diff --git a/DEPS b/DEPS
index cdf83d7..3ae56e1c 100644
--- a/DEPS
+++ b/DEPS
@@ -195,11 +195,11 @@
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling Skia
   # and whatever else without interference from each other.
-  'skia_revision': '471235dba5caba46fe1599d458e7af0e7d82fe6e',
+  'skia_revision': '3000d6b8c25cd8505fa309b51fd32cf80c513732',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling V8
   # and whatever else without interference from each other.
-  'v8_revision': '8640f363b890c6459a5b636cef24a164d80a5913',
+  'v8_revision': '7f3c24c7db891ef3a338a75d3f98d7878556040b',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling swarming_client
   # and whatever else without interference from each other.
@@ -207,7 +207,7 @@
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling ANGLE
   # and whatever else without interference from each other.
-  'angle_revision': '26d2e0461340a8268784d5a0ef440ba5c0b72d00',
+  'angle_revision': 'bec988515e9c4267e805b591623ddb47aff36d87',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling SwiftShader
   # and whatever else without interference from each other.
@@ -266,7 +266,7 @@
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling devtools-frontend
   # and whatever else without interference from each other.
-  'devtools_frontend_revision': 'bb22c1539f01c02985b0b116cebde2143c0e1b75',
+  'devtools_frontend_revision': '504a6f1944feacf2f89a8247ae0a5ad46991b0da',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling libprotobuf-mutator
   # and whatever else without interference from each other.
@@ -318,7 +318,7 @@
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling feed
   # and whatever else without interference from each other.
-  'dawn_revision': 'c0acb25318013bb10ee4fd6b3961316e76cf310a',
+  'dawn_revision': 'e84a1b13760d6ca251819569af8684af56fdee19',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling feed
   # and whatever else without interference from each other.
@@ -545,7 +545,7 @@
   },
 
   'src/ios/third_party/material_components_ios/src': {
-      'url': Var('chromium_git') + '/external/github.com/material-components/material-components-ios.git' + '@' + '1a4412cdbe0446b2cc4b65f3955237b30ac94922',
+      'url': Var('chromium_git') + '/external/github.com/material-components/material-components-ios.git' + '@' + '0dd6376c6de22ff059f68023f0e876d0e275aeb1',
       'condition': 'checkout_ios',
   },
 
@@ -875,7 +875,7 @@
 
   # Build tools for Chrome OS.
   'src/third_party/chromite': {
-      'url': Var('chromium_git') + '/chromiumos/chromite.git' + '@' + '963bc42f87194b3d8707eafc9214ad70e65ab77d',
+      'url': Var('chromium_git') + '/chromiumos/chromite.git' + '@' + '93bb4f5a94f3e1d8be7b774b1e6d0b683d097bf8',
       'condition': 'checkout_chromeos',
   },
 
@@ -946,7 +946,7 @@
     Var('chromium_git') + '/codecs/libgav1.git' + '@' + 'e46493b9148e0d1e63f55b5890bff503822616e5',
 
   'src/third_party/glslang/src':
-    Var('chromium_git') + '/external/github.com/KhronosGroup/glslang.git' + '@' + 'f881f08358b098b8bd1e3b402ab35b5177aa76b9',
+    Var('chromium_git') + '/external/github.com/KhronosGroup/glslang.git' + '@' + '2de6d657dde37a421ff8afb1bd820d522df5821d',
 
   'src/third_party/google_toolbox_for_mac/src': {
       'url': Var('chromium_git') + '/external/github.com/google/google-toolbox-for-mac.git' + '@' + Var('google_toolbox_for_mac_revision'),
@@ -1248,7 +1248,7 @@
   },
 
   'src/third_party/perfetto':
-    Var('android_git') + '/platform/external/perfetto.git' + '@' + 'd14d99cd75b8ec9f83cc738b3162c3fff0b74ef1',
+    Var('android_git') + '/platform/external/perfetto.git' + '@' + '7176f54720e6f5ff087e1fe6407191b5692a7aa2',
 
   'src/third_party/perl': {
       'url': Var('chromium_git') + '/chromium/deps/perl.git' + '@' + '6f3e5028eb65d0b4c5fdd792106ac4c84eee1eb3',
@@ -1537,7 +1537,7 @@
     Var('chromium_git') + '/v8/v8.git' + '@' +  Var('v8_revision'),
 
   'src-internal': {
-    'url': 'https://chrome-internal.googlesource.com/chrome/src-internal.git@4b615359085761bfab0761dab9a655fd60737a2d',
+    'url': 'https://chrome-internal.googlesource.com/chrome/src-internal.git@c6116bf6ce82d05a73126691f52c1ca1f9f4848b',
     'condition': 'checkout_src_internal',
   },
 
diff --git a/ash/BUILD.gn b/ash/BUILD.gn
index 67fa7f7..b9f43d5 100644
--- a/ash/BUILD.gn
+++ b/ash/BUILD.gn
@@ -1527,6 +1527,7 @@
     "//ui/aura",
     "//ui/base/cursor:cursor_base",
     "//ui/base/cursor/mojom:cursor_type",
+    "//ui/base/dragdrop/mojom:mojom_shared",
     "//ui/events",
     "//ui/gfx",
     "//ui/gfx/geometry",
@@ -2181,6 +2182,7 @@
     "//ui/base:test_support",
     "//ui/base/cursor:cursor_base",
     "//ui/base/cursor/mojom:cursor_type",
+    "//ui/base/dragdrop/mojom:mojom_shared",
     "//ui/base/ime",
     "//ui/base/ime/chromeos",
     "//ui/chromeos",
diff --git a/ash/drag_drop/drag_drop_controller.cc b/ash/drag_drop/drag_drop_controller.cc
index cce8c79f..1380097 100644
--- a/ash/drag_drop/drag_drop_controller.cc
+++ b/ash/drag_drop/drag_drop_controller.cc
@@ -150,20 +150,20 @@
     aura::Window* source_window,
     const gfx::Point& screen_location,
     int operation,
-    ui::DragDropTypes::DragEventSource source) {
+    ui::mojom::DragEventSource source) {
   if (!enabled_ || IsDragDropInProgress())
     return 0;
 
   const ui::OSExchangeDataProvider* provider = &data->provider();
   // We do not support touch drag/drop without a drag image.
-  if (source == ui::DragDropTypes::DRAG_EVENT_SOURCE_TOUCH &&
+  if (source == ui::mojom::DragEventSource::kTouch &&
       provider->GetDragImage().size().IsEmpty())
     return 0;
 
   current_drag_event_source_ = source;
   DragDropTracker* tracker =
       new DragDropTracker(root_window, drag_drop_window_delegate_.get());
-  if (source == ui::DragDropTypes::DRAG_EVENT_SOURCE_TOUCH) {
+  if (source == ui::mojom::DragEventSource::kTouch) {
     // We need to transfer the current gesture sequence and the GR's touch event
     // queue to the |drag_drop_tracker_|'s capture window so that when it takes
     // capture, it still gets a valid gesture state.
@@ -233,7 +233,7 @@
 
   float drag_image_scale = 1;
   int drag_image_vertical_offset = 0;
-  if (source == ui::DragDropTypes::DRAG_EVENT_SOURCE_TOUCH) {
+  if (source == ui::mojom::DragEventSource::kTouch) {
     drag_image_scale = kTouchDragImageScale;
     drag_image_vertical_offset = kTouchDragImageVerticalOffset;
   }
@@ -256,7 +256,7 @@
       &drag_image_offset_);
   drag_image->SetBoundsInScreen(drag_image_bounds);
   drag_image->SetWidgetVisible(true);
-  if (source == ui::DragDropTypes::DRAG_EVENT_SOURCE_TOUCH) {
+  if (source == ui::mojom::DragEventSource::kTouch) {
     drag_image->SetTouchDragOperationHintPosition(
         gfx::Point(drag_image_offset_.x(),
                    drag_image_offset_.y() + drag_image_vertical_offset));
@@ -295,8 +295,7 @@
 
   // If current drag session was not started by mouse, dont process this mouse
   // event, but consume it so it does not interfere with current drag session.
-  if (current_drag_event_source_ !=
-      ui::DragDropTypes::DRAG_EVENT_SOURCE_MOUSE) {
+  if (current_drag_event_source_ != ui::mojom::DragEventSource::kMouse) {
     event->StopPropagation();
     return;
   }
@@ -331,7 +330,7 @@
 
   // If current drag session was not started by touch, dont process this touch
   // event, but consume it so it does not interfere with current drag session.
-  if (current_drag_event_source_ != ui::DragDropTypes::DRAG_EVENT_SOURCE_TOUCH)
+  if (current_drag_event_source_ != ui::mojom::DragEventSource::kTouch)
     event->StopPropagation();
 
   if (event->handled())
@@ -354,7 +353,7 @@
   event->StopPropagation();
 
   // If current drag session was not started by touch, dont process this event.
-  if (current_drag_event_source_ != ui::DragDropTypes::DRAG_EVENT_SOURCE_TOUCH)
+  if (current_drag_event_source_ != ui::mojom::DragEventSource::kTouch)
     return;
 
   // Apply kTouchDragImageVerticalOffset to the location.
diff --git a/ash/drag_drop/drag_drop_controller.h b/ash/drag_drop/drag_drop_controller.h
index 318907e..cfd74ed2 100644
--- a/ash/drag_drop/drag_drop_controller.h
+++ b/ash/drag_drop/drag_drop_controller.h
@@ -18,6 +18,7 @@
 #include "base/time/time.h"
 #include "ui/aura/client/drag_drop_client.h"
 #include "ui/aura/window_observer.h"
+#include "ui/base/dragdrop/mojom/drag_drop_types.mojom-shared.h"
 #include "ui/base/dragdrop/os_exchange_data.h"
 #include "ui/events/event_constants.h"
 #include "ui/events/event_handler.h"
@@ -58,7 +59,7 @@
                        aura::Window* source_window,
                        const gfx::Point& screen_location,
                        int operation,
-                       ui::DragDropTypes::DragEventSource source) override;
+                       ui::mojom::DragEventSource source) override;
   void DragCancel() override;
   bool IsDragDropInProgress() override;
   void AddObserver(aura::client::DragDropClientObserver* observer) override;
@@ -146,8 +147,8 @@
   std::unique_ptr<DragDropTracker> drag_drop_tracker_;
   std::unique_ptr<DragDropTrackerDelegate> drag_drop_window_delegate_;
 
-  ui::DragDropTypes::DragEventSource current_drag_event_source_ =
-      ui::DragDropTypes::DRAG_EVENT_SOURCE_MOUSE;
+  ui::mojom::DragEventSource current_drag_event_source_ =
+      ui::mojom::DragEventSource::kMouse;
 
   // Holds a synthetic long tap event to be sent to the |drag_source_window_|.
   // See comment in OnGestureEvent() on why we need this.
diff --git a/ash/drag_drop/drag_drop_controller_unittest.cc b/ash/drag_drop/drag_drop_controller_unittest.cc
index f0185c65..5966cc7 100644
--- a/ash/drag_drop/drag_drop_controller_unittest.cc
+++ b/ash/drag_drop/drag_drop_controller_unittest.cc
@@ -25,6 +25,7 @@
 #include "ui/base/clipboard/clipboard.h"
 #include "ui/base/clipboard/scoped_clipboard_writer.h"
 #include "ui/base/dragdrop/drag_drop_types.h"
+#include "ui/base/dragdrop/mojom/drag_drop_types.mojom-shared.h"
 #include "ui/base/dragdrop/os_exchange_data.h"
 #include "ui/base/ui_base_switches.h"
 #include "ui/events/event.h"
@@ -152,7 +153,7 @@
                        aura::Window* source_window,
                        const gfx::Point& location,
                        int operation,
-                       ui::DragDropTypes::DragEventSource source) override {
+                       ui::mojom::DragEventSource source) override {
     drag_start_received_ = true;
     data->GetString(&drag_string_);
     return DragDropController::StartDragAndDrop(std::move(data), root_window,
@@ -1033,8 +1034,7 @@
     aura::Window* window = widget->GetNativeWindow();
     drag_drop_controller_->StartDragAndDrop(
         std::move(data), window->GetRootWindow(), window, gfx::Point(5, 5),
-        ui::DragDropTypes::DRAG_MOVE,
-        ui::DragDropTypes::DRAG_EVENT_SOURCE_MOUSE);
+        ui::DragDropTypes::DRAG_MOVE, ui::mojom::DragEventSource::kMouse);
 
     DragImageWindowObserver observer;
     ASSERT_TRUE(GetDragImageWindow());
@@ -1068,8 +1068,7 @@
     aura::Window* window = widget->GetNativeWindow();
     drag_drop_controller_->StartDragAndDrop(
         std::move(data), window->GetRootWindow(), window, gfx::Point(405, 405),
-        ui::DragDropTypes::DRAG_MOVE,
-        ui::DragDropTypes::DRAG_EVENT_SOURCE_MOUSE);
+        ui::DragDropTypes::DRAG_MOVE, ui::mojom::DragEventSource::kMouse);
     DragImageWindowObserver observer;
     ASSERT_TRUE(GetDragImageWindow());
     GetDragImageWindow()->AddObserver(&observer);
@@ -1113,7 +1112,7 @@
   aura::Window* window = widget->GetNativeWindow();
   drag_drop_controller_->StartDragAndDrop(
       std::move(data), window->GetRootWindow(), window, gfx::Point(5, 5),
-      ui::DragDropTypes::DRAG_MOVE, ui::DragDropTypes::DRAG_EVENT_SOURCE_MOUSE);
+      ui::DragDropTypes::DRAG_MOVE, ui::mojom::DragEventSource::kMouse);
 
   // Start dragging.
   ui::MouseEvent e1(ui::ET_MOUSE_DRAGGED, gfx::Point(200, 0),
@@ -1198,8 +1197,7 @@
     aura::Window* window = widget->GetNativeWindow();
     drag_drop_controller_->StartDragAndDrop(
         std::move(data), window->GetRootWindow(), window, gfx::Point(5, 5),
-        ui::DragDropTypes::DRAG_MOVE,
-        ui::DragDropTypes::DRAG_EVENT_SOURCE_MOUSE);
+        ui::DragDropTypes::DRAG_MOVE, ui::mojom::DragEventSource::kMouse);
 
     EXPECT_EQ(TestObserver::State::kDragStartedInvoked, observer.state());
 
