diff --git a/DEPS b/DEPS
index 4ec35a8a..34f91a4 100644
--- a/DEPS
+++ b/DEPS
@@ -306,15 +306,15 @@
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling Skia
   # and whatever else without interference from each other.
-  'skia_revision': '550fd51bd2549bce60584b1c1703f6a23868de94',
+  'skia_revision': '0dec6d1823b332fb83edfede730c2fbc0f769ad5',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling V8
   # and whatever else without interference from each other.
-  'v8_revision': '6652d6d5955909e94ad68a7af75aec5cf4abb63d',
+  'v8_revision': 'a27fcf531067692b583d1e358192253a8779df8f',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling ANGLE
   # and whatever else without interference from each other.
-  'angle_revision': '356b2a590e11be18482696ea1d283e975fd612d2',
+  'angle_revision': '12fa46f07dfcb26fc5342f94b77430e30e46deee',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling SwiftShader
   # and whatever else without interference from each other.
@@ -322,7 +322,7 @@
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling PDFium
   # and whatever else without interference from each other.
-  'pdfium_revision': 'd5356204ae6c8a4f699a93387dd7ae1c3daff234',
+  'pdfium_revision': '5a84ee63078c2903c1dd1d5857b4a5e5f614d200',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling BoringSSL
   # and whatever else without interference from each other.
@@ -333,7 +333,7 @@
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling Fuchsia sdk
   # and whatever else without interference from each other.
-  'fuchsia_version': 'version:10.20221121.2.1',
+  'fuchsia_version': 'version:10.20221121.3.1',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling google-toolbox-for-mac
   # and whatever else without interference from each other.
@@ -421,11 +421,11 @@
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling feed
   # and whatever else without interference from each other.
-  'dawn_revision': 'be17904ee872a4cbfc52c93040d17c7c8c33fcb7',
+  'dawn_revision': 'edbeeee285d8ce01f5a30b601a7ebdf17e055bf7',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling feed
   # and whatever else without interference from each other.
-  'quiche_revision': 'b2ecec0c06bfe827458fd49330fc837424809e91',
+  'quiche_revision': 'cfff7cf007ecb3dcfee2aceb04cdbf3f7f39272d',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling ios_webkit
   # and whatever else without interference from each other.
@@ -445,7 +445,7 @@
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling nearby
   # and whatever else without interference from each other.
-  'nearby_revision': '8679d3a370087b0da2eea508c3dd4892d14536cc',
+  'nearby_revision': 'a3b6058753fb9f9590194f68e3853c2787fcf279',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling securemessage
   # and whatever else without interference from each other.
@@ -457,7 +457,7 @@
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling feed
   # and whatever else without interference from each other.
-  'cros_components_revision': 'a39db696dcc3922a53561ab58c8b89ae7eda5f9d',
+  'cros_components_revision': 'e751043ca70dbf90721e9792050d1f55d9d81b87',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling feed
   # and whatever else without interference from each other.
@@ -816,7 +816,7 @@
 
   'src/clank': {
     'url': 'https://chrome-internal.googlesource.com/clank/internal/apps.git' + '@' +
-    '670aba050100c55cfc231981b061996105a91c3f',
+    'ddac7683eac3cde09c03d076baea7a89dfa1d96c',
     'condition': 'checkout_android and checkout_src_internal and not checkout_clank_via_src_internal',
   },
 
@@ -1000,7 +1000,7 @@
     'packages': [
       {
           'package': 'chromium/third_party/androidx',
-          'version': 'rcmLvPaPceZwa6euMzenA2gxol6Va8xNr2W9njQb6moC',
+          'version': 'wadwYbL62ON5yAaCD6gfqhvdQa4GugesoP8EXOOWDecC',
       },
     ],
     'condition': 'checkout_android',
@@ -1243,13 +1243,13 @@
   },
 
   'src/third_party/depot_tools':
-    Var('chromium_git') + '/chromium/tools/depot_tools.git' + '@' + 'd06e475934f6496819f88ae0ab6a3a9d3e77ae6d',
+    Var('chromium_git') + '/chromium/tools/depot_tools.git' + '@' + '30e3ce8b1c670be00c4957fe773ffb8ff986ed8f',
 
   'src/third_party/devtools-frontend/src':
     Var('chromium_git') + '/devtools/devtools-frontend' + '@' + Var('devtools_frontend_revision'),
 
   'src/third_party/devtools-frontend-internal': {
-      'url': 'https://chrome-internal.googlesource.com/devtools/devtools-internal.git' + '@' + '241e7aa5d24e5077f5e172d977ea3641300da074',
+      'url': 'https://chrome-internal.googlesource.com/devtools/devtools-internal.git' + '@' + '9ed8aff9da6ca4d2f1384a111a4955d8898adaff',
     'condition': 'checkout_src_internal',
   },
 
@@ -1664,7 +1664,7 @@
   },
 
   'src/third_party/perfetto':
-    Var('android_git') + '/platform/external/perfetto.git' + '@' + '0febe43447933d6b266583f344ad08cd067237de',
+    Var('android_git') + '/platform/external/perfetto.git' + '@' + 'c5fb93e71014315880f4e38620f11cad5cca0a2c',
 
   'src/third_party/perl': {
       'url': Var('chromium_git') + '/chromium/deps/perl.git' + '@' + '6f3e5028eb65d0b4c5fdd792106ac4c84eee1eb3',
@@ -1846,10 +1846,10 @@
     Var('chromium_git') + '/external/khronosgroup/webgl.git' + '@' + 'd1b65aa5a88f6efd900604dfcda840154e9f16e2',
 
   'src/third_party/webgpu-cts/src':
-    Var('chromium_git') + '/external/github.com/gpuweb/cts.git' + '@' + '21a8e06d1079f2df522e1c1d395016bd0675a4c2',
+    Var('chromium_git') + '/external/github.com/gpuweb/cts.git' + '@' + 'a2798bc2c5820f76b5f0504144fb275857e8bab0',
 
   'src/third_party/webrtc':
-    Var('webrtc_git') + '/src.git' + '@' + '538fa813283b96ff8e0b49770b5620d7bf71cdb5',
+    Var('webrtc_git') + '/src.git' + '@' + 'ca0481751d96d9fc65dc221a8de1a9f5de8d1aa5',
 
   # Wuffs' canonical repository is at github.com/google/wuffs, but we use
   # Skia's mirror of Wuffs, the same as in upstream Skia's DEPS file.
@@ -1919,7 +1919,7 @@
     Var('chromium_git') + '/v8/v8.git' + '@' +  Var('v8_revision'),
 
   'src-internal': {
-    'url': 'https://chrome-internal.googlesource.com/chrome/src-internal.git@454147d888a2c175760959a204f91c22c1b34747',
+    'url': 'https://chrome-internal.googlesource.com/chrome/src-internal.git@bf3d84018d3680a32522fade0789908e08ceafb6',
     'condition': 'checkout_src_internal',
   },
 
diff --git a/android_webview/browser/aw_feature_list_creator.cc b/android_webview/browser/aw_feature_list_creator.cc
index f7b81df9..9dee62ab 100644
--- a/android_webview/browser/aw_feature_list_creator.cc
+++ b/android_webview/browser/aw_feature_list_creator.cc
@@ -210,18 +210,18 @@
   std::unique_ptr<variations::SeedResponse> seed;
   base::Time seed_date;  // Initializes to null time.
   if (seed_proto) {
-    seed = std::make_unique<variations::SeedResponse>();
-    seed->data = seed_proto->seed_data();
-    seed->signature = seed_proto->signature();
-    seed->country = seed_proto->country();
-    seed->date = seed_proto->date();
-    seed->is_gzip_compressed = seed_proto->is_gzip_compressed();
-
     // We set the seed fetch time to when the service downloaded the seed rather
     // than base::Time::Now() because we want to compute seed freshness based on
     // the initial download time, which happened in the service at some earlier
     // point.
-    seed_date = base::Time::FromJavaTime(seed->date);
+    seed_date = base::Time::FromJavaTime(seed_proto->date());
+
+    seed = std::make_unique<variations::SeedResponse>();
+    seed->data = seed_proto->seed_data();
+    seed->signature = seed_proto->signature();
+    seed->country = seed_proto->country();
+    seed->date = seed_date;
+    seed->is_gzip_compressed = seed_proto->is_gzip_compressed();
   }
 
   client_ = std::make_unique<AwVariationsServiceClient>();
diff --git a/ash/app_list/app_list_controller_impl_unittest.cc b/ash/app_list/app_list_controller_impl_unittest.cc
index affdcfe..b9f1cdc 100644
--- a/ash/app_list/app_list_controller_impl_unittest.cc
+++ b/ash/app_list/app_list_controller_impl_unittest.cc
@@ -663,7 +663,7 @@
   ShowAppListNow(AppListViewState::kFullscreenAllApps);
   PagedAppsGridView* apps_grid_view = GetAppsGridView();
   test::AppsGridViewTestApi test_api(apps_grid_view);
-  PopulateItem(test_api.TilesPerPage(0));
+  PopulateItem(test_api.TilesPerPageInPagedGrid(0));
   EXPECT_EQ(1, apps_grid_view->pagination_model()->total_pages());
 
   // Add an extra item and verify that the page count is 2 now.
diff --git a/ash/app_list/app_list_presenter_unittest.cc b/ash/app_list/app_list_presenter_unittest.cc
index 68af6513..c25dc0a 100644
--- a/ash/app_list/app_list_presenter_unittest.cc
+++ b/ash/app_list/app_list_presenter_unittest.cc
@@ -2120,7 +2120,7 @@
 // (e.g. on screen rotation).
 TEST_F(PopulatedAppListTest, CancelItemDragOnMouseCaptureLoss) {
   InitializeAppsGrid();
-  PopulateApps(apps_grid_test_api_->TilesPerPage(0) + 1);
+  PopulateApps(apps_grid_test_api_->TilesPerPageInPagedGrid(0) + 1);
 
   AppListItemView* const dragged_view = apps_grid_view_->GetItemViewAt(0);
 
@@ -2406,7 +2406,7 @@
   UpdateDisplay("1200x600");
 
   InitializeAppsGrid();
-  PopulateApps(apps_grid_test_api_->TilesPerPage(0) + 1);
+  PopulateApps(apps_grid_test_api_->TilesPerPageInPagedGrid(0) + 1);
 
   AppListItemView* const dragged_view = apps_grid_view_->GetItemViewAt(0);
 
@@ -2448,8 +2448,8 @@
   UpdateDisplay("1200x600");
 
   InitializeAppsGrid();
-  PopulateApps(apps_grid_test_api_->TilesPerPage(0) +
-               apps_grid_test_api_->TilesPerPage(1));
+  PopulateApps(apps_grid_test_api_->TilesPerPageInPagedGrid(0) +
+               apps_grid_test_api_->TilesPerPageInPagedGrid(1));
 
   AppListItemView* const dragged_view = apps_grid_view_->GetItemViewAt(0);
 
diff --git a/ash/app_list/paged_view_structure.cc b/ash/app_list/paged_view_structure.cc
index 4850c9c..d52dd0f4 100644
--- a/ash/app_list/paged_view_structure.cc
+++ b/ash/app_list/paged_view_structure.cc
@@ -64,7 +64,7 @@
   // Copy the view model to N full pages.
   for (size_t i = 0; i < view_model->view_size(); ++i) {
     if (pages_.back().size() ==
-        static_cast<size_t>(TilesPerPage(pages_.size() - 1))) {
+        static_cast<size_t>(*TilesPerPage(pages_.size() - 1))) {
       pages_.emplace_back();
     }
     pages_.back().push_back(view_model->view_at(i));
@@ -117,8 +117,8 @@
     return GridIndex(0, model_index);
 
   int current_page = 0;
-  while (model_index >= TilesPerPage(current_page)) {
-    model_index -= TilesPerPage(current_page);
+  while (model_index >= *TilesPerPage(current_page)) {
+    model_index -= *TilesPerPage(current_page);
     ++current_page;
   }
   return GridIndex(current_page, model_index);
@@ -132,7 +132,7 @@
 
   int model_index = 0;
   for (int i = 0; i < index.page; i++) {
-    model_index += TilesPerPage(i);
+    model_index += *TilesPerPage(i);
   }
   model_index += index.slot;
   return model_index;
@@ -159,7 +159,7 @@
   if (page_index == apps_grid_view_->GetTotalPages() - 1)
     return GetLastTargetIndex();
 
-  return GridIndex(page_index, TilesPerPage(page_index) - 1);
+  return GridIndex(page_index, *TilesPerPage(page_index) - 1);
 }
 
 int PagedViewStructure::GetTargetModelIndexForMove(
@@ -198,8 +198,12 @@
 bool PagedViewStructure::IsFullPage(int page_index) const {
   if (page_index >= total_pages())
     return false;
-  return static_cast<int>(pages_[page_index].size()) ==
-         TilesPerPage(page_index);
+
+  const absl::optional<int> tiles_per_page = TilesPerPage(page_index);
+  if (!tiles_per_page)
+    return false;
+
+  return static_cast<int>(pages_[page_index].size()) == *tiles_per_page;
 }
 
 void PagedViewStructure::Sanitize() {
@@ -210,6 +214,9 @@
 }
 
 void PagedViewStructure::ClearOverflow() {
+  if (mode_ == Mode::kSinglePage)
+    return;
+
   std::vector<AppListItemView*> overflow_views;
   auto iter = pages_.begin();
   while (iter != pages_.end() || !overflow_views.empty()) {
@@ -220,7 +227,7 @@
     }
 
     const size_t max_item_views =
-        TilesPerPage(static_cast<int>(iter - pages_.begin()));
+        *TilesPerPage(static_cast<int>(iter - pages_.begin()));
     auto& page = *iter;
 
     if (!overflow_views.empty()) {
@@ -252,7 +259,7 @@
   }
 }
 
-int PagedViewStructure::TilesPerPage(int page) const {
+absl::optional<int> PagedViewStructure::TilesPerPage(int page) const {
   return apps_grid_view_->TilesPerPage(page);
 }
 
diff --git a/ash/app_list/paged_view_structure.h b/ash/app_list/paged_view_structure.h
index 9bc4f57..c28671bf 100644
--- a/ash/app_list/paged_view_structure.h
+++ b/ash/app_list/paged_view_structure.h
@@ -10,6 +10,7 @@
 
 #include "ash/ash_export.h"
 #include "base/check_op.h"
+#include "third_party/abseil-cpp/absl/types/optional.h"
 
 namespace ash {
 
@@ -130,7 +131,7 @@
   void ClearEmptyPages();
 
   // Returns TilesPerPage() from `apps_grid_view_`.
-  int TilesPerPage(int page) const;
+  absl::optional<int> TilesPerPage(int page) const;
 
   // Not const for tests.
   Mode mode_ = Mode::kFullPages;
diff --git a/ash/app_list/views/app_list_view_unittest.cc b/ash/app_list/views/app_list_view_unittest.cc
index eda22d8..910be63 100644
--- a/ash/app_list/views/app_list_view_unittest.cc
+++ b/ash/app_list/views/app_list_view_unittest.cc
@@ -1224,14 +1224,14 @@
   apps_grid_view()->pagination_model()->SelectPage(1, false);
 
   // Test that focus followed to the next page.
-  EXPECT_EQ(view_model->view_at(test_api()->TilesPerPage(0)),
+  EXPECT_EQ(view_model->view_at(test_api()->TilesPerPageInPagedGrid(0)),
             apps_grid_view()->selected_view());
 
   // Select the first page.
   apps_grid_view()->pagination_model()->SelectPage(0, false);
 
   // Test that focus followed.
-  EXPECT_EQ(view_model->view_at(test_api()->TilesPerPage(0) - 1),
+  EXPECT_EQ(view_model->view_at(test_api()->TilesPerPageInPagedGrid(0) - 1),
             apps_grid_view()->selected_view());
 }
 
diff --git a/ash/app_list/views/apps_grid_view.cc b/ash/app_list/views/apps_grid_view.cc
index 7dddf442..968e632a 100644
--- a/ash/app_list/views/apps_grid_view.cc
+++ b/ash/app_list/views/apps_grid_view.cc
@@ -1166,12 +1166,12 @@
   int existing_items = item_list_ ? item_list_->item_count() : 0;
   const int tablet_page_size =
       SharedAppListConfig::instance().GetMaxNumOfItemsPerPage();
-  // For scrolling app list, the "page size" is very large, so cap the number of
-  // pulsing blocks to the size of the tablet mode page (~20 items).
-  const int tiles_per_page = std::min(TilesPerPage(1), tablet_page_size);
+  // For scrolling app list, the "page size" is not defined, so cap the number
+  // of pulsing blocks to the size of the legacy tablet mode page (~20 items).
+  const int tiles_per_page = TilesPerPage(1).value_or(tablet_page_size);
   if (view_structure_.mode() != PagedViewStructure::Mode::kSinglePage) {
-    if (existing_items > TilesPerPage(0))
-      existing_items -= TilesPerPage(0);
+    if (existing_items > *TilesPerPage(0))
+      existing_items -= *TilesPerPage(0);
   }
   const size_t available_slots =
       tiles_per_page - (existing_items % tiles_per_page);
@@ -1247,20 +1247,11 @@
   return GetItemViewAt(model_index);
 }
 
-int AppsGridView::TilesPerPage(int page) const {
-  const int max_rows = GetMaxRowsInPage(page);
-
-  // In folders, the grid size depends on the number of items in the page.
-  if (IsInFolder()) {
-    // Leave room for at least one item.
-    if (!view_model()->view_size())
-      return 1;
-
-    int rows = (view_model()->view_size() - 1) / cols() + 1;
-    return std::min(max_rows, rows) * cols();
-  }
-
-  return max_rows * cols();
+absl::optional<int> AppsGridView::TilesPerPage(int page) const {
+  const absl::optional<int> max_rows = GetMaxRowsInPage(page);
+  if (!max_rows.has_value())
+    return absl::nullopt;
+  return *max_rows * cols();
 }
 
 void AppsGridView::SetMaxColumnsInternal(int max_cols) {
@@ -2496,9 +2487,11 @@
   GridIndex start_index(GetSelectedPage(), 0);
   if (!IsValidIndex(start_index))
     return;
-  size_t start = view_structure_.GetModelIndexFromIndex(start_index);
-  size_t end =
-      std::min(view_model_.view_size(), start + TilesPerPage(start_index.page));
+  const size_t start = view_structure_.GetModelIndexFromIndex(start_index);
+  const absl::optional<int> tiles_per_page = TilesPerPage(start_index.page);
+  const size_t end = tiles_per_page ? std::min(view_model_.view_size(),
+                                               start + *tiles_per_page)
+                                    : view_model_.view_size();
   for (size_t i = start; i < end; ++i)
     GetItemViewAt(i)->CancelContextMenu();
 }
@@ -2691,11 +2684,12 @@
       cols_ - 1);
 
   DCHECK_GT(total_tile_size.height(), 0);
-  int max_row = TilesPerPage(current_page) / cols_ - 1;
-  int row = base::clamp(
-      (point.y() - bounds.y() - grid_offset.y()) / total_tile_size.height(), 0,
-      max_row);
-
+  const int ideal_row =
+      (point.y() - bounds.y() - grid_offset.y()) / total_tile_size.height();
+  const absl::optional<int> tiles_per_page = TilesPerPage(current_page);
+  const int row = tiles_per_page
+                      ? base::clamp(ideal_row, 0, *tiles_per_page / cols_ - 1)
+                      : std::max(ideal_row, 0);
   return GridIndex(current_page, row * cols_ + col);
 }
 
@@ -2821,34 +2815,16 @@
   } else if (target_row > (GetNumberOfItemsOnPage(target_page) - 1) / cols_) {
     // The app will move to the first row of the next page.
     ++target_page;
-    if (folder_delegate_) {
-      if (target_page >= GetTotalPages())
-        return source_index;
-    } else {
-      if (target_page >= view_structure_.total_pages()) {
-        // If |source_index| page only has one item, moving down to a new page
-        // should be a no-op.
-        if (view_structure_.items_on_page(source_index.page) == 1)
-          return source_index;
-        return GridIndex(target_page, 0);
-      }
-    }
+    if (target_page >= GetTotalPages())
+      return source_index;
     target_row = 0;
   }
 
   // The ideal slot shares a column with |source_index|.
   const int ideal_slot = target_row * cols_ + source_index.slot % cols_;
-  if (folder_delegate_) {
-    return GridIndex(
-        target_page,
-        std::min(GetNumberOfItemsOnPage(target_page) - 1, ideal_slot));
-  }
-
-  // If the app is being moved to a new page there is 1 extra slot available.
-  const int last_slot_in_target_page =
-      view_structure_.items_on_page(target_page) -
-      (source_index.page != target_page ? 0 : 1);
-  return GridIndex(target_page, std::min(last_slot_in_target_page, ideal_slot));
+  return GridIndex(
+      target_page,
+      std::min(GetNumberOfItemsOnPage(target_page) - 1, ideal_slot));
 }
 
 GridIndex AppsGridView::GetTargetGridIndexForKeyboardReparent(
@@ -2883,10 +2859,15 @@
   // Ensure the item is placed on the same page as the folder when possible.
   if (target_index.page < folder_index.page)
     return folder_index;
-  const int folder_page_size = TilesPerPage(folder_index.page);
-  if (target_index.page > folder_index.page &&
-      folder_index.slot + 1 < folder_page_size) {
-    return GridIndex(folder_index.page, folder_index.slot + 1);
+
+  if (target_index.page > folder_index.page) {
+    const absl::optional<int> folder_page_size =
+        TilesPerPage(folder_index.page);
+    // Target index page being at least 1 indicates paged apps grid, so number
+    // of tiles per page should be bounded.
+    DCHECK(folder_page_size);
+    if (folder_index.slot + 1 < *folder_page_size)
+      return GridIndex(folder_index.page, folder_index.slot + 1);
   }
 
   return target_index;
@@ -2948,8 +2929,9 @@
 }
 
 bool AppsGridView::IsValidIndex(const GridIndex& index) const {
+  const absl::optional<int> tiles_per_page = TilesPerPage(index.page);
   return index.page >= 0 && index.page < GetTotalPages() && index.slot >= 0 &&
-         index.slot < TilesPerPage(index.page) &&
+         (!tiles_per_page || index.slot < *tiles_per_page) &&
          static_cast<size_t>(view_structure_.GetModelIndexFromIndex(index)) <
              view_model_.view_size();
 }
@@ -2972,13 +2954,18 @@
 
   // We are guaranteed not on the last page, so the page must be full.
   if (page < GetTotalPages() - 1)
-    return TilesPerPage(page);
+    return *TilesPerPage(page);
 
   // We are on the last page, so calculate the number of items on the page.
   size_t item_count = view_model_.view_size();
   int current_page = 0;
   while (current_page < GetTotalPages() - 1) {
-    item_count -= TilesPerPage(current_page);
+    absl::optional<int> tiles_per_page = TilesPerPage(current_page);
+    // `current_page` not being the last page implies a paged apps grid view,
+    // as the grid has more than one page. For paged apps grid view,
+    // `TilesPerPage()` should be defined.
+    DCHECK(tiles_per_page);
+    item_count -= *tiles_per_page;
     ++current_page;
   }
   return item_count;
diff --git a/ash/app_list/views/apps_grid_view.h b/ash/app_list/views/apps_grid_view.h
index 0580243e..65c58e9 100644
--- a/ash/app_list/views/apps_grid_view.h
+++ b/ash/app_list/views/apps_grid_view.h
@@ -24,6 +24,7 @@
 #include "ash/ash_export.h"
 #include "base/time/time.h"
 #include "base/timer/timer.h"
+#include "third_party/abseil-cpp/absl/types/optional.h"
 #include "ui/base/metadata/metadata_header_macros.h"
 #include "ui/compositor/throughput_tracker.h"
 #include "ui/events/keycodes/keyboard_codes_posix.h"
@@ -394,8 +395,10 @@
   // Returns the size of the entire tile grid.
   virtual gfx::Size GetTileGridSize() const = 0;
 
-  // Returns the max number of rows the grid can have on a page.
-  virtual int GetMaxRowsInPage(int page) const = 0;
+  // Returns the max number of rows the grid can have on a page. Returns nullopt
+  // if apps grid does not have limit on number of rows (which currently implies
+  // scrollable, single-page apps grid).
+  virtual absl::optional<int> GetMaxRowsInPage(int page) const = 0;
 
   // Calculates the offset distance to center the grid in the container.
   virtual gfx::Vector2d GetGridCenteringOffset(int page) const = 0;
@@ -471,9 +474,10 @@
   gfx::Rect GetExpectedTileBounds(const GridIndex& index) const;
 
   // Returns the number of app tiles per page. Takes a page number as an
-  // argument as the first page might have less apps shown. Folder grids may
-  // have different numbers of tiles from the main grid.
-  int TilesPerPage(int page) const;
+  // argument as the first page might have less apps shown.
+  // Returns nullopt if number of tiles per page is not limited (which currently
+  // implies scrollable, single-page apps grid).
+  absl::optional<int> TilesPerPage(int page) const;
 
   GridIndex GetIndexOfView(const AppListItemView* view) const;
   AppListItemView* GetViewAtIndex(const GridIndex& index) const;
diff --git a/ash/app_list/views/apps_grid_view_test_api.cc b/ash/app_list/views/apps_grid_view_test_api.cc
index dbe31c5..05e4e60 100644
--- a/ash/app_list/views/apps_grid_view_test_api.cc
+++ b/ash/app_list/views/apps_grid_view_test_api.cc
@@ -54,8 +54,13 @@
       ui::KeyEvent(ui::ET_KEY_PRESSED, ui::VKEY_RETURN, ui::EF_NONE));
 }
 
-size_t AppsGridViewTestApi::TilesPerPage(int page) const {
-  return view_->TilesPerPage(page);
+size_t AppsGridViewTestApi::TilesPerPageInPagedGrid(int page) const {
+  return *view_->TilesPerPage(page);
+}
+
+size_t AppsGridViewTestApi::TilesPerPageOr(int page,
+                                           size_t default_value) const {
+  return view_->TilesPerPage(page).value_or(default_value);
 }
 
 int AppsGridViewTestApi::AppsOnPage(int page) const {
diff --git a/ash/app_list/views/apps_grid_view_test_api.h b/ash/app_list/views/apps_grid_view_test_api.h
index 6ad77f8..3d4851a 100644
--- a/ash/app_list/views/apps_grid_view_test_api.h
+++ b/ash/app_list/views/apps_grid_view_test_api.h
@@ -48,7 +48,15 @@
 
   void PressItemAt(int index);
 
-  size_t TilesPerPage(int page) const;
+  // Returns the number of tiles per page in paged apps grid. It should not be
+  // called for scrollable apps grid, in which case number of tiles per page is
+  // not defined.
+  size_t TilesPerPageInPagedGrid(int page) const;
+
+  // Returns number of tiles allowed on the page for paged apps grid, or
+  // `default_value` for scrollable apps grid, for which number of tiles per
+  // page is not defined.
+  size_t TilesPerPageOr(int page, size_t default_value) const;
 
   int AppsOnPage(int page) const;
 
diff --git a/ash/app_list/views/apps_grid_view_unittest.cc b/ash/app_list/views/apps_grid_view_unittest.cc
index ec7bee8..f93fcb6 100644
--- a/ash/app_list/views/apps_grid_view_unittest.cc
+++ b/ash/app_list/views/apps_grid_view_unittest.cc
@@ -414,8 +414,12 @@
     return test_api_->GetItemTileRectOnCurrentPageAt(row, col);
   }
 
-  size_t GetTilesPerPage(int page) const {
-    return test_api_->TilesPerPage(page);
+  size_t GetTilesPerPageInPagedGrid(int page) const {
+    return test_api_->TilesPerPageInPagedGrid(page);
+  }
+
+  size_t GetTilesPerPageOr(int page, size_t default_value) const {
+    return test_api_->TilesPerPageOr(page, default_value);
   }
 
   PaginationModel* GetPaginationModel() const {
@@ -859,7 +863,7 @@
 // reorder placeholder is changed during drag.
 TEST_P(AppsGridViewTabletTest, BetweenRowsAnimationOnDragToPreviousPage) {
   ASSERT_TRUE(paged_apps_grid_view_);
-  model_->PopulateApps(GetTilesPerPage(0) + 15);
+  model_->PopulateApps(GetTilesPerPageInPagedGrid(0) + 15);
   UpdateLayout();
 
   GetPaginationModel()->SelectPage(1 /*page*/, false /*animate*/);
@@ -909,7 +913,7 @@
     AppListItemView* item_view = view_model->view_at(i);
     // The first item and items off screen on the second page should not
     // animate.
-    if (i == 0 || i > GetTilesPerPage(0) + 1) {
+    if (i == 0 || i > GetTilesPerPageInPagedGrid(0) + 1) {
       EXPECT_FALSE(apps_grid_view_->IsAnimatingView(item_view));
       continue;
     }
@@ -980,7 +984,7 @@
 // the first row. This causes the between rows animation to reverse.
 TEST_P(AppsGridViewTabletTest, BetweenRowsAnimationReversal) {
   ASSERT_TRUE(paged_apps_grid_view_);
-  model_->PopulateApps(GetTilesPerPage(0));
+  model_->PopulateApps(GetTilesPerPageInPagedGrid(0));
   UpdateLayout();
 
   // Use non-zero animations to test that animations are correct while in
@@ -1274,7 +1278,7 @@
        OnGestureEventScrollSequenceHandleByPaginationController) {
   base::HistogramTester histogram_tester;
 
-  model_->PopulateApps(GetTilesPerPage(0) + 1);
+  model_->PopulateApps(GetTilesPerPageInPagedGrid(0) + 1);
   UpdateLayout();
   EXPECT_EQ(2, GetPaginationModel()->total_pages());
 
@@ -1348,31 +1352,26 @@
   test_api_->PressItemAt(0);
   EXPECT_EQ(2u, items_grid_view->view_model()->view_size());
   EXPECT_EQ(2, items_grid_view->cols());
-  EXPECT_EQ(2u, folder_grid_test_api.TilesPerPage(0));
   app_list_folder_view()->CloseFolderPage();
 
   test_api_->PressItemAt(1);
   EXPECT_EQ(5u, items_grid_view->view_model()->view_size());
   EXPECT_EQ(3, items_grid_view->cols());
-  EXPECT_EQ(6u, folder_grid_test_api.TilesPerPage(0));
   app_list_folder_view()->CloseFolderPage();
 
   test_api_->PressItemAt(2);
   EXPECT_EQ(9u, items_grid_view->view_model()->view_size());
   EXPECT_EQ(3, items_grid_view->cols());
-  EXPECT_EQ(9u, folder_grid_test_api.TilesPerPage(0));
   app_list_folder_view()->CloseFolderPage();
 
   test_api_->PressItemAt(3);
   EXPECT_EQ(15u, items_grid_view->view_model()->view_size());
   EXPECT_EQ(4, items_grid_view->cols());
-  EXPECT_EQ(16u, folder_grid_test_api.TilesPerPage(0));
   app_list_folder_view()->CloseFolderPage();
 
   test_api_->PressItemAt(4);
   EXPECT_EQ(17u, items_grid_view->view_model()->view_size());
   EXPECT_EQ(4, items_grid_view->cols());
-  EXPECT_EQ(20u, folder_grid_test_api.TilesPerPage(0));
   app_list_folder_view()->CloseFolderPage();
 }
 
@@ -1497,7 +1496,7 @@
 
 // Tests that the context menu for app item appears at the right position.
 TEST_P(AppsGridViewTabletTest, MenuAtRightPosition) {
-  const size_t kItemsInPage = GetTilesPerPage(0);
+  const size_t kItemsInPage = GetTilesPerPageInPagedGrid(0);
   const size_t kPages = 2;
   model_->PopulateApps(kItemsInPage * kPages);
   UpdateLayout();
@@ -2662,7 +2661,8 @@
 // at the destination slot moving to the source slot (ie. a swap).
 TEST_P(AppsGridViewTabletTest, ControlArrowSwapsBetweenFullPages) {
   const int kPages = 3;
-  model_->PopulateApps(GetTilesPerPage(0) + (kPages - 1) * GetTilesPerPage(1));
+  model_->PopulateApps(GetTilesPerPageInPagedGrid(0) +
+                       (kPages - 1) * GetTilesPerPageInPagedGrid(1));
 
   // For every item in the first row, ensure an upward move results in the item
   // swapping places with the item directly above it.
@@ -2673,7 +2673,7 @@
         test_api_->GetViewAtIndex(moved_view_index));
 
     const GridIndex swapped_view_index(
-        0, GetTilesPerPage(0) - apps_grid_view_->cols() + i);
+        0, GetTilesPerPageInPagedGrid(0) - apps_grid_view_->cols() + i);
     AppListItemView* moved_view = test_api_->GetViewAtIndex(moved_view_index);
     AppListItemView* swapped_view =
         test_api_->GetViewAtIndex(swapped_view_index);
@@ -2692,7 +2692,7 @@
   for (int i = 0; i < apps_grid_view_->cols(); ++i) {
     GetPaginationModel()->SelectPage(0, false /*animate*/);
     const GridIndex moved_view_index(
-        0, GetTilesPerPage(0) - apps_grid_view_->cols() + i);
+        0, GetTilesPerPageInPagedGrid(0) - apps_grid_view_->cols() + i);
     apps_grid_view_->GetFocusManager()->SetFocusedView(
         test_api_->GetViewAtIndex(moved_view_index));
 
@@ -2713,7 +2713,7 @@
   // For the final item on the first page, moving right to a full page should
   // swap with the first item on the next page.
   GetPaginationModel()->SelectPage(0, false /*animate*/);
-  GridIndex moved_view_index(0, GetTilesPerPage(0) - 1);
+  GridIndex moved_view_index(0, GetTilesPerPageInPagedGrid(0) - 1);
   GridIndex swapped_view_index(1, 0);
   AppListItemView* moved_view = test_api_->GetViewAtIndex(moved_view_index);
   AppListItemView* swapped_view = test_api_->GetViewAtIndex(swapped_view_index);
@@ -2747,7 +2747,8 @@
 TEST_P(AppsGridViewClamshellAndTabletTest,
        ControlArrowDownOnLastAppOnLastPage) {
   base::HistogramTester histogram_tester;
-  const int kItemCount = paged_apps_grid_view_ ? GetTilesPerPage(0) + 1 : 21;
+  const int kItemCount =
+      paged_apps_grid_view_ ? GetTilesPerPageInPagedGrid(0) + 1 : 21;
   model_->PopulateApps(kItemCount);
   AppListItemView* moving_item = GetItemViewInTopLevelGrid(kItemCount - 1);
   apps_grid_view_->GetFocusManager()->SetFocusedView(moving_item);
@@ -2945,14 +2946,15 @@
 
 // Tests that foldering an item that is on a different page fails.
 TEST_P(AppsGridViewTabletTest, ControlShiftArrowFailsToFolderAcrossPages) {
-  model_->PopulateApps(GetTilesPerPage(0) + GetTilesPerPage(1));
+  model_->PopulateApps(GetTilesPerPageInPagedGrid(0) +
+                       GetTilesPerPageInPagedGrid(1));
   UpdateLayout();
 
   // For every item on the last row of the first page, test that foldering to
   // the next page fails.
   for (int i = 0; i < apps_grid_view_->cols(); ++i) {
     const GridIndex moved_view_index(
-        0, GetTilesPerPage(0) - apps_grid_view_->cols() + i);
+        0, GetTilesPerPageInPagedGrid(0) - apps_grid_view_->cols() + i);
     AppListItemView* attempted_folder_view =
         test_api_->GetViewAtIndex(moved_view_index);
     apps_grid_view_->GetFocusManager()->SetFocusedView(attempted_folder_view);
@@ -2967,7 +2969,7 @@
   {
     // The last item on the col is selected, try moving right and test that that
     // fails as well.
-    GridIndex moved_view_index(0, GetTilesPerPage(0) - 1);
+    GridIndex moved_view_index(0, GetTilesPerPageInPagedGrid(0) - 1);
     AppListItemView* attempted_folder_view =
         test_api_->GetViewAtIndex(moved_view_index);
 
@@ -3013,9 +3015,10 @@
   // Create grid with a folder on the last slot in a page (or for scrollable
   // grid, the last slot in the page with enough items that the slot is
   // initially not in the visible part of the grid).
-  const int kTopLevelItemCount = paged_apps_grid_view_
-                                     ? GetTilesPerPage(0) + GetTilesPerPage(1)
-                                     : apps_grid_view_->cols() * 8;
+  const int kTopLevelItemCount =
+      paged_apps_grid_view_
+          ? GetTilesPerPageInPagedGrid(0) + GetTilesPerPageInPagedGrid(1)
+          : apps_grid_view_->cols() * 8;
   model_->PopulateApps(kTopLevelItemCount - 1);
   const AppListFolderItem* folder_item =
       model_->CreateAndPopulateFolderWithApps(3);
@@ -3080,9 +3083,10 @@
   // Create grid with a folder on the last slot in a page (or for scrollable
   // grid, the last slot in the page with enough items that the slot is
   // initially not in the visible part of the grid).
-  const int kTopLevelItemCount = paged_apps_grid_view_
-                                     ? GetTilesPerPage(0) + GetTilesPerPage(1)
-                                     : apps_grid_view_->cols() * 8;
+  const int kTopLevelItemCount =
+      paged_apps_grid_view_
+          ? GetTilesPerPageInPagedGrid(0) + GetTilesPerPageInPagedGrid(1)
+          : apps_grid_view_->cols() * 8;
   model_->PopulateApps(kTopLevelItemCount - 1);
   const AppListFolderItem* folder_item =
       model_->CreateAndPopulateFolderWithApps(3);
@@ -3143,15 +3147,15 @@
 
 TEST_P(AppsGridViewTabletTest,
        KeyboardReparentFromFolderPrefersLeavingMovedItemOnCurrentPage) {
-  model_->PopulateApps(GetTilesPerPage(0) - 2);
+  model_->PopulateApps(GetTilesPerPageInPagedGrid(0) - 2);
   const AppListFolderItem* folder_item =
       model_->CreateAndPopulateFolderWithApps(3);
-  model_->PopulateApps(GetTilesPerPage(1));
+  model_->PopulateApps(GetTilesPerPageInPagedGrid(1));
   const std::string folder_id = folder_item->id();
   UpdateLayout();
 
-  AppListItemView* folder_view =
-      test_api_->GetViewAtIndex(GridIndex(0, GetTilesPerPage(0) - 2));
+  AppListItemView* folder_view = test_api_->GetViewAtIndex(
+      GridIndex(0, GetTilesPerPageInPagedGrid(0) - 2));
   ASSERT_TRUE(folder_view->is_folder());
   folder_view->RequestFocus();
   const gfx::Rect original_folder_view_bounds =
@@ -3169,7 +3173,7 @@
   ASSERT_TRUE(reparented_item_view->item());
 
   std::string reparented_item_id = reparented_item_view->item()->id();
-  EXPECT_EQ("Item " + base::NumberToString(GetTilesPerPage(0) - 2),
+  EXPECT_EQ("Item " + base::NumberToString(GetTilesPerPageInPagedGrid(0) - 2),
             reparented_item_id);
   ASSERT_TRUE(reparented_item_view->HasFocus());
 
@@ -3181,8 +3185,8 @@
   ASSERT_EQ(folder_item, model_->FindItem(folder_id));
   EXPECT_EQ(2u, folder_item->ChildItemCount());
 
-  const AppListItemView* last_item_on_first_page =
-      test_api_->GetViewAtIndex(GridIndex(0, GetTilesPerPage(0) - 1));
+  const AppListItemView* last_item_on_first_page = test_api_->GetViewAtIndex(
+      GridIndex(0, GetTilesPerPageInPagedGrid(0) - 1));
   // Verify the view is within visible grid bounds, and that it has focus.
   EXPECT_EQ(reparented_item_id, last_item_on_first_page->item()->id());
   EXPECT_TRUE(apps_grid_view_->GetWidget()->GetWindowBoundsInScreen().Contains(
@@ -3250,8 +3254,9 @@
   ASSERT_TRUE(paged_apps_grid_view_);
 
   // Create 3 full pages of apps.
-  model_->PopulateApps(GetTilesPerPage(0) + GetTilesPerPage(1) +
-                       GetTilesPerPage(2));
+  model_->PopulateApps(GetTilesPerPageInPagedGrid(0) +
+                       GetTilesPerPageInPagedGrid(1) +
+                       GetTilesPerPageInPagedGrid(2));
   UpdateLayout();
 
   const gfx::Rect apps_grid_bounds = paged_apps_grid_view_->GetLocalBounds();
@@ -3287,7 +3292,7 @@
   ASSERT_TRUE(paged_apps_grid_view_);
 
   // Create a full page and a partially full second page.
-  model_->PopulateApps(GetTilesPerPage(0) + 3);
+  model_->PopulateApps(GetTilesPerPageInPagedGrid(0) + 3);
   UpdateLayout();
 
   // Drag an item from the first page to the last existing slot on the next
@@ -3296,7 +3301,7 @@
       apps_grid_view_->view_model();
   AppListItemView* dragged_view = view_model->view_at(0);
   AppListItemView* original_first_item_on_second_page =
-      view_model->view_at(GetTilesPerPage(0));
+      view_model->view_at(GetTilesPerPageInPagedGrid(0));
 
   auto* generator = GetEventGenerator();
 
@@ -3380,7 +3385,7 @@
   // The first item on second page should have been moved to the first page (to
   // fill up the empty slot left by moving the draggged item away).
   AppListItemView* last_item_on_first_page =
-      test_api_->GetViewAtVisualIndex(0, GetTilesPerPage(0) - 1);
+      test_api_->GetViewAtVisualIndex(0, GetTilesPerPageInPagedGrid(0) - 1);
   ASSERT_TRUE(last_item_on_first_page);
   EXPECT_EQ(original_first_item_on_second_page->item()->id(),
             last_item_on_first_page->item()->id());
@@ -3390,14 +3395,14 @@
   ASSERT_TRUE(paged_apps_grid_view_);
 
   // Create a full page and a partially full second page.
-  model_->PopulateApps(GetTilesPerPage(0) + 3);
+  model_->PopulateApps(GetTilesPerPageInPagedGrid(0) + 3);
   UpdateLayout();
 
   const views::ViewModelT<AppListItemView>* view_model =
       apps_grid_view_->view_model();
   AppListItemView* dragged_view = view_model->view_at(0);
   AppListItemView* original_first_item_on_second_page =
-      view_model->view_at(GetTilesPerPage(0));
+      view_model->view_at(GetTilesPerPageInPagedGrid(0));
 
   auto* generator = GetEventGenerator();
 
@@ -3504,7 +3509,7 @@
   // The first item on second page should have been moved to the first page (to
   // fill up the empty slot left by moving the draggged item away).
   AppListItemView* last_item_on_first_page =
-      test_api_->GetViewAtVisualIndex(0, GetTilesPerPage(0) - 1);
+      test_api_->GetViewAtVisualIndex(0, GetTilesPerPageInPagedGrid(0) - 1);
   ASSERT_TRUE(last_item_on_first_page);
   EXPECT_EQ(original_first_item_on_second_page->item()->id(),
             last_item_on_first_page->item()->id());
@@ -3515,7 +3520,8 @@
   ASSERT_TRUE(paged_apps_grid_view_);
 
   // Create 2 full pages of apps, and add another app to overflow to third page.
-  const size_t kTotalApps = GetTilesPerPage(0) + GetTilesPerPage(1) + 1;
+  const size_t kTotalApps =
+      GetTilesPerPageInPagedGrid(0) + GetTilesPerPageInPagedGrid(1) + 1;
   model_->PopulateApps(kTotalApps);
   EXPECT_EQ(3, GetPaginationModel()->total_pages());
 
@@ -3524,7 +3530,10 @@
   // change between landscape and portrait mode).
   UpdateDisplay("1024x768/r");
 
-  EXPECT_EQ(kTotalApps <= GetTilesPerPage(0) + GetTilesPerPage(1) ? 2 : 3,
+  EXPECT_EQ(kTotalApps <= GetTilesPerPageInPagedGrid(0) +
+                              GetTilesPerPageInPagedGrid(1)
+                ? 2
+                : 3,
             GetPaginationModel()->total_pages());
 }
 
@@ -3533,7 +3542,8 @@
   ASSERT_TRUE(paged_apps_grid_view_);
 
   // Create 2 full pages of apps, and add another app to overflow to third page.
-  const size_t kTotalApps = GetTilesPerPage(0) + GetTilesPerPage(1) - 1;
+  const size_t kTotalApps =
+      GetTilesPerPageInPagedGrid(0) + GetTilesPerPageInPagedGrid(1) - 1;
   model_->PopulateApps(kTotalApps);
   EXPECT_EQ(2, GetPaginationModel()->total_pages());
 
@@ -3542,7 +3552,10 @@
   // may change between landscape and portrait mode).
   UpdateDisplay("1024x768/r");
 
-  EXPECT_EQ(kTotalApps <= GetTilesPerPage(0) + GetTilesPerPage(1) ? 2 : 3,
+  EXPECT_EQ(kTotalApps <= GetTilesPerPageInPagedGrid(0) +
+                              GetTilesPerPageInPagedGrid(1)
+                ? 2
+                : 3,
             GetPaginationModel()->total_pages());
 }
 
@@ -3552,7 +3565,8 @@
   UpdateDisplay("1024x768/r");
 
   // Create 2 full pages of apps, and add another app to overflow to third page.
-  const size_t kTotalApps = GetTilesPerPage(0) + GetTilesPerPage(1) + 1;
+  const size_t kTotalApps =
+      GetTilesPerPageInPagedGrid(0) + GetTilesPerPageInPagedGrid(1) + 1;
   model_->PopulateApps(kTotalApps);
   EXPECT_EQ(3, GetPaginationModel()->total_pages());
 
@@ -3561,7 +3575,10 @@
   // change between landscape and portrait mode).
   UpdateDisplay("1024x768");
 
-  EXPECT_EQ(kTotalApps <= GetTilesPerPage(0) + GetTilesPerPage(1) ? 2 : 3,
+  EXPECT_EQ(kTotalApps <= GetTilesPerPageInPagedGrid(0) +
+                              GetTilesPerPageInPagedGrid(1)
+                ? 2
+                : 3,
             GetPaginationModel()->total_pages());
 }
 
@@ -3571,7 +3588,8 @@
   UpdateDisplay("1024x768/r");
 
   // Create 2 full pages of apps, and add another app to overflow to third page.
-  const size_t kTotalApps = GetTilesPerPage(0) + GetTilesPerPage(1) - 1;
+  const size_t kTotalApps =
+      GetTilesPerPageInPagedGrid(0) + GetTilesPerPageInPagedGrid(1) - 1;
   model_->PopulateApps(kTotalApps);
   EXPECT_EQ(2, GetPaginationModel()->total_pages());
 
@@ -3580,7 +3598,10 @@
   // items per page than landscape UI).
   UpdateDisplay("1024x768");
 
-  EXPECT_EQ(kTotalApps <= GetTilesPerPage(0) + GetTilesPerPage(1) ? 2 : 3,
+  EXPECT_EQ(kTotalApps <= GetTilesPerPageInPagedGrid(0) +
+                              GetTilesPerPageInPagedGrid(1)
+                ? 2
+                : 3,
             GetPaginationModel()->total_pages());
 }
 
@@ -3588,8 +3609,9 @@
   ASSERT_TRUE(paged_apps_grid_view_);
 
   // Create 3 full pages of apps.
-  model_->PopulateApps(GetTilesPerPage(0) + GetTilesPerPage(1) +
-                       GetTilesPerPage(2));
+  model_->PopulateApps(GetTilesPerPageInPagedGrid(0) +
+                       GetTilesPerPageInPagedGrid(1) +
+                       GetTilesPerPageInPagedGrid(2));
   // Select the last page.
   GetPaginationModel()->SelectPage(2, /*animate=*/false);
 
@@ -4263,7 +4285,7 @@
 TEST_P(AppsGridViewTabletTest, Basic) {
   base::HistogramTester histogram_tester;
 
-  model_->PopulateApps(GetTilesPerPage(0) + 1);
+  model_->PopulateApps(GetTilesPerPageInPagedGrid(0) + 1);
   EXPECT_EQ(2, GetPaginationModel()->total_pages());
 
   gfx::Point apps_grid_view_origin =
@@ -4315,7 +4337,7 @@
   // Create a folder with 2 apps. Then add apps until a second page is
   // created.
   model_->CreateAndPopulateFolderWithApps(2);
-  model_->PopulateApps(GetTilesPerPage(0));
+  model_->PopulateApps(GetTilesPerPageInPagedGrid(0));
   EXPECT_EQ(2, GetPaginationModel()->total_pages());
 
   gfx::Point apps_grid_view_origin =
@@ -4404,8 +4426,6 @@
             model_->top_level_item_list()->item_at(0)->GetItemType());
   EXPECT_EQ(kTotalItems, folder_item->ChildItemCount());
   EXPECT_EQ(4, folder_apps_grid_view()->cols());
-  EXPECT_EQ(kTotalItems,
-            AppsGridViewTestApi(folder_apps_grid_view()).TilesPerPage(0));
   EXPECT_EQ(1, GetTotalPages(folder_apps_grid_view()));
   EXPECT_EQ(0, GetSelectedPage(folder_apps_grid_view()));
   EXPECT_TRUE(folder_apps_grid_view()->IsInFolder());
@@ -4414,7 +4434,7 @@
 // There's no "page break" item at the end of first page with full grid.
 TEST_P(AppsGridViewTabletTest, NoPageBreakItemWithFullGrid) {
   // There are two pages and last item is on second page.
-  const int kApps = 2 + GetTilesPerPage(0);
+  const int kApps = 2 + GetTilesPerPageInPagedGrid(0);
   model_->PopulateApps(kApps);
   std::string model_content = "Item 0";
   for (int i = 1; i < kApps; ++i)
@@ -4482,9 +4502,10 @@
   // Add enough items to the root grid so the launcher becomes paged.
   model_->PopulateApps(1);
   model_->CreateAndPopulateFolderWithApps(5);
-  // `GetTilesPerPage()` may return a large number for bubble launcher - ensure
-  // the number of test apps is not excessive.
-  model_->PopulateApps(std::min(size_t{30}, GetTilesPerPage(0)));
+  // `TilesPerPage()` is not well defined for bubble launcher - populate bubble
+  // launcher grid with arbitrary sufficiently large number of apps (so the
+  // root grid becomes scrollable).
+  model_->PopulateApps(GetTilesPerPageOr(0, 30));
   UpdateLayout();
 
   // Open the folder view.
@@ -4545,9 +4566,9 @@
   // Add enough items to the root grid so the launcher becomes paged.
   model_->PopulateApps(1);
   model_->CreateAndPopulateFolderWithApps(5);
-  // `GetTilesPerPage()` may return a large number for bubble launcher - ensure
-  // the number of test apps is not excessive.
-  model_->PopulateApps(std::min(size_t{30}, GetTilesPerPage(0)));
+  // `GetTilesPerPageInPagedGrid()` may return a large number for bubble
+  // launcher - ensure the number of test apps is not excessive.
+  model_->PopulateApps(GetTilesPerPageOr(0, 30));
   UpdateLayout();
 
   // Open the folder view.
@@ -4608,7 +4629,7 @@
 
 TEST_P(AppsGridViewTabletTest, MoveItemToPreviousFullPage) {
   // There are two pages and last item is on second page.
-  const size_t kApps = 2 + GetTilesPerPage(0);
+  const size_t kApps = 2 + GetTilesPerPageInPagedGrid(0);
   model_->PopulateApps(kApps);
   const views::ViewModelT<AppListItemView>* view_model =
       apps_grid_view_->view_model();
@@ -4631,8 +4652,8 @@
   TestAppListItemViewIndice();
   EXPECT_EQ(kApps, view_model->view_size());
   for (size_t i = 0; i < kApps; ++i) {
-    int page = i / GetTilesPerPage(0);
-    int slot = i % GetTilesPerPage(0);
+    int page = i / GetTilesPerPageInPagedGrid(0);
+    int slot = i % GetTilesPerPageInPagedGrid(0);
     EXPECT_EQ(view_model->view_at(i),
               test_api_->GetViewAtVisualIndex(page, slot));
     EXPECT_EQ("Item " + base::NumberToString((i + kApps - 1) % kApps),
@@ -4708,7 +4729,7 @@
       << first_item_bounds.ToString();
 
   gfx::Rect last_item_bounds = GetItemRectOnCurrentPageAt(
-      GetTilesPerPage(0) / apps_grid_view_->cols() - 1,
+      GetTilesPerPageInPagedGrid(0) / apps_grid_view_->cols() - 1,
       apps_grid_view_->cols() - 1);
 
   EXPECT_TRUE(background_card_bounds.Contains(last_item_bounds))
@@ -4740,7 +4761,7 @@
       << first_item_bounds.ToString();
 
   last_item_bounds = GetItemRectOnCurrentPageAt(
-      GetTilesPerPage(0) / apps_grid_view_->cols() - 1,
+      GetTilesPerPageInPagedGrid(0) / apps_grid_view_->cols() - 1,
       apps_grid_view_->cols() - 1);
 
   EXPECT_TRUE(background_card_bounds.Contains(last_item_bounds))
@@ -4790,7 +4811,7 @@
       << first_item_bounds.ToString();
 
   gfx::Rect last_item_bounds = GetItemRectOnCurrentPageAt(
-      GetTilesPerPage(1) / apps_grid_view_->cols() - 1,
+      GetTilesPerPageInPagedGrid(1) / apps_grid_view_->cols() - 1,
       apps_grid_view_->cols() - 1);
 
   EXPECT_TRUE(background_card_bounds.Contains(last_item_bounds))
@@ -4821,7 +4842,7 @@
       << first_item_bounds.ToString();
 
   last_item_bounds = GetItemRectOnCurrentPageAt(
-      GetTilesPerPage(1) / apps_grid_view_->cols() - 1,
+      GetTilesPerPageInPagedGrid(1) / apps_grid_view_->cols() - 1,
       apps_grid_view_->cols() - 1);
 
   EXPECT_TRUE(background_card_bounds.Contains(last_item_bounds))
@@ -5413,7 +5434,7 @@
 TEST_P(AppsGridViewTabletTest, ChangeFolderNameShouldUpdateShadows) {
   SetVirtualKeyboardEnabled(true);
 
-  const int kMaxAppsInGrid = test_api_->TilesPerPage(0);
+  const int kMaxAppsInGrid = test_api_->TilesPerPageInPagedGrid(0);
   model_->PopulateApps(kMaxAppsInGrid - 1);
   UpdateLayout();
 
diff --git a/ash/app_list/views/paged_apps_grid_view.cc b/ash/app_list/views/paged_apps_grid_view.cc
index e68027c..523a5bc 100644
--- a/ash/app_list/views/paged_apps_grid_view.cc
+++ b/ash/app_list/views/paged_apps_grid_view.cc
@@ -248,8 +248,8 @@
                                              int max_rows_on_first_page,
                                              int max_rows) {
   DCHECK_LE(max_rows_on_first_page, max_rows);
-  const int first_page_size = TilesPerPage(0);
-  const int default_page_size = TilesPerPage(1);
+  const absl::optional<int> first_page_size = TilesPerPage(0);
+  const absl::optional<int> default_page_size = TilesPerPage(1);
 
   max_rows_on_first_page_ = max_rows_on_first_page;
   max_rows_ = max_rows;
@@ -513,7 +513,7 @@
                             kMaxAppListAppMovingType);
 }
 
-int PagedAppsGridView::GetMaxRowsInPage(int page) const {
+absl::optional<int> PagedAppsGridView::GetMaxRowsInPage(int page) const {
   return page == 0 ? max_rows_on_first_page_ : max_rows_;
 }
 
@@ -536,11 +536,11 @@
   // The grid can have a different number of tiles per page.
   size_t tiles = view_model()->view_size();
   int total_pages = 1;
-  size_t tiles_on_page = TilesPerPage(0);
+  size_t tiles_on_page = *TilesPerPage(0);
   while (tiles > tiles_on_page) {
     tiles -= tiles_on_page;
     ++total_pages;
-    tiles_on_page = TilesPerPage(total_pages - 1);
+    tiles_on_page = *TilesPerPage(total_pages - 1);
   }
   pagination_model_.SetTotalPages(total_pages);
 }
@@ -769,7 +769,7 @@
 
 gfx::Size PagedAppsGridView::GetTileGridSizeForPage(int page) const {
   gfx::Rect rect(GetTotalTileSize(page));
-  const int rows = TilesPerPage(page) / cols();
+  const int rows = *TilesPerPage(page) / cols();
   rect.set_size(gfx::Size(rect.width() * cols(), rect.height() * rows));
   rect.Inset(-GetTilePadding(page));
   return rect.size();
diff --git a/ash/app_list/views/paged_apps_grid_view.h b/ash/app_list/views/paged_apps_grid_view.h
index 3d825ae2..279da53 100644
--- a/ash/app_list/views/paged_apps_grid_view.h
+++ b/ash/app_list/views/paged_apps_grid_view.h
@@ -114,7 +114,7 @@
                                   ui::EventType type) override;
   void SetFocusAfterEndDrag(AppListItem* drag_item) override;
   void RecordAppMovingTypeMetrics(AppListAppMovingType type) override;
-  int GetMaxRowsInPage(int page) const override;
+  absl::optional<int> GetMaxRowsInPage(int page) const override;
   gfx::Vector2d GetGridCenteringOffset(int page) const override;
   void UpdatePaging() override;
   void RecordPageMetrics() override;
diff --git a/ash/app_list/views/paged_apps_grid_view_unittest.cc b/ash/app_list/views/paged_apps_grid_view_unittest.cc
index bc59197c8..92482bd 100644
--- a/ash/app_list/views/paged_apps_grid_view_unittest.cc
+++ b/ash/app_list/views/paged_apps_grid_view_unittest.cc
@@ -667,7 +667,7 @@
   for (size_t i = 1; i < view_model->view_size(); i++) {
     AppListItemView* item_view = view_model->view_at(i);
     // The items off screen on the second page should not animate.
-    if (i >= grid_test_api_->TilesPerPage(0)) {
+    if (i >= grid_test_api_->TilesPerPageInPagedGrid(0)) {
       EXPECT_FALSE(GetPagedAppsGridView()->IsAnimatingView(item_view));
       continue;
     }
@@ -907,7 +907,7 @@
 // Test that a first page item released outside of the grid with second page
 // shown will visually change back to the first page.
 TEST_F(PagedAppsGridViewTest, DragOutsideOfNextPageSelectsOriginalPage) {
-  const size_t kTotalApps = grid_test_api_->TilesPerPage(0) + 1;
+  const size_t kTotalApps = grid_test_api_->TilesPerPageInPagedGrid(0) + 1;
   app_list_test_model_->PopulateApps(kTotalApps);
   UpdateLayout();
 
diff --git a/ash/app_list/views/scrollable_apps_grid_view.cc b/ash/app_list/views/scrollable_apps_grid_view.cc
index 722a7977..c51f013b 100644
--- a/ash/app_list/views/scrollable_apps_grid_view.cc
+++ b/ash/app_list/views/scrollable_apps_grid_view.cc
@@ -272,10 +272,8 @@
                             kMaxAppListAppMovingType);
 }
 
-int ScrollableAppsGridView::GetMaxRowsInPage(int page) const {
-  // Return an arbitrary large number, chosen to be small enough
-  // that cols*rows_per_page will not overflow.
-  return 100000;
+absl::optional<int> ScrollableAppsGridView::GetMaxRowsInPage(int page) const {
+  return absl::nullopt;
 }
 
 gfx::Vector2d ScrollableAppsGridView::GetGridCenteringOffset(int page) const {
diff --git a/ash/app_list/views/scrollable_apps_grid_view.h b/ash/app_list/views/scrollable_apps_grid_view.h
index 2156f22..edf6fd291 100644
--- a/ash/app_list/views/scrollable_apps_grid_view.h
+++ b/ash/app_list/views/scrollable_apps_grid_view.h
@@ -59,7 +59,7 @@
                                   ui::EventType type) override;
   void SetFocusAfterEndDrag(AppListItem* drag_item) override;
   void RecordAppMovingTypeMetrics(AppListAppMovingType type) override;
-  int GetMaxRowsInPage(int page) const override;
+  absl::optional<int> GetMaxRowsInPage(int page) const override;
   gfx::Vector2d GetGridCenteringOffset(int page) const override;
   const gfx::Vector2d CalculateTransitionOffset(
       int page_of_view) const override;
diff --git a/ash/capture_mode/capture_mode_camera_preview_view.cc b/ash/capture_mode/capture_mode_camera_preview_view.cc
index d25e4123..150f766 100644
--- a/ash/capture_mode/capture_mode_camera_preview_view.cc
+++ b/ash/capture_mode/capture_mode_camera_preview_view.cc
@@ -133,12 +133,14 @@
   accessibility_observation_.Observe(Shell::Get()->accessibility_controller());
   RefreshResizeButtonVisibility();
   UpdateResizeButtonTooltip();
+  capture_mode_util::MaybeUpdateCameraPrivacyIndicator(/*camera_on=*/true);
 }
 
 CameraPreviewView::~CameraPreviewView() {
   auto* controller = CaptureModeController::Get();
   if (controller->IsActive() && !controller->is_recording_in_progress())
     controller->capture_mode_session()->OnCameraPreviewDestroyed();
+  capture_mode_util::MaybeUpdateCameraPrivacyIndicator(/*camera_on=*/false);
 }
 
 void CameraPreviewView::SetIsCollapsible(bool value) {
diff --git a/ash/capture_mode/capture_mode_camera_unittests.cc b/ash/capture_mode/capture_mode_camera_unittests.cc
index bec1960..f714d2a3 100644
--- a/ash/capture_mode/capture_mode_camera_unittests.cc
+++ b/ash/capture_mode/capture_mode_camera_unittests.cc
@@ -25,14 +25,17 @@
 #include "ash/capture_mode/fake_folder_selection_dialog_factory.h"
 #include "ash/capture_mode/fake_video_source_provider.h"
 #include "ash/capture_mode/test_capture_mode_delegate.h"
+#include "ash/constants/ash_features.h"
 #include "ash/display/window_tree_host_manager.h"
 #include "ash/public/cpp/capture_mode/capture_mode_test_api.h"
 #include "ash/public/cpp/window_properties.h"
 #include "ash/resources/vector_icons/vector_icons.h"
+#include "ash/root_window_controller.h"
 #include "ash/shell.h"
 #include "ash/strings/grit/ash_strings.h"
 #include "ash/style/ash_color_id.h"
 #include "ash/system/accessibility/autoclick_menu_bubble_controller.h"
+#include "ash/system/privacy/privacy_indicators_tray_item_view.h"
 #include "ash/system/unified/unified_system_tray.h"
 #include "ash/test/ash_test_base.h"
 #include "ash/wm/window_state.h"
@@ -42,6 +45,7 @@
 #include "base/system/system_monitor.h"
 #include "base/test/bind.h"
 #include "base/test/metrics/histogram_tester.h"
+#include "base/test/scoped_feature_list.h"
 #include "base/timer/timer.h"
 #include "cc/paint/skia_paint_canvas.h"
 #include "media/base/video_facing.h"
@@ -52,12 +56,14 @@
 #include "ui/base/ui_base_types.h"
 #include "ui/compositor/compositor_switches.h"
 #include "ui/compositor/layer.h"
+#include "ui/compositor/scoped_animation_duration_scale_mode.h"
 #include "ui/gfx/geometry/point.h"
 #include "ui/gfx/geometry/rect.h"
 #include "ui/gfx/geometry/size.h"
 #include "ui/gfx/geometry/vector2d.h"
 #include "ui/gfx/image/image_unittest_util.h"
 #include "ui/gfx/paint_vector_icon.h"
+#include "ui/views/controls/image_view.h"
 #include "ui/views/view.h"
 #include "ui/views/widget/widget.h"
 #include "ui/wm/core/coordinate_conversion.h"
@@ -4472,8 +4478,7 @@
   // Simulate the user login process and wait for the camera info to be updated.
   {
     base::RunLoop loop;
-    GetCameraController()->SetOnCameraListReceivedForTesting(
-        loop.QuitClosure());
+    camera_controller->SetOnCameraListReceivedForTesting(loop.QuitClosure());
     SimulateUserLogin("example@gmail.com", user_manager::USER_TYPE_REGULAR);
     loop.Run();
   }
@@ -4482,4 +4487,110 @@
   EXPECT_EQ(camera_controller->available_cameras().size(), 1u);
 }
 
+class CaptureModePrivacyIndicatorsTest : public CaptureModeCameraTest {
+ public:
+  CaptureModePrivacyIndicatorsTest()
+      : scoped_feature_list_(features::kPrivacyIndicators) {}
+  CaptureModePrivacyIndicatorsTest(const CaptureModePrivacyIndicatorsTest&) =
+      delete;
+  CaptureModePrivacyIndicatorsTest& operator=(
+      const CaptureModePrivacyIndicatorsTest&) = delete;
+  ~CaptureModePrivacyIndicatorsTest() override = default;
+
+  bool IsCameraIndicatorIconVisible() const {
+    auto* indicator_view = GetPrimaryDisplayPrivacyIndicatorsView();
+    return indicator_view && indicator_view->GetVisible() &&
+           indicator_view->IsCameraUsed() &&
+           indicator_view->camera_icon_->GetVisible();
+  }
+
+  bool IsMicrophoneIndicatorIconVisible() const {
+    auto* indicator_view = GetPrimaryDisplayPrivacyIndicatorsView();
+    return indicator_view && indicator_view->GetVisible() &&
+           indicator_view->IsMicrophoneUsed() &&
+           indicator_view->microphone_icon_->GetVisible();
+  }
+
+  PrivacyIndicatorsTrayItemView* GetPrimaryDisplayPrivacyIndicatorsView()
+      const {
+    return Shell::GetPrimaryRootWindowController()
+        ->GetStatusAreaWidget()
+        ->unified_system_tray()
+        ->privacy_indicators_view();
+  }
+
+ private:
+  base::test::ScopedFeatureList scoped_feature_list_;
+};
+
+TEST_F(CaptureModePrivacyIndicatorsTest, CameraPrivacyIndicators) {
+  ui::ScopedAnimationDurationScaleMode animation_scale(
+      ui::ScopedAnimationDurationScaleMode::NORMAL_DURATION);
+
+  // Initially the session doesn't show any camera preview since the camera
+  // hasn't connected yet. There should be no privacy indicators.
+  StartCaptureSession(CaptureModeSource::kFullscreen, CaptureModeType::kVideo);
+  auto* camera_controller = GetCameraController();
+  camera_controller->SetSelectedCamera(CameraId(kDefaultCameraModelId, 1));
+  EXPECT_FALSE(camera_controller->camera_preview_widget());
+  EXPECT_FALSE(IsCameraIndicatorIconVisible());
+  EXPECT_FALSE(IsMicrophoneIndicatorIconVisible());
+
+  // Once the camera gets connected, the camera privacy indicator icon should
+  // show. No microphone yet (not until recording starts with audio).
+  AddDefaultCamera();
+  EXPECT_TRUE(camera_controller->camera_preview_widget());
+  EXPECT_TRUE(IsCameraIndicatorIconVisible());
+  EXPECT_FALSE(IsMicrophoneIndicatorIconVisible());
+
+  // If the camera gets disconnected for some reason, the indicator should go
+  // away, and come back once it reconnects again.
+  RemoveDefaultCamera();
+  EXPECT_FALSE(camera_controller->camera_preview_widget());
+  // The widget closes its window asynchronously, run a loop to finish that.
+  base::RunLoop().RunUntilIdle();
+  EXPECT_FALSE(IsCameraIndicatorIconVisible());
+  EXPECT_FALSE(IsMicrophoneIndicatorIconVisible());
+  AddDefaultCamera();
+  EXPECT_TRUE(camera_controller->camera_preview_widget());
+  EXPECT_TRUE(IsCameraIndicatorIconVisible());
+  EXPECT_FALSE(IsMicrophoneIndicatorIconVisible());
+}
+
+TEST_F(CaptureModePrivacyIndicatorsTest, DuringRecordingPrivacyIndicators) {
+  ui::ScopedAnimationDurationScaleMode animation_scale(
+      ui::ScopedAnimationDurationScaleMode::NORMAL_DURATION);
+
+  // Even with the selected camera present, no indicators will show until the
+  // capture session starts.
+  auto* camera_controller = GetCameraController();
+  camera_controller->SetSelectedCamera(CameraId(kDefaultCameraModelId, 1));
+  AddDefaultCamera();
+  EXPECT_FALSE(camera_controller->camera_preview_widget());
+  EXPECT_FALSE(IsCameraIndicatorIconVisible());
+  EXPECT_FALSE(IsMicrophoneIndicatorIconVisible());
+
+  auto* capture_controller = StartCaptureSession(CaptureModeSource::kFullscreen,
+                                                 CaptureModeType::kVideo);
+  EXPECT_TRUE(camera_controller->camera_preview_widget());
+  EXPECT_TRUE(IsCameraIndicatorIconVisible());
+  EXPECT_FALSE(IsMicrophoneIndicatorIconVisible());
+
+  // When the user selects audio recording, the idicators won't change.
+  // Recording has to start first.
+  capture_controller->EnableAudioRecording(true);
+  EXPECT_FALSE(IsMicrophoneIndicatorIconVisible());
+
+  StartRecordingFromSource(CaptureModeSource::kFullscreen);
+  EXPECT_TRUE(IsCameraIndicatorIconVisible());
+  EXPECT_TRUE(IsMicrophoneIndicatorIconVisible());
+
+  // Once recording ends, both indicators should disappear.
+  capture_controller->EndVideoRecording(
+      EndRecordingReason::kStopRecordingButton);
+  WaitForCaptureFileToBeSaved();
+  EXPECT_FALSE(IsCameraIndicatorIconVisible());
+  EXPECT_FALSE(IsMicrophoneIndicatorIconVisible());
+}
+
 }  // namespace ash
diff --git a/ash/capture_mode/capture_mode_controller.cc b/ash/capture_mode/capture_mode_controller.cc
index 7b1f4e2..52029a6 100644
--- a/ash/capture_mode/capture_mode_controller.cc
+++ b/ash/capture_mode/capture_mode_controller.cc
@@ -984,6 +984,7 @@
   if (GetAudioRecordingEnabled()) {
     delegate_->BindAudioStreamFactory(
         audio_stream_factory.InitWithNewPipeAndPassReceiver());
+    capture_mode_util::MaybeUpdateMicrophonePrivacyIndicator(/*mic_on=*/true);
   }
 
   // Only act as a `DriveFsQuotaDelegate` for the recording service if the video
@@ -1070,6 +1071,7 @@
   const bool was_in_projector_mode =
       video_recording_watcher_->is_in_projector_mode();
   video_recording_watcher_.reset();
+  capture_mode_util::MaybeUpdateMicrophonePrivacyIndicator(/*mic_on=*/false);
 
   delegate_->StopObservingRestrictedContent(
       base::BindOnce(&CaptureModeController::OnDlpRestrictionCheckedAtVideoEnd,
diff --git a/ash/capture_mode/capture_mode_util.cc b/ash/capture_mode/capture_mode_util.cc
index 8b26fc0..ab5cb231 100644
--- a/ash/capture_mode/capture_mode_util.cc
+++ b/ash/capture_mode/capture_mode_util.cc
@@ -19,6 +19,7 @@
 #include "ash/shell.h"
 #include "ash/strings/grit/ash_strings.h"
 #include "ash/style/ash_color_id.h"
+#include "ash/system/privacy/privacy_indicators_controller.h"
 #include "ash/wm/tablet_mode/tablet_mode_controller.h"
 #include "base/check.h"
 #include "base/notreached.h"
@@ -44,6 +45,12 @@
 constexpr int kBannerViewBottomRadius = 8;
 constexpr float kScaleUpFactor = 0.8f;
 
+// The app IDs used for the capture mode camera and microphone recording privacy
+// indicators.
+constexpr char kCameraPrivacyIndicatorId[] = "system-capture-mode-camera";
+constexpr char kMicrophonePrivacyIndicatorId[] =
+    "system-capture-mode-microphone";
+
 // Returns the target visibility of the camera preview, given the
 // `confine_bounds_short_side_length`. The out parameter
 // `out_is_surface_too_small` will be set to true if the preview should be
@@ -492,4 +499,18 @@
                             path.BaseName().value().c_str());
 }
 
+void MaybeUpdateCameraPrivacyIndicator(bool camera_on) {
+  if (features::IsPrivacyIndicatorsEnabled()) {
+    UpdatePrivacyIndicatorsView(kCameraPrivacyIndicatorId, camera_on,
+                                /*is_microphone_used=*/false);
+  }
+}
+
+void MaybeUpdateMicrophonePrivacyIndicator(bool mic_on) {
+  if (features::IsPrivacyIndicatorsEnabled()) {
+    UpdatePrivacyIndicatorsView(kMicrophonePrivacyIndicatorId,
+                                /*is_camera_used=*/false, mic_on);
+  }
+}
+
 }  // namespace ash::capture_mode_util
diff --git a/ash/capture_mode/capture_mode_util.h b/ash/capture_mode/capture_mode_util.h
index 1c84c95..ff56fda 100644
--- a/ash/capture_mode/capture_mode_util.h
+++ b/ash/capture_mode/capture_mode_util.h
@@ -184,6 +184,11 @@
 ASH_EXPORT std::string GetScreenCaptureNotificationIdForPath(
     const base::FilePath& path);
 
+// If the privacy indicators feature is enabled, the below functions update the
+// camera and microphone capture mode indicators according to the given values.
+void MaybeUpdateCameraPrivacyIndicator(bool camera_on);
+void MaybeUpdateMicrophonePrivacyIndicator(bool mic_on);
+
 }  // namespace capture_mode_util
 
 }  // namespace ash
diff --git a/ash/login/ui/fingerprint_auth_factor_model_unittest.cc b/ash/login/ui/fingerprint_auth_factor_model_unittest.cc
index a9bfdec..19df8b9 100644
--- a/ash/login/ui/fingerprint_auth_factor_model_unittest.cc
+++ b/ash/login/ui/fingerprint_auth_factor_model_unittest.cc
@@ -63,6 +63,11 @@
                              base::Unretained(this)));
   }
 
+  void TearDown() override {
+    FingerprintAuthFactorModel::Factory::SetFactoryForTesting(nullptr);
+    AshTestBase::TearDown();
+  }
+
   void OnStateChanged() { on_state_changed_called_ = true; }
 
   std::unique_ptr<FakeFingerprintAuthFactorModelFactory>
diff --git a/ash/root_window_settings.h b/ash/root_window_settings.h
index 709ba99..24b935e 100644
--- a/ash/root_window_settings.h
+++ b/ash/root_window_settings.h
@@ -8,6 +8,7 @@
 #include <cstdint>
 
 #include "ash/ash_export.h"
+#include "base/memory/raw_ptr.h"
 
 namespace aura {
 class Window;
@@ -28,7 +29,7 @@
 
   // RootWindowController for the root window. This may be NULL
   // for the root window used for mirroring.
-  RootWindowController* controller;
+  raw_ptr<RootWindowController> controller;
 };
 
 // Initializes and returns RootWindowSettings for |root|.
diff --git a/ash/system/holding_space/holding_space_item_views_section_unittest.cc b/ash/system/holding_space/holding_space_item_views_section_unittest.cc
index a2c53ca..b966b60 100644
--- a/ash/system/holding_space/holding_space_item_views_section_unittest.cc
+++ b/ash/system/holding_space/holding_space_item_views_section_unittest.cc
@@ -19,6 +19,7 @@
 #include "base/functional/bind.h"
 #include "base/functional/callback_forward.h"
 #include "base/strings/strcat.h"
+#include "build/build_config.h"
 #include "ui/views/widget/unique_widget_ptr.h"
 
 namespace ash {
@@ -102,7 +103,13 @@
                          testing::ValuesIn(GetSectionIdItemTypePairs()));
 
 // Verifies the items are ordered as expected.
-TEST_P(HoldingSpaceItemViewsSectionTest, ItemOrder) {
+// https://crbug.com/1392609.
+#if defined(ADDRESS_SANITIZER)
+#define MAYBE_ItemOrder DISABLED_ItemOrder
+#else
+#define MAYBE_ItemOrder ItemOrder
+#endif
+TEST_P(HoldingSpaceItemViewsSectionTest, MAYBE_ItemOrder) {
   const absl::optional<size_t> section_max_views =
       GetHoldingSpaceSection(section_id())->max_visible_item_count;
 
@@ -138,7 +145,16 @@
 
 // Verifies that partially initialized items will not show until they are fully
 // initialized.
-TEST_P(HoldingSpaceItemViewsSectionTest, PartiallyInitializedItemsDontShow) {
+// https://crbug.com/1392609.
+#if defined(ADDRESS_SANITIZER)
+#define MAYBE_PartiallyInitializedItemsDontShow \
+  DISABLED_PartiallyInitializedItemsDontShow
+#else
+#define MAYBE_PartiallyInitializedItemsDontShow \
+  PartiallyInitializedItemsDontShow
+#endif
+TEST_P(HoldingSpaceItemViewsSectionTest,
+       MAYBE_PartiallyInitializedItemsDontShow) {
   auto* partially_initialized_item =
       AddPartiallyInitializedItem(item_type(), base::FilePath("/tmp/fake1"));
   auto views = item_views_section()->GetHoldingSpaceItemViews();
diff --git a/ash/system/privacy/privacy_indicators_tray_item_view.h b/ash/system/privacy/privacy_indicators_tray_item_view.h
index 98d21375..6a1a988 100644
--- a/ash/system/privacy/privacy_indicators_tray_item_view.h
+++ b/ash/system/privacy/privacy_indicators_tray_item_view.h
@@ -87,6 +87,7 @@
 
  private:
   friend class PrivacyIndicatorsTrayItemViewTest;
+  friend class CaptureModePrivacyIndicatorsTest;
 
   // TrayItemView:
   void PerformVisibilityAnimation(bool visible) override;
diff --git a/base/allocator/dispatcher/dispatcher.cc b/base/allocator/dispatcher/dispatcher.cc
index 4a1bf81..8191402 100644
--- a/base/allocator/dispatcher/dispatcher.cc
+++ b/base/allocator/dispatcher/dispatcher.cc
@@ -106,6 +106,12 @@
   return self->next->get_size_estimate_function(self->next, address, context);
 }
 
+bool ClaimedAddressFn(const AllocatorDispatch* self,
+                      void* address,
+                      void* context) {
+  return self->next->claimed_address_function(self->next, address, context);
+}
+
 unsigned BatchMallocFn(const AllocatorDispatch* self,
                        size_t size,
                        void** results,
@@ -141,6 +147,13 @@
   self->next->free_definite_size_function(self->next, address, size, context);
 }
 
+void TryFreeDefaultFn(const AllocatorDispatch* self,
+                      void* address,
+                      void* context) {
+  PoissonAllocationSampler::RecordFree(address);
+  self->next->try_free_default_function(self->next, address, context);
+}
+
 static void* AlignedMallocFn(const AllocatorDispatch* self,
                              size_t size,
                              size_t alignment,
@@ -186,9 +199,11 @@
                                           &ReallocFn,
                                           &FreeFn,
                                           &GetSizeEstimateFn,
+                                          &ClaimedAddressFn,
                                           &BatchMallocFn,
                                           &BatchFreeFn,
                                           &FreeDefiniteSizeFn,
+                                          &TryFreeDefaultFn,
                                           &AlignedMallocFn,
                                           &AlignedReallocFn,
                                           &AlignedFreeFn,
diff --git a/base/allocator/dispatcher/internal/dispatcher_internal.h b/base/allocator/dispatcher/internal/dispatcher_internal.h
index 5205a7e..da32380ac 100644
--- a/base/allocator/dispatcher/internal/dispatcher_internal.h
+++ b/base/allocator/dispatcher/internal/dispatcher_internal.h
@@ -202,6 +202,12 @@
     return self->next->get_size_estimate_function(self->next, address, context);
   }
 
+  static bool ClaimedAddressFn(const AllocatorDispatch* self,
+                               void* address,
+                               void* context) {
+    return self->next->claimed_address_function(self->next, address, context);
+  }
+
   static unsigned BatchMallocFn(const AllocatorDispatch* self,
                                 size_t size,
                                 void** results,
@@ -242,6 +248,13 @@
     self->next->free_definite_size_function(self->next, address, size, context);
   }
 
+  static void TryFreeDefaultFn(const AllocatorDispatch* self,
+                               void* address,
+                               void* context) {
+    DoNotifyFree(address);
+    self->next->try_free_default_function(self->next, address, context);
+  }
+
   static void* AlignedMallocFn(const AllocatorDispatch* self,
                                size_t size,
                                size_t alignment,
@@ -316,9 +329,11 @@
     &ReallocFn,
     &FreeFn,
     &GetSizeEstimateFn,
+    &ClaimedAddressFn,
     &BatchMallocFn,
     &BatchFreeFn,
     &FreeDefiniteSizeFn,
+    &TryFreeDefaultFn,
     &AlignedMallocFn,
     &AlignedReallocFn,
     &AlignedFreeFn,
diff --git a/base/allocator/dispatcher/internal/dispatcher_internal_unittest.cc b/base/allocator/dispatcher/internal/dispatcher_internal_unittest.cc
index 3932be2..06f46c88 100644
--- a/base/allocator/dispatcher/internal/dispatcher_internal_unittest.cc
+++ b/base/allocator/dispatcher/internal/dispatcher_internal_unittest.cc
@@ -65,6 +65,9 @@
                                            void*) {
     return GetEstimatedSize();
   }
+  static bool claimed_address_function(const AllocatorDispatch*, void*, void*) {
+    return GetEstimatedSize();
+  }
   static unsigned batch_malloc_function(const AllocatorDispatch*,
                                         size_t,
                                         void**,
@@ -94,9 +97,11 @@
       &realloc_function,
       [](const AllocatorDispatch*, void*, void*) {},
       &get_size_estimate_function,
+      &claimed_address_function,
       &batch_malloc_function,
       [](const AllocatorDispatch*, void**, unsigned, void*) {},
       [](const AllocatorDispatch*, void*, size_t, void*) {},
+      [](const AllocatorDispatch*, void*, void*) {},
       &aligned_malloc_function,
       &aligned_realloc_function,
       [](const AllocatorDispatch*, void*, void*) {}};
@@ -194,9 +199,11 @@
   EXPECT_NE(nullptr, allocator_dispatch->realloc_function);
   EXPECT_NE(nullptr, allocator_dispatch->free_function);
   EXPECT_NE(nullptr, allocator_dispatch->get_size_estimate_function);
+  EXPECT_NE(nullptr, allocator_dispatch->claimed_address_function);
   EXPECT_NE(nullptr, allocator_dispatch->batch_malloc_function);
   EXPECT_NE(nullptr, allocator_dispatch->batch_free_function);
   EXPECT_NE(nullptr, allocator_dispatch->free_definite_size_function);
+  EXPECT_NE(nullptr, allocator_dispatch->try_free_default_function);
   EXPECT_NE(nullptr, allocator_dispatch->aligned_malloc_function);
   EXPECT_NE(nullptr, allocator_dispatch->aligned_realloc_function);
   EXPECT_NE(nullptr, allocator_dispatch->aligned_free_function);
@@ -449,6 +456,27 @@
 }
 
 TEST_F(AllocationEventDispatcherInternalTest,
+       VerifyAllocatorShimHooksTriggerCorrectly_try_free_default_function) {
+  std::array<ObserverMock, kMaximumNumberOfObservers> observers;
+
+  for (auto& mock : observers) {
+    EXPECT_CALL(mock, OnFree(GetAllocatedAddress())).Times(1);
+    EXPECT_CALL(mock, OnAllocation(_, _, _, _)).Times(0);
+  }
+
+  DispatchData const dispatch_data =
+      GetNotificationHooks(CreateTupleOfPointers(observers));
+
+  auto* const allocator_dispatch = dispatch_data.GetAllocatorDispatch();
+  EXPECT_NE(allocator_dispatch->try_free_default_function, nullptr);
+
+  allocator_dispatch->next = GetNextAllocatorDispatch();
+
+  allocator_dispatch->try_free_default_function(allocator_dispatch,
+                                                GetAllocatedAddress(), nullptr);
+}
+
+TEST_F(AllocationEventDispatcherInternalTest,
        VerifyAllocatorShimHooksTriggerCorrectly_aligned_malloc_function) {
   std::array<ObserverMock, kMaximumNumberOfObservers> observers;
 
diff --git a/base/allocator/early_zone_registration_mac.cc b/base/allocator/early_zone_registration_mac.cc
index 4381904..71c3794 100644
--- a/base/allocator/early_zone_registration_mac.cc
+++ b/base/allocator/early_zone_registration_mac.cc
@@ -31,6 +31,7 @@
 }
 
 namespace {
+
 malloc_zone_t* GetDefaultMallocZone() {
   // malloc_default_zone() does not return... the default zone, but the
   // initial one. The default one is the first element of the default zone
@@ -148,6 +149,11 @@
     return g_default_zone->batch_free(g_default_zone, to_be_freed,
                                       num_to_be_freed);
   };
+#if PA_TRY_FREE_DEFAULT_IS_AVAILABLE
+  g_delegating_zone.try_free_default = [](malloc_zone_t* zone, void* ptr) {
+    return g_default_zone->try_free_default(g_default_zone, ptr);
+  };
+#endif
 
   // Diagnostics and debugging.
   //
diff --git a/base/allocator/early_zone_registration_mac.h b/base/allocator/early_zone_registration_mac.h
index 42d2c35..c8eeb868 100644
--- a/base/allocator/early_zone_registration_mac.h
+++ b/base/allocator/early_zone_registration_mac.h
@@ -16,7 +16,15 @@
 
 // Zone version. Determines which callbacks are set in the various malloc_zone_t
 // structs.
+#if (__MAC_OS_X_VERSION_MAX_ALLOWED >= 130000) || \
+    (__IPHONE_OS_VERSION_MAX_ALLOWED >= 160100)
+#define PA_TRY_FREE_DEFAULT_IS_AVAILABLE 1
+#endif
+#if PA_TRY_FREE_DEFAULT_IS_AVAILABLE
+constexpr int kZoneVersion = 13;
+#else
 constexpr int kZoneVersion = 9;
+#endif
 
 // Must be called *once*, *before* the process becomes multi-threaded.
 void EarlyMallocZoneRegistration();
diff --git a/base/allocator/partition_allocator/shim/allocator_interception_mac.mm b/base/allocator/partition_allocator/shim/allocator_interception_mac.mm
index e35dc29..86e1d6a 100644
--- a/base/allocator/partition_allocator/shim/allocator_interception_mac.mm
+++ b/base/allocator/partition_allocator/shim/allocator_interception_mac.mm
@@ -602,10 +602,21 @@
   if (zone->version >= 6 && functions->free_definite_size) {
     zone->free_definite_size = functions->free_definite_size;
   }
+  if (zone->version >= 10 && functions->claimed_address) {
+    zone->claimed_address = functions->claimed_address;
+  }
+  if (zone->version >= 13 && functions->try_free_default) {
+    zone->try_free_default = functions->try_free_default;
+  }
 
   // Cap the version to the max supported to ensure malloc doesn't try to call
   // functions that weren't replaced.
+#if (__MAC_OS_X_VERSION_MAX_ALLOWED >= 130000) || \
+    (__IPHONE_OS_VERSION_MAX_ALLOWED >= 160100)
+  zone->version = std::min(zone->version, 13U);
+#else
   zone->version = std::min(zone->version, 12U);
+#endif
 
   // Restore protection if it was active.
   if (reprotection_start) {
diff --git a/base/allocator/partition_allocator/shim/allocator_shim.cc b/base/allocator/partition_allocator/shim/allocator_shim.cc
index 462a3c9a..efadba8 100644
--- a/base/allocator/partition_allocator/shim/allocator_shim.cc
+++ b/base/allocator/partition_allocator/shim/allocator_shim.cc
@@ -12,6 +12,7 @@
 #include "base/allocator/buildflags.h"
 #include "base/allocator/partition_allocator/partition_alloc_base/bits.h"
 #include "base/allocator/partition_allocator/partition_alloc_check.h"
+#include "base/allocator/partition_allocator/partition_alloc_notreached.h"
 #include "base/memory/page_size.h"
 #include "base/threading/platform_thread.h"
 #include "build/build_config.h"
@@ -127,6 +128,37 @@
   g_chain_head.store(dispatch->next, std::memory_order_relaxed);
 }
 
+#if BUILDFLAG(IS_APPLE)
+void TryFreeDefaultFallbackToFindZoneAndFree(void* ptr) {
+  unsigned int zone_count = 0;
+  vm_address_t* zones = nullptr;
+  kern_return_t result =
+      malloc_get_all_zones(mach_task_self(), nullptr, &zones, &zone_count);
+  MACH_CHECK(result == KERN_SUCCESS, result) << "malloc_get_all_zones";
+
+  // "find_zone_and_free" expected by try_free_default.
+  //
+  // libmalloc's zones call find_registered_zone() in case the default one
+  // doesn't handle the allocation. We can't, so we try to emulate it. See the
+  // implementation in libmalloc/src/malloc.c for details.
+  // https://github.com/apple-oss-distributions/libmalloc/blob/main/src/malloc.c
+  for (unsigned int i = 0; i < zone_count; ++i) {
+    malloc_zone_t* zone = reinterpret_cast<malloc_zone_t*>(zones[i]);
+    if (size_t size = zone->size(zone, ptr)) {
+      if (zone->version >= 6 && zone->free_definite_size) {
+        zone->free_definite_size(zone, ptr, size);
+      } else {
+        zone->free(zone, ptr);
+      }
+      return;
+    }
+  }
+
+  // There must be an owner zone.
+  PA_CHECK(false);
+}
+#endif  // BUILDFLAG(IS_APPLE)
+
 }  // namespace allocator_shim
 
 // The Shim* functions below are the entry-points into the shim-layer and
@@ -277,6 +309,11 @@
       chain_head, const_cast<void*>(address), context);
 }
 
+ALWAYS_INLINE bool ShimClaimedAddress(void* address, void* context) {
+  const allocator_shim::AllocatorDispatch* const chain_head = GetChainHead();
+  return chain_head->claimed_address_function(chain_head, address, context);
+}
+
 ALWAYS_INLINE unsigned ShimBatchMalloc(size_t size,
                                        void** results,
                                        unsigned num_requested,
@@ -300,6 +337,11 @@
                                                  context);
 }
 
+ALWAYS_INLINE void ShimTryFreeDefault(void* ptr, void* context) {
+  const allocator_shim::AllocatorDispatch* const chain_head = GetChainHead();
+  return chain_head->try_free_default_function(chain_head, ptr, context);
+}
+
 ALWAYS_INLINE void* ShimAlignedMalloc(size_t size,
                                       size_t alignment,
                                       void* context) {
diff --git a/base/allocator/partition_allocator/shim/allocator_shim.h b/base/allocator/partition_allocator/shim/allocator_shim.h
index 1cdd4ace..57f0f88 100644
--- a/base/allocator/partition_allocator/shim/allocator_shim.h
+++ b/base/allocator/partition_allocator/shim/allocator_shim.h
@@ -80,6 +80,9 @@
   using GetSizeEstimateFn = size_t(const AllocatorDispatch* self,
                                    void* address,
                                    void* context);
+  using ClaimedAddressFn = bool(const AllocatorDispatch* self,
+                                void* address,
+                                void* context);
   using BatchMallocFn = unsigned(const AllocatorDispatch* self,
                                  size_t size,
                                  void** results,
@@ -93,6 +96,9 @@
                                   void* ptr,
                                   size_t size,
                                   void* context);
+  using TryFreeDefaultFn = void(const AllocatorDispatch* self,
+                                void* ptr,
+                                void* context);
   using AlignedMallocFn = void*(const AllocatorDispatch* self,
                                 size_t size,
                                 size_t alignment,
@@ -113,11 +119,13 @@
   ReallocFn* const realloc_function;
   FreeFn* const free_function;
   GetSizeEstimateFn* const get_size_estimate_function;
-  // batch_malloc, batch_free, and free_definite_size are specific to the OSX
-  // and iOS allocators.
+  // claimed_address, batch_malloc, batch_free, free_definite_size and
+  // try_free_default are specific to the OSX and iOS allocators.
+  ClaimedAddressFn* const claimed_address_function;
   BatchMallocFn* const batch_malloc_function;
   BatchFreeFn* const batch_free_function;
   FreeDefiniteSizeFn* const free_definite_size_function;
+  TryFreeDefaultFn* const try_free_default_function;
   // _aligned_malloc, _aligned_realloc, and _aligned_free are specific to the
   // Windows allocator.
   AlignedMallocFn* const aligned_malloc_function;
@@ -154,6 +162,12 @@
 // in malloc(), which we really don't want.
 BASE_EXPORT void RemoveAllocatorDispatchForTesting(AllocatorDispatch* dispatch);
 
+#if BUILDFLAG(IS_APPLE)
+// The fallback function to be called when try_free_default_function receives a
+// pointer which doesn't belong to the allocator.
+BASE_EXPORT void TryFreeDefaultFallbackToFindZoneAndFree(void* ptr);
+#endif  // BUILDFLAG(IS_APPLE)
+
 #if BUILDFLAG(USE_PARTITION_ALLOC_AS_MALLOC) && BUILDFLAG(IS_WIN)
 // Configures the allocator for the caller's allocation domain. Allocations that
 // take place prior to this configuration step will succeed, but will not
diff --git a/base/allocator/partition_allocator/shim/allocator_shim_default_dispatch_to_glibc.cc b/base/allocator/partition_allocator/shim/allocator_shim_default_dispatch_to_glibc.cc
index 297a6cd..2c833f43 100644
--- a/base/allocator/partition_allocator/shim/allocator_shim_default_dispatch_to_glibc.cc
+++ b/base/allocator/partition_allocator/shim/allocator_shim_default_dispatch_to_glibc.cc
@@ -112,9 +112,11 @@
     &GlibcRealloc,         /* realloc_function */
     &GlibcFree,            /* free_function */
     &GlibcGetSizeEstimate, /* get_size_estimate_function */
+    nullptr,               /* claimed_address */
     nullptr,               /* batch_malloc_function */
     nullptr,               /* batch_free_function */
     nullptr,               /* free_definite_size_function */
+    nullptr,               /* try_free_default_function */
     nullptr,               /* aligned_malloc_function */
     nullptr,               /* aligned_realloc_function */
     nullptr,               /* aligned_free_function */
diff --git a/base/allocator/partition_allocator/shim/allocator_shim_default_dispatch_to_linker_wrapped_symbols.cc b/base/allocator/partition_allocator/shim/allocator_shim_default_dispatch_to_linker_wrapped_symbols.cc
index 7ac1308..6a73d8a 100644
--- a/base/allocator/partition_allocator/shim/allocator_shim_default_dispatch_to_linker_wrapped_symbols.cc
+++ b/base/allocator/partition_allocator/shim/allocator_shim_default_dispatch_to_linker_wrapped_symbols.cc
@@ -74,9 +74,11 @@
     &RealRealloc,      /* realloc_function */
     &RealFree,         /* free_function */
     &RealSizeEstimate, /* get_size_estimate_function */
+    nullptr,           /* claimed_address */
     nullptr,           /* batch_malloc_function */
     nullptr,           /* batch_free_function */
     nullptr,           /* free_definite_size_function */
+    nullptr,           /* try_free_default_function */
     nullptr,           /* aligned_malloc_function */
     nullptr,           /* aligned_realloc_function */
     nullptr,           /* aligned_free_function */
diff --git a/base/allocator/partition_allocator/shim/allocator_shim_default_dispatch_to_mac_zoned_malloc.cc b/base/allocator/partition_allocator/shim/allocator_shim_default_dispatch_to_mac_zoned_malloc.cc
index ecd960d..76b275c0 100644
--- a/base/allocator/partition_allocator/shim/allocator_shim_default_dispatch_to_mac_zoned_malloc.cc
+++ b/base/allocator/partition_allocator/shim/allocator_shim_default_dispatch_to_mac_zoned_malloc.cc
@@ -54,6 +54,18 @@
   return functions.size(reinterpret_cast<struct _malloc_zone_t*>(context), ptr);
 }
 
+bool ClaimedAddressImpl(const AllocatorDispatch*, void* ptr, void* context) {
+  MallocZoneFunctions& functions = GetFunctionsForZone(context);
+  if (functions.claimed_address) {
+    return functions.claimed_address(
+        reinterpret_cast<struct _malloc_zone_t*>(context), ptr);
+  }
+  // If the fast API 'claimed_address' is not implemented in the specified zone,
+  // fall back to 'size' function, which also tells whether the given address
+  // belongs to the zone or not although it'd be slow.
+  return functions.size(reinterpret_cast<struct _malloc_zone_t*>(context), ptr);
+}
+
 unsigned BatchMallocImpl(const AllocatorDispatch* self,
                          size_t size,
                          void** results,
@@ -83,6 +95,17 @@
       reinterpret_cast<struct _malloc_zone_t*>(context), ptr, size);
 }
 
+void TryFreeDefaultImpl(const AllocatorDispatch* self,
+                        void* ptr,
+                        void* context) {
+  MallocZoneFunctions& functions = GetFunctionsForZone(context);
+  if (functions.try_free_default) {
+    return functions.try_free_default(
+        reinterpret_cast<struct _malloc_zone_t*>(context), ptr);
+  }
+  allocator_shim::TryFreeDefaultFallbackToFindZoneAndFree(ptr);
+}
+
 }  // namespace
 
 const AllocatorDispatch AllocatorDispatch::default_dispatch = {
@@ -93,9 +116,11 @@
     &ReallocImpl,          /* realloc_function */
     &FreeImpl,             /* free_function */
     &GetSizeEstimateImpl,  /* get_size_estimate_function */
+    &ClaimedAddressImpl,   /* claimed_address_function */
     &BatchMallocImpl,      /* batch_malloc_function */
     &BatchFreeImpl,        /* batch_free_function */
     &FreeDefiniteSizeImpl, /* free_definite_size_function */
+    &TryFreeDefaultImpl,   /* try_free_default_function */
     nullptr,               /* aligned_malloc_function */
     nullptr,               /* aligned_realloc_function */
     nullptr,               /* aligned_free_function */
diff --git a/base/allocator/partition_allocator/shim/allocator_shim_default_dispatch_to_partition_alloc.cc b/base/allocator/partition_allocator/shim/allocator_shim_default_dispatch_to_partition_alloc.cc
index 7b917f3..a6bfe89 100644
--- a/base/allocator/partition_allocator/shim/allocator_shim_default_dispatch_to_partition_alloc.cc
+++ b/base/allocator/partition_allocator/shim/allocator_shim_default_dispatch_to_partition_alloc.cc
@@ -488,6 +488,15 @@
   return size;
 }
 
+#if BUILDFLAG(IS_APPLE)
+bool PartitionClaimedAddress(const AllocatorDispatch*,
+                             void* address,
+                             void* context) {
+  return partition_alloc::IsManagedByPartitionAlloc(
+      reinterpret_cast<uintptr_t>(address));
+}
+#endif  // BUILDFLAG(IS_APPLE)
+
 unsigned PartitionBatchMalloc(const AllocatorDispatch*,
                               size_t size,
                               void** results,
@@ -515,6 +524,23 @@
   }
 }
 
+#if BUILDFLAG(IS_APPLE)
+void PartitionTryFreeDefault(const AllocatorDispatch*,
+                             void* address,
+                             void* context) {
+  partition_alloc::ScopedDisallowAllocations guard{};
+
+  if (UNLIKELY(!partition_alloc::IsManagedByPartitionAlloc(
+          reinterpret_cast<uintptr_t>(address)))) {
+    // The object pointed to by `address` is not allocated by the
+    // PartitionAlloc. Call find_zone_and_free.
+    return allocator_shim::TryFreeDefaultFallbackToFindZoneAndFree(address);
+  }
+
+  partition_alloc::ThreadSafePartitionRoot::FreeNoHooks(address);
+}
+#endif  // BUILDFLAG(IS_APPLE)
+
 // static
 partition_alloc::ThreadSafePartitionRoot* PartitionAllocMalloc::Allocator() {
   return ::Allocator();
@@ -728,6 +754,11 @@
     &allocator_shim::internal::PartitionFree,      // free_function
     &allocator_shim::internal::
         PartitionGetSizeEstimate,  // get_size_estimate_function
+#if BUILDFLAG(IS_APPLE)
+    &allocator_shim::internal::PartitionClaimedAddress,  // claimed_address
+#else
+    nullptr,  // claimed_address
+#endif
     &allocator_shim::internal::PartitionBatchMalloc,  // batch_malloc_function
     &allocator_shim::internal::PartitionBatchFree,    // batch_free_function
 #if BUILDFLAG(IS_APPLE)
@@ -735,8 +766,12 @@
     // get_size_estimate() is used to determine whether an allocation belongs to
     // the current zone. It makes sense to optimize for it.
     &allocator_shim::internal::PartitionFreeDefiniteSize,
+    // On Apple OSes, try_free_default() is sometimes called as an optimization
+    // of free().
+    &allocator_shim::internal::PartitionTryFreeDefault,
 #else
     nullptr,  // free_definite_size_function
+    nullptr,  // try_free_default_function
 #endif
     &allocator_shim::internal::
         PartitionAlignedAlloc,  // aligned_malloc_function
diff --git a/base/allocator/partition_allocator/shim/allocator_shim_default_dispatch_to_winheap.cc b/base/allocator/partition_allocator/shim/allocator_shim_default_dispatch_to_winheap.cc
index 165708b..adc15be 100644
--- a/base/allocator/partition_allocator/shim/allocator_shim_default_dispatch_to_winheap.cc
+++ b/base/allocator/partition_allocator/shim/allocator_shim_default_dispatch_to_winheap.cc
@@ -96,9 +96,11 @@
     &DefaultWinHeapReallocImpl,
     &DefaultWinHeapFreeImpl,
     &DefaultWinHeapGetSizeEstimateImpl,
+    nullptr, /* claimed_address */
     nullptr, /* batch_malloc_function */
     nullptr, /* batch_free_function */
     nullptr, /* free_definite_size_function */
+    nullptr, /* try_free_default_function */
     &DefaultWinHeapAlignedMallocImpl,
     &DefaultWinHeapAlignedReallocImpl,
     &DefaultWinHeapAlignedFreeImpl,
diff --git a/base/allocator/partition_allocator/shim/allocator_shim_override_mac_default_zone.h b/base/allocator/partition_allocator/shim/allocator_shim_override_mac_default_zone.h
index c1dd5a6d..86d5be80 100644
--- a/base/allocator/partition_allocator/shim/allocator_shim_override_mac_default_zone.h
+++ b/base/allocator/partition_allocator/shim/allocator_shim_override_mac_default_zone.h
@@ -193,6 +193,16 @@
   return ShimBatchFree(to_be_freed, num, nullptr);
 }
 
+boolean_t MallocZoneClaimedAddress(malloc_zone_t* zone, void* ptr) {
+  return static_cast<boolean_t>(ShimClaimedAddress(ptr, nullptr));
+}
+
+#if PA_TRY_FREE_DEFAULT_IS_AVAILABLE
+void MallocZoneTryFreeDefault(malloc_zone_t* zone, void* ptr) {
+  return ShimTryFreeDefault(ptr, nullptr);
+}
+#endif
+
 malloc_introspection_t g_mac_malloc_introspection{};
 malloc_zone_t g_mac_malloc_zone{};
 
@@ -295,6 +305,7 @@
   //   version >= 10: claimed_address is supported
   //   version >= 11: introspect.print_task is supported
   //   version >= 12: introspect.task_statistics is supported
+  //   version >= 13: try_free_default is supported
   g_mac_malloc_zone.version = partition_alloc::kZoneVersion;
   g_mac_malloc_zone.zone_name = partition_alloc::kPartitionAllocZoneName;
   g_mac_malloc_zone.introspect = &g_mac_malloc_introspection;
@@ -310,7 +321,10 @@
   g_mac_malloc_zone.memalign = MallocZoneMemalign;
   g_mac_malloc_zone.free_definite_size = MallocZoneFreeDefiniteSize;
   g_mac_malloc_zone.pressure_relief = nullptr;
-  g_mac_malloc_zone.claimed_address = nullptr;
+  g_mac_malloc_zone.claimed_address = MallocZoneClaimedAddress;
+#if PA_TRY_FREE_DEFAULT_IS_AVAILABLE
+  g_mac_malloc_zone.try_free_default = MallocZoneTryFreeDefault;
+#endif
 }
 
 namespace {
diff --git a/base/allocator/partition_allocator/shim/allocator_shim_override_mac_symbols.h b/base/allocator/partition_allocator/shim/allocator_shim_override_mac_symbols.h
index 4da6813..08e76ab 100644
--- a/base/allocator/partition_allocator/shim/allocator_shim_override_mac_symbols.h
+++ b/base/allocator/partition_allocator/shim/allocator_shim_override_mac_symbols.h
@@ -20,6 +20,10 @@
   new_functions.size = [](malloc_zone_t* zone, const void* ptr) -> size_t {
     return ShimGetSizeEstimate(ptr, zone);
   };
+  new_functions.claimed_address = [](malloc_zone_t* zone,
+                                     void* ptr) -> boolean_t {
+    return ShimClaimedAddress(ptr, zone);
+  };
   new_functions.malloc = [](malloc_zone_t* zone, size_t size) -> void* {
     return ShimMalloc(size, zone);
   };
@@ -54,6 +58,9 @@
                                         size_t size) {
     ShimFreeDefiniteSize(ptr, size, zone);
   };
+  new_functions.try_free_default = [](malloc_zone_t* zone, void* ptr) {
+    ShimTryFreeDefault(ptr, zone);
+  };
   return new_functions;
 }
 
diff --git a/base/allocator/partition_allocator/shim/allocator_shim_unittest.cc b/base/allocator/partition_allocator/shim/allocator_shim_unittest.cc
index 6caf9d6..59b4a2c9 100644
--- a/base/allocator/partition_allocator/shim/allocator_shim_unittest.cc
+++ b/base/allocator/partition_allocator/shim/allocator_shim_unittest.cc
@@ -144,6 +144,15 @@
     return self->next->get_size_estimate_function(self->next, address, context);
   }
 
+  static bool MockClaimedAddress(const AllocatorDispatch* self,
+                                 void* address,
+                                 void* context) {
+    // The same as MockGetSizeEstimate.
+    if (address == kTestSizeEstimateAddress)
+      return true;
+    return self->next->claimed_address_function(self->next, address, context);
+  }
+
   static unsigned MockBatchMalloc(const AllocatorDispatch* self,
                                   size_t size,
                                   void** results,
@@ -181,6 +190,15 @@
     self->next->free_definite_size_function(self->next, ptr, size, context);
   }
 
+  static void MockTryFreeDefault(const AllocatorDispatch* self,
+                                 void* ptr,
+                                 void* context) {
+    if (instance_) {
+      ++instance_->frees_intercepted_by_addr[Hash(ptr)];
+    }
+    self->next->try_free_default_function(self->next, ptr, context);
+  }
+
   static void* MockAlignedMalloc(const AllocatorDispatch* self,
                                  size_t size,
                                  size_t alignment,
@@ -325,9 +343,11 @@
     &AllocatorShimTest::MockRealloc,       /* realloc_function */
     &AllocatorShimTest::MockFree,          /* free_function */
     &AllocatorShimTest::MockGetSizeEstimate,  /* get_size_estimate_function */
+    &AllocatorShimTest::MockClaimedAddress,   /* claimed_address_function */
     &AllocatorShimTest::MockBatchMalloc,      /* batch_malloc_function */
     &AllocatorShimTest::MockBatchFree,        /* batch_free_function */
     &AllocatorShimTest::MockFreeDefiniteSize, /* free_definite_size_function */
+    &AllocatorShimTest::MockTryFreeDefault,   /* try_free_default_function */
     &AllocatorShimTest::MockAlignedMalloc,    /* aligned_malloc_function */
     &AllocatorShimTest::MockAlignedRealloc,   /* aligned_realloc_function */
     &AllocatorShimTest::MockAlignedFree,      /* aligned_free_function */
diff --git a/base/allocator/partition_allocator/shim/malloc_zone_functions_mac.cc b/base/allocator/partition_allocator/shim/malloc_zone_functions_mac.cc
index 45f547f..01c4fab 100644
--- a/base/allocator/partition_allocator/shim/malloc_zone_functions_mac.cc
+++ b/base/allocator/partition_allocator/shim/malloc_zone_functions_mac.cc
@@ -38,6 +38,12 @@
     // This may be nullptr.
     functions->free_definite_size = zone->free_definite_size;
   }
+  if (zone->version >= 10) {
+    functions->claimed_address = zone->claimed_address;
+  }
+  if (zone->version >= 13) {
+    functions->try_free_default = zone->try_free_default;
+  }
 
   // Note that zone version 8 introduced a pressure relief callback, and version
   // 10 introduced a claimed address callback, but neither are allocation or
diff --git a/base/allocator/partition_allocator/shim/malloc_zone_functions_mac.h b/base/allocator/partition_allocator/shim/malloc_zone_functions_mac.h
index c6b640a0..984f3d5 100644
--- a/base/allocator/partition_allocator/shim/malloc_zone_functions_mac.h
+++ b/base/allocator/partition_allocator/shim/malloc_zone_functions_mac.h
@@ -36,7 +36,10 @@
 typedef void (*free_definite_size_type)(struct _malloc_zone_t* zone,
                                         void* ptr,
                                         size_t size);
+typedef void (*try_free_default_type)(struct _malloc_zone_t* zone, void* ptr);
 typedef size_t (*size_fn_type)(struct _malloc_zone_t* zone, const void* ptr);
+typedef boolean_t (*claimed_address_type)(struct _malloc_zone_t* zone,
+                                          void* ptr);
 
 struct MallocZoneFunctions {
   malloc_type malloc;
@@ -48,7 +51,9 @@
   batch_malloc_type batch_malloc;
   batch_free_type batch_free;
   free_definite_size_type free_definite_size;
+  try_free_default_type try_free_default;
   size_fn_type size;
+  claimed_address_type claimed_address;
   const ChromeMallocZone* context;
 };
 
diff --git a/base/containers/circular_deque_unittest.cc b/base/containers/circular_deque_unittest.cc
index 0ad9b4f0..381ab59 100644
--- a/base/containers/circular_deque_unittest.cc
+++ b/base/containers/circular_deque_unittest.cc
@@ -4,6 +4,7 @@
 
 #include "base/containers/circular_deque.h"
 
+#include "base/memory/raw_ptr.h"
 #include "base/test/copy_only_int.h"
 #include "base/test/move_only_int.h"
 #include "testing/gtest/include/gtest/gtest.h"
@@ -41,7 +42,7 @@
   ~DestructorCounter() { ++(*counter_); }
 
  private:
-  int* counter_;
+  raw_ptr<int> counter_;
 };
 
 }  // namespace
diff --git a/base/containers/id_map_unittest.cc b/base/containers/id_map_unittest.cc
index 3a2801b5..e1401dd4 100644
--- a/base/containers/id_map_unittest.cc
+++ b/base/containers/id_map_unittest.cc
@@ -8,6 +8,7 @@
 
 #include <memory>
 
+#include "base/memory/raw_ptr.h"
 #include "base/test/gtest_util.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
@@ -24,7 +25,7 @@
   ~DestructorCounter() { ++(*counter_); }
 
  private:
-  int* counter_;
+  raw_ptr<int> counter_;
 };
 
 }  // namespace
diff --git a/base/feature_list.cc b/base/feature_list.cc
index fb705f8..c9846f3 100644
--- a/base/feature_list.cc
+++ b/base/feature_list.cc
@@ -14,6 +14,7 @@
 #include "base/debug/dump_without_crashing.h"
 #include "base/logging.h"
 #include "base/memory/ptr_util.h"
+#include "base/memory/raw_ptr.h"
 #include "base/metrics/field_trial.h"
 #include "base/metrics/field_trial_param_associator.h"
 #include "base/metrics/field_trial_params.h"
@@ -106,7 +107,7 @@
   Lock lock_;
 
   // First feature to be accessed before FeatureList registration.
-  const Feature* feature_ GUARDED_BY(lock_) = nullptr;
+  raw_ptr<const Feature> feature_ GUARDED_BY(lock_) = nullptr;
 
   // Whether AccessedFeature() should fail instantly.
   bool fail_instantly_ GUARDED_BY(lock_) = false;
@@ -868,7 +869,7 @@
       target_list->push_back('*');
     target_list->append(entry.first);
     if (entry.second.field_trial) {
-      auto* const field_trial = entry.second.field_trial;
+      auto* const field_trial = entry.second.field_trial.get();
       target_list->push_back('<');
       target_list->append(field_trial->trial_name());
       if (include_group_name) {
diff --git a/base/feature_list.h b/base/feature_list.h
index b942f0b5..922e2d9 100644
--- a/base/feature_list.h
+++ b/base/feature_list.h
@@ -498,7 +498,7 @@
     // An optional associated field trial, which will be activated when the
     // state of the feature is queried for the first time. Weak pointer to the
     // FieldTrial object that is owned by the FieldTrialList singleton.
-    base::FieldTrial* field_trial;
+    raw_ptr<base::FieldTrial> field_trial;
 
     // Specifies whether the feature's state is overridden by |field_trial|.
     // If it's not, and |field_trial| is not null, it means it is simply an
diff --git a/base/message_loop/message_pump_epoll.h b/base/message_loop/message_pump_epoll.h
index c615dd9..3152d66 100644
--- a/base/message_loop/message_pump_epoll.h
+++ b/base/message_loop/message_pump_epoll.h
@@ -100,7 +100,7 @@
     // this entry. This is set immediately upon returning from epoll_wait() and
     // cleared again immediately before dispatching to any registered interests,
     // so long as this entry isn't destroyed in the interim.
-    epoll_event* active_event = nullptr;
+    raw_ptr<epoll_event> active_event = nullptr;
   };
 
   // State which lives on the stack within Run(), to support nested run loops.
diff --git a/base/message_loop/message_pump_libevent.h b/base/message_loop/message_pump_libevent.h
index 74f632a4..06c3f381 100644
--- a/base/message_loop/message_pump_libevent.h
+++ b/base/message_loop/message_pump_libevent.h
@@ -92,7 +92,7 @@
     friend class RefCounted<EpollInterest>;
     ~EpollInterest();
 
-    FdWatchController* const controller_;
+    const raw_ptr<FdWatchController> controller_;
     const EpollInterestParams params_;
     bool active_ = true;
     bool was_controller_destroyed_ = false;
diff --git a/base/metrics/persistent_memory_allocator.h b/base/metrics/persistent_memory_allocator.h
index 739dfe78..b4226df 100644
--- a/base/metrics/persistent_memory_allocator.h
+++ b/base/metrics/persistent_memory_allocator.h
@@ -903,7 +903,7 @@
   // The underlying object that does the actual allocation of memory. Its
   // lifetime must exceed that of all DelayedPersistentAllocation objects
   // that use it.
-  PersistentMemoryAllocator* const allocator_;
+  const raw_ptr<PersistentMemoryAllocator> allocator_;
 
   // The desired type and size of the allocated segment plus the offset
   // within it for the defined request.
@@ -918,7 +918,7 @@
   // stored once the allocation is complete. If multiple delayed allocations
   // share the same pointer then an allocation on one will amount to an
   // allocation for all.
-  volatile std::atomic<Reference>* const reference_;
+  const raw_ptr<volatile std::atomic<Reference>> reference_;
 
   // No DISALLOW_COPY_AND_ASSIGN as it's okay to copy/move these objects.
 };
diff --git a/base/power_monitor/battery_level_provider.cc b/base/power_monitor/battery_level_provider.cc
index e0412a8..d9ef861 100644
--- a/base/power_monitor/battery_level_provider.cc
+++ b/base/power_monitor/battery_level_provider.cc
@@ -34,12 +34,10 @@
 
   // Only populate the following fields if there is one battery detail.
   if (battery_details.size() == 1) {
-    state.current_capacity =
-        absl::make_optional(battery_details.front().current_capacity);
-    state.full_charged_capacity =
-        absl::make_optional(battery_details.front().full_charged_capacity);
-    state.charge_unit =
-        absl::make_optional(battery_details.front().charge_unit);
+    state.current_capacity = battery_details.front().current_capacity;
+    state.full_charged_capacity = battery_details.front().full_charged_capacity;
+    state.voltage_mv = battery_details.front().voltage_mv;
+    state.charge_unit = battery_details.front().charge_unit;
 #if BUILDFLAG(IS_WIN)
     state.battery_discharge_granularity =
         battery_details.front().battery_discharge_granularity;
diff --git a/base/power_monitor/battery_level_provider.h b/base/power_monitor/battery_level_provider.h
index 655d06f9..5f4b4dd8 100644
--- a/base/power_monitor/battery_level_provider.h
+++ b/base/power_monitor/battery_level_provider.h
@@ -48,6 +48,10 @@
     // Fully charged battery capacity. nullopt if `battery_count` != 1.
     absl::optional<uint64_t> full_charged_capacity;
 
+    // The voltage of the battery. Only available on MacOS. nullopt if
+    // `battery_count` != 1.
+    absl::optional<uint64_t> voltage_mv;
+
     // The unit of the battery's charge. Usually kMWh (milliwatt-hour) but can
     // be relative on Windows. nullopt if `battery_count` != 1.
     absl::optional<BatteryLevelUnit> charge_unit;
@@ -99,6 +103,9 @@
     // The battery's fully charged capacity.
     uint64_t full_charged_capacity;
 
+    // The voltage of the battery. Only available on MacOS.
+    absl::optional<uint64_t> voltage_mv;
+
     // The battery's unit of charge.
     BatteryLevelUnit charge_unit;
 
diff --git a/base/power_monitor/battery_level_provider_mac.mm b/base/power_monitor/battery_level_provider_mac.mm
index 62c99ed..e326543 100644
--- a/base/power_monitor/battery_level_provider_mac.mm
+++ b/base/power_monitor/battery_level_provider_mac.mm
@@ -133,16 +133,12 @@
   DCHECK_GE(*max_capacity, 0);
   DCHECK_GE(*voltage_mv, 0);
 
-  uint64_t current_capacity_mwh = static_cast<uint64_t>(
-      current_capacity.value() * voltage_mv.value() / 1000);
-  uint64_t max_capacity_mwh =
-      static_cast<uint64_t>(max_capacity.value() * voltage_mv.value() / 1000);
-
-  return MakeBatteryState(
-      {BatteryDetails{.is_external_power_connected = external_connected.value(),
-                      .current_capacity = current_capacity_mwh,
-                      .full_charged_capacity = max_capacity_mwh,
-                      .charge_unit = BatteryLevelUnit::kMWh}});
+  return MakeBatteryState({BatteryDetails{
+      .is_external_power_connected = external_connected.value(),
+      .current_capacity = static_cast<uint64_t>(current_capacity.value()),
+      .full_charged_capacity = static_cast<uint64_t>(max_capacity.value()),
+      .voltage_mv = static_cast<uint64_t>(voltage_mv.value()),
+      .charge_unit = BatteryLevelUnit::kMAh}});
 }
 
 }  // namespace base
diff --git a/base/power_monitor/battery_level_provider_unittest.cc b/base/power_monitor/battery_level_provider_unittest.cc
index 89fc5f2b..9906631 100644
--- a/base/power_monitor/battery_level_provider_unittest.cc
+++ b/base/power_monitor/battery_level_provider_unittest.cc
@@ -88,4 +88,21 @@
   EXPECT_NE(base::TimeTicks(), state.capture_time);
 }
 
+TEST(BatteryLevelProviderTest, SingleBatteryMAh) {
+  auto state = FakeBatteryLevelProvider::MakeBatteryState({BatteryDetails(
+      {.is_external_power_connected = false,
+       .current_capacity = 42,
+       .full_charged_capacity = 100,
+       .voltage_mv = 12,
+       .charge_unit = BatteryLevelProvider::BatteryLevelUnit::kMAh})});
+  EXPECT_EQ(1, state.battery_count);
+  EXPECT_FALSE(state.is_external_power_connected);
+  EXPECT_EQ(42U, state.current_capacity);
+  EXPECT_EQ(100U, state.full_charged_capacity);
+  EXPECT_TRUE(state.voltage_mv.has_value());
+  EXPECT_EQ(12U, *state.voltage_mv);
+  EXPECT_EQ(BatteryLevelProvider::BatteryLevelUnit::kMAh, state.charge_unit);
+  EXPECT_NE(base::TimeTicks(), state.capture_time);
+}
+
 }  // namespace base
diff --git a/base/profiler/frame.h b/base/profiler/frame.h
index d6fb15f..e29d887 100644
--- a/base/profiler/frame.h
+++ b/base/profiler/frame.h
@@ -6,6 +6,7 @@
 #define BASE_PROFILER_FRAME_H_
 
 #include "base/base_export.h"
+#include "base/memory/raw_ptr_exclusion.h"
 #include "base/profiler/module_cache.h"
 
 namespace base {
@@ -27,7 +28,9 @@
   uintptr_t instruction_pointer;
 
   // The module information.
-  const ModuleCache::Module* module;
+  // `module` is not a raw_ptr<...> because it is used with gmock Field() that
+  // expects a raw pointer in V8UnwinderTest.UnwindThroughV8Frames.
+  RAW_PTR_EXCLUSION const ModuleCache::Module* module;
 
   // This serves as a temporary way to pass function names from libunwindstack
   // unwinder to tracing profiler. Not used by any other unwinder.
diff --git a/base/profiler/stack_sampling_profiler_test_util.cc b/base/profiler/stack_sampling_profiler_test_util.cc
index ab66d39a..2c70d585 100644
--- a/base/profiler/stack_sampling_profiler_test_util.cc
+++ b/base/profiler/stack_sampling_profiler_test_util.cc
@@ -397,7 +397,7 @@
     if (frame_it->instruction_pointer >=
             reinterpret_cast<uintptr_t>(function_it->start) &&
         frame_it->instruction_pointer <=
-            reinterpret_cast<uintptr_t>(function_it->end)) {
+            reinterpret_cast<uintptr_t>(function_it->end.get())) {
       ++function_it;
     }
   }
@@ -443,7 +443,7 @@
       if (frame.instruction_pointer >=
               reinterpret_cast<uintptr_t>(function.start) &&
           frame.instruction_pointer <=
-              reinterpret_cast<uintptr_t>(function.end)) {
+              reinterpret_cast<uintptr_t>(function.end.get())) {
         seen_functions.insert(function);
       }
     }
diff --git a/base/profiler/stack_sampling_profiler_test_util.h b/base/profiler/stack_sampling_profiler_test_util.h
index 9c50cb7..4a8d6c6 100644
--- a/base/profiler/stack_sampling_profiler_test_util.h
+++ b/base/profiler/stack_sampling_profiler_test_util.h
@@ -11,6 +11,7 @@
 
 #include "base/base_export.h"
 #include "base/callback.h"
+#include "base/memory/raw_ptr.h"
 #include "base/native_library.h"
 #include "base/profiler/frame.h"
 #include "base/profiler/sampling_profiler_thread_token.h"
@@ -50,7 +51,7 @@
 // Addresses near the start and end of a function.
 struct FunctionAddressRange {
   const void* start;
-  const void* end;
+  raw_ptr<const void> end;
 };
 
 // Represents a stack unwind scenario to be sampled by the
diff --git a/base/scoped_generic_unittest.cc b/base/scoped_generic_unittest.cc
index d49cb4b0..0cbcbd2 100644
--- a/base/scoped_generic_unittest.cc
+++ b/base/scoped_generic_unittest.cc
@@ -11,6 +11,7 @@
 #include <vector>
 
 #include "base/containers/contains.h"
+#include "base/memory/raw_ptr.h"
 #include "build/build_config.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
@@ -28,7 +29,7 @@
     freed_ints->push_back(value);
   }
 
-  std::vector<int>* freed_ints;
+  raw_ptr<std::vector<int>> freed_ints;
 };
 
 using ScopedInt = ScopedGeneric<int, IntTraits>;
@@ -187,8 +188,8 @@
     owners->erase(it);
   }
 
-  std::unordered_set<int>* freed;
-  OwnerMap* owners;
+  raw_ptr<std::unordered_set<int>> freed;
+  raw_ptr<OwnerMap> owners;
 };
 
 using ScopedTrackedInt = ScopedGeneric<int, TrackedIntTraits>;
diff --git a/base/task/common/task_annotator.h b/base/task/common/task_annotator.h
index dba387e..7fafe246 100644
--- a/base/task/common/task_annotator.h
+++ b/base/task/common/task_annotator.h
@@ -156,7 +156,7 @@
   void EmitReceivedIPCDetails(perfetto::EventContext& ctx);
 
   // For tracking task duration
-  const TickClock* tick_clock_;  // Not owned.
+  raw_ptr<const TickClock> tick_clock_;  // Not owned.
   TimeTicks task_start_time_;
 
   // Tracing variables.
@@ -173,7 +173,7 @@
   uint32_t (*ipc_method_info_)();
   bool is_response_ = false;
   PendingTask& pending_task_;
-  TaskAnnotator* task_annotator_;
+  raw_ptr<TaskAnnotator> task_annotator_;
 };
 
 }  // namespace base
diff --git a/base/task/sequence_manager/sequence_manager_impl.cc b/base/task/sequence_manager/sequence_manager_impl.cc
index 546acc1..48c0799 100644
--- a/base/task/sequence_manager/sequence_manager_impl.cc
+++ b/base/task/sequence_manager/sequence_manager_impl.cc
@@ -763,7 +763,7 @@
 
 void SequenceManagerImpl::MaybeAddLeewayToTask(Task& task) const {
   if (!main_thread_only().time_domain) {
-    task.leeway = base::GetTaskLeeway();
+    task.leeway = GetTaskLeewayForCurrentThread();
   }
 }
 
diff --git a/base/task/sequence_manager/thread_controller.h b/base/task/sequence_manager/thread_controller.h
index e4d4f53..8e439e4 100644
--- a/base/task/sequence_manager/thread_controller.h
+++ b/base/task/sequence_manager/thread_controller.h
@@ -357,7 +357,7 @@
       bool current_work_item_is_native_ = true;
 
       // non-null when recording is enabled.
-      HistogramBase* histogram_ = nullptr;
+      raw_ptr<HistogramBase> histogram_ = nullptr;
 #if BUILDFLAG(ENABLE_BASE_TRACING)
       absl::optional<perfetto::Track> perfetto_track_;
 
@@ -397,7 +397,7 @@
 
       const raw_ref<TimeKeeper> time_keeper_;
       // Must be set shortly before ~RunLevel.
-      LazyNow* exit_lazy_now_ = nullptr;
+      raw_ptr<LazyNow> exit_lazy_now_ = nullptr;
 
       SampleMetadata thread_controller_sample_metadata_;
       size_t thread_controller_active_id_ = 0;
diff --git a/base/task/sequence_manager/thread_controller_with_message_pump_impl.cc b/base/task/sequence_manager/thread_controller_with_message_pump_impl.cc
index 193da681..7a35dab 100644
--- a/base/task/sequence_manager/thread_controller_with_message_pump_impl.cc
+++ b/base/task/sequence_manager/thread_controller_with_message_pump_impl.cc
@@ -60,7 +60,7 @@
 TimeTicks WakeUpRunTime(const WakeUp& wake_up) {
   if (g_align_wake_ups.load(std::memory_order_relaxed)) {
     TimeTicks aligned_run_time = wake_up.earliest_time().SnappedToNextTick(
-        TimeTicks(), base::GetTaskLeeway());
+        TimeTicks(), GetTaskLeewayForCurrentThread());
     return std::min(aligned_run_time, wake_up.latest_time());
   }
   return wake_up.time;
diff --git a/base/task/sequence_manager/wake_up_queue.cc b/base/task/sequence_manager/wake_up_queue.cc
index 5166dbf2..2fce8da 100644
--- a/base/task/sequence_manager/wake_up_queue.cc
+++ b/base/task/sequence_manager/wake_up_queue.cc
@@ -27,7 +27,7 @@
   // needed because a different queue can become the top one once you remove the
   // canceled tasks.
   while (!wake_up_queue_.empty()) {
-    auto* top_queue = wake_up_queue_.top().queue;
+    auto* top_queue = wake_up_queue_.top().queue.get();
 
     // If no tasks are removed from the top queue, then it means the top queue
     // cannot change anymore.
diff --git a/base/task/sequence_manager/wake_up_queue.h b/base/task/sequence_manager/wake_up_queue.h
index 6428aed7..4c15b44b 100644
--- a/base/task/sequence_manager/wake_up_queue.h
+++ b/base/task/sequence_manager/wake_up_queue.h
@@ -87,7 +87,7 @@
 
   struct ScheduledWakeUp {
     WakeUp wake_up;
-    internal::TaskQueueImpl* queue;
+    raw_ptr<internal::TaskQueueImpl> queue;
 
     bool operator>(const ScheduledWakeUp& other) const {
       return wake_up.latest_time() > other.wake_up.latest_time();
diff --git a/base/task/task_features.cc b/base/task/task_features.cc
index febd72e..56005578 100644
--- a/base/task/task_features.cc
+++ b/base/task/task_features.cc
@@ -8,6 +8,7 @@
 
 #include "base/base_export.h"
 #include "base/feature_list.h"
+#include "base/threading/platform_thread.h"
 
 namespace base {
 
@@ -100,7 +101,16 @@
   g_task_leeway.store(kTaskLeewayParam.Get(), std::memory_order_relaxed);
 }
 
-BASE_EXPORT TimeDelta GetTaskLeeway() {
+BASE_EXPORT TimeDelta GetTaskLeewayForCurrentThread() {
+  // For some threads, there might be a override of the leeway, so check it
+  // first.
+  auto leeway_override = PlatformThread::GetThreadLeewayOverride();
+  if (leeway_override.has_value())
+    return leeway_override.value();
+  return g_task_leeway.load(std::memory_order_relaxed);
+}
+
+BASE_EXPORT TimeDelta GetDefaultTaskLeeway() {
   return g_task_leeway.load(std::memory_order_relaxed);
 }
 
diff --git a/base/task/task_features.h b/base/task/task_features.h
index a0cdf229..064da0c 100644
--- a/base/task/task_features.h
+++ b/base/task/task_features.h
@@ -79,7 +79,8 @@
     kBrowserPeriodicYieldingToNativeDelay;
 
 BASE_EXPORT void InitializeTaskLeeway();
-BASE_EXPORT TimeDelta GetTaskLeeway();
+BASE_EXPORT TimeDelta GetTaskLeewayForCurrentThread();
+BASE_EXPORT TimeDelta GetDefaultTaskLeeway();
 
 }  // namespace base
 
diff --git a/base/task/thread_pool/delayed_task_manager.cc b/base/task/thread_pool/delayed_task_manager.cc
index 8564444..6557dc0 100644
--- a/base/task/thread_pool/delayed_task_manager.cc
+++ b/base/task/thread_pool/delayed_task_manager.cc
@@ -192,7 +192,7 @@
   if (align_wake_ups_) {
     TimeTicks aligned_run_time =
         ripest_delayed_task.task.earliest_delayed_run_time().SnappedToNextTick(
-            TimeTicks(), base::GetTaskLeeway());
+            TimeTicks(), GetTaskLeewayForCurrentThread());
     delayed_run_time = std::min(
         aligned_run_time, ripest_delayed_task.task.latest_delayed_run_time());
   }
diff --git a/base/task/thread_pool/pooled_sequenced_task_runner.cc b/base/task/thread_pool/pooled_sequenced_task_runner.cc
index 3b7ceb6..5b2d9875 100644
--- a/base/task/thread_pool/pooled_sequenced_task_runner.cc
+++ b/base/task/thread_pool/pooled_sequenced_task_runner.cc
@@ -31,7 +31,7 @@
   }
 
   Task task(from_here, std::move(closure), TimeTicks::Now(), delay,
-            base::GetTaskLeeway());
+            GetDefaultTaskLeeway());
 
   // Post the task as part of |sequence_|.
   return pooled_task_runner_delegate_->PostTaskWithSequence(std::move(task),
@@ -50,7 +50,7 @@
   }
 
   Task task(from_here, std::move(closure), TimeTicks::Now(), delayed_run_time,
-            base::GetTaskLeeway(), delay_policy);
+            GetDefaultTaskLeeway(), delay_policy);
 
   // Post the task as part of |sequence_|.
   return pooled_task_runner_delegate_->PostTaskWithSequence(std::move(task),
diff --git a/base/task/thread_pool/pooled_single_thread_task_runner_manager.cc b/base/task/thread_pool/pooled_single_thread_task_runner_manager.cc
index 9fb4ad1..86f025ee 100644
--- a/base/task/thread_pool/pooled_single_thread_task_runner_manager.cc
+++ b/base/task/thread_pool/pooled_single_thread_task_runner_manager.cc
@@ -417,7 +417,7 @@
       return false;
 
     Task task(from_here, std::move(closure), TimeTicks::Now(), delay,
-              base::GetTaskLeeway());
+              GetDefaultTaskLeeway());
     return PostTask(std::move(task));
   }
 
@@ -430,7 +430,7 @@
       return false;
 
     Task task(from_here, std::move(closure), TimeTicks::Now(), delayed_run_time,
-              base::GetTaskLeeway(), delay_policy);
+              GetDefaultTaskLeeway(), delay_policy);
     return PostTask(std::move(task));
   }
 
diff --git a/base/task/thread_pool/thread_pool_impl.cc b/base/task/thread_pool/thread_pool_impl.cc
index 036aba3..4faa1d0 100644
--- a/base/task/thread_pool/thread_pool_impl.cc
+++ b/base/task/thread_pool/thread_pool_impl.cc
@@ -250,7 +250,7 @@
   // Post |task| as part of a one-off single-task Sequence.
   return PostTaskWithSequence(
       Task(from_here, std::move(task), TimeTicks::Now(), delay,
-           base::GetTaskLeeway()),
+           GetDefaultTaskLeeway()),
       MakeRefCounted<Sequence>(traits, nullptr,
                                TaskSourceExecutionMode::kParallel));
 }
diff --git a/base/threading/platform_thread.cc b/base/threading/platform_thread.cc
index ca1b56d1..8725ecd 100644
--- a/base/threading/platform_thread.cc
+++ b/base/threading/platform_thread.cc
@@ -8,6 +8,10 @@
 #include "base/task/current_thread.h"
 #include "base/threading/thread_local_storage.h"
 
+#if BUILDFLAG(IS_FUCHSIA)
+#include "base/fuchsia/scheduler.h"
+#endif
+
 namespace base {
 
 namespace {
@@ -58,6 +62,19 @@
   return GetThreadTypeFromTls();
 }
 
+// static
+absl::optional<TimeDelta> PlatformThread::GetThreadLeewayOverride() {
+#if BUILDFLAG(IS_FUCHSIA)
+  // On Fuchsia, all audio threads run with the CPU scheduling profile that uses
+  // an interval of |kAudioSchedulingPeriod|. Using the default leeway may lead
+  // to some tasks posted to audio threads to be executed too late (see
+  // http://crbug.com/1368858).
+  if (GetCurrentThreadType() == ThreadType::kRealtimeAudio)
+    return kAudioSchedulingPeriod;
+#endif
+  return absl::nullopt;
+}
+
 namespace internal {
 
 void SetCurrentThreadType(ThreadType thread_type,
diff --git a/base/threading/platform_thread.h b/base/threading/platform_thread.h
index e5699c0f..43e7064 100644
--- a/base/threading/platform_thread.h
+++ b/base/threading/platform_thread.h
@@ -19,6 +19,7 @@
 #include "base/time/time.h"
 #include "build/build_config.h"
 #include "build/chromeos_buildflags.h"
+#include "third_party/abseil-cpp/absl/types/optional.h"
 
 #if BUILDFLAG(IS_WIN)
 #include "base/win/windows_types.h"
@@ -253,6 +254,9 @@
   // Returns a realtime period provided by `delegate`.
   static TimeDelta GetRealtimePeriod(Delegate* delegate);
 
+  // Returns the override of task leeway if any.
+  static absl::optional<TimeDelta> GetThreadLeewayOverride();
+
 #if BUILDFLAG(IS_LINUX) || BUILDFLAG(IS_CHROMEOS)
   // Toggles a specific thread's type at runtime. This can be used to
   // change the priority of a thread in a different process and will fail
diff --git a/base/threading/sequence_bound_internal.h b/base/threading/sequence_bound_internal.h
index 732366d..ed463b8 100644
--- a/base/threading/sequence_bound_internal.h
+++ b/base/threading/sequence_bound_internal.h
@@ -15,6 +15,7 @@
 #include "base/functional/callback_helpers.h"
 #include "base/location.h"
 #include "base/memory/aligned_memory.h"
+#include "base/memory/raw_ptr.h"
 #include "base/task/sequenced_task_runner.h"
 
 namespace base::sequence_bound_internal {
@@ -92,7 +93,7 @@
     // AlignedAlloc() requires alignment be a multiple of sizeof(void*).
     alloc_ = AlignedAlloc(
         sizeof(T), sizeof(void*) > alignof(T) ? sizeof(void*) : alignof(T));
-    ptr_ = reinterpret_cast<Ptr>(alloc_);
+    ptr_ = reinterpret_cast<Ptr>(alloc_.get());
 
     // Ensure that `ptr_` will be initialized.
     CrossThreadTraits::PostTask(
@@ -151,7 +152,7 @@
   // Storage originally allocated by `AlignedAlloc()`. Maintained separately
   // from  `ptr_` since the original, unadjusted pointer needs to be passed to
   // `AlignedFree()`.
-  void* alloc_ = nullptr;
+  raw_ptr<void> alloc_ = nullptr;
 };
 
 template <typename T, typename CrossThreadTraits>
diff --git a/base/threading/sequence_bound_unittest.cc b/base/threading/sequence_bound_unittest.cc
index f377b9f..684416e 100644
--- a/base/threading/sequence_bound_unittest.cc
+++ b/base/threading/sequence_bound_unittest.cc
@@ -722,7 +722,7 @@
   void set_loop(RunLoop* loop) { loop_ = loop; }
 
  private:
-  RunLoop* loop_ = nullptr;
+  raw_ptr<RunLoop> loop_ = nullptr;
 };
 
 class NoArgsIntReturn {
diff --git a/base/trace_event/heap_profiler_allocation_context.cc b/base/trace_event/heap_profiler_allocation_context.cc
index a3aaf1c7..3d3d2b8 100644
--- a/base/trace_event/heap_profiler_allocation_context.cc
+++ b/base/trace_event/heap_profiler_allocation_context.cc
@@ -59,7 +59,7 @@
 using base::trace_event::StackFrame;
 
 size_t hash<StackFrame>::operator()(const StackFrame& frame) const {
-  return hash<const void*>()(frame.value);
+  return hash<const void*>()(frame.value.get());
 }
 
 size_t hash<Backtrace>::operator()(const Backtrace& backtrace) const {
diff --git a/base/trace_event/heap_profiler_allocation_context.h b/base/trace_event/heap_profiler_allocation_context.h
index 31be0e66..17c32a27 100644
--- a/base/trace_event/heap_profiler_allocation_context.h
+++ b/base/trace_event/heap_profiler_allocation_context.h
@@ -11,6 +11,7 @@
 #include <functional>
 
