diff --git a/DEPS b/DEPS
index 8e61ef12..41b948d 100644
--- a/DEPS
+++ b/DEPS

@@ -39,11 +39,11 @@
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling Skia
   # and whatever else without interference from each other.
-  'skia_revision': '044d3c185876f9960f07b88f068cf08d78311e33',
+  'skia_revision': '11171f3b66ba6aba561fcaafbc51eaa354b73353',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling V8
   # and whatever else without interference from each other.
-  'v8_revision': '167dc63b4c9a1d0f0fe1b19af93644ac9a561e83',
+  'v8_revision': '23da806c07a3b32590513f4f74bb25b3aa7086d2',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling swarming_client
   # and whatever else without interference from each other.
@@ -100,7 +100,7 @@
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling catapult
   # and whatever else without interference from each other.
-  'catapult_revision': '6ddc7cae0322ac1896c3009510454c000d1089b9',
+  'catapult_revision': '4ab1cadef13b0f085cddfae744ba9c99421ea2cc',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling libFuzzer
   # and whatever else without interference from each other.
@@ -220,7 +220,7 @@
    Var('chromium_git') + '/native_client/src/third_party/scons-2.0.1.git' + '@' + '1c1550e17fc26355d08627fbdec13d8291227067',
 
   'src/third_party/webrtc':
-    Var('chromium_git') + '/external/webrtc/trunk/webrtc.git' + '@' + 'b7119195a1115ece827e5940693154322bf9b79d', # commit position 12274
+    Var('chromium_git') + '/external/webrtc/trunk/webrtc.git' + '@' + 'faef168b8094c69749968b4d3c69152b19bfde42', # commit position 12279
 
   'src/third_party/openmax_dl':
     Var('chromium_git') + '/external/webrtc/deps/third_party/openmax.git' + '@' +  Var('openmax_dl_revision'),

diff --git a/ash/shelf/shelf_layout_manager_unittest.cc b/ash/shelf/shelf_layout_manager_unittest.cc
index 91d34cb..8703963 100644
--- a/ash/shelf/shelf_layout_manager_unittest.cc
+++ b/ash/shelf/shelf_layout_manager_unittest.cc

@@ -2325,15 +2325,15 @@
     return;
   Shell::GetInstance()->display_manager()->SetUnifiedDesktopEnabled(true);
 
-  UpdateDisplay("500x500, 500x500");
+  UpdateDisplay("500x400, 500x400");
 
   StatusAreaWidget* status_area_widget =
       Shell::GetPrimaryRootWindowController()->shelf()->status_area_widget();
   EXPECT_TRUE(status_area_widget->IsVisible());
   // Shelf should be in the first display's area.
-  // TODO: make this test more robust against changes in font, font size.
-  EXPECT_EQ("353,453 147x47",
-            status_area_widget->GetWindowBoundsInScreen().ToString());
+  gfx::Rect status_area_bounds(status_area_widget->GetWindowBoundsInScreen());
+  EXPECT_TRUE(gfx::Rect(0, 0, 500, 400).Contains(status_area_bounds));
+  EXPECT_EQ(gfx::Point(500, 400), status_area_bounds.bottom_right());
 }
 
 }  // namespace ash

diff --git a/breakpad/BUILD.gn b/breakpad/BUILD.gn
index 1213850..fd8b457 100644
--- a/breakpad/BUILD.gn
+++ b/breakpad/BUILD.gn

@@ -217,10 +217,10 @@
   } else {
     # Aliases for convenience.
     binary_symlink("microdump_stackwalk") {
-      binary_label = ":dump_syms($host_toolchain)"
+      binary_label = ":$target_name($host_toolchain)"
     }
     binary_symlink("minidump_stackwalk") {
-      binary_label = ":dump_syms($host_toolchain)"
+      binary_label = ":$target_name($host_toolchain)"
     }
     binary_symlink("minidump_dump") {
       binary_label = ":$target_name($host_toolchain)"

diff --git a/build/android/pylib/local/device/local_device_instrumentation_test_run.py b/build/android/pylib/local/device/local_device_instrumentation_test_run.py
index 7ecc52b..f2a75299 100644
--- a/build/android/pylib/local/device/local_device_instrumentation_test_run.py
+++ b/build/android/pylib/local/device/local_device_instrumentation_test_run.py

@@ -141,6 +141,8 @@
         self._test_instance.GetDataDependencies())
 
   def TearDown(self):
+    @local_device_test_run.handle_shard_failures_with(
+        self._env.BlacklistDevice)
     def individual_device_tear_down(dev):
       if str(dev) in self._flag_changers:
         self._flag_changers[str(dev)].Restore()

diff --git a/build/sanitizers/lsan_suppressions.cc b/build/sanitizers/lsan_suppressions.cc
index 5377c9e..afe4c356 100644
--- a/build/sanitizers/lsan_suppressions.cc
+++ b/build/sanitizers/lsan_suppressions.cc

@@ -76,6 +76,9 @@
 // http://crbug.com/356306
 "leak:content::SetProcessTitleFromCommandLine\n"
 
+// http://crbug.com/601435
+"leak:mojo/edk/js/handle.h\n"
+
 // PLEASE READ ABOVE BEFORE ADDING NEW SUPPRESSIONS.
 
 // End of suppressions.

diff --git a/cc/layers/video_frame_provider.h b/cc/layers/video_frame_provider.h
index f747a88..e7619a3 100644
--- a/cc/layers/video_frame_provider.h
+++ b/cc/layers/video_frame_provider.h

@@ -47,9 +47,6 @@
     // BeginFrameObserver based approach. http://crbug.com/336733
     virtual void DidReceiveFrame() = 0;
 
-    // Notifies the client of a new UV transform matrix to be used.
-    virtual void DidUpdateMatrix(const float* matrix) = 0;
-
    protected:
     virtual ~Client() {}
   };

diff --git a/cc/layers/video_frame_provider_client_impl.cc b/cc/layers/video_frame_provider_client_impl.cc
index f2c5eb2..5e9fd33 100644
--- a/cc/layers/video_frame_provider_client_impl.cc
+++ b/cc/layers/video_frame_provider_client_impl.cc

@@ -151,17 +151,6 @@
     active_video_layer_->SetNeedsRedraw();
 }
 
-void VideoFrameProviderClientImpl::DidUpdateMatrix(const float* matrix) {
-  DCHECK(thread_checker_.CalledOnValidThread());
-  stream_texture_matrix_ = gfx::Transform(
-      matrix[0], matrix[4], matrix[8], matrix[12],
-      matrix[1], matrix[5], matrix[9], matrix[13],
-      matrix[2], matrix[6], matrix[10], matrix[14],
-      matrix[3], matrix[7], matrix[11], matrix[15]);
-  if (active_video_layer_)
-    active_video_layer_->SetNeedsRedraw();
-}
-
 void VideoFrameProviderClientImpl::OnBeginFrame(const BeginFrameArgs& args) {
   DCHECK(thread_checker_.CalledOnValidThread());
   DCHECK(rendering_);

diff --git a/cc/layers/video_frame_provider_client_impl.h b/cc/layers/video_frame_provider_client_impl.h
index 17525ec..349b25d 100644
--- a/cc/layers/video_frame_provider_client_impl.h
+++ b/cc/layers/video_frame_provider_client_impl.h

@@ -58,7 +58,6 @@
   void StartRendering() override;
   void StopRendering() override;
   void DidReceiveFrame() override;
-  void DidUpdateMatrix(const float* matrix) override;
 
   const VideoFrameProvider* get_provider_for_testing() const {
     return provider_;

diff --git a/cc/layers/video_frame_provider_client_impl_unittest.cc b/cc/layers/video_frame_provider_client_impl_unittest.cc
index e337baa9..eaa0e6f 100644
--- a/cc/layers/video_frame_provider_client_impl_unittest.cc
+++ b/cc/layers/video_frame_provider_client_impl_unittest.cc

@@ -140,29 +140,4 @@
   StopRendering();
 }
 
-TEST_F(VideoFrameProviderClientImplTest, StreamTextureMatrix) {
-  const float kIdentityMatrix[] = {
-      1.0,
-      0.0,
-      0.0,
-      0.0,
-      0.0,
-      1.0,
-      0.0,
-      0.0,
-      0.0,
-      0.0,
-      1.0,
-      0.0,
-      0.0,
-      0.0,
-      0.0,
-      1.0,
-  };
-
-  EXPECT_FALSE(client_impl_->StreamTextureMatrix().IsIdentity());
-  client_impl_->DidUpdateMatrix(kIdentityMatrix);
-  EXPECT_TRUE(client_impl_->StreamTextureMatrix().IsIdentity());
-}
-
 }  // namespace cc

diff --git a/cc/trees/layer_tree_host_common.cc b/cc/trees/layer_tree_host_common.cc
index fd636302..5104bab 100644
--- a/cc/trees/layer_tree_host_common.cc
+++ b/cc/trees/layer_tree_host_common.cc

@@ -930,8 +930,6 @@
   draw_property_utils::FindLayersThatNeedUpdates(
       inputs->root_layer, property_trees->transform_tree,
       property_trees->effect_tree, &update_layer_list);
-  draw_property_utils::ComputeVisibleRectsForTesting(
-      property_trees, can_render_to_separate_surface, &update_layer_list);
 }
 
 void LayerTreeHostCommon::CalculateDrawProperties(

diff --git a/cc/trees/layer_tree_host_common_unittest.cc b/cc/trees/layer_tree_host_common_unittest.cc
index 394548d..2260536 100644
--- a/cc/trees/layer_tree_host_common_unittest.cc
+++ b/cc/trees/layer_tree_host_common_unittest.cc

@@ -1000,10 +1000,9 @@
 }
 
 TEST_F(LayerTreeHostCommonTest, LayerFullyContainedWithinClipInTargetSpace) {
-  scoped_refptr<Layer> root = Layer::Create();
-  scoped_refptr<Layer> child = Layer::Create();
-  scoped_refptr<LayerWithForcedDrawsContent> grand_child =
-      make_scoped_refptr(new LayerWithForcedDrawsContent());
+  LayerImpl* root = root_layer();
+  LayerImpl* child = AddChild<LayerImpl>(root);
+  LayerImpl* grand_child = AddChild<LayerImpl>(child);
 
   gfx::Transform child_transform;
   child_transform.Translate(50.0, 50.0);
@@ -1013,27 +1012,26 @@
   grand_child_transform.RotateAboutYAxis(90.0);
 
   const gfx::Transform identity_matrix;
-  SetLayerPropertiesForTesting(root.get(), identity_matrix, gfx::Point3F(),
-                               gfx::PointF(), gfx::Size(200, 200), true, false);
-  SetLayerPropertiesForTesting(child.get(), child_transform, gfx::Point3F(),
-                               gfx::PointF(), gfx::Size(10, 10), true, false);
-  SetLayerPropertiesForTesting(grand_child.get(), grand_child_transform,
+  SetLayerPropertiesForTesting(root, identity_matrix, gfx::Point3F(),
+                               gfx::PointF(), gfx::Size(200, 200), true, false,
+                               true);
+  SetLayerPropertiesForTesting(child, child_transform, gfx::Point3F(),
+                               gfx::PointF(), gfx::Size(10, 10), true, false,
+                               false);
+  SetLayerPropertiesForTesting(grand_child, grand_child_transform,
                                gfx::Point3F(), gfx::PointF(),
-                               gfx::Size(100, 100), true, false);
+                               gfx::Size(100, 100), true, false, false);
 
-  root->AddChild(child);
-  child->AddChild(grand_child);
   grand_child->SetShouldFlattenTransform(false);
+  grand_child->SetDrawsContent(true);
 
-  host()->SetRootLayer(root);
-
-  ExecuteCalculateDrawPropertiesWithPropertyTrees(root.get());
+  ExecuteCalculateDrawProperties(root);
 
   // Mapping grand_child's bounds to target space produces a non-empty rect
   // that is fully contained within the target's bounds, so grand_child should
   // be considered fully visible.
   EXPECT_EQ(gfx::Rect(grand_child->bounds()),
-            grand_child->visible_layer_rect_for_testing());
+            grand_child->visible_layer_rect());
 }
 
 TEST_F(LayerTreeHostCommonTest, TransformsForDegenerateIntermediateLayer) {
@@ -3117,35 +3115,33 @@
 }
 
 TEST_F(LayerTreeHostCommonTest, VisibleContentRectWithClippingAndScaling) {
-  scoped_refptr<Layer> root = Layer::Create();
-  scoped_refptr<Layer> child = Layer::Create();
-  scoped_refptr<LayerWithForcedDrawsContent> grand_child =
-      make_scoped_refptr(new LayerWithForcedDrawsContent());
-  root->AddChild(child);
-  child->AddChild(grand_child);
-
-  host()->SetRootLayer(root);
+  LayerImpl* root = root_layer();
+  LayerImpl* child = AddChild<LayerImpl>(root);
+  LayerImpl* grand_child = AddChild<LayerImpl>(child);
 
   gfx::Transform identity_matrix;
   gfx::Transform child_scale_matrix;
   child_scale_matrix.Scale(0.25f, 0.25f);
   gfx::Transform grand_child_scale_matrix;
   grand_child_scale_matrix.Scale(0.246f, 0.246f);
-  SetLayerPropertiesForTesting(root.get(), identity_matrix, gfx::Point3F(),
-                               gfx::PointF(), gfx::Size(100, 100), true, false);
-  SetLayerPropertiesForTesting(child.get(), child_scale_matrix, gfx::Point3F(),
-                               gfx::PointF(), gfx::Size(10, 10), true, false);
-  SetLayerPropertiesForTesting(grand_child.get(), grand_child_scale_matrix,
+  SetLayerPropertiesForTesting(root, identity_matrix, gfx::Point3F(),
+                               gfx::PointF(), gfx::Size(100, 100), true, false,
+                               true);
+  SetLayerPropertiesForTesting(child, child_scale_matrix, gfx::Point3F(),
+                               gfx::PointF(), gfx::Size(10, 10), true, false,
+                               false);
+  SetLayerPropertiesForTesting(grand_child, grand_child_scale_matrix,
                                gfx::Point3F(), gfx::PointF(),
-                               gfx::Size(100, 100), true, false);
+                               gfx::Size(100, 100), true, false, false);
 
   child->SetMasksToBounds(true);
-  ExecuteCalculateDrawPropertiesWithPropertyTrees(root.get());
+  grand_child->SetDrawsContent(true);
+  ExecuteCalculateDrawProperties(root);
 
   // The visible rect is expanded to integer coordinates in target space before
   // being projected back to layer space, where it is once again expanded to
   // integer coordinates.
-  EXPECT_EQ(gfx::Rect(49, 49), grand_child->visible_layer_rect_for_testing());
+  EXPECT_EQ(gfx::Rect(49, 49), grand_child->visible_layer_rect());
 }
 
 TEST_F(LayerTreeHostCommonTest,
@@ -5796,58 +5792,28 @@
 }
 
 TEST_F(LayerTreeHostCommonTest, VisibleContentRectInsideSurface) {
-  FakeImplTaskRunnerProvider task_runner_provider;
-  TestSharedBitmapManager shared_bitmap_manager;
-  TestTaskGraphRunner task_graph_runner;
-  FakeLayerTreeHostImpl host_impl(&task_runner_provider, &shared_bitmap_manager,
-                                  &task_graph_runner);
-  host_impl.CreatePendingTree();
+  LayerImpl* root = root_layer();
+  LayerImpl* surface = AddChild<LayerImpl>(root);
+  LayerImpl* surface_child = AddChild<LayerImpl>(surface);
+
   const gfx::Transform identity_matrix;
-
-  scoped_refptr<Layer> root = Layer::Create();
-  SetLayerPropertiesForTesting(root.get(),
-                               identity_matrix,
-                               gfx::Point3F(),
-                               gfx::PointF(),
-                               gfx::Size(50, 50),
-                               true,
+  SetLayerPropertiesForTesting(root, identity_matrix, gfx::Point3F(),
+                               gfx::PointF(), gfx::Size(50, 50), true, false,
+                               true);
+  SetLayerPropertiesForTesting(surface, identity_matrix, gfx::Point3F(),
+                               gfx::PointF(-10, 20), gfx::Size(), true, false,
+                               true);
+  SetLayerPropertiesForTesting(surface_child, identity_matrix, gfx::Point3F(),
+                               gfx::PointF(), gfx::Size(50, 50), true, false,
                                false);
-  root->SetIsDrawable(true);
+  root->SetDrawsContent(true);
+  surface_child->SetDrawsContent(true);
 
-  // The surface is moved slightly outside of the viewport.
-  scoped_refptr<Layer> surface = Layer::Create();
-  SetLayerPropertiesForTesting(surface.get(),
-                               identity_matrix,
-                               gfx::Point3F(),
-                               gfx::PointF(-10, -20),
-                               gfx::Size(),
-                               true,
-                               false);
-  surface->SetForceRenderSurface(true);
-
-  scoped_refptr<Layer> surface_child = Layer::Create();
-  SetLayerPropertiesForTesting(surface_child.get(),
-                               identity_matrix,
-                               gfx::Point3F(),
-                               gfx::PointF(),
-                               gfx::Size(50, 50),
-                               true,
-                               false);
-  surface_child->SetIsDrawable(true);
-
-  surface->AddChild(surface_child);
-  root->AddChild(surface);
-
-  host()->SetRootLayer(root);
-
-  LayerTreeHostCommon::CalcDrawPropsMainInputsForTesting inputs(root.get(),
-                                                                root->bounds());
-  LayerTreeHostCommon::CalculateDrawPropertiesForTesting(&inputs);
+  ExecuteCalculateDrawProperties(root);
 
   // The visible_layer_rect for the |surface_child| should not be clipped by
   // the viewport.
-  EXPECT_EQ(gfx::Rect(50, 50).ToString(),
-            surface_child->visible_layer_rect_for_testing().ToString());
+  EXPECT_EQ(gfx::Rect(50, 50), surface_child->visible_layer_rect());
 }
 
 TEST_F(LayerTreeHostCommonTest, TransformedClipParent) {
@@ -5906,17 +5872,14 @@
 
   // Ensure that we've inherited our clip parent's clip and weren't affected
   // by the intervening clip layer.
-  ASSERT_EQ(gfx::Rect(1, 1, 20, 20).ToString(),
-            clip_parent->clip_rect().ToString());
-  ASSERT_EQ(clip_parent->clip_rect().ToString(),
-            clip_child->clip_rect().ToString());
-  ASSERT_EQ(gfx::Rect(3, 3, 10, 10).ToString(),
-            intervening->clip_rect().ToString());
+  ASSERT_EQ(gfx::Rect(1, 1, 20, 20), clip_parent->clip_rect());
+  ASSERT_EQ(clip_parent->clip_rect(), clip_child->clip_rect());
+  ASSERT_EQ(gfx::Rect(3, 3, 10, 10), intervening->clip_rect());
 
   // Ensure that the render surface reports a content rect that has been grown
   // to accomodate for the clip child.
-  ASSERT_EQ(gfx::Rect(1, 1, 20, 20).ToString(),
-            render_surface->render_surface()->content_rect().ToString());
+  ASSERT_EQ(gfx::Rect(1, 1, 20, 20),
+            render_surface->render_surface()->content_rect());
 
   // The above check implies the two below, but they nicely demonstrate that
   // we've grown, despite the intervening layer's clip.
@@ -5985,37 +5948,33 @@
   // Since the render surfaces could have expanded, they should not clip (their
   // bounds would no longer be reliable). We should resort to layer clipping
   // in this case.
-  EXPECT_EQ(gfx::Rect(0, 0, 0, 0).ToString(),
-            render_surface1->render_surface()->clip_rect().ToString());
+  EXPECT_EQ(gfx::Rect(0, 0, 0, 0),
+            render_surface1->render_surface()->clip_rect());
   EXPECT_FALSE(render_surface1->render_surface()->is_clipped());
-  EXPECT_EQ(gfx::Rect(0, 0, 0, 0).ToString(),
-            render_surface2->render_surface()->clip_rect().ToString());
+  EXPECT_EQ(gfx::Rect(0, 0, 0, 0),
+            render_surface2->render_surface()->clip_rect());
   EXPECT_FALSE(render_surface2->render_surface()->is_clipped());
 
   // NB: clip rects are in target space.
-  EXPECT_EQ(gfx::Rect(0, 0, 40, 40).ToString(),
-            render_surface1->clip_rect().ToString());
+  EXPECT_EQ(gfx::Rect(0, 0, 40, 40), render_surface1->clip_rect());
   EXPECT_TRUE(render_surface1->is_clipped());
 
   // This value is inherited from the clipping ancestor layer, 'intervening'.
-  EXPECT_EQ(gfx::Rect(0, 0, 5, 5).ToString(),
-            render_surface2->clip_rect().ToString());
+  EXPECT_EQ(gfx::Rect(0, 0, 5, 5), render_surface2->clip_rect());
   EXPECT_TRUE(render_surface2->is_clipped());
 
   // The content rects of both render surfaces should both have expanded to
   // contain the clip child.
-  EXPECT_EQ(gfx::Rect(0, 0, 40, 40).ToString(),
-            render_surface1->render_surface()->content_rect().ToString());
-  EXPECT_EQ(gfx::Rect(-1, -1, 40, 40).ToString(),
-            render_surface2->render_surface()->content_rect().ToString());
+  EXPECT_EQ(gfx::Rect(0, 0, 40, 40),
+            render_surface1->render_surface()->content_rect());
+  EXPECT_EQ(gfx::Rect(-1, -1, 40, 40),
+            render_surface2->render_surface()->content_rect());
 
   // The clip child should have inherited the clip parent's clip (projected to
   // the right space, of course), and should have the correctly sized visible
   // content rect.
-  EXPECT_EQ(gfx::Rect(-1, -1, 40, 40).ToString(),
-            clip_child->clip_rect().ToString());
-  EXPECT_EQ(gfx::Rect(9, 9, 40, 40).ToString(),
-            clip_child->visible_layer_rect().ToString());
+  EXPECT_EQ(gfx::Rect(-1, -1, 40, 40), clip_child->clip_rect());
+  EXPECT_EQ(gfx::Rect(9, 9, 40, 40), clip_child->visible_layer_rect());
   EXPECT_TRUE(clip_child->is_clipped());
 }
 
@@ -6080,37 +6039,33 @@
   // Since the render surfaces could have expanded, they should not clip (their
   // bounds would no longer be reliable). We should resort to layer clipping
   // in this case.
-  EXPECT_EQ(gfx::Rect(0, 0, 0, 0).ToString(),
-            render_surface1->render_surface()->clip_rect().ToString());
+  EXPECT_EQ(gfx::Rect(0, 0, 0, 0),
+            render_surface1->render_surface()->clip_rect());
   EXPECT_FALSE(render_surface1->render_surface()->is_clipped());
-  EXPECT_EQ(gfx::Rect(0, 0, 0, 0).ToString(),
-            render_surface2->render_surface()->clip_rect().ToString());
+  EXPECT_EQ(gfx::Rect(0, 0, 0, 0),
+            render_surface2->render_surface()->clip_rect());
   EXPECT_FALSE(render_surface2->render_surface()->is_clipped());
 
   // NB: clip rects are in target space.
-  EXPECT_EQ(gfx::Rect(0, 0, 40, 40).ToString(),
-            render_surface1->clip_rect().ToString());
+  EXPECT_EQ(gfx::Rect(0, 0, 40, 40), render_surface1->clip_rect());
   EXPECT_TRUE(render_surface1->is_clipped());
 
   // This value is inherited from the clipping ancestor layer, 'intervening'.
-  EXPECT_EQ(gfx::Rect(2, 2, 3, 3).ToString(),
-            render_surface2->clip_rect().ToString());
+  EXPECT_EQ(gfx::Rect(2, 2, 3, 3), render_surface2->clip_rect());
   EXPECT_TRUE(render_surface2->is_clipped());
 
   // The content rects of both render surfaces should both have expanded to
   // contain the clip child.
-  EXPECT_EQ(gfx::Rect(0, 0, 40, 40).ToString(),
-            render_surface1->render_surface()->content_rect().ToString());
-  EXPECT_EQ(gfx::Rect(2, 2, 40, 40).ToString(),
-            render_surface2->render_surface()->content_rect().ToString());
+  EXPECT_EQ(gfx::Rect(0, 0, 40, 40),
+            render_surface1->render_surface()->content_rect());
+  EXPECT_EQ(gfx::Rect(2, 2, 40, 40),
+            render_surface2->render_surface()->content_rect());
 
   // The clip child should have inherited the clip parent's clip (projected to
   // the right space, of course), and should have the correctly sized visible
   // content rect.
-  EXPECT_EQ(gfx::Rect(2, 2, 40, 40).ToString(),
-            clip_child->clip_rect().ToString());
-  EXPECT_EQ(gfx::Rect(12, 12, 40, 40).ToString(),
-            clip_child->visible_layer_rect().ToString());
+  EXPECT_EQ(gfx::Rect(2, 2, 40, 40), clip_child->clip_rect());
+  EXPECT_EQ(gfx::Rect(12, 12, 40, 40), clip_child->visible_layer_rect());
   EXPECT_TRUE(clip_child->is_clipped());
 }
 
@@ -6162,11 +6117,9 @@
 
   // Neither the clip child nor its descendant should have inherited the clip
   // from |intervening|.
-  EXPECT_EQ(gfx::Rect(0, 0, 40, 40).ToString(),
-            clip_child->clip_rect().ToString());
+  EXPECT_EQ(gfx::Rect(0, 0, 40, 40), clip_child->clip_rect());
   EXPECT_TRUE(clip_child->is_clipped());
-  EXPECT_EQ(gfx::Rect(0, 0, 40, 40).ToString(),
-            child->visible_layer_rect().ToString());
+  EXPECT_EQ(gfx::Rect(0, 0, 40, 40), child->visible_layer_rect());
   EXPECT_TRUE(child->is_clipped());
 }
 
@@ -6228,30 +6181,29 @@
   EXPECT_TRUE(render_surface1->render_surface());
   EXPECT_TRUE(render_surface2->render_surface());
 
-  EXPECT_EQ(gfx::Rect(0, 0, 5, 5).ToString(),
-            render_surface1->clip_rect().ToString());
+  EXPECT_EQ(gfx::Rect(0, 0, 5, 5), render_surface1->clip_rect());
   EXPECT_TRUE(render_surface1->is_clipped());
 
   // The render surface should not clip (it has unclipped descendants), instead
   // it should rely on layer clipping.
-  EXPECT_EQ(gfx::Rect(0, 0, 0, 0).ToString(),
-            render_surface1->render_surface()->clip_rect().ToString());
+  EXPECT_EQ(gfx::Rect(0, 0, 0, 0),
+            render_surface1->render_surface()->clip_rect());
   EXPECT_FALSE(render_surface1->render_surface()->is_clipped());
 
   // That said, it should have grown to accomodate the unclipped descendant and
   // its own size.
-  EXPECT_EQ(gfx::Rect(-1, 0, 6, 5).ToString(),
-            render_surface1->render_surface()->content_rect().ToString());
+  EXPECT_EQ(gfx::Rect(-1, 0, 6, 5),
+            render_surface1->render_surface()->content_rect());
 
   // This render surface should clip. It has no unclipped descendants.
-  EXPECT_EQ(gfx::Rect(0, 0, 10, 10).ToString(),
-            render_surface2->render_surface()->clip_rect().ToString());
+  EXPECT_EQ(gfx::Rect(0, 0, 10, 10),
+            render_surface2->render_surface()->clip_rect());
   EXPECT_TRUE(render_surface2->render_surface()->is_clipped());
   EXPECT_FALSE(render_surface2->is_clipped());
 
   // It also shouldn't have grown to accomodate the clip child.
-  EXPECT_EQ(gfx::Rect(0, 0, 5, 5).ToString(),
-            render_surface2->render_surface()->content_rect().ToString());
+  EXPECT_EQ(gfx::Rect(0, 0, 5, 5),
+            render_surface2->render_surface()->content_rect());
 
   // Sanity check our num_unclipped_descendants values.
   EXPECT_EQ(1u, render_surface1->num_unclipped_descendants());
@@ -6624,8 +6576,7 @@
 
   EXPECT_TRUE(root->render_surface());
 
-  EXPECT_EQ(gfx::Rect(0, 0, 30, 30).ToString(),
-            scroll_child->clip_rect().ToString());
+  EXPECT_EQ(gfx::Rect(0, 0, 30, 30), scroll_child->clip_rect());
   EXPECT_TRUE(scroll_child->is_clipped());
 }
 
@@ -6774,8 +6725,7 @@
 
   EXPECT_TRUE(root->render_surface());
 
-  EXPECT_EQ(gfx::Rect(0, 0, 30, 30).ToString(),
-            scroll_child->clip_rect().ToString());
+  EXPECT_EQ(gfx::Rect(0, 0, 30, 30), scroll_child->clip_rect());
   EXPECT_TRUE(scroll_child->is_clipped());
 }
 
@@ -6849,8 +6799,7 @@
 
   EXPECT_TRUE(root->render_surface());
 
-  EXPECT_EQ(gfx::Rect(0, 0, 20, 20).ToString(),
-            scroll_child->clip_rect().ToString());
+  EXPECT_EQ(gfx::Rect(0, 0, 20, 20), scroll_child->clip_rect());
   EXPECT_TRUE(scroll_child->is_clipped());
 
   // Despite the fact that we visited the above layers out of order to get the
@@ -6945,8 +6894,7 @@
 
   EXPECT_TRUE(root->render_surface());
 
-  EXPECT_EQ(gfx::Rect(0, 0, 20, 20).ToString(),
-            scroll_child->clip_rect().ToString());
+  EXPECT_EQ(gfx::Rect(0, 0, 20, 20), scroll_child->clip_rect());
   EXPECT_TRUE(scroll_child->is_clipped());
 
   // Despite the fact that we had to process the layers out of order to get the
@@ -8018,59 +7966,43 @@
 }
 
 TEST_F(LayerTreeHostCommonTest, VisibleContentRectInChildRenderSurface) {
-  scoped_refptr<Layer> root = Layer::Create();
-  SetLayerPropertiesForTesting(root.get(),
-                               gfx::Transform(),
-                               gfx::Point3F(),
-                               gfx::PointF(),
-                               gfx::Size(768 / 2, 3000),
-                               true,
-                               false);
-  root->SetIsDrawable(true);
+  LayerImpl* root = root_layer();
+  LayerImpl* clip = AddChild<LayerImpl>(root);
+  LayerImpl* content = AddChild<LayerImpl>(clip);
 
-  scoped_refptr<Layer> clip = Layer::Create();
-  SetLayerPropertiesForTesting(clip.get(),
-                               gfx::Transform(),
-                               gfx::Point3F(),
-                               gfx::PointF(),
-                               gfx::Size(768 / 2, 10000),
-                               true,
-                               false);
+  const gfx::Transform identity_matrix;
+  SetLayerPropertiesForTesting(root, identity_matrix, gfx::Point3F(),
+                               gfx::PointF(), gfx::Size(768 / 2, 3000), true,
+                               false, true);
+  SetLayerPropertiesForTesting(clip, identity_matrix, gfx::Point3F(),
+                               gfx::PointF(), gfx::Size(768 / 2, 10000), true,
+                               false, false);
+  SetLayerPropertiesForTesting(content, identity_matrix, gfx::Point3F(),
+                               gfx::PointF(), gfx::Size(768 / 2, 10000), true,
+                               false, true);
+  root->SetDrawsContent(true);
   clip->SetMasksToBounds(true);
-
-  scoped_refptr<Layer> content = Layer::Create();
-  SetLayerPropertiesForTesting(content.get(),
-                               gfx::Transform(),
-                               gfx::Point3F(),
-                               gfx::PointF(),
-                               gfx::Size(768 / 2, 10000),
-                               true,
-                               false);
-  content->SetIsDrawable(true);
-  content->SetForceRenderSurface(true);
-
-  root->AddChild(clip);
-  clip->AddChild(content);
-
-  host()->SetRootLayer(root);
+  content->SetDrawsContent(true);
 
   gfx::Size device_viewport_size(768, 582);
-  LayerTreeHostCommon::CalcDrawPropsMainInputsForTesting inputs(
-      host()->root_layer(), device_viewport_size);
+  LayerImplList render_surface_layer_list_impl;
+  root->layer_tree_impl()->IncrementRenderSurfaceListIdForTesting();
+  LayerTreeHostCommon::CalcDrawPropsImplInputsForTesting inputs(
+      root, device_viewport_size, identity_matrix,
+      &render_surface_layer_list_impl,
+      root->layer_tree_impl()->current_render_surface_list_id());
   inputs.device_scale_factor = 2.f;
   inputs.page_scale_factor = 1.f;
   inputs.page_scale_layer = NULL;
-  LayerTreeHostCommon::CalculateDrawPropertiesForTesting(&inputs);
+  LayerTreeHostCommon::CalculateDrawProperties(&inputs);
 
   // Layers in the root render surface have their visible content rect clipped
   // by the viewport.
-  EXPECT_EQ(gfx::Rect(768 / 2, 582 / 2),
-            root->visible_layer_rect_for_testing());
+  EXPECT_EQ(gfx::Rect(768 / 2, 582 / 2), root->visible_layer_rect());
 
   // Layers drawing to a child render surface should still have their visible
   // content rect clipped by the viewport.
-  EXPECT_EQ(gfx::Rect(768 / 2, 582 / 2),
-            content->visible_layer_rect_for_testing());
+  EXPECT_EQ(gfx::Rect(768 / 2, 582 / 2), content->visible_layer_rect());
 }
 
 TEST_F(LayerTreeHostCommonTest, BoundsDeltaAffectVisibleContentRect) {
@@ -8388,38 +8320,33 @@
 // Ensures that the property tree code accounts for offsets between fixed
 // position layers and their respective containers.
 TEST_F(LayerTreeHostCommonTest, PropertyTreesAccountForFixedParentOffset) {
-  scoped_refptr<Layer> root = Layer::Create();
-  scoped_refptr<Layer> child = Layer::Create();
-  scoped_refptr<LayerWithForcedDrawsContent> grandchild =
-      make_scoped_refptr(new LayerWithForcedDrawsContent());
-
-  root->AddChild(child);
-  child->AddChild(grandchild);
+  LayerImpl* root = root_layer();
+  LayerImpl* child = AddChild<LayerImpl>(root);
+  LayerImpl* grandchild = AddChild<LayerImpl>(child);
 
   gfx::Transform identity_transform;
-  SetLayerPropertiesForTesting(root.get(), identity_transform, gfx::Point3F(),
-                               gfx::PointF(), gfx::Size(50, 50), true, false);
-  SetLayerPropertiesForTesting(child.get(), identity_transform, gfx::Point3F(),
+  SetLayerPropertiesForTesting(root, identity_transform, gfx::Point3F(),
+                               gfx::PointF(), gfx::Size(50, 50), true, false,
+                               true);
+  SetLayerPropertiesForTesting(child, identity_transform, gfx::Point3F(),
                                gfx::PointF(1000, 1000), gfx::Size(50, 50), true,
-                               false);
-  SetLayerPropertiesForTesting(grandchild.get(), identity_transform,
-                               gfx::Point3F(), gfx::PointF(-1000, -1000),
-                               gfx::Size(50, 50), true, false);
+                               false, false);
+  SetLayerPropertiesForTesting(grandchild, identity_transform, gfx::Point3F(),
+                               gfx::PointF(-1000, -1000), gfx::Size(50, 50),
+                               true, false, false);
 
   root->SetMasksToBounds(true);
   root->SetIsContainerForFixedPositionLayers(true);
   LayerPositionConstraint constraint;
   constraint.set_is_fixed_position(true);
   grandchild->SetPositionConstraint(constraint);
+  grandchild->SetDrawsContent(true);
 
   root->SetIsContainerForFixedPositionLayers(true);
 
-  host()->SetRootLayer(root);
+  ExecuteCalculateDrawProperties(root);
 
-  ExecuteCalculateDrawPropertiesWithPropertyTrees(root.get());
-
-  EXPECT_EQ(gfx::Rect(0, 0, 50, 50),
-            grandchild->visible_layer_rect_for_testing());
+  EXPECT_EQ(gfx::Rect(0, 0, 50, 50), grandchild->visible_layer_rect());
 }
 
 // Ensures that the property tree code accounts for offsets between fixed
@@ -8428,38 +8355,33 @@
 // own transform tree node.
 TEST_F(LayerTreeHostCommonTest,
        PropertyTreesAccountForFixedParentOffsetWhenContainerIsParent) {
-  scoped_refptr<Layer> root = Layer::Create();
-  scoped_refptr<Layer> child = Layer::Create();
-  scoped_refptr<LayerWithForcedDrawsContent> grandchild =
-      make_scoped_refptr(new LayerWithForcedDrawsContent());
-
-  root->AddChild(child);
-  child->AddChild(grandchild);
+  LayerImpl* root = root_layer();
+  LayerImpl* child = AddChild<LayerImpl>(root);
+  LayerImpl* grandchild = AddChild<LayerImpl>(child);
 
   gfx::Transform identity_transform;
-  SetLayerPropertiesForTesting(root.get(), identity_transform, gfx::Point3F(),
-                               gfx::PointF(), gfx::Size(50, 50), true, false);
-  SetLayerPropertiesForTesting(child.get(), identity_transform, gfx::Point3F(),
+  SetLayerPropertiesForTesting(root, identity_transform, gfx::Point3F(),
+                               gfx::PointF(), gfx::Size(50, 50), true, false,
+                               true);
+  SetLayerPropertiesForTesting(child, identity_transform, gfx::Point3F(),
                                gfx::PointF(1000, 1000), gfx::Size(50, 50), true,
-                               false);
-  SetLayerPropertiesForTesting(grandchild.get(), identity_transform,
-                               gfx::Point3F(), gfx::PointF(-1000, -1000),
-                               gfx::Size(50, 50), true, false);
+                               false, false);
+  SetLayerPropertiesForTesting(grandchild, identity_transform, gfx::Point3F(),
+                               gfx::PointF(-1000, -1000), gfx::Size(50, 50),
+                               true, false, false);
 
   root->SetMasksToBounds(true);
   child->SetIsContainerForFixedPositionLayers(true);
   LayerPositionConstraint constraint;
   constraint.set_is_fixed_position(true);
   grandchild->SetPositionConstraint(constraint);
+  grandchild->SetDrawsContent(true);
 
   root->SetIsContainerForFixedPositionLayers(true);
 
-  host()->SetRootLayer(root);
+  ExecuteCalculateDrawProperties(root);
 
-  ExecuteCalculateDrawPropertiesWithPropertyTrees(root.get());
-
-  EXPECT_EQ(gfx::Rect(0, 0, 50, 50),
-            grandchild->visible_layer_rect_for_testing());
+  EXPECT_EQ(gfx::Rect(0, 0, 50, 50), grandchild->visible_layer_rect());
 }
 
 TEST_F(LayerTreeHostCommonTest, CombineClipsUsingContentTarget) {
@@ -8516,87 +8438,75 @@
 }
 
 TEST_F(LayerTreeHostCommonTest, OnlyApplyFixedPositioningOnce) {
+  LayerImpl* root = root_layer();
+  LayerImpl* frame_clip = AddChild<LayerImpl>(root);
+  LayerImpl* fixed = AddChild<LayerImpl>(frame_clip);
   gfx::Transform identity;
   gfx::Transform translate_z;
   translate_z.Translate3d(0, 0, 10);
 
-  scoped_refptr<Layer> root = Layer::Create();
-  SetLayerPropertiesForTesting(root.get(), identity, gfx::Point3F(),
-                               gfx::PointF(), gfx::Size(800, 800), true, false);
+  SetLayerPropertiesForTesting(root, identity, gfx::Point3F(), gfx::PointF(),
+                               gfx::Size(800, 800), true, false, true);
   root->SetIsContainerForFixedPositionLayers(true);
 
-  scoped_refptr<Layer> frame_clip = Layer::Create();
-  SetLayerPropertiesForTesting(frame_clip.get(), translate_z, gfx::Point3F(),
+  SetLayerPropertiesForTesting(frame_clip, translate_z, gfx::Point3F(),
                                gfx::PointF(500, 100), gfx::Size(100, 100), true,
-                               false);
+                               false, false);
   frame_clip->SetMasksToBounds(true);
 
-  scoped_refptr<LayerWithForcedDrawsContent> fixed =
-      make_scoped_refptr(new LayerWithForcedDrawsContent());
-  SetLayerPropertiesForTesting(fixed.get(), identity, gfx::Point3F(),
-                               gfx::PointF(), gfx::Size(1000, 1000), true,
-                               false);
+  SetLayerPropertiesForTesting(fixed, identity, gfx::Point3F(), gfx::PointF(),
+                               gfx::Size(1000, 1000), true, false, false);
 
   LayerPositionConstraint constraint;
   constraint.set_is_fixed_position(true);
   fixed->SetPositionConstraint(constraint);
+  fixed->SetDrawsContent(true);
 
-  root->AddChild(frame_clip);
-  frame_clip->AddChild(fixed);
-
-  host()->SetRootLayer(root);
-
-  ExecuteCalculateDrawPropertiesWithPropertyTrees(root.get());
+  ExecuteCalculateDrawProperties(root);
 
   gfx::Rect expected(0, 0, 100, 100);
-  EXPECT_EQ(expected, fixed->visible_layer_rect_for_testing());
+  EXPECT_EQ(expected, fixed->visible_layer_rect());
 }
 
 TEST_F(LayerTreeHostCommonTest, FixedClipsShouldBeAssociatedWithTheRightNode) {
+  LayerImpl* root = root_layer();
+  LayerImpl* frame_clip = AddChild<LayerImpl>(root);
+  LayerImpl* scroller = AddChild<LayerImpl>(frame_clip);
+  LayerImpl* fixed = AddChild<LayerImpl>(scroller);
+
   gfx::Transform identity;
-
-  scoped_refptr<Layer> root = Layer::Create();
-  SetLayerPropertiesForTesting(root.get(), identity, gfx::Point3F(),
-                               gfx::PointF(), gfx::Size(800, 800), true, false);
-  root->SetIsContainerForFixedPositionLayers(true);
-
-  scoped_refptr<Layer> frame_clip = Layer::Create();
-  SetLayerPropertiesForTesting(frame_clip.get(), identity, gfx::Point3F(),
+  SetLayerPropertiesForTesting(root, identity, gfx::Point3F(), gfx::PointF(),
+                               gfx::Size(800, 800), true, false, true);
+  SetLayerPropertiesForTesting(frame_clip, identity, gfx::Point3F(),
                                gfx::PointF(500, 100), gfx::Size(100, 100), true,
-                               false);
-  frame_clip->SetMasksToBounds(true);
-
-  scoped_refptr<LayerWithForcedDrawsContent> scroller =
-      make_scoped_refptr(new LayerWithForcedDrawsContent());
-  SetLayerPropertiesForTesting(scroller.get(), identity, gfx::Point3F(),
+                               false, false);
+  SetLayerPropertiesForTesting(scroller, identity, gfx::Point3F(),
                                gfx::PointF(), gfx::Size(1000, 1000), true,
-                               false);
-
-  scroller->SetScrollOffset(gfx::ScrollOffset(100, 100));
-  scroller->SetScrollClipLayerId(frame_clip->id());
-
-  scoped_refptr<LayerWithForcedDrawsContent> fixed =
-      make_scoped_refptr(new LayerWithForcedDrawsContent());
-  SetLayerPropertiesForTesting(fixed.get(), identity, gfx::Point3F(),
+                               false, false);
+  SetLayerPropertiesForTesting(fixed, identity, gfx::Point3F(),
                                gfx::PointF(100, 100), gfx::Size(50, 50), true,
-                               false);
+                               false, true);
+
+  root->SetIsContainerForFixedPositionLayers(true);
+  root->SetDrawsContent(true);
+
+  frame_clip->SetMasksToBounds(true);
+  frame_clip->SetDrawsContent(true);
+
+  scroller->SetCurrentScrollOffset(gfx::ScrollOffset(100, 100));
+  scroller->SetScrollClipLayer(frame_clip->id());
+  scroller->SetDrawsContent(true);
 
   LayerPositionConstraint constraint;
   constraint.set_is_fixed_position(true);
   fixed->SetPositionConstraint(constraint);
-  fixed->SetForceRenderSurface(true);
   fixed->SetMasksToBounds(true);
+  fixed->SetDrawsContent(true);
 
-  root->AddChild(frame_clip);
-  frame_clip->AddChild(scroller);
-  scroller->AddChild(fixed);
-
-  host()->SetRootLayer(root);
-
-  ExecuteCalculateDrawPropertiesWithPropertyTrees(root.get());
+  ExecuteCalculateDrawProperties(root);
 
   gfx::Rect expected(0, 0, 50, 50);
-  EXPECT_EQ(expected, fixed->visible_layer_rect_for_testing());
+  EXPECT_EQ(expected, fixed->visible_layer_rect());
 }
 
 TEST_F(LayerTreeHostCommonTest, ChangingAxisAlignmentTriggersRebuild) {
@@ -8625,63 +8535,65 @@
 }
 
 TEST_F(LayerTreeHostCommonTest, ChangeTransformOrigin) {
-  scoped_refptr<Layer> root = Layer::Create();
-  scoped_refptr<LayerWithForcedDrawsContent> child =
-      make_scoped_refptr(new LayerWithForcedDrawsContent());
-  root->AddChild(child);
-
-  host()->SetRootLayer(root);
+  LayerImpl* root = root_layer();
+  LayerImpl* child = AddChild<LayerImpl>(root);
 
   gfx::Transform identity_matrix;
   gfx::Transform scale_matrix;
   scale_matrix.Scale(2.f, 2.f);
-  SetLayerPropertiesForTesting(root.get(), identity_matrix, gfx::Point3F(),
-                               gfx::PointF(), gfx::Size(100, 100), true, false);
-  SetLayerPropertiesForTesting(child.get(), scale_matrix, gfx::Point3F(),
-                               gfx::PointF(), gfx::Size(10, 10), true, false);
+  SetLayerPropertiesForTesting(root, identity_matrix, gfx::Point3F(),
+                               gfx::PointF(), gfx::Size(100, 100), true, false,
+                               true);
+  SetLayerPropertiesForTesting(child, scale_matrix, gfx::Point3F(),
+                               gfx::PointF(), gfx::Size(10, 10), true, false,
+                               false);
 
-  ExecuteCalculateDrawPropertiesWithPropertyTrees(root.get());
-  EXPECT_EQ(gfx::Rect(10, 10), child->visible_layer_rect_for_testing());
+  root->SetDrawsContent(true);
+  child->SetDrawsContent(true);
+
+  ExecuteCalculateDrawProperties(root);
+  EXPECT_EQ(gfx::Rect(10, 10), child->visible_layer_rect());
 
   child->SetTransformOrigin(gfx::Point3F(10.f, 10.f, 10.f));
 
-  ExecuteCalculateDrawPropertiesWithPropertyTrees(root.get());
-  EXPECT_EQ(gfx::Rect(5, 5, 5, 5), child->visible_layer_rect_for_testing());
+  root->layer_tree_impl()->property_trees()->needs_rebuild = true;
+  ExecuteCalculateDrawProperties(root);
+  EXPECT_EQ(gfx::Rect(5, 5, 5, 5), child->visible_layer_rect());
 }
 
 TEST_F(LayerTreeHostCommonTest, UpdateScrollChildPosition) {
-  scoped_refptr<Layer> root = Layer::Create();
-  scoped_refptr<LayerWithForcedDrawsContent> scroll_parent =
-      make_scoped_refptr(new LayerWithForcedDrawsContent());
-  scoped_refptr<LayerWithForcedDrawsContent> scroll_child =
-      make_scoped_refptr(new LayerWithForcedDrawsContent());
+  LayerImpl* root = root_layer();
+  LayerImpl* scroll_parent = AddChild<LayerImpl>(root);
+  LayerImpl* scroll_child = AddChild<LayerImpl>(scroll_parent);
 
-  root->AddChild(scroll_child);
-  root->AddChild(scroll_parent);
-  scroll_child->SetScrollParent(scroll_parent.get());
-  scroll_parent->SetScrollClipLayerId(root->id());
-
-  host()->SetRootLayer(root);
+  scroll_child->SetDrawsContent(true);
+  scroll_child->SetScrollParent(scroll_parent);
+  scoped_ptr<std::set<LayerImpl*>> scroll_children(new std::set<LayerImpl*>);
+  scroll_children->insert(scroll_child);
+  scroll_parent->SetScrollChildren(scroll_children.release());
+  scroll_parent->SetDrawsContent(true);
 
   gfx::Transform identity_transform;
   gfx::Transform scale;
   scale.Scale(2.f, 2.f);
-  SetLayerPropertiesForTesting(root.get(), identity_transform, gfx::Point3F(),
-                               gfx::PointF(), gfx::Size(50, 50), true, false);
-  SetLayerPropertiesForTesting(scroll_child.get(), scale, gfx::Point3F(),
-                               gfx::PointF(), gfx::Size(40, 40), true, false);
-  SetLayerPropertiesForTesting(scroll_parent.get(), identity_transform,
+  SetLayerPropertiesForTesting(root, identity_transform, gfx::Point3F(),
+                               gfx::PointF(), gfx::Size(50, 50), true, false,
+                               true);
+  SetLayerPropertiesForTesting(scroll_child, scale, gfx::Point3F(),
+                               gfx::PointF(), gfx::Size(40, 40), true, false,
+                               false);
+  SetLayerPropertiesForTesting(scroll_parent, identity_transform,
                                gfx::Point3F(), gfx::PointF(), gfx::Size(30, 30),
-                               true, false);
+                               true, false, false);
 
-  ExecuteCalculateDrawPropertiesWithPropertyTrees(root.get());
-  EXPECT_EQ(gfx::Rect(25, 25), scroll_child->visible_layer_rect_for_testing());
+  ExecuteCalculateDrawProperties(root);
+  EXPECT_EQ(gfx::Rect(25, 25), scroll_child->visible_layer_rect());
 
   scroll_child->SetPosition(gfx::PointF(0, -10.f));
-  scroll_parent->SetScrollOffset(gfx::ScrollOffset(0.f, 10.f));
-  ExecuteCalculateDrawPropertiesWithPropertyTrees(root.get());
-  EXPECT_EQ(gfx::Rect(0, 5, 25, 25),
-            scroll_child->visible_layer_rect_for_testing());
+  scroll_parent->SetCurrentScrollOffset(gfx::ScrollOffset(0.f, 10.f));
+  root->layer_tree_impl()->property_trees()->needs_rebuild = true;
+  ExecuteCalculateDrawProperties(root);
+  EXPECT_EQ(gfx::Rect(0, 5, 25, 25), scroll_child->visible_layer_rect());
 }
 
 static void CopyOutputCallback(scoped_ptr<CopyOutputResult> result) {
@@ -9038,45 +8950,45 @@
 
 TEST_F(LayerTreeHostCommonTest, SkippingLayer) {
   gfx::Transform identity;
-  scoped_refptr<Layer> root = Layer::Create();
-  FakeContentLayerClient client;
-  client.set_bounds(root->bounds());
-  scoped_refptr<LayerWithForcedDrawsContent> child =
-      make_scoped_refptr(new LayerWithForcedDrawsContent());
-  SetLayerPropertiesForTesting(root.get(), identity, gfx::Point3F(),
-                               gfx::PointF(), gfx::Size(100, 100), true, false);
-  SetLayerPropertiesForTesting(child.get(), identity, gfx::Point3F(),
-                               gfx::PointF(), gfx::Size(10, 10), true, false);
-  root->AddChild(child);
+  LayerImpl* root = root_layer();
+  LayerImpl* child = AddChild<LayerImpl>(root);
 
-  host()->SetRootLayer(root);
+  SetLayerPropertiesForTesting(root, identity, gfx::Point3F(), gfx::PointF(),
+                               gfx::Size(100, 100), true, false, true);
+  SetLayerPropertiesForTesting(child, identity, gfx::Point3F(), gfx::PointF(),
+                               gfx::Size(10, 10), true, false, false);
+  child->SetDrawsContent(true);
 
-  ExecuteCalculateDrawPropertiesWithPropertyTrees(root.get());
-  EXPECT_EQ(gfx::Rect(10, 10), child->visible_layer_rect_for_testing());
+  ExecuteCalculateDrawProperties(root);
+  EXPECT_EQ(gfx::Rect(10, 10), child->visible_layer_rect());
   child->set_visible_layer_rect(gfx::Rect());
 
   child->SetHideLayerAndSubtree(true);
-  ExecuteCalculateDrawPropertiesWithPropertyTrees(root.get());
-  EXPECT_EQ(gfx::Rect(0, 0), child->visible_layer_rect_for_testing());
+  root->layer_tree_impl()->property_trees()->needs_rebuild = true;
+  ExecuteCalculateDrawProperties(root);
+  EXPECT_EQ(gfx::Rect(0, 0), child->visible_layer_rect());
   child->SetHideLayerAndSubtree(false);
 
   child->SetBounds(gfx::Size());
-  ExecuteCalculateDrawPropertiesWithPropertyTrees(root.get());
-  EXPECT_EQ(gfx::Rect(0, 0), child->visible_layer_rect_for_testing());
+  root->layer_tree_impl()->property_trees()->needs_rebuild = true;
+  ExecuteCalculateDrawProperties(root);
+  EXPECT_EQ(gfx::Rect(0, 0), child->visible_layer_rect());
   child->SetBounds(gfx::Size(10, 10));
 
   gfx::Transform rotate;
   child->SetDoubleSided(false);
   rotate.RotateAboutXAxis(180.f);
   child->SetTransform(rotate);
-  ExecuteCalculateDrawPropertiesWithPropertyTrees(root.get());
-  EXPECT_EQ(gfx::Rect(0, 0), child->visible_layer_rect_for_testing());
+  root->layer_tree_impl()->property_trees()->needs_rebuild = true;
+  ExecuteCalculateDrawProperties(root);
+  EXPECT_EQ(gfx::Rect(0, 0), child->visible_layer_rect());
   child->SetDoubleSided(true);
   child->SetTransform(identity);
 
   child->SetOpacity(0.f);
-  ExecuteCalculateDrawPropertiesWithPropertyTrees(root.get());
-  EXPECT_EQ(gfx::Rect(0, 0), child->visible_layer_rect_for_testing());
+  root->layer_tree_impl()->property_trees()->needs_rebuild = true;
+  ExecuteCalculateDrawProperties(root);
+  EXPECT_EQ(gfx::Rect(0, 0), child->visible_layer_rect());
 }
 
 TEST_F(LayerTreeHostCommonTest, LayerTreeRebuildTest) {

diff --git a/chrome/android/java/src/org/chromium/chrome/browser/ChromeActivity.java b/chrome/android/java/src/org/chromium/chrome/browser/ChromeActivity.java
index 0db5aec..1272a25 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/ChromeActivity.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/ChromeActivity.java

@@ -632,6 +632,7 @@
     public void onResumeWithNative() {
         super.onResumeWithNative();
         markSessionResume();
+        RecordUserAction.record("MobileComeToForeground");
 
         if (getActivityTab() != null) {
             LaunchMetrics.commitLaunchMetrics(getActivityTab().getWebContents());
@@ -641,6 +642,7 @@
 
     @Override
     public void onPauseWithNative() {
+        RecordUserAction.record("MobileGoToBackground");
         markSessionEnd();
         super.onPauseWithNative();
     }

diff --git a/chrome/android/java/src/org/chromium/chrome/browser/ChromeBackgroundService.java b/chrome/android/java/src/org/chromium/chrome/browser/ChromeBackgroundService.java
index 030c977..9d32165 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/ChromeBackgroundService.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/ChromeBackgroundService.java

@@ -77,7 +77,7 @@
         if (!SnippetsLauncher.hasInstance()) {
             launchBrowser(context);
         }
-        SnippetsController.get(context).fetchSnippets();
+        SnippetsController.get().fetchSnippets();
     }
 
     private void handlePrecache(Context context, String tag) {

diff --git a/chrome/android/java/src/org/chromium/chrome/browser/compositor/bottombar/contextualsearch/ContextualSearchPanelMetrics.java b/chrome/android/java/src/org/chromium/chrome/browser/compositor/bottombar/contextualsearch/ContextualSearchPanelMetrics.java
index dd4a14b4..9fc6851 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/compositor/bottombar/contextualsearch/ContextualSearchPanelMetrics.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/compositor/bottombar/contextualsearch/ContextualSearchPanelMetrics.java

@@ -12,6 +12,7 @@
  * This class is responsible for all the logging related to Contextual Search.
  */
 public class ContextualSearchPanelMetrics {
+    private static final int MILLISECONDS_TO_NANOSECONDS = 1000000;
 
     // Flags for logging.
     private boolean mDidSearchInvolvePromo;
@@ -26,6 +27,7 @@
     private boolean mWasActivatedByTap;
     private boolean mIsSearchPanelFullyPreloaded;
     private boolean mWasIconSpriteAnimated;
+    private boolean mWasPanelOpenedBeyondPeek;
     // Time when the panel peeks into view (not reset by a chained search).
     // Used to log total time the panel is showing (not closed).
     private long mFirstPeekTimeNs;
@@ -33,9 +35,12 @@
     // Used to log preload effectiveness info -- additional time needed to fully render the
     // content in the overlay.
     private long mContentFirstViewTimeNs;
-    // Time when a search request was started.  Reset by chained searches.
+    // Time when a search request was started. Reset by chained searches.
     // Used to log the time it takes for a Search Result to become available.
     private long mSearchRequestStartTimeNs;
+    // Time when the panel was opened beyond peeked. Reset when the panel is closed.
+    // Used to log how long the panel was open.
+    private long mPanelOpenedBeyondPeekTimeNs;
 
     /**
      * Log information when the panel's state has changed.
@@ -58,6 +63,9 @@
         boolean isFirstExitFromMaximized = fromState == PanelState.MAXIMIZED && !mHasExitedMaximized
                 && !isSameState;
         boolean isFirstSearchView = isFirstExitFromPeeking && toState != PanelState.CLOSED;
+        boolean isContentVisible =
+                toState == PanelState.MAXIMIZED || toState == PanelState.EXPANDED;
+        boolean isExitingPanelOpenedBeyondPeeked = mWasPanelOpenedBeyondPeek && !isContentVisible;
         // This variable is needed for logging and gets reset in an isStartingSearch block below,
         // so a local copy is created before the reset.
         boolean isSearchPanelFullyPreloaded = mIsSearchPanelFullyPreloaded;
@@ -65,7 +73,8 @@
         if (isEndingSearch) {
             if (!mDidSearchInvolvePromo) {
                 // Measure duration only when the promo is not involved.
-                long durationMs = (System.nanoTime() - mFirstPeekTimeNs) / 1000000;
+                long durationMs =
+                        (System.nanoTime() - mFirstPeekTimeNs) / MILLISECONDS_TO_NANOSECONDS;
                 ContextualSearchUma.logDuration(mWasSearchContentViewSeen, isChained, durationMs);
             }
             if (mIsPromoActive) {
@@ -78,6 +87,16 @@
             ContextualSearchUma.logIconSpriteAnimated(mWasIconSpriteAnimated,
                     mWasSearchContentViewSeen, mWasActivatedByTap);
         }
+
+        if (isExitingPanelOpenedBeyondPeeked) {
+            assert mPanelOpenedBeyondPeekTimeNs != 0;
+            long durationPanelOpen = (System.nanoTime() - mPanelOpenedBeyondPeekTimeNs)
+                    / MILLISECONDS_TO_NANOSECONDS;
+            ContextualSearchUma.logPanelOpenDuration(durationPanelOpen);
+            mPanelOpenedBeyondPeekTimeNs = 0;
+            mWasPanelOpenedBeyondPeek = false;
+        }
+
         if (isStartingSearch) {
             mFirstPeekTimeNs = System.nanoTime();
             mContentFirstViewTimeNs = 0;
@@ -156,6 +175,8 @@
      */
     public void setWasSearchContentViewSeen() {
         mWasSearchContentViewSeen = true;
+        mWasPanelOpenedBeyondPeek = true;
+        mPanelOpenedBeyondPeekTimeNs = System.nanoTime();
     }
 
     /**
@@ -183,7 +204,8 @@
      * Called when a Search Term has been resolved.
      */
     public void onSearchTermResolved() {
-        long durationMs = (System.nanoTime() - mSearchRequestStartTimeNs) / 1000000;
+        long durationMs =
+                (System.nanoTime() - mSearchRequestStartTimeNs) / MILLISECONDS_TO_NANOSECONDS;
         ContextualSearchUma.logSearchTermResolutionDuration(durationMs);
     }
 
@@ -195,7 +217,8 @@
         if (mHasExpanded || mHasMaximized) {
             // Already opened, log how long it took.
             assert mContentFirstViewTimeNs != 0;
-            long durationMs = (System.nanoTime() - mContentFirstViewTimeNs) / 1000000;
+            long durationMs =
+                    (System.nanoTime() - mContentFirstViewTimeNs) / MILLISECONDS_TO_NANOSECONDS;
             logSearchPanelLoadDuration(wasPrefetch, durationMs);
         }
 
@@ -208,7 +231,8 @@
      * This is the point where the search result starts to render in the panel.
      */
     public void onPanelNavigatedToPrefetchedSearch(boolean didResolve) {
-        long durationMs = (System.nanoTime() - mSearchRequestStartTimeNs) / 1000000;
+        long durationMs =
+                (System.nanoTime() - mSearchRequestStartTimeNs) / MILLISECONDS_TO_NANOSECONDS;
         ContextualSearchUma.logPrefetchedSearchNavigatedDuration(durationMs, didResolve);
     }
 

diff --git a/chrome/android/java/src/org/chromium/chrome/browser/contextualsearch/ContextualSearchUma.java b/chrome/android/java/src/org/chromium/chrome/browser/contextualsearch/ContextualSearchUma.java
index 9190a451..bbe4c01 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/contextualsearch/ContextualSearchUma.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/contextualsearch/ContextualSearchUma.java

@@ -728,6 +728,15 @@
     }
 
     /**
+     * Logs the duration from opening the panel beyond peek until the panel is closed.
+     * @param durationMs The duration to record.
+     */
+    public static void logPanelOpenDuration(long durationMs) {
+        RecordHistogram.recordMediumTimesHistogram(
+                "Search.ContextualSearchPanelOpenDuration", durationMs, TimeUnit.MILLISECONDS);
+    }
+
+    /**
      * Logs whether the promo was seen.
      * Logs multiple histograms, with and without the original triggering gesture.
      * @param wasPanelSeen Whether the panel was seen.

diff --git a/chrome/android/java/src/org/chromium/chrome/browser/init/ChromeBrowserInitializer.java b/chrome/android/java/src/org/chromium/chrome/browser/init/ChromeBrowserInitializer.java
index 08ed6fa8..554602b 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/init/ChromeBrowserInitializer.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/init/ChromeBrowserInitializer.java

@@ -7,6 +7,7 @@
 import android.app.Activity;
 import android.content.Context;
 import android.os.AsyncTask;
+import android.os.Build;
 import android.os.Handler;
 import android.os.Looper;
 import android.os.Process;
@@ -160,13 +161,25 @@
     }
 
     /**
-     * Pre-load shared prefs to avoid being blocked on the
-     * disk access async task in the future.
+     * Pre-load shared prefs to avoid being blocked on the disk access async task in the future.
+     * Running in an AsyncTask as pre-loading itself may cause I/O.
      */
     private void warmUpSharedPrefs() {
-        PreferenceManager.getDefaultSharedPreferences(mApplication);
-        DocumentTabModelImpl.warmUpSharedPrefs(mApplication);
-        ActivityAssigner.warmUpSharedPrefs(mApplication);
+        if (Build.VERSION.CODENAME.equals("N")) {
+            new AsyncTask<Void, Void, Void>() {
+                @Override
+                protected Void doInBackground(Void... params) {
+                    PreferenceManager.getDefaultSharedPreferences(mApplication);
+                    DocumentTabModelImpl.warmUpSharedPrefs(mApplication);
+                    ActivityAssigner.warmUpSharedPrefs(mApplication);
+                    return null;
+                }
+            }.executeOnExecutor(AsyncTask.THREAD_POOL_EXECUTOR);
+        } else {
+            PreferenceManager.getDefaultSharedPreferences(mApplication);
+            DocumentTabModelImpl.warmUpSharedPrefs(mApplication);
+            ActivityAssigner.warmUpSharedPrefs(mApplication);
+        }
     }
 
     private void preInflationStartup() {

diff --git a/chrome/android/java/src/org/chromium/chrome/browser/media/ui/MediaNotificationManager.java b/chrome/android/java/src/org/chromium/chrome/browser/media/ui/MediaNotificationManager.java
index 10a9ba7..b36cc9f 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/media/ui/MediaNotificationManager.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/media/ui/MediaNotificationManager.java

@@ -391,12 +391,14 @@
             new MediaSessionCompat.Callback() {
                 @Override
                 public void onPlay() {
-                    onPlay(MediaNotificationListener.ACTION_SOURCE_MEDIA_SESSION);
+                    MediaNotificationManager.this.onPlay(
+                            MediaNotificationListener.ACTION_SOURCE_MEDIA_SESSION);
                 }
 
                 @Override
                 public void onPause() {
-                    onPause(MediaNotificationListener.ACTION_SOURCE_MEDIA_SESSION);
+                    MediaNotificationManager.this.onPause(
+                            MediaNotificationListener.ACTION_SOURCE_MEDIA_SESSION);
                 }
             };
 

diff --git a/chrome/android/java/src/org/chromium/chrome/browser/ntp/snippets/SnippetArticle.java b/chrome/android/java/src/org/chromium/chrome/browser/ntp/snippets/SnippetArticle.java
index 89f8093..7d99986f 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/ntp/snippets/SnippetArticle.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/ntp/snippets/SnippetArticle.java

@@ -44,6 +44,11 @@
 
         ThumbnailRenderingTask(ImageView thumbnailView) {
             mThumbnailView = thumbnailView;
+
+            // The view might be already holding the thumbnail from another snippet, as the view
+            // is recycled. We start by hiding it to avoid having a stale image be displayed while
+            // the new one is being downloaded.
+            mThumbnailView.setVisibility(View.INVISIBLE);
         }
 
         @Override

diff --git a/chrome/android/java/src/org/chromium/chrome/browser/ntp/snippets/SnippetsController.java b/chrome/android/java/src/org/chromium/chrome/browser/ntp/snippets/SnippetsController.java
index 28975a6..64b33f0 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/ntp/snippets/SnippetsController.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/ntp/snippets/SnippetsController.java

@@ -4,28 +4,19 @@
 
 package org.chromium.chrome.browser.ntp.snippets;
 
-import android.content.Context;
-
 import org.chromium.base.ThreadUtils;
 import org.chromium.base.VisibleForTesting;
 import org.chromium.chrome.browser.profiles.Profile;
-import org.chromium.chrome.browser.signin.SigninManager;
-import org.chromium.chrome.browser.signin.SigninManager.SignInStateObserver;
 
 /**
  * The main controller for calling into the native snippets component to fetch snippets.
  */
-public class SnippetsController implements SignInStateObserver {
+public class SnippetsController {
     private static SnippetsController sInstance;
 
     private long mNativeSnippetsController;
 
-    public SnippetsController(Context applicationContext) {
-        // |applicationContext| can be null in tests.
-        if (applicationContext != null) {
-            SigninManager.get(applicationContext).addSignInStateObserver(this);
-        }
-    }
+    public SnippetsController() {}
 
     /**
      * Fetches new snippets.
@@ -37,25 +28,16 @@
     /**
      * Retrieve the singleton instance of this class.
      *
-     * @param context the current context.
      * @return the singleton instance.
      */
-    public static SnippetsController get(Context context) {
+    public static SnippetsController get() {
         ThreadUtils.assertOnUiThread();
         if (sInstance == null) {
-            sInstance = new SnippetsController(context.getApplicationContext());
+            sInstance = new SnippetsController();
         }
         return sInstance;
     }
 
-    @Override
-    public void onSignedIn() {
-        fetchSnippets();
-    }
-
-    @Override
-    public void onSignedOut() {}
-
     @VisibleForTesting
     public static void setInstanceForTesting(SnippetsController instance) {
         sInstance = instance;

diff --git a/chrome/android/java/src/org/chromium/chrome/browser/omnibox/AnswerTextBuilder.java b/chrome/android/java/src/org/chromium/chrome/browser/omnibox/AnswerTextBuilder.java
index 1c657b5..9904bf3d 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/omnibox/AnswerTextBuilder.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/omnibox/AnswerTextBuilder.java

@@ -38,35 +38,53 @@
     private static final int ANSWERS_SUGGESTION_LINK_COLOR_TYPE = 11;
     private static final int ANSWERS_STATUS_TEXT_TYPE = 12;
     private static final int ANSWERS_PERSONALIZED_SUGGESTION_TEXT_TYPE = 13;
+    // Deprecated: IMMERSIVE_DESCRIPTION_TEXT = 14,
+    // Deprecated: DATE_TEXT = 15,
+    // Deprecated: PREVIEW_TEXT = 16,
+    private static final int ANSWERS_ANSWER_TEXT_MEDIUM_TYPE = 17;
+    private static final int ANSWERS_ANSWER_TEXT_LARGE_TYPE = 18;
+    private static final int ANSWERS_SECONDARY_TEXT_SMALL_TYPE = 19;
+    private static final int ANSWERS_SECONDARY_TEXT_MEDIUM_TYPE = 20;
 
     private static final int ANSWERS_ANSWER_TEXT_SIZE_SP = 28;
     private static final int ANSWERS_HEADLINE_TEXT_SIZE_SP = 24;
-    private static final int ANSWERS_TOP_ALIGNED_TEXT_SIZE_SP = 13;
+    private static final int ANSWERS_TOP_ALIGNED_TEXT_SIZE_SP = 12;
     private static final int ANSWERS_DESCRIPTION_TEXT_SIZE_SP = 15;
     private static final int ANSWERS_DESCRIPTION_TEXT_NEGATIVE_SIZE_SP = 16;
     private static final int ANSWERS_DESCRIPTION_TEXT_POSITIVE_SIZE_SP = 16;
     private static final int ANSWERS_MORE_INFO_TEXT_SIZE_SP = 12;
-    private static final int ANSWERS_SUGGESTION_TEXT_SIZE_SP = 15;
+    private static final int ANSWERS_SUGGESTION_TEXT_SIZE_SP = 16;
     private static final int ANSWERS_SUGGESTION_TEXT_POSITIVE_SIZE_SP = 15;
     private static final int ANSWERS_SUGGESTION_TEXT_NEGATIVE_SIZE_SP = 15;
     private static final int ANSWERS_SUGGESTION_LINK_COLOR_SIZE_SP = 15;
     private static final int ANSWERS_STATUS_TEXT_SIZE_SP = 13;
     private static final int ANSWERS_PERSONALIZED_SUGGESTION_TEXT_SIZE_SP = 15;
+    private static final int ANSWERS_ANSWER_TEXT_MEDIUM_SIZE_SP = 20;
+    private static final int ANSWERS_ANSWER_TEXT_LARGE_SIZE_SP = 24;
+    private static final int ANSWERS_SECONDARY_TEXT_SMALL_SIZE_SP = 12;
+    private static final int ANSWERS_SECONDARY_TEXT_MEDIUM_SIZE_SP = 14;
 
-    private static final int ANSWERS_ANSWER_TEXT_COLOR = Color.BLACK;
+    private static final int ANSWERS_ANSWER_TEXT_COLOR = 0xFF212121;
     private static final int ANSWERS_HEADLINE_TEXT_COLOR = Color.BLACK;
-    private static final int ANSWERS_TOP_ALIGNED_TEXT_COLOR = Color.GRAY;
+    private static final int ANSWERS_TOP_ALIGNED_TEXT_COLOR = 0xFF8A8A8A;
     private static final int ANSWERS_DESCRIPTION_TEXT_COLOR = Color.BLACK;
+    // These two colors deviate from the AIS spec because they provide better
+    // contrast over the background in Chrome, but they do come from the
+    // Google pallette.
     private static final int ANSWERS_DESCRIPTION_TEXT_NEGATIVE_COLOR = 0xFFC53929;
     private static final int ANSWERS_DESCRIPTION_TEXT_POSITIVE_COLOR = 0xFF0B8043;
     private static final int ANSWERS_MORE_INFO_TEXT_COLOR = Color.BLACK;
-    private static final int ANSWERS_SUGGESTION_TEXT_COLOR = Color.BLACK;
+    private static final int ANSWERS_SUGGESTION_TEXT_COLOR = 0xFF212121;
     private static final int ANSWERS_SUGGESTION_TEXT_POSITIVE_COLOR = Color.GREEN;
     private static final int ANSWERS_SUGGESTION_TEXT_NEGATIVE_COLOR = Color.RED;
     // TODO(jdonnelly): Links should be purple if visited.
     private static final int ANSWERS_SUGGESTION_LINK_COLOR_COLOR = Color.BLUE;
     private static final int ANSWERS_STATUS_TEXT_COLOR = Color.GRAY;
     private static final int ANSWERS_PERSONALIZED_SUGGESTION_TEXT_COLOR = Color.BLACK;
+    private static final int ANSWERS_ANSWER_TEXT_MEDIUM_COLOR = 0xFF212121;
+    private static final int ANSWERS_ANSWER_TEXT_LARGE_COLOR = 0xFF212121;
+    private static final int ANSWERS_SECONDARY_TEXT_SMALL_COLOR = 0xFF8A8A8A;
+    private static final int ANSWERS_SECONDARY_TEXT_MEDIUM_COLOR = 0xFF8A8A8A;
 
     /**
      * Builds a Spannable containing all of the styled text in the supplied ImageLine.
@@ -210,6 +228,14 @@
                 return ANSWERS_STATUS_TEXT_SIZE_SP;
             case ANSWERS_PERSONALIZED_SUGGESTION_TEXT_TYPE:
                 return ANSWERS_PERSONALIZED_SUGGESTION_TEXT_SIZE_SP;
+            case ANSWERS_ANSWER_TEXT_MEDIUM_TYPE:
+                return ANSWERS_ANSWER_TEXT_MEDIUM_SIZE_SP;
+            case ANSWERS_ANSWER_TEXT_LARGE_TYPE:
+                return ANSWERS_ANSWER_TEXT_LARGE_SIZE_SP;
+            case ANSWERS_SECONDARY_TEXT_SMALL_TYPE:
+                return ANSWERS_SECONDARY_TEXT_SMALL_SIZE_SP;
+            case ANSWERS_SECONDARY_TEXT_MEDIUM_TYPE:
+                return ANSWERS_SECONDARY_TEXT_MEDIUM_SIZE_SP;
             default:
                 Log.w(TAG, "Unknown answer type: " + type);
                 return ANSWERS_SUGGESTION_TEXT_SIZE_SP;
@@ -249,6 +275,14 @@
                 return ANSWERS_STATUS_TEXT_COLOR;
             case ANSWERS_PERSONALIZED_SUGGESTION_TEXT_TYPE:
                 return ANSWERS_PERSONALIZED_SUGGESTION_TEXT_COLOR;
+            case ANSWERS_ANSWER_TEXT_MEDIUM_TYPE:
+                return ANSWERS_ANSWER_TEXT_MEDIUM_COLOR;
+            case ANSWERS_ANSWER_TEXT_LARGE_TYPE:
+                return ANSWERS_ANSWER_TEXT_LARGE_COLOR;
+            case ANSWERS_SECONDARY_TEXT_SMALL_TYPE:
+                return ANSWERS_SECONDARY_TEXT_SMALL_COLOR;
+            case ANSWERS_SECONDARY_TEXT_MEDIUM_TYPE:
+                return ANSWERS_SECONDARY_TEXT_MEDIUM_COLOR;
             default:
                 Log.w(TAG, "Unknown answer type: " + type);
                 return ANSWERS_SUGGESTION_TEXT_COLOR;

diff --git a/chrome/android/java/src/org/chromium/chrome/browser/preferences/website/SingleWebsitePreferences.java b/chrome/android/java/src/org/chromium/chrome/browser/preferences/website/SingleWebsitePreferences.java
index a0585656..2bbff07 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/preferences/website/SingleWebsitePreferences.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/preferences/website/SingleWebsitePreferences.java

@@ -23,6 +23,7 @@
 import android.widget.ListView;
 
 import org.chromium.base.ApiCompatibilityUtils;
+import org.chromium.base.VisibleForTesting;
 import org.chromium.chrome.R;
 import org.chromium.chrome.browser.ContentSettingsType;
 import org.chromium.chrome.browser.omnibox.geo.GeolocationHeader;
@@ -639,7 +640,11 @@
         return true;
     }
 
-    private void resetSite() {
+    /**
+     * Resets the current site, clearing all permissions and storage used (inc. cookies).
+     */
+    @VisibleForTesting
+    protected void resetSite() {
         if (getActivity() == null) return;
         // Clear the screen.
         // TODO(mvanouwerkerk): Refactor this class so that it does not depend on the screen state
@@ -655,7 +660,7 @@
         mSite.setBackgroundSyncPermission(ContentSetting.DEFAULT);
         mSite.setCameraPermission(ContentSetting.DEFAULT);
         mSite.setCookiePermission(ContentSetting.DEFAULT);
-        WebsitePreferenceBridge.nativeClearCookieData(mSite.getAddress().getOrigin());
+        WebsitePreferenceBridge.nativeClearCookieData(mSite.getAddress().getTitle());
         mSite.setFullscreenPermission(ContentSetting.DEFAULT);
         mSite.setGeolocationPermission(ContentSetting.DEFAULT);
         mSite.setJavaScriptPermission(ContentSetting.DEFAULT);

diff --git a/chrome/android/java/src/org/chromium/chrome/browser/signin/AccountManagementFragment.java b/chrome/android/java/src/org/chromium/chrome/browser/signin/AccountManagementFragment.java
index ab8e0ffa..30e3c0f 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/signin/AccountManagementFragment.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/signin/AccountManagementFragment.java

@@ -378,6 +378,7 @@
 
         for (Account account : accounts) {
             ChromeBasePreference pref = new ChromeBasePreference(activity);
+            pref.setSelectable(false);
             pref.setTitle(account.name);
 
             boolean isChildAccount = ChildAccountService.isChildAccount();
@@ -386,17 +387,6 @@
                     isChildAccount ? getBadgedUserPicture(account.name, getResources()) :
                         getUserPicture(account.name, getResources())));
 
-            pref.setOnPreferenceClickListener(new OnPreferenceClickListener() {
-                @Override
-                public boolean onPreferenceClick(Preference preference) {
-                    if (!isVisible() || !isResumed()) return false;
-
-                    openSyncSettingsPage(activity);
-                    return true;
-                }
-
-            });
-
             pref.setOrder(nextPrefOrder++);
             prefScreen.addPreference(pref);
             mAccountsListPreferences.add(pref);

diff --git a/chrome/android/javatests/src/org/chromium/chrome/browser/ChromeBackgroundServiceTest.java b/chrome/android/javatests/src/org/chromium/chrome/browser/ChromeBackgroundServiceTest.java
index d07b2bf..ad2c65f 100644
--- a/chrome/android/javatests/src/org/chromium/chrome/browser/ChromeBackgroundServiceTest.java
+++ b/chrome/android/javatests/src/org/chromium/chrome/browser/ChromeBackgroundServiceTest.java

@@ -72,10 +72,6 @@
     static class MockSnippetsController extends SnippetsController {
         private boolean mDidFetchSnippets = false;
 
-        MockSnippetsController() {
-            super(null);
-        }
-
         @Override
         public void fetchSnippets() {
             mDidFetchSnippets = true;

diff --git a/chrome/android/javatests/src/org/chromium/chrome/browser/preferences/website/SiteSettingsPreferencesTest.java b/chrome/android/javatests/src/org/chromium/chrome/browser/preferences/website/SiteSettingsPreferencesTest.java
index e21ff377..fbc47426 100644
--- a/chrome/android/javatests/src/org/chromium/chrome/browser/preferences/website/SiteSettingsPreferencesTest.java
+++ b/chrome/android/javatests/src/org/chromium/chrome/browser/preferences/website/SiteSettingsPreferencesTest.java

@@ -455,6 +455,27 @@
     }
 
     /**
+     * Tests Reset Site not crashing on host names (issue 600232).
+     * @throws Exception
+     */
+    @SmallTest
+    @Feature({"Preferences"})
+    public void testResetCrash600232() throws Exception {
+        Website website = new Website(WebsiteAddress.create("example.com"));
+        final Preferences preferenceActivity = startSingleWebsitePreferences(website);
+
+        ThreadUtils.runOnUiThreadBlocking(new Runnable() {
+            @Override
+            public void run() {
+                SingleWebsitePreferences websitePreferences =
+                        (SingleWebsitePreferences) preferenceActivity.getFragmentForTest();
+                websitePreferences.resetSite();
+            }
+        });
+        preferenceActivity.finish();
+    }
+
+    /**
      * Sets Allow Camera Enabled to be false and make sure it is set correctly.
      * @throws Exception
      */

diff --git a/chrome/app/generated_resources.grd b/chrome/app/generated_resources.grd
index 47ef478b..9ea86ae 100644
--- a/chrome/app/generated_resources.grd
+++ b/chrome/app/generated_resources.grd

@@ -12647,16 +12647,19 @@
           Create
         </message>
         <message name="IDS_PROFILES_CREATE_LOCAL_ERROR" desc="Message shown when a local error (for example, a disk error) occurs during profile creation.">
-          Oops! The new user couldn't be created. Please check your hard drive space and permissions and try again.
+          The new user couldn't be created. Please check your hard drive space and permissions and try again.
         </message>
         <message name="IDS_PROFILES_CREATE_REMOTE_ERROR" desc="Message shown when a remote error (for example, a network error) occurs during creation of a new supervised user.">
-          Oops! The new supervised user couldn't be created. Please check your network connection and try again later.
+          The new supervised user couldn't be created. Please check your network connection and try again later.
         </message>
         <message name="IDS_PROFILES_CREATE_SIGN_IN_ERROR" desc="Message shown when a sign-in error occurs during creation of a new supervised user.">
-          Oops! The new supervised user couldn't be created. Please make sure you're signed in properly and try again.
+          The new supervised user couldn't be created. Please make sure you're signed in properly and try again.
+        </message>
+        <message name="IDS_PROFILES_CREATE_NO_CUSTODIAN_ACCOUNT_ERROR" desc="Message shown when the user checks the checkbox to create a supervised user, but does not select a custodian account from the dropdown list.">
+          Select an account to manage the supervised user.
         </message>
         <message name="IDS_PROFILES_CREATE_LEGACY_SUPERVISED_USER_ERROR_EXISTS_REMOTELY" desc="Message shown when the user enters the name of a supervised user that can be imported.">
-          Looks like you're already managing a user by that name.<ph name="LINE_BREAK">&lt;br/&gt;</ph>Did you want to <ph name="BEGIN_LINK">&lt;a is="action-link" id="supervised-user-import-existing"&gt;</ph>import <ph name="PROFILE_NAME">$1<ex>John</ex></ph> to this device<ph name="END_LINK">&lt;/a&gt;</ph>?
+          Looks like you're already managing a user by that name. Did you want to <ph name="BEGIN_LINK">&lt;a is="action-link" id="supervised-user-import-existing"&gt;</ph>import <ph name="PROFILE_NAME">$1<ex>John</ex></ph><ph name="END_LINK">&lt;/a&gt;</ph> to this device?
         </message>
         <message name="IDS_PROFILES_CREATE_LEGACY_SUPERVISED_USER_ERROR_EXISTS_LOCALLY" desc="Message shown when the user enters the name of a supervised user that we already have locally.">
           Looks like you already have a supervised user with this name.
@@ -12665,12 +12668,18 @@
           Control and view the websites this person visits from <ph name="CUSTODIAN_EMAIL">$1<ex>user@gmail.com</ex></ph>.
         </message>
         <message name="IDS_PROFILES_CREATE_SUPERVISED_MULTI_SIGNED_IN_LABEL" desc="Label for the 'Supervised user' checkbox in the create-profile dialog when user can choose from a list of signed in users.">
-          Control and view the websites this person visits from
+          Supervise this person to control and view the websites they visit from your Google Account.
+        </message>
+        <message name="IDS_PROFILES_CREATE_SUPERVISED_SENTINEL_MENU_ITEM_TEXT" desc="Label for the dropdown menu containing signed in users from which the user can choose a custodian account.">
+          Select an account
         </message>
         <message name="IDS_PROFILES_CREATE_SUPERVISED_ACCOUNT_DETAILS_OUT_OF_DATE_LABEL" desc="Label for the 'Supervised user' checkbox in the create-profile dialog when the current user is signed in, but their sign-in information is invalid. This will be followed by a 'Sign in again' link.">
           Control and view the websites this person visits from <ph name="CUSTODIAN_EMAIL">$1<ex>user@gmail.com</ex></ph>.
     Your account sign-in details are out of date.
         </message>
+        <message name="IDS_PROFILES_CREATE_CUSTODIAN_ACCOUNT_DETAILS_OUT_OF_DATE_ERROR" desc="Message shown when the custodian is signed in, but their sign-in information is invalid.">
+          Your account details are out of date. <ph name="BEGIN_LINK">&lt;a is="action-link" id="reauth"&gt;</ph>Sign in again<ph name="END_LINK">&lt;/a&gt;</ph>.
+        </message>
         <message name="IDS_PROFILES_CREATE_SUPERVISED_JUST_SIGNED_IN" desc="Warning message shown in the create-profile dialog when the custodian signed in recently, sync has not yet finished initializing, and so the creation process is likely to take extra time.">
           Creating your supervised user. This may take a few moments.
         </message>

diff --git a/chrome/app/settings_strings.grdp b/chrome/app/settings_strings.grdp
index e63c421..9923319fb 100644
--- a/chrome/app/settings_strings.grdp
+++ b/chrome/app/settings_strings.grdp

@@ -234,6 +234,9 @@
     <message name="IDS_SETTINGS_CERTIFICATE_MANAGER_SERVERS_DESCRIPTION" desc="Label for servers subtitle tab in certificate manager.">
       You have certificates on file that identify these servers
     </message>
+    <message name="IDS_SETTINGS_CERTIFICATE_MANAGER_NO_CERTIFICATES" desc="Message displayed by the certificate manager, indicating that there are no certificates for a given certificate category.">
+      You have no certificates
+    </message>
     <message name="IDS_SETTINGS_CERTIFICATE_MANAGER_AUTHORITIES" desc="Label for the authorities tab in certificate manager.">
       Authorities
     </message>

diff --git a/chrome/browser/android/ntp/ntp_snippets_bridge.cc b/chrome/browser/android/ntp/ntp_snippets_bridge.cc
index 520e2a9..471053d 100644
--- a/chrome/browser/android/ntp/ntp_snippets_bridge.cc
+++ b/chrome/browser/android/ntp/ntp_snippets_bridge.cc

@@ -21,8 +21,6 @@
 using base::android::JavaParamRef;
 using base::android::ToJavaArrayOfStrings;
 using base::android::ToJavaLongArray;
-using ntp_snippets::NTPSnippetsService;
-using ntp_snippets::NTPSnippetsServiceObserver;
 
 static jlong Init(JNIEnv* env,
                   const JavaParamRef<jobject>& obj,
@@ -36,16 +34,14 @@
     : snippet_service_observer_(this) {
   Profile* profile = ProfileAndroid::FromProfileAndroid(j_profile);
   ntp_snippets_service_ = NTPSnippetsServiceFactory::GetForProfile(profile);
-  snippet_service_observer_.Add(ntp_snippets_service_);
 }
 
 void NTPSnippetsBridge::SetObserver(JNIEnv* env,
                                     const JavaParamRef<jobject>& obj,
                                     const JavaParamRef<jobject>& j_observer) {
   observer_.Reset(env, j_observer);
-
-  if (ntp_snippets_service_->is_loaded())
-    NTPSnippetsServiceLoaded(ntp_snippets_service_);
+  // This will call NTPSnippetsServiceLoaded.
+  snippet_service_observer_.Add(ntp_snippets_service_);
 }
 
 NTPSnippetsBridge::~NTPSnippetsBridge() {}
@@ -61,16 +57,15 @@
       GURL(ConvertJavaStringToUTF8(env, url)));
 }
 
-void NTPSnippetsBridge::NTPSnippetsServiceLoaded(NTPSnippetsService* service) {
-  if (observer_.is_null())
-    return;
+void NTPSnippetsBridge::NTPSnippetsServiceLoaded() {
+  DCHECK(!observer_.is_null());
 
   std::vector<std::string> titles;
   std::vector<std::string> urls;
   std::vector<std::string> thumbnail_urls;
   std::vector<std::string> snippets;
   std::vector<int64_t> timestamps;
-  for (const ntp_snippets::NTPSnippet& snippet : *service) {
+  for (const ntp_snippets::NTPSnippet& snippet : *ntp_snippets_service_) {
     titles.push_back(snippet.title());
     urls.push_back(snippet.url().spec());
     thumbnail_urls.push_back(snippet.salient_image_url().spec());
@@ -87,8 +82,7 @@
       ToJavaLongArray(env, timestamps).obj());
 }
 
-void NTPSnippetsBridge::NTPSnippetsServiceShutdown(
-    NTPSnippetsService* service) {
+void NTPSnippetsBridge::NTPSnippetsServiceShutdown() {
   observer_.Reset();
   snippet_service_observer_.Remove(ntp_snippets_service_);
 }

diff --git a/chrome/browser/android/ntp/ntp_snippets_bridge.h b/chrome/browser/android/ntp/ntp_snippets_bridge.h
index 8fb932a..0011c99c 100644
--- a/chrome/browser/android/ntp/ntp_snippets_bridge.h
+++ b/chrome/browser/android/ntp/ntp_snippets_bridge.h

@@ -34,10 +34,8 @@
   ~NTPSnippetsBridge() override;
 
   // NTPSnippetsServiceObserver overrides
-  void NTPSnippetsServiceLoaded(
-      ntp_snippets::NTPSnippetsService* service) override;
-  void NTPSnippetsServiceShutdown(
-      ntp_snippets::NTPSnippetsService* service) override;
+  void NTPSnippetsServiceLoaded() override;
+  void NTPSnippetsServiceShutdown() override;
 
   ntp_snippets::NTPSnippetsService* ntp_snippets_service_;
 

diff --git a/chrome/browser/android/ntp/popular_sites.cc b/chrome/browser/android/ntp/popular_sites.cc
index d458242..0a2255f7 100644
--- a/chrome/browser/android/ntp/popular_sites.cc
+++ b/chrome/browser/android/ntp/popular_sites.cc

@@ -1,4 +1,4 @@
-// Copyright 2013 The Chromium Authors. All rights reserved.
+// Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
@@ -18,7 +18,6 @@
 #include "base/time/time.h"
 #include "base/values.h"
 #include "chrome/browser/browser_process.h"
-#include "chrome/browser/net/file_downloader.h"
 #include "chrome/browser/profiles/profile.h"
 #include "chrome/browser/search_engines/template_url_service_factory.h"
 #include "chrome/common/chrome_paths.h"
@@ -36,14 +35,16 @@
 
 namespace {
 
-const char kPopularSitesURLFormat[] = "https://www.gstatic.com/chrome/ntp/%s";
-const char kPopularSitesServerFilenameFormat[] = "suggested_sites_%s_%s.json";
+const char kPopularSitesURLFormat[] =
+    "https://www.gstatic.com/chrome/ntp/suggested_sites_%s_%s.json";
 const char kPopularSitesDefaultCountryCode[] = "DEFAULT";
 const char kPopularSitesDefaultVersion[] = "5";
 const char kPopularSitesLocalFilename[] = "suggested_sites.json";
 const int kPopularSitesRedownloadIntervalHours = 24;
 
 const char kPopularSitesLastDownloadPref[] = "popular_sites_last_download";
+const char kPopularSitesCountryPref[] = "popular_sites_country";
+const char kPopularSitesVersionPref[] = "popular_sites_version";
 
 // Extract the country from the default search engine if the default search
 // engine is Google.
@@ -92,7 +93,11 @@
 // Google is the default search engine set. If Google is not the default search
 // engine use the country provided by VariationsService. Fallback to a default
 // if we can't make an educated guess.
-std::string GetCountryCode(Profile* profile) {
+std::string GetCountryToUse(Profile* profile,
+                            const std::string& override_country) {
+  if (!override_country.empty())
+    return override_country;
+
   std::string country_code = GetDefaultSearchEngineCountryCode(profile);
 
   if (country_code.empty())
@@ -104,30 +109,10 @@
   return base::ToUpperASCII(country_code);
 }
 
-std::string GetPopularSitesServerFilename(
-    Profile* profile,
-    const std::string& override_country,
-    const std::string& override_version) {
-  std::string country =
-      !override_country.empty() ? override_country : GetCountryCode(profile);
-  std::string version = !override_version.empty() ? override_version
-                                                  : kPopularSitesDefaultVersion;
-  return base::StringPrintf(kPopularSitesServerFilenameFormat,
-                            country.c_str(), version.c_str());
-}
-
-GURL GetPopularSitesURL(Profile* profile,
-                        const std::string& override_country,
-                        const std::string& override_version) {
-  return GURL(base::StringPrintf(
-      kPopularSitesURLFormat,
-      GetPopularSitesServerFilename(profile, override_country, override_version)
-          .c_str()));
-}
-
-GURL GetPopularSitesFallbackURL(Profile* profile) {
-  return GetPopularSitesURL(profile, kPopularSitesDefaultCountryCode,
-                            kPopularSitesDefaultVersion);
+std::string GetVersionToUse(const std::string& override_version) {
+  if (!override_version.empty())
+    return override_version;
+  return kPopularSitesDefaultVersion;
 }
 
 base::FilePath GetPopularSitesPath() {
@@ -198,30 +183,46 @@
                            bool force_download,
                            const FinishedCallback& callback)
     : PopularSites(profile,
-                   GetPopularSitesURL(profile, override_country,
-                                      override_version),
+                   GetCountryToUse(profile, override_country),
+                   GetVersionToUse(override_version),
+                   GURL(),
                    force_download,
                    callback) {}
 
 PopularSites::PopularSites(Profile* profile,
                            const GURL& url,
                            const FinishedCallback& callback)
-    : PopularSites(profile, url, true, callback) {}
+    : PopularSites(profile, std::string(), std::string(), url, true, callback) {
+}
 
 PopularSites::~PopularSites() {}
 
+std::string PopularSites::GetCountry() const {
+  return profile_->GetPrefs()->GetString(kPopularSitesCountryPref);
+}
+
+std::string PopularSites::GetVersion() const {
+  return profile_->GetPrefs()->GetString(kPopularSitesVersionPref);
+}
+
 // static
 void PopularSites::RegisterProfilePrefs(
     user_prefs::PrefRegistrySyncable* user_prefs) {
   user_prefs->RegisterInt64Pref(kPopularSitesLastDownloadPref, 0);
+  user_prefs->RegisterStringPref(kPopularSitesCountryPref, std::string());
+  user_prefs->RegisterStringPref(kPopularSitesVersionPref, std::string());
 }
 
 PopularSites::PopularSites(Profile* profile,
-                           const GURL& url,
+                           const std::string& country,
+                           const std::string& version,
+                           const GURL& override_url,
                            bool force_download,
                            const FinishedCallback& callback)
     : callback_(callback),
-      popular_sites_local_path_(GetPopularSitesPath()),
+      pending_country_(country),
+      pending_version_(version),
+      local_path_(GetPopularSitesPath()),
       profile_(profile),
       weak_ptr_factory_(this) {
   const base::Time last_download_time = base::Time::FromInternalValue(
@@ -235,35 +236,58 @@
   const bool should_redownload_if_exists =
       force_download || download_time_is_future ||
       (time_since_last_download > redownload_interval);
+  // TODO(treib): If country/version don't match what we have, we should
+  // probably also redownload?
 
-  FetchPopularSites(url, should_redownload_if_exists, false /* is_fallback */);
+  FetchPopularSites(
+      override_url.is_valid() ? override_url : GetPopularSitesURL(),
+      should_redownload_if_exists, false /* is_fallback */);
+}
+
+GURL PopularSites::GetPopularSitesURL() const {
+  return GURL(base::StringPrintf(kPopularSitesURLFormat,
+                                 pending_country_.c_str(),
+                                 pending_version_.c_str()));
 }
 
 void PopularSites::FetchPopularSites(const GURL& url,
                                      bool force_download,
                                      bool is_fallback) {
-  downloader_.reset(
-      new FileDownloader(url, popular_sites_local_path_, force_download,
-                         profile_->GetRequestContext(),
-                         base::Bind(&PopularSites::OnDownloadDone,
-                                    base::Unretained(this), is_fallback)));
+  downloader_.reset(new FileDownloader(
+      url, local_path_, force_download, profile_->GetRequestContext(),
+      base::Bind(&PopularSites::OnDownloadDone, base::Unretained(this),
+                 is_fallback)));
 }
 
-void PopularSites::OnDownloadDone(bool is_fallback, bool success) {
+void PopularSites::OnDownloadDone(bool is_fallback,
+                                  FileDownloader::Result result) {
   downloader_.reset();
-  if (success) {
-    profile_->GetPrefs()->SetInt64(kPopularSitesLastDownloadPref,
-                                   base::Time::Now().ToInternalValue());
-    ParseSiteList(popular_sites_local_path_);
-  } else if (!is_fallback) {
-    DLOG(WARNING) << "Download country site list failed";
-    // It is fine to force the download as Fallback is only triggered after a
-    // failed download.
-    FetchPopularSites(GetPopularSitesFallbackURL(profile_),
-                      true /* force_download */, true /* is_fallback */);
-  } else {
-    DLOG(WARNING) << "Download fallback site list failed";
-    callback_.Run(false);
+  PrefService* prefs = profile_->GetPrefs();
+  switch (result) {
+    case FileDownloader::DOWNLOADED:
+      prefs->SetInt64(kPopularSitesLastDownloadPref,
+                      base::Time::Now().ToInternalValue());
+      prefs->SetString(kPopularSitesCountryPref, pending_country_);
+      prefs->SetString(kPopularSitesVersionPref, pending_version_);
+      ParseSiteList(local_path_);
+      break;
+    case FileDownloader::EXISTS:
+      ParseSiteList(local_path_);
+      break;
+    case FileDownloader::FAILED:
+      if (!is_fallback) {
+        DLOG(WARNING) << "Download country site list failed";
+        pending_country_ = kPopularSitesDefaultCountryCode;
+        pending_version_ = kPopularSitesDefaultVersion;
+        // It is fine to force the download as Fallback is only triggered after
+        // a failed download.
+        FetchPopularSites(GetPopularSitesURL(), true /* force_download */,
+                          true /* is_fallback */);
+      } else {
+        DLOG(WARNING) << "Download fallback site list failed";
+        callback_.Run(false);
+      }
+      break;
   }
 }
 

diff --git a/chrome/browser/android/ntp/popular_sites.h b/chrome/browser/android/ntp/popular_sites.h
index 486501a..3735414 100644
--- a/chrome/browser/android/ntp/popular_sites.h
+++ b/chrome/browser/android/ntp/popular_sites.h

@@ -5,6 +5,7 @@
 #ifndef CHROME_BROWSER_ANDROID_NTP_POPULAR_SITES_H_
 #define CHROME_BROWSER_ANDROID_NTP_POPULAR_SITES_H_
 
+#include <string>
 #include <vector>
 
 #include "base/callback.h"
@@ -13,6 +14,7 @@
 #include "base/memory/scoped_ptr.h"
 #include "base/memory/weak_ptr.h"
 #include "base/strings/string16.h"
+#include "chrome/browser/net/file_downloader.h"
 #include "url/gurl.h"
 
 namespace net {
@@ -23,7 +25,6 @@
 class PrefRegistrySyncable;
 }
 
-class FileDownloader;
 class Profile;
 
 // Downloads and provides a list of suggested popular sites, for display on
@@ -70,7 +71,11 @@
 
   const std::vector<Site>& sites() const { return sites_; }
 
-  const base::FilePath& local_path() const { return popular_sites_local_path_; }
+  // The country/version of the file that was last downloaded.
+  std::string GetCountry() const;
+  std::string GetVersion() const;
+
+  const base::FilePath& local_path() const { return local_path_; }
 
   // Register preferences used by this class.
   static void RegisterProfilePrefs(
@@ -78,10 +83,14 @@
 
  private:
   PopularSites(Profile* profile,
-               const GURL& url,
+               const std::string& country,
+               const std::string& version,
+               const GURL& override_url,
                bool force_download,
                const FinishedCallback& callback);
 
+  GURL GetPopularSitesURL() const;
+
   // Fetch the popular sites at the given URL. |force_download| should be true
   // if any previously downloaded site list should be overwritten.
   void FetchPopularSites(const GURL& url,
@@ -90,7 +99,7 @@
 
   // If the download was not successful and it was not a fallback, attempt to
   // download the fallback suggestions.
-  void OnDownloadDone(bool success, bool is_fallback);
+  void OnDownloadDone(bool is_fallback, FileDownloader::Result result);
 
   void ParseSiteList(const base::FilePath& path);
   void OnJsonParsed(scoped_ptr<std::vector<Site>> sites);
@@ -98,8 +107,10 @@
   FinishedCallback callback_;
   scoped_ptr<FileDownloader> downloader_;
   std::vector<Site> sites_;
+  std::string pending_country_;
+  std::string pending_version_;
 
-  base::FilePath popular_sites_local_path_;
+  base::FilePath local_path_;
 
   Profile* profile_;
 

diff --git a/chrome/browser/chrome_content_browser_client.cc b/chrome/browser/chrome_content_browser_client.cc
index b43b8e3..f8e169cd 100644
--- a/chrome/browser/chrome_content_browser_client.cc
+++ b/chrome/browser/chrome_content_browser_client.cc

@@ -828,6 +828,10 @@
   AfterStartupTaskUtils::PostTask(from_here, task_runner, task);
 }
 
+bool ChromeContentBrowserClient::IsBrowserStartupComplete() {
+  return AfterStartupTaskUtils::IsBrowserStartupComplete();
+}
+
 std::string ChromeContentBrowserClient::GetStoragePartitionIdForSite(
     content::BrowserContext* browser_context,
     const GURL& site) {

diff --git a/chrome/browser/chrome_content_browser_client.h b/chrome/browser/chrome_content_browser_client.h
index f75706a..85fc900 100644
--- a/chrome/browser/chrome_content_browser_client.h
+++ b/chrome/browser/chrome_content_browser_client.h

@@ -57,6 +57,7 @@
   void PostAfterStartupTask(const tracked_objects::Location& from_here,
                             const scoped_refptr<base::TaskRunner>& task_runner,
                             const base::Closure& task) override;
+  bool IsBrowserStartupComplete() override;
   std::string GetStoragePartitionIdForSite(
       content::BrowserContext* browser_context,
       const GURL& site) override;

diff --git a/chrome/browser/chromeos/arc/arc_policy_bridge.cc b/chrome/browser/chromeos/arc/arc_policy_bridge.cc
index e472d9ad..15f7bf7 100644
--- a/chrome/browser/chromeos/arc/arc_policy_bridge.cc
+++ b/chrome/browser/chromeos/arc/arc_policy_bridge.cc

@@ -4,6 +4,9 @@
 
 #include "chrome/browser/chromeos/arc/arc_policy_bridge.h"
 
+#include <string>
+
+#include "base/json/json_reader.h"
 #include "base/json/json_string_value_serializer.h"
 #include "base/logging.h"
 #include "base/values.h"
@@ -18,6 +21,60 @@
 
 namespace arc {
 
+namespace {
+
+// invert_bool_value: If the Chrome policy and the ARC policy with boolean value
+// have opposite semantics, set this to true so the bool is inverted before
+// being added. Otherwise, set it to false.
+void AddPolicy(const std::string arc_policy_name,
+               const std::string policy_name,
+               const policy::PolicyMap& policy_map,
+               bool invert_bool_value,
+               base::DictionaryValue& filtered_policies) {
+  const base::Value* const policy_value = policy_map.GetValue(policy_name);
+  if (policy_value) {
+    if (invert_bool_value && policy_value->IsType(base::Value::TYPE_BOOLEAN)) {
+      bool bool_value;
+      policy_value->GetAsBoolean(&bool_value);
+      filtered_policies.SetBoolean(arc_policy_name, !bool_value);
+    } else {
+      filtered_policies.Set(arc_policy_name,
+                            policy_value->CreateDeepCopy().release());
+    }
+  }
+}
+
+std::string GetFilteredJSONPolicies(const policy::PolicyMap& policy_map) {
+  base::DictionaryValue filtered_policies;
+  // Parse ArcApplicationPolicy as JSON string before adding other policies to
+  // the dictionary.
+  const base::Value* const app_policy_value =
+      policy_map.GetValue(policy::key::kArcApplicationPolicy);
+  if (app_policy_value) {
+    std::string app_policy_string;
+    app_policy_value->GetAsString(&app_policy_string);
+    std::unique_ptr<base::DictionaryValue> app_policy_dict =
+        base::DictionaryValue::From(base::JSONReader::Read(app_policy_string));
+    if (app_policy_dict) {
+      filtered_policies.Swap(app_policy_dict.get());
+    } else {
+      LOG(ERROR) << "Value of ArcApplicationPolicy has invalid format: "
+                 << app_policy_string;
+    }
+  }
+
+  // Keep them sorted by the ARC policy names.
+  AddPolicy("cameraDisabled", policy::key::kVideoCaptureAllowed, policy_map,
+            true, filtered_policies);
+
+  std::string policy_json;
+  JSONStringValueSerializer serializer(&policy_json);
+  serializer.Serialize(filtered_policies);
+  return policy_json;
+}
+
+}  // namespace
+
 ArcPolicyBridge::ArcPolicyBridge(ArcBridgeService* bridge_service)
     : ArcService(bridge_service), binding_(this) {
   VLOG(1) << "ArcPolicyBridge::ArcPolicyBridge";
@@ -89,23 +146,4 @@
           ->policy_service();
 }
 
-std::string ArcPolicyBridge::GetFilteredJSONPolicies(
-    const policy::PolicyMap& policy_map) {
-  // TODO(phweiss): Implement general filtering mechanism when more policies
-  // need to be passed on.
-  // Create dictionary with the desired policies.
-  base::DictionaryValue filtered_policies;
-  const std::string policy_name = policy::key::kArcApplicationPolicy;
-  const base::Value* const policy_value = policy_map.GetValue(policy_name);
-  if (policy_value) {
-    filtered_policies.Set(policy_name,
-                          policy_value->CreateDeepCopy().release());
-  }
-  // Convert dictionary to JSON.
-  std::string policy_json;
-  JSONStringValueSerializer serializer(&policy_json);
-  serializer.Serialize(filtered_policies);
-  return policy_json;
-}
-
 }  // namespace arc

diff --git a/chrome/browser/chromeos/arc/arc_policy_bridge.h b/chrome/browser/chromeos/arc/arc_policy_bridge.h
index 2177f1b..90603e8 100644
--- a/chrome/browser/chromeos/arc/arc_policy_bridge.h
+++ b/chrome/browser/chromeos/arc/arc_policy_bridge.h

@@ -5,8 +5,6 @@
 #ifndef CHROME_BROWSER_CHROMEOS_ARC_ARC_POLICY_BRIDGE_H_
 #define CHROME_BROWSER_CHROMEOS_ARC_ARC_POLICY_BRIDGE_H_
 
-#include <string>
-
 #include "base/macros.h"
 #include "components/arc/arc_bridge_service.h"
 #include "components/arc/arc_service.h"
@@ -43,7 +41,6 @@
 
  private:
   void InitializePolicyService();
-  std::string GetFilteredJSONPolicies(const policy::PolicyMap& policy_map);
 
   mojo::Binding<PolicyHost> binding_;
   policy::PolicyService* policy_service_ = nullptr;

diff --git a/chrome/browser/chromeos/arc/arc_policy_bridge_unittest.cc b/chrome/browser/chromeos/arc/arc_policy_bridge_unittest.cc
index ae0ead1d..1574666d 100644
--- a/chrome/browser/chromeos/arc/arc_policy_bridge_unittest.cc
+++ b/chrome/browser/chromeos/arc/arc_policy_bridge_unittest.cc

@@ -3,6 +3,7 @@
 // found in the LICENSE file.
 
 #include <memory>
+#include <string>
 
 #include "base/macros.h"
 #include "base/values.h"
@@ -68,22 +69,81 @@
   DISALLOW_COPY_AND_ASSIGN(ArcPolicyBridgeTest);
 };
 
-TEST_F(ArcPolicyBridgeTest, GetPoliciesTest) {
-  PolicyStringCallback empty_callback("{}");
-  policy_bridge()->GetPolicies(empty_callback);
-  policy_map().Set("HomepageLocation", policy::POLICY_LEVEL_MANDATORY,
-                   policy::POLICY_SCOPE_USER, policy::POLICY_SOURCE_CLOUD,
-                   new base::StringValue("http://chromium.org"), nullptr);
-  policy_bridge()->GetPolicies(empty_callback);
+TEST_F(ArcPolicyBridgeTest, EmptyPolicyTest) {
+  // No policy is set, result should be empty.
+  policy_bridge()->GetPolicies(PolicyStringCallback("{}"));
+}
+
+TEST_F(ArcPolicyBridgeTest, ArcApplicationPolicyTest) {
   policy_map().Set(
       "ArcApplicationPolicy", policy::POLICY_LEVEL_MANDATORY,
       policy::POLICY_SCOPE_USER, policy::POLICY_SOURCE_CLOUD,
-      new base::StringValue("{\"application\": \"com.android.chrome\"}"),
+      new base::StringValue(
+          "{\"applications\":"
+              "[{\"packageName\":\"com.google.android.apps.youtube.kids\","
+                "\"installType\":\"REQUIRED\","
+                "\"lockTaskAllowed\":false,"
+                "\"permissionGrants\":[]"
+              "}],"
+          "\"defaultPermissionPolicy\":\"GRANT\""
+          "}"),
       nullptr);
-  PolicyStringCallback chrome_callback(
-      "{\"ArcApplicationPolicy\":"
-      "\"{\\\"application\\\": \\\"com.android.chrome\\\"}\"}");
-  policy_bridge()->GetPolicies(chrome_callback);
+  policy_bridge()->GetPolicies(PolicyStringCallback(
+      "{\"applications\":"
+          "[{\"installType\":\"REQUIRED\","
+            "\"lockTaskAllowed\":false,"
+            "\"packageName\":\"com.google.android.apps.youtube.kids\","
+            "\"permissionGrants\":[]"
+          "}],"
+      "\"defaultPermissionPolicy\":\"GRANT\""
+      "}"));
+}
+
+TEST_F(ArcPolicyBridgeTest, HompageLocationTest) {
+  // This policy will not be passed on, result should be empty.
+  policy_map().Set("HomepageLocation", policy::POLICY_LEVEL_MANDATORY,
+                   policy::POLICY_SCOPE_USER, policy::POLICY_SOURCE_CLOUD,
+                   new base::StringValue("http://chromium.org"), nullptr);
+  policy_bridge()->GetPolicies(PolicyStringCallback("{}"));
+}
+
+TEST_F(ArcPolicyBridgeTest, VideoCaptureAllowedTest) {
+  policy_map().Set("VideoCaptureAllowed", policy::POLICY_LEVEL_MANDATORY,
+                   policy::POLICY_SCOPE_USER, policy::POLICY_SOURCE_CLOUD,
+                   new base::FundamentalValue(false), nullptr);
+  policy_bridge()->GetPolicies(
+      PolicyStringCallback("{\"cameraDisabled\":true}"));
+}
+
+TEST_F(ArcPolicyBridgeTest, AllPoliciesTest) {
+  // Keep them in alphabetical order.
+  policy_map().Set(
+      "ArcApplicationPolicy", policy::POLICY_LEVEL_MANDATORY,
+      policy::POLICY_SCOPE_USER, policy::POLICY_SOURCE_CLOUD,
+      new base::StringValue("{\"applications\":"
+              "[{\"packageName\":\"com.google.android.apps.youtube.kids\","
+                "\"installType\":\"REQUIRED\","
+                "\"lockTaskAllowed\":false,"
+                "\"permissionGrants\":[]"
+              "}],"
+          "\"defaultPermissionPolicy\":\"GRANT\"}"),
+      nullptr);
+  policy_map().Set("HomepageLocation", policy::POLICY_LEVEL_MANDATORY,
+                   policy::POLICY_SCOPE_USER, policy::POLICY_SOURCE_CLOUD,
+                   new base::StringValue("http://chromium.org"), nullptr);
+  policy_map().Set("VideoCaptureAllowed", policy::POLICY_LEVEL_MANDATORY,
+                   policy::POLICY_SCOPE_USER, policy::POLICY_SOURCE_CLOUD,
+                   new base::FundamentalValue(false), nullptr);
+  policy_bridge()->GetPolicies(PolicyStringCallback(
+      "{\"applications\":"
+          "[{\"installType\":\"REQUIRED\","
+            "\"lockTaskAllowed\":false,"
+            "\"packageName\":\"com.google.android.apps.youtube.kids\","
+            "\"permissionGrants\":[]"
+          "}],"
+        "\"cameraDisabled\":true,"
+        "\"defaultPermissionPolicy\":\"GRANT\""
+      "}"));
 }
 
 }  // namespace arc

diff --git a/chrome/browser/extensions/api/feedback_private/feedback_browsertest.cc b/chrome/browser/extensions/api/feedback_private/feedback_browsertest.cc
index 168de50..201e09a 100644
--- a/chrome/browser/extensions/api/feedback_private/feedback_browsertest.cc
+++ b/chrome/browser/extensions/api/feedback_private/feedback_browsertest.cc

@@ -81,7 +81,13 @@
   }
 };
 
-IN_PROC_BROWSER_TEST_F(FeedbackTest, ShowFeedback) {
+// http://crbug.com/601433
+#if defined(OS_CHROMEOS)
+#define MAYBE_ShowFeedback DISABLED_ShowFeedback
+#else
+#define MAYBE_ShowFeedback ShowFeedback
+#endif
+IN_PROC_BROWSER_TEST_F(FeedbackTest, MAYBE_ShowFeedback) {
   WaitForExtensionViewsToLoad();
 
   ASSERT_TRUE(IsFeedbackAppAvailable());
@@ -89,7 +95,13 @@
   VerifyFeedbackAppLaunch();
 }
 
-IN_PROC_BROWSER_TEST_F(FeedbackTest, ShowLoginFeedback) {
+// http://crbug.com/601306
+#if defined(OS_CHROMEOS)
+#define MAYBE_ShowLoginFeedback DISABLED_ShowLoginFeedback
+#else
+#define MAYBE_ShowLoginFeedback ShowLoginFeedback
+#endif
+IN_PROC_BROWSER_TEST_F(FeedbackTest, MAYBE_ShowLoginFeedback) {
   WaitForExtensionViewsToLoad();
 
   ASSERT_TRUE(IsFeedbackAppAvailable());

diff --git a/chrome/browser/first_run/upgrade_util_win.cc b/chrome/browser/first_run/upgrade_util_win.cc
index 9d5402a..91b35e9 100644
--- a/chrome/browser/first_run/upgrade_util_win.cc
+++ b/chrome/browser/first_run/upgrade_util_win.cc

@@ -93,8 +93,11 @@
   chrome_exe_command_line.SetProgram(
       chrome_exe.DirName().Append(installer::kChromeExe));
 
-  return base::LaunchProcess(chrome_exe_command_line, base::LaunchOptions())
-      .IsValid();
+  // Set the working directory to the exe's directory. This avoids a handle to
+  // the version directory being kept open in the relaunched child process.
+  base::LaunchOptions launch_options;
+  launch_options.current_directory = chrome_exe.DirName();
+  return base::LaunchProcess(chrome_exe_command_line, launch_options).IsValid();
 }
 
 bool IsUpdatePendingRestart() {

diff --git a/chrome/browser/media_galleries/fileapi/safe_audio_video_checker.cc b/chrome/browser/media_galleries/fileapi/safe_audio_video_checker.cc
index abcfde2..a27e6cf 100644
--- a/chrome/browser/media_galleries/fileapi/safe_audio_video_checker.cc
+++ b/chrome/browser/media_galleries/fileapi/safe_audio_video_checker.cc

@@ -58,10 +58,8 @@
     return;
   state_ = STARTED_STATE;
 
-  if (utility_process_host_->GetData().handle == base::kNullProcessHandle)
-    DLOG(ERROR) << "Child process handle is null";
-  IPC::PlatformFileForTransit file_for_transit = IPC::TakeFileHandleForProcess(
-      std::move(file_), utility_process_host_->GetData().handle);
+  IPC::PlatformFileForTransit file_for_transit =
+      IPC::TakePlatformFileForTransit(std::move(file_));
   if (file_for_transit == IPC::InvalidPlatformFileForTransit()) {
     OnCheckingFinished(false /* valid? */);
     return;

diff --git a/chrome/browser/media_galleries/fileapi/safe_iapps_library_parser.cc b/chrome/browser/media_galleries/fileapi/safe_iapps_library_parser.cc
index 53e5bd04..abedc36 100644
--- a/chrome/browser/media_galleries/fileapi/safe_iapps_library_parser.cc
+++ b/chrome/browser/media_galleries/fileapi/safe_iapps_library_parser.cc

@@ -84,9 +84,7 @@
 
   if (!itunes_callback_.is_null()) {
     utility_process_host_->Send(new ChromeUtilityMsg_ParseITunesLibraryXmlFile(
-        IPC::TakeFileHandleForProcess(
-            std::move(library_file_),
-            utility_process_host_->GetData().handle)));
+        IPC::TakePlatformFileForTransit(std::move(library_file_))));
   }
 
   parser_state_ = STARTED_PARSING_STATE;

diff --git a/chrome/browser/media_galleries/fileapi/safe_picasa_album_table_reader.cc b/chrome/browser/media_galleries/fileapi/safe_picasa_album_table_reader.cc
index ee68dae..f45d5aa9 100644
--- a/chrome/browser/media_galleries/fileapi/safe_picasa_album_table_reader.cc
+++ b/chrome/browser/media_galleries/fileapi/safe_picasa_album_table_reader.cc

@@ -86,27 +86,20 @@
     DLOG(ERROR) << "Child process handle is null";
   }
   AlbumTableFilesForTransit files_for_transit;
-  files_for_transit.indicator_file = IPC::TakeFileHandleForProcess(
-      std::move(album_table_files_.indicator_file),
-      utility_process_host_->GetData().handle);
-  files_for_transit.category_file =
-      IPC::TakeFileHandleForProcess(std::move(album_table_files_.category_file),
-                                    utility_process_host_->GetData().handle);
+  files_for_transit.indicator_file = IPC::TakePlatformFileForTransit(
+      std::move(album_table_files_.indicator_file));
+  files_for_transit.category_file = IPC::TakePlatformFileForTransit(
+      std::move(album_table_files_.category_file));
   files_for_transit.date_file =
-      IPC::TakeFileHandleForProcess(std::move(album_table_files_.date_file),
-                                    utility_process_host_->GetData().handle);
-  files_for_transit.filename_file =
-      IPC::TakeFileHandleForProcess(std::move(album_table_files_.filename_file),
-                                    utility_process_host_->GetData().handle);
+      IPC::TakePlatformFileForTransit(std::move(album_table_files_.date_file));
+  files_for_transit.filename_file = IPC::TakePlatformFileForTransit(
+      std::move(album_table_files_.filename_file));
   files_for_transit.name_file =
-      IPC::TakeFileHandleForProcess(std::move(album_table_files_.name_file),
-                                    utility_process_host_->GetData().handle);
+      IPC::TakePlatformFileForTransit(std::move(album_table_files_.name_file));
   files_for_transit.token_file =
-      IPC::TakeFileHandleForProcess(std::move(album_table_files_.token_file),
-                                    utility_process_host_->GetData().handle);
+      IPC::TakePlatformFileForTransit(std::move(album_table_files_.token_file));
   files_for_transit.uid_file =
-      IPC::TakeFileHandleForProcess(std::move(album_table_files_.uid_file),
-                                    utility_process_host_->GetData().handle);
+      IPC::TakePlatformFileForTransit(std::move(album_table_files_.uid_file));
   utility_process_host_->Send(new ChromeUtilityMsg_ParsePicasaPMPDatabase(
       files_for_transit));
   parser_state_ = STARTED_PARSING_STATE;

diff --git a/chrome/browser/net/file_downloader.cc b/chrome/browser/net/file_downloader.cc
index fdc70ab..2f7d044 100644
--- a/chrome/browser/net/file_downloader.cc
+++ b/chrome/browser/net/file_downloader.cc

@@ -58,7 +58,7 @@
   if (!status.is_success()) {
     DLOG(WARNING) << "URLRequestStatus error " << status.error()
         << " while trying to download " << source->GetURL().spec();
-    callback_.Run(false);
+    callback_.Run(FAILED);
     return;
   }
 
@@ -66,14 +66,14 @@
   if (response_code != net::HTTP_OK) {
     DLOG(WARNING) << "HTTP error " << response_code
         << " while trying to download " << source->GetURL().spec();
-    callback_.Run(false);
+    callback_.Run(FAILED);
     return;
   }
 
   base::FilePath response_path;
   bool success = source->GetResponseAsFilePath(false, &response_path);
   if (!success) {
-    callback_.Run(false);
+    callback_.Run(FAILED);
     return;
   }
 
@@ -89,7 +89,7 @@
 
 void FileDownloader::OnFileExistsCheckDone(bool exists) {
   if (exists)
-    callback_.Run(true);
+    callback_.Run(EXISTS);
   else
     fetcher_->Start();
 }
@@ -100,5 +100,5 @@
                   << local_path_.LossyDisplayName();
   }
 
-  callback_.Run(success);
+  callback_.Run(success ? DOWNLOADED : FAILED);
 }

diff --git a/chrome/browser/net/file_downloader.h b/chrome/browser/net/file_downloader.h
index d6383188..4db2b6b 100644
--- a/chrome/browser/net/file_downloader.h
+++ b/chrome/browser/net/file_downloader.h

@@ -25,7 +25,15 @@
 // downloading anything.
 class FileDownloader : public net::URLFetcherDelegate {
  public:
-  typedef base::Callback<void(bool /* success */)> DownloadFinishedCallback;
+  enum Result {
+    // The file was successfully downloaded.
+    DOWNLOADED,
+    // A local file at the given path already existed and was kept.
+    EXISTS,
+    // Downloading failed.
+    FAILED
+  };
+  using DownloadFinishedCallback = base::Callback<void(Result)>;
 
   // Directly starts the download (if necessary) and runs |callback| when done.
   // If the instance is destroyed before it is finished, |callback| is not run.
@@ -36,6 +44,8 @@
                  const DownloadFinishedCallback& callback);
   ~FileDownloader() override;
 
+  static bool IsSuccess(Result result) { return result != FAILED; }
+
  private:
   // net::URLFetcherDelegate implementation.
   void OnURLFetchComplete(const net::URLFetcher* source) override;

diff --git a/chrome/browser/net/file_downloader_unittest.cc b/chrome/browser/net/file_downloader_unittest.cc
index 0eb5474..4d0da78 100644
--- a/chrome/browser/net/file_downloader_unittest.cc
+++ b/chrome/browser/net/file_downloader_unittest.cc

@@ -34,7 +34,7 @@
     ASSERT_FALSE(base::PathExists(path_));
   }
 
-  MOCK_METHOD1(OnDownloadFinished, void(bool success));
+  MOCK_METHOD1(OnDownloadFinished, void(FileDownloader::Result));
 
  protected:
   const base::FilePath& path() const { return path_; }
@@ -57,12 +57,12 @@
         net::URLRequestStatus::SUCCESS);
   }
 
-  void Download(bool overwrite, bool expect_success) {
+  void Download(bool overwrite, FileDownloader::Result expected_result) {
     FileDownloader downloader(
         GURL(kURL), path_, overwrite, request_context_.get(),
         base::Bind(&FileDownloaderTest::OnDownloadFinished,
                    base::Unretained(this)));
-    EXPECT_CALL(*this, OnDownloadFinished(expect_success));
+    EXPECT_CALL(*this, OnDownloadFinished(expected_result));
     // Wait for the FileExists check to happen if necessary.
     if (!overwrite)
       content::BrowserThread::GetBlockingPool()->FlushForTesting();
@@ -84,7 +84,7 @@
 
 TEST_F(FileDownloaderTest, Success) {
   SetValidResponse();
-  Download(true, true);
+  Download(true, FileDownloader::DOWNLOADED);
   EXPECT_TRUE(base::PathExists(path()));
   std::string contents;
   ASSERT_TRUE(base::ReadFileToString(path(), &contents));
@@ -93,20 +93,20 @@
 
 TEST_F(FileDownloaderTest, Failure) {
   SetFailedResponse();
-  Download(true, false);
+  Download(true, FileDownloader::FAILED);
   EXPECT_FALSE(base::PathExists(path()));
 }
 
 TEST_F(FileDownloaderTest, Overwrite) {
   SetValidResponse();
-  Download(true, true);
+  Download(true, FileDownloader::DOWNLOADED);
   ASSERT_TRUE(base::PathExists(path()));
   std::string contents;
   ASSERT_TRUE(base::ReadFileToString(path(), &contents));
   ASSERT_EQ(std::string(kFileContents1), contents);
 
   SetValidResponse2();
-  Download(true, true);
+  Download(true, FileDownloader::DOWNLOADED);
   // The file should have been overwritten with the new contents.
   EXPECT_TRUE(base::PathExists(path()));
   ASSERT_TRUE(base::ReadFileToString(path(), &contents));
@@ -115,14 +115,14 @@
 
 TEST_F(FileDownloaderTest, DontOverwrite) {
   SetValidResponse();
-  Download(true, true);
+  Download(true, FileDownloader::DOWNLOADED);
   ASSERT_TRUE(base::PathExists(path()));
   std::string contents;
   ASSERT_TRUE(base::ReadFileToString(path(), &contents));
   EXPECT_EQ(std::string(kFileContents1), contents);
 
   SetValidResponse2();
-  Download(false, true);
+  Download(false, FileDownloader::EXISTS);
   // The file should still have the old contents.
   EXPECT_TRUE(base::PathExists(path()));
   ASSERT_TRUE(base::ReadFileToString(path(), &contents));

diff --git a/chrome/browser/plugins/plugin_prefs_factory.cc b/chrome/browser/plugins/plugin_prefs_factory.cc
index b82d9b7..899a6a2 100644
--- a/chrome/browser/plugins/plugin_prefs_factory.cc
+++ b/chrome/browser/plugins/plugin_prefs_factory.cc

@@ -57,7 +57,6 @@
   PathService::Get(chrome::DIR_INTERNAL_PLUGINS, &internal_dir);
   registry->RegisterFilePathPref(prefs::kPluginsLastInternalDirectory,
                                  internal_dir);
-  registry->RegisterBooleanPref(prefs::kNpapiFlashMigratedToPepperFlash, false);
   registry->RegisterListPref(prefs::kPluginsPluginsList);
   registry->RegisterListPref(prefs::kPluginsDisabledPlugins);
   registry->RegisterListPref(prefs::kPluginsDisabledPluginsExceptions);

diff --git a/chrome/browser/printing/pwg_raster_converter.cc b/chrome/browser/printing/pwg_raster_converter.cc
index 1b0b4d8..bc00f525 100644
--- a/chrome/browser/printing/pwg_raster_converter.cc
+++ b/chrome/browser/printing/pwg_raster_converter.cc

@@ -57,17 +57,17 @@
     return temp_dir_.path().AppendASCII("input.pdf");
   }
 
-  IPC::PlatformFileForTransit GetPdfForProcess(base::ProcessHandle process) {
+  IPC::PlatformFileForTransit GetPdfForProcess() {
     DCHECK(pdf_file_.IsValid());
     IPC::PlatformFileForTransit transit =
-        IPC::TakeFileHandleForProcess(std::move(pdf_file_), process);
+        IPC::TakePlatformFileForTransit(std::move(pdf_file_));
     return transit;
   }
 
-  IPC::PlatformFileForTransit GetPwgForProcess(base::ProcessHandle process) {
+  IPC::PlatformFileForTransit GetPwgForProcess() {
     DCHECK(pwg_file_.IsValid());
     IPC::PlatformFileForTransit transit =
-        IPC::TakeFileHandleForProcess(std::move(pwg_file_), process);
+        IPC::TakePlatformFileForTransit(std::move(pwg_file_));
     return transit;
   }
 
@@ -196,12 +196,9 @@
     return;
   }
 
-  base::ProcessHandle process = utility_process_host_->GetData().handle;
   utility_process_host_->Send(new ChromeUtilityMsg_RenderPDFPagesToPWGRaster(
-      files_->GetPdfForProcess(process),
-      settings_,
-      bitmap_settings_,
-      files_->GetPwgForProcess(process)));
+      files_->GetPdfForProcess(), settings_, bitmap_settings_,
+      files_->GetPwgForProcess()));
   utility_process_host_.reset();
 }
 

diff --git a/chrome/browser/resources/md_user_manager/compiled_resources2.gyp b/chrome/browser/resources/md_user_manager/compiled_resources2.gyp
index d9e8d44..caf1a92 100644
--- a/chrome/browser/resources/md_user_manager/compiled_resources2.gyp
+++ b/chrome/browser/resources/md_user_manager/compiled_resources2.gyp

@@ -16,6 +16,7 @@
       'dependencies': [
         '<(DEPTH)/ui/webui/resources/js/compiled_resources2.gyp:i18n_behavior',
         '<(DEPTH)/ui/webui/resources/js/compiled_resources2.gyp:load_time_data',
+        '<(DEPTH)/ui/webui/resources/js/compiled_resources2.gyp:util',
         '<(DEPTH)/ui/webui/resources/js/compiled_resources2.gyp:web_ui_listener_behavior',
         'profile_browser_proxy',
       ],

diff --git a/chrome/browser/resources/md_user_manager/control_bar.css b/chrome/browser/resources/md_user_manager/control_bar.css
index 77b12601..3b2489e9 100644
--- a/chrome/browser/resources/md_user_manager/control_bar.css
+++ b/chrome/browser/resources/md_user_manager/control_bar.css

@@ -2,25 +2,23 @@
  * Use of this source code is governed by a BSD-style license that can be
  * found in the LICENSE file. */
 
-#login-header-bar {
-  bottom: 0;
-  left: 0;
-  min-height: 32px;
+#container {
   padding-bottom: 12px;
   padding-top: 12px;
-  position: absolute;
-  right: 0;
 }
 
 paper-button {
   border-radius: 2px;
+  color: var(--paper-grey-600);
+  font-weight: 500;
   line-height: 32px;
+  margin: 0;
   min-width: 52px;
   padding: 0 16px;
 }
 
 #addUser {
-  -webkit-margin-end: 16px;
+  margin: 0 8px;
 }
 
 #logo {

diff --git a/chrome/browser/resources/md_user_manager/control_bar.html b/chrome/browser/resources/md_user_manager/control_bar.html
index 5d6c5df8..94591e35 100644
--- a/chrome/browser/resources/md_user_manager/control_bar.html
+++ b/chrome/browser/resources/md_user_manager/control_bar.html

@@ -1,8 +1,8 @@
 <link rel="import" href="chrome://md-user-manager/profile_browser_proxy.html">
 <link rel="import" href="chrome://md-user-manager/shared_styles.html">
+<link rel="import" href="chrome://resources/html/polymer.html">
 <link rel="import" href="chrome://resources/polymer/v1_0/iron-flex-layout/classes/iron-flex-layout.html">
 <link rel="import" href="chrome://resources/polymer/v1_0/paper-button/paper-button.html">
-<link rel="import" href="chrome://resources/polymer/v1_0/polymer/polymer.html">
 
 <dom-module id="control-bar">
   <!-- TODO(mahmadi): this format is deprecated. Change to the new
@@ -10,15 +10,12 @@
   <link rel="import" type="css" href="chrome://md-user-manager/control_bar.css">
   <template>
     <style include="shared-styles"></style>
-    <div id="login-header-bar"
-        class="login-header-bar layout horizontal end-justified">
+    <div id="container" class="layout horizontal end-justified">
       <div id="logo"></div>
       <paper-button id="launchGuest" on-tap="onLaunchGuestTap_"
           i18n-content="browseAsGuest" hidden="[[!showGuest]]"></paper-button>
-      <div id="add-user-header-bar-item">
-        <paper-button id="addUser" on-tap="onAddUserTap_"
-            i18n-content="addUser" hidden="[[!showAddPerson]]"></paper-button>
-      </div>
+      <paper-button id="addUser" on-tap="onAddUserTap_"
+          i18n-content="addUser" hidden="[[!showAddPerson]]"></paper-button>
     </div>
   </template>
   <script src="chrome://md-user-manager/control_bar.js"></script>

diff --git a/chrome/browser/resources/md_user_manager/create_profile.css b/chrome/browser/resources/md_user_manager/create_profile.css
index e64c020..f0e12a7 100644
--- a/chrome/browser/resources/md_user_manager/create_profile.css
+++ b/chrome/browser/resources/md_user_manager/create_profile.css

@@ -4,18 +4,47 @@
 
 .container {
   color: var(--paper-grey-800);
-  margin: 64px auto;
-  width: 556px;
+  margin: 0 auto;
+  width: 624px;
+}
+
+#message-container {
+  background-color: var(--google-red-700);
+  color: white;
+  left: 0;
+  overflow: hidden;
+  padding: 10px 16px;
+  position: absolute;
+  right: 0;
+  top: 0;
+}
+
+#message-container iron-icon {
+  height: 20px;
+  width: 20px;
+}
+
+#message-container #message {
+  -webkit-margin-start: 16px;
+}
+
+#message-container #supervised-user-import-existing {
+  color: inherit;
+  text-decoration: underline;
 }
 
 #title-bar {
   border-bottom: 1px solid rgba(0, 0, 0, .12);
   font-size: 16px;
-  padding-bottom: 20px;
+  font-weight: 500;
+  padding: 104px 0 16px;
 }
 
 #nameInput,
 paper-dropdown-menu {
+  --paper-input-container: {
+    padding: 0;
+  };
   --paper-input-container-input: {
     color: inherit;
     font-size: inherit;
@@ -23,27 +52,41 @@
 }
 
 #nameInput {
+  margin-bottom: 24px;
+  margin-top: 32px;
   width: 300px;
 }
 
 paper-dropdown-menu {
-  position: relative;
-  top: -1px;
+  margin-top: 12px;
   width: 200px;
 }
 
-#icons {
-  margin-top: 24px;
+paper-menu {
+  --paper-menu: {
+    color: inherit;
+    padding: 0;
+  };
+  --paper-menu-selected-item: {
+    font-weight: normal;
+  }
+}
+
+paper-menu paper-item {
+  font-size: inherit;
+  min-height: 40px;
 }
 
 #icons #wrapper {
-  margin: -12px -10px;
+  display: flex;
+  flex-wrap: wrap;
+  margin: -12px;
 }
 
 #icons paper-button {
-  background: rgb(222, 222, 222);
+  background: var(--paper-grey-300);
   border: 1px solid rgba(0, 0, 0, .12);
-  margin: 12px 10px;
+  margin: 12px;
   min-width: 0;
   padding: 6px 4px;
 }
@@ -56,51 +99,61 @@
   outline: 1px dotted #666;
 }
 
-#createSupervisedContainer {
-  margin-top: 10px;
+#supervised-user-container {
+  margin-top: 24px;
 }
 
-#messageBubble {
-  -webkit-transition: max-height 200ms, padding 200ms;
-  background-color: var(--google-red-700);
-  border-radius: 4px;
-  color: white;
-  font-weight: bold;
-  margin-left: auto;
-  margin-right: auto;
-  margin-top: 16px;
-  max-height: 50px;
-  overflow: hidden;
-  padding: 10px 10px;
-  text-align: center;
-  width: 80%;
+#supervised-user-container paper-checkbox {
+  --paper-checkbox-label-spacing: 16px;
+  --paper-checkbox-size: 20px;
 }
 
-#messageBubble:empty {
-  display: none;
+#supervised-user-container #learn-more-accounts {
+  -webkit-margin-start: 36px;
+}
+
+#supervised-user-container #learn-more {
+  display: block;
+  line-height: 20px;
 }
 
 #actions {
-  margin-top: 32px;
+  bottom: 16px;
+  display: flex;
+  position: absolute;
+  right: 16px;
+}
+
+:host-context([dir='rtl']) #actions {
+  left: 16px;
+  right: auto;
 }
 
 #actions paper-button {
   border-radius: 2px;
+  font-weight: 500;
   line-height: 32px;
+  margin: 0;
   min-width: 52px;
   padding: 0 16px;
 }
 
-#cancel {
+#actions paper-spinner {
+  align-self: center;
+  height: 20px;
+  width: 20px;
+}
+
+#actions #cancel {
   color: var(--paper-grey-600);
 }
 
-#save {
-  -webkit-margin-end: 0;
+#actions #save {
+  -webkit-margin-start: 8px;
   background: var(--google-blue-500);
   color: white;
 }
 
-#save[disabled] {
+#actions #save[disabled] {
   background: rgba(66, 133, 244, .5);
 }

diff --git a/chrome/browser/resources/md_user_manager/create_profile.html b/chrome/browser/resources/md_user_manager/create_profile.html
index dc87987..d253950 100644
--- a/chrome/browser/resources/md_user_manager/create_profile.html
+++ b/chrome/browser/resources/md_user_manager/create_profile.html

@@ -3,8 +3,10 @@
 <link rel="import" href="chrome://resources/html/action_link.html">
 <link rel="import" href="chrome://resources/html/cr.html">
 <link rel="import" href="chrome://resources/html/i18n_behavior.html">
+<link rel="import" href="chrome://resources/html/polymer.html">
+<link rel="import" href="chrome://resources/html/util.html">
 <link rel="import" href="chrome://resources/html/web_ui_listener_behavior.html">
-<link rel="import" href="chrome://resources/polymer/v1_0/iron-flex-layout/classes/iron-flex-layout.html">
+<link rel="import" href="chrome://resources/polymer/v1_0/iron-icon/iron-icon.html">
 <link rel="import" href="chrome://resources/polymer/v1_0/paper-button/paper-button.html">
 <link rel="import" href="chrome://resources/polymer/v1_0/paper-checkbox/paper-checkbox.html">
 <link rel="import" href="chrome://resources/polymer/v1_0/paper-dropdown-menu/paper-dropdown-menu.html">
@@ -12,7 +14,6 @@
 <link rel="import" href="chrome://resources/polymer/v1_0/paper-item/paper-item.html">
 <link rel="import" href="chrome://resources/polymer/v1_0/paper-menu/paper-menu.html">
 <link rel="import" href="chrome://resources/polymer/v1_0/paper-spinner/paper-spinner.html">
-<link rel="import" href="chrome://resources/polymer/v1_0/polymer/polymer.html">
 
 <dom-module id="create-profile">
   <link rel="import" type="css"
@@ -20,51 +21,60 @@
   <link rel="import" type="css" href="chrome://resources/css/action_link.css">
   <template>
     <style include="shared-styles"></style>
+    <div id="message-container" hidden="[[!message_]]">
+      <iron-icon icon="warning"></iron-icon>
+      <span id="message" inner-h-t-m-l="[[message_]]"></span>
+    </div>
     <div class="container">
       <div id="title-bar" i18n-content="createProfileTitle"></div>
       <paper-input id="nameInput" value="{{profileName_}}" pattern=".*\S.*"
-          auto-validate>
+          no-label-float auto-validate>
       </paper-input>
       <div id="icons">
         <div id="wrapper">
         <template is="dom-repeat" items="[[availableIconUrls_]]">
           <paper-button toggles on-tap="onIconTap_" data-icon-url$="[[item]]"
-              active="{{isActiveIcon_(item, profileIconUrl_)}}">
+              active="[[isActiveIcon_(item, profileIconUrl_)]]">
             <img src="[[item]]">
           </paper-button>
         </template>
         </div>
       </div>
-      <div id="createSupervisedContainer">
-        <template is="dom-if" if="[[signedIn_]]">
-          <paper-checkbox checked="{{isSupervised_}}"
-              disabled="{{supervisedUserCheckboxDisabled_}}">
-            <span>[[i18n('manageProfilesSupervisedSignedInLabel')]]</span>
+      <template is="dom-if" if="[[isSignedIn_(signedInUsers_)]]">
+        <div id="supervised-user-container">
+          <paper-checkbox checked="{{isSupervised_}}">
+            [[i18n('manageProfilesSupervisedSignedInLabel')]]
           </paper-checkbox>
-          <paper-dropdown-menu no-label-float>
-            <paper-menu selected="{{selectedEmail_}}" class="dropdown-content">
-              <template is="dom-repeat" items="[[signedInUsers_]]">
-                <paper-item>[[item.username]]</paper-item>
-              </template>
-            </paper-menu>
-          </paper-dropdown-menu>
-          <a id="learnMore" is="action-link" on-tap="onLearnMoreTap_">
-            [[i18n('learnMore')]]
-          </a>
-        </template>
-        <span id="noSignedInUserContainer"
-            i18n-values=".innerHTML:manageProfilesSupervisedNotSignedIn"
-            hidden="{{signedIn_}}">
-        </span>
-        <div id="messageBubble" inner-h-t-m-l="{{message_}}"></div>
-      </div>
-      <div id="actions" class="layout horizontal end-justified">
+          <div id="learn-more-accounts">
+            <a id="learn-more" is="action-link" on-tap="onLearnMoreTap_">
+              [[i18n('learnMore')]]
+            </a>
+            <template is="dom-if" if="[[isSupervised_]]">
+              <paper-dropdown-menu no-label-float>
+                <paper-menu class="dropdown-content"
+                    selected="{{signedInUserIndex_}}"
+                    attr-for-selected="data-user-index">
+                  <paper-item data-user-index$="[[NO_USER_SELECTED]]">
+                    [[i18n('selectAnAccount')]]
+                  </paper-item>
+                  <template is="dom-repeat" items="[[signedInUsers_]]">
+                    <paper-item data-user-index$="[[index]]">
+                      [[item.username]]
+                    </paper-item>
+                  </template>
+                </paper-menu>
+              </paper-dropdown-menu>
+            </template>
+          </div>
+        </div>
+      </template>
+      <div id="actions">
         <paper-spinner active="[[createInProgress_]]"></paper-spinner>
         <paper-button id="cancel" on-tap="onCancelTap_" i18n-content="cancel">
         </paper-button>
         <paper-button id="save" on-tap="onSaveTap_"
             i18n-content="createProfileConfirm"
-            disabled="{{isOkDisabled_(createInProgress_, profileName_, message_)}}">
+            disabled="[[isSaveDisabled_(createInProgress_, profileName_)]]">
         </paper-button>
       </div>
     </div>

diff --git a/chrome/browser/resources/md_user_manager/create_profile.js b/chrome/browser/resources/md_user_manager/create_profile.js
index 7a34902..e7d0113 100644
--- a/chrome/browser/resources/md_user_manager/create_profile.js
+++ b/chrome/browser/resources/md_user_manager/create_profile.js

@@ -6,6 +6,13 @@
  * @fileoverview 'create-profile' is a page that contains controls for creating
  * a (optionally supervised) profile, including choosing a name, and an avatar.
  */
+(function() {
+/**
+ * It means the sentinel menu item is selected.
+ * @const {number}
+ */
+var NO_USER_SELECTED = -1;
+
 Polymer({
   is: 'create-profile',
 
@@ -16,22 +23,12 @@
 
   properties: {
     /**
-     * True if supervised user checkbox is disabled.
-     * @private {boolean}
-     */
-    supervisedUserCheckboxDisabled_: {
-      type: Boolean,
-      computed:
-          'isSupervisedUserCheckboxDisabled_(createInProgress_, signedIn_)'
-    },
-
-    /**
      * The current profile name.
      * @private {string}
      */
     profileName_: {
       type: String,
-      value: '',
+      value: ''
     },
 
     /**
@@ -81,7 +78,7 @@
 
     /**
      * The list of usernames and profile paths for currently signed-in users.
-     * @private {!Array<SignedInUser>}
+     * @private {!Array<!SignedInUser>}
      */
     signedInUsers_: {
       type: Array,
@@ -92,9 +89,9 @@
      * Index of the selected signed-in user.
      * @private {number}
      */
-    selectedEmail_: {
+    signedInUserIndex_: {
       type: Number,
-      value: 0
+      value: NO_USER_SELECTED
     },
 
     /** @private {!signin.ProfileBrowserProxy} */
@@ -107,9 +104,7 @@
   },
 
   /** @override */
-  attached: function() {
-    this.resetForm_();
-
+  ready: function() {
     this.addWebUIListener(
       'create-profile-success', this.handleSuccess_.bind(this));
     this.addWebUIListener(
@@ -119,25 +114,15 @@
     this.addWebUIListener(
       'profile-icons-received', this.handleProfileIcons_.bind(this));
     this.addWebUIListener(
+      'profile-defaults-received', this.handleProfileDefaults_.bind(this));
+    this.addWebUIListener(
       'signedin-users-received', this.handleSignedInUsers_.bind(this));
 
     this.browserProxy_.getAvailableIcons();
     this.browserProxy_.getSignedInUsers();
-  },
 
-  /**
-   * Resets the state of the page.
-   * @private
-   */
-  resetForm_: function() {
-    this.profileName_ = '';
-    this.availableIconUrls_ = [];
-    this.profileIconUrl_ = '';
-    this.createInProgress_ = false;
-    this.message_ = '';
-    this.isSupervised_ = false;
-    this.signedInUsers_ = [];
-    this.selectedEmail_ = 0;
+    // Alias on 'this' to use in html.
+    this.NO_USER_SELECTED = NO_USER_SELECTED;
   },
 
   /**
@@ -151,17 +136,34 @@
   },
 
   /**
-   * Updates the signed-in users.
-   * @param {!Array<SignedInUser>} signedInUsers
+   * Handler for when the profile defaults are pushed from the browser.
+   * @param {ProfileInfo} profileInfo Default Info for the new profile.
+   * @private
+   */
+  handleProfileDefaults_: function(profileInfo) {
+    this.profileName_ = profileInfo.name;
+  },
+
+  /**
+   * Handler for when signed-in users are pushed from the browser.
+   * @param {!Array<!SignedInUser>} signedInUsers
    * @private
    */
   handleSignedInUsers_: function(signedInUsers) {
     this.signedInUsers_ = signedInUsers;
-    this.signedIn_ = signedInUsers.length > 0;
   },
 
   /**
-   * Handler for the 'Learn More' button click event.
+   * Returns the currently selected signed-in user.
+   * @return {(!SignedInUser|undefined)}
+   * @private
+   */
+  signedInUser_: function(signedInUserIndex) {
+    return this.signedInUsers_[signedInUserIndex];
+  },
+
+  /**
+   * Handler for the 'Learn More' link tap event.
    * @param {!Event} event
    * @private
    */
@@ -170,19 +172,89 @@
   },
 
   /**
-   * Handler for the 'Ok' button click event.
+   * Handler for the 'Save' button tap event.
    * @param {!Event} event
    * @private
    */
   onSaveTap_: function(event) {
     this.createInProgress_ = true;
-    this.browserProxy_.createProfile(
-        this.profileName_, this.profileIconUrl_, this.isSupervised_,
-        this.signedInUsers_[this.selectedEmail_].profilePath);
+
+    if (!this.isSupervised_) {
+      // The new profile is not supervised. Go ahead and create it.
+      this.createProfile_();
+    } else if (this.signedInUserIndex_ == NO_USER_SELECTED) {
+      // If the new profile is supervised, a custodian must be selected.
+      this.handleMessage_(this.i18n('custodianAccountNotSelectedError'));
+      this.createInProgress_ = false;
+    } else {
+      var signedInUser = this.signedInUser_(this.signedInUserIndex_);
+      this.browserProxy_.getExistingSupervisedUsers(
+          signedInUser.profilePath).then(
+            this.createProfileIfValidSupervisedUser_.bind(this),
+            /** @param {*} error */
+            function(error) { this.handleMessage_(error); }.bind(this));
+    }
   },
 
   /**
-   * Handler for the 'Cancel' button click event.
+   * Checks if the entered name matches name of an existing supervised user.
+   * If yes, the user is prompted to import the existing supervised user.
+   * If no, the new supervised profile gets created.
+   * @param {Array<SupervisedUser>} supervisedUsers The list of existing
+   *     supervised users.
+   * @private
+   */
+  createProfileIfValidSupervisedUser_: function(supervisedUsers) {
+    for (var i = 0; i < supervisedUsers.length; ++i) {
+      if (supervisedUsers[i].name != this.profileName_)
+        continue;
+      // Check if another supervised user also exists with that name.
+      var nameIsUnique = true;
+      // Handling the case when multiple supervised users with the same
+      // name exist, but not all of them are on the device.
+      // If at least one is not imported, we want to offer that
+      // option to the user. This could happen due to a bug that allowed
+      // creating SUs with the same name (https://crbug.com/557445).
+      var allOnCurrentDevice = supervisedUsers[i].onCurrentDevice;
+      for (var j = i + 1; j < supervisedUsers.length; ++j) {
+        if (supervisedUsers[j].name == this.profileName_) {
+          nameIsUnique = false;
+          allOnCurrentDevice = allOnCurrentDevice &&
+             supervisedUsers[j].onCurrentDevice;
+        }
+      }
+
+      this.handleMessage_(allOnCurrentDevice ?
+          this.i18n('managedProfilesExistingLocalSupervisedUser') :
+          this.i18n('manageProfilesExistingSupervisedUser',
+               HTMLEscape(elide(this.profileName_, /* maxLength */ 50))));
+
+      this.createInProgress_ = false;
+      return;
+    }
+    // No existing supervised user's name matches the entered profile name.
+    // Continue with creating the new supervised profile.
+    this.createProfile_();
+  },
+
+  /**
+   * Creates the new profile.
+   * @private
+   */
+  createProfile_: function() {
+    var custodianProfilePath = '';
+    if (this.signedInUserIndex_ != NO_USER_SELECTED) {
+      custodianProfilePath =
+          this.signedInUser_(this.signedInUserIndex_).profilePath;
+    }
+
+    this.browserProxy_.createProfile(
+        this.profileName_, this.profileIconUrl_, this.isSupervised_,
+        custodianProfilePath);
+  },
+
+  /**
+   * Handler for the 'Cancel' button tap event.
    * @param {!Event} event
    * @private
    */
@@ -231,6 +303,12 @@
   handleMessage_: function(message) {
     this.createInProgress_ = false;
     this.message_ = message;
+
+    // TODO(mahmadi): attach handler to '#supervised-user-import-existing'
+    // in order to import supervised user with the given name.
+
+    // TODO(mahmadi): attach handler to '#reauth' in order to re-authenticate
+    // custodian.
   },
 
   /**
@@ -245,30 +323,28 @@
   },
 
   /**
-   * Computed binding determining whether 'Ok' button is disabled.
+   * Computed binding determining whether 'Save' button is disabled.
    * @param {boolean} createInProgress Is create in progress?
    * @param {string} profileName Profile Name.
-   * @param {string} message Existing warning/error message.
    * @return {boolean}
    * @private
    */
-  isOkDisabled_: function(createInProgress, profileName, message) {
+  isSaveDisabled_: function(createInProgress, profileName) {
     // TODO(mahmadi): Figure out a way to add 'paper-input-extracted' as a
     // dependency and cast to PaperInputElement instead.
     /** @type {{validate: function():boolean}} */
     var nameInput = this.$.nameInput;
-    return createInProgress || !profileName || message != '' ||
-        !nameInput.validate();
+    return createInProgress || !profileName || !nameInput.validate();
   },
 
   /**
-   * Computed binding determining whether supervised user checkbox is disabled.
-   * @param {boolean} createInProgress Is create in progress?
-   * @param {boolean} signedIn Are there any signed-in users?
+   * Computed binding that returns True if there are any signed-in users.
+   * @param {!Array<!SignedInUser>} signedInUsers signed-in users.
    * @return {boolean}
    * @private
    */
-  isSupervisedUserCheckboxDisabled_: function(createInProgress, signedIn) {
-    return createInProgress || !signedIn;
+  isSignedIn_: function(signedInUsers) {
+    return signedInUsers.length > 0;
   }
 });
+}());

diff --git a/chrome/browser/resources/md_user_manager/profile_browser_proxy.js b/chrome/browser/resources/md_user_manager/profile_browser_proxy.js
index 165b92f..b65f737 100644
--- a/chrome/browser/resources/md_user_manager/profile_browser_proxy.js
+++ b/chrome/browser/resources/md_user_manager/profile_browser_proxy.js

@@ -13,6 +13,13 @@
 /** @typedef {{name: string, filePath: string, isSupervised: boolean}} */
 var ProfileInfo;
 
+/** @typedef {{id: string,
+ *             name: string,
+ *             iconURL: string,
+ *             onCurrentDevice: boolean}}
+ */
+var SupervisedUser;
+
 cr.define('signin', function() {
   /** @interface */
   function ProfileBrowserProxy() {}
@@ -40,16 +47,26 @@
     },
 
     /**
+     * Gets the list of existing supervised users.
+     * @param {string} profilePath Profile Path of the custodian.
+     * @return {Promise} A promise for the requested data.
+     * @private
+     */
+    getExistingSupervisedUsers: function(profilePath) {
+      assertNotReached();
+    },
+
+    /**
      * Creates a profile.
      * @param {string} profileName Name of the new profile.
      * @param {string} profileIconUrl URL of the selected icon of the new
      *     profile.
      * @param {boolean} isSupervised True if the new profile is supervised.
-     * @param {string|undefined} supervisorProfilePath Profile path of the
-     *     supervisor if the new profile is supervised.
+     * @param {string} custodianProfilePath Profile path of the custodian if
+     *     the new profile is supervised.
      */
     createProfile: function(profileName, profileIconUrl, isSupervised,
-        supervisorProfilePath) {
+        custodianProfilePath) {
       assertNotReached();
     },
 
@@ -104,11 +121,16 @@
     },
 
     /** @override */
+    getExistingSupervisedUsers: function(profilePath) {
+      return cr.sendWithPromise('getExistingSupervisedUsers', profilePath);
+    },
+
+    /** @override */
     createProfile: function(profileName, profileIconUrl, isSupervised,
-        supervisorProfilePath) {
+        custodianProfilePath) {
       chrome.send('createProfile',
                   [profileName, profileIconUrl, false, isSupervised, '',
-                   supervisorProfilePath]);
+                   custodianProfilePath]);
     },
 
     /** @override */

diff --git a/chrome/browser/resources/md_user_manager/supervised_user_learn_more.html b/chrome/browser/resources/md_user_manager/supervised_user_learn_more.html
index 293fe54..e2abb46 100644
--- a/chrome/browser/resources/md_user_manager/supervised_user_learn_more.html
+++ b/chrome/browser/resources/md_user_manager/supervised_user_learn_more.html

@@ -1,8 +1,8 @@
 <link rel="import" href="chrome://md-user-manager/shared_styles.html">
+<link rel="import" href="chrome://resources/html/polymer.html">
 <link rel="import" href="chrome://resources/polymer/v1_0/iron-flex-layout/iron-flex-layout.html">
 <link rel="import" href="chrome://resources/polymer/v1_0/iron-icon/iron-icon.html">
 <link rel="import" href="chrome://resources/polymer/v1_0/paper-button/paper-button.html">
-<link rel="import" href="chrome://resources/polymer/v1_0/polymer/polymer.html">
 
 <dom-module id="supervised-user-learn-more">
   <link rel="import" type="css"

diff --git a/chrome/browser/resources/md_user_manager/user_manager.html b/chrome/browser/resources/md_user_manager/user_manager.html
index 47925ebe8..6dd9fdc 100644
--- a/chrome/browser/resources/md_user_manager/user_manager.html
+++ b/chrome/browser/resources/md_user_manager/user_manager.html

@@ -37,7 +37,7 @@
       </div>
     </div>
     <div id="bubble" class="bubble faded" hidden></div>
-    <control-bar></control-bar>
+    <control-bar id="login-header-bar"></control-bar>
     <include src="../../../../ui/login/account_picker/user_pod_template.html">
   </user-manager-pages>
   <link rel="import" href="chrome://md-user-manager/strings.html">

diff --git a/chrome/browser/resources/md_user_manager/user_manager_pages.html b/chrome/browser/resources/md_user_manager/user_manager_pages.html
index 7c2f412..5ce6be9 100644
--- a/chrome/browser/resources/md_user_manager/user_manager_pages.html
+++ b/chrome/browser/resources/md_user_manager/user_manager_pages.html

@@ -1,9 +1,9 @@
 <link rel="import" href="chrome://md-user-manager/create_profile.html">
 <link rel="import" href="chrome://md-user-manager/supervised_user_learn_more.html">
+<link rel="import" href="chrome://resources/html/polymer.html">
 <link rel="import" href="chrome://resources/polymer/v1_0/neon-animation/animations/slide-from-left-animation.html">
 <link rel="import" href="chrome://resources/polymer/v1_0/neon-animation/animations/slide-right-animation.html">
 <link rel="import" href="chrome://resources/polymer/v1_0/neon-animation/neon-animated-pages.html">
-<link rel="import" href="chrome://resources/polymer/v1_0/polymer/polymer.html">
 
 <dom-module id="user-manager-pages">
   <link rel="import" type="css"

diff --git a/chrome/browser/resources/md_user_manager/user_manager_styles.html b/chrome/browser/resources/md_user_manager/user_manager_styles.html
index 31a33c8..7b0785b 100644
--- a/chrome/browser/resources/md_user_manager/user_manager_styles.html
+++ b/chrome/browser/resources/md_user_manager/user_manager_styles.html

@@ -8,6 +8,12 @@
       }
 
       /* Overrides for the desktop user manager screen. */
+      #login-header-bar {
+        bottom: 0;
+        left: 0;
+        position: absolute;
+        right: 0;
+      }
 
       #outer-container {
         min-height: 0;

diff --git a/chrome/browser/resources/md_user_manager/user_manager_tutorial.html b/chrome/browser/resources/md_user_manager/user_manager_tutorial.html
index 5067cbf0..25c81bc8 100644
--- a/chrome/browser/resources/md_user_manager/user_manager_tutorial.html
+++ b/chrome/browser/resources/md_user_manager/user_manager_tutorial.html

@@ -1,8 +1,8 @@
 <link rel="import" href="chrome://md-user-manager/shared_styles.html">
 <link rel="import" href="chrome://resources/html/i18n_behavior.html">
+<link rel="import" href="chrome://resources/html/polymer.html">
 <link rel="import" href="chrome://resources/polymer/v1_0/iron-icon/iron-icon.html">
 <link rel="import" href="chrome://resources/polymer/v1_0/paper-button/paper-button.html">
-<link rel="import" href="chrome://resources/polymer/v1_0/polymer/polymer.html">
 
 <dom-module id="user-manager-tutorial">
   <link rel="import" type="css"

diff --git a/chrome/browser/resources/popular_sites_internals.html b/chrome/browser/resources/popular_sites_internals.html
index 65ee20a..97b3a31 100644
--- a/chrome/browser/resources/popular_sites_internals.html
+++ b/chrome/browser/resources/popular_sites_internals.html

@@ -48,14 +48,28 @@
     </table>
   </div>
 
-  <div id="sites" class="section">
+  <div class="section">
+    <h2>Info</h2>
+    <table class="section-details">
+      <tr>
+        <td class="detail">Country</td>
+        <td class="value" jscontent="country"></td>
+      </tr>
+      <tr>
+        <td class="detail">Version</td>
+        <td class="value" jscontent="version"></td>
+      </tr>
+    </table>
+  </div>
+
+  <div class="section">
     <h2>Sites</h2>
     <table class="section-details">
       <tr jsselect="sites">
         <td class="detail" jscontent="title"></td>
         <td class="value" jscontent="url"></td>
       </tr>
-      <tr jsskip = true>
+      <tr jsskip="true">
         <td class="detail">
           <input id="view-json" type="submit" value="View JSON">
         </td>

diff --git a/chrome/browser/resources/popular_sites_internals.js b/chrome/browser/resources/popular_sites_internals.js
index ce1294d6..96f470d 100644
--- a/chrome/browser/resources/popular_sites_internals.js
+++ b/chrome/browser/resources/popular_sites_internals.js

@@ -32,7 +32,7 @@
   }
 
   function receiveSites(sites) {
-    jstProcess(new JsEvalContext(sites), $('sites'));
+    jstProcess(new JsEvalContext(sites), $('info'));
     // Also clear the json string, since it's likely stale now.
     $('json-value').textContent = '';
   }

diff --git a/chrome/browser/resources/settings/certificate_manager_page/certificate_list.html b/chrome/browser/resources/settings/certificate_manager_page/certificate_list.html
index 10a3d00c..4ebf1e3a 100644
--- a/chrome/browser/resources/settings/certificate_manager_page/certificate_list.html
+++ b/chrome/browser/resources/settings/certificate_manager_page/certificate_list.html

@@ -14,7 +14,8 @@
       }
     </style>
     <div class="settings-box first">
-      <span class="start">[[getDescription_(certificateType)]]</span>
+      <span class="start">
+          [[getDescription_(certificateType, certificates)]]</span>
       <paper-button on-tap="onImportTap_"
           hidden="[[!canImport_(certificateType)]]">
         $i18n{certificateManagerImport}</paper-button>
@@ -24,10 +25,6 @@
           certificate-type="[[certificateType]]">
       </settings-certificate-entry>
     </template>
-    <template is="dom-if" if="[[!certificates.length]]">
-      <!-- TODO(dpapad): Localize string -->
-      You have no certificates
-    </template>
   </template>
   <script src="certificate_list.js"></script>
 </dom-module>

diff --git a/chrome/browser/resources/settings/certificate_manager_page/certificate_list.js b/chrome/browser/resources/settings/certificate_manager_page/certificate_list.js
index 59d1699..0388ee8 100644
--- a/chrome/browser/resources/settings/certificate_manager_page/certificate_list.js
+++ b/chrome/browser/resources/settings/certificate_manager_page/certificate_list.js

@@ -27,6 +27,9 @@
    * @private
    */
   getDescription_: function() {
+    if (this.certificates.length == 0)
+      return this.i18n('certificateManagerNoCertificates');
+
     switch (this.certificateType) {
       case settings.CertificateType.PERSONAL:
         return this.i18n('certificateManagerYourCertificatesDescription');

diff --git a/chrome/browser/safe_browsing/sandboxed_dmg_analyzer_mac.cc b/chrome/browser/safe_browsing/sandboxed_dmg_analyzer_mac.cc
index d4ed097..cfc709f 100644
--- a/chrome/browser/safe_browsing/sandboxed_dmg_analyzer_mac.cc
+++ b/chrome/browser/safe_browsing/sandboxed_dmg_analyzer_mac.cc

@@ -91,18 +91,9 @@
 
 void SandboxedDMGAnalyzer::OnUtilityProcessStarted() {
   DCHECK_CURRENTLY_ON(BrowserThread::IO);
-
-  base::ProcessHandle utility_process =
-      content::RenderProcessHost::run_renderer_in_process() ?
-          base::GetCurrentProcessHandle() :
-          utility_process_host_->GetData().handle;
-  if (utility_process == base::kNullProcessHandle) {
-    DLOG(ERROR) << "Child process handle is null";
-  }
-
   utility_process_host_->Send(
       new ChromeUtilityMsg_AnalyzeDmgFileForDownloadProtection(
-          IPC::TakeFileHandleForProcess(std::move(file_), utility_process)));
+          IPC::TakePlatformFileForTransit(std::move(file_))));
 }
 
 void SandboxedDMGAnalyzer::OnAnalysisFinished(

diff --git a/chrome/browser/safe_browsing/sandboxed_zip_analyzer.cc b/chrome/browser/safe_browsing/sandboxed_zip_analyzer.cc
index 1779e4ee..4c4b4b60 100644
--- a/chrome/browser/safe_browsing/sandboxed_zip_analyzer.cc
+++ b/chrome/browser/safe_browsing/sandboxed_zip_analyzer.cc

@@ -137,17 +137,9 @@
 
 void SandboxedZipAnalyzer::OnUtilityProcessStarted() {
   DCHECK_CURRENTLY_ON(BrowserThread::IO);
-  base::ProcessHandle utility_process =
-      content::RenderProcessHost::run_renderer_in_process() ?
-          base::GetCurrentProcessHandle() :
-          utility_process_host_->GetData().handle;
-
-  if (utility_process == base::kNullProcessHandle) {
-    DLOG(ERROR) << "Child process handle is null";
-  }
   utility_process_host_->Send(
       new ChromeUtilityMsg_AnalyzeZipFileForDownloadProtection(
-          IPC::TakeFileHandleForProcess(std::move(zip_file_), utility_process),
+          IPC::TakePlatformFileForTransit(std::move(zip_file_)),
           IPC::GetPlatformFileForTransit(temp_file_.GetPlatformFile(),
                                          false /* !close_source_handle */)));
 }

diff --git a/chrome/browser/supervised_user/supervised_user_service.cc b/chrome/browser/supervised_user/supervised_user_service.cc
index 519484c..66662cb 100644
--- a/chrome/browser/supervised_user/supervised_user_service.cc
+++ b/chrome/browser/supervised_user/supervised_user_service.cc

@@ -18,7 +18,6 @@
 #include "build/build_config.h"
 #include "chrome/browser/browser_process.h"
 #include "chrome/browser/component_updater/supervised_user_whitelist_installer.h"
-#include "chrome/browser/net/file_downloader.h"
 #include "chrome/browser/profiles/profile.h"
 #include "chrome/browser/profiles/profile_attributes_entry.h"
 #include "chrome/browser/profiles/profile_attributes_storage.h"
@@ -853,10 +852,11 @@
                  base::Unretained(this)));
 }
 
-void SupervisedUserService::OnBlacklistDownloadDone(const base::FilePath& path,
-                                                    bool success) {
+void SupervisedUserService::OnBlacklistDownloadDone(
+    const base::FilePath& path,
+    FileDownloader::Result result) {
   DCHECK(blacklist_state_ == BlacklistLoadState::LOAD_STARTED);
-  if (success) {
+  if (FileDownloader::IsSuccess(result)) {
     LoadBlacklistFromFile(path);
   } else {
     LOG(WARNING) << "Blacklist download failed";

diff --git a/chrome/browser/supervised_user/supervised_user_service.h b/chrome/browser/supervised_user/supervised_user_service.h
index 353d586..e9310a1 100644
--- a/chrome/browser/supervised_user/supervised_user_service.h
+++ b/chrome/browser/supervised_user/supervised_user_service.h

@@ -20,6 +20,7 @@
 #include "base/scoped_observer.h"
 #include "base/strings/string16.h"
 #include "build/build_config.h"
+#include "chrome/browser/net/file_downloader.h"
 #include "chrome/browser/supervised_user/experimental/safe_search_url_reporter.h"
 #include "chrome/browser/supervised_user/experimental/supervised_user_blacklist.h"
 #include "chrome/browser/supervised_user/supervised_user_url_filter.h"
@@ -36,7 +37,6 @@
 #endif
 
 class Browser;
-class FileDownloader;
 class GoogleServiceAuthError;
 class PermissionRequestCreator;
 class Profile;
@@ -336,7 +336,8 @@
   // it to the URL filters.
   void LoadBlacklistFromFile(const base::FilePath& path);
 
-  void OnBlacklistDownloadDone(const base::FilePath& path, bool success);
+  void OnBlacklistDownloadDone(const base::FilePath& path,
+                               FileDownloader::Result result);
 
   void OnBlacklistLoaded();
 

diff --git a/chrome/browser/ui/cocoa/browser_window_cocoa.mm b/chrome/browser/ui/cocoa/browser_window_cocoa.mm
index 7e7957c1..cc1a8160 100644
--- a/chrome/browser/ui/cocoa/browser_window_cocoa.mm
+++ b/chrome/browser/ui/cocoa/browser_window_cocoa.mm

@@ -688,6 +688,10 @@
 
 void BrowserWindowCocoa::UserChangedTheme() {
   [controller_ userChangedTheme];
+  LocationBarViewMac* locationBar = [controller_ locationBarBridge];
+  if (locationBar) {
+    locationBar->OnThemeChanged();
+  }
 }
 
 void BrowserWindowCocoa::ShowWebsiteSettings(

diff --git a/chrome/browser/ui/cocoa/location_bar/autocomplete_text_field.h b/chrome/browser/ui/cocoa/location_bar/autocomplete_text_field.h
index b7a4d84b..1c09fd58 100644
--- a/chrome/browser/ui/cocoa/location_bar/autocomplete_text_field.h
+++ b/chrome/browser/ui/cocoa/location_bar/autocomplete_text_field.h

@@ -9,6 +9,7 @@
 
 #include "base/mac/scoped_nsobject.h"
 #import "chrome/browser/ui/cocoa/styled_text_field.h"
+#import "chrome/browser/ui/cocoa/themed_window.h"
 #import "chrome/browser/ui/cocoa/url_drop_target.h"
 
 @class AutocompleteTextFieldCell;
@@ -120,7 +121,8 @@
 };
 
 @interface AutocompleteTextField : StyledTextField<NSTextViewDelegate,
-                                                   URLDropTarget> {
+                                                   URLDropTarget,
+                                                   ThemedWindowDrawing> {
  @private
   // Undo manager for this text field.  We use a specific instance rather than
   // the standard undo manager in order to let us clear the undo stack at will.

diff --git a/chrome/browser/ui/cocoa/location_bar/autocomplete_text_field.mm b/chrome/browser/ui/cocoa/location_bar/autocomplete_text_field.mm
index 46e0d5d..36b9a024 100644
--- a/chrome/browser/ui/cocoa/location_bar/autocomplete_text_field.mm
+++ b/chrome/browser/ui/cocoa/location_bar/autocomplete_text_field.mm

@@ -12,6 +12,7 @@
 #import "chrome/browser/ui/cocoa/location_bar/autocomplete_text_field_cell.h"
 #import "chrome/browser/ui/cocoa/location_bar/autocomplete_text_field_editor.h"
 #import "chrome/browser/ui/cocoa/location_bar/location_bar_decoration.h"
+#include "chrome/browser/ui/cocoa/omnibox/omnibox_view_mac.h"
 #import "chrome/browser/ui/cocoa/toolbar/toolbar_controller.h"
 #import "chrome/browser/ui/cocoa/url_drop_target.h"
 #import "chrome/browser/ui/cocoa/view_id_util.h"
@@ -376,6 +377,20 @@
   [self setNeedsDisplay];
 }
 
+- (void)updateColorsToMatchTheme {
+  if (![[self window] inIncognitoMode]) {
+    return;
+  }
+
+  // Invert the textfield's colors when Material Design and Incognito and not
+  // a custom theme.
+  bool inDarkMode = [[self window] inIncognitoModeWithSystemTheme];
+  [self setBackgroundColor:
+      inDarkMode ? [NSColor colorWithCalibratedWhite:115 / 255. alpha:1]
+                 : [NSColor whiteColor]];
+  [self setTextColor:OmniboxViewMac::BaseTextColor(inDarkMode)];
+}
+
 - (void)viewDidMoveToWindow {
   if (![self window]) {
     return;
@@ -387,15 +402,8 @@
     BrowserWindowController* browserWindowController =
         [BrowserWindowController browserWindowControllerForView:self];
     [[browserWindowController toolbarController] locationBarWasAddedToWindow];
-  }
 
-  // Invert the textfield's colors when Material Design and Incognito and not
-  // a custom theme.
-  if (ui::MaterialDesignController::IsModeMaterial() &&
-      [[self window] inIncognitoModeWithSystemTheme]) {
-    [self setTextColor:[NSColor whiteColor]];
-    [self setBackgroundColor:
-        [NSColor colorWithCalibratedWhite:115 / 255. alpha:1]];
+    [self updateColorsToMatchTheme];
   }
 
   NSNotificationCenter* nc = [NSNotificationCenter defaultCenter];
@@ -528,6 +536,19 @@
   return VIEW_ID_OMNIBOX;
 }
 
+// ThemedWindowDrawing implementation.
+
+- (void)windowDidChangeTheme {
+  if (!ui::MaterialDesignController::IsModeMaterial()) {
+    return;
+  }
+
+  [self updateColorsToMatchTheme];
+}
+
+- (void)windowDidChangeActive {
+}
+
 @end
 
 namespace autocomplete_text_field {

diff --git a/chrome/browser/ui/cocoa/location_bar/autocomplete_text_field_editor.h b/chrome/browser/ui/cocoa/location_bar/autocomplete_text_field_editor.h
index ab2ecad..0fb99ed 100644
--- a/chrome/browser/ui/cocoa/location_bar/autocomplete_text_field_editor.h
+++ b/chrome/browser/ui/cocoa/location_bar/autocomplete_text_field_editor.h

@@ -5,6 +5,7 @@
 #import <Cocoa/Cocoa.h>
 
 #include "base/mac/scoped_nsobject.h"
+#import "chrome/browser/ui/cocoa/themed_window.h"
 #import "chrome/browser/ui/cocoa/url_drop_target.h"
 
 @class AutocompleteTextField;
@@ -18,7 +19,8 @@
 // pasteboard).
 
 // Field editor used for the autocomplete field.
-@interface AutocompleteTextFieldEditor : NSTextView<URLDropTarget> {
+@interface AutocompleteTextFieldEditor : NSTextView<URLDropTarget,
+                                                    ThemedWindowDrawing> {
   // Handles being a drag-and-drop target. We handle DnD directly instead
   // allowing the |AutocompletTextField| to handle it (by making an empty
   // |-updateDragTypeRegistration|), since the latter results in a weird

diff --git a/chrome/browser/ui/cocoa/location_bar/autocomplete_text_field_editor.mm b/chrome/browser/ui/cocoa/location_bar/autocomplete_text_field_editor.mm
index 122ad6a..8a7128f 100644
--- a/chrome/browser/ui/cocoa/location_bar/autocomplete_text_field_editor.mm
+++ b/chrome/browser/ui/cocoa/location_bar/autocomplete_text_field_editor.mm

@@ -78,29 +78,40 @@
   return self;
 }
 
+- (void)updateColorsToMatchTheme {
+  if (![[self window] inIncognitoMode]) {
+    return;
+  }
+
+  bool inDarkMode = [[self window] inIncognitoModeWithSystemTheme];
+  // Draw a light insertion point for MD Incognito.
+  NSColor* insertionPointColor =
+      inDarkMode ? [NSColor colorWithCalibratedWhite:1 alpha:0.75]
+                 : [NSColor blackColor];
+  [self setInsertionPointColor:insertionPointColor];
+
+  NSColor* textSelectionColor = [NSColor selectedTextBackgroundColor];
+  if (inDarkMode) {
+    // In MD Incognito the text is light gray against a dark background. When
+    // selected, the light gray text against the selection color is illegible.
+    // Rather than tweak or change the selection color, make the text black when
+    // selected.
+    [self setSelectedTextAttributes:@{
+      NSForegroundColorAttributeName : [NSColor blackColor],
+      NSBackgroundColorAttributeName : textSelectionColor
+    }];
+  } else {
+    [self setSelectedTextAttributes:@{
+      NSBackgroundColorAttributeName : textSelectionColor
+    }];
+  }
+}
+
 - (void)viewDidMoveToWindow {
   // Only care about landing in a window when in Material Design mode.
-  if (![self window] || !ui::MaterialDesignController::IsModeMaterial()) {
-    return;
+  if ([self window] && ui::MaterialDesignController::IsModeMaterial()) {
+    [self updateColorsToMatchTheme];
   }
-
-  // Only care about Incognito mode with a non-custom theme.
-  if (![[self window] inIncognitoModeWithSystemTheme]) {
-    return;
-  }
-
-  // Draw a light insertion point for MD Incognito.
-  [self setInsertionPointColor:
-      [NSColor colorWithCalibratedWhite:1 alpha:0.75]];
-  // In MD Incognito the text is light gray against a dark background. When
-  // selected, the light gray text against the selection color is illegible.
-  // Rather than tweak or change the selection color, make the text black when
-  // selected.
-  NSColor* textSelectionColor = [NSColor selectedTextBackgroundColor];
-  [self setSelectedTextAttributes:@{
-    NSForegroundColorAttributeName : [NSColor blackColor],
-    NSBackgroundColorAttributeName : textSelectionColor
-  }];
 }
 
 // If the entire field is selected, drag the same data as would be
@@ -592,4 +603,16 @@
     observer->OnDidDrawRect();
 }
 
+// ThemedWindowDrawing implementation.
+
+- (void)windowDidChangeTheme {
+  if (!ui::MaterialDesignController::IsModeMaterial()) {
+    return;
+  }
+  [self updateColorsToMatchTheme];
+}
+
+- (void)windowDidChangeActive {
+}
+
 @end

diff --git a/chrome/browser/ui/cocoa/location_bar/location_bar_view_mac.h b/chrome/browser/ui/cocoa/location_bar/location_bar_view_mac.h
index b0469bc..0e0bb47 100644
--- a/chrome/browser/ui/cocoa/location_bar/location_bar_view_mac.h
+++ b/chrome/browser/ui/cocoa/location_bar/location_bar_view_mac.h

@@ -162,11 +162,19 @@
   // Set the location bar's icon to the correct image for the current URL.
   void UpdateLocationIcon();
 
+  // Set the location bar's controls to visibly match the current theme.
+  void UpdateColorsToMatchTheme();
+
   // Notify the location bar that it was added to the browser window. Provides
   // an update point for interface objects that need to set their appearance
   // based on the window's theme.
   void OnAddedToWindow();
 
+  // Notify the location bar that the browser window theme has changed. Provides
+  // an update point for interface objects that need to set their appearance
+  // based on the window's theme.
+  void OnThemeChanged();
+
   // ChromeOmniboxEditController:
   void UpdateWithoutTabRestore() override;
   void OnChanged() override;

diff --git a/chrome/browser/ui/cocoa/location_bar/location_bar_view_mac.mm b/chrome/browser/ui/cocoa/location_bar/location_bar_view_mac.mm
index bc3aeeb..22d2818 100644
--- a/chrome/browser/ui/cocoa/location_bar/location_bar_view_mac.mm
+++ b/chrome/browser/ui/cocoa/location_bar/location_bar_view_mac.mm

@@ -585,18 +585,31 @@
   Layout();
 }
 
-void LocationBarViewMac::OnAddedToWindow() {
-  if (!ui::MaterialDesignController::IsModeMaterial()) {
+void LocationBarViewMac::UpdateColorsToMatchTheme() {
+  if (!ui::MaterialDesignController::IsModeMaterial() ||
+      ![[field_ window] inIncognitoMode]) {
     return;
   }
 
   // Update the location-bar icon.
   UpdateLocationIcon();
 
-  // Make sure we're displaying the correct star color for a dark location bar.
-  if ([[field_ window] inIncognitoModeWithSystemTheme]) {
-    star_decoration_->SetStarred(star_decoration_->starred(), true);
-  }
+  // Make sure we're displaying the correct star color for Incognito mode. If
+  // the window is in Incognito mode, switching between a theme and no theme
+  // can move the window in and out of dark mode.
+  bool inDarkMode = [[field_ window] inIncognitoModeWithSystemTheme];
+  star_decoration_->SetStarred(star_decoration_->starred(), inDarkMode);
+
+  // Update the appearance of the text in the Omnibox.
+  omnibox_view_->Update();
+}
+
+void LocationBarViewMac::OnAddedToWindow() {
+  UpdateColorsToMatchTheme();
+}
+
+void LocationBarViewMac::OnThemeChanged() {
+  UpdateColorsToMatchTheme();
 }
 
 void LocationBarViewMac::OnChanged() {

diff --git a/chrome/browser/ui/cocoa/omnibox/omnibox_popup_cell.mm b/chrome/browser/ui/cocoa/omnibox/omnibox_popup_cell.mm
index fdb254f..7e7be465 100644
--- a/chrome/browser/ui/cocoa/omnibox/omnibox_popup_cell.mm
+++ b/chrome/browser/ui/cocoa/omnibox/omnibox_popup_cell.mm

@@ -65,10 +65,10 @@
   return [NSColor darkGrayColor];
 }
 NSColor* PositiveTextColor() {
-  return skia::SkColorToCalibratedNSColor(SkColorSetRGB(0x0b, 0x80, 0x43));
+  return skia::SkColorToCalibratedNSColor(SkColorSetRGB(0x3d, 0x94, 0x00));
 }
 NSColor* NegativeTextColor() {
-  return skia::SkColorToCalibratedNSColor(SkColorSetRGB(0xc5, 0x39, 0x29));
+  return skia::SkColorToCalibratedNSColor(SkColorSetRGB(0xdd, 0x4b, 0x39));
 }
 NSColor* URLTextColor() {
   return [NSColor colorWithCalibratedRed:0.0 green:0.55 blue:0.0 alpha:1.0];
@@ -183,6 +183,36 @@
         NSFontAttributeName : FieldFont()
       };
       break;
+    case SuggestionAnswer::ANSWER_TEXT_MEDIUM:
+      answer_style = @{
+        NSForegroundColorAttributeName : ContentTextColor(),
+        NSFontAttributeName : FieldFont()
+      };
+      break;
+    case SuggestionAnswer::ANSWER_TEXT_LARGE:
+      answer_style = @{
+        NSForegroundColorAttributeName : ContentTextColor(),
+        NSFontAttributeName : LargeFont()
+      };
+      break;
+    case SuggestionAnswer::SUGGESTION_SECONDARY_TEXT_SMALL:
+      answer_style = @{
+        NSForegroundColorAttributeName : DimTextColor(),
+        NSFontAttributeName : SmallFont()
+      };
+      break;
+    case SuggestionAnswer::SUGGESTION_SECONDARY_TEXT_MEDIUM:
+      answer_style = @{
+        NSForegroundColorAttributeName : DimTextColor(),
+        NSFontAttributeName : FieldFont()
+      };
+      break;
+    default:
+      answer_style = @{
+        NSForegroundColorAttributeName : ContentTextColor (),
+        NSFontAttributeName : FieldFont()
+      };
+      break;
   }
 
   if (is_bold) {

diff --git a/chrome/browser/ui/startup/default_browser_prompt.cc b/chrome/browser/ui/startup/default_browser_prompt.cc
index 2155659..fe0b890a 100644
--- a/chrome/browser/ui/startup/default_browser_prompt.cc
+++ b/chrome/browser/ui/startup/default_browser_prompt.cc

@@ -44,7 +44,7 @@
  public:
   // Creates a default browser infobar and delegate and adds the infobar to
   // |infobar_service|.
-  static void Create(InfoBarService* infobar_service, PrefService* prefs);
+  static void Create(InfoBarService* infobar_service, Profile* profile);
 
  private:
   // Possible user interactions with the default browser info bar.
@@ -59,7 +59,7 @@
     NUM_INFO_BAR_USER_INTERACTION_TYPES
   };
 
-  explicit DefaultBrowserInfoBarDelegate(PrefService* prefs);
+  explicit DefaultBrowserInfoBarDelegate(Profile* profile);
   ~DefaultBrowserInfoBarDelegate() override;
 
   void AllowExpiry() { should_expire_ = true; }
@@ -76,8 +76,8 @@
   bool Accept() override;
   bool Cancel() override;
 
-  // The prefs to use.
-  PrefService* prefs_;
+  // The WebContents's corresponding profile.
+  Profile* profile_;
 
   // Whether the user clicked one of the buttons.
   bool action_taken_;
@@ -93,15 +93,15 @@
 
 // static
 void DefaultBrowserInfoBarDelegate::Create(InfoBarService* infobar_service,
-                                           PrefService* prefs) {
+                                           Profile* profile) {
   infobar_service->AddInfoBar(
       infobar_service->CreateConfirmInfoBar(scoped_ptr<ConfirmInfoBarDelegate>(
-          new DefaultBrowserInfoBarDelegate(prefs))));
+          new DefaultBrowserInfoBarDelegate(profile))));
 }
 
-DefaultBrowserInfoBarDelegate::DefaultBrowserInfoBarDelegate(PrefService* prefs)
+DefaultBrowserInfoBarDelegate::DefaultBrowserInfoBarDelegate(Profile* profile)
     : ConfirmInfoBarDelegate(),
-      prefs_(prefs),
+      profile_(profile),
       action_taken_(false),
       should_expire_(false),
       weak_factory_(this) {
@@ -194,7 +194,7 @@
                             InfoBarUserInteraction::DONT_ASK_AGAIN,
                             NUM_INFO_BAR_USER_INTERACTION_TYPES);
   // User clicked "Don't ask me again", remember that.
-  prefs_->SetBoolean(prefs::kCheckDefaultBrowser, false);
+  chrome::DefaultBrowserPromptDeclined(profile_);
   return true;
 }
 
@@ -202,7 +202,7 @@
   Profile* profile =
       g_browser_process->profile_manager()->GetProfileByPath(profile_path);
   if (profile)
-    profile->GetPrefs()->SetBoolean(prefs::kCheckDefaultBrowser, true);
+    chrome::ResetDefaultBrowserPrompt(profile);
 }
 
 void ShowPrompt() {
@@ -218,9 +218,7 @@
     return;
 
   DefaultBrowserInfoBarDelegate::Create(
-      InfoBarService::FromWebContents(web_contents),
-      Profile::FromBrowserContext(web_contents->GetBrowserContext())
-          ->GetPrefs());
+      InfoBarService::FromWebContents(web_contents), browser->profile());
 }
 
 void OnCheckIsDefaultBrowserFinished(
@@ -261,7 +259,7 @@
   // Reset preferences if kResetCheckDefaultBrowser is true.
   if (prefs->GetBoolean(prefs::kResetCheckDefaultBrowser)) {
     prefs->SetBoolean(prefs::kResetCheckDefaultBrowser, false);
-    prefs->SetBoolean(prefs::kCheckDefaultBrowser, true);
+    ResetDefaultBrowserPrompt(profile);
   }
 
   // Check if Chrome is the default browser but do not prompt if:
@@ -287,6 +285,14 @@
       ->StartCheckIsDefault();
 }
 
+void DefaultBrowserPromptDeclined(Profile* profile) {
+  profile->GetPrefs()->SetBoolean(prefs::kCheckDefaultBrowser, false);
+}
+
+void ResetDefaultBrowserPrompt(Profile* profile) {
+  profile->GetPrefs()->ClearPref(prefs::kCheckDefaultBrowser);
+}
+
 #if !defined(OS_WIN)
 bool ShowFirstRunDefaultBrowserPrompt(Profile* profile) {
   return false;

diff --git a/chrome/browser/ui/startup/default_browser_prompt.h b/chrome/browser/ui/startup/default_browser_prompt.h
index d009d57..ff395283 100644
--- a/chrome/browser/ui/startup/default_browser_prompt.h
+++ b/chrome/browser/ui/startup/default_browser_prompt.h

@@ -15,6 +15,13 @@
 // Shows a prompt UI to set the default browser if necessary.
 void ShowDefaultBrowserPrompt(Profile* profile);
 
+// Marks the default browser prompt as having been declined.
+void DefaultBrowserPromptDeclined(Profile* profile);
+
+// Resets the tracking preference for the default browser prompt so that it is
+// re-shown if the browser ceases to be the user's chosen default.
+void ResetDefaultBrowserPrompt(Profile* profile);
+
 // Shows a prompt UI to set the default browser on first run
 // (if necessary and permitted). Returns true if the dialog has been launched.
 bool ShowFirstRunDefaultBrowserPrompt(Profile* profile);

diff --git a/chrome/browser/ui/sync/one_click_signin_sync_starter.cc b/chrome/browser/ui/sync/one_click_signin_sync_starter.cc
index c9020a2..6195bbd 100644
--- a/chrome/browser/ui/sync/one_click_signin_sync_starter.cc
+++ b/chrome/browser/ui/sync/one_click_signin_sync_starter.cc

@@ -90,6 +90,7 @@
       current_url_(current_url),
       continue_url_(continue_url),
       sync_setup_completed_callback_(sync_setup_completed_callback),
+      first_account_added_to_cookie_(false),
       weak_pointer_factory_(this) {
   DCHECK(profile);
   DCHECK(web_contents || continue_url.is_empty());
@@ -458,6 +459,11 @@
 
 void OneClickSigninSyncStarter::AccountAddedToCookie(
     const GoogleServiceAuthError& error) {
+  if (first_account_added_to_cookie_)
+    return;
+
+  first_account_added_to_cookie_ = true;
+
   // Regardless of whether the account was successfully added or not,
   // continue with sync starting.
 

diff --git a/chrome/browser/ui/sync/one_click_signin_sync_starter.h b/chrome/browser/ui/sync/one_click_signin_sync_starter.h
index 5cc33693..b8b497071 100644
--- a/chrome/browser/ui/sync/one_click_signin_sync_starter.h
+++ b/chrome/browser/ui/sync/one_click_signin_sync_starter.h

@@ -233,6 +233,11 @@
   std::string dm_token_;
   std::string client_id_;
 
+  // This only cares about the first AccountAddedToCookie event. Since
+  // SigninTracker always expects an observer, this object will just disregard
+  // following AccountAddedToCookie calls triggered by account reconciliation.
+  bool first_account_added_to_cookie_;
+
   base::WeakPtrFactory<OneClickSigninSyncStarter> weak_pointer_factory_;
 
   DISALLOW_COPY_AND_ASSIGN(OneClickSigninSyncStarter);

diff --git a/chrome/browser/ui/views/location_bar/open_pdf_in_reader_view.cc b/chrome/browser/ui/views/location_bar/open_pdf_in_reader_view.cc
index d105f27..57a58a3 100644
--- a/chrome/browser/ui/views/location_bar/open_pdf_in_reader_view.cc
+++ b/chrome/browser/ui/views/location_bar/open_pdf_in_reader_view.cc

@@ -47,7 +47,7 @@
 
   DCHECK(model_);
   bubble_ = new OpenPDFInReaderBubbleView(this, model_);
-  views::BubbleDelegateView::CreateBubble(bubble_);
+  views::BubbleDialogDelegateView::CreateBubble(bubble_);
   bubble_->GetWidget()->AddObserver(this);
   bubble_->GetWidget()->Show();
 }

diff --git a/chrome/browser/ui/views/omnibox/omnibox_result_view.cc b/chrome/browser/ui/views/omnibox/omnibox_result_view.cc
index 3b336b7..7cb37f1 100644
--- a/chrome/browser/ui/views/omnibox/omnibox_result_view.cc
+++ b/chrome/browser/ui/views/omnibox/omnibox_result_view.cc

@@ -164,11 +164,53 @@
       NativeTheme::kColorId_ResultsTableHoveredText,
       NativeTheme::kColorId_ResultsTableSelectedText},
      gfx::NORMAL_BASELINE},
+    // 14 IMMERSIVE_DESCRIPTION_TEXT (deprecated)
+    {ui::ResourceBundle::BaseFont,
+     {NativeTheme::kColorId_ResultsTableNormalText,
+      NativeTheme::kColorId_ResultsTableHoveredText,
+      NativeTheme::kColorId_ResultsTableSelectedText},
+     gfx::NORMAL_BASELINE},
+    // 15 DATE_TEXT (deprecated)
+    {ui::ResourceBundle::BaseFont,
+     {NativeTheme::kColorId_ResultsTableNormalText,
+      NativeTheme::kColorId_ResultsTableHoveredText,
+      NativeTheme::kColorId_ResultsTableSelectedText},
+     gfx::NORMAL_BASELINE},
+    // 16 PREVIEW_TEXT (deprecated)
+    {ui::ResourceBundle::BaseFont,
+     {NativeTheme::kColorId_ResultsTableNormalText,
+      NativeTheme::kColorId_ResultsTableHoveredText,
+      NativeTheme::kColorId_ResultsTableSelectedText},
+     gfx::NORMAL_BASELINE},
+    // 17 ANSWER_TEXT_MEDIUM
+    {ui::ResourceBundle::BaseFont,
+     {NativeTheme::kColorId_ResultsTableNormalText,
+      NativeTheme::kColorId_ResultsTableHoveredText,
+      NativeTheme::kColorId_ResultsTableSelectedText},
+     gfx::NORMAL_BASELINE},
+    // 18 ANSWER_TEXT_LARGE
+    {ui::ResourceBundle::LargeFont,
+     {NativeTheme::kColorId_ResultsTableNormalText,
+      NativeTheme::kColorId_ResultsTableHoveredText,
+      NativeTheme::kColorId_ResultsTableSelectedText},
+     gfx::NORMAL_BASELINE},
+    // 19 SUGGESTION_SECONDARY_TEXT_SMALL
+    {ui::ResourceBundle::BaseFont,
+     {NativeTheme::kColorId_ResultsTableNormalDimmedText,
+      NativeTheme::kColorId_ResultsTableHoveredDimmedText,
+      NativeTheme::kColorId_ResultsTableSelectedDimmedText},
+     gfx::NORMAL_BASELINE},
+    // 20 SUGGESTION_SECONDARY_TEXT_MEDIUM
+    {ui::ResourceBundle::BaseFont,
+     {NativeTheme::kColorId_ResultsTableNormalDimmedText,
+      NativeTheme::kColorId_ResultsTableHoveredDimmedText,
+      NativeTheme::kColorId_ResultsTableSelectedDimmedText},
+     gfx::NORMAL_BASELINE},
 };
 
 const TextStyle& GetTextStyle(int type) {
   if (type < 1 || static_cast<size_t>(type) > arraysize(kTextStyles))
-    type = 1;
+    type = 8;
   // Subtract one because the types are one based (not zero based).
   return kTextStyles[type - 1];
 }

diff --git a/chrome/browser/ui/views/open_pdf_in_reader_bubble_view.cc b/chrome/browser/ui/views/open_pdf_in_reader_bubble_view.cc
index 99b34a1..d1e78d5 100644
--- a/chrome/browser/ui/views/open_pdf_in_reader_bubble_view.cc
+++ b/chrome/browser/ui/views/open_pdf_in_reader_bubble_view.cc

@@ -17,10 +17,10 @@
 OpenPDFInReaderBubbleView::OpenPDFInReaderBubbleView(
     views::View* anchor_view,
     pdf::OpenPDFInReaderPromptClient* model)
-    : views::BubbleDelegateView(anchor_view, views::BubbleBorder::TOP_RIGHT),
+    : views::BubbleDialogDelegateView(anchor_view,
+                                      views::BubbleBorder::TOP_RIGHT),
       model_(model),
-      open_in_reader_link_(NULL),
-      close_button_(NULL) {
+      open_in_reader_link_(nullptr) {
   DCHECK(model);
 }
 
@@ -47,25 +47,20 @@
   open_in_reader_link_->set_listener(this);
   layout->StartRow(0, single_column_set_id);
   layout->AddView(open_in_reader_link_);
-
-  layout->AddPaddingRow(0, views::kRelatedControlVerticalSpacing);
-  layout->StartRow(0, single_column_set_id);
-  layout->AddView(new views::Separator(views::Separator::HORIZONTAL), 1, 1,
-                  GridLayout::FILL, GridLayout::FILL);
-  layout->AddPaddingRow(0, views::kRelatedControlVerticalSpacing);
-
-  close_button_ = new views::LabelButton(this, model_->GetCancelButtonText());
-  close_button_->SetStyle(views::Button::STYLE_BUTTON);
-  layout->StartRow(0, single_column_set_id);
-  layout->AddView(close_button_);
 }
 
-void OpenPDFInReaderBubbleView::ButtonPressed(views::Button* sender,
-                                              const ui::Event& event) {
-  DCHECK_EQ(close_button_, sender);
+int OpenPDFInReaderBubbleView::GetDialogButtons() const {
+  return ui::DIALOG_BUTTON_CANCEL;
+}
 
+base::string16 OpenPDFInReaderBubbleView::GetDialogButtonLabel(
+    ui::DialogButton button) const {
+  return model_->GetCancelButtonText();
+}
+
+bool OpenPDFInReaderBubbleView::Cancel() {
   model_->Cancel();
-  GetWidget()->Close();
+  return true;
 }
 
 void OpenPDFInReaderBubbleView::LinkClicked(views::Link* source,

diff --git a/chrome/browser/ui/views/open_pdf_in_reader_bubble_view.h b/chrome/browser/ui/views/open_pdf_in_reader_bubble_view.h
index dd504ec7..9ea2f75d 100644
--- a/chrome/browser/ui/views/open_pdf_in_reader_bubble_view.h
+++ b/chrome/browser/ui/views/open_pdf_in_reader_bubble_view.h

@@ -6,20 +6,14 @@
 #define CHROME_BROWSER_UI_VIEWS_OPEN_PDF_IN_READER_BUBBLE_VIEW_H_
 
 #include "base/macros.h"
-#include "ui/views/bubble/bubble_delegate.h"
-#include "ui/views/controls/button/button.h"
+#include "ui/views/bubble/bubble_dialog_delegate.h"
 #include "ui/views/controls/link_listener.h"
 
 namespace pdf {
 class OpenPDFInReaderPromptClient;
 }
 
-namespace views {
-class LabelButton;
-}
-
-class OpenPDFInReaderBubbleView : public views::BubbleDelegateView,
-                                  public views::ButtonListener,
+class OpenPDFInReaderBubbleView : public views::BubbleDialogDelegateView,
                                   public views::LinkListener {
  public:
   OpenPDFInReaderBubbleView(views::View* anchor_view,
@@ -27,11 +21,11 @@
   ~OpenPDFInReaderBubbleView() override;
 
  protected:
-  // views::BubbleDelegateView:
+  // views::BubbleDialogDelegateView:
   void Init() override;
-
-  // views::ButtonListener:
-  void ButtonPressed(views::Button* sender, const ui::Event& event) override;
+  bool Cancel() override;
+  int GetDialogButtons() const override;
+  base::string16 GetDialogButtonLabel(ui::DialogButton button) const override;
 
   // views::LinkListener:
   void LinkClicked(views::Link* source, int event_flags) override;
@@ -42,7 +36,6 @@
   pdf::OpenPDFInReaderPromptClient* model_;
 
   views::Link* open_in_reader_link_;
-  views::LabelButton* close_button_;
 
   DISALLOW_COPY_AND_ASSIGN(OpenPDFInReaderBubbleView);
 };

diff --git a/chrome/browser/ui/webui/options/browser_options_handler.cc b/chrome/browser/ui/webui/options/browser_options_handler.cc
index ef9fc77..b5a1bb4 100644
--- a/chrome/browser/ui/webui/options/browser_options_handler.cc
+++ b/chrome/browser/ui/webui/options/browser_options_handler.cc

@@ -105,6 +105,7 @@
 #include "ui/base/webui/web_ui_util.h"
 
 #if !defined(OS_CHROMEOS)
+#include "chrome/browser/ui/startup/default_browser_prompt.h"
 #include "chrome/browser/ui/webui/settings_utils.h"
 #endif
 
@@ -1143,8 +1144,7 @@
 
   // If the user attempted to make Chrome the default browser, notify
   // them when this changes.
-  PrefService* prefs = Profile::FromWebUI(web_ui())->GetPrefs();
-  prefs->SetBoolean(prefs::kCheckDefaultBrowser, true);
+  chrome::ResetDefaultBrowserPrompt(Profile::FromWebUI(web_ui()));
 }
 
 void BrowserOptionsHandler::OnDefaultBrowserWorkerFinished(
@@ -1155,8 +1155,7 @@
     status_string_id = IDS_OPTIONS_DEFAULTBROWSER_DEFAULT;
     // Notify the user in the future if Chrome ceases to be the user's chosen
     // default browser.
-    PrefService* prefs = Profile::FromWebUI(web_ui())->GetPrefs();
-    prefs->SetBoolean(prefs::kCheckDefaultBrowser, true);
+    chrome::ResetDefaultBrowserPrompt(Profile::FromWebUI(web_ui()));
   } else if (state == shell_integration::NOT_DEFAULT) {
     if (shell_integration::CanSetAsDefaultBrowser() ==
         shell_integration::SET_DEFAULT_NOT_ALLOWED) {

diff --git a/chrome/browser/ui/webui/popular_sites_internals_message_handler.cc b/chrome/browser/ui/webui/popular_sites_internals_message_handler.cc
index 11adb9c..c5f4bbe10 100644
--- a/chrome/browser/ui/webui/popular_sites_internals_message_handler.cc
+++ b/chrome/browser/ui/webui/popular_sites_internals_message_handler.cc

@@ -26,7 +26,8 @@
     result.clear();
   return result;
 }
-}
+
+}  // namespace
 
 PopularSitesInternalsMessageHandler::PopularSitesInternalsMessageHandler()
     : weak_ptr_factory_(this) {}
@@ -115,6 +116,8 @@
 
   base::DictionaryValue result;
   result.Set("sites", std::move(sites_list));
+  result.SetString("country", popular_sites_->GetCountry());
+  result.SetString("version", popular_sites_->GetVersion());
   web_ui()->CallJavascriptFunction(
       "chrome.popular_sites_internals.receiveSites", result);
 }

diff --git a/chrome/browser/ui/webui/set_as_default_browser_ui.cc b/chrome/browser/ui/webui/set_as_default_browser_ui.cc
index 1717625..a9a6a9e 100644
--- a/chrome/browser/ui/webui/set_as_default_browser_ui.cc
+++ b/chrome/browser/ui/webui/set_as_default_browser_ui.cc

@@ -22,6 +22,7 @@
 #include "chrome/browser/ui/browser_window.h"
 #include "chrome/browser/ui/chrome_pages.h"
 #include "chrome/browser/ui/singleton_tabs.h"
+#include "chrome/browser/ui/startup/default_browser_prompt.h"
 #include "chrome/browser/ui/sync/sync_promo_ui.h"
 #include "chrome/browser/ui/tabs/tab_strip_model.h"
 #include "chrome/common/pref_names.h"
@@ -291,12 +292,10 @@
                             dialog_interaction_result_,
                             MAKE_CHROME_DEFAULT_MAX);
 
-  // If the user explicitly elected *not to* make Chrome default, we won't
-  // ask again.
-  if (dialog_interaction_result_ == MAKE_CHROME_DEFAULT_REGRETTED) {
-    PrefService* prefs = profile_->GetPrefs();
-    prefs->SetBoolean(prefs::kCheckDefaultBrowser, false);
-  }
+  // Suppress showing the default browser infobar if the user explicitly elected
+  // *not to* make Chrome default.
+  if (dialog_interaction_result_ == MAKE_CHROME_DEFAULT_REGRETTED)
+    chrome::DefaultBrowserPromptDeclined(profile_);
 
   // Carry on with a normal chrome session. For the purpose of surfacing this
   // dialog the actual browser window had to remain hidden. Now it's time to

diff --git a/chrome/browser/ui/webui/settings/md_settings_localized_strings_provider.cc b/chrome/browser/ui/webui/settings/md_settings_localized_strings_provider.cc
index 8686553f..bb74e78 100644
--- a/chrome/browser/ui/webui/settings/md_settings_localized_strings_provider.cc
+++ b/chrome/browser/ui/webui/settings/md_settings_localized_strings_provider.cc

@@ -203,6 +203,8 @@
 void AddCertificateManagerStrings(content::WebUIDataSource* html_source) {
   LocalizedString localized_strings[] = {
       {"certificateManagerPageTitle", IDS_SETTINGS_CERTIFICATE_MANAGER},
+      {"certificateManagerNoCertificates",
+        IDS_SETTINGS_CERTIFICATE_MANAGER_NO_CERTIFICATES},
       {"certificateManagerYourCertificates",
        IDS_SETTINGS_CERTIFICATE_MANAGER_YOUR_CERTIFICATES},
       {"certificateManagerYourCertificatesDescription",

diff --git a/chrome/browser/ui/webui/settings/people_handler.cc b/chrome/browser/ui/webui/settings/people_handler.cc
index 6c7bfa0f..a7af4cb4 100644
--- a/chrome/browser/ui/webui/settings/people_handler.cc
+++ b/chrome/browser/ui/webui/settings/people_handler.cc