@@ -1228,7 +1226,7 @@
   drag_drop_controller_->set_enabled(false);
   drag_drop_controller_->StartDragAndDrop(
       std::move(data), window->GetRootWindow(), window, gfx::Point(5, 5),
-      ui::DragDropTypes::DRAG_MOVE, ui::DragDropTypes::DRAG_EVENT_SOURCE_MOUSE);
+      ui::DragDropTypes::DRAG_MOVE, ui::mojom::DragEventSource::kMouse);
   EXPECT_EQ(TestObserver::State::kNotInvoked, observer.state());
 
   drag_drop_controller_->RemoveObserver(&observer);
@@ -1262,7 +1260,7 @@
   data->SetString(base::UTF8ToUTF16("I am being dragged"));
   drag_drop_controller_->StartDragAndDrop(
       std::move(data), window->GetRootWindow(), window.get(), gfx::Point(5, 5),
-      ui::DragDropTypes::DRAG_MOVE, ui::DragDropTypes::DRAG_EVENT_SOURCE_MOUSE);
+      ui::DragDropTypes::DRAG_MOVE, ui::mojom::DragEventSource::kMouse);
 
   EXPECT_EQ(EventTargetTestDelegate::State::kPerformDropInvoked,
             delegate.state());
diff --git a/ash/drag_drop/drag_image_view.cc b/ash/drag_drop/drag_image_view.cc
index 66206260..c5a57534 100644
--- a/ash/drag_drop/drag_image_view.cc
+++ b/ash/drag_drop/drag_image_view.cc
@@ -10,6 +10,7 @@
 #include "base/memory/ptr_util.h"
 #include "skia/ext/image_operations.h"
 #include "ui/aura/window.h"
+#include "ui/base/dragdrop/mojom/drag_drop_types.mojom-shared.h"
 #include "ui/base/resource/resource_bundle.h"
 #include "ui/display/display.h"
 #include "ui/display/screen.h"
@@ -19,7 +20,7 @@
 
 namespace ash {
 
-DragImageView::DragImageView(ui::DragDropTypes::DragEventSource event_source)
+DragImageView::DragImageView(ui::mojom::DragEventSource event_source)
     : drag_event_source_(event_source) {}
 
 DragImageView::~DragImageView() = default;
@@ -27,7 +28,7 @@
 // static
 views::UniqueWidgetPtr DragImageView::Create(
     aura::Window* root_window,
-    ui::DragDropTypes::DragEventSource event_source) {
+    ui::mojom::DragEventSource event_source) {
   views::Widget::InitParams params;
   params.type = views::Widget::InitParams::TYPE_TOOLTIP;
   params.name = "DragWidget";
@@ -72,7 +73,7 @@
 
 void DragImageView::SetTouchDragOperationHintOff() {
   // Simply set the drag type to non-touch so that no hint is drawn.
-  drag_event_source_ = ui::DragDropTypes::DRAG_EVENT_SOURCE_MOUSE;
+  drag_event_source_ = ui::mojom::DragEventSource::kMouse;
 
   // This disables the drag hint image. This should reduce the widget size if
   // the drag image is smaller than the drag hint image, so we set new bounds.
@@ -167,7 +168,7 @@
 }
 
 bool DragImageView::ShouldDrawDragHint() const {
-  return drag_event_source_ == ui::DragDropTypes::DRAG_EVENT_SOURCE_TOUCH;
+  return drag_event_source_ == ui::mojom::DragEventSource::kTouch;
 }
 
 gfx::Size DragImageView::GetMinimumSize() const {
diff --git a/ash/drag_drop/drag_image_view.h b/ash/drag_drop/drag_image_view.h
index d5f3d0f..c6068646 100644
--- a/ash/drag_drop/drag_image_view.h
+++ b/ash/drag_drop/drag_image_view.h
@@ -10,6 +10,7 @@
 #include "ash/ash_export.h"
 #include "base/macros.h"
 #include "ui/base/dragdrop/drag_drop_types.h"
+#include "ui/base/dragdrop/mojom/drag_drop_types.mojom-forward.h"
 #include "ui/gfx/geometry/point.h"
 #include "ui/gfx/geometry/size.h"
 #include "ui/views/controls/image_view.h"
@@ -37,9 +38,8 @@
   // |source| is the event source that started this drag drop operation (touch
   // or mouse). It is used to determine attributes of the drag image such as
   // whether to show drag operation hint on top of the image.
-  static views::UniqueWidgetPtr Create(
-      aura::Window* root_window,
-      ui::DragDropTypes::DragEventSource source);
+  static views::UniqueWidgetPtr Create(aura::Window* root_window,
+                                       ui::mojom::DragEventSource source);
 
   // Sets the bounds of the native widget in screen
   // coordinates.
@@ -72,7 +72,7 @@
   gfx::Size GetMinimumSize() const override;
 
  private:
-  DragImageView(ui::DragDropTypes::DragEventSource source);
+  DragImageView(ui::mojom::DragEventSource source);
 
   gfx::Image* DragHint() const;
   // Drag hint images are only drawn when the input source is touch.
@@ -90,7 +90,7 @@
   // we need to know the originally requested size to render the drag image.
   gfx::Size drag_image_size_;
 
-  ui::DragDropTypes::DragEventSource drag_event_source_;
+  ui::mojom::DragEventSource drag_event_source_;
 
   // Bitmask of ui::DragDropTypes::DragOperation values.
   int touch_drag_operation_ = ui::DragDropTypes::DRAG_NONE;
diff --git a/ash/drag_drop/drag_image_view_unittest.cc b/ash/drag_drop/drag_image_view_unittest.cc
index 4c5ab935..0e8d69e 100644
--- a/ash/drag_drop/drag_image_view_unittest.cc
+++ b/ash/drag_drop/drag_image_view_unittest.cc
@@ -6,7 +6,7 @@
 
 #include "ash/test/ash_test_base.h"
 #include "ui/aura/window.h"
-#include "ui/base/dragdrop/drag_drop_types.h"
+#include "ui/base/dragdrop/mojom/drag_drop_types.mojom-shared.h"
 #include "ui/views/widget/unique_widget_ptr.h"
 #include "ui/views/widget/widget.h"
 
@@ -16,9 +16,8 @@
 
 TEST_F(DragDropImageTest, SetBoundsConsidersDragHintForTouch) {
   std::unique_ptr<aura::Window> window = CreateTestWindow();
-  views::UniqueWidgetPtr drag_image_widget = DragImageView::Create(
-      window.get(),
-      ui::DragDropTypes::DragEventSource::DRAG_EVENT_SOURCE_TOUCH);
+  views::UniqueWidgetPtr drag_image_widget =
+      DragImageView::Create(window.get(), ui::mojom::DragEventSource::kTouch);
   DragImageView* drag_image_view =
       static_cast<DragImageView*>(drag_image_widget->GetContentsView());
 
@@ -50,9 +49,8 @@
 
 TEST_F(DragDropImageTest, SetBoundsIgnoresDragHintForMouse) {
   std::unique_ptr<aura::Window> window = CreateTestWindow();
-  views::UniqueWidgetPtr drag_image_widget = DragImageView::Create(
-      window.get(),
-      ui::DragDropTypes::DragEventSource::DRAG_EVENT_SOURCE_MOUSE);
+  views::UniqueWidgetPtr drag_image_widget =
+      DragImageView::Create(window.get(), ui::mojom::DragEventSource::kMouse);
   DragImageView* drag_image_view =
       static_cast<DragImageView*>(drag_image_widget->GetContentsView());
 
diff --git a/ash/login/ui/login_password_view.cc b/ash/login/ui/login_password_view.cc
index 7c3a873..e25cd8c 100644
--- a/ash/login/ui/login_password_view.cc
+++ b/ash/login/ui/login_password_view.cc
@@ -108,7 +108,7 @@
 
 // Hides the password after a short delay for security reasons.
 constexpr base::TimeDelta kHidePasswordAfterDelay =
-    base::TimeDelta::FromSeconds(3);
+    base::TimeDelta::FromSeconds(5);
 
 constexpr const char kLoginPasswordViewName[] = "LoginPasswordView";
 
@@ -742,11 +742,10 @@
   if (!is_display_password_feature_enabled_)
     return;
 
-  // Only reset the timer if the display password feature is enabled.
-  if (display_password_button_->GetVisible())
-    clear_password_timer_->Reset();
-  // For UX purposes, hide back the password when the user is typing.
-  HidePassword(false /*chromevox_exception*/);
+  // If the password is currently revealed.
+  if (textfield_->GetTextInputType() == ui::TEXT_INPUT_TYPE_NULL)
+    hide_password_timer_->Reset();
+  clear_password_timer_->Reset();
   display_password_button_->SetEnabled(!new_contents.empty());
 }
 
diff --git a/ash/login/ui/login_password_view_test.cc b/ash/login/ui/login_password_view_test.cc
index ade00b9..c2021048 100644
--- a/ash/login/ui/login_password_view_test.cc
+++ b/ash/login/ui/login_password_view_test.cc
@@ -326,12 +326,15 @@
             ui::TEXT_INPUT_TYPE_PASSWORD);
 }
 
-// Verifies that the password textfield hides back when the content changes.
-TEST_F(LoginPasswordViewTestFeatureEnabled, PasswordHidesAfterTyping) {
+// Verifies that the password textfield remains in the same visibility state
+// when the content changes.
+TEST_F(LoginPasswordViewTestFeatureEnabled,
+       ContentChangesDoNotImpactPasswordVisibility) {
   LoginPasswordView::TestApi test_api(view_);
   ui::test::EventGenerator* generator = GetEventGenerator();
 
-  // Show the password.
+  // Type to enable the display password button and click on it to display the
+  // password.
   EXPECT_EQ(test_api.textfield()->GetTextInputType(),
             ui::TEXT_INPUT_TYPE_PASSWORD);
   generator->PressKey(ui::KeyboardCode::VKEY_A, ui::EF_NONE);
@@ -340,18 +343,22 @@
   generator->ClickLeftButton();
   EXPECT_EQ(test_api.textfield()->GetTextInputType(), ui::TEXT_INPUT_TYPE_NULL);
 
-  // Type and check if the password textfield hides back.
+  // Type manually and programmatically, and check if the password textfield
+  // remains visible.
   generator->PressKey(ui::KeyboardCode::VKEY_A, ui::EF_NONE);
-  EXPECT_EQ(test_api.textfield()->GetTextInputType(),
-            ui::TEXT_INPUT_TYPE_PASSWORD);
+  EXPECT_EQ(test_api.textfield()->GetTextInputType(), ui::TEXT_INPUT_TYPE_NULL);
+  test_api.textfield()->InsertText(base::ASCIIToUTF16("test"));
+  EXPECT_EQ(test_api.textfield()->GetTextInputType(), ui::TEXT_INPUT_TYPE_NULL);
 
-  // Click again to show the password.
+  // Click again on the display password button to hide the password.
   generator->MoveMouseTo(
       test_api.display_password_button()->GetBoundsInScreen().CenterPoint());
   generator->ClickLeftButton();
-  EXPECT_EQ(test_api.textfield()->GetTextInputType(), ui::TEXT_INPUT_TYPE_NULL);
+  EXPECT_EQ(test_api.textfield()->GetTextInputType(),
+            ui::TEXT_INPUT_TYPE_PASSWORD);
 
-  // Modifies the content programmatically and check it is still triggered.
+  // Type manually and programmatically, and check if the password textfield
+  // remains invisible.
   test_api.textfield()->InsertText(base::ASCIIToUTF16("test"));
   EXPECT_EQ(test_api.textfield()->GetTextInputType(),
             ui::TEXT_INPUT_TYPE_PASSWORD);
diff --git a/ash/shelf/scrollable_shelf_view.cc b/ash/shelf/scrollable_shelf_view.cc
index 349310ce..2f0d44f 100644
--- a/ash/shelf/scrollable_shelf_view.cc
+++ b/ash/shelf/scrollable_shelf_view.cc
@@ -19,6 +19,7 @@
 #include "base/metrics/histogram_functions.h"
 #include "base/numerics/ranges.h"
 #include "chromeos/constants/chromeos_switches.h"
+#include "ui/base/dragdrop/mojom/drag_drop_types.mojom-shared.h"
 #include "ui/base/l10n/l10n_util.h"
 #include "ui/compositor/animation_throughput_reporter.h"
 #include "ui/compositor/paint_recorder.h"
@@ -1284,7 +1285,7 @@
     int blur_radius) {
   drag_icon_widget_ =
       DragImageView::Create(GetWidget()->GetNativeWindow()->GetRootWindow(),
-                            ui::DragDropTypes::DRAG_EVENT_SOURCE_MOUSE);
+                            ui::mojom::DragEventSource::kMouse);
   DragImageView* drag_icon =
       static_cast<DragImageView*>(drag_icon_widget_->GetContentsView());
   drag_icon->SetImage(icon);
diff --git a/ash/shelf/shelf_view.cc b/ash/shelf/shelf_view.cc
index aeb586f..8385cf7 100644
--- a/ash/shelf/shelf_view.cc
+++ b/ash/shelf/shelf_view.cc
@@ -52,6 +52,7 @@
 #include "base/timer/timer.h"
 #include "chromeos/constants/chromeos_switches.h"
 #include "ui/accessibility/ax_node_data.h"
+#include "ui/base/dragdrop/mojom/drag_drop_types.mojom-shared.h"
 #include "ui/base/l10n/l10n_util.h"
 #include "ui/base/models/simple_menu_model.h"
 #include "ui/base/ui_base_features.h"
@@ -863,8 +864,8 @@
   drag_replaced_view_ = replaced_view;
   aura::Window* root_window =
       drag_replaced_view_->GetWidget()->GetNativeWindow()->GetRootWindow();
-  drag_image_widget_ = DragImageView::Create(
-      root_window, ui::DragDropTypes::DRAG_EVENT_SOURCE_MOUSE);
+  drag_image_widget_ =
+      DragImageView::Create(root_window, ui::mojom::DragEventSource::kMouse);
   DragImageView* drag_image = GetDragImage();
   if (blur_radius > 0)
     SetDragImageBlur(icon.size(), blur_radius);
@@ -1447,8 +1448,8 @@
   drag_replaced_view_ = replaced_view;
   aura::Window* root_window =
       drag_replaced_view_->GetWidget()->GetNativeWindow()->GetRootWindow();
-  drag_image_widget_ = DragImageView::Create(
-      root_window, ui::DragDropTypes::DRAG_EVENT_SOURCE_MOUSE);
+  drag_image_widget_ =
+      DragImageView::Create(root_window, ui::mojom::DragEventSource::kMouse);
   DragImageView* drag_image = GetDragImage();
   drag_image->SetImage(icon);
   gfx::Size size = drag_image->GetPreferredSize();
diff --git a/ash/system/bluetooth/tray_bluetooth_helper_legacy.cc b/ash/system/bluetooth/tray_bluetooth_helper_legacy.cc
index 2caa9cb..81c33c75 100644
--- a/ash/system/bluetooth/tray_bluetooth_helper_legacy.cc
+++ b/ash/system/bluetooth/tray_bluetooth_helper_legacy.cc
@@ -24,6 +24,7 @@
 #include "device/bluetooth/bluetooth_device.h"
 #include "device/bluetooth/bluetooth_discovery_session.h"
 #include "device/bluetooth/chromeos/bluetooth_utils.h"
+#include "device/bluetooth/public/cpp/bluetooth_address.h"
 #include "services/device/public/cpp/bluetooth/bluetooth_utils.h"
 
 using device::mojom::BluetoothDeviceBatteryInfo;
@@ -96,7 +97,7 @@
 
   // If the string is not a valid encoding of a Bluetooth address, then the
   // underlying Bluetooth API returned an incorrect value.
-  CHECK(device::BluetoothDevice::ParseAddress(address_str, address_array));
+  CHECK(device::ParseBluetoothAddress(address_str, address_array));
 
   return address_array;
 }
diff --git a/base/test/launcher/test_launcher.cc b/base/test/launcher/test_launcher.cc
index 228cfcb4..66c4c89c 100644
--- a/base/test/launcher/test_launcher.cc
+++ b/base/test/launcher/test_launcher.cc
@@ -1695,6 +1695,7 @@
       if (!found)
         continue;
     }
+
     if (!negative_test_filter_.empty()) {
       bool excluded = false;
       for (auto filter : negative_test_filter_) {
@@ -1737,11 +1738,43 @@
 
   test_started_count_ = test_names.size();
 