 #include "base/base_export.h"
+#include "base/memory/raw_ptr.h"
 
 namespace base {
 namespace trace_event {
@@ -42,7 +43,7 @@
   }
 
   Type type;
-  const void* value;
+  raw_ptr<const void> value;
 };
 
 bool BASE_EXPORT operator < (const StackFrame& lhs, const StackFrame& rhs);
diff --git a/base/win/embedded_i18n/language_selector.cc b/base/win/embedded_i18n/language_selector.cc
index 33828e2f..8df39b6b 100644
--- a/base/win/embedded_i18n/language_selector.cc
+++ b/base/win/embedded_i18n/language_selector.cc
@@ -13,6 +13,7 @@
 #include <functional>
 
 #include "base/check_op.h"
+#include "base/memory/raw_ptr.h"
 #include "base/ranges/algorithm.h"
 #include "base/strings/string_util.h"
 #include "base/strings/utf_string_conversions.h"
@@ -30,16 +31,16 @@
 // targets of exceptions (where one language is mapped to another) or wildcards
 // (where a raw language identifier is mapped to a specific localization).
 struct AvailableLanguageAliases {
-  const LangToOffset* en_gb_language_offset;
-  const LangToOffset* en_us_language_offset;
-  const LangToOffset* es_language_offset;
-  const LangToOffset* es_419_language_offset;
-  const LangToOffset* fil_language_offset;
-  const LangToOffset* iw_language_offset;
-  const LangToOffset* no_language_offset;
-  const LangToOffset* pt_br_language_offset;
-  const LangToOffset* zh_cn_language_offset;
-  const LangToOffset* zh_tw_language_offset;
+  raw_ptr<const LangToOffset> en_gb_language_offset;
+  raw_ptr<const LangToOffset> en_us_language_offset;
+  raw_ptr<const LangToOffset> es_language_offset;
+  raw_ptr<const LangToOffset> es_419_language_offset;
+  raw_ptr<const LangToOffset> fil_language_offset;
+  raw_ptr<const LangToOffset> iw_language_offset;
+  raw_ptr<const LangToOffset> no_language_offset;
+  raw_ptr<const LangToOffset> pt_br_language_offset;
+  raw_ptr<const LangToOffset> zh_cn_language_offset;
+  raw_ptr<const LangToOffset> zh_tw_language_offset;
 };
 
 #if DCHECK_IS_ON()
diff --git a/build/config/BUILDCONFIG.gn b/build/config/BUILDCONFIG.gn
index a373e55..2e6c122 100644
--- a/build/config/BUILDCONFIG.gn
+++ b/build/config/BUILDCONFIG.gn
@@ -605,3 +605,107 @@
 set_defaults("component") {
   configs = default_component_configs
 }
+
+# =============================================================================
+# ACTION OVERRIDE
+# =============================================================================
+#
+# We override gn action() to support remote execution using rewrapper. The
+# invoker should set allow_remote to true if remote execution is desired.
+#
+# As remote execution requires inputs to be made more explicit than is normally
+# expected with gn, you may find that setting allow_remote to true will result
+# in many missing file errors. This should be resolved by explicitly declaring
+# these inputs/sources.
+
+# Variables needed by rbe.gni aren't available at the top of this file.
+import("//build/toolchain/rbe.gni")
+
+# TODO(b/253987456): Add action_foreach support.
+foreach(_target_type, [ "action" ]) {
+  template(_target_type) {
+    forward_variables_from(invoker, TESTONLY_AND_VISIBILITY)
+    forward_variables_from(invoker, [ "allow_remote" ])
+    action("${target_name}") {
+      forward_variables_from(invoker,
+                             [
+                               "args",
+                               "assert_no_deps",
+                               "check_includes",
+                               "data_deps",
+                               "data",
+                               "depfile",
+                               "deps",
+                               "metadata",
+                               "outputs",
+                               "pool",
+                               "script",
+                               "public_configs",
+                               "public_deps",
+                               "response_file_contents",
+                               "sources",
+                               "write_runtime_deps",
+                             ])
+      allow_remote = false
+      if (defined(invoker.allow_remote)) {
+        allow_remote = invoker.allow_remote
+      }
+
+      # If remote execution is desired, only run remotely when use_remoteexec
+      # is enabled, and the environment is not nacl.
+      # TODO(b/259381924): Investigate enabling in nacl config.
+      if (allow_remote && use_remoteexec && !is_nacl) {
+        pool = "//build/toolchain:remote_action_pool($default_toolchain)"
+        script = "//build/util/action_remote.py"
+        inputs = [ invoker.script ]
+
+        re_inputs = [ rebase_path(invoker.script, rbe_exec_root) ]
+        if (defined(invoker.inputs)) {
+          foreach(input, invoker.inputs) {
+            re_inputs += [ rebase_path(input, rbe_exec_root) ]
+          }
+        }
+        if (defined(invoker.sources)) {
+          foreach(source, invoker.sources) {
+            re_inputs += [ rebase_path(source, rbe_exec_root) ]
+          }
+        }
+
+        re_outputs = []
+        if (defined(invoker.outputs)) {
+          foreach(output, invoker.outputs) {
+            re_outputs += [ rebase_path(output, rbe_exec_root) ]
+          }
+        }
+
+        # Write input/output lists to files as these can grow extremely large.
+        re_inputs_file = "$target_gen_dir/${target_name}__remote_inputs.rsp"
+        write_file(re_inputs_file, re_inputs)
+        re_outputs_file = "$target_gen_dir/${target_name}__remote_outputs.rsp"
+        write_file(re_outputs_file, re_outputs)
+
+        args = []
+        args += [ "$rbe_bin_dir/rewrapper" ]
+        if (defined(invoker.custom_processor)) {
+          args += [ "--custom_processor=" + invoker.custom_processor ]
+        }
+
+        args += [
+          "--cfg=$rbe_py_cfg_file",
+          "--exec_root=$rbe_exec_root",
+          "--input_list_paths=" + rebase_path(re_inputs_file, root_build_dir),
+          "--output_list_paths=" + rebase_path(re_outputs_file, root_build_dir),
+          "python3",
+          rebase_path(invoker.script, root_build_dir),
+        ]
+
+        if (defined(invoker.args)) {
+          args += invoker.args
+        }
+      } else {
+        forward_variables_from(invoker, [ "inputs" ])
+        not_needed(invoker, [ "custom_processor" ])
+      }
+    }
+  }
+}
diff --git a/build/fuchsia/linux_internal.sdk.sha1 b/build/fuchsia/linux_internal.sdk.sha1
index e10d794d..e7bea22 100644
--- a/build/fuchsia/linux_internal.sdk.sha1
+++ b/build/fuchsia/linux_internal.sdk.sha1
@@ -1 +1 @@
-10.20221118.1.1
+10.20221121.3.1
diff --git a/build/fuchsia/test/ffx_integration.py b/build/fuchsia/test/ffx_integration.py
index d8ac09f6..01b5d9a 100644
--- a/build/fuchsia/test/ffx_integration.py
+++ b/build/fuchsia/test/ffx_integration.py
@@ -189,16 +189,18 @@
                 json.dump(ast.literal_eval(qemu_arm64_meta), f)
             emu_command.extend(['--engine', 'qemu'])
 
-        with ScopedFfxConfig('emu.start.timeout', '180'):
+        with ScopedFfxConfig('emu.start.timeout', '90'):
             for _ in range(_EMU_COMMAND_RETRIES):
 
                 # If the ffx daemon fails to establish a connection with
-                # the emulator after 170 seconds, that means the emulator
+                # the emulator after 85 seconds, that means the emulator
                 # failed to be brought up and a retry is needed.
+                # TODO(fxb/103540): Remove retry when start up issue is fixed.
                 try:
-                    run_ffx_command(emu_command, timeout=170)
+                    run_ffx_command(emu_command, timeout=85)
                     break
-                except subprocess.TimeoutExpired:
+                except (subprocess.TimeoutExpired,
+                        subprocess.CalledProcessError):
                     run_ffx_command(('emu', 'stop'))
         return self._node_name
 
diff --git a/build/toolchain/BUILD.gn b/build/toolchain/BUILD.gn
index b3039bec..a3bd8c5 100644
--- a/build/toolchain/BUILD.gn
+++ b/build/toolchain/BUILD.gn
@@ -23,4 +23,8 @@
   pool("action_pool") {
     depth = action_pool_depth
   }
+
+  pool("remote_action_pool") {
+    depth = 1000
+  }
 }
diff --git a/build/toolchain/rbe.gni b/build/toolchain/rbe.gni
index e5a97ca..31ad93b 100644
--- a/build/toolchain/rbe.gni
+++ b/build/toolchain/rbe.gni
@@ -20,6 +20,7 @@
   rbe_cfg_dir = rebase_path("//buildtools/reclient_cfgs", root_build_dir)
 
   # Set to the path of the RBE reclient configuration files.
+  rbe_py_cfg_file = ""
   rbe_cc_cfg_file = ""
   rbe_link_cfg_file = ""
 
@@ -29,11 +30,13 @@
 
 # Configuration file selection based on operating system.
 if (is_linux || is_android || is_chromeos || is_fuchsia) {
+  rbe_py_cfg_file = "${rbe_cfg_dir}/python/rewrapper_linux.cfg"
   rbe_cc_cfg_file = "${rbe_cfg_dir}/chromium-browser-clang/rewrapper_linux.cfg"
   rbe_link_cfg_file =
       "${rbe_cfg_dir}/chromium-browser-clang/rewrapper_linux_link.cfg"
 }
 if (is_win) {
+  rbe_py_cfg_file = "${rbe_cfg_dir}/python/rewrapper_windows.cfg"
   rbe_cc_cfg_file =
       "${rbe_cfg_dir}/chromium-browser-clang/rewrapper_windows.cfg"
 
@@ -43,6 +46,7 @@
   }
 }
 if (is_mac || is_ios) {
+  rbe_py_cfg_file = "${rbe_cfg_dir}/python/rewrapper_mac.cfg"
   rbe_cc_cfg_file = "${rbe_cfg_dir}/chromium-browser-clang/rewrapper_mac.cfg"
 
   if (use_remoteexec_links) {
diff --git a/build/util/action_remote.py b/build/util/action_remote.py
new file mode 100755
index 0000000..021c871
--- /dev/null
+++ b/build/util/action_remote.py
@@ -0,0 +1,19 @@
+#!/usr/bin/env python3
+# Copyright 2022 The Chromium Authors
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+"""Wrapper script to run action remotely through rewrapper with gn."""
+
+import subprocess
+import sys
+
+
+def main():
+  # Pass through all args. Use check=True to ensure failure is raised.
+  args = sys.argv[1:]
+  proc = subprocess.run(args, check=True)
+  return proc.returncode
+
+
+if __name__ == '__main__':
+  sys.exit(main())
diff --git a/buildtools/reclient_cfgs/.gitignore b/buildtools/reclient_cfgs/.gitignore
index 99db49ba..8f00ec9 100644
--- a/buildtools/reclient_cfgs/.gitignore
+++ b/buildtools/reclient_cfgs/.gitignore
@@ -1,4 +1,5 @@
 /chromium-browser-clang/
 /nacl/
+/python/
 /win-cross-experiments/
 reproxy.cfg
diff --git a/buildtools/reclient_cfgs/fetch_reclient_cfgs.py b/buildtools/reclient_cfgs/fetch_reclient_cfgs.py
index 693349bd..1449e15d 100755
--- a/buildtools/reclient_cfgs/fetch_reclient_cfgs.py
+++ b/buildtools/reclient_cfgs/fetch_reclient_cfgs.py
@@ -70,7 +70,8 @@
 
     tool_revisions = {
         'chromium-browser-clang': ClangRevision(),
-        'nacl': NaclRevision()
+        'nacl': NaclRevision(),
+        'python': '3.8.0',
     }
     for toolchain in tool_revisions:
       revision = tool_revisions[toolchain]
diff --git a/cc/input/input_handler.h b/cc/input/input_handler.h
index 7468c16b..4b47f75 100644
--- a/cc/input/input_handler.h
+++ b/cc/input/input_handler.h
@@ -7,6 +7,7 @@
 
 #include <memory>
 
+#include "base/memory/raw_ptr.h"
 #include "base/memory/raw_ref.h"
 #include "base/time/time.h"
 #include "cc/cc_export.h"
@@ -637,7 +638,7 @@
   //   |scroll_node|. This can be nullptr if no layer was hit and there are no
   //   viewport nodes (e.g. OOPIF, UI compositor).
   struct ScrollHitTestResult {
-    ScrollNode* scroll_node;
+    raw_ptr<ScrollNode> scroll_node;
     bool hit_test_successful;
   };
   ScrollHitTestResult HitTestScrollNode(
diff --git a/cc/layers/effect_tree_layer_list_iterator.h b/cc/layers/effect_tree_layer_list_iterator.h
index fb7b879e..2540c556 100644
--- a/cc/layers/effect_tree_layer_list_iterator.h
+++ b/cc/layers/effect_tree_layer_list_iterator.h
@@ -75,9 +75,9 @@
 
   struct Position {
     State state = State::END;
-    LayerImpl* current_layer = nullptr;
-    RenderSurfaceImpl* current_render_surface = nullptr;
-    RenderSurfaceImpl* target_render_surface = nullptr;
+    raw_ptr<LayerImpl> current_layer = nullptr;
+    raw_ptr<RenderSurfaceImpl> current_render_surface = nullptr;
+    raw_ptr<RenderSurfaceImpl> target_render_surface = nullptr;
   };
 
   operator const Position() const {
diff --git a/cc/layers/picture_layer_impl.cc b/cc/layers/picture_layer_impl.cc
index d977f656..ebc1200 100644
--- a/cc/layers/picture_layer_impl.cc
+++ b/cc/layers/picture_layer_impl.cc
@@ -1229,6 +1229,25 @@
 
 bool PictureLayerImpl::CanRecreateHighResTilingForLCDTextAndRasterTransform(
     const PictureLayerTiling& high_res) const {
+  // Prefer re-rasterization for a change in LCD status from the following
+  // reasons since visual artifacts of LCD text on non-opaque background are
+  // very noticeable. This state also only changes during a commit and is likely
+  // to be discrete as opposed to every frame of the animation.
+  if (high_res.can_use_lcd_text() &&
+      (lcd_text_disallowed_reason_ ==
+           LCDTextDisallowedReason::kBackgroundColorNotOpaque ||
+       lcd_text_disallowed_reason_ ==
+           LCDTextDisallowedReason::kContentsNotOpaque)) {
+    // LCD text state changes require a commit and the existing tiling is
+    // invalidated before scheduling rasterization work for the new pending
+    // tree. So it shouldn't be possible for the new pending tree to be ready to
+    // activate before we have invalidated the existing high rest tiling. This
+    // is important to avoid activating a tree with missing tiles which can
+    // cause flickering.
+    DCHECK(!layer_tree_impl()->IsSyncTree() ||
+           !layer_tree_impl()->IsReadyToActivate());
+    return true;
+  }
   // We can recreate the tiling if we would invalidate all of its tiles.
   if (high_res.may_contain_low_resolution_tiles())
     return true;
diff --git a/cc/paint/paint_op_buffer.h b/cc/paint/paint_op_buffer.h
index b4b9a78..16c05563 100644
--- a/cc/paint/paint_op_buffer.h
+++ b/cc/paint/paint_op_buffer.h
@@ -217,17 +217,17 @@
                        std::vector<uint8_t>* scratch_buffer,
                        bool is_privileged,
                        SharedImageProvider* shared_image_provider);
-    TransferCacheDeserializeHelper* transfer_cache = nullptr;
-    ServicePaintCache* paint_cache = nullptr;
-    SkStrikeClient* strike_client = nullptr;
+    raw_ptr<TransferCacheDeserializeHelper> transfer_cache = nullptr;
+    raw_ptr<ServicePaintCache> paint_cache = nullptr;
+    raw_ptr<SkStrikeClient> strike_client = nullptr;
     // Do a DumpWithoutCrashing when serialization fails.
     bool crash_dump_on_failure = false;
     // Used to memcpy Skia flattenables into to avoid TOCTOU issues.
-    std::vector<uint8_t>* scratch_buffer = nullptr;
+    raw_ptr<std::vector<uint8_t>> scratch_buffer = nullptr;
     // True if the deserialization is happening on a privileged gpu channel.
     // e.g. in the case of UI.
     bool is_privileged = false;
-    SharedImageProvider* shared_image_provider = nullptr;
+    raw_ptr<SharedImageProvider> shared_image_provider = nullptr;
   };
 
   // Indicates how PaintImages are serialized.
diff --git a/cc/raster/task.h b/cc/raster/task.h
index c8c3807..9ecf972 100644
--- a/cc/raster/task.h
+++ b/cc/raster/task.h
@@ -10,6 +10,7 @@
 #include <string>
 #include <vector>
 
+#include "base/memory/raw_ptr.h"
 #include "base/memory/ref_counted.h"
 #include "cc/cc_export.h"
 
@@ -131,8 +132,8 @@
     Edge(const Task* task, Task* dependent)
         : task(task), dependent(dependent) {}
 
-    const Task* task;
-    Task* dependent;
+    raw_ptr<const Task> task;
+    raw_ptr<Task> dependent;
   };
 
   TaskGraph();
diff --git a/cc/raster/task_graph_work_queue.cc b/cc/raster/task_graph_work_queue.cc
index 5533d6ec..d6f6cb7 100644
--- a/cc/raster/task_graph_work_queue.cc
+++ b/cc/raster/task_graph_work_queue.cc
@@ -82,7 +82,7 @@
 
     // Now find the node for the dependent of this edge.
     auto it = base::ranges::find(graph_->nodes,
-                                 graph_->edges[current_index_].dependent,
+                                 graph_->edges[current_index_].dependent.get(),
                                  &TaskGraph::Node::task);
     DCHECK(it != graph_->nodes.end());
     current_node_ = &(*it);
@@ -178,7 +178,7 @@
       continue;
 
     // Skip if already running.
-    if (base::Contains(task_namespace.running_tasks, node.task,
+    if (base::Contains(task_namespace.running_tasks, node.task.get(),
                        &CategorizedTask::second)) {
       continue;
     }
@@ -208,12 +208,12 @@
       continue;
 
     // Skip if already running.
-    if (base::Contains(task_namespace.running_tasks, node.task,
+    if (base::Contains(task_namespace.running_tasks, node.task.get(),
                        &CategorizedTask::second)) {
       continue;
     }
 
-    DCHECK(!base::Contains(task_namespace.completed_tasks, node.task));
+    DCHECK(!base::Contains(task_namespace.completed_tasks, node.task.get()));
     node.task->state().DidCancel();
     task_namespace.completed_tasks.push_back(node.task);
   }
diff --git a/cc/resources/ui_resource_manager.cc b/cc/resources/ui_resource_manager.cc
index 7edb67e..14b98b49 100644
--- a/cc/resources/ui_resource_manager.cc
+++ b/cc/resources/ui_resource_manager.cc
@@ -65,7 +65,7 @@
     const {
   base::flat_map<UIResourceId, gfx::Size>::container_type items(
       ui_resource_client_map_.size());
-  for (const auto pair : ui_resource_client_map_)
+  for (const auto& pair : ui_resource_client_map_)
     items.push_back({pair.first, pair.second.size});
   return base::flat_map<UIResourceId, gfx::Size>(std::move(items));
 }
diff --git a/cc/resources/ui_resource_manager.h b/cc/resources/ui_resource_manager.h
index 482361f..34733ed 100644
--- a/cc/resources/ui_resource_manager.h
+++ b/cc/resources/ui_resource_manager.h
@@ -10,6 +10,7 @@
 #include <vector>
 
 #include "base/containers/flat_map.h"
+#include "base/memory/raw_ptr.h"
 #include "cc/cc_export.h"
 #include "cc/resources/ui_resource_request.h"
 
@@ -67,7 +68,7 @@
 
  private:
   struct UIResourceClientData {
-    UIResourceClient* client;
+    raw_ptr<UIResourceClient> client;
     gfx::Size size;
   };
 
diff --git a/cc/trees/layer_tree_host_unittest.cc b/cc/trees/layer_tree_host_unittest.cc
index 7ac12f6..99000cd2 100644
--- a/cc/trees/layer_tree_host_unittest.cc
+++ b/cc/trees/layer_tree_host_unittest.cc
@@ -10650,7 +10650,7 @@
   }
 
  private:
-  TestLayerTreeFrameSink* layer_tree_frame_sink_;
+  raw_ptr<TestLayerTreeFrameSink> layer_tree_frame_sink_;
 };
 MULTI_THREAD_TEST_F(LayerTreeHostTestBeginFramePausedChanged);
 
@@ -10733,5 +10733,108 @@
 
 MULTI_THREAD_TEST_F(LayerTreeHostUpdateViewportContainerSize);
 
+// Ensures that a change in LCD text status forces tilings to be recreated on
+// the pending tree even during accelerated gestures (scrolling and pinch zoom)
+// and animations.
+class LayerTreeHostTestForceRecreateTilingForLCDText
+    : public LayerTreeHostTestWithHelper {
+ public:
+  LayerTreeHostTestForceRecreateTilingForLCDText() {}
+
+  void SetupTree() override {
+    client_.set_fill_with_nonsolid_color(true);
+    client_.set_has_draw_text_op();
+
+    scoped_refptr<FakePictureLayer> root_layer =
+        FakePictureLayer::Create(&client_);
+    root_layer->SetBounds(gfx::Size(150, 150));
+    root_layer->SetIsDrawable(true);
+
+    layer_on_main_ =
+        CreateAndAddFakePictureLayer(gfx::Size(30, 30), root_layer.get());
+
+    layer_tree_host()->SetRootLayer(root_layer);
+    LayerTreeHostTest::SetupTree();
+    client_.set_bounds(root_layer->bounds());
+
+    layer_id_ = layer_on_main_->id();
+  }
+
+  void WillCommit(const CommitState&) override {
+    switch (layer_tree_host()->SourceFrameNumber()) {
+      case 0:
+        // First frame enables LCD text by marking the layer opaque.
+        layer_on_main_->SetContentsOpaque(true);
+        layer_on_main_->SetBackgroundColor(SkColor4f::FromColor(SK_ColorBLACK));
+        break;
+      case 1:
+        // Now mark the layer non-opaque to disable LCD text.
+        layer_on_main_->SetContentsOpaque(false);
+        break;
+      case 2:
+        // Back to LCD text.
+        layer_on_main_->SetContentsOpaque(true);
+        break;
+      case 3:
+        // Disable LCD text from non-opaque background.
+        layer_on_main_->SetContentsOpaque(false);
+        layer_on_main_->SetBackgroundColor(
+            SkColor4f::FromColor(SK_ColorTRANSPARENT));
+        break;
+    }
+  }
+
+  void BeginTest() override { PostSetNeedsCommitToMainThread(); }
+
+  void CommitCompleteOnThread(LayerTreeHostImpl* host_impl) override {
+    FakePictureLayerImpl* layer_impl = static_cast<FakePictureLayerImpl*>(
+        host_impl->pending_tree()->LayerById(layer_id_));
+
+    switch (host_impl->pending_tree()->source_frame_number()) {
+      case 0:
+        ASSERT_FALSE(host_impl->IsPinchGestureActive());
+        EXPECT_TRUE(layer_impl->can_use_lcd_text());
+        EXPECT_TRUE(layer_impl->HighResTiling()->can_use_lcd_text());
+        host_impl->GetInputHandler().PinchGestureBegin(
+            gfx::Point(1, 1), ui::ScrollInputType::kWheel);
+        PostSetNeedsCommitToMainThread();
+        break;
+      case 1:
+        ASSERT_TRUE(host_impl->IsPinchGestureActive());
+        EXPECT_FALSE(layer_impl->can_use_lcd_text());
+        EXPECT_EQ(layer_impl->lcd_text_disallowed_reason(),
+                  LCDTextDisallowedReason::kContentsNotOpaque);
+        EXPECT_FALSE(layer_impl->HighResTiling()->can_use_lcd_text());
+        host_impl->GetInputHandler().PinchGestureEnd(gfx::Point(1, 1));
+        break;
+      case 2:
+        ASSERT_FALSE(host_impl->IsPinchGestureActive());
+        EXPECT_TRUE(layer_impl->can_use_lcd_text());
+        EXPECT_TRUE(layer_impl->HighResTiling()->can_use_lcd_text());
+        host_impl->GetInputHandler().PinchGestureBegin(
+            gfx::Point(1, 1), ui::ScrollInputType::kWheel);
+        PostSetNeedsCommitToMainThread();
+        break;
+      case 3:
+        ASSERT_TRUE(host_impl->IsPinchGestureActive());
+        EXPECT_FALSE(layer_impl->can_use_lcd_text());
+        EXPECT_EQ(layer_impl->lcd_text_disallowed_reason(),
+                  LCDTextDisallowedReason::kBackgroundColorNotOpaque);
+        EXPECT_FALSE(layer_impl->HighResTiling()->can_use_lcd_text());
+        EndTest();
+        break;
+    }
+  }
+
+ protected:
+  // main and impl thread.
+  int layer_id_;
+
+  // main thread only
+  FakeContentLayerClient client_;
+  scoped_refptr<FakePictureLayer> layer_on_main_;
+};
+MULTI_THREAD_TEST_F(LayerTreeHostTestForceRecreateTilingForLCDText);
+
 }  // namespace
 }  // namespace cc
diff --git a/cc/trees/property_tree_builder.cc b/cc/trees/property_tree_builder.cc
index 3f8e490..cdf5e70 100644
--- a/cc/trees/property_tree_builder.cc
+++ b/cc/trees/property_tree_builder.cc
@@ -48,8 +48,8 @@
   bool animation_axis_aligned_since_render_target;
   bool not_axis_aligned_since_last_clip;
   gfx::Transform compound_transform_since_render_target;
-  bool* subtree_has_rounded_corner;
-  bool* subtree_has_gradient_mask;
+  raw_ptr<bool> subtree_has_rounded_corner;
+  raw_ptr<bool> subtree_has_gradient_mask;
 };
 
 class PropertyTreeBuilderContext {
diff --git a/chrome/VERSION b/chrome/VERSION
index 4debb03..ff306f6 100644
--- a/chrome/VERSION
+++ b/chrome/VERSION
@@ -1,4 +1,4 @@
 MAJOR=110
 MINOR=0
-BUILD=5433
+BUILD=5434
 PATCH=0
diff --git a/chrome/android/features/cablev2_authenticator/native/cablev2_authenticator_android.cc b/chrome/android/features/cablev2_authenticator/native/cablev2_authenticator_android.cc
index 249a58ab..5ec8d7f 100644
--- a/chrome/android/features/cablev2_authenticator/native/cablev2_authenticator_android.cc
+++ b/chrome/android/features/cablev2_authenticator/native/cablev2_authenticator_android.cc
@@ -230,7 +230,7 @@
 // there are ultimately only one human user, concurrent requests are not
 // supported.
 struct GlobalData {
-  JNIEnv* env = nullptr;
+  raw_ptr<JNIEnv> env = nullptr;
   // instance_num is incremented for each new |Transaction| created and returned
   // to Java to serve as a "handle". This prevents commands intended for a
   // previous transaction getting applied to a replacement. The zero value is
@@ -244,14 +244,14 @@
 
   absl::optional<std::array<uint8_t, device::cablev2::kRootSecretSize>>
       root_secret;
-  network::mojom::NetworkContext* network_context = nullptr;
+  raw_ptr<network::mojom::NetworkContext> network_context = nullptr;
 
   // event_to_record_if_stopped contains an event to record with UMA if the
   // activity is stopped. This is updated as a transaction progresses.
   absl::optional<CableV2MobileEvent> event_to_record_if_stopped;
 
   // registration is a non-owning pointer to the global |Registration|.
-  device::cablev2::authenticator::Registration* registration = nullptr;
+  raw_ptr<device::cablev2::authenticator::Registration> registration = nullptr;
 
   // current_transaction holds the |Transaction| that is currently active.
   std::unique_ptr<device::cablev2::authenticator::Transaction>
diff --git a/chrome/android/java/src/org/chromium/chrome/browser/infobar/InfoBarContainer.java b/chrome/android/java/src/org/chromium/chrome/browser/infobar/InfoBarContainer.java
index 76dad5ce..efa620f 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/infobar/InfoBarContainer.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/infobar/InfoBarContainer.java
@@ -405,12 +405,6 @@
     @Override
     public void destroy() {
         destroyContainerView();
-        BrowserControlsManager browserControlsManager =
-                BrowserControlsManagerSupplier.getValueOrNullFrom(mTab.getWindowAndroid());
-        if (browserControlsManager != null
-                && ChromeFeatureList.isEnabled(ChromeFeatureList.INFOBAR_SCROLL_OPTIMIZATION)) {
-            browserControlsManager.getFullscreenManager().removeObserver(mFullscreenObserver);
-        }
         mTab.removeObserver(mTabObserver);
         if (mNativeInfoBarContainer != 0) {
             InfoBarContainerJni.get().destroy(mNativeInfoBarContainer, InfoBarContainer.this);
@@ -507,6 +501,7 @@
                 browserControlsManager, DeviceFormFactor.isWindowOnTablet(mTab.getWindowAndroid()));
         if (browserControlsManager != null
                 && ChromeFeatureList.isEnabled(ChromeFeatureList.INFOBAR_SCROLL_OPTIMIZATION)) {
+            browserControlsManager.getFullscreenManager().removeObserver(mFullscreenObserver);
             browserControlsManager.getFullscreenManager().addObserver(mFullscreenObserver);
         }
 
@@ -556,6 +551,13 @@
             mIPHSupport = null;
         }
 
+        BrowserControlsManager browserControlsManager =
+                BrowserControlsManagerSupplier.getValueOrNullFrom(mTab.getWindowAndroid());
+        if (browserControlsManager != null
+                && ChromeFeatureList.isEnabled(ChromeFeatureList.INFOBAR_SCROLL_OPTIMIZATION)) {
+            browserControlsManager.getFullscreenManager().removeObserver(mFullscreenObserver);
+        }
+
         if (mInfoBarContainerView != null) {
             mInfoBarContainerView.setWebContents(null);
             if (mNativeInfoBarContainer != 0) {
diff --git a/chrome/android/javatests/src/org/chromium/chrome/browser/site_settings/SiteSettingsTest.java b/chrome/android/javatests/src/org/chromium/chrome/browser/site_settings/SiteSettingsTest.java
index df938c4a..4e8841e0 100644
--- a/chrome/android/javatests/src/org/chromium/chrome/browser/site_settings/SiteSettingsTest.java
+++ b/chrome/android/javatests/src/org/chromium/chrome/browser/site_settings/SiteSettingsTest.java
@@ -275,6 +275,15 @@
                 : withId(R.id.managed_view_legacy);
     }
 
+    private void createCookieExceptions() {
+        TestThreadUtils.runOnUiThreadBlocking(() -> {
+            WebsitePreferenceBridge.setContentSettingCustomScope(getBrowserContextHandle(),
+                    ContentSettingsType.COOKIES, "*", "secondary.com", ContentSettingValues.ALLOW);
+            WebsitePreferenceBridge.setContentSettingCustomScope(getBrowserContextHandle(),
+                    ContentSettingsType.COOKIES, "primary.com", "*", ContentSettingValues.ALLOW);
+        });
+    }
+
     /**
      * Sets Allow Location Enabled to be true and make sure it is set correctly.
      */
@@ -421,9 +430,16 @@
         TestThreadUtils.runOnUiThreadBlocking(() -> {
             SingleCategorySettings preferences =
                     (SingleCategorySettings) settingsActivity.getMainFragment();
-            ChromeSwitchPreference toggle = (ChromeSwitchPreference) preferences.findPreference(
-                    SingleCategorySettings.BINARY_TOGGLE_KEY);
-            preferences.onPreferenceChange(toggle, enabled);
+            if (type == SiteSettingsCategory.Type.THIRD_PARTY_COOKIES) {
+                TriStateCookieSettingsPreference preference =
+                        preferences.findPreference(SingleCategorySettings.TRI_STATE_COOKIE_TOGGLE);
+                preferences.onPreferenceChange(preference,
+                        enabled ? CookieControlsMode.OFF : CookieControlsMode.BLOCK_THIRD_PARTY);
+            } else {
+                ChromeSwitchPreference toggle =
+                        preferences.findPreference(SingleCategorySettings.BINARY_TOGGLE_KEY);
+                preferences.onPreferenceChange(toggle, enabled);
+            }
         });
         settingsActivity.finish();
     }
@@ -1326,6 +1342,16 @@
     @SmallTest
     @Feature({"Preferences"})
     @EnableFeatures(ChromeFeatureList.PRIVACY_SANDBOX_SETTINGS_4)
+    public void testOnlyExpectedPreferencesThirdPartyCookies() {
+        testExpectedPreferences(SiteSettingsCategory.Type.THIRD_PARTY_COOKIES,
+                new String[] {"tri_state_cookie_toggle", "add_exception"},
+                new String[] {"tri_state_cookie_toggle"});
+    }
+
+    @Test
+    @SmallTest
+    @Feature({"Preferences"})
+    @EnableFeatures(ChromeFeatureList.PRIVACY_SANDBOX_SETTINGS_4)
     public void testOnlyExpectedPreferencesSiteData() {
         testExpectedPreferences(SiteSettingsCategory.Type.SITE_DATA, BINARY_TOGGLE_WITH_EXCEPTION,
                 BINARY_TOGGLE_WITH_EXCEPTION);
@@ -2251,6 +2277,7 @@
 
     private void renderCategoryPage(@SiteSettingsCategory.Type int category, String name)
             throws IOException {
+        createCookieExceptions();
         var settingsActivity = SiteSettingsTestUtils.startSiteSettingsCategory(category);
         View view = settingsActivity.findViewById(android.R.id.content).getRootView();
         ChromeRenderTestRule.sanitize(view);
diff --git a/chrome/app/theme/chrome_unscaled_resources.grd b/chrome/app/theme/chrome_unscaled_resources.grd
index f7cb4c7f..47b9d2dc 100644
--- a/chrome/app/theme/chrome_unscaled_resources.grd
+++ b/chrome/app/theme/chrome_unscaled_resources.grd
@@ -31,6 +31,7 @@
             </else>
           </if>
           <include name="IDR_ASSISTANT_LOGO_MONOCHROME" file="google_chrome/google_assistant.svg" type="BINDATA" />
+          <include name="IDR_CHROME_PASSWORD_MANAGER_LOGO" file="google_chrome/google_password_manager_logo.svg" type="BINDATA" />
           <include name="IDR_PRODUCT_LOGO_24PX_1X" file="google_chrome/chrome_24px_1x.svg" type="BINDATA" />
           <include name="IDR_PRODUCT_LOGO_128PX_SVG" file="google_chrome/chrome_128px.svg" type="BINDATA" />
           <if expr="chromeos_ash">
diff --git a/chrome/browser/BUILD.gn b/chrome/browser/BUILD.gn
index 173228b..8751286 100644
--- a/chrome/browser/BUILD.gn
+++ b/chrome/browser/BUILD.gn
@@ -3842,6 +3842,8 @@
       "feedback/system_logs/log_sources/chrome_internal_log_source.h",
       "feedback/system_logs/log_sources/crash_ids_source.cc",
       "feedback/system_logs/log_sources/crash_ids_source.h",
+      "feedback/system_logs/log_sources/device_event_log_source.cc",
+      "feedback/system_logs/log_sources/device_event_log_source.h",
       "feedback/system_logs/log_sources/memory_details_log_source.cc",
       "feedback/system_logs/log_sources/memory_details_log_source.h",
       "first_run/first_run.cc",
diff --git a/chrome/browser/accessibility/ax_screen_ai_annotator.h b/chrome/browser/accessibility/ax_screen_ai_annotator.h
index e9a7d7f..4c1f803 100644
--- a/chrome/browser/accessibility/ax_screen_ai_annotator.h
+++ b/chrome/browser/accessibility/ax_screen_ai_annotator.h
@@ -80,7 +80,7 @@
 
   // AXScreenAIAnnotator is created by a factory on this browser context and
   // will be destroyed before browser context gets destroyed.
-  content::BrowserContext* browser_context_;
+  raw_ptr<content::BrowserContext> browser_context_;
 
   mojo::Remote<mojom::ScreenAIAnnotator> screen_ai_annotator_;
   mojo::Receiver<mojom::ScreenAIAnnotatorClient> screen_ai_service_client_;
diff --git a/chrome/browser/android/autocomplete/tab_matcher_android.h b/chrome/browser/android/autocomplete/tab_matcher_android.h
index 8f26258..13af6ac 100644
--- a/chrome/browser/android/autocomplete/tab_matcher_android.h
+++ b/chrome/browser/android/autocomplete/tab_matcher_android.h
@@ -30,7 +30,7 @@
   GURLToTabInfoMap GetAllHiddenAndNonCCTTabInfos(
       const bool keep_search_intent_params) const;
 
-  const TemplateURLService* template_url_service_;
+  raw_ptr<const TemplateURLService> template_url_service_;
   raw_ptr<Profile> profile_;
 };
 
diff --git a/chrome/browser/android/historical_tab_saver.h b/chrome/browser/android/historical_tab_saver.h
index 33d1b57..c864442 100644
--- a/chrome/browser/android/historical_tab_saver.h
+++ b/chrome/browser/android/historical_tab_saver.h
@@ -33,7 +33,7 @@
   // needed. Outside of this scope, this struct is not meant to be used for any
   // other purposes. Please do not attempt to use this struct anywhere else
   // except for in the provided callstack/use case.
-  void* byte_buffer_data;
+  raw_ptr<void> byte_buffer_data;
   int byte_buffer_size;
   int state_version;
 };
diff --git a/chrome/browser/android/recently_closed_tabs_bridge.h b/chrome/browser/android/recently_closed_tabs_bridge.h
index cd31fbd..fbbab44 100644
--- a/chrome/browser/android/recently_closed_tabs_bridge.h
+++ b/chrome/browser/android/recently_closed_tabs_bridge.h
@@ -57,8 +57,8 @@
 
   const sessions::TabRestoreService::Entries& entries_;
   sessions::TabRestoreService::Entries::const_iterator current_entry_;
-  const std::vector<std::unique_ptr<sessions::TabRestoreService::Tab>>* tabs_ =
-      nullptr;
+  raw_ptr<const std::vector<std::unique_ptr<sessions::TabRestoreService::Tab>>>
+      tabs_ = nullptr;
   absl::optional<std::vector<std::unique_ptr<
       sessions::TabRestoreService::Tab>>::const_reverse_iterator>
       current_tab_ = absl::nullopt;
diff --git a/chrome/browser/apps/intent_helper/chromeos_intent_picker_helpers.cc b/chrome/browser/apps/intent_helper/chromeos_intent_picker_helpers.cc
index 64e20cca4..6cc17666 100644
--- a/chrome/browser/apps/intent_helper/chromeos_intent_picker_helpers.cc
+++ b/chrome/browser/apps/intent_helper/chromeos_intent_picker_helpers.cc
@@ -45,14 +45,14 @@
 
 bool ShouldAutoDisplayUi(
     const std::vector<IntentPickerAppInfo>& apps_for_picker,
-    NavigationInfo navigation_info) {
-  content::WebContents* web_contents = navigation_info.web_contents;
+    content::NavigationHandle* navigation_handle) {
+  content::WebContents* web_contents = navigation_handle->GetWebContents();
 
   if (web_contents->GetVisibility() == content::Visibility::HIDDEN) {
     return false;
   }
 
-  const GURL& url = navigation_info.url;
+  const GURL& url = navigation_handle->GetURL();
 
   // Disable Auto-display in the new Intent Picker UI unless it is specifically
   // re-enabled.
@@ -65,7 +65,7 @@
   if (InAppBrowser(web_contents))
     return false;
 
-  if (!ShouldOverrideUrlLoading(navigation_info.starting_url, url))
+  if (!ShouldOverrideUrlLoading(GetStartingGURL(navigation_handle), url))
     return false;
 
   Profile* profile =
@@ -99,10 +99,10 @@
 }
 
 PickerShowState GetPickerShowState(
-    NavigationInfo navigation_info,
+    content::NavigationHandle* navigation_handle,
     const std::vector<IntentPickerAppInfo>& apps_for_picker) {
-  return ShouldAutoDisplayUi(apps_for_picker, navigation_info) &&
-                 navigation_info.is_navigate_from_link
+  return ShouldAutoDisplayUi(apps_for_picker, navigation_handle) &&
+                 IsNavigateFromLink(navigation_handle)
              ? PickerShowState::kPopOut
              : PickerShowState::kOmnibox;
 }
@@ -120,18 +120,18 @@
 
 }  // namespace
 
-void MaybeShowIntentPickerBubble(NavigationInfo navigation_info,
+void MaybeShowIntentPickerBubble(content::NavigationHandle* navigation_handle,
                                  std::vector<IntentPickerAppInfo> apps) {
-  if (apps.empty() ||
-      GetPickerShowState(navigation_info, apps) == PickerShowState::kOmnibox) {
+  if (apps.empty() || GetPickerShowState(navigation_handle, apps) ==
+                          PickerShowState::kOmnibox) {
     return;
   }
 
   IntentHandlingMetrics::RecordIntentPickerIconEvent(
       IntentHandlingMetrics::IntentPickerIconEvent::kAutoPopOut);
 
-  content::WebContents* web_contents = navigation_info.web_contents;
-  const GURL& url = navigation_info.url;
+  content::WebContents* web_contents = navigation_handle->GetWebContents();
+  const GURL& url = navigation_handle->GetURL();
 
   IntentPickerTabHelper::LoadAppIcons(
       web_contents, std::move(apps),
diff --git a/chrome/browser/apps/intent_helper/chromeos_intent_picker_helpers.h b/chrome/browser/apps/intent_helper/chromeos_intent_picker_helpers.h
index eed1e6a..61b8ed0 100644
--- a/chrome/browser/apps/intent_helper/chromeos_intent_picker_helpers.h
+++ b/chrome/browser/apps/intent_helper/chromeos_intent_picker_helpers.h
@@ -12,19 +12,13 @@
 #include "url/gurl.h"
 
 namespace content {
+class NavigationHandle;
 class WebContents;
 }  // namespace content
 
 namespace apps {
 
-struct NavigationInfo {
-  content::WebContents* web_contents;
-  GURL url;
-  GURL starting_url;
-  bool is_navigate_from_link;
-};
-
-void MaybeShowIntentPickerBubble(NavigationInfo navigation_info,
+void MaybeShowIntentPickerBubble(content::NavigationHandle* navigation_handle,
                                  std::vector<IntentPickerAppInfo> apps);
 
 // These enums are used to define the intent picker show state, whether the
diff --git a/chrome/browser/apps/intent_helper/intent_picker_helpers.cc b/chrome/browser/apps/intent_helper/intent_picker_helpers.cc
index 566f70b..17ab1ed 100644
--- a/chrome/browser/apps/intent_helper/intent_picker_helpers.cc
+++ b/chrome/browser/apps/intent_helper/intent_picker_helpers.cc
@@ -7,10 +7,8 @@
 #include <string>
 #include <utility>
 
-#include "base/functional/bind.h"
 #include "base/memory/weak_ptr.h"
 #include "base/notreached.h"
-#include "base/task/task_traits.h"
 #include "build/build_config.h"
 #include "build/chromeos_buildflags.h"
 #include "chrome/browser/apps/app_service/app_service_proxy.h"
@@ -34,7 +32,6 @@
 #include "chrome/browser/apps/intent_helper/chromeos_intent_picker_helpers.h"
 #include "chrome/browser/apps/intent_helper/metrics/intent_handling_metrics.h"
 #elif BUILDFLAG(IS_MAC)
-#include "base/task/thread_pool.h"
 #include "chrome/browser/apps/intent_helper/mac_intent_picker_helpers.h"
 #endif  // BUILDFLAG(IS_CHROMEOS)
 
@@ -42,10 +39,9 @@
 
 namespace {
 
-void AppendAppsForUrlSync(
+std::vector<IntentPickerAppInfo> FindAppsForUrl(
     content::WebContents* web_contents,
     const GURL& url,
-    base::OnceCallback<void(std::vector<IntentPickerAppInfo>)> callback,
     std::vector<IntentPickerAppInfo> apps) {
 #if BUILDFLAG(IS_MAC)
   // On the Mac, if there is a Universal Link, it goes first.
@@ -68,38 +64,7 @@
                        ui::ImageModel(), update.AppId(), update.Name());
         });
   }
-
-  std::move(callback).Run(std::move(apps));
-}
-
-void FindAppsForUrl(
-    content::WebContents* web_contents,
-    const GURL& url,
-    base::OnceCallback<void(std::vector<IntentPickerAppInfo>)> callback) {
-  auto append_apps =
-      [](base::WeakPtr<content::WebContents> web_contents,
-         IntentPickerTabHelper* helper, int commit_count, const GURL& url,
-         base::OnceCallback<void(std::vector<IntentPickerAppInfo>)> callback,
-         std::vector<IntentPickerAppInfo> apps) {
-        if (!web_contents)
-          return;
-        if (helper->commit_count() != commit_count)
-          return;
-
-        AppendAppsForUrlSync(web_contents.get(), url, std::move(callback),
-                             std::move(apps));
-      };
-
-  // TODO(crbug.com/1236141): Move the Mac intent code to be here, called async.
-
-  IntentPickerTabHelper* helper =
-      IntentPickerTabHelper::FromWebContents(web_contents);
-  int commit_count = helper->commit_count();
-
-  base::SequencedTaskRunner::GetCurrentDefault()->PostTask(
-      FROM_HERE, base::BindOnce(append_apps, web_contents->GetWeakPtr(), helper,
-                                commit_count, url, std::move(callback),
-                                std::vector<IntentPickerAppInfo>()));
+  return apps;
 }
 
 void LaunchAppFromIntentPicker(content::WebContents* web_contents,
@@ -173,28 +138,43 @@
       base::BindOnce(&OnIntentPickerClosed, web_contents->GetWeakPtr(), url));
 }
 
-void GetAppsForIntentPicker(
-    content::WebContents* web_contents,
-    base::OnceCallback<void(std::vector<IntentPickerAppInfo>)> callback) {
-  if (!ShouldCheckAppsForUrl(web_contents)) {
-    std::move(callback).Run({});
-    return;
-  }
+std::vector<IntentPickerAppInfo> GetAppsForIntentPicker(
+    content::WebContents* web_contents) {
+  std::vector<IntentPickerAppInfo> apps = {};
+  if (!ShouldCheckAppsForUrl(web_contents))
+    return apps;
 
   Profile* profile =
       Profile::FromBrowserContext(web_contents->GetBrowserContext());
-  if (!AppServiceProxyFactory::IsAppServiceAvailableForProfile(profile)) {
-    std::move(callback).Run({});
-    return;
-  }
+  if (!AppServiceProxyFactory::IsAppServiceAvailableForProfile(profile))
+    return apps;
 
-  FindAppsForUrl(web_contents, web_contents->GetLastCommittedURL(),
-                 std::move(callback));
+  const GURL& url = web_contents->GetLastCommittedURL();
+  apps = FindAppsForUrl(web_contents, url, std::move(apps));
+  return apps;
 }
 
-void ShowIntentPickerOrLaunchAppImpl(content::WebContents* web_contents,
-                                     const GURL& url,
-                                     std::vector<IntentPickerAppInfo> apps) {
+}  // namespace
+
+// for chromeos, this should apply when navigation is not deferred for pwa only
+// case also when navigation deferred and then resumed
+void MaybeShowIntentPicker(content::NavigationHandle* navigation_handle) {
+  content::WebContents* web_contents = navigation_handle->GetWebContents();
+  auto apps = GetAppsForIntentPicker(web_contents);
+  IntentPickerTabHelper::FromWebContents(web_contents)->ShowIconForApps(apps);
+#if BUILDFLAG(IS_CHROMEOS)
+  MaybeShowIntentPickerBubble(navigation_handle, std::move(apps));
+#endif  // BUILDFLAG(IS_CHROMEOS)
+}
+
+void MaybeShowIntentPicker(content::WebContents* web_contents) {
+  IntentPickerTabHelper::FromWebContents(web_contents)
+      ->ShowIconForApps(GetAppsForIntentPicker(web_contents));
+}
+
+void ShowIntentPickerOrLaunchApp(content::WebContents* web_contents,
+                                 const GURL& url) {
+  std::vector<IntentPickerAppInfo> apps = FindAppsForUrl(web_contents, url, {});
   if (apps.empty())
     return;
 
@@ -230,75 +210,6 @@
       base::BindOnce(&OnAppIconsLoaded, web_contents, url));
 }
 
-}  // namespace
-
-void MaybeShowIntentPicker(content::NavigationHandle* navigation_handle) {
-  content::WebContents* web_contents = navigation_handle->GetWebContents();
-  IntentPickerTabHelper* helper =
-      IntentPickerTabHelper::FromWebContents(web_contents);
-  int commit_count = helper->commit_count();
-
-  auto task = [](base::WeakPtr<content::WebContents> web_contents,
-#if BUILDFLAG(IS_CHROMEOS)
-                 NavigationInfo navigation_info,
-#endif  // BUILDFLAG(IS_CHROMEOS)
-                 IntentPickerTabHelper* helper, int commit_count,
-                 std::vector<IntentPickerAppInfo> apps) {
-    if (!web_contents)
-      return;
-    if (helper->commit_count() != commit_count)
-      return;
-
-    helper->ShowIconForApps(apps);
-#if BUILDFLAG(IS_CHROMEOS)
-    MaybeShowIntentPickerBubble(navigation_info, std::move(apps));
-#endif  // BUILDFLAG(IS_CHROMEOS)
-  };
-
-#if BUILDFLAG(IS_CHROMEOS)
-  NavigationInfo navigation_info = {
-      .web_contents = web_contents,
-      .url = navigation_handle->GetURL(),
-      .starting_url = GetStartingGURL(navigation_handle),
-      .is_navigate_from_link = IsNavigateFromLink(navigation_handle)};
-#endif  // BUILDFLAG(IS_CHROMEOS)
-
-  GetAppsForIntentPicker(web_contents,
-                         base::BindOnce(task, web_contents->GetWeakPtr(),
-#if BUILDFLAG(IS_CHROMEOS)
-                                        navigation_info,
-#endif  // BUILDFLAG(IS_CHROMEOS)
-                                        helper, commit_count));
-}
-
-void MaybeShowIntentPicker(content::WebContents* web_contents) {
-  IntentPickerTabHelper* helper =
-      IntentPickerTabHelper::FromWebContents(web_contents);
-  int commit_count = helper->commit_count();
-
-  auto task = [](base::WeakPtr<content::WebContents> web_contents,
-                 IntentPickerTabHelper* helper, int commit_count,
-                 std::vector<IntentPickerAppInfo> apps) {
-    if (!web_contents)
-      return;
-    if (helper->commit_count() != commit_count)
-      return;
-
-    helper->ShowIconForApps(apps);
-  };
-
-  GetAppsForIntentPicker(
-      web_contents,
-      base::BindOnce(task, web_contents->GetWeakPtr(), helper, commit_count));
-}
-
-void ShowIntentPickerOrLaunchApp(content::WebContents* web_contents,
-                                 const GURL& url) {
-  FindAppsForUrl(
-      web_contents, url,
-      base::BindOnce(&ShowIntentPickerOrLaunchAppImpl, web_contents, url));
-}
-
 bool IntentPickerPwaPersistenceEnabled() {
 #if BUILDFLAG(IS_CHROMEOS)
   return true;
diff --git a/chrome/browser/apps/platform_apps/api/sync_file_system/sync_file_system_apitest.cc b/chrome/browser/apps/platform_apps/api/sync_file_system/sync_file_system_apitest.cc
index 9960c8f..302e74f 100644
--- a/chrome/browser/apps/platform_apps/api/sync_file_system/sync_file_system_apitest.cc
+++ b/chrome/browser/apps/platform_apps/api/sync_file_system/sync_file_system_apitest.cc
@@ -110,8 +110,8 @@
   }
 
  private:
-  GURL* origin_;
-  MockRemoteFileSyncService* mock_remote_service_;
+  raw_ptr<GURL> origin_;
+  raw_ptr<MockRemoteFileSyncService> mock_remote_service_;
   sync_file_system::SyncFileType file_type_;
   sync_file_system::SyncFileStatus sync_file_status_;
   sync_file_system::SyncAction sync_action_taken_;
diff --git a/chrome/browser/ash/BUILD.gn b/chrome/browser/ash/BUILD.gn
index 1d17e5f..4380dd3 100644
--- a/chrome/browser/ash/BUILD.gn
+++ b/chrome/browser/ash/BUILD.gn
@@ -2901,8 +2901,6 @@
     "system_logs/debug_daemon_log_source.h",
     "system_logs/debug_log_writer.cc",
     "system_logs/debug_log_writer.h",
-    "system_logs/device_event_log_source.cc",
-    "system_logs/device_event_log_source.h",
     "system_logs/iwlwifi_dump_log_source.cc",
     "system_logs/iwlwifi_dump_log_source.h",
     "system_logs/network_health_source.cc",
diff --git a/chrome/browser/ash/extensions/OWNERS b/chrome/browser/ash/extensions/OWNERS
index 899e2a0..70eed75 100644
--- a/chrome/browser/ash/extensions/OWNERS
+++ b/chrome/browser/ash/extensions/OWNERS
@@ -11,5 +11,5 @@
 per-file device_local_account*=poromov@chromium.org
 
 # input method related reviewers.
-per-file input_method*=keithlee@chromium.org
-per-file ime_menu*=keithlee@chromium.org
+per-file input_method*=file://chrome/browser/ash/input_method/OWNERS
+per-file ime_menu*=file://chrome/browser/ash/input_method/OWNERS
diff --git a/chrome/browser/ash/file_manager/file_tasks.cc b/chrome/browser/ash/file_manager/file_tasks.cc
index 9b35f20..8c82a1b1 100644
--- a/chrome/browser/ash/file_manager/file_tasks.cc
+++ b/chrome/browser/ash/file_manager/file_tasks.cc
@@ -112,6 +112,8 @@
     "open-web-drive-office-powerpoint";
 const char kActionIdOpenInOffice[] = "open-in-office";
 
+const char kODFSExtensionId[] = "ajdgmkbkgifbokednjgbmieaemeighkg";
+
 namespace {
 
 // The values "file" and "app" are confusing, but cannot be changed easily as
@@ -494,19 +496,6 @@
 using ash::file_system_provider::ProviderId;
 using ash::file_system_provider::Service;
 
-const char kODFSExtensionId[] = "ajdgmkbkgifbokednjgbmieaemeighkg";
-
-bool ODFSMounted(Profile* profile) {
-  ProviderId provider_id = ProviderId::CreateFromExtensionId(kODFSExtensionId);
-
-  Service* service = Service::Get(profile);
-  std::vector<ProvidedFileSystemInfo> file_systems =
-      service->GetProvidedFileSystemInfoList(provider_id);
-
-  // Assume any file system mounted by ODFS is the correct one.
-  return !file_systems.empty();
-}
-
 bool FileIsOnODFS(const FileSystemURL& url, Profile* profile) {
   ash::file_system_provider::util::FileSystemURLParser parser(url);
   if (!parser.Parse()) {
@@ -562,25 +551,18 @@
     // TODO(petermarshall): UMAs.
   }
 
-  if (ODFSMounted(profile)) {
-    if (FileIsOnODFS(file_urls.front(), profile)) {
-      OpenODFSUrl(profile, task, file_urls);
-      LOG(ERROR) << "File is on ODFS";
-      return true;
-    } else {
-      // We need to move the file to ODFS first. This flow will eventually open
-      // the file in the browser, too.
-      // TODO(b/247038054) Add user preference to decide whether or not the
-      // dialog should be shown.
-      LOG(ERROR) << "File can be moved to ODFS";
-      return ash::cloud_upload::UploadAndOpen(
-          profile, file_urls, ash::cloud_upload::CloudProvider::kOneDrive);
-    }
+  if (FileIsOnODFS(file_urls.front(), profile)) {
+    OpenODFSUrl(profile, task, file_urls);
+    LOG(ERROR) << "File is on ODFS";
+    return true;
   } else {
-    LOG(ERROR) << "ODFS not available/mounted";
-    return GetUserFallbackChoice(
-        profile, task, file_urls,
-        ash::office_fallback::FallbackReason::kOneDriveUnavailable);
+    // We need to move the file to ODFS first. This flow will eventually open
+    // the file in the browser, too.
+    // TODO(b/247038054) Add user preference to decide whether or not the
+    // dialog should be shown.
+    LOG(ERROR) << "File can be moved to ODFS";
+    return ash::cloud_upload::UploadAndOpen(
+        profile, file_urls, ash::cloud_upload::CloudProvider::kOneDrive);
   }
 }
 
diff --git a/chrome/browser/ash/file_manager/file_tasks.h b/chrome/browser/ash/file_manager/file_tasks.h
index c9fa386..42fd158 100644
--- a/chrome/browser/ash/file_manager/file_tasks.h
+++ b/chrome/browser/ash/file_manager/file_tasks.h
@@ -127,6 +127,8 @@
 extern const char kActionIdWebDriveOfficePowerPoint[];
 extern const char kActionIdOpenInOffice[];
 
+extern const char kODFSExtensionId[];
+
 // Task types as explained in the comment above. Search for <task-type>.
 enum TaskType {
   TASK_TYPE_UNKNOWN = 0,  // Used only for handling errors.
diff --git a/chrome/browser/ash/guest_os/guest_os_terminal.cc b/chrome/browser/ash/guest_os/guest_os_terminal.cc
index c5f4cbe..ec9daec 100644
--- a/chrome/browser/ash/guest_os/guest_os_terminal.cc
+++ b/chrome/browser/ash/guest_os/guest_os_terminal.cc
@@ -547,9 +547,11 @@
     std::vector<gfx::ImageSkia> images) {
   ui::ColorProvider* color_provider =
       ui::ColorProviderManager::Get().GetColorProviderFor(
-          ui::NativeTheme::GetInstanceForWeb()->GetColorProviderKey(nullptr));
+          ui::NativeTheme::GetInstanceForNativeUi()->GetColorProviderKey(
+              nullptr));
   auto icon = [color_provider](const gfx::VectorIcon& icon) {
-    return ui::ImageModel::FromVectorIcon(icon, ui::kColorMenuIcon,
+    return ui::ImageModel::FromVectorIcon(icon,
+                                          apps::GetColorIdForMenuItemIcon(),
                                           apps::kAppShortcutIconSizeDip)
         .Rasterize(color_provider);
   };
diff --git a/chrome/browser/ash/login/enrollment/OWNERS b/chrome/browser/ash/login/enrollment/OWNERS
index c308060..9e0d54e4 100644
--- a/chrome/browser/ash/login/enrollment/OWNERS
+++ b/chrome/browser/ash/login/enrollment/OWNERS
@@ -1,6 +1,7 @@
 antrim@chromium.org
 emaxx@chromium.org
 pmarko@chromium.org
+rbock@google.com
 rsorokin@google.com
 
 per-file *auto_enrollment*=igorcov@chromium.org
diff --git a/chrome/browser/ash/policy/enrollment/OWNERS b/chrome/browser/ash/policy/enrollment/OWNERS
index b5f321a..ac665b8 100644
--- a/chrome/browser/ash/policy/enrollment/OWNERS
+++ b/chrome/browser/ash/policy/enrollment/OWNERS
@@ -1 +1,3 @@
+rbock@google.com
+
 per-file *auto_enrollment*=amraboelkher@chromium.org
diff --git a/chrome/browser/browsing_data/chrome_browsing_data_remover_delegate_unittest.cc b/chrome/browser/browsing_data/chrome_browsing_data_remover_delegate_unittest.cc
index 1ff097f..e335dec3 100644
--- a/chrome/browser/browsing_data/chrome_browsing_data_remover_delegate_unittest.cc
+++ b/chrome/browser/browsing_data/chrome_browsing_data_remover_delegate_unittest.cc
@@ -717,7 +717,7 @@
   }
 
  private:
-  base::SequenceBound<DIPSStorage>* storage_;
+  raw_ptr<base::SequenceBound<DIPSStorage>> storage_;
 };
 
 class RemoveSecurePaymentConfirmationCredentialsTester {
diff --git a/chrome/browser/chrome_content_browser_client_binder_policies.cc b/chrome/browser/chrome_content_browser_client_binder_policies.cc
index 3ca4483e..9a51d62 100644
--- a/chrome/browser/chrome_content_browser_client_binder_policies.cc
+++ b/chrome/browser/chrome_content_browser_client_binder_policies.cc
@@ -41,10 +41,8 @@
   // RequestScriptInjectionPermission, GetInstallState, SendRequestIPC, and
   // notifying CSS selector updates. These APIs are used by Chrome Extensions
   // under proper permission managements beyond the page boundaries.
-  if (blink::features::IsPrerender2Enabled()) {
-    policy_map.SetAssociatedPolicy<extensions::mojom::LocalFrameHost>(
-        content::MojoBinderAssociatedPolicy::kGrant);
-  }
+  policy_map.SetAssociatedPolicy<extensions::mojom::LocalFrameHost>(
+      content::MojoBinderAssociatedPolicy::kGrant);
 #endif
 }
 
diff --git a/chrome/browser/device_identity/device_oauth2_token_store.h b/chrome/browser/device_identity/device_oauth2_token_store.h
index 0b6c4f87..c669177 100644
--- a/chrome/browser/device_identity/device_oauth2_token_store.h
+++ b/chrome/browser/device_identity/device_oauth2_token_store.h
@@ -8,6 +8,7 @@
 #include <string>
 
 #include "base/callback_forward.h"
+#include "base/memory/raw_ptr.h"
 #include "build/chromeos_buildflags.h"
 #include "google_apis/gaia/core_account_id.h"
 
@@ -86,7 +87,7 @@
   Observer* observer() { return observer_; }
 
  private:
-  Observer* observer_ = nullptr;
+  raw_ptr<Observer> observer_ = nullptr;
 };
 
 #endif  // CHROME_BROWSER_DEVICE_IDENTITY_DEVICE_OAUTH2_TOKEN_STORE_H_
diff --git a/chrome/browser/download/download_ui_model.h b/chrome/browser/download/download_ui_model.h
index ff4e1fd..6b3c9219 100644
--- a/chrome/browser/download/download_ui_model.h
+++ b/chrome/browser/download/download_ui_model.h
@@ -71,7 +71,7 @@
         offline_items_collection::FailState fail_state) const;
 
     // Unknowned model to create statuses.
-    DownloadUIModel* model_ = nullptr;
+    raw_ptr<DownloadUIModel> model_ = nullptr;
   };
 
   // Used in Download shelf and page, default option.
diff --git a/chrome/browser/enterprise/connectors/analysis/analysis_service_settings_unittest.cc b/chrome/browser/enterprise/connectors/analysis/analysis_service_settings_unittest.cc
index 8ad2e92..2a1b057 100644
--- a/chrome/browser/enterprise/connectors/analysis/analysis_service_settings_unittest.cc
+++ b/chrome/browser/enterprise/connectors/analysis/analysis_service_settings_unittest.cc
@@ -6,6 +6,7 @@
 
 #include "base/files/file_util.h"
 #include "base/json/json_reader.h"
+#include "base/memory/raw_ptr.h"
 #include "base/no_destructor.h"
 #include "base/strings/stringprintf.h"
 #include "base/strings/utf_string_conversions.h"
@@ -41,7 +42,7 @@
 
   const char* url;
   const char* settings_value;
-  AnalysisSettings* expected_settings;
+  raw_ptr<AnalysisSettings> expected_settings;
 };
 
 constexpr char kNormalSettings[] = R"({
diff --git a/chrome/browser/enterprise/connectors/device_trust/key_management/core/network/win_key_network_delegate_unittest.cc b/chrome/browser/enterprise/connectors/device_trust/key_management/core/network/win_key_network_delegate_unittest.cc
index 416c011..31a8cfd7a 100644
--- a/chrome/browser/enterprise/connectors/device_trust/key_management/core/network/win_key_network_delegate_unittest.cc
+++ b/chrome/browser/enterprise/connectors/device_trust/key_management/core/network/win_key_network_delegate_unittest.cc
@@ -9,6 +9,7 @@
 #include <utility>
 
 #include "base/containers/flat_map.h"
+#include "base/memory/raw_ptr.h"
 #include "base/metrics/histogram_functions.h"
 #include "base/test/metrics/histogram_tester.h"
 #include "base/test/task_environment.h"
@@ -116,7 +117,7 @@
     EXPECT_EQ(response_code, future.Get());
   }
 
-  MockWinNetworkFetcherFactory* mock_network_fetcher_factory_ = nullptr;
+  raw_ptr<MockWinNetworkFetcherFactory> mock_network_fetcher_factory_ = nullptr;
   std::unique_ptr<WinKeyNetworkDelegate> network_delegate_;
   base::test::TaskEnvironment task_environment_{
       base::test::TaskEnvironment::TimeSource::MOCK_TIME};
diff --git a/chrome/browser/enterprise/connectors/device_trust/key_management/installer/management_service/rotate_util_unittest.cc b/chrome/browser/enterprise/connectors/device_trust/key_management/installer/management_service/rotate_util_unittest.cc
index 9499bb90d..809a140c 100644
--- a/chrome/browser/enterprise/connectors/device_trust/key_management/installer/management_service/rotate_util_unittest.cc
+++ b/chrome/browser/enterprise/connectors/device_trust/key_management/installer/management_service/rotate_util_unittest.cc
@@ -10,6 +10,7 @@
 
 #include "base/base64.h"
 #include "base/command_line.h"
+#include "base/memory/raw_ptr.h"
 #include "base/test/metrics/histogram_tester.h"
 #include "base/test/task_environment.h"
 #include "chrome/browser/enterprise/connectors/device_trust/key_management/core/network/mock_key_network_delegate.h"
@@ -85,8 +86,8 @@
     return command_line;
   }
 
-  MockKeyNetworkDelegate* mock_network_delegate_;
-  MockKeyPersistenceDelegate* mock_persistence_delegate_;
+  raw_ptr<MockKeyNetworkDelegate> mock_network_delegate_;
+  raw_ptr<MockKeyPersistenceDelegate> mock_persistence_delegate_;
   std::unique_ptr<KeyRotationManager> key_rotation_manager_;
   test::ScopedKeyPersistenceDelegateFactory scoped_factory_;
   base::test::TaskEnvironment task_environment_;
diff --git a/chrome/browser/enterprise/connectors/file_system/service_settings_unittest.cc b/chrome/browser/enterprise/connectors/file_system/service_settings_unittest.cc
index d791bf2..b22675a8 100644
--- a/chrome/browser/enterprise/connectors/file_system/service_settings_unittest.cc
+++ b/chrome/browser/enterprise/connectors/file_system/service_settings_unittest.cc
@@ -5,6 +5,7 @@
 #include <set>
 
 #include "base/json/json_reader.h"
+#include "base/memory/raw_ptr.h"
 #include "base/no_destructor.h"
 #include "base/strings/utf_string_conversions.h"
 #include "chrome/browser/enterprise/connectors/connectors_service.h"
@@ -184,7 +185,7 @@
 
   const char* url;
   const char* settings_value;
-  std::set<std::string>* expected_mime_types;
+  raw_ptr<std::set<std::string>> expected_mime_types;
 };
 
 class FileSystemServiceSettingsTest : public testing::TestWithParam<TestParam> {
diff --git a/chrome/browser/enterprise/connectors/reporting/extension_install_event_router_unittest.cc b/chrome/browser/enterprise/connectors/reporting/extension_install_event_router_unittest.cc
index ec72b6a..91a6e56 100644
--- a/chrome/browser/enterprise/connectors/reporting/extension_install_event_router_unittest.cc
+++ b/chrome/browser/enterprise/connectors/reporting/extension_install_event_router_unittest.cc
@@ -7,6 +7,7 @@
 #include <set>
 #include <string>
 #include <utility>
+#include "base/memory/raw_ptr.h"
 #include "chrome/browser/enterprise/connectors/common.h"
 #include "chrome/browser/enterprise/connectors/reporting/realtime_reporting_client.h"
 #include "chrome/browser/enterprise/connectors/reporting/realtime_reporting_client_factory.h"
@@ -122,7 +123,7 @@
 
   scoped_refptr<extensions::Extension> extension_chrome_;
   ReportingSettings settings;
-  MockRealtimeReportingClient* mockRealtimeReportingClient_;
+  raw_ptr<MockRealtimeReportingClient> mockRealtimeReportingClient_;
   std::unique_ptr<ExtensionInstallEventRouter> extensionInstallEventRouter_;
 };
 
diff --git a/chrome/browser/enterprise/identifiers/profile_id_service_factory_unittest.cc b/chrome/browser/enterprise/identifiers/profile_id_service_factory_unittest.cc
index f9b85c9..4c0416c 100644
--- a/chrome/browser/enterprise/identifiers/profile_id_service_factory_unittest.cc
+++ b/chrome/browser/enterprise/identifiers/profile_id_service_factory_unittest.cc
@@ -6,6 +6,7 @@
 
 #include "base/base64url.h"
 #include "base/hash/sha1.h"
+#include "base/memory/raw_ptr.h"
 #include "chrome/test/base/testing_browser_process.h"
 #include "chrome/test/base/testing_profile_manager.h"
 #include "components/enterprise/browser/identifiers/identifiers_prefs.h"
@@ -108,7 +109,7 @@
   content::BrowserTaskEnvironment task_environment_;
   TestingProfileManager profile_manager_;
   raw_ptr<TestingProfile> profile_;
-  ProfileIdService* service_;
+  raw_ptr<ProfileIdService> service_;
 #if BUILDFLAG(IS_WIN) || BUILDFLAG(IS_MAC) || BUILDFLAG(IS_LINUX) || \
     BUILDFLAG(IS_ANDROID) || BUILDFLAG(IS_FUCHSIA) ||                \
     BUILDFLAG(IS_CHROMEOS) && !BUILDFLAG(IS_CHROMEOS_ASH) &&         \
diff --git a/chrome/browser/enterprise/idle/action_runner.h b/chrome/browser/enterprise/idle/action_runner.h
index 5bb0d3b..722909a 100644
--- a/chrome/browser/enterprise/idle/action_runner.h
+++ b/chrome/browser/enterprise/idle/action_runner.h
@@ -49,7 +49,7 @@
   void OnActionFinished(ActionQueue remaining_actions, bool succeeded);
 
   raw_ptr<Profile> profile_;
-  ActionFactory* action_factory_;
+  raw_ptr<ActionFactory> action_factory_;
   base::WeakPtrFactory<ActionRunner> weak_ptr_factory_{this};
 };
 
diff --git a/chrome/browser/enterprise/idle/action_runner_unittest.cc b/chrome/browser/enterprise/idle/action_runner_unittest.cc
index 9da6c707..3234aed 100644
--- a/chrome/browser/enterprise/idle/action_runner_unittest.cc
+++ b/chrome/browser/enterprise/idle/action_runner_unittest.cc
@@ -4,6 +4,7 @@
 
 #include "chrome/browser/enterprise/idle/action_runner.h"
 
+#include "base/memory/raw_ptr.h"
 #include "base/test/gmock_callback_support.h"
 #include "chrome/browser/enterprise/idle/action.h"
 #include "chrome/test/base/testing_profile.h"
@@ -16,7 +17,7 @@
 namespace {
 
 struct RunEntry {
-  Profile* profile;
+  raw_ptr<Profile> profile;
   base::flat_set<std::string> action_names;
 };
 
diff --git a/chrome/browser/enterprise/idle/idle_service_browsertest.cc b/chrome/browser/enterprise/idle/idle_service_browsertest.cc
index 68841da6..98ab3472 100644
--- a/chrome/browser/enterprise/idle/idle_service_browsertest.cc
+++ b/chrome/browser/enterprise/idle/idle_service_browsertest.cc
@@ -6,6 +6,7 @@
 
 #include <memory>
 
+#include "base/memory/raw_ptr.h"
 #include "base/scoped_observation.h"
 #include "base/test/scoped_mock_time_message_loop_task_runner.h"
 #include "base/test/task_environment.h"
@@ -124,7 +125,7 @@
   }
 
  private:
-  MockIdleTimeProvider* time_provider_ = nullptr;
+  raw_ptr<MockIdleTimeProvider> time_provider_ = nullptr;
   scoped_refptr<base::TestMockTimeTaskRunner> task_runner_;
   std::unique_ptr<ui::test::ScopedIdleProviderForTest> scoped_idle_provider_;
 };
diff --git a/chrome/browser/enterprise/reporting/extension_info_unittest.cc b/chrome/browser/enterprise/reporting/extension_info_unittest.cc
index ab287062..4bb2c13 100644
--- a/chrome/browser/enterprise/reporting/extension_info_unittest.cc
+++ b/chrome/browser/enterprise/reporting/extension_info_unittest.cc
@@ -58,8 +58,7 @@
         .AddPermission(kPermission2)
         .AddPermission(kPermission3);
     if (is_app) {
-      extensionBuilder.SetManifestPath({"app", "launch", "web_url"},
-                                       kAppLaunchUrl);
+      extensionBuilder.SetManifestPath("app.launch.web_url", kAppLaunchUrl);
     }
     if (from_webstore) {
       extensionBuilder.AddFlags(extensions::Extension::FROM_WEBSTORE);
diff --git a/chrome/browser/enterprise/reporting/policy_info_unittest.cc b/chrome/browser/enterprise/reporting/policy_info_unittest.cc
index be91d7f..8261c076 100644
--- a/chrome/browser/enterprise/reporting/policy_info_unittest.cc
+++ b/chrome/browser/enterprise/reporting/policy_info_unittest.cc
@@ -143,12 +143,12 @@
   extension_registry->AddEnabled(
       extensions::ExtensionBuilder("extension_name")
           .SetID(kExtensionId1)
-          .SetManifestPath({"storage", "managed_schema"}, "schema.json")
+          .SetManifestPath("storage.managed_schema", "schema.json")
           .Build());
   extension_registry->AddEnabled(
       extensions::ExtensionBuilder("extension_name")
           .SetID(kExtensionId2)
-          .SetManifestPath({"storage", "managed_schema"}, "schema.json")
+          .SetManifestPath("storage.managed_schema", "schema.json")
           .Build());
 
   extension_policy_map()->Set(kPolicyName1, policy::POLICY_LEVEL_MANDATORY,
diff --git a/chrome/browser/enterprise/reporting/profile_report_generator_unittest.cc b/chrome/browser/enterprise/reporting/profile_report_generator_unittest.cc
index 28e2d29..096583c 100644
--- a/chrome/browser/enterprise/reporting/profile_report_generator_unittest.cc
+++ b/chrome/browser/enterprise/reporting/profile_report_generator_unittest.cc
@@ -258,6 +258,9 @@
 }
 
 TEST_F(ProfileReportGeneratorTest, PendingRequest) {
+  feature_list_.InitAndDisableFeature(
+      features::kExtensionWorkflowJustification);
+
   profile()->GetTestingPrefService()->SetManagedPref(
       prefs::kCloudExtensionRequestEnabled,
       std::make_unique<base::Value>(true));
@@ -272,8 +275,6 @@
 }
 
 TEST_F(ProfileReportGeneratorTest, PendingRequest_Justification) {
-  feature_list_.InitAndEnableFeature(features::kExtensionWorkflowJustification);
-
   profile()->GetTestingPrefService()->SetManagedPref(
       prefs::kCloudExtensionRequestEnabled,
       std::make_unique<base::Value>(true));
diff --git a/chrome/browser/extensions/api/bookmark_manager_private/bookmark_manager_private_api_browsertest.cc b/chrome/browser/extensions/api/bookmark_manager_private/bookmark_manager_private_api_browsertest.cc
index 9212d2f..fbd3bdb2 100644
--- a/chrome/browser/extensions/api/bookmark_manager_private/bookmark_manager_private_api_browsertest.cc
+++ b/chrome/browser/extensions/api/bookmark_manager_private/bookmark_manager_private_api_browsertest.cc
@@ -2,6 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+#include "base/memory/raw_ptr.h"
 #include "chrome/browser/bookmarks/bookmark_model_factory.h"
 #include "chrome/browser/extensions/api/bookmark_manager_private/bookmark_manager_private_api.h"
 #include "chrome/browser/profiles/profile.h"
@@ -38,7 +39,7 @@
     return model;
   }
 
-  BookmarkModel* model_;
+  raw_ptr<BookmarkModel> model_;
 };
 
 IN_PROC_BROWSER_TEST_F(BookmarkManagerPrivateApiBrowsertest,
diff --git a/chrome/browser/extensions/api/enterprise_reporting_private/enterprise_reporting_private_unittest.cc b/chrome/browser/extensions/api/enterprise_reporting_private/enterprise_reporting_private_unittest.cc
index cae4d4a..fbd1af0 100644
--- a/chrome/browser/extensions/api/enterprise_reporting_private/enterprise_reporting_private_unittest.cc
+++ b/chrome/browser/extensions/api/enterprise_reporting_private/enterprise_reporting_private_unittest.cc
@@ -5,6 +5,7 @@
 #include <tuple>
 
 #include "base/files/file_util.h"
+#include "base/memory/raw_ptr.h"
 #include "chrome/browser/browser_process.h"
 #include "chrome/browser/enterprise/signals/device_info_fetcher.h"
 #include "chrome/browser/extensions/api/enterprise_reporting_private/enterprise_reporting_private_api.h"
@@ -1350,7 +1351,7 @@
         enterprise_signals::features::kNewEvSignalsEnabled);
   }
 
-  device_signals::MockSignalsAggregator* mock_aggregator_;
+  raw_ptr<device_signals::MockSignalsAggregator> mock_aggregator_;
   base::test::ScopedFeatureList scoped_features_;
   base::HistogramTester histogram_tester_;
 };
diff --git a/chrome/browser/extensions/api/side_panel/side_panel_service.h b/chrome/browser/extensions/api/side_panel/side_panel_service.h
index e687dab8..60c7bcc 100644
--- a/chrome/browser/extensions/api/side_panel/side_panel_service.h
+++ b/chrome/browser/extensions/api/side_panel/side_panel_service.h
@@ -6,6 +6,7 @@
 #define CHROME_BROWSER_EXTENSIONS_API_SIDE_PANEL_SIDE_PANEL_SERVICE_H_
 
 #include "base/containers/flat_map.h"
+#include "base/memory/raw_ptr.h"
 #include "base/scoped_observation.h"
 #include "chrome/common/extensions/api/side_panel.h"
 #include "extensions/browser/browser_context_keyed_api_factory.h"
@@ -50,7 +51,7 @@
  private:
   friend class BrowserContextKeyedAPIFactory<SidePanelService>;
 
-  content::BrowserContext* const browser_context_;
+  const raw_ptr<content::BrowserContext> browser_context_;
 
   // BrowserContextKeyedAPI implementation.
   static const char* service_name() { return "SidePanelService"; }
diff --git a/chrome/browser/extensions/cross_origin_isolation_browsertest.cc b/chrome/browser/extensions/cross_origin_isolation_browsertest.cc
index 40c7567..425990be 100644
--- a/chrome/browser/extensions/cross_origin_isolation_browsertest.cc
+++ b/chrome/browser/extensions/cross_origin_isolation_browsertest.cc
@@ -12,6 +12,7 @@
 #include "content/public/browser/web_contents.h"
 #include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
+#include "content/public/test/test_navigation_observer.h"
 #include "extensions/browser/extension_host.h"
 #include "extensions/browser/process_manager.h"
 #include "extensions/browser/process_map.h"
@@ -712,5 +713,109 @@
   }
 }
 
+// Verify extension resource access if it's in an iframe. Regression test for
+// crbug.com/1343610.
+IN_PROC_BROWSER_TEST_F(ExtensionBrowserTest, ExtensionResourceInIframe) {
+  EXPECT_TRUE(embedded_test_server()->Start());
+
+  // Load an extension which has one resource that is web accessible and one
+  // that is not.
+  TestExtensionDir extension_dir;
+  static constexpr char kManifestStub[] = R"({
+    "name": "Test",
+    "version": "0.1",
+    "manifest_version": 3,
+    "web_accessible_resources": [
+      {
+        "resources": [ "web_accessible_resource.html" ],
+        "matches": [ "<all_urls>" ]
+      }
+    ]
+  })";
+  extension_dir.WriteManifest(kManifestStub);
+  extension_dir.WriteFile(FILE_PATH_LITERAL("web_accessible_resource.html"),
+                          "");
+  extension_dir.WriteFile(FILE_PATH_LITERAL("extension_resource.html"), "");
+  const Extension* extension = LoadExtension(extension_dir.UnpackedPath());
+  EXPECT_TRUE(extension);
+
+  // Allow navigation from a web frame to a web accessible resource.
+  {
+    // Navigate the main frame with a renderer initiated navigation to a blank
+    // web page. This should succeed.
+    const GURL gurl = embedded_test_server()->GetURL("/iframe_blank.html");
+    EXPECT_TRUE(ui_test_utils::NavigateToURL(browser(), gurl));
+    content::WebContents* web_contents =
+        browser()->tab_strip_model()->GetActiveWebContents();
+    content::RenderFrameHost* main_frame = web_contents->GetPrimaryMainFrame();
+    content::RenderFrameHost* iframe = content::ChildFrameAt(main_frame, 0);
+    EXPECT_TRUE(iframe);
+
+    // Navigate the iframe with a renderer initiated navigation to a web
+    // accessible resource. This should succeed.
+    GURL target = extension->GetResourceURL("web_accessible_resource.html");
+    content::TestNavigationObserver nav_observer(web_contents);
+    EXPECT_TRUE(content::NavigateIframeToURL(web_contents, "test", target));
+    nav_observer.Wait();
+    EXPECT_TRUE(nav_observer.last_navigation_succeeded());
+    EXPECT_EQ(net::OK, nav_observer.last_net_error_code());
+    iframe = content::ChildFrameAt(web_contents->GetPrimaryMainFrame(), 0);
+    EXPECT_EQ(target, iframe->GetLastCommittedURL());
+  }
+
+  // Prevent navigation from a web frame to a non-web accessible resource.
+  {
+    // Navigate the main frame with a renderer initiated navigation to a blank
+    // web page. This should succeed.
+    const GURL gurl = embedded_test_server()->GetURL("/iframe_blank.html");
+    EXPECT_TRUE(ui_test_utils::NavigateToURL(browser(), gurl));
+    content::WebContents* web_contents =
+        browser()->tab_strip_model()->GetActiveWebContents();
+    content::RenderFrameHost* main_frame = web_contents->GetPrimaryMainFrame();
+    content::RenderFrameHost* iframe = content::ChildFrameAt(main_frame, 0);
+    EXPECT_TRUE(iframe);
+    GURL target = extension->GetResourceURL("extension_resource.html");
+
+    // Navigate the iframe with a renderer initiated navigation to an extension
+    // resource that isn't a web accessible resource. This should be blocked.
+    content::TestNavigationObserver nav_observer(web_contents);
+    EXPECT_TRUE(content::NavigateIframeToURL(web_contents, "test", target));
+    nav_observer.Wait();
+    EXPECT_FALSE(nav_observer.last_navigation_succeeded());
+    EXPECT_EQ(net::ERR_BLOCKED_BY_CLIENT, nav_observer.last_net_error_code());
+    EXPECT_EQ(GURL("chrome-extension://invalid/"),
+              iframe->GetLastCommittedURL());
+
+    // Navigate the iframe with a browser initiated navigation to an extension
+    // resource. This should be blocked because the origin is not opaque, as
+    // it's embedded in a web context.
+    content::TestNavigationObserver reload_observer(web_contents);
+    EXPECT_TRUE(iframe->Reload());
+    reload_observer.Wait();
+    EXPECT_EQ(net::ERR_BLOCKED_BY_CLIENT,
+              reload_observer.last_net_error_code());
+    iframe = content::ChildFrameAt(web_contents->GetPrimaryMainFrame(), 0);
+    EXPECT_FALSE(reload_observer.last_navigation_succeeded());
+    EXPECT_EQ(GURL("chrome-extension://invalid/"),
+              iframe->GetLastCommittedURL());
+
+    // Verify iframe browser initiated navigation (to test real UI behavior).
+    iframe = content::ChildFrameAt(web_contents->GetPrimaryMainFrame(), 0);
+    content::TestNavigationObserver browser_initiated_observer(target);
+    NavigateParams params(browser(), target, ui::PAGE_TRANSITION_RELOAD);
+    params.frame_tree_node_id = iframe->GetFrameTreeNodeId();
+    params.is_renderer_initiated = false;
+    params.initiator_origin = embedded_test_server()->GetOrigin();
+    browser_initiated_observer.WatchExistingWebContents();
+    ui_test_utils::NavigateToURL(&params);
+    browser_initiated_observer.Wait();
+    EXPECT_EQ(net::ERR_BLOCKED_BY_CLIENT,
+              browser_initiated_observer.last_net_error_code());
+    EXPECT_FALSE(browser_initiated_observer.last_navigation_succeeded());
+    iframe = content::ChildFrameAt(web_contents->GetPrimaryMainFrame(), 0);
+    EXPECT_EQ(target, iframe->GetLastCommittedURL());
+  }
+}
+
 }  // namespace
 }  // namespace extensions
diff --git a/chrome/browser/extensions/extension_action_runner_browsertest.cc b/chrome/browser/extensions/extension_action_runner_browsertest.cc
index bf9b90a..aff1f3b97a 100644
--- a/chrome/browser/extensions/extension_action_runner_browsertest.cc
+++ b/chrome/browser/extensions/extension_action_runner_browsertest.cc
@@ -735,7 +735,7 @@
 
  private:
   base::test::ScopedFeatureList feature_list_;
-  PermissionsManager* permissions_manager_;
+  raw_ptr<PermissionsManager> permissions_manager_;
 };
 
 // Tests changing user site settings when the extension has site access (which
diff --git a/chrome/browser/extensions/extension_service_unittest.cc b/chrome/browser/extensions/extension_service_unittest.cc
index 5d33cb2..b9a8652 100644
--- a/chrome/browser/extensions/extension_service_unittest.cc
+++ b/chrome/browser/extensions/extension_service_unittest.cc
@@ -7643,7 +7643,7 @@
   InitializeEmptyExtensionService();
   scoped_refptr<const Extension> extension =
       ExtensionBuilder("Shared Module")
-          .SetManifestPath({"export", "resources"},
+          .SetManifestPath("export.resources",
                            ListBuilder().Append("foo.js").Build())
           .AddFlags(Extension::FROM_WEBSTORE)
           .Build();
diff --git a/chrome/browser/extensions/extension_web_ui_unittest.cc b/chrome/browser/extensions/extension_web_ui_unittest.cc
index 32da654..cb8a7557 100644
--- a/chrome/browser/extensions/extension_web_ui_unittest.cc
+++ b/chrome/browser/extensions/extension_web_ui_unittest.cc
@@ -176,7 +176,7 @@
   // happen because of https://crbug.com/782959.
   scoped_refptr<const Extension> extension =
       ExtensionBuilder("extension")
-          .SetManifestPath({"chrome_url_overrides", "newtab"}, "newtab.html")
+          .SetManifestPath("chrome_url_overrides.newtab", "newtab.html")
           .Build();
 
   const GURL newtab_url = extension->GetResourceURL("newtab.html");
diff --git a/chrome/browser/feature_guide/notifications/feature_notification_guide_service.h b/chrome/browser/feature_guide/notifications/feature_notification_guide_service.h
index 9fa1120..a6d744b6 100644
--- a/chrome/browser/feature_guide/notifications/feature_notification_guide_service.h
+++ b/chrome/browser/feature_guide/notifications/feature_notification_guide_service.h
@@ -10,6 +10,7 @@
 
 #include "base/callback.h"
 #include "base/feature_list.h"
+#include "base/memory/raw_ptr.h"
 #include "base/supports_user_data.h"
 #include "chrome/browser/feature_guide/notifications/feature_type.h"
 #include "chrome/browser/notifications/scheduler/public/notification_scheduler_client.h"
@@ -77,7 +78,7 @@
     virtual ~Delegate();
 
    private:
-    FeatureNotificationGuideService* service_{nullptr};
+    raw_ptr<FeatureNotificationGuideService> service_{nullptr};
   };
 
   using NotificationDataCallback = base::OnceCallback<void(
diff --git a/chrome/browser/feedback/system_logs/about_system_logs_fetcher.cc b/chrome/browser/feedback/system_logs/about_system_logs_fetcher.cc
index a56f5571..2cff71f4 100644
--- a/chrome/browser/feedback/system_logs/about_system_logs_fetcher.cc
+++ b/chrome/browser/feedback/system_logs/about_system_logs_fetcher.cc
@@ -9,6 +9,7 @@
 #include "build/build_config.h"
 #include "build/chromeos_buildflags.h"
 #include "chrome/browser/feedback/system_logs/log_sources/chrome_internal_log_source.h"
+#include "chrome/browser/feedback/system_logs/log_sources/device_event_log_source.h"
 #include "chrome/browser/feedback/system_logs/log_sources/memory_details_log_source.h"
 #include "components/feedback/system_logs/system_logs_fetcher.h"
 #include "net/net_buildflags.h"
@@ -23,7 +24,6 @@
 #include "chrome/browser/ash/system_logs/connected_input_devices_log_source.h"
 #include "chrome/browser/ash/system_logs/dbus_log_source.h"
 #include "chrome/browser/ash/system_logs/debug_daemon_log_source.h"
-#include "chrome/browser/ash/system_logs/device_event_log_source.h"
 #include "chrome/browser/ash/system_logs/network_health_source.h"
 #include "chrome/browser/ash/system_logs/reven_log_source.h"
 #include "chrome/browser/ash/system_logs/shill_log_source.h"
@@ -40,6 +40,7 @@
   SystemLogsFetcher* fetcher = new SystemLogsFetcher(scrub_data, nullptr);
 
   fetcher->AddSource(std::make_unique<ChromeInternalLogSource>());
+  fetcher->AddSource(std::make_unique<DeviceEventLogSource>());
   fetcher->AddSource(std::make_unique<MemoryDetailsLogSource>());
 
 #if BUILDFLAG(CHROME_ROOT_STORE_SUPPORTED)
@@ -51,7 +52,6 @@
   fetcher->AddSource(std::make_unique<BluetoothLogSource>());
   fetcher->AddSource(std::make_unique<CommandLineLogSource>());
   fetcher->AddSource(std::make_unique<DBusLogSource>());
-  fetcher->AddSource(std::make_unique<DeviceEventLogSource>());
 #if BUILDFLAG(IS_CHROMEOS_WITH_HW_DETAILS)
   fetcher->AddSource(std::make_unique<RevenLogSource>());
 #endif
diff --git a/chrome/browser/feedback/system_logs/chrome_system_logs_fetcher.cc b/chrome/browser/feedback/system_logs/chrome_system_logs_fetcher.cc
index 05f50168f..fa504cde 100644
--- a/chrome/browser/feedback/system_logs/chrome_system_logs_fetcher.cc
+++ b/chrome/browser/feedback/system_logs/chrome_system_logs_fetcher.cc
@@ -24,7 +24,6 @@
 #include "chrome/browser/ash/system_logs/crosapi_system_log_source.h"
 #include "chrome/browser/ash/system_logs/dbus_log_source.h"
 #include "chrome/browser/ash/system_logs/debug_daemon_log_source.h"
-#include "chrome/browser/ash/system_logs/device_event_log_source.h"
 #include "chrome/browser/ash/system_logs/iwlwifi_dump_log_source.h"
 #include "chrome/browser/ash/system_logs/network_health_source.h"
 #include "chrome/browser/ash/system_logs/reven_log_source.h"
@@ -33,6 +32,7 @@
 #include "chrome/browser/ash/system_logs/traffic_counters_log_source.h"
 #include "chrome/browser/ash/system_logs/ui_hierarchy_log_source.h"
 #include "chrome/browser/ash/system_logs/virtual_keyboard_log_source.h"
+#include "chrome/browser/feedback/system_logs/log_sources/device_event_log_source.h"
 #endif
 
 #if BUILDFLAG(IS_CHROMEOS_ASH)
diff --git a/chrome/browser/ash/system_logs/device_event_log_source.cc b/chrome/browser/feedback/system_logs/log_sources/device_event_log_source.cc
similarity index 81%
rename from chrome/browser/ash/system_logs/device_event_log_source.cc
rename to chrome/browser/feedback/system_logs/log_sources/device_event_log_source.cc
index e7980ab..d384a1f0 100644
--- a/chrome/browser/ash/system_logs/device_event_log_source.cc
+++ b/chrome/browser/feedback/system_logs/log_sources/device_event_log_source.cc
@@ -1,8 +1,8 @@
-// Copyright 2014 The Chromium Authors
+// Copyright 2022 The Chromium Authors
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "chrome/browser/ash/system_logs/device_event_log_source.h"
+#include "chrome/browser/feedback/system_logs/log_sources/device_event_log_source.h"
 
 #include "components/device_event_log/device_event_log.h"
 #include "content/public/browser/browser_thread.h"
@@ -12,11 +12,10 @@
 const char kNetworkEventLogEntry[] = "network_event_log";
 const char kDeviceEventLogEntry[] = "device_event_log";
 
-DeviceEventLogSource::DeviceEventLogSource() : SystemLogsSource("DeviceEvent") {
-}
+DeviceEventLogSource::DeviceEventLogSource()
+    : SystemLogsSource("DeviceEvent") {}
 
-DeviceEventLogSource::~DeviceEventLogSource() {
-}
+DeviceEventLogSource::~DeviceEventLogSource() {}
 
 void DeviceEventLogSource::Fetch(SysLogsSourceCallback callback) {
   DCHECK_CURRENTLY_ON(content::BrowserThread::UI);
diff --git a/chrome/browser/ash/system_logs/device_event_log_source.h b/chrome/browser/feedback/system_logs/log_sources/device_event_log_source.h
similarity index 68%
rename from chrome/browser/ash/system_logs/device_event_log_source.h
rename to chrome/browser/feedback/system_logs/log_sources/device_event_log_source.h
index a3d1cd5..c3d74152 100644
--- a/chrome/browser/ash/system_logs/device_event_log_source.h
+++ b/chrome/browser/feedback/system_logs/log_sources/device_event_log_source.h
@@ -1,9 +1,9 @@
-// Copyright 2014 The Chromium Authors
+// Copyright 2022 The Chromium Authors
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef CHROME_BROWSER_ASH_SYSTEM_LOGS_DEVICE_EVENT_LOG_SOURCE_H_
-#define CHROME_BROWSER_ASH_SYSTEM_LOGS_DEVICE_EVENT_LOG_SOURCE_H_
+#ifndef CHROME_BROWSER_FEEDBACK_SYSTEM_LOGS_LOG_SOURCES_DEVICE_EVENT_LOG_SOURCE_H_
+#define CHROME_BROWSER_FEEDBACK_SYSTEM_LOGS_LOG_SOURCES_DEVICE_EVENT_LOG_SOURCE_H_
 
 #include "components/feedback/system_logs/system_logs_source.h"
 
@@ -25,4 +25,4 @@
 
 }  // namespace system_logs
 
-#endif  // CHROME_BROWSER_ASH_SYSTEM_LOGS_DEVICE_EVENT_LOG_SOURCE_H_
+#endif  // CHROME_BROWSER_FEEDBACK_SYSTEM_LOGS_LOG_SOURCES_DEVICE_EVENT_LOG_SOURCE_H_
diff --git a/chrome/browser/first_party_sets/first_party_sets_navigation_throttle_unittest.cc b/chrome/browser/first_party_sets/first_party_sets_navigation_throttle_unittest.cc
index 4a3ca8b8..d20ca1e7 100644
--- a/chrome/browser/first_party_sets/first_party_sets_navigation_throttle_unittest.cc
+++ b/chrome/browser/first_party_sets/first_party_sets_navigation_throttle_unittest.cc
@@ -5,6 +5,7 @@
 #include "chrome/browser/first_party_sets/first_party_sets_navigation_throttle.h"
 
 #include "base/functional/callback_helpers.h"
+#include "base/memory/raw_ptr.h"
 #include "base/run_loop.h"
 #include "base/test/metrics/histogram_tester.h"
 #include "base/test/scoped_feature_list.h"
@@ -67,7 +68,7 @@
   base::test::ScopedFeatureList features_;
   raw_ptr<content::RenderFrameHost> subframe_;
   ScopedMockFirstPartySetsHandler first_party_sets_handler_;
-  FirstPartySetsPolicyService* service_;
+  raw_ptr<FirstPartySetsPolicyService> service_;
 };
 
 TEST_F(FirstPartySetsNavigationThrottleTest,
diff --git a/chrome/browser/first_party_sets/first_party_sets_policy_service_unittest.cc b/chrome/browser/first_party_sets/first_party_sets_policy_service_unittest.cc
index 3b81b2a5..9d5afed 100644
--- a/chrome/browser/first_party_sets/first_party_sets_policy_service_unittest.cc
+++ b/chrome/browser/first_party_sets/first_party_sets_policy_service_unittest.cc
@@ -5,6 +5,7 @@
 #include "chrome/browser/first_party_sets/first_party_sets_policy_service.h"
 
 #include "base/callback.h"
+#include "base/memory/raw_ptr.h"
 #include "base/test/metrics/histogram_tester.h"
 #include "base/test/scoped_feature_list.h"
 #include "base/test/test_future.h"
@@ -221,9 +222,9 @@
  private:
   ScopedMockFirstPartySetsHandler first_party_sets_handler_;
   std::unique_ptr<TestingProfileManager> profile_manager_;
-  Profile* profile_;
+  raw_ptr<Profile> profile_;
   base::test::ScopedFeatureList features_;
-  FirstPartySetsPolicyService* service_;
+  raw_ptr<FirstPartySetsPolicyService> service_;
 };
 
 TEST_F(FirstPartySetsPolicyServiceTest, IsSiteInManagedSet_WithoutConfig) {
diff --git a/chrome/browser/first_party_sets/scoped_mock_first_party_sets_handler.h b/chrome/browser/first_party_sets/scoped_mock_first_party_sets_handler.h
index 0ed16f9..2408e4f9 100644
--- a/chrome/browser/first_party_sets/scoped_mock_first_party_sets_handler.h
+++ b/chrome/browser/first_party_sets/scoped_mock_first_party_sets_handler.h
@@ -10,6 +10,7 @@
 
 #include "base/callback.h"
 #include "base/files/file_path.h"
+#include "base/memory/raw_ptr.h"
 #include "content/public/browser/first_party_sets_handler.h"
 #include "net/first_party_sets/first_party_sets_cache_filter.h"
 #include "net/first_party_sets/first_party_sets_context_config.h"
@@ -76,7 +77,7 @@
   }
 
  private:
-  content::FirstPartySetsHandler* previous_;
+  raw_ptr<content::FirstPartySetsHandler> previous_;
   net::GlobalFirstPartySets global_sets_;
   net::FirstPartySetsContextConfig config_;
   net::FirstPartySetsCacheFilter cache_filter_;
diff --git a/chrome/browser/flag-metadata.json b/chrome/browser/flag-metadata.json
index 32fe02fe..f8d65edb 100644
--- a/chrome/browser/flag-metadata.json
+++ b/chrome/browser/flag-metadata.json
@@ -1380,7 +1380,7 @@
     "owners": [
       "quickoffice-chrome-eng@google.com"
     ],
-    "expiry_milestone": 110
+    "expiry_milestone": 130
   },
   {
     "name": "disable-process-reuse",
diff --git a/chrome/browser/history_clusters/entity_image_service.h b/chrome/browser/history_clusters/entity_image_service.h
index 6e7268e0..d8fee00 100644
--- a/chrome/browser/history_clusters/entity_image_service.h
+++ b/chrome/browser/history_clusters/entity_image_service.h
@@ -8,6 +8,7 @@
 #include <string>
 
 #include "base/functional/callback_forward.h"
+#include "base/memory/raw_ptr.h"
 #include "base/memory/weak_ptr.h"
 #include "chrome/browser/autocomplete/chrome_autocomplete_provider_client.h"
 #include "chrome/browser/profiles/profile.h"
@@ -57,7 +58,7 @@
                       ResultCallback callback,
                       const GURL& image_url);
 
-  Profile* const profile_;
+  const raw_ptr<Profile> profile_;
   ChromeAutocompleteProviderClient autocomplete_provider_client_;
 
   std::unique_ptr<unified_consent::UrlKeyedDataCollectionConsentHelper>
diff --git a/chrome/browser/lacros/system_logs/lacros_system_log_fetcher.cc b/chrome/browser/lacros/system_logs/lacros_system_log_fetcher.cc
index 22a8040..50aacaac 100644
--- a/chrome/browser/lacros/system_logs/lacros_system_log_fetcher.cc
+++ b/chrome/browser/lacros/system_logs/lacros_system_log_fetcher.cc
@@ -6,6 +6,7 @@
 
 #include "chrome/browser/feedback/system_logs/log_sources/chrome_internal_log_source.h"
 #include "chrome/browser/feedback/system_logs/log_sources/crash_ids_source.h"
+#include "chrome/browser/feedback/system_logs/log_sources/device_event_log_source.h"
 #include "chrome/browser/feedback/system_logs/log_sources/memory_details_log_source.h"
 #include "chrome/common/extensions/extension_constants.h"
 #include "components/feedback/system_logs/system_logs_fetcher.h"
@@ -18,6 +19,7 @@
 
   fetcher->AddSource(std::make_unique<ChromeInternalLogSource>());
   fetcher->AddSource(std::make_unique<CrashIdsSource>());
+  fetcher->AddSource(std::make_unique<DeviceEventLogSource>());
   fetcher->AddSource(std::make_unique<MemoryDetailsLogSource>());
 
   return fetcher;
diff --git a/chrome/browser/media/android/cdm/media_drm_origin_id_manager.cc b/chrome/browser/media/android/cdm/media_drm_origin_id_manager.cc
index faffb1b..91cc13df 100644
--- a/chrome/browser/media/android/cdm/media_drm_origin_id_manager.cc
+++ b/chrome/browser/media/android/cdm/media_drm_origin_id_manager.cc
@@ -151,13 +151,10 @@
     return base::UnguessableToken::Null();
 
   auto first_entry = origin_ids->begin();
-  absl::optional<base::UnguessableToken> result =
-      base::ValueToUnguessableToken(*first_entry);
-  if (!result)
-    return base::UnguessableToken::Null();
-
+  auto result = base::ValueToUnguessableToken(*first_entry);
   origin_ids->erase(first_entry);
-  return *result;
+
+  return result.value_or(base::UnguessableToken::Null());
 }
 
 void AddOriginId(base::Value::Dict& origin_id_dict,
diff --git a/chrome/browser/media/android/cdm/media_drm_origin_id_manager_unittest.cc b/chrome/browser/media/android/cdm/media_drm_origin_id_manager_unittest.cc
index ff25dce..4c5cf7a 100644
--- a/chrome/browser/media/android/cdm/media_drm_origin_id_manager_unittest.cc
+++ b/chrome/browser/media/android/cdm/media_drm_origin_id_manager_unittest.cc
@@ -20,6 +20,7 @@
 #include "base/unguessable_token.h"
 #include "chrome/browser/media/android/cdm/media_drm_origin_id_manager_factory.h"
 #include "chrome/test/base/testing_profile.h"
+#include "components/prefs/scoped_user_pref_update.h"
 #include "components/sync_preferences/testing_pref_service_syncable.h"
 #include "content/public/test/browser_task_environment.h"
 #include "media/base/android/media_drm_bridge.h"
@@ -105,6 +106,14 @@
     return profile_->GetTestingPrefService()->GetDict(path);
   }
 
+  void VerifyListSize() {
+    auto& dict = GetDict(kMediaDrmOriginIds);
+    DVLOG(1) << DisplayPref(dict);
+    const auto* list = dict.FindList(kAvailableOriginIds);
+    EXPECT_TRUE(list);
+    EXPECT_EQ(list->size(), kExpectedPreferenceListSize);
+  }
+
   // On devices that support per-application provisioning pre-provisioning
   // should fully populate the list of pre-provisioned origin IDs (as long as
   // provisioning succeeds). On devices that don't the list should be empty.
@@ -267,13 +276,7 @@
   task_environment_.RunUntilIdle();
 
   DVLOG(1) << "Checking preference " << kMediaDrmOriginIds;
-
-  auto& dict = GetDict(kMediaDrmOriginIds);
-  DVLOG(1) << DisplayPref(dict);
-
-  const auto* list = dict.FindList(kAvailableOriginIds);
-  EXPECT_TRUE(list);
-  EXPECT_EQ(list->size(), kExpectedPreferenceListSize);
+  VerifyListSize();
 }
 
 TEST_F(MediaDrmOriginIdManagerTest, OriginIdNotInList) {
@@ -339,9 +342,7 @@
   EXPECT_FALSE(dict.Find(kExpirableToken));
 
   // As well, the list of available pre-provisioned origin IDs should be full.
-  auto* list = dict.FindList(kAvailableOriginIds);
-  EXPECT_TRUE(list);
-  EXPECT_EQ(list->size(), kExpectedPreferenceListSize);
+  VerifyListSize();
 }
 
 TEST_F(MediaDrmOriginIdManagerTest, ProvisioningAfterExpiration) {
@@ -453,12 +454,7 @@
 
   // Pre-provisioning should have run and filled up the list.
   DVLOG(1) << "Checking preference " << kMediaDrmOriginIds << " again";
-  {
-    auto& dict = GetDict(kMediaDrmOriginIds);
-    DVLOG(1) << DisplayPref(dict);
-    auto* list = dict.FindList(kAvailableOriginIds);
-    EXPECT_EQ(list->size(), kExpectedPreferenceListSize);
-  }
+  VerifyListSize();
 }
 
 TEST_F(MediaDrmOriginIdManagerTest, NetworkChangeFails) {
@@ -504,3 +500,36 @@
     EXPECT_FALSE(dict.Find(kAvailableOriginIds));
   }
 }
+
+TEST_F(MediaDrmOriginIdManagerTest, InvalidEntry) {
+  // After fetching an origin ID the code should pre-provision more origins
+  // and fill up the list. This is independent of whether the device supports
+  // per-application provisioning or not.
+  EXPECT_CALL(*this, GetProvisioningResult())
+      .WillRepeatedly(InvokeWithoutArgs(&base::UnguessableToken::Create));
+  Initialize();
+
+  EXPECT_TRUE(GetOriginId());
+  task_environment_.RunUntilIdle();
+  VerifyListSize();
+
+  // Fetching the first origin ID has now filled up the list. Replace the
+  // first entry in the list with something (a boolean value) that cannot
+  // be converted to a base::UnguessableToken.
+  {
+    ScopedDictPrefUpdate update(profile_->GetTestingPrefService(),
+                                kMediaDrmOriginIds);
+    base::Value::List* origin_ids = update->FindList(kAvailableOriginIds);
+    EXPECT_FALSE(origin_ids->empty());
+    auto first_entry = origin_ids->begin();
+    *first_entry = base::Value(true);
+  }
+
+  // Next GetOriginId() call should attempt to use the invalid entry. Since
+  // it's invalid, a new origin ID will be created and used. And then an
+  // additional one is created to replace the one that should have been taken
+  // from the list.
+  EXPECT_TRUE(GetOriginId());
+  task_environment_.RunUntilIdle();
+  VerifyListSize();
+}
diff --git a/chrome/browser/media/webrtc/native_desktop_media_list_unittest.cc b/chrome/browser/media/webrtc/native_desktop_media_list_unittest.cc
index a0a9ace..ba80757f 100644
--- a/chrome/browser/media/webrtc/native_desktop_media_list_unittest.cc
+++ b/chrome/browser/media/webrtc/native_desktop_media_list_unittest.cc
@@ -834,7 +834,7 @@
   int ensure_hidden_call_count() const { return ensure_hidden_call_count_; }
 
  private:
-  webrtc::DelegatedSourceListController::Observer* observer_ = nullptr;
+  raw_ptr<webrtc::DelegatedSourceListController::Observer> observer_ = nullptr;
   int ensure_visible_call_count_ = 0;
   int ensure_hidden_call_count_ = 0;
 };
diff --git a/chrome/browser/metrics/power/battery_discharge_reporter_unittest.cc b/chrome/browser/metrics/power/battery_discharge_reporter_unittest.cc
index 5c22859..7aa296a9 100644
--- a/chrome/browser/metrics/power/battery_discharge_reporter_unittest.cc
+++ b/chrome/browser/metrics/power/battery_discharge_reporter_unittest.cc
@@ -22,6 +22,8 @@
     "Power.BatteryDischargeMode5";
 constexpr const char* kBatteryDischargeRateMilliwattsHistogramName =
     "Power.BatteryDischargeRateMilliwatts5";
+constexpr const char* kAltBatteryDischargeRateMilliwattsHistogramName =
+    "Power.AltBatteryDischargeRateMilliwatts5";
 constexpr const char* kBatteryDischargeRateRelativeHistogramName =
     "Power.BatteryDischargeRateRelative5";
 
@@ -170,6 +172,9 @@
       &histogram_tester_, suffixes,
       {{kBatteryDischargeRateMilliwattsHistogramName, kExpectedDischargeRate}});
   ExpectHistogramSamples(&histogram_tester_, suffixes,
+                         {{kAltBatteryDischargeRateMilliwattsHistogramName,
+                           kExpectedDischargeRate}});
+  ExpectHistogramSamples(&histogram_tester_, suffixes,
                          {{kBatteryDischargeRateRelativeHistogramName,
                            kExpectedDischargeRateRelative}});
 }
@@ -281,6 +286,45 @@
                                      1);
 }
 
+TEST_F(BatteryDischargeReporterTest, FullChargedCapacityIncreased) {
+  TestUsageScenarioDataStoreImpl usage_scenario_data_store;
+
+  base::BatteryStateSampler battery_state_sampler(
+      std::make_unique<NoopSamplingEventSource>(),
+      std::make_unique<NoopBatteryLevelProvider>());
+  BatteryDischargeReporter battery_discharge_reporter(
+      &battery_state_sampler, &usage_scenario_data_store);
+
+  battery_discharge_reporter.OnBatteryStateSampled(
+      base::BatteryLevelProvider::BatteryState{
+          .battery_count = 1,
+          .is_external_power_connected = false,
+          .current_capacity = 40,
+          .full_charged_capacity = 100,
+          .charge_unit = base::BatteryLevelProvider::BatteryLevelUnit::kMWh,
+      });
+  task_environment_.FastForwardBy(base::Minutes(1));
+  battery_discharge_reporter.OnBatteryStateSampled(
+      base::BatteryLevelProvider::BatteryState{
+          .battery_count = 1,
+          .is_external_power_connected = false,
+          .current_capacity = 40,
+          .full_charged_capacity = 110,
+          .charge_unit = base::BatteryLevelProvider::BatteryLevelUnit::kMWh,
+      });
+
+  // Full charged capacity increased. Used capacity went from 60 mWh to 70 mwh,
+  // which is interpreted as a 10 mWh discharge. 10 mWh discharge over 1 minute
+  // equals 600 mW.
+  const int64_t kExpectedDischargeRate = 600;
+
+  const std::vector<const char*> suffixes(
+      {"", ".Initial", ".ZeroWindow", ".ZeroWindow.Initial"});
+  ExpectHistogramSamples(&histogram_tester_, suffixes,
+                         {{kAltBatteryDischargeRateMilliwattsHistogramName,
+                           kExpectedDischargeRate}});
+}
+
 TEST_F(BatteryDischargeReporterTest, RetrievalError) {
   TestBatteryDischargeMode(absl::nullopt, absl::nullopt,
                            BatteryDischargeMode::kRetrievalError);
diff --git a/chrome/browser/metrics/power/power_metrics.cc b/chrome/browser/metrics/power/power_metrics.cc
index 1eeaac4..6e84b00 100644
--- a/chrome/browser/metrics/power/power_metrics.cc
+++ b/chrome/browser/metrics/power/power_metrics.cc
@@ -18,6 +18,8 @@
 
 constexpr const char* kBatteryDischargeRateMilliwattsHistogramName =
     "Power.BatteryDischargeRateMilliwatts5";
+constexpr const char* kAltBatteryDischargeRateMilliwattsHistogramName =
+    "Power.AltBatteryDischargeRateMilliwatts5";
 constexpr const char* kBatteryDischargeRateRelativeHistogramName =
     "Power.BatteryDischargeRateRelative5";
 constexpr const char* kBatteryDischargeModeHistogramName =
@@ -51,6 +53,21 @@
 constexpr int kMaxGPUProportion = 1;
 #endif  // BUILDFLAG(IS_MAC)
 
+// Returns the current capacity of |battery_state| in milliwatt-hours.
+uint64_t GetBatteryCapacityinMWh(
+    const base::BatteryLevelProvider::BatteryState& battery_state) {
+  if (battery_state.charge_unit ==
+      base::BatteryLevelProvider::BatteryLevelUnit::kMWh) {
+    return battery_state.current_capacity.value();
+  }
+
+  DCHECK_EQ(battery_state.charge_unit.value(),
+            base::BatteryLevelProvider::BatteryLevelUnit::kMAh);
+  DCHECK(battery_state.voltage_mv.has_value());
+  return battery_state.current_capacity.value() *
+         battery_state.voltage_mv.value() / 1000;
+}
+
 }  // namespace
 
 void ReportAggregatedProcessMetricsHistograms(
@@ -63,22 +80,17 @@
   }
 }
 
-// Returns the discharge rate in milliwatts.
 int64_t CalculateDischargeRateMilliwatts(
-    const absl::optional<base::BatteryLevelProvider::BatteryState>&
-        previous_battery_state,
-    const absl::optional<base::BatteryLevelProvider::BatteryState>&
-        new_battery_state,
+    const base::BatteryLevelProvider::BatteryState& previous_battery_state,
+    const base::BatteryLevelProvider::BatteryState& new_battery_state,
     base::TimeDelta interval_duration) {
-  DCHECK(previous_battery_state &&
-         previous_battery_state->charge_unit ==
-             base::BatteryLevelProvider::BatteryLevelUnit::kMWh);
-  DCHECK(new_battery_state &&
-         previous_battery_state->charge_unit ==
-             base::BatteryLevelProvider::BatteryLevelUnit::kMWh);
+  DCHECK_EQ(previous_battery_state.charge_unit.value(),
+            new_battery_state.charge_unit.value());
+
   const uint64_t previous_capacity =
-      previous_battery_state->current_capacity.value();
-  const uint64_t new_capacity = new_battery_state->current_capacity.value();
+      GetBatteryCapacityinMWh(previous_battery_state);
+  const uint64_t new_capacity = GetBatteryCapacityinMWh(new_battery_state);
+
   // The capacity is in mWh. Divide by hours to get mW. Note that there is no
   // InHoursF() method.
   const double interval_duration_in_hours =
@@ -87,24 +99,57 @@
   return (previous_capacity - new_capacity) / interval_duration_in_hours;
 }
 
-// Returns the discharge rate in one hundredth of a percent of full capacity per
-// minute.
+int64_t CalculateAltDischargeRateMilliwatts(
+    const base::BatteryLevelProvider::BatteryState& previous_battery_state,
+    const base::BatteryLevelProvider::BatteryState& new_battery_state,
+    base::TimeDelta interval_duration) {
+  DCHECK(previous_battery_state.charge_unit.has_value());
+  DCHECK(new_battery_state.charge_unit.has_value());
+  DCHECK_EQ(previous_battery_state.charge_unit.value(),
+            new_battery_state.charge_unit.value());
+
+  const int64_t discharge_capacity =
+      (new_battery_state.full_charged_capacity.value() -
+       new_battery_state.current_capacity.value()) -
+      (previous_battery_state.full_charged_capacity.value() -
+       previous_battery_state.current_capacity.value());
+
+  const int64_t discharge_capacity_mwh = [&]() -> int64_t {
+    if (new_battery_state.charge_unit.value() ==
+        base::BatteryLevelProvider::BatteryLevelUnit::kMWh) {
+      return discharge_capacity;
+    }
+
+    DCHECK_EQ(new_battery_state.charge_unit.value(),
+              base::BatteryLevelProvider::BatteryLevelUnit::kMAh);
+    const uint64_t average_mv = (previous_battery_state.voltage_mv.value() +
+                                 new_battery_state.voltage_mv.value()) /
+                                2;
+    return discharge_capacity * average_mv / 1000;
+  }();
+
+  // The capacity is in mWh. Divide by hours to get mW. Note that there is no
+  // InHoursF() method.
+  const double interval_duration_in_hours =
+      interval_duration.InSecondsF() / base::Time::kSecondsPerHour;
+
+  return discharge_capacity_mwh / interval_duration_in_hours;
+}
+
 int64_t CalculateDischargeRateRelative(
-    const absl::optional<base::BatteryLevelProvider::BatteryState>&
-        previous_battery_state,
-    const absl::optional<base::BatteryLevelProvider::BatteryState>&
-        new_battery_state,
+    const base::BatteryLevelProvider::BatteryState& previous_battery_state,
+    const base::BatteryLevelProvider::BatteryState& new_battery_state,
     base::TimeDelta interval_duration) {
   // The battery discharge rate is reported per minute with 1/10000 of full
   // charge resolution.
   static constexpr int64_t kDischargeRateFactor = 10000;
 
   const double previous_level =
-      static_cast<double>(previous_battery_state->current_capacity.value()) /
-      previous_battery_state->full_charged_capacity.value();
+      static_cast<double>(previous_battery_state.current_capacity.value()) /
+      previous_battery_state.full_charged_capacity.value();
   const double new_level =
-      static_cast<double>(new_battery_state->current_capacity.value()) /
-      new_battery_state->full_charged_capacity.value();
+      static_cast<double>(new_battery_state.current_capacity.value()) /
+      new_battery_state.full_charged_capacity.value();
 
   const double interval_duration_in_minutes =
       interval_duration.InSecondsF() / base::Time::kSecondsPerMinute;
@@ -167,16 +212,19 @@
     return {BatteryDischargeMode::kFullChargedCapacityIsZero, absl::nullopt};
   }
 
-  const auto discharge_rate_relative = CalculateDischargeRateRelative(
-      previous_battery_state, new_battery_state, interval_duration);
   const auto discharge_rate_mw = CalculateDischargeRateMilliwatts(
-      previous_battery_state, new_battery_state, interval_duration);
+      *previous_battery_state, *new_battery_state, interval_duration);
+  const auto alt_discharge_rate_mw = CalculateAltDischargeRateMilliwatts(
+      *previous_battery_state, *new_battery_state, interval_duration);
+
+  const auto discharge_rate_relative = CalculateDischargeRateRelative(
+      *previous_battery_state, *new_battery_state, interval_duration);
 
   if (discharge_rate_relative < 0 || discharge_rate_mw < 0) {
     return {BatteryDischargeMode::kBatteryLevelIncreased, absl::nullopt};
   }
   return {BatteryDischargeMode::kDischarging, discharge_rate_mw,
-          discharge_rate_relative};
+          alt_discharge_rate_mw, discharge_rate_relative};
 }
 
 void ReportBatteryHistograms(
@@ -200,6 +248,11 @@
             base::StrCat({kBatteryDischargeRateMilliwattsHistogramName,
                           scenario_suffix, interval_type_suffix}),
             *battery_discharge.rate_milliwatts);
+        DCHECK(battery_discharge.alt_rate_milliwatts.has_value());
+        base::UmaHistogramCounts100000(
+            base::StrCat({kAltBatteryDischargeRateMilliwattsHistogramName,
+                          scenario_suffix, interval_type_suffix}),
+            *battery_discharge.alt_rate_milliwatts);
         DCHECK(battery_discharge.rate_relative.has_value());
         base::UmaHistogramCounts1000(
             base::StrCat({kBatteryDischargeRateRelativeHistogramName,
diff --git a/chrome/browser/metrics/power/power_metrics.h b/chrome/browser/metrics/power/power_metrics.h
index c9fd6af..462df18 100644
--- a/chrome/browser/metrics/power/power_metrics.h
+++ b/chrome/browser/metrics/power/power_metrics.h
@@ -44,10 +44,33 @@
   BatteryDischargeMode mode;
   // Discharge rate in milliwatts.
   absl::optional<int64_t> rate_milliwatts;
+  // Discharge rate in milliwatts, calculated using the used capacity instead of
+  // the current capacity.
+  absl::optional<int64_t> alt_rate_milliwatts;
   // Discharge rate in hundredth of a percent per minute.
   absl::optional<int64_t> rate_relative;
 };
 
+// Returns the discharge rate in milliwatts.
+int64_t CalculateDischargeRateMilliwatts(
+    const base::BatteryLevelProvider::BatteryState& previous_battery_state,
+    const base::BatteryLevelProvider::BatteryState& new_battery_state,
+    base::TimeDelta interval_duration);
+
+// Returns the discharge rate in milliwatts, using the used capacity instead of
+// the current capacity.
+int64_t CalculateAltDischargeRateMilliwatts(
+    const base::BatteryLevelProvider::BatteryState& previous_battery_state,
+    const base::BatteryLevelProvider::BatteryState& new_battery_state,
+    base::TimeDelta interval_duration);
+
+// Returns the discharge rate in one hundredth of a percent of full capacity per
+// minute.
+int64_t CalculateDischargeRateRelative(
+    const base::BatteryLevelProvider::BatteryState& previous_battery_state,
+    const base::BatteryLevelProvider::BatteryState& new_battery_state,
+    base::TimeDelta interval_duration);
+
 // Computes and returns the battery discharge mode and rate during the interval.
 // If the discharge rate isn't valid, the returned rate is nullopt and the
 // reason is indicated per BatteryDischargeMode.
diff --git a/chrome/browser/metrics/power/power_metrics_unittest.cc b/chrome/browser/metrics/power/power_metrics_unittest.cc
index d6b9074..8a097da 100644
--- a/chrome/browser/metrics/power/power_metrics_unittest.cc
+++ b/chrome/browser/metrics/power/power_metrics_unittest.cc
@@ -180,3 +180,98 @@
       "PerformanceMonitor.ResourceCoalition.EnergyImpact.Foo", 0);
 }
 #endif  // BUILDFLAG(IS_MAC)
+
+TEST(PowerMetricsTest, CalculateDischargeRateMilliwatts_mWh) {
+  int64_t discharge_rate = CalculateDischargeRateMilliwatts(
+      base::BatteryLevelProvider::BatteryState{
+          .battery_count = 1,
+          .is_external_power_connected = false,
+          .current_capacity = 100,
+          .full_charged_capacity = 10000,
+          .charge_unit = base::BatteryLevelProvider::BatteryLevelUnit::kMWh,
+      },
+      base::BatteryLevelProvider::BatteryState{
+          .battery_count = 1,
+          .is_external_power_connected = false,
+          .current_capacity = 90,
+          .full_charged_capacity = 10000,
+          .charge_unit = base::BatteryLevelProvider::BatteryLevelUnit::kMWh,
+      },
+      base::Minutes(1));
+
+  // 10 mWh discharge in 1 minute translates to 600 mWh in 1 hour.
+  EXPECT_EQ(discharge_rate, 600);
+}
+
+TEST(PowerMetricsTest, CalculateDischargeRateMilliwatts_mAh) {
+  int64_t discharge_rate = CalculateDischargeRateMilliwatts(
+      base::BatteryLevelProvider::BatteryState{
+          .battery_count = 1,
+          .is_external_power_connected = false,
+          .current_capacity = 100,
+          .full_charged_capacity = 10000,
+          .voltage_mv = 12000,
+          .charge_unit = base::BatteryLevelProvider::BatteryLevelUnit::kMAh,
+      },
+      base::BatteryLevelProvider::BatteryState{
+          .battery_count = 1,
+          .is_external_power_connected = false,
+          .current_capacity = 90,
+          .full_charged_capacity = 10000,
+          .voltage_mv = 12000,
+          .charge_unit = base::BatteryLevelProvider::BatteryLevelUnit::kMAh,
+      },
+      base::Minutes(1));
+
+  // 10 mAh discharge in 1 minute translates to 600 mWh in 1 hour. That value is
+  // then multiplied by the voltage (12v) to get 7200 milliwatts.
+  EXPECT_EQ(discharge_rate, 7200);
+}
+
+TEST(PowerMetricsTest, CalculateAltDischargeRateMilliwatts_mWh) {
+  int64_t discharge_rate = CalculateAltDischargeRateMilliwatts(
+      base::BatteryLevelProvider::BatteryState{
+          .battery_count = 1,
+          .is_external_power_connected = false,
+          .current_capacity = 100,
+          .full_charged_capacity = 10000,
+          .charge_unit = base::BatteryLevelProvider::BatteryLevelUnit::kMWh,
+      },
+      base::BatteryLevelProvider::BatteryState{
+          .battery_count = 1,
+          .is_external_power_connected = false,
+          .current_capacity = 90,
+          .full_charged_capacity = 10000,
+          .charge_unit = base::BatteryLevelProvider::BatteryLevelUnit::kMWh,
+      },
+      base::Minutes(1));
+
+  // 10 mWh discharge in 1 minute translates to 600 mWh in 1 hour.
+  EXPECT_EQ(discharge_rate, 600);
+}
+
+
+TEST(PowerMetricsTest, CalculateAltDischargeRateMilliwatts_mAh) {
+  int64_t discharge_rate = CalculateAltDischargeRateMilliwatts(
+      base::BatteryLevelProvider::BatteryState{
+          .battery_count = 1,
+          .is_external_power_connected = false,
+          .current_capacity = 100,
+          .full_charged_capacity = 10000,
+          .voltage_mv = 12100,
+          .charge_unit = base::BatteryLevelProvider::BatteryLevelUnit::kMAh,
+      },
+      base::BatteryLevelProvider::BatteryState{
+          .battery_count = 1,
+          .is_external_power_connected = false,
+          .current_capacity = 90,
+          .full_charged_capacity = 10000,
+          .voltage_mv = 11900,
+          .charge_unit = base::BatteryLevelProvider::BatteryLevelUnit::kMAh,
+      },
+      base::Minutes(1));
+
+  // 10 mAh discharge in 1 minute translates to 600 mWh in 1 hour. That value is
+  // then multiplied by the average voltage (12v) to get 7200 milliwatts.
+  EXPECT_EQ(discharge_rate, 7200);
+}
diff --git a/chrome/browser/new_tab_page/modules/feed/feed_handler_unittest.cc b/chrome/browser/new_tab_page/modules/feed/feed_handler_unittest.cc
index 6f3a7bc..797b6b9 100644
--- a/chrome/browser/new_tab_page/modules/feed/feed_handler_unittest.cc
+++ b/chrome/browser/new_tab_page/modules/feed/feed_handler_unittest.cc
@@ -8,6 +8,7 @@
 #include <vector>
 
 #include "base/callback_forward.h"
+#include "base/memory/raw_ptr.h"
 #include "base/memory/scoped_refptr.h"
 #include "base/strings/strcat.h"
 #include "base/strings/string_number_conversions.h"
@@ -93,7 +94,7 @@
 
  protected:
   std::unique_ptr<FeedHandler> handler_;
-  TestingProfile* profile_;
+  raw_ptr<TestingProfile> profile_;
   content::BrowserTaskEnvironment task_environment_{
       base::test::TaskEnvironment::TimeSource::MOCK_TIME};
   variations::ScopedVariationsIdsProvider scoped_variations_ids_provider_{
diff --git a/chrome/browser/password_manager/chrome_webauthn_credentials_delegate_unittest.cc b/chrome/browser/password_manager/chrome_webauthn_credentials_delegate_unittest.cc
index a13aa33..eb4deb7 100644
--- a/chrome/browser/password_manager/chrome_webauthn_credentials_delegate_unittest.cc
+++ b/chrome/browser/password_manager/chrome_webauthn_credentials_delegate_unittest.cc
@@ -146,7 +146,7 @@
 #endif
 
  protected:
-  ChromeWebAuthnCredentialsDelegate* credentials_delegate_;
+  raw_ptr<ChromeWebAuthnCredentialsDelegate> credentials_delegate_;
 #if !BUILDFLAG(IS_ANDROID)
   std::unique_ptr<ChromeAuthenticatorRequestDelegate>
       authenticator_request_delegate_;
diff --git a/chrome/browser/performance_manager/policies/page_discarding_helper.h b/chrome/browser/performance_manager/policies/page_discarding_helper.h
index a0ca059..a4aa33c 100644
--- a/chrome/browser/performance_manager/policies/page_discarding_helper.h
+++ b/chrome/browser/performance_manager/policies/page_discarding_helper.h
@@ -57,7 +57,7 @@
   }
 
  private:
-  const PageNode* page_node_;
+  raw_ptr<const PageNode> page_node_;
   bool is_marked_;
   bool is_protected_;
   // Delta between current time and last visibility change time.
diff --git a/chrome/browser/performance_manager/test_support/fake_frame_throttling_delegate.h b/chrome/browser/performance_manager/test_support/fake_frame_throttling_delegate.h
index e0bad3f..290a382 100644
--- a/chrome/browser/performance_manager/test_support/fake_frame_throttling_delegate.h
+++ b/chrome/browser/performance_manager/test_support/fake_frame_throttling_delegate.h
@@ -5,6 +5,7 @@
 #ifndef CHROME_BROWSER_PERFORMANCE_MANAGER_TEST_SUPPORT_FAKE_FRAME_THROTTLING_DELEGATE_H_
 #define CHROME_BROWSER_PERFORMANCE_MANAGER_TEST_SUPPORT_FAKE_FRAME_THROTTLING_DELEGATE_H_
 
+#include "base/memory/raw_ptr.h"
 #include "chrome/browser/performance_manager/public/user_tuning/user_performance_tuning_manager.h"
 
 namespace performance_manager {
@@ -19,7 +20,7 @@
   explicit FakeFrameThrottlingDelegate(bool* throttling_enabled);
   ~FakeFrameThrottlingDelegate() override = default;
 
-  bool* throttling_enabled_;
+  raw_ptr<bool> throttling_enabled_;
 };
 
 }  // namespace performance_manager
diff --git a/chrome/browser/performance_manager/user_tuning/user_performance_tuning_manager_unittest.cc b/chrome/browser/performance_manager/user_tuning/user_performance_tuning_manager_unittest.cc
index 97bf622..59f7dbd 100644
--- a/chrome/browser/performance_manager/user_tuning/user_performance_tuning_manager_unittest.cc
+++ b/chrome/browser/performance_manager/user_tuning/user_performance_tuning_manager_unittest.cc
@@ -4,6 +4,7 @@
 
 #include "chrome/browser/performance_manager/public/user_tuning/user_performance_tuning_manager.h"
 
+#include "base/memory/raw_ptr.h"
 #include "base/power_monitor/power_monitor.h"
 #include "base/power_monitor/power_monitor_source.h"
 #include "base/run_loop.h"
@@ -132,7 +133,7 @@
   raw_ptr<base::test::TestBatteryLevelProvider> battery_level_provider_;
   std::unique_ptr<base::BatteryStateSampler> battery_sampler_;
 
-  FakePowerMonitorSource* power_monitor_source_;
+  raw_ptr<FakePowerMonitorSource> power_monitor_source_;
   bool throttling_enabled_ = false;
   std::unique_ptr<UserPerformanceTuningManager> manager_;
 };
diff --git a/chrome/browser/policy/policy_network_browsertest.cc b/chrome/browser/policy/policy_network_browsertest.cc
index eaa62ea3..b0bd172 100644
--- a/chrome/browser/policy/policy_network_browsertest.cc
+++ b/chrome/browser/policy/policy_network_browsertest.cc
@@ -437,7 +437,7 @@
   // The first profile.
   raw_ptr<Profile, DanglingUntriaged> profile_1_;
   // The second profile. Only valid after CreateSecondProfile() has been called.
-  Profile* profile_2_;
+  raw_ptr<Profile> profile_2_;
 
   // Mock Policy for profile_1_.
   MockConfigurationPolicyProvider policy_for_profile_1_;
diff --git a/chrome/browser/preloading/prerender/omnibox_prerender_browsertest.cc b/chrome/browser/preloading/prerender/omnibox_prerender_browsertest.cc
index 1b1b71c..fc70c08f 100644
--- a/chrome/browser/preloading/prerender/omnibox_prerender_browsertest.cc
+++ b/chrome/browser/preloading/prerender/omnibox_prerender_browsertest.cc
@@ -123,38 +123,6 @@
   base::test::ScopedFeatureList scoped_feature_list_;
 };
 
-// This test class uses the kPrerender2 default value, which is true for Android
-// and false for others. In contrast, OmniboxPrerenderBrowserTest enables
-// kPrerender2 by PrerenderTestHelper.
-class OmniboxPrerenderDefaultPrerender2BrowserTest
-    : public PlatformBrowserTest {
- public:
-  OmniboxPrerenderDefaultPrerender2BrowserTest() {
-    scoped_feature_list_.InitAndEnableFeature(
-        features::kOmniboxTriggerForPrerender2);
-  }
-
-  void SetUp() override { PlatformBrowserTest::SetUp(); }
-
-  void SetUpOnMainThread() override {
-    host_resolver()->AddRule("*", "127.0.0.1");
-    embedded_test_server()->ServeFilesFromDirectory(
-        base::PathService::CheckedGet(chrome::DIR_TEST_DATA));
-    ASSERT_TRUE(embedded_test_server()->Start());
-  }
-
-  void TearDownOnMainThread() override {
-    ASSERT_TRUE(embedded_test_server()->ShutdownAndWaitUntilComplete());
-  }
-
-  content::WebContents* GetActiveWebContents() {
-    return chrome_test_utils::GetActiveWebContents(this);
-  }
-
- private:
-  base::test::ScopedFeatureList scoped_feature_list_;
-};
-
 // Tests that Prerender2 cannot be triggered when preload setting is disabled.
 IN_PROC_BROWSER_TEST_F(OmniboxPrerenderBrowserTest, DisableNetworkPrediction) {
   const GURL kInitialUrl = embedded_test_server()->GetURL("/empty.html");
@@ -247,82 +215,6 @@
   }
 }
 
-// Verifies that prerendering functions in document are properly exposed.
-IN_PROC_BROWSER_TEST_F(
-    OmniboxPrerenderBrowserTest,
-    PrerenderFunctionsProperlyExportedWhenInitiatedByOmnibox) {
-  const GURL kInitialUrl = embedded_test_server()->GetURL("/empty.html");
-  ASSERT_TRUE(GetActiveWebContents());
-  ASSERT_TRUE(content::NavigateToURL(GetActiveWebContents(), kInitialUrl));
-  EXPECT_EQ(true,
-            EvalJs(GetActiveWebContents(), "document.prerendering === false"));
-  EXPECT_EQ(
-      0,
-      EvalJs(GetActiveWebContents(),
-             "performance.getEntriesByType('navigation')[0].activationStart"));
-  EXPECT_EQ(true, EvalJs(GetActiveWebContents(),
-                         "'onprerenderingchange' in document"));
-
-  const GURL kPrerenderingUrl =
-      embedded_test_server()->GetURL("/prerender/onprerendering_check.html");
-
-  GetAutocompleteActionPredictor()->StartPrerendering(
-      kPrerenderingUrl, *GetActiveWebContents(), gfx::Size(50, 50));
-
-  int host_id = prerender_helper().GetHostForUrl(kPrerenderingUrl);
-  content::RenderFrameHost* prerender_frame_host =
-      prerender_helper().GetPrerenderedMainFrameHost(host_id);
-  prerender_helper().WaitForPrerenderLoadCompletion(host_id);
-  EXPECT_EQ(true,
-            EvalJs(prerender_frame_host, "document.prerendering === true"));
-  EXPECT_EQ(
-      0,
-      EvalJs(prerender_frame_host,
-             "performance.getEntriesByType('navigation')[0].activationStart"));
-  EXPECT_EQ(true,
-            EvalJs(prerender_frame_host, "'onprerenderingchange' in document"));
-
-  // Simulate a browser-initiated navigation.
-  content::test::PrerenderHostObserver prerender_observer(
-      *GetActiveWebContents(), kPrerenderingUrl);
-
-  GetActiveWebContents()->OpenURL(content::OpenURLParams(
-      kPrerenderingUrl, content::Referrer(), WindowOpenDisposition::CURRENT_TAB,
-      ui::PageTransitionFromInt(ui::PAGE_TRANSITION_TYPED |
-                                ui::PAGE_TRANSITION_FROM_ADDRESS_BAR),
-      /*is_renderer_initiated=*/false));
-  prerender_observer.WaitForActivation();
-
-  EXPECT_EQ(true,
-            EvalJs(prerender_frame_host, "document.prerendering === false"));
-  EXPECT_LT(
-      0.0,
-      EvalJs(prerender_frame_host,
-             "performance.getEntriesByType('navigation')[0].activationStart")
-          .ExtractDouble());
-  EXPECT_EQ(true, EvalJs(prerender_frame_host,
-                         "onprerenderingchange_observed_promise"));
-}
-
-// Verifies that the exportation of prerendering functions in the document is
-// handled properly when Prerender2 is set to be the default value. For android,
-// on which Prerender2 is enabled,  those functions are expected to be exported,
-// while the functions are not supposed to be exported on other platforms.
-IN_PROC_BROWSER_TEST_F(OmniboxPrerenderDefaultPrerender2BrowserTest,
-                       PrerenderFunctionsCheckWithDefaultFlag) {
-  const GURL kInitialUrl = embedded_test_server()->GetURL("/empty.html");
-  ASSERT_TRUE(GetActiveWebContents());
-  ASSERT_TRUE(content::NavigateToURL(GetActiveWebContents(), kInitialUrl));
-
-  EXPECT_EQ(true,
-            EvalJs(GetActiveWebContents(), "document.prerendering === false"));
-  EXPECT_EQ(0, EvalJs(GetActiveWebContents(),
-                      "performance.getEntriesByType('navigation')[0]."
-                      "activationStart"));
-  EXPECT_EQ(true, EvalJs(GetActiveWebContents(),
-                         "'onprerenderingchange' in document"));
-}
-
 class PrerenderOmniboxSearchSuggestionBrowserTest
     : public OmniboxPrerenderBrowserTest {
  public:
@@ -656,53 +548,4 @@
       internal::kHistogramPrerenderPredictionStatusDefaultSearchEngine, 2);
 }
 
-// Verifies that prerendering functions in document are properly exposed when
-// triggered by search suggestion.
-IN_PROC_BROWSER_TEST_F(
-    PrerenderOmniboxSearchSuggestionBrowserTest,
-    PrerenderFunctionsProperlyExportedWhenInitiatedByOmnibox) {
-  const GURL kInitialUrl = embedded_test_server()->GetURL("/empty.html");
-  ASSERT_TRUE(GetActiveWebContents());
-  ASSERT_TRUE(content::NavigateToURL(GetActiveWebContents(), kInitialUrl));
-  InitializePrerenderManager();
-  EXPECT_EQ(true,
-            EvalJs(GetActiveWebContents(), "document.prerendering === false"));
-  EXPECT_EQ(
-      0,
-      EvalJs(GetActiveWebContents(),
-             "performance.getEntriesByType('navigation')[0].activationStart"));
-  EXPECT_EQ(true, EvalJs(GetActiveWebContents(),
-                         "'onprerenderingchange' in document"));
-
-  SetNewUrlTemplate("/prerender/onprerendering_check.html");
-  GURL kPrerenderingUrl =
-      GetSearchSuggestionUrl("prerender222", /*is_prerender=*/true);
-  PrerenderQuery("prerender222", kPrerenderingUrl);
-
-  int host_id = prerender_helper().GetHostForUrl(kPrerenderingUrl);
-  content::RenderFrameHost* prerender_frame_host =
-      prerender_helper().GetPrerenderedMainFrameHost(host_id);
-  prerender_helper().WaitForPrerenderLoadCompletion(host_id);
-  EXPECT_EQ(true,
-            EvalJs(prerender_frame_host, "document.prerendering === true"));
-  EXPECT_EQ(
-      0,
-      EvalJs(prerender_frame_host,
-             "performance.getEntriesByType('navigation')[0].activationStart"));
-  EXPECT_EQ(true,
-            EvalJs(prerender_frame_host, "'onprerenderingchange' in document"));
-
-  NavigateToPrerenderedResult(kPrerenderingUrl);
-
-  EXPECT_EQ(true,
-            EvalJs(prerender_frame_host, "document.prerendering === false"));
-  EXPECT_LT(
-      0.0,
-      EvalJs(prerender_frame_host,
-             "performance.getEntriesByType('navigation')[0].activationStart")
-          .ExtractDouble());
-  EXPECT_EQ(true, EvalJs(prerender_frame_host,
-                         "onprerenderingchange_observed_promise"));
-}
-
 }  // namespace
diff --git a/chrome/browser/preloading/prerender/prerender_utils.cc b/chrome/browser/preloading/prerender/prerender_utils.cc
index 5a12b8a..55c6c695 100644
--- a/chrome/browser/preloading/prerender/prerender_utils.cc
+++ b/chrome/browser/preloading/prerender/prerender_utils.cc
@@ -18,14 +18,12 @@
 const char kDirectUrlInputMetricSuffix[] = "DirectURLInput";
 
 bool IsDirectUrlInputPrerenderEnabled() {
-  return blink::features::IsPrerender2Enabled() &&
-         base::FeatureList::IsEnabled(features::kOmniboxTriggerForPrerender2);
+  return base::FeatureList::IsEnabled(features::kOmniboxTriggerForPrerender2);
 }
 
 bool IsSearchSuggestionPrerenderEnabled() {
-  return blink::features::IsPrerender2Enabled() &&
-         base::FeatureList::IsEnabled(
-             features::kSupportSearchSuggestionForPrerender2);
+  return base::FeatureList::IsEnabled(
+      features::kSupportSearchSuggestionForPrerender2);
 }
 
 bool ShouldUpdateCacheEntryManually() {
diff --git a/chrome/browser/profiles/profile_testing_helper.h b/chrome/browser/profiles/profile_testing_helper.h
index 95b8de6..4a34c38 100644
--- a/chrome/browser/profiles/profile_testing_helper.h
+++ b/chrome/browser/profiles/profile_testing_helper.h
@@ -5,6 +5,7 @@
 #ifndef CHROME_BROWSER_PROFILES_PROFILE_TESTING_HELPER_H_
 #define CHROME_BROWSER_PROFILES_PROFILE_TESTING_HELPER_H_
 
+#include "base/memory/raw_ptr.h"
 #include "chrome/test/base/testing_profile_manager.h"
 #include "content/public/test/browser_task_environment.h"
 
@@ -46,15 +47,15 @@
   content::BrowserTaskEnvironment task_environment_;
   TestingProfileManager manager_;
 
-  TestingProfile* regular_profile_ = nullptr;
-  Profile* incognito_profile_ = nullptr;
+  raw_ptr<TestingProfile> regular_profile_ = nullptr;
+  raw_ptr<Profile> incognito_profile_ = nullptr;
 
-  TestingProfile* guest_profile_ = nullptr;
-  Profile* guest_profile_otr_ = nullptr;
+  raw_ptr<TestingProfile> guest_profile_ = nullptr;
+  raw_ptr<Profile> guest_profile_otr_ = nullptr;
 
 #if !BUILDFLAG(IS_CHROMEOS_ASH) && !BUILDFLAG(IS_ANDROID)
-  TestingProfile* system_profile_ = nullptr;
-  Profile* system_profile_otr_ = nullptr;
+  raw_ptr<TestingProfile> system_profile_ = nullptr;
+  raw_ptr<Profile> system_profile_otr_ = nullptr;
 #endif  // !BUILDFLAG(IS_CHROMEOS_ASH) && !BUILDFLAG(IS_ANDROID)
 
 #if BUILDFLAG(IS_CHROMEOS_ASH)
diff --git a/chrome/browser/resource_coordinator/tab_memory_metrics_reporter.h b/chrome/browser/resource_coordinator/tab_memory_metrics_reporter.h
index 8d92405..125af6c 100644
--- a/chrome/browser/resource_coordinator/tab_memory_metrics_reporter.h
+++ b/chrome/browser/resource_coordinator/tab_memory_metrics_reporter.h
@@ -8,6 +8,7 @@
 #include <set>
 
 #include "base/gtest_prod_util.h"
+#include "base/memory/raw_ptr.h"
 #include "base/time/time.h"
 #include "base/timer/timer.h"
 #include "chrome/browser/resource_coordinator/tab_load_tracker.h"
@@ -62,7 +63,7 @@
     base::TimeTicks page_loaded_time;
     base::TimeTicks next_emit_time;
     ReportState state;
-    content::WebContents* web_contents;
+    raw_ptr<content::WebContents> web_contents;
   };
 
   struct WebContentsDataComparator {
diff --git a/chrome/browser/resources/chromeos/accessibility/accessibility_common/BUILD.gn b/chrome/browser/resources/chromeos/accessibility/accessibility_common/BUILD.gn
index a5e2c45..756a96b 100644
--- a/chrome/browser/resources/chromeos/accessibility/accessibility_common/BUILD.gn
+++ b/chrome/browser/resources/chromeos/accessibility/accessibility_common/BUILD.gn
@@ -112,6 +112,7 @@
     "../common/rect_util.js",
     "../common/testing/accessibility_test_base.js",
     "../common/testing/callback_helper.js",
+    "../common/testing/common_e2e_test_base.js",
     "../common/testing/e2e_test_base.js",
     "../common/testing/mock_accessibility_private.js",
     "../common/testing/mock_input_ime.js",
diff --git a/chrome/browser/resources/chromeos/accessibility/accessibility_common/accessibility_common_test.js b/chrome/browser/resources/chromeos/accessibility/accessibility_common/accessibility_common_test.js
index 84717a9c1..77c55aff 100644
--- a/chrome/browser/resources/chromeos/accessibility/accessibility_common/accessibility_common_test.js
+++ b/chrome/browser/resources/chromeos/accessibility/accessibility_common/accessibility_common_test.js
@@ -2,43 +2,12 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-GEN_INCLUDE(['../common/testing/e2e_test_base.js']);
+GEN_INCLUDE(['../common/testing/common_e2e_test_base.js']);
 
 /**
  * Accessibility common extension browser tests.
  */
-AccessibilityCommonE2ETest = class extends E2ETestBase {
-  constructor() {
-    super();
-  }
-
-  /** @override */
-  testGenCppIncludes() {
-    super.testGenCppIncludes();
-    GEN(`
-#include "ash/accessibility/accessibility_delegate.h"
-#include "ash/shell.h"
-#include "base/bind.h"
-#include "base/callback.h"
-#include "chrome/browser/ash/accessibility/accessibility_manager.h"
-    `);
-  }
-
-  /** @override */
-  testGenPreamble() {
-    super.testGenPreamble();
-    // Note that at least one accessibility common feature has to be enabled for
-    // the extension to load. Extension load is required for this test suite to
-    // have a place to be injected.
-    GEN(`
-  base::OnceClosure load_cb =
-      base::BindOnce(&ash::AccessibilityManager::EnableAutoclick,
-          base::Unretained(ash::AccessibilityManager::Get()),
-          true);
-    `);
-    super.testGenPreambleCommon('kAccessibilityCommonExtensionId');
-  }
-
+AccessibilityCommonE2ETest = class extends CommonE2ETestBase {
   async getPref(name) {
     return new Promise(resolve => {
       chrome.settingsPrivate.getPref(name, ret => {
diff --git a/chrome/browser/resources/chromeos/accessibility/chromevox/BUILD.gn b/chrome/browser/resources/chromeos/accessibility/chromevox/BUILD.gn
index b390c791..adb3d150 100644
--- a/chrome/browser/resources/chromeos/accessibility/chromevox/BUILD.gn
+++ b/chrome/browser/resources/chromeos/accessibility/chromevox/BUILD.gn
@@ -21,7 +21,6 @@
 chromevox_modules = [
   "background/braille/cursor_dots.js",
   "background/braille/pan_strategy.js",
-  "common/extension_bridge.js",
   "injected/api_implementation.js",
   "injected/extension_bridge.js",
   "injected/loader.js",
@@ -127,9 +126,9 @@
   "common/bridge_helper.js",
   "common/command_store.js",
   "common/composite_tts.js",
+  "common/content_script_bridge.js",
   "common/custom_automation_event.js",
   "common/event_source_type.js",
-  "common/extension_bridge.js",
   "common/gesture_command_data.js",
   "common/key_map.js",
   "common/key_sequence.js",
diff --git a/chrome/browser/resources/chromeos/accessibility/chromevox/background/background.js b/chrome/browser/resources/chromeos/accessibility/chromevox/background/background.js
index 822e96c..76ecd46 100644
--- a/chrome/browser/resources/chromeos/accessibility/chromevox/background/background.js
+++ b/chrome/browser/resources/chromeos/accessibility/chromevox/background/background.js
@@ -10,7 +10,7 @@
 import {AbstractEarcons} from '../common/abstract_earcons.js';
 import {NavBraille} from '../common/braille/nav_braille.js';
 import {CompositeTts} from '../common/composite_tts.js';
-import {ExtensionBridge} from '../common/extension_bridge.js';
+import {ContentScriptBridge} from '../common/content_script_bridge.js';
 import {LocaleOutputHelper} from '../common/locale_output_helper.js';
 import {Msgs} from '../common/msgs.js';
 import {PanelCommand, PanelCommandType} from '../common/panel_command.js';
diff --git a/chrome/browser/resources/chromeos/accessibility/chromevox/background/classic_background.js b/chrome/browser/resources/chromeos/accessibility/chromevox/background/classic_background.js
index 9d0fb888..dfa2802 100644
--- a/chrome/browser/resources/chromeos/accessibility/chromevox/background/classic_background.js
+++ b/chrome/browser/resources/chromeos/accessibility/chromevox/background/classic_background.js
@@ -5,7 +5,7 @@
 /**
  * @fileoverview Script that runs on the background page.
  */
-import {ExtensionBridge} from '../common/extension_bridge.js';
+import {ContentScriptBridge} from '../common/content_script_bridge.js';
 import {QueueMode, TtsSpeechProperties} from '../common/tts_types.js';
 
 import {ChromeVox} from './chromevox.js';
@@ -71,7 +71,7 @@
    * messages to the proper destination.
    */
   addBridgeListener() {
-    ExtensionBridge.addMessageListener((msg, port) => {
+    ContentScriptBridge.addMessageListener((msg, port) => {
       if (msg['target'] !== 'TTS') {
         return;
       }
@@ -86,7 +86,7 @@
 
   /** Initializes classic background object. */
   static init() {
-    ExtensionBridge.init();
+    ContentScriptBridge.init();
     const background = new ChromeVoxBackground();
   }
 }
diff --git a/chrome/browser/resources/chromeos/accessibility/chromevox/common/extension_bridge.js b/chrome/browser/resources/chromeos/accessibility/chromevox/common/content_script_bridge.js
similarity index 73%
rename from chrome/browser/resources/chromeos/accessibility/chromevox/common/extension_bridge.js
rename to chrome/browser/resources/chromeos/accessibility/chromevox/common/content_script_bridge.js
index bb7a617..a5113724 100644
--- a/chrome/browser/resources/chromeos/accessibility/chromevox/common/extension_bridge.js
+++ b/chrome/browser/resources/chromeos/accessibility/chromevox/common/content_script_bridge.js
@@ -10,7 +10,7 @@
  * Messages can be any object that can be serialized using JSON.
  */
 
-export class ExtensionBridge {
+export class ContentScriptBridge {
   /** @private */
   constructor() {
     /** @private {!Array<!function(Object, Port)>} */
@@ -24,8 +24,8 @@
   }
 
   /**
-   * Initialize the extension bridge in a background page context by registering
-   * a listener for connections from the content script.
+   * Initialize the content script bridge by registering a listener for
+   * connections from the content script.
    * @private
    */
   init_() {
@@ -33,13 +33,10 @@
         port => this.onConnectHandler_(port));
   }
 
-  /**
-   * Initialize the extension bridge. Dynamically figure out whether we're in
-   * the background page, content script, or in a page, and call the
-   * corresponding function for more specific initialization.
-   */
+
+  /** Initialize the content script bridge. */
   static init() {
-    ExtensionBridge.instance = new ExtensionBridge();
+    ContentScriptBridge.instance = new ContentScriptBridge();
   }
 
   /**
@@ -51,7 +48,7 @@
    * @param {function(Object, Port)} listener The message listener.
    */
   static addMessageListener(listener) {
-    ExtensionBridge.instance.messageListeners_.push(listener);
+    ContentScriptBridge.instance.messageListeners_.push(listener);
   }
 
   /**
@@ -60,7 +57,7 @@
    * @private
    */
   onConnectHandler_(port) {
-    if (port.name !== ExtensionBridge.PORT_NAME) {
+    if (port.name !== ContentScriptBridge.PORT_NAME) {
       return;
     }
 
@@ -72,22 +69,6 @@
   }
 
   /**
-   * Listens for messages to the background page from a specific port.
-   * @param {Object} message
-   * @param {!Port} port
-   * @private
-   */
-  onMessage_(message, port) {
-    if (message[ExtensionBridge.PING_MSG]) {
-      const pongMessage = {[ExtensionBridge.PONG_MSG]: this.nextPongId_++};
-      port.postMessage(pongMessage);
-      return;
-    }
-
-    this.messageListeners_.forEach(listener => listener(message, port));
-  }
-
-  /**
    * Handles a specific port disconnecting.
    * @param {!Port} port
    * @private
@@ -100,10 +81,26 @@
       }
     }
   }
+
+  /**
+   * Listens for messages to the background page from a specific port.
+   * @param {Object} message
+   * @param {!Port} port
+   * @private
+   */
+  onMessage_(message, port) {
+    if (message[ContentScriptBridge.PING_MSG]) {
+      const pongMessage = {[ContentScriptBridge.PONG_MSG]: this.nextPongId_++};
+      port.postMessage(pongMessage);
+      return;
+    }
+
+    this.messageListeners_.forEach(listener => listener(message, port));
+  }
 }
 
-/** @private {ExtensionBridge} */
-ExtensionBridge.instance;
+/** @private {ContentScriptBridge} */
+ContentScriptBridge.instance;
 
 // Keep these constants in sync with injected/extension_bridge.js.
 