@@ -158,7 +158,6 @@
   return true;
 }
 
-// Retrieves the
 void GetAccountNameAndIcon(const Profile& profile,
                            std::string* name,
                            std::string* icon_url) {

diff --git a/chrome/browser/ui/webui/settings/settings_default_browser_handler.cc b/chrome/browser/ui/webui/settings/settings_default_browser_handler.cc
index 119d8c7..b2083d7 100644
--- a/chrome/browser/ui/webui/settings/settings_default_browser_handler.cc
+++ b/chrome/browser/ui/webui/settings/settings_default_browser_handler.cc

@@ -6,6 +6,7 @@
 
 #include "base/bind.h"
 #include "chrome/browser/browser_process.h"
+#include "chrome/browser/ui/startup/default_browser_prompt.h"
 #include "chrome/common/pref_names.h"
 #include "components/prefs/pref_service.h"
 #include "content/public/browser/web_ui.h"
@@ -56,8 +57,7 @@
 
   // If the user attempted to make Chrome the default browser, notify
   // them when this changes.
-  Profile::FromWebUI(web_ui())->GetPrefs()->SetBoolean(
-      prefs::kCheckDefaultBrowser, true);
+  chrome::ResetDefaultBrowserPrompt(Profile::FromWebUI(web_ui()));
 }
 
 void DefaultBrowserHandler::OnDefaultBrowserWorkerFinished(
@@ -65,8 +65,7 @@
   if (state == shell_integration::IS_DEFAULT) {
     // Notify the user in the future if Chrome ceases to be the user's chosen
     // default browser.
-    Profile::FromWebUI(web_ui())->GetPrefs()->SetBoolean(
-        prefs::kCheckDefaultBrowser, true);
+    chrome::ResetDefaultBrowserPrompt(Profile::FromWebUI(web_ui()));
   }
 
   base::FundamentalValue is_default(state == shell_integration::IS_DEFAULT);

diff --git a/chrome/browser/ui/webui/settings/settings_manage_profile_handler.cc b/chrome/browser/ui/webui/settings/settings_manage_profile_handler.cc
index 84c34ff9..8a957cdb 100644
--- a/chrome/browser/ui/webui/settings/settings_manage_profile_handler.cc
+++ b/chrome/browser/ui/webui/settings/settings_manage_profile_handler.cc

@@ -42,37 +42,30 @@
 namespace settings {
 
 ManageProfileHandler::ManageProfileHandler(Profile* profile)
-    : profile_(profile), weak_factory_(this) {
-  g_browser_process->profile_manager()->
-      GetProfileAttributesStorage().AddObserver(this);
-}
+    : profile_(profile), observer_(this), weak_factory_(this) {}
 
-ManageProfileHandler::~ManageProfileHandler() {
-  g_browser_process->profile_manager()->
-      GetProfileAttributesStorage().RemoveObserver(this);
-}
+ManageProfileHandler::~ManageProfileHandler() {}
 
 void ManageProfileHandler::RegisterMessages() {
-  web_ui()->RegisterMessageCallback("setProfileIconAndName",
-      base::Bind(&ManageProfileHandler::SetProfileIconAndName,
+  web_ui()->RegisterMessageCallback(
+      "getAvailableIcons",
+      base::Bind(&ManageProfileHandler::HandleGetAvailableIcons,
                  base::Unretained(this)));
-  web_ui()->RegisterMessageCallback("getAvailableIcons",
-      base::Bind(&ManageProfileHandler::GetAvailableIcons,
+  web_ui()->RegisterMessageCallback(
+      "setProfileIconAndName",
+      base::Bind(&ManageProfileHandler::HandleSetProfileIconAndName,
                  base::Unretained(this)));
-  web_ui()->RegisterMessageCallback("requestHasProfileShortcuts",
-      base::Bind(&ManageProfileHandler::RequestHasProfileShortcuts,
+  web_ui()->RegisterMessageCallback(
+      "requestHasProfileShortcuts",
+      base::Bind(&ManageProfileHandler::HandleRequestHasProfileShortcuts,
                  base::Unretained(this)));
-  web_ui()->RegisterMessageCallback("profileIconSelectionChanged",
-      base::Bind(&ManageProfileHandler::ProfileIconSelectionChanged,
+  web_ui()->RegisterMessageCallback(
+      "addProfileShortcut",
+      base::Bind(&ManageProfileHandler::HandleAddProfileShortcut,
                  base::Unretained(this)));
-  web_ui()->RegisterMessageCallback("addProfileShortcut",
-      base::Bind(&ManageProfileHandler::AddProfileShortcut,
-                 base::Unretained(this)));
-  web_ui()->RegisterMessageCallback("removeProfileShortcut",
-      base::Bind(&ManageProfileHandler::RemoveProfileShortcut,
-                 base::Unretained(this)));
-  web_ui()->RegisterMessageCallback("refreshGaiaPicture",
-      base::Bind(&ManageProfileHandler::RefreshGaiaPicture,
+  web_ui()->RegisterMessageCallback(
+      "removeProfileShortcut",
+      base::Bind(&ManageProfileHandler::HandleRemoveProfileShortcut,
                  base::Unretained(this)));
 }
 
@@ -82,7 +75,17 @@
   SendAvailableIcons();
 }
 
-void ManageProfileHandler::GetAvailableIcons(const base::ListValue* args) {
+void ManageProfileHandler::HandleGetAvailableIcons(
+    const base::ListValue* args) {
+  // This is also used as a signal that the page has loaded and is ready to
+  // observe profile avatar changes.
+  if (!observer_.IsObservingSources()) {
+    observer_.Add(
+        &g_browser_process->profile_manager()->GetProfileAttributesStorage());
+  }
+
+  profiles::UpdateGaiaProfileInfoIfNeeded(profile_);
+
   SendAvailableIcons();
 }
 
@@ -112,12 +115,14 @@
                                    image_url_list);
 }
 
-void ManageProfileHandler::SetProfileIconAndName(const base::ListValue* args) {
+void ManageProfileHandler::HandleSetProfileIconAndName(
+    const base::ListValue* args) {
+  DCHECK_CURRENTLY_ON(content::BrowserThread::UI);
   DCHECK(args);
+  DCHECK_EQ(2u, args->GetSize());
 
   std::string icon_url;
-  if (!args->GetString(0, &icon_url))
-    return;
+  CHECK(args->GetString(0, &icon_url));
 
   PrefService* pref_service = profile_->GetPrefs();
   // Updating the profile preferences will cause the cache to be updated.
@@ -151,43 +156,14 @@
     return;
 
   base::string16 new_profile_name;
-  if (!args->GetString(1, &new_profile_name))
-    return;
+  CHECK(args->GetString(1, &new_profile_name));
 
   base::TrimWhitespace(new_profile_name, base::TRIM_ALL, &new_profile_name);
   CHECK(!new_profile_name.empty());
   profiles::UpdateProfileName(profile_, new_profile_name);
 }
 
-void ManageProfileHandler::ProfileIconSelectionChanged(
-    const base::ListValue* args) {
-  DCHECK(args);
-
-  std::string icon_url;
-  if (!args->GetString(0, &icon_url))
-    return;
-
-  if (icon_url != gaia_picture_url_)
-    return;
-
-  // If the selection is the GAIA picture then also show the profile name in the
-  // text field. This will display either the GAIA given name, if available,
-  // or the first name.
-  ProfileAttributesEntry* entry;
-  if (!g_browser_process->profile_manager()->GetProfileAttributesStorage().
-          GetProfileAttributesWithPath(profile_->GetPath(), &entry)) {
-    return;
-  }
-  base::string16 gaia_name = entry->GetName();
-  if (gaia_name.empty())
-    return;
-
-  web_ui()->CallJavascriptFunction(
-      "settings.SyncPrivateApi.setProfileName",
-      base::StringValue(gaia_name));
-}
-
-void ManageProfileHandler::RequestHasProfileShortcuts(
+void ManageProfileHandler::HandleRequestHasProfileShortcuts(
     const base::ListValue* args) {
   DCHECK_CURRENTLY_ON(content::BrowserThread::UI);
   DCHECK(ProfileShortcutManager::IsFeatureEnabled());
@@ -219,7 +195,8 @@
       has_shortcuts_value);
 }
 
-void ManageProfileHandler::AddProfileShortcut(const base::ListValue* args) {
+void ManageProfileHandler::HandleAddProfileShortcut(
+    const base::ListValue* args) {
   DCHECK(ProfileShortcutManager::IsFeatureEnabled());
   ProfileShortcutManager* shortcut_manager =
       g_browser_process->profile_manager()->profile_shortcut_manager();
@@ -231,7 +208,8 @@
   OnHasProfileShortcuts(true);
 }
 
-void ManageProfileHandler::RemoveProfileShortcut(const base::ListValue* args) {
+void ManageProfileHandler::HandleRemoveProfileShortcut(
+    const base::ListValue* args) {
   DCHECK(ProfileShortcutManager::IsFeatureEnabled());
   ProfileShortcutManager* shortcut_manager =
     g_browser_process->profile_manager()->profile_shortcut_manager();
@@ -243,8 +221,4 @@
   OnHasProfileShortcuts(false);
 }
 
-void ManageProfileHandler::RefreshGaiaPicture(const base::ListValue* args) {
-  profiles::UpdateGaiaProfileInfoIfNeeded(Profile::FromWebUI(web_ui()));
-}
-
 }  // namespace settings

diff --git a/chrome/browser/ui/webui/settings/settings_manage_profile_handler.h b/chrome/browser/ui/webui/settings/settings_manage_profile_handler.h
index 3cf8c40a..548e8c2 100644
--- a/chrome/browser/ui/webui/settings/settings_manage_profile_handler.h
+++ b/chrome/browser/ui/webui/settings/settings_manage_profile_handler.h

@@ -8,6 +8,7 @@
 #include <string>
 
 #include "base/memory/weak_ptr.h"
+#include "base/scoped_observer.h"
 #include "chrome/browser/profiles/profile_attributes_storage.h"
 #include "chrome/browser/ui/webui/settings/settings_page_ui_handler.h"
 
@@ -33,9 +34,12 @@
   void OnProfileAvatarChanged(const base::FilePath& profile_path) override;
 
  private:
+  FRIEND_TEST_ALL_PREFIXES(ManageProfileHandlerTest, SetProfileIconAndName);
+  FRIEND_TEST_ALL_PREFIXES(ManageProfileHandlerTest, GetAvailableIcons);
+
   // Callback for the "getAvailableIcons" message.
   // Sends the array of default profile icon URLs and profile names to WebUI.
-  void GetAvailableIcons(const base::ListValue* args);
+  void HandleGetAvailableIcons(const base::ListValue* args);
 
   // Send all the available profile icons to choose from.
   void SendAvailableIcons();
@@ -43,21 +47,16 @@
   // Callback for the "setProfileIconAndName" message. Sets the name and icon
   // of a given profile.
   // |args| is of the form: [
-  //   /*string*/ profileFilePath,
   //   /*string*/ newProfileIconURL
   //   /*string*/ newProfileName,
   // ]
-  void SetProfileIconAndName(const base::ListValue* args);
-
-  // Callback for the 'profileIconSelectionChanged' message. Used to update the
-  // name in the manager profile dialog based on the selected icon.
-  void ProfileIconSelectionChanged(const base::ListValue* args);
+  void HandleSetProfileIconAndName(const base::ListValue* args);
 
   // Callback for the "requestHasProfileShortcuts" message, which is called
   // when editing an existing profile. Asks the profile shortcut manager whether
   // the profile has shortcuts and gets the result in |OnHasProfileShortcuts()|.
   // |args| is of the form: [ {string} profileFilePath ]
-  void RequestHasProfileShortcuts(const base::ListValue* args);
+  void HandleRequestHasProfileShortcuts(const base::ListValue* args);
 
   // Callback invoked from the profile manager indicating whether the profile
   // being edited has any desktop shortcuts.
@@ -66,16 +65,12 @@
   // Callback for the "addProfileShortcut" message, which is called when editing
   // an existing profile and the user clicks the "Add desktop shortcut" button.
   // Adds a desktop shortcut for the profile.
-  void AddProfileShortcut(const base::ListValue* args);
+  void HandleAddProfileShortcut(const base::ListValue* args);
 
   // Callback for the "removeProfileShortcut" message, which is called when
   // editing an existing profile and the user clicks the "Remove desktop
   // shortcut" button. Removes the desktop shortcut for the profile.
-  void RemoveProfileShortcut(const base::ListValue* args);
-
-  // Callback for the "refreshGaiaPicture" message, which is called when the
-  // user is editing an existing profile.
-  void RefreshGaiaPicture(const base::ListValue* args);
+  void HandleRemoveProfileShortcut(const base::ListValue* args);
 
   // Non-owning pointer to the associated profile.
   Profile* profile_;
@@ -83,6 +78,9 @@
   // URL for the current profile's GAIA picture.
   std::string gaia_picture_url_;
 
+  // Used to observe profile avatar updates.
+  ScopedObserver<ProfileAttributesStorage, ManageProfileHandler> observer_;
+
   // For generating weak pointers to itself for callbacks.
   base::WeakPtrFactory<ManageProfileHandler> weak_factory_;
 

diff --git a/chrome/browser/ui/webui/settings/settings_manage_profile_handler_unittest.cc b/chrome/browser/ui/webui/settings/settings_manage_profile_handler_unittest.cc
new file mode 100644
index 0000000..7569be5
--- /dev/null
+++ b/chrome/browser/ui/webui/settings/settings_manage_profile_handler_unittest.cc

@@ -0,0 +1,97 @@
+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "chrome/browser/ui/webui/settings/settings_manage_profile_handler.h"
+
+#include "base/strings/utf_string_conversions.h"
+#include "chrome/common/pref_names.h"
+#include "chrome/test/base/testing_browser_process.h"
+#include "chrome/test/base/testing_profile_manager.h"
+#include "components/prefs/pref_service.h"
+#include "content/public/browser/web_ui_data_source.h"
+#include "content/public/test/test_browser_thread_bundle.h"
+#include "content/public/test/test_web_ui.h"
+#include "testing/gtest/include/gtest/gtest.h"
+
+namespace settings {
+
+namespace {
+
+class TestManageProfileHandler : public ManageProfileHandler {
+ public:
+  explicit TestManageProfileHandler(Profile* profile)
+      : ManageProfileHandler(profile) {}
+
+  using ManageProfileHandler::set_web_ui;
+};
+
+}  // namespace
+
+class ManageProfileHandlerTest : public testing::Test {
+ public:
+  ManageProfileHandlerTest()
+      : profile_manager_(TestingBrowserProcess::GetGlobal()),
+        profile_(nullptr) {}
+
+  void SetUp() override {
+    ASSERT_TRUE(profile_manager_.SetUp());
+    profile_ = profile_manager_.CreateTestingProfile("Profile 1");
+
+    handler_.reset(new TestManageProfileHandler(profile_));
+    handler_->set_web_ui(&web_ui_);
+  }
+
+  content::TestWebUI* web_ui() { return &web_ui_; }
+  Profile* profile() const { return profile_; }
+  TestManageProfileHandler* handler() const { return handler_.get(); }
+
+ private:
+  content::TestBrowserThreadBundle thread_bundle_;
+  TestingProfileManager profile_manager_;
+  content::TestWebUI web_ui_;
+
+  Profile* profile_;
+  scoped_ptr<TestManageProfileHandler> handler_;
+};
+
+TEST_F(ManageProfileHandlerTest, SetProfileIconAndName) {
+  base::ListValue list_args;
+  list_args.Append(
+      new base::StringValue("chrome://theme/IDR_PROFILE_AVATAR_15"));
+  list_args.Append(new base::StringValue("New Profile Name"));
+  handler()->HandleSetProfileIconAndName(&list_args);
+
+  PrefService* pref_service = profile()->GetPrefs();
+
+  EXPECT_EQ(15, pref_service->GetInteger(prefs::kProfileAvatarIndex));
+  EXPECT_FALSE(pref_service->GetBoolean(prefs::kProfileUsingDefaultAvatar));
+  EXPECT_FALSE(pref_service->GetBoolean(prefs::kProfileUsingGAIAAvatar));
+  EXPECT_EQ("New Profile Name", pref_service->GetString(prefs::kProfileName));
+}
+
+TEST_F(ManageProfileHandlerTest, GetAvailableIcons) {
+  handler()->HandleGetAvailableIcons(nullptr);
+
+  EXPECT_EQ(1U, web_ui()->call_data().size());
+
+  const content::TestWebUI::CallData& data = *web_ui()->call_data().back();
+  EXPECT_EQ("cr.webUIListenerCallback", data.function_name());
+
+  std::string callback_id;
+  ASSERT_TRUE(data.arg1()->GetAsString(&callback_id));
+  EXPECT_EQ("available-icons-changed", callback_id);
+
+  const base::ListValue* icon_urls = nullptr;
+  ASSERT_TRUE(data.arg2()->GetAsList(&icon_urls));
+
+  // Expect the list of icon URLs to be a non-empty list of non-empty strings.
+  EXPECT_FALSE(icon_urls->empty());
+  for (size_t i = 0; i < icon_urls->GetSize(); ++i) {
+    std::string icon_url;
+    EXPECT_TRUE(icon_urls->GetString(i, &icon_url));
+    EXPECT_FALSE(icon_url.empty());
+  }
+}
+
+}  // namespace settings

diff --git a/chrome/browser/ui/webui/signin/md_user_manager_ui.cc b/chrome/browser/ui/webui/signin/md_user_manager_ui.cc
index 5c2f25ef..d5e3d40 100644
--- a/chrome/browser/ui/webui/signin/md_user_manager_ui.cc
+++ b/chrome/browser/ui/webui/signin/md_user_manager_ui.cc

@@ -20,6 +20,10 @@
 #include "ui/base/resource/resource_bundle.h"
 #include "ui/base/webui/web_ui_util.h"
 
+#if defined(ENABLE_SUPERVISED_USERS)
+#include "chrome/browser/ui/webui/signin/signin_supervised_user_import_handler.h"
+#endif
+
 MDUserManagerUI::MDUserManagerUI(content::WebUI* web_ui)
     : WebUIController(web_ui),
       signin_create_profile_handler_(new SigninCreateProfileHandler()),
@@ -28,6 +32,11 @@
   // destroy them when it (the WebUI) is destroyed.
   web_ui->AddMessageHandler(signin_create_profile_handler_);
   web_ui->AddMessageHandler(user_manager_screen_handler_);
+#if defined(ENABLE_SUPERVISED_USERS)
+  signin_supervised_user_import_handler_ =
+      new SigninSupervisedUserImportHandler();
+  web_ui->AddMessageHandler(signin_supervised_user_import_handler_);
+#endif
 
   base::DictionaryValue localized_strings;
   GetLocalizedStrings(&localized_strings);

diff --git a/chrome/browser/ui/webui/signin/md_user_manager_ui.h b/chrome/browser/ui/webui/signin/md_user_manager_ui.h
index df59715a..e7cd8407 100644
--- a/chrome/browser/ui/webui/signin/md_user_manager_ui.h
+++ b/chrome/browser/ui/webui/signin/md_user_manager_ui.h

@@ -11,6 +11,10 @@
 class SigninCreateProfileHandler;
 class UserManagerScreenHandler;
 
+#if defined(ENABLE_SUPERVISED_USERS)
+class SigninSupervisedUserImportHandler;
+#endif
+
 namespace base {
 class DictionaryValue;
 }
@@ -32,6 +36,10 @@
   SigninCreateProfileHandler* signin_create_profile_handler_;
   UserManagerScreenHandler* user_manager_screen_handler_;
 
+#if defined(ENABLE_SUPERVISED_USERS)
+  SigninSupervisedUserImportHandler* signin_supervised_user_import_handler_;
+#endif
+
   DISALLOW_COPY_AND_ASSIGN(MDUserManagerUI);
 };
 

diff --git a/chrome/browser/ui/webui/signin/signin_create_profile_handler.cc b/chrome/browser/ui/webui/signin/signin_create_profile_handler.cc
index 7b16a83..d0d8640 100644
--- a/chrome/browser/ui/webui/signin/signin_create_profile_handler.cc
+++ b/chrome/browser/ui/webui/signin/signin_create_profile_handler.cc

@@ -24,6 +24,7 @@
 #include "chrome/browser/profiles/profile_manager.h"
 #include "chrome/browser/profiles/profile_metrics.h"
 #include "chrome/browser/profiles/profiles_state.h"
+#include "chrome/browser/signin/signin_error_controller_factory.h"
 #include "chrome/browser/signin/signin_manager_factory.h"
 #include "chrome/browser/sync/profile_sync_service_factory.h"
 #include "chrome/browser/ui/webui/profile_helper.h"
@@ -32,6 +33,7 @@
 #include "chrome/grit/generated_resources.h"
 #include "components/browser_sync/browser/profile_sync_service.h"
 #include "components/prefs/pref_service.h"
+#include "components/signin/core/browser/signin_error_controller.h"
 #include "components/strings/grit/components_strings.h"
 #include "content/public/browser/browser_thread.h"
 #include "content/public/browser/web_ui.h"
@@ -62,18 +64,17 @@
       "manageProfilesSupervisedSignedInLabel",
       l10n_util::GetStringUTF16(
           IDS_PROFILES_CREATE_SUPERVISED_MULTI_SIGNED_IN_LABEL));
-  localized_strings->SetString(
-      "manageProfilesSupervisedNotSignedIn",
-      l10n_util::GetStringUTF16(
-          IDS_PROFILES_CREATE_SUPERVISED_NOT_SIGNED_IN_HTML));
   localized_strings->SetString("createProfileConfirm",
                                l10n_util::GetStringUTF16(IDS_SAVE));
   localized_strings->SetString("learnMore",
                                l10n_util::GetStringUTF16(IDS_LEARN_MORE));
   localized_strings->SetString(
+      "selectAnAccount",
+      l10n_util::GetStringUTF16(
+          IDS_PROFILES_CREATE_SUPERVISED_SENTINEL_MENU_ITEM_TEXT));
+  localized_strings->SetString(
       "createProfileTitle",
       l10n_util::GetStringUTF16(IDS_PROFILES_CREATE_TITLE));
-
   localized_strings->SetString(
       "supervisedUserLearnMoreTitle",
       l10n_util::GetStringUTF16(IDS_LEGACY_SUPERVISED_USER_LEARN_MORE_TITLE));
@@ -89,6 +90,18 @@
               chrome::kLegacySupervisedUserManagementURL),
           base::ASCIIToUTF16(
               chrome::kLegacySupervisedUserManagementDisplayURL)));
+  localized_strings->SetString(
+      "manageProfilesExistingSupervisedUser",
+      l10n_util::GetStringUTF16(
+          IDS_PROFILES_CREATE_LEGACY_SUPERVISED_USER_ERROR_EXISTS_REMOTELY));
+  localized_strings->SetString(
+      "managedProfilesExistingLocalSupervisedUser",
+      l10n_util::GetStringUTF16(
+          IDS_PROFILES_CREATE_LEGACY_SUPERVISED_USER_ERROR_EXISTS_LOCALLY));
+  localized_strings->SetString(
+      "custodianAccountNotSelectedError",
+      l10n_util::GetStringUTF16(
+          IDS_PROFILES_CREATE_NO_CUSTODIAN_ACCOUNT_ERROR));
 }
 
 void SigninCreateProfileHandler::RegisterMessages() {
@@ -130,6 +143,20 @@
   web_ui()->CallJavascriptFunction("cr.webUIListenerCallback",
                                    base::StringValue("profile-icons-received"),
                                    image_url_list);
+
+  SendNewProfileDefaults();
+}
+
+void SigninCreateProfileHandler::SendNewProfileDefaults() {
+  ProfileInfoCache& cache =
+      g_browser_process->profile_manager()->GetProfileInfoCache();
+  base::DictionaryValue profile_info;
+  profile_info.SetString("name", cache.ChooseNameForNewProfile(0));
+
+  web_ui()->CallJavascriptFunction(
+      "cr.webUIListenerCallback",
+      base::StringValue("profile-defaults-received"),
+      profile_info);
 }
 
 void SigninCreateProfileHandler::RequestSignedInProfiles(
@@ -184,13 +211,13 @@
   }
 #if defined(ENABLE_SUPERVISED_USERS)
   std::string supervised_user_id;
-  base::FilePath supervisor_profile_path;
+  base::FilePath custodian_profile_path;
   if (GetSupervisedCreateProfileArgs(args, &supervised_user_id,
-                                     &supervisor_profile_path)) {
-    // Load supervisor profile.
+                                     &custodian_profile_path)) {
+    // Load custodian profile.
     g_browser_process->profile_manager()->CreateProfileAsync(
-        supervisor_profile_path,
-        base::Bind(&SigninCreateProfileHandler::LoadSupervisorProfileCallback,
+        custodian_profile_path,
+        base::Bind(&SigninCreateProfileHandler::LoadCustodianProfileCallback,
                    weak_ptr_factory_.GetWeakPtr(), name, icon_url,
                    create_shortcut, supervised_user_id),
         base::string16(), std::string(), std::string());
@@ -207,21 +234,21 @@
     const std::string& icon_url,
     bool create_shortcut,
     const std::string& supervised_user_id,
-    Profile* supervisor_profile) {
+    Profile* custodian_profile) {
   ProfileMetrics::LogProfileAddNewUser(ProfileMetrics::ADD_NEW_USER_DIALOG);
 
   profile_path_being_created_ = ProfileManager::CreateMultiProfileAsync(
       name, icon_url,
       base::Bind(&SigninCreateProfileHandler::OnProfileCreated,
                  weak_ptr_factory_.GetWeakPtr(), create_shortcut,
-                 supervised_user_id, supervisor_profile),
+                 supervised_user_id, custodian_profile),
       supervised_user_id);
 }
 
 void SigninCreateProfileHandler::OnProfileCreated(
     bool create_shortcut,
     const std::string& supervised_user_id,
-    Profile* supervisor_profile,
+    Profile* custodian_profile,
     Profile* profile,
     Profile::CreateStatus status) {
   if (status != Profile::CREATE_STATUS_CREATED)
@@ -238,7 +265,7 @@
     }
     case Profile::CREATE_STATUS_INITIALIZED: {
       HandleProfileCreationSuccess(create_shortcut, supervised_user_id,
-                                   supervisor_profile, profile);
+                                   custodian_profile, profile);
       break;
     }
     // User-initiated cancellation is handled in CancelProfileRegistration and
@@ -257,7 +284,7 @@
 void SigninCreateProfileHandler::HandleProfileCreationSuccess(
     bool create_shortcut,
     const std::string& supervised_user_id,
-    Profile* supervisor_profile,
+    Profile* custodian_profile,
     Profile* profile) {
   switch (profile_creation_type_) {
     case NON_SUPERVISED_PROFILE_CREATION: {
@@ -269,7 +296,7 @@
     case SUPERVISED_PROFILE_CREATION:
     case SUPERVISED_PROFILE_IMPORT:
       RegisterSupervisedUser(create_shortcut, supervised_user_id,
-                             supervisor_profile, profile);
+                             custodian_profile, profile);
       break;
 #endif
     case NO_CREATION_IN_PROGRESS:
@@ -329,14 +356,14 @@
     Profile* profile,
     const base::string16& error) {
   DCHECK_NE(NO_CREATION_IN_PROGRESS, profile_creation_type_);
-  profile_creation_type_ = NO_CREATION_IN_PROGRESS;
-  profile_path_being_created_.clear();
   web_ui()->CallJavascriptFunction("cr.webUIListenerCallback",
                                    GetWebUIListenerName(PROFILE_CREATION_ERROR),
                                    base::StringValue(error));
   // The ProfileManager calls us back with a NULL profile in some cases.
   if (profile)
     webui::DeleteProfileAtPath(profile->GetPath(), web_ui());
+  profile_creation_type_ = NO_CREATION_IN_PROGRESS;
+  profile_path_being_created_.clear();
 }
 
 void SigninCreateProfileHandler::RecordProfileCreationMetrics(
@@ -408,7 +435,7 @@
 bool SigninCreateProfileHandler::GetSupervisedCreateProfileArgs(
     const base::ListValue* args,
     std::string* supervised_user_id,
-    base::FilePath* supervisor_profile_path) {
+    base::FilePath* custodian_profile_path) {
   bool supervised_user = false;
   bool success = args->GetBoolean(3, &supervised_user);
   DCHECK(success);
@@ -421,18 +448,18 @@
   const base::Value* path_value;
   success = args->Get(5, &path_value);
   DCHECK(success);
-  success = base::GetValueAsFilePath(*path_value, supervisor_profile_path);
+  success = base::GetValueAsFilePath(*path_value, custodian_profile_path);
   DCHECK(success);
 
-  return !supervisor_profile_path->empty();
+  return !custodian_profile_path->empty();
 }
 
-void SigninCreateProfileHandler::LoadSupervisorProfileCallback(
+void SigninCreateProfileHandler::LoadCustodianProfileCallback(
     const base::string16& name,
     const std::string& icon_url,
     bool create_shortcut,
     const std::string& supervised_user_id,
-    Profile* supervisor_profile,
+    Profile* custodian_profile,
     Profile::CreateStatus status) {
   // This method gets called once before with Profile::CREATE_STATUS_CREATED.
   switch (status) {
@@ -448,8 +475,14 @@
     case Profile::CREATE_STATUS_INITIALIZED: {
       // We are only interested in Profile::CREATE_STATUS_INITIALIZED when
       // everything is ready.
-      // TODO(mahmadi): display proper error message to the user.
-      PrefService* prefs = supervisor_profile->GetPrefs();
+      if (!IsAccountConnected(custodian_profile) ||
+          HasAuthError(custodian_profile)) {
+        ShowProfileCreationError(nullptr, l10n_util::GetStringUTF16(
+          IDS_PROFILES_CREATE_CUSTODIAN_ACCOUNT_DETAILS_OUT_OF_DATE_ERROR));
+        return;
+      }
+
+      PrefService* prefs = custodian_profile->GetPrefs();
       if (!prefs->GetBoolean(prefs::kSupervisedUserCreationAllowed))
         return;
 
@@ -457,12 +490,12 @@
         profile_creation_type_ = SUPERVISED_PROFILE_IMPORT;
 
         SupervisedUserSyncService* supervised_user_sync_service =
-            SupervisedUserSyncServiceFactory::GetForProfile(supervisor_profile);
+            SupervisedUserSyncServiceFactory::GetForProfile(custodian_profile);
         if (supervised_user_sync_service) {
           supervised_user_sync_service->GetSupervisedUsersAsync(base::Bind(
               &SigninCreateProfileHandler::DoCreateProfileIfPossible,
               weak_ptr_factory_.GetWeakPtr(), name, icon_url, create_shortcut,
-              supervised_user_id, supervisor_profile));
+              supervised_user_id, custodian_profile));
         }
       } else {
         profile_creation_type_ = SUPERVISED_PROFILE_CREATION;
@@ -474,7 +507,7 @@
         // so it won't have the same potential delay.
         ProfileSyncService* sync_service =
             ProfileSyncServiceFactory::GetInstance()->GetForProfile(
-                supervisor_profile);
+                custodian_profile);
         ProfileSyncService::SyncStatusSummary status =
             sync_service->QuerySyncStatusSummary();
         if (status == ProfileSyncService::DATATYPES_NOT_INITIALIZED) {
@@ -483,7 +516,7 @@
         }
 
         DoCreateProfile(name, icon_url, create_shortcut, new_supervised_user_id,
-                        supervisor_profile);
+                        custodian_profile);
       }
       break;
     }
@@ -496,12 +529,30 @@
   }
 }
 
+bool SigninCreateProfileHandler::IsAccountConnected(Profile* profile)
+    const {
+  SigninManagerBase* signin_manager =
+      SigninManagerFactory::GetForProfile(profile);
+  return signin_manager && signin_manager->IsAuthenticated();
+}
+
+bool SigninCreateProfileHandler::HasAuthError(Profile* profile)
+    const {
+  SigninErrorController* error_controller =
+      SigninErrorControllerFactory::GetForProfile(profile);
+  if (!error_controller)
+    return true;
+
+  GoogleServiceAuthError::State state = error_controller->auth_error().state();
+  return state != GoogleServiceAuthError::NONE;
+}
+
 void SigninCreateProfileHandler::DoCreateProfileIfPossible(
     const base::string16& name,
     const std::string& icon_url,
     bool create_shortcut,
     const std::string& supervised_user_id,
-    Profile* supervisor_profile,
+    Profile* custodian_profile,
     const base::DictionaryValue* dict) {
   DCHECK(dict);
   if (!dict->HasKey(supervised_user_id))
@@ -520,7 +571,7 @@
   }
 
   DoCreateProfile(name, icon_url, create_shortcut, supervised_user_id,
-                  supervisor_profile);
+                  custodian_profile);
 }
 
 void SigninCreateProfileHandler::HandleCancelProfileCreation(
@@ -563,7 +614,7 @@
 void SigninCreateProfileHandler::RegisterSupervisedUser(
     bool create_shortcut,
     const std::string& supervised_user_id,
-    Profile* supervisor_profile,
+    Profile* custodian_profile,
     Profile* new_profile) {
   DCHECK_EQ(profile_path_being_created_.value(),
             new_profile->GetPath().value());
@@ -573,9 +624,9 @@
 
   // Register the supervised user using the profile of the custodian.
   supervised_user_registration_utility_ =
-      SupervisedUserRegistrationUtility::Create(supervisor_profile);
+      SupervisedUserRegistrationUtility::Create(custodian_profile);
   supervised_user_service->RegisterAndInitSync(
-      supervised_user_registration_utility_.get(), supervisor_profile,
+      supervised_user_registration_utility_.get(), custodian_profile,
       supervised_user_id,
       base::Bind(&SigninCreateProfileHandler::OnSupervisedUserRegistered,
                  weak_ptr_factory_.GetWeakPtr(), create_shortcut, new_profile));

diff --git a/chrome/browser/ui/webui/signin/signin_create_profile_handler.h b/chrome/browser/ui/webui/signin/signin_create_profile_handler.h
index 05ebe64..5887e87 100644
--- a/chrome/browser/ui/webui/signin/signin_create_profile_handler.h
+++ b/chrome/browser/ui/webui/signin/signin_create_profile_handler.h

@@ -58,6 +58,10 @@
   // Sends the array of default profile icon URLs to WebUI.
   void RequestDefaultProfileIcons(const base::ListValue* args);
 
+  // Sends an object to WebUI of the form: { "name": profileName } after
+  // "requestDefaultProfileIcons" is fulfilled.
+  void SendNewProfileDefaults();
+
   // Callback for the "requestSignedInProfiles" message.
   // Sends the email address of the signed-in user, or an empty string if the
   // user is not signed in. Also sends information about whether supervised
@@ -73,7 +77,7 @@
   //   3: a flag stating whether the user should be supervised
   //      (optional, boolean)
   //   4: a string representing the supervised user ID.
-  //   5: a string representing the supervisor profile path.
+  //   5: a string representing the custodian profile path.
   void CreateProfile(const base::ListValue* args);
 
   // If a local error occurs during profile creation, then show an appropriate
@@ -83,13 +87,13 @@
   // as the final task after a new profile has been created.
   void OnProfileCreated(bool create_shortcut,
                         const std::string& supervised_user_id,
-                        Profile* supervisor_profile,
+                        Profile* custodian_profile,
                         Profile* profile,
                         Profile::CreateStatus status);
 
   void HandleProfileCreationSuccess(bool create_shortcut,
                                     const std::string& supervised_user_id,
-                                    Profile* supervisor_profile,
+                                    Profile* custodian_profile,
                                     Profile* profile);
 
   // Creates desktop shortcut and updates the UI to indicate success
@@ -131,23 +135,23 @@
                        const std::string& icon_url,
                        bool create_shortcut,
                        const std::string& supervised_user_id,
-                       Profile* supervisor_profile);
+                       Profile* custodian_profile);
 
 #if defined(ENABLE_SUPERVISED_USERS)
-  // Extracts the supervised user ID and the supervisor user profile path from
+  // Extracts the supervised user ID and the custodian user profile path from
   // the args passed into CreateProfile.
   bool GetSupervisedCreateProfileArgs(const base::ListValue* args,
                                       std::string* supervised_user_id,
-                                      base::FilePath* supervisor_profile_path);
+                                      base::FilePath* custodian_profile_path);
 
-  // Callback that runs once the supervisor profile has been loaded. It sets
+  // Callback that runs once the custodian profile has been loaded. It sets
   // |profile_creation_type_| if necessary, and calls |DoCreateProfile| if the
   // supervised user id specified in |args| is valid.
-  void LoadSupervisorProfileCallback(const base::string16& name,
+  void LoadCustodianProfileCallback(const base::string16& name,
                                      const std::string& icon_url,
                                      bool create_shortcut,
                                      const std::string& supervised_user_id,
-                                     Profile* supervisor_profile,
+                                     Profile* custodian_profile,
                                      Profile::CreateStatus status);
 
   // Cancels creation of a supervised-user profile currently in progress, as
@@ -166,7 +170,7 @@
   // with the management server.
   void RegisterSupervisedUser(bool create_shortcut,
                               const std::string& managed_user_id,
-                              Profile* supervisor_profile,
+                              Profile* custodian_profile,
                               Profile* new_profile);
 
   // Called back with the result of the supervised user registration.
@@ -179,17 +183,24 @@
   void RecordSupervisedProfileCreationMetrics(
       GoogleServiceAuthError::State error_state);
 
+  // Creates the supervised user with the given |supervised_user_id| if the user
+  // doesn't already exist on the machine.
   void DoCreateProfileIfPossible(const base::string16& name,
                                  const std::string& icon_url,
                                  bool create_shortcut,
                                  const std::string& supervised_user_id,
-                                 Profile* supervisor_profile,
+                                 Profile* custodian_profile,
                                  const base::DictionaryValue* dict);
 
   scoped_ptr<SupervisedUserRegistrationUtility>
       supervised_user_registration_utility_;
 #endif
 
+  // Returns true if profile has signed into chrome.
+  bool IsAccountConnected(Profile* profile) const;
+  // Returns true if profile has authentication error.
+  bool HasAuthError(Profile* profile) const;
+
   base::WeakPtrFactory<SigninCreateProfileHandler> weak_ptr_factory_;
 
   DISALLOW_COPY_AND_ASSIGN(SigninCreateProfileHandler);

diff --git a/chrome/browser/ui/webui/signin/signin_supervised_user_import_handler.cc b/chrome/browser/ui/webui/signin/signin_supervised_user_import_handler.cc
new file mode 100644
index 0000000..b321a70
--- /dev/null
+++ b/chrome/browser/ui/webui/signin/signin_supervised_user_import_handler.cc

@@ -0,0 +1,227 @@
+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "chrome/browser/ui/webui/signin/signin_supervised_user_import_handler.h"
+
+#include <stddef.h>
+
+#include <set>
+#include <vector>
+
+#include "base/bind.h"
+#include "base/macros.h"
+#include "base/value_conversions.h"
+#include "base/values.h"
+#include "chrome/browser/browser_process.h"
+#include "chrome/browser/profiles/profile.h"
+#include "chrome/browser/profiles/profile_avatar_icon_util.h"
+#include "chrome/browser/profiles/profile_info_cache.h"
+#include "chrome/browser/profiles/profile_manager.h"
+#include "chrome/browser/signin/signin_error_controller_factory.h"
+#include "chrome/browser/signin/signin_manager_factory.h"
+#include "chrome/browser/supervised_user/legacy/supervised_user_shared_settings_service.h"
+#include "chrome/browser/supervised_user/legacy/supervised_user_shared_settings_service_factory.h"
+#include "chrome/browser/supervised_user/legacy/supervised_user_sync_service.h"
+#include "chrome/browser/supervised_user/legacy/supervised_user_sync_service_factory.h"
+#include "chrome/browser/supervised_user/supervised_user_constants.h"
+#include "chrome/common/url_constants.h"
+#include "chrome/grit/generated_resources.h"
+#include "components/prefs/pref_service.h"
+#include "components/signin/core/browser/signin_error_controller.h"
+#include "components/signin/core/browser/signin_manager.h"
+#include "content/public/browser/web_ui.h"
+#include "grit/theme_resources.h"
+#include "ui/base/l10n/l10n_util.h"
+
+
+SigninSupervisedUserImportHandler::SigninSupervisedUserImportHandler()
+    : weak_ptr_factory_(this) {
+}
+
+SigninSupervisedUserImportHandler::~SigninSupervisedUserImportHandler() {
+}
+
+void SigninSupervisedUserImportHandler::RegisterMessages() {
+  web_ui()->RegisterMessageCallback("getExistingSupervisedUsers",
+      base::Bind(&SigninSupervisedUserImportHandler::
+                      GetExistingSupervisedUsers,
+                 base::Unretained(this)));
+}
+
+void SigninSupervisedUserImportHandler::AssignWebUICallbackId(
+    const base::ListValue* args) {
+  CHECK_LE(1U, args->GetSize());
+  CHECK(webui_callback_id_.empty());
+  CHECK(args->GetString(0, &webui_callback_id_));
+}
+
+void SigninSupervisedUserImportHandler::GetExistingSupervisedUsers(
+    const base::ListValue* args) {
+  CHECK_EQ(2U, args->GetSize());
+  AssignWebUICallbackId(args);
+
+  base::FilePath custodian_profile_path;
+  const base::Value* profile_path_value;
+  bool success = args->Get(1, &profile_path_value);
+  DCHECK(success);
+  success = base::GetValueAsFilePath(*profile_path_value,
+                                     &custodian_profile_path);
+  DCHECK(success);
+
+  // Load custodian profile.
+  g_browser_process->profile_manager()->CreateProfileAsync(
+      custodian_profile_path,
+      base::Bind(
+          &SigninSupervisedUserImportHandler::LoadCustodianProfileCallback,
+          weak_ptr_factory_.GetWeakPtr()),
+      base::string16(), std::string(), std::string());
+}
+
+void SigninSupervisedUserImportHandler::LoadCustodianProfileCallback(
+    Profile* profile, Profile::CreateStatus status) {
+
+  // This method gets called once before with Profile::CREATE_STATUS_CREATED.
+  switch (status) {
+    case Profile::CREATE_STATUS_LOCAL_FAIL: {
+      // TODO(mahmadi): see if a better error message is required here.
+      RejectCallback(GetLocalErorrMessage());
+      break;
+    }
+    case Profile::CREATE_STATUS_CREATED: {
+      // Ignore the intermediate status.
+      break;
+    }
+    case Profile::CREATE_STATUS_INITIALIZED: {
+      // We are only interested in Profile::CREATE_STATUS_INITIALIZED when
+      // everything is ready.
+      if (profile->IsSupervised())
+        return;
+
+      if (!IsAccountConnected(profile) || HasAuthError(profile)) {
+        RejectCallback(GetAuthErorrMessage());
+        return;
+      }
+
+      SupervisedUserSyncService* supervised_user_sync_service =
+          SupervisedUserSyncServiceFactory::GetForProfile(profile);
+      if (supervised_user_sync_service) {
+        supervised_user_sync_service->GetSupervisedUsersAsync(
+            base::Bind(
+                &SigninSupervisedUserImportHandler::SendExistingSupervisedUsers,
+                weak_ptr_factory_.GetWeakPtr(), profile));
+      }
+      break;
+    }
+    case Profile::CREATE_STATUS_CANCELED:
+    case Profile::CREATE_STATUS_REMOTE_FAIL:
+    case Profile::MAX_CREATE_STATUS: {
+      NOTREACHED();
+      break;
+    }
+  }
+}
+
+void SigninSupervisedUserImportHandler::RejectCallback(
+    const base::string16& error) {
+  web_ui()->CallJavascriptFunction("cr.webUIResponse",
+      base::StringValue(webui_callback_id_),
+      base::FundamentalValue(false),
+      base::StringValue(error));
+  webui_callback_id_.clear();
+}
+
+base::string16 SigninSupervisedUserImportHandler::GetLocalErorrMessage() const {
+  return l10n_util::GetStringUTF16(
+      IDS_LEGACY_SUPERVISED_USER_IMPORT_LOCAL_ERROR);
+}
+
+base::string16 SigninSupervisedUserImportHandler::GetAuthErorrMessage() const {
+  return l10n_util::GetStringUTF16(
+      IDS_PROFILES_CREATE_CUSTODIAN_ACCOUNT_DETAILS_OUT_OF_DATE_ERROR);
+}
+
+void SigninSupervisedUserImportHandler::SendExistingSupervisedUsers(
+    Profile* profile,
+    const base::DictionaryValue* dict) {
+  DCHECK(dict);
+  ProfileInfoCache& cache =
+      g_browser_process->profile_manager()->GetProfileInfoCache();
+  std::vector<ProfileAttributesEntry*> entries =
+      cache.GetAllProfilesAttributes();
+
+  // Collect the ids of local supervised user profiles.
+  std::set<std::string> supervised_user_ids;
+  for (auto& entry : entries) {
+    // Filter out omitted profiles. These are currently being imported, and
+    // shouldn't show up as "already on this device" just yet.
+    if (entry->IsLegacySupervised() && !entry->IsOmitted()) {
+      supervised_user_ids.insert(entry->GetSupervisedUserId());
+    }
+  }
+
+  base::ListValue supervised_users;
+  SupervisedUserSharedSettingsService* service =
+      SupervisedUserSharedSettingsServiceFactory::GetForBrowserContext(profile);
+  for (base::DictionaryValue::Iterator it(*dict); !it.IsAtEnd(); it.Advance()) {
+    const base::DictionaryValue* value = NULL;
+    bool success = it.value().GetAsDictionary(&value);
+    DCHECK(success);
+    std::string name;
+    value->GetString(SupervisedUserSyncService::kName, &name);
+
+    base::DictionaryValue* supervised_user = new base::DictionaryValue;
+    supervised_user->SetString("id", it.key());
+    supervised_user->SetString("name", name);
+
+    int avatar_index = SupervisedUserSyncService::kNoAvatar;
+    const base::Value* avatar_index_value =
+        service->GetValue(it.key(), supervised_users::kChromeAvatarIndex);
+    if (avatar_index_value) {
+      success = avatar_index_value->GetAsInteger(&avatar_index);
+    } else {
+      // Check if there is a legacy avatar index stored.
+      std::string avatar_str;
+      value->GetString(SupervisedUserSyncService::kChromeAvatar, &avatar_str);
+      success =
+          SupervisedUserSyncService::GetAvatarIndex(avatar_str, &avatar_index);
+    }
+    DCHECK(success);
+
+    std::string avatar_url =
+        avatar_index == SupervisedUserSyncService::kNoAvatar ?
+            profiles::GetDefaultAvatarIconUrl(
+                profiles::GetPlaceholderAvatarIndex()) :
+            profiles::GetDefaultAvatarIconUrl(avatar_index);
+    supervised_user->SetString("iconURL", avatar_url);
+    bool on_current_device =
+        supervised_user_ids.find(it.key()) != supervised_user_ids.end();
+    supervised_user->SetBoolean("onCurrentDevice", on_current_device);
+
+    supervised_users.Append(supervised_user);
+  }
+
+  // Resolve callback with response.
+  web_ui()->CallJavascriptFunction("cr.webUIResponse",
+      base::StringValue(webui_callback_id_),
+      base::FundamentalValue(true),
+      supervised_users);
+  webui_callback_id_.clear();
+}
+
+bool SigninSupervisedUserImportHandler::IsAccountConnected(
+      Profile* profile) const {
+  SigninManagerBase* signin_manager =
+      SigninManagerFactory::GetForProfile(profile);
+  return signin_manager && signin_manager->IsAuthenticated();
+}
+
+bool SigninSupervisedUserImportHandler::HasAuthError(Profile* profile) const {
+  SigninErrorController* error_controller =
+      SigninErrorControllerFactory::GetForProfile(profile);
+  if (!error_controller)
+    return true;
+
+  GoogleServiceAuthError::State state = error_controller->auth_error().state();
+  return state != GoogleServiceAuthError::NONE;
+}

diff --git a/chrome/browser/ui/webui/signin/signin_supervised_user_import_handler.h b/chrome/browser/ui/webui/signin/signin_supervised_user_import_handler.h
new file mode 100644
index 0000000..5c792bd
--- /dev/null
+++ b/chrome/browser/ui/webui/signin/signin_supervised_user_import_handler.h

@@ -0,0 +1,76 @@
+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CHROME_BROWSER_UI_WEBUI_SIGNIN_SIGNIN_SUPERVISED_USER_IMPORT_HANDLER_H_
+#define CHROME_BROWSER_UI_WEBUI_SIGNIN_SIGNIN_SUPERVISED_USER_IMPORT_HANDLER_H_
+
+#include <string>
+
+#include "base/callback_list.h"
+#include "base/macros.h"
+#include "base/memory/weak_ptr.h"
+#include "base/scoped_observer.h"
+#include "base/strings/string16.h"
+#include "chrome/browser/profiles/profile.h"
+#include "content/public/browser/web_ui_message_handler.h"
+
+namespace base {
+class DictionaryValue;
+class ListValue;
+}
+
+// Handler for the 'import existing supervised user' dialog.
+class SigninSupervisedUserImportHandler : public content::WebUIMessageHandler {
+ public:
+  SigninSupervisedUserImportHandler();
+  ~SigninSupervisedUserImportHandler() override;
+
+  // WebUIMessageHandler implementation.
+  void RegisterMessages() override;
+
+ private:
+  // Assigns a new |webui_callback_id_|. Ensures that previous in-flight request
+  // has been fulfilled.
+  void AssignWebUICallbackId(const base::ListValue* args);
+
+  // Callback for the "getExistingSupervisedUsers" message.
+  // Checks the sign-in status of the custodian and accordingly
+  // sends an update to the WebUI.
+  void GetExistingSupervisedUsers(const base::ListValue* args);
+
+  void LoadCustodianProfileCallback(Profile* custodian_profile,
+                                     Profile::CreateStatus status);
+
+  // Reject the WebUI callback with an error message.
+  void RejectCallback(const base::string16& error);
+
+  base::string16 GetLocalErorrMessage() const;
+
+  base::string16 GetAuthErorrMessage() const;
+
+  // Sends an array of supervised users to WebUI. Each entry is of the form:
+  //   supervisedProfile = {
+  //     id: "Supervised User ID",
+  //     name: "Supervised User Name",
+  //     iconURL: "chrome://path/to/icon/image",
+  //     onCurrentDevice: true or false,
+  //   }
+  // The array holds all existing supervised users attached to the
+  // custodian's profile which initiated the request.
+  void SendExistingSupervisedUsers(Profile* profile,
+                                   const base::DictionaryValue* dict);
+
+  bool IsAccountConnected(Profile* profile) const;
+  bool HasAuthError(Profile* profile) const;
+
+  // The WebUI callback ID of the last in-flight async request. There is always
+  // only one in-flight such request.
+  std::string webui_callback_id_;
+
+  base::WeakPtrFactory<SigninSupervisedUserImportHandler> weak_ptr_factory_;
+
+  DISALLOW_COPY_AND_ASSIGN(SigninSupervisedUserImportHandler);
+};
+
+#endif // CHROME_BROWSER_UI_WEBUI_SIGNIN_SIGNIN_SUPERVISED_USER_IMPORT_HANDLER_H_

diff --git a/chrome/chrome_browser_ui.gypi b/chrome/chrome_browser_ui.gypi
index eae2a46..a727eda 100644
--- a/chrome/chrome_browser_ui.gypi
+++ b/chrome/chrome_browser_ui.gypi

@@ -1367,6 +1367,8 @@
       'browser/ui/webui/signin/md_user_manager_ui.h',
       'browser/ui/webui/signin/signin_create_profile_handler.cc',
       'browser/ui/webui/signin/signin_create_profile_handler.h',
+      'browser/ui/webui/signin/signin_supervised_user_import_handler.cc',
+      'browser/ui/webui/signin/signin_supervised_user_import_handler.h',
       'browser/ui/webui/signin/sync_confirmation_handler.cc',
       'browser/ui/webui/signin/sync_confirmation_handler.h',
       'browser/ui/webui/signin/sync_confirmation_ui.cc',

diff --git a/chrome/chrome_tests_unit.gypi b/chrome/chrome_tests_unit.gypi
index 95042ca..096dc8d 100644
--- a/chrome/chrome_tests_unit.gypi
+++ b/chrome/chrome_tests_unit.gypi

@@ -1566,9 +1566,10 @@
       'browser/ui/webui/options/language_options_handler_unittest.cc',
       'browser/ui/webui/options/pepper_flash_content_settings_utils_unittest.cc',
       'browser/ui/webui/options/sync_setup_handler_unittest.cc',
+      'browser/ui/webui/settings_utils_unittest.cc',
+      'browser/ui/webui/settings/settings_manage_profile_handler_unittest.cc',
       'browser/ui/webui/settings/people_handler_unittest.cc',
       'browser/ui/webui/settings/reset_settings_handler_unittest.cc',
-      'browser/ui/webui/settings_utils_unittest.cc',
       'browser/ui/webui/settings/site_settings_handler_unittest.cc',
       'browser/ui/webui/signin/login_ui_service_unittest.cc',
       'browser/ui/webui/sync_internals_message_handler_unittest.cc',

diff --git a/chrome/common/chrome_paths.cc b/chrome/common/chrome_paths.cc
index 364a02d..9b44155a 100644
--- a/chrome/common/chrome_paths.cc
+++ b/chrome/common/chrome_paths.cc

@@ -43,10 +43,6 @@
 #if defined(OS_MACOSX)
 const base::FilePath::CharType kPepperFlashSystemBaseDirectory[] =
     FILE_PATH_LITERAL("Internet Plug-Ins/PepperFlashPlayer");
-const base::FilePath::CharType kFlashSystemBaseDirectory[] =
-    FILE_PATH_LITERAL("Internet Plug-Ins");
-const base::FilePath::CharType kFlashSystemPluginName[] =
-    FILE_PATH_LITERAL("Flash Player.plugin");
 #endif
 
 const base::FilePath::CharType kInternalNaClPluginFileName[] =
@@ -90,18 +86,14 @@
 }
 
 #if defined(OS_WIN)
-// Gets the Flash path if installed on the system. |is_npapi| determines whether
-// to return the NPAPI of the PPAPI version of the system plugin.
-bool GetSystemFlashFilename(base::FilePath* out_path, bool is_npapi) {
-  const wchar_t kNpapiFlashRegistryRoot[] =
-      L"SOFTWARE\\Macromedia\\FlashPlayerPlugin";
+// Gets the Pepper Flash path if installed on the system.
+bool GetSystemFlashFilename(base::FilePath* out_path) {
   const wchar_t kPepperFlashRegistryRoot[] =
       L"SOFTWARE\\Macromedia\\FlashPlayerPepper";
   const wchar_t kFlashPlayerPathValueName[] = L"PlayerPath";
 
-  base::win::RegKey path_key(
-      HKEY_LOCAL_MACHINE,
-      is_npapi ? kNpapiFlashRegistryRoot : kPepperFlashRegistryRoot, KEY_READ);
+  base::win::RegKey path_key(HKEY_LOCAL_MACHINE, kPepperFlashRegistryRoot,
+                             KEY_READ);
   base::string16 path_str;
   if (FAILED(path_key.ReadValue(kFlashPlayerPathValueName, &path_str)))
     return false;
@@ -276,7 +268,7 @@
       break;
     case chrome::FILE_PEPPER_FLASH_SYSTEM_PLUGIN:
 #if defined(OS_WIN)
-      if (!GetSystemFlashFilename(&cur, false))
+      if (!GetSystemFlashFilename(&cur))
         return false;
 #elif defined(OS_MACOSX)
       if (!GetLocalLibraryDirectory(&cur))
@@ -289,20 +281,6 @@
       return false;
 #endif
       break;
-    case chrome::FILE_FLASH_SYSTEM_PLUGIN:
-#if defined(OS_WIN)
-      if (!GetSystemFlashFilename(&cur, true))
-        return false;
-#elif defined(OS_MACOSX)
-      if (!GetLocalLibraryDirectory(&cur))
-        return false;
-      cur = cur.Append(kFlashSystemBaseDirectory);
-      cur = cur.Append(kFlashSystemPluginName);
-#else
-      // Chrome on other platforms does not supports system NPAPI binaries.
-      return false;
-#endif
-      break;
     case chrome::FILE_LOCAL_STATE:
       if (!PathService::Get(chrome::DIR_USER_DATA, &cur))
         return false;

diff --git a/chrome/common/chrome_paths.h b/chrome/common/chrome_paths.h
index b651082..a0ed80f6 100644
--- a/chrome/common/chrome_paths.h
+++ b/chrome/common/chrome_paths.h

@@ -84,10 +84,6 @@
                                     // Pepper Flash plugin, downloadable from
                                     // Adobe website. Querying this path might
                                     // succeed no matter the file exists or not.
-  FILE_FLASH_SYSTEM_PLUGIN,     // Full path to the system version of NPAPI
-                                // Flash plugin, downloadable from Adobe
-                                // website. Querying this path might succeed no
-                                // matter the file exists or not.
   FILE_NACL_PLUGIN,             // Full path to the internal NaCl plugin file.
   DIR_PNACL_BASE,               // Full path to the base dir for PNaCl.
   DIR_PNACL_COMPONENT,          // Full path to the latest PNaCl version

diff --git a/chrome/common/pref_names.cc b/chrome/common/pref_names.cc
index 3c1ee55..bee0a4d 100644
--- a/chrome/common/pref_names.cc
+++ b/chrome/common/pref_names.cc

@@ -949,12 +949,6 @@
 // List pref containing names of plugins that are enabled by policy.
 const char kPluginsEnabledPlugins[] = "plugins.plugins_enabled";
 
-// When bundled NPAPI Flash is removed, if at that point it is enabled while
-// Pepper Flash is disabled, we would like to turn on Pepper Flash. And we will
-// want to do so in M45, once, for realz.
-const char kNpapiFlashMigratedToPepperFlash[] =
-    "plugins.npapi_flash_migrated_to_pepper_flash";
-
 #if defined(ENABLE_PLUGINS)
 // Whether about:plugins is shown in the details mode or not.
 const char kPluginsShowDetails[] = "plugins.show_details";

diff --git a/chrome/common/pref_names.h b/chrome/common/pref_names.h
index 813916e4..b39af63 100644
--- a/chrome/common/pref_names.h
+++ b/chrome/common/pref_names.h

@@ -324,7 +324,6 @@
 extern const char kPluginsDisabledPlugins[];
 extern const char kPluginsDisabledPluginsExceptions[];
 extern const char kPluginsEnabledPlugins[];
-extern const char kNpapiFlashMigratedToPepperFlash[];
 #if defined(ENABLE_PLUGINS)
 extern const char kPluginsShowDetails[];
 #endif

diff --git a/chrome/renderer/chrome_render_process_observer.cc b/chrome/renderer/chrome_render_process_observer.cc
index ecad9b7..891c6bcf 100644
--- a/chrome/renderer/chrome_render_process_observer.cc
+++ b/chrome/renderer/chrome_render_process_observer.cc

@@ -239,6 +239,24 @@
   "V8_ES2015_TailCalls", base::FEATURE_DISABLED_BY_DEFAULT
 };
 
+const base::Feature kV8SerializeEagerFeature{"V8_Serialize_Eager",
+                                             base::FEATURE_DISABLED_BY_DEFAULT};
+
+const base::Feature kV8SerializeAgeCodeFeature{
+    "V8_Serialize_Age_Code", base::FEATURE_DISABLED_BY_DEFAULT};
+
+void SetV8FlagIfFeature(const base::Feature& feature, const char* v8_flag) {
+  if (base::FeatureList::IsEnabled(feature)) {
+    v8::V8::SetFlagsFromString(v8_flag, strlen(v8_flag));
+  }
+}
+
+void SetV8FlagIfHasSwitch(const char* switch_name, const char* v8_flag) {
+  if (base::CommandLine::ForCurrentProcess()->HasSwitch(switch_name)) {
+    v8::V8::SetFlagsFromString(v8_flag, strlen(v8_flag));
+  }
+}
+
 }  // namespace
 
 bool ChromeRenderProcessObserver::is_incognito_process_ = false;
@@ -252,25 +270,13 @@
   WebRuntimeFeatures::enableRequestAutocomplete(true);
 #endif
 
-  if (base::FeatureList::IsEnabled(kV8_ES2015_TailCalls_Feature)) {
-    std::string flag("--harmony-tailcalls");
-    v8::V8::SetFlagsFromString(flag.c_str(), static_cast<int>(flag.size()));
-  }
-
-  if (command_line.HasSwitch(switches::kDisableJavaScriptHarmonyShipping)) {
-    std::string flag("--noharmony-shipping");
-    v8::V8::SetFlagsFromString(flag.c_str(), static_cast<int>(flag.size()));
-  }
-
-  if (command_line.HasSwitch(switches::kJavaScriptHarmony)) {
-    std::string flag("--harmony");
-    v8::V8::SetFlagsFromString(flag.c_str(), static_cast<int>(flag.size()));
-  }
-
-  if (command_line.HasSwitch(switches::kEnableWasm)) {
-    std::string flag("--expose-wasm");
-    v8::V8::SetFlagsFromString(flag.c_str(), static_cast<int>(flag.size()));
-  }
+  SetV8FlagIfFeature(kV8_ES2015_TailCalls_Feature, "--harmony-tailcalls");
+  SetV8FlagIfFeature(kV8SerializeEagerFeature, "--serialize_eager");
+  SetV8FlagIfFeature(kV8SerializeAgeCodeFeature, "--serialize_age_code");
+  SetV8FlagIfHasSwitch(switches::kDisableJavaScriptHarmonyShipping,
+                       "--noharmony-shipping");
+  SetV8FlagIfHasSwitch(switches::kJavaScriptHarmony, "--harmony");
+  SetV8FlagIfHasSwitch(switches::kEnableWasm, "--expose-wasm");
 
   RenderThread* thread = RenderThread::Get();
   resource_delegate_.reset(new RendererResourceDelegate());

diff --git a/chrome/service/service_utility_process_host.cc b/chrome/service/service_utility_process_host.cc
index 957f3e6..8389a10 100644
--- a/chrome/service/service_utility_process_host.cc
+++ b/chrome/service/service_utility_process_host.cc

@@ -95,7 +95,7 @@
     if (!temp_dir_.CreateUniqueTempDir())
       return false;
     return host_->Send(new ChromeUtilityMsg_RenderPDFPagesToMetafiles(
-        IPC::TakeFileHandleForProcess(std::move(pdf_file), host_->handle()),
+        IPC::TakePlatformFileForTransit(std::move(pdf_file)),
         conversion_settings));
   }
 

diff --git a/chrome/test/data/webui/md_user_manager/create_profile_tests.js b/chrome/test/data/webui/md_user_manager/create_profile_tests.js
index a0ed5242..072ac599 100644
--- a/chrome/test/data/webui/md_user_manager/create_profile_tests.js
+++ b/chrome/test/data/webui/md_user_manager/create_profile_tests.js

@@ -24,9 +24,14 @@
 
         // Replace real proxy with mock proxy.
         signin.ProfileBrowserProxyImpl.instance_ = browserProxy;
+        browserProxy.setDefaultProfileInfo({name: 'profile name'});
         browserProxy.setIconUrls(['icon1.png', 'icon2.png']);
         browserProxy.setSignedInUsers([{username: 'username',
                                         profilePath: 'path/to/profile'}]);
+        browserProxy.setExistingSupervisedUsers([{name: 'existing name 1',
+                                                  onCurrentDevice: true},
+                                                 {name: 'existing name 2',
+                                                  onCurrentDevice: false}]);
 
         createProfileElement = createElement();
 
@@ -50,69 +55,165 @@
           assertEquals('path/to/profile',
                        createProfileElement.signedInUsers_[0].profilePath);
 
-          // The dropdown menu is populated.
-          Polymer.dom.flush();
-          var users = createProfileElement.querySelectorAll('paper-item');
-          assertEquals(1, users.length);
+          // The 'learn more' link is visible.
+          assertTrue(!!createProfileElement.$$('#learn-more'));
 
-          assertTrue(createProfileElement.$.noSignedInUserContainer.hidden);
+          // The dropdown menu is visible only when the checkbox is checked.
+          assertFalse(!!createProfileElement.$$('paper-dropdown-menu'));
+
+          // Simulate checking the checkbox.
+          MockInteractions.tap(createProfileElement.$$('paper-checkbox'));
+          Polymer.dom.flush();
+
+          // The dropdown menu is visible and is populated with the sentinel
+          // item as well as the signed in users.
+          var dropdownMenu = createProfileElement.$$('paper-dropdown-menu');
+          assertTrue(!!dropdownMenu);
+          var users = dropdownMenu.querySelectorAll('paper-item');
+          assertEquals(2, users.length);
         });
       });
 
-      test('Name is empty by default', function() {
-        assertEquals('', createProfileElement.$.nameInput.value);
+      test('Sentinel item is the initially selected item', function() {
+        return browserProxy.whenCalled('getSignedInUsers').then(function() {
+          // Simulate checking the checkbox.
+          MockInteractions.tap(createProfileElement.$$('paper-checkbox'));
+          Polymer.dom.flush();
+
+          var dropdownMenu = createProfileElement.$$('paper-dropdown-menu');
+          var paperMenu = dropdownMenu.querySelector('paper-menu');
+          assertEquals(createProfileElement.i18n('selectAnAccount'),
+                       paperMenu.selectedItem.textContent.trim());
+        });
+      });
+
+      test('Name is non-empty by default', function() {
+        assertEquals('profile name', createProfileElement.$.nameInput.value);
       });
 
       test('Create button is disabled if name is empty or invalid', function() {
-        assertEquals('', createProfileElement.$.nameInput.value);
+        assertEquals('profile name', createProfileElement.$.nameInput.value);
+        assertFalse(createProfileElement.$.nameInput.invalid);
+        assertFalse(createProfileElement.$.save.disabled);
+
+        createProfileElement.$.nameInput.value = '';
         assertTrue(createProfileElement.$.save.disabled);
 
         createProfileElement.$.nameInput.value = ' ';
         assertTrue(createProfileElement.$.nameInput.invalid);
         assertTrue(createProfileElement.$.save.disabled);
-
-        createProfileElement.$.nameInput.value = 'foo';
-        assertFalse(createProfileElement.$.nameInput.invalid);
-        assertFalse(createProfileElement.$.save.disabled);
       });
 
       test('Create a profile', function() {
-        // Set the text in the name field.
-        createProfileElement.$.nameInput.value = 'foo';
-
         // Simulate clicking 'Create'.
         MockInteractions.tap(createProfileElement.$.save);
 
         return browserProxy.whenCalled('createProfile').then(function(args) {
-          assertEquals('foo', args.profileName);
+          assertEquals('profile name', args.profileName);
           assertEquals('icon1.png', args.profileIconUrl);
           assertFalse(args.isSupervised);
-          assertEquals('path/to/profile', args.supervisorProfilePath);
+          assertEquals('', args.custodianProfilePath);
         });
       });
 
-      test('Create supervised profile', function() {
-        // Set the text in the name field.
-        createProfileElement.$.nameInput.value = 'foo';
-
+      test('Has to select a custodian for the supervised profile', function() {
         // Simulate checking the checkbox.
         MockInteractions.tap(createProfileElement.$$('paper-checkbox'));
+        Polymer.dom.flush();
+
+        // Simulate clicking 'Create'.
+        MockInteractions.tap(createProfileElement.$.save);
+
+        // Create is not in progress.
+        assertFalse(createProfileElement.createInProgress_);
+        // Message container is visible.
+        assertFalse(createProfileElement.$$('#message-container').hidden);
+        // Error message is set.
+        assertEquals(
+            createProfileElement.i18n('custodianAccountNotSelectedError'),
+            createProfileElement.$.message.innerHTML);
+      });
+
+      test('Supervised profile name is duplicate (on the device)', function() {
+        // Simulate checking the checkbox.
+        MockInteractions.tap(createProfileElement.$$('paper-checkbox'));
+        Polymer.dom.flush();
+
+        // There is an existing supervised user with this name on the device.
+        createProfileElement.$.nameInput.value = 'existing name 1';
+
+        // Select the first signed in user.
+        var dropdownMenu = createProfileElement.$$('paper-dropdown-menu');
+        var paperMenu = dropdownMenu.querySelector('paper-menu');
+        paperMenu.selected = 0;
+
+        // Simulate clicking 'Create'.
+        MockInteractions.tap(createProfileElement.$.save);
+
+        return browserProxy.whenCalled('getExistingSupervisedUsers').then(
+            function(args) {
+              // Create is not in progress.
+              assertFalse(createProfileElement.createInProgress_);
+              // Message container is visible.
+              assertFalse(createProfileElement.$$('#message-container').hidden);
+              // Error message is set.
+              var message = createProfileElement.i18n(
+                  'managedProfilesExistingLocalSupervisedUser');
+              assertEquals(message, createProfileElement.$.message.innerHTML);
+            });
+      });
+
+      test('Supervised profile name is duplicate (remote)', function() {
+        // Simulate checking the checkbox.
+        MockInteractions.tap(createProfileElement.$$('paper-checkbox'));
+        Polymer.dom.flush();
+
+        // There is an existing supervised user with this name on the device.
+        createProfileElement.$.nameInput.value = 'existing name 2';
+
+        // Select the first signed in user.
+        var dropdownMenu = createProfileElement.$$('paper-dropdown-menu');
+        var paperMenu = dropdownMenu.querySelector('paper-menu');
+        paperMenu.selected = 0;
+
+        // Simulate clicking 'Create'.
+        MockInteractions.tap(createProfileElement.$.save);
+
+        return browserProxy.whenCalled('getExistingSupervisedUsers').then(
+            function(args) {
+              // Create is not in progress.
+              assertFalse(createProfileElement.createInProgress_);
+              // Message container is visible.
+              assertFalse(createProfileElement.$$('#message-container').hidden);
+              // Error message contains a link to import the supervised user.
+              var message = createProfileElement.$.message;
+              assertTrue(
+                  !!message.querySelector('#supervised-user-import-existing'));
+            });
+      });
+
+      test('Create supervised profile', function() {
+        // Simulate checking the checkbox.
+        MockInteractions.tap(createProfileElement.$$('paper-checkbox'));
+        Polymer.dom.flush();
+
+        // Select the first signed in user.
+        var dropdownMenu = createProfileElement.$$('paper-dropdown-menu');
+        var paperMenu = dropdownMenu.querySelector('paper-menu');
+        paperMenu.selected = 0;
 
         // Simulate clicking 'Create'.
         MockInteractions.tap(createProfileElement.$.save);
 
         return browserProxy.whenCalled('createProfile').then(function(args) {
-          assertEquals('foo', args.profileName);
+          assertEquals('profile name', args.profileName);
           assertEquals('icon1.png', args.profileIconUrl);
           assertTrue(args.isSupervised);
-          assertEquals('path/to/profile', args.supervisorProfilePath);
+          assertEquals('path/to/profile', args.custodianProfilePath);
         });
       });
 
       test('Cancel creating a profile', function() {
-        // Set the text in the name field.
-        createProfileElement.$.nameInput.value = 'foo';
-
         // Simulate clicking 'Create'.
         MockInteractions.tap(createProfileElement.$.save);
 
@@ -135,10 +236,12 @@
       test('Leave the page by clicking the Cancel button', function() {
         return new Promise(function(resolve, reject) {
           // Create is not in progress. We expect to leave the page.
-          createProfileElement.addEventListener('change-page', function() {
+          createProfileElement.addEventListener('change-page', function(event) {
             // This should not be called if create is not in progress.
-            if (!browserProxy.cancelCreateProfileCalled)
+            if (!browserProxy.cancelCreateProfileCalled &&
+                event.detail.page == 'user-pods-page') {
               resolve();
+            }
           });
 
           // Simulate clicking 'Cancel'.
@@ -151,9 +254,6 @@
           // Create was successful. We expect to leave the page.
           createProfileElement.addEventListener('change-page', resolve);
 
-          // Set the text in the name field.
-          createProfileElement.$.nameInput.value = 'foo';
-
           // Simulate clicking 'Create'.
           MockInteractions.tap(createProfileElement.$.save);
 
@@ -171,9 +271,6 @@
       });
 
       test('Create profile error', function() {
-        // Set the text in the name field.
-        createProfileElement.$.nameInput.value = 'foo';
-
         // Simulate clicking 'Create'.
         MockInteractions.tap(createProfileElement.$.save);
 
@@ -184,7 +281,7 @@
           assertFalse(createProfileElement.createInProgress_);
           // Error message is set.
           assertEquals('Error Message',
-                       createProfileElement.$.messageBubble.innerHTML);
+                       createProfileElement.$.message.innerHTML);
         });
       });
 
@@ -203,7 +300,20 @@
           assertFalse(createProfileElement.createInProgress_);
           // Warning message is set.
           assertEquals('Warning Message',
-                       createProfileElement.$.messageBubble.innerHTML);
+                       createProfileElement.$.message.innerHTML);
+        });
+      });
+
+      test('Learn more link takes you to the correct page', function() {
+        return new Promise(function(resolve, reject) {
+          // Create is not in progress. We expect to leave the page.
+          createProfileElement.addEventListener('change-page', function(event) {
+            if (event.detail.page == 'supervised-learn-more-page')
+              resolve();
+          });
+
+          // Simulate clicking 'Learn more'.
+          MockInteractions.tap(createProfileElement.$$('#learn-more'));
         });
       });
     });
@@ -226,11 +336,9 @@
         return browserProxy.whenCalled('getSignedInUsers').then(function() {
           assertEquals(0, createProfileElement.signedInUsers_.length);
 
-          // The dropdown menu is empty.
-          var users = createProfileElement.querySelectorAll('paper-item');
-          assertEquals(0, users.length);
-
-          assertFalse(createProfileElement.$.noSignedInUserContainer.hidden);
+          // '#supervised-user-container' is not present in the DOM.
+          var container = createProfileElement.$$('#supervised-user-container');
+          assertFalse(!!container);
         });
       });
 

diff --git a/chrome/test/data/webui/md_user_manager/test_profile_browser_proxy.js b/chrome/test/data/webui/md_user_manager/test_profile_browser_proxy.js
index c821879..c2b93742 100644
--- a/chrome/test/data/webui/md_user_manager/test_profile_browser_proxy.js
+++ b/chrome/test/data/webui/md_user_manager/test_profile_browser_proxy.js

@@ -17,7 +17,8 @@
     'createProfile',
     'cancelCreateProfile',
     'initializeUserManager',
-    'launchUser'
+    'launchUser',
+    'getExistingSupervisedUsers',
   ]);
 
   /** @private {!Array<string>} */
@@ -25,6 +26,12 @@
 
   /** @private {!Array<SignedInUser>} */
   this.signedInUsers_ = [];
+
+  /** @private {!ProfileInfo} */
+  this.defaultProfileInfo_ = {};
+
+  /** @private {!Array<SupervisedUser>} */
+  this.existingSupervisedUsers_ = [];
 };
 
 TestProfileBrowserProxy.prototype = {
@@ -44,10 +51,26 @@
     this.signedInUsers_ = signedInUsers;
   },
 
+  /**
+   * @param {!ProfileInfo} profileInfo
+   */
+  setDefaultProfileInfo: function(profileInfo) {
+    this.defaultProfileInfo_ = profileInfo;
+  },
+
+  /**
+   * @param {!Array<SupervisedUser>} supervisedUsers
+   */
+  setExistingSupervisedUsers: function(supervisedUsers) {
+    this.existingSupervisedUsers_ = supervisedUsers;
+  },
+
   /** @override */
   getAvailableIcons: function() {
     this.methodCalled('getAvailableIcons');
     cr.webUIListenerCallback('profile-icons-received', this.iconUrls_);
+    cr.webUIListenerCallback('profile-defaults-received',
+                             this.defaultProfileInfo_);
   },
 
   /** @override */
@@ -68,16 +91,22 @@
 
   /** @override */
   createProfile: function(profileName, profileIconUrl, isSupervised,
-        supervisorProfilePath) {
+        custodianProfilePath) {
     this.methodCalled('createProfile',
                       {profileName: profileName,
                        profileIconUrl: profileIconUrl,
                        isSupervised: isSupervised,
-                       supervisorProfilePath: supervisorProfilePath});
+                       custodianProfilePath: custodianProfilePath});
   },
 
   /** @override */
   launchGuestUser: function() {
     this.methodCalled('launchGuestUser');
-  }
+  },
+
+  /** @override */
+  getExistingSupervisedUsers: function() {
+    this.methodCalled('getExistingSupervisedUsers');
+    return Promise.resolve(this.existingSupervisedUsers_);
+  },
 };

diff --git a/components/autofill/content/common/autofill_param_traits_macros.h b/components/autofill/content/common/autofill_param_traits_macros.h
index 2afd0471..ed94ab8 100644
--- a/components/autofill/content/common/autofill_param_traits_macros.h
+++ b/components/autofill/content/common/autofill_param_traits_macros.h

@@ -51,6 +51,7 @@
   IPC_STRUCT_TRAITS_MEMBER(form_data)
   IPC_STRUCT_TRAITS_MEMBER(layout)
   IPC_STRUCT_TRAITS_MEMBER(was_parsed_using_autofill_predictions)
+  IPC_STRUCT_TRAITS_MEMBER(does_look_like_signup_form)
 IPC_STRUCT_TRAITS_END()
 
 #endif  // COMPONENTS_AUTOFILL_CONTENT_COMMON_AUTOFILL_PARAM_TRAITS_MACROS_H_

diff --git a/components/autofill/content/renderer/password_form_conversion_utils.cc b/components/autofill/content/renderer/password_form_conversion_utils.cc
index dc6bf7b..4780a84 100644
--- a/components/autofill/content/renderer/password_form_conversion_utils.cc
+++ b/components/autofill/content/renderer/password_form_conversion_utils.cc

@@ -389,6 +389,7 @@
       form, &ignore_invisible_passwords, &ignore_invisible_usernames);
   std::string layout_sequence;
   layout_sequence.reserve(form.control_elements.size());
+  size_t number_of_non_empty_text_non_password_fields = 0;
   for (size_t i = 0; i < form.control_elements.size(); ++i) {
     WebFormControlElement control_element = form.control_elements[i];
 
@@ -403,6 +404,10 @@
           continue;
         layout_sequence.push_back('P');
       } else {
+        if (nonscript_modified_values &&
+            nonscript_modified_values->find(*input_element) !=
+                nonscript_modified_values->end())
+          ++number_of_non_empty_text_non_password_fields;
         if (element_is_invisible && ignore_invisible_usernames)
           continue;
         layout_sequence.push_back('N');
@@ -594,6 +599,14 @@
   password_form->blacklisted_by_user = false;
   password_form->type = PasswordForm::TYPE_MANUAL;
 
+  // The password form is considered that it looks like SignUp form if it has
+  // more than 1 text field with user input or it has a new password field and
+  // no current password field.
+  password_form->does_look_like_signup_form =
+      number_of_non_empty_text_non_password_fields > 1 ||
+      (number_of_non_empty_text_non_password_fields == 1 &&
+       password_form->password_element.empty() &&
+       !password_form->new_password_element.empty());
   return true;
 }
 

diff --git a/components/autofill/content/renderer/password_form_conversion_utils_browsertest.cc b/components/autofill/content/renderer/password_form_conversion_utils_browsertest.cc
index 46969b4..dc790c1 100644
--- a/components/autofill/content/renderer/password_form_conversion_utils_browsertest.cc
+++ b/components/autofill/content/renderer/password_form_conversion_utils_browsertest.cc

@@ -49,7 +49,7 @@
   // Appends a new text-type field at the end of the form, having the specified
   // |name_and_id|, |value|, and |autocomplete| attributes. The |autocomplete|
   // argument can take two special values, namely:
-  //  1.) NULL, causing no autocomplete attribute to be added,
+  //  1.) nullptr, causing no autocomplete attribute to be added,
   //  2.) "", causing an empty attribute (i.e. autocomplete="") to be added.
   void AddTextField(const char* name_and_id,
                     const char* value,
@@ -167,24 +167,29 @@
 
  protected:
   // Loads the given |html|, retrieves the sole WebFormElement from it, and then
-  // calls CreatePasswordForm(), passing it the |predictions| to convert it into
-  // a |password_form|. Note that ASSERT() can only be used in void functions,
-  // this is why |password_form| is passed in as a pointer to a scoped_ptr.
-  void LoadHTMLAndConvertForm(const std::string& html,
-                              std::unique_ptr<PasswordForm>* password_form,
-                              FormsPredictionsMap* predictions) {
+  // calls CreatePasswordForm(), passing it the |predictions| to convert it to
+  // a PasswordForm. If |with_user_input| == true it's considered that all
+  // values in the form elements came from the user input.
+  std::unique_ptr<PasswordForm> LoadHTMLAndConvertForm(
+      const std::string& html,
+      FormsPredictionsMap* predictions,
+      bool with_user_input) {
     WebFormElement form;
     LoadWebFormFromHTML(html, &form);
 
     WebVector<WebFormControlElement> control_elements;
     form.getFormControlElements(control_elements);
+    ModifiedValues user_input;
     for (size_t i = 0; i < control_elements.size(); ++i) {
       WebInputElement* input_element = toWebInputElement(&control_elements[i]);
       if (input_element->hasAttribute("set-activated-submit"))
         input_element->setActivatedSubmit(true);
+      if (with_user_input)
+        user_input[*input_element] = input_element->value();
     }
 
-    *password_form = CreatePasswordFormFromWebForm(form, nullptr, predictions);
+    return CreatePasswordFormFromWebForm(
+        form, with_user_input ? &user_input : nullptr, predictions);
   }
 
   // Iterates on the form generated by the |html| and adds the fields and type
@@ -237,16 +242,15 @@
 
 TEST_F(MAYBE_PasswordFormConversionUtilsTest, BasicFormAttributes) {
   PasswordFormBuilder builder(kTestFormActionURL);
-  builder.AddTextField("username", "johnsmith", NULL);
+  builder.AddTextField("username", "johnsmith", nullptr);
   builder.AddSubmitButton("inactive_submit");
   builder.AddSubmitButton("active_submit");
   builder.AddSubmitButton("inactive_submit2");
-  builder.AddPasswordField("password", "secret", NULL);
+  builder.AddPasswordField("password", "secret", nullptr);
   std::string html = builder.ProduceHTML();
 
-  std::unique_ptr<PasswordForm> password_form;
-  ASSERT_NO_FATAL_FAILURE(
-      LoadHTMLAndConvertForm(html, &password_form, nullptr));
+  std::unique_ptr<PasswordForm> password_form =
+      LoadHTMLAndConvertForm(html, nullptr, false);
   ASSERT_TRUE(password_form);
 
   EXPECT_EQ("data:", password_form->signon_realm);
@@ -264,16 +268,15 @@
 
 TEST_F(MAYBE_PasswordFormConversionUtilsTest, DisabledFieldsAreIgnored) {
   PasswordFormBuilder builder(kTestFormActionURL);
-  builder.AddTextField("username", "johnsmith", NULL);
+  builder.AddTextField("username", "johnsmith", nullptr);
   builder.AddDisabledUsernameField();
   builder.AddDisabledPasswordField();
-  builder.AddPasswordField("password", "secret", NULL);
+  builder.AddPasswordField("password", "secret", nullptr);
   builder.AddSubmitButton("submit");
   std::string html = builder.ProduceHTML();
 
-  std::unique_ptr<PasswordForm> password_form;
-  ASSERT_NO_FATAL_FAILURE(
-      LoadHTMLAndConvertForm(html, &password_form, nullptr));
+  std::unique_ptr<PasswordForm> password_form =
+      LoadHTMLAndConvertForm(html, nullptr, false);
   ASSERT_TRUE(password_form);
   EXPECT_EQ(base::UTF8ToUTF16("username"), password_form->username_element);
   EXPECT_EQ(base::UTF8ToUTF16("johnsmith"), password_form->username_value);
@@ -293,18 +296,20 @@
       // When no elements are marked with autocomplete='username', the text-type
       // input field before the first password element should get selected as
       // the username, and the rest should be marked as alternatives.
-      {{NULL, NULL, NULL}, "username2", "William", "John+Smith"},
+      {{nullptr, nullptr, nullptr}, "username2", "William", "John+Smith"},
       // When a sole element is marked with autocomplete='username', it should
       // be treated as the username for sure, with no other_possible_usernames.
-      {{"username", NULL, NULL}, "username1", "John", ""},
-      {{NULL, "username", NULL}, "username2", "William", ""},
-      {{NULL, NULL, "username"}, "username3", "Smith", ""},
+      {{"username", nullptr, nullptr}, "username1", "John", ""},
+      {{nullptr, "username", nullptr}, "username2", "William", ""},
+      {{nullptr, nullptr, "username"}, "username3", "Smith", ""},
       // When >=2 elements have the attribute, the first should be selected as
       // the username, and the rest should go to other_possible_usernames.
-      {{"username", "username", NULL}, "username1", "John", "William"},
-      {{NULL, "username", "username"}, "username2", "William", "Smith"},
-      {{"username", NULL, "username"}, "username1", "John", "Smith"},
-      {{"username", "username", "username"}, "username1", "John",
+      {{"username", "username", nullptr}, "username1", "John", "William"},
+      {{nullptr, "username", "username"}, "username2", "William", "Smith"},
+      {{"username", nullptr, "username"}, "username1", "John", "Smith"},
+      {{"username", "username", "username"},
+       "username1",
+       "John",
        "William+Smith"},
       // When there is an empty autocomplete attribute (i.e. autocomplete=""),
       // it should have the same effect as having no attribute whatsoever.
@@ -312,8 +317,8 @@
       {{"", "", "username"}, "username3", "Smith", ""},
       {{"username", "", "username"}, "username1", "John", "Smith"},
       // It should not matter if attribute values are upper or mixed case.
-      {{"USERNAME", NULL, "uSeRNaMe"}, "username1", "John", "Smith"},
-      {{"uSeRNaMe", NULL, "USERNAME"}, "username1", "John", "Smith"}};
+      {{"USERNAME", nullptr, "uSeRNaMe"}, "username1", "John", "Smith"},
+      {{"uSeRNaMe", nullptr, "USERNAME"}, "username1", "John", "Smith"}};
 
   for (size_t i = 0; i < arraysize(cases); ++i) {
     for (size_t nonempty_username_fields = 0; nonempty_username_fields < 2;
@@ -336,15 +341,14 @@
       PasswordFormBuilder builder(kTestFormActionURL);
       builder.AddTextField("username1", names[0], cases[i].autocomplete[0]);
       builder.AddTextField("username2", names[1], cases[i].autocomplete[1]);
-      builder.AddPasswordField("password", "secret", NULL);
+      builder.AddPasswordField("password", "secret", nullptr);
       builder.AddTextField("username3", names[2], cases[i].autocomplete[2]);
-      builder.AddPasswordField("password2", "othersecret", NULL);
+      builder.AddPasswordField("password2", "othersecret", nullptr);
       builder.AddSubmitButton("submit");
       std::string html = builder.ProduceHTML();
 
-      std::unique_ptr<PasswordForm> password_form;
-      ASSERT_NO_FATAL_FAILURE(
-          LoadHTMLAndConvertForm(html, &password_form, nullptr));
+      std::unique_ptr<PasswordForm> password_form =
+          LoadHTMLAndConvertForm(html, nullptr, false);
       ASSERT_TRUE(password_form);
 
       EXPECT_EQ(base::UTF8ToUTF16(cases[i].expected_username_element),
@@ -395,16 +399,15 @@
     SCOPED_TRACE(testing::Message() << "Iteration " << i);
 
     PasswordFormBuilder builder(kTestFormActionURL);
-    builder.AddTextField("username1", "William", NULL);
-    builder.AddPasswordField("password1", cases[i].password_values[0], NULL);
-    builder.AddTextField("username2", "Smith", NULL);
-    builder.AddPasswordField("password2", cases[i].password_values[1], NULL);
+    builder.AddTextField("username1", "William", nullptr);
+    builder.AddPasswordField("password1", cases[i].password_values[0], nullptr);
+    builder.AddTextField("username2", "Smith", nullptr);
+    builder.AddPasswordField("password2", cases[i].password_values[1], nullptr);
     builder.AddSubmitButton("submit");
     std::string html = builder.ProduceHTML();
 
-    std::unique_ptr<PasswordForm> password_form;
-    ASSERT_NO_FATAL_FAILURE(
-        LoadHTMLAndConvertForm(html, &password_form, nullptr));
+    std::unique_ptr<PasswordForm> password_form =
+        LoadHTMLAndConvertForm(html, nullptr, false);
     ASSERT_TRUE(password_form);
 
     EXPECT_EQ(base::UTF8ToUTF16(cases[i].expected_password_element),
@@ -456,17 +459,16 @@
     SCOPED_TRACE(testing::Message() << "Iteration " << i);
 
     PasswordFormBuilder builder(kTestFormActionURL);
-    builder.AddTextField("username1", "William", NULL);
-    builder.AddPasswordField("password1", cases[i].password_values[0], NULL);
-    builder.AddPasswordField("password2", cases[i].password_values[1], NULL);
-    builder.AddTextField("username2", "Smith", NULL);
-    builder.AddPasswordField("password3", cases[i].password_values[2], NULL);
+    builder.AddTextField("username1", "William", nullptr);
+    builder.AddPasswordField("password1", cases[i].password_values[0], nullptr);
+    builder.AddPasswordField("password2", cases[i].password_values[1], nullptr);
+    builder.AddTextField("username2", "Smith", nullptr);
+    builder.AddPasswordField("password3", cases[i].password_values[2], nullptr);
     builder.AddSubmitButton("submit");
     std::string html = builder.ProduceHTML();
 
-    std::unique_ptr<PasswordForm> password_form;
-    ASSERT_NO_FATAL_FAILURE(
-        LoadHTMLAndConvertForm(html, &password_form, nullptr));
+    std::unique_ptr<PasswordForm> password_form =
+        LoadHTMLAndConvertForm(html, nullptr, false);
     ASSERT_TRUE(password_form);
 
     EXPECT_EQ(base::UTF8ToUTF16(cases[i].expected_password_element),
@@ -509,105 +511,320 @@
       // Username is the element just before the first 'current-password' (even
       // if 'new-password' comes earlier). If no 'current-password', then the
       // element just before the first 'new-passwords'.
-      {{"current-password", NULL, NULL},
-       "password1", "alpha", "", "", false, "username1", "William"},
-      {{NULL, "current-password", NULL},
-       "password2", "beta", "", "", false, "username2", "Smith"},
-      {{NULL, NULL, "current-password"},
-       "password3", "gamma", "", "", false, "username2", "Smith"},
-      {{NULL, "current-password", "current-password"},
-       "password2", "beta", "", "", false, "username2", "Smith"},
-      {{"current-password", NULL, "current-password"},
-       "password1", "alpha", "", "", false, "username1", "William"},
-      {{"current-password", "current-password", NULL},
-       "password1", "alpha", "", "", false, "username1", "William"},
+      {{"current-password", nullptr, nullptr},
+       "password1",
+       "alpha",
+       "",
+       "",
+       false,
+       "username1",
+       "William"},
+      {{nullptr, "current-password", nullptr},
+       "password2",
+       "beta",
+       "",
+       "",
+       false,
+       "username2",
+       "Smith"},
+      {{nullptr, nullptr, "current-password"},
+       "password3",
+       "gamma",
+       "",
+       "",
+       false,
+       "username2",
+       "Smith"},
+      {{nullptr, "current-password", "current-password"},
+       "password2",
+       "beta",
+       "",
+       "",
+       false,
+       "username2",
+       "Smith"},
+      {{"current-password", nullptr, "current-password"},
+       "password1",
+       "alpha",
+       "",
+       "",
+       false,
+       "username1",
+       "William"},
+      {{"current-password", "current-password", nullptr},
+       "password1",
+       "alpha",
+       "",
+       "",
+       false,
+       "username1",
+       "William"},
       {{"current-password", "current-password", "current-password"},
-       "password1", "alpha", "", "", false, "username1", "William"},
+       "password1",
+       "alpha",
+       "",
+       "",
+       false,
+       "username1",
+       "William"},
       // The same goes vice versa for autocomplete='new-password'.
-      {{"new-password", NULL, NULL},
-       "", "", "password1", "alpha", true, "username1", "William"},
-      {{NULL, "new-password", NULL},
-       "", "", "password2", "beta", true, "username2", "Smith"},
-      {{NULL, NULL, "new-password"},
-       "", "", "password3", "gamma", true, "username2", "Smith"},
-      {{NULL, "new-password", "new-password"},
-       "", "", "password2", "beta", true, "username2", "Smith"},
-      {{"new-password", NULL, "new-password"},
-       "", "", "password1", "alpha", true, "username1", "William"},
-      {{"new-password", "new-password", NULL},
-       "", "", "password1", "alpha", true, "username1", "William"},
+      {{"new-password", nullptr, nullptr},
+       "",
+       "",
+       "password1",
+       "alpha",
+       true,
+       "username1",
+       "William"},
+      {{nullptr, "new-password", nullptr},
+       "",
+       "",
+       "password2",
+       "beta",
+       true,
+       "username2",
+       "Smith"},
+      {{nullptr, nullptr, "new-password"},
+       "",
+       "",
+       "password3",
+       "gamma",
+       true,
+       "username2",
+       "Smith"},
+      {{nullptr, "new-password", "new-password"},
+       "",
+       "",
+       "password2",
+       "beta",
+       true,
+       "username2",
+       "Smith"},
+      {{"new-password", nullptr, "new-password"},
+       "",
+       "",
+       "password1",
+       "alpha",
+       true,
+       "username1",
+       "William"},
+      {{"new-password", "new-password", nullptr},
+       "",
+       "",
+       "password1",
+       "alpha",
+       true,
+       "username1",
+       "William"},
       {{"new-password", "new-password", "new-password"},
-       "", "", "password1", "alpha", true, "username1", "William"},
+       "",
+       "",
+       "password1",
+       "alpha",
+       true,
+       "username1",
+       "William"},
       // When there is one element marked with autocomplete='current-password',
       // and one with 'new-password', just comply. Ignore the unmarked password
       // field(s) for the same reason as above.
-      {{"current-password", "new-password", NULL},
-       "password1", "alpha", "password2", "beta", true, "username1", "William"},
-      {{"current-password", NULL, "new-password"},
-       "password1", "alpha", "password3", "gamma", true, "username1","William"},
-      {{NULL, "current-password", "new-password"},
-       "password2", "beta", "password3", "gamma", true, "username2", "Smith"},
-      {{"new-password", "current-password", NULL},
-       "password2", "beta", "password1", "alpha", true, "username2", "Smith"},
-      {{"new-password", NULL, "current-password"},
-       "password3", "gamma", "password1", "alpha", true, "username2","Smith"},
-      {{NULL, "new-password", "current-password"},
-       "password3", "gamma", "password2", "beta", true, "username2", "Smith"},
+      {{"current-password", "new-password", nullptr},
+       "password1",
+       "alpha",
+       "password2",
+       "beta",
+       true,
+       "username1",
+       "William"},
+      {{"current-password", nullptr, "new-password"},
+       "password1",
+       "alpha",
+       "password3",
+       "gamma",
+       true,
+       "username1",
+       "William"},
+      {{nullptr, "current-password", "new-password"},
+       "password2",
+       "beta",
+       "password3",
+       "gamma",
+       true,
+       "username2",
+       "Smith"},
+      {{"new-password", "current-password", nullptr},
+       "password2",
+       "beta",
+       "password1",
+       "alpha",
+       true,
+       "username2",
+       "Smith"},
+      {{"new-password", nullptr, "current-password"},
+       "password3",
+       "gamma",
+       "password1",
+       "alpha",
+       true,
+       "username2",
+       "Smith"},
+      {{nullptr, "new-password", "current-password"},
+       "password3",
+       "gamma",
+       "password2",
+       "beta",
+       true,
+       "username2",
+       "Smith"},
       // In case of duplicated elements of either kind, go with the first one of
       // its kind.
       {{"current-password", "current-password", "new-password"},
-       "password1", "alpha", "password3", "gamma", true, "username1","William"},
+       "password1",
+       "alpha",
+       "password3",
+       "gamma",
+       true,
+       "username1",
+       "William"},
       {{"current-password", "new-password", "current-password"},
-       "password1", "alpha", "password2", "beta", true, "username1", "William"},
+       "password1",
+       "alpha",
+       "password2",
+       "beta",
+       true,
+       "username1",
+       "William"},
       {{"new-password", "current-password", "current-password"},
-       "password2", "beta", "password1", "alpha", true, "username2", "Smith"},
+       "password2",
+       "beta",
+       "password1",
+       "alpha",
+       true,
+       "username2",
+       "Smith"},
       {{"current-password", "new-password", "new-password"},
-       "password1", "alpha", "password2", "beta", true, "username1", "William"},
+       "password1",
+       "alpha",
+       "password2",
+       "beta",
+       true,
+       "username1",
+       "William"},
       {{"new-password", "current-password", "new-password"},
-       "password2", "beta", "password1", "alpha", true, "username2", "Smith"},
+       "password2",
+       "beta",
+       "password1",
+       "alpha",
+       true,
+       "username2",
+       "Smith"},
       {{"new-password", "new-password", "current-password"},
-       "password3", "gamma", "password1", "alpha", true, "username2", "Smith"},
+       "password3",
+       "gamma",
+       "password1",
+       "alpha",
+       true,
+       "username2",
+       "Smith"},
       // When there is an empty autocomplete attribute (i.e. autocomplete=""),
       // it should have the same effect as having no attribute whatsoever.
       {{"current-password", "", ""},
-       "password1", "alpha", "", "", false, "username1", "William"},
+       "password1",
+       "alpha",
+       "",
+       "",
+       false,
+       "username1",
+       "William"},
       {{"", "", "new-password"},
-       "", "", "password3", "gamma", true, "username2", "Smith"},
+       "",
+       "",
+       "password3",
+       "gamma",
+       true,
+       "username2",
+       "Smith"},
       {{"", "new-password", ""},
-       "", "", "password2", "beta", true, "username2", "Smith"},
+       "",
+       "",
+       "password2",
+       "beta",
+       true,
+       "username2",
+       "Smith"},
       {{"", "current-password", "current-password"},
-       "password2", "beta", "", "", false, "username2", "Smith"},
+       "password2",
+       "beta",
+       "",
+       "",
+       false,
+       "username2",
+       "Smith"},
       {{"new-password", "", "new-password"},
-       "", "", "password1", "alpha", true, "username1", "William"},
+       "",
+       "",
+       "password1",
+       "alpha",
+       true,
+       "username1",
+       "William"},
       {{"new-password", "", "current-password"},
-       "password3", "gamma", "password1", "alpha", true, "username2","Smith"},
+       "password3",
+       "gamma",
+       "password1",
+       "alpha",
+       true,
+       "username2",
+       "Smith"},
       // It should not matter if attribute values are upper or mixed case.
-      {{NULL, "current-password", NULL},
-       "password2", "beta", "", "", false, "username2", "Smith"},
-      {{NULL, "CURRENT-PASSWORD", NULL},
-       "password2", "beta", "", "", false, "username2", "Smith"},
-      {{NULL, "new-password", NULL},
-       "", "", "password2", "beta", true, "username2", "Smith"},
-      {{NULL, "nEw-PaSsWoRd", NULL},
-       "", "", "password2", "beta", true, "username2", "Smith"}};
+      {{nullptr, "current-password", nullptr},
+       "password2",
+       "beta",
+       "",
+       "",
+       false,
+       "username2",
+       "Smith"},
+      {{nullptr, "CURRENT-PASSWORD", nullptr},
+       "password2",
+       "beta",
+       "",
+       "",
+       false,
+       "username2",
+       "Smith"},
+      {{nullptr, "new-password", nullptr},
+       "",
+       "",
+       "password2",
+       "beta",
+       true,
+       "username2",
+       "Smith"},
+      {{nullptr, "nEw-PaSsWoRd", nullptr},
+       "",
+       "",
+       "password2",
+       "beta",
+       true,
+       "username2",
+       "Smith"}};
 
   for (size_t i = 0; i < arraysize(cases); ++i) {
     SCOPED_TRACE(testing::Message() << "Iteration " << i);
 
     PasswordFormBuilder builder(kTestFormActionURL);
-    builder.AddPasswordField("pin1", "123456", NULL);
-    builder.AddPasswordField("pin2", "789101", NULL);
-    builder.AddTextField("username1", "William", NULL);
+    builder.AddPasswordField("pin1", "123456", nullptr);
+    builder.AddPasswordField("pin2", "789101", nullptr);
+    builder.AddTextField("username1", "William", nullptr);
     builder.AddPasswordField("password1", "alpha", cases[i].autocomplete[0]);
-    builder.AddTextField("username2", "Smith", NULL);
+    builder.AddTextField("username2", "Smith", nullptr);
     builder.AddPasswordField("password2", "beta", cases[i].autocomplete[1]);
     builder.AddPasswordField("password3", "gamma", cases[i].autocomplete[2]);
     builder.AddSubmitButton("submit");
     std::string html = builder.ProduceHTML();
 
-    std::unique_ptr<PasswordForm> password_form;
-    ASSERT_NO_FATAL_FAILURE(
-        LoadHTMLAndConvertForm(html, &password_form, nullptr));
+    std::unique_ptr<PasswordForm> password_form =
+        LoadHTMLAndConvertForm(html, nullptr, false);
     ASSERT_TRUE(password_form);
 
     // In the absence of username autocomplete attributes, the username should
@@ -641,16 +858,15 @@
   PasswordFormBuilder builder(kTestFormActionURL);
 
   builder.AddNonDisplayedTextField("nondisplayed1", "nodispalyed_value1");
-  builder.AddTextField("username", "johnsmith", NULL);
+  builder.AddTextField("username", "johnsmith", nullptr);
   builder.AddNonDisplayedTextField("nondisplayed2", "nodispalyed_value2");
-  builder.AddPasswordField("password", "secret", NULL);
-  builder.AddPasswordField("password", "secret", NULL);
+  builder.AddPasswordField("password", "secret", nullptr);
+  builder.AddPasswordField("password", "secret", nullptr);
   builder.AddSubmitButton("submit");
   std::string html = builder.ProduceHTML();
 
-  std::unique_ptr<PasswordForm> password_form;
-  ASSERT_NO_FATAL_FAILURE(
-      LoadHTMLAndConvertForm(html, &password_form, nullptr));
+  std::unique_ptr<PasswordForm> password_form =
+      LoadHTMLAndConvertForm(html, nullptr, false);
   ASSERT_TRUE(password_form);
   EXPECT_EQ(base::UTF8ToUTF16("username"), password_form->username_element);
   EXPECT_EQ(base::UTF8ToUTF16("johnsmith"), password_form->username_value);
@@ -664,17 +880,16 @@
 
   builder.AddNonDisplayedTextField("nondisplayed1", "nodispalyed_value1");
   builder.AddNonDisplayedPasswordField("nondisplayed2", "nodispalyed_value2");
-  builder.AddTextField("username", "johnsmith", NULL);
+  builder.AddTextField("username", "johnsmith", nullptr);
   builder.AddNonDisplayedTextField("nondisplayed3", "nodispalyed_value3");
   builder.AddNonDisplayedPasswordField("nondisplayed4", "nodispalyed_value4");
-  builder.AddPasswordField("password", "secret", NULL);
-  builder.AddPasswordField("password", "secret", NULL);
+  builder.AddPasswordField("password", "secret", nullptr);
+  builder.AddPasswordField("password", "secret", nullptr);
   builder.AddSubmitButton("submit");
   std::string html = builder.ProduceHTML();
 
-  std::unique_ptr<PasswordForm> password_form;
-  ASSERT_NO_FATAL_FAILURE(
-      LoadHTMLAndConvertForm(html, &password_form, nullptr));
+  std::unique_ptr<PasswordForm> password_form =
+      LoadHTMLAndConvertForm(html, nullptr, false);
   ASSERT_TRUE(password_form);
   EXPECT_EQ(base::UTF8ToUTF16("username"), password_form->username_element);
   EXPECT_EQ(base::UTF8ToUTF16("johnsmith"), password_form->username_value);
@@ -691,9 +906,8 @@
   builder.AddSubmitButton("submit");
   std::string html = builder.ProduceHTML();
 
-  std::unique_ptr<PasswordForm> password_form;
-  ASSERT_NO_FATAL_FAILURE(
-      LoadHTMLAndConvertForm(html, &password_form, nullptr));
+  std::unique_ptr<PasswordForm> password_form =
+      LoadHTMLAndConvertForm(html, nullptr, false);
   ASSERT_TRUE(password_form);
   EXPECT_EQ(base::UTF8ToUTF16("username"),
             password_form->username_element);
@@ -710,13 +924,12 @@
   PasswordFormBuilder builder(kTestFormActionURL);
 
   builder.AddNonDisplayedTextField("username", "William");
-  builder.AddPasswordField("password", "secret", NULL);
+  builder.AddPasswordField("password", "secret", nullptr);
   builder.AddSubmitButton("submit");
   std::string html = builder.ProduceHTML();
 
-  std::unique_ptr<PasswordForm> password_form;
-  ASSERT_NO_FATAL_FAILURE(
-      LoadHTMLAndConvertForm(html, &password_form, nullptr));
+  std::unique_ptr<PasswordForm> password_form =
+      LoadHTMLAndConvertForm(html, nullptr, false);
   ASSERT_TRUE(password_form);
   EXPECT_EQ(base::UTF8ToUTF16("username"), password_form->username_element);
   EXPECT_EQ(base::UTF8ToUTF16("William"), password_form->username_value);
@@ -729,14 +942,13 @@
   PasswordFormBuilder builder(kTestFormActionURL);
 
   builder.AddNonDisplayedTextField("search", "query");
-  builder.AddTextField("username", "William", NULL);
+  builder.AddTextField("username", "William", nullptr);
   builder.AddNonDisplayedPasswordField("password", "secret");
   builder.AddSubmitButton("submit");
   std::string html = builder.ProduceHTML();
 
-  std::unique_ptr<PasswordForm> password_form;
-  ASSERT_NO_FATAL_FAILURE(
-      LoadHTMLAndConvertForm(html, &password_form, nullptr));
+  std::unique_ptr<PasswordForm> password_form =
+      LoadHTMLAndConvertForm(html, nullptr, false);
   ASSERT_TRUE(password_form);
   EXPECT_EQ(base::UTF8ToUTF16("username"), password_form->username_element);
   EXPECT_EQ(base::UTF8ToUTF16("William"), password_form->username_value);
@@ -748,15 +960,14 @@
        InvisiblePassword_LatestUsernameIsInvisible) {
   PasswordFormBuilder builder(kTestFormActionURL);
 
-  builder.AddTextField("search", "query", NULL);
+  builder.AddTextField("search", "query", nullptr);
   builder.AddNonDisplayedTextField("username", "William");
   builder.AddNonDisplayedPasswordField("password", "secret");
   builder.AddSubmitButton("submit");
   std::string html = builder.ProduceHTML();
 
-  std::unique_ptr<PasswordForm> password_form;
-  ASSERT_NO_FATAL_FAILURE(
-      LoadHTMLAndConvertForm(html, &password_form, nullptr));
+  std::unique_ptr<PasswordForm> password_form =
+      LoadHTMLAndConvertForm(html, nullptr, false);
   ASSERT_TRUE(password_form);
   EXPECT_EQ(base::UTF8ToUTF16("username"), password_form->username_element);
   EXPECT_EQ(base::UTF8ToUTF16("William"), password_form->username_value);
@@ -766,28 +977,26 @@
 
 TEST_F(MAYBE_PasswordFormConversionUtilsTest, InvalidFormDueToBadActionURL) {
   PasswordFormBuilder builder("invalid_target");
-  builder.AddTextField("username", "JohnSmith", NULL);
+  builder.AddTextField("username", "JohnSmith", nullptr);
   builder.AddSubmitButton("submit");
-  builder.AddPasswordField("password", "secret", NULL);
+  builder.AddPasswordField("password", "secret", nullptr);
   std::string html = builder.ProduceHTML();
 
-  std::unique_ptr<PasswordForm> password_form;
-  ASSERT_NO_FATAL_FAILURE(
-      LoadHTMLAndConvertForm(html, &password_form, nullptr));
+  std::unique_ptr<PasswordForm> password_form =
+      LoadHTMLAndConvertForm(html, nullptr, false);
   EXPECT_FALSE(password_form);
 }
 
 TEST_F(MAYBE_PasswordFormConversionUtilsTest,
        InvalidFormDueToNoPasswordFields) {
   PasswordFormBuilder builder(kTestFormActionURL);
-  builder.AddTextField("username1", "John", NULL);
-  builder.AddTextField("username2", "Smith", NULL);
+  builder.AddTextField("username1", "John", nullptr);
+  builder.AddTextField("username2", "Smith", nullptr);
   builder.AddSubmitButton("submit");
   std::string html = builder.ProduceHTML();
 
-  std::unique_ptr<PasswordForm> password_form;
-  ASSERT_NO_FATAL_FAILURE(
-      LoadHTMLAndConvertForm(html, &password_form, nullptr));
+  std::unique_ptr<PasswordForm> password_form =
+      LoadHTMLAndConvertForm(html, nullptr, false);
   EXPECT_FALSE(password_form);
 }
 
@@ -809,16 +1018,15 @@
     SCOPED_TRACE(testing::Message() << "Iteration " << i);
 
     PasswordFormBuilder builder(kTestFormActionURL);
-    builder.AddTextField("username1", "John", NULL);
-    builder.AddPasswordField("password1", cases[i][0], NULL);
-    builder.AddPasswordField("password2", cases[i][1], NULL);
-    builder.AddPasswordField("password3", cases[i][2], NULL);
+    builder.AddTextField("username1", "John", nullptr);
+    builder.AddPasswordField("password1", cases[i][0], nullptr);
+    builder.AddPasswordField("password2", cases[i][1], nullptr);
+    builder.AddPasswordField("password3", cases[i][2], nullptr);
     builder.AddSubmitButton("submit");
     std::string html = builder.ProduceHTML();
 
-    std::unique_ptr<PasswordForm> password_form;
-    ASSERT_NO_FATAL_FAILURE(
-        LoadHTMLAndConvertForm(html, &password_form, nullptr));
+    std::unique_ptr<PasswordForm> password_form =
+        LoadHTMLAndConvertForm(html, nullptr, false);
     EXPECT_FALSE(password_form);
   }
 }
@@ -826,17 +1034,16 @@
 TEST_F(MAYBE_PasswordFormConversionUtilsTest,
        InvalidFormDueToTooManyPasswordFieldsWithoutAutocompleteAttributes) {
   PasswordFormBuilder builder(kTestFormActionURL);
-  builder.AddTextField("username1", "John", NULL);
-  builder.AddPasswordField("password1", "alpha", NULL);
-  builder.AddPasswordField("password2", "alpha", NULL);
-  builder.AddPasswordField("password3", "alpha", NULL);
-  builder.AddPasswordField("password4", "alpha", NULL);
+  builder.AddTextField("username1", "John", nullptr);
+  builder.AddPasswordField("password1", "alpha", nullptr);
+  builder.AddPasswordField("password2", "alpha", nullptr);
+  builder.AddPasswordField("password3", "alpha", nullptr);
+  builder.AddPasswordField("password4", "alpha", nullptr);
   builder.AddSubmitButton("submit");
   std::string html = builder.ProduceHTML();
 
-  std::unique_ptr<PasswordForm> password_form;
-  ASSERT_NO_FATAL_FAILURE(
-      LoadHTMLAndConvertForm(html, &password_form, nullptr));
+  std::unique_ptr<PasswordForm> password_form =
+      LoadHTMLAndConvertForm(html, nullptr, false);
   EXPECT_FALSE(password_form);
 }
 
@@ -848,9 +1055,8 @@
   builder.AddSubmitButton("submit");
   std::string login_html = builder.ProduceHTML();
 
-  std::unique_ptr<PasswordForm> login_form;
-  ASSERT_NO_FATAL_FAILURE(
-      LoadHTMLAndConvertForm(login_html, &login_form, nullptr));
+  std::unique_ptr<PasswordForm> login_form =
+      LoadHTMLAndConvertForm(login_html, nullptr, false);
   ASSERT_TRUE(login_form);
   EXPECT_EQ(PasswordForm::Layout::LAYOUT_OTHER, login_form->layout);
 }
@@ -865,9 +1071,8 @@
   builder.AddSubmitButton("submit");
   std::string signup_html = builder.ProduceHTML();
 
-  std::unique_ptr<PasswordForm> signup_form;
-  ASSERT_NO_FATAL_FAILURE(
-      LoadHTMLAndConvertForm(signup_html, &signup_form, nullptr));
+  std::unique_ptr<PasswordForm> signup_form =
+      LoadHTMLAndConvertForm(signup_html, nullptr, false);
   ASSERT_TRUE(signup_form);
   EXPECT_EQ(PasswordForm::Layout::LAYOUT_OTHER, signup_form->layout);
 }
@@ -882,9 +1087,8 @@
   builder.AddSubmitButton("submit");
   std::string change_html = builder.ProduceHTML();
 
-  std::unique_ptr<PasswordForm> change_form;
-  ASSERT_NO_FATAL_FAILURE(
-      LoadHTMLAndConvertForm(change_html, &change_form, nullptr));
+  std::unique_ptr<PasswordForm> change_form =
+      LoadHTMLAndConvertForm(change_html, nullptr, false);
   ASSERT_TRUE(change_form);
   EXPECT_EQ(PasswordForm::Layout::LAYOUT_OTHER, change_form->layout);
 }
@@ -903,9 +1107,8 @@
   builder.AddSubmitButton("submit");
   std::string login_plus_signup_html = builder.ProduceHTML();
 
-  std::unique_ptr<PasswordForm> login_plus_signup_form;
-  ASSERT_NO_FATAL_FAILURE(LoadHTMLAndConvertForm(
-      login_plus_signup_html, &login_plus_signup_form, nullptr));
+  std::unique_ptr<PasswordForm> login_plus_signup_form =
+      LoadHTMLAndConvertForm(login_plus_signup_html, nullptr, false);
   ASSERT_TRUE(login_plus_signup_form);
   EXPECT_EQ(PasswordForm::Layout::LAYOUT_LOGIN_AND_SIGNUP,
             login_plus_signup_form->layout);
@@ -925,9 +1128,8 @@
   builder.AddSubmitButton("submit");
   std::string login_plus_signup_html = builder.ProduceHTML();
 
-  std::unique_ptr<PasswordForm> login_plus_signup_form;
-  ASSERT_NO_FATAL_FAILURE(LoadHTMLAndConvertForm(
-      login_plus_signup_html, &login_plus_signup_form, nullptr));
+  std::unique_ptr<PasswordForm> login_plus_signup_form =
+      LoadHTMLAndConvertForm(login_plus_signup_html, nullptr, false);
   ASSERT_TRUE(login_plus_signup_form);
   EXPECT_EQ(PasswordForm::Layout::LAYOUT_LOGIN_AND_SIGNUP,
             login_plus_signup_form->layout);
@@ -949,8 +1151,8 @@
   FormsPredictionsMap predictions;
   SetPredictions(html, &predictions, predictions_positions);
 
-  std::unique_ptr<PasswordForm> password_form;
-  LoadHTMLAndConvertForm(html, &password_form, &predictions);
+  std::unique_ptr<PasswordForm> password_form =
+      LoadHTMLAndConvertForm(html, &predictions, false);
   EXPECT_FALSE(password_form);
 }
 
@@ -969,8 +1171,8 @@
   FormsPredictionsMap predictions;
   SetPredictions(html, &predictions, predictions_positions);
 
-  std::unique_ptr<PasswordForm> password_form;
-  LoadHTMLAndConvertForm(html, &password_form, &predictions);
+  std::unique_ptr<PasswordForm> password_form =
+      LoadHTMLAndConvertForm(html, &predictions, false);
   EXPECT_FALSE(password_form);
 }
 
@@ -990,8 +1192,8 @@
   FormsPredictionsMap predictions;
   SetPredictions(html, &predictions, predictions_positions);
 
-  std::unique_ptr<PasswordForm> password_form;
-  LoadHTMLAndConvertForm(html, &password_form, &predictions);
+  std::unique_ptr<PasswordForm> password_form =
+      LoadHTMLAndConvertForm(html, &predictions, false);
   EXPECT_TRUE(password_form);
 }
 
@@ -1010,8 +1212,8 @@
   FormsPredictionsMap predictions;
   SetPredictions(html, &predictions, predictions_positions);
 
-  std::unique_ptr<PasswordForm> password_form;
-  LoadHTMLAndConvertForm(html, &password_form, &predictions);
+  std::unique_ptr<PasswordForm> password_form =
+      LoadHTMLAndConvertForm(html, &predictions, false);
   EXPECT_TRUE(password_form);
 }
 
@@ -1175,8 +1377,8 @@
     }
     std::string html = builder.ProduceHTML();
 
-    std::unique_ptr<PasswordForm> password_form;
-    LoadHTMLAndConvertForm(html, &password_form, nullptr);
+    std::unique_ptr<PasswordForm> password_form =
+        LoadHTMLAndConvertForm(html, nullptr, false);
     EXPECT_TRUE(password_form);
 
     EXPECT_EQ(base::UTF8ToUTF16(test_cases[i].expected_username_element),
@@ -1188,4 +1390,71 @@
   }
 }
 
+TEST_F(MAYBE_PasswordFormConversionUtilsTest,
+       ProbablySignUpFormTwoTextOnePassword) {
+  PasswordFormBuilder builder(kTestFormActionURL);
+  builder.AddTextField("email", "johnsmith@gmail.com", nullptr);
+  builder.AddTextField("username", "johnsmith", nullptr);
+  builder.AddPasswordField("password", "secret", nullptr);
+  std::string html = builder.ProduceHTML();
+
+  // No user input, not considered as SignUp.
+  std::unique_ptr<PasswordForm> password_form =
+      LoadHTMLAndConvertForm(html, nullptr, false);
+  ASSERT_TRUE(password_form);
+  EXPECT_FALSE(password_form->does_look_like_signup_form);
+
+  // With user input, considered as SignUp.
+  password_form = LoadHTMLAndConvertForm(html, nullptr, true);
+  ASSERT_TRUE(password_form);
+  EXPECT_TRUE(password_form->does_look_like_signup_form);
+}
+
+TEST_F(MAYBE_PasswordFormConversionUtilsTest,
+       ProbablySignUpFormOneTextNewAndConfirmPassword) {
+  PasswordFormBuilder builder(kTestFormActionURL);
+  builder.AddTextField("username", "johnsmith", nullptr);
+  builder.AddPasswordField("new_password", "secret", nullptr);
+  builder.AddPasswordField("confirm_password", "secret", nullptr);
+  std::string html = builder.ProduceHTML();
+
+  // No user input, not considered as SignUp.
+  std::unique_ptr<PasswordForm> password_form =
+      LoadHTMLAndConvertForm(html, nullptr, false);
+  ASSERT_TRUE(password_form);
+  EXPECT_FALSE(password_form->does_look_like_signup_form);
+
+  // With user input, considered as SignUp.
+  password_form = LoadHTMLAndConvertForm(html, nullptr, true);
+  ASSERT_TRUE(password_form);
+  EXPECT_TRUE(password_form->does_look_like_signup_form);
+}
+
+TEST_F(MAYBE_PasswordFormConversionUtilsTest,
+       NotProbablySignUpFormOneTextCurrentAndNewPassword) {
+  PasswordFormBuilder builder(kTestFormActionURL);
+  builder.AddTextField("username", "johnsmith", nullptr);
+  builder.AddPasswordField("password", "secret", nullptr);
+  builder.AddPasswordField("new_password", "new_secret", nullptr);
+  std::string html = builder.ProduceHTML();
+
+  std::unique_ptr<PasswordForm> password_form =
+      LoadHTMLAndConvertForm(html, nullptr, true);
+  ASSERT_TRUE(password_form);
+  EXPECT_FALSE(password_form->does_look_like_signup_form);
+}
+
+TEST_F(MAYBE_PasswordFormConversionUtilsTest,
+       NotProbablySignUpFormForSignInForm) {
+  PasswordFormBuilder builder(kTestFormActionURL);
+  builder.AddTextField("username", "johnsmith", nullptr);
+  builder.AddPasswordField("password", "secret", nullptr);
+  std::string html = builder.ProduceHTML();
+
+  std::unique_ptr<PasswordForm> password_form =
+      LoadHTMLAndConvertForm(html, nullptr, true);
+  ASSERT_TRUE(password_form);
+  EXPECT_FALSE(password_form->does_look_like_signup_form);
+}
+
 }  // namespace autofill

diff --git a/components/autofill/core/browser/autofill_type.cc b/components/autofill/core/browser/autofill_type.cc
index d75ef41..b5567b2 100644
--- a/components/autofill/core/browser/autofill_type.cc
+++ b/components/autofill/core/browser/autofill_type.cc

@@ -125,6 +125,7 @@
     case NEW_PASSWORD:
     case PROBABLY_NEW_PASSWORD:
     case NOT_NEW_PASSWORD:
+    case PROBABLY_ACCOUNT_CREATION_PASSWORD:
       return PASSWORD_FIELD;
 
     case NO_SERVER_DATA:
@@ -655,6 +656,8 @@
       return "PROBABLY_NEW_PASSWORD";
     case NOT_NEW_PASSWORD:
       return "NOT_NEW_PASSWORD";
+    case PROBABLY_ACCOUNT_CREATION_PASSWORD:
+      return "PROBABLY_ACCOUNT_CREATION_PASSWORD";
 
     case MAX_VALID_FIELD_TYPE:
       return std::string();

diff --git a/components/autofill/core/browser/credit_card.cc b/components/autofill/core/browser/credit_card.cc
index 649a8126..b98790d1 100644
--- a/components/autofill/core/browser/credit_card.cc
+++ b/components/autofill/core/browser/credit_card.cc

@@ -635,12 +635,6 @@
   return types.empty();
 }
 
-bool CreditCard::IsComplete() const {
-  return IsValidCreditCardNumber(number_) &&
-         expiration_month_ != 0 &&
-         expiration_year_ != 0;
-}
-
 bool CreditCard::IsValid() const {
   return IsValidCreditCardNumber(number_) &&
          IsValidCreditCardExpirationDate(

diff --git a/components/autofill/core/browser/credit_card.h b/components/autofill/core/browser/credit_card.h
index e15c79f..56e9579 100644
--- a/components/autofill/core/browser/credit_card.h
+++ b/components/autofill/core/browser/credit_card.h

@@ -171,10 +171,6 @@
   // Returns true if there are no values (field types) set.
   bool IsEmpty(const std::string& app_locale) const;
 
-  // Returns true if all field types have valid values set. Server masked cards
-  // will not be complete. MASKED_SERVER_CARDs will never be complete.
-  bool IsComplete() const;
-
   // Returns true if all field types have valid values set and the card is not
   // expired. MASKED_SERVER_CARDs will never be valid because the number is
   // not complete.

diff --git a/components/autofill/core/browser/credit_card_unittest.cc b/components/autofill/core/browser/credit_card_unittest.cc
index f24726e..36288b1 100644
--- a/components/autofill/core/browser/credit_card_unittest.cc
+++ b/components/autofill/core/browser/credit_card_unittest.cc

@@ -400,27 +400,6 @@
   EXPECT_EQ(original_card, a);
 }
 
-TEST(CreditCardTest, IsComplete) {
-  CreditCard card(base::GenerateGUID(), "https://www.example.com/");
-  EXPECT_FALSE(card.IsComplete());
-  card.SetRawInfo(CREDIT_CARD_NAME_FULL, ASCIIToUTF16("Wally T. Walrus"));
-  EXPECT_FALSE(card.IsComplete());
-  card.SetRawInfo(CREDIT_CARD_EXP_MONTH, ASCIIToUTF16("01"));
-  EXPECT_FALSE(card.IsComplete());
-  card.SetRawInfo(CREDIT_CARD_EXP_4_DIGIT_YEAR, ASCIIToUTF16("2014"));
-
-  for (size_t i = 0; i < arraysize(kValidNumbers); ++i) {
-    SCOPED_TRACE(kValidNumbers[i]);
-    card.SetRawInfo(CREDIT_CARD_NUMBER, ASCIIToUTF16(kValidNumbers[i]));
-    EXPECT_TRUE(card.IsComplete());
-  }
-  for (size_t i = 0; i < arraysize(kInvalidNumbers); ++i) {
-    SCOPED_TRACE(kInvalidNumbers[i]);
-    card.SetRawInfo(CREDIT_CARD_NUMBER, ASCIIToUTF16(kInvalidNumbers[i]));
-    EXPECT_FALSE(card.IsComplete());
-  }
-}
-
 TEST(CreditCardTest, IsValid) {
   CreditCard card;
   // Invalid because expired
@@ -440,20 +419,16 @@
   card.SetRawInfo(CREDIT_CARD_NUMBER, ASCIIToUTF16("41111"));
   EXPECT_FALSE(card.IsValid());
 
-  // Valid
-  card.SetRawInfo(CREDIT_CARD_EXP_MONTH, ASCIIToUTF16("12"));
-  card.SetRawInfo(CREDIT_CARD_EXP_4_DIGIT_YEAR, ASCIIToUTF16("9999"));
-  card.SetRawInfo(CREDIT_CARD_NUMBER, ASCIIToUTF16("4111111111111111"));
-  EXPECT_TRUE(card.IsValid());
-}
-
-TEST(CreditCardTest, InvalidMastercardNumber) {
-  CreditCard card(base::GenerateGUID(), "https://www.example.com/");
-
-  test::SetCreditCardInfo(&card, "Baby Face Nelson",
-                          "5200000000000004", "01", "2010");
-  EXPECT_EQ(kMasterCard, card.type());
-  EXPECT_FALSE(card.IsComplete());
+  for (size_t i = 0; i < arraysize(kValidNumbers); ++i) {
+    SCOPED_TRACE(kValidNumbers[i]);
+    card.SetRawInfo(CREDIT_CARD_NUMBER, ASCIIToUTF16(kValidNumbers[i]));
+    EXPECT_TRUE(card.IsValid());
+  }
+  for (size_t i = 0; i < arraysize(kInvalidNumbers); ++i) {
+    SCOPED_TRACE(kInvalidNumbers[i]);
+    card.SetRawInfo(CREDIT_CARD_NUMBER, ASCIIToUTF16(kInvalidNumbers[i]));
+    EXPECT_FALSE(card.IsValid());
+  }
 }
 
 // Verify that we preserve exactly what the user typed for credit card numbers.

diff --git a/components/autofill/core/browser/field_types.h b/components/autofill/core/browser/field_types.h
index a8aef650..7dee427 100644
--- a/components/autofill/core/browser/field_types.h
+++ b/components/autofill/core/browser/field_types.h

@@ -155,9 +155,13 @@
 
   PHONE_HOME_EXTENSION = 93,
 
+  // The first password field in a form that looks like account creation form
+  // for local heuristics.
+  PROBABLY_ACCOUNT_CREATION_PASSWORD = 94,
+
   // No new types can be added without a corresponding change to the Autofill
   // server.
-  MAX_VALID_FIELD_TYPE = 94,
+  MAX_VALID_FIELD_TYPE = 95,
 };
 
 // The list of all HTML autocomplete field type hints supported by Chrome.

diff --git a/components/autofill/core/browser/personal_data_manager.cc b/components/autofill/core/browser/personal_data_manager.cc
index 5c02242d..b00583d 100644
--- a/components/autofill/core/browser/personal_data_manager.cc
+++ b/components/autofill/core/browser/personal_data_manager.cc

@@ -1374,7 +1374,7 @@
 
   // Reject the credit card if we did not detect enough filled credit card
   // fields (such as valid number, month, year).
-  if (!candidate_credit_card.IsComplete())
+  if (!candidate_credit_card.IsValid())
     return false;
 
   // Attempt to merge with an existing credit card. Don't present a prompt if we

diff --git a/components/autofill/core/browser/personal_data_manager_unittest.cc b/components/autofill/core/browser/personal_data_manager_unittest.cc
index c7d9219..43090970 100644
--- a/components/autofill/core/browser/personal_data_manager_unittest.cc
+++ b/components/autofill/core/browser/personal_data_manager_unittest.cc

@@ -231,7 +231,7 @@
                             "https://www.example.com");
     test::SetCreditCardInfo(&credit_card0, "Clyde Barrow",
                             "347666888555" /* American Express */, "04",
-                            "2015");
+                            "3999");
     credit_card0.set_use_count(3);
     credit_card0.set_use_date(base::Time::Now() - base::TimeDelta::FromDays(1));
     personal_data_->AddCreditCard(credit_card0);
@@ -242,7 +242,7 @@
     credit_card1.set_use_date(base::Time::Now() -
                               base::TimeDelta::FromDays(10));
     test::SetCreditCardInfo(&credit_card1, "John Dillinger",
-                            "423456789012" /* Visa */, "01", "2010");
+                            "423456789012" /* Visa */, "01", "2999");
     personal_data_->AddCreditCard(credit_card1);
 
     CreditCard credit_card2("002149C1-EE28-4213-A3B9-DA243FFF021B",
@@ -476,15 +476,15 @@
 TEST_F(PersonalDataManagerTest, AddUpdateRemoveCreditCards) {
   CreditCard credit_card0(base::GenerateGUID(), "https://www.example.com");
   test::SetCreditCardInfo(&credit_card0,
-      "John Dillinger", "423456789012" /* Visa */, "01", "2010");
+      "John Dillinger", "423456789012" /* Visa */, "01", "2999");
 
   CreditCard credit_card1(base::GenerateGUID(), "https://www.example.com");
   test::SetCreditCardInfo(&credit_card1,
-      "Bonnie Parker", "518765432109" /* Mastercard */, "12", "2012");
+      "Bonnie Parker", "518765432109" /* Mastercard */, "12", "3999");
 
   CreditCard credit_card2(base::GenerateGUID(), "https://www.example.com");
   test::SetCreditCardInfo(&credit_card2,
-      "Clyde Barrow", "347666888555" /* American Express */, "04", "2015");
+      "Clyde Barrow", "347666888555" /* American Express */, "04", "3999");
 
   // Add two test credit cards to the database.
   personal_data_->AddCreditCard(credit_card0);
@@ -539,7 +539,7 @@
 
   CreditCard credit_card(base::GenerateGUID(), "https://www.example.com/");
   test::SetCreditCardInfo(&credit_card,
-      "John Dillinger", "423456789012" /* Visa */, "01", "2010");
+      "John Dillinger", "423456789012" /* Visa */, "01", "2999");
   EXPECT_FALSE(credit_card.IsVerified());
 
   // Add the data to the database.
@@ -621,7 +621,7 @@
   std::vector<CreditCard> server_cards;
   server_cards.push_back(CreditCard(CreditCard::FULL_SERVER_CARD, "c789"));
   test::SetCreditCardInfo(&server_cards.back(), "Clyde Barrow",
-                          "347666888555" /* American Express */, "04", "2015");
+                          "347666888555" /* American Express */, "04", "3999");
   test::SetServerCreditCards(autofill_table_, server_cards);
   personal_data_->Refresh();
 
@@ -651,17 +651,17 @@
   std::vector<CreditCard> server_cards;
   server_cards.push_back(CreditCard(CreditCard::MASKED_SERVER_CARD, "a123"));
   test::SetCreditCardInfo(&server_cards.back(), "John Dillinger",
-                          "9012" /* Visa */, "01", "2010");
+                          "9012" /* Visa */, "01", "2999");
   server_cards.back().SetTypeForMaskedCard(kVisaCard);
 
   server_cards.push_back(CreditCard(CreditCard::MASKED_SERVER_CARD, "b456"));
   test::SetCreditCardInfo(&server_cards.back(), "Bonnie Parker",
-                          "2109" /* Mastercard */, "12", "2012");
+                          "2109" /* Mastercard */, "12", "3999");
   server_cards.back().SetTypeForMaskedCard(kMasterCard);
 
   server_cards.push_back(CreditCard(CreditCard::FULL_SERVER_CARD, "c789"));
   test::SetCreditCardInfo(&server_cards.back(), "Clyde Barrow",
-                          "347666888555" /* American Express */, "04", "2015");
+                          "347666888555" /* American Express */, "04", "3999");
 
   test::SetServerCreditCards(autofill_table_, server_cards);
   personal_data_->Refresh();
@@ -729,11 +729,11 @@
 
   CreditCard credit_card0(base::GenerateGUID(), "https://www.example.com");
   test::SetCreditCardInfo(&credit_card0,
-      "John Dillinger", "423456789012" /* Visa */, "01", "2010");
+      "John Dillinger", "423456789012" /* Visa */, "01", "2999");
 
   CreditCard credit_card1(base::GenerateGUID(), "https://www.example.com");
   test::SetCreditCardInfo(&credit_card1,
-      "Bonnie Parker", "518765432109" /* Mastercard */, "12", "2012");
+      "Bonnie Parker", "518765432109" /* Mastercard */, "12", "3999");
 
   // Add two test profiles to the database.
   personal_data_->AddProfile(profile0);
@@ -1955,7 +1955,7 @@
   // Add a single valid credit card form.
   FormData form;
   AddFullCreditCardForm(&form, "Biggie Smalls", "4111-1111-1111-1111", "01",
-                        "2011");
+                        "2999");
 
   FormStructure form_structure(form);
   form_structure.DetermineHeuristicTypes();
@@ -1971,7 +1971,7 @@
 
   CreditCard expected(base::GenerateGUID(), "https://www.example.com");
   test::SetCreditCardInfo(&expected, "Biggie Smalls", "4111111111111111", "01",
-                          "2011");
+                          "2999");
   const std::vector<CreditCard*>& results = personal_data_->GetCreditCards();
   ASSERT_EQ(1U, results.size());
   EXPECT_EQ(0, expected.Compare(*results[0]));
@@ -1981,7 +1981,7 @@
 TEST_F(PersonalDataManagerTest, ImportCreditCard_Invalid) {
   FormData form;
   AddFullCreditCardForm(&form, "Jim Johansen", "1000000000000000", "02",
-                        "2012");
+                        "3999");
 
   FormStructure form_structure(form);
   form_structure.DetermineHeuristicTypes();
@@ -2003,7 +2003,7 @@
   // Add a single valid credit card form with an invalid option value.
   FormData form;
   AddFullCreditCardForm(&form, "Biggie Smalls", "4111-1111-1111-1111",
-                        "Feb (2)", "2011");
+                        "Feb (2)", "2999");
   // Add option values and contents to the expiration month field.
   ASSERT_EQ(ASCIIToUTF16("exp_month"), form.fields[2].name);
   std::vector<base::string16> values;
@@ -2032,7 +2032,7 @@
   // See that the invalid option text was converted to the right value.
   CreditCard expected(base::GenerateGUID(), "https://www.example.com");
   test::SetCreditCardInfo(&expected, "Biggie Smalls", "4111111111111111", "02",
-                          "2011");
+                          "2999");
   const std::vector<CreditCard*>& results = personal_data_->GetCreditCards();
   ASSERT_EQ(1U, results.size());
   EXPECT_EQ(0, expected.Compare(*results[0]));
@@ -2042,7 +2042,7 @@
   // Start with a single valid credit card form.
   FormData form1;
   AddFullCreditCardForm(&form1, "Biggie Smalls", "4111-1111-1111-1111", "01",
-                        "2011");
+                        "2999");
 
   FormStructure form_structure1(form1);
   form_structure1.DetermineHeuristicTypes();
@@ -2058,14 +2058,14 @@
 
   CreditCard expected(base::GenerateGUID(), "https://www.example.com");
   test::SetCreditCardInfo(&expected, "Biggie Smalls", "4111111111111111", "01",
-                          "2011");
+                          "2999");
   const std::vector<CreditCard*>& results = personal_data_->GetCreditCards();
   ASSERT_EQ(1U, results.size());
   EXPECT_EQ(0, expected.Compare(*results[0]));
 
   // Add a second different valid credit card.
   FormData form2;
-  AddFullCreditCardForm(&form2, "", "5500 0000 0000 0004", "02", "2012");
+  AddFullCreditCardForm(&form2, "", "5500 0000 0000 0004", "02", "3999");
 
   FormStructure form_structure2(form2);
   form_structure2.DetermineHeuristicTypes();
@@ -2080,7 +2080,7 @@
   base::MessageLoop::current()->Run();
 
   CreditCard expected2(base::GenerateGUID(), "https://www.example.com");
-  test::SetCreditCardInfo(&expected2, "", "5500000000000004", "02", "2012");
+  test::SetCreditCardInfo(&expected2, "", "5500000000000004", "02", "3999");
   std::vector<CreditCard*> cards;
   cards.push_back(&expected);
   cards.push_back(&expected2);
@@ -2095,14 +2095,14 @@
   std::vector<CreditCard> server_cards;
   server_cards.push_back(CreditCard(CreditCard::MASKED_SERVER_CARD, "a123"));
   test::SetCreditCardInfo(&server_cards.back(), "John Dillinger",
-                          "1111" /* Visa */, "01", "2010");
+                          "1111" /* Visa */, "01", "2999");
   server_cards.back().SetTypeForMaskedCard(kVisaCard);
   test::SetServerCreditCards(autofill_table_, server_cards);
 
   // Type the same data as the masked card into a form.
   FormData form;
   AddFullCreditCardForm(&form, "John Dillinger", "4111111111111111", "01",
-                        "2010");
+                        "2999");
 
   // The card should be offered to be saved locally because it only matches the
   // masked server card.
@@ -2127,12 +2127,12 @@
   std::vector<CreditCard> server_cards;
   server_cards.push_back(CreditCard(CreditCard::FULL_SERVER_CARD, "c789"));
   test::SetCreditCardInfo(&server_cards.back(), "Clyde Barrow",
-                          "347666888555" /* American Express */, "04", "2015");
+                          "347666888555" /* American Express */, "04", "3999");
   test::SetServerCreditCards(autofill_table_, server_cards);
 
   // Type the same data as the unmasked card into a form.
   FormData form;
-  AddFullCreditCardForm(&form, "Clyde Barrow", "347666888555", "04", "2015");
+  AddFullCreditCardForm(&form, "Clyde Barrow", "347666888555", "04", "3999");
 
   // The card should not be offered to be saved locally because it only matches
   // the full server card.
@@ -2147,7 +2147,7 @@
   // Start with a single valid credit card form.
   FormData form1;
   AddFullCreditCardForm(&form1, "Biggie Smalls", "4111-1111-1111-1111", "01",
-                        "2011");
+                        "2999");
 
   FormStructure form_structure1(form1);
   form_structure1.DetermineHeuristicTypes();
@@ -2163,7 +2163,7 @@
 
   CreditCard expected(base::GenerateGUID(), "https://www.example.com");
   test::SetCreditCardInfo(&expected,
-      "Biggie Smalls", "4111111111111111", "01", "2011");
+      "Biggie Smalls", "4111111111111111", "01", "2999");
   const std::vector<CreditCard*>& results = personal_data_->GetCreditCards();
   ASSERT_EQ(1U, results.size());
   EXPECT_EQ(0, expected.Compare(*results[0]));
@@ -2172,7 +2172,7 @@
   // the credit card number matches.
   FormData form2;
   AddFullCreditCardForm(&form2, "Biggie Smalls", "4111 1111 1111 1111", "01",
-                        /* different year */ "2012");
+                        /* different year */ "3999");
 
   FormStructure form_structure2(form2);
   form_structure2.DetermineHeuristicTypes();
@@ -2186,10 +2186,10 @@
   base::MessageLoop::current()->Run();
 
   // Expect that the newer information is saved.  In this case the year is
-  // updated to "2012".
+  // updated to "3999".
   CreditCard expected2(base::GenerateGUID(), "https://www.example.com");
   test::SetCreditCardInfo(&expected2, "Biggie Smalls", "4111111111111111", "01",
-                          "2012");
+                          "3999");
   const std::vector<CreditCard*>& results2 = personal_data_->GetCreditCards();
   ASSERT_EQ(1U, results2.size());
   EXPECT_EQ(0, expected2.Compare(*results2[0]));
@@ -2199,7 +2199,7 @@
   // Start with a single valid credit card form.
   FormData form1;
   AddFullCreditCardForm(&form1, "Biggie Smalls", "4111-1111-1111-1111", "01",
-                        "2011");
+                        "2999");
 
   FormStructure form_structure1(form1);
   form_structure1.DetermineHeuristicTypes();
@@ -2215,7 +2215,7 @@
 
   CreditCard expected(base::GenerateGUID(), "https://www.example.com");
   test::SetCreditCardInfo(&expected,
-      "Biggie Smalls", "4111111111111111", "01", "2011");
+      "Biggie Smalls", "4111111111111111", "01", "2999");
   const std::vector<CreditCard*>& results = personal_data_->GetCreditCards();
   ASSERT_EQ(1U, results.size());
   EXPECT_EQ(0, expected.Compare(*results[0]));
@@ -2224,7 +2224,7 @@
   // the credit card number matches.
   FormData form2;
   AddFullCreditCardForm(&form2, "Biggie Smalls", "4111 1111 1111 1111", "01",
-                        /* different year */ "2012");
+                        /* different year */ "3999");
 
   FormStructure form_structure2(form2);
   form_structure2.DetermineHeuristicTypes();
@@ -2241,10 +2241,10 @@
   base::MessageLoop::current()->Run();
 
   // Expect that the newer information is saved.  In this case the year is
-  // updated to "2012".
+  // updated to "3999".
   CreditCard expected2(base::GenerateGUID(), "https://www.example.com");
   test::SetCreditCardInfo(&expected2,
-      "Biggie Smalls", "4111111111111111", "01", "2012");
+      "Biggie Smalls", "4111111111111111", "01", "3999");
   const std::vector<CreditCard*>& results2 = personal_data_->GetCreditCards();
   ASSERT_EQ(1U, results2.size());
   EXPECT_EQ(0, expected2.Compare(*results2[0]));
@@ -2254,7 +2254,7 @@
   // Start with a single valid credit card form.
   FormData form1;
   AddFullCreditCardForm(&form1, "Biggie Smalls", "4111-1111-1111-1111", "01",
-                        "2011");
+                        "2999");
 
   FormStructure form_structure1(form1);
   form_structure1.DetermineHeuristicTypes();
@@ -2270,7 +2270,7 @@
 
   CreditCard expected(base::GenerateGUID(), "https://www.example.com");
   test::SetCreditCardInfo(&expected,
-      "Biggie Smalls", "4111111111111111", "01", "2011");
+      "Biggie Smalls", "4111111111111111", "01", "2999");
   const std::vector<CreditCard*>& results = personal_data_->GetCreditCards();
   ASSERT_EQ(1U, results.size());
   EXPECT_EQ(0, expected.Compare(*results[0]));
@@ -2278,7 +2278,7 @@
   // Add a second credit card with no number.
   FormData form2;
   AddFullCreditCardForm(&form2, "Biggie Smalls", /* no number */ nullptr, "01",
-                        "2012");
+                        "3999");
 
   FormStructure form_structure2(form2);
   form_structure2.DetermineHeuristicTypes();
@@ -2294,7 +2294,7 @@
   // No change is expected.
   CreditCard expected2(base::GenerateGUID(), "https://www.example.com");
   test::SetCreditCardInfo(&expected2,
-      "Biggie Smalls", "4111111111111111", "01", "2011");
+      "Biggie Smalls", "4111111111111111", "01", "2999");
   const std::vector<CreditCard*>& results2 = personal_data_->GetCreditCards();
   ASSERT_EQ(1U, results2.size());
   EXPECT_EQ(0, expected2.Compare(*results2[0]));
@@ -2304,7 +2304,7 @@
   // Start with a single valid credit card form.
   FormData form1;
   AddFullCreditCardForm(&form1, "Biggie Smalls", "4111-1111-1111-1111", "01",
-                        "2011");
+                        "2999");
 
   FormStructure form_structure1(form1);
   form_structure1.DetermineHeuristicTypes();
@@ -2320,7 +2320,7 @@
 
   CreditCard expected(base::GenerateGUID(), "https://www.example.com");
   test::SetCreditCardInfo(&expected,
-      "Biggie Smalls", "4111111111111111", "01", "2011");
+      "Biggie Smalls", "4111111111111111", "01", "2999");
   const std::vector<CreditCard*>& results = personal_data_->GetCreditCards();
   ASSERT_EQ(1U, results.size());
   EXPECT_EQ(0, expected.Compare(*results[0]));
@@ -2329,7 +2329,7 @@
   // the credit card number matches.
   FormData form2;
   AddFullCreditCardForm(&form2, /* missing name */ nullptr,
-                        "4111-1111-1111-1111", "01", "2011");
+                        "4111-1111-1111-1111", "01", "2999");
 
   FormStructure form_structure2(form2);
   form_structure2.DetermineHeuristicTypes();
@@ -2344,7 +2344,7 @@
   // No change is expected.
   CreditCard expected2(base::GenerateGUID(), "https://www.example.com");
   test::SetCreditCardInfo(&expected2,
-      "Biggie Smalls", "4111111111111111", "01", "2011");
+      "Biggie Smalls", "4111111111111111", "01", "2999");
   const std::vector<CreditCard*>& results2 = personal_data_->GetCreditCards();
   ASSERT_EQ(1U, results2.size());
   EXPECT_EQ(0, expected2.Compare(*results2[0]));
@@ -2369,7 +2369,7 @@
   // No change is expected.
   CreditCard expected3(base::GenerateGUID(), "https://www.example.com");
   test::SetCreditCardInfo(&expected3,
-      "Biggie Smalls", "4111111111111111", "01", "2011");
+      "Biggie Smalls", "4111111111111111", "01", "2999");
   const std::vector<CreditCard*>& results3 = personal_data_->GetCreditCards();
   ASSERT_EQ(1U, results3.size());
   EXPECT_EQ(0, expected3.Compare(*results3[0]));
@@ -2380,7 +2380,7 @@
   // Note the empty name.
   CreditCard saved_credit_card(base::GenerateGUID(), "https://www.example.com");
   test::SetCreditCardInfo(&saved_credit_card,
-      "", "4111111111111111" /* Visa */, "01", "2011");
+      "", "4111111111111111" /* Visa */, "01", "2999");
   personal_data_->AddCreditCard(saved_credit_card);
 
   // Verify that the web database has been updated and the notification sent.
@@ -2396,7 +2396,7 @@
   // the credit card number matches.
   FormData form;
   AddFullCreditCardForm(&form, "Biggie Smalls", "4111-1111-1111-1111", "01",
-                        /* different year */ "2012");
+                        /* different year */ "3999");
 
   FormStructure form_structure(form);
   form_structure.DetermineHeuristicTypes();
@@ -2413,7 +2413,7 @@
   // added to the existing credit card.
   CreditCard expected2(base::GenerateGUID(), "https://www.example.com");
   test::SetCreditCardInfo(&expected2,
-      "Biggie Smalls", "4111111111111111", "01", "2012");
+      "Biggie Smalls", "4111111111111111", "01", "3999");
   const std::vector<CreditCard*>& results2 = personal_data_->GetCreditCards();
   ASSERT_EQ(1U, results2.size());
   EXPECT_EQ(0, expected2.Compare(*results2[0]));
@@ -2426,7 +2426,7 @@
   // Note the separators in the credit card number.
   CreditCard saved_credit_card(base::GenerateGUID(), "https://www.example.com");
   test::SetCreditCardInfo(&saved_credit_card,
-      "Biggie Smalls", "4111 1111 1111 1111" /* Visa */, "01", "2011");
+      "Biggie Smalls", "4111 1111 1111 1111" /* Visa */, "01", "2999");
   personal_data_->AddCreditCard(saved_credit_card);
 
   // Verify that the web database has been updated and the notification sent.
@@ -2441,7 +2441,7 @@
   // Import the same card info, but with different separators in the number.
   FormData form;
   AddFullCreditCardForm(&form, "Biggie Smalls", "4111-1111-1111-1111", "01",
-                        "2011");
+                        "2999");
 
   FormStructure form_structure(form);
   form_structure.DetermineHeuristicTypes();
@@ -2466,7 +2466,7 @@
   // Start with a verified credit card.
   CreditCard credit_card(base::GenerateGUID(), "Chrome settings");
   test::SetCreditCardInfo(&credit_card, "Biggie Smalls",
-                          "4111 1111 1111 1111" /* Visa */, "01", "2011");
+                          "4111 1111 1111 1111" /* Visa */, "01", "2999");
   EXPECT_TRUE(credit_card.IsVerified());
 
   // Add the credit card to the database.
@@ -2480,7 +2480,7 @@
   // Simulate a form submission with conflicting expiration year.
   FormData form;
   AddFullCreditCardForm(&form, "Biggie Smalls", "4111 1111 1111 1111", "01",
-                        /* different year */ "2012");
+                        /* different year */ "3999");
 
   FormStructure form_structure(form);
   form_structure.DetermineHeuristicTypes();
@@ -2527,7 +2527,7 @@
 
   // Credit card section.
   AddFullCreditCardForm(&form, "Biggie Smalls", "4111-1111-1111-1111", "01",
-                        "2011");
+                        "2999");
 
   FormStructure form_structure(form);
   form_structure.DetermineHeuristicTypes();
@@ -2556,7 +2556,7 @@
   // Test that the credit card has also been saved.
   CreditCard expected_card(base::GenerateGUID(), "https://www.example.com");
   test::SetCreditCardInfo(&expected_card, "Biggie Smalls", "4111111111111111",
-                          "01", "2011");
+                          "01", "2999");
   const std::vector<CreditCard*>& results_cards =
       personal_data_->GetCreditCards();
   ASSERT_EQ(1U, results_cards.size());
@@ -2605,7 +2605,7 @@
 
   // Credit card section.
   AddFullCreditCardForm(&form, "Biggie Smalls", "4111-1111-1111-1111", "01",
-                        "2011");
+                        "2999");
 
   FormStructure form_structure(form);
   form_structure.DetermineHeuristicTypes();
@@ -2627,7 +2627,7 @@
   // Test that the credit card has been saved.
   CreditCard expected_card(base::GenerateGUID(), "https://www.example.com");
   test::SetCreditCardInfo(&expected_card, "Biggie Smalls", "4111111111111111",
-                          "01", "2011");
+                          "01", "2999");
   const std::vector<CreditCard*>& results = personal_data_->GetCreditCards();
   ASSERT_EQ(1U, results.size());
   EXPECT_EQ(0, expected_card.Compare(*results[0]));
@@ -2715,7 +2715,7 @@
   // Start with a verified credit card.
   CreditCard credit_card(base::GenerateGUID(), "Chrome settings");
   test::SetCreditCardInfo(&credit_card,
-      "Biggie Smalls", "4111 1111 1111 1111" /* Visa */, "01", "2011");
+      "Biggie Smalls", "4111 1111 1111 1111" /* Visa */, "01", "2999");
   EXPECT_TRUE(credit_card.IsVerified());
 
   // Add the credit card to the database.
@@ -2830,7 +2830,7 @@
   CreditCard credit_card(base::GenerateGUID(), "https://www.example.com");
   test::SetCreditCardInfo(&credit_card,
                           "John Dillinger", "423456789012" /* Visa */,
-                          "01", "2010");
+                          "01", "2999");
   personal_data_->AddCreditCard(credit_card);
 
   // Verify that the web database has been updated and the notification sent.
@@ -3256,7 +3256,7 @@
   std::vector<CreditCard> server_cards;
   server_cards.push_back(CreditCard(CreditCard::MASKED_SERVER_CARD, "b459"));
   test::SetCreditCardInfo(&server_cards.back(), "Emmet Dalton", "2110", "12",
-                          "2012");
+                          "3999");
   server_cards.back().SetTypeForMaskedCard(kVisaCard);
 
   test::SetServerCreditCards(autofill_table_, server_cards);
@@ -3307,7 +3307,7 @@
   std::vector<CreditCard> server_cards;
   server_cards.push_back(CreditCard(CreditCard::MASKED_SERVER_CARD, "b459"));
   test::SetCreditCardInfo(&server_cards.back(), "Emmet Dalton", "2110", "12",
-                          "2012");
+                          "3999");
   server_cards.back().set_use_count(2);
   server_cards.back().set_use_date(base::Time::Now() -
                                    base::TimeDelta::FromDays(1));
@@ -3315,7 +3315,7 @@
 
   server_cards.push_back(CreditCard(CreditCard::FULL_SERVER_CARD, "b460"));
   test::SetCreditCardInfo(&server_cards.back(), "Jesse James", "2109", "12",
-                          "2012");
+                          "3999");
   server_cards.back().set_use_count(6);
   server_cards.back().set_use_date(base::Time::Now() -
                                    base::TimeDelta::FromDays(1));
@@ -3349,7 +3349,7 @@
   CreditCard credit_card0("287151C8-6AB1-487C-9095-28E80BE5DA15",
                           "https://www.example.com");
   test::SetCreditCardInfo(&credit_card0, "Clyde Barrow",
-                          "347666888555" /* American Express */, "04", "2015");
+                          "347666888555" /* American Express */, "04", "3999");
   credit_card0.set_use_count(3);
   credit_card0.set_use_date(base::Time::Now() - base::TimeDelta::FromDays(1));
   personal_data_->AddCreditCard(credit_card0);
@@ -3358,7 +3358,7 @@
                           "https://www.example.com");
   credit_card1.set_use_count(300);
   credit_card1.set_use_date(base::Time::Now() - base::TimeDelta::FromDays(10));
-  test::SetCreditCardInfo(&credit_card1, "John Dillinger", "", "01", "2010");
+  test::SetCreditCardInfo(&credit_card1, "John Dillinger", "", "01", "2999");
   personal_data_->AddCreditCard(credit_card1);
 
   EXPECT_CALL(personal_data_observer_, OnPersonalDataChanged())
@@ -3377,7 +3377,7 @@
   EXPECT_EQ(UTF8ToUTF16("Amex\xC2\xA0\xE2\x8B\xAF"
                         "8555"),
             suggestions[0].value);
-  EXPECT_EQ(ASCIIToUTF16("04/15"), suggestions[0].label);
+  EXPECT_EQ(ASCIIToUTF16("04/99"), suggestions[0].label);
 }
 
 // Tests the suggestions of duplicate local and server credit cards.
@@ -3393,7 +3393,7 @@
   // suggestions since the locally saved card takes precedence.
   server_cards.push_back(CreditCard(CreditCard::MASKED_SERVER_CARD, "a123"));
   test::SetCreditCardInfo(&server_cards.back(), "John Dillinger",
-                          "9012" /* Visa */, "01", "2010");
+                          "9012" /* Visa */, "01", "2999");
   server_cards.back().set_use_count(2);
   server_cards.back().set_use_date(base::Time::Now() -
                                    base::TimeDelta::FromDays(15));
@@ -3403,7 +3403,7 @@
   // card type. Not a dupe and therefore both should appear in the suggestions.
   server_cards.push_back(CreditCard(CreditCard::MASKED_SERVER_CARD, "b456"));
   test::SetCreditCardInfo(&server_cards.back(), "Bonnie Parker", "2109", "12",
-                          "2012");
+                          "3999");
   server_cards.back().set_use_count(3);
   server_cards.back().set_use_date(base::Time::Now() -
                                    base::TimeDelta::FromDays(15));
@@ -3414,7 +3414,7 @@
   // precedence over local cards.
   server_cards.push_back(CreditCard(CreditCard::FULL_SERVER_CARD, "c789"));
   test::SetCreditCardInfo(&server_cards.back(), "Clyde Barrow",
-                          "347666888555" /* American Express */, "04", "2015");
+                          "347666888555" /* American Express */, "04", "3999");
   server_cards.back().set_use_count(1);
   server_cards.back().set_use_date(base::Time::Now() -
                                    base::TimeDelta::FromDays(15));
@@ -3464,7 +3464,7 @@
   // the local card should appear in the suggestions.
   server_cards.push_back(CreditCard(CreditCard::FULL_SERVER_CARD, "c789"));
   test::SetCreditCardInfo(&server_cards.back(), "Clyde Barrow",
-                          "347666888555" /* American Express */, "04", "2015");
+                          "347666888555" /* American Express */, "04", "3999");
 
   test::SetServerCreditCards(autofill_table_, server_cards);
   personal_data_->Refresh();
@@ -3505,7 +3505,7 @@
   CreditCard local_card("287151C8-6AB1-487C-9095-28E80BE5DA15",
                         "https://www.example.com");
   test::SetCreditCardInfo(&local_card, "Homer Simpson",
-                          "423456789012" /* Visa */, "01", "2010");
+                          "423456789012" /* Visa */, "01", "2999");
   local_card.set_use_count(3);
   local_card.set_use_date(base::Time::Now() - base::TimeDelta::FromDays(1));
   credit_cards.push_back(&local_card);
@@ -3513,7 +3513,7 @@
   // Create a full server card that is a duplicate of one of the local cards.
   CreditCard full_server_card(CreditCard::FULL_SERVER_CARD, "c789");
   test::SetCreditCardInfo(&full_server_card, "Homer Simpson",
-                          "423456789012" /* Visa */, "01", "2010");
+                          "423456789012" /* Visa */, "01", "2999");
   full_server_card.set_use_count(1);
   full_server_card.set_use_date(base::Time::Now() -
                                 base::TimeDelta::FromDays(15));
@@ -3536,13 +3536,13 @@
   local_card.set_use_count(300);
   local_card.set_use_date(base::Time::Now() - base::TimeDelta::FromDays(10));
   test::SetCreditCardInfo(&local_card, "Homer Simpson",
-                          "423456789012" /* Visa */, "01", "2010");
+                          "423456789012" /* Visa */, "01", "2999");
   credit_cards.push_back(&local_card);
 
   // Create a masked server card that is a duplicate of a local card.
   CreditCard masked_card(CreditCard::MASKED_SERVER_CARD, "a123");
   test::SetCreditCardInfo(&masked_card, "Homer Simpson", "9012" /* Visa */,
-                          "01", "2010");
+                          "01", "2999");
   masked_card.set_use_count(2);
   masked_card.set_use_date(base::Time::Now() - base::TimeDelta::FromDays(15));
   masked_card.SetTypeForMaskedCard(kVisaCard);
@@ -3562,7 +3562,7 @@
   // Create a full server card that is a duplicate of one of the local cards.
   CreditCard full_server_card(CreditCard::FULL_SERVER_CARD, "c789");
   test::SetCreditCardInfo(&full_server_card, "Homer Simpson",
-                          "423456789012" /* Visa */, "01", "2010");
+                          "423456789012" /* Visa */, "01", "2999");
   full_server_card.set_use_count(1);
   full_server_card.set_use_date(base::Time::Now() -
                                 base::TimeDelta::FromDays(15));
@@ -3571,7 +3571,7 @@
   // Create a masked server card that is a duplicate of a local card.
   CreditCard masked_card(CreditCard::MASKED_SERVER_CARD, "a123");
   test::SetCreditCardInfo(&masked_card, "Homer Simpson", "9012" /* Visa */,
-                          "01", "2010");
+                          "01", "2999");
   masked_card.set_use_count(2);
   masked_card.set_use_date(base::Time::Now() - base::TimeDelta::FromDays(15));
   masked_card.SetTypeForMaskedCard(kVisaCard);
@@ -3596,7 +3596,7 @@
 
   // Create a masked server card that is slightly different of the local card.
   CreditCard credit_card4(CreditCard::MASKED_SERVER_CARD, "b456");
-  test::SetCreditCardInfo(&credit_card4, "Homer Simpson", "2109", "12", "2012");
+  test::SetCreditCardInfo(&credit_card4, "Homer Simpson", "2109", "12", "3999");
   credit_card4.set_use_count(3);
   credit_card4.set_use_date(base::Time::Now() - base::TimeDelta::FromDays(15));
   credit_card4.SetTypeForMaskedCard(kVisaCard);
@@ -3606,7 +3606,7 @@
   // cards.
   CreditCard credit_card5(CreditCard::FULL_SERVER_CARD, "c789");
   test::SetCreditCardInfo(&credit_card5, "Homer Simpson",
-                          "347666888555" /* American Express */, "04", "2015");
+                          "347666888555" /* American Express */, "04", "3999");
   credit_card5.set_use_count(1);
   credit_card5.set_use_date(base::Time::Now() - base::TimeDelta::FromDays(15));
   credit_cards.push_back(&credit_card5);
@@ -3624,7 +3624,7 @@
 
   CreditCard credit_card(base::GenerateGUID(), "https://www.example.com");
   test::SetCreditCardInfo(&credit_card, "John Dillinger",
-                          "423456789012" /* Visa */, "01", "2010");
+                          "423456789012" /* Visa */, "01", "2999");
   EXPECT_EQ(0U, credit_card.use_count());
   EXPECT_EQ(base::Time(), credit_card.use_date());
   EXPECT_EQ(base::Time(), credit_card.modification_date());
@@ -3677,17 +3677,17 @@
   std::vector<CreditCard> server_cards;
   server_cards.push_back(CreditCard(CreditCard::MASKED_SERVER_CARD, "a123"));
   test::SetCreditCardInfo(&server_cards.back(), "John Dillinger",
-                          "9012" /* Visa */, "01", "2010");
+                          "9012" /* Visa */, "01", "2999");
   server_cards.back().SetTypeForMaskedCard(kVisaCard);
 
   server_cards.push_back(CreditCard(CreditCard::MASKED_SERVER_CARD, "b456"));
   test::SetCreditCardInfo(&server_cards.back(), "Bonnie Parker",
-                          "4444" /* Mastercard */, "12", "2012");
+                          "4444" /* Mastercard */, "12", "3999");
   server_cards.back().SetTypeForMaskedCard(kMasterCard);
 
   server_cards.push_back(CreditCard(CreditCard::FULL_SERVER_CARD, "c789"));
   test::SetCreditCardInfo(&server_cards.back(), "Clyde Barrow",
-                          "347666888555" /* American Express */, "04", "2015");
+                          "347666888555" /* American Express */, "04", "3999");
 
   test::SetServerCreditCards(autofill_table_, server_cards);
   personal_data_->Refresh();
@@ -3787,7 +3787,7 @@
   std::vector<CreditCard> server_cards;
   server_cards.push_back(CreditCard(CreditCard::MASKED_SERVER_CARD, "a123"));
   test::SetCreditCardInfo(&server_cards.back(), "John Dillinger",
-                          "9012" /* Visa */, "01", "2010");
+                          "9012" /* Visa */, "01", "2999");
   server_cards.back().SetTypeForMaskedCard(kVisaCard);
   test::SetServerCreditCards(autofill_table_, server_cards);
   personal_data_->Refresh();
@@ -3823,12 +3823,12 @@
   std::vector<CreditCard> server_cards;
   server_cards.push_back(CreditCard(CreditCard::MASKED_SERVER_CARD, "a123"));
   test::SetCreditCardInfo(&server_cards.back(), "John Dillinger",
-                          "1881" /* Visa */, "01", "2017");
+                          "1881" /* Visa */, "01", "4999");
   server_cards.back().SetTypeForMaskedCard(kVisaCard);
 
   server_cards.push_back(CreditCard(CreditCard::FULL_SERVER_CARD, "c789"));
   test::SetCreditCardInfo(&server_cards.back(), "Clyde Barrow",
-                          "347666888555" /* American Express */, "04", "2015");
+                          "347666888555" /* American Express */, "04", "3999");
 
   test::SetServerCreditCards(autofill_table_, server_cards);
   personal_data_->Refresh();
@@ -3850,7 +3850,7 @@
   form1.fields.push_back(field);
   test::CreateTestFormField("Exp Month:", "exp_month", "01", "text", &field);
   form1.fields.push_back(field);
-  test::CreateTestFormField("Exp Year:", "exp_year", "2017", "text", &field);
+  test::CreateTestFormField("Exp Year:", "exp_year", "4999", "text", &field);
   form1.fields.push_back(field);
 
   FormStructure form_structure1(form1);
@@ -3872,7 +3872,7 @@
   form2.fields.push_back(field);
   test::CreateTestFormField("Exp Month:", "exp_month", "04", "text", &field);
   form2.fields.push_back(field);
-  test::CreateTestFormField("Exp Year:", "exp_year", "2015", "text", &field);
+  test::CreateTestFormField("Exp Year:", "exp_year", "3999", "text", &field);
   form2.fields.push_back(field);
 
   FormStructure form_structure2(form2);

diff --git a/components/autofill/core/common/password_form.cc b/components/autofill/core/common/password_form.cc
index acb9b45..c4bcc58 100644
--- a/components/autofill/core/common/password_form.cc
+++ b/components/autofill/core/common/password_form.cc

@@ -64,6 +64,8 @@
   target->SetBoolean("was_parsed_using_autofill_predictions",
                      form.was_parsed_using_autofill_predictions);
   target->SetString("affiliated_web_realm", form.affiliated_web_realm);
+  target->SetBoolean("does_look_like_signup_form",
+                     form.does_look_like_signup_form);
 }
 
 }  // namespace
@@ -84,7 +86,8 @@
       layout(Layout::LAYOUT_OTHER),
       was_parsed_using_autofill_predictions(false),
       is_public_suffix_match(false),
-      is_affiliation_based_match(false) {}
+      is_affiliation_based_match(false),
+      does_look_like_signup_form(false) {}
 
 PasswordForm::PasswordForm(const PasswordForm& other) = default;
 
@@ -128,7 +131,8 @@
              form.was_parsed_using_autofill_predictions &&
          is_public_suffix_match == form.is_public_suffix_match &&
          is_affiliation_based_match == form.is_affiliation_based_match &&
-         affiliated_web_realm == form.affiliated_web_realm;
+         affiliated_web_realm == form.affiliated_web_realm &&
+         does_look_like_signup_form == form.does_look_like_signup_form;
 }
 
 bool PasswordForm::operator!=(const PasswordForm& form) const {

diff --git a/components/autofill/core/common/password_form.h b/components/autofill/core/common/password_form.h
index e28d3b8..f7ba31e 100644
--- a/components/autofill/core/common/password_form.h
+++ b/components/autofill/core/common/password_form.h

@@ -274,6 +274,9 @@
   // found using affiliation-based match.
   bool is_affiliation_based_match;
 
+  // If true, this form looks like SignUp form according to local heuristics.
+  bool does_look_like_signup_form;
+
   // Return true if we consider this form to be a change password form.
   // We use only client heuristics, so it could include signup forms.
   bool IsPossibleChangePasswordForm() const;

diff --git a/components/cronet/android/test/javatests/src/org/chromium/net/DiskStorageTest.java b/components/cronet/android/test/javatests/src/org/chromium/net/DiskStorageTest.java
index 58dc713..38ef644 100644
--- a/components/cronet/android/test/javatests/src/org/chromium/net/DiskStorageTest.java
+++ b/components/cronet/android/test/javatests/src/org/chromium/net/DiskStorageTest.java

@@ -8,6 +8,7 @@
 
 import org.chromium.base.FileUtils;
 import org.chromium.base.PathUtils;
+import org.chromium.base.test.util.DisabledTest;
 import org.chromium.base.test.util.Feature;
 
 import java.io.BufferedReader;
@@ -43,6 +44,8 @@
     @SmallTest
     @Feature({"Cronet"})
     @OnlyRunNativeCronet
+    // Crashing on Android Cronet Builder, see crbug.com/601409.
+    @DisabledTest
     public void testReadOnlyStorageDirectory() throws Exception {
         mReadOnlyStoragePath = PathUtils.getDataDirectory(getContext()) + "/read_only";
         File readOnlyStorage = new File(mReadOnlyStoragePath);
@@ -86,6 +89,8 @@
     @SmallTest
     @Feature({"Cronet"})
     @OnlyRunNativeCronet
+    // Crashing on Android Cronet Builder, see crbug.com/601409.
+    @DisabledTest
     public void testPurgeOldVersion() throws Exception {
         String testStorage = CronetTestFramework.getTestStorage(getContext());
         File versionFile = new File(testStorage + "/version");

diff --git a/components/exo/test/exo_test_helper.cc b/components/exo/test/exo_test_helper.cc
index 84d580a8..2ce2d20 100644
--- a/components/exo/test/exo_test_helper.cc
+++ b/components/exo/test/exo_test_helper.cc

@@ -24,7 +24,7 @@
       ->context_factory()
       ->GetGpuMemoryBufferManager()
       ->AllocateGpuMemoryBuffer(size, gfx::BufferFormat::RGBA_8888,
-                                gfx::BufferUsage::GPU_READ);
+                                gfx::BufferUsage::GPU_READ, 0 /* surface_id */);
 }
 
 }  // namespace test

diff --git a/components/nacl/browser/nacl_file_host.cc b/components/nacl/browser/nacl_file_host.cc
index 36c9eba..4c1cdb6 100644
--- a/components/nacl/browser/nacl_file_host.cc
+++ b/components/nacl/browser/nacl_file_host.cc

@@ -61,8 +61,8 @@
   uint64_t file_token_hi = 0;
   nacl_browser->PutFilePath(file_path, &file_token_lo, &file_token_hi);
 
-  IPC::PlatformFileForTransit file_desc = IPC::TakeFileHandleForProcess(
-      std::move(file), nacl_host_message_filter->PeerHandle());
+  IPC::PlatformFileForTransit file_desc =
+      IPC::TakePlatformFileForTransit(std::move(file));
 
   write_reply_message(reply_msg, file_desc, file_token_lo, file_token_hi);
   nacl_host_message_filter->Send(reply_msg);
@@ -110,8 +110,8 @@
                    static_cast<WriteFileInfoReply>(
                        NaClHostMsg_GetReadonlyPnaclFD::WriteReplyParams)));
   } else {
-    IPC::PlatformFileForTransit target_desc = IPC::TakeFileHandleForProcess(
-        std::move(file_to_open), nacl_host_message_filter->PeerHandle());
+    IPC::PlatformFileForTransit target_desc =
+        IPC::TakePlatformFileForTransit(std::move(file_to_open));
     uint64_t dummy_file_token = 0;
     NaClHostMsg_GetReadonlyPnaclFD::WriteReplyParams(
         reply_msg, target_desc, dummy_file_token, dummy_file_token);
@@ -158,8 +158,8 @@
                      static_cast<WriteFileInfoReply>(
                          NaClHostMsg_OpenNaClExecutable::WriteReplyParams)));
     } else {
-      IPC::PlatformFileForTransit file_desc = IPC::TakeFileHandleForProcess(
-          std::move(file), nacl_host_message_filter->PeerHandle());
+      IPC::PlatformFileForTransit file_desc =
+          IPC::TakePlatformFileForTransit(std::move(file));
       uint64_t dummy_file_token = 0;
       NaClHostMsg_OpenNaClExecutable::WriteReplyParams(
           reply_msg, file_desc, dummy_file_token, dummy_file_token);

diff --git a/components/nacl/browser/nacl_host_message_filter.cc b/components/nacl/browser/nacl_host_message_filter.cc
index 72a9565..c8d0ebfe 100644
--- a/components/nacl/browser/nacl_host_message_filter.cc
+++ b/components/nacl/browser/nacl_host_message_filter.cc

@@ -225,8 +225,8 @@
       continue;
 
     prefetched_resource_files.push_back(NaClResourcePrefetchResult(
-        IPC::TakeFileHandleForProcess(std::move(file), PeerHandle()),
-        file_path_metadata, request_list[i].file_key));
+        IPC::TakePlatformFileForTransit(std::move(file)), file_path_metadata,
+        request_list[i].file_key));
 
     if (prefetched_resource_files.size() >= kMaxPreOpenResourceFiles)
       break;
@@ -301,8 +301,7 @@
     base::File file) {
   if (file.IsValid()) {
     NaClHostMsg_NaClCreateTemporaryFile::WriteReplyParams(
-        reply_msg,
-        IPC::TakeFileHandleForProcess(std::move(file), PeerHandle()));
+        reply_msg, IPC::TakePlatformFileForTransit(std::move(file)));
   } else {
     reply_msg->set_reply_error();
   }

diff --git a/components/nacl/browser/nacl_process_host.cc b/components/nacl/browser/nacl_process_host.cc
index e1a2f275..f1af838 100644
--- a/components/nacl/browser/nacl_process_host.cc
+++ b/components/nacl/browser/nacl_process_host.cc

@@ -965,11 +965,10 @@
     content::BrowserThread::GetBlockingPool()->PostTask(
         FROM_HERE, base::Bind(&CloseFile, base::Passed(std::move(nexe_file_))));
     params.nexe_file_path_metadata = file_path;
-    params.nexe_file = IPC::TakeFileHandleForProcess(
-        std::move(checked_nexe_file), process_->GetData().handle);
+    params.nexe_file =
+        IPC::TakePlatformFileForTransit(std::move(checked_nexe_file));
   } else {
-    params.nexe_file = IPC::TakeFileHandleForProcess(
-        std::move(nexe_file_), process_->GetData().handle);
+    params.nexe_file = IPC::TakePlatformFileForTransit(std::move(nexe_file_));
   }
 
 #if defined(OS_LINUX)
@@ -1232,8 +1231,7 @@
   IPC::PlatformFileForTransit out_handle;
   if (file.IsValid()) {
     out_file_path = file_path;
-    out_handle = IPC::TakeFileHandleForProcess(std::move(file),
-                                               process_->GetData().handle);
+    out_handle = IPC::TakePlatformFileForTransit(std::move(file));
   } else {
     out_handle = IPC::InvalidPlatformFileForTransit();
   }

diff --git a/components/nacl/renderer/manifest_service_channel.cc b/components/nacl/renderer/manifest_service_channel.cc
index b32ee10..1bb962a0 100644
--- a/components/nacl/renderer/manifest_service_channel.cc
+++ b/components/nacl/renderer/manifest_service_channel.cc

@@ -13,6 +13,7 @@
 #include "content/public/common/sandbox_init.h"
 #include "content/public/renderer/render_thread.h"
 #include "ipc/ipc_channel.h"
+#include "ipc/ipc_platform_file.h"
 #include "ipc/ipc_sync_channel.h"
 #include "ppapi/c/pp_errors.h"
 #include "ppapi/c/ppb_file_io.h"

diff --git a/components/ntp_snippets/ntp_snippets_fetcher.cc b/components/ntp_snippets/ntp_snippets_fetcher.cc
index 10e48b0b..df764b7 100644
--- a/components/ntp_snippets/ntp_snippets_fetcher.cc
+++ b/components/ntp_snippets/ntp_snippets_fetcher.cc

@@ -34,6 +34,18 @@
     "    \"local_scoring_params\": {"
     "      \"content_params\": {"
     "        \"only_return_personalized_results\": false"
+    "      },"
+    "      \"content_restricts\": {"
+    "        \"type\": \"METADATA\","
+    "        \"value\": \"TITLE\""
+    "      },"
+    "      \"content_restricts\": {"
+    "        \"type\": \"METADATA\","
+    "        \"value\": \"SNIPPET\""
+    "      },"
+    "      \"content_restricts\": {"
+    "        \"type\": \"METADATA\","
+    "        \"value\": \"THUMBNAIL\""
     "      }"
     "%s"
     "    },"

diff --git a/components/ntp_snippets/ntp_snippets_service.cc b/components/ntp_snippets/ntp_snippets_service.cc
index b03d048..310cacd 100644
--- a/components/ntp_snippets/ntp_snippets_service.cc
+++ b/components/ntp_snippets/ntp_snippets_service.cc

@@ -122,7 +122,6 @@
     const ParseJSONCallback& parse_json_callback)
     : pref_service_(pref_service),
       suggestions_service_(suggestions_service),
-      loaded_(false),
       file_task_runner_(file_task_runner),
       application_language_code_(application_language_code),
       scheduler_(scheduler),
@@ -174,8 +173,7 @@
 
 void NTPSnippetsService::Shutdown() {
   FOR_EACH_OBSERVER(NTPSnippetsServiceObserver, observers_,
-                    NTPSnippetsServiceShutdown(this));
-  loaded_ = false;
+                    NTPSnippetsServiceShutdown());
 }
 
 void NTPSnippetsService::FetchSnippets() {
@@ -203,8 +201,7 @@
 
 void NTPSnippetsService::AddObserver(NTPSnippetsServiceObserver* observer) {
   observers_.AddObserver(observer);
-  if (loaded_)
-    observer->NTPSnippetsServiceLoaded(this);
+  observer->NTPSnippetsServiceLoaded();
 }
 
 void NTPSnippetsService::RemoveObserver(NTPSnippetsServiceObserver* observer) {
@@ -227,7 +224,7 @@
   StoreSnippetsToPrefs();
 
   FOR_EACH_OBSERVER(NTPSnippetsServiceObserver, observers_,
-                    NTPSnippetsServiceLoaded(this));
+                    NTPSnippetsServiceLoaded());
 
   FetchSnippetsImpl(hosts);
 }
@@ -305,7 +302,6 @@
     else
       snippets_.push_back(std::move(snippet));
   }
-  loaded_ = true;
 
   // Immediately remove any already-expired snippets. This will also notify our
   // observers and schedule the expiry timer.
@@ -364,7 +360,7 @@
   StoreDiscardedSnippetsToPrefs();
 
   FOR_EACH_OBSERVER(NTPSnippetsServiceObserver, observers_,
-                    NTPSnippetsServiceLoaded(this));
+                    NTPSnippetsServiceLoaded());
 
   // If there are any snippets left, schedule a timer for the next expiry.
   if (snippets_.empty() && discarded_snippets_.empty())

diff --git a/components/ntp_snippets/ntp_snippets_service.h b/components/ntp_snippets/ntp_snippets_service.h
index ff2b039c0..07ad7a42 100644
--- a/components/ntp_snippets/ntp_snippets_service.h
+++ b/components/ntp_snippets/ntp_snippets_service.h

@@ -72,9 +72,6 @@
   // Inherited from KeyedService.
   void Shutdown() override;
 
-  // True once the data is loaded in memory and available to loop over.
-  bool is_loaded() { return loaded_; }
-
   // Fetches snippets from the server and adds them to the current ones.
   void FetchSnippets();
 
@@ -86,11 +83,8 @@
   void AddObserver(NTPSnippetsServiceObserver* observer);
   void RemoveObserver(NTPSnippetsServiceObserver* observer);
 
-  // Number of snippets available. Can only be called when is_loaded() is true.
-  size_t size() const {
-    DCHECK(loaded_);
-    return snippets_.size();
-  }
+  // Number of snippets available.
+  size_t size() const { return snippets_.size(); }
 
   // The snippets can be iterated upon only via a const_iterator. Recommended
   // way to iterate is as follows:
@@ -99,14 +93,8 @@
   //  for (auto& snippet : *service) {
   //    // |snippet| here is a const object.
   //  }
-  const_iterator begin() const {
-    DCHECK(loaded_);
-    return const_iterator(snippets_.begin());
-  }
-  const_iterator end() const {
-    DCHECK(loaded_);
-    return const_iterator(snippets_.end());
-  }
+  const_iterator begin() const { return const_iterator(snippets_.begin()); }
+  const_iterator end() const { return const_iterator(snippets_.end()); }
 
  private:
   friend class NTPSnippetsServiceTest;
@@ -144,9 +132,6 @@
 
   suggestions::SuggestionsService* suggestions_service_;
 
-  // True if the suggestions are loaded.
-  bool loaded_;
-
   // The SequencedTaskRunner on which file system operations will be run.
   scoped_refptr<base::SequencedTaskRunner> file_task_runner_;
 
@@ -192,10 +177,10 @@
 
 class NTPSnippetsServiceObserver {
  public:
-  // Send everytime the service loads a new set of data.
-  virtual void NTPSnippetsServiceLoaded(NTPSnippetsService* service) = 0;
-  // Send when the service is shutting down.
-  virtual void NTPSnippetsServiceShutdown(NTPSnippetsService* service) = 0;
+  // Sent every time the service loads a new set of data.
+  virtual void NTPSnippetsServiceLoaded() = 0;
+  // Sent when the service is shutting down.
+  virtual void NTPSnippetsServiceShutdown() = 0;
 
  protected:
   virtual ~NTPSnippetsServiceObserver() {}

diff --git a/components/ntp_snippets/ntp_snippets_service_unittest.cc b/components/ntp_snippets/ntp_snippets_service_unittest.cc
index 18f4a2e..699a20ff 100644
--- a/components/ntp_snippets/ntp_snippets_service_unittest.cc
+++ b/components/ntp_snippets/ntp_snippets_service_unittest.cc

@@ -79,27 +79,6 @@
   }
 }
 
-class SnippetObserver : public NTPSnippetsServiceObserver {
- public:
-  SnippetObserver() : loaded_(false), shutdown_(false) {}
-  ~SnippetObserver() override {}
-
-  void NTPSnippetsServiceLoaded(NTPSnippetsService* service) override {
-    loaded_ = true;
-  }
-
-  void NTPSnippetsServiceShutdown(NTPSnippetsService* service) override {
-    shutdown_ = true;
-    loaded_ = false;
-  }
-
-  bool loaded_;
-  bool shutdown_;
-
- private:
-  DISALLOW_COPY_AND_ASSIGN(SnippetObserver);
-};
-
 }  // namespace
 
 class NTPSnippetsServiceTest : public testing::Test {
@@ -148,21 +127,13 @@
   DISALLOW_COPY_AND_ASSIGN(NTPSnippetsServiceTest);
 };
 
-TEST_F(NTPSnippetsServiceTest, Create) {
-  EXPECT_FALSE(service()->is_loaded());
-}
-
 TEST_F(NTPSnippetsServiceTest, Loop) {
-  EXPECT_FALSE(service()->is_loaded());
-
   std::string json_str(
       "{ \"recos\": [ "
       "{ \"contentInfo\": { \"url\" : \"http://localhost/foobar\" }}"
       "]}");
   ASSERT_TRUE(LoadFromJSONString(json_str));
 
-  EXPECT_TRUE(service()->is_loaded());
-
   // The same for loop without the '&' should not compile.
   for (auto& snippet : *service()) {
     // Snippet here is a const.
@@ -200,7 +171,6 @@
   std::string json_str(
       "{ \"recos\": [ { \"contentInfo\": { \"url\" : \"http://site.com\" }}]}");
   ASSERT_TRUE(LoadFromJSONString(json_str));
-  ASSERT_TRUE(service()->is_loaded());
 
   ASSERT_EQ(1u, service()->size());
 
@@ -248,34 +218,4 @@
   EXPECT_EQ(service()->size(), 0u);
 }
 
-TEST_F(NTPSnippetsServiceTest, ObserverNotLoaded) {
-  SnippetObserver observer;
-  ScopedObserver<NTPSnippetsService, SnippetObserver> scoped_observer(
-      &observer);
-  scoped_observer.Add(service());
-  EXPECT_FALSE(observer.loaded_);
-
-  std::string json_str(
-      "{ \"recos\": [ "
-      "{ \"contentInfo\": { \"url\" : \"http://localhost/foobar\" }}"
-      "]}");
-  ASSERT_TRUE(LoadFromJSONString(json_str));
-  EXPECT_TRUE(observer.loaded_);
-}
-
-TEST_F(NTPSnippetsServiceTest, ObserverLoaded) {
-  std::string json_str(
-      "{ \"recos\": [ "
-      "{ \"contentInfo\": { \"url\" : \"http://localhost/foobar\" }}"
-      "]}");
-  ASSERT_TRUE(LoadFromJSONString(json_str));
-
-  SnippetObserver observer;
-  ScopedObserver<NTPSnippetsService, SnippetObserver> scoped_observer(
-      &observer);
-  scoped_observer.Add(service());
-
-  EXPECT_TRUE(observer.loaded_);
-}
-
 }  // namespace ntp_snippets

diff --git a/components/omnibox/browser/suggestion_answer.h b/components/omnibox/browser/suggestion_answer.h
index 6f947a7..0a8a25d8 100644
--- a/components/omnibox/browser/suggestion_answer.h
+++ b/components/omnibox/browser/suggestion_answer.h

@@ -52,6 +52,13 @@
     SUGGESTION_LINK = 11,
     STATUS = 12,
     PERSONALIZED_SUGGESTION = 13,
+    // Deprecated: IMMERSIVE_DESCRIPTION_TEXT = 14,
+    // Deprecated: DATE_TEXT = 15,
+    // Deprecated: PREVIEW_TEXT = 16,
+    ANSWER_TEXT_MEDIUM = 17,
+    ANSWER_TEXT_LARGE = 18,
+    SUGGESTION_SECONDARY_TEXT_SMALL = 19,
+    SUGGESTION_SECONDARY_TEXT_MEDIUM = 20,
   };
 
   class TextField {

diff --git a/components/password_manager/content/renderer/credential_manager_client.cc b/components/password_manager/content/renderer/credential_manager_client.cc
index 6c071a2..3c548e8 100644
--- a/components/password_manager/content/renderer/credential_manager_client.cc
+++ b/components/password_manager/content/renderer/credential_manager_client.cc

@@ -6,6 +6,9 @@
 
 #include <stddef.h>
 
+#include <memory>
+#include <utility>
+
 #include "components/password_manager/content/common/credential_manager_content_utils.h"
 #include "components/password_manager/content/common/credential_manager_messages.h"
 #include "components/password_manager/core/common/credential_manager_types.h"
@@ -13,7 +16,6 @@
 #include "third_party/WebKit/public/platform/WebCredential.h"
 #include "third_party/WebKit/public/platform/WebCredentialManagerError.h"
 #include "third_party/WebKit/public/platform/WebFederatedCredential.h"
-#include "third_party/WebKit/public/platform/WebPassOwnPtr.h"
 #include "third_party/WebKit/public/platform/WebPasswordCredential.h"
 #include "third_party/WebKit/public/web/WebView.h"
 
@@ -76,7 +78,7 @@
                                                const CredentialInfo& info) {
   RequestCallbacks* callbacks = get_callbacks_.Lookup(request_id);
   DCHECK(callbacks);
-  std::unique_ptr<blink::WebCredential> credential = nullptr;
+  std::unique_ptr<blink::WebCredential> credential;
   switch (info.type) {
     case CredentialType::CREDENTIAL_TYPE_FEDERATED:
       credential.reset(new blink::WebFederatedCredential(
@@ -90,7 +92,7 @@
       // Intentionally empty; we'll send nullptr to the onSuccess call below.
       break;
   }
-  callbacks->onSuccess(adoptWebPtr(credential.release()));
+  callbacks->onSuccess(std::move(credential));
   get_callbacks_.Remove(request_id);
 }
 

diff --git a/components/password_manager/content/renderer/credential_manager_client_browsertest.cc b/components/password_manager/content/renderer/credential_manager_client_browsertest.cc
index cb28b97..addbcf2a 100644
--- a/components/password_manager/content/renderer/credential_manager_client_browsertest.cc
+++ b/components/password_manager/content/renderer/credential_manager_client_browsertest.cc

@@ -2,19 +2,20 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+#include "components/password_manager/content/renderer/credential_manager_client.h"
+
 #include <stdint.h>
 
+#include <memory>
 #include <tuple>
 
 #include "components/password_manager/content/common/credential_manager_messages.h"
-#include "components/password_manager/content/renderer/credential_manager_client.h"
 #include "content/public/test/render_view_test.h"
 #include "ipc/ipc_test_sink.h"
 #include "testing/gtest/include/gtest/gtest.h"
 #include "third_party/WebKit/public/platform/WebCredential.h"
 #include "third_party/WebKit/public/platform/WebCredentialManagerClient.h"
 #include "third_party/WebKit/public/platform/WebCredentialManagerError.h"
-#include "third_party/WebKit/public/platform/WebPassOwnPtr.h"
 #include "third_party/WebKit/public/platform/WebPasswordCredential.h"
 
 namespace password_manager {
@@ -130,7 +131,7 @@
 
   ~TestRequestCallbacks() override {}
 
-  void onSuccess(blink::WebPassOwnPtr<blink::WebCredential>) override {
+  void onSuccess(std::unique_ptr<blink::WebCredential>) override {
     test_->set_callback_succeeded(true);
   }
 

diff --git a/components/password_manager/core/browser/password_form_manager.cc b/components/password_manager/core/browser/password_form_manager.cc
index 247d5394..765afaa 100644
--- a/components/password_manager/core/browser/password_form_manager.cc
+++ b/components/password_manager/core/browser/password_form_manager.cc

@@ -291,6 +291,7 @@
   }
   provisionally_saved_form_ = std::move(mutable_provisionally_saved_form);
   other_possible_username_action_ = action;
+  does_look_like_signup_form_ = credentials.does_look_like_signup_form;
 
   if (HasCompletedMatching())
     CreatePendingCredentials();
@@ -618,8 +619,14 @@
     UploadGeneratedVote();
   } else if (pending_credentials_.times_used == 0) {
     if (!observed_form_.IsPossibleChangePasswordFormWithoutUsername())
-      UploadPasswordForm(pending_credentials_.form_data, base::string16(),
-                         autofill::PASSWORD, std::string());
+      UploadPasswordForm(pending_credentials_.form_data,
+                         does_look_like_signup_form_
+                             ? pending_credentials_.username_element
+                             : base::string16(),
+                         does_look_like_signup_form_
+                             ? autofill::PROBABLY_ACCOUNT_CREATION_PASSWORD
+                             : autofill::PASSWORD,
+                         std::string());
     } else {
       if (!observed_form_.IsPossibleChangePasswordFormWithoutUsername())
         SendAutofillVotes(observed_form_, &pending_credentials_);
@@ -819,6 +826,7 @@
     const autofill::ServerFieldType& password_type,
     const std::string& login_form_signature) {
   DCHECK(password_type == autofill::PASSWORD ||
+         password_type == autofill::PROBABLY_ACCOUNT_CREATION_PASSWORD ||
          password_type == autofill::ACCOUNT_CREATION_PASSWORD ||
          autofill::NOT_ACCOUNT_CREATION_PASSWORD);
   DCHECK(!has_generated_password_);

diff --git a/components/password_manager/core/browser/password_form_manager.h b/components/password_manager/core/browser/password_form_manager.h
index b855d15..0cf54a3 100644
--- a/components/password_manager/core/browser/password_form_manager.h
+++ b/components/password_manager/core/browser/password_form_manager.h

@@ -542,6 +542,10 @@
   // |observed_form_| but also on the credentials that the user submitted.
   bool is_possible_change_password_form_without_username_;
 
+  // True if |provisionally_saved_form_| looks like SignUp form according to
+  // local heuristics.
+  bool does_look_like_signup_form_ = false;
+
   typedef enum {
     PRE_MATCHING_PHASE,  // Have not yet invoked a GetLogins query to find
                          // matching login information from password store.

diff --git a/components/password_manager/core/browser/password_form_manager_unittest.cc b/components/password_manager/core/browser/password_form_manager_unittest.cc
index c911e28..fc60ff8 100644
--- a/components/password_manager/core/browser/password_form_manager_unittest.cc
+++ b/components/password_manager/core/browser/password_form_manager_unittest.cc

@@ -2965,4 +2965,49 @@
   EXPECT_EQ(*(form_manager()->best_matches().begin()->second), *saved_match());
 }
 
+TEST_F(PasswordFormManagerTest, ProbablyAccountCreationUpload) {
+  PasswordForm form(*observed_form());
+  form.form_data = saved_match()->form_data;
+
+  PasswordFormManager form_manager(password_manager(), client(),
+                                   client()->driver(), form, false);
+
+  PasswordForm form_to_save(form);
+  form_to_save.preferred = true;
+  form_to_save.username_element = ASCIIToUTF16("observed-username-field");
+  form_to_save.username_value = saved_match()->username_value;
+  form_to_save.password_value = saved_match()->password_value;
+  form_to_save.does_look_like_signup_form = true;
+
+  form_manager.SimulateFetchMatchingLoginsFromPasswordStore();
+  ScopedVector<PasswordForm> result;
+  form_manager.OnGetPasswordStoreResults(std::move(result));
+
+  autofill::FormStructure pending_structure(form_to_save.form_data);
+  autofill::ServerFieldTypeSet expected_available_field_types;
+  std::map<base::string16, autofill::ServerFieldType> expected_types;
+  expected_types[ASCIIToUTF16("full_name")] = autofill::UNKNOWN_TYPE;
+  expected_available_field_types.insert(autofill::USERNAME);
+  expected_types[saved_match()->username_element] = autofill::USERNAME;
+  expected_available_field_types.insert(
+      autofill::PROBABLY_ACCOUNT_CREATION_PASSWORD);
+  expected_types[saved_match()->password_element] =
+      autofill::PROBABLY_ACCOUNT_CREATION_PASSWORD;
+
+  std::map<base::string16,
+           autofill::AutofillUploadContents::Field::PasswordGenerationType>
+      expected_generation_types;
+
+  EXPECT_CALL(
+      *client()->mock_driver()->mock_autofill_download_manager(),
+      StartUploadRequest(
+          CheckUploadFormStructure(pending_structure.FormSignature(),
+                                   expected_types, expected_generation_types),
+          false, expected_available_field_types, std::string(), true));
+
+  form_manager.ProvisionallySave(
+      form_to_save, PasswordFormManager::IGNORE_OTHER_POSSIBLE_USERNAMES);
+  form_manager.Save();
+}
+
 }  // namespace password_manager

diff --git a/components/password_manager/core/browser/password_manager.cc b/components/password_manager/core/browser/password_manager.cc
index fcd0c9d..f4a5750 100644
--- a/components/password_manager/core/browser/password_manager.cc
+++ b/components/password_manager/core/browser/password_manager.cc

@@ -215,7 +215,7 @@
   PasswordFormManager* manager = new PasswordFormManager(
       this, client_, driver->AsWeakPtr(), form, ssl_valid);
   pending_login_managers_.push_back(manager);
-  manager->set_has_generated_password(true);
+  manager->FetchDataFromPasswordStore();
 }
 
 void PasswordManager::ProvisionallySavePassword(const PasswordForm& form) {

diff --git a/components/password_manager/core/browser/password_manager_unittest.cc b/components/password_manager/core/browser/password_manager_unittest.cc
index 9fffb179..0433333 100644
--- a/components/password_manager/core/browser/password_manager_unittest.cc
+++ b/components/password_manager/core/browser/password_manager_unittest.cc

@@ -1266,6 +1266,28 @@
   EXPECT_EQ(form.new_password_value, form_to_save.password_value);
 }
 
+TEST_F(PasswordManagerTest,
+       PasswordGenerationNoCorrespondingPasswordFormManager) {
+  // Verifies that if there is no corresponding password form manager for the
+  // given form, new password form manager should fetch data from the password
+  // store. Also verifies that |SetGenerationElementAndReasonForForm| doesn't
+  // change |has_generated_password_| of new password form manager.
+  EXPECT_CALL(client_, IsSavingAndFillingEnabledForCurrentPage())
+      .WillRepeatedly(Return(true));
+  PasswordForm form(MakeFormWithOnlyNewPasswordField());
+  std::vector<PasswordForm> observed;
+  manager()->OnPasswordFormsParsed(&driver_, observed);
+  manager()->OnPasswordFormsRendered(&driver_, observed, true);
+
+  PasswordStoreConsumer* consumer = nullptr;
+  EXPECT_CALL(*store_, GetLogins(form, _)).WillOnce(SaveArg<1>(&consumer));
+  manager()->SetGenerationElementAndReasonForForm(&driver_, form,
+                                                  base::string16(), false);
+  PasswordFormManager* form_manager =
+      static_cast<PasswordFormManager*>(consumer);
+  EXPECT_FALSE(form_manager->has_generated_password());
+}
+
 TEST_F(PasswordManagerTest, ForceSavingPasswords) {
   // Add the enable-password-force-saving feature.
   base::FeatureList::ClearInstanceForTesting();

diff --git a/components/policy/resources/policy_templates.json b/components/policy/resources/policy_templates.json
index 48cf1b8..d417471 100644
--- a/components/policy/resources/policy_templates.json
+++ b/components/policy/resources/policy_templates.json

@@ -5674,11 +5674,15 @@
       If enabled or not configured (default), the user will be prompted for
       video capture access except for URLs configured in the
       VideoCaptureAllowedUrls list which will be granted access without prompting.
+      ARC-apps will be able to access the camera if they have been given
+      permission.
 
       When this policy is disabled, the user will never be prompted and video
       capture only be available to URLs configured in VideoCaptureAllowedUrls.
+      ARC-apps will not be able to access the camera.
 