+  // If there are no matching tests, warn and notify of any matches against
+  // *<filter>*.
+  if (test_started_count_ == 0) {
+    PrintFuzzyMatchingTestNames();
+    fprintf(stdout, "WARNING: No matching tests to run.\n");
+    fflush(stdout);
+  }
+
   TestRunner test_runner(this, parallel_jobs_,
                          launcher_delegate_->GetBatchSize());
   test_runner.Run(test_names);
 }
 
+void TestLauncher::PrintFuzzyMatchingTestNames() {
+  for (auto filter : positive_test_filter_) {
+    if (filter.empty())
+      continue;
+    std::string almost_filter;
+    if (filter.front() != '*')
+      almost_filter += '*';
+    almost_filter += filter;
+    if (filter.back() != '*')
+      almost_filter += '*';
+
+    for (const TestInfo& test_info : tests_) {
+      std::string test_name = test_info.GetFullName();
+      std::string prefix_stripped_name = test_info.GetPrefixStrippedName();
+      if (MatchPattern(test_name, almost_filter) ||
+          MatchPattern(prefix_stripped_name, almost_filter)) {
+        fprintf(stdout, "Filter \"%s\" would have matched: %s\n",
+                almost_filter.c_str(), test_name.c_str());
+        fflush(stdout);
+      }
+    }
+  }
+}
+
 bool TestLauncher::RunRetryTests() {
   // Number of retries in this iteration.
   size_t retry_count = 0;
diff --git a/base/test/launcher/test_launcher.h b/base/test/launcher/test_launcher.h
index 31fc58bf..572832c 100644
--- a/base/test/launcher/test_launcher.h
+++ b/base/test/launcher/test_launcher.h
@@ -187,6 +187,9 @@
   // Runs all tests in current iteration.
   void RunTests();
 
+  // Print test names that almost match a filter (matches *<filter>*).
+  void PrintFuzzyMatchingTestNames();
+
   // Retry to run tests that failed during RunTests.
   // Returns false if retry still fails or unable to start.
   bool RunRetryTests();
diff --git a/build/fuchsia/linux.sdk.sha1 b/build/fuchsia/linux.sdk.sha1
index 0f4c280..5ef6316 100644
--- a/build/fuchsia/linux.sdk.sha1
+++ b/build/fuchsia/linux.sdk.sha1
@@ -1 +1 @@
-0.20200803.3.1
+0.20200804.1.1
diff --git a/build/fuchsia/mac.sdk.sha1 b/build/fuchsia/mac.sdk.sha1
index 7485b99..5ef6316 100644
--- a/build/fuchsia/mac.sdk.sha1
+++ b/build/fuchsia/mac.sdk.sha1
@@ -1 +1 @@
-0.20200803.2.1
+0.20200804.1.1
diff --git a/cc/layers/painted_scrollbar_layer.cc b/cc/layers/painted_scrollbar_layer.cc
index 2be635c5..1a3e05aa 100644
--- a/cc/layers/painted_scrollbar_layer.cc
+++ b/cc/layers/painted_scrollbar_layer.cc
@@ -106,7 +106,7 @@
   return content_size;
 }
 
-void PaintedScrollbarLayer::UpdateThumbAndTrackGeometry() {
+bool PaintedScrollbarLayer::UpdateThumbAndTrackGeometry() {
   // These properties should never change.
   DCHECK_EQ(supports_drag_snap_back_, scrollbar_->SupportsDragSnapBack());
   DCHECK_EQ(is_left_side_vertical_scrollbar(),
@@ -114,21 +114,25 @@
   DCHECK_EQ(is_overlay_, scrollbar_->IsOverlay());
   DCHECK_EQ(orientation(), scrollbar_->Orientation());
 
-  UpdateProperty(scrollbar_->JumpOnTrackClick(), &jump_on_track_click_);
-  UpdateProperty(scrollbar_->TrackRect(), &track_rect_);
-  UpdateProperty(scrollbar_->BackButtonRect(), &back_button_rect_);
-  UpdateProperty(scrollbar_->ForwardButtonRect(), &forward_button_rect_);
-  UpdateProperty(scrollbar_->HasThumb(), &has_thumb_);
+  bool updated = false;
+  updated |=
+      UpdateProperty(scrollbar_->JumpOnTrackClick(), &jump_on_track_click_);
+  updated |= UpdateProperty(scrollbar_->TrackRect(), &track_rect_);
+  updated |= UpdateProperty(scrollbar_->BackButtonRect(), &back_button_rect_);
+  updated |=
+      UpdateProperty(scrollbar_->ForwardButtonRect(), &forward_button_rect_);
+  updated |= UpdateProperty(scrollbar_->HasThumb(), &has_thumb_);
   if (has_thumb_) {
     // Ignore ThumbRect's location because the PaintedScrollbarLayerImpl will
     // compute it from scroll offset.
-    UpdateProperty(scrollbar_->ThumbRect().size(), &thumb_size_);
+    updated |= UpdateProperty(scrollbar_->ThumbRect().size(), &thumb_size_);
   } else {
-    UpdateProperty(gfx::Size(), &thumb_size_);
+    updated |= UpdateProperty(gfx::Size(), &thumb_size_);
   }
+  return updated;
 }
 
-void PaintedScrollbarLayer::UpdateInternalContentScale() {
+bool PaintedScrollbarLayer::UpdateInternalContentScale() {
   gfx::Transform transform;
   transform = draw_property_utils::ScreenSpaceTransform(
       this, layer_tree_host()->property_trees()->transform_tree);
@@ -137,31 +141,24 @@
       transform, layer_tree_host()->device_scale_factor());
   float scale = std::max(transform_scales.x(), transform_scales.y());
 
-  bool changed = false;
-  changed |= UpdateProperty(scale, &internal_contents_scale_);
-  changed |=
+  bool updated = false;
+  updated |= UpdateProperty(scale, &internal_contents_scale_);
+  updated |=
       UpdateProperty(gfx::ScaleToCeiledSize(bounds(), internal_contents_scale_),
                      &internal_content_bounds_);
-  if (changed) {
-    // If the content scale or bounds change, repaint.
-    SetNeedsDisplay();
-  }
+  return updated;
 }
 
 bool PaintedScrollbarLayer::Update() {
-  {
-    auto ignore_set_needs_commit = IgnoreSetNeedsCommit();
-    ScrollbarLayerBase::Update();
-    UpdateInternalContentScale();
-  }
+  bool updated = false;
 
-  UpdateThumbAndTrackGeometry();
+  updated |= ScrollbarLayerBase::Update();
+  updated |= UpdateInternalContentScale();
+  updated |= UpdateThumbAndTrackGeometry();
 
   gfx::Size size = bounds();
   gfx::Size scaled_size = internal_content_bounds_;
 
-  bool updated = false;
-
   if (scaled_size.IsEmpty()) {
     if (track_resource_) {
       track_resource_ = nullptr;
@@ -178,14 +175,13 @@
     updated = true;
   }
 
-  if (update_rect().IsEmpty() && track_resource_)
-    return updated;
-
   if (!track_resource_ ||
       scrollbar_->NeedsRepaintPart(TRACK_BUTTONS_TICKMARKS)) {
     track_resource_ = ScopedUIResource::Create(
         layer_tree_host()->GetUIResourceManager(),
         RasterizeScrollbarPart(size, scaled_size, TRACK_BUTTONS_TICKMARKS));
+    SetNeedsPushProperties();
+    updated = true;
   }
 
   gfx::Size scaled_thumb_size = LayerSizeToContentSize(thumb_size_);
@@ -195,13 +191,12 @@
       thumb_resource_ = ScopedUIResource::Create(
           layer_tree_host()->GetUIResourceManager(),
           RasterizeScrollbarPart(thumb_size_, scaled_thumb_size, THUMB));
+      SetNeedsPushProperties();
+      updated = true;
     }
-    painted_opacity_ = scrollbar_->Opacity();
+    updated |= UpdateProperty(scrollbar_->Opacity(), &painted_opacity_);
   }
 
-  // UI resources changed so push properties is needed.
-  SetNeedsPushProperties();
-  updated = true;
   return updated;
 }
 
diff --git a/cc/layers/painted_scrollbar_layer.h b/cc/layers/painted_scrollbar_layer.h
index 930c614..a449ffc 100644
--- a/cc/layers/painted_scrollbar_layer.h
+++ b/cc/layers/painted_scrollbar_layer.h
@@ -52,8 +52,8 @@
   UIResourceId thumb_resource_id() {
     return thumb_resource_.get() ? thumb_resource_->id() : 0;
   }
-  void UpdateInternalContentScale();
-  void UpdateThumbAndTrackGeometry();
+  bool UpdateInternalContentScale();
+  bool UpdateThumbAndTrackGeometry();
 
  private:
   gfx::Size LayerSizeToContentSize(const gfx::Size& layer_size) const;
diff --git a/cc/layers/scrollbar_layer_unittest.cc b/cc/layers/scrollbar_layer_unittest.cc
index 4bf6b64..6da184e2 100644
--- a/cc/layers/scrollbar_layer_unittest.cc
+++ b/cc/layers/scrollbar_layer_unittest.cc
@@ -227,6 +227,66 @@
   }
 }
 
+TEST_F(ScrollbarLayerTest, SetNeedsDisplayDoesNotRequireUpdate) {
+  scoped_refptr<Layer> layer_tree_root = Layer::Create();
+  scoped_refptr<Layer> content_layer = Layer::Create();
+  scoped_refptr<FakePaintedScrollbarLayer> scrollbar_layer =
+      FakePaintedScrollbarLayer::Create(true, true,
+                                        layer_tree_root->element_id());
+
+  // Setup.
+  {
+    layer_tree_root->AddChild(content_layer);
+    layer_tree_root->AddChild(scrollbar_layer);
+    layer_tree_host_->SetRootLayer(layer_tree_root);
+    scrollbar_layer->SetIsDrawable(true);
+    scrollbar_layer->SetBounds(gfx::Size(100, 100));
+    layer_tree_root->SetBounds(gfx::Size(100, 200));
+    content_layer->SetBounds(gfx::Size(100, 200));
+  }
+
+  layer_tree_host_->UpdateLayers();
+
+  // Simulate commit to compositor thread.
+  scrollbar_layer->PushPropertiesTo(
+      scrollbar_layer->CreateLayerImpl(layer_tree_host_->active_tree()).get());
+  scrollbar_layer->fake_scrollbar()->set_needs_repaint_thumb(false);
+  scrollbar_layer->fake_scrollbar()->set_needs_repaint_track(false);
+
+  EXPECT_FALSE(scrollbar_layer->Update());
+
+  // Opacity changes should cause an update.
+  {
+    scrollbar_layer->fake_scrollbar()->set_thumb_opacity(0.3f);
+    EXPECT_TRUE(scrollbar_layer->Update());
+  }
+
+  // Needing a thumb repaint should cause an update.
+  {
+    scrollbar_layer->fake_scrollbar()->set_needs_repaint_thumb(true);
+    EXPECT_TRUE(scrollbar_layer->Update());
+    scrollbar_layer->fake_scrollbar()->set_needs_repaint_thumb(false);
+    EXPECT_FALSE(scrollbar_layer->Update());
+  }
+
+  // Needing a track repaint should cause an update.
+  {
+    scrollbar_layer->fake_scrollbar()->set_needs_repaint_track(true);
+    EXPECT_TRUE(scrollbar_layer->Update());
+    scrollbar_layer->fake_scrollbar()->set_needs_repaint_track(false);
+    EXPECT_FALSE(scrollbar_layer->Update());
+  }
+
+  // A scroll will cause |SetNeedsDisplay| to be called, but the scrollbar parts
+  // are used for invalidation, rather than the scrollbar layer itself. This
+  // should not cause an update. This is important for performance as an update
+  // will cause a commit on every scroll offset change.
+  {
+    scrollbar_layer->SetNeedsDisplay();
+    EXPECT_FALSE(scrollbar_layer->Update());
+  }
+}
+
 class FakeNinePatchScrollbar : public FakeScrollbar {
  public:
   FakeNinePatchScrollbar() {
@@ -1263,6 +1323,8 @@
   // Simulate commit to compositor thread.
   scrollbar_layer->PushPropertiesTo(
       scrollbar_layer->CreateLayerImpl(layer_tree_host_->active_tree()).get());
+  scrollbar_layer->fake_scrollbar()->set_needs_repaint_thumb(false);
+  scrollbar_layer->fake_scrollbar()->set_needs_repaint_track(false);
 
   EXPECT_FALSE(scrollbar_layer->Update());
   EXPECT_NE(0, scrollbar_layer->track_resource_id());
diff --git a/cc/paint/image_transfer_cache_entry.cc b/cc/paint/image_transfer_cache_entry.cc
index 357d14f9..57389c1c 100644
--- a/cc/paint/image_transfer_cache_entry.cc
+++ b/cc/paint/image_transfer_cache_entry.cc
@@ -19,7 +19,7 @@
 #include "third_party/skia/include/core/SkPixmap.h"
 #include "third_party/skia/include/core/SkYUVAIndex.h"
 #include "third_party/skia/include/gpu/GrBackendSurface.h"
-#include "third_party/skia/include/gpu/GrContext.h"
+#include "third_party/skia/include/gpu/GrDirectContext.h"
 #include "third_party/skia/include/gpu/GrTypes.h"
 
 namespace cc {
@@ -46,7 +46,7 @@
 // returned. On failure, nullptr is returned (e.g., if one of the backend
 // textures is invalid or a Skia error occurs).
 sk_sp<SkImage> MakeYUVImageFromUploadedPlanes(
-    GrContext* context,
+    GrDirectContext* context,
     const std::vector<sk_sp<SkImage>>& plane_images,
     YUVDecodeFormat plane_images_format,
     SkYUVColorSpace yuv_color_space,
@@ -104,7 +104,7 @@
 