@@ -111,18 +108,18 @@
  * The name of the port between the content script and background page.
  * @const {string}
  */
-ExtensionBridge.PORT_NAME = 'ExtensionBridge.Port';
+ContentScriptBridge.PORT_NAME = 'ExtensionBridge.Port';
 
 /**
  * The name of the message between the content script and background to
  * see if they're connected.
  * @const {string}
  */
-ExtensionBridge.PING_MSG = 'ExtensionBridge.Ping';
+ContentScriptBridge.PING_MSG = 'ExtensionBridge.Ping';
 
 /**
  * The name of the message between the background and content script to
  * confirm that they're connected.
  * @const {string}
  */
-ExtensionBridge.PONG_MSG = 'ExtensionBridge.Pong';
+ContentScriptBridge.PONG_MSG = 'ExtensionBridge.Pong';
diff --git a/chrome/browser/resources/chromeos/accessibility/chromevox/injected/extension_bridge.js b/chrome/browser/resources/chromeos/accessibility/chromevox/injected/extension_bridge.js
index f0c02aa..afa94574 100644
--- a/chrome/browser/resources/chromeos/accessibility/chromevox/injected/extension_bridge.js
+++ b/chrome/browser/resources/chromeos/accessibility/chromevox/injected/extension_bridge.js
@@ -184,7 +184,7 @@
   }
 };
 
-// Keep these constants in sync with common/extension_bridge.js.
+// Keep these constants in sync with common/content_script_bridge.js.
 
 /**
  * The name of the port between the content script and background page.
diff --git a/chrome/browser/resources/chromeos/accessibility/chromevox/options/options.js b/chrome/browser/resources/chromeos/accessibility/chromevox/options/options.js
index 9126157..cbf63da 100644
--- a/chrome/browser/resources/chromeos/accessibility/chromevox/options/options.js
+++ b/chrome/browser/resources/chromeos/accessibility/chromevox/options/options.js
@@ -8,7 +8,7 @@
 import {constants} from '../../common/constants.js';
 import {BackgroundBridge} from '../common/background_bridge.js';
 import {BrailleTable} from '../common/braille/braille_table.js';
-import {ExtensionBridge} from '../common/extension_bridge.js';
+import {ContentScriptBridge} from '../common/content_script_bridge.js';
 import {Msgs} from '../common/msgs.js';
 import {PanelCommand, PanelCommandType} from '../common/panel_command.js';
 import {PunctuationEchoes, TtsSettings} from '../common/tts_types.js';
@@ -31,6 +31,7 @@
    * @this {OptionsPage}
    */
   static async init() {
+    ContentScriptBridge.init();
     OptionsPage.populateVoicesSelect();
     BrailleTable.getAll(function(tables) {
       /** @type {!Array<BrailleTable.Table>} */
@@ -158,7 +159,7 @@
       }
     });
 
-    ExtensionBridge.addMessageListener(function(message) {
+    ContentScriptBridge.addMessageListener(function(message) {
       if (message['prefs']) {
         OptionsPage.update();
       }
diff --git a/chrome/browser/resources/chromeos/accessibility/common/testing/common_e2e_test_base.js b/chrome/browser/resources/chromeos/accessibility/common/testing/common_e2e_test_base.js
new file mode 100644
index 0000000..9395b41
--- /dev/null
+++ b/chrome/browser/resources/chromeos/accessibility/common/testing/common_e2e_test_base.js
@@ -0,0 +1,38 @@
+// Copyright 2022 The Chromium Authors
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+GEN_INCLUDE(['e2e_test_base.js']);
+
+/**
+ * @fileoverview Test base used both by shared files (in common/) and the
+ * accessibility common extension (in accessibility_common/).
+ */
+CommonE2ETestBase = class extends E2ETestBase {
+  /** @override */
+  testGenCppIncludes() {
+    super.testGenCppIncludes();
+    GEN(`
+#include "ash/accessibility/accessibility_delegate.h"
+#include "ash/shell.h"
+#include "base/bind.h"
+#include "base/callback.h"
+#include "chrome/browser/ash/accessibility/accessibility_manager.h"
+    `);
+  }
+
+  /** @override */
+  testGenPreamble() {
+    super.testGenPreamble();
+    // Note that at least one accessibility common feature has to be enabled for
+    // the extension to load. Extension load is required for this test suite to
+    // have a place to be injected.
+    GEN(`
+  base::OnceClosure load_cb =
+      base::BindOnce(&ash::AccessibilityManager::EnableAutoclick,
+          base::Unretained(ash::AccessibilityManager::Get()),
+          true);
+    `);
+    super.testGenPreambleCommon('kAccessibilityCommonExtensionId');
+  }
+};
diff --git a/chrome/browser/resources/chromeos/cloud_upload/BUILD.gn b/chrome/browser/resources/chromeos/cloud_upload/BUILD.gn
index fb43087..0b7026e 100644
--- a/chrome/browser/resources/chromeos/cloud_upload/BUILD.gn
+++ b/chrome/browser/resources/chromeos/cloud_upload/BUILD.gn
@@ -22,6 +22,7 @@
     "file_handler_page.ts",
     "office_pwa_install_page.ts",
     "one_drive_upload_page.ts",
+    "sign_in_page.ts",
     "welcome_page.ts",
   ]
   non_web_component_files = [
diff --git a/chrome/browser/resources/chromeos/cloud_upload/base_setup_page.ts b/chrome/browser/resources/chromeos/cloud_upload/base_setup_page.ts
index 62d0b575..d3d75808 100644
--- a/chrome/browser/resources/chromeos/cloud_upload/base_setup_page.ts
+++ b/chrome/browser/resources/chromeos/cloud_upload/base_setup_page.ts
@@ -43,7 +43,7 @@
     super();
 
     const template = document.createElement('template');
-    template.innerHTML = getTemplate() as string;
+    template.innerHTML = getTemplate();
     this.attachShadow({mode: 'open'})
         .appendChild(template.content.cloneNode(true));
   }
diff --git a/chrome/browser/resources/chromeos/cloud_upload/cloud_upload_dialog.ts b/chrome/browser/resources/chromeos/cloud_upload/cloud_upload_dialog.ts
index a20ada5..454dbc3 100644
--- a/chrome/browser/resources/chromeos/cloud_upload/cloud_upload_dialog.ts
+++ b/chrome/browser/resources/chromeos/cloud_upload/cloud_upload_dialog.ts
@@ -9,6 +9,7 @@
 import {CloudUploadBrowserProxy} from './cloud_upload_browser_proxy.js';
 import {OfficePwaInstallPageElement} from './office_pwa_install_page.js';
 import {OneDriveUploadPageElement} from './one_drive_upload_page.js';
+import {SignInPageElement} from './sign_in_page.js';
 import {WelcomePageElement} from './welcome_page.js';
 
 /**
@@ -39,6 +40,7 @@
       this.processDialogArgs(),
       this.proxy.handler.isOfficePWAInstalled(),
     ]);
+    const odfsMounted = false;
 
     // TODO(b/251046341): Adjust this once the rest of the pages are in place.
     this.pages.push(new WelcomePageElement());
@@ -47,18 +49,21 @@
       this.pages.push(new OfficePwaInstallPageElement());
     }
 
+    if (!odfsMounted) {
+      this.pages.push(new SignInPageElement());
+    }
+
     const oneDriveUploadPage = new OneDriveUploadPageElement();
     oneDriveUploadPage.setFileNames(this.fileNames);
     this.pages.push(oneDriveUploadPage);
 
-    for (let i = 0; i < this.pages.length; i++) {
-      this.pages[i]?.setAttribute(
-          'total-pages', (this.pages.length).toString());
-      this.pages[i]?.setAttribute('page-number', i.toString());
-      this.pages[i]?.addEventListener(NEXT_PAGE_EVENT, () => this.goNextPage());
-      this.pages[i]?.addEventListener(
-          CANCEL_SETUP_EVENT, () => this.cancelSetup());
-    }
+    this.pages.forEach((page, index) => {
+      page.setAttribute('total-pages', String(this.pages.length));
+      page.setAttribute('page-number', String(index));
+      page.addEventListener(NEXT_PAGE_EVENT, () => this.goNextPage());
+      page.addEventListener(CANCEL_SETUP_EVENT, () => this.cancelSetup());
+    });
+
     this.switchPage(0);
   }
 
diff --git a/chrome/browser/resources/chromeos/cloud_upload/one_drive_upload_page.ts b/chrome/browser/resources/chromeos/cloud_upload/one_drive_upload_page.ts
index 961c44de..c38dcdf8 100644
--- a/chrome/browser/resources/chromeos/cloud_upload/one_drive_upload_page.ts
+++ b/chrome/browser/resources/chromeos/cloud_upload/one_drive_upload_page.ts
@@ -41,13 +41,15 @@
    * Initialises the page specific content inside the page.
    */
   connectedCallback(): void {
-    this.innerHTML = getTemplate() as string;
+    this.innerHTML = getTemplate();
     const fileContainerElement =
         this.querySelector('#file-container')! as HTMLElement;
     const fileNameElement = this.querySelector('#file-name')! as HTMLElement;
     const uploadButton = this.querySelector('.action-button')! as HTMLElement;
     const cancelButton = this.querySelector('.cancel-button') as HTMLElement;
 
+    this.proxy.handler.setOfficeAsDefaultHandler();
+
     // TODO(b/251046341): Show multiple files.
     if (this.fileNames.length > 0) {
       fileContainerElement.hidden = false;
diff --git a/chrome/browser/resources/chromeos/cloud_upload/sign_in_page.html b/chrome/browser/resources/chromeos/cloud_upload/sign_in_page.html
new file mode 100644
index 0000000..01ab8b0
--- /dev/null
+++ b/chrome/browser/resources/chromeos/cloud_upload/sign_in_page.html
@@ -0,0 +1,18 @@
+<!-- TODO(b/254586358): Use localized strings -->
+<div slot="title">
+  Connect to Microsoft OneDrive
+</div>
+<div slot="body">
+  <p>
+    To use Office files on your Chromebook, files need to be stored in
+    Microsoft OneDrive cloud storage. Office files will automatically
+    move to OneDrive when opening.
+  </p>
+  <p>
+    You'll need to sign in with your Microsoft account to connect to OneDrive.
+  </p>
+</div>
+<div slot="button-container">
+  <cr-button class="cancel-button">Cancel</cr-button>
+  <cr-button class="action-button">Connect to OneDrive</cr-button>
+</div>
diff --git a/chrome/browser/resources/chromeos/cloud_upload/sign_in_page.ts b/chrome/browser/resources/chromeos/cloud_upload/sign_in_page.ts
new file mode 100644
index 0000000..59fd486c
--- /dev/null
+++ b/chrome/browser/resources/chromeos/cloud_upload/sign_in_page.ts
@@ -0,0 +1,44 @@
+// Copyright 2022 The Chromium Authors
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+import 'chrome://resources/cr_elements/cr_button/cr_button.js';
+
+import {BaseSetupPageElement, CANCEL_SETUP_EVENT, NEXT_PAGE_EVENT} from './base_setup_page.js';
+import {getTemplate} from './sign_in_page.html.js';
+
+/**
+ * The SignInPageElement represents the page that prompts the user to connect to
+ * OneDrive.
+ */
+export class SignInPageElement extends BaseSetupPageElement {
+  /**
+   * Initialises the page specific content inside the page.
+   */
+  connectedCallback(): void {
+    this.innerHTML = getTemplate();
+    const connectButton = this.querySelector<HTMLElement>('.action-button')!;
+    const cancelButton = this.querySelector<HTMLElement>('.cancel-button')!;
+
+    connectButton.addEventListener('click', () => this.onConnectButtonClick());
+    cancelButton.addEventListener('click', () => this.onCancelButtonClick());
+  }
+
+  private onConnectButtonClick(): void {
+    this.dispatchEvent(
+        new CustomEvent(NEXT_PAGE_EVENT, {bubbles: true, composed: true}));
+  }
+
+  private onCancelButtonClick(): void {
+    this.dispatchEvent(
+        new CustomEvent(CANCEL_SETUP_EVENT, {bubbles: true, composed: true}));
+  }
+}
+
+declare global {
+  interface HTMLElementTagNameMap {
+    'sign-in-page': SignInPageElement;
+  }
+}
+
+customElements.define('sign-in-page', SignInPageElement);
diff --git a/chrome/browser/resources/chromeos/cloud_upload/welcome_page.ts b/chrome/browser/resources/chromeos/cloud_upload/welcome_page.ts
index 0877abd..f275560 100644
--- a/chrome/browser/resources/chromeos/cloud_upload/welcome_page.ts
+++ b/chrome/browser/resources/chromeos/cloud_upload/welcome_page.ts
@@ -16,7 +16,7 @@
   }
 
   connectedCallback() {
-    this.innerHTML = getTemplate() as string;
+    this.innerHTML = getTemplate();
 
     const actionButton = this.querySelector('.action-button') as HTMLElement;
     actionButton.addEventListener('click', this.onActionButtonClick);
diff --git a/chrome/browser/resources/password_manager/BUILD.gn b/chrome/browser/resources/password_manager/BUILD.gn
index 2fbe1e2..acb58e78 100644
--- a/chrome/browser/resources/password_manager/BUILD.gn
+++ b/chrome/browser/resources/password_manager/BUILD.gn
@@ -7,16 +7,17 @@
 build_webui("build") {
   grd_prefix = "password_manager"
   static_files = [
-    "password_manager.html",
-    "manifest.webmanifest",
-    "images/checkup_result_banner_error_dark.svg",
-    "images/checkup_result_banner_compromised_dark.svg",
-    "images/checkup_result_banner_running_dark.svg",
-    "images/checkup_result_banner_error.svg",
     "images/checkup_result_banner_compromised.svg",
-    "images/checkup_result_banner_running.svg",
-    "images/checkup_result_banner_ok_dark.svg",
+    "images/checkup_result_banner_compromised_dark.svg",
+    "images/checkup_result_banner_error.svg",
+    "images/checkup_result_banner_error_dark.svg",
     "images/checkup_result_banner_ok.svg",
+    "images/checkup_result_banner_ok_dark.svg",
+    "images/checkup_result_banner_running.svg",
+    "images/checkup_result_banner_running_dark.svg",
+    "images/password_manager_logo.svg",
+    "manifest.webmanifest",
+    "password_manager.html",
   ]
   web_component_files = [
     "checkup_section.ts",
diff --git a/chrome/browser/resources/password_manager/images/password_manager_logo.svg b/chrome/browser/resources/password_manager/images/password_manager_logo.svg
new file mode 100644
index 0000000..d1593d78
--- /dev/null
+++ b/chrome/browser/resources/password_manager/images/password_manager_logo.svg
@@ -0,0 +1 @@
+<svg width="151" height="151" viewBox="0 0 151 83" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M79.961 27.667C74.333 11.55 59.096 0 41.181 0 18.464 0 0 18.606 0 41.5S18.463 83 41.182 83c17.914 0 33.151-11.55 38.78-27.667h29.856V83h27.455V55.333H151V27.667H79.961Zm-38.78 27.666c-7.55 0-13.726-6.225-13.726-13.833 0-7.608 6.177-13.833 13.727-13.833 7.55 0 13.727 6.225 13.727 13.833 0 7.608-6.177 13.833-13.727 13.833Z" fill="#1A73E8"/></svg>
\ No newline at end of file
diff --git a/chrome/browser/resources/password_manager/manifest.webmanifest b/chrome/browser/resources/password_manager/manifest.webmanifest
index 7b11c7b2..20cca606 100644
--- a/chrome/browser/resources/password_manager/manifest.webmanifest
+++ b/chrome/browser/resources/password_manager/manifest.webmanifest
@@ -3,9 +3,9 @@
   "name": "Password Manager",
   "icons": [
     {
-      "src": "chrome://theme/current-channel-logo",
-      "type": "image/png",
-      "sizes": "32x32"
+      "src": "chrome://password-manager/images/password_manager_logo.svg",
+      "type": "image/svg+xml",
+      "sizes": "any"
     }
   ],
   "start_url": "/?source=pwa",
diff --git a/chrome/browser/safe_browsing/incident_reporting/state_store.h b/chrome/browser/safe_browsing/incident_reporting/state_store.h
index bd4f8b39..cd5f665 100644
--- a/chrome/browser/safe_browsing/incident_reporting/state_store.h
+++ b/chrome/browser/safe_browsing/incident_reporting/state_store.h
@@ -105,7 +105,7 @@
   raw_ptr<Profile> profile_;
 
   // A read-only view on the profile's incidents_sent preference.
-  const base::Value::Dict* incidents_sent_ = nullptr;
+  raw_ptr<const base::Value::Dict> incidents_sent_ = nullptr;
 
 #if DCHECK_IS_ON()
   // True when a Transaction instance is outstanding.
diff --git a/chrome/browser/safe_browsing/tailored_security/chrome_tailored_security_service_unittest.cc b/chrome/browser/safe_browsing/tailored_security/chrome_tailored_security_service_unittest.cc
index d393d780..1ea3ef98 100644
--- a/chrome/browser/safe_browsing/tailored_security/chrome_tailored_security_service_unittest.cc
+++ b/chrome/browser/safe_browsing/tailored_security/chrome_tailored_security_service_unittest.cc
@@ -5,6 +5,7 @@
 #include "chrome/browser/safe_browsing/tailored_security/chrome_tailored_security_service.h"
 
 #include "base/files/scoped_temp_dir.h"
+#include "base/memory/raw_ptr.h"
 #include "base/memory/scoped_refptr.h"
 #include "base/test/scoped_feature_list.h"
 #include "chrome/browser/prefs/browser_prefs.h"
@@ -195,7 +196,7 @@
   std::unique_ptr<IdentityTestEnvironmentProfileAdaptor>
       identity_test_env_adaptor_;
   TestingProfileManager profile_manager_;
-  TestingProfile* profile_;
+  raw_ptr<TestingProfile> profile_;
   std::unique_ptr<TestBrowserWindow> browser_window_;
   std::unique_ptr<Browser> browser_;
   std::unique_ptr<TestChromeTailoredSecurityService>
diff --git a/chrome/browser/search_resumption/search_resumption_module_bridge.h b/chrome/browser/search_resumption/search_resumption_module_bridge.h
index 64987ad2..27f754df 100644
--- a/chrome/browser/search_resumption/search_resumption_module_bridge.h
+++ b/chrome/browser/search_resumption/search_resumption_module_bridge.h
@@ -10,6 +10,7 @@
 
 #include "base/android/jni_android.h"
 #include "base/android/jni_string.h"
+#include "base/memory/raw_ptr.h"
 #include "base/memory/weak_ptr.h"
 #include "components/keyed_service/content/browser_context_keyed_service_factory.h"
 #include "components/search/start_suggest_service.h"
@@ -36,7 +37,7 @@
   ~SearchResumptionModuleBridge();
   void OnSuggestionsReceived(std::vector<QuerySuggestion> suggestions);
 
-  StartSuggestService* start_suggest_service_;
+  raw_ptr<StartSuggestService> start_suggest_service_;
   base::android::ScopedJavaGlobalRef<jobject> java_object_;
 
   const base::WeakPtrFactory<SearchResumptionModuleBridge> weak_ptr_factory_{
diff --git a/chrome/browser/supervised_user/android/favicon_fetcher_unittest.cc b/chrome/browser/supervised_user/android/favicon_fetcher_unittest.cc
index 6f033079..29e5914d 100644
--- a/chrome/browser/supervised_user/android/favicon_fetcher_unittest.cc
+++ b/chrome/browser/supervised_user/android/favicon_fetcher_unittest.cc
@@ -109,7 +109,7 @@
 
  protected:
   MockLargeIconService mock_large_icon_service_;
-  MockFaviconFetcher* favicon_fetcher_ =
+  raw_ptr<MockFaviconFetcher> favicon_fetcher_ =
       new MockFaviconFetcher(&mock_large_icon_service_);
 };
 
diff --git a/chrome/browser/supervised_user/kids_chrome_management/kids_management_service.h b/chrome/browser/supervised_user/kids_chrome_management/kids_management_service.h
index f5be2e97..1ad2a71 100644
--- a/chrome/browser/supervised_user/kids_chrome_management/kids_management_service.h
+++ b/chrome/browser/supervised_user/kids_chrome_management/kids_management_service.h
@@ -11,6 +11,7 @@
 
 #include "base/functional/callback.h"
 #include "base/functional/callback_forward.h"
+#include "base/memory/raw_ptr.h"
 #include "base/memory/raw_ref.h"
 #include "base/memory/scoped_refptr.h"
 #include "base/memory/singleton.h"
@@ -104,7 +105,8 @@
   void UpdateUserSignOutSetting();
 #endif
 
-  Profile* profile_;  // TODO(b/252793687): remove direct uses of the profile.
+  raw_ptr<Profile>
+      profile_;  // TODO(b/252793687): remove direct uses of the profile.
   const raw_ref<signin::IdentityManager> identity_manager_;
   const raw_ref<SupervisedUserService> supervised_user_service_;
   KidsProfileManager profile_manager_;
diff --git a/chrome/browser/supervised_user/kids_chrome_management/kids_management_service_unittest.cc b/chrome/browser/supervised_user/kids_chrome_management/kids_management_service_unittest.cc
index aaa09fd64..c4871e1 100644
--- a/chrome/browser/supervised_user/kids_chrome_management/kids_management_service_unittest.cc
+++ b/chrome/browser/supervised_user/kids_chrome_management/kids_management_service_unittest.cc
@@ -8,6 +8,7 @@
 #include <memory>
 #include <string>
 
+#include "base/memory/raw_ptr.h"
 #include "base/strings/string_piece_forward.h"
 #include "base/test/bind.h"
 #include "base/test/task_environment.h"
@@ -123,12 +124,12 @@
   network::TestURLLoaderFactory test_url_loader_factory_;
   std::unique_ptr<TestingProfile> profile_ =
       MakeTestingProfile(test_url_loader_factory_);
-  KidsManagementService* under_test_ =
+  raw_ptr<KidsManagementService> under_test_ =
       KidsManagementServiceFactory::GetForProfile(profile_.get());
   IdentityTestEnvironmentProfileAdaptor
       identity_test_environment_profile_adaptor_{
           profile_.get()};  // Must be owned by test fixture.
-  IdentityTestEnvironment* identity_test_environment{
+  raw_ptr<IdentityTestEnvironment> identity_test_environment{
       identity_test_environment_profile_adaptor_.identity_test_env()};
 };
 
diff --git a/chrome/browser/supervised_user/kids_chrome_management/kids_profile_manager.cc b/chrome/browser/supervised_user/kids_chrome_management/kids_profile_manager.cc
index 6bd406e..03ab33b 100644
--- a/chrome/browser/supervised_user/kids_chrome_management/kids_profile_manager.cc
+++ b/chrome/browser/supervised_user/kids_chrome_management/kids_profile_manager.cc
@@ -38,6 +38,8 @@
       pref_service_(pref_service),
       profile_(profile) {}
 
+KidsProfileManager::~KidsProfileManager() {}
+
 bool KidsProfileManager::IsChildAccount() const {
   return profile_
       ->IsChild();  // TODO(b/252793687): Use AccountInfo.is_child_account ==
@@ -82,6 +84,8 @@
       profileURL_(manager, profileURL_property_path),
       imageURL_(manager, imageURL_property_path) {}
 
+KidsProfileManager::Custodian::~Custodian() {}
+
 void KidsProfileManager::Custodian::Clear() {
   name_.Clear();
   email_.Clear();
diff --git a/chrome/browser/supervised_user/kids_chrome_management/kids_profile_manager.h b/chrome/browser/supervised_user/kids_chrome_management/kids_profile_manager.h
index ab95a28e..c28876b 100644
--- a/chrome/browser/supervised_user/kids_chrome_management/kids_profile_manager.h
+++ b/chrome/browser/supervised_user/kids_chrome_management/kids_profile_manager.h
@@ -5,6 +5,7 @@
 #ifndef CHROME_BROWSER_SUPERVISED_USER_KIDS_CHROME_MANAGEMENT_KIDS_PROFILE_MANAGER_H_
 #define CHROME_BROWSER_SUPERVISED_USER_KIDS_CHROME_MANAGEMENT_KIDS_PROFILE_MANAGER_H_
 
+#include "base/memory/raw_ptr.h"
 #include "base/memory/raw_ref.h"
 #include "base/strings/string_piece.h"
 #include "chrome/browser/profiles/profile.h"
@@ -25,7 +26,7 @@
     bool GetBool() const;
 
    private:
-    KidsProfileManager* manager_;
+    raw_ptr<KidsProfileManager> manager_;
     base::StringPiece property_path_;
   };
 
@@ -40,6 +41,7 @@
               base::StringPiece gaiaID_property_path,
               base::StringPiece profileURL_property_path,
               base::StringPiece imageURL_property_path);
+    ~Custodian();
     void Clear();
     void Update(const kids_chrome_management::FamilyMember& family_member);
 
@@ -55,6 +57,7 @@
   KidsProfileManager(PrefService& pref_service,
 
                      Profile& profile);
+  ~KidsProfileManager();
   void UpdateChildAccountStatus(bool is_child_account);
   bool IsChildAccountStatusKnown() const;
   bool IsChildAccount() const;
diff --git a/chrome/browser/support_tool/support_tool_util.cc b/chrome/browser/support_tool/support_tool_util.cc
index a499b19..08c3d6f0 100644
--- a/chrome/browser/support_tool/support_tool_util.cc
+++ b/chrome/browser/support_tool/support_tool_util.cc
@@ -13,6 +13,7 @@
 #include "build/chromeos_buildflags.h"
 #include "chrome/browser/feedback/system_logs/log_sources/chrome_internal_log_source.h"
 #include "chrome/browser/feedback/system_logs/log_sources/crash_ids_source.h"
+#include "chrome/browser/feedback/system_logs/log_sources/device_event_log_source.h"
 #include "chrome/browser/feedback/system_logs/log_sources/memory_details_log_source.h"
 #include "chrome/browser/support_tool/data_collection_module.pb.h"
 #include "chrome/browser/support_tool/policy_data_collector.h"
@@ -26,7 +27,6 @@
 #include "chrome/browser/ash/system_logs/connected_input_devices_log_source.h"
 #include "chrome/browser/ash/system_logs/crosapi_system_log_source.h"
 #include "chrome/browser/ash/system_logs/dbus_log_source.h"
-#include "chrome/browser/ash/system_logs/device_event_log_source.h"
 #include "chrome/browser/ash/system_logs/iwlwifi_dump_log_source.h"
 #include "chrome/browser/ash/system_logs/touch_log_source.h"
 #include "chrome/browser/ash/system_logs/traffic_counters_log_source.h"
@@ -48,13 +48,13 @@
 // Data collector types that can work on every platform.
 constexpr support_tool::DataCollectorType kDataCollectors[] = {
     support_tool::CHROME_INTERNAL, support_tool::CRASH_IDS,
-    support_tool::MEMORY_DETAILS, support_tool::POLICIES};
+    support_tool::MEMORY_DETAILS, support_tool::POLICIES,
+    support_tool::CHROMEOS_DEVICE_EVENT};
 
 // Data collector types can only work on Chrome OS Ash.
 constexpr support_tool::DataCollectorType kDataCollectorsChromeosAsh[] = {
     support_tool::CHROMEOS_UI_HIERARCHY,
     support_tool::CHROMEOS_COMMAND_LINE,
-    support_tool::CHROMEOS_DEVICE_EVENT,
     support_tool::CHROMEOS_IWL_WIFI_DUMP,
     support_tool::CHROMEOS_TOUCH_EVENTS,
     support_tool::CHROMEOS_DBUS,
@@ -117,6 +117,12 @@
         handler->AddDataCollector(
             std::make_unique<PolicyDataCollector>(profile));
         break;
+      case support_tool::CHROMEOS_DEVICE_EVENT:
+        handler->AddDataCollector(std::make_unique<
+                                  SystemLogSourceDataCollectorAdaptor>(
+            "Fetches entries for 'network_event_log' and 'device_event_log'.",
+            std::make_unique<system_logs::DeviceEventLogSource>()));
+        break;
 #if BUILDFLAG(IS_CHROMEOS_ASH)
       case support_tool::CHROMEOS_UI_HIERARCHY:
         handler->AddDataCollector(std::make_unique<UiHierarchyDataCollector>());
@@ -133,12 +139,6 @@
                 "audio_diagnostics, env, disk_usage.",
                 std::make_unique<system_logs::CommandLineLogSource>()));
         break;
-      case support_tool::CHROMEOS_DEVICE_EVENT:
-        handler->AddDataCollector(std::make_unique<
-                                  SystemLogSourceDataCollectorAdaptor>(
-            "Fetches entries for 'network_event_log' and 'device_event_log'.",
-            std::make_unique<system_logs::DeviceEventLogSource>()));
-        break;
       case support_tool::CHROMEOS_IWL_WIFI_DUMP:
         handler->AddDataCollector(std::make_unique<
                                   SystemLogSourceDataCollectorAdaptor>(
diff --git a/chrome/browser/sync_file_system/local/local_file_sync_service_unittest.cc b/chrome/browser/sync_file_system/local/local_file_sync_service_unittest.cc
index 54732693..55a5545 100644
--- a/chrome/browser/sync_file_system/local/local_file_sync_service_unittest.cc
+++ b/chrome/browser/sync_file_system/local/local_file_sync_service_unittest.cc
@@ -11,6 +11,7 @@
 #include "base/containers/contains.h"
 #include "base/files/file_util.h"
 #include "base/location.h"
+#include "base/memory/raw_ptr.h"
 #include "base/run_loop.h"
 #include "base/task/single_thread_task_runner.h"
 #include "base/task/thread_pool.h"
@@ -119,7 +120,7 @@
 
  private:
   SyncStatusCode status_;
-  std::vector<FileChange>* changes_;
+  raw_ptr<std::vector<FileChange>> changes_;
 };
 
 }  // namespace
diff --git a/chrome/browser/task_manager/task_manager_browsertest.cc b/chrome/browser/task_manager/task_manager_browsertest.cc
index eee77715..e26b1e8 100644
--- a/chrome/browser/task_manager/task_manager_browsertest.cc
+++ b/chrome/browser/task_manager/task_manager_browsertest.cc
@@ -1468,7 +1468,6 @@
     prerender_helper_ = std::make_unique<content::test::PrerenderTestHelper>(
         base::BindRepeating(&PrerenderTaskBrowserTest::GetActiveWebContents,
                             base::Unretained(this)));
-    EXPECT_TRUE(blink::features::IsPrerender2Enabled());
     feature_list_.InitWithFeaturesAndParameters(
         /*enabled_features=*/
         {
diff --git a/chrome/browser/ui/app_list/search/files/item_suggest_cache.h b/chrome/browser/ui/app_list/search/files/item_suggest_cache.h
index 391d6ce1..e2d68fd 100644
--- a/chrome/browser/ui/app_list/search/files/item_suggest_cache.h
+++ b/chrome/browser/ui/app_list/search/files/item_suggest_cache.h
@@ -7,6 +7,7 @@
 
 #include "base/callback_list.h"
 #include "base/feature_list.h"
+#include "base/memory/raw_ptr.h"
 #include "base/memory/scoped_refptr.h"
 #include "base/memory/weak_ptr.h"
 #include "base/metrics/field_trial_params.h"
@@ -167,7 +168,7 @@
   // List of callbacks to run when results are updated.
   OnResultsCallbackList on_results_callback_list_;
 
-  Profile* profile_;
+  raw_ptr<Profile> profile_;
   std::unique_ptr<signin::PrimaryAccountAccessTokenFetcher> token_fetcher_;
   scoped_refptr<network::SharedURLLoaderFactory> url_loader_factory_;
   std::unique_ptr<network::SimpleURLLoader> url_loader_;
diff --git a/chrome/browser/ui/bookmarks/recently_used_folders_combo_model.cc b/chrome/browser/ui/bookmarks/recently_used_folders_combo_model.cc
index 09cc679..80cb9ce 100644
--- a/chrome/browser/ui/bookmarks/recently_used_folders_combo_model.cc
+++ b/chrome/browser/ui/bookmarks/recently_used_folders_combo_model.cc
@@ -6,6 +6,7 @@
 
 #include <stddef.h>
 
+#include "base/memory/raw_ptr.h"
 #include "base/metrics/user_metrics.h"
 #include "base/observer_list.h"
 #include "base/ranges/algorithm.h"
@@ -37,7 +38,7 @@
 
   bool operator==(const Item& item) const;
 
-  const BookmarkNode* node;
+  raw_ptr<const BookmarkNode> node;
   Type type;
 };
 
@@ -229,7 +230,7 @@
 }
 
 const BookmarkNode* RecentlyUsedFoldersComboModel::GetNodeAt(size_t index) {
-  return (index < items_.size()) ? items_[index].node : nullptr;
+  return (index < items_.size()) ? items_[index].node.get() : nullptr;
 }
 
 void RecentlyUsedFoldersComboModel::RemoveNode(const BookmarkNode* node) {
diff --git a/chrome/browser/ui/fast_checkout/fast_checkout_controller_impl_unittest.cc b/chrome/browser/ui/fast_checkout/fast_checkout_controller_impl_unittest.cc
index 19f2485..95a6e91 100644
--- a/chrome/browser/ui/fast_checkout/fast_checkout_controller_impl_unittest.cc
+++ b/chrome/browser/ui/fast_checkout/fast_checkout_controller_impl_unittest.cc
@@ -5,6 +5,7 @@
 #include "chrome/browser/ui/fast_checkout/fast_checkout_controller_impl.h"
 #include <memory>
 
+#include "base/memory/raw_ptr.h"
 #include "chrome/browser/ui/fast_checkout/fast_checkout_view.h"
 #include "chrome/test/base/chrome_render_view_host_test_harness.h"
 #include "components/autofill/core/browser/autofill_test_utils.h"
@@ -53,7 +54,7 @@
   FastCheckoutView* GetOrCreateView() override { return view_; }
 
  private:
-  FastCheckoutView* view_;
+  raw_ptr<FastCheckoutView> view_;
 };
 
 }  // namespace
diff --git a/chrome/browser/ui/intent_picker_tab_helper.cc b/chrome/browser/ui/intent_picker_tab_helper.cc
index 152b1f74..d2c22d7 100644
--- a/chrome/browser/ui/intent_picker_tab_helper.cc
+++ b/chrome/browser/ui/intent_picker_tab_helper.cc
@@ -311,10 +311,7 @@
   if (!web_contents()) {
     return;
   }
-
   if (IsNavigatingToNewSite(navigation_handle)) {
-    ++commit_count_;
-
     bool is_valid_page = navigation_handle->GetURL().SchemeIsHTTPOrHTTPS() &&
                          !navigation_handle->IsErrorPage();
     if (is_valid_page) {
diff --git a/chrome/browser/ui/intent_picker_tab_helper.h b/chrome/browser/ui/intent_picker_tab_helper.h
index 771fe85..b294de1 100644
--- a/chrome/browser/ui/intent_picker_tab_helper.h
+++ b/chrome/browser/ui/intent_picker_tab_helper.h
@@ -62,8 +62,6 @@
                            std::vector<apps::IntentPickerAppInfo> apps,
                            IntentPickerIconLoaderCallback callback);
 
-  int commit_count() { return commit_count_; }
-
   // Sets a OnceClosure callback which will be called next time the icon is
   // updated. If include_latest_navigation is true, and the latest navigation
   // was finished, the callback is called immediately.
@@ -113,10 +111,6 @@
   // on this origin.
   bool show_expanded_chip_from_usage_ = false;
 
-  // Tracks the number of commits on this page, to allow for checking to make
-  // sure that asynchronous invocations do not cause a stale intent picker.
-  int commit_count_ = 0;
-
   // Contains the app ID of an app which can be opened through the intent
   // picker. This is only set when ShowIconForApps() is called with a single
   // app. Will be set to the empty string in all other cases (e.g. when there
diff --git a/chrome/browser/ui/startup/startup_browser_creator.h b/chrome/browser/ui/startup/startup_browser_creator.h
index 91f4239..9deab99 100644
--- a/chrome/browser/ui/startup/startup_browser_creator.h
+++ b/chrome/browser/ui/startup/startup_browser_creator.h
@@ -10,6 +10,7 @@
 
 #include "base/files/file_path.h"
 #include "base/gtest_prod_util.h"
+#include "base/memory/raw_ptr.h"
 #include "build/build_config.h"
 #include "build/chromeos_buildflags.h"
 #include "chrome/browser/prefs/session_startup_pref.h"
@@ -66,7 +67,7 @@
 // TODO(https://crbug.com/1150326): return a guest profile for the Guest mode
 // and return nullptr for kProfilePicker.
 struct StartupProfileInfo {
-  Profile* profile;
+  raw_ptr<Profile> profile;
   StartupProfileMode mode;
 };
 
diff --git a/chrome/browser/ui/tabs/tab_strip_model_unittest.cc b/chrome/browser/ui/tabs/tab_strip_model_unittest.cc
index 29b5655f..2092600 100644
--- a/chrome/browser/ui/tabs/tab_strip_model_unittest.cc
+++ b/chrome/browser/ui/tabs/tab_strip_model_unittest.cc
@@ -96,8 +96,8 @@
           TabStripModelObserverAction action)
         : dst_contents(dst_contents), dst_index(dst_index), action(action) {}
 
-    WebContents* src_contents = nullptr;
-    WebContents* dst_contents;
+    raw_ptr<WebContents> src_contents = nullptr;
+    raw_ptr<WebContents> dst_contents;
     absl::optional<size_t> src_index;
     absl::optional<size_t> dst_index;
     int change_reason = CHANGE_REASON_NONE;
diff --git a/chrome/browser/ui/views/apps/app_dialog/app_uninstall_dialog_view.cc b/chrome/browser/ui/views/apps/app_dialog/app_uninstall_dialog_view.cc
index 5ef48a6..965e006 100644
--- a/chrome/browser/ui/views/apps/app_dialog/app_uninstall_dialog_view.cc
+++ b/chrome/browser/ui/views/apps/app_dialog/app_uninstall_dialog_view.cc
@@ -8,6 +8,7 @@
 
 #include "base/bind.h"
 #include "base/feature_list.h"
+#include "base/memory/raw_ptr.h"
 #include "base/strings/string_util.h"
 #include "base/strings/utf_string_conversions.h"
 #include "build/chromeos_buildflags.h"
@@ -110,7 +111,7 @@
   views::Checkbox* checkbox() { return checkbox_; }
 
  private:
-  views::Checkbox* checkbox_;
+  raw_ptr<views::Checkbox> checkbox_;
   std::unique_ptr<CheckboxTargeter> checkbox_targeter_;
 };
 
diff --git a/chrome/browser/ui/views/autofill_assistant/password_change/apc_scrim_manager_impl_unittest.cc b/chrome/browser/ui/views/autofill_assistant/password_change/apc_scrim_manager_impl_unittest.cc
index 148a328..83c44e4 100644
--- a/chrome/browser/ui/views/autofill_assistant/password_change/apc_scrim_manager_impl_unittest.cc
+++ b/chrome/browser/ui/views/autofill_assistant/password_change/apc_scrim_manager_impl_unittest.cc
@@ -57,7 +57,7 @@
 
  private:
   std::unique_ptr<TestApcScrimManagerImpl> apc_scrim_manager_;
-  content::WebContents* web_contents_;
+  raw_ptr<content::WebContents> web_contents_;
 };
 
 TEST_F(ApcScrimManagerImplTest,
diff --git a/chrome/browser/ui/views/autofill_assistant/password_change/password_change_animated_icon.h b/chrome/browser/ui/views/autofill_assistant/password_change/password_change_animated_icon.h
index 5e28306f..8367281 100644
--- a/chrome/browser/ui/views/autofill_assistant/password_change/password_change_animated_icon.h
+++ b/chrome/browser/ui/views/autofill_assistant/password_change/password_change_animated_icon.h
@@ -6,6 +6,7 @@
 #define CHROME_BROWSER_UI_VIEWS_AUTOFILL_ASSISTANT_PASSWORD_CHANGE_PASSWORD_CHANGE_ANIMATED_ICON_H_
 
 #include "base/callback_forward.h"
+#include "base/memory/raw_ptr.h"
 #include "base/time/time.h"
 #include "components/autofill_assistant/browser/public/password_change/proto/actions.pb.h"
 #include "ui/gfx/animation/animation_delegate.h"
@@ -75,7 +76,7 @@
   bool animation_ended_ = true;
 
   // A raw pointer to the delegate for this icon that must outlive `this`.
-  Delegate* delegate_;
+  raw_ptr<Delegate> delegate_;
 };
 
 #endif  // CHROME_BROWSER_UI_VIEWS_AUTOFILL_ASSISTANT_PASSWORD_CHANGE_PASSWORD_CHANGE_ANIMATED_ICON_H_
diff --git a/chrome/browser/ui/views/bookmarks/bookmark_bubble_view_browsertest.cc b/chrome/browser/ui/views/bookmarks/bookmark_bubble_view_browsertest.cc
index 616e64db..a61e396 100644
--- a/chrome/browser/ui/views/bookmarks/bookmark_bubble_view_browsertest.cc
+++ b/chrome/browser/ui/views/bookmarks/bookmark_bubble_view_browsertest.cc
@@ -5,6 +5,7 @@
 #include "chrome/browser/ui/views/bookmarks/bookmark_bubble_view.h"
 
 #include "base/command_line.h"
+#include "base/memory/raw_ptr.h"
 #include "base/strings/utf_string_conversions.h"
 #include "base/test/scoped_feature_list.h"
 #include "build/build_config.h"
@@ -90,7 +91,7 @@
   }
 
  private:
-  commerce::MockShoppingService* mock_shopping_service_;
+  raw_ptr<commerce::MockShoppingService> mock_shopping_service_;
   base::test::ScopedFeatureList test_features_;
 };
 
diff --git a/chrome/browser/ui/views/extensions/extensions_toolbar_button.h b/chrome/browser/ui/views/extensions/extensions_toolbar_button.h
index ce2a1e4..5f34829a 100644
--- a/chrome/browser/ui/views/extensions/extensions_toolbar_button.h
+++ b/chrome/browser/ui/views/extensions/extensions_toolbar_button.h
@@ -58,7 +58,7 @@
   // This can be nullptr before ExtensionsTabbedMenu is fully rolled out.
   // TODO(crbug.com/1279986): Remove this disclaimer once ExtensionsTabbedMenu
   // is rolled out.
-  ExtensionsTabbedMenuCoordinator* extensions_tabbed_menu_coordinator_;
+  raw_ptr<ExtensionsTabbedMenuCoordinator> extensions_tabbed_menu_coordinator_;
 };
 
 #endif  // CHROME_BROWSER_UI_VIEWS_EXTENSIONS_EXTENSIONS_TOOLBAR_BUTTON_H_
diff --git a/chrome/browser/ui/views/extensions/extensions_toolbar_container_interactive_uitest.cc b/chrome/browser/ui/views/extensions/extensions_toolbar_container_interactive_uitest.cc
index 90a1f13..1f45f7c 100644
--- a/chrome/browser/ui/views/extensions/extensions_toolbar_container_interactive_uitest.cc
+++ b/chrome/browser/ui/views/extensions/extensions_toolbar_container_interactive_uitest.cc
@@ -921,7 +921,7 @@
  private:
   base::test::ScopedFeatureList scoped_feature_list_;
 
-  content::WebContents* web_contents_ = nullptr;
+  raw_ptr<content::WebContents> web_contents_ = nullptr;
 };
 
 // Tests that clicking the request access button grants one time access to the
diff --git a/chrome/browser/ui/views/frame/browser_view_layout_unittest.cc b/chrome/browser/ui/views/frame/browser_view_layout_unittest.cc
index 2e37167..0390c50 100644
--- a/chrome/browser/ui/views/frame/browser_view_layout_unittest.cc
+++ b/chrome/browser/ui/views/frame/browser_view_layout_unittest.cc
@@ -237,7 +237,7 @@
   }
 
  private:
-  BrowserViewLayout* layout_;
+  raw_ptr<BrowserViewLayout> layout_;
   raw_ptr<MockBrowserViewLayoutDelegate> delegate_;  // Owned by |layout_|.
   std::unique_ptr<views::View> browser_view_;
 
diff --git a/chrome/browser/ui/views/intent_picker_bubble_view_browsertest.cc b/chrome/browser/ui/views/intent_picker_bubble_view_browsertest.cc
index 033a806..35cafd9b 100644
--- a/chrome/browser/ui/views/intent_picker_bubble_view_browsertest.cc
+++ b/chrome/browser/ui/views/intent_picker_bubble_view_browsertest.cc
@@ -5,14 +5,12 @@
 #include <string>
 
 #include "base/bind.h"
-#include "base/run_loop.h"
 #include "base/test/scoped_feature_list.h"
 #include "build/build_config.h"
 #include "chrome/browser/apps/intent_helper/intent_picker_features.h"
 #include "chrome/browser/ui/browser.h"
 #include "chrome/browser/ui/browser_commands.h"
 #include "chrome/browser/ui/browser_list.h"
-#include "chrome/browser/ui/intent_picker_tab_helper.h"
 #include "chrome/browser/ui/tabs/tab_strip_model.h"
 #include "chrome/browser/ui/views/frame/browser_view.h"
 #include "chrome/browser/ui/views/frame/toolbar_button_provider.h"
@@ -43,29 +41,14 @@
     scoped_feature_list_.InitWithFeatures({}, disabled_features);
   }
 
-  template <typename Action>
-  void DoAndWaitForIntentPickerIconUpdate(Action action) {
-    base::RunLoop run_loop;
-    auto* tab_helper = IntentPickerTabHelper::FromWebContents(GetWebContents());
-    tab_helper->SetIconUpdateCallbackForTesting(run_loop.QuitClosure());
-    action();
-    run_loop.Run();
-  }
-
-  content::WebContents* OpenNewTab(const GURL& url) {
+  void OpenNewTab(const GURL& url) {
     chrome::NewTab(browser());
     content::WebContents* web_contents =
         browser()->tab_strip_model()->GetActiveWebContents();
-
-    DoAndWaitForIntentPickerIconUpdate(
-        [this] { NavigateToLaunchingPage(browser()); });
-    DoAndWaitForIntentPickerIconUpdate([this, url, web_contents] {
-      TestTabActionDoesNotOpenAppWindow(
-          url, base::BindOnce(&ClickLinkAndWait, web_contents, url,
-                              LinkTarget::SELF, GetParam()));
-    });
-
-    return web_contents;
+    NavigateToLaunchingPage(browser());
+    TestTabActionDoesNotOpenAppWindow(
+        url, base::BindOnce(&ClickLinkAndWait, web_contents, url,
+                            LinkTarget::SELF, GetParam()));
   }
 
   // Inserts an iframe in the main frame of |web_contents|.
@@ -83,10 +66,6 @@
         ->GetPageActionIconView(PageActionIconType::kIntentPicker);
   }
 
-  content::WebContents* GetWebContents() {
-    return browser()->tab_strip_model()->GetActiveWebContents();
-  }
-
   IntentPickerBubbleView* intent_picker_bubble() {
     return IntentPickerBubbleView::intent_picker_bubble();
   }
@@ -112,7 +91,7 @@
 // Tests that clicking a link from a tabbed browser to outside the scope of an
 // installed app does not show the intent picker.
 IN_PROC_BROWSER_TEST_P(IntentPickerBubbleViewBrowserTest,
-                       NavigationToOutOfScopeLinkDoesNotShowIntentPicker) {
+                       NavigationToOutofScopeLinkDoesNotShowIntentPicker) {
   InstallTestWebApp();
 
   const GURL out_of_scope_url =
@@ -120,8 +99,9 @@
   NavigateToLaunchingPage(browser());
   TestTabActionDoesNotOpenAppWindow(
       out_of_scope_url,
-      base::BindOnce(&ClickLinkAndWait, GetWebContents(), out_of_scope_url,
-                     LinkTarget::SELF, GetParam()));
+      base::BindOnce(&ClickLinkAndWait,
+                     browser()->tab_strip_model()->GetActiveWebContents(),
+                     out_of_scope_url, LinkTarget::SELF, GetParam()));
 
   EXPECT_EQ(nullptr, intent_picker_bubble());
 }
@@ -136,25 +116,23 @@
 
   const GURL in_scope_url =
       https_server().GetURL(GetAppUrlHost(), GetInScopeUrlPath());
-  auto* tab_helper = IntentPickerTabHelper::FromWebContents(GetWebContents());
+  content::WebContents* web_contents =
+      browser()->tab_strip_model()->GetActiveWebContents();
   NavigateToLaunchingPage(browser());
 
   views::NamedWidgetShownWaiter waiter(views::test::AnyWidgetTestPasskey{},
                                        "IntentPickerBubbleView");
-  base::RunLoop run_loop;
-  tab_helper->SetIconUpdateCallbackForTesting(run_loop.QuitClosure());
   TestTabActionDoesNotOpenAppWindow(
-      in_scope_url, base::BindOnce(&ClickLinkAndWait, GetWebContents(),
+      in_scope_url, base::BindOnce(&ClickLinkAndWait, web_contents,
                                    in_scope_url, LinkTarget::SELF, GetParam()));
-  run_loop.Run();
 
-  PageActionIconView* intent_picker_icon = GetIntentPickerIcon();
-  EXPECT_TRUE(intent_picker_icon->GetVisible());
+  PageActionIconView* intent_picker_view = GetIntentPickerIcon();
+  EXPECT_TRUE(intent_picker_view->GetVisible());
 
 #if !BUILDFLAG(IS_CHROMEOS)
-  // On ChromeOS, the picker bubble will appear automatically.
+  // On Chrome OS, the picker bubble will appear automatically.
   EXPECT_FALSE(intent_picker_bubble());
-  intent_picker_icon->ExecuteForTesting();
+  GetIntentPickerIcon()->ExecuteForTesting();
 #endif
 
   waiter.WaitIfNeededAndGet();
@@ -210,7 +188,7 @@
 #endif  // BUILDFLAG(IS_CHROMEOS)
 #endif  // !BUILDFLAG(IS_CHROMEOS_LACROS)
 
-// Tests that the intent icon updates its visibility when switching between
+// Tests that the intent icon updates its visibiliy when switching between
 // tabs.
 IN_PROC_BROWSER_TEST_P(IntentPickerBubbleViewBrowserTest,
                        IconVisibilityAfterTabSwitching) {
@@ -221,18 +199,19 @@
   const GURL out_of_scope_url =
       https_server().GetURL(GetAppUrlHost(), GetOutOfScopeUrlPath());
 
-  PageActionIconView* intent_picker_icon = GetIntentPickerIcon();
+  PageActionIconView* intent_picker_view = GetIntentPickerIcon();
 
   // OpenNewTab opens a new tab and focus on the new tab.
   OpenNewTab(in_scope_url);
-  EXPECT_TRUE(intent_picker_icon->GetVisible());
+  EXPECT_TRUE(intent_picker_view->GetVisible());
   OpenNewTab(out_of_scope_url);
-  EXPECT_FALSE(intent_picker_icon->GetVisible());
+  EXPECT_FALSE(intent_picker_view->GetVisible());
 
   chrome::SelectPreviousTab(browser());
-  EXPECT_TRUE(intent_picker_icon->GetVisible());
+  EXPECT_TRUE(intent_picker_view->GetVisible());
+
   chrome::SelectNextTab(browser());
-  EXPECT_FALSE(intent_picker_icon->GetVisible());
+  EXPECT_FALSE(intent_picker_view->GetVisible());
 }
 
 // Tests that the navigation in iframe doesn't affect intent picker icon
@@ -245,25 +224,29 @@
   const GURL out_of_scope_url =
       https_server().GetURL(GetAppUrlHost(), GetOutOfScopeUrlPath());
 
-  PageActionIconView* intent_picker_icon = GetIntentPickerIcon();
+  PageActionIconView* intent_picker_view = GetIntentPickerIcon();
 
-  content::WebContents* initial_tab = OpenNewTab(out_of_scope_url);
+  OpenNewTab(out_of_scope_url);
+  content::WebContents* initial_tab =
+      browser()->tab_strip_model()->GetActiveWebContents();
   ASSERT_TRUE(InsertIFrame(initial_tab));
 
   EXPECT_TRUE(
       content::NavigateIframeToURL(initial_tab, "iframe", in_scope_url));
-  EXPECT_FALSE(intent_picker_icon->GetVisible());
+  EXPECT_FALSE(intent_picker_view->GetVisible());
 
-  content::WebContents* new_tab = OpenNewTab(in_scope_url);
+  OpenNewTab(in_scope_url);
+  content::WebContents* new_tab =
+      browser()->tab_strip_model()->GetActiveWebContents();
   ASSERT_TRUE(InsertIFrame(new_tab));
 
   EXPECT_TRUE(
       content::NavigateIframeToURL(initial_tab, "iframe", out_of_scope_url));
-  EXPECT_TRUE(intent_picker_icon->GetVisible());
+  EXPECT_TRUE(intent_picker_view->GetVisible());
 }
 
-// Tests that the intent picker icon is not visible if the navigation redirects
-// to a URL that doesn't have an installed PWA.
+// Tests that the intent picker icon is not visible if the navigatation
+// redirects to a URL that doesn't have an installed PWA.
 IN_PROC_BROWSER_TEST_P(IntentPickerBubbleViewBrowserTest,
                        DoesNotShowIntentPickerWhenRedirectedOutOfScope) {
   InstallTestWebApp(GetOtherAppUrlHost(), /*app_scope=*/"/");
@@ -274,16 +257,15 @@
   const GURL redirect_url = https_server().GetURL(
       GetOtherAppUrlHost(), CreateServerRedirect(out_of_scope_url));
 
-  PageActionIconView* intent_picker_icon = GetIntentPickerIcon();
+  PageActionIconView* intent_picker_view = GetIntentPickerIcon();
 
   OpenNewTab(in_scope_url);
-  EXPECT_TRUE(intent_picker_icon->GetVisible());
+  EXPECT_TRUE(intent_picker_view->GetVisible());
 
-  DoAndWaitForIntentPickerIconUpdate([this, redirect_url, out_of_scope_url] {
-    ClickLinkAndWaitForURL(GetWebContents(), redirect_url, out_of_scope_url,
-                           LinkTarget::SELF, GetParam());
-  });
-  EXPECT_FALSE(intent_picker_icon->GetVisible());
+  ClickLinkAndWaitForURL(browser()->tab_strip_model()->GetActiveWebContents(),
+                         redirect_url, out_of_scope_url, LinkTarget::SELF,
+                         GetParam());
+  EXPECT_FALSE(intent_picker_view->GetVisible());
 }
 
 INSTANTIATE_TEST_SUITE_P(
@@ -320,6 +302,10 @@
     return prerender_helper_;
   }
 
+  content::WebContents* GetWebContents() {
+    return browser()->tab_strip_model()->GetActiveWebContents();
+  }
+
  private:
   content::test::PrerenderTestHelper prerender_helper_;
 };
@@ -328,12 +314,12 @@
                        PrerenderingShouldNotShowIntentPicker) {
   InstallTestWebApp();
 
+  PageActionIconView* intent_picker_view = GetIntentPickerIcon();
+
   const GURL initial_url =
       https_server().GetURL(GetAppUrlHost(), "/empty.html");
   OpenNewTab(initial_url);
-
-  PageActionIconView* intent_picker_icon = GetIntentPickerIcon();
-  EXPECT_FALSE(intent_picker_icon->GetVisible());
+  EXPECT_FALSE(intent_picker_view->GetVisible());
 
   // Load a prerender page and prerendering should not try to show the
   // intent picker.
@@ -343,17 +329,15 @@
   content::test::PrerenderHostObserver host_observer(*GetWebContents(),
                                                      host_id);
   EXPECT_FALSE(host_observer.was_activated());
-  EXPECT_FALSE(intent_picker_icon->GetVisible());
+  EXPECT_FALSE(intent_picker_view->GetVisible());
 
   // Activate the prerender page.
-  DoAndWaitForIntentPickerIconUpdate([this, prerender_url] {
-    prerender_test_helper().NavigatePrimaryPage(prerender_url);
-  });
+  prerender_test_helper().NavigatePrimaryPage(prerender_url);
   EXPECT_TRUE(host_observer.was_activated());
 
   // After activation, IntentPickerTabHelper should show the
   // intent picker.
-  EXPECT_TRUE(intent_picker_icon->GetVisible());
+  EXPECT_TRUE(intent_picker_view->GetVisible());
 }
 
 INSTANTIATE_TEST_SUITE_P(
@@ -384,20 +368,24 @@
                        ShouldShowIntentPickerInFencedFrame) {
   InstallTestWebApp();
 
-  PageActionIconView* intent_picker_icon = GetIntentPickerIcon();
+  PageActionIconView* intent_picker_view = GetIntentPickerIcon();
 
   const GURL initial_url =
       https_server().GetURL(GetAppUrlHost(), "/empty.html");
   OpenNewTab(initial_url);
-  EXPECT_FALSE(intent_picker_icon->GetVisible());
+  EXPECT_FALSE(intent_picker_view->GetVisible());
 
   const GURL fenced_frame_url = https_server().GetURL(
       GetAppUrlHost(), std::string(GetAppScopePath()) + "index1.html");
   // Create a fenced frame.
-  ASSERT_TRUE(fenced_frame_test_helper().CreateFencedFrame(
-      GetWebContents()->GetPrimaryMainFrame(), fenced_frame_url));
+  ASSERT_TRUE(
+      fenced_frame_test_helper().CreateFencedFrame(browser()
+                                                       ->tab_strip_model()
+                                                       ->GetActiveWebContents()
+                                                       ->GetPrimaryMainFrame(),
+                                                   fenced_frame_url));
 
-  EXPECT_FALSE(intent_picker_icon->GetVisible());
+  EXPECT_FALSE(intent_picker_view->GetVisible());
 }
 
 INSTANTIATE_TEST_SUITE_P(
diff --git a/chrome/browser/ui/views/intent_picker_bubble_view_browsertest_chromeos.cc b/chrome/browser/ui/views/intent_picker_bubble_view_browsertest_chromeos.cc
index b48f72c..befdd18 100644
--- a/chrome/browser/ui/views/intent_picker_bubble_view_browsertest_chromeos.cc
+++ b/chrome/browser/ui/views/intent_picker_bubble_view_browsertest_chromeos.cc
@@ -30,7 +30,6 @@
 #include "chrome/browser/ui/browser_list_observer.h"
 #include "chrome/browser/ui/browser_navigator.h"
 #include "chrome/browser/ui/browser_navigator_params.h"
-#include "chrome/browser/ui/intent_picker_tab_helper.h"
 #include "chrome/browser/ui/views/frame/browser_view.h"
 #include "chrome/browser/ui/views/frame/toolbar_button_provider.h"
 #include "chrome/browser/ui/views/location_bar/intent_picker_view.h"
@@ -348,19 +347,6 @@
     return embedded_test_server()->GetURL("/web_apps/minimal_ui/basic.html");
   }
 
-  content::WebContents* GetWebContents() {
-    return browser()->tab_strip_model()->GetActiveWebContents();
-  }
-
-  template <typename Action>
-  void DoAndWaitForIntentPickerIconUpdate(Action action) {
-    base::RunLoop run_loop;
-    auto* tab_helper = IntentPickerTabHelper::FromWebContents(GetWebContents());
-    tab_helper->SetIconUpdateCallbackForTesting(run_loop.QuitClosure());
-    action();
-    run_loop.Run();
-  }
-
  private:
   base::test::ScopedFeatureList feature_list_;
   apps::AppServiceProxy* app_service_proxy_ = nullptr;
@@ -418,10 +404,14 @@
   // Launch the default selected app.
   EXPECT_EQ(0U, launched_arc_apps().size());
 
-  DoAndWaitForIntentPickerIconUpdate([this, app_name, test_url] {
-    intent_picker_bubble()->AcceptDialog();
-    ASSERT_NO_FATAL_FAILURE(VerifyArcAppLaunched(app_name, test_url));
-  });
+  content::TestNavigationObserver observer(
+      browser()->tab_strip_model()->GetActiveWebContents());
+
+  intent_picker_bubble()->AcceptDialog();
+  ASSERT_NO_FATAL_FAILURE(VerifyArcAppLaunched(app_name, test_url));
+
+  // The page should go back to blank state after launching the app.
+  observer.WaitForNavigationFinished();
 
   // Make sure that the intent picker icon is no longer visible.
   ASSERT_TRUE(intent_picker_view);
@@ -754,12 +744,12 @@
   NavigateParams params(browser(), test_url,
                         ui::PageTransition::PAGE_TRANSITION_LINK);
 
-  // Navigates and waits for loading to finish.
   views::NamedWidgetShownWaiter waiter(views::test::AnyWidgetTestPasskey{},
                                        IntentPickerBubbleView::kViewClassName);
+  // Navigates and waits for loading to finish.
   ui_test_utils::NavigateToURL(&params);
-  waiter.WaitIfNeededAndGet();
 
+  waiter.WaitIfNeededAndGet();
   EXPECT_TRUE(intent_picker_view->GetVisible());
   ASSERT_TRUE(intent_picker_bubble());
   EXPECT_TRUE(intent_picker_bubble()->GetVisible());
@@ -772,12 +762,11 @@
 
   content::WebContents* web_contents =
       browser()->tab_strip_model()->GetActiveWebContents();
-  DoAndWaitForIntentPickerIconUpdate([web_contents] {
-    ASSERT_TRUE(content::ExecuteScript(
-        web_contents,
-        "document.getElementById('push_to_new_url_button').click();"));
-  });
-
+  content::TestNavigationObserver observer(web_contents);
+  ASSERT_TRUE(content::ExecuteScript(
+      web_contents,
+      "document.getElementById('push_to_new_url_button').click();"));
+  observer.WaitForNavigationFinished();
   EXPECT_FALSE(intent_picker_view->GetVisible());
 }
 
@@ -805,9 +794,11 @@
   auto app_id = AddArcAppWithIntentFilter(app_name, test_url);
 
   // Reload the page and the intent picker should show up.
-  DoAndWaitForIntentPickerIconUpdate([this] {
-    chrome::Reload(browser(), WindowOpenDisposition::CURRENT_TAB);
-  });
+  content::WebContents* web_contents =
+      browser()->tab_strip_model()->GetActiveWebContents();
+  content::TestNavigationObserver observer(web_contents);
+  chrome::Reload(browser(), WindowOpenDisposition::CURRENT_TAB);
+  observer.WaitForNavigationFinished();
 
   EXPECT_TRUE(intent_picker_view->GetVisible());
 
diff --git a/chrome/browser/ui/views/layout/interpolating_layout_manager.h b/chrome/browser/ui/views/layout/interpolating_layout_manager.h
index 420e6261..61b2246 100644
--- a/chrome/browser/ui/views/layout/interpolating_layout_manager.h
+++ b/chrome/browser/ui/views/layout/interpolating_layout_manager.h
@@ -95,8 +95,8 @@
   // Describes an interpolation between two layouts as a pointer to each and
   // a percentage of distance between them to interpolate linearly to.
   struct LayoutInterpolation {
-    LayoutManagerBase* first = nullptr;
-    LayoutManagerBase* second = nullptr;
+    raw_ptr<LayoutManagerBase> first = nullptr;
+    raw_ptr<LayoutManagerBase> second = nullptr;
 
     // The closer this number is to zero, the more of |first| is used; the
     // closer to 1.0f, the more of |second|. If the value is 0, |second| may be
diff --git a/chrome/browser/ui/views/location_bar/intent_chip_button_browsertest.cc b/chrome/browser/ui/views/location_bar/intent_chip_button_browsertest.cc
index 09adc730..776b8d13 100644
--- a/chrome/browser/ui/views/location_bar/intent_chip_button_browsertest.cc
+++ b/chrome/browser/ui/views/location_bar/intent_chip_button_browsertest.cc
@@ -100,23 +100,12 @@
     web_app::WebAppNavigationBrowserTest::TearDownOnMainThread();
   }
 
-  template <typename Action>
-  void DoAndWaitForIntentPickerIconUpdate(Action action) {
-    content::WebContents* web_contents =
-        browser()->tab_strip_model()->GetActiveWebContents();
-    base::RunLoop run_loop;
-    auto* tab_helper = IntentPickerTabHelper::FromWebContents(web_contents);
-    tab_helper->SetIconUpdateCallbackForTesting(run_loop.QuitClosure());
-    action();
-    run_loop.Run();
-  }
-
   void OpenNewTab(const GURL& url) {
     chrome::NewTab(browser());
-    DoAndWaitForIntentPickerIconUpdate(
-        [this] { NavigateToLaunchingPage(browser()); });
-    ClickLinkAndWaitForIconUpdate(
-        browser()->tab_strip_model()->GetActiveWebContents(), url);
+    content::WebContents* web_contents =
+        browser()->tab_strip_model()->GetActiveWebContents();
+    NavigateToLaunchingPage(browser());
+    ClickLinkAndWait(web_contents, url, LinkTarget::SELF, "");
   }
 
   IntentChipButton* GetIntentChip() {
@@ -132,16 +121,6 @@
     test_api.NotifyClick(e);
   }
 
-  void ClickLinkAndWaitForIconUpdate(content::WebContents* web_contents,
-                                     const GURL& link_url) {
-    auto* tab_helper = IntentPickerTabHelper::FromWebContents(web_contents);
-
-    base::RunLoop run_loop;
-    tab_helper->SetIconUpdateCallbackForTesting(run_loop.QuitClosure());
-    ClickLinkAndWait(web_contents, link_url, LinkTarget::SELF, "");
-    run_loop.Run();
-  }
-
   // Installs a web app on the same host as InstallTestWebApp(), but with "/" as
   // a scope, so it overlaps with all URLs in the test app scope.
   void InstallOverlappingApp() {
@@ -205,6 +184,7 @@
 
   chrome::SelectPreviousTab(browser());
   EXPECT_TRUE(intent_chip_button->GetVisible());
+
   chrome::SelectNextTab(browser());
   EXPECT_FALSE(intent_chip_button->GetVisible());
 }
@@ -219,11 +199,9 @@
       https_server().GetURL(GetAppUrlHost(), GetInScopeUrlPath());
   ASSERT_TRUE(ui_test_utils::NavigateToURL(browser(), in_scope_url));
 
-  ui_test_utils::BrowserChangeObserver new_browser(
-      nullptr, ui_test_utils::BrowserChangeObserver::ChangeType::kAdded);
   ClickIntentChip();
-  Browser* app_browser = new_browser.Wait();
 
+  Browser* app_browser = BrowserList::GetInstance()->GetLastActive();
   EXPECT_TRUE(web_app::AppBrowserController::IsForWebApp(app_browser,
                                                          test_web_app_id()));
 }
@@ -269,11 +247,9 @@
       https_server().GetURL(GetAppUrlHost(), GetInScopeUrlPath());
   ASSERT_TRUE(ui_test_utils::NavigateToURL(browser(), in_scope_url));
 
-  ui_test_utils::BrowserChangeObserver new_browser(
-      nullptr, ui_test_utils::BrowserChangeObserver::ChangeType::kAdded);
   ClickIntentChip();
-  Browser* app_browser = new_browser.Wait();
 
+  Browser* app_browser = BrowserList::GetInstance()->GetLastActive();
   EXPECT_TRUE(web_app::AppBrowserController::IsForWebApp(app_browser,
                                                          test_web_app_id()));
 }
@@ -322,31 +298,31 @@
       browser()->tab_strip_model()->GetActiveWebContents();
 
   // 1st appearance: Expanded.
-  ClickLinkAndWaitForIconUpdate(web_contents, in_scope_url);
+  ClickLinkAndWait(web_contents, in_scope_url, LinkTarget::SELF, "");
   EXPECT_TRUE(GetIntentChip()->GetVisible());
   EXPECT_FALSE(GetIntentChip()->is_fully_collapsed());
 
-  ClickLinkAndWaitForIconUpdate(web_contents, separate_host_url);
+  ClickLinkAndWait(web_contents, separate_host_url, LinkTarget::SELF, "");
   EXPECT_FALSE(GetIntentChip()->GetVisible());
 
   // 2nd appearance: Expanded.
-  ClickLinkAndWaitForIconUpdate(web_contents, in_scope_url);
+  ClickLinkAndWait(web_contents, in_scope_url, LinkTarget::SELF, "");
   EXPECT_TRUE(GetIntentChip()->GetVisible());
   EXPECT_FALSE(GetIntentChip()->is_fully_collapsed());
 
-  ClickLinkAndWaitForIconUpdate(web_contents, out_of_scope_url);
+  ClickLinkAndWait(web_contents, out_of_scope_url, LinkTarget::SELF, "");
   EXPECT_FALSE(GetIntentChip()->GetVisible());
 
   // 3rd appearance: Expanded.
-  ClickLinkAndWaitForIconUpdate(web_contents, in_scope_url);
+  ClickLinkAndWait(web_contents, in_scope_url, LinkTarget::SELF, "");
   EXPECT_TRUE(GetIntentChip()->GetVisible());
   EXPECT_FALSE(GetIntentChip()->is_fully_collapsed());
 
-  ClickLinkAndWaitForIconUpdate(web_contents, out_of_scope_url);
+  ClickLinkAndWait(web_contents, out_of_scope_url, LinkTarget::SELF, "");
   EXPECT_FALSE(GetIntentChip()->GetVisible());
 
   // 4th appearance: Collapsed.
-  ClickLinkAndWaitForIconUpdate(web_contents, in_scope_url);
+  ClickLinkAndWait(web_contents, in_scope_url, LinkTarget::SELF, "");
   EXPECT_TRUE(GetIntentChip()->GetVisible());
   EXPECT_TRUE(GetIntentChip()->is_fully_collapsed());
 
@@ -354,12 +330,11 @@
   ClickIntentChip();
 
   // Open another browser- we should be able to see the expanded chip again.
-  DoAndWaitForIntentPickerIconUpdate(
-      [this] { NavigateToLaunchingPage(browser()); });
+  NavigateToLaunchingPage(browser());
+  web_contents = browser()->tab_strip_model()->GetActiveWebContents();
 
   // 1st appearance since intent chip counter reset: Expanded.
-  web_contents = browser()->tab_strip_model()->GetActiveWebContents();
-  ClickLinkAndWaitForIconUpdate(web_contents, in_scope_url);
+  ClickLinkAndWait(web_contents, in_scope_url, LinkTarget::SELF, "");
   EXPECT_TRUE(GetIntentChip()->GetVisible());
   EXPECT_FALSE(GetIntentChip()->is_fully_collapsed());
 }
@@ -405,7 +380,7 @@
       browser()->tab_strip_model()->GetActiveWebContents();
 
   // Navigate to an in-scope page to see the intent chip and the IPH.
-  ClickLinkAndWaitForIconUpdate(web_contents, in_scope_url);
+  ClickLinkAndWait(web_contents, in_scope_url, LinkTarget::SELF, "");
   EXPECT_TRUE(GetIntentChip()->GetVisible());
 
   // Wait for the chip to actually be laid out. This will result in the IPH
@@ -432,6 +407,18 @@
     feature_list_.InitAndEnableFeature(apps::features::kIntentChipAppIcon);
   }
 
+  void ClickLinkAndWaitForIconUpdate(content::WebContents* web_contents,
+                                     const GURL& link_url) {
+    auto* tab_helper = IntentPickerTabHelper::FromWebContents(web_contents);
+    base::RunLoop run_loop;
+    tab_helper->SetIconUpdateCallbackForTesting(
+        base::BindLambdaForTesting([&run_loop]() { run_loop.Quit(); }));
+
+    ClickLinkAndWait(web_contents, link_url, LinkTarget::SELF, "");
+
+    run_loop.Run();
+  }
+
  private:
   base::test::ScopedFeatureList feature_list_;
 };
@@ -494,16 +481,11 @@
                        ShowsInfoBarOnAppOpen) {
   const GURL in_scope_url =
       https_server().GetURL(GetAppUrlHost(), GetInScopeUrlPath());
+  ASSERT_TRUE(ui_test_utils::NavigateToURL(browser(), in_scope_url));
 
-  DoAndWaitForIntentPickerIconUpdate([this, in_scope_url] {
-    ASSERT_TRUE(ui_test_utils::NavigateToURL(browser(), in_scope_url));
-  });
   EXPECT_TRUE(GetIntentChip()->GetVisible());
 
-  ui_test_utils::BrowserChangeObserver browser_opened(
-      nullptr, ui_test_utils::BrowserChangeObserver::ChangeType::kAdded);
   ClickIntentChip();
-  browser_opened.Wait();
 
   Browser* app_browser = BrowserList::GetInstance()->GetLastActive();
   EXPECT_TRUE(web_app::AppBrowserController::IsForWebApp(app_browser,
diff --git a/chrome/browser/ui/views/media_router/media_remoting_dialog_view.h b/chrome/browser/ui/views/media_router/media_remoting_dialog_view.h
index 1718550..07a701e 100644
--- a/chrome/browser/ui/views/media_router/media_remoting_dialog_view.h
+++ b/chrome/browser/ui/views/media_router/media_remoting_dialog_view.h
@@ -40,7 +40,7 @@
   bool IsShowing() const override;
 
  private:
-  content::WebContents* const web_contents_;
+  const raw_ptr<content::WebContents> web_contents_;
   views::ViewTracker tracker_;
 };
 
diff --git a/chrome/browser/ui/views/page_info/page_info_bubble_view_browsertest.cc b/chrome/browser/ui/views/page_info/page_info_bubble_view_browsertest.cc
index 8414d6ce..a3a6e1b 100644
--- a/chrome/browser/ui/views/page_info/page_info_bubble_view_browsertest.cc
+++ b/chrome/browser/ui/views/page_info/page_info_bubble_view_browsertest.cc
@@ -1134,7 +1134,7 @@
 
  private:
   base::test::ScopedFeatureList feature_list_;
-  PrefService* prefs_;
+  raw_ptr<PrefService> prefs_;
   raw_ptr<MockPrivacySandboxService, DanglingUntriaged>
       mock_privacy_sandbox_service_;
 };
diff --git a/chrome/browser/ui/views/permissions/permission_prompt_chip.h b/chrome/browser/ui/views/permissions/permission_prompt_chip.h
index 533e5297..0e3f871 100644
--- a/chrome/browser/ui/views/permissions/permission_prompt_chip.h
+++ b/chrome/browser/ui/views/permissions/permission_prompt_chip.h
@@ -49,7 +49,7 @@
 
  private:
   // The controller handling the chip view
-  ChipController* chip_controller_;
+  raw_ptr<ChipController> chip_controller_;
 
   // Delegate representing a permission request
   raw_ptr<permissions::PermissionPrompt::Delegate> delegate_;
diff --git a/chrome/browser/ui/views/policy/idle_dialog_view.h b/chrome/browser/ui/views/policy/idle_dialog_view.h
index 7c76afd..c82b7b38 100644
--- a/chrome/browser/ui/views/policy/idle_dialog_view.h
+++ b/chrome/browser/ui/views/policy/idle_dialog_view.h
@@ -6,6 +6,7 @@
 #define CHROME_BROWSER_UI_VIEWS_POLICY_IDLE_DIALOG_VIEW_H_
 
 #include "base/callback.h"
+#include "base/memory/raw_ptr.h"
 #include "base/time/time.h"
 #include "base/timer/timer.h"
 #include "chrome/browser/ui/idle_dialog.h"
@@ -84,7 +85,7 @@
   void OnWidgetDestroying(views::Widget* widget) override;
 
  private:
-  views::Widget* widget_;
+  raw_ptr<views::Widget> widget_;
 };
 
 }  // namespace policy
diff --git a/chrome/browser/ui/views/profiles/profile_management_step_controller.cc b/chrome/browser/ui/views/profiles/profile_management_step_controller.cc
index b420d88f..c64d51f 100644
--- a/chrome/browser/ui/views/profiles/profile_management_step_controller.cc
+++ b/chrome/browser/ui/views/profiles/profile_management_step_controller.cc
@@ -4,6 +4,7 @@
 
 #include "chrome/browser/ui/views/profiles/profile_management_step_controller.h"
 
+#include "base/memory/raw_ptr.h"
 #include "chrome/browser/browser_process.h"
 #include "chrome/browser/profiles/keep_alive/profile_keep_alive_types.h"
 #include "chrome/browser/profiles/profile.h"
@@ -199,7 +200,7 @@
   }
 
   std::unique_ptr<ScopedProfileKeepAlive> profile_keep_alive_;
-  Profile* profile_;
+  raw_ptr<Profile> profile_;
   std::unique_ptr<content::WebContents> contents_;
   absl::optional<SkColor> profile_color_;
   FinishFlowCallback finish_flow_callback_;
diff --git a/chrome/browser/ui/views/profiles/profile_menu_view_browsertest.cc b/chrome/browser/ui/views/profiles/profile_menu_view_browsertest.cc
index 75519a4..be0a32b 100644
--- a/chrome/browser/ui/views/profiles/profile_menu_view_browsertest.cc
+++ b/chrome/browser/ui/views/profiles/profile_menu_view_browsertest.cc
@@ -192,7 +192,7 @@
   }
 
  private:
-  Browser* target_browser_ = nullptr;
+  raw_ptr<Browser> target_browser_ = nullptr;
 };
 
 class ProfileMenuViewExtensionsTest : public ProfileMenuViewTestBase,
diff --git a/chrome/browser/ui/views/sharing_hub/screenshot/screenshot_captured_bubble_unittest.cc b/chrome/browser/ui/views/sharing_hub/screenshot/screenshot_captured_bubble_unittest.cc
index 8ebaf64e..f5f7081 100644
--- a/chrome/browser/ui/views/sharing_hub/screenshot/screenshot_captured_bubble_unittest.cc
+++ b/chrome/browser/ui/views/sharing_hub/screenshot/screenshot_captured_bubble_unittest.cc
@@ -7,6 +7,7 @@
 #include <vector>
 
 #include "base/callback.h"
+#include "base/memory/raw_ptr.h"
 #include "base/test/bind.h"
 #include "chrome/browser/image_editor/image_editor_component_info.h"
 #include "chrome/browser/share/share_features.h"
@@ -98,8 +99,8 @@
       content::WebContentsTester::CreateTestWebContents(&profile_, nullptr);
 
   std::unique_ptr<views::Widget> anchor_widget_;
-  ScreenshotCapturedBubble* bubble_;
-  views::Widget* bubble_widget_;
+  raw_ptr<ScreenshotCapturedBubble> bubble_;
+  raw_ptr<views::Widget> bubble_widget_;
 };
 
 TEST_F(ScreenshotCapturedBubbleTest, EditNavigatesToImageEditorWebUI) {
diff --git a/chrome/browser/ui/views/sharing_hub/sharing_hub_bubble_view_impl_unittest.cc b/chrome/browser/ui/views/sharing_hub/sharing_hub_bubble_view_impl_unittest.cc
index fe6af9e..6be316d 100644
--- a/chrome/browser/ui/views/sharing_hub/sharing_hub_bubble_view_impl_unittest.cc
+++ b/chrome/browser/ui/views/sharing_hub/sharing_hub_bubble_view_impl_unittest.cc
@@ -4,6 +4,7 @@
 
 #include "chrome/browser/ui/views/sharing_hub/sharing_hub_bubble_view_impl.h"
 
+#include "base/memory/raw_ptr.h"
 #include "base/ranges/algorithm.h"
 #include "base/test/scoped_feature_list.h"
 #include "chrome/browser/share/share_features.h"
@@ -124,12 +125,12 @@
  private:
   base::test::ScopedFeatureList feature_list_{share::kDesktopSharePreview};
 
-  sharing_hub::SharingHubBubbleViewImpl* bubble_;
+  raw_ptr<sharing_hub::SharingHubBubbleViewImpl> bubble_;
   testing::NiceMock<sharing_hub::FakeSharingHubBubbleController> controller_{
       kFirstPartyActions, kThirdPartyActions};
 
   std::unique_ptr<views::Widget> anchor_widget_;
-  views::Widget* bubble_widget_;
+  raw_ptr<views::Widget> bubble_widget_;
 };
 
 TEST_F(SharingHubBubbleTest, AllFirstPartyActionsAppearInOrder) {
diff --git a/chrome/browser/ui/views/side_panel/webview/webview_side_panel_coordinator.h b/chrome/browser/ui/views/side_panel/webview/webview_side_panel_coordinator.h
index 8e5d923f..dcd0f4c 100644
--- a/chrome/browser/ui/views/side_panel/webview/webview_side_panel_coordinator.h
+++ b/chrome/browser/ui/views/side_panel/webview/webview_side_panel_coordinator.h
@@ -5,6 +5,7 @@
 #ifndef CHROME_BROWSER_UI_VIEWS_SIDE_PANEL_WEBVIEW_WEBVIEW_SIDE_PANEL_COORDINATOR_H_
 #define CHROME_BROWSER_UI_VIEWS_SIDE_PANEL_WEBVIEW_WEBVIEW_SIDE_PANEL_COORDINATOR_H_
 
+#include "base/memory/raw_ptr.h"
 #include "chrome/browser/ui/browser_user_data.h"
 #include "content/public/browser/web_contents_observer.h"
 #include "ui/views/controls/textfield/textfield_controller.h"
@@ -43,8 +44,8 @@
 
   std::unique_ptr<views::View> CreateView();
 
-  views::Textfield* location_;
-  views::WebView* webview_;
+  raw_ptr<views::Textfield> location_;
+  raw_ptr<views::WebView> webview_;
 
   BROWSER_USER_DATA_KEY_DECL();
 };
diff --git a/chrome/browser/ui/views/side_search/side_search_browser_controller.cc b/chrome/browser/ui/views/side_search/side_search_browser_controller.cc
index 8a06e268..47f6754 100644
--- a/chrome/browser/ui/views/side_search/side_search_browser_controller.cc
+++ b/chrome/browser/ui/views/side_search/side_search_browser_controller.cc
@@ -5,6 +5,7 @@
 #include "chrome/browser/ui/views/side_search/side_search_browser_controller.h"
 
 #include "base/bind.h"
+#include "base/memory/raw_ptr.h"
 #include "base/memory/raw_ref.h"
 #include "base/strings/utf_string_conversions.h"
 #include "build/branding_buildflags.h"
@@ -146,7 +147,7 @@
   }
 
  private:
-  Browser* const browser_;
+  const raw_ptr<Browser> browser_;
 
   // Subscription to change notifications to the default search icon source.
   base::CallbackListSubscription icon_changed_subscription_;
diff --git a/chrome/browser/ui/views/tabs/z_orderable_tab_container_element.h b/chrome/browser/ui/views/tabs/z_orderable_tab_container_element.h
index 99f7f1b..7d61424 100644
--- a/chrome/browser/ui/views/tabs/z_orderable_tab_container_element.h
+++ b/chrome/browser/ui/views/tabs/z_orderable_tab_container_element.h
@@ -5,6 +5,8 @@
 #ifndef CHROME_BROWSER_UI_VIEWS_TABS_Z_ORDERABLE_TAB_CONTAINER_ELEMENT_H_
 #define CHROME_BROWSER_UI_VIEWS_TABS_Z_ORDERABLE_TAB_CONTAINER_ELEMENT_H_
 
+#include "base/memory/raw_ptr.h"
+
 namespace views {
 class View;
 }
@@ -34,7 +36,7 @@
   // on top of smaller ones.
   static float CalculateZValue(views::View* child);
 
-  views::View* child_;
+  raw_ptr<views::View> child_;
   float z_value_;
 };  // ZOrderableTabContainerElement
 
diff --git a/chrome/browser/ui/views/translate/partial_translate_bubble_view.h b/chrome/browser/ui/views/translate/partial_translate_bubble_view.h
index 602e027..6d5cde9 100644
--- a/chrome/browser/ui/views/translate/partial_translate_bubble_view.h
+++ b/chrome/browser/ui/views/translate/partial_translate_bubble_view.h
@@ -241,7 +241,7 @@
   raw_ptr<views::View, DanglingUntriaged> advanced_view_source_ = nullptr;
   raw_ptr<views::View, DanglingUntriaged> advanced_view_target_ = nullptr;
 
-  views::Throbber* throbber_;
+  raw_ptr<views::Throbber> throbber_;
 
   raw_ptr<views::Combobox, DanglingUntriaged> source_language_combobox_ =
       nullptr;
diff --git a/chrome/browser/ui/views/translate/translate_bubble_controller_unittest.cc b/chrome/browser/ui/views/translate/translate_bubble_controller_unittest.cc
index 4480e98..cd57698 100644
--- a/chrome/browser/ui/views/translate/translate_bubble_controller_unittest.cc
+++ b/chrome/browser/ui/views/translate/translate_bubble_controller_unittest.cc
@@ -5,6 +5,7 @@
 #include "chrome/browser/ui/views/translate/translate_bubble_controller.h"
 #include <memory>
 
+#include "base/memory/raw_ptr.h"
 #include "base/observer_list.h"
 #include "base/test/bind.h"
 #include "base/test/scoped_feature_list.h"
@@ -249,9 +250,9 @@
   std::unique_ptr<translate::testing::MockTranslateMetricsLogger>
       mock_translate_metrics_logger_;
 
-  FakeTranslateBubbleModel* fake_translate_bubble_model_ = nullptr;
-  FakePartialTranslateBubbleModel* fake_partial_translate_bubble_model_ =
-      nullptr;
+  raw_ptr<FakeTranslateBubbleModel> fake_translate_bubble_model_ = nullptr;
+  raw_ptr<FakePartialTranslateBubbleModel>
+      fake_partial_translate_bubble_model_ = nullptr;
 
   // Owned by WebContents.
   raw_ptr<TranslateBubbleController> controller_;
diff --git a/chrome/browser/ui/views/web_apps/pwa_confirmation_bubble_view.h b/chrome/browser/ui/views/web_apps/pwa_confirmation_bubble_view.h
index f9cc197a..8694b7a 100644
--- a/chrome/browser/ui/views/web_apps/pwa_confirmation_bubble_view.h
+++ b/chrome/browser/ui/views/web_apps/pwa_confirmation_bubble_view.h
@@ -55,7 +55,7 @@
   void OnBeforeBubbleWidgetInit(views::Widget::InitParams* params,
                                 views::Widget* widget) const override;
  private:
-  PageActionIconView* highlight_icon_button_ = nullptr;
+  raw_ptr<PageActionIconView> highlight_icon_button_ = nullptr;
   std::unique_ptr<WebAppInstallInfo> web_app_info_;
   chrome::AppInstallationAcceptanceCallback callback_;
 
diff --git a/chrome/browser/ui/views/web_apps/web_app_integration_test_driver.cc b/chrome/browser/ui/views/web_apps/web_app_integration_test_driver.cc
index e9facd5e..ed367f1 100644
--- a/chrome/browser/ui/views/web_apps/web_app_integration_test_driver.cc
+++ b/chrome/browser/ui/views/web_apps/web_app_integration_test_driver.cc
@@ -475,7 +475,7 @@
   }
 
  private:
-  const Profile* profile_;
+  raw_ptr<const Profile> profile_;
   const AppId app_id_;
   bool uninstall_complete_ = false;
   base::RunLoop run_loop_;
diff --git a/chrome/browser/ui/views/webauthn/hover_list_view.h b/chrome/browser/ui/views/webauthn/hover_list_view.h
index 94ff44bf..281f1bf7 100644
--- a/chrome/browser/ui/views/webauthn/hover_list_view.h
+++ b/chrome/browser/ui/views/webauthn/hover_list_view.h
@@ -9,6 +9,7 @@
 #include <memory>
 #include <string>
 
+#include "base/memory/raw_ptr.h"
 #include "chrome/browser/ui/webauthn/hover_list_model.h"
 #include "third_party/abseil-cpp/absl/types/optional.h"
 #include "ui/base/metadata/metadata_header_macros.h"
@@ -46,8 +47,8 @@
 
  private:
   struct ListItemViews {
-    WebAuthnHoverButton* item_view;
-    views::Separator* separator_view;
+    raw_ptr<WebAuthnHoverButton> item_view;
+    raw_ptr<views::Separator> separator_view;
   };
 
   void AppendListItemView(const ui::ImageModel& icon,
diff --git a/chrome/browser/ui/web_applications/web_app_navigate_browsertest.cc b/chrome/browser/ui/web_applications/web_app_navigate_browsertest.cc
index 70682da3..5793192 100644
--- a/chrome/browser/ui/web_applications/web_app_navigate_browsertest.cc
+++ b/chrome/browser/ui/web_applications/web_app_navigate_browsertest.cc
@@ -2,6 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+#include "base/memory/raw_ptr.h"
 #include "chrome/browser/web_applications/web_app_helpers.h"
 
 #include "base/test/metrics/histogram_tester.h"
@@ -169,7 +170,7 @@
   base::HistogramTester& histogram_tester() { return histogram_tester_; }
 
  private:
-  Browser* app_browser_ = nullptr;
+  raw_ptr<Browser> app_browser_ = nullptr;
   content::test::PrerenderTestHelper prerender_helper_;
   base::HistogramTester histogram_tester_;
   net::test_server::EmbeddedTestServerHandle test_server_handle_;
diff --git a/chrome/browser/ui/webui/ash/cloud_upload/cloud_upload.mojom b/chrome/browser/ui/webui/ash/cloud_upload/cloud_upload.mojom
index b264997..3b03743 100644
--- a/chrome/browser/ui/webui/ash/cloud_upload/cloud_upload.mojom
+++ b/chrome/browser/ui/webui/ash/cloud_upload/cloud_upload.mojom
@@ -51,4 +51,8 @@
 
   // Returns the user selected action and requests the dialog to be closed.
   RespondAndClose(UserAction response);
+
+  // Set Office as the default file handler for office files and mark the
+  // setup as complete so that it does not need to be started again.
+  SetOfficeAsDefaultHandler();
 };
diff --git a/chrome/browser/ui/webui/ash/cloud_upload/cloud_upload_dialog.cc b/chrome/browser/ui/webui/ash/cloud_upload/cloud_upload_dialog.cc
index a56f8cf..1db5928 100644
--- a/chrome/browser/ui/webui/ash/cloud_upload/cloud_upload_dialog.cc
+++ b/chrome/browser/ui/webui/ash/cloud_upload/cloud_upload_dialog.cc
@@ -81,7 +81,6 @@
 void OnDialogComplete(Profile* profile,
                       const std::vector<storage::FileSystemURL>& file_urls,
                       const std::string& action) {
-  using file_manager::file_tasks::kActionIdOpenInOffice;
   using file_manager::file_tasks::SetExcelFileHandler;
   using file_manager::file_tasks::SetOfficeSetupComplete;
   using file_manager::file_tasks::SetPowerPointFileHandler;
@@ -97,10 +96,7 @@
     SetOfficeSetupComplete(profile);
     StartUpload(profile, file_urls, CloudProvider::kGoogleDrive);
   } else if (action == kUserActionUploadToOneDrive) {
-    SetWordFileHandler(profile, kActionIdOpenInOffice);
-    SetExcelFileHandler(profile, kActionIdOpenInOffice);
-    SetPowerPointFileHandler(profile, kActionIdOpenInOffice);
-    SetOfficeSetupComplete(profile);
+    // Default handlers have already been set by this point for Office/OneDrive.
     StartUpload(profile, file_urls, CloudProvider::kOneDrive);
   } else if (action == kUserActionSetUpGoogleDrive) {
     CloudUploadDialog::Show(profile, file_urls,
diff --git a/chrome/browser/ui/webui/ash/cloud_upload/cloud_upload_page_handler.cc b/chrome/browser/ui/webui/ash/cloud_upload/cloud_upload_page_handler.cc
index 40e61cf..d35ba59cd 100644
--- a/chrome/browser/ui/webui/ash/cloud_upload/cloud_upload_page_handler.cc
+++ b/chrome/browser/ui/webui/ash/cloud_upload/cloud_upload_page_handler.cc
@@ -5,6 +5,7 @@
 #include "chrome/browser/ui/webui/ash/cloud_upload/cloud_upload_page_handler.h"
 #include "chrome/browser/apps/app_service/app_service_proxy.h"
 #include "chrome/browser/apps/app_service/app_service_proxy_factory.h"
+#include "chrome/browser/ash/file_manager/file_tasks.h"
 #include "chrome/browser/ui/webui/ash/cloud_upload/cloud_upload.mojom.h"
 #include "chrome/browser/web_applications/commands/install_from_info_command.h"
 #include "chrome/browser/web_applications/web_app_command_manager.h"
@@ -59,4 +60,15 @@
   }
 }
 
+void CloudUploadPageHandler::SetOfficeAsDefaultHandler() {
+  using file_manager::file_tasks::kActionIdOpenInOffice;
+
+  file_manager::file_tasks::SetWordFileHandler(profile_, kActionIdOpenInOffice);
+  file_manager::file_tasks::SetExcelFileHandler(profile_,
+                                                kActionIdOpenInOffice);
+  file_manager::file_tasks::SetPowerPointFileHandler(profile_,
+                                                     kActionIdOpenInOffice);
+  file_manager::file_tasks::SetOfficeSetupComplete(profile_);
+}
+
 }  // namespace ash::cloud_upload
diff --git a/chrome/browser/ui/webui/ash/cloud_upload/cloud_upload_page_handler.h b/chrome/browser/ui/webui/ash/cloud_upload/cloud_upload_page_handler.h
index c4f3357..92f69a0 100644
--- a/chrome/browser/ui/webui/ash/cloud_upload/cloud_upload_page_handler.h
+++ b/chrome/browser/ui/webui/ash/cloud_upload/cloud_upload_page_handler.h
@@ -42,6 +42,7 @@
   void GetDialogArgs(GetDialogArgsCallback callback) override;
   void IsOfficePWAInstalled(IsOfficePWAInstalledCallback callback) override;
   void RespondAndClose(mojom::UserAction action) override;
+  void SetOfficeAsDefaultHandler() override;
 
  private:
   Profile* profile_;
diff --git a/chrome/browser/ui/webui/ash/cloud_upload/cloud_upload_util.h b/chrome/browser/ui/webui/ash/cloud_upload/cloud_upload_util.h
index c9cfd2e..1225f15 100644
--- a/chrome/browser/ui/webui/ash/cloud_upload/cloud_upload_util.h
+++ b/chrome/browser/ui/webui/ash/cloud_upload/cloud_upload_util.h
@@ -19,9 +19,6 @@
 // The default folder where the file should be uploaded.
 const char kDestinationFolder[] = "from Chromebook";
 
-// ODFS extension ID.
-const char kODFSExtensionId[] = "ajdgmkbkgifbokednjgbmieaemeighkg";
-
 // Converts an absolute FilePath into a filesystem URL.
 storage::FileSystemURL FilePathToFileSystemURL(
     Profile* profile,
diff --git a/chrome/browser/ui/webui/ash/cloud_upload/one_drive_upload_handler.cc b/chrome/browser/ui/webui/ash/cloud_upload/one_drive_upload_handler.cc
index 743cb1f9..73271fb 100644
--- a/chrome/browser/ui/webui/ash/cloud_upload/one_drive_upload_handler.cc
+++ b/chrome/browser/ui/webui/ash/cloud_upload/one_drive_upload_handler.cc
@@ -6,6 +6,7 @@
 
 #include "base/check_op.h"
 #include "chrome/browser/ash/file_manager/copy_or_move_io_task.h"
+#include "chrome/browser/ash/file_manager/file_tasks.h"
 #include "chrome/browser/ash/file_manager/fileapi_util.h"
 #include "chrome/browser/ash/file_manager/open_util.h"
 #include "chrome/browser/ash/file_manager/volume_manager.h"
@@ -88,7 +89,8 @@
   io_task_controller_->AddObserver(this);
 
   // Destination url.
-  ProviderId provider_id = ProviderId::CreateFromExtensionId(kODFSExtensionId);
+  ProviderId provider_id = ProviderId::CreateFromExtensionId(
+      file_manager::file_tasks::kODFSExtensionId);
   Service* service = Service::Get(profile_);
   std::vector<ProvidedFileSystemInfo> file_systems =
       service->GetProvidedFileSystemInfoList(provider_id);
diff --git a/chrome/browser/ui/webui/ash/cloud_upload/one_drive_upload_handler_browsertest.cc b/chrome/browser/ui/webui/ash/cloud_upload/one_drive_upload_handler_browsertest.cc
index 51caac512..0245c61 100644
--- a/chrome/browser/ui/webui/ash/cloud_upload/one_drive_upload_handler_browsertest.cc
+++ b/chrome/browser/ui/webui/ash/cloud_upload/one_drive_upload_handler_browsertest.cc
@@ -9,6 +9,7 @@
 #include "base/path_service.h"
 #include "base/test/scoped_feature_list.h"
 #include "base/threading/thread_restrictions.h"
+#include "chrome/browser/ash/file_manager/file_tasks.h"
 #include "chrome/browser/ash/file_manager/fileapi_util.h"
 #include "chrome/browser/ash/file_manager/path_util.h"
 #include "chrome/browser/ash/file_system_provider/fake_extension_provider.h"
@@ -84,9 +85,10 @@
     file_system_provider::MountOptions options("odfs", "ODFS");
     const file_system_provider::ProviderId provider_id =
         file_system_provider::ProviderId::CreateFromExtensionId(
-            kODFSExtensionId);
+            file_manager::file_tasks::kODFSExtensionId);
     service->RegisterProvider(
-        file_system_provider::FakeExtensionProvider::Create(kODFSExtensionId));
+        file_system_provider::FakeExtensionProvider::Create(
+            file_manager::file_tasks::kODFSExtensionId));
     EXPECT_EQ(base::File::FILE_OK,
               service->MountFileSystem(provider_id, options));
   }
diff --git a/chrome/browser/ui/webui/browser_command/browser_command_handler_unittest.cc b/chrome/browser/ui/webui/browser_command/browser_command_handler_unittest.cc
index 601a9b7..617415a 100644
--- a/chrome/browser/ui/webui/browser_command/browser_command_handler_unittest.cc
+++ b/chrome/browser/ui/webui/browser_command/browser_command_handler_unittest.cc
@@ -5,6 +5,7 @@
 #include <memory>
 
 #include "base/bind.h"
+#include "base/memory/raw_ptr.h"
 #include "base/run_loop.h"
 #include "base/test/metrics/histogram_tester.h"
 #include "base/test/scoped_feature_list.h"
@@ -108,7 +109,7 @@
   bool BrowserHasTabGroups() override { return has_tab_groups_; }
 
  private:
-  user_education::TutorialService* tutorial_service_;
+  raw_ptr<user_education::TutorialService> tutorial_service_;
   std::unique_ptr<CommandUpdater> command_updater_;
 
   bool tab_groups_feature_supported_ = true;
diff --git a/chrome/browser/ui/webui/commerce/shopping_list_context_menu_controller.h b/chrome/browser/ui/webui/commerce/shopping_list_context_menu_controller.h
index 4d1b247..1653978 100644
--- a/chrome/browser/ui/webui/commerce/shopping_list_context_menu_controller.h
+++ b/chrome/browser/ui/webui/commerce/shopping_list_context_menu_controller.h
@@ -45,7 +45,7 @@
  private:
   raw_ptr<bookmarks::BookmarkModel> bookmark_model_;
   raw_ptr<ShoppingService> shopping_service_;
-  const bookmarks::BookmarkNode* bookmark_node_;
+  raw_ptr<const bookmarks::BookmarkNode> bookmark_node_;
   raw_ptr<ui::SimpleMenuModel> menu_model_;
 };
 
diff --git a/chrome/browser/ui/webui/devtools_ui_data_source.cc b/chrome/browser/ui/webui/devtools_ui_data_source.cc
index 0d38cb8ba..d92e8dd9 100644
--- a/chrome/browser/ui/webui/devtools_ui_data_source.cc
+++ b/chrome/browser/ui/webui/devtools_ui_data_source.cc
@@ -251,8 +251,7 @@
           destination: GOOGLE_OWNED_SERVICE
         }
         policy {
-          cookies_allowed: YES
-          cookies_store: "user"
+          cookies_allowed: NO
           setting: "This feature cannot be disabled by settings."
           chrome_policy {
             DeveloperToolsAvailability {
@@ -291,8 +290,7 @@
           destination: WEBSITE
         }
         policy {
-          cookies_allowed: YES
-          cookies_store: "user"
+          cookies_allowed: NO
           setting: "This feature cannot be disabled by settings."
           chrome_policy {
             DeveloperToolsAvailability {
@@ -314,6 +312,7 @@
   auto request = std::make_unique<network::ResourceRequest>();
   request->url = url;
   request->load_flags = load_flags;
+  request->credentials_mode = network::mojom::CredentialsMode::kOmit;
 
   auto request_iter = pending_requests_.emplace(pending_requests_.begin());
   request_iter->callback = std::move(callback);
diff --git a/chrome/browser/ui/webui/new_tab_page_third_party/new_tab_page_third_party_handler.h b/chrome/browser/ui/webui/new_tab_page_third_party/new_tab_page_third_party_handler.h
index 54bfc83..39773e46 100644
--- a/chrome/browser/ui/webui/new_tab_page_third_party/new_tab_page_third_party_handler.h
+++ b/chrome/browser/ui/webui/new_tab_page_third_party/new_tab_page_third_party_handler.h
@@ -5,6 +5,7 @@
 #ifndef CHROME_BROWSER_UI_WEBUI_NEW_TAB_PAGE_THIRD_PARTY_NEW_TAB_PAGE_THIRD_PARTY_HANDLER_H_
 #define CHROME_BROWSER_UI_WEBUI_NEW_TAB_PAGE_THIRD_PARTY_NEW_TAB_PAGE_THIRD_PARTY_HANDLER_H_
 
+#include "base/memory/raw_ptr.h"
 #include "chrome/browser/themes/theme_service_observer.h"
 #include "chrome/browser/ui/webui/new_tab_page_third_party/new_tab_page_third_party.mojom.h"
 #include "content/public/browser/web_contents.h"
@@ -52,8 +53,8 @@
 
   void NotifyAboutTheme();
 
-  Profile* profile_;
-  content::WebContents* web_contents_;
+  raw_ptr<Profile> profile_;
+  raw_ptr<content::WebContents> web_contents_;
 
   // These are located at the end of the list of member variables to ensure the
   // WebUI page is disconnected before other members are destroyed.
diff --git a/chrome/browser/ui/webui/new_tab_page_third_party/new_tab_page_third_party_ui.h b/chrome/browser/ui/webui/new_tab_page_third_party/new_tab_page_third_party_ui.h
index f713895..4b0bdfc 100644
--- a/chrome/browser/ui/webui/new_tab_page_third_party/new_tab_page_third_party_ui.h
+++ b/chrome/browser/ui/webui/new_tab_page_third_party/new_tab_page_third_party_ui.h
@@ -7,6 +7,7 @@
 
 #include <memory>
 
+#include "base/memory/raw_ptr.h"
 #include "base/time/time.h"
 #include "chrome/browser/ui/webui/new_tab_page_third_party/new_tab_page_third_party.mojom.h"
 #include "content/public/browser/web_contents_observer.h"
@@ -72,8 +73,8 @@
   std::unique_ptr<MostVisitedHandler> most_visited_page_handler_;
   mojo::Receiver<most_visited::mojom::MostVisitedPageHandlerFactory>
       most_visited_page_factory_receiver_;
-  Profile* profile_;
-  content::WebContents* web_contents_;
+  raw_ptr<Profile> profile_;
+  raw_ptr<content::WebContents> web_contents_;
   // Time the NTP started loading. Used for logging the WebUI NTP's load
   // performance.
   base::Time navigation_start_time_;
diff --git a/chrome/browser/ui/webui/password_manager/password_manager_ui.cc b/chrome/browser/ui/webui/password_manager/password_manager_ui.cc
index f65c71b..96d05ee4 100644
--- a/chrome/browser/ui/webui/password_manager/password_manager_ui.cc
+++ b/chrome/browser/ui/webui/password_manager/password_manager_ui.cc
@@ -11,6 +11,7 @@
 #include "chrome/browser/ui/webui/webui_util.h"
 #include "chrome/common/url_constants.h"
 #include "chrome/common/webui_url_constants.h"
+#include "chrome/grit/browser_resources.h"
 #include "chrome/grit/generated_resources.h"
 #include "chrome/grit/password_manager_resources.h"
 #include "chrome/grit/password_manager_resources_map.h"
@@ -21,6 +22,10 @@
 #include "ui/base/resource/resource_bundle.h"
 #include "ui/base/webui/web_ui_util.h"
 
+#if BUILDFLAG(GOOGLE_CHROME_BRANDING)
+#include "chrome/grit/chrome_unscaled_resources.h"
+#endif
+
 namespace {
 
 content::WebUIDataSource* CreatePasswordsUIHTMLSource(Profile* profile) {
@@ -84,6 +89,14 @@
           IDS_PASSWORD_MANAGER_UI_PASSWORDS_DESCRIPTION,
           base::ASCIIToUTF16(chrome::kPasswordManagerLearnMoreURL)));
 
+#if BUILDFLAG(GOOGLE_CHROME_BRANDING)
+  // Overwrite ubranded logo for Chrome-branded builds.
+  // This path is used in the manifest of the PasswordManager web app
+  // (chrome/browser/resources/password_manager/manifest.webmanifest).
+  source->AddResourcePath("images/password_manager_logo.svg",
+                          IDR_CHROME_PASSWORD_MANAGER_LOGO);
+#endif
+
   return source;
 }
 
diff --git a/chrome/browser/ui/webui/signin/OWNERS b/chrome/browser/ui/webui/signin/OWNERS
index bd7918d..570c576 100644
--- a/chrome/browser/ui/webui/signin/OWNERS
+++ b/chrome/browser/ui/webui/signin/OWNERS
@@ -3,12 +3,9 @@
 # For profile picker and first run changes
 dgn@chromium.org
 
-# For ChromeOS changes
-achuith@chromium.org
-xiyuan@chromium.org
-
 per-file inline_login_handler_impl*=file://chrome/credential_provider/OWNERS
 per-file inline_login_handler.*=file://chrome/credential_provider/OWNERS
 
+# For ChromeOS changes
 per-file inline_login_*_chromeos*=file://chromeos/ash/components/account_manager/OWNERS
 per-file signin_helper_chromeos.*=file://chromeos/ash/components/account_manager/OWNERS
diff --git a/chrome/browser/ui/webui/signin/ash/OWNERS b/chrome/browser/ui/webui/signin/ash/OWNERS
new file mode 100644
index 0000000..31ce3d3
--- /dev/null
+++ b/chrome/browser/ui/webui/signin/ash/OWNERS
@@ -0,0 +1 @@
+file://chromeos/ash/components/account_manager/OWNERS
diff --git a/chrome/browser/ui/webui/signin/turn_sync_on_helper.cc b/chrome/browser/ui/webui/signin/turn_sync_on_helper.cc
index c6d8fc0..f43f472 100644
--- a/chrome/browser/ui/webui/signin/turn_sync_on_helper.cc
+++ b/chrome/browser/ui/webui/signin/turn_sync_on_helper.cc
@@ -13,6 +13,7 @@
 #include "base/feature_list.h"
 #include "base/location.h"
 #include "base/logging.h"
+#include "base/memory/raw_ptr.h"
 #include "base/metrics/user_metrics.h"
 #include "base/metrics/user_metrics_action.h"
 #include "base/no_destructor.h"
@@ -125,7 +126,7 @@
 };
 
 struct CurrentTurnSyncOnHelperUserData : public base::SupportsUserData::Data {
-  TurnSyncOnHelper* current_helper = nullptr;
+  raw_ptr<TurnSyncOnHelper> current_helper = nullptr;
 };
 
 TurnSyncOnHelper* GetCurrentTurnSyncOnHelper(Profile* profile) {
diff --git a/chrome/browser/ui/webui/signin/turn_sync_on_helper_unittest.cc b/chrome/browser/ui/webui/signin/turn_sync_on_helper_unittest.cc
index f87adc14..ce836f5 100644
--- a/chrome/browser/ui/webui/signin/turn_sync_on_helper_unittest.cc
+++ b/chrome/browser/ui/webui/signin/turn_sync_on_helper_unittest.cc
@@ -278,7 +278,7 @@
   }
 
  private:
-  policy::PolicyService::ProviderUpdateObserver* observer_ = nullptr;
+  raw_ptr<policy::PolicyService::ProviderUpdateObserver> observer_ = nullptr;
 };
 
 std::unique_ptr<KeyedService> BuildMockSyncService(
diff --git a/chrome/browser/web_applications/app_service/web_app_publisher_helper_unittest.cc b/chrome/browser/web_applications/app_service/web_app_publisher_helper_unittest.cc
index 94723af..a61e7e5 100644
--- a/chrome/browser/web_applications/app_service/web_app_publisher_helper_unittest.cc
+++ b/chrome/browser/web_applications/app_service/web_app_publisher_helper_unittest.cc
@@ -10,6 +10,7 @@
 #include <utility>
 
 #include "base/check.h"
+#include "base/memory/raw_ptr.h"
 #include "base/strings/utf_string_conversions.h"
 #include "base/test/scoped_feature_list.h"
 #include "base/traits_bag.h"
@@ -96,7 +97,7 @@
   content::BrowserTaskEnvironment task_environment_;
   std::unique_ptr<TestingProfile> profile_;
   NoOpWebAppPublisherDelegate no_op_delegate_;
-  WebAppProvider* provider_;
+  raw_ptr<WebAppProvider> provider_;
   std::unique_ptr<WebAppPublisherHelper> publisher_;
 };
 
diff --git a/chrome/browser/web_applications/commands/install_from_sync_command_unittest.cc b/chrome/browser/web_applications/commands/install_from_sync_command_unittest.cc
index 3233cef4..164d081 100644
--- a/chrome/browser/web_applications/commands/install_from_sync_command_unittest.cc
+++ b/chrome/browser/web_applications/commands/install_from_sync_command_unittest.cc
@@ -677,7 +677,7 @@
       command_manager_->Shutdown();
     }
 
-    WebAppCommandManager* const command_manager_;
+    const raw_ptr<WebAppCommandManager> command_manager_;
   };
 
   class CustomWebAppDataRetriever : public WebAppDataRetriever {
@@ -697,7 +697,7 @@
       std::move(callback).Run(std::make_unique<WebAppInstallInfo>());
     }
 
-    WebAppCommandManager* const command_manager_;
+    const raw_ptr<WebAppCommandManager> command_manager_;
   };
 
   const AppId app_id = GenerateAppId(/*manifest_id=*/absl::nullopt, kWebAppUrl);
diff --git a/chrome/browser/web_applications/commands/install_isolated_web_app_command_unittest.cc b/chrome/browser/web_applications/commands/install_isolated_web_app_command_unittest.cc
index 93f63d5..8d99b02 100644
--- a/chrome/browser/web_applications/commands/install_isolated_web_app_command_unittest.cc
+++ b/chrome/browser/web_applications/commands/install_isolated_web_app_command_unittest.cc
@@ -199,7 +199,7 @@
     std::unique_ptr<WebAppUrlLoader> url_loader;
     std::unique_ptr<content::WebContents> web_contents;
     absl::optional<IsolationData> isolation_data;
-    WebAppInstallFinalizer* install_finalizer = nullptr;
+    raw_ptr<WebAppInstallFinalizer> install_finalizer = nullptr;
   };
 
   base::expected<InstallIsolatedWebAppCommandSuccess,
diff --git a/chrome/browser/web_applications/commands/web_app_uninstall_command_unittest.cc b/chrome/browser/web_applications/commands/web_app_uninstall_command_unittest.cc
index 107304e5..1274709 100644
--- a/chrome/browser/web_applications/commands/web_app_uninstall_command_unittest.cc
+++ b/chrome/browser/web_applications/commands/web_app_uninstall_command_unittest.cc
@@ -6,6 +6,7 @@
 
 #include <memory>
 
+#include "base/memory/raw_ptr.h"
 #include "base/memory/scoped_refptr.h"
 #include "base/test/bind.h"
 #include "base/test/gmock_callback_support.h"
@@ -61,7 +62,8 @@
 
   WebAppProvider* provider() { return WebAppProvider::GetForTest(profile()); }
 
-  testing::StrictMock<MockOsIntegrationManager>* os_integration_manager_;
+  raw_ptr<testing::StrictMock<MockOsIntegrationManager>>
+      os_integration_manager_;
   scoped_refptr<testing::StrictMock<MockFileUtilsWrapper>> file_utils_wrapper_;
   base::HistogramTester histogram_tester_;
 };
diff --git a/chrome/browser/web_applications/isolated_web_apps/install_isolated_web_app_from_command_line_unittest.cc b/chrome/browser/web_applications/isolated_web_apps/install_isolated_web_app_from_command_line_unittest.cc
index 7318e0d..cca6759 100644
--- a/chrome/browser/web_applications/isolated_web_apps/install_isolated_web_app_from_command_line_unittest.cc
+++ b/chrome/browser/web_applications/isolated_web_apps/install_isolated_web_app_from_command_line_unittest.cc
@@ -433,8 +433,9 @@
   EXPECT_THAT(result.error(), HasSubstr("is not implemented"));
 }
 
+// Disabled. https://crbug.com/1392579
 TEST_F(InstallIsolatedWebAppFromCommandLineIsolationInfoTest,
-       GetIsolationInfoWhenDevModeBundleSucceeds) {
+       DISABLED_GetIsolationInfoWhenDevModeBundleSucceeds) {
   base::ScopedTempDir temp_dir;
   ASSERT_TRUE(temp_dir.CreateUniqueTempDir());
   base::FilePath path =
@@ -472,8 +473,9 @@
                         "bundle: FILE_ERROR_NOT_FOUND"));
 }
 
+// Disabled. https://crbug.com/1392579
 TEST_F(InstallIsolatedWebAppFromCommandLineIsolationInfoTest,
-       GetIsolationInfoWhenDevModeBundleFailsWhenInvalidFile) {
+       DISABLED_GetIsolationInfoWhenDevModeBundleFailsWhenInvalidFile) {
   base::ScopedTempDir temp_dir;
   ASSERT_TRUE(temp_dir.CreateUniqueTempDir());
   base::FilePath path =
diff --git a/chrome/browser/web_applications/isolated_web_apps/isolated_web_app_url_loader_factory_unittest.cc b/chrome/browser/web_applications/isolated_web_apps/isolated_web_app_url_loader_factory_unittest.cc
index f352ae9..720d914 100644
--- a/chrome/browser/web_applications/isolated_web_apps/isolated_web_app_url_loader_factory_unittest.cc
+++ b/chrome/browser/web_applications/isolated_web_apps/isolated_web_app_url_loader_factory_unittest.cc
@@ -11,6 +11,7 @@
 #include "base/files/file_path.h"
 #include "base/files/file_util.h"
 #include "base/files/scoped_temp_dir.h"
+#include "base/memory/raw_ptr.h"
 #include "base/strings/strcat.h"
 #include "chrome/browser/ui/web_applications/test/isolated_web_app_test_utils.h"
 #include "chrome/browser/web_applications/isolated_web_apps/isolated_web_app_url_info.h"
@@ -239,7 +240,7 @@
   bool enable_isolated_web_apps_feature_flag_;
   base::test::ScopedFeatureList scoped_feature_list_;
 
-  FakeWebAppProvider* provider_;
+  raw_ptr<FakeWebAppProvider> provider_;
   std::unique_ptr<ScopedUrlHandler> url_handler_;
 
   data_decoder::test::InProcessDataDecoder in_process_data_decoder_;
diff --git a/chrome/browser/web_applications/os_integration/web_app_shortcut.cc b/chrome/browser/web_applications/os_integration/web_app_shortcut.cc
index 535660a..94cb167 100644
--- a/chrome/browser/web_applications/os_integration/web_app_shortcut.cc
+++ b/chrome/browser/web_applications/os_integration/web_app_shortcut.cc
@@ -18,6 +18,7 @@
 #include "base/files/file_util.h"
 #include "base/files/scoped_temp_dir.h"
 #include "base/logging.h"
+#include "base/memory/raw_ptr.h"
 #include "base/memory/scoped_refptr.h"
 #include "base/no_destructor.h"
 #include "base/run_loop.h"
@@ -122,8 +123,8 @@
 
 struct ShortcutOverrideForTestingState {
   base::Lock lock;
-  ShortcutOverrideForTesting* global_shortcut_override GUARDED_BY(lock) =
-      nullptr;
+  raw_ptr<ShortcutOverrideForTesting> global_shortcut_override
+      GUARDED_BY(lock) = nullptr;
 };
 
 ShortcutOverrideForTestingState& GetMutableShortcutOverrideStateForTesting() {
@@ -287,7 +288,7 @@
 scoped_refptr<ShortcutOverrideForTesting> GetShortcutOverrideForTesting() {
   auto& state = GetMutableShortcutOverrideStateForTesting();
   base::AutoLock state_lock(state.lock);
-  return base::WrapRefCounted(state.global_shortcut_override);
+  return base::WrapRefCounted(state.global_shortcut_override.get());
 }
 
 ShortcutInfo::ShortcutInfo() = default;
diff --git a/chrome/browser/web_applications/web_app_command_scheduler_unittest.cc b/chrome/browser/web_applications/web_app_command_scheduler_unittest.cc
index b50a88fea..aca3b51 100644
--- a/chrome/browser/web_applications/web_app_command_scheduler_unittest.cc
+++ b/chrome/browser/web_applications/web_app_command_scheduler_unittest.cc
@@ -5,6 +5,7 @@
 #include "chrome/browser/web_applications/web_app_command_scheduler.h"
 
 #include "base/functional/callback_helpers.h"
+#include "base/memory/raw_ptr.h"
 #include "chrome/browser/web_applications/test/fake_web_app_provider.h"
 #include "chrome/browser/web_applications/test/web_app_test.h"
 #include "chrome/browser/web_applications/web_app_command_manager.h"
@@ -32,7 +33,7 @@
   }
 
  private:
-  FakeWebAppProvider* provider_;
+  raw_ptr<FakeWebAppProvider> provider_;
 };
 
 TEST_F(WebAppCommandSchedulerTest, FetchManifestAndInstall) {
diff --git a/chrome/browser/web_applications/web_app_database_unittest.cc b/chrome/browser/web_applications/web_app_database_unittest.cc
index 87dd8872..190f5525 100644
--- a/chrome/browser/web_applications/web_app_database_unittest.cc
+++ b/chrome/browser/web_applications/web_app_database_unittest.cc
@@ -10,6 +10,7 @@
 #include <vector>
 
 #include "base/files/file_path.h"
+#include "base/memory/raw_ptr.h"
 #include "base/run_loop.h"
 #include "base/strings/string_number_conversions.h"
 #include "base/strings/utf_string_conversions.h"
@@ -157,9 +158,9 @@
   }
 
  private:
-  WebAppSyncBridge* sync_bridge_;
-  FakeWebAppDatabaseFactory* database_factory_;
-  FakeWebAppProvider* provider_;
+  raw_ptr<WebAppSyncBridge> sync_bridge_;
+  raw_ptr<FakeWebAppDatabaseFactory> database_factory_;
+  raw_ptr<FakeWebAppProvider> provider_;
 
   testing::NiceMock<syncer::MockModelTypeChangeProcessor> mock_processor_;
 };
diff --git a/chrome/browser/web_applications/web_app_utils.cc b/chrome/browser/web_applications/web_app_utils.cc
index cc41413..92e409c 100644
--- a/chrome/browser/web_applications/web_app_utils.cc
+++ b/chrome/browser/web_applications/web_app_utils.cc
@@ -242,14 +242,14 @@
 
 content::BrowserContext* GetBrowserContextForWebAppMetrics(
     content::BrowserContext* context) {
-  // Use original profile to create only one KeyedService instance.
-  Profile* original_profile =
-      Profile::FromBrowserContext(context)->GetOriginalProfile();
-  const bool is_web_app_metrics_enabled =
-      site_engagement::SiteEngagementService::IsEnabled() &&
-      AreWebAppsEnabled(original_profile) &&
-      !original_profile->IsGuestSession();
-  return is_web_app_metrics_enabled ? original_profile : nullptr;
+  Profile* profile = Profile::FromBrowserContext(context);
+  if (!profile)
+    return nullptr;
+  if (!site_engagement::SiteEngagementService::IsEnabled())
+    return nullptr;
+  if (profile->GetOriginalProfile()->IsGuestSession())
+    return nullptr;
+  return GetBrowserContextForWebApps(context);
 }
 
 content::mojom::AlternativeErrorPageOverrideInfoPtr GetOfflinePageInfo(
diff --git a/chrome/browser/webauthn/local_credential_management_win.h b/chrome/browser/webauthn/local_credential_management_win.h
index 8f88c60..8a5a5e9 100644
--- a/chrome/browser/webauthn/local_credential_management_win.h
+++ b/chrome/browser/webauthn/local_credential_management_win.h
@@ -9,6 +9,7 @@
 
 #include "base/callback_forward.h"
 #include "base/containers/span.h"
+#include "base/memory/raw_ptr.h"
 #include "chrome/browser/webauthn/local_credential_management.h"
 #include "device/fido/win/authenticator.h"
 
@@ -46,8 +47,8 @@
             base::OnceCallback<void(bool)> callback) override;
 
  private:
-  device::WinWebAuthnApi* const api_;
-  Profile* profile_;
+  const raw_ptr<device::WinWebAuthnApi> api_;
+  raw_ptr<Profile> profile_;
 };
 
 #endif  // CHROME_BROWSER_WEBAUTHN_LOCAL_CREDENTIAL_MANAGEMENT_WIN_H_
diff --git a/chrome/browser/win/conflicts/third_party_conflicts_manager.h b/chrome/browser/win/conflicts/third_party_conflicts_manager.h
index 29156a79..6f668d7 100644
--- a/chrome/browser/win/conflicts/third_party_conflicts_manager.h
+++ b/chrome/browser/win/conflicts/third_party_conflicts_manager.h
@@ -10,6 +10,7 @@
 #include <vector>
 
 #include "base/callback.h"
+#include "base/memory/raw_ptr.h"
 #include "base/memory/ref_counted.h"
 #include "base/memory/weak_ptr.h"
 #include "base/strings/string_piece_forward.h"
@@ -180,7 +181,7 @@
   // |on_initialization_complete_callback_|.
   void SetTerminalState(State terminal_state);
 