-      This policy affects all types of video inputs and not only the built-in camera.''',
+      Outside of ARC-apps, this policy affects all types of video inputs and
+      not only the built-in camera.''',
     },
     {
       'name': 'VideoCaptureAllowedUrls',

diff --git a/components/scheduler/child/web_scheduler_impl.cc b/components/scheduler/child/web_scheduler_impl.cc
index 6c568159..7112a44 100644
--- a/components/scheduler/child/web_scheduler_impl.cc
+++ b/components/scheduler/child/web_scheduler_impl.cc

@@ -87,7 +87,7 @@
   return timer_web_task_runner_.get();
 }
 
-blink::WebPassOwnPtr<blink::WebViewScheduler>
+std::unique_ptr<blink::WebViewScheduler>
 WebSchedulerImpl::createWebViewScheduler(blink::WebView*) {
   NOTREACHED();
   return nullptr;

diff --git a/components/scheduler/child/web_scheduler_impl.h b/components/scheduler/child/web_scheduler_impl.h
index 82c1a2c..8a363cb 100644
--- a/components/scheduler/child/web_scheduler_impl.h
+++ b/components/scheduler/child/web_scheduler_impl.h

@@ -39,7 +39,7 @@
                                blink::WebThread::IdleTask* task) override;
   blink::WebTaskRunner* loadingTaskRunner() override;
   blink::WebTaskRunner* timerTaskRunner() override;
-  blink::WebPassOwnPtr<blink::WebViewScheduler> createWebViewScheduler(
+  std::unique_ptr<blink::WebViewScheduler> createWebViewScheduler(
       blink::WebView*) override;
   void suspendTimerQueue() override {}
   void resumeTimerQueue() override {}

diff --git a/components/scheduler/renderer/renderer_web_scheduler_impl.cc b/components/scheduler/renderer/renderer_web_scheduler_impl.cc
index 4faa081..cb837b3 100644
--- a/components/scheduler/renderer/renderer_web_scheduler_impl.cc
+++ b/components/scheduler/renderer/renderer_web_scheduler_impl.cc

@@ -4,12 +4,14 @@
 
 #include "components/scheduler/renderer/renderer_web_scheduler_impl.h"
 
+#include <memory>
+
 #include "base/command_line.h"
+#include "base/memory/ptr_util.h"
 #include "components/scheduler/base/task_queue.h"
 #include "components/scheduler/common/scheduler_switches.h"
 #include "components/scheduler/renderer/renderer_scheduler_impl.h"
 #include "components/scheduler/renderer/web_view_scheduler_impl.h"
-#include "third_party/WebKit/public/platform/WebPassOwnPtr.h"
 
 namespace scheduler {
 
@@ -32,10 +34,10 @@
   renderer_scheduler_->ResumeTimerQueue();
 }
 
-blink::WebPassOwnPtr<blink::WebViewScheduler>
+std::unique_ptr<blink::WebViewScheduler>
 RendererWebSchedulerImpl::createWebViewScheduler(blink::WebView* web_view) {
   base::CommandLine* command_line = base::CommandLine::ForCurrentProcess();
-  return blink::adoptWebPtr(new WebViewSchedulerImpl(
+  return base::WrapUnique(new WebViewSchedulerImpl(
       web_view, renderer_scheduler_,
       command_line->HasSwitch(switches::kDisableBackgroundTimerThrottling)));
 }

diff --git a/components/scheduler/renderer/renderer_web_scheduler_impl.h b/components/scheduler/renderer/renderer_web_scheduler_impl.h
index acab082..e82d0a22 100644
--- a/components/scheduler/renderer/renderer_web_scheduler_impl.h
+++ b/components/scheduler/renderer/renderer_web_scheduler_impl.h

@@ -20,7 +20,7 @@
   // blink::WebScheduler implementation:
   void suspendTimerQueue() override;
   void resumeTimerQueue() override;
-  blink::WebPassOwnPtr<blink::WebViewScheduler> createWebViewScheduler(
+  std::unique_ptr<blink::WebViewScheduler> createWebViewScheduler(
       blink::WebView* web_view) override;
   void addPendingNavigation() override;
   void removePendingNavigation() override;

diff --git a/components/scheduler/renderer/web_view_scheduler_impl.cc b/components/scheduler/renderer/web_view_scheduler_impl.cc
index ebef3ac..cf857ab 100644
--- a/components/scheduler/renderer/web_view_scheduler_impl.cc
+++ b/components/scheduler/renderer/web_view_scheduler_impl.cc

@@ -62,10 +62,9 @@
   return frame_scheduler;
 }
 
-blink::WebPassOwnPtr<blink::WebFrameScheduler>
+std::unique_ptr<blink::WebFrameScheduler>
 WebViewSchedulerImpl::createFrameScheduler(blink::BlameContext* blame_context) {
-  return blink::adoptWebPtr(
-      createWebFrameSchedulerImpl(blame_context).release());
+  return createWebFrameSchedulerImpl(blame_context);
 }
 
 void WebViewSchedulerImpl::Unregister(WebFrameSchedulerImpl* frame_scheduler) {

diff --git a/components/scheduler/renderer/web_view_scheduler_impl.h b/components/scheduler/renderer/web_view_scheduler_impl.h
index 5174b4f..3782cc3 100644
--- a/components/scheduler/renderer/web_view_scheduler_impl.h
+++ b/components/scheduler/renderer/web_view_scheduler_impl.h

@@ -41,7 +41,7 @@
 
   // blink::WebViewScheduler implementation:
   void setPageVisible(bool page_visible) override;
-  blink::WebPassOwnPtr<blink::WebFrameScheduler> createFrameScheduler(
+  std::unique_ptr<blink::WebFrameScheduler> createFrameScheduler(
       blink::BlameContext* blame_context) override;
   void enableVirtualTime() override;
   void setAllowVirtualTimeToAdvance(

diff --git a/components/scheduler/renderer/web_view_scheduler_impl_unittest.cc b/components/scheduler/renderer/web_view_scheduler_impl_unittest.cc
index fb3e60a..fb14d0a 100644
--- a/components/scheduler/renderer/web_view_scheduler_impl_unittest.cc
+++ b/components/scheduler/renderer/web_view_scheduler_impl_unittest.cc

@@ -58,16 +58,16 @@
 };
 
 TEST_F(WebViewSchedulerImplTest, TestDestructionOfFrameSchedulersBefore) {
-  blink::WebPassOwnPtr<blink::WebFrameScheduler> frame1(
+  std::unique_ptr<blink::WebFrameScheduler> frame1(
       web_view_scheduler_->createFrameScheduler(nullptr));
-  blink::WebPassOwnPtr<blink::WebFrameScheduler> frame2(
+  std::unique_ptr<blink::WebFrameScheduler> frame2(
       web_view_scheduler_->createFrameScheduler(nullptr));
 }
 
 TEST_F(WebViewSchedulerImplTest, TestDestructionOfFrameSchedulersAfter) {
-  blink::WebPassOwnPtr<blink::WebFrameScheduler> frame1(
+  std::unique_ptr<blink::WebFrameScheduler> frame1(
       web_view_scheduler_->createFrameScheduler(nullptr));
-  blink::WebPassOwnPtr<blink::WebFrameScheduler> frame2(
+  std::unique_ptr<blink::WebFrameScheduler> frame2(
       web_view_scheduler_->createFrameScheduler(nullptr));
   web_view_scheduler_.reset();
 }

diff --git a/components/test_runner/event_sender.cc b/components/test_runner/event_sender.cc
index 9be86de8..7d6df6e 100644
--- a/components/test_runner/event_sender.cc
+++ b/components/test_runner/event_sender.cc

@@ -6,6 +6,8 @@
 
 #include <stddef.h>
 
+#include "base/bind.h"
+#include "base/bind_helpers.h"
 #include "base/command_line.h"
 #include "base/logging.h"
 #include "base/macros.h"
@@ -16,6 +18,7 @@
 #include "build/build_config.h"
 #include "components/test_runner/mock_spell_check.h"
 #include "components/test_runner/test_interfaces.h"
+#include "components/test_runner/web_task.h"
 #include "components/test_runner/web_test_delegate.h"
 #include "components/test_runner/web_test_proxy.h"
 #include "gin/handle.h"
@@ -325,55 +328,6 @@
 // WebKit impl and layout test results.
 const float kScrollbarPixelsPerTick = 40.0f;
 
-class MouseDownTask : public WebMethodTask<EventSender> {
- public:
-  MouseDownTask(EventSender* obj, int button_number, int modifiers)
-      : WebMethodTask<EventSender>(obj),
-        button_number_(button_number),
-        modifiers_(modifiers) {}
-
-  void RunIfValid() override { object_->MouseDown(button_number_, modifiers_); }
-
- private:
-  int button_number_;
-  int modifiers_;
-};
-
-class MouseUpTask : public WebMethodTask<EventSender> {
- public:
-  MouseUpTask(EventSender* obj, int button_number, int modifiers)
-      : WebMethodTask<EventSender>(obj),
-        button_number_(button_number),
-        modifiers_(modifiers) {}
-
-  void RunIfValid() override { object_->MouseUp(button_number_, modifiers_); }
-
- private:
-  int button_number_;
-  int modifiers_;
-};
-
-class KeyDownTask : public WebMethodTask<EventSender> {
- public:
-  KeyDownTask(EventSender* obj,
-              const std::string code_str,
-              int modifiers,
-              KeyLocationCode location)
-      : WebMethodTask<EventSender>(obj),
-        code_str_(code_str),
-        modifiers_(modifiers),
-        location_(location) {}
-
-  void RunIfValid() override {
-    object_->KeyDown(code_str_, modifiers_, location_);
-  }
-
- private:
-  std::string code_str_;
-  int modifiers_;
-  KeyLocationCode location_;
-};
-
 bool NeedsShiftModifier(int keyCode) {
   // If code is an uppercase letter, assign a SHIFT key to eventDown.modifier.
   return (keyCode & 0xFF) >= 'A' && (keyCode & 0xFF) <= 'Z';
@@ -1226,7 +1180,7 @@
   last_button_type_ = WebMouseEvent::ButtonNone;
   touch_points_.clear();
   last_context_menu_data_.reset();
-  task_list_.RevokeAll();
+  weak_factory_.InvalidateWeakPtrs();
   current_gesture_location_ = WebPoint(0, 0);
   mouse_event_queue_.clear();
 
@@ -2022,14 +1976,20 @@
 
 
 void EventSender::ScheduleAsynchronousClick(int button_number, int modifiers) {
-  delegate_->PostTask(new MouseDownTask(this, button_number, modifiers));
-  delegate_->PostTask(new MouseUpTask(this, button_number, modifiers));
+  delegate_->PostTask(new WebCallbackTask(
+      base::Bind(&EventSender::MouseDown, weak_factory_.GetWeakPtr(),
+                 button_number, modifiers)));
+  delegate_->PostTask(new WebCallbackTask(
+      base::Bind(&EventSender::MouseUp, weak_factory_.GetWeakPtr(),
+                 button_number, modifiers)));
 }
 
 void EventSender::ScheduleAsynchronousKeyDown(const std::string& code_str,
                                               int modifiers,
                                               KeyLocationCode location) {
-  delegate_->PostTask(new KeyDownTask(this, code_str, modifiers, location));
+  delegate_->PostTask(new WebCallbackTask(
+      base::Bind(&EventSender::KeyDown, weak_factory_.GetWeakPtr(), code_str,
+                 modifiers, location)));
 }
 
 double EventSender::GetCurrentEventTimeSec() {

diff --git a/components/test_runner/event_sender.h b/components/test_runner/event_sender.h
index be4bd7866..91c3cb2a 100644
--- a/components/test_runner/event_sender.h
+++ b/components/test_runner/event_sender.h

@@ -15,7 +15,6 @@
 #include "base/memory/scoped_ptr.h"
 #include "base/memory/weak_ptr.h"
 #include "build/build_config.h"
-#include "components/test_runner/web_task.h"
 #include "third_party/WebKit/public/platform/WebDragData.h"
 #include "third_party/WebKit/public/platform/WebInputEventResult.h"
 #include "third_party/WebKit/public/platform/WebPoint.h"
@@ -69,8 +68,6 @@
                int modifiers,
                KeyLocationCode location);
 
-  WebTaskList* mutable_task_list() { return &task_list_; }
-
   void set_send_wheel_gestures(bool send_wheel_gestures) {
     send_wheel_gestures_ = send_wheel_gestures;
   }
@@ -243,8 +240,6 @@
   int wm_sys_dead_char_;
 #endif
 
-  WebTaskList task_list_;
-
   TestInterfaces* interfaces_;
   WebTestDelegate* delegate_;
   blink::WebView* view_;

diff --git a/components/test_runner/mock_color_chooser.cc b/components/test_runner/mock_color_chooser.cc
index cccdf0d..aa150e98 100644
--- a/components/test_runner/mock_color_chooser.cc
+++ b/components/test_runner/mock_color_chooser.cc

@@ -4,31 +4,20 @@
 
 #include "components/test_runner/mock_color_chooser.h"
 
+#include "base/bind.h"
 #include "components/test_runner/test_runner.h"
+#include "components/test_runner/web_task.h"
 #include "components/test_runner/web_test_delegate.h"
 
 namespace test_runner {
 
-namespace {
-class HostMethodTask : public WebMethodTask<MockColorChooser> {
- public:
-  typedef void (MockColorChooser::*CallbackMethodType)();
-  HostMethodTask(MockColorChooser* object, CallbackMethodType callback)
-      : WebMethodTask<MockColorChooser>(object),
-        callback_(callback) {}
-
-  void RunIfValid() override { (object_->*callback_)(); }
-
- private:
-  CallbackMethodType callback_;
-};
-
-} // namespace
-
 MockColorChooser::MockColorChooser(blink::WebColorChooserClient* client,
                                    WebTestDelegate* delegate,
                                    TestRunner* test_runner)
-    : client_(client), delegate_(delegate), test_runner_(test_runner) {
+    : client_(client),
+      delegate_(delegate),
+      test_runner_(test_runner),
+      weak_factory_(this) {
   test_runner_->DidOpenChooser();
 }
 
@@ -40,7 +29,9 @@
 
 void MockColorChooser::endChooser() {
   delegate_->PostDelayedTask(
-      new HostMethodTask(this, &MockColorChooser::InvokeDidEndChooser), 0);
+      new WebCallbackTask(base::Bind(&MockColorChooser::InvokeDidEndChooser,
+                                     weak_factory_.GetWeakPtr())),
+      0);
 }
 
 void MockColorChooser::InvokeDidEndChooser() {

diff --git a/components/test_runner/mock_color_chooser.h b/components/test_runner/mock_color_chooser.h
index 7ff49201..8e6d87a 100644
--- a/components/test_runner/mock_color_chooser.h
+++ b/components/test_runner/mock_color_chooser.h

@@ -6,7 +6,7 @@
 #define COMPONENTS_TEST_RUNNER_MOCK_COLOR_CHOOSER_H_
 
 #include "base/macros.h"
-#include "components/test_runner/web_task.h"
+#include "base/memory/weak_ptr.h"
 #include "third_party/WebKit/public/web/WebColorChooser.h"
 #include "third_party/WebKit/public/web/WebColorChooserClient.h"
 
@@ -31,13 +31,13 @@
   void endChooser() override;
 
   void InvokeDidEndChooser();
-  WebTaskList* mutable_task_list() { return &task_list_; }
 
  private:
   blink::WebColorChooserClient* client_;
   WebTestDelegate* delegate_;
   TestRunner* test_runner_;
-  WebTaskList task_list_;
+
+  base::WeakPtrFactory<MockColorChooser> weak_factory_;
 
   DISALLOW_COPY_AND_ASSIGN(MockColorChooser);
 };

diff --git a/components/test_runner/mock_credential_manager_client.cc b/components/test_runner/mock_credential_manager_client.cc
index bda8acd..a2d2a3c 100644
--- a/components/test_runner/mock_credential_manager_client.cc
+++ b/components/test_runner/mock_credential_manager_client.cc

@@ -4,8 +4,10 @@
 
 #include "components/test_runner/mock_credential_manager_client.h"
 
+#include <memory>
+#include <utility>
+
 #include "third_party/WebKit/public/platform/WebCredential.h"
-#include "third_party/WebKit/public/platform/WebPassOwnPtr.h"
 
 namespace test_runner {
 
@@ -52,7 +54,7 @@
   if (error_ != blink::WebCredentialManagerNoError)
     callbacks->onError(error_);
   else
-    callbacks->onSuccess(adoptWebPtr(credential_.release()));
+    callbacks->onSuccess(std::move(credential_));
   delete callbacks;
 }
 

diff --git a/components/test_runner/mock_web_media_stream_center.cc b/components/test_runner/mock_web_media_stream_center.cc
index a675f8a..55c0c94 100644
--- a/components/test_runner/mock_web_media_stream_center.cc
+++ b/components/test_runner/mock_web_media_stream_center.cc

@@ -38,14 +38,6 @@
 
 }  // namespace
 
-MockWebMediaStreamCenter::MockWebMediaStreamCenter(
-    blink::WebMediaStreamCenterClient* client,
-    TestInterfaces* interfaces) {
-}
-
-MockWebMediaStreamCenter::~MockWebMediaStreamCenter() {
-}
-
 void MockWebMediaStreamCenter::didEnableMediaStreamTrack(
     const blink::WebMediaStreamTrack& track) {
   track.source().setReadyState(blink::WebMediaStreamSource::ReadyStateLive);

diff --git a/components/test_runner/mock_web_media_stream_center.h b/components/test_runner/mock_web_media_stream_center.h
index 7826bde..8bd68fb 100644
--- a/components/test_runner/mock_web_media_stream_center.h
+++ b/components/test_runner/mock_web_media_stream_center.h

@@ -6,7 +6,6 @@
 #define COMPONENTS_TEST_RUNNER_MOCK_WEB_MEDIA_STREAM_CENTER_H_
 
 #include "base/macros.h"
-#include "components/test_runner/web_task.h"
 #include "third_party/WebKit/public/platform/WebMediaStreamCenter.h"
 
 namespace blink {
@@ -20,9 +19,8 @@
 
 class MockWebMediaStreamCenter : public blink::WebMediaStreamCenter {
  public:
-  MockWebMediaStreamCenter(blink::WebMediaStreamCenterClient* client,
-                           TestInterfaces* interfaces);
-  ~MockWebMediaStreamCenter() override;
+  MockWebMediaStreamCenter() = default;
+  ~MockWebMediaStreamCenter() override {};
 
   void didEnableMediaStreamTrack(
       const blink::WebMediaStreamTrack& track) override;
@@ -41,8 +39,6 @@
       const blink::WebMediaStreamTrack& track) override;
 
  private:
-  WebTaskList task_list_;
-
   DISALLOW_COPY_AND_ASSIGN(MockWebMediaStreamCenter);
 };
 

diff --git a/components/test_runner/mock_web_midi_accessor.cc b/components/test_runner/mock_web_midi_accessor.cc
index f5920bd..b53915b 100644
--- a/components/test_runner/mock_web_midi_accessor.cc
+++ b/components/test_runner/mock_web_midi_accessor.cc

@@ -4,43 +4,22 @@
 
 #include "components/test_runner/mock_web_midi_accessor.h"
 
+#include "base/bind.h"
+#include "base/bind_helpers.h"
 #include "base/macros.h"
 #include "components/test_runner/test_interfaces.h"
 #include "components/test_runner/test_runner.h"
+#include "components/test_runner/web_task.h"
 #include "components/test_runner/web_test_delegate.h"
 #include "components/test_runner/web_test_runner.h"
+#include "third_party/WebKit/public/platform/WebString.h"
 #include "third_party/WebKit/public/platform/modules/webmidi/WebMIDIAccessorClient.h"
 
 namespace test_runner {
 
-namespace {
-
-class DidStartSessionTask : public WebMethodTask<MockWebMIDIAccessor> {
- public:
-  DidStartSessionTask(MockWebMIDIAccessor* object,
-                      blink::WebMIDIAccessorClient* client,
-                      bool result)
-      : WebMethodTask<MockWebMIDIAccessor>(object),
-        client_(client),
-        result_(result) {}
-
-  void RunIfValid() override {
-    client_->didStartSession(result_, "InvalidStateError", "");
-  }
-
- private:
-  blink::WebMIDIAccessorClient* client_;
-  bool result_;
-
-  DISALLOW_COPY_AND_ASSIGN(DidStartSessionTask);
-};
-
-}  // namespace
-
 MockWebMIDIAccessor::MockWebMIDIAccessor(blink::WebMIDIAccessorClient* client,
                                          TestInterfaces* interfaces)
-    : client_(client), interfaces_(interfaces) {
-}
+    : client_(client), interfaces_(interfaces), weak_factory_(this) {}
 
 MockWebMIDIAccessor::~MockWebMIDIAccessor() {
 }
@@ -59,8 +38,13 @@
                             "MockOutputName",
                             "MockOutputVersion",
                             state);
-  interfaces_->GetDelegate()->PostTask(new DidStartSessionTask(
-      this, client_, interfaces_->GetTestRunner()->midiAccessorResult()));
+  interfaces_->GetDelegate()->PostTask(new WebCallbackTask(base::Bind(
+      &MockWebMIDIAccessor::ReportStartedSession, weak_factory_.GetWeakPtr(),
+      interfaces_->GetTestRunner()->midiAccessorResult())));
+}
+
+void MockWebMIDIAccessor::ReportStartedSession(bool success) {
+  client_->didStartSession(success, "InvalidStateError", "");
 }
 
 void MockWebMIDIAccessor::sendMIDIData(unsigned port_index,

diff --git a/components/test_runner/mock_web_midi_accessor.h b/components/test_runner/mock_web_midi_accessor.h
index 661329a..8728291 100644
--- a/components/test_runner/mock_web_midi_accessor.h
+++ b/components/test_runner/mock_web_midi_accessor.h

@@ -8,7 +8,7 @@
 #include <stddef.h>
 
 #include "base/macros.h"
-#include "components/test_runner/web_task.h"
+#include "base/memory/weak_ptr.h"
 #include "third_party/WebKit/public/platform/modules/webmidi/WebMIDIAccessor.h"
 
 namespace blink {
@@ -32,14 +32,14 @@
                     size_t length,
                     double timestamp) override;
 
-  // WebTask related methods
-  WebTaskList* mutable_task_list() { return &task_list_; }
-
  private:
+  void ReportStartedSession(bool success);
+
   blink::WebMIDIAccessorClient* client_;
-  WebTaskList task_list_;
   TestInterfaces* interfaces_;
 
+  base::WeakPtrFactory<MockWebMIDIAccessor> weak_factory_;
+
   DISALLOW_COPY_AND_ASSIGN(MockWebMIDIAccessor);
 };
 

diff --git a/components/test_runner/mock_web_speech_recognizer.cc b/components/test_runner/mock_web_speech_recognizer.cc
index 0106f37..78f9176 100644
--- a/components/test_runner/mock_web_speech_recognizer.cc
+++ b/components/test_runner/mock_web_speech_recognizer.cc

@@ -6,8 +6,11 @@
 
 #include <stddef.h>
 
+#include "base/bind.h"
+#include "base/bind_helpers.h"
 #include "base/logging.h"
 #include "base/macros.h"
+#include "components/test_runner/web_task.h"
 #include "components/test_runner/web_test_delegate.h"
 #include "third_party/WebKit/public/web/WebSpeechRecognitionResult.h"
 #include "third_party/WebKit/public/web/WebSpeechRecognizerClient.h"
@@ -129,8 +132,10 @@
 }  // namespace
 
 MockWebSpeechRecognizer::MockWebSpeechRecognizer()
-    : was_aborted_(false), task_queue_running_(false), delegate_(0) {
-}
+    : was_aborted_(false),
+      task_queue_running_(false),
+      delegate_(0),
+      weak_factory_(this) {}
 
 MockWebSpeechRecognizer::~MockWebSpeechRecognizer() {
   ClearTaskQueue();
@@ -239,8 +244,7 @@
 void MockWebSpeechRecognizer::StartTaskQueue() {
   if (task_queue_running_)
     return;
-  delegate_->PostTask(new StepTask(this));
-  task_queue_running_ = true;
+  PostRunTaskFromQueue();
 }
 
 void MockWebSpeechRecognizer::ClearTaskQueue() {
@@ -251,23 +255,29 @@
   task_queue_running_ = false;
 }
 
-void MockWebSpeechRecognizer::StepTask::RunIfValid() {
-  if (object_->task_queue_.empty()) {
-    object_->task_queue_running_ = false;
+void MockWebSpeechRecognizer::PostRunTaskFromQueue() {
+  task_queue_running_ = true;
+  delegate_->PostTask(new WebCallbackTask(base::Bind(
+      &MockWebSpeechRecognizer::RunTaskFromQueue, weak_factory_.GetWeakPtr())));
+}
+
+void MockWebSpeechRecognizer::RunTaskFromQueue() {
+  if (task_queue_.empty()) {
+    task_queue_running_ = false;
     return;
   }
 
-  MockWebSpeechRecognizer::Task* task = object_->task_queue_.front();
-  object_->task_queue_.pop_front();
+  MockWebSpeechRecognizer::Task* task = task_queue_.front();
+  task_queue_.pop_front();
   task->run();
   delete task;
 
-  if (object_->task_queue_.empty()) {
-    object_->task_queue_running_ = false;
+  if (task_queue_.empty()) {
+    task_queue_running_ = false;
     return;
   }
 
-  object_->delegate_->PostTask(new StepTask(object_));
+  PostRunTaskFromQueue();
 }
 
 }  // namespace test_runner

diff --git a/components/test_runner/mock_web_speech_recognizer.h b/components/test_runner/mock_web_speech_recognizer.h
index b3950de..e80897a 100644
--- a/components/test_runner/mock_web_speech_recognizer.h
+++ b/components/test_runner/mock_web_speech_recognizer.h

@@ -9,7 +9,7 @@
 #include <vector>
 
 #include "base/macros.h"
-#include "components/test_runner/web_task.h"
+#include "base/memory/weak_ptr.h"
 #include "third_party/WebKit/public/web/WebSpeechRecognizer.h"
 
 namespace blink {
@@ -47,7 +47,6 @@
   // Methods accessed from Task objects:
   blink::WebSpeechRecognizerClient* Client() { return client_; }
   blink::WebSpeechRecognitionHandle& Handle() { return handle_; }
-  WebTaskList* mutable_task_list() { return &task_list_; }
 
   class Task {
    public:
@@ -65,8 +64,9 @@
  private:
   void StartTaskQueue();
   void ClearTaskQueue();
+  void PostRunTaskFromQueue();
+  void RunTaskFromQueue();
 
-  WebTaskList task_list_;
   blink::WebSpeechRecognitionHandle handle_;
   blink::WebSpeechRecognizerClient* client_;
   std::vector<blink::WebString> mock_transcripts_;
@@ -79,16 +79,7 @@
 
   WebTestDelegate* delegate_;
 
-  // Task for stepping the queue.
-  class StepTask : public WebMethodTask<MockWebSpeechRecognizer> {
-   public:
-    StepTask(MockWebSpeechRecognizer* object)
-        : WebMethodTask<MockWebSpeechRecognizer>(object) {}
-    void RunIfValid() override;
-
-   private:
-    DISALLOW_COPY_AND_ASSIGN(StepTask);
-  };
+  base::WeakPtrFactory<MockWebSpeechRecognizer> weak_factory_;
 
   DISALLOW_COPY_AND_ASSIGN(MockWebSpeechRecognizer);
 };

diff --git a/components/test_runner/mock_web_user_media_client.cc b/components/test_runner/mock_web_user_media_client.cc
index f39357a..e83105f 100644
--- a/components/test_runner/mock_web_user_media_client.cc
+++ b/components/test_runner/mock_web_user_media_client.cc

@@ -6,8 +6,11 @@
 
 #include <stddef.h>
 
+#include "base/bind.h"
+#include "base/bind_helpers.h"
 #include "base/logging.h"
 #include "base/macros.h"
+#include "components/test_runner/web_task.h"
 #include "components/test_runner/web_test_delegate.h"
 #include "third_party/WebKit/public/platform/WebMediaConstraints.h"
 #include "third_party/WebKit/public/platform/WebMediaDeviceInfo.h"
@@ -35,102 +38,13 @@
 
 namespace test_runner {
 
-class UserMediaRequestTask : public WebMethodTask<MockWebUserMediaClient> {
- public:
-  UserMediaRequestTask(MockWebUserMediaClient* object,
-                       const WebUserMediaRequest& request,
-                       const WebMediaStream result)
-      : WebMethodTask<MockWebUserMediaClient>(object),
-        request_(request),
-        result_(result) {
-    DCHECK(!result_.isNull());
-  }
-
-  void RunIfValid() override { request_.requestSucceeded(result_); }
-
- private:
-  WebUserMediaRequest request_;
-  WebMediaStream result_;
-
-  DISALLOW_COPY_AND_ASSIGN(UserMediaRequestTask);
-};
-
-class UserMediaRequestConstraintFailedTask
-    : public WebMethodTask<MockWebUserMediaClient> {
- public:
-  UserMediaRequestConstraintFailedTask(MockWebUserMediaClient* object,
-                                       const WebUserMediaRequest& request,
-                                       const WebString& constraint)
-      : WebMethodTask<MockWebUserMediaClient>(object),
-        request_(request),
-        constraint_(constraint) {}
-
-  void RunIfValid() override { request_.requestFailedConstraint(constraint_); }
-
- private:
-  WebUserMediaRequest request_;
-  WebString constraint_;
-
-  DISALLOW_COPY_AND_ASSIGN(UserMediaRequestConstraintFailedTask);
-};
-
-class UserMediaRequestPermissionDeniedTask
-    : public WebMethodTask<MockWebUserMediaClient> {
- public:
-  UserMediaRequestPermissionDeniedTask(MockWebUserMediaClient* object,
-                                       const WebUserMediaRequest& request)
-      : WebMethodTask<MockWebUserMediaClient>(object),
-        request_(request) {}
-
-  void RunIfValid() override { request_.requestFailed(); }
-
- private:
-  WebUserMediaRequest request_;
-
-  DISALLOW_COPY_AND_ASSIGN(UserMediaRequestPermissionDeniedTask);
-};
-
-class MediaDevicesRequestTask : public WebMethodTask<MockWebUserMediaClient> {
- public:
-  MediaDevicesRequestTask(MockWebUserMediaClient* object,
-                          const WebMediaDevicesRequest& request,
-                          const WebVector<WebMediaDeviceInfo>& result)
-      : WebMethodTask<MockWebUserMediaClient>(object),
-        request_(request),
-        result_(result) {}
-
-  void RunIfValid() override { request_.requestSucceeded(result_); }
-
- private:
-  WebMediaDevicesRequest request_;
-  WebVector<WebMediaDeviceInfo> result_;
-
-  DISALLOW_COPY_AND_ASSIGN(MediaDevicesRequestTask);
-};
-
-class SourcesRequestTask : public WebMethodTask<MockWebUserMediaClient> {
- public:
-  SourcesRequestTask(MockWebUserMediaClient* object,
-                     const WebMediaStreamTrackSourcesRequest& request,
-                     const WebVector<WebSourceInfo>& result)
-      : WebMethodTask<MockWebUserMediaClient>(object),
-        request_(request),
-        result_(result) {}
-
-  void RunIfValid() override { request_.requestSucceeded(result_); }
-
- private:
-  WebMediaStreamTrackSourcesRequest request_;
-  WebVector<WebSourceInfo> result_;
-
-  DISALLOW_COPY_AND_ASSIGN(SourcesRequestTask);
-};
-
 class MockExtraData : public WebMediaStream::ExtraData {
 };
 
 MockWebUserMediaClient::MockWebUserMediaClient(WebTestDelegate* delegate)
-    : delegate_(delegate) {}
+    : delegate_(delegate), weak_factory_(this) {}
+
+MockWebUserMediaClient::~MockWebUserMediaClient() {}
 
 void MockWebUserMediaClient::requestUserMedia(
     const WebUserMediaRequest& stream_request) {
@@ -138,9 +52,10 @@
     WebUserMediaRequest request = stream_request;
 
     if (request.ownerDocument().isNull() || !request.ownerDocument().frame()) {
-      delegate_->PostTask(
-          new UserMediaRequestPermissionDeniedTask(this, request));
-        return;
+      delegate_->PostTask(new WebCallbackTask(base::Bind(
+          &WebUserMediaRequest::requestFailed,
+          base::Owned(new WebUserMediaRequest(request)), WebString())));
+      return;
     }
 
     WebMediaStream stream;
@@ -173,7 +88,9 @@
       stream.addTrack(web_track);
     }
 
-    delegate_->PostTask(new UserMediaRequestTask(this, request, stream));
+    delegate_->PostTask(new WebCallbackTask(
+        base::Bind(&WebUserMediaRequest::requestSucceeded,
+                   base::Owned(new WebUserMediaRequest(request)), stream)));
 }
 
 void MockWebUserMediaClient::cancelUserMediaRequest(
@@ -216,7 +133,9 @@
                           WebString::fromUTF8(test_devices[i].group_id));
   }
 
-  delegate_->PostTask(new MediaDevicesRequestTask(this, request, devices));
+  delegate_->PostTask(new WebCallbackTask(
+      base::Bind(&WebMediaDevicesRequest::requestSucceeded,
+                 base::Owned(new WebMediaDevicesRequest(request)), devices)));
 }
 
 void MockWebUserMediaClient::cancelMediaDevicesRequest(
@@ -253,7 +172,9 @@
                         test_sources[i].facing);
   }
 
-  delegate_->PostTask(new SourcesRequestTask(this, request, sources));
+  delegate_->PostTask(new WebCallbackTask(base::Bind(
+      &WebMediaStreamTrackSourcesRequest::requestSucceeded,
+      base::Owned(new WebMediaStreamTrackSourcesRequest(request)), sources)));
 }
 
 }  // namespace test_runner

diff --git a/components/test_runner/mock_web_user_media_client.h b/components/test_runner/mock_web_user_media_client.h
index dda0d4df..5649f79 100644
--- a/components/test_runner/mock_web_user_media_client.h
+++ b/components/test_runner/mock_web_user_media_client.h

@@ -6,7 +6,7 @@
 #define COMPONENTS_TEST_RUNNER_MOCK_WEB_USER_MEDIA_CLIENT_H_
 
 #include "base/macros.h"
-#include "components/test_runner/web_task.h"
+#include "base/memory/weak_ptr.h"
 #include "third_party/WebKit/public/web/WebUserMediaClient.h"
 
 namespace test_runner {
@@ -16,7 +16,7 @@
 class MockWebUserMediaClient : public blink::WebUserMediaClient {
  public:
   explicit MockWebUserMediaClient(WebTestDelegate* delegate);
-  ~MockWebUserMediaClient() override {}
+  ~MockWebUserMediaClient() override;
 
   void requestUserMedia(const blink::WebUserMediaRequest&) override;
   void cancelUserMediaRequest(const blink::WebUserMediaRequest&) override;
@@ -24,13 +24,11 @@
   void cancelMediaDevicesRequest(const blink::WebMediaDevicesRequest&) override;
   void requestSources(const blink::WebMediaStreamTrackSourcesRequest&) override;
 
-  // Task related methods
-  WebTaskList* mutable_task_list() { return &task_list_; }
-
  private:
-  WebTaskList task_list_;
   WebTestDelegate* delegate_;
 
+  base::WeakPtrFactory<MockWebUserMediaClient> weak_factory_;
+
   DISALLOW_COPY_AND_ASSIGN(MockWebUserMediaClient);
 };
 

diff --git a/components/test_runner/mock_webrtc_data_channel_handler.cc b/components/test_runner/mock_webrtc_data_channel_handler.cc
index c4419c2..797651f 100644
--- a/components/test_runner/mock_webrtc_data_channel_handler.cc
+++ b/components/test_runner/mock_webrtc_data_channel_handler.cc

@@ -4,7 +4,10 @@
 
 #include "components/test_runner/mock_webrtc_data_channel_handler.h"
 
+#include "base/bind.h"
+#include "base/bind_helpers.h"
 #include "base/logging.h"
+#include "components/test_runner/web_task.h"
 #include "components/test_runner/web_test_delegate.h"
 #include "third_party/WebKit/public/platform/WebRTCDataChannelHandlerClient.h"
 
@@ -12,42 +15,28 @@
 
 namespace test_runner {
 
-class DataChannelReadyStateTask
-    : public WebMethodTask<MockWebRTCDataChannelHandler> {
- public:
-  DataChannelReadyStateTask(MockWebRTCDataChannelHandler* object,
-                            WebRTCDataChannelHandlerClient* data_channel_client,
-                            WebRTCDataChannelHandlerClient::ReadyState state)
-      : WebMethodTask<MockWebRTCDataChannelHandler>(object),
-        data_channel_client_(data_channel_client),
-        state_(state) {}
-
-  void RunIfValid() override {
-    data_channel_client_->didChangeReadyState(state_);
-  }
-
- private:
-  WebRTCDataChannelHandlerClient* data_channel_client_;
-  WebRTCDataChannelHandlerClient::ReadyState state_;
-};
-
-/////////////////////
-
 MockWebRTCDataChannelHandler::MockWebRTCDataChannelHandler(
     WebString label,
     const WebRTCDataChannelInit& init,
     WebTestDelegate* delegate)
-    : client_(0), label_(label), init_(init), delegate_(delegate) {
+    : client_(0),
+      label_(label),
+      init_(init),
+      delegate_(delegate),
+      weak_factory_(this) {
   reliable_ = (init.ordered && init.maxRetransmits == -1 &&
                init.maxRetransmitTime == -1);
 }
 
+MockWebRTCDataChannelHandler::~MockWebRTCDataChannelHandler() {}
+
 void MockWebRTCDataChannelHandler::setClient(
     WebRTCDataChannelHandlerClient* client) {
   client_ = client;
   if (client_)
-    delegate_->PostTask(new DataChannelReadyStateTask(
-        this, client_, WebRTCDataChannelHandlerClient::ReadyStateOpen));
+    delegate_->PostTask(new WebCallbackTask(
+        base::Bind(&MockWebRTCDataChannelHandler::ReportOpenedState,
+                   weak_factory_.GetWeakPtr())));
 }
 
 blink::WebString MockWebRTCDataChannelHandler::label() {
@@ -105,8 +94,18 @@
 
 void MockWebRTCDataChannelHandler::close() {
   DCHECK(client_);
-  delegate_->PostTask(new DataChannelReadyStateTask(
-      this, client_, WebRTCDataChannelHandlerClient::ReadyStateClosed));
+  delegate_->PostTask(new WebCallbackTask(
+      base::Bind(&MockWebRTCDataChannelHandler::ReportClosedState,
+                 weak_factory_.GetWeakPtr())));
+}
+
+void MockWebRTCDataChannelHandler::ReportOpenedState() {
+  client_->didChangeReadyState(WebRTCDataChannelHandlerClient::ReadyStateOpen);
+}
+
+void MockWebRTCDataChannelHandler::ReportClosedState() {
+  client_->didChangeReadyState(
+      WebRTCDataChannelHandlerClient::ReadyStateClosed);
 }
 
 }  // namespace test_runner

diff --git a/components/test_runner/mock_webrtc_data_channel_handler.h b/components/test_runner/mock_webrtc_data_channel_handler.h
index 403a219..5b16b12a 100644
--- a/components/test_runner/mock_webrtc_data_channel_handler.h
+++ b/components/test_runner/mock_webrtc_data_channel_handler.h

@@ -8,7 +8,7 @@
 #include <stddef.h>
 
 #include "base/macros.h"
-#include "components/test_runner/web_task.h"
+#include "base/memory/weak_ptr.h"
 #include "third_party/WebKit/public/platform/WebRTCDataChannelHandler.h"
 #include "third_party/WebKit/public/platform/WebRTCDataChannelHandlerClient.h"
 #include "third_party/WebKit/public/platform/WebRTCDataChannelInit.h"
@@ -23,6 +23,7 @@
   MockWebRTCDataChannelHandler(blink::WebString label,
                                const blink::WebRTCDataChannelInit& init,
                                WebTestDelegate* delegate);
+  ~MockWebRTCDataChannelHandler() override;
 
   // WebRTCDataChannelHandler related methods
   void setClient(blink::WebRTCDataChannelHandlerClient* client) override;
@@ -40,19 +41,19 @@
   bool sendRawData(const char* data, size_t size) override;
   void close() override;
 
-  // WebTask related methods
-  WebTaskList* mutable_task_list() { return &task_list_; }
-
  private:
   MockWebRTCDataChannelHandler();
+  void ReportOpenedState();
+  void ReportClosedState();
 
   blink::WebRTCDataChannelHandlerClient* client_;
   blink::WebString label_;
   blink::WebRTCDataChannelInit init_;
   bool reliable_;
-  WebTaskList task_list_;
   WebTestDelegate* delegate_;
 
+  base::WeakPtrFactory<MockWebRTCDataChannelHandler> weak_factory_;
+
   DISALLOW_COPY_AND_ASSIGN(MockWebRTCDataChannelHandler);
 };
 

diff --git a/components/test_runner/mock_webrtc_dtmf_sender_handler.cc b/components/test_runner/mock_webrtc_dtmf_sender_handler.cc
index 4a4d33c..363b6da 100644
--- a/components/test_runner/mock_webrtc_dtmf_sender_handler.cc
+++ b/components/test_runner/mock_webrtc_dtmf_sender_handler.cc

@@ -4,7 +4,10 @@
 
 #include "components/test_runner/mock_webrtc_dtmf_sender_handler.h"
 
+#include "base/bind.h"
+#include "base/bind_helpers.h"
 #include "base/logging.h"
+#include "components/test_runner/web_task.h"
 #include "components/test_runner/web_test_delegate.h"
 #include "third_party/WebKit/public/platform/WebMediaStreamSource.h"
 #include "third_party/WebKit/public/platform/WebRTCDTMFSenderHandlerClient.h"
@@ -13,29 +16,12 @@
 
 namespace test_runner {
 
-class DTMFSenderToneTask : public WebMethodTask<MockWebRTCDTMFSenderHandler> {
- public:
-  DTMFSenderToneTask(MockWebRTCDTMFSenderHandler* object,
-                     WebRTCDTMFSenderHandlerClient* client)
-      : WebMethodTask<MockWebRTCDTMFSenderHandler>(object), client_(client) {}
-
-  void RunIfValid() override {
-    WebString tones = object_->currentToneBuffer();
-    object_->ClearToneBuffer();
-    client_->didPlayTone(tones);
-  }
-
- private:
-  WebRTCDTMFSenderHandlerClient* client_;
-};
-
-/////////////////////
-
 MockWebRTCDTMFSenderHandler::MockWebRTCDTMFSenderHandler(
     const WebMediaStreamTrack& track,
     WebTestDelegate* delegate)
-    : client_(0), track_(track), delegate_(delegate) {
-}
+    : client_(0), track_(track), delegate_(delegate), weak_factory_(this) {}
+
+MockWebRTCDTMFSenderHandler::~MockWebRTCDTMFSenderHandler() {}
 
 void MockWebRTCDTMFSenderHandler::setClient(
     WebRTCDTMFSenderHandlerClient* client) {
@@ -62,9 +48,17 @@
     return false;
 
   tone_buffer_ = tones;
-  delegate_->PostTask(new DTMFSenderToneTask(this, client_));
-  delegate_->PostTask(new DTMFSenderToneTask(this, client_));
+  base::Closure closure = base::Bind(&MockWebRTCDTMFSenderHandler::PlayTone,
+                                     weak_factory_.GetWeakPtr());
+  delegate_->PostTask(new WebCallbackTask(closure));
+  delegate_->PostTask(new WebCallbackTask(closure));
   return true;
 }
 
+void MockWebRTCDTMFSenderHandler::PlayTone() {
+  WebString tones = currentToneBuffer();
+  ClearToneBuffer();
+  client_->didPlayTone(tones);
+}
+
 }  // namespace test_runner

diff --git a/components/test_runner/mock_webrtc_dtmf_sender_handler.h b/components/test_runner/mock_webrtc_dtmf_sender_handler.h
index 4e6487a..20b2b03 100644
--- a/components/test_runner/mock_webrtc_dtmf_sender_handler.h
+++ b/components/test_runner/mock_webrtc_dtmf_sender_handler.h

@@ -6,7 +6,7 @@
 #define COMPONENTS_TEST_RUNNER_MOCK_WEBRTC_DTMF_SENDER_HANDLER_H_
 
 #include "base/macros.h"
-#include "components/test_runner/web_task.h"
+#include "base/memory/weak_ptr.h"
 #include "third_party/WebKit/public/platform/WebMediaStreamTrack.h"
 #include "third_party/WebKit/public/platform/WebRTCDTMFSenderHandler.h"
 #include "third_party/WebKit/public/platform/WebString.h"
@@ -19,6 +19,7 @@
  public:
   MockWebRTCDTMFSenderHandler(const blink::WebMediaStreamTrack& track,
                               WebTestDelegate* delegate);
+  ~MockWebRTCDTMFSenderHandler() override;
 
   // WebRTCDTMFSenderHandler related methods
   void setClient(blink::WebRTCDTMFSenderHandlerClient* client) override;
@@ -28,20 +29,18 @@
                   long duration,
                   long inter_tone_gap) override;
 
-  // WebTask related methods
-  WebTaskList* mutable_task_list() { return &task_list_; }
-
   void ClearToneBuffer() { tone_buffer_.reset(); }
 
  private:
-  MockWebRTCDTMFSenderHandler();
+  void PlayTone();
 
   blink::WebRTCDTMFSenderHandlerClient* client_;
   blink::WebMediaStreamTrack track_;
   blink::WebString tone_buffer_;
-  WebTaskList task_list_;
   WebTestDelegate* delegate_;
 
+  base::WeakPtrFactory<MockWebRTCDTMFSenderHandler> weak_factory_;
+
   DISALLOW_COPY_AND_ASSIGN(MockWebRTCDTMFSenderHandler);
 };
 

diff --git a/components/test_runner/mock_webrtc_peer_connection_handler.cc b/components/test_runner/mock_webrtc_peer_connection_handler.cc
index 079d95f..465f414 100644
--- a/components/test_runner/mock_webrtc_peer_connection_handler.cc
+++ b/components/test_runner/mock_webrtc_peer_connection_handler.cc

@@ -6,9 +6,12 @@
 
 #include <stddef.h>
 
+#include "base/bind.h"
+#include "base/bind_helpers.h"
 #include "components/test_runner/mock_webrtc_data_channel_handler.h"
 #include "components/test_runner/mock_webrtc_dtmf_sender_handler.h"
 #include "components/test_runner/test_interfaces.h"
+#include "components/test_runner/web_task.h"
 #include "components/test_runner/web_test_delegate.h"
 #include "third_party/WebKit/public/platform/WebMediaStream.h"
 #include "third_party/WebKit/public/platform/WebMediaStreamSource.h"
@@ -26,129 +29,8 @@
 
 namespace test_runner {
 
-class RTCSessionDescriptionRequestSuccededTask
-    : public WebMethodTask<MockWebRTCPeerConnectionHandler> {
- public:
-  RTCSessionDescriptionRequestSuccededTask(
-      MockWebRTCPeerConnectionHandler* object,
-      const WebRTCSessionDescriptionRequest& request,
-      const WebRTCSessionDescription& result)
-      : WebMethodTask<MockWebRTCPeerConnectionHandler>(object),
-        request_(request),
-        result_(result) {}
-
-  void RunIfValid() override { request_.requestSucceeded(result_); }
-
- private:
-  WebRTCSessionDescriptionRequest request_;
-  WebRTCSessionDescription result_;
-};
-
-class RTCSessionDescriptionRequestFailedTask
-    : public WebMethodTask<MockWebRTCPeerConnectionHandler> {
- public:
-  RTCSessionDescriptionRequestFailedTask(
-      MockWebRTCPeerConnectionHandler* object,
-      const WebRTCSessionDescriptionRequest& request)
-      : WebMethodTask<MockWebRTCPeerConnectionHandler>(object),
-        request_(request) {}
-
-  void RunIfValid() override { request_.requestFailed("TEST_ERROR"); }
-
- private:
-  WebRTCSessionDescriptionRequest request_;
-};
-
-class RTCStatsRequestSucceededTask
-    : public WebMethodTask<MockWebRTCPeerConnectionHandler> {
- public:
-  RTCStatsRequestSucceededTask(MockWebRTCPeerConnectionHandler* object,
-                               const blink::WebRTCStatsRequest& request,
-                               const blink::WebRTCStatsResponse& response)
-      : WebMethodTask<MockWebRTCPeerConnectionHandler>(object),
-        request_(request),
-        response_(response) {}
-
-  void RunIfValid() override { request_.requestSucceeded(response_); }
-
- private:
-  blink::WebRTCStatsRequest request_;
-  blink::WebRTCStatsResponse response_;
-};
-
-class RTCVoidRequestTask
-    : public WebMethodTask<MockWebRTCPeerConnectionHandler> {
- public:
-  RTCVoidRequestTask(MockWebRTCPeerConnectionHandler* object,
-                     const WebRTCVoidRequest& request,
-                     bool succeeded)
-      : WebMethodTask<MockWebRTCPeerConnectionHandler>(object),
-        request_(request),
-        succeeded_(succeeded) {}
-
-  void RunIfValid() override {
-    if (succeeded_)
-      request_.requestSucceeded();
-    else
-      request_.requestFailed("TEST_ERROR");
-  }
-
- private:
-  WebRTCVoidRequest request_;
-  bool succeeded_;
-};
-
-class RTCPeerConnectionStateTask
-    : public WebMethodTask<MockWebRTCPeerConnectionHandler> {
- public:
-  RTCPeerConnectionStateTask(
-      MockWebRTCPeerConnectionHandler* object,
-      WebRTCPeerConnectionHandlerClient* client,
-      WebRTCPeerConnectionHandlerClient::ICEConnectionState connection_state,
-      WebRTCPeerConnectionHandlerClient::ICEGatheringState gathering_state)
-      : WebMethodTask<MockWebRTCPeerConnectionHandler>(object),
-        client_(client),
-        connection_state_(connection_state),
-        gathering_state_(gathering_state) {}
-
-  void RunIfValid() override {
-    client_->didChangeICEGatheringState(gathering_state_);
-    client_->didChangeICEConnectionState(connection_state_);
-  }
-
- private:
-  WebRTCPeerConnectionHandlerClient* client_;
-  WebRTCPeerConnectionHandlerClient::ICEConnectionState connection_state_;
-  WebRTCPeerConnectionHandlerClient::ICEGatheringState gathering_state_;
-};
-
-class RemoteDataChannelTask
-    : public WebMethodTask<MockWebRTCPeerConnectionHandler> {
- public:
-  RemoteDataChannelTask(MockWebRTCPeerConnectionHandler* object,
-                        WebRTCPeerConnectionHandlerClient* client,
-                        WebTestDelegate* delegate)
-      : WebMethodTask<MockWebRTCPeerConnectionHandler>(object),
-        client_(client),
-        delegate_(delegate) {}
-
-  void RunIfValid() override {
-    WebRTCDataChannelInit init;
-    WebRTCDataChannelHandler* remote_data_channel =
-        new MockWebRTCDataChannelHandler(
-            "MockRemoteDataChannel", init, delegate_);
-    client_->didAddRemoteDataChannel(remote_data_channel);
-  }
-
- private:
-  WebRTCPeerConnectionHandlerClient* client_;
-  WebTestDelegate* delegate_;
-};
-
-/////////////////////
-
-MockWebRTCPeerConnectionHandler::MockWebRTCPeerConnectionHandler() {
-}
+MockWebRTCPeerConnectionHandler::MockWebRTCPeerConnectionHandler()
+    : weak_factory_(this) {}
 
 MockWebRTCPeerConnectionHandler::~MockWebRTCPeerConnectionHandler() {
 }
@@ -159,25 +41,60 @@
     : client_(client),
       stopped_(false),
       stream_count_(0),
-      interfaces_(interfaces) {
+      interfaces_(interfaces),
+      weak_factory_(this) {}
+
+void MockWebRTCPeerConnectionHandler::ReportInitializeCompleted() {
+  client_->didChangeICEGatheringState(
+      WebRTCPeerConnectionHandlerClient::ICEGatheringStateComplete);
+  client_->didChangeICEConnectionState(
+      WebRTCPeerConnectionHandlerClient::ICEConnectionStateCompleted);
 }
 
 bool MockWebRTCPeerConnectionHandler::initialize(
     const WebRTCConfiguration& configuration,
     const WebMediaConstraints& constraints) {
-  interfaces_->GetDelegate()->PostTask(new RTCPeerConnectionStateTask(
-      this,
-      client_,
-      WebRTCPeerConnectionHandlerClient::ICEConnectionStateCompleted,
-      WebRTCPeerConnectionHandlerClient::ICEGatheringStateComplete));
+  interfaces_->GetDelegate()->PostTask(new WebCallbackTask(
+      base::Bind(&MockWebRTCPeerConnectionHandler::ReportInitializeCompleted,
+                 weak_factory_.GetWeakPtr())));
   return true;
 }
 
 void MockWebRTCPeerConnectionHandler::createOffer(
     const WebRTCSessionDescriptionRequest& request,
     const WebMediaConstraints& constraints) {
-  interfaces_->GetDelegate()->PostTask(
-      new RTCSessionDescriptionRequestFailedTask(this, request));
+  PostRequestFailure(request);
+}
+
+void MockWebRTCPeerConnectionHandler::PostRequestResult(
+    const WebRTCSessionDescriptionRequest& request,
+    const WebRTCSessionDescription& session_description) {
+  interfaces_->GetDelegate()->PostTask(new WebCallbackTask(
+      base::Bind(&WebRTCSessionDescriptionRequest::requestSucceeded,
+                 base::Owned(new WebRTCSessionDescriptionRequest(request)),
+                 session_description)));
+}
+
+void MockWebRTCPeerConnectionHandler::PostRequestFailure(
+    const WebRTCSessionDescriptionRequest& request) {
+  interfaces_->GetDelegate()->PostTask(new WebCallbackTask(
+      base::Bind(&WebRTCSessionDescriptionRequest::requestFailed,
+                 base::Owned(new WebRTCSessionDescriptionRequest(request)),
+                 WebString("TEST_ERROR"))));
+}
+
+void MockWebRTCPeerConnectionHandler::PostRequestResult(
+    const WebRTCVoidRequest& request) {
+  interfaces_->GetDelegate()->PostTask(new WebCallbackTask(
+      base::Bind(&WebRTCVoidRequest::requestSucceeded,
+                 base::Owned(new WebRTCVoidRequest(request)))));
+}
+
+void MockWebRTCPeerConnectionHandler::PostRequestFailure(
+    const WebRTCVoidRequest& request) {
+  interfaces_->GetDelegate()->PostTask(new WebCallbackTask(base::Bind(
+      &WebRTCVoidRequest::requestFailed,
+      base::Owned(new WebRTCVoidRequest(request)), WebString("TEST_ERROR"))));
 }
 
 void MockWebRTCPeerConnectionHandler::createOffer(
@@ -186,12 +103,9 @@
   if (options.iceRestart() && options.voiceActivityDetection()) {
     WebRTCSessionDescription session_description;
     session_description.initialize("offer", "local");
-    interfaces_->GetDelegate()->PostTask(
-        new RTCSessionDescriptionRequestSuccededTask(
-            this, request, session_description));
+    PostRequestResult(request, session_description);
   } else {
-    interfaces_->GetDelegate()->PostTask(
-        new RTCSessionDescriptionRequestFailedTask(this, request));
+    PostRequestFailure(request);
   }
 }
 
@@ -201,12 +115,10 @@
   if (!remote_description_.isNull()) {
     WebRTCSessionDescription session_description;
     session_description.initialize("answer", "local");
-    interfaces_->GetDelegate()->PostTask(
-        new RTCSessionDescriptionRequestSuccededTask(
-            this, request, session_description));
-  } else
-    interfaces_->GetDelegate()->PostTask(
-        new RTCSessionDescriptionRequestFailedTask(this, request));
+    PostRequestResult(request, session_description);
+  } else {
+    PostRequestFailure(request);
+  }
 }
 
 void MockWebRTCPeerConnectionHandler::createAnswer(
@@ -215,12 +127,9 @@
   if (options.voiceActivityDetection()) {
     WebRTCSessionDescription session_description;
     session_description.initialize("answer", "local");
-    interfaces_->GetDelegate()->PostTask(
-        new RTCSessionDescriptionRequestSuccededTask(this, request,
-                                                     session_description));
+    PostRequestResult(request, session_description);
   } else {
-    interfaces_->GetDelegate()->PostTask(
-        new RTCSessionDescriptionRequestFailedTask(this, request));
+    PostRequestFailure(request);
   }
 }
 
@@ -229,11 +138,10 @@
     const WebRTCSessionDescription& local_description) {
   if (!local_description.isNull() && local_description.sdp() == "local") {
     local_description_ = local_description;
-    interfaces_->GetDelegate()->PostTask(
-        new RTCVoidRequestTask(this, request, true));
-  } else
-    interfaces_->GetDelegate()->PostTask(
-        new RTCVoidRequestTask(this, request, false));
+    PostRequestResult(request);
+  } else {
+    PostRequestFailure(request);
+  }
 }
 
 void MockWebRTCPeerConnectionHandler::setRemoteDescription(
@@ -243,11 +151,9 @@
   if (!remote_description.isNull() && remote_description.sdp() == "remote") {
     UpdateRemoteStreams();
     remote_description_ = remote_description;
-    interfaces_->GetDelegate()->PostTask(
-        new RTCVoidRequestTask(this, request, true));
+    PostRequestResult(request);
   } else
-    interfaces_->GetDelegate()->PostTask(
-        new RTCVoidRequestTask(this, request, false));
+    PostRequestFailure(request);
 }
 
 void MockWebRTCPeerConnectionHandler::UpdateRemoteStreams() {
@@ -352,8 +258,7 @@
 bool MockWebRTCPeerConnectionHandler::addICECandidate(
     const WebRTCVoidRequest& request,
     const WebRTCICECandidate& ice_candidate) {
-  interfaces_->GetDelegate()->PostTask(
-      new RTCVoidRequestTask(this, request, true));
+  PostRequestResult(request);
   return true;
 }
 
@@ -394,16 +299,28 @@
       response.addStatistic(report_index, "type", "video");
     }
   }
-  interfaces_->GetDelegate()->PostTask(
-      new RTCStatsRequestSucceededTask(this, request, response));
+  interfaces_->GetDelegate()->PostTask(new WebCallbackTask(
+      base::Bind(&blink::WebRTCStatsRequest::requestSucceeded,
+                 base::Owned(new WebRTCStatsRequest(request)), response)));
+}
+
+void MockWebRTCPeerConnectionHandler::ReportCreationOfDataChannel() {
+  WebRTCDataChannelInit init;
+  WebRTCDataChannelHandler* remote_data_channel =
+      new MockWebRTCDataChannelHandler("MockRemoteDataChannel", init,
+                                       interfaces_->GetDelegate());
+  client_->didAddRemoteDataChannel(remote_data_channel);
 }
 
 WebRTCDataChannelHandler* MockWebRTCPeerConnectionHandler::createDataChannel(
     const WebString& label,
     const blink::WebRTCDataChannelInit& init) {
-  interfaces_->GetDelegate()->PostTask(
-      new RemoteDataChannelTask(this, client_, interfaces_->GetDelegate()));
+  interfaces_->GetDelegate()->PostTask(new WebCallbackTask(
+      base::Bind(&MockWebRTCPeerConnectionHandler::ReportCreationOfDataChannel,
+                 weak_factory_.GetWeakPtr())));
 
+  // TODO(lukasza): Unclear if it is okay to return a different object than the
+  // one created in ReportCreationOfDataChannel.
   return new MockWebRTCDataChannelHandler(
       label, init, interfaces_->GetDelegate());
 }
@@ -415,7 +332,7 @@
 
 void MockWebRTCPeerConnectionHandler::stop() {
   stopped_ = true;
-  task_list_.RevokeAll();
+  weak_factory_.InvalidateWeakPtrs();
 }
 
 }  // namespace test_runner

diff --git a/components/test_runner/mock_webrtc_peer_connection_handler.h b/components/test_runner/mock_webrtc_peer_connection_handler.h
index 2704469..6d7b7e64 100644
--- a/components/test_runner/mock_webrtc_peer_connection_handler.h
+++ b/components/test_runner/mock_webrtc_peer_connection_handler.h

@@ -8,7 +8,7 @@
 #include <map>
 
 #include "base/macros.h"
-#include "components/test_runner/web_task.h"
+#include "base/memory/weak_ptr.h"
 #include "third_party/WebKit/public/platform/WebRTCPeerConnectionHandler.h"
 #include "third_party/WebKit/public/platform/WebRTCSessionDescription.h"
 #include "third_party/WebKit/public/platform/WebRTCSessionDescriptionRequest.h"
@@ -65,9 +65,6 @@
       const blink::WebMediaStreamTrack& track) override;
   void stop() override;
 
-  // WebTask related methods
-  WebTaskList* mutable_task_list() { return &task_list_; }
-
  private:
   MockWebRTCPeerConnectionHandler();
 
@@ -77,9 +74,19 @@
   // is called.
   void UpdateRemoteStreams();
 
+  void ReportInitializeCompleted();
+  void ReportCreationOfDataChannel();
+
+  void PostRequestResult(
+      const blink::WebRTCSessionDescriptionRequest& request,
+      const blink::WebRTCSessionDescription& session_description);
+  void PostRequestFailure(
+      const blink::WebRTCSessionDescriptionRequest& request);
+  void PostRequestResult(const blink::WebRTCVoidRequest& request);
+  void PostRequestFailure(const blink::WebRTCVoidRequest& request);
+
   blink::WebRTCPeerConnectionHandlerClient* client_;
   bool stopped_;
-  WebTaskList task_list_;
   blink::WebRTCSessionDescription local_description_;
   blink::WebRTCSessionDescription remote_description_;
   int stream_count_;
@@ -88,6 +95,8 @@
   StreamMap local_streams_;
   StreamMap remote_streams_;
 
+  base::WeakPtrFactory<MockWebRTCPeerConnectionHandler> weak_factory_;
+
   DISALLOW_COPY_AND_ASSIGN(MockWebRTCPeerConnectionHandler);
 };
 

diff --git a/components/test_runner/spell_check_client.cc b/components/test_runner/spell_check_client.cc
index 32bfd88..68c663a 100644
--- a/components/test_runner/spell_check_client.cc
+++ b/components/test_runner/spell_check_client.cc

@@ -6,39 +6,23 @@
 
 #include <stddef.h>
 
+#include "base/bind.h"
+#include "base/bind_helpers.h"
 #include "base/logging.h"
 #include "base/macros.h"
 #include "components/test_runner/mock_grammar_check.h"
 #include "components/test_runner/test_runner.h"
+#include "components/test_runner/web_task.h"
 #include "components/test_runner/web_test_delegate.h"
 #include "third_party/WebKit/public/web/WebTextCheckingCompletion.h"
 #include "third_party/WebKit/public/web/WebTextCheckingResult.h"
 
 namespace test_runner {
 
-namespace {
-
-class HostMethodTask : public WebMethodTask<SpellCheckClient> {
- public:
-  typedef void (SpellCheckClient::*CallbackMethodType)();
-  HostMethodTask(SpellCheckClient* object, CallbackMethodType callback)
-      : WebMethodTask<SpellCheckClient>(object), callback_(callback) {}
-
-  ~HostMethodTask() override {}
-
-  void RunIfValid() override { (object_->*callback_)(); }
-
- private:
-  CallbackMethodType callback_;
-
-  DISALLOW_COPY_AND_ASSIGN(HostMethodTask);
-};
-
-}  // namespace
-
 SpellCheckClient::SpellCheckClient(TestRunner* test_runner)
     : last_requested_text_checking_completion_(nullptr),
-      test_runner_(test_runner) {
+      test_runner_(test_runner),
+      weak_factory_(this) {
   DCHECK(test_runner);
 }
 
@@ -107,7 +91,9 @@
     FinishLastTextCheck();
   else
     delegate_->PostDelayedTask(
-        new HostMethodTask(this, &SpellCheckClient::FinishLastTextCheck), 0);
+        new WebCallbackTask(base::Bind(&SpellCheckClient::FinishLastTextCheck,
+                                       weak_factory_.GetWeakPtr())),
+        0);
 }
 
 void SpellCheckClient::FinishLastTextCheck() {

diff --git a/components/test_runner/spell_check_client.h b/components/test_runner/spell_check_client.h
index 8eac3c1..978c5ba 100644
--- a/components/test_runner/spell_check_client.h
+++ b/components/test_runner/spell_check_client.h

@@ -8,8 +8,8 @@
 #include <stdint.h>
 
 #include "base/macros.h"
+#include "base/memory/weak_ptr.h"
 #include "components/test_runner/mock_spell_check.h"
-#include "components/test_runner/web_task.h"
 #include "third_party/WebKit/public/platform/WebString.h"
 #include "third_party/WebKit/public/platform/WebVector.h"
 #include "third_party/WebKit/public/web/WebSpellCheckClient.h"
@@ -31,8 +31,6 @@
 
   void SetDelegate(WebTestDelegate* delegate);
 
-  WebTaskList* mutable_task_list() { return &task_list_; }
-
   // blink::WebSpellCheckClient implementation.
   void spellCheck(
       const blink::WebString& text,
@@ -58,11 +56,11 @@
   blink::WebString last_requested_text_check_string_;
   blink::WebTextCheckingCompletion* last_requested_text_checking_completion_;
 
-  WebTaskList task_list_;
-
   TestRunner* test_runner_;
   WebTestDelegate* delegate_;
 
+  base::WeakPtrFactory<SpellCheckClient> weak_factory_;
+
   DISALLOW_COPY_AND_ASSIGN(SpellCheckClient);
 };
 

diff --git a/components/test_runner/test_runner.cc b/components/test_runner/test_runner.cc
index c925801..96941df 100644
--- a/components/test_runner/test_runner.cc
+++ b/components/test_runner/test_runner.cc

@@ -25,6 +25,7 @@
 #include "components/test_runner/test_interfaces.h"
 #include "components/test_runner/test_preferences.h"
 #include "components/test_runner/web_content_settings.h"
+#include "components/test_runner/web_task.h"
 #include "components/test_runner/web_test_delegate.h"
 #include "components/test_runner/web_test_proxy.h"
 #include "gin/arguments.h"
@@ -93,66 +94,8 @@
   return 1.f;
 }
 
-class HostMethodTask : public WebMethodTask<TestRunner> {
- public:
-  typedef void (TestRunner::*CallbackMethodType)();
-  HostMethodTask(TestRunner* object, CallbackMethodType callback)
-      : WebMethodTask<TestRunner>(object), callback_(callback) {}
-
-  void RunIfValid() override { (object_->*callback_)(); }
-
- private:
-  CallbackMethodType callback_;
-};
-
 }  // namespace
 
-class InvokeCallbackTask : public WebMethodTask<TestRunner> {
- public:
-  InvokeCallbackTask(TestRunner* object, v8::Local<v8::Function> callback)
-      : WebMethodTask<TestRunner>(object),
-        callback_(blink::mainThreadIsolate(), callback),
-        argc_(0) {}
-
-  void RunIfValid() override {
-    v8::Isolate* isolate = blink::mainThreadIsolate();
-    v8::HandleScope handle_scope(isolate);
-    WebFrame* frame = object_->web_view_->mainFrame();
-
-    v8::Local<v8::Context> context = frame->mainWorldScriptContext();
-    if (context.IsEmpty())
-      return;
-
-    v8::Context::Scope context_scope(context);
-
-    scoped_ptr<v8::Local<v8::Value>[]> local_argv;
-    if (argc_) {
-        local_argv.reset(new v8::Local<v8::Value>[argc_]);
-        for (int i = 0; i < argc_; ++i)
-          local_argv[i] = v8::Local<v8::Value>::New(isolate, argv_[i]);
-    }
-
-    frame->callFunctionEvenIfScriptDisabled(
-        v8::Local<v8::Function>::New(isolate, callback_),
-        context->Global(),
-        argc_,
-        local_argv.get());
-  }
-
-  void SetArguments(int argc, v8::Local<v8::Value> argv[]) {
-    v8::Isolate* isolate = blink::mainThreadIsolate();
-    argc_ = argc;
-    argv_.reset(new v8::UniquePersistent<v8::Value>[argc]);
-    for (int i = 0; i < argc; ++i)
-      argv_[i] = v8::UniquePersistent<v8::Value>(isolate, argv[i]);
-  }
-
- private:
-  v8::UniquePersistent<v8::Function> callback_;
-  int argc_;
-  scoped_ptr<v8::UniquePersistent<v8::Value>[]> argv_;
-};
-
 class TestRunnerBindings : public gin::Wrappable<TestRunnerBindings> {
  public:
   static gin::WrapperInfo kWrapperInfo;
@@ -1503,7 +1446,8 @@
 }
 
 void TestRunnerBindings::SetCustomTextOutput(const std::string& output) {
-  runner_->setCustomTextOutput(output);
+  if (runner_)
+    runner_->setCustomTextOutput(output);
 }
 
 void TestRunnerBindings::SetViewSourceForFrame(const std::string& name,
@@ -1606,8 +1550,7 @@
 }
 
 TestRunner::WorkQueue::WorkQueue(TestRunner* controller)
-    : frozen_(false)
-    , controller_(controller) {}
+    : frozen_(false), controller_(controller), weak_factory_(this) {}
 
 TestRunner::WorkQueue::~WorkQueue() {
   Reset();
@@ -1619,7 +1562,8 @@
 
   if (!queue_.empty()) {
     // We delay processing queued work to avoid recursion problems.
-    controller_->delegate_->PostTask(new WorkQueueTask(this));
+    controller_->PostTask(base::Bind(&TestRunner::WorkQueue::ProcessWork,
+                                     weak_factory_.GetWeakPtr()));
   } else if (!controller_->layout_test_runtime_flags_.wait_until_done()) {
     controller_->delegate_->TestFinished();
   }
@@ -1657,10 +1601,6 @@
     controller_->delegate_->TestFinished();
 }
 
-void TestRunner::WorkQueue::WorkQueueTask::RunIfValid() {
-  object_->ProcessWork();
-}
-
 TestRunner::TestRunner(TestInterfaces* interfaces)
     : test_is_running_(false),
       close_remaining_windows_(false),
@@ -1779,7 +1719,7 @@
   pointer_locked_ = false;
   pointer_lock_planned_result_ = PointerLockWillSucceed;
 
-  task_list_.RevokeAll();
+  weak_factory_.InvalidateWeakPtrs();
   work_queue_.Reset();
 
   if (close_remaining_windows_ && delegate_)
@@ -1792,8 +1732,73 @@
   test_is_running_ = running;
 }
 
-void TestRunner::InvokeCallback(scoped_ptr<InvokeCallbackTask> task) {
-  delegate_->PostTask(task.release());
+void TestRunner::PostTask(const base::Closure& callback) {
+  delegate_->PostTask(new WebCallbackTask(callback));
+}
+
+void TestRunner::PostDelayedTask(long long delay,
+                                 const base::Closure& callback) {
+  delegate_->PostDelayedTask(new WebCallbackTask(callback), delay);
+}
+
+void TestRunner::PostV8Callback(const v8::Local<v8::Function>& callback) {
+  PostTask(base::Bind(&TestRunner::InvokeV8Callback, weak_factory_.GetWeakPtr(),
+                      v8::UniquePersistent<v8::Function>(
+                          blink::mainThreadIsolate(), callback)));
+}
+
+void TestRunner::PostV8CallbackWithArgs(
+    v8::UniquePersistent<v8::Function> callback,
+    int argc,
+    v8::Local<v8::Value> argv[]) {
+  std::vector<v8::UniquePersistent<v8::Value>> args;
+  for (int i = 0; i < argc; i++) {
+    args.push_back(
+        v8::UniquePersistent<v8::Value>(blink::mainThreadIsolate(), argv[i]));
+  }
+
+  PostTask(base::Bind(&TestRunner::InvokeV8CallbackWithArgs,
+                      weak_factory_.GetWeakPtr(), std::move(callback),
+                      std::move(args)));
+}
+
+void TestRunner::InvokeV8Callback(
+    const v8::UniquePersistent<v8::Function>& callback) {
+  std::vector<v8::UniquePersistent<v8::Value>> empty_args;
+  InvokeV8CallbackWithArgs(callback, std::move(empty_args));
+}
+
+void TestRunner::InvokeV8CallbackWithArgs(
+    const v8::UniquePersistent<v8::Function>& callback,
+    const std::vector<v8::UniquePersistent<v8::Value>>& args) {
+  v8::Isolate* isolate = blink::mainThreadIsolate();
+  v8::HandleScope handle_scope(isolate);
+
+  if (!web_view_)
+    return;
+  WebFrame* frame = web_view_->mainFrame();
+  v8::Local<v8::Context> context = frame->mainWorldScriptContext();
+  if (context.IsEmpty())
+    return;
+  v8::Context::Scope context_scope(context);
+
+  std::vector<v8::Local<v8::Value>> local_args;
+  for (const auto& arg : args) {
+    local_args.push_back(v8::Local<v8::Value>::New(isolate, arg));
+  }
+
+  frame->callFunctionEvenIfScriptDisabled(
+      v8::Local<v8::Function>::New(isolate, callback), context->Global(),
+      local_args.size(), local_args.data());
+}
+
+base::Closure TestRunner::CreateClosureThatPostsV8Callback(
+    const v8::Local<v8::Function>& callback) {
+  return base::Bind(
+      &TestRunner::PostTask, weak_factory_.GetWeakPtr(),
+      base::Bind(&TestRunner::InvokeV8Callback, weak_factory_.GetWeakPtr(),
+                 v8::UniquePersistent<v8::Function>(blink::mainThreadIsolate(),
+                                                    callback)));
 }
 
 bool TestRunner::shouldDumpEditingCallbacks() const {
@@ -2021,9 +2026,8 @@
 bool TestRunner::RequestPointerLock() {
   switch (pointer_lock_planned_result_) {
     case PointerLockWillSucceed:
-      delegate_->PostDelayedTask(
-          new HostMethodTask(this, &TestRunner::DidAcquirePointerLockInternal),
-          0);
+      PostDelayedTask(0, base::Bind(&TestRunner::DidAcquirePointerLockInternal,
+                                    weak_factory_.GetWeakPtr()));
       return true;
     case PointerLockWillRespondAsync:
       DCHECK(!pointer_locked_);
@@ -2038,8 +2042,8 @@
 }
 
 void TestRunner::RequestPointerUnlock() {
-  delegate_->PostDelayedTask(
-      new HostMethodTask(this, &TestRunner::DidLosePointerLockInternal), 0);
+  PostDelayedTask(0, base::Bind(&TestRunner::DidLosePointerLockInternal,
+                                weak_factory_.GetWeakPtr()));
 }
 
 bool TestRunner::isPointerLocked() {
@@ -2089,8 +2093,8 @@
 };
 
 void TestRunner::NotifyDone() {
-  // Test didn't timeout. Kill the timeout timer.
-  task_list_.RevokeAll();
+  // Test didn't timeout. Kill the pending callbacks.
+  weak_factory_.InvalidateWeakPtrs();
 
   CompleteNotifyDone();
 }
@@ -2964,27 +2968,24 @@
 void TestRunner::SetBackingScaleFactor(double value,
                                        v8::Local<v8::Function> callback) {
   delegate_->SetDeviceScaleFactor(value);
-  delegate_->PostTask(new InvokeCallbackTask(this, callback));
+  PostV8Callback(callback);
 }
 
 void TestRunner::EnableUseZoomForDSF(v8::Local<v8::Function> callback) {
   delegate_->EnableUseZoomForDSF();
-  delegate_->PostTask(new InvokeCallbackTask(this, callback));
+  PostV8Callback(callback);
 }
 
 void TestRunner::SetColorProfile(const std::string& name,
                                  v8::Local<v8::Function> callback) {
   delegate_->SetDeviceColorProfile(name);
-  delegate_->PostTask(new InvokeCallbackTask(this, callback));
+  PostV8Callback(callback);
 }
 
 void TestRunner::SetBluetoothFakeAdapter(const std::string& adapter_name,
                                          v8::Local<v8::Function> callback) {
-  scoped_ptr<InvokeCallbackTask> task(new InvokeCallbackTask(this, callback));
   delegate_->SetBluetoothFakeAdapter(
-      adapter_name,
-      base::Bind(&TestRunner::InvokeCallback, weak_factory_.GetWeakPtr(),
-                 base::Passed(&task)));
+      adapter_name, CreateClosureThatPostsV8Callback(callback));
 }
 
 void TestRunner::SetBluetoothManualChooser(bool enable) {
@@ -2993,10 +2994,11 @@
 
 void TestRunner::GetBluetoothManualChooserEvents(
     v8::Local<v8::Function> callback) {
-  scoped_ptr<InvokeCallbackTask> task(new InvokeCallbackTask(this, callback));
   return delegate_->GetBluetoothManualChooserEvents(
       base::Bind(&TestRunner::GetBluetoothManualChooserEventsCallback,
-                 weak_factory_.GetWeakPtr(), base::Passed(&task)));
+                 weak_factory_.GetWeakPtr(),
+                 base::Passed(v8::UniquePersistent<v8::Function>(
+                     blink::mainThreadIsolate(), callback))));
 }
 
 void TestRunner::SendBluetoothManualChooserEvent(const std::string& event,
@@ -3027,13 +3029,12 @@
     int request_id,
     const std::vector<std::string>& event_platforms,
     v8::Local<v8::Function> callback) {
-  scoped_ptr<InvokeCallbackTask> task(
-      new InvokeCallbackTask(this, callback));
-
   delegate_->DispatchBeforeInstallPromptEvent(
       request_id, event_platforms,
       base::Bind(&TestRunner::DispatchBeforeInstallPromptCallback,
-                 weak_factory_.GetWeakPtr(), base::Passed(&task)));
+                 weak_factory_.GetWeakPtr(),
+                 base::Passed(v8::UniquePersistent<v8::Function>(
+                     blink::mainThreadIsolate(), callback))));
 }
 
 void TestRunner::ResolveBeforeInstallPromptPromise(
@@ -3104,28 +3105,39 @@
 }
 
 void TestRunner::LayoutAndPaintAsyncThen(v8::Local<v8::Function> callback) {
-  scoped_ptr<InvokeCallbackTask> task(
-      new InvokeCallbackTask(this, callback));
-  proxy_->LayoutAndPaintAsyncThen(base::Bind(&TestRunner::InvokeCallback,
-                                             weak_factory_.GetWeakPtr(),
-                                             base::Passed(&task)));
+  proxy_->LayoutAndPaintAsyncThen(CreateClosureThatPostsV8Callback(callback));
 }
 
 void TestRunner::GetManifestThen(v8::Local<v8::Function> callback) {
-  scoped_ptr<InvokeCallbackTask> task(
-      new InvokeCallbackTask(this, callback));
+  v8::UniquePersistent<v8::Function> persistent_callback(
+      blink::mainThreadIsolate(), callback);
+
+  if (!web_view_) {
+    WebURLResponse response;
+    response.setHTTPStatusCode(404);
+    GetManifestCallback(std::move(persistent_callback), response, "");
+    return;
+  }
 
   delegate_->FetchManifest(
       web_view_, web_view_->mainFrame()->document().manifestURL(),
       base::Bind(&TestRunner::GetManifestCallback, weak_factory_.GetWeakPtr(),
-                 base::Passed(&task)));
+                 base::Passed(std::move(persistent_callback))));
 }
 
 void TestRunner::CapturePixelsAsyncThen(v8::Local<v8::Function> callback) {
-  scoped_ptr<InvokeCallbackTask> task(new InvokeCallbackTask(this, callback));
-  DumpPixelsAsync(proxy_->web_view(),
-                  base::Bind(&TestRunner::CapturePixelsCallback,
-                             weak_factory_.GetWeakPtr(), base::Passed(&task)));
+  v8::UniquePersistent<v8::Function> persistent_callback(
+      blink::mainThreadIsolate(), callback);
+
+  if (!web_view_) {
+    CapturePixelsCallback(std::move(persistent_callback), SkBitmap());
+    return;
+  }
+
+  DumpPixelsAsync(
+      proxy_->web_view(),
+      base::Bind(&TestRunner::CapturePixelsCallback, weak_factory_.GetWeakPtr(),
+                 base::Passed(std::move(persistent_callback))));
 }
 
 void TestRunner::OnLayoutTestRuntimeFlagsChanged() {
@@ -3149,22 +3161,33 @@
 
 void TestRunner::CopyImageAtAndCapturePixelsAsyncThen(
     int x, int y, v8::Local<v8::Function> callback) {
-  scoped_ptr<InvokeCallbackTask> task(
-      new InvokeCallbackTask(this, callback));
+  v8::UniquePersistent<v8::Function> persistent_callback(
+      blink::mainThreadIsolate(), callback);
+
+  if (!web_view_) {
+    CapturePixelsCallback(std::move(persistent_callback), SkBitmap());
+    return;
+  }
+
   CopyImageAtAndCapturePixels(
       proxy_->web_view(), x, y,
       base::Bind(&TestRunner::CapturePixelsCallback, weak_factory_.GetWeakPtr(),
-                 base::Passed(&task)));
+                 base::Passed(std::move(persistent_callback))));
 }
 
-void TestRunner::GetManifestCallback(scoped_ptr<InvokeCallbackTask> task,
-                                     const blink::WebURLResponse& response,
-                                     const std::string& data) {
-  InvokeCallback(std::move(task));
+void TestRunner::GetManifestCallback(
+    v8::UniquePersistent<v8::Function> callback,
+    const blink::WebURLResponse& response,
+    const std::string& data) {
+  PostV8CallbackWithArgs(std::move(callback), 0, nullptr);
 }
 
-void TestRunner::CapturePixelsCallback(scoped_ptr<InvokeCallbackTask> task,
-                                       const SkBitmap& snapshot) {
+void TestRunner::CapturePixelsCallback(
+    v8::UniquePersistent<v8::Function> callback,
+    const SkBitmap& snapshot) {
+  if (!web_view_)
+    return;
+
   v8::Isolate* isolate = blink::mainThreadIsolate();
   v8::HandleScope handle_scope(isolate);
 
@@ -3203,13 +3226,15 @@
   argv[2] = blink::WebArrayBufferConverter::toV8Value(
       &buffer, context->Global(), isolate);
 
-  task->SetArguments(3, argv);
-  InvokeCallback(std::move(task));
+  PostV8CallbackWithArgs(std::move(callback), arraysize(argv), argv);
 }
 
 void TestRunner::DispatchBeforeInstallPromptCallback(
-    scoped_ptr<InvokeCallbackTask> task,
+    v8::UniquePersistent<v8::Function> callback,
     bool canceled) {
+  if (!web_view_)
+    return;
+
   v8::Isolate* isolate = blink::mainThreadIsolate();
   v8::HandleScope handle_scope(isolate);
 
@@ -3219,16 +3244,18 @@
     return;
 
   v8::Context::Scope context_scope(context);
-  v8::Local<v8::Value> argv[1];
-  argv[0] = v8::Boolean::New(isolate, canceled);
+  v8::Local<v8::Value> arg;
+  arg = v8::Boolean::New(isolate, canceled);
 
-  task->SetArguments(1, argv);
-  InvokeCallback(std::move(task));
+  PostV8CallbackWithArgs(std::move(callback), 1, &arg);
 }
 
 void TestRunner::GetBluetoothManualChooserEventsCallback(
-    scoped_ptr<InvokeCallbackTask> task,
+    v8::UniquePersistent<v8::Function> callback,
     const std::vector<std::string>& events) {
+  if (!web_view_)
+    return;
+
   // Build the V8 context.
   v8::Isolate* isolate = blink::mainThreadIsolate();
   v8::HandleScope handle_scope(isolate);
@@ -3239,13 +3266,12 @@
   v8::Context::Scope context_scope(context);
 
   // Convert the argument.
-  v8::Local<v8::Value> arg[1];
-  if (!gin::TryConvertToV8(isolate, events, &arg[0]))
+  v8::Local<v8::Value> arg;
+  if (!gin::TryConvertToV8(isolate, events, &arg))
     return;
 
   // Call the callback.
-  task->SetArguments(1, arg);
-  InvokeCallback(std::move(task));
+  PostV8CallbackWithArgs(std::move(callback), 1, &arg);
 }
 
 void TestRunner::LocationChangeDone() {

diff --git a/components/test_runner/test_runner.h b/components/test_runner/test_runner.h
index 065fc1f..2a4f87fd 100644
--- a/components/test_runner/test_runner.h
+++ b/components/test_runner/test_runner.h

@@ -17,7 +17,6 @@
 #include "base/memory/weak_ptr.h"
 #include "components/test_runner/layout_test_runtime_flags.h"
 #include "components/test_runner/test_runner_export.h"
-#include "components/test_runner/web_task.h"
 #include "components/test_runner/web_test_runner.h"
 #include "third_party/WebKit/public/platform/WebImage.h"
 #include "v8/include/v8.h"
@@ -52,8 +51,7 @@
 class WebTestDelegate;
 class WebTestProxyBase;
 
-class TestRunner : public WebTestRunner,
-                   public base::SupportsWeakPtr<TestRunner> {
+class TestRunner : public WebTestRunner {
  public:
   explicit TestRunner(TestInterfaces*);
   virtual ~TestRunner();
@@ -65,15 +63,11 @@
 
   void Reset();
 
-  WebTaskList* mutable_task_list() { return &task_list_; }
-
   void SetTestIsRunning(bool);
   bool TestIsRunning() const { return test_is_running_; }
 
   bool UseMockTheme() const { return use_mock_theme_; }
 
-  void InvokeCallback(scoped_ptr<InvokeCallbackTask> callback);
-
   // WebTestRunner implementation.
   bool ShouldGeneratePixelResults() override;
   bool ShouldDumpAsAudio() const override;
@@ -155,10 +149,23 @@
   };
 
  private:
-  friend class InvokeCallbackTask;
   friend class TestRunnerBindings;
   friend class WorkQueue;
 
+  // Helpers for working with base and V8 callbacks.
+  void PostTask(const base::Closure& callback);
+  void PostDelayedTask(long long delay, const base::Closure& callback);
+  void PostV8Callback(const v8::Local<v8::Function>& callback);
+  void PostV8CallbackWithArgs(v8::UniquePersistent<v8::Function> callback,
+                              int argc,
+                              v8::Local<v8::Value> argv[]);
+  void InvokeV8Callback(const v8::UniquePersistent<v8::Function>& callback);
+  void InvokeV8CallbackWithArgs(
+      const v8::UniquePersistent<v8::Function>& callback,
+      const std::vector<v8::UniquePersistent<v8::Value>>& args);
+  base::Closure CreateClosureThatPostsV8Callback(
+      const v8::Local<v8::Function>& callback);
+
   // Helper class for managing events queued by methods like queueLoad or
   // queueScript.
   class WorkQueue {
@@ -174,22 +181,15 @@
 
     void set_frozen(bool frozen) { frozen_ = frozen; }
     bool is_empty() { return queue_.empty(); }
-    WebTaskList* mutable_task_list() { return &task_list_; }
 
    private:
     void ProcessWork();
 
-    class WorkQueueTask : public WebMethodTask<WorkQueue> {
-     public:
-      WorkQueueTask(WorkQueue* object) : WebMethodTask<WorkQueue>(object) {}
-
-      void RunIfValid() override;
-    };
-
-    WebTaskList task_list_;
     std::deque<WorkItem*> queue_;
     bool frozen_;
     TestRunner* controller_;
+
+    base::WeakPtrFactory<WorkQueue> weak_factory_;
   };
 
   ///////////////////////////////////////////////////////////////////////////
@@ -650,15 +650,16 @@
   ///////////////////////////////////////////////////////////////////////////
   // Internal helpers
 
-  void GetManifestCallback(scoped_ptr<InvokeCallbackTask> task,
+  void GetManifestCallback(v8::UniquePersistent<v8::Function> callback,
                            const blink::WebURLResponse& response,
                            const std::string& data);
-  void CapturePixelsCallback(scoped_ptr<InvokeCallbackTask> task,
+  void CapturePixelsCallback(v8::UniquePersistent<v8::Function> callback,
                              const SkBitmap& snapshot);
-  void DispatchBeforeInstallPromptCallback(scoped_ptr<InvokeCallbackTask> task,
-                                           bool canceled);
+  void DispatchBeforeInstallPromptCallback(
+      v8::UniquePersistent<v8::Function> callback,
+      bool canceled);
   void GetBluetoothManualChooserEventsCallback(
-      scoped_ptr<InvokeCallbackTask> task,
+      v8::UniquePersistent<v8::Function> callback,
       const std::vector<std::string>& events);
 
   void CheckResponseMimeType();
@@ -791,9 +792,6 @@
   // WAV audio data is stored here.
   std::vector<unsigned char> audio_data_;
 
-  // Used for test timeouts.
-  WebTaskList task_list_;
-
   TestInterfaces* test_interfaces_;
   WebTestDelegate* delegate_;
   blink::WebView* web_view_;

diff --git a/components/test_runner/web_task.cc b/components/test_runner/web_task.cc
index df3cb699..b7c6e4e3 100644
--- a/components/test_runner/web_task.cc
+++ b/components/test_runner/web_task.cc

@@ -4,42 +4,15 @@
 
 #include "components/test_runner/web_task.h"
 
-#include <algorithm>
-
-#include "third_party/WebKit/public/web/WebKit.h"
-
 namespace test_runner {
 
-WebTask::WebTask(WebTaskList* list) : task_list_(list) {
-  task_list_->RegisterTask(this);
-}
+WebCallbackTask::WebCallbackTask(const base::Closure& callback)
+    : callback_(callback) {}
 
-WebTask::~WebTask() {
-  if (task_list_)
-    task_list_->UnregisterTask(this);
-}
+WebCallbackTask::~WebCallbackTask() {}
 
-WebTaskList::WebTaskList() {
-}
-
-WebTaskList::~WebTaskList() {
-  RevokeAll();
-}
-
-void WebTaskList::RegisterTask(WebTask* task) {
-  tasks_.push_back(task);
-}
-
-void WebTaskList::UnregisterTask(WebTask* task) {
-  std::vector<WebTask*>::iterator iter =
-      std::find(tasks_.begin(), tasks_.end(), task);
-  if (iter != tasks_.end())
-    tasks_.erase(iter);
-}
-
-void WebTaskList::RevokeAll() {
-  while (!tasks_.empty())
-    tasks_[0]->cancel();
+void WebCallbackTask::run() {
+  callback_.Run();
 }
 
 }  // namespace test_runner

diff --git a/components/test_runner/web_task.h b/components/test_runner/web_task.h
index 3fb4d2d4..d8470a2 100644
--- a/components/test_runner/web_task.h
+++ b/components/test_runner/web_task.h

@@ -5,72 +5,24 @@
 #ifndef COMPONENTS_TEST_RUNNER_WEB_TASK_H_
 #define COMPONENTS_TEST_RUNNER_WEB_TASK_H_
 
-#include <vector>
-
+#include "base/callback.h"
 #include "base/macros.h"
 #include "third_party/WebKit/public/platform/WebTaskRunner.h"
 
 namespace test_runner {
 
-class WebTaskList;
-
-// WebTask represents a task which can run by WebTestDelegate::postTask() or
-// WebTestDelegate::postDelayedTask().
-class WebTask : public blink::WebTaskRunner::Task {
+// blink::WebTaskRunner::Task that wraps a base::Closure.
+class WebCallbackTask : public blink::WebTaskRunner::Task {
  public:
-  explicit WebTask(WebTaskList*);
-  ~WebTask() override;
+  WebCallbackTask(const base::Closure& callback);
+  ~WebCallbackTask() override;
 
-  // The main code of this task.
-  // An implementation of run() should return immediately if cancel() was
-  // called.
-  void run() override = 0;
-  virtual void cancel() = 0;
-
- protected:
-  WebTaskList* task_list_;
-};
-
-class WebTaskList {
- public:
-  WebTaskList();
-  ~WebTaskList();
-  void RegisterTask(WebTask*);
-  void UnregisterTask(WebTask*);
-  void RevokeAll();
+  void run() override;
 
  private:
-  std::vector<WebTask*> tasks_;
+  base::Closure callback_;
 
-  DISALLOW_COPY_AND_ASSIGN(WebTaskList);
-};
-
-// A task containing an object pointer of class T. Derived classes should
-// override RunIfValid() which in turn can safely invoke methods on the
-// object_. The Class T must have "WebTaskList* mutable_task_list()".
-template <class T>
-class WebMethodTask : public WebTask {
- public:
-  explicit WebMethodTask(T* object)
-      : WebTask(object->mutable_task_list()), object_(object) {}
-
-  virtual ~WebMethodTask() {}
-
-  void run() override {
-    if (object_)
-      RunIfValid();
-  }
-
-  void cancel() override {
-    object_ = 0;
-    task_list_->UnregisterTask(this);
-    task_list_ = 0;
-  }
-
-  virtual void RunIfValid() = 0;
-
- protected:
-  T* object_;
+  DISALLOW_COPY_AND_ASSIGN(WebCallbackTask);
 };
 
 }  // namespace test_runner

diff --git a/components/test_runner/web_test_interfaces.cc b/components/test_runner/web_test_interfaces.cc
index 748b3ef0..7fbd288 100644
--- a/components/test_runner/web_test_interfaces.cc
+++ b/components/test_runner/web_test_interfaces.cc

@@ -70,7 +70,7 @@
 
 WebMediaStreamCenter* WebTestInterfaces::CreateMediaStreamCenter(
     WebMediaStreamCenterClient* client) {
-  return new MockWebMediaStreamCenter(client, interfaces_.get());
+  return new MockWebMediaStreamCenter();
 }
 
 WebRTCPeerConnectionHandler*

diff --git a/components/test_runner/web_view_test_client.cc b/components/test_runner/web_view_test_client.cc
index 55152c5..c6338b3 100644
--- a/components/test_runner/web_view_test_client.cc
+++ b/components/test_runner/web_view_test_client.cc

@@ -4,6 +4,8 @@
 
 #include "components/test_runner/web_view_test_client.h"
 
+#include "base/bind.h"
+#include "base/bind_helpers.h"
 #include "base/i18n/rtl.h"
 #include "base/strings/string16.h"
 #include "base/strings/utf_string_conversions.h"
@@ -25,22 +27,6 @@
 
 namespace test_runner {
 
-namespace {
-
-class HostMethodTask : public WebMethodTask<WebViewTestClient> {
- public:
-  typedef void (WebViewTestClient::*CallbackMethodType)();
-  HostMethodTask(WebViewTestClient* object, CallbackMethodType callback)
-      : WebMethodTask<WebViewTestClient>(object), callback_(callback) {}
-
-  void RunIfValid() override { (object_->*callback_)(); }
-
- private:
-  CallbackMethodType callback_;
-};
-
-}  // namespace
-
 WebViewTestClient::WebViewTestClient(TestRunner* test_runner,
                                      WebTestDelegate* delegate,
                                      EventSender* event_sender,
@@ -49,7 +35,8 @@
       delegate_(delegate),
       event_sender_(event_sender),
       web_test_proxy_base_(web_test_proxy_base),
-      animation_scheduled_(false) {
+      animation_scheduled_(false),
+      weak_factory_(this) {
   DCHECK(test_runner);
   DCHECK(delegate);
   DCHECK(event_sender);
@@ -67,7 +54,9 @@
     test_runner_->OnAnimationScheduled(web_test_proxy_base_->web_view());
 
     delegate_->PostDelayedTask(
-        new HostMethodTask(this, &WebViewTestClient::AnimateNow), 1);
+        new WebCallbackTask(base::Bind(&WebViewTestClient::AnimateNow,
+                                       weak_factory_.GetWeakPtr())),
+        1);
   }
 }
 

diff --git a/components/test_runner/web_view_test_client.h b/components/test_runner/web_view_test_client.h
index 9e1a09e..701354d 100644
--- a/components/test_runner/web_view_test_client.h
+++ b/components/test_runner/web_view_test_client.h

@@ -6,7 +6,7 @@
 #define COMPONENTS_TEST_RUNNER_WEB_VIEW_TEST_CLIENT_H_
 
 #include "base/macros.h"
-#include "components/test_runner/web_task.h"
+#include "base/memory/weak_ptr.h"
 #include "third_party/WebKit/public/web/WebViewClient.h"
 
 namespace blink {
@@ -68,9 +68,6 @@
   void resetInputMethod() override;
   blink::WebString acceptLanguages() override;
 
-  // Members expected by WebTask-related templates.
-  WebTaskList* mutable_task_list() { return &task_list_; }
-
  private:
   void AnimateNow();
 
@@ -82,7 +79,7 @@
 
   bool animation_scheduled_;
 
-  WebTaskList task_list_;
+  base::WeakPtrFactory<WebViewTestClient> weak_factory_;
 
   DISALLOW_COPY_AND_ASSIGN(WebViewTestClient);
 };

diff --git a/content/browser/bluetooth/bluetooth_blacklist.cc b/content/browser/bluetooth/bluetooth_blacklist.cc
index 086861eb..c9edc5e38 100644
--- a/content/browser/bluetooth/bluetooth_blacklist.cc
+++ b/content/browser/bluetooth/bluetooth_blacklist.cc

@@ -139,10 +139,6 @@
 void BluetoothBlacklist::PopulateWithDefaultValues() {
   blacklisted_uuids_.clear();
 
-  // Blacklist UUIDs updated 2016-02-12 from:
-  // https://github.com/WebBluetoothCG/registries/blob/master/gatt_blacklist.txt
-  // Short UUIDs are used for readability of this list.
-  //
   // Testing from Layout Tests Note:
   //
   // Random UUIDs for object & exclude permutations that do not exist in the
@@ -157,8 +153,15 @@
   // that match the specific permutations.
   DCHECK(BluetoothUUID("00001800-0000-1000-8000-00805f9b34fb") ==
          BluetoothUUID("1800"));
+
+  // Blacklist UUIDs updated 2016-04-07 from:
+  // https://github.com/WebBluetoothCG/registries/blob/master/gatt_blacklist.txt
+  // Short UUIDs are used for readability of this list.
+  //
   // Services:
   Add(BluetoothUUID("1812"), Value::EXCLUDE);
+  Add(BluetoothUUID("00001530-1212-efde-1523-785feabcd123"), Value::EXCLUDE);
+  Add(BluetoothUUID("f000ffc0-0451-4000-b000-000000000000"), Value::EXCLUDE);
   // Characteristics:
   Add(BluetoothUUID("2a02"), Value::EXCLUDE_WRITES);
   Add(BluetoothUUID("2a03"), Value::EXCLUDE);

diff --git a/content/browser/bluetooth/bluetooth_blacklist_unittest.cc b/content/browser/bluetooth/bluetooth_blacklist_unittest.cc
index 7e0761e..b0ed9c2 100644
--- a/content/browser/bluetooth/bluetooth_blacklist_unittest.cc
+++ b/content/browser/bluetooth/bluetooth_blacklist_unittest.cc

@@ -351,13 +351,17 @@
 TEST_F(BluetoothBlacklistTest, VerifyDefaultBlacklistSize) {
   // When adding items to the blacklist the new values should be added in the
   // tests below for each exclusion type.
-  EXPECT_EQ(9u, list_.size());
+  EXPECT_EQ(11u, list_.size());
 }
 
 TEST_F(BluetoothBlacklistTest, VerifyDefaultExcludeList) {
   EXPECT_FALSE(list_.IsExcluded(BluetoothUUID("1800")));
   EXPECT_FALSE(list_.IsExcluded(BluetoothUUID("1801")));
   EXPECT_TRUE(list_.IsExcluded(BluetoothUUID("1812")));
+  EXPECT_TRUE(
+      list_.IsExcluded(BluetoothUUID("00001530-1212-efde-1523-785feabcd123")));
+  EXPECT_TRUE(
+      list_.IsExcluded(BluetoothUUID("f000ffc0-0451-4000-b000-000000000000")));
   EXPECT_TRUE(list_.IsExcluded(BluetoothUUID("2a03")));
   EXPECT_TRUE(list_.IsExcluded(BluetoothUUID("2a25")));
   EXPECT_TRUE(

diff --git a/content/browser/compositor/software_output_device_mac.mm b/content/browser/compositor/software_output_device_mac.mm
index 4fd7993..9c9c393 100644
--- a/content/browser/compositor/software_output_device_mac.mm
+++ b/content/browser/compositor/software_output_device_mac.mm

@@ -141,7 +141,7 @@
       DLOG(ERROR) << "Failed to unlock IOSurface " << io_result;
   }
 
-  canvas_ = nullptr;
+  canvas_.reset();
   base::TimeTicks vsync_timebase;
   base::TimeDelta vsync_interval;
   ui::AcceleratedWidgetMacGotFrame(

diff --git a/content/browser/compositor/surface_utils.cc b/content/browser/compositor/surface_utils.cc
index 9a0c11d4..4f4b3ba 100644
--- a/content/browser/compositor/surface_utils.cc
+++ b/content/browser/compositor/surface_utils.cc

@@ -12,7 +12,6 @@
 #include "cc/surfaces/surface_id_allocator.h"
 #include "content/browser/compositor/gl_helper.h"
 #include "skia/ext/image_operations.h"
-#include "skia/ext/refptr.h"
 #include "third_party/skia/include/core/SkCanvas.h"
 #include "third_party/skia/include/core/SkColorFilter.h"
 #include "third_party/skia/include/core/SkPaint.h"

diff --git a/content/browser/gpu/gpu_ipc_browsertests.cc b/content/browser/gpu/gpu_ipc_browsertests.cc
index c9ece28..fd0ba69 100644
--- a/content/browser/gpu/gpu_ipc_browsertests.cc
+++ b/content/browser/gpu/gpu_ipc_browsertests.cc

@@ -14,7 +14,6 @@
 #include "content/public/common/content_switches.h"
 #include "content/public/test/content_browser_test.h"
 #include "gpu/blink/webgraphicscontext3d_in_process_command_buffer_impl.h"
-#include "skia/ext/refptr.h"
 #include "third_party/skia/include/core/SkCanvas.h"
 #include "third_party/skia/include/core/SkPaint.h"
 #include "third_party/skia/include/core/SkSurface.h"
@@ -234,7 +233,7 @@
                                            OFFSCREEN_CONTEXT_FOR_TESTING);
   EXPECT_TRUE(provider->BindToCurrentThread());
 
-  skia::RefPtr<GrContext> gr_context = skia::SharePtr(provider->GrContext());
+  sk_sp<GrContext> gr_context = sk_ref_sp(provider->GrContext());
 
   SkImageInfo info = SkImageInfo::MakeN32Premul(100, 100);
   sk_sp<SkSurface> surface = SkSurface::MakeRenderTarget(

diff --git a/content/browser/media/media_canplaytype_browsertest.cc b/content/browser/media/media_canplaytype_browsertest.cc
index 189477d..e3e1bb6 100644
--- a/content/browser/media/media_canplaytype_browsertest.cc
+++ b/content/browser/media/media_canplaytype_browsertest.cc

@@ -892,7 +892,15 @@
 }
 
 // When modifying this test, also change CodecSupportTest_Avc3Variants.
-IN_PROC_BROWSER_TEST_F(MediaCanPlayTypeTest, CodecSupportTest_Avc1Variants) {
+#if defined(OS_ANDROID)
+// Failing on Android, https://crbug.com/601418.
+#define MAYBE_CodecSupportTest_Avc1Variants \
+    DISABLED_CodecSupportTest_Avc1Variants
+#else
+#define MAYBE_CodecSupportTest_Avc1Variants CodecSupportTest_Avc1Variants
+#endif
+IN_PROC_BROWSER_TEST_F(MediaCanPlayTypeTest,
+    MAYBE_CodecSupportTest_Avc1Variants) {
   // avc1 without extensions results in "maybe" for compatibility.
   EXPECT_EQ(kPropMaybe, CanPlay("'video/mp4; codecs=\"avc1\"'"));
 
@@ -997,7 +1005,15 @@
 }
 
 // When modifying this test, also change CodecSupportTest_Avc1Variants.
-IN_PROC_BROWSER_TEST_F(MediaCanPlayTypeTest, CodecSupportTest_Avc3Variants) {
+#if defined(OS_ANDROID)
+// Failing on Android, https://crbug.com/601418.
+#define MAYBE_CodecSupportTest_Avc3Variants \
+    DISABLED_CodecSupportTest_Avc3Variants
+#else
+#define MAYBE_CodecSupportTest_Avc3Variants CodecSupportTest_Avc3Variants
+#endif
+IN_PROC_BROWSER_TEST_F(MediaCanPlayTypeTest,
+    MAYBE_CodecSupportTest_Avc3Variants) {
   // avc3 without extensions results in "maybe" for compatibility.
   EXPECT_EQ(kPropMaybe, CanPlay("'video/mp4; codecs=\"avc3\"'"));
 

diff --git a/content/browser/notifications/notification_database_data.proto b/content/browser/notifications/notification_database_data.proto
index 7044ed2..aad02a8 100644
--- a/content/browser/notifications/notification_database_data.proto
+++ b/content/browser/notifications/notification_database_data.proto

@@ -20,11 +20,19 @@
 
   // A notification action, corresponds to content::PlatformNotificationAction.
   //
-  // Next tag: 4
+  // Next tag: 6
   message NotificationAction {
+    // Corresponds to PlatformNotificationActionType.
+    enum Type {
+      BUTTON = 0;
+      TEXT = 1;
+    }
+
     optional string action = 1;
     optional string title = 2;
     optional string icon = 3;
+    optional Type type = 4;
+    optional string placeholder = 5;
   }
 
   // Actual data payload of the notification. This message is the protocol

diff --git a/content/browser/notifications/notification_database_data_conversions.cc b/content/browser/notifications/notification_database_data_conversions.cc
index 11cdd48..381f0d3 100644
--- a/content/browser/notifications/notification_database_data_conversions.cc
+++ b/content/browser/notifications/notification_database_data_conversions.cc

@@ -73,9 +73,25 @@
 
   for (const auto& payload_action : payload.actions()) {
     PlatformNotificationAction action;
+
+    switch (payload_action.type()) {
+      case NotificationDatabaseDataProto::NotificationAction::BUTTON:
+        action.type = PLATFORM_NOTIFICATION_ACTION_TYPE_BUTTON;
+        break;
+      case NotificationDatabaseDataProto::NotificationAction::TEXT:
+        action.type = PLATFORM_NOTIFICATION_ACTION_TYPE_TEXT;
+        break;
+      default:
+        NOTREACHED();
+    }
+
     action.action = payload_action.action();
     action.title = base::UTF8ToUTF16(payload_action.title());
     action.icon = GURL(payload_action.icon());
+    if (payload_action.has_placeholder()) {
+      action.placeholder = base::NullableString16(
+          base::UTF8ToUTF16(payload_action.placeholder()), false);
+    }
     notification_data->actions.push_back(action);
   }
 
@@ -130,9 +146,28 @@
   for (const PlatformNotificationAction& action : notification_data.actions) {
     NotificationDatabaseDataProto::NotificationAction* payload_action =
         payload->add_actions();
+
+    switch (action.type) {
+      case PLATFORM_NOTIFICATION_ACTION_TYPE_BUTTON:
+        payload_action->set_type(
+            NotificationDatabaseDataProto::NotificationAction::BUTTON);
+        break;
+      case PLATFORM_NOTIFICATION_ACTION_TYPE_TEXT:
+        payload_action->set_type(
+            NotificationDatabaseDataProto::NotificationAction::TEXT);
+        break;
+      default:
+        NOTREACHED() << "Unknown action type: " << action.type;
+    }
+
     payload_action->set_action(action.action);
     payload_action->set_title(base::UTF16ToUTF8(action.title));
     payload_action->set_icon(action.icon.spec());
+
+    if (!action.placeholder.is_null()) {
+      payload_action->set_placeholder(
+          base::UTF16ToUTF8(action.placeholder.string()));
+    }
   }
 
   NotificationDatabaseDataProto message;

diff --git a/content/browser/notifications/notification_database_data_unittest.cc b/content/browser/notifications/notification_database_data_unittest.cc
index a07a5f5..bf93b35 100644
--- a/content/browser/notifications/notification_database_data_unittest.cc
+++ b/content/browser/notifications/notification_database_data_unittest.cc

@@ -6,6 +6,7 @@
 #include <stdint.h>
 
 #include "base/macros.h"
+#include "base/strings/nullable_string16.h"
 #include "base/strings/string_number_conversions.h"
 #include "base/strings/utf_string_conversions.h"
 #include "base/time/time.h"
@@ -21,6 +22,8 @@
 const int64_t kNotificationId = 42;
 const int64_t kServiceWorkerRegistrationId = 9001;
 
+const PlatformNotificationActionType kNotificationActionType =
+    PLATFORM_NOTIFICATION_ACTION_TYPE_TEXT;
 const char kOrigin[] = "https://example.com/";
 const char kNotificationTitle[] = "My Notification";
 const char kNotificationLang[] = "nl";
@@ -58,9 +61,12 @@
   notification_data.data = developer_data;
   for (size_t i = 0; i < kPlatformNotificationMaxActions; i++) {
     PlatformNotificationAction notification_action;
+    notification_action.type = kNotificationActionType;
     notification_action.action = base::SizeTToString(i);
     notification_action.title = base::SizeTToString16(i);
     notification_action.icon = GURL(kNotificationActionIconUrl);
+    notification_action.placeholder =
+        base::NullableString16(base::SizeTToString16(i), false);
     notification_data.actions.push_back(notification_action);
   }
 
@@ -114,12 +120,44 @@
   ASSERT_EQ(notification_data.actions.size(),
             copied_notification_data.actions.size());
   for (size_t i = 0; i < notification_data.actions.size(); ++i) {
+    EXPECT_EQ(notification_data.actions[i].type,
+              copied_notification_data.actions[i].type);
     EXPECT_EQ(notification_data.actions[i].action,
               copied_notification_data.actions[i].action);
     EXPECT_EQ(notification_data.actions[i].title,
               copied_notification_data.actions[i].title);
     EXPECT_EQ(notification_data.actions[i].icon,
               copied_notification_data.actions[i].icon);
+    EXPECT_EQ(notification_data.actions[i].placeholder,
+              copied_notification_data.actions[i].placeholder);
+    EXPECT_FALSE(copied_notification_data.actions[i].placeholder.is_null());
+  }
+}
+
+TEST(NotificationDatabaseDataTest, SerializeAndDeserializeActionTypes) {
+  PlatformNotificationActionType action_types[] = {
+      PLATFORM_NOTIFICATION_ACTION_TYPE_BUTTON,
+      PLATFORM_NOTIFICATION_ACTION_TYPE_TEXT};
+
+  for (PlatformNotificationActionType action_type : action_types) {
+    PlatformNotificationData notification_data;
+
+    PlatformNotificationAction action;
+    action.type = action_type;
+    notification_data.actions.push_back(action);
+
+    NotificationDatabaseData database_data;
+    database_data.notification_data = notification_data;
+
+    std::string serialized_data;
+    ASSERT_TRUE(
+        SerializeNotificationDatabaseData(database_data, &serialized_data));
+
+    NotificationDatabaseData copied_data;
+    ASSERT_TRUE(
+        DeserializeNotificationDatabaseData(serialized_data, &copied_data));
+
+    EXPECT_EQ(action_type, copied_data.notification_data.actions[0].type);
   }
 }
 
@@ -148,4 +186,26 @@
   }
 }
 
+TEST(NotificationDatabaseDataTest, SerializeAndDeserializeNullPlaceholder) {
+  PlatformNotificationAction action;
+  action.type = kNotificationActionType;
+  action.placeholder = base::NullableString16();  // null string.
+
+  PlatformNotificationData notification_data;
+  notification_data.actions.push_back(action);
+
+  NotificationDatabaseData database_data;
+  database_data.notification_data = notification_data;
+
+  std::string serialized_data;
+  ASSERT_TRUE(
+      SerializeNotificationDatabaseData(database_data, &serialized_data));
+
+  NotificationDatabaseData copied_data;
+  ASSERT_TRUE(
+      DeserializeNotificationDatabaseData(serialized_data, &copied_data));
+
+  EXPECT_TRUE(copied_data.notification_data.actions[0].placeholder.is_null());
+}
+
 }  // namespace content

diff --git a/content/browser/renderer_host/database_message_filter.cc b/content/browser/renderer_host/database_message_filter.cc
index d29b294..5f9a8ae5d 100644
--- a/content/browser/renderer_host/database_message_filter.cc
+++ b/content/browser/renderer_host/database_message_filter.cc

@@ -163,7 +163,7 @@
   // database tracker.
   *handle = IPC::InvalidPlatformFileForTransit();
   if (file.IsValid()) {
-    *handle = IPC::TakeFileHandleForProcess(std::move(file), PeerHandle());
+    *handle = IPC::TakePlatformFileForTransit(std::move(file));
   } else if (tracked_file) {
     DCHECK(tracked_file->IsValid());
     *handle =

diff --git a/content/browser/renderer_host/media/video_capture_gpu_jpeg_decoder.cc b/content/browser/renderer_host/media/video_capture_gpu_jpeg_decoder.cc
index 60662eb..c1656e9 100644
--- a/content/browser/renderer_host/media/video_capture_gpu_jpeg_decoder.cc
+++ b/content/browser/renderer_host/media/video_capture_gpu_jpeg_decoder.cc

@@ -16,10 +16,10 @@
 #include "base/trace_event/trace_event.h"
 #include "build/build_config.h"
 #include "content/browser/gpu/browser_gpu_channel_host_factory.h"
-#include "content/common/gpu/client/gpu_jpeg_decode_accelerator_host.h"
 #include "content/public/browser/browser_thread.h"
 #include "content/public/common/content_switches.h"
 #include "media/base/video_frame.h"
+#include "media/gpu/ipc/client/gpu_jpeg_decode_accelerator_host.h"
 
 namespace content {
 
@@ -229,9 +229,9 @@
         BrowserGpuChannelHostFactory::instance()->GetIOThreadTaskRunner();
 
     int32_t route_id = gpu_channel_host_->GenerateRouteID();
-    scoped_ptr<GpuJpegDecodeAcceleratorHost> decoder(
-        new GpuJpegDecodeAcceleratorHost(gpu_channel_host_.get(), route_id,
-                                         io_task_runner));
+    scoped_ptr<media::GpuJpegDecodeAcceleratorHost> decoder(
+        new media::GpuJpegDecodeAcceleratorHost(gpu_channel_host_.get(),
+                                                route_id, io_task_runner));
     if (decoder->Initialize(this)) {
       gpu_channel_host_->AddRouteWithTaskRunner(
           route_id, decoder->GetReceiver(), io_task_runner);

diff --git a/content/browser/renderer_host/pepper/pepper_flash_file_message_filter.cc b/content/browser/renderer_host/pepper/pepper_flash_file_message_filter.cc
index 3059dd7..6f03077 100644
--- a/content/browser/renderer_host/pepper/pepper_flash_file_message_filter.cc
+++ b/content/browser/renderer_host/pepper/pepper_flash_file_message_filter.cc

@@ -136,7 +136,7 @@
   }
 
   IPC::PlatformFileForTransit transit_file =
-      IPC::TakeFileHandleForProcess(std::move(file), plugin_process_.Handle());
+      IPC::TakePlatformFileForTransit(std::move(file));
   ppapi::host::ReplyMessageContext reply_context =
       context->MakeReplyMessageContext();
   reply_context.params.AppendHandle(ppapi::proxy::SerializedHandle(
@@ -258,7 +258,7 @@
     return ppapi::FileErrorToPepperError(file.error_details());
 
   IPC::PlatformFileForTransit transit_file =
-      IPC::TakeFileHandleForProcess(std::move(file), plugin_process_.Handle());
+      IPC::TakePlatformFileForTransit(std::move(file));
   ppapi::host::ReplyMessageContext reply_context =
       context->MakeReplyMessageContext();
   reply_context.params.AppendHandle(ppapi::proxy::SerializedHandle(

diff --git a/content/browser/renderer_host/render_process_host_impl.cc b/content/browser/renderer_host/render_process_host_impl.cc
index 5ba1bc8e8..734aee25 100644
--- a/content/browser/renderer_host/render_process_host_impl.cc
+++ b/content/browser/renderer_host/render_process_host_impl.cc

@@ -282,8 +282,7 @@
 #if defined(ENABLE_WEBRTC)
 
 // Creates a file used for handing over to the renderer.
-IPC::PlatformFileForTransit CreateFileForProcess(base::FilePath file_path,
-                                                 base::ProcessHandle process) {
+IPC::PlatformFileForTransit CreateFileForProcess(base::FilePath file_path) {
   DCHECK_CURRENTLY_ON(BrowserThread::FILE);
   base::File dump_file(file_path,
                        base::File::FLAG_OPEN_ALWAYS | base::File::FLAG_APPEND);
@@ -292,7 +291,7 @@
             << dump_file.error_details();
     return IPC::InvalidPlatformFileForTransit();
   }
-  return IPC::TakeFileHandleForProcess(std::move(dump_file), process);
+  return IPC::TakePlatformFileForTransit(std::move(dump_file));
 }
 
 // Allow us to only run the trial in the first renderer.
@@ -2714,8 +2713,7 @@
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
   BrowserThread::PostTaskAndReplyWithResult(
       BrowserThread::FILE, FROM_HERE,
-      base::Bind(&CreateFileForProcess, file.AddExtension(IntToStringType(id)),
-                 GetHandle()),
+      base::Bind(&CreateFileForProcess, file.AddExtension(IntToStringType(id))),
       base::Bind(&RenderProcessHostImpl::SendAecDumpFileToRenderer,
                  weak_factory_.GetWeakPtr(), id));
 }
@@ -2725,8 +2723,7 @@
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
   BrowserThread::PostTaskAndReplyWithResult(
       BrowserThread::FILE, FROM_HERE,
-      base::Bind(&CreateFileForProcess, file.AddExtension(IntToStringType(id)),
-                 GetHandle()),
+      base::Bind(&CreateFileForProcess, file.AddExtension(IntToStringType(id))),
       base::Bind(&RenderProcessHostImpl::SendEventLogFileToRenderer,
                  weak_factory_.GetWeakPtr(), id));
 }

diff --git a/content/browser/resources/media/dump_creator.js b/content/browser/resources/media/dump_creator.js
index 1f13256..e636b941 100644
--- a/content/browser/resources/media/dump_creator.js
+++ b/content/browser/resources/media/dump_creator.js

@@ -62,14 +62,12 @@
         ' and RTCP packets are logged. These do not include any audio or' +
         ' video information, nor any other types of personally identifiable' +
         ' information (so no IP addresses or URLs). Checking this box will' +
-        ' enable the recording for ongoing WebRTC calls and for future' +
-        ' WebRTC calls. When the box is unchecked or this page is closed,' +
-        ' all ongoing recordings will be stopped and this recording' +
-        ' functionality will be disabled for future WebRTC calls. Recording' +
-        ' in multiple tabs or multiple recordings in the same tab is' +
-        ' currently not supported. When enabling, a filename for the' +
-        ' recording can be selected. If an existing file is selected, it' +
-        ' will be overwritten. </p>';
+        ' enable the recording for currently ongoing WebRTC calls. When' +
+        ' the box is unchecked or this page is closed, all active recordings' +
+        ' will be stopped. Recording in multiple tabs or multiple recordings' +
+        ' in the same tab is currently not supported. When enabling, a' +
+        ' filename for the recording can be selected. If an existing file is' +
+        ' selected, it will be overwritten. </p>';
     content.getElementsByTagName('a')[0].addEventListener(
         'click', this.onDownloadData_.bind(this));
     content.getElementsByTagName('input')[0].addEventListener(

diff --git a/content/browser/service_worker/embedded_worker_instance.cc b/content/browser/service_worker/embedded_worker_instance.cc
index 0e78c93..f30a79d 100644
--- a/content/browser/service_worker/embedded_worker_instance.cc
+++ b/content/browser/service_worker/embedded_worker_instance.cc

@@ -21,6 +21,7 @@
 #include "content/common/service_worker/embedded_worker_setup.mojom.h"
 #include "content/common/service_worker/service_worker_types.h"
 #include "content/public/browser/browser_thread.h"
+#include "content/public/browser/content_browser_client.h"
 #include "content/public/browser/render_process_host.h"
 #include "content/public/common/child_process_host.h"
 #include "ipc/ipc_message.h"
@@ -145,10 +146,12 @@
  public:
   WorkerProcessHandle(const base::WeakPtr<ServiceWorkerContextCore>& context,
                       int embedded_worker_id,
-                      int process_id)
+                      int process_id,
+                      bool is_new_process)
       : context_(context),
         embedded_worker_id_(embedded_worker_id),
-        process_id_(process_id) {
+        process_id_(process_id),
+        is_new_process_(is_new_process) {
     DCHECK_NE(ChildProcessHost::kInvalidUniqueID, process_id_);
   }
 
@@ -158,12 +161,14 @@
   }
 
   int process_id() const { return process_id_; }
+  bool is_new_process() const { return is_new_process_; }
 
  private:
   base::WeakPtr<ServiceWorkerContextCore> context_;
 
   const int embedded_worker_id_;
   const int process_id_;
+  const bool is_new_process_;
 
   DISALLOW_COPY_AND_ASSIGN(WorkerProcessHandle);
 };
@@ -180,6 +185,8 @@
   StartTask(EmbeddedWorkerInstance* instance, const GURL& script_url)
       : instance_(instance),
         state_(ProcessAllocationState::NOT_ALLOCATED),
+        is_installed_(false),
+        start_situation_(ServiceWorkerMetrics::StartSituation::UNKNOWN),
         weak_factory_(this) {
     TRACE_EVENT_ASYNC_BEGIN1("ServiceWorker", "EmbeddedWorkerInstance::Start",
                              this, "Script", script_url.spec());
@@ -223,6 +230,10 @@
     DCHECK_CURRENTLY_ON(BrowserThread::IO);
     state_ = ProcessAllocationState::ALLOCATING;
     start_callback_ = callback;
+    is_installed_ = params->is_installed;
+
+    if (!GetContentClient()->browser()->IsBrowserStartupComplete())
+      start_situation_ = ServiceWorkerMetrics::StartSituation::DURING_STARTUP;
 
     GURL scope(params->scope);
     GURL script_url(params->script_url);
@@ -246,6 +257,11 @@
     // |task| may be destroyed.
   }
 
+  bool is_installed() const { return is_installed_; }
+  ServiceWorkerMetrics::StartSituation start_situation() const {
+    return start_situation_;
+  }
+
  private:
   void OnProcessAllocated(
       scoped_ptr<EmbeddedWorkerMsg_StartWorker_Params> params,
@@ -270,11 +286,22 @@
     TRACE_EVENT_ASYNC_STEP_PAST1(
         "ServiceWorker", "EmbeddedWorkerInstance::Start", this,
         "OnProcessAllocated", "Is New Process", is_new_process);
+    if (is_installed_)
+      ServiceWorkerMetrics::RecordProcessCreated(is_new_process);
+
+    if (start_situation_ == ServiceWorkerMetrics::StartSituation::UNKNOWN) {
+      if (is_new_process)
+        start_situation_ = ServiceWorkerMetrics::StartSituation::NEW_PROCESS;
+      else
+        start_situation_ =
+            ServiceWorkerMetrics::StartSituation::EXISTING_PROCESS;
+    }
 
     // Notify the instance that a process is allocated.
     state_ = ProcessAllocationState::ALLOCATED;
     instance_->OnProcessAllocated(make_scoped_ptr(new WorkerProcessHandle(
-        instance_->context_, instance_->embedded_worker_id(), process_id)));
+        instance_->context_, instance_->embedded_worker_id(), process_id,
+        is_new_process)));
 
     // TODO(bengr): Support changes to this setting while the worker
     // is running.
@@ -340,6 +367,10 @@
   StatusCallback start_callback_;
   ProcessAllocationState state_;
 
+  // Used for UMA.
+  bool is_installed_;
+  ServiceWorkerMetrics::StartSituation start_situation_;
+
   base::WeakPtrFactory<StartTask> weak_factory_;
 
   DISALLOW_COPY_AND_ASSIGN(StartTask);
@@ -368,8 +399,9 @@
   }
   DCHECK(status_ == STOPPED);
 
+  DCHECK(!params->pause_after_download || !params->is_installed);
   DCHECK_NE(kInvalidServiceWorkerVersionId, params->service_worker_version_id);
-  start_timing_ = base::TimeTicks::Now();
+  step_time_ = base::TimeTicks::Now();
   status_ = STARTING;
   starting_phase_ = ALLOCATING_PROCESS;
   network_accessed_for_script_ = false;
@@ -471,27 +503,21 @@
         new DevToolsProxy(process_id(), worker_devtools_agent_route_id));
   }
   if (wait_for_debugger) {
-    // We don't measure the start time when wait_for_debugger flag is set. So we
-    // set the NULL time here.
-    start_timing_ = base::TimeTicks();
-  } else {
-    DCHECK(!start_timing_.is_null());
-    if (is_new_process) {
-      UMA_HISTOGRAM_TIMES("EmbeddedWorkerInstance.NewProcessAllocation",
-                          base::TimeTicks::Now() - start_timing_);
-    } else {
-      UMA_HISTOGRAM_TIMES("EmbeddedWorkerInstance.ExistingProcessAllocation",
-                          base::TimeTicks::Now() - start_timing_);
-    }
-    UMA_HISTOGRAM_BOOLEAN("EmbeddedWorkerInstance.ProcessCreated",
-                          is_new_process);
-    // Reset |start_timing_| to measure the time excluding the process
-    // allocation time.
-    start_timing_ = base::TimeTicks::Now();
+    // We don't measure the start time when wait_for_debugger flag is set. So
+    // we set the NULL time here.
+    step_time_ = base::TimeTicks();
   }
 }
 
 void EmbeddedWorkerInstance::OnStartWorkerMessageSent() {
+  if (!step_time_.is_null()) {
+    base::TimeDelta duration = UpdateStepTime();
+    if (inflight_start_task_->is_installed()) {
+      ServiceWorkerMetrics::RecordTimeToSendStartWorker(
+          duration, inflight_start_task_->start_situation());
+    }
+  }
+
   starting_phase_ = SENT_START_WORKER;
   FOR_EACH_OBSERVER(Listener, listener_list_, OnStartWorkerMessageSent());
 }
@@ -510,14 +536,29 @@
 }
 
 void EmbeddedWorkerInstance::OnScriptLoaded() {
+  using LoadSource = ServiceWorkerMetrics::LoadSource;
+
   if (!inflight_start_task_)
     return;
+  LoadSource source;
+  if (network_accessed_for_script_) {
+    DCHECK(!inflight_start_task_->is_installed());
+    source = LoadSource::NETWORK;
+  } else if (inflight_start_task_->is_installed()) {
+    source = LoadSource::SERVICE_WORKER_STORAGE;
+  } else {
+    source = LoadSource::HTTP_CACHE;
+  }
   TRACE_EVENT_ASYNC_STEP_PAST1(
       "ServiceWorker", "EmbeddedWorkerInstance::Start",
       inflight_start_task_.get(), "OnScriptLoaded", "Source",
-      (network_accessed_for_script_
-           ? "Network"
-           : "Disk (HttpCache or ServiceWorkerStorage)"));
+      ServiceWorkerMetrics::LoadSourceToString(source));
+
+  if (!step_time_.is_null()) {
+    base::TimeDelta duration = UpdateStepTime();
+    ServiceWorkerMetrics::RecordTimeToLoad(
+        duration, source, inflight_start_task_->start_situation());
+  }
 
   FOR_EACH_OBSERVER(Listener, listener_list_, OnScriptLoaded());
   starting_phase_ = SCRIPT_LOADED;
@@ -528,6 +569,12 @@
     return;
   TRACE_EVENT_ASYNC_STEP_PAST0("ServiceWorker", "EmbeddedWorkerInstance::Start",
                                inflight_start_task_.get(), "OnURLJobCreated");
+  if (!step_time_.is_null()) {
+    base::TimeDelta duration = UpdateStepTime();
+    if (inflight_start_task_->is_installed())
+      ServiceWorkerMetrics::RecordTimeToURLJob(
+          duration, inflight_start_task_->start_situation());
+  }
 }
 
 void EmbeddedWorkerInstance::OnThreadStarted(int thread_id) {
@@ -537,20 +584,13 @@
                                inflight_start_task_.get(), "OnThreadStarted");
 
   starting_phase_ = THREAD_STARTED;
-
-  if (!start_timing_.is_null()) {
-    if (network_accessed_for_script_) {
-      UMA_HISTOGRAM_TIMES("EmbeddedWorkerInstance.ScriptLoadWithNetworkAccess",
-                          base::TimeTicks::Now() - start_timing_);
-    } else {
-      UMA_HISTOGRAM_TIMES(
-          "EmbeddedWorkerInstance.ScriptLoadWithoutNetworkAccess",
-          base::TimeTicks::Now() - start_timing_);
-    }
-    // Reset |start_timing_| to measure the time excluding the process
-    // allocation time and the script loading time.
-    start_timing_ = base::TimeTicks::Now();
+  if (!step_time_.is_null()) {
+    base::TimeDelta duration = UpdateStepTime();
+    if (inflight_start_task_->is_installed())
+      ServiceWorkerMetrics::RecordTimeToStartThread(
+          duration, inflight_start_task_->start_situation());
   }
+
   thread_id_ = thread_id;
   FOR_EACH_OBSERVER(Listener, listener_list_, OnThreadStarted());
 
@@ -584,11 +624,12 @@
   TRACE_EVENT_ASYNC_STEP_PAST1("ServiceWorker", "EmbeddedWorkerInstance::Start",
                                inflight_start_task_.get(), "OnScriptEvaluated",
                                "Success", success);
-
   starting_phase_ = SCRIPT_EVALUATED;
-  if (success && !start_timing_.is_null()) {
-    UMA_HISTOGRAM_TIMES("EmbeddedWorkerInstance.ScriptEvaluate",
-                        base::TimeTicks::Now() - start_timing_);
+  if (!step_time_.is_null()) {
+    base::TimeDelta duration = UpdateStepTime();
+    if (success && inflight_start_task_->is_installed())
+      ServiceWorkerMetrics::RecordTimeToEvaluateScript(
+          duration, inflight_start_task_->start_situation());
   }
 
   base::WeakPtr<EmbeddedWorkerInstance> weak_this = weak_factory_.GetWeakPtr();
@@ -669,6 +710,11 @@
   return ChildProcessHost::kInvalidUniqueID;
 }
 
+bool EmbeddedWorkerInstance::is_new_process() const {
+  DCHECK(process_handle_);
+  return process_handle_->is_new_process();
+}
+
 int EmbeddedWorkerInstance::worker_devtools_agent_route_id() const {
   if (devtools_proxy_)
     return devtools_proxy_->agent_route_id();
@@ -715,6 +761,15 @@
                       OnStopped(old_status));
 }
 
+base::TimeDelta EmbeddedWorkerInstance::UpdateStepTime() {
+  DCHECK_CURRENTLY_ON(BrowserThread::IO);
+  DCHECK(!step_time_.is_null());
+  base::TimeTicks now = base::TimeTicks::Now();
+  base::TimeDelta duration = now - step_time_;
+  step_time_ = now;
+  return duration;
+}
+
 // static
 std::string EmbeddedWorkerInstance::StatusToString(Status status) {
   switch (status) {

diff --git a/content/browser/service_worker/embedded_worker_instance.h b/content/browser/service_worker/embedded_worker_instance.h
index d84fd0b..0c9b67e 100644
--- a/content/browser/service_worker/embedded_worker_instance.h
+++ b/content/browser/service_worker/embedded_worker_instance.h

@@ -20,6 +20,7 @@
 #include "base/observer_list.h"
 #include "base/strings/string16.h"
 #include "base/time/time.h"
+#include "content/browser/service_worker/service_worker_metrics.h"
 #include "content/common/content_export.h"
 #include "content/common/service_worker/service_worker_status_code.h"
 #include "url/gurl.h"
@@ -145,6 +146,9 @@
   }
   int process_id() const;
   int thread_id() const { return thread_id_; }
+  // This should be called only when the worker instance has a valid process,
+  // that is, when |process_id()| returns a valid process id.
+  bool is_new_process() const;
   int worker_devtools_agent_route_id() const;
   MessagePortMessageFilter* message_port_message_filter() const;
 
@@ -158,7 +162,7 @@
     return network_accessed_for_script_;
   }
 
-  // Called when the script load request accessed the network.
+  // Called when the main script load accessed the network.
   void OnNetworkAccessedForScriptLoad();
 
   // Called when reading the main script from the service worker script cache
@@ -267,6 +271,10 @@
   void OnStartFailed(const StatusCallback& callback,
                      ServiceWorkerStatusCode status);
 
+  // Returns the time elapsed since |step_time_| and updates |step_time_|
+  // to the current time.
+  base::TimeDelta UpdateStepTime();
+
   base::WeakPtr<ServiceWorkerContextCore> context_;
   scoped_refptr<EmbeddedWorkerRegistry> registry_;
   const int embedded_worker_id_;
@@ -289,7 +297,9 @@
   scoped_ptr<DevToolsProxy> devtools_proxy_;
 
   scoped_ptr<StartTask> inflight_start_task_;
-  base::TimeTicks start_timing_;
+
+  // Used for UMA. The start time of the current start sequence step.
+  base::TimeTicks step_time_;
 
   base::WeakPtrFactory<EmbeddedWorkerInstance> weak_factory_;
 

diff --git a/content/browser/service_worker/service_worker_metrics.cc b/content/browser/service_worker/service_worker_metrics.cc
index 6e8a1e25..3fdb74f 100644
--- a/content/browser/service_worker/service_worker_metrics.cc
+++ b/content/browser/service_worker/service_worker_metrics.cc

@@ -16,6 +16,35 @@
 
 namespace {
 
+std::string StartSituationToSuffix(
+    ServiceWorkerMetrics::StartSituation situation) {
+  switch (situation) {
+    case ServiceWorkerMetrics::StartSituation::DURING_STARTUP:
+      return "_DuringStartup";
+    case ServiceWorkerMetrics::StartSituation::NEW_PROCESS:
+      return "_NewProcess";
+    case ServiceWorkerMetrics::StartSituation::EXISTING_PROCESS:
+      return "_ExistingProcess";
+    default:
+      NOTREACHED() << static_cast<int>(situation);
+  }
+  return "_Unknown";
+}
+
+// Use this for histograms with dynamically generated names, which
+// otherwise can't use the UMA_HISTOGRAM macro without code duplication.
+void RecordSuffixedTimeHistogram(const std::string& name,
+                                 const std::string& suffix,
+                                 base::TimeDelta sample) {
+  const std::string name_with_suffix = name + suffix;
+  // This unrolls UMA_HISTOGRAM_MEDIUM_TIMES.
+  base::HistogramBase* histogram_pointer = base::Histogram::FactoryTimeGet(
+      name_with_suffix, base::TimeDelta::FromMilliseconds(10),
+      base::TimeDelta::FromMinutes(3), 50,
+      base::HistogramBase::kUmaTargetedHistogramFlag);
+  histogram_pointer->AddTime(sample);
+}
+
 void RecordURLMetricOnUI(const GURL& url) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
   GetContentClient()->browser()->RecordURLMetric(
@@ -175,12 +204,18 @@
   }
 }
 
-void ServiceWorkerMetrics::RecordStartWorkerTime(const base::TimeDelta& time,
-                                                 bool is_installed) {
-  if (is_installed)
-    UMA_HISTOGRAM_MEDIUM_TIMES("ServiceWorker.StartWorker.Time", time);
-  else
+void ServiceWorkerMetrics::RecordStartWorkerTime(
+    base::TimeDelta time,
+    bool is_installed,
+    StartSituation start_situation) {
+  if (is_installed) {
+    std::string name = "ServiceWorker.StartWorker.Time";
+    UMA_HISTOGRAM_MEDIUM_TIMES(name, time);
+    RecordSuffixedTimeHistogram(name, StartSituationToSuffix(start_situation),
+                                time);
+  } else {
     UMA_HISTOGRAM_MEDIUM_TIMES("ServiceWorker.StartNewWorker.Time", time);
+  }
 }
 
 void ServiceWorkerMetrics::RecordWorkerStopped(StopStatus status) {
@@ -189,7 +224,7 @@
                             static_cast<int>(StopStatus::NUM_TYPES));
 }
 
-void ServiceWorkerMetrics::RecordStopWorkerTime(const base::TimeDelta& time) {
+void ServiceWorkerMetrics::RecordStopWorkerTime(base::TimeDelta time) {
   UMA_HISTOGRAM_MEDIUM_TIMES("ServiceWorker.StopWorker.Time", time);
 }
 
@@ -243,7 +278,7 @@
 }
 
 void ServiceWorkerMetrics::RecordEventDuration(EventType event,
-                                               const base::TimeDelta& time,
+                                               base::TimeDelta time,
                                                bool was_handled) {
   switch (event) {
     case EventType::ACTIVATE:
@@ -348,9 +383,98 @@
                             mode, FETCH_REQUEST_MODE_LAST + 1);
 }
 
-void ServiceWorkerMetrics::RecordTimeBetweenEvents(
-    const base::TimeDelta& time) {
+void ServiceWorkerMetrics::RecordTimeBetweenEvents(base::TimeDelta time) {
   UMA_HISTOGRAM_MEDIUM_TIMES("ServiceWorker.TimeBetweenEvents", time);
 }
 
+void ServiceWorkerMetrics::RecordProcessCreated(bool is_new_process) {
+  UMA_HISTOGRAM_BOOLEAN("EmbeddedWorkerInstance.ProcessCreated",
+                        is_new_process);
+}
+
+void ServiceWorkerMetrics::RecordTimeToSendStartWorker(
+    base::TimeDelta duration,
+    StartSituation situation) {
+  std::string name = "EmbeddedWorkerInstance.Start.TimeToSendStartWorker";
+  UMA_HISTOGRAM_MEDIUM_TIMES(name, duration);
+  RecordSuffixedTimeHistogram(name, StartSituationToSuffix(situation),
+                              duration);
+}
+
+void ServiceWorkerMetrics::RecordTimeToURLJob(base::TimeDelta duration,
+                                              StartSituation situation) {
+  std::string name = "EmbeddedWorkerInstance.Start.TimeToURLJob";
+  UMA_HISTOGRAM_MEDIUM_TIMES(name, duration);
+  RecordSuffixedTimeHistogram(name, StartSituationToSuffix(situation),
+                              duration);
+}
+
+void ServiceWorkerMetrics::RecordTimeToLoad(base::TimeDelta duration,
+                                            LoadSource source,
+                                            StartSituation situation) {
+  std::string name;
+  switch (source) {
+    case LoadSource::NETWORK:
+      name = "EmbeddedWorkerInstance.Start.TimeToLoad.Network";
+      UMA_HISTOGRAM_MEDIUM_TIMES(name, duration);
+      RecordSuffixedTimeHistogram(name, StartSituationToSuffix(situation),
+                                  duration);
+      break;
+    case LoadSource::HTTP_CACHE:
+      name = "EmbeddedWorkerInstance.Start.TimeToLoad.HttpCache";
+      UMA_HISTOGRAM_MEDIUM_TIMES(name, duration);
+      RecordSuffixedTimeHistogram(name, StartSituationToSuffix(situation),
+                                  duration);
+      break;
+    case LoadSource::SERVICE_WORKER_STORAGE:
+      name = "EmbeddedWorkerInstance.Start.TimeToLoad.InstalledScript";
+      UMA_HISTOGRAM_MEDIUM_TIMES(name, duration);
+      RecordSuffixedTimeHistogram(name, StartSituationToSuffix(situation),
+                                  duration);
+      break;
+    default:
+      NOTREACHED() << static_cast<int>(source);
+  }
+}
+
+void ServiceWorkerMetrics::RecordTimeToStartThread(base::TimeDelta duration,
+                                                   StartSituation situation) {
+  std::string name = "EmbeddedWorkerInstance.Start.TimeToStartThread";
+  UMA_HISTOGRAM_MEDIUM_TIMES(name, duration);
+  RecordSuffixedTimeHistogram(name, StartSituationToSuffix(situation),
+                              duration);
+}
+
+void ServiceWorkerMetrics::RecordTimeToEvaluateScript(
+    base::TimeDelta duration,
+    StartSituation situation) {
+  std::string name = "EmbeddedWorkerInstance.Start.TimeToEvaluateScript";
+  UMA_HISTOGRAM_MEDIUM_TIMES(name, duration);
+  RecordSuffixedTimeHistogram(name, StartSituationToSuffix(situation),
+                              duration);
+}
+
+const char* ServiceWorkerMetrics::LoadSourceToString(LoadSource source) {
+  switch (source) {
+    case LoadSource::NETWORK:
+      return "Network";
+    case LoadSource::HTTP_CACHE:
+      return "HTTP cache";
+    case LoadSource::SERVICE_WORKER_STORAGE:
+      return "Service worker storage";
+  }
+  NOTREACHED() << static_cast<int>(source);
+  return nullptr;
+}
+
+ServiceWorkerMetrics::StartSituation ServiceWorkerMetrics::GetStartSituation(
+    bool is_browser_startup_complete,
+    bool is_new_process) {
+  if (!is_browser_startup_complete)
+    return StartSituation::DURING_STARTUP;
+  if (is_new_process)
+    return StartSituation::NEW_PROCESS;
+  return StartSituation::EXISTING_PROCESS;
+}
+
 }  // namespace content

diff --git a/content/browser/service_worker/service_worker_metrics.h b/content/browser/service_worker/service_worker_metrics.h
index 75371f0..e14d1ad 100644
--- a/content/browser/service_worker/service_worker_metrics.h
+++ b/content/browser/service_worker/service_worker_metrics.h

@@ -18,6 +18,7 @@
 
 class ServiceWorkerMetrics {
  public:
+  // Used for UMA. Append-only.
   enum ReadResponseResult {
     READ_OK,
     READ_HEADERS_ERROR,
@@ -25,6 +26,7 @@
     NUM_READ_RESPONSE_RESULT_TYPES,
   };
 
+  // Used for UMA. Append-only.
   enum WriteResponseResult {
     WRITE_OK,
     WRITE_HEADERS_ERROR,
@@ -32,6 +34,7 @@
     NUM_WRITE_RESPONSE_RESULT_TYPES,
   };
 
+  // Used for UMA. Append-only.
   enum DeleteAndStartOverResult {
     DELETE_OK,
     DELETE_DATABASE_ERROR,
@@ -39,6 +42,7 @@
     NUM_DELETE_AND_START_OVER_RESULT_TYPES,
   };
 
+  // Used for UMA. Append-only.
   enum URLRequestJobResult {
     REQUEST_JOB_FALLBACK_RESPONSE,
     REQUEST_JOB_FALLBACK_FOR_CORS,
@@ -97,6 +101,17 @@
   // Used for UMA. Append only.
   enum class Site { OTHER, NEW_TAB_PAGE, NUM_TYPES };
 
+  // Not used for UMA.
+  enum class StartSituation {
+    UNKNOWN,
+    DURING_STARTUP,
+    EXISTING_PROCESS,
+    NEW_PROCESS
+  };
+
+  // Not used for UMA.
+  enum class LoadSource { NETWORK, HTTP_CACHE, SERVICE_WORKER_STORAGE };
+
   // Converts an event type to a string. Used for tracing.
   static const char* EventTypeToString(EventType event_type);
 
@@ -132,14 +147,15 @@
 
   // Records the time taken to successfully start a worker. |is_installed|
   // indicates whether the version has been installed.
-  static void RecordStartWorkerTime(const base::TimeDelta& time,
-                                    bool is_installed);
+  static void RecordStartWorkerTime(base::TimeDelta time,
+                                    bool is_installed,
+                                    StartSituation start_situation);
 
   // Records the result of trying to stop a worker.
   static void RecordWorkerStopped(StopStatus status);
 
   // Records the time taken to successfully stop a worker.
-  static void RecordStopWorkerTime(const base::TimeDelta& time);
+  static void RecordStopWorkerTime(base::TimeDelta time);
 
   static void RecordActivateEventStatus(ServiceWorkerStatusCode status);
   static void RecordInstallEventStatus(ServiceWorkerStatusCode status);
@@ -155,7 +171,7 @@
 
   // Records the amount of time spent handling an event.
   static void RecordEventDuration(EventType event,
-                                  const base::TimeDelta& time,
+                                  base::TimeDelta time,
                                   bool was_handled);
 
   // Records the result of dispatching a fetch event to a service worker.
@@ -179,7 +195,25 @@
   // Called at the beginning of each ServiceWorkerVersion::Dispatch*Event
   // function. Records the time elapsed since idle (generally the time since the
   // previous event ended).
-  static void RecordTimeBetweenEvents(const base::TimeDelta& time);
+  static void RecordTimeBetweenEvents(base::TimeDelta time);
+
+  // The following record steps of EmbeddedWorkerInstance's start sequence.
+  static void RecordProcessCreated(bool is_new_process);
+  static void RecordTimeToSendStartWorker(base::TimeDelta duration,
+                                          StartSituation start_situation);
+  static void RecordTimeToURLJob(base::TimeDelta duration,
+                                 StartSituation start_situation);
+  static void RecordTimeToLoad(base::TimeDelta duration,
+                               LoadSource source,
+                               StartSituation start_situation);
+  static void RecordTimeToStartThread(base::TimeDelta duration,
+                                      StartSituation start_situation);
+  static void RecordTimeToEvaluateScript(base::TimeDelta duration,
+                                         StartSituation start_situation);
+
+  static const char* LoadSourceToString(LoadSource source);
+  static StartSituation GetStartSituation(bool is_browser_startup_complete,
+                                          bool is_new_process);
 
  private:
   DISALLOW_IMPLICIT_CONSTRUCTORS(ServiceWorkerMetrics);

diff --git a/content/browser/service_worker/service_worker_version.cc b/content/browser/service_worker/service_worker_version.cc
index 27e2319..cf3c209d 100644
--- a/content/browser/service_worker/service_worker_version.cc
+++ b/content/browser/service_worker/service_worker_version.cc

@@ -396,14 +396,18 @@
       ServiceWorkerMetrics::EventTypeToString(purpose));
 
   DCHECK_CURRENTLY_ON(BrowserThread::IO);
+  const bool is_browser_startup_complete =
+      GetContentClient()->browser()->IsBrowserStartupComplete();
   if (!context_) {
     RecordStartWorkerResult(purpose, status_, kInvalidTraceId,
+                            is_browser_startup_complete,
                             SERVICE_WORKER_ERROR_ABORT);
     RunSoon(base::Bind(callback, SERVICE_WORKER_ERROR_ABORT));
     return;
   }
   if (is_redundant()) {
     RecordStartWorkerResult(purpose, status_, kInvalidTraceId,
+                            is_browser_startup_complete,
                             SERVICE_WORKER_ERROR_REDUNDANT);
     RunSoon(base::Bind(callback, SERVICE_WORKER_ERROR_REDUNDANT));
     return;
@@ -416,6 +420,7 @@
       !GetContentClient()->browser()->AllowServiceWorker(
           scope_, scope_, context_->wrapper()->resource_context(), -1, -1)) {
     RecordStartWorkerResult(purpose, status_, kInvalidTraceId,
+                            is_browser_startup_complete,
                             SERVICE_WORKER_ERROR_DISALLOWED);
     RunSoon(base::Bind(callback, SERVICE_WORKER_ERROR_DISALLOWED));
     return;
@@ -426,7 +431,8 @@
   context_->storage()->FindRegistrationForId(
       registration_id_, scope_.GetOrigin(),
       base::Bind(&ServiceWorkerVersion::DidEnsureLiveRegistrationForStartWorker,
-                 weak_factory_.GetWeakPtr(), purpose, status_, callback));
+                 weak_factory_.GetWeakPtr(), purpose, status_,
+                 is_browser_startup_complete, callback));
 }
 
 void ServiceWorkerVersion::StopWorker(const StatusCallback& callback) {
@@ -1275,6 +1281,7 @@
 void ServiceWorkerVersion::DidEnsureLiveRegistrationForStartWorker(
     ServiceWorkerMetrics::EventType purpose,
     Status prestart_status,
+    bool is_browser_startup_complete,
     const StatusCallback& callback,
     ServiceWorkerStatusCode status,
     const scoped_refptr<ServiceWorkerRegistration>& registration) {
@@ -1291,12 +1298,14 @@
     }
   }
   if (status != SERVICE_WORKER_OK) {
-    RecordStartWorkerResult(purpose, prestart_status, kInvalidTraceId, status);
+    RecordStartWorkerResult(purpose, prestart_status, kInvalidTraceId,
+                            is_browser_startup_complete, status);
     RunSoon(base::Bind(callback, SERVICE_WORKER_ERROR_START_WORKER_FAILED));
     return;
   }
   if (is_redundant()) {
     RecordStartWorkerResult(purpose, prestart_status, kInvalidTraceId,
+                            is_browser_startup_complete,
                             SERVICE_WORKER_ERROR_REDUNDANT);
     RunSoon(base::Bind(callback, SERVICE_WORKER_ERROR_REDUNDANT));
     return;
@@ -1319,9 +1328,10 @@
             "ServiceWorker", "ServiceWorkerVersion::StartWorker", trace_id,
             "Script", script_url_.spec(), "Purpose",
             ServiceWorkerMetrics::EventTypeToString(purpose));
-        start_callbacks_.push_back(base::Bind(
-            &ServiceWorkerVersion::RecordStartWorkerResult,
-            weak_factory_.GetWeakPtr(), purpose, prestart_status, trace_id));
+        start_callbacks_.push_back(
+            base::Bind(&ServiceWorkerVersion::RecordStartWorkerResult,
+                       weak_factory_.GetWeakPtr(), purpose, prestart_status,
+                       trace_id, is_browser_startup_complete));
       }
       break;
   }
@@ -1348,9 +1358,9 @@
   params->service_worker_version_id = version_id_;
   params->scope = scope_;
   params->script_url = script_url_;
+  params->is_installed = IsInstalled(status_);
   params->pause_after_download = pause_after_download_;
 
-  DCHECK(!pause_after_download_ || !IsInstalled(status_));
   embedded_worker_->Start(
       std::move(params),
       base::Bind(&ServiceWorkerVersion::OnStartSentAndScriptEvaluated,
@@ -1522,6 +1532,7 @@
     ServiceWorkerMetrics::EventType purpose,
     Status prestart_status,
     int trace_id,
+    bool is_browser_startup_complete,
     ServiceWorkerStatusCode status) {
   if (trace_id != kInvalidTraceId) {
     TRACE_EVENT_ASYNC_END1("ServiceWorker", "ServiceWorkerVersion::StartWorker",
@@ -1539,8 +1550,10 @@
 
   if (status == SERVICE_WORKER_OK && !start_time.is_null() &&
       !skip_recording_startup_time_) {
-    ServiceWorkerMetrics::RecordStartWorkerTime(GetTickDuration(start_time),
-                                                IsInstalled(prestart_status));
+    ServiceWorkerMetrics::RecordStartWorkerTime(
+        GetTickDuration(start_time), IsInstalled(prestart_status),
+        ServiceWorkerMetrics::GetStartSituation(
+            is_browser_startup_complete, embedded_worker_->is_new_process()));
   }
 
   if (status != SERVICE_WORKER_ERROR_TIMEOUT)

diff --git a/content/browser/service_worker/service_worker_version.h b/content/browser/service_worker/service_worker_version.h
index 1e83e3ed..b951750 100644
--- a/content/browser/service_worker/service_worker_version.h
+++ b/content/browser/service_worker/service_worker_version.h

@@ -544,6 +544,7 @@
   void DidEnsureLiveRegistrationForStartWorker(
       ServiceWorkerMetrics::EventType purpose,
       Status prestart_status,
+      bool is_browser_startup_complete,
       const StatusCallback& callback,
       ServiceWorkerStatusCode status,
       const scoped_refptr<ServiceWorkerRegistration>& registration);
@@ -577,6 +578,7 @@
   void RecordStartWorkerResult(ServiceWorkerMetrics::EventType purpose,
                                Status prestart_status,
                                int trace_id,
+                               bool is_browser_startup_complete,
                                ServiceWorkerStatusCode status);
 
   bool MaybeTimeOutRequest(const RequestInfo& info);

diff --git a/content/browser/zygote_host/zygote_host_impl_linux.cc b/content/browser/zygote_host/zygote_host_impl_linux.cc
index 517c102..e798f96 100644
--- a/content/browser/zygote_host/zygote_host_impl_linux.cc
+++ b/content/browser/zygote_host/zygote_host_impl_linux.cc

@@ -50,7 +50,7 @@
   const bool using_namespace_sandbox = ShouldUseNamespaceSandbox();
   // A non empty sandbox_cmd means we want a SUID sandbox.
   const bool using_suid_sandbox =
-      sandbox_binary_.empty() && !using_namespace_sandbox;
+      !sandbox_binary_.empty() && !using_namespace_sandbox;
 
   // Use the SUID sandbox for adjusting OOM scores when we are using the setuid
   // sandbox. This is needed beacuse the processes are non-dumpable, so

diff --git a/content/child/background_sync/background_sync_provider.cc b/content/child/background_sync/background_sync_provider.cc
index 1b97dc87..820ebf7 100644
--- a/content/child/background_sync/background_sync_provider.cc
+++ b/content/child/background_sync/background_sync_provider.cc

@@ -138,7 +138,7 @@
       if (!options.is_null())
         result =
             mojo::ConvertTo<scoped_ptr<blink::WebSyncRegistration>>(options);
-      callbacks->onSuccess(blink::adoptWebPtr(result.release()));
+      callbacks->onSuccess(std::move(result));
       break;
     case mojom::BackgroundSyncError::NOT_FOUND:
       NOTREACHED();

diff --git a/content/child/dwrite_font_proxy/dwrite_font_proxy_init_win.cc b/content/child/dwrite_font_proxy/dwrite_font_proxy_init_win.cc
index 8aed718a..58d1055 100644
--- a/content/child/dwrite_font_proxy/dwrite_font_proxy_init_win.cc
+++ b/content/child/dwrite_font_proxy/dwrite_font_proxy_init_win.cc

@@ -14,7 +14,6 @@
 #include "content/child/dwrite_font_proxy/dwrite_font_proxy_win.h"
 #include "content/child/font_warmup_win.h"
 #include "skia/ext/fontmgr_default_win.h"
-#include "skia/ext/refptr.h"
 #include "third_party/WebKit/public/web/win/WebFontRendering.h"
 #include "third_party/skia/include/ports/SkFontMgr.h"
 #include "third_party/skia/include/ports/SkTypeface_win.h"
@@ -72,7 +71,7 @@
         &g_font_collection, factory.Get(), g_sender_override);
   }
 
-  skia::RefPtr<SkFontMgr> skia_font_manager = skia::AdoptRef(
+  sk_sp<SkFontMgr> skia_font_manager(
       SkFontMgr_New_DirectWrite(factory.Get(), g_font_collection.Get()));
   blink::WebFontRendering::setSkiaFontManager(skia_font_manager.get());
 

diff --git a/content/child/notifications/notification_data_conversions.cc b/content/child/notifications/notification_data_conversions.cc
index 23763043..be49a7a 100644
--- a/content/child/notifications/notification_data_conversions.cc
+++ b/content/child/notifications/notification_data_conversions.cc

@@ -51,11 +51,24 @@
   platform_data.data.assign(web_data.data.begin(), web_data.data.end());
   platform_data.actions.resize(web_data.actions.size());
   for (size_t i = 0; i < web_data.actions.size(); ++i) {
+    switch (web_data.actions[i].type) {
+      case blink::WebNotificationAction::Button:
+        platform_data.actions[i].type =
+            PLATFORM_NOTIFICATION_ACTION_TYPE_BUTTON;
+        break;
+      case blink::WebNotificationAction::Text:
+        platform_data.actions[i].type = PLATFORM_NOTIFICATION_ACTION_TYPE_TEXT;
+        break;
+      default:
+        NOTREACHED() << "Unknown notification action type: "
+                     << web_data.actions[i].type;
+    }
     platform_data.actions[i].action =
         base::UTF16ToUTF8(base::StringPiece16(web_data.actions[i].action));
     platform_data.actions[i].title = web_data.actions[i].title;
     platform_data.actions[i].icon =
         blink::WebStringToGURL(web_data.actions[i].icon.string());
+    platform_data.actions[i].placeholder = web_data.actions[i].placeholder;
   }
 
   return platform_data;
@@ -93,10 +106,22 @@
       platform_data.actions.size());
   web_data.actions.swap(resized);
   for (size_t i = 0; i < platform_data.actions.size(); ++i) {
+    switch (platform_data.actions[i].type) {
+      case PLATFORM_NOTIFICATION_ACTION_TYPE_BUTTON:
+        web_data.actions[i].type = blink::WebNotificationAction::Button;
+        break;
+      case PLATFORM_NOTIFICATION_ACTION_TYPE_TEXT:
+        web_data.actions[i].type = blink::WebNotificationAction::Text;
+        break;
+      default:
+        NOTREACHED() << "Unknown platform data type: "
+                     << platform_data.actions[i].type;
+    }
     web_data.actions[i].action =
         blink::WebString::fromUTF8(platform_data.actions[i].action);
     web_data.actions[i].title = platform_data.actions[i].title;
     web_data.actions[i].icon = blink::WebURL(platform_data.actions[i].icon);
+    web_data.actions[i].placeholder = platform_data.actions[i].placeholder;
   }
 
   return web_data;

diff --git a/content/child/notifications/notification_data_conversions_unittest.cc b/content/child/notifications/notification_data_conversions_unittest.cc
index 24642f2..01daee1 100644
--- a/content/child/notifications/notification_data_conversions_unittest.cc
+++ b/content/child/notifications/notification_data_conversions_unittest.cc

@@ -30,6 +30,7 @@
 const char kAction1Name[] = "btn1";
 const char kAction1Title[] = "Button 1";
 const char kAction1IconUrl[] = "https://example.com/action_icon_1.png";
+const char kAction1Placeholder[] = "Run into the... friendliness pellets.";
 const char kAction2Name[] = "btn2";
 const char kAction2Title[] = "Button 2";
 const char kAction2IconUrl[] = "https://example.com/action_icon_2.png";
@@ -54,12 +55,17 @@
 
   web_data.actions =
       blink::WebVector<blink::WebNotificationAction>(static_cast<size_t>(2));
+  web_data.actions[0].type = blink::WebNotificationAction::Button;
   web_data.actions[0].action = blink::WebString::fromUTF8(kAction1Name);
   web_data.actions[0].title = blink::WebString::fromUTF8(kAction1Title);
   web_data.actions[0].icon = blink::WebURL(GURL(kAction1IconUrl));
+  web_data.actions[0].placeholder =
+      blink::WebString::fromUTF8(kAction1Placeholder);
+  web_data.actions[1].type = blink::WebNotificationAction::Text;
   web_data.actions[1].action = blink::WebString::fromUTF8(kAction2Name);
   web_data.actions[1].title = blink::WebString::fromUTF8(kAction2Title);
   web_data.actions[1].icon = blink::WebURL(GURL(kAction2IconUrl));
+  web_data.actions[1].placeholder = blink::WebString();
 
   PlatformNotificationData platform_data = ToPlatformNotificationData(web_data);
   EXPECT_EQ(base::ASCIIToUTF16(kNotificationTitle), platform_data.title);
@@ -82,12 +88,20 @@
   for (size_t i = 0; i < web_data.data.size(); ++i)
     EXPECT_EQ(web_data.data[i], platform_data.data[i]);
   ASSERT_EQ(web_data.actions.size(), platform_data.actions.size());
+  EXPECT_EQ(PLATFORM_NOTIFICATION_ACTION_TYPE_BUTTON,
+            platform_data.actions[0].type);
   EXPECT_EQ(kAction1Name, platform_data.actions[0].action);
   EXPECT_EQ(base::ASCIIToUTF16(kAction1Title), platform_data.actions[0].title);
   EXPECT_EQ(kAction1IconUrl, platform_data.actions[0].icon.spec());
+  EXPECT_EQ(base::ASCIIToUTF16(kAction1Placeholder),
+            platform_data.actions[0].placeholder.string());
+  EXPECT_FALSE(platform_data.actions[0].placeholder.is_null());
+  EXPECT_EQ(PLATFORM_NOTIFICATION_ACTION_TYPE_TEXT,
+            platform_data.actions[1].type);
   EXPECT_EQ(kAction2Name, platform_data.actions[1].action);
   EXPECT_EQ(base::ASCIIToUTF16(kAction2Title), platform_data.actions[1].title);
   EXPECT_EQ(kAction2IconUrl, platform_data.actions[1].icon.spec());
+  EXPECT_TRUE(platform_data.actions[1].placeholder.is_null());
 }
 
 TEST(NotificationDataConversionsTest, ToWebNotificationData) {
@@ -113,12 +127,17 @@
   platform_data.require_interaction = true;
   platform_data.data = developer_data;
   platform_data.actions.resize(2);
+  platform_data.actions[0].type = PLATFORM_NOTIFICATION_ACTION_TYPE_BUTTON;
   platform_data.actions[0].action = kAction1Name;
   platform_data.actions[0].title = base::ASCIIToUTF16(kAction1Title);
   platform_data.actions[0].icon = GURL(kAction1IconUrl);
+  platform_data.actions[0].placeholder =
+      base::NullableString16(base::ASCIIToUTF16(kAction1Placeholder), false);
+  platform_data.actions[1].type = PLATFORM_NOTIFICATION_ACTION_TYPE_TEXT;
   platform_data.actions[1].action = kAction2Name;
   platform_data.actions[1].title = base::ASCIIToUTF16(kAction2Title);
   platform_data.actions[1].icon = GURL(kAction2IconUrl);
+  platform_data.actions[1].placeholder = base::NullableString16();
 
   blink::WebNotificationData web_data = ToWebNotificationData(platform_data);
   EXPECT_EQ(kNotificationTitle, web_data.title);
@@ -144,12 +163,16 @@
     EXPECT_EQ(developer_data[i], web_data.data[i]);
 
   ASSERT_EQ(platform_data.actions.size(), web_data.actions.size());
+  EXPECT_EQ(blink::WebNotificationAction::Button, web_data.actions[0].type);
   EXPECT_EQ(kAction1Name, web_data.actions[0].action);
   EXPECT_EQ(kAction1Title, web_data.actions[0].title);
   EXPECT_EQ(kAction1IconUrl, web_data.actions[0].icon.string());
+  EXPECT_EQ(kAction1Placeholder, web_data.actions[0].placeholder);
+  EXPECT_EQ(blink::WebNotificationAction::Text, web_data.actions[1].type);
   EXPECT_EQ(kAction2Name, web_data.actions[1].action);
   EXPECT_EQ(kAction2Title, web_data.actions[1].title);
   EXPECT_EQ(kAction2IconUrl, web_data.actions[1].icon.string());
+  EXPECT_TRUE(web_data.actions[1].placeholder.isNull());
 }
 
 TEST(NotificationDataConversionsTest, NotificationDataDirectionality) {

diff --git a/content/child/permissions/permission_dispatcher.cc b/content/child/permissions/permission_dispatcher.cc
index ffc0d82c..4b1e305 100644
--- a/content/child/permissions/permission_dispatcher.cc
+++ b/content/child/permissions/permission_dispatcher.cc

@@ -223,7 +223,7 @@
 void PermissionDispatcher::RunPermissionsCallbackOnWorkerThread(
     scoped_ptr<blink::WebPermissionsCallback> callback,
     scoped_ptr<blink::WebVector<blink::WebPermissionStatus>> statuses) {
-  callback->onSuccess(blink::adoptWebPtr(statuses.release()));
+  callback->onSuccess(std::move(statuses));
 }
 
 blink::mojom::PermissionService*
@@ -366,7 +366,7 @@
     return;
   }
 
-  callback->onSuccess(blink::adoptWebPtr(statuses.release()));
+  callback->onSuccess(std::move(statuses));
 }
 
 void PermissionDispatcher::OnPermissionChanged(blink::WebPermissionType type,

diff --git a/content/child/push_messaging/push_provider.cc b/content/child/push_messaging/push_provider.cc
index a9e79f5..2062f8c 100644
--- a/content/child/push_messaging/push_provider.cc
+++ b/content/child/push_messaging/push_provider.cc

@@ -5,6 +5,7 @@
 #include "content/child/push_messaging/push_provider.h"
 
 #include "base/lazy_instance.h"
+#include "base/memory/ptr_util.h"
 #include "base/memory/scoped_ptr.h"
 #include "base/stl_util.h"
 #include "base/threading/thread_local.h"
@@ -161,8 +162,8 @@
   if (!callbacks)
     return;
 
-  callbacks->onSuccess(blink::adoptWebPtr(
-      new blink::WebPushSubscription(endpoint, p256dh, auth)));
+  callbacks->onSuccess(
+      base::WrapUnique(new blink::WebPushSubscription(endpoint, p256dh, auth)));
 
   subscription_callbacks_.Remove(request_id);
 }
@@ -221,8 +222,8 @@
   if (!callbacks)
     return;
 
-  callbacks->onSuccess(blink::adoptWebPtr(
-      new blink::WebPushSubscription(endpoint, p256dh, auth)));
+  callbacks->onSuccess(
+      base::WrapUnique(new blink::WebPushSubscription(endpoint, p256dh, auth)));
 
   subscription_callbacks_.Remove(request_id);
 }

diff --git a/content/child/service_worker/service_worker_dispatcher.cc b/content/child/service_worker/service_worker_dispatcher.cc
index 72ba685..57d3ce1 100644
--- a/content/child/service_worker/service_worker_dispatcher.cc
+++ b/content/child/service_worker/service_worker_dispatcher.cc

@@ -481,14 +481,14 @@
       ServiceWorkerVersionAttributes attr(attrs[i]);
 
       // WebServiceWorkerGetRegistrationsCallbacks cannot receive an array of
-      // WebPassOwnPtr<WebServiceWorkerRegistration::Handle>, so create leaky
+      // std::unique_ptr<WebServiceWorkerRegistration::Handle>, so create leaky
       // handles instead.
       (*registrations)[i] = WebServiceWorkerRegistrationImpl::CreateLeakyHandle(
           GetOrAdoptRegistration(info, attr));
     }
   }
 
-  callbacks->onSuccess(blink::adoptWebPtr(registrations.release()));
+  callbacks->onSuccess(std::move(registrations));
   pending_get_registrations_callbacks_.Remove(request_id);
 }
 

diff --git a/content/child/service_worker/service_worker_dispatcher_unittest.cc b/content/child/service_worker/service_worker_dispatcher_unittest.cc
index 6d6f939..8149885 100644
--- a/content/child/service_worker/service_worker_dispatcher_unittest.cc
+++ b/content/child/service_worker/service_worker_dispatcher_unittest.cc

@@ -125,16 +125,15 @@
     dispatcher_->RemoveProviderClient(provider_id_);
   }
 
-  void setController(
-      blink::WebPassOwnPtr<blink::WebServiceWorker::Handle> handle,
-      bool shouldNotifyControllerChange) override {
+  void setController(std::unique_ptr<blink::WebServiceWorker::Handle> handle,
+                     bool shouldNotifyControllerChange) override {
     // WebPassOwnPtr cannot be owned in Chromium, so drop the handle here.
     // The destruction releases ServiceWorkerHandleReference.
     is_set_controlled_called_ = true;
   }
 
   void dispatchMessageEvent(
-      blink::WebPassOwnPtr<blink::WebServiceWorker::Handle> handle,
+      std::unique_ptr<blink::WebServiceWorker::Handle> handle,
       const blink::WebString& message,
       const blink::WebMessagePortChannelArray& channels) override {
     // WebPassOwnPtr cannot be owned in Chromium, so drop the handle here.

diff --git a/content/child/service_worker/web_service_worker_impl.cc b/content/child/service_worker/web_service_worker_impl.cc
index 397f945..5441dc3 100644
--- a/content/child/service_worker/web_service_worker_impl.cc
+++ b/content/child/service_worker/web_service_worker_impl.cc

@@ -7,6 +7,7 @@
 #include <utility>
 
 #include "base/macros.h"
+#include "base/memory/ptr_util.h"
 #include "content/child/service_worker/service_worker_dispatcher.h"
 #include "content/child/service_worker/service_worker_handle_reference.h"
 #include "content/child/service_worker/web_service_worker_provider_impl.h"
@@ -138,12 +139,12 @@
 }
 
 // static
-blink::WebPassOwnPtr<blink::WebServiceWorker::Handle>
+std::unique_ptr<blink::WebServiceWorker::Handle>
 WebServiceWorkerImpl::CreateHandle(
     const scoped_refptr<WebServiceWorkerImpl>& worker) {
   if (!worker)
     return nullptr;
-  return blink::adoptWebPtr(new HandleImpl(worker));
+  return base::WrapUnique(new HandleImpl(worker));
 }
 
 WebServiceWorkerImpl::~WebServiceWorkerImpl() {

diff --git a/content/child/service_worker/web_service_worker_impl.h b/content/child/service_worker/web_service_worker_impl.h
index 48a3237..b5ba505 100644
--- a/content/child/service_worker/web_service_worker_impl.h
+++ b/content/child/service_worker/web_service_worker_impl.h

@@ -5,6 +5,7 @@
 #ifndef CONTENT_CHILD_SERVICE_WORKER_WEB_SERVICE_WORKER_IMPL_H_
 #define CONTENT_CHILD_SERVICE_WORKER_WEB_SERVICE_WORKER_IMPL_H_
 
+#include <memory>
 #include <vector>
 
 #include "base/compiler_specific.h"
@@ -14,7 +15,6 @@
 #include "base/strings/string16.h"
 #include "content/common/content_export.h"
 #include "third_party/WebKit/public/platform/WebMessagePortChannel.h"
-#include "third_party/WebKit/public/platform/WebPassOwnPtr.h"
 #include "third_party/WebKit/public/platform/modules/serviceworker/WebServiceWorker.h"
 #include "third_party/WebKit/public/web/WebFrame.h"
 
@@ -57,7 +57,7 @@
 
   // Creates WebServiceWorker::Handle object that owns a reference to the given
   // WebServiceWorkerImpl object.
-  static blink::WebPassOwnPtr<blink::WebServiceWorker::Handle> CreateHandle(
+  static std::unique_ptr<blink::WebServiceWorker::Handle> CreateHandle(
       const scoped_refptr<WebServiceWorkerImpl>& worker);
 
  private:

diff --git a/content/child/service_worker/web_service_worker_registration_impl.cc b/content/child/service_worker/web_service_worker_registration_impl.cc
index 1897c5b..41d4ef6 100644
--- a/content/child/service_worker/web_service_worker_registration_impl.cc
+++ b/content/child/service_worker/web_service_worker_registration_impl.cc

@@ -7,6 +7,7 @@
 #include <utility>
 
 #include "base/macros.h"
+#include "base/memory/ptr_util.h"
 #include "content/child/service_worker/service_worker_dispatcher.h"
 #include "content/child/service_worker/service_worker_registration_handle_reference.h"
 #include "content/child/service_worker/web_service_worker_impl.h"
@@ -149,12 +150,12 @@
 }
 
 // static
-blink::WebPassOwnPtr<blink::WebServiceWorkerRegistration::Handle>
+std::unique_ptr<blink::WebServiceWorkerRegistration::Handle>
 WebServiceWorkerRegistrationImpl::CreateHandle(
     const scoped_refptr<WebServiceWorkerRegistrationImpl>& registration) {
   if (!registration)
     return nullptr;
-  return blink::adoptWebPtr(new HandleImpl(registration));
+  return base::WrapUnique(new HandleImpl(registration));
 }
 
 blink::WebServiceWorkerRegistration::Handle*

diff --git a/content/child/service_worker/web_service_worker_registration_impl.h b/content/child/service_worker/web_service_worker_registration_impl.h
index 19229cc..2c8d3c9 100644
--- a/content/child/service_worker/web_service_worker_registration_impl.h
+++ b/content/child/service_worker/web_service_worker_registration_impl.h

@@ -63,7 +63,7 @@
 
   // Creates WebServiceWorkerRegistrationHandle object that owns a reference to
   // the given WebServiceWorkerRegistrationImpl object.
-  static blink::WebPassOwnPtr<WebServiceWorkerRegistrationHandle> CreateHandle(
+  static std::unique_ptr<WebServiceWorkerRegistrationHandle> CreateHandle(
       const scoped_refptr<WebServiceWorkerRegistrationImpl>& registration);
 
   // Same with CreateHandle(), but returns a raw pointer to the handle w/ its

diff --git a/content/common/BUILD.gn b/content/common/BUILD.gn
index bfe0ba7ba..b0fee26f 100644
--- a/content/common/BUILD.gn
+++ b/content/common/BUILD.gn

@@ -178,6 +178,7 @@
     "//ipc/mojo",
     "//media",
     "//media:shared_memory_support",
+    "//media/gpu/ipc/client",
     "//media/gpu/ipc/common",
     "//media/midi",
     "//mojo/common:common_base",

diff --git a/content/common/cc_messages.cc b/content/common/cc_messages.cc
index b6bb66c..f5c688eb 100644
--- a/content/common/cc_messages.cc
+++ b/content/common/cc_messages.cc

@@ -223,8 +223,7 @@
                                                      const param_type& p) {
   SkImageFilter* filter = p.get();
   if (filter) {
-    skia::RefPtr<SkData> data =
-        skia::AdoptRef(SkValidatingSerializeFlattenable(filter));
+    sk_sp<SkData> data(SkValidatingSerializeFlattenable(filter));
     m->WriteData(static_cast<const char*>(data->data()), data->size());
   } else {
     m->WriteData(0, 0);

diff --git a/content/common/gpu/client/grcontext_for_gles2_interface.cc b/content/common/gpu/client/grcontext_for_gles2_interface.cc
index 8805a4a..cebdfd77 100644
--- a/content/common/gpu/client/grcontext_for_gles2_interface.cc
+++ b/content/common/gpu/client/grcontext_for_gles2_interface.cc

@@ -22,8 +22,8 @@
     gpu::gles2::GLES2Interface* gl) {
   sk_sp<GrGLInterface> interface(
       skia_bindings::CreateGLES2InterfaceBindings(gl));
-  gr_context_ = skia::AdoptRef(
-      GrContext::Create(kOpenGL_GrBackend,
+  gr_context_ =
+      sk_sp<GrContext>(GrContext::Create(kOpenGL_GrBackend,
                         // GrContext takes ownership of |interface|.
                         reinterpret_cast<GrBackendContext>(interface.get())));
   if (gr_context_) {

diff --git a/content/common/gpu/client/grcontext_for_gles2_interface.h b/content/common/gpu/client/grcontext_for_gles2_interface.h
index aa8d2a56..354092a9 100644
--- a/content/common/gpu/client/grcontext_for_gles2_interface.h
+++ b/content/common/gpu/client/grcontext_for_gles2_interface.h

@@ -6,7 +6,7 @@
 #define CONTENT_COMMON_GPU_CLIENT_GRCONTEXT_FOR_GLES2_INTERFACE_H_
 
 #include "base/macros.h"
-#include "skia/ext/refptr.h"
+#include "third_party/skia/include/core/SkRefCnt.h"
 
 class GrContext;
 
@@ -32,7 +32,7 @@
   void FreeGpuResources();
 
  private:
-  skia::RefPtr<class GrContext> gr_context_;
+  sk_sp<class GrContext> gr_context_;
 
   DISALLOW_COPY_AND_ASSIGN(GrContextForGLES2Interface);
 };

diff --git a/content/common/gpu/media/android_video_decode_accelerator.cc b/content/common/gpu/media/android_video_decode_accelerator.cc
index e43ae7c30..efa1b84d 100644
--- a/content/common/gpu/media/android_video_decode_accelerator.cc
+++ b/content/common/gpu/media/android_video_decode_accelerator.cc

@@ -15,6 +15,7 @@
 #include "base/logging.h"
 #include "base/message_loop/message_loop.h"
 #include "base/metrics/histogram.h"
+#include "base/task_runner_util.h"
 #include "base/trace_event/trace_event.h"
 #include "content/common/gpu/gpu_channel.h"
 #include "content/common/gpu/media/android_copying_backing_strategy.h"
@@ -177,11 +178,27 @@
 // time out or keep polling forever in some common cases.
 class AVDATimerManager {
  public:
+  // Make sure that the construction thread is started for |avda_instance|.
+  void StartThread(AndroidVideoDecodeAccelerator* avda_instance) {
+    if (thread_avda_instances_.empty())
+      construction_thread_.Start();
+
+    thread_avda_instances_.insert(avda_instance);
+  }
+
+  // |avda_instance| will no longer need the construction thread.  Stop the
+  // thread if this is the last instance.
+  void StopThread(AndroidVideoDecodeAccelerator* avda_instance) {
+    thread_avda_instances_.erase(avda_instance);
+    if (thread_avda_instances_.empty())
+      construction_thread_.Stop();
+  }
+
   // Request periodic callback of |avda_instance|->DoIOTask(). Does nothing if
   // the instance is already registered and the timer started. The first request
   // will start the repeating timer on an interval of DecodePollDelay().
   void StartTimer(AndroidVideoDecodeAccelerator* avda_instance) {
-    avda_instances_.insert(avda_instance);
+    timer_avda_instances_.insert(avda_instance);
 
     // If the timer is running, StopTimer() might have been called earlier, if
     // so remove the instance from the pending erasures.
@@ -204,15 +221,21 @@
       return;
     }
 
-    avda_instances_.erase(avda_instance);
-    if (avda_instances_.empty())
+    timer_avda_instances_.erase(avda_instance);
+    if (timer_avda_instances_.empty())
       io_timer_.Stop();
   }
 
+  // Eventually, we should run the timer on this thread.  For now, we just keep
+  // it as a convenience for construction.
+  scoped_refptr<base::SingleThreadTaskRunner> ConstructionTaskRunner() {
+    return construction_thread_.task_runner();
+  }
+
  private:
   friend struct base::DefaultLazyInstanceTraits<AVDATimerManager>;
 
-  AVDATimerManager() {}
+  AVDATimerManager() : construction_thread_("AVDAThread") {}
   ~AVDATimerManager() { NOTREACHED(); }
 
   void RunTimer() {
@@ -221,7 +244,7 @@
       // themselves from the list during this operation; those removals will be
       // deferred until after all iterations are complete.
       base::AutoReset<bool> scoper(&timer_running_, true);
-      for (auto* avda : avda_instances_)
+      for (auto* avda : timer_avda_instances_)
         avda->DoIOTask(false);
     }
 
@@ -234,7 +257,11 @@
     // takes too long for the combined timer.
   }
 
-  std::set<AndroidVideoDecodeAccelerator*> avda_instances_;
+  // All AVDA instances that would like us to poll DoIOTask.
+  std::set<AndroidVideoDecodeAccelerator*> timer_avda_instances_;
+
+  // All AVDA instances that might like to use the construction thread.
+  std::set<AndroidVideoDecodeAccelerator*> thread_avda_instances_;
 
   // Since we can't delete while iterating when using a set, defer erasure until
   // after iteration complete.
@@ -244,21 +271,25 @@
   // Repeating timer responsible for draining pending IO to the codecs.
   base::RepeatingTimer io_timer_;
 
+  base::Thread construction_thread_;
+
   DISALLOW_COPY_AND_ASSIGN(AVDATimerManager);
 };
 
 static base::LazyInstance<AVDATimerManager>::Leaky g_avda_timer =
     LAZY_INSTANCE_INITIALIZER;
 
+AndroidVideoDecodeAccelerator::CodecConfig::CodecConfig() {}
+
+AndroidVideoDecodeAccelerator::CodecConfig::~CodecConfig() {}
+
 AndroidVideoDecodeAccelerator::AndroidVideoDecodeAccelerator(
     const MakeGLContextCurrentCallback& make_context_current_cb,
     const GetGLES2DecoderCallback& get_gles2_decoder_cb)
     : client_(NULL),
       make_context_current_cb_(make_context_current_cb),
       get_gles2_decoder_cb_(get_gles2_decoder_cb),
-      codec_(media::kCodecH264),
       is_encrypted_(false),
-      needs_protected_surface_(false),
       state_(NO_ERROR),
       picturebuffers_requested_(false),
       media_drm_bridge_cdm_context_(nullptr),
@@ -266,11 +297,13 @@
       pending_input_buf_index_(-1),
       error_sequence_token_(0),
       defer_errors_(false),
+      deferred_initialization_pending_(false),
       weak_this_factory_(this) {}
 
 AndroidVideoDecodeAccelerator::~AndroidVideoDecodeAccelerator() {
   DCHECK(thread_checker_.CalledOnValidThread());
   g_avda_timer.Pointer()->StopTimer(this);
+  g_avda_timer.Pointer()->StopThread(this);
 
 #if defined(ENABLE_MOJO_MEDIA_IN_GPU_PROCESS)
   if (!media_drm_bridge_cdm_context_)
@@ -296,24 +329,34 @@
 
   DCHECK(client);
   client_ = client;
-  codec_ = VideoCodecProfileToVideoCodec(config.profile);
+  codec_config_ = new CodecConfig();
+  codec_config_->codec_ = VideoCodecProfileToVideoCodec(config.profile);
   is_encrypted_ = config.is_encrypted;
 
-  bool profile_supported = codec_ == media::kCodecVP8 ||
-                           codec_ == media::kCodecVP9 ||
-                           codec_ == media::kCodecH264;
+  bool profile_supported = codec_config_->codec_ == media::kCodecVP8 ||
+                           codec_config_->codec_ == media::kCodecVP9 ||
+                           codec_config_->codec_ == media::kCodecH264;
+
+  // We signalled that we support deferred initialization, so see if the client
+  // does also.
+  deferred_initialization_pending_ = config.is_deferred_initialization_allowed;
 
   if (!profile_supported) {
     LOG(ERROR) << "Unsupported profile: " << config.profile;
     return false;
   }
 
+  // For encrypted streams we postpone configuration until MediaCrypto is
+  // available.
+  DCHECK(!is_encrypted_ || deferred_initialization_pending_);
+
   // Only use MediaCodec for VP8/9 if it's likely backed by hardware
   // or if the stream is encrypted.
-  if (codec_ == media::kCodecVP8 || codec_ == media::kCodecVP9) {
+  if (codec_config_->codec_ == media::kCodecVP8 ||
+      codec_config_->codec_ == media::kCodecVP9) {
     DCHECK(is_encrypted_ ||
            !media::VideoCodecBridge::IsKnownUnaccelerated(
-               codec_, media::MEDIA_CODEC_DECODER));
+               codec_config_->codec_, media::MEDIA_CODEC_DECODER));
   }
 
   auto gles_decoder = get_gles2_decoder_cb_.Run();
@@ -341,8 +384,8 @@
     return false;
   }
 
-  surface_ = strategy_->Initialize(config.surface_id);
-  if (surface_.IsEmpty()) {
+  codec_config_->surface_ = strategy_->Initialize(config.surface_id);
+  if (codec_config_->surface_.IsEmpty()) {
     LOG(ERROR) << "Failed to initialize the backing strategy. The returned "
                   "Java surface is empty.";
     return false;
@@ -356,12 +399,19 @@
         new OnFrameAvailableHandler(this, surface_texture);
   }
 
-  // For encrypted streams we postpone configuration until MediaCrypto is
-  // available.
+  // If we are encrypted, then we aren't able to create the codec yet.
   if (is_encrypted_)
     return true;
 
-  return ConfigureMediaCodec();
+  if (deferred_initialization_pending_) {
+    g_avda_timer.Pointer()->StartThread(this);
+    ConfigureMediaCodecAsynchronously();
+    return true;
+  }
+
+  // If the client doesn't support deferred initialization (WebRTC), then we
+  // should complete it now and return a meaningful result.
+  return ConfigureMediaCodecSynchronously();
 }
 
 void AndroidVideoDecodeAccelerator::SetCdm(int cdm_id) {
@@ -372,7 +422,7 @@
 
   if (media_drm_bridge_cdm_context_) {
     NOTREACHED() << "We do not support resetting CDM.";
-    NotifyCdmAttached(false);
+    NotifyInitializationComplete(false);
     return;
   }
 
@@ -403,12 +453,12 @@
       base::Bind(&AndroidVideoDecodeAccelerator::OnMediaCryptoReady,
                  weak_this_factory_.GetWeakPtr())));
 
-  // Postpone NotifyCdmAttached() call till we create the MediaCodec after
-  // OnMediaCryptoReady().
+// Postpone NotifyInitializationComplete() call till we create the MediaCodec
+// after OnMediaCryptoReady().
 #else
 
   NOTIMPLEMENTED();
-  NotifyCdmAttached(false);
+  NotifyInitializationComplete(false);
 
 #endif  // !defined(ENABLE_MOJO_MEDIA_IN_GPU_PROCESS)
 }
@@ -416,7 +466,7 @@
 void AndroidVideoDecodeAccelerator::DoIOTask(bool start_timer) {
   DCHECK(thread_checker_.CalledOnValidThread());
   TRACE_EVENT0("media", "AVDA::DoIOTask");
-  if (state_ == ERROR) {
+  if (state_ == ERROR || state_ == WAITING_FOR_CODEC) {
     return;
   }
 
@@ -652,6 +702,7 @@
     state_ = was_waiting_for_eos ? NO_ERROR : ERROR;
 
     ResetCodecState();
+    // |media_codec_| might still be null.
     if (was_waiting_for_eos) {
       base::MessageLoop::current()->PostTask(
           FROM_HERE, base::Bind(&AndroidVideoDecodeAccelerator::NotifyFlushDone,
@@ -851,36 +902,101 @@
   DecodeBuffer(media::BitstreamBuffer(-1, base::SharedMemoryHandle(), 0));
 }
 
-bool AndroidVideoDecodeAccelerator::ConfigureMediaCodec() {
+void AndroidVideoDecodeAccelerator::ConfigureMediaCodecAsynchronously() {
   DCHECK(thread_checker_.CalledOnValidThread());
+
+  // It's probably okay just to return here, since the codec will be configured
+  // asynchronously.  It's unclear that any state for the new request could
+  // be different, unless somebody modifies |codec_config_| while we're already
+  // waiting for a codec.  One shouldn't do that for thread safety.
+  DCHECK_NE(state_, WAITING_FOR_CODEC);
+
+  state_ = WAITING_FOR_CODEC;
+
+  // Tell the strategy that we're changing codecs.  The codec itself could be
+  // used normally, since we don't replace it until we're back on the main
+  // thread.  However, if we're using an output surface, then the incoming codec
+  // might access that surface while the main thread is drawing.  Telling the
+  // strategy to forget the codec avoids this.
+  if (media_codec_) {
+    media_codec_.reset();
+    strategy_->CodecChanged(nullptr, output_picture_buffers_);
+  }
+
+  base::PostTaskAndReplyWithResult(
+      g_avda_timer.Pointer()->ConstructionTaskRunner().get(), FROM_HERE,
+      base::Bind(&AndroidVideoDecodeAccelerator::ConfigureMediaCodecOnAnyThread,
+                 codec_config_),
+      base::Bind(&AndroidVideoDecodeAccelerator::OnCodecConfigured,
+                 weak_this_factory_.GetWeakPtr()));
+}
+
+bool AndroidVideoDecodeAccelerator::ConfigureMediaCodecSynchronously() {
+  state_ = WAITING_FOR_CODEC;
+  scoped_ptr<media::VideoCodecBridge> media_codec =
+      ConfigureMediaCodecOnAnyThread(codec_config_);
+  OnCodecConfigured(std::move(media_codec));
+  return !!media_codec_;
+}
+
+scoped_ptr<media::VideoCodecBridge>
+AndroidVideoDecodeAccelerator::ConfigureMediaCodecOnAnyThread(
+    scoped_refptr<CodecConfig> codec_config) {
   TRACE_EVENT0("media", "AVDA::ConfigureMediaCodec");
 
-  jobject media_crypto = media_crypto_ ? media_crypto_->obj() : nullptr;
+  jobject media_crypto = codec_config->media_crypto_
+                             ? codec_config->media_crypto_->obj()
+                             : nullptr;
 
   // |needs_protected_surface_| implies encrypted stream.
-  DCHECK(!needs_protected_surface_ || media_crypto);
+  DCHECK(!codec_config->needs_protected_surface_ || media_crypto);
 
   // Pass a dummy 320x240 canvas size and let the codec signal the real size
   // when it's known from the bitstream.
-  media_codec_.reset(media::VideoCodecBridge::CreateDecoder(
-      codec_, needs_protected_surface_, gfx::Size(320, 240),
-      surface_.j_surface().obj(), media_crypto, false));
+  return scoped_ptr<media::VideoCodecBridge>(
+      media::VideoCodecBridge::CreateDecoder(
+          codec_config->codec_, codec_config->needs_protected_surface_,
+          gfx::Size(320, 240), codec_config->surface_.j_surface().obj(),
+          media_crypto, false));
+}
+
+void AndroidVideoDecodeAccelerator::OnCodecConfigured(
+    scoped_ptr<media::VideoCodecBridge> media_codec) {
+  DCHECK(thread_checker_.CalledOnValidThread());
+  DCHECK_EQ(state_, WAITING_FOR_CODEC);
+
+  media_codec_ = std::move(media_codec);
 
   // Record one instance of the codec being initialized.
   RecordFormatChangedMetric(FormatChangedValue::CodecInitialized);
 
   strategy_->CodecChanged(media_codec_.get(), output_picture_buffers_);
-  if (!media_codec_) {
-    LOG(ERROR) << "Failed to create MediaCodec instance.";
-    return false;
+
+  // If we are supposed to notify that initialization is complete, then do so
+  // now.  Otherwise, this is a reconfiguration.
+  if (deferred_initialization_pending_) {
+    NotifyInitializationComplete(!!media_codec_);
+    deferred_initialization_pending_ = false;
   }
 
+  if (!media_codec_) {
+    POST_ERROR(PLATFORM_FAILURE, "Failed to create MediaCodec.");
+    return;
+  }
+
+  state_ = NO_ERROR;
+
   ManageTimer(true);
-  return true;
 }
 
 void AndroidVideoDecodeAccelerator::ResetCodecState() {
   DCHECK(thread_checker_.CalledOnValidThread());
+
+  // If there is already a reset in flight, then that counts.  This can really
+  // only happen if somebody calls Reset.
+  if (state_ == WAITING_FOR_CODEC)
+    return;
+
   bitstream_buffers_in_decoder_.clear();
 
   if (pending_input_buf_index_ != -1) {
@@ -919,12 +1035,10 @@
     DVLOG(3) << __FUNCTION__
              << " Deleting the MediaCodec and creating a new one.";
     g_avda_timer.Pointer()->StopTimer(this);
-    media_codec_.reset();
     // Changing the codec will also notify the strategy to forget about any
     // output buffers it has currently.
     state_ = NO_ERROR;
-    if (!ConfigureMediaCodec())
-      POST_ERROR(PLATFORM_FAILURE, "Failed to create MediaCodec.");
+    ConfigureMediaCodecAsynchronously();
   }
 }
 
@@ -951,6 +1065,8 @@
 
   ResetCodecState();
 
+  // Note that |media_codec_| might not yet be ready, but we can still post
+  // this anyway.
   base::MessageLoop::current()->PostTask(
       FROM_HERE, base::Bind(&AndroidVideoDecodeAccelerator::NotifyResetDone,
                             weak_this_factory_.GetWeakPtr()));
@@ -972,6 +1088,9 @@
     on_frame_available_handler_ = nullptr;
   }
 
+  // Note that async codec construction might still be in progress.  In that
+  // case, the codec will be deleted when it completes once we invalidate all
+  // our weak refs.
   weak_this_factory_.InvalidateWeakPtrs();
   if (media_codec_) {
     g_avda_timer.Pointer()->StopTimer(this);
@@ -1048,7 +1167,7 @@
     LOG(ERROR) << "MediaCrypto is not available, can't play encrypted stream.";
     cdm_for_reference_holding_only_ = nullptr;
     media_drm_bridge_cdm_context_ = nullptr;
-    NotifyCdmAttached(false);
+    NotifyInitializationComplete(false);
     return;
   }
 
@@ -1058,12 +1177,11 @@
   // is not created yet.
   DCHECK(!media_codec_);
 
-  media_crypto_ = std::move(media_crypto);
-  needs_protected_surface_ = needs_protected_surface;
+  codec_config_->media_crypto_ = std::move(media_crypto);
+  codec_config_->needs_protected_surface_ = needs_protected_surface;
 
   // After receiving |media_crypto_| we can configure MediaCodec.
-  const bool success = ConfigureMediaCodec();
-  NotifyCdmAttached(success);
+  ConfigureMediaCodecAsynchronously();
 }
 
 void AndroidVideoDecodeAccelerator::OnKeyAdded() {
@@ -1075,8 +1193,8 @@
   DoIOTask(true);
 }
 
-void AndroidVideoDecodeAccelerator::NotifyCdmAttached(bool success) {
-  client_->NotifyCdmAttached(success);
+void AndroidVideoDecodeAccelerator::NotifyInitializationComplete(bool success) {
+  client_->NotifyInitializationComplete(success);
 }
 
 void AndroidVideoDecodeAccelerator::NotifyPictureReady(
@@ -1194,7 +1312,9 @@
     capabilities.flags = media::VideoDecodeAccelerator::Capabilities::
                              NEEDS_ALL_PICTURE_BUFFERS_TO_DECODE |
                          media::VideoDecodeAccelerator::Capabilities::
-                             SUPPORTS_EXTERNAL_OUTPUT_SURFACE;
+                             SUPPORTS_EXTERNAL_OUTPUT_SURFACE |
+                         media::VideoDecodeAccelerator::Capabilities::
+                             SUPPORTS_DEFERRED_INITIALIZATION;
   }
 
   return capabilities;

diff --git a/content/common/gpu/media/android_video_decode_accelerator.h b/content/common/gpu/media/android_video_decode_accelerator.h
index 16bb5c0f..272a6a0 100644
--- a/content/common/gpu/media/android_video_decode_accelerator.h
+++ b/content/common/gpu/media/android_video_decode_accelerator.h

@@ -42,7 +42,7 @@
     : public media::VideoDecodeAccelerator,
       public AVDAStateProvider {
  public:
-  typedef std::map<int32_t, media::PictureBuffer> OutputBufferMap;
+  using OutputBufferMap = std::map<int32_t, media::PictureBuffer>;
 
   // A BackingStrategy is responsible for making a PictureBuffer's texture
   // contain the image that a MediaCodec decoder buffer tells it to.
@@ -154,12 +154,66 @@
   enum State {
     NO_ERROR,
     ERROR,
+    // Set when we are asynchronously constructing the codec.  Will transition
+    // to NO_ERROR or ERROR depending on success.
+    WAITING_FOR_CODEC,
+    // Set when we have a codec, but it doesn't yet have a key.
     WAITING_FOR_KEY,
     WAITING_FOR_EOS,
   };
 
+  // Configuration info for MediaCodec.
+  // This is used to shuttle configuration info between threads without needing
+  // to worry about the lifetime of the AVDA instance.  All of these should not
+  // be modified while |state_| is WAITING_FOR_CODEC.
+  class CodecConfig : public base::RefCountedThreadSafe<CodecConfig> {
+   public:
+    CodecConfig();
+
+    // Codec type. Used when we configure media codec.
+    media::VideoCodec codec_ = media::kUnknownVideoCodec;
+
+    // Whether encryption scheme requires to use protected surface.
+    bool needs_protected_surface_ = false;
+
+    // The surface that MediaCodec is configured to output to. It's created by
+    // the backing strategy.
+    gfx::ScopedJavaSurface surface_;
+
+    // The MediaCrypto object is used in the MediaCodec.configure() in case of
+    // an encrypted stream.
+    media::MediaDrmBridgeCdmContext::JavaObjectPtr media_crypto_;
+
+   protected:
+    friend class base::RefCountedThreadSafe<CodecConfig>;
+    virtual ~CodecConfig();
+
+   private:
+    DISALLOW_COPY_AND_ASSIGN(CodecConfig);
+  };
+
   // Configures |media_codec_| with the given codec parameters from the client.
-  bool ConfigureMediaCodec();
+  // This configuration will (probably) not be complete before this call
+  // returns.  Multiple calls before completion will be ignored.  |state_|
+  // must be NO_ERROR or WAITING_FOR_CODEC.  Note that, once you call this,
+  // you should be careful to avoid modifying members of |codec_config_| until
+  // |state_| is no longer WAITING_FOR_CODEC.
+  void ConfigureMediaCodecAsynchronously();
+
+  // Like ConfigureMediaCodecAsynchronously, but synchronous.  Returns true if
+  // and only if |media_codec_| is non-null.  Since all configuration is done
+  // synchronously, there is no concern with modifying |codec_config_| after
+  // this returns.
+  bool ConfigureMediaCodecSynchronously();
+
+  // Instantiate a media codec using |codec_config|.
+  // This may be called on any thread.
+  static scoped_ptr<media::VideoCodecBridge> ConfigureMediaCodecOnAnyThread(
+      scoped_refptr<CodecConfig> codec_config);
+
+  // Called on the main thread to update |media_codec_| and complete codec
+  // configuration.  |media_codec| will be null if configuration failed.
+  void OnCodecConfigured(scoped_ptr<media::VideoCodecBridge> media_codec);
 
   // Sends the decoded frame specified by |codec_buffer_index| to the client.
   void SendDecodedFrameToClient(int32_t codec_buffer_index,
@@ -195,8 +249,8 @@
   // This callback is called when a new key is added to CDM.
   void OnKeyAdded();
 
-  // Notifies the client of the CDM setting result.
-  void NotifyCdmAttached(bool success);
+  // Notifies the client of the result of deferred initialization.
+  void NotifyInitializationComplete(bool success);
 
   // Notifies the client about the availability of a picture.
   void NotifyPictureReady(const media::Picture& picture);
@@ -246,15 +300,9 @@
   // Callback to get the GLES2Decoder instance.
   GetGLES2DecoderCallback get_gles2_decoder_cb_;
 
-  // Codec type. Used when we configure media codec.
-  media::VideoCodec codec_;
-
   // Whether the stream is encrypted.
   bool is_encrypted_;
 
-  // Whether encryption scheme requires to use protected surface.
-  bool needs_protected_surface_;
-
   // The current state of this class. For now, this is used only for setting
   // error state.
   State state_;
@@ -270,10 +318,6 @@
   // The low-level decoder which Android SDK provides.
   scoped_ptr<media::VideoCodecBridge> media_codec_;
 
-  // The surface that MediaCodec is configured to output to. It's created by the
-  // backing strategy.
-  gfx::ScopedJavaSurface surface_;
-
   // Set to true after requesting picture buffers to the client.
   bool picturebuffers_requested_;
 
@@ -315,9 +359,9 @@
   // registration id is used for this.
   int cdm_registration_id_;
 
-  // The MediaCrypto object is used in the MediaCodec.configure() in case of
-  // an encrypted stream.
-  media::MediaDrmBridgeCdmContext::JavaObjectPtr media_crypto_;
+  // Configuration that we use for MediaCodec.
+  // Do not update any of its members while |state_| is WAITING_FOR_CODEC.
+  scoped_refptr<CodecConfig> codec_config_;
 
   // Index of the dequeued and filled buffer that we keep trying to enqueue.
   // Such buffer appears in MEDIA_CODEC_NO_KEY processing.
@@ -330,6 +374,10 @@
   // PostError will defer sending an error if and only if this is true.
   bool defer_errors_;
 
+  // True if and only if VDA initialization is deferred, and we have not yet
+  // called NotifyInitializationComplete.
+  bool deferred_initialization_pending_;
+
   // WeakPtrFactory for posting tasks back to |this|.
   base::WeakPtrFactory<AndroidVideoDecodeAccelerator> weak_this_factory_;
 

diff --git a/content/common/gpu/media/android_video_decode_accelerator_unittest.cc b/content/common/gpu/media/android_video_decode_accelerator_unittest.cc
index d601888f..d21ad9e 100644
--- a/content/common/gpu/media/android_video_decode_accelerator_unittest.cc
+++ b/content/common/gpu/media/android_video_decode_accelerator_unittest.cc

@@ -82,9 +82,10 @@
         static_cast<AndroidVideoDecodeAccelerator*>(accelerator_.get());
     scoped_refptr<gfx::SurfaceTexture> surface_texture =
         gfx::SurfaceTexture::Create(0);
-    accelerator->surface_ = gfx::ScopedJavaSurface(surface_texture.get());
-    accelerator->codec_ = codec;
-    return accelerator->ConfigureMediaCodec();
+    accelerator->codec_config_->surface_ =
+        gfx::ScopedJavaSurface(surface_texture.get());
+    accelerator->codec_config_->codec_ = codec;
+    return accelerator->ConfigureMediaCodecSynchronously();
   }
 
  private:

diff --git a/content/common/gpu/media/gpu_video_accelerator_util.h b/content/common/gpu/media/gpu_video_accelerator_util.h
deleted file mode 100644
index e39034e1..0000000
--- a/content/common/gpu/media/gpu_video_accelerator_util.h
+++ /dev/null

@@ -1,63 +0,0 @@
-// Copyright 2015 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef CONTENT_COMMON_GPU_MEDIA_GPU_VIDEO_ACCELERATOR_UTIL_H_
-#define CONTENT_COMMON_GPU_MEDIA_GPU_VIDEO_ACCELERATOR_UTIL_H_
-
-#include <vector>
-
-#include "gpu/config/gpu_info.h"
-#include "media/video/video_decode_accelerator.h"
-#include "media/video/video_encode_accelerator.h"
-
-namespace content {
-
-class GpuVideoAcceleratorUtil {
- public:
-  // Convert decoder gpu capabilities to media capabilities.
-  static media::VideoDecodeAccelerator::Capabilities
-  ConvertGpuToMediaDecodeCapabilities(
-      const gpu::VideoDecodeAcceleratorCapabilities& gpu_capabilities);
-
-  // Convert decoder gpu profiles to media profiles.
-  static media::VideoDecodeAccelerator::SupportedProfiles
-      ConvertGpuToMediaDecodeProfiles(const
-          gpu::VideoDecodeAcceleratorSupportedProfiles& gpu_profiles);
-
-  // Convert decoder media capabilities to gpu capabilities.
-  static gpu::VideoDecodeAcceleratorCapabilities
-  ConvertMediaToGpuDecodeCapabilities(
-      const media::VideoDecodeAccelerator::Capabilities& media_capabilities);
-
-  // Convert decoder media profiles to gpu profiles.
-  static gpu::VideoDecodeAcceleratorSupportedProfiles
-      ConvertMediaToGpuDecodeProfiles(const
-          media::VideoDecodeAccelerator::SupportedProfiles& media_profiles);
-
-  // Convert encoder gpu profiles to media profiles.
-  static media::VideoEncodeAccelerator::SupportedProfiles
-      ConvertGpuToMediaEncodeProfiles(const
-          gpu::VideoEncodeAcceleratorSupportedProfiles& gpu_profiles);
-
-  // Convert encoder media profiles to gpu profiles.
-  static gpu::VideoEncodeAcceleratorSupportedProfiles
-      ConvertMediaToGpuEncodeProfiles(const
-          media::VideoEncodeAccelerator::SupportedProfiles& media_profiles);
-
-  // Insert |new_profiles| into |media_profiles|, ensuring no duplicates are
-  // inserted.
-  static void InsertUniqueDecodeProfiles(
-      const media::VideoDecodeAccelerator::SupportedProfiles& new_profiles,
-      media::VideoDecodeAccelerator::SupportedProfiles* media_profiles);
-
-  // Insert |new_profiles| into |media_profiles|, ensuring no duplicates are
-  // inserted.
-  static void InsertUniqueEncodeProfiles(
-      const media::VideoEncodeAccelerator::SupportedProfiles& new_profiles,
-      media::VideoEncodeAccelerator::SupportedProfiles* media_profiles);
-};
-
-}  // namespace content
-
-#endif  // CONTENT_COMMON_GPU_MEDIA_GPU_VIDEO_ACCELERATOR_UTIL_H_

diff --git a/content/common/gpu/media/gpu_video_decode_accelerator.cc b/content/common/gpu/media/gpu_video_decode_accelerator.cc
index cc50774..1e0914e0 100644
--- a/content/common/gpu/media/gpu_video_decode_accelerator.cc
+++ b/content/common/gpu/media/gpu_video_decode_accelerator.cc

@@ -14,10 +14,8 @@
 #include "base/stl_util.h"
 #include "base/thread_task_runner_handle.h"
 #include "build/build_config.h"
-
 #include "content/common/gpu/gpu_channel.h"
 #include "content/common/gpu/gpu_channel_manager.h"
-#include "content/common/gpu/media/gpu_video_accelerator_util.h"
 #include "content/common/gpu/media/gpu_video_decode_accelerator_factory_impl.h"
 #include "gpu/command_buffer/common/command_buffer.h"
 #include "ipc/ipc_message_macros.h"
@@ -209,10 +207,11 @@
   return handled;
 }
 
-void GpuVideoDecodeAccelerator::NotifyCdmAttached(bool success) {
-  if (!Send(new AcceleratedVideoDecoderHostMsg_CdmAttached(host_route_id_,
-                                                           success)))
-    DLOG(ERROR) << "Send(AcceleratedVideoDecoderHostMsg_CdmAttached) failed";
+void GpuVideoDecodeAccelerator::NotifyInitializationComplete(bool success) {
+  if (!Send(new AcceleratedVideoDecoderHostMsg_InitializationComplete(
+          host_route_id_, success)))
+    DLOG(ERROR)
+        << "Send(AcceleratedVideoDecoderHostMsg_InitializationComplete) failed";
 }
 
 void GpuVideoDecodeAccelerator::ProvidePictureBuffers(

diff --git a/content/common/gpu/media/gpu_video_decode_accelerator.h b/content/common/gpu/media/gpu_video_decode_accelerator.h
index 3bbef5a..bec4087c 100644
--- a/content/common/gpu/media/gpu_video_decode_accelerator.h
+++ b/content/common/gpu/media/gpu_video_decode_accelerator.h

@@ -54,7 +54,7 @@
   bool OnMessageReceived(const IPC::Message& message) override;
 
   // media::VideoDecodeAccelerator::Client implementation.
-  void NotifyCdmAttached(bool success) override;
+  void NotifyInitializationComplete(bool success) override;
   void ProvidePictureBuffers(uint32_t requested_num_of_buffers,
                              uint32_t textures_per_buffer,
                              const gfx::Size& dimensions,

diff --git a/content/common/gpu/media/gpu_video_decode_accelerator_factory_impl.cc b/content/common/gpu/media/gpu_video_decode_accelerator_factory_impl.cc
index c3cd7ee..0483148 100644
--- a/content/common/gpu/media/gpu_video_decode_accelerator_factory_impl.cc
+++ b/content/common/gpu/media/gpu_video_decode_accelerator_factory_impl.cc

@@ -2,10 +2,11 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "content/common/gpu/media/gpu_video_accelerator_util.h"
-#include "content/common/gpu/media/gpu_video_decode_accelerator.h"
 #include "content/common/gpu/media/gpu_video_decode_accelerator_factory_impl.h"
+
+#include "content/common/gpu/media/gpu_video_decode_accelerator.h"
 #include "gpu/command_buffer/service/gpu_preferences.h"
+#include "media/gpu/ipc/common/gpu_video_accelerator_util.h"
 
 #if defined(OS_WIN)
 #include "base/win/windows_version.h"
@@ -81,15 +82,15 @@
   media::VideoDecodeAccelerator::SupportedProfiles vda_profiles;
 #if defined(USE_V4L2_CODEC)
   vda_profiles = V4L2VideoDecodeAccelerator::GetSupportedProfiles();
-  GpuVideoAcceleratorUtil::InsertUniqueDecodeProfiles(
+  media::GpuVideoAcceleratorUtil::InsertUniqueDecodeProfiles(
       vda_profiles, &capabilities.supported_profiles);
   vda_profiles = V4L2SliceVideoDecodeAccelerator::GetSupportedProfiles();
-  GpuVideoAcceleratorUtil::InsertUniqueDecodeProfiles(
+  media::GpuVideoAcceleratorUtil::InsertUniqueDecodeProfiles(
       vda_profiles, &capabilities.supported_profiles);
 #endif
 #if defined(ARCH_CPU_X86_FAMILY)
   vda_profiles = VaapiVideoDecodeAccelerator::GetSupportedProfiles();
-  GpuVideoAcceleratorUtil::InsertUniqueDecodeProfiles(
+  media::GpuVideoAcceleratorUtil::InsertUniqueDecodeProfiles(
       vda_profiles, &capabilities.supported_profiles);
 #endif
 #elif defined(OS_MACOSX)
@@ -99,7 +100,7 @@
   capabilities =
       AndroidVideoDecodeAccelerator::GetCapabilities(gpu_preferences);
 #endif
-  return GpuVideoAcceleratorUtil::ConvertMediaToGpuDecodeCapabilities(
+  return media::GpuVideoAcceleratorUtil::ConvertMediaToGpuDecodeCapabilities(
       capabilities);
 }
 

diff --git a/content/common/gpu/media/gpu_video_encode_accelerator.cc b/content/common/gpu/media/gpu_video_encode_accelerator.cc
index 0e6d2205..dd16953 100644
--- a/content/common/gpu/media/gpu_video_encode_accelerator.cc
+++ b/content/common/gpu/media/gpu_video_encode_accelerator.cc

@@ -13,11 +13,11 @@
 #include "build/build_config.h"
 #include "content/common/gpu/gpu_channel.h"
 #include "content/common/gpu/gpu_channel_manager.h"
-#include "content/common/gpu/media/gpu_video_accelerator_util.h"
 #include "ipc/ipc_message_macros.h"
 #include "media/base/bind_to_current_loop.h"
 #include "media/base/limits.h"
 #include "media/base/video_frame.h"
+#include "media/gpu/ipc/common/gpu_video_accelerator_util.h"
 #include "media/gpu/ipc/common/media_messages.h"
 
 #if defined(OS_CHROMEOS)
@@ -181,10 +181,11 @@
       continue;
     media::VideoEncodeAccelerator::SupportedProfiles vea_profiles =
         encoder->GetSupportedProfiles();
-    GpuVideoAcceleratorUtil::InsertUniqueEncodeProfiles(
-        vea_profiles, &profiles);
+    media::GpuVideoAcceleratorUtil::InsertUniqueEncodeProfiles(vea_profiles,
+                                                               &profiles);
   }
-  return GpuVideoAcceleratorUtil::ConvertMediaToGpuEncodeProfiles(profiles);
+  return media::GpuVideoAcceleratorUtil::ConvertMediaToGpuEncodeProfiles(
+      profiles);
 }
 
 // static

diff --git a/content/common/gpu/stream_texture_android.cc b/content/common/gpu/stream_texture_android.cc
index ae135d3..15ebb53 100644
--- a/content/common/gpu/stream_texture_android.cc
+++ b/content/common/gpu/stream_texture_android.cc

@@ -42,16 +42,16 @@
 
     // TODO: Ideally a valid image id was returned to the client so that
     // it could then call glBindTexImage2D() for doing the following.
-    scoped_refptr<gl::GLImage> gl_image(
+    scoped_refptr<gpu::gles2::GLStreamTextureImage> gl_image(
         new StreamTexture(owner_stub, stream_id, texture->service_id()));
     gfx::Size size = gl_image->GetSize();
     texture_manager->SetTarget(texture, GL_TEXTURE_EXTERNAL_OES);
     texture_manager->SetLevelInfo(texture, GL_TEXTURE_EXTERNAL_OES, 0, GL_RGBA,
                                   size.width(), size.height(), 1, 0, GL_RGBA,
                                   GL_UNSIGNED_BYTE, gfx::Rect(size));
-    texture_manager->SetLevelImage(texture, GL_TEXTURE_EXTERNAL_OES, 0,
-                                   gl_image.get(),
-                                   gpu::gles2::Texture::UNBOUND);
+    texture_manager->SetLevelStreamTextureImage(
+        texture, GL_TEXTURE_EXTERNAL_OES, 0, gl_image.get(),
+        gpu::gles2::Texture::UNBOUND);
     return true;
   }
 
@@ -63,7 +63,6 @@
                              uint32_t texture_id)
     : surface_texture_(gfx::SurfaceTexture::Create(texture_id)),
       size_(0, 0),
-      has_valid_frame_(false),
       has_pending_frame_(false),
       owner_stub_(owner_stub),
       route_id_(route_id),
@@ -90,6 +89,12 @@
   }
 }
 