 // TODO(ericrk): Replace calls to this with calls to SkImage::makeTextureImage,
 // once that function handles colorspaces. https://crbug.com/834837
-sk_sp<SkImage> MakeTextureImage(GrContext* context,
+sk_sp<SkImage> MakeTextureImage(GrDirectContext* context,
                                 sk_sp<SkImage> source_image,
                                 sk_sp<SkColorSpace> target_color_space,
                                 GrMipMapped mip_mapped) {
@@ -121,7 +121,8 @@
 
   // Step 2: Apply a color-space conversion if necessary.
   if (uploaded_image && target_color_space) {
-    uploaded_image = uploaded_image->makeColorSpace(target_color_space);
+    uploaded_image =
+        uploaded_image->makeColorSpace(target_color_space, context);
   }
 
   // Step 3: If we had a colorspace conversion, we couldn't mipmap in step 1, so
@@ -331,7 +332,7 @@
     ServiceImageTransferCacheEntry&& other) = default;
 
 bool ServiceImageTransferCacheEntry::BuildFromHardwareDecodedImage(
-    GrContext* context,
+    GrDirectContext* context,
     std::vector<sk_sp<SkImage>> plane_images,
     YUVDecodeFormat plane_images_format,
     SkYUVColorSpace yuv_color_space,
@@ -384,7 +385,7 @@
 }
 
 bool ServiceImageTransferCacheEntry::Deserialize(
-    GrContext* context,
+    GrDirectContext* context,
     base::span<const uint8_t> data) {
   context_ = context;
 
diff --git a/cc/paint/image_transfer_cache_entry.h b/cc/paint/image_transfer_cache_entry.h
index 12eb917..c68810d1 100644
--- a/cc/paint/image_transfer_cache_entry.h
+++ b/cc/paint/image_transfer_cache_entry.h
@@ -18,7 +18,7 @@
 #include "third_party/skia/include/core/SkRefCnt.h"
 #include "third_party/skia/include/core/SkYUVASizeInfo.h"
 
-class GrContext;
+class GrDirectContext;
 class SkColorSpace;
 class SkImage;
 class SkPixmap;
@@ -113,7 +113,7 @@
   // - The colorspace of the resulting RGB image is sRGB.
   //
   // Returns true if the entry can be built, false otherwise.
-  bool BuildFromHardwareDecodedImage(GrContext* context,
+  bool BuildFromHardwareDecodedImage(GrDirectContext* context,
                                      std::vector<sk_sp<SkImage>> plane_images,
                                      YUVDecodeFormat plane_images_format,
                                      SkYUVColorSpace yuv_color_space,
@@ -122,7 +122,8 @@
 
   // ServiceTransferCacheEntry implementation:
   size_t CachedSize() const final;
-  bool Deserialize(GrContext* context, base::span<const uint8_t> data) final;
+  bool Deserialize(GrDirectContext* context,
+                   base::span<const uint8_t> data) final;
 
   bool fits_on_gpu() const { return fits_on_gpu_; }
   const std::vector<sk_sp<SkImage>>& plane_images() const {
@@ -148,7 +149,7 @@
                              uint32_t height,
                              sk_sp<SkColorSpace> target_color_space);
 
-  GrContext* context_ = nullptr;
+  GrDirectContext* context_ = nullptr;
   std::vector<sk_sp<SkImage>> plane_images_;
   YUVDecodeFormat plane_images_format_ = YUVDecodeFormat::kUnknown;
   std::vector<size_t> plane_sizes_;
diff --git a/cc/paint/raw_memory_transfer_cache_entry.cc b/cc/paint/raw_memory_transfer_cache_entry.cc
index 8f8e746..c6e4f15 100644
--- a/cc/paint/raw_memory_transfer_cache_entry.cc
+++ b/cc/paint/raw_memory_transfer_cache_entry.cc
@@ -5,6 +5,7 @@
 #include "cc/paint/raw_memory_transfer_cache_entry.h"
 
 #include <string.h>
+#include <utility>
 
 namespace cc {
 
@@ -47,7 +48,7 @@
 }
 
 bool ServiceRawMemoryTransferCacheEntry::Deserialize(
-    GrContext* context,
+    GrDirectContext* context,
     base::span<const uint8_t> data) {
   data_ = std::vector<uint8_t>(data.begin(), data.end());
   return true;
diff --git a/cc/paint/raw_memory_transfer_cache_entry.h b/cc/paint/raw_memory_transfer_cache_entry.h
index 2e9aafd4..52e54dc0 100644
--- a/cc/paint/raw_memory_transfer_cache_entry.h
+++ b/cc/paint/raw_memory_transfer_cache_entry.h
@@ -5,11 +5,10 @@
 #ifndef CC_PAINT_RAW_MEMORY_TRANSFER_CACHE_ENTRY_H_
 #define CC_PAINT_RAW_MEMORY_TRANSFER_CACHE_ENTRY_H_
 
-#include "cc/paint/transfer_cache_entry.h"
-
 #include <vector>
 
 #include "base/atomic_sequence_num.h"
+#include "cc/paint/transfer_cache_entry.h"
 
 namespace cc {
 
@@ -37,7 +36,8 @@
   ServiceRawMemoryTransferCacheEntry();
   ~ServiceRawMemoryTransferCacheEntry() final;
   size_t CachedSize() const final;
-  bool Deserialize(GrContext* context, base::span<const uint8_t> data) final;
+  bool Deserialize(GrDirectContext* context,
+                   base::span<const uint8_t> data) final;
   const std::vector<uint8_t>& data() { return data_; }
 
  private:
diff --git a/cc/paint/shader_transfer_cache_entry.cc b/cc/paint/shader_transfer_cache_entry.cc
index fda25bd..7a9085a 100644
--- a/cc/paint/shader_transfer_cache_entry.cc
+++ b/cc/paint/shader_transfer_cache_entry.cc
@@ -4,6 +4,8 @@
 
 #include "cc/paint/shader_transfer_cache_entry.h"
 
+#include <utility>
+
 #include "base/notreached.h"
 
 namespace cc {
@@ -21,7 +23,7 @@
 }
 
 bool ServiceShaderTransferCacheEntry::Deserialize(
-    GrContext* context,
+    GrDirectContext* context,
     base::span<const uint8_t> data) {
   // These entries must be created directly via CreateLocalEntry.
   NOTREACHED();
diff --git a/cc/paint/shader_transfer_cache_entry.h b/cc/paint/shader_transfer_cache_entry.h
index 736009e..9fef12c 100644
--- a/cc/paint/shader_transfer_cache_entry.h
+++ b/cc/paint/shader_transfer_cache_entry.h
@@ -29,7 +29,8 @@
                                            size_t size);
   ~ServiceShaderTransferCacheEntry() final;
   size_t CachedSize() const final;
-  bool Deserialize(GrContext* context, base::span<const uint8_t> data) final;
+  bool Deserialize(GrDirectContext* context,
+                   base::span<const uint8_t> data) final;
 
   sk_sp<PaintShader> shader() const { return shader_; }
 
diff --git a/cc/paint/skottie_transfer_cache_entry.cc b/cc/paint/skottie_transfer_cache_entry.cc
index 7b1f1bd..edac568 100644
--- a/cc/paint/skottie_transfer_cache_entry.cc
+++ b/cc/paint/skottie_transfer_cache_entry.cc
@@ -4,6 +4,8 @@
 
 #include "cc/paint/skottie_transfer_cache_entry.h"
 
+#include <utility>
+
 #include "cc/paint/skottie_wrapper.h"
 
 namespace cc {
@@ -37,7 +39,7 @@
 }
 
 bool ServiceSkottieTransferCacheEntry::Deserialize(
-    GrContext* context,
+    GrDirectContext* context,
     base::span<const uint8_t> data) {
   skottie_ = SkottieWrapper::CreateNonSerializable(data);
   cached_size_ = data.size();
diff --git a/cc/paint/skottie_transfer_cache_entry.h b/cc/paint/skottie_transfer_cache_entry.h
index c81de74ad..671c9db 100644
--- a/cc/paint/skottie_transfer_cache_entry.h
+++ b/cc/paint/skottie_transfer_cache_entry.h
@@ -40,7 +40,8 @@
 
   // ServiceTransferCacheEntry implementation:
   size_t CachedSize() const final;
-  bool Deserialize(GrContext* context, base::span<const uint8_t> data) final;
+  bool Deserialize(GrDirectContext* context,
+                   base::span<const uint8_t> data) final;
 
   const scoped_refptr<SkottieWrapper>& skottie() const { return skottie_; }
 
diff --git a/cc/paint/transfer_cache_entry.h b/cc/paint/transfer_cache_entry.h
index 62a0179..cd209df 100644
--- a/cc/paint/transfer_cache_entry.h
+++ b/cc/paint/transfer_cache_entry.h
@@ -10,7 +10,7 @@
 #include "base/containers/span.h"
 #include "cc/paint/paint_export.h"
 
-class GrContext;
+class GrDirectContext;
 
 namespace cc {
 
@@ -85,7 +85,7 @@
 
   // Deserialize the cache entry from the given span of memory with the given
   // context.
-  virtual bool Deserialize(GrContext* context,
+  virtual bool Deserialize(GrDirectContext* context,
                            base::span<const uint8_t> data) = 0;
 };
 
diff --git a/chrome/android/chrome_test_java_sources.gni b/chrome/android/chrome_test_java_sources.gni
index 85a366a8..e97643a6 100644
--- a/chrome/android/chrome_test_java_sources.gni
+++ b/chrome/android/chrome_test_java_sources.gni
@@ -75,6 +75,7 @@
   "javatests/src/org/chromium/chrome/browser/browserservices/RunningInChromeTest.java",
   "javatests/src/org/chromium/chrome/browser/browserservices/TrustedWebActivityClientLocationDelegationTest.java",
   "javatests/src/org/chromium/chrome/browser/browserservices/TrustedWebActivityClientTest.java",
+  "javatests/src/org/chromium/chrome/browser/browserservices/TrustedWebActivityOrientationTest.java",
   "javatests/src/org/chromium/chrome/browser/browserservices/TrustedWebActivityShareTargetTest.java",
   "javatests/src/org/chromium/chrome/browser/browserservices/TrustedWebActivityTest.java",
   "javatests/src/org/chromium/chrome/browser/browserservices/TrustedWebActivityTestUtil.java",
diff --git a/chrome/android/features/autofill_assistant/java/src/org/chromium/chrome/browser/autofill_assistant/AssistantOnboardingCoordinator.java b/chrome/android/features/autofill_assistant/java/src/org/chromium/chrome/browser/autofill_assistant/AssistantOnboardingCoordinator.java
index 74d881d..30f916c 100644
--- a/chrome/android/features/autofill_assistant/java/src/org/chromium/chrome/browser/autofill_assistant/AssistantOnboardingCoordinator.java
+++ b/chrome/android/features/autofill_assistant/java/src/org/chromium/chrome/browser/autofill_assistant/AssistantOnboardingCoordinator.java
@@ -40,6 +40,7 @@
     private static final String INTENT_IDENTFIER = "INTENT";
     private static final String BUY_MOVIE_TICKETS_INTENT = "BUY_MOVIE_TICKET";
     private static final String RENT_CAR_INTENT = "RENT_CAR";
+    private static final String PASSWORD_CHANGE_INTENT = "PASSWORD_CHANGE";
     private static final String FLIGHTS_INTENT = "FLIGHTS_CHECKIN";
     private static final String FOOD_ORDERING_INTENT = "FOOD_ORDERING";
     private static final String VOICE_SEARCH_INTENT = "TELEPORT";
@@ -237,6 +238,10 @@
                 termsTextView.setText(R.string.autofill_assistant_init_message_short);
                 titleTextView.setText(R.string.autofill_assistant_init_message_rent_car);
                 break;
+            case PASSWORD_CHANGE_INTENT:
+                termsTextView.setText(R.string.autofill_assistant_init_message_short);
+                titleTextView.setText(R.string.autofill_assistant_init_message_password_change);
+                break;
             case SHOPPING_INTENT:
             case SHOPPING_ASSISTED_CHECKOUT_INTENT:
                 termsTextView.setText(R.string.autofill_assistant_init_message_short);
diff --git a/chrome/android/features/autofill_assistant/java/strings/android_chrome_autofill_assistant_strings.grd b/chrome/android/features/autofill_assistant/java/strings/android_chrome_autofill_assistant_strings.grd
index d122756..c7168cfcd 100644
--- a/chrome/android/features/autofill_assistant/java/strings/android_chrome_autofill_assistant_strings.grd
+++ b/chrome/android/features/autofill_assistant/java/strings/android_chrome_autofill_assistant_strings.grd
@@ -177,6 +177,9 @@
       <message name="IDS_AUTOFILL_ASSISTANT_INIT_MESSAGE_RENT_CAR" desc="Onboarding message describing autofill assistant's capability for car rentals.">
         Rent a car\nin just a few taps
       </message>
+      <message name="IDS_AUTOFILL_ASSISTANT_INIT_MESSAGE_PASSWORD_CHANGE" desc="Onboarding message describing autofill assistant's capability for password change.">
+        Let Google Assistant help you\nchange your password
+      </message>
       <message name="IDS_AUTOFILL_ASSISTANT_INIT_MESSAGE_BUY_MOVIE_TICKETS" desc="Onboarding message describing autofill assistant's capability for movie tickets.">
         Buy movie tickets\nin just a few taps
       </message>
diff --git a/chrome/android/features/autofill_assistant/java/strings/android_chrome_autofill_assistant_strings_grd/IDS_AUTOFILL_ASSISTANT_INIT_MESSAGE_PASSWORD_CHANGE.png.sha1 b/chrome/android/features/autofill_assistant/java/strings/android_chrome_autofill_assistant_strings_grd/IDS_AUTOFILL_ASSISTANT_INIT_MESSAGE_PASSWORD_CHANGE.png.sha1
new file mode 100644
index 0000000..457235a
--- /dev/null
+++ b/chrome/android/features/autofill_assistant/java/strings/android_chrome_autofill_assistant_strings_grd/IDS_AUTOFILL_ASSISTANT_INIT_MESSAGE_PASSWORD_CHANGE.png.sha1
Binary files differ
diff --git a/chrome/android/features/tab_ui/java/src/org/chromium/chrome/browser/tasks/SingleTabSwitcherCoordinator.java b/chrome/android/features/tab_ui/java/src/org/chromium/chrome/browser/tasks/SingleTabSwitcherCoordinator.java
index 936dfca2..25d3d31 100644
--- a/chrome/android/features/tab_ui/java/src/org/chromium/chrome/browser/tasks/SingleTabSwitcherCoordinator.java
+++ b/chrome/android/features/tab_ui/java/src/org/chromium/chrome/browser/tasks/SingleTabSwitcherCoordinator.java
@@ -124,6 +124,7 @@
             SnackbarManager.SnackbarManageable snackbarManageable,
             ModalDialogManager modalDialogManager) {
         mTabListFaviconProvider.initWithNative(Profile.getLastUsedRegularProfile());
+        mMediator.initWithNative();
     }
 