-  ModuleDatabaseEventSource* const module_database_event_source_;
+  const raw_ptr<ModuleDatabaseEventSource> module_database_event_source_;
 
   scoped_refptr<base::SequencedTaskRunner> background_sequence_;
 
diff --git a/chrome/build/linux.pgo.txt b/chrome/build/linux.pgo.txt
index 2f8cb73..05de94a8 100644
--- a/chrome/build/linux.pgo.txt
+++ b/chrome/build/linux.pgo.txt
@@ -1 +1 @@
-chrome-linux-main-1669052379-349c9b09fc496ab00d547f4d7a2d7b10068fd2f3.profdata
+chrome-linux-main-1669096145-d961650051dda62ef799d500d9ce329de594b199.profdata
diff --git a/chrome/build/mac-arm.pgo.txt b/chrome/build/mac-arm.pgo.txt
index 8f1379d7..d1a9bd6 100644
--- a/chrome/build/mac-arm.pgo.txt
+++ b/chrome/build/mac-arm.pgo.txt
@@ -1 +1 @@
-chrome-mac-arm-main-1669052379-c0d13ae4b3813f67ea71a047d260d6eb215ac467.profdata
+chrome-mac-arm-main-1669096145-aff49237aa4a3fbee037d9ba7075dea407a15675.profdata
diff --git a/chrome/build/mac.pgo.txt b/chrome/build/mac.pgo.txt
index 3c2318b2..ab7ab621 100644
--- a/chrome/build/mac.pgo.txt
+++ b/chrome/build/mac.pgo.txt
@@ -1 +1 @@
-chrome-mac-main-1669075030-b6c517aaf7fcdb56dd96db53064a6fad987648f8.profdata
+chrome-mac-main-1669096145-c2b39b7e4fc78342ccef00e499d733b2f7858900.profdata
diff --git a/chrome/build/win32.pgo.txt b/chrome/build/win32.pgo.txt
index 33016e9..a663e8d 100644
--- a/chrome/build/win32.pgo.txt
+++ b/chrome/build/win32.pgo.txt
@@ -1 +1 @@
-chrome-win32-main-1669052379-ed4e1927fb4c3372babbbba7ae1d10dd6fe9a454.profdata
+chrome-win32-main-1669075030-b6e69f84cd68d527d18c50c9bc3fbd39a2632cfa.profdata
diff --git a/chrome/build/win64.pgo.txt b/chrome/build/win64.pgo.txt
index 7c4c6b3..50ebd69 100644
--- a/chrome/build/win64.pgo.txt
+++ b/chrome/build/win64.pgo.txt
@@ -1 +1 @@
-chrome-win64-main-1669052379-aff84406a097833821a4a1c0cd18bde5494c3d6f.profdata
+chrome-win64-main-1669075030-95ca73767382ff6dde32ece69ac48d0ab5673d74.profdata
diff --git a/chrome/common/chrome_features.cc b/chrome/common/chrome_features.cc
index 469526a..9ede9b9 100644
--- a/chrome/common/chrome_features.cc
+++ b/chrome/common/chrome_features.cc
@@ -425,7 +425,7 @@
 // extension request dialog.
 BASE_FEATURE(kExtensionWorkflowJustification,
              "ExtensionWorkflowJustification",
-             base::FEATURE_DISABLED_BY_DEFAULT);
+             base::FEATURE_ENABLED_BY_DEFAULT);
 
 // If enabled, this feature's |kExternalInstallDefaultButtonKey| field trial
 // parameter value controls which |ExternalInstallBubbleAlert| button is the
diff --git a/chrome/common/extensions/permissions/chrome_permission_message_provider.cc b/chrome/common/extensions/permissions/chrome_permission_message_provider.cc
index df198c18..cb1e551 100644
--- a/chrome/common/extensions/permissions/chrome_permission_message_provider.cc
+++ b/chrome/common/extensions/permissions/chrome_permission_message_provider.cc
@@ -7,6 +7,7 @@
 #include <tuple>
 #include <vector>
 
+#include "base/memory/raw_ptr.h"
 #include "base/metrics/field_trial.h"
 #include "base/ranges/algorithm.h"
 #include "base/stl_util.h"
@@ -41,7 +42,7 @@
   }
 
  private:
-  const PermissionMessage* msg_;
+  raw_ptr<const PermissionMessage> msg_;
 };
 using ComparablePermissions = std::vector<ComparablePermission>;
 
diff --git a/chrome/common/profiler/unwind_util_unittest.cc b/chrome/common/profiler/unwind_util_unittest.cc
index f82bcfc5..e131fda4 100644
--- a/chrome/common/profiler/unwind_util_unittest.cc
+++ b/chrome/common/profiler/unwind_util_unittest.cc
@@ -6,6 +6,7 @@
 
 #include "base/command_line.h"
 #include "base/feature_list.h"
+#include "base/memory/raw_ptr.h"
 #include "base/profiler/profiler_buildflags.h"
 #include "base/test/scoped_feature_list.h"
 #include "build/branding_buildflags.h"
@@ -98,7 +99,7 @@
 
   struct {
     version_info::Channel channel;
-    UnwindPrerequisitesDelegate* delegate;
+    raw_ptr<UnwindPrerequisitesDelegate> delegate;
     bool are_unwind_prerequisites_expected;
   } test_cases[] = {
     {version_info::Channel::CANARY, &true_mock_delegate, true},
diff --git a/chrome/common/safe_browsing/seven_zip_analyzer.cc b/chrome/common/safe_browsing/seven_zip_analyzer.cc
index cd090b1..973006e 100644
--- a/chrome/common/safe_browsing/seven_zip_analyzer.cc
+++ b/chrome/common/safe_browsing/seven_zip_analyzer.cc
@@ -5,6 +5,7 @@
 #include "chrome/common/safe_browsing/seven_zip_analyzer.h"
 
 #include "base/files/memory_mapped_file.h"
+#include "base/memory/raw_ptr.h"
 #include "base/metrics/histogram_functions.h"
 #include "base/time/time.h"
 #include "build/build_config.h"
@@ -114,7 +115,7 @@
   bool success() const { return success_; }
 
  private:
-  ArchiveAnalyzerResults* const results_;
+  const raw_ptr<ArchiveAnalyzerResults> results_;
   base::File temp_file_;
   base::File temp_file2_;
   const base::TimeTicks start_time_{base::TimeTicks::Now()};
diff --git a/chrome/installer/util/OWNERS b/chrome/installer/util/OWNERS
index f25cab8..978f56c 100644
--- a/chrome/installer/util/OWNERS
+++ b/chrome/installer/util/OWNERS
@@ -1,3 +1,3 @@
 per-file shell_util*=davidbienvenu@chromium.org
 per-file shell_util*=jessemckenna@google.com
-per-file tasbar_util*=davidbienvenu@chromium.org
+per-file taskbar_util*=davidbienvenu@chromium.org
diff --git a/chrome/installer/util/initial_preferences.h b/chrome/installer/util/initial_preferences.h
index 21dc033..6f68742 100644
--- a/chrome/installer/util/initial_preferences.h
+++ b/chrome/installer/util/initial_preferences.h
@@ -13,6 +13,7 @@
 #include <vector>
 
 #include "base/command_line.h"
+#include "base/memory/raw_ptr.h"
 #include "base/values.h"
 #include "build/build_config.h"
 
@@ -200,7 +201,7 @@
   std::string ExtractPrefString(const std::string& name);
 
   absl::optional<base::Value::Dict> initial_dictionary_;
-  base::Value::Dict* distribution_ = nullptr;
+  raw_ptr<base::Value::Dict> distribution_ = nullptr;
   bool preferences_read_from_file_ = false;
 };
 
diff --git a/chrome/installer/util/lzma_util.cc b/chrome/installer/util/lzma_util.cc
index 4f67f669..9a888f8 100644
--- a/chrome/installer/util/lzma_util.cc
+++ b/chrome/installer/util/lzma_util.cc
@@ -14,6 +14,7 @@
 #include "base/files/file_util.h"
 #include "base/files/memory_mapped_file.h"
 #include "base/logging.h"
+#include "base/memory/raw_ptr.h"
 #include "third_party/lzma_sdk/google/seven_zip_reader.h"
 
 namespace {
@@ -42,7 +43,7 @@
   bool CreateDirectory(const base::FilePath& dir);
 
   const base::FilePath location_;
-  base::FilePath* const output_file_;
+  const raw_ptr<base::FilePath> output_file_;
 
   std::set<base::FilePath> directories_created_;
   absl::optional<DWORD> error_code_;
diff --git a/chrome/renderer/chrome_content_renderer_client.cc b/chrome/renderer/chrome_content_renderer_client.cc
index 1625431..3d4c1e27 100644
--- a/chrome/renderer/chrome_content_renderer_client.cc
+++ b/chrome/renderer/chrome_content_renderer_client.cc
@@ -1599,10 +1599,9 @@
   // One of the features of kOmniboxTriggerForPrerender2 and
   // kSupportSearchSuggestionForPrerender2 should be enabled before telling the
   // blink side that chrome is enrolling the experinment.
-  if (blink::features::IsPrerender2Enabled() &&
-      (base::FeatureList::IsEnabled(features::kOmniboxTriggerForPrerender2) ||
-       base::FeatureList::IsEnabled(
-           features::kSupportSearchSuggestionForPrerender2))) {
+  if (base::FeatureList::IsEnabled(features::kOmniboxTriggerForPrerender2) ||
+      base::FeatureList::IsEnabled(
+          features::kSupportSearchSuggestionForPrerender2)) {
     blink::WebRuntimeFeatures::EnablePrerender2RelatedFeatures(true);
   }
 
diff --git a/chrome/services/system_signals/win/win_system_signals_service_unittest.cc b/chrome/services/system_signals/win/win_system_signals_service_unittest.cc
index 4ed5fc1..1f3d297 100644
--- a/chrome/services/system_signals/win/win_system_signals_service_unittest.cc
+++ b/chrome/services/system_signals/win/win_system_signals_service_unittest.cc
@@ -9,6 +9,7 @@
 #include <utility>
 
 #include "base/files/file_path.h"
+#include "base/memory/raw_ptr.h"
 #include "base/test/metrics/histogram_tester.h"
 #include "base/test/scoped_os_info_override_win.h"
 #include "base/test/task_environment.h"
@@ -60,9 +61,9 @@
   base::HistogramTester histogram_tester_;
   absl::optional<base::test::ScopedOSInfoOverride> os_info_override_;
 
-  MockFileSystemService* file_system_service_;
-  MockWmiClient* wmi_client_;
-  MockWscClient* wsc_client_;
+  raw_ptr<MockFileSystemService> file_system_service_;
+  raw_ptr<MockWmiClient> wmi_client_;
+  raw_ptr<MockWscClient> wsc_client_;
   std::unique_ptr<WinSystemSignalsService> win_system_signals_service_;
 };
 
diff --git a/chrome/test/chromedriver/chrome/web_view_impl.h b/chrome/test/chromedriver/chrome/web_view_impl.h
index ff928d6..75c3087e 100644
--- a/chrome/test/chromedriver/chrome/web_view_impl.h
+++ b/chrome/test/chromedriver/chrome/web_view_impl.h
@@ -238,7 +238,7 @@
 
  private:
   struct Item {
-    WebViewImpl* web_view;
+    raw_ptr<WebViewImpl> web_view;
     bool was_locked;
   };
   std::vector<Item> items_;
diff --git a/chrome/test/data/pdf/navigator_test.ts b/chrome/test/data/pdf/navigator_test.ts
index 44ec17ca..72a3504c 100644
--- a/chrome/test/data/pdf/navigator_test.ts
+++ b/chrome/test/data/pdf/navigator_test.ts
@@ -3,6 +3,7 @@
 // found in the LICENSE file.
 
 import {NavigatorDelegate, OpenPdfParamsParser, PdfNavigator, WindowOpenDisposition} from 'chrome-extension://mhjfbmdgcfjbbpaeojofohoefgiehjai/pdf_viewer_wrapper.js';
+import {assertNotReached} from 'chrome://resources/js/assert_ts.js';
 import {TestBrowserProxy} from 'chrome://webui-test/test_browser_proxy.js';
 
 import {getZoomableViewport, MockDocumentDimensions, MockElement, MockSizer, MockViewportChangedCallback} from './test_util.js';
@@ -45,7 +46,25 @@
   navigatorDelegate.reset();
   await navigator.navigate(url, disposition);
   chrome.test.assertFalse(viewportChangedCallback.wasCalled);
+
   if (expectedResultUrl === undefined) {
+    // Navigation shouldn't occur.
+    switch (disposition) {
+      case WindowOpenDisposition.CURRENT_TAB:
+        chrome.test.assertEq(
+            0, navigatorDelegate.getCallCount('navigateInCurrentTab'));
+        break;
+      case WindowOpenDisposition.NEW_BACKGROUND_TAB:
+        chrome.test.assertEq(
+            0, navigatorDelegate.getCallCount('navigateInNewTab'));
+        break;
+      case WindowOpenDisposition.NEW_WINDOW:
+        chrome.test.assertEq(
+            0, navigatorDelegate.getCallCount('navigateInNewWindow'));
+        break;
+      default:
+        assertNotReached();
+    }
     return;
   }
 
diff --git a/chrome/test/data/webui/chromeos/cloud_upload/cloud_upload_app_test.ts b/chrome/test/data/webui/chromeos/cloud_upload/cloud_upload_app_test.ts
index 20caa88..9286277 100644
--- a/chrome/test/data/webui/chromeos/cloud_upload/cloud_upload_app_test.ts
+++ b/chrome/test/data/webui/chromeos/cloud_upload/cloud_upload_app_test.ts
@@ -7,6 +7,10 @@
 import {DialogArgs, DialogPage, PageHandlerRemote, UserAction} from 'chrome://cloud-upload/cloud_upload.mojom-webui.js';
 import {CloudUploadBrowserProxy} from 'chrome://cloud-upload/cloud_upload_browser_proxy.js';
 import {CloudUploadElement} from 'chrome://cloud-upload/cloud_upload_dialog.js';
+import {OfficePwaInstallPageElement} from 'chrome://cloud-upload/office_pwa_install_page.js';
+import {OneDriveUploadPageElement} from 'chrome://cloud-upload/one_drive_upload_page.js';
+import {SignInPageElement} from 'chrome://cloud-upload/sign_in_page.js';
+import {WelcomePageElement} from 'chrome://cloud-upload/welcome_page.js';
 import {assertDeepEquals, assertEquals, assertFalse, assertNotEquals, assertTrue} from 'chrome://webui-test/chai_assert.js';
 import {TestBrowserProxy} from 'chrome://webui-test/test_browser_proxy.js';
 
@@ -50,7 +54,7 @@
      called. */
   let testProxy: CloudUploadTestBrowserProxy;
 
-  const setUp = async (options: ProxyOptions) => {
+  async function setUp(options: ProxyOptions) {
     testProxy = new CloudUploadTestBrowserProxy(options);
     CloudUploadBrowserProxy.setInstance(testProxy);
 
@@ -59,11 +63,28 @@
         document.createElement('cloud-upload') as CloudUploadElement;
     container.appendChild(cloudUploadApp);
     await cloudUploadApp.initPromise;
-  };
+  }
 
-  const doPWAInstallPage = async () => {
+  function checkIsWelcomePage(): void {
+    assertTrue(cloudUploadApp.currentPage instanceof WelcomePageElement);
+  }
+
+  function checkIsInstallPage(): void {
+    assertTrue(
+        cloudUploadApp.currentPage instanceof OfficePwaInstallPageElement);
+  }
+
+  function checkIsSignInPage(): void {
+    assertTrue(cloudUploadApp.currentPage instanceof SignInPageElement);
+  }
+
+  function checkIsOneDriveUploadPage(): void {
+    assertTrue(cloudUploadApp.currentPage instanceof OneDriveUploadPageElement);
+  }
+
+  async function waitForNextPage(): Promise<void> {
     // This promise resolves once a new page appears.
-    const nextPagePromise = new Promise<void>(resolve => {
+    return new Promise<void>(resolve => {
       const observer = new MutationObserver(mutations => {
         for (const mutation of mutations) {
           if (mutation.addedNodes.length > 0) {
@@ -74,10 +95,28 @@
       });
       observer.observe(cloudUploadApp.shadowRoot!, {childList: true});
     });
+  }
 
+  async function doWelcomePage(): Promise<void> {
+    checkIsWelcomePage();
+    const nextPagePromise = waitForNextPage();
     cloudUploadApp.$('.action-button').click();
     await nextPagePromise;
-  };
+  }
+
+  async function doPWAInstallPage(): Promise<void> {
+    checkIsInstallPage();
+    const nextPagePromise = waitForNextPage();
+    cloudUploadApp.$('.action-button').click();
+    await nextPagePromise;
+  }
+
+  async function doSignInPage(): Promise<void> {
+    checkIsSignInPage();
+    const nextPagePromise = waitForNextPage();
+    cloudUploadApp.$('.action-button').click();
+    await nextPagePromise;
+  }
 
   /**
    * Runs prior to all the tests running, attaches a div to enable isolated
@@ -107,11 +146,12 @@
       officePWAInstalled: false,
     });
 
-    // Click the 'next' button on the welcome page.
-    cloudUploadApp.$('.action-button').click();
-
+    // Go to the OneDrive upload page.
+    await doWelcomePage();
     await doPWAInstallPage();
+    await doSignInPage();
 
+    checkIsOneDriveUploadPage();
     const fileContainer = cloudUploadApp.$('#file-container');
     assertFalse(fileContainer.hidden);
   });
@@ -125,11 +165,12 @@
       officePWAInstalled: false,
     });
 
-    // Click the 'next' button on the welcome page.
-    cloudUploadApp.$('.action-button').click();
-
+    // Go to the OneDrive upload page.
+    await doWelcomePage();
     await doPWAInstallPage();
+    await doSignInPage();
 
+    checkIsOneDriveUploadPage();
     const fileContainer = cloudUploadApp.$('#file-container');
     assertTrue(fileContainer.hidden);
   });
@@ -139,13 +180,17 @@
       officePWAInstalled: true,
     });
 
-    // Click the 'next' button on the welcome page.
-    cloudUploadApp.$('.action-button').click();
+    await doWelcomePage();
 
     // Make the setup skips the PWA install page and goes to the upload page.
     // TODO(b/251046341): Once the sign in page is ready, this should check for
     // that page instead.
     assertEquals(null, cloudUploadApp.$('office-pwa-install-page'));
+
+    // Go to the OneDrive upload page.
+    await doSignInPage();
+
+    checkIsOneDriveUploadPage();
     assertNotEquals(null, cloudUploadApp.$('upload-page'));
   });
 
@@ -158,12 +203,15 @@
       fileName: 'file.docx',
       officePWAInstalled: false,
     });
+    checkIsWelcomePage();
 
     // Click the 'next' button on the welcome page.
     cloudUploadApp.$('.action-button').click();
 
     await doPWAInstallPage();
+    await doSignInPage();
 
+    checkIsOneDriveUploadPage();
     cloudUploadApp.$('.action-button').click();
     await testProxy.handler.whenCalled('respondAndClose');
     assertEquals(1, testProxy.handler.getCallCount('respondAndClose'));
@@ -182,11 +230,12 @@
       officePWAInstalled: false,
     });
 
-    // Click the 'next' button on the welcome page.
-    cloudUploadApp.$('.action-button').click();
-
+    // Go to the OneDrive upload page.
+    await doWelcomePage();
     await doPWAInstallPage();
+    await doSignInPage();
 
+    checkIsOneDriveUploadPage();
     cloudUploadApp.$('.cancel-button').click();
     await testProxy.handler.whenCalled('respondAndClose');
     assertEquals(1, testProxy.handler.getCallCount('respondAndClose'));
diff --git a/chrome/test/media_router/access_code_cast/access_code_cast_integration_browsertest.h b/chrome/test/media_router/access_code_cast/access_code_cast_integration_browsertest.h
index e8246ca..f9097ff4 100644
--- a/chrome/test/media_router/access_code_cast/access_code_cast_integration_browsertest.h
+++ b/chrome/test/media_router/access_code_cast/access_code_cast_integration_browsertest.h
@@ -184,7 +184,7 @@
   std::unique_ptr<cast_channel::MockCastSocketService,
                   base::OnTaskRunnerDeleter>
       mock_cast_socket_service_;
-  MockCastMediaSinkServiceImpl* impl_ = nullptr;
+  raw_ptr<MockCastMediaSinkServiceImpl> impl_ = nullptr;
 
   std::unique_ptr<TestMediaSinkService> mock_dual_media_sink_service_;
 
diff --git a/chrome/utility/importer/ie_importer_win.cc b/chrome/utility/importer/ie_importer_win.cc
index 75e6ece..ef1d8de 100644
--- a/chrome/utility/importer/ie_importer_win.cc
+++ b/chrome/utility/importer/ie_importer_win.cc
@@ -23,6 +23,7 @@
 #include "base/files/file_path.h"
 #include "base/files/file_util.h"
 #include "base/logging.h"
+#include "base/memory/raw_ptr.h"
 #include "base/ranges/algorithm.h"
 #include "base/strings/string_split.h"
 #include "base/strings/string_util.h"
@@ -135,7 +136,7 @@
     }
     return lhs.path.size() < rhs.path.size();
   }
-  const std::map<base::FilePath, uint32_t>* sort_index_;
+  raw_ptr<const std::map<base::FilePath, uint32_t>> sort_index_;
 };
 
 // IE stores the order of the Favorites menu in registry under:
diff --git a/chromeos/ash/components/drivefs/OWNERS b/chromeos/ash/components/drivefs/OWNERS
index f30cc143..e16f7b10 100644
--- a/chromeos/ash/components/drivefs/OWNERS
+++ b/chromeos/ash/components/drivefs/OWNERS
@@ -1,6 +1,4 @@
-austinct@chromium.org
-petermarshall@chromium.org
-simmonsjosh@google.com
+file://ui/file_manager/OWNERS
 
 per-file *_mojom_traits*.*=set noparent
 per-file *_mojom_traits*.*=file://ipc/SECURITY_OWNERS
diff --git a/chromeos/ash/components/network/fake_stub_cellular_networks_provider.cc b/chromeos/ash/components/network/fake_stub_cellular_networks_provider.cc
index 3e3c8fb732..d5d8f3c 100644
--- a/chromeos/ash/components/network/fake_stub_cellular_networks_provider.cc
+++ b/chromeos/ash/components/network/fake_stub_cellular_networks_provider.cc
@@ -44,7 +44,7 @@
     for (const IccidEidPair& pair : stubs_to_add) {
       new_stub_networks.push_back(NetworkState::CreateNonShillCellularNetwork(
           pair.first, pair.second, GetGuidForStubIccid(pair.first),
-          base::Contains(managed_iccids_, pair.first), device));
+          base::Contains(managed_iccids_, pair.first), device->path()));
       stub_networks_add_count_++;
     }
   }
diff --git a/chromeos/ash/components/network/network_state.cc b/chromeos/ash/components/network/network_state.cc
index be2d522..1ca84fe 100644
--- a/chromeos/ash/components/network/network_state.cc
+++ b/chromeos/ash/components/network/network_state.cc
@@ -621,13 +621,13 @@
     const std::string& eid,
     const std::string& guid,
     bool is_managed,
-    const DeviceState* cellular_device) {
+    const std::string& cellular_device_path) {
   std::string path = GenerateStubCellularServicePath(iccid);
   auto new_state = std::make_unique<NetworkState>(path);
   new_state->set_type(shill::kTypeCellular);
   new_state->set_update_received();
   new_state->set_visible(true);
-  new_state->device_path_ = cellular_device->path();
+  new_state->device_path_ = cellular_device_path;
   new_state->iccid_ = iccid;
   new_state->eid_ = eid;
   new_state->guid_ = guid;
diff --git a/chromeos/ash/components/network/network_state.h b/chromeos/ash/components/network/network_state.h
index 88badbe..55e6322 100644
--- a/chromeos/ash/components/network/network_state.h
+++ b/chromeos/ash/components/network/network_state.h
@@ -284,7 +284,7 @@
       const std::string& eid,
       const std::string& guid,
       bool is_managed,
-      const DeviceState* cellular_device);
+      const std::string& cellular_device_path);
 
   // Ignore changes to signal strength less than this value.
   constexpr static const int kSignalStrengthChangeThreshold = 5;
diff --git a/chromeos/ash/components/network/network_state_unittest.cc b/chromeos/ash/components/network/network_state_unittest.cc
index f40c1cb..0ef0468 100644
--- a/chromeos/ash/components/network/network_state_unittest.cc
+++ b/chromeos/ash/components/network/network_state_unittest.cc
@@ -13,6 +13,7 @@
 #include "base/strings/string_number_conversions.h"
 #include "base/test/task_environment.h"
 #include "base/values.h"
+#include "chromeos/ash/components/network/device_state.h"
 #include "chromeos/ash/components/network/network_state_handler.h"
 #include "chromeos/ash/components/network/network_state_test_helper.h"
 #include "chromeos/ash/components/network/tether_constants.h"
@@ -468,7 +469,7 @@
   std::unique_ptr<NetworkState> non_shill_cellular =
       NetworkState::CreateNonShillCellularNetwork(
           kTestIccid, kTestEid, kTestGuid, /*is_managed=*/false,
-          GetCellularDevice());
+          GetCellularDevice()->path());
   EXPECT_EQ(kTestIccid, non_shill_cellular->iccid());
   EXPECT_EQ(kTestEid, non_shill_cellular->eid());
   EXPECT_EQ(kTestGuid, non_shill_cellular->guid());
@@ -482,7 +483,7 @@
 
   non_shill_cellular = NetworkState::CreateNonShillCellularNetwork(
       kTestIccid, kTestEid, kTestGuid, /*is_managed=*/true,
-      GetCellularDevice());
+      GetCellularDevice()->path());
   EXPECT_EQ(kTestIccid, non_shill_cellular->iccid());
   EXPECT_EQ(kTestEid, non_shill_cellular->eid());
   EXPECT_EQ(kTestGuid, non_shill_cellular->guid());
diff --git a/chromeos/ash/components/network/stub_cellular_networks_provider.cc b/chromeos/ash/components/network/stub_cellular_networks_provider.cc
index 0e20044..b8c1cd4 100644
--- a/chromeos/ash/components/network/stub_cellular_networks_provider.cc
+++ b/chromeos/ash/components/network/stub_cellular_networks_provider.cc
@@ -181,7 +181,7 @@
     new_stub_networks.push_back(NetworkState::CreateNonShillCellularNetwork(
         iccid_eid_pair.first, iccid_eid_pair.second,
         GetGuidForStubIccid(iccid_eid_pair.first), is_managed,
-        cellular_device));
+        cellular_device->path()));
   }
 
   return network_added;
diff --git a/chromeos/ash/services/ime/public/mojom/japanese_settings.mojom b/chromeos/ash/services/ime/public/mojom/japanese_settings.mojom
index d2df6d9..5dc2ab9 100644
--- a/chromeos/ash/services/ime/public/mojom/japanese_settings.mojom
+++ b/chromeos/ash/services/ime/public/mojom/japanese_settings.mojom
@@ -68,21 +68,21 @@
     kKatakana = 2,
 };
 
-[Stable]
-struct MozcConfig {
-    InputMode input_mode;
-    PunctuationStyle punctuation_style;
-    SymbolStyle symbol_style;
-    SpaceInputStyle space_input_style;
-    SelectionShortcut selection_shortcut;
-    KeymapStyle keymap_style;
-    bool automatically_switch_to_halfwidth;
-    ShiftKeyModeSwitch shift_key_mode_switch;
-    bool use_input_history;
-    bool use_system_dictionary;
-    int64 number_of_suggestions;
-    bool disable_personalized_suggestions;
-    bool send_statistics_to_google;
+[Stable, RenamedFrom="ash.ime.mojom.MozcConfig"]
+struct JapaneseConfig {
+    InputMode input_mode@0;
+    PunctuationStyle punctuation_style@1;
+    SymbolStyle symbol_style@2;
+    SpaceInputStyle space_input_style@3;
+    SelectionShortcut selection_shortcut@4;
+    KeymapStyle keymap_style@5;
+    bool automatically_switch_to_halfwidth@6;
+    ShiftKeyModeSwitch shift_key_mode_switch@7;
+    bool use_input_history@8;
+    bool use_system_dictionary@9;
+    int64 number_of_suggestions@10;
+    bool disable_personalized_suggestions@11;
+    bool send_statistics_to_google@12;
 };
 
 // JapaneseDecoder is the interface used for communicating with the Mozc
@@ -94,6 +94,6 @@
 interface JapaneseDecoder {
     // Retrieve the config used for Mozc which is stored as a file internally.
     // If this file does not exist, this should just return the default config.
-    FetchMozcConfig@0() => (MozcConfig config);
+    FetchJapaneseConfig@0() => (JapaneseConfig config);
 };
 
diff --git a/components/attribution_reporting/BUILD.gn b/components/attribution_reporting/BUILD.gn
index 6a3a895..15152d1 100644
--- a/components/attribution_reporting/BUILD.gn
+++ b/components/attribution_reporting/BUILD.gn
@@ -127,3 +127,17 @@
   seed_corpus =
       "//components/attribution_reporting/source_registration_fuzzer_corpus"
 }
+
+fuzzer_test("trigger_registration_fuzzer") {
+  sources = [ "trigger_registration_fuzzer.cc" ]
+  deps = [
+    ":attribution_reporting",
+    "//base",
+    "//base:i18n",
+    "//testing/libfuzzer/proto:json_proto",
+    "//testing/libfuzzer/proto:json_proto_converter",
+    "//third_party/libprotobuf-mutator",
+  ]
+  seed_corpus =
+      "//components/attribution_reporting/trigger_registration_fuzzer_corpus"
+}
diff --git a/components/attribution_reporting/trigger_registration_fuzzer.cc b/components/attribution_reporting/trigger_registration_fuzzer.cc
new file mode 100644
index 0000000..2fec1b8
--- /dev/null
+++ b/components/attribution_reporting/trigger_registration_fuzzer.cc
@@ -0,0 +1,58 @@
+// Copyright 2022 The Chromium Authors
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include <stdlib.h>
+
+#include <iostream>
+#include <string>
+#include <tuple>
+#include <utility>
+
+#include "base/command_line.h"
+#include "base/i18n/icu_util.h"
+#include "base/json/json_reader.h"
+#include "base/logging.h"
+#include "base/values.h"
+#include "components/attribution_reporting/suitable_origin.h"
+#include "components/attribution_reporting/trigger_registration.h"
+#include "testing/libfuzzer/proto/json.pb.h"
+#include "testing/libfuzzer/proto/json_proto_converter.h"
+#include "testing/libfuzzer/proto/lpm_interface.h"
+#include "third_party/abseil-cpp/absl/types/optional.h"
+
+namespace attribution_reporting {
+
+namespace {
+
+struct Environment {
+  Environment() {
+    base::CommandLine::Init(0, nullptr);
+    base::i18n::InitializeICU();
+    logging::SetMinLogLevel(logging::LOG_FATAL);
+  }
+};
+
+}  // namespace
+
+DEFINE_PROTO_FUZZER(const json_proto::JsonValue& json_value) {
+  static Environment env;
+
+  json_proto::JsonProtoConverter converter;
+  std::string native_input = converter.Convert(json_value);
+
+  if (getenv("LPM_DUMP_NATIVE_INPUT"))
+    std::cout << native_input << std::endl;
+
+  absl::optional<base::Value> input = base::JSONReader::Read(
+      native_input, base::JSONParserOptions::JSON_PARSE_RFC);
+  if (!input || !input->is_dict())
+    return;
+
+  std::ignore = TriggerRegistration::Parse(
+      std::move(*input).TakeDict(),
+      /*reporting_origin=*/
+      *SuitableOrigin::Deserialize("https://r.test/"));
+}
+
+}  // namespace attribution_reporting
diff --git a/third_party/blink/renderer/core/frame/attribution_src/attribution_trigger_registration_corpus/all_params.textproto b/components/attribution_reporting/trigger_registration_fuzzer_corpus/all_params.textproto
similarity index 100%
rename from third_party/blink/renderer/core/frame/attribution_src/attribution_trigger_registration_corpus/all_params.textproto
rename to components/attribution_reporting/trigger_registration_fuzzer_corpus/all_params.textproto
diff --git a/components/autofill/content/browser/form_forest.h b/components/autofill/content/browser/form_forest.h
index f12f3ae..82481e03 100644
--- a/components/autofill/content/browser/form_forest.h
+++ b/components/autofill/content/browser/form_forest.h
@@ -295,8 +295,8 @@
       return frame && form;
     }
 
-    FrameData* frame = nullptr;
-    FormData* form = nullptr;
+    raw_ptr<FrameData> frame = nullptr;
+    raw_ptr<FormData> form = nullptr;
   };
 
   // Resolves a FrameToken |query| from the perspective of |reference| to the
diff --git a/components/autofill/content/browser/form_forest_unittest.cc b/components/autofill/content/browser/form_forest_unittest.cc
index 3d10f6a..8babee6 100644
--- a/components/autofill/content/browser/form_forest_unittest.cc
+++ b/components/autofill/content/browser/form_forest_unittest.cc
@@ -11,6 +11,7 @@
 #include <vector>
 
 #include "base/containers/contains.h"
+#include "base/memory/raw_ptr.h"
 #include "base/strings/strcat.h"
 #include "base/strings/string_piece.h"
 #include "base/strings/utf_string_conversions.h"
@@ -1683,7 +1684,7 @@
   class Dummy {
    public:
     size_t val = 0;
-    size_t* num_equals_calls = nullptr;
+    raw_ptr<size_t> num_equals_calls = nullptr;
   };
 
   std::vector<Dummy> ToDummies(const std::vector<size_t>& vec) {
diff --git a/components/autofill/content/renderer/autofill_agent.cc b/components/autofill/content/renderer/autofill_agent.cc
index 40fc9b1..d0efa8a 100644
--- a/components/autofill/content/renderer/autofill_agent.cc
+++ b/components/autofill/content/renderer/autofill_agent.cc
@@ -1107,8 +1107,7 @@
 }
 
 bool AutofillAgent::IsPrerendering() const {
-  return blink::features::IsPrerender2Enabled() &&
-         render_frame()->GetWebFrame()->GetDocument().IsPrerendering();
+  return render_frame()->GetWebFrame()->GetDocument().IsPrerendering();
 }
 
 void AutofillAgent::FormControlElementClicked(
diff --git a/components/autofill/content/renderer/password_autofill_agent.cc b/components/autofill/content/renderer/password_autofill_agent.cc
index dc46d47..700da2c 100644
--- a/components/autofill/content/renderer/password_autofill_agent.cc
+++ b/components/autofill/content/renderer/password_autofill_agent.cc
@@ -1409,8 +1409,7 @@
 }
 
 bool PasswordAutofillAgent::IsPrerendering() const {
-  return blink::features::IsPrerender2Enabled() &&
-         render_frame()->GetWebFrame()->GetDocument().IsPrerendering();
+  return render_frame()->GetWebFrame()->GetDocument().IsPrerendering();
 }
 
 void PasswordAutofillAgent::ReadyToCommitNavigation(
diff --git a/components/autofill/content/renderer/password_generation_agent.cc b/components/autofill/content/renderer/password_generation_agent.cc
index 6332f2d..68e82463 100644
--- a/components/autofill/content/renderer/password_generation_agent.cc
+++ b/components/autofill/content/renderer/password_generation_agent.cc
@@ -283,8 +283,7 @@
 }
 
 bool PasswordGenerationAgent::IsPrerendering() const {
-  return blink::features::IsPrerender2Enabled() &&
-         render_frame()->GetWebFrame()->GetDocument().IsPrerendering();
+  return render_frame()->GetWebFrame()->GetDocument().IsPrerendering();
 }
 
 void PasswordGenerationAgent::GeneratedPasswordAccepted(
diff --git a/components/autofill/core/browser/address_rewriter.h b/components/autofill/core/browser/address_rewriter.h
index effeb72..9e2387d 100644
--- a/components/autofill/core/browser/address_rewriter.h
+++ b/components/autofill/core/browser/address_rewriter.h
@@ -7,6 +7,7 @@
 
 #include <string>
 
+#include "base/memory/raw_ptr.h"
 #include "base/strings/string_piece.h"
 #include "base/strings/string_util.h"
 
@@ -28,7 +29,7 @@
 
  private:
   // A handle to the internal rewrite rules this instance is using.
-  const void* impl_ = nullptr;
+  raw_ptr<const void> impl_ = nullptr;
 };
 
 }  // namespace autofill
diff --git a/components/autofill/core/browser/form_data_importer_unittest.cc b/components/autofill/core/browser/form_data_importer_unittest.cc
index cbd70a8..0250fbc5 100644
--- a/components/autofill/core/browser/form_data_importer_unittest.cc
+++ b/components/autofill/core/browser/form_data_importer_unittest.cc
@@ -737,7 +737,7 @@
   // as the destructor of the clients FormDataImporter relies on it.
   std::unique_ptr<PersonalDataManager> personal_data_manager_;
   std::unique_ptr<TestAutofillClient> autofill_client_;
-  MockVirtualCardEnrollmentManager* virtual_card_enrollment_manager_;
+  raw_ptr<MockVirtualCardEnrollmentManager> virtual_card_enrollment_manager_;
   base::test::ScopedFeatureList scoped_feature_list_;
 };
 
diff --git a/components/autofill/core/browser/iban_manager.h b/components/autofill/core/browser/iban_manager.h
index d10ac2edf..738263e 100644
--- a/components/autofill/core/browser/iban_manager.h
+++ b/components/autofill/core/browser/iban_manager.h
@@ -6,6 +6,7 @@
 #define COMPONENTS_AUTOFILL_CORE_BROWSER_IBAN_MANAGER_H_
 
 #include "base/gtest_prod_util.h"
+#include "base/memory/raw_ptr.h"
 #include "components/autofill/core/browser/autofill_subject.h"
 #include "components/autofill/core/browser/data_model/iban.h"
 #include "components/autofill/core/browser/personal_data_manager.h"
@@ -70,7 +71,7 @@
   void SendIBANSuggestions(const std::vector<IBAN*>& ibans,
                            const QueryHandler& query_handler);
 
-  PersonalDataManager* personal_data_manager_ = nullptr;
+  raw_ptr<PersonalDataManager> personal_data_manager_ = nullptr;
 
   bool is_off_the_record_ = false;
 
diff --git a/components/autofill/core/browser/payments/credit_card_fido_authenticator.h b/components/autofill/core/browser/payments/credit_card_fido_authenticator.h
index d6c07270..3ddd5a09 100644
--- a/components/autofill/core/browser/payments/credit_card_fido_authenticator.h
+++ b/components/autofill/core/browser/payments/credit_card_fido_authenticator.h
@@ -69,7 +69,7 @@
     bool did_succeed = false;
     // The fetched credit card if the authentication was successful. Can be
     // nullptr if authentication failed.
-    const CreditCard* card = nullptr;
+    raw_ptr<const CreditCard> card = nullptr;
     // The CVC of the fetched credit card. Can be empty string.
     std::u16string cvc = std::u16string();
     // The type of the failure of the full card request.
diff --git a/components/autofill/core/browser/strike_database_integrator_base.h b/components/autofill/core/browser/strike_database_integrator_base.h
index 403d02f..036cfcc 100644
--- a/components/autofill/core/browser/strike_database_integrator_base.h
+++ b/components/autofill/core/browser/strike_database_integrator_base.h
@@ -12,6 +12,7 @@
 
 #include "base/check.h"
 #include "base/gtest_prod_util.h"
+#include "base/memory/raw_ptr.h"
 #include "base/time/time.h"
 #include "components/autofill/core/browser/strike_database_base.h"
 #include "third_party/abseil-cpp/absl/types/optional.h"
@@ -129,7 +130,7 @@
   friend class StrikeDatabaseTest;
   friend class StrikeDatabaseTester;
 
-  StrikeDatabaseBase* strike_database_;
+  raw_ptr<StrikeDatabaseBase> strike_database_;
 
   // For projects in which strikes don't have unique identifiers, the
   // id suffix is set to |kSharedId|. This makes sure that projects requiring
diff --git a/components/autofill/core/common/mojom/autofill_types.mojom b/components/autofill/core/common/mojom/autofill_types.mojom
index 0d03091f..46a45154 100644
--- a/components/autofill/core/common/mojom/autofill_types.mojom
+++ b/components/autofill/core/common/mojom/autofill_types.mojom
@@ -83,8 +83,6 @@
 
   // Variants of type hints specified in the HTML specification that are
   // inferred based on a field's 'maxlength' attribute.
-  // TODO(isherman): Remove these types, in favor of understanding maxlength
-  // when filling fields.
   kAdditionalNameInitial,
   kCreditCardExpDate2DigitYear,
   kCreditCardExpDate4DigitYear,
diff --git a/components/autofill_assistant/browser/android/assistant_qr_code_camera_scan_model_wrapper.h b/components/autofill_assistant/browser/android/assistant_qr_code_camera_scan_model_wrapper.h
index 1241acce..491d2f1 100644
--- a/components/autofill_assistant/browser/android/assistant_qr_code_camera_scan_model_wrapper.h
+++ b/components/autofill_assistant/browser/android/assistant_qr_code_camera_scan_model_wrapper.h
@@ -9,6 +9,7 @@
 
 #include "base/android/jni_android.h"
 #include "base/android/scoped_java_ref.h"
+#include "base/memory/raw_ptr.h"
 #include "components/autofill_assistant/browser/android/assistant_qr_code_native_delegate.h"
 
 namespace autofill_assistant {
@@ -34,7 +35,7 @@
       const std::string& camera_preview_security_text) const;
 
  private:
-  JNIEnv* jni_env_;
+  raw_ptr<JNIEnv> jni_env_;
   // Java-side AssistantQrCodeCameraScanModelWrapper object.
   base::android::ScopedJavaGlobalRef<jobject>
       java_assistant_camera_scan_model_wrapper_;
diff --git a/components/autofill_assistant/browser/android/assistant_qr_code_image_picker_model_wrapper.h b/components/autofill_assistant/browser/android/assistant_qr_code_image_picker_model_wrapper.h
index 7332a5c..3c1c4eb 100644
--- a/components/autofill_assistant/browser/android/assistant_qr_code_image_picker_model_wrapper.h
+++ b/components/autofill_assistant/browser/android/assistant_qr_code_image_picker_model_wrapper.h
@@ -9,6 +9,7 @@
 
 #include "base/android/jni_android.h"
 #include "base/android/scoped_java_ref.h"
+#include "base/memory/raw_ptr.h"
 #include "components/autofill_assistant/browser/android/assistant_qr_code_native_delegate.h"
 
 namespace autofill_assistant {
@@ -30,7 +31,7 @@
       const std::string& open_settings_button_text) const;
 
  private:
-  JNIEnv* jni_env_;
+  raw_ptr<JNIEnv> jni_env_;
   // Java-side AssistantQrCodeImagePickerModelWrapper object.
   base::android::ScopedJavaGlobalRef<jobject>
       java_assistant_image_picker_model_wrapper_;
diff --git a/components/autofill_assistant/browser/starter_unittest.cc b/components/autofill_assistant/browser/starter_unittest.cc
index 5a6d94d..aa1ad64 100644
--- a/components/autofill_assistant/browser/starter_unittest.cc
+++ b/components/autofill_assistant/browser/starter_unittest.cc
@@ -250,7 +250,7 @@
   raw_ptr<TriggerScriptCoordinator> trigger_script_coordinator_ = nullptr;
 
   signin::IdentityTestEnvironment identity_test_environment;
-  signin::IdentityManager* identity_manager_ =
+  raw_ptr<signin::IdentityManager> identity_manager_ =
       identity_test_environment.identity_manager();
   FakeStarterPlatformDelegate fake_platform_delegate_ =
       FakeStarterPlatformDelegate(
diff --git a/components/blocked_content/popup_navigation_delegate.h b/components/blocked_content/popup_navigation_delegate.h
index 814e2c5..55ea3357 100644
--- a/components/blocked_content/popup_navigation_delegate.h
+++ b/components/blocked_content/popup_navigation_delegate.h
@@ -5,6 +5,7 @@
 #ifndef COMPONENTS_BLOCKED_CONTENT_POPUP_NAVIGATION_DELEGATE_H_
 #define COMPONENTS_BLOCKED_CONTENT_POPUP_NAVIGATION_DELEGATE_H_
 
+#include "base/memory/raw_ptr.h"
 #include "third_party/abseil-cpp/absl/types/optional.h"
 #include "third_party/blink/public/mojom/window_features/window_features.mojom-forward.h"
 #include "ui/base/window_open_disposition.h"
@@ -36,7 +37,7 @@
 
   // Performs the navigation.
   struct NavigateResult {
-    content::WebContents* navigated_or_inserted_contents = nullptr;
+    raw_ptr<content::WebContents> navigated_or_inserted_contents = nullptr;
     WindowOpenDisposition disposition = WindowOpenDisposition::UNKNOWN;
   };
   virtual NavigateResult NavigateWithGesture(
diff --git a/components/bookmarks/browser/bookmark_model.cc b/components/bookmarks/browser/bookmark_model.cc
index 54e71ba..ac0cc09 100644
--- a/components/bookmarks/browser/bookmark_model.cc
+++ b/components/bookmarks/browser/bookmark_model.cc
@@ -68,7 +68,7 @@
   }
 
  private:
-  BookmarkClient* client_;
+  raw_ptr<BookmarkClient> client_;
 };
 
 // Comparator used when sorting bookmarks. Folders are sorted first, then
@@ -92,7 +92,7 @@
   }
 
  private:
-  icu::Collator* collator_;
+  raw_ptr<icu::Collator> collator_;
 };
 
 // Delegate that does nothing.
diff --git a/components/browser_ui/site_settings/android/java/src/org/chromium/components/browser_ui/site_settings/AddExceptionPreference.java b/components/browser_ui/site_settings/android/java/src/org/chromium/components/browser_ui/site_settings/AddExceptionPreference.java
index 86760d6..41e7c844 100644
--- a/components/browser_ui/site_settings/android/java/src/org/chromium/components/browser_ui/site_settings/AddExceptionPreference.java
+++ b/components/browser_ui/site_settings/android/java/src/org/chromium/components/browser_ui/site_settings/AddExceptionPreference.java
@@ -124,9 +124,8 @@
         LayoutInflater inflater =
                 (LayoutInflater) getContext().getSystemService(Context.LAYOUT_INFLATER_SERVICE);
         View view = inflater.inflate(R.layout.add_site_dialog, null);
-        final EditText input = (EditText) view.findViewById(R.id.site);
-        final CheckBoxWithDescription checkBox =
-                (CheckBoxWithDescription) view.findViewById(R.id.add_site_dialog_checkbox);
+        final EditText input = view.findViewById(R.id.site);
+        final CheckBoxWithDescription checkBox = view.findViewById(R.id.add_site_dialog_checkbox);
 
         if (mCategory.getType() == SiteSettingsCategory.Type.COOKIES) {
             checkBox.setVisibility(View.VISIBLE);
@@ -218,32 +217,36 @@
 
     @VisibleForTesting
     static String updatePatternIfNeeded(@NonNull String pattern, int type, boolean isChecked) {
-        if (type != SiteSettingsCategory.Type.REQUEST_DESKTOP_SITE) {
-            return pattern;
+        if (type == SiteSettingsCategory.Type.REQUEST_DESKTOP_SITE) {
+            if (isChecked) {
+                return WebsitePreferenceBridge.toDomainWildcardPattern(pattern);
+            } else {
+                return WebsitePreferenceBridge.toHostOnlyPattern(pattern);
+            }
         }
-        if (isChecked) {
-            return WebsitePreferenceBridge.toDomainWildcardPattern(pattern);
-        } else {
-            return WebsitePreferenceBridge.toHostOnlyPattern(pattern);
-        }
+        return pattern;
     }
 
     @VisibleForTesting
     static String getPrimaryPattern(@NonNull String pattern, int type, boolean isChecked) {
-        if (type != SiteSettingsCategory.Type.COOKIES) {
-            return pattern;
+        if (type == SiteSettingsCategory.Type.COOKIES) {
+            // If a user clicks the third party checkbox, set wildcard as primary.
+            return isChecked ? SITE_WILDCARD : pattern;
+        } else if (type == SiteSettingsCategory.Type.THIRD_PARTY_COOKIES) {
+            return SITE_WILDCARD;
         }
-        // If a user clicks the third party checkbox, set wildcard as primary.
-        return isChecked ? SITE_WILDCARD : pattern;
+        return pattern;
     }
 
     @VisibleForTesting
     static String getSecondaryPattern(@NonNull String pattern, int type, boolean isChecked) {
-        if (type != SiteSettingsCategory.Type.COOKIES) {
-            return SITE_WILDCARD;
+        if (type == SiteSettingsCategory.Type.COOKIES) {
+            // If a user clicks the third party checkbox, set pattern as secondary.
+            return isChecked ? pattern : SITE_WILDCARD;
+        } else if (type == SiteSettingsCategory.Type.THIRD_PARTY_COOKIES) {
+            return pattern;
         }
-        // If a user clicks the third party checkbox, set pattern as secondary.
-        return isChecked ? pattern : SITE_WILDCARD;
+        return SITE_WILDCARD;
     }
 
     @VisibleForTesting
diff --git a/components/browser_ui/site_settings/android/java/src/org/chromium/components/browser_ui/site_settings/SingleCategorySettings.java b/components/browser_ui/site_settings/android/java/src/org/chromium/components/browser_ui/site_settings/SingleCategorySettings.java
index 5380d81d..0fcef18 100644
--- a/components/browser_ui/site_settings/android/java/src/org/chromium/components/browser_ui/site_settings/SingleCategorySettings.java
+++ b/components/browser_ui/site_settings/android/java/src/org/chromium/components/browser_ui/site_settings/SingleCategorySettings.java
@@ -810,6 +810,9 @@
                 allowSpecifyingExceptions = ContentFeatureList.isEnabled(
                         ContentFeatureList.REQUEST_DESKTOP_SITE_EXCEPTIONS);
                 break;
+            case SiteSettingsCategory.Type.THIRD_PARTY_COOKIES:
+                allowSpecifyingExceptions = getCookieControlsMode() != CookieControlsMode.OFF;
+                break;
             default:
                 break;
         }
@@ -858,12 +861,9 @@
             }
         } else {
             // Group sites into Allowed/Blocked lists.
-            PreferenceGroup allowedGroup =
-                    (PreferenceGroup) getPreferenceScreen().findPreference(ALLOWED_GROUP);
-            PreferenceGroup blockedGroup =
-                    (PreferenceGroup) getPreferenceScreen().findPreference(BLOCKED_GROUP);
-            PreferenceGroup managedGroup =
-                    (PreferenceGroup) getPreferenceScreen().findPreference(MANAGED_GROUP);
+            PreferenceGroup allowedGroup = getPreferenceScreen().findPreference(ALLOWED_GROUP);
+            PreferenceGroup blockedGroup = getPreferenceScreen().findPreference(BLOCKED_GROUP);
+            PreferenceGroup managedGroup = getPreferenceScreen().findPreference(MANAGED_GROUP);
 
             Set<String> delegatedOrigins =
                     mCategory.getType() == SiteSettingsCategory.Type.NOTIFICATIONS
@@ -997,7 +997,7 @@
             case GlobalToggleLayout.TRI_STATE_COOKIE_TOGGLE:
                 TriStateCookieSettingsPreference triStateCookieToggle =
                         getPreferenceScreen().findPreference(TRI_STATE_COOKIE_TOGGLE);
-                return triStateCookieToggle.getState() == CookieControlsMode.BLOCK_THIRD_PARTY;
+                return triStateCookieToggle.getState() != CookieControlsMode.OFF;
             case GlobalToggleLayout.BINARY_TOGGLE:
                 ChromeSwitchPreference binaryToggle =
                         getPreferenceScreen().findPreference(BINARY_TOGGLE_KEY);
@@ -1251,8 +1251,7 @@
 
         // The notifications vibrate checkbox.
         ChromeBaseCheckBoxPreference vibratePref =
-                (ChromeBaseCheckBoxPreference) getPreferenceScreen().findPreference(
-                        NOTIFICATIONS_VIBRATE_TOGGLE_KEY);
+                getPreferenceScreen().findPreference(NOTIFICATIONS_VIBRATE_TOGGLE_KEY);
         if (vibratePref != null) vibratePref.setEnabled(categoryEnabled);
 
         if (!getSiteSettingsDelegate().isQuietNotificationPromptsFeatureEnabled()) return;
diff --git a/components/browser_ui/site_settings/android/java/src/org/chromium/components/browser_ui/site_settings/Website.java b/components/browser_ui/site_settings/android/java/src/org/chromium/components/browser_ui/site_settings/Website.java
index b713b70..5456f3d 100644
--- a/components/browser_ui/site_settings/android/java/src/org/chromium/components/browser_ui/site_settings/Website.java
+++ b/components/browser_ui/site_settings/android/java/src/org/chromium/components/browser_ui/site_settings/Website.java
@@ -86,7 +86,7 @@
                 && !mEmbedder.getTitle().equals(SITE_WILDCARD);
     }
 
-    private WebsiteAddress getMainAddress() {
+    public WebsiteAddress getMainAddress() {
         if (representsThirdPartiesOnSite()) {
             return mEmbedder;
         }
diff --git a/components/browser_ui/site_settings/android/java/src/org/chromium/components/browser_ui/site_settings/WebsitePreference.java b/components/browser_ui/site_settings/android/java/src/org/chromium/components/browser_ui/site_settings/WebsitePreference.java
index 3fd415b3..aa4dbc3 100644
--- a/components/browser_ui/site_settings/android/java/src/org/chromium/components/browser_ui/site_settings/WebsitePreference.java
+++ b/components/browser_ui/site_settings/android/java/src/org/chromium/components/browser_ui/site_settings/WebsitePreference.java
@@ -80,7 +80,7 @@
      * Returns the url of the site to fetch a favicon for.
      */
     private GURL faviconUrl() {
-        String origin = mSite.getAddress().getOrigin();
+        String origin = mSite.getMainAddress().getOrigin();
         GURL uri = new GURL(origin);
         return UrlUtilities.clearPort(uri);
     }
diff --git a/components/content_settings/core/browser/content_settings_registry.cc b/components/content_settings/core/browser/content_settings_registry.cc
index 4ebd526..d9ca68a 100644
--- a/components/content_settings/core/browser/content_settings_registry.cc
+++ b/components/content_settings/core/browser/content_settings_registry.cc
@@ -555,8 +555,7 @@
   Register(ContentSettingsType::PRIVATE_NETWORK_GUARD, "private-network-guard",
            CONTENT_SETTING_ASK, WebsiteSettingsInfo::UNSYNCABLE,
            /*allowlisted_schemes=*/{},
-           /*valid_settings=*/{CONTENT_SETTING_BLOCK, CONTENT_SETTING_ASK,
-                         CONTENT_SETTING_SESSION_ONLY},
+           /*valid_settings=*/{CONTENT_SETTING_BLOCK, CONTENT_SETTING_ASK},
            WebsiteSettingsInfo::TOP_ORIGIN_ONLY_SCOPE,
            WebsiteSettingsRegistry::DESKTOP |
                WebsiteSettingsRegistry::PLATFORM_ANDROID,
diff --git a/components/content_settings/core/browser/content_settings_registry_unittest.cc b/components/content_settings/core/browser/content_settings_registry_unittest.cc
index af097a0..aa17532e 100644
--- a/components/content_settings/core/browser/content_settings_registry_unittest.cc
+++ b/components/content_settings/core/browser/content_settings_registry_unittest.cc
@@ -98,6 +98,20 @@
   // Check the WebsiteSettingsInfo is registered correctly.
   EXPECT_EQ(website_settings_registry()->Get(ContentSettingsType::COOKIES),
             website_settings_info);
+
+  // Check that PRIVATE_NETWORK_GUARD is registered correctly.
+#if !BUILDFLAG(IS_IOS)
+  info = registry()->Get(ContentSettingsType::PRIVATE_NETWORK_GUARD);
+  ASSERT_TRUE(info);
+
+  // Check the other properties are populated correctly.
+  EXPECT_TRUE(info->IsSettingValid(CONTENT_SETTING_BLOCK));
+  EXPECT_TRUE(info->IsSettingValid(CONTENT_SETTING_ASK));
+  EXPECT_FALSE(info->IsSettingValid(CONTENT_SETTING_SESSION_ONLY));
+  EXPECT_FALSE(info->IsSettingValid(CONTENT_SETTING_ALLOW));
+  EXPECT_EQ(ContentSettingsInfo::INHERIT_IF_LESS_PERMISSIVE,
+            info->incognito_behavior());
+#endif
 }
 
 TEST_F(ContentSettingsRegistryTest, Iteration) {
diff --git a/components/device_signals/core/system_signals/executable_metadata_service_unittest.cc b/components/device_signals/core/system_signals/executable_metadata_service_unittest.cc
index ae026de1..5dfc97ba 100644
--- a/components/device_signals/core/system_signals/executable_metadata_service_unittest.cc
+++ b/components/device_signals/core/system_signals/executable_metadata_service_unittest.cc
@@ -8,6 +8,7 @@
 #include <utility>
 
 #include "base/files/file_path.h"
+#include "base/memory/raw_ptr.h"
 #include "components/device_signals/core/common/common_types.h"
 #include "components/device_signals/core/system_signals/mock_platform_delegate.h"
 #include "components/device_signals/core/system_signals/platform_delegate.h"
@@ -41,7 +42,7 @@
         ExecutableMetadataService::Create(std::move(mock_platform_delegate));
   }
 
-  MockPlatformDelegate* mock_platform_delegate_;
+  raw_ptr<MockPlatformDelegate> mock_platform_delegate_;
   std::unique_ptr<ExecutableMetadataService> executable_metadata_service_;
 };
 
diff --git a/components/device_signals/core/system_signals/file_system_service_unittest.cc b/components/device_signals/core/system_signals/file_system_service_unittest.cc
index 35ec87c..fdcf9903 100644
--- a/components/device_signals/core/system_signals/file_system_service_unittest.cc
+++ b/components/device_signals/core/system_signals/file_system_service_unittest.cc
@@ -10,6 +10,7 @@
 #include "base/files/file_path.h"
 #include "base/files/file_util.h"
 #include "base/files/scoped_temp_dir.h"
+#include "base/memory/raw_ptr.h"
 #include "base/strings/string_number_conversions.h"
 #include "base/strings/string_util.h"
 #include "components/device_signals/core/common/common_types.h"
@@ -92,8 +93,8 @@
         .WillOnce(Return(true));
   }
 
-  testing::StrictMock<MockPlatformDelegate>* mock_platform_delegate_;
-  testing::StrictMock<MockExecutableMetadataService>*
+  raw_ptr<testing::StrictMock<MockPlatformDelegate>> mock_platform_delegate_;
+  raw_ptr<testing::StrictMock<MockExecutableMetadataService>>
       mock_executable_metadata_service_;
   std::unique_ptr<FileSystemService> file_system_service_;
 };
diff --git a/components/dom_distiller/core/distilled_content_store.h b/components/dom_distiller/core/distilled_content_store.h
index 7191632..d4259cf 100644
--- a/components/dom_distiller/core/distilled_content_store.h
+++ b/components/dom_distiller/core/distilled_content_store.h
@@ -11,6 +11,7 @@
 
 #include "base/bind.h"
 #include "base/containers/lru_cache.h"
+#include "base/memory/raw_ptr.h"
 #include "components/dom_distiller/core/article_entry.h"
 #include "components/dom_distiller/core/proto/distilled_article.pb.h"
 
@@ -68,7 +69,7 @@
     void operator()(DistilledArticleProto* proto);
 
    private:
-    InMemoryContentStore* store_;
+    raw_ptr<InMemoryContentStore> store_;
   };
 
   void AddUrlToIdMapping(const ArticleEntry& entry,
diff --git a/components/enterprise/browser/identifiers/profile_id_service_unittest.cc b/components/enterprise/browser/identifiers/profile_id_service_unittest.cc
index 4e035d3..4b66f15f 100644
--- a/components/enterprise/browser/identifiers/profile_id_service_unittest.cc
+++ b/components/enterprise/browser/identifiers/profile_id_service_unittest.cc
@@ -8,6 +8,7 @@
 
 #include "base/base64url.h"
 #include "base/hash/sha1.h"
+#include "base/memory/raw_ptr.h"
 #include "base/test/metrics/histogram_tester.h"
 #include "components/enterprise/browser/identifiers/identifiers_prefs.h"
 #include "components/enterprise/browser/identifiers/mock_profile_id_delegate.h"
@@ -41,7 +42,7 @@
                                                   &profile_prefs_);
   }
 
-  MockProfileIdDelegate* mock_delegate_ = nullptr;
+  raw_ptr<MockProfileIdDelegate> mock_delegate_ = nullptr;
   TestingPrefServiceSimple profile_prefs_;
   std::unique_ptr<ProfileIdService> service_;
   base::HistogramTester histogram_tester_;
diff --git a/components/feed/core/v2/stream_surface_set.h b/components/feed/core/v2/stream_surface_set.h
index 12112c51..628cb79 100644
--- a/components/feed/core/v2/stream_surface_set.h
+++ b/components/feed/core/v2/stream_surface_set.h
@@ -7,6 +7,7 @@
 
 #include <vector>
 
+#include "base/memory/raw_ptr.h"
 #include "base/observer_list.h"
 #include "base/observer_list_types.h"
 #include "components/feed/core/proto/v2/wire/reliability_logging_enums.pb.h"
@@ -23,7 +24,7 @@
   // Entry in the surface set. Holds the surface and information about it.
   struct Entry {
     // The surface.
-    FeedStreamSurface* surface;
+    raw_ptr<FeedStreamSurface> surface;
     // Whether or not the feed content was ever reported as viewed.
     bool feed_viewed = false;
   };
diff --git a/components/gwp_asan/client/sampling_malloc_shims.cc b/components/gwp_asan/client/sampling_malloc_shims.cc
index ed71f43..ae1614b 100644
--- a/components/gwp_asan/client/sampling_malloc_shims.cc
+++ b/components/gwp_asan/client/sampling_malloc_shims.cc
@@ -137,6 +137,15 @@
   return self->next->get_size_estimate_function(self->next, address, context);
 }
 
+bool ClaimedAddressFn(const AllocatorDispatch* self,
+                      void* address,
+                      void* context) {
+  if (UNLIKELY(gpa->PointerIsMine(address)))
+    return true;
+
+  return self->next->claimed_address_function(self->next, address, context);
+}
+
 unsigned BatchMallocFn(const AllocatorDispatch* self,
                        size_t size,
                        void** results,
@@ -185,6 +194,17 @@
   self->next->free_definite_size_function(self->next, address, size, context);
 }
 
+void TryFreeDefaultFn(const AllocatorDispatch* self,
+                      void* address,
+                      void* context) {
+  if (UNLIKELY(gpa->PointerIsMine(address))) {
+    gpa->Deallocate(address);
+    return;
+  }
+
+  self->next->try_free_default_function(self->next, address, context);
+}
+
 static void* AlignedMallocFn(const AllocatorDispatch* self,
                              size_t size,
                              size_t alignment,
@@ -243,9 +263,11 @@
     &ReallocFn,
     &FreeFn,
     &GetSizeEstimateFn,
+    &ClaimedAddressFn,
     &BatchMallocFn,
     &BatchFreeFn,
     &FreeDefiniteSizeFn,
+    &TryFreeDefaultFn,
     &AlignedMallocFn,
     &AlignedReallocFn,
     &AlignedFreeFn,
diff --git a/components/metrics/metrics_logs_event_manager.h b/components/metrics/metrics_logs_event_manager.h
index 26983ce..f8d18f8 100644
--- a/components/metrics/metrics_logs_event_manager.h
+++ b/components/metrics/metrics_logs_event_manager.h
@@ -5,6 +5,7 @@
 #ifndef COMPONENTS_METRICS_METRICS_LOGS_EVENT_MANAGER_H_
 #define COMPONENTS_METRICS_METRICS_LOGS_EVENT_MANAGER_H_
 
+#include "base/memory/raw_ptr.h"
 #include "base/observer_list.h"
 #include "base/strings/string_piece.h"
 #include "components/metrics/metrics_log.h"
@@ -58,7 +59,7 @@
     ~ScopedNotifyLogType();
 
    private:
-    MetricsLogsEventManager* const logs_event_manager_;
+    const raw_ptr<MetricsLogsEventManager> logs_event_manager_;
 
     // Used to ensure that only one instance of this class exists at a time.
     static bool instance_exists_;
diff --git a/components/metrics/persistent_system_profile.h b/components/metrics/persistent_system_profile.h
index a431a598..1c5a7491 100644
--- a/components/metrics/persistent_system_profile.h
+++ b/components/metrics/persistent_system_profile.h
@@ -7,6 +7,7 @@
 
 #include <vector>
 
+#include "base/memory/raw_ptr.h"
 #include "base/strings/string_piece.h"
 #include "base/threading/thread_checker.h"
 #include "third_party/metrics_proto/system_profile.pb.h"
@@ -114,7 +115,7 @@
     bool ReadData(RecordType* type, std::string* record) const;
 
     // This never changes but can't be "const" because vector calls operator=().
-    base::PersistentMemoryAllocator* allocator_;  // Storage location.
+    raw_ptr<base::PersistentMemoryAllocator> allocator_;  // Storage location.
 
     // Indicates if a complete profile has been stored.
     bool has_complete_profile_;
diff --git a/components/omnibox/browser/history_quick_provider.h b/components/omnibox/browser/history_quick_provider.h
index 7762e3e..ff542ea 100644
--- a/components/omnibox/browser/history_quick_provider.h
+++ b/components/omnibox/browser/history_quick_provider.h
@@ -63,7 +63,7 @@
 
   AutocompleteInput autocomplete_input_;
   raw_ptr<InMemoryURLIndex> in_memory_url_index_;  // Not owned by this class.
-  const TemplateURL* starter_pack_engine_;
+  raw_ptr<const TemplateURL> starter_pack_engine_;
 
   // This provider is disabled when true.
   static bool disabled_;
diff --git a/components/omnibox/browser/history_url_provider.h b/components/omnibox/browser/history_url_provider.h
index 80c4eb85..36ec0fc 100644
--- a/components/omnibox/browser/history_url_provider.h
+++ b/components/omnibox/browser/history_url_provider.h
@@ -189,7 +189,7 @@
   // we aren't allowed to read user preferences from the History sequence.
   const bool allow_deleting_browser_history;
 
-  const TemplateURL* starter_pack_engine;
+  raw_ptr<const TemplateURL> starter_pack_engine;
 };
 
 // This class is an autocomplete provider and is also a pseudo-internal
diff --git a/components/omnibox/browser/omnibox_view.h b/components/omnibox/browser/omnibox_view.h
index 76d3ed3..2aef519e 100644
--- a/components/omnibox/browser/omnibox_view.h
+++ b/components/omnibox/browser/omnibox_view.h
@@ -43,8 +43,8 @@
   // state changes.  See OmniboxEditModel::OnAfterPossibleChange().
   struct StateChanges {
     // |old_text| and |new_text| are not owned.
-    const std::u16string* old_text;
-    const std::u16string* new_text;
+    raw_ptr<const std::u16string> old_text;
+    raw_ptr<const std::u16string> new_text;
     size_t new_sel_start;
     size_t new_sel_end;
     bool selection_differs;
diff --git a/components/omnibox/browser/on_device_model_update_listener_unittest.cc b/components/omnibox/browser/on_device_model_update_listener_unittest.cc
index 420fe84..c6304d08 100644
--- a/components/omnibox/browser/on_device_model_update_listener_unittest.cc
+++ b/components/omnibox/browser/on_device_model_update_listener_unittest.cc
@@ -7,6 +7,7 @@
 #include "base/containers/flat_set.h"
 #include "base/files/file_path.h"
 #include "base/files/file_util.h"
+#include "base/memory/raw_ptr.h"
 #include "base/path_service.h"
 #include "base/strings/string_util.h"
 #include "base/test/task_environment.h"
@@ -42,7 +43,7 @@
   }
 
   base::test::TaskEnvironment task_environment_;
-  OnDeviceModelUpdateListener* listener_;
+  raw_ptr<OnDeviceModelUpdateListener> listener_;
 };
 
 TEST_F(OnDeviceModelUpdateListenerTest, OnHeadModelUpdate) {
diff --git a/components/optimization_guide/content/browser/page_content_annotations_service.h b/components/optimization_guide/content/browser/page_content_annotations_service.h
index 0a48a92..3a286ccf 100644
--- a/components/optimization_guide/content/browser/page_content_annotations_service.h
+++ b/components/optimization_guide/content/browser/page_content_annotations_service.h
@@ -311,7 +311,7 @@
   // are set.
   std::unique_ptr<PageContentAnnotationsValidator> validator_;
 
-  OptimizationGuideLogger* optimization_guide_logger_ = nullptr;
+  raw_ptr<OptimizationGuideLogger> optimization_guide_logger_ = nullptr;
 
   base::WeakPtrFactory<PageContentAnnotationsService> weak_ptr_factory_{this};
 };
diff --git a/components/page_load_metrics/browser/page_load_metrics_test_waiter.h b/components/page_load_metrics/browser/page_load_metrics_test_waiter.h
index 5d3dbcca..fdc0fc4 100644
--- a/components/page_load_metrics/browser/page_load_metrics_test_waiter.h
+++ b/components/page_load_metrics/browser/page_load_metrics_test_waiter.h
@@ -296,8 +296,6 @@
   State expected_;
   State observed_;
 
-  TimingFieldBitSet observed_page_fields_;
-
   int current_complete_resources_ = 0;
   int64_t current_network_bytes_ = 0;
 
diff --git a/components/page_load_metrics/browser/page_load_metrics_update_dispatcher.cc b/components/page_load_metrics/browser/page_load_metrics_update_dispatcher.cc
index fd0b89c3..7401467 100644
--- a/components/page_load_metrics/browser/page_load_metrics_update_dispatcher.cc
+++ b/components/page_load_metrics/browser/page_load_metrics_update_dispatcher.cc
@@ -53,8 +53,7 @@
 }
 
 internal::PageLoadTimingStatus IsValidPageLoadTiming(
-    const mojom::PageLoadTiming& timing,
-    bool is_prerendered) {
+    const mojom::PageLoadTiming& timing) {
   if (page_load_metrics::IsEmpty(timing))
     return internal::INVALID_EMPTY_TIMING;
 
@@ -66,6 +65,18 @@
 
   // Verify proper ordering between the various timings.
 
+  // Note for activation_start
+  //
+  // PaintTiming is composed in MetricsRenderFrameObserver::GetTiming,
+  // which also clamps wall clocks as navigation_start origin.
+  // Majority of wall clocks are taken in render side, but
+  // activation_start is taken in browser side
+  // PageImpl::ActivateForPrerendering. Besides, there is no control
+  // of these events. Therefore, we don't have any order relations
+  // between activation_start and others except for navigation_start.
+  // (Always 0 = navigation_start <= activation_start for main frames as
+  // navigation_start origin TimeDelta.)
+
   if (!EventsInOrder(timing.response_start, timing.parse_timing->parse_start)) {
     // We sometimes get a zero response_start with a non-zero parse start. See
     // crbug.com/590212.
@@ -151,30 +162,11 @@
     return internal::INVALID_ORDER_DOM_CONTENT_LOADED_LOAD;
   }
 
-  // If the page is prerendered, `parse_start <= activation_start <=
-  // first_paint`.
-  // If the page is non prerendered, `parse_start <= first_paint`.
-  if (is_prerendered) {
-    if (!EventsInOrder(timing.parse_timing->parse_start,
-                       timing.activation_start)) {
-      LOG(ERROR) << "Invalid parse_start " << timing.parse_timing->parse_start
-                 << " for activation_start " << timing.activation_start;
-      return internal::INVALID_ORDER_PARSE_START_ACTIVATION_START;
-    }
-
-    if (!EventsInOrder(timing.activation_start,
-                       timing.paint_timing->first_paint)) {
-      LOG(ERROR) << "Invalid activation_start " << timing.activation_start
-                 << " for first_paint " << timing.paint_timing->first_paint;
-      return internal::INVALID_ORDER_ACTIVATION_START_FIRST_PAINT;
-    }
-  } else {
-    if (!EventsInOrder(timing.parse_timing->parse_start,
-                       timing.paint_timing->first_paint)) {
-      LOG(ERROR) << "Invalid parse_start " << timing.parse_timing->parse_start
-                 << " for first_paint " << timing.paint_timing->first_paint;
-      return internal::INVALID_ORDER_PARSE_START_FIRST_PAINT;
-    }
+  if (!EventsInOrder(timing.parse_timing->parse_start,
+                     timing.paint_timing->first_paint)) {
+    LOG(ERROR) << "Invalid parse_start " << timing.parse_timing->parse_start
+               << " for first_paint " << timing.paint_timing->first_paint;
+    return internal::INVALID_ORDER_PARSE_START_FIRST_PAINT;
   }
 
   if (!EventsInOrder(timing.paint_timing->first_paint,
@@ -711,10 +703,7 @@
     return;
   }
 
-  const bool is_prerendered =
-      (client_->GetPrerenderingState() != PrerenderingState::kNoPrerendering);
-  internal::PageLoadTimingStatus status =
-      IsValidPageLoadTiming(*new_timing, is_prerendered);
+  internal::PageLoadTimingStatus status = IsValidPageLoadTiming(*new_timing);
   UMA_HISTOGRAM_ENUMERATION(internal::kPageLoadTimingStatus, status,
                             internal::LAST_PAGE_LOAD_TIMING_STATUS);
   if (status != internal::VALID) {
@@ -892,10 +881,8 @@
 
   current_merged_page_timing_ = pending_merged_page_timing_->Clone();
 
-  const bool is_prerendered =
-      (client_->GetPrerenderingState() != PrerenderingState::kNoPrerendering);
   internal::PageLoadTimingStatus status =
-      IsValidPageLoadTiming(*pending_merged_page_timing_, is_prerendered);
+      IsValidPageLoadTiming(*pending_merged_page_timing_);
   UMA_HISTOGRAM_ENUMERATION(internal::kPageLoadTimingDispatchStatus, status,
                             internal::LAST_PAGE_LOAD_TIMING_STATUS);
 
diff --git a/components/page_load_metrics/browser/page_load_metrics_update_dispatcher.h b/components/page_load_metrics/browser/page_load_metrics_update_dispatcher.h
index 66f7386..da954fe 100644
--- a/components/page_load_metrics/browser/page_load_metrics_update_dispatcher.h
+++ b/components/page_load_metrics/browser/page_load_metrics_update_dispatcher.h
@@ -89,7 +89,7 @@
   // Longest input delay cannot be less than first input delay.
   INVALID_LONGEST_INPUT_DELAY_LESS_THAN_FIRST_INPUT_DELAY,
 
-  // Activation start should be occur between parse start and first paint.
+  // Deprecated but not removing because it would affect histogram enumeration.
   INVALID_ORDER_PARSE_START_ACTIVATION_START,
   INVALID_ORDER_ACTIVATION_START_FIRST_PAINT,
 
diff --git a/components/paint_preview/browser/paint_preview_base_service.cc b/components/paint_preview/browser/paint_preview_base_service.cc
index 452f63e..ec2ee18 100644
--- a/components/paint_preview/browser/paint_preview_base_service.cc
+++ b/components/paint_preview/browser/paint_preview_base_service.cc
@@ -37,7 +37,7 @@
   DCHECK_CURRENTLY_ON(content::BrowserThread::UI);
   content::WebContents* web_contents = capture_params.web_contents;
   content::RenderFrameHost* render_frame_host =
-      capture_params.render_frame_host ? capture_params.render_frame_host
+      capture_params.render_frame_host ? capture_params.render_frame_host.get()
                                        : web_contents->GetPrimaryMainFrame();
   if (policy_ && !policy_->SupportedForContents(web_contents)) {
     std::move(callback).Run(CaptureStatus::kContentUnsupported, {});
diff --git a/components/paint_preview/browser/paint_preview_base_service.h b/components/paint_preview/browser/paint_preview_base_service.h
index 7ce8e06..844a364 100644
--- a/components/paint_preview/browser/paint_preview_base_service.h
+++ b/components/paint_preview/browser/paint_preview_base_service.h
@@ -9,6 +9,7 @@
 
 #include "base/bind.h"
 #include "base/callback.h"
+#include "base/memory/raw_ptr.h"
 #include "base/memory/weak_ptr.h"
 #include "base/task/sequenced_task_runner.h"
 #include "base/time/time.h"
@@ -50,7 +51,7 @@
   };
 
   struct CaptureParams {
-    content::WebContents* web_contents = nullptr;
+    raw_ptr<content::WebContents> web_contents = nullptr;
 
     // In case of specifying, an individual |render_frame_host| and its
     // descendents will be captured. In case of nullptr, full page contents will
@@ -59,7 +60,7 @@
     // Generally, leaving this as nullptr is what you should be doing for most
     // features. Specifying a |render_frame_host| is intended for capturing
     // individual subframes and should be used for only a few use cases.
-    content::RenderFrameHost* render_frame_host = nullptr;
+    raw_ptr<content::RenderFrameHost> render_frame_host = nullptr;
 
     // Store artifacts in the file system or in memory buffers.
     RecordingPersistence persistence;
@@ -73,7 +74,7 @@
     // - a number of SKPs listed as <guid>.skp (one per frame)
     //
     // Will be ignored if persistence = kMemoryBuffer
-    const base::FilePath* root_dir = nullptr;
+    raw_ptr<const base::FilePath> root_dir = nullptr;
 
     // The captured area is clipped to |clip_rect| if it is non-zero.
     gfx::Rect clip_rect;
diff --git a/components/password_manager/core/browser/android_affiliation/affiliation_database.cc b/components/password_manager/core/browser/android_affiliation/affiliation_database.cc
index ab7990ec..ecfbd07f 100644
--- a/components/password_manager/core/browser/android_affiliation/affiliation_database.cc
+++ b/components/password_manager/core/browser/android_affiliation/affiliation_database.cc
@@ -15,6 +15,7 @@
 #include "base/containers/flat_set.h"
 #include "base/files/file_path.h"
 #include "base/logging.h"
+#include "base/memory/raw_ptr.h"
 #include "build/build_config.h"
 #include "sql/database.h"
 #include "sql/error_delegate_util.h"
@@ -36,9 +37,9 @@
 // Struct to hold table builder for "eq_classes", "eq_class_members",
 // and "eq_class_groups" tables.
 struct SQLTableBuilders {
-  SQLTableBuilder* eq_classes;
-  SQLTableBuilder* eq_class_members;
-  SQLTableBuilder* eq_class_groups;
+  raw_ptr<SQLTableBuilder> eq_classes;
+  raw_ptr<SQLTableBuilder> eq_class_members;
+  raw_ptr<SQLTableBuilder> eq_class_groups;
 };
 
 // Seals the version of the given builders. This is method should be always used
diff --git a/components/password_manager/core/browser/form_parsing/form_parser.cc b/components/password_manager/core/browser/form_parsing/form_parser.cc
index cb03e05..560f8df 100644
--- a/components/password_manager/core/browser/form_parsing/form_parser.cc
+++ b/components/password_manager/core/browser/form_parsing/form_parser.cc
@@ -14,6 +14,7 @@
 
 #include "base/containers/contains.h"
 #include "base/feature_list.h"
+#include "base/memory/raw_ptr.h"
 #include "base/metrics/histogram_functions.h"
 #include "base/ranges/algorithm.h"
 #include "base/strings/string_piece.h"
@@ -204,7 +205,7 @@
 // A helper struct that is used to capture significant fields to be used for
 // the construction of a PasswordForm.
 struct SignificantFields {
-  const FormFieldData* username = nullptr;
+  raw_ptr<const FormFieldData> username = nullptr;
   const FormFieldData* password = nullptr;
   const FormFieldData* new_password = nullptr;
   const FormFieldData* confirmation_password = nullptr;
@@ -295,7 +296,7 @@
       std::find_if(std::next(new_password_field), processed_fields.end(),
                    MatchesNewPasswordField);
   return confirmation_password_field != processed_fields.end()
-             ? confirmation_password_field->field
+             ? confirmation_password_field->field.get()
              : nullptr;
 }
 
diff --git a/components/password_manager/core/browser/form_parsing/form_parser.h b/components/password_manager/core/browser/form_parsing/form_parser.h
index 2620395..ff3ab7d 100644
--- a/components/password_manager/core/browser/form_parsing/form_parser.h
+++ b/components/password_manager/core/browser/form_parsing/form_parser.h
@@ -9,6 +9,7 @@
 #include <utility>
 #include <vector>
 
+#include "base/memory/raw_ptr.h"
 #include "components/password_manager/core/browser/form_parsing/password_field_prediction.h"
 #include "third_party/abseil-cpp/absl/types/optional.h"
 #include "url/gurl.h"
@@ -47,7 +48,7 @@
 // parsing.
 struct ProcessedField {
   // This points to the wrapped FormFieldData.
-  const autofill::FormFieldData* field;
+  raw_ptr<const autofill::FormFieldData> field;
 
   // The flag derived from field->autocomplete_attribute.
   AutocompleteFlag autocomplete_flag = AutocompleteFlag::kNone;
diff --git a/components/password_manager/core/browser/login_database.cc b/components/password_manager/core/browser/login_database.cc
index 53415ba..cbbdb909 100644
--- a/components/password_manager/core/browser/login_database.cc
+++ b/components/password_manager/core/browser/login_database.cc
@@ -181,11 +181,11 @@
 // Struct to hold table builder for "logins", "insecure_credentials",
 // "sync_entities_metadata", and "sync_model_metadata" tables.
 struct SQLTableBuilders {
-  SQLTableBuilder* logins;
-  SQLTableBuilder* insecure_credentials;
-  SQLTableBuilder* password_notes;
-  SQLTableBuilder* sync_entities_metadata;
-  SQLTableBuilder* sync_model_metadata;
+  raw_ptr<SQLTableBuilder> logins;
+  raw_ptr<SQLTableBuilder> insecure_credentials;
+  raw_ptr<SQLTableBuilder> password_notes;
+  raw_ptr<SQLTableBuilder> sync_entities_metadata;
+  raw_ptr<SQLTableBuilder> sync_model_metadata;
 };
 
 base::span<const uint8_t> PickleToSpan(const base::Pickle& pickle) {
diff --git a/components/password_manager/core/browser/password_save_manager_impl.h b/components/password_manager/core/browser/password_save_manager_impl.h
index 100d92a3..0db2ee8d 100644
--- a/components/password_manager/core/browser/password_save_manager_impl.h
+++ b/components/password_manager/core/browser/password_save_manager_impl.h
@@ -147,8 +147,8 @@
     PendingCredentialsState profile_store_state = PendingCredentialsState::NONE;
     PendingCredentialsState account_store_state = PendingCredentialsState::NONE;
 
-    const PasswordForm* similar_saved_form_from_profile_store = nullptr;
-    const PasswordForm* similar_saved_form_from_account_store = nullptr;
+    raw_ptr<const PasswordForm> similar_saved_form_from_profile_store = nullptr;
+    raw_ptr<const PasswordForm> similar_saved_form_from_account_store = nullptr;
   };
   static PendingCredentialsStates ComputePendingCredentialsStates(
       const PasswordForm& parsed_submitted_form,
diff --git a/components/performance_manager/performance_manager_tab_helper.cc b/components/performance_manager/performance_manager_tab_helper.cc
index 2e2f6a2..90212df 100644
--- a/components/performance_manager/performance_manager_tab_helper.cc
+++ b/components/performance_manager/performance_manager_tab_helper.cc
@@ -282,28 +282,21 @@
       FROM_HERE, base::BindOnce(
                      [](FrameNodeImpl* old_frame, FrameNodeImpl* new_frame) {
                        if (old_frame) {
-                         // Prerendering is a special case where,
-                         // old_frame->is_current() would be set to false.
-                         // Ignore this check when Prerender2 is enabled.
-                         // TODO(https://crbug.com/1177859): Remove this check
-                         // once PerformanceManagerTabHelper is supported with
-                         // Prerender2.
-                         DCHECK(blink::features::IsPrerender2Enabled() ||
-                                old_frame->is_current());
+                         // Prerendering is a special case where
+                         // old_frame->is_current() may be false.
+                         // TODO(https://crbug.com/1211368): assert that
+                         // old_frame->is_current() or its PageState is
+                         // kPrerendering.
                          old_frame->SetIsCurrent(false);
                        }
+
                        if (new_frame) {
-                         if (!new_frame->is_current()) {
-                           new_frame->SetIsCurrent(true);
-                         } else {
-                           // The very first frame to be created is already
-                           // current by default. In which case the swap must be
-                           // from no frame to a frame.
-                           // TODO(https://crbug.com/1179682): Make this
-                           // compatible with MPArch.
-                           DCHECK(!old_frame ||
-                                  blink::features::IsPrerender2Enabled());
-                         }
+                         // The very first frame to be created is already
+                         // current by default except in the special case of
+                         // prerendering.
+                         // TODO(https://crbug.com/1211368): assert that
+                         // old_frame is null or its PageState is kPrerendering.
+                         new_frame->SetIsCurrent(true);
                        }
                      },
                      old_frame, new_frame));
diff --git a/components/permissions/unused_site_permissions_service.h b/components/permissions/unused_site_permissions_service.h
index b8301850..abaa104 100644
--- a/components/permissions/unused_site_permissions_service.h
+++ b/components/permissions/unused_site_permissions_service.h
@@ -8,6 +8,7 @@
 #include <list>
 #include <map>
 #include "base/callback_forward.h"
+#include "base/memory/raw_ptr.h"
 #include "base/memory/scoped_refptr.h"
 #include "base/memory/weak_ptr.h"
 #include "base/time/clock.h"
@@ -103,7 +104,7 @@
 
   const scoped_refptr<HostContentSettingsMap> hcsm_;
 
-  base::Clock* clock_;
+  raw_ptr<base::Clock> clock_;
 };
 
 }  // namespace permissions
diff --git a/components/policy/core/browser/policy_error_map_unittest.cc b/components/policy/core/browser/policy_error_map_unittest.cc
index 9949eb0..6313437 100644
--- a/components/policy/core/browser/policy_error_map_unittest.cc
+++ b/components/policy/core/browser/policy_error_map_unittest.cc
@@ -4,6 +4,7 @@
 
 #include "components/policy/core/browser/policy_error_map.h"
 
+#include "base/memory/raw_ptr.h"
 #include "components/strings/grit/components_strings.h"
 #include "testing/gtest/include/gtest/gtest.h"
 #include "ui/base/resource/resource_bundle.h"
@@ -34,7 +35,7 @@
 
  private:
   bool has_resource_bundle_;
-  ui::ResourceBundle* original_resource_bundle_;
+  raw_ptr<ui::ResourceBundle> original_resource_bundle_;
 };
 
 TEST_P(PolicyErrorMapTestResourceBundle, CheckForErrorsWithoutFatalErrors) {
diff --git a/components/policy/core/common/cloud/dmserver_job_configurations.h b/components/policy/core/common/cloud/dmserver_job_configurations.h
index 44cd900..5500cfa 100644
--- a/components/policy/core/common/cloud/dmserver_job_configurations.h
+++ b/components/policy/core/common/cloud/dmserver_job_configurations.h
@@ -9,6 +9,7 @@
 #include <string>
 
 #include "base/callback.h"
+#include "base/memory/raw_ptr.h"
 #include "base/memory/scoped_refptr.h"
 #include "components/policy/core/common/cloud/device_management_service.h"
 #include "components/policy/core/common/cloud/dm_auth.h"
@@ -29,7 +30,7 @@
 // Struct containing the result data for a given job.
 struct DMServerJobResult {
   // Unowned pointer the return value of `DeviceManagementService::CreateJob`.
-  const DeviceManagementService::Job* job = nullptr;
+  raw_ptr<const DeviceManagementService::Job> job = nullptr;
 
   // net::Error value cast to int.
   int net_error = 0;
diff --git a/components/power_bookmarks/core/power_bookmark_service.h b/components/power_bookmarks/core/power_bookmark_service.h
index 27c8666..6d05dbfd 100644
--- a/components/power_bookmarks/core/power_bookmark_service.h
+++ b/components/power_bookmarks/core/power_bookmark_service.h
@@ -10,6 +10,7 @@
 #include "base/files/file_path.h"
 #include "base/functional/callback.h"
 #include "base/guid.h"
+#include "base/memory/raw_ptr.h"
 #include "base/threading/sequence_bound.h"
 #include "components/bookmarks/browser/base_bookmark_model_observer.h"
 #include "components/keyed_service/core/keyed_service.h"
@@ -122,7 +123,7 @@
   void BookmarkModelChanged() override {}
 
  private:
-  bookmarks::BookmarkModel* model_;
+  raw_ptr<bookmarks::BookmarkModel> model_;
   base::SequenceBound<PowerBookmarkBackend> backend_;
   scoped_refptr<base::SequencedTaskRunner> backend_task_runner_;
 
diff --git a/components/reporting/health/health_module_unittest.cc b/components/reporting/health/health_module_unittest.cc
index 3064535..8f5fdff9 100644
--- a/components/reporting/health/health_module_unittest.cc
+++ b/components/reporting/health/health_module_unittest.cc
@@ -6,6 +6,7 @@
 
 #include <utility>
 
+#include "base/memory/raw_ptr.h"
 #include "base/memory/scoped_refptr.h"
 #include "base/strings/strcat.h"
 #include "base/task/thread_pool.h"
@@ -65,7 +66,7 @@
   base::test::TaskEnvironment task_environment_;
 
   std::unique_ptr<MockHealthModuleDelegate> delegate_;
-  MockHealthModuleDelegate* mock_delegate_ = nullptr;
+  raw_ptr<MockHealthModuleDelegate> mock_delegate_ = nullptr;
   scoped_refptr<HealthModule> module_;
 };
 
diff --git a/components/reporting/storage/storage_queue_unittest.cc b/components/reporting/storage/storage_queue_unittest.cc
index 5b6792a9..321ad92 100644
--- a/components/reporting/storage/storage_queue_unittest.cc
+++ b/components/reporting/storage/storage_queue_unittest.cc
@@ -561,7 +561,7 @@
     const int64_t uploader_id_;
 
     absl::optional<int64_t> generation_id_;
-    absl::optional<int64_t>* const last_upload_generation_id_;
+    const raw_ptr<absl::optional<int64_t>> last_upload_generation_id_;
     const raw_ptr<LastRecordDigestMap> last_record_digest_map_;
 
     const raw_ptr<const MockUpload> mock_upload_;
diff --git a/components/reporting/storage/storage_unittest.cc b/components/reporting/storage/storage_unittest.cc
index 8257fe4..9002503 100644
--- a/components/reporting/storage/storage_unittest.cc
+++ b/components/reporting/storage/storage_unittest.cc
@@ -757,7 +757,7 @@
     const int64_t uploader_id_;
 
     absl::optional<int64_t> generation_id_;
-    base::flat_map<Priority, int64_t>* const last_upload_generation_id_;
+    const raw_ptr<base::flat_map<Priority, int64_t>> last_upload_generation_id_;
     const raw_ptr<LastRecordDigestMap> last_record_digest_map_;
 
     const raw_ptr<const MockUpload> mock_upload_;
diff --git a/components/reporting/util/refcounted_closure_list_unittest.cc b/components/reporting/util/refcounted_closure_list_unittest.cc
index 8de87309..32b82bc8 100644
--- a/components/reporting/util/refcounted_closure_list_unittest.cc
+++ b/components/reporting/util/refcounted_closure_list_unittest.cc
@@ -6,6 +6,7 @@
 #include <memory>
 
 #include "base/callback.h"
+#include "base/memory/raw_ptr.h"
 #include "base/rand_util.h"
 #include "base/task/sequenced_task_runner.h"
 #include "base/task/thread_pool.h"
@@ -36,7 +37,7 @@
     void Run() { (*count_)--; }
 
    private:
-    std::atomic<size_t>* const count_;
+    const raw_ptr<std::atomic<size_t>> count_;
     const scoped_refptr<RefCountedClosureList> callback_;
   };
 
diff --git a/components/segmentation_platform/internal/metadata/metadata_writer.h b/components/segmentation_platform/internal/metadata/metadata_writer.h
index 286a079..cfe76a3 100644
--- a/components/segmentation_platform/internal/metadata/metadata_writer.h
+++ b/components/segmentation_platform/internal/metadata/metadata_writer.h
@@ -87,7 +87,7 @@
       const raw_ptr<const UkmMetricHash> metrics{nullptr};
       const size_t metrics_size{0};
     };
-    const EventAndMetrics* const events{nullptr};
+    const raw_ptr<const EventAndMetrics> events{nullptr};
     const size_t events_size{0};
   };
 
diff --git a/components/signin/public/identity_manager/account_managed_status_finder.cc b/components/signin/public/identity_manager/account_managed_status_finder.cc
index 6957985..0ffebb8 100644
--- a/components/signin/public/identity_manager/account_managed_status_finder.cc
+++ b/components/signin/public/identity_manager/account_managed_status_finder.cc
@@ -121,7 +121,7 @@
     } else {
       // Extended account info isn't (fully) available yet. Observe the
       // IdentityManager to get notified once it is.
-      identity_manager_observation_.Observe(identity_manager_);
+      identity_manager_observation_.Observe(identity_manager_.get());
       callback_ = std::move(async_callback);
       // TODO(crbug.com/1378553): Add a timeout mechanism.
     }
diff --git a/components/signin/public/identity_manager/account_managed_status_finder.h b/components/signin/public/identity_manager/account_managed_status_finder.h
index cf74661..132967f 100644
--- a/components/signin/public/identity_manager/account_managed_status_finder.h
+++ b/components/signin/public/identity_manager/account_managed_status_finder.h
@@ -8,6 +8,7 @@
 #include <string>
 
 #include "base/functional/callback_forward.h"
+#include "base/memory/raw_ptr.h"
 #include "base/scoped_observation.h"
 #include "components/signin/public/identity_manager/account_info.h"
 #include "components/signin/public/identity_manager/identity_manager.h"
@@ -70,7 +71,7 @@
  private:
   void OutcomeDetermined(Outcome type);
 
-  signin::IdentityManager* identity_manager_;
+  raw_ptr<signin::IdentityManager> identity_manager_;
   const CoreAccountInfo account_;
 
   base::ScopedObservation<signin::IdentityManager,
diff --git a/components/sync_bookmarks/bookmark_model_merger.h b/components/sync_bookmarks/bookmark_model_merger.h
index 7f4068e..d4620df 100644
--- a/components/sync_bookmarks/bookmark_model_merger.h
+++ b/components/sync_bookmarks/bookmark_model_merger.h
@@ -117,8 +117,8 @@
   // matched by GUID. They are guaranteed to have the same type and URL (if
   // applicable).
   struct GuidMatch {
-    const bookmarks::BookmarkNode* local_node;
-    const RemoteTreeNode* remote_node;
+    raw_ptr<const bookmarks::BookmarkNode> local_node;
+    raw_ptr<const RemoteTreeNode> remote_node;
   };
 
   // Constructs the remote bookmark tree to be merged. Each entry in the
diff --git a/components/translate/content/browser/partial_translate_manager_unittest.cc b/components/translate/content/browser/partial_translate_manager_unittest.cc
index 10aab523..9b2b76aa 100644
--- a/components/translate/content/browser/partial_translate_manager_unittest.cc
+++ b/components/translate/content/browser/partial_translate_manager_unittest.cc
@@ -5,6 +5,7 @@
 #include "components/translate/content/browser/partial_translate_manager.h"
 
 #include "base/callback_helpers.h"
+#include "base/memory/raw_ptr.h"
 #include "components/contextual_search/core/browser/contextual_search_delegate.h"
 #include "components/contextual_search/core/browser/resolved_search_term.h"
 #include "testing/gtest/include/gtest/gtest.h"
@@ -54,7 +55,7 @@
 
  protected:
   // Owned by manager_.
-  FakeContextualSearchDelegate* delegate_;
+  raw_ptr<FakeContextualSearchDelegate> delegate_;
   std::unique_ptr<PartialTranslateManager> manager_;
 };
 
diff --git a/components/variations/android/variations_seed_bridge.cc b/components/variations/android/variations_seed_bridge.cc
index c47f898..ea8ad42f 100644
--- a/components/variations/android/variations_seed_bridge.cc
+++ b/components/variations/android/variations_seed_bridge.cc
@@ -11,6 +11,7 @@
 #include "base/android/jni_array.h"
 #include "base/android/jni_string.h"
 #include "base/android/jni_weak_ref.h"
+#include "base/time/time.h"
 #include "components/variations/jni/VariationsSeedBridge_jni.h"
 
 using base::android::AttachCurrentThread;
@@ -40,7 +41,7 @@
   }
   seed->signature = ConvertJavaStringToUTF8(j_seed_signature);
   seed->country = ConvertJavaStringToUTF8(j_seed_country);
-  seed->date = static_cast<long>(j_response_date);
+  seed->date = base::Time::FromJavaTime(static_cast<long>(j_response_date));
   seed->is_gzip_compressed = static_cast<bool>(j_is_gzip_compressed);
   return seed;
 }
diff --git a/components/variations/seed_response.h b/components/variations/seed_response.h
index c02da61..6f7b5867 100644
--- a/components/variations/seed_response.h
+++ b/components/variations/seed_response.h
@@ -8,6 +8,7 @@
 #include <string>
 
 #include "base/component_export.h"
+#include "base/time/time.h"
 
 namespace variations {
 
@@ -21,7 +22,7 @@
   std::string data;  // "data" is binary, for which protobuf uses strings.
   std::string signature;
   std::string country;
-  int64_t date;
+  base::Time date;
   bool is_gzip_compressed = false;
 };
 
diff --git a/components/variations/service/ui_string_overrider.cc b/components/variations/service/ui_string_overrider.cc
index 444320f9..5da4fad 100644
--- a/components/variations/service/ui_string_overrider.cc
+++ b/components/variations/service/ui_string_overrider.cc
@@ -32,7 +32,7 @@
   if (!num_resources_)
     return -1;
   const uint32_t* end = resource_hashes_ + num_resources_;
-  const uint32_t* element = std::lower_bound(resource_hashes_, end, hash);
+  const uint32_t* element = std::lower_bound(resource_hashes_.get(), end, hash);
   if (element == end || *element != hash)
     return -1;
   return resource_indices_[element - resource_hashes_];
diff --git a/components/variations/service/ui_string_overrider.h b/components/variations/service/ui_string_overrider.h
index df4abe1..ed6b916 100644
--- a/components/variations/service/ui_string_overrider.h
+++ b/components/variations/service/ui_string_overrider.h
@@ -8,6 +8,8 @@
 #include <stddef.h>
 #include <stdint.h>
 
+#include "base/memory/raw_ptr.h"
+
 namespace variations {
 
 // Provides a mapping from hashes of generated resource names to their IDs. The
@@ -43,8 +45,8 @@
   int GetResourceIndex(uint32_t hash);
 
  private:
-  const uint32_t* const resource_hashes_;
-  const int* const resource_indices_;
+  const raw_ptr<const uint32_t> resource_hashes_;
+  const raw_ptr<const int> resource_indices_;
   size_t const num_resources_;
 };
 
diff --git a/components/variations/service/variations_field_trial_creator_unittest.cc b/components/variations/service/variations_field_trial_creator_unittest.cc
index d6dfcc1..12ae1cd 100644
--- a/components/variations/service/variations_field_trial_creator_unittest.cc
+++ b/components/variations/service/variations_field_trial_creator_unittest.cc
@@ -852,7 +852,7 @@
   initial_seed->data = SerializeSeed(CreateTestSeedWithCountryFilter());
   initial_seed->signature = kTestSeedSignature;
   initial_seed->country = kTestSeedCountry;
-  initial_seed->date = one_day_ago.ToJavaTime();
+  initial_seed->date = one_day_ago;
   initial_seed->is_gzip_compressed = false;
 
   TestVariationsServiceClient variations_service_client;
diff --git a/components/variations/variations_seed_store.cc b/components/variations/variations_seed_store.cc
index d05b808c..69edd74 100644
--- a/components/variations/variations_seed_store.cc
+++ b/components/variations/variations_seed_store.cc
@@ -448,13 +448,12 @@
     return;
   }
 
-  if (initial_seed->date == 0) {
+  if (initial_seed->date.is_null()) {
     RecordFirstRunSeedImportResult(
         FirstRunSeedImportResult::FAIL_INVALID_RESPONSE_DATE);
     LOG(WARNING) << "Missing response date";
     return;
   }
-  base::Time date = base::Time::FromJavaTime(initial_seed->date);
 
   auto done_callback =
       base::BindOnce([](bool store_success, VariationsSeed seed) {
@@ -468,7 +467,7 @@
       });
   StoreSeedData(std::move(initial_seed->data),
                 std::move(initial_seed->signature),
-                std::move(initial_seed->country), date,
+                std::move(initial_seed->country), initial_seed->date,
                 /*is_delta_compressed=*/false, initial_seed->is_gzip_compressed,
                 std::move(done_callback),
                 /*require_synchronous=*/true);
diff --git a/components/variations/variations_seed_store_unittest.cc b/components/variations/variations_seed_store_unittest.cc
index eea2d1f..bb536b7 100644
--- a/components/variations/variations_seed_store_unittest.cc
+++ b/components/variations/variations_seed_store_unittest.cc
@@ -1296,7 +1296,7 @@
   EXPECT_EQ(test_seed_data,          seed->data);
   EXPECT_EQ(test_seed_signature,     seed->signature);
   EXPECT_EQ(test_seed_country,       seed->country);
-  EXPECT_EQ(test_response_date,      seed->date);
+  EXPECT_EQ(test_response_date, seed->date.ToJavaTime());
   EXPECT_EQ(test_is_gzip_compressed, seed->is_gzip_compressed);
 
   android::ClearJavaFirstRunPrefs();
@@ -1304,7 +1304,7 @@
   EXPECT_EQ("", seed->data);
   EXPECT_EQ("", seed->signature);
   EXPECT_EQ("", seed->country);
-  EXPECT_EQ(0, seed->date);
+  EXPECT_EQ(0, seed->date.ToJavaTime());
   EXPECT_FALSE(seed->is_gzip_compressed);
 }
 
@@ -1334,7 +1334,7 @@
   seed->data = seed_data;
   seed->signature = "java_seed_signature";
   seed->country = "java_seed_country";
-  seed->date = 1234554321;
+  seed->date = base::Time::FromJavaTime(test_response_date) + base::Days(1);
   seed->is_gzip_compressed = false;
 
   TestingPrefServiceSimple prefs;
@@ -1348,7 +1348,7 @@
   EXPECT_EQ(test_seed_data, seed->data);
   EXPECT_EQ(test_seed_signature, seed->signature);
   EXPECT_EQ(test_seed_country, seed->country);
-  EXPECT_EQ(test_response_date, seed->date);
+  EXPECT_EQ(test_response_date, seed->date.ToJavaTime());
   EXPECT_EQ(test_is_gzip_compressed, seed->is_gzip_compressed);
   if (use_first_run_prefs) {
     EXPECT_TRUE(android::HasMarkedPrefsForTesting());
diff --git a/components/viz/client/frame_eviction_manager.h b/components/viz/client/frame_eviction_manager.h
index 9c2c4299..8abff6b 100644
--- a/components/viz/client/frame_eviction_manager.h
+++ b/components/viz/client/frame_eviction_manager.h
@@ -14,6 +14,7 @@
 
 #include "base/gtest_prod_util.h"
 #include "base/memory/memory_pressure_listener.h"
+#include "base/memory/raw_ptr.h"
 #include "base/memory/singleton.h"
 #include "base/task/single_thread_task_runner.h"
 #include "base/time/default_tick_clock.h"
@@ -117,7 +118,7 @@
   absl::optional<size_t> pending_unlocked_frame_limit_;
 
   base::RepeatingTimer idle_frames_culling_timer_;
-  const base::TickClock* clock_ = base::DefaultTickClock::GetInstance();
+  raw_ptr<const base::TickClock> clock_ = base::DefaultTickClock::GetInstance();
 };
 
 }  // namespace viz
diff --git a/components/viz/service/debugger/viz_debugger_unittests/viz_debugger_rwlock_unittest.cc b/components/viz/service/debugger/viz_debugger_unittests/viz_debugger_rwlock_unittest.cc
index 9b61423..22b89672 100644
--- a/components/viz/service/debugger/viz_debugger_unittests/viz_debugger_rwlock_unittest.cc
+++ b/components/viz/service/debugger/viz_debugger_unittests/viz_debugger_rwlock_unittest.cc
@@ -2,6 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+#include "base/memory/raw_ptr.h"
 #include "base/threading/platform_thread.h"
 #include "components/viz/service/debugger/rwlock.h"
 #include "testing/gtest/include/gtest/gtest.h"
@@ -25,7 +26,7 @@
 // slate for the reader threads to continue working on.
 class WriterThread : public base::PlatformThread::Delegate {
  private:
-  std::vector<int>* array_;
+  raw_ptr<std::vector<int>> array_;
   int size_;
   volatile int delay_counter = 0;
   static const unsigned kNumWriterTries = 100;
@@ -71,7 +72,7 @@
  private:
   static const unsigned kNumTimeDelay = 100;
   volatile int delay_counter = 0;
-  std::vector<int>* array_;
+  raw_ptr<std::vector<int>> array_;
   int array_index;
 
  public:
diff --git a/components/viz/service/display/overlay_candidate_factory.cc b/components/viz/service/display/overlay_candidate_factory.cc
index 96d07db1..d016121 100644
--- a/components/viz/service/display/overlay_candidate_factory.cc
+++ b/components/viz/service/display/overlay_candidate_factory.cc
@@ -8,6 +8,7 @@
 #include "build/build_config.h"
 #include "cc/base/math_util.h"
 #include "components/viz/common/quads/aggregated_render_pass_draw_quad.h"
+#include "components/viz/common/quads/draw_quad.h"
 #include "components/viz/common/quads/shared_quad_state.h"
 #include "components/viz/common/quads/solid_color_draw_quad.h"
 #include "components/viz/common/quads/texture_draw_quad.h"
@@ -350,7 +351,10 @@
         resource_provider_->GetSurfaceId(resource_id).frame_sink_id();
   }
 
-  if (is_delegated_context_) {
+  // |kAggregatedRenderPass| must be clipped in 'PrepareRenderPassOverlay' as
+  // filters can expand display size.
+  if (is_delegated_context_ &&
+      quad->material != DrawQuad::Material::kAggregatedRenderPass) {
     // The delegate might not support specifying |clip_rect| so if not, apply it
     // to the |display_rect| and |uv_rect| directly.
     if (!supports_clip_rect_) {
diff --git a/components/viz/service/display/overlay_unittest.cc b/components/viz/service/display/overlay_unittest.cc
index d9e399b5..102763a 100644
--- a/components/viz/service/display/overlay_unittest.cc
+++ b/components/viz/service/display/overlay_unittest.cc
@@ -4787,6 +4787,43 @@
   EXPECT_RECTF_NEAR(uv_rect, candidate_list[0].uv_rect, 0.01f);
 }
 
+TEST_F(DelegatedTest, TestClipAggregateRenderPass) {
+  auto pass = CreateRenderPass();
+  const auto kSmallCandidateRect = gfx::Rect(5, 10, 128, 64);
+  const auto kTestClip = gfx::Rect(0, 15, 70, 64);
+
+  AggregatedRenderPassId render_pass_id{3};
+  AggregatedRenderPassDrawQuad* quad =
+      pass->CreateAndAppendDrawQuad<AggregatedRenderPassDrawQuad>();
+  quad->SetNew(pass->shared_quad_state_list.back(), kSmallCandidateRect,
+               kSmallCandidateRect, render_pass_id, kInvalidResourceId,
+               gfx::RectF(), gfx::Size(), gfx::Vector2dF(1, 1), gfx::PointF(),
+               gfx::RectF(), false, 1.0f);
+
+  pass->shared_quad_state_list.back()->clip_rect = kTestClip;
+  // Check for potential candidates.
+  OverlayCandidateList candidate_list;
+  OverlayProcessorInterface::FilterOperationsMap render_pass_filters;
+  OverlayProcessorInterface::FilterOperationsMap render_pass_backdrop_filters;
+  AggregatedRenderPassList pass_list;
+  // AggregatedRenderPass* main_pass = pass.get();
+  SurfaceDamageRectList surface_damage_rect_list;
+  // Simplify by adding full root damage.
+  surface_damage_rect_list.push_back(pass->output_rect);
+  pass_list.push_back(std::move(pass));
+  overlay_processor_->ProcessForOverlays(
+      resource_provider_.get(), &pass_list, GetIdentityColorMatrix(),
+      render_pass_filters, render_pass_backdrop_filters,
+      std::move(surface_damage_rect_list),
+      overlay_processor_->GetDefaultPrimaryPlane(), &candidate_list,
+      &damage_rect_, &content_bounds_);
+
+  EXPECT_EQ(1U, candidate_list.size());
+  EXPECT_RECTF_NEAR(gfx::RectF(kSmallCandidateRect),
+                    candidate_list[0].display_rect, 0.01f);
+  EXPECT_EQ(kTestClip, candidate_list[0].clip_rect.value());
+}
+
 TEST_F(DelegatedTest, TestClipWithPrimary) {
   auto pass = CreateRenderPass();
   // This is a quad with a rect that is twice is large as the primary plane and
diff --git a/components/viz/service/display/skia_renderer.cc b/components/viz/service/display/skia_renderer.cc
index e8662fb..abf7405 100644
--- a/components/viz/service/display/skia_renderer.cc
+++ b/components/viz/service/display/skia_renderer.cc
@@ -39,6 +39,7 @@
 #include "components/viz/common/resources/platform_color.h"
 #include "components/viz/common/resources/resource_format_utils.h"
 #include "components/viz/common/skia_helper.h"
+#include "components/viz/service/debugger/viz_debugger.h"
 #include "components/viz/service/display/delegated_ink_handler.h"
 #include "components/viz/service/display/delegated_ink_point_renderer_skia.h"
 #include "components/viz/service/display/display_resource_provider.h"
@@ -3580,9 +3581,11 @@
   // TODO(rivr): Handle the case where the overlay has an arbitrary transform
   // applied.
   if (absl::holds_alternative<gfx::OverlayTransform>(overlay->transform)) {
-    OverlayCandidate::ApplyClip(
-        *overlay,
-        gfx::RectF(gfx::SizeF(current_frame()->device_viewport_size)));
+    gfx::Rect apply_clip = gfx::Rect(current_frame()->device_viewport_size);
+    if (overlay->clip_rect.has_value())
+      apply_clip.Intersect(overlay->clip_rect.value());
+
+    OverlayCandidate::ApplyClip(*overlay, gfx::RectF(apply_clip));
   }
 #endif  // BUILDFLAG(IS_APPLE)
 }
diff --git a/components/viz/service/display_embedder/skia_output_device_dcomp.cc b/components/viz/service/display_embedder/skia_output_device_dcomp.cc
index bff4c52..2b55622 100644
--- a/components/viz/service/display_embedder/skia_output_device_dcomp.cc
+++ b/components/viz/service/display_embedder/skia_output_device_dcomp.cc
@@ -148,7 +148,7 @@
   int alpha_bits = 0;
   glBindFramebufferEXT(GL_FRAMEBUFFER, 0);
   gr_context->resetContext(kRenderTarget_GrGLBackendState);
-  const auto* version = current_gl->Version;
+  const auto* version = current_gl->Version.get();
   if (version->is_desktop_core_profile) {
     glGetFramebufferAttachmentParameterivEXT(
         GL_FRAMEBUFFER, GL_BACK_LEFT, GL_FRAMEBUFFER_ATTACHMENT_ALPHA_SIZE,
diff --git a/components/viz/service/display_embedder/skia_output_device_gl.cc b/components/viz/service/display_embedder/skia_output_device_gl.cc
index 3069bcf..e733a929 100644
--- a/components/viz/service/display_embedder/skia_output_device_gl.cc
+++ b/components/viz/service/display_embedder/skia_output_device_gl.cc
@@ -109,7 +109,7 @@
   int alpha_bits = 0;
   glBindFramebufferEXT(GL_FRAMEBUFFER, 0);
   gr_context->resetContext(kRenderTarget_GrGLBackendState);
-  const auto* version = current_gl->Version;
+  const auto* version = current_gl->Version.get();
   if (version->is_desktop_core_profile) {
     glGetFramebufferAttachmentParameterivEXT(
         GL_FRAMEBUFFER, GL_BACK_LEFT, GL_FRAMEBUFFER_ATTACHMENT_ALPHA_SIZE,
diff --git a/components/viz/service/display_embedder/skia_output_surface_impl_on_gpu.cc b/components/viz/service/display_embedder/skia_output_surface_impl_on_gpu.cc
index 791d4b7..da6bd86 100644
--- a/components/viz/service/display_embedder/skia_output_surface_impl_on_gpu.cc
+++ b/components/viz/service/display_embedder/skia_output_surface_impl_on_gpu.cc
@@ -61,6 +61,7 @@
 #include "third_party/skia/include/core/SkImageInfo.h"
 #include "third_party/skia/include/core/SkPromiseImageTexture.h"
 #include "third_party/skia/include/core/SkSamplingOptions.h"
+#include "third_party/skia/include/core/SkSwizzle.h"
 #include "third_party/skia/include/core/SkYUVAInfo.h"
 #include "third_party/skia/include/gpu/GrTypes.h"
 #include "ui/gfx/color_space.h"
@@ -2289,15 +2290,30 @@
     gpu::Mailbox mailbox,
     const SkColor4f& color,
     const gfx::ColorSpace& color_space) {
-  // Create a 1x1 pixel span of the colour in RGBA format.
+#if BUILDFLAG(IS_OZONE)
+  auto preferred_solid_color_format = ui::OzonePlatform::GetInstance()
+                                          ->GetSurfaceFactoryOzone()
+                                          ->GetPreferredFormatForSolidColor();
+  if (preferred_solid_color_format)
+    solid_color_image_format_ =
+        GetResourceFormat(preferred_solid_color_format.value());
+#endif
+  DCHECK(solid_color_image_format_ == RGBA_8888 ||
+         solid_color_image_format_ == BGRA_8888);
+  // Create a 1x1 pixel span of the colour in |solid_color_image_format_|.
   gfx::Size size(1, 1);
-  SharedImageFormat si_format = SharedImageFormat::SinglePlane(RGBA_8888);
+  SharedImageFormat si_format =
+      SharedImageFormat::SinglePlane(solid_color_image_format_);
   // Premultiply the SkColor4f to support transparent quads.
   SkColor4f premul{color[0] * color[3], color[1] * color[3],
                    color[2] * color[3], color[3]};
   const uint32_t premul_rgba_bytes = premul.toBytes_RGBA();
+  uint32_t premul_bytes = premul_rgba_bytes;
+  if (solid_color_image_format_ == BGRA_8888) {
+    SkSwapRB(&premul_bytes, &premul_rgba_bytes, 1);
+  }
   auto pixel_span = base::make_span(
-      reinterpret_cast<const uint8_t*>(&premul_rgba_bytes), sizeof(uint32_t));
+      reinterpret_cast<const uint8_t*>(&premul_bytes), sizeof(uint32_t));
 
   // TODO(crbug.com/1360538) Some work is needed to properly support F16 format.
   shared_image_factory_->CreateSharedImage(
diff --git a/components/viz/service/display_embedder/skia_output_surface_impl_on_gpu.h b/components/viz/service/display_embedder/skia_output_surface_impl_on_gpu.h
index 33cc4bb..bc67d09 100644
--- a/components/viz/service/display_embedder/skia_output_surface_impl_on_gpu.h
+++ b/components/viz/service/display_embedder/skia_output_surface_impl_on_gpu.h
@@ -553,6 +553,11 @@
   // destructor.
   base::flat_set<gpu::Mailbox> solid_color_images_;
 
+  // The format that will be used to CreateSolidColorSharedImage(). This should
+  // be either RGBA_8888 by default, or BGRA_8888 if the default is not
+  // supported on Linux.
+  ResourceFormat solid_color_image_format_ = RGBA_8888;
+
   THREAD_CHECKER(thread_checker_);
 
   base::WeakPtr<SkiaOutputSurfaceImplOnGpu> weak_ptr_;
diff --git a/components/viz/service/transitions/transferable_resource_tracker.h b/components/viz/service/transitions/transferable_resource_tracker.h
index 7ddb43c..15a41abc 100644
--- a/components/viz/service/transitions/transferable_resource_tracker.h
+++ b/components/viz/service/transitions/transferable_resource_tracker.h
@@ -10,6 +10,7 @@
 #include <vector>
 
 #include "base/containers/flat_map.h"
+#include "base/memory/raw_ptr.h"
 #include "components/viz/common/resources/release_callback.h"
 #include "components/viz/common/resources/resource_id.h"
 #include "components/viz/common/resources/transferable_resource.h"
@@ -103,7 +104,7 @@
   const uint32_t starting_id_;
   uint32_t next_id_;
 
-  SharedBitmapManager* const shared_bitmap_manager_;
+  const raw_ptr<SharedBitmapManager> shared_bitmap_manager_;
 
   struct TransferableResourceHolder {
     using ResourceReleaseCallback =
diff --git a/components/zoom/zoom_controller.h b/components/zoom/zoom_controller.h
index 4e8c007..87d7463 100644
--- a/components/zoom/zoom_controller.h
+++ b/components/zoom/zoom_controller.h
@@ -84,7 +84,7 @@
           new_zoom_level(new_zoom_level),
           zoom_mode(zoom_mode),
           can_show_bubble(can_show_bubble) {}
-    content::WebContents* web_contents;
+    raw_ptr<content::WebContents> web_contents;
     double old_zoom_level;
     double new_zoom_level;
     ZoomController::ZoomMode zoom_mode;
diff --git a/content/browser/attribution_reporting/attribution_input_event_tracker_android_unittest.cc b/content/browser/attribution_reporting/attribution_input_event_tracker_android_unittest.cc
index f596c2a..58956ea 100644
--- a/content/browser/attribution_reporting/attribution_input_event_tracker_android_unittest.cc
+++ b/content/browser/attribution_reporting/attribution_input_event_tracker_android_unittest.cc
@@ -13,6 +13,7 @@
 #include "base/android/jni_string.h"
 #include "base/android/scoped_java_ref.h"
 #include "base/bind.h"
+#include "base/memory/raw_ptr.h"
 #include "base/strings/string_piece.h"
 #include "base/test/bind.h"
 #include "base/time/time.h"
@@ -81,7 +82,7 @@
     return static_cast<bool>(env_->IsSameObject(a.obj(), b.obj()));
   }
 
-  JNIEnv* env_;
+  raw_ptr<JNIEnv> env_;
   std::unique_ptr<AttributionInputEventTrackerAndroid> input_event_tracker_;
 };
 
diff --git a/content/browser/bluetooth/web_bluetooth_service_impl.cc b/content/browser/bluetooth/web_bluetooth_service_impl.cc
index 96b653f..18c37d955 100644
--- a/content/browser/bluetooth/web_bluetooth_service_impl.cc
+++ b/content/browser/bluetooth/web_bluetooth_service_impl.cc
@@ -496,10 +496,10 @@
     return blink::mojom::WebBluetoothResult::DEVICE_NO_LONGER_IN_RANGE;
   }
 
-  BluetoothDevice* device = nullptr;
-  BluetoothRemoteGattService* service = nullptr;
-  BluetoothRemoteGattCharacteristic* characteristic = nullptr;
-  BluetoothRemoteGattDescriptor* descriptor = nullptr;
+  raw_ptr<BluetoothDevice> device = nullptr;
+  raw_ptr<BluetoothRemoteGattService> service = nullptr;
+  raw_ptr<BluetoothRemoteGattCharacteristic> characteristic = nullptr;
+  raw_ptr<BluetoothRemoteGattDescriptor> descriptor = nullptr;
   CacheQueryOutcome outcome;
 };
 
diff --git a/content/browser/browser_interface_broker_impl.h b/content/browser/browser_interface_broker_impl.h
index 76238fbe..0756fbd 100644
--- a/content/browser/browser_interface_broker_impl.h
+++ b/content/browser/browser_interface_broker_impl.h
@@ -70,7 +70,6 @@
 
   // Sets MojoBinderPolicyApplier to control when to bind interfaces.
   void ApplyMojoBinderPolicies(MojoBinderPolicyApplier* policy_applier) {
-    DCHECK(blink::features::IsPrerender2Enabled());
     DCHECK(policy_applier);
     DCHECK(!policy_applier_);
     policy_applier_ = policy_applier;
@@ -78,7 +77,6 @@
 
   // Stops applying policies to binding requests.
   void ReleaseMojoBinderPolicies() {
-    DCHECK(blink::features::IsPrerender2Enabled());
     DCHECK(policy_applier_);
     // Reset `policy_applier_` to disable capability control.
     policy_applier_ = nullptr;
diff --git a/content/browser/buckets/bucket_manager.h b/content/browser/buckets/bucket_manager.h
index 13148da..d401cd6 100644
--- a/content/browser/buckets/bucket_manager.h
+++ b/content/browser/buckets/bucket_manager.h
@@ -9,6 +9,7 @@
 #include <memory>
 
 #include "base/gtest_prod_util.h"
+#include "base/memory/raw_ptr.h"
 #include "base/sequence_checker.h"
 #include "base/thread_annotations.h"
 #include "base/types/pass_key.h"
@@ -66,7 +67,7 @@
   std::map<blink::StorageKey, std::unique_ptr<BucketManagerHost>> hosts_
       GUARDED_BY_CONTEXT(sequence_checker_);
 
-  StoragePartitionImpl* storage_partition_;
+  raw_ptr<StoragePartitionImpl> storage_partition_;
 };
 
 }  // namespace content
diff --git a/content/browser/client_hints/client_hints_unittest.cc b/content/browser/client_hints/client_hints_unittest.cc
index 60b3aa8..00df466 100644
--- a/content/browser/client_hints/client_hints_unittest.cc
+++ b/content/browser/client_hints/client_hints_unittest.cc
@@ -4,6 +4,7 @@
 
 #include "content/browser/client_hints/client_hints.h"
 
+#include "base/memory/raw_ptr.h"
 #include "base/strings/strcat.h"
 #include "base/strings/string_number_conversions.h"
 #include "base/strings/string_util.h"
@@ -282,7 +283,7 @@
     std::string description;
     absl::optional<std::string> origin_trial_token;
     std::string accept_ch_str;
-    FrameTreeNode* frame_tree_node;
+    raw_ptr<FrameTreeNode> frame_tree_node;
     absl::optional<ClientHintsVector> expect_hints;
     ClientHintsVector expect_commit_hints;
   } tests[] = {
diff --git a/content/browser/devtools/protocol/devtools_protocol_browsertest.cc b/content/browser/devtools/protocol/devtools_protocol_browsertest.cc
index f3f91ffb..9130f4f8 100644
--- a/content/browser/devtools/protocol/devtools_protocol_browsertest.cc
+++ b/content/browser/devtools/protocol/devtools_protocol_browsertest.cc
@@ -242,6 +242,17 @@
   std::unique_ptr<test::PrerenderTestHelper> prerender_helper_;
 };
 
+class PrerenderHoldbackDevToolsProtocolTest
+    : public PrerenderDevToolsProtocolTest {
+ public:
+  PrerenderHoldbackDevToolsProtocolTest() {
+    feature_list_.InitAndEnableFeature(features::kPrerender2Holdback);
+  }
+
+ private:
+  base::test::ScopedFeatureList feature_list_;
+};
+
 class MultiplePrerendersDevToolsProtocolTest
     : public PrerenderDevToolsProtocolTest {
  public:
@@ -3877,6 +3888,29 @@
   EXPECT_THAT(*result.FindString("finalStatus"), Eq("Activated"));
 }
 
+IN_PROC_BROWSER_TEST_F(PrerenderHoldbackDevToolsProtocolTest,
+                       PrerenderActivation) {
+  ASSERT_TRUE(embedded_test_server()->Start());
+  const GURL kInitialUrl = GetUrl("/empty.html");
+  const GURL kPrerenderingUrl = GetUrl("/empty.html?prerender1");
+
+  // Navigate to an initial page.
+  ASSERT_TRUE(NavigateToURL(shell(), kInitialUrl));
+
+  Attach();
+  SendCommandSync("Page.enable");
+  SendCommandSync("Runtime.enable");
+
+  AddPrerender(kPrerenderingUrl);
+
+  EXPECT_TRUE(HasHostForUrl(kPrerenderingUrl));
+
+  NavigatePrimaryPage(kPrerenderingUrl);
+  base::Value::Dict result =
+      WaitForNotification("Page.prerenderAttemptCompleted", true);
+  EXPECT_THAT(*result.FindString("finalStatus"), Eq("Activated"));
+}
+
 IN_PROC_BROWSER_TEST_F(MultiplePrerendersDevToolsProtocolTest,
                        MultiplePrerendersCancellation) {
   ASSERT_TRUE(embedded_test_server()->Start());
diff --git a/content/browser/loader/navigation_early_hints_manager.cc b/content/browser/loader/navigation_early_hints_manager.cc
index 5296138..e597d81c 100644
--- a/content/browser/loader/navigation_early_hints_manager.cc
+++ b/content/browser/loader/navigation_early_hints_manager.cc
@@ -147,13 +147,13 @@
     const network::mojom::LinkHeaderPtr& link) {
   switch (link->as) {
     case network::mojom::LinkAsAttribute::kUnspecified:
-      // For modulepreload destination should be "script" when `as` is not
-      // specified.
+      // For modulepreload, the request destination should be "script" when `as`
+      // is not specified.
+      // https://html.spec.whatwg.org/multipage/links.html#link-type-modulepreload
       if (link->rel == network::mojom::LinkRelAttribute::kModulePreload) {
         return network::mojom::RequestDestination::kScript;
-      } else {
-        return network::mojom::RequestDestination::kEmpty;
       }
+      return network::mojom::RequestDestination::kEmpty;
     case network::mojom::LinkAsAttribute::kImage:
       return network::mojom::RequestDestination::kImage;
     case network::mojom::LinkAsAttribute::kFont:
@@ -163,8 +163,6 @@
     case network::mojom::LinkAsAttribute::kStyleSheet:
       return network::mojom::RequestDestination::kStyle;
   }
-  NOTREACHED();
-  return network::mojom::RequestDestination::kEmpty;
 }
 
 // Used to determine a priority for a speculative subresource request.
@@ -428,9 +426,8 @@
     const network::ResourceRequest& request_for_navigation) {
   // Ignore the second and subsequent responses to avoid situations where
   // policies such as CSP are inconsistent among the first and following
-  // responses.
-  // TODO(https://crbug.com/1305896): Refer to a relevant specification once the
-  // spec discussion is settled.
+  // responses. This behavior is specified by the step 19.5 of
+  // https://html.spec.whatwg.org/multipage/browsing-the-web.html#create-navigation-params-by-fetching
   if (was_first_early_hints_received_)
     return;
 
@@ -528,6 +525,13 @@
   if (!ShouldHandleResourceHints(link))
     return;
 
+  network::mojom::RequestDestination destination =
+      LinkAsAttributeToRequestDestination(link);
+  // Step 2. If options's destination is not a destination, then return null.
+  // https://html.spec.whatwg.org/multipage/semantics.html#create-a-link-request
+  if (destination == network::mojom::RequestDestination::kEmpty)
+    return;
+
   if (!CheckContentSecurityPolicyForPreload(link, content_security_policies))
     return;
 
@@ -543,7 +547,7 @@
   network::ResourceRequest request;
   request.method = net::HttpRequestHeaders::kGetMethod;
   request.priority = CalculateRequestPriority(link);
-  request.destination = LinkAsAttributeToRequestDestination(link);
+  request.destination = destination;
   request.url = link->href;
   request.site_for_cookies = site_for_cookies;
   request.request_initiator = origin_;
diff --git a/content/browser/plugin_list_unittest.cc b/content/browser/plugin_list_unittest.cc
index 7cda980..041a506 100644
--- a/content/browser/plugin_list_unittest.cc
+++ b/content/browser/plugin_list_unittest.cc
@@ -7,6 +7,7 @@
 #include <string>
 
 #include "base/files/file_path.h"
+#include "base/memory/raw_ptr.h"
 #include "content/public/test/browser_task_environment.h"
 #include "testing/gtest/include/gtest/gtest.h"
 #include "url/gurl.h"
@@ -67,7 +68,7 @@
 
   // Owns the PluginList but cannot be a std::unique_ptr due to private
   // ctor/dtor.
-  PluginList* plugin_list_;
+  raw_ptr<PluginList> plugin_list_;
   WebPluginInfo foo_plugin_;
   WebPluginInfo bar_plugin_;
 };
diff --git a/content/browser/plugin_service_impl_browsertest.cc b/content/browser/plugin_service_impl_browsertest.cc
index 34c5763e..07e5470 100644
--- a/content/browser/plugin_service_impl_browsertest.cc
+++ b/content/browser/plugin_service_impl_browsertest.cc
@@ -9,6 +9,7 @@
 #include <utility>
 
 #include "base/bind.h"
+#include "base/memory/raw_ptr.h"
 #include "base/strings/stringprintf.h"
 #include "base/strings/utf_string_conversions.h"
 #include "build/build_config.h"
@@ -48,7 +49,7 @@
 
  private:
   base::ProcessId plugin_pid_ = 0;
-  base::RunLoop* run_loop_ = nullptr;
+  raw_ptr<base::RunLoop> run_loop_ = nullptr;
 };
 #endif  // BUILDFLAG(ENABLE_PPAPI)
 
diff --git a/content/browser/preloading/anchor_element_interaction_host_impl_unittest.cc b/content/browser/preloading/anchor_element_interaction_host_impl_unittest.cc
index b643cf3..59591283 100644
--- a/content/browser/preloading/anchor_element_interaction_host_impl_unittest.cc
+++ b/content/browser/preloading/anchor_element_interaction_host_impl_unittest.cc
@@ -4,6 +4,7 @@
 
 #include "content/browser/preloading/anchor_element_interaction_host_impl.h"
 
+#include "base/memory/raw_ptr.h"
 #include "content/browser/preloading/preloading_decider.h"
 #include "content/public/test/test_browser_context.h"
 #include "content/test/test_web_contents.h"
@@ -61,7 +62,7 @@
  private:
   std::unique_ptr<TestBrowserContext> browser_context_;
   std::unique_ptr<TestWebContents> web_contents_;
-  PreloadingObserverImpl* observer_;
+  raw_ptr<PreloadingObserverImpl> observer_;
 };
 
 TEST_F(AnchorElementInteractionHostImplTest, OnPointerEvents) {
diff --git a/content/browser/preloading/prerender/prerender_host.cc b/content/browser/preloading/prerender/prerender_host.cc
index 3dabe79e..178a4179 100644
--- a/content/browser/preloading/prerender/prerender_host.cc
+++ b/content/browser/preloading/prerender/prerender_host.cc
@@ -146,7 +146,6 @@
                                               &web_contents,
                                               &web_contents,
                                               FrameTree::Type::kPrerender)) {
-  DCHECK(blink::features::IsPrerender2Enabled());
   // If the prerendering is browser-initiated, it is expected to have no
   // initiator. All initiator related information should be null or invalid. On
   // the other hand, renderer-initiated prerendering should have valid initiator
diff --git a/content/browser/preloading/prerender/prerender_host_registry.cc b/content/browser/preloading/prerender/prerender_host_registry.cc
index bf95f96..70d5b59 100644
--- a/content/browser/preloading/prerender/prerender_host_registry.cc
+++ b/content/browser/preloading/prerender/prerender_host_registry.cc
@@ -19,6 +19,7 @@
 #include "base/trace_event/trace_conversion_helper.h"
 #include "build/build_config.h"
 #include "content/browser/devtools/devtools_instrumentation.h"
+#include "content/browser/devtools/render_frame_devtools_agent_host.h"
 #include "content/browser/preloading/preloading_attempt_impl.h"
 #include "content/browser/preloading/prerender/prerender_final_status.h"
 #include "content/browser/preloading/prerender/prerender_metrics.h"
@@ -75,7 +76,6 @@
 
 PrerenderHostRegistry::PrerenderHostRegistry(WebContents& web_contents) {
   Observe(&web_contents);
-  DCHECK(blink::features::IsPrerender2Enabled());
 }
 
 PrerenderHostRegistry::~PrerenderHostRegistry() {
@@ -194,7 +194,20 @@
       attempt->SetEligibility(PreloadingEligibility::kEligible);
 
     // Check for the HoldbackStatus after checking the eligibility.
-    if (base::FeatureList::IsEnabled(features::kPrerender2Holdback)) {
+    // Override Prerender2Holdback for speculation rules when DevTools is
+    // opened to mitigate the cases in which developers are affected by
+    // kPrerender2Holdback.
+    RenderFrameHostImpl* initiator_rfh =
+        attributes.IsBrowserInitiated()
+            ? nullptr
+            : RenderFrameHostImpl::FromFrameToken(
+                  attributes.initiator_process_id,
+                  attributes.initiator_frame_token.value());
+    bool should_prerender2holdback_be_overridden =
+        initiator_rfh &&
+        RenderFrameDevToolsAgentHost::GetFor(initiator_rfh) != nullptr;
+    if (!should_prerender2holdback_be_overridden &&
+        base::FeatureList::IsEnabled(features::kPrerender2Holdback)) {
       if (attempt)
         attempt->SetHoldbackStatus(PreloadingHoldbackStatus::kHoldback);
       return RenderFrameHost::kNoFrameTreeNodeId;
@@ -394,6 +407,13 @@
 
 bool PrerenderHostRegistry::CancelHost(int frame_tree_node_id,
                                        PrerenderFinalStatus final_status) {
+  return CancelHost(frame_tree_node_id,
+                    PrerenderCancellationReason(final_status));
+}
+
+bool PrerenderHostRegistry::CancelHost(
+    int frame_tree_node_id,
+    const PrerenderCancellationReason& reason) {
   TRACE_EVENT1("navigation", "PrerenderHostRegistry::CancelHost",
                "frame_tree_node_id", frame_tree_node_id);
 
@@ -406,6 +426,9 @@
   if (iter == prerender_host_by_frame_tree_node_id_.end())
     return false;
 
+  reason.ReportMetrics(iter->second->trigger_type(),
+                       iter->second->embedder_histogram_suffix());
+
   // Remove the prerender host from the host map so that it's not used for
   // activation during asynchronous deletion.
 