+// gpu::gles2::GLStreamTextureMatrix implementation
+void StreamTexture::GetTextureMatrix(float xform[16]) {
+  UpdateTexImage();
+  surface_texture_->GetTransformMatrix(xform);
+}
+
 void StreamTexture::OnWillDestroyStub() {
   owner_stub_->RemoveDestructionObserver(this);
   owner_stub_->channel()->RemoveRoute(route_id_);
@@ -142,23 +147,8 @@
 
   surface_texture_->UpdateTexImage();
 
-  has_valid_frame_ = true;
   has_pending_frame_ = false;
 
-  float mtx[16];
-  surface_texture_->GetTransformMatrix(mtx);
-
-  if (memcmp(current_matrix_, mtx, sizeof(mtx)) != 0) {
-    memcpy(current_matrix_, mtx, sizeof(mtx));
-
-    if (has_listener_) {
-      GpuStreamTextureMsg_MatrixChanged_Params params;
-      memcpy(&params.m00, mtx, sizeof(mtx));
-      owner_stub_->channel()->Send(
-          new GpuStreamTextureMsg_MatrixChanged(route_id_, params));
-    }
-  }
-
   if (scoped_make_current.get()) {
     // UpdateTexImage() implies glBindTexture().
     // The cmd decoder takes care of restoring the binding for this GLImage as
@@ -176,12 +166,6 @@
 }
 
 bool StreamTexture::CopyTexImage(unsigned target) {
-  if (target == GL_TEXTURE_2D) {
-    glTexImage2D(GL_TEXTURE_2D, 0, GL_RGBA, size_.width(), size_.height(), 0,
-                 GL_RGBA, GL_UNSIGNED_BYTE, nullptr);
-    return CopyTexSubImage(GL_TEXTURE_2D, gfx::Point(), gfx::Rect(size_));
-  }
-
   if (target != GL_TEXTURE_EXTERNAL_OES)
     return false;
 
@@ -209,8 +193,8 @@
     // By setting image state to UNBOUND instead of COPIED we ensure that
     // CopyTexImage() is called each time the surface texture is used for
     // drawing.
-    texture->SetLevelImage(GL_TEXTURE_EXTERNAL_OES, 0, this,
-                           gpu::gles2::Texture::UNBOUND);
+    texture->SetLevelStreamTextureImage(GL_TEXTURE_EXTERNAL_OES, 0, this,
+                                        gpu::gles2::Texture::UNBOUND);
   }
 
   return true;
@@ -272,94 +256,7 @@
 bool StreamTexture::CopyTexSubImage(unsigned target,
                                     const gfx::Point& offset,
                                     const gfx::Rect& rect) {
-  if (target != GL_TEXTURE_2D)
-    return false;
-
-  if (!owner_stub_ || !surface_texture_.get())
-    return true;
-
-  if (!offset.IsOrigin()) {
-    LOG(ERROR) << "Non-origin offset is not supported";
-    return false;
-  }
-
-  if (rect != gfx::Rect(size_)) {
-    LOG(ERROR) << "Sub-rectangle is not supported";
-    return false;
-  }
-
-  GLint target_texture = 0;
-  glGetIntegerv(GL_TEXTURE_BINDING_2D, &target_texture);
-  DCHECK(target_texture);
-
-  UpdateTexImage();
-
-  if (!framebuffer_) {
-    glGenFramebuffersEXT(1, &framebuffer_);
-
-    // This vertex shader introduces a y flip before applying the stream
-    // texture matrix.  This is required because the stream texture matrix
-    // Android provides is intended to  be used in a y-up coordinate system,
-    // whereas Chromium expects y-down.
-
-    // clang-format off
-    const char kVertexShader[] = STRINGIZE(
-      attribute vec2 a_position;
-      varying vec2 v_texCoord;
-      uniform mat4 u_xform;
-      void main() {
-        gl_Position = vec4(a_position.x, a_position.y, 0.0, 1.0);
-        vec2 uv_untransformed = a_position * vec2(0.5, -0.5) + vec2(0.5, 0.5);
-        v_texCoord = (u_xform * vec4(uv_untransformed, 0.0, 1.0)).xy;
-      }
-    );
-    const char kFragmentShader[] =
-      "#extension GL_OES_EGL_image_external : require\n" STRINGIZE(
-      precision mediump float;
-      uniform samplerExternalOES a_texture;
-      varying vec2 v_texCoord;
-      void main() {
-        gl_FragColor = texture2D(a_texture, v_texCoord);
-      }
-    );
-    // clang-format on
-
-    vertex_buffer_ = gfx::GLHelper::SetupQuadVertexBuffer();
-    vertex_shader_ = gfx::GLHelper::LoadShader(GL_VERTEX_SHADER, kVertexShader);
-    fragment_shader_ =
-        gfx::GLHelper::LoadShader(GL_FRAGMENT_SHADER, kFragmentShader);
-    program_ = gfx::GLHelper::SetupProgram(vertex_shader_, fragment_shader_);
-    gfx::ScopedUseProgram use_program(program_);
-    int sampler_location = glGetUniformLocation(program_, "a_texture");
-    DCHECK_NE(-1, sampler_location);
-    glUniform1i(sampler_location, 0);
-    u_xform_location_ = glGetUniformLocation(program_, "u_xform");
-    DCHECK_NE(-1, u_xform_location_);
-  }
-
-  gfx::ScopedActiveTexture active_texture(GL_TEXTURE0);
-  // UpdateTexImage() call below will bind the surface texture to
-  // TEXTURE_EXTERNAL_OES. This scoped texture binder will restore the current
-  // binding before this function returns.
-  gfx::ScopedTextureBinder texture_binder(GL_TEXTURE_EXTERNAL_OES, texture_id_);
-
-  {
-    gfx::ScopedFrameBufferBinder framebuffer_binder(framebuffer_);
-    gfx::ScopedViewport viewport(0, 0, size_.width(), size_.height());
-    glFramebufferTexture2DEXT(GL_FRAMEBUFFER, GL_COLOR_ATTACHMENT0,
-                              GL_TEXTURE_2D, target_texture, 0);
-    DCHECK_EQ(static_cast<GLenum>(GL_FRAMEBUFFER_COMPLETE),
-              glCheckFramebufferStatusEXT(GL_FRAMEBUFFER));
-    gfx::ScopedUseProgram use_program(program_);
-
-    glUniformMatrix4fv(u_xform_location_, 1, false, current_matrix_);
-    gfx::GLHelper::DrawQuad(vertex_buffer_);
-
-    // Detach the output texture from the fbo.
-    glFramebufferTexture2DEXT(GL_FRAMEBUFFER, GL_COLOR_ATTACHMENT0,
-                              GL_TEXTURE_2D, 0, 0);
-  }
-  return true;
+  return false;
 }
 
 bool StreamTexture::ScheduleOverlayPlane(gfx::AcceleratedWidget widget,

diff --git a/content/common/gpu/stream_texture_android.h b/content/common/gpu/stream_texture_android.h
index e19fc1b..8852965 100644
--- a/content/common/gpu/stream_texture_android.h
+++ b/content/common/gpu/stream_texture_android.h

@@ -10,6 +10,7 @@
 #include "base/macros.h"
 #include "base/memory/weak_ptr.h"
 #include "content/common/gpu/gpu_command_buffer_stub.h"
+#include "gpu/command_buffer/service/gl_stream_texture_image.h"
 #include "ipc/ipc_listener.h"
 #include "ui/gl/android/surface_texture.h"
 #include "ui/gl/gl_image.h"
@@ -24,7 +25,7 @@
 
 namespace content {
 
-class StreamTexture : public gl::GLImage,
+class StreamTexture : public gpu::gles2::GLStreamTextureImage,
                       public IPC::Listener,
                       public GpuCommandBufferStub::DestructionObserver {
  public:
@@ -57,6 +58,9 @@
                     uint64_t process_tracing_id,
                     const std::string& dump_name) override;
 
+  // gpu::gles2::GLStreamTextureMatrix implementation
+  void GetTextureMatrix(float xform[16]) override;
+
   // GpuCommandBufferStub::DestructionObserver implementation.
   void OnWillDestroyStub() override;
 
@@ -83,9 +87,6 @@
   // Current size of the surface texture.
   gfx::Size size_;
 
-  // Whether we ever bound a valid frame.
-  bool has_valid_frame_;
-
   // Whether a new frame is available that we should update to.
   bool has_pending_frame_;
 

diff --git a/content/common/platform_notification_messages.h b/content/common/platform_notification_messages.h
index 0ba110f..5e5d8bb 100644
--- a/content/common/platform_notification_messages.h
+++ b/content/common/platform_notification_messages.h

@@ -36,10 +36,15 @@
     content::PlatformNotificationData::Direction,
     content::PlatformNotificationData::DIRECTION_LAST)
 
+IPC_ENUM_TRAITS_MAX_VALUE(content::PlatformNotificationActionType,
+                          content::PLATFORM_NOTIFICATION_ACTION_TYPE_TEXT)
+
 IPC_STRUCT_TRAITS_BEGIN(content::PlatformNotificationAction)
+  IPC_STRUCT_TRAITS_MEMBER(type)
   IPC_STRUCT_TRAITS_MEMBER(action)
   IPC_STRUCT_TRAITS_MEMBER(title)
   IPC_STRUCT_TRAITS_MEMBER(icon)
+  IPC_STRUCT_TRAITS_MEMBER(placeholder)
 IPC_STRUCT_TRAITS_END()
 
 IPC_STRUCT_TRAITS_BEGIN(content::PlatformNotificationData)

diff --git a/content/common/sandbox_linux/bpf_renderer_policy_linux.cc b/content/common/sandbox_linux/bpf_renderer_policy_linux.cc
index a3e7438..b6a960c 100644
--- a/content/common/sandbox_linux/bpf_renderer_policy_linux.cc
+++ b/content/common/sandbox_linux/bpf_renderer_policy_linux.cc

@@ -15,6 +15,19 @@
 #include "sandbox/linux/seccomp-bpf-helpers/syscall_sets.h"
 #include "sandbox/linux/system_headers/linux_syscalls.h"
 
+#if defined(OS_CHROMEOS)
+// TODO(vignatti): replace the local definitions below with #include
+// <linux/dma-buf.h> once kernel version 4.6 becomes widely used.
+#include <linux/types.h>
+
+struct local_dma_buf_sync {
+  __u64 flags;
+};
+#define LOCAL_DMA_BUF_BASE 'b'
+#define LOCAL_DMA_BUF_IOCTL_SYNC \
+  _IOW(LOCAL_DMA_BUF_BASE, 0, struct local_dma_buf_sync)
+#endif
+
 using sandbox::SyscallSets;
 using sandbox::bpf_dsl::Allow;
 using sandbox::bpf_dsl::Arg;
@@ -30,6 +43,10 @@
   return Switch(request)
       .SANDBOX_BPF_DSL_CASES((static_cast<unsigned long>(TCGETS), FIONREAD),
                              Allow())
+#if defined(OS_CHROMEOS)
+      .SANDBOX_BPF_DSL_CASES(
+          (static_cast<unsigned long>(LOCAL_DMA_BUF_IOCTL_SYNC)), Allow())
+#endif
       .Default(sandbox::CrashSIGSYSIoctl());
 }
 

diff --git a/content/common/service_worker/embedded_worker_messages.h b/content/common/service_worker/embedded_worker_messages.h
index f065bab..86fb48c 100644
--- a/content/common/service_worker/embedded_worker_messages.h
+++ b/content/common/service_worker/embedded_worker_messages.h

@@ -34,6 +34,7 @@
   IPC_STRUCT_MEMBER(int, worker_devtools_agent_route_id)
   IPC_STRUCT_MEMBER(bool, pause_after_download)
   IPC_STRUCT_MEMBER(bool, wait_for_debugger)
+  IPC_STRUCT_MEMBER(bool, is_installed)
   IPC_STRUCT_MEMBER(content::EmbeddedWorkerSettings, settings)
 IPC_STRUCT_END()
 

diff --git a/content/common/text_input_state.cc b/content/common/text_input_state.cc
index cfe92ed..f65442a4 100644
--- a/content/common/text_input_state.cc
+++ b/content/common/text_input_state.cc

@@ -10,6 +10,7 @@
     : type(ui::TEXT_INPUT_TYPE_NONE),
       mode(ui::TEXT_INPUT_MODE_DEFAULT),
       flags(0),
-      can_compose_inline(true) {}
+      can_compose_inline(true),
+      show_ime_if_needed(false) {}
 
 }  //  namespace content

diff --git a/content/content_common.gypi b/content/content_common.gypi
index 7248199..125deed 100644
--- a/content/content_common.gypi
+++ b/content/content_common.gypi

@@ -22,6 +22,7 @@
     '../ipc/mojo/ipc_mojo.gyp:ipc_mojo',
     '../media/media.gyp:media',
     '../media/media.gyp:shared_memory_support',
+    '../media/gpu/ipc/media_ipc.gyp:media_gpu_ipc_client',
     '../media/gpu/ipc/media_ipc.gyp:media_gpu_ipc_common',
     '../media/midi/midi.gyp:midi',
     '../mojo/mojo_base.gyp:mojo_application_bindings',
@@ -350,12 +351,6 @@
       'common/gpu/client/command_buffer_metrics.h',
       'common/gpu/client/context_provider_command_buffer.cc',
       'common/gpu/client/context_provider_command_buffer.h',
-      'common/gpu/client/gpu_jpeg_decode_accelerator_host.cc',
-      'common/gpu/client/gpu_jpeg_decode_accelerator_host.h',
-      'common/gpu/client/gpu_video_decode_accelerator_host.cc',
-      'common/gpu/client/gpu_video_decode_accelerator_host.h',
-      'common/gpu/client/gpu_video_encode_accelerator_host.cc',
-      'common/gpu/client/gpu_video_encode_accelerator_host.h',
       'common/gpu/client/grcontext_for_gles2_interface.cc',
       'common/gpu/client/grcontext_for_gles2_interface.h',
       'common/gpu/client/webgraphicscontext3d_command_buffer_impl.cc',
@@ -388,8 +383,6 @@
       'common/gpu/media/fake_video_decode_accelerator.h',
       'common/gpu/media/gpu_jpeg_decode_accelerator.cc',
       'common/gpu/media/gpu_jpeg_decode_accelerator.h',
-      'common/gpu/media/gpu_video_accelerator_util.cc',
-      'common/gpu/media/gpu_video_accelerator_util.h',
       'common/gpu/media/gpu_video_decode_accelerator.cc',
       'common/gpu/media/gpu_video_decode_accelerator.h',
       'common/gpu/media/gpu_video_decode_accelerator_factory_impl.cc',

diff --git a/content/public/browser/content_browser_client.cc b/content/public/browser/content_browser_client.cc
index 3279d61dc..97579e6 100644
--- a/content/public/browser/content_browser_client.cc
+++ b/content/public/browser/content_browser_client.cc

@@ -27,6 +27,10 @@
   task_runner->PostTask(from_here, task);
 }
 
+bool ContentBrowserClient::IsBrowserStartupComplete() {
+  return true;
+}
+
 WebContentsViewDelegate* ContentBrowserClient::GetWebContentsViewDelegate(
     WebContents* web_contents) {
   return nullptr;

diff --git a/content/public/browser/content_browser_client.h b/content/public/browser/content_browser_client.h
index 8954d1da..13bebea 100644
--- a/content/public/browser/content_browser_client.h
+++ b/content/public/browser/content_browser_client.h

@@ -166,6 +166,12 @@
       const scoped_refptr<base::TaskRunner>& task_runner,
       const base::Closure& task);
 
+  // Allows the embedder to indicate whether it considers startup to be
+  // complete. May be called on any thread. This should be called on a one-off
+  // basis; if you need to poll this function constantly, use the above
+  // PostAfterStartupTask() API instead.
+  virtual bool IsBrowserStartupComplete();
+
   // If content creates the WebContentsView implementation, it will ask the
   // embedder to return an (optional) delegate to customize it. The view will
   // own the delegate.

diff --git a/content/public/common/platform_notification_data.h b/content/public/common/platform_notification_data.h
index b96cd80..d24c44f 100644
--- a/content/public/common/platform_notification_data.h
+++ b/content/public/common/platform_notification_data.h

@@ -10,6 +10,7 @@
 #include <string>
 #include <vector>
 
+#include "base/strings/nullable_string16.h"
 #include "base/strings/string16.h"
 #include "base/time/time.h"
 #include "content/common/content_export.h"
@@ -17,11 +18,20 @@
 
 namespace content {
 
-// A notification action (button); corresponds to Blink WebNotificationAction.
+enum PlatformNotificationActionType {
+  PLATFORM_NOTIFICATION_ACTION_TYPE_BUTTON = 0,
+  PLATFORM_NOTIFICATION_ACTION_TYPE_TEXT,
+};
+
+// A notification action (button or text input); corresponds to Blink
+// WebNotificationAction.
 struct CONTENT_EXPORT PlatformNotificationAction {
   PlatformNotificationAction();
   ~PlatformNotificationAction();
 
+  // Type of the action (button or text input).
+  PlatformNotificationActionType type;
+
   // Action name that the author can use to distinguish them.
   std::string action;
 
@@ -30,6 +40,10 @@
 
   // URL of the icon for the button. May be empty if no url was specified.
   GURL icon;
+
+  // Optional text to use as placeholder for text inputs. May be null if it was
+  // not specified.
+  base::NullableString16 placeholder;
 };
 
 // Structure representing the information associated with a Web Notification.

diff --git a/content/public/renderer/BUILD.gn b/content/public/renderer/BUILD.gn
index c0eaab1..75d44398 100644
--- a/content/public/renderer/BUILD.gn
+++ b/content/public/renderer/BUILD.gn

@@ -34,6 +34,7 @@
     "//content/renderer",
     "//gin",
     "//media",
+    "//media/gpu/ipc/client",
     "//net",
     "//ppapi/c",
     "//skia",

diff --git a/content/public/renderer/DEPS b/content/public/renderer/DEPS
index 0e936af..1ad8a8a 100644
--- a/content/public/renderer/DEPS
+++ b/content/public/renderer/DEPS

@@ -2,6 +2,7 @@
   "+content/common/media",
   "+content/public/child",
   "+media/base",
+  "+media/gpu/ipc/client",
   "+media/renderers",
   "+media/video",
   "+gin",

diff --git a/content/public/renderer/video_encode_accelerator.cc b/content/public/renderer/video_encode_accelerator.cc
index 88d6c5a..5efbbb7c 100644
--- a/content/public/renderer/video_encode_accelerator.cc
+++ b/content/public/renderer/video_encode_accelerator.cc

@@ -5,8 +5,8 @@
 #include "content/public/renderer/video_encode_accelerator.h"
 
 #include "base/task_runner_util.h"
-#include "content/common/gpu/client/gpu_video_encode_accelerator_host.h"
 #include "content/renderer/render_thread_impl.h"
+#include "media/gpu/ipc/client/gpu_video_encode_accelerator_host.h"
 #include "media/renderers/gpu_video_accelerator_factories.h"
 
 namespace content {

diff --git a/content/renderer/BUILD.gn b/content/renderer/BUILD.gn
index b1c9977f..790a7488 100644
--- a/content/renderer/BUILD.gn
+++ b/content/renderer/BUILD.gn

@@ -57,6 +57,8 @@
     "//jingle:jingle_glue",
     "//media",
     "//media/blink",
+    "//media/gpu/ipc/client",
+    "//media/gpu/ipc/common",
     "//media/midi",
     "//mojo/common",
     "//mojo/converters/geometry",

diff --git a/content/renderer/bluetooth/bluetooth_dispatcher.cc b/content/renderer/bluetooth/bluetooth_dispatcher.cc
index a4b7b47..37805454 100644
--- a/content/renderer/bluetooth/bluetooth_dispatcher.cc
+++ b/content/renderer/bluetooth/bluetooth_dispatcher.cc

@@ -6,14 +6,17 @@
 
 #include <stddef.h>
 
+#include <memory>
+#include <utility>
+
 #include "base/lazy_instance.h"
+#include "base/memory/ptr_util.h"
 #include "base/memory/scoped_ptr.h"
 #include "base/message_loop/message_loop.h"
 #include "base/thread_task_runner_handle.h"
 #include "content/child/thread_safe_sender.h"
 #include "content/common/bluetooth/bluetooth_messages.h"
 #include "device/bluetooth/bluetooth_uuid.h"
-#include "third_party/WebKit/public/platform/WebPassOwnPtr.h"
 #include "third_party/WebKit/public/platform/modules/bluetooth/WebBluetoothDevice.h"
 #include "third_party/WebKit/public/platform/modules/bluetooth/WebBluetoothError.h"
 #include "third_party/WebKit/public/platform/modules/bluetooth/WebBluetoothRemoteGATTCharacteristic.h"
@@ -591,7 +594,7 @@
     uuids[i] = WebString::fromUTF8(device.uuids[i].c_str());
 
   pending_requests_.Lookup(request_id)
-      ->onSuccess(blink::adoptWebPtr(new WebBluetoothDevice(
+      ->onSuccess(base::WrapUnique(new WebBluetoothDevice(
           WebString::fromUTF8(device.id), WebString(device.name),
           device.tx_power, device.rssi, device.device_class,
           GetWebVendorIdSource(device.vendor_id_source), device.vendor_id,
@@ -631,7 +634,7 @@
   BluetoothPrimaryServiceRequest* request =
       pending_primary_service_requests_.Lookup(request_id);
   request->callbacks->onSuccess(
-      blink::adoptWebPtr(new WebBluetoothRemoteGATTService(
+      base::WrapUnique(new WebBluetoothRemoteGATTService(
           WebString::fromUTF8(service_instance_id), request->service_uuid,
           true /* isPrimary */, request->device_id)));
   pending_primary_service_requests_.Remove(request_id);
@@ -657,7 +660,7 @@
   BluetoothCharacteristicRequest* request =
       pending_characteristic_requests_.Lookup(request_id);
   request->callbacks->onSuccess(
-      blink::adoptWebPtr(new WebBluetoothRemoteGATTCharacteristicInit(
+      base::WrapUnique(new WebBluetoothRemoteGATTCharacteristicInit(
           request->service_instance_id,
           WebString::fromUTF8(characteristic_instance_id),
           request->characteristic_uuid, characteristic_properties)));
@@ -687,9 +690,10 @@
   BluetoothCharacteristicsRequest* request =
       pending_characteristics_requests_.Lookup(request_id);
 
-  WebVector<blink::WebBluetoothRemoteGATTCharacteristicInit*>* characteristics =
-      new WebVector<WebBluetoothRemoteGATTCharacteristicInit*>(
-          characteristics_instance_ids.size());
+  // TODO(dcheng): This WebVector should use smart pointers.
+  std::unique_ptr<WebVector<blink::WebBluetoothRemoteGATTCharacteristicInit*>>
+  characteristics(new WebVector<WebBluetoothRemoteGATTCharacteristicInit*>(
+      characteristics_instance_ids.size()));
 
   for (size_t i = 0; i < characteristics_instance_ids.size(); i++) {
     (*characteristics)[i] = new WebBluetoothRemoteGATTCharacteristicInit(
@@ -699,7 +703,7 @@
         characteristics_properties[i]);
   }
 
-  request->callbacks->onSuccess(blink::adoptWebPtr(characteristics));
+  request->callbacks->onSuccess(std::move(characteristics));
 
   pending_characteristics_requests_.Remove(request_id);
 }

diff --git a/content/renderer/cache_storage/cache_storage_dispatcher.cc b/content/renderer/cache_storage/cache_storage_dispatcher.cc
index dd5b258..25b5f867 100644
--- a/content/renderer/cache_storage/cache_storage_dispatcher.cc
+++ b/content/renderer/cache_storage/cache_storage_dispatcher.cc

@@ -303,7 +303,7 @@
                       TimeTicks::Now() - open_times_[request_id]);
   WebServiceWorkerCacheStorage::CacheStorageWithCacheCallbacks* callbacks =
       open_callbacks_.Lookup(request_id);
-  callbacks->onSuccess(blink::adoptWebPtr(web_cache.release()));
+  callbacks->onSuccess(std::move(web_cache));
   open_callbacks_.Remove(request_id);
   open_times_.erase(request_id);
 }

diff --git a/content/renderer/gpu/stream_texture_host_android.cc b/content/renderer/gpu/stream_texture_host_android.cc
index 08c4c2b..3e62f98 100644
--- a/content/renderer/gpu/stream_texture_host_android.cc
+++ b/content/renderer/gpu/stream_texture_host_android.cc

@@ -42,8 +42,6 @@
   IPC_BEGIN_MESSAGE_MAP(StreamTextureHost, message)
     IPC_MESSAGE_HANDLER(GpuStreamTextureMsg_FrameAvailable,
                         OnFrameAvailable);
-    IPC_MESSAGE_HANDLER(GpuStreamTextureMsg_MatrixChanged,
-                        OnMatrixChanged);
     IPC_MESSAGE_UNHANDLED(handled = false)
   IPC_END_MESSAGE_MAP()
   DCHECK(handled);
@@ -58,12 +56,4 @@
     listener_->OnFrameAvailable();
 }
 
-void StreamTextureHost::OnMatrixChanged(
-    const GpuStreamTextureMsg_MatrixChanged_Params& params) {
-  static_assert(sizeof(params) == sizeof(float) * 16,
-                "bad GpuStreamTextureMsg MatrixChanged_Params format");
-  if (listener_)
-    listener_->OnMatrixChanged((const float*)&params);
-}
-
 }  // namespace content

diff --git a/content/renderer/gpu/stream_texture_host_android.h b/content/renderer/gpu/stream_texture_host_android.h
index 4c88ded..d03151b 100644
--- a/content/renderer/gpu/stream_texture_host_android.h
+++ b/content/renderer/gpu/stream_texture_host_android.h

@@ -37,7 +37,6 @@
   class Listener {
    public:
     virtual void OnFrameAvailable() = 0;
-    virtual void OnMatrixChanged(const float mtx[16]) = 0;
     virtual ~Listener() {}
   };
 
@@ -50,7 +49,6 @@
  private:
   // Message handlers:
   void OnFrameAvailable();
-  void OnMatrixChanged(const GpuStreamTextureMsg_MatrixChanged_Params& param);
 
   int stream_id_;
   Listener* listener_;

diff --git a/content/renderer/media/android/stream_texture_factory_impl.cc b/content/renderer/media/android/stream_texture_factory_impl.cc
index e38b6de..81de90a 100644
--- a/content/renderer/media/android/stream_texture_factory_impl.cc
+++ b/content/renderer/media/android/stream_texture_factory_impl.cc

@@ -31,7 +31,6 @@
 
   // StreamTextureHost::Listener implementation:
   void OnFrameAvailable() override;
-  void OnMatrixChanged(const float matrix[16]) override;
 
  private:
   void BindOnThread(int32_t stream_id);
@@ -102,12 +101,6 @@
     client_->DidReceiveFrame();
 }
 
-void StreamTextureProxyImpl::OnMatrixChanged(const float matrix[16]) {
-  base::AutoLock lock(lock_);
-  if (client_)
-    client_->DidUpdateMatrix(matrix);
-}
-
 }  // namespace
 
 // static

diff --git a/content/renderer/media/android/stream_texture_factory_synchronous_impl.cc b/content/renderer/media/android/stream_texture_factory_synchronous_impl.cc
index 86a0e37..513432a 100644
--- a/content/renderer/media/android/stream_texture_factory_synchronous_impl.cc
+++ b/content/renderer/media/android/stream_texture_factory_synchronous_impl.cc

@@ -54,16 +54,13 @@
   scoped_refptr<StreamTextureFactorySynchronousImpl::ContextProvider>
       context_provider_;
   scoped_refptr<gfx::SurfaceTexture> surface_texture_;
-  float current_matrix_[16];
-  bool has_updated_;
 
   DISALLOW_IMPLICIT_CONSTRUCTORS(StreamTextureProxyImpl);
 };
 
 StreamTextureProxyImpl::StreamTextureProxyImpl(
     StreamTextureFactorySynchronousImpl::ContextProvider* provider)
-    : client_(NULL), context_provider_(provider), has_updated_(false) {
-  std::fill(current_matrix_, current_matrix_ + 16, 0);
+    : client_(NULL), context_provider_(provider) {
 }
 
 StreamTextureProxyImpl::~StreamTextureProxyImpl() {}
@@ -122,25 +119,6 @@
 }
 
 void StreamTextureProxyImpl::OnFrameAvailable() {
-  // GetTransformMatrix only returns something valid after both is true:
-  // - OnFrameAvailable was called
-  // - we called UpdateTexImage
-  if (has_updated_) {
-    float matrix[16];
-    surface_texture_->GetTransformMatrix(matrix);
-
-    if (memcmp(current_matrix_, matrix, sizeof(matrix)) != 0) {
-      memcpy(current_matrix_, matrix, sizeof(matrix));
-
-      base::AutoLock lock(lock_);
-      if (client_)
-        client_->DidUpdateMatrix(current_matrix_);
-    }
-  }
-  // OnFrameAvailable being called a second time implies that we called
-  // updateTexImage since after we received the first frame.
-  has_updated_ = true;
-
   base::AutoLock lock(lock_);
   if (client_)
     client_->DidReceiveFrame();

diff --git a/content/renderer/media/android/webmediaplayer_android.cc b/content/renderer/media/android/webmediaplayer_android.cc
index 17caed4..469e94d 100644
--- a/content/renderer/media/android/webmediaplayer_android.cc
+++ b/content/renderer/media/android/webmediaplayer_android.cc

@@ -128,9 +128,8 @@
   desc.fOrigin = kTopLeft_GrSurfaceOrigin;
   desc.fWidth = size.width();
   desc.fHeight = size.height();
-  skia::RefPtr<GrTexture> texture = skia::AdoptRef(
-      gr->textureProvider()->refScratchTexture(
-          desc, GrTextureProvider::kExact_ScratchTexMatch));
+  sk_sp<GrTexture> texture(gr->textureProvider()->refScratchTexture(
+        desc, GrTextureProvider::kExact_ScratchTexMatch));
   if (!texture.get())
     return false;
 

diff --git a/content/renderer/media/canvas_capture_handler_unittest.cc b/content/renderer/media/canvas_capture_handler_unittest.cc
index d4665ca..700e992 100644
--- a/content/renderer/media/canvas_capture_handler_unittest.cc
+++ b/content/renderer/media/canvas_capture_handler_unittest.cc

@@ -9,7 +9,6 @@
 #include "content/renderer/media/canvas_capture_handler.h"
 #include "content/renderer/media/media_stream_video_capturer_source.h"
 #include "media/base/limits.h"
-#include "skia/ext/refptr.h"
 #include "testing/gmock/include/gmock/gmock.h"
 #include "testing/gtest/include/gtest/gtest.h"
 #include "third_party/WebKit/public/platform/WebMediaStreamSource.h"
@@ -82,13 +81,13 @@
   void OnRunning(bool state) { DoOnRunning(state); }
 
   // Verify returned frames.
-  static skia::RefPtr<SkImage> GenerateTestImage(bool opaque) {
+  static sk_sp<SkImage> GenerateTestImage(bool opaque) {
 
     SkBitmap testBitmap;
     testBitmap.allocN32Pixels(kTestCanvasCaptureFrameWidth,
                               kTestCanvasCaptureFrameHeight, opaque);
     testBitmap.eraseARGB(kTestAlphaValue, 30, 60, 200);
-    return skia::AdoptRef(SkImage::NewFromBitmap(testBitmap));
+    return SkImage::MakeFromBitmap(testBitmap);
   }
 
   void OnVerifyDeliveredFrame(

diff --git a/content/renderer/media/html_video_element_capturer_source.cc b/content/renderer/media/html_video_element_capturer_source.cc
index d53e4fbc8..7c45e78 100644
--- a/content/renderer/media/html_video_element_capturer_source.cc
+++ b/content/renderer/media/html_video_element_capturer_source.cc

@@ -90,7 +90,7 @@
     return;
   }
   const blink::WebSize resolution = web_media_player_->naturalSize();
-  canvas_ = skia::AdoptRef(skia::CreatePlatformCanvas(resolution.width,
+  canvas_ = sk_sp<SkCanvas>(skia::CreatePlatformCanvas(resolution.width,
                                resolution.height,
                                true /* is_opaque */));
 

diff --git a/content/renderer/media/html_video_element_capturer_source.h b/content/renderer/media/html_video_element_capturer_source.h
index 1f545d8..c5e7cb36 100644
--- a/content/renderer/media/html_video_element_capturer_source.h
+++ b/content/renderer/media/html_video_element_capturer_source.h

@@ -56,7 +56,7 @@
   void sendNewFrame();
 
   media::VideoFramePool frame_pool_;
-  skia::RefPtr<SkCanvas> canvas_;
+  sk_sp<SkCanvas> canvas_;
 
   const base::WeakPtr<blink::WebMediaPlayer> web_media_player_;
   const scoped_refptr<base::SingleThreadTaskRunner> io_task_runner_;

diff --git a/content/renderer/media/renderer_gpu_video_accelerator_factories.cc b/content/renderer/media/renderer_gpu_video_accelerator_factories.cc
index 5976a5dd..117b45250 100644
--- a/content/renderer/media/renderer_gpu_video_accelerator_factories.cc
+++ b/content/renderer/media/renderer_gpu_video_accelerator_factories.cc

@@ -13,14 +13,14 @@
 #include "content/child/child_gpu_memory_buffer_manager.h"
 #include "content/child/child_thread_impl.h"
 #include "content/common/gpu/client/context_provider_command_buffer.h"
-#include "content/common/gpu/client/gpu_video_decode_accelerator_host.h"
-#include "content/common/gpu/client/gpu_video_encode_accelerator_host.h"
 #include "content/common/gpu/client/webgraphicscontext3d_command_buffer_impl.h"
-#include "content/common/gpu/media/gpu_video_accelerator_util.h"
 #include "content/renderer/render_thread_impl.h"
 #include "gpu/command_buffer/client/gles2_interface.h"
 #include "gpu/command_buffer/client/gpu_memory_buffer_manager.h"
 #include "gpu/ipc/client/gpu_channel_host.h"
+#include "media/gpu/ipc/client/gpu_video_decode_accelerator_host.h"
+#include "media/gpu/ipc/client/gpu_video_encode_accelerator_host.h"
+#include "media/gpu/ipc/common/gpu_video_accelerator_util.h"
 #include "media/video/video_decode_accelerator.h"
 #include "media/video/video_encode_accelerator.h"
 
@@ -119,7 +119,7 @@
   DCHECK(channel);
 
   return scoped_ptr<media::VideoDecodeAccelerator>(
-      new GpuVideoDecodeAcceleratorHost(
+      new media::GpuVideoDecodeAcceleratorHost(
           channel, context_provider_->GetCommandBufferProxy()));
 }
 
@@ -135,7 +135,7 @@
   DCHECK(channel);
 
   return scoped_ptr<media::VideoEncodeAccelerator>(
-      new GpuVideoEncodeAcceleratorHost(
+      new media::GpuVideoEncodeAcceleratorHost(
           channel, context_provider_->GetCommandBufferProxy()));
 }
 
@@ -286,14 +286,14 @@
 
 media::VideoDecodeAccelerator::Capabilities
 RendererGpuVideoAcceleratorFactories::GetVideoDecodeAcceleratorCapabilities() {
-  return GpuVideoAcceleratorUtil::ConvertGpuToMediaDecodeCapabilities(
+  return media::GpuVideoAcceleratorUtil::ConvertGpuToMediaDecodeCapabilities(
       gpu_channel_host_->gpu_info().video_decode_accelerator_capabilities);
 }
 
 media::VideoEncodeAccelerator::SupportedProfiles
 RendererGpuVideoAcceleratorFactories::
     GetVideoEncodeAcceleratorSupportedProfiles() {
-  return GpuVideoAcceleratorUtil::ConvertGpuToMediaEncodeProfiles(
+  return media::GpuVideoAcceleratorUtil::ConvertGpuToMediaEncodeProfiles(
       gpu_channel_host_->gpu_info()
           .video_encode_accelerator_supported_profiles);
 }

diff --git a/content/renderer/media/rtc_certificate.cc b/content/renderer/media/rtc_certificate.cc
index 19ec478..7c2ff28 100644
--- a/content/renderer/media/rtc_certificate.cc
+++ b/content/renderer/media/rtc_certificate.cc

@@ -4,6 +4,7 @@
 
 #include "content/renderer/media/rtc_certificate.h"
 
+#include "base/memory/ptr_util.h"
 #include "content/renderer/media/peer_connection_identity_store.h"
 #include "url/gurl.h"
 
@@ -19,9 +20,8 @@
 RTCCertificate::~RTCCertificate() {
 }
 
-blink::WebPassOwnPtr<blink::WebRTCCertificate> RTCCertificate::shallowCopy()
-    const {
-  return blink::adoptWebPtr(new RTCCertificate(key_params_, certificate_));
+std::unique_ptr<blink::WebRTCCertificate> RTCCertificate::shallowCopy() const {
+  return base::WrapUnique(new RTCCertificate(key_params_, certificate_));
 }
 
 const blink::WebRTCKeyParams& RTCCertificate::keyParams() const {

diff --git a/content/renderer/media/rtc_certificate.h b/content/renderer/media/rtc_certificate.h
index eb9b35b6..60af249 100644
--- a/content/renderer/media/rtc_certificate.h
+++ b/content/renderer/media/rtc_certificate.h

@@ -25,7 +25,7 @@
   ~RTCCertificate() override;
 
   // blink::WebRTCCertificate implementation.
-  blink::WebPassOwnPtr<blink::WebRTCCertificate> shallowCopy() const override;
+  std::unique_ptr<blink::WebRTCCertificate> shallowCopy() const override;
   const blink::WebRTCKeyParams& keyParams() const override;
   uint64_t expires() const override;
 

diff --git a/content/renderer/media/rtc_certificate_generator.cc b/content/renderer/media/rtc_certificate_generator.cc
index fe43be4..263ba5f 100644
--- a/content/renderer/media/rtc_certificate_generator.cc
+++ b/content/renderer/media/rtc_certificate_generator.cc

@@ -8,6 +8,7 @@
 #include <utility>
 
 #include "base/macros.h"
+#include "base/memory/ptr_util.h"
 #include "content/renderer/media/peer_connection_identity_store.h"
 #include "content/renderer/media/rtc_certificate.h"
 #include "content/renderer/media/webrtc/peer_connection_dependency_factory.h"
@@ -56,11 +57,11 @@
       const blink::WebRTCKeyParams& key_params,
       const GURL& url,
       const GURL& first_party_for_cookies,
-      blink::WebPassOwnPtr<blink::WebRTCCertificateCallback> observer) {
+      std::unique_ptr<blink::WebRTCCertificateCallback> observer) {
     DCHECK(main_thread_->BelongsToCurrentThread());
     DCHECK(!observer_) << "Already have a RequestIdentity in progress.";
     key_params_ = key_params;
-    observer_ = observer;
+    observer_ = std::move(observer);
     DCHECK(observer_);
     // Identity request must be performed on the WebRTC signaling thread.
     signaling_thread_->PostTask(FROM_HERE, base::Bind(
@@ -107,16 +108,19 @@
     DCHECK(observer_);
     rtc::scoped_refptr<rtc::RTCCertificate> certificate =
         rtc::RTCCertificate::Create(std::move(identity));
-    main_thread_->PostTask(FROM_HERE, base::Bind(
-        &RTCCertificateIdentityObserver::DoCallbackOnMainThread,
-        this, new RTCCertificate(key_params_, certificate)));
+    main_thread_->PostTask(
+        FROM_HERE,
+        base::Bind(&RTCCertificateIdentityObserver::DoCallbackOnMainThread,
+                   this, base::Passed(base::WrapUnique(
+                             new RTCCertificate(key_params_, certificate)))));
   }
 
-  void DoCallbackOnMainThread(blink::WebRTCCertificate* certificate) {
+  void DoCallbackOnMainThread(
+      std::unique_ptr<blink::WebRTCCertificate> certificate) {
     DCHECK(main_thread_->BelongsToCurrentThread());
     DCHECK(observer_);
     if (certificate)
-      observer_->onSuccess(blink::adoptWebPtr(certificate));
+      observer_->onSuccess(std::move(certificate));
     else
       observer_->onError();
     observer_.reset();
@@ -139,7 +143,7 @@
     const blink::WebRTCKeyParams& key_params,
     const blink::WebURL& url,
     const blink::WebURL& first_party_for_cookies,
-    blink::WebPassOwnPtr<blink::WebRTCCertificateCallback> observer) {
+    std::unique_ptr<blink::WebRTCCertificateCallback> observer) {
   DCHECK(isSupportedKeyParams(key_params));
 
 #if defined(ENABLE_WEBRTC)
@@ -156,8 +160,8 @@
       new rtc::RefCountedObject<RTCCertificateIdentityObserver>(
           main_thread, signaling_thread));
   // |identity_observer| lives until request has completed.
-  identity_observer->RequestIdentity(
-      key_params, url, first_party_for_cookies, observer);
+  identity_observer->RequestIdentity(key_params, url, first_party_for_cookies,
+                                     std::move(observer));
 #else
   observer->onError();
 #endif

diff --git a/content/renderer/media/rtc_certificate_generator.h b/content/renderer/media/rtc_certificate_generator.h
index 51a29559..95734fd 100644
--- a/content/renderer/media/rtc_certificate_generator.h
+++ b/content/renderer/media/rtc_certificate_generator.h

@@ -25,7 +25,7 @@
       const blink::WebRTCKeyParams& key_params,
       const blink::WebURL& url,
       const blink::WebURL& first_party_for_cookies,
-      blink::WebPassOwnPtr<blink::WebRTCCertificateCallback> observer) override;
+      std::unique_ptr<blink::WebRTCCertificateCallback> observer) override;
   bool isSupportedKeyParams(const blink::WebRTCKeyParams& key_params) override;
 
  private:

diff --git a/content/renderer/media/rtc_video_encoder_factory.cc b/content/renderer/media/rtc_video_encoder_factory.cc
index d9fc4eef..194a236f 100644
--- a/content/renderer/media/rtc_video_encoder_factory.cc
+++ b/content/renderer/media/rtc_video_encoder_factory.cc

@@ -5,9 +5,9 @@
 #include "content/renderer/media/rtc_video_encoder_factory.h"
 
 #include "base/command_line.h"
-#include "content/common/gpu/client/gpu_video_encode_accelerator_host.h"
 #include "content/public/common/content_switches.h"
 #include "content/renderer/media/rtc_video_encoder.h"
+#include "media/gpu/ipc/client/gpu_video_encode_accelerator_host.h"
 #include "media/renderers/gpu_video_accelerator_factories.h"
 #include "media/video/video_encode_accelerator.h"
 

diff --git a/content/renderer/media/webmediaplayer_ms_unittest.cc b/content/renderer/media/webmediaplayer_ms_unittest.cc
index beaad89..5c890cec 100644
--- a/content/renderer/media/webmediaplayer_ms_unittest.cc
+++ b/content/renderer/media/webmediaplayer_ms_unittest.cc

@@ -395,7 +395,6 @@
   void StartRendering() override;
   void StopRendering() override;
   void DidReceiveFrame() override {}
-  void DidUpdateMatrix(const float* matrix) override {}
 
   // For test use
   void SetBackgroundRendering(bool background_rendering) {

diff --git a/content/renderer/pepper/pepper_plugin_instance_impl.cc b/content/renderer/pepper/pepper_plugin_instance_impl.cc
index 8bd0a1c..372b503 100644
--- a/content/renderer/pepper/pepper_plugin_instance_impl.cc
+++ b/content/renderer/pepper/pepper_plugin_instance_impl.cc

@@ -1748,7 +1748,7 @@
   if (!num_pages)
     return 0;
   current_print_settings_ = print_settings;
-  canvas_.clear();
+  canvas_.reset();
   ranges_.clear();
   return num_pages;
 }
@@ -1767,7 +1767,7 @@
 #endif  // defined(OS_MACOSX)
   if (save_for_later) {
     ranges_.push_back(page_range);
-    canvas_ = skia::SharePtr(canvas);
+    canvas_ = sk_ref_sp(canvas);
   } else {
     PrintPageHelper(&page_range, 1, canvas);
   }
@@ -1800,7 +1800,7 @@
   scoped_refptr<PepperPluginInstanceImpl> ref(this);
   if (!ranges_.empty())
     PrintPageHelper(&(ranges_.front()), ranges_.size(), canvas_.get());
-  canvas_.clear();
+  canvas_.reset();
   ranges_.clear();
 
   DCHECK(plugin_print_interface_);

diff --git a/content/renderer/pepper/pepper_plugin_instance_impl.h b/content/renderer/pepper/pepper_plugin_instance_impl.h
index c02a4505..db95d8e 100644
--- a/content/renderer/pepper/pepper_plugin_instance_impl.h
+++ b/content/renderer/pepper/pepper_plugin_instance_impl.h

@@ -54,7 +54,6 @@
 #include "ppapi/shared_impl/tracked_callback.h"
 #include "ppapi/thunk/ppb_gamepad_api.h"
 #include "ppapi/thunk/resource_creation_api.h"
-#include "skia/ext/refptr.h"
 #include "third_party/WebKit/public/platform/WebCanvas.h"
 #include "third_party/WebKit/public/platform/WebString.h"
 #include "third_party/WebKit/public/platform/WebURLLoaderClient.h"
@@ -807,7 +806,7 @@
   // to generate the entire PDF given the variables below:
   //
   // The most recently used WebCanvas, guaranteed to be valid.
-  skia::RefPtr<blink::WebCanvas> canvas_;
+  sk_sp<blink::WebCanvas> canvas_;
   // An array of page ranges.
   std::vector<PP_PrintPageNumberRange_Dev> ranges_;
 

diff --git a/content/renderer/pepper/pepper_video_decoder_host.cc b/content/renderer/pepper/pepper_video_decoder_host.cc
index 85f0ad65..8016b9e 100644
--- a/content/renderer/pepper/pepper_video_decoder_host.cc
+++ b/content/renderer/pepper/pepper_video_decoder_host.cc

@@ -9,7 +9,6 @@
 #include "base/bind.h"
 #include "base/memory/shared_memory.h"
 #include "build/build_config.h"
-#include "content/common/gpu/client/gpu_video_decode_accelerator_host.h"
 #include "content/common/pepper_file_util.h"
 #include "content/public/common/content_client.h"
 #include "content/public/renderer/content_renderer_client.h"
@@ -20,6 +19,7 @@
 #include "content/renderer/pepper/video_decoder_shim.h"
 #include "gpu/ipc/client/command_buffer_proxy_impl.h"
 #include "media/base/limits.h"
+#include "media/gpu/ipc/client/gpu_video_decode_accelerator_host.h"
 #include "media/video/video_decode_accelerator.h"
 #include "ppapi/c/pp_completion_callback.h"
 #include "ppapi/c/pp_errors.h"
@@ -150,7 +150,7 @@
     gpu::GpuChannelHost* channel = command_buffer->channel();
     if (channel) {
       decoder_.reset(
-          new GpuVideoDecodeAcceleratorHost(channel, command_buffer));
+          new media::GpuVideoDecodeAcceleratorHost(channel, command_buffer));
       if (decoder_->Initialize(profile_, this)) {
         initialized_ = true;
         return PP_OK;

diff --git a/content/renderer/pepper/pepper_video_encoder_host.cc b/content/renderer/pepper/pepper_video_encoder_host.cc
index 78987e9a..afdc33d 100644
--- a/content/renderer/pepper/pepper_video_encoder_host.cc
+++ b/content/renderer/pepper/pepper_video_encoder_host.cc

@@ -10,8 +10,6 @@
 #include "base/memory/shared_memory.h"
 #include "base/numerics/safe_math.h"
 #include "build/build_config.h"
-#include "content/common/gpu/client/gpu_video_encode_accelerator_host.h"
-#include "content/common/gpu/media/gpu_video_accelerator_util.h"
 #include "content/common/pepper_file_util.h"
 #include "content/public/renderer/renderer_ppapi_host.h"
 #include "content/renderer/pepper/gfx_conversion.h"
@@ -21,6 +19,8 @@
 #include "gpu/ipc/client/command_buffer_proxy_impl.h"
 #include "media/base/bind_to_current_loop.h"
 #include "media/base/video_frame.h"
+#include "media/gpu/ipc/client/gpu_video_encode_accelerator_host.h"
+#include "media/gpu/ipc/common/gpu_video_accelerator_util.h"
 #include "media/renderers/gpu_video_accelerator_factories.h"
 #include "media/video/video_encode_accelerator.h"
 #include "ppapi/c/pp_codecs.h"
@@ -451,7 +451,7 @@
   media::VideoEncodeAccelerator::SupportedProfiles profiles;
 
   if (EnsureGpuChannel()) {
-    profiles = GpuVideoAcceleratorUtil::ConvertGpuToMediaEncodeProfiles(
+    profiles = media::GpuVideoAcceleratorUtil::ConvertGpuToMediaEncodeProfiles(
         channel_->gpu_info().video_encode_accelerator_supported_profiles);
     for (media::VideoEncodeAccelerator::SupportedProfile profile : profiles) {
       if (profile.profile == media::VP9PROFILE_PROFILE1 ||
@@ -540,8 +540,8 @@
   if (!EnsureGpuChannel())
     return false;
 
-  encoder_.reset(
-      new GpuVideoEncodeAcceleratorHost(channel_.get(), command_buffer_.get()));
+  encoder_.reset(new media::GpuVideoEncodeAcceleratorHost(
+      channel_.get(), command_buffer_.get()));
   return encoder_->Initialize(input_format, input_visible_size, output_profile,
                               initial_bitrate, this);
 }

diff --git a/content/renderer/pepper/ppb_image_data_impl.cc b/content/renderer/pepper/ppb_image_data_impl.cc
index e1f169f..4756cfd 100644
--- a/content/renderer/pepper/ppb_image_data_impl.cc
+++ b/content/renderer/pepper/ppb_image_data_impl.cc

@@ -172,7 +172,7 @@
   if (!mapped_canvas_) {
     const bool is_opaque = false;
     mapped_canvas_ =
-        skia::AdoptRef(dib_->GetPlatformCanvas(width_, height_, is_opaque));
+        sk_sp<SkCanvas>(dib_->GetPlatformCanvas(width_, height_, is_opaque));
     if (!mapped_canvas_)
       return NULL;
   }
@@ -242,7 +242,7 @@
     skia_bitmap_.setPixels(shared_memory_->memory());
     // Our platform bitmaps are set to opaque by default, which we don't want.
     skia_bitmap_.setAlphaType(kPremul_SkAlphaType);
-    skia_canvas_ = skia::AdoptRef(new SkCanvas(skia_bitmap_));
+    skia_canvas_ = sk_make_sp<SkCanvas>(skia_bitmap_);
     return skia_bitmap_.getAddr32(0, 0);
   }
   return shared_memory_->memory();

diff --git a/content/renderer/pepper/ppb_image_data_impl.h b/content/renderer/pepper/ppb_image_data_impl.h
index 3306a8d..13a1e0c 100644
--- a/content/renderer/pepper/ppb_image_data_impl.h
+++ b/content/renderer/pepper/ppb_image_data_impl.h

@@ -15,7 +15,6 @@
 #include "ppapi/shared_impl/ppb_image_data_shared.h"
 #include "ppapi/shared_impl/resource.h"
 #include "ppapi/thunk/ppb_image_data_api.h"
-#include "skia/ext/refptr.h"
 #include "third_party/skia/include/core/SkCanvas.h"
 
 class SkBitmap;
@@ -145,7 +144,7 @@
   scoped_ptr<TransportDIB> dib_;
 
   // When the device is mapped, this is the image. Null when umapped.
-  skia::RefPtr<SkCanvas> mapped_canvas_;
+  sk_sp<SkCanvas> mapped_canvas_;
 
   DISALLOW_COPY_AND_ASSIGN(ImageDataPlatformBackend);
 };
@@ -175,7 +174,7 @@
   scoped_ptr<base::SharedMemory> shared_memory_;
   // skia_bitmap_ is backed by shared_memory_.
   SkBitmap skia_bitmap_;
-  skia::RefPtr<SkCanvas> skia_canvas_;
+  sk_sp<SkCanvas> skia_canvas_;
   uint32_t map_count_;
 
   DISALLOW_COPY_AND_ASSIGN(ImageDataSimpleBackend);

diff --git a/content/renderer/pepper/ppb_video_decoder_impl.cc b/content/renderer/pepper/ppb_video_decoder_impl.cc
index 61c13dbb..50c104b 100644
--- a/content/renderer/pepper/ppb_video_decoder_impl.cc
+++ b/content/renderer/pepper/ppb_video_decoder_impl.cc

@@ -9,7 +9,6 @@
 #include "base/logging.h"
 #include "base/message_loop/message_loop.h"
 #include "base/metrics/histogram.h"
-#include "content/common/gpu/client/gpu_video_decode_accelerator_host.h"
 #include "content/renderer/pepper/host_globals.h"
 #include "content/renderer/pepper/pepper_plugin_instance_impl.h"
 #include "content/renderer/pepper/plugin_module.h"
@@ -17,6 +16,7 @@
 #include "content/renderer/pepper/ppb_graphics_3d_impl.h"
 #include "content/renderer/render_thread_impl.h"
 #include "gpu/ipc/client/command_buffer_proxy_impl.h"
+#include "media/gpu/ipc/client/gpu_video_decode_accelerator_host.h"
 #include "media/video/picture.h"
 #include "media/video/video_decode_accelerator.h"
 #include "ppapi/c/dev/pp_video_dev.h"
@@ -131,7 +131,8 @@
   // it is okay to immediately send IPC messages.
   gpu::GpuChannelHost* channel = command_buffer->channel();
   if (channel) {
-    decoder_.reset(new GpuVideoDecodeAcceleratorHost(channel, command_buffer));
+    decoder_.reset(
+        new media::GpuVideoDecodeAcceleratorHost(channel, command_buffer));
     return decoder_->Initialize(PPToMediaProfile(profile), this);
   }
   return false;

diff --git a/content/renderer/presentation/presentation_dispatcher.cc b/content/renderer/presentation/presentation_dispatcher.cc
index b3bbbfd5..6536f86 100644
--- a/content/renderer/presentation/presentation_dispatcher.cc
+++ b/content/renderer/presentation/presentation_dispatcher.cc

@@ -9,6 +9,7 @@
 #include <vector>
 
 #include "base/logging.h"
+#include "base/memory/ptr_util.h"
 #include "content/common/presentation/presentation_service.mojom.h"
 #include "content/public/common/presentation_constants.h"
 #include "content/public/common/service_registry.h"
@@ -383,7 +384,7 @@
 
   DCHECK(!session_info.is_null());
   presentation_service_->ListenForSessionMessages(session_info.Clone());
-  callback->onSuccess(blink::adoptWebPtr(
+  callback->onSuccess(base::WrapUnique(
       new PresentationConnectionClient(std::move(session_info))));
 }
 

diff --git a/content/renderer/push_messaging/push_messaging_dispatcher.cc b/content/renderer/push_messaging/push_messaging_dispatcher.cc
index 0bd40dc..1cfc044f 100644
--- a/content/renderer/push_messaging/push_messaging_dispatcher.cc
+++ b/content/renderer/push_messaging/push_messaging_dispatcher.cc

@@ -4,6 +4,7 @@
 
 #include "content/renderer/push_messaging/push_messaging_dispatcher.h"
 
+#include "base/memory/ptr_util.h"
 #include "base/strings/utf_string_conversions.h"
 #include "content/child/service_worker/web_service_worker_registration_impl.h"
 #include "content/common/push_messaging_messages.h"
@@ -114,8 +115,8 @@
       subscription_callbacks_.Lookup(request_id);
   DCHECK(callbacks);
 
-  callbacks->onSuccess(blink::adoptWebPtr(
-      new blink::WebPushSubscription(endpoint, p256dh, auth)));
+  callbacks->onSuccess(
+      base::WrapUnique(new blink::WebPushSubscription(endpoint, p256dh, auth)));
 
   subscription_callbacks_.Remove(request_id);
 }

diff --git a/content/renderer/service_worker/service_worker_context_client.cc b/content/renderer/service_worker/service_worker_context_client.cc
index 5f42031..44b5ce54 100644
--- a/content/renderer/service_worker/service_worker_context_client.cc
+++ b/content/renderer/service_worker/service_worker_context_client.cc

@@ -4,6 +4,7 @@
 
 #include "content/renderer/service_worker/service_worker_context_client.h"
 
+#include <memory>
 #include <utility>
 
 #include "base/lazy_instance.h"
@@ -45,7 +46,6 @@
 #include "ipc/ipc_message_macros.h"
 #include "third_party/WebKit/public/platform/URLConversion.h"
 #include "third_party/WebKit/public/platform/WebMessagePortChannel.h"
-#include "third_party/WebKit/public/platform/WebPassOwnPtr.h"
 #include "third_party/WebKit/public/platform/WebReferrerPolicy.h"
 #include "third_party/WebKit/public/platform/WebSecurityOrigin.h"
 #include "third_party/WebKit/public/platform/WebString.h"
@@ -866,7 +866,7 @@
     web_client.reset(new blink::WebServiceWorkerClientInfo(
         ToWebServiceWorkerClientInfo(client)));
   }
-  callbacks->onSuccess(blink::adoptWebPtr(web_client.release()));
+  callbacks->onSuccess(std::move(web_client));
   context_->client_callbacks.Remove(request_id);
 }
 
@@ -907,7 +907,7 @@
     web_client.reset(new blink::WebServiceWorkerClientInfo(
         ToWebServiceWorkerClientInfo(client)));
   }
-  callbacks->onSuccess(blink::adoptWebPtr(web_client.release()));
+  callbacks->onSuccess(std::move(web_client));
   context_->client_callbacks.Remove(request_id);
 }
 
@@ -943,7 +943,7 @@
     scoped_ptr<blink::WebServiceWorkerClientInfo> web_client (
         new blink::WebServiceWorkerClientInfo(
             ToWebServiceWorkerClientInfo(client)));
-    callback->onSuccess(blink::adoptWebPtr(web_client.release()));
+    callback->onSuccess(std::move(web_client));
   } else {
     callback->onError(blink::WebServiceWorkerError(
         blink::WebServiceWorkerError::ErrorTypeNotFound,
@@ -970,7 +970,7 @@
     web_client.reset(new blink::WebServiceWorkerClientInfo(
         ToWebServiceWorkerClientInfo(client)));
   }
-  callbacks->onSuccess(blink::adoptWebPtr(web_client.release()));
+  callbacks->onSuccess(std::move(web_client));
   context_->client_callbacks.Remove(request_id);
 }
 

diff --git a/content/renderer/usb/web_usb_client_impl.cc b/content/renderer/usb/web_usb_client_impl.cc
index 33533754..fc79424d 100644
--- a/content/renderer/usb/web_usb_client_impl.cc
+++ b/content/renderer/usb/web_usb_client_impl.cc

@@ -5,10 +5,13 @@
 #include "content/renderer/usb/web_usb_client_impl.h"
 
 #include <stddef.h>
+
+#include <memory>
 #include <utility>
 
 #include "base/bind.h"
 #include "base/callback.h"
+#include "base/memory/ptr_util.h"
 #include "base/memory/scoped_ptr.h"
 #include "base/move.h"
 #include "base/strings/utf_string_conversions.h"
@@ -20,7 +23,6 @@
 #include "mojo/public/cpp/bindings/array.h"
 #include "mojo/public/cpp/bindings/interface_request.h"
 #include "third_party/WebKit/public/platform/WebCallbacks.h"
-#include "third_party/WebKit/public/platform/WebPassOwnPtr.h"
 #include "third_party/WebKit/public/platform/modules/webusb/WebUSBDeviceFilter.h"
 #include "third_party/WebKit/public/platform/modules/webusb/WebUSBDeviceInfo.h"
 #include "third_party/WebKit/public/platform/modules/webusb/WebUSBDeviceRequestOptions.h"
@@ -57,8 +59,9 @@
     ScopedWebCallbacks<blink::WebUSBClientGetDevicesCallbacks> scoped_callbacks,
     device::usb::DeviceManager* device_manager,
     mojo::Array<device::usb::DeviceInfoPtr> results) {
-  blink::WebVector<blink::WebUSBDevice*>* devices =
-      new blink::WebVector<blink::WebUSBDevice*>(results.size());
+  // TODO(dcheng): This WebVector should hold smart pointers.
+  std::unique_ptr<blink::WebVector<blink::WebUSBDevice*>> devices(
+      new blink::WebVector<blink::WebUSBDevice*>(results.size()));
   for (size_t i = 0; i < results.size(); ++i) {
     device::usb::DevicePtr device;
     device_manager->GetDevice(results[i]->guid, mojo::GetProxy(&device));
@@ -66,7 +69,7 @@
         std::move(device),
         mojo::ConvertTo<blink::WebUSBDeviceInfo>(results[i]));
   }
-  scoped_callbacks.PassCallbacks()->onSuccess(blink::adoptWebPtr(devices));
+  scoped_callbacks.PassCallbacks()->onSuccess(std::move(devices));
 }
 
 void OnRequestDevicesComplete(
@@ -77,10 +80,10 @@
   if (result) {
     device::usb::DevicePtr device;
     device_manager->GetDevice(result->guid, mojo::GetProxy(&device));
-    blink::WebUSBDevice* web_usb_device = new WebUSBDeviceImpl(
-        std::move(device), mojo::ConvertTo<blink::WebUSBDeviceInfo>(result));
+    std::unique_ptr<blink::WebUSBDevice> web_usb_device(new WebUSBDeviceImpl(
+        std::move(device), mojo::ConvertTo<blink::WebUSBDeviceInfo>(result)));
 
-    scoped_callbacks->onSuccess(blink::adoptWebPtr(web_usb_device));
+    scoped_callbacks->onSuccess(std::move(web_usb_device));
   } else {
     scoped_callbacks->onError(
         blink::WebUSBError(blink::WebUSBError::Error::NotFound,
@@ -160,7 +163,7 @@
     for (auto observer : observers_) {
       device::usb::DevicePtr device;
       device_manager_->GetDevice(device_info->guid, mojo::GetProxy(&device));
-      observer->onDeviceConnected(blink::adoptWebPtr(new WebUSBDeviceImpl(
+      observer->onDeviceConnected(base::WrapUnique(new WebUSBDeviceImpl(
           std::move(device),
           mojo::ConvertTo<blink::WebUSBDeviceInfo>(device_info))));
     }
@@ -169,7 +172,7 @@
     const device::usb::DeviceInfoPtr& device_info =
         notification->devices_removed[i];
     for (auto observer : observers_)
-      observer->onDeviceDisconnected(blink::adoptWebPtr(new WebUSBDeviceImpl(
+      observer->onDeviceDisconnected(base::WrapUnique(new WebUSBDeviceImpl(
           nullptr, mojo::ConvertTo<blink::WebUSBDeviceInfo>(device_info))));
   }
 }

diff --git a/content/renderer/usb/web_usb_device_impl.cc b/content/renderer/usb/web_usb_device_impl.cc
index fc6920d..bb2ca99 100644
--- a/content/renderer/usb/web_usb_device_impl.cc
+++ b/content/renderer/usb/web_usb_device_impl.cc

@@ -128,7 +128,7 @@
   info->status.assign(
       std::vector<blink::WebUSBTransferInfo::Status>(1, web_status));
   info->data.assign(data);
-  scoped_callbacks->onSuccess(adoptWebPtr(info.release()));
+  scoped_callbacks->onSuccess(std::move(info));
 }
 
 void OnTransferOut(
@@ -154,7 +154,7 @@
   info->status.assign(
       std::vector<blink::WebUSBTransferInfo::Status>(1, web_status));
   info->bytesTransferred.assign(std::vector<uint32_t>(1, bytes_written));
-  scoped_callbacks->onSuccess(adoptWebPtr(info.release()));
+  scoped_callbacks->onSuccess(std::move(info));
 }
 
 void OnIsochronousTransferIn(
@@ -186,7 +186,7 @@
     info->packetLength[i] = packets[i]->length;
     info->bytesTransferred[i] = packets[i]->transferred_length;
   }
-  scoped_callbacks->onSuccess(adoptWebPtr(info.release()));
+  scoped_callbacks->onSuccess(std::move(info));
 }
 
 void OnIsochronousTransferOut(
@@ -211,7 +211,7 @@
     }
     info->bytesTransferred[i] = packets[i]->transferred_length;
   }
-  scoped_callbacks->onSuccess(adoptWebPtr(info.release()));
+  scoped_callbacks->onSuccess(std::move(info));
 }
 
 }  // namespace

diff --git a/content/shell/renderer/layout_test/blink_test_runner.cc b/content/shell/renderer/layout_test/blink_test_runner.cc
index 5d2f98a..20d87dd 100644
--- a/content/shell/renderer/layout_test/blink_test_runner.cc
+++ b/content/shell/renderer/layout_test/blink_test_runner.cc

@@ -903,10 +903,7 @@
 void BlinkTestRunner::CaptureDumpComplete() {
   render_view()->GetWebView()->mainFrame()->stopLoading();
 
-  base::ThreadTaskRunnerHandle::Get()->PostTask(
-      FROM_HERE, base::Bind(base::IgnoreResult(&BlinkTestRunner::Send),
-                            base::Unretained(this),
-                            new ShellViewHostMsg_TestFinished(routing_id())));
+  Send(new ShellViewHostMsg_TestFinished(routing_id()));
 }
 
 mojom::LayoutTestBluetoothFakeAdapterSetter&

diff --git a/content/test/gpu/gpu_tests/webgl2_conformance_expectations.py b/content/test/gpu/gpu_tests/webgl2_conformance_expectations.py
index 9cebea2..ed8c5e6 100644
--- a/content/test/gpu/gpu_tests/webgl2_conformance_expectations.py
+++ b/content/test/gpu/gpu_tests/webgl2_conformance_expectations.py

@@ -60,11 +60,9 @@
     self.Skip('deqp/functional/gles3/uniformbuffers.html', bug=483282)
     self.Skip('deqp/functional/gles3/vertexarrays.html', bug=483282)
 
-    self.Fail('conformance2/glsl3/array-complex-indexing.html', bug=483282)
     self.Fail('conformance2/glsl3/forbidden-operators.html', bug=483282)
 
     self.Fail('conformance2/misc/expando-loss-2.html', bug=483282)
-    self.Fail('conformance2/reading/read-pixels-from-fbo-test.html', bug=483282)
     self.Fail('conformance2/vertex_arrays/vertex-array-object.html', bug=483282)
 
     # Windows only.
@@ -131,14 +129,10 @@
     self.Skip('deqp/functional/gles3/readpixel.html', ['win'], bug=483282)
     self.Skip('deqp/functional/gles3/texturestatequery.html',
         ['win'], bug=483282)
-    self.Fail('deqp/functional/gles3/shaderstruct.html',
-        ['win'], bug=483282)
     self.Fail('conformance2/glsl3/array-in-complex-expression.html',
         ['win'], bug=483282)
     self.Skip('conformance2/reading/read-pixels-pack-parameters.html',
         ['win'], bug=483282)
-    self.Fail('conformance2/textures/misc/gl-get-tex-parameter.html',
-        ['win'], bug=483282)
     self.Fail('conformance2/textures/misc/tex-input-validation.html',
         ['win'], bug=483282)
     self.Skip('conformance2/textures/misc/tex-mipmap-levels.html',
@@ -155,6 +149,10 @@
         ['win'], bug=483282)
 
     # Windows 8 only.
+
+    self.Fail('conformance2/reading/read-pixels-from-fbo-test.html',
+        ['win8'], bug=483282)
+
     self.Fail('conformance2/textures/image_data/' +
         'tex-2d-rgb565-rgb-unsigned_byte.html',
         ['win8'], bug=483282)
@@ -306,6 +304,8 @@
     # Win / Intel
     self.Fail('conformance2/buffers/uniform-buffers.html',
         ['win', 'intel'], bug=483282)
+    self.Fail('deqp/functional/gles3/shaderstruct.html',
+        ['win', 'intel'], bug=483282)
 
     # Mac only.
     self.Skip('deqp/data/gles3/shaders/qualification_order.html',
@@ -334,16 +334,15 @@
         ['mac'], bug=483282)
     self.Fail('conformance2/misc/uninitialized-test-2.html',
         ['mac'], bug=483282)
+    self.Fail('conformance2/reading/read-pixels-from-fbo-test.html',
+        ['mac'], bug=483282)
     self.Fail('conformance2/renderbuffers/' +
         'multisampled-renderbuffer-initialization.html',
         ['mac'], bug=483282)
     self.Fail('conformance2/textures/misc/compressed-tex-image.html',
         ['mac'], bug=565438)
-    self.Fail('conformance2/textures/video/*', ['mac'], bug=483282)
     self.Fail('conformance2/textures/misc/gl-get-tex-parameter.html',
         ['mac'], bug=483282)
-    self.Fail('conformance2/textures/misc/texture-npot.html',
-        ['mac'], bug=483282)
     self.Fail('conformance2/textures/misc/tex-storage-compressed-formats.html',
         ['mac'], bug=295792)
     self.Fail('conformance2/renderbuffers/invalidate-framebuffer.html',
@@ -352,14 +351,10 @@
         ['mac'], bug=483282)
     self.Fail('conformance2/renderbuffers/readbuffer.html',
         ['mac'], bug=570453)
-    self.Fail('conformance2/textures/misc/copy-texture-image.html',
-        ['mac'], bug=577144)
     self.Fail('conformance2/textures/misc/tex-storage-and-subimage-3d.html',
         ['mac'], bug=483282)
     self.Fail('conformance2/state/gl-object-get-calls.html',
         ['mac'], bug=483282)
-    self.Fail('conformance2/textures/image_bitmap_from_image/*',
-        ['mac'], bug=589930)
 
     # Mac Retina NVIDIA
     self.Fail('conformance2/rendering/draw-buffers.html',
@@ -388,6 +383,8 @@
         ['linux'], bug=483282)
     self.Fail('conformance2/glsl3/vector-dynamic-indexing.html',
         ['linux'], bug=483282)
+    self.Fail('conformance2/reading/read-pixels-from-fbo-test.html',
+        ['linux'], bug=483282)
     self.Fail('conformance2/rendering/draw-buffers.html',
         ['linux'], bug=483282)
     self.Fail('conformance2/textures/misc/tex-unpack-params.html',

diff --git a/content/test/gpu/gpu_tests/webgl_conformance_expectations.py b/content/test/gpu/gpu_tests/webgl_conformance_expectations.py
index c350d15..ab49d196 100644
--- a/content/test/gpu/gpu_tests/webgl_conformance_expectations.py
+++ b/content/test/gpu/gpu_tests/webgl_conformance_expectations.py

@@ -230,6 +230,10 @@
         ['android'], bug=478572)
     self.Fail('conformance/textures/image/tex-2d-rgb-rgb-unsigned_byte.html',
         ['android'], bug=586183)
+    self.Fail('conformance/textures/misc/texture-npot-video.html',
+        ['android', 'android-content-shell'], bug=601110)
+    self.Fail('conformance/textures/video/*',
+        ['android'], bug=601110)
     # The following tests timed out on android, so skip them for now.
     self.Skip('conformance/textures/image_bitmap_from_video/*',
         ['android'], bug=585108)

diff --git a/docs/android_build_instructions.md b/docs/android_build_instructions.md
index 2e1c7e0..c377207c 100644
--- a/docs/android_build_instructions.md
+++ b/docs/android_build_instructions.md

@@ -75,3 +75,116 @@
  **NOTE:** If you are using the `GYP_DEFINES` environment variable, it
 will override any settings in this file. Either clear it or set it to
 the values above before running `gclient runhooks`.
+
+ See
+[build/android/developer\_recommended\_flags.gypi](https://code.google.com/p/chromium/codesearch#chromium/src/build/android/developer_recommended_flags.gypi&sq=package:chromium&type=cs&q=file:android/developer_recommended_flags.gypi&l=1)
+for other recommended GYP settings.
+ Once chromium.gyp_env is ready, you need to run the following command
+to update projects from gyp files. You may need to run this again when
+you have added new files, updated gyp files, or sync'ed your
+repository.
+
+```shell
+gclient runhooks
+```
+
+#### This will download more things and prompt you to accept Terms of Service for Android SDK packages.
+
+## Configure GN (recommended)
+
+If you are using GN, create a build directory and set the build flags
+with:
+
+```shell
+gn args out/Default
+```
+
+ You can replace out/Default with another name you choose inside the out
+directory. Do not use GYP's out/Debug or out/Release directories, as
+they may conflict with GYP builds.
+
+Also be aware that some scripts (e.g. tombstones.py, adb_gdb.py)
+require you to set `CHROMIUM_OUTPUT_DIR=out/Default`.
+
+This command will bring up your editor with the GN build args. In this
+file add:
+
+```
+target_os = "android"
+target_cpu = "arm"  # (default)
+is_debug = true  # (default)
+
+# Other args you may want to set:
+is_component_build = true
+is_clang = true
+symbol_level = 1  # Faster build with fewer symbols. -g1 rather than -g2
+enable_incremental_javac = true  # Much faster; experimental
+symbol_level = 1 # Faster build with fewer symbols. -g1 rather than -g2
+enable_incremental_javac = true # Much faster; experimental
+```
+
+You can also specify `target_cpu` values of "x86" and "mipsel". Re-run
+gn args on that directory to edit the flags in the future. See the [GN
+build
+configuration](https://www.chromium.org/developers/gn-build-configuration)
+page for other flags you may want to set.
+
+### Install build dependencies
+
+Update the system packages required to build by running:
+
+```shell
+./build/install-build-deps-android.sh
+```
+
+Make also sure that OpenJDK 1.7 is selected as default:
+
+`sudo update-alternatives --config javac`
+`sudo update-alternatives --config java`
+`sudo update-alternatives --config javaws`
+`sudo update-alternatives --config javap`
+`sudo update-alternatives --config jar`
+`sudo update-alternatives --config jarsigner`
+
+### Synchronize sub-directories.
+
+```shell
+gclient sync
+```
+
+## Build and install the APKs
+
+If the `adb_install_apk.py` script below fails, make sure aapt is in
+your PATH. If not, add aapt's path to your PATH environment variable (it
+should be
+`/path/to/src/third_party/android_tools/sdk/build-tools/{latest_version}/`).
+
+Prepare the environment:
+
+```shell
+. build/android/envsetup.sh
+```
+
+### Plug in your Android device
+
+Make sure your Android device is plugged in via USB, and USB Debugging
+is enabled.
+
+To enable USB Debugging:
+
+*   Navigate to Settings \> About Phone \> Build number
+*   Click 'Build number' 7 times
+*   Now navigate back to Settings \> Developer Options
+*   Enable 'USB Debugging' and follow the prompts
+
+You may also be prompted to allow access to your PC once your device is
+plugged in.
+
+You can check if the device is connected by running:
+
+```shell
+third_party/android_tools/sdk/platform-tools/adb devices
+```
+
+Which prints a list of connected devices. If not connected, try
+unplugging and reattaching your device.

diff --git a/gpu/command_buffer/service/gl_stream_texture_image.h b/gpu/command_buffer/service/gl_stream_texture_image.h
index a6a517d..b5bc370c 100644
--- a/gpu/command_buffer/service/gl_stream_texture_image.h
+++ b/gpu/command_buffer/service/gl_stream_texture_image.h

@@ -19,8 +19,18 @@
 
   // Get the matrix.
   // Copy the texture matrix for this image into |matrix|.
+  // Subclasses must return a matrix appropriate for a coordinate system where
+  // UV=(0,0) corresponds to the bottom left corner of the image.
   virtual void GetTextureMatrix(float matrix[16]) = 0;
 
+  // Copy the texture matrix for this image into |matrix|, returning a matrix
+  // for which UV=(0,0) corresponds to the top left of corner of the image,
+  // which is what Chromium generally expects.
+  void GetFlippedTextureMatrix(float matrix[16]) {
+    GetTextureMatrix(matrix);
+    matrix[13] += matrix[5];
+    matrix[5] = -matrix[5];
+  }
  protected:
   ~GLStreamTextureImage() override {}
 

diff --git a/gpu/command_buffer/service/gles2_cmd_copy_texture_chromium.cc b/gpu/command_buffer/service/gles2_cmd_copy_texture_chromium.cc
index 407f1baa..dad3d03 100644
--- a/gpu/command_buffer/service/gles2_cmd_copy_texture_chromium.cc
+++ b/gpu/command_buffer/service/gles2_cmd_copy_texture_chromium.cc

@@ -487,10 +487,39 @@
     return;
   }
 
+  DoCopySubTextureWithTransform(
+      decoder, source_target, source_id, source_internal_format, dest_target,
+      dest_id, dest_internal_format, xoffset, yoffset, x, y, width, height,
+      dest_width, dest_height, source_width, source_height, flip_y,
+      premultiply_alpha, unpremultiply_alpha, kIdentityMatrix);
+}
+
+void CopyTextureCHROMIUMResourceManager::DoCopySubTextureWithTransform(
+    const gles2::GLES2Decoder* decoder,
+    GLenum source_target,
+    GLuint source_id,
+    GLenum source_internal_format,
+    GLenum dest_target,
+    GLuint dest_id,
+    GLenum dest_internal_format,
+    GLint xoffset,
+    GLint yoffset,
+    GLint x,
+    GLint y,
+    GLsizei width,
+    GLsizei height,
+    GLsizei dest_width,
+    GLsizei dest_height,
+    GLsizei source_width,
+    GLsizei source_height,
+    bool flip_y,
+    bool premultiply_alpha,
+    bool unpremultiply_alpha,
+    const GLfloat transform_matrix[16]) {
   DoCopyTextureInternal(decoder, source_target, source_id, dest_target, dest_id,
       xoffset, yoffset, x, y, width, height, dest_width, dest_height,
       source_width, source_height, flip_y, premultiply_alpha,
-      unpremultiply_alpha, kIdentityMatrix);
+      unpremultiply_alpha, transform_matrix);
 }
 
 void CopyTextureCHROMIUMResourceManager::DoCopyTextureWithTransform(

diff --git a/gpu/command_buffer/service/gles2_cmd_copy_texture_chromium.h b/gpu/command_buffer/service/gles2_cmd_copy_texture_chromium.h
index aae3741..95b25a0 100644
--- a/gpu/command_buffer/service/gles2_cmd_copy_texture_chromium.h
+++ b/gpu/command_buffer/service/gles2_cmd_copy_texture_chromium.h

@@ -67,6 +67,28 @@
                         bool premultiply_alpha,
                         bool unpremultiply_alpha);
 
+  void DoCopySubTextureWithTransform(const gles2::GLES2Decoder* decoder,
+                                     GLenum source_target,
+                                     GLuint source_id,
+                                     GLenum source_internal_format,
+                                     GLenum dest_target,
+                                     GLuint dest_id,
+                                     GLenum dest_internal_format,
+                                     GLint xoffset,
+                                     GLint yoffset,
+                                     GLint x,
+                                     GLint y,
+                                     GLsizei width,
+                                     GLsizei height,
+                                     GLsizei dest_width,
+                                     GLsizei dest_height,
+                                     GLsizei source_width,
+                                     GLsizei source_height,
+                                     bool flip_y,
+                                     bool premultiply_alpha,
+                                     bool unpremultiply_alpha,
+                                     const GLfloat transform_matrix[16]);
+
   // This will apply a transform on the texture coordinates before sampling
   // the source texture and copying to the destination texture. The transform
   // matrix should be given in column-major form, so it can be passed

diff --git a/gpu/command_buffer/service/gles2_cmd_decoder.cc b/gpu/command_buffer/service/gles2_cmd_decoder.cc
index d9381f2..f28cc43 100644
--- a/gpu/command_buffer/service/gles2_cmd_decoder.cc
+++ b/gpu/command_buffer/service/gles2_cmd_decoder.cc

@@ -13911,34 +13911,29 @@
 
   DoCopyTexImageIfNeeded(source_texture, source_target);
 
-  // GL_TEXTURE_EXTERNAL_OES texture requires apply a transform matrix
+  // GL_TEXTURE_EXTERNAL_OES texture requires that we apply a transform matrix
   // before presenting.
   if (source_target == GL_TEXTURE_EXTERNAL_OES) {
-    // TODO(hkuang): get the StreamTexture transform matrix in GPU process
-    // instead of using kIdentityMatrix crbug.com/226218.  AVDACodecImage does
-    // this correctly, but others (e.g., stream_texture_android.cc) don't.
-    // (crbug.com/371500, crbug.com/588837)
-    GLfloat transform_matrix[16];
-    memcpy(transform_matrix, kIdentityMatrix, sizeof(transform_matrix));
     if (GLStreamTextureImage* image =
             source_texture->GetLevelStreamTextureImage(GL_TEXTURE_EXTERNAL_OES,
                                                        0)) {
-      image->GetTextureMatrix(transform_matrix);
+      // The coordinate system of this matrix is y-up, not y-down, so a flip is
+      // needed.
+      GLfloat transform_matrix[16];
+      image->GetFlippedTextureMatrix(transform_matrix);
+      copy_texture_CHROMIUM_->DoCopyTextureWithTransform(
+          this, source_target, source_texture->service_id(), dest_target,
+          dest_texture->service_id(), source_width, source_height,
+          unpack_flip_y == GL_TRUE, unpack_premultiply_alpha == GL_TRUE,
+          unpack_unmultiply_alpha == GL_TRUE, transform_matrix);
+      return;
     }
-    copy_texture_CHROMIUM_->DoCopyTextureWithTransform(
-        this, source_target, source_texture->service_id(), dest_target,
-        dest_texture->service_id(), source_width, source_height,
-        unpack_flip_y == GL_TRUE, unpack_premultiply_alpha == GL_TRUE,
-        unpack_unmultiply_alpha == GL_TRUE, transform_matrix);
-  } else {
-    copy_texture_CHROMIUM_->DoCopyTexture(
-        this, source_target, source_texture->service_id(),
-        source_internal_format, dest_target, dest_texture->service_id(),
-        internal_format, source_width, source_height,
-        unpack_flip_y == GL_TRUE,
-        unpack_premultiply_alpha == GL_TRUE,
-        unpack_unmultiply_alpha == GL_TRUE);
   }
+  copy_texture_CHROMIUM_->DoCopyTexture(
+      this, source_target, source_texture->service_id(), source_internal_format,
+      dest_target, dest_texture->service_id(), internal_format, source_width,
+      source_height, unpack_flip_y == GL_TRUE,
+      unpack_premultiply_alpha == GL_TRUE, unpack_unmultiply_alpha == GL_TRUE);
 }
 
 void GLES2DecoderImpl::DoCopySubTextureCHROMIUM(
@@ -14109,16 +14104,33 @@
 
   DoCopyTexImageIfNeeded(source_texture, source_target);
 
-  // TODO(hkuang): get the StreamTexture transform matrix in GPU process.
-  // crbug.com/226218.
+
+  // GL_TEXTURE_EXTERNAL_OES texture requires apply a transform matrix
+  // before presenting.
+  if (source_target == GL_TEXTURE_EXTERNAL_OES) {
+    if (GLStreamTextureImage* image =
+            source_texture->GetLevelStreamTextureImage(GL_TEXTURE_EXTERNAL_OES,
+                                                       0)) {
+      // The coordinate system of this matrix is y-up, not y-down, so a flip is
+      // needed.
+      GLfloat transform_matrix[16];
+      image->GetFlippedTextureMatrix(transform_matrix);
+      copy_texture_CHROMIUM_->DoCopySubTextureWithTransform(
+          this, source_target, source_texture->service_id(),
+          source_internal_format, dest_target, dest_texture->service_id(),
+          dest_internal_format, xoffset, yoffset, x, y, width, height,
+          dest_width, dest_height, source_width, source_height,
+          unpack_flip_y == GL_TRUE, unpack_premultiply_alpha == GL_TRUE,
+          unpack_unmultiply_alpha == GL_TRUE, transform_matrix);
+      return;
+    }
+  }
   copy_texture_CHROMIUM_->DoCopySubTexture(
       this, source_target, source_texture->service_id(), source_internal_format,
-      dest_target, dest_texture->service_id(), dest_internal_format,
-      xoffset, yoffset, x, y, width, height, dest_width, dest_height,
-      source_width, source_height,
-      unpack_flip_y == GL_TRUE,
-      unpack_premultiply_alpha == GL_TRUE,
-      unpack_unmultiply_alpha == GL_TRUE);
+      dest_target, dest_texture->service_id(), dest_internal_format, xoffset,
+      yoffset, x, y, width, height, dest_width, dest_height, source_width,
+      source_height, unpack_flip_y == GL_TRUE,
+      unpack_premultiply_alpha == GL_TRUE, unpack_unmultiply_alpha == GL_TRUE);
 }
 
 void GLES2DecoderImpl::DoCompressedCopyTextureCHROMIUM(GLuint source_id,
@@ -14279,22 +14291,11 @@
       source_height, 1, 0, GL_RGBA, GL_UNSIGNED_BYTE,
       gfx::Rect(source_width, source_height));
 
-  // GL_TEXTURE_EXTERNAL_OES texture requires apply a transform matrix
-  // before presenting.
-  if (source_texture->target() == GL_TEXTURE_EXTERNAL_OES) {
-    // TODO(hkuang): get the StreamTexture transform matrix in GPU process
-    // instead of using kIdentityMatrix crbug.com/226218.
-    copy_texture_CHROMIUM_->DoCopyTextureWithTransform(
-        this, source_texture->target(), source_texture->service_id(),
-        dest_texture->target(), dest_texture->service_id(), source_width,
-        source_height, false, false, false, kIdentityMatrix);
-  } else {
-    copy_texture_CHROMIUM_->DoCopyTexture(
-        this, source_texture->target(), source_texture->service_id(),
-        source_internal_format, dest_texture->target(),
-        dest_texture->service_id(), GL_RGBA, source_width, source_height, false,
-        false, false);
-  }
+  copy_texture_CHROMIUM_->DoCopyTexture(
+      this, source_texture->target(), source_texture->service_id(),
+      source_internal_format, dest_texture->target(),
+      dest_texture->service_id(), GL_RGBA, source_width, source_height, false,
+      false, false);
 }
 
 void GLES2DecoderImpl::DoTexStorage2DEXT(

diff --git a/gpu/ipc/common/gpu_messages.h b/gpu/ipc/common/gpu_messages.h
index 634f3e8..449d151 100644
--- a/gpu/ipc/common/gpu_messages.h
+++ b/gpu/ipc/common/gpu_messages.h

@@ -70,27 +70,6 @@
   IPC_STRUCT_MEMBER(uint64_t, image_release_count)
 IPC_STRUCT_END()
 
-#if defined(OS_ANDROID)
-IPC_STRUCT_BEGIN(GpuStreamTextureMsg_MatrixChanged_Params)
-  IPC_STRUCT_MEMBER(float, m00)
-  IPC_STRUCT_MEMBER(float, m01)
-  IPC_STRUCT_MEMBER(float, m02)
-  IPC_STRUCT_MEMBER(float, m03)
-  IPC_STRUCT_MEMBER(float, m10)
-  IPC_STRUCT_MEMBER(float, m11)
-  IPC_STRUCT_MEMBER(float, m12)
-  IPC_STRUCT_MEMBER(float, m13)
-  IPC_STRUCT_MEMBER(float, m20)
-  IPC_STRUCT_MEMBER(float, m21)
-  IPC_STRUCT_MEMBER(float, m22)
-  IPC_STRUCT_MEMBER(float, m23)
-  IPC_STRUCT_MEMBER(float, m30)
-  IPC_STRUCT_MEMBER(float, m31)
-  IPC_STRUCT_MEMBER(float, m32)
-  IPC_STRUCT_MEMBER(float, m33)
-IPC_STRUCT_END()
-#endif
-
 //------------------------------------------------------------------------------
 // GPU Channel Messages
 // These are messages from a renderer process to the GPU process.
@@ -141,10 +120,6 @@
 
 // Inform the renderer that a new frame is available.
 IPC_MESSAGE_ROUTED0(GpuStreamTextureMsg_FrameAvailable)
-
-// Inform the renderer process that the transform matrix has changed.
-IPC_MESSAGE_ROUTED1(GpuStreamTextureMsg_MatrixChanged,
-                    GpuStreamTextureMsg_MatrixChanged_Params /* params */)
 #endif
 
 //------------------------------------------------------------------------------

diff --git a/headless/BUILD.gn b/headless/BUILD.gn
index 0f59cabd..c035c259 100644
--- a/headless/BUILD.gn
+++ b/headless/BUILD.gn

@@ -84,6 +84,7 @@
     "public/headless_browser.h",
     "public/headless_export.h",
     "public/headless_web_contents.h",
+    "public/util/maybe.h",
   ]
 
   deps = [
@@ -110,6 +111,19 @@
 
   deps = [
     ":headless_browsertests",
+    ":headless_unittests",
+  ]
+}
+
+test("headless_unittests") {
+  sources = [
+    "public/util/maybe_unittest.cc",
+  ]
+
+  deps = [
+    "//base/test:run_all_unittests",
+    "//base/test:test_support",
+    "//testing/gtest",
   ]
 }
 

diff --git a/headless/public/util/maybe.h b/headless/public/util/maybe.h
new file mode 100644
index 0000000..18540a36
--- /dev/null
+++ b/headless/public/util/maybe.h

@@ -0,0 +1,92 @@
+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef HEADLESS_PUBLIC_UTIL_MAYBE_H_
+#define HEADLESS_PUBLIC_UTIL_MAYBE_H_
+
+#include <algorithm>
+
+#include "base/logging.h"
+#include "base/macros.h"
+
+namespace headless {
+
+// A simple Maybe which may or may not have a value. Based on v8::Maybe.
+template <typename T>
+class Maybe {
+ public:
+  Maybe() : has_value_(false) {}
+
+  bool IsNothing() const { return !has_value_; }
+  bool IsJust() const { return has_value_; }
+
+  // Will crash if the Maybe<> is nothing.
+  T& FromJust() {
+    DCHECK(IsJust());
+    return value_;
+  }
+  const T& FromJust() const {
+    DCHECK(IsJust());
+    return value_;
+  }
+
+  T FromMaybe(const T& default_value) const {
+    return has_value_ ? value_ : default_value;
+  }
+
+  bool operator==(const Maybe& other) const {
+    return (IsJust() == other.IsJust()) &&
+           (!IsJust() || FromJust() == other.FromJust());
+  }
+
+  bool operator!=(const Maybe& other) const { return !operator==(other); }
+
+  Maybe& operator=(Maybe&& other) {
+    has_value_ = other.has_value_;
+    value_ = std::move(other.value_);
+    return *this;
+  }
+
+  Maybe& operator=(const Maybe& other) {
+    has_value_ = other.has_value_;
+    value_ = other.value_;
+    return *this;
+  }
+
+  Maybe(const Maybe& other) = default;
+  Maybe(Maybe&& other) = default;
+
+ private:
+  template <class U>
+  friend Maybe<U> Nothing();
+  template <class U>
+  friend Maybe<U> Just(const U& u);
+  template <class U>
+  friend Maybe<typename std::remove_reference<U>::type> Just(U&& u);
+
+  explicit Maybe(const T& t) : has_value_(true), value_(t) {}
+  explicit Maybe(T&& t) : has_value_(true), value_(std::move(t)) {}
+
+  bool has_value_;
+  T value_;
+};
+
+template <class T>
+Maybe<T> Nothing() {
+  return Maybe<T>();
+}
+
+template <class T>
+Maybe<T> Just(const T& t) {
+  return Maybe<T>(t);
+}
+
+template <class T>
+Maybe<typename std::remove_reference<T>::type> Just(T&& t) {
+  return Maybe<typename std::remove_reference<T>::type>(std::move(t));
+}
+
+}  // namespace headless
+
+#endif  // HEADLESS_PUBLIC_UTIL_MAYBE_H_

diff --git a/headless/public/util/maybe_unittest.cc b/headless/public/util/maybe_unittest.cc
new file mode 100644
index 0000000..fb926961
--- /dev/null
+++ b/headless/public/util/maybe_unittest.cc

@@ -0,0 +1,83 @@
+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "headless/public/util/maybe.h"
+#include "testing/gtest/include/gtest/gtest.h"
+
+namespace headless {
+namespace {
+
+class MoveOnlyType {
+ public:
+  MoveOnlyType() {}
+  MoveOnlyType(MoveOnlyType&& other) {}
+
+  void operator=(MoveOnlyType&& other) {}
+
+ private:
+  DISALLOW_COPY_AND_ASSIGN(MoveOnlyType);
+};
+
+}  // namespace
+
+TEST(MaybeTest, Nothing) {
+  Maybe<int> maybe;
+  EXPECT_TRUE(maybe.IsNothing());
+  EXPECT_FALSE(maybe.IsJust());
+}
+
+TEST(MaybeTest, Just) {
+  Maybe<int> maybe = Just(1);
+  EXPECT_FALSE(maybe.IsNothing());
+  EXPECT_TRUE(maybe.IsJust());
+  EXPECT_EQ(1, maybe.FromJust());
+
+  const Maybe<int> const_maybe = Just(2);
+  EXPECT_EQ(2, const_maybe.FromJust());
+}
+
+TEST(MaybeTest, Equality) {
+  Maybe<int> a;
+  Maybe<int> b;
+  EXPECT_EQ(a, b);
+  EXPECT_EQ(b, a);
+
+  a = Just(1);
+  EXPECT_NE(a, b);
+  EXPECT_NE(b, a);
+
+  b = Just(2);
+  EXPECT_NE(a, b);
+  EXPECT_NE(b, a);
+
+  b = Just(1);
+  EXPECT_EQ(a, b);
+  EXPECT_EQ(b, a);
+}
+
+TEST(MaybeTest, Assignment) {
+  Maybe<int> a = Just(1);
+  Maybe<int> b = Nothing<int>();
+  EXPECT_NE(a, b);
+
+  b = a;
+  EXPECT_EQ(a, b);
+}
+
+TEST(MaybeTest, MoveOnlyType) {
+  MoveOnlyType value;
+  Maybe<MoveOnlyType> a = Just(std::move(value));
+  EXPECT_TRUE(a.IsJust());
+
+  Maybe<MoveOnlyType> b = Just(MoveOnlyType());
+  EXPECT_TRUE(b.IsJust());
+
+  Maybe<MoveOnlyType> c = Nothing<MoveOnlyType>();
+  c = std::move(a);
+  EXPECT_TRUE(c.IsJust());
+
+  MoveOnlyType d = std::move(b.FromJust());
+}
+
+}  // namespace headless

diff --git a/ios/web/BUILD.gn b/ios/web/BUILD.gn
index f4bcbd11..08e6eb2 100644
--- a/ios/web/BUILD.gn
+++ b/ios/web/BUILD.gn

@@ -64,8 +64,6 @@
     "net/cert_verifier_block_adapter.cc",
     "net/cert_verifier_block_adapter.h",
     "net/certificate_policy_cache.cc",
-    "net/clients/crw_csp_network_client.h",
-    "net/clients/crw_csp_network_client.mm",
     "net/clients/crw_js_injection_network_client.h",
     "net/clients/crw_js_injection_network_client.mm",
     "net/clients/crw_js_injection_network_client_factory.h",
@@ -81,8 +79,6 @@
     "net/crw_request_tracker_delegate.h",
     "net/crw_ssl_status_updater.h",
     "net/crw_ssl_status_updater.mm",
-    "net/crw_url_verifying_protocol_handler.h",
-    "net/crw_url_verifying_protocol_handler.mm",
     "net/request_group_util.h",
     "net/request_group_util.mm",
     "net/request_tracker_data_memoizing_store.h",
@@ -374,11 +370,9 @@
     "net/cert_host_pair_unittest.cc",
     "net/cert_policy_unittest.cc",
     "net/cert_verifier_block_adapter_unittest.cc",
-    "net/clients/crw_csp_network_client_unittest.mm",
     "net/clients/crw_js_injection_network_client_unittest.mm",
     "net/crw_cert_verification_controller_unittest.mm",
     "net/crw_ssl_status_updater_unittest.mm",
-    "net/crw_url_verifying_protocol_handler_unittest.mm",
     "net/request_group_util_unittest.mm",
     "net/request_tracker_impl_unittest.mm",
     "net/web_http_protocol_handler_delegate_unittest.mm",

diff --git a/ios/web/ios_web.gyp b/ios/web/ios_web.gyp
index f2aa4b0..58a4a9d8 100644
--- a/ios/web/ios_web.gyp
+++ b/ios/web/ios_web.gyp

@@ -100,8 +100,6 @@
         'net/cert_verifier_block_adapter.cc',
         'net/cert_verifier_block_adapter.h',
         'net/certificate_policy_cache.cc',
-        'net/clients/crw_csp_network_client.h',
-        'net/clients/crw_csp_network_client.mm',
         'net/clients/crw_js_injection_network_client.h',
         'net/clients/crw_js_injection_network_client.mm',
         'net/clients/crw_js_injection_network_client_factory.h',
@@ -117,8 +115,6 @@
         'net/crw_request_tracker_delegate.h',
         'net/crw_ssl_status_updater.h',
         'net/crw_ssl_status_updater.mm',
-        'net/crw_url_verifying_protocol_handler.h',
-        'net/crw_url_verifying_protocol_handler.mm',
         'net/request_group_util.h',
         'net/request_group_util.mm',
         'net/request_tracker_data_memoizing_store.h',

diff --git a/ios/web/ios_web_unittests.gyp b/ios/web/ios_web_unittests.gyp
index 64285fed..983f482 100644
--- a/ios/web/ios_web_unittests.gyp
+++ b/ios/web/ios_web_unittests.gyp

@@ -36,11 +36,9 @@
         'net/cert_host_pair_unittest.cc',
         'net/cert_policy_unittest.cc',
         'net/cert_verifier_block_adapter_unittest.cc',
-        'net/clients/crw_csp_network_client_unittest.mm',
         'net/clients/crw_js_injection_network_client_unittest.mm',
         'net/crw_cert_verification_controller_unittest.mm',
         'net/crw_ssl_status_updater_unittest.mm',
-        'net/crw_url_verifying_protocol_handler_unittest.mm',
         'net/request_group_util_unittest.mm',
         'net/request_tracker_impl_unittest.mm',
         'net/web_http_protocol_handler_delegate_unittest.mm',

diff --git a/ios/web/net/clients/crw_csp_network_client.h b/ios/web/net/clients/crw_csp_network_client.h
deleted file mode 100644
index da72cdc..0000000
--- a/ios/web/net/clients/crw_csp_network_client.h
+++ /dev/null

@@ -1,13 +0,0 @@
-// Copyright 2014 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef IOS_WEB_NET_CLIENTS_CRW_CSP_NETWORK_CLIENT_H_
-#define IOS_WEB_NET_CLIENTS_CRW_CSP_NETWORK_CLIENT_H_
-
-#import "ios/net/clients/crn_forwarding_network_client.h"
-
-@interface CRWCspNetworkClient : CRNForwardingNetworkClient
-@end
-
-#endif  // IOS_WEB_NET_CLIENTS_CRW_CSP_NETWORK_CLIENT_H_

diff --git a/ios/web/net/clients/crw_csp_network_client.mm b/ios/web/net/clients/crw_csp_network_client.mm
deleted file mode 100644
index 2f2a72c..0000000
--- a/ios/web/net/clients/crw_csp_network_client.mm
+++ /dev/null

@@ -1,138 +0,0 @@
-// Copyright 2014 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#import "ios/web/net/clients/crw_csp_network_client.h"
-
-#import <Foundation/Foundation.h>
-#include <stddef.h>
-
-#include "base/logging.h"
-#include "base/mac/scoped_nsobject.h"
-#include "base/macros.h"
-#import "ios/web/net/crw_url_verifying_protocol_handler.h"
-
-namespace {
-
-// HTTP headers for the content security policy.
-NSString* const kCSPHeaders[] {
-  @"Content-Security-Policy", @"Content-Security-Policy-Report-Only",
-      @"X-WebKit-CSP", @"X-WebKit-CSP-Report-Only"
-};
-
-NSString* const kDefaultSrc = @"default-src";
-NSString* const kConnectSrc = @"connect-src";
-NSString* const kSelf = @"'self'";
-NSString* const kFrameSrc = @"frame-src";
-NSString* const kFrameValue = @" crwebinvoke: crwebinvokeimmediate: crwebnull:";
-
-// Value of the 'connect-src' directive for the Content Security Policy.
-// Lazily initialized.
-NSString* g_connect_value = nil;
-
-// Adds |value| (i.e. 'self') to the CSP |directive| (i.e. 'frame-src').
-// |header| is the value of the 'Content-Security-Policy' header and is modified
-// by the function.
-// If |directive| is not in the CSP, the function checks for 'default-src' and
-// adds |value| there if needed.
-void RelaxCspValue(NSString* directive,
-                            NSString* value,
-                            NSMutableString* header) {
-  DCHECK(directive);
-  DCHECK(value);
-  DCHECK(header);
-  // The function is sub-optimal if the directive is 'default-src' as we could
-  // skip one of the calls to |-rangeOfString:options:| in that case.
-  // Please consider improving the implementation if you need to support this.
-  DCHECK(![directive isEqualToString:kDefaultSrc]);
-
-  // If |directive| is already present in |header|, |value| is prepended to the
-  // existing value.
-  NSRange range =
-      [header rangeOfString:directive options:NSCaseInsensitiveSearch];
-  if (range.location == NSNotFound) {
-    // Else, if the 'default-src' directive is present, |value| is prepended to
-    // the existing value of "default-src".
-    range = [header rangeOfString:kDefaultSrc options:NSCaseInsensitiveSearch];
-  }
-
-  if (range.location != NSNotFound) {
-    [header insertString:value atIndex:NSMaxRange(range)];
-    return;
-  }
-
-  // Else, there is no |directive| and no 'default-src', nothing to do.
-}
-
-}  // namespace
-
-@implementation CRWCspNetworkClient
-
-- (void)didReceiveResponse:(NSURLResponse*)response {
-  if (![response isKindOfClass:[NSHTTPURLResponse class]]) {
-    [super didReceiveResponse:response];
-    return;
-  }
-
-  NSHTTPURLResponse* httpResponse = static_cast<NSHTTPURLResponse*>(response);
-  base::scoped_nsobject<NSDictionary> inputHeaders(
-      [[httpResponse allHeaderFields] retain]);
-
-  // Enumerate the headers and return early if there is nothing to do.
-  bool hasCspHeader = false;
-  for (NSString* key in inputHeaders.get()) {
-    for (size_t i = 0; i < arraysize(kCSPHeaders); ++i) {
-      if ([key caseInsensitiveCompare:kCSPHeaders[i]] == NSOrderedSame) {
-        hasCspHeader = true;
-        break;
-      }
-    }
-    if (hasCspHeader)
-      break;
-  }
-
-  if (!hasCspHeader) {
-    // No CSP header, return early.
-    [super didReceiveResponse:response];
-    return;
-  }
-
-  if (!g_connect_value) {
-    g_connect_value = [[NSString alloc]
-        initWithFormat:@" %@ %s", kSelf, web::kURLForVerification];
-  }
-
-  base::scoped_nsobject<NSMutableDictionary> outputHeaders(
-      [[NSMutableDictionary alloc] init]);
-
-  // Add some values to the content security policy headers in order to keep the
-  // URL verification and the javascript injection working.
-  for (NSString* key in inputHeaders.get()) {
-    base::scoped_nsobject<NSString> header(
-        [[inputHeaders objectForKey:key] retain]);
-    for (size_t i = 0; i < arraysize(kCSPHeaders); ++i) {
-      if ([key caseInsensitiveCompare:kCSPHeaders[i]] != NSOrderedSame)
-        continue;
-      base::scoped_nsobject<NSMutableString> cspHeader(
-          [[NSMutableString alloc] initWithString:header]);
-      // Fix connect-src.
-      RelaxCspValue(kConnectSrc, g_connect_value, cspHeader);
-      // Fix frame-src.
-      RelaxCspValue(kFrameSrc, kFrameValue, cspHeader);
-      header.reset([cspHeader retain]);
-      break;
-    }
-    DCHECK(![outputHeaders objectForKey:key]);
-    [outputHeaders setObject:header forKey:key];
-  }
-
-  // Build a new response with |outputHeaders|.
-  base::scoped_nsobject<NSHTTPURLResponse> outResponse(
-      [[NSHTTPURLResponse alloc] initWithURL:[httpResponse URL]
-                                  statusCode:[httpResponse statusCode]
-                                 HTTPVersion:@"HTTP/1.1"
-                                headerFields:outputHeaders]);
-  [super didReceiveResponse:outResponse];
-}
-
-@end

diff --git a/ios/web/net/clients/crw_csp_network_client_unittest.mm b/ios/web/net/clients/crw_csp_network_client_unittest.mm
deleted file mode 100644
index 29c51238..0000000
--- a/ios/web/net/clients/crw_csp_network_client_unittest.mm
+++ /dev/null

@@ -1,129 +0,0 @@
-// Copyright 2014 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#import "ios/web/net/clients/crw_csp_network_client.h"
-
-#import <Foundation/Foundation.h>
-
-#include "base/mac/scoped_nsobject.h"
-#import "ios/net/clients/crn_forwarding_network_client.h"
-#import "ios/web/net/crw_url_verifying_protocol_handler.h"
-#include "ios/web/public/test/test_web_thread_bundle.h"
-#include "testing/gtest/include/gtest/gtest.h"
-#include "testing/gtest_mac.h"
-
-@interface CRWCspMockClient : CRNForwardingNetworkClient
-@end
-
-@implementation CRWCspMockClient {
-  base::scoped_nsobject<NSURLResponse> _response;
-}
-
-- (void)didReceiveResponse:(NSURLResponse*)response {
-  _response.reset([response retain]);
-}
-
-- (NSURLResponse*)response {
-  return _response;
-}
-
-@end
-
-class CRWCspNetworkClientTest : public testing::Test {
- public:
-  CRWCspNetworkClientTest() {
-    mock_client_.reset([[CRWCspMockClient alloc] init]);
-    csp_client_.reset([[CRWCspNetworkClient alloc] init]);
-    [csp_client_ setUnderlyingClient:mock_client_];
-  }
-
-  web::TestWebThreadBundle thread_bundle_;
-  base::scoped_nsobject<CRWCspNetworkClient> csp_client_;
-  base::scoped_nsobject<CRWCspMockClient> mock_client_;
-};
-
-TEST_F(CRWCspNetworkClientTest, FixCspHeaders) {
-  base::scoped_nsobject<NSDictionary> input_headers([@{
-    @"Foo" : @"Bar",
-    @"coNteNt-seCuRity-POLicy" : @"coNNect-sRc foo.com; script-src 'self'",
-    @"X-WebKit-CSP" : @"frame-src 'self'"
-  } retain]);
-
-  base::scoped_nsobject<NSHTTPURLResponse> input_response(
-      [[NSHTTPURLResponse alloc] initWithURL:[NSURL URLWithString:@"http://foo"]
-                                  statusCode:200
-                                 HTTPVersion:@"HTTP/1.1"
-                                headerFields:input_headers]);
-
-  [csp_client_ didReceiveResponse:input_response];
-  ASSERT_TRUE(
-      [[mock_client_ response] isKindOfClass:[NSHTTPURLResponse class]]);
-  base::scoped_nsobject<NSDictionary> output_headers(
-      [[static_cast<NSHTTPURLResponse*>([mock_client_ response])
-          allHeaderFields] retain]);
-
-  // Check that unrelated headers are copied.
-  EXPECT_NSEQ(@"Bar", [output_headers objectForKey:@"Foo"]);
-
-  base::scoped_nsobject<NSString> csp_header(
-      [[output_headers objectForKey:@"coNteNt-seCuRity-POLicy"] retain]);
-
-  EXPECT_TRUE(csp_header.get());
-
-  // frame-src is not created because there were no frame-src and no
-  // default-src.
-  // 'self' and |kURLForVerification| are prepended to the connect-src value.
-  NSString* expected_csp_header = [NSString stringWithFormat:
-      @"coNNect-sRc 'self' %s foo.com; " @"script-src 'self'",
-      web::kURLForVerification];
-  EXPECT_NSEQ(expected_csp_header, csp_header);
-
-  // X-WebKit-CSP is handled as well.
-  // crwebinvoke: crwebinvokeimmediate: and crwebnull: are prepended to the
-  // existing frame-src value.
-  // connect-src is not created because there were no connect-src and no
-  // default-src.
-  csp_header.reset([[output_headers objectForKey:@"X-WebKit-CSP"] retain]);
-  EXPECT_NSEQ(@"frame-src crwebinvoke: crwebinvokeimmediate: crwebnull: 'self'",
-              csp_header);
-}
-
-TEST_F(CRWCspNetworkClientTest, FixCspHeadersWithDefault) {
-  base::scoped_nsobject<NSDictionary> input_headers([@{
-    @"Content-Security-Policy" : @"default-src foo.com; connect-src *"
-  } retain]);
-
-  base::scoped_nsobject<NSHTTPURLResponse> input_response(
-      [[NSHTTPURLResponse alloc] initWithURL:[NSURL URLWithString:@"http://foo"]
-                                  statusCode:200
-                                 HTTPVersion:@"HTTP/1.1"
-                                headerFields:input_headers]);
-
-  [csp_client_ didReceiveResponse:input_response];
-  ASSERT_TRUE(
-      [[mock_client_ response] isKindOfClass:[NSHTTPURLResponse class]]);
-  base::scoped_nsobject<NSDictionary> output_headers(
-      [[static_cast<NSHTTPURLResponse*>([mock_client_ response])
-          allHeaderFields] retain]);
-
-  base::scoped_nsobject<NSString> csp_header(
-      [[output_headers objectForKey:@"Content-Security-Policy"] retain]);
-
-  EXPECT_TRUE(csp_header.get());
-
-  // crwebinvoke: crwebinvokeimmediate: and crwebnull: are prepended to the
-  // existing default-src value because there was no frame-src.
-  // 'self' and |kURLForVerification| are prepended to the connect-src value.
-  NSString* expected_csp_header = [NSString stringWithFormat:
-      @"default-src crwebinvoke: crwebinvokeimmediate: crwebnull: foo.com; "
-      @"connect-src 'self' %s *", web::kURLForVerification];
-  EXPECT_NSEQ(expected_csp_header, csp_header);
-}
-
-TEST_F(CRWCspNetworkClientTest, NonHTTPResponse) {
-  base::scoped_nsobject<NSURLResponse> response([[NSURLResponse alloc] init]);
-  [csp_client_ didReceiveResponse:response];
-  // The client is a pass-through, compare the pointers.
-  EXPECT_EQ(response, [mock_client_ response]);
-}

diff --git a/ios/web/net/crw_url_verifying_protocol_handler.h b/ios/web/net/crw_url_verifying_protocol_handler.h
deleted file mode 100644
index ea6d31e..0000000
--- a/ios/web/net/crw_url_verifying_protocol_handler.h
+++ /dev/null

@@ -1,42 +0,0 @@
-// Copyright 2012 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef IOS_WEB_NET_CRW_URL_VERIFYING_PROTOCOL_HANDLER_H_
-#define IOS_WEB_NET_CRW_URL_VERIFYING_PROTOCOL_HANDLER_H_
-
-#import <UIKit/UIKit.h>
-
-#include "ios/web/public/web_state/url_verification_constants.h"
-
-class GURL;
-
-namespace web {
-
-// The URL used for verification. Requests to this URL must not be blocked (by
-// Content Security Policy for example).
-extern const char kURLForVerification[];
-
-}  // namespace web
-
-// Protocol handler used to verify that a site is not trying to spoof its URL.
-// This handler will handle a specific URL, and use [NSURLRequest
-// mainDocumentURL] on this request to check that the url returned by
-// window.location.href has the same origin as the URL that webkit knows about.
-@interface CRWURLVerifyingProtocolHandler : NSURLProtocol
-
-// Returns the URL of the given UIWebView. Moreover, this method will set the
-// trustLevel enum to the appropriate level from a security point of view. This
-// method will execute JavaScript on the UIWebView and must not be called from
-// inside a javascript execution context.
-+ (GURL)currentURLForWebView:(UIWebView*)webView
-    trustLevel:(web::URLVerificationTrustLevel*)trustLevel;
-
-// Class initialization function that should be called as early as possible to
-// initialize and thus reduce overhead when this class is first called.
-// Returns YES if initialization completed.
-+ (BOOL)preInitialize;
-
-@end
-
-#endif  // IOS_WEB_NET_CRW_URL_VERIFYING_PROTOCOL_HANDLER_H_

diff --git a/ios/web/net/crw_url_verifying_protocol_handler.mm b/ios/web/net/crw_url_verifying_protocol_handler.mm
deleted file mode 100644
index 67cfbe5..0000000
--- a/ios/web/net/crw_url_verifying_protocol_handler.mm
+++ /dev/null

@@ -1,315 +0,0 @@
-// Copyright 2012 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#import "ios/web/net/crw_url_verifying_protocol_handler.h"
-
-#include "base/ios/ios_util.h"
-#include "base/logging.h"
-#include "base/mac/scoped_nsobject.h"
-#include "base/metrics/histogram.h"
-#include "base/strings/sys_string_conversions.h"
-#include "base/time/time.h"
-#include "ios/web/public/web_client.h"
-#import "ios/web/web_state/web_view_internal_creation_util.h"
-#import "net/base/mac/url_conversions.h"
-#include "url/gurl.h"
-
-// A private singleton object to hold all shared flags/data used by
-// CRWURLVerifyingProtocolHandler.
-@interface CRWURLVerifyingProtocolHandlerData : NSObject {
- @private
-  // Flag to remember that class has been pre-initialized.
-  BOOL _preInitialized;
-  // Contains the last seen URL by the constructor of the ProtocolHandler.
-  // This must only be accessed from the main thread.
-  GURL _lastSeenURL;
-  // On iOS8, |+canInitWithRequest| is not called on the main thread. Thus the
-  // url check is run in |-initWithRequest| instead. See crbug.com/380768.
-  // TODO(droger): Run the check at the same place on all versions.
-  BOOL _runInInitWithRequest;
-}
-@property(nonatomic, assign) BOOL preInitialized;
-@property(nonatomic, readonly) BOOL runInInitWithRequest;
-// Returns the global CRWURLVerifyingProtocolHandlerData instance.
-+ (CRWURLVerifyingProtocolHandlerData*)sharedInstance;
-// If there is a URL saved as "last seen URL", return it as an autoreleased
-// object. |newURL| is now saved as the "last seen URL".
-- (GURL)swapLastSeenURL:(const GURL&)newURL;
-@end
-
-@implementation CRWURLVerifyingProtocolHandlerData
-@synthesize preInitialized = _preInitialized;
-@synthesize runInInitWithRequest = _runInInitWithRequest;
-
-+ (CRWURLVerifyingProtocolHandlerData*)sharedInstance {
-  static CRWURLVerifyingProtocolHandlerData* instance =
-      [[CRWURLVerifyingProtocolHandlerData alloc] init];
-  return instance;
-}
-
-- (GURL)swapLastSeenURL:(const GURL&)newURL {
-  // Note that release() does *not* call release on oldURL.
-  const GURL oldURL(_lastSeenURL);
-  _lastSeenURL = newURL;
-  return oldURL;
-}
-
-- (instancetype)init {
-  if (self = [super init]) {
-    _runInInitWithRequest = base::ios::IsRunningOnIOS8OrLater();
-  }
-  return self;
-}
-
-@end
-
-namespace web {
-
-// The special URL used to communicate between the JavaScript and this handler.
-// This has to be a http request, because Ajax request can only be cross origin
-// for http and https schemes. localhost:0 is used because no sane URL should
-// use this. A relative URL is also used if the first request fails, because
-// HTTP servers can use headers to prevent arbitrary ajax requests.
-const char kURLForVerification[] = "https://localhost:0/crwebiossecurity";
-
-}  // namespace web
-
-namespace {
-
-// This URL has been chosen with a specific prefix, and a random suffix to
-// prevent accidental collision.
-const char kCheckRelativeURL[] =
-    "/crwebiossecurity/b86b97a1-2ce0-44fd-a074-e2158790c98d";
-
-}  // namespace
-
-@interface CRWURLVerifyingProtocolHandler () {
-  // The URL of the request to handle.
-  base::scoped_nsobject<NSURL> _url;
-}
-
-// Returns the JavaScript to execute to check URL.
-+ (NSString*)checkURLJavaScript;
-// Implements the logic for verifying the current URL for the given
-// |webView|. This is the internal implementation for the public interface
-// of +currentURLForWebView:trustLevel:.
-+ (GURL)internalCurrentURLForWebView:(UIWebView*)webView
-    trustLevel:(web::URLVerificationTrustLevel*)trustLevel;
-// Updates the last seen URL to be the mainDocumentURL of |request|.
-+ (void)updateLastSeenUrl:(NSURLRequest*)request;
-@end
-
-@implementation CRWURLVerifyingProtocolHandler
-
-+ (NSString*)checkURLJavaScript {
-  static base::scoped_nsobject<NSString> cachedJavaScript;
-  if (!cachedJavaScript) {
-    // The JavaScript to execute. It does execute an synchronous Ajax request to
-    // the special URL handled by this handler and then returns the URL of the
-    // UIWebView by computing window.location.href.
-    // NOTE(qsr):
-    // - Creating a new XMLHttpRequest can crash the application if the Web
-    // Thread is iterating over active DOM objects. To prevent this from
-    // happening, the same XMLHttpRequest is reused as much as possible.
-    // - A XMLHttpRequest is associated to a document, and trying to reuse one
-    // from another document will trigger an exception. To prevent this,
-    // information about the document on which the current XMLHttpRequest has
-    // been created is kept.
-    cachedJavaScript.reset([[NSString
-        stringWithFormat:
-            @"try{"
-             "window.__gCrWeb_Verifying = true;"
-             "if(!window.__gCrWeb_CachedRequest||"
-             "!(window.__gCrWeb_CachedRequestDocument===window.document)){"
-             "window.__gCrWeb_CachedRequest = new XMLHttpRequest();"
-             "window.__gCrWeb_CachedRequestDocument = window.document;"
-             "}"
-             "window.__gCrWeb_CachedRequest.open('POST','%s',false);"
-             "window.__gCrWeb_CachedRequest.send();"
-             "}catch(e){"
-             "try{"
-             "window.__gCrWeb_CachedRequest.open('POST','%s',false);"
-             "window.__gCrWeb_CachedRequest.send();"
-             "}catch(e2){}"
-             "}"
-             "delete window.__gCrWeb_Verifying;"
-             "window.location.href",
-            web::kURLForVerification, kCheckRelativeURL] retain]);
-  }
-  return cachedJavaScript.get();
-}
-
-// Calls +internalCurrentURLForWebView:trustLevel: to do the real work.
-// Logs timing of the actual work to console for debugging.
-+ (GURL)currentURLForWebView:(UIWebView*)webView
-                  trustLevel:(web::URLVerificationTrustLevel*)trustLevel {
-  base::Time start = base::Time::NowFromSystemTime();
-  const GURL result(
-      [CRWURLVerifyingProtocolHandler internalCurrentURLForWebView:webView
-                                                        trustLevel:trustLevel]);
-  base::TimeDelta elapsed = base::Time::NowFromSystemTime() - start;
-  UMA_HISTOGRAM_TIMES("WebController.UrlVerifyTimes", elapsed);
-  // Setting pre-initialization flag to YES here disables pre-initialization
-  // if pre-initialization is held back such that it is called after the
-  // first real call to this function.
-  [[CRWURLVerifyingProtocolHandlerData sharedInstance] setPreInitialized:YES];
-  return result;
-}
-
-// The implementation of this method is doing the following
-// - Set the "last seen URL" to nil.
-// - Inject JavaScript in the UIWebView that will execute a synchronous ajax
-//   request to |kURLForVerification|
-//   - The CRWURLVerifyingProtocolHandler will then update "last seen URL" to
-//     the value of the request mainDocumentURL.
-// - Execute window.location.href on the UIWebView.
-// - Do one of the following:
-//   - If "last seen URL" is nil, return the value of window.location.href and
-//     set |trustLevel| to kNone.
-//   - If "last seen URL" is not nil and "last seen URL" origin is the same as
-//     window.location.href origin, return window.location.href and set
-//     |trustLevel| to kAbsolute.
-//   - If "last seen URL" is not nil and "last seen URL" origin is *not* the
-//     same as window.location.href origin, return "last seen URL" and set
-//     |trustLevel| to kMixed.
-// Only the origin is checked, because pushed states are not reflected in the
-// mainDocumentURL of the request.
-+ (GURL)internalCurrentURLForWebView:(UIWebView*)webView
-    trustLevel:(web::URLVerificationTrustLevel*)trustLevel {
-  // This should only be called on the main thread. The reason is that an
-  // attacker must not be able to compromise the result by generating a request
-  // to |kURLForVerification| from another tab. To prevent this,
-  // "last seen URL" is only updated if the handler is created on the main
-  // thread, and this only happens if the JavaScript is injected from the main
-  // thread too.
-  DCHECK([NSThread isMainThread]);
-  DCHECK(trustLevel) << "Verification of the trustLevel state is mandatory";
-
-  // Compute the main document URL using a synchronous AJAX request.
-  [[CRWURLVerifyingProtocolHandlerData sharedInstance] swapLastSeenURL:GURL()];
-  // Executing the script, will set "last seen URL" as a request will be
-  // executed.
-  NSString* script = [CRWURLVerifyingProtocolHandler checkURLJavaScript];
-  NSString* href = [webView stringByEvaluatingJavaScriptFromString:script];
-  GURL nativeURL([[CRWURLVerifyingProtocolHandlerData sharedInstance]
-      swapLastSeenURL:GURL()]);
-
-  // applewebdata:// is occasionally set as the URL for a blank page during
-  // transition. For instance, if <META HTTP-EQUIV="refresh" ...>' is used.
-  // This results in spurious history entries if this isn't masked with the
-  // default page URL of about:blank.
-  if ([href hasPrefix:@"applewebdata://"])
-    href = @"about:blank";
-  const GURL jsURL(base::SysNSStringToUTF8(href));
-
-  // If XHR is not working (e.g., slow PDF, XHR blocked), fall back to the
-  // UIWebView request. This lags behind the other changes (it appears to update
-  // at the point where the document object becomes present), so it's more
-  // likely to return kMixed during transitions, but it's better than erroring
-  // out when the faster XHR validation method isn't available.
-  if (!nativeURL.is_valid() && webView.request) {
-    nativeURL = net::GURLWithNSURL(webView.request.URL);
-  }
-
-  if (!nativeURL.is_valid()) {
-    *trustLevel = web::URLVerificationTrustLevel::kNone;
-    return jsURL;
-  }
-  if (jsURL.GetOrigin() != nativeURL.GetOrigin()) {
-    DVLOG(1) << "Origin differs, trusting webkit over JavaScript ["
-        << "jsURLOrigin='" << jsURL.GetOrigin() << ", "
-        << "nativeURLOrigin='" << nativeURL.GetOrigin() << "']";
-    *trustLevel = web::URLVerificationTrustLevel::kMixed;
-    return nativeURL;
-  }
-  *trustLevel = web::URLVerificationTrustLevel::kAbsolute;
-  return jsURL;
-}
-
-+ (void)updateLastSeenUrl:(NSURLRequest*)request {
-  DCHECK([NSThread isMainThread]);
-  if ([NSThread isMainThread]) {
-    // See above why this should only be done if this is called on the main
-    // thread.
-    [[CRWURLVerifyingProtocolHandlerData sharedInstance]
-        swapLastSeenURL:net::GURLWithNSURL(request.mainDocumentURL)];
-  }
-}
-
-#pragma mark -
-#pragma mark Class Method
-
-// Injection of JavaScript into any UIWebView pre-initializes the entire
-// system which will save run time when user types into Omnibox and triggers
-// JavaScript injection again.
-+ (BOOL)preInitialize {
-  if ([[CRWURLVerifyingProtocolHandlerData sharedInstance] preInitialized])
-    return YES;
-  web::URLVerificationTrustLevel trustLevel;
-  web::WebClient* web_client = web::GetWebClient();
-  DCHECK(web_client);
-  base::scoped_nsobject<UIWebView> dummyWebView(web::CreateWebView(CGRectZero));
-  [CRWURLVerifyingProtocolHandler currentURLForWebView:dummyWebView
-                                            trustLevel:&trustLevel];
-  return [[CRWURLVerifyingProtocolHandlerData sharedInstance] preInitialized];
-}
-
-#pragma mark NSURLProtocol methods
-
-+ (BOOL)canInitWithRequest:(NSURLRequest*)request {
-  GURL requestURL = net::GURLWithNSURL(request.URL);
-  if (requestURL != GURL(web::kURLForVerification) &&
-      requestURL.path() != kCheckRelativeURL) {
-    return NO;
-  }
-
-  if (![[CRWURLVerifyingProtocolHandlerData
-              sharedInstance] runInInitWithRequest]) {
-    [CRWURLVerifyingProtocolHandler updateLastSeenUrl:request];
-  }
-
-  return YES;
-}
-
-+ (NSURLRequest*)canonicalRequestForRequest:(NSURLRequest*)request {
-  return request;
-}
-
-- (id)initWithRequest:(NSURLRequest*)request
-       cachedResponse:(NSCachedURLResponse*)cachedResponse
-               client:(id<NSURLProtocolClient>)client {
-  if ((self = [super initWithRequest:request
-                      cachedResponse:cachedResponse
-                              client:client])) {
-    if ([[CRWURLVerifyingProtocolHandlerData
-                sharedInstance] runInInitWithRequest]) {
-      [CRWURLVerifyingProtocolHandler updateLastSeenUrl:request];
-    }
-
-    _url.reset([request.URL retain]);
-  }
-  return self;
-}
-
-- (void)startLoading {
-  NSMutableDictionary* headerFields = [NSMutableDictionary dictionary];
-  // This request is done by an AJAX call, cross origin must be allowed.
-  [headerFields setObject:@"*" forKey:@"Access-Control-Allow-Origin"];
-  base::scoped_nsobject<NSHTTPURLResponse> response([[NSHTTPURLResponse alloc]
-       initWithURL:_url
-        statusCode:200
-       HTTPVersion:@"HTTP/1.1"
-      headerFields:headerFields]);
-  [self.client URLProtocol:self
-        didReceiveResponse:response
-        cacheStoragePolicy:NSURLCacheStorageNotAllowed];
-  [self.client URLProtocol:self didLoadData:[NSData data]];
-  [self.client URLProtocolDidFinishLoading:self];
-}
-
-- (void)stopLoading {
-  // Nothing to do.
-}
-
-@end

diff --git a/ios/web/net/crw_url_verifying_protocol_handler_unittest.mm b/ios/web/net/crw_url_verifying_protocol_handler_unittest.mm
deleted file mode 100644
index 059c405..0000000
--- a/ios/web/net/crw_url_verifying_protocol_handler_unittest.mm
+++ /dev/null

@@ -1,22 +0,0 @@
-// Copyright 2012 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "ios/web/net/crw_url_verifying_protocol_handler.h"
-
-#include "base/memory/scoped_ptr.h"
-#include "ios/web/public/test/scoped_testing_web_client.h"
-#import "ios/web/public/test/test_web_client.h"
-#include "ios/web/public/web_client.h"
-#include "testing/gtest/include/gtest/gtest.h"
-
-namespace {
-
-// TODO(shreyasv): See if this can use the WebTest test fixture.
-TEST(CRWURLVerifyingProtocolHandlerTest, NonLazyInitializer) {
-  web::ScopedTestingWebClient web_client(
-      make_scoped_ptr(new web::TestWebClient));
-  EXPECT_TRUE([CRWURLVerifyingProtocolHandler preInitialize]);
-}
-
-}  // namespace

diff --git a/ios/web/public/test/test_web_client.h b/ios/web/public/test/test_web_client.h
index 1172ba6..a912fed 100644
--- a/ios/web/public/test/test_web_client.h
+++ b/ios/web/public/test/test_web_client.h

@@ -19,16 +19,17 @@
  public:
   TestWebClient();
   ~TestWebClient() override;
+
   // WebClient implementation.
+  NSString* GetEarlyPageScript() const override;
   NSString* GetEarlyPageScript(web::WebViewType web_view_type) const override;
   bool WebViewsNeedActiveStateManager() const override;
 
   // Changes Early Page Script for testing purposes.
-  void SetEarlyPageScript(NSString* page_script,
-                          web::WebViewType web_view_type);
+  void SetEarlyPageScript(NSString* page_script);
 
  private:
-  base::scoped_nsobject<NSMutableDictionary> early_page_scripts_;
+  base::scoped_nsobject<NSString> early_page_script_;
 };
 
 }  // namespace web

diff --git a/ios/web/public/test/test_web_client.mm b/ios/web/public/test/test_web_client.mm
index 4d7addf..eacd565 100644
--- a/ios/web/public/test/test_web_client.mm
+++ b/ios/web/public/test/test_web_client.mm

@@ -4,30 +4,30 @@
 
 #import "ios/web/public/test/test_web_client.h"
 
-#include "base/strings/sys_string_conversions.h"
+#include "base/logging.h"
 
 namespace web {
 
-TestWebClient::TestWebClient()
-    : early_page_scripts_([[NSMutableDictionary alloc] init]) {
-}
+TestWebClient::TestWebClient() {}
 
-TestWebClient::~TestWebClient() {
+TestWebClient::~TestWebClient() {}
+
+NSString* TestWebClient::GetEarlyPageScript() const {
+  return early_page_script_ ? early_page_script_.get() : @"";
 }
 
 NSString* TestWebClient::GetEarlyPageScript(
     web::WebViewType web_view_type) const {
-  NSString* result = [early_page_scripts_ objectForKey:@(web_view_type)];
-  return result ? result : @"";
+  DCHECK_EQ(web_view_type, web::WK_WEB_VIEW_TYPE);
+  return GetEarlyPageScript();
 }
 
 bool TestWebClient::WebViewsNeedActiveStateManager() const {
   return true;
 }
 
-void TestWebClient::SetEarlyPageScript(NSString* page_script,
-                                       web::WebViewType web_view_type) {
-  [early_page_scripts_ setObject:page_script forKey:@(web_view_type)];
+void TestWebClient::SetEarlyPageScript(NSString* page_script) {
+  early_page_script_.reset([page_script copy]);
 }
 
 }  // namespace web

diff --git a/ios/web/public/web_client.h b/ios/web/public/web_client.h
index 2bcc5ec3..2043fb2 100644
--- a/ios/web/public/web_client.h
+++ b/ios/web/public/web_client.h

@@ -123,6 +123,11 @@
 
   // Gives the embedder a chance to provide the JavaScript to be injected into
   // the web view as early as possible. Result must not be nil.
+  virtual NSString* GetEarlyPageScript() const;
+
+  // Gives the embedder a chance to provide the JavaScript to be injected into
+  // the web view as early as possible. Result must not be nil.
+  // Deprecated, use GetEarlyPageScript() instead.
   virtual NSString* GetEarlyPageScript(WebViewType web_view_type) const;
 };
 

diff --git a/ios/web/public/web_client.mm b/ios/web/public/web_client.mm
index 245f8a9..ec462f2 100644
--- a/ios/web/public/web_client.mm
+++ b/ios/web/public/web_client.mm

@@ -75,6 +75,10 @@
   return nullptr;
 }
 
+NSString* WebClient::GetEarlyPageScript() const {
+  return GetEarlyPageScript(web::WK_WEB_VIEW_TYPE);
+}
+
 NSString* WebClient::GetEarlyPageScript(WebViewType web_view_type) const {
   return @"";
 }

diff --git a/ios/web/test/web_test.mm b/ios/web/test/web_test.mm
index 5d2bee2..fb43ada 100644
--- a/ios/web/test/web_test.mm
+++ b/ios/web/test/web_test.mm

@@ -11,7 +11,6 @@
 #import "base/test/ios/wait_util.h"
 #import "ios/testing/ocmock_complex_type_helper.h"
 #import "ios/web/navigation/crw_session_controller.h"
-#import "ios/web/net/crw_url_verifying_protocol_handler.h"
 #include "ios/web/public/active_state_manager.h"
 #include "ios/web/public/referrer.h"
 #import "ios/web/public/web_state/ui/crw_web_delegate.h"
@@ -64,9 +63,6 @@
 
 void WebTestWithWebController::SetUp() {
   WebTest::SetUp();
-  BOOL success =
-      [NSURLProtocol registerClass:[CRWURLVerifyingProtocolHandler class]];
-  DCHECK(success);
   webController_.reset(this->CreateWebController());
 
   [webController_ setWebUsageEnabled:YES];
@@ -77,7 +73,6 @@
 
 void WebTestWithWebController::TearDown() {
   [webController_ close];
-  [NSURLProtocol unregisterClass:[CRWURLVerifyingProtocolHandler class]];
   WebTest::TearDown();
 }
 

diff --git a/ios/web/web_state/js/crw_js_early_script_manager.mm b/ios/web/web_state/js/crw_js_early_script_manager.mm
index 655c52f..00eb142 100644
--- a/ios/web/web_state/js/crw_js_early_script_manager.mm
+++ b/ios/web/web_state/js/crw_js_early_script_manager.mm

@@ -10,7 +10,7 @@
 @implementation CRWJSEarlyScriptManager
 
 - (NSString*)staticInjectionContent {
-  return web::GetEarlyPageScript(self.receiver.webViewType);
+  return web::GetEarlyPageScript();
 }
 
 - (NSString*)presenceBeacon {

diff --git a/ios/web/web_state/js/crw_js_early_script_manager_unittest.mm b/ios/web/web_state/js/crw_js_early_script_manager_unittest.mm
index bb134c17..c06ad6e 100644
--- a/ios/web/web_state/js/crw_js_early_script_manager_unittest.mm
+++ b/ios/web/web_state/js/crw_js_early_script_manager_unittest.mm

@@ -39,7 +39,7 @@
 // web::GetEarlyPageScript.
 TEST_F(CRWJSEarlyScriptManagerTest, Content) {
   NSString* injectionContent = [earlyScriptManager_ staticInjectionContent];
-  NSString* earlyScript = GetEarlyPageScript([receiver_ webViewType]);
+  NSString* earlyScript = GetEarlyPageScript();
   // |earlyScript| is a substring of |injectionContent|. The latter wraps the
   // former with "if (typeof __gCrWeb !== 'object')" check to avoid multiple
   // injections.

diff --git a/ios/web/web_state/js/crw_js_window_id_manager.mm b/ios/web/web_state/js/crw_js_window_id_manager.mm
index d689990..4e5c5b4 100644
--- a/ios/web/web_state/js/crw_js_window_id_manager.mm
+++ b/ios/web/web_state/js/crw_js_window_id_manager.mm

@@ -53,7 +53,7 @@
 }
 
 // It is important to recreate the injection content on every injection, because
-// it cotains the randomly-generated page ID used for security checks.
+// it contains the randomly-generated page ID used for security checks.
 - (NSString*)injectionContent {
   _windowId.reset([[self generateUniqueKey] retain]);
   NSString* script = [super injectionContent];

diff --git a/ios/web/web_state/js/page_script_util.h b/ios/web/web_state/js/page_script_util.h
index 442c362..d9285d27 100644
--- a/ios/web/web_state/js/page_script_util.h
+++ b/ios/web/web_state/js/page_script_util.h

@@ -16,8 +16,13 @@
 NSString* GetPageScript(NSString* script_file_name);
 
 // Returns an autoreleased string containing the JavaScript to be injected into
+// the web view as early as possible.
+NSString* GetEarlyPageScript();
+
+// Returns an autoreleased string containing the JavaScript to be injected into
 // the web view as early as possible. The type of a target web view must match
 // |web_view_type|.
+// Deprecated, use web::GetEarlyPageScript() instead.
 NSString* GetEarlyPageScript(WebViewType web_view_type);
 
 }  // namespace web

diff --git a/ios/web/web_state/js/page_script_util.mm b/ios/web/web_state/js/page_script_util.mm
index fec9fcd..d1c04be 100644
--- a/ios/web/web_state/js/page_script_util.mm
+++ b/ios/web/web_state/js/page_script_util.mm

@@ -28,10 +28,9 @@
   return content;
 }
 
-NSString* GetEarlyPageScript(WebViewType web_view_type) {
+NSString* GetEarlyPageScript() {
   DCHECK(GetWebClient());
-  NSString* embedder_page_script =
-      GetWebClient()->GetEarlyPageScript(web_view_type);
+  NSString* embedder_page_script = GetWebClient()->GetEarlyPageScript();
   DCHECK(embedder_page_script);
 
   // Make sure that script is injected only once. For example, content of
@@ -47,4 +46,9 @@
                                     embedder_page_script];
 }
 
+NSString* GetEarlyPageScript(WebViewType web_view_type) {
+  DCHECK_EQ(web_view_type, web::WK_WEB_VIEW_TYPE);
+  return GetEarlyPageScript();
+}
+
 }  // namespace web

diff --git a/ios/web/web_state/js/page_script_util_unittest.mm b/ios/web/web_state/js/page_script_util_unittest.mm
index c508e06..9260ff7 100644
--- a/ios/web/web_state/js/page_script_util_unittest.mm
+++ b/ios/web/web_state/js/page_script_util_unittest.mm

@@ -28,16 +28,16 @@
 TEST_F(PageScriptUtilTest, WKWebViewEarlyPageScript) {
   base::scoped_nsobject<WKWebView> web_view(
       CreateWKWebView(CGRectZero, GetBrowserState()));
-  EvaluateJavaScript(web_view, GetEarlyPageScript(WK_WEB_VIEW_TYPE));
+  EvaluateJavaScript(web_view, GetEarlyPageScript());
   EXPECT_NSEQ(@"object", EvaluateJavaScript(web_view, @"typeof __gCrWeb"));
 }
 
 // Tests that embedder's WKWebView script is included into early script.
 TEST_F(PageScriptUtilTest, WKEmbedderScript) {
-  GetWebClient()->SetEarlyPageScript(@"__gCrEmbedder = {};", WK_WEB_VIEW_TYPE);
+  GetWebClient()->SetEarlyPageScript(@"__gCrEmbedder = {};");
   base::scoped_nsobject<WKWebView> web_view(
       CreateWKWebView(CGRectZero, GetBrowserState()));
-  EvaluateJavaScript(web_view, GetEarlyPageScript(WK_WEB_VIEW_TYPE));
+  EvaluateJavaScript(web_view, GetEarlyPageScript());
   EXPECT_NSEQ(@"object", EvaluateJavaScript(web_view, @"typeof __gCrEmbedder"));
 }
 

diff --git a/ios/web/web_state/ui/wk_web_view_configuration_provider.mm b/ios/web/web_state/ui/wk_web_view_configuration_provider.mm
index 76894414..647d596a 100644
--- a/ios/web/web_state/ui/wk_web_view_configuration_provider.mm
+++ b/ios/web/web_state/ui/wk_web_view_configuration_provider.mm

@@ -22,9 +22,9 @@
 
 // Returns an autoreleased instance of WKUserScript to be added to
 // configuration's userContentController.
-WKUserScript* GetEarlyPageScript() {
+WKUserScript* InternalGetEarlyPageScript() {
   return [[[WKUserScript alloc]
-        initWithSource:GetEarlyPageScript(WK_WEB_VIEW_TYPE)
+        initWithSource:GetEarlyPageScript()
          injectionTime:WKUserScriptInjectionTimeAtDocumentStart
       forMainFrameOnly:YES] autorelease];
 }
@@ -65,7 +65,8 @@
     }
     // setJavaScriptCanOpenWindowsAutomatically is required to support popups.
     [[configuration_ preferences] setJavaScriptCanOpenWindowsAutomatically:YES];
-    [[configuration_ userContentController] addUserScript:GetEarlyPageScript()];
+    [[configuration_ userContentController]
+        addUserScript:InternalGetEarlyPageScript()];
   }
   // Prevent callers from changing the internals of configuration.
   return [[configuration_ copy] autorelease];

diff --git a/ios/web/web_state/ui/wk_web_view_configuration_provider_unittest.mm b/ios/web/web_state/ui/wk_web_view_configuration_provider_unittest.mm
index 5831b288..70c0bee2 100644
--- a/ios/web/web_state/ui/wk_web_view_configuration_provider_unittest.mm
+++ b/ios/web/web_state/ui/wk_web_view_configuration_provider_unittest.mm

@@ -131,12 +131,12 @@
 }
 
 // Tests that configuration's userContentController has only one script with the
-// same content as web::GetEarlyPageScript(WK_WEB_VIEW_TYPE) returns.
+// same content as web::GetEarlyPageScript() returns.
 TEST_F(WKWebViewConfigurationProviderTest, UserScript) {
   WKWebViewConfiguration* config = GetProvider().GetWebViewConfiguration();
   NSArray* scripts = config.userContentController.userScripts;
   EXPECT_EQ(1U, scripts.count);
-  NSString* early_script = GetEarlyPageScript(WK_WEB_VIEW_TYPE);
+  NSString* early_script = GetEarlyPageScript();
   // |earlyScript| is a substring of |userScripts|. The latter wraps the
   // former with "if (!injected)" check to avoid double injections.
   EXPECT_LT(0U, [[scripts[0] source] rangeOfString:early_script].length);

diff --git a/ipc/ipc_platform_file.cc b/ipc/ipc_platform_file.cc
index 2dcc9aa..dbcfddc 100644
--- a/ipc/ipc_platform_file.cc
+++ b/ipc/ipc_platform_file.cc

@@ -44,8 +44,7 @@
 #endif
 }
 
-PlatformFileForTransit TakeFileHandleForProcess(base::File file,
-                                                base::ProcessHandle process) {
+PlatformFileForTransit TakePlatformFileForTransit(base::File file) {
   return GetPlatformFileForTransit(file.TakePlatformFile(), true);
 }
 

diff --git a/ipc/ipc_platform_file.h b/ipc/ipc_platform_file.h
index 3d60983..15807f6 100644
--- a/ipc/ipc_platform_file.h
+++ b/ipc/ipc_platform_file.h

@@ -61,11 +61,10 @@
     base::PlatformFile file,
     bool close_source_handle);
 
-// Returns a file handle equivalent to |file| that can be used in |process|.
+// Creates a new handle that can be passed through IPC. The result must be
+// passed to the IPC layer as part of a message, or else it will leak.
 // Note that this function takes ownership of |file|.
-IPC_EXPORT PlatformFileForTransit TakeFileHandleForProcess(
-    base::File file,
-    base::ProcessHandle process);
+IPC_EXPORT PlatformFileForTransit TakePlatformFileForTransit(base::File file);
 
 }  // namespace IPC
 

diff --git a/media/blink/video_frame_compositor_unittest.cc b/media/blink/video_frame_compositor_unittest.cc
index b2e1695..29274d38 100644
--- a/media/blink/video_frame_compositor_unittest.cc
+++ b/media/blink/video_frame_compositor_unittest.cc

@@ -70,7 +70,6 @@
   MOCK_METHOD0(StartRendering, void());
   MOCK_METHOD0(StopRendering, void());
   void DidReceiveFrame() override { ++did_receive_frame_count_; }
-  void DidUpdateMatrix(const float* matrix) override {}
 
   // VideoRendererSink::RenderCallback implementation.
   MOCK_METHOD3(Render,

diff --git a/media/filters/gpu_video_decoder.cc b/media/filters/gpu_video_decoder.cc
index a9bd073..34204ce 100644
--- a/media/filters/gpu_video_decoder.cc
+++ b/media/filters/gpu_video_decoder.cc

@@ -80,6 +80,7 @@
       next_bitstream_buffer_id_(0),
       available_pictures_(0),
       needs_all_picture_buffers_to_decode_(false),
+      supports_deferred_initialization_(false),
       weak_factory_(this) {
   DCHECK(factories_);
 }
@@ -183,8 +184,18 @@
       capabilities.flags &
       VideoDecodeAccelerator::Capabilities::NEEDS_ALL_PICTURE_BUFFERS_TO_DECODE;
   needs_bitstream_conversion_ = (config.codec() == kCodecH264);
+  supports_deferred_initialization_ = !!(
+      capabilities.flags &
+      VideoDecodeAccelerator::Capabilities::SUPPORTS_DEFERRED_INITIALIZATION);
   output_cb_ = BindToCurrentLoop(output_cb);
 
+  if (config.is_encrypted() && !supports_deferred_initialization_) {
+    DVLOG(1) << __FUNCTION__
+             << " Encrypted stream requires deferred initialialization.";
+    bound_init_cb.Run(false);
+    return;
+  }
+
   if (previously_initialized) {
     DVLOG(3) << __FUNCTION__
              << " Expecting initialized VDA to detect in-stream config change.";
@@ -239,6 +250,7 @@
 
   VideoDecodeAccelerator::Config vda_config(config_);
   vda_config.surface_id = surface_id;
+  vda_config.is_deferred_initialization_allowed = true;
   if (!vda_->Initialize(vda_config, this)) {
     DVLOG(1) << "VDA::Initialize failed.";
     base::ResetAndReturn(&init_cb_).Run(false);
@@ -250,13 +262,19 @@
   if (config_.is_encrypted()) {
     // TODO(watk,timav): Pass this in the VDA::Config.
     vda_->SetCdm(cdm_id);
-    return;
+    DCHECK(supports_deferred_initialization_);
   }
 
-  base::ResetAndReturn(&init_cb_).Run(true);
+  // We enable deferred initialization in the config, so if the VDA supports it,
+  // then it will be in use.  Otherwise, initialization is already complete.
+  if (!supports_deferred_initialization_) {
+    base::ResetAndReturn(&init_cb_).Run(true);
+  }
+
+  // A call to NotifyInitializationComplete will follow with the status.
 }
 
-void GpuVideoDecoder::NotifyCdmAttached(bool success) {
+void GpuVideoDecoder::NotifyInitializationComplete(bool success) {
   DVLOG_IF(2, !success) << __FUNCTION__ << ": CDM not attached.";
   DCHECK(!init_cb_.is_null());
 

diff --git a/media/filters/gpu_video_decoder.h b/media/filters/gpu_video_decoder.h
index de63e65..44c037f8 100644
--- a/media/filters/gpu_video_decoder.h
+++ b/media/filters/gpu_video_decoder.h

@@ -65,7 +65,7 @@
   int GetMaxDecodeRequests() const override;
 
   // VideoDecodeAccelerator::Client implementation.
-  void NotifyCdmAttached(bool success) override;
+  void NotifyInitializationComplete(bool success) override;
   void ProvidePictureBuffers(uint32_t count,
                              uint32_t textures_per_buffer,
                              const gfx::Size& size,
@@ -223,6 +223,11 @@
   // proceed with decoding the next frame.
   bool needs_all_picture_buffers_to_decode_;
 
+  // If true, then the VDA supports deferred initialization via
+  // NotifyInitializationComplete.  Otherwise, it will return initialization
+  // status synchronously from VDA::Initialize.
+  bool supports_deferred_initialization_;
+
   // Bound to factories_->GetMessageLoop().
   // NOTE: Weak pointers must be invalidated before all other member variables.
   base::WeakPtrFactory<GpuVideoDecoder> weak_factory_;

diff --git a/media/gpu/ipc/client/BUILD.gn b/media/gpu/ipc/client/BUILD.gn
new file mode 100644
index 0000000..c55b1ac
--- /dev/null
+++ b/media/gpu/ipc/client/BUILD.gn

@@ -0,0 +1,26 @@
+# Copyright 2016 The Chromium Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+source_set("client") {
+  sources = [
+    "gpu_jpeg_decode_accelerator_host.cc",
+    "gpu_jpeg_decode_accelerator_host.h",
+    "gpu_video_decode_accelerator_host.cc",
+    "gpu_video_decode_accelerator_host.h",
+    "gpu_video_encode_accelerator_host.cc",
+    "gpu_video_encode_accelerator_host.h",
+  ]
+
+  configs += [ "//build/config/compiler:no_size_t_to_int_warning" ]
+
+  deps = [
+    "//base",
+    "//gpu/ipc/common",
+    "//ipc",
+    "//media",
+    "//ui/gfx:memory_buffer",
+    "//ui/gfx/geometry",
+    "//ui/gfx/ipc",
+  ]
+}

diff --git a/content/common/gpu/client/gpu_jpeg_decode_accelerator_host.cc b/media/gpu/ipc/client/gpu_jpeg_decode_accelerator_host.cc
similarity index 89%
rename from content/common/gpu/client/gpu_jpeg_decode_accelerator_host.cc
rename to media/gpu/ipc/client/gpu_jpeg_decode_accelerator_host.cc
index ee53258..c7f3ef14c 100644
--- a/content/common/gpu/client/gpu_jpeg_decode_accelerator_host.cc
+++ b/media/gpu/ipc/client/gpu_jpeg_decode_accelerator_host.cc

@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "content/common/gpu/client/gpu_jpeg_decode_accelerator_host.h"
+#include "media/gpu/ipc/client/gpu_jpeg_decode_accelerator_host.h"
 
 #include <stddef.h>
 
@@ -19,7 +19,7 @@
 #include "ipc/ipc_message_utils.h"
 #include "media/gpu/ipc/common/media_messages.h"
 
-namespace content {
+namespace media {
 
 // Class to receive AcceleratedJpegDecoderHostMsg_DecodeAck IPC message on IO
 // thread. This does very similar what MessageFilter usually does. It is not
@@ -55,8 +55,8 @@
 
     bool handled = true;
     IPC_BEGIN_MESSAGE_MAP(GpuJpegDecodeAcceleratorHost::Receiver, msg)
-    IPC_MESSAGE_HANDLER(AcceleratedJpegDecoderHostMsg_DecodeAck, OnDecodeAck)
-    IPC_MESSAGE_UNHANDLED(handled = false)
+      IPC_MESSAGE_HANDLER(AcceleratedJpegDecoderHostMsg_DecodeAck, OnDecodeAck)
+      IPC_MESSAGE_UNHANDLED(handled = false)
     IPC_END_MESSAGE_MAP()
     DCHECK(handled);
     return handled;
@@ -73,13 +73,13 @@
     if (!client_)
       return;
 
-    if (error == media::JpegDecodeAccelerator::NO_ERRORS) {
+    if (error == JpegDecodeAccelerator::NO_ERRORS) {
       client_->VideoFrameReady(bitstream_buffer_id);
     } else {
       // Only NotifyError once.
       // Client::NotifyError() may trigger deletion of |this| (on another
       // thread), so calling it needs to be the last thing done on this stack!
-      media::JpegDecodeAccelerator::Client* client = nullptr;
+      JpegDecodeAccelerator::Client* client = nullptr;
       std::swap(client, client_);
       client->NotifyError(bitstream_buffer_id, error);
     }
@@ -126,7 +126,7 @@
 }
 
 bool GpuJpegDecodeAcceleratorHost::Initialize(
-    media::JpegDecodeAccelerator::Client* client) {
+    JpegDecodeAccelerator::Client* client) {
   DCHECK(CalledOnValidThread());
 
   bool succeeded = false;
@@ -144,8 +144,8 @@
 }
 
 void GpuJpegDecodeAcceleratorHost::Decode(
-    const media::BitstreamBuffer& bitstream_buffer,
-    const scoped_refptr<media::VideoFrame>& video_frame) {
+    const BitstreamBuffer& bitstream_buffer,
+    const scoped_refptr<VideoFrame>& video_frame) {
   DCHECK(CalledOnValidThread());
 
   DCHECK(
@@ -170,12 +170,12 @@
       base::ScopedFD(input_handle.fd);
     }
 #else
-    // TODO(kcwu) fix the handle leak after crbug.com/493414 resolved.
+// TODO(kcwu) fix the handle leak after crbug.com/493414 resolved.
 #endif
     return;
   }
 
-  size_t output_buffer_size = media::VideoFrame::AllocationSize(
+  size_t output_buffer_size = VideoFrame::AllocationSize(
       video_frame->format(), video_frame->coded_size());
 
   decode_params.coded_size = video_frame->coded_size();
@@ -201,4 +201,4 @@
   return receiver_->AsWeakPtrForIO();
 }
 
-}  // namespace content
+}  // namespace media

diff --git a/content/common/gpu/client/gpu_jpeg_decode_accelerator_host.h b/media/gpu/ipc/client/gpu_jpeg_decode_accelerator_host.h
similarity index 74%
rename from content/common/gpu/client/gpu_jpeg_decode_accelerator_host.h
rename to media/gpu/ipc/client/gpu_jpeg_decode_accelerator_host.h
index 1b8bbefb..ec9a00c 100644
--- a/content/common/gpu/client/gpu_jpeg_decode_accelerator_host.h
+++ b/media/gpu/ipc/client/gpu_jpeg_decode_accelerator_host.h

@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef CONTENT_COMMON_GPU_CLIENT_GPU_JPEG_DECODE_ACCELERATOR_HOST_H_
-#define CONTENT_COMMON_GPU_CLIENT_GPU_JPEG_DECODE_ACCELERATOR_HOST_H_
+#ifndef MEDIA_GPU_IPC_CLIENT_GPU_JPEG_DECODE_ACCELERATOR_HOST_H_
+#define MEDIA_GPU_IPC_CLIENT_GPU_JPEG_DECODE_ACCELERATOR_HOST_H_
 
 #include <stdint.h>
 
@@ -25,11 +25,11 @@
 class Message;
 }
 
-namespace content {
+namespace media {
 
 // This class is used to talk to JpegDecodeAccelerator in the GPU process
 // through IPC messages.
-class GpuJpegDecodeAcceleratorHost : public media::JpegDecodeAccelerator,
+class GpuJpegDecodeAcceleratorHost : public JpegDecodeAccelerator,
                                      public base::NonThreadSafe {
  public:
   // VideoCaptureGpuJpegDecoder owns |this| and |channel|. And
@@ -41,12 +41,12 @@
       const scoped_refptr<base::SingleThreadTaskRunner>& io_task_runner);
   ~GpuJpegDecodeAcceleratorHost() override;
 
-  // media::JpegDecodeAccelerator implementation.
+  // JpegDecodeAccelerator implementation.
   // |client| is called on the IO thread, but is never called into after the
   // GpuJpegDecodeAcceleratorHost is destroyed.
-  bool Initialize(media::JpegDecodeAccelerator::Client* client) override;
-  void Decode(const media::BitstreamBuffer& bitstream_buffer,
-              const scoped_refptr<media::VideoFrame>& video_frame) override;
+  bool Initialize(JpegDecodeAccelerator::Client* client) override;
+  void Decode(const BitstreamBuffer& bitstream_buffer,
+              const scoped_refptr<VideoFrame>& video_frame) override;
   bool IsSupported() override;
 
   base::WeakPtr<IPC::Listener> GetReceiver();
@@ -71,6 +71,6 @@
   DISALLOW_COPY_AND_ASSIGN(GpuJpegDecodeAcceleratorHost);
 };
 
-}  // namespace content
+}  // namespace media
 
-#endif  // CONTENT_COMMON_GPU_CLIENT_GPU_JPEG_DECODE_ACCELERATOR_HOST_H_
+#endif  // MEDIA_GPU_IPC_CLIENT_GPU_JPEG_DECODE_ACCELERATOR_HOST_H_

diff --git a/content/common/gpu/client/gpu_video_decode_accelerator_host.cc b/media/gpu/ipc/client/gpu_video_decode_accelerator_host.cc
similarity index 86%
rename from content/common/gpu/client/gpu_video_decode_accelerator_host.cc
rename to media/gpu/ipc/client/gpu_video_decode_accelerator_host.cc
index 7a6e337..0d3d068 100644
--- a/content/common/gpu/client/gpu_video_decode_accelerator_host.cc
+++ b/media/gpu/ipc/client/gpu_video_decode_accelerator_host.cc

@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "content/common/gpu/client/gpu_video_decode_accelerator_host.h"
+#include "media/gpu/ipc/client/gpu_video_decode_accelerator_host.h"
 
 #include "base/bind.h"
 #include "base/logging.h"
@@ -15,8 +15,7 @@
 #include "ipc/ipc_message_utils.h"
 #include "media/gpu/ipc/common/media_messages.h"
 
-using media::VideoDecodeAccelerator;
-namespace content {
+namespace media {
 
 GpuVideoDecodeAcceleratorHost::GpuVideoDecodeAcceleratorHost(
     gpu::GpuChannelHost* channel,
@@ -44,18 +43,16 @@
   DCHECK(CalledOnValidThread());
   bool handled = true;
   IPC_BEGIN_MESSAGE_MAP(GpuVideoDecodeAcceleratorHost, msg)
-    IPC_MESSAGE_HANDLER(AcceleratedVideoDecoderHostMsg_CdmAttached,
-                        OnCdmAttached)
+    IPC_MESSAGE_HANDLER(AcceleratedVideoDecoderHostMsg_InitializationComplete,
+                        OnInitializationComplete)
     IPC_MESSAGE_HANDLER(AcceleratedVideoDecoderHostMsg_BitstreamBufferProcessed,
                         OnBitstreamBufferProcessed)
     IPC_MESSAGE_HANDLER(AcceleratedVideoDecoderHostMsg_ProvidePictureBuffers,
                         OnProvidePictureBuffer)
     IPC_MESSAGE_HANDLER(AcceleratedVideoDecoderHostMsg_PictureReady,
                         OnPictureReady)
-    IPC_MESSAGE_HANDLER(AcceleratedVideoDecoderHostMsg_FlushDone,
-                        OnFlushDone)
-    IPC_MESSAGE_HANDLER(AcceleratedVideoDecoderHostMsg_ResetDone,
-                        OnResetDone)
+    IPC_MESSAGE_HANDLER(AcceleratedVideoDecoderHostMsg_FlushDone, OnFlushDone)
+    IPC_MESSAGE_HANDLER(AcceleratedVideoDecoderHostMsg_ResetDone, OnResetDone)
     IPC_MESSAGE_HANDLER(AcceleratedVideoDecoderHostMsg_ErrorNotification,
                         OnNotifyError)
     IPC_MESSAGE_HANDLER(AcceleratedVideoDecoderHostMsg_DismissPictureBuffer,
@@ -112,11 +109,11 @@
 }
 
 void GpuVideoDecodeAcceleratorHost::Decode(
-    const media::BitstreamBuffer& bitstream_buffer) {
+    const BitstreamBuffer& bitstream_buffer) {
   DCHECK(CalledOnValidThread());
   if (!channel_)
     return;
-  media::BitstreamBuffer buffer_to_send = bitstream_buffer;
+  BitstreamBuffer buffer_to_send = bitstream_buffer;
   base::SharedMemoryHandle handle =
       channel_->ShareToGpuProcess(bitstream_buffer.handle());
   if (!base::SharedMemory::IsHandleValid(handle)) {
@@ -129,19 +126,19 @@
 }
 
 void GpuVideoDecodeAcceleratorHost::AssignPictureBuffers(
-    const std::vector<media::PictureBuffer>& buffers) {
+    const std::vector<PictureBuffer>& buffers) {
   DCHECK(CalledOnValidThread());
   if (!channel_)
     return;
   // Rearrange data for IPC command.
   std::vector<int32_t> buffer_ids;
-  std::vector<media::PictureBuffer::TextureIds> texture_ids;
+  std::vector<PictureBuffer::TextureIds> texture_ids;
   for (uint32_t i = 0; i < buffers.size(); i++) {
-    const media::PictureBuffer& buffer = buffers[i];
+    const PictureBuffer& buffer = buffers[i];
     if (buffer.size() != picture_buffer_dimensions_) {
       DLOG(ERROR) << "buffer.size() invalid: expected "
-                  << picture_buffer_dimensions_.ToString()
-                  << ", got " << buffer.size().ToString();
+                  << picture_buffer_dimensions_.ToString() << ", got "
+                  << buffer.size().ToString();
       PostNotifyError(INVALID_ARGUMENT);
       return;
     }
@@ -157,8 +154,8 @@
   DCHECK(CalledOnValidThread());
   if (!channel_)
     return;
-  Send(new AcceleratedVideoDecoderMsg_ReusePictureBuffer(
-      decoder_route_id_, picture_buffer_id));
+  Send(new AcceleratedVideoDecoderMsg_ReusePictureBuffer(decoder_route_id_,
+                                                         picture_buffer_id));
 }
 
 void GpuVideoDecodeAcceleratorHost::Flush() {
@@ -208,10 +205,10 @@
   }
 }
 
-void GpuVideoDecodeAcceleratorHost::OnCdmAttached(bool success) {
+void GpuVideoDecodeAcceleratorHost::OnInitializationComplete(bool success) {
   DCHECK(CalledOnValidThread());
   if (client_)
-    client_->NotifyCdmAttached(success);
+    client_->NotifyInitializationComplete(success);
 }
 
 void GpuVideoDecodeAcceleratorHost::OnBitstreamBufferProcessed(
@@ -257,8 +254,8 @@
   DCHECK(CalledOnValidThread());
   if (!client_)
     return;
-  media::Picture picture(picture_buffer_id, bitstream_buffer_id, visible_rect,
-                         allow_overlay);
+  Picture picture(picture_buffer_id, bitstream_buffer_id, visible_rect,
+                  allow_overlay);
   picture.set_size_changed(size_changed);
   client_->PictureReady(picture);
 }
@@ -283,9 +280,9 @@
 
   // Client::NotifyError() may Destroy() |this|, so calling it needs to be the
   // last thing done on this stack!
-  media::VideoDecodeAccelerator::Client* client = NULL;
+  VideoDecodeAccelerator::Client* client = NULL;
   std::swap(client, client_);
-  client->NotifyError(static_cast<media::VideoDecodeAccelerator::Error>(error));
+  client->NotifyError(static_cast<VideoDecodeAccelerator::Error>(error));
 }
 
-}  // namespace content
+}  // namespace media

diff --git a/content/common/gpu/client/gpu_video_decode_accelerator_host.h b/media/gpu/ipc/client/gpu_video_decode_accelerator_host.h
similarity index 84%
rename from content/common/gpu/client/gpu_video_decode_accelerator_host.h
rename to media/gpu/ipc/client/gpu_video_decode_accelerator_host.h
index 96737dc..c60d2b5 100644
--- a/content/common/gpu/client/gpu_video_decode_accelerator_host.h
+++ b/media/gpu/ipc/client/gpu_video_decode_accelerator_host.h

@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef CONTENT_COMMON_GPU_CLIENT_GPU_VIDEO_DECODE_ACCELERATOR_HOST_H_
-#define CONTENT_COMMON_GPU_CLIENT_GPU_VIDEO_DECODE_ACCELERATOR_HOST_H_
+#ifndef MEDIA_GPU_IPC_CLIENT_GPU_VIDEO_DECODE_ACCELERATOR_HOST_H_
+#define MEDIA_GPU_IPC_CLIENT_GPU_VIDEO_DECODE_ACCELERATOR_HOST_H_
 
 #include <stdint.h>
 
@@ -21,13 +21,13 @@
 class GpuChannelHost;
 }
 
-namespace content {
+namespace media {
 
 // This class is used to talk to VideoDecodeAccelerator in the Gpu process
 // through IPC messages.
 class GpuVideoDecodeAcceleratorHost
     : public IPC::Listener,
-      public media::VideoDecodeAccelerator,
+      public VideoDecodeAccelerator,
       public gpu::CommandBufferProxyImpl::DeletionObserver,
       public base::NonThreadSafe {
  public:
@@ -40,12 +40,11 @@
   void OnChannelError() override;
   bool OnMessageReceived(const IPC::Message& message) override;
 
-  // media::VideoDecodeAccelerator implementation.
+  // VideoDecodeAccelerator implementation.
   bool Initialize(const Config& config, Client* client) override;
   void SetCdm(int cdm_id) override;
-  void Decode(const media::BitstreamBuffer& bitstream_buffer) override;
-  void AssignPictureBuffers(
-      const std::vector<media::PictureBuffer>& buffers) override;
+  void Decode(const BitstreamBuffer& bitstream_buffer) override;
+  void AssignPictureBuffers(const std::vector<PictureBuffer>& buffers) override;
   void ReusePictureBuffer(int32_t picture_buffer_id) override;
   void Flush() override;
   void Reset() override;
@@ -63,9 +62,9 @@
 
   void Send(IPC::Message* message);
 
-  // IPC handlers, proxying media::VideoDecodeAccelerator::Client for the GPU
+  // IPC handlers, proxying VideoDecodeAccelerator::Client for the GPU
   // process.  Should not be called directly.
-  void OnCdmAttached(bool success);
+  void OnInitializationComplete(bool success);
   void OnBitstreamBufferProcessed(int32_t bitstream_buffer_id);
   void OnProvidePictureBuffer(uint32_t num_requested_buffers,
                               uint32_t textures_per_buffer,
@@ -106,6 +105,6 @@
   DISALLOW_COPY_AND_ASSIGN(GpuVideoDecodeAcceleratorHost);
 };
 
-}  // namespace content
+}  // namespace media
 
-#endif  // CONTENT_COMMON_GPU_CLIENT_GPU_VIDEO_DECODE_ACCELERATOR_HOST_H_
+#endif  // MEDIA_GPU_IPC_CLIENT_GPU_VIDEO_DECODE_ACCELERATOR_HOST_H_

diff --git a/content/common/gpu/client/gpu_video_encode_accelerator_host.cc b/media/gpu/ipc/client/gpu_video_encode_accelerator_host.cc
similarity index 86%
rename from content/common/gpu/client/gpu_video_encode_accelerator_host.cc
rename to media/gpu/ipc/client/gpu_video_encode_accelerator_host.cc
index 3ae2e7e..8a8ea088 100644
--- a/content/common/gpu/client/gpu_video_encode_accelerator_host.cc
+++ b/media/gpu/ipc/client/gpu_video_encode_accelerator_host.cc

@@ -2,19 +2,19 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "content/common/gpu/client/gpu_video_encode_accelerator_host.h"
+#include "media/gpu/ipc/client/gpu_video_encode_accelerator_host.h"
 
 #include "base/location.h"
 #include "base/logging.h"
 #include "base/thread_task_runner_handle.h"
-#include "content/common/gpu/media/gpu_video_accelerator_util.h"
 #include "gpu/ipc/client/gpu_channel_host.h"
 #include "media/base/video_frame.h"
+#include "media/gpu/ipc/common/gpu_video_accelerator_util.h"
 #include "media/gpu/ipc/common/media_messages.h"
 #include "media/video/video_encode_accelerator.h"
 #include "ui/gfx/gpu_memory_buffer.h"
 
-namespace content {
+namespace media {
 
 GpuVideoEncodeAcceleratorHost::GpuVideoEncodeAcceleratorHost(
     gpu::GpuChannelHost* channel,
@@ -68,19 +68,19 @@
   PostNotifyError(FROM_HERE, kPlatformFailureError, "OnChannelError()");
 }
 
-media::VideoEncodeAccelerator::SupportedProfiles
+VideoEncodeAccelerator::SupportedProfiles
 GpuVideoEncodeAcceleratorHost::GetSupportedProfiles() {
   DCHECK(CalledOnValidThread());
   if (!channel_)
-    return media::VideoEncodeAccelerator::SupportedProfiles();
+    return VideoEncodeAccelerator::SupportedProfiles();
   return GpuVideoAcceleratorUtil::ConvertGpuToMediaEncodeProfiles(
       channel_->gpu_info().video_encode_accelerator_supported_profiles);
 }
 
 bool GpuVideoEncodeAcceleratorHost::Initialize(
-    media::VideoPixelFormat input_format,
+    VideoPixelFormat input_format,
     const gfx::Size& input_visible_size,
-    media::VideoCodecProfile output_profile,
+    VideoCodecProfile output_profile,
     uint32_t initial_bitrate,
     Client* client) {
   DCHECK(CalledOnValidThread());
@@ -93,7 +93,7 @@
   int32_t route_id = channel_->GenerateRouteID();
   channel_->AddRoute(route_id, weak_this_factory_.GetWeakPtr());
 
-  media::CreateVideoEncoderParams params;
+  CreateVideoEncoderParams params;
   params.input_format = input_format;
   params.input_visible_size = input_visible_size;
   params.output_profile = output_profile;
@@ -112,18 +112,18 @@
 }
 
 void GpuVideoEncodeAcceleratorHost::Encode(
-    const scoped_refptr<media::VideoFrame>& frame,
+    const scoped_refptr<VideoFrame>& frame,
     bool force_keyframe) {
   DCHECK(CalledOnValidThread());
-  DCHECK_EQ(media::PIXEL_FORMAT_I420, frame->format());
+  DCHECK_EQ(PIXEL_FORMAT_I420, frame->format());
   if (!channel_)
     return;
 
   switch (frame->storage_type()) {
-    case media::VideoFrame::STORAGE_SHMEM:
+    case VideoFrame::STORAGE_SHMEM:
       EncodeSharedMemoryFrame(frame, force_keyframe);
       break;
-    case media::VideoFrame::STORAGE_GPU_MEMORY_BUFFERS:
+    case VideoFrame::STORAGE_GPU_MEMORY_BUFFERS:
       EncodeGpuMemoryBufferFrame(frame, force_keyframe);
       break;
     default:
@@ -139,7 +139,7 @@
 }
 
 void GpuVideoEncodeAcceleratorHost::UseOutputBitstreamBuffer(
-    const media::BitstreamBuffer& buffer) {
+    const BitstreamBuffer& buffer) {
   DCHECK(CalledOnValidThread());
   if (!channel_)
     return;
@@ -186,9 +186,9 @@
 }
 
 void GpuVideoEncodeAcceleratorHost::EncodeGpuMemoryBufferFrame(
-    const scoped_refptr<media::VideoFrame>& frame,
-    bool force_keyframe){
-  DCHECK_EQ(media::VideoFrame::NumPlanes(media::PIXEL_FORMAT_I420),
+    const scoped_refptr<VideoFrame>& frame,
+    bool force_keyframe) {
+  DCHECK_EQ(VideoFrame::NumPlanes(PIXEL_FORMAT_I420),
             frame->gpu_memory_buffer_handles().size());
   AcceleratedVideoEncoderMsg_Encode_Params2 params;
   params.frame_id = next_frame_id_;
@@ -213,8 +213,8 @@
 }
 
 void GpuVideoEncodeAcceleratorHost::EncodeSharedMemoryFrame(
-    const scoped_refptr<media::VideoFrame>& frame,
-    bool force_keyframe){
+    const scoped_refptr<VideoFrame>& frame,
+    bool force_keyframe) {
   if (!base::SharedMemory::IsHandleValid(frame->shared_memory_handle())) {
     PostNotifyError(FROM_HERE, kPlatformFailureError,
                     "EncodeSharedMemory(): cannot encode frame with invalid "
@@ -236,19 +236,19 @@
   params.buffer_offset =
       base::checked_cast<uint32_t>(frame->shared_memory_offset());
   params.buffer_size =
-      media::VideoFrame::AllocationSize(frame->format(), frame->coded_size());
+      VideoFrame::AllocationSize(frame->format(), frame->coded_size());
   params.force_keyframe = force_keyframe;
 
   Send(new AcceleratedVideoEncoderMsg_Encode(encoder_route_id_, params));
 }
 
 void GpuVideoEncodeAcceleratorHost::PostNotifyError(
-    const tracked_objects::Location& location, Error error,
+    const tracked_objects::Location& location,
+    Error error,
     const std::string& message) {
   DCHECK(CalledOnValidThread());
-  DLOG(ERROR) << "Error from " << location.function_name()
-              << "(" << location.file_name() << ":"
-              << location.line_number() << ") "
+  DLOG(ERROR) << "Error from " << location.function_name() << "("
+              << location.file_name() << ":" << location.line_number() << ") "
               << message << " (error = " << error << ")";
   // Post the error notification back to this thread, to avoid re-entrancy.
   base::ThreadTaskRunnerHandle::Get()->PostTask(
@@ -274,8 +274,8 @@
            << ", input_coded_size=" << input_coded_size.ToString()
            << ", output_buffer_size=" << output_buffer_size;
   if (client_) {
-    client_->RequireBitstreamBuffers(
-        input_count, input_coded_size, output_buffer_size);
+    client_->RequireBitstreamBuffers(input_count, input_coded_size,
+                                     output_buffer_size);
   }
 }
 
@@ -287,10 +287,11 @@
   // back into the map, we separate the frame's dtor running from the .erase()
   // running by holding on to the frame temporarily.  This isn't "just
   // theoretical" - Android's std::hash_map crashes if we don't do this.
-  scoped_refptr<media::VideoFrame> frame = frame_map_[frame_id];
+  scoped_refptr<VideoFrame> frame = frame_map_[frame_id];
   if (!frame_map_.erase(frame_id)) {
     DLOG(ERROR) << "OnNotifyInputDone(): "
-                   "invalid frame_id=" << frame_id;
+                   "invalid frame_id="
+                << frame_id;
     // See OnNotifyError for why this needs to be the last thing in this
     // function.
     OnNotifyError(kPlatformFailureError);
@@ -305,8 +306,8 @@
     bool key_frame) {
   DCHECK(CalledOnValidThread());
   DVLOG(3) << "OnBitstreamBufferReady(): "
-              "bitstream_buffer_id=" << bitstream_buffer_id
-           << ", payload_size=" << payload_size
+              "bitstream_buffer_id="
+           << bitstream_buffer_id << ", payload_size=" << payload_size
            << ", key_frame=" << key_frame;
   if (client_)
     client_->BitstreamBufferReady(bitstream_buffer_id, payload_size, key_frame);
@@ -321,9 +322,9 @@
 
   // Client::NotifyError() may Destroy() |this|, so calling it needs to be the
   // last thing done on this stack!
-  media::VideoEncodeAccelerator::Client* client = NULL;
+  VideoEncodeAccelerator::Client* client = NULL;
   std::swap(client_, client);
   client->NotifyError(error);
 }
 
-}  // namespace content
+}  // namespace media

diff --git a/content/common/gpu/client/gpu_video_encode_accelerator_host.h b/media/gpu/ipc/client/gpu_video_encode_accelerator_host.h
similarity index 78%
rename from content/common/gpu/client/gpu_video_encode_accelerator_host.h
rename to media/gpu/ipc/client/gpu_video_encode_accelerator_host.h
index 15d02ce..b1dc8f72 100644
--- a/content/common/gpu/client/gpu_video_encode_accelerator_host.h
+++ b/media/gpu/ipc/client/gpu_video_encode_accelerator_host.h

@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef CONTENT_COMMON_GPU_CLIENT_GPU_VIDEO_ENCODE_ACCELERATOR_HOST_H_
-#define CONTENT_COMMON_GPU_CLIENT_GPU_VIDEO_ENCODE_ACCELERATOR_HOST_H_
+#ifndef MEDIA_GPU_IPC_CLIENT_GPU_VIDEO_ENCODE_ACCELERATOR_HOST_H_
+#define MEDIA_GPU_IPC_CLIENT_GPU_VIDEO_ENCODE_ACCELERATOR_HOST_H_
 
 #include <stdint.h>
 
@@ -36,13 +36,13 @@
 class Location;
 }  // namespace tracked_objects
 
-namespace content {
+namespace media {
 
 // This class is the renderer-side host for the VideoEncodeAccelerator in the
 // GPU process, coordinated over IPC.
 class GpuVideoEncodeAcceleratorHost
     : public IPC::Listener,
-      public media::VideoEncodeAccelerator,
+      public VideoEncodeAccelerator,
       public gpu::CommandBufferProxyImpl::DeletionObserver,
       public base::NonThreadSafe {
  public:
@@ -55,16 +55,16 @@
   bool OnMessageReceived(const IPC::Message& message) override;
   void OnChannelError() override;
 
-  // media::VideoEncodeAccelerator implementation.
+  // VideoEncodeAccelerator implementation.
   SupportedProfiles GetSupportedProfiles() override;
-  bool Initialize(media::VideoPixelFormat input_format,
+  bool Initialize(VideoPixelFormat input_format,
                   const gfx::Size& input_visible_size,
-                  media::VideoCodecProfile output_profile,
+                  VideoCodecProfile output_profile,
                   uint32_t initial_bitrate,
                   Client* client) override;
-  void Encode(const scoped_refptr<media::VideoFrame>& frame,
+  void Encode(const scoped_refptr<VideoFrame>& frame,
               bool force_keyframe) override;
-  void UseOutputBitstreamBuffer(const media::BitstreamBuffer& buffer) override;
+  void UseOutputBitstreamBuffer(const BitstreamBuffer& buffer) override;
   void RequestEncodingParametersChange(uint32_t bitrate,
                                        uint32_t framerate_num) override;
   void Destroy() override;
@@ -77,18 +77,19 @@
   ~GpuVideoEncodeAcceleratorHost() override;
 
   // Encode specific video frame types.
-  void EncodeGpuMemoryBufferFrame(const scoped_refptr<media::VideoFrame>& frame,
+  void EncodeGpuMemoryBufferFrame(const scoped_refptr<VideoFrame>& frame,
                                   bool force_keyframe);
-  void EncodeSharedMemoryFrame(const scoped_refptr<media::VideoFrame>& frame,
+  void EncodeSharedMemoryFrame(const scoped_refptr<VideoFrame>& frame,
                                bool force_keyframe);
 
   // Notify |client_| of an error.  Posts a task to avoid re-entrancy.
   void PostNotifyError(const tracked_objects::Location& location,
-                       Error error, const std::string& message);
+                       Error error,
+                       const std::string& message);
 
   void Send(IPC::Message* message);
 
-  // IPC handlers, proxying media::VideoEncodeAccelerator::Client for the GPU
+  // IPC handlers, proxying VideoEncodeAccelerator::Client for the GPU
   // process.  Should not be called directly.
   void OnRequireBitstreamBuffers(uint32_t input_count,
                                  const gfx::Size& input_coded_size,
@@ -115,9 +116,9 @@
   // always valid as long as it is not NULL.
   gpu::CommandBufferProxyImpl* impl_;
 
-  // media::VideoFrames sent to the encoder.
+  // VideoFrames sent to the encoder.
   // base::IDMap not used here, since that takes pointers, not scoped_refptr.
-  typedef base::hash_map<int32_t, scoped_refptr<media::VideoFrame>> FrameMap;
+  typedef base::hash_map<int32_t, scoped_refptr<VideoFrame>> FrameMap;
   FrameMap frame_map_;
 
   // ID serial number for the next frame to send to the GPU process.
@@ -129,6 +130,6 @@
   DISALLOW_COPY_AND_ASSIGN(GpuVideoEncodeAcceleratorHost);
 };
 
-}  // namespace content
+}  // namespace media
 
-#endif  // CONTENT_COMMON_GPU_CLIENT_GPU_VIDEO_ENCODE_ACCELERATOR_HOST_H_
+#endif  // MEDIA_GPU_IPC_CLIENT_GPU_VIDEO_ENCODE_ACCELERATOR_HOST_H_

diff --git a/media/gpu/ipc/common/BUILD.gn b/media/gpu/ipc/common/BUILD.gn
index 10fe776..7da6476 100644
--- a/media/gpu/ipc/common/BUILD.gn
+++ b/media/gpu/ipc/common/BUILD.gn

@@ -6,6 +6,8 @@
   sources = [
     "create_video_encoder_params.cc",
     "create_video_encoder_params.h",
+    "gpu_video_accelerator_util.cc",
+    "gpu_video_accelerator_util.h",
     "media_message_generator.cc",
     "media_message_generator.h",
     "media_messages.cc",

diff --git a/content/common/gpu/media/gpu_video_accelerator_util.cc b/media/gpu/ipc/common/gpu_video_accelerator_util.cc
similarity index 69%
rename from content/common/gpu/media/gpu_video_accelerator_util.cc
rename to media/gpu/ipc/common/gpu_video_accelerator_util.cc
index 8a88cc1a..3178328 100644
--- a/content/common/gpu/media/gpu_video_accelerator_util.cc
+++ b/media/gpu/ipc/common/gpu_video_accelerator_util.cc

@@ -2,16 +2,15 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "content/common/gpu/media/gpu_video_accelerator_util.h"
+#include "media/gpu/ipc/common/gpu_video_accelerator_util.h"
 
-namespace content {
+namespace media {
 
-// Make sure the enum values of media::VideoCodecProfile and
+// Make sure the enum values of VideoCodecProfile and
 // gpu::VideoCodecProfile match.
-#define STATIC_ASSERT_ENUM_MATCH(name)                                 \
-  static_assert(                                                       \
-      media::name == static_cast<media::VideoCodecProfile>(gpu::name), \
-      #name " value must match in media and gpu.")
+#define STATIC_ASSERT_ENUM_MATCH(name)                             \
+  static_assert(name == static_cast<VideoCodecProfile>(gpu::name), \
+                #name " value must match in media and gpu.")
 
 STATIC_ASSERT_ENUM_MATCH(VIDEO_CODEC_PROFILE_UNKNOWN);
 STATIC_ASSERT_ENUM_MATCH(VIDEO_CODEC_PROFILE_MIN);
@@ -34,10 +33,10 @@
 STATIC_ASSERT_ENUM_MATCH(VIDEO_CODEC_PROFILE_MAX);
 
 // static
-media::VideoDecodeAccelerator::Capabilities
+VideoDecodeAccelerator::Capabilities
 GpuVideoAcceleratorUtil::ConvertGpuToMediaDecodeCapabilities(
     const gpu::VideoDecodeAcceleratorCapabilities& gpu_capabilities) {
-  media::VideoDecodeAccelerator::Capabilities capabilities;
+  VideoDecodeAccelerator::Capabilities capabilities;
   capabilities.supported_profiles =
       ConvertGpuToMediaDecodeProfiles(gpu_capabilities.supported_profiles);
   capabilities.flags = gpu_capabilities.flags;
@@ -45,14 +44,13 @@
 }
 
 // static
-media::VideoDecodeAccelerator::SupportedProfiles
-GpuVideoAcceleratorUtil::ConvertGpuToMediaDecodeProfiles(const
-    gpu::VideoDecodeAcceleratorSupportedProfiles& gpu_profiles) {
-  media::VideoDecodeAccelerator::SupportedProfiles profiles;
+VideoDecodeAccelerator::SupportedProfiles
+GpuVideoAcceleratorUtil::ConvertGpuToMediaDecodeProfiles(
+    const gpu::VideoDecodeAcceleratorSupportedProfiles& gpu_profiles) {
+  VideoDecodeAccelerator::SupportedProfiles profiles;
   for (const auto& gpu_profile : gpu_profiles) {
-    media::VideoDecodeAccelerator::SupportedProfile profile;
-    profile.profile =
-        static_cast<media::VideoCodecProfile>(gpu_profile.profile);
+    VideoDecodeAccelerator::SupportedProfile profile;
+    profile.profile = static_cast<VideoCodecProfile>(gpu_profile.profile);
     profile.max_resolution = gpu_profile.max_resolution;
     profile.min_resolution = gpu_profile.min_resolution;
     profile.encrypted_only = gpu_profile.encrypted_only;
@@ -64,7 +62,7 @@
 // static
 gpu::VideoDecodeAcceleratorCapabilities
 GpuVideoAcceleratorUtil::ConvertMediaToGpuDecodeCapabilities(
-    const media::VideoDecodeAccelerator::Capabilities& media_capabilities) {
+    const VideoDecodeAccelerator::Capabilities& media_capabilities) {
   gpu::VideoDecodeAcceleratorCapabilities capabilities;
   capabilities.supported_profiles =
       ConvertMediaToGpuDecodeProfiles(media_capabilities.supported_profiles);
@@ -74,8 +72,8 @@
 
 // static
 gpu::VideoDecodeAcceleratorSupportedProfiles
-GpuVideoAcceleratorUtil::ConvertMediaToGpuDecodeProfiles(const
-    media::VideoDecodeAccelerator::SupportedProfiles& media_profiles) {
+GpuVideoAcceleratorUtil::ConvertMediaToGpuDecodeProfiles(
+    const VideoDecodeAccelerator::SupportedProfiles& media_profiles) {
   gpu::VideoDecodeAcceleratorSupportedProfiles profiles;
   for (const auto& media_profile : media_profiles) {
     gpu::VideoDecodeAcceleratorSupportedProfile profile;
@@ -90,14 +88,13 @@
 }
 
 // static
-media::VideoEncodeAccelerator::SupportedProfiles
-GpuVideoAcceleratorUtil::ConvertGpuToMediaEncodeProfiles(const
-    gpu::VideoEncodeAcceleratorSupportedProfiles& gpu_profiles) {
-  media::VideoEncodeAccelerator::SupportedProfiles profiles;
+VideoEncodeAccelerator::SupportedProfiles
+GpuVideoAcceleratorUtil::ConvertGpuToMediaEncodeProfiles(
+    const gpu::VideoEncodeAcceleratorSupportedProfiles& gpu_profiles) {
+  VideoEncodeAccelerator::SupportedProfiles profiles;
   for (const auto& gpu_profile : gpu_profiles) {
-    media::VideoEncodeAccelerator::SupportedProfile profile;
-    profile.profile =
-        static_cast<media::VideoCodecProfile>(gpu_profile.profile);
+    VideoEncodeAccelerator::SupportedProfile profile;
+    profile.profile = static_cast<VideoCodecProfile>(gpu_profile.profile);
     profile.max_resolution = gpu_profile.max_resolution;
     profile.max_framerate_numerator = gpu_profile.max_framerate_numerator;
     profile.max_framerate_denominator = gpu_profile.max_framerate_denominator;
@@ -108,8 +105,8 @@
 
 // static
 gpu::VideoEncodeAcceleratorSupportedProfiles
-GpuVideoAcceleratorUtil::ConvertMediaToGpuEncodeProfiles(const
-    media::VideoEncodeAccelerator::SupportedProfiles& media_profiles) {
+GpuVideoAcceleratorUtil::ConvertMediaToGpuEncodeProfiles(
+    const VideoEncodeAccelerator::SupportedProfiles& media_profiles) {
   gpu::VideoEncodeAcceleratorSupportedProfiles profiles;
   for (const auto& media_profile : media_profiles) {
     gpu::VideoEncodeAcceleratorSupportedProfile profile;
@@ -125,8 +122,8 @@
 
 // static
 void GpuVideoAcceleratorUtil::InsertUniqueDecodeProfiles(
-    const media::VideoDecodeAccelerator::SupportedProfiles& new_profiles,
-    media::VideoDecodeAccelerator::SupportedProfiles* media_profiles) {
+    const VideoDecodeAccelerator::SupportedProfiles& new_profiles,
+    VideoDecodeAccelerator::SupportedProfiles* media_profiles) {
   for (const auto& profile : new_profiles) {
     bool duplicate = false;
     for (const auto& media_profile : *media_profiles) {
@@ -142,8 +139,8 @@
 
 // static
 void GpuVideoAcceleratorUtil::InsertUniqueEncodeProfiles(
-    const media::VideoEncodeAccelerator::SupportedProfiles& new_profiles,
-    media::VideoEncodeAccelerator::SupportedProfiles* media_profiles) {
+    const VideoEncodeAccelerator::SupportedProfiles& new_profiles,
+    VideoEncodeAccelerator::SupportedProfiles* media_profiles) {
   for (const auto& profile : new_profiles) {
     bool duplicate = false;
     for (const auto& media_profile : *media_profiles) {
@@ -157,4 +154,4 @@
   }
 }
 
-}  // namespace content
+}  // namespace media

diff --git a/media/gpu/ipc/common/gpu_video_accelerator_util.h b/media/gpu/ipc/common/gpu_video_accelerator_util.h
new file mode 100644
index 0000000..1d940946
--- /dev/null
+++ b/media/gpu/ipc/common/gpu_video_accelerator_util.h

@@ -0,0 +1,63 @@
+// Copyright 2015 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef MEDIA_GPU_IPC_COMMON_GPU_VIDEO_ACCELERATOR_UTIL_H_
+#define MEDIA_GPU_IPC_COMMON_GPU_VIDEO_ACCELERATOR_UTIL_H_
+
+#include <vector>
+
+#include "gpu/config/gpu_info.h"
+#include "media/video/video_decode_accelerator.h"
+#include "media/video/video_encode_accelerator.h"
+
+namespace media {
+
+class GpuVideoAcceleratorUtil {
+ public:
+  // Convert decoder gpu capabilities to media capabilities.
+  static VideoDecodeAccelerator::Capabilities
+  ConvertGpuToMediaDecodeCapabilities(
+      const gpu::VideoDecodeAcceleratorCapabilities& gpu_capabilities);
+
+  // Convert decoder gpu profiles to media profiles.
+  static VideoDecodeAccelerator::SupportedProfiles
+  ConvertGpuToMediaDecodeProfiles(
+      const gpu::VideoDecodeAcceleratorSupportedProfiles& gpu_profiles);
+
+  // Convert decoder media capabilities to gpu capabilities.
+  static gpu::VideoDecodeAcceleratorCapabilities
+  ConvertMediaToGpuDecodeCapabilities(
+      const VideoDecodeAccelerator::Capabilities& media_capabilities);
+
+  // Convert decoder media profiles to gpu profiles.
+  static gpu::VideoDecodeAcceleratorSupportedProfiles
+  ConvertMediaToGpuDecodeProfiles(
+      const VideoDecodeAccelerator::SupportedProfiles& media_profiles);
+
+  // Convert encoder gpu profiles to media profiles.
+  static VideoEncodeAccelerator::SupportedProfiles
+  ConvertGpuToMediaEncodeProfiles(
+      const gpu::VideoEncodeAcceleratorSupportedProfiles& gpu_profiles);
+
+  // Convert encoder media profiles to gpu profiles.
+  static gpu::VideoEncodeAcceleratorSupportedProfiles
+  ConvertMediaToGpuEncodeProfiles(
+      const VideoEncodeAccelerator::SupportedProfiles& media_profiles);
+
+  // Insert |new_profiles| into |media_profiles|, ensuring no duplicates are
+  // inserted.
+  static void InsertUniqueDecodeProfiles(
+      const VideoDecodeAccelerator::SupportedProfiles& new_profiles,
+      VideoDecodeAccelerator::SupportedProfiles* media_profiles);
+
+  // Insert |new_profiles| into |media_profiles|, ensuring no duplicates are
+  // inserted.
+  static void InsertUniqueEncodeProfiles(
+      const VideoEncodeAccelerator::SupportedProfiles& new_profiles,
+      VideoEncodeAccelerator::SupportedProfiles* media_profiles);
+};
+
+}  // namespace media
+
+#endif  // MEDIA_GPU_IPC_COMMON_GPU_VIDEO_ACCELERATOR_UTIL_H_

diff --git a/media/gpu/ipc/common/media_messages.h b/media/gpu/ipc/common/media_messages.h
index 0f91e45..780e378 100644
--- a/media/gpu/ipc/common/media_messages.h
+++ b/media/gpu/ipc/common/media_messages.h

@@ -105,8 +105,8 @@
 // Inform AcceleratedVideoDecoderHost that AcceleratedVideoDecoder has been
 // created.
 