     @Override
diff --git a/chrome/android/features/tab_ui/java/src/org/chromium/chrome/browser/tasks/SingleTabSwitcherMediator.java b/chrome/android/features/tab_ui/java/src/org/chromium/chrome/browser/tasks/SingleTabSwitcherMediator.java
index d522519..77fbb0a4 100644
--- a/chrome/android/features/tab_ui/java/src/org/chromium/chrome/browser/tasks/SingleTabSwitcherMediator.java
+++ b/chrome/android/features/tab_ui/java/src/org/chromium/chrome/browser/tasks/SingleTabSwitcherMediator.java
@@ -51,6 +51,7 @@
     private boolean mSelectedTabDidNotChangedAfterShown;
     private boolean mAddNormalTabModelObserverPending;
     private Long mTabTitleAvailableTime;
+    private boolean mFaviconInitialized;
 
     SingleTabSwitcherMediator(PropertyModel propertyModel, TabModelSelector tabModelSelector,
             TabListFaviconProvider tabListFaviconProvider) {
@@ -103,13 +104,37 @@
                     if (mTabTitleAvailableTime == null) {
                         mTabTitleAvailableTime = SystemClock.elapsedRealtime();
                     }
-                    mTabListFaviconProvider.getFaviconForUrlAsync(tab.getUrlString(), false,
-                            (Drawable favicon) -> { mPropertyModel.set(FAVICON, favicon); });
+                    // Favicon should be updated here unless mTabListFaviconProvider hasn't been
+                    // initialized yet.
+                    assert !mFaviconInitialized;
+                    if (mTabListFaviconProvider.isInitialized()) {
+                        mFaviconInitialized = true;
+                        updateFavicon(tab);
+                    }
                 }
             }
         };
     }
 
+    void initWithNative() {
+        if (mFaviconInitialized || !mTabModelSelector.isTabStateInitialized()) return;
+
+        TabModel normalTabModel = mTabModelSelector.getModel(false);
+        int selectedTabIndex = normalTabModel.index();
+        if (selectedTabIndex != TabList.INVALID_TAB_INDEX) {
+            assert normalTabModel.getCount() > 0;
+            Tab tab = normalTabModel.getTabAt(selectedTabIndex);
+            updateFavicon(tab);
+            mFaviconInitialized = true;
+        }
+    }
+
+    private void updateFavicon(Tab tab) {
+        assert mTabListFaviconProvider.isInitialized();
+        mTabListFaviconProvider.getFaviconForUrlAsync(tab.getUrlString(), false,
+                (Drawable favicon) -> { mPropertyModel.set(FAVICON, favicon); });
+    }
+
     void setOnTabSelectingListener(TabSwitcher.OnTabSelectingListener listener) {
         mTabSelectingListener = listener;
     }
diff --git a/chrome/android/java/src/org/chromium/chrome/browser/password_manager/settings/PasswordSettings.java b/chrome/android/java/src/org/chromium/chrome/browser/password_manager/settings/PasswordSettings.java
index e633cb1..5629519 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/password_manager/settings/PasswordSettings.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/password_manager/settings/PasswordSettings.java
@@ -148,11 +148,7 @@
 
         setHasOptionsMenu(true); // Password Export might be optional but Search is always present.
 
-        Bundle extras = getArguments();
-        assert extras.containsKey(PasswordManagerHelper.MANAGE_PASSWORDS_REFERRER)
-            : "PasswordSettings must be launched with a manage-passwords-referrer fragment"
-                + "argument, but none was provided.";
-        mManagePasswordsReferrer = extras.getInt(PasswordManagerHelper.MANAGE_PASSWORDS_REFERRER);
+        mManagePasswordsReferrer = getReferrerFromInstanceStateOrLaunchBundle(savedInstanceState);
 
         if (savedInstanceState == null) return;
 
@@ -162,6 +158,20 @@
         }
     }
 
+    private @ManagePasswordsReferrer int getReferrerFromInstanceStateOrLaunchBundle(
+            Bundle savedInstanceState) {
+        if (savedInstanceState != null
+                && savedInstanceState.containsKey(
+                        PasswordManagerHelper.MANAGE_PASSWORDS_REFERRER)) {
+            return savedInstanceState.getInt(PasswordManagerHelper.MANAGE_PASSWORDS_REFERRER);
+        }
+        Bundle extras = getArguments();
+        assert extras.containsKey(PasswordManagerHelper.MANAGE_PASSWORDS_REFERRER)
+            : "PasswordSettings must be launched with a manage-passwords-referrer fragment"
+                + "argument, but none was provided.";
+        return extras.getInt(PasswordManagerHelper.MANAGE_PASSWORDS_REFERRER);
+    }
+
     @Override
     public void onCreate(Bundle savedInstanceState) {
         super.onCreate(savedInstanceState);
@@ -417,6 +427,7 @@
         if (mSearchQuery != null) {
             outState.putString(SAVED_STATE_SEARCH_QUERY, mSearchQuery);
         }
+        outState.putInt(PasswordManagerHelper.MANAGE_PASSWORDS_REFERRER, mManagePasswordsReferrer);
     }
 
     @Override
diff --git a/chrome/android/javatests/src/org/chromium/chrome/browser/bookmarks/BookmarkPersonalizedSigninPromoDismissTest.java b/chrome/android/javatests/src/org/chromium/chrome/browser/bookmarks/BookmarkPersonalizedSigninPromoDismissTest.java
index aa34374..d202b9a 100644
--- a/chrome/android/javatests/src/org/chromium/chrome/browser/bookmarks/BookmarkPersonalizedSigninPromoDismissTest.java
+++ b/chrome/android/javatests/src/org/chromium/chrome/browser/bookmarks/BookmarkPersonalizedSigninPromoDismissTest.java
@@ -25,7 +25,6 @@
 import org.junit.runner.RunWith;
 
 import org.chromium.base.test.util.CommandLineFlags;
-import org.chromium.base.test.util.DisableIf;
 import org.chromium.chrome.R;
 import org.chromium.chrome.browser.ChromeTabbedActivity;
 import org.chromium.chrome.browser.flags.ChromeSwitches;
@@ -37,7 +36,6 @@
 import org.chromium.chrome.test.util.BookmarkTestUtil;
 import org.chromium.chrome.test.util.ChromeTabUtils;
 import org.chromium.content_public.browser.test.util.TestThreadUtils;
-import org.chromium.ui.test.util.UiDisableIf;
 
 /**
  * Tests different scenarios when the bookmark personalized signin promo is not shown.
@@ -77,7 +75,6 @@
 
     @Test
     @MediumTest
-    @DisableIf.Device(type = {UiDisableIf.TABLET}) // https://crbug.com/1103210
     public void testPromoNotShownAfterBeingDismissed() {
         mBookmarkTestRule.showBookmarkManager(mSyncTestRule.getActivity());
         onView(withId(R.id.signin_promo_view_container)).check(matches(isDisplayed()));
@@ -111,7 +108,6 @@
 
     @Test
     @MediumTest
-    @DisableIf.Device(type = {UiDisableIf.TABLET}) // https://crbug.com/1103210
     public void testPromoImpressionCountIncrementAfterDisplayingSigninPromo() {
         assertEquals(0, SigninPromoController.getSigninPromoImpressionsCountBookmarks());
         mBookmarkTestRule.showBookmarkManager(mSyncTestRule.getActivity());
diff --git a/chrome/android/javatests/src/org/chromium/chrome/browser/browserservices/TrustedWebActivityOrientationTest.java b/chrome/android/javatests/src/org/chromium/chrome/browser/browserservices/TrustedWebActivityOrientationTest.java
new file mode 100644
index 0000000..8d9f00b
--- /dev/null
+++ b/chrome/android/javatests/src/org/chromium/chrome/browser/browserservices/TrustedWebActivityOrientationTest.java
@@ -0,0 +1,124 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+package org.chromium.chrome.browser.browserservices;
+
+import static org.junit.Assert.assertTrue;
+
+import static org.chromium.chrome.browser.browserservices.TrustedWebActivityTestUtil.createSession;
+import static org.chromium.chrome.browser.browserservices.TrustedWebActivityTestUtil.createTrustedWebActivityIntent;
+import static org.chromium.chrome.browser.browserservices.TrustedWebActivityTestUtil.isTrustedWebActivity;
+import static org.chromium.chrome.browser.browserservices.TrustedWebActivityTestUtil.spoofVerification;
+
+import android.content.Intent;
+import android.content.pm.ActivityInfo;
+import android.net.Uri;
+
+import androidx.browser.trusted.ScreenOrientation;
+import androidx.browser.trusted.TrustedWebActivityIntentBuilder;
+import androidx.test.filters.MediumTest;
+
+import org.hamcrest.Matchers;
+import org.junit.Before;
+import org.junit.Rule;
+import org.junit.Test;
+import org.junit.rules.RuleChain;
+import org.junit.runner.RunWith;
+
+import org.chromium.base.CommandLine;
+import org.chromium.base.ContextUtils;
+import org.chromium.base.library_loader.LibraryLoader;
+import org.chromium.base.test.util.CommandLineFlags;
+import org.chromium.chrome.browser.customtabs.CustomTabActivityTestRule;
+import org.chromium.chrome.browser.flags.ChromeSwitches;
+import org.chromium.chrome.browser.tab.Tab;
+import org.chromium.chrome.browser.tab.TabTestUtils;
+import org.chromium.chrome.browser.tab.TabWebContentsDelegateAndroid;
+import org.chromium.chrome.test.ChromeJUnit4ClassRunner;
+import org.chromium.chrome.test.util.FullscreenTestUtils;
+import org.chromium.content_public.browser.test.util.Criteria;
+import org.chromium.content_public.browser.test.util.CriteriaHelper;
+import org.chromium.content_public.browser.test.util.JavaScriptUtils;
+import org.chromium.content_public.common.ContentSwitches;
+import org.chromium.net.test.EmbeddedTestServerRule;
+
+import java.util.concurrent.TimeoutException;
+
+/**
+ * Instrumentation tests for launching
+ * {@link org.chromium.chrome.browser.customtabs.CustomTabActivity} in Trusted Web Activity Mode
+ * with default orientation set.
+ */
+@RunWith(ChromeJUnit4ClassRunner.class)
+@CommandLineFlags.Add({ChromeSwitches.DISABLE_FIRST_RUN_EXPERIENCE})
+public class TrustedWebActivityOrientationTest {
+    public CustomTabActivityTestRule mCustomTabActivityTestRule = new CustomTabActivityTestRule();
+    public EmbeddedTestServerRule mEmbeddedTestServerRule = new EmbeddedTestServerRule();
+
+    @Rule
+    public RuleChain mRuleChain = RuleChain.emptyRuleChain()
+                                          .around(mCustomTabActivityTestRule)
+                                          .around(mEmbeddedTestServerRule);
+
+    private static final String PACKAGE_NAME =
+            ContextUtils.getApplicationContext().getPackageName();
+
+    @Before
+    public void setUp() {
+        // Native needs to be initialized to start the test server.
+        LibraryLoader.getInstance().ensureInitialized();
+
+        mEmbeddedTestServerRule.setServerUsesHttps(true); // TWAs only work with HTTPS.
+
+        // Map non-localhost-URLs to localhost. Navigations to non-localhost URLs will throw a
+        // certificate error.
+        Uri mapToUri = Uri.parse(mEmbeddedTestServerRule.getServer().getURL("/"));
+        CommandLine.getInstance().appendSwitchWithValue(
+                ContentSwitches.HOST_RESOLVER_RULES, "MAP * " + mapToUri.getAuthority());
+    }
+
+    @Test
+    @MediumTest
+    public void defaultOrientationIsSet() throws TimeoutException {
+        final String mTestPage =
+                mEmbeddedTestServerRule.getServer().getURL("/chrome/test/data/android/simple.html");
+
+        Intent intent = createTrustedWebActivityIntent(mTestPage);
+        intent.putExtra(TrustedWebActivityIntentBuilder.EXTRA_SCREEN_ORIENTATION,
+                ScreenOrientation.LANDSCAPE);
+        launchCustomTabActivity(intent);
+
+        assertTrue(isTrustedWebActivity(mCustomTabActivityTestRule.getActivity()));
+
+        // Check that the browser is not in fullscreen.
+        Tab tab = mCustomTabActivityTestRule.getActivity().getActivityTab();
+        final TabWebContentsDelegateAndroid delegate = TabTestUtils.getTabWebContentsDelegate(tab);
+        FullscreenTestUtils.waitForFullscreenFlag(
+                tab, false, mCustomTabActivityTestRule.getActivity());
+        FullscreenTestUtils.waitForPersistentFullscreen(delegate, false);
+
+        FullscreenTestUtils.togglePersistentFullscreenAndAssert(
+                tab, true, mCustomTabActivityTestRule.getActivity());
+
+        JavaScriptUtils.executeJavaScript(
+                tab.getWebContents(), "screen.orientation.lock('portrait');");
+        CriteriaHelper.pollUiThread(() -> {
+            Criteria.checkThat(mCustomTabActivityTestRule.getActivity().getRequestedOrientation(),
+                    Matchers.is(ActivityInfo.SCREEN_ORIENTATION_SENSOR_PORTRAIT));
+        });
+
+        JavaScriptUtils.executeJavaScript(tab.getWebContents(), "screen.orientation.unlock();");
+        CriteriaHelper.pollUiThread(() -> {
+            Criteria.checkThat(mCustomTabActivityTestRule.getActivity().getRequestedOrientation(),
+                    Matchers.is(ActivityInfo.SCREEN_ORIENTATION_SENSOR_LANDSCAPE));
+        });
+    }
+
+    public void launchCustomTabActivity(Intent intent) throws TimeoutException {
+        String url = intent.getData().toString();
+        spoofVerification(PACKAGE_NAME, url);
+        createSession(intent, PACKAGE_NAME);
+        mCustomTabActivityTestRule.startCustomTabActivityWithIntent(intent);
+    }
+}
diff --git a/chrome/android/javatests/src/org/chromium/chrome/browser/vr/WebXrArHitTestTest.java b/chrome/android/javatests/src/org/chromium/chrome/browser/vr/WebXrArHitTestTest.java
index efc7085..b7a427c 100644
--- a/chrome/android/javatests/src/org/chromium/chrome/browser/vr/WebXrArHitTestTest.java
+++ b/chrome/android/javatests/src/org/chromium/chrome/browser/vr/WebXrArHitTestTest.java
@@ -21,6 +21,7 @@
 import org.chromium.base.test.params.ParameterSet;
 import org.chromium.base.test.params.ParameterizedRunner;
 import org.chromium.base.test.util.CommandLineFlags;
+import org.chromium.base.test.util.DisabledTest;
 import org.chromium.base.test.util.MinAndroidSdkLevel;
 import org.chromium.chrome.browser.flags.ChromeSwitches;
 import org.chromium.chrome.browser.vr.rules.ArPlaybackFile;
@@ -81,6 +82,7 @@
      */
     @Test
     @MediumTest
+    @DisabledTest(message = "https://crbug.com/1112773")
     @XrActivityRestriction({XrActivityRestriction.SupportedActivity.ALL})
     @ArPlaybackFile("chrome/test/data/xr/ar_playback_datasets/floor_session_12s_30fps.mp4")
     public void testHitTestResultsAvailableInSubsequentFrame() {
diff --git a/chrome/android/junit/src/org/chromium/chrome/browser/customtabs/CustomTabIntentDataProviderTest.java b/chrome/android/junit/src/org/chromium/chrome/browser/customtabs/CustomTabIntentDataProviderTest.java
index 13e33886..91b28e6 100644
--- a/chrome/android/junit/src/org/chromium/chrome/browser/customtabs/CustomTabIntentDataProviderTest.java
+++ b/chrome/android/junit/src/org/chromium/chrome/browser/customtabs/CustomTabIntentDataProviderTest.java
@@ -4,12 +4,21 @@
 
 package org.chromium.chrome.browser.customtabs;
 