@@ -413,7 +436,8 @@
   prerender_host_by_frame_tree_node_id_.erase(iter);
 
   // Asynchronously delete the prerender host.
-  ScheduleToDeleteAbandonedHost(std::move(prerender_host), final_status);
+  ScheduleToDeleteAbandonedHost(std::move(prerender_host),
+                                reason.final_status());
 
   // Start another prerender if the running prerender is cancelled.
   if (running_prerender_host_id_ == frame_tree_node_id) {
diff --git a/content/browser/preloading/prerender/prerender_host_registry.h b/content/browser/preloading/prerender/prerender_host_registry.h
index 30ed59c..28eaedad 100644
--- a/content/browser/preloading/prerender/prerender_host_registry.h
+++ b/content/browser/preloading/prerender/prerender_host_registry.h
@@ -30,6 +30,7 @@
 namespace content {
 
 class RenderFrameHostImpl;
+class PrerenderCancellationReason;
 
 // PrerenderHostRegistry creates and retains a prerender host, and reserves it
 // for NavigationRequest to activate the prerendered page. This is created per
@@ -97,6 +98,9 @@
   // for self destruction.
   // Returns true if a cancelation has occurred.
   bool CancelHost(int frame_tree_node_id, PrerenderFinalStatus final_status);
+  // Same as CancelHost, but can pass a detailed reason for recording if given.
+  bool CancelHost(int frame_tree_node_id,
+                  const PrerenderCancellationReason& reason);
 
   // Cancels the existing hosts specified in the vector with the same final
   // status.
diff --git a/content/browser/preloading/prerender/prerender_host_unittest.cc b/content/browser/preloading/prerender/prerender_host_unittest.cc
index 444cc61..fe6ea34 100644
--- a/content/browser/preloading/prerender/prerender_host_unittest.cc
+++ b/content/browser/preloading/prerender/prerender_host_unittest.cc
@@ -497,13 +497,13 @@
       registry->FindNonReservedHostById(prerender_frame_tree_node_id);
   ASSERT_NE(prerender_host, nullptr);
 
-  // Registry keeps alive through this test, so it is safe to use
-  // base::Unretained.
+  // Registry keeps alive through this test, so it is safe to capture the
+  // reference to `registry`.
   base::SequencedTaskRunner::GetCurrentDefault()->PostTask(
-      FROM_HERE,
-      base::BindOnce(base::IgnoreResult(&PrerenderHostRegistry::CancelHost),
-                     base::Unretained(registry), prerender_frame_tree_node_id,
-                     PrerenderFinalStatus::kTriggerDestroyed));
+      FROM_HERE, base::BindOnce(base::BindLambdaForTesting([&]() {
+        registry->CancelHost(prerender_frame_tree_node_id,
+                             PrerenderFinalStatus::kTriggerDestroyed);
+      })));
 
   // For some reasons triggers want to set the failure reason by themselves,
   // this would happen together with cancelling prerender.
diff --git a/content/browser/preloading/prerender/prerender_metrics.cc b/content/browser/preloading/prerender/prerender_metrics.cc
index a04b48c4..958971f 100644
--- a/content/browser/preloading/prerender/prerender_metrics.cc
+++ b/content/browser/preloading/prerender/prerender_metrics.cc
@@ -78,8 +78,6 @@
       HeaderMismatchHasher(base::ToLowerASCII(key), mismatch_type));
 }
 
-}  // namespace
-
 // Called by MojoBinderPolicyApplier. This function records the Mojo interface
 // that causes MojoBinderPolicyApplier to cancel prerendering.
 void RecordPrerenderCancelledInterface(
@@ -105,20 +103,62 @@
   }
 }
 
-void RecordPrerenderReasonForInactivePageRestriction(uint16_t reason,
-                                                     RenderFrameHostImpl& rfh) {
-  FrameTreeNode* outermost_frame =
-      rfh.GetOutermostMainFrameOrEmbedder()->frame_tree_node();
-  PrerenderHost* prerender_host =
-      rfh.delegate()->GetPrerenderHostRegistry()->FindNonReservedHostById(
-          outermost_frame->frame_tree_node_id());
-  if (prerender_host) {
-    base::UmaHistogramSparse(
-        GenerateHistogramName("Prerender.CanceledForInactivePageRestriction."
-                              "DisallowActivationReason",
-                              prerender_host->trigger_type(),
-                              prerender_host->embedder_histogram_suffix()),
-        reason);
+}  // namespace
+
+// static
+PrerenderCancellationReason
+PrerenderCancellationReason::BuildForDisallowActivationState(
+    uint64_t disallow_activation_reason) {
+  return PrerenderCancellationReason(
+      PrerenderFinalStatus::kInactivePageRestriction,
+      disallow_activation_reason);
+}
+
+// static
+PrerenderCancellationReason
+PrerenderCancellationReason::BuildForMojoBinderPolicy(
+    const std::string& interface_name) {
+  return PrerenderCancellationReason(PrerenderFinalStatus::kMojoBinderPolicy,
+                                     interface_name);
+}
+
+PrerenderCancellationReason::PrerenderCancellationReason(
+    PrerenderFinalStatus final_status)
+    : PrerenderCancellationReason(final_status, DetailedReasonVariant()) {}
+
+PrerenderCancellationReason::PrerenderCancellationReason(
+    PrerenderCancellationReason&& reason) = default;
+
+PrerenderCancellationReason::~PrerenderCancellationReason() = default;
+
+PrerenderCancellationReason::PrerenderCancellationReason(
+    PrerenderFinalStatus final_status,
+    DetailedReasonVariant explanation)
+    : final_status_(final_status), explanation_(std::move(explanation)) {}
+
+void PrerenderCancellationReason::ReportMetrics(
+    PrerenderTriggerType trigger_type,
+    const std::string& embedder_histogram_suffix) const {
+  switch (final_status_) {
+    case PrerenderFinalStatus::kInactivePageRestriction:
+      DCHECK(absl::holds_alternative<uint64_t>(explanation_));
+      base::UmaHistogramSparse(
+          GenerateHistogramName("Prerender.CanceledForInactivePageRestriction."
+                                "DisallowActivationReason",
+                                trigger_type, embedder_histogram_suffix),
+
+          absl::get<uint64_t>(explanation_));
+      break;
+    case PrerenderFinalStatus::kMojoBinderPolicy:
+      DCHECK(absl::holds_alternative<std::string>(explanation_));
+      RecordPrerenderCancelledInterface(absl::get<std::string>(explanation_),
+                                        trigger_type,
+                                        embedder_histogram_suffix);
+      break;
+    default:
+      DCHECK(absl::holds_alternative<absl::monostate>(explanation_));
+      // Other types need not to report.
+      break;
   }
 }
 
diff --git a/content/browser/preloading/prerender/prerender_metrics.h b/content/browser/preloading/prerender/prerender_metrics.h
index a25def5..7b5e927 100644
--- a/content/browser/preloading/prerender/prerender_metrics.h
+++ b/content/browser/preloading/prerender/prerender_metrics.h
@@ -11,10 +11,9 @@
 #include "base/time/time.h"
 #include "content/browser/preloading/prerender/prerender_final_status.h"
 #include "content/browser/preloading/prerender/prerender_host.h"
-#include "content/browser/preloading/prerender/prerender_host_registry.h"
-#include "content/browser/renderer_host/render_frame_host_delegate.h"
 #include "content/public/browser/prerender_trigger_type.h"
 #include "services/metrics/public/cpp/ukm_source_id.h"
+#include "third_party/abseil-cpp/absl/types/variant.h"
 
 namespace content {
 
@@ -48,6 +47,39 @@
   kMaxValue = kSchemeHostPortMismatch
 };
 
+// Assembles PrerenderHostFinalStatus with a detailed explanation if applicable.
+// Some FinalStatus enums cover multiple sub cases. To explain them in detail,
+// some explanations can be attached to the status.
+class PrerenderCancellationReason {
+ public:
+  using DetailedReasonVariant =
+      absl::variant<absl::monostate, uint64_t, std::string>;
+
+  static PrerenderCancellationReason BuildForDisallowActivationState(
+      uint64_t disallow_activation_reason);
+
+  static PrerenderCancellationReason BuildForMojoBinderPolicy(
+      const std::string& interface_name);
+
+  explicit PrerenderCancellationReason(PrerenderFinalStatus final_status);
+  ~PrerenderCancellationReason();
+
+  PrerenderCancellationReason(PrerenderCancellationReason&& reason);
+
+  void ReportMetrics(PrerenderTriggerType trigger_type,
+                     const std::string& embedder_histogram_suffix) const;
+
+  PrerenderFinalStatus final_status() const { return final_status_; }
+
+ private:
+  PrerenderCancellationReason(PrerenderFinalStatus final_status,
+                              DetailedReasonVariant explanation);
+
+  const PrerenderFinalStatus final_status_;
+
+  const DetailedReasonVariant explanation_;
+};
+
 // Used by PrerenderNavigationThrottle. This is a breakdown enum for
 // PrerenderCrossOriginRedirectionMismatch.kSchemePortMismatch.
 // These values are persisted to logs. Entries should not be renumbered and
@@ -69,14 +101,6 @@
   kMaxValue = kCrossDomain
 };
 
-void RecordPrerenderCancelledInterface(
-    const std::string& interface_name,
-    PrerenderTriggerType trigger_type,
-    const std::string& embedder_histogram_suffix);
-
-void RecordPrerenderReasonForInactivePageRestriction(uint16_t reason,
-                                                     RenderFrameHostImpl& rfh);
-
 void RecordPrerenderTriggered(ukm::SourceId ukm_id);
 
 void RecordPrerenderActivationTime(
diff --git a/content/browser/preloading/prerender/prerender_navigation_throttle.cc b/content/browser/preloading/prerender/prerender_navigation_throttle.cc
index c9fad68..cfd7100 100644
--- a/content/browser/preloading/prerender/prerender_navigation_throttle.cc
+++ b/content/browser/preloading/prerender/prerender_navigation_throttle.cc
@@ -84,8 +84,6 @@
   FrameTreeNode* frame_tree_node = navigation_request->frame_tree_node();
   if (frame_tree_node->IsMainFrame() &&
       frame_tree_node->frame_tree()->is_prerendering()) {
-    DCHECK(blink::features::IsPrerender2Enabled());
-
     PrerenderHost* prerender_host =
         static_cast<PrerenderHost*>(frame_tree_node->frame_tree()->delegate());
     DCHECK(prerender_host);
@@ -132,8 +130,6 @@
 
 NavigationThrottle::ThrottleCheckResult
 PrerenderNavigationThrottle::WillStartOrRedirectRequest(bool is_redirection) {
-  DCHECK(blink::features::IsPrerender2Enabled());
-
   // Take the root frame tree node of the prerendering page.
   auto* navigation_request = NavigationRequest::From(navigation_handle());
   FrameTreeNode* frame_tree_node = navigation_request->frame_tree_node();
diff --git a/content/browser/preloading/prerender/prerender_subframe_navigation_throttle.cc b/content/browser/preloading/prerender/prerender_subframe_navigation_throttle.cc
index 58259b8b..a409b4d 100644
--- a/content/browser/preloading/prerender/prerender_subframe_navigation_throttle.cc
+++ b/content/browser/preloading/prerender/prerender_subframe_navigation_throttle.cc
@@ -24,8 +24,7 @@
     NavigationHandle* navigation_handle) {
   auto* navigation_request = NavigationRequest::From(navigation_handle);
   FrameTreeNode* frame_tree_node = navigation_request->frame_tree_node();
-  if (!blink::features::IsPrerender2Enabled() ||
-      frame_tree_node->IsMainFrame() ||
+  if (frame_tree_node->IsMainFrame() ||
       !frame_tree_node->frame_tree()->is_prerendering()) {
     return nullptr;
   }
@@ -188,8 +187,6 @@
 
 NavigationThrottle::ThrottleCheckResult
 PrerenderSubframeNavigationThrottle::WillStartOrRedirectRequest() {
-  DCHECK(blink::features::IsPrerender2Enabled());
-
   auto* navigation_request = NavigationRequest::From(navigation_handle());
   FrameTreeNode* frame_tree_node = navigation_request->frame_tree_node();
   DCHECK(!frame_tree_node->IsMainFrame());
diff --git a/content/browser/preloading/prerenderer.cc b/content/browser/preloading/prerenderer.cc
index e86eb60..0bfae120 100644
--- a/content/browser/preloading/prerenderer.cc
+++ b/content/browser/preloading/prerenderer.cc
@@ -54,10 +54,8 @@
     : WebContentsObserver(WebContents::FromRenderFrameHost(&render_frame_host)),
       render_frame_host_(render_frame_host) {
   DCHECK_CURRENTLY_ON(content::BrowserThread::UI);
-  if (blink::features::IsPrerender2Enabled()) {
-    auto& rfhi = static_cast<RenderFrameHostImpl&>(render_frame_host);
-    registry_ = rfhi.delegate()->GetPrerenderHostRegistry()->GetWeakPtr();
-  }
+  auto& rfhi = static_cast<RenderFrameHostImpl&>(render_frame_host);
+  registry_ = rfhi.delegate()->GetPrerenderHostRegistry()->GetWeakPtr();
 }
 Prerenderer::~Prerenderer() {
   DCHECK_CURRENTLY_ON(content::BrowserThread::UI);
@@ -84,7 +82,6 @@
     const std::vector<blink::mojom::SpeculationCandidatePtr>& candidates) {
   if (!registry_)
     return;
-  DCHECK(blink::features::IsPrerender2Enabled());
 
   // Extract only the candidates which apply to prerender, and sort them by URL
   // so we can efficiently compare them to `started_prerenders_`.
diff --git a/content/browser/preloading/speculation_rules/speculation_host_impl_unittest.cc b/content/browser/preloading/speculation_rules/speculation_host_impl_unittest.cc
index 095c8b6..0d6b7c2 100644
--- a/content/browser/preloading/speculation_rules/speculation_host_impl_unittest.cc
+++ b/content/browser/preloading/speculation_rules/speculation_host_impl_unittest.cc
@@ -114,7 +114,7 @@
   std::unique_ptr<TestBrowserContext> browser_context_;
   std::unique_ptr<TestWebContents> web_contents_;
   PrerenderWebContentsDelegate web_contents_delegate_;
-  PreloadingObserverImpl* observer_;
+  raw_ptr<PreloadingObserverImpl> observer_;
 };
 
 // Tests that SpeculationHostImpl dispatches the candidates to
diff --git a/content/browser/private_aggregation/private_aggregation_manager_impl_unittest.cc b/content/browser/private_aggregation/private_aggregation_manager_impl_unittest.cc
index d7aa413..9787ebc 100644
--- a/content/browser/private_aggregation/private_aggregation_manager_impl_unittest.cc
+++ b/content/browser/private_aggregation/private_aggregation_manager_impl_unittest.cc
@@ -12,6 +12,7 @@
 #include "base/callback_helpers.h"
 #include "base/files/file_path.h"
 #include "base/memory/ptr_util.h"
+#include "base/memory/raw_ptr.h"
 #include "base/run_loop.h"
 #include "base/task/sequenced_task_runner.h"
 #include "base/task/thread_pool.h"
@@ -81,17 +82,17 @@
       : budgeter_(new testing::StrictMock<MockPrivateAggregationBudgeter>()),
         host_(new testing::StrictMock<MockPrivateAggregationHost>()),
         aggregation_service_(new testing::StrictMock<MockAggregationService>()),
-        manager_(base::WrapUnique(budgeter_),
-                 base::WrapUnique(host_),
-                 base::WrapUnique(aggregation_service_)) {}
+        manager_(base::WrapUnique(budgeter_.get()),
+                 base::WrapUnique(host_.get()),
+                 base::WrapUnique(aggregation_service_.get())) {}
 
  protected:
   BrowserTaskEnvironment task_environment_;
 
   // Keep pointers around for EXPECT_CALL.
-  MockPrivateAggregationBudgeter* budgeter_;
-  MockPrivateAggregationHost* host_;
-  MockAggregationService* aggregation_service_;
+  raw_ptr<MockPrivateAggregationBudgeter> budgeter_;
+  raw_ptr<MockPrivateAggregationHost> host_;
+  raw_ptr<MockAggregationService> aggregation_service_;
 
   testing::StrictMock<PrivateAggregationManagerImplUnderTest> manager_;
 };
diff --git a/content/browser/renderer_host/back_forward_cache_impl.cc b/content/browser/renderer_host/back_forward_cache_impl.cc
index cba6eed..bb3a33a 100644
--- a/content/browser/renderer_host/back_forward_cache_impl.cc
+++ b/content/browser/renderer_host/back_forward_cache_impl.cc
@@ -838,16 +838,14 @@
   // change this part to use the information stored in RenderFrameHostImpl
   // instead.
 
-  BlockListedFeatures cache_control_no_store_feature(
-      WebSchedulerTrackedFeature::kMainResourceHasCacheControlNoStore);
-  if (!Intersection(rfh->GetBackForwardCacheDisablingFeatures(),
-                    cache_control_no_store_feature)
-           .Empty()) {
+  if (rfh->GetBackForwardCacheDisablingFeatures().Has(
+          WebSchedulerTrackedFeature::kMainResourceHasCacheControlNoStore)) {
     if (!AllowStoringPagesWithCacheControlNoStore()) {
       // Block pages with cache-control: no-store only when
       // |should_cache_control_no_store_enter| flag is false. If true, put the
       // page in and evict later.
-      result.NoDueToFeatures(cache_control_no_store_feature);
+      result.NoDueToFeatures(
+          WebSchedulerTrackedFeature::kMainResourceHasCacheControlNoStore);
     }
   }
 
diff --git a/content/browser/renderer_host/frame_tree_node.cc b/content/browser/renderer_host/frame_tree_node.cc
index f71823d..968f7a4 100644
--- a/content/browser/renderer_host/frame_tree_node.cc
+++ b/content/browser/renderer_host/frame_tree_node.cc
@@ -218,7 +218,6 @@
 
     current_frame_host()->ResetLoadingState();
   } else {
-    DCHECK(blink::features::IsPrerender2Enabled());
     DCHECK(!parent());  // Only main documents can be activated.
     DCHECK(!opener());  // Prerendered frame trees can't have openers.
 
@@ -438,7 +437,6 @@
 }
 
 void FrameTreeNode::SetFrameTree(FrameTree& frame_tree) {
-  DCHECK(blink::features::IsPrerender2Enabled());
   frame_tree_ = &frame_tree;
   DCHECK(current_frame_host());
   current_frame_host()->SetFrameTree(frame_tree);
@@ -801,13 +799,13 @@
 
 void FrameTreeNode::SetInitialPopupURL(const GURL& initial_popup_url) {
   DCHECK(initial_popup_url_.is_empty());
-  DCHECK(is_on_initial_empty_document_);
+  DCHECK(is_on_initial_empty_document());
   initial_popup_url_ = initial_popup_url;
 }
 
 void FrameTreeNode::SetPopupCreatorOrigin(
     const url::Origin& popup_creator_origin) {
-  DCHECK(is_on_initial_empty_document_);
+  DCHECK(is_on_initial_empty_document());
   popup_creator_origin_ = popup_creator_origin;
 }
 
diff --git a/content/browser/renderer_host/frame_tree_node.h b/content/browser/renderer_host/frame_tree_node.h
index 46e0fc2..74ef740a 100644
--- a/content/browser/renderer_host/frame_tree_node.h
+++ b/content/browser/renderer_host/frame_tree_node.h
@@ -191,23 +191,16 @@
     return current_frame_host()->GetLastCommittedURL();
   }
 
-  // Sets `is_on_initial_empty_document_` to false.
-  void SetNotOnInitialEmptyDocument() { is_on_initial_empty_document_ = false; }
-
-  // Returns false if the frame has committed a document that is not the initial
-  // empty document, or if the current document's input stream has been opened
-  // with document.open(), causing the document to lose its "initial empty
-  // document" status. For more details, see the definition of
-  // `is_on_initial_empty_document_`.
+  // Note that the current RenderFrameHost might not exist yet when calling this
+  // during FrameTreeNode initialization. In this case the FrameTreeNode must be
+  // on the initial empty document. Refer RFHI::is_initial_empty_document for a
+  // more details.
   bool is_on_initial_empty_document() const {
-    return is_on_initial_empty_document_;
+    return current_frame_host()
+               ? current_frame_host()->is_initial_empty_document()
+               : true;
   }
 
-  // Sets `is_on_initial_empty_document_` to
-  // false. Must only be called after the current document's input stream has
-  // been opened with document.open().
-  void DidOpenDocumentInputStream() { is_on_initial_empty_document_ = false; }
-
   // Returns whether the frame's owner element in the parent document is
   // collapsed, that is, removed from the layout as if it did not exist, as per
   // request by the embedder (of the content/ layer).
@@ -699,24 +692,6 @@
   // stores the srcdoc_attribute's value for re-use in history navigations.
   std::string srcdoc_value_;
 
-  // Whether this frame is still on the initial about:blank document or the
-  // synchronously committed about:blank document committed at frame creation,
-  // and its "initial empty document"-ness is still true.
-  // This will be false if either of these has happened:
-  // - The current RenderFrameHost commits a cross-document navigation that is
-  //   not the synchronously committed about:blank document per:
-  //   https://html.spec.whatwg.org/multipage/browsers.html#creating-browsing-contexts:is-initial-about:blank
-  // - The document's input stream has been opened with document.open(), per
-  //   https://html.spec.whatwg.org/multipage/dynamic-markup-insertion.html#opening-the-input-stream:is-initial-about:blank
-  // NOTE: we treat both the "initial about:blank document" and the
-  // "synchronously committed about:blank document" as the initial empty
-  // document. In the future, we plan to remove the synchronous about:blank
-  // commit so that this state will only be true if the frame is on the
-  // "initial about:blank document". See also:
-  // - https://github.com/whatwg/html/issues/6863
-  // - https://crbug.com/1215096
-  bool is_on_initial_empty_document_ = true;
-
   // Whether the frame's owner element in the parent document is collapsed.
   bool is_collapsed_ = false;
 
diff --git a/content/browser/renderer_host/media/media_stream_manager_unittest.cc b/content/browser/renderer_host/media/media_stream_manager_unittest.cc
index 7a5bf64..cdbaa5c 100644
--- a/content/browser/renderer_host/media/media_stream_manager_unittest.cc
+++ b/content/browser/renderer_host/media/media_stream_manager_unittest.cc
@@ -201,7 +201,7 @@
   }
 
  private:
-  const size_t* screen_count_;
+  raw_ptr<const size_t> screen_count_;
 };
 
 class MediaStreamProviderListenerMock
@@ -240,7 +240,7 @@
 
  private:
   raw_ptr<MediaObserver> media_observer_;
-  const size_t* screen_count_;
+  raw_ptr<const size_t> screen_count_;
 };
 
 class MockMediaStreamUIProxy : public FakeMediaStreamUIProxy {
diff --git a/content/browser/renderer_host/media/video_capture_manager.cc b/content/browser/renderer_host/media/video_capture_manager.cc
index d46f94a..7a38312 100644
--- a/content/browser/renderer_host/media/video_capture_manager.cc
+++ b/content/browser/renderer_host/media/video_capture_manager.cc
@@ -15,6 +15,7 @@
 #include "base/containers/cxx20_erase.h"
 #include "base/location.h"
 #include "base/logging.h"
+#include "base/memory/raw_ptr.h"
 #include "base/metrics/histogram_functions.h"
 #include "base/observer_list.h"
 #include "base/ranges/algorithm.h"
@@ -61,7 +62,7 @@
   media::VideoCaptureParams params() const { return params_; }
 
  private:
-  VideoCaptureController* const controller_;
+  const raw_ptr<VideoCaptureController> controller_;
   const base::UnguessableToken session_id_;
   const media::VideoCaptureParams params_;
 };
diff --git a/content/browser/renderer_host/mixed_content_navigation_throttle.cc b/content/browser/renderer_host/mixed_content_navigation_throttle.cc
index 11ae74b4..e8465c0 100644
--- a/content/browser/renderer_host/mixed_content_navigation_throttle.cc
+++ b/content/browser/renderer_host/mixed_content_navigation_throttle.cc
@@ -10,6 +10,7 @@
 #include "base/memory/ptr_util.h"
 #include "base/metrics/histogram_macros.h"
 #include "content/browser/preloading/prerender/prerender_final_status.h"
+#include "content/browser/preloading/prerender/prerender_metrics.h"
 #include "content/browser/renderer_host/frame_tree.h"
 #include "content/browser/renderer_host/frame_tree_node.h"
 #include "content/browser/renderer_host/navigation_request.h"
@@ -186,7 +187,7 @@
   // logging UMA, UKM and calling DidChangeVisibleSecurityState() through this
   // throttle.
   if (mixed_content_frame->CancelPrerendering(
-          PrerenderFinalStatus::kMixedContent)) {
+          PrerenderCancellationReason(PrerenderFinalStatus::kMixedContent))) {
     return true;
   }
 
diff --git a/content/browser/renderer_host/navigation_request.cc b/content/browser/renderer_host/navigation_request.cc
index d349de1a..6d3ffbec 100644
--- a/content/browser/renderer_host/navigation_request.cc
+++ b/content/browser/renderer_host/navigation_request.cc
@@ -2068,9 +2068,6 @@
 }
 
 bool NavigationRequest::MaybeStartPrerenderingActivationChecks() {
-  if (!blink::features::IsPrerender2Enabled())
-    return false;
-
   // Find an available prerendered page for this request. If it's found, this
   // request may activate it instead of loading a page via network.
   int candidate_prerender_frame_tree_node_id =
@@ -2105,8 +2102,6 @@
 void NavigationRequest::OnPrerenderingActivationChecksComplete(
     CommitDeferringCondition::NavigationType navigation_type,
     absl::optional<int> candidate_prerender_frame_tree_node_id) {
-  DCHECK(blink::features::IsPrerender2Enabled());
-
   // Prerendered page activation must run CommitDeferringConditions before
   // StartRequest().
   DCHECK_LT(state_, WILL_START_NAVIGATION);
@@ -6769,8 +6764,7 @@
              rfh_restored_from_back_forward_cache_);
   }
 
-  if (blink::features::IsPrerender2Enabled() &&
-      prerender_frame_tree_node_id_.has_value()) {
+  if (prerender_frame_tree_node_id_.has_value()) {
     dict.Add("prerender_frame_tree_node_id",
              prerender_frame_tree_node_id_.value());
   }
@@ -7045,9 +7039,6 @@
 }
 
 bool NavigationRequest::IsPrerenderedPageActivation() const {
-  if (!blink::features::IsPrerender2Enabled())
-    return false;
-
   CHECK(prerender_frame_tree_node_id_.has_value());
   return prerender_frame_tree_node_id_ != RenderFrameHost::kNoFrameTreeNodeId;
 }
@@ -8222,8 +8213,7 @@
 }
 
 void NavigationRequest::MaybeAssignInvalidPrerenderFrameTreeNodeId() {
-  if (blink::features::IsPrerender2Enabled() &&
-      !prerender_frame_tree_node_id_.has_value()) {
+  if (!prerender_frame_tree_node_id_.has_value()) {
     // This navigation won't activate a prerendered page. Otherwise,
     // `prerender_frame_tree_node_id_` should have already been set before this
     // in OnPrerenderingActivationChecksComplete().
diff --git a/content/browser/renderer_host/pending_beacon_host_unittest.cc b/content/browser/renderer_host/pending_beacon_host_unittest.cc
index f76a0cc..b713497e 100644
--- a/content/browser/renderer_host/pending_beacon_host_unittest.cc
+++ b/content/browser/renderer_host/pending_beacon_host_unittest.cc
@@ -8,6 +8,7 @@
 #include <vector>
 
 #include "base/files/file_path.h"
+#include "base/memory/raw_ptr.h"
 #include "base/memory/scoped_refptr.h"
 #include "base/strings/strcat.h"
 #include "base/strings/stringprintf.h"
@@ -417,7 +418,7 @@
 
  private:
   // Owned by `main_rfh()`.
-  PendingBeaconHost* host_;
+  raw_ptr<PendingBeaconHost> host_;
   std::unique_ptr<MockClientBeacon> beacon_;
 };
 
diff --git a/content/browser/renderer_host/render_frame_host_csp_context.h b/content/browser/renderer_host/render_frame_host_csp_context.h
index fd786fc08..c8d7bc8 100644
--- a/content/browser/renderer_host/render_frame_host_csp_context.h
+++ b/content/browser/renderer_host/render_frame_host_csp_context.h
@@ -5,6 +5,7 @@
 #ifndef CONTENT_BROWSER_RENDERER_HOST_RENDER_FRAME_HOST_CSP_CONTEXT_H_
 #define CONTENT_BROWSER_RENDERER_HOST_RENDER_FRAME_HOST_CSP_CONTEXT_H_
 
+#include "base/memory/raw_ptr.h"
 #include "content/common/content_export.h"
 #include "services/network/public/cpp/content_security_policy/csp_context.h"
 
@@ -33,7 +34,7 @@
       network::mojom::SourceLocation* source_location) const override;
 
  private:
-  RenderFrameHostImpl* render_frame_host_;
+  raw_ptr<RenderFrameHostImpl> render_frame_host_;
 };
 
 }  // namespace content
diff --git a/content/browser/renderer_host/render_frame_host_delegate.h b/content/browser/renderer_host/render_frame_host_delegate.h
index 6c5fe58a..c5500d18 100644
--- a/content/browser/renderer_host/render_frame_host_delegate.h
+++ b/content/browser/renderer_host/render_frame_host_delegate.h
@@ -633,8 +633,7 @@
       RenderFrameHostImpl* render_frame_host);
 
   // Returns the PrerenderHostRegistry to start/cancel prerendering. This
-  // doesn't return nullptr except for some tests. This should only be called
-  // when blink::features::IsPrerender2Enabled() is true.
+  // doesn't return nullptr except for some tests.
   virtual PrerenderHostRegistry* GetPrerenderHostRegistry();
 
 #if BUILDFLAG(ENABLE_PLUGINS)
diff --git a/content/browser/renderer_host/render_frame_host_impl.cc b/content/browser/renderer_host/render_frame_host_impl.cc
index b0ea916..fec0807 100644
--- a/content/browser/renderer_host/render_frame_host_impl.cc
+++ b/content/browser/renderer_host/render_frame_host_impl.cc
@@ -2995,9 +2995,10 @@
                   kRendererProcessKilled);
   }
 
-  CancelPrerendering(info.status == base::TERMINATION_STATUS_PROCESS_CRASHED
-                         ? PrerenderFinalStatus::kRendererProcessCrashed
-                         : PrerenderFinalStatus::kRendererProcessKilled);
+  CancelPrerendering(PrerenderCancellationReason(
+      info.status == base::TERMINATION_STATUS_PROCESS_CRASHED
+          ? PrerenderFinalStatus::kRendererProcessCrashed
+          : PrerenderFinalStatus::kRendererProcessKilled));
 
   if (owned_render_widget_host_)
     owned_render_widget_host_->RendererExited();
@@ -3548,8 +3549,6 @@
 }
 
 void RenderFrameHostImpl::RendererDidActivateForPrerendering() {
-  DCHECK(blink::features::IsPrerender2Enabled());
-
   // RendererDidActivateForPrerendering() is called after the renderer has
   // notified that it fired the prerenderingchange event on the documents. The
   // browser now runs any binders that were deferred during prerendering. This
@@ -3706,7 +3705,7 @@
   if (!navigation_request->IsSameDocument() &&
       (!navigation_request->is_synchronous_renderer_commit() ||
        !navigation_request->GetURL().IsAboutBlank())) {
-    navigation_request->frame_tree_node()->SetNotOnInitialEmptyDocument();
+    SetNotInitialEmptyDocument();
   }
 
   // For uuid-in-package: resources served from WebBundles, use the Bundle's
@@ -4237,7 +4236,8 @@
   // a case as the embedders are unaware of prerender page yet and shouldn't
   // show any user-visible changes from an inactive RenderFrameHost.
   if (!GetParentOrOuterDocument() &&
-      CancelPrerendering(PrerenderFinalStatus::kDidFailLoad)) {
+      CancelPrerendering(
+          PrerenderCancellationReason(PrerenderFinalStatus::kDidFailLoad))) {
     return;
   }
 
@@ -4529,7 +4529,7 @@
   GURL filtered_url(url);
   GetProcess()->FilterURL(/*empty_allowed=*/false, &filtered_url);
   renderer_url_info_.last_document_url = filtered_url;
-  frame_tree_node_->DidOpenDocumentInputStream();
+  DidOpenDocumentInputStream();
 }
 
 RenderWidgetHostImpl* RenderFrameHostImpl::GetRenderWidgetHost() {
@@ -5336,7 +5336,8 @@
   // TODO(crbug.com/1205359): We should defer the download until the
   // prerendering page is activated, and it will comply with the prerendering
   // spec.
-  if (CancelPrerendering(PrerenderFinalStatus::kDownload)) {
+  if (CancelPrerendering(
+          PrerenderCancellationReason(PrerenderFinalStatus::kDownload))) {
     return;
   }
 
@@ -6242,8 +6243,8 @@
     }
       return true;
     case LifecycleStateImpl::kPrerendering:
-      RecordPrerenderReasonForInactivePageRestriction(reason, *this);
-      CancelPrerendering(PrerenderFinalStatus::kInactivePageRestriction);
+      CancelPrerendering(
+          PrerenderCancellationReason::BuildForDisallowActivationState(reason));
       return true;
     case LifecycleStateImpl::kSpeculative:
       // We do not expect speculative or pending commit RenderFrameHosts to
@@ -10170,7 +10171,8 @@
         base::BindOnce(
             base::IgnoreResult(&RenderFrameHostImpl::CancelPrerendering),
             base::Unretained(this),
-            PrerenderFinalStatus::kAudioOutputDeviceRequested));
+            PrerenderCancellationReason(
+                PrerenderFinalStatus::kAudioOutputDeviceRequested)));
   } else {
     audio_service_audio_output_stream_factory_.emplace(
         this, audio_system, media_stream_manager, std::move(receiver),
@@ -10221,9 +10223,8 @@
       .WithArgs(std::move(receiver));
 }
 
-bool RenderFrameHostImpl::CancelPrerendering(PrerenderFinalStatus status) {
-  if (!blink::features::IsPrerender2Enabled())
-    return false;
+bool RenderFrameHostImpl::CancelPrerendering(
+    const PrerenderCancellationReason& reason) {
   // A prerendered page is identified by its root FrameTreeNode id, so if this
   // RenderFrameHost is in any way embedded, we need to iterate up to the
   // prerender root.
@@ -10237,11 +10238,8 @@
   if (outermost_frame->GetFrameType() != FrameType::kPrerenderMainFrame)
     return false;
 
-  // TODO(https://crbug.com/1126305): Pass a FinalStatus to CancelPrerendering()
-  // method when MojoInterface control, or IsInactiveAndDisallowActivation are
-  // called.
   return delegate_->GetPrerenderHostRegistry()->CancelHost(
-      outermost_frame->frame_tree_node_id(), status);
+      outermost_frame->frame_tree_node_id(), reason);
 }
 
 void RenderFrameHostImpl::CancelPrerenderingByMojoBinderPolicy(
@@ -10249,6 +10247,8 @@
   // A prerendered page is identified by its root FrameTreeNode id, so if this
   // RenderFrameHost is in any way embedded, we need to iterate up to the
   // prerender root.
+  // TODO(https://crbug.com/1363996): Move the devtools logic to
+  // PrerenderHostRegistry, as it knows the detailed cancellation reason now.
   FrameTreeNode* outermost_frame =
       GetOutermostMainFrameOrEmbedder()->frame_tree_node();
   PrerenderHost* prerender_host =
@@ -10257,11 +10257,8 @@
   if (!prerender_host)
     return;
 
-  RecordPrerenderCancelledInterface(
-      interface_name, prerender_host->trigger_type(),
-      prerender_host->embedder_histogram_suffix());
-
-  bool canceled = CancelPrerendering(PrerenderFinalStatus::kMojoBinderPolicy);
+  bool canceled = CancelPrerendering(
+      PrerenderCancellationReason::BuildForMojoBinderPolicy(interface_name));
   // This function is called from MojoBinderPolicyApplier, which should only be
   // active during prerendering. It would be an error to call this while not
   // prerendering, as it could mean an interface request is never resolved for
@@ -10283,8 +10280,6 @@
 }
 
 void RenderFrameHostImpl::RendererWillActivateForPrerendering() {
-  DCHECK(blink::features::IsPrerender2Enabled());
-
   if (audio_service_audio_output_stream_factory_) {
     audio_service_audio_output_stream_factory_->ReleaseRestriction();
   }
@@ -10728,9 +10723,9 @@
 }
 
 bool IsInitialSynchronousAboutBlankCommit(const GURL& url,
-                                          bool is_on_initial_empty_document) {
+                                          bool is_initial_empty_document) {
   return url.SchemeIs(url::kAboutScheme) && url != GURL(url::kAboutSrcdocURL) &&
-         is_on_initial_empty_document;
+         is_initial_empty_document;
 }
 
 std::unique_ptr<NavigationRequest>
diff --git a/content/browser/renderer_host/render_frame_host_impl.h b/content/browser/renderer_host/render_frame_host_impl.h
index d8254b6..9253d03 100644
--- a/content/browser/renderer_host/render_frame_host_impl.h
+++ b/content/browser/renderer_host/render_frame_host_impl.h
@@ -45,7 +45,6 @@
 #include "content/browser/buckets/bucket_context.h"
 #include "content/browser/can_commit_status.h"
 #include "content/browser/network/cross_origin_opener_policy_reporter.h"
-#include "content/browser/preloading/prerender/prerender_final_status.h"
 #include "content/browser/renderer_host/back_forward_cache_impl.h"
 #include "content/browser/renderer_host/back_forward_cache_metrics.h"
 #include "content/browser/renderer_host/browsing_context_state.h"
@@ -237,6 +236,7 @@
 class FrameTree;
 class FrameTreeNode;
 class GeolocationServiceImpl;
+class PrerenderCancellationReason;
 class IdleManagerImpl;
 class NavigationEarlyHintsManager;
 class NavigationRequest;
@@ -1996,11 +1996,10 @@
   // frame is in, which destroys this frame.
   // Returns true if a prerender was canceled. Does nothing and returns false if
   // `this` is not prerendered.
-  bool CancelPrerendering(PrerenderFinalStatus status);
+  bool CancelPrerendering(const PrerenderCancellationReason& reason);
   // Called by MojoBinderPolicyApplier when it receives a kCancel interface.
   void CancelPrerenderingByMojoBinderPolicy(const std::string& interface_name);
 
-  // Prerender2:
   // Called when the Activate IPC is sent to the renderer. Puts the
   // MojoPolicyBinderApplier in "loose" mode via PrepareToGrantAll() until
   // DidActivateForPrerending() is called.
@@ -2685,6 +2684,20 @@
   // document.
   void SendAllPendingBeaconsOnNavigation();
 
+  // Sets `is_initial_empty_document_` to false.
+  void SetNotInitialEmptyDocument() { is_initial_empty_document_ = false; }
+
+  // Returns false if this document not the initial empty document, or if the
+  // current document's input stream has been opened with document.open(),
+  // causing the document to lose its "initial empty document" status. For more
+  // details, see the definition of `is_initial_empty_document_`.
+  bool is_initial_empty_document() const { return is_initial_empty_document_; }
+
+  // Sets `is_initial_empty_document_` to
+  // false. Must only be called after the current document's input stream has
+  // been opened with document.open().
+  void DidOpenDocumentInputStream() { is_initial_empty_document_ = false; }
+
   enum class FencedFrameStatus {
     kNotNestedInFencedFrame,
     kFencedFrameRoot,
@@ -4534,6 +4547,24 @@
   // nested within a fenced frame.
   const FencedFrameStatus fenced_frame_status_;
 
+  // Whether this document is the initial about:blank document or the
+  // synchronously committed about:blank document committed at frame creation,
+  // and its "initial empty document"-ness is still true.
+  // This will be false if either of these has happened:
+  // - The RenderFrameHost had committed a cross-document navigation that is
+  //   not the synchronously committed about:blank document per:
+  //   https://html.spec.whatwg.org/multipage/browsers.html#creating-browsing-contexts:is-initial-about:blank
+  // - The document's input stream has been opened with document.open(), per
+  //   https://html.spec.whatwg.org/multipage/dynamic-markup-insertion.html#opening-the-input-stream:is-initial-about:blank
+  // NOTE: we treat both the "initial about:blank document" and the
+  // "synchronously committed about:blank document" as the initial empty
+  // document. In the future, we plan to remove the synchronous about:blank
+  // commit so that this state will only be true if the frame is on the
+  // "initial about:blank document". See also:
+  // - https://github.com/whatwg/html/issues/6863
+  // - https://crbug.com/1215096
+  bool is_initial_empty_document_ = true;
+
   // Testing callback run in DidStopLoading() regardless of loading state. This
   // is useful for tests that need to detect when newly created frames finish
   // loading about:blank.
diff --git a/content/browser/renderer_host/render_frame_host_impl_unittest.cc b/content/browser/renderer_host/render_frame_host_impl_unittest.cc
index 110959a..234baea7 100644
--- a/content/browser/renderer_host/render_frame_host_impl_unittest.cc
+++ b/content/browser/renderer_host/render_frame_host_impl_unittest.cc
@@ -5,6 +5,7 @@
 #include <memory>
 
 #include "base/memory/ptr_util.h"
+#include "base/memory/raw_ptr.h"
 #include "base/test/scoped_feature_list.h"
 #include "build/buildflag.h"
 #include "content/browser/renderer_host/navigation_controller_impl.h"
@@ -708,7 +709,7 @@
   }
 
  private:
-  TestWebAuthenticationDelegate* delegate_;
+  raw_ptr<TestWebAuthenticationDelegate> delegate_;
 };
 
 class RenderFrameHostImplWebAuthnTest : public RenderFrameHostImplTest {
@@ -729,7 +730,7 @@
   }
 
  protected:
-  ContentBrowserClient* old_browser_client_;
+  raw_ptr<ContentBrowserClient> old_browser_client_;
   std::unique_ptr<TestWebAuthnContentBrowserClientImpl> browser_client_;
   std::unique_ptr<TestWebAuthenticationDelegate> webauthn_delegate_ =
       std::make_unique<TestWebAuthenticationDelegate>();
diff --git a/content/browser/renderer_host/render_frame_host_manager.cc b/content/browser/renderer_host/render_frame_host_manager.cc
index bb64252..75f3977 100644
--- a/content/browser/renderer_host/render_frame_host_manager.cc
+++ b/content/browser/renderer_host/render_frame_host_manager.cc
@@ -998,7 +998,6 @@
 // to ensure that we do not create speculative RFHs for prerender activation.
 void RenderFrameHostManager::ActivatePrerender(
     std::unique_ptr<StoredPage> stored_page) {
-  DCHECK(blink::features::IsPrerender2Enabled());
   if (speculative_render_frame_host_) {
     DiscardUnusedFrame(UnsetSpeculativeRenderFrameHost(
         NavigationDiscardReason::kNewNavigation));
diff --git a/content/browser/renderer_host/render_widget_host_view_android.h b/content/browser/renderer_host/render_widget_host_view_android.h
index d021a91..6321ac9 100644
--- a/content/browser/renderer_host/render_widget_host_view_android.h
+++ b/content/browser/renderer_host/render_widget_host_view_android.h
@@ -469,7 +469,7 @@
 
     base::OneShotTimer throttle_timeout_;
 
-    RenderWidgetHostViewAndroid* rwhva_;
+    raw_ptr<RenderWidgetHostViewAndroid> rwhva_;
   };
 
   bool ShouldReportAllRootScrolls();
diff --git a/content/browser/renderer_host/render_widget_host_view_aura_vk_browsertest.cc b/content/browser/renderer_host/render_widget_host_view_aura_vk_browsertest.cc
index ab3f775c..8046505 100644
--- a/content/browser/renderer_host/render_widget_host_view_aura_vk_browsertest.cc
+++ b/content/browser/renderer_host/render_widget_host_view_aura_vk_browsertest.cc
@@ -2,6 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+#include "base/memory/raw_ptr.h"
 #include "base/observer_list.h"
 #include "base/win/windows_version.h"
 #include "build/build_config.h"
@@ -457,7 +458,7 @@
       std::move(quit_callback_).Run();
   }
 
-  RenderWidgetHostView* last_updated_active_view_ = nullptr;
+  raw_ptr<RenderWidgetHostView> last_updated_active_view_ = nullptr;
   base::OnceClosure quit_callback_;
 };
 
diff --git a/content/browser/renderer_host/stored_page.h b/content/browser/renderer_host/stored_page.h
index 5805b68..a1a8bba 100644
--- a/content/browser/renderer_host/stored_page.h
+++ b/content/browser/renderer_host/stored_page.h
@@ -8,6 +8,7 @@
 #include <set>
 #include <unordered_map>
 
+#include "base/memory/raw_ptr.h"
 #include "base/memory/safe_ref.h"
 #include "content/browser/site_instance_group.h"
 #include "content/public/browser/site_instance.h"
@@ -122,7 +123,7 @@
   // we're restoring a page from the back-forward cache.
   blink::mojom::PageRestoreParamsPtr page_restore_params_;
 
-  Delegate* delegate_ = nullptr;
+  raw_ptr<Delegate> delegate_ = nullptr;
 };
 
 }  // namespace content
diff --git a/content/browser/scheduler/responsiveness/jank_monitor_impl.cc b/content/browser/scheduler/responsiveness/jank_monitor_impl.cc
index 581bb2e..677366b 100644
--- a/content/browser/scheduler/responsiveness/jank_monitor_impl.cc
+++ b/content/browser/scheduler/responsiveness/jank_monitor_impl.cc
@@ -310,7 +310,7 @@
   }
 
   // Mark that the target thread is janky and notify the monitor thread.
-  return task_execution_metadata_.back().identifier;
+  return task_execution_metadata_.back().identifier.get();
 }
 
 void JankMonitorImpl::ThreadExecutionState::WillRunTaskOrEvent(
diff --git a/content/browser/scheduler/responsiveness/jank_monitor_impl.h b/content/browser/scheduler/responsiveness/jank_monitor_impl.h
index a05432c..953a6dc 100644
--- a/content/browser/scheduler/responsiveness/jank_monitor_impl.h
+++ b/content/browser/scheduler/responsiveness/jank_monitor_impl.h
@@ -8,6 +8,7 @@
 #include <atomic>
 
 #include "base/gtest_prod_util.h"
+#include "base/memory/raw_ptr.h"
 #include "base/observer_list.h"
 #include "base/sequence_checker.h"
 #include "base/synchronization/lock.h"
@@ -86,7 +87,7 @@
       ~TaskMetadata();
 
       base::TimeTicks execution_start_time;
-      const void* identifier;
+      raw_ptr<const void> identifier;
     };
     std::vector<TaskMetadata> task_execution_metadata_;
 
diff --git a/content/browser/shared_storage/shared_storage_browsertest.cc b/content/browser/shared_storage/shared_storage_browsertest.cc
index 10cbd01..c440c6f0 100644
--- a/content/browser/shared_storage/shared_storage_browsertest.cc
+++ b/content/browser/shared_storage/shared_storage_browsertest.cc
@@ -3895,7 +3895,7 @@
         std::make_unique<TestPrivateAggregationManagerImpl>(
             std::make_unique<MockPrivateAggregationBudgeter>(),
             base::WrapUnique<PrivateAggregationHost>(
-                private_aggregation_host_)));
+                private_aggregation_host_.get())));
 
     EXPECT_TRUE(NavigateToURL(
         shell(), https_server()->GetURL("a.test", kSimplePagePath)));
@@ -3915,7 +3915,7 @@
   url::Origin a_test_origin_;
 
  private:
-  PrivateAggregationHost* private_aggregation_host_;
+  raw_ptr<PrivateAggregationHost> private_aggregation_host_;
 
   base::test::ScopedFeatureList scoped_feature_list_;
 
diff --git a/content/browser/web_contents/web_contents_impl.cc b/content/browser/web_contents/web_contents_impl.cc
index 696c9dd..58e9c1d 100644
--- a/content/browser/web_contents/web_contents_impl.cc
+++ b/content/browser/web_contents/web_contents_impl.cc
@@ -77,6 +77,7 @@
 #include "content/browser/portal/portal.h"
 #include "content/browser/preloading/prerender/prerender_final_status.h"
 #include "content/browser/preloading/prerender/prerender_host_registry.h"
+#include "content/browser/preloading/prerender/prerender_metrics.h"
 #include "content/browser/renderer_host/agent_scheduling_group_host.h"
 #include "content/browser/renderer_host/cross_process_frame_connector.h"
 #include "content/browser/renderer_host/frame_token_message_queue.h"
@@ -921,10 +922,7 @@
           std::make_unique<MediaWebContentsObserver>(this)),
       is_overlay_content_(false),
       showing_context_menu_(false),
-      prerender_host_registry_(
-          blink::features::IsPrerender2Enabled()
-              ? std::make_unique<PrerenderHostRegistry>(*this)
-              : nullptr),
+      prerender_host_registry_(std::make_unique<PrerenderHostRegistry>(*this)),
       audible_power_mode_voter_(
           power_scheduler::PowerModeArbiter::GetInstance()->NewVoter(
               "PowerModeVoter.Audible")) {
@@ -1473,12 +1471,10 @@
   std::vector<FrameTree*> result;
   result.push_back(&GetPrimaryFrameTree());
 
-  if (blink::features::IsPrerender2Enabled()) {
-    const std::vector<FrameTree*> prerender_frame_trees =
-        GetPrerenderHostRegistry()->GetPrerenderFrameTrees();
-    result.insert(result.end(), prerender_frame_trees.begin(),
-                  prerender_frame_trees.end());
-  }
+  const std::vector<FrameTree*> prerender_frame_trees =
+      GetPrerenderHostRegistry()->GetPrerenderFrameTrees();
+  result.insert(result.end(), prerender_frame_trees.begin(),
+                prerender_frame_trees.end());
 
   return result;
 }
@@ -1833,7 +1829,8 @@
       // page may not allow another navigation including a reload, depending
       // on conditions.
       frame_tree->GetMainFrame()->CancelPrerendering(
-          PrerenderFinalStatus::kUaChangeRequiresReload);
+          PrerenderCancellationReason(
+              PrerenderFinalStatus::kUaChangeRequiresReload));
     } else {
       frame_tree->controller().Reload(ReloadType::BYPASSING_CACHE, true);
     }
@@ -2983,9 +2980,7 @@
   TRACE_EVENT0("content", "WebContentsImpl::Stop");
   ForEachFrameTree(base::BindRepeating(
       [](FrameTree* frame_tree) { frame_tree->StopLoading(); }));
-  if (blink::features::IsPrerender2Enabled()) {
-    GetPrerenderHostRegistry()->CancelAllHosts(PrerenderFinalStatus::kStop);
-  }
+  GetPrerenderHostRegistry()->CancelAllHosts(PrerenderFinalStatus::kStop);
   observers_.NotifyObservers(&WebContentsObserver::NavigationStopped);
 }
 
@@ -7460,7 +7455,6 @@
 }
 
 PrerenderHostRegistry* WebContentsImpl::GetPrerenderHostRegistry() {
-  DCHECK(blink::features::IsPrerender2Enabled());
   DCHECK(prerender_host_registry_);
   return prerender_host_registry_.get();
 }
@@ -9520,9 +9514,6 @@
 
 bool WebContentsImpl::CancelPrerendering(FrameTreeNode* frame_tree_node,
                                          PrerenderFinalStatus final_status) {
-  if (!blink::features::IsPrerender2Enabled())
-    return false;
-
   if (!frame_tree_node)
     return false;
 
@@ -9533,7 +9524,7 @@
   // the prerender root.
   if (frame_tree_node->GetParentOrOuterDocumentOrEmbedder()) {
     return frame_tree_node->GetParentOrOuterDocumentOrEmbedder()
-        ->CancelPrerendering(final_status);
+        ->CancelPrerendering(PrerenderCancellationReason(final_status));
   }
   return GetPrerenderHostRegistry()->CancelHost(
       frame_tree_node->frame_tree_node_id(), final_status);
diff --git a/content/public/test/browser_test_utils.cc b/content/public/test/browser_test_utils.cc
index 55db263..a7e67a4 100644
--- a/content/public/test/browser_test_utils.cc
+++ b/content/public/test/browser_test_utils.cc
@@ -2687,7 +2687,7 @@
     queue_->OnBackingWebContentsDestroyed(this);
   }
 
-  DOMMessageQueue* queue_;
+  raw_ptr<DOMMessageQueue> queue_;
 };
 
 DOMMessageQueue::DOMMessageQueue() {
diff --git a/content/public/test/preloading_test_util.h b/content/public/test/preloading_test_util.h
index 00758e9a..265fa82 100644
--- a/content/public/test/preloading_test_util.h
+++ b/content/public/test/preloading_test_util.h
@@ -7,6 +7,7 @@
 
 #include <vector>
 
+#include "base/memory/raw_ptr.h"
 #include "components/ukm/test_ukm_recorder.h"
 #include "content/public/browser/preloading.h"
 #include "content/public/browser/preloading_data.h"
@@ -77,7 +78,7 @@
   PreloadingFailureReason GetFailureReason();
 
  private:
-  PreloadingAttempt* preloading_attempt_;
+  raw_ptr<PreloadingAttempt> preloading_attempt_;
 };
 
 }  // namespace content::test
diff --git a/content/renderer/render_frame_impl.cc b/content/renderer/render_frame_impl.cc
index 0d87df3..aa66067 100644
--- a/content/renderer/render_frame_impl.cc
+++ b/content/renderer/render_frame_impl.cc
@@ -1098,8 +1098,6 @@
 void CallClientDeferMediaLoad(base::WeakPtr<RenderFrameImpl> frame,
                               bool has_played_media_before,
                               base::OnceClosure closure) {
-  DCHECK(blink::features::IsPrerender2Enabled());
-
   if (!frame)
     return;
   GetContentClient()->renderer()->DeferMediaLoad(
diff --git a/content/shell/browser/shell_platform_delegate_views.cc b/content/shell/browser/shell_platform_delegate_views.cc
index 766e2763..f6a867e1 100644
--- a/content/shell/browser/shell_platform_delegate_views.cc
+++ b/content/shell/browser/shell_platform_delegate_views.cc
@@ -61,7 +61,7 @@
 struct ShellPlatformDelegate::ShellData {
   gfx::Size content_size;
   // Self-owned Widget, destroyed through CloseNow().
-  views::Widget* window_widget = nullptr;
+  raw_ptr<views::Widget> window_widget = nullptr;
 };
 
 struct ShellPlatformDelegate::PlatformData {
diff --git a/content/test/content_browser_test_utils_internal.cc b/content/test/content_browser_test_utils_internal.cc
index 91a11d67..4a77887 100644
--- a/content/test/content_browser_test_utils_internal.cc
+++ b/content/test/content_browser_test_utils_internal.cc
@@ -901,11 +901,9 @@
       ->GetController()
       .GetBackForwardCache()
       .Flush();
-  if (blink::features::IsPrerender2Enabled()) {
-    static_cast<WebContentsImpl*>(web_contents())
-        ->GetPrerenderHostRegistry()
-        ->CancelAllHostsForTesting();
-  }
+  static_cast<WebContentsImpl*>(web_contents())
+      ->GetPrerenderHostRegistry()
+      ->CancelAllHostsForTesting();
 
   for (RenderFrameHost* rfh : CollectAllRenderFrameHosts(web_contents())) {
     // Keep track of all currently inactive RenderFrameHosts so that we can wait
@@ -941,4 +939,27 @@
   TestNavigationObserver::OnDidFinishNavigation(navigation_handle);
 }
 
+RenderFrameHostImpl* DescendantRenderFrameHostAtInternal(
+    RenderFrameHostImpl* rfh,
+    std::string path,
+    std::vector<size_t>& descendant_indices) {
+  if (descendant_indices.size() == 0)
+    return rfh;
+  size_t index = descendant_indices[0];
+  descendant_indices.erase(descendant_indices.begin());
+  CHECK_LT(index, rfh->child_count()) << path;
+  FrameTreeNode* node = rfh->child_at(index);
+  path = base::StringPrintf("%s[%zu]", path.c_str(), index);
+  return DescendantRenderFrameHostAtInternal(node->current_frame_host(), path,
+                                             descendant_indices);
+}
+
+RenderFrameHostImpl* DescendantRenderFrameHostImplAt(
+    const ToRenderFrameHost& adapter,
+    std::vector<size_t> descendant_indices) {
+  return DescendantRenderFrameHostAtInternal(
+      static_cast<RenderFrameHostImpl*>(adapter.render_frame_host()), "rfh",
+      descendant_indices);
+}
+
 }  // namespace content
diff --git a/content/test/content_browser_test_utils_internal.h b/content/test/content_browser_test_utils_internal.h
index 4df2233..039fbd6e 100644
--- a/content/test/content_browser_test_utils_internal.h
+++ b/content/test/content_browser_test_utils_internal.h
@@ -701,6 +701,13 @@
   NavigationType last_navigation_type_ = NAVIGATION_TYPE_UNKNOWN;
 };
 
+// Return the descendant of `rfh` found by selecting children according to
+// `descendant_indices`. E.g. `DescendantRenderFrameHostImplAt(rfh, {0, 1}) will
+// return the child at index 1 of the child at index 0 of `rfh`.
+RenderFrameHostImpl* DescendantRenderFrameHostImplAt(
+    const ToRenderFrameHost& adapter,
+    std::vector<size_t> descendant_indices);
+
 }  // namespace content
 
 #endif  // CONTENT_TEST_CONTENT_BROWSER_TEST_UTILS_INTERNAL_H_
diff --git a/content/test/fenced_frame_test_utils.h b/content/test/fenced_frame_test_utils.h
index a363b6dc..9110d4c 100644
--- a/content/test/fenced_frame_test_utils.h
+++ b/content/test/fenced_frame_test_utils.h
@@ -5,6 +5,7 @@
 #ifndef CONTENT_TEST_FENCED_FRAME_TEST_UTILS_H_
 #define CONTENT_TEST_FENCED_FRAME_TEST_UTILS_H_
 
+#include "base/memory/raw_ptr.h"
 #include "content/browser/fenced_frame/fenced_frame_url_mapping.h"
 #include "net/base/net_errors.h"
 
@@ -95,7 +96,7 @@
   void FillMap(const GURL& url);
 
  private:
-  FencedFrameURLMapping* fenced_frame_url_mapping_;
+  raw_ptr<FencedFrameURLMapping> fenced_frame_url_mapping_;
 };
 
 }  // namespace content
diff --git a/courgette/adjustment_method_2.cc b/courgette/adjustment_method_2.cc
index 177dcb60..c30e54a5 100644
--- a/courgette/adjustment_method_2.cc
+++ b/courgette/adjustment_method_2.cc
@@ -511,7 +511,7 @@
       Shingle::PointerLess resolve_ties;
     };
    private:
-    const Shingle* instance_;
+    raw_ptr<const Shingle> instance_;
   };
 
   typedef std::set<FreqView, FreqView::Greater> Histogram;
diff --git a/device/fido/win/authenticator.cc b/device/fido/win/authenticator.cc
index 7b92275..847671fd 100644
--- a/device/fido/win/authenticator.cc
+++ b/device/fido/win/authenticator.cc
@@ -12,6 +12,7 @@
 #include "base/bind.h"
 #include "base/check_op.h"
 #include "base/containers/flat_map.h"
+#include "base/memory/raw_ptr.h"
 #include "base/memory/ref_counted.h"
 #include "base/notreached.h"
 #include "base/strings/string_util_win.h"
@@ -39,7 +40,7 @@
   inline void operator()(PWEBAUTHN_CREDENTIAL_DETAILS_LIST ptr) const {
     win_api_->FreePlatformCredentialList(ptr);
   }
-  WinWebAuthnApi* win_api_;
+  raw_ptr<WinWebAuthnApi> win_api_;
 };
 
 }  // namespace
diff --git a/device/gamepad/gamepad_service.h b/device/gamepad/gamepad_service.h
index cc1ca418..71d390b 100644
--- a/device/gamepad/gamepad_service.h
+++ b/device/gamepad/gamepad_service.h
@@ -13,6 +13,7 @@
 
 #include "base/bind.h"
 #include "base/callback_forward.h"
+#include "base/memory/raw_ptr.h"
 #include "base/memory/read_only_shared_memory_region.h"
 #include "base/memory/singleton.h"
 #include "base/sequence_checker.h"
@@ -139,7 +140,7 @@
       return consumer < other.consumer;
     }
 
-    GamepadConsumer* consumer;
+    raw_ptr<GamepadConsumer> consumer;
     mutable bool is_active = false;
     mutable bool did_observe_user_gesture = false;
   };
diff --git a/extensions/browser/api/declarative_net_request/flat_ruleset_indexer_unittest.cc b/extensions/browser/api/declarative_net_request/flat_ruleset_indexer_unittest.cc
index 88c3f55..d357b70 100644
--- a/extensions/browser/api/declarative_net_request/flat_ruleset_indexer_unittest.cc
+++ b/extensions/browser/api/declarative_net_request/flat_ruleset_indexer_unittest.cc
@@ -11,6 +11,7 @@
 
 #include "base/format_macros.h"
 #include "base/json/json_reader.h"
+#include "base/memory/raw_ptr.h"
 #include "base/ranges/algorithm.h"
 #include "base/strings/stringprintf.h"
 #include "components/url_pattern_index/flat/url_pattern_index_generated.h"
@@ -260,22 +261,22 @@
 void VerifyIndexEquality(const std::vector<const IndexedRule*>& rules,
                          const flat_rule::UrlPatternIndex* index) {
   struct RulePair {
-    const IndexedRule* indexed_rule = nullptr;
-    const flat_rule::UrlRule* url_rule = nullptr;
+    raw_ptr<const IndexedRule> indexed_rule = nullptr;
+    raw_ptr<const flat_rule::UrlRule> url_rule = nullptr;
   };
 
   // Build a map from rule IDs to RulePair(s).
   std::map<uint32_t, RulePair> map;
 
   for (const auto* rule : rules) {
-    EXPECT_EQ(nullptr, map[rule->id].indexed_rule);
+    EXPECT_EQ(nullptr, map[rule->id].indexed_rule.get());
     map[rule->id].indexed_rule = rule;
   }
 
   std::vector<const flat_rule::UrlRule*> flat_rules =
       GetAllRulesFromIndex(index);
   for (const auto* rule : flat_rules) {
-    EXPECT_EQ(nullptr, map[rule->id()].url_rule);
+    EXPECT_EQ(nullptr, map[rule->id()].url_rule.get());
     map[rule->id()].url_rule = rule;
   }
 
@@ -294,8 +295,8 @@
     const ::flatbuffers::Vector<flatbuffers::Offset<flat::UrlRuleMetadata>>*
         extension_metdata) {
   struct MetadataPair {
-    const IndexedRule* indexed_rule = nullptr;
-    const flat::UrlRuleMetadata* metadata = nullptr;
+    raw_ptr<const IndexedRule> indexed_rule = nullptr;
+    raw_ptr<const flat::UrlRuleMetadata> metadata = nullptr;
   };
 
   // Build a map from IDs to MetadataPair(s).
@@ -311,7 +312,7 @@
 
   int previous_id = kMinValidID - 1;
   for (const auto* metadata : *extension_metdata) {
-    EXPECT_EQ(nullptr, map[metadata->id()].metadata);
+    EXPECT_EQ(nullptr, map[metadata->id()].metadata.get());
     map[metadata->id()].metadata = metadata;
 
     // Also verify that the metadata vector is sorted by ID.
diff --git a/extensions/browser/api/file_handlers/app_file_handler_util.h b/extensions/browser/api/file_handlers/app_file_handler_util.h
index d6e7bbc..a272ed3 100644
--- a/extensions/browser/api/file_handlers/app_file_handler_util.h
+++ b/extensions/browser/api/file_handlers/app_file_handler_util.h
@@ -11,6 +11,7 @@
 #include <vector>
 
 #include "base/callback.h"
+#include "base/memory/raw_ptr.h"
 #include "extensions/common/extension.h"
 #include "extensions/common/manifest_handlers/file_handler_info.h"
 
@@ -56,7 +57,7 @@
   bool DoMatch(const EntryInfo& entry);
 
  private:
-  const apps::FileHandler* const file_handler_;
+  const raw_ptr<const apps::FileHandler> file_handler_;
   bool matched_mime_type_ = false;
   bool matched_file_extension_ = false;
 };
diff --git a/extensions/browser/api/messaging/extension_message_port.cc b/extensions/browser/api/messaging/extension_message_port.cc
index cd0758e9..7e447cf5b7 100644
--- a/extensions/browser/api/messaging/extension_message_port.cc
+++ b/extensions/browser/api/messaging/extension_message_port.cc
@@ -131,8 +131,8 @@
 
 // Represents target of an IPC (render frame, ServiceWorker or render process).
 struct ExtensionMessagePort::IPCTarget {
-  content::RenderProcessHost* render_process_host;
-  content::RenderFrameHost* render_frame_host;
+  raw_ptr<content::RenderProcessHost> render_process_host;
+  raw_ptr<content::RenderFrameHost> render_frame_host;
   int worker_thread_id;
 };
 
diff --git a/extensions/browser/api/web_request/web_request_api.h b/extensions/browser/api/web_request/web_request_api.h
index caf3a72..bc5d630 100644
--- a/extensions/browser/api/web_request/web_request_api.h
+++ b/extensions/browser/api/web_request/web_request_api.h
@@ -625,7 +625,7 @@
     // BrowserContext. That is, if this context is incognito, `cross_context`
     // will point to the original context; if this context is the original,
     // `cross_context` will point to the incognito context (if any).
-    content::BrowserContext* cross_context = nullptr;
+    raw_ptr<content::BrowserContext> cross_context = nullptr;
   };
 
   using DataMap = std::map<content::BrowserContext*, BrowserContextData>;
diff --git a/extensions/browser/api/web_request/web_request_api_helpers.cc b/extensions/browser/api/web_request/web_request_api_helpers.cc
index 31605e2..64955b7e 100644
--- a/extensions/browser/api/web_request/web_request_api_helpers.cc
+++ b/extensions/browser/api/web_request/web_request_api_helpers.cc
@@ -16,6 +16,7 @@
 #include "base/containers/contains.h"
 #include "base/containers/fixed_flat_map.h"
 #include "base/containers/fixed_flat_set.h"
+#include "base/memory/raw_ptr.h"
 #include "base/memory/scoped_refptr.h"
 #include "base/metrics/histogram_macros.h"
 #include "base/ranges/algorithm.h"
@@ -383,8 +384,8 @@
   }
 
   // Non-owning pointers to HeaderInfo and ExtensionId.
-  const DNRRequestAction::HeaderInfo* header_info;
-  const extensions::ExtensionId* extension_id;
+  raw_ptr<const DNRRequestAction::HeaderInfo> header_info;
+  raw_ptr<const extensions::ExtensionId> extension_id;
 };
 
 // Helper to modify request headers from
diff --git a/extensions/browser/extension_navigation_throttle.cc b/extensions/browser/extension_navigation_throttle.cc
index 781e41f3..3276614 100644
--- a/extensions/browser/extension_navigation_throttle.cc
+++ b/extensions/browser/extension_navigation_throttle.cc
@@ -6,6 +6,7 @@
 
 #include <string>
 
+#include "base/containers/contains.h"
 #include "components/guest_view/browser/guest_view_base.h"
 #include "content/public/browser/browser_thread.h"
 #include "content/public/browser/navigation_handle.h"
@@ -30,6 +31,7 @@
 #include "extensions/common/extension_urls.h"
 #include "extensions/common/identifiability_metrics.h"
 #include "extensions/common/manifest_handlers/icons_handler.h"
+#include "extensions/common/manifest_handlers/mime_types_handler.h"
 #include "extensions/common/manifest_handlers/web_accessible_resources_info.h"
 #include "extensions/common/manifest_handlers/webview_info.h"
 #include "extensions/common/mojom/view_type.mojom.h"
@@ -277,19 +279,31 @@
     return content::NavigationThrottle::BLOCK_REQUEST;
   }
 
-  // A browser-initiated navigation is always considered trusted, and thus
-  // allowed.
-  if (!navigation_handle()->IsRendererInitiated())
-    return content::NavigationThrottle::PROCEED;
-
-  // A renderer-initiated request without an initiator origin is a history
-  // traversal to an entry that was originally loaded in a browser-initiated
-  // navigation. Those are trusted, too.
+  // Automatically trusted navigation:
+  // * Browser-initiated navigations without an initiator origin happen when a
+  //   user directly triggers a navigation (e.g. using the omnibox, or the
+  //   bookmark bar).
+  // * Renderer-initiated navigations without an initiator origin represent a
+  //   history traversal to an entry that was originally loaded in a
+  //   browser-initiated navigation.
   if (!navigation_handle()->GetInitiatorOrigin().has_value())
     return content::NavigationThrottle::PROCEED;
 
+  // Not automatically trusted navigation:
+  // * Some browser-initiated navigations with an initiator origin are not
+  //   automatically trusted and allowed. For example, see the scenario where
+  //   a frame-reload is triggered from the context menu in crbug.com/1343610.
+  // * An initiator origin matching an extension. There are some MIME type
+  //   handlers in an allow list. For example, there are a variety of mechanisms
+  //   that can initiate navigations from the PDF viewer. The extension isn't
+  //   navigated, but the page that contains the PDF can be.
   const url::Origin& initiator_origin =
       navigation_handle()->GetInitiatorOrigin().value();
+  if (initiator_origin.scheme() == kExtensionScheme &&
+      base::Contains(MimeTypesHandler::GetMIMETypeAllowlist(),
+                     initiator_origin.host())) {
+    return content::NavigationThrottle::PROCEED;
+  }
 
   // Navigations from chrome://, devtools:// or chrome-search:// pages need to
   // be allowed, even if the target |url| is not web-accessible.  See also:
diff --git a/extensions/browser/extension_prefs_helper.h b/extensions/browser/extension_prefs_helper.h
index e3cb556..2ee6c51c 100644
--- a/extensions/browser/extension_prefs_helper.h
+++ b/extensions/browser/extension_prefs_helper.h
@@ -7,6 +7,7 @@
 
 #include <string>
 
+#include "base/memory/raw_ptr.h"
 #include "components/keyed_service/core/keyed_service.h"
 #include "extensions/browser/extension_prefs_scope.h"
 
@@ -70,8 +71,8 @@
   const ExtensionPrefs* prefs() const { return prefs_; }
 
  private:
-  ExtensionPrefs* const prefs_;
-  ExtensionPrefValueMap* const value_map_;
+  const raw_ptr<ExtensionPrefs> prefs_;
+  const raw_ptr<ExtensionPrefValueMap> value_map_;
 };
 
 }  // namespace extensions
diff --git a/extensions/browser/permissions_manager.cc b/extensions/browser/permissions_manager.cc
index bbcee0e..1221bd2d 100644
--- a/extensions/browser/permissions_manager.cc
+++ b/extensions/browser/permissions_manager.cc
@@ -6,6 +6,7 @@
 
 #include <memory>
 
+#include "base/check.h"
 #include "base/containers/contains.h"
 #include "base/feature_list.h"
 #include "base/no_destructor.h"
@@ -404,16 +405,10 @@
   if (!util::CanWithholdPermissionsFromExtension(extension))
     return false;
 
-  // The extension can be affected if it currently has host permissions, or if
-  // it did and they are actively withheld.
-  return !extension.permissions_data()
-              ->active_permissions()
-              .effective_hosts()
-              .is_empty() ||
-         !extension.permissions_data()
-              ->withheld_permissions()
-              .effective_hosts()
-              .is_empty();
+  // The extension can be affected by runtime host permissions if it requests
+  // host permissions.
+  return !PermissionsParser::GetRequiredPermissions(&extension).IsEmpty() ||
+         !PermissionsParser::GetOptionalPermissions(&extension).IsEmpty();
 }
 
 bool PermissionsManager::HasGrantedHostPermission(const Extension& extension,
diff --git a/extensions/common/extension_builder.cc b/extensions/common/extension_builder.cc
index 2446215e..202d3ec 100644
--- a/extensions/common/extension_builder.cc
+++ b/extensions/common/extension_builder.cc
@@ -33,9 +33,9 @@
   using ContentScriptEntry = std::pair<std::string, std::vector<std::string>>;
   std::vector<ContentScriptEntry> content_scripts;
 
-  absl::optional<base::Value> extra;
+  absl::optional<base::Value::Dict> extra;
 
-  std::unique_ptr<base::DictionaryValue> GetValue() const {
+  base::Value::Dict GetValue() const {
     DictionaryBuilder manifest;
     manifest.Set(manifest_keys::kName, name)
         .Set(manifest_keys::kManifestVersion, manifest_version.value_or(2))
@@ -106,20 +106,17 @@
                    scripts_value.Build());
     }
 
-    std::unique_ptr<base::DictionaryValue> result = manifest.Build();
-    if (extra) {
-      const base::DictionaryValue* extra_dict = nullptr;
-      extra->GetAsDictionary(&extra_dict);
-      result->MergeDictionary(extra_dict);
-    }
+    base::Value::Dict result = manifest.BuildDict();
+    if (extra)
+      result.Merge(extra->Clone());
 
     return result;
   }
 
-  base::Value* get_extra() {
+  base::Value::Dict& get_extra() {
     if (!extra)
-      extra.emplace(base::Value::Type::DICTIONARY);
-    return &extra.value();
+      extra.emplace();
+    return *extra;
   }
 };
 
@@ -149,8 +146,9 @@
   std::string error;
   scoped_refptr<const Extension> extension = Extension::Create(
       path_, location_,
-      manifest_data_ ? *manifest_data_->GetValue() : *manifest_value_, flags_,
-      id_, &error);
+      manifest_data_ ? base::DictAdapterForMigration(manifest_data_->GetValue())
+                     : *manifest_value_,
+      flags_, id_, &error);
 
   CHECK(error.empty()) << error;
   CHECK(extension);
@@ -160,9 +158,8 @@
 
 base::Value ExtensionBuilder::BuildManifest() {
   CHECK(manifest_data_ || manifest_value_);
-  return manifest_data_
-             ? base::Value::FromUniquePtrValue(manifest_data_->GetValue())
-             : manifest_value_->Clone();
+  return manifest_data_ ? base::Value(manifest_data_->GetValue())
+                        : manifest_value_->Clone();
 }
 
 ExtensionBuilder& ExtensionBuilder::AddPermission(
@@ -249,7 +246,7 @@
 ExtensionBuilder& ExtensionBuilder::MergeManifest(const base::Value& to_merge) {
   CHECK(to_merge.is_dict());
   if (manifest_data_) {
-    manifest_data_->get_extra()->MergeDictionary(&to_merge);
+    manifest_data_->get_extra().Merge(to_merge.GetDict().Clone());
   } else {
     manifest_value_->MergeDictionary(&to_merge);
   }
@@ -274,14 +271,13 @@
 void ExtensionBuilder::SetManifestKeyImpl(base::StringPiece key,
                                           base::Value value) {
   CHECK(manifest_data_);
-  manifest_data_->get_extra()->SetKey(key, std::move(value));
+  manifest_data_->get_extra().Set(key, std::move(value));
 }
 
-void ExtensionBuilder::SetManifestPathImpl(
-    std::initializer_list<base::StringPiece> path,
-    base::Value value) {
+void ExtensionBuilder::SetManifestPathImpl(base::StringPiece path,
+                                           base::Value value) {
   CHECK(manifest_data_);
-  manifest_data_->get_extra()->SetPath(path, std::move(value));
+  manifest_data_->get_extra().SetByDottedPath(path, std::move(value));
 }
 
 }  // namespace extensions
diff --git a/extensions/common/extension_builder.h b/extensions/common/extension_builder.h
index a49875c..b2959d6 100644
--- a/extensions/common/extension_builder.h
+++ b/extensions/common/extension_builder.h
@@ -120,9 +120,7 @@
     return *this;
   }
   template <typename T>
-  ExtensionBuilder& SetManifestPath(
-      std::initializer_list<base::StringPiece> path,
-      T&& value) {
+  ExtensionBuilder& SetManifestPath(base::StringPiece path, T&& value) {
     SetManifestPathImpl(path, base::Value(std::forward<T>(value)));
     return *this;
   }
@@ -135,9 +133,8 @@
     return *this;
   }
   template <typename T>
-  ExtensionBuilder& SetManifestPath(
-      std::initializer_list<base::StringPiece> path,
-      std::unique_ptr<T> value) {
+  ExtensionBuilder& SetManifestPath(base::StringPiece path,
+                                    std::unique_ptr<T> value) {
     SetManifestPathImpl(path, std::move(*value));
     return *this;
   }
@@ -189,8 +186,7 @@
   struct ManifestData;
 
   void SetManifestKeyImpl(base::StringPiece key, base::Value value);
-  void SetManifestPathImpl(std::initializer_list<base::StringPiece> path,
-                           base::Value value);
+  void SetManifestPathImpl(base::StringPiece path, base::Value value);
 
   // Information for constructing the manifest; either metadata about the
   // manifest which will be used to construct it, or the dictionary itself. Only
diff --git a/extensions/common/manifest_handlers/file_handler_info.h b/extensions/common/manifest_handlers/file_handler_info.h
index 3009c79..8433d2f 100644
--- a/extensions/common/manifest_handlers/file_handler_info.h
+++ b/extensions/common/manifest_handlers/file_handler_info.h
@@ -9,6 +9,7 @@
 #include <string>
 #include <vector>
 
+#include "base/memory/raw_ptr.h"
 #include "components/services/app_service/public/cpp/file_handler_info.h"
 #include "extensions/common/extension.h"
 #include "extensions/common/manifest_handler.h"
@@ -21,7 +22,7 @@
 struct FileHandlerMatch {
   FileHandlerMatch();
   ~FileHandlerMatch();
-  const apps::FileHandlerInfo* handler = nullptr;
+  raw_ptr<const apps::FileHandlerInfo> handler = nullptr;
 
   // True if the handler matched on MIME type
   bool matched_mime = false;
diff --git a/extensions/renderer/api/automation/automation_internal_custom_bindings_unittests.cc b/extensions/renderer/api/automation/automation_internal_custom_bindings_unittests.cc
index ad92ecf..15220aa 100644
--- a/extensions/renderer/api/automation/automation_internal_custom_bindings_unittests.cc
+++ b/extensions/renderer/api/automation/automation_internal_custom_bindings_unittests.cc
@@ -29,7 +29,7 @@
     // Bootstrap a simple extension with desktop automation permissions.
     scoped_refptr<const Extension> extension =
         ExtensionBuilder("testExtension")
-            .SetManifestPath({"automation", "desktop"}, true)
+            .SetManifestPath("automation.desktop", true)
             .SetLocation(mojom::ManifestLocation::kComponent)
             .Build();
     RegisterExtension(extension);
diff --git a/extensions/renderer/api/runtime_hooks_delegate_unittest.cc b/extensions/renderer/api/runtime_hooks_delegate_unittest.cc
index 9ac5a1c..d0b52ff 100644
--- a/extensions/renderer/api/runtime_hooks_delegate_unittest.cc
+++ b/extensions/renderer/api/runtime_hooks_delegate_unittest.cc
@@ -109,7 +109,7 @@
   {
     scoped_refptr<const Extension> connectable_extension =
         ExtensionBuilder("connectable")
-            .SetManifestPath({"externally_connectable", "matches"},
+            .SetManifestPath("externally_connectable.matches",
                              ListBuilder().Append("*://example.com/*").Build())
             .Build();
     RegisterExtension(connectable_extension);
diff --git a/gpu/command_buffer/client/gles2_implementation.h b/gpu/command_buffer/client/gles2_implementation.h
index cf8daae9..a2b3238 100644
--- a/gpu/command_buffer/client/gles2_implementation.h
+++ b/gpu/command_buffer/client/gles2_implementation.h
@@ -259,7 +259,7 @@
     int shm_id;
 
     // Address of shared memory
-    void* shm_memory;
+    raw_ptr<void> shm_memory;
 
     // Offset of shared memory
     unsigned int shm_offset;
diff --git a/gpu/command_buffer/client/mock_transfer_buffer.h b/gpu/command_buffer/client/mock_transfer_buffer.h
index 31ff1e9..82e9bd3 100644
--- a/gpu/command_buffer/client/mock_transfer_buffer.h
+++ b/gpu/command_buffer/client/mock_transfer_buffer.h
@@ -18,7 +18,9 @@
   struct ExpectedMemoryInfo {
     uint32_t offset;
     int32_t id;
-    uint8_t* ptr;
+    // `ptr` is not a raw_ptr<...> because it requires a rewrite in a generated
+    // file (gles2_implementation_unittest_autogen.h)
+    RAW_PTR_EXCLUSION uint8_t* ptr;
   };
 
   MockTransferBuffer(CommandBuffer* command_buffer,
diff --git a/gpu/command_buffer/service/BUILD.gn b/gpu/command_buffer/service/BUILD.gn
index b6c04ec..6b9ea4e 100644
--- a/gpu/command_buffer/service/BUILD.gn
+++ b/gpu/command_buffer/service/BUILD.gn
@@ -567,8 +567,10 @@
       "shared_image/dxgi_swap_chain_image_backing.h",
       "shared_image/dxgi_swap_chain_image_representation.cc",
       "shared_image/dxgi_swap_chain_image_representation.h",
-      "shared_image/gl_image_backing.cc",
-      "shared_image/gl_image_backing.h",
+      "shared_image/gl_image_pbuffer.cc",
+      "shared_image/gl_image_pbuffer.h",
+      "shared_image/gl_image_pbuffer_backing.cc",
+      "shared_image/gl_image_pbuffer_backing.h",
     ]
     libs = [ "dxguid.lib" ]
   }
diff --git a/gpu/command_buffer/service/external_semaphore.cc b/gpu/command_buffer/service/external_semaphore.cc
index cec5a41..43a915a1 100644
--- a/gpu/command_buffer/service/external_semaphore.cc
+++ b/gpu/command_buffer/service/external_semaphore.cc
@@ -154,7 +154,7 @@
 
   if (gl_semaphore_ != 0) {
     auto* current_gl = gl::g_current_gl_context_tls->Get();
-    auto* api = current_gl->Driver ? current_gl->Api : nullptr;
+    auto* api = current_gl->Driver ? current_gl->Api.get() : nullptr;
     // We assume there is always one GL context current. If there isn't a
     // GL context current, we assume the last GL context is destroyed, in that
     // case, we will skip glDeleteSemaphoresEXT().
diff --git a/gpu/command_buffer/service/gles2_cmd_decoder_passthrough.h b/gpu/command_buffer/service/gles2_cmd_decoder_passthrough.h
index dec68505..b169998 100644
--- a/gpu/command_buffer/service/gles2_cmd_decoder_passthrough.h
+++ b/gpu/command_buffer/service/gles2_cmd_decoder_passthrough.h
@@ -57,7 +57,7 @@
   GLsizeiptr size;
   GLbitfield original_access;
   GLbitfield filtered_access;
-  uint8_t* map_ptr;
+  raw_ptr<uint8_t> map_ptr;
   int32_t data_shm_id;
   uint32_t data_shm_offset;
 };
diff --git a/gpu/command_buffer/service/mocks.h b/gpu/command_buffer/service/mocks.h
index 5e10fbe..461530d9 100644
--- a/gpu/command_buffer/service/mocks.h
+++ b/gpu/command_buffer/service/mocks.h
@@ -61,7 +61,7 @@
 
    private:
     unsigned int arg_count_;
-    volatile CommandBufferEntry* args_;
+    raw_ptr<volatile CommandBufferEntry> args_;
   };
 
   void BeginDecoding() override {}
diff --git a/gpu/command_buffer/service/service_discardable_manager.h b/gpu/command_buffer/service/service_discardable_manager.h
index 9161182..6c66eb4 100644
--- a/gpu/command_buffer/service/service_discardable_manager.h
+++ b/gpu/command_buffer/service/service_discardable_manager.h
@@ -9,6 +9,7 @@
 
 #include "base/containers/lru_cache.h"
 #include "base/memory/memory_pressure_listener.h"
+#include "base/memory/raw_ptr.h"
 #include "base/trace_event/memory_dump_provider.h"
 #include "gpu/command_buffer/common/discardable_handle.h"
 #include "gpu/command_buffer/service/context_group.h"
@@ -112,7 +113,7 @@
   };
   struct GpuDiscardableEntryKey {
     uint32_t texture_id;
-    gles2::TextureManager* texture_manager;
+    raw_ptr<gles2::TextureManager> texture_manager;
   };
   struct GpuDiscardableEntryKeyCompare {
     bool operator()(const GpuDiscardableEntryKey& lhs,
diff --git a/gpu/command_buffer/service/shared_image/gl_image_pbuffer.cc b/gpu/command_buffer/service/shared_image/gl_image_pbuffer.cc
new file mode 100644
index 0000000..c0fcb09f
--- /dev/null
+++ b/gpu/command_buffer/service/shared_image/gl_image_pbuffer.cc
@@ -0,0 +1,66 @@
+// Copyright 2022 The Chromium Authors
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "gpu/command_buffer/service/shared_image/gl_image_pbuffer.h"
+
+#include "base/logging.h"
+#include "ui/gl/gl_bindings.h"
+#include "ui/gl/gl_surface_egl.h"
+
+namespace gpu {
+
+GLImagePbuffer::GLImagePbuffer(const gfx::Size& size, EGLSurface surface)
+    : size_(size), surface_(surface) {}
+
+// static
+GLImagePbuffer* GLImagePbuffer::FromGLImage(GLImage* image) {
+  if (!image || image->GetType() != Type::PBUFFER)
+    return nullptr;
+  return static_cast<GLImagePbuffer*>(image);
+}
+
+gfx::Size GLImagePbuffer::GetSize() {
+  return size_;
+}
+unsigned GLImagePbuffer::GetInternalFormat() {
+  return GL_BGRA_EXT;
+}
+unsigned GLImagePbuffer::GetDataType() {
+  return GL_UNSIGNED_BYTE;
+}
+gl::GLImage::Type GLImagePbuffer::GetType() const {
+  return gl::GLImage::Type::PBUFFER;
+}
+gl::GLImage::BindOrCopy GLImagePbuffer::ShouldBindOrCopy() {
+  return gl::GLImage::BindOrCopy::BIND;
+}
+// PbufferPictureBuffer::CopySurfaceComplete does the actual binding, so
+// this doesn't do anything and always succeeds.
+bool GLImagePbuffer::BindTexImage(unsigned target) {
+  return true;
+}
+void ReleaseTexImage(unsigned target) {}
+bool GLImagePbuffer::CopyTexImage(unsigned target) {
+  NOTREACHED();
+  return false;
+}
+bool GLImagePbuffer::CopyTexSubImage(unsigned target,
+                                     const gfx::Point& offset,
+                                     const gfx::Rect& rect) {
+  return false;
+}
+void SetColorSpace(const gfx::ColorSpace& color_space) {}
+void OnMemoryDump(base::trace_event::ProcessMemoryDump* pmd,
+                  uint64_t process_tracing_id,
+                  const std::string& dump_name) {}
+
+GLImagePbuffer::~GLImagePbuffer() {
+  EGLDisplay egl_display = gl::GLSurfaceEGL::GetGLDisplayEGL()->GetDisplay();
+
+  eglReleaseTexImage(egl_display, surface_, EGL_BACK_BUFFER);
+
+  eglDestroySurface(egl_display, surface_);
+}
+
+}  // namespace gpu
diff --git a/gpu/command_buffer/service/shared_image/gl_image_pbuffer.h b/gpu/command_buffer/service/shared_image/gl_image_pbuffer.h
new file mode 100644
index 0000000..070226f
--- /dev/null
+++ b/gpu/command_buffer/service/shared_image/gl_image_pbuffer.h
@@ -0,0 +1,52 @@
+// Copyright 2022 The Chromium Authors
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef GPU_COMMAND_BUFFER_SERVICE_SHARED_IMAGE_GL_IMAGE_PBUFFER_H_
+#define GPU_COMMAND_BUFFER_SERVICE_SHARED_IMAGE_GL_IMAGE_PBUFFER_H_
+
+#include <EGL/egl.h>
+#include <EGL/eglext.h>
+
+#include "gpu/gpu_gles2_export.h"
+#include "ui/gfx/geometry/size.h"
+#include "ui/gl/gl_image.h"
+
+namespace gpu {
+
+// GLImagePbuffer is just used to hold references to the underlying
+// image content so it can be destroyed when the textures are.
+class GPU_GLES2_EXPORT GLImagePbuffer final : public gl::GLImage {
+ public:
+  GLImagePbuffer(const gfx::Size& size, EGLSurface surface);
+
+  // Safe downcast. Returns nullptr on failure.
+  static GLImagePbuffer* FromGLImage(GLImage* image);
+
+  // gl::GLImage implementation.
+  gfx::Size GetSize() override;
+  unsigned GetInternalFormat() override;
+  unsigned GetDataType() override;
+  gl::GLImage::Type GetType() const override;
+  BindOrCopy ShouldBindOrCopy() override;
+  bool BindTexImage(unsigned target) override;
+  void ReleaseTexImage(unsigned target) override {}
+  bool CopyTexImage(unsigned target) override;
+  bool CopyTexSubImage(unsigned target,
+                       const gfx::Point& offset,
+                       const gfx::Rect& rect) override;
+  void SetColorSpace(const gfx::ColorSpace& color_space) override {}
+  void OnMemoryDump(base::trace_event::ProcessMemoryDump* pmd,
+                    uint64_t process_tracing_id,
+                    const std::string& dump_name) override {}
+
+ private:
+  ~GLImagePbuffer() override;
+
+  gfx::Size size_;
+  EGLSurface surface_;
+};
+
+}  // namespace gpu
+
+#endif  // GPU_COMMAND_BUFFER_SERVICE_SHARED_IMAGE_GL_IMAGE_PBUFFER_H_
diff --git a/gpu/command_buffer/service/shared_image/gl_image_backing.cc b/gpu/command_buffer/service/shared_image/gl_image_pbuffer_backing.cc
similarity index 79%
rename from gpu/command_buffer/service/shared_image/gl_image_backing.cc
rename to gpu/command_buffer/service/shared_image/gl_image_pbuffer_backing.cc
index e0002e59..97f4654 100644
--- a/gpu/command_buffer/service/shared_image/gl_image_backing.cc
+++ b/gpu/command_buffer/service/shared_image/gl_image_pbuffer_backing.cc
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "gpu/command_buffer/service/shared_image/gl_image_backing.h"
+#include "gpu/command_buffer/service/shared_image/gl_image_pbuffer_backing.h"
 
 #include "base/trace_event/memory_dump_manager.h"
 #include "components/viz/common/resources/resource_format_utils.h"
@@ -47,7 +47,7 @@
 
 bool OverlayGLImageRepresentation::BeginReadAccess(
     gfx::GpuFenceHandle& acquire_fence) {
-  auto* gl_backing = static_cast<GLImageBacking*>(backing());
+  auto* gl_backing = static_cast<GLImagePbufferBacking*>(backing());
   std::unique_ptr<gfx::GpuFence> fence = gl_backing->GetLastWriteGpuFence();
   if (fence)
     acquire_fence = fence->GetGpuFenceHandle().Clone();
@@ -56,7 +56,7 @@
 
 void OverlayGLImageRepresentation::EndReadAccess(
     gfx::GpuFenceHandle release_fence) {
-  auto* gl_backing = static_cast<GLImageBacking*>(backing());
+  auto* gl_backing = static_cast<GLImagePbufferBacking*>(backing());
   gl_backing->SetReleaseFence(std::move(release_fence));
 }
 
@@ -65,11 +65,12 @@
 }
 
 ///////////////////////////////////////////////////////////////////////////////
-// GLImageBacking
+// GLImagePbufferBacking
 
 // static
-std::unique_ptr<GLImageBacking> GLImageBacking::CreateFromGLTexture(
-    scoped_refptr<gl::GLImage> image,
+std::unique_ptr<GLImagePbufferBacking>
+GLImagePbufferBacking::CreateFromGLTexture(
+    scoped_refptr<GLImagePbuffer> image,
     const Mailbox& mailbox,
     viz::ResourceFormat format,
     const gfx::Size& size,
@@ -88,9 +89,10 @@
   params.target = texture_target;
 
   auto si_format = viz::SharedImageFormat::SinglePlane(format);
-  auto shared_image = base::WrapUnique<GLImageBacking>(new GLImageBacking(
-      std::move(image), mailbox, si_format, size, color_space, surface_origin,
-      alpha_type, usage, params));
+  auto shared_image =
+      base::WrapUnique<GLImagePbufferBacking>(new GLImagePbufferBacking(
+          std::move(image), mailbox, si_format, size, color_space,
+          surface_origin, alpha_type, usage, params));
 
   shared_image->passthrough_texture_ = std::move(wrapped_gl_texture);
   shared_image->image_bind_or_copy_needed_ = false;
@@ -98,15 +100,16 @@
   return shared_image;
 }
 
-GLImageBacking::GLImageBacking(scoped_refptr<gl::GLImage> image,
-                               const Mailbox& mailbox,
-                               viz::SharedImageFormat format,
-                               const gfx::Size& size,
-                               const gfx::ColorSpace& color_space,
-                               GrSurfaceOrigin surface_origin,
-                               SkAlphaType alpha_type,
-                               uint32_t usage,
-                               const InitializeGLTextureParams& params)
+GLImagePbufferBacking::GLImagePbufferBacking(
+    scoped_refptr<GLImagePbuffer> image,
+    const Mailbox& mailbox,
+    viz::SharedImageFormat format,
+    const gfx::Size& size,
+    const gfx::ColorSpace& color_space,
+    GrSurfaceOrigin surface_origin,
+    SkAlphaType alpha_type,
+    uint32_t usage,
+    const InitializeGLTextureParams& params)
     : SharedImageBacking(
           mailbox,
           format,
@@ -124,11 +127,11 @@
   DCHECK(image_);
 }
 
-GLImageBacking::~GLImageBacking() {
+GLImagePbufferBacking::~GLImagePbufferBacking() {
   ReleaseGLTexture(have_context());
 }
 
-void GLImageBacking::ReleaseGLTexture(bool have_context) {
+void GLImagePbufferBacking::ReleaseGLTexture(bool have_context) {
   // If the cached promise texture is referencing the GL texture, then it needs
   // to be deleted, too.
   if (cached_promise_texture_) {
@@ -153,29 +156,29 @@
   }
 }
 
-GLenum GLImageBacking::GetGLTarget() const {
+GLenum GLImagePbufferBacking::GetGLTarget() const {
   return gl_params_.target;
 }
 
-GLuint GLImageBacking::GetGLServiceId() const {
+GLuint GLImagePbufferBacking::GetGLServiceId() const {
   if (passthrough_texture_)
     return passthrough_texture_->service_id();
   return 0;
 }
 
-std::unique_ptr<gfx::GpuFence> GLImageBacking::GetLastWriteGpuFence() {
+std::unique_ptr<gfx::GpuFence> GLImagePbufferBacking::GetLastWriteGpuFence() {
   return last_write_gl_fence_ ? last_write_gl_fence_->GetGpuFence() : nullptr;
 }
 
-void GLImageBacking::SetReleaseFence(gfx::GpuFenceHandle release_fence) {
+void GLImagePbufferBacking::SetReleaseFence(gfx::GpuFenceHandle release_fence) {
   release_fence_ = std::move(release_fence);
 }
 
-scoped_refptr<gfx::NativePixmap> GLImageBacking::GetNativePixmap() {
+scoped_refptr<gfx::NativePixmap> GLImagePbufferBacking::GetNativePixmap() {
   return image_->GetNativePixmap();
 }
 
-void GLImageBacking::OnMemoryDump(
+void GLImagePbufferBacking::OnMemoryDump(
     const std::string& dump_name,
     base::trace_event::MemoryAllocatorDumpGuid client_guid,
     base::trace_event::ProcessMemoryDump* pmd,
@@ -193,40 +196,40 @@
   image_->OnMemoryDump(pmd, client_tracing_id, dump_name);
 }
 
-SharedImageBackingType GLImageBacking::GetType() const {
+SharedImageBackingType GLImagePbufferBacking::GetType() const {
   return SharedImageBackingType::kGLImage;
 }
 
-gfx::Rect GLImageBacking::ClearedRect() const {
+gfx::Rect GLImagePbufferBacking::ClearedRect() const {
   return cleared_rect_;
 }
 
-void GLImageBacking::SetClearedRect(const gfx::Rect& cleared_rect) {
+void GLImagePbufferBacking::SetClearedRect(const gfx::Rect& cleared_rect) {
   cleared_rect_ = cleared_rect;
 }
 
-std::unique_ptr<GLTextureImageRepresentation> GLImageBacking::ProduceGLTexture(
-    SharedImageManager* manager,
-    MemoryTypeTracker* tracker) {
+std::unique_ptr<GLTextureImageRepresentation>
+GLImagePbufferBacking::ProduceGLTexture(SharedImageManager* manager,
+                                        MemoryTypeTracker* tracker) {
   NOTREACHED();
   return nullptr;
 }
 std::unique_ptr<GLTexturePassthroughImageRepresentation>
-GLImageBacking::ProduceGLTexturePassthrough(SharedImageManager* manager,
-                                            MemoryTypeTracker* tracker) {
+GLImagePbufferBacking::ProduceGLTexturePassthrough(SharedImageManager* manager,
+                                                   MemoryTypeTracker* tracker) {
   DCHECK(passthrough_texture_);
   return std::make_unique<GLTexturePassthroughGLCommonRepresentation>(
       manager, this, this, tracker, passthrough_texture_);
 }
 
-std::unique_ptr<OverlayImageRepresentation> GLImageBacking::ProduceOverlay(
-    SharedImageManager* manager,
-    MemoryTypeTracker* tracker) {
+std::unique_ptr<OverlayImageRepresentation>
+GLImagePbufferBacking::ProduceOverlay(SharedImageManager* manager,
+                                      MemoryTypeTracker* tracker) {
   return std::make_unique<OverlayGLImageRepresentation>(manager, this, tracker,
                                                         image_);
 }
 
-std::unique_ptr<DawnImageRepresentation> GLImageBacking::ProduceDawn(
+std::unique_ptr<DawnImageRepresentation> GLImagePbufferBacking::ProduceDawn(
     SharedImageManager* manager,
     MemoryTypeTracker* tracker,
     WGPUDevice device,
@@ -240,7 +243,7 @@
       factory(), manager, tracker, device, backend_type, this, true);
 }
 
-std::unique_ptr<SkiaImageRepresentation> GLImageBacking::ProduceSkia(
+std::unique_ptr<SkiaImageRepresentation> GLImagePbufferBacking::ProduceSkia(
     SharedImageManager* manager,
     MemoryTypeTracker* tracker,
     scoped_refptr<SharedContextState> context_state) {
@@ -277,7 +280,7 @@
                   image_memory_->stride());
 }
 
-std::unique_ptr<MemoryImageRepresentation> GLImageBacking::ProduceMemory(
+std::unique_ptr<MemoryImageRepresentation> GLImagePbufferBacking::ProduceMemory(
     SharedImageManager* manager,
     MemoryTypeTracker* tracker) {
   gl::GLImageMemory* image_memory =
@@ -289,7 +292,7 @@
       manager, this, tracker, base::WrapRefCounted(image_memory));
 }
 
-void GLImageBacking::Update(std::unique_ptr<gfx::GpuFence> in_fence) {
+void GLImagePbufferBacking::Update(std::unique_ptr<gfx::GpuFence> in_fence) {
   if (in_fence) {
     // TODO(dcastagna): Don't wait for the fence if the SharedImage is going
     // to be scanned out as an HW overlay. Currently we don't know that at
@@ -302,7 +305,8 @@
   image_bind_or_copy_needed_ = true;
 }
 
-bool GLImageBacking::GLTextureImageRepresentationBeginAccess(bool readonly) {
+bool GLImagePbufferBacking::GLTextureImageRepresentationBeginAccess(
+    bool readonly) {
   if (!release_fence_.is_null()) {
     auto fence = gfx::GpuFence(std::move(release_fence_));
     if (gl::GLFence::IsGpuFenceSupported()) {
@@ -314,7 +318,8 @@
   return BindOrCopyImageIfNeeded();
 }
 
-void GLImageBacking::GLTextureImageRepresentationEndAccess(bool readonly) {
+void GLImagePbufferBacking::GLTextureImageRepresentationEndAccess(
+    bool readonly) {
   // If the image will be used for an overlay, we insert a fence that can be
   // used by OutputPresenter to synchronize image writes with presentation.
   if (!readonly && usage() & SHARED_IMAGE_USAGE_SCANOUT &&
@@ -336,12 +341,13 @@
   }
 }
 
-void GLImageBacking::GLTextureImageRepresentationRelease(bool has_context) {
+void GLImagePbufferBacking::GLTextureImageRepresentationRelease(
+    bool has_context) {
   // No action needed: This class retains the passed-in texture for its
   // lifetime, and releases it in its destructor.
 }
 
-bool GLImageBacking::BindOrCopyImageIfNeeded() {
+bool GLImagePbufferBacking::BindOrCopyImageIfNeeded() {
   // This is called by code that has retained the GL texture.
   DCHECK(passthrough_texture_);
   if (!image_bind_or_copy_needed_)
diff --git a/gpu/command_buffer/service/shared_image/gl_image_backing.h b/gpu/command_buffer/service/shared_image/gl_image_pbuffer_backing.h
similarity index 80%
rename from gpu/command_buffer/service/shared_image/gl_image_backing.h
rename to gpu/command_buffer/service/shared_image/gl_image_pbuffer_backing.h
index 0c25b60..7aaab42 100644
--- a/gpu/command_buffer/service/shared_image/gl_image_backing.h
+++ b/gpu/command_buffer/service/shared_image/gl_image_pbuffer_backing.h
@@ -2,10 +2,11 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef GPU_COMMAND_BUFFER_SERVICE_SHARED_IMAGE_GL_IMAGE_BACKING_H_
-#define GPU_COMMAND_BUFFER_SERVICE_SHARED_IMAGE_GL_IMAGE_BACKING_H_
+#ifndef GPU_COMMAND_BUFFER_SERVICE_SHARED_IMAGE_GL_IMAGE_PBUFFER_BACKING_H_
+#define GPU_COMMAND_BUFFER_SERVICE_SHARED_IMAGE_GL_IMAGE_PBUFFER_BACKING_H_
 
 #include "base/memory/raw_ptr.h"
+#include "gpu/command_buffer/service/shared_image/gl_image_pbuffer.h"
 #include "gpu/command_buffer/service/shared_image/gl_texture_common_representations.h"
 #include "gpu/command_buffer/service/shared_image/gl_texture_image_backing_helper.h"
 #include "gpu/command_buffer/service/shared_image/shared_image_backing.h"
@@ -15,7 +16,7 @@
 
 namespace gpu {
 
-// Overlay representation for a GLImageBacking.
+// Overlay representation for a GLImagePbufferBacking.
 class OverlayGLImageRepresentation : public OverlayImageRepresentation {
  public:
   OverlayGLImageRepresentation(SharedImageManager* manager,
@@ -47,18 +48,20 @@
   scoped_refptr<gl::GLImageMemory> image_memory_;
 };
 
-// Implementation of SharedImageBacking that creates a GL Texture that is backed
-// by a GLImage and stores it as a gles2::Texture. Can be used with the legacy
-// mailbox implementation.
-class GPU_GLES2_EXPORT GLImageBacking
+// Implementation of SharedImageBacking that takes in a caller-created GL
+// Texture and GLImagePbuffer, scopes their lifetime, and exposes the texture
+// via SharedImageRepresentations. Used with the legacy mailbox implementation
+// in //media's DXVA video decoder. DO NOT USE FOR ANY OTHER PURPOSE.
+// TODO(crbug.com/1384438): Remove this class.
+class GPU_GLES2_EXPORT GLImagePbufferBacking
     : public SharedImageBacking,
       public GLTextureImageRepresentationClient {
  public:
-  // Used when GLImageBacking is serving as a temporary SharedImage
+  // Used when GLImagePbufferBacking is serving as a temporary SharedImage
   // wrapper to an already-allocated texture. The returned backing will not
   // create any new textures.
-  static std::unique_ptr<GLImageBacking> CreateFromGLTexture(
-      scoped_refptr<gl::GLImage> image,
+  static std::unique_ptr<GLImagePbufferBacking> CreateFromGLTexture(
+      scoped_refptr<GLImagePbuffer> image,
       const Mailbox& mailbox,
       viz::ResourceFormat format,
       const gfx::Size& size,
@@ -69,9 +72,9 @@
       GLenum texture_target,
       scoped_refptr<gles2::TexturePassthrough> wrapped_gl_texture);
 
-  GLImageBacking(const GLImageBacking& other) = delete;
-  GLImageBacking& operator=(const GLImageBacking& other) = delete;
-  ~GLImageBacking() override;
+  GLImagePbufferBacking(const GLImagePbufferBacking& other) = delete;
+  GLImagePbufferBacking& operator=(const GLImagePbufferBacking& other) = delete;
+  ~GLImagePbufferBacking() override;
 
   GLenum GetGLTarget() const;
   GLuint GetGLServiceId() const;
@@ -79,8 +82,8 @@
   void SetReleaseFence(gfx::GpuFenceHandle release_fence);
 
  private:
-  GLImageBacking(
-      scoped_refptr<gl::GLImage> image,
+  GLImagePbufferBacking(
+      scoped_refptr<GLImagePbuffer> image,
       const Mailbox& mailbox,
       viz::SharedImageFormat format,
       const gfx::Size& size,
@@ -127,7 +130,7 @@
   void GLTextureImageRepresentationEndAccess(bool readonly) override;
   void GLTextureImageRepresentationRelease(bool have_context) override;
 
-  scoped_refptr<gl::GLImage> image_;
+  scoped_refptr<GLImagePbuffer> image_;
 
   // If |image_bind_or_copy_needed_| is true, then either bind or copy |image_|
   // to the GL texture, and un-set |image_bind_or_copy_needed_|.
@@ -150,9 +153,9 @@
   // Wait on this fence before allowing another access.
   gfx::GpuFenceHandle release_fence_;
 
-  base::WeakPtrFactory<GLImageBacking> weak_factory_;
+  base::WeakPtrFactory<GLImagePbufferBacking> weak_factory_;
 };
 
 }  // namespace gpu
 
-#endif  // GPU_COMMAND_BUFFER_SERVICE_SHARED_IMAGE_GL_IMAGE_BACKING_H_
+#endif  // GPU_COMMAND_BUFFER_SERVICE_SHARED_IMAGE_GL_IMAGE_PBUFFER_BACKING_H_
diff --git a/gpu/command_buffer/service/texture_manager.h b/gpu/command_buffer/service/texture_manager.h
index 1524f6d5..341adcd 100644
--- a/gpu/command_buffer/service/texture_manager.h
+++ b/gpu/command_buffer/service/texture_manager.h
@@ -1153,7 +1153,8 @@
     GLint border;
     GLenum format;
     GLenum type;
-    const void* pixels;
+    // `pixels` is not a raw_ptr<...> to avoid adding an out-of-line destructor.
+    RAW_PTR_EXCLUSION const void* pixels;
     uint32_t pixels_size;
     uint32_t padding;
     CommandType command_type;
@@ -1190,7 +1191,8 @@
     GLsizei depth;
     GLenum format;
     GLenum type;
-    const void* pixels;
+    // `pixels` is not a raw_ptr<...> to avoid adding an out-of-line destructor.
+    RAW_PTR_EXCLUSION const void* pixels;
     uint32_t pixels_size;
     uint32_t padding;
     CommandType command_type;
diff --git a/gpu/command_buffer/service/webgpu_decoder.h b/gpu/command_buffer/service/webgpu_decoder.h
index e0ae6fb..58f7bf2 100644
--- a/gpu/command_buffer/service/webgpu_decoder.h
+++ b/gpu/command_buffer/service/webgpu_decoder.h
@@ -5,6 +5,7 @@
 #ifndef GPU_COMMAND_BUFFER_SERVICE_WEBGPU_DECODER_H_
 #define GPU_COMMAND_BUFFER_SERVICE_WEBGPU_DECODER_H_
 
+#include "base/memory/raw_ptr.h"
 #include "gpu/command_buffer/service/common_decoder.h"
 #include "gpu/command_buffer/service/decoder_context.h"
 #include "gpu/gpu_gles2_export.h"
@@ -31,7 +32,7 @@
 
 // Options specifically passed for Dawn caching;
 struct DawnCacheOptions {
-  DawnCachingInterfaceFactory* caching_interface_factory = nullptr;
+  raw_ptr<DawnCachingInterfaceFactory> caching_interface_factory = nullptr;
   absl::optional<GpuDiskCacheHandle> handle = {};
 };
 
diff --git a/gpu/command_buffer/service/webgpu_decoder_impl.cc b/gpu/command_buffer/service/webgpu_decoder_impl.cc
index 4b68faa7..797cde3 100644
--- a/gpu/command_buffer/service/webgpu_decoder_impl.cc
+++ b/gpu/command_buffer/service/webgpu_decoder_impl.cc
@@ -1050,7 +1050,7 @@
   std::unique_ptr<webgpu::DawnCachingInterface> dawn_caching_interface =
       nullptr;
   if (auto* caching_interface_factory =
-          dawn_cache_options.caching_interface_factory) {
+          dawn_cache_options.caching_interface_factory.get()) {
     if (dawn_cache_options.handle) {
       dawn_caching_interface = caching_interface_factory->CreateInstance(
           *dawn_cache_options.handle, client);
diff --git a/gpu/ipc/in_process_command_buffer.cc b/gpu/ipc/in_process_command_buffer.cc
index 89c72bfe..8ecc722 100644
--- a/gpu/ipc/in_process_command_buffer.cc
+++ b/gpu/ipc/in_process_command_buffer.cc
@@ -331,7 +331,7 @@
       // RasterDecoder uses the shared context.
       use_virtualized_gl_context_ = false;
 
-      gr_shader_cache_ = params.gr_shader_cache;
+      gr_shader_cache_ = params.gr_shader_cache.get();
 
       if (!context_state_ ||
           !context_state_->MakeCurrent(nullptr, /*needs_gl=*/true)) {
diff --git a/gpu/ipc/in_process_command_buffer.h b/gpu/ipc/in_process_command_buffer.h
index c044c287..6b0439c 100644
--- a/gpu/ipc/in_process_command_buffer.h
+++ b/gpu/ipc/in_process_command_buffer.h
@@ -179,10 +179,10 @@
  private:
   struct InitializeOnGpuThreadParams {
     const ContextCreationAttribs& attribs;
-    Capabilities* capabilities;  // Ouptut.
-    ImageFactory* image_factory;
-    gpu::raster::GrShaderCache* gr_shader_cache;
-    GpuProcessActivityFlags* activity_flags;
+    raw_ptr<Capabilities> capabilities;  // Ouptut.
+    raw_ptr<ImageFactory> image_factory;
+    raw_ptr<gpu::raster::GrShaderCache> gr_shader_cache;
+    raw_ptr<GpuProcessActivityFlags> activity_flags;
 
     InitializeOnGpuThreadParams(const ContextCreationAttribs& attribs,
                                 Capabilities* capabilities,
diff --git a/ios/chrome/browser/ui/browser_view/browser_coordinator.mm b/ios/chrome/browser/ui/browser_view/browser_coordinator.mm
index 3da3542..ee545d7 100644
--- a/ios/chrome/browser/ui/browser_view/browser_coordinator.mm
+++ b/ios/chrome/browser/ui/browser_view/browser_coordinator.mm
@@ -444,6 +444,8 @@
   [self startMediators];
   [self installDelegatesForAllWebStates];
   [self startChildCoordinators];
+  // TODO(crbug.com/1392109) remove this special case.
+  [self installPostCoordinatorDelegatesForAllWebStates];
   // Browser delegates can have dependencies on coordinators.
   [self installDelegatesForBrowser];
   [self installDelegatesForBrowserState];
@@ -1782,6 +1784,14 @@
               atIndex:(int)index
            activating:(BOOL)activating {
   [self installDelegatesForWebState:webState];
+  // TODO(crbug.com/1392109): remove these special cases.
+  DCHECK(self.passKitCoordinator);
+  PassKitTabHelper::FromWebState(webState)->SetDelegate(
+      self.passKitCoordinator);
+
+  DCHECK(self.storeKitCoordinator);
+  StoreKitTabHelper::FromWebState(webState)->SetLauncher(
+      self.storeKitCoordinator);
 }
 
 - (void)webStateList:(WebStateList*)webStateList
@@ -1843,6 +1853,24 @@
     [self installDelegatesForWebState:webState];
   }
 }
+// Temporary fix for crbug.com/1380980. Webstate delegates which depend on
+// coordinators are set up here.
+// TODO(crbug.com/1392109) Remove this workaround and stop having coordinators
+// which are delegates of webstates that start themselves.
+- (void)installPostCoordinatorDelegatesForAllWebStates {
+  for (int i = 0; i < self.browser->GetWebStateList()->count(); i++) {
+    web::WebState* webState = self.browser->GetWebStateList()->GetWebStateAt(i);
+    // Add delegates for webstates where those delegates are other coorindators.
+    // (Please don't add further code here).
+    DCHECK(self.passKitCoordinator);
+    PassKitTabHelper::FromWebState(webState)->SetDelegate(
+        self.passKitCoordinator);
+
+    DCHECK(self.storeKitCoordinator);
+    StoreKitTabHelper::FromWebState(webState)->SetLauncher(
+        self.storeKitCoordinator);
+  }
+}
 
 // Installs delegates for self.browser.
 - (void)installDelegatesForBrowser {
@@ -1942,20 +1970,12 @@
         self.viewController);
   }
 
-  PassKitTabHelper::FromWebState(webState)->SetDelegate(
-      self.passKitCoordinator);
-
   if (PrintTabHelper::FromWebState(webState)) {
     PrintTabHelper::FromWebState(webState)->set_printer(self.printController);
   }
 
   RepostFormTabHelper::FromWebState(webState)->SetDelegate(self);
 
-  if (StoreKitTabHelper::FromWebState(webState)) {
-    StoreKitTabHelper::FromWebState(webState)->SetLauncher(
-        self.storeKitCoordinator);
-  }
-
   FollowTabHelper* followTabHelper = FollowTabHelper::FromWebState(webState);
   if (followTabHelper) {
     followTabHelper->set_follow_iph_presenter(self.followIPHCoordinator);
diff --git a/ios/chrome/browser/variations/ios_chrome_variations_service_client.mm b/ios/chrome/browser/variations/ios_chrome_variations_service_client.mm
index dcfa8a6..3b75209 100644
--- a/ios/chrome/browser/variations/ios_chrome_variations_service_client.mm
+++ b/ios/chrome/browser/variations/ios_chrome_variations_service_client.mm
@@ -5,6 +5,7 @@
 #import "ios/chrome/browser/variations/ios_chrome_variations_service_client.h"
 
 #import "base/strings/sys_string_conversions.h"
+#import "base/time/time.h"
 #import "base/version.h"
 #import "components/variations/seed_response.h"
 #import "components/version_info/version_info.h"
@@ -67,7 +68,7 @@
   }
   seed->signature = base::SysNSStringToUTF8(ios_seed.signature);
   seed->country = base::SysNSStringToUTF8(ios_seed.country);
-  seed->date = ios_seed.time.timeIntervalSince1970;
+  seed->date = base::Time::FromNSDate(ios_seed.time);
   seed->is_gzip_compressed = ios_seed.compressed;
   return seed;
 }
diff --git a/ipc/ipc_mojo_bootstrap.cc b/ipc/ipc_mojo_bootstrap.cc
index c5aa680..2f96b3a 100644
--- a/ipc/ipc_mojo_bootstrap.cc
+++ b/ipc/ipc_mojo_bootstrap.cc
@@ -763,7 +763,7 @@
     scoped_refptr<base::SequencedTaskRunner> task_runner_;
     std::unique_ptr<mojo::SequenceLocalSyncEventWatcher> sync_watcher_;
     base::circular_deque<std::pair<uint32_t, MessageWrapper>> sync_messages_;
-    ExclusiveSyncWait* exclusive_wait_ = nullptr;
+    raw_ptr<ExclusiveSyncWait> exclusive_wait_ = nullptr;
     uint32_t next_sync_message_id_ = 0;
   };
 
diff --git a/ipc/ipc_sync_message.h b/ipc/ipc_sync_message.h
index 209a4cd9..1fdec1fd 100644
--- a/ipc/ipc_sync_message.h
+++ b/ipc/ipc_sync_message.h
@@ -7,6 +7,7 @@
 
 #include <stdint.h>
 
+#include "base/memory/raw_ptr.h"
 #include "build/build_config.h"
 
 #if BUILDFLAG(IS_WIN)
@@ -85,8 +86,8 @@
       : id(id), deserializer(d), done_event(e), send_result(false) {}
 
   int id;
-  MessageReplyDeserializer* deserializer;
-  base::WaitableEvent* done_event;
+  raw_ptr<MessageReplyDeserializer> deserializer;
+  raw_ptr<base::WaitableEvent> done_event;
   bool send_result;
 };
 
diff --git a/media/audio/audio_debug_file_writer_unittest.cc b/media/audio/audio_debug_file_writer_unittest.cc
index 3d7b020..1c5466b 100644
--- a/media/audio/audio_debug_file_writer_unittest.cc
+++ b/media/audio/audio_debug_file_writer_unittest.cc
@@ -11,6 +11,7 @@
 #include "base/bind.h"
 #include "base/files/file_util.h"
 #include "base/memory/ptr_util.h"
+#include "base/memory/raw_ptr.h"
 #include "base/synchronization/waitable_event.h"
 #include "base/sys_byteorder.h"
 #include "base/test/task_environment.h"
@@ -252,7 +253,7 @@
   AudioDebugFileWriter::Ptr debug_writer_;
 
   // Pointer to the AudioBusPool of the most recently created writer.
-  MockAudioBusPool* mock_audio_bus_pool_;
+  raw_ptr<MockAudioBusPool> mock_audio_bus_pool_;
 
   // AudioBus parameters.
   AudioParameters params_;
diff --git a/media/audio/audio_debug_recording_helper_unittest.cc b/media/audio/audio_debug_recording_helper_unittest.cc
index cea821a..d14c585b 100644
--- a/media/audio/audio_debug_recording_helper_unittest.cc
+++ b/media/audio/audio_debug_recording_helper_unittest.cc
@@ -184,7 +184,7 @@
 
   // Used for testing to access the file writer having to go through the
   // internal |file_writer_lock_|.
-  MockAudioDebugFileWriter* mock_audio_file_writer_;
+  raw_ptr<MockAudioDebugFileWriter> mock_audio_file_writer_;
 
   std::vector<base::FilePath> paths_;
 };
diff --git a/media/audio/mac/audio_device_listener_mac.cc b/media/audio/mac/audio_device_listener_mac.cc
index 85756a6..6c08f8a7 100644
--- a/media/audio/mac/audio_device_listener_mac.cc
+++ b/media/audio/mac/audio_device_listener_mac.cc
@@ -40,13 +40,15 @@
         kAudioDevicePropertyNominalSampleRate, kAudioObjectPropertyScopeGlobal,
         kAudioObjectPropertyElementMaster};
 
-const AudioObjectPropertyAddress kPropertyOutputSourceChanged = {
-    kAudioDevicePropertyDataSource, kAudioDevicePropertyScopeOutput,
-    kAudioObjectPropertyElementMaster};
+const AudioObjectPropertyAddress
+    AudioDeviceListenerMac::kPropertyOutputSourceChanged = {
+        kAudioDevicePropertyDataSource, kAudioDevicePropertyScopeOutput,
+        kAudioObjectPropertyElementMaster};
 
-const AudioObjectPropertyAddress kPropertyInputSourceChanged = {
-    kAudioDevicePropertyDataSource, kAudioDevicePropertyScopeInput,
-    kAudioObjectPropertyElementMaster};
+const AudioObjectPropertyAddress
+    AudioDeviceListenerMac::kPropertyInputSourceChanged = {
+        kAudioDevicePropertyDataSource, kAudioDevicePropertyScopeInput,
+        kAudioObjectPropertyElementMaster};
 
 class AudioDeviceListenerMac::PropertyListener {
  public:
@@ -306,31 +308,34 @@
   DCHECK_CALLED_ON_VALID_THREAD(thread_checker_);
   DCHECK(monitor_sources_);
   DVLOG(1) << __func__ << " this=" << this;
+
+  SourceListenerMap new_listeners;
   for (bool is_input : {true, false}) {
     for (auto device_id : device_ids) {
+      // Do not monitor devices which do not have sources.
+      if (!GetDeviceSource(device_id, is_input))
+        continue;
+
+      SourceListenerKey key = {device_id, is_input};
+      auto listener_iter = source_listeners_.find(key);
+      if (listener_iter != source_listeners_.end()) {
+        // Continue monitoring.
+        new_listeners[key] = std::move(listener_iter->second);
+        continue;
+      }
+      // Start monitoring
       const AudioObjectPropertyAddress* property_address =
           is_input ? &kPropertyInputSourceChanged
                    : &kPropertyOutputSourceChanged;
-      SourceListenerKey key = {device_id, is_input};
-      auto it_key = source_listeners_.find(key);
-      bool is_monitored = it_key != source_listeners_.end();
-      if (core_audio_mac::GetDeviceSource(device_id, is_input)) {
-        if (!is_monitored) {
-          // Start monitoring if the device has source and is not currently
-          // being monitored.
-          auto source_listener =
-              CreatePropertyListener(device_id, property_address, listener_cb_);
-          if (source_listener) {
-            source_listeners_[key] = std::move(source_listener);
-          }
-        }
-      } else if (is_monitored) {
-        // Stop monitoring if the device has no source but is currently being
-        // monitored.
-        source_listeners_.erase(it_key);
-      }
+      auto new_listener =
+          CreatePropertyListener(device_id, property_address, listener_cb_);
+      if (new_listener)
+        new_listeners[key] = std::move(new_listener);
     }
   }
+
+  // Drop all the listeners not in |device_ids|.
+  source_listeners_.swap(new_listeners);
 }
 
 void AudioDeviceListenerMac::UpdateOutputSampleRateListeners(
@@ -386,6 +391,12 @@
   return core_audio_mac::IsOutputDevice(id);
 }
 
+absl::optional<uint32_t> AudioDeviceListenerMac::GetDeviceSource(
+    AudioObjectID device_id,
+    bool is_input) {
+  return core_audio_mac::GetDeviceSource(device_id, is_input);
+}
+
 OSStatus AudioDeviceListenerMac::AddPropertyListener(
     AudioObjectID inObjectID,
     const AudioObjectPropertyAddress* inAddress,
diff --git a/media/audio/mac/audio_device_listener_mac.h b/media/audio/mac/audio_device_listener_mac.h
index 982837e..a1c19b5 100644
--- a/media/audio/mac/audio_device_listener_mac.h
+++ b/media/audio/mac/audio_device_listener_mac.h
@@ -15,6 +15,7 @@
 #include "base/containers/flat_map.h"
 #include "base/threading/thread_checker.h"
 #include "media/base/media_export.h"
+#include "third_party/abseil-cpp/absl/types/optional.h"
 
 namespace media {
 
@@ -56,6 +57,8 @@
       kDefaultInputDeviceChangePropertyAddress;
   static const AudioObjectPropertyAddress kDevicesPropertyAddress;
   static const AudioObjectPropertyAddress kPropertyOutputSampleRateChanged;
+  static const AudioObjectPropertyAddress kPropertyOutputSourceChanged;
+  static const AudioObjectPropertyAddress kPropertyInputSourceChanged;
 
   AudioDeviceListenerMac(base::RepeatingClosure listener_cb,
                          bool monitor_output_sample_rate_changes,
@@ -81,6 +84,8 @@
   // Virtual for testing.
   virtual std::vector<AudioObjectID> GetAllAudioDeviceIDs();
   virtual bool IsOutputDevice(AudioObjectID id);
+  virtual absl::optional<uint32_t> GetDeviceSource(AudioObjectID device_id,
+                                                   bool is_input);
   virtual OSStatus AddPropertyListener(
       AudioObjectID inObjectID,
       const AudioObjectPropertyAddress* inAddress,
diff --git a/media/audio/mac/audio_device_listener_mac_unittest.cc b/media/audio/mac/audio_device_listener_mac_unittest.cc
index 609e4c0..509e4b21 100644
--- a/media/audio/mac/audio_device_listener_mac_unittest.cc
+++ b/media/audio/mac/audio_device_listener_mac_unittest.cc
@@ -16,6 +16,7 @@
 #include "media/base/bind_to_current_loop.h"
 #include "testing/gmock/include/gmock/gmock.h"
 #include "testing/gtest/include/gtest/gtest.h"
+#include "third_party/abseil-cpp/absl/types/optional.h"
 
 using testing::Return;
 
@@ -38,6 +39,7 @@
 
   MOCK_METHOD0(GetAllAudioDeviceIDs, std::vector<AudioObjectID>());
   MOCK_METHOD1(IsOutputDevice, bool(AudioObjectID));
+  MOCK_METHOD2(GetDeviceSource, absl::optional<uint32_t>(AudioObjectID, bool));
 
   OSStatus AddPropertyListener(AudioObjectID inObjectID,
                                const AudioObjectPropertyAddress* inAddress,
@@ -81,10 +83,10 @@
     return true;
   }
 
-  static bool SimulateSampleRateChange(AudioObjectID id,
-                                       std::vector<void*>& contexts) {
-    const AudioObjectPropertyAddress addresses[] = {
-        AudioDeviceListenerMac::kPropertyOutputSampleRateChanged};
+  static bool SimulateDeviceEvent(AudioObjectID id,
+                                  std::vector<void*>& contexts,
+                                  const AudioObjectPropertyAddress& address) {
+    const AudioObjectPropertyAddress addresses[] = {address};
     for (void* context : contexts) {
       OSStatus status = AudioDeviceListenerMac::SimulateEventForTesting(
           id, 1, addresses, context);
@@ -94,6 +96,24 @@
     return true;
   }
 
+  static bool SimulateSampleRateChange(AudioObjectID id,
+                                       std::vector<void*>& contexts) {
+    return SimulateDeviceEvent(
+        id, contexts, AudioDeviceListenerMac::kPropertyOutputSampleRateChanged);
+  }
+
+  static bool SimulateOutputSourceChange(AudioObjectID id,
+                                         std::vector<void*>& contexts) {
+    return SimulateDeviceEvent(
+        id, contexts, AudioDeviceListenerMac::kPropertyOutputSourceChanged);
+  }
+
+  static bool SimluateInputSourceChange(AudioObjectID id,
+                                        std::vector<void*>& contexts) {
+    return SimulateDeviceEvent(
+        id, contexts, AudioDeviceListenerMac::kPropertyInputSourceChanged);
+  }
+
   static void CreatePropertyListeners(AudioDeviceListenerMac* device_listener) {
     return device_listener->CreatePropertyListeners();
   }
@@ -365,4 +385,185 @@
   base::RunLoop().RunUntilIdle();
 }
 
+TEST_F(AudioDeviceListenerMacTest,
+       SourceChangeSubscriptionUpdatedWhenDevicesAddedRemoved) {
+  auto device_listener = std::make_unique<AudioDeviceListenerMacUnderTest>(
+      base::BindRepeating(&AudioDeviceListenerMacTest::OnDeviceChange,
+                          base::Unretained(this)),
+      /*monitor_output_sample_rate_changes=*/false,
+      /*monitor_default_input=*/false, /*monitor_addition_removal=*/true,
+      /*monitor_sources*/ true);
+
+  AudioDeviceListenerMacUnderTest& system_audio_mock = *device_listener.get();
+
+  EXPECT_CALL(system_audio_mock, GetAllAudioDeviceIDs())
+      .WillOnce(Return(std::vector<AudioObjectID>{1}))
+      .WillOnce(Return(std::vector<AudioObjectID>{}))
+      .WillOnce(Return(std::vector<AudioObjectID>{1, 2}))
+      .WillOnce(Return(std::vector<AudioObjectID>{1, 3}));
+
+  // Device 1 is an input device.
+  EXPECT_CALL(system_audio_mock, GetDeviceSource(1, false))
+      .Times(3)
+      .WillRepeatedly(Return(absl::optional<uint32_t>()));
+  EXPECT_CALL(system_audio_mock, GetDeviceSource(1, true))
+      .Times(3)
+      .WillRepeatedly(Return(123));
+
+  // Device 2 is an output device.
+  EXPECT_CALL(system_audio_mock, GetDeviceSource(2, false))
+      .WillOnce(Return(123));
+  EXPECT_CALL(system_audio_mock, GetDeviceSource(2, true))
+      .WillOnce(Return(absl::optional<uint32_t>()));
+
+  // Device 3 is both an input and output device.
+  EXPECT_CALL(system_audio_mock, GetDeviceSource(3, false))
+      .WillOnce(Return(123));
+  EXPECT_CALL(system_audio_mock, GetDeviceSource(3, true))
+      .WillOnce(Return(123));
+
+  // We add or remove devices three times, expect a call for each of them.
+  EXPECT_CALL(*this, OnDeviceChange()).Times(3);
+
+  CreatePropertyListeners(device_listener.get());
+
+  std::vector<void*> property_listeners =
+      GetPropertyListeners(device_listener.get());
+
+  // Default output, addition-removal and one device source
+  EXPECT_EQ(property_listeners.size(), 3u);
+
+  ASSERT_TRUE(SimulateDeviceAdditionRemoval(property_listeners));
+  property_listeners = GetPropertyListeners(device_listener.get());
+  // Default output, addition-removal and no device source
+  EXPECT_EQ(property_listeners.size(), 2u);
+
+  ASSERT_TRUE(SimulateDeviceAdditionRemoval(property_listeners));
+  property_listeners = GetPropertyListeners(device_listener.get());
+  // Default output, addition-removal and two device sources
+  EXPECT_EQ(property_listeners.size(), 4u);
+
+  ASSERT_TRUE(SimulateDeviceAdditionRemoval(property_listeners));
+  property_listeners = GetPropertyListeners(device_listener.get());
+  // Default output, addition-removal and three device sources
+  EXPECT_EQ(property_listeners.size(), 5u);
+
+  device_listener.reset();
+  base::RunLoop().RunUntilIdle();
+}
+
+TEST_F(AudioDeviceListenerMacTest, SourceChangeNotifications) {
+  auto device_listener = std::make_unique<AudioDeviceListenerMacUnderTest>(
+      base::BindRepeating(&AudioDeviceListenerMacTest::OnDeviceChange,
+                          base::Unretained(this)),
+      /*monitor_output_sample_rate_changes=*/false,
+      /*monitor_default_input=*/false, /*monitor_addition_removal=*/true,
+      /*monitor_sources*/ true);
+
+  AudioDeviceListenerMacUnderTest& system_audio_mock = *device_listener.get();
+
+  EXPECT_CALL(system_audio_mock, GetAllAudioDeviceIDs())
+      .WillOnce(Return(std::vector<AudioObjectID>{1}))
+      .WillOnce(Return(std::vector<AudioObjectID>{}))
+      .WillOnce(Return(std::vector<AudioObjectID>{1, 2}))
+      .WillOnce(Return(std::vector<AudioObjectID>{1, 3}));
+
+  // Device 1 is an input device.
+  EXPECT_CALL(system_audio_mock, GetDeviceSource(1, false))
+      .Times(3)
+      .WillRepeatedly(Return(absl::optional<uint32_t>()));
+  EXPECT_CALL(system_audio_mock, GetDeviceSource(1, true))
+      .Times(3)
+      .WillRepeatedly(Return(123));
+
+  // Device 2 is an output device.
+  EXPECT_CALL(system_audio_mock, GetDeviceSource(2, false))
+      .WillOnce(Return(123));
+  EXPECT_CALL(system_audio_mock, GetDeviceSource(2, true))
+      .WillOnce(Return(absl::optional<uint32_t>()));
+
+  // Device 3 is both an input and output device.
+  EXPECT_CALL(system_audio_mock, GetDeviceSource(3, false))
+      .WillOnce(Return(123));
+  EXPECT_CALL(system_audio_mock, GetDeviceSource(3, true))
+      .WillOnce(Return(123));
+
+  CreatePropertyListeners(device_listener.get());
+
+  std::vector<void*> property_listeners =
+      GetPropertyListeners(device_listener.get());
+
+  // Default output, addition-removal and one device source
+  EXPECT_EQ(property_listeners.size(), 3u);
+  {
+    EXPECT_CALL(*this, OnDeviceChange()).Times(1);
+    SimluateInputSourceChange(1, property_listeners);
+    SimluateInputSourceChange(2, property_listeners);
+    SimluateInputSourceChange(3, property_listeners);
+    testing::Mock::VerifyAndClearExpectations(this);
+    EXPECT_CALL(*this, OnDeviceChange()).Times(0);
+    SimulateOutputSourceChange(1, property_listeners);
+    SimulateOutputSourceChange(2, property_listeners);
+    SimulateOutputSourceChange(3, property_listeners);
+    testing::Mock::VerifyAndClearExpectations(this);
+  }
+
+  EXPECT_CALL(*this, OnDeviceChange());
+  ASSERT_TRUE(SimulateDeviceAdditionRemoval(property_listeners));
+  property_listeners = GetPropertyListeners(device_listener.get());
+  // Default output, addition-removal and no device source
+  EXPECT_EQ(property_listeners.size(), 2u);
+  {
+    EXPECT_CALL(*this, OnDeviceChange()).Times(0);
+    SimluateInputSourceChange(1, property_listeners);
+    SimluateInputSourceChange(2, property_listeners);
+    SimluateInputSourceChange(3, property_listeners);
+    testing::Mock::VerifyAndClearExpectations(this);
+    EXPECT_CALL(*this, OnDeviceChange()).Times(0);
+    SimulateOutputSourceChange(1, property_listeners);
+    SimulateOutputSourceChange(2, property_listeners);
+    SimulateOutputSourceChange(3, property_listeners);
+    testing::Mock::VerifyAndClearExpectations(this);
+  }
+
+  EXPECT_CALL(*this, OnDeviceChange());
+  ASSERT_TRUE(SimulateDeviceAdditionRemoval(property_listeners));
+  property_listeners = GetPropertyListeners(device_listener.get());
+  // Default output, addition-removal and two device sources
+  EXPECT_EQ(property_listeners.size(), 4u);
+  {
+    EXPECT_CALL(*this, OnDeviceChange()).Times(1);
+    SimluateInputSourceChange(1, property_listeners);
+    SimluateInputSourceChange(2, property_listeners);
+    SimluateInputSourceChange(3, property_listeners);
+    testing::Mock::VerifyAndClearExpectations(this);
+    EXPECT_CALL(*this, OnDeviceChange()).Times(1);
+    SimulateOutputSourceChange(1, property_listeners);
+    SimulateOutputSourceChange(2, property_listeners);
+    SimulateOutputSourceChange(3, property_listeners);
+    testing::Mock::VerifyAndClearExpectations(this);
+  }
+
+  EXPECT_CALL(*this, OnDeviceChange());
+  ASSERT_TRUE(SimulateDeviceAdditionRemoval(property_listeners));
+  property_listeners = GetPropertyListeners(device_listener.get());
+  // Default output, addition-removal and three device sources
+  EXPECT_EQ(property_listeners.size(), 5u);
+  {
+    EXPECT_CALL(*this, OnDeviceChange()).Times(2);
+    SimluateInputSourceChange(1, property_listeners);
+    SimluateInputSourceChange(2, property_listeners);
+    SimluateInputSourceChange(3, property_listeners);
+    testing::Mock::VerifyAndClearExpectations(this);
+    EXPECT_CALL(*this, OnDeviceChange()).Times(1);
+    SimulateOutputSourceChange(1, property_listeners);
+    SimulateOutputSourceChange(2, property_listeners);
+    SimulateOutputSourceChange(3, property_listeners);
+    testing::Mock::VerifyAndClearExpectations(this);
+  }
+
+  device_listener.reset();
+  base::RunLoop().RunUntilIdle();
+}
+
 }  // namespace media
diff --git a/media/audio/win/core_audio_util_win.cc b/media/audio/win/core_audio_util_win.cc
index 7ee461a..5f95e76 100644
--- a/media/audio/win/core_audio_util_win.cc
+++ b/media/audio/win/core_audio_util_win.cc
@@ -605,7 +605,7 @@
 // CoreAudioUtil::WaveFormatWrapper implementation.
 WAVEFORMATEXTENSIBLE* CoreAudioUtil::WaveFormatWrapper::GetExtensible() const {
   CHECK(IsExtensible());
-  return reinterpret_cast<WAVEFORMATEXTENSIBLE*>(ptr_);
+  return reinterpret_cast<WAVEFORMATEXTENSIBLE*>(ptr_.get());
 }
 
 bool CoreAudioUtil::WaveFormatWrapper::IsExtensible() const {
diff --git a/media/audio/win/core_audio_util_win.h b/media/audio/win/core_audio_util_win.h
index 441678f9..34c07cb 100644
--- a/media/audio/win/core_audio_util_win.h
+++ b/media/audio/win/core_audio_util_win.h
@@ -18,6 +18,7 @@
 
 #include <string>
 
+#include "base/memory/raw_ptr.h"
 #include "base/time/time.h"
 #include "media/audio/audio_device_name.h"
 #include "media/base/audio_parameters.h"
@@ -52,7 +53,7 @@
     size_t size() const;
 
    private:
-    WAVEFORMATEX* ptr_;
+    raw_ptr<WAVEFORMATEX> ptr_;
   };
 
   CoreAudioUtil() = delete;
diff --git a/media/base/channel_mixer_unittest.cc b/media/base/channel_mixer_unittest.cc
index 3af82e80..a5a801f 100644
--- a/media/base/channel_mixer_unittest.cc
+++ b/media/base/channel_mixer_unittest.cc
@@ -6,6 +6,7 @@
 
 #include <memory>
 
+#include "base/memory/raw_ptr.h"
 #include "base/strings/stringprintf.h"
 #include "media/base/audio_bus.h"
 #include "media/base/audio_parameters.h"
@@ -87,7 +88,7 @@
   int input_channels;
   ChannelLayout output_layout;
   int output_channels;
-  const float* channel_values;
+  raw_ptr<const float> channel_values;
   int num_channel_values;
   float scale;
 };
diff --git a/media/cast/encoding/audio_encoder_unittest.cc b/media/cast/encoding/audio_encoder_unittest.cc
index b36b4dd4..5ef7e35 100644
--- a/media/cast/encoding/audio_encoder_unittest.cc
+++ b/media/cast/encoding/audio_encoder_unittest.cc
@@ -14,6 +14,7 @@
 #include "base/bind.h"
 #include "base/callback_helpers.h"
 #include "base/logging.h"
+#include "base/memory/raw_ptr.h"
 #include "base/time/time.h"
 #include "build/build_config.h"
 #include "media/base/audio_bus.h"
@@ -89,7 +90,7 @@
 };
 
 struct TestScenario {
-  const int64_t* durations_in_ms;
+  raw_ptr<const int64_t> durations_in_ms;
   size_t num_durations;
 
   TestScenario(const int64_t* d, size_t n)
diff --git a/media/filters/demuxer_manager.h b/media/filters/demuxer_manager.h
index 3c699a0..66c35fd 100644
--- a/media/filters/demuxer_manager.h
+++ b/media/filters/demuxer_manager.h
@@ -5,6 +5,7 @@
 #ifndef MEDIA_FILTERS_DEMUXER_MANAGER_H_
 #define MEDIA_FILTERS_DEMUXER_MANAGER_H_
 
+#include "base/memory/raw_ptr.h"
 #include "base/memory/weak_ptr.h"
 #include "media/base/media_export.h"
 
@@ -31,7 +32,7 @@
 
  private:
   // This is usually just the WebMediPlayerImpl.
-  Client* client_;
+  raw_ptr<Client> client_;
 
   // Weak pointer implementation.
   base::WeakPtrFactory<DemuxerManager> weak_factory_{this};
diff --git a/media/formats/hls/audio_rendition.h b/media/formats/hls/audio_rendition.h
index feaaf4b5..b6ccafc 100644
--- a/media/formats/hls/audio_rendition.h
+++ b/media/formats/hls/audio_rendition.h
@@ -9,6 +9,7 @@
 #include <string>
 
 #include "base/containers/flat_map.h"
+#include "base/memory/raw_ptr.h"
 #include "base/memory/ref_counted.h"
 #include "base/types/pass_key.h"
 #include "media/base/media_export.h"
@@ -132,7 +133,7 @@
   base::flat_map<std::string, const AudioRendition*> renditions_map_;
 
   // Default rendition, `nullptr` if none.
-  const AudioRendition* default_rendition_ = nullptr;
+  raw_ptr<const AudioRendition> default_rendition_ = nullptr;
 };
 
 }  // namespace media::hls
diff --git a/media/formats/webm/webm_parser.h b/media/formats/webm/webm_parser.h
index 2d78e6a..afd94cd4 100644
--- a/media/formats/webm/webm_parser.h
+++ b/media/formats/webm/webm_parser.h
@@ -93,8 +93,8 @@
     int id_;
     int64_t size_;
     int64_t bytes_parsed_;
-    const ListElementInfo* element_info_;
-    WebMParserClient* client_;
+    raw_ptr<const ListElementInfo> element_info_;
+    raw_ptr<WebMParserClient> client_;
   };
 
   void ChangeState(State new_state);
diff --git a/media/gpu/windows/dxva_picture_buffer_win.cc b/media/gpu/windows/dxva_picture_buffer_win.cc
index 681e191..24c8f59a 100644
--- a/media/gpu/windows/dxva_picture_buffer_win.cc
+++ b/media/gpu/windows/dxva_picture_buffer_win.cc
@@ -5,6 +5,7 @@
 #include "media/gpu/windows/dxva_picture_buffer_win.h"
 