-// Notify the CDM setting result.
-IPC_MESSAGE_ROUTED1(AcceleratedVideoDecoderHostMsg_CdmAttached,
+// Notify the deferred initialization result.
+IPC_MESSAGE_ROUTED1(AcceleratedVideoDecoderHostMsg_InitializationComplete,
                     bool) /* success */
 
 // Accelerated video decoder has consumed input buffer from transfer buffer.

diff --git a/media/gpu/ipc/common/media_param_traits_macros.h b/media/gpu/ipc/common/media_param_traits_macros.h
index 38cb37cd..5ea736f 100644
--- a/media/gpu/ipc/common/media_param_traits_macros.h
+++ b/media/gpu/ipc/common/media_param_traits_macros.h

@@ -28,6 +28,7 @@
 IPC_STRUCT_TRAITS_BEGIN(media::VideoDecodeAccelerator::Config)
   IPC_STRUCT_TRAITS_MEMBER(profile)
   IPC_STRUCT_TRAITS_MEMBER(is_encrypted)
+  IPC_STRUCT_TRAITS_MEMBER(is_deferred_initialization_allowed)
   IPC_STRUCT_TRAITS_MEMBER(surface_id)
 IPC_STRUCT_TRAITS_END()
 

diff --git a/media/gpu/ipc/media_ipc.gyp b/media/gpu/ipc/media_ipc.gyp
index 3c25a63a..e8d6b91 100644
--- a/media/gpu/ipc/media_ipc.gyp
+++ b/media/gpu/ipc/media_ipc.gyp

@@ -21,6 +21,8 @@
       'sources': [
         'common/create_video_encoder_params.cc',
         'common/create_video_encoder_params.h',
+        'common/gpu_video_accelerator_util.cc',
+        'common/gpu_video_accelerator_util.h',
         'common/media_message_generator.cc',
         'common/media_message_generator.h',
         'common/media_messages.cc',
@@ -30,5 +32,30 @@
         'common/media_param_traits_macros.h',
       ],
     },
+    {
+      # GN version: //media/gpu/ipc/client
+      'target_name': 'media_gpu_ipc_client',
+      'type': 'static_library',
+      'dependencies': [
+        '../../media.gyp:media',
+        '../../../base/base.gyp:base',
+        '../../../gpu/gpu.gyp:gpu_ipc_common',
+        '../../../ipc/ipc.gyp:ipc',
+        '../../../ui/gfx/gfx.gyp:gfx',
+        '../../../ui/gfx/gfx.gyp:gfx_geometry',
+        '../../../ui/gfx/ipc/gfx_ipc.gyp:gfx_ipc',
+      ],
+      # This sources list is duplicated in //media/gpu/ipc/client/BUILD.gn
+      'sources': [
+        'client/gpu_jpeg_decode_accelerator_host.cc',
+        'client/gpu_jpeg_decode_accelerator_host.h',
+        'client/gpu_video_decode_accelerator_host.cc',
+        'client/gpu_video_decode_accelerator_host.h',
+        'client/gpu_video_encode_accelerator_host.cc',
+        'client/gpu_video_encode_accelerator_host.h',
+      ],
+      # TODO(jschuh): crbug.com/167187 fix size_t to int truncations.
+      'msvs_disabled_warnings': [4267, ],
+    },
   ]
 }

diff --git a/media/video/video_decode_accelerator.cc b/media/video/video_decode_accelerator.cc
index 00ae88c..f0a5626 100644
--- a/media/video/video_decode_accelerator.cc
+++ b/media/video/video_decode_accelerator.cc

@@ -24,8 +24,9 @@
   return s.str();
 }
 
-void VideoDecodeAccelerator::Client::NotifyCdmAttached(bool success) {
-  NOTREACHED() << "By default CDM is not supported.";
+void VideoDecodeAccelerator::Client::NotifyInitializationComplete(
+    bool success) {
+  NOTREACHED() << "By default deferred initialization is not supported.";
 }
 
 VideoDecodeAccelerator::~VideoDecodeAccelerator() {}

diff --git a/media/video/video_decode_accelerator.h b/media/video/video_decode_accelerator.h
index f4956f2..cc01eaf 100644
--- a/media/video/video_decode_accelerator.h
+++ b/media/video/video_decode_accelerator.h

@@ -68,6 +68,11 @@
       // Whether the VDA supports being configured with an output surface for
       // it to render frames to. For example, SurfaceViews on Android.
       SUPPORTS_EXTERNAL_OUTPUT_SURFACE = 1 << 1,
+
+      // If set, the VDA will use deferred initialization if the config
+      // indicates that the client supports it as well.  Refer to
+      // NotifyInitializationComplete for more details.
+      SUPPORTS_DEFERRED_INITIALIZATION = 1 << 2,
     };
 
     SupportedProfiles supported_profiles;
@@ -109,6 +114,10 @@
     // The flag indicating whether the stream is encrypted.
     bool is_encrypted = false;
 
+    // The flag indicating whether the client supports deferred initialization
+    // or not.
+    bool is_deferred_initialization_allowed = false;
+
     // An optional graphics surface that the VDA should render to. For setting
     // an output SurfaceView on Android. It's only valid when not equal to
     // |kNoSurfaceID|.
@@ -123,10 +132,14 @@
   // implements.
   class MEDIA_EXPORT Client {
    public:
-    // SetCdm completion callback to indicate whether the CDM is successfully
-    // attached to the decoder. The default implementation is a no-op since most
-    // VDAs don't support encrypted video.
-    virtual void NotifyCdmAttached(bool success);
+    // Notify the client that deferred initialization has completed successfully
+    // or not.  This is required if and only if deferred initialization is
+    // supported by the VDA (see Capabilities), and it is supported by the
+    // client (see Config::is_deferred_initialization_allowed), and the initial
+    // call to VDA::Initialize returns true.
+    // The default implementation is a NOTREACHED, since deferred initialization
+    // is not supported by default.
+    virtual void NotifyInitializationComplete(bool success);
 
     // Callback to tell client how many and what size of buffers to provide.
     // Note that the actual count provided through AssignPictureBuffers() can be
@@ -165,7 +178,16 @@
 
   // Initializes the video decoder with specific configuration.  Called once per
   // decoder construction.  This call is synchronous and returns true iff
-  // initialization is successful.
+  // initialization is successful, unless deferred initialization is used.
+  //
+  // By default, deferred initialization is not used.  However, if Config::
+  // is_deferred_initialization_allowed is set by the client, and if
+  // Capabilities::Flags::SUPPORTS_DEFERRED_INITIALIZATION is set by the VDA,
+  // and if VDA::Initialize returns true, then the client can expect a call to
+  // NotifyInitializationComplete with the actual success / failure of
+  // initialization.  Note that a return value of false from VDA::Initialize
+  // indicates that initialization definitely failed, and no callback is needed.
+  // TODO(liberato): should we say that encrypted video requires deferred?
   //
   // For encrpyted video, the decoder needs a CDM to be able to decode encrypted
   // buffers. SetCdm() should be called after Initialize() to set such a CDM.

diff --git a/net/cookies/cookie_monster_unittest.cc b/net/cookies/cookie_monster_unittest.cc
index eaa0e72..45c3063b 100644
--- a/net/cookies/cookie_monster_unittest.cc
+++ b/net/cookies/cookie_monster_unittest.cc

@@ -856,14 +856,14 @@
 TEST_F(DeferredCookieTaskTest, DeferredSetAllCookies) {
   MockSetCookiesCallback set_cookies_callback;
   CookieList list;
-  list.push_back(CanonicalCookie(
+  list.push_back(*CanonicalCookie::Create(
       http_www_google_.url(), "A", "B", http_www_google_.domain(), "/",
-      base::Time::Now(), base::Time(), base::Time(), false, true,
-      CookieSameSite::DEFAULT_MODE, COOKIE_PRIORITY_DEFAULT));
-  list.push_back(CanonicalCookie(
+      base::Time::Now(), base::Time(), false, true,
+      CookieSameSite::DEFAULT_MODE, false, COOKIE_PRIORITY_DEFAULT));
+  list.push_back(*CanonicalCookie::Create(
       http_www_google_.url(), "C", "D", http_www_google_.domain(), "/",
-      base::Time::Now(), base::Time(), base::Time(), false, true,
-      CookieSameSite::DEFAULT_MODE, COOKIE_PRIORITY_DEFAULT));
+      base::Time::Now(), base::Time(), false, true,
+      CookieSameSite::DEFAULT_MODE, false, COOKIE_PRIORITY_DEFAULT));
 
   BeginWith(
       SetAllCookiesAction(&cookie_monster(), list, &set_cookies_callback));
@@ -2303,18 +2303,18 @@
   EXPECT_TRUE(SetCookie(cm.get(), http_www_google_.url(), "Y=Z; path=/"));
 
   CookieList list;
-  list.push_back(CanonicalCookie(
+  list.push_back(*CanonicalCookie::Create(
       http_www_google_.url(), "A", "B", http_www_google_.url().host(), "/",
-      base::Time::Now(), base::Time(), base::Time(), false, false,
-      CookieSameSite::DEFAULT_MODE, COOKIE_PRIORITY_DEFAULT));
-  list.push_back(CanonicalCookie(
+      base::Time::Now(), base::Time(), false, false,
+      CookieSameSite::DEFAULT_MODE, false, COOKIE_PRIORITY_DEFAULT));
+  list.push_back(*CanonicalCookie::Create(
       http_www_google_.url(), "W", "X", http_www_google_.url().host(), "/bar",
-      base::Time::Now(), base::Time(), base::Time(), false, false,
-      CookieSameSite::DEFAULT_MODE, COOKIE_PRIORITY_DEFAULT));
-  list.push_back(CanonicalCookie(
+      base::Time::Now(), base::Time(), false, false,
+      CookieSameSite::DEFAULT_MODE, false, COOKIE_PRIORITY_DEFAULT));
+  list.push_back(*CanonicalCookie::Create(
       http_www_google_.url(), "Y", "Z", http_www_google_.url().host(), "/",
-      base::Time::Now(), base::Time(), base::Time(), false, false,
-      CookieSameSite::DEFAULT_MODE, COOKIE_PRIORITY_DEFAULT));
+      base::Time::Now(), base::Time(), false, false,
+      CookieSameSite::DEFAULT_MODE, false, COOKIE_PRIORITY_DEFAULT));
 
   // SetAllCookies must not flush.
   ASSERT_EQ(0, store->flush_count());
@@ -2346,67 +2346,68 @@
   base::Time now = base::Time::Now();
   base::Time creation_time = now - base::TimeDelta::FromSeconds(1);
 
-  CanonicalCookie cookie1(
+  scoped_ptr<CanonicalCookie> cookie1(CanonicalCookie::Create(
       http_www_google_.url(), "A", "B", http_www_google_.url().host(), "/",
-      creation_time, base::Time(), base::Time(), false, false,
-      CookieSameSite::DEFAULT_MODE, COOKIE_PRIORITY_DEFAULT);
-  CanonicalCookie cookie2(
+      creation_time, base::Time(), false, false, CookieSameSite::DEFAULT_MODE,
+      false, COOKIE_PRIORITY_DEFAULT));
+  scoped_ptr<CanonicalCookie> cookie2(CanonicalCookie::Create(
       http_www_google_.url(), "C", "D", http_www_google_.url().host(), "/",
-      creation_time, base::Time(), base::Time(), false, false,
-      CookieSameSite::DEFAULT_MODE, COOKIE_PRIORITY_DEFAULT);
-  CanonicalCookie cookie3(
+      creation_time, base::Time(), false, false, CookieSameSite::DEFAULT_MODE,
+      false, COOKIE_PRIORITY_DEFAULT));
+  scoped_ptr<CanonicalCookie> cookie3(CanonicalCookie::Create(
       http_www_google_.url(), "E", "F", http_www_google_.url().host(), "/",
-      creation_time, base::Time(), base::Time(), false, false,
-      CookieSameSite::DEFAULT_MODE, COOKIE_PRIORITY_DEFAULT);
-  CanonicalCookie cookie4(
+      creation_time, base::Time(), false, false, CookieSameSite::DEFAULT_MODE,
+      false, COOKIE_PRIORITY_DEFAULT));
+  scoped_ptr<CanonicalCookie> cookie4(CanonicalCookie::Create(
       http_www_google_.url(), "G", "H", http_www_google_.url().host(), "/",
-      creation_time, base::Time(), base::Time(), false, false,
-      CookieSameSite::DEFAULT_MODE, COOKIE_PRIORITY_DEFAULT);
-  CanonicalCookie cookie4_with_new_value(
+      creation_time, base::Time(), false, false, CookieSameSite::DEFAULT_MODE,
+      false, COOKIE_PRIORITY_DEFAULT));
+  scoped_ptr<CanonicalCookie> cookie4_with_new_value(CanonicalCookie::Create(
       http_www_google_.url(), "G", "iamnew", http_www_google_.url().host(), "/",
-      creation_time, base::Time(), base::Time(), false, false,
-      CookieSameSite::DEFAULT_MODE, COOKIE_PRIORITY_DEFAULT);
-  CanonicalCookie cookie5(
+      creation_time, base::Time(), false, false, CookieSameSite::DEFAULT_MODE,
+      false, COOKIE_PRIORITY_DEFAULT));
+  scoped_ptr<CanonicalCookie> cookie5(CanonicalCookie::Create(
       http_www_google_.url(), "I", "J", http_www_google_.url().host(), "/",
-      creation_time, base::Time(), base::Time(), false, false,
-      CookieSameSite::DEFAULT_MODE, COOKIE_PRIORITY_DEFAULT);
-  CanonicalCookie cookie5_with_new_creation_time(
-      http_www_google_.url(), "I", "J", http_www_google_.url().host(), "/", now,
-      base::Time(), base::Time(), false, false, CookieSameSite::DEFAULT_MODE,
-      COOKIE_PRIORITY_DEFAULT);
-  CanonicalCookie cookie6(
+      creation_time, base::Time(), false, false, CookieSameSite::DEFAULT_MODE,
+      false, COOKIE_PRIORITY_DEFAULT));
+  scoped_ptr<CanonicalCookie> cookie5_with_new_creation_time(
+      CanonicalCookie::Create(
+          http_www_google_.url(), "I", "J", http_www_google_.url().host(), "/",
+          now, base::Time(), false, false, CookieSameSite::DEFAULT_MODE, false,
+          COOKIE_PRIORITY_DEFAULT));
+  scoped_ptr<CanonicalCookie> cookie6(CanonicalCookie::Create(
       http_www_google_.url(), "K", "L", http_www_google_.url().host(), "/foo",
-      creation_time, base::Time(), base::Time(), false, false,
-      CookieSameSite::DEFAULT_MODE, COOKIE_PRIORITY_DEFAULT);
-  CanonicalCookie cookie6_with_new_path(
+      creation_time, base::Time(), false, false, CookieSameSite::DEFAULT_MODE,
+      false, COOKIE_PRIORITY_DEFAULT));
+  scoped_ptr<CanonicalCookie> cookie6_with_new_path(CanonicalCookie::Create(
       http_www_google_.url(), "K", "L", http_www_google_.url().host(), "/bar",
-      creation_time, base::Time(), base::Time(), false, false,
-      CookieSameSite::DEFAULT_MODE, COOKIE_PRIORITY_DEFAULT);
-  CanonicalCookie cookie7(
+      creation_time, base::Time(), false, false, CookieSameSite::DEFAULT_MODE,
+      false, COOKIE_PRIORITY_DEFAULT));
+  scoped_ptr<CanonicalCookie> cookie7(CanonicalCookie::Create(
       http_www_google_.url(), "M", "N", http_www_google_.url().host(), "/foo",
-      creation_time, base::Time(), base::Time(), false, false,
-      CookieSameSite::DEFAULT_MODE, COOKIE_PRIORITY_DEFAULT);
-  CanonicalCookie cookie7_with_new_path(
+      creation_time, base::Time(), false, false, CookieSameSite::DEFAULT_MODE,
+      false, COOKIE_PRIORITY_DEFAULT));
+  scoped_ptr<CanonicalCookie> cookie7_with_new_path(CanonicalCookie::Create(
       http_www_google_.url(), "M", "N", http_www_google_.url().host(), "/bar",
-      creation_time, base::Time(), base::Time(), false, false,
-      CookieSameSite::DEFAULT_MODE, COOKIE_PRIORITY_DEFAULT);
+      creation_time, base::Time(), false, false, CookieSameSite::DEFAULT_MODE,
+      false, COOKIE_PRIORITY_DEFAULT));
 
   CookieList old_cookies;
-  old_cookies.push_back(cookie1);
-  old_cookies.push_back(cookie2);
-  old_cookies.push_back(cookie4);
-  old_cookies.push_back(cookie5);
-  old_cookies.push_back(cookie6);
-  old_cookies.push_back(cookie7);
+  old_cookies.push_back(*cookie1);
+  old_cookies.push_back(*cookie2);
+  old_cookies.push_back(*cookie4);
+  old_cookies.push_back(*cookie5);
+  old_cookies.push_back(*cookie6);
+  old_cookies.push_back(*cookie7);
 
   CookieList new_cookies;
-  new_cookies.push_back(cookie1);
-  new_cookies.push_back(cookie3);
-  new_cookies.push_back(cookie4_with_new_value);
-  new_cookies.push_back(cookie5_with_new_creation_time);
-  new_cookies.push_back(cookie6_with_new_path);
-  new_cookies.push_back(cookie7);
-  new_cookies.push_back(cookie7_with_new_path);
+  new_cookies.push_back(*cookie1);
+  new_cookies.push_back(*cookie3);
+  new_cookies.push_back(*cookie4_with_new_value);
+  new_cookies.push_back(*cookie5_with_new_creation_time);
+  new_cookies.push_back(*cookie6_with_new_path);
+  new_cookies.push_back(*cookie7);
+  new_cookies.push_back(*cookie7_with_new_path);
 
   CookieList cookies_to_add;
   CookieList cookies_to_delete;
@@ -2415,44 +2416,44 @@
                         &cookies_to_delete);
 
   // |cookie1| has not changed.
-  EXPECT_FALSE(IsCookieInList(cookie1, cookies_to_add));
-  EXPECT_FALSE(IsCookieInList(cookie1, cookies_to_delete));
+  EXPECT_FALSE(IsCookieInList(*cookie1, cookies_to_add));
+  EXPECT_FALSE(IsCookieInList(*cookie1, cookies_to_delete));
 
   // |cookie2| has been deleted.
-  EXPECT_FALSE(IsCookieInList(cookie2, cookies_to_add));
-  EXPECT_TRUE(IsCookieInList(cookie2, cookies_to_delete));
+  EXPECT_FALSE(IsCookieInList(*cookie2, cookies_to_add));
+  EXPECT_TRUE(IsCookieInList(*cookie2, cookies_to_delete));
 
   // |cookie3| has been added.
-  EXPECT_TRUE(IsCookieInList(cookie3, cookies_to_add));
-  EXPECT_FALSE(IsCookieInList(cookie3, cookies_to_delete));
+  EXPECT_TRUE(IsCookieInList(*cookie3, cookies_to_add));
+  EXPECT_FALSE(IsCookieInList(*cookie3, cookies_to_delete));
 
   // |cookie4| has a new value: new cookie overrides the old one (which does not
   // need to be explicitly removed).
-  EXPECT_FALSE(IsCookieInList(cookie4, cookies_to_add));
-  EXPECT_FALSE(IsCookieInList(cookie4, cookies_to_delete));
-  EXPECT_TRUE(IsCookieInList(cookie4_with_new_value, cookies_to_add));
-  EXPECT_FALSE(IsCookieInList(cookie4_with_new_value, cookies_to_delete));
+  EXPECT_FALSE(IsCookieInList(*cookie4, cookies_to_add));
+  EXPECT_FALSE(IsCookieInList(*cookie4, cookies_to_delete));
+  EXPECT_TRUE(IsCookieInList(*cookie4_with_new_value, cookies_to_add));
+  EXPECT_FALSE(IsCookieInList(*cookie4_with_new_value, cookies_to_delete));
 
   // |cookie5| has a new creation time: new cookie overrides the old one (which
   // does not need to be explicitly removed).
-  EXPECT_FALSE(IsCookieInList(cookie5, cookies_to_add));
-  EXPECT_FALSE(IsCookieInList(cookie5, cookies_to_delete));
-  EXPECT_TRUE(IsCookieInList(cookie5_with_new_creation_time, cookies_to_add));
+  EXPECT_FALSE(IsCookieInList(*cookie5, cookies_to_add));
+  EXPECT_FALSE(IsCookieInList(*cookie5, cookies_to_delete));
+  EXPECT_TRUE(IsCookieInList(*cookie5_with_new_creation_time, cookies_to_add));
   EXPECT_FALSE(
-      IsCookieInList(cookie5_with_new_creation_time, cookies_to_delete));
+      IsCookieInList(*cookie5_with_new_creation_time, cookies_to_delete));
 
   // |cookie6| has a new path: the new cookie does not overrides the old one,
   // which needs to be explicitly removed.
-  EXPECT_FALSE(IsCookieInList(cookie6, cookies_to_add));
-  EXPECT_TRUE(IsCookieInList(cookie6, cookies_to_delete));
-  EXPECT_TRUE(IsCookieInList(cookie6_with_new_path, cookies_to_add));
-  EXPECT_FALSE(IsCookieInList(cookie6_with_new_path, cookies_to_delete));
+  EXPECT_FALSE(IsCookieInList(*cookie6, cookies_to_add));
+  EXPECT_TRUE(IsCookieInList(*cookie6, cookies_to_delete));
+  EXPECT_TRUE(IsCookieInList(*cookie6_with_new_path, cookies_to_add));
+  EXPECT_FALSE(IsCookieInList(*cookie6_with_new_path, cookies_to_delete));
 
   // |cookie7| is kept and |cookie7_with_new_path| is added as a new cookie.
-  EXPECT_FALSE(IsCookieInList(cookie7, cookies_to_add));
-  EXPECT_FALSE(IsCookieInList(cookie7, cookies_to_delete));
-  EXPECT_TRUE(IsCookieInList(cookie7_with_new_path, cookies_to_add));
-  EXPECT_FALSE(IsCookieInList(cookie7_with_new_path, cookies_to_delete));
+  EXPECT_FALSE(IsCookieInList(*cookie7, cookies_to_add));
+  EXPECT_FALSE(IsCookieInList(*cookie7, cookies_to_delete));
+  EXPECT_TRUE(IsCookieInList(*cookie7_with_new_path, cookies_to_add));
+  EXPECT_FALSE(IsCookieInList(*cookie7_with_new_path, cookies_to_delete));
 }
 
 // Check that DeleteAll does flush (as a sanity check that flush_count()
@@ -2601,13 +2602,13 @@
 
   // We have to manually build this cookie because it contains a control
   // character, and our cookie line parser rejects control characters.
-  CanonicalCookie* cc = new CanonicalCookie(
+  scoped_ptr<CanonicalCookie> cc = CanonicalCookie::Create(
       url, "baz",
       "\x05"
       "boo",
-      domain, path, now2, later, now2, false, false,
-      CookieSameSite::DEFAULT_MODE, COOKIE_PRIORITY_DEFAULT);
-  initial_cookies.push_back(cc);
+      domain, path, now2, later, false, false, CookieSameSite::DEFAULT_MODE,
+      false, COOKIE_PRIORITY_DEFAULT);
+  initial_cookies.push_back(cc.release());
 
   AddCookieToList(url, "hello=world; path=" + path, now3, &initial_cookies);
 

diff --git a/net/dns/dns_config_service.cc b/net/dns/dns_config_service.cc
index 23f1424..e30ed7a 100644
--- a/net/dns/dns_config_service.cc
+++ b/net/dns/dns_config_service.cc

@@ -12,87 +12,6 @@
 
 namespace net {
 
-NameServerClassifier::NameServerClassifier() {
-  // Google Public DNS addresses from:
-  // https://developers.google.com/speed/public-dns/docs/using
-  AddRule("8.8.8.8", NAME_SERVERS_TYPE_GOOGLE_PUBLIC_DNS);
-  AddRule("8.8.4.4", NAME_SERVERS_TYPE_GOOGLE_PUBLIC_DNS);
-  AddRule("2001:4860:4860:0:0:0:0:8888", NAME_SERVERS_TYPE_GOOGLE_PUBLIC_DNS),
-  AddRule("2001:4860:4860:0:0:0:0:8844", NAME_SERVERS_TYPE_GOOGLE_PUBLIC_DNS),
-
-  // Count localhost as private, since we don't know what upstream it uses:
-  AddRule("127.*.*.*", NAME_SERVERS_TYPE_PRIVATE);
-  AddRule("0:0:0:0:0:0:0:1", NAME_SERVERS_TYPE_PRIVATE);
-
-  // RFC 1918 private addresses:
-  AddRule("10.*.*.*", NAME_SERVERS_TYPE_PRIVATE);
-  AddRule("172.[16-31].*.*", NAME_SERVERS_TYPE_PRIVATE);
-  AddRule("192.168.*.*", NAME_SERVERS_TYPE_PRIVATE);
-
-  // IPv4 link-local addresses:
-  AddRule("169.254.*.*", NAME_SERVERS_TYPE_PRIVATE);
-
-  // IPv6 link-local addresses:
-  AddRule("fe80:*:*:*:*:*:*:*", NAME_SERVERS_TYPE_PRIVATE);
-
-  // Anything else counts as public:
-  AddRule("*.*.*.*", NAME_SERVERS_TYPE_PUBLIC);
-  AddRule("*:*:*:*:*:*:*:*", NAME_SERVERS_TYPE_PUBLIC);
-}
-
-NameServerClassifier::~NameServerClassifier() {}
-
-NameServerClassifier::NameServersType NameServerClassifier::GetNameServersType(
-    const std::vector<IPEndPoint>& nameservers) const {
-  NameServersType type = NAME_SERVERS_TYPE_NONE;
-  for (std::vector<IPEndPoint>::const_iterator it = nameservers.begin();
-       it != nameservers.end();
-       ++it) {
-    type = MergeNameServersTypes(type, GetNameServerType(it->address()));
-  }
-  return type;
-}
-
-struct NameServerClassifier::NameServerTypeRule {
-  NameServerTypeRule(const char* pattern_string, NameServersType type)
-      : type(type) {
-    bool parsed = pattern.ParsePattern(pattern_string);
-    DCHECK(parsed);
-  }
-
-  IPPattern pattern;
-  NameServersType type;
-};
-
-void NameServerClassifier::AddRule(const char* pattern_string,
-                                   NameServersType address_type) {
-  rules_.push_back(new NameServerTypeRule(pattern_string, address_type));
-}
-
-NameServerClassifier::NameServersType NameServerClassifier::GetNameServerType(
-    const IPAddress& address) const {
-  for (ScopedVector<NameServerTypeRule>::const_iterator it = rules_.begin();
-       it != rules_.end();
-       ++it) {
-    if ((*it)->pattern.Match(address))
-      return (*it)->type;
-  }
-  NOTREACHED();
-  return NAME_SERVERS_TYPE_NONE;
-}
-
-NameServerClassifier::NameServersType
-NameServerClassifier::MergeNameServersTypes(NameServersType a,
-                                            NameServersType b) {
-  if (a == NAME_SERVERS_TYPE_NONE)
-    return b;
-  if (b == NAME_SERVERS_TYPE_NONE)
-    return a;
-  if (a == b)
-    return a;
-  return NAME_SERVERS_TYPE_MIXED;
-}
-
 // Default values are taken from glibc resolv.h except timeout which is set to
 // |kDnsDefaultTimeoutMs|.
 DnsConfig::DnsConfig()
@@ -236,10 +155,6 @@
                              base::TimeTicks::Now() - last_sent_empty_time_);
   }
   UMA_HISTOGRAM_BOOLEAN("AsyncDNS.ConfigChange", changed);
-  UMA_HISTOGRAM_ENUMERATION(
-      "AsyncDNS.NameServersType",
-      classifier_.GetNameServersType(dns_config_.nameservers),
-      NameServerClassifier::NAME_SERVERS_TYPE_MAX_VALUE);
 
   have_config_ = true;
   if (have_hosts_ || watch_failed_)

diff --git a/net/dns/dns_config_service.h b/net/dns/dns_config_service.h
index dfe2680..e62a5af 100644
--- a/net/dns/dns_config_service.h
+++ b/net/dns/dns_config_service.h

@@ -33,37 +33,6 @@
 // Default to 1 second timeout (before exponential backoff).
 const int64_t kDnsDefaultTimeoutMs = 1000;
 
-// Classifies nameserver address lists for histograms.
-class NET_EXPORT_PRIVATE NameServerClassifier {
- public:
-  // This is used in a histogram (AsyncDNS.NameServersType); add new entries
-  // right before MAX_VALUE.
-  enum NameServersType {
-    NAME_SERVERS_TYPE_NONE,
-    NAME_SERVERS_TYPE_GOOGLE_PUBLIC_DNS,
-    NAME_SERVERS_TYPE_PRIVATE,
-    NAME_SERVERS_TYPE_PUBLIC,
-    NAME_SERVERS_TYPE_MIXED,
-    NAME_SERVERS_TYPE_MAX_VALUE
-  };
-
-  NameServerClassifier();
-  ~NameServerClassifier();
-
-  NameServersType GetNameServersType(
-      const std::vector<IPEndPoint>& nameservers) const;
-
- private:
-  struct NameServerTypeRule;
-
-  void AddRule(const char* pattern_string, NameServersType type);
-  NameServersType GetNameServerType(const IPAddress& address) const;
-  static NameServersType MergeNameServersTypes(NameServersType a,
-                                               NameServersType b);
-
-  ScopedVector<NameServerTypeRule> rules_;
-};
-
 // DnsConfig stores configuration of the system resolver.
 struct NET_EXPORT_PRIVATE DnsConfig {
   DnsConfig();
@@ -207,8 +176,6 @@
   // Started in Invalidate*, cleared in On*Read.
   base::OneShotTimer timer_;
 
-  NameServerClassifier classifier_;
-
   DISALLOW_COPY_AND_ASSIGN(DnsConfigService);
 };
 

diff --git a/net/dns/dns_config_service_unittest.cc b/net/dns/dns_config_service_unittest.cc
index 16d1c896..ae8e5f6 100644
--- a/net/dns/dns_config_service_unittest.cc
+++ b/net/dns/dns_config_service_unittest.cc

@@ -20,93 +20,6 @@
 
 namespace {
 
-const NameServerClassifier::NameServersType kNone =
-    NameServerClassifier::NAME_SERVERS_TYPE_NONE;
-const NameServerClassifier::NameServersType kGoogle =
-    NameServerClassifier::NAME_SERVERS_TYPE_GOOGLE_PUBLIC_DNS;
-const NameServerClassifier::NameServersType kPrivate =
-    NameServerClassifier::NAME_SERVERS_TYPE_PRIVATE;
-const NameServerClassifier::NameServersType kPublic =
-    NameServerClassifier::NAME_SERVERS_TYPE_PUBLIC;
-const NameServerClassifier::NameServersType kMixed =
-    NameServerClassifier::NAME_SERVERS_TYPE_MIXED;
-
-class NameServerClassifierTest : public testing::Test {
- protected:
-  NameServerClassifier::NameServersType Classify(
-      const std::string& servers_string) {
-    std::vector<IPEndPoint> servers;
-    for (const base::StringPiece& server_str :
-         base::SplitStringPiece(servers_string, " ", base::TRIM_WHITESPACE,
-                                base::SPLIT_WANT_ALL)) {
-      if (server_str.empty())
-        continue;
-
-      IPAddress address;
-      EXPECT_TRUE(address.AssignFromIPLiteral(server_str));
-      servers.push_back(IPEndPoint(address, dns_protocol::kDefaultPort));
-    }
-
-    return classifier_.GetNameServersType(servers);
-  }
-
- private:
-  NameServerClassifier classifier_;
-};
-
-TEST_F(NameServerClassifierTest, None) {
-  EXPECT_EQ(kNone, Classify(""));
-}
-
-TEST_F(NameServerClassifierTest, Google) {
-  EXPECT_EQ(kGoogle, Classify("8.8.8.8"));
-  EXPECT_EQ(kGoogle, Classify("8.8.8.8 8.8.4.4"));
-  EXPECT_EQ(kGoogle, Classify("2001:4860:4860::8888"));
-  EXPECT_EQ(kGoogle, Classify("2001:4860:4860::8888 2001:4860:4860::8844"));
-  EXPECT_EQ(kGoogle, Classify("2001:4860:4860::8888 8.8.8.8"));
-
-  // Make sure nobody took any shortcuts on the IP matching:
-  EXPECT_EQ(kPublic, Classify("8.8.8.4"));
-  EXPECT_EQ(kPublic, Classify("8.8.4.8"));
-  EXPECT_EQ(kPublic, Classify("2001:4860:4860::8884"));
-  EXPECT_EQ(kPublic, Classify("2001:4860:4860::8848"));
-  EXPECT_EQ(kPublic, Classify("2001:4860:4860::1:8888"));
-  EXPECT_EQ(kPublic, Classify("2001:4860:4860:1::8888"));
-}
-
-TEST_F(NameServerClassifierTest, PrivateLocalhost) {
-  EXPECT_EQ(kPrivate, Classify("127.0.0.1"));
-  EXPECT_EQ(kPrivate, Classify("::1"));
-}
-
-TEST_F(NameServerClassifierTest, PrivateRfc1918) {
-  EXPECT_EQ(kPrivate, Classify("10.0.0.0 10.255.255.255"));
-  EXPECT_EQ(kPrivate, Classify("172.16.0.0 172.31.255.255"));
-  EXPECT_EQ(kPrivate, Classify("192.168.0.0 192.168.255.255"));
-  EXPECT_EQ(kPrivate, Classify("10.1.1.1 172.16.1.1 192.168.1.1"));
-}
-
-TEST_F(NameServerClassifierTest, PrivateIPv4LinkLocal) {
-  EXPECT_EQ(kPrivate, Classify("169.254.0.0 169.254.255.255"));
-}
-
-TEST_F(NameServerClassifierTest, PrivateIPv6LinkLocal) {
-  EXPECT_EQ(kPrivate,
-      Classify("fe80:: fe80:ffff:ffff:ffff:ffff:ffff:ffff:ffff"));
-}
-
-TEST_F(NameServerClassifierTest, Public) {
-  EXPECT_EQ(kPublic, Classify("4.2.2.1"));
-  EXPECT_EQ(kPublic, Classify("4.2.2.1 4.2.2.2"));
-}
-
-TEST_F(NameServerClassifierTest, Mixed) {
-  EXPECT_EQ(kMixed, Classify("8.8.8.8 192.168.1.1"));
-  EXPECT_EQ(kMixed, Classify("8.8.8.8 4.2.2.1"));
-  EXPECT_EQ(kMixed, Classify("192.168.1.1 4.2.2.1"));
-  EXPECT_EQ(kMixed, Classify("8.8.8.8 192.168.1.1 4.2.2.1"));
-}
-
 class DnsConfigServiceTest : public testing::Test {
  public:
   void OnConfigChanged(const DnsConfig& config) {

diff --git a/remoting/host/BUILD.gn b/remoting/host/BUILD.gn
index fce89542..618850d 100644
--- a/remoting/host/BUILD.gn
+++ b/remoting/host/BUILD.gn

@@ -271,6 +271,7 @@
       "it2me/it2me_confirmation_dialog_proxy_unittest.cc",
       "it2me/it2me_native_messaging_host_unittest.cc",
       "linux/audio_pipe_reader_unittest.cc",
+      "linux/certificate_watcher_unittest.cc",
       "linux/unicode_to_keysym_unittest.cc",
       "linux/x_server_clipboard_unittest.cc",
       "local_input_monitor_unittest.cc",

diff --git a/remoting/host/linux/certificate_watcher.cc b/remoting/host/linux/certificate_watcher.cc
new file mode 100644
index 0000000..42e3a7cc
--- /dev/null
+++ b/remoting/host/linux/certificate_watcher.cc

@@ -0,0 +1,145 @@
+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "remoting/host/linux/certificate_watcher.h"
+
+#include "base/bind.h"
+#include "base/bind_helpers.h"
+#include "base/location.h"
+#include "base/logging.h"
+#include "base/path_service.h"
+#include "base/thread_task_runner_handle.h"
+
+namespace remoting {
+
+// Delay time to restart the host when a change of certificate is detected.
+// This is to avoid repeating restarts when continuous writes to the database
+// occur.
+const int kRestartDelayInSecond = 2;
+
+// Full Path: $HOME/.pki/nssdb
+const char kCertDirectoryPath[] = ".pki/nssdb";
+
+CertificateWatcher::CertificateWatcher(
+    const base::Closure& restart_action,
+    scoped_refptr<base::SingleThreadTaskRunner> io_task_runner)
+    : restart_action_(restart_action),
+      caller_task_runner_(base::ThreadTaskRunnerHandle::Get()),
+      io_task_runner_(io_task_runner),
+      delay_(base::TimeDelta::FromSeconds(kRestartDelayInSecond)),
+      weak_factory_(this) {
+  if (!base::PathService::Get(base::DIR_HOME, &cert_watch_path_)) {
+    LOG(FATAL) << "Failed to get path of the home directory.";
+  }
+  cert_watch_path_ = cert_watch_path_.AppendASCII(kCertDirectoryPath);
+}
+
+CertificateWatcher::~CertificateWatcher() {
+  DCHECK(caller_task_runner_->BelongsToCurrentThread());
+
+  if (!is_started()) {
+    return;
+  }
+  if (monitor_) {
+    monitor_->RemoveStatusObserver(this);
+  }
+  io_task_runner_->DeleteSoon(FROM_HERE, file_watcher_.release());
+
+  VLOG(1) << "Stopped watching certificate changes.";
+}
+
+void CertificateWatcher::Start() {
+  DCHECK(caller_task_runner_->BelongsToCurrentThread());
+  DCHECK(!cert_watch_path_.empty());
+
+  file_watcher_.reset(new base::FilePathWatcher());
+  io_task_runner_->PostTask(
+      FROM_HERE,
+      base::Bind(base::IgnoreResult(&base::FilePathWatcher::Watch),
+                 base::Unretained(file_watcher_.get()), cert_watch_path_, true,
+                 base::Bind(&CertificateWatcher::OnCertDirectoryChanged,
+                            caller_task_runner_, weak_factory_.GetWeakPtr())));
+  restart_timer_.reset(new base::DelayTimer(FROM_HERE, delay_, this,
+                                            &CertificateWatcher::OnTimer));
+
+  VLOG(1) << "Started watching certificate changes.";
+}
+
+void CertificateWatcher::SetMonitor(base::WeakPtr<HostStatusMonitor> monitor) {
+  DCHECK(is_started());
+  if (monitor_) {
+    monitor_->RemoveStatusObserver(this);
+  }
+  monitor->AddStatusObserver(this);
+  monitor_ = monitor;
+}
+
+void CertificateWatcher::OnClientConnected(const std::string& jid) {
+  DCHECK(is_started());
+  DCHECK(caller_task_runner_->BelongsToCurrentThread());
+  inhibit_mode_ = true;
+}
+
+void CertificateWatcher::OnClientDisconnected(const std::string& jid) {
+  DCHECK(is_started());
+  DCHECK(caller_task_runner_->BelongsToCurrentThread());
+  inhibit_mode_ = false;
+  if (restart_pending_) {
+    restart_pending_ = false;
+    restart_action_.Run();
+  }
+}
+
+void CertificateWatcher::SetDelayForTests(const base::TimeDelta& delay) {
+  DCHECK(!is_started());
+  delay_ = delay;
+}
+
+void CertificateWatcher::SetWatchPathForTests(
+    const base::FilePath& watch_path) {
+  DCHECK(!is_started());
+  cert_watch_path_ = watch_path;
+}
+
+bool CertificateWatcher::is_started() const {
+  return file_watcher_ != nullptr;
+}
+
+// static
+void CertificateWatcher::OnCertDirectoryChanged(
+    scoped_refptr<base::SingleThreadTaskRunner> network_task_runner,
+    base::WeakPtr<CertificateWatcher> watcher_,
+    const base::FilePath& path,
+    bool error) {
+  network_task_runner->PostTask(
+      FROM_HERE,
+      base::Bind(&CertificateWatcher::DirectoryChanged, watcher_, path, error));
+}
+
+void CertificateWatcher::DirectoryChanged(const base::FilePath& path,
+                                          bool error) {
+  DCHECK(caller_task_runner_->BelongsToCurrentThread());
+  DCHECK(path == cert_watch_path_);
+
+  if (error) {
+    LOG(FATAL) << "Error occurs when watching changes of file "
+               << cert_watch_path_.MaybeAsASCII();
+  }
+
+  restart_timer_->Reset();
+}
+
+void CertificateWatcher::OnTimer() {
+  DCHECK(caller_task_runner_->BelongsToCurrentThread());
+
+  if (inhibit_mode_) {
+    restart_pending_ = true;
+    return;
+  }
+
+  VLOG(1) << "Certificate was updated. Calling restart...";
+  restart_action_.Run();
+}
+
+}  // namespace remoting

diff --git a/remoting/host/linux/certificate_watcher.h b/remoting/host/linux/certificate_watcher.h
new file mode 100644
index 0000000..5d99139b
--- /dev/null
+++ b/remoting/host/linux/certificate_watcher.h

@@ -0,0 +1,109 @@
+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef REMOTING_HOST_LINUX_CERTIFICATE_WATCHER_H_
+#define REMOTING_HOST_LINUX_CERTIFICATE_WATCHER_H_
+
+#include "base/files/file_path.h"
+#include "base/files/file_path_watcher.h"
+#include "base/macros.h"
+#include "base/memory/scoped_ptr.h"
+#include "base/memory/weak_ptr.h"
+#include "base/timer/timer.h"
+#include "remoting/host/host_status_monitor.h"
+#include "remoting/host/host_status_observer.h"
+
+namespace remoting {
+
+// This class watches the cert database and notifies the host to restart when
+// a change of the database is detected. The runner script will restart the host
+// when the host is killed then the new host will capture any new changes of the
+// database.
+//
+// Acceptable false positives will be caused by desktop sessions and other
+// external programs.
+//
+// Implements HostStatusObserver to defer restart action when the host is
+// connected to a client.
+class CertificateWatcher : public remoting::HostStatusObserver {
+ public:
+  CertificateWatcher(
+      const base::Closure& restart_action,
+      scoped_refptr<base::SingleThreadTaskRunner> io_task_runner);
+
+  // The message loop of io_task_runner MUST be running after the destructor is
+  // called, otherwise there will be memory leaks.
+  ~CertificateWatcher() override;
+
+  // Starts watching file changes
+  // calling |restart_action_| when the host need to restart.
+  void Start();
+
+  // Sets the monitor to observe connection/disconnection events to toggle
+  // the inhibit mode. Should be called after the watcher starts.
+  // Adds |this| as an observer to the monitor.
+  // Removes |this| as an observer from the old monitor if it is not null.
+  void SetMonitor(base::WeakPtr<HostStatusMonitor> monitor);
+
+  // HostStatusObserver interface.
+  void OnClientConnected(const std::string& jid) override;
+  void OnClientDisconnected(const std::string& jid) override;
+
+  // Will only work before the watcher starts.
+  void SetDelayForTests(const base::TimeDelta& delay);
+  void SetWatchPathForTests(const base::FilePath& watch_path);
+
+ private:
+  // Returns true if the watcher has started.
+  bool is_started() const;
+
+  // Callback passed to |file_watcher_|. Runs in IO thread.
+  static void OnCertDirectoryChanged(
+      scoped_refptr<base::SingleThreadTaskRunner> network_task_runner,
+      base::WeakPtr<CertificateWatcher> watcher_, const base::FilePath& path,
+      bool error);
+
+  // Runs in the caller's thread.
+  void DirectoryChanged(const base::FilePath& path, bool error);
+
+  // Called by |restart_timer_| when it's time to reset the host.
+  // It will defer restart if |inhibit_restart_scheduled_| flag is set to true.
+  void OnTimer();
+
+  // Reference to the monitor
+  base::WeakPtr<HostStatusMonitor> monitor_;
+
+  // Called when a restart is scheduled.
+  base::Closure restart_action_;
+
+  // The runner that runs everything other than the file watcher.
+  scoped_refptr<base::SingleThreadTaskRunner> caller_task_runner_;
+
+  // The runner that runs the file watcher.
+  scoped_refptr<base::SingleThreadTaskRunner> io_task_runner_;
+
+  bool inhibit_mode_ = false;
+
+  bool restart_pending_ = false;
+
+  // Path of the certificate files/directories.
+  base::FilePath cert_watch_path_;
+
+  // The file watcher to watch changes inside the certificate folder.
+  scoped_ptr<base::FilePathWatcher> file_watcher_;
+
+  // The time to wait to restart when it is scheduled.
+  base::TimeDelta delay_;
+
+  // Timer to delay the restart action.
+  scoped_ptr<base::DelayTimer> restart_timer_;
+
+  base::WeakPtrFactory<CertificateWatcher> weak_factory_;
+
+  DISALLOW_COPY_AND_ASSIGN(CertificateWatcher);
+};
+
+}  // namespace remoting
+
+#endif  // REMOTING_HOST_LINUX_CERTIFICATE_WATCHER_H_

diff --git a/remoting/host/linux/certificate_watcher_unittest.cc b/remoting/host/linux/certificate_watcher_unittest.cc
new file mode 100644
index 0000000..bf08c3db
--- /dev/null
+++ b/remoting/host/linux/certificate_watcher_unittest.cc

@@ -0,0 +1,146 @@
+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "remoting/host/linux/certificate_watcher.h"
+
+#include <cstdlib>
+#include <string>
+
+#include "base/bind.h"
+#include "base/files/file_util.h"
+#include "base/files/scoped_temp_dir.h"
+#include "base/run_loop.h"
+#include "testing/gtest/include/gtest/gtest.h"
+
+namespace remoting {
+
+const char kWatchFileName[] = "testfile.txt";
+
+const int kMessageLoopWaitMsecs = 150;
+
+class CertificateWatcherTest : public testing::Test {
+ public:
+  CertificateWatcherTest()
+      : task_runner_(message_loop_.task_runner()),
+        watch_path_(CreateAndGetUniqueTempDir().AppendASCII(kWatchFileName)) {
+    watcher_.reset(new CertificateWatcher(
+        base::Bind(&CertificateWatcherTest::OnRestart,
+        base::Unretained(this)),
+        task_runner_));
+    watcher_->SetDelayForTests(base::TimeDelta::FromSeconds(0));
+    watcher_->SetWatchPathForTests(watch_path_);
+  }
+
+  ~CertificateWatcherTest() override {
+    watcher_.reset();
+    base::RunLoop().RunUntilIdle();
+  }
+
+ protected:
+  // Call this if you expect a restart after the loop runs.
+  // The thread will hang if OnRestart is never called.
+  void RunLoop() {
+    base::RunLoop loop;
+    quit_loop_closure_ = loop.QuitClosure();
+    loop.Run();
+  }
+
+  // Call this if you expect no restart after the loop runs.
+  // Will quit the loop after kMessageLoopWaitMsecs.
+  void RunAndWait() {
+    base::RunLoop loop;
+    task_runner_->PostDelayedTask(FROM_HERE,loop.QuitClosure(),
+                                  loop_wait_);
+    loop.Run();
+  }
+
+  void Start() {
+    watcher_->Start();
+  }
+
+  void Connect() {
+    task_runner_->PostTask(
+        FROM_HERE,
+        base::Bind(&CertificateWatcher::OnClientConnected,
+                   base::Unretained(watcher_.get()), ""));
+  }
+
+  void Disconnect() {
+    task_runner_->PostTask(
+        FROM_HERE,
+        base::Bind(&CertificateWatcher::OnClientDisconnected,
+                   base::Unretained(watcher_.get()), ""));
+  }
+
+  void TouchFile() {
+    task_runner_->PostTask(
+              FROM_HERE, base::Bind(&CertificateWatcherTest::TouchFileTask,
+                                    base::Unretained(this)));
+  }
+
+  void TouchFileTask() {
+    std::string testWriteString = std::to_string(rand());
+
+    base::WriteFile(watch_path_, testWriteString.c_str(),
+                    testWriteString.length());
+  }
+
+  base::MessageLoopForIO message_loop_;
+  scoped_refptr<base::SingleThreadTaskRunner> task_runner_;
+  base::ScopedTempDir temp_dir_;
+  base::FilePath watch_path_;
+  scoped_ptr<CertificateWatcher> watcher_;
+  int restart_count_ = 0;
+  base::TimeDelta loop_wait_ =
+      base::TimeDelta::FromMilliseconds(kMessageLoopWaitMsecs);
+  base::Closure quit_loop_closure_;
+
+ private:
+  const base::FilePath& CreateAndGetUniqueTempDir() {
+    EXPECT_TRUE(temp_dir_.CreateUniqueTempDir());
+    return temp_dir_.path();
+  }
+
+  void OnRestart() {
+    restart_count_++;
+    quit_loop_closure_.Run();
+  }
+};
+
+TEST_F(CertificateWatcherTest, OneTouch) {
+  EXPECT_EQ(0, restart_count_);
+  Start();
+  EXPECT_EQ(0, restart_count_);
+  TouchFile();
+  RunLoop();
+  EXPECT_EQ(1, restart_count_);
+}
+
+TEST_F(CertificateWatcherTest, InhibitDeferRestart) {
+  Start();
+  EXPECT_EQ(0, restart_count_);
+  Connect();
+  EXPECT_EQ(0, restart_count_);
+  TouchFile();
+  RunAndWait();
+  EXPECT_EQ(0, restart_count_);
+  Disconnect();
+  RunLoop();
+  EXPECT_EQ(1, restart_count_);
+}
+
+TEST_F(CertificateWatcherTest, UninhibitAndRestart) {
+  Start();
+  EXPECT_EQ(0, restart_count_);
+  Connect();
+  EXPECT_EQ(0, restart_count_);
+  Disconnect();
+  RunAndWait();
+  EXPECT_EQ(0, restart_count_);
+  TouchFile();
+  RunLoop();
+  EXPECT_EQ(1, restart_count_);
+}
+
+} // namespace remoting

diff --git a/remoting/host/remoting_me2me_host.cc b/remoting/host/remoting_me2me_host.cc
index 9e9393e0..d0a50969 100644
--- a/remoting/host/remoting_me2me_host.cc
+++ b/remoting/host/remoting_me2me_host.cc

@@ -115,6 +115,7 @@
 #undef Status  // Xlib.h #defines this, which breaks protobuf headers.
 #include <base/linux_util.h>
 #include "remoting/host/audio_capturer_linux.h"
+#include "remoting/host/linux/certificate_watcher.h"
 #endif  // defined(OS_LINUX)
 
 #if defined(OS_WIN)
@@ -384,6 +385,11 @@
 
   std::unique_ptr<ChromotingHostContext> context_;
 
+#if defined(OS_LINUX)
+  // Watch for certificate changes and kill the host when changes occur
+  scoped_ptr<CertificateWatcher> cert_watcher_;
+#endif
+
   // XMPP server/remoting bot configuration (initialized from the command line).
   XmppSignalStrategy::XmppServerConfig xmpp_server_config_;
   std::string directory_bot_jid_;
@@ -786,6 +792,16 @@
     DCHECK(third_party_auth_config_.token_url.is_valid());
     DCHECK(third_party_auth_config_.token_validation_url.is_valid());
 
+#if defined(OS_LINUX)
+    if (!cert_watcher_) {
+      cert_watcher_.reset(new CertificateWatcher(
+          base::Bind(&HostProcess::ShutdownHost, this, kSuccessExitCode),
+          context_->file_task_runner()));
+      cert_watcher_->Start();
+    }
+    cert_watcher_->SetMonitor(host_->AsWeakPtr());
+#endif
+
     scoped_refptr<protocol::TokenValidatorFactory> token_validator_factory =
         new TokenValidatorFactoryImpl(third_party_auth_config_, key_pair_,
                                       context_->url_request_context_getter());

diff --git a/remoting/remoting_host_srcs.gypi b/remoting/remoting_host_srcs.gypi
index 4654ec08..dce1d05 100644
--- a/remoting/remoting_host_srcs.gypi
+++ b/remoting/remoting_host_srcs.gypi

@@ -154,6 +154,8 @@
       'host/it2me_desktop_environment.h',
       'host/linux/audio_pipe_reader.cc',
       'host/linux/audio_pipe_reader.h',
+      'host/linux/certificate_watcher.cc',
+      'host/linux/certificate_watcher.h',
       'host/linux/unicode_to_keysym.cc',
       'host/linux/unicode_to_keysym.h',
       'host/linux/x11_util.cc',

diff --git a/remoting/remoting_test.gypi b/remoting/remoting_test.gypi
index be6d023c..0d8bc0e 100644
--- a/remoting/remoting_test.gypi
+++ b/remoting/remoting_test.gypi

@@ -283,6 +283,7 @@
         'host/it2me/it2me_confirmation_dialog_proxy_unittest.cc',
         'host/it2me/it2me_native_messaging_host_unittest.cc',
         'host/linux/audio_pipe_reader_unittest.cc',
+        'host/linux/certificate_watcher_unittest.cc',
         'host/linux/unicode_to_keysym_unittest.cc',
         'host/linux/x_server_clipboard_unittest.cc',
         'host/local_input_monitor_unittest.cc',

diff --git a/third_party/WebKit/LayoutTests/TestExpectations b/third_party/WebKit/LayoutTests/TestExpectations
index c585913..4fc0589e 100644
--- a/third_party/WebKit/LayoutTests/TestExpectations
+++ b/third_party/WebKit/LayoutTests/TestExpectations

@@ -108,20 +108,20 @@
 crbug.com/538697 [ Win7 Debug ] virtual/threaded/printing/webgl-oversized-printing.html [ Crash ]
 crbug.com/538697 [ Win7 Debug ] printing/webgl-oversized-printing.html [ Crash ]
 
-crbug.com/303728 [ Win10 ] printing/fixed-positioned-headers-and-footers-absolute-covering-some-pages.html [ Failure ]
-crbug.com/303728 [ Win10 ] virtual/threaded/printing/fixed-positioned-headers-and-footers-absolute-covering-some-pages.html [ Failure ]
-crbug.com/303728 [ Win10 ] printing/absolute-position-headers-and-footers.html [ Failure ]
-crbug.com/303728 [ Win10 ] printing/fixed-positioned-but-static-headers-and-footers.html [ Failure ]
-crbug.com/303728 [ Win10 ] printing/fixed-positioned-headers-and-footers-clipped.html [ Failure ]
-crbug.com/303728 [ Win10 ] printing/fixed-positioned-headers-and-footers-inside-transform.html [ Failure ]
-crbug.com/303728 [ Win10 ] printing/fixed-positioned-headers-and-footers-larger-than-page.html [ Failure ]
-crbug.com/303728 [ Win10 ] printing/fixed-positioned-headers-and-footers.html [ Failure ]
-crbug.com/303728 [ Win10 ] virtual/threaded/printing/absolute-position-headers-and-footers.html [ Failure ]
-crbug.com/303728 [ Win10 ] virtual/threaded/printing/fixed-positioned-but-static-headers-and-footers.html [ Failure ]
-crbug.com/303728 [ Win10 ] virtual/threaded/printing/fixed-positioned-headers-and-footers-clipped.html [ Failure ]
-crbug.com/303728 [ Win10 ] virtual/threaded/printing/fixed-positioned-headers-and-footers-inside-transform.html [ Failure ]
-crbug.com/303728 [ Win10 ] virtual/threaded/printing/fixed-positioned-headers-and-footers-larger-than-page.html [ Failure ]
-crbug.com/303728 [ Win10 ] virtual/threaded/printing/fixed-positioned-headers-and-footers.html [ Failure ]
+crbug.com/303728 [ Win10 ] printing/fixed-positioned-headers-and-footers-absolute-covering-some-pages.html [ Missing ]
+crbug.com/303728 [ Win10 ] virtual/threaded/printing/fixed-positioned-headers-and-footers-absolute-covering-some-pages.html [ Missing ]
+crbug.com/303728 [ Win10 ] printing/absolute-position-headers-and-footers.html [ Missing ]
+crbug.com/303728 [ Win10 ] printing/fixed-positioned-but-static-headers-and-footers.html [ Missing ]
+crbug.com/303728 [ Win10 ] printing/fixed-positioned-headers-and-footers-clipped.html [ Missing ]
+crbug.com/303728 [ Win10 ] printing/fixed-positioned-headers-and-footers-inside-transform.html [ Missing ]
+crbug.com/303728 [ Win10 ] printing/fixed-positioned-headers-and-footers-larger-than-page.html [ Missing ]
+crbug.com/303728 [ Win10 ] printing/fixed-positioned-headers-and-footers.html [ Missing ]
+crbug.com/303728 [ Win10 ] virtual/threaded/printing/absolute-position-headers-and-footers.html [ Missing ]
+crbug.com/303728 [ Win10 ] virtual/threaded/printing/fixed-positioned-but-static-headers-and-footers.html [ Missing ]
+crbug.com/303728 [ Win10 ] virtual/threaded/printing/fixed-positioned-headers-and-footers-clipped.html [ Missing ]
+crbug.com/303728 [ Win10 ] virtual/threaded/printing/fixed-positioned-headers-and-footers-inside-transform.html [ Missing ]
+crbug.com/303728 [ Win10 ] virtual/threaded/printing/fixed-positioned-headers-and-footers-larger-than-page.html [ Missing ]
+crbug.com/303728 [ Win10 ] virtual/threaded/printing/fixed-positioned-headers-and-footers.html [ Missing ]
 
 # Expected to fail until OffscreenCanvas can render on the gpu
 crbug.com/593514 virtual/gpu/fast/canvas/OffscreenCanvas-strokeRect-in-worker.html [ Failure ]
@@ -395,11 +395,6 @@
 
 crbug.com/475984 [ Mac Debug ] css2.1/t100801-c544-valgn-03-d-agi.html [ Failure ]
 
-crbug.com/591793 [ Mac ] fast/forms/textarea/basic-textareas-quirks.html [ NeedsRebaseline ]
-crbug.com/591793 [ Mac ] fast/forms/textarea/basic-textareas.html [ NeedsRebaseline ]
-crbug.com/591793 [ Mac ] fast/loader/text-document-wrapping.html [ NeedsRebaseline ]
-crbug.com/591793 [ Mac10.10 Mac10.11 Retina Win ] fast/text/midword-break-after-breakable-char.html [ NeedsRebaseline ]
-
 # Rebaseline didn't fix this. It's flaking between two different failures due to rounding error.
 # It consistently fails on debug builds and sometiems on release+asserts builds.
 # But consistently passes on release builds.

diff --git a/third_party/WebKit/LayoutTests/fast/css/counters/counter-reparent-table-children-crash.html b/third_party/WebKit/LayoutTests/fast/css/counters/counter-reparent-table-children-crash.html
index c73306a..f6b87aa 100644
--- a/third_party/WebKit/LayoutTests/fast/css/counters/counter-reparent-table-children-crash.html
+++ b/third_party/WebKit/LayoutTests/fast/css/counters/counter-reparent-table-children-crash.html

@@ -12,8 +12,8 @@
 function crash() {
     document.body.innerHTML = "PASS: Malformed table counters do not cause crash";
     if (window.testRunner) {
-        testRunner.notifyDone();
         testRunner.dumpAsText();
+        testRunner.notifyDone();
     }
 }
 </script>

diff --git a/third_party/WebKit/LayoutTests/http/tests/credentialmanager/passwordcredential-fetch.html b/third_party/WebKit/LayoutTests/http/tests/credentialmanager/passwordcredential-fetch.html
index 7622777..5fe86f9 100644
--- a/third_party/WebKit/LayoutTests/http/tests/credentialmanager/passwordcredential-fetch.html
+++ b/third_party/WebKit/LayoutTests/http/tests/credentialmanager/passwordcredential-fetch.html

@@ -12,6 +12,16 @@
 });
 
 promise_test(_ => {
+    var r = new Request('/', { credentials: c, body: 'this is a body', method: 'POST' });
+    return r.text().then(t => assert_equals(t, ""));
+}, "Body ignored in presence of a PasswordCredential");
+
+promise_test(_ => {
+    var r = new Request('/', { credentials: 'include', body: 'this is a body', method: 'POST' });
+    return r.text().then(t => assert_equals(t, "this is a body"));
+}, "Body present if 'credentials' is not a PasswordCredential");
+
+promise_test(_ => {
     var r = new Request('/', { credentials: c, method: 'POST' });
     var clone = r.clone();
     assert_equals(r.credentials, "password");

diff --git a/third_party/WebKit/LayoutTests/http/tests/fetch/script-tests/request.js b/third_party/WebKit/LayoutTests/http/tests/fetch/script-tests/request.js
index af33bce..2295db0 100644
--- a/third_party/WebKit/LayoutTests/http/tests/fetch/script-tests/request.js
+++ b/third_party/WebKit/LayoutTests/http/tests/fetch/script-tests/request.js

@@ -748,4 +748,16 @@
         });
   }, 'Extract a MIME type (1)');
 
+promise_test(function(t) {
+    var req = new Request('http://localhost/',
+                          {method: 'POST',
+                           credentials: 'include',
+                           body: 'this is a body'});
+
+    return req.text()
+        .then(t => {
+           assert_equals(t, 'this is a body');
+        });
+  }, 'Credentials and body can both be set.');
+
 done();

diff --git a/third_party/WebKit/LayoutTests/http/tests/notifications/notification-properties.html b/third_party/WebKit/LayoutTests/http/tests/notifications/notification-properties.html
index 2318ef1..2550ab27 100644
--- a/third_party/WebKit/LayoutTests/http/tests/notifications/notification-properties.html
+++ b/third_party/WebKit/LayoutTests/http/tests/notifications/notification-properties.html

@@ -116,6 +116,20 @@
                 });
             }, 'Providing non-empty `actions` for a non-persistent notification should throw a TypeError.');
 
+            // Notification actions should only support the placeholder attribute if they are type text.
+            assert_throws(new TypeError(), function() {
+                new Notification("My Notification", {
+                    actions: [{ action: "foo", title: "Foo", placeholder: "I'm sorry, Dave." }]
+                });
+            }, 'Providing a placeholder for an action that is not type text should throw a TypeError.');
+
+            // Notification actions should not accept invalid types.
+            assert_throws(new TypeError(), function() {
+                new Notification("My Notification", {
+                    actions: [{ type: "blah", action: "foo", title: "Foo" }]
+                });
+            }, 'Providing an invalid type for an action should throw a TypeError.');
+
       }, 'Checks the properties exposed on the Notification object.');
     </script>
   </body>

diff --git a/third_party/WebKit/LayoutTests/http/tests/notifications/serviceworker-notification-properties.html b/third_party/WebKit/LayoutTests/http/tests/notifications/serviceworker-notification-properties.html
index 2755ea6..2dc12e93 100644
--- a/third_party/WebKit/LayoutTests/http/tests/notifications/serviceworker-notification-properties.html
+++ b/third_party/WebKit/LayoutTests/http/tests/notifications/serviceworker-notification-properties.html

@@ -54,9 +54,11 @@
           // Deliberately add more actions than are supported.
           for (var i = 0; i < 2 * Notification.maxActions; i++) {
               options.actions.push({
+                  type: i % 2 == 0 ? 'button' : 'text',
                   action: 'a' + i,
                   title: 'Action ' + i,
-                  icon: 'https://example/action_icon_' + i + '.png'
+                  icon: 'https://example/action_icon_' + i + '.png',
+                  placeholder: i % 2 == 0 ? null : 'Type a reply...'
               });
           }
 

diff --git a/third_party/WebKit/LayoutTests/http/tests/security/contentSecurityPolicy/resources/service-worker.js b/third_party/WebKit/LayoutTests/http/tests/security/contentSecurityPolicy/resources/service-worker.js
new file mode 100644
index 0000000..8b1a393
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/http/tests/security/contentSecurityPolicy/resources/service-worker.js

@@ -0,0 +1 @@
+// empty

diff --git a/third_party/WebKit/LayoutTests/http/tests/security/contentSecurityPolicy/service-worker-allowed.html b/third_party/WebKit/LayoutTests/http/tests/security/contentSecurityPolicy/service-worker-allowed.html
new file mode 100644
index 0000000..3e8d5cd
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/http/tests/security/contentSecurityPolicy/service-worker-allowed.html

@@ -0,0 +1,14 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta http-equiv="Content-Security-Policy" content="child-src 'self';">
+<script src="../../resources/testharness.js"></script>
+<script src="../../resources/testharnessreport.js"></script>
+<script>
+    var t = async_test('Test that a service worker can be registered');
+    navigator.serviceWorker.register("resources/service-worker.js").then(function (registration) {
+        t.done();
+    });
+</script>
+</head>
+<body>

diff --git a/third_party/WebKit/LayoutTests/http/tests/security/contentSecurityPolicy/service-worker-blocked-expected.txt b/third_party/WebKit/LayoutTests/http/tests/security/contentSecurityPolicy/service-worker-blocked-expected.txt
new file mode 100644
index 0000000..c13ecd8
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/http/tests/security/contentSecurityPolicy/service-worker-blocked-expected.txt

@@ -0,0 +1,6 @@
+CONSOLE ERROR: Refused to create a child context containing 'http://127.0.0.1:8000/security/contentSecurityPolicy/resources/service-worker.js' because it violates the following Content Security Policy directive: "child-src 'none'".
+
+This is a testharness.js-based test.
+PASS Test that a service worker cannot be registered if the CSP does not allow it 
+Harness: the test ran to completion.
+

diff --git a/third_party/WebKit/LayoutTests/http/tests/security/contentSecurityPolicy/service-worker-blocked.html b/third_party/WebKit/LayoutTests/http/tests/security/contentSecurityPolicy/service-worker-blocked.html
new file mode 100644
index 0000000..ba63037
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/http/tests/security/contentSecurityPolicy/service-worker-blocked.html

@@ -0,0 +1,15 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta http-equiv="Content-Security-Policy" content="child-src 'none';">
+<script src="../../resources/testharness.js"></script>
+<script src="../../resources/testharnessreport.js"></script>
+<script>
+    var t = async_test('Test that a service worker cannot be registered if the CSP does not allow it');
+    navigator.serviceWorker.register("resources/service-worker.js").then(function (registration) {
+    }).catch(function (error) {
+        t.done();
+    });
+</script>
+</head>
+<body>

diff --git a/third_party/WebKit/LayoutTests/media/track/css-cue-for-video-in-shadow-2-expected.txt b/third_party/WebKit/LayoutTests/media/track/css-cue-for-video-in-shadow-2-expected.txt
deleted file mode 100644
index b0b0f9c1..0000000
--- a/third_party/WebKit/LayoutTests/media/track/css-cue-for-video-in-shadow-2-expected.txt
+++ /dev/null

@@ -1,8 +0,0 @@
-Test that the cue is styled when video and style is in the same shadow tree.
-EVENT(canplaythrough)
-EVENT(seeked)
-EXPECTED (getComputedStyle(cueNode).color == 'rgb(255, 0, 0)') OK
-EXPECTED (getComputedStyle(cueNode).color == 'rgb(0, 128, 0)') OK
-EXPECTED (getComputedStyle(cueNode).color == 'rgb(255, 0, 0)') OK
-END OF TEST
-

diff --git a/third_party/WebKit/LayoutTests/media/track/css-cue-for-video-in-shadow-2.html b/third_party/WebKit/LayoutTests/media/track/css-cue-for-video-in-shadow-2.html
index 8f96ac1..e6a0f75 100644
--- a/third_party/WebKit/LayoutTests/media/track/css-cue-for-video-in-shadow-2.html
+++ b/third_party/WebKit/LayoutTests/media/track/css-cue-for-video-in-shadow-2.html

@@ -1,50 +1,28 @@
 <!DOCTYPE html>
-<html>
-<head>
-<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
+<title>Test that the cue is styled when video and style is in the same shadow tree.</title>
 <script src="../media-file.js"></script>
-<!-- TODO(philipj): Convert test to testharness.js. crbug.com/588956
-     (Please avoid writing new tests using video-test.js) -->
-<script src="../video-test.js"></script>
 <script src="../media-controls.js"></script>
+<script src="../../resources/testharness.js"></script>
+<script src="../../resources/testharnessreport.js"></script>
+<div id='host'>
+</div>
 <script>
-var cueNode;
-var seekedCount = 0;
-var step = 0.4;
-var initialTime = 0.6;
-var endTime = 3.0
-
-function seeked()
-{
-    if (testEnded)
-        return;
-
-    cueNode = textTrackDisplayElement(video, 'cue').firstElementChild;
-    testExpected("getComputedStyle(cueNode).color", "rgb(255, 0, 0)");
-    cueNode = cueNode.nextElementSibling;
-    testExpected("getComputedStyle(cueNode).color", "rgb(0, 128, 0)");
-    cueNode = cueNode.nextElementSibling;
-    testExpected("getComputedStyle(cueNode).color", "rgb(255, 0, 0)");
-    endTest();
-}
-
-function loaded()
-{
-    consoleWrite("Test that the cue is styled when video and style is in the same shadow tree.");
+async_test(function(t) {
     var host = document.getElementById('host');
     var shadowRoot = host.createShadowRoot();
     shadowRoot.innerHTML = '<style>video::cue(.red, .red2) { color:red } video::cue(.green) { color:green }</style>'
         + '<video controls ><track src="captions-webvtt/styling-lifetime.vtt" kind="captions" default></video>';
-    video = shadowRoot.querySelector('video');
+    var video = shadowRoot.querySelector('video');
     video.src = findMediaFile('video', '../content/test');
     video.id = "testvideo";
-    waitForEvent('seeked', seeked);
-    waitForEventOnce('canplaythrough', function() { video.currentTime = initialTime; });
-}
+    video.onseeked = t.step_func_done(function() {
+        var cueNode = textTrackDisplayElement(video, 'cue').firstElementChild;
+        assert_equals(getComputedStyle(cueNode).color, "rgb(255, 0, 0)");
+        cueNode = cueNode.nextElementSibling;
+        assert_equals(getComputedStyle(cueNode).color, "rgb(0, 128, 0)");
+        cueNode = cueNode.nextElementSibling;
+        assert_equals(getComputedStyle(cueNode).color, "rgb(255, 0, 0)");
+    });
+    video.currentTime = 0.6;
+});
 </script>
-</head>
-<body onload="loaded()">
-<div id='host'>
-</div>
-</body>
-</html>

diff --git a/third_party/WebKit/LayoutTests/media/track/css-cue-for-video-in-shadow-expected.txt b/third_party/WebKit/LayoutTests/media/track/css-cue-for-video-in-shadow-expected.txt
deleted file mode 100644
index 1c5aedf..0000000
--- a/third_party/WebKit/LayoutTests/media/track/css-cue-for-video-in-shadow-expected.txt
+++ /dev/null

@@ -1,8 +0,0 @@
-Test that the cue is not styled when video is in a shadow tree and style is in a document.
-EVENT(canplaythrough)
-EVENT(seeked)
-EXPECTED (getComputedStyle(cueNode).color != 'rgb(255, 0, 0)') OK
-EXPECTED (getComputedStyle(cueNode).color != 'rgb(0, 128, 0)') OK
-EXPECTED (getComputedStyle(cueNode).color != 'rgb(255, 0, 0)') OK
-END OF TEST
-

diff --git a/third_party/WebKit/LayoutTests/media/track/css-cue-for-video-in-shadow.html b/third_party/WebKit/LayoutTests/media/track/css-cue-for-video-in-shadow.html
index 5d82bd5..18267531 100644
--- a/third_party/WebKit/LayoutTests/media/track/css-cue-for-video-in-shadow.html
+++ b/third_party/WebKit/LayoutTests/media/track/css-cue-for-video-in-shadow.html

@@ -1,53 +1,31 @@
 <!DOCTYPE html>
-<html>
-<head>
-<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
+<title>Test that the cue is not styled when video is in a shadow tree and style is in a document.</title>
 <script src="../media-file.js"></script>
-<!-- TODO(philipj): Convert test to testharness.js. crbug.com/588956
-     (Please avoid writing new tests using video-test.js) -->
-<script src="../video-test.js"></script>
 <script src="../media-controls.js"></script>
+<script src="../../resources/testharness.js"></script>
+<script src="../../resources/testharnessreport.js"></script>
 <style>
 video::cue(.red, .red2) { color:red }
 video::cue(.green) { color:green }
 </style>
+<div id='host'>
+</div>
 <script>
-var cueNode;
-var seekedCount = 0;
-var step = 0.4;
-var initialTime = 0.6;
-var endTime = 3.0
-
-function seeked()
-{
-    if (testEnded)
-        return;
-
-    cueNode = textTrackDisplayElement(video, 'cue').firstElementChild;
-    testExpected("getComputedStyle(cueNode).color", "rgb(255, 0, 0)", "!=");
-    cueNode = cueNode.nextElementSibling;
-    testExpected("getComputedStyle(cueNode).color", "rgb(0, 128, 0)", "!=");
-    cueNode = cueNode.nextElementSibling;
-    testExpected("getComputedStyle(cueNode).color", "rgb(255, 0, 0)", "!=");
-    endTest();
-}
-
-function loaded()
-{
-    consoleWrite("Test that the cue is not styled when video is in a shadow tree and style is in a document.");
+async_test(function(t) {
     var host = document.getElementById('host');
     var shadowRoot = host.createShadowRoot();
     shadowRoot.innerHTML = '<video controls ><track src="captions-webvtt/styling-lifetime.vtt" kind="captions" default></video>';
-    video = shadowRoot.querySelector('video');
+    var video = shadowRoot.querySelector('video');
     video.src = findMediaFile('video', '../content/test');
     video.id = "testvideo";
-    waitForEvent('seeked', seeked);
-    waitForEventOnce('canplaythrough', function() { video.currentTime = initialTime; });
-}
+    video.onseeked = t.step_func_done(function() {
+        var cueNode = textTrackDisplayElement(video, 'cue').firstElementChild;
+        assert_equals(getComputedStyle(cueNode).color, "rgb(255, 255, 255)");
+        cueNode = cueNode.nextElementSibling;
+        assert_equals(getComputedStyle(cueNode).color, "rgb(255, 255, 255)");
+        cueNode = cueNode.nextElementSibling;
+        assert_equals(getComputedStyle(cueNode).color, "rgb(255, 255, 255)");
+    });
+    video.currentTime = 0.6;
+});
 </script>
-</head>
-<body onload="loaded()">
-<div id='host'>
-</div>
-</body>
-</html>

diff --git a/third_party/WebKit/LayoutTests/media/track/cue-style-invalidation-expected.txt b/third_party/WebKit/LayoutTests/media/track/cue-style-invalidation-expected.txt
deleted file mode 100644
index a7bd1afb..0000000
--- a/third_party/WebKit/LayoutTests/media/track/cue-style-invalidation-expected.txt
+++ /dev/null

@@ -1,17 +0,0 @@
-Check that descendant style invalidation works with ::cue selectors.
-EVENT(canplaythrough)
-EVENT(seeked)
-EXPECTED (getComputedStyle(cueNode).backgroundColor == 'rgb(255, 0, 0)') OK
-EXPECTED (internals.updateStyleAndReturnAffectedElementCount() == '8') OK
-EXPECTED (getComputedStyle(cueNode).backgroundColor == 'rgb(0, 128, 0)') OK
-EXPECTED (getComputedStyle(cNode).backgroundColor == 'rgb(255, 0, 0)') OK
-EXPECTED (internals.updateStyleAndReturnAffectedElementCount() == '1') OK
-EXPECTED (getComputedStyle(cNode).backgroundColor == 'rgb(0, 128, 0)') OK
-EXPECTED (getComputedStyle(iNode).backgroundColor == 'rgb(255, 0, 0)') OK
-EXPECTED (internals.updateStyleAndReturnAffectedElementCount() == '1') OK
-EXPECTED (getComputedStyle(iNode).backgroundColor == 'rgb(0, 128, 0)') OK
-EXPECTED (getComputedStyle(bNode).backgroundColor == 'rgb(255, 0, 0)') OK
-EXPECTED (internals.updateStyleAndReturnAffectedElementCount() == '1') OK
-EXPECTED (getComputedStyle(bNode).backgroundColor == 'rgb(0, 128, 0)') OK
-END OF TEST
-

diff --git a/third_party/WebKit/LayoutTests/media/track/cue-style-invalidation.html b/third_party/WebKit/LayoutTests/media/track/cue-style-invalidation.html
index 222b9ac..66c5ca8 100644
--- a/third_party/WebKit/LayoutTests/media/track/cue-style-invalidation.html
+++ b/third_party/WebKit/LayoutTests/media/track/cue-style-invalidation.html

@@ -1,9 +1,9 @@
 <!DOCTYPE html>
+<title>Check that descendant style invalidation works with ::cue selectors.</title>
 <script src="../media-file.js"></script>
-<!-- TODO(philipj): Convert test to testharness.js. crbug.com/588956
-     (Please avoid writing new tests using video-test.js) -->
-<script src="../video-test.js"></script>
 <script src="../media-controls.js"></script>
+<script src="../../resources/testharness.js"></script>
+<script src="../../resources/testharnessreport.js"></script>
 <style>
 video::cue,
 video::cue(c),
@@ -14,67 +14,53 @@
 .cuefunc video::cue(c),
 .past video::cue(i:past),
 .future video::cue(.b:future) { background-color: green }
-
-// This selector would have triggered sibling subtree recalc if we didn't
-// support descendant invalidation for ::cue/::cue().
-#ascendant + div { color: pink }
 </style>
-<script>
-function seeked() {
-    var red = "rgb(255, 0, 0)";
-    var green = "rgb(0, 128, 0)";
-
-    cueNode = textTrackDisplayElement(video, "cue");
-    iNode = cueNode.firstElementChild;
-    cNode = iNode.nextSibling.nextSibling;
-    bNode = cNode.nextSibling.nextSibling;
-
-    testExpected("getComputedStyle(cueNode).backgroundColor", red);
-    ascendant.offsetTop;
-    ascendant.classList.add("cue");
-    if (window.internals)
-        testExpected("internals.updateStyleAndReturnAffectedElementCount()", 8);
-    testExpected("getComputedStyle(cueNode).backgroundColor", green);
-
-    testExpected("getComputedStyle(cNode).backgroundColor", red);
-    ascendant.offsetTop;
-    ascendant.classList.add("cuefunc");
-    if (window.internals)
-        testExpected("internals.updateStyleAndReturnAffectedElementCount()", 1);
-    testExpected("getComputedStyle(cNode).backgroundColor", green);
-
-    testExpected("getComputedStyle(iNode).backgroundColor", red);
-    ascendant.offsetTop;
-    ascendant.classList.add("past");
-    if (window.internals)
-        testExpected("internals.updateStyleAndReturnAffectedElementCount()", 1);
-    testExpected("getComputedStyle(iNode).backgroundColor", green);
-
-    testExpected("getComputedStyle(bNode).backgroundColor", red);
-    ascendant.offsetTop;
-    ascendant.classList.add("future");
-    if (window.internals)
-        testExpected("internals.updateStyleAndReturnAffectedElementCount()", 1);
-    testExpected("getComputedStyle(bNode).backgroundColor", green);
-
-    endTest();
-}
-
-window.onload = function() {
-    consoleWrite("Check that descendant style invalidation works with ::cue selectors.");
-    findMediaElement();
-    video.src = findMediaFile("video", "../content/test");
-    waitForEvent("seeked", seeked);
-    waitForEvent("canplaythrough", function() { video.currentTime = 0.1; });
-};
-</script>
 <div id="ascendant">
     <video>
         <track src="captions-webvtt/invalidation.vtt" kind="captions" default>
     </video>
-    <div></div>
-    <div></div>
 </div>
-<div>
-    <div></div>
-</div>
+<script>
+async_test(function(t) {
+    var video = document.querySelector('video');
+    video.src = findMediaFile("video", "../content/test");
+    video.onseeked = t.step_func_done(function() {
+        var red = "rgb(255, 0, 0)";
+        var green = "rgb(0, 128, 0)";
+
+        var cueNode = textTrackDisplayElement(video, "cue");
+        var iNode = cueNode.firstElementChild;
+        var cNode = iNode.nextSibling.nextSibling;
+        var bNode = cNode.nextSibling.nextSibling;
+
+        assert_equals(getComputedStyle(cueNode).backgroundColor, red);
+        ascendant.offsetTop;
+        ascendant.classList.add("cue");
+        if (window.internals)
+            assert_equals(internals.updateStyleAndReturnAffectedElementCount(), 8);
+        assert_equals(getComputedStyle(cueNode).backgroundColor, green);
+
+        assert_equals(getComputedStyle(cNode).backgroundColor, red);
+        ascendant.offsetTop;
+        ascendant.classList.add("cuefunc");
+        if (window.internals)
+            assert_equals(internals.updateStyleAndReturnAffectedElementCount(), 1);
+        assert_equals(getComputedStyle(cNode).backgroundColor, green);
+
+        assert_equals(getComputedStyle(iNode).backgroundColor, red);
+        ascendant.offsetTop;
+        ascendant.classList.add("past");
+        if (window.internals)
+            assert_equals(internals.updateStyleAndReturnAffectedElementCount(), 1);
+        assert_equals(getComputedStyle(iNode).backgroundColor, green);
+
+        assert_equals(getComputedStyle(bNode).backgroundColor, red);
+        ascendant.offsetTop;
+        ascendant.classList.add("future");
+        if (window.internals)
+            assert_equals(internals.updateStyleAndReturnAffectedElementCount(), 1);
+        assert_equals(getComputedStyle(bNode).backgroundColor, green);
+    });
+    video.currentTime = 0.1;
+});
+</script>

diff --git a/third_party/WebKit/LayoutTests/media/track/regions-webvtt/text-track-cue-region-attribute-expected.txt b/third_party/WebKit/LayoutTests/media/track/regions-webvtt/text-track-cue-region-attribute-expected.txt
deleted file mode 100644
index 5ce0efe..0000000
--- a/third_party/WebKit/LayoutTests/media/track/regions-webvtt/text-track-cue-region-attribute-expected.txt
+++ /dev/null

@@ -1,17 +0,0 @@
-Tests the regionId attribute of a cue.
-
-
-** Test the setter and getter through the JS API **
-EXPECTED (cue.regionId == '') OK
-EXPECTED (cue.regionId == 'someId') OK
-
-** Test parsing a region attribute of a cue **
-EXPECTED (cue.regionId == 'someregionattributeid') OK
-
-** Test that region attribute is ignored if either line position or cue size are specified or writing direction is not horizontal **
-EXPECTED (cue.regionId == '') OK
-EXPECTED (cue.regionId == '') OK
-EXPECTED (cue.regionId == '') OK
-
-END OF TEST
-

diff --git a/third_party/WebKit/LayoutTests/media/track/regions-webvtt/text-track-cue-region-attribute.html b/third_party/WebKit/LayoutTests/media/track/regions-webvtt/text-track-cue-region-attribute.html
index 9e5edaea..42b9556e 100644
--- a/third_party/WebKit/LayoutTests/media/track/regions-webvtt/text-track-cue-region-attribute.html
+++ b/third_party/WebKit/LayoutTests/media/track/regions-webvtt/text-track-cue-region-attribute.html

@@ -1,50 +1,29 @@
 <!DOCTYPE html>
-<html>
-    <head>
-        <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
+<title>Tests the regionId attribute of a cue.</title>
+<script src="../../../resources/testharness.js"></script>
+<script src="../../../resources/testharnessreport.js"></script>
+<script>
+async_test(function(t) {
+    var cue = new VTTCue(0, 1, 'sample');
 
-        <script src=../../media-file.js></script>
-        <!-- TODO(philipj): Convert test to testharness.js. crbug.com/588956
-             (Please avoid writing new tests using video-test.js) -->
-        <script src=../../video-test.js></script>
-        <script>
-            var cue;
+    assert_equals(cue.regionId, '');
+    cue.regionId = 'someId';
+    assert_equals(cue.regionId, 'someId');
 
-            function startTest()
-            {
-                if (!window.VTTRegion) {
-                    failTest();
-                    return;
-                }
+    var video = document.createElement('video');
+    var track = document.createElement('track');
+    track.onload = t.step_func_done(function() {
+        cue = track.track.cues[0];
+        assert_equals(cue.regionId, 'someregionattributeid');
 
-                consoleWrite("<br>** Test the setter and getter through the JS API **");
-                cue = new VTTCue(0.0, 1.0, "sample");
-
-                testExpected("cue.regionId", "");
-                cue.regionId = "someId";
-                testExpected("cue.regionId", "someId");
-
-                consoleWrite("<br>** Test parsing a region attribute of a cue **");
-                findMediaElement();
-
-                cue = video.textTracks[0].cues[0];
-                testExpected("cue.regionId", "someregionattributeid");
-
-                consoleWrite("<br>** Test that region attribute is ignored if either line position or cue size are specified or writing direction is not horizontal **");
-                for (i = 1; i < 4; ++i) {
-                  cue = video.textTracks[0].cues[i];
-                  testExpected("cue.regionId", "");
-                }
-
-                consoleWrite("");
-                endTest();
-            }
-        </script>
-    </head>
-    <body>
-        <p>Tests the regionId attribute of a cue.</p>
-        <video controls>
-            <track src="../captions-webvtt/header-regions.vtt" kind="captions" default onload="startTest()">
-        </video>
-    </body>
-</html>
+        for (i = 1; i < 4; ++i) {
+          cue = track.track.cues[i];
+          assert_equals(cue.regionId, '');
+        }
+    });
+    track.src = '../captions-webvtt/header-regions.vtt';
+    track.kind = 'captions';
+    track.default = true;
+    video.appendChild(track);
+});
+</script>

diff --git a/third_party/WebKit/LayoutTests/media/track/regions-webvtt/vtt-region-constructor-expected.txt b/third_party/WebKit/LayoutTests/media/track/regions-webvtt/vtt-region-constructor-expected.txt
deleted file mode 100644
index 1823ed9b..0000000
--- a/third_party/WebKit/LayoutTests/media/track/regions-webvtt/vtt-region-constructor-expected.txt
+++ /dev/null

@@ -1,122 +0,0 @@
-Tests the constructor and mutation of VTTRegion.
-
-** Test instanceof VTTRegion. **
-EXPECTED (region instanceof VTTRegion == 'true') OK
-** Test the default indexs of a region. **
-EXPECTED (region.track == 'null') OK
-EXPECTED (region.scroll == '') OK
-EXPECTED (region.viewportAnchorX == '0') OK
-EXPECTED (region.viewportAnchorY == '100') OK
-EXPECTED (region.regionAnchorX == '0') OK
-EXPECTED (region.regionAnchorY == '100') OK
-EXPECTED (region.height == '3') OK
-EXPECTED (region.width == '100') OK
-
-** Test that incorrect mutation keeps previous valid values. **
-RUN(region.scroll = 'invalid-scroll-value')
-SyntaxError: Failed to set the 'scroll' property on 'VTTRegion': The value provided ('invalid-scroll-value') is invalid. The 'scroll' property must be either the empty string, or 'up'.
-EXPECTED (region.scroll == '') OK
-
-Invalid percentage value: -1
-RUN(region.viewportAnchorX = invalidPercentageValues[index])
-IndexSizeError: Failed to set the 'viewportAnchorX' property on 'VTTRegion': The value provided (-1) is outside the range [0, 100].
-EXPECTED (region.viewportAnchorX == '0') OK
-RUN(region.viewportAnchorY = invalidPercentageValues[index])
-IndexSizeError: Failed to set the 'viewportAnchorY' property on 'VTTRegion': The value provided (-1) is outside the range [0, 100].
-EXPECTED (region.viewportAnchorY == '100') OK
-RUN(region.regionAnchorX = invalidPercentageValues[index])
-IndexSizeError: Failed to set the 'regionAnchorX' property on 'VTTRegion': The value provided (-1) is outside the range [0, 100].
-EXPECTED (region.regionAnchorX == '0') OK
-RUN(region.regionAnchorY = invalidPercentageValues[index])
-IndexSizeError: Failed to set the 'regionAnchorY' property on 'VTTRegion': The value provided (-1) is outside the range [0, 100].
-EXPECTED (region.regionAnchorY == '100') OK
-RUN(region.width = invalidPercentageValues[index])
-IndexSizeError: Failed to set the 'width' property on 'VTTRegion': The value provided (-1) is outside the range [0, 100].
-EXPECTED (region.width == '100') OK
-
-Invalid percentage value: 101
-RUN(region.viewportAnchorX = invalidPercentageValues[index])
-IndexSizeError: Failed to set the 'viewportAnchorX' property on 'VTTRegion': The value provided (101) is outside the range [0, 100].
-EXPECTED (region.viewportAnchorX == '0') OK
-RUN(region.viewportAnchorY = invalidPercentageValues[index])
-IndexSizeError: Failed to set the 'viewportAnchorY' property on 'VTTRegion': The value provided (101) is outside the range [0, 100].
-EXPECTED (region.viewportAnchorY == '100') OK
-RUN(region.regionAnchorX = invalidPercentageValues[index])
-IndexSizeError: Failed to set the 'regionAnchorX' property on 'VTTRegion': The value provided (101) is outside the range [0, 100].
-EXPECTED (region.regionAnchorX == '0') OK
-RUN(region.regionAnchorY = invalidPercentageValues[index])
-IndexSizeError: Failed to set the 'regionAnchorY' property on 'VTTRegion': The value provided (101) is outside the range [0, 100].
-EXPECTED (region.regionAnchorY == '100') OK
-RUN(region.width = invalidPercentageValues[index])
-IndexSizeError: Failed to set the 'width' property on 'VTTRegion': The value provided (101) is outside the range [0, 100].
-EXPECTED (region.width == '100') OK
-
-Invalid percentage value: -Infinity
-RUN(region.viewportAnchorX = invalidPercentageValues[index])
-TypeError: Failed to set the 'viewportAnchorX' property on 'VTTRegion': The provided double value is non-finite.
-EXPECTED (region.viewportAnchorX == '0') OK
-RUN(region.viewportAnchorY = invalidPercentageValues[index])
-TypeError: Failed to set the 'viewportAnchorY' property on 'VTTRegion': The provided double value is non-finite.
-EXPECTED (region.viewportAnchorY == '100') OK
-RUN(region.regionAnchorX = invalidPercentageValues[index])
-TypeError: Failed to set the 'regionAnchorX' property on 'VTTRegion': The provided double value is non-finite.
-EXPECTED (region.regionAnchorX == '0') OK
-RUN(region.regionAnchorY = invalidPercentageValues[index])
-TypeError: Failed to set the 'regionAnchorY' property on 'VTTRegion': The provided double value is non-finite.
-EXPECTED (region.regionAnchorY == '100') OK
-RUN(region.width = invalidPercentageValues[index])
-TypeError: Failed to set the 'width' property on 'VTTRegion': The provided double value is non-finite.
-EXPECTED (region.width == '100') OK
-
-Invalid percentage value: Infinity
-RUN(region.viewportAnchorX = invalidPercentageValues[index])
-TypeError: Failed to set the 'viewportAnchorX' property on 'VTTRegion': The provided double value is non-finite.
-EXPECTED (region.viewportAnchorX == '0') OK
-RUN(region.viewportAnchorY = invalidPercentageValues[index])
-TypeError: Failed to set the 'viewportAnchorY' property on 'VTTRegion': The provided double value is non-finite.
-EXPECTED (region.viewportAnchorY == '100') OK
-RUN(region.regionAnchorX = invalidPercentageValues[index])
-TypeError: Failed to set the 'regionAnchorX' property on 'VTTRegion': The provided double value is non-finite.
-EXPECTED (region.regionAnchorX == '0') OK
-RUN(region.regionAnchorY = invalidPercentageValues[index])
-TypeError: Failed to set the 'regionAnchorY' property on 'VTTRegion': The provided double value is non-finite.
-EXPECTED (region.regionAnchorY == '100') OK
-RUN(region.width = invalidPercentageValues[index])
-TypeError: Failed to set the 'width' property on 'VTTRegion': The provided double value is non-finite.
-EXPECTED (region.width == '100') OK
-
-Invalid percentage value: NaN
-RUN(region.viewportAnchorX = invalidPercentageValues[index])
-TypeError: Failed to set the 'viewportAnchorX' property on 'VTTRegion': The provided double value is non-finite.
-EXPECTED (region.viewportAnchorX == '0') OK
-RUN(region.viewportAnchorY = invalidPercentageValues[index])
-TypeError: Failed to set the 'viewportAnchorY' property on 'VTTRegion': The provided double value is non-finite.
-EXPECTED (region.viewportAnchorY == '100') OK
-RUN(region.regionAnchorX = invalidPercentageValues[index])
-TypeError: Failed to set the 'regionAnchorX' property on 'VTTRegion': The provided double value is non-finite.
-EXPECTED (region.regionAnchorX == '0') OK
-RUN(region.regionAnchorY = invalidPercentageValues[index])
-TypeError: Failed to set the 'regionAnchorY' property on 'VTTRegion': The provided double value is non-finite.
-EXPECTED (region.regionAnchorY == '100') OK
-RUN(region.width = invalidPercentageValues[index])
-TypeError: Failed to set the 'width' property on 'VTTRegion': The provided double value is non-finite.
-EXPECTED (region.width == '100') OK
-RUN(region.height = -1)
-IndexSizeError: Failed to set the 'height' property on 'VTTRegion': The height provided (-1) is negative.
-EXPECTED (region.height == '3') OK
-
-** Test that proper mutation keeps assigned value. **
-RUN(region.height = 130)
-EXPECTED (region.height == '130') OK
-RUN(region.viewportAnchorX = 64)
-EXPECTED (region.viewportAnchorX == '64') OK
-RUN(region.viewportAnchorY = 32)
-EXPECTED (region.viewportAnchorY == '32') OK
-RUN(region.regionAnchorX = 16)
-EXPECTED (region.regionAnchorX == '16') OK
-RUN(region.regionAnchorY = 8)
-EXPECTED (region.regionAnchorY == '8') OK
-RUN(region.width = 42)
-EXPECTED (region.width == '42') OK
-END OF TEST
-

diff --git a/third_party/WebKit/LayoutTests/media/track/regions-webvtt/vtt-region-constructor.html b/third_party/WebKit/LayoutTests/media/track/regions-webvtt/vtt-region-constructor.html
index 0171e84..1eb5d81 100644
--- a/third_party/WebKit/LayoutTests/media/track/regions-webvtt/vtt-region-constructor.html
+++ b/third_party/WebKit/LayoutTests/media/track/regions-webvtt/vtt-region-constructor.html

@@ -1,82 +1,66 @@
 <!DOCTYPE html>
-<html>
-    <head>
-        <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
+<title>Tests the constructor and mutation of VTTRegion.</title>
+<script src="../../../resources/testharness.js"></script>
+<script src="../../../resources/testharnessreport.js"></script>
+<script>
+test(function() {
+    var region = new VTTRegion();
+    assert_true(region instanceof VTTRegion, "instanceof");
 
-        <script src=../../media-file.js></script>
-        <!-- TODO(philipj): Convert test to testharness.js. crbug.com/588956
-             (Please avoid writing new tests using video-test.js) -->
-        <script src=../../video-test.js></script>
-        <script>
-            var region;
-            var invalidPercentageValues;
+    assert_equals(region.track, null);
+    assert_equals(region.scroll, "");
+    assert_equals(region.viewportAnchorX, 0);
+    assert_equals(region.viewportAnchorY, 100);
+    assert_equals(region.regionAnchorX, 0);
+    assert_equals(region.regionAnchorY, 100);
+    assert_equals(region.height, 3);
+    assert_equals(region.width, 100);
 
-            function startTest()
-            {
-                if (!window.VTTRegion) {
-                    failTest();
-                    return;
-                }
+    assert_throws(new SyntaxError, function() { region.scroll = "invalid-scroll-value"; });
+    assert_equals(region.scroll, "");
 
-                region = new VTTRegion();
+    var invalidPercentageValues = [-1, 101];
+    for (var value of invalidPercentageValues) {
+      assert_throws("IndexSizeError", function() { region.viewportAnchorX = value; });
+      assert_equals(region.viewportAnchorX, 0);
+      assert_throws("IndexSizeError", function() { region.viewportAnchorY = value; });
+      assert_equals(region.viewportAnchorY, 100);
+      assert_throws("IndexSizeError", function() { region.regionAnchorX = value; });
+      assert_equals(region.regionAnchorX, 0);
+      assert_throws("IndexSizeError", function() { region.regionAnchorY = value; });
+      assert_equals(region.regionAnchorY, 100);
+      assert_throws("IndexSizeError", function() { region.width = value; });
+      assert_equals(region.width, 100);
+    }
 
-                consoleWrite("** Test instanceof VTTRegion. **");
-                testExpected("region instanceof VTTRegion", true);
+    invalidPercentageValues = [-Infinity, Infinity, NaN];
+    for (var value of invalidPercentageValues) {
+      assert_throws(new TypeError, function() { region.viewportAnchorX = value; });
+      assert_equals(region.viewportAnchorX, 0);
+      assert_throws(new TypeError, function() { region.viewportAnchorY = value; });
+      assert_equals(region.viewportAnchorY, 100);
+      assert_throws(new TypeError, function() { region.regionAnchorX = value; });
+      assert_equals(region.regionAnchorX, 0);
+      assert_throws(new TypeError, function() { region.regionAnchorY = value; });
+      assert_equals(region.regionAnchorY, 100);
+      assert_throws(new TypeError, function() { region.width = value; });
+      assert_equals(region.width, 100);
+    }
 
-                consoleWrite("** Test the default indexs of a region. **");
-                testExpected("region.track", null);
-                testExpected("region.scroll", "");
-                testExpected("region.viewportAnchorX", 0);
-                testExpected("region.viewportAnchorY", 100);
-                testExpected("region.regionAnchorX", 0);
-                testExpected("region.regionAnchorY", 100);
-                testExpected("region.height", 3);
-                testExpected("region.width", 100);
+    assert_throws("IndexSizeError", function() { region.height = -1; });
+    assert_equals(region.height, 3);
 
-                consoleWrite("<br>** Test that incorrect mutation keeps previous valid values. **");
-                run("region.scroll = 'invalid-scroll-value'");
-                testExpected("region.scroll", "");
-
-                invalidPercentageValues = [-1, 101, -Infinity, Infinity, NaN];
-                for (index in invalidPercentageValues) {
-                  consoleWrite("<br>Invalid percentage value: " + invalidPercentageValues[index]);
-                  run("region.viewportAnchorX = invalidPercentageValues[index]");
-                  testExpected("region.viewportAnchorX", 0);
-                  run("region.viewportAnchorY = invalidPercentageValues[index]");
-                  testExpected("region.viewportAnchorY", 100);
-                  run("region.regionAnchorX = invalidPercentageValues[index]");
-                  testExpected("region.regionAnchorX", 0);
-                  run("region.regionAnchorY = invalidPercentageValues[index]");
-                  testExpected("region.regionAnchorY", 100);
-                  run("region.width = invalidPercentageValues[index]");
-                  testExpected("region.width", 100);
-                }
-
-                run("region.height = -1");
-                testExpected("region.height", 3);
-
-                consoleWrite("<br>** Test that proper mutation keeps assigned value. **");
-                run("region.height = 130");
-                testExpected("region.height", 130);
-
-                run("region.viewportAnchorX = 64");
-                testExpected("region.viewportAnchorX", 64);
-                run("region.viewportAnchorY = 32");
-                testExpected("region.viewportAnchorY", 32);
-                run("region.regionAnchorX = 16");
-                testExpected("region.regionAnchorX", 16);
-                run("region.regionAnchorY = 8");
-                testExpected("region.regionAnchorY", 8);
-
-                run("region.width = 42");
-                testExpected("region.width", 42);
-
-                endTest();
-            }
-
-        </script>
-    </head>
-    <body onload="startTest()">
-        <p>Tests the constructor and mutation of VTTRegion.</p>
-    </body>
-</html>
+    region.height = 130;
+    assert_equals(region.height, 130);
+    region.viewportAnchorX = 64;
+    assert_equals(region.viewportAnchorX, 64);
+    region.viewportAnchorY = 32;
+    assert_equals(region.viewportAnchorY, 32);
+    region.regionAnchorX = 16;
+    assert_equals(region.regionAnchorX, 16);
+    region.regionAnchorY = 8;
+    assert_equals(region.regionAnchorY, 8);
+    region.width = 42;
+    assert_equals(region.width, 42);
+});
+</script>

diff --git a/third_party/WebKit/LayoutTests/media/track/regions-webvtt/vtt-region-display-expected.txt b/third_party/WebKit/LayoutTests/media/track/regions-webvtt/vtt-region-display-expected.txt
deleted file mode 100644
index 03bf685..0000000
--- a/third_party/WebKit/LayoutTests/media/track/regions-webvtt/vtt-region-display-expected.txt
+++ /dev/null

@@ -1,51 +0,0 @@
-Tests default rendering for TextTrackCues that belong to a VTTRegion.
-
-** The text track has only one region **
-EXPECTED (testTrack.regions.length == '1') OK
-
-** Inspecting cues displayed within region**
-
-RUN(video.currentTime = 0.2)
-EVENT(seeked)
-Total cues in region: 1
-Cue content is: We are in New York City
-Cue lines visible from this cue: 1
-EXPECTED (totalVisibleLines <= testTrack.regions[0].height == 'true') OK
-
-RUN(video.currentTime = 0.5)
-EVENT(seeked)
-Total cues in region: 2
-Cue content is: We are in New York City
-Cue lines visible from this cue: 1
-Cue content is: Second cue
-Cue lines visible from this cue: 1
-EXPECTED (totalVisibleLines <= testTrack.regions[0].height == 'true') OK
-
-RUN(video.currentTime = 1)
-EVENT(seeked)
-Total cues in region: 3
-Cue content is: We are in New York City
-Cue lines visible from this cue: 0
-Cue content is: Second cue
-Cue lines visible from this cue: 0
-Cue content is: Multiline Cue
-Cue lines visible from this cue: 2
-EXPECTED (totalVisibleLines <= testTrack.regions[0].height == 'true') OK
-
-RUN(video.currentTime = 2.3)
-EVENT(seeked)
-Total cues in region: 2
-Cue content is: Multiline Cue
-Cue lines visible from this cue: 1
-Cue content is: Fourth cue!
-Cue lines visible from this cue: 1
-EXPECTED (totalVisibleLines <= testTrack.regions[0].height == 'true') OK
-
-RUN(video.currentTime = 3)
-EVENT(seeked)
-Total cues in region: 1
-Cue content is: Fourth cue!
-Cue lines visible from this cue: 1
-EXPECTED (totalVisibleLines <= testTrack.regions[0].height == 'true') OK
-END OF TEST
-

diff --git a/third_party/WebKit/LayoutTests/media/track/regions-webvtt/vtt-region-display.html b/third_party/WebKit/LayoutTests/media/track/regions-webvtt/vtt-region-display.html
index 22dc53c3..d0f001fd 100644
--- a/third_party/WebKit/LayoutTests/media/track/regions-webvtt/vtt-region-display.html
+++ b/third_party/WebKit/LayoutTests/media/track/regions-webvtt/vtt-region-display.html

@@ -1,112 +1,70 @@
 <!DOCTYPE html>
-<html>
-    <head>
-        <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
+<title>Tests default rendering for TextTrackCues that belong to a VTTRegion.</title>
+<script src="../../media-controls.js"></script>
+<script src="../../media-file.js"></script>
+<script src="../../../resources/testharness.js"></script>
+<script src="../../../resources/testharnessreport.js"></script>
+<video controls></video>
+<script>
+var region;
+var seekTimes = [0.2, 0.5, 1.0, 2.3, 3.0];
+var seekTimeIndex = 0;
 
-        <script src=../../media-controls.js></script>
-        <script src=../../media-file.js></script>
-        <!-- TODO(philipj): Convert test to testharness.js. crbug.com/588956
-             (Please avoid writing new tests using video-test.js) -->
-        <script src=../../video-test.js></script>
-        <script>
-        var testTrack;
-        var region;
-        var container;
-        var totalVisibleLines;
+function countVisibleLines(cueElement)
+{
+    var cueRect = cueElement.getBoundingClientRect();
+    var regionRect = region.getBoundingClientRect();
 
-        var seekTimes = [0.2, 0.5, 1.0, 2.3, 3.0];
-        var crtSeekTime = 0;
+    var linesMatch = cueElement.textContent.match(/\n/g);
+    var linesCount = 1 + (linesMatch == null ? 0 : linesMatch.length);
+    var lineHeight = cueRect.height / linesCount;
 
-        function countVisibleLines(cueElement)
-        {
-            var cueRect = cueElement.getBoundingClientRect();
-            var regionRect = region.getBoundingClientRect();
+    var visibleLines = 0;
+    for (i = 0; i < linesCount; ++i) {
+      var lineTop = cueRect.top + i * lineHeight;
+      var lineBottom = cueRect.top + (i+1) * lineHeight;
 
-            var linesMatch = cueElement.textContent.match(/\n/g);
-            var linesCount = 1 + (linesMatch == null ? 0 : linesMatch.length);
-            var lineHeight = cueRect.height / linesCount;
+      if (lineTop >= regionRect.top && lineBottom <= regionRect.bottom)
+        visibleLines++;
+    }
 
-            var visibleLines = 0;
-            for (i = 0; i < linesCount; ++i) {
-              var lineTop = cueRect.top + i * lineHeight;
-              var lineBottom = cueRect.top + (i+1) * lineHeight;
+    return visibleLines;
+}
 
-              if (lineTop >= regionRect.top && lineBottom <= regionRect.bottom)
-                visibleLines++;
-            }
+async_test(function() {
+    var video = document.querySelector('video');
+    video.src = findMediaFile('video', '../../content/test');
+    var testTrack = document.createElement('track');
+    testTrack.onload = this.step_func(function() {
+        video.oncanplaythrough = this.step_func(function() {
+            track = video.textTracks[0];
 
-            return visibleLines;
-        }
+            assert_equals(track.regions.length, 1);
 
-        function testRegionsDisplay()
-        {
-            video.removeEventListener('canplaythrough', testRegionsDisplay);
+            region = textTrackDisplayElement(video, 'region');
+            var container = textTrackDisplayElement(video, 'region-container');
 
-            testTrack = video.textTracks[0];
+            video.onseeked = this.step_func(function() {
+                var totalVisibleLines = 0;
 
-            consoleWrite("** The text track has only one region **");
-            testExpected("testTrack.regions.length", 1);
+                for (var i = 0; i < container.children.length; ++i) {
+                    var cue = container.children[i];
+                    totalVisibleLines += countVisibleLines(cue);;
+                }
 
-            try {
-              region = textTrackDisplayElement(video, 'region');
-              container = textTrackDisplayElement(video, 'region-container');
-            } catch(e) {
-              consoleWrite(e);
-            }
+                assert_less_than_equal(totalVisibleLines, track.regions[0].height);
 
-            consoleWrite("<br>** Inspecting cues displayed within region**");
-
-            waitForEvent("seeked", inspectRegionTree);
-            seekVideo();
-        }
-
-        function seekVideo()
-        {
-            consoleWrite("");
-            run("video.currentTime = " + seekTimes[crtSeekTime++]);
-        }
-
-        function inspectRegionTree()
-        {
-            consoleWrite("Total cues in region: " + container.children.length);
-            totalVisibleLines = 0;
-
-            for (var i = 0; i < container.children.length; ++i) {
-                var cue = container.children[i];
-                var cueVisibleLines = countVisibleLines(cue);
-                consoleWrite("Cue content is: " + cue.textContent);
-                consoleWrite("Cue lines visible from this cue: " + cueVisibleLines);
-
-                totalVisibleLines += cueVisibleLines;
-            }
-
-            testExpected("totalVisibleLines <= testTrack.regions[0].height", true);
-
-            if (crtSeekTime == seekTimes.length)
-                endTest();
-            else
-                seekVideo();
-        }
-
-        function startTest()
-        {
-            if (!window.VTTRegion) {
-                failTest();
-                return;
-            }
-
-            findMediaElement();
-
-            video.src = findMediaFile('video', '../../content/test');
-            video.addEventListener('canplaythrough', testRegionsDisplay);
-        }
-
-        </script>
-    </head>
-    <body>
-        <p>Tests default rendering for TextTrackCues that belong to a VTTRegion.</p>
-        <video controls>
-            <track src="../captions-webvtt/captions-regions.vtt" kind="captions" default onload="startTest()">
-        </video>
-    </body>
-</html>
+                if (seekTimeIndex == seekTimes.length)
+                    this.done();
+                else
+                    video.currentTime = seekTimes[seekTimeIndex++];
+            });
+            video.currentTime = seekTimes[seekTimeIndex++];
+        });
+    });
+    testTrack.src = '../captions-webvtt/captions-regions.vtt';
+    testTrack.kind = 'captions';
+    testTrack.default = true;
+    video.appendChild(testTrack);
+});
+</script>

diff --git a/third_party/WebKit/LayoutTests/media/track/regions-webvtt/vtt-region-dom-layout-expected.txt b/third_party/WebKit/LayoutTests/media/track/regions-webvtt/vtt-region-dom-layout-expected.txt
deleted file mode 100644
index f96abe6..0000000
--- a/third_party/WebKit/LayoutTests/media/track/regions-webvtt/vtt-region-dom-layout-expected.txt
+++ /dev/null

@@ -1,19 +0,0 @@
-Tests default DOM layout structure for a VTTRegion.
-
-EVENT(canplaythrough)
-** The text track has only one region **
-EXPECTED (testTrack.regions.length == '1') OK
-
-** Inspecting the default DOM layout used for regions display **
-
-** Only one region should be displayed **
-EXPECTED (region.children.length == '1') OK
-
-** The child of the region should be the container **
-EXPECTED (region.children[0] == container == 'true') OK
-
-** Default pseudo IDs should be set properly
-EXPECTED (internals.shadowPseudoId(region) == '-webkit-media-text-track-region') OK
-EXPECTED (internals.shadowPseudoId(container) == '-webkit-media-text-track-region-container') OK
-END OF TEST
-

diff --git a/third_party/WebKit/LayoutTests/media/track/regions-webvtt/vtt-region-dom-layout.html b/third_party/WebKit/LayoutTests/media/track/regions-webvtt/vtt-region-dom-layout.html
index 91a3070d..831d397 100644
--- a/third_party/WebKit/LayoutTests/media/track/regions-webvtt/vtt-region-dom-layout.html
+++ b/third_party/WebKit/LayoutTests/media/track/regions-webvtt/vtt-region-dom-layout.html

@@ -1,66 +1,30 @@
 <!DOCTYPE html>
-<html>
-    <head>
-        <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
+<title>Tests default DOM layout structure for a VTTRegion.</title>
+<script src="../../media-controls.js"></script>
+<script src="../../media-file.js"></script>
+<script src="../../../resources/testharness.js"></script>
+<script src="../../../resources/testharnessreport.js"></script>
+<script>
+async_test(function() {
+    var video = document.createElement('video');
+    video.src = findMediaFile('video', '../../content/test');
+    var testTrack = document.createElement('track');
+    testTrack.onload = this.step_func(function() {
+        video.oncanplaythrough = this.step_func_done(function() {
+            assert_equals(testTrack.track.regions.length, 1);
 
-        <script src=../../media-controls.js></script>
-        <script src=../../media-file.js></script>
-        <!-- TODO(philipj): Convert test to testharness.js. crbug.com/588956
-             (Please avoid writing new tests using video-test.js) -->
-        <script src=../../video-test.js></script>
-        <script>
-        var testTrack;
-        var region;
-        var container;
+            var region = textTrackDisplayElement(video, 'region');
+            var container = textTrackDisplayElement(video, 'region-container');
 
-        function testRegionsDisplay()
-        {
-            testTrack = video.textTracks[0];
-
-            consoleWrite("** The text track has only one region **");
-            testExpected("testTrack.regions.length", 1);
-
-            try {
-              region = textTrackDisplayElement(video, 'region');
-              container = textTrackDisplayElement(video, 'region-container');
-            } catch(e) {
-              consoleWrite(e);
-            }
-
-            consoleWrite("<br>** Inspecting the default DOM layout used for regions display **");
-
-            consoleWrite("<br>** Only one region should be displayed **");
-            testExpected("region.children.length", 1);
-
-            consoleWrite("<br>** The child of the region should be the container **");
-            testExpected("region.children[0] == container", true);
-
-            consoleWrite("<br>** Default pseudo IDs should be set properly");
-            testExpected("internals.shadowPseudoId(region)", "-webkit-media-text-track-region");
-            testExpected("internals.shadowPseudoId(container)", "-webkit-media-text-track-region-container");
-
-            endTest();
-        }
-
-        function startTest()
-        {
-            if (!window.VTTRegion) {
-                failTest();
-                return;
-            }
-
-            findMediaElement();
-
-            video.src = findMediaFile('video', '../../content/test');
-            waitForEvent('canplaythrough', testRegionsDisplay);
-        }
-
-        </script>
-    </head>
-    <body>
-        <p>Tests default DOM layout structure for a VTTRegion.</p>
-        <video controls>
-            <track src="../captions-webvtt/captions-regions.vtt" kind="captions" default onload="startTest()">
-        </video>
-    </body>
-</html>
+            assert_equals(region.children.length, 1);
+            assert_equals(region.children[0], container);
+            assert_equals(internals.shadowPseudoId(region), '-webkit-media-text-track-region');
+            assert_equals(internals.shadowPseudoId(container), '-webkit-media-text-track-region-container');
+        });
+    });
+    testTrack.src = '../captions-webvtt/captions-regions.vtt';
+    testTrack.kind = 'captions';
+    testTrack.default = true;
+    video.appendChild(testTrack);
+});
+</script>

diff --git a/third_party/WebKit/LayoutTests/media/track/regions-webvtt/vtt-region-list-expected.txt b/third_party/WebKit/LayoutTests/media/track/regions-webvtt/vtt-region-list-expected.txt
deleted file mode 100644
index b0d402c..0000000
--- a/third_party/WebKit/LayoutTests/media/track/regions-webvtt/vtt-region-list-expected.txt
+++ /dev/null

@@ -1,44 +0,0 @@
-Tests VTTRegionList functionality: length, operator[], and getRegionById()
-
-
-** Implicit mode disabled and the regions attribute is null **
-EXPECTED (testTrack.track.mode == 'disabled') OK
-EXPECTED (testTrack.track.regions == 'null') OK
-
-** Test instanceof VTTRegionList **
-EXPECTED (regions instanceof VTTRegionList == 'true') OK
-
-** The regions attribute should be an empty VTTRegionList **
-EXPECTED (regions != null == 'true') OK
-EXPECTED (regions.length == '0') OK
-
-** The default value of the track attribute of the region is null**
-EXPECTED (region.track == 'null') OK
-
-** The addRegion() method properly updates the VTTRegionList object **
-EXPECTED (regions.length == '1') OK
-EXPECTED (regions[0] == region == 'true') OK
-EXPECTED (regions[0].track == testTrack.track == 'true') OK
-
-** The track attribute should correctly reflect the track to which the region was added to**
-EXPECTED (region.track == testTrack.track == 'true') OK
-
-** Adding a region with an existing id should update the existing region **
-EXPECTED (regions[0].viewportAnchorX == '59') OK
-EXPECTED (regions[0].viewportAnchorY == '68') OK
-EXPECTED (regions[0].regionAnchorX == '20') OK
-EXPECTED (regions[0].regionAnchorY == '30') OK
-EXPECTED (regions[0].height == '5') OK
-EXPECTED (regions[0].width == '87') OK
-EXPECTED (regions[0].scroll == 'up') OK
-EXPECTED (regions[0] != updatedRegion == 'true') OK
-
-** Add the region back and check if removeRegion() removes it properly **
-EXPECTED (regions.length == '1') OK
-EXPECTED (regions.length == '0') OK
-
-** In case the region is not found, NotFoundError should be thrown **
-NotFoundError: Failed to execute 'removeRegion' on 'TextTrack': The specified region is not listed in the TextTrack's list of regions.
-
-END OF TEST
-

diff --git a/third_party/WebKit/LayoutTests/media/track/regions-webvtt/vtt-region-list.html b/third_party/WebKit/LayoutTests/media/track/regions-webvtt/vtt-region-list.html
index 856d7057..a3cc48e 100644
--- a/third_party/WebKit/LayoutTests/media/track/regions-webvtt/vtt-region-list.html
+++ b/third_party/WebKit/LayoutTests/media/track/regions-webvtt/vtt-region-list.html

@@ -1,103 +1,63 @@
 <!DOCTYPE html>
-<html>
-    <head>
-        <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
+<title>Tests VTTRegionList functionality: length, operator[], and getRegionById().</title>
+<script src="../../../resources/testharness.js"></script>
+<script src="../../../resources/testharnessreport.js"></script>
+<script>
+test(function() {
+    var testTrack = document.createElement('track');
+    
+    assert_equals(testTrack.track.mode, 'disabled');
+    assert_equals(testTrack.track.regions, null);
 
-        <script src=../../media-file.js></script>
-        <!-- TODO(philipj): Convert test to testharness.js. crbug.com/588956
-             (Please avoid writing new tests using video-test.js) -->
-        <script src=../../video-test.js></script>
-        <script>
-        var testTrack;
-        var region;
-        var regions;
-        var updatedRegion;
+    testTrack.track.mode = 'hidden';
+    var regions = testTrack.track.regions;
 
-        function startTest()
-        {
-            testTrack = document.getElementsByTagName('track')[0];
+    assert_true(regions instanceof VTTRegionList, 'instanceof');
 
-            consoleWrite("<br>** Implicit mode disabled and the regions attribute is null **");
-            testExpected("testTrack.track.mode", "disabled");
-            testExpected("testTrack.track.regions", null);
+    assert_equals(regions.length, 0);
 
-            testTrack.track.mode = "hidden";
-            regions = testTrack.track.regions;
+    var region = new VTTRegion();
+    region.id = 'TestId';
 
-            consoleWrite("<br>** Test instanceof VTTRegionList **");
-            testExpected("regions instanceof VTTRegionList", true);
+    assert_equals(region.track, null);
 
-            consoleWrite("<br>** The regions attribute should be an empty VTTRegionList **");
-            testExpected("regions != null", true);
-            testExpected("regions.length", 0);
+    testTrack.track.addRegion(region);
 
-            region = new VTTRegion();
-            region.id = "TestId";
+    assert_equals(regions.length, 1);
+    assert_equals(regions[0], region);
+    assert_equals(regions[0].track, testTrack.track);
 
-            consoleWrite("<br>** The default value of the track attribute of the region is null**");
-            testExpected("region.track", null);
+    assert_equals(region.track, testTrack.track);
 
-            testTrack.track.addRegion(region);
+    var updatedRegion = new VTTRegion();
+    updatedRegion.id = region.id;
+    updatedRegion.viewportAnchorX = 59;
+    updatedRegion.viewportAnchorY = 68;
+    updatedRegion.regionAnchorX = 20;
+    updatedRegion.regionAnchorY = 30;
+    updatedRegion.height = 5;
+    updatedRegion.width = 87;
+    updatedRegion.scroll = 'up';
 
-            consoleWrite("<br>** The addRegion() method properly updates the VTTRegionList object **");
-            testExpected("regions.length", 1);
-            testExpected("regions[0] == region", true);
-            testExpected("regions[0].track == testTrack.track", true);
+    testTrack.track.addRegion(updatedRegion);
+    assert_equals(regions[0].viewportAnchorX, updatedRegion.viewportAnchorX);
+    assert_equals(regions[0].viewportAnchorY, updatedRegion.viewportAnchorY);
+    assert_equals(regions[0].regionAnchorX, updatedRegion.regionAnchorX);
+    assert_equals(regions[0].regionAnchorY, updatedRegion.regionAnchorY);
+    assert_equals(regions[0].height, updatedRegion.height);
+    assert_equals(regions[0].width, updatedRegion.width);
+    assert_equals(regions[0].scroll, updatedRegion.scroll);
 
-            consoleWrite("<br>** The track attribute should correctly reflect the track to which the region was added to**");
-            testExpected("region.track == testTrack.track", true);
+    assert_not_equals(regions[0], updatedRegion);
 
-            updatedRegion = new VTTRegion();
-            updatedRegion.id = region.id;
-            updatedRegion.viewportAnchorX = 59;
-            updatedRegion.viewportAnchorY = 68;
-            updatedRegion.regionAnchorX = 20;
-            updatedRegion.regionAnchorY = 30;
-            updatedRegion.height = 5;
-            updatedRegion.width = 87;
-            updatedRegion.scroll = "up";
+    testTrack.track.addRegion(region);
+    assert_equals(regions.length, 1);
+    testTrack.track.removeRegion(region);
+    assert_equals(regions.length, 0);
 
-            consoleWrite("<br>** Adding a region with an existing id should update the existing region **");
-            testTrack.track.addRegion(updatedRegion);
-            testExpected("regions[0].viewportAnchorX", updatedRegion.viewportAnchorX);
-            testExpected("regions[0].viewportAnchorY", updatedRegion.viewportAnchorY);
-            testExpected("regions[0].regionAnchorX", updatedRegion.regionAnchorX);
-            testExpected("regions[0].regionAnchorY", updatedRegion.regionAnchorY);
-            testExpected("regions[0].height", updatedRegion.height);
-            testExpected("regions[0].width", updatedRegion.width);
-            testExpected("regions[0].scroll", updatedRegion.scroll);
+    assert_throws('NotFoundError', function() { testTrack.track.removeRegion(region); });
 
-            testExpected("regions[0] != updatedRegion", true);
-
-            consoleWrite("<br>** Add the region back and check if removeRegion() removes it properly **");
-            testTrack.track.addRegion(region);
-            testExpected("regions.length", 1);
-            testTrack.track.removeRegion(region);
-            testExpected("regions.length", 0);
-
-            consoleWrite("<br>** In case the region is not found, NotFoundError should be thrown **");
-            try {
-              testTrack.track.removeRegion(region);
-            } catch(e) {
-              consoleWrite(e);
-            }
-
-            // FIXME(109818): Update test for multiple initial regions (after parsing is supported).
-
-            consoleWrite("");
-            endTest();
-        }
-
-        function startTestWithDelay()
-        {
-            setTimeout(startTest, 100);
-        }
-        </script>
-    </head>
-    <body onload="startTestWithDelay()">
-        <p>Tests VTTRegionList functionality: length, operator[], and getRegionById()</p>
-        <video>
-            <track id="testTrack" src="captions-webvtt/captions-fast.vtt">
-        </video>
-    </body>
+    // FIXME(109818): Update test for multiple initial regions (after parsing is supported).
+});
+</script>
 </html>

diff --git a/third_party/WebKit/LayoutTests/media/track/regions-webvtt/vtt-region-parser-expected.txt b/third_party/WebKit/LayoutTests/media/track/regions-webvtt/vtt-region-parser-expected.txt
deleted file mode 100644
index 070f431..0000000
--- a/third_party/WebKit/LayoutTests/media/track/regions-webvtt/vtt-region-parser-expected.txt
+++ /dev/null

@@ -1,28 +0,0 @@
-Tests proper parsing of various regions present in WebVTT header area.
-
-EXPECTED (video.textTracks[0].regions.length == '5') OK
-
-EXPECTED (region.id == 'region_without_settings') OK
-
-EXPECTED (region.id == 'region_with_all_settings') OK
-EXPECTED (region.width == '32') OK
-EXPECTED (region.height == '5') OK
-EXPECTED (region.regionAnchorX == '41') OK
-EXPECTED (region.regionAnchorY == '20') OK
-EXPECTED (region.viewportAnchorX == '31') OK
-EXPECTED (region.viewportAnchorY == '84') OK
-EXPECTED (region.scroll == 'up') OK
-
-EXPECTED (region.id == 'region_floating_point_anchor') OK
-EXPECTED (Math.round(region.regionAnchorX * 1000) == '41133') OK
-EXPECTED (Math.round(region.regionAnchorY * 1000) == '20420') OK
-EXPECTED (Math.round(region.viewportAnchorX * 1000) == '32330') OK
-EXPECTED (Math.round(region.viewportAnchorY * 1000) == '32440') OK
-
-EXPECTED (region.id == 'not_unique_id') OK
-EXPECTED (region.width == '67') OK
-
-EXPECTED (region.id == '') OK
-
-END OF TEST
-

diff --git a/third_party/WebKit/LayoutTests/media/track/regions-webvtt/vtt-region-parser.html b/third_party/WebKit/LayoutTests/media/track/regions-webvtt/vtt-region-parser.html
index 86c62e5..5eb4338 100644
--- a/third_party/WebKit/LayoutTests/media/track/regions-webvtt/vtt-region-parser.html
+++ b/third_party/WebKit/LayoutTests/media/track/regions-webvtt/vtt-region-parser.html

@@ -1,68 +1,47 @@
 <!DOCTYPE html>
-<html>
-    <head>
-        <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
+<title>Tests proper parsing of various regions present in WebVTT header area.</title>
+<script src="../../media-file.js"></script>
+<script src="../../../resources/testharness.js"></script>
+<script src="../../../resources/testharnessreport.js"></script>
+<script>
+async_test(function(t) {
+    var video = document.createElement('video');
+    video.src = findMediaFile('video', '../../content/test');
+    var testTrack = document.createElement('track');
+    testTrack.onload = t.step_func_done(function() {
+        var track = testTrack.track;
+        assert_equals(track.regions.length, 5);
 
-        <script src=../../media-file.js></script>
-        <!-- TODO(philipj): Convert test to testharness.js. crbug.com/588956
-             (Please avoid writing new tests using video-test.js) -->
-        <script src=../../video-test.js></script>
-        <script>
-        var region;
+        var region = track.regions[0];
+        assert_equals(region.id, 'region_without_settings');
 
-        function startTest()
-        {
-            if (!window.VTTRegion) {
-                failTest();
-                return;
-            }
+        region = track.regions[1];
+        assert_equals(region.id, 'region_with_all_settings');
+        assert_equals(region.width, 32);
+        assert_equals(region.height, 5);
+        assert_equals(region.regionAnchorX, 41);
+        assert_equals(region.regionAnchorY, 20);
+        assert_equals(region.viewportAnchorX, 31);
+        assert_equals(region.viewportAnchorY, 84);
+        assert_equals(region.scroll, 'up');
 
-            findMediaElement();
-            testExpected("video.textTracks[0].regions.length", 5);
+        region = track.regions[2];
+        assert_equals(region.id, 'region_floating_point_anchor');
+        assert_equals(Math.round(region.regionAnchorX * 1000), 41133);
+        assert_equals(Math.round(region.regionAnchorY * 1000), 20420);
+        assert_equals(Math.round(region.viewportAnchorX * 1000), 32330);
+        assert_equals(Math.round(region.viewportAnchorY * 1000), 32440);
 
-            consoleWrite("");
-            region = video.textTracks[0].regions[0];
-            testExpected("region.id", "region_without_settings");
+        region = track.regions[3];
+        assert_equals(region.id, 'not_unique_id');
+        assert_equals(region.width, 67);
 
-            consoleWrite("");
-            region = video.textTracks[0].regions[1];
-            testExpected("region.id", "region_with_all_settings");
-            testExpected("region.width", 32);
-            testExpected("region.height", 5);
-            testExpected("region.regionAnchorX", 41);
-            testExpected("region.regionAnchorY", 20);
-            testExpected("region.viewportAnchorX", 31);
-            testExpected("region.viewportAnchorY", 84);
-            testExpected("region.scroll", "up");
-
-            consoleWrite("");
-            region = video.textTracks[0].regions[2];
-            testExpected("region.id", "region_floating_point_anchor");
-            testExpected("Math.round(region.regionAnchorX * 1000)", 41133);
-            testExpected("Math.round(region.regionAnchorY * 1000)", 20420);
-            testExpected("Math.round(region.viewportAnchorX * 1000)", 32330);
-            testExpected("Math.round(region.viewportAnchorY * 1000)", 32440);
-
-            consoleWrite("");
-            region = video.textTracks[0].regions[3];
-            testExpected("region.id", "not_unique_id");
-            testExpected("region.width", 67);
-
-            consoleWrite("");
-            region = video.textTracks[0].regions[4];
-            testExpected("region.id", "");
-
-            consoleWrite("");
-            endTest();
-        }
-
-        </script>
-    </head>
-    <body>
-        <p>Tests proper parsing of various regions present in WebVTT header area.</p>
-        <video controls>
-            <track src="../captions-webvtt/header-regions.vtt" kind="captions" default onload="startTest()">
-        </video>
-
-    </body>
-</html>
+        region = track.regions[4];
+        assert_equals(region.id, '');
+    });
+    testTrack.src = '../captions-webvtt/header-regions.vtt';
+    testTrack.kind = 'captions';
+    testTrack.default = true;
+    video.appendChild(testTrack);
+});
+</script>

diff --git a/third_party/WebKit/LayoutTests/platform/android/svg/wicd/test-rightsizing-b-expected.png b/third_party/WebKit/LayoutTests/platform/android/svg/wicd/test-rightsizing-b-expected.png
new file mode 100644
index 0000000..3580881
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/platform/android/svg/wicd/test-rightsizing-b-expected.png
Binary files differ

diff --git a/third_party/WebKit/LayoutTests/platform/android/svg/wicd/test-rightsizing-b-expected.txt b/third_party/WebKit/LayoutTests/platform/android/svg/wicd/test-rightsizing-b-expected.txt
new file mode 100644
index 0000000..ea8eff9
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/platform/android/svg/wicd/test-rightsizing-b-expected.txt

@@ -0,0 +1,101 @@
+layer at (0,0) size 800x600 clip at (0,0) size 785x600 scrollHeight 856
+  LayoutView at (0,0) size 800x600
+layer at (0,0) size 785x856 backgroundClip at (0,0) size 785x600 clip at (0,0) size 785x600
+  LayoutBlockFlow {html} at (0,0) size 785x856.11
+    LayoutBlockFlow {body} at (47.09,30.72) size 737.89x817.39
+      LayoutBlockFlow {div} at (0,0) size 737.89x817.39
+        LayoutBlockFlow {h1} at (0,0) size 678.86x31
+          LayoutText {#text} at (0,0) size 387x30
+            text run at (0,0) width 387: "rightsizing to percentage width"
+        LayoutBlockFlow {h4} at (0,31) size 737.89x16
+          LayoutText {#text} at (0,0) size 138x16
+            text run at (0,0) width 138: "WICD Core 1.0 #20-2"
+        LayoutBlockFlow (anonymous) at (0,66.14) size 737.89x299
+          LayoutText {#text} at (295,280) size 5x18
+            text run at (295,280) width 5: " "
+          LayoutText {#text} at (446,280) size 5x18
+            text run at (446,280) width 5: " "
+          LayoutText {#text} at (524,280) size 5x18
+            text run at (524,280) width 5: " "
+          LayoutText {#text} at (0,0) size 0x0
+        LayoutBlockFlow {p} at (0,368.02) size 678.86x68
+          LayoutText {#text} at (0,0) size 651x34
+            text run at (0,0) width 651: "Above there must be four times the same, square SVG child visible, each referenced by an object element"
+            text run at (0,17) width 414: "with different widths (40%, 20%, 10%, 5%) and no height defined. "
+          LayoutBR {br} at (0,0) size 0x0
+          LayoutBR {br} at (0,34) size 0x17
+          LayoutText {#text} at (0,51) size 398x17
+            text run at (0,51) width 398: "Beyond there is the same, only with PNG images instead of SVG."
+        LayoutBlockFlow (anonymous) at (0,441.77) size 737.89x299
+          LayoutImage {object} at (0,0) size 295.16x295 [bgcolor=#FF0000]
+          LayoutText {#text} at (295,280) size 5x18
+            text run at (295,280) width 5: " "
+          LayoutImage {object} at (299.16,147) size 147.58x148 [bgcolor=#FF0000]
+          LayoutText {#text} at (446,280) size 5x18
+            text run at (446,280) width 5: " "
+          LayoutImage {object} at (450.73,221) size 73.78x74 [bgcolor=#FF0000]
+          LayoutText {#text} at (524,280) size 5x18
+            text run at (524,280) width 5: " "
+          LayoutImage {object} at (528.52,258) size 36.89x37 [bgcolor=#FF0000]
+          LayoutText {#text} at (0,0) size 0x0
+        LayoutBlockFlow {p} at (0,743.64) size 678.86x34
+          LayoutText {#text} at (0,0) size 661x34
+            text run at (0,0) width 661: "This test has succeeded, if both rows look exactly the same (SVGs must be square!) and no red background"
+            text run at (0,17) width 94: "color is visible."
+        LayoutBlockFlow {p} at (0,783.39) size 678.86x34
+          LayoutBR {br} at (0,0) size 0x17
+          LayoutInline {a} at (0,0) size 31x17 [color=#000066]
+            LayoutText {#text} at (0,17) size 31x17
+              text run at (0,17) width 31: "Back"
+layer at (47,97) size 295x295
+  LayoutEmbeddedObject {object} at (0,0) size 295.16x295 [bgcolor=#FF0000]
+    layer at (0,0) size 295x295
+      LayoutView at (0,0) size 295x295
+    layer at (0,0) size 295x295
+      LayoutSVGRoot {svg} at (0,0) size 295x295
+        LayoutSVGHiddenContainer {defs} at (0,0) size 0x0
+        LayoutSVGRect {rect} at (0,0) size 295x295 [fill={[type=SOLID] [color=#5588FF]}] [x=-3000.00] [y=-1000.00] [width=6200.00] [height=2200.00]
+        LayoutSVGEllipse {circle} at (0,0) size 295x295 [fill={[type=SOLID] [color=#0000FF]}] [cx=100.00] [cy=100.00] [r=100.00]
+        LayoutSVGContainer {g} at (44,92) size 206x118
+          LayoutSVGText {text} at (30,62) size 140x80 contains 1 chunk(s)
+            LayoutSVGInlineText {#text} at (0,0) size 139x80
+              chunk 1 (middle anchor) text run 1 at (30.51,125.00) startOffset 0 endOffset 3 width 138.98: "SVG"
+layer at (346,244) size 148x148
+  LayoutEmbeddedObject {object} at (299.16,147) size 147.58x148 [bgcolor=#FF0000]
+    layer at (0,0) size 148x148
+      LayoutView at (0,0) size 148x148
+    layer at (0,0) size 148x148
+      LayoutSVGRoot {svg} at (0,0) size 148x148
+        LayoutSVGHiddenContainer {defs} at (0,0) size 0x0
+        LayoutSVGRect {rect} at (0,0) size 148x148 [fill={[type=SOLID] [color=#5588FF]}] [x=-3000.00] [y=-1000.00] [width=6200.00] [height=2200.00]
+        LayoutSVGEllipse {circle} at (0,0) size 148x148 [fill={[type=SOLID] [color=#0000FF]}] [cx=100.00] [cy=100.00] [r=100.00]
+        LayoutSVGContainer {g} at (21,45) size 105x61
+          LayoutSVGText {text} at (29,61) size 142x82 contains 1 chunk(s)
+            LayoutSVGInlineText {#text} at (0,0) size 141x82
+              chunk 1 (middle anchor) text run 1 at (29.73,125.00) startOffset 0 endOffset 3 width 140.54: "SVG"
+layer at (498,318) size 74x74
+  LayoutEmbeddedObject {object} at (450.73,221) size 73.78x74 [bgcolor=#FF0000]
+    layer at (0,0) size 74x74
+      LayoutView at (0,0) size 74x74
+    layer at (0,0) size 74x74
+      LayoutSVGRoot {svg} at (0,0) size 74x74
+        LayoutSVGHiddenContainer {defs} at (0,0) size 0x0
+        LayoutSVGRect {rect} at (0,0) size 74x74 [fill={[type=SOLID] [color=#5588FF]}] [x=-3000.00] [y=-1000.00] [width=6200.00] [height=2200.00]
+        LayoutSVGEllipse {circle} at (0,0) size 74x74 [fill={[type=SOLID] [color=#0000FF]}] [cx=100.00] [cy=100.00] [r=100.00]
+        LayoutSVGContainer {g} at (11,23) size 51x30
+          LayoutSVGText {text} at (32,62) size 136x80 contains 1 chunk(s)
+            LayoutSVGInlineText {#text} at (0,0) size 136x79
+              chunk 1 (middle anchor) text run 1 at (32.43,125.00) startOffset 0 endOffset 3 width 135.14: "SVG"
+layer at (576,355) size 36x37
+  LayoutEmbeddedObject {object} at (528.52,258) size 36.89x37 [bgcolor=#FF0000]
+    layer at (0,0) size 37x37
+      LayoutView at (0,0) size 37x37
+    layer at (0,0) size 37x37
+      LayoutSVGRoot {svg} at (0,0) size 37x37
+        LayoutSVGHiddenContainer {defs} at (0,0) size 0x0
+        LayoutSVGRect {rect} at (0,0) size 37x37 [fill={[type=SOLID] [color=#5588FF]}] [x=-3000.00] [y=-1000.00] [width=6200.00] [height=2200.00]
+        LayoutSVGEllipse {circle} at (0,0) size 37x37 [fill={[type=SOLID] [color=#0000FF]}] [cx=100.00] [cy=100.00] [r=100.00]
+        LayoutSVGContainer {g} at (6,11) size 24x16
+          LayoutSVGText {text} at (37,60) size 126x82 contains 1 chunk(s)
+            LayoutSVGInlineText {#text} at (0,0) size 125x82
+              chunk 1 (middle anchor) text run 1 at (37.84,125.00) startOffset 0 endOffset 3 width 124.32: "SVG"

diff --git a/third_party/WebKit/LayoutTests/platform/android/virtual/gpu-rasterization/fast/images/jpeg-yuv-progressive-image-expected.png b/third_party/WebKit/LayoutTests/platform/android/virtual/gpu-rasterization/fast/images/jpeg-yuv-progressive-image-expected.png
new file mode 100644
index 0000000..6801b665
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/platform/android/virtual/gpu-rasterization/fast/images/jpeg-yuv-progressive-image-expected.png
Binary files differ

diff --git a/third_party/WebKit/LayoutTests/platform/linux-precise/svg/wicd/test-rightsizing-b-expected.png b/third_party/WebKit/LayoutTests/platform/linux-precise/svg/wicd/test-rightsizing-b-expected.png
index 186229e..6b331ad 100644
--- a/third_party/WebKit/LayoutTests/platform/linux-precise/svg/wicd/test-rightsizing-b-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/linux-precise/svg/wicd/test-rightsizing-b-expected.png
Binary files differ

diff --git a/third_party/WebKit/LayoutTests/platform/linux-precise/svg/wicd/test-rightsizing-b-expected.txt b/third_party/WebKit/LayoutTests/platform/linux-precise/svg/wicd/test-rightsizing-b-expected.txt
index 62cc2e9..eb858a4 100644
--- a/third_party/WebKit/LayoutTests/platform/linux-precise/svg/wicd/test-rightsizing-b-expected.txt
+++ b/third_party/WebKit/LayoutTests/platform/linux-precise/svg/wicd/test-rightsizing-b-expected.txt

@@ -27,16 +27,16 @@
           LayoutText {#text} at (0,51) size 398x17
             text run at (0,51) width 398: "Beyond there is the same, only with PNG images instead of SVG."
         LayoutBlockFlow (anonymous) at (0,296.77) size 737.89x299
-          LayoutImage {object} at (0,0) size 295.16x295 [bgcolor=#FF0000]
+          LayoutImage {object} at (0,0) size 295.16x295.16 [bgcolor=#FF0000]
           LayoutText {#text} at (295,280) size 5x18
             text run at (295,280) width 5: " "
-          LayoutImage {object} at (299.16,147) size 147.58x148 [bgcolor=#FF0000]
+          LayoutImage {object} at (299.16,147) size 147.58x147.58 [bgcolor=#FF0000]
           LayoutText {#text} at (446,280) size 5x18
             text run at (446,280) width 5: " "
-          LayoutImage {object} at (450.73,221) size 73.78x74 [bgcolor=#FF0000]
+          LayoutImage {object} at (450.73,221) size 73.78x73.78 [bgcolor=#FF0000]
           LayoutText {#text} at (524,280) size 5x18
             text run at (524,280) width 5: " "
-          LayoutImage {object} at (528.52,258) size 36.89x37 [bgcolor=#FF0000]
+          LayoutImage {object} at (528.52,258) size 36.89x36.89 [bgcolor=#FF0000]
           LayoutText {#text} at (0,0) size 0x0
         LayoutBlockFlow {p} at (0,598.64) size 678.86x34
           LayoutText {#text} at (0,0) size 661x34

diff --git a/third_party/WebKit/LayoutTests/platform/linux/svg/wicd/test-rightsizing-b-expected.png b/third_party/WebKit/LayoutTests/platform/linux/svg/wicd/test-rightsizing-b-expected.png
index 3580881..b683efef 100644
--- a/third_party/WebKit/LayoutTests/platform/linux/svg/wicd/test-rightsizing-b-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/linux/svg/wicd/test-rightsizing-b-expected.png
Binary files differ

diff --git a/third_party/WebKit/LayoutTests/platform/linux/svg/wicd/test-rightsizing-b-expected.txt b/third_party/WebKit/LayoutTests/platform/linux/svg/wicd/test-rightsizing-b-expected.txt
index ea8eff9..ba739ec 100644
--- a/third_party/WebKit/LayoutTests/platform/linux/svg/wicd/test-rightsizing-b-expected.txt
+++ b/third_party/WebKit/LayoutTests/platform/linux/svg/wicd/test-rightsizing-b-expected.txt

@@ -1,24 +1,24 @@
-layer at (0,0) size 800x600 clip at (0,0) size 785x600 scrollHeight 856
+layer at (0,0) size 800x600 clip at (0,0) size 785x600 scrollHeight 711
   LayoutView at (0,0) size 800x600
-layer at (0,0) size 785x856 backgroundClip at (0,0) size 785x600 clip at (0,0) size 785x600
-  LayoutBlockFlow {html} at (0,0) size 785x856.11
-    LayoutBlockFlow {body} at (47.09,30.72) size 737.89x817.39
-      LayoutBlockFlow {div} at (0,0) size 737.89x817.39
+layer at (0,0) size 785x711 backgroundClip at (0,0) size 785x600 clip at (0,0) size 785x600
+  LayoutBlockFlow {html} at (0,0) size 785x711.11
+    LayoutBlockFlow {body} at (47.09,30.72) size 737.89x672.39
+      LayoutBlockFlow {div} at (0,0) size 737.89x672.39
         LayoutBlockFlow {h1} at (0,0) size 678.86x31
           LayoutText {#text} at (0,0) size 387x30
             text run at (0,0) width 387: "rightsizing to percentage width"
         LayoutBlockFlow {h4} at (0,31) size 737.89x16
           LayoutText {#text} at (0,0) size 138x16
             text run at (0,0) width 138: "WICD Core 1.0 #20-2"
-        LayoutBlockFlow (anonymous) at (0,66.14) size 737.89x299
-          LayoutText {#text} at (295,280) size 5x18
-            text run at (295,280) width 5: " "
-          LayoutText {#text} at (446,280) size 5x18
-            text run at (446,280) width 5: " "
-          LayoutText {#text} at (524,280) size 5x18
-            text run at (524,280) width 5: " "
+        LayoutBlockFlow (anonymous) at (0,66.14) size 737.89x154
+          LayoutText {#text} at (295,135) size 5x18
+            text run at (295,135) width 5: " "
+          LayoutText {#text} at (446,135) size 5x18
+            text run at (446,135) width 5: " "
+          LayoutText {#text} at (524,135) size 5x18
+            text run at (524,135) width 5: " "
           LayoutText {#text} at (0,0) size 0x0
-        LayoutBlockFlow {p} at (0,368.02) size 678.86x68
+        LayoutBlockFlow {p} at (0,223.02) size 678.86x68
           LayoutText {#text} at (0,0) size 651x34
             text run at (0,0) width 651: "Above there must be four times the same, square SVG child visible, each referenced by an object element"
             text run at (0,17) width 414: "with different widths (40%, 20%, 10%, 5%) and no height defined. "
@@ -26,55 +26,43 @@
           LayoutBR {br} at (0,34) size 0x17
           LayoutText {#text} at (0,51) size 398x17
             text run at (0,51) width 398: "Beyond there is the same, only with PNG images instead of SVG."
-        LayoutBlockFlow (anonymous) at (0,441.77) size 737.89x299
-          LayoutImage {object} at (0,0) size 295.16x295 [bgcolor=#FF0000]
+        LayoutBlockFlow (anonymous) at (0,296.77) size 737.89x299
+          LayoutImage {object} at (0,0) size 295.16x295.16 [bgcolor=#FF0000]
           LayoutText {#text} at (295,280) size 5x18
             text run at (295,280) width 5: " "
-          LayoutImage {object} at (299.16,147) size 147.58x148 [bgcolor=#FF0000]
+          LayoutImage {object} at (299.16,147) size 147.58x147.58 [bgcolor=#FF0000]
           LayoutText {#text} at (446,280) size 5x18
             text run at (446,280) width 5: " "
-          LayoutImage {object} at (450.73,221) size 73.78x74 [bgcolor=#FF0000]
+          LayoutImage {object} at (450.73,221) size 73.78x73.78 [bgcolor=#FF0000]
           LayoutText {#text} at (524,280) size 5x18
             text run at (524,280) width 5: " "
-          LayoutImage {object} at (528.52,258) size 36.89x37 [bgcolor=#FF0000]
+          LayoutImage {object} at (528.52,258) size 36.89x36.89 [bgcolor=#FF0000]
           LayoutText {#text} at (0,0) size 0x0
-        LayoutBlockFlow {p} at (0,743.64) size 678.86x34
+        LayoutBlockFlow {p} at (0,598.64) size 678.86x34
           LayoutText {#text} at (0,0) size 661x34
             text run at (0,0) width 661: "This test has succeeded, if both rows look exactly the same (SVGs must be square!) and no red background"
             text run at (0,17) width 94: "color is visible."
-        LayoutBlockFlow {p} at (0,783.39) size 678.86x34
+        LayoutBlockFlow {p} at (0,638.39) size 678.86x34
           LayoutBR {br} at (0,0) size 0x17
           LayoutInline {a} at (0,0) size 31x17 [color=#000066]
             LayoutText {#text} at (0,17) size 31x17
               text run at (0,17) width 31: "Back"
-layer at (47,97) size 295x295
-  LayoutEmbeddedObject {object} at (0,0) size 295.16x295 [bgcolor=#FF0000]
-    layer at (0,0) size 295x295
-      LayoutView at (0,0) size 295x295
-    layer at (0,0) size 295x295
-      LayoutSVGRoot {svg} at (0,0) size 295x295
-        LayoutSVGHiddenContainer {defs} at (0,0) size 0x0
-        LayoutSVGRect {rect} at (0,0) size 295x295 [fill={[type=SOLID] [color=#5588FF]}] [x=-3000.00] [y=-1000.00] [width=6200.00] [height=2200.00]
-        LayoutSVGEllipse {circle} at (0,0) size 295x295 [fill={[type=SOLID] [color=#0000FF]}] [cx=100.00] [cy=100.00] [r=100.00]
-        LayoutSVGContainer {g} at (44,92) size 206x118
-          LayoutSVGText {text} at (30,62) size 140x80 contains 1 chunk(s)
-            LayoutSVGInlineText {#text} at (0,0) size 139x80
-              chunk 1 (middle anchor) text run 1 at (30.51,125.00) startOffset 0 endOffset 3 width 138.98: "SVG"
-layer at (346,244) size 148x148
-  LayoutEmbeddedObject {object} at (299.16,147) size 147.58x148 [bgcolor=#FF0000]
-    layer at (0,0) size 148x148
-      LayoutView at (0,0) size 148x148
-    layer at (0,0) size 148x148
-      LayoutSVGRoot {svg} at (0,0) size 148x148
-        LayoutSVGHiddenContainer {defs} at (0,0) size 0x0
-        LayoutSVGRect {rect} at (0,0) size 148x148 [fill={[type=SOLID] [color=#5588FF]}] [x=-3000.00] [y=-1000.00] [width=6200.00] [height=2200.00]
-        LayoutSVGEllipse {circle} at (0,0) size 148x148 [fill={[type=SOLID] [color=#0000FF]}] [cx=100.00] [cy=100.00] [r=100.00]
-        LayoutSVGContainer {g} at (21,45) size 105x61
-          LayoutSVGText {text} at (29,61) size 142x82 contains 1 chunk(s)
-            LayoutSVGInlineText {#text} at (0,0) size 141x82
-              chunk 1 (middle anchor) text run 1 at (29.73,125.00) startOffset 0 endOffset 3 width 140.54: "SVG"
-layer at (498,318) size 74x74
-  LayoutEmbeddedObject {object} at (450.73,221) size 73.78x74 [bgcolor=#FF0000]
+layer at (47,97) size 295x150
+  LayoutEmbeddedObject {object} at (0,0) size 295.16x150 [bgcolor=#FF0000]
+    layer at (0,0) size 295x150
+      LayoutView at (0,0) size 295x150
+    layer at (0,0) size 295x150
+      LayoutBlockFlow {HTML} at (0,0) size 295x150
+        LayoutBlockFlow {BODY} at (8,8) size 279x134
+layer at (346,97) size 148x150
+  LayoutEmbeddedObject {object} at (299.16,0) size 147.58x150 [bgcolor=#FF0000]
+    layer at (0,0) size 148x150
+      LayoutView at (0,0) size 148x150
+    layer at (0,0) size 148x150
+      LayoutBlockFlow {HTML} at (0,0) size 148x150
+        LayoutBlockFlow {BODY} at (8,8) size 132x134
+layer at (498,173) size 74x74
+  LayoutEmbeddedObject {object} at (450.73,76) size 73.78x73.78 [bgcolor=#FF0000]
     layer at (0,0) size 74x74
       LayoutView at (0,0) size 74x74
     layer at (0,0) size 74x74
@@ -82,20 +70,14 @@
         LayoutSVGHiddenContainer {defs} at (0,0) size 0x0
         LayoutSVGRect {rect} at (0,0) size 74x74 [fill={[type=SOLID] [color=#5588FF]}] [x=-3000.00] [y=-1000.00] [width=6200.00] [height=2200.00]
         LayoutSVGEllipse {circle} at (0,0) size 74x74 [fill={[type=SOLID] [color=#0000FF]}] [cx=100.00] [cy=100.00] [r=100.00]
-        LayoutSVGContainer {g} at (11,23) size 51x30
-          LayoutSVGText {text} at (32,62) size 136x80 contains 1 chunk(s)
-            LayoutSVGInlineText {#text} at (0,0) size 136x79
+        LayoutSVGContainer {g} at (11,23) size 52x30
+          LayoutSVGText {text} at (32,62) size 139x80 contains 1 chunk(s)
+            LayoutSVGInlineText {#text} at (0,0) size 138x79
               chunk 1 (middle anchor) text run 1 at (32.43,125.00) startOffset 0 endOffset 3 width 135.14: "SVG"
-layer at (576,355) size 36x37
-  LayoutEmbeddedObject {object} at (528.52,258) size 36.89x37 [bgcolor=#FF0000]
-    layer at (0,0) size 37x37
-      LayoutView at (0,0) size 37x37
-    layer at (0,0) size 37x37
-      LayoutSVGRoot {svg} at (0,0) size 37x37
-        LayoutSVGHiddenContainer {defs} at (0,0) size 0x0
-        LayoutSVGRect {rect} at (0,0) size 37x37 [fill={[type=SOLID] [color=#5588FF]}] [x=-3000.00] [y=-1000.00] [width=6200.00] [height=2200.00]
-        LayoutSVGEllipse {circle} at (0,0) size 37x37 [fill={[type=SOLID] [color=#0000FF]}] [cx=100.00] [cy=100.00] [r=100.00]
-        LayoutSVGContainer {g} at (6,11) size 24x16
-          LayoutSVGText {text} at (37,60) size 126x82 contains 1 chunk(s)
-            LayoutSVGInlineText {#text} at (0,0) size 125x82
-              chunk 1 (middle anchor) text run 1 at (37.84,125.00) startOffset 0 endOffset 3 width 124.32: "SVG"
+layer at (576,97) size 36x150
+  LayoutEmbeddedObject {object} at (528.52,0) size 36.89x150 [bgcolor=#FF0000]
+    layer at (0,0) size 37x150
+      LayoutView at (0,0) size 37x150
+    layer at (0,0) size 37x150
+      LayoutBlockFlow {HTML} at (0,0) size 37x150
+        LayoutBlockFlow {BODY} at (8,8) size 21x134

diff --git a/third_party/WebKit/LayoutTests/platform/linux/virtual/gpu-rasterization/fast/images/jpeg-yuv-progressive-image-expected.png b/third_party/WebKit/LayoutTests/platform/linux/virtual/gpu-rasterization/fast/images/jpeg-yuv-progressive-image-expected.png
index 6801b665..38f2b27 100644
--- a/third_party/WebKit/LayoutTests/platform/linux/virtual/gpu-rasterization/fast/images/jpeg-yuv-progressive-image-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/linux/virtual/gpu-rasterization/fast/images/jpeg-yuv-progressive-image-expected.png
Binary files differ

diff --git a/third_party/WebKit/LayoutTests/platform/mac-mac10.10/fast/forms/textarea/basic-textareas-expected.png b/third_party/WebKit/LayoutTests/platform/mac-mac10.10/fast/forms/textarea/basic-textareas-expected.png
index d50c95f3..6838d740 100644
--- a/third_party/WebKit/LayoutTests/platform/mac-mac10.10/fast/forms/textarea/basic-textareas-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/mac-mac10.10/fast/forms/textarea/basic-textareas-expected.png
Binary files differ

diff --git a/third_party/WebKit/LayoutTests/platform/mac-mac10.10/fast/forms/textarea/basic-textareas-expected.txt b/third_party/WebKit/LayoutTests/platform/mac-mac10.10/fast/forms/textarea/basic-textareas-expected.txt
index c735b598..c0f9d006 100644
--- a/third_party/WebKit/LayoutTests/platform/mac-mac10.10/fast/forms/textarea/basic-textareas-expected.txt
+++ b/third_party/WebKit/LayoutTests/platform/mac-mac10.10/fast/forms/textarea/basic-textareas-expected.txt

@@ -278,17 +278,17 @@
     layer at (144,192) size 66x32 clip at (145,193) size 49x30 scrollHeight 147
       LayoutTextControl {TEXTAREA} at (1,29) size 66x32 [bgcolor=#FFFFFF] [border: (1px solid #000000)]
         LayoutBlockFlow {DIV} at (3,3) size 45x143
-          LayoutText {#text} at (0,0) size 45x143
+          LayoutText {#text} at (0,0) size 44x143
             text run at (0,0) width 32: "Lorem"
             text run at (31,0) width 4: " "
             text run at (0,13) width 31: "ipsum"
             text run at (30,13) width 7: "  "
             text run at (0,26) width 26: "dolor"
             text run at (25,26) width 4: " "
-            text run at (0,39) width 45: "ABCDEF"
+            text run at (0,39) width 44: "ABCDEF"
             text run at (0,52) width 39: "GHIJKL"
-            text run at (0,65) width 43: "MNOPQ"
-            text run at (0,78) width 37: "RSTUV"
+            text run at (0,65) width 42: "MNOPQ"
+            text run at (0,78) width 36: "RSTUV"
             text run at (0,91) width 32: "WXYZ"
             text run at (31,91) width 4: " "
             text run at (0,104) width 41: "abcdefg"
@@ -297,17 +297,17 @@
     layer at (226,156) size 102x68 clip at (227,157) size 85x66 scrollHeight 183
       LayoutTextControl {TEXTAREA} at (1,43) size 102x68 [bgcolor=#FFFFFF] [border: (1px solid #000000)]
         LayoutBlockFlow {DIV} at (21,21) size 45x143
-          LayoutText {#text} at (0,0) size 45x143
+          LayoutText {#text} at (0,0) size 44x143
             text run at (0,0) width 32: "Lorem"
             text run at (31,0) width 4: " "
             text run at (0,13) width 31: "ipsum"
             text run at (30,13) width 7: "  "
             text run at (0,26) width 26: "dolor"
             text run at (25,26) width 4: " "
-            text run at (0,39) width 45: "ABCDEF"
+            text run at (0,39) width 44: "ABCDEF"
             text run at (0,52) width 39: "GHIJKL"
-            text run at (0,65) width 43: "MNOPQ"
-            text run at (0,78) width 37: "RSTUV"
+            text run at (0,65) width 42: "MNOPQ"
+            text run at (0,78) width 36: "RSTUV"
             text run at (0,91) width 32: "WXYZ"
             text run at (31,91) width 4: " "
             text run at (0,104) width 41: "abcdefg"
@@ -316,17 +316,17 @@
     layer at (330,196) size 62x28 clip at (331,197) size 45x26 scrollHeight 143
       LayoutTextControl {TEXTAREA} at (1,43) size 62x28 [bgcolor=#FFFFFF] [border: (1px solid #000000)]
         LayoutBlockFlow {DIV} at (1,1) size 45x143
-          LayoutText {#text} at (0,0) size 45x143
+          LayoutText {#text} at (0,0) size 44x143
             text run at (0,0) width 32: "Lorem"
             text run at (31,0) width 4: " "
             text run at (0,13) width 31: "ipsum"
             text run at (30,13) width 7: "  "
             text run at (0,26) width 26: "dolor"
             text run at (25,26) width 4: " "
-            text run at (0,39) width 45: "ABCDEF"
+            text run at (0,39) width 44: "ABCDEF"
             text run at (0,52) width 39: "GHIJKL"
-            text run at (0,65) width 43: "MNOPQ"
-            text run at (0,78) width 37: "RSTUV"
+            text run at (0,65) width 42: "MNOPQ"
+            text run at (0,78) width 36: "RSTUV"
             text run at (0,91) width 32: "WXYZ"
             text run at (31,91) width 4: " "
             text run at (0,104) width 41: "abcdefg"
@@ -345,17 +345,17 @@
     layer at (555,158) size 66x66 clip at (556,159) size 49x64 scrollHeight 147
       LayoutTextControl {TEXTAREA} at (1,43) size 66x66 [bgcolor=#FFFFFF] [border: (1px solid #000000)]
         LayoutBlockFlow {DIV} at (3,3) size 45x143
-          LayoutText {#text} at (0,0) size 45x143
+          LayoutText {#text} at (0,0) size 44x143
             text run at (0,0) width 32: "Lorem"
             text run at (31,0) width 4: " "
             text run at (0,13) width 31: "ipsum"
             text run at (30,13) width 7: "  "
             text run at (0,26) width 26: "dolor"
             text run at (25,26) width 4: " "
-            text run at (0,39) width 45: "ABCDEF"
+            text run at (0,39) width 44: "ABCDEF"
             text run at (0,52) width 39: "GHIJKL"
-            text run at (0,65) width 43: "MNOPQ"
-            text run at (0,78) width 37: "RSTUV"
+            text run at (0,65) width 42: "MNOPQ"
+            text run at (0,78) width 36: "RSTUV"
             text run at (0,91) width 32: "WXYZ"
             text run at (31,91) width 4: " "
             text run at (0,104) width 41: "abcdefg"
@@ -382,10 +382,10 @@
             text run at (75,26) width 5: " "
             text run at (0,39) width 115: "abcdefghijklmnopqrstu"
             text run at (0,52) width 6: "v"
-    layer at (144,285) size 66x66 clip at (145,286) size 64x64 scrollHeight 134
+    layer at (144,285) size 66x66 clip at (145,286) size 64x64 scrollHeight 121
       LayoutTextControl {TEXTAREA} at (1,57) size 66x66 [bgcolor=#FFFFFF] [border: (1px solid #000000)]
-        LayoutBlockFlow {DIV} at (3,3) size 60x130
-          LayoutText {#text} at (0,0) size 58x130
+        LayoutBlockFlow {DIV} at (3,3) size 60x117
+          LayoutText {#text} at (0,0) size 60x117
             text run at (0,0) width 32: "Lorem"
             text run at (31,0) width 4: " "
             text run at (0,13) width 31: "ipsum"
@@ -397,23 +397,22 @@
             text run at (0,65) width 52: "PQRSTUV"
             text run at (0,78) width 32: "WXYZ"
             text run at (31,78) width 4: " "
-            text run at (0,91) width 58: "abcdefghijk"
-            text run at (0,104) width 57: "lmnopqrstu"
-            text run at (0,117) width 6: "v"
+            text run at (0,91) width 60: "abcdefghijkl"
+            text run at (0,104) width 60: "mnopqrstuv"
     layer at (226,285) size 66x66 clip at (227,286) size 49x49 scrollHeight 147
       LayoutTextControl {TEXTAREA} at (1,57) size 66x66 [bgcolor=#FFFFFF] [border: (1px solid #000000)]
         LayoutBlockFlow {DIV} at (3,3) size 45x143
-          LayoutText {#text} at (0,0) size 45x143
+          LayoutText {#text} at (0,0) size 44x143
             text run at (0,0) width 32: "Lorem"
             text run at (31,0) width 4: " "
             text run at (0,13) width 31: "ipsum"
             text run at (30,13) width 7: "  "
             text run at (0,26) width 26: "dolor"
             text run at (25,26) width 4: " "
-            text run at (0,39) width 45: "ABCDEF"
+            text run at (0,39) width 44: "ABCDEF"
             text run at (0,52) width 39: "GHIJKL"
-            text run at (0,65) width 43: "MNOPQ"
-            text run at (0,78) width 37: "RSTUV"
+            text run at (0,65) width 42: "MNOPQ"
+            text run at (0,78) width 36: "RSTUV"
             text run at (0,91) width 32: "WXYZ"
             text run at (31,91) width 4: " "
             text run at (0,104) width 41: "abcdefg"
@@ -422,17 +421,17 @@
     layer at (308,285) size 66x66 clip at (309,286) size 49x64 scrollHeight 147
       LayoutTextControl {TEXTAREA} at (1,43) size 66x66 [bgcolor=#FFFFFF] [border: (1px solid #000000)]
         LayoutBlockFlow {DIV} at (3,3) size 45x143
-          LayoutText {#text} at (0,0) size 45x143
+          LayoutText {#text} at (0,0) size 44x143
             text run at (0,0) width 32: "Lorem"
             text run at (31,0) width 4: " "
             text run at (0,13) width 31: "ipsum"
             text run at (30,13) width 7: "  "
             text run at (0,26) width 26: "dolor"
             text run at (25,26) width 4: " "
-            text run at (0,39) width 45: "ABCDEF"
+            text run at (0,39) width 44: "ABCDEF"
             text run at (0,52) width 39: "GHIJKL"
-            text run at (0,65) width 43: "MNOPQ"
-            text run at (0,78) width 37: "RSTUV"
+            text run at (0,65) width 42: "MNOPQ"
+            text run at (0,78) width 36: "RSTUV"
             text run at (0,91) width 32: "WXYZ"
             text run at (31,91) width 4: " "
             text run at (0,104) width 41: "abcdefg"
@@ -441,17 +440,17 @@
     layer at (390,285) size 66x66 clip at (391,286) size 49x64 scrollHeight 147
       LayoutTextControl {TEXTAREA} at (1,43) size 66x66 [bgcolor=#FFFFFF] [border: (1px solid #000000)]
         LayoutBlockFlow {DIV} at (3,3) size 45x143
-          LayoutText {#text} at (0,0) size 45x143
+          LayoutText {#text} at (0,0) size 44x143
             text run at (0,0) width 32: "Lorem"
             text run at (31,0) width 4: " "
             text run at (0,13) width 31: "ipsum"
             text run at (30,13) width 7: "  "
             text run at (0,26) width 26: "dolor"
             text run at (25,26) width 4: " "
-            text run at (0,39) width 45: "ABCDEF"
+            text run at (0,39) width 44: "ABCDEF"
             text run at (0,52) width 39: "GHIJKL"
-            text run at (0,65) width 43: "MNOPQ"
-            text run at (0,78) width 37: "RSTUV"
+            text run at (0,65) width 42: "MNOPQ"
+            text run at (0,78) width 36: "RSTUV"
             text run at (0,91) width 32: "WXYZ"
             text run at (31,91) width 4: " "
             text run at (0,104) width 41: "abcdefg"
@@ -460,27 +459,27 @@
     layer at (472,285) size 66x66 clip at (473,286) size 49x64 scrollHeight 147
       LayoutTextControl {TEXTAREA} at (1,57) size 66x66 [bgcolor=#FFFFFF] [border: (1px solid #000000)]
         LayoutBlockFlow {DIV} at (3,3) size 45x143
-          LayoutText {#text} at (0,0) size 45x143
+          LayoutText {#text} at (0,0) size 44x143
             text run at (0,0) width 32: "Lorem"
             text run at (31,0) width 4: " "
             text run at (0,13) width 31: "ipsum"
             text run at (30,13) width 7: "  "
             text run at (0,26) width 26: "dolor"
             text run at (25,26) width 4: " "
-            text run at (0,39) width 45: "ABCDEF"
+            text run at (0,39) width 44: "ABCDEF"
             text run at (0,52) width 39: "GHIJKL"
-            text run at (0,65) width 43: "MNOPQ"
-            text run at (0,78) width 37: "RSTUV"
+            text run at (0,65) width 42: "MNOPQ"
+            text run at (0,78) width 36: "RSTUV"
             text run at (0,91) width 32: "WXYZ"
             text run at (31,91) width 4: " "
             text run at (0,104) width 41: "abcdefg"
             text run at (0,117) width 42: "hijklmno"
             text run at (0,130) width 38: "pqrstuv"
-    layer at (554,319) size 39x32 clip at (555,320) size 22x30 scrollHeight 381
+    layer at (554,319) size 39x32 clip at (555,320) size 22x30 scrollHeight 368
       LayoutTextControl {TEXTAREA} at (1,15) size 39x32 [bgcolor=#FFFFFF] [border: (1px solid #000000)]
-        LayoutBlockFlow {DIV} at (3,3) size 18x377
-          LayoutText {#text} at (0,0) size 18x377
-            text run at (0,0) width 17: "Lor"
+        LayoutBlockFlow {DIV} at (3,3) size 18x364
+          LayoutText {#text} at (0,0) size 18x364
+            text run at (0,0) width 16: "Lor"
             text run at (0,13) width 16: "em"
             text run at (15,13) width 3: " "
             text run at (0,26) width 15: "ips"
@@ -491,27 +490,26 @@
             text run at (10,78) width 4: " "
             text run at (0,91) width 15: "AB"
             text run at (0,104) width 16: "CD"
-            text run at (0,117) width 14: "EF"
+            text run at (0,117) width 13: "EF"
             text run at (0,130) width 17: "GH"
-            text run at (0,143) width 17: "IJK"
+            text run at (0,143) width 16: "IJK"
             text run at (0,156) width 16: "LM"
             text run at (0,169) width 17: "NO"
             text run at (0,182) width 16: "PQ"
             text run at (0,195) width 15: "RS"
-            text run at (0,208) width 15: "TU"
-            text run at (0,221) width 18: "VW"
-            text run at (0,234) width 15: "XY"
+            text run at (0,208) width 14: "TU"
+            text run at (0,221) width 17: "VW"
+            text run at (0,234) width 14: "XY"
             text run at (0,247) width 7: "Z"
             text run at (6,247) width 4: " "
             text run at (0,260) width 13: "ab"
             text run at (0,273) width 13: "cd"
             text run at (0,286) width 16: "efg"
             text run at (0,299) width 17: "hijk"
-            text run at (0,312) width 13: "lm"
-            text run at (0,325) width 13: "no"
-            text run at (0,338) width 17: "pqr"
-            text run at (0,351) width 16: "stu"
-            text run at (0,364) width 6: "v"
+            text run at (0,312) width 18: "lmn"
+            text run at (0,325) width 13: "op"
+            text run at (0,338) width 16: "qrs"
+            text run at (0,351) width 16: "tuv"
     layer at (636,306) size 141x45 clip at (637,307) size 124x43 scrollHeight 69
       LayoutTextControl {TEXTAREA} at (1,15) size 141x45 [bgcolor=#FFFFFF] [border: (1px solid #000000)]
         LayoutBlockFlow {DIV} at (3,3) size 120x65
@@ -534,7 +532,7 @@
             text run at (0,26) width 26: "dolor"
             text run at (25,26) width 4: " "
             text run at (0,39) width 38: "ABCDE"
-            text run at (0,52) width 40: "FGHIJK"
+            text run at (0,52) width 39: "FGHIJK"
             text run at (0,65) width 40: "LMNOP"
             text run at (0,78) width 38: "QRSTU"
             text run at (0,91) width 39: "VWXYZ"
@@ -556,28 +554,27 @@
       LayoutTextControl {TEXTAREA} at (1,29) size 51x58 [bgcolor=#FFFFFF] [border: (1px solid #000000)]
         LayoutBlockFlow {DIV} at (3,3) size 30x234
           LayoutText {#text} at (0,0) size 30x234
-            text run at (0,0) width 23: "Lore"
+            text run at (0,0) width 22: "Lore"
             text run at (0,13) width 10: "m"
             text run at (9,13) width 4: " "
-            text run at (0,26) width 21: "ipsu"
-            text run at (0,39) width 10: "m"
-            text run at (9,39) width 7: "  "
+            text run at (0,26) width 30: "ipsum"
+            text run at (0,39) width 7: "  "
             text run at (0,52) width 26: "dolor"
             text run at (25,52) width 4: " "
             text run at (0,65) width 23: "ABC"
             text run at (0,78) width 30: "DEFG"
-            text run at (0,91) width 25: "HIJK"
-            text run at (0,104) width 25: "LMN"
-            text run at (0,117) width 25: "OPQ"
-            text run at (0,130) width 30: "RSTU"
-            text run at (0,143) width 24: "VWX"
-            text run at (0,156) width 15: "YZ"
-            text run at (14,156) width 4: " "
-            text run at (0,169) width 26: "abcd"
+            text run at (0,91) width 30: "HIJKL"
+            text run at (0,104) width 26: "MNO"
+            text run at (0,117) width 23: "PQR"
+            text run at (0,130) width 29: "STUV"
+            text run at (0,143) width 24: "WXY"
+            text run at (0,156) width 7: "Z"
+            text run at (6,156) width 4: " "
+            text run at (0,169) width 25: "abcd"
             text run at (0,182) width 27: "efghij"
-            text run at (0,195) width 25: "klmn"
-            text run at (0,208) width 29: "opqrs"
-            text run at (0,221) width 16: "tuv"
+            text run at (0,195) width 30: "klmno"
+            text run at (0,208) width 26: "pqrst"
+            text run at (0,221) width 12: "uv"
     layer at (308,420) size 141x47 clip at (309,421) size 139x30 scrollWidth 418
       LayoutTextControl {TEXTAREA} at (1,15) size 141x47 [bgcolor=#FFFFFF] [border: (1px solid #000000)]
         LayoutBlockFlow {DIV} at (3,3) size 135x13
@@ -946,14 +943,14 @@
             text run at (0,26) width 26: "dolor"
             text run at (25,26) width 4: " "
             text run at (0,39) width 38: "ABCDE"
-            text run at (0,52) width 32: "FGHIJ"
-            text run at (0,65) width 32: "KLMN"
-            text run at (0,78) width 32: "OPQR"
-            text run at (0,91) width 39: "STUVW"
-            text run at (0,104) width 21: "XYZ"
-            text run at (20,104) width 4: " "
+            text run at (0,52) width 39: "FGHIJK"
+            text run at (0,65) width 33: "LMNO"
+            text run at (0,78) width 37: "PQRST"
+            text run at (0,91) width 39: "UVWXY"
+            text run at (0,104) width 7: "Z"
+            text run at (6,104) width 4: " "
             text run at (0,117) width 35: "abcdef"
-            text run at (0,130) width 36: "ghijklm"
+            text run at (0,130) width 35: "ghijklm"
             text run at (0,143) width 39: "nopqrst"
             text run at (0,156) width 12: "uv"
     layer at (226,153) size 60x68 clip at (227,154) size 43x66 scrollHeight 924
@@ -966,7 +963,7 @@
             text run at (0,39) width 6: "e"
             text run at (0,52) width 10: "m"
             text run at (0,65) width 3: " "
-            text run at (0,78) width 3: "i"
+            text run at (0,78) width 2: "i"
             text run at (0,91) width 7: "p"
             text run at (0,104) width 6: "s"
             text run at (0,117) width 7: "u"
@@ -975,7 +972,7 @@
             text run at (0,156) width 3: " "
             text run at (0,169) width 7: "d"
             text run at (0,182) width 7: "o"
-            text run at (0,195) width 3: "l"
+            text run at (0,195) width 2: "l"
             text run at (0,208) width 7: "o"
             text run at (0,221) width 4: "r"
             text run at (0,234) width 3: " "
@@ -1011,13 +1008,13 @@
             text run at (0,624) width 6: "c"
             text run at (0,637) width 7: "d"
             text run at (0,650) width 6: "e"
-            text run at (0,663) width 4: "f"
+            text run at (0,663) width 3: "f"
             text run at (0,676) width 7: "g"
             text run at (0,689) width 7: "h"
-            text run at (0,702) width 3: "i"
-            text run at (0,715) width 3: "j"
+            text run at (0,702) width 2: "i"
+            text run at (0,715) width 2: "j"
             text run at (0,728) width 6: "k"
-            text run at (0,741) width 3: "l"
+            text run at (0,741) width 2: "l"
             text run at (0,754) width 10: "m"
             text run at (0,767) width 7: "n"
             text run at (0,780) width 7: "o"
@@ -1039,7 +1036,7 @@
             text run at (0,26) width 26: "dolor"
             text run at (25,26) width 4: " "
             text run at (0,39) width 38: "ABCDE"
-            text run at (0,52) width 40: "FGHIJK"
+            text run at (0,52) width 39: "FGHIJK"
             text run at (0,65) width 40: "LMNOP"
             text run at (0,78) width 38: "QRSTU"
             text run at (0,91) width 39: "VWXYZ"
@@ -1068,14 +1065,14 @@
             text run at (0,26) width 26: "dolor"
             text run at (25,26) width 4: " "
             text run at (0,39) width 38: "ABCDE"
-            text run at (0,52) width 32: "FGHIJ"
-            text run at (0,65) width 32: "KLMN"
-            text run at (0,78) width 32: "OPQR"
-            text run at (0,91) width 39: "STUVW"
-            text run at (0,104) width 21: "XYZ"
-            text run at (20,104) width 4: " "
+            text run at (0,52) width 39: "FGHIJK"
+            text run at (0,65) width 33: "LMNO"
+            text run at (0,78) width 37: "PQRST"
+            text run at (0,91) width 39: "UVWXY"
+            text run at (0,104) width 7: "Z"
+            text run at (6,104) width 4: " "
             text run at (0,117) width 35: "abcdef"
-            text run at (0,130) width 36: "ghijklm"
+            text run at (0,130) width 35: "ghijklm"
             text run at (0,143) width 39: "nopqrst"
             text run at (0,156) width 12: "uv"
     layer at (615,189) size 141x32 clip at (616,190) size 139x30 scrollHeight 56
@@ -1110,12 +1107,12 @@
             text run at (0,26) width 26: "dolor"
             text run at (25,26) width 4: " "
             text run at (0,39) width 53: "ABCDEFG"
-            text run at (0,52) width 49: "HIJKLMN"
+            text run at (0,52) width 48: "HIJKLMN"
             text run at (0,65) width 54: "OPQRSTU"
             text run at (0,78) width 39: "VWXYZ"
             text run at (38,78) width 4: " "
-            text run at (0,91) width 53: "abcdefghij"
-            text run at (0,104) width 54: "klmnopqrs"
+            text run at (0,91) width 52: "abcdefghij"
+            text run at (0,104) width 53: "klmnopqrs"
             text run at (0,117) width 16: "tuv"
     layer at (226,279) size 60x60 clip at (227,280) size 43x43 scrollHeight 173
       LayoutTextControl {TEXTAREA} at (1,57) size 60x60 [bgcolor=#FFFFFF] [border: (1px solid #000000)]
@@ -1128,14 +1125,14 @@
             text run at (0,26) width 26: "dolor"
             text run at (25,26) width 4: " "
             text run at (0,39) width 38: "ABCDE"
-            text run at (0,52) width 32: "FGHIJ"
-            text run at (0,65) width 32: "KLMN"
-            text run at (0,78) width 32: "OPQR"
-            text run at (0,91) width 39: "STUVW"
-            text run at (0,104) width 21: "XYZ"
-            text run at (20,104) width 4: " "
+            text run at (0,52) width 39: "FGHIJK"
+            text run at (0,65) width 33: "LMNO"
+            text run at (0,78) width 37: "PQRST"
+            text run at (0,91) width 39: "UVWXY"
+            text run at (0,104) width 7: "Z"
+            text run at (6,104) width 4: " "
             text run at (0,117) width 35: "abcdef"
-            text run at (0,130) width 36: "ghijklm"
+            text run at (0,130) width 35: "ghijklm"
             text run at (0,143) width 39: "nopqrst"
             text run at (0,156) width 12: "uv"
     layer at (308,279) size 60x60 clip at (309,280) size 43x58 scrollHeight 173
@@ -1149,14 +1146,14 @@
             text run at (0,26) width 26: "dolor"
             text run at (25,26) width 4: " "
             text run at (0,39) width 38: "ABCDE"
-            text run at (0,52) width 32: "FGHIJ"
-            text run at (0,65) width 32: "KLMN"
-            text run at (0,78) width 32: "OPQR"
-            text run at (0,91) width 39: "STUVW"
-            text run at (0,104) width 21: "XYZ"
-            text run at (20,104) width 4: " "
+            text run at (0,52) width 39: "FGHIJK"
+            text run at (0,65) width 33: "LMNO"
+            text run at (0,78) width 37: "PQRST"
+            text run at (0,91) width 39: "UVWXY"
+            text run at (0,104) width 7: "Z"
+            text run at (6,104) width 4: " "
             text run at (0,117) width 35: "abcdef"
-            text run at (0,130) width 36: "ghijklm"
+            text run at (0,130) width 35: "ghijklm"
             text run at (0,143) width 39: "nopqrst"
             text run at (0,156) width 12: "uv"
     layer at (390,279) size 60x60 clip at (391,280) size 43x58 scrollHeight 173
@@ -1170,14 +1167,14 @@
             text run at (0,26) width 26: "dolor"
             text run at (25,26) width 4: " "
             text run at (0,39) width 38: "ABCDE"
-            text run at (0,52) width 32: "FGHIJ"
-            text run at (0,65) width 32: "KLMN"
-            text run at (0,78) width 32: "OPQR"
-            text run at (0,91) width 39: "STUVW"
-            text run at (0,104) width 21: "XYZ"
-            text run at (20,104) width 4: " "
+            text run at (0,52) width 39: "FGHIJK"
+            text run at (0,65) width 33: "LMNO"
+            text run at (0,78) width 37: "PQRST"
+            text run at (0,91) width 39: "UVWXY"
+            text run at (0,104) width 7: "Z"
+            text run at (6,104) width 4: " "
             text run at (0,117) width 35: "abcdef"
-            text run at (0,130) width 36: "ghijklm"
+            text run at (0,130) width 35: "ghijklm"
             text run at (0,143) width 39: "nopqrst"
             text run at (0,156) width 12: "uv"
     layer at (472,279) size 60x60 clip at (473,280) size 43x58 scrollHeight 173
@@ -1191,21 +1188,21 @@
             text run at (0,26) width 26: "dolor"
             text run at (25,26) width 4: " "
             text run at (0,39) width 38: "ABCDE"
-            text run at (0,52) width 32: "FGHIJ"
-            text run at (0,65) width 32: "KLMN"
-            text run at (0,78) width 32: "OPQR"
-            text run at (0,91) width 39: "STUVW"
-            text run at (0,104) width 21: "XYZ"
-            text run at (20,104) width 4: " "
+            text run at (0,52) width 39: "FGHIJK"
+            text run at (0,65) width 33: "LMNO"
+            text run at (0,78) width 37: "PQRST"
+            text run at (0,91) width 39: "UVWXY"
+            text run at (0,104) width 7: "Z"
+            text run at (6,104) width 4: " "
             text run at (0,117) width 35: "abcdef"
-            text run at (0,130) width 36: "ghijklm"
+            text run at (0,130) width 35: "ghijklm"
             text run at (0,143) width 39: "nopqrst"
             text run at (0,156) width 12: "uv"
-    layer at (554,307) size 39x32 clip at (555,308) size 22x30 scrollHeight 381
+    layer at (554,307) size 39x32 clip at (555,308) size 22x30 scrollHeight 368
       LayoutTextControl {TEXTAREA} at (1,15) size 39x32 [bgcolor=#FFFFFF] [border: (1px solid #000000)]
-        LayoutBlockFlow {DIV} at (3,3) size 18x377
-          LayoutText {#text} at (0,0) size 18x377
-            text run at (0,0) width 17: "Lor"
+        LayoutBlockFlow {DIV} at (3,3) size 18x364
+          LayoutText {#text} at (0,0) size 18x364
+            text run at (0,0) width 16: "Lor"
             text run at (0,13) width 16: "em"
             text run at (15,13) width 3: " "
             text run at (0,26) width 15: "ips"
@@ -1216,27 +1213,26 @@
             text run at (10,78) width 4: " "
             text run at (0,91) width 15: "AB"
             text run at (0,104) width 16: "CD"
-            text run at (0,117) width 14: "EF"
+            text run at (0,117) width 13: "EF"
             text run at (0,130) width 17: "GH"
-            text run at (0,143) width 17: "IJK"
+            text run at (0,143) width 16: "IJK"
             text run at (0,156) width 16: "LM"
             text run at (0,169) width 17: "NO"
             text run at (0,182) width 16: "PQ"
             text run at (0,195) width 15: "RS"
-            text run at (0,208) width 15: "TU"
-            text run at (0,221) width 18: "VW"
-            text run at (0,234) width 15: "XY"
+            text run at (0,208) width 14: "TU"
+            text run at (0,221) width 17: "VW"
+            text run at (0,234) width 14: "XY"
             text run at (0,247) width 7: "Z"
             text run at (6,247) width 4: " "
             text run at (0,260) width 13: "ab"
             text run at (0,273) width 13: "cd"
             text run at (0,286) width 16: "efg"
             text run at (0,299) width 17: "hijk"
-            text run at (0,312) width 13: "lm"
-            text run at (0,325) width 13: "no"
-            text run at (0,338) width 17: "pqr"
-            text run at (0,351) width 16: "stu"
-            text run at (0,364) width 6: "v"
+            text run at (0,312) width 18: "lmn"
+            text run at (0,325) width 13: "op"
+            text run at (0,338) width 16: "qrs"
+            text run at (0,351) width 16: "tuv"
     layer at (636,294) size 141x45 clip at (637,295) size 124x43 scrollHeight 69
       LayoutTextControl {TEXTAREA} at (1,15) size 141x45 [bgcolor=#FFFFFF] [border: (1px solid #000000)]
         LayoutBlockFlow {DIV} at (3,3) size 120x65
@@ -1259,7 +1255,7 @@
             text run at (0,26) width 26: "dolor"
             text run at (25,26) width 4: " "
             text run at (0,39) width 38: "ABCDE"
-            text run at (0,52) width 40: "FGHIJK"
+            text run at (0,52) width 39: "FGHIJK"
             text run at (0,65) width 40: "LMNOP"
             text run at (0,78) width 38: "QRSTU"
             text run at (0,91) width 39: "VWXYZ"
@@ -1281,28 +1277,27 @@
       LayoutTextControl {TEXTAREA} at (1,29) size 51x58 [bgcolor=#FFFFFF] [border: (1px solid #000000)]
         LayoutBlockFlow {DIV} at (3,3) size 30x234
           LayoutText {#text} at (0,0) size 30x234
-            text run at (0,0) width 23: "Lore"
+            text run at (0,0) width 22: "Lore"
             text run at (0,13) width 10: "m"
             text run at (9,13) width 4: " "
-            text run at (0,26) width 21: "ipsu"
-            text run at (0,39) width 10: "m"
-            text run at (9,39) width 7: "  "
+            text run at (0,26) width 30: "ipsum"
+            text run at (0,39) width 7: "  "
             text run at (0,52) width 26: "dolor"
             text run at (25,52) width 4: " "
             text run at (0,65) width 23: "ABC"
             text run at (0,78) width 30: "DEFG"
-            text run at (0,91) width 25: "HIJK"
-            text run at (0,104) width 25: "LMN"
-            text run at (0,117) width 25: "OPQ"
-            text run at (0,130) width 30: "RSTU"
-            text run at (0,143) width 24: "VWX"
-            text run at (0,156) width 15: "YZ"
-            text run at (14,156) width 4: " "
-            text run at (0,169) width 26: "abcd"
+            text run at (0,91) width 30: "HIJKL"
+            text run at (0,104) width 26: "MNO"
+            text run at (0,117) width 23: "PQR"
+            text run at (0,130) width 29: "STUV"
+            text run at (0,143) width 24: "WXY"
+            text run at (0,156) width 7: "Z"
+            text run at (6,156) width 4: " "
+            text run at (0,169) width 25: "abcd"
             text run at (0,182) width 27: "efghij"
-            text run at (0,195) width 25: "klmn"
-            text run at (0,208) width 29: "opqrs"
-            text run at (0,221) width 16: "tuv"
+            text run at (0,195) width 30: "klmno"
+            text run at (0,208) width 26: "pqrst"
+            text run at (0,221) width 12: "uv"
     layer at (308,405) size 141x47 clip at (309,406) size 139x30 scrollWidth 418
       LayoutTextControl {TEXTAREA} at (1,15) size 141x47 [bgcolor=#FFFFFF] [border: (1px solid #000000)]
         LayoutBlockFlow {DIV} at (3,3) size 135x13

diff --git a/third_party/WebKit/LayoutTests/platform/mac-mac10.10/fast/forms/textarea/basic-textareas-quirks-expected.png b/third_party/WebKit/LayoutTests/platform/mac-mac10.10/fast/forms/textarea/basic-textareas-quirks-expected.png
index 2164a72..a7bf90c 100644
--- a/third_party/WebKit/LayoutTests/platform/mac-mac10.10/fast/forms/textarea/basic-textareas-quirks-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/mac-mac10.10/fast/forms/textarea/basic-textareas-quirks-expected.png
Binary files differ

diff --git a/third_party/WebKit/LayoutTests/platform/mac-mac10.10/fast/forms/textarea/basic-textareas-quirks-expected.txt b/third_party/WebKit/LayoutTests/platform/mac-mac10.10/fast/forms/textarea/basic-textareas-quirks-expected.txt
index 76baffc..ec58b58 100644
--- a/third_party/WebKit/LayoutTests/platform/mac-mac10.10/fast/forms/textarea/basic-textareas-quirks-expected.txt
+++ b/third_party/WebKit/LayoutTests/platform/mac-mac10.10/fast/forms/textarea/basic-textareas-quirks-expected.txt

@@ -305,7 +305,7 @@
   LayoutTextControl {TEXTAREA} at (14.61,1) size 39x32 [bgcolor=#FFFFFF] [border: (1px solid #000000)]
     LayoutBlockFlow {DIV} at (3,3) size 18x364
       LayoutText {#text} at (0,0) size 18x364
-        text run at (0,0) width 17: "Lor"
+        text run at (0,0) width 16: "Lor"
         text run at (0,13) width 16: "em"
         text run at (15,13) width 3: " "
         text run at (0,26) width 15: "ips"
@@ -316,28 +316,27 @@
         text run at (10,65) width 4: " "
         text run at (0,78) width 15: "AB"
         text run at (0,91) width 16: "CD"
-        text run at (0,104) width 14: "EF"
+        text run at (0,104) width 13: "EF"
         text run at (0,117) width 17: "GH"
-        text run at (0,130) width 17: "IJK"
+        text run at (0,130) width 16: "IJK"
         text run at (0,143) width 16: "LM"
         text run at (0,156) width 17: "NO"
         text run at (0,169) width 16: "PQ"
         text run at (0,182) width 15: "RS"
-        text run at (0,195) width 15: "TU"
-        text run at (0,208) width 18: "VW"
-        text run at (0,221) width 15: "XY"
+        text run at (0,195) width 14: "TU"
+        text run at (0,208) width 17: "VW"
+        text run at (0,221) width 14: "XY"
         text run at (0,234) width 7: "Z"
         text run at (6,234) width 4: " "
         text run at (0,247) width 13: "ab"
         text run at (0,260) width 13: "cd"
         text run at (0,273) width 16: "efg"
         text run at (0,286) width 17: "hijk"
-        text run at (0,299) width 13: "lm"
-        text run at (0,312) width 13: "no"
-        text run at (0,325) width 17: "pqr"
-        text run at (0,338) width 16: "stu"
-        text run at (0,351) width 6: "v"
-        text run at (5,351) width 4: " "
+        text run at (0,299) width 18: "lmn"
+        text run at (0,312) width 13: "op"
+        text run at (0,325) width 16: "qrs"
+        text run at (0,338) width 16: "tuv"
+        text run at (0,351) width 4: " "
 layer at (24,464) size 141x45 clip at (25,465) size 124x43 scrollHeight 69
   LayoutTextControl {TEXTAREA} at (14.61,1) size 141x45 [bgcolor=#FFFFFF] [border: (1px solid #000000)]
     LayoutBlockFlow {DIV} at (3,3) size 120x65
@@ -363,10 +362,9 @@
         text run at (0,52) width 52: "PQRSTUV"
         text run at (0,65) width 32: "WXYZ"
         text run at (31,65) width 4: " "
-        text run at (0,78) width 58: "abcdefghijk"
-        text run at (0,91) width 57: "lmnopqrstu"
-        text run at (0,104) width 6: "v"
-        text run at (5,104) width 4: " "
+        text run at (0,78) width 60: "abcdefghijkl"
+        text run at (0,91) width 60: "mnopqrstuv"
+        text run at (0,104) width 4: " "
 layer at (24,579) size 141x136 backgroundClip at (24,579) size 141x21 clip at (25,580) size 139x20
   LayoutTextControl {TEXTAREA} at (14.61,1) size 141x136 [bgcolor=#FFFFFF] [border: (1px solid #000000)]
     LayoutBlockFlow {DIV} at (3,3) size 135x52
@@ -378,33 +376,31 @@
         text run at (59,26) width 4: " "
         text run at (0,39) width 121: "abcdefghijklmnopqrstuv"
         text run at (120,39) width 4: " "
-layer at (24,734) size 51x58 backgroundClip at (0,0) size 0x0 clip at (0,0) size 0x0 scrollHeight 238
+layer at (24,734) size 51x58 backgroundClip at (0,0) size 0x0 clip at (0,0) size 0x0 scrollHeight 225
   LayoutTextControl {TEXTAREA} at (14.61,1) size 51x58 [bgcolor=#FFFFFF] [border: (1px solid #000000)]
-    LayoutBlockFlow {DIV} at (3,3) size 30x234
-      LayoutText {#text} at (0,0) size 30x234
-        text run at (0,0) width 23: "Lore"
+    LayoutBlockFlow {DIV} at (3,3) size 30x221
+      LayoutText {#text} at (0,0) size 30x221
+        text run at (0,0) width 22: "Lore"
         text run at (0,13) width 10: "m"
         text run at (9,13) width 4: " "
-        text run at (0,26) width 21: "ipsu"
-        text run at (0,39) width 10: "m"
-        text run at (9,39) width 4: " "
-        text run at (0,52) width 26: "dolor"
-        text run at (25,52) width 4: " "
-        text run at (0,65) width 23: "ABC"
-        text run at (0,78) width 30: "DEFG"
-        text run at (0,91) width 25: "HIJK"
-        text run at (0,104) width 25: "LMN"
-        text run at (0,117) width 25: "OPQ"
-        text run at (0,130) width 30: "RSTU"
-        text run at (0,143) width 24: "VWX"
-        text run at (0,156) width 15: "YZ"
-        text run at (14,156) width 4: " "
-        text run at (0,169) width 26: "abcd"
-        text run at (0,182) width 27: "efghij"
-        text run at (0,195) width 25: "klmn"
-        text run at (0,208) width 29: "opqrs"
-        text run at (0,221) width 16: "tuv"
-        text run at (15,221) width 4: " "
+        text run at (0,26) width 30: "ipsum"
+        text run at (0,39) width 29: " dolor"
+        text run at (28,39) width 2: " "
+        text run at (0,52) width 23: "ABC"
+        text run at (0,65) width 30: "DEFG"
+        text run at (0,78) width 30: "HIJKL"
+        text run at (0,91) width 26: "MNO"
+        text run at (0,104) width 23: "PQR"
+        text run at (0,117) width 29: "STUV"
+        text run at (0,130) width 24: "WXY"
+        text run at (0,143) width 7: "Z"
+        text run at (6,143) width 4: " "
+        text run at (0,156) width 25: "abcd"
+        text run at (0,169) width 27: "efghij"
+        text run at (0,182) width 30: "klmno"
+        text run at (0,195) width 26: "pqrst"
+        text run at (0,208) width 12: "uv"
+        text run at (11,208) width 4: " "
 layer at (376,24) size 60x32 clip at (377,25) size 43x30 scrollHeight 173
   LayoutTextControl {TEXTAREA} at (14.61,1) size 60x32 [bgcolor=#FFFFFF] [border: (1px solid #000000)]
     LayoutBlockFlow {DIV} at (3,3) size 39x169
@@ -416,14 +412,14 @@
         text run at (0,26) width 26: "dolor"
         text run at (25,26) width 4: " "
         text run at (0,39) width 38: "ABCDE"
-        text run at (0,52) width 32: "FGHIJ"
-        text run at (0,65) width 32: "KLMN"
-        text run at (0,78) width 32: "OPQR"
-        text run at (0,91) width 39: "STUVW"
-        text run at (0,104) width 21: "XYZ"
-        text run at (20,104) width 4: " "
+        text run at (0,52) width 39: "FGHIJK"
+        text run at (0,65) width 33: "LMNO"
+        text run at (0,78) width 37: "PQRST"
+        text run at (0,91) width 39: "UVWXY"
+        text run at (0,104) width 7: "Z"
+        text run at (6,104) width 4: " "
         text run at (0,117) width 35: "abcdef"
-        text run at (0,130) width 36: "ghijklm"
+        text run at (0,130) width 35: "ghijklm"
         text run at (0,143) width 39: "nopqrst"
         text run at (0,156) width 12: "uv"
         text run at (11,156) width 4: " "
@@ -437,7 +433,7 @@
         text run at (0,39) width 6: "e"
         text run at (0,52) width 10: "m"
         text run at (0,65) width 3: " "
-        text run at (0,78) width 3: "i"
+        text run at (0,78) width 2: "i"
         text run at (0,91) width 7: "p"
         text run at (0,104) width 6: "s"
         text run at (0,117) width 7: "u"
@@ -445,7 +441,7 @@
         text run at (0,143) width 3: " "
         text run at (0,156) width 7: "d"
         text run at (0,169) width 7: "o"
-        text run at (0,182) width 3: "l"
+        text run at (0,182) width 2: "l"
         text run at (0,195) width 7: "o"
         text run at (0,208) width 4: "r"
         text run at (0,221) width 3: " "
@@ -481,13 +477,13 @@
         text run at (0,611) width 6: "c"
         text run at (0,624) width 7: "d"
         text run at (0,637) width 6: "e"
-        text run at (0,650) width 4: "f"
+        text run at (0,650) width 3: "f"
         text run at (0,663) width 7: "g"
         text run at (0,676) width 7: "h"
-        text run at (0,689) width 3: "i"
-        text run at (0,702) width 3: "j"
+        text run at (0,689) width 2: "i"
+        text run at (0,702) width 2: "j"
         text run at (0,715) width 6: "k"
-        text run at (0,728) width 3: "l"
+        text run at (0,728) width 2: "l"
         text run at (0,741) width 10: "m"
         text run at (0,754) width 7: "n"
         text run at (0,767) width 7: "o"
@@ -510,7 +506,7 @@
         text run at (0,26) width 26: "dolor"
         text run at (25,26) width 4: " "
         text run at (0,39) width 38: "ABCDE"
-        text run at (0,52) width 40: "FGHIJK"
+        text run at (0,52) width 39: "FGHIJK"
         text run at (0,65) width 40: "LMNOP"
         text run at (0,78) width 38: "QRSTU"
         text run at (0,91) width 39: "VWXYZ"
@@ -541,14 +537,14 @@
         text run at (0,26) width 26: "dolor"
         text run at (25,26) width 4: " "
         text run at (0,39) width 38: "ABCDE"
-        text run at (0,52) width 32: "FGHIJ"
-        text run at (0,65) width 32: "KLMN"
-        text run at (0,78) width 32: "OPQR"
-        text run at (0,91) width 39: "STUVW"
-        text run at (0,104) width 21: "XYZ"
-        text run at (20,104) width 4: " "
+        text run at (0,52) width 39: "FGHIJK"
+        text run at (0,65) width 33: "LMNO"
+        text run at (0,78) width 37: "PQRST"
+        text run at (0,91) width 39: "UVWXY"
+        text run at (0,104) width 7: "Z"
+        text run at (6,104) width 4: " "
         text run at (0,117) width 35: "abcdef"
-        text run at (0,130) width 36: "ghijklm"
+        text run at (0,130) width 35: "ghijklm"
         text run at (0,143) width 39: "nopqrst"
         text run at (0,156) width 12: "uv"
         text run at (11,156) width 4: " "
@@ -586,12 +582,12 @@
         text run at (0,26) width 26: "dolor"
         text run at (25,26) width 4: " "
         text run at (0,39) width 53: "ABCDEFG"
-        text run at (0,52) width 49: "HIJKLMN"
+        text run at (0,52) width 48: "HIJKLMN"
         text run at (0,65) width 54: "OPQRSTU"
         text run at (0,78) width 39: "VWXYZ"
         text run at (38,78) width 4: " "
-        text run at (0,91) width 53: "abcdefghij"
-        text run at (0,104) width 54: "klmnopqrs"
+        text run at (0,91) width 52: "abcdefghij"
+        text run at (0,104) width 53: "klmnopqrs"
         text run at (0,117) width 16: "tuv"
         text run at (15,117) width 4: " "
 layer at (376,563) size 60x60 backgroundClip at (376,563) size 60x37 clip at (377,564) size 43x36 scrollHeight 173
@@ -605,14 +601,14 @@
         text run at (0,26) width 26: "dolor"
         text run at (25,26) width 4: " "
         text run at (0,39) width 38: "ABCDE"
-        text run at (0,52) width 32: "FGHIJ"
-        text run at (0,65) width 32: "KLMN"
-        text run at (0,78) width 32: "OPQR"
-        text run at (0,91) width 39: "STUVW"
-        text run at (0,104) width 21: "XYZ"
-        text run at (20,104) width 4: " "
+        text run at (0,52) width 39: "FGHIJK"
+        text run at (0,65) width 33: "LMNO"
+        text run at (0,78) width 37: "PQRST"
+        text run at (0,91) width 39: "UVWXY"
+        text run at (0,104) width 7: "Z"
+        text run at (6,104) width 4: " "
         text run at (0,117) width 35: "abcdef"
-        text run at (0,130) width 36: "ghijklm"
+        text run at (0,130) width 35: "ghijklm"
         text run at (0,143) width 39: "nopqrst"
         text run at (0,156) width 12: "uv"
         text run at (11,156) width 4: " "
@@ -627,14 +623,14 @@
         text run at (0,26) width 26: "dolor"
         text run at (25,26) width 4: " "
         text run at (0,39) width 38: "ABCDE"
-        text run at (0,52) width 32: "FGHIJ"
-        text run at (0,65) width 32: "KLMN"
-        text run at (0,78) width 32: "OPQR"
-        text run at (0,91) width 39: "STUVW"
-        text run at (0,104) width 21: "XYZ"
-        text run at (20,104) width 4: " "
+        text run at (0,52) width 39: "FGHIJK"
+        text run at (0,65) width 33: "LMNO"
+        text run at (0,78) width 37: "PQRST"
+        text run at (0,91) width 39: "UVWXY"
+        text run at (0,104) width 7: "Z"
+        text run at (6,104) width 4: " "
         text run at (0,117) width 35: "abcdef"
-        text run at (0,130) width 36: "ghijklm"
+        text run at (0,130) width 35: "ghijklm"
         text run at (0,143) width 39: "nopqrst"
         text run at (0,156) width 12: "uv"
         text run at (11,156) width 4: " "
@@ -649,14 +645,14 @@
         text run at (0,26) width 26: "dolor"
         text run at (25,26) width 4: " "
         text run at (0,39) width 38: "ABCDE"
-        text run at (0,52) width 32: "FGHIJ"
-        text run at (0,65) width 32: "KLMN"
-        text run at (0,78) width 32: "OPQR"
-        text run at (0,91) width 39: "STUVW"
-        text run at (0,104) width 21: "XYZ"
-        text run at (20,104) width 4: " "
+        text run at (0,52) width 39: "FGHIJK"
+        text run at (0,65) width 33: "LMNO"
+        text run at (0,78) width 37: "PQRST"
+        text run at (0,91) width 39: "UVWXY"
+        text run at (0,104) width 7: "Z"
+        text run at (6,104) width 4: " "
         text run at (0,117) width 35: "abcdef"
-        text run at (0,130) width 36: "ghijklm"
+        text run at (0,130) width 35: "ghijklm"
         text run at (0,143) width 39: "nopqrst"
         text run at (0,156) width 12: "uv"
         text run at (11,156) width 4: " "
@@ -671,14 +667,14 @@
         text run at (0,26) width 26: "dolor"
         text run at (25,26) width 4: " "
         text run at (0,39) width 38: "ABCDE"
-        text run at (0,52) width 32: "FGHIJ"
-        text run at (0,65) width 32: "KLMN"
-        text run at (0,78) width 32: "OPQR"
-        text run at (0,91) width 39: "STUVW"
-        text run at (0,104) width 21: "XYZ"
-        text run at (20,104) width 4: " "
+        text run at (0,52) width 39: "FGHIJK"
+        text run at (0,65) width 33: "LMNO"
+        text run at (0,78) width 37: "PQRST"
+        text run at (0,91) width 39: "UVWXY"
+        text run at (0,104) width 7: "Z"
+        text run at (6,104) width 4: " "
         text run at (0,117) width 35: "abcdef"
-        text run at (0,130) width 36: "ghijklm"
+        text run at (0,130) width 35: "ghijklm"
         text run at (0,143) width 39: "nopqrst"
         text run at (0,156) width 12: "uv"
         text run at (11,156) width 4: " "

diff --git a/third_party/WebKit/LayoutTests/platform/mac-mac10.10/fast/text/midword-break-after-breakable-char-expected.png b/third_party/WebKit/LayoutTests/platform/mac-mac10.10/fast/text/midword-break-after-breakable-char-expected.png
index a752cff..c804fbf 100644
--- a/third_party/WebKit/LayoutTests/platform/mac-mac10.10/fast/text/midword-break-after-breakable-char-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/mac-mac10.10/fast/text/midword-break-after-breakable-char-expected.png
Binary files differ

diff --git a/third_party/WebKit/LayoutTests/platform/mac-mac10.9/fast/forms/textarea/basic-textareas-expected.png b/third_party/WebKit/LayoutTests/platform/mac-mac10.9/fast/forms/textarea/basic-textareas-expected.png
index 1d27960..85c6d56d 100644
--- a/third_party/WebKit/LayoutTests/platform/mac-mac10.9/fast/forms/textarea/basic-textareas-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/mac-mac10.9/fast/forms/textarea/basic-textareas-expected.png
Binary files differ

diff --git a/third_party/WebKit/LayoutTests/platform/mac-mac10.9/fast/forms/textarea/basic-textareas-expected.txt b/third_party/WebKit/LayoutTests/platform/mac-mac10.9/fast/forms/textarea/basic-textareas-expected.txt
index 7f459ba..bb6ed332 100644
--- a/third_party/WebKit/LayoutTests/platform/mac-mac10.9/fast/forms/textarea/basic-textareas-expected.txt
+++ b/third_party/WebKit/LayoutTests/platform/mac-mac10.9/fast/forms/textarea/basic-textareas-expected.txt

@@ -281,13 +281,13 @@
             text run at (0,26) width 29: "dolor"
             text run at (28,26) width 4: " "
             text run at (0,39) width 42: "ABCDEF"
-            text run at (0,52) width 36: "GHIJKL"
-            text run at (0,65) width 41: "MNOPQ"
-            text run at (0,78) width 45: "RSTUVW"
-            text run at (0,91) width 21: "XYZ"
-            text run at (20,91) width 4: " "
+            text run at (0,52) width 45: "GHIJKLM"
+            text run at (0,65) width 44: "NOPQRS"
+            text run at (0,78) width 45: "TUVWXY"
+            text run at (0,91) width 7: "Z"
+            text run at (6,91) width 5: " "
             text run at (0,104) width 43: "abcdefg"
-            text run at (0,117) width 41: "hijklmn"
+            text run at (0,117) width 40: "hijklmn"
             text run at (0,130) width 42: "opqrstu"
             text run at (0,143) width 6: "v"
     layer at (429,152) size 102x68 clip at (430,153) size 85x66 scrollHeight 196
@@ -301,13 +301,13 @@
             text run at (0,26) width 29: "dolor"
             text run at (28,26) width 4: " "
             text run at (0,39) width 42: "ABCDEF"
-            text run at (0,52) width 36: "GHIJKL"
-            text run at (0,65) width 41: "MNOPQ"
-            text run at (0,78) width 45: "RSTUVW"
-            text run at (0,91) width 21: "XYZ"
-            text run at (20,91) width 4: " "
+            text run at (0,52) width 45: "GHIJKLM"
+            text run at (0,65) width 44: "NOPQRS"
+            text run at (0,78) width 45: "TUVWXY"
+            text run at (0,91) width 7: "Z"
+            text run at (6,91) width 5: " "
             text run at (0,104) width 43: "abcdefg"
-            text run at (0,117) width 41: "hijklmn"
+            text run at (0,117) width 40: "hijklmn"
             text run at (0,130) width 42: "opqrstu"
             text run at (0,143) width 6: "v"
     layer at (533,192) size 62x28 clip at (534,193) size 45x26 scrollHeight 156
@@ -321,13 +321,13 @@
             text run at (0,26) width 29: "dolor"
             text run at (28,26) width 4: " "
             text run at (0,39) width 42: "ABCDEF"
-            text run at (0,52) width 36: "GHIJKL"
-            text run at (0,65) width 41: "MNOPQ"
-            text run at (0,78) width 45: "RSTUVW"
-            text run at (0,91) width 21: "XYZ"
-            text run at (20,91) width 4: " "
+            text run at (0,52) width 45: "GHIJKLM"
+            text run at (0,65) width 44: "NOPQRS"
+            text run at (0,78) width 45: "TUVWXY"
+            text run at (0,91) width 7: "Z"
+            text run at (6,91) width 5: " "
             text run at (0,104) width 43: "abcdefg"
-            text run at (0,117) width 41: "hijklmn"
+            text run at (0,117) width 40: "hijklmn"
             text run at (0,130) width 42: "opqrstu"
             text run at (0,143) width 6: "v"
     layer at (615,154) size 161x66 clip at (616,155) size 159x64
@@ -351,13 +351,13 @@
             text run at (0,26) width 29: "dolor"
             text run at (28,26) width 4: " "
             text run at (0,39) width 42: "ABCDEF"
-            text run at (0,52) width 36: "GHIJKL"
-            text run at (0,65) width 41: "MNOPQ"
-            text run at (0,78) width 45: "RSTUVW"
-            text run at (0,91) width 21: "XYZ"
-            text run at (20,91) width 4: " "
+            text run at (0,52) width 45: "GHIJKLM"
+            text run at (0,65) width 44: "NOPQRS"
+            text run at (0,78) width 45: "TUVWXY"
+            text run at (0,91) width 7: "Z"
+            text run at (6,91) width 5: " "
             text run at (0,104) width 43: "abcdefg"
-            text run at (0,117) width 41: "hijklmn"
+            text run at (0,117) width 40: "hijklmn"
             text run at (0,130) width 42: "opqrstu"
             text run at (0,143) width 6: "v"
     layer at (83,315) size 161x32 clip at (84,316) size 159x30 scrollHeight 56
@@ -391,12 +391,12 @@
             text run at (0,26) width 29: "dolor"
             text run at (28,26) width 4: " "
             text run at (0,39) width 58: "ABCDEFGH"
-            text run at (0,52) width 52: "IJKLMNOP"
-            text run at (0,65) width 60: "QRSTUVWX"
-            text run at (0,78) width 14: "YZ"
-            text run at (13,78) width 4: " "
+            text run at (0,52) width 60: "IJKLMNOPQ"
+            text run at (0,65) width 58: "RSTUVWXY"
+            text run at (0,78) width 7: "Z"
+            text run at (6,78) width 5: " "
             text run at (0,91) width 56: "abcdefghij"
-            text run at (0,104) width 58: "klmnopqrs"
+            text run at (0,104) width 57: "klmnopqrs"
             text run at (0,117) width 17: "tuv"
     layer at (491,281) size 66x66 clip at (492,282) size 49x49 scrollHeight 160
       LayoutTextControl {TEXTAREA} at (1,57) size 66x66 [bgcolor=#FFFFFF] [border: (1px solid #000000)]
@@ -409,13 +409,13 @@
             text run at (0,26) width 29: "dolor"
             text run at (28,26) width 4: " "
             text run at (0,39) width 42: "ABCDEF"
-            text run at (0,52) width 36: "GHIJKL"
-            text run at (0,65) width 41: "MNOPQ"
-            text run at (0,78) width 45: "RSTUVW"
-            text run at (0,91) width 21: "XYZ"
-            text run at (20,91) width 4: " "
+            text run at (0,52) width 45: "GHIJKLM"
+            text run at (0,65) width 44: "NOPQRS"
+            text run at (0,78) width 45: "TUVWXY"
+            text run at (0,91) width 7: "Z"
+            text run at (6,91) width 5: " "
             text run at (0,104) width 43: "abcdefg"
-            text run at (0,117) width 41: "hijklmn"
+            text run at (0,117) width 40: "hijklmn"
             text run at (0,130) width 42: "opqrstu"
             text run at (0,143) width 6: "v"
     layer at (573,281) size 66x66 clip at (574,282) size 49x64 scrollHeight 160
@@ -429,13 +429,13 @@
             text run at (0,26) width 29: "dolor"
             text run at (28,26) width 4: " "
             text run at (0,39) width 42: "ABCDEF"
-            text run at (0,52) width 36: "GHIJKL"
-            text run at (0,65) width 41: "MNOPQ"
-            text run at (0,78) width 45: "RSTUVW"
-            text run at (0,91) width 21: "XYZ"
-            text run at (20,91) width 4: " "
+            text run at (0,52) width 45: "GHIJKLM"
+            text run at (0,65) width 44: "NOPQRS"
+            text run at (0,78) width 45: "TUVWXY"
+            text run at (0,91) width 7: "Z"
+            text run at (6,91) width 5: " "
             text run at (0,104) width 43: "abcdefg"
-            text run at (0,117) width 41: "hijklmn"
+            text run at (0,117) width 40: "hijklmn"
             text run at (0,130) width 42: "opqrstu"
             text run at (0,143) width 6: "v"
     layer at (655,281) size 66x66 clip at (656,282) size 49x64 scrollHeight 160
@@ -449,13 +449,13 @@
             text run at (0,26) width 29: "dolor"
             text run at (28,26) width 4: " "
             text run at (0,39) width 42: "ABCDEF"
-            text run at (0,52) width 36: "GHIJKL"
-            text run at (0,65) width 41: "MNOPQ"
-            text run at (0,78) width 45: "RSTUVW"
-            text run at (0,91) width 21: "XYZ"
-            text run at (20,91) width 4: " "
+            text run at (0,52) width 45: "GHIJKLM"
+            text run at (0,65) width 44: "NOPQRS"
+            text run at (0,78) width 45: "TUVWXY"
+            text run at (0,91) width 7: "Z"
+            text run at (6,91) width 5: " "
             text run at (0,104) width 43: "abcdefg"
-            text run at (0,117) width 41: "hijklmn"
+            text run at (0,117) width 40: "hijklmn"
             text run at (0,130) width 42: "opqrstu"
             text run at (0,143) width 6: "v"
     layer at (1,408) size 66x66 clip at (2,409) size 49x64 scrollHeight 160
@@ -469,20 +469,20 @@
             text run at (0,26) width 29: "dolor"
             text run at (28,26) width 4: " "
             text run at (0,39) width 42: "ABCDEF"
-            text run at (0,52) width 36: "GHIJKL"
-            text run at (0,65) width 41: "MNOPQ"
-            text run at (0,78) width 45: "RSTUVW"
-            text run at (0,91) width 21: "XYZ"
-            text run at (20,91) width 4: " "
+            text run at (0,52) width 45: "GHIJKLM"
+            text run at (0,65) width 44: "NOPQRS"
+            text run at (0,78) width 45: "TUVWXY"
+            text run at (0,91) width 7: "Z"
+            text run at (6,91) width 5: " "
             text run at (0,104) width 43: "abcdefg"
-            text run at (0,117) width 41: "hijklmn"
+            text run at (0,117) width 40: "hijklmn"
             text run at (0,130) width 42: "opqrstu"
             text run at (0,143) width 6: "v"
     layer at (83,442) size 42x32 clip at (84,443) size 25x30 scrollHeight 316
       LayoutTextControl {TEXTAREA} at (1,15) size 42x32 [bgcolor=#FFFFFF] [border: (1px solid #000000)]
         LayoutBlockFlow {DIV} at (3,3) size 21x312
           LayoutText {#text} at (0,0) size 21x312
-            text run at (0,0) width 18: "Lor"
+            text run at (0,0) width 17: "Lor"
             text run at (0,13) width 17: "em"
             text run at (16,13) width 4: " "
             text run at (0,26) width 16: "ips"
@@ -495,21 +495,21 @@
             text run at (0,91) width 16: "CD"
             text run at (0,104) width 20: "EFG"
             text run at (0,117) width 15: "HIJ"
-            text run at (0,130) width 14: "KL"
+            text run at (0,130) width 13: "KL"
             text run at (0,143) width 18: "MN"
             text run at (0,156) width 15: "OP"
-            text run at (0,169) width 16: "QR"
-            text run at (0,182) width 21: "STU"
+            text run at (0,169) width 21: "QRS"
+            text run at (0,182) width 15: "TU"
             text run at (0,195) width 17: "VW"
             text run at (0,208) width 21: "XYZ"
             text run at (20,208) width 1: " "
             text run at (0,221) width 19: "abc"
-            text run at (0,234) width 18: "def"
-            text run at (0,247) width 21: "ghij"
+            text run at (0,234) width 17: "def"
+            text run at (0,247) width 20: "ghij"
             text run at (0,260) width 20: "klm"
             text run at (0,273) width 21: "nop"
-            text run at (0,286) width 18: "qrs"
-            text run at (0,299) width 17: "tuv"
+            text run at (0,286) width 21: "qrst"
+            text run at (0,299) width 13: "uv"
     layer at (165,429) size 161x45 clip at (166,430) size 144x43 scrollHeight 56
       LayoutTextControl {TEXTAREA} at (1,15) size 161x45 [bgcolor=#FFFFFF] [border: (1px solid #000000)]
         LayoutBlockFlow {DIV} at (3,3) size 140x52
@@ -523,7 +523,7 @@
     layer at (328,442) size 70x32 clip at (329,443) size 53x30 scrollHeight 147
       LayoutTextControl {TEXTAREA} at (1,15) size 70x32 [bgcolor=#FFFFFF] [border: (1px solid #000000)]
         LayoutBlockFlow {DIV} at (3,3) size 49x143
-          LayoutText {#text} at (0,0) size 47x143
+          LayoutText {#text} at (0,0) size 49x143
             text run at (0,0) width 34: "Lorem"
             text run at (33,0) width 4: " "
             text run at (0,13) width 33: "ipsum"
@@ -531,14 +531,14 @@
             text run at (0,26) width 29: "dolor"
             text run at (28,26) width 4: " "
             text run at (0,39) width 42: "ABCDEF"
-            text run at (0,52) width 46: "GHIJKLM"
-            text run at (0,65) width 45: "NOPQRS"
+            text run at (0,52) width 45: "GHIJKLM"
+            text run at (0,65) width 44: "NOPQRS"
             text run at (0,78) width 45: "TUVWXY"
             text run at (0,91) width 7: "Z"
             text run at (6,91) width 5: " "
-            text run at (0,104) width 43: "abcdefg"
-            text run at (0,117) width 47: "hijklmno"
-            text run at (0,130) width 41: "pqrstuv"
+            text run at (0,104) width 49: "abcdefgh"
+            text run at (0,117) width 47: "ijklmnop"
+            text run at (0,130) width 34: "qrstuv"
     layer at (410,377) size 161x97 clip at (411,378) size 159x95
       LayoutTextControl {TEXTAREA} at (1,15) size 161x97 [bgcolor=#FFFFFF] [border: (1px solid #000000)]
         LayoutBlockFlow {DIV} at (3,3) size 155x52
@@ -560,9 +560,9 @@
             text run at (0,39) width 29: "dolor"
             text run at (28,39) width 4: " "
             text run at (0,52) width 30: "ABCD"
-            text run at (0,65) width 35: "EFGHIJ"
+            text run at (0,65) width 34: "EFGHIJ"
             text run at (0,78) width 31: "KLMN"
-            text run at (0,91) width 31: "OPQR"
+            text run at (0,91) width 30: "OPQR"
             text run at (0,104) width 28: "STUV"
             text run at (0,117) width 30: "WXYZ"
             text run at (29,117) width 5: " "
@@ -929,7 +929,7 @@
             text run at (28,26) width 4: " "
             text run at (0,39) width 36: "ABCDE"
             text run at (0,52) width 36: "FGHIJK"
-            text run at (0,65) width 39: "LMNOP"
+            text run at (0,65) width 38: "LMNOP"
             text run at (0,78) width 36: "QRSTU"
             text run at (0,91) width 37: "VWXYZ"
             text run at (36,91) width 3: " "
@@ -947,7 +947,7 @@
             text run at (0,39) width 7: "e"
             text run at (0,52) width 11: "m"
             text run at (0,65) width 3: " "
-            text run at (0,78) width 4: "i"
+            text run at (0,78) width 3: "i"
             text run at (0,91) width 7: "p"
             text run at (0,104) width 6: "s"
             text run at (0,117) width 7: "u"
@@ -956,7 +956,7 @@
             text run at (0,156) width 3: " "
             text run at (0,169) width 7: "d"
             text run at (0,182) width 7: "o"
-            text run at (0,195) width 4: "l"
+            text run at (0,195) width 3: "l"
             text run at (0,208) width 7: "o"
             text run at (0,221) width 5: "r"
             text run at (0,234) width 3: " "
@@ -968,8 +968,8 @@
             text run at (0,312) width 6: "F"
             text run at (0,325) width 8: "G"
             text run at (0,338) width 9: "H"
-            text run at (0,351) width 4: "I"
-            text run at (0,364) width 4: "J"
+            text run at (0,351) width 3: "I"
+            text run at (0,364) width 3: "J"
             text run at (0,377) width 8: "K"
             text run at (0,390) width 6: "L"
             text run at (0,403) width 10: "M"
@@ -995,10 +995,10 @@
             text run at (0,663) width 5: "f"
             text run at (0,676) width 7: "g"
             text run at (0,689) width 7: "h"
-            text run at (0,702) width 4: "i"
-            text run at (0,715) width 4: "j"
+            text run at (0,702) width 3: "i"
+            text run at (0,715) width 3: "j"
             text run at (0,728) width 7: "k"
-            text run at (0,741) width 4: "l"
+            text run at (0,741) width 3: "l"
             text run at (0,754) width 11: "m"
             text run at (0,767) width 7: "n"
             text run at (0,780) width 7: "o"
@@ -1026,7 +1026,7 @@
             text run at (0,91) width 30: "WXYZ"
             text run at (29,91) width 5: " "
             text run at (0,104) width 43: "abcdefg"
-            text run at (0,117) width 41: "hijklmn"
+            text run at (0,117) width 40: "hijklmn"
             text run at (0,130) width 42: "opqrstu"
             text run at (0,143) width 6: "v"
     layer at (593,157) size 161x60 clip at (594,158) size 159x58
@@ -1051,7 +1051,7 @@
             text run at (28,26) width 4: " "
             text run at (0,39) width 36: "ABCDE"
             text run at (0,52) width 36: "FGHIJK"
-            text run at (0,65) width 39: "LMNOP"
+            text run at (0,65) width 38: "LMNOP"
             text run at (0,78) width 36: "QRSTU"
             text run at (0,91) width 37: "VWXYZ"
             text run at (36,91) width 3: " "
@@ -1091,7 +1091,7 @@
             text run at (28,26) width 4: " "
             text run at (0,39) width 50: "ABCDEFG"
             text run at (0,52) width 54: "HIJKLMNO"
-            text run at (0,65) width 50: "PQRSTUV"
+            text run at (0,65) width 49: "PQRSTUV"
             text run at (0,78) width 30: "WXYZ"
             text run at (29,78) width 5: " "
             text run at (0,91) width 53: "abcdefghi"
@@ -1109,7 +1109,7 @@
             text run at (28,26) width 4: " "
             text run at (0,39) width 36: "ABCDE"
             text run at (0,52) width 36: "FGHIJK"
-            text run at (0,65) width 39: "LMNOP"
+            text run at (0,65) width 38: "LMNOP"
             text run at (0,78) width 36: "QRSTU"
             text run at (0,91) width 37: "VWXYZ"
             text run at (36,91) width 3: " "
@@ -1129,7 +1129,7 @@
             text run at (28,26) width 4: " "
             text run at (0,39) width 36: "ABCDE"
             text run at (0,52) width 36: "FGHIJK"
-            text run at (0,65) width 39: "LMNOP"
+            text run at (0,65) width 38: "LMNOP"
             text run at (0,78) width 36: "QRSTU"
             text run at (0,91) width 37: "VWXYZ"
             text run at (36,91) width 3: " "
@@ -1149,7 +1149,7 @@
             text run at (28,26) width 4: " "
             text run at (0,39) width 36: "ABCDE"
             text run at (0,52) width 36: "FGHIJK"
-            text run at (0,65) width 39: "LMNOP"
+            text run at (0,65) width 38: "LMNOP"
             text run at (0,78) width 36: "QRSTU"
             text run at (0,91) width 37: "VWXYZ"
             text run at (36,91) width 3: " "
@@ -1169,7 +1169,7 @@
             text run at (28,26) width 4: " "
             text run at (0,39) width 36: "ABCDE"
             text run at (0,52) width 36: "FGHIJK"
-            text run at (0,65) width 39: "LMNOP"
+            text run at (0,65) width 38: "LMNOP"
             text run at (0,78) width 36: "QRSTU"
             text run at (0,91) width 37: "VWXYZ"
             text run at (36,91) width 3: " "
@@ -1181,7 +1181,7 @@
       LayoutTextControl {TEXTAREA} at (1,15) size 42x32 [bgcolor=#FFFFFF] [border: (1px solid #000000)]
         LayoutBlockFlow {DIV} at (3,3) size 21x312
           LayoutText {#text} at (0,0) size 21x312
-            text run at (0,0) width 18: "Lor"
+            text run at (0,0) width 17: "Lor"
             text run at (0,13) width 17: "em"
             text run at (16,13) width 4: " "
             text run at (0,26) width 16: "ips"
@@ -1194,21 +1194,21 @@
             text run at (0,91) width 16: "CD"
             text run at (0,104) width 20: "EFG"
             text run at (0,117) width 15: "HIJ"
-            text run at (0,130) width 14: "KL"
+            text run at (0,130) width 13: "KL"
             text run at (0,143) width 18: "MN"
             text run at (0,156) width 15: "OP"
-            text run at (0,169) width 16: "QR"
-            text run at (0,182) width 21: "STU"
+            text run at (0,169) width 21: "QRS"
+            text run at (0,182) width 15: "TU"
             text run at (0,195) width 17: "VW"
             text run at (0,208) width 21: "XYZ"
             text run at (20,208) width 1: " "
             text run at (0,221) width 19: "abc"
-            text run at (0,234) width 18: "def"
-            text run at (0,247) width 21: "ghij"
+            text run at (0,234) width 17: "def"
+            text run at (0,247) width 20: "ghij"
             text run at (0,260) width 20: "klm"
             text run at (0,273) width 21: "nop"
-            text run at (0,286) width 18: "qrs"
-            text run at (0,299) width 17: "tuv"
+            text run at (0,286) width 21: "qrst"
+            text run at (0,299) width 13: "uv"
     layer at (165,408) size 161x45 clip at (166,409) size 144x43 scrollHeight 56
       LayoutTextControl {TEXTAREA} at (1,15) size 161x45 [bgcolor=#FFFFFF] [border: (1px solid #000000)]
         LayoutBlockFlow {DIV} at (3,3) size 140x52
@@ -1222,7 +1222,7 @@
     layer at (328,421) size 70x32 clip at (329,422) size 53x30 scrollHeight 147
       LayoutTextControl {TEXTAREA} at (1,15) size 70x32 [bgcolor=#FFFFFF] [border: (1px solid #000000)]
         LayoutBlockFlow {DIV} at (3,3) size 49x143
-          LayoutText {#text} at (0,0) size 47x143
+          LayoutText {#text} at (0,0) size 49x143
             text run at (0,0) width 34: "Lorem"
             text run at (33,0) width 4: " "
             text run at (0,13) width 33: "ipsum"
@@ -1230,14 +1230,14 @@
             text run at (0,26) width 29: "dolor"
             text run at (28,26) width 4: " "
             text run at (0,39) width 42: "ABCDEF"
-            text run at (0,52) width 46: "GHIJKLM"
-            text run at (0,65) width 45: "NOPQRS"
+            text run at (0,52) width 45: "GHIJKLM"
+            text run at (0,65) width 44: "NOPQRS"
             text run at (0,78) width 45: "TUVWXY"
             text run at (0,91) width 7: "Z"
             text run at (6,91) width 5: " "
-            text run at (0,104) width 43: "abcdefg"
-            text run at (0,117) width 47: "hijklmno"
-            text run at (0,130) width 41: "pqrstuv"
+            text run at (0,104) width 49: "abcdefgh"
+            text run at (0,117) width 47: "ijklmnop"
+            text run at (0,130) width 34: "qrstuv"
     layer at (410,356) size 161x97 clip at (411,357) size 159x95
       LayoutTextControl {TEXTAREA} at (1,15) size 161x97 [bgcolor=#FFFFFF] [border: (1px solid #000000)]
         LayoutBlockFlow {DIV} at (3,3) size 155x52
@@ -1259,9 +1259,9 @@
             text run at (0,39) width 29: "dolor"
             text run at (28,39) width 4: " "
             text run at (0,52) width 30: "ABCD"
-            text run at (0,65) width 35: "EFGHIJ"
+            text run at (0,65) width 34: "EFGHIJ"
             text run at (0,78) width 31: "KLMN"
-            text run at (0,91) width 31: "OPQR"
+            text run at (0,91) width 30: "OPQR"
             text run at (0,104) width 28: "STUV"
             text run at (0,117) width 30: "WXYZ"
             text run at (29,117) width 5: " "

diff --git a/third_party/WebKit/LayoutTests/platform/mac-mac10.9/fast/forms/textarea/basic-textareas-quirks-expected.txt b/third_party/WebKit/LayoutTests/platform/mac-mac10.9/fast/forms/textarea/basic-textareas-quirks-expected.txt
index dab91a8..81b2901 100644
--- a/third_party/WebKit/LayoutTests/platform/mac-mac10.9/fast/forms/textarea/basic-textareas-quirks-expected.txt
+++ b/third_party/WebKit/LayoutTests/platform/mac-mac10.9/fast/forms/textarea/basic-textareas-quirks-expected.txt