-import static org.junit.Assert.assertEquals;
-
 import static androidx.browser.customtabs.CustomTabsIntent.COLOR_SCHEME_DARK;
 import static androidx.browser.customtabs.CustomTabsIntent.COLOR_SCHEME_LIGHT;
 
+import static org.junit.Assert.assertEquals;
+
+import android.content.ComponentName;
+import android.content.Context;
 import android.content.Intent;
+import android.net.Uri;
+
+import androidx.browser.customtabs.CustomTabColorSchemeParams;
+import androidx.browser.customtabs.CustomTabsIntent;
+import androidx.browser.customtabs.CustomTabsSession;
+import androidx.browser.trusted.ScreenOrientation;
+import androidx.browser.trusted.TrustedWebActivityIntentBuilder;
 
 import org.junit.Test;
 import org.junit.runner.RunWith;
@@ -17,9 +26,8 @@
 import org.robolectric.annotation.Config;
 
 import org.chromium.base.test.BaseRobolectricTestRunner;
-
-import androidx.browser.customtabs.CustomTabColorSchemeParams;
-import androidx.browser.customtabs.CustomTabsIntent;
+import org.chromium.chrome.browser.document.ChromeLauncherActivity;
+import org.chromium.device.mojom.ScreenOrientationLockType;
 
 /** Tests for {@link CustomTabIntentDataProvider}. */
 @RunWith(BaseRobolectricTestRunner.class)
@@ -58,5 +66,36 @@
         assertEquals(lightParams.navigationBarColor, lightProvider.getNavigationBarColor());
         assertEquals(darkParams.navigationBarColor, darkProvider.getNavigationBarColor());
     }
+
+    /* Test the setting the default orientation for Trusted Web Activity and getting the default
+     * orientation.
+     */
+    @Test
+    public void defaultOrientationIsSet() throws Exception {
+        Context mContext = RuntimeEnvironment.application;
+        CustomTabsSession mSession = CustomTabsSession.createMockSessionForTesting(
+                new ComponentName(mContext, ChromeLauncherActivity.class));
+
+        TrustedWebActivityIntentBuilder twaBuilder =
+                new TrustedWebActivityIntentBuilder(getLaunchingUrl())
+                        .setScreenOrientation(ScreenOrientation.LANDSCAPE);
+        Intent intent = twaBuilder.build(mSession).getIntent();
+        CustomTabIntentDataProvider customTabIntentDataProvider =
+                new CustomTabIntentDataProvider(intent, mContext, COLOR_SCHEME_LIGHT);
+        assertEquals(ScreenOrientationLockType.LANDSCAPE,
+                customTabIntentDataProvider.getDefaultOrientation());
+
+        twaBuilder = new TrustedWebActivityIntentBuilder(getLaunchingUrl())
+                             .setScreenOrientation(ScreenOrientation.PORTRAIT);
+        intent = twaBuilder.build(mSession).getIntent();
+        customTabIntentDataProvider =
+                new CustomTabIntentDataProvider(intent, mContext, COLOR_SCHEME_LIGHT);
+        assertEquals(ScreenOrientationLockType.PORTRAIT,
+                customTabIntentDataProvider.getDefaultOrientation());
+    }
+
+    protected Uri getLaunchingUrl() {
+        return Uri.parse("https://www.example.com/");
+    }
 }
 
diff --git a/chrome/app/chrome_exe_main_win.cc b/chrome/app/chrome_exe_main_win.cc
index 03ee82c..2fcdad9 100644
--- a/chrome/app/chrome_exe_main_win.cc
+++ b/chrome/app/chrome_exe_main_win.cc
@@ -47,27 +47,13 @@
 
 namespace {
 
-// List of switches that it's safe to rendezvous early with. Fast start should
-// not be done if a command line contains a switch not in this set.
-// Note this is currently stored as a list of two because it's probably faster
-// to iterate over this small array than building a map for constant time
-// lookups.
-const char* const kFastStartSwitches[] = {
-  switches::kProfileDirectory,
-  switches::kShowAppList,
-};
-
 bool IsFastStartSwitch(const std::string& command_line_switch) {
-  for (size_t i = 0; i < base::size(kFastStartSwitches); ++i) {
-    if (command_line_switch == kFastStartSwitches[i])
-      return true;
-  }
-  return false;
+  return command_line_switch == switches::kProfileDirectory;
 }
 
 bool ContainsNonFastStartFlag(const base::CommandLine& command_line) {
   const base::CommandLine::SwitchMap& switches = command_line.GetSwitches();
-  if (switches.size() > base::size(kFastStartSwitches))
+  if (switches.size() > 1)
     return true;
   for (base::CommandLine::SwitchMap::const_iterator it = switches.begin();
        it != switches.end(); ++it) {
diff --git a/chrome/app/profiles_strings.grdp b/chrome/app/profiles_strings.grdp
index 3a0f82e..3927896 100644
--- a/chrome/app/profiles_strings.grdp
+++ b/chrome/app/profiles_strings.grdp
@@ -664,6 +664,9 @@
 
   <!-- Profile Picker -->
   <if expr="not chromeos and not is_android">
+    <message name="IDS_PROFILE_PICKER_ASK_ON_STARTUP" desc="Text for the checkbox on the profile picker main view">
+      Ask on startup
+    </message>
     <message name="IDS_PROFILE_PICKER_BACK_BUTTON_LABEL" desc="Label for a button that navigates user to the previous page">
       Back
     </message>
diff --git a/chrome/app/profiles_strings_grdp/IDS_PROFILE_PICKER_ASK_ON_STARTUP.png.sha1 b/chrome/app/profiles_strings_grdp/IDS_PROFILE_PICKER_ASK_ON_STARTUP.png.sha1
new file mode 100644
index 0000000..b21a8a8b
--- /dev/null
+++ b/chrome/app/profiles_strings_grdp/IDS_PROFILE_PICKER_ASK_ON_STARTUP.png.sha1
@@ -0,0 +1 @@
+9b870df57bd31352a2576b0e15a0d58f541e4858
\ No newline at end of file
diff --git a/chrome/browser/BUILD.gn b/chrome/browser/BUILD.gn
index c276c6b2..23975344 100644
--- a/chrome/browser/BUILD.gn
+++ b/chrome/browser/BUILD.gn
@@ -1261,6 +1261,8 @@
     "prerender/chrome_prerender_contents_delegate.h",
     "prerender/chrome_prerender_manager_delegate.cc",
     "prerender/chrome_prerender_manager_delegate.h",
+    "prerender/chrome_prerender_processor_impl_delegate.cc",
+    "prerender/chrome_prerender_processor_impl_delegate.h",
     "prerender/isolated/isolated_prerender_features.cc",
     "prerender/isolated/isolated_prerender_features.h",
     "prerender/isolated/isolated_prerender_from_string_url_loader.cc",
@@ -1305,6 +1307,7 @@
     "prerender/prerender_manager_factory.h",
     "prerender/prerender_processor_impl.cc",
     "prerender/prerender_processor_impl.h",
+    "prerender/prerender_processor_impl_delegate.h",
     "prerender/prerender_tab_helper.cc",
     "prerender/prerender_tab_helper.h",
     "previews/previews_content_util.cc",
@@ -4688,6 +4691,7 @@
     ]
     deps += [
       "//ui/aura",
+      "//ui/base/dragdrop/mojom:mojom_shared",
       "//ui/compositor",
       "//ui/snapshot",
     ]
diff --git a/chrome/browser/about_flags.cc b/chrome/browser/about_flags.cc
index 8e61dc4..b08fb9c5 100644
--- a/chrome/browser/about_flags.cc
+++ b/chrome/browser/about_flags.cc
@@ -5995,7 +5995,7 @@
      FEATURE_WITH_PARAMS_VALUE_TYPE(
          blink::features::kAlignFontDisplayAutoTimeoutWithLCPGoal,
          kAlignFontDisplayAutoTimeoutWithLCPGoalVariations,
-         "AlignFontDisplayAutoTimeoutWithLCPGoalVariations")},
+         "AlignFontDisplayAutoTimeoutWithLCPGoal")},
 
 #if defined(OS_CHROMEOS)
     {"enable-palm-suppression", flag_descriptions::kEnablePalmSuppressionName,
@@ -6200,8 +6200,9 @@
 
  private:
   // flags_ui::FlagsState::Delegate:
-  bool ShouldExcludeFlag(const FeatureEntry& entry) override {
-    return flags::IsFlagExpired(entry.internal_name);
+  bool ShouldExcludeFlag(const flags_ui::FlagsStorage* storage,
+                         const FeatureEntry& entry) override {
+    return flags::IsFlagExpired(storage, entry.internal_name);
   }
 
   std::unique_ptr<flags_ui::FlagsState> flags_state_;
@@ -6213,7 +6214,8 @@
   return ~entry.supported_platforms & kDeprecated;
 }
 
-bool SkipConditionalFeatureEntry(const FeatureEntry& entry) {
+bool SkipConditionalFeatureEntry(const flags_ui::FlagsStorage* storage,
+                                 const FeatureEntry& entry) {
   version_info::Channel channel = chrome::GetChannel();
 #if defined(OS_CHROMEOS)
   // enable-ui-devtools is only available on for non Stable channels.
@@ -6281,7 +6283,7 @@
   }
 #endif  // OS_ANDROID
 
-  if (flags::IsFlagExpired(entry.internal_name))
+  if (flags::IsFlagExpired(storage, entry.internal_name))
     return true;
 
   return false;
@@ -6331,7 +6333,10 @@
                            base::ListValue* unsupported_entries) {
   FlagsStateSingleton::GetFlagsState()->GetFlagFeatureEntries(
       flags_storage, access, supported_entries, unsupported_entries,
-      base::BindRepeating(&SkipConditionalFeatureEntry));
+      base::BindRepeating(&SkipConditionalFeatureEntry,
+                          // Unretained: this callback doesn't outlive this
+                          // stack frame.
+                          base::Unretained(flags_storage)));
 }
 
 void GetFlagFeatureEntriesForDeprecatedPage(
diff --git a/chrome/browser/about_flags_browsertest.cc b/chrome/browser/about_flags_browsertest.cc
index cf9515e..2f65e11 100644
--- a/chrome/browser/about_flags_browsertest.cc
+++ b/chrome/browser/about_flags_browsertest.cc
@@ -140,13 +140,20 @@
                               public testing::WithParamInterface<bool> {
  public:
   AboutFlagsBrowserTest() {
-    about_flags::testing::SetFeatureEntries(
-        {{kFlagName, "name-1", "description-1", -1,
-          ORIGIN_LIST_VALUE_TYPE(kSwitchName, "")},
-         {kExpiredFlagName, "name-2", "description-2", -1,
-          SINGLE_VALUE_TYPE(kExpiredFlagSwitchName)},
-         {kFlagWithOptionSelectorName, "name-3", "description-3", -1,
-          SINGLE_VALUE_TYPE(kFlagWithOptionSelectorSwitchName)}});
+    std::vector<flags_ui::FeatureEntry> entries = {
+        {kFlagName, "name-1", "description-1", -1,
+         ORIGIN_LIST_VALUE_TYPE(kSwitchName, "")},
+        {kExpiredFlagName, "name-2", "description-2", -1,
+         SINGLE_VALUE_TYPE(kExpiredFlagSwitchName)},
+        {kFlagWithOptionSelectorName, "name-3", "description-3", -1,
+         SINGLE_VALUE_TYPE(kFlagWithOptionSelectorSwitchName)}};
+    unexpire_name_ = base::StringPrintf("temporary-unexpire-flags-m%d",
+                                        CHROME_VERSION_MAJOR - 1);
+    flags_ui::FeatureEntry expiry_entry = {
+        unexpire_name_.c_str(), "unexpire name", "unexpire desc", -1,
+        SINGLE_VALUE_TYPE("unexpire-dummy-switch")};
+    entries.push_back(expiry_entry);
+    about_flags::testing::SetFeatureEntries(entries);
 
     flags::testing::SetFlagExpiration(kExpiredFlagName,
                                       CHROME_VERSION_MAJOR - 1);
@@ -179,6 +186,7 @@
   }
 
   bool expiration_enabled_ = true;
+  std::string unexpire_name_;
 
   base::test::ScopedFeatureList feature_list_;
 };
@@ -362,6 +370,30 @@
 }
 #endif
 
+// Regression test for https://crbug.com/1101828:
+// Test that simply setting a flag (without the backing feature) is sufficient
+// to consider a flag unexpired. This test checks that by using a flag with the
+// expected unexpire name, but wired to a dummy switch rather than the usual
+// feature.
+//
+// This isn't a perfect regression test - that would require two separate
+// browser restarts:
+// 1) Enable temporary-unexpire-flags-m$M, restart
+// 2) Enable the test flag (which is only visible after the previous restart),
+//    restart
+// 3) Ensure that the test flag got applied at startup
+IN_PROC_BROWSER_TEST_P(AboutFlagsBrowserTest, RawFlagUnexpiryWorks) {
+  NavigateToFlagsPage();
+  content::WebContents* contents =
+      browser()->tab_strip_model()->GetActiveWebContents();
+  EXPECT_FALSE(IsFlagPresent(contents, kExpiredFlagName));
+  ToggleEnableDropdown(contents, unexpire_name_.c_str(), true);
+
+  NavigateToFlagsPage();
+  contents = browser()->tab_strip_model()->GetActiveWebContents();
+  EXPECT_TRUE(IsFlagPresent(contents, kExpiredFlagName));
+}
+
 IN_PROC_BROWSER_TEST_P(AboutFlagsBrowserTest, FormRestore) {
   NavigateToFlagsPage();
   content::WebContents* contents =
diff --git a/chrome/browser/android/cookies/cookies_fetcher_util.cc b/chrome/browser/android/cookies/cookies_fetcher_util.cc
index 57788a7..aa4dde7 100644
--- a/chrome/browser/android/cookies/cookies_fetcher_util.cc
+++ b/chrome/browser/android/cookies/cookies_fetcher_util.cc
@@ -110,7 +110,10 @@
           static_cast<net::CookiePriority>(priority));
 