 #include "base/metrics/histogram_functions.h"
+#include "gpu/command_buffer/service/shared_image/gl_image_pbuffer.h"
 #include "media/base/win/mf_helpers.h"
 #include "media/gpu/windows/dxva_video_decode_accelerator_win.h"
 #include "third_party/angle/include/EGL/egl.h"
@@ -19,54 +20,6 @@
 
 namespace media {
 
-namespace {
-
-// GLImagePbuffer is just used to hold references to the underlying
-// image content so it can be destroyed when the textures are.
-class GLImagePbuffer : public gl::GLImage {
- public:
-  GLImagePbuffer(const gfx::Size& size, EGLSurface surface)
-      : size_(size), surface_(surface) {}
-
-  // gl::GLImage implementation.
-  gfx::Size GetSize() override { return size_; }
-  unsigned GetInternalFormat() override { return GL_BGRA_EXT; }
-  unsigned GetDataType() override { return GL_UNSIGNED_BYTE; }
-  BindOrCopy ShouldBindOrCopy() override { return BIND; }
-  // PbufferPictureBuffer::CopySurfaceComplete does the actual binding, so
-  // this doesn't do anything and always succeeds.
-  bool BindTexImage(unsigned target) override { return true; }
-  void ReleaseTexImage(unsigned target) override {}
-  bool CopyTexImage(unsigned target) override {
-    NOTREACHED();
-    return false;
-  }
-  bool CopyTexSubImage(unsigned target,
-                       const gfx::Point& offset,
-                       const gfx::Rect& rect) override {
-    return false;
-  }
-  void SetColorSpace(const gfx::ColorSpace& color_space) override {}
-  void OnMemoryDump(base::trace_event::ProcessMemoryDump* pmd,
-                    uint64_t process_tracing_id,
-                    const std::string& dump_name) override {}
-
- protected:
-  ~GLImagePbuffer() override {
-    EGLDisplay egl_display = gl::GLSurfaceEGL::GetGLDisplayEGL()->GetDisplay();
-
-    eglReleaseTexImage(egl_display, surface_, EGL_BACK_BUFFER);
-
-    eglDestroySurface(egl_display, surface_);
-  }
-
- private:
-  gfx::Size size_;
-  EGLSurface surface_;
-};
-
-}  // namespace
-
 enum {
   // The keyed mutex should always be released before the other thread
   // attempts to acquire it, so AcquireSync should always return immediately.
@@ -186,7 +139,8 @@
       egl_display, EGL_D3D_TEXTURE_2D_SHARE_HANDLE_ANGLE, texture_share_handle_,
       egl_config, attrib_list);
   RETURN_ON_FAILURE(decoding_surface_, "Failed to create surface", false);
-  gl_image_ = base::MakeRefCounted<GLImagePbuffer>(size(), decoding_surface_);
+  gl_image_ =
+      base::MakeRefCounted<gpu::GLImagePbuffer>(size(), decoding_surface_);
   if (decoder.d3d11_device_ && decoder.use_keyed_mutex_) {
     void* keyed_mutex = nullptr;
     EGLBoolean ret =
diff --git a/media/gpu/windows/dxva_video_decode_accelerator_win.cc b/media/gpu/windows/dxva_video_decode_accelerator_win.cc
index e2262e1..f590d94 100644
--- a/media/gpu/windows/dxva_video_decode_accelerator_win.cc
+++ b/media/gpu/windows/dxva_video_decode_accelerator_win.cc
@@ -41,7 +41,7 @@
 #include "components/viz/common/resources/resource_format_utils.h"
 #include "gpu/command_buffer/common/shared_image_usage.h"
 #include "gpu/command_buffer/service/shared_image/d3d_image_backing.h"
-#include "gpu/command_buffer/service/shared_image/gl_image_backing.h"
+#include "gpu/command_buffer/service/shared_image/gl_image_pbuffer_backing.h"
 #include "gpu/command_buffer/service/shared_image/shared_image_backing.h"
 #include "gpu/command_buffer/service/shared_image/shared_image_factory.h"
 #include "gpu/config/gpu_driver_bug_workarounds.h"
@@ -3262,8 +3262,11 @@
           kPremul_SkAlphaType, shared_image_usage, gl_image_dxgi->texture(),
           std::move(gl_texture));
     } else {
-      shared_image = gpu::GLImageBacking::CreateFromGLTexture(
-          picture_buffer->gl_image(), mailbox, viz_formats[texture_idx],
+      auto* gl_image_pbuffer =
+          gpu::GLImagePbuffer::FromGLImage(picture_buffer->gl_image().get());
+      DCHECK(gl_image_pbuffer);
+      shared_image = gpu::GLImagePbufferBacking::CreateFromGLTexture(
+          gl_image_pbuffer, mailbox, viz_formats[texture_idx],
           picture_buffer->size(), picture_buffer->color_space(),
           kTopLeft_GrSurfaceOrigin, kPremul_SkAlphaType, shared_image_usage,
           GetTextureTarget(), std::move(gl_texture));
diff --git a/media/midi/usb_midi_descriptor_parser_unittest.cc b/media/midi/usb_midi_descriptor_parser_unittest.cc
index 403f4d64..6fb9958 100644
--- a/media/midi/usb_midi_descriptor_parser_unittest.cc
+++ b/media/midi/usb_midi_descriptor_parser_unittest.cc
@@ -79,19 +79,19 @@
   EXPECT_EQ(0u, jacks[0].cable_number);
   EXPECT_EQ(2u, jacks[0].endpoint_number());
   EXPECT_EQ(UsbMidiJack::DIRECTION_OUT, jacks[0].direction());
-  EXPECT_EQ(nullptr, jacks[0].device);
+  EXPECT_EQ(nullptr, jacks[0].device.get());
 
   EXPECT_EQ(3u, jacks[1].jack_id);
   EXPECT_EQ(1u, jacks[1].cable_number);
   EXPECT_EQ(2u, jacks[1].endpoint_number());
   EXPECT_EQ(UsbMidiJack::DIRECTION_OUT, jacks[1].direction());
-  EXPECT_EQ(nullptr, jacks[1].device);
+  EXPECT_EQ(nullptr, jacks[1].device.get());
 
   EXPECT_EQ(7u, jacks[2].jack_id);
   EXPECT_EQ(0u, jacks[2].cable_number);
   EXPECT_EQ(2u, jacks[2].endpoint_number());
   EXPECT_EQ(UsbMidiJack::DIRECTION_IN, jacks[2].direction());
-  EXPECT_EQ(nullptr, jacks[2].device);
+  EXPECT_EQ(nullptr, jacks[2].device.get());
 }
 
 TEST(UsbMidiDescriptorParserTest, ParseDeviceInfoEmpty) {
diff --git a/media/midi/usb_midi_input_stream.h b/media/midi/usb_midi_input_stream.h
index 092c474..fb58bc2 100644
--- a/media/midi/usb_midi_input_stream.h
+++ b/media/midi/usb_midi_input_stream.h
@@ -42,7 +42,7 @@
     bool operator==(const JackUniqueKey& that) const;
     bool operator<(const JackUniqueKey& that) const;
 
-    UsbMidiDevice* device;
+    raw_ptr<UsbMidiDevice> device;
     int endpoint_number;
     int cable_number;
   };
diff --git a/media/midi/usb_midi_jack.h b/media/midi/usb_midi_jack.h
index c1eb4a5a..b0dc635 100644
--- a/media/midi/usb_midi_jack.h
+++ b/media/midi/usb_midi_jack.h
@@ -7,6 +7,7 @@
 
 #include <stdint.h>
 
+#include "base/memory/raw_ptr.h"
 #include "media/midi/usb_midi_export.h"
 
 namespace midi {
@@ -31,7 +32,7 @@
         cable_number(cable_number),
         endpoint_address(endpoint_address) {}
   // Not owned
-  UsbMidiDevice* device;
+  raw_ptr<UsbMidiDevice> device;
   // The id of this jack unique in the interface.
   uint8_t jack_id;
   // The cable number of this jack in the associated endpoint.
diff --git a/media/renderers/paint_canvas_video_renderer.cc b/media/renderers/paint_canvas_video_renderer.cc
index b698be4..42ac044 100644
--- a/media/renderers/paint_canvas_video_renderer.cc
+++ b/media/renderers/paint_canvas_video_renderer.cc
@@ -13,6 +13,7 @@
 #include "base/compiler_specific.h"
 #include "base/logging.h"
 #include "base/memory/ptr_util.h"
+#include "base/memory/raw_ptr.h"
 #include "base/numerics/checked_math.h"
 #include "base/sequence_checker.h"
 #include "base/synchronization/waitable_event.h"
@@ -159,8 +160,8 @@
   }
 
  private:
-  gpu::gles2::GLES2Interface* gl;
-  gpu::raster::RasterInterface* ri;
+  raw_ptr<gpu::gles2::GLES2Interface> gl;
+  raw_ptr<gpu::raster::RasterInterface> ri;
   GLuint texture;
   bool is_shared_image;
 };
diff --git a/mojo/core/core_ipcz_test.cc b/mojo/core/core_ipcz_test.cc
index 023af0d..1ea4772 100644
--- a/mojo/core/core_ipcz_test.cc
+++ b/mojo/core/core_ipcz_test.cc
@@ -8,6 +8,7 @@
 
 #include "base/check.h"
 #include "base/containers/span.h"
+#include "base/memory/raw_ptr.h"
 #include "base/strings/string_piece.h"
 #include "base/synchronization/waitable_event.h"
 #include "build/build_config.h"
@@ -207,7 +208,7 @@
     }
   }
 
-  const MojoSystemThunks2* const mojo_{GetMojoIpczImpl()};
+  const raw_ptr<const MojoSystemThunks2> mojo_{GetMojoIpczImpl()};
 };
 
 // Watches a PlatformChannel endpoint handle for its peer's closure.
diff --git a/mojo/core/ipcz_driver/driver_for_ipcz_tests.cc b/mojo/core/ipcz_driver/driver_for_ipcz_tests.cc
index 4c86e38..aec2f99 100644
--- a/mojo/core/ipcz_driver/driver_for_ipcz_tests.cc
+++ b/mojo/core/ipcz_driver/driver_for_ipcz_tests.cc
@@ -10,6 +10,7 @@
 #include "base/base_switches.h"
 #include "base/check.h"
 #include "base/command_line.h"
+#include "base/memory/raw_ptr.h"
 #include "base/memory/scoped_refptr.h"
 #include "base/process/process.h"
 #include "base/strings/strcat.h"
@@ -50,7 +51,7 @@
 
    private:
     std::unique_ptr<ipcz::test::TestNode> node_;
-    ipcz::test::TestDriver* const driver_;
+    const raw_ptr<ipcz::test::TestDriver> driver_;
   };
 
   MojoIpczInProcessTestNodeController(
diff --git a/mojo/core/ipcz_driver/shared_buffer_mapping.h b/mojo/core/ipcz_driver/shared_buffer_mapping.h
index a15c3e59..ea8d529 100644
--- a/mojo/core/ipcz_driver/shared_buffer_mapping.h
+++ b/mojo/core/ipcz_driver/shared_buffer_mapping.h
@@ -10,6 +10,7 @@
 
 #include "base/containers/span.h"
 #include "base/memory/platform_shared_memory_region.h"
+#include "base/memory/raw_ptr.h"
 #include "base/memory/shared_memory_mapping.h"
 #include "mojo/core/ipcz_driver/object.h"
 #include "mojo/core/system_impl_export.h"
@@ -51,7 +52,7 @@
   ~SharedBufferMapping() override;
 
   std::unique_ptr<base::SharedMemoryMapping> mapping_;
-  void* memory_;
+  raw_ptr<void> memory_;
 };
 
 }  // namespace mojo::core::ipcz_driver
diff --git a/mojo/public/tools/bindings/mojom.gni b/mojo/public/tools/bindings/mojom.gni
index 5afce408..5781c8a 100644
--- a/mojo/public/tools/bindings/mojom.gni
+++ b/mojo/public/tools/bindings/mojom.gni
@@ -836,7 +836,8 @@
     action(generator_cpp_message_ids_target_name) {
       script = mojom_generator_script
       inputs = mojom_generator_sources + jinja2_sources
-      sources = sources_list
+      sources = sources_list +
+                [ "$root_gen_dir/mojo/public/tools/bindings/cpp_templates.zip" ]
       deps = [
         ":$parser_target_name",
         "//mojo/public/tools/bindings:precompile_templates",
@@ -851,6 +852,9 @@
         filelist += [ rebase_path(source, root_build_dir) ]
       }
       foreach(base_path, output_file_base_paths) {
+        filename = get_path_info(base_path, "file")
+        dirname = get_path_info(base_path, "dir")
+        inputs += [ "$root_gen_dir/$dirname/${filename}-module" ]
         outputs += [ "$root_gen_dir/$base_path-shared-message-ids.h" ]
       }
 
@@ -877,7 +881,8 @@
       visibility = [ ":*" ]
       script = mojom_generator_script
       inputs = mojom_generator_sources + jinja2_sources
-      sources = sources_list
+      sources = sources_list +
+                [ "$root_gen_dir/mojo/public/tools/bindings/cpp_templates.zip" ]
       deps = [
         ":$parser_target_name",
         "//mojo/public/tools/bindings:precompile_templates",
@@ -893,6 +898,11 @@
         filelist += [ rebase_path(source, root_build_dir) ]
       }
       foreach(base_path, output_file_base_paths) {
+        # Need the mojom-module as an input to this action.
+        filename = get_path_info(base_path, "file")
+        dirname = get_path_info(base_path, "dir")
+        inputs += [ "$root_gen_dir/$dirname/${filename}-module" ]
+
         outputs += [
           "$root_gen_dir/$base_path-params-data.h",
           "$root_gen_dir/$base_path-shared-internal.h",
@@ -996,7 +1006,11 @@
     action(generator_mojolpm_proto_target_name) {
       script = mojom_generator_script
       inputs = mojom_generator_sources + jinja2_sources
-      sources = invoker.sources
+      sources =
+          invoker.sources + [
+            "$root_gen_dir/mojo/public/tools/bindings/cpp_templates.zip",
+            "$root_gen_dir/mojo/public/tools/bindings/mojolpm_templates.zip",
+          ]
       deps = [
         ":$parser_target_name",
         "//mojo/public/tools/bindings:precompile_templates",
@@ -1015,6 +1029,7 @@
 
       foreach(source, non_gen_sources) {
         filelist += [ rebase_path(source, root_build_dir) ]
+        inputs += [ "$target_gen_dir/$source-module" ]
         outputs += [ "$target_gen_dir/$source.mojolpm.proto" ]
       }
 
@@ -1024,6 +1039,7 @@
         # For generated files, we assume they're in the target_gen_dir or a
         # sub-folder of it. Rebase the path so we can get the relative location.
         source_file = rebase_path(source, target_gen_dir)
+        inputs += [ "$target_gen_dir/$source_file-module" ]
         outputs += [ "$target_gen_dir/$source_file.mojolpm.proto" ]
       }
 
@@ -1249,12 +1265,22 @@
         visibility = [ ":*" ]
         script = mojom_generator_script
         inputs = mojom_generator_sources + jinja2_sources
-        sources = sources_list
+        sources =
+            sources_list + [
+              "$root_gen_dir/mojo/public/tools/bindings/cpp_templates.zip",
+              type_mappings_path,
+            ]
+        if (generate_fuzzing && !defined(bindings_configuration.variant)) {
+          sources += [
+            "$root_gen_dir/mojo/public/tools/bindings/mojolpm_templates.zip",
+          ]
+        }
         deps = [
           ":$parser_target_name",
           ":$type_mappings_target_name",
           "//mojo/public/tools/bindings:precompile_templates",
         ]
+
         if (defined(invoker.parser_deps)) {
           deps += invoker.parser_deps
         }
@@ -1265,6 +1291,10 @@
           filelist += [ rebase_path(source, root_build_dir) ]
         }
         foreach(base_path, output_file_base_paths) {
+          filename = get_path_info(base_path, "file")
+          dirname = get_path_info(base_path, "dir")
+          inputs += [ "$root_gen_dir/$dirname/${filename}-module" ]
+
           outputs += [
             "$root_gen_dir/${base_path}${variant_dash_suffix}-forward.h",
             "$root_gen_dir/${base_path}${variant_dash_suffix}-import-headers.h",
@@ -1331,6 +1361,8 @@
               "--extra_cpp_template_paths",
               rebase_path(extra_cpp_template, root_build_dir),
             ]
+            inputs += [ extra_cpp_template ]
+
             assert(
                 get_path_info(extra_cpp_template, "extension") == "tmpl",
                 "--extra_cpp_template_paths only accepts template files ending in extension .tmpl")
@@ -1461,6 +1493,7 @@
         rebase_path(type_mappings_path, root_build_dir),
       ]
 
+      sources = []
       foreach(d, all_deps) {
         name = get_label_info(d, "label_no_toolchain")
         toolchain = get_label_info(d, "toolchain")
@@ -1470,12 +1503,11 @@
         dependency_output_dir =
             get_label_info(dependency_output, "target_gen_dir")
         dependency_name = get_label_info(dependency_output, "name")
-        dependency_path =
-            rebase_path("$dependency_output_dir/${dependency_name}",
-                        root_build_dir)
+        dependency_path = "$dependency_output_dir/${dependency_name}"
+        sources += [ dependency_path ]
         args += [
           "--dependency",
-          dependency_path,
+          rebase_path(dependency_path, root_build_dir),
         ]
       }
 
diff --git a/net/disk_cache/simple/simple_file_tracker_unittest.cc b/net/disk_cache/simple/simple_file_tracker_unittest.cc
index 076a343..719d217a 100644
--- a/net/disk_cache/simple/simple_file_tracker_unittest.cc
+++ b/net/disk_cache/simple/simple_file_tracker_unittest.cc
@@ -8,6 +8,7 @@
 #include "base/files/file.h"
 #include "base/files/file_path.h"
 #include "base/files/file_util.h"
+#include "base/memory/raw_ptr.h"
 #include "base/strings/string_number_conversions.h"
 #include "base/strings/string_piece.h"
 #include "base/strings/string_util.h"
@@ -45,7 +46,7 @@
     }
 
    private:
-    SimpleFileTrackerTest* fixture_;
+    raw_ptr<SimpleFileTrackerTest> fixture_;
   };
 
   using SyncEntryPointer =
diff --git a/net/dns/address_sorter_posix.cc b/net/dns/address_sorter_posix.cc
index c8cc191..ec3391d 100644
--- a/net/dns/address_sorter_posix.cc
+++ b/net/dns/address_sorter_posix.cc
@@ -332,7 +332,7 @@
   std::vector<DestinationInfo> sort_list_;
   AddressSorter::CallbackType callback_;
 
-  const AddressSorterPosix* sorter_;
+  raw_ptr<const AddressSorterPosix> sorter_;
 };
 
 AddressSorterPosix::AddressSorterPosix(ClientSocketFactory* socket_factory)
diff --git a/net/dns/dns_transaction.cc b/net/dns/dns_transaction.cc
index 5db23b2..adb3b0c 100644
--- a/net/dns/dns_transaction.cc
+++ b/net/dns/dns_transaction.cc
@@ -1195,7 +1195,7 @@
         : rv(rv), attempt(attempt) {}
 
     int rv;
-    const DnsAttempt* attempt;
+    raw_ptr<const DnsAttempt> attempt;
   };
 
   // Used in UMA (DNS.AttemptType). Do not renumber or remove values.
diff --git a/net/log/net_log_with_source.h b/net/log/net_log_with_source.h
index c4e8f9e..5e45435 100644
--- a/net/log/net_log_with_source.h
+++ b/net/log/net_log_with_source.h
@@ -5,6 +5,7 @@
 #ifndef NET_LOG_NET_LOG_WITH_SOURCE_H_
 #define NET_LOG_NET_LOG_WITH_SOURCE_H_
 
+#include "base/memory/raw_ptr.h"
 #include "net/base/net_export.h"
 #include "net/log/net_log.h"
 #include "net/log/net_log_event_type.h"
@@ -159,7 +160,7 @@
   // As an optimization, both types internally store a non-null NetLog*. This
   // way no null checks are needed before dispatching to the (possibly dummy)
   // NetLog
-  NetLog* non_null_net_log_;
+  raw_ptr<NetLog> non_null_net_log_;
 };
 
 }  // namespace net
diff --git a/net/quic/bidirectional_stream_quic_impl_unittest.cc b/net/quic/bidirectional_stream_quic_impl_unittest.cc
index cff1176..f34f672 100644
--- a/net/quic/bidirectional_stream_quic_impl_unittest.cc
+++ b/net/quic/bidirectional_stream_quic_impl_unittest.cc
@@ -426,7 +426,7 @@
         : mode(mode), packet(packet) {}
     PacketToWrite(IoMode mode, int rv) : mode(mode), packet(nullptr), rv(rv) {}
     IoMode mode;
-    quic::QuicReceivedPacket* packet;
+    raw_ptr<quic::QuicReceivedPacket> packet;
     int rv;
   };
 
diff --git a/net/quic/quic_http_stream_test.cc b/net/quic/quic_http_stream_test.cc
index dd4327ce..2e0c787 100644
--- a/net/quic/quic_http_stream_test.cc
+++ b/net/quic/quic_http_stream_test.cc
@@ -264,7 +264,7 @@
         : mode(mode), packet(packet) {}
     PacketToWrite(IoMode mode, int rv) : mode(mode), packet(nullptr), rv(rv) {}
     IoMode mode;
-    quic::QuicReceivedPacket* packet;
+    raw_ptr<quic::QuicReceivedPacket> packet;
     int rv;
   };
 
diff --git a/net/socket/unix_domain_server_socket_posix.h b/net/socket/unix_domain_server_socket_posix.h
index e03f4479c..50b0622f 100644
--- a/net/socket/unix_domain_server_socket_posix.h
+++ b/net/socket/unix_domain_server_socket_posix.h
@@ -12,6 +12,7 @@
 #include <string>
 
 #include "base/callback.h"
+#include "base/memory/raw_ptr.h"
 #include "build/build_config.h"
 #include "net/base/completion_once_callback.h"
 #include "net/base/net_export.h"
@@ -91,10 +92,10 @@
 
   struct SocketDestination {
     // Non-null while a call to Accept is pending.
-    std::unique_ptr<StreamSocket>* stream = nullptr;
+    raw_ptr<std::unique_ptr<StreamSocket>> stream = nullptr;
 
     // Non-null while a call to AcceptSocketDescriptor is pending.
-    SocketDescriptor* descriptor = nullptr;
+    raw_ptr<SocketDescriptor> descriptor = nullptr;
   };
   SocketDestination out_socket_;
 };
diff --git a/net/test/embedded_test_server/http2_connection.cc b/net/test/embedded_test_server/http2_connection.cc
index ee82fdc..45513245 100644
--- a/net/test/embedded_test_server/http2_connection.cc
+++ b/net/test/embedded_test_server/http2_connection.cc
@@ -389,8 +389,9 @@
   return true;
 }
 
-void Http2Connection::OnEndStream(http2::adapter::Http2StreamId stream_id) {
+bool Http2Connection::OnEndStream(http2::adapter::Http2StreamId stream_id) {
   ready_streams_.push(stream_id);
+  return true;
 }
 
 bool Http2Connection::OnFrameHeader(StreamId /*stream_id*/,
diff --git a/net/test/embedded_test_server/http2_connection.h b/net/test/embedded_test_server/http2_connection.h
index b7bf585..e650818 100644
--- a/net/test/embedded_test_server/http2_connection.h
+++ b/net/test/embedded_test_server/http2_connection.h
@@ -55,7 +55,7 @@
                                    absl::string_view key,
                                    absl::string_view value) override;
   bool OnEndHeadersForStream(StreamId stream_id) override;
-  void OnEndStream(StreamId stream_id) override;
+  bool OnEndStream(StreamId stream_id) override;
   bool OnCloseStream(StreamId stream_id,
                      http2::adapter::Http2ErrorCode error_code) override;
   // Unused functions
diff --git a/printing/emf_win.h b/printing/emf_win.h
index dd8f3b13..56b2e5b6 100644
--- a/printing/emf_win.h
+++ b/printing/emf_win.h
@@ -132,7 +132,7 @@
  private:
   friend class Emf;
   friend class Enumerator;
-  const ENHMETARECORD* record_;
+  raw_ptr<const ENHMETARECORD> record_;
 };
 
 // Retrieves individual records out of a Emf buffer. The main use is to skip
diff --git a/remoting/host/chromeos/scoped_fake_ash_proxy.h b/remoting/host/chromeos/scoped_fake_ash_proxy.h
index 63d9ad9..66faca4 100644
--- a/remoting/host/chromeos/scoped_fake_ash_proxy.h
+++ b/remoting/host/chromeos/scoped_fake_ash_proxy.h
@@ -82,7 +82,8 @@
 
   DisplayId primary_display_id_ = -1;
   std::vector<display::Display> displays_;
-  mojo::Receiver<viz::mojom::FrameSinkVideoCapturer>* receiver_ = nullptr;
+  raw_ptr<mojo::Receiver<viz::mojom::FrameSinkVideoCapturer>> receiver_ =
+      nullptr;
 
   base::test::TestFuture<ScreenshotRequest> screenshot_request_;
 
diff --git a/remoting/host/desktop_display_layout_util.h b/remoting/host/desktop_display_layout_util.h
index e44c4c9..d7e44d27 100644
--- a/remoting/host/desktop_display_layout_util.h
+++ b/remoting/host/desktop_display_layout_util.h
@@ -7,6 +7,7 @@
 
 #include <vector>
 
+#include "base/memory/raw_ptr.h"
 #include "remoting/proto/control.pb.h"
 
 namespace remoting {
@@ -15,7 +16,7 @@
 // platform-specific representation of the display.
 struct VideoTrackLayoutWithContext {
   protocol::VideoTrackLayout layout;
-  void* context;
+  raw_ptr<void> context;
 };
 
 struct DisplayLayoutDiff {
diff --git a/remoting/protocol/third_party_authenticator_unittest.cc b/remoting/protocol/third_party_authenticator_unittest.cc
index c264c28..7c1d325 100644
--- a/remoting/protocol/third_party_authenticator_unittest.cc
+++ b/remoting/protocol/third_party_authenticator_unittest.cc
@@ -7,6 +7,7 @@
 
 #include "base/bind.h"
 #include "base/memory/ptr_util.h"
+#include "base/memory/raw_ptr.h"
 #include "base/run_loop.h"
 #include "net/base/net_errors.h"
 #include "remoting/base/rsa_key_pair.h"
@@ -121,7 +122,7 @@
     host_ = std::make_unique<ThirdPartyHostAuthenticator>(
         base::BindRepeating(&V2Authenticator::CreateForHost, host_cert_,
                             key_pair_),
-        base::WrapUnique(token_validator_));
+        base::WrapUnique(token_validator_.get()));
     client_ = std::make_unique<ThirdPartyClientAuthenticator>(
         base::BindRepeating(&V2Authenticator::CreateForClient),
         base::BindRepeating(&FakeTokenFetcher::FetchThirdPartyToken,
@@ -129,7 +130,7 @@
   }
 
   FakeTokenFetcher token_fetcher_;
-  FakeTokenValidator* token_validator_;
+  raw_ptr<FakeTokenValidator> token_validator_;
 };
 
 TEST_F(ThirdPartyAuthenticatorTest, SuccessfulAuth) {
diff --git a/sandbox/linux/seccomp-bpf/trap.cc b/sandbox/linux/seccomp-bpf/trap.cc
index 0ef42807..4d0471c 100644
--- a/sandbox/linux/seccomp-bpf/trap.cc
+++ b/sandbox/linux/seccomp-bpf/trap.cc
@@ -248,7 +248,7 @@
 
     // Now call the TrapFnc callback associated with this particular instance
     // of SECCOMP_RET_TRAP.
-    rc = trap.fnc(data, const_cast<void*>(trap.aux));
+    rc = trap.fnc(data, const_cast<void*>(trap.aux.get()));
   }
 
   // Update the CPU register that stores the return code of the system call
diff --git a/sandbox/linux/seccomp-bpf/trap.h b/sandbox/linux/seccomp-bpf/trap.h
index 0bfbbbc8..66b4303 100644
--- a/sandbox/linux/seccomp-bpf/trap.h
+++ b/sandbox/linux/seccomp-bpf/trap.h
@@ -10,6 +10,7 @@
 
 #include <map>
 
+#include "base/memory/raw_ptr.h"
 #include "base/memory/raw_ptr_exclusion.h"
 #include "sandbox/linux/bpf_dsl/trap_registry.h"
 #include "sandbox/linux/system_headers/linux_signal.h"
@@ -49,7 +50,7 @@
     TrapKey() : fnc(nullptr), aux(nullptr), safe(false) {}
     TrapKey(TrapFnc f, const void* a, bool s) : fnc(f), aux(a), safe(s) {}
     TrapFnc fnc;
-    const void* aux;
+    raw_ptr<const void> aux;
     bool safe;
     bool operator<(const TrapKey&) const;
   };
diff --git a/sandbox/win/src/internal_types.h b/sandbox/win/src/internal_types.h
index 434c7e8..88da5c2 100644
--- a/sandbox/win/src/internal_types.h
+++ b/sandbox/win/src/internal_types.h
@@ -7,6 +7,8 @@
 
 #include <stdint.h>
 
+#include "base/memory/raw_ptr.h"
+
 namespace sandbox {
 
 const wchar_t kNtdllName[] = L"ntdll.dll";
@@ -38,7 +40,7 @@
 
  private:
   uint32_t size_;
-  void* buffer_;
+  raw_ptr<void> buffer_;
 };
 
 // Helper class to convert void-pointer packed ints for both
diff --git a/sandbox/win/src/policy_engine_params.h b/sandbox/win/src/policy_engine_params.h
index a8851ee..9ad5719 100644
--- a/sandbox/win/src/policy_engine_params.h
+++ b/sandbox/win/src/policy_engine_params.h
@@ -7,6 +7,7 @@
 
 #include <stdint.h>
 
+#include "base/memory/raw_ptr.h"
 #include "sandbox/win/src/internal_types.h"
 #include "sandbox/win/src/nt_internals.h"
 #include "sandbox/win/src/sandbox_nt_util.h"
@@ -102,11 +103,11 @@
   // it works with pointer while the former works only with references.
   template <typename T>
   T Void2TypePointerCopy() const {
-    return *(reinterpret_cast<const T*>(address_));
+    return *(reinterpret_cast<const T*>(address_.get()));
   }
 
   ArgType real_type_;
-  const void* address_;
+  raw_ptr<const void> address_;
 };
 
 // To safely infer the type, we use a set of template specializations
diff --git a/sandbox/win/src/policy_low_level.h b/sandbox/win/src/policy_low_level.h
index fd7d1396..240d098 100644
--- a/sandbox/win/src/policy_low_level.h
+++ b/sandbox/win/src/policy_low_level.h
@@ -103,7 +103,7 @@
 
  private:
   struct RuleNode {
-    const PolicyRule* rule;
+    raw_ptr<const PolicyRule> rule;
     IpcTag service;
   };
   std::list<RuleNode> rules_;
diff --git a/sandbox/win/src/threadpool.h b/sandbox/win/src/threadpool.h
index 5f77520..db6c142 100644
--- a/sandbox/win/src/threadpool.h
+++ b/sandbox/win/src/threadpool.h
@@ -6,6 +6,7 @@
 #define SANDBOX_WIN_SRC_THREADPOOL_H_
 
 #include <list>
+#include "base/memory/raw_ptr.h"
 #include "base/synchronization/lock.h"
 #include "base/win/windows_types.h"
 
@@ -71,7 +72,7 @@
  private:
   // Record to keep track of a wait and its associated cookie.
   struct PoolObject {
-    const void* cookie;
+    raw_ptr<const void> cookie;
     HANDLE wait;
   };
   // The list of pool wait objects.
diff --git a/services/accessibility/fake_service_client.h b/services/accessibility/fake_service_client.h
index 0039c8d..17484d0 100644
--- a/services/accessibility/fake_service_client.h
+++ b/services/accessibility/fake_service_client.h
@@ -5,6 +5,7 @@
 #ifndef SERVICES_ACCESSIBILITY_FAKE_SERVICE_CLIENT_H_
 #define SERVICES_ACCESSIBILITY_FAKE_SERVICE_CLIENT_H_
 
+#include "base/memory/raw_ptr.h"
 #include "mojo/public/cpp/bindings/receiver.h"
 #include "mojo/public/cpp/bindings/receiver_set.h"
 #include "mojo/public/cpp/bindings/remote_set.h"
@@ -36,7 +37,7 @@
   bool AutomationIsBound();
 
  private:
-  mojom::AccessibilityService* service_;
+  raw_ptr<mojom::AccessibilityService> service_;
 
   base::OnceClosure automation_bound_closure_;
 
diff --git a/services/audio/output_device_mixer_impl_unittest.cc b/services/audio/output_device_mixer_impl_unittest.cc
index 9f073d9..b80a5dc 100644
--- a/services/audio/output_device_mixer_impl_unittest.cc
+++ b/services/audio/output_device_mixer_impl_unittest.cc
@@ -198,9 +198,9 @@
   // Helper.
   struct StreamUnderTest {
     // MixableOutputStream produced by OutputMixerImpl.
-    AudioOutputStream* mixable_stream;
+    raw_ptr<AudioOutputStream> mixable_stream;
     // All the mocks associated with it.
-    MixTrackMock* mix_track_mock;
+    raw_ptr<MixTrackMock> mix_track_mock;
   };
 
   OutputDeviceMixerImplTestBase() {
diff --git a/services/device/geolocation/wifi_data_provider_handle.h b/services/device/geolocation/wifi_data_provider_handle.h
index 3d9da0902..53ac3cb 100644
--- a/services/device/geolocation/wifi_data_provider_handle.h
+++ b/services/device/geolocation/wifi_data_provider_handle.h
@@ -17,6 +17,7 @@
 
 #include "base/bind.h"
 #include "base/callback.h"
+#include "base/memory/raw_ptr.h"
 #include "base/memory/scoped_refptr.h"
 #include "base/strings/string_util.h"
 #include "services/device/geolocation/wifi_data.h"
@@ -80,7 +81,7 @@
   static ImplFactoryFunction factory_function_;
 
   scoped_refptr<WifiDataProvider> impl_;
-  WifiDataUpdateCallback* callback_;
+  raw_ptr<WifiDataUpdateCallback> callback_;
 };
 
 }  // namespace device
diff --git a/services/network/proxy_auto_config_library_unittest.cc b/services/network/proxy_auto_config_library_unittest.cc
index f7d86e9..fa48b69 100644
--- a/services/network/proxy_auto_config_library_unittest.cc
+++ b/services/network/proxy_auto_config_library_unittest.cc
@@ -12,6 +12,7 @@
 #include "base/containers/circular_deque.h"
 #include "base/functional/bind.h"
 #include "base/functional/callback_forward.h"
+#include "base/memory/raw_ptr.h"
 #include "base/memory/scoped_refptr.h"
 #include "base/notreached.h"
 #include "base/run_loop.h"
@@ -262,7 +263,7 @@
   net::IPAddress local_ip_;
   net::Error connect_error_;
   bool connect_async_ = false;
-  base::OnceClosure* connect_callback_;
+  raw_ptr<base::OnceClosure> connect_callback_;
 };
 
 class MockSocketFactory : public net::ClientSocketFactory {
diff --git a/services/network/url_loader_unittest.cc b/services/network/url_loader_unittest.cc
index 8b1bb24..5266d26 100644
--- a/services/network/url_loader_unittest.cc
+++ b/services/network/url_loader_unittest.cc
@@ -665,7 +665,7 @@
   mojo::PendingRemote<mojom::AcceptCHFrameObserver> accept_ch_frame_observer =
       mojo::NullRemote();
   bool third_party_cookies_enabled = true;
-  CacheTransparencySettings* cache_transparency_settings = nullptr;
+  raw_ptr<CacheTransparencySettings> cache_transparency_settings = nullptr;
 
  private:
   bool used = false;
diff --git a/services/resource_coordinator/memory_instrumentation/graph.h b/services/resource_coordinator/memory_instrumentation/graph.h
index 649094e..3ff71c73 100644
--- a/services/resource_coordinator/memory_instrumentation/graph.h
+++ b/services/resource_coordinator/memory_instrumentation/graph.h
@@ -211,8 +211,8 @@
     int priority() const { return priority_; }
 
    private:
-    GlobalDumpGraph::Node* const source_;
-    GlobalDumpGraph::Node* const target_;
+    const raw_ptr<GlobalDumpGraph::Node> source_;
+    const raw_ptr<GlobalDumpGraph::Node> target_;
     const int priority_;
   };
 
diff --git a/services/tracing/public/cpp/perfetto/java_heap_profiler/hprof_parser_android.cc b/services/tracing/public/cpp/perfetto/java_heap_profiler/hprof_parser_android.cc
index b26cf44..943cc1f 100644
--- a/services/tracing/public/cpp/perfetto/java_heap_profiler/hprof_parser_android.cc
+++ b/services/tracing/public/cpp/perfetto/java_heap_profiler/hprof_parser_android.cc
@@ -14,6 +14,7 @@
 #include "base/files/file.h"
 #include "base/files/scoped_file.h"
 #include "base/files/scoped_temp_dir.h"
+#include "base/memory/raw_ptr.h"
 #include "base/strings/string_number_conversions.h"
 #include "services/tracing/public/cpp/perfetto/java_heap_profiler/hprof_data_type_android.h"
 #include "services/tracing/public/cpp/perfetto/java_heap_profiler/hprof_instances_android.h"
@@ -245,7 +246,7 @@
 }
 
 struct HprofParser::RegisteredNativeSize {
-  Instance* referent = nullptr;
+  raw_ptr<Instance> referent = nullptr;
   uint64_t native_size = 0;
 };
 
diff --git a/services/tracing/public/cpp/perfetto/perfetto_tracing_backend.h b/services/tracing/public/cpp/perfetto/perfetto_tracing_backend.h
index 85c7590..71d754da 100644
--- a/services/tracing/public/cpp/perfetto/perfetto_tracing_backend.h
+++ b/services/tracing/public/cpp/perfetto/perfetto_tracing_backend.h
@@ -5,6 +5,7 @@
 #ifndef SERVICES_TRACING_PUBLIC_CPP_PERFETTO_PERFETTO_TRACING_BACKEND_H_
 #define SERVICES_TRACING_PUBLIC_CPP_PERFETTO_PERFETTO_TRACING_BACKEND_H_
 
+#include "base/memory/raw_ptr.h"
 #include "base/sequence_checker.h"
 #include "mojo/public/cpp/bindings/remote.h"
 #include "third_party/perfetto/include/perfetto/tracing/tracing_backend.h"
@@ -61,7 +62,7 @@
   base::Lock task_runner_lock_;
   base::WeakPtr<ProducerEndpoint> producer_endpoint_;
   base::WeakPtr<ConsumerEndpoint> consumer_endpoint_;
-  perfetto::base::TaskRunner* muxer_task_runner_ = nullptr;
+  raw_ptr<perfetto::base::TaskRunner> muxer_task_runner_ = nullptr;
   mojo::PendingRemote<mojom::PerfettoService> perfetto_service_;
   mojo::PendingRemote<mojom::ConsumerHost> consumer_host_remote_;
 
diff --git a/services/video_capture/device_factory.h b/services/video_capture/device_factory.h
index 24f81444..a47bca48 100644
--- a/services/video_capture/device_factory.h
+++ b/services/video_capture/device_factory.h
@@ -5,6 +5,7 @@
 #ifndef SERVICES_VIDEO_CAPTURE_DEVICE_FACTORY_H_
 #define SERVICES_VIDEO_CAPTURE_DEVICE_FACTORY_H_
 
+#include "base/memory/raw_ptr.h"
 #include "services/video_capture/device.h"
 #include "services/video_capture/public/mojom/device_factory.mojom-shared.h"
 #include "services/video_capture/public/mojom/device_factory.mojom.h"
@@ -14,7 +15,7 @@
 class DeviceFactory : public mojom::DeviceFactory {
  public:
   struct DeviceInProcessInfo {
-    Device* device;
+    raw_ptr<Device> device;
     media::VideoCaptureError result_code;
   };
   using CreateDeviceInProcessCallback =
diff --git a/services/viz/public/cpp/compositing/quads_mojom_traits.h b/services/viz/public/cpp/compositing/quads_mojom_traits.h
index 81d9e0e1..21a5184 100644
--- a/services/viz/public/cpp/compositing/quads_mojom_traits.h
+++ b/services/viz/public/cpp/compositing/quads_mojom_traits.h
@@ -627,8 +627,8 @@
 };
 
 struct DrawQuadWithSharedQuadState {
-  const viz::DrawQuad* quad;
-  const viz::SharedQuadState* shared_quad_state;
+  raw_ptr<const viz::DrawQuad> quad;
+  raw_ptr<const viz::SharedQuadState> shared_quad_state;
 };
 
 template <>
@@ -647,7 +647,7 @@
   }
 
   static OptSharedQuadState sqs(const DrawQuadWithSharedQuadState& input) {
-    return {input.shared_quad_state};
+    return {input.shared_quad_state.get()};
   }
 
   static const viz::DrawQuad& draw_quad_state(
diff --git a/styleguide/web/es.md b/styleguide/web/es.md
index aead28e..e411432 100644
--- a/styleguide/web/es.md
+++ b/styleguide/web/es.md
@@ -1097,3 +1097,28 @@
 **Discussion Notes / Link to Thread:**
 
 ---
+
+# ES2020 Support in Chromium
+
+## Allowed features
+
+### Optional Chaining (?.)
+
+The optional chaining operator makes it easy to chain multiple functions /
+property accesses that may return null or undefined.
+
+**Usage Example:**
+
+```js
+// Before:
+const currentKeyboard = keyboards.getCurrentKeyboard();
+const keys = currentKeyboard && currentKeyboard.getKeys();
+const enterKey = keys && keys.getEnterKey();
+
+// After:
+const enterKey = keyboards.getCurrentKeyboard()?.getKeys()?.getEnterKey();
+```
+
+**Documentation:** [link](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Operators/Optional_chaining)
+
+**Discussion Notes / Link to Thread:** [link](https://groups.google.com/a/chromium.org/g/chromium-dev/c/DHLSm05HHlo)
diff --git a/styleguide/web/web.md b/styleguide/web/web.md
index f4412446..f41de47c 100644
--- a/styleguide/web/web.md
+++ b/styleguide/web/web.md
@@ -325,6 +325,22 @@
   instead of always using an arrow function wrapper, when it makes the code less
   verbose without compromising type safety (for example in TypeScript files).
 
+* When using `?.` be aware that information about the original location of the
+  null/undefined value can be lost. You should avoid cases like this and instead
+  prefer explicit error checking:
+```js
+const enterKey = keyboards.getCurrentKeyboard()?.getKeys()?.getEnterKey();
+// ... Lots of code here.
+if (!enterKey) {
+  // Something has gone wrong here, but it is unclear what.
+}
+```
+
+* Don't use `?.` as a way to silence TypeScript "object is possibly null"
+  errors. Instead use `assert()` statements. Only use the optional chaining
+  feature when the code needs to handle null/undefined gracefully.
+
+
 ### Closure compiler
 
 * Closure compiler should only be used by legacy code that has not yet been
diff --git a/testing/buildbot/chromium.chromiumos.json b/testing/buildbot/chromium.chromiumos.json
index 4d36701..4d754c28 100644
--- a/testing/buildbot/chromium.chromiumos.json
+++ b/testing/buildbot/chromium.chromiumos.json
@@ -5923,9 +5923,9 @@
       {
         "args": [
           "--test-launcher-filter-file=../../testing/buildbot/filters/linux-lacros.interactive_ui_tests.filter;../../testing/buildbot/filters/linux-lacros.interactive_ui_tests.skew.filter",
-          "--ash-chrome-path-override=../../lacros_version_skew_tests_v110.0.5432.0/test_ash_chrome"
+          "--ash-chrome-path-override=../../lacros_version_skew_tests_v110.0.5433.0/test_ash_chrome"
         ],
-        "description": "Run with ash-chrome version 110.0.5432.0",
+        "description": "Run with ash-chrome version 110.0.5433.0",
         "isolate_profile_data": true,
         "merge": {
           "args": [],
@@ -5937,8 +5937,8 @@
           "cipd_packages": [
             {
               "cipd_package": "chromium/testing/linux-ash-chromium/x86_64/ash.zip",
-              "location": "lacros_version_skew_tests_v110.0.5432.0",
-              "revision": "version:110.0.5432.0"
+              "location": "lacros_version_skew_tests_v110.0.5433.0",
+              "revision": "version:110.0.5433.0"
             }
           ],
           "dimension_sets": [
@@ -6090,9 +6090,9 @@
       {
         "args": [
           "--test-launcher-filter-file=../../testing/buildbot/filters/linux-lacros.lacros_chrome_browsertests.skew.filter",
-          "--ash-chrome-path-override=../../lacros_version_skew_tests_v110.0.5432.0/test_ash_chrome"
+          "--ash-chrome-path-override=../../lacros_version_skew_tests_v110.0.5433.0/test_ash_chrome"
         ],
-        "description": "Run with ash-chrome version 110.0.5432.0",
+        "description": "Run with ash-chrome version 110.0.5433.0",
         "isolate_profile_data": true,
         "merge": {
           "args": [],
@@ -6104,8 +6104,8 @@
           "cipd_packages": [
             {
               "cipd_package": "chromium/testing/linux-ash-chromium/x86_64/ash.zip",
-              "location": "lacros_version_skew_tests_v110.0.5432.0",
-              "revision": "version:110.0.5432.0"
+              "location": "lacros_version_skew_tests_v110.0.5433.0",
+              "revision": "version:110.0.5433.0"
             }
           ],
           "dimension_sets": [
@@ -6242,9 +6242,9 @@
       {
         "args": [
           "--test-launcher-filter-file=../../testing/buildbot/filters/linux-lacros.lacros_chrome_browsertests.skew.filter",
-          "--ash-chrome-path-override=../../lacros_version_skew_tests_v110.0.5432.0/test_ash_chrome"
+          "--ash-chrome-path-override=../../lacros_version_skew_tests_v110.0.5433.0/test_ash_chrome"
         ],
-        "description": "Run with ash-chrome version 110.0.5432.0",
+        "description": "Run with ash-chrome version 110.0.5433.0",
         "isolate_profile_data": true,
         "merge": {
           "args": [],
@@ -6256,8 +6256,8 @@
           "cipd_packages": [
             {
               "cipd_package": "chromium/testing/linux-ash-chromium/x86_64/ash.zip",
-              "location": "lacros_version_skew_tests_v110.0.5432.0",
-              "revision": "version:110.0.5432.0"
+              "location": "lacros_version_skew_tests_v110.0.5433.0",
+              "revision": "version:110.0.5433.0"
             }
           ],
           "dimension_sets": [
diff --git a/testing/buildbot/chromium.fyi.json b/testing/buildbot/chromium.fyi.json
index 1b57e52..0df54b2 100644
--- a/testing/buildbot/chromium.fyi.json
+++ b/testing/buildbot/chromium.fyi.json
@@ -87397,9 +87397,9 @@
       {
         "args": [
           "--test-launcher-filter-file=../../testing/buildbot/filters/linux-lacros.interactive_ui_tests.filter;../../testing/buildbot/filters/linux-lacros.interactive_ui_tests.skew.filter",
-          "--ash-chrome-path-override=../../lacros_version_skew_tests_v110.0.5432.0/test_ash_chrome"
+          "--ash-chrome-path-override=../../lacros_version_skew_tests_v110.0.5433.0/test_ash_chrome"
         ],
-        "description": "Run with ash-chrome version 110.0.5432.0",
+        "description": "Run with ash-chrome version 110.0.5433.0",
         "isolate_profile_data": true,
         "merge": {
           "args": [],
@@ -87411,8 +87411,8 @@
           "cipd_packages": [
             {
               "cipd_package": "chromium/testing/linux-ash-chromium/x86_64/ash.zip",
-              "location": "lacros_version_skew_tests_v110.0.5432.0",
-              "revision": "version:110.0.5432.0"
+              "location": "lacros_version_skew_tests_v110.0.5433.0",
+              "revision": "version:110.0.5433.0"
             }
           ],
           "service_account": "chromium-tester@chops-service-accounts.iam.gserviceaccount.com",
@@ -87534,9 +87534,9 @@
       {
         "args": [
           "--test-launcher-filter-file=../../testing/buildbot/filters/linux-lacros.lacros_chrome_browsertests.skew.filter",
-          "--ash-chrome-path-override=../../lacros_version_skew_tests_v110.0.5432.0/test_ash_chrome"
+          "--ash-chrome-path-override=../../lacros_version_skew_tests_v110.0.5433.0/test_ash_chrome"
         ],
-        "description": "Run with ash-chrome version 110.0.5432.0",
+        "description": "Run with ash-chrome version 110.0.5433.0",
         "isolate_profile_data": true,
         "merge": {
           "args": [],
@@ -87548,8 +87548,8 @@
           "cipd_packages": [
             {
               "cipd_package": "chromium/testing/linux-ash-chromium/x86_64/ash.zip",
-              "location": "lacros_version_skew_tests_v110.0.5432.0",
-              "revision": "version:110.0.5432.0"
+              "location": "lacros_version_skew_tests_v110.0.5433.0",
+              "revision": "version:110.0.5433.0"
             }
           ],
           "service_account": "chromium-tester@chops-service-accounts.iam.gserviceaccount.com"
@@ -87661,9 +87661,9 @@
       {
         "args": [
           "--test-launcher-filter-file=../../testing/buildbot/filters/linux-lacros.lacros_chrome_browsertests.skew.filter",
-          "--ash-chrome-path-override=../../lacros_version_skew_tests_v110.0.5432.0/test_ash_chrome"
+          "--ash-chrome-path-override=../../lacros_version_skew_tests_v110.0.5433.0/test_ash_chrome"
         ],
-        "description": "Run with ash-chrome version 110.0.5432.0",
+        "description": "Run with ash-chrome version 110.0.5433.0",
         "isolate_profile_data": true,
         "merge": {
           "args": [],
@@ -87675,8 +87675,8 @@
           "cipd_packages": [
             {
               "cipd_package": "chromium/testing/linux-ash-chromium/x86_64/ash.zip",
-              "location": "lacros_version_skew_tests_v110.0.5432.0",
-              "revision": "version:110.0.5432.0"
+              "location": "lacros_version_skew_tests_v110.0.5433.0",
+              "revision": "version:110.0.5433.0"
             }
           ],
           "service_account": "chromium-tester@chops-service-accounts.iam.gserviceaccount.com",
@@ -89017,9 +89017,9 @@
       {
         "args": [
           "--test-launcher-filter-file=../../testing/buildbot/filters/linux-lacros.interactive_ui_tests.filter;../../testing/buildbot/filters/linux-lacros.interactive_ui_tests.skew.filter",
-          "--ash-chrome-path-override=../../lacros_version_skew_tests_v110.0.5432.0/test_ash_chrome"
+          "--ash-chrome-path-override=../../lacros_version_skew_tests_v110.0.5433.0/test_ash_chrome"
         ],
-        "description": "Run with ash-chrome version 110.0.5432.0",
+        "description": "Run with ash-chrome version 110.0.5433.0",
         "merge": {
           "args": [],
           "script": "//testing/merge_scripts/standard_gtest_merge.py"
@@ -89030,8 +89030,8 @@
           "cipd_packages": [
             {
               "cipd_package": "chromium/testing/linux-ash-chromium/x86_64/ash.zip",
-              "location": "lacros_version_skew_tests_v110.0.5432.0",
-              "revision": "version:110.0.5432.0"
+              "location": "lacros_version_skew_tests_v110.0.5433.0",
+              "revision": "version:110.0.5433.0"
             }
           ],
           "dimension_sets": [
@@ -89184,9 +89184,9 @@
       {
         "args": [
           "--test-launcher-filter-file=../../testing/buildbot/filters/linux-lacros.lacros_chrome_browsertests.skew.filter",
-          "--ash-chrome-path-override=../../lacros_version_skew_tests_v110.0.5432.0/test_ash_chrome"
+          "--ash-chrome-path-override=../../lacros_version_skew_tests_v110.0.5433.0/test_ash_chrome"
         ],
-        "description": "Run with ash-chrome version 110.0.5432.0",
+        "description": "Run with ash-chrome version 110.0.5433.0",
         "merge": {
           "args": [],
           "script": "//testing/merge_scripts/standard_gtest_merge.py"
@@ -89197,8 +89197,8 @@
           "cipd_packages": [
             {
               "cipd_package": "chromium/testing/linux-ash-chromium/x86_64/ash.zip",
-              "location": "lacros_version_skew_tests_v110.0.5432.0",
-              "revision": "version:110.0.5432.0"
+              "location": "lacros_version_skew_tests_v110.0.5433.0",
+              "revision": "version:110.0.5433.0"
             }
           ],
           "dimension_sets": [
@@ -89336,9 +89336,9 @@
       {
         "args": [
           "--test-launcher-filter-file=../../testing/buildbot/filters/linux-lacros.lacros_chrome_browsertests.skew.filter",
-          "--ash-chrome-path-override=../../lacros_version_skew_tests_v110.0.5432.0/test_ash_chrome"
+          "--ash-chrome-path-override=../../lacros_version_skew_tests_v110.0.5433.0/test_ash_chrome"
         ],
-        "description": "Run with ash-chrome version 110.0.5432.0",
+        "description": "Run with ash-chrome version 110.0.5433.0",
         "merge": {
           "args": [],
           "script": "//testing/merge_scripts/standard_gtest_merge.py"
@@ -89349,8 +89349,8 @@
           "cipd_packages": [
             {
               "cipd_package": "chromium/testing/linux-ash-chromium/x86_64/ash.zip",
-              "location": "lacros_version_skew_tests_v110.0.5432.0",
-              "revision": "version:110.0.5432.0"
+              "location": "lacros_version_skew_tests_v110.0.5433.0",
+              "revision": "version:110.0.5433.0"
             }
           ],
           "dimension_sets": [
@@ -90872,9 +90872,9 @@
       {
         "args": [
           "--test-launcher-filter-file=../../testing/buildbot/filters/linux-lacros.interactive_ui_tests.filter;../../testing/buildbot/filters/linux-lacros.interactive_ui_tests.skew.filter",
-          "--ash-chrome-path-override=../../lacros_version_skew_tests_v110.0.5432.0/test_ash_chrome"
+          "--ash-chrome-path-override=../../lacros_version_skew_tests_v110.0.5433.0/test_ash_chrome"
         ],
-        "description": "Run with ash-chrome version 110.0.5432.0",
+        "description": "Run with ash-chrome version 110.0.5433.0",
         "merge": {
           "args": [],
           "script": "//testing/merge_scripts/standard_gtest_merge.py"
@@ -90885,8 +90885,8 @@
           "cipd_packages": [
             {
               "cipd_package": "chromium/testing/linux-ash-chromium/x86_64/ash.zip",
-              "location": "lacros_version_skew_tests_v110.0.5432.0",
-              "revision": "version:110.0.5432.0"
+              "location": "lacros_version_skew_tests_v110.0.5433.0",
+              "revision": "version:110.0.5433.0"
             }
           ],
           "dimension_sets": [
@@ -91039,9 +91039,9 @@
       {
         "args": [
           "--test-launcher-filter-file=../../testing/buildbot/filters/linux-lacros.lacros_chrome_browsertests.skew.filter",
-          "--ash-chrome-path-override=../../lacros_version_skew_tests_v110.0.5432.0/test_ash_chrome"
+          "--ash-chrome-path-override=../../lacros_version_skew_tests_v110.0.5433.0/test_ash_chrome"
         ],
-        "description": "Run with ash-chrome version 110.0.5432.0",
+        "description": "Run with ash-chrome version 110.0.5433.0",
         "merge": {
           "args": [],
           "script": "//testing/merge_scripts/standard_gtest_merge.py"
@@ -91052,8 +91052,8 @@
           "cipd_packages": [
             {
               "cipd_package": "chromium/testing/linux-ash-chromium/x86_64/ash.zip",
-              "location": "lacros_version_skew_tests_v110.0.5432.0",
-              "revision": "version:110.0.5432.0"
+              "location": "lacros_version_skew_tests_v110.0.5433.0",
+              "revision": "version:110.0.5433.0"
             }
           ],
           "dimension_sets": [
@@ -91191,9 +91191,9 @@
       {
         "args": [
           "--test-launcher-filter-file=../../testing/buildbot/filters/linux-lacros.lacros_chrome_browsertests.skew.filter",
-          "--ash-chrome-path-override=../../lacros_version_skew_tests_v110.0.5432.0/test_ash_chrome"
+          "--ash-chrome-path-override=../../lacros_version_skew_tests_v110.0.5433.0/test_ash_chrome"
         ],
-        "description": "Run with ash-chrome version 110.0.5432.0",
+        "description": "Run with ash-chrome version 110.0.5433.0",
         "merge": {
           "args": [],
           "script": "//testing/merge_scripts/standard_gtest_merge.py"
@@ -91204,8 +91204,8 @@
           "cipd_packages": [
             {
               "cipd_package": "chromium/testing/linux-ash-chromium/x86_64/ash.zip",
-              "location": "lacros_version_skew_tests_v110.0.5432.0",
-              "revision": "version:110.0.5432.0"
+              "location": "lacros_version_skew_tests_v110.0.5433.0",
+              "revision": "version:110.0.5433.0"
             }
           ],
           "dimension_sets": [
@@ -91973,9 +91973,9 @@
       {
         "args": [
           "--test-launcher-filter-file=../../testing/buildbot/filters/linux-lacros.interactive_ui_tests.filter;../../testing/buildbot/filters/linux-lacros.interactive_ui_tests.skew.filter",
-          "--ash-chrome-path-override=../../lacros_version_skew_tests_v110.0.5432.0/test_ash_chrome"
+          "--ash-chrome-path-override=../../lacros_version_skew_tests_v110.0.5433.0/test_ash_chrome"
         ],
-        "description": "Run with ash-chrome version 110.0.5432.0",
+        "description": "Run with ash-chrome version 110.0.5433.0",
         "merge": {
           "args": [],
           "script": "//testing/merge_scripts/standard_gtest_merge.py"
@@ -91986,8 +91986,8 @@
           "cipd_packages": [
             {
               "cipd_package": "chromium/testing/linux-ash-chromium/x86_64/ash.zip",
-              "location": "lacros_version_skew_tests_v110.0.5432.0",
-              "revision": "version:110.0.5432.0"
+              "location": "lacros_version_skew_tests_v110.0.5433.0",
+              "revision": "version:110.0.5433.0"
             }
           ],
           "dimension_sets": [
diff --git a/testing/buildbot/chromium.memory.json b/testing/buildbot/chromium.memory.json
index b107ea4..a4196bf 100644
--- a/testing/buildbot/chromium.memory.json
+++ b/testing/buildbot/chromium.memory.json
@@ -18604,11 +18604,11 @@
       {
         "args": [
           "--test-launcher-filter-file=../../testing/buildbot/filters/linux-lacros.interactive_ui_tests.filter;../../testing/buildbot/filters/linux-lacros.interactive_ui_tests.skew.filter",
-          "--ash-chrome-path-override=../../lacros_version_skew_tests_v110.0.5432.0/test_ash_chrome",
+          "--ash-chrome-path-override=../../lacros_version_skew_tests_v110.0.5433.0/test_ash_chrome",
           "--test-launcher-print-test-stdio=always",
           "--combine-ash-logs-on-bots"
         ],
-        "description": "Run with ash-chrome version 110.0.5432.0",
+        "description": "Run with ash-chrome version 110.0.5433.0",
         "isolate_profile_data": true,
         "merge": {
           "args": [],
@@ -18620,8 +18620,8 @@
           "cipd_packages": [
             {
               "cipd_package": "chromium/testing/linux-ash-chromium/x86_64/ash.zip",
-              "location": "lacros_version_skew_tests_v110.0.5432.0",
-              "revision": "version:110.0.5432.0"
+              "location": "lacros_version_skew_tests_v110.0.5433.0",
+              "revision": "version:110.0.5433.0"
             }
           ],
           "dimension_sets": [
@@ -18785,11 +18785,11 @@
       {
         "args": [
           "--test-launcher-filter-file=../../testing/buildbot/filters/linux-lacros.lacros_chrome_browsertests.skew.filter",
-          "--ash-chrome-path-override=../../lacros_version_skew_tests_v110.0.5432.0/test_ash_chrome",
+          "--ash-chrome-path-override=../../lacros_version_skew_tests_v110.0.5433.0/test_ash_chrome",
           "--test-launcher-print-test-stdio=always",
           "--combine-ash-logs-on-bots"
         ],
-        "description": "Run with ash-chrome version 110.0.5432.0",
+        "description": "Run with ash-chrome version 110.0.5433.0",
         "isolate_profile_data": true,
         "merge": {
           "args": [],
@@ -18801,8 +18801,8 @@
           "cipd_packages": [
             {
               "cipd_package": "chromium/testing/linux-ash-chromium/x86_64/ash.zip",
-              "location": "lacros_version_skew_tests_v110.0.5432.0",
-              "revision": "version:110.0.5432.0"
+              "location": "lacros_version_skew_tests_v110.0.5433.0",
+              "revision": "version:110.0.5433.0"
             }
           ],
           "dimension_sets": [
@@ -18947,11 +18947,11 @@
       {
         "args": [
           "--test-launcher-filter-file=../../testing/buildbot/filters/linux-lacros.lacros_chrome_browsertests.skew.filter",
-          "--ash-chrome-path-override=../../lacros_version_skew_tests_v110.0.5432.0/test_ash_chrome",
+          "--ash-chrome-path-override=../../lacros_version_skew_tests_v110.0.5433.0/test_ash_chrome",
           "--test-launcher-print-test-stdio=always",
           "--combine-ash-logs-on-bots"
         ],
-        "description": "Run with ash-chrome version 110.0.5432.0",
+        "description": "Run with ash-chrome version 110.0.5433.0",
         "isolate_profile_data": true,
         "merge": {
           "args": [],
@@ -18963,8 +18963,8 @@
           "cipd_packages": [
             {
               "cipd_package": "chromium/testing/linux-ash-chromium/x86_64/ash.zip",
-              "location": "lacros_version_skew_tests_v110.0.5432.0",
-              "revision": "version:110.0.5432.0"
+              "location": "lacros_version_skew_tests_v110.0.5433.0",
+              "revision": "version:110.0.5433.0"
             }
           ],
           "dimension_sets": [
diff --git a/testing/buildbot/variants.pyl b/testing/buildbot/variants.pyl
index 763fd76c..2a16ac277 100644
--- a/testing/buildbot/variants.pyl
+++ b/testing/buildbot/variants.pyl
@@ -22,16 +22,16 @@
   },
   'LACROS_VERSION_SKEW_CANARY': {
     'args': [
-      '--ash-chrome-path-override=../../lacros_version_skew_tests_v110.0.5432.0/test_ash_chrome',
+      '--ash-chrome-path-override=../../lacros_version_skew_tests_v110.0.5433.0/test_ash_chrome',
     ],
-    'description': 'Run with ash-chrome version 110.0.5432.0',
+    'description': 'Run with ash-chrome version 110.0.5433.0',
     'identifier': 'Lacros version skew testing ash canary',
     'swarming': {
       'cipd_packages': [
         {
           'cipd_package': 'chromium/testing/linux-ash-chromium/x86_64/ash.zip',
-          'location': 'lacros_version_skew_tests_v110.0.5432.0',
-          'revision': 'version:110.0.5432.0',
+          'location': 'lacros_version_skew_tests_v110.0.5433.0',
+          'revision': 'version:110.0.5433.0',
         },
       ],
     },
diff --git a/testing/variations/fieldtrial_testing_config.json b/testing/variations/fieldtrial_testing_config.json
index b024a2b..30ee464 100644
--- a/testing/variations/fieldtrial_testing_config.json
+++ b/testing/variations/fieldtrial_testing_config.json
@@ -4547,25 +4547,6 @@
             ]
         }
     ],
-    "ExtensionJustification": [
-        {
-            "platforms": [
-                "chromeos",
-                "fuchsia",
-                "linux",
-                "mac",
-                "windows"
-            ],
-            "experiments": [
-                {
-                    "name": "Enabled",
-                    "enable_features": [
-                        "ExtensionWorkflowJustification"
-                    ]
-                }
-            ]
-        }
-    ],
     "ExtensionTelemetryStudyPersistence": [
         {
             "platforms": [
diff --git a/third_party/blink/common/scheduler/web_scheduler_tracked_feature.cc b/third_party/blink/common/scheduler/web_scheduler_tracked_feature.cc
index 4b9c1c44..a68df4a4 100644
--- a/third_party/blink/common/scheduler/web_scheduler_tracked_feature.cc
+++ b/third_party/blink/common/scheduler/web_scheduler_tracked_feature.cc
@@ -120,7 +120,7 @@
     case WebSchedulerTrackedFeature::kInjectedStyleSheet:
       return {"InjectedStyleSheet", "External systesheet injected"};
     case WebSchedulerTrackedFeature::kKeepaliveRequest:
-      return {"InjectedStyleSheet", "requests with keepalive set"};
+      return {"KeepaliveRequest", "requests with keepalive set"};
     case WebSchedulerTrackedFeature::kDummy:
       return {"Dummy", "Dummy for testing"};
   }
diff --git a/third_party/blink/common/tokens/tokens_mojom_traits.cc b/third_party/blink/common/tokens/tokens_mojom_traits.cc
index 4a13a86..7d2d4ae 100644
--- a/third_party/blink/common/tokens/tokens_mojom_traits.cc
+++ b/third_party/blink/common/tokens/tokens_mojom_traits.cc
@@ -173,6 +173,12 @@
       *output = token;
       return ret;
     }
+    case DataView::Tag::kShadowRealmToken: {
+      blink::ShadowRealmToken token;
+      bool ret = input.ReadShadowRealmToken(&token);
+      *output = token;
+      return ret;
+    }
   }
   return false;
 }
diff --git a/third_party/blink/public/common/tokens/tokens_mojom_traits.h b/third_party/blink/public/common/tokens/tokens_mojom_traits.h
index d8ec43b..c4a1376 100644
--- a/third_party/blink/public/common/tokens/tokens_mojom_traits.h
+++ b/third_party/blink/public/common/tokens/tokens_mojom_traits.h
@@ -203,6 +203,16 @@
 };
 
 ////////////////////////////////////////////////////////////////////////////////
+// SHADOW REALM TOKENS
+
+template <>
+struct StructTraits<blink::mojom::ShadowRealmTokenDataView,
+                    blink::ShadowRealmToken>
+    : public blink::TokenMojomTraitsHelper<
+          blink::mojom::ShadowRealmTokenDataView,
+          blink::ShadowRealmToken> {};
+
+////////////////////////////////////////////////////////////////////////////////
 // OTHER TOKENS
 //
 // Keep this section last.
@@ -255,6 +265,8 @@
         return DataView::Tag::kLayoutWorkletToken;
       case blink::ExecutionContextToken::IndexOf<blink::PaintWorkletToken>():
         return DataView::Tag::kPaintWorkletToken;
+      case blink::ExecutionContextToken::IndexOf<blink::ShadowRealmToken>():
+        return DataView::Tag::kShadowRealmToken;
     }
     base::ImmediateCrash();
   }
@@ -291,6 +303,10 @@
       const blink::ExecutionContextToken& token) {
     return token.GetAs<blink::PaintWorkletToken>();
   }
+  static const blink::ShadowRealmToken& shadow_realm_token(
+      const blink::ExecutionContextToken& token) {
+    return token.GetAs<blink::ShadowRealmToken>();
+  }
 };
 
 template <>
diff --git a/third_party/blink/public/mojom/tokens/BUILD.gn b/third_party/blink/public/mojom/tokens/BUILD.gn
index f04008e..b0db960 100644
--- a/third_party/blink/public/mojom/tokens/BUILD.gn
+++ b/third_party/blink/public/mojom/tokens/BUILD.gn
@@ -70,6 +70,12 @@
           cpp = "::blink::WorkletToken"
         },
 
+        # SHADOW REALM TOKENS
+        {
+          mojom = "blink.mojom.ShadowRealmToken"
+          cpp = "::blink::ShadowRealmToken"
+        },
+
         # OTHER TOKENS
         #
         # Keep this section last.
diff --git a/third_party/blink/public/mojom/tokens/tokens.mojom b/third_party/blink/public/mojom/tokens/tokens.mojom
index 34bf994..293c410 100644
--- a/third_party/blink/public/mojom/tokens/tokens.mojom
+++ b/third_party/blink/public/mojom/tokens/tokens.mojom
@@ -86,6 +86,13 @@
 };
 
 ////////////////////////////////////////////////////////////////////////////////
+// SHADOW REALM TOKENS
+
+struct ShadowRealmToken {
+  mojo_base.mojom.UnguessableToken value;
+};
+
+////////////////////////////////////////////////////////////////////////////////
 // OTHER TOKENS
 //
 // Keep this section last.
@@ -111,6 +118,7 @@
   AudioWorkletToken audio_worklet_token;
   LayoutWorkletToken layout_worklet_token;
   PaintWorkletToken paint_worklet_token;
+  ShadowRealmToken shadow_realm_token;
 };
 
 struct PortalToken {
diff --git a/third_party/blink/renderer/core/BUILD.gn b/third_party/blink/renderer/core/BUILD.gn
index 42f8f26..011e28d6 100644
--- a/third_party/blink/renderer/core/BUILD.gn
+++ b/third_party/blink/renderer/core/BUILD.gn
@@ -1733,5 +1733,6 @@
     "//third_party/blink/renderer/platform:blink_fuzzer_test_support",
     "//third_party/libprotobuf-mutator",
   ]
-  seed_corpus = "//third_party/blink/renderer/core/frame/attribution_src/attribution_trigger_registration_corpus"
+  seed_corpus =
+      "//components/attribution_reporting/trigger_registration_fuzzer_corpus"
 }
diff --git a/third_party/blink/renderer/core/dom/document.cc b/third_party/blink/renderer/core/dom/document.cc
index 442d81d..50593d7 100644
--- a/third_party/blink/renderer/core/dom/document.cc
+++ b/third_party/blink/renderer/core/dom/document.cc
@@ -8808,8 +8808,6 @@
 
 void Document::ActivateForPrerendering(
     const mojom::blink::PrerenderPageActivationParams& params) {
-  DCHECK(features::IsPrerender2Enabled());
-
   // TODO(bokan): Portals will change this assumption since they mean an active
   // document can be "adopted" into a portal.
   DCHECK(is_prerendering_);
diff --git a/third_party/blink/renderer/core/editing/position_iterator.cc b/third_party/blink/renderer/core/editing/position_iterator.cc
index 1f8c4bbe..2c3fc2ea 100644
--- a/third_party/blink/renderer/core/editing/position_iterator.cc
+++ b/third_party/blink/renderer/core/editing/position_iterator.cc
@@ -25,7 +25,9 @@
 
 #include "third_party/blink/renderer/core/editing/position_iterator.h"
 
+#include "base/numerics/safe_conversions.h"
 #include "third_party/blink/renderer/core/core_export.h"
+#include "third_party/blink/renderer/core/dom/text.h"
 #include "third_party/blink/renderer/core/editing/editing_utilities.h"
 #include "third_party/blink/renderer/core/editing/position.h"
 
@@ -58,7 +60,7 @@
 static constexpr int kInvalidOffset = -1;
 
 template <typename Strategy>
-PositionIteratorAlgorithm<Strategy>::PositionIteratorAlgorithm(
+SlowPositionIteratorAlgorithm<Strategy>::SlowPositionIteratorAlgorithm(
     const PositionTemplate<Strategy>& pos) {
   if (pos.IsNull())
     return;
@@ -84,7 +86,7 @@
 
 template <typename Strategy>
 PositionTemplate<Strategy>
-PositionIteratorAlgorithm<Strategy>::DeprecatedComputePosition() const {
+SlowPositionIteratorAlgorithm<Strategy>::DeprecatedComputePosition() const {
   // TODO(yoichio): Share code to check domTreeVersion with EphemeralRange.
   DCHECK(IsValid());
   if (node_after_position_in_anchor_) {
@@ -110,7 +112,7 @@
 
 template <typename Strategy>
 PositionTemplate<Strategy>
-PositionIteratorAlgorithm<Strategy>::ComputePosition() const {
+SlowPositionIteratorAlgorithm<Strategy>::ComputePosition() const {
   DCHECK(IsValid());
   // Assume that we have the following DOM tree:
   // A
@@ -150,7 +152,7 @@
 }
 
 template <typename Strategy>
-void PositionIteratorAlgorithm<Strategy>::Increment() {
+void SlowPositionIteratorAlgorithm<Strategy>::Increment() {
   DCHECK(IsValid());
   if (!anchor_node_)
     return;
@@ -227,7 +229,7 @@
 }
 
 template <typename Strategy>
-void PositionIteratorAlgorithm<Strategy>::Decrement() {
+void SlowPositionIteratorAlgorithm<Strategy>::Decrement() {
   DCHECK(IsValid());
   if (!anchor_node_)
     return;
@@ -338,7 +340,7 @@
 }
 
 template <typename Strategy>
-bool PositionIteratorAlgorithm<Strategy>::AtStart() const {
+bool SlowPositionIteratorAlgorithm<Strategy>::AtStart() const {
   DCHECK(IsValid());
   if (!anchor_node_)
     return true;
@@ -350,7 +352,7 @@
 }
 
 template <typename Strategy>
-bool PositionIteratorAlgorithm<Strategy>::AtEnd() const {
+bool SlowPositionIteratorAlgorithm<Strategy>::AtEnd() const {
   DCHECK(IsValid());
   if (!anchor_node_)
     return true;
@@ -362,7 +364,7 @@
 }
 
 template <typename Strategy>
-bool PositionIteratorAlgorithm<Strategy>::AtStartOfNode() const {
+bool SlowPositionIteratorAlgorithm<Strategy>::AtStartOfNode() const {
   DCHECK(IsValid());
   if (!anchor_node_)
     return true;
@@ -374,7 +376,7 @@
 }
 
 template <typename Strategy>
-bool PositionIteratorAlgorithm<Strategy>::AtEndOfNode() const {
+bool SlowPositionIteratorAlgorithm<Strategy>::AtEndOfNode() const {
   DCHECK(IsValid());
   if (!anchor_node_)
     return true;
@@ -384,6 +386,676 @@
          offset_in_anchor_ >= Strategy::LastOffsetForEditing(anchor_node_);
 }
 
+template class CORE_TEMPLATE_EXPORT
+    SlowPositionIteratorAlgorithm<EditingStrategy>;
+template class CORE_TEMPLATE_EXPORT
+    SlowPositionIteratorAlgorithm<EditingInFlatTreeStrategy>;
+
+// ---
+
+// static
+template <typename Strategy>
+typename FastPositionIteratorAlgorithm<Strategy>::ContainerType
+FastPositionIteratorAlgorithm<Strategy>::ContainerToContainerType(
+    const Node* node) {
+  if (!node)
+    return kNullNode;
+  if (IsA<Text>(node) && node->GetLayoutObject())
+    return kTextNode;
+  if (IsA<CharacterData>(node))
+    return kCharacterData;
+  if (!Strategy::HasChildren(*node))
+    return kNoChildren;
+  if (::blink::IsUserSelectContain(*node))
+    return kUserSelectContainNode;
+  return kContainerNode;
+}
+
+template <typename Strategy>
+FastPositionIteratorAlgorithm<Strategy>::FastPositionIteratorAlgorithm(
+    const PositionType& position) {
+  Initialize(position);
+  AssertOffsetInContainerIsValid();
+}
+
+template <typename Strategy>
+void FastPositionIteratorAlgorithm<Strategy>::Initialize(
+    const PositionType& position) {
+  container_node_ = position.AnchorNode();
+  if (!container_node_)
+    return;
+  dom_tree_version_ = container_node_->GetDocument().DomTreeVersion();
+  container_type_ = ContainerToContainerType(container_node_);
+
+  switch (container_type_) {
+    case kNullNode:
+      NOTREACHED();
+      return;
+    case kNoChildren:
+      switch (position.AnchorType()) {
+        case PositionAnchorType::kAfterChildren:
+        case PositionAnchorType::kAfterAnchor:
+          offset_in_container_ = IgnoresChildren() ? 1 : 0;
+          return;
+        case PositionAnchorType::kBeforeAnchor:
+          offset_in_container_ = 0;
+          return;
+        case PositionAnchorType::kOffsetInAnchor:
+          DCHECK(!position.OffsetInContainerNode());
+          offset_in_container_ = 0;
+          return;
+      }
+      NOTREACHED() << "Invalid PositionAnchorType";
+      return;
+    case kCharacterData:
+    case kTextNode:
+      // Note: `Position::ComputeOffsetInContainer()` for `kAfterAnchor`
+      // returns `container_node_->Index() + 1` instead of `Text::length()`.
+      switch (position.AnchorType()) {
+        case PositionAnchorType::kAfterChildren:
+          NOTREACHED();
+          break;
+        case PositionAnchorType::kAfterAnchor:
+          offset_in_container_ = To<CharacterData>(container_node_)->length();
+          return;
+        case PositionAnchorType::kBeforeAnchor:
+          offset_in_container_ = 0;
+          return;
+        case PositionAnchorType::kOffsetInAnchor:
+          offset_in_container_ = position.OffsetInContainerNode();
+          return;
+      }
+      NOTREACHED() << "Invalid PositionAnchorType";
+      return;
+    case kContainerNode:
+    case kUserSelectContainNode:
+      container_type_ = kContainerNode;
+      switch (position.AnchorType()) {
+        case PositionAnchorType::kAfterChildren:
+        case PositionAnchorType::kAfterAnchor:
+          child_before_position_ = Strategy::LastChild(*container_node_);
+          offset_in_container_ = child_before_position_ ? kInvalidOffset : 0;
+          container_type_ = kContainerNode;
+          return;
+        case PositionAnchorType::kBeforeAnchor:
+          child_before_position_ = nullptr;
+          offset_in_container_ = 0;
+          container_type_ = kContainerNode;
+          return;
+        case PositionAnchorType::kOffsetInAnchor:
+          // This takes `O(position.OffsetInContainerNode())`.
+          child_before_position_ = position.ComputeNodeBeforePosition();
+          offset_in_container_ = position.OffsetInContainerNode();
+          container_type_ = kContainerNode;
+          return;
+      }
+      NOTREACHED() << " Invalid PositionAnchorType=" << position.AnchorType();
+  }
+  NOTREACHED() << " Invalid container_type_=" << container_type_;
+}
+
+template <typename Strategy>
+FastPositionIteratorAlgorithm<Strategy>::FastPositionIteratorAlgorithm() =
+    default;
+
+template <typename Strategy>
+void FastPositionIteratorAlgorithm<Strategy>::AssertOffsetInContainerIsValid()
+    const {
+#if DCHECK_IS_ON()
+  switch (container_type_) {
+    case kNullNode:
+      DCHECK(!child_before_position_);
+      DCHECK_EQ(offset_in_container_, kInvalidOffset);
+      return;
+    case kNoChildren:
+      DCHECK(!child_before_position_);
+      DCHECK(offset_in_container_ == 0 || offset_in_container_ == 1);
+      return;
+    case kCharacterData:
+    case kTextNode:
+      DCHECK(!child_before_position_);
+      DCHECK_LE(offset_in_container_,
+                To<CharacterData>(container_node_)->length());
+      return;
+    case kContainerNode:
+    case kUserSelectContainNode:
+      if (!child_before_position_) {
+        DCHECK(!offset_in_container_);
+        return;
+      }
+      if (offset_in_container_ == kInvalidOffset)
+        return;
+      DCHECK_EQ(offset_in_container_,
+                Strategy::Index(*child_before_position_) + 1);
+      return;
+  }
+  NOTREACHED() << " Invalid container_type_=" << container_type_;
+#endif
+}
+
+template <typename Strategy>
+void FastPositionIteratorAlgorithm<Strategy>::AssertOffsetStackIsValid() const {
+#if DCHECK_IS_ON()
+  const auto* it = offset_stack_.begin();
+  for (const Node& ancestor : Strategy::AncestorsOf(*container_node_)) {
+    if (it == offset_stack_.end())
+      break;
+    DCHECK_EQ(*it, Strategy::Index(ancestor)) << " " << ancestor;
+    ++it;
+  }
+#endif
+}
+
+template <typename Strategy>
+bool FastPositionIteratorAlgorithm<Strategy>::IsValid() const {
+  if (container_node_ &&
+      container_node_->GetDocument().DomTreeVersion() != dom_tree_version_)
+    return false;
+  AssertOffsetInContainerIsValid();
+  return true;
+}
+
+template <typename Strategy>
+Node* FastPositionIteratorAlgorithm<Strategy>::ChildAfterPosition() const {
+  DCHECK(container_type_ == kContainerNode ||
+         container_type_ == kUserSelectContainNode);
+  return child_before_position_ ? Strategy::NextSibling(*child_before_position_)
+                                : Strategy::FirstChild(*container_node_);
+}
+
+template <typename Strategy>
+bool FastPositionIteratorAlgorithm<Strategy>::HasChildren() const {
+  DCHECK(container_node_);
+  return Strategy::HasChildren(*container_node_);
+}
+
+template <typename Strategy>
+bool FastPositionIteratorAlgorithm<Strategy>::IgnoresChildren() const {
+  DCHECK(container_node_);
+  return EditingIgnoresContent(*container_node_);
+}
+
+template <typename Strategy>
+bool FastPositionIteratorAlgorithm<Strategy>::IsUserSelectContain() const {
+  DCHECK(container_node_);
+  return ::blink::IsUserSelectContain(*container_node_);
+}
+
+template <typename Strategy>
+void FastPositionIteratorAlgorithm<Strategy>::Decrement() {
+  AssertOffsetInContainerIsValid();
+  DecrementInternal();
+  AssertOffsetInContainerIsValid();
+}
+
+template <typename Strategy>
+void FastPositionIteratorAlgorithm<Strategy>::Increment() {
+  AssertOffsetInContainerIsValid();
+  IncrementInternal();
+  AssertOffsetInContainerIsValid();
+}
+
+template <typename Strategy>
+void FastPositionIteratorAlgorithm<Strategy>::DecrementInternal() {
+  DCHECK(IsValid());
+  switch (container_type_) {
+    case kNullNode:
+      return;
+    case kNoChildren:
+      if (!offset_in_container_ || !container_node_->GetLayoutObject())
+        return MoveToPreviousContainer();
+      offset_in_container_ = 0;
+      return;
+    case kCharacterData:
+      return MoveToPreviousContainer();
+    case kContainerNode:
+      if (!child_before_position_)
+        return MoveToPreviousContainer();
+
+      if (IsUserSelectContain()) {
+        if (!container_node_->GetLayoutObject())
+          return MoveToPreviousContainer();
+        if (!ChildAfterPosition()) {
+          container_type_ = kUserSelectContainNode;
+          return MoveToPreviousSkippingChildren();
+        }
+        // TODO(crbug.com/1132412): We should move to before children.
+      }
+
+      MoveOffsetInContainerBy(-1);
+      SetContainer(child_before_position_);
+      switch (container_type_) {
+        case kNoChildren:
+          child_before_position_ = nullptr;
+          PushThenSetOffset(IgnoresChildren() ? 1 : 0);
+          return;
+        case kCharacterData:
+        case kTextNode:
+          child_before_position_ = nullptr;
+          PushThenSetOffset(To<CharacterData>(container_node_)->length());
+          return;
+        case kContainerNode:
+          child_before_position_ = Strategy::LastChild(*container_node_);
+          PushThenSetOffset(kInvalidOffset);
+          return;
+        case kUserSelectContainNode:
+          // TODO(crbug.com/1132412): We should move to before children.
+          child_before_position_ = Strategy::FirstChild(*container_node_);
+          PushThenSetOffset(child_before_position_ ? 1 : 0);
+          return;
+        case kNullNode:
+          NOTREACHED() << " Unexpected container_type_=" << container_type_;
+          return;
+      }
+      NOTREACHED() << " Invalid container_type_=" << container_type_;
+      return;
+
+    case kTextNode:
+      if (!offset_in_container_)
+        return MoveToPreviousContainer();
+      offset_in_container_ =
+          PreviousGraphemeBoundaryOf(*container_node_, offset_in_container_);
+      return;
+    case kUserSelectContainNode:
+      // TODO(crbug.com/1132412): We should move to next container
+      // unconditionally.
+      if (!container_node_->GetLayoutObject())
+        return MoveToPreviousContainer();
+      return MoveToPreviousSkippingChildren();
+  }
+  NOTREACHED() << " Invalid container_type_=" << container_type_;
+}
+
+template <typename Strategy>
+void FastPositionIteratorAlgorithm<Strategy>::IncrementInternal() {
+  DCHECK(IsValid());
+  switch (container_type_) {
+    case kNullNode:
+      return;
+    case kNoChildren:
+      if (offset_in_container_ || !container_node_->GetLayoutObject() ||
+          !IgnoresChildren())
+        return MoveToNextContainer();
+      offset_in_container_ = 1;
+      return;
+    case kCharacterData:
+      return MoveToNextContainer();
+    case kContainerNode:
+      if (!ChildAfterPosition())
+        return MoveToNextContainer();
+      MoveOffsetInContainerBy(1);
+      child_before_position_ = ChildAfterPosition();
+      SetContainer(child_before_position_);
+      child_before_position_ = nullptr;
+      return PushThenSetOffset(0);
+    case kTextNode:
+      if (offset_in_container_ == To<Text>(container_node_)->length())
+        return MoveToNextContainer();
+      offset_in_container_ =
+          NextGraphemeBoundaryOf(*container_node_, offset_in_container_);
+      return;
+    case kUserSelectContainNode:
+      // TODO(crbug.com/1132412): We should move to next container
+      // unconditionally.
+      if (!container_node_->GetLayoutObject())
+        return MoveToNextContainer();
+      // Note: We should skip to next container after visiting first child,
+      // because `LastOffsetForPositionIterator()` returns 1.
+      if (child_before_position_ == Strategy::FirstChild(*container_node_))
+        return MoveToNextContainer();
+      return MoveToNextSkippingChildren();
+  }
+  NOTREACHED() << " Invalid container_type_=" << container_type_;
+}
+
+template <typename Strategy>
+void FastPositionIteratorAlgorithm<Strategy>::MoveToNextContainer() {
+  PopOffsetStack();
+  child_before_position_ = container_node_;
+  SetContainer(SelectableParentOf<Strategy>(*container_node_));
+}
+
+template <typename Strategy>
+void FastPositionIteratorAlgorithm<Strategy>::MoveToNextSkippingChildren() {
+  if (child_before_position_ == Strategy::LastChild(*container_node_)) {
+    PopOffsetStack();
+    child_before_position_ = container_node_;
+    return SetContainer(SelectableParentOf<Strategy>(*container_node_));
+  }
+  MoveOffsetInContainerBy(1);
+  child_before_position_ = ChildAfterPosition();
+}
+
+template <typename Strategy>
+void FastPositionIteratorAlgorithm<Strategy>::MoveToPreviousContainer() {
+  PopOffsetStack();
+  child_before_position_ = Strategy::PreviousSibling(*container_node_);
+  if (!child_before_position_) {
+    DCHECK(offset_in_container_ == kInvalidOffset || !offset_in_container_);
+    offset_in_container_ = 0;
+  }
+  SetContainer(SelectableParentOf<Strategy>(*container_node_));
+}
+
+template <typename Strategy>
+void FastPositionIteratorAlgorithm<Strategy>::MoveToPreviousSkippingChildren() {
+  if (!child_before_position_) {
+    PopOffsetStack();
+    child_before_position_ = Strategy::PreviousSibling(*container_node_);
+    return SetContainer(SelectableParentOf<Strategy>(*container_node_));
+  }
+  MoveOffsetInContainerBy(-1);
+  child_before_position_ = Strategy::PreviousSibling(*child_before_position_);
+  if (!child_before_position_) {
+    DCHECK(offset_in_container_ == kInvalidOffset || !offset_in_container_);
+    offset_in_container_ = 0;
+  }
+}
+
+template <typename Strategy>
+void FastPositionIteratorAlgorithm<Strategy>::SetContainer(Node* node) {
+  container_node_ = node;
+  container_type_ = ContainerToContainerType(node);
+  if (container_type_ == kNullNode) {
+    child_before_position_ = nullptr;
+    offset_in_container_ = kInvalidOffset;
+    container_type_ = kNullNode;
+  }
+}
+
+template <typename Strategy>
+PositionTemplate<Strategy>
+FastPositionIteratorAlgorithm<Strategy>::BeforeOrAfterPosition() const {
+  DCHECK(IsValid());
+  return IsBeforePosition() ? PositionType::BeforeNode(*container_node_)
+                            : PositionType::AfterNode(*container_node_);
+}
+
+template <typename Strategy>
+bool FastPositionIteratorAlgorithm<Strategy>::IsBeforePosition() const {
+  DCHECK(IsValid());
+  switch (container_type_) {
+    case kNullNode:
+    case kTextNode:
+      NOTREACHED() << " Unexpected container_type_=" << container_type_;
+      return false;
+    case kNoChildren:
+    case kCharacterData:
+    case kUserSelectContainNode:
+      return !offset_in_container_;
+    case kContainerNode:
+      return !child_before_position_;
+  }
+  NOTREACHED() << " Invalid container_type_=" << container_type_;
+  return false;
+}
+
+template <typename Strategy>
+PositionTemplate<Strategy>
+FastPositionIteratorAlgorithm<Strategy>::DeprecatedComputePosition() const {
+  DCHECK(IsValid());
+  switch (container_type_) {
+    case kNullNode:
+      return PositionType();
+    case kNoChildren:
+      if (IgnoresChildren())
+        return BeforeOrAfterPosition();
+      DCHECK(!offset_in_container_);
+      return PositionType(*container_node_, 0);
+    case kCharacterData:
+      if (IsA<Text>(*container_node_))
+        return PositionType(*container_node_, offset_in_container_);
+      return BeforeOrAfterPosition();
+    case kContainerNode:
+      if (Node* child_after_position = ChildAfterPosition()) {
+        if (EditingIgnoresContent(*Strategy::Parent(*child_after_position)))
+          return PositionType::BeforeNode(*container_node_);
+        EnsureOffsetInContainer();
+        return PositionType(*container_node_, offset_in_container_);
+      }
+      return PositionType::LastPositionInOrAfterNode(*container_node_);
+    case kTextNode:
+      return PositionType(*container_node_, offset_in_container_);
+    case kUserSelectContainNode:
+      return PositionType::LastPositionInOrAfterNode(*container_node_);
+  }
+  NOTREACHED() << " Invalid container_type_=" << container_type_;
+}
+
+template <typename Strategy>
+PositionTemplate<Strategy>
+FastPositionIteratorAlgorithm<Strategy>::ComputePosition() const {
+  DCHECK(IsValid());
+  switch (container_type_) {
+    case kNullNode:
+      return PositionType();
+    case kNoChildren:
+      return BeforeOrAfterPosition();
+    case kCharacterData:
+      if (IsA<Text>(*container_node_))
+        return PositionType(*container_node_, offset_in_container_);
+      return BeforeOrAfterPosition();
+    case kContainerNode:
+      if (Node* child_after_position = ChildAfterPosition()) {
+        EnsureOffsetInContainer();
+        return PositionType(*container_node_, offset_in_container_);
+      }
+      if (IsUserSelectContain())
+        return BeforeOrAfterPosition();
+      return PositionType::LastPositionInOrAfterNode(*container_node_);
+    case kTextNode:
+      return PositionType(*container_node_, offset_in_container_);
+    case kUserSelectContainNode:
+      return BeforeOrAfterPosition();
+  }
+  NOTREACHED() << " Invalid container_type_=" << container_type_;
+}
+
+template <typename Strategy>
+int FastPositionIteratorAlgorithm<Strategy>::OffsetInTextNode() const {
+  DCHECK(IsValid());
+  //`VisiblePositionTest.PlaceholderBRWithCollapsedSpace` calls this function
+  // with `kCharacterData`.
+  DCHECK(container_type_ == kTextNode || container_type_ == kCharacterData)
+      << container_type_;
+  DCHECK(IsA<Text>(container_node_)) << container_node_;
+  return base::saturated_cast<int>(offset_in_container_);
+}
+
+template <typename Strategy>
+bool FastPositionIteratorAlgorithm<Strategy>::AtStart() const {
+  DCHECK(IsValid());
+  if (!container_node_)
+    return true;
+  return !Strategy::Parent(*container_node_) && AtStartOfNode();
+}
+
+template <typename Strategy>
+bool FastPositionIteratorAlgorithm<Strategy>::AtEnd() const {
+  DCHECK(IsValid());
+  if (!container_node_)
+    return true;
+  return !Strategy::Parent(*container_node_) && AtEndOfNode();
+}
+
+template <typename Strategy>
+bool FastPositionIteratorAlgorithm<Strategy>::AtStartOfNode() const {
+  DCHECK(IsValid());
+  switch (container_type_) {
+    case kNullNode:
+      return true;
+    case kContainerNode:
+      return !child_before_position_;
+    case kNoChildren:
+    case kCharacterData:
+    case kTextNode:
+      return !offset_in_container_;
+    case kUserSelectContainNode:
+      return !child_before_position_;
+  }
+  NOTREACHED() << " Invalid container_type_=" << container_type_;
+}
+
+template <typename Strategy>
+bool FastPositionIteratorAlgorithm<Strategy>::AtEndOfNode() const {
+  DCHECK(IsValid());
+  switch (container_type_) {
+    case kNullNode:
+      return true;
+    case kContainerNode:
+      return !ChildAfterPosition();
+    case kNoChildren:
+      return !IgnoresChildren() || offset_in_container_;
+    case kCharacterData:
+    case kTextNode:
+      return offset_in_container_ ==
+             To<CharacterData>(container_node_)->length();
+    case kUserSelectContainNode:
+      return HasChildren() || !ChildAfterPosition();
+  }
+  NOTREACHED() << " Invalid container_type_=" << container_type_;
+}
+
+template <typename Strategy>
+void FastPositionIteratorAlgorithm<Strategy>::EnsureOffsetInContainer() const {
+  DCHECK(container_type_ == kContainerNode ||
+         container_type_ == kUserSelectContainNode);
+  if (offset_in_container_ != kInvalidOffset)
+    return;
+  offset_in_container_ = Strategy::Index(*child_before_position_) + 1;
+}
+
+template <typename Strategy>
+void FastPositionIteratorAlgorithm<Strategy>::MoveOffsetInContainerBy(
+    int delta) {
+  DCHECK(delta == 1 || delta == -1) << delta;
+  if (offset_in_container_ == kInvalidOffset)
+    return;
+  offset_in_container_ += delta;
+}
+
+template <typename Strategy>
+void FastPositionIteratorAlgorithm<Strategy>::PopOffsetStack() {
+  if (offset_stack_.empty()) {
+    offset_in_container_ = kInvalidOffset;
+    return;
+  }
+  offset_in_container_ = offset_stack_.back();
+  offset_stack_.pop_back();
+}
+
+template <typename Strategy>
+void FastPositionIteratorAlgorithm<Strategy>::PushThenSetOffset(
+    unsigned offset_in_container) {
+  offset_stack_.push_back(offset_in_container_);
+  offset_in_container_ = offset_in_container;
+  AssertOffsetInContainerIsValid();
+}
+
+template class CORE_TEMPLATE_EXPORT
+    FastPositionIteratorAlgorithm<EditingStrategy>;
+template class CORE_TEMPLATE_EXPORT
+    FastPositionIteratorAlgorithm<EditingInFlatTreeStrategy>;
+
+// ---
+
+template <typename Strategy>
+PositionIteratorAlgorithm<Strategy>::PositionIteratorAlgorithm(
+    const PositionTemplate<Strategy>& position)
+    : fast_(!RuntimeEnabledFeatures::FastPositionIteratorEnabled()
+                ? PositionTemplate<Strategy>()
+                : position),
+
+      slow_(RuntimeEnabledFeatures::FastPositionIteratorEnabled()
+                ? PositionTemplate<Strategy>()
+                : position) {}
+
+template <typename Strategy>
+PositionIteratorAlgorithm<Strategy>::PositionIteratorAlgorithm(
+    const PositionIteratorAlgorithm& other)
+    : fast_(other.fast_), slow_(other.slow_) {}
+
+template <typename Strategy>
+PositionIteratorAlgorithm<Strategy>&
+PositionIteratorAlgorithm<Strategy>::operator=(
+    const PositionIteratorAlgorithm& other) {
+  fast_ = other.fast_;
+  slow_ = other.slow_;
+  return *this;
+}
+
+template <typename Strategy>
+PositionTemplate<Strategy>
+PositionIteratorAlgorithm<Strategy>::DeprecatedComputePosition() const {
+  if (!RuntimeEnabledFeatures::FastPositionIteratorEnabled())
+    return slow_.DeprecatedComputePosition();
+  return fast_.DeprecatedComputePosition();
+}
+
+template <typename Strategy>
+PositionTemplate<Strategy>
+PositionIteratorAlgorithm<Strategy>::ComputePosition() const {
+  if (!RuntimeEnabledFeatures::FastPositionIteratorEnabled())
+    return slow_.ComputePosition();
+  return fast_.ComputePosition();
+}
+
+template <typename Strategy>
+void PositionIteratorAlgorithm<Strategy>::Decrement() {
+  if (!RuntimeEnabledFeatures::FastPositionIteratorEnabled())
+    return slow_.Decrement();
+  fast_.Decrement();
+}
+
+template <typename Strategy>
+void PositionIteratorAlgorithm<Strategy>::Increment() {
+  if (!RuntimeEnabledFeatures::FastPositionIteratorEnabled())
+    return slow_.Increment();
+  fast_.Increment();
+}
+
+template <typename Strategy>
+Node* PositionIteratorAlgorithm<Strategy>::GetNode() const {
+  if (!RuntimeEnabledFeatures::FastPositionIteratorEnabled())
+    return slow_.GetNode();
+  return fast_.GetNode();
+}
+
+template <typename Strategy>
+int PositionIteratorAlgorithm<Strategy>::OffsetInTextNode() const {
+  if (!RuntimeEnabledFeatures::FastPositionIteratorEnabled())
+    return slow_.OffsetInTextNode();
+  return fast_.OffsetInTextNode();
+}
+
+template <typename Strategy>
+bool PositionIteratorAlgorithm<Strategy>::AtStart() const {
+  if (!RuntimeEnabledFeatures::FastPositionIteratorEnabled())
+    return slow_.AtStart();
+  return fast_.AtStart();
+}
+
+template <typename Strategy>
+bool PositionIteratorAlgorithm<Strategy>::AtEnd() const {
+  if (!RuntimeEnabledFeatures::FastPositionIteratorEnabled())
+    return slow_.AtEnd();
+  return fast_.AtEnd();
+}
+
+template <typename Strategy>
+bool PositionIteratorAlgorithm<Strategy>::AtStartOfNode() const {
+  if (!RuntimeEnabledFeatures::FastPositionIteratorEnabled())
+    return slow_.AtStartOfNode();
+  return fast_.AtStartOfNode();
+}
+
+template <typename Strategy>
+bool PositionIteratorAlgorithm<Strategy>::AtEndOfNode() const {
+  if (!RuntimeEnabledFeatures::FastPositionIteratorEnabled())
+    return slow_.AtEndOfNode();
+  return fast_.AtEndOfNode();
+}
+
 template class CORE_TEMPLATE_EXPORT PositionIteratorAlgorithm<EditingStrategy>;
 template class CORE_TEMPLATE_EXPORT
     PositionIteratorAlgorithm<EditingInFlatTreeStrategy>;
diff --git a/third_party/blink/renderer/core/editing/position_iterator.h b/third_party/blink/renderer/core/editing/position_iterator.h
index dd34915..dc9371a1 100644
--- a/third_party/blink/renderer/core/editing/position_iterator.h
+++ b/third_party/blink/renderer/core/editing/position_iterator.h
@@ -39,11 +39,11 @@
 // Conversion to Position is O(1).
 // PositionIteratorAlgorithm must be used without DOM tree change.
 template <typename Strategy>
-class PositionIteratorAlgorithm {
+class SlowPositionIteratorAlgorithm {
   STACK_ALLOCATED();
 
  public:
-  explicit PositionIteratorAlgorithm(const PositionTemplate<Strategy>&);
+  explicit SlowPositionIteratorAlgorithm(const PositionTemplate<Strategy>&);
 
   // Since |deprecatedComputePosition()| is slow, new code should use
   // |computePosition()| instead.
@@ -93,6 +93,153 @@
 };
 
 extern template class CORE_EXTERN_TEMPLATE_EXPORT
+    SlowPositionIteratorAlgorithm<EditingStrategy>;
+extern template class CORE_EXTERN_TEMPLATE_EXPORT
+    SlowPositionIteratorAlgorithm<EditingInFlatTreeStrategy>;
+
+using SlowPositionIterator = SlowPositionIteratorAlgorithm<EditingStrategy>;
+using SlowPositionIteratorInFlatTree =
+    SlowPositionIteratorAlgorithm<EditingInFlatTreeStrategy>;
+
+// ----
+
+// A Position iterator with nearly constant-time
+// increment, decrement, and several predicates on the Position it is at.
+// Conversion from Position is O(n) in the depth.
+// Conversion to Position is O(1).
+// PositionIteratorAlgorithm must be used without DOM tree change.
+template <typename Strategy>
+class FastPositionIteratorAlgorithm {
+  STACK_ALLOCATED();
+
+ public:
+  using PositionType = PositionTemplate<Strategy>;
+
+  // When `position` is `kOffsetInAnchor`. It takes O(n) where n is an offset
+  // in container node.
+  explicit FastPositionIteratorAlgorithm(const PositionType& position);
+  FastPositionIteratorAlgorithm();
+
+  // Since `DeprecatedComputePosition()` is slow, new code should use
+  // `ComputePosition()` instead.
+  PositionType DeprecatedComputePosition() const;
+  PositionType ComputePosition() const;
+
+  // `Decrement()` takes O(1).
+  void Decrement();
+  // `Increment()` takes O(1).
+  void Increment();
+
+  Node* GetNode() const { return container_node_; }
+  int OffsetInTextNode() const;
+
+  bool AtStart() const;
+  bool AtEnd() const;
+  bool AtStartOfNode() const;
+  bool AtEndOfNode() const;
+
+ private:
+  enum ContainerType {
+    kNullNode,
+
+    kNoChildren,
+    kCharacterData,
+    kContainerNode,
+    kTextNode,
+    kUserSelectContainNode,
+  };
+
+  static constexpr unsigned kInvalidOffset = static_cast<unsigned>(-1);
+
+  static ContainerType ContainerToContainerType(const Node* node);
+
+  void Initialize(const PositionType& position);
+
+  void AssertOffsetInContainerIsValid() const;
+  void AssertOffsetStackIsValid() const;
+  bool IsValid() const;
+
+  Node* ChildAfterPosition() const;
+  bool HasChildren() const;
+  bool IgnoresChildren() const;
+  bool IsUserSelectContain() const;
+
+  void IncrementInternal();
+  void DecrementInternal();
+
+  void MoveToNextContainer();
+  void MoveToNextSkippingChildren();
+  void MoveToPreviousContainer();
+  void MoveToPreviousSkippingChildren();
+
+  void SetContainer(Node* node);
+
+  // Returns `PositionType::AfterNode(*container_node_)` if
+  // `offset_in_container_` is non-zero, otherwise `BeforeNode()`.
+  PositionType BeforeOrAfterPosition() const;
+  bool IsBeforePosition() const;
+
+  void EnsureOffsetInContainer() const;
+  void MoveOffsetInContainerBy(int delta);
+  void PopOffsetStack();
+  void PushThenSetOffset(unsigned offset_in_container);
+
+  // We representation a position as same as`RangeBoundaryPoint`.
+  Node* container_node_ = nullptr;
+  Node* child_before_position_ = nullptr;
+  uint64_t dom_tree_version_ = 0;
+  mutable unsigned offset_in_container_ = kInvalidOffset;
+
+  Vector<unsigned> offset_stack_;
+  ContainerType container_type_ = kNullNode;
+};
+
+extern template class CORE_EXTERN_TEMPLATE_EXPORT
+    FastPositionIteratorAlgorithm<EditingStrategy>;
+extern template class CORE_EXTERN_TEMPLATE_EXPORT
+    FastPositionIteratorAlgorithm<EditingInFlatTreeStrategy>;
+
+using FastPositionIterator = FastPositionIteratorAlgorithm<EditingStrategy>;
+using FastPositionIteratorInFlatTree =
+    FastPositionIteratorAlgorithm<EditingInFlatTreeStrategy>;
+
+// --
+
+// The switcher of `FastPositionIterator` and `SlowPositionIterator` based on
+// `RuntimeEnabledFeatures::FastPositionItertorEnabled()`.
+template <typename Strategy>
+class PositionIteratorAlgorithm {
+  STACK_ALLOCATED();
+
+ public:
+  explicit PositionIteratorAlgorithm(
+      const PositionTemplate<Strategy>& position);
+
+  PositionIteratorAlgorithm(const PositionIteratorAlgorithm<Strategy>& other);
+
+  PositionIteratorAlgorithm& operator=(
+      const PositionIteratorAlgorithm<Strategy>& other);
+
+  PositionTemplate<Strategy> DeprecatedComputePosition() const;
+  PositionTemplate<Strategy> ComputePosition() const;
+
+  void Increment();
+  void Decrement();
+
+  Node* GetNode() const;
+  int OffsetInTextNode() const;
+
+  bool AtStart() const;
+  bool AtEnd() const;
+  bool AtStartOfNode() const;
+  bool AtEndOfNode() const;
+
+ private:
+  FastPositionIteratorAlgorithm<Strategy> fast_;
+  SlowPositionIteratorAlgorithm<Strategy> slow_;
+};
+
+extern template class CORE_EXTERN_TEMPLATE_EXPORT
     PositionIteratorAlgorithm<EditingStrategy>;
 extern template class CORE_EXTERN_TEMPLATE_EXPORT
     PositionIteratorAlgorithm<EditingInFlatTreeStrategy>;
diff --git a/third_party/blink/renderer/core/exported/web_view_impl.cc b/third_party/blink/renderer/core/exported/web_view_impl.cc
index f5305699..6db951a 100644
--- a/third_party/blink/renderer/core/exported/web_view_impl.cc
+++ b/third_party/blink/renderer/core/exported/web_view_impl.cc
@@ -3302,8 +3302,6 @@
     mojom::blink::PrerenderPageActivationParamsPtr
         prerender_page_activation_params,
     ActivatePrerenderedPageCallback callback) {
-  DCHECK(features::IsPrerender2Enabled());
-
   // From here all new documents will have prerendering false.
   GetPage()->SetIsPrerendering(false);
 
diff --git a/third_party/blink/renderer/core/frame/frame_test_helpers.cc b/third_party/blink/renderer/core/frame/frame_test_helpers.cc
index a975cfe..db1c5f9 100644
--- a/third_party/blink/renderer/core/frame/frame_test_helpers.cc
+++ b/third_party/blink/renderer/core/frame/frame_test_helpers.cc
@@ -922,17 +922,16 @@
   GetWidgetInputHandlerManager()->DispatchEvent(
       std::make_unique<WebCoalescedInputEvent>(event.Clone(),
                                                ui::LatencyInfo()),
-      base::BindOnce(
-          [](WeakMember<TestWebFrameWidget> widget,
-             mojom::blink::InputEventResultSource, const ui::LatencyInfo&,
-             mojom::blink::InputEventResultState,
+      WTF::BindOnce(
+          [](TestWebFrameWidget* widget, mojom::blink::InputEventResultSource,
+             const ui::LatencyInfo&, mojom::blink::InputEventResultState,
              mojom::blink::DidOverscrollParamsPtr overscroll,
              mojom::blink::TouchActionOptionalPtr,
              mojom::blink::ScrollResultDataPtr) {
             if (widget)
               widget->last_overscroll_ = std::move(overscroll);
           },
-          this));
+          WrapWeakPersistent(this)));
   FlushInputHandlerTasks();
 }
 
diff --git a/third_party/blink/renderer/core/frame/local_frame_back_forward_cache_test.cc b/third_party/blink/renderer/core/frame/local_frame_back_forward_cache_test.cc
index f110e37..361b07ee 100644
--- a/third_party/blink/renderer/core/frame/local_frame_back_forward_cache_test.cc
+++ b/third_party/blink/renderer/core/frame/local_frame_back_forward_cache_test.cc
@@ -21,6 +21,7 @@
 #include "third_party/blink/renderer/core/testing/fake_local_frame_host.h"
 #include "third_party/blink/renderer/platform/scheduler/public/event_loop.h"
 #include "third_party/blink/renderer/platform/testing/runtime_enabled_features_test_helpers.h"
+#include "third_party/blink/renderer/platform/wtf/functional.h"
 
 namespace blink {
 
@@ -109,12 +110,12 @@
   //   2) C++ closure
   // The case 1) should never happen when the frame is in bfcache. On the other
   // hand, the case 2) can happen. See https://crbug.com/994169
-  frame->DomWindow()->GetAgent()->event_loop()->EnqueueMicrotask(base::BindOnce(
+  frame->DomWindow()->GetAgent()->event_loop()->EnqueueMicrotask(WTF::BindOnce(
       [](LocalFrame* frame) {
         ClassicScript::CreateUnspecifiedScript("console.log('hi');")
             ->RunScript(frame->DomWindow());
       },
-      frame));
+      WrapWeakPersistent(frame)));
   frame_host.WaitUntilEvictedFromBackForwardCache();
 }
 
diff --git a/third_party/blink/renderer/core/frame/root_frame_viewport_test.cc b/third_party/blink/renderer/core/frame/root_frame_viewport_test.cc
index 2d4cb9a..73f13d9 100644
--- a/third_party/blink/renderer/core/frame/root_frame_viewport_test.cc
+++ b/third_party/blink/renderer/core/frame/root_frame_viewport_test.cc
@@ -514,24 +514,26 @@
   root_frame_viewport->SetScrollOffset(
       ScrollOffset(40, 40), mojom::blink::ScrollType::kUser,
       mojom::blink::ScrollBehavior::kInstant,
-      ScrollableArea::ScrollCallback(base::BindOnce(
+      ScrollableArea::ScrollCallback(WTF::BindOnce(
           [](ScrollableArea* visual_viewport, ScrollableArea* layout_viewport) {
             EXPECT_EQ(ScrollOffset(40, 40), visual_viewport->GetScrollOffset());
             EXPECT_EQ(ScrollOffset(0, 0), layout_viewport->GetScrollOffset());
           },
-          visual_viewport, layout_viewport)));
+          WrapWeakPersistent(visual_viewport),
+          WrapWeakPersistent(layout_viewport))));
   EXPECT_EQ(ScrollOffset(40, 40), visual_viewport->GetScrollOffset());
   EXPECT_EQ(ScrollOffset(0, 0), layout_viewport->GetScrollOffset());
 
   root_frame_viewport->SetScrollOffset(
       ScrollOffset(60, 60), mojom::blink::ScrollType::kProgrammatic,
       mojom::blink::ScrollBehavior::kInstant,
-      ScrollableArea::ScrollCallback(base::BindOnce(
+      ScrollableArea::ScrollCallback(WTF::BindOnce(
           [](ScrollableArea* visual_viewport, ScrollableArea* layout_viewport) {
             EXPECT_EQ(ScrollOffset(50, 50), visual_viewport->GetScrollOffset());
             EXPECT_EQ(ScrollOffset(10, 10), layout_viewport->GetScrollOffset());
           },
-          visual_viewport, layout_viewport)));
+          WrapWeakPersistent(visual_viewport),
+          WrapWeakPersistent(layout_viewport))));
   EXPECT_EQ(ScrollOffset(50, 50), visual_viewport->GetScrollOffset());
   EXPECT_EQ(ScrollOffset(10, 10), layout_viewport->GetScrollOffset());
 }
@@ -594,12 +596,13 @@
   root_frame_viewport->DistributeScrollBetweenViewports(
       ScrollOffset(60, 60), mojom::blink::ScrollType::kProgrammatic,
       mojom::blink::ScrollBehavior::kSmooth, RootFrameViewport::kVisualViewport,
-      ScrollableArea::ScrollCallback(base::BindOnce(
+      ScrollableArea::ScrollCallback(WTF::BindOnce(
           [](ScrollableArea* visual_viewport, ScrollableArea* layout_viewport) {
             EXPECT_EQ(ScrollOffset(50, 50), visual_viewport->GetScrollOffset());
             EXPECT_EQ(ScrollOffset(10, 10), layout_viewport->GetScrollOffset());
           },
-          visual_viewport, layout_viewport)));
+          WrapWeakPersistent(visual_viewport),
+          WrapWeakPersistent(layout_viewport))));
   root_frame_viewport->UpdateCompositorScrollAnimations();
   root_frame_viewport->ServiceScrollAnimations(1);
   EXPECT_EQ(ScrollOffset(0, 0), visual_viewport->GetScrollOffset());
diff --git a/third_party/blink/renderer/core/layout/svg/svg_hit_test_perftest.cc b/third_party/blink/renderer/core/layout/svg/svg_hit_test_perftest.cc
index 5a8579d..2155eb6 100644
--- a/third_party/blink/renderer/core/layout/svg/svg_hit_test_perftest.cc
+++ b/third_party/blink/renderer/core/layout/svg/svg_hit_test_perftest.cc
@@ -87,18 +87,18 @@
 
   RunTest("HandleMouseMoveEvent",
           WTF::BindRepeating(
-              [](EventHandler& event_handler) {
+              [](EventHandler* event_handler) {
                 WebMouseEvent mouse_move_event(
                     WebMouseEvent::Type::kMouseMove, gfx::PointF(1, 1),
                     gfx::PointF(1, 1), WebPointerProperties::Button::kNoButton,
                     0, WebInputEvent::Modifiers::kNoModifiers,
                     WebInputEvent::GetStaticTimeStampForTests());
                 mouse_move_event.SetFrameScale(1);
-                event_handler.HandleMouseMoveEvent(mouse_move_event,
-                                                   Vector<WebMouseEvent>(),
-                                                   Vector<WebMouseEvent>());
+                event_handler->HandleMouseMoveEvent(mouse_move_event,
+                                                    Vector<WebMouseEvent>(),
+                                                    Vector<WebMouseEvent>());
               },
-              std::ref(event_handler)));
+              WrapWeakPersistent(&event_handler)));
 }
 
 TEST_F(SvgHitTestPerfTest, IntersectsClipPath) {
diff --git a/third_party/blink/renderer/core/loader/resource_load_observer_for_frame_test.cc b/third_party/blink/renderer/core/loader/resource_load_observer_for_frame_test.cc
index 86e1b6ce..767e950 100644
--- a/third_party/blink/renderer/core/loader/resource_load_observer_for_frame_test.cc
+++ b/third_party/blink/renderer/core/loader/resource_load_observer_for_frame_test.cc
@@ -19,6 +19,7 @@
 #include "third_party/blink/renderer/platform/loader/testing/mock_resource.h"
 #include "third_party/blink/renderer/platform/loader/testing/test_resource_fetcher_properties.h"
 #include "third_party/blink/renderer/platform/testing/unit_test_helpers.h"
+#include "third_party/blink/renderer/platform/wtf/functional.h"
 
 namespace blink {
 
@@ -33,12 +34,12 @@
       *MakeGarbageCollected<TestResourceFetcherProperties>());
 
   testing::StrictMock<MockContentSecurityNotifier> mock_notifier;
-  base::ScopedClosureRunner clear_binder(base::BindOnce(
+  base::ScopedClosureRunner clear_binder(WTF::BindOnce(
       [](LocalFrame* frame) {
         frame->Client()->GetBrowserInterfaceBroker().SetBinderForTesting(
             mojom::blink::ContentSecurityNotifier::Name_, {});
       },
-      &frame));
+      WrapWeakPersistent(&frame)));
 
   frame.Client()->GetBrowserInterfaceBroker().SetBinderForTesting(
       mojom::blink::ContentSecurityNotifier::Name_,
diff --git a/third_party/blink/renderer/core/navigation_api/navigation_api.cc b/third_party/blink/renderer/core/navigation_api/navigation_api.cc
index 821b9b6..6aa7f10 100644
--- a/third_party/blink/renderer/core/navigation_api/navigation_api.cc
+++ b/third_party/blink/renderer/core/navigation_api/navigation_api.cc
@@ -776,10 +776,14 @@
   init->setNavigationType(navigation_type);
 
   SerializedScriptValue* destination_state = nullptr;
-  if (params->destination_item)
+  if (params->destination_item) {
     destination_state = params->destination_item->GetNavigationApiState();
-  else if (ongoing_navigation_)
+  } else if (ongoing_navigation_) {
     destination_state = ongoing_navigation_->GetSerializedState();
+  } else if (navigation_type == "reload") {
+    HistoryItem* current_item = window_->document()->Loader()->GetHistoryItem();
+    destination_state = current_item->GetNavigationApiState();
+  }
   NavigationDestination* destination =
       MakeGarbageCollected<NavigationDestination>(
           params->url, params->event_type != NavigateEventType::kCrossDocument,
diff --git a/third_party/blink/renderer/core/paint/ng/ng_highlight_painter.cc b/third_party/blink/renderer/core/paint/ng/ng_highlight_painter.cc
index e47864ea..a640b7d 100644
--- a/third_party/blink/renderer/core/paint/ng/ng_highlight_painter.cc
+++ b/third_party/blink/renderer/core/paint/ng/ng_highlight_painter.cc
@@ -850,7 +850,8 @@
 
   // If the new ::spelling-error and ::grammar-error pseudos are not enabled,
   // use the old marker-based decorations for now.
-  if (!RuntimeEnabledFeatures::CSSSpellingGrammarErrorsEnabled()) {
+  if (!RuntimeEnabledFeatures::CSSSpellingGrammarErrorsEnabled() &&
+      !RuntimeEnabledFeatures::CSSPaintingForSpellingGrammarErrorsEnabled()) {
     return DocumentMarkerPainter::PaintDocumentMarker(
         paint_info_, box_origin_, originating_style_, type,
         MarkerRectForForeground(fragment_item_, text, paint_start_offset,
diff --git a/third_party/blink/renderer/modules/mediastream/user_media_client_test.cc b/third_party/blink/renderer/modules/mediastream/user_media_client_test.cc
index 777c219..2774c92 100644
--- a/third_party/blink/renderer/modules/mediastream/user_media_client_test.cc
+++ b/third_party/blink/renderer/modules/mediastream/user_media_client_test.cc
@@ -49,6 +49,7 @@
 #include "third_party/blink/renderer/platform/mediastream/media_stream_descriptor.h"
 #include "third_party/blink/renderer/platform/mediastream/media_stream_track_platform.h"
 #include "third_party/blink/renderer/platform/testing/io_task_runner_testing_platform_support.h"
+#include "third_party/blink/renderer/platform/wtf/functional.h"
 #include "third_party/blink/renderer/platform/wtf/text/wtf_string.h"
 #include "ui/display/screen_info.h"
 
@@ -393,9 +394,17 @@
       RequestState* state)
       : UserMediaProcessor(
             frame,
-            base::BindRepeating(
-                &UserMediaProcessorUnderTest::media_devices_dispatcher,
-                base::Unretained(this)),
+            WTF::BindRepeating(
+                // Note: this uses a lambda because binding a non-static method
+                // with a weak receiver triggers special cancellation handling,
+                // which cannot handle non-void return types.
+                [](UserMediaProcessorUnderTest* processor)
+                    -> blink::mojom::blink::MediaDevicesDispatcherHost* {
+                  // In a test, `processor` should always be kept alive.
+                  CHECK(processor);
+                  return processor->media_devices_dispatcher_.get();
+                },
+                WrapWeakPersistent(this)),
             blink::scheduler::GetSingleThreadTaskRunnerForTesting()),
         media_stream_device_observer_(std::move(media_stream_device_observer)),
         media_devices_dispatcher_(std::move(media_devices_dispatcher)),
@@ -403,11 +412,6 @@
     SetMediaStreamDeviceObserverForTesting(media_stream_device_observer_.get());
   }
 
-  blink::mojom::blink::MediaDevicesDispatcherHost* media_devices_dispatcher()
-      const {
-    return media_devices_dispatcher_.get();
-  }
-
   MockMediaStreamVideoCapturerSource* last_created_video_source() const {
     return video_source_;
   }
diff --git a/third_party/blink/renderer/modules/peerconnection/rtc_peer_connection_test.cc b/third_party/blink/renderer/modules/peerconnection/rtc_peer_connection_test.cc
index 8ed6cd6..06f3f02a 100644
--- a/third_party/blink/renderer/modules/peerconnection/rtc_peer_connection_test.cc
+++ b/third_party/blink/renderer/modules/peerconnection/rtc_peer_connection_test.cc
@@ -40,6 +40,7 @@
 #include "third_party/blink/renderer/platform/peerconnection/rtc_rtp_sender_platform.h"
 #include "third_party/blink/renderer/platform/peerconnection/rtc_session_description_platform.h"
 #include "third_party/blink/renderer/platform/testing/testing_platform_support.h"
+#include "third_party/blink/renderer/platform/wtf/functional.h"
 #include "third_party/webrtc/api/rtc_error.h"
 #include "v8/include/v8.h"
 
@@ -279,13 +280,13 @@
       return;
     case AsyncOperationAction::kResolve:
       scheduler::GetSequencedTaskRunnerForTesting()->PostTask(
-          FROM_HERE,
-          base::BindOnce(&CompleteRequest<RequestType>, request, true));
+          FROM_HERE, WTF::BindOnce(&CompleteRequest<RequestType>,
+                                   WrapWeakPersistent(request), true));
       return;
     case AsyncOperationAction::kReject:
       scheduler::GetSequencedTaskRunnerForTesting()->PostTask(
-          FROM_HERE,
-          base::BindOnce(&CompleteRequest<RequestType>, request, false));
+          FROM_HERE, WTF::BindOnce(&CompleteRequest<RequestType>,
+                                   WrapWeakPersistent(request), false));
       return;
   }
 }
diff --git a/third_party/blink/renderer/modules/webgpu/gpu_buffer.cc b/third_party/blink/renderer/modules/webgpu/gpu_buffer.cc
index 723c22b..e28beea 100644
--- a/third_party/blink/renderer/modules/webgpu/gpu_buffer.cc
+++ b/third_party/blink/renderer/modules/webgpu/gpu_buffer.cc
@@ -118,7 +118,8 @@
 
 // static
 GPUBuffer* GPUBuffer::Create(GPUDevice* device,
-                             const GPUBufferDescriptor* webgpu_desc) {
+                             const GPUBufferDescriptor* webgpu_desc,
+                             ExceptionState& exception_state) {
   DCHECK(device);
 
   std::string label;
@@ -133,9 +134,21 @@
     dawn_desc.size = std::min(dawn_desc.size, kGuaranteedBufferOOMSize);
   }
 
-  GPUBuffer* buffer = MakeGarbageCollected<GPUBuffer>(
-      device, dawn_desc.size,
-      device->GetProcs().deviceCreateBuffer(device->GetHandle(), &dawn_desc));
+  WGPUBuffer wgpuBuffer =
+      device->GetProcs().deviceCreateBuffer(device->GetHandle(), &dawn_desc);
+  // dawn_wire::client will return nullptr when mappedAtCreation == true and
+  // dawn_wire::client fails to allocate memory for initializing an active
+  // buffer mapping, which is required by latest WebGPU SPEC.
+  if (wgpuBuffer == nullptr) {
+    DCHECK(dawn_desc.mappedAtCreation);
+    exception_state.ThrowRangeError(
+        "createBuffer failed, size is too large for the implementation when "
+        "mappedAtCreation == true");
+    return nullptr;
+  }
+
+  GPUBuffer* buffer =
+      MakeGarbageCollected<GPUBuffer>(device, dawn_desc.size, wgpuBuffer);
   if (webgpu_desc->hasLabel())
     buffer->setLabel(webgpu_desc->label());
 
diff --git a/third_party/blink/renderer/modules/webgpu/gpu_buffer.h b/third_party/blink/renderer/modules/webgpu/gpu_buffer.h
index f3cb7b0..2f2987b8 100644
--- a/third_party/blink/renderer/modules/webgpu/gpu_buffer.h
+++ b/third_party/blink/renderer/modules/webgpu/gpu_buffer.h
@@ -26,7 +26,8 @@
 
  public:
   static GPUBuffer* Create(GPUDevice* device,
-                           const GPUBufferDescriptor* webgpu_desc);
+                           const GPUBufferDescriptor* webgpu_desc,
+                           ExceptionState& exception_state);
   GPUBuffer(GPUDevice* device, uint64_t size, WGPUBuffer buffer);
   ~GPUBuffer() override;
 
diff --git a/third_party/blink/renderer/modules/webgpu/gpu_device.cc b/third_party/blink/renderer/modules/webgpu/gpu_device.cc
index 15c8456..32b92b7 100644
--- a/third_party/blink/renderer/modules/webgpu/gpu_device.cc
+++ b/third_party/blink/renderer/modules/webgpu/gpu_device.cc
@@ -400,8 +400,9 @@
   FlushNow();
 }
 
-GPUBuffer* GPUDevice::createBuffer(const GPUBufferDescriptor* descriptor) {
-  return GPUBuffer::Create(this, descriptor);
+GPUBuffer* GPUDevice::createBuffer(const GPUBufferDescriptor* descriptor,
+                                   ExceptionState& exception_state) {
+  return GPUBuffer::Create(this, descriptor, exception_state);
 }
 
 GPUTexture* GPUDevice::createTexture(const GPUTextureDescriptor* descriptor,
diff --git a/third_party/blink/renderer/modules/webgpu/gpu_device.h b/third_party/blink/renderer/modules/webgpu/gpu_device.h
index 318be9b3..7f6b363 100644
--- a/third_party/blink/renderer/modules/webgpu/gpu_device.h
+++ b/third_party/blink/renderer/modules/webgpu/gpu_device.h
@@ -85,7 +85,8 @@
 
   void destroy(ScriptState* script_state);
 
-  GPUBuffer* createBuffer(const GPUBufferDescriptor* descriptor);
+  GPUBuffer* createBuffer(const GPUBufferDescriptor* descriptor,
+                          ExceptionState& exception_state);
   GPUTexture* createTexture(const GPUTextureDescriptor* descriptor,
                             ExceptionState& exception_state);
   GPUTexture* experimentalImportTexture(HTMLCanvasElement* canvas,
diff --git a/third_party/blink/renderer/modules/webgpu/gpu_device.idl b/third_party/blink/renderer/modules/webgpu/gpu_device.idl
index f100b89b..f7e32f1b 100644
--- a/third_party/blink/renderer/modules/webgpu/gpu_device.idl
+++ b/third_party/blink/renderer/modules/webgpu/gpu_device.idl
@@ -17,7 +17,7 @@
 
     [CallWith=ScriptState] void destroy();
 
-    GPUBuffer createBuffer(GPUBufferDescriptor descriptor);
+    [RaisesException] GPUBuffer createBuffer(GPUBufferDescriptor descriptor);
     [RaisesException] GPUTexture createTexture(GPUTextureDescriptor descriptor);
     [RuntimeEnabled=WebGPUImportTexture, RaisesException] GPUTexture experimentalImportTexture(HTMLCanvasElement canvas, GPUTextureUsageFlags usage);
     GPUSampler createSampler(optional GPUSamplerDescriptor descriptor = {});
diff --git a/third_party/blink/renderer/platform/heap/test/incremental_marking_test.cc b/third_party/blink/renderer/platform/heap/test/incremental_marking_test.cc
index 05ddc42..adc6d1c 100644
--- a/third_party/blink/renderer/platform/heap/test/incremental_marking_test.cc
+++ b/third_party/blink/renderer/platform/heap/test/incremental_marking_test.cc
@@ -26,6 +26,7 @@
 #include "third_party/blink/renderer/platform/heap/trace_traits.h"
 #include "third_party/blink/renderer/platform/heap/visitor.h"
 #include "third_party/blink/renderer/platform/wtf/allocator/allocator.h"
+#include "third_party/blink/renderer/platform/wtf/functional.h"
 
 namespace blink {
 
@@ -1228,7 +1229,7 @@
   IncrementalMarkingTestDriver driver(ThreadState::Current());
   driver.StartGC();
   MakeGarbageCollected<O>(
-      base::BindOnce(
+      WTF::BindOnce(
           [](IncrementalMarkingTestDriver* driver, Holder* holder, O* thiz) {
             // Publish not-fully-constructed object |thiz| by triggering write
             // barrier for the object.
@@ -1237,7 +1238,7 @@
             driver->TriggerMarkingSteps(
                 ThreadState::StackState::kMayContainHeapPointers);
           },
-          &driver, holder.Get()),
+          WTF::Unretained(&driver), WrapWeakPersistent(holder.Get())),
       MakeGarbageCollected<LinkedObject>());
   driver.FinishGC();
   PreciselyCollectGarbage();
@@ -1254,7 +1255,7 @@
   IncrementalMarkingTestDriver driver(ThreadState::Current());
   driver.StartGC();
   MakeGarbageCollected<Parent>(
-      base::BindOnce(
+      WTF::BindOnce(
           [](IncrementalMarkingTestDriver* driver, Holder* holder,
              Mixin* thiz) {
             // Publish not-fully-constructed object
@@ -1265,7 +1266,7 @@
             driver->TriggerMarkingSteps(
                 ThreadState::StackState::kMayContainHeapPointers);
           },
-          &driver, holder.Get()),
+          WTF::Unretained(&driver), WrapWeakPersistent(holder.Get())),
       MakeGarbageCollected<LinkedObject>());
   driver.FinishGC();
   PreciselyCollectGarbage();
diff --git a/third_party/blink/renderer/platform/loader/fetch/memory_cache.cc b/third_party/blink/renderer/platform/loader/fetch/memory_cache.cc
index b1214e2..e2469b7c 100644
--- a/third_party/blink/renderer/platform/loader/fetch/memory_cache.cc
+++ b/third_party/blink/renderer/platform/loader/fetch/memory_cache.cc
@@ -34,6 +34,7 @@
 #include "third_party/blink/renderer/platform/loader/fetch/resource_loading_log.h"
 #include "third_party/blink/renderer/platform/scheduler/public/main_thread.h"
 #include "third_party/blink/renderer/platform/weborigin/security_origin.h"
+#include "third_party/blink/renderer/platform/wtf/functional.h"
 #include "third_party/blink/renderer/platform/wtf/math_extras.h"
 
 namespace blink {
@@ -386,8 +387,8 @@
     } else {
       // Defer.
       task_runner_->PostTask(
-          FROM_HERE, base::BindOnce(&MemoryCache::PruneNow,
-                                    base::Unretained(this), kAutomaticPrune));
+          FROM_HERE, WTF::BindOnce(&MemoryCache::PruneNow,
+                                   WrapWeakPersistent(this), kAutomaticPrune));
       prune_pending_ = true;
     }
   }
diff --git a/third_party/blink/renderer/platform/loader/fetch/resource_loader.cc b/third_party/blink/renderer/platform/loader/fetch/resource_loader.cc
index 288aee2..ccf7874 100644
--- a/third_party/blink/renderer/platform/loader/fetch/resource_loader.cc
+++ b/third_party/blink/renderer/platform/loader/fetch/resource_loader.cc
@@ -91,6 +91,7 @@
 #include "third_party/blink/renderer/platform/weborigin/reporting_disposition.h"
 #include "third_party/blink/renderer/platform/weborigin/scheme_registry.h"
 #include "third_party/blink/renderer/platform/wtf/allocator/allocator.h"
+#include "third_party/blink/renderer/platform/wtf/functional.h"
 #include "third_party/blink/renderer/platform/wtf/shared_buffer.h"
 #include "third_party/blink/renderer/platform/wtf/text/string_builder.h"
 #include "url/url_constants.h"
@@ -316,9 +317,10 @@
   // through ResourceLoader.
   url_loader->Freeze(LoaderFreezeMode::kStrict);
 
-  WebCodeCacheLoader::FetchCodeCacheCallback callback = base::BindOnce(
-      &ResourceLoader::CodeCacheRequest::DidReceiveCachedCode,
-      weak_ptr_factory_.GetWeakPtr(), base::TimeTicks::Now(), resource_loader);
+  WebCodeCacheLoader::FetchCodeCacheCallback callback =
+      WTF::BindOnce(&ResourceLoader::CodeCacheRequest::DidReceiveCachedCode,
+                    weak_ptr_factory_.GetWeakPtr(), base::TimeTicks::Now(),
+                    WrapWeakPersistent(resource_loader));
   auto cache_type = resource_loader->GetCodeCacheType();
   code_cache_loader_->FetchFromCodeCache(cache_type, url_, std::move(callback));
   return true;
diff --git a/third_party/blink/renderer/platform/loader/fetch/url_loader/worker_main_script_loader.cc b/third_party/blink/renderer/platform/loader/fetch/url_loader/worker_main_script_loader.cc
index 45aedc7..383e275 100644
--- a/third_party/blink/renderer/platform/loader/fetch/url_loader/worker_main_script_loader.cc
+++ b/third_party/blink/renderer/platform/loader/fetch/url_loader/worker_main_script_loader.cc
@@ -24,6 +24,7 @@
 #include "third_party/blink/renderer/platform/loader/fetch/script_cached_metadata_handler.h"
 #include "third_party/blink/renderer/platform/loader/fetch/url_loader/cached_metadata_handler.h"
 #include "third_party/blink/renderer/platform/loader/fetch/url_loader/worker_main_script_loader_client.h"
+#include "third_party/blink/renderer/platform/wtf/functional.h"
 
 namespace blink {
 
@@ -102,8 +103,8 @@
   receiver_.Bind(
       std::move(worker_main_script_load_params->url_loader_client_endpoints
                     ->url_loader_client));
-  receiver_.set_disconnect_handler(base::BindOnce(
-      &WorkerMainScriptLoader::OnConnectionClosed, base::Unretained(this)));
+  receiver_.set_disconnect_handler(WTF::BindOnce(
+      &WorkerMainScriptLoader::OnConnectionClosed, WrapWeakPersistent(this)));
   data_pipe_ = std::move(worker_main_script_load_params->response_body);
 
   client_->OnStartLoadingBody(resource_response_);
@@ -203,8 +204,8 @@
       FROM_HERE, mojo::SimpleWatcher::ArmingPolicy::MANUAL);
   MojoResult rv =
       watcher_->Watch(data_pipe_.get(), MOJO_HANDLE_SIGNAL_READABLE,
-                      base::BindRepeating(&WorkerMainScriptLoader::OnReadable,
-                                          base::Unretained(this)));
+                      WTF::BindRepeating(&WorkerMainScriptLoader::OnReadable,
+                                         WrapWeakPersistent(this)));
   DCHECK_EQ(MOJO_RESULT_OK, rv);
   watcher_->ArmOrNotify();
 }
diff --git a/third_party/blink/renderer/platform/runtime_enabled_features.json5 b/third_party/blink/renderer/platform/runtime_enabled_features.json5
index e2aaa0fe..c5d05e5 100644
--- a/third_party/blink/renderer/platform/runtime_enabled_features.json5
+++ b/third_party/blink/renderer/platform/runtime_enabled_features.json5
@@ -810,6 +810,14 @@
       status: "experimental",
     },
     {
+      // Use the new CSS-based painting for spelling and grammar errors,
+      // regardless of whether the new highlights or decorations are exposed
+      // to authors (see CSSSpellingGrammarErrors).
+      name: "CSSPaintingForSpellingGrammarErrors",
+      status: "stable",
+      base_feature: "CssPaintingForSpellingGrammarErrors",
+    },
+    {
       name: "CSSPictureInPicture",
       status: "experimental",
       depends_on: ["PictureInPictureAPI"],
@@ -1163,6 +1171,11 @@
       status: "test",
     },
     {
+      name: "FastPositionIterator",
+      status: "stable",
+      base_feature: "FastPositionIterator",
+    },
+    {
       name: "FeaturePolicyReporting",
       status: "experimental"
     },
diff --git a/third_party/blink/renderer/platform/scheduler/common/throttling/task_queue_throttler.cc b/third_party/blink/renderer/platform/scheduler/common/throttling/task_queue_throttler.cc
index d9b7f4cf..b5d08db 100644
--- a/third_party/blink/renderer/platform/scheduler/common/throttling/task_queue_throttler.cc
+++ b/third_party/blink/renderer/platform/scheduler/common/throttling/task_queue_throttler.cc
@@ -85,7 +85,7 @@
       // WakeUpResolution::kLow is always used for throttled tasks since those
       // tasks can tolerate having their execution being delayed.
       return base::sequence_manager::WakeUp{
-          allowed_run_time, base::GetTaskLeeway(),
+          allowed_run_time, base::GetTaskLeewayForCurrentThread(),
           base::sequence_manager::WakeUpResolution::kLow};
     }
   }
diff --git a/third_party/blink/web_tests/TestExpectations b/third_party/blink/web_tests/TestExpectations
index 90cfd6e..738b84f 100644
--- a/third_party/blink/web_tests/TestExpectations
+++ b/third_party/blink/web_tests/TestExpectations
@@ -6884,57 +6884,6 @@
 crbug.com/1386017 external/wpt/performance-timeline/not-restored-reasons/performance-navigation-timing-cross-origin-bfcache.window.html [ Failure Pass ]
 crbug.com/1386017 external/wpt/performance-timeline/not-restored-reasons/performance-navigation-timing-not-bfcached.window.html [ Failure Pass ]
 