@@ -299,7 +299,7 @@
   LayoutTextControl {TEXTAREA} at (14.61,1) size 42x32 [bgcolor=#FFFFFF] [border: (1px solid #000000)]
     LayoutBlockFlow {DIV} at (3,3) size 21x312
       LayoutText {#text} at (0,0) size 21x312
-        text run at (0,0) width 18: "Lor"
+        text run at (0,0) width 17: "Lor"
         text run at (0,13) width 17: "em"
         text run at (16,13) width 4: " "
         text run at (0,26) width 16: "ips"
@@ -312,22 +312,22 @@
         text run at (0,91) width 16: "CD"
         text run at (0,104) width 20: "EFG"
         text run at (0,117) width 15: "HIJ"
-        text run at (0,130) width 14: "KL"
+        text run at (0,130) width 13: "KL"
         text run at (0,143) width 18: "MN"
         text run at (0,156) width 15: "OP"
-        text run at (0,169) width 16: "QR"
-        text run at (0,182) width 21: "STU"
+        text run at (0,169) width 21: "QRS"
+        text run at (0,182) width 15: "TU"
         text run at (0,195) width 17: "VW"
         text run at (0,208) width 21: "XYZ"
         text run at (20,208) width 1: " "
         text run at (0,221) width 19: "abc"
-        text run at (0,234) width 18: "def"
-        text run at (0,247) width 21: "ghij"
+        text run at (0,234) width 17: "def"
+        text run at (0,247) width 20: "ghij"
         text run at (0,260) width 20: "klm"
         text run at (0,273) width 21: "nop"
-        text run at (0,286) width 18: "qrs"
-        text run at (0,299) width 17: "tuv"
-        text run at (16,299) width 5: " "
+        text run at (0,286) width 21: "qrst"
+        text run at (0,299) width 13: "uv"
+        text run at (12,299) width 4: " "
 layer at (24,464) size 161x45 clip at (25,465) size 144x43 scrollHeight 56
   LayoutTextControl {TEXTAREA} at (14.61,1) size 161x45 [bgcolor=#FFFFFF] [border: (1px solid #000000)]
     LayoutBlockFlow {DIV} at (3,3) size 140x52
@@ -347,7 +347,7 @@
         text run at (69,0) width 1: " "
         text run at (0,13) width 29: "dolor"
         text run at (28,13) width 4: " "
-        text run at (0,26) width 65: "ABCDEFGHIJ"
+        text run at (0,26) width 64: "ABCDEFGHIJ"
         text run at (0,39) width 67: "KLMNOPQRS"
         text run at (0,52) width 52: "TUVWXYZ"
         text run at (51,52) width 5: " "
@@ -376,9 +376,9 @@
         text run at (0,26) width 29: "dolor"
         text run at (28,26) width 4: " "
         text run at (0,39) width 30: "ABCD"
-        text run at (0,52) width 35: "EFGHIJ"
+        text run at (0,52) width 34: "EFGHIJ"
         text run at (0,65) width 31: "KLMN"
-        text run at (0,78) width 31: "OPQR"
+        text run at (0,78) width 30: "OPQR"
         text run at (0,91) width 28: "STUV"
         text run at (0,104) width 30: "WXYZ"
         text run at (29,104) width 5: " "
@@ -399,7 +399,7 @@
         text run at (28,26) width 4: " "
         text run at (0,39) width 36: "ABCDE"
         text run at (0,52) width 36: "FGHIJK"
-        text run at (0,65) width 39: "LMNOP"
+        text run at (0,65) width 38: "LMNOP"
         text run at (0,78) width 36: "QRSTU"
         text run at (0,91) width 37: "VWXYZ"
         text run at (36,91) width 3: " "
@@ -418,7 +418,7 @@
         text run at (0,39) width 7: "e"
         text run at (0,52) width 11: "m"
         text run at (0,65) width 3: " "
-        text run at (0,78) width 4: "i"
+        text run at (0,78) width 3: "i"
         text run at (0,91) width 7: "p"
         text run at (0,104) width 6: "s"
         text run at (0,117) width 7: "u"
@@ -426,7 +426,7 @@
         text run at (0,143) width 3: " "
         text run at (0,156) width 7: "d"
         text run at (0,169) width 7: "o"
-        text run at (0,182) width 4: "l"
+        text run at (0,182) width 3: "l"
         text run at (0,195) width 7: "o"
         text run at (0,208) width 5: "r"
         text run at (0,221) width 3: " "
@@ -438,8 +438,8 @@
         text run at (0,299) width 6: "F"
         text run at (0,312) width 8: "G"
         text run at (0,325) width 9: "H"
-        text run at (0,338) width 4: "I"
-        text run at (0,351) width 4: "J"
+        text run at (0,338) width 3: "I"
+        text run at (0,351) width 3: "J"
         text run at (0,364) width 8: "K"
         text run at (0,377) width 6: "L"
         text run at (0,390) width 10: "M"
@@ -465,10 +465,10 @@
         text run at (0,650) width 5: "f"
         text run at (0,663) width 7: "g"
         text run at (0,676) width 7: "h"
-        text run at (0,689) width 4: "i"
-        text run at (0,702) width 4: "j"
+        text run at (0,689) width 3: "i"
+        text run at (0,702) width 3: "j"
         text run at (0,715) width 7: "k"
-        text run at (0,728) width 4: "l"
+        text run at (0,728) width 3: "l"
         text run at (0,741) width 11: "m"
         text run at (0,754) width 7: "n"
         text run at (0,767) width 7: "o"
@@ -497,7 +497,7 @@
         text run at (0,91) width 30: "WXYZ"
         text run at (29,91) width 5: " "
         text run at (0,104) width 43: "abcdefg"
-        text run at (0,117) width 41: "hijklmn"
+        text run at (0,117) width 40: "hijklmn"
         text run at (0,130) width 42: "opqrstu"
         text run at (0,143) width 6: "v"
         text run at (5,143) width 5: " "
@@ -524,7 +524,7 @@
         text run at (28,26) width 4: " "
         text run at (0,39) width 36: "ABCDE"
         text run at (0,52) width 36: "FGHIJK"
-        text run at (0,65) width 39: "LMNOP"
+        text run at (0,65) width 38: "LMNOP"
         text run at (0,78) width 36: "QRSTU"
         text run at (0,91) width 37: "VWXYZ"
         text run at (36,91) width 3: " "
@@ -567,7 +567,7 @@
         text run at (28,26) width 4: " "
         text run at (0,39) width 50: "ABCDEFG"
         text run at (0,52) width 54: "HIJKLMNO"
-        text run at (0,65) width 50: "PQRSTUV"
+        text run at (0,65) width 49: "PQRSTUV"
         text run at (0,78) width 30: "WXYZ"
         text run at (29,78) width 5: " "
         text run at (0,91) width 53: "abcdefghi"
@@ -586,7 +586,7 @@
         text run at (28,26) width 4: " "
         text run at (0,39) width 36: "ABCDE"
         text run at (0,52) width 36: "FGHIJK"
-        text run at (0,65) width 39: "LMNOP"
+        text run at (0,65) width 38: "LMNOP"
         text run at (0,78) width 36: "QRSTU"
         text run at (0,91) width 37: "VWXYZ"
         text run at (36,91) width 3: " "
@@ -607,7 +607,7 @@
         text run at (28,26) width 4: " "
         text run at (0,39) width 36: "ABCDE"
         text run at (0,52) width 36: "FGHIJK"
-        text run at (0,65) width 39: "LMNOP"
+        text run at (0,65) width 38: "LMNOP"
         text run at (0,78) width 36: "QRSTU"
         text run at (0,91) width 37: "VWXYZ"
         text run at (36,91) width 3: " "
@@ -628,7 +628,7 @@
         text run at (28,26) width 4: " "
         text run at (0,39) width 36: "ABCDE"
         text run at (0,52) width 36: "FGHIJK"
-        text run at (0,65) width 39: "LMNOP"
+        text run at (0,65) width 38: "LMNOP"
         text run at (0,78) width 36: "QRSTU"
         text run at (0,91) width 37: "VWXYZ"
         text run at (36,91) width 3: " "
@@ -649,7 +649,7 @@
         text run at (28,26) width 4: " "
         text run at (0,39) width 36: "ABCDE"
         text run at (0,52) width 36: "FGHIJK"
-        text run at (0,65) width 39: "LMNOP"
+        text run at (0,65) width 38: "LMNOP"
         text run at (0,78) width 36: "QRSTU"
         text run at (0,91) width 37: "VWXYZ"
         text run at (36,91) width 3: " "

diff --git a/third_party/WebKit/LayoutTests/platform/mac-mac10.9/fast/text/midword-break-after-breakable-char-expected.txt b/third_party/WebKit/LayoutTests/platform/mac-mac10.9/fast/text/midword-break-after-breakable-char-expected.txt
new file mode 100644
index 0000000..50e5d3d
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/platform/mac-mac10.9/fast/text/midword-break-after-breakable-char-expected.txt

@@ -0,0 +1,67 @@
+layer at (0,0) size 800x600
+  LayoutView at (0,0) size 800x600
+layer at (0,0) size 800x600
+  LayoutBlockFlow {HTML} at (0,0) size 800x600
+    LayoutBlockFlow {BODY} at (8,8) size 784x576
+      LayoutBlockFlow {P} at (0,0) size 784x36
+        LayoutText {#text} at (0,0) size 54x18
+          text run at (0,0) width 54: "Test for "
+        LayoutInline {I} at (0,0) size 737x36
+          LayoutInline {A} at (0,0) size 305x18 [color=#0000EE]
+            LayoutText {#text} at (53,0) size 305x18
+              text run at (53,0) width 305: "http://bugs.webkit.org/show_bug.cgi?id=13156"
+          LayoutText {#text} at (357,0) size 737x36
+            text run at (357,0) width 5: " "
+            text run at (361,0) width 376: "REGRESSION (r19621): Pasting breakable content where"
+            text run at (0,18) width 502: "wrapped line is too long to fit in a textarea fails to draw a horizontal scrollbar"
+        LayoutText {#text} at (501,18) size 5x18
+          text run at (501,18) width 5: "."
+      LayoutBlockFlow {P} at (0,52) size 784x36
+        LayoutText {#text} at (0,0) size 783x36
+          text run at (0,0) width 783: "This tests that a line break will occur in the middle of the first word on a line if it\x{2019}s too long to fit on the line. The behavior"
+          text run at (0,18) width 647: "is tested after breakable characters (question mark and hyphen), after a space and after a soft hyphen."
+      LayoutBlockFlow {P} at (0,104) size 784x18
+        LayoutText {#text} at (0,0) size 266x18
+          text run at (0,0) width 266: "The following blocks should be identical."
+      LayoutBlockFlow (floating) {DIV} at (4,142) size 300x162 [bgcolor=#FFFFE0]
+        LayoutText {#text} at (0,0) size 298x162
+          text run at (0,0) width 191: "Curabiturpretium,quamquiss?"
+          text run at (0,18) width 295: "empermalesuada,estliberofeugiatlibero,velfrin"
+          text run at (0,36) width 147: "gillaorcinibhsedneque-"
+          text run at (0,54) width 295: "Quisqueeunullanonnisimolestieaccumsan.Etia"
+          text run at (0,72) width 209: "mtellusurna,laoreetac,laoreetnon"
+          text run at (0,90) width 298: "suscipitsed,sapien.Phasellusvehicula,sematpos"
+          text run at (0,108) width 236: "uerevehicula,auguenibhmolestienisl\x{AD}" + hyphen string "-"
+          text run at (0,126) width 297: "necullamcorperlacusantevulputatepede.Nascet"
+          text run at (0,144) width 100: "urridiculusmus."
+      LayoutBlockFlow (floating) {DIV} at (312,142) size 300x234 [bgcolor=#FFFFE0]
+        LayoutText {#text} at (0,0) size 191x18
+          text run at (0,0) width 191: "Curabiturpretium,quamquiss?"
+        LayoutBR {BR} at (190,14) size 1x0
+        LayoutText {#text} at (0,18) size 295x36
+          text run at (0,18) width 295: "empermalesuada,estliberofeugiatlibero,velfrin"
+          text run at (0,36) width 13: "gi"
+        LayoutBR {BR} at (12,50) size 1x0
+        LayoutText {#text} at (0,54) size 135x18
+          text run at (0,54) width 135: "llaorcinibhsedneque-"
+        LayoutBR {BR} at (134,68) size 1x0
+        LayoutText {#text} at (0,72) size 295x36
+          text run at (0,72) width 295: "Quisqueeunullanonnisimolestieaccumsan.Etia"
+          text run at (0,90) width 13: "m"
+        LayoutBR {BR} at (12,104) size 1x0
+        LayoutText {#text} at (0,108) size 197x18
+          text run at (0,108) width 197: "tellusurna,laoreetac,laoreetnon"
+        LayoutBR {BR} at (196,122) size 1x0
+        LayoutText {#text} at (0,126) size 298x36
+          text run at (0,126) width 298: "suscipitsed,sapien.Phasellusvehicula,sematpos"
+          text run at (0,144) width 8: "u"
+        LayoutBR {BR} at (8,158) size 0x0
+        LayoutText {#text} at (0,162) size 228x18
+          text run at (0,162) width 228: "erevehicula,auguenibhmolestienisl-"
+        LayoutBR {BR} at (227,176) size 1x0
+        LayoutText {#text} at (0,180) size 297x36
+          text run at (0,180) width 297: "necullamcorperlacusantevulputatepede.Nascet"
+          text run at (0,198) width 8: "u"
+        LayoutBR {BR} at (8,212) size 0x0
+        LayoutText {#text} at (0,216) size 92x18
+          text run at (0,216) width 92: "rridiculusmus."

diff --git a/third_party/WebKit/LayoutTests/platform/mac-mac10.9/svg/wicd/test-rightsizing-b-expected.png b/third_party/WebKit/LayoutTests/platform/mac-mac10.9/svg/wicd/test-rightsizing-b-expected.png
index 78f74f5..308c24f 100644
--- a/third_party/WebKit/LayoutTests/platform/mac-mac10.9/svg/wicd/test-rightsizing-b-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/mac-mac10.9/svg/wicd/test-rightsizing-b-expected.png
Binary files differ

diff --git a/third_party/WebKit/LayoutTests/platform/mac-mac10.9/svg/wicd/test-rightsizing-b-expected.txt b/third_party/WebKit/LayoutTests/platform/mac-mac10.9/svg/wicd/test-rightsizing-b-expected.txt
new file mode 100644
index 0000000..ee8430c
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/platform/mac-mac10.9/svg/wicd/test-rightsizing-b-expected.txt

@@ -0,0 +1,83 @@
+layer at (0,0) size 800x600 clip at (0,0) size 785x600 scrollHeight 701
+  LayoutView at (0,0) size 800x600
+layer at (0,0) size 785x701 backgroundClip at (0,0) size 785x600 clip at (0,0) size 785x600
+  LayoutBlockFlow {html} at (0,0) size 785x701.11
+    LayoutBlockFlow {body} at (47.09,30.72) size 737.89x662.39
+      LayoutBlockFlow {div} at (0,0) size 737.89x662.39
+        LayoutBlockFlow {h1} at (0,0) size 678.86x29
+          LayoutText {#text} at (0,0) size 379x28
+            text run at (0,0) width 379: "rightsizing to percentage width"
+        LayoutBlockFlow {h4} at (0,29) size 737.89x16
+          LayoutText {#text} at (0,0) size 141x16
+            text run at (0,0) width 141: "WICD Core 1.0 #20-2"
+        LayoutBlockFlow (anonymous) at (0,64.14) size 737.89x154
+          LayoutText {#text} at (295,136) size 5x17
+            text run at (295,136) width 5: " "
+          LayoutText {#text} at (447,136) size 5x17
+            text run at (447,136) width 5: " "
+          LayoutText {#text} at (525,136) size 5x17
+            text run at (525,136) width 5: " "
+          LayoutText {#text} at (0,0) size 0x0
+        LayoutBlockFlow {p} at (0,221.02) size 678.86x64
+          LayoutText {#text} at (0,0) size 663x32
+            text run at (0,0) width 663: "Above there must be four times the same, square SVG child visible, each referenced by an object element"
+            text run at (0,16) width 423: "with different widths (40%, 20%, 10%, 5%) and no height defined. "
+          LayoutBR {br} at (0,0) size 0x0
+          LayoutBR {br} at (0,32) size 0x16
+          LayoutText {#text} at (0,48) size 409x16
+            text run at (0,48) width 409: "Beyond there is the same, only with PNG images instead of SVG."
+        LayoutBlockFlow (anonymous) at (0,290.77) size 737.89x299
+          LayoutImage {object} at (0,0) size 295.16x295.16 [bgcolor=#FF0000]
+          LayoutText {#text} at (295,281) size 5x17
+            text run at (295,281) width 5: " "
+          LayoutImage {object} at (299.59,147) size 147.58x147.58 [bgcolor=#FF0000]
+          LayoutText {#text} at (447,281) size 5x17
+            text run at (447,281) width 5: " "
+          LayoutImage {object} at (451.61,221) size 73.78x73.78 [bgcolor=#FF0000]
+          LayoutText {#text} at (525,281) size 5x17
+            text run at (525,281) width 5: " "
+          LayoutImage {object} at (529.83,258) size 36.89x36.89 [bgcolor=#FF0000]
+          LayoutText {#text} at (0,0) size 0x0
+        LayoutBlockFlow {p} at (0,592.64) size 678.86x32
+          LayoutText {#text} at (0,0) size 675x32
+            text run at (0,0) width 675: "This test has succeeded, if both rows look exactly the same (SVGs must be square!) and no red background"
+            text run at (0,16) width 95: "color is visible."
+        LayoutBlockFlow {p} at (0,630.39) size 678.86x32
+          LayoutBR {br} at (0,0) size 0x16
+          LayoutInline {a} at (0,0) size 31x16 [color=#000066]
+            LayoutText {#text} at (0,16) size 31x16
+              text run at (0,16) width 31: "Back"
+layer at (47,95) size 295x150
+  LayoutEmbeddedObject {object} at (0,0) size 295.16x150 [bgcolor=#FF0000]
+    layer at (0,0) size 295x150
+      LayoutView at (0,0) size 295x150
+    layer at (0,0) size 295x150
+      LayoutBlockFlow {HTML} at (0,0) size 295x150
+        LayoutBlockFlow {BODY} at (8,8) size 279x134
+layer at (347,95) size 147x150
+  LayoutEmbeddedObject {object} at (299.59,0) size 147.58x150 [bgcolor=#FF0000]
+    layer at (0,0) size 148x150
+      LayoutView at (0,0) size 148x150
+    layer at (0,0) size 148x150
+      LayoutBlockFlow {HTML} at (0,0) size 148x150
+        LayoutBlockFlow {BODY} at (8,8) size 132x134
+layer at (499,95) size 73x150
+  LayoutEmbeddedObject {object} at (451.61,0) size 73.78x150 [bgcolor=#FF0000]
+    layer at (0,0) size 74x150
+      LayoutView at (0,0) size 74x150
+    layer at (0,0) size 74x150
+      LayoutBlockFlow {HTML} at (0,0) size 74x150
+        LayoutBlockFlow {BODY} at (8,8) size 58x134
+layer at (577,208) size 37x37
+  LayoutEmbeddedObject {object} at (529.83,113) size 36.89x36.89 [bgcolor=#FF0000]
+    layer at (0,0) size 37x37
+      LayoutView at (0,0) size 37x37
+    layer at (0,0) size 37x37
+      LayoutSVGRoot {svg} at (0,0) size 37x37
+        LayoutSVGHiddenContainer {defs} at (0,0) size 0x0
+        LayoutSVGRect {rect} at (0,0) size 37x37 [fill={[type=SOLID] [color=#5588FF]}] [x=-3000.00] [y=-1000.00] [width=6200.00] [height=2200.00]
+        LayoutSVGEllipse {circle} at (0,0) size 37x37 [fill={[type=SOLID] [color=#0000FF]}] [cx=100.00] [cy=100.00] [r=100.00]
+        LayoutSVGContainer {g} at (5,11) size 27x16
+          LayoutSVGText {text} at (29,60) size 141x82 contains 1 chunk(s)
+            LayoutSVGInlineText {#text} at (0,0) size 141x82
+              chunk 1 (middle anchor) text run 1 at (29.98,125.00) startOffset 0 endOffset 3 width 140.03: "SVG"

diff --git a/third_party/WebKit/LayoutTests/platform/mac-retina/svg/wicd/test-rightsizing-b-expected.txt b/third_party/WebKit/LayoutTests/platform/mac-retina/svg/wicd/test-rightsizing-b-expected.txt
new file mode 100644
index 0000000..ee8430c
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/platform/mac-retina/svg/wicd/test-rightsizing-b-expected.txt

@@ -0,0 +1,83 @@
+layer at (0,0) size 800x600 clip at (0,0) size 785x600 scrollHeight 701
+  LayoutView at (0,0) size 800x600
+layer at (0,0) size 785x701 backgroundClip at (0,0) size 785x600 clip at (0,0) size 785x600
+  LayoutBlockFlow {html} at (0,0) size 785x701.11
+    LayoutBlockFlow {body} at (47.09,30.72) size 737.89x662.39
+      LayoutBlockFlow {div} at (0,0) size 737.89x662.39
+        LayoutBlockFlow {h1} at (0,0) size 678.86x29
+          LayoutText {#text} at (0,0) size 379x28
+            text run at (0,0) width 379: "rightsizing to percentage width"
+        LayoutBlockFlow {h4} at (0,29) size 737.89x16
+          LayoutText {#text} at (0,0) size 141x16
+            text run at (0,0) width 141: "WICD Core 1.0 #20-2"
+        LayoutBlockFlow (anonymous) at (0,64.14) size 737.89x154
+          LayoutText {#text} at (295,136) size 5x17
+            text run at (295,136) width 5: " "
+          LayoutText {#text} at (447,136) size 5x17
+            text run at (447,136) width 5: " "
+          LayoutText {#text} at (525,136) size 5x17
+            text run at (525,136) width 5: " "
+          LayoutText {#text} at (0,0) size 0x0
+        LayoutBlockFlow {p} at (0,221.02) size 678.86x64
+          LayoutText {#text} at (0,0) size 663x32
+            text run at (0,0) width 663: "Above there must be four times the same, square SVG child visible, each referenced by an object element"
+            text run at (0,16) width 423: "with different widths (40%, 20%, 10%, 5%) and no height defined. "
+          LayoutBR {br} at (0,0) size 0x0
+          LayoutBR {br} at (0,32) size 0x16
+          LayoutText {#text} at (0,48) size 409x16
+            text run at (0,48) width 409: "Beyond there is the same, only with PNG images instead of SVG."
+        LayoutBlockFlow (anonymous) at (0,290.77) size 737.89x299
+          LayoutImage {object} at (0,0) size 295.16x295.16 [bgcolor=#FF0000]
+          LayoutText {#text} at (295,281) size 5x17
+            text run at (295,281) width 5: " "
+          LayoutImage {object} at (299.59,147) size 147.58x147.58 [bgcolor=#FF0000]
+          LayoutText {#text} at (447,281) size 5x17
+            text run at (447,281) width 5: " "
+          LayoutImage {object} at (451.61,221) size 73.78x73.78 [bgcolor=#FF0000]
+          LayoutText {#text} at (525,281) size 5x17
+            text run at (525,281) width 5: " "
+          LayoutImage {object} at (529.83,258) size 36.89x36.89 [bgcolor=#FF0000]
+          LayoutText {#text} at (0,0) size 0x0
+        LayoutBlockFlow {p} at (0,592.64) size 678.86x32
+          LayoutText {#text} at (0,0) size 675x32
+            text run at (0,0) width 675: "This test has succeeded, if both rows look exactly the same (SVGs must be square!) and no red background"
+            text run at (0,16) width 95: "color is visible."
+        LayoutBlockFlow {p} at (0,630.39) size 678.86x32
+          LayoutBR {br} at (0,0) size 0x16
+          LayoutInline {a} at (0,0) size 31x16 [color=#000066]
+            LayoutText {#text} at (0,16) size 31x16
+              text run at (0,16) width 31: "Back"
+layer at (47,95) size 295x150
+  LayoutEmbeddedObject {object} at (0,0) size 295.16x150 [bgcolor=#FF0000]
+    layer at (0,0) size 295x150
+      LayoutView at (0,0) size 295x150
+    layer at (0,0) size 295x150
+      LayoutBlockFlow {HTML} at (0,0) size 295x150
+        LayoutBlockFlow {BODY} at (8,8) size 279x134
+layer at (347,95) size 147x150
+  LayoutEmbeddedObject {object} at (299.59,0) size 147.58x150 [bgcolor=#FF0000]
+    layer at (0,0) size 148x150
+      LayoutView at (0,0) size 148x150
+    layer at (0,0) size 148x150
+      LayoutBlockFlow {HTML} at (0,0) size 148x150
+        LayoutBlockFlow {BODY} at (8,8) size 132x134
+layer at (499,95) size 73x150
+  LayoutEmbeddedObject {object} at (451.61,0) size 73.78x150 [bgcolor=#FF0000]
+    layer at (0,0) size 74x150
+      LayoutView at (0,0) size 74x150
+    layer at (0,0) size 74x150
+      LayoutBlockFlow {HTML} at (0,0) size 74x150
+        LayoutBlockFlow {BODY} at (8,8) size 58x134
+layer at (577,208) size 37x37
+  LayoutEmbeddedObject {object} at (529.83,113) size 36.89x36.89 [bgcolor=#FF0000]
+    layer at (0,0) size 37x37
+      LayoutView at (0,0) size 37x37
+    layer at (0,0) size 37x37
+      LayoutSVGRoot {svg} at (0,0) size 37x37
+        LayoutSVGHiddenContainer {defs} at (0,0) size 0x0
+        LayoutSVGRect {rect} at (0,0) size 37x37 [fill={[type=SOLID] [color=#5588FF]}] [x=-3000.00] [y=-1000.00] [width=6200.00] [height=2200.00]
+        LayoutSVGEllipse {circle} at (0,0) size 37x37 [fill={[type=SOLID] [color=#0000FF]}] [cx=100.00] [cy=100.00] [r=100.00]
+        LayoutSVGContainer {g} at (5,11) size 27x16
+          LayoutSVGText {text} at (29,60) size 141x82 contains 1 chunk(s)
+            LayoutSVGInlineText {#text} at (0,0) size 141x82
+              chunk 1 (middle anchor) text run 1 at (29.98,125.00) startOffset 0 endOffset 3 width 140.03: "SVG"

diff --git a/third_party/WebKit/LayoutTests/platform/mac/fast/forms/textarea/basic-textareas-expected.txt b/third_party/WebKit/LayoutTests/platform/mac/fast/forms/textarea/basic-textareas-expected.txt
index 0f92dad5..21f1dea 100644
--- a/third_party/WebKit/LayoutTests/platform/mac/fast/forms/textarea/basic-textareas-expected.txt
+++ b/third_party/WebKit/LayoutTests/platform/mac/fast/forms/textarea/basic-textareas-expected.txt

@@ -223,114 +223,114 @@
     layer at (144,77) size 141x32 clip at (145,78) size 124x30 scrollHeight 69
       LayoutTextControl {TEXTAREA} at (1,15) size 141x32 [color=#545454] [bgcolor=#FFFFFF] [border: (1px solid #545454)]
         LayoutBlockFlow {DIV} at (3,3) size 120x65
-          LayoutText {#text} at (0,0) size 120x65
+          LayoutText {#text} at (0,0) size 119x65
             text run at (0,0) width 100: "Lorem ipsum  dolor"
             text run at (99,0) width 4: " "
-            text run at (0,13) width 116: "ABCDEFGHIJKLMNOP"
+            text run at (0,13) width 115: "ABCDEFGHIJKLMNOP"
             text run at (0,26) width 78: "QRSTUVWXYZ"
             text run at (77,26) width 4: " "
-            text run at (0,39) width 120: "abcdefghijklmnopqrstu"
+            text run at (0,39) width 119: "abcdefghijklmnopqrstu"
             text run at (0,52) width 6: "v"
     layer at (287,61) size 157x48 clip at (288,62) size 140x46 scrollHeight 85
       LayoutTextControl {TEXTAREA} at (1,29) size 157x48 [bgcolor=#FFFFFF] [border: (1px solid #000000)]
         LayoutBlockFlow {DIV} at (11,11) size 120x65
-          LayoutText {#text} at (0,0) size 120x65
+          LayoutText {#text} at (0,0) size 119x65
             text run at (0,0) width 100: "Lorem ipsum  dolor"
             text run at (99,0) width 4: " "
-            text run at (0,13) width 116: "ABCDEFGHIJKLMNOP"
+            text run at (0,13) width 115: "ABCDEFGHIJKLMNOP"
             text run at (0,26) width 78: "QRSTUVWXYZ"
             text run at (77,26) width 4: " "
-            text run at (0,39) width 120: "abcdefghijklmnopqrstu"
+            text run at (0,39) width 119: "abcdefghijklmnopqrstu"
             text run at (0,52) width 6: "v"
     layer at (446,81) size 137x28 clip at (447,82) size 120x26 scrollHeight 65
       LayoutTextControl {TEXTAREA} at (1,29) size 137x28 [bgcolor=#FFFFFF] [border: (1px solid #000000)]
         LayoutBlockFlow {DIV} at (1,1) size 120x65
-          LayoutText {#text} at (0,0) size 120x65
+          LayoutText {#text} at (0,0) size 119x65
             text run at (0,0) width 100: "Lorem ipsum  dolor"
             text run at (99,0) width 4: " "
-            text run at (0,13) width 116: "ABCDEFGHIJKLMNOP"
+            text run at (0,13) width 115: "ABCDEFGHIJKLMNOP"
             text run at (0,26) width 78: "QRSTUVWXYZ"
             text run at (77,26) width 4: " "
-            text run at (0,39) width 120: "abcdefghijklmnopqrstu"
+            text run at (0,39) width 119: "abcdefghijklmnopqrstu"
             text run at (0,52) width 6: "v"
     layer at (595,67) size 141x32 clip at (596,68) size 124x30 scrollHeight 69
       LayoutTextControl {TEXTAREA} at (11,39) size 141x32 [bgcolor=#FFFFFF] [border: (1px solid #000000)]
         LayoutBlockFlow {DIV} at (3,3) size 120x65
-          LayoutText {#text} at (0,0) size 120x65
+          LayoutText {#text} at (0,0) size 119x65
             text run at (0,0) width 100: "Lorem ipsum  dolor"
             text run at (99,0) width 4: " "
-            text run at (0,13) width 116: "ABCDEFGHIJKLMNOP"
+            text run at (0,13) width 115: "ABCDEFGHIJKLMNOP"
             text run at (0,26) width 78: "QRSTUVWXYZ"
             text run at (77,26) width 4: " "
-            text run at (0,39) width 120: "abcdefghijklmnopqrstu"
+            text run at (0,39) width 119: "abcdefghijklmnopqrstu"
             text run at (0,52) width 6: "v"
     layer at (1,192) size 141x32 clip at (2,193) size 124x30 scrollHeight 69
       LayoutTextControl {TEXTAREA} at (1,29) size 141x32 [bgcolor=#FFFFFF] [border: (1px solid #000000)]
         LayoutBlockFlow {DIV} at (3,3) size 120x65
-          LayoutText {#text} at (0,0) size 120x65
+          LayoutText {#text} at (0,0) size 119x65
             text run at (0,0) width 100: "Lorem ipsum  dolor"
             text run at (99,0) width 4: " "
-            text run at (0,13) width 116: "ABCDEFGHIJKLMNOP"
+            text run at (0,13) width 115: "ABCDEFGHIJKLMNOP"
             text run at (0,26) width 78: "QRSTUVWXYZ"
             text run at (77,26) width 4: " "
-            text run at (0,39) width 120: "abcdefghijklmnopqrstu"
+            text run at (0,39) width 119: "abcdefghijklmnopqrstu"
             text run at (0,52) width 6: "v"
     layer at (144,192) size 66x32 clip at (145,193) size 49x30 scrollHeight 147
       LayoutTextControl {TEXTAREA} at (1,29) size 66x32 [bgcolor=#FFFFFF] [border: (1px solid #000000)]
         LayoutBlockFlow {DIV} at (3,3) size 45x143
-          LayoutText {#text} at (0,0) size 44x143
+          LayoutText {#text} at (0,0) size 43x143
             text run at (0,0) width 33: "Lorem"
             text run at (32,0) width 4: " "
             text run at (0,13) width 32: "ipsum"
             text run at (31,13) width 7: "  "
             text run at (0,26) width 27: "dolor"
             text run at (26,26) width 4: " "
-            text run at (0,39) width 44: "ABCDEF"
+            text run at (0,39) width 43: "ABCDEF"
             text run at (0,52) width 39: "GHIJKL"
             text run at (0,65) width 42: "MNOPQ"
             text run at (0,78) width 37: "RSTUV"
             text run at (0,91) width 33: "WXYZ"
             text run at (32,91) width 4: " "
-            text run at (0,104) width 43: "abcdefg"
-            text run at (0,117) width 44: "hijklmno"
+            text run at (0,104) width 42: "abcdefg"
+            text run at (0,117) width 43: "hijklmno"
             text run at (0,130) width 40: "pqrstuv"
     layer at (226,156) size 102x68 clip at (227,157) size 85x66 scrollHeight 183
       LayoutTextControl {TEXTAREA} at (1,43) size 102x68 [bgcolor=#FFFFFF] [border: (1px solid #000000)]
         LayoutBlockFlow {DIV} at (21,21) size 45x143
-          LayoutText {#text} at (0,0) size 44x143
+          LayoutText {#text} at (0,0) size 43x143
             text run at (0,0) width 33: "Lorem"
             text run at (32,0) width 4: " "
             text run at (0,13) width 32: "ipsum"
             text run at (31,13) width 7: "  "
             text run at (0,26) width 27: "dolor"
             text run at (26,26) width 4: " "
-            text run at (0,39) width 44: "ABCDEF"
+            text run at (0,39) width 43: "ABCDEF"
             text run at (0,52) width 39: "GHIJKL"
             text run at (0,65) width 42: "MNOPQ"
             text run at (0,78) width 37: "RSTUV"
             text run at (0,91) width 33: "WXYZ"
             text run at (32,91) width 4: " "
-            text run at (0,104) width 43: "abcdefg"
-            text run at (0,117) width 44: "hijklmno"
+            text run at (0,104) width 42: "abcdefg"
+            text run at (0,117) width 43: "hijklmno"
             text run at (0,130) width 40: "pqrstuv"
     layer at (330,196) size 62x28 clip at (331,197) size 45x26 scrollHeight 143
       LayoutTextControl {TEXTAREA} at (1,43) size 62x28 [bgcolor=#FFFFFF] [border: (1px solid #000000)]
         LayoutBlockFlow {DIV} at (1,1) size 45x143
-          LayoutText {#text} at (0,0) size 44x143
+          LayoutText {#text} at (0,0) size 43x143
             text run at (0,0) width 33: "Lorem"
             text run at (32,0) width 4: " "
             text run at (0,13) width 32: "ipsum"
             text run at (31,13) width 7: "  "
             text run at (0,26) width 27: "dolor"
             text run at (26,26) width 4: " "
-            text run at (0,39) width 44: "ABCDEF"
+            text run at (0,39) width 43: "ABCDEF"
             text run at (0,52) width 39: "GHIJKL"
             text run at (0,65) width 42: "MNOPQ"
             text run at (0,78) width 37: "RSTUV"
             text run at (0,91) width 33: "WXYZ"
             text run at (32,91) width 4: " "
-            text run at (0,104) width 43: "abcdefg"
-            text run at (0,117) width 44: "hijklmno"
+            text run at (0,104) width 42: "abcdefg"
+            text run at (0,117) width 43: "hijklmno"
             text run at (0,130) width 40: "pqrstuv"
     layer at (412,158) size 141x66 clip at (413,159) size 139x64
       LayoutTextControl {TEXTAREA} at (1,29) size 141x66 [bgcolor=#FFFFFF] [border: (1px solid #000000)]
@@ -345,21 +345,21 @@
     layer at (555,158) size 66x66 clip at (556,159) size 49x64 scrollHeight 147
       LayoutTextControl {TEXTAREA} at (1,43) size 66x66 [bgcolor=#FFFFFF] [border: (1px solid #000000)]
         LayoutBlockFlow {DIV} at (3,3) size 45x143
-          LayoutText {#text} at (0,0) size 44x143
+          LayoutText {#text} at (0,0) size 43x143
             text run at (0,0) width 33: "Lorem"
             text run at (32,0) width 4: " "
             text run at (0,13) width 32: "ipsum"
             text run at (31,13) width 7: "  "
             text run at (0,26) width 27: "dolor"
             text run at (26,26) width 4: " "
-            text run at (0,39) width 44: "ABCDEF"
+            text run at (0,39) width 43: "ABCDEF"
             text run at (0,52) width 39: "GHIJKL"
             text run at (0,65) width 42: "MNOPQ"
             text run at (0,78) width 37: "RSTUV"
             text run at (0,91) width 33: "WXYZ"
             text run at (32,91) width 4: " "
-            text run at (0,104) width 43: "abcdefg"
-            text run at (0,117) width 44: "hijklmno"
+            text run at (0,104) width 42: "abcdefg"
+            text run at (0,117) width 43: "hijklmno"
             text run at (0,130) width 40: "pqrstuv"
     layer at (637,192) size 141x32 clip at (638,193) size 139x30 scrollHeight 56
       LayoutTextControl {TEXTAREA} at (1,29) size 141x32 [bgcolor=#FFFFFF] [border: (1px solid #000000)]
@@ -374,13 +374,13 @@
     layer at (1,304) size 141x47 clip at (2,305) size 124x30 scrollHeight 69
       LayoutTextControl {TEXTAREA} at (1,29) size 141x47 [bgcolor=#FFFFFF] [border: (1px solid #000000)]
         LayoutBlockFlow {DIV} at (3,3) size 120x65
-          LayoutText {#text} at (0,0) size 120x65
+          LayoutText {#text} at (0,0) size 119x65
             text run at (0,0) width 100: "Lorem ipsum  dolor"
             text run at (99,0) width 4: " "
-            text run at (0,13) width 116: "ABCDEFGHIJKLMNOP"
+            text run at (0,13) width 115: "ABCDEFGHIJKLMNOP"
             text run at (0,26) width 78: "QRSTUVWXYZ"
             text run at (77,26) width 4: " "
-            text run at (0,39) width 120: "abcdefghijklmnopqrstu"
+            text run at (0,39) width 119: "abcdefghijklmnopqrstu"
             text run at (0,52) width 6: "v"
     layer at (144,285) size 66x66 clip at (145,286) size 64x64 scrollHeight 134
       LayoutTextControl {TEXTAREA} at (1,57) size 66x66 [bgcolor=#FFFFFF] [border: (1px solid #000000)]
@@ -397,132 +397,131 @@
             text run at (0,65) width 56: "QRSTUVW"
             text run at (0,78) width 22: "XYZ"
             text run at (21,78) width 5: " "
-            text run at (0,91) width 55: "abcdefghij"
-            text run at (0,104) width 59: "klmnopqrst"
-            text run at (0,117) width 13: "uv"
+            text run at (0,91) width 60: "abcdefghijk"
+            text run at (0,104) width 59: "lmnopqrstu"
+            text run at (0,117) width 6: "v"
     layer at (226,285) size 66x66 clip at (227,286) size 49x49 scrollHeight 147
       LayoutTextControl {TEXTAREA} at (1,57) size 66x66 [bgcolor=#FFFFFF] [border: (1px solid #000000)]
         LayoutBlockFlow {DIV} at (3,3) size 45x143
-          LayoutText {#text} at (0,0) size 44x143
+          LayoutText {#text} at (0,0) size 43x143
             text run at (0,0) width 33: "Lorem"
             text run at (32,0) width 4: " "
             text run at (0,13) width 32: "ipsum"
             text run at (31,13) width 7: "  "
             text run at (0,26) width 27: "dolor"
             text run at (26,26) width 4: " "
-            text run at (0,39) width 44: "ABCDEF"
+            text run at (0,39) width 43: "ABCDEF"
             text run at (0,52) width 39: "GHIJKL"
             text run at (0,65) width 42: "MNOPQ"
             text run at (0,78) width 37: "RSTUV"
             text run at (0,91) width 33: "WXYZ"
             text run at (32,91) width 4: " "
-            text run at (0,104) width 43: "abcdefg"
-            text run at (0,117) width 44: "hijklmno"
+            text run at (0,104) width 42: "abcdefg"
+            text run at (0,117) width 43: "hijklmno"
             text run at (0,130) width 40: "pqrstuv"
     layer at (308,285) size 66x66 clip at (309,286) size 49x64 scrollHeight 147
       LayoutTextControl {TEXTAREA} at (1,43) size 66x66 [bgcolor=#FFFFFF] [border: (1px solid #000000)]
         LayoutBlockFlow {DIV} at (3,3) size 45x143
-          LayoutText {#text} at (0,0) size 44x143
+          LayoutText {#text} at (0,0) size 43x143
             text run at (0,0) width 33: "Lorem"
             text run at (32,0) width 4: " "
             text run at (0,13) width 32: "ipsum"
             text run at (31,13) width 7: "  "
             text run at (0,26) width 27: "dolor"
             text run at (26,26) width 4: " "
-            text run at (0,39) width 44: "ABCDEF"
+            text run at (0,39) width 43: "ABCDEF"
             text run at (0,52) width 39: "GHIJKL"
             text run at (0,65) width 42: "MNOPQ"
             text run at (0,78) width 37: "RSTUV"
             text run at (0,91) width 33: "WXYZ"
             text run at (32,91) width 4: " "
-            text run at (0,104) width 43: "abcdefg"
-            text run at (0,117) width 44: "hijklmno"
+            text run at (0,104) width 42: "abcdefg"
+            text run at (0,117) width 43: "hijklmno"
             text run at (0,130) width 40: "pqrstuv"
     layer at (390,285) size 66x66 clip at (391,286) size 49x64 scrollHeight 147
       LayoutTextControl {TEXTAREA} at (1,43) size 66x66 [bgcolor=#FFFFFF] [border: (1px solid #000000)]
         LayoutBlockFlow {DIV} at (3,3) size 45x143
-          LayoutText {#text} at (0,0) size 44x143
+          LayoutText {#text} at (0,0) size 43x143
             text run at (0,0) width 33: "Lorem"
             text run at (32,0) width 4: " "
             text run at (0,13) width 32: "ipsum"
             text run at (31,13) width 7: "  "
             text run at (0,26) width 27: "dolor"
             text run at (26,26) width 4: " "
-            text run at (0,39) width 44: "ABCDEF"
+            text run at (0,39) width 43: "ABCDEF"
             text run at (0,52) width 39: "GHIJKL"
             text run at (0,65) width 42: "MNOPQ"
             text run at (0,78) width 37: "RSTUV"
             text run at (0,91) width 33: "WXYZ"
             text run at (32,91) width 4: " "
-            text run at (0,104) width 43: "abcdefg"
-            text run at (0,117) width 44: "hijklmno"
+            text run at (0,104) width 42: "abcdefg"
+            text run at (0,117) width 43: "hijklmno"
             text run at (0,130) width 40: "pqrstuv"
     layer at (472,285) size 66x66 clip at (473,286) size 49x64 scrollHeight 147
       LayoutTextControl {TEXTAREA} at (1,57) size 66x66 [bgcolor=#FFFFFF] [border: (1px solid #000000)]
         LayoutBlockFlow {DIV} at (3,3) size 45x143
-          LayoutText {#text} at (0,0) size 44x143
+          LayoutText {#text} at (0,0) size 43x143
             text run at (0,0) width 33: "Lorem"
             text run at (32,0) width 4: " "
             text run at (0,13) width 32: "ipsum"
             text run at (31,13) width 7: "  "
             text run at (0,26) width 27: "dolor"
             text run at (26,26) width 4: " "
-            text run at (0,39) width 44: "ABCDEF"
+            text run at (0,39) width 43: "ABCDEF"
             text run at (0,52) width 39: "GHIJKL"
             text run at (0,65) width 42: "MNOPQ"
             text run at (0,78) width 37: "RSTUV"
             text run at (0,91) width 33: "WXYZ"
             text run at (32,91) width 4: " "
-            text run at (0,104) width 43: "abcdefg"
-            text run at (0,117) width 44: "hijklmno"
+            text run at (0,104) width 42: "abcdefg"
+            text run at (0,117) width 43: "hijklmno"
             text run at (0,130) width 40: "pqrstuv"
-    layer at (554,319) size 39x32 clip at (555,320) size 22x30 scrollHeight 394
+    layer at (554,319) size 39x32 clip at (555,320) size 22x30 scrollHeight 381
       LayoutTextControl {TEXTAREA} at (1,15) size 39x32 [bgcolor=#FFFFFF] [border: (1px solid #000000)]
-        LayoutBlockFlow {DIV} at (3,3) size 18x390
-          LayoutText {#text} at (0,0) size 18x390
+        LayoutBlockFlow {DIV} at (3,3) size 18x377
+          LayoutText {#text} at (0,0) size 18x377
             text run at (0,0) width 17: "Lor"
             text run at (0,13) width 16: "em"
             text run at (15,13) width 3: " "
-            text run at (0,26) width 16: "ips"
+            text run at (0,26) width 15: "ips"
             text run at (0,39) width 16: "um"
             text run at (0,52) width 7: "  "
-            text run at (0,65) width 17: "dol"
+            text run at (0,65) width 16: "dol"
             text run at (0,78) width 11: "or"
             text run at (10,78) width 4: " "
             text run at (0,91) width 15: "AB"
             text run at (0,104) width 16: "CD"
             text run at (0,117) width 13: "EF"
-            text run at (0,130) width 17: "GH"
-            text run at (0,143) width 17: "IJK"
+            text run at (0,130) width 16: "GH"
+            text run at (0,143) width 16: "IJK"
             text run at (0,156) width 16: "LM"
             text run at (0,169) width 17: "NO"
-            text run at (0,182) width 16: "PQ"
-            text run at (0,195) width 15: "RS"
-            text run at (0,208) width 16: "TU"
-            text run at (0,221) width 8: "V"
-            text run at (0,234) width 11: "W"
-            text run at (0,247) width 15: "XY"
-            text run at (0,260) width 8: "Z"
-            text run at (7,260) width 4: " "
-            text run at (0,273) width 13: "ab"
-            text run at (0,286) width 13: "cd"
-            text run at (0,299) width 17: "efg"
-            text run at (0,312) width 18: "hijk"
-            text run at (0,325) width 13: "lm"
-            text run at (0,338) width 13: "no"
-            text run at (0,351) width 18: "pqr"
-            text run at (0,364) width 17: "stu"
-            text run at (0,377) width 6: "v"
+            text run at (0,182) width 15: "PQ"
+            text run at (0,195) width 14: "RS"
+            text run at (0,208) width 15: "TU"
+            text run at (0,221) width 18: "VW"
+            text run at (0,234) width 15: "XY"
+            text run at (0,247) width 8: "Z"
+            text run at (7,247) width 4: " "
+            text run at (0,260) width 13: "ab"
+            text run at (0,273) width 13: "cd"
+            text run at (0,286) width 17: "efg"
+            text run at (0,299) width 18: "hijk"
+            text run at (0,312) width 12: "lm"
+            text run at (0,325) width 13: "no"
+            text run at (0,338) width 17: "pqr"
+            text run at (0,351) width 16: "stu"
+            text run at (0,364) width 6: "v"
     layer at (636,306) size 141x45 clip at (637,307) size 124x43 scrollHeight 69
       LayoutTextControl {TEXTAREA} at (1,15) size 141x45 [bgcolor=#FFFFFF] [border: (1px solid #000000)]
         LayoutBlockFlow {DIV} at (3,3) size 120x65
-          LayoutText {#text} at (0,0) size 120x65
+          LayoutText {#text} at (0,0) size 119x65
             text run at (0,0) width 100: "Lorem ipsum  dolor"
             text run at (99,0) width 4: " "
-            text run at (0,13) width 116: "ABCDEFGHIJKLMNOP"
+            text run at (0,13) width 115: "ABCDEFGHIJKLMNOP"
             text run at (0,26) width 78: "QRSTUVWXYZ"
             text run at (77,26) width 4: " "
-            text run at (0,39) width 120: "abcdefghijklmnopqrstu"
+            text run at (0,39) width 119: "abcdefghijklmnopqrstu"
             text run at (0,52) width 6: "v"
     layer at (1,435) size 63x32 clip at (2,436) size 46x30 scrollHeight 160
       LayoutTextControl {TEXTAREA} at (1,15) size 63x32 [bgcolor=#FFFFFF] [border: (1px solid #000000)]
@@ -534,16 +533,16 @@
             text run at (31,13) width 7: "  "
             text run at (0,26) width 27: "dolor"
             text run at (26,26) width 4: " "
-            text run at (0,39) width 38: "ABCDE"
+            text run at (0,39) width 37: "ABCDE"
             text run at (0,52) width 39: "FGHIJK"
-            text run at (0,65) width 40: "LMNOP"
+            text run at (0,65) width 39: "LMNOP"
             text run at (0,78) width 38: "QRSTU"
             text run at (0,91) width 41: "VWXYZ"
             text run at (40,91) width 2: " "
-            text run at (0,104) width 36: "abcdef"
-            text run at (0,117) width 37: "ghijklm"
-            text run at (0,130) width 41: "nopqrst"
-            text run at (0,143) width 13: "uv"
+            text run at (0,104) width 42: "abcdefg"
+            text run at (0,117) width 37: "hijklmn"
+            text run at (0,130) width 40: "opqrstu"
+            text run at (0,143) width 6: "v"
     layer at (83,370) size 141x97 clip at (84,371) size 139x95
       LayoutTextControl {TEXTAREA} at (1,15) size 141x97 [bgcolor=#FFFFFF] [border: (1px solid #000000)]
         LayoutBlockFlow {DIV} at (3,3) size 135x52
@@ -567,11 +566,11 @@
             text run at (0,52) width 27: "dolor"
             text run at (26,52) width 4: " "
             text run at (0,65) width 23: "ABC"
-            text run at (0,78) width 30: "DEFG"
-            text run at (0,91) width 25: "HIJK"
-            text run at (0,104) width 25: "LMN"
+            text run at (0,78) width 29: "DEFG"
+            text run at (0,91) width 24: "HIJK"
+            text run at (0,104) width 24: "LMN"
             text run at (0,117) width 24: "OPQ"
-            text run at (0,130) width 30: "RSTU"
+            text run at (0,130) width 29: "RSTU"
             text run at (0,143) width 26: "VWX"
             text run at (0,156) width 15: "YZ"
             text run at (14,156) width 4: " "
@@ -588,35 +587,35 @@
     layer at (451,435) size 141x32 clip at (452,436) size 124x30 scrollHeight 69
       LayoutTextControl {TEXTAREA} at (1,15) size 141x32 [bgcolor=#FFFFFF] [border: (1px solid #000000)]
         LayoutBlockFlow {DIV} at (3,3) size 120x65
-          LayoutText {#text} at (0,0) size 120x65
+          LayoutText {#text} at (0,0) size 119x65
             text run at (0,0) width 100: "Lorem ipsum  dolor"
             text run at (99,0) width 4: " "
-            text run at (0,13) width 116: "ABCDEFGHIJKLMNOP"
+            text run at (0,13) width 115: "ABCDEFGHIJKLMNOP"
             text run at (0,26) width 78: "QRSTUVWXYZ"
             text run at (77,26) width 4: " "
-            text run at (0,39) width 120: "abcdefghijklmnopqrstu"
+            text run at (0,39) width 119: "abcdefghijklmnopqrstu"
             text run at (0,52) width 6: "v"
     layer at (594,435) size 141x32 clip at (595,436) size 124x30 scrollHeight 69
       LayoutTextControl {TEXTAREA} at (1,15) size 141x32 [bgcolor=#FFFFFF] [border: (1px solid #000000)]
         LayoutBlockFlow {DIV} at (3,3) size 120x65
-          LayoutText {#text} at (0,0) size 120x65
+          LayoutText {#text} at (0,0) size 119x65
             text run at (0,0) width 100: "Lorem ipsum  dolor"
             text run at (99,0) width 4: " "
-            text run at (0,13) width 116: "ABCDEFGHIJKLMNOP"
+            text run at (0,13) width 115: "ABCDEFGHIJKLMNOP"
             text run at (0,26) width 78: "QRSTUVWXYZ"
             text run at (77,26) width 4: " "
-            text run at (0,39) width 120: "abcdefghijklmnopqrstu"
+            text run at (0,39) width 119: "abcdefghijklmnopqrstu"
             text run at (0,52) width 6: "v"
     layer at (1,500) size 141x32 clip at (2,501) size 124x30 scrollHeight 69
       LayoutTextControl {TEXTAREA} at (1,29) size 141x32 [bgcolor=#FFFFFF] [border: (1px solid #000000)]
         LayoutBlockFlow {DIV} at (3,3) size 120x65
-          LayoutText {#text} at (0,0) size 120x65
+          LayoutText {#text} at (0,0) size 119x65
             text run at (0,0) width 100: "Lorem ipsum  dolor"
             text run at (99,0) width 4: " "
-            text run at (0,13) width 116: "ABCDEFGHIJKLMNOP"
+            text run at (0,13) width 115: "ABCDEFGHIJKLMNOP"
             text run at (0,26) width 78: "QRSTUVWXYZ"
             text run at (77,26) width 4: " "
-            text run at (0,39) width 120: "abcdefghijklmnopqrstu"
+            text run at (0,39) width 119: "abcdefghijklmnopqrstu"
             text run at (0,52) width 6: "v"
     layer at (144,500) size 141x32 clip at (145,501) size 124x15 scrollWidth 426 scrollHeight 17
       LayoutTextControl {TEXTAREA} at (1,29) size 141x32 [bgcolor=#FFFFFF] [border: (1px solid #000000)]
@@ -626,13 +625,13 @@
     layer at (287,500) size 141x32 clip at (288,501) size 124x30 scrollHeight 69
       LayoutTextControl {TEXTAREA} at (1,29) size 141x32 [bgcolor=#FFFFFF] [border: (1px solid #000000)]
         LayoutBlockFlow {DIV} at (3,3) size 120x65
-          LayoutText {#text} at (0,0) size 120x65
+          LayoutText {#text} at (0,0) size 119x65
             text run at (0,0) width 100: "Lorem ipsum  dolor"
             text run at (99,0) width 4: " "
-            text run at (0,13) width 116: "ABCDEFGHIJKLMNOP"
+            text run at (0,13) width 115: "ABCDEFGHIJKLMNOP"
             text run at (0,26) width 78: "QRSTUVWXYZ"
             text run at (77,26) width 4: " "
-            text run at (0,39) width 120: "abcdefghijklmnopqrstu"
+            text run at (0,39) width 119: "abcdefghijklmnopqrstu"
             text run at (0,52) width 6: "v"
     layer at (430,500) size 141x32 clip at (431,501) size 124x15 scrollWidth 426 scrollHeight 17
       LayoutTextControl {TEXTAREA} at (1,29) size 141x32 [bgcolor=#FFFFFF] [border: (1px solid #000000)]
@@ -642,13 +641,13 @@
     layer at (573,500) size 141x32 clip at (574,501) size 124x30 scrollHeight 69
       LayoutTextControl {TEXTAREA} at (1,29) size 141x32 [bgcolor=#FFFFFF] [border: (1px solid #000000)]
         LayoutBlockFlow {DIV} at (3,3) size 120x65
-          LayoutText {#text} at (0,0) size 120x65
+          LayoutText {#text} at (0,0) size 119x65
             text run at (0,0) width 100: "Lorem ipsum  dolor"
             text run at (99,0) width 4: " "
-            text run at (0,13) width 116: "ABCDEFGHIJKLMNOP"
+            text run at (0,13) width 115: "ABCDEFGHIJKLMNOP"
             text run at (0,26) width 78: "QRSTUVWXYZ"
             text run at (77,26) width 4: " "
-            text run at (0,39) width 120: "abcdefghijklmnopqrstu"
+            text run at (0,39) width 119: "abcdefghijklmnopqrstu"
             text run at (0,52) width 6: "v"
     layer at (1,593) size 141x47 clip at (2,594) size 124x30 scrollWidth 195 scrollHeight 43
       LayoutTextControl {TEXTAREA} at (1,29) size 141x47 [bgcolor=#FFFFFF] [border: (1px solid #000000)]
@@ -885,57 +884,57 @@
     layer at (144,77) size 141x32 clip at (145,78) size 124x30 scrollHeight 69
       LayoutTextControl {TEXTAREA} at (1,15) size 141x32 [color=#545454] [bgcolor=#FFFFFF] [border: (1px solid #545454)]
         LayoutBlockFlow {DIV} at (3,3) size 120x65
-          LayoutText {#text} at (0,0) size 120x65
+          LayoutText {#text} at (0,0) size 119x65
             text run at (0,0) width 100: "Lorem ipsum  dolor"
             text run at (99,0) width 4: " "
-            text run at (0,13) width 116: "ABCDEFGHIJKLMNOP"
+            text run at (0,13) width 115: "ABCDEFGHIJKLMNOP"
             text run at (0,26) width 78: "QRSTUVWXYZ"
             text run at (77,26) width 4: " "
-            text run at (0,39) width 120: "abcdefghijklmnopqrstu"
+            text run at (0,39) width 119: "abcdefghijklmnopqrstu"
             text run at (0,52) width 6: "v"
     layer at (287,61) size 157x48 clip at (288,62) size 140x46 scrollHeight 85
       LayoutTextControl {TEXTAREA} at (1,29) size 157x48 [bgcolor=#FFFFFF] [border: (1px solid #000000)]
         LayoutBlockFlow {DIV} at (11,11) size 120x65
-          LayoutText {#text} at (0,0) size 120x65
+          LayoutText {#text} at (0,0) size 119x65
             text run at (0,0) width 100: "Lorem ipsum  dolor"
             text run at (99,0) width 4: " "
-            text run at (0,13) width 116: "ABCDEFGHIJKLMNOP"
+            text run at (0,13) width 115: "ABCDEFGHIJKLMNOP"
             text run at (0,26) width 78: "QRSTUVWXYZ"
             text run at (77,26) width 4: " "
-            text run at (0,39) width 120: "abcdefghijklmnopqrstu"
+            text run at (0,39) width 119: "abcdefghijklmnopqrstu"
             text run at (0,52) width 6: "v"
     layer at (446,81) size 137x28 clip at (447,82) size 120x26 scrollHeight 65
       LayoutTextControl {TEXTAREA} at (1,29) size 137x28 [bgcolor=#FFFFFF] [border: (1px solid #000000)]
         LayoutBlockFlow {DIV} at (1,1) size 120x65
-          LayoutText {#text} at (0,0) size 120x65
+          LayoutText {#text} at (0,0) size 119x65
             text run at (0,0) width 100: "Lorem ipsum  dolor"
             text run at (99,0) width 4: " "
-            text run at (0,13) width 116: "ABCDEFGHIJKLMNOP"
+            text run at (0,13) width 115: "ABCDEFGHIJKLMNOP"
             text run at (0,26) width 78: "QRSTUVWXYZ"
             text run at (77,26) width 4: " "
-            text run at (0,39) width 120: "abcdefghijklmnopqrstu"
+            text run at (0,39) width 119: "abcdefghijklmnopqrstu"
             text run at (0,52) width 6: "v"
     layer at (595,67) size 141x32 clip at (596,68) size 124x30 scrollHeight 69
       LayoutTextControl {TEXTAREA} at (11,39) size 141x32 [bgcolor=#FFFFFF] [border: (1px solid #000000)]
         LayoutBlockFlow {DIV} at (3,3) size 120x65
-          LayoutText {#text} at (0,0) size 120x65
+          LayoutText {#text} at (0,0) size 119x65
             text run at (0,0) width 100: "Lorem ipsum  dolor"
             text run at (99,0) width 4: " "
-            text run at (0,13) width 116: "ABCDEFGHIJKLMNOP"
+            text run at (0,13) width 115: "ABCDEFGHIJKLMNOP"
             text run at (0,26) width 78: "QRSTUVWXYZ"
             text run at (77,26) width 4: " "
-            text run at (0,39) width 120: "abcdefghijklmnopqrstu"
+            text run at (0,39) width 119: "abcdefghijklmnopqrstu"
             text run at (0,52) width 6: "v"
     layer at (1,189) size 141x32 clip at (2,190) size 124x30 scrollHeight 69
       LayoutTextControl {TEXTAREA} at (1,29) size 141x32 [bgcolor=#FFFFFF] [border: (1px solid #000000)]
         LayoutBlockFlow {DIV} at (3,3) size 120x65
-          LayoutText {#text} at (0,0) size 120x65
+          LayoutText {#text} at (0,0) size 119x65
             text run at (0,0) width 100: "Lorem ipsum  dolor"
             text run at (99,0) width 4: " "
-            text run at (0,13) width 116: "ABCDEFGHIJKLMNOP"
+            text run at (0,13) width 115: "ABCDEFGHIJKLMNOP"
             text run at (0,26) width 78: "QRSTUVWXYZ"
             text run at (77,26) width 4: " "
-            text run at (0,39) width 120: "abcdefghijklmnopqrstu"
+            text run at (0,39) width 119: "abcdefghijklmnopqrstu"
             text run at (0,52) width 6: "v"
     layer at (144,189) size 60x32 clip at (145,190) size 43x30 scrollHeight 173
       LayoutTextControl {TEXTAREA} at (1,29) size 60x32 [bgcolor=#FFFFFF] [border: (1px solid #000000)]
@@ -947,16 +946,16 @@
             text run at (31,13) width 7: "  "
             text run at (0,26) width 27: "dolor"
             text run at (26,26) width 4: " "
-            text run at (0,39) width 38: "ABCDE"
+            text run at (0,39) width 37: "ABCDE"
             text run at (0,52) width 39: "FGHIJK"
-            text run at (0,65) width 33: "LMNO"
-            text run at (0,78) width 37: "PQRST"
-            text run at (0,91) width 34: "UVWX"
-            text run at (0,104) width 15: "YZ"
-            text run at (14,104) width 4: " "
+            text run at (0,65) width 39: "LMNOP"
+            text run at (0,78) width 38: "QRSTU"
+            text run at (0,91) width 33: "VWXY"
+            text run at (0,104) width 8: "Z"
+            text run at (7,104) width 4: " "
             text run at (0,117) width 36: "abcdef"
             text run at (0,130) width 37: "ghijklm"
-            text run at (0,143) width 37: "nopqrs"
+            text run at (0,143) width 36: "nopqrs"
             text run at (0,156) width 17: "tuv"
     layer at (226,153) size 60x68 clip at (227,154) size 43x66 scrollHeight 924
       LayoutTextControl {TEXTAREA} at (1,43) size 60x68 [bgcolor=#FFFFFF] [border: (1px solid #000000)]
@@ -1030,26 +1029,25 @@
             text run at (0,845) width 4: "t"
             text run at (0,858) width 7: "u"
             text run at (0,871) width 6: "v"
-    layer at (308,193) size 60x28 clip at (309,194) size 43x26 scrollHeight 156
+    layer at (308,193) size 60x28 clip at (309,194) size 43x26 scrollHeight 143
       LayoutTextControl {TEXTAREA} at (1,43) size 60x28 [bgcolor=#FFFFFF] [border: (1px solid #000000)]
-        LayoutBlockFlow {DIV} at (1,1) size 43x156
-          LayoutText {#text} at (0,0) size 43x156
+        LayoutBlockFlow {DIV} at (1,1) size 43x143
+          LayoutText {#text} at (0,0) size 43x143
             text run at (0,0) width 33: "Lorem"
             text run at (32,0) width 4: " "
             text run at (0,13) width 32: "ipsum"
             text run at (31,13) width 7: "  "
             text run at (0,26) width 27: "dolor"
             text run at (26,26) width 4: " "
-            text run at (0,39) width 38: "ABCDE"
-            text run at (0,52) width 39: "FGHIJK"
-            text run at (0,65) width 40: "LMNOP"
-            text run at (0,78) width 38: "QRSTU"
-            text run at (0,91) width 41: "VWXYZ"
-            text run at (40,91) width 3: " "
-            text run at (0,104) width 43: "abcdefg"
-            text run at (0,117) width 37: "hijklmn"
-            text run at (0,130) width 41: "opqrstu"
-            text run at (0,143) width 6: "v"
+            text run at (0,39) width 43: "ABCDEF"
+            text run at (0,52) width 39: "GHIJKL"
+            text run at (0,65) width 42: "MNOPQ"
+            text run at (0,78) width 37: "RSTUV"
+            text run at (0,91) width 33: "WXYZ"
+            text run at (32,91) width 4: " "
+            text run at (0,104) width 42: "abcdefg"
+            text run at (0,117) width 43: "hijklmno"
+            text run at (0,130) width 40: "pqrstuv"
     layer at (390,161) size 141x60 clip at (391,162) size 139x58
       LayoutTextControl {TEXTAREA} at (1,29) size 141x60 [bgcolor=#FFFFFF] [border: (1px solid #000000)]
         LayoutBlockFlow {DIV} at (3,3) size 135x52
@@ -1070,16 +1068,16 @@
             text run at (31,13) width 7: "  "
             text run at (0,26) width 27: "dolor"
             text run at (26,26) width 4: " "
-            text run at (0,39) width 38: "ABCDE"
+            text run at (0,39) width 37: "ABCDE"
             text run at (0,52) width 39: "FGHIJK"
-            text run at (0,65) width 33: "LMNO"
-            text run at (0,78) width 37: "PQRST"
-            text run at (0,91) width 34: "UVWX"
-            text run at (0,104) width 15: "YZ"
-            text run at (14,104) width 4: " "
+            text run at (0,65) width 39: "LMNOP"
+            text run at (0,78) width 38: "QRSTU"
+            text run at (0,91) width 33: "VWXY"
+            text run at (0,104) width 8: "Z"
+            text run at (7,104) width 4: " "
             text run at (0,117) width 36: "abcdef"
             text run at (0,130) width 37: "ghijklm"
-            text run at (0,143) width 37: "nopqrs"
+            text run at (0,143) width 36: "nopqrs"
             text run at (0,156) width 17: "tuv"
     layer at (615,189) size 141x32 clip at (616,190) size 139x30 scrollHeight 56
       LayoutTextControl {TEXTAREA} at (1,29) size 141x32 [bgcolor=#FFFFFF] [border: (1px solid #000000)]
@@ -1094,13 +1092,13 @@
     layer at (1,292) size 141x47 clip at (2,293) size 124x30 scrollHeight 69
       LayoutTextControl {TEXTAREA} at (1,29) size 141x47 [bgcolor=#FFFFFF] [border: (1px solid #000000)]
         LayoutBlockFlow {DIV} at (3,3) size 120x65
-          LayoutText {#text} at (0,0) size 120x65
+          LayoutText {#text} at (0,0) size 119x65
             text run at (0,0) width 100: "Lorem ipsum  dolor"
             text run at (99,0) width 4: " "
-            text run at (0,13) width 116: "ABCDEFGHIJKLMNOP"
+            text run at (0,13) width 115: "ABCDEFGHIJKLMNOP"
             text run at (0,26) width 78: "QRSTUVWXYZ"
             text run at (77,26) width 4: " "
-            text run at (0,39) width 120: "abcdefghijklmnopqrstu"
+            text run at (0,39) width 119: "abcdefghijklmnopqrstu"
             text run at (0,52) width 6: "v"
     layer at (144,279) size 60x60 clip at (145,280) size 58x58 scrollHeight 134
       LayoutTextControl {TEXTAREA} at (1,57) size 60x60 [bgcolor=#FFFFFF] [border: (1px solid #000000)]
@@ -1113,13 +1111,13 @@
             text run at (0,26) width 27: "dolor"
             text run at (26,26) width 4: " "
             text run at (0,39) width 52: "ABCDEFG"
-            text run at (0,52) width 49: "HIJKLMN"
-            text run at (0,65) width 54: "OPQRSTU"
+            text run at (0,52) width 48: "HIJKLMN"
+            text run at (0,65) width 53: "OPQRSTU"
             text run at (0,78) width 41: "VWXYZ"
             text run at (40,78) width 4: " "
-            text run at (0,91) width 52: "abcdefghi"
-            text run at (0,104) width 52: "jklmnopqr"
-            text run at (0,117) width 23: "stuv"
+            text run at (0,91) width 54: "abcdefghij"
+            text run at (0,104) width 54: "klmnopqrs"
+            text run at (0,117) width 17: "tuv"
     layer at (226,279) size 60x60 clip at (227,280) size 43x43 scrollHeight 173
       LayoutTextControl {TEXTAREA} at (1,57) size 60x60 [bgcolor=#FFFFFF] [border: (1px solid #000000)]
         LayoutBlockFlow {DIV} at (3,3) size 39x169
@@ -1130,16 +1128,16 @@
             text run at (31,13) width 7: "  "
             text run at (0,26) width 27: "dolor"
             text run at (26,26) width 4: " "
-            text run at (0,39) width 38: "ABCDE"
+            text run at (0,39) width 37: "ABCDE"
             text run at (0,52) width 39: "FGHIJK"
-            text run at (0,65) width 33: "LMNO"
-            text run at (0,78) width 37: "PQRST"
-            text run at (0,91) width 34: "UVWX"
-            text run at (0,104) width 15: "YZ"
-            text run at (14,104) width 4: " "
+            text run at (0,65) width 39: "LMNOP"
+            text run at (0,78) width 38: "QRSTU"
+            text run at (0,91) width 33: "VWXY"
+            text run at (0,104) width 8: "Z"
+            text run at (7,104) width 4: " "
             text run at (0,117) width 36: "abcdef"
             text run at (0,130) width 37: "ghijklm"
-            text run at (0,143) width 37: "nopqrs"
+            text run at (0,143) width 36: "nopqrs"
             text run at (0,156) width 17: "tuv"
     layer at (308,279) size 60x60 clip at (309,280) size 43x58 scrollHeight 173
       LayoutTextControl {TEXTAREA} at (1,43) size 60x60 [bgcolor=#FFFFFF] [border: (1px solid #000000)]
@@ -1151,16 +1149,16 @@
             text run at (31,13) width 7: "  "
             text run at (0,26) width 27: "dolor"
             text run at (26,26) width 4: " "
-            text run at (0,39) width 38: "ABCDE"
+            text run at (0,39) width 37: "ABCDE"
             text run at (0,52) width 39: "FGHIJK"
-            text run at (0,65) width 33: "LMNO"
-            text run at (0,78) width 37: "PQRST"
-            text run at (0,91) width 34: "UVWX"
-            text run at (0,104) width 15: "YZ"
-            text run at (14,104) width 4: " "
+            text run at (0,65) width 39: "LMNOP"
+            text run at (0,78) width 38: "QRSTU"
+            text run at (0,91) width 33: "VWXY"
+            text run at (0,104) width 8: "Z"
+            text run at (7,104) width 4: " "
             text run at (0,117) width 36: "abcdef"
             text run at (0,130) width 37: "ghijklm"
-            text run at (0,143) width 37: "nopqrs"
+            text run at (0,143) width 36: "nopqrs"
             text run at (0,156) width 17: "tuv"
     layer at (390,279) size 60x60 clip at (391,280) size 43x58 scrollHeight 173
       LayoutTextControl {TEXTAREA} at (1,43) size 60x60 [bgcolor=#FFFFFF] [border: (1px solid #000000)]
@@ -1172,16 +1170,16 @@
             text run at (31,13) width 7: "  "
             text run at (0,26) width 27: "dolor"
             text run at (26,26) width 4: " "
-            text run at (0,39) width 38: "ABCDE"
+            text run at (0,39) width 37: "ABCDE"
             text run at (0,52) width 39: "FGHIJK"
-            text run at (0,65) width 33: "LMNO"
-            text run at (0,78) width 37: "PQRST"
-            text run at (0,91) width 34: "UVWX"
-            text run at (0,104) width 15: "YZ"
-            text run at (14,104) width 4: " "
+            text run at (0,65) width 39: "LMNOP"
+            text run at (0,78) width 38: "QRSTU"
+            text run at (0,91) width 33: "VWXY"
+            text run at (0,104) width 8: "Z"
+            text run at (7,104) width 4: " "
             text run at (0,117) width 36: "abcdef"
             text run at (0,130) width 37: "ghijklm"
-            text run at (0,143) width 37: "nopqrs"
+            text run at (0,143) width 36: "nopqrs"
             text run at (0,156) width 17: "tuv"
     layer at (472,279) size 60x60 clip at (473,280) size 43x58 scrollHeight 173
       LayoutTextControl {TEXTAREA} at (1,57) size 60x60 [bgcolor=#FFFFFF] [border: (1px solid #000000)]
@@ -1193,64 +1191,63 @@
             text run at (31,13) width 7: "  "
             text run at (0,26) width 27: "dolor"
             text run at (26,26) width 4: " "
-            text run at (0,39) width 38: "ABCDE"
+            text run at (0,39) width 37: "ABCDE"
             text run at (0,52) width 39: "FGHIJK"
-            text run at (0,65) width 33: "LMNO"
-            text run at (0,78) width 37: "PQRST"
-            text run at (0,91) width 34: "UVWX"
-            text run at (0,104) width 15: "YZ"
-            text run at (14,104) width 4: " "
+            text run at (0,65) width 39: "LMNOP"
+            text run at (0,78) width 38: "QRSTU"
+            text run at (0,91) width 33: "VWXY"
+            text run at (0,104) width 8: "Z"
+            text run at (7,104) width 4: " "
             text run at (0,117) width 36: "abcdef"
             text run at (0,130) width 37: "ghijklm"
-            text run at (0,143) width 37: "nopqrs"
+            text run at (0,143) width 36: "nopqrs"
             text run at (0,156) width 17: "tuv"
-    layer at (554,307) size 39x32 clip at (555,308) size 22x30 scrollHeight 394
+    layer at (554,307) size 39x32 clip at (555,308) size 22x30 scrollHeight 381
       LayoutTextControl {TEXTAREA} at (1,15) size 39x32 [bgcolor=#FFFFFF] [border: (1px solid #000000)]
-        LayoutBlockFlow {DIV} at (3,3) size 18x390
-          LayoutText {#text} at (0,0) size 18x390
+        LayoutBlockFlow {DIV} at (3,3) size 18x377
+          LayoutText {#text} at (0,0) size 18x377
             text run at (0,0) width 17: "Lor"
             text run at (0,13) width 16: "em"
             text run at (15,13) width 3: " "
-            text run at (0,26) width 16: "ips"
+            text run at (0,26) width 15: "ips"
             text run at (0,39) width 16: "um"
             text run at (0,52) width 7: "  "
-            text run at (0,65) width 17: "dol"
+            text run at (0,65) width 16: "dol"
             text run at (0,78) width 11: "or"
             text run at (10,78) width 4: " "
             text run at (0,91) width 15: "AB"
             text run at (0,104) width 16: "CD"
             text run at (0,117) width 13: "EF"
-            text run at (0,130) width 17: "GH"
-            text run at (0,143) width 17: "IJK"
+            text run at (0,130) width 16: "GH"
+            text run at (0,143) width 16: "IJK"
             text run at (0,156) width 16: "LM"
             text run at (0,169) width 17: "NO"
-            text run at (0,182) width 16: "PQ"
-            text run at (0,195) width 15: "RS"
-            text run at (0,208) width 16: "TU"
-            text run at (0,221) width 8: "V"
-            text run at (0,234) width 11: "W"
-            text run at (0,247) width 15: "XY"
-            text run at (0,260) width 8: "Z"
-            text run at (7,260) width 4: " "
-            text run at (0,273) width 13: "ab"
-            text run at (0,286) width 13: "cd"
-            text run at (0,299) width 17: "efg"
-            text run at (0,312) width 18: "hijk"
-            text run at (0,325) width 13: "lm"
-            text run at (0,338) width 13: "no"
-            text run at (0,351) width 18: "pqr"
-            text run at (0,364) width 17: "stu"
-            text run at (0,377) width 6: "v"
+            text run at (0,182) width 15: "PQ"
+            text run at (0,195) width 14: "RS"
+            text run at (0,208) width 15: "TU"
+            text run at (0,221) width 18: "VW"
+            text run at (0,234) width 15: "XY"
+            text run at (0,247) width 8: "Z"
+            text run at (7,247) width 4: " "
+            text run at (0,260) width 13: "ab"
+            text run at (0,273) width 13: "cd"
+            text run at (0,286) width 17: "efg"
+            text run at (0,299) width 18: "hijk"
+            text run at (0,312) width 12: "lm"
+            text run at (0,325) width 13: "no"
+            text run at (0,338) width 17: "pqr"
+            text run at (0,351) width 16: "stu"
+            text run at (0,364) width 6: "v"
     layer at (636,294) size 141x45 clip at (637,295) size 124x43 scrollHeight 69
       LayoutTextControl {TEXTAREA} at (1,15) size 141x45 [bgcolor=#FFFFFF] [border: (1px solid #000000)]
         LayoutBlockFlow {DIV} at (3,3) size 120x65
-          LayoutText {#text} at (0,0) size 120x65
+          LayoutText {#text} at (0,0) size 119x65
             text run at (0,0) width 100: "Lorem ipsum  dolor"
             text run at (99,0) width 4: " "
-            text run at (0,13) width 116: "ABCDEFGHIJKLMNOP"
+            text run at (0,13) width 115: "ABCDEFGHIJKLMNOP"
             text run at (0,26) width 78: "QRSTUVWXYZ"
             text run at (77,26) width 4: " "
-            text run at (0,39) width 120: "abcdefghijklmnopqrstu"
+            text run at (0,39) width 119: "abcdefghijklmnopqrstu"
             text run at (0,52) width 6: "v"
     layer at (1,420) size 63x32 clip at (2,421) size 46x30 scrollHeight 160
       LayoutTextControl {TEXTAREA} at (1,15) size 63x32 [bgcolor=#FFFFFF] [border: (1px solid #000000)]
@@ -1262,16 +1259,16 @@
             text run at (31,13) width 7: "  "
             text run at (0,26) width 27: "dolor"
             text run at (26,26) width 4: " "
-            text run at (0,39) width 38: "ABCDE"
+            text run at (0,39) width 37: "ABCDE"
             text run at (0,52) width 39: "FGHIJK"
-            text run at (0,65) width 40: "LMNOP"
+            text run at (0,65) width 39: "LMNOP"
             text run at (0,78) width 38: "QRSTU"
             text run at (0,91) width 41: "VWXYZ"
             text run at (40,91) width 2: " "
-            text run at (0,104) width 36: "abcdef"
-            text run at (0,117) width 37: "ghijklm"
-            text run at (0,130) width 41: "nopqrst"
-            text run at (0,143) width 13: "uv"
+            text run at (0,104) width 42: "abcdefg"
+            text run at (0,117) width 37: "hijklmn"
+            text run at (0,130) width 40: "opqrstu"
+            text run at (0,143) width 6: "v"
     layer at (83,355) size 141x97 clip at (84,356) size 139x95
       LayoutTextControl {TEXTAREA} at (1,15) size 141x97 [bgcolor=#FFFFFF] [border: (1px solid #000000)]
         LayoutBlockFlow {DIV} at (3,3) size 135x52
@@ -1295,11 +1292,11 @@
             text run at (0,52) width 27: "dolor"
             text run at (26,52) width 4: " "
             text run at (0,65) width 23: "ABC"
-            text run at (0,78) width 30: "DEFG"
-            text run at (0,91) width 25: "HIJK"
-            text run at (0,104) width 25: "LMN"
+            text run at (0,78) width 29: "DEFG"
+            text run at (0,91) width 24: "HIJK"
+            text run at (0,104) width 24: "LMN"
             text run at (0,117) width 24: "OPQ"
-            text run at (0,130) width 30: "RSTU"
+            text run at (0,130) width 29: "RSTU"
             text run at (0,143) width 26: "VWX"
             text run at (0,156) width 15: "YZ"
             text run at (14,156) width 4: " "
@@ -1316,35 +1313,35 @@
     layer at (451,420) size 141x32 clip at (452,421) size 124x30 scrollHeight 69
       LayoutTextControl {TEXTAREA} at (1,15) size 141x32 [bgcolor=#FFFFFF] [border: (1px solid #000000)]
         LayoutBlockFlow {DIV} at (3,3) size 120x65
-          LayoutText {#text} at (0,0) size 120x65
+          LayoutText {#text} at (0,0) size 119x65
             text run at (0,0) width 100: "Lorem ipsum  dolor"
             text run at (99,0) width 4: " "
-            text run at (0,13) width 116: "ABCDEFGHIJKLMNOP"
+            text run at (0,13) width 115: "ABCDEFGHIJKLMNOP"
             text run at (0,26) width 78: "QRSTUVWXYZ"
             text run at (77,26) width 4: " "
-            text run at (0,39) width 120: "abcdefghijklmnopqrstu"
+            text run at (0,39) width 119: "abcdefghijklmnopqrstu"
             text run at (0,52) width 6: "v"
     layer at (594,420) size 141x32 clip at (595,421) size 124x30 scrollHeight 69
       LayoutTextControl {TEXTAREA} at (1,15) size 141x32 [bgcolor=#FFFFFF] [border: (1px solid #000000)]
         LayoutBlockFlow {DIV} at (3,3) size 120x65
-          LayoutText {#text} at (0,0) size 120x65
+          LayoutText {#text} at (0,0) size 119x65
             text run at (0,0) width 100: "Lorem ipsum  dolor"
             text run at (99,0) width 4: " "
-            text run at (0,13) width 116: "ABCDEFGHIJKLMNOP"
+            text run at (0,13) width 115: "ABCDEFGHIJKLMNOP"
             text run at (0,26) width 78: "QRSTUVWXYZ"
             text run at (77,26) width 4: " "
-            text run at (0,39) width 120: "abcdefghijklmnopqrstu"
+            text run at (0,39) width 119: "abcdefghijklmnopqrstu"
             text run at (0,52) width 6: "v"
     layer at (1,482) size 141x32 clip at (2,483) size 124x30 scrollHeight 69
       LayoutTextControl {TEXTAREA} at (1,29) size 141x32 [bgcolor=#FFFFFF] [border: (1px solid #000000)]
         LayoutBlockFlow {DIV} at (3,3) size 120x65
-          LayoutText {#text} at (0,0) size 120x65
+          LayoutText {#text} at (0,0) size 119x65
             text run at (0,0) width 100: "Lorem ipsum  dolor"
             text run at (99,0) width 4: " "
-            text run at (0,13) width 116: "ABCDEFGHIJKLMNOP"
+            text run at (0,13) width 115: "ABCDEFGHIJKLMNOP"
             text run at (0,26) width 78: "QRSTUVWXYZ"
             text run at (77,26) width 4: " "
-            text run at (0,39) width 120: "abcdefghijklmnopqrstu"
+            text run at (0,39) width 119: "abcdefghijklmnopqrstu"
             text run at (0,52) width 6: "v"
     layer at (144,482) size 141x32 clip at (145,483) size 124x15 scrollWidth 426 scrollHeight 17
       LayoutTextControl {TEXTAREA} at (1,29) size 141x32 [bgcolor=#FFFFFF] [border: (1px solid #000000)]
@@ -1354,13 +1351,13 @@
     layer at (287,482) size 141x32 clip at (288,483) size 124x30 scrollHeight 69
       LayoutTextControl {TEXTAREA} at (1,29) size 141x32 [bgcolor=#FFFFFF] [border: (1px solid #000000)]
         LayoutBlockFlow {DIV} at (3,3) size 120x65
-          LayoutText {#text} at (0,0) size 120x65
+          LayoutText {#text} at (0,0) size 119x65
             text run at (0,0) width 100: "Lorem ipsum  dolor"
             text run at (99,0) width 4: " "
-            text run at (0,13) width 116: "ABCDEFGHIJKLMNOP"
+            text run at (0,13) width 115: "ABCDEFGHIJKLMNOP"
             text run at (0,26) width 78: "QRSTUVWXYZ"
             text run at (77,26) width 4: " "
-            text run at (0,39) width 120: "abcdefghijklmnopqrstu"
+            text run at (0,39) width 119: "abcdefghijklmnopqrstu"
             text run at (0,52) width 6: "v"
     layer at (430,482) size 141x32 clip at (431,483) size 124x15 scrollWidth 426 scrollHeight 17
       LayoutTextControl {TEXTAREA} at (1,29) size 141x32 [bgcolor=#FFFFFF] [border: (1px solid #000000)]
@@ -1370,13 +1367,13 @@
     layer at (573,482) size 141x32 clip at (574,483) size 124x30 scrollHeight 69
       LayoutTextControl {TEXTAREA} at (1,29) size 141x32 [bgcolor=#FFFFFF] [border: (1px solid #000000)]
         LayoutBlockFlow {DIV} at (3,3) size 120x65
-          LayoutText {#text} at (0,0) size 120x65
+          LayoutText {#text} at (0,0) size 119x65
             text run at (0,0) width 100: "Lorem ipsum  dolor"
             text run at (99,0) width 4: " "
-            text run at (0,13) width 116: "ABCDEFGHIJKLMNOP"
+            text run at (0,13) width 115: "ABCDEFGHIJKLMNOP"
             text run at (0,26) width 78: "QRSTUVWXYZ"
             text run at (77,26) width 4: " "
-            text run at (0,39) width 120: "abcdefghijklmnopqrstu"
+            text run at (0,39) width 119: "abcdefghijklmnopqrstu"
             text run at (0,52) width 6: "v"
     layer at (1,572) size 141x47 clip at (2,573) size 124x30 scrollWidth 195 scrollHeight 43
       LayoutTextControl {TEXTAREA} at (1,29) size 141x47 [bgcolor=#FFFFFF] [border: (1px solid #000000)]

diff --git a/third_party/WebKit/LayoutTests/platform/mac/fast/forms/textarea/basic-textareas-quirks-expected.txt b/third_party/WebKit/LayoutTests/platform/mac/fast/forms/textarea/basic-textareas-quirks-expected.txt
index 87233ca..331c050 100644
--- a/third_party/WebKit/LayoutTests/platform/mac/fast/forms/textarea/basic-textareas-quirks-expected.txt
+++ b/third_party/WebKit/LayoutTests/platform/mac/fast/forms/textarea/basic-textareas-quirks-expected.txt

@@ -232,123 +232,122 @@
 layer at (24,75) size 141x32 clip at (25,76) size 124x30 scrollHeight 69
   LayoutTextControl {TEXTAREA} at (14.61,1) size 141x32 [bgcolor=#FFFFFF] [border: (1px solid #000000)]
     LayoutBlockFlow {DIV} at (3,3) size 120x65
-      LayoutText {#text} at (0,0) size 120x65
+      LayoutText {#text} at (0,0) size 119x65
         text run at (0,0) width 97: "Lorem ipsum dolor"
         text run at (96,0) width 4: " "
-        text run at (0,13) width 116: "ABCDEFGHIJKLMNOP"
+        text run at (0,13) width 115: "ABCDEFGHIJKLMNOP"
         text run at (0,26) width 78: "QRSTUVWXYZ"
         text run at (77,26) width 4: " "
-        text run at (0,39) width 120: "abcdefghijklmnopqrstu"
+        text run at (0,39) width 119: "abcdefghijklmnopqrstu"
         text run at (0,52) width 6: "v"
         text run at (5,52) width 5: " "
 layer at (24,126) size 141x32 clip at (25,127) size 124x30 scrollHeight 69
   LayoutTextControl {TEXTAREA} at (14.61,1) size 141x32 [color=#545454] [bgcolor=#FFFFFF] [border: (1px solid #545454)]
     LayoutBlockFlow {DIV} at (3,3) size 120x65
-      LayoutText {#text} at (0,0) size 120x65
+      LayoutText {#text} at (0,0) size 119x65
         text run at (0,0) width 97: "Lorem ipsum dolor"
         text run at (96,0) width 4: " "
-        text run at (0,13) width 116: "ABCDEFGHIJKLMNOP"
+        text run at (0,13) width 115: "ABCDEFGHIJKLMNOP"
         text run at (0,26) width 78: "QRSTUVWXYZ"
         text run at (77,26) width 4: " "
-        text run at (0,39) width 120: "abcdefghijklmnopqrstu"
+        text run at (0,39) width 119: "abcdefghijklmnopqrstu"
         text run at (0,52) width 6: "v"
         text run at (5,52) width 5: " "
 layer at (24,177) size 157x48 clip at (25,178) size 140x46 scrollHeight 85
   LayoutTextControl {TEXTAREA} at (14.61,1) size 157x48 [bgcolor=#FFFFFF] [border: (1px solid #000000)]
     LayoutBlockFlow {DIV} at (11,11) size 120x65
-      LayoutText {#text} at (0,0) size 120x65
+      LayoutText {#text} at (0,0) size 119x65
         text run at (0,0) width 97: "Lorem ipsum dolor"
         text run at (96,0) width 4: " "
-        text run at (0,13) width 116: "ABCDEFGHIJKLMNOP"
+        text run at (0,13) width 115: "ABCDEFGHIJKLMNOP"
         text run at (0,26) width 78: "QRSTUVWXYZ"
         text run at (77,26) width 4: " "
-        text run at (0,39) width 120: "abcdefghijklmnopqrstu"
+        text run at (0,39) width 119: "abcdefghijklmnopqrstu"
         text run at (0,52) width 6: "v"
         text run at (5,52) width 5: " "
 layer at (24,244) size 137x28 clip at (25,245) size 120x26 scrollHeight 65
   LayoutTextControl {TEXTAREA} at (14.61,1) size 137x28 [bgcolor=#FFFFFF] [border: (1px solid #000000)]
     LayoutBlockFlow {DIV} at (1,1) size 120x65
-      LayoutText {#text} at (0,0) size 120x65
+      LayoutText {#text} at (0,0) size 119x65
         text run at (0,0) width 97: "Lorem ipsum dolor"
         text run at (96,0) width 4: " "
-        text run at (0,13) width 116: "ABCDEFGHIJKLMNOP"
+        text run at (0,13) width 115: "ABCDEFGHIJKLMNOP"
         text run at (0,26) width 78: "QRSTUVWXYZ"
         text run at (77,26) width 4: " "
-        text run at (0,39) width 120: "abcdefghijklmnopqrstu"
+        text run at (0,39) width 119: "abcdefghijklmnopqrstu"
         text run at (0,52) width 6: "v"
         text run at (5,52) width 5: " "
 layer at (34,301) size 141x32 clip at (35,302) size 124x30 scrollHeight 69
   LayoutTextControl {TEXTAREA} at (24.61,11) size 141x32 [bgcolor=#FFFFFF] [border: (1px solid #000000)]
     LayoutBlockFlow {DIV} at (3,3) size 120x65
-      LayoutText {#text} at (0,0) size 120x65
+      LayoutText {#text} at (0,0) size 119x65
         text run at (0,0) width 97: "Lorem ipsum dolor"
         text run at (96,0) width 4: " "
-        text run at (0,13) width 116: "ABCDEFGHIJKLMNOP"
+        text run at (0,13) width 115: "ABCDEFGHIJKLMNOP"
         text run at (0,26) width 78: "QRSTUVWXYZ"
         text run at (77,26) width 4: " "
-        text run at (0,39) width 120: "abcdefghijklmnopqrstu"
+        text run at (0,39) width 119: "abcdefghijklmnopqrstu"
         text run at (0,52) width 6: "v"
         text run at (5,52) width 5: " "
 layer at (24,362) size 141x32 clip at (25,363) size 124x30 scrollHeight 69
   LayoutTextControl {TEXTAREA} at (14.61,1) size 141x32 [bgcolor=#FFFFFF] [border: (1px solid #000000)]
     LayoutBlockFlow {DIV} at (3,3) size 120x65
-      LayoutText {#text} at (0,0) size 120x65
+      LayoutText {#text} at (0,0) size 119x65
         text run at (0,0) width 97: "Lorem ipsum dolor"
         text run at (96,0) width 4: " "
-        text run at (0,13) width 116: "ABCDEFGHIJKLMNOP"
+        text run at (0,13) width 115: "ABCDEFGHIJKLMNOP"
         text run at (0,26) width 78: "QRSTUVWXYZ"
         text run at (77,26) width 4: " "
-        text run at (0,39) width 120: "abcdefghijklmnopqrstu"
+        text run at (0,39) width 119: "abcdefghijklmnopqrstu"
         text run at (0,52) width 6: "v"
         text run at (5,52) width 5: " "
-layer at (24,413) size 39x32 clip at (25,414) size 22x30 scrollHeight 381
+layer at (24,413) size 39x32 clip at (25,414) size 22x30 scrollHeight 368
   LayoutTextControl {TEXTAREA} at (14.61,1) size 39x32 [bgcolor=#FFFFFF] [border: (1px solid #000000)]
-    LayoutBlockFlow {DIV} at (3,3) size 18x377
-      LayoutText {#text} at (0,0) size 18x377
+    LayoutBlockFlow {DIV} at (3,3) size 18x364
+      LayoutText {#text} at (0,0) size 18x364
         text run at (0,0) width 17: "Lor"
         text run at (0,13) width 16: "em"
         text run at (15,13) width 3: " "
-        text run at (0,26) width 16: "ips"
+        text run at (0,26) width 15: "ips"
         text run at (0,39) width 16: "um"
         text run at (15,39) width 3: " "
-        text run at (0,52) width 17: "dol"
+        text run at (0,52) width 16: "dol"
         text run at (0,65) width 11: "or"
         text run at (10,65) width 4: " "
         text run at (0,78) width 15: "AB"
         text run at (0,91) width 16: "CD"
         text run at (0,104) width 13: "EF"
-        text run at (0,117) width 17: "GH"
-        text run at (0,130) width 17: "IJK"
+        text run at (0,117) width 16: "GH"
+        text run at (0,130) width 16: "IJK"
         text run at (0,143) width 16: "LM"
         text run at (0,156) width 17: "NO"
-        text run at (0,169) width 16: "PQ"
-        text run at (0,182) width 15: "RS"
-        text run at (0,195) width 16: "TU"
-        text run at (0,208) width 8: "V"
-        text run at (0,221) width 11: "W"
-        text run at (0,234) width 15: "XY"
-        text run at (0,247) width 8: "Z"
-        text run at (7,247) width 4: " "
-        text run at (0,260) width 13: "ab"
-        text run at (0,273) width 13: "cd"
-        text run at (0,286) width 17: "efg"
-        text run at (0,299) width 18: "hijk"
-        text run at (0,312) width 13: "lm"
-        text run at (0,325) width 13: "no"
-        text run at (0,338) width 18: "pqr"
-        text run at (0,351) width 17: "stu"
-        text run at (0,364) width 6: "v"
-        text run at (5,364) width 5: " "
+        text run at (0,169) width 15: "PQ"
+        text run at (0,182) width 14: "RS"
+        text run at (0,195) width 15: "TU"
+        text run at (0,208) width 18: "VW"
+        text run at (0,221) width 15: "XY"
+        text run at (0,234) width 8: "Z"
+        text run at (7,234) width 4: " "
+        text run at (0,247) width 13: "ab"
+        text run at (0,260) width 13: "cd"
+        text run at (0,273) width 17: "efg"
+        text run at (0,286) width 18: "hijk"
+        text run at (0,299) width 12: "lm"
+        text run at (0,312) width 13: "no"
+        text run at (0,325) width 17: "pqr"
+        text run at (0,338) width 16: "stu"
+        text run at (0,351) width 6: "v"
+        text run at (5,351) width 5: " "
 layer at (24,464) size 141x45 clip at (25,465) size 124x43 scrollHeight 69
   LayoutTextControl {TEXTAREA} at (14.61,1) size 141x45 [bgcolor=#FFFFFF] [border: (1px solid #000000)]
     LayoutBlockFlow {DIV} at (3,3) size 120x65
-      LayoutText {#text} at (0,0) size 120x65
+      LayoutText {#text} at (0,0) size 119x65
         text run at (0,0) width 97: "Lorem ipsum dolor"
         text run at (96,0) width 4: " "
-        text run at (0,13) width 116: "ABCDEFGHIJKLMNOP"
+        text run at (0,13) width 115: "ABCDEFGHIJKLMNOP"
         text run at (0,26) width 78: "QRSTUVWXYZ"
         text run at (77,26) width 4: " "
-        text run at (0,39) width 120: "abcdefghijklmnopqrstu"
+        text run at (0,39) width 119: "abcdefghijklmnopqrstu"
         text run at (0,52) width 6: "v"
         text run at (5,52) width 5: " "
 layer at (24,528) size 81x32 clip at (25,529) size 64x30 scrollHeight 134
@@ -366,10 +365,10 @@
         text run at (0,65) width 56: "QRSTUVW"
         text run at (0,78) width 22: "XYZ"
         text run at (21,78) width 5: " "
-        text run at (0,91) width 55: "abcdefghij"
-        text run at (0,104) width 59: "klmnopqrst"
-        text run at (0,117) width 13: "uv"
-        text run at (12,117) width 4: " "
+        text run at (0,91) width 60: "abcdefghijk"
+        text run at (0,104) width 59: "lmnopqrstu"
+        text run at (0,117) width 6: "v"
+        text run at (5,117) width 5: " "
 layer at (24,579) size 141x136 backgroundClip at (24,579) size 141x21 clip at (25,580) size 139x20
   LayoutTextControl {TEXTAREA} at (14.61,1) size 141x136 [bgcolor=#FFFFFF] [border: (1px solid #000000)]
     LayoutBlockFlow {DIV} at (3,3) size 135x52
@@ -394,11 +393,11 @@
         text run at (0,52) width 27: "dolor"
         text run at (26,52) width 4: " "
         text run at (0,65) width 23: "ABC"
-        text run at (0,78) width 30: "DEFG"
-        text run at (0,91) width 25: "HIJK"
-        text run at (0,104) width 25: "LMN"
+        text run at (0,78) width 29: "DEFG"
+        text run at (0,91) width 24: "HIJK"
+        text run at (0,104) width 24: "LMN"
         text run at (0,117) width 24: "OPQ"
-        text run at (0,130) width 30: "RSTU"
+        text run at (0,130) width 29: "RSTU"
         text run at (0,143) width 26: "VWX"
         text run at (0,156) width 15: "YZ"
         text run at (14,156) width 4: " "
@@ -418,16 +417,16 @@
         text run at (31,13) width 4: " "
         text run at (0,26) width 27: "dolor"
         text run at (26,26) width 4: " "
-        text run at (0,39) width 38: "ABCDE"
+        text run at (0,39) width 37: "ABCDE"
         text run at (0,52) width 39: "FGHIJK"
-        text run at (0,65) width 33: "LMNO"
-        text run at (0,78) width 37: "PQRST"
-        text run at (0,91) width 34: "UVWX"
-        text run at (0,104) width 15: "YZ"
-        text run at (14,104) width 4: " "
+        text run at (0,65) width 39: "LMNOP"
+        text run at (0,78) width 38: "QRSTU"
+        text run at (0,91) width 33: "VWXY"
+        text run at (0,104) width 8: "Z"
+        text run at (7,104) width 4: " "
         text run at (0,117) width 36: "abcdef"
         text run at (0,130) width 37: "ghijklm"
-        text run at (0,143) width 37: "nopqrs"
+        text run at (0,143) width 36: "nopqrs"
         text run at (0,156) width 17: "tuv"
         text run at (16,156) width 4: " "
 layer at (376,75) size 60x68 clip at (377,76) size 43x66 scrollHeight 924
@@ -502,27 +501,26 @@
         text run at (0,845) width 7: "u"
         text run at (0,858) width 6: "v"
         text run at (0,871) width 3: " "
-layer at (376,162) size 60x28 clip at (377,163) size 43x26 scrollHeight 156
+layer at (376,162) size 60x28 clip at (377,163) size 43x26 scrollHeight 143
   LayoutTextControl {TEXTAREA} at (14.61,1) size 60x28 [bgcolor=#FFFFFF] [border: (1px solid #000000)]
-    LayoutBlockFlow {DIV} at (1,1) size 43x156
-      LayoutText {#text} at (0,0) size 43x156
+    LayoutBlockFlow {DIV} at (1,1) size 43x143
+      LayoutText {#text} at (0,0) size 43x143
         text run at (0,0) width 33: "Lorem"
         text run at (32,0) width 4: " "
         text run at (0,13) width 32: "ipsum"
         text run at (31,13) width 4: " "
         text run at (0,26) width 27: "dolor"
         text run at (26,26) width 4: " "
-        text run at (0,39) width 38: "ABCDE"
-        text run at (0,52) width 39: "FGHIJK"
-        text run at (0,65) width 40: "LMNOP"
-        text run at (0,78) width 38: "QRSTU"
-        text run at (0,91) width 41: "VWXYZ"
-        text run at (40,91) width 3: " "
-        text run at (0,104) width 43: "abcdefg"
-        text run at (0,117) width 37: "hijklmn"
-        text run at (0,130) width 41: "opqrstu"
-        text run at (0,143) width 6: "v"
-        text run at (5,143) width 5: " "
+        text run at (0,39) width 43: "ABCDEF"
+        text run at (0,52) width 39: "GHIJKL"
+        text run at (0,65) width 42: "MNOPQ"
+        text run at (0,78) width 37: "RSTUV"
+        text run at (0,91) width 33: "WXYZ"
+        text run at (32,91) width 4: " "
+        text run at (0,104) width 42: "abcdefg"
+        text run at (0,117) width 43: "hijklmno"
+        text run at (0,130) width 40: "pqrstuv"
+        text run at (39,130) width 4: " "
 layer at (376,209) size 141x60 clip at (377,210) size 139x58
   LayoutTextControl {TEXTAREA} at (14.61,1) size 141x60 [bgcolor=#FFFFFF] [border: (1px solid #000000)]
     LayoutBlockFlow {DIV} at (3,3) size 135x52
@@ -544,16 +542,16 @@
         text run at (31,13) width 4: " "
         text run at (0,26) width 27: "dolor"
         text run at (26,26) width 4: " "
-        text run at (0,39) width 38: "ABCDE"
+        text run at (0,39) width 37: "ABCDE"
         text run at (0,52) width 39: "FGHIJK"
-        text run at (0,65) width 33: "LMNO"
-        text run at (0,78) width 37: "PQRST"
-        text run at (0,91) width 34: "UVWX"
-        text run at (0,104) width 15: "YZ"
-        text run at (14,104) width 4: " "
+        text run at (0,65) width 39: "LMNOP"
+        text run at (0,78) width 38: "QRSTU"
+        text run at (0,91) width 33: "VWXY"
+        text run at (0,104) width 8: "Z"
+        text run at (7,104) width 4: " "
         text run at (0,117) width 36: "abcdef"
         text run at (0,130) width 37: "ghijklm"
-        text run at (0,143) width 37: "nopqrs"
+        text run at (0,143) width 36: "nopqrs"
         text run at (0,156) width 17: "tuv"
         text run at (16,156) width 4: " "
 layer at (376,367) size 141x32 clip at (377,368) size 139x30 scrollHeight 56
@@ -570,13 +568,13 @@
 layer at (376,418) size 141x47 clip at (377,419) size 124x30 scrollHeight 69
   LayoutTextControl {TEXTAREA} at (14.61,1) size 141x47 [bgcolor=#FFFFFF] [border: (1px solid #000000)]
     LayoutBlockFlow {DIV} at (3,3) size 120x65
-      LayoutText {#text} at (0,0) size 120x65
+      LayoutText {#text} at (0,0) size 119x65
         text run at (0,0) width 97: "Lorem ipsum dolor"
         text run at (96,0) width 4: " "
-        text run at (0,13) width 116: "ABCDEFGHIJKLMNOP"
+        text run at (0,13) width 115: "ABCDEFGHIJKLMNOP"
         text run at (0,26) width 78: "QRSTUVWXYZ"
         text run at (77,26) width 4: " "
-        text run at (0,39) width 120: "abcdefghijklmnopqrstu"
+        text run at (0,39) width 119: "abcdefghijklmnopqrstu"
         text run at (0,52) width 6: "v"
         text run at (5,52) width 5: " "
 layer at (376,484) size 60x60 clip at (377,485) size 58x58 scrollHeight 134
@@ -590,14 +588,14 @@
         text run at (0,26) width 27: "dolor"
         text run at (26,26) width 4: " "
         text run at (0,39) width 52: "ABCDEFG"
-        text run at (0,52) width 49: "HIJKLMN"
-        text run at (0,65) width 54: "OPQRSTU"
+        text run at (0,52) width 48: "HIJKLMN"
+        text run at (0,65) width 53: "OPQRSTU"
         text run at (0,78) width 41: "VWXYZ"
         text run at (40,78) width 4: " "
-        text run at (0,91) width 52: "abcdefghi"
-        text run at (0,104) width 52: "jklmnopqr"
-        text run at (0,117) width 23: "stuv"
-        text run at (22,117) width 4: " "
+        text run at (0,91) width 54: "abcdefghij"
+        text run at (0,104) width 54: "klmnopqrs"
+        text run at (0,117) width 17: "tuv"
+        text run at (16,117) width 4: " "
 layer at (376,563) size 60x60 backgroundClip at (376,563) size 60x37 clip at (377,564) size 43x36 scrollHeight 173
   LayoutTextControl {TEXTAREA} at (14.61,1) size 60x60 [bgcolor=#FFFFFF] [border: (1px solid #000000)]
     LayoutBlockFlow {DIV} at (3,3) size 39x169
@@ -608,16 +606,16 @@
         text run at (31,13) width 4: " "
         text run at (0,26) width 27: "dolor"
         text run at (26,26) width 4: " "
-        text run at (0,39) width 38: "ABCDE"
+        text run at (0,39) width 37: "ABCDE"
         text run at (0,52) width 39: "FGHIJK"
-        text run at (0,65) width 33: "LMNO"
-        text run at (0,78) width 37: "PQRST"
-        text run at (0,91) width 34: "UVWX"
-        text run at (0,104) width 15: "YZ"
-        text run at (14,104) width 4: " "
+        text run at (0,65) width 39: "LMNOP"
+        text run at (0,78) width 38: "QRSTU"
+        text run at (0,91) width 33: "VWXY"
+        text run at (0,104) width 8: "Z"
+        text run at (7,104) width 4: " "
         text run at (0,117) width 36: "abcdef"
         text run at (0,130) width 37: "ghijklm"
-        text run at (0,143) width 37: "nopqrs"
+        text run at (0,143) width 36: "nopqrs"
         text run at (0,156) width 17: "tuv"
         text run at (16,156) width 4: " "
 layer at (376,642) size 60x60 backgroundClip at (0,0) size 0x0 clip at (0,0) size 0x0 scrollHeight 173
@@ -630,16 +628,16 @@
         text run at (31,13) width 4: " "
         text run at (0,26) width 27: "dolor"
         text run at (26,26) width 4: " "
-        text run at (0,39) width 38: "ABCDE"
+        text run at (0,39) width 37: "ABCDE"
         text run at (0,52) width 39: "FGHIJK"
-        text run at (0,65) width 33: "LMNO"
-        text run at (0,78) width 37: "PQRST"
-        text run at (0,91) width 34: "UVWX"
-        text run at (0,104) width 15: "YZ"
-        text run at (14,104) width 4: " "
+        text run at (0,65) width 39: "LMNOP"
+        text run at (0,78) width 38: "QRSTU"
+        text run at (0,91) width 33: "VWXY"
+        text run at (0,104) width 8: "Z"
+        text run at (7,104) width 4: " "
         text run at (0,117) width 36: "abcdef"
         text run at (0,130) width 37: "ghijklm"
-        text run at (0,143) width 37: "nopqrs"
+        text run at (0,143) width 36: "nopqrs"
         text run at (0,156) width 17: "tuv"
         text run at (16,156) width 4: " "
 layer at (376,721) size 60x60 backgroundClip at (0,0) size 0x0 clip at (0,0) size 0x0 scrollHeight 173
@@ -652,16 +650,16 @@
         text run at (31,13) width 4: " "
         text run at (0,26) width 27: "dolor"
         text run at (26,26) width 4: " "
-        text run at (0,39) width 38: "ABCDE"
+        text run at (0,39) width 37: "ABCDE"
         text run at (0,52) width 39: "FGHIJK"
-        text run at (0,65) width 33: "LMNO"
-        text run at (0,78) width 37: "PQRST"
-        text run at (0,91) width 34: "UVWX"
-        text run at (0,104) width 15: "YZ"
-        text run at (14,104) width 4: " "
+        text run at (0,65) width 39: "LMNOP"
+        text run at (0,78) width 38: "QRSTU"
+        text run at (0,91) width 33: "VWXY"
+        text run at (0,104) width 8: "Z"
+        text run at (7,104) width 4: " "
         text run at (0,117) width 36: "abcdef"
         text run at (0,130) width 37: "ghijklm"
-        text run at (0,143) width 37: "nopqrs"
+        text run at (0,143) width 36: "nopqrs"
         text run at (0,156) width 17: "tuv"
         text run at (16,156) width 4: " "
 layer at (376,800) size 60x60 backgroundClip at (0,0) size 0x0 clip at (0,0) size 0x0 scrollHeight 173
@@ -674,16 +672,16 @@
         text run at (31,13) width 4: " "
         text run at (0,26) width 27: "dolor"
         text run at (26,26) width 4: " "
-        text run at (0,39) width 38: "ABCDE"
+        text run at (0,39) width 37: "ABCDE"
         text run at (0,52) width 39: "FGHIJK"
-        text run at (0,65) width 33: "LMNO"
-        text run at (0,78) width 37: "PQRST"
-        text run at (0,91) width 34: "UVWX"
-        text run at (0,104) width 15: "YZ"
-        text run at (14,104) width 4: " "
+        text run at (0,65) width 39: "LMNOP"
+        text run at (0,78) width 38: "QRSTU"
+        text run at (0,91) width 33: "VWXY"
+        text run at (0,104) width 8: "Z"
+        text run at (7,104) width 4: " "
         text run at (0,117) width 36: "abcdef"
         text run at (0,130) width 37: "ghijklm"
-        text run at (0,143) width 37: "nopqrs"
+        text run at (0,143) width 36: "nopqrs"
         text run at (0,156) width 17: "tuv"
         text run at (16,156) width 4: " "
 layer at (376,879) size 141x47 backgroundClip at (0,0) size 0x0 clip at (0,0) size 0x0 scrollWidth 183 scrollHeight 212

diff --git a/third_party/WebKit/LayoutTests/platform/mac/fast/loader/text-document-wrapping-expected.txt b/third_party/WebKit/LayoutTests/platform/mac/fast/loader/text-document-wrapping-expected.txt
index 29f768e5..d4d6d41e 100644
--- a/third_party/WebKit/LayoutTests/platform/mac/fast/loader/text-document-wrapping-expected.txt
+++ b/third_party/WebKit/LayoutTests/platform/mac/fast/loader/text-document-wrapping-expected.txt

@@ -11,11 +11,11 @@
       LayoutBlockFlow {HTML} at (0,0) size 800x600
         LayoutBlockFlow {BODY} at (8,8) size 784x579
           LayoutBlockFlow {PRE} at (0,0) size 784x75
-            LayoutText {#text} at (0,0) size 781x75
+            LayoutText {#text} at (0,0) size 780x75
               text run at (0,0) width 406: "This line should wrap with no horizontal scroll bar:"
               text run at (405,0) width 1: " "
               text run at (0,15) width 0: " "
-              text run at (0,30) width 781: "abcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuv"
-              text run at (0,45) width 781: "wxyzabcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyzabcdefghijklmnopqr"
+              text run at (0,30) width 780: "abcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuv"
+              text run at (0,45) width 780: "wxyzabcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyzabcdefghijklmnopqr"
               text run at (0,60) width 469: "stuvwxyzabcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyz"
               text run at (468,60) width 1: " "

diff --git a/third_party/WebKit/LayoutTests/platform/mac/fast/text/midword-break-after-breakable-char-expected.png b/third_party/WebKit/LayoutTests/platform/mac/fast/text/midword-break-after-breakable-char-expected.png
index af58347..f95a06c 100644
--- a/third_party/WebKit/LayoutTests/platform/mac/fast/text/midword-break-after-breakable-char-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/mac/fast/text/midword-break-after-breakable-char-expected.png
Binary files differ

diff --git a/third_party/WebKit/LayoutTests/platform/mac/fast/text/midword-break-after-breakable-char-expected.txt b/third_party/WebKit/LayoutTests/platform/mac/fast/text/midword-break-after-breakable-char-expected.txt
index 50e5d3d..b090a94 100644
--- a/third_party/WebKit/LayoutTests/platform/mac/fast/text/midword-break-after-breakable-char-expected.txt
+++ b/third_party/WebKit/LayoutTests/platform/mac/fast/text/midword-break-after-breakable-char-expected.txt

@@ -24,15 +24,15 @@
         LayoutText {#text} at (0,0) size 266x18
           text run at (0,0) width 266: "The following blocks should be identical."
       LayoutBlockFlow (floating) {DIV} at (4,142) size 300x162 [bgcolor=#FFFFE0]
-        LayoutText {#text} at (0,0) size 298x162
+        LayoutText {#text} at (0,0) size 296x162
           text run at (0,0) width 191: "Curabiturpretium,quamquiss?"
           text run at (0,18) width 295: "empermalesuada,estliberofeugiatlibero,velfrin"
           text run at (0,36) width 147: "gillaorcinibhsedneque-"
           text run at (0,54) width 295: "Quisqueeunullanonnisimolestieaccumsan.Etia"
           text run at (0,72) width 209: "mtellusurna,laoreetac,laoreetnon"
-          text run at (0,90) width 298: "suscipitsed,sapien.Phasellusvehicula,sematpos"
-          text run at (0,108) width 236: "uerevehicula,auguenibhmolestienisl\x{AD}" + hyphen string "-"
-          text run at (0,126) width 297: "necullamcorperlacusantevulputatepede.Nascet"
+          text run at (0,90) width 291: "suscipitsed,sapien.Phasellusvehicula,sematpo"
+          text run at (0,108) width 242: "suerevehicula,auguenibhmolestienisl\x{AD}" + hyphen string "-"
+          text run at (0,126) width 296: "necullamcorperlacusantevulputatepede.Nascet"
           text run at (0,144) width 100: "urridiculusmus."
       LayoutBlockFlow (floating) {DIV} at (312,142) size 300x234 [bgcolor=#FFFFE0]
         LayoutText {#text} at (0,0) size 191x18
@@ -52,15 +52,15 @@
         LayoutText {#text} at (0,108) size 197x18
           text run at (0,108) width 197: "tellusurna,laoreetac,laoreetnon"
         LayoutBR {BR} at (196,122) size 1x0
-        LayoutText {#text} at (0,126) size 298x36
-          text run at (0,126) width 298: "suscipitsed,sapien.Phasellusvehicula,sematpos"
+        LayoutText {#text} at (0,126) size 297x36
+          text run at (0,126) width 297: "suscipitsed,sapien.Phasellusvehicula,sematpos"
           text run at (0,144) width 8: "u"
         LayoutBR {BR} at (8,158) size 0x0
         LayoutText {#text} at (0,162) size 228x18
           text run at (0,162) width 228: "erevehicula,auguenibhmolestienisl-"
         LayoutBR {BR} at (227,176) size 1x0
-        LayoutText {#text} at (0,180) size 297x36
-          text run at (0,180) width 297: "necullamcorperlacusantevulputatepede.Nascet"
+        LayoutText {#text} at (0,180) size 296x36
+          text run at (0,180) width 296: "necullamcorperlacusantevulputatepede.Nascet"
           text run at (0,198) width 8: "u"
         LayoutBR {BR} at (8,212) size 0x0
         LayoutText {#text} at (0,216) size 92x18

diff --git a/third_party/WebKit/LayoutTests/platform/mac/svg/wicd/test-rightsizing-b-expected.png b/third_party/WebKit/LayoutTests/platform/mac/svg/wicd/test-rightsizing-b-expected.png
index debb33c2..19a60a5 100644
--- a/third_party/WebKit/LayoutTests/platform/mac/svg/wicd/test-rightsizing-b-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/mac/svg/wicd/test-rightsizing-b-expected.png
Binary files differ

diff --git a/third_party/WebKit/LayoutTests/platform/mac/svg/wicd/test-rightsizing-b-expected.txt b/third_party/WebKit/LayoutTests/platform/mac/svg/wicd/test-rightsizing-b-expected.txt
index ef5fe39..916eb419 100644
--- a/third_party/WebKit/LayoutTests/platform/mac/svg/wicd/test-rightsizing-b-expected.txt
+++ b/third_party/WebKit/LayoutTests/platform/mac/svg/wicd/test-rightsizing-b-expected.txt

@@ -27,16 +27,16 @@
           LayoutText {#text} at (0,48) size 409x16
             text run at (0,48) width 409: "Beyond there is the same, only with PNG images instead of SVG."
         LayoutBlockFlow (anonymous) at (0,435.77) size 737.89x299
-          LayoutImage {object} at (0,0) size 295.16x295 [bgcolor=#FF0000]
+          LayoutImage {object} at (0,0) size 295.16x295.16 [bgcolor=#FF0000]
           LayoutText {#text} at (295,281) size 5x17
             text run at (295,281) width 5: " "
-          LayoutImage {object} at (299.59,147) size 147.58x148 [bgcolor=#FF0000]
+          LayoutImage {object} at (299.59,147) size 147.58x147.58 [bgcolor=#FF0000]
           LayoutText {#text} at (447,281) size 5x17
             text run at (447,281) width 5: " "
-          LayoutImage {object} at (451.61,221) size 73.78x74 [bgcolor=#FF0000]
+          LayoutImage {object} at (451.61,221) size 73.78x73.78 [bgcolor=#FF0000]
           LayoutText {#text} at (525,281) size 5x17
             text run at (525,281) width 5: " "
-          LayoutImage {object} at (529.83,258) size 36.89x37 [bgcolor=#FF0000]
+          LayoutImage {object} at (529.83,258) size 36.89x36.89 [bgcolor=#FF0000]
           LayoutText {#text} at (0,0) size 0x0
         LayoutBlockFlow {p} at (0,737.64) size 678.86x32
           LayoutText {#text} at (0,0) size 675x32
@@ -48,7 +48,7 @@
             LayoutText {#text} at (0,16) size 31x16
               text run at (0,16) width 31: "Back"
 layer at (47,95) size 295x295
-  LayoutEmbeddedObject {object} at (0,0) size 295.16x295 [bgcolor=#FF0000]
+  LayoutEmbeddedObject {object} at (0,0) size 295.16x295.16 [bgcolor=#FF0000]
     layer at (0,0) size 295x295
       LayoutView at (0,0) size 295x295
     layer at (0,0) size 295x295
@@ -61,7 +61,7 @@
             LayoutSVGInlineText {#text} at (0,0) size 141x80
               chunk 1 (middle anchor) text run 1 at (29.98,125.00) startOffset 0 endOffset 3 width 140.03: "SVG"
 layer at (347,242) size 147x148
-  LayoutEmbeddedObject {object} at (299.59,147) size 147.58x148 [bgcolor=#FF0000]
+  LayoutEmbeddedObject {object} at (299.59,147) size 147.58x147.58 [bgcolor=#FF0000]
     layer at (0,0) size 148x148
       LayoutView at (0,0) size 148x148
     layer at (0,0) size 148x148
@@ -74,7 +74,7 @@
             LayoutSVGInlineText {#text} at (0,0) size 141x82
               chunk 1 (middle anchor) text run 1 at (29.98,125.00) startOffset 0 endOffset 3 width 140.03: "SVG"
 layer at (499,316) size 73x74
-  LayoutEmbeddedObject {object} at (451.61,221) size 73.78x74 [bgcolor=#FF0000]
+  LayoutEmbeddedObject {object} at (451.61,221) size 73.78x73.78 [bgcolor=#FF0000]
     layer at (0,0) size 74x74
       LayoutView at (0,0) size 74x74
     layer at (0,0) size 74x74
@@ -87,7 +87,7 @@
             LayoutSVGInlineText {#text} at (0,0) size 141x79
               chunk 1 (middle anchor) text run 1 at (29.98,125.00) startOffset 0 endOffset 3 width 140.03: "SVG"
 layer at (577,353) size 37x37
-  LayoutEmbeddedObject {object} at (529.83,258) size 36.89x37 [bgcolor=#FF0000]
+  LayoutEmbeddedObject {object} at (529.83,258) size 36.89x36.89 [bgcolor=#FF0000]
     layer at (0,0) size 37x37
       LayoutView at (0,0) size 37x37
     layer at (0,0) size 37x37

diff --git a/third_party/WebKit/LayoutTests/platform/mac/virtual/gpu-rasterization/fast/images/jpeg-yuv-progressive-image-expected.png b/third_party/WebKit/LayoutTests/platform/mac/virtual/gpu-rasterization/fast/images/jpeg-yuv-progressive-image-expected.png
index 6801b665..38f2b27 100644
--- a/third_party/WebKit/LayoutTests/platform/mac/virtual/gpu-rasterization/fast/images/jpeg-yuv-progressive-image-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/mac/virtual/gpu-rasterization/fast/images/jpeg-yuv-progressive-image-expected.png
Binary files differ

diff --git a/third_party/WebKit/LayoutTests/platform/win/fast/text/midword-break-after-breakable-char-expected.png b/third_party/WebKit/LayoutTests/platform/win/fast/text/midword-break-after-breakable-char-expected.png
index a159aba..c7c7082 100644
--- a/third_party/WebKit/LayoutTests/platform/win/fast/text/midword-break-after-breakable-char-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/win/fast/text/midword-break-after-breakable-char-expected.png
Binary files differ

diff --git a/third_party/WebKit/LayoutTests/platform/win/fast/text/midword-break-after-breakable-char-expected.txt b/third_party/WebKit/LayoutTests/platform/win/fast/text/midword-break-after-breakable-char-expected.txt
index eabf1b78..69642e5 100644
--- a/third_party/WebKit/LayoutTests/platform/win/fast/text/midword-break-after-breakable-char-expected.txt
+++ b/third_party/WebKit/LayoutTests/platform/win/fast/text/midword-break-after-breakable-char-expected.txt

@@ -24,15 +24,15 @@
         LayoutText {#text} at (0,0) size 266x17
           text run at (0,0) width 266: "The following blocks should be identical."
       LayoutBlockFlow (floating) {DIV} at (4,142) size 300x162 [bgcolor=#FFFFE0]
-        LayoutText {#text} at (0,0) size 298x161
+        LayoutText {#text} at (0,0) size 296x161
           text run at (0,0) width 191: "Curabiturpretium,quamquiss?"
           text run at (0,18) width 295: "empermalesuada,estliberofeugiatlibero,velfrin"
           text run at (0,36) width 147: "gillaorcinibhsedneque-"
           text run at (0,54) width 295: "Quisqueeunullanonnisimolestieaccumsan.Etia"
           text run at (0,72) width 209: "mtellusurna,laoreetac,laoreetnon"
-          text run at (0,90) width 298: "suscipitsed,sapien.Phasellusvehicula,sematpos"
-          text run at (0,108) width 236: "uerevehicula,auguenibhmolestienisl\x{AD}" + hyphen string "-"
-          text run at (0,126) width 297: "necullamcorperlacusantevulputatepede.Nascet"
+          text run at (0,90) width 291: "suscipitsed,sapien.Phasellusvehicula,sematpo"
+          text run at (0,108) width 242: "suerevehicula,auguenibhmolestienisl\x{AD}" + hyphen string "-"
+          text run at (0,126) width 296: "necullamcorperlacusantevulputatepede.Nascet"
           text run at (0,144) width 100: "urridiculusmus."
       LayoutBlockFlow (floating) {DIV} at (312,142) size 300x234 [bgcolor=#FFFFE0]
         LayoutText {#text} at (0,0) size 191x17
@@ -52,15 +52,15 @@
         LayoutText {#text} at (0,108) size 197x17
           text run at (0,108) width 197: "tellusurna,laoreetac,laoreetnon"
         LayoutBR {BR} at (196,122) size 1x0
-        LayoutText {#text} at (0,126) size 298x35
-          text run at (0,126) width 298: "suscipitsed,sapien.Phasellusvehicula,sematpos"
+        LayoutText {#text} at (0,126) size 297x35
+          text run at (0,126) width 297: "suscipitsed,sapien.Phasellusvehicula,sematpos"
           text run at (0,144) width 8: "u"
         LayoutBR {BR} at (8,158) size 0x0
         LayoutText {#text} at (0,162) size 228x17
           text run at (0,162) width 228: "erevehicula,auguenibhmolestienisl-"
         LayoutBR {BR} at (227,176) size 1x0
-        LayoutText {#text} at (0,180) size 297x35
-          text run at (0,180) width 297: "necullamcorperlacusantevulputatepede.Nascet"
+        LayoutText {#text} at (0,180) size 296x35
+          text run at (0,180) width 296: "necullamcorperlacusantevulputatepede.Nascet"
           text run at (0,198) width 8: "u"
         LayoutBR {BR} at (8,212) size 0x0
         LayoutText {#text} at (0,216) size 92x17

diff --git a/third_party/WebKit/LayoutTests/platform/win/svg/wicd/test-rightsizing-b-expected.png b/third_party/WebKit/LayoutTests/platform/win/svg/wicd/test-rightsizing-b-expected.png
index 6bcd76f3..b24dabd 100644
--- a/third_party/WebKit/LayoutTests/platform/win/svg/wicd/test-rightsizing-b-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/win/svg/wicd/test-rightsizing-b-expected.png
Binary files differ

diff --git a/third_party/WebKit/LayoutTests/platform/win/svg/wicd/test-rightsizing-b-expected.txt b/third_party/WebKit/LayoutTests/platform/win/svg/wicd/test-rightsizing-b-expected.txt
index f9196ce7..bdd114b 100644
--- a/third_party/WebKit/LayoutTests/platform/win/svg/wicd/test-rightsizing-b-expected.txt
+++ b/third_party/WebKit/LayoutTests/platform/win/svg/wicd/test-rightsizing-b-expected.txt

@@ -1,24 +1,24 @@
-layer at (0,0) size 800x600 clip at (0,0) size 785x600 scrollHeight 854
+layer at (0,0) size 800x600 clip at (0,0) size 785x600 scrollHeight 709
   LayoutView at (0,0) size 800x600
-layer at (0,0) size 785x854 backgroundClip at (0,0) size 785x600 clip at (0,0) size 785x600
-  LayoutBlockFlow {html} at (0,0) size 785x854.11
-    LayoutBlockFlow {body} at (47.09,30.72) size 737.89x815.39
-      LayoutBlockFlow {div} at (0,0) size 737.89x815.39
+layer at (0,0) size 785x709 backgroundClip at (0,0) size 785x600 clip at (0,0) size 785x600
+  LayoutBlockFlow {html} at (0,0) size 785x709.11
+    LayoutBlockFlow {body} at (47.09,30.72) size 737.89x670.39
+      LayoutBlockFlow {div} at (0,0) size 737.89x670.39
         LayoutBlockFlow {h1} at (0,0) size 678.86x29
           LayoutText {#text} at (0,0) size 379x28
             text run at (0,0) width 379: "rightsizing to percentage width"
         LayoutBlockFlow {h4} at (0,29) size 737.89x16
           LayoutText {#text} at (0,0) size 138x16
             text run at (0,0) width 138: "WICD Core 1.0 #20-2"
-        LayoutBlockFlow (anonymous) at (0,64.14) size 737.89x299
-          LayoutText {#text} at (295,281) size 5x17
-            text run at (295,281) width 5: " "
-          LayoutText {#text} at (447,281) size 5x17
-            text run at (447,281) width 5: " "
-          LayoutText {#text} at (525,281) size 5x17
-            text run at (525,281) width 5: " "
+        LayoutBlockFlow (anonymous) at (0,64.14) size 737.89x154
+          LayoutText {#text} at (295,136) size 5x17
+            text run at (295,136) width 5: " "
+          LayoutText {#text} at (447,136) size 5x17
+            text run at (447,136) width 5: " "
+          LayoutText {#text} at (525,136) size 5x17
+            text run at (525,136) width 5: " "
           LayoutText {#text} at (0,0) size 0x0
-        LayoutBlockFlow {p} at (0,366.02) size 678.86x68
+        LayoutBlockFlow {p} at (0,221.02) size 678.86x68
           LayoutText {#text} at (0,0) size 651x34
             text run at (0,0) width 651: "Above there must be four times the same, square SVG child visible, each referenced by an object element"
             text run at (0,17) width 414: "with different widths (40%, 20%, 10%, 5%) and no height defined. "
@@ -26,76 +26,52 @@
           LayoutBR {br} at (0,34) size 0x17
           LayoutText {#text} at (0,51) size 398x17
             text run at (0,51) width 398: "Beyond there is the same, only with PNG images instead of SVG."
-        LayoutBlockFlow (anonymous) at (0,439.77) size 737.89x299
-          LayoutImage {object} at (0,0) size 295.16x295 [bgcolor=#FF0000]
+        LayoutBlockFlow (anonymous) at (0,294.77) size 737.89x299
+          LayoutImage {object} at (0,0) size 295.16x295.16 [bgcolor=#FF0000]
           LayoutText {#text} at (295,281) size 5x17
             text run at (295,281) width 5: " "
-          LayoutImage {object} at (299.59,147) size 147.58x148 [bgcolor=#FF0000]
+          LayoutImage {object} at (299.59,147) size 147.58x147.58 [bgcolor=#FF0000]
           LayoutText {#text} at (447,281) size 5x17
             text run at (447,281) width 5: " "
-          LayoutImage {object} at (451.61,221) size 73.78x74 [bgcolor=#FF0000]
+          LayoutImage {object} at (451.61,221) size 73.78x73.78 [bgcolor=#FF0000]
           LayoutText {#text} at (525,281) size 5x17
             text run at (525,281) width 5: " "
-          LayoutImage {object} at (529.83,258) size 36.89x37 [bgcolor=#FF0000]
+          LayoutImage {object} at (529.83,258) size 36.89x36.89 [bgcolor=#FF0000]
           LayoutText {#text} at (0,0) size 0x0
-        LayoutBlockFlow {p} at (0,741.64) size 678.86x34
+        LayoutBlockFlow {p} at (0,596.64) size 678.86x34
           LayoutText {#text} at (0,0) size 661x34
             text run at (0,0) width 661: "This test has succeeded, if both rows look exactly the same (SVGs must be square!) and no red background"
             text run at (0,17) width 94: "color is visible."
-        LayoutBlockFlow {p} at (0,781.39) size 678.86x34
+        LayoutBlockFlow {p} at (0,636.39) size 678.86x34
           LayoutBR {br} at (0,0) size 0x17
           LayoutInline {a} at (0,0) size 31x17 [color=#000066]
             LayoutText {#text} at (0,17) size 31x17
               text run at (0,17) width 31: "Back"
-layer at (47,95) size 295x295
-  LayoutEmbeddedObject {object} at (0,0) size 295.16x295 [bgcolor=#FF0000]
-    layer at (0,0) size 295x295
-      LayoutView at (0,0) size 295x295
-    layer at (0,0) size 295x295
-      LayoutSVGRoot {svg} at (0,0) size 295x295
-        LayoutSVGHiddenContainer {defs} at (0,0) size 0x0
-        LayoutSVGRect {rect} at (0,0) size 295x295 [fill={[type=SOLID] [color=#5588FF]}] [x=-3000.00] [y=-1000.00] [width=6200.00] [height=2200.00]
-        LayoutSVGEllipse {circle} at (0,0) size 295x295 [fill={[type=SOLID] [color=#0000FF]}] [cx=100.00] [cy=100.00] [r=100.00]
-        LayoutSVGContainer {g} at (44,92) size 207x115
-          LayoutSVGText {text} at (29,62) size 141x78 contains 1 chunk(s)
-            LayoutSVGInlineText {#text} at (0,0) size 141x78
-              chunk 1 (middle anchor) text run 1 at (29.98,125.00) startOffset 0 endOffset 3 width 140.03: "SVG"
-layer at (347,242) size 147x148
-  LayoutEmbeddedObject {object} at (299.59,147) size 147.58x148 [bgcolor=#FF0000]
-    layer at (0,0) size 148x148
-      LayoutView at (0,0) size 148x148
-    layer at (0,0) size 148x148
-      LayoutSVGRoot {svg} at (0,0) size 148x148
-        LayoutSVGHiddenContainer {defs} at (0,0) size 0x0
-        LayoutSVGRect {rect} at (0,0) size 148x148 [fill={[type=SOLID] [color=#5588FF]}] [x=-3000.00] [y=-1000.00] [width=6200.00] [height=2200.00]
-        LayoutSVGEllipse {circle} at (0,0) size 148x148 [fill={[type=SOLID] [color=#0000FF]}] [cx=100.00] [cy=100.00] [r=100.00]
-        LayoutSVGContainer {g} at (22,46) size 104x58
-          LayoutSVGText {text} at (29,62) size 141x78 contains 1 chunk(s)
-            LayoutSVGInlineText {#text} at (0,0) size 141x78
-              chunk 1 (middle anchor) text run 1 at (29.98,125.00) startOffset 0 endOffset 3 width 140.03: "SVG"
-layer at (499,316) size 73x74
-  LayoutEmbeddedObject {object} at (451.61,221) size 73.78x74 [bgcolor=#FF0000]
-    layer at (0,0) size 74x74
-      LayoutView at (0,0) size 74x74
-    layer at (0,0) size 74x74
-      LayoutSVGRoot {svg} at (0,0) size 74x74
-        LayoutSVGHiddenContainer {defs} at (0,0) size 0x0
-        LayoutSVGRect {rect} at (0,0) size 74x74 [fill={[type=SOLID] [color=#5588FF]}] [x=-3000.00] [y=-1000.00] [width=6200.00] [height=2200.00]
-        LayoutSVGEllipse {circle} at (0,0) size 74x74 [fill={[type=SOLID] [color=#0000FF]}] [cx=100.00] [cy=100.00] [r=100.00]
-        LayoutSVGContainer {g} at (11,23) size 52x30
-          LayoutSVGText {text} at (29,62) size 141x80 contains 1 chunk(s)
-            LayoutSVGInlineText {#text} at (0,0) size 141x79
-              chunk 1 (middle anchor) text run 1 at (29.98,125.00) startOffset 0 endOffset 3 width 140.03: "SVG"
-layer at (577,353) size 37x37
-  LayoutEmbeddedObject {object} at (529.83,258) size 36.89x37 [bgcolor=#FF0000]
-    layer at (0,0) size 37x37
-      LayoutView at (0,0) size 37x37
-    layer at (0,0) size 37x37
-      LayoutSVGRoot {svg} at (0,0) size 37x37
-        LayoutSVGHiddenContainer {defs} at (0,0) size 0x0
-        LayoutSVGRect {rect} at (0,0) size 37x37 [fill={[type=SOLID] [color=#5588FF]}] [x=-3000.00] [y=-1000.00] [width=6200.00] [height=2200.00]
-        LayoutSVGEllipse {circle} at (0,0) size 37x37 [fill={[type=SOLID] [color=#0000FF]}] [cx=100.00] [cy=100.00] [r=100.00]
-        LayoutSVGContainer {g} at (6,11) size 24x16
-          LayoutSVGText {text} at (37,60) size 126x82 contains 1 chunk(s)
-            LayoutSVGInlineText {#text} at (0,0) size 125x82
-              chunk 1 (middle anchor) text run 1 at (37.84,125.00) startOffset 0 endOffset 3 width 124.32: "SVG"
+layer at (47,95) size 295x150
+  LayoutEmbeddedObject {object} at (0,0) size 295.16x150 [bgcolor=#FF0000]
+    layer at (0,0) size 295x150
+      LayoutView at (0,0) size 295x150
+    layer at (0,0) size 295x150
+      LayoutBlockFlow {HTML} at (0,0) size 295x150
+        LayoutBlockFlow {BODY} at (8,8) size 279x134
+layer at (347,95) size 147x150
+  LayoutEmbeddedObject {object} at (299.59,0) size 147.58x150 [bgcolor=#FF0000]
+    layer at (0,0) size 148x150
+      LayoutView at (0,0) size 148x150
+    layer at (0,0) size 148x150
+      LayoutBlockFlow {HTML} at (0,0) size 148x150
+        LayoutBlockFlow {BODY} at (8,8) size 132x134
+layer at (499,95) size 73x150
+  LayoutEmbeddedObject {object} at (451.61,0) size 73.78x150 [bgcolor=#FF0000]
+    layer at (0,0) size 74x150
+      LayoutView at (0,0) size 74x150
+    layer at (0,0) size 74x150
+      LayoutBlockFlow {HTML} at (0,0) size 74x150
+        LayoutBlockFlow {BODY} at (8,8) size 58x134
+layer at (577,95) size 37x150
+  LayoutEmbeddedObject {object} at (529.83,0) size 36.89x150 [bgcolor=#FF0000]
+    layer at (0,0) size 37x150
+      LayoutView at (0,0) size 37x150
+    layer at (0,0) size 37x150
+      LayoutBlockFlow {HTML} at (0,0) size 37x150
+        LayoutBlockFlow {BODY} at (8,8) size 21x134

diff --git a/third_party/WebKit/LayoutTests/platform/win/virtual/gpu-rasterization/fast/images/jpeg-yuv-progressive-image-expected.png b/third_party/WebKit/LayoutTests/platform/win/virtual/gpu-rasterization/fast/images/jpeg-yuv-progressive-image-expected.png
index bba0ac2..a6b75898 100644
--- a/third_party/WebKit/LayoutTests/platform/win/virtual/gpu-rasterization/fast/images/jpeg-yuv-progressive-image-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/win/virtual/gpu-rasterization/fast/images/jpeg-yuv-progressive-image-expected.png
Binary files differ

diff --git a/third_party/WebKit/LayoutTests/platform/win7/svg/wicd/test-rightsizing-b-expected.txt b/third_party/WebKit/LayoutTests/platform/win7/svg/wicd/test-rightsizing-b-expected.txt
new file mode 100644
index 0000000..e828f3a
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/platform/win7/svg/wicd/test-rightsizing-b-expected.txt

@@ -0,0 +1,101 @@
+layer at (0,0) size 800x600 clip at (0,0) size 785x600 scrollHeight 854
+  LayoutView at (0,0) size 800x600
+layer at (0,0) size 785x854 backgroundClip at (0,0) size 785x600 clip at (0,0) size 785x600
+  LayoutBlockFlow {html} at (0,0) size 785x854.11
+    LayoutBlockFlow {body} at (47.09,30.72) size 737.89x815.39
+      LayoutBlockFlow {div} at (0,0) size 737.89x815.39
+        LayoutBlockFlow {h1} at (0,0) size 678.86x29
+          LayoutText {#text} at (0,0) size 379x28
+            text run at (0,0) width 379: "rightsizing to percentage width"
+        LayoutBlockFlow {h4} at (0,29) size 737.89x16
+          LayoutText {#text} at (0,0) size 138x16
+            text run at (0,0) width 138: "WICD Core 1.0 #20-2"
+        LayoutBlockFlow (anonymous) at (0,64.14) size 737.89x299
+          LayoutText {#text} at (295,281) size 5x17
+            text run at (295,281) width 5: " "
+          LayoutText {#text} at (447,281) size 5x17
+            text run at (447,281) width 5: " "
+          LayoutText {#text} at (525,281) size 5x17
+            text run at (525,281) width 5: " "
+          LayoutText {#text} at (0,0) size 0x0
+        LayoutBlockFlow {p} at (0,366.02) size 678.86x68
+          LayoutText {#text} at (0,0) size 651x34
+            text run at (0,0) width 651: "Above there must be four times the same, square SVG child visible, each referenced by an object element"
+            text run at (0,17) width 414: "with different widths (40%, 20%, 10%, 5%) and no height defined. "
+          LayoutBR {br} at (0,0) size 0x0
+          LayoutBR {br} at (0,34) size 0x17
+          LayoutText {#text} at (0,51) size 398x17
+            text run at (0,51) width 398: "Beyond there is the same, only with PNG images instead of SVG."
+        LayoutBlockFlow (anonymous) at (0,439.77) size 737.89x299
+          LayoutImage {object} at (0,0) size 295.16x295.16 [bgcolor=#FF0000]
+          LayoutText {#text} at (295,281) size 5x17
+            text run at (295,281) width 5: " "
+          LayoutImage {object} at (299.59,147) size 147.58x147.58 [bgcolor=#FF0000]
+          LayoutText {#text} at (447,281) size 5x17
+            text run at (447,281) width 5: " "
+          LayoutImage {object} at (451.61,221) size 73.78x73.78 [bgcolor=#FF0000]
+          LayoutText {#text} at (525,281) size 5x17
+            text run at (525,281) width 5: " "
+          LayoutImage {object} at (529.83,258) size 36.89x36.89 [bgcolor=#FF0000]
+          LayoutText {#text} at (0,0) size 0x0
+        LayoutBlockFlow {p} at (0,741.64) size 678.86x34
+          LayoutText {#text} at (0,0) size 661x34
+            text run at (0,0) width 661: "This test has succeeded, if both rows look exactly the same (SVGs must be square!) and no red background"
+            text run at (0,17) width 94: "color is visible."
+        LayoutBlockFlow {p} at (0,781.39) size 678.86x34
+          LayoutBR {br} at (0,0) size 0x17
+          LayoutInline {a} at (0,0) size 31x17 [color=#000066]
+            LayoutText {#text} at (0,17) size 31x17
+              text run at (0,17) width 31: "Back"
+layer at (47,95) size 295x295
+  LayoutEmbeddedObject {object} at (0,0) size 295.16x295.16 [bgcolor=#FF0000]
+    layer at (0,0) size 295x295
+      LayoutView at (0,0) size 295x295
+    layer at (0,0) size 295x295
+      LayoutSVGRoot {svg} at (0,0) size 295x295
+        LayoutSVGHiddenContainer {defs} at (0,0) size 0x0
+        LayoutSVGRect {rect} at (0,0) size 295x295 [fill={[type=SOLID] [color=#5588FF]}] [x=-3000.00] [y=-1000.00] [width=6200.00] [height=2200.00]
+        LayoutSVGEllipse {circle} at (0,0) size 295x295 [fill={[type=SOLID] [color=#0000FF]}] [cx=100.00] [cy=100.00] [r=100.00]
+        LayoutSVGContainer {g} at (44,92) size 207x115
+          LayoutSVGText {text} at (29,62) size 141x78 contains 1 chunk(s)
+            LayoutSVGInlineText {#text} at (0,0) size 141x78
+              chunk 1 (middle anchor) text run 1 at (29.98,125.00) startOffset 0 endOffset 3 width 140.03: "SVG"
+layer at (347,242) size 147x148
+  LayoutEmbeddedObject {object} at (299.59,147) size 147.58x147.58 [bgcolor=#FF0000]
+    layer at (0,0) size 148x148
+      LayoutView at (0,0) size 148x148
+    layer at (0,0) size 148x148
+      LayoutSVGRoot {svg} at (0,0) size 148x148
+        LayoutSVGHiddenContainer {defs} at (0,0) size 0x0
+        LayoutSVGRect {rect} at (0,0) size 148x148 [fill={[type=SOLID] [color=#5588FF]}] [x=-3000.00] [y=-1000.00] [width=6200.00] [height=2200.00]
+        LayoutSVGEllipse {circle} at (0,0) size 148x148 [fill={[type=SOLID] [color=#0000FF]}] [cx=100.00] [cy=100.00] [r=100.00]
+        LayoutSVGContainer {g} at (22,46) size 104x58
+          LayoutSVGText {text} at (29,62) size 141x78 contains 1 chunk(s)
+            LayoutSVGInlineText {#text} at (0,0) size 141x78
+              chunk 1 (middle anchor) text run 1 at (29.98,125.00) startOffset 0 endOffset 3 width 140.03: "SVG"
+layer at (499,316) size 73x74
+  LayoutEmbeddedObject {object} at (451.61,221) size 73.78x73.78 [bgcolor=#FF0000]
+    layer at (0,0) size 74x74
+      LayoutView at (0,0) size 74x74
+    layer at (0,0) size 74x74
+      LayoutSVGRoot {svg} at (0,0) size 74x74
+        LayoutSVGHiddenContainer {defs} at (0,0) size 0x0
+        LayoutSVGRect {rect} at (0,0) size 74x74 [fill={[type=SOLID] [color=#5588FF]}] [x=-3000.00] [y=-1000.00] [width=6200.00] [height=2200.00]
+        LayoutSVGEllipse {circle} at (0,0) size 74x74 [fill={[type=SOLID] [color=#0000FF]}] [cx=100.00] [cy=100.00] [r=100.00]
+        LayoutSVGContainer {g} at (11,23) size 52x30
+          LayoutSVGText {text} at (29,62) size 141x80 contains 1 chunk(s)
+            LayoutSVGInlineText {#text} at (0,0) size 141x79
+              chunk 1 (middle anchor) text run 1 at (29.98,125.00) startOffset 0 endOffset 3 width 140.03: "SVG"
+layer at (577,353) size 37x37
+  LayoutEmbeddedObject {object} at (529.83,258) size 36.89x36.89 [bgcolor=#FF0000]
+    layer at (0,0) size 37x37
+      LayoutView at (0,0) size 37x37
+    layer at (0,0) size 37x37
+      LayoutSVGRoot {svg} at (0,0) size 37x37
+        LayoutSVGHiddenContainer {defs} at (0,0) size 0x0
+        LayoutSVGRect {rect} at (0,0) size 37x37 [fill={[type=SOLID] [color=#5588FF]}] [x=-3000.00] [y=-1000.00] [width=6200.00] [height=2200.00]
+        LayoutSVGEllipse {circle} at (0,0) size 37x37 [fill={[type=SOLID] [color=#0000FF]}] [cx=100.00] [cy=100.00] [r=100.00]
+        LayoutSVGContainer {g} at (6,11) size 25x16
+          LayoutSVGText {text} at (37,60) size 131x82 contains 1 chunk(s)
+            LayoutSVGInlineText {#text} at (0,0) size 130x82
+              chunk 1 (middle anchor) text run 1 at (37.84,125.00) startOffset 0 endOffset 3 width 124.32: "SVG"

diff --git a/third_party/WebKit/PerformanceTests/Bindings/post-message.html b/third_party/WebKit/PerformanceTests/Bindings/post-message.html
new file mode 100644
index 0000000..862aa824
--- /dev/null
+++ b/third_party/WebKit/PerformanceTests/Bindings/post-message.html

@@ -0,0 +1,20 @@
+<!DOCTYPE html>
+<body>
+<script src="../resources/runner.js"></script>
+<script>
+
+var times = 100000;
+var worker = new Worker('resources/worker.js');
+worker.onmessage = function(event) {
+    console.log("received");
+};
+
+PerfTestRunner.measureTime({
+    description: "Measures performance of postMessage().",
+    run: function() {
+        for (var i = 0; i < times; i++)
+            worker.postMessage('foo');
+    }
+});
+</script>
+</body>

diff --git a/third_party/WebKit/Source/bindings/core/v8/CallbackPromiseAdapter.h b/third_party/WebKit/Source/bindings/core/v8/CallbackPromiseAdapter.h
index baabc3c..65e9b930 100644
--- a/third_party/WebKit/Source/bindings/core/v8/CallbackPromiseAdapter.h
+++ b/third_party/WebKit/Source/bindings/core/v8/CallbackPromiseAdapter.h

@@ -33,11 +33,12 @@
 
 #include "bindings/core/v8/ScriptPromiseResolver.h"
 #include "public/platform/WebCallbacks.h"
-#include "public/platform/WebPassOwnPtr.h"
 #include "wtf/OwnPtr.h"
 #include "wtf/PassOwnPtr.h"
 #include "wtf/TypeTraits.h"
 
+#include <memory>
+
 namespace blink {
 
 // CallbackPromiseAdapter is a WebCallbacks subclass and resolves / rejects the
@@ -50,7 +51,7 @@
 //    CallbackPromiseAdapter<bool, void> is a subclass of
 //    WebCallbacks<bool, void>.
 //  - If a WebType is OwnPtr<T>, its corresponding type parameter on
-//    WebCallbacks is WebPassOwnPtr<T>, because WebCallbacks must be exposed to
+//    WebCallbacks is std::unique_ptr<T>, because WebCallbacks must be exposed to
 //    Chromium.
 //
 // When onSuccess is called with a S::WebType value, the value is passed to
@@ -81,7 +82,7 @@
 //     }
 //     ...
 // };
-// OwnPtr<WebCallbacks<WebPassOwnPtr<WebMyClass>, const WebMyErrorClass&>>
+// OwnPtr<WebCallbacks<std::unique_ptr<WebMyClass>, const WebMyErrorClass&>>
 //     callbacks = adoptPtr(new CallbackPromiseAdapter<MyClass, MyErrorClass>(
 //     resolver));
 // ...
@@ -133,12 +134,13 @@
     };
     template <typename T>
     struct WebPassTypeImpl<OwnPtr<T>> {
-        using Type = WebPassOwnPtr<T>;
+        using Type = std::unique_ptr<T>;
     };
     template <typename T> using PassType = typename PassTypeImpl<T>::Type;
     template <typename T> using WebPassType = typename WebPassTypeImpl<T>::Type;
     template <typename T> static T& adopt(T& x) { return x; }
-    template <typename T> static PassOwnPtr<T> adopt(WebPassOwnPtr<T>& x) { return x.release(); }
+    template <typename T>
+    static PassOwnPtr<T> adopt(std::unique_ptr<T>& x) { return adoptPtr(x.release()); }
     template <typename T> static PassType<T> pass(T& x) { return x; }
     template <typename T> static PassOwnPtr<T> pass(OwnPtr<T>& x) { return x.release(); }
 

diff --git a/third_party/WebKit/Source/bindings/core/v8/DocumentWriteEvaluator.cpp b/third_party/WebKit/Source/bindings/core/v8/DocumentWriteEvaluator.cpp
index beedbbd..cdd62e4 100644
--- a/third_party/WebKit/Source/bindings/core/v8/DocumentWriteEvaluator.cpp
+++ b/third_party/WebKit/Source/bindings/core/v8/DocumentWriteEvaluator.cpp

@@ -41,6 +41,15 @@
     m_userAgent = document.userAgent();
 }
 
+// For unit testing.
+DocumentWriteEvaluator::DocumentWriteEvaluator(const String& pathName, const String& hostName, const String& protocol, const String& userAgent)
+    : m_pathName(pathName)
+    , m_hostName(hostName)
+    , m_protocol(protocol)
+    , m_userAgent(userAgent)
+{
+}
+
 DocumentWriteEvaluator::~DocumentWriteEvaluator()
 {
 }

diff --git a/third_party/WebKit/Source/bindings/core/v8/DocumentWriteEvaluator.h b/third_party/WebKit/Source/bindings/core/v8/DocumentWriteEvaluator.h
index baccc5b9..b7f1914 100644
--- a/third_party/WebKit/Source/bindings/core/v8/DocumentWriteEvaluator.h
+++ b/third_party/WebKit/Source/bindings/core/v8/DocumentWriteEvaluator.h

@@ -23,6 +23,9 @@
     USING_FAST_MALLOC(DocumentWriteEvaluator);
 
 public:
+    // For unit testing.
+    DocumentWriteEvaluator(const String& pathName, const String& hostName, const String& protocol, const String& userAgent);
+
     static PassOwnPtr<DocumentWriteEvaluator> create(const Document& document)
     {
         return adoptPtr(new DocumentWriteEvaluator(document));
@@ -54,8 +57,8 @@
 
     String m_pathName;
     String m_hostName;
-    String m_userAgent;
     String m_protocol;
+    String m_userAgent;
 };
 
 } // namespace blink

diff --git a/third_party/WebKit/Source/bindings/core/v8/DocumentWriteEvaluatorTest.cpp b/third_party/WebKit/Source/bindings/core/v8/DocumentWriteEvaluatorTest.cpp
new file mode 100644
index 0000000..882354c
--- /dev/null
+++ b/third_party/WebKit/Source/bindings/core/v8/DocumentWriteEvaluatorTest.cpp

@@ -0,0 +1,120 @@
+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "bindings/core/v8/DocumentWriteEvaluator.h"
+
+#include "bindings/core/v8/V8Binding.h"
+#include "testing/gtest/include/gtest/gtest.h"
+
+namespace blink {
+
+namespace {
+
+class DocumentWriteEvaluatorTest : public ::testing::Test {
+public:
+    DocumentWriteEvaluatorTest()
+        : m_evaluator(new DocumentWriteEvaluator("/path/", "www.example.com", "http:", "userAgent"))
+    {
+        m_evaluator->ensureEvaluationContext();
+    }
+    std::unique_ptr<DocumentWriteEvaluator> m_evaluator;
+};
+
+} // namespace
+
+TEST_F(DocumentWriteEvaluatorTest, NoEvaluation)
+{
+    String written = m_evaluator->evaluateAndEmitWrittenSource(
+        "var a = 2;");
+    EXPECT_EQ("", written);
+}
+
+TEST_F(DocumentWriteEvaluatorTest, SimpleDocumentWrite)
+{
+    String written = m_evaluator->evaluateAndEmitWrittenSource(
+        "document.write('Hello, World!');");
+    EXPECT_EQ("Hello, World!", written);
+}
+
+TEST_F(DocumentWriteEvaluatorTest, WriteBeforeError)
+{
+    String written = m_evaluator->evaluateAndEmitWrittenSource(
+        "document.write('Hello, World!');"
+        "console.log('this causes an exception');");
+    EXPECT_EQ("Hello, World!", written);
+}
+
+TEST_F(DocumentWriteEvaluatorTest, MultipleWrites)
+{
+    String written = m_evaluator->evaluateAndEmitWrittenSource(
+        "document.write('Hello, World', '!');"
+        "window.document.write('How' + ' are you?');"
+        "document.writeln('Not bad.');");
+    EXPECT_EQ("Hello, World!How are you?Not bad.", written);
+}
+
+TEST_F(DocumentWriteEvaluatorTest, HandleSimpleFunctions)
+{
+    String written = m_evaluator->evaluateAndEmitWrittenSource(
+        "(function(src) {"
+        "document.write(src);"
+        "})('Hello, World!');");
+    EXPECT_EQ("Hello, World!", written);
+}
+
+TEST_F(DocumentWriteEvaluatorTest, DynamicDocWrite)
+{
+    String written = m_evaluator->evaluateAndEmitWrittenSource(
+        "var write = document.write;"
+        "(function(f, w) {"
+        "f(w);"
+        "})(write, 'Hello, World!');");
+    EXPECT_EQ("Hello, World!", written);
+}
+
+TEST_F(DocumentWriteEvaluatorTest, MultipleScripts)
+{
+    String written = m_evaluator->evaluateAndEmitWrittenSource(
+        "var write = document.write;"
+        "write('Hello');");
+    EXPECT_EQ("Hello", written);
+
+    String written2 = m_evaluator->evaluateAndEmitWrittenSource(
+        "write('Hello');");
+    EXPECT_EQ("Hello", written2);
+}
+
+TEST_F(DocumentWriteEvaluatorTest, UsePath)
+{
+    String written = m_evaluator->evaluateAndEmitWrittenSource(
+        "document.write(location.pathname);"
+        "document.write(' ', window.location.pathname);");
+    EXPECT_EQ("/path/ /path/", written);
+}
+
+TEST_F(DocumentWriteEvaluatorTest, UseHost)
+{
+    String written = m_evaluator->evaluateAndEmitWrittenSource(
+        "document.write(location.hostname);"
+        "document.write(' ', window.location.hostname);");
+    EXPECT_EQ("www.example.com www.example.com", written);
+}
+
+TEST_F(DocumentWriteEvaluatorTest, UseProtocol)
+{
+    String written = m_evaluator->evaluateAndEmitWrittenSource(
+        "document.write(location.protocol);"
+        "document.write(' ', window.location.protocol);");
+    EXPECT_EQ("http: http:", written);
+}
+
+TEST_F(DocumentWriteEvaluatorTest, UseUserAgent)
+{
+    String written = m_evaluator->evaluateAndEmitWrittenSource(
+        "document.write(navigator.userAgent);"
+        "document.write(' ', window.navigator.userAgent);");
+    EXPECT_EQ("userAgent userAgent", written);
+}
+
+} // namespace blink

diff --git a/third_party/WebKit/Source/bindings/core/v8/v8.gypi b/third_party/WebKit/Source/bindings/core/v8/v8.gypi
index 1e816ea..dbab681ab 100644
--- a/third_party/WebKit/Source/bindings/core/v8/v8.gypi
+++ b/third_party/WebKit/Source/bindings/core/v8/v8.gypi

@@ -177,6 +177,7 @@
             'WrapperTypeInfo.h',
         ],
         'bindings_core_v8_unittest_files': [
+            'DocumentWriteEvaluatorTest.cpp',
             'ScriptPromisePropertyTest.cpp',
             'ScriptPromiseResolverTest.cpp',
             'ScriptPromiseTest.cpp',

diff --git a/third_party/WebKit/Source/core/dom/Document.cpp b/third_party/WebKit/Source/core/dom/Document.cpp
index 1e74e399..1de225c 100644
--- a/third_party/WebKit/Source/core/dom/Document.cpp
+++ b/third_party/WebKit/Source/core/dom/Document.cpp

@@ -1559,7 +1559,7 @@
 
 void Document::scheduleLayoutTreeUpdate()
 {
-    ASSERT(!hasPendingStyleRecalc());
+    ASSERT(!hasPendingVisualUpdate());
     ASSERT(shouldScheduleLayoutTreeUpdate());
     ASSERT(needsLayoutTreeUpdate());
 
@@ -1575,7 +1575,7 @@
 
 bool Document::hasPendingForcedStyleRecalc() const
 {
-    return hasPendingStyleRecalc() && !inStyleRecalc() && getStyleChangeType() >= SubtreeStyleChange;
+    return hasPendingVisualUpdate() && !inStyleRecalc() && getStyleChangeType() >= SubtreeStyleChange;
 }
 
 void Document::updateStyleInvalidationIfNeeded()

diff --git a/third_party/WebKit/Source/core/dom/Document.h b/third_party/WebKit/Source/core/dom/Document.h
index 00a9dc0..bddd60c2 100644
--- a/third_party/WebKit/Source/core/dom/Document.h
+++ b/third_party/WebKit/Source/core/dom/Document.h

@@ -1092,8 +1092,7 @@
     SecurityContext& securityContext() final { return *this; }
     EventQueue* getEventQueue() const final;
 
-    // FIXME: Rename the StyleRecalc state to LayoutTreeUpdate.
-    bool hasPendingStyleRecalc() const { return m_lifecycle.state() == DocumentLifecycle::VisualUpdatePending; }
+    bool hasPendingVisualUpdate() const { return m_lifecycle.state() == DocumentLifecycle::VisualUpdatePending; }
 
     bool shouldScheduleLayoutTreeUpdate() const;
     void scheduleLayoutTreeUpdate();
@@ -1417,7 +1416,7 @@
 inline void Document::scheduleLayoutTreeUpdateIfNeeded()
 {
     // Inline early out to avoid the function calls below.
-    if (hasPendingStyleRecalc())
+    if (hasPendingVisualUpdate())
         return;
     if (shouldScheduleLayoutTreeUpdate() && needsLayoutTreeUpdate())
         scheduleLayoutTreeUpdate();

diff --git a/third_party/WebKit/Source/core/editing/EditingUtilities.cpp b/third_party/WebKit/Source/core/editing/EditingUtilities.cpp
index 8afb247a..81ad1146 100644
--- a/third_party/WebKit/Source/core/editing/EditingUtilities.cpp
+++ b/third_party/WebKit/Source/core/editing/EditingUtilities.cpp

@@ -42,6 +42,8 @@
 #include "core/editing/iterators/TextIterator.h"
 #include "core/editing/serializers/HTMLInterchange.h"
 #include "core/editing/state_machines/BackspaceStateMachine.h"
+#include "core/editing/state_machines/BackwardGraphemeBoundaryStateMachine.h"
+#include "core/editing/state_machines/ForwardGraphemeBoundaryStateMachine.h"
 #include "core/frame/LocalFrame.h"
 #include "core/frame/UseCounter.h"
 #include "core/html/HTMLBRElement.h"
@@ -555,7 +557,7 @@
         if (state != TextSegmentationMachineState::NeedMoreCodeUnit)
             break;
     }
-    if (state == TextSegmentationMachineState::NeedMoreCodeUnit)
+    if (current == 0 || state == TextSegmentationMachineState::NeedMoreCodeUnit)
         state = machine.tellEndOfPrecedingText();
     if (state == TextSegmentationMachineState::Finished)
         return current + machine.finalizeAndGetBoundaryOffset();
@@ -571,16 +573,15 @@
 
 int previousGraphemeBoundaryOf(const Node* node, int current)
 {
-    if (!node->isTextNode())
+    // TODO(yosin): Need to support grapheme crossing |Node| boundary.
+    DCHECK_GE(current, 0);
+    if (current <= 1 || !node->isTextNode())
         return current - 1;
     const String& text = toText(node)->data();
-    if (text.is8Bit())
-        return current - 1; // TODO(nona): Good to support CR x LF.
-    TextBreakIterator* iterator = cursorMovementIterator(text.characters16(), text.length());
-    if (!iterator)
+    // TODO(yosin): Replace with DCHECK for out-of-range request.
+    if (static_cast<unsigned>(current) > text.length())
         return current - 1;
-    const int result = iterator->preceding(current);
-    return result == TextBreakDone ? current - 1 : result;
+    return findNextBoundaryOffset<BackwardGraphemeBoundaryStateMachine>(text, current);
 }
 
 static int previousBackwardDeletionOffsetOf(const Node* node, int current)
@@ -598,16 +599,15 @@
 
 int nextGraphemeBoundaryOf(const Node* node, int current)
 {
+    // TODO(yosin): Need to support grapheme crossing |Node| boundary.
     if (!node->isTextNode())
         return current + 1;
     const String& text = toText(node)->data();
-    if (text.is8Bit())
-        return current + 1; // TODO(nona): Good to support CR x LF.
-    TextBreakIterator* iterator = cursorMovementIterator(text.characters16(), text.length());
-    if (!iterator)
+    const int length = text.length();
+    DCHECK_LE(current, length);
+    if (current >= length - 1)
         return current + 1;
-    const int result = iterator->following(current);
-    return result == TextBreakDone ? current + 1 : result;
+    return findNextBoundaryOffset<ForwardGraphemeBoundaryStateMachine>(text, current);
 }
 
 template <typename Strategy>

diff --git a/third_party/WebKit/Source/core/editing/EditingUtilitiesTest.cpp b/third_party/WebKit/Source/core/editing/EditingUtilitiesTest.cpp
index 8de7431..f7cb54c2 100644
--- a/third_party/WebKit/Source/core/editing/EditingUtilitiesTest.cpp
+++ b/third_party/WebKit/Source/core/editing/EditingUtilitiesTest.cpp

@@ -156,8 +156,8 @@
     Node* host = document().getElementById("host");
     Node* two = document().getElementById("two");
 
-    EXPECT_EQ(Position(host, 3), nextPositionOf(Position(two, 2), PositionMoveType::CodeUnit));
-    EXPECT_EQ(PositionInFlatTree(host, 1), nextPositionOf(PositionInFlatTree(two, 2), PositionMoveType::CodeUnit));
+    EXPECT_EQ(Position(host, 3), nextPositionOf(Position(two, 2), PositionMoveType::CodePoint));
+    EXPECT_EQ(PositionInFlatTree(host, 1), nextPositionOf(PositionInFlatTree(two, 2), PositionMoveType::CodePoint));
 }
 
 TEST_F(EditingUtilitiesTest, NextVisuallyDistinctCandidate)
@@ -261,12 +261,10 @@
     setBodyContent("<p id='target'>a&#x0D;&#x0A;b</p>");
     node = document().getElementById("target")->firstChild();
     EXPECT_EQ(3, previousGraphemeBoundaryOf(node, 4));
-    // TODO(nona) : Enable following expectation.
-    // EXPECT_EQ(1, previousGraphemeBoundaryOf(node, 3));
+    EXPECT_EQ(1, previousGraphemeBoundaryOf(node, 3));
     EXPECT_EQ(0, previousGraphemeBoundaryOf(node, 1));
     EXPECT_EQ(1, nextGraphemeBoundaryOf(node, 0));
-    // TODO(nona) : Enable following expectation.
-    // EXPECT_EQ(3, nextGraphemeBoundaryOf(node, 1));
+    EXPECT_EQ(3, nextGraphemeBoundaryOf(node, 1));
     EXPECT_EQ(4, nextGraphemeBoundaryOf(node, 3));
 
     // GB4,GB5: Break before and after CR/LF/Control.
@@ -396,12 +394,11 @@
     node = document().getElementById("target")->firstChild();
     EXPECT_EQ(16, previousGraphemeBoundaryOf(node, 17));
     EXPECT_EQ(12, previousGraphemeBoundaryOf(node, 16));
-    // TODO(nona): Enable following expectations.
-    // EXPECT_EQ(8, previousGraphemeBoundaryOf(node, 12));
-    // EXPECT_EQ(4, previousGraphemeBoundaryOf(node, 8));
-    // EXPECT_EQ(0, previousGraphemeBoundaryOf(node, 4));
-    // EXPECT_EQ(4, nextGraphemeBoundaryOf(node, 0));
-    // EXPECT_EQ(8, nextGraphemeBoundaryOf(node, 4));
+    EXPECT_EQ(8, previousGraphemeBoundaryOf(node, 12));
+    EXPECT_EQ(4, previousGraphemeBoundaryOf(node, 8));
+    EXPECT_EQ(0, previousGraphemeBoundaryOf(node, 4));
+    EXPECT_EQ(4, nextGraphemeBoundaryOf(node, 0));
+    EXPECT_EQ(8, nextGraphemeBoundaryOf(node, 4));
     EXPECT_EQ(12, nextGraphemeBoundaryOf(node, 8));
     EXPECT_EQ(16, nextGraphemeBoundaryOf(node, 12));
     EXPECT_EQ(17, nextGraphemeBoundaryOf(node, 16));
@@ -411,15 +408,13 @@
     node = document().getElementById("target")->firstChild();
     EXPECT_EQ(17, previousGraphemeBoundaryOf(node, 18));
     EXPECT_EQ(13, previousGraphemeBoundaryOf(node, 17));
-    // TODO(nona): Enable following expectations.
-    // EXPECT_EQ(9, previousGraphemeBoundaryOf(node, 13));
-    // EXPECT_EQ(5, previousGraphemeBoundaryOf(node, 9));
+    EXPECT_EQ(9, previousGraphemeBoundaryOf(node, 13));
+    EXPECT_EQ(5, previousGraphemeBoundaryOf(node, 9));
     EXPECT_EQ(1, previousGraphemeBoundaryOf(node, 5));
     EXPECT_EQ(0, previousGraphemeBoundaryOf(node, 1));
     EXPECT_EQ(1, nextGraphemeBoundaryOf(node, 0));
-    // TODO(nona): Enable following expectations.
-    // EXPECT_EQ(5, nextGraphemeBoundaryOf(node, 1));
-    // EXPECT_EQ(9, nextGraphemeBoundaryOf(node, 5));
+    EXPECT_EQ(5, nextGraphemeBoundaryOf(node, 1));
+    EXPECT_EQ(9, nextGraphemeBoundaryOf(node, 5));
     EXPECT_EQ(13, nextGraphemeBoundaryOf(node, 9));
     EXPECT_EQ(17, nextGraphemeBoundaryOf(node, 13));
     EXPECT_EQ(18, nextGraphemeBoundaryOf(node, 17));
@@ -428,18 +423,16 @@
     setBodyContent("<p id='target'>a" + flag + flag + flag + flag + "&#x1F1F8;b</p>"); // RI ÷ RI
     node = document().getElementById("target")->firstChild();
     EXPECT_EQ(19, previousGraphemeBoundaryOf(node, 20));
-    // TODO(nona): Enable following expectations.
-    // EXPECT_EQ(17, previousGraphemeBoundaryOf(node, 19));
-    // EXPECT_EQ(13, previousGraphemeBoundaryOf(node, 17));
-    // EXPECT_EQ(9, previousGraphemeBoundaryOf(node, 13));
-    // EXPECT_EQ(5, previousGraphemeBoundaryOf(node, 9));
+    EXPECT_EQ(17, previousGraphemeBoundaryOf(node, 19));
+    EXPECT_EQ(13, previousGraphemeBoundaryOf(node, 17));
+    EXPECT_EQ(9, previousGraphemeBoundaryOf(node, 13));
+    EXPECT_EQ(5, previousGraphemeBoundaryOf(node, 9));
     EXPECT_EQ(1, previousGraphemeBoundaryOf(node, 5));
     EXPECT_EQ(0, previousGraphemeBoundaryOf(node, 1));
     EXPECT_EQ(1, nextGraphemeBoundaryOf(node, 0));
-    // TODO(nona): Enable following expectations.
-    // EXPECT_EQ(5, nextGraphemeBoundaryOf(node, 1));
-    // EXPECT_EQ(9, nextGraphemeBoundaryOf(node, 5));
-    // EXPECT_EQ(13, nextGraphemeBoundaryOf(node, 9));
+    EXPECT_EQ(5, nextGraphemeBoundaryOf(node, 1));
+    EXPECT_EQ(9, nextGraphemeBoundaryOf(node, 5));
+    EXPECT_EQ(13, nextGraphemeBoundaryOf(node, 9));
     EXPECT_EQ(17, nextGraphemeBoundaryOf(node, 13));
     EXPECT_EQ(19, nextGraphemeBoundaryOf(node, 17));
     EXPECT_EQ(20, nextGraphemeBoundaryOf(node, 19));
@@ -469,9 +462,12 @@
     EXPECT_EQ(2, nextGraphemeBoundaryOf(node, 0));
     EXPECT_EQ(3, nextGraphemeBoundaryOf(node, 2));
 
-    // GB9b: Do not break after Prepend but Blink breaks after Prepend char to address Bug 24342.
-    // U+0600(ARABIC NUMBER SIGN) has Prepend property.
-    setBodyContent("<p id='target'>a&#x0600;b</p>"); // Prepend x
+    // GB9b: Do not break after Prepend.
+    // TODO(nona): Introduce Prepend test case once ICU grabs Unicode 9.0.
+
+    // For https://bugs.webkit.org/show_bug.cgi?id=24342
+    // The break should happens after Thai character.
+    setBodyContent("<p id='target'>a&#x0E40;b</p>");
     node = document().getElementById("target")->firstChild();
     EXPECT_EQ(2, previousGraphemeBoundaryOf(node, 3));
     EXPECT_EQ(1, previousGraphemeBoundaryOf(node, 2));
@@ -490,7 +486,7 @@
     EXPECT_EQ(3, nextGraphemeBoundaryOf(node, 1));
     EXPECT_EQ(4, nextGraphemeBoundaryOf(node, 3));
 
-    // Additional rule for Virama: Do not break after Virama except for Tamil.
+    // Additional rule for IndicSyllabicCategory=Virama: Do not break after that.
     // See http://www.unicode.org/Public/9.0.0/ucd/IndicSyllabicCategory-9.0.0d2.txt
     // U+0905 is DEVANAGARI LETTER A. This has Extend property.
     // U+094D is DEVANAGARI SIGN VIRAMA. This has Virama property.
@@ -503,10 +499,11 @@
     EXPECT_EQ(1, nextGraphemeBoundaryOf(node, 0));
     EXPECT_EQ(4, nextGraphemeBoundaryOf(node, 1));
     EXPECT_EQ(5, nextGraphemeBoundaryOf(node, 4));
-    // U+0B85 is TAMIL LETTER A. This has Extend property.
-    // U+0BCD is TAMIL SIGN VIRAMA. This has Virama property.
-    // U+0B95 is TAMIL LETTER KA.
-    setBodyContent("<p id='target'>a&#x0B85;&#x0BCD;&#x0B95;b</p>");
+    // U+0E01 is THAI CHARACTER KO KAI
+    // U+0E3A is THAI CHARACTER PHINTHU
+    // Should break after U+0E3A since U+0E3A has Virama property but not listed in
+    // IndicSyllabicCategory=Virama.
+    setBodyContent("<p id='target'>a&#x0E01;&#x0E3A;&#x0E01;b</p>");
     node = document().getElementById("target")->firstChild();
     EXPECT_EQ(4, previousGraphemeBoundaryOf(node, 5));
     EXPECT_EQ(3, previousGraphemeBoundaryOf(node, 4));
@@ -516,7 +513,6 @@
     EXPECT_EQ(3, nextGraphemeBoundaryOf(node, 1));
     EXPECT_EQ(4, nextGraphemeBoundaryOf(node, 3));
     EXPECT_EQ(5, nextGraphemeBoundaryOf(node, 4));
-    // TODO(nona): Consider to add Sinhala, Balinese, etc.
 