   // These cookies were in the cookie store already so they should be valid.
-  DCHECK(cookie);
+  // TODO(dylancutler) This early return should be removed when the condition is
+  // no longer met.
+  if (!cookie)
+    return;
 
   // Assume HTTPS - since the cookies are being restored from another store,
   // they have already gone through the strict secure check.
diff --git a/chrome/browser/android/feed/history/feed_history_helper_unittest.cc b/chrome/browser/android/feed/history/feed_history_helper_unittest.cc
index 4b6af09..af0e95b 100644
--- a/chrome/browser/android/feed/history/feed_history_helper_unittest.cc
+++ b/chrome/browser/android/feed/history/feed_history_helper_unittest.cc
@@ -28,8 +28,7 @@
   FeedHistoryHelperTest() {}
 
   void SetUp() override {
-    ASSERT_TRUE(profile_.CreateHistoryService(/*delete_file=*/false,
-                                              /*no_db=*/false));
+    ASSERT_TRUE(profile_.CreateHistoryService());
     history_service_ = HistoryServiceFactory::GetForProfile(
         &profile_, ServiceAccessType::IMPLICIT_ACCESS);
     ASSERT_TRUE(history_service_);
diff --git a/chrome/browser/android/vr/BUILD.gn b/chrome/browser/android/vr/BUILD.gn
index 57e6a087..3365176f 100644
--- a/chrome/browser/android/vr/BUILD.gn
+++ b/chrome/browser/android/vr/BUILD.gn
@@ -69,6 +69,7 @@
 
   if (enable_arcore) {
     sources += [
+      "arcore_device/address_to_id_map.h",
       "arcore_device/ar_image_transport.cc",
       "arcore_device/ar_image_transport.h",
       "arcore_device/ar_renderer.cc",
diff --git a/chrome/browser/android/vr/arcore_device/address_to_id_map.h b/chrome/browser/android/vr/arcore_device/address_to_id_map.h
new file mode 100644
index 0000000..5b4c7f91
--- /dev/null
+++ b/chrome/browser/android/vr/arcore_device/address_to_id_map.h
@@ -0,0 +1,83 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CHROME_BROWSER_ANDROID_VR_ARCORE_DEVICE_ADDRESS_TO_ID_MAP_H_
+#define CHROME_BROWSER_ANDROID_VR_ARCORE_DEVICE_ADDRESS_TO_ID_MAP_H_
+
+#include "base/check.h"
+#include "base/optional.h"
+#include "base/stl_util.h"
+
+#include <unordered_map>
+
+namespace device {
+
+// Wrapper class used to generate an Id for a given address. Allows looking up
+// the Id for an address at a later time, or removing the mapping when desired.
+// Ids generated will be monotonically increasing from 1, and are suitable to
+// be passed over mojo. The Ids should be directly exposable from blink if
+// desired.
+// Note that IdType must be constructable from a uint64_t, and should most often
+// be a util::IdTypeU64 type.
+template <typename IdType>
+class AddressToIdMap {
+ public:
+  // Helper struct to provide a cleaner return interface than a std::pair for
+  // CreateOrGetId.
+  struct CreateOrGetIdResult {
+    // The found or newly created Id corresponding to the supplied address.
+    IdType id;
+
+    // Whether or not the above Id was newly created (true), or found (false).
+    bool created;
+
+    CreateOrGetIdResult(IdType id, bool created) : id(id), created(created) {}
+  };
+
+  // Retrieves or creates an id for the corresponding address.
+  CreateOrGetIdResult CreateOrGetId(void* address) {
+    auto it = address_to_id_.find(address);
+    if (it != address_to_id_.end()) {
+      return {it->second, false};
+    }
+
+    CHECK(next_id_ != std::numeric_limits<uint64_t>::max())
+        << "preventing ID overflow";
+
+    uint64_t current_id = next_id_;
+    next_id_++;
+    address_to_id_.emplace(address, current_id);
+
+    return {IdType(current_id), true};
+  }
+
+  // Gets the id for the corresponding address, if it's available.
+  base::Optional<IdType> GetId(void* address) const {
+    auto it = address_to_id_.find(address);
+    if (it == address_to_id_.end()) {
+      return base::nullopt;
+    }
+
+    return it->second;
+  }
+
+  // Used to "erase" a particular id->address mapping, such that lookup methods
+  // for the given address will fail. This will result in a new id being
+  // generated if the address is passed into CreateOrGetId.
+  template <class Predicate>
+  size_t EraseIf(Predicate pred) {
+    return base::EraseIf(address_to_id_, pred);
+  }
+
+ private:
+  // The HashMaps used in blink do not allow Ids that evaluate to 0. Thus, we
+  // start generating Ids from 1, so that the first IdType does not cause any
+  // issues in blink.
+  uint64_t next_id_ = 1;
+  std::unordered_map<void*, IdType> address_to_id_;
+};
+
+}  // namespace device
+
+#endif  // CHROME_BROWSER_ANDROID_VR_ARCORE_DEVICE_ADDRESS_TO_ID_MAP_H_
diff --git a/chrome/browser/android/vr/arcore_device/arcore_anchor_manager.cc b/chrome/browser/android/vr/arcore_device/arcore_anchor_manager.cc
index 28789526..c2f69ae 100644
--- a/chrome/browser/android/vr/arcore_device/arcore_anchor_manager.cc
+++ b/chrome/browser/android/vr/arcore_device/arcore_anchor_manager.cc
@@ -107,20 +107,17 @@
                                                          ArAnchor*> ar_anchor,
                                                  ArTrackingState
                                                      tracking_state) {
-    // ID
-    AnchorId anchor_id;
-    bool created;
-    std::tie(anchor_id, created) = CreateOrGetAnchorId(ar_anchor.get());
+    auto result = anchor_address_to_id_.CreateOrGetId(ar_anchor.get());
 
     DVLOG(3) << __func__
-             << ": anchor updated, anchor_id=" << anchor_id.GetUnsafeValue()
+             << ": anchor updated, anchor_id=" << result.id.GetUnsafeValue()
              << ", tracking_state=" << tracking_state;
 
-    DCHECK(!created)
+    DCHECK(!result.created)
         << "Anchor creation is app-initiated - we should never encounter an "
            "anchor that was created outside of `ArCoreImpl::CreateAnchor()`.";
 
-    updated_anchor_ids.insert(anchor_id);
+    updated_anchor_ids.insert(result.id);
   });
 
   DVLOG(3) << __func__
@@ -130,7 +127,7 @@
   ArSession_getAllAnchors(arcore_session_, arcore_anchors_.get());
 
   // Collect the objects of all currently tracked anchors.
-  // |ar_plane_address_to_id_| should *not* grow.
+  // |anchor_address_to_id_| should *not* grow.
   std::map<AnchorId, AnchorInfo> new_anchor_id_to_anchor_info;
   ForEachArCoreAnchor(arcore_anchors_.get(), [this,
                                               &new_anchor_id_to_anchor_info,
@@ -141,39 +138,36 @@
                                                  ArTrackingState
                                                      tracking_state) {
     // ID
-    AnchorId anchor_id;
-    bool created;
-    std::tie(anchor_id, created) = CreateOrGetAnchorId(anchor.get());
+    auto result = anchor_address_to_id_.CreateOrGetId(anchor.get());
 
     DVLOG(3) << __func__
-             << ": anchor present, anchor_id=" << anchor_id.GetUnsafeValue()
+             << ": anchor present, anchor_id=" << result.id.GetUnsafeValue()
              << ", tracking state=" << tracking_state;
 
-    DCHECK(!created)
+    DCHECK(!result.created)
         << "Anchor creation is app-initiated - we should never encounter an "
            "anchor that was created outside of `ArCoreImpl::CreateAnchor()`.";
 
     // Inspect the tracking state of this anchor in the previous frame. If it
     // changed, mark the anchor as updated.
-    if (base::Contains(anchor_id_to_anchor_info_, anchor_id) &&
-        anchor_id_to_anchor_info_.at(anchor_id).tracking_state !=
+    if (base::Contains(anchor_id_to_anchor_info_, result.id) &&
+        anchor_id_to_anchor_info_.at(result.id).tracking_state !=
             tracking_state) {
-      updated_anchor_ids.insert(anchor_id);
+      updated_anchor_ids.insert(result.id);
     }
 
     AnchorInfo new_anchor_info = AnchorInfo(std::move(anchor), tracking_state);
 
-    new_anchor_id_to_anchor_info.emplace(anchor_id, std::move(new_anchor_info));
+    new_anchor_id_to_anchor_info.emplace(result.id, std::move(new_anchor_info));
   });
 
   DVLOG(3) << __func__ << ": new_anchor_id_to_anchor_info.size()="
            << new_anchor_id_to_anchor_info.size();
 
-  // Shrink |ar_plane_address_to_id_|, removing all planes that are no longer
-  // tracked or were subsumed - if they do not show up in
-  // |plane_id_to_plane_object| map, they are no longer tracked.
-  base::EraseIf(
-      ar_anchor_address_to_id_,
+  // Shrink |anchor_address_to_id_|, removing all anchors that are no longer
+  // tracked - if they do not show up in |anchor_id_to_anchor_info| map, they
+  // are no longer tracked.
+  anchor_address_to_id_.EraseIf(
       [&new_anchor_id_to_anchor_info](const auto& anchor_address_and_id) {
         return !base::Contains(new_anchor_id_to_anchor_info,
                                anchor_address_and_id.second);
@@ -182,22 +176,6 @@
   updated_anchor_ids_.swap(updated_anchor_ids);
 }
 
-std::pair<AnchorId, bool> ArCoreAnchorManager::CreateOrGetAnchorId(
-    void* anchor_address) {
-  auto it = ar_anchor_address_to_id_.find(anchor_address);
-  if (it != ar_anchor_address_to_id_.end()) {
-    return std::make_pair(it->second, false);
-  }
-
-  CHECK(next_id_ != std::numeric_limits<uint64_t>::max())
-      << "preventing ID overflow";
-
-  uint64_t current_id = next_id_++;
-  ar_anchor_address_to_id_.emplace(anchor_address, current_id);
-
-  return std::make_pair(AnchorId(current_id), true);
-}
-
 base::Optional<AnchorId> ArCoreAnchorManager::CreateAnchor(
     const device::mojom::Pose& pose) {
   auto ar_pose = GetArPoseFromMojomPose(arcore_session_, pose);
@@ -212,23 +190,21 @@
     return base::nullopt;
   }
 
-  AnchorId anchor_id;
-  bool created;
-  std::tie(anchor_id, created) = CreateOrGetAnchorId(ar_anchor.get());
+  auto result = anchor_address_to_id_.CreateOrGetId(ar_anchor.get());
 
-  DCHECK(created) << "This should always be a new anchor, not something we've "
-                     "seen previously.";
+  DCHECK(result.created) << "This should always be a new anchor, not something "
+                            "we've seen previously.";
 
   // Mark new anchor as updated to ensure we send its information over to blink:
-  updated_anchor_ids_.insert(anchor_id);
+  updated_anchor_ids_.insert(result.id);
 
   ArTrackingState tracking_state;
   ArAnchor_getTrackingState(arcore_session_, ar_anchor.get(), &tracking_state);
 
   anchor_id_to_anchor_info_.emplace(
-      anchor_id, AnchorInfo(std::move(ar_anchor), tracking_state));
+      result.id, AnchorInfo(std::move(ar_anchor), tracking_state));
 
-  return anchor_id;
+  return result.id;
 }
 
 base::Optional<AnchorId> ArCoreAnchorManager::CreateAnchor(
@@ -245,23 +221,21 @@
     return base::nullopt;
   }
 
-  AnchorId anchor_id;
-  bool created;
-  std::tie(anchor_id, created) = CreateOrGetAnchorId(ar_anchor.get());
+  auto result = anchor_address_to_id_.CreateOrGetId(ar_anchor.get());
 
-  DCHECK(created) << "This should always be a new anchor, not something we've "
-                     "seen previously.";
+  DCHECK(result.created) << "This should always be a new anchor, not something "
+                            "we've seen previously.";
 
   // Mark new anchor as updated to ensure we send its information over to blink:
-  updated_anchor_ids_.insert(anchor_id);
+  updated_anchor_ids_.insert(result.id);
 
   ArTrackingState tracking_state;
   ArAnchor_getTrackingState(arcore_session_, ar_anchor.get(), &tracking_state);
 
   anchor_id_to_anchor_info_.emplace(
-      anchor_id, AnchorInfo(std::move(ar_anchor), tracking_state));
+      result.id, AnchorInfo(std::move(ar_anchor), tracking_state));
 
-  return anchor_id;
+  return result.id;
 }
 
 void ArCoreAnchorManager::DetachAnchor(AnchorId anchor_id) {
diff --git a/chrome/browser/android/vr/arcore_device/arcore_anchor_manager.h b/chrome/browser/android/vr/arcore_device/arcore_anchor_manager.h
index 37cb34c..b933d74 100644
--- a/chrome/browser/android/vr/arcore_device/arcore_anchor_manager.h
+++ b/chrome/browser/android/vr/arcore_device/arcore_anchor_manager.h
@@ -9,6 +9,7 @@
 
 #include "base/util/type_safety/id_type.h"
 #include "base/util/type_safety/pass_key.h"
+#include "chrome/browser/android/vr/arcore_device/address_to_id_map.h"
 #include "chrome/browser/android/vr/arcore_device/arcore_plane_manager.h"
 #include "chrome/browser/android/vr/arcore_device/arcore_sdk.h"
 #include "chrome/browser/android/vr/arcore_device/scoped_arcore_objects.h"
@@ -76,13 +77,9 @@
 
   internal::ScopedArCoreObject<ArAnchorList*> arcore_anchors_;
 
-  uint64_t next_id_ = 1;
-  // Returns tuple containing anchor id and a boolean signifying that the
-  // anchor was created. It should be called only during calls to |Update()|.
-  std::pair<AnchorId, bool> CreateOrGetAnchorId(void* anchor_address);
   // Mapping from anchor address to anchor ID. It should be modified only during
   // calls to |Update()| and anchor creation.
-  std::map<void*, AnchorId> ar_anchor_address_to_id_;
+  AddressToIdMap<AnchorId> anchor_address_to_id_;
   // Mapping from anchor ID to ARCore anchor information. It should be modified
   // only during calls to |Update()|.
   std::map<AnchorId, AnchorInfo> anchor_id_to_anchor_info_;
diff --git a/chrome/browser/android/vr/arcore_device/arcore_plane_manager.cc b/chrome/browser/android/vr/arcore_device/arcore_plane_manager.cc
index 1b0f48eb..5215255 100644
--- a/chrome/browser/android/vr/arcore_device/arcore_plane_manager.cc
+++ b/chrome/browser/android/vr/arcore_device/arcore_plane_manager.cc
@@ -132,24 +132,20 @@
   ArFrame_getUpdatedTrackables(arcore_session_, ar_frame, plane_tracked_type,
                                arcore_planes_.get());
 