-# Sheriff 2022-11-18
-crbug.com/1386241 virtual/web-bluetooth-new-permissions-backend/wpt_internal/bluetooth/characteristic/getDescriptor/gen-descriptor-garbage-collection-ran-during-error.https.html [ Failure Pass ]
-crbug.com/1386241 virtual/web-bluetooth-new-permissions-backend/wpt_internal/bluetooth/characteristic/getDescriptor/gen-descriptor-garbage-collection-ran-during-success.https.html [ Failure Pass ]
-crbug.com/1386241 virtual/web-bluetooth-new-permissions-backend/wpt_internal/bluetooth/characteristic/getDescriptors/gen-descriptor-garbage-collection-ran-during-error.https.html [ Failure Pass ]
-crbug.com/1386241 virtual/web-bluetooth-new-permissions-backend/wpt_internal/bluetooth/characteristic/getDescriptors/gen-descriptor-garbage-collection-ran-during-error-with-uuid.https.html [ Failure Pass ]
-crbug.com/1386241 virtual/web-bluetooth-new-permissions-backend/wpt_internal/bluetooth/characteristic/getDescriptors/gen-descriptor-garbage-collection-ran-during-success-with-uuid.https.html [ Failure Pass ]
-crbug.com/1386241 virtual/web-bluetooth-new-permissions-backend/wpt_internal/bluetooth/characteristic/getDescriptors/gen-descriptor-garbage-collection-ran-during-success.https.html [ Failure Pass ]
-crbug.com/1386241 virtual/web-bluetooth-new-permissions-backend/wpt_internal/bluetooth/characteristic/readValue/gen-gatt-op-garbage-collection-ran-during-error.https.html [ Failure Pass ]
-crbug.com/1386241 virtual/web-bluetooth-new-permissions-backend/wpt_internal/bluetooth/characteristic/readValue/gen-gatt-op-garbage-collection-ran-during-success.https.html [ Failure Pass ]
-crbug.com/1386241 virtual/web-bluetooth-new-permissions-backend/wpt_internal/bluetooth/characteristic/startNotifications/gen-gatt-op-garbage-collection-ran-during-error.https.html [ Failure Pass ]
-crbug.com/1386241 virtual/web-bluetooth-new-permissions-backend/wpt_internal/bluetooth/characteristic/startNotifications/gen-gatt-op-garbage-collection-ran-during-success.https.html [ Failure Pass ]
-crbug.com/1386241 virtual/web-bluetooth-new-permissions-backend/wpt_internal/bluetooth/characteristic/stopNotifications/gen-gatt-op-garbage-collection-ran-during-success.https.html [ Failure Pass ]
-crbug.com/1386241 virtual/web-bluetooth-new-permissions-backend/wpt_internal/bluetooth/characteristic/writeValue/gen-gatt-op-garbage-collection-ran-during-error.https.html [ Failure Pass ]
-crbug.com/1386241 virtual/web-bluetooth-new-permissions-backend/wpt_internal/bluetooth/characteristic/writeValue/gen-gatt-op-garbage-collection-ran-during-success.https.html [ Failure Pass ]
-crbug.com/1386241 virtual/web-bluetooth-new-permissions-backend/wpt_internal/bluetooth/characteristic/writeValueWithoutResponse/gen-gatt-op-garbage-collection-ran-during-error.https.html [ Failure Pass ]
-crbug.com/1386241 virtual/web-bluetooth-new-permissions-backend/wpt_internal/bluetooth/characteristic/writeValueWithoutResponse/gen-gatt-op-garbage-collection-ran-during-success.https.html [ Failure Pass ]
-crbug.com/1386241 virtual/web-bluetooth-new-permissions-backend/wpt_internal/bluetooth/characteristic/writeValueWithResponse/gen-gatt-op-garbage-collection-ran-during-error.https.html [ Failure Pass ]
-crbug.com/1386241 virtual/web-bluetooth-new-permissions-backend/wpt_internal/bluetooth/characteristic/writeValueWithResponse/gen-gatt-op-garbage-collection-ran-during-success.https.html [ Failure Pass ]
-crbug.com/1386241 virtual/web-bluetooth-new-permissions-backend/wpt_internal/bluetooth/descriptor/readValue/gen-io-op-garbage-collection-ran-during-error.https.html [ Failure Pass ]
-crbug.com/1386241 virtual/web-bluetooth-new-permissions-backend/wpt_internal/bluetooth/descriptor/readValue/gen-io-op-garbage-collection-ran-during-success.https.html [ Failure Pass ]
-crbug.com/1386241 virtual/web-bluetooth-new-permissions-backend/wpt_internal/bluetooth/descriptor/writeValue/gen-io-op-garbage-collection-ran-during-error.https.html [ Failure Pass ]
-crbug.com/1386241 virtual/web-bluetooth-new-permissions-backend/wpt_internal/bluetooth/descriptor/writeValue/gen-io-op-garbage-collection-ran-during-success.https.html [ Failure Pass ]
-crbug.com/1386241 virtual/web-bluetooth-new-permissions-backend/wpt_internal/bluetooth/server/connect/garbage-collection-ran-during-error.https.html [ Failure Pass ]
-crbug.com/1386241 virtual/web-bluetooth-new-permissions-backend/wpt_internal/bluetooth/service/getCharacteristics/gen-garbage-collection-ran-during-success-with-uuid.https.html [ Failure Pass ]
-crbug.com/1386241 virtual/web-bluetooth-new-permissions-backend/wpt_internal/bluetooth/service/getCharacteristics/gen-garbage-collection-ran-during-success.https.html [ Failure Pass ]
-crbug.com/1386241 wpt_internal/bluetooth/characteristic/getDescriptor/gen-descriptor-garbage-collection-ran-during-error.https.html [ Failure Pass ]
-crbug.com/1386241 wpt_internal/bluetooth/characteristic/getDescriptor/gen-descriptor-garbage-collection-ran-during-success.https.html [ Failure Pass ]
-crbug.com/1386241 wpt_internal/bluetooth/characteristic/getDescriptors/gen-descriptor-garbage-collection-ran-during-error-with-uuid.https.html [ Failure Pass ]
-crbug.com/1386241 wpt_internal/bluetooth/characteristic/getDescriptors/gen-descriptor-garbage-collection-ran-during-error.https.html [ Failure Pass ]
-crbug.com/1386241 wpt_internal/bluetooth/characteristic/getDescriptors/gen-descriptor-garbage-collection-ran-during-success-with-uuid.https.html [ Failure Pass ]
-crbug.com/1386241 wpt_internal/bluetooth/characteristic/getDescriptors/gen-descriptor-garbage-collection-ran-during-success.https.html [ Failure Pass ]
-crbug.com/1386241 wpt_internal/bluetooth/characteristic/readValue/gen-gatt-op-garbage-collection-ran-during-error.https.html [ Failure Pass ]
-crbug.com/1386241 wpt_internal/bluetooth/characteristic/readValue/gen-gatt-op-garbage-collection-ran-during-success.https.html [ Failure Pass ]
-crbug.com/1386241 wpt_internal/bluetooth/characteristic/startNotifications/gen-gatt-op-garbage-collection-ran-during-error.https.html [ Failure Pass ]
-crbug.com/1386241 wpt_internal/bluetooth/characteristic/startNotifications/gen-gatt-op-garbage-collection-ran-during-success.https.html [ Failure Pass ]
-crbug.com/1386241 wpt_internal/bluetooth/characteristic/stopNotifications/gen-gatt-op-garbage-collection-ran-during-success.https.html [ Failure Pass ]
-crbug.com/1386241 wpt_internal/bluetooth/characteristic/writeValue/gen-gatt-op-garbage-collection-ran-during-error.https.html [ Failure Pass ]
-crbug.com/1386241 wpt_internal/bluetooth/characteristic/writeValue/gen-gatt-op-garbage-collection-ran-during-success.https.html [ Failure Pass ]
-crbug.com/1386241 wpt_internal/bluetooth/characteristic/writeValueWithoutResponse/gen-gatt-op-garbage-collection-ran-during-error.https.html [ Failure Pass ]
-crbug.com/1386241 wpt_internal/bluetooth/characteristic/writeValueWithoutResponse/gen-gatt-op-garbage-collection-ran-during-success.https.html [ Failure Pass ]
-crbug.com/1386241 wpt_internal/bluetooth/characteristic/writeValueWithResponse/gen-gatt-op-garbage-collection-ran-during-error.https.html [ Failure Pass ]
-crbug.com/1386241 wpt_internal/bluetooth/characteristic/writeValueWithResponse/gen-gatt-op-garbage-collection-ran-during-success.https.html [ Failure Pass ]
-crbug.com/1386241 wpt_internal/bluetooth/descriptor/readValue/gen-io-op-garbage-collection-ran-during-error.https.html [ Failure Pass ]
-crbug.com/1386241 wpt_internal/bluetooth/descriptor/readValue/gen-io-op-garbage-collection-ran-during-success.https.html [ Failure Pass ]
-crbug.com/1386241 wpt_internal/bluetooth/descriptor/writeValue/gen-io-op-garbage-collection-ran-during-error.https.html [ Failure Pass ]
-crbug.com/1386241 wpt_internal/bluetooth/descriptor/writeValue/gen-io-op-garbage-collection-ran-during-success.https.html [ Failure Pass ]
-crbug.com/1386241 wpt_internal/bluetooth/server/connect/garbage-collection-ran-during-error.https.html [ Failure Pass ]
-crbug.com/1386241 wpt_internal/bluetooth/service/getCharacteristic/gen-garbage-collection-ran-during-success.https.html [ Failure Pass ]
-crbug.com/1386241 wpt_internal/bluetooth/service/getCharacteristics/gen-garbage-collection-ran-during-success-with-uuid.https.html [ Failure Pass ]
-crbug.com/1386241 wpt_internal/bluetooth/service/getCharacteristics/gen-garbage-collection-ran-during-success.https.html [ Failure Pass ]
-
 # Sheriff 2022-11-21
 crbug.com/1380188 external/wpt/html/browsers/browsing-the-web/history-traversal/event-order/before-load-hash.html [ Failure Pass ]
 crbug.com/1385809 external/wpt/clipboard-apis/async-navigator-clipboard-basics.https.html [ Failure Pass Timeout ]
@@ -6943,9 +6892,6 @@
 crbug.com/1385548 [ Win ] virtual/close-watcher/external/wpt/close-watcher/user-activation.html [ Pass Timeout ]
 crbug.com/1385548 [ Mac ] virtual/close-watcher/external/wpt/close-watcher/user-activation.html [ Pass Timeout ]
 
-# Changing expectation for devtools-frontend change.
-crbug.com/1325457 http/tests/devtools/oopif/oopif-presentation-console-messages.js [ Failure Pass ]
-
 # Sheriff 2022-11-21 - EMEA
 crbug.com/1376986 [ Mac ] virtual/compute-pressure/external/wpt/compute-pressure/compute_pressure_duplicate_updates.tentative.https.window.html [ Failure Timeout ]
 crbug.com/1376986 [ Linux ] virtual/compute-pressure/external/wpt/compute-pressure/compute_pressure_duplicate_updates.tentative.https.window.html [ Failure Timeout ]
diff --git a/third_party/blink/web_tests/external/WPT_BASE_MANIFEST_8.json b/third_party/blink/web_tests/external/WPT_BASE_MANIFEST_8.json
index c16a21a..7ff6f12 100644
--- a/third_party/blink/web_tests/external/WPT_BASE_MANIFEST_8.json
+++ b/third_party/blink/web_tests/external/WPT_BASE_MANIFEST_8.json
@@ -2114,6 +2114,13 @@
         {}
        ]
       ],
+      "move-newline-pre-text.html": [
+       "86892a1d39c720440c22f58487de98e2bec6e106",
+       [
+        null,
+        {}
+       ]
+      ],
       "multicol-at-page-boundary-print.html": [
        "63b27c88cd01ccef03bb7eeffc3ee065194c5f33",
        [
@@ -132061,7 +132068,7 @@
        ]
       ],
       "image-orientation-background-properties.html": [
-       "9f80feb7e9aa2db4b5b126133ca88a363858cb74",
+       "431fba1330eb0a37ff3aae7ee2bcd4835edfb79e",
        [
         null,
         [
@@ -132077,7 +132084,7 @@
            [
             [
              0,
-             2
+             100
             ],
             [
              0,
@@ -132119,7 +132126,7 @@
        ]
       ],
       "image-orientation-default.html": [
-       "7487e40db76e9fb8f12f1e48f3e838581ac484f8",
+       "3fefbd073a4d727b787336aafc746924a9f39e0b",
        [
         null,
         [
@@ -132135,11 +132142,11 @@
            [
             [
              0,
-             5
+             100
             ],
             [
              0,
-             200
+             236
             ]
            ]
           ]
@@ -132161,7 +132168,7 @@
        ]
       ],
       "image-orientation-from-image-composited-dynamic1.html": [
-       "29355518fdef34a1579592bf4b3b70967ee74f1c",
+       "b42b010d6200bb9bb04d1fe99f3116f1b2e386e4",
        [
         null,
         [
@@ -132177,11 +132184,11 @@
            [
             [
              0,
-             5
+             100
             ],
             [
              0,
-             200
+             236
             ]
            ]
           ]
@@ -132190,7 +132197,7 @@
        ]
       ],
       "image-orientation-from-image-composited-dynamic2.html": [
-       "053919d2602c7c4d55919bf35266275c22e68216",
+       "39f23621a77d2b89312997cef282d7b6d8e77694",
        [
         null,
         [
@@ -132206,11 +132213,11 @@
            [
             [
              0,
-             5
+             100
             ],
             [
              0,
-             100
+             123
             ]
            ]
           ]
@@ -132219,7 +132226,7 @@
        ]
       ],
       "image-orientation-from-image-composited.html": [
-       "2db88810bca9758013e994bfdcb1f878824565f7",
+       "4e5032779d7b9012494f13a687122e996b3e6db7",
        [
         null,
         [
@@ -132235,11 +132242,11 @@
            [
             [
              0,
-             5
+             100
             ],
             [
              0,
-             200
+             236
             ]
            ]
           ]
@@ -132277,7 +132284,7 @@
        ]
       ],
       "image-orientation-from-image-dynamic1.html": [
-       "d5e00f27cf3597266373b6d8858a7c106760fa0c",
+       "d97492b7f1fa3e4c088e7c451d7835a831d26a96",
        [
         null,
         [
@@ -132293,11 +132300,11 @@
            [
             [
              0,
-             5
+             100
             ],
             [
              0,
-             200
+             236
             ]
            ]
           ]
@@ -132306,7 +132313,7 @@
        ]
       ],
       "image-orientation-from-image-dynamic2.html": [
-       "d70c5f6b3c028e62d096e106b6656695d6545eba",
+       "ee4c3ff1fbfd7c6ce0e8414ef6b6628ee645691d",
        [
         null,
         [
@@ -132322,11 +132329,11 @@
            [
             [
              0,
-             5
+             100
             ],
             [
              0,
-             100
+             123
             ]
            ]
           ]
@@ -132364,7 +132371,7 @@
        ]
       ],
       "image-orientation-from-image.html": [
-       "14b929c089504b9e2bb6b5f52725bd3e80019dba",
+       "00d87fc406951f75f1b041e6e42f31fc6175bed1",
        [
         null,
         [
@@ -132380,11 +132387,11 @@
            [
             [
              0,
-             5
+             100
             ],
             [
              0,
-             200
+             236
             ]
            ]
           ]
@@ -132561,7 +132568,7 @@
        ]
       ],
       "image-orientation-none-image-document.html": [
-       "672ed58e6e0d956bd5363aed6c4830f3c99b4348",
+       "05dd66e1e3e50a6a20759fc545dcaa0e6e739490",
        [
         null,
         [
@@ -132577,11 +132584,11 @@
            [
             [
              0,
-             5
+             100
             ],
             [
              0,
-             200
+             236
             ]
            ]
           ]
@@ -132590,7 +132597,7 @@
        ]
       ],
       "image-orientation-none.html": [
-       "dfdfa011aefcf1f2df6999006416b329cb4669cf",
+       "d689b5af06f2ec3d0c9c74e902ee70ca664e48a8",
        [
         null,
         [
@@ -132606,11 +132613,11 @@
            [
             [
              0,
-             5
+             100
             ],
             [
              0,
-             100
+             123
             ]
            ]
           ]
@@ -140331,7 +140338,7 @@
        ]
       ],
       "clip-path-contentBox-1a.html": [
-       "97680121fe7bcb779772a765e3b18398580c0ae7",
+       "b10dcbe3ad50028fdb143121534a41e47a923dc1",
        [
         null,
         [
@@ -140347,11 +140354,11 @@
            [
             [
              0,
-             60
+             62
             ],
             [
              0,
-             394
+             420
             ]
            ]
           ]
@@ -140360,7 +140367,7 @@
        ]
       ],
       "clip-path-contentBox-1b.html": [
-       "a8dbe5d259f93a65385b9c03c706afc5c3460b1b",
+       "8c2a6517667d6c0434f03f4252e875ad3ff382bf",
        [
         null,
         [
@@ -140376,11 +140383,11 @@
            [
             [
              0,
-             60
+             62
             ],
             [
              0,
-             394
+             420
             ]
            ]
           ]
@@ -140756,7 +140763,7 @@
        ]
       ],
       "clip-path-marginBox-1a.html": [
-       "cef9a2b75e55108f3fd513788b987fc3da3e9ecb",
+       "009ba674d8c56d3f63906e1ab8287ea4db702057",
        [
         null,
         [
@@ -140772,11 +140779,11 @@
            [
             [
              0,
-             60
+             62
             ],
             [
              0,
-             394
+             420
             ]
            ]
           ]
@@ -140798,7 +140805,7 @@
        ]
       ],
       "clip-path-paddingBox-1a.html": [
-       "d7434ed3c8a0fde634fca8be1b00362c4649e7a9",
+       "493ba7ab05678854d2232e75882483516464a4e8",
        [
         null,
         [
@@ -140814,11 +140821,11 @@
            [
             [
              0,
-             60
+             62
             ],
             [
              0,
-             394
+             420
             ]
            ]
           ]
@@ -140827,7 +140834,7 @@
        ]
       ],
       "clip-path-paddingBox-1b.html": [
-       "2d1bd534963b9c14bede20a0fa07a9e2cf2b652c",
+       "d3ea29633e317b94e85e1f2ddd0f097e641d717d",
        [
         null,
         [
@@ -140843,11 +140850,11 @@
            [
             [
              0,
-             60
+             62
             ],
             [
              0,
-             394
+             420
             ]
            ]
           ]
@@ -141457,7 +141464,7 @@
        ]
       ],
       "clip-path-viewBox-1a.html": [
-       "f8fb4f90efeb3fe67b8e758f628ad0c17f269a64",
+       "5b029e1ef7cfea200416bd99314c7288e44e3f60",
        [
         null,
         [
@@ -141473,11 +141480,11 @@
            [
             [
              0,
-             60
+             62
             ],
             [
              0,
-             394
+             420
             ]
            ]
           ]
@@ -141551,7 +141558,7 @@
        ]
       ],
       "svg-clip-path-circle-offset.html": [
-       "975f9418661a6c0791b20e9fc6b45c1dc72829fa",
+       "ec4cbaeb25203d8d8897d004a4e9c1ba0986350d",
        [
         null,
         [
@@ -141567,11 +141574,11 @@
            [
             [
              0,
-             60
+             62
             ],
             [
              0,
-             394
+             420
             ]
            ]
           ]
@@ -141580,7 +141587,7 @@
        ]
       ],
       "svg-clip-path-ellipse-offset.html": [
-       "3925926ac14db179a3919439dd39990e517b7cdc",
+       "2b0876eb5890c0aa2cc6fcbf054b70efed16a9d7",
        [
         null,
         [
@@ -141596,7 +141603,7 @@
            [
             [
              0,
-             60
+             69
             ],
             [
              0,
@@ -199307,7 +199314,7 @@
       ]
      ],
      "transform3d-preserve3d-007.html": [
-      "6e426e2681a80e259b64bdd91b8883215bc39fcf",
+      "91310b91bae359331f813a15693e17889e18c4f4",
       [
        null,
        [
@@ -199323,7 +199330,7 @@
           [
            [
             0,
-            54
+            55
            ],
            [
             0,
@@ -251698,7 +251705,7 @@
        ]
       ],
       "masked.html": [
-       "58efa225b16e1ad1ce37bd9a450196322678bc8a",
+       "1c7a332d7f9e21dc85105793922b725aeb3891c2",
        [
         null,
         [
@@ -251714,7 +251721,7 @@
            [
             [
              0,
-             36
+             37
             ],
             [
              0,
@@ -258693,7 +258700,7 @@
       []
      ],
      "eddsa.https.any-expected.txt": [
-      "4453f4de19eb3138ad1fb88b144885b3bce34218",
+      "d9c753bc5346c9a967e95d4f4304ad704938136b",
       []
      ],
      "eddsa.https.any.js.ini": [
@@ -258701,11 +258708,11 @@
       []
      ],
      "eddsa.https.any.worker-expected.txt": [
-      "4453f4de19eb3138ad1fb88b144885b3bce34218",
+      "d9c753bc5346c9a967e95d4f4304ad704938136b",
       []
      ],
      "eddsa.js": [
-      "0a2e638114ad198ba8b08a80cff2ea514826b143",
+      "d425fec2dc343ef456ba714e51b940477436a32a",
       []
      ],
      "eddsa_vectors.js": [
diff --git a/third_party/blink/web_tests/external/wpt/css/css-images/image-orientation/image-orientation-background-properties.html b/third_party/blink/web_tests/external/wpt/css/css-images/image-orientation/image-orientation-background-properties.html
index 9f80feb..431fba1 100644
--- a/third_party/blink/web_tests/external/wpt/css/css-images/image-orientation/image-orientation-background-properties.html
+++ b/third_party/blink/web_tests/external/wpt/css/css-images/image-orientation/image-orientation-background-properties.html
@@ -6,7 +6,7 @@
 <link rel="author" title="Stephen Chenney" href="mailto:schenney@chromium.org">
 <link rel="help" href="https://drafts.csswg.org/css-images-3/#propdef-image-orientation">
 <link rel="match" href="reference/image-orientation-background-properties-ref.html">
-<meta name=fuzzy content="0-2;0-313">
+<meta name="fuzzy" content="maxDifference=0-100; totalPixels=0-313">
 <style>
     div {
         position: absolute;
diff --git a/third_party/blink/web_tests/external/wpt/css/css-images/image-orientation/image-orientation-default.html b/third_party/blink/web_tests/external/wpt/css/css-images/image-orientation/image-orientation-default.html
index 7487e40..3fefbd0 100644
--- a/third_party/blink/web_tests/external/wpt/css/css-images/image-orientation/image-orientation-default.html
+++ b/third_party/blink/web_tests/external/wpt/css/css-images/image-orientation/image-orientation-default.html
@@ -6,7 +6,7 @@
 <link rel="author" title="Stephen Chenney" href="mailto:schenney@chromium.org">
 <link rel="help" href="https://drafts.csswg.org/css-images-3/#propdef-image-orientation">
 <link rel="match" href="reference/image-orientation-default-ref.html">
-<meta name=fuzzy content="0-5;0-200">
+<meta name="fuzzy" content="maxDifference=0-100; totalPixels=0-236">
 <style>
     body {
         overflow: hidden;
diff --git a/third_party/blink/web_tests/external/wpt/css/css-images/image-orientation/image-orientation-from-image-composited-dynamic1.html b/third_party/blink/web_tests/external/wpt/css/css-images/image-orientation/image-orientation-from-image-composited-dynamic1.html
index 29355518..b42b010 100644
--- a/third_party/blink/web_tests/external/wpt/css/css-images/image-orientation/image-orientation-from-image-composited-dynamic1.html
+++ b/third_party/blink/web_tests/external/wpt/css/css-images/image-orientation/image-orientation-from-image-composited-dynamic1.html
@@ -6,7 +6,7 @@
 <link rel="author" title="Stephen Chenney" href="mailto:schenney@chromium.org">
 <link rel="help" href="https://drafts.csswg.org/css-images-3/#propdef-image-orientation">
 <link rel="match" href="reference/image-orientation-from-image-ref.html">
-<meta name=fuzzy content="0-5;0-200">
+<meta name="fuzzy" content="maxDifference=0-100; totalPixels=0-236">
 <style>
     body {
         overflow: hidden;}
diff --git a/third_party/blink/web_tests/external/wpt/css/css-images/image-orientation/image-orientation-from-image-composited-dynamic2.html b/third_party/blink/web_tests/external/wpt/css/css-images/image-orientation/image-orientation-from-image-composited-dynamic2.html
index 053919d..39f2362 100644
--- a/third_party/blink/web_tests/external/wpt/css/css-images/image-orientation/image-orientation-from-image-composited-dynamic2.html
+++ b/third_party/blink/web_tests/external/wpt/css/css-images/image-orientation/image-orientation-from-image-composited-dynamic2.html
@@ -6,7 +6,7 @@
 <link rel="author" title="Stephen Chenney" href="mailto:schenney@chromium.org">
 <link rel="help" href="https://drafts.csswg.org/css-images-3/#propdef-image-orientation">
 <link rel="match" href="reference/image-orientation-none-ref.html">
-<meta name=fuzzy content="0-5;0-100">
+<meta name="fuzzy" content="maxDifference=0-100; totalPixels=0-123">
 <style>
     body {
         overflow: hidden;
diff --git a/third_party/blink/web_tests/external/wpt/css/css-images/image-orientation/image-orientation-from-image-composited.html b/third_party/blink/web_tests/external/wpt/css/css-images/image-orientation/image-orientation-from-image-composited.html
index 2db8881..4e50327 100644
--- a/third_party/blink/web_tests/external/wpt/css/css-images/image-orientation/image-orientation-from-image-composited.html
+++ b/third_party/blink/web_tests/external/wpt/css/css-images/image-orientation/image-orientation-from-image-composited.html
@@ -6,7 +6,7 @@
 <link rel="author" title="Stephen Chenney" href="mailto:schenney@chromium.org">
 <link rel="help" href="https://drafts.csswg.org/css-images-3/#propdef-image-orientation">
 <link rel="match" href="reference/image-orientation-from-image-ref.html">
-<meta name=fuzzy content="0-5;0-200">
+<meta name="fuzzy" content="maxDifference=0-100; totalPixels=0-236">
 <style>
     body {
         overflow: hidden;
diff --git a/third_party/blink/web_tests/external/wpt/css/css-images/image-orientation/image-orientation-from-image-dynamic1.html b/third_party/blink/web_tests/external/wpt/css/css-images/image-orientation/image-orientation-from-image-dynamic1.html
index d5e00f2..d97492b 100644
--- a/third_party/blink/web_tests/external/wpt/css/css-images/image-orientation/image-orientation-from-image-dynamic1.html
+++ b/third_party/blink/web_tests/external/wpt/css/css-images/image-orientation/image-orientation-from-image-dynamic1.html
@@ -6,7 +6,7 @@
 <link rel="author" title="Stephen Chenney" href="mailto:schenney@chromium.org">
 <link rel="help" href="https://drafts.csswg.org/css-images-3/#propdef-image-orientation">
 <link rel="match" href="reference/image-orientation-from-image-ref.html">
-<meta name=fuzzy content="0-5;0-200">
+<meta name="fuzzy" content="maxDifference=0-100; totalPixels=0-236">
 <style>
     body {
         overflow: hidden;
diff --git a/third_party/blink/web_tests/external/wpt/css/css-images/image-orientation/image-orientation-from-image-dynamic2.html b/third_party/blink/web_tests/external/wpt/css/css-images/image-orientation/image-orientation-from-image-dynamic2.html
index d70c5f6..ee4c3ff 100644
--- a/third_party/blink/web_tests/external/wpt/css/css-images/image-orientation/image-orientation-from-image-dynamic2.html
+++ b/third_party/blink/web_tests/external/wpt/css/css-images/image-orientation/image-orientation-from-image-dynamic2.html
@@ -6,7 +6,7 @@
 <link rel="author" title="Stephen Chenney" href="mailto:schenney@chromium.org">
 <link rel="help" href="https://drafts.csswg.org/css-images-3/#propdef-image-orientation">
 <link rel="match" href="reference/image-orientation-none-ref.html">
-<meta name=fuzzy content="0-5;0-100">
+<meta name="fuzzy" content="maxDifference=0-100; totalPixels=0-123">
 <style>
     body {
         overflow: hidden;
diff --git a/third_party/blink/web_tests/external/wpt/css/css-images/image-orientation/image-orientation-from-image.html b/third_party/blink/web_tests/external/wpt/css/css-images/image-orientation/image-orientation-from-image.html
index 14b929c..00d87fc4 100644
--- a/third_party/blink/web_tests/external/wpt/css/css-images/image-orientation/image-orientation-from-image.html
+++ b/third_party/blink/web_tests/external/wpt/css/css-images/image-orientation/image-orientation-from-image.html
@@ -6,7 +6,7 @@
 <link rel="author" title="Stephen Chenney" href="mailto:schenney@chromium.org">
 <link rel="help" href="https://drafts.csswg.org/css-images-3/#propdef-image-orientation">
 <link rel="match" href="reference/image-orientation-from-image-ref.html">
-<meta name=fuzzy content="0-5;0-200">
+<meta name="fuzzy" content="maxDifference=0-100; totalPixels=0-236">
 <style>
     body {
         overflow: hidden;
diff --git a/third_party/blink/web_tests/external/wpt/css/css-images/image-orientation/image-orientation-none-image-document.html b/third_party/blink/web_tests/external/wpt/css/css-images/image-orientation/image-orientation-none-image-document.html
index 672ed58..05dd66e 100644
--- a/third_party/blink/web_tests/external/wpt/css/css-images/image-orientation/image-orientation-none-image-document.html
+++ b/third_party/blink/web_tests/external/wpt/css/css-images/image-orientation/image-orientation-none-image-document.html
@@ -6,7 +6,7 @@
 <link rel="author" title="Stephen Chenney" href="mailto:schenney@chromium.org">
 <link rel="help" href="https://drafts.csswg.org/css-images-3/#propdef-image-orientation">
 <link rel="match" href="reference/image-orientation-none-image-document-ref.html">
-<meta name=fuzzy content="0-5;0-200">
+<meta name="fuzzy" content="maxDifference=0-100; totalPixels=0-236">
 <style>
     iframe {
         display: inline-block;
diff --git a/third_party/blink/web_tests/external/wpt/css/css-images/image-orientation/image-orientation-none.html b/third_party/blink/web_tests/external/wpt/css/css-images/image-orientation/image-orientation-none.html
index dfdfa011..d689b5af 100644
--- a/third_party/blink/web_tests/external/wpt/css/css-images/image-orientation/image-orientation-none.html
+++ b/third_party/blink/web_tests/external/wpt/css/css-images/image-orientation/image-orientation-none.html
@@ -6,7 +6,7 @@
 <link rel="author" title="Stephen Chenney" href="mailto:schenney@chromium.org">
 <link rel="help" href="https://drafts.csswg.org/css-images-3/#propdef-image-orientation">
 <link rel="match" href="reference/image-orientation-none-ref.html">
-<meta name=fuzzy content="0-5;0-100">
+<meta name="fuzzy" content="maxDifference=0-100; totalPixels=0-123">
 <style>
     body {
         overflow: hidden;
diff --git a/third_party/blink/web_tests/external/wpt/css/css-masking/clip-path/clip-path-contentBox-1a.html b/third_party/blink/web_tests/external/wpt/css/css-masking/clip-path/clip-path-contentBox-1a.html
index 97680121..b10dcbe3 100644
--- a/third_party/blink/web_tests/external/wpt/css/css-masking/clip-path/clip-path-contentBox-1a.html
+++ b/third_party/blink/web_tests/external/wpt/css/css-masking/clip-path/clip-path-contentBox-1a.html
@@ -8,7 +8,7 @@
     <link rel="help" href="https://www.w3.org/TR/css-masking-1/#the-clip-path">
     <link rel="match" href="clip-path-geometryBox-1-ref.html">
     <meta name="assert" content="Test checks whether clip-path content-box works correctly or not. This test is for clip-path applied to an HTML element.">
-    <meta name="fuzzy" content="maxDifference=0-60; totalPixels=0-394">
+    <meta name="fuzzy" content="maxDifference=0-62; totalPixels=0-420">
     <style>
       div {
         background-color: blue;
diff --git a/third_party/blink/web_tests/external/wpt/css/css-masking/clip-path/clip-path-contentBox-1b.html b/third_party/blink/web_tests/external/wpt/css/css-masking/clip-path/clip-path-contentBox-1b.html
index a8dbe5d2..8c2a651 100644
--- a/third_party/blink/web_tests/external/wpt/css/css-masking/clip-path/clip-path-contentBox-1b.html
+++ b/third_party/blink/web_tests/external/wpt/css/css-masking/clip-path/clip-path-contentBox-1b.html
@@ -8,7 +8,7 @@
     <link rel="help" href="https://www.w3.org/TR/css-masking-1/#the-clip-path">
     <link rel="match" href="clip-path-geometryBox-1-ref.html">
     <meta name="assert" content="Test checks whether clip-path content-box works correctly or not. This test is for clip-path applied to an SVG element.">
-    <meta name="fuzzy" content="maxDifference=0-60; totalPixels=0-394">
+    <meta name="fuzzy" content="maxDifference=0-62; totalPixels=0-420">
   </head>
   <body>
     <svg width="200" height="200" style="position: absolute; left: 0px; top: 0px;">
diff --git a/third_party/blink/web_tests/external/wpt/css/css-masking/clip-path/clip-path-marginBox-1a.html b/third_party/blink/web_tests/external/wpt/css/css-masking/clip-path/clip-path-marginBox-1a.html
index cef9a2b..009ba67 100644
--- a/third_party/blink/web_tests/external/wpt/css/css-masking/clip-path/clip-path-marginBox-1a.html
+++ b/third_party/blink/web_tests/external/wpt/css/css-masking/clip-path/clip-path-marginBox-1a.html
@@ -8,7 +8,7 @@
     <link rel="help" href="https://www.w3.org/TR/css-masking-1/#the-clip-path">
     <link rel="match" href="clip-path-geometryBox-1-ref.html">
     <meta name="assert" content="Test checks whether clip-path margin-box works correctly or not. This test is for clip-path applied to an SVG element.">
-    <meta name="fuzzy" content="maxDifference=0-60; totalPixels=0-394">
+    <meta name="fuzzy" content="maxDifference=0-62; totalPixels=0-420">
   </head>
   <body>
     <svg width="200" height="200" style="position: absolute; left: 10px; top: 15px;">
diff --git a/third_party/blink/web_tests/external/wpt/css/css-masking/clip-path/clip-path-paddingBox-1a.html b/third_party/blink/web_tests/external/wpt/css/css-masking/clip-path/clip-path-paddingBox-1a.html
index d7434ed..493ba7a 100644
--- a/third_party/blink/web_tests/external/wpt/css/css-masking/clip-path/clip-path-paddingBox-1a.html
+++ b/third_party/blink/web_tests/external/wpt/css/css-masking/clip-path/clip-path-paddingBox-1a.html
@@ -8,7 +8,7 @@
     <link rel="help" href="https://www.w3.org/TR/css-masking-1/#the-clip-path">
     <link rel="match" href="clip-path-geometryBox-1-ref.html">
     <meta name="assert" content="Test checks whether clip-path padding-box works correctly or not. This test is for clip-path applied to an HTML element.">
-    <meta name="fuzzy" content="maxDifference=0-60; totalPixels=0-394">
+    <meta name="fuzzy" content="maxDifference=0-62; totalPixels=0-420">
     <style>
       div {
         position: absolute;
diff --git a/third_party/blink/web_tests/external/wpt/css/css-masking/clip-path/clip-path-paddingBox-1b.html b/third_party/blink/web_tests/external/wpt/css/css-masking/clip-path/clip-path-paddingBox-1b.html
index 2d1bd53..d3ea296 100644
--- a/third_party/blink/web_tests/external/wpt/css/css-masking/clip-path/clip-path-paddingBox-1b.html
+++ b/third_party/blink/web_tests/external/wpt/css/css-masking/clip-path/clip-path-paddingBox-1b.html
@@ -8,7 +8,7 @@
     <link rel="help" href="https://www.w3.org/TR/css-masking-1/#the-clip-path">
     <link rel="match" href="clip-path-geometryBox-1-ref.html">
     <meta name="assert" content="Test checks whether clip-path padding-box works correctly or not. This test is for clip-path applied to an SVG element.">
-    <meta name="fuzzy" content="maxDifference=0-60; totalPixels=0-394">
+    <meta name="fuzzy" content="maxDifference=0-62; totalPixels=0-420">
   </head>
   <body>
     <svg width="200" height="200" style="position: absolute; left: 0px; top: 0px;">
diff --git a/third_party/blink/web_tests/external/wpt/css/css-masking/clip-path/clip-path-viewBox-1a.html b/third_party/blink/web_tests/external/wpt/css/css-masking/clip-path/clip-path-viewBox-1a.html
index f8fb4f9..5b029e1 100644
--- a/third_party/blink/web_tests/external/wpt/css/css-masking/clip-path/clip-path-viewBox-1a.html
+++ b/third_party/blink/web_tests/external/wpt/css/css-masking/clip-path/clip-path-viewBox-1a.html
@@ -8,7 +8,7 @@
     <link rel="help" href="https://www.w3.org/TR/css-masking-1/#the-clip-path">
     <link rel="match" href="clip-path-geometryBox-1-ref.html">
     <meta name="assert" content="Test checks whether clip-path view-box works correctly or not.">
-    <meta name="fuzzy" content="maxDifference=0-60; totalPixels=0-394">
+    <meta name="fuzzy" content="maxDifference=0-62; totalPixels=0-420">
   </head>
   <body>
     <svg width="200" height="200" style="position: absolute; left: 10px; top: 10px;">
diff --git a/third_party/blink/web_tests/external/wpt/css/css-masking/clip-path/svg-clip-path-circle-offset.html b/third_party/blink/web_tests/external/wpt/css/css-masking/clip-path/svg-clip-path-circle-offset.html
index 975f941..ec4cbaeb 100644
--- a/third_party/blink/web_tests/external/wpt/css/css-masking/clip-path/svg-clip-path-circle-offset.html
+++ b/third_party/blink/web_tests/external/wpt/css/css-masking/clip-path/svg-clip-path-circle-offset.html
@@ -4,7 +4,7 @@
 <link rel="help" href="https://drafts.fxtf.org/css-masking/#the-clip-path">
 <link rel="match" href="svg-clip-path-circle-offset-ref.html">
 <!-- Allow antialised pixel differences along the edge of the circle -->
-<meta name="fuzzy" content="maxDifference=0-60; totalPixels=0-394">
+<meta name="fuzzy" content="maxDifference=0-62; totalPixels=0-420">
 <svg>
   <rect x="30" y="30" width="100" height="100" fill="green" style="clip-path: circle(50%)"/>
 </svg>
diff --git a/third_party/blink/web_tests/external/wpt/css/css-masking/clip-path/svg-clip-path-ellipse-offset.html b/third_party/blink/web_tests/external/wpt/css/css-masking/clip-path/svg-clip-path-ellipse-offset.html
index 3925926..2b0876e 100644
--- a/third_party/blink/web_tests/external/wpt/css/css-masking/clip-path/svg-clip-path-ellipse-offset.html
+++ b/third_party/blink/web_tests/external/wpt/css/css-masking/clip-path/svg-clip-path-ellipse-offset.html
@@ -4,7 +4,7 @@
 <link rel="help" href="https://drafts.fxtf.org/css-masking/#the-clip-path">
 <link rel="match" href="svg-clip-path-ellipse-offset-ref.html">
 <!-- Allow antialised pixel differences along the edge of the ellipse -->
-<meta name="fuzzy" content="maxDifference=0-60; totalPixels=0-394">
+<meta name="fuzzy" content="maxDifference=0-69; totalPixels=0-394">
 <svg>
   <rect x="30" y="30" width="100" height="100" fill="green" style="clip-path: ellipse(40% 50%)"/>
 </svg>
diff --git a/third_party/blink/web_tests/external/wpt/css/css-transforms/transform3d-preserve3d-007.html b/third_party/blink/web_tests/external/wpt/css/css-transforms/transform3d-preserve3d-007.html
index 6e426e2..91310b9 100644
--- a/third_party/blink/web_tests/external/wpt/css/css-transforms/transform3d-preserve3d-007.html
+++ b/third_party/blink/web_tests/external/wpt/css/css-transforms/transform3d-preserve3d-007.html
@@ -7,7 +7,7 @@
     <meta name="assert" content="This is identical to
     transform3d-preserve3d-006.html, except with rotatey() instead of
     rotatex().">
-    <meta name="fuzzy" content="maxDifference=0-54;totalPixels=0-200">
+    <meta name="fuzzy" content="maxDifference=0-55; totalPixels=0-200">
     <link rel="match" href="transform-lime-square-ref.html">
   </head>
   <body>
diff --git a/third_party/blink/web_tests/external/wpt/loading/early-hints/preload-without-as.h2.window.js b/third_party/blink/web_tests/external/wpt/loading/early-hints/preload-without-as.h2.window.js
new file mode 100644
index 0000000..bf77210
--- /dev/null
+++ b/third_party/blink/web_tests/external/wpt/loading/early-hints/preload-without-as.h2.window.js
@@ -0,0 +1,10 @@
+// META: script=/common/utils.js
+// META: script=resources/early-hints-helpers.sub.js
+
+test(() => {
+    const params = new URLSearchParams();
+    params.set("resource-url",
+        SAME_ORIGIN_RESOURCES_URL + "/empty.js?" + token());
+    const test_url = "resources/preload-without-as.h2.py?" + params.toString();
+    window.location.replace(new URL(test_url, window.location));
+});
diff --git a/third_party/blink/web_tests/external/wpt/loading/early-hints/resources/preload-without-as.h2.py b/third_party/blink/web_tests/external/wpt/loading/early-hints/resources/preload-without-as.h2.py
new file mode 100644
index 0000000..d37a0a6
--- /dev/null
+++ b/third_party/blink/web_tests/external/wpt/loading/early-hints/resources/preload-without-as.h2.py
@@ -0,0 +1,24 @@
+import os
+
+
+def handle_headers(frame, request, response):
+    resource_url = request.GET.first(b"resource-url").decode()
+    link_header_value = "<{}>; rel=preload".format(resource_url)
+    early_hints = [
+        (b":status", b"103"),
+        (b"link", link_header_value),
+    ]
+    response.writer.write_raw_header_frame(headers=early_hints,
+                                           end_headers=True)
+
+    response.status = 200
+    response.headers[b"content-type"] = "text/html"
+    response.write_status_headers()
+
+
+def main(request, response):
+    current_dir = os.path.dirname(os.path.realpath(__file__))
+    file_path = os.path.join(current_dir, "preload-without-as.html")
+    with open(file_path, "r") as f:
+        test_content = f.read()
+    response.writer.write_data(item=test_content, last=True)
diff --git a/third_party/blink/web_tests/external/wpt/loading/early-hints/resources/preload-without-as.html b/third_party/blink/web_tests/external/wpt/loading/early-hints/resources/preload-without-as.html
new file mode 100644
index 0000000..f0473bd
--- /dev/null
+++ b/third_party/blink/web_tests/external/wpt/loading/early-hints/resources/preload-without-as.html
@@ -0,0 +1,15 @@
+<!DOCTYPE html>
+<meta charset=utf-8>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="early-hints-helpers.sub.js"></script>
+<body>
+<script>
+promise_test(async (t) => {
+    const params = new URLSearchParams(window.location.search);
+    const resource_url = params.get("resource-url");
+    await fetchScript(resource_url);
+    assert_false(isPreloadedByEarlyHints(resource_url));
+}, "An early hints preload without `as` attribute should be ignored.");
+</script>
+</body>
diff --git a/third_party/blink/web_tests/external/wpt/navigation-api/navigate-event/navigate-destination-getState-reload.html b/third_party/blink/web_tests/external/wpt/navigation-api/navigate-event/navigate-destination-getState-reload.html
new file mode 100644
index 0000000..b3afb72
--- /dev/null
+++ b/third_party/blink/web_tests/external/wpt/navigation-api/navigate-event/navigate-destination-getState-reload.html
@@ -0,0 +1,25 @@
+<!doctype html>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+async_test(t => {
+  // Wait for after the load event so that the navigation doesn't get converted
+  // into a replace navigation.
+  window.onload = () => t.step_timeout(() => {
+    let navState = { statevar: "state" };
+    navigation.onnavigate = t.step_func_done(e => {
+      assert_equals(e.navigationType, "reload");
+      assert_not_equals(e.destination, null);
+      assert_not_equals(e.destination.getState(), undefined);
+      assert_equals(e.destination.getState().statevar, "state");
+      assert_not_equals(e.destination.getState(), e.destination.getState());
+      assert_equals(e.destination.key, null);
+      assert_equals(e.destination.id, null);
+      assert_equals(e.destination.index, -1);
+      e.intercept();
+    });
+    navigation.updateCurrentEntry({ state: navState });
+    location.reload();
+  }, 0);
+}, "navigate event destination.getState() on location.reload()");
+</script>
diff --git a/third_party/blink/web_tests/external/wpt/svg/extensibility/foreignObject/masked.html b/third_party/blink/web_tests/external/wpt/svg/extensibility/foreignObject/masked.html
index 58efa22..1c7a332 100644
--- a/third_party/blink/web_tests/external/wpt/svg/extensibility/foreignObject/masked.html
+++ b/third_party/blink/web_tests/external/wpt/svg/extensibility/foreignObject/masked.html
@@ -3,7 +3,7 @@
 <link rel="match" href="masked-ref.html">
 <link rel="author" title="Chris Harrelson" href="mailto:chrishtr@chromium.org">
 <link rel="help" href="https://svgwg.org/svg2-draft/single-page.html#embedded-ForeignObjectElement"/>
-<meta name="fuzzy" content="maxDifference=0-36; totalPixels=0-124">
+<meta name="fuzzy" content="maxDifference=0-37; totalPixels=0-124">
 <svg style="display: block">
     <foreignObject x="0" y="0" width="32" height="32" mask="url(#circle)">
         <div style="width: 32px; height: 32px; background: green"></div>
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/getDescriptor/gen-descriptor-blocklisted.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/getDescriptor/gen-descriptor-blocklisted.https.html
index e175dce..77c09f9 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/getDescriptor/gen-descriptor-blocklisted.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/getDescriptor/gen-descriptor-blocklisted.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 'use strict';
 const test_desc = 'Make sure that getDescriptor can not access blocklisted ' +
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/getDescriptor/gen-descriptor-device-disconnects-before.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/getDescriptor/gen-descriptor-device-disconnects-before.https.html
index 771e6a9..3515e1c9 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/getDescriptor/gen-descriptor-device-disconnects-before.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/getDescriptor/gen-descriptor-device-disconnects-before.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 'use strict';
 const test_desc = 'Device disconnects before getDescriptor. ' +
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/getDescriptor/gen-descriptor-device-disconnects-during-error.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/getDescriptor/gen-descriptor-device-disconnects-during-error.https.html
index 619a4f8c..8966ef1f 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/getDescriptor/gen-descriptor-device-disconnects-during-error.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/getDescriptor/gen-descriptor-device-disconnects-during-error.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 'use strict';
 bluetooth_test(
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/getDescriptor/gen-descriptor-device-disconnects-during-success.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/getDescriptor/gen-descriptor-device-disconnects-during-success.https.html
index f8d2a253..21274a9 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/getDescriptor/gen-descriptor-device-disconnects-during-success.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/getDescriptor/gen-descriptor-device-disconnects-during-success.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 'use strict';
 bluetooth_test(
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/getDescriptor/gen-descriptor-disconnect-called-before.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/getDescriptor/gen-descriptor-disconnect-called-before.https.html
index 0d6a2ab..95df1d8 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/getDescriptor/gen-descriptor-disconnect-called-before.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/getDescriptor/gen-descriptor-disconnect-called-before.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 'use strict';
 const test_desc = 'disconnect() called before getDescriptor. ' +
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/getDescriptor/gen-descriptor-disconnect-called-during-error.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/getDescriptor/gen-descriptor-disconnect-called-during-error.https.html
index fde9ee50..3ba88ce 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/getDescriptor/gen-descriptor-disconnect-called-during-error.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/getDescriptor/gen-descriptor-disconnect-called-during-error.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 'use strict';
 bluetooth_test(
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/getDescriptor/gen-descriptor-disconnect-called-during-success.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/getDescriptor/gen-descriptor-disconnect-called-during-success.https.html
index f54a652..e04917f 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/getDescriptor/gen-descriptor-disconnect-called-during-success.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/getDescriptor/gen-descriptor-disconnect-called-during-success.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 'use strict';
 bluetooth_test(
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/getDescriptor/gen-descriptor-garbage-collection-ran-during-error.https-expected.txt b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/getDescriptor/gen-descriptor-garbage-collection-ran-during-error.https-expected.txt
deleted file mode 100644
index dec8286..0000000
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/getDescriptor/gen-descriptor-garbage-collection-ran-during-error.https-expected.txt
+++ /dev/null
@@ -1,4 +0,0 @@
-This is a testharness.js-based test.
-FAIL Garbage Collection ran during getDescriptor call that fails. Should not crash promise_test: Unhandled rejection with value: object "ReferenceError: runGarbageCollection is not defined"
-Harness: the test ran to completion.
-
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/getDescriptor/gen-descriptor-garbage-collection-ran-during-error.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/getDescriptor/gen-descriptor-garbage-collection-ran-during-error.https.html
index e6bb963..3151835 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/getDescriptor/gen-descriptor-garbage-collection-ran-during-error.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/getDescriptor/gen-descriptor-garbage-collection-ran-during-error.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 'use strict';
 bluetooth_test(() => {
@@ -29,7 +30,7 @@
         // object to get garbage collected.
         characteristic.service.device.gatt.disconnect();
       })
-      .then(runGarbageCollection)
+      .then(garbageCollect)
       .then(() => promise);
 }, 'Garbage Collection ran during getDescriptor call that fails. ' +
    'Should not crash');
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/getDescriptor/gen-descriptor-garbage-collection-ran-during-success.https-expected.txt b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/getDescriptor/gen-descriptor-garbage-collection-ran-during-success.https-expected.txt
deleted file mode 100644
index c4b9789..0000000
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/getDescriptor/gen-descriptor-garbage-collection-ran-during-success.https-expected.txt
+++ /dev/null
@@ -1,4 +0,0 @@
-This is a testharness.js-based test.
-FAIL Garbage Collection ran during a getDescriptor call that succeeds. Should not crash. promise_test: Unhandled rejection with value: object "ReferenceError: runGarbageCollection is not defined"
-Harness: the test ran to completion.
-
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/getDescriptor/gen-descriptor-garbage-collection-ran-during-success.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/getDescriptor/gen-descriptor-garbage-collection-ran-during-success.https.html
index d58bd4d..29cc8ac 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/getDescriptor/gen-descriptor-garbage-collection-ran-during-success.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/getDescriptor/gen-descriptor-garbage-collection-ran-during-success.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 'use strict';
 bluetooth_test(() => {
@@ -28,7 +29,7 @@
         // object to get garbage collected.
         characteristic.service.device.gatt.disconnect();
       })
-      .then(runGarbageCollection)
+      .then(garbageCollect)
       .then(() => promise);
 }, 'Garbage Collection ran during a getDescriptor call that succeeds. ' +
    'Should not crash.');
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/getDescriptor/gen-descriptor-invalid-name.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/getDescriptor/gen-descriptor-invalid-name.https.html
index 84db2e1d..d452588 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/getDescriptor/gen-descriptor-invalid-name.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/getDescriptor/gen-descriptor-invalid-name.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 'use strict';
 bluetooth_test(() => {
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/getDescriptor/gen-device-out-of-range.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/getDescriptor/gen-device-out-of-range.https.html
index 42863cf..4665bd9 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/getDescriptor/gen-device-out-of-range.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/getDescriptor/gen-device-out-of-range.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 // TODO(672127) Use this test case to test the rest of characteristic functions.
 'use strict';
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/getDescriptors/gen-descriptor-blocklisted.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/getDescriptors/gen-descriptor-blocklisted.https.html
index 54c282cfc..383eb5a0 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/getDescriptors/gen-descriptor-blocklisted.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/getDescriptors/gen-descriptor-blocklisted.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 'use strict';
 const test_desc = 'Make sure that getDescriptors can not access blocklisted ' +
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/getDescriptors/gen-descriptor-device-disconnects-before-with-uuid.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/getDescriptors/gen-descriptor-device-disconnects-before-with-uuid.https.html
index e08aae2..1d05ec7 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/getDescriptors/gen-descriptor-device-disconnects-before-with-uuid.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/getDescriptors/gen-descriptor-device-disconnects-before-with-uuid.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 'use strict';
 const test_desc = 'Device disconnects before getDescriptors. ' +
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/getDescriptors/gen-descriptor-device-disconnects-before.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/getDescriptors/gen-descriptor-device-disconnects-before.https.html
index e224dc0b..dcbd9b97 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/getDescriptors/gen-descriptor-device-disconnects-before.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/getDescriptors/gen-descriptor-device-disconnects-before.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 'use strict';
 const test_desc = 'Device disconnects before getDescriptors. ' +
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/getDescriptors/gen-descriptor-device-disconnects-during-error-with-uuid.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/getDescriptors/gen-descriptor-device-disconnects-during-error-with-uuid.https.html
index 3e8da2c..25e210a 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/getDescriptors/gen-descriptor-device-disconnects-during-error-with-uuid.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/getDescriptors/gen-descriptor-device-disconnects-during-error-with-uuid.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 'use strict';
 bluetooth_test(
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/getDescriptors/gen-descriptor-device-disconnects-during-error.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/getDescriptors/gen-descriptor-device-disconnects-during-error.https.html
index 041e6c9..0ea5214e 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/getDescriptors/gen-descriptor-device-disconnects-during-error.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/getDescriptors/gen-descriptor-device-disconnects-during-error.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 'use strict';
 bluetooth_test(
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/getDescriptors/gen-descriptor-device-disconnects-during-success-with-uuid.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/getDescriptors/gen-descriptor-device-disconnects-during-success-with-uuid.https.html
index 9406b8f5..8dd9c65 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/getDescriptors/gen-descriptor-device-disconnects-during-success-with-uuid.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/getDescriptors/gen-descriptor-device-disconnects-during-success-with-uuid.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 'use strict';
 bluetooth_test(
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/getDescriptors/gen-descriptor-device-disconnects-during-success.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/getDescriptors/gen-descriptor-device-disconnects-during-success.https.html
index 3307ec0..622ba10 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/getDescriptors/gen-descriptor-device-disconnects-during-success.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/getDescriptors/gen-descriptor-device-disconnects-during-success.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 'use strict';
 bluetooth_test(
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/getDescriptors/gen-descriptor-disconnect-called-before-with-uuid.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/getDescriptors/gen-descriptor-disconnect-called-before-with-uuid.https.html
index 9e3bb74..cd7c3eb 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/getDescriptors/gen-descriptor-disconnect-called-before-with-uuid.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/getDescriptors/gen-descriptor-disconnect-called-before-with-uuid.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 'use strict';
 const test_desc = 'disconnect() called before getDescriptors. ' +
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/getDescriptors/gen-descriptor-disconnect-called-before.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/getDescriptors/gen-descriptor-disconnect-called-before.https.html
index 566f453..4e350f7 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/getDescriptors/gen-descriptor-disconnect-called-before.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/getDescriptors/gen-descriptor-disconnect-called-before.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 'use strict';
 const test_desc = 'disconnect() called before getDescriptors. ' +
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/getDescriptors/gen-descriptor-disconnect-called-during-error-with-uuid.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/getDescriptors/gen-descriptor-disconnect-called-during-error-with-uuid.https.html
index 45aa8e8..c65a63e5 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/getDescriptors/gen-descriptor-disconnect-called-during-error-with-uuid.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/getDescriptors/gen-descriptor-disconnect-called-during-error-with-uuid.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 'use strict';
 bluetooth_test(
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/getDescriptors/gen-descriptor-disconnect-called-during-error.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/getDescriptors/gen-descriptor-disconnect-called-during-error.https.html
index 513c1cd..0dcb4c86d 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/getDescriptors/gen-descriptor-disconnect-called-during-error.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/getDescriptors/gen-descriptor-disconnect-called-during-error.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 'use strict';
 bluetooth_test(
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/getDescriptors/gen-descriptor-disconnect-called-during-success-with-uuid.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/getDescriptors/gen-descriptor-disconnect-called-during-success-with-uuid.https.html
index 4b6441a6..2f82d8ee 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/getDescriptors/gen-descriptor-disconnect-called-during-success-with-uuid.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/getDescriptors/gen-descriptor-disconnect-called-during-success-with-uuid.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 'use strict';
 bluetooth_test(
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/getDescriptors/gen-descriptor-disconnect-called-during-success.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/getDescriptors/gen-descriptor-disconnect-called-during-success.https.html
index 271f8c4..c6d84e9 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/getDescriptors/gen-descriptor-disconnect-called-during-success.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/getDescriptors/gen-descriptor-disconnect-called-during-success.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 'use strict';
 bluetooth_test(
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/getDescriptors/gen-descriptor-garbage-collection-ran-during-error-with-uuid.https-expected.txt b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/getDescriptors/gen-descriptor-garbage-collection-ran-during-error-with-uuid.https-expected.txt
deleted file mode 100644
index 64dace8..0000000
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/getDescriptors/gen-descriptor-garbage-collection-ran-during-error-with-uuid.https-expected.txt
+++ /dev/null
@@ -1,4 +0,0 @@
-This is a testharness.js-based test.
-FAIL Garbage Collection ran during getDescriptors call that fails. Should not crash promise_test: Unhandled rejection with value: object "ReferenceError: runGarbageCollection is not defined"
-Harness: the test ran to completion.
-
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/getDescriptors/gen-descriptor-garbage-collection-ran-during-error-with-uuid.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/getDescriptors/gen-descriptor-garbage-collection-ran-during-error-with-uuid.https.html
index 627cd482..f0b98d2 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/getDescriptors/gen-descriptor-garbage-collection-ran-during-error-with-uuid.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/getDescriptors/gen-descriptor-garbage-collection-ran-during-error-with-uuid.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 'use strict';
 bluetooth_test(() => {
@@ -29,7 +30,7 @@
         // object to get garbage collected.
         characteristic.service.device.gatt.disconnect();
       })
-      .then(runGarbageCollection)
+      .then(garbageCollect)
       .then(() => promise);
 }, 'Garbage Collection ran during getDescriptors call that fails. ' +
    'Should not crash');
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/getDescriptors/gen-descriptor-garbage-collection-ran-during-error.https-expected.txt b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/getDescriptors/gen-descriptor-garbage-collection-ran-during-error.https-expected.txt
deleted file mode 100644
index 64dace8..0000000
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/getDescriptors/gen-descriptor-garbage-collection-ran-during-error.https-expected.txt
+++ /dev/null
@@ -1,4 +0,0 @@
-This is a testharness.js-based test.
-FAIL Garbage Collection ran during getDescriptors call that fails. Should not crash promise_test: Unhandled rejection with value: object "ReferenceError: runGarbageCollection is not defined"
-Harness: the test ran to completion.
-
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/getDescriptors/gen-descriptor-garbage-collection-ran-during-error.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/getDescriptors/gen-descriptor-garbage-collection-ran-during-error.https.html
index 308d7b04..3aedb26 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/getDescriptors/gen-descriptor-garbage-collection-ran-during-error.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/getDescriptors/gen-descriptor-garbage-collection-ran-during-error.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 'use strict';
 bluetooth_test(() => {
@@ -29,7 +30,7 @@
         // object to get garbage collected.
         characteristic.service.device.gatt.disconnect();
       })
-      .then(runGarbageCollection)
+      .then(garbageCollect)
       .then(() => promise);
 }, 'Garbage Collection ran during getDescriptors call that fails. ' +
    'Should not crash');
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/getDescriptors/gen-descriptor-garbage-collection-ran-during-success-with-uuid.https-expected.txt b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/getDescriptors/gen-descriptor-garbage-collection-ran-during-success-with-uuid.https-expected.txt
deleted file mode 100644
index 961e30eb..0000000
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/getDescriptors/gen-descriptor-garbage-collection-ran-during-success-with-uuid.https-expected.txt
+++ /dev/null
@@ -1,4 +0,0 @@
-This is a testharness.js-based test.
-FAIL Garbage Collection ran during a getDescriptors call that succeeds. Should not crash. promise_test: Unhandled rejection with value: object "ReferenceError: runGarbageCollection is not defined"
-Harness: the test ran to completion.
-
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/getDescriptors/gen-descriptor-garbage-collection-ran-during-success-with-uuid.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/getDescriptors/gen-descriptor-garbage-collection-ran-during-success-with-uuid.https.html
index 830eea7..538bf73 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/getDescriptors/gen-descriptor-garbage-collection-ran-during-success-with-uuid.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/getDescriptors/gen-descriptor-garbage-collection-ran-during-success-with-uuid.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 'use strict';
 bluetooth_test(() => {
@@ -28,7 +29,7 @@
         // object to get garbage collected.
         characteristic.service.device.gatt.disconnect();
       })
-      .then(runGarbageCollection)
+      .then(garbageCollect)
       .then(() => promise);
 }, 'Garbage Collection ran during a getDescriptors call that succeeds. ' +
    'Should not crash.');
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/getDescriptors/gen-descriptor-garbage-collection-ran-during-success.https-expected.txt b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/getDescriptors/gen-descriptor-garbage-collection-ran-during-success.https-expected.txt
deleted file mode 100644
index 961e30eb..0000000
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/getDescriptors/gen-descriptor-garbage-collection-ran-during-success.https-expected.txt
+++ /dev/null
@@ -1,4 +0,0 @@
-This is a testharness.js-based test.
-FAIL Garbage Collection ran during a getDescriptors call that succeeds. Should not crash. promise_test: Unhandled rejection with value: object "ReferenceError: runGarbageCollection is not defined"
-Harness: the test ran to completion.
-
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/getDescriptors/gen-descriptor-garbage-collection-ran-during-success.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/getDescriptors/gen-descriptor-garbage-collection-ran-during-success.https.html
index b8bb7c11..2920d9bd 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/getDescriptors/gen-descriptor-garbage-collection-ran-during-success.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/getDescriptors/gen-descriptor-garbage-collection-ran-during-success.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 'use strict';
 bluetooth_test(() => {
@@ -28,7 +29,7 @@
         // object to get garbage collected.
         characteristic.service.device.gatt.disconnect();
       })
-      .then(runGarbageCollection)
+      .then(garbageCollect)
       .then(() => promise);
 }, 'Garbage Collection ran during a getDescriptors call that succeeds. ' +
    'Should not crash.');
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/getDescriptors/gen-descriptor-invalid-name.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/getDescriptors/gen-descriptor-invalid-name.https.html
index a71ea64..a5104da 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/getDescriptors/gen-descriptor-invalid-name.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/getDescriptors/gen-descriptor-invalid-name.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 'use strict';
 bluetooth_test(() => {
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/getDescriptors/gen-device-out-of-range-with-uuid.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/getDescriptors/gen-device-out-of-range-with-uuid.https.html
index f8c3edb..fc0bab8 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/getDescriptors/gen-device-out-of-range-with-uuid.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/getDescriptors/gen-device-out-of-range-with-uuid.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 // TODO(672127) Use this test case to test the rest of characteristic functions.
 'use strict';
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/getDescriptors/gen-device-out-of-range.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/getDescriptors/gen-device-out-of-range.https.html
index 7ccd367..79cc696 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/getDescriptors/gen-device-out-of-range.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/getDescriptors/gen-device-out-of-range.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 // TODO(672127) Use this test case to test the rest of characteristic functions.
 'use strict';
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/notifications/gc-with-event-listener.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/notifications/gc-with-event-listener.https.html
index 2fb9231..72bc53a 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/notifications/gc-with-event-listener.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/notifications/gc-with-event-listener.https.html
@@ -5,6 +5,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 'use strict';
 bluetooth_test(async () => {
@@ -39,7 +40,7 @@
 
   // At this point all the variables above should be out of scope and so this
   // will free them.
-  GCController.collect();
+  garbageCollect();
 
   // The event listener should still be active.
   expectingEvent = true;
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/notifications/gc-with-pending-start.https-expected.txt b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/notifications/gc-with-pending-start.https-expected.txt
deleted file mode 100644
index 802841f..0000000
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/notifications/gc-with-pending-start.https-expected.txt
+++ /dev/null
@@ -1,4 +0,0 @@
-This is a testharness.js-based test.
-FAIL Object gets garbage collected while start request is pending. Make sure we don' crash. promise_test: Unhandled rejection with value: object "ReferenceError: runGarbageCollection is not defined"
-Harness: the test ran to completion.
-
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/notifications/gc-with-pending-start.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/notifications/gc-with-pending-start.https.html
index 27544c84..6393f6f94 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/notifications/gc-with-pending-start.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/notifications/gc-with-pending-start.https.html
@@ -5,6 +5,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 'use strict';
 bluetooth_test(() => {
@@ -20,7 +21,7 @@
       // We intentionally don't return the promise so that 'characteristic' goes
       // out of scope while the request is still pending.
     })
-    .then(() => runGarbageCollection())
+    .then(() => garbageCollect())
     .then(() => start_promise);
   // TODO(ortuno): Assert that notifications are not active.
   // http://crbug.com/600762
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/notifications/gc-with-pending-stop.https-expected.txt b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/notifications/gc-with-pending-stop.https-expected.txt
deleted file mode 100644
index c8e0dd6..0000000
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/notifications/gc-with-pending-stop.https-expected.txt
+++ /dev/null
@@ -1,4 +0,0 @@
-This is a testharness.js-based test.
-FAIL Object gets garbage collected while stop request is pending. Make sure we don't crash while the request is pending. promise_test: Unhandled rejection with value: object "ReferenceError: runGarbageCollection is not defined"
-Harness: the test ran to completion.
-
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/notifications/gc-with-pending-stop.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/notifications/gc-with-pending-stop.https.html
index 76e0ce7d..10625b7b 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/notifications/gc-with-pending-stop.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/notifications/gc-with-pending-stop.https.html
@@ -5,6 +5,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 'use strict';
 bluetooth_test(() => {
@@ -22,7 +23,7 @@
         // goes out of scope while the request is still pending.
       });
     })
-    .then(() => runGarbageCollection())
+    .then(() => garbageCollect())
     .then(() => stop_promise);
   // TODO(ortuno): Assert that notifications are not active.
   // http://crbug.com/600762
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/readValue/gen-gatt-op-device-disconnects-before.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/readValue/gen-gatt-op-device-disconnects-before.https.html
index ea7f56e..fa5ac08 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/readValue/gen-gatt-op-device-disconnects-before.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/readValue/gen-gatt-op-device-disconnects-before.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 'use strict';
 const test_desc = 'Device disconnects before readValue. ' +
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/readValue/gen-gatt-op-device-disconnects-during-error.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/readValue/gen-gatt-op-device-disconnects-during-error.https.html
index dda1bac4..7758fc9 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/readValue/gen-gatt-op-device-disconnects-during-error.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/readValue/gen-gatt-op-device-disconnects-during-error.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 'use strict';
 bluetooth_test(() => {
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/readValue/gen-gatt-op-device-disconnects-during-success.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/readValue/gen-gatt-op-device-disconnects-during-success.https.html
index 95a83eb..08c3e268 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/readValue/gen-gatt-op-device-disconnects-during-success.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/readValue/gen-gatt-op-device-disconnects-during-success.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 'use strict';
 bluetooth_test(() => {
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/readValue/gen-gatt-op-device-reconnects-during-error.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/readValue/gen-gatt-op-device-reconnects-during-error.https.html
index aefd362..aa82865c 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/readValue/gen-gatt-op-device-reconnects-during-error.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/readValue/gen-gatt-op-device-reconnects-during-error.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 bluetooth_test(() => {
   let val = new Uint8Array([1]);
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/readValue/gen-gatt-op-device-reconnects-during-success.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/readValue/gen-gatt-op-device-reconnects-during-success.https.html
index 67acab2..e1251cd6 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/readValue/gen-gatt-op-device-reconnects-during-success.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/readValue/gen-gatt-op-device-reconnects-during-success.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 bluetooth_test(() => {
   let val = new Uint8Array([1]);
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/readValue/gen-gatt-op-disconnect-called-before.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/readValue/gen-gatt-op-disconnect-called-before.https.html
index aa96ab7..a55622d 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/readValue/gen-gatt-op-disconnect-called-before.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/readValue/gen-gatt-op-disconnect-called-before.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 'use strict';
 const test_desc = 'disconnect() called before readValue. ' +
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/readValue/gen-gatt-op-disconnect-called-during-error.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/readValue/gen-gatt-op-disconnect-called-during-error.https.html
index b3d20c4..aaeaf72 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/readValue/gen-gatt-op-disconnect-called-during-error.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/readValue/gen-gatt-op-disconnect-called-during-error.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 'use strict';
 bluetooth_test(() => {
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/readValue/gen-gatt-op-disconnect-called-during-success.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/readValue/gen-gatt-op-disconnect-called-during-success.https.html
index 559ad039..34750ef 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/readValue/gen-gatt-op-disconnect-called-during-success.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/readValue/gen-gatt-op-disconnect-called-during-success.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 'use strict';
 bluetooth_test(() => {
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/readValue/gen-gatt-op-garbage-collection-ran-during-error.https-expected.txt b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/readValue/gen-gatt-op-garbage-collection-ran-during-error.https-expected.txt
deleted file mode 100644
index 72afe73..0000000
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/readValue/gen-gatt-op-garbage-collection-ran-during-error.https-expected.txt
+++ /dev/null
@@ -1,4 +0,0 @@
-This is a testharness.js-based test.
-FAIL Garbage Collection ran during a readValue call that fails. Should not crash. promise_test: Unhandled rejection with value: object "ReferenceError: runGarbageCollection is not defined"
-Harness: the test ran to completion.
-
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/readValue/gen-gatt-op-garbage-collection-ran-during-error.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/readValue/gen-gatt-op-garbage-collection-ran-during-error.https.html
index a4dd7118..9254af2 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/readValue/gen-gatt-op-garbage-collection-ran-during-error.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/readValue/gen-gatt-op-garbage-collection-ran-during-error.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 'use strict';
 bluetooth_test(() => {
@@ -28,7 +29,7 @@
       // object to get garbage collected.
       error_characteristic.service.device.gatt.disconnect();
     })
-    .then(runGarbageCollection)
+    .then(garbageCollect)
     .then(() => promise);
 }, 'Garbage Collection ran during a readValue call that fails. ' +
    'Should not crash.');
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/readValue/gen-gatt-op-garbage-collection-ran-during-success.https-expected.txt b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/readValue/gen-gatt-op-garbage-collection-ran-during-success.https-expected.txt
deleted file mode 100644
index 9571e9a0..0000000
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/readValue/gen-gatt-op-garbage-collection-ran-during-success.https-expected.txt
+++ /dev/null
@@ -1,4 +0,0 @@
-This is a testharness.js-based test.
-FAIL Garbage collection ran during a readValue call that succeeds. Should not crash. promise_test: Unhandled rejection with value: object "ReferenceError: runGarbageCollection is not defined"
-Harness: the test ran to completion.
-
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/readValue/gen-gatt-op-garbage-collection-ran-during-success.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/readValue/gen-gatt-op-garbage-collection-ran-during-success.https.html
index f227f4c..0f718c7 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/readValue/gen-gatt-op-garbage-collection-ran-during-success.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/readValue/gen-gatt-op-garbage-collection-ran-during-success.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 'use strict';
 bluetooth_test(() => {
@@ -28,7 +29,7 @@
       // object to get garbage collected.
       measurement_interval.service.device.gatt.disconnect();
     })
-    .then(runGarbageCollection)
+    .then(garbageCollect)
     .then(() => promise);
 }, 'Garbage collection ran during a readValue call that succeeds. ' +
    'Should not crash.');
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/readValue/gen-gatt-op-reconnect-during-error.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/readValue/gen-gatt-op-reconnect-during-error.https.html
index c088a4ea..12718ae35 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/readValue/gen-gatt-op-reconnect-during-error.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/readValue/gen-gatt-op-reconnect-during-error.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 bluetooth_test(() => {
   let val = new Uint8Array([1]);
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/readValue/gen-gatt-op-reconnect-during-success.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/readValue/gen-gatt-op-reconnect-during-success.https.html
index 61ea75c9..2f1f806 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/readValue/gen-gatt-op-reconnect-during-success.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/readValue/gen-gatt-op-reconnect-during-success.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 bluetooth_test(() => {
   let val = new Uint8Array([1]);
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/startNotifications/gen-gatt-op-device-disconnects-before.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/startNotifications/gen-gatt-op-device-disconnects-before.https.html
index d4385374..b240c44 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/startNotifications/gen-gatt-op-device-disconnects-before.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/startNotifications/gen-gatt-op-device-disconnects-before.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 'use strict';
 const test_desc = 'Device disconnects before startNotifications. ' +
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/startNotifications/gen-gatt-op-device-disconnects-during-error.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/startNotifications/gen-gatt-op-device-disconnects-during-error.https.html
index de35e0a..92250a83 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/startNotifications/gen-gatt-op-device-disconnects-during-error.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/startNotifications/gen-gatt-op-device-disconnects-during-error.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 'use strict';
 bluetooth_test(() => {
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/startNotifications/gen-gatt-op-device-disconnects-during-success.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/startNotifications/gen-gatt-op-device-disconnects-during-success.https.html
index 580aaf3..930ff53 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/startNotifications/gen-gatt-op-device-disconnects-during-success.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/startNotifications/gen-gatt-op-device-disconnects-during-success.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 'use strict';
 bluetooth_test(() => {
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/startNotifications/gen-gatt-op-device-reconnects-during-error.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/startNotifications/gen-gatt-op-device-reconnects-during-error.https.html
index 8dbc32f..2be3cd1 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/startNotifications/gen-gatt-op-device-reconnects-during-error.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/startNotifications/gen-gatt-op-device-reconnects-during-error.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 bluetooth_test(() => {
   let val = new Uint8Array([1]);
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/startNotifications/gen-gatt-op-device-reconnects-during-success.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/startNotifications/gen-gatt-op-device-reconnects-during-success.https.html
index 5cc19c6c..300a404 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/startNotifications/gen-gatt-op-device-reconnects-during-success.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/startNotifications/gen-gatt-op-device-reconnects-during-success.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 bluetooth_test(() => {
   let val = new Uint8Array([1]);
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/startNotifications/gen-gatt-op-disconnect-called-before.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/startNotifications/gen-gatt-op-disconnect-called-before.https.html
index da29e6d..2a0be6c7 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/startNotifications/gen-gatt-op-disconnect-called-before.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/startNotifications/gen-gatt-op-disconnect-called-before.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 'use strict';
 const test_desc = 'disconnect() called before startNotifications. ' +
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/startNotifications/gen-gatt-op-disconnect-called-during-error.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/startNotifications/gen-gatt-op-disconnect-called-during-error.https.html
index 14038b9a..e1e0e9e 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/startNotifications/gen-gatt-op-disconnect-called-during-error.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/startNotifications/gen-gatt-op-disconnect-called-during-error.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 'use strict';
 bluetooth_test(() => {
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/startNotifications/gen-gatt-op-disconnect-called-during-success.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/startNotifications/gen-gatt-op-disconnect-called-during-success.https.html
index afd8273..4b08d42 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/startNotifications/gen-gatt-op-disconnect-called-during-success.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/startNotifications/gen-gatt-op-disconnect-called-during-success.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 'use strict';
 bluetooth_test(() => {
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/startNotifications/gen-gatt-op-garbage-collection-ran-during-error.https-expected.txt b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/startNotifications/gen-gatt-op-garbage-collection-ran-during-error.https-expected.txt
deleted file mode 100644
index 583c99f..0000000
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/startNotifications/gen-gatt-op-garbage-collection-ran-during-error.https-expected.txt
+++ /dev/null
@@ -1,4 +0,0 @@
-This is a testharness.js-based test.
-FAIL Garbage Collection ran during a startNotifications call that fails. Should not crash. promise_test: Unhandled rejection with value: object "ReferenceError: runGarbageCollection is not defined"
-Harness: the test ran to completion.
-
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/startNotifications/gen-gatt-op-garbage-collection-ran-during-error.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/startNotifications/gen-gatt-op-garbage-collection-ran-during-error.https.html
index ebe5fcb..297f193 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/startNotifications/gen-gatt-op-garbage-collection-ran-during-error.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/startNotifications/gen-gatt-op-garbage-collection-ran-during-error.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 'use strict';
 bluetooth_test(() => {
@@ -28,7 +29,7 @@
       // object to get garbage collected.
       error_characteristic.service.device.gatt.disconnect();
     })
-    .then(runGarbageCollection)
+    .then(garbageCollect)
     .then(() => promise);
 }, 'Garbage Collection ran during a startNotifications call that fails. ' +
    'Should not crash.');
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/startNotifications/gen-gatt-op-garbage-collection-ran-during-success.https-expected.txt b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/startNotifications/gen-gatt-op-garbage-collection-ran-during-success.https-expected.txt
deleted file mode 100644
index 74bbcb76..0000000
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/startNotifications/gen-gatt-op-garbage-collection-ran-during-success.https-expected.txt
+++ /dev/null
@@ -1,4 +0,0 @@
-This is a testharness.js-based test.
-FAIL Garbage collection ran during a startNotifications call that succeeds. Should not crash. promise_test: Unhandled rejection with value: object "ReferenceError: runGarbageCollection is not defined"
-Harness: the test ran to completion.
-
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/startNotifications/gen-gatt-op-garbage-collection-ran-during-success.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/startNotifications/gen-gatt-op-garbage-collection-ran-during-success.https.html
index a7f0b27..60f58e8 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/startNotifications/gen-gatt-op-garbage-collection-ran-during-success.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/startNotifications/gen-gatt-op-garbage-collection-ran-during-success.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 'use strict';
 bluetooth_test(() => {
@@ -28,7 +29,7 @@
       // object to get garbage collected.
       measurement_interval.service.device.gatt.disconnect();
     })
-    .then(runGarbageCollection)
+    .then(garbageCollect)
     .then(() => promise);
 }, 'Garbage collection ran during a startNotifications call that succeeds. ' +
    'Should not crash.');
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/startNotifications/gen-gatt-op-reconnect-during-error.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/startNotifications/gen-gatt-op-reconnect-during-error.https.html
index 5d4f548..d34fed4e 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/startNotifications/gen-gatt-op-reconnect-during-error.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/startNotifications/gen-gatt-op-reconnect-during-error.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 bluetooth_test(() => {
   let val = new Uint8Array([1]);
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/startNotifications/gen-gatt-op-reconnect-during-success.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/startNotifications/gen-gatt-op-reconnect-during-success.https.html
index b1bece9..bc0990e5 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/startNotifications/gen-gatt-op-reconnect-during-success.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/startNotifications/gen-gatt-op-reconnect-during-success.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 bluetooth_test(() => {
   let val = new Uint8Array([1]);
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/stopNotifications/gen-gatt-op-device-disconnects-before.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/stopNotifications/gen-gatt-op-device-disconnects-before.https.html
index f67961c3..e41e14a9 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/stopNotifications/gen-gatt-op-device-disconnects-before.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/stopNotifications/gen-gatt-op-device-disconnects-before.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 'use strict';
 const test_desc = 'Device disconnects before stopNotifications. ' +
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/stopNotifications/gen-gatt-op-device-disconnects-during-success.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/stopNotifications/gen-gatt-op-device-disconnects-during-success.https.html
index 0f12ccc..ad8fd57 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/stopNotifications/gen-gatt-op-device-disconnects-during-success.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/stopNotifications/gen-gatt-op-device-disconnects-during-success.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 'use strict';
 bluetooth_test(() => {
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/stopNotifications/gen-gatt-op-disconnect-called-before.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/stopNotifications/gen-gatt-op-disconnect-called-before.https.html
index 2f84f1e5..730e0d7 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/stopNotifications/gen-gatt-op-disconnect-called-before.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/stopNotifications/gen-gatt-op-disconnect-called-before.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 'use strict';
 const test_desc = 'disconnect() called before stopNotifications. ' +
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/stopNotifications/gen-gatt-op-disconnect-called-during-success.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/stopNotifications/gen-gatt-op-disconnect-called-during-success.https.html
index 3899af2..e1a8b399 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/stopNotifications/gen-gatt-op-disconnect-called-during-success.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/stopNotifications/gen-gatt-op-disconnect-called-during-success.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 'use strict';
 bluetooth_test(() => {
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/stopNotifications/gen-gatt-op-garbage-collection-ran-during-success.https-expected.txt b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/stopNotifications/gen-gatt-op-garbage-collection-ran-during-success.https-expected.txt
deleted file mode 100644
index 41910ee..0000000
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/stopNotifications/gen-gatt-op-garbage-collection-ran-during-success.https-expected.txt
+++ /dev/null
@@ -1,4 +0,0 @@
-This is a testharness.js-based test.
-FAIL Garbage collection ran during a stopNotifications call that succeeds. Should not crash. promise_test: Unhandled rejection with value: object "ReferenceError: runGarbageCollection is not defined"
-Harness: the test ran to completion.
-
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/stopNotifications/gen-gatt-op-garbage-collection-ran-during-success.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/stopNotifications/gen-gatt-op-garbage-collection-ran-during-success.https.html
index b31ace52..6746038 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/stopNotifications/gen-gatt-op-garbage-collection-ran-during-success.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/stopNotifications/gen-gatt-op-garbage-collection-ran-during-success.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 'use strict';
 bluetooth_test(() => {
@@ -28,7 +29,7 @@
       // object to get garbage collected.
       measurement_interval.service.device.gatt.disconnect();
     })
-    .then(runGarbageCollection)
+    .then(garbageCollect)
     .then(() => promise);
 }, 'Garbage collection ran during a stopNotifications call that succeeds. ' +
    'Should not crash.');
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/writeValue/gen-gatt-op-device-disconnects-before.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/writeValue/gen-gatt-op-device-disconnects-before.https.html
index ab7b1581..4b79f323 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/writeValue/gen-gatt-op-device-disconnects-before.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/writeValue/gen-gatt-op-device-disconnects-before.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 'use strict';
 const test_desc = 'Device disconnects before writeValue. ' +
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/writeValue/gen-gatt-op-device-disconnects-during-error.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/writeValue/gen-gatt-op-device-disconnects-during-error.https.html
index 7c81198..23f9195 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/writeValue/gen-gatt-op-device-disconnects-during-error.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/writeValue/gen-gatt-op-device-disconnects-during-error.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 'use strict';
 bluetooth_test(() => {
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/writeValue/gen-gatt-op-device-disconnects-during-success.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/writeValue/gen-gatt-op-device-disconnects-during-success.https.html
index bd743e9..49abba6 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/writeValue/gen-gatt-op-device-disconnects-during-success.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/writeValue/gen-gatt-op-device-disconnects-during-success.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 'use strict';
 bluetooth_test(() => {
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/writeValue/gen-gatt-op-device-reconnects-during-error.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/writeValue/gen-gatt-op-device-reconnects-during-error.https.html
index bf7c285..17387c7 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/writeValue/gen-gatt-op-device-reconnects-during-error.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/writeValue/gen-gatt-op-device-reconnects-during-error.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 bluetooth_test(() => {
   let val = new Uint8Array([1]);
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/writeValue/gen-gatt-op-device-reconnects-during-success.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/writeValue/gen-gatt-op-device-reconnects-during-success.https.html
index b85c89e..71a0759 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/writeValue/gen-gatt-op-device-reconnects-during-success.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/writeValue/gen-gatt-op-device-reconnects-during-success.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 bluetooth_test(() => {
   let val = new Uint8Array([1]);
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/writeValue/gen-gatt-op-disconnect-called-before.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/writeValue/gen-gatt-op-disconnect-called-before.https.html
index 25f15ee0..e792e73 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/writeValue/gen-gatt-op-disconnect-called-before.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/writeValue/gen-gatt-op-disconnect-called-before.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 'use strict';
 const test_desc = 'disconnect() called before writeValue. ' +
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/writeValue/gen-gatt-op-disconnect-called-during-error.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/writeValue/gen-gatt-op-disconnect-called-during-error.https.html
index 9c90965..07a6d32 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/writeValue/gen-gatt-op-disconnect-called-during-error.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/writeValue/gen-gatt-op-disconnect-called-during-error.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 'use strict';
 bluetooth_test(() => {
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/writeValue/gen-gatt-op-disconnect-called-during-success.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/writeValue/gen-gatt-op-disconnect-called-during-success.https.html
index da7c69d..72000cb9 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/writeValue/gen-gatt-op-disconnect-called-during-success.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/writeValue/gen-gatt-op-disconnect-called-during-success.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 'use strict';
 bluetooth_test(() => {
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/writeValue/gen-gatt-op-garbage-collection-ran-during-error.https-expected.txt b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/writeValue/gen-gatt-op-garbage-collection-ran-during-error.https-expected.txt
deleted file mode 100644
index 1ca5a7b..0000000
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/writeValue/gen-gatt-op-garbage-collection-ran-during-error.https-expected.txt
+++ /dev/null
@@ -1,4 +0,0 @@
-This is a testharness.js-based test.
-FAIL Garbage Collection ran during a writeValue call that fails. Should not crash. promise_test: Unhandled rejection with value: object "ReferenceError: runGarbageCollection is not defined"
-Harness: the test ran to completion.
-
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/writeValue/gen-gatt-op-garbage-collection-ran-during-error.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/writeValue/gen-gatt-op-garbage-collection-ran-during-error.https.html
index 2e69696..daf903d 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/writeValue/gen-gatt-op-garbage-collection-ran-during-error.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/writeValue/gen-gatt-op-garbage-collection-ran-during-error.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 'use strict';
 bluetooth_test(() => {
@@ -28,7 +29,7 @@
       // object to get garbage collected.
       error_characteristic.service.device.gatt.disconnect();
     })
-    .then(runGarbageCollection)
+    .then(garbageCollect)
     .then(() => promise);
 }, 'Garbage Collection ran during a writeValue call that fails. ' +
    'Should not crash.');
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/writeValue/gen-gatt-op-garbage-collection-ran-during-success.https-expected.txt b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/writeValue/gen-gatt-op-garbage-collection-ran-during-success.https-expected.txt
deleted file mode 100644
index 969ad7b..0000000
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/writeValue/gen-gatt-op-garbage-collection-ran-during-success.https-expected.txt
+++ /dev/null
@@ -1,4 +0,0 @@
-This is a testharness.js-based test.
-FAIL Garbage collection ran during a writeValue call that succeeds. Should not crash. promise_test: Unhandled rejection with value: object "ReferenceError: runGarbageCollection is not defined"
-Harness: the test ran to completion.
-
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/writeValue/gen-gatt-op-garbage-collection-ran-during-success.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/writeValue/gen-gatt-op-garbage-collection-ran-during-success.https.html
index 3ca80dba..eb442d59 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/writeValue/gen-gatt-op-garbage-collection-ran-during-success.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/writeValue/gen-gatt-op-garbage-collection-ran-during-success.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 'use strict';
 bluetooth_test(() => {
@@ -28,7 +29,7 @@
       // object to get garbage collected.
       measurement_interval.service.device.gatt.disconnect();
     })
-    .then(runGarbageCollection)
+    .then(garbageCollect)
     .then(() => promise);
 }, 'Garbage collection ran during a writeValue call that succeeds. ' +
    'Should not crash.');
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/writeValue/gen-gatt-op-reconnect-during-error.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/writeValue/gen-gatt-op-reconnect-during-error.https.html
index c6783af..b9304ad 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/writeValue/gen-gatt-op-reconnect-during-error.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/writeValue/gen-gatt-op-reconnect-during-error.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 bluetooth_test(() => {
   let val = new Uint8Array([1]);
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/writeValue/gen-gatt-op-reconnect-during-success.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/writeValue/gen-gatt-op-reconnect-during-success.https.html
index 83f6da4..685ced88 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/writeValue/gen-gatt-op-reconnect-during-success.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/writeValue/gen-gatt-op-reconnect-during-success.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 bluetooth_test(() => {
   let val = new Uint8Array([1]);
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/writeValueWithResponse/gen-gatt-op-device-disconnects-before.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/writeValueWithResponse/gen-gatt-op-device-disconnects-before.https.html
index 024e961..f2c2e8d 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/writeValueWithResponse/gen-gatt-op-device-disconnects-before.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/writeValueWithResponse/gen-gatt-op-device-disconnects-before.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 'use strict';
 const test_desc = 'Device disconnects before writeValueWithResponse. ' +
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/writeValueWithResponse/gen-gatt-op-device-disconnects-during-error.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/writeValueWithResponse/gen-gatt-op-device-disconnects-during-error.https.html
index 47291b8..c1698e96 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/writeValueWithResponse/gen-gatt-op-device-disconnects-during-error.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/writeValueWithResponse/gen-gatt-op-device-disconnects-during-error.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 'use strict';
 bluetooth_test(() => {
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/writeValueWithResponse/gen-gatt-op-device-disconnects-during-success.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/writeValueWithResponse/gen-gatt-op-device-disconnects-during-success.https.html
index cf83c37b..fb060064 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/writeValueWithResponse/gen-gatt-op-device-disconnects-during-success.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/writeValueWithResponse/gen-gatt-op-device-disconnects-during-success.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 'use strict';
 bluetooth_test(() => {
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/writeValueWithResponse/gen-gatt-op-device-reconnects-during-error.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/writeValueWithResponse/gen-gatt-op-device-reconnects-during-error.https.html
index 8183edc..562d178 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/writeValueWithResponse/gen-gatt-op-device-reconnects-during-error.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/writeValueWithResponse/gen-gatt-op-device-reconnects-during-error.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 bluetooth_test(() => {
   let val = new Uint8Array([1]);
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/writeValueWithResponse/gen-gatt-op-device-reconnects-during-success.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/writeValueWithResponse/gen-gatt-op-device-reconnects-during-success.https.html
index 976319c..0e18f4c 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/writeValueWithResponse/gen-gatt-op-device-reconnects-during-success.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/writeValueWithResponse/gen-gatt-op-device-reconnects-during-success.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 bluetooth_test(() => {
   let val = new Uint8Array([1]);
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/writeValueWithResponse/gen-gatt-op-disconnect-called-before.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/writeValueWithResponse/gen-gatt-op-disconnect-called-before.https.html
index a173193..c6d6724 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/writeValueWithResponse/gen-gatt-op-disconnect-called-before.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/writeValueWithResponse/gen-gatt-op-disconnect-called-before.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 'use strict';
 const test_desc = 'disconnect() called before writeValueWithResponse. ' +
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/writeValueWithResponse/gen-gatt-op-disconnect-called-during-error.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/writeValueWithResponse/gen-gatt-op-disconnect-called-during-error.https.html
index 9b297fa..f5c36a38 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/writeValueWithResponse/gen-gatt-op-disconnect-called-during-error.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/writeValueWithResponse/gen-gatt-op-disconnect-called-during-error.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 'use strict';
 bluetooth_test(() => {
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/writeValueWithResponse/gen-gatt-op-disconnect-called-during-success.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/writeValueWithResponse/gen-gatt-op-disconnect-called-during-success.https.html
index a432cd3..64e52b7 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/writeValueWithResponse/gen-gatt-op-disconnect-called-during-success.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/writeValueWithResponse/gen-gatt-op-disconnect-called-during-success.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 'use strict';
 bluetooth_test(() => {
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/writeValueWithResponse/gen-gatt-op-garbage-collection-ran-during-error.https-expected.txt b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/writeValueWithResponse/gen-gatt-op-garbage-collection-ran-during-error.https-expected.txt
deleted file mode 100644
index eb796f2..0000000
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/writeValueWithResponse/gen-gatt-op-garbage-collection-ran-during-error.https-expected.txt
+++ /dev/null
@@ -1,4 +0,0 @@
-This is a testharness.js-based test.
-FAIL Garbage Collection ran during a writeValueWithResponse call that fails. Should not crash. promise_test: Unhandled rejection with value: object "ReferenceError: runGarbageCollection is not defined"
-Harness: the test ran to completion.
-
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/writeValueWithResponse/gen-gatt-op-garbage-collection-ran-during-error.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/writeValueWithResponse/gen-gatt-op-garbage-collection-ran-during-error.https.html
index fec86283..f199eea 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/writeValueWithResponse/gen-gatt-op-garbage-collection-ran-during-error.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/writeValueWithResponse/gen-gatt-op-garbage-collection-ran-during-error.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 'use strict';
 bluetooth_test(() => {
@@ -28,7 +29,7 @@
       // object to get garbage collected.
       error_characteristic.service.device.gatt.disconnect();
     })
-    .then(runGarbageCollection)
+    .then(garbageCollect)
     .then(() => promise);
 }, 'Garbage Collection ran during a writeValueWithResponse call that fails. ' +
    'Should not crash.');
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/writeValueWithResponse/gen-gatt-op-garbage-collection-ran-during-success.https-expected.txt b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/writeValueWithResponse/gen-gatt-op-garbage-collection-ran-during-success.https-expected.txt
deleted file mode 100644
index caddd96..0000000
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/writeValueWithResponse/gen-gatt-op-garbage-collection-ran-during-success.https-expected.txt
+++ /dev/null
@@ -1,4 +0,0 @@
-This is a testharness.js-based test.
-FAIL Garbage collection ran during a writeValueWithResponse call that succeeds. Should not crash. promise_test: Unhandled rejection with value: object "ReferenceError: runGarbageCollection is not defined"
-Harness: the test ran to completion.
-
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/writeValueWithResponse/gen-gatt-op-garbage-collection-ran-during-success.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/writeValueWithResponse/gen-gatt-op-garbage-collection-ran-during-success.https.html
index 601c6ac..737f540 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/writeValueWithResponse/gen-gatt-op-garbage-collection-ran-during-success.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/writeValueWithResponse/gen-gatt-op-garbage-collection-ran-during-success.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 'use strict';
 bluetooth_test(() => {
@@ -28,7 +29,7 @@
       // object to get garbage collected.
       measurement_interval.service.device.gatt.disconnect();
     })
-    .then(runGarbageCollection)
+    .then(garbageCollect)
     .then(() => promise);
 }, 'Garbage collection ran during a writeValueWithResponse call that succeeds. ' +
    'Should not crash.');
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/writeValueWithResponse/gen-gatt-op-reconnect-during-error.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/writeValueWithResponse/gen-gatt-op-reconnect-during-error.https.html
index a093ff84..c7c5b71 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/writeValueWithResponse/gen-gatt-op-reconnect-during-error.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/writeValueWithResponse/gen-gatt-op-reconnect-during-error.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 bluetooth_test(() => {
   let val = new Uint8Array([1]);
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/writeValueWithResponse/gen-gatt-op-reconnect-during-success.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/writeValueWithResponse/gen-gatt-op-reconnect-during-success.https.html
index f149ab5..2ae6bfd 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/writeValueWithResponse/gen-gatt-op-reconnect-during-success.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/writeValueWithResponse/gen-gatt-op-reconnect-during-success.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 bluetooth_test(() => {
   let val = new Uint8Array([1]);
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/writeValueWithoutResponse/gen-gatt-op-device-disconnects-before.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/writeValueWithoutResponse/gen-gatt-op-device-disconnects-before.https.html
index 5078eb7..64edb79e 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/writeValueWithoutResponse/gen-gatt-op-device-disconnects-before.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/writeValueWithoutResponse/gen-gatt-op-device-disconnects-before.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 'use strict';
 const test_desc = 'Device disconnects before writeValueWithoutResponse. ' +
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/writeValueWithoutResponse/gen-gatt-op-device-disconnects-during-error.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/writeValueWithoutResponse/gen-gatt-op-device-disconnects-during-error.https.html
index 17873ee..3ba3efa 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/writeValueWithoutResponse/gen-gatt-op-device-disconnects-during-error.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/writeValueWithoutResponse/gen-gatt-op-device-disconnects-during-error.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 'use strict';
 bluetooth_test(() => {
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/writeValueWithoutResponse/gen-gatt-op-device-disconnects-during-success.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/writeValueWithoutResponse/gen-gatt-op-device-disconnects-during-success.https.html
index 3a432984..a85c4ca 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/writeValueWithoutResponse/gen-gatt-op-device-disconnects-during-success.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/writeValueWithoutResponse/gen-gatt-op-device-disconnects-during-success.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 'use strict';
 bluetooth_test(() => {
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/writeValueWithoutResponse/gen-gatt-op-device-reconnects-during-error.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/writeValueWithoutResponse/gen-gatt-op-device-reconnects-during-error.https.html
index 9d91214..72279982 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/writeValueWithoutResponse/gen-gatt-op-device-reconnects-during-error.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/writeValueWithoutResponse/gen-gatt-op-device-reconnects-during-error.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 bluetooth_test(() => {
   let val = new Uint8Array([1]);
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/writeValueWithoutResponse/gen-gatt-op-device-reconnects-during-success.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/writeValueWithoutResponse/gen-gatt-op-device-reconnects-during-success.https.html
index de998146..ef352cb 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/writeValueWithoutResponse/gen-gatt-op-device-reconnects-during-success.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/writeValueWithoutResponse/gen-gatt-op-device-reconnects-during-success.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 bluetooth_test(() => {
   let val = new Uint8Array([1]);
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/writeValueWithoutResponse/gen-gatt-op-disconnect-called-before.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/writeValueWithoutResponse/gen-gatt-op-disconnect-called-before.https.html
index 055806ba..0fbbd43 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/writeValueWithoutResponse/gen-gatt-op-disconnect-called-before.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/writeValueWithoutResponse/gen-gatt-op-disconnect-called-before.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 'use strict';
 const test_desc = 'disconnect() called before writeValueWithoutResponse. ' +
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/writeValueWithoutResponse/gen-gatt-op-disconnect-called-during-error.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/writeValueWithoutResponse/gen-gatt-op-disconnect-called-during-error.https.html
index e906907..e5a27f37 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/writeValueWithoutResponse/gen-gatt-op-disconnect-called-during-error.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/writeValueWithoutResponse/gen-gatt-op-disconnect-called-during-error.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 'use strict';
 bluetooth_test(() => {
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/writeValueWithoutResponse/gen-gatt-op-disconnect-called-during-success.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/writeValueWithoutResponse/gen-gatt-op-disconnect-called-during-success.https.html
index 7c4915d..e47a87d5 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/writeValueWithoutResponse/gen-gatt-op-disconnect-called-during-success.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/writeValueWithoutResponse/gen-gatt-op-disconnect-called-during-success.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 'use strict';
 bluetooth_test(() => {
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/writeValueWithoutResponse/gen-gatt-op-garbage-collection-ran-during-error.https-expected.txt b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/writeValueWithoutResponse/gen-gatt-op-garbage-collection-ran-during-error.https-expected.txt
deleted file mode 100644
index ab57895..0000000
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/writeValueWithoutResponse/gen-gatt-op-garbage-collection-ran-during-error.https-expected.txt
+++ /dev/null
@@ -1,4 +0,0 @@
-This is a testharness.js-based test.
-FAIL Garbage Collection ran during a writeValueWithoutResponse call that fails. Should not crash. promise_test: Unhandled rejection with value: object "ReferenceError: runGarbageCollection is not defined"
-Harness: the test ran to completion.
-
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/writeValueWithoutResponse/gen-gatt-op-garbage-collection-ran-during-error.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/writeValueWithoutResponse/gen-gatt-op-garbage-collection-ran-during-error.https.html
index ec60625..417d612 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/writeValueWithoutResponse/gen-gatt-op-garbage-collection-ran-during-error.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/writeValueWithoutResponse/gen-gatt-op-garbage-collection-ran-during-error.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 'use strict';
 bluetooth_test(() => {
@@ -28,7 +29,7 @@
       // object to get garbage collected.
       error_characteristic.service.device.gatt.disconnect();
     })
-    .then(runGarbageCollection)
+    .then(garbageCollect)
     .then(() => promise);
 }, 'Garbage Collection ran during a writeValueWithoutResponse call that fails. ' +
    'Should not crash.');
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/writeValueWithoutResponse/gen-gatt-op-garbage-collection-ran-during-success.https-expected.txt b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/writeValueWithoutResponse/gen-gatt-op-garbage-collection-ran-during-success.https-expected.txt
deleted file mode 100644
index 32b39de1..0000000
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/writeValueWithoutResponse/gen-gatt-op-garbage-collection-ran-during-success.https-expected.txt
+++ /dev/null
@@ -1,4 +0,0 @@
-This is a testharness.js-based test.
-FAIL Garbage collection ran during a writeValueWithoutResponse call that succeeds. Should not crash. promise_test: Unhandled rejection with value: object "ReferenceError: runGarbageCollection is not defined"
-Harness: the test ran to completion.
-
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/writeValueWithoutResponse/gen-gatt-op-garbage-collection-ran-during-success.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/writeValueWithoutResponse/gen-gatt-op-garbage-collection-ran-during-success.https.html
index 9474324..24e772c9 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/writeValueWithoutResponse/gen-gatt-op-garbage-collection-ran-during-success.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/writeValueWithoutResponse/gen-gatt-op-garbage-collection-ran-during-success.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 'use strict';
 bluetooth_test(() => {
@@ -28,7 +29,7 @@
       // object to get garbage collected.
       measurement_interval.service.device.gatt.disconnect();
     })
-    .then(runGarbageCollection)
+    .then(garbageCollect)
     .then(() => promise);
 }, 'Garbage collection ran during a writeValueWithoutResponse call that succeeds. ' +
    'Should not crash.');
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/writeValueWithoutResponse/gen-gatt-op-reconnect-during-error.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/writeValueWithoutResponse/gen-gatt-op-reconnect-during-error.https.html
index 6754d20..8d2735c6 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/writeValueWithoutResponse/gen-gatt-op-reconnect-during-error.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/writeValueWithoutResponse/gen-gatt-op-reconnect-during-error.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 bluetooth_test(() => {
   let val = new Uint8Array([1]);
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/writeValueWithoutResponse/gen-gatt-op-reconnect-during-success.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/writeValueWithoutResponse/gen-gatt-op-reconnect-during-success.https.html
index 1cebe193..92b7f69 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/writeValueWithoutResponse/gen-gatt-op-reconnect-during-success.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/characteristic/writeValueWithoutResponse/gen-gatt-op-reconnect-during-success.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 bluetooth_test(() => {
   let val = new Uint8Array([1]);
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/descriptor/readValue/gen-descriptor-is-removed.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/descriptor/readValue/gen-descriptor-is-removed.https.html
index 8683d26..2c24327 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/descriptor/readValue/gen-descriptor-is-removed.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/descriptor/readValue/gen-descriptor-is-removed.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 'use strict';
 const test_desc = 'Descriptor gets removed. Reject with InvalidStateError.';
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/descriptor/readValue/gen-device-goes-out-of-range.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/descriptor/readValue/gen-device-goes-out-of-range.https.html
index 137b15f..c0b4e1a 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/descriptor/readValue/gen-device-goes-out-of-range.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/descriptor/readValue/gen-device-goes-out-of-range.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 'use strict';
 bluetooth_test(() => {
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/descriptor/readValue/gen-io-op-device-disconnects-before.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/descriptor/readValue/gen-io-op-device-disconnects-before.https.html
index 6e7280e..b945cfe7 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/descriptor/readValue/gen-io-op-device-disconnects-before.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/descriptor/readValue/gen-io-op-device-disconnects-before.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 'use strict';
 function createDOMException(func) {
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/descriptor/readValue/gen-io-op-device-disconnects-during-error.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/descriptor/readValue/gen-io-op-device-disconnects-during-error.https.html
index 1e544fb..77038f9 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/descriptor/readValue/gen-io-op-device-disconnects-during-error.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/descriptor/readValue/gen-io-op-device-disconnects-during-error.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 'use strict';
 bluetooth_test(
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/descriptor/readValue/gen-io-op-device-disconnects-during-success.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/descriptor/readValue/gen-io-op-device-disconnects-during-success.https.html
index 39af933c..6d44f8c 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/descriptor/readValue/gen-io-op-device-disconnects-during-success.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/descriptor/readValue/gen-io-op-device-disconnects-during-success.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 'use strict';
 bluetooth_test(
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/descriptor/readValue/gen-io-op-device-reconnects-during-error.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/descriptor/readValue/gen-io-op-device-reconnects-during-error.https.html
index 14d704b..d59240f4 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/descriptor/readValue/gen-io-op-device-reconnects-during-error.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/descriptor/readValue/gen-io-op-device-reconnects-during-error.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 bluetooth_test(
     () => {
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/descriptor/readValue/gen-io-op-device-reconnects-during-success.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/descriptor/readValue/gen-io-op-device-reconnects-during-success.https.html
index 474e61f..1d333d4 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/descriptor/readValue/gen-io-op-device-reconnects-during-success.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/descriptor/readValue/gen-io-op-device-reconnects-during-success.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 bluetooth_test(
     () => {
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/descriptor/readValue/gen-io-op-disconnect-called-before.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/descriptor/readValue/gen-io-op-disconnect-called-before.https.html
index 53f1079..9b00b4c 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/descriptor/readValue/gen-io-op-disconnect-called-before.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/descriptor/readValue/gen-io-op-disconnect-called-before.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 'use strict';
 const test_desc = 'disconnect() called before readValue. Reject with ' +
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/descriptor/readValue/gen-io-op-disconnect-called-during-error.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/descriptor/readValue/gen-io-op-disconnect-called-during-error.https.html
index 48a92b0..d238bca 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/descriptor/readValue/gen-io-op-disconnect-called-during-error.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/descriptor/readValue/gen-io-op-disconnect-called-during-error.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 'use strict';
 const test_desc = 'disconnect() called during a readValue call that ' +
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/descriptor/readValue/gen-io-op-disconnect-called-during-success.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/descriptor/readValue/gen-io-op-disconnect-called-during-success.https.html
index 2b44a51..8e1870a 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/descriptor/readValue/gen-io-op-disconnect-called-during-success.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/descriptor/readValue/gen-io-op-disconnect-called-during-success.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 'use strict';
 const test_desc = 'disconnect() called during a readValue call that ' +
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/descriptor/readValue/gen-io-op-fails.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/descriptor/readValue/gen-io-op-fails.https.html
index 961a53b1..cc9c0a127 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/descriptor/readValue/gen-io-op-fails.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/descriptor/readValue/gen-io-op-fails.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 'use strict';
 bluetooth_test(
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/descriptor/readValue/gen-io-op-garbage-collection-ran-during-error.https-expected.txt b/third_party/blink/web_tests/wpt_internal/bluetooth/descriptor/readValue/gen-io-op-garbage-collection-ran-during-error.https-expected.txt
deleted file mode 100644
index 72afe73..0000000
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/descriptor/readValue/gen-io-op-garbage-collection-ran-during-error.https-expected.txt
+++ /dev/null
@@ -1,4 +0,0 @@
-This is a testharness.js-based test.
-FAIL Garbage Collection ran during a readValue call that fails. Should not crash. promise_test: Unhandled rejection with value: object "ReferenceError: runGarbageCollection is not defined"
-Harness: the test ran to completion.
-
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/descriptor/readValue/gen-io-op-garbage-collection-ran-during-error.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/descriptor/readValue/gen-io-op-garbage-collection-ran-during-error.https.html
index 020cc72..68b702c 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/descriptor/readValue/gen-io-op-garbage-collection-ran-during-error.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/descriptor/readValue/gen-io-op-garbage-collection-ran-during-error.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 'use strict';
 bluetooth_test(
@@ -33,7 +34,7 @@
             // object to get garbage collected.
             error_descriptor.characteristic.service.device.gatt.disconnect();
           })
-          .then(runGarbageCollection)
+          .then(garbageCollect)
           .then(() => promise);
     },
     'Garbage Collection ran during a readValue call that fails. ' +
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/descriptor/readValue/gen-io-op-garbage-collection-ran-during-success.https-expected.txt b/third_party/blink/web_tests/wpt_internal/bluetooth/descriptor/readValue/gen-io-op-garbage-collection-ran-during-success.https-expected.txt
deleted file mode 100644
index 9571e9a0..0000000
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/descriptor/readValue/gen-io-op-garbage-collection-ran-during-success.https-expected.txt
+++ /dev/null
@@ -1,4 +0,0 @@
-This is a testharness.js-based test.
-FAIL Garbage collection ran during a readValue call that succeeds. Should not crash. promise_test: Unhandled rejection with value: object "ReferenceError: runGarbageCollection is not defined"
-Harness: the test ran to completion.
-
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/descriptor/readValue/gen-io-op-garbage-collection-ran-during-success.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/descriptor/readValue/gen-io-op-garbage-collection-ran-during-success.https.html
index 42bedb72..428815bf 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/descriptor/readValue/gen-io-op-garbage-collection-ran-during-success.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/descriptor/readValue/gen-io-op-garbage-collection-ran-during-success.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 'use strict';
 bluetooth_test(
@@ -34,7 +35,7 @@
             // object to get garbage collected.
             descriptor.characteristic.service.device.gatt.disconnect();
           })
-          .then(runGarbageCollection)
+          .then(garbageCollect)
           .then(() => promise);
     },
     'Garbage collection ran during a readValue call that succeeds. ' +
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/descriptor/readValue/gen-io-op-reconnect-during-error.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/descriptor/readValue/gen-io-op-reconnect-during-error.https.html
index 988c628..1a8f325 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/descriptor/readValue/gen-io-op-reconnect-during-error.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/descriptor/readValue/gen-io-op-reconnect-during-error.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 bluetooth_test(
     () => {
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/descriptor/readValue/gen-io-op-reconnect-during-success.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/descriptor/readValue/gen-io-op-reconnect-during-success.https.html
index a47e8c9..a1b68f8 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/descriptor/readValue/gen-io-op-reconnect-during-success.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/descriptor/readValue/gen-io-op-reconnect-during-success.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 bluetooth_test(
     () => {
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/descriptor/writeValue/gen-descriptor-is-removed.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/descriptor/writeValue/gen-descriptor-is-removed.https.html
index a05a2cb..bd441b7 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/descriptor/writeValue/gen-descriptor-is-removed.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/descriptor/writeValue/gen-descriptor-is-removed.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 'use strict';
 const test_desc = 'Descriptor gets removed. Reject with InvalidStateError.';
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/descriptor/writeValue/gen-io-op-device-disconnects-before.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/descriptor/writeValue/gen-io-op-device-disconnects-before.https.html
index e6fa2f27..b3f02e17 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/descriptor/writeValue/gen-io-op-device-disconnects-before.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/descriptor/writeValue/gen-io-op-device-disconnects-before.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 'use strict';
 function createDOMException(func) {
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/descriptor/writeValue/gen-io-op-device-disconnects-during-error.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/descriptor/writeValue/gen-io-op-device-disconnects-during-error.https.html
index 92373e12..5efb841 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/descriptor/writeValue/gen-io-op-device-disconnects-during-error.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/descriptor/writeValue/gen-io-op-device-disconnects-during-error.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 'use strict';
 bluetooth_test(
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/descriptor/writeValue/gen-io-op-device-disconnects-during-success.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/descriptor/writeValue/gen-io-op-device-disconnects-during-success.https.html
index 6af39b0c..f1cdbbb 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/descriptor/writeValue/gen-io-op-device-disconnects-during-success.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/descriptor/writeValue/gen-io-op-device-disconnects-during-success.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 'use strict';
 bluetooth_test(
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/descriptor/writeValue/gen-io-op-device-reconnects-during-error.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/descriptor/writeValue/gen-io-op-device-reconnects-during-error.https.html
index 5b011408..cdd39746b 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/descriptor/writeValue/gen-io-op-device-reconnects-during-error.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/descriptor/writeValue/gen-io-op-device-reconnects-during-error.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 bluetooth_test(
     () => {
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/descriptor/writeValue/gen-io-op-device-reconnects-during-success.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/descriptor/writeValue/gen-io-op-device-reconnects-during-success.https.html
index 1b70a65e2..846c713 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/descriptor/writeValue/gen-io-op-device-reconnects-during-success.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/descriptor/writeValue/gen-io-op-device-reconnects-during-success.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 bluetooth_test(
     () => {
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/descriptor/writeValue/gen-io-op-disconnect-called-before.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/descriptor/writeValue/gen-io-op-disconnect-called-before.https.html
index 9feec49..beac96e 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/descriptor/writeValue/gen-io-op-disconnect-called-before.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/descriptor/writeValue/gen-io-op-disconnect-called-before.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 'use strict';
 const test_desc = 'disconnect() called before writeValue. Reject with ' +
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/descriptor/writeValue/gen-io-op-disconnect-called-during-error.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/descriptor/writeValue/gen-io-op-disconnect-called-during-error.https.html
index 39fe1eeb..fb08f3ee 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/descriptor/writeValue/gen-io-op-disconnect-called-during-error.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/descriptor/writeValue/gen-io-op-disconnect-called-during-error.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 'use strict';
 const test_desc = 'disconnect() called during a writeValue call that ' +
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/descriptor/writeValue/gen-io-op-disconnect-called-during-success.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/descriptor/writeValue/gen-io-op-disconnect-called-during-success.https.html
index 048fd9d..b10c85eb 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/descriptor/writeValue/gen-io-op-disconnect-called-during-success.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/descriptor/writeValue/gen-io-op-disconnect-called-during-success.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 'use strict';
 const test_desc = 'disconnect() called during a writeValue call that ' +
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/descriptor/writeValue/gen-io-op-fails.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/descriptor/writeValue/gen-io-op-fails.https.html
index 773b6b3..6b86ca5 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/descriptor/writeValue/gen-io-op-fails.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/descriptor/writeValue/gen-io-op-fails.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 'use strict';
 bluetooth_test(
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/descriptor/writeValue/gen-io-op-garbage-collection-ran-during-error.https-expected.txt b/third_party/blink/web_tests/wpt_internal/bluetooth/descriptor/writeValue/gen-io-op-garbage-collection-ran-during-error.https-expected.txt
deleted file mode 100644
index 1ca5a7b..0000000
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/descriptor/writeValue/gen-io-op-garbage-collection-ran-during-error.https-expected.txt
+++ /dev/null
@@ -1,4 +0,0 @@
-This is a testharness.js-based test.
-FAIL Garbage Collection ran during a writeValue call that fails. Should not crash. promise_test: Unhandled rejection with value: object "ReferenceError: runGarbageCollection is not defined"
-Harness: the test ran to completion.
-
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/descriptor/writeValue/gen-io-op-garbage-collection-ran-during-error.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/descriptor/writeValue/gen-io-op-garbage-collection-ran-during-error.https.html
index 1fa6af4b..0f360fc 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/descriptor/writeValue/gen-io-op-garbage-collection-ran-during-error.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/descriptor/writeValue/gen-io-op-garbage-collection-ran-during-error.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 'use strict';
 bluetooth_test(
@@ -33,7 +34,7 @@
             // object to get garbage collected.
             error_descriptor.characteristic.service.device.gatt.disconnect();
           })
-          .then(runGarbageCollection)
+          .then(garbageCollect)
           .then(() => promise);
     },
     'Garbage Collection ran during a writeValue call that fails. ' +
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/descriptor/writeValue/gen-io-op-garbage-collection-ran-during-success.https-expected.txt b/third_party/blink/web_tests/wpt_internal/bluetooth/descriptor/writeValue/gen-io-op-garbage-collection-ran-during-success.https-expected.txt
deleted file mode 100644
index 969ad7b..0000000
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/descriptor/writeValue/gen-io-op-garbage-collection-ran-during-success.https-expected.txt
+++ /dev/null
@@ -1,4 +0,0 @@
-This is a testharness.js-based test.
-FAIL Garbage collection ran during a writeValue call that succeeds. Should not crash. promise_test: Unhandled rejection with value: object "ReferenceError: runGarbageCollection is not defined"
-Harness: the test ran to completion.
-
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/descriptor/writeValue/gen-io-op-garbage-collection-ran-during-success.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/descriptor/writeValue/gen-io-op-garbage-collection-ran-during-success.https.html
index b3acc96..7df78a8 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/descriptor/writeValue/gen-io-op-garbage-collection-ran-during-success.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/descriptor/writeValue/gen-io-op-garbage-collection-ran-during-success.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 'use strict';
 bluetooth_test(
@@ -34,7 +35,7 @@
             // object to get garbage collected.
             descriptor.characteristic.service.device.gatt.disconnect();
           })
-          .then(runGarbageCollection)
+          .then(garbageCollect)
           .then(() => promise);
     },
     'Garbage collection ran during a writeValue call that succeeds. ' +
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/descriptor/writeValue/gen-io-op-reconnect-during-error.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/descriptor/writeValue/gen-io-op-reconnect-during-error.https.html
index bc451c0..0eac6dde 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/descriptor/writeValue/gen-io-op-reconnect-during-error.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/descriptor/writeValue/gen-io-op-reconnect-during-error.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 bluetooth_test(
     () => {
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/descriptor/writeValue/gen-io-op-reconnect-during-success.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/descriptor/writeValue/gen-io-op-reconnect-during-success.https.html
index 508676d..2654c00 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/descriptor/writeValue/gen-io-op-reconnect-during-success.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/descriptor/writeValue/gen-io-op-reconnect-during-success.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 bluetooth_test(
     () => {
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/script-tests/base_test.html.template b/third_party/blink/web_tests/wpt_internal/bluetooth/script-tests/base_test.html.template
index 82c9323..9a3afe56 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/script-tests/base_test.html.template
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/script-tests/base_test.html.template
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 TEST
 </script>
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/script-tests/characteristic/descriptor-garbage-collection-ran-during-error.js b/third_party/blink/web_tests/wpt_internal/bluetooth/script-tests/characteristic/descriptor-garbage-collection-ran-during-error.js
index f3a9eb8..786512f 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/script-tests/characteristic/descriptor-garbage-collection-ran-during-error.js
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/script-tests/characteristic/descriptor-garbage-collection-ran-during-error.js
@@ -22,7 +22,7 @@
         // object to get garbage collected.
         characteristic.service.device.gatt.disconnect();
       })
-      .then(runGarbageCollection)
+      .then(garbageCollect)
       .then(() => promise);
 }, 'Garbage Collection ran during FUNCTION_NAME call that fails. ' +
    'Should not crash');
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/script-tests/characteristic/descriptor-garbage-collection-ran-during-success.js b/third_party/blink/web_tests/wpt_internal/bluetooth/script-tests/characteristic/descriptor-garbage-collection-ran-during-success.js
index cde72b9..801c519 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/script-tests/characteristic/descriptor-garbage-collection-ran-during-success.js
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/script-tests/characteristic/descriptor-garbage-collection-ran-during-success.js
@@ -21,7 +21,7 @@
         // object to get garbage collected.
         characteristic.service.device.gatt.disconnect();
       })
-      .then(runGarbageCollection)
+      .then(garbageCollect)
       .then(() => promise);
 }, 'Garbage Collection ran during a FUNCTION_NAME call that succeeds. ' +
    'Should not crash.');
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/script-tests/characteristic/gatt-op-garbage-collection-ran-during-error.js b/third_party/blink/web_tests/wpt_internal/bluetooth/script-tests/characteristic/gatt-op-garbage-collection-ran-during-error.js
index 8d23fb0..e3eef16 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/script-tests/characteristic/gatt-op-garbage-collection-ran-during-error.js
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/script-tests/characteristic/gatt-op-garbage-collection-ran-during-error.js
@@ -24,7 +24,7 @@
       // object to get garbage collected.
       error_characteristic.service.device.gatt.disconnect();
     })
-    .then(runGarbageCollection)
+    .then(garbageCollect)
     .then(() => promise);
 }, 'Garbage Collection ran during a FUNCTION_NAME call that fails. ' +
    'Should not crash.');
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/script-tests/characteristic/gatt-op-garbage-collection-ran-during-success.js b/third_party/blink/web_tests/wpt_internal/bluetooth/script-tests/characteristic/gatt-op-garbage-collection-ran-during-success.js
index 1ff9a5b..2c27ce4 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/script-tests/characteristic/gatt-op-garbage-collection-ran-during-success.js
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/script-tests/characteristic/gatt-op-garbage-collection-ran-during-success.js
@@ -25,7 +25,7 @@
       // object to get garbage collected.
       measurement_interval.service.device.gatt.disconnect();
     })
-    .then(runGarbageCollection)
+    .then(garbageCollect)
     .then(() => promise);
 }, 'Garbage collection ran during a FUNCTION_NAME call that succeeds. ' +
    'Should not crash.');
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/script-tests/descriptor/io-op-garbage-collection-ran-during-error.js b/third_party/blink/web_tests/wpt_internal/bluetooth/script-tests/descriptor/io-op-garbage-collection-ran-during-error.js
index 2c3ad5bc..facabfc 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/script-tests/descriptor/io-op-garbage-collection-ran-during-error.js
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/script-tests/descriptor/io-op-garbage-collection-ran-during-error.js
@@ -24,7 +24,7 @@
             // object to get garbage collected.
             error_descriptor.characteristic.service.device.gatt.disconnect();
           })
-          .then(runGarbageCollection)
+          .then(garbageCollect)
           .then(() => promise);
     },
     'Garbage Collection ran during a FUNCTION_NAME call that fails. ' +
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/script-tests/descriptor/io-op-garbage-collection-ran-during-success.js b/third_party/blink/web_tests/wpt_internal/bluetooth/script-tests/descriptor/io-op-garbage-collection-ran-during-success.js
index f10fc33d..f6ff1be 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/script-tests/descriptor/io-op-garbage-collection-ran-during-success.js
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/script-tests/descriptor/io-op-garbage-collection-ran-during-success.js
@@ -25,7 +25,7 @@
             // object to get garbage collected.
             descriptor.characteristic.service.device.gatt.disconnect();
           })
-          .then(runGarbageCollection)
+          .then(garbageCollect)
           .then(() => promise);
     },
     'Garbage collection ran during a FUNCTION_NAME call that succeeds. ' +
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/script-tests/service/garbage-collection-ran-during-success.js b/third_party/blink/web_tests/wpt_internal/bluetooth/script-tests/service/garbage-collection-ran-during-success.js
index 074ef7ca..5d7e14f 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/script-tests/service/garbage-collection-ran-during-success.js
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/script-tests/service/garbage-collection-ran-during-success.js
@@ -20,7 +20,7 @@
       // object to get garbage collected.
       service.device.gatt.disconnect();
     })
-    .then(runGarbageCollection)
+    .then(garbageCollect)
     .then(() => promise);
 }, 'Garbage Collection ran during a FUNCTION_NAME call that succeeds. ' +
    'Should not crash.');
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/server/connect/garbage-collection-ran-during-error.https-expected.txt b/third_party/blink/web_tests/wpt_internal/bluetooth/server/connect/garbage-collection-ran-during-error.https-expected.txt
deleted file mode 100644
index 47e62b6..0000000
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/server/connect/garbage-collection-ran-during-error.https-expected.txt
+++ /dev/null
@@ -1,4 +0,0 @@
-This is a testharness.js-based test.
-FAIL Garbage collection ran during a connect call that fails. Should not crash. promise_test: Unhandled rejection with value: object "ReferenceError: runGarbageCollection is not defined"
-Harness: the test ran to completion.
-
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/server/connect/garbage-collection-ran-during-error.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/server/connect/garbage-collection-ran-during-error.https.html
index e3092b0..7ac0c20 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/server/connect/garbage-collection-ran-during-error.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/server/connect/garbage-collection-ran-during-error.https.html
@@ -5,6 +5,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 'use strict';
 bluetooth_test(t => {
@@ -14,7 +15,7 @@
     .then(device => {
       promise_rejects_dom(t, 'NetworkError', device.gatt.connect());
     })
-    .then(runGarbageCollection);
+    .then(garbageCollect);
 }, 'Garbage collection ran during a connect call that fails. ' +
    'Should not crash.');
 </script>
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/server/getPrimaryService/gen-delayed-discovery-no-permission-present-service.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/server/getPrimaryService/gen-delayed-discovery-no-permission-present-service.https.html
index a1b72e3..9f83e77 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/server/getPrimaryService/gen-delayed-discovery-no-permission-present-service.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/server/getPrimaryService/gen-delayed-discovery-no-permission-present-service.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 'use strict';
 let expected = new DOMException('Origin is not allowed to access the ' +
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/server/getPrimaryService/gen-delayed-discovery-service-found.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/server/getPrimaryService/gen-delayed-discovery-service-found.https.html
index 3445c8f..a3e567b 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/server/getPrimaryService/gen-delayed-discovery-service-found.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/server/getPrimaryService/gen-delayed-discovery-service-found.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 'use strict';
 bluetooth_test(() => {
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/server/getPrimaryService/gen-device-disconnects-before.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/server/getPrimaryService/gen-device-disconnects-before.https.html
index 7858958..7467026 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/server/getPrimaryService/gen-device-disconnects-before.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/server/getPrimaryService/gen-device-disconnects-before.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 'use strict';
 function createDOMException(func) {
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/server/getPrimaryService/gen-device-disconnects-during-error.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/server/getPrimaryService/gen-device-disconnects-during-error.https.html
index c17fca09..0482df6 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/server/getPrimaryService/gen-device-disconnects-during-error.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/server/getPrimaryService/gen-device-disconnects-during-error.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 'use strict';
 bluetooth_test(t => {
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/server/getPrimaryService/gen-device-disconnects-during-success.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/server/getPrimaryService/gen-device-disconnects-during-success.https.html
index 387094e..3653b93 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/server/getPrimaryService/gen-device-disconnects-during-success.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/server/getPrimaryService/gen-device-disconnects-during-success.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 'use strict';
 bluetooth_test(t => {
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/server/getPrimaryService/gen-device-disconnects-during.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/server/getPrimaryService/gen-device-disconnects-during.https.html
index fc511511..a4f3ead1 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/server/getPrimaryService/gen-device-disconnects-during.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/server/getPrimaryService/gen-device-disconnects-during.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 'use strict';
 bluetooth_test(() => {
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/server/getPrimaryService/gen-device-disconnects-invalidates-objects.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/server/getPrimaryService/gen-device-disconnects-invalidates-objects.https.html
index 60ac52d6..71405932 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/server/getPrimaryService/gen-device-disconnects-invalidates-objects.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/server/getPrimaryService/gen-device-disconnects-invalidates-objects.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 'use strict';
 function createDOMException(func, uuid) {
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/server/getPrimaryService/gen-device-goes-out-of-range.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/server/getPrimaryService/gen-device-goes-out-of-range.https.html
index e9cac09..d30c315 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/server/getPrimaryService/gen-device-goes-out-of-range.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/server/getPrimaryService/gen-device-goes-out-of-range.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 'use strict';
 bluetooth_test(() => {
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/server/getPrimaryService/gen-device-reconnects-during-error.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/server/getPrimaryService/gen-device-reconnects-during-error.https.html
index 52bd3b4..9fe0b0a 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/server/getPrimaryService/gen-device-reconnects-during-error.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/server/getPrimaryService/gen-device-reconnects-during-error.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 'use strict';
 bluetooth_test(() => {
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/server/getPrimaryService/gen-device-reconnects-during-success.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/server/getPrimaryService/gen-device-reconnects-during-success.https.html
index cfc07f87..1fc8490 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/server/getPrimaryService/gen-device-reconnects-during-success.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/server/getPrimaryService/gen-device-reconnects-during-success.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 'use strict';
 bluetooth_test(() => {
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/server/getPrimaryService/gen-reconnect-during-error.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/server/getPrimaryService/gen-reconnect-during-error.https.html
index 025722f..484581e 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/server/getPrimaryService/gen-reconnect-during-error.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/server/getPrimaryService/gen-reconnect-during-error.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 'use strict';
 bluetooth_test(() => {
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/server/getPrimaryService/gen-reconnect-during-success.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/server/getPrimaryService/gen-reconnect-during-success.https.html
index 8d01caa..d1e32ee 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/server/getPrimaryService/gen-reconnect-during-success.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/server/getPrimaryService/gen-reconnect-during-success.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 'use strict';
 bluetooth_test(() => {
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/server/getPrimaryServices/gen-delayed-discovery-no-permission-present-service-with-uuid.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/server/getPrimaryServices/gen-delayed-discovery-no-permission-present-service-with-uuid.https.html
index 71c1a62..33dde86 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/server/getPrimaryServices/gen-delayed-discovery-no-permission-present-service-with-uuid.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/server/getPrimaryServices/gen-delayed-discovery-no-permission-present-service-with-uuid.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 'use strict';
 let expected = new DOMException('Origin is not allowed to access the ' +
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/server/getPrimaryServices/gen-delayed-discovery-service-found-with-uuid.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/server/getPrimaryServices/gen-delayed-discovery-service-found-with-uuid.https.html
index 06aa7fe..6686a37 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/server/getPrimaryServices/gen-delayed-discovery-service-found-with-uuid.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/server/getPrimaryServices/gen-delayed-discovery-service-found-with-uuid.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 'use strict';
 bluetooth_test(() => {
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/server/getPrimaryServices/gen-delayed-discovery-service-found.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/server/getPrimaryServices/gen-delayed-discovery-service-found.https.html
index 654bf15..c9272b19 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/server/getPrimaryServices/gen-delayed-discovery-service-found.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/server/getPrimaryServices/gen-delayed-discovery-service-found.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 'use strict';
 bluetooth_test(() => {
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/server/getPrimaryServices/gen-device-disconnects-before-with-uuid.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/server/getPrimaryServices/gen-device-disconnects-before-with-uuid.https.html
index 9ac8b526..abc9fe7 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/server/getPrimaryServices/gen-device-disconnects-before-with-uuid.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/server/getPrimaryServices/gen-device-disconnects-before-with-uuid.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 'use strict';
 function createDOMException(func) {
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/server/getPrimaryServices/gen-device-disconnects-before.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/server/getPrimaryServices/gen-device-disconnects-before.https.html
index 3b3b52a..6eb8725 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/server/getPrimaryServices/gen-device-disconnects-before.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/server/getPrimaryServices/gen-device-disconnects-before.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 'use strict';
 function createDOMException(func) {
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/server/getPrimaryServices/gen-device-disconnects-during-error-with-uuid.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/server/getPrimaryServices/gen-device-disconnects-during-error-with-uuid.https.html
index 8f4203a..1ef30a7 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/server/getPrimaryServices/gen-device-disconnects-during-error-with-uuid.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/server/getPrimaryServices/gen-device-disconnects-during-error-with-uuid.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 'use strict';
 bluetooth_test(t => {
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/server/getPrimaryServices/gen-device-disconnects-during-success-with-uuid.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/server/getPrimaryServices/gen-device-disconnects-during-success-with-uuid.https.html
index 9d13be0..eac65b8 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/server/getPrimaryServices/gen-device-disconnects-during-success-with-uuid.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/server/getPrimaryServices/gen-device-disconnects-during-success-with-uuid.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 'use strict';
 bluetooth_test(t => {
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/server/getPrimaryServices/gen-device-disconnects-during-success.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/server/getPrimaryServices/gen-device-disconnects-during-success.https.html
index 8a14959c..6d3a5eba 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/server/getPrimaryServices/gen-device-disconnects-during-success.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/server/getPrimaryServices/gen-device-disconnects-during-success.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 'use strict';
 bluetooth_test(t => {
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/server/getPrimaryServices/gen-device-disconnects-during-with-uuid.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/server/getPrimaryServices/gen-device-disconnects-during-with-uuid.https.html
index c916bf91..7fd09edf 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/server/getPrimaryServices/gen-device-disconnects-during-with-uuid.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/server/getPrimaryServices/gen-device-disconnects-during-with-uuid.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 'use strict';
 bluetooth_test(() => {
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/server/getPrimaryServices/gen-device-disconnects-during.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/server/getPrimaryServices/gen-device-disconnects-during.https.html
index 9ad50237d..840d10c7 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/server/getPrimaryServices/gen-device-disconnects-during.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/server/getPrimaryServices/gen-device-disconnects-during.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 'use strict';
 bluetooth_test(() => {
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/server/getPrimaryServices/gen-device-disconnects-invalidates-objects-with-uuid.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/server/getPrimaryServices/gen-device-disconnects-invalidates-objects-with-uuid.https.html
index 9a580206..7d8a1cc 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/server/getPrimaryServices/gen-device-disconnects-invalidates-objects-with-uuid.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/server/getPrimaryServices/gen-device-disconnects-invalidates-objects-with-uuid.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 'use strict';
 function createDOMException(func, uuid) {
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/server/getPrimaryServices/gen-device-disconnects-invalidates-objects.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/server/getPrimaryServices/gen-device-disconnects-invalidates-objects.https.html
index 67ecb54..0161ef4 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/server/getPrimaryServices/gen-device-disconnects-invalidates-objects.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/server/getPrimaryServices/gen-device-disconnects-invalidates-objects.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 'use strict';
 function createDOMException(func, uuid) {
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/server/getPrimaryServices/gen-device-goes-out-of-range-with-uuid.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/server/getPrimaryServices/gen-device-goes-out-of-range-with-uuid.https.html
index ecee845..6c1c1a3 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/server/getPrimaryServices/gen-device-goes-out-of-range-with-uuid.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/server/getPrimaryServices/gen-device-goes-out-of-range-with-uuid.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 'use strict';
 bluetooth_test(() => {
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/server/getPrimaryServices/gen-device-goes-out-of-range.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/server/getPrimaryServices/gen-device-goes-out-of-range.https.html
index a694d7d..d47ad95 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/server/getPrimaryServices/gen-device-goes-out-of-range.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/server/getPrimaryServices/gen-device-goes-out-of-range.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 'use strict';
 bluetooth_test(() => {
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/server/getPrimaryServices/gen-device-reconnects-during-error-with-uuid.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/server/getPrimaryServices/gen-device-reconnects-during-error-with-uuid.https.html
index 79255d0..534e9a9 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/server/getPrimaryServices/gen-device-reconnects-during-error-with-uuid.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/server/getPrimaryServices/gen-device-reconnects-during-error-with-uuid.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 'use strict';
 bluetooth_test(() => {
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/server/getPrimaryServices/gen-device-reconnects-during-success-with-uuid.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/server/getPrimaryServices/gen-device-reconnects-during-success-with-uuid.https.html
index 8295e46..e425c0d 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/server/getPrimaryServices/gen-device-reconnects-during-success-with-uuid.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/server/getPrimaryServices/gen-device-reconnects-during-success-with-uuid.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 'use strict';
 bluetooth_test(() => {
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/server/getPrimaryServices/gen-device-reconnects-during-success.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/server/getPrimaryServices/gen-device-reconnects-during-success.https.html
index 62f8901..1cc1775 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/server/getPrimaryServices/gen-device-reconnects-during-success.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/server/getPrimaryServices/gen-device-reconnects-during-success.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 'use strict';
 bluetooth_test(() => {
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/server/getPrimaryServices/gen-reconnect-during-error-with-uuid.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/server/getPrimaryServices/gen-reconnect-during-error-with-uuid.https.html
index db309cd..abe81f08 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/server/getPrimaryServices/gen-reconnect-during-error-with-uuid.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/server/getPrimaryServices/gen-reconnect-during-error-with-uuid.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 'use strict';
 bluetooth_test(() => {
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/server/getPrimaryServices/gen-reconnect-during-success-with-uuid.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/server/getPrimaryServices/gen-reconnect-during-success-with-uuid.https.html
index 1f26ffa..e47149f 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/server/getPrimaryServices/gen-reconnect-during-success-with-uuid.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/server/getPrimaryServices/gen-reconnect-during-success-with-uuid.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 'use strict';
 bluetooth_test(() => {
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/server/getPrimaryServices/gen-reconnect-during-success.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/server/getPrimaryServices/gen-reconnect-during-success.https.html
index 0a6deecd..29b4a217 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/server/getPrimaryServices/gen-reconnect-during-success.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/server/getPrimaryServices/gen-reconnect-during-success.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 'use strict';
 bluetooth_test(() => {
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/service/getCharacteristic/gen-device-disconnects-before.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/service/getCharacteristic/gen-device-disconnects-before.https.html
index 018e086..a8356bf8 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/service/getCharacteristic/gen-device-disconnects-before.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/service/getCharacteristic/gen-device-disconnects-before.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 'use strict';
 function createDOMException(func) {
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/service/getCharacteristic/gen-device-disconnects-during.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/service/getCharacteristic/gen-device-disconnects-during.https.html
index 9892ba8..9d5890c 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/service/getCharacteristic/gen-device-disconnects-during.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/service/getCharacteristic/gen-device-disconnects-during.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 'use strict';
 bluetooth_test(() => {
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/service/getCharacteristic/gen-device-disconnects-invalidates-objects.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/service/getCharacteristic/gen-device-disconnects-invalidates-objects.https.html
index cb91f8c..fa64640 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/service/getCharacteristic/gen-device-disconnects-invalidates-objects.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/service/getCharacteristic/gen-device-disconnects-invalidates-objects.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 'use strict';
 function createDOMException(func, uuid) {
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/service/getCharacteristic/gen-device-goes-out-of-range.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/service/getCharacteristic/gen-device-goes-out-of-range.https.html
index 9faca03..28ceecd 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/service/getCharacteristic/gen-device-goes-out-of-range.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/service/getCharacteristic/gen-device-goes-out-of-range.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 'use strict';
 bluetooth_test(() => {
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/service/getCharacteristic/gen-disconnect-called-before.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/service/getCharacteristic/gen-disconnect-called-before.https.html
index 9f5acc4..9bb4f85e 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/service/getCharacteristic/gen-disconnect-called-before.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/service/getCharacteristic/gen-disconnect-called-before.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 'use strict';
 function createDOMException(func) {
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/service/getCharacteristic/gen-disconnect-called-during.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/service/getCharacteristic/gen-disconnect-called-during.https.html
index 7fbc9f5..f2819e5 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/service/getCharacteristic/gen-disconnect-called-during.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/service/getCharacteristic/gen-disconnect-called-during.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 'use strict';
 bluetooth_test(() => {
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/service/getCharacteristic/gen-disconnect-invalidates-objects.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/service/getCharacteristic/gen-disconnect-invalidates-objects.https.html
index e7b1f93d..2cf6a472 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/service/getCharacteristic/gen-disconnect-invalidates-objects.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/service/getCharacteristic/gen-disconnect-invalidates-objects.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 'use strict';
 function createDOMException(func, uuid) {
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/service/getCharacteristic/gen-garbage-collection-ran-during-success.https-expected.txt b/third_party/blink/web_tests/wpt_internal/bluetooth/service/getCharacteristic/gen-garbage-collection-ran-during-success.https-expected.txt
deleted file mode 100644
index 121fba4b..0000000
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/service/getCharacteristic/gen-garbage-collection-ran-during-success.https-expected.txt
+++ /dev/null
@@ -1,4 +0,0 @@
-This is a testharness.js-based test.
-FAIL Garbage Collection ran during a getCharacteristic call that succeeds. Should not crash. promise_test: Unhandled rejection with value: object "ReferenceError: runGarbageCollection is not defined"
-Harness: the test ran to completion.
-
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/service/getCharacteristic/gen-garbage-collection-ran-during-success.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/service/getCharacteristic/gen-garbage-collection-ran-during-success.https.html
index b0d15a8..44dcaf5 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/service/getCharacteristic/gen-garbage-collection-ran-during-success.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/service/getCharacteristic/gen-garbage-collection-ran-during-success.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 'use strict';
 bluetooth_test(() => {
@@ -26,7 +27,7 @@
       // object to get garbage collected.
       service.device.gatt.disconnect();
     })
-    .then(runGarbageCollection)
+    .then(garbageCollect)
     .then(() => promise);
 }, 'Garbage Collection ran during a getCharacteristic call that succeeds. ' +
    'Should not crash.');
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/service/getCharacteristics/gen-device-disconnects-before-with-uuid.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/service/getCharacteristics/gen-device-disconnects-before-with-uuid.https.html
index 49eaade..1157e62 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/service/getCharacteristics/gen-device-disconnects-before-with-uuid.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/service/getCharacteristics/gen-device-disconnects-before-with-uuid.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 'use strict';
 function createDOMException(func) {
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/service/getCharacteristics/gen-device-disconnects-before.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/service/getCharacteristics/gen-device-disconnects-before.https.html
index 27ae34a..9143f46 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/service/getCharacteristics/gen-device-disconnects-before.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/service/getCharacteristics/gen-device-disconnects-before.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 'use strict';
 function createDOMException(func) {
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/service/getCharacteristics/gen-device-disconnects-during-with-uuid.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/service/getCharacteristics/gen-device-disconnects-during-with-uuid.https.html
index 872324da..ecd8eb13 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/service/getCharacteristics/gen-device-disconnects-during-with-uuid.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/service/getCharacteristics/gen-device-disconnects-during-with-uuid.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 'use strict';
 bluetooth_test(() => {
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/service/getCharacteristics/gen-device-disconnects-during.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/service/getCharacteristics/gen-device-disconnects-during.https.html
index 92b0c04..789c4245 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/service/getCharacteristics/gen-device-disconnects-during.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/service/getCharacteristics/gen-device-disconnects-during.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 'use strict';
 bluetooth_test(() => {
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/service/getCharacteristics/gen-device-disconnects-invalidates-objects-with-uuid.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/service/getCharacteristics/gen-device-disconnects-invalidates-objects-with-uuid.https.html
index 7b372a2..6ac050b 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/service/getCharacteristics/gen-device-disconnects-invalidates-objects-with-uuid.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/service/getCharacteristics/gen-device-disconnects-invalidates-objects-with-uuid.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 'use strict';
 function createDOMException(func, uuid) {
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/service/getCharacteristics/gen-device-disconnects-invalidates-objects.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/service/getCharacteristics/gen-device-disconnects-invalidates-objects.https.html
index 80a370f..de2b8fa 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/service/getCharacteristics/gen-device-disconnects-invalidates-objects.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/service/getCharacteristics/gen-device-disconnects-invalidates-objects.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 'use strict';
 function createDOMException(func, uuid) {
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/service/getCharacteristics/gen-device-goes-out-of-range-with-uuid.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/service/getCharacteristics/gen-device-goes-out-of-range-with-uuid.https.html
index 711e726..89a4ab88 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/service/getCharacteristics/gen-device-goes-out-of-range-with-uuid.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/service/getCharacteristics/gen-device-goes-out-of-range-with-uuid.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 'use strict';
 bluetooth_test(() => {
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/service/getCharacteristics/gen-device-goes-out-of-range.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/service/getCharacteristics/gen-device-goes-out-of-range.https.html
index 70553a74..8de789f 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/service/getCharacteristics/gen-device-goes-out-of-range.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/service/getCharacteristics/gen-device-goes-out-of-range.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 'use strict';
 bluetooth_test(() => {
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/service/getCharacteristics/gen-disconnect-called-before-with-uuid.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/service/getCharacteristics/gen-disconnect-called-before-with-uuid.https.html
index ed3b8399..82be2665 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/service/getCharacteristics/gen-disconnect-called-before-with-uuid.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/service/getCharacteristics/gen-disconnect-called-before-with-uuid.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 'use strict';
 function createDOMException(func) {
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/service/getCharacteristics/gen-disconnect-called-before.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/service/getCharacteristics/gen-disconnect-called-before.https.html
index 2d3a9801..4ec3b9b 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/service/getCharacteristics/gen-disconnect-called-before.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/service/getCharacteristics/gen-disconnect-called-before.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 'use strict';
 function createDOMException(func) {
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/service/getCharacteristics/gen-disconnect-called-during-with-uuid.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/service/getCharacteristics/gen-disconnect-called-during-with-uuid.https.html
index 213334230..2fd2ea6 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/service/getCharacteristics/gen-disconnect-called-during-with-uuid.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/service/getCharacteristics/gen-disconnect-called-during-with-uuid.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 'use strict';
 bluetooth_test(() => {
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/service/getCharacteristics/gen-disconnect-called-during.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/service/getCharacteristics/gen-disconnect-called-during.https.html
index 8aaee48..64456ca 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/service/getCharacteristics/gen-disconnect-called-during.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/service/getCharacteristics/gen-disconnect-called-during.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 'use strict';
 bluetooth_test(() => {
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/service/getCharacteristics/gen-disconnect-invalidates-objects-with-uuid.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/service/getCharacteristics/gen-disconnect-invalidates-objects-with-uuid.https.html
index d47e508..e5c76e5 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/service/getCharacteristics/gen-disconnect-invalidates-objects-with-uuid.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/service/getCharacteristics/gen-disconnect-invalidates-objects-with-uuid.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 'use strict';
 function createDOMException(func, uuid) {
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/service/getCharacteristics/gen-disconnect-invalidates-objects.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/service/getCharacteristics/gen-disconnect-invalidates-objects.https.html
index 46a84ea..4049974 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/service/getCharacteristics/gen-disconnect-invalidates-objects.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/service/getCharacteristics/gen-disconnect-invalidates-objects.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 'use strict';
 function createDOMException(func, uuid) {
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/service/getCharacteristics/gen-garbage-collection-ran-during-success-with-uuid.https-expected.txt b/third_party/blink/web_tests/wpt_internal/bluetooth/service/getCharacteristics/gen-garbage-collection-ran-during-success-with-uuid.https-expected.txt
deleted file mode 100644
index e519edec..0000000
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/service/getCharacteristics/gen-garbage-collection-ran-during-success-with-uuid.https-expected.txt
+++ /dev/null
@@ -1,4 +0,0 @@
-This is a testharness.js-based test.
-FAIL Garbage Collection ran during a getCharacteristics call that succeeds. Should not crash. promise_test: Unhandled rejection with value: object "ReferenceError: runGarbageCollection is not defined"
-Harness: the test ran to completion.
-
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/service/getCharacteristics/gen-garbage-collection-ran-during-success-with-uuid.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/service/getCharacteristics/gen-garbage-collection-ran-during-success-with-uuid.https.html
index fcf32d47..8e90e0cb 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/service/getCharacteristics/gen-garbage-collection-ran-during-success-with-uuid.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/service/getCharacteristics/gen-garbage-collection-ran-during-success-with-uuid.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 'use strict';
 bluetooth_test(() => {
@@ -26,7 +27,7 @@
       // object to get garbage collected.
       service.device.gatt.disconnect();
     })
-    .then(runGarbageCollection)
+    .then(garbageCollect)
     .then(() => promise);
 }, 'Garbage Collection ran during a getCharacteristics call that succeeds. ' +
    'Should not crash.');
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/service/getCharacteristics/gen-garbage-collection-ran-during-success.https-expected.txt b/third_party/blink/web_tests/wpt_internal/bluetooth/service/getCharacteristics/gen-garbage-collection-ran-during-success.https-expected.txt
deleted file mode 100644
index e519edec..0000000
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/service/getCharacteristics/gen-garbage-collection-ran-during-success.https-expected.txt
+++ /dev/null
@@ -1,4 +0,0 @@
-This is a testharness.js-based test.
-FAIL Garbage Collection ran during a getCharacteristics call that succeeds. Should not crash. promise_test: Unhandled rejection with value: object "ReferenceError: runGarbageCollection is not defined"
-Harness: the test ran to completion.
-
diff --git a/third_party/blink/web_tests/wpt_internal/bluetooth/service/getCharacteristics/gen-garbage-collection-ran-during-success.https.html b/third_party/blink/web_tests/wpt_internal/bluetooth/service/getCharacteristics/gen-garbage-collection-ran-during-success.https.html
index f2083e4..46540e6 100644
--- a/third_party/blink/web_tests/wpt_internal/bluetooth/service/getCharacteristics/gen-garbage-collection-ran-during-success.https.html
+++ b/third_party/blink/web_tests/wpt_internal/bluetooth/service/getCharacteristics/gen-garbage-collection-ran-during-success.https.html
@@ -6,6 +6,7 @@
 <script src="/resources/testdriver-vendor.js"></script>
 <script src="/bluetooth/resources/bluetooth-test.js"></script>
 <script src="/bluetooth/resources/bluetooth-fake-devices.js"></script>
+<script src="/common/gc.js"></script>
 <script>
 'use strict';
 bluetooth_test(() => {
@@ -26,7 +27,7 @@
       // object to get garbage collected.
       service.device.gatt.disconnect();
     })
-    .then(runGarbageCollection)
+    .then(garbageCollect)
     .then(() => promise);
 }, 'Garbage Collection ran during a getCharacteristics call that succeeds. ' +
    'Should not crash.');
diff --git a/third_party/closure_compiler/closure_args.gni b/third_party/closure_compiler/closure_args.gni
index a702b55..0692a72 100644
--- a/third_party/closure_compiler/closure_args.gni
+++ b/third_party/closure_compiler/closure_args.gni
@@ -34,7 +34,7 @@
                          "extra_annotation_name=demo",
                          "extra_annotation_name=element",
 