     // GB10: Do not break within emoji modifier.
     // U+1F385(FATHER CHRISTMAS) has E_Base property.
@@ -524,23 +520,19 @@
     setBodyContent("<p id='target'>a&#x1F385;&#x1F3FB;b</p>"); // E_Base x E_Modifier
     node = document().getElementById("target")->firstChild();
     EXPECT_EQ(5, previousGraphemeBoundaryOf(node, 6));
-    // TODO(nona): Enable following expectation.
-    // EXPECT_EQ(1, previousGraphemeBoundaryOf(node, 5));
+    EXPECT_EQ(1, previousGraphemeBoundaryOf(node, 5));
     EXPECT_EQ(0, previousGraphemeBoundaryOf(node, 1));
     EXPECT_EQ(1, nextGraphemeBoundaryOf(node, 0));
-    // TODO(nona): Enable following expectation.
-    // EXPECT_EQ(5, nextGraphemeBoundaryOf(node, 1));
+    EXPECT_EQ(5, nextGraphemeBoundaryOf(node, 1));
     EXPECT_EQ(6, nextGraphemeBoundaryOf(node, 5));
     // U+1F466(BOY) has EBG property.
     setBodyContent("<p id='target'>a&#x1F466;&#x1F3FB;b</p>"); // EBG x E_Modifier
     node = document().getElementById("target")->firstChild();
     EXPECT_EQ(5, previousGraphemeBoundaryOf(node, 6));
-    // TODO(nona): Enable following expectation.
-    // EXPECT_EQ(1, previousGraphemeBoundaryOf(node, 5));
+    EXPECT_EQ(1, previousGraphemeBoundaryOf(node, 5));
     EXPECT_EQ(0, previousGraphemeBoundaryOf(node, 1));
     EXPECT_EQ(1, nextGraphemeBoundaryOf(node, 0));
-    // TODO(nona): Enable following expectation.
-    // EXPECT_EQ(5, nextGraphemeBoundaryOf(node, 1));
+    EXPECT_EQ(5, nextGraphemeBoundaryOf(node, 1));
     EXPECT_EQ(6, nextGraphemeBoundaryOf(node, 5));
 
     // GB11: Do not break within ZWJ emoji sequence.
@@ -548,16 +540,14 @@
     setBodyContent("<p id='target'>a&#x200D;&#x2764;b</p>"); // ZWJ x Glue_After_Zwj
     node = document().getElementById("target")->firstChild();
     EXPECT_EQ(3, previousGraphemeBoundaryOf(node, 4));
-    // TODO(nona): Enable following expectation.
-    // EXPECT_EQ(0, previousGraphemeBoundaryOf(node, 3));
-    // EXPECT_EQ(3, nextGraphemeBoundaryOf(node, 0));
+    EXPECT_EQ(0, previousGraphemeBoundaryOf(node, 3));
+    EXPECT_EQ(3, nextGraphemeBoundaryOf(node, 0));
     EXPECT_EQ(4, nextGraphemeBoundaryOf(node, 3));
     setBodyContent("<p id='target'>a&#x200D;&#x1F466;b</p>"); // ZWJ x EBG
     node = document().getElementById("target")->firstChild();
     EXPECT_EQ(4, previousGraphemeBoundaryOf(node, 5));
-    // TODO(nona): Enable following expectation.
-    // EXPECT_EQ(0, previousGraphemeBoundaryOf(node, 4));
-    // EXPECT_EQ(4, nextGraphemeBoundaryOf(node, 0));
+    EXPECT_EQ(0, previousGraphemeBoundaryOf(node, 4));
+    EXPECT_EQ(4, nextGraphemeBoundaryOf(node, 0));
     EXPECT_EQ(5, nextGraphemeBoundaryOf(node, 4));
 
     // GB999: Otherwise break everywhere.

diff --git a/third_party/WebKit/Source/core/editing/state_machines/BackwardGraphemeBoundaryStateMachine.cpp b/third_party/WebKit/Source/core/editing/state_machines/BackwardGraphemeBoundaryStateMachine.cpp
index eef83ec1..b91624b6 100644
--- a/third_party/WebKit/Source/core/editing/state_machines/BackwardGraphemeBoundaryStateMachine.cpp
+++ b/third_party/WebKit/Source/core/editing/state_machines/BackwardGraphemeBoundaryStateMachine.cpp

@@ -7,11 +7,16 @@
 #include "core/editing/state_machines/StateMachineUtil.h"
 #include "core/editing/state_machines/TextSegmentationMachineState.h"
 #include "platform/text/Character.h"
+#include "wtf/text/CharacterNames.h"
 #include "wtf/text/Unicode.h"
 #include <ostream> // NOLINT
 
 namespace blink {
 
+namespace {
+const UChar32 kInvalidCodePoint = WTF::Unicode::kMaxCodepoint + 1;
+} // namespace
+
 #define FOR_EACH_BACKWARD_GRAPHEME_BOUNDARY_STATE(V)                           \
     /* Initial state */                                                        \
     V(Start)                                                                   \
@@ -49,7 +54,8 @@
 }
 
 BackwardGraphemeBoundaryStateMachine::BackwardGraphemeBoundaryStateMachine()
-    : m_internalState(InternalState::Start)
+    : m_nextCodePoint(kInvalidCodePoint),
+    m_internalState(InternalState::Start)
 {
 }
 
@@ -59,7 +65,7 @@
     switch (m_internalState) {
     case InternalState::Start:
         DCHECK_EQ(m_trailSurrogate, 0);
-        DCHECK_EQ(m_nextCodePoint, 0);
+        DCHECK_EQ(m_nextCodePoint, kInvalidCodePoint);
         DCHECK_EQ(m_boundaryOffset, 0);
         DCHECK_EQ(m_precedingRISCount, 0);
         if (U16_IS_TRAIL(codeUnit)) {
@@ -76,7 +82,7 @@
         return moveToNextState(InternalState::Search);
     case InternalState::StartWaitLeadSurrogate:
         DCHECK_NE(m_trailSurrogate, 0);
-        DCHECK_EQ(m_nextCodePoint, 0);
+        DCHECK_EQ(m_nextCodePoint, kInvalidCodePoint);
         DCHECK_EQ(m_boundaryOffset, 0);
         DCHECK_EQ(m_precedingRISCount, 0);
         if (!U16_IS_LEAD(codeUnit)) {
@@ -90,7 +96,7 @@
         return moveToNextState(InternalState::Search);
     case InternalState::Search:
         DCHECK_EQ(m_trailSurrogate, 0);
-        DCHECK_NE(m_nextCodePoint, 0);
+        DCHECK_NE(m_nextCodePoint, kInvalidCodePoint);
         DCHECK_LT(m_boundaryOffset, 0);
         DCHECK_EQ(m_precedingRISCount, 0);
         if (U16_IS_TRAIL(codeUnit)) {
@@ -107,7 +113,7 @@
         return staySameState();
     case InternalState::SearchWaitLeadSurrogate:
         DCHECK_NE(m_trailSurrogate, 0);
-        DCHECK_NE(m_nextCodePoint, 0);
+        DCHECK_NE(m_nextCodePoint, kInvalidCodePoint);
         DCHECK_LT(m_boundaryOffset, 0);
         DCHECK_EQ(m_precedingRISCount, 0);
         if (!U16_IS_LEAD(codeUnit))
@@ -235,7 +241,7 @@
 void BackwardGraphemeBoundaryStateMachine::reset()
 {
     m_trailSurrogate = 0;
-    m_nextCodePoint = 0;
+    m_nextCodePoint = kInvalidCodePoint;
     m_boundaryOffset = 0;
     m_precedingRISCount = 0;
     m_internalState = InternalState::Start;

diff --git a/third_party/WebKit/Source/core/editing/state_machines/BackwardGraphemeBoundaryStateMachine.h b/third_party/WebKit/Source/core/editing/state_machines/BackwardGraphemeBoundaryStateMachine.h
index 7db5c0d5..b1ed261 100644
--- a/third_party/WebKit/Source/core/editing/state_machines/BackwardGraphemeBoundaryStateMachine.h
+++ b/third_party/WebKit/Source/core/editing/state_machines/BackwardGraphemeBoundaryStateMachine.h

@@ -56,7 +56,7 @@
     UChar m_trailSurrogate = 0;
 
     // The code point immediately after the m_BoundaryOffset.
-    UChar32 m_nextCodePoint = 0;
+    UChar32 m_nextCodePoint;
 
     // The relative offset from the begging of this state machine.
     int m_boundaryOffset = 0;

diff --git a/third_party/WebKit/Source/core/editing/state_machines/BackwardGraphemeBoundaryStateMachineTest.cpp b/third_party/WebKit/Source/core/editing/state_machines/BackwardGraphemeBoundaryStateMachineTest.cpp
index b31627d7..4c8e560 100644
--- a/third_party/WebKit/Source/core/editing/state_machines/BackwardGraphemeBoundaryStateMachineTest.cpp
+++ b/third_party/WebKit/Source/core/editing/state_machines/BackwardGraphemeBoundaryStateMachineTest.cpp

@@ -71,6 +71,10 @@
 {
     BackwardGraphemeBoundaryStateMachine machine;
 
+    // U+0000 + U+0000
+    EXPECT_EQ("RF", processSequenceBackward(&machine, { 0, 0 }));
+    EXPECT_EQ(-1, machine.finalizeAndGetBoundaryOffset());
+
     // 'a' + 'a'
     EXPECT_EQ("RF", processSequenceBackward(&machine, { 'a', 'a' }));
     EXPECT_EQ(-1, machine.finalizeAndGetBoundaryOffset());

diff --git a/third_party/WebKit/Source/core/editing/state_machines/ForwardGraphemeBoundaryStateMachine.cpp b/third_party/WebKit/Source/core/editing/state_machines/ForwardGraphemeBoundaryStateMachine.cpp
index 1caa4b8..88c08051 100644
--- a/third_party/WebKit/Source/core/editing/state_machines/ForwardGraphemeBoundaryStateMachine.cpp
+++ b/third_party/WebKit/Source/core/editing/state_machines/ForwardGraphemeBoundaryStateMachine.cpp

@@ -11,6 +11,9 @@
 #include <ostream> // NOLINT
 
 namespace blink {
+namespace {
+const UChar32 kInvalidCodePoint = WTF::Unicode::kMaxCodepoint + 1;
+} // namespace
 
 #define FOR_EACH_FORWARD_GRAPHEME_BOUNDARY_STATE(V)                      \
     /* Counting preceding regional indicators. This is initial state. */ \
@@ -49,14 +52,15 @@
 }
 
 ForwardGraphemeBoundaryStateMachine::ForwardGraphemeBoundaryStateMachine()
-    : m_internalState(InternalState::CountRIS)
+    : m_prevCodePoint(kInvalidCodePoint),
+    m_internalState(InternalState::CountRIS)
 {
 }
 
 TextSegmentationMachineState
 ForwardGraphemeBoundaryStateMachine::feedPrecedingCodeUnit(UChar codeUnit)
 {
-    DCHECK_EQ(m_prevCodePoint, 0);
+    DCHECK_EQ(m_prevCodePoint, kInvalidCodePoint);
     DCHECK_EQ(m_boundaryOffset, 0);
     switch (m_internalState) {
     case InternalState::CountRIS:
@@ -106,7 +110,7 @@
             << " is returned. InternalState: " << m_internalState;
         return finish();
     case InternalState::StartForward:
-        DCHECK_EQ(m_prevCodePoint, 0);
+        DCHECK_EQ(m_prevCodePoint, kInvalidCodePoint);
         DCHECK_EQ(m_boundaryOffset, 0);
         DCHECK_EQ(m_pendingCodeUnit, 0);
         if (U16_IS_TRAIL(codeUnit)) {
@@ -123,7 +127,7 @@
         m_boundaryOffset = 1;
         return moveToNextState(InternalState::Search);
     case InternalState::StartForwardWaitTrailSurrgate:
-        DCHECK_EQ(m_prevCodePoint, 0);
+        DCHECK_EQ(m_prevCodePoint, kInvalidCodePoint);
         DCHECK_EQ(m_boundaryOffset, 0);
         DCHECK_NE(m_pendingCodeUnit, 0);
         if (U16_IS_TRAIL(codeUnit)) {
@@ -137,7 +141,7 @@
         m_boundaryOffset = 1;
         return finish();
     case InternalState::Search:
-        DCHECK_NE(m_prevCodePoint, 0);
+        DCHECK_NE(m_prevCodePoint, kInvalidCodePoint);
         DCHECK_NE(m_boundaryOffset, 0);
         DCHECK_EQ(m_pendingCodeUnit, 0);
         if (U16_IS_LEAD(codeUnit)) {
@@ -152,7 +156,7 @@
         m_boundaryOffset += 1;
         return staySameState();
     case InternalState::SearchWaitTrailSurrogate:
-        DCHECK_NE(m_prevCodePoint, 0);
+        DCHECK_NE(m_prevCodePoint, kInvalidCodePoint);
         DCHECK_NE(m_boundaryOffset, 0);
         DCHECK_NE(m_pendingCodeUnit, 0);
         if (!U16_IS_TRAIL(codeUnit))
@@ -214,7 +218,7 @@
     m_pendingCodeUnit = 0;
     m_boundaryOffset = 0;
     m_precedingRISCount = 0;
-    m_prevCodePoint = 0;
+    m_prevCodePoint = kInvalidCodePoint;
     m_internalState = InternalState::CountRIS;
 }
 

diff --git a/third_party/WebKit/Source/core/editing/state_machines/ForwardGraphemeBoundaryStateMachine.h b/third_party/WebKit/Source/core/editing/state_machines/ForwardGraphemeBoundaryStateMachine.h
index d330e10..8ceada2 100644
--- a/third_party/WebKit/Source/core/editing/state_machines/ForwardGraphemeBoundaryStateMachine.h
+++ b/third_party/WebKit/Source/core/editing/state_machines/ForwardGraphemeBoundaryStateMachine.h

@@ -59,7 +59,7 @@
     UChar m_pendingCodeUnit = 0;
 
     // The code point immediately before the m_BoundaryOffset.
-    UChar32 m_prevCodePoint = 0;
+    UChar32 m_prevCodePoint;
 
     // The relative offset from the begging of this state machine.
     int m_boundaryOffset = 0;

diff --git a/third_party/WebKit/Source/core/editing/state_machines/ForwardGraphemeBoundaryStateMachineTest.cpp b/third_party/WebKit/Source/core/editing/state_machines/ForwardGraphemeBoundaryStateMachineTest.cpp
index f27ecaf..cdbb8c2d 100644
--- a/third_party/WebKit/Source/core/editing/state_machines/ForwardGraphemeBoundaryStateMachineTest.cpp
+++ b/third_party/WebKit/Source/core/editing/state_machines/ForwardGraphemeBoundaryStateMachineTest.cpp

@@ -66,6 +66,18 @@
         { kRisU, kRisS }, { 'a', 'a' }));
     EXPECT_EQ(1, machine.finalizeAndGetBoundaryOffset());
 
+    // U+0000 + | + 'a' + 'a'
+    EXPECT_EQ("SRF", processSequenceForward(&machine, { 0 }, { 'a', 'a' }));
+    EXPECT_EQ(1, machine.finalizeAndGetBoundaryOffset());
+    // U+0000 + [U] + | + 'a' + 'a'
+    EXPECT_EQ("RRSRF", processSequenceForward(&machine,
+        { 0, kRisU }, { 'a', 'a' }));
+    EXPECT_EQ(1, machine.finalizeAndGetBoundaryOffset());
+    // U+0000 + [U] + [S] + | + 'a' + 'a'
+    EXPECT_EQ("RRRRSRF", processSequenceForward(&machine,
+        { 0, kRisU, kRisS }, { 'a', 'a' }));
+    EXPECT_EQ(1, machine.finalizeAndGetBoundaryOffset());
+
     // 'a' + | + 'a' + 'a'
     EXPECT_EQ("SRF", processSequenceForward(&machine, { 'a' }, { 'a', 'a' }));
     EXPECT_EQ(1, machine.finalizeAndGetBoundaryOffset());
@@ -170,6 +182,10 @@
     const std::vector<UChar32> kEmpty;
     ForwardGraphemeBoundaryStateMachine machine;
 
+    // SOT + | + U+0000 + U+0000
+    EXPECT_EQ("SRF", processSequenceForward(&machine, kEmpty, { 0, 0 }));
+    EXPECT_EQ(1, machine.finalizeAndGetBoundaryOffset());
+
     // SOT + | + 'a' + 'a'
     EXPECT_EQ("SRF", processSequenceForward(&machine, kEmpty, { 'a', 'a' }));
     EXPECT_EQ(1, machine.finalizeAndGetBoundaryOffset());

diff --git a/third_party/WebKit/Source/core/html/HTMLCanvasElement.h b/third_party/WebKit/Source/core/html/HTMLCanvasElement.h
index d52462a..c8d5000e 100644
--- a/third_party/WebKit/Source/core/html/HTMLCanvasElement.h
+++ b/third_party/WebKit/Source/core/html/HTMLCanvasElement.h

@@ -123,7 +123,6 @@
     void disableDeferral(DisableDeferralReason) const;
     SkCanvas* existingDrawingCanvas() const;
 
-    void setRenderingContext(RawPtr<CanvasRenderingContext>);
     CanvasRenderingContext* renderingContext() const { return m_context.get(); }
 
     void ensureUnacceleratedImageBuffer();

diff --git a/third_party/WebKit/Source/core/html/canvas/CanvasRenderingContextFactory.h b/third_party/WebKit/Source/core/html/canvas/CanvasRenderingContextFactory.h
index 9e6c439..97b10d1 100644
--- a/third_party/WebKit/Source/core/html/canvas/CanvasRenderingContextFactory.h
+++ b/third_party/WebKit/Source/core/html/canvas/CanvasRenderingContextFactory.h

@@ -23,7 +23,7 @@
     CanvasRenderingContextFactory() = default;
     virtual ~CanvasRenderingContextFactory() { }
 
-    virtual RawPtr<CanvasRenderingContext> create(HTMLCanvasElement*, const CanvasContextCreationAttributes&, Document&) = 0;
+    virtual CanvasRenderingContext* create(HTMLCanvasElement*, const CanvasContextCreationAttributes&, Document&) = 0;
     virtual CanvasRenderingContext::ContextType getContextType() const = 0;
     virtual void onError(HTMLCanvasElement*, const String& error) = 0;
 };

diff --git a/third_party/WebKit/Source/core/layout/LayoutGrid.cpp b/third_party/WebKit/Source/core/layout/LayoutGrid.cpp
index cfb0a74..2e24425 100644
--- a/third_party/WebKit/Source/core/layout/LayoutGrid.cpp
+++ b/third_party/WebKit/Source/core/layout/LayoutGrid.cpp

@@ -693,9 +693,8 @@
     if (shouldClearContainingBlockLogicalHeight)
         layoutScope.setNeedsLayout(&child, LayoutInvalidationReason::GridChanged);
 
-    bool hasOverrideHeight = child.hasOverrideLogicalContentHeight();
     // We need to clear the stretched height to properly compute logical height during layout.
-    if (hasOverrideHeight && child.needsLayout())
+    if (child.needsLayout())
         child.clearOverrideLogicalContentHeight();
 
     // If |child| has a relative logical height, we shouldn't let it override its intrinsic height, which is
@@ -703,7 +702,6 @@
     if (shouldClearContainingBlockLogicalHeight)
         child.setOverrideContainingBlockContentLogicalHeight(LayoutUnit(-1));
     child.layoutIfNeeded();
-    // If the child was stretched we should use its intrinsic height.
     return child.logicalHeight() + child.marginLogicalHeight();
 }
 

diff --git a/third_party/WebKit/Source/core/layout/api/LayoutBoxItem.h b/third_party/WebKit/Source/core/layout/api/LayoutBoxItem.h
index 155fbf4..cb8aded 100644
--- a/third_party/WebKit/Source/core/layout/api/LayoutBoxItem.h
+++ b/third_party/WebKit/Source/core/layout/api/LayoutBoxItem.h

@@ -11,6 +11,9 @@
 
 namespace blink {
 
+class LayoutPoint;
+class LayoutSize;
+
 class LayoutBoxItem : public LayoutBoxModel {
 public:
     explicit LayoutBoxItem(LayoutBox* layoutBox)
@@ -38,6 +41,16 @@
         return toBox()->scroll(granularity, delta);
     }
 
+    LayoutSize size() const
+    {
+        return toBox()->size();
+    }
+
+    LayoutPoint location() const
+    {
+        return toBox()->location();
+    }
+
 private:
     LayoutBox* toBox()
     {

diff --git a/third_party/WebKit/Source/modules/accessibility/AXLayoutObject.cpp b/third_party/WebKit/Source/modules/accessibility/AXLayoutObject.cpp
index d94649c4..e874db8 100644
--- a/third_party/WebKit/Source/modules/accessibility/AXLayoutObject.cpp
+++ b/third_party/WebKit/Source/modules/accessibility/AXLayoutObject.cpp

@@ -1851,7 +1851,7 @@
         return AXRange();
 
     VisibleSelection selection = getLayoutObject()->frame()->selection().selection();
-    RawPtr<Range> selectionRange = firstRangeOf(selection);
+    Range* selectionRange = firstRangeOf(selection);
     ContainerNode* parentNode = getNode()->parentNode();
     int nodeIndex = getNode()->nodeIndex();
     if (!selectionRange
@@ -1915,7 +1915,7 @@
     if (indexPosition.isNull())
         return 0;
 
-    RawPtr<Range> range = Range::create(*getDocument());
+    Range* range = Range::create(*getDocument());
     range->setStart(getNode(), 0, IGNORE_EXCEPTION);
     range->setEnd(indexPosition, IGNORE_EXCEPTION);
 

diff --git a/third_party/WebKit/Source/modules/accessibility/AXObjectCacheImpl.cpp b/third_party/WebKit/Source/modules/accessibility/AXObjectCacheImpl.cpp
index bd3d738..2874418 100644
--- a/third_party/WebKit/Source/modules/accessibility/AXObjectCacheImpl.cpp
+++ b/third_party/WebKit/Source/modules/accessibility/AXObjectCacheImpl.cpp

@@ -653,8 +653,6 @@
 
 void AXObjectCacheImpl::notificationPostTimerFired(Timer<AXObjectCacheImpl>*)
 {
-    RawPtr<Document> protectorForCacheOwner(m_document.get());
-
     m_notificationPostTimer.stop();
 
     unsigned i = 0, count = m_notificationsToPost.size();

diff --git a/third_party/WebKit/Source/modules/accessibility/AXTable.cpp b/third_party/WebKit/Source/modules/accessibility/AXTable.cpp
index fb107b8..42593b1 100644
--- a/third_party/WebKit/Source/modules/accessibility/AXTable.cpp
+++ b/third_party/WebKit/Source/modules/accessibility/AXTable.cpp

@@ -130,20 +130,20 @@
     if (elementHasAriaRole(tableElement->tFoot()))
         return false;
 
-    RawPtr<HTMLCollection> bodies = tableElement->tBodies();
+    HTMLCollection* bodies = tableElement->tBodies();
     for (unsigned bodyIndex = 0; bodyIndex < bodies->length(); ++bodyIndex) {
         Element* bodyElement = bodies->item(bodyIndex);
         if (elementHasAriaRole(bodyElement))
             return false;
     }
 
-    RawPtr<HTMLTableRowsCollection> rows = tableElement->rows();
+    HTMLTableRowsCollection* rows = tableElement->rows();
     unsigned rowCount = rows->length();
     for (unsigned rowIndex = 0; rowIndex < rowCount; ++rowIndex) {
         HTMLTableRowElement* rowElement = rows->item(rowIndex);
         if (elementHasAriaRole(rowElement))
             return false;
-        RawPtr<HTMLCollection> cells = rowElement->cells();
+        HTMLCollection* cells = rowElement->cells();
         for (unsigned cellIndex = 0; cellIndex < cells->length(); ++cellIndex) {
             if (elementHasAriaRole(cells->item(cellIndex)))
                 return false;

diff --git a/third_party/WebKit/Source/modules/accessibility/InspectorAccessibilityAgent.h b/third_party/WebKit/Source/modules/accessibility/InspectorAccessibilityAgent.h
index f322bc6..5dcd7f5 100644
--- a/third_party/WebKit/Source/modules/accessibility/InspectorAccessibilityAgent.h
+++ b/third_party/WebKit/Source/modules/accessibility/InspectorAccessibilityAgent.h

@@ -16,7 +16,7 @@
 class MODULES_EXPORT InspectorAccessibilityAgent : public InspectorBaseAgent<InspectorAccessibilityAgent, protocol::Frontend::Accessibility>, public protocol::Backend::Accessibility {
     WTF_MAKE_NONCOPYABLE(InspectorAccessibilityAgent);
 public:
-    static RawPtr<InspectorAccessibilityAgent> create(Page* page)
+    static InspectorAccessibilityAgent* create(Page* page)
     {
         return new InspectorAccessibilityAgent(page);
     }

diff --git a/third_party/WebKit/Source/modules/app_banner/BeforeInstallPromptEvent.h b/third_party/WebKit/Source/modules/app_banner/BeforeInstallPromptEvent.h
index 755b92e..8ef6dd4 100644
--- a/third_party/WebKit/Source/modules/app_banner/BeforeInstallPromptEvent.h
+++ b/third_party/WebKit/Source/modules/app_banner/BeforeInstallPromptEvent.h

@@ -25,17 +25,17 @@
     ~BeforeInstallPromptEvent() override;
 
     // For EventModules.cpp
-    static RawPtr<BeforeInstallPromptEvent> create()
+    static BeforeInstallPromptEvent* create()
     {
         return new BeforeInstallPromptEvent();
     }
 
-    static RawPtr<BeforeInstallPromptEvent> create(const AtomicString& name, ExecutionContext* executionContext, const Vector<String>& platforms, int requestId, WebAppBannerClient* client)
+    static BeforeInstallPromptEvent* create(const AtomicString& name, ExecutionContext* executionContext, const Vector<String>& platforms, int requestId, WebAppBannerClient* client)
     {
         return new BeforeInstallPromptEvent(name, executionContext, platforms, requestId, client);
     }
 
-    static RawPtr<BeforeInstallPromptEvent> create(const AtomicString& name, const BeforeInstallPromptEventInit& init)
+    static BeforeInstallPromptEvent* create(const AtomicString& name, const BeforeInstallPromptEventInit& init)
     {
         return new BeforeInstallPromptEvent(name, init);
     }

diff --git a/third_party/WebKit/Source/modules/audio_output_devices/AudioOutputDeviceClient.cpp b/third_party/WebKit/Source/modules/audio_output_devices/AudioOutputDeviceClient.cpp
index 7389fdc..191230d 100644
--- a/third_party/WebKit/Source/modules/audio_output_devices/AudioOutputDeviceClient.cpp
+++ b/third_party/WebKit/Source/modules/audio_output_devices/AudioOutputDeviceClient.cpp

@@ -27,7 +27,7 @@
     return static_cast<AudioOutputDeviceClient*>(Supplement<LocalFrame>::from(document->frame(), supplementName()));
 }
 
-void provideAudioOutputDeviceClientTo(LocalFrame& frame, RawPtr<AudioOutputDeviceClient> client)
+void provideAudioOutputDeviceClientTo(LocalFrame& frame, AudioOutputDeviceClient* client)
 {
     frame.provideSupplement(AudioOutputDeviceClient::supplementName(), client);
 }

diff --git a/third_party/WebKit/Source/modules/audio_output_devices/AudioOutputDeviceClient.h b/third_party/WebKit/Source/modules/audio_output_devices/AudioOutputDeviceClient.h
index 953aad1..616b823 100644
--- a/third_party/WebKit/Source/modules/audio_output_devices/AudioOutputDeviceClient.h
+++ b/third_party/WebKit/Source/modules/audio_output_devices/AudioOutputDeviceClient.h

@@ -29,7 +29,7 @@
     static const char* supplementName();
 };
 
-MODULES_EXPORT void provideAudioOutputDeviceClientTo(LocalFrame&, RawPtr<AudioOutputDeviceClient>);
+MODULES_EXPORT void provideAudioOutputDeviceClientTo(LocalFrame&, AudioOutputDeviceClient*);
 
 } // namespace blink
 

diff --git a/third_party/WebKit/Source/modules/background_sync/SyncCallbacks.cpp b/third_party/WebKit/Source/modules/background_sync/SyncCallbacks.cpp
index 9e2af89..9b6e3e7 100644
--- a/third_party/WebKit/Source/modules/background_sync/SyncCallbacks.cpp
+++ b/third_party/WebKit/Source/modules/background_sync/SyncCallbacks.cpp

@@ -24,13 +24,13 @@
 {
 }
 
-void SyncRegistrationCallbacks::onSuccess(WebPassOwnPtr<WebSyncRegistration> webSyncRegistration)
+void SyncRegistrationCallbacks::onSuccess(std::unique_ptr<WebSyncRegistration> webSyncRegistration)
 {
     if (!m_resolver->getExecutionContext() || m_resolver->getExecutionContext()->activeDOMObjectsAreStopped()) {
         return;
     }
 
-    OwnPtr<WebSyncRegistration> registration = webSyncRegistration.release();
+    OwnPtr<WebSyncRegistration> registration = adoptPtr(webSyncRegistration.release());
     if (!registration) {
         m_resolver->resolve(v8::Null(m_resolver->getScriptState()->isolate()));
         return;

diff --git a/third_party/WebKit/Source/modules/background_sync/SyncCallbacks.h b/third_party/WebKit/Source/modules/background_sync/SyncCallbacks.h
index d4ad487..a5dc89a 100644
--- a/third_party/WebKit/Source/modules/background_sync/SyncCallbacks.h
+++ b/third_party/WebKit/Source/modules/background_sync/SyncCallbacks.h

@@ -34,7 +34,7 @@
     SyncRegistrationCallbacks(ScriptPromiseResolver*, ServiceWorkerRegistration*);
     ~SyncRegistrationCallbacks() override;
 
-    void onSuccess(WebPassOwnPtr<WebSyncRegistration>) override;
+    void onSuccess(std::unique_ptr<WebSyncRegistration>) override;
     void onError(const WebSyncError&) override;
 
 private:

diff --git a/third_party/WebKit/Source/modules/background_sync/SyncEvent.h b/third_party/WebKit/Source/modules/background_sync/SyncEvent.h
index b69d50e..867e07b 100644
--- a/third_party/WebKit/Source/modules/background_sync/SyncEvent.h
+++ b/third_party/WebKit/Source/modules/background_sync/SyncEvent.h

@@ -17,15 +17,15 @@
 class MODULES_EXPORT SyncEvent final : public ExtendableEvent {
     DEFINE_WRAPPERTYPEINFO();
 public:
-    static RawPtr<SyncEvent> create()
+    static SyncEvent* create()
     {
         return new SyncEvent;
     }
-    static RawPtr<SyncEvent> create(const AtomicString& type, const String& tag, bool lastChance, WaitUntilObserver* observer)
+    static SyncEvent* create(const AtomicString& type, const String& tag, bool lastChance, WaitUntilObserver* observer)
     {
         return new SyncEvent(type, tag, lastChance, observer);
     }
-    static RawPtr<SyncEvent> create(const AtomicString& type, const SyncEventInit& init)
+    static SyncEvent* create(const AtomicString& type, const SyncEventInit& init)
     {
         return new SyncEvent(type, init);
     }

diff --git a/third_party/WebKit/Source/modules/cachestorage/Cache.cpp b/third_party/WebKit/Source/modules/cachestorage/Cache.cpp
index 6d9385e..30973127 100644
--- a/third_party/WebKit/Source/modules/cachestorage/Cache.cpp
+++ b/third_party/WebKit/Source/modules/cachestorage/Cache.cpp

@@ -23,9 +23,10 @@
 #include "platform/HTTPNames.h"
 #include "platform/Histogram.h"
 #include "platform/RuntimeEnabledFeatures.h"
-#include "public/platform/WebPassOwnPtr.h"
 #include "public/platform/modules/serviceworker/WebServiceWorkerCache.h"
 
+#include <memory>
+
 namespace blink {
 
 namespace {
@@ -360,7 +361,7 @@
     WebServiceWorkerResponse m_webResponse;
 };
 
-Cache* Cache::create(RawPtr<GlobalFetch::ScopedFetcher> fetcher, PassOwnPtr<WebServiceWorkerCache> webCache)
+Cache* Cache::create(GlobalFetch::ScopedFetcher* fetcher, PassOwnPtr<WebServiceWorkerCache> webCache)
 {
     return new Cache(fetcher, webCache);
 }
@@ -472,7 +473,7 @@
     return webQueryParams;
 }
 
-Cache::Cache(RawPtr<GlobalFetch::ScopedFetcher> fetcher, PassOwnPtr<WebServiceWorkerCache> webCache)
+Cache::Cache(GlobalFetch::ScopedFetcher* fetcher, PassOwnPtr<WebServiceWorkerCache> webCache)
     : m_scopedFetcher(fetcher)
     , m_webCache(webCache)
 {

diff --git a/third_party/WebKit/Source/modules/cachestorage/Cache.h b/third_party/WebKit/Source/modules/cachestorage/Cache.h
index e92ab22..03de1b5 100644
--- a/third_party/WebKit/Source/modules/cachestorage/Cache.h
+++ b/third_party/WebKit/Source/modules/cachestorage/Cache.h

@@ -32,7 +32,7 @@
     DEFINE_WRAPPERTYPEINFO();
     WTF_MAKE_NONCOPYABLE(Cache);
 public:
-    static Cache* create(RawPtr<GlobalFetch::ScopedFetcher>, PassOwnPtr<WebServiceWorkerCache>);
+    static Cache* create(GlobalFetch::ScopedFetcher*, PassOwnPtr<WebServiceWorkerCache>);
 
     // From Cache.idl:
     ScriptPromise match(ScriptState*, const RequestInfo&, const CacheQueryOptions&, ExceptionState&);
@@ -54,7 +54,7 @@
     class BlobHandleCallbackForPut;
     class FetchResolvedForAdd;
     friend class FetchResolvedForAdd;
-    Cache(RawPtr<GlobalFetch::ScopedFetcher>, PassOwnPtr<WebServiceWorkerCache>);
+    Cache(GlobalFetch::ScopedFetcher*, PassOwnPtr<WebServiceWorkerCache>);
 
     ScriptPromise matchImpl(ScriptState*, const Request*, const CacheQueryOptions&);
     ScriptPromise matchAllImpl(ScriptState*);

diff --git a/third_party/WebKit/Source/modules/cachestorage/CacheStorage.cpp b/third_party/WebKit/Source/modules/cachestorage/CacheStorage.cpp
index f0fed5d..30b0e39 100644
--- a/third_party/WebKit/Source/modules/cachestorage/CacheStorage.cpp
+++ b/third_party/WebKit/Source/modules/cachestorage/CacheStorage.cpp

@@ -91,11 +91,11 @@
         : m_cacheName(cacheName), m_cacheStorage(cacheStorage), m_resolver(resolver) { }
     ~WithCacheCallbacks() override { }
 
-    void onSuccess(WebPassOwnPtr<WebServiceWorkerCache> webCache) override
+    void onSuccess(std::unique_ptr<WebServiceWorkerCache> webCache) override
     {
         if (!m_resolver->getExecutionContext() || m_resolver->getExecutionContext()->activeDOMObjectsAreStopped())
             return;
-        Cache* cache = Cache::create(m_cacheStorage->m_scopedFetcher, webCache.release());
+        Cache* cache = Cache::create(m_cacheStorage->m_scopedFetcher, adoptPtr(webCache.release()));
         m_cacheStorage->m_nameToCacheMap.set(m_cacheName, cache);
         m_resolver->resolve(cache);
         m_resolver.clear();
@@ -214,7 +214,7 @@
     Persistent<ScriptPromiseResolver> m_resolver;
 };
 
-CacheStorage* CacheStorage::create(RawPtr<GlobalFetch::ScopedFetcher> fetcher, WebServiceWorkerCacheStorage* webCacheStorage)
+CacheStorage* CacheStorage::create(GlobalFetch::ScopedFetcher* fetcher, WebServiceWorkerCacheStorage* webCacheStorage)
 {
     return new CacheStorage(fetcher, adoptPtr(webCacheStorage));
 }
@@ -325,7 +325,7 @@
     return promise;
 }
 
-CacheStorage::CacheStorage(RawPtr<GlobalFetch::ScopedFetcher> fetcher, PassOwnPtr<WebServiceWorkerCacheStorage> webCacheStorage)
+CacheStorage::CacheStorage(GlobalFetch::ScopedFetcher* fetcher, PassOwnPtr<WebServiceWorkerCacheStorage> webCacheStorage)
     : m_scopedFetcher(fetcher)
     , m_webCacheStorage(webCacheStorage)
 {

diff --git a/third_party/WebKit/Source/modules/cachestorage/CacheStorage.h b/third_party/WebKit/Source/modules/cachestorage/CacheStorage.h
index aa3622bf..29a4721 100644
--- a/third_party/WebKit/Source/modules/cachestorage/CacheStorage.h
+++ b/third_party/WebKit/Source/modules/cachestorage/CacheStorage.h

@@ -25,7 +25,7 @@
     DEFINE_WRAPPERTYPEINFO();
     WTF_MAKE_NONCOPYABLE(CacheStorage);
 public:
-    static CacheStorage* create(RawPtr<GlobalFetch::ScopedFetcher>, WebServiceWorkerCacheStorage*);
+    static CacheStorage* create(GlobalFetch::ScopedFetcher*, WebServiceWorkerCacheStorage*);
     ~CacheStorage();
     void dispose();
 
@@ -47,7 +47,7 @@
     friend class WithCacheCallbacks;
     friend class DeleteCallbacks;
 
-    CacheStorage(RawPtr<GlobalFetch::ScopedFetcher>, PassOwnPtr<WebServiceWorkerCacheStorage>);
+    CacheStorage(GlobalFetch::ScopedFetcher*, PassOwnPtr<WebServiceWorkerCacheStorage>);
     ScriptPromise matchImpl(ScriptState*, const Request*, const CacheQueryOptions&);
 
     Member<GlobalFetch::ScopedFetcher> m_scopedFetcher;

diff --git a/third_party/WebKit/Source/modules/cachestorage/CacheTest.cpp b/third_party/WebKit/Source/modules/cachestorage/CacheTest.cpp
index cbd0ea7..249bf6f 100644
--- a/third_party/WebKit/Source/modules/cachestorage/CacheTest.cpp
+++ b/third_party/WebKit/Source/modules/cachestorage/CacheTest.cpp

@@ -37,7 +37,7 @@
 class ScopedFetcherForTests final : public GarbageCollectedFinalized<ScopedFetcherForTests>, public GlobalFetch::ScopedFetcher {
     USING_GARBAGE_COLLECTED_MIXIN(ScopedFetcherForTests);
 public:
-    static RawPtr<ScopedFetcherForTests> create()
+    static ScopedFetcherForTests* create()
     {
         return new ScopedFetcherForTests;
     }
@@ -63,7 +63,7 @@
         return ScriptPromise::reject(scriptState, V8ThrowException::createTypeError(scriptState->isolate(), "Unexpected call to fetch, no response available."));
     }
 
-    RawPtr<GlobalFetch::ScopedFetcher> weakPtr()
+    GlobalFetch::ScopedFetcher* weakPtr()
     {
 #if ENABLE(OILPAN)
         return this;
@@ -343,9 +343,9 @@
 TEST_F(CacheStorageTest, Basics)
 {
     ScriptState::Scope scope(getScriptState());
-    RawPtr<ScopedFetcherForTests> fetcher = ScopedFetcherForTests::create();
+    ScopedFetcherForTests* fetcher = ScopedFetcherForTests::create();
     ErrorWebCacheForTests* testCache;
-    Cache* cache = createCache(fetcher.get(), testCache = new NotImplementedErrorCache());
+    Cache* cache = createCache(fetcher, testCache = new NotImplementedErrorCache());
     ASSERT(cache);
 
     const String url = "http://www.cachetest.org/";
@@ -354,12 +354,12 @@
     ScriptPromise matchPromise = cache->match(getScriptState(), stringToRequestInfo(url), options, exceptionState());
     EXPECT_EQ(kNotImplementedString, getRejectString(matchPromise));
 
-    cache = createCache(fetcher.get(), testCache = new ErrorWebCacheForTests(WebServiceWorkerCacheErrorNotFound));
+    cache = createCache(fetcher, testCache = new ErrorWebCacheForTests(WebServiceWorkerCacheErrorNotFound));
     matchPromise = cache->match(getScriptState(), stringToRequestInfo(url), options, exceptionState());
     ScriptValue scriptValue = getResolveValue(matchPromise);
     EXPECT_TRUE(scriptValue.isUndefined());
 
-    cache = createCache(fetcher.get(), testCache = new ErrorWebCacheForTests(WebServiceWorkerCacheErrorExists));
+    cache = createCache(fetcher, testCache = new ErrorWebCacheForTests(WebServiceWorkerCacheErrorExists));
     matchPromise = cache->match(getScriptState(), stringToRequestInfo(url), options, exceptionState());
     EXPECT_EQ("InvalidAccessError: Entry already exists.", getRejectString(matchPromise));
 }
@@ -369,9 +369,9 @@
 TEST_F(CacheStorageTest, BasicArguments)
 {
     ScriptState::Scope scope(getScriptState());
-    RawPtr<ScopedFetcherForTests> fetcher = ScopedFetcherForTests::create();
+    ScopedFetcherForTests* fetcher = ScopedFetcherForTests::create();
     ErrorWebCacheForTests* testCache;
-    Cache* cache = createCache(fetcher.get(), testCache = new NotImplementedErrorCache());
+    Cache* cache = createCache(fetcher, testCache = new NotImplementedErrorCache());
     ASSERT(cache);
 
     const String url = "http://www.cache.arguments.test/";
@@ -425,9 +425,9 @@
 TEST_F(CacheStorageTest, BatchOperationArguments)
 {
     ScriptState::Scope scope(getScriptState());
-    RawPtr<ScopedFetcherForTests> fetcher = ScopedFetcherForTests::create();
+    ScopedFetcherForTests* fetcher = ScopedFetcherForTests::create();
     ErrorWebCacheForTests* testCache;
-    Cache* cache = createCache(fetcher.get(), testCache = new NotImplementedErrorCache());
+    Cache* cache = createCache(fetcher, testCache = new NotImplementedErrorCache());
     ASSERT(cache);
 
     WebServiceWorkerCache::QueryParams expectedQueryParams;
@@ -505,7 +505,7 @@
 TEST_F(CacheStorageTest, MatchResponseTest)
 {
     ScriptState::Scope scope(getScriptState());
-    RawPtr<ScopedFetcherForTests> fetcher = ScopedFetcherForTests::create();
+    ScopedFetcherForTests* fetcher = ScopedFetcherForTests::create();
     const String requestUrl = "http://request.url/";
     const String responseUrl = "http://match.response.test/";
 
@@ -513,7 +513,7 @@
     webResponse.setURL(KURL(ParsedURLString, responseUrl));
     webResponse.setResponseType(WebServiceWorkerResponseTypeDefault);
 
-    Cache* cache = createCache(fetcher.get(), new MatchTestCache(webResponse));
+    Cache* cache = createCache(fetcher, new MatchTestCache(webResponse));
     CacheQueryOptions options;
 
     ScriptPromise result = cache->match(getScriptState(), stringToRequestInfo(requestUrl), options, exceptionState());
@@ -541,7 +541,7 @@
 TEST_F(CacheStorageTest, KeysResponseTest)
 {
     ScriptState::Scope scope(getScriptState());
-    RawPtr<ScopedFetcherForTests> fetcher = ScopedFetcherForTests::create();
+    ScopedFetcherForTests* fetcher = ScopedFetcherForTests::create();
     const String url1 = "http://first.request/";
     const String url2 = "http://second.request/";
 
@@ -553,7 +553,7 @@
     webRequests[0].setURL(KURL(ParsedURLString, url1));
     webRequests[1].setURL(KURL(ParsedURLString, url2));
 
-    Cache* cache = createCache(fetcher.get(), new KeysTestCache(webRequests));
+    Cache* cache = createCache(fetcher, new KeysTestCache(webRequests));
 
     ScriptPromise result = cache->keys(getScriptState(), exceptionState());
     ScriptValue scriptValue = getResolveValue(result);
@@ -592,7 +592,7 @@
 TEST_F(CacheStorageTest, MatchAllAndBatchResponseTest)
 {
     ScriptState::Scope scope(getScriptState());
-    RawPtr<ScopedFetcherForTests> fetcher = ScopedFetcherForTests::create();
+    ScopedFetcherForTests* fetcher = ScopedFetcherForTests::create();
     const String url1 = "http://first.response/";
     const String url2 = "http://second.response/";
 
@@ -606,7 +606,7 @@
     webResponses[1].setURL(KURL(ParsedURLString, url2));
     webResponses[1].setResponseType(WebServiceWorkerResponseTypeDefault);
 
-    Cache* cache = createCache(fetcher.get(), new MatchAllAndBatchTestCache(webResponses));
+    Cache* cache = createCache(fetcher, new MatchAllAndBatchTestCache(webResponses));
 
     CacheQueryOptions options;
     ScriptPromise result = cache->matchAll(getScriptState(), stringToRequestInfo("http://some.url/"), options, exceptionState());
@@ -630,13 +630,13 @@
 TEST_F(CacheStorageTest, Add)
 {
     ScriptState::Scope scope(getScriptState());
-    RawPtr<ScopedFetcherForTests> fetcher = ScopedFetcherForTests::create();
+    ScopedFetcherForTests* fetcher = ScopedFetcherForTests::create();
     const String url = "http://www.cacheadd.test/";
     const String contentType = "text/plain";
     const String content = "hello cache";
 
     ErrorWebCacheForTests* testCache;
-    Cache* cache = createCache(fetcher.get(), testCache = new NotImplementedErrorCache());
+    Cache* cache = createCache(fetcher, testCache = new NotImplementedErrorCache());
 
     fetcher->setExpectedFetchUrl(&url);
 

diff --git a/third_party/WebKit/Source/modules/cachestorage/InspectorCacheStorageAgent.cpp b/third_party/WebKit/Source/modules/cachestorage/InspectorCacheStorageAgent.cpp
index 8fd87e2..547ad6b 100644
--- a/third_party/WebKit/Source/modules/cachestorage/InspectorCacheStorageAgent.cpp
+++ b/third_party/WebKit/Source/modules/cachestorage/InspectorCacheStorageAgent.cpp

@@ -3,7 +3,6 @@
 // found in the LICENSE file.
 
 #include "modules/cachestorage/InspectorCacheStorageAgent.h"
-
 #include "platform/heap/Handle.h"
 #include "platform/inspector_protocol/Dispatcher.h"
 #include "platform/inspector_protocol/TypeBuilder.h"
@@ -11,7 +10,6 @@
 #include "platform/weborigin/KURL.h"
 #include "platform/weborigin/SecurityOrigin.h"
 #include "public/platform/Platform.h"
-#include "public/platform/WebPassOwnPtr.h"
 #include "public/platform/WebSecurityOrigin.h"
 #include "public/platform/WebString.h"
 #include "public/platform/WebURL.h"
@@ -30,6 +28,7 @@
 #include "wtf/text/StringBuilder.h"
 
 #include <algorithm>
+#include <memory>
 
 using blink::protocol::Array;
 using blink::protocol::CacheStorage::Cache;
@@ -299,9 +298,9 @@
     }
     ~GetCacheForRequestData() override { }
 
-    void onSuccess(WebPassOwnPtr<WebServiceWorkerCache> cache) override
+    void onSuccess(std::unique_ptr<WebServiceWorkerCache> cache) override
     {
-        auto* cacheRequest = new GetCacheKeysForRequestData(m_params, cache.release(), m_callback.release());
+        auto* cacheRequest = new GetCacheKeysForRequestData(m_params, adoptPtr(cache.release()), m_callback.release());
         cacheRequest->cache()->dispatchKeys(cacheRequest, nullptr, WebServiceWorkerCache::QueryParams());
     }
 
@@ -376,7 +375,7 @@
     }
     ~GetCacheForDeleteEntry() override { }
 
-    void onSuccess(WebPassOwnPtr<WebServiceWorkerCache> cache) override
+    void onSuccess(std::unique_ptr<WebServiceWorkerCache> cache) override
     {
         auto* deleteRequest = new DeleteCacheEntry(m_callback.release());
         BatchOperation deleteOperation;

diff --git a/third_party/WebKit/Source/modules/cachestorage/InspectorCacheStorageAgent.h b/third_party/WebKit/Source/modules/cachestorage/InspectorCacheStorageAgent.h
index a062f49d..8e61f5f 100644
--- a/third_party/WebKit/Source/modules/cachestorage/InspectorCacheStorageAgent.h
+++ b/third_party/WebKit/Source/modules/cachestorage/InspectorCacheStorageAgent.h

@@ -17,7 +17,7 @@
     WTF_MAKE_NONCOPYABLE(InspectorCacheStorageAgent);
 
 public:
-    static RawPtr<InspectorCacheStorageAgent> create()
+    static InspectorCacheStorageAgent* create()
     {
         return new InspectorCacheStorageAgent();
     }

diff --git a/third_party/WebKit/Source/modules/canvas2d/BaseRenderingContext2D.cpp b/third_party/WebKit/Source/modules/canvas2d/BaseRenderingContext2D.cpp
index 16607f6..1f1a57e 100644
--- a/third_party/WebKit/Source/modules/canvas2d/BaseRenderingContext2D.cpp
+++ b/third_party/WebKit/Source/modules/canvas2d/BaseRenderingContext2D.cpp

@@ -376,23 +376,22 @@
     if (filterString == state().unparsedFilter())
         return;
 
-    RawPtr<CSSValue> filterValue = CSSParser::parseSingleValue(CSSPropertyWebkitFilter, filterString, CSSParserContext(HTMLStandardMode, 0));
+    CSSValue* filterValue = CSSParser::parseSingleValue(CSSPropertyWebkitFilter, filterString, CSSParserContext(HTMLStandardMode, 0));
 
     if (!filterValue || filterValue->isInitialValue() || filterValue->isInheritedValue())
         return;
 
     modifiableState().setUnparsedFilter(filterString);
-    modifiableState().setFilter(filterValue.release());
+    modifiableState().setFilter(filterValue);
 }
 
-RawPtr<SVGMatrixTearOff> BaseRenderingContext2D::currentTransform() const
+SVGMatrixTearOff* BaseRenderingContext2D::currentTransform() const
 {
     return SVGMatrixTearOff::create(state().transform());
 }
 
-void BaseRenderingContext2D::setCurrentTransform(RawPtr<SVGMatrixTearOff> passMatrixTearOff)
+void BaseRenderingContext2D::setCurrentTransform(SVGMatrixTearOff* matrixTearOff)
 {
-    RawPtr<SVGMatrixTearOff> matrixTearOff = passMatrixTearOff;
     const AffineTransform& transform = matrixTearOff->value();
     setTransform(transform.a(), transform.b(), transform.c(), transform.d(), transform.e(), transform.f());
 }

diff --git a/third_party/WebKit/Source/modules/canvas2d/BaseRenderingContext2D.h b/third_party/WebKit/Source/modules/canvas2d/BaseRenderingContext2D.h
index f13f116..7d5b6111 100644
--- a/third_party/WebKit/Source/modules/canvas2d/BaseRenderingContext2D.h
+++ b/third_party/WebKit/Source/modules/canvas2d/BaseRenderingContext2D.h

@@ -78,8 +78,8 @@
     void save();
     void restore();
 
-    RawPtr<SVGMatrixTearOff> currentTransform() const;
-    void setCurrentTransform(RawPtr<SVGMatrixTearOff>);
+    SVGMatrixTearOff* currentTransform() const;
+    void setCurrentTransform(SVGMatrixTearOff*);
 
     void scale(double sx, double sy);
     void rotate(double angleInRadians);

diff --git a/third_party/WebKit/Source/modules/canvas2d/CanvasRenderingContext2D.cpp b/third_party/WebKit/Source/modules/canvas2d/CanvasRenderingContext2D.cpp
index e8f6371..3c4d22d7 100644
--- a/third_party/WebKit/Source/modules/canvas2d/CanvasRenderingContext2D.cpp
+++ b/third_party/WebKit/Source/modules/canvas2d/CanvasRenderingContext2D.cpp

@@ -130,7 +130,7 @@
 
 void CanvasRenderingContext2D::setCanvasGetContextResult(RenderingContext& result)
 {
-    result.setCanvasRenderingContext2D(RawPtr<CanvasRenderingContext2D>(this));
+    result.setCanvasRenderingContext2D(this);
 }
 
 void CanvasRenderingContext2D::unwindStateStack()
@@ -228,7 +228,7 @@
 void CanvasRenderingContext2D::dispatchContextLostEvent(Timer<CanvasRenderingContext2D>*)
 {
     if (contextLostRestoredEventsEnabled()) {
-        RawPtr<Event> event = Event::createCancelable(EventTypeNames::contextlost);
+        Event* event = Event::createCancelable(EventTypeNames::contextlost);
         canvas()->dispatchEvent(event);
         if (event->defaultPrevented()) {
             m_contextRestorable = false;
@@ -273,7 +273,7 @@
     reset();
     m_contextLostMode = NotLostContext;
     if (contextLostRestoredEventsEnabled()) {
-        RawPtr<Event> event(Event::create(EventTypeNames::contextrestored));
+        Event* event(Event::create(EventTypeNames::contextrestored));
         canvas()->dispatchEvent(event);
     }
 }
@@ -1013,11 +1013,11 @@
     m_hitRegionManager->removeHitRegionById(options.id());
     m_hitRegionManager->removeHitRegionByControl(options.control());
 
-    RawPtr<HitRegion> hitRegion = HitRegion::create(hitRegionPath, options);
+    HitRegion* hitRegion = HitRegion::create(hitRegionPath, options);
     Element* element = hitRegion->control();
     if (element && element->isDescendantOf(canvas()))
         updateElementAccessibility(hitRegion->path(), hitRegion->control());
-    m_hitRegionManager->addHitRegion(hitRegion.release());
+    m_hitRegionManager->addHitRegion(hitRegion);
 }
 
 void CanvasRenderingContext2D::removeHitRegion(const String& id)

diff --git a/third_party/WebKit/Source/modules/canvas2d/CanvasRenderingContext2D.h b/third_party/WebKit/Source/modules/canvas2d/CanvasRenderingContext2D.h
index 54accd5..da8a9f415 100644
--- a/third_party/WebKit/Source/modules/canvas2d/CanvasRenderingContext2D.h
+++ b/third_party/WebKit/Source/modules/canvas2d/CanvasRenderingContext2D.h

@@ -73,7 +73,7 @@
         Factory() {}
         ~Factory() override {}
 
-        RawPtr<CanvasRenderingContext> create(HTMLCanvasElement* canvas, const CanvasContextCreationAttributes& attrs, Document& document) override
+        CanvasRenderingContext* create(HTMLCanvasElement* canvas, const CanvasContextCreationAttributes& attrs, Document& document) override
         {
             return new CanvasRenderingContext2D(canvas, attrs, document);
         }

diff --git a/third_party/WebKit/Source/modules/canvas2d/CanvasRenderingContext2DState.cpp b/third_party/WebKit/Source/modules/canvas2d/CanvasRenderingContext2DState.cpp
index 3bc0a98..76299c8 100644
--- a/third_party/WebKit/Source/modules/canvas2d/CanvasRenderingContext2DState.cpp
+++ b/third_party/WebKit/Source/modules/canvas2d/CanvasRenderingContext2DState.cpp

@@ -313,7 +313,7 @@
 
         StyleBuilder::applyProperty(CSSPropertyWebkitFilter, resolverState, m_filterValue.get());
         resolverState.loadPendingResources();
-        RawPtr<FilterEffectBuilder> filterEffectBuilder = FilterEffectBuilder::create();
+        FilterEffectBuilder* filterEffectBuilder = FilterEffectBuilder::create();
 
         // We can't reuse m_fillPaint and m_strokePaint for the filter, since these incorporate
         // the global alpha, which isn't applicable here.
@@ -328,8 +328,8 @@
         filterEffectBuilder->build(styleResolutionHost, filterStyle->filter(), effectiveZoom, &floatCanvasSize, &fillPaintForFilter, &strokePaintForFilter);
 
         SkiaImageFilterBuilder imageFilterBuilder;
-        RawPtr<FilterEffect> lastEffect = filterEffectBuilder->lastEffect();
-        m_resolvedFilter = imageFilterBuilder.build(lastEffect.get(), ColorSpaceDeviceRGB);
+        FilterEffect* lastEffect = filterEffectBuilder->lastEffect();
+        m_resolvedFilter = imageFilterBuilder.build(lastEffect, ColorSpaceDeviceRGB);
         if (m_resolvedFilter) {
             updateFilterReferences(toHTMLCanvasElement(styleResolutionHost), context, filterStyle->filter());
             if (lastEffect->originTainted())
@@ -432,7 +432,7 @@
     shadowParameterChanged();
 }
 
-void CanvasRenderingContext2DState::setFilter(RawPtr<CSSValue> filterValue)
+void CanvasRenderingContext2DState::setFilter(CSSValue* filterValue)
 {
     m_filterValue = filterValue;
     m_resolvedFilter.clear();

diff --git a/third_party/WebKit/Source/modules/canvas2d/CanvasRenderingContext2DState.h b/third_party/WebKit/Source/modules/canvas2d/CanvasRenderingContext2DState.h
index 32a55d71..f2f684f 100644
--- a/third_party/WebKit/Source/modules/canvas2d/CanvasRenderingContext2DState.h
+++ b/third_party/WebKit/Source/modules/canvas2d/CanvasRenderingContext2DState.h

@@ -22,7 +22,7 @@
     WTF_MAKE_NONCOPYABLE(CanvasRenderingContext2DState);
     USING_GARBAGE_COLLECTED_MIXIN(CanvasRenderingContext2DState);
 public:
-    static RawPtr<CanvasRenderingContext2DState> create()
+    static CanvasRenderingContext2DState* create()
     {
         return new CanvasRenderingContext2DState;
     }
@@ -42,7 +42,7 @@
         ImagePaintType,
     };
 
-    static RawPtr<CanvasRenderingContext2DState> create(const CanvasRenderingContext2DState& other, ClipListCopyMode mode)
+    static CanvasRenderingContext2DState* create(const CanvasRenderingContext2DState& other, ClipListCopyMode mode)
     {
         return new CanvasRenderingContext2DState(other, mode);
     }
@@ -82,7 +82,7 @@
     void setUnparsedFont(const String& font) { m_unparsedFont = font; }
     const String& unparsedFont() const { return m_unparsedFont; }
 
-    void setFilter(RawPtr<CSSValue>);
+    void setFilter(CSSValue*);
     void setUnparsedFilter(const String& filterString) { m_unparsedFilter = filterString; }
     const String& unparsedFilter() const { return m_unparsedFilter; }
     SkImageFilter* getFilter(Element*, const Font&, IntSize canvasSize, CanvasRenderingContext2D*) const;

diff --git a/third_party/WebKit/Source/modules/canvas2d/CanvasRenderingContext2DTest.cpp b/third_party/WebKit/Source/modules/canvas2d/CanvasRenderingContext2DTest.cpp
index 5b5c4195..e708cf6b 100644
--- a/third_party/WebKit/Source/modules/canvas2d/CanvasRenderingContext2DTest.cpp
+++ b/third_party/WebKit/Source/modules/canvas2d/CanvasRenderingContext2DTest.cpp

@@ -93,7 +93,7 @@
 
     class WrapGradients final : public GarbageCollectedFinalized<WrapGradients> {
     public:
-        static RawPtr<WrapGradients> create()
+        static WrapGradients* create()
         {
             return new WrapGradients;
         }
@@ -446,18 +446,18 @@
     canvasElement().createImageBufferUsingSurfaceForTesting(surface.release());
 
     NonThrowableExceptionState exceptionState;
-    RawPtr<Element> sourceCanvasElement = document().createElement("canvas", exceptionState);
+    Element* sourceCanvasElement = document().createElement("canvas", exceptionState);
     EXPECT_FALSE(exceptionState.hadException());
-    HTMLCanvasElement* sourceCanvas = static_cast<HTMLCanvasElement*>(sourceCanvasElement.get());
+    HTMLCanvasElement* sourceCanvas = static_cast<HTMLCanvasElement*>(sourceCanvasElement);
     IntSize sourceSize(10, 10 * ExpensiveCanvasHeuristicParameters::ExpensiveImageSizeRatio);
     OwnPtr<UnacceleratedImageBufferSurface> sourceSurface = adoptPtr(new UnacceleratedImageBufferSurface(sourceSize, NonOpaque));
     sourceCanvas->createImageBufferUsingSurfaceForTesting(sourceSurface.release());
 
     const ImageBitmapOptions defaultOptions;
     // Go through an ImageBitmap to avoid triggering a display list fallback
-    RawPtr<ImageBitmap> sourceImageBitmap = ImageBitmap::create(sourceCanvas, IntRect(IntPoint(0, 0), sourceSize), defaultOptions);
+    ImageBitmap* sourceImageBitmap = ImageBitmap::create(sourceCanvas, IntRect(IntPoint(0, 0), sourceSize), defaultOptions);
 
-    context2d()->drawImage(sourceImageBitmap.get(), 0, 0, 1, 1, 0, 0, 1, 1, exceptionState);
+    context2d()->drawImage(sourceImageBitmap, 0, 0, 1, 1, 0, 0, 1, 1, exceptionState);
     EXPECT_FALSE(exceptionState.hadException());
 
     EXPECT_FALSE(canvasElement().shouldBeDirectComposited());
@@ -470,18 +470,18 @@
     canvasElement().createImageBufferUsingSurfaceForTesting(surface.release());
 
     NonThrowableExceptionState exceptionState;
-    RawPtr<Element> sourceCanvasElement = document().createElement("canvas", exceptionState);
+    Element* sourceCanvasElement = document().createElement("canvas", exceptionState);
     EXPECT_FALSE(exceptionState.hadException());
-    HTMLCanvasElement* sourceCanvas = static_cast<HTMLCanvasElement*>(sourceCanvasElement.get());
+    HTMLCanvasElement* sourceCanvas = static_cast<HTMLCanvasElement*>(sourceCanvasElement);
     IntSize sourceSize(10, 10 * ExpensiveCanvasHeuristicParameters::ExpensiveImageSizeRatio + 1);
     OwnPtr<UnacceleratedImageBufferSurface> sourceSurface = adoptPtr(new UnacceleratedImageBufferSurface(sourceSize, NonOpaque));
     sourceCanvas->createImageBufferUsingSurfaceForTesting(sourceSurface.release());
 
     const ImageBitmapOptions defaultOptions;
     // Go through an ImageBitmap to avoid triggering a display list fallback
-    RawPtr<ImageBitmap> sourceImageBitmap = ImageBitmap::create(sourceCanvas, IntRect(IntPoint(0, 0), sourceSize), defaultOptions);
+    ImageBitmap* sourceImageBitmap = ImageBitmap::create(sourceCanvas, IntRect(IntPoint(0, 0), sourceSize), defaultOptions);
 
-    context2d()->drawImage(sourceImageBitmap.get(), 0, 0, 1, 1, 0, 0, 1, 1, exceptionState);
+    context2d()->drawImage(sourceImageBitmap, 0, 0, 1, 1, 0, 0, 1, 1, exceptionState);
     EXPECT_FALSE(exceptionState.hadException());
 
     EXPECT_TRUE(canvasElement().shouldBeDirectComposited());
@@ -660,16 +660,16 @@
 TEST_F(CanvasRenderingContext2DTest, ImageResourceLifetime)
 {
     NonThrowableExceptionState nonThrowableExceptionState;
-    RawPtr<Element> canvasElement = document().createElement("canvas", nonThrowableExceptionState);
+    Element* canvasElement = document().createElement("canvas", nonThrowableExceptionState);
     EXPECT_FALSE(nonThrowableExceptionState.hadException());
-    HTMLCanvasElement* canvas = static_cast<HTMLCanvasElement*>(canvasElement.get());
+    HTMLCanvasElement* canvas = static_cast<HTMLCanvasElement*>(canvasElement);
     canvas->setHeight(40);
     canvas->setWidth(40);
-    RawPtr<ImageBitmap> imageBitmapDerived = nullptr;
+    ImageBitmap* imageBitmapDerived = nullptr;
     {
         const ImageBitmapOptions defaultOptions;
-        RawPtr<ImageBitmap> imageBitmapFromCanvas = ImageBitmap::create(canvas, IntRect(0, 0, canvas->width(), canvas->height()), defaultOptions);
-        imageBitmapDerived = ImageBitmap::create(imageBitmapFromCanvas.get(), IntRect(0, 0, 20, 20), defaultOptions);
+        ImageBitmap* imageBitmapFromCanvas = ImageBitmap::create(canvas, IntRect(0, 0, canvas->width(), canvas->height()), defaultOptions);
+        imageBitmapDerived = ImageBitmap::create(imageBitmapFromCanvas, IntRect(0, 0, 20, 20), defaultOptions);
     }
     CanvasContextCreationAttributes attributes;
     CanvasRenderingContext2D* context = static_cast<CanvasRenderingContext2D*>(canvas->getCanvasRenderingContext("2d", attributes));

diff --git a/third_party/WebKit/Source/modules/canvas2d/HitRegion.cpp b/third_party/WebKit/Source/modules/canvas2d/HitRegion.cpp
index 42eb2c7..3934ca7 100644
--- a/third_party/WebKit/Source/modules/canvas2d/HitRegion.cpp
+++ b/third_party/WebKit/Source/modules/canvas2d/HitRegion.cpp

@@ -35,10 +35,8 @@
     visitor->trace(m_control);
 }
 
-void HitRegionManager::addHitRegion(RawPtr<HitRegion> passHitRegion)
+void HitRegionManager::addHitRegion(HitRegion* hitRegion)
 {
-    RawPtr<HitRegion> hitRegion = passHitRegion;
-
     m_hitRegionList.add(hitRegion);
 
     if (!hitRegion->id().isEmpty())
@@ -83,7 +81,7 @@
     HitRegionList toBeRemoved;
 
     for (HitRegionIterator it = m_hitRegionList.rbegin(); it != itEnd; ++it) {
-        RawPtr<HitRegion> hitRegion = *it;
+        HitRegion* hitRegion = *it;
         hitRegion->removePixels(clearArea);
         if (hitRegion->path().isEmpty())
             toBeRemoved.add(hitRegion);
@@ -119,9 +117,9 @@
     HitRegionIterator itEnd = m_hitRegionList.rend();
 
     for (HitRegionIterator it = m_hitRegionList.rbegin(); it != itEnd; ++it) {
-        RawPtr<HitRegion> hitRegion = *it;
+        HitRegion* hitRegion = *it;
         if (hitRegion->contains(point))
-            return hitRegion.get();
+            return hitRegion;
     }
 
     return nullptr;

diff --git a/third_party/WebKit/Source/modules/canvas2d/HitRegion.h b/third_party/WebKit/Source/modules/canvas2d/HitRegion.h
index a032e1b..8a03e27 100644
--- a/third_party/WebKit/Source/modules/canvas2d/HitRegion.h
+++ b/third_party/WebKit/Source/modules/canvas2d/HitRegion.h

@@ -19,7 +19,7 @@
 
 class HitRegion final : public GarbageCollectedFinalized<HitRegion> {
 public:
-    static RawPtr<HitRegion> create(const Path& path, const HitRegionOptions& options)
+    static HitRegion* create(const Path& path, const HitRegionOptions& options)
     {
         return new HitRegion(path, options);
     }
@@ -51,7 +51,7 @@
     static HitRegionManager* create() { return new HitRegionManager; }
     ~HitRegionManager() { }
 
-    void addHitRegion(RawPtr<HitRegion>);
+    void addHitRegion(HitRegion*);
 
     void removeHitRegion(HitRegion*);
     void removeHitRegionById(const String& id);

diff --git a/third_party/WebKit/Source/modules/compositorworker/CompositorWorkerGlobalScope.cpp b/third_party/WebKit/Source/modules/compositorworker/CompositorWorkerGlobalScope.cpp
index 305805ec..9d7c10f 100644
--- a/third_party/WebKit/Source/modules/compositorworker/CompositorWorkerGlobalScope.cpp
+++ b/third_party/WebKit/Source/modules/compositorworker/CompositorWorkerGlobalScope.cpp

@@ -22,7 +22,7 @@
     return context;
 }
 
-CompositorWorkerGlobalScope::CompositorWorkerGlobalScope(const KURL& url, const String& userAgent, CompositorWorkerThread* thread, double timeOrigin, PassOwnPtr<SecurityOrigin::PrivilegeData> starterOriginPrivilegeData, RawPtr<WorkerClients> workerClients)
+CompositorWorkerGlobalScope::CompositorWorkerGlobalScope(const KURL& url, const String& userAgent, CompositorWorkerThread* thread, double timeOrigin, PassOwnPtr<SecurityOrigin::PrivilegeData> starterOriginPrivilegeData, WorkerClients* workerClients)
     : WorkerGlobalScope(url, userAgent, thread, timeOrigin, starterOriginPrivilegeData, workerClients)
     , m_callbackCollection(this)
 {

diff --git a/third_party/WebKit/Source/modules/compositorworker/CompositorWorkerGlobalScope.h b/third_party/WebKit/Source/modules/compositorworker/CompositorWorkerGlobalScope.h
index c53490f5..b21147e 100644
--- a/third_party/WebKit/Source/modules/compositorworker/CompositorWorkerGlobalScope.h
+++ b/third_party/WebKit/Source/modules/compositorworker/CompositorWorkerGlobalScope.h

@@ -36,7 +36,7 @@
     DECLARE_VIRTUAL_TRACE();
 
 private:
-    CompositorWorkerGlobalScope(const KURL&, const String& userAgent, CompositorWorkerThread*, double timeOrigin, PassOwnPtr<SecurityOrigin::PrivilegeData>, RawPtr<WorkerClients>);
+    CompositorWorkerGlobalScope(const KURL&, const String& userAgent, CompositorWorkerThread*, double timeOrigin, PassOwnPtr<SecurityOrigin::PrivilegeData>, WorkerClients*);
     CompositorWorkerThread* thread() const;
 
     FrameRequestCallbackCollection m_callbackCollection;

diff --git a/third_party/WebKit/Source/modules/compositorworker/CompositorWorkerThreadTest.cpp b/third_party/WebKit/Source/modules/compositorworker/CompositorWorkerThreadTest.cpp
index 5a771e5..237078e8 100644
--- a/third_party/WebKit/Source/modules/compositorworker/CompositorWorkerThreadTest.cpp
+++ b/third_party/WebKit/Source/modules/compositorworker/CompositorWorkerThreadTest.cpp

@@ -137,7 +137,7 @@
     PassOwnPtr<TestCompositorWorkerThread> createCompositorWorker(WaitableEvent* startEvent)
     {
         TestCompositorWorkerThread* workerThread = new TestCompositorWorkerThread(nullptr, *m_objectProxy, 0, startEvent);
-        RawPtr<WorkerClients> clients = nullptr;
+        WorkerClients* clients = nullptr;
         workerThread->start(WorkerThreadStartupData::create(
             KURL(ParsedURLString, "http://fake.url/"),
             "fake user agent",
@@ -146,7 +146,7 @@
             DontPauseWorkerGlobalScopeOnStart,
             adoptPtr(new Vector<CSPHeaderAndType>()),
             m_securityOrigin.get(),
-            clients.release(),
+            clients,
             WebAddressSpaceLocal,
             V8CacheOptionsDefault));
         return adoptPtr(workerThread);

diff --git a/third_party/WebKit/Source/modules/credentialmanager/CredentialsContainer.cpp b/third_party/WebKit/Source/modules/credentialmanager/CredentialsContainer.cpp
index 9612607..98dc149 100644
--- a/third_party/WebKit/Source/modules/credentialmanager/CredentialsContainer.cpp
+++ b/third_party/WebKit/Source/modules/credentialmanager/CredentialsContainer.cpp

@@ -75,12 +75,12 @@
     explicit RequestCallbacks(ScriptPromiseResolver* resolver) : m_resolver(resolver) { }
     ~RequestCallbacks() override { }
 
-    void onSuccess(WebPassOwnPtr<WebCredential> webCredential) override
+    void onSuccess(std::unique_ptr<WebCredential> webCredential) override
     {
         Frame* frame = toDocument(m_resolver->getScriptState()->getExecutionContext())->frame();
         SECURITY_CHECK(!frame || frame == frame->tree().top());
 
-        OwnPtr<WebCredential> credential = webCredential.release();
+        OwnPtr<WebCredential> credential = adoptPtr(webCredential.release());
         if (!credential || !frame) {
             m_resolver->resolve();
             return;

diff --git a/third_party/WebKit/Source/modules/csspaint/CSSPaintDefinition.cpp b/third_party/WebKit/Source/modules/csspaint/CSSPaintDefinition.cpp
index 29507cd..339962f 100644
--- a/third_party/WebKit/Source/modules/csspaint/CSSPaintDefinition.cpp
+++ b/third_party/WebKit/Source/modules/csspaint/CSSPaintDefinition.cpp

@@ -8,7 +8,7 @@
 
 namespace blink {
 
-RawPtr<CSSPaintDefinition> CSSPaintDefinition::create(ScriptState* scriptState, v8::Local<v8::Function> constructor, v8::Local<v8::Function> paint)
+CSSPaintDefinition* CSSPaintDefinition::create(ScriptState* scriptState, v8::Local<v8::Function> constructor, v8::Local<v8::Function> paint)
 {
     return new CSSPaintDefinition(scriptState, constructor, paint);
 }

diff --git a/third_party/WebKit/Source/modules/csspaint/CSSPaintDefinition.h b/third_party/WebKit/Source/modules/csspaint/CSSPaintDefinition.h
index 9c768b73..0d18373 100644
--- a/third_party/WebKit/Source/modules/csspaint/CSSPaintDefinition.h
+++ b/third_party/WebKit/Source/modules/csspaint/CSSPaintDefinition.h

@@ -16,7 +16,7 @@
 
 class CSSPaintDefinition final : public GarbageCollectedFinalized<CSSPaintDefinition> {
 public:
-    static RawPtr<CSSPaintDefinition> create(ScriptState*, v8::Local<v8::Function> constructor, v8::Local<v8::Function> paint);
+    static CSSPaintDefinition* create(ScriptState*, v8::Local<v8::Function> constructor, v8::Local<v8::Function> paint);
     virtual ~CSSPaintDefinition();
 
     v8::Local<v8::Function> paintFunctionForTesting(v8::Isolate* isolate) { return m_paint.newLocal(isolate); }

diff --git a/third_party/WebKit/Source/modules/csspaint/PaintRenderingContext2D.h b/third_party/WebKit/Source/modules/csspaint/PaintRenderingContext2D.h
index dc57016..72e4ecd 100644
--- a/third_party/WebKit/Source/modules/csspaint/PaintRenderingContext2D.h
+++ b/third_party/WebKit/Source/modules/csspaint/PaintRenderingContext2D.h

@@ -21,7 +21,7 @@
     USING_GARBAGE_COLLECTED_MIXIN(PaintRenderingContext2D);
     WTF_MAKE_NONCOPYABLE(PaintRenderingContext2D);
 public:
-    static RawPtr<PaintRenderingContext2D> create(PassOwnPtr<ImageBuffer> imageBuffer)
+    static PaintRenderingContext2D* create(PassOwnPtr<ImageBuffer> imageBuffer)
     {
         return new PaintRenderingContext2D(imageBuffer);
     }

diff --git a/third_party/WebKit/Source/modules/csspaint/PaintWorkletGlobalScope.cpp b/third_party/WebKit/Source/modules/csspaint/PaintWorkletGlobalScope.cpp
index 0350334..5690d8614 100644
--- a/third_party/WebKit/Source/modules/csspaint/PaintWorkletGlobalScope.cpp
+++ b/third_party/WebKit/Source/modules/csspaint/PaintWorkletGlobalScope.cpp

@@ -14,12 +14,12 @@
 namespace blink {
 
 // static
-RawPtr<PaintWorkletGlobalScope> PaintWorkletGlobalScope::create(LocalFrame* frame, const KURL& url, const String& userAgent, PassRefPtr<SecurityOrigin> securityOrigin, v8::Isolate* isolate)
+PaintWorkletGlobalScope* PaintWorkletGlobalScope::create(LocalFrame* frame, const KURL& url, const String& userAgent, PassRefPtr<SecurityOrigin> securityOrigin, v8::Isolate* isolate)
 {
-    RawPtr<PaintWorkletGlobalScope> paintWorkletGlobalScope = new PaintWorkletGlobalScope(frame, url, userAgent, securityOrigin, isolate);
+    PaintWorkletGlobalScope* paintWorkletGlobalScope = new PaintWorkletGlobalScope(frame, url, userAgent, securityOrigin, isolate);
     paintWorkletGlobalScope->scriptController()->initializeContextIfNeeded();
     MainThreadDebugger::instance()->contextCreated(paintWorkletGlobalScope->scriptController()->getScriptState(), paintWorkletGlobalScope->frame(), paintWorkletGlobalScope->getSecurityOrigin());
-    return paintWorkletGlobalScope.release();
+    return paintWorkletGlobalScope;
 }
 
 PaintWorkletGlobalScope::PaintWorkletGlobalScope(LocalFrame* frame, const KURL& url, const String& userAgent, PassRefPtr<SecurityOrigin> securityOrigin, v8::Isolate* isolate)
@@ -103,7 +103,7 @@
 
     v8::Local<v8::Function> paint = v8::Local<v8::Function>::Cast(paintValue);
 
-    RawPtr<CSSPaintDefinition> definition = CSSPaintDefinition::create(scriptController()->getScriptState(), constructor, paint);
+    CSSPaintDefinition* definition = CSSPaintDefinition::create(scriptController()->getScriptState(), constructor, paint);
     m_paintDefinitions.set(name, definition);
 }
 

diff --git a/third_party/WebKit/Source/modules/csspaint/PaintWorkletGlobalScope.h b/third_party/WebKit/Source/modules/csspaint/PaintWorkletGlobalScope.h
index 4c87e491..cb0d416d 100644
--- a/third_party/WebKit/Source/modules/csspaint/PaintWorkletGlobalScope.h
+++ b/third_party/WebKit/Source/modules/csspaint/PaintWorkletGlobalScope.h

@@ -18,7 +18,7 @@
 class MODULES_EXPORT PaintWorkletGlobalScope : public WorkletGlobalScope {
     DEFINE_WRAPPERTYPEINFO();
 public:
-    static RawPtr<PaintWorkletGlobalScope> create(LocalFrame*, const KURL&, const String& userAgent, PassRefPtr<SecurityOrigin>, v8::Isolate*);
+    static PaintWorkletGlobalScope* create(LocalFrame*, const KURL&, const String& userAgent, PassRefPtr<SecurityOrigin>, v8::Isolate*);
     ~PaintWorkletGlobalScope() override;
     void dispose() override;
 

diff --git a/third_party/WebKit/Source/modules/device_light/DeviceLightEvent.h b/third_party/WebKit/Source/modules/device_light/DeviceLightEvent.h
index aab1174..3713f99b 100644
--- a/third_party/WebKit/Source/modules/device_light/DeviceLightEvent.h
+++ b/third_party/WebKit/Source/modules/device_light/DeviceLightEvent.h

@@ -16,15 +16,15 @@
 public:
     ~DeviceLightEvent() override;
 
-    static RawPtr<DeviceLightEvent> create()
+    static DeviceLightEvent* create()
     {
         return new DeviceLightEvent;
     }
-    static RawPtr<DeviceLightEvent> create(const AtomicString& eventType, double value)
+    static DeviceLightEvent* create(const AtomicString& eventType, double value)
     {
         return new DeviceLightEvent(eventType, value);
     }
-    static RawPtr<DeviceLightEvent> create(const AtomicString& eventType, const DeviceLightEventInit& initializer)
+    static DeviceLightEvent* create(const AtomicString& eventType, const DeviceLightEventInit& initializer)
     {
         return new DeviceLightEvent(eventType, initializer);
     }

diff --git a/third_party/WebKit/Source/modules/device_orientation/DeviceMotionEvent.h b/third_party/WebKit/Source/modules/device_orientation/DeviceMotionEvent.h
index 89357f5..7fa05c0a 100644
--- a/third_party/WebKit/Source/modules/device_orientation/DeviceMotionEvent.h
+++ b/third_party/WebKit/Source/modules/device_orientation/DeviceMotionEvent.h

@@ -39,11 +39,11 @@
     DEFINE_WRAPPERTYPEINFO();
 public:
     ~DeviceMotionEvent() override;
-    static RawPtr<DeviceMotionEvent> create()
+    static DeviceMotionEvent* create()
     {
         return new DeviceMotionEvent;
     }
-    static RawPtr<DeviceMotionEvent> create(const AtomicString& eventType, DeviceMotionData* deviceMotionData)
+    static DeviceMotionEvent* create(const AtomicString& eventType, DeviceMotionData* deviceMotionData)
     {
         return new DeviceMotionEvent(eventType, deviceMotionData);
     }

diff --git a/third_party/WebKit/Source/modules/device_orientation/DeviceOrientationEvent.h b/third_party/WebKit/Source/modules/device_orientation/DeviceOrientationEvent.h
index b97f5d1..5ee44c96 100644
--- a/third_party/WebKit/Source/modules/device_orientation/DeviceOrientationEvent.h
+++ b/third_party/WebKit/Source/modules/device_orientation/DeviceOrientationEvent.h

@@ -38,11 +38,11 @@
     DEFINE_WRAPPERTYPEINFO();
 public:
     ~DeviceOrientationEvent() override;
-    static RawPtr<DeviceOrientationEvent> create()
+    static DeviceOrientationEvent* create()
     {
         return new DeviceOrientationEvent;
     }
-    static RawPtr<DeviceOrientationEvent> create(const AtomicString& eventType, DeviceOrientationData* orientation)
+    static DeviceOrientationEvent* create(const AtomicString& eventType, DeviceOrientationData* orientation)
     {
         return new DeviceOrientationEvent(eventType, orientation);
     }

diff --git a/third_party/WebKit/Source/modules/device_orientation/DeviceOrientationInspectorAgent.cpp b/third_party/WebKit/Source/modules/device_orientation/DeviceOrientationInspectorAgent.cpp
index c78a865..212377a 100644
--- a/third_party/WebKit/Source/modules/device_orientation/DeviceOrientationInspectorAgent.cpp
+++ b/third_party/WebKit/Source/modules/device_orientation/DeviceOrientationInspectorAgent.cpp

@@ -20,7 +20,7 @@
 }
 
 // static
-RawPtr<DeviceOrientationInspectorAgent> DeviceOrientationInspectorAgent::create(Page* page)
+DeviceOrientationInspectorAgent* DeviceOrientationInspectorAgent::create(Page* page)
 {
     return new DeviceOrientationInspectorAgent(*page);
 }

diff --git a/third_party/WebKit/Source/modules/device_orientation/DeviceOrientationInspectorAgent.h b/third_party/WebKit/Source/modules/device_orientation/DeviceOrientationInspectorAgent.h
index f550a84..c263cc1 100644
--- a/third_party/WebKit/Source/modules/device_orientation/DeviceOrientationInspectorAgent.h
+++ b/third_party/WebKit/Source/modules/device_orientation/DeviceOrientationInspectorAgent.h

@@ -18,7 +18,7 @@
 class MODULES_EXPORT DeviceOrientationInspectorAgent final : public InspectorBaseAgent<DeviceOrientationInspectorAgent, protocol::Frontend::DeviceOrientation>, public protocol::Backend::DeviceOrientation {
     WTF_MAKE_NONCOPYABLE(DeviceOrientationInspectorAgent);
 public:
-    static RawPtr<DeviceOrientationInspectorAgent> create(Page*);
+    static DeviceOrientationInspectorAgent* create(Page*);
 
     ~DeviceOrientationInspectorAgent() override;
     DECLARE_VIRTUAL_TRACE();

diff --git a/third_party/WebKit/Source/modules/encryptedmedia/HTMLMediaElementEncryptedMedia.cpp b/third_party/WebKit/Source/modules/encryptedmedia/HTMLMediaElementEncryptedMedia.cpp
index 9ffb7f5..50830fd5 100644
--- a/third_party/WebKit/Source/modules/encryptedmedia/HTMLMediaElementEncryptedMedia.cpp
+++ b/third_party/WebKit/Source/modules/encryptedmedia/HTMLMediaElementEncryptedMedia.cpp

@@ -341,7 +341,7 @@
 }
 
 // Create a MediaEncryptedEvent for WD EME.
-static RawPtr<Event> createEncryptedEvent(WebEncryptedMediaInitDataType initDataType, const unsigned char* initData, unsigned initDataLength)
+static Event* createEncryptedEvent(WebEncryptedMediaInitDataType initDataType, const unsigned char* initData, unsigned initDataLength)
 {
     MediaEncryptedEventInit initializer;
     initializer.setInitDataType(EncryptedMediaUtils::convertFromInitDataType(initDataType));
@@ -356,7 +356,7 @@
 {
     WTF_LOG(Media, "HTMLMediaElementEncryptedMedia::encrypted");
 
-    RawPtr<Event> event;
+    Event* event;
     if (m_mediaElement->isMediaDataCORSSameOrigin(m_mediaElement->getExecutionContext()->getSecurityOrigin())) {
         event = createEncryptedEvent(initDataType, initData, initDataLength);
     } else {
@@ -366,7 +366,7 @@
     }
 
     event->setTarget(m_mediaElement);
-    m_mediaElement->scheduleEvent(event.release());
+    m_mediaElement->scheduleEvent(event);
 }
 
 void HTMLMediaElementEncryptedMedia::didBlockPlaybackWaitingForKey()
@@ -382,9 +382,9 @@
     // 2. If the media element's waiting for key value is false, queue a task
     //    to fire a simple event named waitingforkey at the media element.
     if (!m_isWaitingForKey) {
-        RawPtr<Event> event = Event::create(EventTypeNames::waitingforkey);
+        Event* event = Event::create(EventTypeNames::waitingforkey);
         event->setTarget(m_mediaElement);
-        m_mediaElement->scheduleEvent(event.release());
+        m_mediaElement->scheduleEvent(event);
     }
 
     // 3. Set the media element's waiting for key value to true.

diff --git a/third_party/WebKit/Source/modules/encryptedmedia/HTMLMediaElementEncryptedMedia.h b/third_party/WebKit/Source/modules/encryptedmedia/HTMLMediaElementEncryptedMedia.h
index e91b32e..7fa25ab8 100644
--- a/third_party/WebKit/Source/modules/encryptedmedia/HTMLMediaElementEncryptedMedia.h
+++ b/third_party/WebKit/Source/modules/encryptedmedia/HTMLMediaElementEncryptedMedia.h

@@ -50,7 +50,7 @@
     HTMLMediaElementEncryptedMedia(HTMLMediaElement&);
 
     // EventTarget
-    bool setAttributeEventListener(const AtomicString& eventType, RawPtr<EventListener>);
+    bool setAttributeEventListener(const AtomicString& eventType, EventListener*);
     EventListener* getAttributeEventListener(const AtomicString& eventType);
 
     Member<HTMLMediaElement> m_mediaElement;

diff --git a/third_party/WebKit/Source/modules/encryptedmedia/MediaEncryptedEvent.h b/third_party/WebKit/Source/modules/encryptedmedia/MediaEncryptedEvent.h
index 4877595..f9d4196 100644
--- a/third_party/WebKit/Source/modules/encryptedmedia/MediaEncryptedEvent.h
+++ b/third_party/WebKit/Source/modules/encryptedmedia/MediaEncryptedEvent.h

@@ -36,12 +36,12 @@
 public:
     ~MediaEncryptedEvent() override;
 
-    static RawPtr<MediaEncryptedEvent> create()
+    static MediaEncryptedEvent* create()
     {
         return new MediaEncryptedEvent;
     }
 
-    static RawPtr<MediaEncryptedEvent> create(const AtomicString& type, const MediaEncryptedEventInit& initializer)
+    static MediaEncryptedEvent* create(const AtomicString& type, const MediaEncryptedEventInit& initializer)
     {
         return new MediaEncryptedEvent(type, initializer);
     }

diff --git a/third_party/WebKit/Source/modules/encryptedmedia/MediaKeyMessageEvent.h b/third_party/WebKit/Source/modules/encryptedmedia/MediaKeyMessageEvent.h
index e26ddf0..14cfd83 100644
--- a/third_party/WebKit/Source/modules/encryptedmedia/MediaKeyMessageEvent.h
+++ b/third_party/WebKit/Source/modules/encryptedmedia/MediaKeyMessageEvent.h

@@ -39,12 +39,12 @@
 public:
     ~MediaKeyMessageEvent() override;
 
-    static RawPtr<MediaKeyMessageEvent> create()
+    static MediaKeyMessageEvent* create()
     {
         return new MediaKeyMessageEvent;
     }
 
-    static RawPtr<MediaKeyMessageEvent> create(const AtomicString& type, const MediaKeyMessageEventInit& initializer)
+    static MediaKeyMessageEvent* create(const AtomicString& type, const MediaKeyMessageEventInit& initializer)
     {
         return new MediaKeyMessageEvent(type, initializer);
     }

diff --git a/third_party/WebKit/Source/modules/encryptedmedia/MediaKeySession.cpp b/third_party/WebKit/Source/modules/encryptedmedia/MediaKeySession.cpp
index cebd227..55cd354 100644
--- a/third_party/WebKit/Source/modules/encryptedmedia/MediaKeySession.cpp
+++ b/third_party/WebKit/Source/modules/encryptedmedia/MediaKeySession.cpp

@@ -302,9 +302,9 @@
 
 MediaKeySession* MediaKeySession::create(ScriptState* scriptState, MediaKeys* mediaKeys, WebEncryptedMediaSessionType sessionType)
 {
-    RawPtr<MediaKeySession> session = new MediaKeySession(scriptState, mediaKeys, sessionType);
+    MediaKeySession* session = new MediaKeySession(scriptState, mediaKeys, sessionType);
     session->suspendIfNeeded();
-    return session.get();
+    return session;
 }
 
 MediaKeySession::MediaKeySession(ScriptState* scriptState, MediaKeys* mediaKeys, WebEncryptedMediaSessionType sessionType)
@@ -801,9 +801,9 @@
     }
     init.setMessage(DOMArrayBuffer::create(static_cast<const void*>(message), messageLength));
 
-    RawPtr<MediaKeyMessageEvent> event = MediaKeyMessageEvent::create(EventTypeNames::message, init);
+    MediaKeyMessageEvent* event = MediaKeyMessageEvent::create(EventTypeNames::message, init);
     event->setTarget(this);
-    m_asyncEventQueue->enqueueEvent(event.release());
+    m_asyncEventQueue->enqueueEvent(event);
 }
 
 void MediaKeySession::close()
@@ -869,9 +869,9 @@
 
     // 5. Queue a task to fire a simple event named keystatuseschange
     //    at the session.
-    RawPtr<Event> event = Event::create(EventTypeNames::keystatuseschange);
+    Event* event = Event::create(EventTypeNames::keystatuseschange);
     event->setTarget(this);
-    m_asyncEventQueue->enqueueEvent(event.release());
+    m_asyncEventQueue->enqueueEvent(event);
 
     // 6. Queue a task to run the attempt to resume playback if necessary
     //    algorithm on each of the media element(s) whose mediaKeys attribute

diff --git a/third_party/WebKit/Source/modules/fetch/GlobalFetch.cpp b/third_party/WebKit/Source/modules/fetch/GlobalFetch.cpp
index 2cefdf6c..95b2c18d 100644
--- a/third_party/WebKit/Source/modules/fetch/GlobalFetch.cpp
+++ b/third_party/WebKit/Source/modules/fetch/GlobalFetch.cpp

@@ -21,7 +21,7 @@
 class GlobalFetchImpl final : public GarbageCollectedFinalized<GlobalFetchImpl<T>>, public GlobalFetch::ScopedFetcher, public Supplement<T> {
     USING_GARBAGE_COLLECTED_MIXIN(GlobalFetchImpl);
 public:
-    static RawPtr<ScopedFetcher> from(T& supplementable, ExecutionContext* executionContext)
+    static ScopedFetcher* from(T& supplementable, ExecutionContext* executionContext)
     {
         GlobalFetchImpl* supplement = static_cast<GlobalFetchImpl*>(Supplement<T>::from(supplementable, supplementName()));
         if (!supplement) {
@@ -71,12 +71,12 @@
 {
 }
 
-RawPtr<GlobalFetch::ScopedFetcher> GlobalFetch::ScopedFetcher::from(DOMWindow& window)
+GlobalFetch::ScopedFetcher* GlobalFetch::ScopedFetcher::from(DOMWindow& window)
 {
     return GlobalFetchImpl<LocalDOMWindow>::from(toLocalDOMWindow(window), window.getExecutionContext());
 }
 
-RawPtr<GlobalFetch::ScopedFetcher> GlobalFetch::ScopedFetcher::from(WorkerGlobalScope& worker)
+GlobalFetch::ScopedFetcher* GlobalFetch::ScopedFetcher::from(WorkerGlobalScope& worker)
 {
     return GlobalFetchImpl<WorkerGlobalScope>::from(worker, worker.getExecutionContext());
 }

diff --git a/third_party/WebKit/Source/modules/fetch/GlobalFetch.h b/third_party/WebKit/Source/modules/fetch/GlobalFetch.h
index 0f88cfe..7d9265a 100644
--- a/third_party/WebKit/Source/modules/fetch/GlobalFetch.h
+++ b/third_party/WebKit/Source/modules/fetch/GlobalFetch.h

@@ -27,8 +27,8 @@
 
         virtual ScriptPromise fetch(ScriptState*, const RequestInfo&, const Dictionary&, ExceptionState&) = 0;
 
-        static RawPtr<ScopedFetcher> from(DOMWindow&);
-        static RawPtr<ScopedFetcher> from(WorkerGlobalScope&);
+        static ScopedFetcher* from(DOMWindow&);
+        static ScopedFetcher* from(WorkerGlobalScope&);
 
         DECLARE_VIRTUAL_TRACE();
     };

diff --git a/third_party/WebKit/Source/modules/fetch/RequestInit.cpp b/third_party/WebKit/Source/modules/fetch/RequestInit.cpp
index 253f5d93..183ab99 100644
--- a/third_party/WebKit/Source/modules/fetch/RequestInit.cpp
+++ b/third_party/WebKit/Source/modules/fetch/RequestInit.cpp

@@ -82,7 +82,7 @@
         }
     }
 
-    if (isCredentialSet || !isBodySet || v8Body->IsUndefined() || v8Body->IsNull())
+    if (attachedCredential.get() || !isBodySet || v8Body->IsUndefined() || v8Body->IsNull())
         return;
 
     if (v8Body->IsArrayBuffer()) {

diff --git a/third_party/WebKit/Source/modules/filesystem/LocalFileSystem.cpp b/third_party/WebKit/Source/modules/filesystem/LocalFileSystem.cpp
index d26d883a..675b6bb 100644
--- a/third_party/WebKit/Source/modules/filesystem/LocalFileSystem.cpp
+++ b/third_party/WebKit/Source/modules/filesystem/LocalFileSystem.cpp

@@ -74,7 +74,7 @@
     OwnPtr<AsyncFileSystemCallbacks> m_callbacks;
 };
 
-RawPtr<LocalFileSystem> LocalFileSystem::create(PassOwnPtr<FileSystemClient> client)
+LocalFileSystem* LocalFileSystem::create(PassOwnPtr<FileSystemClient> client)
 {
     return new LocalFileSystem(client);
 }
@@ -85,7 +85,7 @@
 
 void LocalFileSystem::resolveURL(ExecutionContext* context, const KURL& fileSystemURL, PassOwnPtr<AsyncFileSystemCallbacks> callbacks)
 {
-    RawPtr<ExecutionContext> contextPtr(context);
+    ExecutionContext* contextPtr(context);
     CallbackWrapper* wrapper = new CallbackWrapper(callbacks);
     requestFileSystemAccessInternal(context,
         bind(&LocalFileSystem::resolveURLInternal, this, contextPtr, fileSystemURL, wrapper),
@@ -94,7 +94,7 @@
 
 void LocalFileSystem::requestFileSystem(ExecutionContext* context, FileSystemType type, long long size, PassOwnPtr<AsyncFileSystemCallbacks> callbacks)
 {
-    RawPtr<ExecutionContext> contextPtr(context);
+    ExecutionContext* contextPtr(context);
     CallbackWrapper* wrapper = new CallbackWrapper(callbacks);
     requestFileSystemAccessInternal(context,
         bind(&LocalFileSystem::fileSystemAllowedInternal, this, contextPtr, type, wrapper),
@@ -103,7 +103,7 @@
 
 void LocalFileSystem::deleteFileSystem(ExecutionContext* context, FileSystemType type, PassOwnPtr<AsyncFileSystemCallbacks> callbacks)
 {
-    RawPtr<ExecutionContext> contextPtr(context);
+    ExecutionContext* contextPtr(context);
     ASSERT(context);
     ASSERT_WITH_SECURITY_IMPLICATION(context->isDocument());
 
@@ -139,21 +139,21 @@
 }
 
 void LocalFileSystem::fileSystemNotAvailable(
-    RawPtr<ExecutionContext> context,
+    ExecutionContext* context,
     CallbackWrapper* callbacks)
 {
     context->postTask(BLINK_FROM_HERE, createSameThreadTask(&reportFailure, callbacks->release(), FileError::ABORT_ERR));
 }
 
 void LocalFileSystem::fileSystemNotAllowedInternal(
-    RawPtr<ExecutionContext> context,
+    ExecutionContext* context,
     CallbackWrapper* callbacks)
 {
     context->postTask(BLINK_FROM_HERE, createSameThreadTask(&reportFailure, callbacks->release(), FileError::ABORT_ERR));
 }
 
 void LocalFileSystem::fileSystemAllowedInternal(
-    RawPtr<ExecutionContext> context,
+    ExecutionContext* context,
     FileSystemType type,
     CallbackWrapper* callbacks)
 {
@@ -167,7 +167,7 @@
 }
 
 void LocalFileSystem::resolveURLInternal(
-    RawPtr<ExecutionContext> context,
+    ExecutionContext* context,
     const KURL& fileSystemURL,
     CallbackWrapper* callbacks)
 {
@@ -179,7 +179,7 @@
 }
 
 void LocalFileSystem::deleteFileSystemInternal(
-    RawPtr<ExecutionContext> context,
+    ExecutionContext* context,
     FileSystemType type,
     CallbackWrapper* callbacks)
 {

diff --git a/third_party/WebKit/Source/modules/filesystem/LocalFileSystem.h b/third_party/WebKit/Source/modules/filesystem/LocalFileSystem.h
index b24c5fe..3ae81b2 100644
--- a/third_party/WebKit/Source/modules/filesystem/LocalFileSystem.h
+++ b/third_party/WebKit/Source/modules/filesystem/LocalFileSystem.h

@@ -51,7 +51,7 @@
     USING_GARBAGE_COLLECTED_MIXIN(LocalFileSystem);
     WTF_MAKE_NONCOPYABLE(LocalFileSystem);
 public:
-    static RawPtr<LocalFileSystem> create(PassOwnPtr<FileSystemClient>);
+    static LocalFileSystem* create(PassOwnPtr<FileSystemClient>);
     virtual ~LocalFileSystem();
 
     void resolveURL(ExecutionContext*, const KURL&, PassOwnPtr<AsyncFileSystemCallbacks>);
@@ -75,11 +75,11 @@
 private:
     WebFileSystem* fileSystem() const;
     void requestFileSystemAccessInternal(ExecutionContext*, PassOwnPtr<SameThreadClosure> allowed, PassOwnPtr<SameThreadClosure> denied);
-    void fileSystemNotAvailable(RawPtr<ExecutionContext>, CallbackWrapper*);
-    void fileSystemNotAllowedInternal(RawPtr<ExecutionContext>, CallbackWrapper*);
-    void fileSystemAllowedInternal(RawPtr<ExecutionContext>, FileSystemType, CallbackWrapper*);
-    void resolveURLInternal(RawPtr<ExecutionContext>, const KURL&, CallbackWrapper*);
-    void deleteFileSystemInternal(RawPtr<ExecutionContext>, FileSystemType, CallbackWrapper*);
+    void fileSystemNotAvailable(ExecutionContext*, CallbackWrapper*);
+    void fileSystemNotAllowedInternal(ExecutionContext*, CallbackWrapper*);
+    void fileSystemAllowedInternal(ExecutionContext*, FileSystemType, CallbackWrapper*);
+    void resolveURLInternal(ExecutionContext*, const KURL&, CallbackWrapper*);
+    void deleteFileSystemInternal(ExecutionContext*, FileSystemType, CallbackWrapper*);
     OwnPtr<FileSystemClient> m_client;
 };
 

diff --git a/third_party/WebKit/Source/modules/gamepad/GamepadEvent.h b/third_party/WebKit/Source/modules/gamepad/GamepadEvent.h
index 38e5647..89a7e17 100644
--- a/third_party/WebKit/Source/modules/gamepad/GamepadEvent.h
+++ b/third_party/WebKit/Source/modules/gamepad/GamepadEvent.h

@@ -14,15 +14,15 @@
 class GamepadEvent final : public Event {
     DEFINE_WRAPPERTYPEINFO();
 public:
-    static RawPtr<GamepadEvent> create()
+    static GamepadEvent* create()
     {
         return new GamepadEvent;
     }
-    static RawPtr<GamepadEvent> create(const AtomicString& type, bool canBubble, bool cancelable, Gamepad* gamepad)
+    static GamepadEvent* create(const AtomicString& type, bool canBubble, bool cancelable, Gamepad* gamepad)
     {
         return new GamepadEvent(type, canBubble, cancelable, gamepad);
     }
-    static RawPtr<GamepadEvent> create(const AtomicString& type, const GamepadEventInit& initializer)
+    static GamepadEvent* create(const AtomicString& type, const GamepadEventInit& initializer)
     {
         return new GamepadEvent(type, initializer);
     }

diff --git a/third_party/WebKit/Source/modules/geofencing/GeofencingEvent.h b/third_party/WebKit/Source/modules/geofencing/GeofencingEvent.h
index 3ac139c..e922203 100644
--- a/third_party/WebKit/Source/modules/geofencing/GeofencingEvent.h
+++ b/third_party/WebKit/Source/modules/geofencing/GeofencingEvent.h

@@ -20,12 +20,12 @@
 class MODULES_EXPORT GeofencingEvent final : public Event {
     DEFINE_WRAPPERTYPEINFO();
 public:
-    static RawPtr<GeofencingEvent> create()
+    static GeofencingEvent* create()
     {
         return new GeofencingEvent;
     }
 
-    static RawPtr<GeofencingEvent> create(const AtomicString& type, const String& id, GeofencingRegion* region)
+    static GeofencingEvent* create(const AtomicString& type, const String& id, GeofencingRegion* region)
     {
         return new GeofencingEvent(type, id, region);
     }

diff --git a/third_party/WebKit/Source/modules/geolocation/GeolocationController.cpp b/third_party/WebKit/Source/modules/geolocation/GeolocationController.cpp
index 2ab6033..d08f5a9 100644
--- a/third_party/WebKit/Source/modules/geolocation/GeolocationController.cpp
+++ b/third_party/WebKit/Source/modules/geolocation/GeolocationController.cpp

@@ -73,7 +73,7 @@
 #endif
 }
 
-RawPtr<GeolocationController> GeolocationController::create(LocalFrame& frame, GeolocationClient* client)
+GeolocationController* GeolocationController::create(LocalFrame& frame, GeolocationClient* client)
 {
     return new GeolocationController(frame, client);
 }

diff --git a/third_party/WebKit/Source/modules/geolocation/GeolocationController.h b/third_party/WebKit/Source/modules/geolocation/GeolocationController.h
index e2e7a92a..04ec584 100644
--- a/third_party/WebKit/Source/modules/geolocation/GeolocationController.h
+++ b/third_party/WebKit/Source/modules/geolocation/GeolocationController.h

@@ -46,7 +46,7 @@
 public:
     virtual ~GeolocationController();
 
-    static RawPtr<GeolocationController> create(LocalFrame&, GeolocationClient*);
+    static GeolocationController* create(LocalFrame&, GeolocationClient*);
 
     void addObserver(Geolocation*, bool enableHighAccuracy);
     void removeObserver(Geolocation*);

diff --git a/third_party/WebKit/Source/modules/imagebitmap/ImageBitmapRenderingContext.cpp b/third_party/WebKit/Source/modules/imagebitmap/ImageBitmapRenderingContext.cpp
index ae6b34b..82ac1c2 100644
--- a/third_party/WebKit/Source/modules/imagebitmap/ImageBitmapRenderingContext.cpp
+++ b/third_party/WebKit/Source/modules/imagebitmap/ImageBitmapRenderingContext.cpp

@@ -22,7 +22,7 @@
 
 void ImageBitmapRenderingContext::setCanvasGetContextResult(RenderingContext& result)
 {
-    result.setImageBitmapRenderingContext(RawPtr<ImageBitmapRenderingContext>(this));
+    result.setImageBitmapRenderingContext(this);
 }
 
 void ImageBitmapRenderingContext::transferImageBitmap(ImageBitmap* imageBitmap)
@@ -58,7 +58,7 @@
     return true;
 }
 
-RawPtr<CanvasRenderingContext> ImageBitmapRenderingContext::Factory::create(HTMLCanvasElement* canvas, const CanvasContextCreationAttributes& attrs, Document& document)
+CanvasRenderingContext* ImageBitmapRenderingContext::Factory::create(HTMLCanvasElement* canvas, const CanvasContextCreationAttributes& attrs, Document& document)
 {
     if (!RuntimeEnabledFeatures::experimentalCanvasFeaturesEnabled())
         return nullptr;

diff --git a/third_party/WebKit/Source/modules/imagebitmap/ImageBitmapRenderingContext.h b/third_party/WebKit/Source/modules/imagebitmap/ImageBitmapRenderingContext.h
index d096fd8..1118f80 100644
--- a/third_party/WebKit/Source/modules/imagebitmap/ImageBitmapRenderingContext.h
+++ b/third_party/WebKit/Source/modules/imagebitmap/ImageBitmapRenderingContext.h

@@ -23,7 +23,7 @@
         Factory() {}
         ~Factory() override {}
 
-        RawPtr<CanvasRenderingContext> create(HTMLCanvasElement*, const CanvasContextCreationAttributes&, Document&) override;
+        CanvasRenderingContext* create(HTMLCanvasElement*, const CanvasContextCreationAttributes&, Document&) override;
         CanvasRenderingContext::ContextType getContextType() const override { return CanvasRenderingContext::ContextImageBitmap; }
         void onError(HTMLCanvasElement*, const String& error) override { }
     };

diff --git a/third_party/WebKit/Source/modules/indexeddb/IDBAny.cpp b/third_party/WebKit/Source/modules/indexeddb/IDBAny.cpp
index a842d040..f93970c 100644
--- a/third_party/WebKit/Source/modules/indexeddb/IDBAny.cpp
+++ b/third_party/WebKit/Source/modules/indexeddb/IDBAny.cpp

@@ -122,7 +122,7 @@
     return m_integer;
 }
 
-IDBAny::IDBAny(RawPtr<DOMStringList> value)
+IDBAny::IDBAny(DOMStringList* value)
     : m_type(DOMStringListType)
     , m_domStringList(value)
 {

diff --git a/third_party/WebKit/Source/modules/indexeddb/IDBAny.h b/third_party/WebKit/Source/modules/indexeddb/IDBAny.h
index 39c30dc..805cc96 100644
--- a/third_party/WebKit/Source/modules/indexeddb/IDBAny.h
+++ b/third_party/WebKit/Source/modules/indexeddb/IDBAny.h

@@ -60,7 +60,7 @@
     {
         return new IDBAny(idbObject);
     }
-    static IDBAny* create(RawPtr<DOMStringList> domStringList)
+    static IDBAny* create(DOMStringList* domStringList)
     {
         return new IDBAny(domStringList);
     }
@@ -110,7 +110,7 @@
 
 private:
     explicit IDBAny(Type);
-    explicit IDBAny(RawPtr<DOMStringList>);
+    explicit IDBAny(DOMStringList*);
     explicit IDBAny(IDBCursor*);
     explicit IDBAny(IDBDatabase*);
     explicit IDBAny(IDBIndex*);

diff --git a/third_party/WebKit/Source/modules/indexeddb/IDBDatabase.cpp b/third_party/WebKit/Source/modules/indexeddb/IDBDatabase.cpp
index 48bdaad..7aee9d1 100644
--- a/third_party/WebKit/Source/modules/indexeddb/IDBDatabase.cpp
+++ b/third_party/WebKit/Source/modules/indexeddb/IDBDatabase.cpp

@@ -160,13 +160,13 @@
     m_transactions.get(transactionId)->onComplete();
 }
 
-RawPtr<DOMStringList> IDBDatabase::objectStoreNames() const
+DOMStringList* IDBDatabase::objectStoreNames() const
 {
-    RawPtr<DOMStringList> objectStoreNames = DOMStringList::create(DOMStringList::IndexedDB);
+    DOMStringList* objectStoreNames = DOMStringList::create(DOMStringList::IndexedDB);
     for (const auto& it : m_metadata.objectStores)
         objectStoreNames->append(it.value.name);
     objectStoreNames->sort();
-    return objectStoreNames.release();
+    return objectStoreNames;
 }
 
 IDBObjectStore* IDBDatabase::createObjectStore(const String& name, const IDBKeyPath& keyPath, bool autoIncrement, ExceptionState& exceptionState)

diff --git a/third_party/WebKit/Source/modules/indexeddb/IDBDatabase.h b/third_party/WebKit/Source/modules/indexeddb/IDBDatabase.h
index 8f501d64..f620d0f 100644
--- a/third_party/WebKit/Source/modules/indexeddb/IDBDatabase.h
+++ b/third_party/WebKit/Source/modules/indexeddb/IDBDatabase.h

@@ -75,7 +75,7 @@
     // Implement the IDL
     const String& name() const { return m_metadata.name; }
     unsigned long long version() const { return m_metadata.version; }
-    RawPtr<DOMStringList> objectStoreNames() const;
+    DOMStringList* objectStoreNames() const;
 
     IDBObjectStore* createObjectStore(const String& name, const IDBObjectStoreParameters& options, ExceptionState& exceptionState) { return createObjectStore(name, IDBKeyPath(options.keyPath()), options.autoIncrement(), exceptionState); }
     IDBTransaction* transaction(ScriptState*, const StringOrStringSequenceOrDOMStringList&, const String& mode, ExceptionState&);

diff --git a/third_party/WebKit/Source/modules/indexeddb/IDBObjectStore.cpp b/third_party/WebKit/Source/modules/indexeddb/IDBObjectStore.cpp
index f5b9949..569ce38a 100644
--- a/third_party/WebKit/Source/modules/indexeddb/IDBObjectStore.cpp
+++ b/third_party/WebKit/Source/modules/indexeddb/IDBObjectStore.cpp

@@ -75,14 +75,14 @@
     return ScriptValue::from(scriptState, m_metadata.keyPath);
 }
 
-RawPtr<DOMStringList> IDBObjectStore::indexNames() const
+DOMStringList* IDBObjectStore::indexNames() const
 {
     IDB_TRACE("IDBObjectStore::indexNames");
-    RawPtr<DOMStringList> indexNames = DOMStringList::create(DOMStringList::IndexedDB);
+    DOMStringList* indexNames = DOMStringList::create(DOMStringList::IndexedDB);
     for (const auto& it : m_metadata.indexes)
         indexNames->append(it.value.name);
     indexNames->sort();
-    return indexNames.release();
+    return indexNames;
 }
 
 IDBRequest* IDBObjectStore::get(ScriptState* scriptState, const ScriptValue& key, ExceptionState& exceptionState)
@@ -416,7 +416,7 @@
 // cursor success handlers are kept alive.
 class IndexPopulator final : public EventListener {
 public:
-    static RawPtr<IndexPopulator> create(ScriptState* scriptState, IDBDatabase* database, int64_t transactionId, int64_t objectStoreId, const IDBIndexMetadata& indexMetadata)
+    static IndexPopulator* create(ScriptState* scriptState, IDBDatabase* database, int64_t transactionId, int64_t objectStoreId, const IDBIndexMetadata& indexMetadata)
     {
         return new IndexPopulator(scriptState, database, transactionId, objectStoreId, indexMetadata);
     }
@@ -547,7 +547,7 @@
     indexRequest->preventPropagation();
 
     // This is kept alive by being the success handler of the request, which is in turn kept alive by the owning transaction.
-    RawPtr<IndexPopulator> indexPopulator = IndexPopulator::create(scriptState, transaction()->db(), m_transaction->id(), id(), metadata);
+    IndexPopulator* indexPopulator = IndexPopulator::create(scriptState, transaction()->db(), m_transaction->id(), id(), metadata);
     indexRequest->setOnsuccess(indexPopulator);
     return index;
 }

diff --git a/third_party/WebKit/Source/modules/indexeddb/IDBObjectStore.h b/third_party/WebKit/Source/modules/indexeddb/IDBObjectStore.h
index 3e114f1a..756c0f39 100644
--- a/third_party/WebKit/Source/modules/indexeddb/IDBObjectStore.h
+++ b/third_party/WebKit/Source/modules/indexeddb/IDBObjectStore.h

@@ -64,7 +64,7 @@
     int64_t id() const { return m_metadata.id; }
     const String& name() const { return m_metadata.name; }
     ScriptValue keyPath(ScriptState*) const;
-    RawPtr<DOMStringList> indexNames() const;
+    DOMStringList* indexNames() const;
     IDBTransaction* transaction() const { return m_transaction.get(); }
     bool autoIncrement() const { return m_metadata.autoIncrement; }
 

diff --git a/third_party/WebKit/Source/modules/indexeddb/IDBRequest.cpp b/third_party/WebKit/Source/modules/indexeddb/IDBRequest.cpp
index ba00da9..0a97409 100644
--- a/third_party/WebKit/Source/modules/indexeddb/IDBRequest.cpp
+++ b/third_party/WebKit/Source/modules/indexeddb/IDBRequest.cpp

@@ -240,10 +240,10 @@
     if (!shouldEnqueueEvent())
         return;
 
-    RawPtr<DOMStringList> domStringList = DOMStringList::create(DOMStringList::IndexedDB);
+    DOMStringList* domStringList = DOMStringList::create(DOMStringList::IndexedDB);
     for (size_t i = 0; i < stringList.size(); ++i)
         domStringList->append(stringList[i]);
-    onSuccessInternal(IDBAny::create(domStringList.release()));
+    onSuccessInternal(IDBAny::create(domStringList));
 }
 
 void IDBRequest::onSuccess(PassOwnPtr<WebIDBCursor> backend, IDBKey* key, IDBKey* primaryKey, PassRefPtr<IDBValue> value)

diff --git a/third_party/WebKit/Source/modules/indexeddb/IDBTransaction.cpp b/third_party/WebKit/Source/modules/indexeddb/IDBTransaction.cpp
index 754034c..44d0401 100644
--- a/third_party/WebKit/Source/modules/indexeddb/IDBTransaction.cpp
+++ b/third_party/WebKit/Source/modules/indexeddb/IDBTransaction.cpp

@@ -339,16 +339,16 @@
     return IndexedDBNames::readonly;
 }
 
-RawPtr<DOMStringList> IDBTransaction::objectStoreNames() const
+DOMStringList* IDBTransaction::objectStoreNames() const
 {
     if (m_mode == WebIDBTransactionModeVersionChange)
         return m_database->objectStoreNames();
 
-    RawPtr<DOMStringList> objectStoreNames = DOMStringList::create(DOMStringList::IndexedDB);
+    DOMStringList* objectStoreNames = DOMStringList::create(DOMStringList::IndexedDB);
     for (const String& name : m_objectStoreNames)
         objectStoreNames->append(name);
     objectStoreNames->sort();
-    return objectStoreNames.release();
+    return objectStoreNames;
 }
 
 const AtomicString& IDBTransaction::interfaceName() const

diff --git a/third_party/WebKit/Source/modules/indexeddb/IDBTransaction.h b/third_party/WebKit/Source/modules/indexeddb/IDBTransaction.h
index cc545aa..6a8d121 100644
--- a/third_party/WebKit/Source/modules/indexeddb/IDBTransaction.h
+++ b/third_party/WebKit/Source/modules/indexeddb/IDBTransaction.h

@@ -76,7 +76,7 @@
 
     // Implement the IDBTransaction IDL
     const String& mode() const;
-    RawPtr<DOMStringList> objectStoreNames() const;
+    DOMStringList* objectStoreNames() const;
     IDBDatabase* db() const { return m_database.get(); }
     DOMException* error() const { return m_error; }
     IDBObjectStore* objectStore(const String& name, ExceptionState&);

diff --git a/third_party/WebKit/Source/modules/indexeddb/IDBVersionChangeEvent.h b/third_party/WebKit/Source/modules/indexeddb/IDBVersionChangeEvent.h
index e8156ab..0bec4bfd 100644
--- a/third_party/WebKit/Source/modules/indexeddb/IDBVersionChangeEvent.h
+++ b/third_party/WebKit/Source/modules/indexeddb/IDBVersionChangeEvent.h

@@ -42,15 +42,15 @@
 class IDBVersionChangeEvent final : public Event {
     DEFINE_WRAPPERTYPEINFO();
 public:
-    static RawPtr<IDBVersionChangeEvent> create()
+    static IDBVersionChangeEvent* create()
     {
         return new IDBVersionChangeEvent();
     }
-    static RawPtr<IDBVersionChangeEvent> create(const AtomicString& eventType, unsigned long long oldVersion, const Nullable<unsigned long long>& newVersion, WebIDBDataLoss dataLoss = WebIDBDataLossNone, const String& dataLossMessage = String())
+    static IDBVersionChangeEvent* create(const AtomicString& eventType, unsigned long long oldVersion, const Nullable<unsigned long long>& newVersion, WebIDBDataLoss dataLoss = WebIDBDataLossNone, const String& dataLossMessage = String())
     {
         return new IDBVersionChangeEvent(eventType, oldVersion, newVersion, dataLoss, dataLossMessage);
     }
-    static RawPtr<IDBVersionChangeEvent> create(const AtomicString& eventType, const IDBVersionChangeEventInit& initializer)
+    static IDBVersionChangeEvent* create(const AtomicString& eventType, const IDBVersionChangeEventInit& initializer)
     {
         return new IDBVersionChangeEvent(eventType, initializer);
     }

diff --git a/third_party/WebKit/Source/modules/indexeddb/IndexedDBClient.cpp b/third_party/WebKit/Source/modules/indexeddb/IndexedDBClient.cpp
index 78f0eca..ddbe4cd 100644
--- a/third_party/WebKit/Source/modules/indexeddb/IndexedDBClient.cpp
+++ b/third_party/WebKit/Source/modules/indexeddb/IndexedDBClient.cpp

@@ -3,22 +3,28 @@
 // found in the LICENSE file.
 
 #include "modules/indexeddb/IndexedDBClient.h"
+#include "wtf/Atomics.h"
 
 namespace blink {
 
-static CreateIndexedDBClient* idbClientCreateFunction = nullptr;
+static void* idbClientCreateFunction = nullptr;
 
 void setIndexedDBClientCreateFunction(CreateIndexedDBClient createFunction)
 {
-    idbClientCreateFunction = createFunction;
+#if ENABLE(ASSERT)
+    CreateIndexedDBClient* currentFunction = reinterpret_cast<CreateIndexedDBClient*>(acquireLoad(&idbClientCreateFunction));
+    ASSERT(!currentFunction || currentFunction == createFunction);
+#endif
+    releaseStore(&idbClientCreateFunction, reinterpret_cast<void*>(createFunction));
 }
 
 IndexedDBClient* IndexedDBClient::create()
 {
-    ASSERT(idbClientCreateFunction);
+    CreateIndexedDBClient* createFunction = reinterpret_cast<CreateIndexedDBClient*>(acquireLoad(&idbClientCreateFunction));
+    ASSERT(createFunction);
     // There's no reason why we need to allocate a new proxy each time, but
     // there's also no strong reason not to.
-    return idbClientCreateFunction();
+    return createFunction();
 }
 
 } // namespace blink

diff --git a/third_party/WebKit/Source/modules/indexeddb/InspectorIndexedDBAgent.cpp b/third_party/WebKit/Source/modules/indexeddb/InspectorIndexedDBAgent.cpp
index db3bfde..790ff2f 100644
--- a/third_party/WebKit/Source/modules/indexeddb/InspectorIndexedDBAgent.cpp
+++ b/third_party/WebKit/Source/modules/indexeddb/InspectorIndexedDBAgent.cpp

@@ -88,7 +88,7 @@
 class GetDatabaseNamesCallback final : public EventListener {
     WTF_MAKE_NONCOPYABLE(GetDatabaseNamesCallback);
 public:
-    static RawPtr<GetDatabaseNamesCallback> create(PassOwnPtr<RequestDatabaseNamesCallback> requestCallback, const String& securityOrigin)
+    static GetDatabaseNamesCallback* create(PassOwnPtr<RequestDatabaseNamesCallback> requestCallback, const String& securityOrigin)
     {
         return new GetDatabaseNamesCallback(requestCallback, securityOrigin);
     }
@@ -114,7 +114,7 @@
             return;
         }
 
-        RawPtr<DOMStringList> databaseNamesList = requestResult->domStringList();
+        DOMStringList* databaseNamesList = requestResult->domStringList();
         OwnPtr<protocol::Array<String>> databaseNames = protocol::Array<String>::create();
         for (size_t i = 0; i < databaseNamesList->length(); ++i)
             databaseNames->addItem(databaseNamesList->anonymousIndexedGetter(i));
@@ -151,7 +151,7 @@
 
 class OpenDatabaseCallback final : public EventListener {
 public:
-    static RawPtr<OpenDatabaseCallback> create(ExecutableWithDatabase* executableWithDatabase)
+    static OpenDatabaseCallback* create(ExecutableWithDatabase* executableWithDatabase)
     {
         return new OpenDatabaseCallback(executableWithDatabase);
     }
@@ -192,7 +192,7 @@
 
 class UpgradeDatabaseCallback final : public EventListener {
 public:
-    static RawPtr<UpgradeDatabaseCallback> create(ExecutableWithDatabase* executableWithDatabase)
+    static UpgradeDatabaseCallback* create(ExecutableWithDatabase* executableWithDatabase)
     {
         return new UpgradeDatabaseCallback(executableWithDatabase);
     }
@@ -229,8 +229,8 @@
 
 void ExecutableWithDatabase::start(IDBFactory* idbFactory, SecurityOrigin*, const String& databaseName)
 {
-    RawPtr<OpenDatabaseCallback> openCallback = OpenDatabaseCallback::create(this);
-    RawPtr<UpgradeDatabaseCallback> upgradeCallback = UpgradeDatabaseCallback::create(this);
+    OpenDatabaseCallback* openCallback = OpenDatabaseCallback::create(this);
+    UpgradeDatabaseCallback* upgradeCallback = UpgradeDatabaseCallback::create(this);
     TrackExceptionState exceptionState;
     IDBOpenDBRequest* idbOpenDBRequest = idbFactory->open(getScriptState(), databaseName, exceptionState);
     if (exceptionState.hadException()) {
@@ -407,7 +407,7 @@
 
 class OpenCursorCallback final : public EventListener {
 public:
-    static RawPtr<OpenCursorCallback> create(ScriptState* scriptState, PassOwnPtr<RequestDataCallback> requestCallback, int skipCount, unsigned pageSize)
+    static OpenCursorCallback* create(ScriptState* scriptState, PassOwnPtr<RequestDataCallback> requestCallback, int skipCount, unsigned pageSize)
     {
         return new OpenCursorCallback(scriptState, requestCallback, skipCount, pageSize);
     }
@@ -544,7 +544,7 @@
         } else {
             idbRequest = idbObjectStore->openCursor(getScriptState(), m_idbKeyRange.get(), WebIDBCursorDirectionNext);
         }
-        RawPtr<OpenCursorCallback> openCursorCallback = OpenCursorCallback::create(getScriptState(), m_requestCallback.release(), m_skipCount, m_pageSize);
+        OpenCursorCallback* openCursorCallback = OpenCursorCallback::create(getScriptState(), m_requestCallback.release(), m_skipCount, m_pageSize);
         idbRequest->addEventListener(EventTypeNames::success, openCursorCallback, false);
     }
 
@@ -571,7 +571,7 @@
 } // namespace
 
 // static
-RawPtr<InspectorIndexedDBAgent> InspectorIndexedDBAgent::create(InspectedFrames* inspectedFrames)
+InspectorIndexedDBAgent* InspectorIndexedDBAgent::create(InspectedFrames* inspectedFrames)
 {
     return new InspectorIndexedDBAgent(inspectedFrames);
 }
@@ -705,7 +705,7 @@
 class ClearObjectStoreListener final : public EventListener {
     WTF_MAKE_NONCOPYABLE(ClearObjectStoreListener);
 public:
-    static RawPtr<ClearObjectStoreListener> create(PassOwnPtr<ClearObjectStoreCallback> requestCallback)
+    static ClearObjectStoreListener* create(PassOwnPtr<ClearObjectStoreCallback> requestCallback)
     {
         return new ClearObjectStoreListener(requestCallback);
     }

diff --git a/third_party/WebKit/Source/modules/indexeddb/InspectorIndexedDBAgent.h b/third_party/WebKit/Source/modules/indexeddb/InspectorIndexedDBAgent.h
index 56685eb..a0cb283 100644
--- a/third_party/WebKit/Source/modules/indexeddb/InspectorIndexedDBAgent.h
+++ b/third_party/WebKit/Source/modules/indexeddb/InspectorIndexedDBAgent.h

@@ -43,7 +43,7 @@
 
 class MODULES_EXPORT InspectorIndexedDBAgent final : public InspectorBaseAgent<InspectorIndexedDBAgent, protocol::Frontend::IndexedDB>, public protocol::Backend::IndexedDB {
 public:
-    static RawPtr<InspectorIndexedDBAgent> create(InspectedFrames*);
+    static InspectorIndexedDBAgent* create(InspectedFrames*);
 
     ~InspectorIndexedDBAgent() override;
     DECLARE_VIRTUAL_TRACE();

diff --git a/third_party/WebKit/Source/modules/installedapp/InstalledAppController.cpp b/third_party/WebKit/Source/modules/installedapp/InstalledAppController.cpp
index c43109d..4f0c188 100644
--- a/third_party/WebKit/Source/modules/installedapp/InstalledAppController.cpp
+++ b/third_party/WebKit/Source/modules/installedapp/InstalledAppController.cpp

@@ -8,6 +8,8 @@
 #include "platform/RuntimeEnabledFeatures.h"
 #include "public/platform/WebSecurityOrigin.h"
 
+#include <utility>
+
 namespace blink {
 
 InstalledAppController::~InstalledAppController()
@@ -18,8 +20,8 @@
 {
     ASSERT(RuntimeEnabledFeatures::installedAppEnabled());
 
-    RawPtr<InstalledAppController> controller = new InstalledAppController(frame, client);
-    Supplement<LocalFrame>::provideTo(frame, supplementName(), controller.release());
+    InstalledAppController* controller = new InstalledAppController(frame, client);
+    Supplement<LocalFrame>::provideTo(frame, supplementName(), controller);
 }
 
 InstalledAppController* InstalledAppController::from(LocalFrame& frame)
@@ -40,7 +42,7 @@
     return "InstalledAppController";
 }
 
-void InstalledAppController::getInstalledApps(const WebSecurityOrigin& url, WebPassOwnPtr<AppInstalledCallbacks> callback)
+void InstalledAppController::getInstalledApps(const WebSecurityOrigin& url, std::unique_ptr<AppInstalledCallbacks> callback)
 {
     // When detached, the client is no longer valid.
     if (!m_client) {
@@ -49,7 +51,7 @@
     }
 
     // Client is expected to take ownership of the callback
-    m_client->getInstalledRelatedApps(url, callback);
+    m_client->getInstalledRelatedApps(url, std::move(callback));
 }
 
 void InstalledAppController::willDetachFrameHost()

diff --git a/third_party/WebKit/Source/modules/installedapp/InstalledAppController.h b/third_party/WebKit/Source/modules/installedapp/InstalledAppController.h
index f7a0553..c1496a4 100644
--- a/third_party/WebKit/Source/modules/installedapp/InstalledAppController.h
+++ b/third_party/WebKit/Source/modules/installedapp/InstalledAppController.h

@@ -21,7 +21,7 @@
 public:
     virtual ~InstalledAppController();
 
-    void getInstalledApps(const WebSecurityOrigin&, WebPassOwnPtr<AppInstalledCallbacks>);
+    void getInstalledApps(const WebSecurityOrigin&, std::unique_ptr<AppInstalledCallbacks>);
 
     static void provideTo(LocalFrame&, WebInstalledAppClient*);
     static InstalledAppController* from(LocalFrame&);

diff --git a/third_party/WebKit/Source/modules/installedapp/NavigatorInstalledApp.cpp b/third_party/WebKit/Source/modules/installedapp/NavigatorInstalledApp.cpp
index 90a7c60..6a8d01d 100644
--- a/third_party/WebKit/Source/modules/installedapp/NavigatorInstalledApp.cpp
+++ b/third_party/WebKit/Source/modules/installedapp/NavigatorInstalledApp.cpp

@@ -18,6 +18,7 @@
 #include "modules/installedapp/RelatedApplication.h"
 #include "public/platform/modules/installedapp/WebInstalledAppClient.h"
 #include "public/platform/modules/installedapp/WebRelatedApplication.h"
+#include "wtf/PtrUtil.h"
 
 namespace blink {
 
@@ -80,7 +81,7 @@
 
     controller()->getInstalledApps(
         WebSecurityOrigin(scriptState->getExecutionContext()->getSecurityOrigin()),
-        adoptWebPtr(new CallbackPromiseAdapter<RelatedAppArray, void>(resolver)));
+        wrapUnique(new CallbackPromiseAdapter<RelatedAppArray, void>(resolver)));
     return promise;
 }
 

diff --git a/third_party/WebKit/Source/modules/mediacapturefromelement/CanvasCaptureMediaStreamTrack.cpp b/third_party/WebKit/Source/modules/mediacapturefromelement/CanvasCaptureMediaStreamTrack.cpp
index 26b627fa..53ae3e1 100644
--- a/third_party/WebKit/Source/modules/mediacapturefromelement/CanvasCaptureMediaStreamTrack.cpp
+++ b/third_party/WebKit/Source/modules/mediacapturefromelement/CanvasCaptureMediaStreamTrack.cpp

@@ -12,12 +12,12 @@
 
 namespace blink {
 
-CanvasCaptureMediaStreamTrack* CanvasCaptureMediaStreamTrack::create(MediaStreamComponent* component, RawPtr<HTMLCanvasElement> element, const PassOwnPtr<WebCanvasCaptureHandler> handler)
+CanvasCaptureMediaStreamTrack* CanvasCaptureMediaStreamTrack::create(MediaStreamComponent* component, HTMLCanvasElement* element, const PassOwnPtr<WebCanvasCaptureHandler> handler)
 {
     return new CanvasCaptureMediaStreamTrack(component, element, handler);
 }
 
-CanvasCaptureMediaStreamTrack* CanvasCaptureMediaStreamTrack::create(MediaStreamComponent* component, RawPtr<HTMLCanvasElement> element, const PassOwnPtr<WebCanvasCaptureHandler> handler, double frameRate)
+CanvasCaptureMediaStreamTrack* CanvasCaptureMediaStreamTrack::create(MediaStreamComponent* component, HTMLCanvasElement* element, const PassOwnPtr<WebCanvasCaptureHandler> handler, double frameRate)
 {
     return new CanvasCaptureMediaStreamTrack(component, element, handler, frameRate);
 }
@@ -56,7 +56,7 @@
     m_canvasElement->addListener(m_drawListener.get());
 }
 
-CanvasCaptureMediaStreamTrack::CanvasCaptureMediaStreamTrack(MediaStreamComponent* component, RawPtr<HTMLCanvasElement> element, const PassOwnPtr<WebCanvasCaptureHandler> handler)
+CanvasCaptureMediaStreamTrack::CanvasCaptureMediaStreamTrack(MediaStreamComponent* component, HTMLCanvasElement* element, const PassOwnPtr<WebCanvasCaptureHandler> handler)
     : MediaStreamTrack(element->getExecutionContext(), component)
     , m_canvasElement(element)
 {
@@ -65,7 +65,7 @@
     m_canvasElement->addListener(m_drawListener.get());
 }
 
-CanvasCaptureMediaStreamTrack::CanvasCaptureMediaStreamTrack(MediaStreamComponent* component, RawPtr<HTMLCanvasElement> element, const PassOwnPtr<WebCanvasCaptureHandler> handler, double frameRate)
+CanvasCaptureMediaStreamTrack::CanvasCaptureMediaStreamTrack(MediaStreamComponent* component, HTMLCanvasElement* element, const PassOwnPtr<WebCanvasCaptureHandler> handler, double frameRate)
     : MediaStreamTrack(element->getExecutionContext(), component)
     , m_canvasElement(element)
 {

diff --git a/third_party/WebKit/Source/modules/mediacapturefromelement/CanvasCaptureMediaStreamTrack.h b/third_party/WebKit/Source/modules/mediacapturefromelement/CanvasCaptureMediaStreamTrack.h
index 7c8a41a9..9ba323e 100644
--- a/third_party/WebKit/Source/modules/mediacapturefromelement/CanvasCaptureMediaStreamTrack.h
+++ b/third_party/WebKit/Source/modules/mediacapturefromelement/CanvasCaptureMediaStreamTrack.h

@@ -17,8 +17,8 @@
 class CanvasCaptureMediaStreamTrack final : public MediaStreamTrack {
     DEFINE_WRAPPERTYPEINFO();
 public:
-    static CanvasCaptureMediaStreamTrack* create(MediaStreamComponent*, RawPtr<HTMLCanvasElement>, const PassOwnPtr<WebCanvasCaptureHandler>);
-    static CanvasCaptureMediaStreamTrack* create(MediaStreamComponent*, RawPtr<HTMLCanvasElement>, const PassOwnPtr<WebCanvasCaptureHandler>, double frameRate);
+    static CanvasCaptureMediaStreamTrack* create(MediaStreamComponent*, HTMLCanvasElement*, const PassOwnPtr<WebCanvasCaptureHandler>);
+    static CanvasCaptureMediaStreamTrack* create(MediaStreamComponent*, HTMLCanvasElement*, const PassOwnPtr<WebCanvasCaptureHandler>, double frameRate);
 
     HTMLCanvasElement* canvas() const;
     void requestFrame();
@@ -29,8 +29,8 @@
 
 private:
     CanvasCaptureMediaStreamTrack(const CanvasCaptureMediaStreamTrack&, MediaStreamComponent*);
-    CanvasCaptureMediaStreamTrack(MediaStreamComponent*, RawPtr<HTMLCanvasElement>, const PassOwnPtr<WebCanvasCaptureHandler>);
-    CanvasCaptureMediaStreamTrack(MediaStreamComponent*, RawPtr<HTMLCanvasElement>, const PassOwnPtr<WebCanvasCaptureHandler>, double frameRate);
+    CanvasCaptureMediaStreamTrack(MediaStreamComponent*, HTMLCanvasElement*, const PassOwnPtr<WebCanvasCaptureHandler>);
+    CanvasCaptureMediaStreamTrack(MediaStreamComponent*, HTMLCanvasElement*, const PassOwnPtr<WebCanvasCaptureHandler>, double frameRate);
 
     Member<HTMLCanvasElement> m_canvasElement;
     Member<CanvasDrawListener> m_drawListener;

diff --git a/third_party/WebKit/Source/modules/mediarecorder/BlobEvent.cpp b/third_party/WebKit/Source/modules/mediarecorder/BlobEvent.cpp
index ba579bb..c5363d0 100644
--- a/third_party/WebKit/Source/modules/mediarecorder/BlobEvent.cpp
+++ b/third_party/WebKit/Source/modules/mediarecorder/BlobEvent.cpp

@@ -10,19 +10,19 @@
 namespace blink {
 
 // static
-RawPtr<BlobEvent> BlobEvent::create()
+BlobEvent* BlobEvent::create()
 {
     return new BlobEvent;
 }
 
 // static
-RawPtr<BlobEvent> BlobEvent::create(const AtomicString& type, const BlobEventInit& initializer)
+BlobEvent* BlobEvent::create(const AtomicString& type, const BlobEventInit& initializer)
 {
     return new BlobEvent(type, initializer);
 }
 
 // static
-RawPtr<BlobEvent> BlobEvent::create(const AtomicString& type, Blob* blob)
+BlobEvent* BlobEvent::create(const AtomicString& type, Blob* blob)
 {
     return new BlobEvent(type, blob);
 }

diff --git a/third_party/WebKit/Source/modules/mediarecorder/BlobEvent.h b/third_party/WebKit/Source/modules/mediarecorder/BlobEvent.h
index a436fbfa9..be00c34 100644
--- a/third_party/WebKit/Source/modules/mediarecorder/BlobEvent.h
+++ b/third_party/WebKit/Source/modules/mediarecorder/BlobEvent.h

@@ -20,9 +20,9 @@
 public:
     ~BlobEvent() override {}
 
-    static RawPtr<BlobEvent> create();
-    static RawPtr<BlobEvent> create(const AtomicString& type, const BlobEventInit& initializer);
-    static RawPtr<BlobEvent> create(const AtomicString& type, Blob*);
+    static BlobEvent* create();
+    static BlobEvent* create(const AtomicString& type, const BlobEventInit& initializer);
+    static BlobEvent* create(const AtomicString& type, Blob*);
 
     Blob* data() const { return m_blob.get(); }
 

diff --git a/third_party/WebKit/Source/modules/mediarecorder/MediaRecorder.cpp b/third_party/WebKit/Source/modules/mediarecorder/MediaRecorder.cpp
index ce48adf..3e85d8d 100644
--- a/third_party/WebKit/Source/modules/mediarecorder/MediaRecorder.cpp
+++ b/third_party/WebKit/Source/modules/mediarecorder/MediaRecorder.cpp

@@ -240,7 +240,7 @@
 
 bool MediaRecorder::isTypeSupported(const String& type)
 {
-    RawPtr<WebMediaRecorderHandler> handler = Platform::current()->createMediaRecorderHandler();
+    WebMediaRecorderHandler* handler = Platform::current()->createMediaRecorderHandler();
     if (!handler)
         return false;
 
@@ -332,7 +332,7 @@
     scheduleDispatchEvent(Event::create(EventTypeNames::stop));
 }
 
-void MediaRecorder::scheduleDispatchEvent(RawPtr<Event> event)
+void MediaRecorder::scheduleDispatchEvent(Event* event)
 {
     m_scheduledEvents.append(event);
 

diff --git a/third_party/WebKit/Source/modules/mediarecorder/MediaRecorder.h b/third_party/WebKit/Source/modules/mediarecorder/MediaRecorder.h
index 77db8c92..71782c9 100644
--- a/third_party/WebKit/Source/modules/mediarecorder/MediaRecorder.h
+++ b/third_party/WebKit/Source/modules/mediarecorder/MediaRecorder.h

@@ -90,7 +90,7 @@
     void createBlobEvent(Blob*);
 
     void stopRecording();
-    void scheduleDispatchEvent(RawPtr<Event>);
+    void scheduleDispatchEvent(Event*);
     void dispatchScheduledEvent();
 
     Member<MediaStream> m_stream;

diff --git a/third_party/WebKit/Source/modules/mediasource/MediaSource.cpp b/third_party/WebKit/Source/modules/mediasource/MediaSource.cpp
index b440b95..06dee75 100644
--- a/third_party/WebKit/Source/modules/mediasource/MediaSource.cpp
+++ b/third_party/WebKit/Source/modules/mediasource/MediaSource.cpp

@@ -611,10 +611,10 @@
 {
     ASSERT(m_asyncEventQueue);
 
-    RawPtr<Event> event = Event::create(eventName);
+    Event* event = Event::create(eventName);
     event->setTarget(this);
 
-    m_asyncEventQueue->enqueueEvent(event.release());
+    m_asyncEventQueue->enqueueEvent(event);
 }
 
 URLRegistry& MediaSource::registry() const

diff --git a/third_party/WebKit/Source/modules/mediasource/SourceBuffer.cpp b/third_party/WebKit/Source/modules/mediasource/SourceBuffer.cpp
index 10285d6b..f9f5201 100644
--- a/third_party/WebKit/Source/modules/mediasource/SourceBuffer.cpp
+++ b/third_party/WebKit/Source/modules/mediasource/SourceBuffer.cpp

@@ -622,10 +622,10 @@
 {
     ASSERT(m_asyncEventQueue);
 
-    RawPtr<Event> event = Event::create(eventName);
+    Event* event = Event::create(eventName);
     event->setTarget(this);
 
-    m_asyncEventQueue->enqueueEvent(event.release());
+    m_asyncEventQueue->enqueueEvent(event);
 }
 
 bool SourceBuffer::prepareAppend(size_t newDataSize, ExceptionState& exceptionState)

diff --git a/third_party/WebKit/Source/modules/mediasource/SourceBufferList.cpp b/third_party/WebKit/Source/modules/mediasource/SourceBufferList.cpp
index c355f75..b1bb175 100644
--- a/third_party/WebKit/Source/modules/mediasource/SourceBufferList.cpp
+++ b/third_party/WebKit/Source/modules/mediasource/SourceBufferList.cpp

@@ -81,10 +81,10 @@
 {
     ASSERT(m_asyncEventQueue);
 
-    RawPtr<Event> event = Event::create(eventName);
+    Event* event = Event::create(eventName);
     event->setTarget(this);
 
-    m_asyncEventQueue->enqueueEvent(event.release());
+    m_asyncEventQueue->enqueueEvent(event);
 }
 
 const AtomicString& SourceBufferList::interfaceName() const

diff --git a/third_party/WebKit/Source/modules/mediastream/MediaStream.cpp b/third_party/WebKit/Source/modules/mediastream/MediaStream.cpp
index 8fa874c..1f8b443 100644
--- a/third_party/WebKit/Source/modules/mediastream/MediaStream.cpp
+++ b/third_party/WebKit/Source/modules/mediastream/MediaStream.cpp

@@ -382,7 +382,7 @@
     }
 }
 
-void MediaStream::scheduleDispatchEvent(RawPtr<Event> event)
+void MediaStream::scheduleDispatchEvent(Event* event)
 {
     m_scheduledEvents.append(event);
 

diff --git a/third_party/WebKit/Source/modules/mediastream/MediaStream.h b/third_party/WebKit/Source/modules/mediastream/MediaStream.h
index d0a5e28e..f004425 100644
--- a/third_party/WebKit/Source/modules/mediastream/MediaStream.h
+++ b/third_party/WebKit/Source/modules/mediastream/MediaStream.h

@@ -101,7 +101,7 @@
 
     bool emptyOrOnlyEndedTracks();
 
-    void scheduleDispatchEvent(RawPtr<Event>);
+    void scheduleDispatchEvent(Event*);
     void scheduledEventTimerFired(Timer<MediaStream>*);
 
     bool m_stopped;

diff --git a/third_party/WebKit/Source/modules/mediastream/MediaStreamEvent.cpp b/third_party/WebKit/Source/modules/mediastream/MediaStreamEvent.cpp
index 76734ee..59a6987 100644
--- a/third_party/WebKit/Source/modules/mediastream/MediaStreamEvent.cpp
+++ b/third_party/WebKit/Source/modules/mediastream/MediaStreamEvent.cpp

@@ -26,17 +26,17 @@
 
 namespace blink {
 
-RawPtr<MediaStreamEvent> MediaStreamEvent::create()
+MediaStreamEvent* MediaStreamEvent::create()
 {
     return new MediaStreamEvent;
 }
 
-RawPtr<MediaStreamEvent> MediaStreamEvent::create(const AtomicString& type, bool canBubble, bool cancelable, MediaStream* stream)
+MediaStreamEvent* MediaStreamEvent::create(const AtomicString& type, bool canBubble, bool cancelable, MediaStream* stream)
 {
     return new MediaStreamEvent(type, canBubble, cancelable, stream);
 }
 
-RawPtr<MediaStreamEvent> MediaStreamEvent::create(const AtomicString& type, const MediaStreamEventInit& initializer)
+MediaStreamEvent* MediaStreamEvent::create(const AtomicString& type, const MediaStreamEventInit& initializer)
 {
     return new MediaStreamEvent(type, initializer);
 }

diff --git a/third_party/WebKit/Source/modules/mediastream/MediaStreamEvent.h b/third_party/WebKit/Source/modules/mediastream/MediaStreamEvent.h
index 9ed8793..e65a5ef7 100644
--- a/third_party/WebKit/Source/modules/mediastream/MediaStreamEvent.h
+++ b/third_party/WebKit/Source/modules/mediastream/MediaStreamEvent.h

@@ -37,9 +37,9 @@
 public:
     ~MediaStreamEvent() override;
 
-    static RawPtr<MediaStreamEvent> create();
-    static RawPtr<MediaStreamEvent> create(const AtomicString& type, bool canBubble, bool cancelable, MediaStream*);
-    static RawPtr<MediaStreamEvent> create(const AtomicString& type, const MediaStreamEventInit& initializer);
+    static MediaStreamEvent* create();
+    static MediaStreamEvent* create(const AtomicString& type, bool canBubble, bool cancelable, MediaStream*);
+    static MediaStreamEvent* create(const AtomicString& type, const MediaStreamEventInit& initializer);
 
     MediaStream* stream() const;
     MediaStream* stream(bool&) const;

diff --git a/third_party/WebKit/Source/modules/mediastream/MediaStreamTrackEvent.cpp b/third_party/WebKit/Source/modules/mediastream/MediaStreamTrackEvent.cpp
index bece9844..80d4094 100644
--- a/third_party/WebKit/Source/modules/mediastream/MediaStreamTrackEvent.cpp
+++ b/third_party/WebKit/Source/modules/mediastream/MediaStreamTrackEvent.cpp

@@ -28,12 +28,12 @@
 
 namespace blink {
 
-RawPtr<MediaStreamTrackEvent> MediaStreamTrackEvent::create()
+MediaStreamTrackEvent* MediaStreamTrackEvent::create()
 {
     return new MediaStreamTrackEvent;
 }
 
-RawPtr<MediaStreamTrackEvent> MediaStreamTrackEvent::create(const AtomicString& type, bool canBubble, bool cancelable, MediaStreamTrack* track)
+MediaStreamTrackEvent* MediaStreamTrackEvent::create(const AtomicString& type, bool canBubble, bool cancelable, MediaStreamTrack* track)
 {
     return new MediaStreamTrackEvent(type, canBubble, cancelable, track);
 }

diff --git a/third_party/WebKit/Source/modules/mediastream/MediaStreamTrackEvent.h b/third_party/WebKit/Source/modules/mediastream/MediaStreamTrackEvent.h
index e064cd75..5913012 100644
--- a/third_party/WebKit/Source/modules/mediastream/MediaStreamTrackEvent.h
+++ b/third_party/WebKit/Source/modules/mediastream/MediaStreamTrackEvent.h

@@ -37,8 +37,8 @@
 public:
     ~MediaStreamTrackEvent() override;
 
-    static RawPtr<MediaStreamTrackEvent> create();
-    static RawPtr<MediaStreamTrackEvent> create(const AtomicString& type, bool canBubble, bool cancelable, MediaStreamTrack*);
+    static MediaStreamTrackEvent* create();
+    static MediaStreamTrackEvent* create(const AtomicString& type, bool canBubble, bool cancelable, MediaStreamTrack*);
 
     MediaStreamTrack* track() const;
 

diff --git a/third_party/WebKit/Source/modules/mediastream/RTCCertificate.cpp b/third_party/WebKit/Source/modules/mediastream/RTCCertificate.cpp
index 15269c1..96ecb6c 100644
--- a/third_party/WebKit/Source/modules/mediastream/RTCCertificate.cpp
+++ b/third_party/WebKit/Source/modules/mediastream/RTCCertificate.cpp

@@ -32,12 +32,12 @@
 
 namespace blink {
 
-RTCCertificate::RTCCertificate(WebPassOwnPtr<WebRTCCertificate> certificate)
-    : m_certificate(certificate.release())
+RTCCertificate::RTCCertificate(std::unique_ptr<WebRTCCertificate> certificate)
+    : m_certificate(adoptPtr(certificate.release()))
 {
 }
 
-WebPassOwnPtr<WebRTCCertificate> RTCCertificate::certificateShallowCopy() const
+std::unique_ptr<WebRTCCertificate> RTCCertificate::certificateShallowCopy() const
 {
     return m_certificate->shallowCopy();
 }

diff --git a/third_party/WebKit/Source/modules/mediastream/RTCCertificate.h b/third_party/WebKit/Source/modules/mediastream/RTCCertificate.h
index d98bba0..2cfd63a 100644
--- a/third_party/WebKit/Source/modules/mediastream/RTCCertificate.h
+++ b/third_party/WebKit/Source/modules/mediastream/RTCCertificate.h

@@ -34,20 +34,21 @@
 #include "bindings/core/v8/ScriptWrappable.h"
 #include "core/dom/DOMTimeStamp.h"
 #include "platform/heap/GarbageCollected.h"
-#include "public/platform/WebPassOwnPtr.h"
 #include "public/platform/WebRTCCertificate.h"
 #include "wtf/OwnPtr.h"
 
+#include <memory>
+
 namespace blink {
 
 class RTCCertificate final : public GarbageCollectedFinalized<RTCCertificate>, public ScriptWrappable {
     DEFINE_WRAPPERTYPEINFO();
 public:
     // Takes ownership of the certificate.
-    RTCCertificate(WebPassOwnPtr<WebRTCCertificate>);
+    RTCCertificate(std::unique_ptr<WebRTCCertificate>);
 
     // Returns a new WebRTCCertificate shallow copy.
-    WebPassOwnPtr<WebRTCCertificate> certificateShallowCopy() const;
+    std::unique_ptr<WebRTCCertificate> certificateShallowCopy() const;
 
     DEFINE_INLINE_TRACE() {}
 

diff --git a/third_party/WebKit/Source/modules/mediastream/RTCDTMFSender.cpp b/third_party/WebKit/Source/modules/mediastream/RTCDTMFSender.cpp
index b370276..1e591a6 100644
--- a/third_party/WebKit/Source/modules/mediastream/RTCDTMFSender.cpp
+++ b/third_party/WebKit/Source/modules/mediastream/RTCDTMFSender.cpp

@@ -142,7 +142,7 @@
     m_handler->setClient(0);
 }
 
-void RTCDTMFSender::scheduleDispatchEvent(RawPtr<Event> event)
+void RTCDTMFSender::scheduleDispatchEvent(Event* event)
 {
     m_scheduledEvents.append(event);
 

diff --git a/third_party/WebKit/Source/modules/mediastream/RTCDTMFSender.h b/third_party/WebKit/Source/modules/mediastream/RTCDTMFSender.h
index 70ea964..5f71e3f 100644
--- a/third_party/WebKit/Source/modules/mediastream/RTCDTMFSender.h
+++ b/third_party/WebKit/Source/modules/mediastream/RTCDTMFSender.h

@@ -75,7 +75,7 @@
 private:
     RTCDTMFSender(ExecutionContext*, MediaStreamTrack*, PassOwnPtr<WebRTCDTMFSenderHandler>);
 
-    void scheduleDispatchEvent(RawPtr<Event>);
+    void scheduleDispatchEvent(Event*);
     void scheduledEventTimerFired(Timer<RTCDTMFSender>*);
 
     // WebRTCDTMFSenderHandlerClient

diff --git a/third_party/WebKit/Source/modules/mediastream/RTCDTMFToneChangeEvent.cpp b/third_party/WebKit/Source/modules/mediastream/RTCDTMFToneChangeEvent.cpp
index f545977c..d2fd38cc 100644
--- a/third_party/WebKit/Source/modules/mediastream/RTCDTMFToneChangeEvent.cpp
+++ b/third_party/WebKit/Source/modules/mediastream/RTCDTMFToneChangeEvent.cpp

@@ -27,17 +27,17 @@
 
 namespace blink {
 
-RawPtr<RTCDTMFToneChangeEvent> RTCDTMFToneChangeEvent::create()
+RTCDTMFToneChangeEvent* RTCDTMFToneChangeEvent::create()
 {
     return new RTCDTMFToneChangeEvent;
 }
 
-RawPtr<RTCDTMFToneChangeEvent> RTCDTMFToneChangeEvent::create(const String& tone)
+RTCDTMFToneChangeEvent* RTCDTMFToneChangeEvent::create(const String& tone)
 {
     return new RTCDTMFToneChangeEvent(tone);
 }
 
-RawPtr<RTCDTMFToneChangeEvent> RTCDTMFToneChangeEvent::create(const AtomicString& type, const RTCDTMFToneChangeEventInit& initializer)
+RTCDTMFToneChangeEvent* RTCDTMFToneChangeEvent::create(const AtomicString& type, const RTCDTMFToneChangeEventInit& initializer)
 {
     ASSERT(type == EventTypeNames::tonechange);
     return new RTCDTMFToneChangeEvent(initializer);

diff --git a/third_party/WebKit/Source/modules/mediastream/RTCDTMFToneChangeEvent.h b/third_party/WebKit/Source/modules/mediastream/RTCDTMFToneChangeEvent.h
index 1766189..15c09e9 100644
--- a/third_party/WebKit/Source/modules/mediastream/RTCDTMFToneChangeEvent.h
+++ b/third_party/WebKit/Source/modules/mediastream/RTCDTMFToneChangeEvent.h

@@ -37,9 +37,9 @@
 public:
     ~RTCDTMFToneChangeEvent() override;
 
-    static RawPtr<RTCDTMFToneChangeEvent> create();
-    static RawPtr<RTCDTMFToneChangeEvent> create(const String& tone);
-    static RawPtr<RTCDTMFToneChangeEvent> create(const AtomicString& type, const RTCDTMFToneChangeEventInit& initializer);
+    static RTCDTMFToneChangeEvent* create();
+    static RTCDTMFToneChangeEvent* create(const String& tone);
+    static RTCDTMFToneChangeEvent* create(const AtomicString& type, const RTCDTMFToneChangeEventInit& initializer);
 
     const String& tone() const;
 

diff --git a/third_party/WebKit/Source/modules/mediastream/RTCDataChannel.cpp b/third_party/WebKit/Source/modules/mediastream/RTCDataChannel.cpp
index 009342e..905b242 100644
--- a/third_party/WebKit/Source/modules/mediastream/RTCDataChannel.cpp
+++ b/third_party/WebKit/Source/modules/mediastream/RTCDataChannel.cpp

@@ -294,7 +294,7 @@
     return m_executionContext;
 }
 
-void RTCDataChannel::scheduleDispatchEvent(RawPtr<Event> event)
+void RTCDataChannel::scheduleDispatchEvent(Event* event)
 {
     m_scheduledEvents.append(event);
 

diff --git a/third_party/WebKit/Source/modules/mediastream/RTCDataChannel.h b/third_party/WebKit/Source/modules/mediastream/RTCDataChannel.h
index 192fdccac..cd808414 100644
--- a/third_party/WebKit/Source/modules/mediastream/RTCDataChannel.h
+++ b/third_party/WebKit/Source/modules/mediastream/RTCDataChannel.h

@@ -107,7 +107,7 @@
 private:
     RTCDataChannel(ExecutionContext*, PassOwnPtr<WebRTCDataChannelHandler>);
 
-    void scheduleDispatchEvent(RawPtr<Event>);
+    void scheduleDispatchEvent(Event*);
     void scheduledEventTimerFired(Timer<RTCDataChannel>*);
 
     Member<ExecutionContext> m_executionContext;

diff --git a/third_party/WebKit/Source/modules/mediastream/RTCDataChannelEvent.cpp b/third_party/WebKit/Source/modules/mediastream/RTCDataChannelEvent.cpp
index 8552758..3824528 100644
--- a/third_party/WebKit/Source/modules/mediastream/RTCDataChannelEvent.cpp
+++ b/third_party/WebKit/Source/modules/mediastream/RTCDataChannelEvent.cpp

@@ -26,12 +26,12 @@
 
 namespace blink {
 
-RawPtr<RTCDataChannelEvent> RTCDataChannelEvent::create()
+RTCDataChannelEvent* RTCDataChannelEvent::create()
 {
     return new RTCDataChannelEvent;
 }
 
-RawPtr<RTCDataChannelEvent> RTCDataChannelEvent::create(const AtomicString& type, bool canBubble, bool cancelable, RTCDataChannel* channel)
+RTCDataChannelEvent* RTCDataChannelEvent::create(const AtomicString& type, bool canBubble, bool cancelable, RTCDataChannel* channel)
 {
     return new RTCDataChannelEvent(type, canBubble, cancelable, channel);
 }

diff --git a/third_party/WebKit/Source/modules/mediastream/RTCDataChannelEvent.h b/third_party/WebKit/Source/modules/mediastream/RTCDataChannelEvent.h
index 3f6f8a1f..ff9eb2b 100644
--- a/third_party/WebKit/Source/modules/mediastream/RTCDataChannelEvent.h
+++ b/third_party/WebKit/Source/modules/mediastream/RTCDataChannelEvent.h

@@ -36,8 +36,8 @@
 public:
     ~RTCDataChannelEvent() override;
 
-    static RawPtr<RTCDataChannelEvent> create();
-    static RawPtr<RTCDataChannelEvent> create(const AtomicString& type, bool canBubble, bool cancelable, RTCDataChannel*);
+    static RTCDataChannelEvent* create();
+    static RTCDataChannelEvent* create(const AtomicString& type, bool canBubble, bool cancelable, RTCDataChannel*);
 
     RTCDataChannel* channel() const;
 

diff --git a/third_party/WebKit/Source/modules/mediastream/RTCIceCandidateEvent.cpp b/third_party/WebKit/Source/modules/mediastream/RTCIceCandidateEvent.cpp
index f5b12c53..0a801a8 100644
--- a/third_party/WebKit/Source/modules/mediastream/RTCIceCandidateEvent.cpp
+++ b/third_party/WebKit/Source/modules/mediastream/RTCIceCandidateEvent.cpp

@@ -28,12 +28,12 @@
 
 namespace blink {
 
-RawPtr<RTCIceCandidateEvent> RTCIceCandidateEvent::create()
+RTCIceCandidateEvent* RTCIceCandidateEvent::create()
 {
     return new RTCIceCandidateEvent;
 }
 
-RawPtr<RTCIceCandidateEvent> RTCIceCandidateEvent::create(bool canBubble, bool cancelable, RTCIceCandidate* candidate)
+RTCIceCandidateEvent* RTCIceCandidateEvent::create(bool canBubble, bool cancelable, RTCIceCandidate* candidate)
 {
     return new RTCIceCandidateEvent(canBubble, cancelable, candidate);
 }

diff --git a/third_party/WebKit/Source/modules/mediastream/RTCIceCandidateEvent.h b/third_party/WebKit/Source/modules/mediastream/RTCIceCandidateEvent.h
index fc82b39..c201ed7 100644
--- a/third_party/WebKit/Source/modules/mediastream/RTCIceCandidateEvent.h
+++ b/third_party/WebKit/Source/modules/mediastream/RTCIceCandidateEvent.h

@@ -36,8 +36,8 @@
 public:
     ~RTCIceCandidateEvent() override;
 
-    static RawPtr<RTCIceCandidateEvent> create();
-    static RawPtr<RTCIceCandidateEvent> create(bool canBubble, bool cancelable, RTCIceCandidate*);
+    static RTCIceCandidateEvent* create();
+    static RTCIceCandidateEvent* create(bool canBubble, bool cancelable, RTCIceCandidate*);
 
     RTCIceCandidate* candidate() const;
 

diff --git a/third_party/WebKit/Source/modules/mediastream/RTCPeerConnection.cpp b/third_party/WebKit/Source/modules/mediastream/RTCPeerConnection.cpp
index 0f0fa01..ace817ff 100644
--- a/third_party/WebKit/Source/modules/mediastream/RTCPeerConnection.cpp
+++ b/third_party/WebKit/Source/modules/mediastream/RTCPeerConnection.cpp

@@ -88,6 +88,8 @@
 #include "public/platform/WebRTCStatsRequest.h"
 #include "public/platform/WebRTCVoidRequest.h"
 
+#include <memory>
+
 namespace blink {
 
 namespace {
@@ -169,15 +171,13 @@
 
     ~WebRTCCertificateObserver() override {}
 
-    DEFINE_INLINE_TRACE() { visitor->trace(m_resolver); }
-
 private:
     WebRTCCertificateObserver(ScriptPromiseResolver* resolver)
         : m_resolver(resolver) {}
 
-    void onSuccess(WebPassOwnPtr<WebRTCCertificate> certificate) override
+    void onSuccess(std::unique_ptr<WebRTCCertificate> certificate) override
     {
-        m_resolver->resolve(new RTCCertificate(certificate));
+        m_resolver->resolve(new RTCCertificate(std::move(certificate)));
     }
 
     void onError() override
@@ -356,7 +356,7 @@
 } // namespace
 
 RTCPeerConnection::EventWrapper::EventWrapper(
-    RawPtr<Event> event,
+    Event* event,
     PassOwnPtr<BoolFunction> function)
     : m_event(event)
     , m_setupFunction(function)
@@ -705,7 +705,7 @@
     ScriptPromiseResolver* resolver = ScriptPromiseResolver::create(scriptState);
     ScriptPromise promise = resolver->promise();
 
-    WebPassOwnPtr<WebRTCCertificateObserver> certificateObserver = adoptWebPtr(WebRTCCertificateObserver::create(resolver));
+    std::unique_ptr<WebRTCCertificateObserver> certificateObserver(WebRTCCertificateObserver::create(resolver));
 
     // Generate certificate. The |certificateObserver| will resolve the promise asynchronously upon completion.
     // The observer will manage its own destruction as well as the resolver's destruction.
@@ -713,7 +713,7 @@
         keyParams.get(),
         toDocument(scriptState->getExecutionContext())->url(),
         toDocument(scriptState->getExecutionContext())->firstPartyForCookies(),
-        certificateObserver);
+        std::move(certificateObserver));
 
     return promise;
 }
@@ -1131,12 +1131,12 @@
     changeSignalingState(SignalingStateClosed);
 }
 
-void RTCPeerConnection::scheduleDispatchEvent(RawPtr<Event> event)
+void RTCPeerConnection::scheduleDispatchEvent(Event* event)
 {
     scheduleDispatchEvent(event, nullptr);
 }
 
-void RTCPeerConnection::scheduleDispatchEvent(RawPtr<Event> event,
+void RTCPeerConnection::scheduleDispatchEvent(Event* event,
     PassOwnPtr<BoolFunction> setupFunction)
 {
     m_scheduledEvents.append(new EventWrapper(event, setupFunction));

diff --git a/third_party/WebKit/Source/modules/mediastream/RTCPeerConnection.h b/third_party/WebKit/Source/modules/mediastream/RTCPeerConnection.h
index 82394b10..a666076 100644
--- a/third_party/WebKit/Source/modules/mediastream/RTCPeerConnection.h
+++ b/third_party/WebKit/Source/modules/mediastream/RTCPeerConnection.h

@@ -169,7 +169,7 @@
     typedef Function<bool()> BoolFunction;
     class EventWrapper : public GarbageCollectedFinalized<EventWrapper> {
     public:
-        EventWrapper(RawPtr<Event>, PassOwnPtr<BoolFunction>);
+        EventWrapper(Event*, PassOwnPtr<BoolFunction>);
         // Returns true if |m_setupFunction| returns true or it is null.
         // |m_event| will only be fired if setup() returns true;
         bool setup();
@@ -184,8 +184,8 @@
 
     RTCPeerConnection(ExecutionContext*, RTCConfiguration*, WebMediaConstraints, ExceptionState&);
 
-    void scheduleDispatchEvent(RawPtr<Event>);
-    void scheduleDispatchEvent(RawPtr<Event>, PassOwnPtr<BoolFunction>);
+    void scheduleDispatchEvent(Event*);
+    void scheduleDispatchEvent(Event*, PassOwnPtr<BoolFunction>);
     void dispatchScheduledEvent();
     bool hasLocalStreamWithTrackId(const String& trackId);
 

diff --git a/third_party/WebKit/Source/modules/mediastream/UserMediaController.cpp b/third_party/WebKit/Source/modules/mediastream/UserMediaController.cpp
index 148e60bc..b996523 100644
--- a/third_party/WebKit/Source/modules/mediastream/UserMediaController.cpp
+++ b/third_party/WebKit/Source/modules/mediastream/UserMediaController.cpp

@@ -41,7 +41,7 @@
     Supplement<LocalFrame>::trace(visitor);
 }
 
-RawPtr<UserMediaController> UserMediaController::create(UserMediaClient* client)
+UserMediaController* UserMediaController::create(UserMediaClient* client)
 {
     return new UserMediaController(client);
 }

diff --git a/third_party/WebKit/Source/modules/mediastream/UserMediaController.h b/third_party/WebKit/Source/modules/mediastream/UserMediaController.h
index 8ea96cda..36b0e84 100644
--- a/third_party/WebKit/Source/modules/mediastream/UserMediaController.h
+++ b/third_party/WebKit/Source/modules/mediastream/UserMediaController.h

@@ -37,7 +37,7 @@
 class UserMediaController final : public GarbageCollected<UserMediaController>, public Supplement<LocalFrame> {
     USING_GARBAGE_COLLECTED_MIXIN(UserMediaController);
 public:
-    static RawPtr<UserMediaController> create(UserMediaClient*);
+    static UserMediaController* create(UserMediaClient*);
 
     DECLARE_VIRTUAL_TRACE();
 

diff --git a/third_party/WebKit/Source/modules/mediastream/UserMediaRequest.cpp b/third_party/WebKit/Source/modules/mediastream/UserMediaRequest.cpp
index fdf866c..f2947fa 100644
--- a/third_party/WebKit/Source/modules/mediastream/UserMediaRequest.cpp
+++ b/third_party/WebKit/Source/modules/mediastream/UserMediaRequest.cpp

@@ -163,7 +163,7 @@
     if (!getExecutionContext())
         return;
 
-    RawPtr<MediaStream> stream = MediaStream::create(getExecutionContext(), streamDescriptor);
+    MediaStream* stream = MediaStream::create(getExecutionContext(), streamDescriptor);
 
     MediaStreamTrackVector audioTracks = stream->getAudioTracks();
     for (MediaStreamTrackVector::iterator iter = audioTracks.begin(); iter != audioTracks.end(); ++iter) {
@@ -175,7 +175,7 @@
         (*iter)->component()->source()->setConstraints(m_video);
     }
 
-    m_successCallback->handleEvent(stream.get());
+    m_successCallback->handleEvent(stream);
 }
 
 void UserMediaRequest::failPermissionDenied(const String& message)

diff --git a/third_party/WebKit/Source/modules/navigatorcontentutils/NavigatorContentUtils.cpp b/third_party/WebKit/Source/modules/navigatorcontentutils/NavigatorContentUtils.cpp
index 67e8720..d6e0cd0 100644
--- a/third_party/WebKit/Source/modules/navigatorcontentutils/NavigatorContentUtils.cpp
+++ b/third_party/WebKit/Source/modules/navigatorcontentutils/NavigatorContentUtils.cpp

@@ -145,7 +145,7 @@
 {
 }
 
-RawPtr<NavigatorContentUtils> NavigatorContentUtils::create(RawPtr<NavigatorContentUtilsClient> client)
+NavigatorContentUtils* NavigatorContentUtils::create(NavigatorContentUtilsClient* client)
 {
     return new NavigatorContentUtils(client);
 }
@@ -229,7 +229,7 @@
     return "NavigatorContentUtils";
 }
 
-void provideNavigatorContentUtilsTo(LocalFrame& frame, RawPtr<NavigatorContentUtilsClient> client)
+void provideNavigatorContentUtilsTo(LocalFrame& frame, NavigatorContentUtilsClient* client)
 {
     NavigatorContentUtils::provideTo(frame, NavigatorContentUtils::supplementName(), NavigatorContentUtils::create(client));
 }

diff --git a/third_party/WebKit/Source/modules/navigatorcontentutils/NavigatorContentUtils.h b/third_party/WebKit/Source/modules/navigatorcontentutils/NavigatorContentUtils.h
index 958ac28..2708fb3 100644
--- a/third_party/WebKit/Source/modules/navigatorcontentutils/NavigatorContentUtils.h
+++ b/third_party/WebKit/Source/modules/navigatorcontentutils/NavigatorContentUtils.h

@@ -52,7 +52,7 @@
     static String isProtocolHandlerRegistered(Navigator&, const String& scheme, const String& url, ExceptionState&);
     static void unregisterProtocolHandler(Navigator&, const String& scheme, const String& url, ExceptionState&);
 
-    static RawPtr<NavigatorContentUtils> create(RawPtr<NavigatorContentUtilsClient>);
+    static NavigatorContentUtils* create(NavigatorContentUtilsClient*);
 
     DEFINE_INLINE_VIRTUAL_TRACE()
     {
@@ -60,10 +60,10 @@
         Supplement<LocalFrame>::trace(visitor);
     }
 
-    void setClientForTest(RawPtr<NavigatorContentUtilsClient> client) { m_client = client; }
+    void setClientForTest(NavigatorContentUtilsClient* client) { m_client = client; }
 
 private:
-    explicit NavigatorContentUtils(RawPtr<NavigatorContentUtilsClient> client)
+    explicit NavigatorContentUtils(NavigatorContentUtilsClient* client)
         : m_client(client)
     {
     }

diff --git a/third_party/WebKit/Source/modules/navigatorcontentutils/NavigatorContentUtilsClient.h b/third_party/WebKit/Source/modules/navigatorcontentutils/NavigatorContentUtilsClient.h
index d0ce0cde..d9664e2 100644
--- a/third_party/WebKit/Source/modules/navigatorcontentutils/NavigatorContentUtilsClient.h
+++ b/third_party/WebKit/Source/modules/navigatorcontentutils/NavigatorContentUtilsClient.h

@@ -53,7 +53,7 @@
     DEFINE_INLINE_VIRTUAL_TRACE() { }
 };
 
-MODULES_EXPORT void provideNavigatorContentUtilsTo(LocalFrame&, RawPtr<NavigatorContentUtilsClient>);
+MODULES_EXPORT void provideNavigatorContentUtilsTo(LocalFrame&, NavigatorContentUtilsClient*);
 
 } // namespace blink
 

diff --git a/third_party/WebKit/Source/modules/navigatorcontentutils/testing/NavigatorContentUtilsClientMock.h b/third_party/WebKit/Source/modules/navigatorcontentutils/testing/NavigatorContentUtilsClientMock.h
index 46532eb3..a86cd5c 100644
--- a/third_party/WebKit/Source/modules/navigatorcontentutils/testing/NavigatorContentUtilsClientMock.h
+++ b/third_party/WebKit/Source/modules/navigatorcontentutils/testing/NavigatorContentUtilsClientMock.h

@@ -17,7 +17,7 @@
 // Provides a mock object for the navigatorcontentutils client.
 class NavigatorContentUtilsClientMock final : public NavigatorContentUtilsClient {
 public:
-    static RawPtr<NavigatorContentUtilsClientMock> create()
+    static NavigatorContentUtilsClientMock* create()
     {
         return new NavigatorContentUtilsClientMock;
     }

diff --git a/third_party/WebKit/Source/modules/notifications/Notification.cpp b/third_party/WebKit/Source/modules/notifications/Notification.cpp
index bd780fb..ca0f8ca9 100644
--- a/third_party/WebKit/Source/modules/notifications/Notification.cpp
+++ b/third_party/WebKit/Source/modules/notifications/Notification.cpp

@@ -302,9 +302,20 @@
     actions.grow(m_data.actions.size());
 
     for (size_t i = 0; i < m_data.actions.size(); ++i) {
+        switch (m_data.actions[i].type) {
+        case WebNotificationAction::Button:
+            actions[i].setType("button");
+            break;
+        case WebNotificationAction::Text:
+            actions[i].setType("text");
+            break;
+        default:
+            NOTREACHED() << "Unknown action type: " << m_data.actions[i].type;
+        }
         actions[i].setAction(m_data.actions[i].action);
         actions[i].setTitle(m_data.actions[i].title);
         actions[i].setIcon(m_data.actions[i].icon.string());
+        actions[i].setPlaceholder(m_data.actions[i].placeholder);
     }
 
     return actions;

diff --git a/third_party/WebKit/Source/modules/notifications/NotificationAction.idl b/third_party/WebKit/Source/modules/notifications/NotificationAction.idl
index be78856..5de51f9 100644
--- a/third_party/WebKit/Source/modules/notifications/NotificationAction.idl
+++ b/third_party/WebKit/Source/modules/notifications/NotificationAction.idl

@@ -4,8 +4,15 @@
 
 // https://notifications.spec.whatwg.org/#dictdef-notificationaction
 
+[RuntimeEnabled=NotificationInlineReplies] enum NotificationActionType {
+    "button",
+    "text"
+};
+
 dictionary NotificationAction {
+    [RuntimeEnabled=NotificationInlineReplies] NotificationActionType type = "button";
     required DOMString action;
     required DOMString title;
     [RuntimeEnabled=NotificationActionIcons] USVString icon;
+    [RuntimeEnabled=NotificationInlineReplies] DOMString? placeholder = null;
 };

diff --git a/third_party/WebKit/Source/modules/notifications/NotificationData.cpp b/third_party/WebKit/Source/modules/notifications/NotificationData.cpp
index ed67c9e..60a86876 100644
--- a/third_party/WebKit/Source/modules/notifications/NotificationData.cpp
+++ b/third_party/WebKit/Source/modules/notifications/NotificationData.cpp

@@ -93,6 +93,20 @@
         webAction.action = action.action();
         webAction.title = action.title();
 
+        if (action.type() == "button")
+            webAction.type = WebNotificationAction::Button;
+        else if (action.type() == "text")
+            webAction.type = WebNotificationAction::Text;
+        else
+            NOTREACHED() << "Unknown action type: " << action.type();
+
+        if (action.hasPlaceholder() && webAction.type == WebNotificationAction::Button) {
+            exceptionState.throwTypeError("Notifications of type \"button\" cannot specify a placeholder.");
+            return WebNotificationData();
+        }
+
+        webAction.placeholder = action.placeholder();
+
         if (action.hasIcon() && !action.icon().isEmpty())
             webAction.icon = completeURL(executionContext, action.icon());
 

diff --git a/third_party/WebKit/Source/modules/notifications/NotificationDataTest.cpp b/third_party/WebKit/Source/modules/notifications/NotificationDataTest.cpp
index 63b4a34..9f8038d 100644
--- a/third_party/WebKit/Source/modules/notifications/NotificationDataTest.cpp
+++ b/third_party/WebKit/Source/modules/notifications/NotificationDataTest.cpp

@@ -33,9 +33,12 @@
 const bool kNotificationSilent = false;
 const bool kNotificationRequireInteraction = true;
 
+const WebNotificationAction::Type kWebNotificationActionType = WebNotificationAction::Text;
+const char kNotificationActionType[] = "text";
 const char kNotificationActionAction[] = "my_action";
 const char kNotificationActionTitle[] = "My Action";
 const char kNotificationActionIcon[] = "https://example.com/action_icon.png";
+const char kNotificationActionPlaceholder[] = "Placeholder...";
 
 const unsigned kNotificationVibrationUnnormalized[] = { 10, 1000000, 50, 42 };
 const int kNotificationVibrationNormalized[] = { 10, 10000, 50 };
@@ -65,9 +68,11 @@
     HeapVector<NotificationAction> actions;
     for (size_t i = 0; i < Notification::maxActions(); ++i) {
         NotificationAction action;
+        action.setType(kNotificationActionType);
         action.setAction(kNotificationActionAction);
         action.setTitle(kNotificationActionTitle);
         action.setIcon(kNotificationActionIcon);
+        action.setPlaceholder(kNotificationActionPlaceholder);
 
         actions.append(action);
     }
@@ -111,8 +116,10 @@
     EXPECT_EQ(kNotificationRequireInteraction, notificationData.requireInteraction);
     EXPECT_EQ(actions.size(), notificationData.actions.size());
     for (const auto& action : notificationData.actions) {
+        EXPECT_EQ(kWebNotificationActionType, action.type);
         EXPECT_EQ(kNotificationActionAction, action.action);
         EXPECT_EQ(kNotificationActionTitle, action.title);
+        EXPECT_EQ(kNotificationActionPlaceholder, action.placeholder);
     }
 }
 
@@ -136,6 +143,24 @@
     EXPECT_EQ("Silent notifications must not specify vibration patterns.", exceptionState.message());
 }
 
+TEST_F(NotificationDataTest, ActionTypeButtonWithPlaceholder)
+{
+    HeapVector<NotificationAction> actions;
+    NotificationAction action;
+    action.setType("button");
+    action.setPlaceholder("I'm afraid I can't do that...");
+    actions.append(action);
+
+    NotificationOptions options;
+    options.setActions(actions);
+
+    TrackExceptionState exceptionState;
+    WebNotificationData notificationData = createWebNotificationData(getExecutionContext(), kNotificationTitle, options, exceptionState);
+    ASSERT_TRUE(exceptionState.hadException());
+
+    EXPECT_EQ("Notifications of type \"button\" cannot specify a placeholder.", exceptionState.message());
+}
+
 TEST_F(NotificationDataTest, RenotifyWithEmptyTag)
 {
     NotificationOptions options;

diff --git a/third_party/WebKit/Source/modules/notifications/NotificationEvent.h b/third_party/WebKit/Source/modules/notifications/NotificationEvent.h
index d79e7a0b..1d080142 100644
--- a/third_party/WebKit/Source/modules/notifications/NotificationEvent.h
+++ b/third_party/WebKit/Source/modules/notifications/NotificationEvent.h

@@ -18,15 +18,15 @@
 class MODULES_EXPORT NotificationEvent final : public ExtendableEvent {
     DEFINE_WRAPPERTYPEINFO();
 public:
-    static RawPtr<NotificationEvent> create()
+    static NotificationEvent* create()
     {
         return new NotificationEvent;
     }
-    static RawPtr<NotificationEvent> create(const AtomicString& type, const NotificationEventInit& initializer)
+    static NotificationEvent* create(const AtomicString& type, const NotificationEventInit& initializer)
     {
         return new NotificationEvent(type, initializer);
     }
-    static RawPtr<NotificationEvent> create(const AtomicString& type, const NotificationEventInit& initializer, WaitUntilObserver* observer)
+    static NotificationEvent* create(const AtomicString& type, const NotificationEventInit& initializer, WaitUntilObserver* observer)
     {
         return new NotificationEvent(type, initializer, observer);
     }

diff --git a/third_party/WebKit/Source/modules/notifications/NotificationPermissionClient.cpp b/third_party/WebKit/Source/modules/notifications/NotificationPermissionClient.cpp
index e19cc31a..8bc91abc 100644
--- a/third_party/WebKit/Source/modules/notifications/NotificationPermissionClient.cpp
+++ b/third_party/WebKit/Source/modules/notifications/NotificationPermissionClient.cpp

@@ -27,7 +27,7 @@
     return static_cast<NotificationPermissionClient*>(Supplement<LocalFrame>::from(document->frame(), supplementName()));
 }
 
-void provideNotificationPermissionClientTo(LocalFrame& frame, RawPtr<NotificationPermissionClient> client)
+void provideNotificationPermissionClientTo(LocalFrame& frame, NotificationPermissionClient* client)
 {
     frame.provideSupplement(NotificationPermissionClient::supplementName(), client);
 }

diff --git a/third_party/WebKit/Source/modules/notifications/NotificationPermissionClient.h b/third_party/WebKit/Source/modules/notifications/NotificationPermissionClient.h
index f8b49c7..26e2243c 100644
--- a/third_party/WebKit/Source/modules/notifications/NotificationPermissionClient.h
+++ b/third_party/WebKit/Source/modules/notifications/NotificationPermissionClient.h

@@ -30,7 +30,7 @@
     static NotificationPermissionClient* from(ExecutionContext*);
 };
 
-MODULES_EXPORT void provideNotificationPermissionClientTo(LocalFrame&, RawPtr<NotificationPermissionClient>);
+MODULES_EXPORT void provideNotificationPermissionClientTo(LocalFrame&, NotificationPermissionClient*);
 
 } // namespace blink
 

diff --git a/third_party/WebKit/Source/modules/offscreencanvas/OffscreenCanvas.cpp b/third_party/WebKit/Source/modules/offscreencanvas/OffscreenCanvas.cpp
index 71dfbe1..6748172 100644
--- a/third_party/WebKit/Source/modules/offscreencanvas/OffscreenCanvas.cpp
+++ b/third_party/WebKit/Source/modules/offscreencanvas/OffscreenCanvas.cpp

@@ -65,18 +65,18 @@
     return static_cast<OffscreenCanvasRenderingContext2D*>(m_context.get());
 }
 
-RawPtr<ImageBitmap> OffscreenCanvas::transferToImageBitmap(ExceptionState& exceptionState)
+ImageBitmap* OffscreenCanvas::transferToImageBitmap(ExceptionState& exceptionState)
 {
     if (!m_context) {
         exceptionState.throwDOMException(InvalidStateError, "Cannot transfer an ImageBitmap from an OffscreenCanvas with no context");
         return nullptr;
     }
-    RawPtr<ImageBitmap> image = m_context->transferToImageBitmap(exceptionState);
+    ImageBitmap* image = m_context->transferToImageBitmap(exceptionState);
     if (!image) {
         // Undocumented exception (not in spec)
         exceptionState.throwDOMException(V8GeneralError, "Out of memory");
     }
-    return image.release();
+    return image;
 }
 
 OffscreenCanvasRenderingContext2D* OffscreenCanvas::renderingContext() const

diff --git a/third_party/WebKit/Source/modules/offscreencanvas/OffscreenCanvas.h b/third_party/WebKit/Source/modules/offscreencanvas/OffscreenCanvas.h
index a31bcf2a..3b285c6d 100644
--- a/third_party/WebKit/Source/modules/offscreencanvas/OffscreenCanvas.h
+++ b/third_party/WebKit/Source/modules/offscreencanvas/OffscreenCanvas.h

@@ -35,7 +35,7 @@
 
     // API Methods
     OffscreenCanvasRenderingContext2D* getContext(const String&, const CanvasContextCreationAttributes&);
-    RawPtr<ImageBitmap> transferToImageBitmap(ExceptionState&);
+    ImageBitmap* transferToImageBitmap(ExceptionState&);
 
     IntSize size() const { return m_size; }
     OffscreenCanvasRenderingContext2D* renderingContext() const;

diff --git a/third_party/WebKit/Source/modules/offscreencanvas/OffscreenCanvasRenderingContext.h b/third_party/WebKit/Source/modules/offscreencanvas/OffscreenCanvasRenderingContext.h
index 6549936f..0eff273 100644
--- a/third_party/WebKit/Source/modules/offscreencanvas/OffscreenCanvasRenderingContext.h
+++ b/third_party/WebKit/Source/modules/offscreencanvas/OffscreenCanvasRenderingContext.h

@@ -26,7 +26,7 @@
 
     OffscreenCanvas* getOffscreenCanvas() const { return m_offscreenCanvas; }
     virtual ContextType getContextType() const = 0;
-    virtual RawPtr<ImageBitmap> transferToImageBitmap(ExceptionState&) = 0;
+    virtual ImageBitmap* transferToImageBitmap(ExceptionState&) = 0;
 
     virtual bool is2d() const { return false; }
 

diff --git a/third_party/WebKit/Source/modules/offscreencanvas2d/OffscreenCanvasRenderingContext2D.cpp b/third_party/WebKit/Source/modules/offscreencanvas2d/OffscreenCanvasRenderingContext2D.cpp
index 9edb535..d5e85db 100644
--- a/third_party/WebKit/Source/modules/offscreencanvas2d/OffscreenCanvasRenderingContext2D.cpp
+++ b/third_party/WebKit/Source/modules/offscreencanvas2d/OffscreenCanvasRenderingContext2D.cpp

@@ -74,7 +74,7 @@
     return m_imageBuffer.get();
 }
 
-RawPtr<ImageBitmap> OffscreenCanvasRenderingContext2D::transferToImageBitmap(ExceptionState& exceptionState)
+ImageBitmap* OffscreenCanvasRenderingContext2D::transferToImageBitmap(ExceptionState& exceptionState)
 {
     if (!imageBuffer())
         return nullptr;

diff --git a/third_party/WebKit/Source/modules/offscreencanvas2d/OffscreenCanvasRenderingContext2D.h b/third_party/WebKit/Source/modules/offscreencanvas2d/OffscreenCanvasRenderingContext2D.h
index 2002850d..1a010d15 100644
--- a/third_party/WebKit/Source/modules/offscreencanvas2d/OffscreenCanvasRenderingContext2D.h
+++ b/third_party/WebKit/Source/modules/offscreencanvas2d/OffscreenCanvasRenderingContext2D.h

@@ -67,7 +67,7 @@
     bool hasAlpha() const override { return m_hasAlpha; }
     bool isContextLost() const override;
 
-    RawPtr<ImageBitmap> transferToImageBitmap(ExceptionState&) final;
+    ImageBitmap* transferToImageBitmap(ExceptionState&) final;
 
 protected:
     OffscreenCanvasRenderingContext2D(OffscreenCanvas*, const CanvasContextCreationAttributes& attrs);

diff --git a/third_party/WebKit/Source/modules/payments/PaymentRequest.cpp b/third_party/WebKit/Source/modules/payments/PaymentRequest.cpp
index b69172a..710a2ad 100644
--- a/third_party/WebKit/Source/modules/payments/PaymentRequest.cpp
+++ b/third_party/WebKit/Source/modules/payments/PaymentRequest.cpp

@@ -318,7 +318,7 @@
     }
 
     m_shippingAddress = new ShippingAddress(std::move(address));
-    RawPtr<Event> event = Event::create(EventTypeNames::shippingaddresschange);
+    Event* event = Event::create(EventTypeNames::shippingaddresschange);
     event->setTarget(this);
     getExecutionContext()->getEventQueue()->enqueueEvent(event);
 }
@@ -328,7 +328,7 @@
     DCHECK(m_showResolver);
     DCHECK(!m_completeResolver);
     m_shippingOption = shippingOptionId;
-    RawPtr<Event> event = Event::create(EventTypeNames::shippingoptionchange);
+    Event* event = Event::create(EventTypeNames::shippingoptionchange);
     event->setTarget(this);
     getExecutionContext()->getEventQueue()->enqueueEvent(event);
 }

diff --git a/third_party/WebKit/Source/modules/permissions/PermissionsCallback.cpp b/third_party/WebKit/Source/modules/permissions/PermissionsCallback.cpp
index 7d967ab..c850718 100644
--- a/third_party/WebKit/Source/modules/permissions/PermissionsCallback.cpp
+++ b/third_party/WebKit/Source/modules/permissions/PermissionsCallback.cpp

@@ -17,12 +17,12 @@
     ASSERT(m_resolver);
 }
 
-void PermissionsCallback::onSuccess(WebPassOwnPtr<WebVector<WebPermissionStatus>> permissionStatus)
+void PermissionsCallback::onSuccess(std::unique_ptr<WebVector<WebPermissionStatus>> permissionStatus)
 {
     if (!m_resolver->getExecutionContext() || m_resolver->getExecutionContext()->activeDOMObjectsAreStopped())
         return;
 
-    OwnPtr<WebVector<WebPermissionStatus>> statusPtr = permissionStatus.release();
+    OwnPtr<WebVector<WebPermissionStatus>> statusPtr = adoptPtr(permissionStatus.release());
     HeapVector<Member<PermissionStatus>> result(m_callerIndexToInternalIndex->size());
 
     // Create the response vector by finding the status for each index by

diff --git a/third_party/WebKit/Source/modules/permissions/PermissionsCallback.h b/third_party/WebKit/Source/modules/permissions/PermissionsCallback.h
index 3800a78..a2351c9 100644
--- a/third_party/WebKit/Source/modules/permissions/PermissionsCallback.h
+++ b/third_party/WebKit/Source/modules/permissions/PermissionsCallback.h

@@ -7,7 +7,6 @@
 
 #include "platform/heap/Handle.h"
 #include "public/platform/WebCallbacks.h"
-#include "public/platform/WebPassOwnPtr.h"
 #include "public/platform/WebVector.h"
 #include "public/platform/modules/permissions/WebPermissionStatus.h"
 #include "public/platform/modules/permissions/WebPermissionType.h"
@@ -15,6 +14,8 @@
 #include "wtf/PassRefPtr.h"
 #include "wtf/RefPtr.h"
 
+#include <memory>
+
 namespace blink {
 
 class ScriptPromiseResolver;
@@ -24,12 +25,12 @@
 // the callback. It takes a WebPermissionType in its constructor and will pass
 // it to the PermissionStatus.
 class PermissionsCallback final
-    : public WebCallbacks<WebPassOwnPtr<WebVector<WebPermissionStatus>>, void> {
+    : public WebCallbacks<std::unique_ptr<WebVector<WebPermissionStatus>>, void> {
 public:
     PermissionsCallback(ScriptPromiseResolver*, PassOwnPtr<Vector<WebPermissionType>>, PassOwnPtr<Vector<int>>);
     ~PermissionsCallback() = default;
 
-    void onSuccess(WebPassOwnPtr<WebVector<WebPermissionStatus>>) override;
+    void onSuccess(std::unique_ptr<WebVector<WebPermissionStatus>>) override;
     void onError() override;
 
 private:

diff --git a/third_party/WebKit/Source/modules/presentation/PresentationConnectionAvailableEvent.h b/third_party/WebKit/Source/modules/presentation/PresentationConnectionAvailableEvent.h
index 0eb986a..33f9adf7 100644
--- a/third_party/WebKit/Source/modules/presentation/PresentationConnectionAvailableEvent.h
+++ b/third_party/WebKit/Source/modules/presentation/PresentationConnectionAvailableEvent.h

@@ -21,15 +21,15 @@
 public:
     ~PresentationConnectionAvailableEvent() override;
 
-    static RawPtr<PresentationConnectionAvailableEvent> create()
+    static PresentationConnectionAvailableEvent* create()
     {
         return new PresentationConnectionAvailableEvent;
     }
-    static RawPtr<PresentationConnectionAvailableEvent> create(const AtomicString& eventType, PresentationConnection* connection)
+    static PresentationConnectionAvailableEvent* create(const AtomicString& eventType, PresentationConnection* connection)
     {
         return new PresentationConnectionAvailableEvent(eventType, connection);
     }
-    static RawPtr<PresentationConnectionAvailableEvent> create(const AtomicString& eventType, const PresentationConnectionAvailableEventInit& initializer)
+    static PresentationConnectionAvailableEvent* create(const AtomicString& eventType, const PresentationConnectionAvailableEventInit& initializer)
     {
         return new PresentationConnectionAvailableEvent(eventType, initializer);
     }

diff --git a/third_party/WebKit/Source/modules/presentation/PresentationConnectionCallbacks.cpp b/third_party/WebKit/Source/modules/presentation/PresentationConnectionCallbacks.cpp
index ee05de9..ea1d2b9 100644
--- a/third_party/WebKit/Source/modules/presentation/PresentationConnectionCallbacks.cpp
+++ b/third_party/WebKit/Source/modules/presentation/PresentationConnectionCallbacks.cpp

@@ -21,9 +21,9 @@
     ASSERT(m_request);
 }
 
-void PresentationConnectionCallbacks::onSuccess(WebPassOwnPtr<WebPresentationConnectionClient> PresentationConnectionClient)
+void PresentationConnectionCallbacks::onSuccess(std::unique_ptr<WebPresentationConnectionClient> PresentationConnectionClient)
 {
-    OwnPtr<WebPresentationConnectionClient> result(PresentationConnectionClient.release());
+    OwnPtr<WebPresentationConnectionClient> result(adoptPtr(PresentationConnectionClient.release()));
 
     if (!m_resolver->getExecutionContext() || m_resolver->getExecutionContext()->activeDOMObjectsAreStopped())
         return;

diff --git a/third_party/WebKit/Source/modules/presentation/PresentationConnectionCallbacks.h b/third_party/WebKit/Source/modules/presentation/PresentationConnectionCallbacks.h
index d460c995..3da9ed1 100644
--- a/third_party/WebKit/Source/modules/presentation/PresentationConnectionCallbacks.h
+++ b/third_party/WebKit/Source/modules/presentation/PresentationConnectionCallbacks.h

@@ -21,12 +21,12 @@
 // the PresentationRequest object that originated the call in its constructor
 // and will pass it to the created PresentationConnection.
 class PresentationConnectionCallbacks final
-    : public WebCallbacks<WebPassOwnPtr<WebPresentationConnectionClient>, const WebPresentationError&> {
+    : public WebCallbacks<std::unique_ptr<WebPresentationConnectionClient>, const WebPresentationError&> {
 public:
     PresentationConnectionCallbacks(ScriptPromiseResolver*, PresentationRequest*);
     ~PresentationConnectionCallbacks() override = default;
 
-    void onSuccess(WebPassOwnPtr<WebPresentationConnectionClient>) override;
+    void onSuccess(std::unique_ptr<WebPresentationConnectionClient>) override;
     void onError(const WebPresentationError&) override;
 
 private:

diff --git a/third_party/WebKit/Source/modules/presentation/PresentationConnectionCloseEvent.h b/third_party/WebKit/Source/modules/presentation/PresentationConnectionCloseEvent.h
index 9df1034..fcbc103 100644
--- a/third_party/WebKit/Source/modules/presentation/PresentationConnectionCloseEvent.h
+++ b/third_party/WebKit/Source/modules/presentation/PresentationConnectionCloseEvent.h

@@ -20,17 +20,17 @@
 public:
     ~PresentationConnectionCloseEvent() override = default;
 
-    static RawPtr<PresentationConnectionCloseEvent> create()
+    static PresentationConnectionCloseEvent* create()
     {
         return new PresentationConnectionCloseEvent;
     }
 
-    static RawPtr<PresentationConnectionCloseEvent> create(const AtomicString& eventType, const String& reason, const String& message)
+    static PresentationConnectionCloseEvent* create(const AtomicString& eventType, const String& reason, const String& message)
     {
         return new PresentationConnectionCloseEvent(eventType, reason, message);
     }
 
-    static RawPtr<PresentationConnectionCloseEvent> create(const AtomicString& eventType, const PresentationConnectionCloseEventInit& initializer)
+    static PresentationConnectionCloseEvent* create(const AtomicString& eventType, const PresentationConnectionCloseEventInit& initializer)
     {
         return new PresentationConnectionCloseEvent(eventType, initializer);
     }

diff --git a/third_party/WebKit/Source/modules/presentation/PresentationController.cpp b/third_party/WebKit/Source/modules/presentation/PresentationController.cpp
index f1474241..f0904d2f 100644
--- a/third_party/WebKit/Source/modules/presentation/PresentationController.cpp
+++ b/third_party/WebKit/Source/modules/presentation/PresentationController.cpp

@@ -25,7 +25,7 @@
 }
 
 // static
-RawPtr<PresentationController> PresentationController::create(LocalFrame& frame, WebPresentationClient* client)
+PresentationController* PresentationController::create(LocalFrame& frame, WebPresentationClient* client)
 {
     return new PresentationController(frame, client);
 }

diff --git a/third_party/WebKit/Source/modules/presentation/PresentationController.h b/third_party/WebKit/Source/modules/presentation/PresentationController.h
index 903c09c..ef45351 100644
--- a/third_party/WebKit/Source/modules/presentation/PresentationController.h
+++ b/third_party/WebKit/Source/modules/presentation/PresentationController.h

@@ -35,7 +35,7 @@
 public:
     ~PresentationController() override;
 
-    static RawPtr<PresentationController> create(LocalFrame&, WebPresentationClient*);
+    static PresentationController* create(LocalFrame&, WebPresentationClient*);
 
     static const char* supplementName();
     static PresentationController* from(LocalFrame&);

diff --git a/third_party/WebKit/Source/modules/push_messaging/PushController.cpp b/third_party/WebKit/Source/modules/push_messaging/PushController.cpp
index 13afc5e..6f1afd8 100644
--- a/third_party/WebKit/Source/modules/push_messaging/PushController.cpp
+++ b/third_party/WebKit/Source/modules/push_messaging/PushController.cpp

@@ -14,7 +14,7 @@
 {
 }
 
-RawPtr<PushController> PushController::create(WebPushClient* client)
+PushController* PushController::create(WebPushClient* client)
 {
     return new PushController(client);
 }

diff --git a/third_party/WebKit/Source/modules/push_messaging/PushController.h b/third_party/WebKit/Source/modules/push_messaging/PushController.h
index 918b26a..797c023 100644
--- a/third_party/WebKit/Source/modules/push_messaging/PushController.h
+++ b/third_party/WebKit/Source/modules/push_messaging/PushController.h

@@ -20,7 +20,7 @@
     USING_GARBAGE_COLLECTED_MIXIN(PushController);
     WTF_MAKE_NONCOPYABLE(PushController);
 public:
-    static RawPtr<PushController> create(WebPushClient*);
+    static PushController* create(WebPushClient*);
     static const char* supplementName();
     static PushController* from(LocalFrame* frame) { return static_cast<PushController*>(Supplement<LocalFrame>::from(frame, supplementName())); }
     static WebPushClient& clientFrom(LocalFrame*);

diff --git a/third_party/WebKit/Source/modules/push_messaging/PushEvent.h b/third_party/WebKit/Source/modules/push_messaging/PushEvent.h
index 20f776c..1446a10 100644
--- a/third_party/WebKit/Source/modules/push_messaging/PushEvent.h
+++ b/third_party/WebKit/Source/modules/push_messaging/PushEvent.h

@@ -20,15 +20,15 @@
 class MODULES_EXPORT PushEvent final : public ExtendableEvent {
     DEFINE_WRAPPERTYPEINFO();
 public:
-    static RawPtr<PushEvent> create()
+    static PushEvent* create()
     {
         return new PushEvent;
     }
-    static RawPtr<PushEvent> create(const AtomicString& type, PushMessageData* data, WaitUntilObserver* observer)
+    static PushEvent* create(const AtomicString& type, PushMessageData* data, WaitUntilObserver* observer)
     {
         return new PushEvent(type, data, observer);
     }
-    static RawPtr<PushEvent> create(const AtomicString& type, const PushEventInit& initializer)
+    static PushEvent* create(const AtomicString& type, const PushEventInit& initializer)
     {
         return new PushEvent(type, initializer);
     }

diff --git a/third_party/WebKit/Source/modules/push_messaging/PushSubscriptionCallbacks.cpp b/third_party/WebKit/Source/modules/push_messaging/PushSubscriptionCallbacks.cpp
index b36197e..bce85d2b 100644
--- a/third_party/WebKit/Source/modules/push_messaging/PushSubscriptionCallbacks.cpp
+++ b/third_party/WebKit/Source/modules/push_messaging/PushSubscriptionCallbacks.cpp

@@ -24,12 +24,12 @@
 {
 }
 
-void PushSubscriptionCallbacks::onSuccess(WebPassOwnPtr<WebPushSubscription> webPushSubscription)
+void PushSubscriptionCallbacks::onSuccess(std::unique_ptr<WebPushSubscription> webPushSubscription)
 {
     if (!m_resolver->getExecutionContext() || m_resolver->getExecutionContext()->activeDOMObjectsAreStopped())
         return;
 
-    m_resolver->resolve(PushSubscription::take(m_resolver.get(), webPushSubscription.release(), m_serviceWorkerRegistration));
+    m_resolver->resolve(PushSubscription::take(m_resolver.get(), adoptPtr(webPushSubscription.release()), m_serviceWorkerRegistration));
 }
 
 void PushSubscriptionCallbacks::onError(const WebPushError& error)

diff --git a/third_party/WebKit/Source/modules/push_messaging/PushSubscriptionCallbacks.h b/third_party/WebKit/Source/modules/push_messaging/PushSubscriptionCallbacks.h
index ecf1758a..dab9381a 100644
--- a/third_party/WebKit/Source/modules/push_messaging/PushSubscriptionCallbacks.h
+++ b/third_party/WebKit/Source/modules/push_messaging/PushSubscriptionCallbacks.h

@@ -27,7 +27,7 @@
     PushSubscriptionCallbacks(ScriptPromiseResolver*, ServiceWorkerRegistration*);
     ~PushSubscriptionCallbacks() override;
 
-    void onSuccess(WebPassOwnPtr<WebPushSubscription>) override;
+    void onSuccess(std::unique_ptr<WebPushSubscription>) override;
     void onError(const WebPushError&) override;
 
 private:

diff --git a/third_party/WebKit/Source/modules/quota/StorageQuotaClient.cpp b/third_party/WebKit/Source/modules/quota/StorageQuotaClient.cpp
index db2066f..e504881 100644
--- a/third_party/WebKit/Source/modules/quota/StorageQuotaClient.cpp
+++ b/third_party/WebKit/Source/modules/quota/StorageQuotaClient.cpp

@@ -48,7 +48,7 @@
     return static_cast<StorageQuotaClient*>(Supplement<Page>::from(toDocument(context)->page(), supplementName()));
 }
 
-void provideStorageQuotaClientTo(Page& page, RawPtr<StorageQuotaClient> client)
+void provideStorageQuotaClientTo(Page& page, StorageQuotaClient* client)
 {
     page.provideSupplement(StorageQuotaClient::supplementName(), client);
 }

diff --git a/third_party/WebKit/Source/modules/quota/StorageQuotaClient.h b/third_party/WebKit/Source/modules/quota/StorageQuotaClient.h
index cb5073db..1ba82be 100644
--- a/third_party/WebKit/Source/modules/quota/StorageQuotaClient.h
+++ b/third_party/WebKit/Source/modules/quota/StorageQuotaClient.h

@@ -60,7 +60,7 @@
     static StorageQuotaClient* from(ExecutionContext*);
 };
 
-MODULES_EXPORT void provideStorageQuotaClientTo(Page&, RawPtr<StorageQuotaClient>);
+MODULES_EXPORT void provideStorageQuotaClientTo(Page&, StorageQuotaClient*);
 
 } // namespace blink
 

diff --git a/third_party/WebKit/Source/modules/serviceworkers/ExtendableEvent.cpp b/third_party/WebKit/Source/modules/serviceworkers/ExtendableEvent.cpp
index b578d836..75412f1 100644
--- a/third_party/WebKit/Source/modules/serviceworkers/ExtendableEvent.cpp
+++ b/third_party/WebKit/Source/modules/serviceworkers/ExtendableEvent.cpp

@@ -35,17 +35,17 @@
 
 namespace blink {
 
-RawPtr<ExtendableEvent> ExtendableEvent::create()
+ExtendableEvent* ExtendableEvent::create()
 {
     return new ExtendableEvent();
 }
 
-RawPtr<ExtendableEvent> ExtendableEvent::create(const AtomicString& type, const ExtendableEventInit& eventInit)
+ExtendableEvent* ExtendableEvent::create(const AtomicString& type, const ExtendableEventInit& eventInit)
 {
     return new ExtendableEvent(type, eventInit);
 }
 
-RawPtr<ExtendableEvent> ExtendableEvent::create(const AtomicString& type, const ExtendableEventInit& eventInit, WaitUntilObserver* observer)
+ExtendableEvent* ExtendableEvent::create(const AtomicString& type, const ExtendableEventInit& eventInit, WaitUntilObserver* observer)
 {
     return new ExtendableEvent(type, eventInit, observer);
 }

diff --git a/third_party/WebKit/Source/modules/serviceworkers/ExtendableEvent.h b/third_party/WebKit/Source/modules/serviceworkers/ExtendableEvent.h
index 45b212f..08d19ae 100644
--- a/third_party/WebKit/Source/modules/serviceworkers/ExtendableEvent.h
+++ b/third_party/WebKit/Source/modules/serviceworkers/ExtendableEvent.h

@@ -43,9 +43,9 @@
 class MODULES_EXPORT ExtendableEvent : public Event {
     DEFINE_WRAPPERTYPEINFO();
 public:
-    static RawPtr<ExtendableEvent> create();
-    static RawPtr<ExtendableEvent> create(const AtomicString& type, const ExtendableEventInit&);
-    static RawPtr<ExtendableEvent> create(const AtomicString& type, const ExtendableEventInit&, WaitUntilObserver*);
+    static ExtendableEvent* create();
+    static ExtendableEvent* create(const AtomicString& type, const ExtendableEventInit&);
+    static ExtendableEvent* create(const AtomicString& type, const ExtendableEventInit&, WaitUntilObserver*);
 
     ~ExtendableEvent() override;
 

diff --git a/third_party/WebKit/Source/modules/serviceworkers/ExtendableMessageEvent.cpp b/third_party/WebKit/Source/modules/serviceworkers/ExtendableMessageEvent.cpp
index 58c5e4f..4ede4d9 100644
--- a/third_party/WebKit/Source/modules/serviceworkers/ExtendableMessageEvent.cpp
+++ b/third_party/WebKit/Source/modules/serviceworkers/ExtendableMessageEvent.cpp

@@ -6,38 +6,38 @@
 
 namespace blink {
 
-RawPtr<ExtendableMessageEvent> ExtendableMessageEvent::create()
+ExtendableMessageEvent* ExtendableMessageEvent::create()
 {
     return new ExtendableMessageEvent;
 }
 
-RawPtr<ExtendableMessageEvent> ExtendableMessageEvent::create(const AtomicString& type, const ExtendableMessageEventInit& initializer)
+ExtendableMessageEvent* ExtendableMessageEvent::create(const AtomicString& type, const ExtendableMessageEventInit& initializer)
 {
     return new ExtendableMessageEvent(type, initializer);
 }
 
-RawPtr<ExtendableMessageEvent> ExtendableMessageEvent::create(const AtomicString& type, const ExtendableMessageEventInit& initializer, WaitUntilObserver* observer)
+ExtendableMessageEvent* ExtendableMessageEvent::create(const AtomicString& type, const ExtendableMessageEventInit& initializer, WaitUntilObserver* observer)
 {
     return new ExtendableMessageEvent(type, initializer, observer);
 }
 
-RawPtr<ExtendableMessageEvent> ExtendableMessageEvent::create(PassRefPtr<SerializedScriptValue> data, const String& origin, MessagePortArray* ports, WaitUntilObserver* observer)
+ExtendableMessageEvent* ExtendableMessageEvent::create(PassRefPtr<SerializedScriptValue> data, const String& origin, MessagePortArray* ports, WaitUntilObserver* observer)
 {
     return new ExtendableMessageEvent(data, origin, ports, observer);
 }
 
-RawPtr<ExtendableMessageEvent> ExtendableMessageEvent::create(PassRefPtr<SerializedScriptValue> data, const String& origin, MessagePortArray* ports, ServiceWorkerClient* source, WaitUntilObserver* observer)
+ExtendableMessageEvent* ExtendableMessageEvent::create(PassRefPtr<SerializedScriptValue> data, const String& origin, MessagePortArray* ports, ServiceWorkerClient* source, WaitUntilObserver* observer)
 {
-    RawPtr<ExtendableMessageEvent> event = new ExtendableMessageEvent(data, origin, ports, observer);
+    ExtendableMessageEvent* event = new ExtendableMessageEvent(data, origin, ports, observer);
     event->m_sourceAsClient = source;
-    return event.release();
+    return event;
 }
 
-RawPtr<ExtendableMessageEvent> ExtendableMessageEvent::create(PassRefPtr<SerializedScriptValue> data, const String& origin, MessagePortArray* ports, ServiceWorker* source, WaitUntilObserver* observer)
+ExtendableMessageEvent* ExtendableMessageEvent::create(PassRefPtr<SerializedScriptValue> data, const String& origin, MessagePortArray* ports, ServiceWorker* source, WaitUntilObserver* observer)
 {
-    RawPtr<ExtendableMessageEvent> event = new ExtendableMessageEvent(data, origin, ports, observer);
+    ExtendableMessageEvent* event = new ExtendableMessageEvent(data, origin, ports, observer);
     event->m_sourceAsServiceWorker = source;
-    return event.release();
+    return event;
 }
 
 MessagePortArray ExtendableMessageEvent::ports(bool& isNull) const

diff --git a/third_party/WebKit/Source/modules/serviceworkers/ExtendableMessageEvent.h b/third_party/WebKit/Source/modules/serviceworkers/ExtendableMessageEvent.h
index dd7824c..9ecbc92 100644
--- a/third_party/WebKit/Source/modules/serviceworkers/ExtendableMessageEvent.h
+++ b/third_party/WebKit/Source/modules/serviceworkers/ExtendableMessageEvent.h

@@ -16,12 +16,12 @@
     DEFINE_WRAPPERTYPEINFO();
 
 public:
-    static RawPtr<ExtendableMessageEvent> create();
-    static RawPtr<ExtendableMessageEvent> create(const AtomicString& type, const ExtendableMessageEventInit& initializer);
-    static RawPtr<ExtendableMessageEvent> create(const AtomicString& type, const ExtendableMessageEventInit& initializer, WaitUntilObserver*);
-    static RawPtr<ExtendableMessageEvent> create(PassRefPtr<SerializedScriptValue> data, const String& origin, MessagePortArray* ports, WaitUntilObserver*);
-    static RawPtr<ExtendableMessageEvent> create(PassRefPtr<SerializedScriptValue> data, const String& origin, MessagePortArray* ports, ServiceWorkerClient* source, WaitUntilObserver*);
-    static RawPtr<ExtendableMessageEvent> create(PassRefPtr<SerializedScriptValue> data, const String& origin, MessagePortArray* ports, ServiceWorker* source, WaitUntilObserver*);
+    static ExtendableMessageEvent* create();
+    static ExtendableMessageEvent* create(const AtomicString& type, const ExtendableMessageEventInit& initializer);
+    static ExtendableMessageEvent* create(const AtomicString& type, const ExtendableMessageEventInit& initializer, WaitUntilObserver*);
+    static ExtendableMessageEvent* create(PassRefPtr<SerializedScriptValue> data, const String& origin, MessagePortArray* ports, WaitUntilObserver*);
+    static ExtendableMessageEvent* create(PassRefPtr<SerializedScriptValue> data, const String& origin, MessagePortArray* ports, ServiceWorkerClient* source, WaitUntilObserver*);
+    static ExtendableMessageEvent* create(PassRefPtr<SerializedScriptValue> data, const String& origin, MessagePortArray* ports, ServiceWorker* source, WaitUntilObserver*);
 
     SerializedScriptValue* serializedData() const { return m_serializedData.get(); }
     void setSerializedData(PassRefPtr<SerializedScriptValue> serializedData) { m_serializedData = serializedData; }

diff --git a/third_party/WebKit/Source/modules/serviceworkers/FetchEvent.cpp b/third_party/WebKit/Source/modules/serviceworkers/FetchEvent.cpp
index 8c71242..acfcff15 100644
--- a/third_party/WebKit/Source/modules/serviceworkers/FetchEvent.cpp
+++ b/third_party/WebKit/Source/modules/serviceworkers/FetchEvent.cpp

@@ -10,17 +10,17 @@
 
 namespace blink {
 
-RawPtr<FetchEvent> FetchEvent::create()
+FetchEvent* FetchEvent::create()
 {
     return new FetchEvent();
 }
 
-RawPtr<FetchEvent> FetchEvent::create(const AtomicString& type, const FetchEventInit& initializer)
+FetchEvent* FetchEvent::create(const AtomicString& type, const FetchEventInit& initializer)
 {
     return new FetchEvent(type, initializer, nullptr);
 }
 
-RawPtr<FetchEvent> FetchEvent::create(const AtomicString& type, const FetchEventInit& initializer, RespondWithObserver* observer)
+FetchEvent* FetchEvent::create(const AtomicString& type, const FetchEventInit& initializer, RespondWithObserver* observer)
 {
     return new FetchEvent(type, initializer, observer);
 }

diff --git a/third_party/WebKit/Source/modules/serviceworkers/FetchEvent.h b/third_party/WebKit/Source/modules/serviceworkers/FetchEvent.h
index 6f24f32..20086b2 100644
--- a/third_party/WebKit/Source/modules/serviceworkers/FetchEvent.h
+++ b/third_party/WebKit/Source/modules/serviceworkers/FetchEvent.h

@@ -26,9 +26,9 @@
 class MODULES_EXPORT FetchEvent final : public ExtendableEvent {
     DEFINE_WRAPPERTYPEINFO();
 public:
-    static RawPtr<FetchEvent> create();
-    static RawPtr<FetchEvent> create(const AtomicString& type, const FetchEventInit&);
-    static RawPtr<FetchEvent> create(const AtomicString& type, const FetchEventInit&, RespondWithObserver*);
+    static FetchEvent* create();
+    static FetchEvent* create(const AtomicString& type, const FetchEventInit&);
+    static FetchEvent* create(const AtomicString& type, const FetchEventInit&, RespondWithObserver*);
 
     Request* request() const;
     String clientId() const;

diff --git a/third_party/WebKit/Source/modules/serviceworkers/InstallEvent.cpp b/third_party/WebKit/Source/modules/serviceworkers/InstallEvent.cpp
index 2ade67d..8343d06 100644
--- a/third_party/WebKit/Source/modules/serviceworkers/InstallEvent.cpp
+++ b/third_party/WebKit/Source/modules/serviceworkers/InstallEvent.cpp

@@ -11,17 +11,17 @@
 
 namespace blink {
 
-RawPtr<InstallEvent> InstallEvent::create()
+InstallEvent* InstallEvent::create()
 {
     return new InstallEvent();
 }
 
-RawPtr<InstallEvent> InstallEvent::create(const AtomicString& type, const ExtendableEventInit& eventInit)
+InstallEvent* InstallEvent::create(const AtomicString& type, const ExtendableEventInit& eventInit)
 {
     return new InstallEvent(type, eventInit);
 }
 
-RawPtr<InstallEvent> InstallEvent::create(const AtomicString& type, const ExtendableEventInit& eventInit, WaitUntilObserver* observer)
+InstallEvent* InstallEvent::create(const AtomicString& type, const ExtendableEventInit& eventInit, WaitUntilObserver* observer)
 {
     return new InstallEvent(type, eventInit, observer);
 }

diff --git a/third_party/WebKit/Source/modules/serviceworkers/InstallEvent.h b/third_party/WebKit/Source/modules/serviceworkers/InstallEvent.h
index 96a508cd..eb075a7 100644
--- a/third_party/WebKit/Source/modules/serviceworkers/InstallEvent.h
+++ b/third_party/WebKit/Source/modules/serviceworkers/InstallEvent.h

@@ -18,9 +18,9 @@
     DEFINE_WRAPPERTYPEINFO();
 
 public:
-    static RawPtr<InstallEvent> create();
-    static RawPtr<InstallEvent> create(const AtomicString& type, const ExtendableEventInit&);
-    static RawPtr<InstallEvent> create(const AtomicString& type, const ExtendableEventInit&, WaitUntilObserver*);
+    static InstallEvent* create();
+    static InstallEvent* create(const AtomicString& type, const ExtendableEventInit&);
+    static InstallEvent* create(const AtomicString& type, const ExtendableEventInit&, WaitUntilObserver*);
 
     ~InstallEvent() override;
 

diff --git a/third_party/WebKit/Source/modules/serviceworkers/ServiceWorkerClients.cpp b/third_party/WebKit/Source/modules/serviceworkers/ServiceWorkerClients.cpp
index 0e458ccf..4805bf9 100644
--- a/third_party/WebKit/Source/modules/serviceworkers/ServiceWorkerClients.cpp
+++ b/third_party/WebKit/Source/modules/serviceworkers/ServiceWorkerClients.cpp

@@ -66,9 +66,9 @@
         : m_resolver(resolver) { }
     ~GetCallback() override { }
 
-    void onSuccess(WebPassOwnPtr<WebServiceWorkerClientInfo> webClient) override
+    void onSuccess(std::unique_ptr<WebServiceWorkerClientInfo> webClient) override
     {
-        OwnPtr<WebServiceWorkerClientInfo> client = webClient.release();
+        OwnPtr<WebServiceWorkerClientInfo> client = adoptPtr(webClient.release());
         if (!m_resolver->getExecutionContext() || m_resolver->getExecutionContext()->activeDOMObjectsAreStopped())
             return;
         if (!client) {

diff --git a/third_party/WebKit/Source/modules/serviceworkers/ServiceWorkerContainer.cpp b/third_party/WebKit/Source/modules/serviceworkers/ServiceWorkerContainer.cpp
index ef8e865..1117acc 100644
--- a/third_party/WebKit/Source/modules/serviceworkers/ServiceWorkerContainer.cpp
+++ b/third_party/WebKit/Source/modules/serviceworkers/ServiceWorkerContainer.cpp

@@ -42,6 +42,7 @@
 #include "core/dom/MessagePort.h"
 #include "core/frame/LocalDOMWindow.h"
 #include "core/frame/UseCounter.h"
+#include "core/frame/csp/ContentSecurityPolicy.h"
 #include "modules/EventTargetModules.h"
 #include "modules/serviceworkers/ServiceWorker.h"
 #include "modules/serviceworkers/ServiceWorkerContainerClient.h"
@@ -64,11 +65,11 @@
         : m_resolver(resolver) { }
     ~RegistrationCallback() override { }
 
-    void onSuccess(WebPassOwnPtr<WebServiceWorkerRegistration::Handle> handle) override
+    void onSuccess(std::unique_ptr<WebServiceWorkerRegistration::Handle> handle) override
     {
         if (!m_resolver->getExecutionContext() || m_resolver->getExecutionContext()->activeDOMObjectsAreStopped())
             return;
-        m_resolver->resolve(ServiceWorkerRegistration::getOrCreate(m_resolver->getExecutionContext(), handle.release()));
+        m_resolver->resolve(ServiceWorkerRegistration::getOrCreate(m_resolver->getExecutionContext(), adoptPtr(handle.release())));
     }
 
     void onError(const WebServiceWorkerError& error) override
@@ -93,9 +94,9 @@
         : m_resolver(resolver) { }
     ~GetRegistrationCallback() override { }
 
-    void onSuccess(WebPassOwnPtr<WebServiceWorkerRegistration::Handle> webPassHandle) override
+    void onSuccess(std::unique_ptr<WebServiceWorkerRegistration::Handle> webPassHandle) override
     {
-        OwnPtr<WebServiceWorkerRegistration::Handle> handle = webPassHandle.release();
+        OwnPtr<WebServiceWorkerRegistration::Handle> handle = adoptPtr(webPassHandle.release());
         if (!m_resolver->getExecutionContext() || m_resolver->getExecutionContext()->activeDOMObjectsAreStopped())
             return;
         if (!handle) {
@@ -124,10 +125,10 @@
         : m_resolver(resolver) { }
     ~GetRegistrationsCallback() override { }
 
-    void onSuccess(WebPassOwnPtr<WebVector<WebServiceWorkerRegistration::Handle*>> webPassRegistrations) override
+    void onSuccess(std::unique_ptr<WebVector<WebServiceWorkerRegistration::Handle*>> webPassRegistrations) override
     {
         Vector<OwnPtr<WebServiceWorkerRegistration::Handle>> handles;
-        OwnPtr<WebVector<WebServiceWorkerRegistration::Handle*>> webRegistrations = webPassRegistrations.release();
+        OwnPtr<WebVector<WebServiceWorkerRegistration::Handle*>> webRegistrations = adoptPtr(webPassRegistrations.release());
         for (auto& handle : *webRegistrations) {
             handles.append(adoptPtr(handle));
         }
@@ -155,12 +156,12 @@
         : m_ready(ready) { }
     ~GetRegistrationForReadyCallback() override { }
 
-    void onSuccess(WebPassOwnPtr<WebServiceWorkerRegistration::Handle> handle) override
+    void onSuccess(std::unique_ptr<WebServiceWorkerRegistration::Handle> handle) override
     {
         ASSERT(m_ready->getState() == ReadyProperty::Pending);
 
         if (m_ready->getExecutionContext() && !m_ready->getExecutionContext()->activeDOMObjectsAreStopped())
-            m_ready->resolve(ServiceWorkerRegistration::getOrCreate(m_ready->getExecutionContext(), handle.release()));
+            m_ready->resolve(ServiceWorkerRegistration::getOrCreate(m_ready->getExecutionContext(), adoptPtr(handle.release())));
     }
 
 private:
@@ -246,6 +247,14 @@
         return;
     }
 
+    ContentSecurityPolicy* csp = executionContext->contentSecurityPolicy();
+    if (csp) {
+        if (!csp->allowWorkerContextFromSource(scriptURL, ContentSecurityPolicy::DidNotRedirect, ContentSecurityPolicy::SendReport)) {
+            callbacks->onError(WebServiceWorkerError(WebServiceWorkerError::ErrorTypeSecurity, String("Failed to register a ServiceWorker: The provided scriptURL ('" + scriptURL.getString() + "') violates the Content Security Policy.")));
+            return;
+        }
+    }
+
     m_provider->registerServiceWorker(patternURL, scriptURL, callbacks.leakPtr());
 }
 
@@ -372,25 +381,25 @@
     return m_ready->promise(callerState->world());
 }
 
-void ServiceWorkerContainer::setController(WebPassOwnPtr<WebServiceWorker::Handle> handle, bool shouldNotifyControllerChange)
+void ServiceWorkerContainer::setController(std::unique_ptr<WebServiceWorker::Handle> handle, bool shouldNotifyControllerChange)
 {
     if (!getExecutionContext())
         return;
-    m_controller = ServiceWorker::from(getExecutionContext(), handle.release());
+    m_controller = ServiceWorker::from(getExecutionContext(), adoptPtr(handle.release()));
     if (m_controller)
         UseCounter::count(getExecutionContext(), UseCounter::ServiceWorkerControlledPage);
     if (shouldNotifyControllerChange)
         dispatchEvent(Event::create(EventTypeNames::controllerchange));
 }
 
-void ServiceWorkerContainer::dispatchMessageEvent(WebPassOwnPtr<WebServiceWorker::Handle> handle, const WebString& message, const WebMessagePortChannelArray& webChannels)
+void ServiceWorkerContainer::dispatchMessageEvent(std::unique_ptr<WebServiceWorker::Handle> handle, const WebString& message, const WebMessagePortChannelArray& webChannels)
 {
     if (!getExecutionContext() || !getExecutionContext()->executingWindow())
         return;
 
     MessagePortArray* ports = MessagePort::toMessagePortArray(getExecutionContext(), webChannels);
     RefPtr<SerializedScriptValue> value = SerializedScriptValueFactory::instance().createFromWire(message);
-    ServiceWorker* source = ServiceWorker::from(getExecutionContext(), handle.release());
+    ServiceWorker* source = ServiceWorker::from(getExecutionContext(), adoptPtr(handle.release()));
     dispatchEvent(ServiceWorkerMessageEvent::create(ports, value, source, getExecutionContext()->getSecurityOrigin()->toString()));
 }
 

diff --git a/third_party/WebKit/Source/modules/serviceworkers/ServiceWorkerContainer.h b/third_party/WebKit/Source/modules/serviceworkers/ServiceWorkerContainer.h
index 37fb79c8..336c7d7 100644
--- a/third_party/WebKit/Source/modules/serviceworkers/ServiceWorkerContainer.h
+++ b/third_party/WebKit/Source/modules/serviceworkers/ServiceWorkerContainer.h

@@ -80,8 +80,8 @@
     ScriptPromise getRegistrations(ScriptState*);
 
     // WebServiceWorkerProviderClient overrides.
-    void setController(WebPassOwnPtr<WebServiceWorker::Handle>, bool shouldNotifyControllerChange) override;
-    void dispatchMessageEvent(WebPassOwnPtr<WebServiceWorker::Handle>, const WebString& message, const WebMessagePortChannelArray&) override;
+    void setController(std::unique_ptr<WebServiceWorker::Handle>, bool shouldNotifyControllerChange) override;
+    void dispatchMessageEvent(std::unique_ptr<WebServiceWorker::Handle>, const WebString& message, const WebMessagePortChannelArray&) override;
 
     // EventTarget overrides.
     ExecutionContext* getExecutionContext() const override { return ContextLifecycleObserver::getExecutionContext(); }

diff --git a/third_party/WebKit/Source/modules/serviceworkers/ServiceWorkerContainerClient.cpp b/third_party/WebKit/Source/modules/serviceworkers/ServiceWorkerContainerClient.cpp
index f5defc34..62b071b6 100644
--- a/third_party/WebKit/Source/modules/serviceworkers/ServiceWorkerContainerClient.cpp
+++ b/third_party/WebKit/Source/modules/serviceworkers/ServiceWorkerContainerClient.cpp