-                         "language_in=ECMASCRIPT_2017",
+                         "language_in=ECMASCRIPT_2020",
                          "language_out=ECMASCRIPT5_STRICT",
 
                          "jscomp_off=duplicate",
diff --git a/third_party/nearby/README.chromium b/third_party/nearby/README.chromium
index 93317f7..f6ecbff 100644
--- a/third_party/nearby/README.chromium
+++ b/third_party/nearby/README.chromium
@@ -1,7 +1,7 @@
 Name: Nearby Connections Library
 Short Name: Nearby
 URL: https://github.com/google/nearby
-Version: 8679d3a370087b0da2eea508c3dd4892d14536cc
+Version: a3b6058753fb9f9590194f68e3853c2787fcf279
 License: Apache 2.0
 License File: LICENSE
 Security Critical: yes
diff --git a/tools/clang/rewrite_raw_ptr_fields/manual-fields-to-ignore.txt b/tools/clang/rewrite_raw_ptr_fields/manual-fields-to-ignore.txt
index 71549e3..a62627ca 100644
--- a/tools/clang/rewrite_raw_ptr_fields/manual-fields-to-ignore.txt
+++ b/tools/clang/rewrite_raw_ptr_fields/manual-fields-to-ignore.txt
@@ -23,6 +23,12 @@
 content::IndexedDBDispatcherHost::indexed_db_context_
 ServiceProcessState::state_
 
+# Populated manually - used with gmock Field() that expects a raw pointer.
+base::Frame::module
+
+# Populated manually - requires a rewrite in a generated file
+gpu::MockTransferBuffer::ExpectedMemoryInfo::ptr
+
 # Populated manually - conflicting types in an initializer list
 WebUITabStripContainerView::tab_counter_
 DownloadItemView::review_button_
@@ -302,6 +308,7 @@
 # Populated manually - to avoid out-of-line destructor
 base::LockFreeAddressHashSet::Node::next
 gpu::gles2::TextureManager::DoTexSubImageArguments::pixels
+gpu::gles2::TextureManager::DoTexImageArguments::pixels
 
 # Populated manually - on-stack pointer + a large number of non-PA pointees
 base::AutoReset::scoped_variable_
diff --git a/tools/metrics/histograms/enums.xml b/tools/metrics/histograms/enums.xml
index 8ab0573e..a13312a 100644
--- a/tools/metrics/histograms/enums.xml
+++ b/tools/metrics/histograms/enums.xml
@@ -107225,9 +107225,22 @@
     These values are integers representing a set of flags indicating how the
     PeerConnection is used. For flag values, see header file
     webrtc/pc/peerconnection.h, enum class UsageEvent. Only interesting values
-    are called out with labels.
+    (exceeding 1% usage at last probe) are called out with labels.
   </summary>
   <int value="0" label="Unused and unclosed"/>
+  <int value="1090" label="No media, Stun, SRD, priv IPv4 local"/>
+  <int value="2212" label="Data, remote priv IPv4"/>
+  <int value="3236" label="Data, priv IPv4"/>
+  <int value="3238" label="Data, Stun, priv IPv4"/>
+  <int value="9380" label="Data, priv IPv4, remote MDNS"/>
+  <int value="9382" label="Data, Stun, IPv4, remote MDNS"/>
+  <int value="36004" label="Data, remote MDNS, local IPv6"/>
+  <int value="36006" label="Data, Stun, priv IPv4 local, IPv6 remote"/>
+  <int value="156898" label="No media, Stun, SLD/SRD, local IPv6, remote MDNS"/>
+  <int value="157154" label="Connected, Data, Stun, local IPv6, remote MDNS"/>
+  <int value="157158" label="Connected, Data, Stun, local IPv6, remote MDNS"/>
+  <int value="157414" label="Data, Stun, SLD/SRD, local IPv6, remote MDNS"/>
+  <int value="157670" label="Connected, Data, Stun, local IPv6, remote MDNS"/>
 </enum>
 
 <enum name="WebRtcStunIntegrityOutcome">
diff --git a/tools/metrics/histograms/metadata/accessibility/histograms.xml b/tools/metrics/histograms/metadata/accessibility/histograms.xml
index 031e247..19a1091e 100644
--- a/tools/metrics/histograms/metadata/accessibility/histograms.xml
+++ b/tools/metrics/histograms/metadata/accessibility/histograms.xml
@@ -2184,7 +2184,7 @@
 </histogram>
 
 <histogram name="SodaInstaller.BinaryInstallationFailureTime" units="ms"
-    expires_after="2023-01-01">
+    expires_after="2023-06-01">
   <owner>abigailbklein@google.com</owner>
   <owner>evliu@google.com</owner>
   <owner>yilkal@chromium.org</owner>
@@ -2197,7 +2197,7 @@
 </histogram>
 
 <histogram name="SodaInstaller.BinaryInstallationResult" enum="BooleanSuccess"
-    expires_after="2023-01-01">
+    expires_after="2023-06-01">
   <owner>abigailbklein@google.com</owner>
   <owner>evliu@google.com</owner>
   <owner>yilkal@chromium.org</owner>
@@ -2210,7 +2210,7 @@
 </histogram>
 
 <histogram name="SodaInstaller.BinaryInstallationSuccessTime" units="ms"
-    expires_after="2023-01-01">
+    expires_after="2023-06-01">
   <owner>abigailbklein@google.com</owner>
   <owner>evliu@google.com</owner>
   <owner>yilkal@chromium.org</owner>
@@ -2224,7 +2224,7 @@
 
 <histogram
     name="SodaInstaller.Language.{SodaLanguageCode}.InstallationFailureTime"
-    units="ms" expires_after="2023-01-01">
+    units="ms" expires_after="2023-06-01">
   <owner>abigailbklein@google.com</owner>
   <owner>evliu@google.com</owner>
   <owner>yilkal@chromium.org</owner>
@@ -2238,7 +2238,7 @@
 </histogram>
 
 <histogram name="SodaInstaller.Language.{SodaLanguageCode}.InstallationResult"
-    enum="BooleanSuccess" expires_after="2023-01-01">
+    enum="BooleanSuccess" expires_after="2023-06-01">
   <owner>abigailbklein@google.com</owner>
   <owner>evliu@google.com</owner>
   <owner>yilkal@chromium.org</owner>
@@ -2254,7 +2254,7 @@
 
 <histogram
     name="SodaInstaller.Language.{SodaLanguageCode}.InstallationSuccessTime"
-    units="ms" expires_after="2023-01-01">
+    units="ms" expires_after="2023-06-01">
   <owner>abigailbklein@google.com</owner>
   <owner>evliu@google.com</owner>
   <owner>yilkal@chromium.org</owner>
diff --git a/tools/metrics/histograms/metadata/ash/histograms.xml b/tools/metrics/histograms/metadata/ash/histograms.xml
index 5cf0dba..95319b10 100644
--- a/tools/metrics/histograms/metadata/ash/histograms.xml
+++ b/tools/metrics/histograms/metadata/ash/histograms.xml
@@ -4044,7 +4044,7 @@
 </histogram>
 
 <histogram name="Ash.SearchResultUpdateAnimationShortened" enum="Boolean"
-    expires_after="2022-12-01">
+    expires_after="2023-11-01">
   <owner>yulunwu@google.com</owner>
   <owner>tbarzic@google.com</owner>
   <owner>tby@google.com</owner>
diff --git a/tools/metrics/histograms/metadata/cros_ml/histograms.xml b/tools/metrics/histograms/metadata/cros_ml/histograms.xml
index 725fa00..d1b5b6cd 100644
--- a/tools/metrics/histograms/metadata/cros_ml/histograms.xml
+++ b/tools/metrics/histograms/metadata/cros_ml/histograms.xml
@@ -56,9 +56,10 @@
 
 <histogram name="MachineLearningService.DocumentScanner.{RequestName}.Event"
     enum="MachineLearningServiceDocumentScannerResultEvent"
-    expires_after="2022-12-31">
+    expires_after="2023-07-01">
   <owner>wtlee@chromium.org</owner>
   <owner>chromeos-camera-eng@google.com</owner>
+  <owner>ml-service-team@google.com</owner>
   <summary>
     The result of DocumentScanner.{RequestName} request, which can be OK or
     ERROR.
@@ -88,7 +89,7 @@
 
 <histogram name="MachineLearningService.GrammarChecker.LoadModelResult.Event"
     enum="MachineLearningServiceLoadModelResultEvent"
-    expires_after="2022-12-30">
+    expires_after="2023-07-01">
   <owner>jiwan@chromium.org</owner>
   <owner>amoylan@chromium.org</owner>
   <summary>
@@ -517,7 +518,7 @@
 </histogram>
 
 <histogram name="MachineLearningService.{RequestName}.TotalMemoryDeltaKb"
-    units="KB" expires_after="2022-12-31">
+    units="KB" expires_after="2023-07-01">
   <owner>amoylan@chromium.org</owner>
   <owner>alanlxl@chromium.org</owner>
   <owner>honglinyu@chromium.org</owner>
diff --git a/tools/metrics/histograms/metadata/net/histograms.xml b/tools/metrics/histograms/metadata/net/histograms.xml
index 9ff0f4e..68f6c315 100644
--- a/tools/metrics/histograms/metadata/net/histograms.xml
+++ b/tools/metrics/histograms/metadata/net/histograms.xml
@@ -4295,7 +4295,7 @@
 
 <histogram
     name="Net.Radio.PossibleWakeupTrigger.{ProtocolType}WriteAnnotationId"
-    enum="TrafficAnnotationUniqueIdHash" expires_after="2023-01-01">
+    enum="TrafficAnnotationUniqueIdHash" expires_after="2023-02-22">
   <owner>bashi@chromium.org</owner>
   <owner>blink-network-stack@google.com</owner>
   <summary>
diff --git a/tools/metrics/histograms/metadata/network/histograms.xml b/tools/metrics/histograms/metadata/network/histograms.xml
index 9fcf4ac..0ee80e5d 100644
--- a/tools/metrics/histograms/metadata/network/histograms.xml
+++ b/tools/metrics/histograms/metadata/network/histograms.xml
@@ -3478,7 +3478,7 @@
 </histogram>
 
 <histogram name="NetworkService.MemoryCache.ContentLength.{RequestDestination}"
-    units="bytes" expires_after="2023-01-05">
+    units="bytes" expires_after="2023-02-22">
   <owner>bashi@chromium.org</owner>
   <owner>blink-network-stack@google.com</owner>
   <summary>
@@ -3505,7 +3505,7 @@
 </histogram>
 
 <histogram name="NetworkService.MemoryCache.FreshnessAtStore" units="seconds"
-    expires_after="2023-01-05">
+    expires_after="2023-02-22">
   <owner>bashi@chromium.org</owner>
   <owner>blink-network-stack@google.com</owner>
   <summary>
@@ -3515,7 +3515,7 @@
 </histogram>
 
 <histogram name="NetworkService.NetworkLoaderCompletionTime.{Source}"
-    units="ms" expires_after="2023-01-05">
+    units="ms" expires_after="2023-02-22">
   <owner>bashi@chromium.org</owner>
   <owner>blink-network-stack@google.com</owner>
   <summary>
diff --git a/tools/metrics/histograms/metadata/password/histograms.xml b/tools/metrics/histograms/metadata/password/histograms.xml
index 0de8887..90980380 100644
--- a/tools/metrics/histograms/metadata/password/histograms.xml
+++ b/tools/metrics/histograms/metadata/password/histograms.xml
@@ -2255,7 +2255,7 @@
 </histogram>
 
 <histogram name="PasswordManager.PasswordNoteActionInSettings"
-    enum="PasswordNoteAction" expires_after="2023-05-14">
+    enum="PasswordNoteAction" expires_after="2023-06-01">
   <owner>derinel@google.com</owner>
   <owner>mamir@chromium.org</owner>
   <summary>
@@ -2965,7 +2965,7 @@
 </histogram>
 
 <histogram name="PasswordManager.PasswordViewPage.UserActions"
-    enum="PasswordViewPageInteractions" expires_after="2023-05-07">
+    enum="PasswordViewPageInteractions" expires_after="2023-06-01">
   <owner>derinel@google.com</owner>
   <owner>mamir@chromium.org</owner>
   <summary>
@@ -3820,7 +3820,7 @@
 
 <histogram
     name="PasswordManager.{Store}PasswordNotes.CountCredentialsWithNonEmptyNotes2"
-    units="count" expires_after="2023-01-01">
+    units="count" expires_after="2023-06-01">
   <owner>derinel@google.com</owner>
   <owner>mamir@chromium.org</owner>
   <summary>
@@ -3847,7 +3847,7 @@
 </histogram>
 
 <histogram name="PasswordManager.{Store}PasswordNotes.CountNotesPerCredential2"
-    units="count" expires_after="2023-01-01">
+    units="count" expires_after="2023-06-01">
   <owner>derinel@google.com</owner>
   <owner>mamir@chromium.org</owner>
   <summary>
diff --git a/tools/metrics/histograms/metadata/power/histograms.xml b/tools/metrics/histograms/metadata/power/histograms.xml
index 6471604b..d37dcad 100644
--- a/tools/metrics/histograms/metadata/power/histograms.xml
+++ b/tools/metrics/histograms/metadata/power/histograms.xml
@@ -682,6 +682,35 @@
   </summary>
 </histogram>
 
+<histogram
+    name="Power.AltBatteryDischargeRateMilliwatts5{UsageScenario}{IntervalType}"
+    units="milliwatts" expires_after="2023-03-31">
+  <owner>etiennep@chromium.org</owner>
+  <owner>olivierli@chromium.org</owner>
+  <owner>lgrey@chromium.org</owner>
+  <summary>
+    Battery discharge in milliwatts, example: - Battery charge at the beginning
+    of the interval: 4000 mWh; - Battery charge at the end of the interval: 3990
+    mWh; - Discharge: (4000-3990) = 10 mWh per minute - Reported value: 600 mW.
+
+    This is reported at the end of every valid 1 minute interval. An invalid
+    interval is one that deviate too much from 1 minute, which can be caused by
+    the computer going to sleep, or the OS sending multiple notifications in a
+    row.
+
+    The difference with Power.BatteryDischargeRateMilliwatts5 is that values for
+    this histogram are calculated using the used battery capacity instead of the
+    current capacity. This difference matters only when the full charged
+    capacity changes between intervals.
+
+    This is recorded for {UsageScenario}.
+
+    This contains {IntervalType}.
+  </summary>
+  <token key="UsageScenario" variants="UsageScenario"/>
+  <token key="IntervalType" variants="IntervalType"/>
+</histogram>
+
 <histogram name="Power.AmbientLightOnResume" units="lux"
     expires_after="2023-04-23">
   <owner>bkersten@chromium.org</owner>
diff --git a/tools/metrics/histograms/metadata/web_rtc/histograms.xml b/tools/metrics/histograms/metadata/web_rtc/histograms.xml
index ea1e007..08c17fea 100644
--- a/tools/metrics/histograms/metadata/web_rtc/histograms.xml
+++ b/tools/metrics/histograms/metadata/web_rtc/histograms.xml
@@ -1818,7 +1818,7 @@
 </histogram>
 
 <histogram name="WebRTC.PeerConnection.UsagePattern"
-    enum="WebRtcPeerConnectionUsagePattern" expires_after="2023-01-01">
+    enum="WebRtcPeerConnectionUsagePattern" expires_after="2023-07-01">
   <owner>hta@chromium.org</owner>
   <owner>webrtc-dev@chromium.org</owner>
   <summary>
diff --git a/tools/perf/core/perfetto_binary_roller/binary_deps.json b/tools/perf/core/perfetto_binary_roller/binary_deps.json
index 47da7fb..fd20477 100644
--- a/tools/perf/core/perfetto_binary_roller/binary_deps.json
+++ b/tools/perf/core/perfetto_binary_roller/binary_deps.json
@@ -5,24 +5,24 @@
             "full_remote_path": "perfetto-luci-artifacts/v31.0/linux-arm64/trace_processor_shell"
         },
         "win": {
-            "hash": "e1749ec3ccf342d82cacfa512d84004106af46dd",
-            "full_remote_path": "chromium-telemetry/perfetto_binaries/trace_processor_shell/win/ceec2c49ed86f6b95053262513f3171948a560bc/trace_processor_shell.exe"
+            "hash": "2556b96927dbfb0a7f8877d998558f5ba685cb52",
+            "full_remote_path": "chromium-telemetry/perfetto_binaries/trace_processor_shell/win/c5fb93e71014315880f4e38620f11cad5cca0a2c/trace_processor_shell.exe"
         },
         "linux_arm": {
             "hash": "6373f26144aad58f230d11d6a91efda5a09c9873",
             "full_remote_path": "perfetto-luci-artifacts/v31.0/linux-arm/trace_processor_shell"
         },
         "mac": {
-            "hash": "e7f28beaaa5fdb8f367181931079f5f4d20213a4",
-            "full_remote_path": "chromium-telemetry/perfetto_binaries/trace_processor_shell/mac/f5b6c4ed868219aefe172ac2d5bd683814a5f001/trace_processor_shell"
+            "hash": "beba9acd7bedfb03c3544e09c1c6bd24be77b2ce",
+            "full_remote_path": "chromium-telemetry/perfetto_binaries/trace_processor_shell/mac/c5fb93e71014315880f4e38620f11cad5cca0a2c/trace_processor_shell"
         },
         "mac_arm64": {
             "hash": "5f47ee79e59d00bf3889d30ca52315522c158040",
             "full_remote_path": "perfetto-luci-artifacts/v31.0/mac-arm64/trace_processor_shell"
         },
         "linux": {
-            "hash": "48b8b37f81f733ff0f92d5322fa94700065e336c",
-            "full_remote_path": "chromium-telemetry/perfetto_binaries/trace_processor_shell/linux/ceec2c49ed86f6b95053262513f3171948a560bc/trace_processor_shell"
+            "hash": "b1447193ea6aea5af1f5c25587715003882a2be4",
+            "full_remote_path": "chromium-telemetry/perfetto_binaries/trace_processor_shell/linux/c5fb93e71014315880f4e38620f11cad5cca0a2c/trace_processor_shell"
         }
     },
     "power_profile.sql": {
diff --git a/tools/traffic_annotation/summary/annotations.xml b/tools/traffic_annotation/summary/annotations.xml
index 8636f1ae..d9b9aa4f 100644
--- a/tools/traffic_annotation/summary/annotations.xml
+++ b/tools/traffic_annotation/summary/annotations.xml
@@ -55,9 +55,9 @@
  <item id="desktop_screenshot_save" added_in_milestone="94" content_hash_code="019480c9" os_list="linux,windows,chromeos" file_path="chrome/browser/ui/views/sharing_hub/screenshot/screenshot_captured_bubble.cc" />
  <item id="device_management_service" added_in_milestone="62" content_hash_code="06395282" os_list="linux,windows,chromeos,android" file_path="components/policy/core/common/cloud/device_management_service.cc" />
  <item id="devtools_cdp_network_resource" added_in_milestone="87" content_hash_code="051db8c6" os_list="linux,windows,chromeos,android" file_path="content/browser/devtools/protocol/devtools_network_resource_loader.cc" />
- <item id="devtools_free_data_source" added_in_milestone="62" content_hash_code="02213e08" os_list="linux,windows,chromeos" file_path="chrome/browser/ui/webui/devtools_ui_data_source.cc" />
+ <item id="devtools_free_data_source" added_in_milestone="62" content_hash_code="01a26b6a" os_list="linux,windows,chromeos" file_path="chrome/browser/ui/webui/devtools_ui_data_source.cc" />
  <item id="devtools_handle_front_end_messages" added_in_milestone="62" content_hash_code="04940191" os_list="linux,windows,chromeos,android" file_path="content/shell/browser/shell_devtools_bindings.cc" />
- <item id="devtools_hard_coded_data_source" added_in_milestone="62" content_hash_code="047b3668" os_list="linux,windows,chromeos" file_path="chrome/browser/ui/webui/devtools_ui_data_source.cc" />
+ <item id="devtools_hard_coded_data_source" added_in_milestone="62" content_hash_code="073b9777" os_list="linux,windows,chromeos" file_path="chrome/browser/ui/webui/devtools_ui_data_source.cc" />
  <item id="devtools_http_handler" added_in_milestone="66" content_hash_code="054518b9" os_list="linux,windows,chromeos,android" file_path="content/browser/devtools/devtools_http_handler.cc" />
  <item id="devtools_network_resource" added_in_milestone="62" content_hash_code="01f4a4af" os_list="linux,windows,chromeos" file_path="chrome/browser/devtools/devtools_ui_bindings.cc" />
  <item id="devtools_proxy_config" added_in_milestone="85" content_hash_code="01e83c36" os_list="linux,windows,chromeos,android" file_path="content/browser/devtools/protocol/target_handler.cc" />
diff --git a/ui/accessibility/ax_table_info.h b/ui/accessibility/ax_table_info.h
index db6b00a..47314e0 100644
--- a/ui/accessibility/ax_table_info.h
+++ b/ui/accessibility/ax_table_info.h
@@ -27,7 +27,7 @@
 class AX_EXPORT AXTableInfo {
  public:
   struct CellData {
-    AXNode* cell;
+    raw_ptr<AXNode> cell;
     AXNodeID cell_id;
     size_t col_index;
     size_t row_index;
diff --git a/ui/accessibility/ax_tree_observer.h b/ui/accessibility/ax_tree_observer.h
index 92088e96..3e9f4dc 100644
--- a/ui/accessibility/ax_tree_observer.h
+++ b/ui/accessibility/ax_tree_observer.h
@@ -5,6 +5,7 @@
 #ifndef UI_ACCESSIBILITY_AX_TREE_OBSERVER_H_
 #define UI_ACCESSIBILITY_AX_TREE_OBSERVER_H_
 
+#include "base/memory/raw_ptr.h"
 #include "base/observer_list_types.h"
 #include "ui/accessibility/ax_enums.mojom-forward.h"
 #include "ui/accessibility/ax_export.h"
@@ -156,7 +157,7 @@
       this->node = node;
       this->type = type;
     }
-    AXNode* node;
+    raw_ptr<AXNode> node;
     ChangeType type;
   };
 
diff --git a/ui/accessibility/platform/automation/automation_ax_tree_wrapper.h b/ui/accessibility/platform/automation/automation_ax_tree_wrapper.h
index c412e20..c61fa7e 100644
--- a/ui/accessibility/platform/automation/automation_ax_tree_wrapper.h
+++ b/ui/accessibility/platform/automation/automation_ax_tree_wrapper.h
@@ -5,6 +5,7 @@
 #ifndef UI_ACCESSIBILITY_PLATFORM_AUTOMATION_AUTOMATION_AX_TREE_WRAPPER_H_
 #define UI_ACCESSIBILITY_PLATFORM_AUTOMATION_AUTOMATION_AX_TREE_WRAPPER_H_
 
+#include "base/memory/raw_ptr.h"
 #include "ui/accessibility/ax_enums.mojom-shared.h"
 #include "ui/accessibility/ax_event_generator.h"
 #include "ui/accessibility/ax_node.h"
@@ -135,7 +136,7 @@
                         AXNode* node,
                         bool is_ignored_new_value) override;
 
-  AutomationTreeManagerOwner* owner_;
+  raw_ptr<AutomationTreeManagerOwner> owner_;
   std::vector<int> deleted_node_ids_;
   std::vector<int> text_changed_node_ids_;
 
diff --git a/ui/accessibility/platform/automation/automation_v8_bindings.cc b/ui/accessibility/platform/automation/automation_v8_bindings.cc
index ebe455a..426ae9f 100644
--- a/ui/accessibility/platform/automation/automation_v8_bindings.cc
+++ b/ui/accessibility/platform/automation/automation_v8_bindings.cc
@@ -5,6 +5,7 @@
 #include "ui/accessibility/platform/automation/automation_v8_bindings.h"
 
 #include "base/bind.h"
+#include "base/memory/raw_ptr.h"
 #include "base/memory/scoped_refptr.h"
 #include "base/strings/utf_offset_string_conversions.h"
 #include "base/strings/utf_string_conversions.h"
@@ -115,8 +116,8 @@
  private:
   ~TreeIDWrapper() override = default;
 
-  AutomationTreeManagerOwner* automation_tree_manager_owner_;
-  AutomationV8Router* automation_router_;
+  raw_ptr<AutomationTreeManagerOwner> automation_tree_manager_owner_;
+  raw_ptr<AutomationV8Router> automation_router_;
   TreeIDFunction function_;
 };
 
@@ -173,8 +174,8 @@
 
   friend class base::RefCountedThreadSafe<NodeIDWrapper>;
 
-  AutomationTreeManagerOwner* automation_tree_manager_owner_;
-  AutomationV8Router* automation_router_;
+  raw_ptr<AutomationTreeManagerOwner> automation_tree_manager_owner_;
+  raw_ptr<AutomationV8Router> automation_router_;
   NodeIDFunction function_;
 };
 
@@ -235,8 +236,8 @@
  private:
   ~NodeIDPlusAttributeWrapper() override = default;
 
-  AutomationTreeManagerOwner* automation_tree_manager_owner_;
-  AutomationV8Router* automation_router_;
+  raw_ptr<AutomationTreeManagerOwner> automation_tree_manager_owner_;
+  raw_ptr<AutomationV8Router> automation_router_;
   NodeIDPlusAttributeFunction function_;
 };
 
@@ -302,8 +303,8 @@
  private:
   ~NodeIDPlusRangeWrapper() override = default;
 
-  AutomationTreeManagerOwner* automation_tree_manager_owner_;
-  AutomationV8Router* automation_router_;
+  raw_ptr<AutomationTreeManagerOwner> automation_tree_manager_owner_;
+  raw_ptr<AutomationV8Router> automation_router_;
   NodeIDPlusRangeFunction function_;
 };
 
@@ -360,8 +361,8 @@
  private:
   ~NodeIDPlusStringBoolWrapper() override = default;
 
-  AutomationTreeManagerOwner* automation_tree_manager_owner_;
-  AutomationV8Router* automation_router_;
+  raw_ptr<AutomationTreeManagerOwner> automation_tree_manager_owner_;
+  raw_ptr<AutomationV8Router> automation_router_;
   NodeIDPlusStringBoolFunction function_;
 };
 
@@ -424,8 +425,8 @@
 
   friend class base::RefCountedThreadSafe<NodeIDPlusDimensionsWrapper>;
 
-  AutomationTreeManagerOwner* automation_tree_manager_owner_;
-  AutomationV8Router* automation_router_;
+  raw_ptr<AutomationTreeManagerOwner> automation_tree_manager_owner_;
+  raw_ptr<AutomationV8Router> automation_router_;
   NodeIDPlusDimensionsFunction function_;
 };
 
@@ -497,8 +498,8 @@
  private:
   ~NodeIDPlusEventWrapper() override = default;
 
-  AutomationTreeManagerOwner* automation_tree_manager_owner_;
-  AutomationV8Router* automation_router_;
+  raw_ptr<AutomationTreeManagerOwner> automation_tree_manager_owner_;
+  raw_ptr<AutomationV8Router> automation_router_;
   NodeIDPlusEventFunction function_;
 };
 
diff --git a/ui/accessibility/platform/automation/automation_v8_bindings.h b/ui/accessibility/platform/automation/automation_v8_bindings.h
index d840762..f61c4d0 100644
--- a/ui/accessibility/platform/automation/automation_v8_bindings.h
+++ b/ui/accessibility/platform/automation/automation_v8_bindings.h
@@ -6,6 +6,7 @@
 #define UI_ACCESSIBILITY_PLATFORM_AUTOMATION_AUTOMATION_V8_BINDINGS_H_
 
 #include "base/callback_forward.h"
+#include "base/memory/raw_ptr.h"
 #include "ui/accessibility/ax_enums.mojom-shared.h"
 #include "ui/accessibility/ax_event_generator.h"
 #include "ui/accessibility/platform/automation/automation_ax_tree_wrapper.h"
@@ -242,8 +243,8 @@
   void StopCachingAccessibilityTrees(
       const v8::FunctionCallbackInfo<v8::Value>& args);
 
-  AutomationTreeManagerOwner* automation_tree_manager_owner_;
-  AutomationV8Router* automation_v8_router_;
+  raw_ptr<AutomationTreeManagerOwner> automation_tree_manager_owner_;
+  raw_ptr<AutomationV8Router> automation_v8_router_;
 };
 }  // namespace ui
 
diff --git a/ui/aura/env.h b/ui/aura/env.h
index 7b17df5a..74ed88a 100644
--- a/ui/aura/env.h
+++ b/ui/aura/env.h
@@ -215,7 +215,7 @@
 
   std::vector<aura::WindowTreeHost*> window_tree_hosts_;
 
-  client::CursorShapeClient* cursor_shape_client_ = nullptr;
+  raw_ptr<client::CursorShapeClient> cursor_shape_client_ = nullptr;
 };
 
 }  // namespace aura
diff --git a/ui/aura/window_unittest.cc b/ui/aura/window_unittest.cc
index dc0314b4..057deb3 100644
--- a/ui/aura/window_unittest.cc
+++ b/ui/aura/window_unittest.cc
@@ -1979,7 +1979,7 @@
 
   struct WindowBoundsInfo {
     int changed_count = 0;
-    Window* window = nullptr;
+    raw_ptr<Window> window = nullptr;
     gfx::Rect old_bounds;
     gfx::Rect new_bounds;
     ui::PropertyChangeReason reason =
@@ -1988,27 +1988,27 @@
 
   struct WindowOpacityInfo {
     int changed_count = 0;
-    Window* window = nullptr;
+    raw_ptr<Window> window = nullptr;
     ui::PropertyChangeReason reason =
         ui::PropertyChangeReason::NOT_FROM_ANIMATION;
   };
 
   struct WindowTargetTransformChangingInfo {
     int changed_count = 0;
-    Window* window = nullptr;
+    raw_ptr<Window> window = nullptr;
     gfx::Transform new_transform;
   };
 
   struct WindowTransformedInfo {
     int changed_count = 0;
-    Window* window = nullptr;
+    raw_ptr<Window> window = nullptr;
     ui::PropertyChangeReason reason =
         ui::PropertyChangeReason::NOT_FROM_ANIMATION;
   };
 
   struct CountAndWindow {
     int count = 0;
-    Window* window = nullptr;
+    raw_ptr<Window> window = nullptr;
   };
 
   WindowObserverTest() = default;
@@ -2379,7 +2379,7 @@
   shape->emplace_back(0, 0, 10, 20);
 
   EXPECT_EQ(0, alpha_shape_info().count);
-  EXPECT_EQ(nullptr, alpha_shape_info().window);
+  EXPECT_EQ(nullptr, alpha_shape_info().window.get());
   window->layer()->SetAlphaShape(std::move(shape));
   EXPECT_EQ(1, alpha_shape_info().count);
   EXPECT_EQ(window.get(), alpha_shape_info().window);
diff --git a/ui/events/event_target.h b/ui/events/event_target.h
index 123babfb..5c6f328 100644
--- a/ui/events/event_target.h
+++ b/ui/events/event_target.h
@@ -113,7 +113,7 @@
 
   // A handler with a priority.
   struct PrioritizedHandler {
-    EventHandler* handler = nullptr;
+    raw_ptr<EventHandler> handler = nullptr;
     Priority priority = Priority::kDefault;
 
     bool operator<(const PrioritizedHandler& ph) const {
diff --git a/ui/file_manager/file_manager/containers/search_container.ts b/ui/file_manager/file_manager/containers/search_container.ts
index 8d7271d..251f988 100644
--- a/ui/file_manager/file_manager/containers/search_container.ts
+++ b/ui/file_manager/file_manager/containers/search_container.ts
@@ -388,7 +388,7 @@
    * open the widget and thus the widget it not fully opened until the CSS
    * transition finishes.
    */
-  private openSearch() {
+  openSearch() {
     // Do not initiate open transition if we are not closed. This would leave us
     // in the OPENING state, without ever getting to OPEN state.
     if (this.inputState_ === SearchInputState.CLOSED) {
diff --git a/ui/file_manager/file_manager/foreground/js/file_manager_commands.js b/ui/file_manager/file_manager/foreground/js/file_manager_commands.js
index 3a71790..4139285 100644
--- a/ui/file_manager/file_manager/foreground/js/file_manager_commands.js
+++ b/ui/file_manager/file_manager/foreground/js/file_manager_commands.js
@@ -2156,11 +2156,8 @@
   execute(event, fileManager) {
     // Cancel item selection.
     fileManager.directoryModel.clearSelection();
-
-    // Focus and unhide the search box.
-    const element = fileManager.document.querySelector('#search-box cr-input');
-    element.disabled = false;
-    (/** @type {!CrInputElement} */ (element)).select();
+    // Open the query input via the search container.
+    fileManager.ui.searchContainer.openSearch();
   }
 
   /** @override */
diff --git a/ui/file_manager/integration_tests/file_manager/tab_index.js b/ui/file_manager/integration_tests/file_manager/tab_index.js
index 95c7665..ba251eb5 100644
--- a/ui/file_manager/integration_tests/file_manager/tab_index.js
+++ b/ui/file_manager/integration_tests/file_manager/tab_index.js
@@ -18,10 +18,17 @@
   // Check that the file list has the focus on launch.
   await remoteCall.waitForElement(appId, ['#file-list:focus']);
 
+  // Check that the search UI is in the collapsed state (hidden from the user).
+  await remoteCall.waitForElement(appId, '#search-wrapper[collapsed]');
+
   // Press the Ctrl-F key.
   chrome.test.assertTrue(await remoteCall.callRemoteTestUtil(
       'fakeKeyDown', appId, ['body', 'f', true, false, false]));
 
+  // Wait for the search box to fully open. Only once the search wrapper
+  // is fully expanded the collapsed attribute is removed.
+  await remoteCall.waitForElementLost(appId, '#search-wrapper[collapsed]');
+
   // Check that the search box has the focus.
   await remoteCall.waitForElement(appId, ['#search-box cr-input:focus-within']);
 
diff --git a/ui/gfx/android/android_surface_control_compat.cc b/ui/gfx/android/android_surface_control_compat.cc
index 98c7ba3..14b2429 100644
--- a/ui/gfx/android/android_surface_control_compat.cc
+++ b/ui/gfx/android/android_surface_control_compat.cc
@@ -15,6 +15,7 @@
 #include "base/hash/md5_constexpr.h"
 #include "base/logging.h"
 #include "base/memory/ptr_util.h"
+#include "base/memory/raw_ptr.h"
 #include "base/strings/string_number_conversions.h"
 #include "base/system/sys_info.h"
 #include "base/task/bind_post_task.h"
@@ -160,9 +161,9 @@
   void InitWithStubs() {
     struct TransactionStub {
       ASurfaceTransaction_OnComplete on_complete = nullptr;
-      void* on_complete_ctx = nullptr;
+      raw_ptr<void> on_complete_ctx = nullptr;
       ASurfaceTransaction_OnCommit on_commit = nullptr;
-      void* on_commit_ctx = nullptr;
+      raw_ptr<void> on_commit_ctx = nullptr;
     };
 
     ASurfaceTransaction_createFn = []() {
diff --git a/ui/gfx/x/event.cc b/ui/gfx/x/event.cc
index cd47ffa..cbe57f594 100644
--- a/ui/gfx/x/event.cc
+++ b/ui/gfx/x/event.cc
@@ -64,7 +64,7 @@
       sequence_(event.sequence_),
       type_id_(event.type_id_),
       event_(std::move(event.event_)),
-      window_(event.window_) {
+      window_(std::move(event.window_)) {
   memset(&event, 0, sizeof(Event));
 }
 
@@ -77,7 +77,7 @@
   window_ = nullptr;
   event_.reset();
   event_ = std::move(event.event_);
-  window_ = event.window_;
+  window_ = std::move(event.window_);
   memset(&event, 0, sizeof(Event));
   return *this;
 }
diff --git a/ui/gl/gl_bindings.h b/ui/gl/gl_bindings.h
index cec5903..aa02ae1 100644
--- a/ui/gl/gl_bindings.h
+++ b/ui/gl/gl_bindings.h
@@ -5,6 +5,7 @@
 #ifndef UI_GL_GL_BINDINGS_H_
 #define UI_GL_GL_BINDINGS_H_
 
+#include "base/memory/raw_ptr.h"
 #include "build/build_config.h"
 
 // Includes the platform independent and platform dependent GL headers.
@@ -530,9 +531,9 @@
 };
 
 struct GL_EXPORT CurrentGL {
-  GLApi* Api = nullptr;
-  DriverGL* Driver = nullptr;
-  const GLVersionInfo* Version = nullptr;
+  raw_ptr<GLApi> Api = nullptr;
+  raw_ptr<DriverGL> Driver = nullptr;
+  raw_ptr<const GLVersionInfo> Version = nullptr;
 };
 
 #if defined(USE_EGL)
@@ -560,9 +561,9 @@
 #endif
 
 // This #define is here to support autogenerated code.
-#define g_current_gl_context g_current_gl_context_tls->Get()->Api
+#define g_current_gl_context g_current_gl_context_tls->Get()->Api.get()
 #define g_current_gl_driver g_current_gl_context_tls->Get()->Driver
-#define g_current_gl_version g_current_gl_context_tls->Get()->Version
+#define g_current_gl_version g_current_gl_context_tls->Get()->Version.get()
 GL_EXPORT extern base::ThreadLocalPointer<CurrentGL>* g_current_gl_context_tls;
 
 #if defined(USE_EGL)
diff --git a/ui/gl/gl_image.h b/ui/gl/gl_image.h
index afb4f4c..e3dfae7f 100644
--- a/ui/gl/gl_image.h
+++ b/ui/gl/gl_image.h
@@ -110,6 +110,7 @@
     DXGI_IMAGE,
     D3D,
     DCOMP_SURFACE,
+    PBUFFER
   };
   virtual Type GetType() const;
 
diff --git a/ui/ozone/platform/wayland/BUILD.gn b/ui/ozone/platform/wayland/BUILD.gn
index 219c81da..69a2874e 100644
--- a/ui/ozone/platform/wayland/BUILD.gn
+++ b/ui/ozone/platform/wayland/BUILD.gn
@@ -486,6 +486,8 @@
     "test/test_surface_augmenter.h",
     "test/test_touch.cc",
     "test/test_touch.h",
+    "test/test_util.cc",
+    "test/test_util.h",
     "test/test_viewport.cc",
     "test/test_viewport.h",
     "test/test_viewporter.cc",
diff --git a/ui/ozone/platform/wayland/fuzzer/wayland_buffer_fuzzer.cc b/ui/ozone/platform/wayland/fuzzer/wayland_buffer_fuzzer.cc
index aefc097..af89519b0 100644
--- a/ui/ozone/platform/wayland/fuzzer/wayland_buffer_fuzzer.cc
+++ b/ui/ozone/platform/wayland/fuzzer/wayland_buffer_fuzzer.cc
@@ -20,6 +20,7 @@
 #include "base/message_loop/message_pump_type.h"
 #include "base/no_destructor.h"
 #include "base/task/single_thread_task_executor.h"
+#include "base/test/bind.h"
 #include "base/test/icu_test_util.h"
 #include "base/test/mock_callback.h"
 #include "base/test/task_environment.h"
@@ -32,6 +33,7 @@
 #include "ui/ozone/platform/wayland/host/wayland_event_source.h"
 #include "ui/ozone/platform/wayland/host/wayland_output_manager.h"
 #include "ui/ozone/platform/wayland/host/wayland_window.h"
+#include "ui/ozone/platform/wayland/test/test_util.h"
 #include "ui/ozone/platform/wayland/test/test_wayland_server_thread.h"
 #include "ui/ozone/platform/wayland/test/test_zwp_linux_buffer_params.h"
 #include "ui/platform_window/platform_window_delegate.h"
@@ -94,25 +96,6 @@
   bool terminated = false;
 };
 
-// Given the server runs on a different thread, but some of its parameters shall
-// be accessed from the thread where the buffer fuzzer runs, we need to resume
-// and pause the server to avoid race conditions.
-void SyncServer(wl::TestWaylandServerThread* server,
-                base::test::TaskEnvironment* task_env) {
-  DCHECK(server);
-  DCHECK(task_env);
-
-  // Resume the server, flushing its pending events.
-  server->Resume();
-
-  // Wait for the client to finish processing these events.
-  task_env->RunUntilIdle();
-
-  // Pause the server, after it has finished processing any follow-up requests
-  // from the client.
-  server->Pause();
-}
-
 }  // namespace
 
 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
@@ -144,9 +127,6 @@
   // Wait until everything is initialised.
   env.task_environment.RunUntilIdle();
 
-  // Pause the server after it has responded to all incoming events.
-  server.Pause();
-
   auto screen = connection->wayland_output_manager()->CreateWaylandScreen();
   connection->wayland_output_manager()->InitWaylandScreen(screen.get());
 
@@ -164,7 +144,7 @@
   CHECK_NE(widget, gfx::kNullAcceleratedWidget);
 
   // Let the server process the events and wait until everything is initialised.
-  SyncServer(&server, &env.task_environment);
+  wl::SyncDisplay(connection->display_wrapper(), *connection->display());
 
   base::FilePath temp_dir, temp_path;
   base::ScopedFD fd =
@@ -204,18 +184,23 @@
       modifiers, kFormat, kPlaneCount, kBufferId);
 
   // Wait until the buffers are created.
-  SyncServer(&server, &env.task_environment);
+  wl::SyncDisplay(connection->display_wrapper(), *connection->display());
 
   if (!env.terminated) {
-    // The server must notify the buffers are created so that the client is able
-    // to free the resources (destroy the params).
-    auto params_vector = server.zwp_linux_dmabuf_v1()->buffer_params();
-    // To ensure, no other buffers are created, test the size of the vector.
-    for (auto* mock_params : params_vector) {
-      zwp_linux_buffer_params_v1_send_created(mock_params->resource(),
-                                              mock_params->buffer_resource());
-    }
-    SyncServer(&server, &env.task_environment);
+    server.RunAndWait(
+        base::BindLambdaForTesting([](wl::TestWaylandServerThread* server) {
+          // The server must notify the buffers are created so that the client
+          // is able to free the resources (destroy the params).
+          auto params_vector = server->zwp_linux_dmabuf_v1()->buffer_params();
+          // To ensure, no other buffers are created, test the size of the
+          // vector.
+          for (auto* mock_params : params_vector) {
+            zwp_linux_buffer_params_v1_send_created(
+                mock_params->resource(), mock_params->buffer_resource());
+          }
+        }));
+
+    wl::SyncDisplay(connection->display_wrapper(), *connection->display());
   } else {
     // If the |manager_host| fires the terminate gpu callback, we need to set
     // the callback again.
@@ -225,7 +210,7 @@
   manager_host->DestroyBuffer(kBufferId);
 
   // Wait until the buffers are destroyed.
-  SyncServer(&server, &env.task_environment);
+  wl::SyncDisplay(connection->display_wrapper(), *connection->display());
 
   // Reset the value as |env| is a static object.
   env.terminated = false;
diff --git a/ui/ozone/platform/wayland/gpu/wayland_surface_factory.cc b/ui/ozone/platform/wayland/gpu/wayland_surface_factory.cc
index be9fa58..1666507 100644
--- a/ui/ozone/platform/wayland/gpu/wayland_surface_factory.cc
+++ b/ui/ozone/platform/wayland/gpu/wayland_surface_factory.cc
@@ -288,4 +288,11 @@
   return supports_native_pixmaps;
 }
 
+absl::optional<gfx::BufferFormat>
+WaylandSurfaceFactory::GetPreferredFormatForSolidColor() const {
+  if (!buffer_manager_->SupportsFormat(gfx::BufferFormat::RGBA_8888))
+    return gfx::BufferFormat::BGRA_8888;
+  return gfx::BufferFormat::RGBA_8888;
+}
+
 }  // namespace ui
diff --git a/ui/ozone/platform/wayland/gpu/wayland_surface_factory.h b/ui/ozone/platform/wayland/gpu/wayland_surface_factory.h
index e7a898b..3a9b8a2 100644
--- a/ui/ozone/platform/wayland/gpu/wayland_surface_factory.h
+++ b/ui/ozone/platform/wayland/gpu/wayland_surface_factory.h
@@ -58,6 +58,8 @@
       gfx::Size size,
       gfx::BufferFormat format,
       gfx::NativePixmapHandle handle) override;
+  absl::optional<gfx::BufferFormat> GetPreferredFormatForSolidColor()
+      const override;
 
   bool SupportsNativePixmaps() const;
 
diff --git a/ui/ozone/platform/wayland/gpu/wayland_surface_factory_unittest.cc b/ui/ozone/platform/wayland/gpu/wayland_surface_factory_unittest.cc
index 3aaafddd..44c0281 100644
--- a/ui/ozone/platform/wayland/gpu/wayland_surface_factory_unittest.cc
+++ b/ui/ozone/platform/wayland/gpu/wayland_surface_factory_unittest.cc
@@ -164,13 +164,10 @@
 
 class WaylandSurfaceFactoryTest : public WaylandTest {
  public:
-  WaylandSurfaceFactoryTest()
-      : WaylandTest(WaylandTest::TestServerMode::kAsync) {}
-
+  WaylandSurfaceFactoryTest() = default;
   WaylandSurfaceFactoryTest(const WaylandSurfaceFactoryTest&) = delete;
   WaylandSurfaceFactoryTest& operator=(const WaylandSurfaceFactoryTest&) =
       delete;
-
   ~WaylandSurfaceFactoryTest() override = default;
 
   void SetUp() override {
diff --git a/ui/ozone/platform/wayland/host/wayland_clipboard_unittest.cc b/ui/ozone/platform/wayland/host/wayland_clipboard_unittest.cc
index 7096063c..8310d298 100644
--- a/ui/ozone/platform/wayland/host/wayland_clipboard_unittest.cc
+++ b/ui/ozone/platform/wayland/host/wayland_clipboard_unittest.cc
@@ -42,6 +42,7 @@
 #include "ui/ozone/platform/wayland/test/test_keyboard.h"
 #include "ui/ozone/platform/wayland/test/test_selection_device_manager.h"
 #include "ui/ozone/platform/wayland/test/test_touch.h"
+#include "ui/ozone/platform/wayland/test/test_util.h"
 #include "ui/ozone/platform/wayland/test/test_wayland_server_thread.h"
 #include "ui/ozone/platform/wayland/test/wayland_test.h"
 #include "ui/ozone/public/platform_clipboard.h"
@@ -90,7 +91,7 @@
 
 class WaylandClipboardTestBase : public WaylandTest {
  public:
-  WaylandClipboardTestBase() : WaylandTest(TestServerMode::kAsync) {}
+  WaylandClipboardTestBase() = default;
   WaylandClipboardTestBase(const WaylandClipboardTestBase&) = delete;
   WaylandClipboardTestBase& operator=(const WaylandClipboardTestBase&) = delete;
   ~WaylandClipboardTestBase() override = default;
@@ -120,7 +121,8 @@
     WaylandConnectionTestApi(connection_.get())
         .SetRoundtripClosure(base::BindLambdaForTesting([&]() {
           wl_display_flush(connection_->display());
-          SyncDisplay();
+          wl::SyncDisplay(connection_->display_wrapper(),
+                          *connection_->display());
           base::ThreadPoolInstance::Get()->FlushForTesting();
         }));
 
@@ -140,7 +142,7 @@
   // Actual clipboard data reading is performed in the ThreadPool. Also,
   // wl::TestSelection{Source,Offer} currently use ThreadPool task runners.
   void WaitForClipboardTasks() {
-    SyncDisplay();
+    wl::SyncDisplay(connection_->display_wrapper(), *connection_->display());
     base::ThreadPoolInstance::Get()->FlushForTesting();
     base::RunLoop().RunUntilIdle();
   }
@@ -230,7 +232,7 @@
     // calls, otherwise tests, such as ReadFromClipboard, would crash.
     ASSERT_EQ(WhichBufferToUse() == ClipboardBuffer::kSelection,
               !!clipboard_->GetClipboard(ClipboardBuffer::kSelection));
-    SyncDisplay();
+    wl::SyncDisplay(connection_->display_wrapper(), *connection_->display());
 
     offered_data_.clear();
   }
@@ -319,7 +321,7 @@
 
     // 1. Offer sample text as selection data.
     OfferData(WhichBufferToUse(), kSampleClipboardText, {kMimeTypeTextUtf8});
-    SyncDisplay();
+    wl::SyncDisplay(connection_->display_wrapper(), *connection_->display());
 
     // 2. Emulate an external client requesting to read the offered data and
     // make sure the appropriate string gets delivered.
diff --git a/ui/ozone/platform/wayland/host/wayland_connection_unittest.cc b/ui/ozone/platform/wayland/host/wayland_connection_unittest.cc
index c9e87ba..d4332e98 100644
--- a/ui/ozone/platform/wayland/host/wayland_connection_unittest.cc
+++ b/ui/ozone/platform/wayland/host/wayland_connection_unittest.cc
@@ -15,13 +15,7 @@
 
 namespace ui {
 
-class WaylandConnectionTest : public WaylandTest {
- public:
-  WaylandConnectionTest() : WaylandTest(TestServerMode::kAsync) {}
-  WaylandConnectionTest(const WaylandConnectionTest&) = delete;
-  WaylandConnectionTest& operator=(const WaylandConnectionTest&) = delete;
-  ~WaylandConnectionTest() override = default;
-};
+using WaylandConnectionTest = WaylandTest;
 
 TEST_P(WaylandConnectionTest, Ping) {
   PostToServerAndWait([](wl::TestWaylandServerThread* server) {
diff --git a/ui/ozone/platform/wayland/host/wayland_input_method_context_unittest.cc b/ui/ozone/platform/wayland/host/wayland_input_method_context_unittest.cc
index 9304d56..fd03c68 100644
--- a/ui/ozone/platform/wayland/host/wayland_input_method_context_unittest.cc
+++ b/ui/ozone/platform/wayland/host/wayland_input_method_context_unittest.cc
@@ -25,6 +25,7 @@
 #include "ui/ozone/platform/wayland/test/mock_surface.h"
 #include "ui/ozone/platform/wayland/test/mock_zcr_extended_text_input.h"
 #include "ui/ozone/platform/wayland/test/mock_zwp_text_input.h"
+#include "ui/ozone/platform/wayland/test/test_util.h"
 #include "ui/ozone/platform/wayland/test/test_wayland_server_thread.h"
 #include "ui/ozone/platform/wayland/test/wayland_test.h"
 
@@ -257,7 +258,7 @@
     input_method_context_->Init(true);
     connection_->Flush();
 
-    SyncDisplay();
+    wl::SyncDisplay(connection_->display_wrapper(), *connection_->display());
 
     // Unset Keyboard focus.
     connection_->wayland_window_manager()->SetKeyboardFocusedWindow(nullptr);
@@ -826,7 +827,7 @@
 
 TEST_F(WaylandInputMethodContextTest, OnClearGrammarFragments) {
   input_method_context_->OnClearGrammarFragments(gfx::Range(1, 5));
-  SyncDisplay();
+  wl::SyncDisplay(connection_->display_wrapper(), *connection_->display());
   EXPECT_TRUE(
       input_method_context_delegate_->was_on_clear_grammar_fragments_called());
 }
@@ -834,14 +835,14 @@
 TEST_F(WaylandInputMethodContextTest, OnAddGrammarFragments) {
   input_method_context_->OnAddGrammarFragment(
       ui::GrammarFragment(gfx::Range(1, 5), "test"));
-  SyncDisplay();
+  wl::SyncDisplay(connection_->display_wrapper(), *connection_->display());
   EXPECT_TRUE(
       input_method_context_delegate_->was_on_add_grammar_fragment_called());
 }
 
 TEST_F(WaylandInputMethodContextTest, OnSetAutocorrectRange) {
   input_method_context_->OnSetAutocorrectRange(gfx::Range(1, 5));
-  SyncDisplay();
+  wl::SyncDisplay(connection_->display_wrapper(), *connection_->display());
   EXPECT_TRUE(
       input_method_context_delegate_->was_on_set_autocorrect_range_called());
 }
@@ -849,7 +850,7 @@
 TEST_F(WaylandInputMethodContextTest, OnSetVirtualKeyboardOccludedBounds) {
   constexpr gfx::Rect kBounds(10, 20, 300, 400);
   input_method_context_->OnSetVirtualKeyboardOccludedBounds(kBounds);
-  SyncDisplay();
+  wl::SyncDisplay(connection_->display_wrapper(), *connection_->display());
   EXPECT_EQ(input_method_context_delegate_->virtual_keyboard_bounds(), kBounds);
 }
 
@@ -870,7 +871,7 @@
   EXPECT_CALL(*client1, EnsureCaretNotInRect(kBounds));
   EXPECT_CALL(*client2, EnsureCaretNotInRect(kBounds));
   input_method_context_->OnSetVirtualKeyboardOccludedBounds(kBounds);
-  SyncDisplay();
+  wl::SyncDisplay(connection_->display_wrapper(), *connection_->display());
   Mock::VerifyAndClearExpectations(client1.get());
   Mock::VerifyAndClearExpectations(client2.get());
 
@@ -879,7 +880,7 @@
   EXPECT_CALL(*client1, EnsureCaretNotInRect(kBoundsEmpty));
   EXPECT_CALL(*client2, EnsureCaretNotInRect(kBoundsEmpty));
   input_method_context_->OnSetVirtualKeyboardOccludedBounds(kBoundsEmpty);
-  SyncDisplay();
+  wl::SyncDisplay(connection_->display_wrapper(), *connection_->display());
   Mock::VerifyAndClearExpectations(client1.get());
   Mock::VerifyAndClearExpectations(client2.get());
 
@@ -888,7 +889,7 @@
   EXPECT_CALL(*client1, EnsureCaretNotInRect).Times(0);
   EXPECT_CALL(*client2, EnsureCaretNotInRect).Times(0);
   input_method_context_->OnSetVirtualKeyboardOccludedBounds(kBounds2);
-  SyncDisplay();
+  wl::SyncDisplay(connection_->display_wrapper(), *connection_->display());
   Mock::VerifyAndClearExpectations(client1.get());
   Mock::VerifyAndClearExpectations(client2.get());
 }
@@ -904,12 +905,12 @@
   const gfx::Rect kBounds(10, 20, 300, 400);
   EXPECT_CALL(*client, EnsureCaretNotInRect(kBounds));
   input_method_context_->OnSetVirtualKeyboardOccludedBounds(kBounds);
-  SyncDisplay();
+  wl::SyncDisplay(connection_->display_wrapper(), *connection_->display());
   Mock::VerifyAndClearExpectations(client.get());
 
   client.reset();
   input_method_context_->OnSetVirtualKeyboardOccludedBounds(kBounds);
-  SyncDisplay();
+  wl::SyncDisplay(connection_->display_wrapper(), *connection_->display());
 }
 
 TEST_F(WaylandInputMethodContextTest, DisplayVirtualKeyboard) {
@@ -920,7 +921,7 @@
   });
   EXPECT_TRUE(input_method_context_->DisplayVirtualKeyboard());
   connection_->Flush();
-  SyncDisplay();
+  wl::SyncDisplay(connection_->display_wrapper(), *connection_->display());
 }
 
 TEST_F(WaylandInputMethodContextTest, DismissVirtualKeyboard) {
@@ -930,7 +931,7 @@
   });
   input_method_context_->DismissVirtualKeyboard();
   connection_->Flush();
-  SyncDisplay();
+  wl::SyncDisplay(connection_->display_wrapper(), *connection_->display());
 }
 
 TEST_F(WaylandInputMethodContextTest, UpdateVirtualKeyboardState) {
diff --git a/ui/ozone/platform/wayland/host/wayland_output_unittest.cc b/ui/ozone/platform/wayland/host/wayland_output_unittest.cc
index 74e7250..8f512fa 100644
--- a/ui/ozone/platform/wayland/host/wayland_output_unittest.cc
+++ b/ui/ozone/platform/wayland/host/wayland_output_unittest.cc
@@ -13,15 +13,7 @@
 
 namespace ui {
 
-// TODO(crbug.com/1365887): revert this to using WaylandOutputTest = WaylandTest
-// once the default mode becomes asynchronous.
-class WaylandOutputTest : public WaylandTest {
- public:
-  WaylandOutputTest() : WaylandTest(TestServerMode::kAsync) {}
-  WaylandOutputTest(const WaylandOutputTest&) = delete;
-  WaylandOutputTest& operator=(const WaylandOutputTest&) = delete;
-  ~WaylandOutputTest() override = default;
-};
+using WaylandOutputTest = WaylandTest;
 
 // Tests that name and description fall back to ones in the WaylandOutput if
 // XDGOutput is not created.
diff --git a/ui/ozone/platform/wayland/host/wayland_screen_unittest.cc b/ui/ozone/platform/wayland/host/wayland_screen_unittest.cc
index 0a1bb5a..df61457 100644
--- a/ui/ozone/platform/wayland/host/wayland_screen_unittest.cc
+++ b/ui/ozone/platform/wayland/host/wayland_screen_unittest.cc
@@ -94,13 +94,9 @@
 
 class WaylandScreenTest : public WaylandTest {
  public:
-  // TODO(crbug.com/1365887): TestServerMode::kAsync must be removed once all
-  // tests switch to asynchronous mode.
-  WaylandScreenTest() : WaylandTest(WaylandTest::TestServerMode::kAsync) {}
-
+  WaylandScreenTest() = default;
   WaylandScreenTest(const WaylandScreenTest&) = delete;
   WaylandScreenTest& operator=(const WaylandScreenTest&) = delete;
-
   ~WaylandScreenTest() override = default;
 
   void SetUp() override {
@@ -1044,10 +1040,7 @@
     : public WaylandTest,
       public wl::TestWaylandServerThread::OutputDelegate {
  public:
-  // TODO(crbug.com/1365887): TestServerMode::kAsync must be removed once all
-  // tests switch to asynchronous mode.
-  LazilyConfiguredScreenTest()
-      : WaylandTest(WaylandTest::TestServerMode::kAsync) {}
+  LazilyConfiguredScreenTest() = default;
   LazilyConfiguredScreenTest(const LazilyConfiguredScreenTest&) = delete;
   LazilyConfiguredScreenTest& operator=(const LazilyConfiguredScreenTest&) =
       delete;
diff --git a/ui/ozone/platform/wayland/host/wayland_surface_unittest.cc b/ui/ozone/platform/wayland/host/wayland_surface_unittest.cc
index 8c7f9c90..a3ff54b 100644
--- a/ui/ozone/platform/wayland/host/wayland_surface_unittest.cc
+++ b/ui/ozone/platform/wayland/host/wayland_surface_unittest.cc
@@ -19,13 +19,7 @@
 
 using ::testing::ElementsAre;
 
-class WaylandSurfaceTest : public WaylandTest {
- public:
-  WaylandSurfaceTest() : WaylandTest(WaylandTest::TestServerMode::kAsync) {}
-  WaylandSurfaceTest(const WaylandSurfaceTest&) = delete;
-  WaylandSurfaceTest& operator=(const WaylandSurfaceTest&) = delete;
-  ~WaylandSurfaceTest() override = default;
-};
+using WaylandSurfaceTest = WaylandTest;
 
 TEST_P(WaylandSurfaceTest, SurfaceReenterOutput) {
   WaylandSurface* wayland_surface = window_->root_surface();
@@ -35,26 +29,21 @@
   const uint32_t output_id =
       screen_->GetOutputIdForDisplayId(screen_->GetPrimaryDisplay().id());
 
-  // Shared wl_resource ids.
-  const uint32_t wl_surface_id = wl_resource_get_id(surface_->resource());
-  const uint32_t wl_output_id =
-      wl_resource_get_id(server_.output()->resource());
+  const uint32_t surface_id_ = window_->root_surface()->get_surface_id();
 
-  PostToServerAndWait(
-      [wl_surface_id, wl_output_id](wl::TestWaylandServerThread* server) {
-        wl_surface_send_enter(
-            server->GetObject<wl::MockSurface>(wl_surface_id)->resource(),
-            server->GetObject<wl::TestOutput>(wl_output_id)->resource());
-      });
+  PostToServerAndWait([surface_id_](wl::TestWaylandServerThread* server) {
+    wl_surface_send_enter(
+        server->GetObject<wl::MockSurface>(surface_id_)->resource(),
+        server->output()->resource());
+  });
   EXPECT_THAT(wayland_surface->entered_outputs(), ElementsAre(output_id));
 
   // Send enter again, but entered outputs should not have duplicate values.
-  PostToServerAndWait(
-      [wl_surface_id, wl_output_id](wl::TestWaylandServerThread* server) {
-        wl_surface_send_enter(
-            server->GetObject<wl::MockSurface>(wl_surface_id)->resource(),
-            server->GetObject<wl::TestOutput>(wl_output_id)->resource());
-      });
+  PostToServerAndWait([surface_id_](wl::TestWaylandServerThread* server) {
+    wl_surface_send_enter(
+        server->GetObject<wl::MockSurface>(surface_id_)->resource(),
+        server->output()->resource());
+  });
   EXPECT_THAT(wayland_surface->entered_outputs(), ElementsAre(output_id));
 }
 
diff --git a/ui/ozone/platform/wayland/host/wayland_touch_unittest.cc b/ui/ozone/platform/wayland/host/wayland_touch_unittest.cc
index 2dc92f0..efcf60d0 100644
--- a/ui/ozone/platform/wayland/host/wayland_touch_unittest.cc
+++ b/ui/ozone/platform/wayland/host/wayland_touch_unittest.cc
@@ -353,8 +353,6 @@
     wl_touch_send_cancel(touch);
   });
 
-  Sync();
-
   EXPECT_FALSE(window_->has_touch_focus());
 }
 
diff --git a/ui/ozone/platform/wayland/host/wayland_window_drag_controller_unittest.cc b/ui/ozone/platform/wayland/host/wayland_window_drag_controller_unittest.cc
index 06223e2..a8e4e8c3 100644
--- a/ui/ozone/platform/wayland/host/wayland_window_drag_controller_unittest.cc
+++ b/ui/ozone/platform/wayland/host/wayland_window_drag_controller_unittest.cc
@@ -37,6 +37,7 @@
 #include "ui/ozone/platform/wayland/test/test_data_offer.h"
 #include "ui/ozone/platform/wayland/test/test_data_source.h"
 #include "ui/ozone/platform/wayland/test/test_output.h"
+#include "ui/ozone/platform/wayland/test/test_util.h"
 #include "ui/ozone/platform/wayland/test/test_wayland_server_thread.h"
 #include "ui/ozone/platform/wayland/test/wayland_drag_drop_test.h"
 #include "ui/platform_window/extensions/wayland_extension.h"
@@ -776,7 +777,7 @@
   EXPECT_CALL(delegate_, DispatchEvent(_)).Times(1);
   wayland_extension->StartWindowDraggingSessionIfNeeded(
       /*allow_system_drag=*/false);
-  SyncDisplay();
+  wl::SyncDisplay(connection_->display_wrapper(), *connection_->display());
   EXPECT_EQ(State::kAttached, drag_controller()->state());
 
   // Emulate a [motion => leave] event sequence and make sure the correct
@@ -1032,7 +1033,7 @@
   // Start the drag session.
   GetWaylandExtension(*dragged_window)
       ->StartWindowDraggingSessionIfNeeded(/*allow_system_drag=*/false);
-  SyncDisplay();
+  wl::SyncDisplay(connection_->display_wrapper(), *connection_->display());
   EXPECT_EQ(State::kAttached, drag_controller()->state());
 
   auto* move_loop_handler = GetWmMoveLoopHandler(*dragged_window);
@@ -1113,7 +1114,7 @@
   EXPECT_CALL(delegate(), DispatchEvent(_)).Times(::testing::AtLeast(2));
   wayland_extension->StartWindowDraggingSessionIfNeeded(
       /*allow_system_drag=*/false);
-  SyncDisplay();
+  wl::SyncDisplay(connection_->display_wrapper(), *connection_->display());
   // Starting a DnD session results in a server sending a Enter event, which
   // enters the window at 0x0.
   EXPECT_EQ(gfx::Point(0, 0), screen_->GetCursorScreenPoint());
@@ -1170,7 +1171,6 @@
       expected_point += window->GetBoundsInDIP().origin().OffsetFromOrigin();
 
       self->SendDndMotion(p1);
-      self->Sync();
 
       EXPECT_EQ(expected_point, screen->GetCursorScreenPoint());
       self->PostToServerAndWait([surface_id, output_id](
diff --git a/ui/ozone/platform/wayland/host/wayland_window_manager_unittests.cc b/ui/ozone/platform/wayland/host/wayland_window_manager_unittests.cc
index 047c58b..bbbbde1 100644
--- a/ui/ozone/platform/wayland/host/wayland_window_manager_unittests.cc
+++ b/ui/ozone/platform/wayland/host/wayland_window_manager_unittests.cc
@@ -9,6 +9,7 @@
 #include "ui/ozone/platform/wayland/test/mock_pointer.h"
 #include "ui/ozone/platform/wayland/test/mock_surface.h"
 #include "ui/ozone/platform/wayland/test/test_keyboard.h"
+#include "ui/ozone/platform/wayland/test/test_util.h"
 #include "ui/ozone/platform/wayland/test/wayland_test.h"
 #include "ui/ozone/test/mock_platform_window_delegate.h"
 
@@ -24,7 +25,7 @@
 
 class WaylandWindowManagerTest : public WaylandTest {
  public:
-  WaylandWindowManagerTest() : WaylandTest(TestServerMode::kAsync) {}
+  WaylandWindowManagerTest() = default;
   WaylandWindowManagerTest(const WaylandWindowManagerTest&) = delete;
   WaylandWindowManagerTest& operator=(const WaylandWindowManagerTest&) = delete;
   ~WaylandWindowManagerTest() override = default;
@@ -85,7 +86,7 @@
   // When window is shown, it automatically gets keyboard focus. Reset it.
   connection_->wayland_window_manager()->SetKeyboardFocusedWindow(nullptr);
 
-  SyncDisplay();
+  wl::SyncDisplay(connection_->display_wrapper(), *connection_->display());
 
   EXPECT_FALSE(manager_->GetCurrentFocusedWindow());
   EXPECT_FALSE(manager_->GetCurrentKeyboardFocusedWindow());
@@ -136,7 +137,7 @@
   // When window is shown, it automatically gets keyboard focus. Reset it.
   connection_->wayland_window_manager()->SetKeyboardFocusedWindow(nullptr);
 
-  SyncDisplay();
+  wl::SyncDisplay(connection_->display_wrapper(), *connection_->display());
 
   EXPECT_FALSE(manager_->GetCurrentKeyboardFocusedWindow());
 
diff --git a/ui/ozone/platform/wayland/host/wayland_window_unittest.cc b/ui/ozone/platform/wayland/host/wayland_window_unittest.cc
index 0d3dd33..c67ca808 100644
--- a/ui/ozone/platform/wayland/host/wayland_window_unittest.cc
+++ b/ui/ozone/platform/wayland/host/wayland_window_unittest.cc
@@ -64,6 +64,7 @@
 #include "ui/ozone/platform/wayland/test/test_output.h"
 #include "ui/ozone/platform/wayland/test/test_region.h"
 #include "ui/ozone/platform/wayland/test/test_touch.h"
+#include "ui/ozone/platform/wayland/test/test_util.h"
 #include "ui/ozone/platform/wayland/test/test_wayland_server_thread.h"
 #include "ui/ozone/platform/wayland/test/wayland_test.h"
 #include "ui/ozone/public/ozone_switches.h"
@@ -154,8 +155,7 @@
 class WaylandWindowTest : public WaylandTest {
  public:
   WaylandWindowTest()
-      : WaylandTest(WaylandTest::TestServerMode::kAsync),
-        test_mouse_event_(ET_MOUSE_PRESSED,
+      : test_mouse_event_(ET_MOUSE_PRESSED,
                           gfx::Point(10, 15),
                           gfx::Point(10, 15),
                           ui::EventTimeStampFromSeconds(123456),
@@ -335,13 +335,15 @@
     auto* xdg_surface = mock_surface->xdg_surface();
     EXPECT_CALL(*xdg_surface, SetWindowGeometry(gfx::Rect(bounds.size())))
         .Times(0);
-    EXPECT_CALL(*xdg_surface, AckConfigure(1)).Times(0);
+    EXPECT_CALL(*xdg_surface, AckConfigure(_)).Times(0);
     EXPECT_CALL(*mock_surface, SetOpaqueRegion(_)).Times(0);
     EXPECT_CALL(*mock_surface, SetInputRegion(_)).Times(0);
   });
 
   auto state = InitializeWlArrayWithActivatedState();
-  SendConfigureEvent(surface_id_, kNormalBounds.size(), state);
+  constexpr uint32_t kConfigureSerial = 2u;
+  SendConfigureEvent(surface_id_, kNormalBounds.size(), state,
+                     kConfigureSerial);
 
   PostToServerAndWait([id = surface_id_, bounds = kNormalBounds](
                           wl::TestWaylandServerThread* server) {
@@ -349,7 +351,7 @@
     ASSERT_TRUE(mock_surface);
     auto* xdg_surface = mock_surface->xdg_surface();
     EXPECT_CALL(*xdg_surface, SetWindowGeometry(gfx::Rect(bounds.size())));
-    EXPECT_CALL(*xdg_surface, AckConfigure(1));
+    EXPECT_CALL(*xdg_surface, AckConfigure(kConfigureSerial));
     EXPECT_CALL(*mock_surface, SetOpaqueRegion(_));
     EXPECT_CALL(*mock_surface, SetInputRegion(_));
   });
@@ -376,7 +378,7 @@
   window_->root_surface()->set_input_region(region_px.data());
   window_->root_surface()->set_surface_buffer_scale(2);
 
-  SyncDisplay();
+  wl::SyncDisplay(connection_->display_wrapper(), *connection_->display());
 
   PostToServerAndWait([id = surface_id_](wl::TestWaylandServerThread* server) {
     auto* mock_surface = server->GetObject<wl::MockSurface>(id);
@@ -391,7 +393,7 @@
   window_->root_surface()->ApplyPendingState();
   window_->root_surface()->Commit();
 
-  SyncDisplay();
+  wl::SyncDisplay(connection_->display_wrapper(), *connection_->display());
 }
 
 // Checks that decoration insets do not change final bounds and that
@@ -438,7 +440,7 @@
   // (which also updates visual size).
   window_->root_surface()->Commit();
 
-  SyncDisplay();
+  wl::SyncDisplay(connection_->display_wrapper(), *connection_->display());
 
   EXPECT_CALL(delegate_, OnBoundsChanged(_)).Times(0);
   PostToServerAndWait([id = surface_id_, bounds_with_insets](
@@ -482,7 +484,7 @@
   // (which also updates visual size).
   window_->root_surface()->Commit();
 
-  SyncDisplay();
+  wl::SyncDisplay(connection_->display_wrapper(), *connection_->display());
 
   // Now send configure events many times - bounds mustn't change.
   for (size_t i = 0; i < 10; i++) {
@@ -901,7 +903,7 @@
   auto window = delegate.CreateWaylandWindow(connection_.get(),
                                              std::move(properties), true, true);
 
-  SyncDisplay();
+  wl::SyncDisplay(connection_->display_wrapper(), *connection_->display());
 
   // Make sure the window is initialized to normal state from the beginning.
   EXPECT_EQ(PlatformWindowState::kNormal, window->GetPlatformWindowState());
@@ -919,7 +921,7 @@
   // The state of the window must already be fullscreen one.
   EXPECT_EQ(window->GetPlatformWindowState(), PlatformWindowState::kFullScreen);
 
-  SyncDisplay();
+  wl::SyncDisplay(connection_->display_wrapper(), *connection_->display());
 
   Mock::VerifyAndClearExpectations(&delegate);
 
@@ -959,7 +961,7 @@
   auto window = delegate.CreateWaylandWindow(connection_.get(),
                                              std::move(properties), true, true);
 
-  SyncDisplay();
+  wl::SyncDisplay(connection_->display_wrapper(), *connection_->display());
 
   // Make sure the window is initialized to normal state from the beginning.
   EXPECT_EQ(PlatformWindowState::kNormal, window->GetPlatformWindowState());
@@ -977,7 +979,7 @@
   // The state of the window must already be fullscreen one.
   EXPECT_EQ(window->GetPlatformWindowState(), PlatformWindowState::kMaximized);
 
-  SyncDisplay();
+  wl::SyncDisplay(connection_->display_wrapper(), *connection_->display());
 
   Mock::VerifyAndClearExpectations(&delegate);
 
@@ -1801,7 +1803,7 @@
   // update) for that.
   window_->UpdateVisualSize(kMainWindowBounds.size());
 
-  SyncDisplay();
+  wl::SyncDisplay(connection_->display_wrapper(), *connection_->display());
 
   // Create a menu.
   constexpr gfx::Rect kMenuBounds{100, 100, 80, 50};
@@ -2311,7 +2313,7 @@
     EXPECT_EQ(2, window_->window_scale());
     wayland_popup->Show(false);
 
-    Sync();
+    wl::SyncDisplay(connection_->display_wrapper(), *connection_->display());
 
     // |wayland_popup|'s scale and bounds must change whenever its parents
     // scale is changed.
@@ -3273,7 +3275,7 @@
 
   window->Hide();
 
-  SyncDisplay();
+  wl::SyncDisplay(connection_->display_wrapper(), *connection_->display());
 
   window->Show(false);
 
diff --git a/ui/ozone/platform/wayland/host/wayland_zaura_output_unittest.cc b/ui/ozone/platform/wayland/host/wayland_zaura_output_unittest.cc
index 7c2676d..315a3b0 100644
--- a/ui/ozone/platform/wayland/host/wayland_zaura_output_unittest.cc
+++ b/ui/ozone/platform/wayland/host/wayland_zaura_output_unittest.cc
@@ -14,13 +14,13 @@
 #include "ui/ozone/platform/wayland/test/test_zaura_output.h"
 #include "ui/ozone/platform/wayland/test/wayland_test.h"
 
+using ::testing::Values;
+
 namespace ui {
 
-using ::testing::Values;
-namespace {
 class WaylandZAuraOutputTest : public WaylandTest {
  public:
-  WaylandZAuraOutputTest() : WaylandTest(TestServerMode::kAsync) {}
+  WaylandZAuraOutputTest() = default;
   WaylandZAuraOutputTest(const WaylandZAuraOutputTest&) = delete;
   WaylandZAuraOutputTest& operator=(const WaylandZAuraOutputTest&) = delete;
   ~WaylandZAuraOutputTest() override = default;
@@ -51,8 +51,6 @@
   std::unique_ptr<WaylandScreen> platform_screen_;
 };
 
-}  // namespace
-
 TEST_P(WaylandZAuraOutputTest, HandleInsets) {
   WaylandOutput* wayland_output = output_manager_->GetPrimaryOutput();
   ASSERT_TRUE(wayland_output);
diff --git a/ui/ozone/platform/wayland/host/wayland_zaura_shell_unittest.cc b/ui/ozone/platform/wayland/host/wayland_zaura_shell_unittest.cc
index 96498dfbc..d08e28a 100644
--- a/ui/ozone/platform/wayland/host/wayland_zaura_shell_unittest.cc
+++ b/ui/ozone/platform/wayland/host/wayland_zaura_shell_unittest.cc
@@ -13,16 +13,7 @@
 
 namespace ui {
 
-// TODO(crbug.com/1365887): change this to
-// `using WaylandZAuraShellTest = WaylandTest`
-// once the default mode becomes asynchronous.
-class WaylandZAuraShellTest : public WaylandTest {
- public:
-  WaylandZAuraShellTest() : WaylandTest(TestServerMode::kAsync) {}
-  WaylandZAuraShellTest(const WaylandZAuraShellTest&) = delete;
-  WaylandZAuraShellTest& operator=(const WaylandZAuraShellTest&) = delete;
-  ~WaylandZAuraShellTest() override = default;
-};
+using WaylandZAuraShellTest = WaylandTest;
 
 TEST_P(WaylandZAuraShellTest, BugFix) {
   PostToServerAndWait([](wl::TestWaylandServerThread* server) {
diff --git a/ui/ozone/platform/wayland/test/mock_surface.cc b/ui/ozone/platform/wayland/test/mock_surface.cc
index e3a2bfb..340c0708 100644
--- a/ui/ozone/platform/wayland/test/mock_surface.cc
+++ b/ui/ozone/platform/wayland/test/mock_surface.cc
@@ -202,12 +202,12 @@
   if (linux_buffer_releases_.find(buffer) != linux_buffer_releases_.end()) {
     ReleaseBufferFenced(buffer, {});
     wl_buffer_send_release(buffer);
-    TestWaylandServerThread::FlushClientForResource(buffer);
+    wl_client_flush(wl_resource_get_client(buffer));
   }
 
   DCHECK(buffer);
   wl_buffer_send_release(buffer);
-  TestWaylandServerThread::FlushClientForResource(buffer);
+  wl_client_flush(wl_resource_get_client(buffer));
 
   if (buffer == prev_attached_buffer_)
     prev_attached_buffer_ = nullptr;
@@ -227,7 +227,7 @@
   } else {
     zwp_linux_buffer_release_v1_send_immediate_release(linux_buffer_release);
   }
-  TestWaylandServerThread::FlushClientForResource(linux_buffer_release);
+  wl_client_flush(wl_resource_get_client(linux_buffer_release));
   linux_buffer_releases_.erase(iter);
   if (buffer == prev_attached_buffer_)
     prev_attached_buffer_ = nullptr;
@@ -242,7 +242,7 @@
   wl_callback_send_done(
       frame_callback_,
       0 /* trequest-specific data for the callback. not used */);
-  TestWaylandServerThread::FlushClientForResource(frame_callback_);
+  wl_client_flush(wl_resource_get_client(frame_callback_));
   wl_resource_destroy(frame_callback_);
   frame_callback_ = nullptr;
 }
diff --git a/ui/ozone/platform/wayland/test/test_data_device.cc b/ui/ozone/platform/wayland/test/test_data_device.cc
index 0424eab1..213a144 100644
--- a/ui/ozone/platform/wayland/test/test_data_device.cc
+++ b/ui/ozone/platform/wayland/test/test_data_device.cc
@@ -105,7 +105,7 @@
   drag_serial_ = serial;
   manager_->set_data_source(source);
   SendOfferAndEnter(origin, {});
-  TestWaylandServerThread::FlushClientForResource(resource());
+  wl_client_flush(wl_resource_get_client(resource()));
 }
 
 void TestDataDevice::SendOfferAndEnter(MockSurface* origin,
diff --git a/ui/ozone/platform/wayland/test/test_data_source.cc b/ui/ozone/platform/wayland/test/test_data_source.cc
index 7970ef7..3f15b58 100644
--- a/ui/ozone/platform/wayland/test/test_data_source.cc
+++ b/ui/ozone/platform/wayland/test/test_data_source.cc
@@ -38,22 +38,22 @@
                 base::ScopedFD write_fd) override {
     wl_data_source_send_send(source_->resource(), mime_type.c_str(),
                              write_fd.get());
-    TestWaylandServerThread::FlushClientForResource(source_->resource());
+    wl_client_flush(wl_resource_get_client(source_->resource()));
   }
 
   void SendFinished() override {
     wl_data_source_send_dnd_finished(source_->resource());
-    TestWaylandServerThread::FlushClientForResource(source_->resource());
+    wl_client_flush(wl_resource_get_client(source_->resource()));
   }
 
   void SendCancelled() override {
     wl_data_source_send_cancelled(source_->resource());
-    TestWaylandServerThread::FlushClientForResource(source_->resource());
+    wl_client_flush(wl_resource_get_client(source_->resource()));
   }
 
   void SendDndAction(uint32_t action) override {
     wl_data_source_send_action(source_->resource(), action);
-    TestWaylandServerThread::FlushClientForResource(source_->resource());
+    wl_client_flush(wl_resource_get_client(source_->resource()));
   }
 
   void OnDestroying() override { delete this; }
diff --git a/ui/ozone/platform/wayland/test/test_gtk_primary_selection.cc b/ui/ozone/platform/wayland/test/test_gtk_primary_selection.cc
index 435bd42..323021f 100644
--- a/ui/ozone/platform/wayland/test/test_gtk_primary_selection.cc
+++ b/ui/ozone/platform/wayland/test/test_gtk_primary_selection.cc
@@ -76,7 +76,7 @@
                 base::ScopedFD write_fd) override {
     gtk_primary_selection_source_send_send(source->resource(),
                                            mime_type.c_str(), write_fd.get());
-    TestWaylandServerThread::FlushClientForResource(source->resource());
+    wl_client_flush(wl_resource_get_client(source->resource()));
   }
 
   void SendFinished() override {
diff --git a/ui/ozone/platform/wayland/test/test_util.cc b/ui/ozone/platform/wayland/test/test_util.cc
new file mode 100644
index 0000000..a804ff56
--- /dev/null
+++ b/ui/ozone/platform/wayland/test/test_util.cc
@@ -0,0 +1,27 @@
+// Copyright 2022 The Chromium Authors
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "ui/ozone/platform/wayland/test/test_util.h"
+
+#include <wayland-client-protocol.h>
+
+#include "base/run_loop.h"
+#include "ui/ozone/platform/wayland/common/wayland_object.h"
+
+namespace wl {
+
+void SyncDisplay(wl_display* display_proxy, wl_display& display) {
+  base::RunLoop run_loop;
+  wl::Object<wl_callback> sync_callback(
+      wl_display_sync(display_proxy ? display_proxy : &display));
+  wl_callback_listener listener = {
+      [](void* data, struct wl_callback* cb, uint32_t time) {
+        static_cast<base::RunLoop*>(data)->Quit();
+      }};
+  wl_callback_add_listener(sync_callback.get(), &listener, &run_loop);
+  wl_display_flush(&display);
+  run_loop.Run();
+}
+
+}  // namespace wl
diff --git a/ui/ozone/platform/wayland/test/test_util.h b/ui/ozone/platform/wayland/test/test_util.h
new file mode 100644
index 0000000..59ce772
--- /dev/null
+++ b/ui/ozone/platform/wayland/test/test_util.h
@@ -0,0 +1,23 @@
+// Copyright 2022 The Chromium Authors
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef UI_OZONE_PLATFORM_WAYLAND_TEST_TEST_UTIL_H_
+#define UI_OZONE_PLATFORM_WAYLAND_TEST_TEST_UTIL_H_
+
+struct wl_display;
+
+namespace wl {
+
+// Sets up a sync callback via wl_display.sync and waits until it's received.
+// Requests are handled in-order and events are delivered in-order, thus sync
+// is used as a barrier to ensure all previous requests and the resulting
+// events have been handled. A client may choose whether it uses a proxy wrapper
+// or an original display object to create a sync object. If |display_proxy| is
+// null, a callback is created for the original display object. In other words,
+// a default event queue is used.
+void SyncDisplay(wl_display* display_proxy, wl_display& display);
+
+}  // namespace wl
+
+#endif  // UI_OZONE_PLATFORM_WAYLAND_TEST_TEST_UTIL_H_
diff --git a/ui/ozone/platform/wayland/test/test_wayland_server_thread.cc b/ui/ozone/platform/wayland/test/test_wayland_server_thread.cc
index 6039565..c3399d1 100644
--- a/ui/ozone/platform/wayland/test/test_wayland_server_thread.cc
+++ b/ui/ozone/platform/wayland/test/test_wayland_server_thread.cc
@@ -18,7 +18,6 @@
 #include "base/functional/callback_helpers.h"
 #include "base/run_loop.h"
 #include "base/strings/string_number_conversions.h"
-#include "base/synchronization/lock.h"
 #include "base/test/bind.h"
 #include "ui/ozone/platform/wayland/test/test_gtk_primary_selection.h"
 #include "ui/ozone/platform/wayland/test/test_zwp_primary_selection.h"
@@ -26,9 +25,6 @@
 namespace wl {
 
 namespace {
-// TODO(1365887): This is a lock that workarounds a problem when wl_client_flush
-// is called from multiple threads.
-static base::Lock g_global_lock_;
 
 void handle_client_destroyed(struct wl_listener* listener, void* data) {
   TestServerListener* destroy_listener =
@@ -48,10 +44,6 @@
 TestWaylandServerThread::TestWaylandServerThread()
     : Thread("test_wayland_server"),
       client_destroy_listener_(this),
-      pause_event_(base::WaitableEvent::ResetPolicy::AUTOMATIC,
-                   base::WaitableEvent::InitialState::NOT_SIGNALED),
-      resume_event_(base::WaitableEvent::ResetPolicy::AUTOMATIC,
-                    base::WaitableEvent::InitialState::NOT_SIGNALED),
       compositor_v4_(4),
       compositor_v3_(3),
       controller_(FROM_HERE) {
@@ -59,21 +51,16 @@
 }
 
 TestWaylandServerThread::~TestWaylandServerThread() {
-  // TODO(crbug.com/1365887): remove this condition once all the tests are
-  // refactored.
-  if (is_async_) {
-    // Stop watching the descriptor here to guarantee that no new events
-    // will come during or after the destruction of the display. This must be
-    // done on the correct thread to avoid data races.
-    auto stop_controller_on_server_thread =
-        [](wl::TestWaylandServerThread* server) {
-          server->controller_.StopWatchingFileDescriptor();
-        };
-    RunAndWait(base::BindLambdaForTesting(
-        std::move(stop_controller_on_server_thread)));
-  }
+  // Stop watching the descriptor here to guarantee that no new events
+  // will come during or after the destruction of the display. This must be
+  // done on the correct thread to avoid data races.
+  auto stop_controller_on_server_thread =
+      [](wl::TestWaylandServerThread* server) {
+        server->controller_.StopWatchingFileDescriptor();
+      };
+  RunAndWait(
+      base::BindLambdaForTesting(std::move(stop_controller_on_server_thread)));
 
-  Resume();
   Stop();
 
   if (protocol_logger_)
@@ -90,23 +77,6 @@
   client_ = nullptr;
 }
 
-// static
-void TestWaylandServerThread::FlushClientForResource(wl_resource* resource) {
-  DCHECK(resource);
-  base::AutoLock scoped_lock(g_global_lock_);
-  wl_client_flush(wl_resource_get_client(resource));
-}
-
-void TestWaylandServerThread::SetServerAsync() {
-  // Resume and Pause the server to ensure it's paused. Calling just Pause may
-  // result in a deadlock if the server has already been paused.
-  Resume();
-  Pause();
-  is_async_ = true;
-  // Now resume the server thread so that it runs and processed the events.
-  resume_event_.Signal();
-}
-
 bool TestWaylandServerThread::Start(const ServerConfig& config) {
   display_.reset(wl_display_create());
   if (!display_)
@@ -194,27 +164,6 @@
   return true;
 }
 
-void TestWaylandServerThread::Pause() {
-  if (is_async_)
-    return;
-
-  task_runner()->PostTask(FROM_HERE,
-                          base::BindOnce(&TestWaylandServerThread::DoPause,
-                                         base::Unretained(this)));
-  pause_event_.Wait();
-}
-
-void TestWaylandServerThread::Resume() {
-  if (is_async_)
-    return;
-
-  if (display_) {
-    base::AutoLock scoped_lock(g_global_lock_);
-    wl_display_flush_clients(display_.get());
-  }
-  resume_event_.Signal();
-}
-
 void TestWaylandServerThread::RunAndWait(
     base::OnceCallback<void(TestWaylandServerThread*)> callback) {
   base::OnceClosure closure =
@@ -234,6 +183,7 @@
 }
 
 MockWpPresentation* TestWaylandServerThread::EnsureAndGetWpPresentation() {
+  DCHECK_CALLED_ON_VALID_THREAD(thread_checker_);
   if (wp_presentation_.resource())
     return &wp_presentation_;
   if (wp_presentation_.Initialize(display_.get()))
@@ -242,6 +192,7 @@
 }
 
 TestSurfaceAugmenter* TestWaylandServerThread::EnsureSurfaceAugmenter() {
+  DCHECK_CALLED_ON_VALID_THREAD(thread_checker_);
   if (surface_augmenter_.Initialize(display_.get()))
     return &surface_augmenter_;
   return nullptr;
@@ -305,14 +256,6 @@
   return false;
 }
 
-void TestWaylandServerThread::DoPause() {
-  DCHECK_CALLED_ON_VALID_THREAD(thread_checker_);
-  DCHECK(!is_async_);
-  base::RunLoop().RunUntilIdle();
-  pause_event_.Signal();
-  resume_event_.Wait();
-}
-
 std::unique_ptr<base::MessagePump>
 TestWaylandServerThread::CreateMessagePump() {
   DCHECK_CALLED_ON_VALID_THREAD(thread_checker_);
@@ -326,17 +269,14 @@
 void TestWaylandServerThread::DoRun(base::OnceClosure closure) {
   DCHECK_CALLED_ON_VALID_THREAD(thread_checker_);
   std::move(closure).Run();
-  base::AutoLock scoped_lock(g_global_lock_);
   wl_display_flush_clients(display_.get());
 }
 
 void TestWaylandServerThread::OnFileCanReadWithoutBlocking(int fd) {
   DCHECK_CALLED_ON_VALID_THREAD(thread_checker_);
   wl_event_loop_dispatch(event_loop_, 0);
-  if (display_) {
-    base::AutoLock scoped_lock(g_global_lock_);
+  if (display_)
     wl_display_flush_clients(display_.get());
-  }
 }
 
 void TestWaylandServerThread::OnFileCanWriteWithoutBlocking(int fd) {}
@@ -348,11 +288,8 @@
     const struct wl_protocol_logger_message* message) {
   auto* test_server = static_cast<TestWaylandServerThread*>(user_data);
   DCHECK(test_server);
-  // When the server is running in asynchronous mode, all the protocol calls
-  // must be made on the correct thread.
-  if (test_server->is_async_) {
-    DCHECK_CALLED_ON_VALID_THREAD(test_server->thread_checker_);
-  }
+  // All the protocol calls must be made on the correct thread.
+  DCHECK_CALLED_ON_VALID_THREAD(test_server->thread_checker_);
 }
 
 }  // namespace wl
diff --git a/ui/ozone/platform/wayland/test/test_wayland_server_thread.h b/ui/ozone/platform/wayland/test/test_wayland_server_thread.h
index 4cd36ed..759efbc6 100644
--- a/ui/ozone/platform/wayland/test/test_wayland_server_thread.h
+++ b/ui/ozone/platform/wayland/test/test_wayland_server_thread.h
@@ -13,7 +13,6 @@
 
 #include "base/memory/raw_ptr.h"
 #include "base/message_loop/message_pump_libevent.h"
-#include "base/synchronization/waitable_event.h"
 #include "base/threading/thread.h"
 #include "base/threading/thread_checker.h"
 #include "ui/display/types/display_constants.h"
@@ -89,15 +88,6 @@
 
   ~TestWaylandServerThread() override;
 
-  // TODO(1365887): This shouldn't really exist.
-  static void FlushClientForResource(wl_resource* resource);
-
-  // Makes server to be asynchronous. In other words, Pause/Resume do nothing
-  // and the server thread is constantly running.
-  // TODO(crbug.com/1365887): this must be removed once all tests switch to
-  // asynchronous mode.
-  void SetServerAsync();
-
   // Starts the test Wayland server thread. If this succeeds, the WAYLAND_SOCKET
   // environment variable will be set to the string representation of a file
   // descriptor that a client can connect to. The caller is responsible for
@@ -107,12 +97,6 @@
   // (stable) are supported.
   bool Start(const ServerConfig& config);
 
-  // Pauses the server thread when it becomes idle.
-  void Pause();
-
-  // Resumes the server thread after flushing client connections.
-  void Resume();
-
   // Runs 'callback' or 'closure' on the server thread; blocks until the
   // callable is run and all pending Wayland requests and events are delivered.
   void RunAndWait(base::OnceCallback<void(TestWaylandServerThread*)> callback);
@@ -126,13 +110,8 @@
 
   template <typename T>
   T* GetObject(uint32_t id) {
-    // When the server is running in asynchronous mode, all the protocol calls
-    // must be made on the correct thread.
-    // TODO(crbug.com/1365887): this must always do thread check once all the
-    // tests are refactored.
-    if (is_async_) {
-      DCHECK_CALLED_ON_VALID_THREAD(thread_checker_);
-    }
+    // All the protocol calls must be made on the correct thread.
+    DCHECK_CALLED_ON_VALID_THREAD(thread_checker_);
     wl_resource* resource = wl_client_get_object(client_, id);
     return resource ? T::FromResource(resource) : nullptr;
   }
@@ -192,7 +171,6 @@
   bool SetupPrimarySelectionManager(PrimarySelectionProtocol protocol);
   bool SetupExplicitSynchronizationProtocol(
       ShouldUseExplicitSynchronizationProtocol usage);
-  void DoPause();
 
   std::unique_ptr<base::MessagePump> CreateMessagePump();
 
@@ -219,9 +197,6 @@
   raw_ptr<wl_event_loop> event_loop_ = nullptr;
   raw_ptr<wl_protocol_logger> protocol_logger_ = nullptr;
 
-  base::WaitableEvent pause_event_;
-  base::WaitableEvent resume_event_;
-
   // Represent Wayland global objects
   // Compositor version is selected dynamically by server config but version is
   // actually set on construction thus both compositor version objects appear
@@ -254,16 +229,6 @@
 
   raw_ptr<OutputDelegate> output_delegate_ = nullptr;
 
-  // Makes the server to run asynchronously - the server is resumed and
-  // processes events as soon as there is something to read from the event
-  // queue. The client is not required to call Resume/Pause anymore. This cannot
-  // be set in ctor as the WaylandTest needs the first operations to be done
-  // synchronously. Otherwise, it'll crash in WaylandTest::SetUp. And given this
-  // is used temporarily, it's fine to have it as it is now.
-  // TODO(crbug.com/1365887): this must be removed once all tests switch to
-  // asynchronous mode.
-  bool is_async_ = false;
-
   THREAD_CHECKER(thread_checker_);
 };
 
diff --git a/ui/ozone/platform/wayland/test/wayland_drag_drop_test.cc b/ui/ozone/platform/wayland/test/wayland_drag_drop_test.cc
index 2a49697..e3cceaa 100644
--- a/ui/ozone/platform/wayland/test/wayland_drag_drop_test.cc
+++ b/ui/ozone/platform/wayland/test/wayland_drag_drop_test.cc
@@ -43,8 +43,7 @@
   return std::make_unique<WaylandExchangeDataProvider>();
 }
 
-WaylandDragDropTest::WaylandDragDropTest()
-    : WaylandTest(WaylandTest::TestServerMode::kAsync) {}
+WaylandDragDropTest::WaylandDragDropTest() = default;
 
 WaylandDragDropTest::~WaylandDragDropTest() = default;
 
diff --git a/ui/ozone/platform/wayland/test/wayland_test.cc b/ui/ozone/platform/wayland/test/wayland_test.cc
index f63748f..e75e03c 100644
--- a/ui/ozone/platform/wayland/test/wayland_test.cc
+++ b/ui/ozone/platform/wayland/test/wayland_test.cc
@@ -18,6 +18,7 @@
 #include "ui/ozone/platform/wayland/test/mock_surface.h"
 #include "ui/ozone/platform/wayland/test/scoped_wl_array.h"
 #include "ui/ozone/platform/wayland/test/test_keyboard.h"
+#include "ui/ozone/platform/wayland/test/test_util.h"
 #include "ui/ozone/platform/wayland/test/test_wayland_server_thread.h"
 #include "ui/platform_window/platform_window_init_properties.h"
 
@@ -32,11 +33,9 @@
 
 namespace ui {
 
-WaylandTestBase::WaylandTestBase(wl::ServerConfig config,
-                                 TestServerMode server_mode)
+WaylandTestBase::WaylandTestBase(wl::ServerConfig config)
     : task_environment_(base::test::TaskEnvironment::MainThreadType::UI,
                         base::test::TaskEnvironment::TimeSource::MOCK_TIME),
-      server_mode_(server_mode),
       config_(config) {
 #if BUILDFLAG(USE_XKBCOMMON)
   auto keyboard_layout_engine =
@@ -83,19 +82,10 @@
   window_->Show(false);
 
   // Wait for the client to flush all pending requests from initialization.
-  base::RunLoop().RunUntilIdle();
-
-  // Pause the server after it has responded to all incoming events.
-  server_.Pause();
-
-  auto id = window_->root_surface()->get_surface_id();
-  surface_ = server_.GetObject<wl::MockSurface>(id);
-  ASSERT_TRUE(surface_);
+  wl::SyncDisplay(connection_->display_wrapper(), *connection_->display());
 
   // The surface must be activated before buffers are attached.
-  ActivateSurface(server_.GetObject<wl::MockSurface>(id)->xdg_surface());
-
-  Sync();
+  ActivateSurface(window_->root_surface()->get_surface_id());
 
   EXPECT_EQ(0u,
             DeviceDataManager::GetInstance()->GetTouchscreenDevices().size());
@@ -104,53 +94,32 @@
   EXPECT_EQ(0u, DeviceDataManager::GetInstance()->GetTouchpadDevices().size());
 
   initialized_ = true;
-
-  // TODO(crbug.com/1365887): this must be removed once all tests switch to
-  // asynchronous mode.
-  if (server_mode_ == TestServerMode::kAsync)
-    server_.SetServerAsync();
 }
 
 void WaylandTestBase::TearDown() {
-  if (initialized_) {
-    if (server_mode_ != TestServerMode::kAsync)
-      Sync();
-    else
-      SyncDisplay();
-  }
-}
-
-void WaylandTestBase::Sync() {
-  // Resume the server, flushing its pending events.
-  server_.Resume();
-
-  // Wait for the client to finish processing these events.
-  base::RunLoop().RunUntilIdle();
-
-  // Pause the server, after it has finished processing any follow-up requests
-  // from the client.
-  server_.Pause();
+  if (initialized_)
+    wl::SyncDisplay(connection_->display_wrapper(), *connection_->display());
 }
 
 void WaylandTestBase::PostToServerAndWait(
     base::OnceCallback<void(wl::TestWaylandServerThread* server)> callback) {
   // Sync with the display to ensure client's requests are processed.
-  SyncDisplay();
+  wl::SyncDisplay(connection_->display_wrapper(), *connection_->display());
 
   server_.RunAndWait(std::move(callback));
 
   // Sync with the display to ensure server's events are received and processed.
-  SyncDisplay();
+  wl::SyncDisplay(connection_->display_wrapper(), *connection_->display());
 }
 
 void WaylandTestBase::PostToServerAndWait(base::OnceClosure closure) {
   // Sync with the display to ensure client's requests are processed.
-  SyncDisplay();
+  wl::SyncDisplay(connection_->display_wrapper(), *connection_->display());
 
   server_.RunAndWait(std::move(closure));
 
   // Sync with the display to ensure server's events are received and processed
-  SyncDisplay();
+  wl::SyncDisplay(connection_->display_wrapper(), *connection_->display());
 }
 
 void WaylandTestBase::DisableSyncOnTearDown() {
@@ -165,30 +134,10 @@
   connection_->wayland_window_manager()->SetKeyboardFocusedWindow(window);
 }
 
-void WaylandTestBase::SendConfigureEvent(wl::MockXdgSurface* xdg_surface,
-                                         const gfx::Size& size,
-                                         uint32_t serial,
-                                         struct wl_array* states) {
-  const int32_t width = size.width();
-  const int32_t height = size.height();
-  // Please note that toplevel surfaces may not exist if the surface was created
-  // for the popup role.
-  if (xdg_surface->xdg_toplevel()) {
-    xdg_toplevel_send_configure(xdg_surface->xdg_toplevel()->resource(), width,
-                                height, states);
-  } else {
-    ASSERT_TRUE(xdg_surface->xdg_popup()->resource());
-    xdg_popup_send_configure(xdg_surface->xdg_popup()->resource(), 0, 0, width,
-                             height);
-  }
-  xdg_surface_send_configure(xdg_surface->resource(), serial);
-}
-
 void WaylandTestBase::SendConfigureEvent(uint32_t surface_id,
                                          const gfx::Size& size,
                                          const wl::ScopedWlArray& states,
                                          absl::optional<uint32_t> serial) {
-  ASSERT_EQ(server_mode_, TestServerMode::kAsync);
   PostToServerAndWait([size, surface_id, states,
                        serial](wl::TestWaylandServerThread* server) {
     auto* surface = server->GetObject<wl::MockSurface>(surface_id);
@@ -217,41 +166,16 @@
   });
 }
 
-void WaylandTestBase::ActivateSurface(wl::MockXdgSurface* xdg_surface) {
+void WaylandTestBase::ActivateSurface(uint32_t surface_id,
+                                      absl::optional<uint32_t> serial) {
   wl::ScopedWlArray state({XDG_TOPLEVEL_STATE_ACTIVATED});
-  SendConfigureEvent(xdg_surface, {0, 0}, 1, state.get());
-}
-
-void WaylandTestBase::ActivateSurface(uint32_t surface_id) {
-  ASSERT_EQ(server_mode_, TestServerMode::kAsync);
-  wl::ScopedWlArray state({XDG_TOPLEVEL_STATE_ACTIVATED});
-  SendConfigureEvent(surface_id, {0, 0}, state);
+  SendConfigureEvent(surface_id, {0, 0}, state, serial);
 }
 
 void WaylandTestBase::InitializeSurfaceAugmenter() {
-  if (server_mode_ == TestServerMode::kAsync) {
-    PostToServerAndWait([](wl::TestWaylandServerThread* server) {
-      server->EnsureSurfaceAugmenter();
-    });
-  } else {
-    server_.EnsureSurfaceAugmenter();
-    Sync();
-  }
-}
-
-void WaylandTestBase::SyncDisplay() {
-  ASSERT_EQ(server_mode_, TestServerMode::kAsync);
-  DCHECK(initialized_);
-  base::RunLoop run_loop;
-  wl::Object<wl_callback> sync_callback(
-      wl_display_sync(connection_->display_wrapper()));
-  wl_callback_listener listener = {
-      [](void* data, struct wl_callback* cb, uint32_t time) {
-        static_cast<base::RunLoop*>(data)->Quit();
-      }};
-  wl_callback_add_listener(sync_callback.get(), &listener, &run_loop);
-  connection_->Flush();
-  run_loop.Run();
+  PostToServerAndWait([](wl::TestWaylandServerThread* server) {
+    server->EnsureSurfaceAugmenter();
+  });
 }
 
 void WaylandTestBase::MaybeSetUpXkb() {
@@ -309,8 +233,7 @@
   return window;
 }
 
-WaylandTest::WaylandTest(WaylandTestBase::TestServerMode server_mode)
-    : WaylandTestBase(GetParam(), server_mode) {}
+WaylandTest::WaylandTest() : WaylandTestBase(GetParam()) {}
 
 WaylandTest::~WaylandTest() = default;
 
@@ -322,9 +245,7 @@
   WaylandTestBase::TearDown();
 }
 
-WaylandTestSimple::WaylandTestSimple(
-    WaylandTestBase::TestServerMode server_mode)
-    : WaylandTestBase({}, server_mode) {}
+WaylandTestSimple::WaylandTestSimple() : WaylandTestBase({}) {}
 
 WaylandTestSimple::~WaylandTestSimple() = default;
 
diff --git a/ui/ozone/platform/wayland/test/wayland_test.h b/ui/ozone/platform/wayland/test/wayland_test.h
index ed24458..2cea082 100644
--- a/ui/ozone/platform/wayland/test/wayland_test.h
+++ b/ui/ozone/platform/wayland/test/wayland_test.h
@@ -28,11 +28,6 @@
 #include "ui/events/ozone/layout/xkb/xkb_evdev_codes.h"
 #endif
 
-namespace wl {
-class MockSurface;
-class MockXdgSurface;
-}  // namespace wl
-
 namespace ui {
 
 class ScopedKeyboardLayoutEngine;
@@ -42,19 +37,7 @@
 // and allows easy synchronization between them.
 class WaylandTestBase {
  public:
-  // Specifies how the server should run.
-  // TODO(crbug.com/1365887): this must be removed once all tests switch to
-  // asynchronous mode.
-  enum class TestServerMode {
-    // The server will not be paused. The tests are expected to use
-    // PostToServerAndWait to access libwayland-server APIs.
-    kAsync = 0,
-    // The server will be paused. The tests directly access libwayland-server
-    // APIs.
-    kSync
-  };
-
-  WaylandTestBase(wl::ServerConfig config, TestServerMode server_mode);
+  explicit WaylandTestBase(wl::ServerConfig config);
   WaylandTestBase(const WaylandTestBase&) = delete;
   WaylandTestBase& operator=(const WaylandTestBase&) = delete;
   ~WaylandTestBase();
@@ -62,8 +45,6 @@
   void SetUp();
   void TearDown();
 
-  void Sync();
-
   // Posts 'callback' or 'closure' to run on the client thread; blocks till the
   // callable is run and all pending Wayland requests and events are delivered.
   void PostToServerAndWait(
@@ -89,11 +70,6 @@
   void SetPointerFocusedWindow(WaylandWindow* window);
   void SetKeyboardFocusedWindow(WaylandWindow* window);
 
-  // Sends configure event for the |xdg_surface|.
-  void SendConfigureEvent(wl::MockXdgSurface* xdg_surface,
-                          const gfx::Size& size,
-                          uint32_t serial,
-                          struct wl_array* states);
   // Sends configure event for the |surface_id|. Please note that |surface_id|
   // must be an id of the wl_surface that has xdg_surface role.
   void SendConfigureEvent(uint32_t surface_id,
@@ -101,23 +77,16 @@
                           const wl::ScopedWlArray& states,
                           absl::optional<uint32_t> serial = absl::nullopt);
 
-  // Sends XDG_TOPLEVEL_STATE_ACTIVATED to the |xdg_surface| with width and
-  // height set to 0, which results in asking the client to set the width and
-  // height of the surface.
-  void ActivateSurface(wl::MockXdgSurface* xdg_surface);
-  // Same as above, but uses surface_id. Requires the tests to use async test
-  // server.
-  void ActivateSurface(uint32_t surface_id);
+  // Sends XDG_TOPLEVEL_STATE_ACTIVATED to the surface that has |surface_id| and
+  // has xdg surface role with width and height set to 0, which results in
+  // asking the client to set the width and height of the surface. The client
+  // test may pass |serial| that will be used to activate the surface.
+  void ActivateSurface(uint32_t surface_id,
+                       absl::optional<uint32_t> serial = absl::nullopt);
 
   // Initializes SurfaceAugmenter in |server_|.
   void InitializeSurfaceAugmenter();
 
-  // Sets up a sync callback via wl_display.sync and waits until it's received.
-  // Requests are handled in-order and events are delivered in-order, thus sync
-  // is used as a barrier to ensure all previous requests and the resulting
-  // events have been handled.
-  void SyncDisplay();
-
   // A helper method that sets up the XKB configuration for tests that require
   // it.
   // Does nothing if XkbCommon is not used.
@@ -133,7 +102,6 @@
   base::test::TaskEnvironment task_environment_;
 
   wl::TestWaylandServerThread server_;
-  raw_ptr<wl::MockSurface> surface_;
 
   ::testing::NiceMock<MockWaylandPlatformWindowDelegate> delegate_;
   std::unique_ptr<ScopedKeyboardLayoutEngine> scoped_keyboard_layout_engine_;
@@ -157,8 +125,6 @@
   std::unique_ptr<KeyboardLayoutEngine> keyboard_layout_engine_;
   base::test::ScopedFeatureList feature_list_;
 
-  // The server will be set to asynchronous mode once started.
-  const TestServerMode server_mode_;
   const wl::ServerConfig config_;
 };
 
@@ -166,7 +132,7 @@
 class WaylandTest : public WaylandTestBase,
                     public ::testing::TestWithParam<wl::ServerConfig> {
  public:
-  explicit WaylandTest(TestServerMode server_mode = TestServerMode::kSync);
+  WaylandTest();
   WaylandTest(const WaylandTest&) = delete;
   WaylandTest& operator=(const WaylandTest&) = delete;
   ~WaylandTest() override;
@@ -178,8 +144,7 @@
 // Version of WaylandTest that uses simple test fixtures (TEST_F).
 class WaylandTestSimple : public WaylandTestBase, public ::testing::Test {
  public:
-  explicit WaylandTestSimple(WaylandTestBase::TestServerMode server_mode =
-                                 WaylandTestBase::TestServerMode::kAsync);
+  WaylandTestSimple();
   WaylandTestSimple(const WaylandTestSimple&) = delete;
   WaylandTestSimple& operator=(const WaylandTestSimple&) = delete;
   ~WaylandTestSimple() override;
diff --git a/ui/ozone/platform/wayland/wayland_buffer_manager_unittest.cc b/ui/ozone/platform/wayland/wayland_buffer_manager_unittest.cc
index f24498e..e9e94da 100644
--- a/ui/ozone/platform/wayland/wayland_buffer_manager_unittest.cc
+++ b/ui/ozone/platform/wayland/wayland_buffer_manager_unittest.cc
@@ -38,6 +38,7 @@
 #include "ui/ozone/platform/wayland/test/mock_surface.h"
 #include "ui/ozone/platform/wayland/test/mock_zwp_linux_dmabuf.h"
 #include "ui/ozone/platform/wayland/test/test_overlay_prioritized_surface.h"
+#include "ui/ozone/platform/wayland/test/test_util.h"
 #include "ui/ozone/platform/wayland/test/test_zwp_linux_buffer_params.h"
 #include "ui/ozone/platform/wayland/test/wayland_test.h"
 #include "ui/platform_window/platform_window_init_properties.h"
@@ -102,14 +103,9 @@
 
 class WaylandBufferManagerTest : public WaylandTest {
  public:
-  // TODO(crbug.com/1365887): TestServerMode::kAsync must be removed once all
-  // tests switch to asynchronous mode.
-  WaylandBufferManagerTest()
-      : WaylandTest(WaylandTest::TestServerMode::kAsync) {}
-
+  WaylandBufferManagerTest() = default;
   WaylandBufferManagerTest(const WaylandBufferManagerTest&) = delete;
   WaylandBufferManagerTest& operator=(const WaylandBufferManagerTest&) = delete;
-
   ~WaylandBufferManagerTest() override = default;
 
   void SetUp() override {
@@ -288,7 +284,7 @@
                                             std::move(properties));
     EXPECT_TRUE(new_window);
 
-    SyncDisplay();
+    wl::SyncDisplay(connection_->display_wrapper(), *connection_->display());
 
     EXPECT_NE(new_window->GetWidget(), gfx::kNullAcceleratedWidget);
     return new_window;
@@ -1453,12 +1449,13 @@
   // amount. I.e: No buffer attaches before setting geometry + acking initial
   // configure sequence, etc.
 
+  constexpr uint32_t kActivateSerial = 1u;
   PostToServerAndWait([surface_id, bounds = kRestoredBounds](
                           wl::TestWaylandServerThread* server) {
     auto* mock_surface = server->GetObject<wl::MockSurface>(surface_id);
     auto* xdg_surface = mock_surface->xdg_surface();
     EXPECT_CALL(*xdg_surface, SetWindowGeometry(bounds)).Times(1);
-    EXPECT_CALL(*xdg_surface, AckConfigure(1)).Times(1);
+    EXPECT_CALL(*xdg_surface, AckConfigure(kActivateSerial)).Times(1);
     EXPECT_CALL(*mock_surface, Attach(_, 0, 0)).Times(1);
     EXPECT_CALL(*mock_surface, Frame(_)).Times(1);
     EXPECT_CALL(*mock_surface, Commit()).Times(1);
@@ -1466,7 +1463,7 @@
 
   CommitBuffer(widget, kDmabufBufferId, kDmabufBufferId, gfx::Rect{55, 55},
                gfx::RoundedCornersF(), kDefaultScale, gfx::Rect{55, 55});
-  ActivateSurface(surface_id);
+  ActivateSurface(surface_id, kActivateSerial);
 
   CommitBuffer(widget, kDmabufBufferId, kDmabufBufferId, kRestoredBounds,
                gfx::RoundedCornersF(), kDefaultScale, kRestoredBounds);
diff --git a/ui/ozone/public/surface_factory_ozone.cc b/ui/ozone/public/surface_factory_ozone.cc
index 7f5435fd..b29f161 100644
--- a/ui/ozone/public/surface_factory_ozone.cc
+++ b/ui/ozone/public/surface_factory_ozone.cc
@@ -130,4 +130,9 @@
   return std::vector<gfx::BufferFormat>();
 }
 
+absl::optional<gfx::BufferFormat>
+SurfaceFactoryOzone::GetPreferredFormatForSolidColor() const {
+  return absl::nullopt;
+}
+
 }  // namespace ui
diff --git a/ui/ozone/public/surface_factory_ozone.h b/ui/ozone/public/surface_factory_ozone.h
index 20659520..8b7806e85 100644
--- a/ui/ozone/public/surface_factory_ozone.h
+++ b/ui/ozone/public/surface_factory_ozone.h
@@ -208,6 +208,10 @@
   virtual std::vector<gfx::BufferFormat> GetSupportedFormatsForTexturing()
       const;
 
+  // This returns a preferred format for solid color image on Wayland.
+  virtual absl::optional<gfx::BufferFormat> GetPreferredFormatForSolidColor()
+      const;
+
  protected:
   SurfaceFactoryOzone();
   virtual ~SurfaceFactoryOzone();
diff --git a/ui/shell_dialogs/fake_select_file_dialog.h b/ui/shell_dialogs/fake_select_file_dialog.h
index 4f45471..e4e30bad 100644
--- a/ui/shell_dialogs/fake_select_file_dialog.h
+++ b/ui/shell_dialogs/fake_select_file_dialog.h
@@ -110,7 +110,7 @@
   FileTypeInfo file_types_;
   std::string default_extension_;
   raw_ptr<void> params_;
-  const GURL* caller_;
+  raw_ptr<const GURL> caller_;
   base::WeakPtrFactory<FakeSelectFileDialog> weak_ptr_factory_{this};
 };
 
diff --git a/ui/views/animation/animation_key.h b/ui/views/animation/animation_key.h
index 28ff8c73..90ca5f09 100644
--- a/ui/views/animation/animation_key.h
+++ b/ui/views/animation/animation_key.h
@@ -7,6 +7,7 @@
 
 #include <tuple>
 
+#include "base/memory/raw_ptr.h"
 #include "ui/compositor/layer_animation_element.h"
 
 namespace ui {
@@ -16,7 +17,7 @@
 namespace views {
 
 struct AnimationKey {
-  ui::Layer* target;
+  raw_ptr<ui::Layer> target;
   ui::LayerAnimationElement::AnimatableProperty property;
 
   bool operator<(const AnimationKey& key) const {
diff --git a/ui/views/bubble/bubble_dialog_model_host.cc b/ui/views/bubble/bubble_dialog_model_host.cc
index f8e06a0..155d0a8 100644
--- a/ui/views/bubble/bubble_dialog_model_host.cc
+++ b/ui/views/bubble/bubble_dialog_model_host.cc
@@ -908,8 +908,8 @@
 
 View* BubbleDialogModelHost::GetTargetView(
     const DialogModelHostField& field_view_info) {
-  return field_view_info.focusable_view ? field_view_info.focusable_view
-                                        : field_view_info.field_view;
+  return field_view_info.focusable_view ? field_view_info.focusable_view.get()
+                                        : field_view_info.field_view.get();
 }
 
 bool BubbleDialogModelHost::DialogModelLabelRequiresStyledLabel(
diff --git a/ui/views/bubble/bubble_dialog_model_host.h b/ui/views/bubble/bubble_dialog_model_host.h
index 2053242..ed8dc358 100644
--- a/ui/views/bubble/bubble_dialog_model_host.h
+++ b/ui/views/bubble/bubble_dialog_model_host.h
@@ -113,16 +113,16 @@
   };
 
   struct DialogModelHostField {
-    ui::DialogModelField* dialog_model_field;
+    raw_ptr<ui::DialogModelField> dialog_model_field;
 
     // View representing the entire field.
-    View* field_view;
+    raw_ptr<View> field_view;
 
     // Child view to |field_view|, if any, that's used for focus. For instance,
     // a textfield row would be a container that contains both a
     // views::Textfield and a descriptive label. In this case |focusable_view|
     // would refer to the views::Textfield which is also what would gain focus.
-    View* focusable_view;
+    raw_ptr<View> focusable_view;
   };
 
   void OnWindowClosing();
diff --git a/ui/views/controls/menu/menu_controller.cc b/ui/views/controls/menu/menu_controller.cc
index c66cddd..98091f3 100644
--- a/ui/views/controls/menu/menu_controller.cc
+++ b/ui/views/controls/menu/menu_controller.cc
@@ -729,7 +729,7 @@
         part.menu = source->GetMenuItem();
       else
         mouse_menu = part.menu;
-      SetSelection(part.menu ? part.menu : state_.item.get(),
+      SetSelection(part.menu ? part.menu.get() : state_.item.get(),
                    SELECTION_OPEN_SUBMENU);
     }
   } else if (part.type == MenuPart::Type::kNone) {
@@ -833,7 +833,7 @@
     }
   } else if (part.type == MenuPart::Type::kMenuItem) {
     // User either clicked on empty space, or a menu that has children.
-    SetSelection(part.menu ? part.menu : state_.item.get(),
+    SetSelection(part.menu ? part.menu.get() : state_.item.get(),
                  SELECTION_OPEN_SUBMENU | SELECTION_UPDATE_IMMEDIATELY);
   }
   SendMouseCaptureLostToActiveView();
@@ -889,7 +889,7 @@
                                   const ui::MouseWheelEvent& event) {
   MenuPart part = GetMenuPart(source, event.location());
 
-  SetSelection(part.menu ? part.menu : state_.item.get(),
+  SetSelection(part.menu ? part.menu.get() : state_.item.get(),
                SELECTION_OPEN_SUBMENU | SELECTION_UPDATE_IMMEDIATELY);
 
   return part.submenu && part.submenu->OnMouseWheel(event);
@@ -953,7 +953,7 @@
       event->StopPropagation();
     } else if (part.type == MenuPart::Type::kMenuItem) {
       // User either tapped on empty space, or a menu that has children.
-      SetSelection(part.menu ? part.menu : state_.item.get(),
+      SetSelection(part.menu ? part.menu.get() : state_.item.get(),
                    SELECTION_OPEN_SUBMENU | SELECTION_UPDATE_IMMEDIATELY);
       event->StopPropagation();
     }
diff --git a/ui/views/controls/menu/menu_controller.h b/ui/views/controls/menu/menu_controller.h
index aa811f23c..66c8cff2 100644
--- a/ui/views/controls/menu/menu_controller.h
+++ b/ui/views/controls/menu/menu_controller.h
@@ -357,14 +357,14 @@
     //       but is over a menu (for example, the mouse is over a separator or
     //       empty menu), this is null and parent is the menu the mouse was
     //       clicked on.
-    MenuItemView* menu = nullptr;
+    raw_ptr<MenuItemView> menu = nullptr;
 
     // If type is kMenuItem but the mouse is not over a menu item this is the
     // parent of the menu item the user clicked on. Otherwise this is null.
-    MenuItemView* parent = nullptr;
+    raw_ptr<MenuItemView> parent = nullptr;
 
     // This is the submenu the mouse is over.
-    SubmenuView* submenu = nullptr;
+    raw_ptr<SubmenuView> submenu = nullptr;
 
     // Whether the controller should apply SELECTION_OPEN_SUBMENU to this item.
     bool should_submenu_show = false;
diff --git a/ui/views/controls/menu/menu_host.cc b/ui/views/controls/menu/menu_host.cc
index 3f72d409..821826d 100644
--- a/ui/views/controls/menu/menu_host.cc
+++ b/ui/views/controls/menu/menu_host.cc
@@ -172,7 +172,7 @@
 #endif
 
   DCHECK(!owner_);
-  owner_ = init_params.parent;
+  owner_ = init_params.parent.get();
   if (owner_)
     owner_->AddObserver(this);
 
diff --git a/ui/views/controls/menu/menu_host.h b/ui/views/controls/menu/menu_host.h
index 0720b74..67cdb88 100644
--- a/ui/views/controls/menu/menu_host.h
+++ b/ui/views/controls/menu/menu_host.h
@@ -42,15 +42,15 @@
 class MenuHost : public Widget, public WidgetObserver {
  public:
   struct InitParams {
-    Widget* parent = nullptr;
+    raw_ptr<Widget> parent = nullptr;
     gfx::Rect bounds;
-    View* contents_view = nullptr;
+    raw_ptr<View> contents_view = nullptr;
     bool do_capture = false;
     gfx::NativeView native_view_for_gestures;
     ui::MenuType menu_type = ui::MenuType::kRootContextMenu;
     // Window that is stacked below a new menu window (can be different from the
     // |parent|).
-    Widget* context = nullptr;
+    raw_ptr<Widget> context = nullptr;
 
     // Additional information that helps to position anchored windows in such
     // backends as Wayland.
diff --git a/ui/views/controls/native/native_view_host_aura_unittest.cc b/ui/views/controls/native/native_view_host_aura_unittest.cc
index f54f00d..e14a495 100644
--- a/ui/views/controls/native/native_view_host_aura_unittest.cc
+++ b/ui/views/controls/native/native_view_host_aura_unittest.cc
@@ -44,7 +44,7 @@
 
   struct EventDetails {
     EventType type;
-    aura::Window* window;
+    raw_ptr<aura::Window> window;
     gfx::Rect bounds;
     bool operator!=(const EventDetails& rhs) {
       return type != rhs.type || window != rhs.window || bounds != rhs.bounds;
diff --git a/ui/views/examples/layout_example_base.h b/ui/views/examples/layout_example_base.h
index e6ca5f1d..535b24d 100644
--- a/ui/views/examples/layout_example_base.h
+++ b/ui/views/examples/layout_example_base.h
@@ -27,10 +27,10 @@
  public:
   // Grouping of multiple textfields that provide insets.
   struct InsetTextfields {
-    Textfield* left = nullptr;
-    Textfield* top = nullptr;
-    Textfield* right = nullptr;
-    Textfield* bottom = nullptr;
+    raw_ptr<Textfield> left = nullptr;
+    raw_ptr<Textfield> top = nullptr;
+    raw_ptr<Textfield> right = nullptr;
+    raw_ptr<Textfield> bottom = nullptr;
   };
 
   // This view is created and added to the left-side view in the FullPanel each
diff --git a/ui/views/focus/focus_traversal_unittest.cc b/ui/views/focus/focus_traversal_unittest.cc
index d50f0c9..44a0ba3 100644
--- a/ui/views/focus/focus_traversal_unittest.cc
+++ b/ui/views/focus/focus_traversal_unittest.cc
@@ -175,7 +175,7 @@
 
  private:
   std::unique_ptr<View> child_;
-  Widget* widget_ = nullptr;
+  raw_ptr<Widget> widget_ = nullptr;
 };
 
 }  // namespace
diff --git a/ui/views/layout/animating_layout_manager.cc b/ui/views/layout/animating_layout_manager.cc
index 374666d..32c5b365 100644
--- a/ui/views/layout/animating_layout_manager.cc
+++ b/ui/views/layout/animating_layout_manager.cc
@@ -88,13 +88,13 @@
   // How the child view is fading.
   LayoutFadeType fade_type;
   // The child view which is fading.
-  View* child_view = nullptr;
+  raw_ptr<View> child_view = nullptr;
   // The view previous (leading side) to the fading view which is in both the
   // starting and target layout, or null if none.
-  View* prev_view = nullptr;
+  raw_ptr<View> prev_view = nullptr;
   // The view next (trailing side) to the fading view which is in both the
   // starting and target layout, or null if none.
-  View* next_view = nullptr;
+  raw_ptr<View> next_view = nullptr;
   // The full-size bounds, normalized to the orientation of the layout manager,
   // that |child_view| starts with, if fading out, or ends with, if fading in.
   NormalizedRect reference_bounds;
diff --git a/ui/views/layout/proposed_layout.h b/ui/views/layout/proposed_layout.h
index 462163b6..bbadcfa0 100644
--- a/ui/views/layout/proposed_layout.h
+++ b/ui/views/layout/proposed_layout.h
@@ -8,6 +8,7 @@
 #include <string>
 #include <vector>
 
+#include "base/memory/raw_ptr.h"
 #include "ui/gfx/geometry/rect.h"
 #include "ui/views/layout/layout_types.h"
 #include "ui/views/views_export.h"
@@ -26,7 +27,7 @@
 
   std::string ToString() const;
 
-  View* child_view = nullptr;
+  raw_ptr<View> child_view = nullptr;
   bool visible = false;
   gfx::Rect bounds;
   SizeBounds available_size;
diff --git a/ui/views/layout/table_layout.cc b/ui/views/layout/table_layout.cc
index ccaf63c4..ae6dda41 100644
--- a/ui/views/layout/table_layout.cc
+++ b/ui/views/layout/table_layout.cc
@@ -11,6 +11,7 @@
 #include <utility>
 
 #include "base/check_op.h"
+#include "base/memory/raw_ptr.h"
 #include "base/notreached.h"
 #include "base/numerics/safe_conversions.h"
 #include "base/ranges/algorithm.h"
@@ -757,7 +758,7 @@
 void TableLayout::ResizeUsingMin(int total_delta) const {
   struct ColumnMinResizeData {
     // The column being resized.
-    Column* column;
+    raw_ptr<Column> column;
 
     // The remaining amount of space available (the difference between the
     // preferred and minimum).
diff --git a/ui/views/view_unittest.cc b/ui/views/view_unittest.cc
index a03a8adf..f2efca48 100644
--- a/ui/views/view_unittest.cc
+++ b/ui/views/view_unittest.cc
@@ -5216,7 +5216,7 @@
   const ui::NativeTheme* GetNativeTheme() const override { return theme_; }
 
  private:
-  ui::TestNativeTheme* theme_;
+  raw_ptr<ui::TestNativeTheme> theme_;
 };
 
 // See comment above test for details.
diff --git a/ui/webui/examples/browser/browser_main_parts.cc b/ui/webui/examples/browser/browser_main_parts.cc
index 4c63a0dc..8cec4f8d 100644
--- a/ui/webui/examples/browser/browser_main_parts.cc
+++ b/ui/webui/examples/browser/browser_main_parts.cc
@@ -8,6 +8,7 @@
 
 #include "base/bind.h"
 #include "base/callback.h"
+#include "base/memory/raw_ptr.h"
 #include "base/run_loop.h"
 #include "content/public/browser/browser_context.h"
 #include "content/public/browser/browser_task_traits.h"
@@ -49,7 +50,7 @@
         create_window_func_.Run(frontend->frontend_url()));
   }
 
-  content::WebContents* const web_contents_;
+  const raw_ptr<content::WebContents> web_contents_;
   CreateContentWindowFunc create_window_func_;
 };
 
diff --git a/ui/webui/examples/browser/content_browser_client.h b/ui/webui/examples/browser/content_browser_client.h
index a1ac027..9889828b 100644
--- a/ui/webui/examples/browser/content_browser_client.h
+++ b/ui/webui/examples/browser/content_browser_client.h
@@ -7,6 +7,7 @@
 
 #include <memory>
 
+#include "base/memory/raw_ptr.h"
 #include "content/public/browser/content_browser_client.h"
 
 namespace webui_examples {
@@ -29,7 +30,7 @@
   std::unique_ptr<content::DevToolsManagerDelegate>
   CreateDevToolsManagerDelegate() override;
 
-  BrowserMainParts* browser_main_parts_ = nullptr;
+  raw_ptr<BrowserMainParts> browser_main_parts_ = nullptr;
 };
 
 }  // namespace webui_examples
diff --git a/weblayer/browser/tab_impl.cc b/weblayer/browser/tab_impl.cc
index a4b3727..df35a93 100644
--- a/weblayer/browser/tab_impl.cc
+++ b/weblayer/browser/tab_impl.cc
@@ -12,6 +12,7 @@
 #include "base/feature_list.h"
 #include "base/guid.h"
 #include "base/logging.h"
+#include "base/memory/raw_ptr.h"
 #include "base/no_destructor.h"
 #include "base/task/thread_pool.h"
 #include "base/time/default_tick_clock.h"
@@ -200,7 +201,7 @@
 constexpr int kWebContentsUserDataKey = 0;
 
 struct UserData : public base::SupportsUserData::Data {
-  TabImpl* tab = nullptr;
+  raw_ptr<TabImpl> tab = nullptr;
 };
 
 #if BUILDFLAG(IS_ANDROID)
@@ -478,7 +479,7 @@
 
   UserData* user_data = reinterpret_cast<UserData*>(
       web_contents->GetUserData(&kWebContentsUserDataKey));
-  return user_data ? user_data->tab : nullptr;
+  return user_data ? user_data->tab.get() : nullptr;
 }
 
 // static
diff --git a/weblayer/browser/webrtc/media_stream_manager.cc b/weblayer/browser/webrtc/media_stream_manager.cc
index ebb4cdd..e3c599d8 100644
--- a/weblayer/browser/webrtc/media_stream_manager.cc
+++ b/weblayer/browser/webrtc/media_stream_manager.cc
@@ -6,6 +6,7 @@
 
 #include <utility>
 
+#include "base/memory/raw_ptr.h"
 #include "base/supports_user_data.h"
 #include "components/webrtc/media_stream_devices_controller.h"
 #include "content/public/browser/media_stream_request.h"
@@ -24,7 +25,7 @@
 constexpr int kWebContentsUserDataKey = 0;
 
 struct UserData : public base::SupportsUserData::Data {
-  MediaStreamManager* manager = nullptr;
+  raw_ptr<MediaStreamManager> manager = nullptr;
 };
 
 }  // namespace