@@ -13,7 +13,7 @@
 
 namespace blink {
 
-RawPtr<ServiceWorkerContainerClient> ServiceWorkerContainerClient::create(PassOwnPtr<WebServiceWorkerProvider> provider)
+ServiceWorkerContainerClient* ServiceWorkerContainerClient::create(PassOwnPtr<WebServiceWorkerProvider> provider)
 {
     return new ServiceWorkerContainerClient(provider);
 }

diff --git a/third_party/WebKit/Source/modules/serviceworkers/ServiceWorkerContainerClient.h b/third_party/WebKit/Source/modules/serviceworkers/ServiceWorkerContainerClient.h
index cd3bcb55..28e63b6a 100644
--- a/third_party/WebKit/Source/modules/serviceworkers/ServiceWorkerContainerClient.h
+++ b/third_party/WebKit/Source/modules/serviceworkers/ServiceWorkerContainerClient.h

@@ -24,7 +24,7 @@
     USING_GARBAGE_COLLECTED_MIXIN(ServiceWorkerContainerClient);
     WTF_MAKE_NONCOPYABLE(ServiceWorkerContainerClient);
 public:
-    static RawPtr<ServiceWorkerContainerClient> create(PassOwnPtr<WebServiceWorkerProvider>);
+    static ServiceWorkerContainerClient* create(PassOwnPtr<WebServiceWorkerProvider>);
     virtual ~ServiceWorkerContainerClient();
 
     WebServiceWorkerProvider* provider() { return m_provider.get(); }

diff --git a/third_party/WebKit/Source/modules/serviceworkers/ServiceWorkerGlobalScope.cpp b/third_party/WebKit/Source/modules/serviceworkers/ServiceWorkerGlobalScope.cpp
index ca72032..7e8513e 100644
--- a/third_party/WebKit/Source/modules/serviceworkers/ServiceWorkerGlobalScope.cpp
+++ b/third_party/WebKit/Source/modules/serviceworkers/ServiceWorkerGlobalScope.cpp

@@ -64,20 +64,20 @@
 
 namespace blink {
 
-RawPtr<ServiceWorkerGlobalScope> ServiceWorkerGlobalScope::create(ServiceWorkerThread* thread, PassOwnPtr<WorkerThreadStartupData> startupData)
+ServiceWorkerGlobalScope* ServiceWorkerGlobalScope::create(ServiceWorkerThread* thread, PassOwnPtr<WorkerThreadStartupData> startupData)
 {
     // Note: startupData is finalized on return. After the relevant parts has been
     // passed along to the created 'context'.
-    RawPtr<ServiceWorkerGlobalScope> context = new ServiceWorkerGlobalScope(startupData->m_scriptURL, startupData->m_userAgent, thread, monotonicallyIncreasingTime(), startupData->m_starterOriginPrivilegeData.release(), startupData->m_workerClients.release());
+    ServiceWorkerGlobalScope* context = new ServiceWorkerGlobalScope(startupData->m_scriptURL, startupData->m_userAgent, thread, monotonicallyIncreasingTime(), startupData->m_starterOriginPrivilegeData.release(), startupData->m_workerClients.release());
 
     context->setV8CacheOptions(startupData->m_v8CacheOptions);
     context->applyContentSecurityPolicyFromVector(*startupData->m_contentSecurityPolicyHeaders);
     context->setAddressSpace(startupData->m_addressSpace);
 
-    return context.release();
+    return context;
 }
 
-ServiceWorkerGlobalScope::ServiceWorkerGlobalScope(const KURL& url, const String& userAgent, ServiceWorkerThread* thread, double timeOrigin, PassOwnPtr<SecurityOrigin::PrivilegeData> starterOriginPrivilegeData, RawPtr<WorkerClients> workerClients)
+ServiceWorkerGlobalScope::ServiceWorkerGlobalScope(const KURL& url, const String& userAgent, ServiceWorkerThread* thread, double timeOrigin, PassOwnPtr<SecurityOrigin::PrivilegeData> starterOriginPrivilegeData, WorkerClients* workerClients)
     : WorkerGlobalScope(url, userAgent, thread, timeOrigin, starterOriginPrivilegeData, workerClients)
     , m_didEvaluateScript(false)
     , m_hadErrorInTopLevelEventHandler(false)
@@ -141,22 +141,22 @@
     return promise;
 }
 
-void ServiceWorkerGlobalScope::setRegistration(WebPassOwnPtr<WebServiceWorkerRegistration::Handle> handle)
+void ServiceWorkerGlobalScope::setRegistration(std::unique_ptr<WebServiceWorkerRegistration::Handle> handle)
 {
     if (!getExecutionContext())
         return;
-    m_registration = ServiceWorkerRegistration::getOrCreate(getExecutionContext(), handle.release());
+    m_registration = ServiceWorkerRegistration::getOrCreate(getExecutionContext(), adoptPtr(handle.release()));
 }
 
 bool ServiceWorkerGlobalScope::addEventListenerInternal(const AtomicString& eventType, EventListener* listener, const EventListenerOptions& options)
 {
     if (m_didEvaluateScript) {
         if (eventType == EventTypeNames::install) {
-            RawPtr<ConsoleMessage> consoleMessage = ConsoleMessage::create(JSMessageSource, WarningMessageLevel, "Event handler of 'install' event must be added on the initial evaluation of worker script.");
-            addMessageToWorkerConsole(consoleMessage.release());
+            ConsoleMessage* consoleMessage = ConsoleMessage::create(JSMessageSource, WarningMessageLevel, "Event handler of 'install' event must be added on the initial evaluation of worker script.");
+            addMessageToWorkerConsole(consoleMessage);
         } else if (eventType == EventTypeNames::activate) {
-            RawPtr<ConsoleMessage> consoleMessage = ConsoleMessage::create(JSMessageSource, WarningMessageLevel, "Event handler of 'activate' event must be added on the initial evaluation of worker script.");
-            addMessageToWorkerConsole(consoleMessage.release());
+            ConsoleMessage* consoleMessage = ConsoleMessage::create(JSMessageSource, WarningMessageLevel, "Event handler of 'activate' event must be added on the initial evaluation of worker script.");
+            addMessageToWorkerConsole(consoleMessage);
         }
     }
     return WorkerGlobalScope::addEventListenerInternal(eventType, listener, options);
@@ -177,7 +177,7 @@
     return dispatchResult;
 }
 
-void ServiceWorkerGlobalScope::dispatchExtendableEvent(RawPtr<Event> event, WaitUntilObserver* observer)
+void ServiceWorkerGlobalScope::dispatchExtendableEvent(Event* event, WaitUntilObserver* observer)
 {
     ASSERT(m_eventNestingLevel == 0);
     m_hadErrorInTopLevelEventHandler = false;
@@ -214,10 +214,10 @@
 void ServiceWorkerGlobalScope::logExceptionToConsole(const String& errorMessage, int scriptId, const String& sourceURL, int lineNumber, int columnNumber, PassRefPtr<ScriptCallStack> callStack)
 {
     WorkerGlobalScope::logExceptionToConsole(errorMessage, scriptId, sourceURL, lineNumber, columnNumber, callStack);
-    RawPtr<ConsoleMessage> consoleMessage = ConsoleMessage::create(JSMessageSource, ErrorMessageLevel, errorMessage, sourceURL, lineNumber, columnNumber);
+    ConsoleMessage* consoleMessage = ConsoleMessage::create(JSMessageSource, ErrorMessageLevel, errorMessage, sourceURL, lineNumber, columnNumber);
     consoleMessage->setScriptId(scriptId);
     consoleMessage->setCallStack(callStack);
-    addMessageToWorkerConsole(consoleMessage.release());
+    addMessageToWorkerConsole(consoleMessage);
 }
 
 void ServiceWorkerGlobalScope::scriptLoaded(size_t scriptSize, size_t cachedMetadataSize)

diff --git a/third_party/WebKit/Source/modules/serviceworkers/ServiceWorkerGlobalScope.h b/third_party/WebKit/Source/modules/serviceworkers/ServiceWorkerGlobalScope.h
index a690354..a2204ffb 100644
--- a/third_party/WebKit/Source/modules/serviceworkers/ServiceWorkerGlobalScope.h
+++ b/third_party/WebKit/Source/modules/serviceworkers/ServiceWorkerGlobalScope.h

@@ -56,7 +56,7 @@
 class MODULES_EXPORT ServiceWorkerGlobalScope final : public WorkerGlobalScope {
     DEFINE_WRAPPERTYPEINFO();
 public:
-    static RawPtr<ServiceWorkerGlobalScope> create(ServiceWorkerThread*, PassOwnPtr<WorkerThreadStartupData>);
+    static ServiceWorkerGlobalScope* create(ServiceWorkerThread*, PassOwnPtr<WorkerThreadStartupData>);
 
     ~ServiceWorkerGlobalScope() override;
     bool isServiceWorkerGlobalScope() const override { return true; }
@@ -74,12 +74,12 @@
 
     ScriptPromise skipWaiting(ScriptState*);
 
-    void setRegistration(WebPassOwnPtr<WebServiceWorkerRegistration::Handle>);
+    void setRegistration(std::unique_ptr<WebServiceWorkerRegistration::Handle>);
 
     // EventTarget
     const AtomicString& interfaceName() const override;
 
-    void dispatchExtendableEvent(RawPtr<Event>, WaitUntilObserver*);
+    void dispatchExtendableEvent(Event*, WaitUntilObserver*);
 
     DEFINE_ATTRIBUTE_EVENT_LISTENER(install);
     DEFINE_ATTRIBUTE_EVENT_LISTENER(activate);
@@ -95,7 +95,7 @@
     bool addEventListenerInternal(const AtomicString& eventType, EventListener*, const EventListenerOptions&) override;
 
 private:
-    ServiceWorkerGlobalScope(const KURL&, const String& userAgent, ServiceWorkerThread*, double timeOrigin, PassOwnPtr<SecurityOrigin::PrivilegeData>, RawPtr<WorkerClients>);
+    ServiceWorkerGlobalScope(const KURL&, const String& userAgent, ServiceWorkerThread*, double timeOrigin, PassOwnPtr<SecurityOrigin::PrivilegeData>, WorkerClients*);
     void importScripts(const Vector<String>& urls, ExceptionState&) override;
     CachedMetadataHandler* createWorkerScriptCachedMetadataHandler(const KURL& scriptURL, const Vector<char>* metaData) override;
     void logExceptionToConsole(const String& errorMessage, int scriptId, const String& sourceURL, int lineNumber, int columnNumber, PassRefPtr<ScriptCallStack>) override;

diff --git a/third_party/WebKit/Source/modules/serviceworkers/ServiceWorkerGlobalScopeClient.cpp b/third_party/WebKit/Source/modules/serviceworkers/ServiceWorkerGlobalScopeClient.cpp
index acfda7b..a295a23a 100644
--- a/third_party/WebKit/Source/modules/serviceworkers/ServiceWorkerGlobalScopeClient.cpp
+++ b/third_party/WebKit/Source/modules/serviceworkers/ServiceWorkerGlobalScopeClient.cpp

@@ -47,7 +47,7 @@
     return static_cast<ServiceWorkerGlobalScopeClient*>(Supplement<WorkerClients>::from(clients, supplementName()));
 }
 
-void provideServiceWorkerGlobalScopeClientToWorker(WorkerClients* clients, RawPtr<ServiceWorkerGlobalScopeClient> client)
+void provideServiceWorkerGlobalScopeClientToWorker(WorkerClients* clients, ServiceWorkerGlobalScopeClient* client)
 {
     clients->provideSupplement(ServiceWorkerGlobalScopeClient::supplementName(), client);
 }

diff --git a/third_party/WebKit/Source/modules/serviceworkers/ServiceWorkerGlobalScopeClient.h b/third_party/WebKit/Source/modules/serviceworkers/ServiceWorkerGlobalScopeClient.h
index 7ec0d21..91d839f 100644
--- a/third_party/WebKit/Source/modules/serviceworkers/ServiceWorkerGlobalScopeClient.h
+++ b/third_party/WebKit/Source/modules/serviceworkers/ServiceWorkerGlobalScopeClient.h

@@ -94,7 +94,7 @@
     ServiceWorkerGlobalScopeClient() { }
 };
 
-MODULES_EXPORT void provideServiceWorkerGlobalScopeClientToWorker(WorkerClients*, RawPtr<ServiceWorkerGlobalScopeClient>);
+MODULES_EXPORT void provideServiceWorkerGlobalScopeClientToWorker(WorkerClients*, ServiceWorkerGlobalScopeClient*);
 
 } // namespace blink
 

diff --git a/third_party/WebKit/Source/modules/serviceworkers/ServiceWorkerLinkResource.cpp b/third_party/WebKit/Source/modules/serviceworkers/ServiceWorkerLinkResource.cpp
index e7aacb6..b7883a1 100644
--- a/third_party/WebKit/Source/modules/serviceworkers/ServiceWorkerLinkResource.cpp
+++ b/third_party/WebKit/Source/modules/serviceworkers/ServiceWorkerLinkResource.cpp

@@ -22,7 +22,7 @@
     explicit RegistrationCallback(LinkLoaderClient* client) : m_client(client) {}
     ~RegistrationCallback() override {}
 
-    void onSuccess(WebPassOwnPtr<WebServiceWorkerRegistration::Handle> handle) override
+    void onSuccess(std::unique_ptr<WebServiceWorkerRegistration::Handle> handle) override
     {
         Platform::current()->currentThread()->scheduler()->timerTaskRunner()->postTask(BLINK_FROM_HERE, bind(&LinkLoaderClient::linkLoaded, m_client));
     }
@@ -40,7 +40,7 @@
 
 }
 
-RawPtr<ServiceWorkerLinkResource> ServiceWorkerLinkResource::create(HTMLLinkElement* owner)
+ServiceWorkerLinkResource* ServiceWorkerLinkResource::create(HTMLLinkElement* owner)
 {
     return new ServiceWorkerLinkResource(owner);
 }

diff --git a/third_party/WebKit/Source/modules/serviceworkers/ServiceWorkerLinkResource.h b/third_party/WebKit/Source/modules/serviceworkers/ServiceWorkerLinkResource.h
index 4e6a4dae..5ea5f60 100644
--- a/third_party/WebKit/Source/modules/serviceworkers/ServiceWorkerLinkResource.h
+++ b/third_party/WebKit/Source/modules/serviceworkers/ServiceWorkerLinkResource.h

@@ -18,7 +18,7 @@
 class MODULES_EXPORT ServiceWorkerLinkResource final : public LinkResource {
 public:
 
-    static RawPtr<ServiceWorkerLinkResource> create(HTMLLinkElement* owner);
+    static ServiceWorkerLinkResource* create(HTMLLinkElement* owner);
 
     ~ServiceWorkerLinkResource() override;
 

diff --git a/third_party/WebKit/Source/modules/serviceworkers/ServiceWorkerMessageEvent.h b/third_party/WebKit/Source/modules/serviceworkers/ServiceWorkerMessageEvent.h
index 6e6f5a60..d1744d2 100644
--- a/third_party/WebKit/Source/modules/serviceworkers/ServiceWorkerMessageEvent.h
+++ b/third_party/WebKit/Source/modules/serviceworkers/ServiceWorkerMessageEvent.h

@@ -16,17 +16,17 @@
 class MODULES_EXPORT ServiceWorkerMessageEvent final : public Event {
     DEFINE_WRAPPERTYPEINFO();
 public:
-    static RawPtr<ServiceWorkerMessageEvent> create()
+    static ServiceWorkerMessageEvent* create()
     {
         return new ServiceWorkerMessageEvent;
     }
 
-    static RawPtr<ServiceWorkerMessageEvent> create(const AtomicString& type, const ServiceWorkerMessageEventInit& initializer)
+    static ServiceWorkerMessageEvent* create(const AtomicString& type, const ServiceWorkerMessageEventInit& initializer)
     {
         return new ServiceWorkerMessageEvent(type, initializer);
     }
 
-    static RawPtr<ServiceWorkerMessageEvent> create(MessagePortArray* ports, PassRefPtr<SerializedScriptValue> data, ServiceWorker* source, const String& origin)
+    static ServiceWorkerMessageEvent* create(MessagePortArray* ports, PassRefPtr<SerializedScriptValue> data, ServiceWorker* source, const String& origin)
     {
         return new ServiceWorkerMessageEvent(data, origin, String(), source, ports);
     }

diff --git a/third_party/WebKit/Source/modules/serviceworkers/ServiceWorkerRegistration.cpp b/third_party/WebKit/Source/modules/serviceworkers/ServiceWorkerRegistration.cpp
index 9044c03..f0490d96 100644
--- a/third_party/WebKit/Source/modules/serviceworkers/ServiceWorkerRegistration.cpp
+++ b/third_party/WebKit/Source/modules/serviceworkers/ServiceWorkerRegistration.cpp

@@ -28,25 +28,25 @@
     dispatchEvent(Event::create(EventTypeNames::updatefound));
 }
 
-void ServiceWorkerRegistration::setInstalling(WebPassOwnPtr<WebServiceWorker::Handle> handle)
+void ServiceWorkerRegistration::setInstalling(std::unique_ptr<WebServiceWorker::Handle> handle)
 {
     if (!getExecutionContext())
         return;
-    m_installing = ServiceWorker::from(getExecutionContext(), handle.release());
+    m_installing = ServiceWorker::from(getExecutionContext(), adoptPtr(handle.release()));
 }
 
-void ServiceWorkerRegistration::setWaiting(WebPassOwnPtr<WebServiceWorker::Handle> handle)
+void ServiceWorkerRegistration::setWaiting(std::unique_ptr<WebServiceWorker::Handle> handle)
 {
     if (!getExecutionContext())
         return;
-    m_waiting = ServiceWorker::from(getExecutionContext(), handle.release());
+    m_waiting = ServiceWorker::from(getExecutionContext(), adoptPtr(handle.release()));
 }
 
-void ServiceWorkerRegistration::setActive(WebPassOwnPtr<WebServiceWorker::Handle> handle)
+void ServiceWorkerRegistration::setActive(std::unique_ptr<WebServiceWorker::Handle> handle)
 {
     if (!getExecutionContext())
         return;
-    m_active = ServiceWorker::from(getExecutionContext(), handle.release());
+    m_active = ServiceWorker::from(getExecutionContext(), adoptPtr(handle.release()));
 }
 
 ServiceWorkerRegistration* ServiceWorkerRegistration::getOrCreate(ExecutionContext* executionContext, PassOwnPtr<WebServiceWorkerRegistration::Handle> handle)

diff --git a/third_party/WebKit/Source/modules/serviceworkers/ServiceWorkerRegistration.h b/third_party/WebKit/Source/modules/serviceworkers/ServiceWorkerRegistration.h
index 196eace..a9f546c 100644
--- a/third_party/WebKit/Source/modules/serviceworkers/ServiceWorkerRegistration.h
+++ b/third_party/WebKit/Source/modules/serviceworkers/ServiceWorkerRegistration.h

@@ -44,9 +44,9 @@
 
     // WebServiceWorkerRegistrationProxy overrides.
     void dispatchUpdateFoundEvent() override;
-    void setInstalling(WebPassOwnPtr<WebServiceWorker::Handle>) override;
-    void setWaiting(WebPassOwnPtr<WebServiceWorker::Handle>) override;
-    void setActive(WebPassOwnPtr<WebServiceWorker::Handle>) override;
+    void setInstalling(std::unique_ptr<WebServiceWorker::Handle>) override;
+    void setWaiting(std::unique_ptr<WebServiceWorker::Handle>) override;
+    void setActive(std::unique_ptr<WebServiceWorker::Handle>) override;
 
     // Returns an existing registration object for the handle if it exists.
     // Otherwise, returns a new registration object.

diff --git a/third_party/WebKit/Source/modules/serviceworkers/ServiceWorkerScriptCachedMetadataHandler.h b/third_party/WebKit/Source/modules/serviceworkers/ServiceWorkerScriptCachedMetadataHandler.h
index 860af08..a6beb078 100644
--- a/third_party/WebKit/Source/modules/serviceworkers/ServiceWorkerScriptCachedMetadataHandler.h
+++ b/third_party/WebKit/Source/modules/serviceworkers/ServiceWorkerScriptCachedMetadataHandler.h

@@ -18,7 +18,7 @@
 
 class ServiceWorkerScriptCachedMetadataHandler : public CachedMetadataHandler {
 public:
-    static RawPtr<ServiceWorkerScriptCachedMetadataHandler> create(WorkerGlobalScope* workerGlobalScope, const KURL& scriptURL, const Vector<char>* metaData)
+    static ServiceWorkerScriptCachedMetadataHandler* create(WorkerGlobalScope* workerGlobalScope, const KURL& scriptURL, const Vector<char>* metaData)
     {
         return new ServiceWorkerScriptCachedMetadataHandler(workerGlobalScope, scriptURL, metaData);
     }

diff --git a/third_party/WebKit/Source/modules/serviceworkers/ServiceWorkerWindowClientCallback.cpp b/third_party/WebKit/Source/modules/serviceworkers/ServiceWorkerWindowClientCallback.cpp
index f6387fc..2658542 100644
--- a/third_party/WebKit/Source/modules/serviceworkers/ServiceWorkerWindowClientCallback.cpp
+++ b/third_party/WebKit/Source/modules/serviceworkers/ServiceWorkerWindowClientCallback.cpp

@@ -11,11 +11,11 @@
 
 namespace blink {
 
-void NavigateClientCallback::onSuccess(WebPassOwnPtr<WebServiceWorkerClientInfo> clientInfo)
+void NavigateClientCallback::onSuccess(std::unique_ptr<WebServiceWorkerClientInfo> clientInfo)
 {
     if (!m_resolver->getExecutionContext() || m_resolver->getExecutionContext()->activeDOMObjectsAreStopped())
         return;
-    m_resolver->resolve(ServiceWorkerWindowClient::take(m_resolver.get(), clientInfo.release()));
+    m_resolver->resolve(ServiceWorkerWindowClient::take(m_resolver.get(), adoptPtr(clientInfo.release())));
 }
 
 void NavigateClientCallback::onError(const WebServiceWorkerError& error)

diff --git a/third_party/WebKit/Source/modules/serviceworkers/ServiceWorkerWindowClientCallback.h b/third_party/WebKit/Source/modules/serviceworkers/ServiceWorkerWindowClientCallback.h
index f81fdef0..e6da3578 100644
--- a/third_party/WebKit/Source/modules/serviceworkers/ServiceWorkerWindowClientCallback.h
+++ b/third_party/WebKit/Source/modules/serviceworkers/ServiceWorkerWindowClientCallback.h

@@ -16,7 +16,7 @@
     explicit NavigateClientCallback(ScriptPromiseResolver* resolver)
         : m_resolver(resolver) { }
 
-    void onSuccess(WebPassOwnPtr<WebServiceWorkerClientInfo>) override;
+    void onSuccess(std::unique_ptr<WebServiceWorkerClientInfo>) override;
     void onError(const WebServiceWorkerError&) override;
 
 private:

diff --git a/third_party/WebKit/Source/modules/speech/SpeechRecognition.cpp b/third_party/WebKit/Source/modules/speech/SpeechRecognition.cpp
index 206b7fd..74e0aaf 100644
--- a/third_party/WebKit/Source/modules/speech/SpeechRecognition.cpp
+++ b/third_party/WebKit/Source/modules/speech/SpeechRecognition.cpp

@@ -132,7 +132,7 @@
     dispatchEvent(SpeechRecognitionEvent::createNoMatch(result));
 }
 
-void SpeechRecognition::didReceiveError(RawPtr<SpeechRecognitionError> error)
+void SpeechRecognition::didReceiveError(SpeechRecognitionError* error)
 {
     dispatchEvent(error);
     m_started = false;

diff --git a/third_party/WebKit/Source/modules/speech/SpeechRecognition.h b/third_party/WebKit/Source/modules/speech/SpeechRecognition.h
index 76616b4..9384547 100644
--- a/third_party/WebKit/Source/modules/speech/SpeechRecognition.h
+++ b/third_party/WebKit/Source/modules/speech/SpeechRecognition.h

@@ -83,7 +83,7 @@
     void didEndAudio();
     void didReceiveResults(const HeapVector<Member<SpeechRecognitionResult>>& newFinalResults, const HeapVector<Member<SpeechRecognitionResult>>& currentInterimResults);
     void didReceiveNoMatch(SpeechRecognitionResult*);
-    void didReceiveError(RawPtr<SpeechRecognitionError>);
+    void didReceiveError(SpeechRecognitionError*);
     void didStart();
     void didEnd();
 

diff --git a/third_party/WebKit/Source/modules/speech/SpeechRecognitionController.cpp b/third_party/WebKit/Source/modules/speech/SpeechRecognitionController.cpp
index 70d7500..0a6d094c 100644
--- a/third_party/WebKit/Source/modules/speech/SpeechRecognitionController.cpp
+++ b/third_party/WebKit/Source/modules/speech/SpeechRecognitionController.cpp

@@ -42,7 +42,7 @@
     // FIXME: Call m_client->pageDestroyed(); once we have implemented a client.
 }
 
-RawPtr<SpeechRecognitionController> SpeechRecognitionController::create(PassOwnPtr<SpeechRecognitionClient> client)
+SpeechRecognitionController* SpeechRecognitionController::create(PassOwnPtr<SpeechRecognitionClient> client)
 {
     return new SpeechRecognitionController(client);
 }

diff --git a/third_party/WebKit/Source/modules/speech/SpeechRecognitionController.h b/third_party/WebKit/Source/modules/speech/SpeechRecognitionController.h
index 962ef10..6eced0e 100644
--- a/third_party/WebKit/Source/modules/speech/SpeechRecognitionController.h
+++ b/third_party/WebKit/Source/modules/speech/SpeechRecognitionController.h

@@ -47,7 +47,7 @@
     void stop(SpeechRecognition* recognition) { m_client->stop(recognition); }
     void abort(SpeechRecognition* recognition) { m_client->abort(recognition); }
 
-    static RawPtr<SpeechRecognitionController> create(PassOwnPtr<SpeechRecognitionClient>);
+    static SpeechRecognitionController* create(PassOwnPtr<SpeechRecognitionClient>);
     static const char* supplementName();
     static SpeechRecognitionController* from(Page* page) { return static_cast<SpeechRecognitionController*>(Supplement<Page>::from(page, supplementName())); }
 

diff --git a/third_party/WebKit/Source/modules/speech/SpeechRecognitionError.cpp b/third_party/WebKit/Source/modules/speech/SpeechRecognitionError.cpp
index 7cf44d68..6831fbd0 100644
--- a/third_party/WebKit/Source/modules/speech/SpeechRecognitionError.cpp
+++ b/third_party/WebKit/Source/modules/speech/SpeechRecognitionError.cpp

@@ -54,17 +54,17 @@
     return String();
 }
 
-RawPtr<SpeechRecognitionError> SpeechRecognitionError::create(ErrorCode code, const String& message)
+SpeechRecognitionError* SpeechRecognitionError::create(ErrorCode code, const String& message)
 {
     return new SpeechRecognitionError(ErrorCodeToString(code), message);
 }
 
-RawPtr<SpeechRecognitionError> SpeechRecognitionError::create()
+SpeechRecognitionError* SpeechRecognitionError::create()
 {
     return new SpeechRecognitionError(emptyString(), emptyString());
 }
 
-RawPtr<SpeechRecognitionError> SpeechRecognitionError::create(const AtomicString& eventName, const SpeechRecognitionErrorInit& initializer)
+SpeechRecognitionError* SpeechRecognitionError::create(const AtomicString& eventName, const SpeechRecognitionErrorInit& initializer)
 {
     return new SpeechRecognitionError(eventName, initializer);
 }

diff --git a/third_party/WebKit/Source/modules/speech/SpeechRecognitionError.h b/third_party/WebKit/Source/modules/speech/SpeechRecognitionError.h
index 17d9a00..d2ee32e 100644
--- a/third_party/WebKit/Source/modules/speech/SpeechRecognitionError.h
+++ b/third_party/WebKit/Source/modules/speech/SpeechRecognitionError.h

@@ -50,9 +50,9 @@
         ErrorCodeLanguageNotSupported = 8
     };
 
-    static RawPtr<SpeechRecognitionError> create(ErrorCode, const String&);
-    static RawPtr<SpeechRecognitionError> create();
-    static RawPtr<SpeechRecognitionError> create(const AtomicString&, const SpeechRecognitionErrorInit&);
+    static SpeechRecognitionError* create(ErrorCode, const String&);
+    static SpeechRecognitionError* create();
+    static SpeechRecognitionError* create(const AtomicString&, const SpeechRecognitionErrorInit&);
 
     const String& error() { return m_error; }
     const String& message() { return m_message; }

diff --git a/third_party/WebKit/Source/modules/speech/SpeechRecognitionEvent.cpp b/third_party/WebKit/Source/modules/speech/SpeechRecognitionEvent.cpp
index 6cdd4c0..8343dec 100644
--- a/third_party/WebKit/Source/modules/speech/SpeechRecognitionEvent.cpp
+++ b/third_party/WebKit/Source/modules/speech/SpeechRecognitionEvent.cpp

@@ -27,22 +27,22 @@
 
 namespace blink {
 
-RawPtr<SpeechRecognitionEvent> SpeechRecognitionEvent::create()
+SpeechRecognitionEvent* SpeechRecognitionEvent::create()
 {
     return new SpeechRecognitionEvent;
 }
 
-RawPtr<SpeechRecognitionEvent> SpeechRecognitionEvent::create(const AtomicString& eventName, const SpeechRecognitionEventInit& initializer)
+SpeechRecognitionEvent* SpeechRecognitionEvent::create(const AtomicString& eventName, const SpeechRecognitionEventInit& initializer)
 {
     return new SpeechRecognitionEvent(eventName, initializer);
 }
 
-RawPtr<SpeechRecognitionEvent> SpeechRecognitionEvent::createResult(unsigned long resultIndex, const HeapVector<Member<SpeechRecognitionResult>>& results)
+SpeechRecognitionEvent* SpeechRecognitionEvent::createResult(unsigned long resultIndex, const HeapVector<Member<SpeechRecognitionResult>>& results)
 {
     return new SpeechRecognitionEvent(EventTypeNames::result, resultIndex, SpeechRecognitionResultList::create(results));
 }
 
-RawPtr<SpeechRecognitionEvent> SpeechRecognitionEvent::createNoMatch(SpeechRecognitionResult* result)
+SpeechRecognitionEvent* SpeechRecognitionEvent::createNoMatch(SpeechRecognitionResult* result)
 {
     if (result) {
         HeapVector<Member<SpeechRecognitionResult>> results;

diff --git a/third_party/WebKit/Source/modules/speech/SpeechRecognitionEvent.h b/third_party/WebKit/Source/modules/speech/SpeechRecognitionEvent.h
index b43a237c..3d1d217 100644
--- a/third_party/WebKit/Source/modules/speech/SpeechRecognitionEvent.h
+++ b/third_party/WebKit/Source/modules/speech/SpeechRecognitionEvent.h

@@ -39,12 +39,12 @@
 class SpeechRecognitionEvent final : public Event {
     DEFINE_WRAPPERTYPEINFO();
 public:
-    static RawPtr<SpeechRecognitionEvent> create();
-    static RawPtr<SpeechRecognitionEvent> create(const AtomicString&, const SpeechRecognitionEventInit&);
+    static SpeechRecognitionEvent* create();
+    static SpeechRecognitionEvent* create(const AtomicString&, const SpeechRecognitionEventInit&);
     ~SpeechRecognitionEvent() override;
 
-    static RawPtr<SpeechRecognitionEvent> createResult(unsigned long resultIndex, const HeapVector<Member<SpeechRecognitionResult>>& results);
-    static RawPtr<SpeechRecognitionEvent> createNoMatch(SpeechRecognitionResult*);
+    static SpeechRecognitionEvent* createResult(unsigned long resultIndex, const HeapVector<Member<SpeechRecognitionResult>>& results);
+    static SpeechRecognitionEvent* createNoMatch(SpeechRecognitionResult*);
 
     unsigned long resultIndex() const { return m_resultIndex; }
     SpeechRecognitionResultList* results() const { return m_results; }

diff --git a/third_party/WebKit/Source/modules/speech/SpeechSynthesisEvent.cpp b/third_party/WebKit/Source/modules/speech/SpeechSynthesisEvent.cpp
index a1e58ba..2798b24 100644
--- a/third_party/WebKit/Source/modules/speech/SpeechSynthesisEvent.cpp
+++ b/third_party/WebKit/Source/modules/speech/SpeechSynthesisEvent.cpp

@@ -27,12 +27,12 @@
 
 namespace blink {
 
-RawPtr<SpeechSynthesisEvent> SpeechSynthesisEvent::create()
+SpeechSynthesisEvent* SpeechSynthesisEvent::create()
 {
     return new SpeechSynthesisEvent;
 }
 
-RawPtr<SpeechSynthesisEvent> SpeechSynthesisEvent::create(const AtomicString& type, SpeechSynthesisUtterance* utterance, unsigned charIndex, float elapsedTime, const String& name)
+SpeechSynthesisEvent* SpeechSynthesisEvent::create(const AtomicString& type, SpeechSynthesisUtterance* utterance, unsigned charIndex, float elapsedTime, const String& name)
 {
     return new SpeechSynthesisEvent(type, utterance, charIndex, elapsedTime, name);
 }

diff --git a/third_party/WebKit/Source/modules/speech/SpeechSynthesisEvent.h b/third_party/WebKit/Source/modules/speech/SpeechSynthesisEvent.h
index c8f7bdb1..c8d9148 100644
--- a/third_party/WebKit/Source/modules/speech/SpeechSynthesisEvent.h
+++ b/third_party/WebKit/Source/modules/speech/SpeechSynthesisEvent.h

@@ -34,8 +34,8 @@
 class SpeechSynthesisEvent final : public Event {
     DEFINE_WRAPPERTYPEINFO();
 public:
-    static RawPtr<SpeechSynthesisEvent> create();
-    static RawPtr<SpeechSynthesisEvent> create(const AtomicString& type, SpeechSynthesisUtterance*, unsigned charIndex, float elapsedTime, const String& name);
+    static SpeechSynthesisEvent* create();
+    static SpeechSynthesisEvent* create(const AtomicString& type, SpeechSynthesisUtterance*, unsigned charIndex, float elapsedTime, const String& name);
 
     SpeechSynthesisUtterance* utterance() const { return m_utterance; }
     unsigned charIndex() const { return m_charIndex; }

diff --git a/third_party/WebKit/Source/modules/storage/InspectorDOMStorageAgent.cpp b/third_party/WebKit/Source/modules/storage/InspectorDOMStorageAgent.cpp
index 0ad8ef79..91dd2155 100644
--- a/third_party/WebKit/Source/modules/storage/InspectorDOMStorageAgent.cpp
+++ b/third_party/WebKit/Source/modules/storage/InspectorDOMStorageAgent.cpp

@@ -199,7 +199,7 @@
     if (!m_page->mainFrame()->isLocalFrame())
         return nullptr;
 
-    RawPtr<InspectedFrames> inspectedFrames = InspectedFrames::create(m_page->deprecatedLocalMainFrame());
+    InspectedFrames* inspectedFrames = InspectedFrames::create(m_page->deprecatedLocalMainFrame());
     LocalFrame* frame = inspectedFrames->frameWithSecurityOrigin(securityOrigin);
     if (!frame) {
         if (errorString)

diff --git a/third_party/WebKit/Source/modules/storage/InspectorDOMStorageAgent.h b/third_party/WebKit/Source/modules/storage/InspectorDOMStorageAgent.h
index f16c95c..6381c9ed 100644
--- a/third_party/WebKit/Source/modules/storage/InspectorDOMStorageAgent.h
+++ b/third_party/WebKit/Source/modules/storage/InspectorDOMStorageAgent.h

@@ -49,7 +49,7 @@
 
 class MODULES_EXPORT InspectorDOMStorageAgent final : public InspectorBaseAgent<InspectorDOMStorageAgent, protocol::Frontend::DOMStorage>, public protocol::Backend::DOMStorage {
 public:
-    static RawPtr<InspectorDOMStorageAgent> create(Page* page)
+    static InspectorDOMStorageAgent* create(Page* page)
     {
         return new InspectorDOMStorageAgent(page);
     }

diff --git a/third_party/WebKit/Source/modules/storage/StorageEvent.cpp b/third_party/WebKit/Source/modules/storage/StorageEvent.cpp
index aa5596d..b18c5032 100644
--- a/third_party/WebKit/Source/modules/storage/StorageEvent.cpp
+++ b/third_party/WebKit/Source/modules/storage/StorageEvent.cpp

@@ -31,7 +31,7 @@
 
 namespace blink {
 
-RawPtr<StorageEvent> StorageEvent::create()
+StorageEvent* StorageEvent::create()
 {
     return new StorageEvent;
 }
@@ -44,12 +44,12 @@
 {
 }
 
-RawPtr<StorageEvent> StorageEvent::create(const AtomicString& type, const String& key, const String& oldValue, const String& newValue, const String& url, Storage* storageArea)
+StorageEvent* StorageEvent::create(const AtomicString& type, const String& key, const String& oldValue, const String& newValue, const String& url, Storage* storageArea)
 {
     return new StorageEvent(type, key, oldValue, newValue, url, storageArea);
 }
 
-RawPtr<StorageEvent> StorageEvent::create(const AtomicString& type, const StorageEventInit& initializer)
+StorageEvent* StorageEvent::create(const AtomicString& type, const StorageEventInit& initializer)
 {
     return new StorageEvent(type, initializer);
 }

diff --git a/third_party/WebKit/Source/modules/storage/StorageEvent.h b/third_party/WebKit/Source/modules/storage/StorageEvent.h
index 63e1352..a261d14 100644
--- a/third_party/WebKit/Source/modules/storage/StorageEvent.h
+++ b/third_party/WebKit/Source/modules/storage/StorageEvent.h

@@ -38,9 +38,9 @@
 class StorageEvent final : public Event {
     DEFINE_WRAPPERTYPEINFO();
 public:
-    static RawPtr<StorageEvent> create();
-    static RawPtr<StorageEvent> create(const AtomicString& type, const String& key, const String& oldValue, const String& newValue, const String& url, Storage* storageArea);
-    static RawPtr<StorageEvent> create(const AtomicString&, const StorageEventInit&);
+    static StorageEvent* create();
+    static StorageEvent* create(const AtomicString& type, const String& key, const String& oldValue, const String& newValue, const String& url, Storage* storageArea);
+    static StorageEvent* create(const AtomicString&, const StorageEventInit&);
     ~StorageEvent() override;
 
     const String& key() const { return m_key; }

diff --git a/third_party/WebKit/Source/modules/webaudio/AudioProcessingEvent.cpp b/third_party/WebKit/Source/modules/webaudio/AudioProcessingEvent.cpp
index bc8a3ae35..faef1e2b 100644
--- a/third_party/WebKit/Source/modules/webaudio/AudioProcessingEvent.cpp
+++ b/third_party/WebKit/Source/modules/webaudio/AudioProcessingEvent.cpp

@@ -26,12 +26,12 @@
 
 namespace blink {
 
-RawPtr<AudioProcessingEvent> AudioProcessingEvent::create()
+AudioProcessingEvent* AudioProcessingEvent::create()
 {
     return new AudioProcessingEvent;
 }
 
-RawPtr<AudioProcessingEvent> AudioProcessingEvent::create(AudioBuffer* inputBuffer, AudioBuffer* outputBuffer, double playbackTime)
+AudioProcessingEvent* AudioProcessingEvent::create(AudioBuffer* inputBuffer, AudioBuffer* outputBuffer, double playbackTime)
 {
     return new AudioProcessingEvent(inputBuffer, outputBuffer, playbackTime);
 }

diff --git a/third_party/WebKit/Source/modules/webaudio/AudioProcessingEvent.h b/third_party/WebKit/Source/modules/webaudio/AudioProcessingEvent.h
index f782ba40..2460b81 100644
--- a/third_party/WebKit/Source/modules/webaudio/AudioProcessingEvent.h
+++ b/third_party/WebKit/Source/modules/webaudio/AudioProcessingEvent.h

@@ -37,8 +37,8 @@
 class AudioProcessingEvent final : public Event {
     DEFINE_WRAPPERTYPEINFO();
 public:
-    static RawPtr<AudioProcessingEvent> create();
-    static RawPtr<AudioProcessingEvent> create(AudioBuffer* inputBuffer, AudioBuffer* outputBuffer, double playbackTime);
+    static AudioProcessingEvent* create();
+    static AudioProcessingEvent* create(AudioBuffer* inputBuffer, AudioBuffer* outputBuffer, double playbackTime);
 
     ~AudioProcessingEvent() override;
 

diff --git a/third_party/WebKit/Source/modules/webaudio/AudioScheduledSourceNode.cpp b/third_party/WebKit/Source/modules/webaudio/AudioScheduledSourceNode.cpp
index 0291b36..5123b3d 100644
--- a/third_party/WebKit/Source/modules/webaudio/AudioScheduledSourceNode.cpp
+++ b/third_party/WebKit/Source/modules/webaudio/AudioScheduledSourceNode.cpp

@@ -259,7 +259,7 @@
     return getAttributeEventListener(EventTypeNames::ended);
 }
 
-void AudioScheduledSourceNode::setOnended(RawPtr<EventListener> listener)
+void AudioScheduledSourceNode::setOnended(EventListener* listener)
 {
     setAttributeEventListener(EventTypeNames::ended, listener);
 }

diff --git a/third_party/WebKit/Source/modules/webaudio/AudioScheduledSourceNode.h b/third_party/WebKit/Source/modules/webaudio/AudioScheduledSourceNode.h
index 89b60e69..d0cd060a 100644
--- a/third_party/WebKit/Source/modules/webaudio/AudioScheduledSourceNode.h
+++ b/third_party/WebKit/Source/modules/webaudio/AudioScheduledSourceNode.h

@@ -129,7 +129,7 @@
     void stop(double when, ExceptionState&);
 
     EventListener* onended();
-    void setOnended(RawPtr<EventListener>);
+    void setOnended(EventListener*);
 
     // ActiveScriptWrappable
     bool hasPendingActivity() const final;

diff --git a/third_party/WebKit/Source/modules/webaudio/OfflineAudioCompletionEvent.cpp b/third_party/WebKit/Source/modules/webaudio/OfflineAudioCompletionEvent.cpp
index 13aa884e..ee002219 100644
--- a/third_party/WebKit/Source/modules/webaudio/OfflineAudioCompletionEvent.cpp
+++ b/third_party/WebKit/Source/modules/webaudio/OfflineAudioCompletionEvent.cpp

@@ -26,12 +26,12 @@
 
 namespace blink {
 
-RawPtr<OfflineAudioCompletionEvent> OfflineAudioCompletionEvent::create()
+OfflineAudioCompletionEvent* OfflineAudioCompletionEvent::create()
 {
     return new OfflineAudioCompletionEvent;
 }
 
-RawPtr<OfflineAudioCompletionEvent> OfflineAudioCompletionEvent::create(AudioBuffer* renderedBuffer)
+OfflineAudioCompletionEvent* OfflineAudioCompletionEvent::create(AudioBuffer* renderedBuffer)
 {
     return new OfflineAudioCompletionEvent(renderedBuffer);
 }

diff --git a/third_party/WebKit/Source/modules/webaudio/OfflineAudioCompletionEvent.h b/third_party/WebKit/Source/modules/webaudio/OfflineAudioCompletionEvent.h
index 50fcaf4..1974269 100644
--- a/third_party/WebKit/Source/modules/webaudio/OfflineAudioCompletionEvent.h
+++ b/third_party/WebKit/Source/modules/webaudio/OfflineAudioCompletionEvent.h

@@ -37,8 +37,8 @@
 class OfflineAudioCompletionEvent final : public Event {
     DEFINE_WRAPPERTYPEINFO();
 public:
-    static RawPtr<OfflineAudioCompletionEvent> create();
-    static RawPtr<OfflineAudioCompletionEvent> create(AudioBuffer* renderedBuffer);
+    static OfflineAudioCompletionEvent* create();
+    static OfflineAudioCompletionEvent* create(AudioBuffer* renderedBuffer);
 
     ~OfflineAudioCompletionEvent() override;
 

diff --git a/third_party/WebKit/Source/modules/webdatabase/DatabaseClient.cpp b/third_party/WebKit/Source/modules/webdatabase/DatabaseClient.cpp
index 67eab9f..88c2fab 100644
--- a/third_party/WebKit/Source/modules/webdatabase/DatabaseClient.cpp
+++ b/third_party/WebKit/Source/modules/webdatabase/DatabaseClient.cpp

@@ -73,7 +73,7 @@
     m_inspectorAgent = agent;
 }
 
-void provideDatabaseClientTo(Page& page, RawPtr<DatabaseClient> client)
+void provideDatabaseClientTo(Page& page, DatabaseClient* client)
 {
     page.provideSupplement(DatabaseClient::supplementName(), client);
 }

diff --git a/third_party/WebKit/Source/modules/webdatabase/DatabaseClient.h b/third_party/WebKit/Source/modules/webdatabase/DatabaseClient.h
index 5c9542e..a75db206 100644
--- a/third_party/WebKit/Source/modules/webdatabase/DatabaseClient.h
+++ b/third_party/WebKit/Source/modules/webdatabase/DatabaseClient.h

@@ -66,7 +66,7 @@
     Member<InspectorDatabaseAgent> m_inspectorAgent;
 };
 
-MODULES_EXPORT void provideDatabaseClientTo(Page&, RawPtr<DatabaseClient>);
+MODULES_EXPORT void provideDatabaseClientTo(Page&, DatabaseClient*);
 
 } // namespace blink
 

diff --git a/third_party/WebKit/Source/modules/webdatabase/InspectorDatabaseAgent.h b/third_party/WebKit/Source/modules/webdatabase/InspectorDatabaseAgent.h
index a84daa8..e5c19e785 100644
--- a/third_party/WebKit/Source/modules/webdatabase/InspectorDatabaseAgent.h
+++ b/third_party/WebKit/Source/modules/webdatabase/InspectorDatabaseAgent.h

@@ -48,7 +48,7 @@
 class MODULES_EXPORT InspectorDatabaseAgent final : public InspectorBaseAgent<InspectorDatabaseAgent, protocol::Frontend::Database>, public protocol::Backend::Database {
     WTF_MAKE_NONCOPYABLE(InspectorDatabaseAgent);
 public:
-    static RawPtr<InspectorDatabaseAgent> create(Page* page)
+    static InspectorDatabaseAgent* create(Page* page)
     {
         return new InspectorDatabaseAgent(page);
     }

diff --git a/third_party/WebKit/Source/modules/webgl/WebGL2RenderingContext.cpp b/third_party/WebKit/Source/modules/webgl/WebGL2RenderingContext.cpp
index 813b2a2..588a81e 100644
--- a/third_party/WebKit/Source/modules/webgl/WebGL2RenderingContext.cpp
+++ b/third_party/WebKit/Source/modules/webgl/WebGL2RenderingContext.cpp

@@ -31,7 +31,7 @@
 
 namespace blink {
 
-RawPtr<CanvasRenderingContext> WebGL2RenderingContext::Factory::create(HTMLCanvasElement* canvas, const CanvasContextCreationAttributes& attrs, Document&)
+CanvasRenderingContext* WebGL2RenderingContext::Factory::create(HTMLCanvasElement* canvas, const CanvasContextCreationAttributes& attrs, Document&)
 {
     if (!RuntimeEnabledFeatures::unsafeES3APIsEnabled()) {
         canvas->dispatchEvent(WebGLContextEvent::create(EventTypeNames::webglcontextcreationerror, false, true, "Creation of WebGL2 contexts disabled."));
@@ -51,7 +51,7 @@
         gl->PushGroupMarkerEXT(0, contextLabel.ascii().data());
     }
 
-    RawPtr<WebGL2RenderingContext> renderingContext = new WebGL2RenderingContext(canvas, contextProvider.release(), attributes);
+    WebGL2RenderingContext* renderingContext = new WebGL2RenderingContext(canvas, contextProvider.release(), attributes);
 
     if (!renderingContext->drawingBuffer()) {
         canvas->dispatchEvent(WebGLContextEvent::create(EventTypeNames::webglcontextcreationerror, false, true, "Could not create a WebGL2 context."));
@@ -61,7 +61,7 @@
     renderingContext->initializeNewContext();
     renderingContext->registerContextExtensions();
 
-    return renderingContext.release();
+    return renderingContext;
 }
 
 void WebGL2RenderingContext::Factory::onError(HTMLCanvasElement* canvas, const String& error)
@@ -81,7 +81,7 @@
 
 void WebGL2RenderingContext::setCanvasGetContextResult(RenderingContext& result)
 {
-    result.setWebGL2RenderingContext(RawPtr<WebGL2RenderingContext>(this));
+    result.setWebGL2RenderingContext(this);
 }
 
 void WebGL2RenderingContext::registerContextExtensions()

diff --git a/third_party/WebKit/Source/modules/webgl/WebGL2RenderingContext.h b/third_party/WebKit/Source/modules/webgl/WebGL2RenderingContext.h
index bd1397a..5c1d8671 100644
--- a/third_party/WebKit/Source/modules/webgl/WebGL2RenderingContext.h
+++ b/third_party/WebKit/Source/modules/webgl/WebGL2RenderingContext.h

@@ -22,7 +22,7 @@
         Factory() {}
         ~Factory() override {}
 
-        RawPtr<CanvasRenderingContext> create(HTMLCanvasElement*, const CanvasContextCreationAttributes&, Document&) override;
+        CanvasRenderingContext* create(HTMLCanvasElement*, const CanvasContextCreationAttributes&, Document&) override;
         CanvasRenderingContext::ContextType getContextType() const override { return CanvasRenderingContext::ContextWebgl2; }
         void onError(HTMLCanvasElement*, const String& error) override;
     };

diff --git a/third_party/WebKit/Source/modules/webgl/WebGL2RenderingContextBase.cpp b/third_party/WebKit/Source/modules/webgl/WebGL2RenderingContextBase.cpp
index c1718301..8bd2343 100644
--- a/third_party/WebKit/Source/modules/webgl/WebGL2RenderingContextBase.cpp
+++ b/third_party/WebKit/Source/modules/webgl/WebGL2RenderingContextBase.cpp

@@ -906,7 +906,7 @@
     WebGLRenderingContextBase::texImage2D(target, level, internalformat, format, type, video, exceptionState);
 }
 
-void WebGL2RenderingContextBase::texImage2D(GLenum target, GLint level, GLint internalformat, GLenum format, GLenum type, RawPtr<ImageBitmap> imageBitMap, ExceptionState& exceptionState)
+void WebGL2RenderingContextBase::texImage2D(GLenum target, GLint level, GLint internalformat, GLenum format, GLenum type, ImageBitmap* imageBitMap, ExceptionState& exceptionState)
 {
     WebGLRenderingContextBase::texImage2D(target, level, internalformat, format, type, imageBitMap, exceptionState);
 }
@@ -942,7 +942,7 @@
 }
 
 void WebGL2RenderingContextBase::texSubImage2D(GLenum target, GLint level, GLint xoffset, GLint yoffset,
-    GLenum format, GLenum type, RawPtr<ImageBitmap> bitmap, ExceptionState& exceptionState)
+    GLenum format, GLenum type, ImageBitmap* bitmap, ExceptionState& exceptionState)
 {
     WebGLRenderingContextBase::texSubImage2D(target, level, xoffset, yoffset, format, type, bitmap, exceptionState);
 }
@@ -1169,11 +1169,11 @@
     texSubImage3DImpl(target, level, xoffset, yoffset, zoffset, format, type, image.get(), WebGLImageConversion::HtmlDomVideo, m_unpackFlipY, m_unpackPremultiplyAlpha);
 }
 
-void WebGL2RenderingContextBase::texSubImage3D(GLenum target, GLint level, GLint xoffset, GLint yoffset, GLint zoffset, GLenum format, GLenum type, RawPtr<ImageBitmap> bitmap, ExceptionState& exceptionState)
+void WebGL2RenderingContextBase::texSubImage3D(GLenum target, GLint level, GLint xoffset, GLint yoffset, GLint zoffset, GLenum format, GLenum type, ImageBitmap* bitmap, ExceptionState& exceptionState)
 {
     if (isContextLost())
         return;
-    if (!validateImageBitmap("texSubImage3D", bitmap.get(), exceptionState))
+    if (!validateImageBitmap("texSubImage3D", bitmap, exceptionState))
         return;
     if (!validateTexture3DBinding("texSubImage3D", target))
         return;

diff --git a/third_party/WebKit/Source/modules/webgl/WebGL2RenderingContextBase.h b/third_party/WebKit/Source/modules/webgl/WebGL2RenderingContextBase.h
index 2ab1d1c8..2d5b681 100644
--- a/third_party/WebKit/Source/modules/webgl/WebGL2RenderingContextBase.h
+++ b/third_party/WebKit/Source/modules/webgl/WebGL2RenderingContextBase.h

@@ -59,7 +59,7 @@
     void texImage2D(GLenum target, GLint level, GLint internalformat,
         GLenum format, GLenum type, HTMLVideoElement*, ExceptionState&);
     void texImage2D(GLenum target, GLint level, GLint internalformat,
-        GLenum format, GLenum type, RawPtr<ImageBitmap>, ExceptionState&);
+        GLenum format, GLenum type, ImageBitmap*, ExceptionState&);
     void texSubImage2D(GLenum target, GLint level, GLint xoffset, GLint yoffset,
         GLsizei width, GLsizei height,
         GLenum format, GLenum type, DOMArrayBufferView*);
@@ -72,7 +72,7 @@
     void texSubImage2D(GLenum target, GLint level, GLint xoffset, GLint yoffset,
         GLenum format, GLenum type, HTMLVideoElement*, ExceptionState&);
     void texSubImage2D(GLenum target, GLint level, GLint xoffset, GLint yoffset,
-        GLenum format, GLenum type, RawPtr<ImageBitmap>, ExceptionState&);
+        GLenum format, GLenum type, ImageBitmap*, ExceptionState&);
 
     void texStorage2D(GLenum, GLsizei, GLenum, GLsizei, GLsizei);
     void texStorage3D(GLenum, GLsizei, GLenum, GLsizei, GLsizei, GLsizei);
@@ -84,7 +84,7 @@
     void texSubImage3D(GLenum, GLint, GLint, GLint, GLint, GLenum, GLenum, HTMLImageElement*, ExceptionState&);
     void texSubImage3D(GLenum, GLint, GLint, GLint, GLint, GLenum, GLenum, HTMLCanvasElement*, ExceptionState&);
     void texSubImage3D(GLenum, GLint, GLint, GLint, GLint, GLenum, GLenum, HTMLVideoElement*, ExceptionState&);
-    void texSubImage3D(GLenum, GLint, GLint, GLint, GLint, GLenum, GLenum, RawPtr<ImageBitmap>, ExceptionState&);
+    void texSubImage3D(GLenum, GLint, GLint, GLint, GLint, GLenum, GLenum, ImageBitmap*, ExceptionState&);
     void copyTexSubImage3D(GLenum, GLint, GLint, GLint, GLint, GLint, GLint, GLsizei, GLsizei);
     void compressedTexImage3D(GLenum, GLint, GLenum, GLsizei, GLsizei, GLsizei, GLint, DOMArrayBufferView*);
     void compressedTexSubImage3D(GLenum, GLint, GLint, GLint, GLint, GLsizei, GLsizei, GLsizei, GLenum, DOMArrayBufferView*);

diff --git a/third_party/WebKit/Source/modules/webgl/WebGLContextEvent.h b/third_party/WebKit/Source/modules/webgl/WebGLContextEvent.h
index 1c3e918b..cce7358a 100644
--- a/third_party/WebKit/Source/modules/webgl/WebGLContextEvent.h
+++ b/third_party/WebKit/Source/modules/webgl/WebGLContextEvent.h

@@ -35,15 +35,15 @@
     DEFINE_WRAPPERTYPEINFO();
 
 public:
-    static RawPtr<WebGLContextEvent> create()
+    static WebGLContextEvent* create()
     {
         return new WebGLContextEvent;
     }
-    static RawPtr<WebGLContextEvent> create(const AtomicString& type, bool canBubble, bool cancelable, const String& statusMessage)
+    static WebGLContextEvent* create(const AtomicString& type, bool canBubble, bool cancelable, const String& statusMessage)
     {
         return new WebGLContextEvent(type, canBubble, cancelable, statusMessage);
     }
-    static RawPtr<WebGLContextEvent> create(const AtomicString& type, const WebGLContextEventInit& initializer)
+    static WebGLContextEvent* create(const AtomicString& type, const WebGLContextEventInit& initializer)
     {
         return new WebGLContextEvent(type, initializer);
     }

diff --git a/third_party/WebKit/Source/modules/webgl/WebGLRenderingContext.cpp b/third_party/WebKit/Source/modules/webgl/WebGLRenderingContext.cpp
index c73f8a6..a8dddde 100644
--- a/third_party/WebKit/Source/modules/webgl/WebGLRenderingContext.cpp
+++ b/third_party/WebKit/Source/modules/webgl/WebGLRenderingContext.cpp

@@ -66,7 +66,7 @@
 
 namespace blink {
 
-RawPtr<CanvasRenderingContext> WebGLRenderingContext::Factory::create(HTMLCanvasElement* canvas, const CanvasContextCreationAttributes& attrs, Document&)
+CanvasRenderingContext* WebGLRenderingContext::Factory::create(HTMLCanvasElement* canvas, const CanvasContextCreationAttributes& attrs, Document&)
 {
     WebGLContextAttributes attributes = toWebGLContextAttributes(attrs);
     OwnPtr<WebGraphicsContext3DProvider> contextProvider(createWebGraphicsContext3DProvider(canvas, attributes, 1));
@@ -81,7 +81,7 @@
         gl->PushGroupMarkerEXT(0, contextLabel.ascii().data());
     }
 
-    RawPtr<WebGLRenderingContext> renderingContext = new WebGLRenderingContext(canvas, contextProvider.release(), attributes);
+    WebGLRenderingContext* renderingContext = new WebGLRenderingContext(canvas, contextProvider.release(), attributes);
 
     if (!renderingContext->drawingBuffer()) {
         canvas->dispatchEvent(WebGLContextEvent::create(EventTypeNames::webglcontextcreationerror, false, true, "Could not create a WebGL context."));
@@ -91,7 +91,7 @@
     renderingContext->initializeNewContext();
     renderingContext->registerContextExtensions();
 
-    return renderingContext.release();
+    return renderingContext;
 }
 
 void WebGLRenderingContext::Factory::onError(HTMLCanvasElement* canvas, const String& error)

diff --git a/third_party/WebKit/Source/modules/webgl/WebGLRenderingContext.h b/third_party/WebKit/Source/modules/webgl/WebGLRenderingContext.h
index bd32faf6..6c23f29 100644
--- a/third_party/WebKit/Source/modules/webgl/WebGLRenderingContext.h
+++ b/third_party/WebKit/Source/modules/webgl/WebGLRenderingContext.h

@@ -42,7 +42,7 @@
         Factory() {}
         ~Factory() override {}
 
-        RawPtr<CanvasRenderingContext> create(HTMLCanvasElement*, const CanvasContextCreationAttributes&, Document&) override;
+        CanvasRenderingContext* create(HTMLCanvasElement*, const CanvasContextCreationAttributes&, Document&) override;
         CanvasRenderingContext::ContextType getContextType() const override { return CanvasRenderingContext::ContextWebgl; }
         void onError(HTMLCanvasElement*, const String& error) override;
     };

diff --git a/third_party/WebKit/Source/modules/webgl/WebGLRenderingContextBase.cpp b/third_party/WebKit/Source/modules/webgl/WebGLRenderingContextBase.cpp
index c3dad86d..1ec1427 100644
--- a/third_party/WebKit/Source/modules/webgl/WebGLRenderingContextBase.cpp
+++ b/third_party/WebKit/Source/modules/webgl/WebGLRenderingContextBase.cpp

@@ -133,12 +133,6 @@
     if (!candidate)
         return;
 
-    // This context could belong to a dead page and the last JavaScript reference has already
-    // been lost. Garbage collection might be triggered in the middle of this function, for
-    // example, printWarningToConsole() causes an upcall to JavaScript.
-    // Must make sure that the context is not deleted until the call stack unwinds.
-    RawPtr<WebGLRenderingContextBase> protect(candidate);
-
     candidate->printWarningToConsole(reason);
     InspectorInstrumentation::didFireWebGLWarning(candidate->canvas());
 
@@ -4240,11 +4234,11 @@
 }
 
 void WebGLRenderingContextBase::texImage2D(GLenum target, GLint level, GLint internalformat,
-    GLenum format, GLenum type, RawPtr<ImageBitmap> bitmap, ExceptionState& exceptionState)
+    GLenum format, GLenum type, ImageBitmap* bitmap, ExceptionState& exceptionState)
 {
     if (isContextLost())
         return;
-    if (!validateImageBitmap("texImage2D", bitmap.get(), exceptionState))
+    if (!validateImageBitmap("texImage2D", bitmap, exceptionState))
         return;
     if (!validateTexture2DBinding("texImage2D", target))
         return;
@@ -4506,11 +4500,11 @@
 }
 
 void WebGLRenderingContextBase::texSubImage2D(GLenum target, GLint level, GLint xoffset, GLint yoffset,
-    GLenum format, GLenum type, RawPtr<ImageBitmap> bitmap, ExceptionState& exceptionState)
+    GLenum format, GLenum type, ImageBitmap* bitmap, ExceptionState& exceptionState)
 {
     if (isContextLost())
         return;
-    if (!validateImageBitmap("texSubImage2D", bitmap.get(), exceptionState))
+    if (!validateImageBitmap("texSubImage2D", bitmap, exceptionState))
         return;
     if (!validateTexture2DBinding("texSubImage2D", target))
         return;
@@ -5955,7 +5949,7 @@
 
 void WebGLRenderingContextBase::dispatchContextLostEvent(Timer<WebGLRenderingContextBase>*)
 {
-    RawPtr<WebGLContextEvent> event = WebGLContextEvent::create(EventTypeNames::webglcontextlost, false, true, "");
+    WebGLContextEvent* event = WebGLContextEvent::create(EventTypeNames::webglcontextlost, false, true, "");
     canvas()->dispatchEvent(event);
     m_restoreAllowed = event->defaultPrevented();
     if (m_restoreAllowed && !m_isHidden) {

diff --git a/third_party/WebKit/Source/modules/webgl/WebGLRenderingContextBase.h b/third_party/WebKit/Source/modules/webgl/WebGLRenderingContextBase.h
index eafdf33..26ded6f5 100644
--- a/third_party/WebKit/Source/modules/webgl/WebGLRenderingContextBase.h
+++ b/third_party/WebKit/Source/modules/webgl/WebGLRenderingContextBase.h

@@ -292,7 +292,7 @@
     void texImage2D(GLenum target, GLint level, GLint internalformat,
         GLenum format, GLenum type, HTMLVideoElement*, ExceptionState&);
     void texImage2D(GLenum target, GLint level, GLint internalformat,
-        GLenum format, GLenum type, RawPtr<ImageBitmap>, ExceptionState&);
+        GLenum format, GLenum type, ImageBitmap*, ExceptionState&);
 
     void texParameterf(GLenum target, GLenum pname, GLfloat param);
     void texParameteri(GLenum target, GLenum pname, GLint param);
@@ -309,7 +309,7 @@
     void texSubImage2D(GLenum target, GLint level, GLint xoffset, GLint yoffset,
         GLenum format, GLenum type, HTMLVideoElement*, ExceptionState&);
     void texSubImage2D(GLenum target, GLint level, GLint xoffset, GLint yoffset,
-        GLenum format, GLenum type, RawPtr<ImageBitmap>, ExceptionState&);
+        GLenum format, GLenum type, ImageBitmap*, ExceptionState&);
 
     void uniform1f(const WebGLUniformLocation*, GLfloat x);
     void uniform1fv(const WebGLUniformLocation*, const FlexibleFloat32ArrayView&);

diff --git a/third_party/WebKit/Source/modules/webmidi/MIDIConnectionEvent.h b/third_party/WebKit/Source/modules/webmidi/MIDIConnectionEvent.h
index 0daa1dc3..01457f2 100644
--- a/third_party/WebKit/Source/modules/webmidi/MIDIConnectionEvent.h
+++ b/third_party/WebKit/Source/modules/webmidi/MIDIConnectionEvent.h

@@ -41,17 +41,17 @@
 class MIDIConnectionEvent final : public Event {
     DEFINE_WRAPPERTYPEINFO();
 public:
-    static RawPtr<MIDIConnectionEvent> create()
+    static MIDIConnectionEvent* create()
     {
         return new MIDIConnectionEvent();
     }
 
-    static RawPtr<MIDIConnectionEvent> create(MIDIPort* port)
+    static MIDIConnectionEvent* create(MIDIPort* port)
     {
         return new MIDIConnectionEvent(port);
     }
 
-    static RawPtr<MIDIConnectionEvent> create(const AtomicString& type, const MIDIConnectionEventInit& initializer)
+    static MIDIConnectionEvent* create(const AtomicString& type, const MIDIConnectionEventInit& initializer)
     {
         return new MIDIConnectionEvent(type, initializer);
     }

diff --git a/third_party/WebKit/Source/modules/webmidi/MIDIController.cpp b/third_party/WebKit/Source/modules/webmidi/MIDIController.cpp
index 60c17f2..562a2e76 100644
--- a/third_party/WebKit/Source/modules/webmidi/MIDIController.cpp
+++ b/third_party/WebKit/Source/modules/webmidi/MIDIController.cpp

@@ -50,7 +50,7 @@
 {
 }
 
-RawPtr<MIDIController> MIDIController::create(PassOwnPtr<MIDIClient> client)
+MIDIController* MIDIController::create(PassOwnPtr<MIDIClient> client)
 {
     return new MIDIController(client);
 }

diff --git a/third_party/WebKit/Source/modules/webmidi/MIDIController.h b/third_party/WebKit/Source/modules/webmidi/MIDIController.h
index 5e3b7d0..4cf7bdf 100644
--- a/third_party/WebKit/Source/modules/webmidi/MIDIController.h
+++ b/third_party/WebKit/Source/modules/webmidi/MIDIController.h

@@ -48,7 +48,7 @@
     void requestPermission(MIDIAccessInitializer*, const MIDIOptions&);
     void cancelPermissionRequest(MIDIAccessInitializer*);
 
-    static RawPtr<MIDIController> create(PassOwnPtr<MIDIClient>);
+    static MIDIController* create(PassOwnPtr<MIDIClient>);
     static const char* supplementName();
     static MIDIController* from(LocalFrame* frame) { return static_cast<MIDIController*>(Supplement<LocalFrame>::from(frame, supplementName())); }
 

diff --git a/third_party/WebKit/Source/modules/webmidi/MIDIInput.cpp b/third_party/WebKit/Source/modules/webmidi/MIDIInput.cpp
index 8983576..67efdf8 100644
--- a/third_party/WebKit/Source/modules/webmidi/MIDIInput.cpp
+++ b/third_party/WebKit/Source/modules/webmidi/MIDIInput.cpp

@@ -56,7 +56,7 @@
     return getAttributeEventListener(EventTypeNames::midimessage);
 }
 
-void MIDIInput::setOnmidimessage(RawPtr<EventListener> listener)
+void MIDIInput::setOnmidimessage(EventListener* listener)
 {
     // Implicit open. It does nothing if the port is already opened.
     // See http://www.w3.org/TR/webmidi/#widl-MIDIPort-open-Promise-MIDIPort

diff --git a/third_party/WebKit/Source/modules/webmidi/MIDIInput.h b/third_party/WebKit/Source/modules/webmidi/MIDIInput.h
index 32bddee..4a74d60 100644
--- a/third_party/WebKit/Source/modules/webmidi/MIDIInput.h
+++ b/third_party/WebKit/Source/modules/webmidi/MIDIInput.h

@@ -46,7 +46,7 @@
     ~MIDIInput() override { }
 
     EventListener* onmidimessage();
-    void setOnmidimessage(RawPtr<EventListener>);
+    void setOnmidimessage(EventListener*);
 
     // EventTarget
     const AtomicString& interfaceName() const override { return EventTargetNames::MIDIInput; }

diff --git a/third_party/WebKit/Source/modules/webmidi/MIDIMessageEvent.h b/third_party/WebKit/Source/modules/webmidi/MIDIMessageEvent.h
index a212ce6..d2c871dd 100644
--- a/third_party/WebKit/Source/modules/webmidi/MIDIMessageEvent.h
+++ b/third_party/WebKit/Source/modules/webmidi/MIDIMessageEvent.h

@@ -41,17 +41,17 @@
 class MIDIMessageEvent final : public Event {
     DEFINE_WRAPPERTYPEINFO();
 public:
-    static RawPtr<MIDIMessageEvent> create()
+    static MIDIMessageEvent* create()
     {
         return new MIDIMessageEvent();
     }
 
-    static RawPtr<MIDIMessageEvent> create(double receivedTime, PassRefPtr<DOMUint8Array> data)
+    static MIDIMessageEvent* create(double receivedTime, PassRefPtr<DOMUint8Array> data)
     {
         return new MIDIMessageEvent(receivedTime, data);
     }
 
-    static RawPtr<MIDIMessageEvent> create(const AtomicString& type, const MIDIMessageEventInit& initializer)
+    static MIDIMessageEvent* create(const AtomicString& type, const MIDIMessageEventInit& initializer)
     {
         return new MIDIMessageEvent(type, initializer);
     }

diff --git a/third_party/WebKit/Source/modules/websockets/CloseEvent.h b/third_party/WebKit/Source/modules/websockets/CloseEvent.h
index 0c9c621..816723b 100644
--- a/third_party/WebKit/Source/modules/websockets/CloseEvent.h
+++ b/third_party/WebKit/Source/modules/websockets/CloseEvent.h

@@ -46,17 +46,17 @@
 class CloseEvent final : public Event {
     DEFINE_WRAPPERTYPEINFO();
 public:
-    static RawPtr<CloseEvent> create()
+    static CloseEvent* create()
     {
         return new CloseEvent();
     }
 
-    static RawPtr<CloseEvent> create(bool wasClean, unsigned short code, const String& reason)
+    static CloseEvent* create(bool wasClean, unsigned short code, const String& reason)
     {
         return new CloseEvent(wasClean, code, reason);
     }
 
-    static RawPtr<CloseEvent> create(const AtomicString& type, const CloseEventInit& initializer)
+    static CloseEvent* create(const AtomicString& type, const CloseEventInit& initializer)
     {
         return new CloseEvent(type, initializer);
     }

diff --git a/third_party/WebKit/Source/modules/websockets/DOMWebSocket.cpp b/third_party/WebKit/Source/modules/websockets/DOMWebSocket.cpp
index 71ab2c5..152dda2 100644
--- a/third_party/WebKit/Source/modules/websockets/DOMWebSocket.cpp
+++ b/third_party/WebKit/Source/modules/websockets/DOMWebSocket.cpp

@@ -71,7 +71,7 @@
 
 DOMWebSocket::EventQueue::~EventQueue() { stop(); }
 
-void DOMWebSocket::EventQueue::dispatch(RawPtr<Event> event)
+void DOMWebSocket::EventQueue::dispatch(Event* event)
 {
     switch (m_state) {
     case Active:

diff --git a/third_party/WebKit/Source/modules/websockets/DOMWebSocket.h b/third_party/WebKit/Source/modules/websockets/DOMWebSocket.h
index c8654c0..78627ce2 100644
--- a/third_party/WebKit/Source/modules/websockets/DOMWebSocket.h
+++ b/third_party/WebKit/Source/modules/websockets/DOMWebSocket.h

@@ -154,7 +154,7 @@
         // Dispatches the event if this queue is active.
         // Queues the event if this queue is suspended.
         // Does nothing otherwise.
-        void dispatch(RawPtr<Event> /* event */);
+        void dispatch(Event* /* event */);
 
         bool isEmpty() const;
 

diff --git a/third_party/WebKit/Source/modules/webusb/USB.cpp b/third_party/WebKit/Source/modules/webusb/USB.cpp
index 3bd8b8fc..7863b6f8 100644
--- a/third_party/WebKit/Source/modules/webusb/USB.cpp
+++ b/third_party/WebKit/Source/modules/webusb/USB.cpp

@@ -143,14 +143,14 @@
     m_client = nullptr;
 }
 
-void USB::onDeviceConnected(WebPassOwnPtr<WebUSBDevice> device)
+void USB::onDeviceConnected(std::unique_ptr<WebUSBDevice> device)
 {
-    dispatchEvent(USBConnectionEvent::create(EventTypeNames::connect, USBDevice::create(device.release(), getExecutionContext())));
+    dispatchEvent(USBConnectionEvent::create(EventTypeNames::connect, USBDevice::create(adoptPtr(device.release()), getExecutionContext())));
 }
 
-void USB::onDeviceDisconnected(WebPassOwnPtr<WebUSBDevice> device)
+void USB::onDeviceDisconnected(std::unique_ptr<WebUSBDevice> device)
 {
-    dispatchEvent(USBConnectionEvent::create(EventTypeNames::disconnect, USBDevice::create(device.release(), getExecutionContext())));
+    dispatchEvent(USBConnectionEvent::create(EventTypeNames::disconnect, USBDevice::create(adoptPtr(device.release()), getExecutionContext())));
 }
 
 DEFINE_TRACE(USB)

diff --git a/third_party/WebKit/Source/modules/webusb/USB.h b/third_party/WebKit/Source/modules/webusb/USB.h
index 8d406a6..026fe800 100644
--- a/third_party/WebKit/Source/modules/webusb/USB.h
+++ b/third_party/WebKit/Source/modules/webusb/USB.h

@@ -48,8 +48,8 @@
     void contextDestroyed() override;
 
     // WebUSBClient::Observer overrides.
-    void onDeviceConnected(WebPassOwnPtr<WebUSBDevice>) override;
-    void onDeviceDisconnected(WebPassOwnPtr<WebUSBDevice>) override;
+    void onDeviceConnected(std::unique_ptr<WebUSBDevice>) override;
+    void onDeviceDisconnected(std::unique_ptr<WebUSBDevice>) override;
 
     DECLARE_VIRTUAL_TRACE();
     EAGERLY_FINALIZE();

diff --git a/third_party/WebKit/Source/modules/webusb/USBConnectionEvent.cpp b/third_party/WebKit/Source/modules/webusb/USBConnectionEvent.cpp
index 3aecfcf..507356ee 100644
--- a/third_party/WebKit/Source/modules/webusb/USBConnectionEvent.cpp
+++ b/third_party/WebKit/Source/modules/webusb/USBConnectionEvent.cpp

@@ -9,12 +9,12 @@
 
 namespace blink {
 
-RawPtr<USBConnectionEvent> USBConnectionEvent::create(const AtomicString& type, const USBConnectionEventInit& initializer)
+USBConnectionEvent* USBConnectionEvent::create(const AtomicString& type, const USBConnectionEventInit& initializer)
 {
     return new USBConnectionEvent(type, initializer);
 }
 
-RawPtr<USBConnectionEvent> USBConnectionEvent::create(const AtomicString& type, USBDevice* device)
+USBConnectionEvent* USBConnectionEvent::create(const AtomicString& type, USBDevice* device)
 {
     return new USBConnectionEvent(type, device);
 }

diff --git a/third_party/WebKit/Source/modules/webusb/USBConnectionEvent.h b/third_party/WebKit/Source/modules/webusb/USBConnectionEvent.h
index 286882b..b4c8112 100644
--- a/third_party/WebKit/Source/modules/webusb/USBConnectionEvent.h
+++ b/third_party/WebKit/Source/modules/webusb/USBConnectionEvent.h

@@ -16,8 +16,8 @@
 class USBConnectionEvent final : public Event {
     DEFINE_WRAPPERTYPEINFO();
 public:
-    static RawPtr<USBConnectionEvent> create(const AtomicString& type, const USBConnectionEventInit&);
-    static RawPtr<USBConnectionEvent> create(const AtomicString& type, USBDevice*);
+    static USBConnectionEvent* create(const AtomicString& type, const USBConnectionEventInit&);
+    static USBConnectionEvent* create(const AtomicString& type, USBDevice*);
 
     USBConnectionEvent(const AtomicString& type, const USBConnectionEventInit&);
     USBConnectionEvent(const AtomicString& type, USBDevice*);

diff --git a/third_party/WebKit/Source/platform/RuntimeEnabledFeatures.in b/third_party/WebKit/Source/platform/RuntimeEnabledFeatures.in
index 2db162d..f50181b 100644
--- a/third_party/WebKit/Source/platform/RuntimeEnabledFeatures.in
+++ b/third_party/WebKit/Source/platform/RuntimeEnabledFeatures.in

@@ -135,6 +135,7 @@
 NotificationExperimental status=test
 NotificationActionIcons status=stable
 NotificationBadge status=experimental
+NotificationInlineReplies status=experimental
 Notifications status=stable
 OrientationEvent
 // For simulating Android's overlay fullscreen video in layout tests on Linux.

diff --git a/third_party/WebKit/Source/platform/TimerTest.cpp b/third_party/WebKit/Source/platform/TimerTest.cpp
index 37f82157..080ac90 100644
--- a/third_party/WebKit/Source/platform/TimerTest.cpp
+++ b/third_party/WebKit/Source/platform/TimerTest.cpp

@@ -185,7 +185,7 @@
     }
 
     void shutdown() override {}
-    WebPassOwnPtr<WebViewScheduler> createWebViewScheduler(blink::WebView*) override { return nullptr; }
+    std::unique_ptr<WebViewScheduler> createWebViewScheduler(blink::WebView*) override { return nullptr; }
     void suspendTimerQueue() override { }
     void resumeTimerQueue() override { }
     void addPendingNavigation() override { }

diff --git a/third_party/WebKit/Source/platform/image-decoders/jpeg/JPEGImageDecoder.cpp b/third_party/WebKit/Source/platform/image-decoders/jpeg/JPEGImageDecoder.cpp
index 09cc8af..03b465d8 100644
--- a/third_party/WebKit/Source/platform/image-decoders/jpeg/JPEGImageDecoder.cpp
+++ b/third_party/WebKit/Source/platform/image-decoders/jpeg/JPEGImageDecoder.cpp

@@ -219,7 +219,6 @@
 {
     if ((DCTSIZE == 8)
         && (info.num_components == 3)
-        && (info.comps_in_scan >= info.num_components)
         && (info.scale_denom <= 8)
         && (info.cur_comp_info[0])
         && (info.cur_comp_info[1])
@@ -856,7 +855,7 @@
     bufferraw[1] = &bufferraw2[16]; // U channel rows (8)
     bufferraw[2] = &bufferraw2[24]; // V channel rows (8)
     int yHeight = info->output_height;
-    int v = info->cur_comp_info[0]->v_samp_factor;
+    int v = info->comp_info[0].v_samp_factor;
     IntSize uvSize = reader->uvSize();
     int uvHeight = uvSize.height();
     JSAMPROW outputY = static_cast<JSAMPROW>(imagePlanes->plane(0));

diff --git a/third_party/WebKit/Source/platform/mediastream/RTCConfiguration.h b/third_party/WebKit/Source/platform/mediastream/RTCConfiguration.h
index 25670c4..8e83245 100644
--- a/third_party/WebKit/Source/platform/mediastream/RTCConfiguration.h
+++ b/third_party/WebKit/Source/platform/mediastream/RTCConfiguration.h

@@ -97,7 +97,7 @@
     void setRtcpMuxPolicy(RTCRtcpMuxPolicy rtcpMuxPolicy) { m_rtcpMuxPolicy = rtcpMuxPolicy; }
     RTCRtcpMuxPolicy rtcpMuxPolicy() { return m_rtcpMuxPolicy; }
 
-    void appendCertificate(WebPassOwnPtr<WebRTCCertificate> certificate) { m_certificates.append(certificate.release()); }
+    void appendCertificate(std::unique_ptr<WebRTCCertificate> certificate) { m_certificates.append(adoptPtr(certificate.release())); }
     size_t numberOfCertificates() const { return m_certificates.size(); }
     WebRTCCertificate* certificate(size_t index) const { return m_certificates[index].get(); }
 

diff --git a/third_party/WebKit/Source/platform/testing/TestingPlatformSupport.h b/third_party/WebKit/Source/platform/testing/TestingPlatformSupport.h
index 793d003..3a9c5fa 100644
--- a/third_party/WebKit/Source/platform/testing/TestingPlatformSupport.h
+++ b/third_party/WebKit/Source/platform/testing/TestingPlatformSupport.h

@@ -66,7 +66,7 @@
     void postIdleTask(const WebTraceLocation&, WebThread::IdleTask*) override { }
     void postNonNestableIdleTask(const WebTraceLocation&, WebThread::IdleTask*) override { }
     void postIdleTaskAfterWakeup(const WebTraceLocation&, WebThread::IdleTask*) override { }
-    WebPassOwnPtr<WebViewScheduler> createWebViewScheduler(blink::WebView*) override { return nullptr; }
+    std::unique_ptr<WebViewScheduler> createWebViewScheduler(blink::WebView*) override { return nullptr; }
     void suspendTimerQueue() override { }
     void resumeTimerQueue() override { }
     void addPendingNavigation() override { }

diff --git a/third_party/WebKit/Source/platform/testing/weburl_loader_mock_factory_impl.cc b/third_party/WebKit/Source/platform/testing/weburl_loader_mock_factory_impl.cc
index d71b097b..bfe21a5 100644
--- a/third_party/WebKit/Source/platform/testing/weburl_loader_mock_factory_impl.cc
+++ b/third_party/WebKit/Source/platform/testing/weburl_loader_mock_factory_impl.cc

@@ -15,13 +15,13 @@
 #include "public/platform/WebURLError.h"
 #include "public/platform/WebURLRequest.h"
 #include "public/platform/WebURLResponse.h"
+#include "wtf/PtrUtil.h"
 
 namespace blink {
 
-WebPassOwnPtr<WebURLLoaderMockFactory> WebURLLoaderMockFactory::create()
+std::unique_ptr<WebURLLoaderMockFactory> WebURLLoaderMockFactory::create()
 {
-    return adoptWebPtr(static_cast<WebURLLoaderMockFactory*>(
-        new WebURLLoaderMockFactoryImpl));
+    return wrapUnique(new WebURLLoaderMockFactoryImpl);
 }
 
 WebURLLoaderMockFactoryImpl::WebURLLoaderMockFactoryImpl() {}

diff --git a/third_party/WebKit/Source/platform/v8_inspector/V8RuntimeAgentImpl.cpp b/third_party/WebKit/Source/platform/v8_inspector/V8RuntimeAgentImpl.cpp
index 179e080..e7b111aa 100644
--- a/third_party/WebKit/Source/platform/v8_inspector/V8RuntimeAgentImpl.cpp
+++ b/third_party/WebKit/Source/platform/v8_inspector/V8RuntimeAgentImpl.cpp

@@ -109,7 +109,8 @@
         return;
 
     v8::HandleScope scope(injectedScript->isolate());
-    v8::Context::Scope contextScope(injectedScript->context()->context());
+    v8::Local<v8::Context> context = injectedScript->context()->context();
+    v8::Context::Scope contextScope(context);
 
     if (!injectedScript->canAccessInspectedWindow()) {
         *errorString = "Can not access given context";
@@ -125,7 +126,13 @@
         return;
     InjectedScript::ScopedGlobalObjectExtension scopeExtension(injectedScript, commandLineAPI);
 
+    bool evalIsDisabled = !context->IsCodeGenerationFromStringsAllowed();
+    // Temporarily enable allow evals for inspector.
+    if (evalIsDisabled)
+        context->AllowCodeGenerationFromStrings(true);
     v8::MaybeLocal<v8::Value> maybeResultValue = m_debugger->compileAndRunInternalScript(injectedScript->context()->context(), toV8String(injectedScript->isolate(), expression));
+    if (evalIsDisabled)
+        context->AllowCodeGenerationFromStrings(false);
     // InjectedScript may be gone after any evaluate call - find it again.
     injectedScript = m_session->findInjectedScript(errorString, contextId);
     if (!injectedScript)

diff --git a/third_party/WebKit/Source/web/ChromeClientImpl.cpp b/third_party/WebKit/Source/web/ChromeClientImpl.cpp
index 504e3eb..6853309a 100644
--- a/third_party/WebKit/Source/web/ChromeClientImpl.cpp
+++ b/third_party/WebKit/Source/web/ChromeClientImpl.cpp

@@ -1092,7 +1092,7 @@
 
 PassOwnPtr<WebFrameScheduler> ChromeClientImpl::createFrameScheduler(BlameContext* blameContext)
 {
-    return m_webView->scheduler()->createFrameScheduler(blameContext).release();
+    return adoptPtr(m_webView->scheduler()->createFrameScheduler(blameContext).release());
 }
 
 } // namespace blink

diff --git a/third_party/WebKit/Source/web/ServiceWorkerGlobalScopeProxy.cpp b/third_party/WebKit/Source/web/ServiceWorkerGlobalScopeProxy.cpp
index bbdcbbe7..3628ab9 100644
--- a/third_party/WebKit/Source/web/ServiceWorkerGlobalScopeProxy.cpp
+++ b/third_party/WebKit/Source/web/ServiceWorkerGlobalScopeProxy.cpp

@@ -67,6 +67,8 @@
 #include "wtf/Functional.h"
 #include "wtf/PassOwnPtr.h"
 
+#include <utility>
+
 namespace blink {
 
 RawPtr<ServiceWorkerGlobalScopeProxy> ServiceWorkerGlobalScopeProxy::create(WebEmbeddedWorkerImpl& embeddedWorker, Document& document, WebServiceWorkerContextClient& client)
@@ -86,9 +88,9 @@
     visitor->trace(m_workerGlobalScope);
 }
 
-void ServiceWorkerGlobalScopeProxy::setRegistration(WebPassOwnPtr<WebServiceWorkerRegistration::Handle> handle)
+void ServiceWorkerGlobalScopeProxy::setRegistration(std::unique_ptr<WebServiceWorkerRegistration::Handle> handle)
 {
-    workerGlobalScope()->setRegistration(handle);
+    workerGlobalScope()->setRegistration(std::move(handle));
 }
 
 void ServiceWorkerGlobalScopeProxy::dispatchActivateEvent(int eventID)
@@ -118,7 +120,7 @@
     workerGlobalScope()->dispatchExtendableEvent(event.release(), observer);
 }
 
-void ServiceWorkerGlobalScopeProxy::dispatchExtendableMessageEvent(int eventID, const WebString& message, const WebSecurityOrigin& sourceOrigin, const WebMessagePortChannelArray& webChannels, WebPassOwnPtr<WebServiceWorker::Handle> handle)
+void ServiceWorkerGlobalScopeProxy::dispatchExtendableMessageEvent(int eventID, const WebString& message, const WebSecurityOrigin& sourceOrigin, const WebMessagePortChannelArray& webChannels, std::unique_ptr<WebServiceWorker::Handle> handle)
 {
     DCHECK(RuntimeEnabledFeatures::serviceWorkerExtendableMessageEventEnabled());
 
@@ -127,7 +129,7 @@
     String origin;
     if (!sourceOrigin.isUnique())
         origin = sourceOrigin.toString();
-    ServiceWorker* source = ServiceWorker::from(m_workerGlobalScope->getExecutionContext(), handle.release());
+    ServiceWorker* source = ServiceWorker::from(m_workerGlobalScope->getExecutionContext(), adoptPtr(handle.release()));
     WaitUntilObserver* observer = WaitUntilObserver::create(workerGlobalScope(), WaitUntilObserver::Message, eventID);
 
     RawPtr<Event> event(ExtendableMessageEvent::create(value, origin, ports, source, observer));

diff --git a/third_party/WebKit/Source/web/ServiceWorkerGlobalScopeProxy.h b/third_party/WebKit/Source/web/ServiceWorkerGlobalScopeProxy.h
index 912b2487..3061e95 100644
--- a/third_party/WebKit/Source/web/ServiceWorkerGlobalScopeProxy.h
+++ b/third_party/WebKit/Source/web/ServiceWorkerGlobalScopeProxy.h

@@ -70,10 +70,10 @@
     ~ServiceWorkerGlobalScopeProxy() override;
 
     // WebServiceWorkerContextProxy overrides:
-    void setRegistration(WebPassOwnPtr<WebServiceWorkerRegistration::Handle>) override;
+    void setRegistration(std::unique_ptr<WebServiceWorkerRegistration::Handle>) override;
     void dispatchActivateEvent(int) override;
     void dispatchExtendableMessageEvent(int eventID, const WebString& message, const WebSecurityOrigin& sourceOrigin, const WebMessagePortChannelArray&, const WebServiceWorkerClientInfo&) override;
-    void dispatchExtendableMessageEvent(int eventID, const WebString& message, const WebSecurityOrigin& sourceOrigin, const WebMessagePortChannelArray&, WebPassOwnPtr<WebServiceWorker::Handle>) override;
+    void dispatchExtendableMessageEvent(int eventID, const WebString& message, const WebSecurityOrigin& sourceOrigin, const WebMessagePortChannelArray&, std::unique_ptr<WebServiceWorker::Handle>) override;
     void dispatchFetchEvent(int, const WebServiceWorkerRequest&) override;
     void dispatchForeignFetchEvent(int, const WebServiceWorkerRequest&) override;
     void dispatchGeofencingEvent(int, WebGeofencingEventType, const WebString& regionID, const WebCircularGeofencingRegion&) override;

diff --git a/third_party/WebKit/Source/web/WebFrameContentDumper.cpp b/third_party/WebKit/Source/web/WebFrameContentDumper.cpp
index 937004f..a9e39f5 100644
--- a/third_party/WebKit/Source/web/WebFrameContentDumper.cpp
+++ b/third_party/WebKit/Source/web/WebFrameContentDumper.cpp

@@ -10,7 +10,7 @@
 #include "core/frame/LocalFrame.h"
 #include "core/layout/LayoutPart.h"
 #include "core/layout/LayoutTreeAsText.h"
-#include "core/layout/LayoutView.h"
+#include "core/layout/api/LayoutViewItem.h"
 #include "public/web/WebDocument.h"
 #include "public/web/WebLocalFrame.h"
 #include "public/web/WebView.h"
@@ -54,10 +54,10 @@
             continue;
         LocalFrame* curLocalChild = toLocalFrame(curChild);
         // Ignore the text of non-visible frames.
-        LayoutView* contentLayoutObject = curLocalChild->contentLayoutObject();
+        LayoutViewItem contentLayoutItem = curLocalChild->contentLayoutItem();
         LayoutPart* ownerLayoutObject = curLocalChild->ownerLayoutObject();
-        if (!contentLayoutObject || !contentLayoutObject->size().width() || !contentLayoutObject->size().height()
-            || (contentLayoutObject->location().x() + contentLayoutObject->size().width() <= 0) || (contentLayoutObject->location().y() + contentLayoutObject->size().height() <= 0)
+        if (contentLayoutItem.isNull() || !contentLayoutItem.size().width() || !contentLayoutItem.size().height()
+            || (contentLayoutItem.location().x() + contentLayoutItem.size().width() <= 0) || (contentLayoutItem.location().y() + contentLayoutItem.size().height() <= 0)
             || (ownerLayoutObject && ownerLayoutObject->style() && ownerLayoutObject->style()->visibility() != VISIBLE)) {
             continue;
         }

diff --git a/third_party/WebKit/Source/web/WebViewImpl.cpp b/third_party/WebKit/Source/web/WebViewImpl.cpp
index 101b499..d2377674 100644
--- a/third_party/WebKit/Source/web/WebViewImpl.cpp
+++ b/third_party/WebKit/Source/web/WebViewImpl.cpp

@@ -444,7 +444,7 @@
     , m_shouldDispatchFirstLayoutAfterFinishedLoading(false)
     , m_displayMode(WebDisplayModeBrowser)
     , m_elasticOverscroll(FloatSize())
-    , m_scheduler(Platform::current()->currentThread()->scheduler()->createWebViewScheduler(this).release())
+    , m_scheduler(adoptPtr(Platform::current()->currentThread()->scheduler()->createWebViewScheduler(this).release()))
 {
     Page::PageClients pageClients;
     pageClients.chromeClient = m_chromeClientImpl.get();

diff --git a/third_party/WebKit/Source/wtf/PtrUtil.h b/third_party/WebKit/Source/wtf/PtrUtil.h
new file mode 100644
index 0000000..1c19fd8
--- /dev/null
+++ b/third_party/WebKit/Source/wtf/PtrUtil.h

@@ -0,0 +1,27 @@
+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef PtrUtil_h
+#define PtrUtil_h
+
+#include "wtf/TypeTraits.h"
+
+#include <memory>
+
+namespace WTF {
+
+template<typename T>
+std::unique_ptr<T> wrapUnique(T* ptr)
+{
+    static_assert(
+        !WTF::IsGarbageCollectedType<T>::value,
+        "Garbage collected types should not be stored in std::unique_ptr!");
+    return std::unique_ptr<T>(ptr);
+}
+
+} // namespace WTF
+
+using WTF::wrapUnique;
+
+#endif // PtrUtil_h

diff --git a/third_party/WebKit/Source/wtf/wtf.gypi b/third_party/WebKit/Source/wtf/wtf.gypi
index 6c526bb..0573b31e 100644
--- a/third_party/WebKit/Source/wtf/wtf.gypi
+++ b/third_party/WebKit/Source/wtf/wtf.gypi

@@ -91,6 +91,7 @@
             'PassRefPtr.h',
             'PrintStream.cpp',
             'PrintStream.h',
+            'PtrUtil.h',
             'RefCounted.h',
             'RefPtr.h',
             'RetainPtr.h',

diff --git a/third_party/WebKit/public/platform/WebCallbacks.h b/third_party/WebKit/public/platform/WebCallbacks.h
index 51f83ae..9cf230d0 100644
--- a/third_party/WebKit/public/platform/WebCallbacks.h
+++ b/third_party/WebKit/public/platform/WebCallbacks.h

@@ -31,14 +31,12 @@
 #ifndef WebCallbacks_h
 #define WebCallbacks_h
 
-#include "public/platform/WebPassOwnPtr.h"
-
 namespace blink {
 
 // A WebCallbacks<S, T> represents a callback object. Typically it is created
 // in Blink and passed to Chromium, and onSuccess or onError will be called
 // from Chromium.
-// When transferring ownership, use |WebPrivatePassOwnPtr<X>| as a type
+// When transferring ownership, use |std::unique_ptr<X>| as a type
 // parameter. Otherwise, |const X&| or |X| for a type parameter. It is
 // generally not preferred to use |X*| because the object ownership is not well
 // specified.

diff --git a/third_party/WebKit/public/platform/WebCredentialManagerClient.h b/third_party/WebKit/public/platform/WebCredentialManagerClient.h
index f9e8049..eba06e88 100644
--- a/third_party/WebKit/public/platform/WebCredentialManagerClient.h
+++ b/third_party/WebKit/public/platform/WebCredentialManagerClient.h

@@ -7,9 +7,10 @@
 
 #include "public/platform/WebCallbacks.h"
 #include "public/platform/WebCredentialManagerError.h"
-#include "public/platform/WebPassOwnPtr.h"
 #include "public/platform/WebVector.h"
 
+#include <memory>
+
 namespace blink {
 
 class WebCredential;
@@ -20,7 +21,7 @@
 // 'credentialmanager' module.
 class WebCredentialManagerClient {
 public:
-    typedef WebCallbacks<WebPassOwnPtr<WebCredential>, WebCredentialManagerError> RequestCallbacks;
+    typedef WebCallbacks<std::unique_ptr<WebCredential>, WebCredentialManagerError> RequestCallbacks;
     typedef WebCallbacks<void, WebCredentialManagerError> NotificationCallbacks;
 
     // Ownership of the callback is transferred to the callee for each of

diff --git a/third_party/WebKit/public/platform/WebPassOwnPtr.h b/third_party/WebKit/public/platform/WebPassOwnPtr.h
deleted file mode 100644
index e818b70..0000000
--- a/third_party/WebKit/public/platform/WebPassOwnPtr.h
+++ /dev/null

@@ -1,78 +0,0 @@
-// Copyright 2015 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef WebPassOwnPtr_h
-#define WebPassOwnPtr_h
-
-#include "public/platform/WebCommon.h"
-#include <cstddef>
-#include <memory>
-
-#if INSIDE_BLINK
-#include "wtf/PassOwnPtr.h"
-#endif
-
-namespace blink {
-
-// WebPassOwnPtr<T> is used to pass a T pointer with ownership from chromium
-// side to blink side. T's definition must be shared among all users
-// (especially between chromium and blink).
-// TODO(yhirano): Migrate to std::unique_ptr once the repository
-// merge is done or C++11 std library is allowed.
-template <typename T>
-class WebPassOwnPtr final {
-public:
-    WebPassOwnPtr() : m_ptr(nullptr) {}
-    WebPassOwnPtr(std::nullptr_t) : m_ptr(nullptr) {}
-    // We need |const| to bind an rvalue. As a result, |m_ptr| needs to be
-    // mutable because we manipulate it.
-    template <typename U>
-    WebPassOwnPtr(const WebPassOwnPtr<U>& o)
-    {
-        m_ptr = o.m_ptr;
-        o.m_ptr = nullptr;
-    }
-    WebPassOwnPtr(const WebPassOwnPtr& o)
-    {
-        m_ptr = o.m_ptr;
-        o.m_ptr = nullptr;
-    }
-    ~WebPassOwnPtr()
-    {
-        delete m_ptr;
-    }
-    WebPassOwnPtr& operator =(const WebPassOwnPtr&) = delete;
-
-#if INSIDE_BLINK
-    PassOwnPtr<T> release()
-    {
-        T* ptr = m_ptr;
-        m_ptr = nullptr;
-        return adoptPtr(ptr);
-    }
-#else
-    operator std::unique_ptr<T>()
-    {
-        T* ptr = m_ptr;
-        m_ptr = nullptr;
-        return std::unique_ptr<T>(ptr);
-    }
-#endif // INSIDE_BLINK
-
-    template <typename U> friend class WebPassOwnPtr;
-    template <typename U> friend WebPassOwnPtr<U> adoptWebPtr(U*);
-
-private:
-    explicit WebPassOwnPtr(T* ptr) : m_ptr(ptr) {}
-
-    // See the constructor comment to see why |mutable| is needed.
-    mutable T* m_ptr;
-};
-
-template <typename T>
-WebPassOwnPtr<T> adoptWebPtr(T* p) { return WebPassOwnPtr<T>(p); }
-
-} // namespace blink
-
-#endif

diff --git a/third_party/WebKit/public/platform/WebRTCCertificate.h b/third_party/WebKit/public/platform/WebRTCCertificate.h
index 4480acf5..80983926 100644
--- a/third_party/WebKit/public/platform/WebRTCCertificate.h
+++ b/third_party/WebKit/public/platform/WebRTCCertificate.h

@@ -5,9 +5,10 @@
 #ifndef WebRTCCertificate_h
 #define WebRTCCertificate_h
 
-#include "public/platform/WebPassOwnPtr.h"
 #include "public/platform/WebRTCKeyParams.h"
 
+#include <memory>
+
 namespace blink {
 
 // WebRTCCertificate is an interface defining what Blink needs to know about certificates,
@@ -23,7 +24,7 @@
     // Copies the WebRTCCertificate object without copying the underlying implementation
     // specific (WebRTC layer) certificate. When all copies are destroyed the underlying
     // data is freed.
-    virtual WebPassOwnPtr<WebRTCCertificate> shallowCopy() const = 0;
+    virtual std::unique_ptr<WebRTCCertificate> shallowCopy() const = 0;
 
     virtual const WebRTCKeyParams& keyParams() const = 0;
 

diff --git a/third_party/WebKit/public/platform/WebRTCCertificateGenerator.h b/third_party/WebKit/public/platform/WebRTCCertificateGenerator.h
index e41629ce..653039f 100644
--- a/third_party/WebKit/public/platform/WebRTCCertificateGenerator.h
+++ b/third_party/WebKit/public/platform/WebRTCCertificateGenerator.h

@@ -32,14 +32,15 @@
 #define WebRTCCertificateGenerator_h
 
 #include "public/platform/WebCallbacks.h"
-#include "public/platform/WebPassOwnPtr.h"
 #include "public/platform/WebRTCCertificate.h"
 #include "public/platform/WebRTCKeyParams.h"
 #include "public/platform/WebURL.h"
 
+#include <memory>
+
 namespace blink {
 
-using WebRTCCertificateCallback = WebCallbacks<WebPassOwnPtr<WebRTCCertificate>, void>;
+using WebRTCCertificateCallback = WebCallbacks<std::unique_ptr<WebRTCCertificate>, void>;
 
 // Interface defining a class that can generate WebRTCCertificates asynchronously.
 class WebRTCCertificateGenerator {
@@ -52,7 +53,8 @@
         const WebRTCKeyParams&,
         const WebURL&,
         const WebURL& firstPartyForCookies,
-        WebPassOwnPtr<WebRTCCertificateCallback> observer) = 0;
+        std::unique_ptr<WebRTCCertificateCallback> observer)
+        = 0;
 
     // Determines if the parameters are supported by generateCertificate.
     // For example, if the number of bits of some parameter is too small or too large we

diff --git a/third_party/WebKit/public/platform/WebScheduler.h b/third_party/WebKit/public/platform/WebScheduler.h
index aeeb8f4..4d75f177 100644
--- a/third_party/WebKit/public/platform/WebScheduler.h
+++ b/third_party/WebKit/public/platform/WebScheduler.h

@@ -6,11 +6,12 @@
 #define WebScheduler_h
 
 #include "WebCommon.h"
-#include "public/platform/WebPassOwnPtr.h"
 #include "public/platform/WebTaskRunner.h"
 #include "public/platform/WebThread.h"
 #include "public/platform/WebViewScheduler.h"
 
+#include <memory>
+
 namespace blink {
 
 class WebTraceLocation;
@@ -68,7 +69,7 @@
 
     // Creates a new WebViewScheduler for a given WebView. Must be called from
     // the associated WebThread.
-    virtual WebPassOwnPtr<WebViewScheduler> createWebViewScheduler(blink::WebView*) = 0;
+    virtual std::unique_ptr<WebViewScheduler> createWebViewScheduler(blink::WebView*) = 0;
 
     // Suspends the timer queue and increments the timer queue suspension count.
     // May only be called from the main thread.

diff --git a/third_party/WebKit/public/platform/WebURLLoaderMockFactory.h b/third_party/WebKit/public/platform/WebURLLoaderMockFactory.h
index a2e6c955..50ad556 100644
--- a/third_party/WebKit/public/platform/WebURLLoaderMockFactory.h
+++ b/third_party/WebKit/public/platform/WebURLLoaderMockFactory.h

@@ -7,10 +7,11 @@
 
 #include "public/platform/WebCommon.h"
 #include "public/platform/WebData.h"
-#include "public/platform/WebPassOwnPtr.h"
 #include "public/platform/WebString.h"
 #include "public/platform/WebURLLoaderTestDelegate.h"
 
+#include <memory>
+
 namespace blink {
 
 class WebURL;
@@ -19,7 +20,7 @@
 
 class WebURLLoaderMockFactory {
 public:
-    static WebPassOwnPtr<WebURLLoaderMockFactory> create();
+    static std::unique_ptr<WebURLLoaderMockFactory> create();
 
     virtual ~WebURLLoaderMockFactory() {}
 

diff --git a/third_party/WebKit/public/platform/WebViewScheduler.h b/third_party/WebKit/public/platform/WebViewScheduler.h
index a3693f6..3635b784 100644
--- a/third_party/WebKit/public/platform/WebViewScheduler.h
+++ b/third_party/WebKit/public/platform/WebViewScheduler.h

@@ -7,7 +7,8 @@
 
 #include "WebCommon.h"
 #include "public/platform/BlameContext.h"
-#include "public/platform/WebPassOwnPtr.h"
+
+#include <memory>
 
 namespace blink {
 
@@ -23,7 +24,7 @@
     // Creates a new WebFrameScheduler. The caller is responsible for deleting
     // it. All tasks executed by the frame scheduler will be attributed to
     // |BlameContext|.
-    virtual WebPassOwnPtr<WebFrameScheduler> createFrameScheduler(BlameContext*) = 0;
+    virtual std::unique_ptr<WebFrameScheduler> createFrameScheduler(BlameContext*) = 0;
 
     // Instructs this WebViewScheduler to use virtual time. When virtual time is enabled
     // the system doesn't actually sleep for the delays between tasks before executing

diff --git a/third_party/WebKit/public/platform/modules/background_sync/WebSyncProvider.h b/third_party/WebKit/public/platform/modules/background_sync/WebSyncProvider.h
index 1491d3d3..58f2674c 100644
--- a/third_party/WebKit/public/platform/modules/background_sync/WebSyncProvider.h
+++ b/third_party/WebKit/public/platform/modules/background_sync/WebSyncProvider.h

@@ -7,16 +7,17 @@
 
 #include "public/platform/WebCallbacks.h"
 #include "public/platform/WebCommon.h"
-#include "public/platform/WebPassOwnPtr.h"
 #include "public/platform/WebString.h"
 #include "public/platform/WebVector.h"
 #include "public/platform/modules/background_sync/WebSyncError.h"
 #include "public/platform/modules/background_sync/WebSyncRegistration.h"
 
+#include <memory>
+
 namespace blink {
 
 class WebServiceWorkerRegistration;
-using WebSyncRegistrationCallbacks = WebCallbacks<WebPassOwnPtr<WebSyncRegistration>, const WebSyncError&>;
+using WebSyncRegistrationCallbacks = WebCallbacks<std::unique_ptr<WebSyncRegistration>, const WebSyncError&>;
 using WebSyncGetRegistrationsCallbacks = WebCallbacks<const WebVector<WebSyncRegistration*>&, const WebSyncError&>;
 
 class WebSyncProvider {

diff --git a/third_party/WebKit/public/platform/modules/bluetooth/WebBluetooth.h b/third_party/WebKit/public/platform/modules/bluetooth/WebBluetooth.h
index b6352ab..c022ff1d 100644
--- a/third_party/WebKit/public/platform/modules/bluetooth/WebBluetooth.h
+++ b/third_party/WebKit/public/platform/modules/bluetooth/WebBluetooth.h

@@ -6,11 +6,12 @@
 #define WebBluetooth_h
 
 #include "public/platform/WebCallbacks.h"
-#include "public/platform/WebPassOwnPtr.h"
 #include "public/platform/WebString.h"
 #include "public/platform/WebVector.h"
 #include "public/platform/modules/bluetooth/WebBluetoothError.h"
 
+#include <memory>
+
 namespace blink {
 
 class WebBluetoothRemoteGATTCharacteristic;
@@ -21,20 +22,19 @@
 struct WebRequestDeviceOptions;
 
 // Success and failure callbacks for requestDevice.
-using WebBluetoothRequestDeviceCallbacks = WebCallbacks<WebPassOwnPtr<WebBluetoothDevice>, const WebBluetoothError&>;
+using WebBluetoothRequestDeviceCallbacks = WebCallbacks<std::unique_ptr<WebBluetoothDevice>, const WebBluetoothError&>;
 
 // Success and failure callbacks for connectGATT.
 using WebBluetoothRemoteGATTServerConnectCallbacks = WebCallbacks<void, const WebBluetoothError&>;
 
 // Success and failure callbacks for getPrimaryService.
-using WebBluetoothGetPrimaryServiceCallbacks = WebCallbacks<WebPassOwnPtr<WebBluetoothRemoteGATTService>, const WebBluetoothError&>;
+using WebBluetoothGetPrimaryServiceCallbacks = WebCallbacks<std::unique_ptr<WebBluetoothRemoteGATTService>, const WebBluetoothError&>;
 
 // Success and failure callbacks for getCharacteristic.
-using WebBluetoothGetCharacteristicCallbacks = WebCallbacks<WebPassOwnPtr<WebBluetoothRemoteGATTCharacteristicInit>, const WebBluetoothError&>;
+using WebBluetoothGetCharacteristicCallbacks = WebCallbacks<std::unique_ptr<WebBluetoothRemoteGATTCharacteristicInit>, const WebBluetoothError&>;
 
 // Success and failure callbacks for getCharacteristics.
-using WebBluetoothGetCharacteristicsCallbacks =
-    WebCallbacks<WebPassOwnPtr<WebVector<WebBluetoothRemoteGATTCharacteristicInit*>>, const WebBluetoothError&>;
+using WebBluetoothGetCharacteristicsCallbacks = WebCallbacks<std::unique_ptr<WebVector<WebBluetoothRemoteGATTCharacteristicInit*>>, const WebBluetoothError&>;
 
 // Success and failure callbacks for readValue.
 using WebBluetoothReadValueCallbacks = WebCallbacks<const WebVector<uint8_t>&, const WebBluetoothError&>;

diff --git a/third_party/WebKit/public/platform/modules/installedapp/WebInstalledAppClient.h b/third_party/WebKit/public/platform/modules/installedapp/WebInstalledAppClient.h
index f21b4f6..3e3b1eea 100644
--- a/third_party/WebKit/public/platform/modules/installedapp/WebInstalledAppClient.h
+++ b/third_party/WebKit/public/platform/modules/installedapp/WebInstalledAppClient.h

@@ -19,7 +19,7 @@
     virtual ~WebInstalledAppClient() {}
 
     // Takes ownership of the AppInstalledCallbacks.
-    virtual void getInstalledRelatedApps(const WebSecurityOrigin&, WebPassOwnPtr<AppInstalledCallbacks>) = 0;
+    virtual void getInstalledRelatedApps(const WebSecurityOrigin&, std::unique_ptr<AppInstalledCallbacks>) = 0;
 };
 
 } // namespace blink

diff --git a/third_party/WebKit/public/platform/modules/nfc/WebNFCClient.h b/third_party/WebKit/public/platform/modules/nfc/WebNFCClient.h
index a813e7c..ac610bc8 100644
--- a/third_party/WebKit/public/platform/modules/nfc/WebNFCClient.h
+++ b/third_party/WebKit/public/platform/modules/nfc/WebNFCClient.h

@@ -6,7 +6,8 @@
 #define WebNFCClient_h
 
 #include "public/platform/WebCallbacks.h"
-#include "public/platform/WebPassOwnPtr.h"
+
+#include <memory>
 
 namespace blink {
 

diff --git a/third_party/WebKit/public/platform/modules/notifications/WebNotificationAction.h b/third_party/WebKit/public/platform/modules/notifications/WebNotificationAction.h
index c42b47d..8f3499a 100644
--- a/third_party/WebKit/public/platform/modules/notifications/WebNotificationAction.h
+++ b/third_party/WebKit/public/platform/modules/notifications/WebNotificationAction.h

@@ -12,9 +12,17 @@
 
 // Structure representing the data associated with a Web Notification action.
 struct WebNotificationAction {
+    // Corresponds to NotificationActionType.
+    enum Type {
+        Button = 0,
+        Text
+    };
+
+    Type type;
     WebString action;
     WebString title;
     WebURL icon;
+    WebString placeholder;
 };
 
 } // namespace blink

diff --git a/third_party/WebKit/public/platform/modules/permissions/WebPermissionClient.h b/third_party/WebKit/public/platform/modules/permissions/WebPermissionClient.h
index f851050c..6e0ec26 100644
--- a/third_party/WebKit/public/platform/modules/permissions/WebPermissionClient.h
+++ b/third_party/WebKit/public/platform/modules/permissions/WebPermissionClient.h

@@ -6,15 +6,16 @@
 #define WebPermissionClient_h
 
 #include "public/platform/WebCallbacks.h"
-#include "public/platform/WebPassOwnPtr.h"
 #include "public/platform/WebVector.h"
 #include "public/platform/modules/permissions/WebPermissionStatus.h"
 #include "public/platform/modules/permissions/WebPermissionType.h"
 
+#include <memory>
+
 namespace blink {
 
 using WebPermissionCallback = WebCallbacks<WebPermissionStatus, void>;
-using WebPermissionsCallback = WebCallbacks<WebPassOwnPtr<WebVector<WebPermissionStatus>>, void>;
+using WebPermissionsCallback = WebCallbacks<std::unique_ptr<WebVector<WebPermissionStatus>>, void>;
 
 class WebPermissionObserver;
 class WebURL;

diff --git a/third_party/WebKit/public/platform/modules/presentation/WebPresentationClient.h b/third_party/WebKit/public/platform/modules/presentation/WebPresentationClient.h
index 74bb2c5d..b0bae336 100644
--- a/third_party/WebKit/public/platform/modules/presentation/WebPresentationClient.h
+++ b/third_party/WebKit/public/platform/modules/presentation/WebPresentationClient.h

@@ -7,7 +7,8 @@
 
 #include "public/platform/WebCallbacks.h"
 #include "public/platform/WebCommon.h"
-#include "public/platform/WebPassOwnPtr.h"
+
+#include <memory>
 
 namespace blink {
 
@@ -20,7 +21,7 @@
 // If session was created, callback's onSuccess() is invoked with the information about the
 // presentation session created by the embedder. Otherwise, onError() is invoked with the error code
 // and message.
-using WebPresentationConnectionClientCallbacks = WebCallbacks<WebPassOwnPtr<WebPresentationConnectionClient>, const WebPresentationError&>;
+using WebPresentationConnectionClientCallbacks = WebCallbacks<std::unique_ptr<WebPresentationConnectionClient>, const WebPresentationError&>;
 
 // Callback for .getAvailability().
 using WebPresentationAvailabilityCallbacks = WebCallbacks<bool, const WebPresentationError&>;

diff --git a/third_party/WebKit/public/platform/modules/push_messaging/WebPushProvider.h b/third_party/WebKit/public/platform/modules/push_messaging/WebPushProvider.h
index 5de2f8a..7672c16 100644
--- a/third_party/WebKit/public/platform/modules/push_messaging/WebPushProvider.h
+++ b/third_party/WebKit/public/platform/modules/push_messaging/WebPushProvider.h

@@ -6,17 +6,18 @@
 #define WebPushProvider_h
 
 #include "public/platform/WebCallbacks.h"
-#include "public/platform/WebPassOwnPtr.h"
 #include "public/platform/modules/push_messaging/WebPushPermissionStatus.h"
 #include "public/platform/modules/push_messaging/WebPushSubscription.h"
 
+#include <memory>
+
 namespace blink {
 
 class WebServiceWorkerRegistration;
 struct WebPushError;
 struct WebPushSubscriptionOptions;
 
-using WebPushSubscriptionCallbacks = WebCallbacks<WebPassOwnPtr<WebPushSubscription>, const WebPushError&>;
+using WebPushSubscriptionCallbacks = WebCallbacks<std::unique_ptr<WebPushSubscription>, const WebPushError&>;
 using WebPushPermissionStatusCallbacks = WebCallbacks<WebPushPermissionStatus, const WebPushError&>;
 using WebPushUnsubscribeCallbacks = WebCallbacks<bool, const WebPushError&>;
 

diff --git a/third_party/WebKit/public/platform/modules/serviceworker/WebServiceWorkerCacheStorage.h b/third_party/WebKit/public/platform/modules/serviceworker/WebServiceWorkerCacheStorage.h
index fa7b0ba..8ce012e 100644
--- a/third_party/WebKit/public/platform/modules/serviceworker/WebServiceWorkerCacheStorage.h
+++ b/third_party/WebKit/public/platform/modules/serviceworker/WebServiceWorkerCacheStorage.h

@@ -7,12 +7,13 @@
 
 #include "public/platform/WebCallbacks.h"
 #include "public/platform/WebCommon.h"
-#include "public/platform/WebPassOwnPtr.h"
 #include "public/platform/WebString.h"
 #include "public/platform/WebVector.h"
 #include "public/platform/modules/serviceworker/WebServiceWorkerCache.h"
 #include "public/platform/modules/serviceworker/WebServiceWorkerCacheError.h"
 
+#include <memory>
+
 namespace blink {
 
 class WebServiceWorkerCache;
@@ -23,7 +24,7 @@
 class WebServiceWorkerCacheStorage {
 public:
     using CacheStorageCallbacks = WebCallbacks<void, WebServiceWorkerCacheError>;
-    using CacheStorageWithCacheCallbacks = WebCallbacks<WebPassOwnPtr<WebServiceWorkerCache>, WebServiceWorkerCacheError>;
+    using CacheStorageWithCacheCallbacks = WebCallbacks<std::unique_ptr<WebServiceWorkerCache>, WebServiceWorkerCacheError>;
     using CacheStorageKeysCallbacks = WebCallbacks<const WebVector<WebString>&, WebServiceWorkerCacheError>;
     using CacheStorageMatchCallbacks = WebCallbacks<const WebServiceWorkerResponse&, WebServiceWorkerCacheError>;
 

diff --git a/third_party/WebKit/public/platform/modules/serviceworker/WebServiceWorkerClientsInfo.h b/third_party/WebKit/public/platform/modules/serviceworker/WebServiceWorkerClientsInfo.h
index 6ca5e69..c3ac9de 100644
--- a/third_party/WebKit/public/platform/modules/serviceworker/WebServiceWorkerClientsInfo.h
+++ b/third_party/WebKit/public/platform/modules/serviceworker/WebServiceWorkerClientsInfo.h

@@ -7,12 +7,13 @@
 
 #include "public/platform/WebCallbacks.h"
 #include "public/platform/WebPageVisibilityState.h"
-#include "public/platform/WebPassOwnPtr.h"
 #include "public/platform/WebURL.h"
 #include "public/platform/WebURLRequest.h"
 #include "public/platform/WebVector.h"
 #include "public/platform/modules/serviceworker/WebServiceWorkerClientType.h"
 
+#include <memory>
+
 namespace blink {
 
 struct WebServiceWorkerError;
@@ -40,7 +41,7 @@
 };
 
 // Two WebCallbacks, one for one client, one for a WebVector of clients.
-using WebServiceWorkerClientCallbacks = WebCallbacks<WebPassOwnPtr<WebServiceWorkerClientInfo>, const WebServiceWorkerError&>;
+using WebServiceWorkerClientCallbacks = WebCallbacks<std::unique_ptr<WebServiceWorkerClientInfo>, const WebServiceWorkerError&>;
 using WebServiceWorkerClientsCallbacks = WebCallbacks<const WebServiceWorkerClientsInfo&, const WebServiceWorkerError&>;
 
 } // namespace blink

diff --git a/third_party/WebKit/public/platform/modules/serviceworker/WebServiceWorkerProvider.h b/third_party/WebKit/public/platform/modules/serviceworker/WebServiceWorkerProvider.h
index 0beb484c..d853fb1 100644
--- a/third_party/WebKit/public/platform/modules/serviceworker/WebServiceWorkerProvider.h
+++ b/third_party/WebKit/public/platform/modules/serviceworker/WebServiceWorkerProvider.h

@@ -32,10 +32,11 @@
 #define WebServiceWorkerProvider_h
 
 #include "public/platform/WebCallbacks.h"
-#include "public/platform/WebPassOwnPtr.h"
 #include "public/platform/WebVector.h"
 #include "public/platform/modules/serviceworker/WebServiceWorkerRegistration.h"
 
+#include <memory>
+
 namespace blink {
 
 class WebURL;
@@ -52,13 +53,12 @@
     // events. Must be cleared before the client becomes invalid.
     virtual void setClient(WebServiceWorkerProviderClient*) { }
 
-    using WebServiceWorkerRegistrationCallbacks = WebCallbacks<WebPassOwnPtr<WebServiceWorkerRegistration::Handle>, const WebServiceWorkerError&>;
-    using WebServiceWorkerGetRegistrationCallbacks = WebCallbacks<WebPassOwnPtr<WebServiceWorkerRegistration::Handle>, const WebServiceWorkerError&>;
+    using WebServiceWorkerRegistrationCallbacks = WebCallbacks<std::unique_ptr<WebServiceWorkerRegistration::Handle>, const WebServiceWorkerError&>;
+    using WebServiceWorkerGetRegistrationCallbacks = WebCallbacks<std::unique_ptr<WebServiceWorkerRegistration::Handle>, const WebServiceWorkerError&>;
 
     // Each element's ownership is transferred.
-    // TODO(yhirano): Consider using vector<std::unique_ptr<>>.
-    using WebServiceWorkerGetRegistrationsCallbacks = WebCallbacks<WebPassOwnPtr<WebVector<WebServiceWorkerRegistration::Handle*>>, const WebServiceWorkerError&>;
-    using WebServiceWorkerGetRegistrationForReadyCallbacks = WebCallbacks<WebPassOwnPtr<WebServiceWorkerRegistration::Handle>, void>;
+    using WebServiceWorkerGetRegistrationsCallbacks = WebCallbacks<std::unique_ptr<WebVector<WebServiceWorkerRegistration::Handle*>>, const WebServiceWorkerError&>;
+    using WebServiceWorkerGetRegistrationForReadyCallbacks = WebCallbacks<std::unique_ptr<WebServiceWorkerRegistration::Handle>, void>;
 
     virtual void registerServiceWorker(const WebURL& pattern, const WebURL& scriptUrl, WebServiceWorkerRegistrationCallbacks*) { }
     virtual void getRegistration(const WebURL& documentURL, WebServiceWorkerGetRegistrationCallbacks*) { }

diff --git a/third_party/WebKit/public/platform/modules/serviceworker/WebServiceWorkerProviderClient.h b/third_party/WebKit/public/platform/modules/serviceworker/WebServiceWorkerProviderClient.h
index a0c4a0a..ac5e003 100644
--- a/third_party/WebKit/public/platform/modules/serviceworker/WebServiceWorkerProviderClient.h
+++ b/third_party/WebKit/public/platform/modules/serviceworker/WebServiceWorkerProviderClient.h

@@ -33,9 +33,10 @@
 
 #include "public/platform/WebCommon.h"
 #include "public/platform/WebMessagePortChannel.h"
-#include "public/platform/WebPassOwnPtr.h"
 #include "public/platform/modules/serviceworker/WebServiceWorker.h"
 
+#include <memory>
+
 namespace blink {
 
 class WebServiceWorker;
@@ -47,9 +48,9 @@
 public:
     virtual ~WebServiceWorkerProviderClient() { }
 
-    virtual void setController(WebPassOwnPtr<WebServiceWorker::Handle>, bool shouldNotifyControllerChange) = 0;
+    virtual void setController(std::unique_ptr<WebServiceWorker::Handle>, bool shouldNotifyControllerChange) = 0;
 
-    virtual void dispatchMessageEvent(WebPassOwnPtr<WebServiceWorker::Handle>, const WebString& message, const WebMessagePortChannelArray& channels) = 0;
+    virtual void dispatchMessageEvent(std::unique_ptr<WebServiceWorker::Handle>, const WebString& message, const WebMessagePortChannelArray& channels) = 0;
 };
 
 } // namespace blink

diff --git a/third_party/WebKit/public/platform/modules/serviceworker/WebServiceWorkerRegistrationProxy.h b/third_party/WebKit/public/platform/modules/serviceworker/WebServiceWorkerRegistrationProxy.h
index 77649de..e4d8815 100644
--- a/third_party/WebKit/public/platform/modules/serviceworker/WebServiceWorkerRegistrationProxy.h
+++ b/third_party/WebKit/public/platform/modules/serviceworker/WebServiceWorkerRegistrationProxy.h

@@ -5,7 +5,7 @@
 #ifndef WebServiceWorkerRegistrationProxy_h
 #define WebServiceWorkerRegistrationProxy_h
 
-#include "public/platform/WebPassOwnPtr.h"
+#include <memory>
 
 namespace blink {
 
@@ -21,9 +21,9 @@
     // WebServiceWorkerRegistration.installing.
     virtual void dispatchUpdateFoundEvent() = 0;
 
-    virtual void setInstalling(WebPassOwnPtr<WebServiceWorker::Handle>) = 0;
-    virtual void setWaiting(WebPassOwnPtr<WebServiceWorker::Handle>) = 0;
-    virtual void setActive(WebPassOwnPtr<WebServiceWorker::Handle>) = 0;
+    virtual void setInstalling(std::unique_ptr<WebServiceWorker::Handle>) = 0;
+    virtual void setWaiting(std::unique_ptr<WebServiceWorker::Handle>) = 0;
+    virtual void setActive(std::unique_ptr<WebServiceWorker::Handle>) = 0;
 
 protected:
     virtual ~WebServiceWorkerRegistrationProxy() { }

diff --git a/third_party/WebKit/public/platform/modules/webusb/WebUSBClient.h b/third_party/WebKit/public/platform/modules/webusb/WebUSBClient.h
index 18c4a5c8..2dee386 100644
--- a/third_party/WebKit/public/platform/modules/webusb/WebUSBClient.h
+++ b/third_party/WebKit/public/platform/modules/webusb/WebUSBClient.h

@@ -14,8 +14,8 @@
 struct WebUSBDeviceRequestOptions;
 struct WebUSBError;
 
-using WebUSBClientGetDevicesCallbacks = WebCallbacks<WebPassOwnPtr<WebVector<WebUSBDevice*>>, const WebUSBError&>;
-using WebUSBClientRequestDeviceCallbacks = WebCallbacks<WebPassOwnPtr<WebUSBDevice>, const WebUSBError&>;
+using WebUSBClientGetDevicesCallbacks = WebCallbacks<std::unique_ptr<WebVector<WebUSBDevice*>>, const WebUSBError&>;
+using WebUSBClientRequestDeviceCallbacks = WebCallbacks<std::unique_ptr<WebUSBDevice>, const WebUSBError&>;
 
 class WebUSBClient {
 public:
@@ -24,10 +24,10 @@
         virtual ~Observer() { }
 
         // Called when a device is connected to the system.
-        virtual void onDeviceConnected(WebPassOwnPtr<WebUSBDevice>) = 0;
+        virtual void onDeviceConnected(std::unique_ptr<WebUSBDevice>) = 0;
 
         // Called when a device is disconnected from the system.
-        virtual void onDeviceDisconnected(WebPassOwnPtr<WebUSBDevice>) = 0;
+        virtual void onDeviceDisconnected(std::unique_ptr<WebUSBDevice>) = 0;
     };
 
     virtual ~WebUSBClient() { }

diff --git a/third_party/WebKit/public/platform/modules/webusb/WebUSBDevice.h b/third_party/WebKit/public/platform/modules/webusb/WebUSBDevice.h
index 59ccd7f4..85812ae 100644
--- a/third_party/WebKit/public/platform/modules/webusb/WebUSBDevice.h
+++ b/third_party/WebKit/public/platform/modules/webusb/WebUSBDevice.h

@@ -6,9 +6,10 @@
 #define WebUSBDevice_h
 
 #include "public/platform/WebCallbacks.h"
-#include "public/platform/WebPassOwnPtr.h"
 #include "public/platform/WebVector.h"
 
+#include <memory>
+
 namespace blink {
 
 struct WebUSBDeviceInfo;
@@ -23,7 +24,7 @@
 using WebUSBDeviceResetCallbacks = WebCallbacks<void, const WebUSBError&>;
 using WebUSBDeviceSetInterfaceAlternateSettingCallbacks = WebCallbacks<void, const WebUSBError&>;
 using WebUSBDeviceClearHaltCallbacks = WebCallbacks<void, const WebUSBError&>;
-using WebUSBDeviceTransferCallbacks = WebCallbacks<WebPassOwnPtr<WebUSBTransferInfo>, const WebUSBError&>;
+using WebUSBDeviceTransferCallbacks = WebCallbacks<std::unique_ptr<WebUSBTransferInfo>, const WebUSBError&>;
 
 class WebUSBDevice {
 public:

diff --git a/third_party/WebKit/public/web/modules/serviceworker/WebServiceWorkerContextProxy.h b/third_party/WebKit/public/web/modules/serviceworker/WebServiceWorkerContextProxy.h
index 319a529c..d1e44db 100644
--- a/third_party/WebKit/public/web/modules/serviceworker/WebServiceWorkerContextProxy.h
+++ b/third_party/WebKit/public/web/modules/serviceworker/WebServiceWorkerContextProxy.h

@@ -33,10 +33,11 @@
 
 #include "public/platform/WebGeofencingEventType.h"
 #include "public/platform/WebMessagePortChannel.h"
-#include "public/platform/WebPassOwnPtr.h"
 #include "public/platform/modules/serviceworker/WebServiceWorker.h"
 #include "public/platform/modules/serviceworker/WebServiceWorkerRegistration.h"
 
+#include <memory>
+
 namespace blink {
 
 class WebServiceWorkerRequest;
@@ -51,11 +52,11 @@
 public:
     virtual ~WebServiceWorkerContextProxy() { }
 
-    virtual void setRegistration(WebPassOwnPtr<WebServiceWorkerRegistration::Handle>) = 0;
+    virtual void setRegistration(std::unique_ptr<WebServiceWorkerRegistration::Handle>) = 0;
 
     virtual void dispatchActivateEvent(int eventID) = 0;
     virtual void dispatchExtendableMessageEvent(int eventID, const WebString& message, const WebSecurityOrigin& sourceOrigin, const WebMessagePortChannelArray&, const WebServiceWorkerClientInfo&) = 0;
-    virtual void dispatchExtendableMessageEvent(int eventID, const WebString& message, const WebSecurityOrigin& sourceOrigin, const WebMessagePortChannelArray&, WebPassOwnPtr<WebServiceWorker::Handle>) = 0;
+    virtual void dispatchExtendableMessageEvent(int eventID, const WebString& message, const WebSecurityOrigin& sourceOrigin, const WebMessagePortChannelArray&, std::unique_ptr<WebServiceWorker::Handle>) = 0;
     virtual void dispatchInstallEvent(int eventID) = 0;
     virtual void dispatchFetchEvent(int eventID, const WebServiceWorkerRequest& webRequest) = 0;
     virtual void dispatchForeignFetchEvent(int eventID, const WebServiceWorkerRequest& webRequest) = 0;

diff --git a/tools/android/loading/common_util.py b/tools/android/loading/common_util.py
index 9384df0..ca06da2 100644
--- a/tools/android/loading/common_util.py
+++ b/tools/android/loading/common_util.py

@@ -2,7 +2,10 @@
 # Use of this source code is governed by a BSD-style license that can be
 # found in the LICENSE file.
 
+import contextlib
 import logging
+import shutil
+import tempfile
 import time
 
 
@@ -61,3 +64,15 @@
     getattr(instance, attr) # To raise AttributeError if attr doesn't exist.
     setattr(instance, attr, json_dict[attr])
   return instance
+
+
+@contextlib.contextmanager
+def TemporaryDirectory():
+  """Returns a freshly-created directory that gets automatically deleted after
+  usage.
+  """
+  name = tempfile.mkdtemp()
+  try:
+    yield name
+  finally:
+    shutil.rmtree(name)

diff --git a/tools/android/loading/controller.py b/tools/android/loading/controller.py
index b6616f94..567bcb7 100644
--- a/tools/android/loading/controller.py
+++ b/tools/android/loading/controller.py

@@ -346,7 +346,7 @@
     the value of stdout/stderr based on the value of OPTIONS.local_noisy."""
     stdout = None if OPTIONS.local_noisy else file('/dev/null', 'w')
     stderr = stdout
-    return self.OpenWithRedirection(self, stdout, stderr)
+    return self.OpenWithRedirection(stdout, stderr)
 
   def PushBrowserCache(self, cache_path):
     """Override for chrome cache pushing."""

diff --git a/tools/android/loading/gce/main.py b/tools/android/loading/gce/main.py
index c20f0ae..dc1da8e 100644
--- a/tools/android/loading/gce/main.py
+++ b/tools/android/loading/gce/main.py

@@ -22,6 +22,7 @@
 import controller
 import loading_trace
 import options
+from loading_trace_database import LoadingTraceDatabase
 
 
 class ServerApp(object):
@@ -114,7 +115,8 @@
       log_filename: Name of the file where standard output and errors are logged
 
     Returns:
-      True if the trace was generated successfully.
+      A dictionary of metadata about the trace, including a 'succeeded' field
+      indicating whether the trace was successfully generated.
     """
     try:
       os.remove(filename)  # Remove any existing trace for this URL.
@@ -127,7 +129,7 @@
     old_stdout = sys.stdout
     old_stderr = sys.stderr
 
-    succeeded = True
+    trace_metadata = { 'succeeded' : False, 'url' : url }
     try:
       with open(log_filename, 'w') as sys.stdout:
         sys.stderr = sys.stdout
@@ -146,8 +148,9 @@
           connection.ClearCache()
           trace = loading_trace.LoadingTrace.RecordUrlNavigation(
               url, connection, chrome_ctl.ChromeMetadata())
+          trace_metadata['succeeded'] = True
+          trace_metadata.update(trace.ToJsonDict()[trace._METADATA_KEY])
     except Exception as e:
-      succeeded = False
       sys.stderr.write(e)
 
     sys.stdout = old_stdout
@@ -156,7 +159,7 @@
     with open(filename, 'w') as f:
       json.dump(trace.ToJsonDict(), f, sort_keys=True, indent=2)
 
-    return succeeded
+    return trace_metadata
 
   def _GetCurrentTaskCount(self):
     """Returns the number of remaining tasks. Thread safe."""
@@ -183,6 +186,8 @@
     failures_dir = self._base_path_in_bucket + 'failures/'
     traces_dir = self._base_path_in_bucket + 'traces/'
 
+    trace_database = LoadingTraceDatabase({})
+
     # TODO(blundell): Fix this up.
     logs_dir = self._base_path_in_bucket + 'analyze_logs/'
     log_filename = 'analyze.log'
@@ -194,10 +199,15 @@
       for repeat in range(repeat_count):
         print 'Generating trace for URL: %s' % url
         remote_filename = local_filename + '/' + str(repeat)
-        if self._GenerateTrace(
-            url, emulate_device, emulate_network, local_filename, log_filename):
+        trace_metadata = self._GenerateTrace(
+            url, emulate_device, emulate_network, local_filename, log_filename)
+        if trace_metadata['succeeded']:
           print 'Uploading: %s' % remote_filename
-          self._UploadFile(local_filename, traces_dir + remote_filename)
+          remote_trace_location = traces_dir + remote_filename
+          self._UploadFile(local_filename, remote_trace_location)
+          full_cloud_storage_path = ('gs://' + self._bucket_name + '/' +
+              remote_trace_location)
+          trace_database.AddTrace(full_cloud_storage_path, trace_metadata)
         else:
           print 'Trace generation failed for URL: %s' % url
           self._tasks_lock.acquire()
@@ -212,6 +222,9 @@
       url = self._tasks.pop()
       self._tasks_lock.release()
 
+    self._UploadString(json.dumps(trace_database.ToJsonDict(), indent=2),
+                       traces_dir + 'trace_database.json')
+
     if len(self._failed_tasks) > 0:
       print 'Uploading failing URLs'
       self._UploadString(json.dumps(self._failed_tasks, indent=2),

diff --git a/tools/android/loading/loading_trace_analyzer.py b/tools/android/loading/loading_trace_analyzer.py
index 1821001..3c7882d 100755
--- a/tools/android/loading/loading_trace_analyzer.py
+++ b/tools/android/loading/loading_trace_analyzer.py

@@ -33,6 +33,23 @@
       dest='where_statement', type=str,
       nargs=2, metavar=('FORMAT', 'REGEX'), default=[],
       help='Where statement to filter such as: --where "{protocol}" "https?"')
+
+  # requests listing subcommand.
+  prune_parser = subparsers.add_parser('prune',
+      help='Prunes some stuff from traces to make them small.')
+  prune_parser.add_argument('loading_trace', type=file,
+      help='Input path of the loading trace.')
+  prune_parser.add_argument('-t', '--trace-filters',
+      type=str, nargs='+', metavar='REGEX', default=[],
+      help='Regex filters to whitelist trace events.')
+  prune_parser.add_argument('-r', '--request-member-filter',
+      type=str, nargs='+', metavar='REGEX', default=[],
+      help='Regex filters to whitelist requests\' members.')
+  prune_parser.add_argument('-i', '--indent', type=int, default=2,
+      help='Number of space to indent the output.')
+  prune_parser.add_argument('-o', '--output',
+      type=argparse.FileType('w'), default=sys.stdout,
+      help='Output destination path if different from stdout.')
   return parser
 
 
@@ -70,9 +87,70 @@
     yield output_format.format(**request_event_json)
 
 
-def main(command_line_args):
-  """Command line tool entry point.
+def _PruneMain(args):
+  """`loading_trace_analyzer.py requests` Command line tool entry point.
+
+  Args:
+    args: Command line parsed arguments.
+
+  Example:
+    Keep only blink.net trace event category:
+      ... prune -t "blink.net"
+
+    Keep only requestStart trace events:
+      ... prune -t "requestStart"
+
+    Keep only requestStart trace events of the blink.user_timing category:
+      ... prune -t "blink.user_timing:requestStart"
+
+    Keep only all blink trace event categories:
+      ... prune -t "^blink\.*"
+
+    Keep only requests' url member:
+      ... prune -r "^url$"
+
+    Keep only requests' url and document_url members:
+      ... prune -r "^./url$"
+
+    Keep only requests' url, document_url and initiator members:
+      ... prune -r "^./url$" "initiator"
   """
+  trace_json = json.load(args.loading_trace)
+
+  # Filter trace events.
+  regexes = [re.compile(f) for f in args.trace_filters]
+  events = []
+  for event in trace_json['tracing_track']['events']:
+    prune = True
+    for cat in event['cat'].split(','):
+      event_name = cat + ':' + event['name']
+      for regex in regexes:
+        if regex.search(event_name):
+          prune = False
+          break
+      if not prune:
+        events.append(event)
+        break
+  trace_json['tracing_track']['events'] = events
+
+  # Filter members of requests.
+  regexes = [re.compile(f) for f in args.request_member_filter]
+  for request in trace_json['request_track']['events']:
+    for key in request.keys():
+      prune = True
+      for regex in regexes:
+        if regex.search(key):
+          prune = False
+          break
+      if prune:
+        del request[key]
+
+  json.dump(trace_json, args.output, indent=args.indent)
+  return 0
+
+
+def main(command_line_args):
+  """Command line tool entry point."""
   args = _ArgumentParser().parse_args(command_line_args)
   if args.subcommand == 'requests':
     try:
@@ -91,6 +169,8 @@
       sys.stderr.write("Invalid where statement REGEX: {}\n{}\n".format(
           where_statement[1], str(e)))
     return 1
+  elif args.subcommand == 'prune':
+    return _PruneMain(args)
   assert False
 
 

diff --git a/tools/android/loading/loading_trace_database.py b/tools/android/loading/loading_trace_database.py
index d2e49100..2ef33b0 100644
--- a/tools/android/loading/loading_trace_database.py
+++ b/tools/android/loading/loading_trace_database.py

@@ -7,13 +7,18 @@
 import json
 from google_storage_util import ReadFromGoogleStorage
 
-class LoadingTraceDatabase:
 
+class LoadingTraceDatabase(object):
   def __init__(self, traces_dict):
     """traces_dict is a dictionary mapping filenames of traces to metadata
        about those traces."""
     self._traces_dict = traces_dict
 
+  def AddTrace(self, filename, trace_dict):
+    """Adds a mapping from |filename| to |trace_dict| into the database."""
+    assert filename not in self._traces_dict
+    self._traces_dict[filename] = trace_dict
+
   def GetTraceFilesForURL(self, url):
     """Given a URL, returns the set of filenames of traces that were generated
        for this URL."""

diff --git a/tools/android/loading/loading_trace_database_unittest.py b/tools/android/loading/loading_trace_database_unittest.py
index 775638c..31dc9b3 100644
--- a/tools/android/loading/loading_trace_database_unittest.py
+++ b/tools/android/loading/loading_trace_database_unittest.py

@@ -32,6 +32,14 @@
     self.assertEqual(
         self._JSON_DATABASE, self.database.ToJsonDict())
 
+  def testAddTrace(self):
+    dummy_url = "http://dummy.com"
+    new_trace_file = "traces/new_trace.json"
+    self.assertEqual(self.database.GetTraceFilesForURL(dummy_url), [])
+    self.database.AddTrace(new_trace_file, {"url" : dummy_url})
+    self.assertEqual(self.database.GetTraceFilesForURL(dummy_url),
+                     [new_trace_file])
+
 
 if __name__ == '__main__':
   unittest.main()

diff --git a/tools/android/loading/prefetch_view.py b/tools/android/loading/prefetch_view.py
index 85dd48d..057ac0f 100644
--- a/tools/android/loading/prefetch_view.py
+++ b/tools/android/loading/prefetch_view.py

@@ -56,7 +56,7 @@
     self.postload_msec = user_lens.PostloadTimeMsec()
     self.graph = dependency_graph.RequestDependencyGraph(
         requests, dependencies_lens, node_class=RequestNode)
-    preloaded_requests = [r.request_id for r in self._PreloadedRequests(
+    preloaded_requests = [r.request_id for r in self.PreloadedRequests(
         requests[0], dependencies_lens, trace)]
     self._AnnotateNodes(self.graph.graph.Nodes(), preloaded_requests,
                         critical_requests_ids)
@@ -102,8 +102,8 @@
       node.before = node.request.request_id in critical_requests_ids
 
   @classmethod
-  def _ParserDiscoverableRequests(
-      cls, dependencies_lens, request, recurse=False):
+  def ParserDiscoverableRequests(
+      cls, request, dependencies_lens, recurse=False):
     """Returns a list of requests IDs dicovered by the parser.
 
     Args:
@@ -128,7 +128,7 @@
         [dependencies_lens.GetRedirectChain(r) for r in requests]))
 
   @classmethod
-  def _PreloadedRequests(cls, request, dependencies_lens, trace):
+  def PreloadedRequests(cls, request, dependencies_lens, trace):
     """Returns the requests that have been preloaded from a given request.
 
     This list is the set of request that are:
@@ -142,7 +142,7 @@
 
     Returns:
       A list of Request. Does not include the root request. This list is a
-      subset of the one returned by _ParserDiscoverableRequests().
+      subset of the one returned by ParserDiscoverableRequests().
     """
     # Preload step events are emitted in ResourceFetcher::preloadStarted().
     resource_events = trace.tracing_track.Filter(
@@ -155,8 +155,8 @@
       preload_event = resource_events.EventFromStep(preload_step_event)
       if preload_event:
         preloaded_urls.add(preload_event.args['url'])
-    parser_requests = cls._ParserDiscoverableRequests(
-        dependencies_lens, request)
+    parser_requests = cls.ParserDiscoverableRequests(
+        request, dependencies_lens)
     preloaded_root_requests = filter(
         lambda r: r.url in preloaded_urls, parser_requests)
     # We can actually fetch the whole redirect chain.

diff --git a/tools/android/loading/prefetch_view_unittest.py b/tools/android/loading/prefetch_view_unittest.py
index e222bf5..be97809 100644
--- a/tools/android/loading/prefetch_view_unittest.py
+++ b/tools/android/loading/prefetch_view_unittest.py

@@ -25,8 +25,8 @@
 
   def testParserDiscoverableRequests(self):
     first_request = TestRequests.FIRST_REDIRECT_REQUEST
-    discovered_requests = PrefetchSimulationView._ParserDiscoverableRequests(
-        self.dependencies_lens, first_request)
+    discovered_requests = PrefetchSimulationView.ParserDiscoverableRequests(
+        first_request, self.dependencies_lens)
     self.assertListEqual(
         [TestRequests.FIRST_REDIRECT_REQUEST,
          TestRequests.JS_REQUEST, TestRequests.JS_REQUEST_OTHER_FRAME,
@@ -34,7 +34,7 @@
 
   def testPreloadedRequests(self):
     first_request = TestRequests.FIRST_REDIRECT_REQUEST
-    preloaded_requests = PrefetchSimulationView._PreloadedRequests(
+    preloaded_requests = PrefetchSimulationView.PreloadedRequests(
         first_request, self.dependencies_lens, self.trace)
     self.assertListEqual([first_request], preloaded_requests)
     self._SetUp(
@@ -44,7 +44,7 @@
          {'args': {'step': 'Preload'}, 'cat': 'blink.net',
           'id': '0xaf9f14fa9dd6c314', 'name': 'Resource', 'ph': 'T',
           'ts': 12, 'pid': 12, 'tid': 12}])
-    preloaded_requests = PrefetchSimulationView._PreloadedRequests(
+    preloaded_requests = PrefetchSimulationView.PreloadedRequests(
         first_request, self.dependencies_lens, self.trace)
     self.assertListEqual([TestRequests.FIRST_REDIRECT_REQUEST,
          TestRequests.JS_REQUEST, TestRequests.JS_REQUEST_OTHER_FRAME,

diff --git a/tools/android/loading/request_track.py b/tools/android/loading/request_track.py
index 47b874f8..bf19fbbf 100644
--- a/tools/android/loading/request_track.py
+++ b/tools/android/loading/request_track.py

@@ -333,6 +333,9 @@
                       % len(self._requests_in_flight))
     return self._requests
 
+  def GetFirstResourceRequest(self):
+    return self.GetEvents()[0]
+
   def GetFirstRequestMillis(self):
     """Find the canonical start time for this track.
 

diff --git a/tools/android/loading/sandwich.py b/tools/android/loading/sandwich.py
index 3fac221..5f61aac3 100755
--- a/tools/android/loading/sandwich.py
+++ b/tools/android/loading/sandwich.py

@@ -15,6 +15,7 @@
 import csv
 import logging
 import os
+import shutil
 import sys
 
 _SRC_DIR = os.path.abspath(os.path.join(
@@ -28,11 +29,13 @@
 import devil_chromium
 
 import chrome_cache
+import common_util
 import emulation
 import options
 import sandwich_metrics
 import sandwich_misc
 from sandwich_runner import SandwichRunner
+from trace_test.webserver_test import WebServer
 
 
 # Use options layer to access constants.
@@ -137,6 +140,10 @@
   filter_cache_parser.add_argument('--cache-archive', type=str, required=True,
                                    dest='cache_archive_path',
                                    help='Path of the cache archive to filter.')
+  filter_cache_parser.add_argument('--subresource-discoverer', required=True,
+      help='Strategy for populating the cache with a subset of resources, '
+           'according to the way they can be discovered',
+      choices=sandwich_misc.SUBRESOURCE_DISCOVERERS)
   filter_cache_parser.add_argument('--output', type=str, required=True,
                                    dest='output_cache_archive_path',
                                    help='Path of filtered cache archive.')
@@ -147,11 +154,24 @@
           'list the ones discoverable by the HTML pre-scanner for that given ' +
           'url.')
 
+  # Record test trace subcommand.
+  record_trace_parser = subparsers.add_parser('record-test-trace',
+      help='Record a test trace using the trace_test.webserver_test.')
+  record_trace_parser.add_argument('--source-dir', type=str, required=True,
+                                   help='Base path where the files are opened'
+                                        'by the web server.')
+  record_trace_parser.add_argument('--page', type=str, required=True,
+                                   help='Source page in source-dir to navigate '
+                                        'to.')
+  record_trace_parser.add_argument('-o', '--output', type=str, required=True,
+                                   help='Output path of the generated trace.')
+
   return parser
 
 
 def _RecordWprMain(args):
-  sandwich_runner = SandwichRunner(args.job)
+  sandwich_runner = SandwichRunner()
+  sandwich_runner.LoadJob(args.job)
   sandwich_runner.PullConfigFromArgs(args)
   sandwich_runner.wpr_record = True
   sandwich_runner.PrintConfig()
@@ -162,7 +182,8 @@
 
 
 def _CreateCacheMain(args):
-  sandwich_runner = SandwichRunner(args.job)
+  sandwich_runner = SandwichRunner()
+  sandwich_runner.LoadJob(args.job)
   sandwich_runner.PullConfigFromArgs(args)
   sandwich_runner.cache_operation = 'save'
   sandwich_runner.PrintConfig()
@@ -173,7 +194,8 @@
 
 
 def _RunJobMain(args):
-  sandwich_runner = SandwichRunner(args.job)
+  sandwich_runner = SandwichRunner()
+  sandwich_runner.LoadJob(args.job)
   sandwich_runner.PullConfigFromArgs(args)
   sandwich_runner.PrintConfig()
   sandwich_runner.Run()
@@ -196,8 +218,8 @@
 def _FilterCacheMain(args):
   whitelisted_urls = set()
   for loading_trace_path in args.loading_trace_paths:
-    whitelisted_urls.update(
-        sandwich_misc.ExtractParserDiscoverableResources(loading_trace_path))
+    whitelisted_urls.update(sandwich_misc.ExtractDiscoverableUrls(
+        loading_trace_path, args.subresource_discoverer))
   if not os.path.isdir(os.path.dirname(args.output_cache_archive_path)):
     os.makedirs(os.path.dirname(args.output_cache_archive_path))
   chrome_cache.ApplyUrlWhitelistToCacheArchive(args.cache_archive_path,
@@ -206,6 +228,22 @@
   return 0
 
 
+def _RecordWebServerTestTrace(args):
+  with common_util.TemporaryDirectory() as out_path:
+    sandwich_runner = SandwichRunner()
+    # Reuse the WPR's forwarding to access the webpage from Android.
+    sandwich_runner.wpr_record = True
+    sandwich_runner.wpr_archive_path = os.path.join(out_path, 'wpr')
+    sandwich_runner.trace_output_directory = os.path.join(out_path, 'run')
+    with WebServer.Context(
+        source_dir=args.source_dir, communication_dir=out_path) as server:
+      address = server.Address()
+      sandwich_runner.urls = ['http://%s/%s' % (address, args.page)]
+      sandwich_runner.Run()
+    shutil.copy(os.path.join(out_path, 'run', '0', 'trace.json'), args.output)
+  return 0
+
+
 def main(command_line_args):
   logging.basicConfig(level=logging.INFO)
   devil_chromium.Initialize()
@@ -226,6 +264,8 @@
     return _ExtractMetricsMain(args)
   if args.subcommand == 'filter-cache':
     return _FilterCacheMain(args)
+  if args.subcommand == 'record-test-trace':
+    return _RecordWebServerTestTrace(args)
   assert False
 
 

diff --git a/tools/android/loading/sandwich_metrics.py b/tools/android/loading/sandwich_metrics.py
index e30232c..1a9e96d 100644
--- a/tools/android/loading/sandwich_metrics.py
+++ b/tools/android/loading/sandwich_metrics.py

@@ -29,7 +29,16 @@
 import tracing
 
 
-CATEGORIES = ['blink.user_timing', 'disabled-by-default-memory-infra']
+# List of selected trace event categories when running chrome.
+CATEGORIES = [
+    # Need blink network trace events for prefetch_view.PrefetchSimulationView
+    'blink.net',
+
+    # Need to get mark trace events for _GetWebPageTrackedEvents()
+    'blink.user_timing',
+
+    # Need to memory dump trace event for _GetBrowserDumpEvents()
+    'disabled-by-default-memory-infra']
 
 CSV_FIELD_NAMES = [
     'id',

diff --git a/tools/android/loading/sandwich_misc.py b/tools/android/loading/sandwich_misc.py
index a15f5ab..13988c3 100644
--- a/tools/android/loading/sandwich_misc.py
+++ b/tools/android/loading/sandwich_misc.py

@@ -4,9 +4,27 @@
 
 import logging
 
+from loading_trace import LoadingTrace
+from prefetch_view import PrefetchSimulationView
+from request_dependencies_lens import RequestDependencyLens
+from user_satisfied_lens import FirstContentfulPaintLens
 import wpr_backend
-import loading_trace
-import request_dependencies_lens
+
+
+# Prefetches the first resource following the redirection chain.
+REDIRECTED_MAIN_DISCOVERER = 'redirected-main'
+
+# All resources which are fetched from the main document and their redirections.
+PARSER_DISCOVERER = 'parser',
+
+# Simulation of HTMLPreloadScanner on the main document and their redirections.
+HTML_PRELOAD_SCANNER_DISCOVERER = 'html-scanner',
+
+SUBRESOURCE_DISCOVERERS = set([
+  REDIRECTED_MAIN_DISCOVERER,
+  PARSER_DISCOVERER,
+  HTML_PRELOAD_SCANNER_DISCOVERER
+])
 
 
 def PatchWpr(wpr_archive_path):
@@ -44,38 +62,55 @@
   wpr_archive.Persist()
 
 
-def ExtractParserDiscoverableResources(loading_trace_path):
-  """Extracts the parser discoverable resources from a loading trace.
+def ExtractDiscoverableUrls(loading_trace_path, subresource_discoverer):
+  """Extracts discoverable resource urls from a loading trace according to a
+  sub-resource discoverer.
 
   Args:
     loading_trace_path: The loading trace's path.
+    subresource_discoverer: The sub-resources discoverer that should white-list
+      the resources to keep in cache for the NoState-Prefetch benchmarks.
 
   Returns:
     A set of urls.
   """
-  whitelisted_urls = set()
-  logging.info('loading %s' % loading_trace_path)
-  trace = loading_trace.LoadingTrace.FromJsonFile(loading_trace_path)
-  requests_lens = request_dependencies_lens.RequestDependencyLens(trace)
-  deps = requests_lens.GetRequestDependencies()
+  assert subresource_discoverer in SUBRESOURCE_DISCOVERERS, \
+      'unknown prefetch simulation {}'.format(subresource_discoverer)
 
-  main_resource_request = deps[0][0]
-  logging.info('white-listing %s' % main_resource_request.url)
-  whitelisted_urls.add(main_resource_request.url)
-  for (first, second, reason) in deps:
+  # Load trace and related infos.
+  logging.info('loading %s' % loading_trace_path)
+  trace = LoadingTrace.FromJsonFile(loading_trace_path)
+  dependencies_lens = RequestDependencyLens(trace)
+  first_resource_request = trace.request_track.GetFirstResourceRequest()
+
+  # Build the list of discovered requests according to the desired simulation.
+  discovered_requests = []
+  if subresource_discoverer == REDIRECTED_MAIN_DISCOVERER:
+    discovered_requests = \
+        [dependencies_lens.GetRedirectChain(first_resource_request)[-1]]
+  elif subresource_discoverer == PARSER_DISCOVERER:
+    discovered_requests = PrefetchSimulationView.ParserDiscoverableRequests(
+        first_resource_request, dependencies_lens)
+  elif subresource_discoverer == HTML_PRELOAD_SCANNER_DISCOVERER:
+    discovered_requests = PrefetchSimulationView.PreloadedRequests(
+        first_resource_request, dependencies_lens, trace)
+  else:
+    assert False
+
+  # Prune out data:// requests.
+  whitelisted_urls = set()
+  logging.info('white-listing %s' % first_resource_request.url)
+  whitelisted_urls.add(first_resource_request.url)
+  for request in discovered_requests:
     # Work-around where the protocol may be none for an unclear reason yet.
     # TODO(gabadie): Follow up on this with Clovis guys and possibly remove
     #   this work-around.
-    if not second.protocol:
-      logging.info('ignoring %s (no protocol)' % second.url)
+    if not request.protocol:
+      logging.warning('ignoring %s (no protocol)' % request.url)
       continue
     # Ignore data protocols.
-    if not second.protocol.startswith('http'):
-      logging.info('ignoring %s (`%s` is not HTTP{,S} protocol)' % (
-          second.url, second.protocol))
+    if not request.protocol.startswith('http'):
       continue
-    if (first.request_id == main_resource_request.request_id and
-        reason == 'parser' and second.url not in whitelisted_urls):
-      logging.info('white-listing %s' % second.url)
-      whitelisted_urls.add(second.url)
+    logging.info('white-listing %s' % request.url)
+    whitelisted_urls.add(request.url)
   return whitelisted_urls

diff --git a/tools/android/loading/sandwich_misc_unittest.py b/tools/android/loading/sandwich_misc_unittest.py
new file mode 100644
index 0000000..f75288c
--- /dev/null
+++ b/tools/android/loading/sandwich_misc_unittest.py

@@ -0,0 +1,45 @@
+# Copyright 2016 The Chromium Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+import os
+import unittest
+import urlparse
+
+import sandwich_misc
+
+
+LOADING_DIR = os.path.dirname(__file__)
+TEST_DATA_DIR = os.path.join(LOADING_DIR, 'testdata')
+
+
+class SandwichMiscTest(unittest.TestCase):
+  _TRACE_PATH = os.path.join(TEST_DATA_DIR, 'scanner_vs_parser.trace')
+
+  def GetResourceUrl(self, path):
+    return urlparse.urljoin('http://l/', path)
+
+  def testRedirectedMainWhitelisting(self):
+    urls_set_ref = set([self.GetResourceUrl('./')])
+    urls_set = sandwich_misc.ExtractDiscoverableUrls(
+        self._TRACE_PATH, sandwich_misc.REDIRECTED_MAIN_DISCOVERER)
+    self.assertEquals(urls_set_ref, urls_set)
+
+  def testParserDiscoverableWhitelisting(self):
+    urls_set_ref = set([self.GetResourceUrl('./'),
+                        self.GetResourceUrl('0.png'),
+                        self.GetResourceUrl('1.png')])
+    urls_set = sandwich_misc.ExtractDiscoverableUrls(
+        self._TRACE_PATH, sandwich_misc.PARSER_DISCOVERER)
+    self.assertEquals(urls_set_ref, urls_set)
+
+  def testHTMLPreloadScannerWhitelisting(self):
+    urls_set_ref = set([self.GetResourceUrl('./'),
+                        self.GetResourceUrl('0.png')])
+    urls_set = sandwich_misc.ExtractDiscoverableUrls(
+        self._TRACE_PATH, sandwich_misc.HTML_PRELOAD_SCANNER_DISCOVERER)
+    self.assertEquals(urls_set_ref, urls_set)
+
+
+if __name__ == '__main__':
+  unittest.main()

diff --git a/tools/android/loading/sandwich_runner.py b/tools/android/loading/sandwich_runner.py
index 5dd7ba2..ebef772 100644
--- a/tools/android/loading/sandwich_runner.py
+++ b/tools/android/loading/sandwich_runner.py

@@ -78,7 +78,7 @@
   command line flags have `dest` parameter set to existing runner members.
   """
 
-  def __init__(self, job_name):
+  def __init__(self):
     """Configures a sandwich runner out of the box.
 
     Public members are meant to be configured as wished before calling Run().
@@ -97,7 +97,7 @@
     self.disable_wpr_script_injection = False
 
     # The job name. Is str.
-    self.job_name = job_name
+    self.job_name = '__unknown_job'
 
     # Number of times to repeat the job.
     self.job_repeat = 1
@@ -112,7 +112,7 @@
     self.trace_output_directory = None
 
     # List of urls to run.
-    self.urls = _ReadUrlsFromJobDescription(job_name)
+    self.urls = []
 
     # Configures whether to record speed-index video.
     self.record_video = False
@@ -126,6 +126,10 @@
     self._chrome_ctl = None
     self._local_cache_directory_path = None
 
+  def LoadJob(self, job_name):
+    self.job_name = job_name
+    self.urls = _ReadUrlsFromJobDescription(job_name)
+
   def PullConfigFromArgs(self, args):
     """Configures the sandwich runner from parsed command line argument.
 

diff --git a/tools/android/loading/testdata/scanner_vs_parser.trace b/tools/android/loading/testdata/scanner_vs_parser.trace
new file mode 100644
index 0000000..427cdc8
--- /dev/null
+++ b/tools/android/loading/testdata/scanner_vs_parser.trace

@@ -0,0 +1,159 @@
+{
+  "metadata": {},
+  "page_track": {
+    "events": []
+  },
+  "request_track": {
+    "events": [
+      {
+        "initiator": {
+          "type": "other"
+        },
+        "protocol": "http/1.0",
+        "url": "http://l/"
+      },
+      {
+        "initiator": {
+          "lineNumber": 28,
+          "type": "parser",
+          "url": "http://l/"
+        },
+        "protocol": "data",
+        "url": "data:image/png;base64,iVBO[PRUNED]"
+      },
+      {
+        "initiator": {
+          "lineNumber": 21,
+          "type": "parser",
+          "url": "http://l/"
+        },
+        "protocol": "http/1.0",
+        "url": "http://l/0.png"
+      },
+      {
+        "initiator": {
+          "type": "parser",
+          "url": "http://l/"
+        },
+        "protocol": "http/1.0",
+        "url": "http://l/1.png"
+      },
+      {
+        "initiator": {
+          "type": "other"
+        },
+        "protocol": "http/1.0",
+        "url": "http://l/favicon.ico"
+      }
+    ],
+    "metadata": {
+      "duplicates_count": 0,
+      "inconsistent_initiators": 0
+    }
+  },
+  "tracing_track": {
+    "events": [
+      {
+        "args": {
+          "priority": 4,
+          "url": "http://l/"
+        },
+        "cat": "blink.net",
+        "name": "Resource",
+        "ph": "S",
+        "pid": 3,
+        "ts": 1213697828839
+      },
+      {
+        "args": {},
+        "cat": "blink.net",
+        "name": "Resource",
+        "ph": "F",
+        "pid": 3,
+        "ts": 1213697889955
+      },
+      {
+        "args": {
+          "priority": 1,
+          "url": "http://l/0.png"
+        },
+        "cat": "blink.net",
+        "name": "Resource",
+        "ph": "S",
+        "pid": 3,
+        "ts": 1213697891911
+      },
+      {
+        "args": {
+          "step": "Preload"
+        },
+        "cat": "blink.net",
+        "name": "Resource",
+        "ph": "T",
+        "pid": 3,
+        "ts": 1213697892658
+      },
+      {
+        "args": {
+          "priority": 1,
+          "url": "http://l/1.png"
+        },
+        "cat": "blink.net",
+        "name": "Resource",
+        "ph": "S",
+        "pid": 3,
+        "ts": 1213697934273
+      },
+      {
+        "args": {},
+        "cat": "blink.net",
+        "name": "Resource",
+        "ph": "F",
+        "pid": 3,
+        "ts": 1213697943810
+      },
+      {
+        "args": {
+          "priority": 3,
+          "step": "ChangePriority"
+        },
+        "cat": "blink.net",
+        "name": "Resource",
+        "ph": "T",
+        "pid": 3,
+        "ts": 1213697984606
+      },
+      {
+        "args": {
+          "priority": 3,
+          "step": "ChangePriority"
+        },
+        "cat": "blink.net",
+        "name": "Resource",
+        "ph": "T",
+        "pid": 3,
+        "ts": 1213697984875
+      },
+      {
+        "args": {
+          "priority": 3,
+          "step": "ChangePriority"
+        },
+        "cat": "blink.net",
+        "name": "Resource",
+        "ph": "T",
+        "pid": 3,
+        "ts": 1213697985346
+      },
+      {
+        "args": {},
+        "cat": "blink.net",
+        "name": "Resource",
+        "ph": "F",
+        "pid": 3,
+        "ts": 1213698035637
+      }
+    ]
+  },
+  "url": "http://l/"
+}

diff --git a/tools/android/loading/unmaintained/README.md b/tools/android/loading/unmaintained/README.md
new file mode 100644
index 0000000..295323b7
--- /dev/null
+++ b/tools/android/loading/unmaintained/README.md

@@ -0,0 +1,2 @@
+This directory contains unmaintained code that still has value, such as
+experimental or temporary scripts.

diff --git a/tools/android/loading/unmaintained/gce_validation_collect.sh b/tools/android/loading/unmaintained/gce_validation_collect.sh
new file mode 100755
index 0000000..41d84170
--- /dev/null
+++ b/tools/android/loading/unmaintained/gce_validation_collect.sh

@@ -0,0 +1,45 @@
+#!/bin/bash
+# Copyright 2016 The Chromium Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+# Takes a list of URLs (infile), and runs analyse.py on them in  parallel on a
+# device and on GCE, in a sychronized manner (the task is started on both
+# platforms at the same time).
+
+infile=$1
+outdir=$2
+instance_ip=$3
+repeat_count=$4
+
+for site in $(< $infile); do
+ echo $site
+ output_subdir=$(echo "$site"|tr "/:" "_")
+ echo 'Start remote task'
+ cat >urls.json << EOF
+ {
+  "urls" : [
+    "$site"
+  ],
+  "repeat_count" : "$repeat_count",
+  "emulate_device" : "Nexus 4"
+ }
+EOF
+
+ while [ "$(curl http://$instance_ip:8080/status)" != "Idle" ]; do
+   echo 'Waiting for instance to be ready, retry in 5s'
+   sleep 5
+ done
+ curl -X POST -d @urls.json http://$instance_ip:8080/set_tasks
+
+ echo 'Run on device'
+ mkdir $outdir/$output_subdir
+ for ((run=0;run<$repeat_count;++run)); do
+   echo '****'  $run
+   tools/android/loading/analyze.py log_requests \
+      --clear_cache \
+      --devtools_port 9222 \
+      --url $site \
+      --output $outdir/${output_subdir}/${run}
+ done
+done

diff --git a/tools/android/loading/unmaintained/gce_validation_compare.sh b/tools/android/loading/unmaintained/gce_validation_compare.sh
new file mode 100755
index 0000000..88e26df1
--- /dev/null
+++ b/tools/android/loading/unmaintained/gce_validation_compare.sh

@@ -0,0 +1,75 @@
+#!/bin/bash
+# Copyright 2016 The Chromium Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+# gce_validation_compare.sh rootdir compare_filename
+#   root_dir: root directory for the experiment.
+#   compare_filename: file where the comparison breakdown is output.
+#
+# Computes core sets from GCE and device experiment resutls, and compare them.
+# The expected directory structure is:
+#
+# root_dir/
+#   cloud/
+#     url1/         # Can be any name as long as it is mirrored under device/.
+#       run1.trace  # Can be any name.
+#       run2.trace
+#       ...
+#     url2/
+#     ...
+#   device/
+#     url1/
+#       run1.trace
+#       run2.trace
+#       ...
+#     url2/
+#     ...
+
+root_dir=$1
+compare_filename=$2
+
+rm $compare_filename
+
+# Check directory structure.
+if [ ! -d $root_dir/cloud ]; then
+  echo "$root_dir/cloud missing!"
+  exit 1
+fi
+
+if [ ! -d $root_dir/device ]; then
+  echo "$root_dir/device missing!"
+  exit 1
+fi
+
+for device_file in $root_dir/device/*/  ; do
+  cloud_file=$root_dir/cloud/$(basename $device_file)
+  if [ ! -d $cloud_file ]; then
+    echo "$cloud_file not found"
+  fi
+done
+
+for cloud_file in $root_dir/cloud/*/  ; do
+  device_file=$root_dir/device/$(basename $device_file)
+  if [ ! -d $device_file ]; then
+    echo "$device_file not found"
+  fi
+done
+
+# Loop through all the subdirectories, compute the core sets and compare them.
+for device_file in $root_dir/device/*/  ; do
+  base_name=$(basename $device_file)
+  python tools/android/loading/core_set.py page_core --sets device/$base_name \
+    --output $device_file/core_set.json --prefix $device_file
+
+  cloud_file=$root_dir/cloud/$base_name
+  if [ -d $cloud_file ]; then
+    python tools/android/loading/core_set.py page_core --sets cloud/$base_name \
+      --output $cloud_file/core_set.json --prefix $cloud_file
+
+    compare_result=$(python tools/android/loading/core_set.py compare \
+      --a $cloud_file/core_set.json --b $device_file/core_set.json)
+    compare_result+=" $base_name"
+    echo $compare_result >> $compare_filename
+  fi
+done

diff --git a/tools/mb/mb_config.pyl b/tools/mb/mb_config.pyl
index 42e77ce..f0cd4fa 100644
--- a/tools/mb/mb_config.pyl
+++ b/tools/mb/mb_config.pyl

@@ -101,7 +101,7 @@
       'Chromium Win x64 Clobber': 'tbd',
       'ChromiumOS Linux Tests': 'tbd',
       'ClangToTAndroidASan':
-        'android_clang_no_chrome_plugins_asan_gyp_debug_bot_minimal_symbols',
+        'android_clang_no_chrome_plugins_asan_gn_debug_bot_minimal_symbols',
       'ClangToTLinux': 'tbd',
       'ClangToTLinux (dbg)': 'tbd',
       'ClangToTLinuxASan': 'tbd',
@@ -146,13 +146,13 @@
       'Windows Tests (DrMemory)': 'tbd',
 
       'Android ChromeDriver Tests (dbg)': 'none',
-      'Android Cloud Tests': 'android_gyp_debug_static_bot_x86',
+      'Android Cloud Tests': 'android_gn_debug_static_bot_x86',
       'Android Remoting Tests': 'none',
       'Android Tests (trial)(dbg)': 'none',
-      'Android Tests (x86 emulator)': 'android_gyp_debug_static_bot_x86',
+      'Android Tests (x86 emulator)': 'android_gn_debug_static_bot_x86',
       'Android Asan Builder Tests (dbg)':
-          'android_asan_gyp_debug_bot_minimal_symbols',
-      'Android Builder (dbg)': 'android_gyp_debug_static_bot',
+          'android_asan_gn_debug_bot_minimal_symbols',
+      'Android Builder (dbg)': 'android_gn_debug_static_bot',
       'CFI Linux CF': 'gn_cfi_diag_release_bot',
       'CFI Linux ToT': 'gn_cfi_release_bot',
       'CFI Linux': 'gn_cfi_release_bot',
@@ -214,9 +214,9 @@
     },
 
     'chromium.gpu': {
-      'Android Debug (Nexus 5)': 'tbd',
-      'Android Debug (Nexus 6)': 'tbd',
-      'Android Debug (Nexus 9)': 'tbd',
+      'Android Debug (Nexus 5)': 'android_gyp_debug_static_bot',
+      'Android Debug (Nexus 6)': 'android_gyp_debug_static_bot',
+      'Android Debug (Nexus 9)': 'android_gyp_debug_static_bot_arm64',
       'GPU Mac Builder': 'tbd',
       'GPU Mac Builder (dbg)': 'tbd',
 
@@ -894,16 +894,16 @@
   # is not necessarily so (i.e., we might have mac, win, and linux
   # bots all using the 'gn_release_bot' config).
   'configs': {
-    'android_asan_gyp_debug_bot_minimal_symbols': [
-      'android', 'asan', 'gyp', 'debug_bot_minimal_symbols',
+    'android_asan_gn_debug_bot_minimal_symbols': [
+      'android', 'asan', 'gn', 'debug_bot_minimal_symbols',
     ],
 
     'android_cast_gyp_debug_static_bot': [
       'android', 'cast', 'gyp', 'debug_static_bot',
     ],
 
-    'android_clang_no_chrome_plugins_asan_gyp_debug_bot_minimal_symbols': [
-      'android', 'clang_no_chrome_plugins', 'asan', 'gyp',
+    'android_clang_no_chrome_plugins_asan_gn_debug_bot_minimal_symbols': [
+      'android', 'clang_no_chrome_plugins', 'asan', 'gn',
       'debug_bot_minimal_symbols',
     ],
 
@@ -1013,8 +1013,8 @@
       'android', 'gyp', 'debug_static_bot',
     ],
 
-    'android_gyp_debug_static_bot_x86': [
-      'android', 'gyp', 'debug_static_bot', 'x86',
+    'android_gyp_debug_static_bot_arm64': [
+      'android', 'gyp', 'debug_static_bot', 'arm64',
     ],
 
     'android_without_codecs_gyp_release_bot_minimal_symbols': [

diff --git a/tools/metrics/actions/actions.xml b/tools/metrics/actions/actions.xml
index d15985f..f56848e 100644
--- a/tools/metrics/actions/actions.xml
+++ b/tools/metrics/actions/actions.xml

@@ -8074,6 +8074,30 @@
   <description>Please enter the description of this user action.</description>
 </action>
 
+<action name="MobileComeToForeground">
+  <owner>tedchoc@chromium.org</owner>
+  <description>
+    Chrome has come to the foreground.  Only emitted if the foreground content
+    is an Activity that views web content, e.g., not settings.  This will be
+    emitted everytime the Activity goes from entirely hidden to at least
+    partially visible.  Partially visible means that at least some portion of
+    the Activity is visible, but the Activity is not interactable, e.g. being
+    covered by the share dialog, javascript alert dialogs, the voice input
+    dialog, etc.
+
+    Please note, this has the potential to be called many times for a given
+    session.  For further details, see the Android activity concept of onPause
+    and onResume for a better understanding of what circumstances can trigger
+    this.
+
+    Session tracking is based on the same visibility concept, but a session can
+    span multiple live Android Activities, while this metric will be logged when
+    each applicable Activity goes to the foreground (per above).  Since session
+    tracking uses onPause and onResume, this metric is also tied to that to
+    ensure we capture the event.
+  </description>
+</action>
+
 <action name="MobileContextMenuCopyImageLinkAddress">
   <owner>Please list the metric's owners. Add more owner tags as needed.</owner>
   <description>Please enter the description of this user action.</description>
@@ -8238,6 +8262,30 @@
   <obsolete>Deprecated as of 5/2015</obsolete>
 </action>
 
+<action name="MobileGoToBackground">
+  <owner>tedchoc@chromium.org</owner>
+  <description>
+    Chrome has gone to the background.  Only emitted if the previously
+    foregrounded content was an Activity that views web content, e.g., not
+    settings.  Chrome may be partially visible at this point, but is not
+    directly in the foreground/interactable.  Partially visible means that at
+    least some portion of the Activity is visible, but the Activity is not
+    interactable, e.g. being covered by the share dialog, javascript alert
+    dialogs, the voice input dialog, etc.
+
+    Please note, this has the potential to be called many times for a given
+    session.  For further details, see the Android activity concept of onPause
+    and onResume for a better understanding of what circumstances can trigger
+    this.
+
+    Session tracking is based on the same visibility concept, but a session can
+    span multiple live Android Activities, while this metric will be logged when
+    each applicable Activity goes to the background (per above).  Since session
+    tracking uses onPause and onResume, this metric is also tied to that to
+    ensure we capture the event.
+  </description>
+</action>
+
 <action name="MobileMWSession">
   <owner>Please list the metric's owners. Add more owner tags as needed.</owner>
   <description>Please enter the description of this user action.</description>

diff --git a/tools/metrics/histograms/histograms.xml b/tools/metrics/histograms/histograms.xml
index 464cf491..62f4b2ac 100644
--- a/tools/metrics/histograms/histograms.xml
+++ b/tools/metrics/histograms/histograms.xml

@@ -1770,6 +1770,9 @@
 </histogram>
 
 <histogram name="AsyncDNS.NameServersType" enum="AsyncDNSNameServersType">
+  <obsolete>
+    Deprecated as of 4/2016.
+  </obsolete>
   <owner>ttuttle@chromium.org</owner>
   <summary>
     Type of nameservers in the DNS config, recorded each time the config is read
@@ -10675,6 +10678,11 @@
 </histogram>
 
 <histogram name="EmbeddedWorkerInstance.ExistingProcessAllocation" units="ms">
+  <obsolete>
+    Deprecated 03/2016; replaced by
+    EmbeddedWorkerInstance.Start.SendStartWorker_ExistingProcess and
+    EmbeddedWorkerInstance.Start.TimeToURLJob_ExistingProcess.
+  </obsolete>
   <owner>ksakamoto@chromium.org</owner>
   <summary>
     The time taken to allocate a process to start the EmbeddedWorkerInstance.
@@ -10683,6 +10691,11 @@
 </histogram>
 
 <histogram name="EmbeddedWorkerInstance.NewProcessAllocation" units="ms">
+  <obsolete>
+    Deprecated 03/2016; replaced by
+    EmbeddedWorkerInstance.Start.SendStartWorker_NewProcess and
+    EmbeddedWorkerInstance.Start.TimeToURLJob_NewProcess.
+  </obsolete>
   <owner>ksakamoto@chromium.org</owner>
   <summary>
     The time taken to allocate a process to start the EmbeddedWorkerInstance.
@@ -10706,11 +10719,15 @@
   <owner>ksakamoto@chromium.org</owner>
   <summary>
     Whether a new renderer process was created for the EmbeddedWorkerInstance or
-    existing one was used.
+    existing one was used. Only recorded for installed workers.
   </summary>
 </histogram>
 
 <histogram name="EmbeddedWorkerInstance.ScriptEvaluate" units="ms">
+  <obsolete>
+    Deprecated as of 03/2016. Replaced by
+    EmbeddedWorkerInstance.Start.TimeToEvaluateScript.
+  </obsolete>
   <owner>horo@chromium.org</owner>
   <summary>
     The time taken to evaluate the script to start the EmbeddedWorkerInstance.
@@ -10718,6 +10735,10 @@
 </histogram>
 
 <histogram name="EmbeddedWorkerInstance.ScriptLoadWithNetworkAccess" units="ms">
+  <obsolete>
+    Deprecated as of 03/2016. Replaced by
+    EmbeddedWorkerInstance.Start.TimeToLoad_Network.
+  </obsolete>
   <owner>horo@chromium.org</owner>
   <summary>
     The time taken to load the script file for the EmbeddedWorkerInstance with
@@ -10727,6 +10748,11 @@
 
 <histogram name="EmbeddedWorkerInstance.ScriptLoadWithoutNetworkAccess"
     units="ms">
+  <obsolete>
+    Deprecated as of 03/2016. Replaced by
+    EmbeddedWorkerInstance.Start.TimeToLoad_HttpCache and
+    EmbeddedWorkerInstance.Start.TimeToLoad_InstalledScript.
+  </obsolete>
   <owner>horo@chromium.org</owner>
   <summary>
     The time taken to load the script file for the EmbeddedWorkerInstance
@@ -10734,6 +10760,65 @@
   </summary>
 </histogram>
 
+<histogram name="EmbeddedWorkerInstance.Start.TimeToEvaluateScript" units="ms">
+  <owner>falken@chromium.org</owner>
+  <summary>
+    The time taken for initial evaluation of the service worker script.
+    Specifically, the time between ACK from the renderer that the thread started
+    and ACK that the script evaluation finished. Only recorded for installed
+    workers.
+  </summary>
+</histogram>
+
+<histogram name="EmbeddedWorkerInstance.Start.TimeToLoad.HttpCache" units="ms">
+  <owner>falken@chromium.org</owner>
+  <summary>
+    The time taken to load a new (not installed) service worker, when it came
+    from the HTTP cache.
+  </summary>
+</histogram>
+
+<histogram name="EmbeddedWorkerInstance.Start.TimeToLoad.InstalledScript"
+    units="ms">
+  <owner>falken@chromium.org</owner>
+  <summary>The time taken to load an installed service worker.</summary>
+</histogram>
+
+<histogram name="EmbeddedWorkerInstance.Start.TimeToLoad.Network" units="ms">
+  <owner>falken@chromium.org</owner>
+  <summary>
+    The time taken to load a new (not installed) service worker, when it came
+    from the network.
+  </summary>
+</histogram>
+
+<histogram name="EmbeddedWorkerInstance.Start.TimeToSendStartWorker" units="ms">
+  <owner>falken@chromium.org</owner>
+  <summary>
+    The time taken between deciding to start a worker and sending the start
+    worker IPC. Only recorded for installed workers.
+  </summary>
+</histogram>
+
+<histogram name="EmbeddedWorkerInstance.Start.TimeToStartThread" units="ms">
+  <owner>falken@chromium.org</owner>
+  <summary>
+    The time taken to start the service worker thread. Specifically, the time
+    between ACK from the renderer that load finished and ACK that the thread
+    started. Does not include script evaluation time. Only recorded for
+    installed workers.
+  </summary>
+</histogram>
+
+<histogram name="EmbeddedWorkerInstance.Start.TimeToURLJob" units="ms">
+  <owner>falken@chromium.org</owner>
+  <summary>
+    The round-trip time between asking the renderer process to start a worker
+    and receiving the corresponding resource request. Only recorded for
+    installed workers.
+  </summary>
+</histogram>
+
 <histogram name="EnhancedBookmarks.AllBookmarksCount">
   <owner>ianwen@chromium.org</owner>
   <owner>kkimlabs@chromium.org</owner>
@@ -46103,6 +46188,15 @@
   </summary>
 </histogram>
 
+<histogram name="Search.ContextualSearchPanelOpenDuration" units="ms">
+  <owner>donnd@chromium.org</owner>
+  <owner>twellington@chromium.org</owner>
+  <summary>
+    The time from opening the panel beyond peek until the panel is closed.
+    Implemented for Android.
+  </summary>
+</histogram>
+
 <histogram name="Search.ContextualSearchPeekPromoCount" units="count">
   <owner>donnd@chromium.org</owner>
   <owner>pedrosimonetti@chromium.org</owner>
@@ -75957,6 +76051,7 @@
   <int value="12" label="ConnectionError"/>
   <int value="13" label="RegisterMediaRouteProvider"/>
   <int value="14" label="ConnectRouteByRouteId"/>
+  <int value="15" label="EnableMdnsDiscovery"/>
 </enum>
 
 <enum name="MediaRouteProviderWakeup" type="int">
@@ -82038,7 +82133,7 @@
   <int value="11" label="FETCH_SUB_FRAME"/>
   <int value="12" label="FETCH_SHARED_WORKER"/>
   <int value="13" label="FETCH_SUB_RESOURCE"/>
-  <int value="14" label="UNKOWN"/>
+  <int value="14" label="UNKNOWN"/>
   <int value="15" label="FOREIGN_FETCH"/>
 </enum>
 
@@ -91394,6 +91489,26 @@
   <affected-histogram name="interstitial.interaction"/>
 </histogram_suffixes>
 
+<histogram_suffixes name="ServiceWorker.StartSituation">
+  <affected-histogram name="EmbeddedWorkerInstance.Start.TimeToEvaluateScript"/>
+  <affected-histogram name="EmbeddedWorkerInstance.Start.TimeToLoad.HttpCache"/>
+  <affected-histogram
+      name="EmbeddedWorkerInstance.Start.TimeToLoad.InstalledScript"/>
+  <affected-histogram name="EmbeddedWorkerInstance.Start.TimeToLoad.Network"/>
+  <affected-histogram
+      name="EmbeddedWorkerInstance.Start.TimeToSendStartWorker"/>
+  <affected-histogram name="EmbeddedWorkerInstance.Start.TimeToStartThread"/>
+  <affected-histogram name="EmbeddedWorkerInstance.Start.TimeToURLJob"/>
+  <suffix name="DuringStartup"
+      label="The worker started up during browser startup."/>
+  <suffix name="NewProcess"
+      label="A new process was created for the worker (or is asyncly being
+             created, depending on the histogram)."/>
+  <suffix name="ExistingProcess"
+      label="An existing process was used for the worker."/>
+  <affected-histogram name="ServiceWorker.StartWorker.Time"/>
+</histogram_suffixes>
+
 <histogram_suffixes name="ServiceWorkerCache.Cache" separator=".">
   <suffix name="Batch"
       label="The time to perform the 'batch' operation on a ServiceWorker

diff --git a/tools/perf/benchmarks/oortonline.py b/tools/perf/benchmarks/oortonline.py
index fdda6ca..d3f072cd 100644
--- a/tools/perf/benchmarks/oortonline.py
+++ b/tools/perf/benchmarks/oortonline.py

@@ -33,7 +33,6 @@
 
 
 @benchmark.Disabled('android')
-@benchmark.Disabled('mac', 'win')  # crbug.com/599416
 class OortOnline(perf_benchmark.PerfBenchmark):
   """OortOnline benchmark that measures WebGL and V8 performance.
   URL: http://oortonline.gl/#run
@@ -53,7 +52,6 @@
 # Tracing.requestMemoryDump DevTools API. See http://crbug.com/540022.
 @benchmark.Disabled('reference')
 @benchmark.Disabled('android')
-@benchmark.Disabled('mac', 'win')  # crbug.com/599416
 class OortOnlineTBM(perf_benchmark.PerfBenchmark):
   """OortOnline benchmark that measures WebGL and V8 performance.
   URL: http://oortonline.gl/#run

diff --git a/tools/valgrind/gtest_exclude/net_unittests.gtest-drmemory_win32.txt b/tools/valgrind/gtest_exclude/net_unittests.gtest-drmemory_win32.txt
index a99e7aa9..c865baf0 100644
--- a/tools/valgrind/gtest_exclude/net_unittests.gtest-drmemory_win32.txt
+++ b/tools/valgrind/gtest_exclude/net_unittests.gtest-drmemory_win32.txt

@@ -19,9 +19,6 @@
 # DrM-i#1465
 URLRequestTest.ResolveShortcutTest
 
-# Crashes, http://crbug.com/369840
-ProxyResolverV8TracingTest.MultipleResolvers
-
 # http://crbug.com/400521
 HttpServerTest.RequestWithTooLargeBody
 

diff --git a/ui/gfx/BUILD.gn b/ui/gfx/BUILD.gn
index 4d11b59f..8cf1218 100644
--- a/ui/gfx/BUILD.gn
+++ b/ui/gfx/BUILD.gn

@@ -577,6 +577,10 @@
     "--output_cc=" + rebase_path(vector_icons_cc_file, root_build_dir),
     "--output_h=" + rebase_path(vector_icons_h_file, root_build_dir),
   ]
+
+  if (is_mac) {
+    sources += [ "vector_icons/combobox_arrow_mac.icon" ]
+  }
 }
 
 # Looking for gfx_geometry? It's //ui/gfx/geometry:geometry

diff --git a/ui/gfx/vector_icons/combobox_arrow_mac.icon b/ui/gfx/vector_icons/combobox_arrow_mac.icon
new file mode 100644
index 0000000..4f585828
--- /dev/null
+++ b/ui/gfx/vector_icons/combobox_arrow_mac.icon

@@ -0,0 +1,13 @@
+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+CANVAS_DIMENSIONS, 32,
+STROKE, 4,
+MOVE_TO, 8, 10,
+LINE_TO, 16, 2,
+LINE_TO, 24, 10,
+MOVE_TO, 8, 22,
+LINE_TO, 16, 30,
+LINE_TO, 24, 22,
+END

diff --git a/ui/native_theme/common_theme.cc b/ui/native_theme/common_theme.cc
index cf6b6afd..ab72df6 100644
--- a/ui/native_theme/common_theme.cc
+++ b/ui/native_theme/common_theme.cc

@@ -405,28 +405,6 @@
   return gfx::kPlaceholderColor;
 }
 
-gfx::Size CommonThemeGetPartSize(NativeTheme::Part part,
-                                 NativeTheme::State state,
-                                 const NativeTheme::ExtraParams& extra) {
-  gfx::Size size;
-  switch (part) {
-    case NativeTheme::kComboboxArrow:
-      return ui::ResourceBundle::GetSharedInstance().GetImageNamed(
-          IDR_MENU_DROPARROW).Size();
-
-    default:
-      break;
-  }
-
-  return size;
-}
-
-void CommonThemePaintComboboxArrow(SkCanvas* canvas, const gfx::Rect& rect) {
-  gfx::ImageSkia* arrow = ui::ResourceBundle::GetSharedInstance().
-      GetImageSkiaNamed(IDR_MENU_DROPARROW);
-  CommonThemeCreateCanvas(canvas)->DrawImageInt(*arrow, rect.x(), rect.y());
-}
-
 void CommonThemePaintMenuItemBackground(
     const NativeTheme* theme,
     SkCanvas* canvas,

diff --git a/ui/native_theme/common_theme.h b/ui/native_theme/common_theme.h
index eba9cc2..48edf85 100644
--- a/ui/native_theme/common_theme.h
+++ b/ui/native_theme/common_theme.h

@@ -24,15 +24,6 @@
 SkColor NATIVE_THEME_EXPORT GetAuraColor(NativeTheme::ColorId color_id,
                                          const NativeTheme* base_theme);
 
-gfx::Size NATIVE_THEME_EXPORT CommonThemeGetPartSize(
-    NativeTheme::Part part,
-    NativeTheme::State state,
-    const NativeTheme::ExtraParams& extra);
-
-void NATIVE_THEME_EXPORT CommonThemePaintComboboxArrow(
-    SkCanvas* canvas,
-    const gfx::Rect& rect);
-
 void NATIVE_THEME_EXPORT CommonThemePaintMenuItemBackground(
     const NativeTheme* theme,
     SkCanvas* canvas,

diff --git a/ui/native_theme/native_theme.h b/ui/native_theme/native_theme.h
index a9f56d5..917ed95 100644
--- a/ui/native_theme/native_theme.h
+++ b/ui/native_theme/native_theme.h

@@ -44,7 +44,6 @@
  public:
   // The part to be painted / sized.
   enum Part {
-    kComboboxArrow,
     kCheckbox,
     kInnerSpinButton,
     kMenuList,

diff --git a/ui/native_theme/native_theme_aurawin.cc b/ui/native_theme/native_theme_aurawin.cc
index 956186b..03e53c6 100644
--- a/ui/native_theme/native_theme_aurawin.cc
+++ b/ui/native_theme/native_theme_aurawin.cc

@@ -72,10 +72,6 @@
 gfx::Size NativeThemeAuraWin::GetPartSize(Part part,
                                           State state,
                                           const ExtraParams& extra) const {
-  gfx::Size part_size = CommonThemeGetPartSize(part, state, extra);
-  if (!part_size.IsEmpty())
-    return part_size;
-
   // We want aura on windows to use the same size for scrollbars as we would in
   // the native theme.
   if (IsScrollbarPart(part))

diff --git a/ui/native_theme/native_theme_base.cc b/ui/native_theme/native_theme_base.cc
index 017b07a..d0f135ac 100644
--- a/ui/native_theme/native_theme_base.cc
+++ b/ui/native_theme/native_theme_base.cc

@@ -97,10 +97,6 @@
 gfx::Size NativeThemeBase::GetPartSize(Part part,
                                        State state,
                                        const ExtraParams& extra) const {
-  gfx::Size size = CommonThemeGetPartSize(part, state, extra);
-  if (!size.IsEmpty())
-    return size;
-
   switch (part) {
     // Please keep these in the order of NativeTheme::Part.
     case kCheckbox:
@@ -197,9 +193,6 @@
 
   switch (part) {
     // Please keep these in the order of NativeTheme::Part.
-    case kComboboxArrow:
-      CommonThemePaintComboboxArrow(canvas, rect);
-      break;
     case kCheckbox:
       PaintCheckbox(canvas, state, rect, extra.button);
       break;

diff --git a/ui/native_theme/native_theme_win.cc b/ui/native_theme/native_theme_win.cc
index 8539fe6..94f9075 100644
--- a/ui/native_theme/native_theme_win.cc
+++ b/ui/native_theme/native_theme_win.cc

@@ -193,10 +193,6 @@
 gfx::Size NativeThemeWin::GetPartSize(Part part,
                                       State state,
                                       const ExtraParams& extra) const {
-  gfx::Size part_size = CommonThemeGetPartSize(part, state, extra);
-  if (!part_size.IsEmpty())
-    return part_size;
-
   // The GetThemePartSize call below returns the default size without
   // accounting for user customization (crbug/218291).
   switch (part) {
@@ -242,9 +238,6 @@
     return;
 
   switch (part) {
-    case kComboboxArrow:
-      CommonThemePaintComboboxArrow(canvas, rect);
-      return;
     case kMenuPopupGutter:
       PaintMenuGutter(canvas, rect);
       return;
@@ -464,7 +457,6 @@
     case kWindowResizeGripper:
       PaintWindowResizeGripper(hdc, rect);
       return;
-    case kComboboxArrow:
     case kSliderTrack:
     case kSliderThumb:
     case kMaxPart:
@@ -1708,7 +1700,6 @@
       return TEXTFIELD;
     case kWindowResizeGripper:
       return STATUS;
-    case kComboboxArrow:
     case kMenuCheckBackground:
     case kMenuPopupBackground:
     case kMenuItemBackground:
@@ -1754,7 +1745,6 @@
       return SBP_THUMBBTNVERT;
     case kWindowResizeGripper:
       return SP_GRIPPER;
-    case kComboboxArrow:
     case kInnerSpinButton:
     case kMenuList:
     case kMenuCheckBackground:
@@ -1948,7 +1938,6 @@
           NOTREACHED();
           return 0;
       }
-    case kComboboxArrow:
     case kInnerSpinButton:
     case kMenuList:
     case kMenuCheckBackground:

diff --git a/ui/ozone/platform/drm/client_native_pixmap_factory_gbm.cc b/ui/ozone/platform/drm/client_native_pixmap_factory_gbm.cc
index 284b50b..3bae9dd 100644
--- a/ui/ozone/platform/drm/client_native_pixmap_factory_gbm.cc
+++ b/ui/ozone/platform/drm/client_native_pixmap_factory_gbm.cc

@@ -47,7 +47,11 @@
                format == gfx::BufferFormat::BGRX_8888;
       case gfx::BufferUsage::GPU_READ_CPU_READ_WRITE:
       case gfx::BufferUsage::GPU_READ_CPU_READ_WRITE_PERSISTENT: {
+#if defined(OS_CHROMEOS)
         return format == gfx::BufferFormat::BGRA_8888;
+#else
+        return false;
+#endif
       }
     }
     NOTREACHED();
@@ -62,8 +66,13 @@
     switch (usage) {
       case gfx::BufferUsage::GPU_READ_CPU_READ_WRITE:
       case gfx::BufferUsage::GPU_READ_CPU_READ_WRITE_PERSISTENT:
-        return ClientNativePixmapDmaBuf::ImportFromDmabuf(
-            scoped_fd.get(), size, handle.stride);
+#if defined(OS_CHROMEOS)
+        return ClientNativePixmapDmaBuf::ImportFromDmabuf(scoped_fd.release(),
+                                                          size, handle.stride);
+#else
+        NOTREACHED();
+        return nullptr;
+#endif
       case gfx::BufferUsage::GPU_READ:
       case gfx::BufferUsage::SCANOUT:
         return make_scoped_ptr<ClientNativePixmapGbm>(

diff --git a/ui/ozone/platform/drm/common/client_native_pixmap_dmabuf.cc b/ui/ozone/platform/drm/common/client_native_pixmap_dmabuf.cc
index 26d123a..09e8692 100644
--- a/ui/ozone/platform/drm/common/client_native_pixmap_dmabuf.cc
+++ b/ui/ozone/platform/drm/common/client_native_pixmap_dmabuf.cc

@@ -12,8 +12,47 @@
 #include "base/process/memory.h"
 #include "base/trace_event/trace_event.h"
 
+#if defined(OS_CHROMEOS)
+// TODO(vignatti): replace the local definitions below with #include
+// <linux/dma-buf.h> once kernel version 4.6 becomes widely used.
+#include <linux/types.h>
+
+struct local_dma_buf_sync {
+  __u64 flags;
+};
+
+#define LOCAL_DMA_BUF_SYNC_READ (1 << 0)
+#define LOCAL_DMA_BUF_SYNC_WRITE (2 << 0)
+#define LOCAL_DMA_BUF_SYNC_START (0 << 2)
+#define LOCAL_DMA_BUF_SYNC_END (1 << 2)
+
+#define LOCAL_DMA_BUF_BASE 'b'
+#define LOCAL_DMA_BUF_IOCTL_SYNC \
+  _IOW(LOCAL_DMA_BUF_BASE, 0, struct local_dma_buf_sync)
+#endif
+
 namespace ui {
 
+namespace {
+
+void PrimeSyncStart(int dmabuf_fd) {
+  struct local_dma_buf_sync sync_start = {0};
+
+  sync_start.flags = LOCAL_DMA_BUF_SYNC_START | LOCAL_DMA_BUF_SYNC_READ;
+  if (drmIoctl(dmabuf_fd, LOCAL_DMA_BUF_IOCTL_SYNC, &sync_start))
+    PLOG(ERROR) << "Failed DMA_BUF_SYNC_START";
+}
+
+void PrimeSyncEnd(int dmabuf_fd) {
+  struct local_dma_buf_sync sync_end = {0};
+
+  sync_end.flags = LOCAL_DMA_BUF_SYNC_END | LOCAL_DMA_BUF_SYNC_WRITE;
+  if (drmIoctl(dmabuf_fd, LOCAL_DMA_BUF_IOCTL_SYNC, &sync_end))
+    PLOG(ERROR) << "Failed DMA_BUF_SYNC_END";
+}
+
+}  // namespace
+
 // static
 scoped_ptr<ClientNativePixmap> ClientNativePixmapDmaBuf::ImportFromDmabuf(
     int dmabuf_fd,
@@ -26,7 +65,7 @@
 ClientNativePixmapDmaBuf::ClientNativePixmapDmaBuf(int dmabuf_fd,
                                                    const gfx::Size& size,
                                                    int stride)
-    : size_(size), stride_(stride) {
+    : dmabuf_fd_(dmabuf_fd), size_(size), stride_(stride) {
   TRACE_EVENT0("drm", "ClientNativePixmapDmaBuf");
   size_t map_size = stride_ * size_.height();
   data_ = mmap(nullptr, map_size, (PROT_READ | PROT_WRITE), MAP_SHARED,
@@ -42,10 +81,15 @@
 }
 
 void* ClientNativePixmapDmaBuf::Map() {
+  TRACE_EVENT0("drm", "DmaBuf:Map");
+  PrimeSyncStart(dmabuf_fd_.get());
   return data_;
 }
 
-void ClientNativePixmapDmaBuf::Unmap() {}
+void ClientNativePixmapDmaBuf::Unmap() {
+  TRACE_EVENT0("drm", "DmaBuf:Unmap");
+  PrimeSyncEnd(dmabuf_fd_.get());
+}
 
 void ClientNativePixmapDmaBuf::GetStride(int* stride) const {
   *stride = stride_;

diff --git a/ui/ozone/platform/drm/common/client_native_pixmap_dmabuf.h b/ui/ozone/platform/drm/common/client_native_pixmap_dmabuf.h
index 9f9465ce..b00f34d 100644
--- a/ui/ozone/platform/drm/common/client_native_pixmap_dmabuf.h
+++ b/ui/ozone/platform/drm/common/client_native_pixmap_dmabuf.h

@@ -7,6 +7,7 @@
 
 #include <stdint.h>
 
+#include "base/files/scoped_file.h"
 #include "base/macros.h"
 #include "base/memory/scoped_ptr.h"
 #include "ui/gfx/geometry/size.h"
@@ -30,6 +31,7 @@
  private:
   ClientNativePixmapDmaBuf(int dmabuf_fd, const gfx::Size& size, int stride);
 
+  base::ScopedFD dmabuf_fd_;
   const gfx::Size size_;
   const int stride_;
   void* data_;

diff --git a/ui/views/controls/combobox/combobox.cc b/ui/views/controls/combobox/combobox.cc
index 88cd6ef..3de636fb 100644
--- a/ui/views/controls/combobox/combobox.cc
+++ b/ui/views/controls/combobox/combobox.cc

@@ -752,19 +752,9 @@
                          arrow_size.height());
   AdjustBoundsForRTLUI(&arrow_bounds);
 
-  // TODO(estade): hack alert! Remove this direct call into CommonTheme. For now
-  // STYLE_ACTION isn't properly themed so we have to override the NativeTheme
-  // behavior. See crbug.com/384071
-  if (style_ == STYLE_ACTION) {
-    ui::CommonThemePaintComboboxArrow(canvas->sk_canvas(), arrow_bounds);
-  } else {
-    ui::NativeTheme::ExtraParams ignored;
-    GetNativeTheme()->Paint(canvas->sk_canvas(),
-                            ui::NativeTheme::kComboboxArrow,
-                            ui::NativeTheme::kNormal,
-                            arrow_bounds,
-                            ignored);
-  }
+  gfx::ImageSkia arrow_image = PlatformStyle::CreateComboboxArrow(
+      enabled(), style_);
+  canvas->DrawImageInt(arrow_image, arrow_bounds.x(), arrow_bounds.y());
 }
 
 void Combobox::PaintButtons(gfx::Canvas* canvas) {
@@ -905,21 +895,7 @@
 }
 
 gfx::Size Combobox::ArrowSize() const {
-#if defined(OS_LINUX) && !defined(OS_CHROMEOS)
-  // TODO(estade): hack alert! This should always use GetNativeTheme(). For now
-  // STYLE_ACTION isn't properly themed so we have to override the NativeTheme
-  // behavior. See crbug.com/384071
-  const ui::NativeTheme* native_theme_for_arrow =
-      style_ == STYLE_ACTION ? ui::NativeThemeAura::instance()
-                             : GetNativeTheme();
-#else
-  const ui::NativeTheme* native_theme_for_arrow = GetNativeTheme();
-#endif
-
-  ui::NativeTheme::ExtraParams ignored;
-  return native_theme_for_arrow->GetPartSize(ui::NativeTheme::kComboboxArrow,
-                                             ui::NativeTheme::kNormal,
-                                             ignored);
+  return PlatformStyle::CreateComboboxArrow(enabled(), style_).size();
 }
 
 gfx::Size Combobox::GetContentSize() const {

diff --git a/ui/views/style/platform_style.cc b/ui/views/style/platform_style.cc
index 596112b..6719c9b 100644
--- a/ui/views/style/platform_style.cc
+++ b/ui/views/style/platform_style.cc

@@ -6,6 +6,8 @@
 
 #include "build/build_config.h"
 #include "ui/base/material_design/material_design_controller.h"
+#include "ui/base/resource/resource_bundle.h"
+#include "ui/resources/grit/ui_resources.h"
 #include "ui/views/background.h"
 #include "ui/views/controls/button/label_button.h"
 #include "ui/views/controls/button/label_button_border.h"
@@ -17,6 +19,13 @@
 #if !defined(OS_MACOSX)
 
 // static
+gfx::ImageSkia PlatformStyle::CreateComboboxArrow(bool is_enabled,
+                                                  Combobox::Style style) {
+  ui::ResourceBundle& rb = ui::ResourceBundle::GetSharedInstance();
+  return *rb.GetImageSkiaNamed(IDR_MENU_DROPARROW);
+}
+
+// static
 scoped_ptr<FocusableBorder> PlatformStyle::CreateComboboxBorder() {
   return make_scoped_ptr(new FocusableBorder());
 }

diff --git a/ui/views/style/platform_style.h b/ui/views/style/platform_style.h
index e4240d4..3103691 100644
--- a/ui/views/style/platform_style.h
+++ b/ui/views/style/platform_style.h

@@ -8,6 +8,7 @@
 #include "base/macros.h"
 #include "base/memory/scoped_ptr.h"
 #include "ui/views/controls/button/button.h"
+#include "ui/views/controls/combobox/combobox.h"
 
 namespace views {
 
@@ -20,6 +21,13 @@
 // Cross-platform API for providing platform-specific styling for toolkit-views.
 class PlatformStyle {
  public:
+  // Creates an ImageSkia containing the image to use for the combobox arrow.
+  // The |is_enabled| argument is true if the control the arrow is for is
+  // enabled, and false if the control is disabled. The |style| argument is the
+  // style of the combobox the arrow is being drawn for.
+  static gfx::ImageSkia CreateComboboxArrow(bool is_enabled,
+                                            Combobox::Style style);
+
   // Creates the appropriate border for a focusable Combobox.
   static scoped_ptr<FocusableBorder> CreateComboboxBorder();
 

diff --git a/ui/views/style/platform_style_mac.mm b/ui/views/style/platform_style_mac.mm
index 1fb13f32..cbe9be5 100644
--- a/ui/views/style/platform_style_mac.mm
+++ b/ui/views/style/platform_style_mac.mm

@@ -4,6 +4,10 @@
 
 #include "ui/views/style/platform_style.h"
 
+#include "ui/base/resource/resource_bundle.h"
+#include "ui/gfx/paint_vector_icon.h"
+#include "ui/gfx/vector_icons.h"
+#include "ui/resources/grit/ui_resources.h"
 #include "ui/views/controls/button/label_button.h"
 #include "ui/views/controls/button/label_button_border.h"
 #include "ui/views/controls/focusable_rounded_border_mac.h"
@@ -14,6 +18,21 @@
 namespace views {
 
 // static
+gfx::ImageSkia PlatformStyle::CreateComboboxArrow(bool is_enabled,
+                                                  Combobox::Style style) {
+  // TODO(ellyjones): IDR_MENU_DROPARROW is a cross-platform image that doesn't
+  // look right on Mac. See https://crbug.com/384071.
+  if (style == Combobox::STYLE_ACTION) {
+    ui::ResourceBundle& rb = ui::ResourceBundle::GetSharedInstance();
+    return *rb.GetImageSkiaNamed(IDR_MENU_DROPARROW);
+  }
+  const int kComboboxArrowWidth = 13;
+  return gfx::CreateVectorIcon(gfx::VectorIconId::COMBOBOX_ARROW_MAC,
+                               kComboboxArrowWidth,
+                               is_enabled ? SK_ColorWHITE : SK_ColorBLACK);
+}
+
+// static
 scoped_ptr<FocusableBorder> PlatformStyle::CreateComboboxBorder() {
   return make_scoped_ptr(new FocusableRoundedBorder);
 }