-  // Collect the IDs of the updated planes. |ar_plane_address_to_id_| might
-  // grow.
+  // Collect the IDs of the updated planes. |plane_address_to_id_| might grow.
   std::set<PlaneId> updated_plane_ids;
   ForEachArCorePlane(
       arcore_planes_.get(),
       [this, &updated_plane_ids](
           internal::ScopedArCoreObject<ArTrackable*> trackable,
           ArPlane* ar_plane, ArTrackingState tracking_state) {
-        // ID
-        PlaneId plane_id;
-        bool created;
-        std::tie(plane_id, created) = CreateOrGetPlaneId(ar_plane);
+        auto result = plane_address_to_id_.CreateOrGetId(ar_plane);
 
-        DVLOG(3) << "Previously detected plane found, plane_id=" << plane_id
-                 << ", created?=" << created
+        DVLOG(3) << "Previously detected plane found, plane_id=" << result.id
+                 << ", created?=" << result.created
                  << ", tracking_state=" << tracking_state;
 
-        updated_plane_ids.insert(plane_id);
+        updated_plane_ids.insert(result.id);
       });
 
   DVLOG(3) << __func__
@@ -161,44 +157,42 @@
                              arcore_planes_.get());
 
   // Collect the objects of all currently tracked planes.
-  // |ar_plane_address_to_id_| should *not* grow.
+  // |plane_address_to_id_| should *not* grow.
   std::map<PlaneId, PlaneInfo> new_plane_id_to_plane_info;
   ForEachArCorePlane(
       arcore_planes_.get(),
       [this, &new_plane_id_to_plane_info, &updated_plane_ids](
           internal::ScopedArCoreObject<ArTrackable*> trackable,
           ArPlane* ar_plane, ArTrackingState tracking_state) {
-        // ID
-        PlaneId plane_id;
-        bool created;
-        std::tie(plane_id, created) = CreateOrGetPlaneId(ar_plane);
+        auto result = plane_address_to_id_.CreateOrGetId(ar_plane);
 
-        DCHECK(!created)
+        DCHECK(!result.created)
             << "Newly detected planes should already be handled - new plane_id="
-            << plane_id;
+            << result.id;
 
         // Inspect the tracking state of this plane in the previous frame. If it
         // changed, mark the plane as updated.
-        if (base::Contains(plane_id_to_plane_info_, plane_id) &&
-            plane_id_to_plane_info_.at(plane_id).tracking_state !=
+        if (base::Contains(plane_id_to_plane_info_, result.id) &&
+            plane_id_to_plane_info_.at(result.id).tracking_state !=
                 tracking_state) {
-          updated_plane_ids.insert(plane_id);
+          updated_plane_ids.insert(result.id);
         }
 
         PlaneInfo new_plane_info =
             PlaneInfo(std::move(trackable), tracking_state);
 
-        new_plane_id_to_plane_info.emplace(plane_id, std::move(new_plane_info));
+        new_plane_id_to_plane_info.emplace(result.id,
+                                           std::move(new_plane_info));
       });
 
   DVLOG(3) << __func__ << ": new_plane_id_to_plane_info.size()="
            << new_plane_id_to_plane_info.size();
 
-  // Shrink |ar_plane_address_to_id_|, removing all planes that are no longer
+  // Shrink |plane_address_to_id_|, removing all planes that are no longer
   // tracked or were subsumed - if they do not show up in
   // |new_plane_id_to_plane_info| map, they are no longer tracked.
-  base::EraseIf(ar_plane_address_to_id_, [&new_plane_id_to_plane_info](
-                                             const auto& plane_address_and_id) {
+  plane_address_to_id_.EraseIf([&new_plane_id_to_plane_info](
+                                   const auto& plane_address_and_id) {
     return !base::Contains(new_plane_id_to_plane_info,
                            plane_address_and_id.second);
   });
@@ -271,30 +265,9 @@
                                           std::move(updated_planes));
 }
 
-std::pair<PlaneId, bool> ArCorePlaneManager::CreateOrGetPlaneId(
-    void* plane_address) {
-  auto it = ar_plane_address_to_id_.find(plane_address);
-  if (it != ar_plane_address_to_id_.end()) {
-    return std::make_pair(it->second, false);
-  }
-
-  CHECK(next_id_ != std::numeric_limits<uint64_t>::max())
-      << "preventing ID overflow";
-
-  uint64_t current_id = next_id_++;
-  ar_plane_address_to_id_.emplace(plane_address, current_id);
-
-  return std::make_pair(PlaneId(current_id), true);
-}
-
 base::Optional<PlaneId> ArCorePlaneManager::GetPlaneId(
     void* plane_address) const {
-  auto it = ar_plane_address_to_id_.find(plane_address);
-  if (it == ar_plane_address_to_id_.end()) {
-    return base::nullopt;
-  }
-
-  return it->second;
+  return plane_address_to_id_.GetId(plane_address);
 }
 
 bool ArCorePlaneManager::PlaneExists(PlaneId id) const {
diff --git a/chrome/browser/android/vr/arcore_device/arcore_plane_manager.h b/chrome/browser/android/vr/arcore_device/arcore_plane_manager.h
index 1f2a2dab..9051816 100644
--- a/chrome/browser/android/vr/arcore_device/arcore_plane_manager.h
+++ b/chrome/browser/android/vr/arcore_device/arcore_plane_manager.h
@@ -9,6 +9,7 @@
 
 #include "base/util/type_safety/id_type.h"
 #include "base/util/type_safety/pass_key.h"
+#include "chrome/browser/android/vr/arcore_device/address_to_id_map.h"
 #include "chrome/browser/android/vr/arcore_device/arcore_sdk.h"
 #include "chrome/browser/android/vr/arcore_device/scoped_arcore_objects.h"
 #include "device/vr/public/mojom/vr_service.mojom.h"
@@ -92,13 +93,9 @@
   // each call to the ARCore SDK.
   internal::ScopedArCoreObject<ArPose*> ar_pose_;
 
-  uint64_t next_id_ = 1;
-  // Returns tuple containing plane id and a boolean signifying that the
-  // plane was created. It should be called only during calls to |Update()|.
-  std::pair<PlaneId, bool> CreateOrGetPlaneId(void* plane_address);
   // Mapping from plane address to plane ID. It should be modified only during
   // calls to |Update()|.
-  std::map<void*, PlaneId> ar_plane_address_to_id_;
+  AddressToIdMap<PlaneId> plane_address_to_id_;
   // Mapping from plane ID to ARCore plane information. It should be modified
   // only during calls to |Update()|.
   std::map<PlaneId, PlaneInfo> plane_id_to_plane_info_;
diff --git a/chrome/browser/autocomplete/search_provider_unittest.cc b/chrome/browser/autocomplete/search_provider_unittest.cc
index 34f6a24e..fed78be 100644
--- a/chrome/browser/autocomplete/search_provider_unittest.cc
+++ b/chrome/browser/autocomplete/search_provider_unittest.cc
@@ -368,7 +368,7 @@
     const std::string& search_url,
     const std::string& suggestions_url) {
   // We need both the history service and template url model loaded.
-  ASSERT_TRUE(profile_.CreateHistoryService(true, false));
+  ASSERT_TRUE(profile_.CreateHistoryService());
   TemplateURLServiceFactory::GetInstance()->SetTestingFactoryAndUse(
       &profile_,
       base::BindRepeating(&TemplateURLServiceFactory::BuildInstanceFor));
diff --git a/chrome/browser/autocomplete/shortcuts_provider_extension_unittest.cc b/chrome/browser/autocomplete/shortcuts_provider_extension_unittest.cc
index 6a641ad..60e99ba9 100644
--- a/chrome/browser/autocomplete/shortcuts_provider_extension_unittest.cc
+++ b/chrome/browser/autocomplete/shortcuts_provider_extension_unittest.cc
@@ -75,7 +75,7 @@
           &ShortcutsBackendFactory::BuildProfileNoDatabaseForTesting));
   backend_ = ShortcutsBackendFactory::GetForProfile(&profile_);
   ASSERT_TRUE(backend_.get());
-  ASSERT_TRUE(profile_.CreateHistoryService(true, false));
+  ASSERT_TRUE(profile_.CreateHistoryService());
   provider_ = new ShortcutsProvider(&client_);
   PopulateShortcutsBackendWithTestData(client_.GetShortcutsBackend(),
                                        shortcut_test_db,
@@ -85,9 +85,7 @@
 void ShortcutsProviderExtensionTest::TearDown() {
   // Run all pending tasks or else some threads hold on to the message loop
   // and prevent it from being deleted.
-  base::RunLoop().RunUntilIdle();
-
-  profile_.BlockUntilHistoryBackendDestroyed();
+  task_environment_.RunUntilIdle();
 }
 
 // Actual tests ---------------------------------------------------------------
diff --git a/chrome/browser/background_fetch/background_fetch_delegate_impl_unittest.cc b/chrome/browser/background_fetch/background_fetch_delegate_impl_unittest.cc
index 6bae1a0..3528a3d80 100644
--- a/chrome/browser/background_fetch/background_fetch_delegate_impl_unittest.cc
+++ b/chrome/browser/background_fetch/background_fetch_delegate_impl_unittest.cc
@@ -38,8 +38,7 @@
 
     // Add |OriginUrl()| to |profile_|'s history so the UKM background
     // recording conditions are met.
-    ASSERT_TRUE(profile_.CreateHistoryService(/* delete_file= */ true,
-                                              /* no_db= */ false));
+    ASSERT_TRUE(profile_.CreateHistoryService());
     auto* history_service = HistoryServiceFactory::GetForProfile(
         &profile_, ServiceAccessType::EXPLICIT_ACCESS);
     history_service->AddPage(OriginUrl(), base::Time::Now(),
diff --git a/chrome/browser/chrome_browser_interface_binders.cc b/chrome/browser/chrome_browser_interface_binders.cc
index 50e3116..e2afbb6c 100644
--- a/chrome/browser/chrome_browser_interface_binders.cc
+++ b/chrome/browser/chrome_browser_interface_binders.cc
@@ -21,6 +21,7 @@
 #include "chrome/browser/password_manager/chrome_password_manager_client.h"
 #include "chrome/browser/predictors/network_hints_handler_impl.h"
 #include "chrome/browser/prerender/chrome_prerender_contents_delegate.h"
+#include "chrome/browser/prerender/chrome_prerender_processor_impl_delegate.h"
 #include "chrome/browser/prerender/prerender_contents.h"
 #include "chrome/browser/prerender/prerender_processor_impl.h"
 #include "chrome/browser/profiles/profile.h"
@@ -295,6 +296,14 @@
   prerender_contents->AddPrerenderCancelerReceiver(std::move(receiver));
 }
 
+void BindPrerenderProcessor(
+    content::RenderFrameHost* frame_host,
+    mojo::PendingReceiver<blink::mojom::PrerenderProcessor> receiver) {
+  prerender::PrerenderProcessorImpl::Create(
+      frame_host, std::move(receiver),
+      std::make_unique<prerender::ChromePrerenderProcessorImplDelegate>());
+}
+
 #if defined(OS_ANDROID)
 template <typename Interface>
 void ForwardToJavaWebContents(content::RenderFrameHost* frame_host,
@@ -397,7 +406,7 @@
       base::BindRepeating(&BindPrerenderCanceler));
 
   map->Add<blink::mojom::PrerenderProcessor>(
-      base::BindRepeating(&prerender::PrerenderProcessorImpl::Create));
+      base::BindRepeating(&BindPrerenderProcessor));
 
   if (performance_manager::PerformanceManager::IsAvailable()) {
     map->Add<performance_manager::mojom::DocumentCoordinationUnit>(
diff --git a/chrome/browser/chrome_browser_main.cc b/chrome/browser/chrome_browser_main.cc
index 73eecfc..77f7fcd 100644
--- a/chrome/browser/chrome_browser_main.cc
+++ b/chrome/browser/chrome_browser_main.cc
@@ -920,8 +920,7 @@
 #if !defined(OS_ANDROID) && !defined(OS_CHROMEOS)
   if (first_run::IsChromeFirstRun()) {
     if (!parsed_command_line().HasSwitch(switches::kApp) &&
-        !parsed_command_line().HasSwitch(switches::kAppId) &&
-        !parsed_command_line().HasSwitch(switches::kShowAppList)) {
+        !parsed_command_line().HasSwitch(switches::kAppId)) {
       AddFirstRunNewTabs(browser_creator_.get(), master_prefs_->new_tabs);
     }
 
diff --git a/chrome/browser/chromeos/file_manager/guest_os_file_tasks.cc b/chrome/browser/chromeos/file_manager/guest_os_file_tasks.cc
index 17f9388..b1e19274 100644
--- a/chrome/browser/chromeos/file_manager/guest_os_file_tasks.cc
+++ b/chrome/browser/chromeos/file_manager/guest_os_file_tasks.cc
@@ -155,10 +155,12 @@
   // Ensure all files can be shared with VMs.
   storage::FileSystemContext* file_system_context =
       util::GetFileSystemContextForExtensionId(profile, kFileManagerAppId);
+  base::FilePath dummy_vm_mount("/");
   base::FilePath not_used;
   for (const GURL& file_url : file_urls) {
-    if (!file_manager::util::ConvertFileSystemURLToPathInsideCrostini(
-            profile, file_system_context->CrackURL(file_url), &not_used)) {
+    if (!file_manager::util::ConvertFileSystemURLToPathInsideVM(
+            profile, file_system_context->CrackURL(file_url), dummy_vm_mount,
+            &not_used)) {
       return;
     }
   }
diff --git a/chrome/browser/chromeos/file_manager/path_util.cc b/chrome/browser/chromeos/file_manager/path_util.cc
index 445781f0..eac3c98 100644
--- a/chrome/browser/chromeos/file_manager/path_util.cc
+++ b/chrome/browser/chromeos/file_manager/path_util.cc
@@ -52,6 +52,7 @@
 
 constexpr char kAndroidFilesMountPointName[] = "android_files";
 constexpr char kCrostiniMapGoogleDrive[] = "GoogleDrive";
+constexpr char kCrostiniMapLinuxFiles[] = "LinuxFiles";
 constexpr char kCrostiniMapMyDrive[] = "MyDrive";
 constexpr char kCrostiniMapPlayFiles[] = "PlayFiles";
 constexpr char kCrostiniMapTeamDrives[] = "SharedDrives";
@@ -308,10 +309,12 @@
   return options;
 }
 
-bool ConvertFileSystemURLToPathInsideCrostini(
+bool ConvertFileSystemURLToPathInsideVM(
     Profile* profile,
     const storage::FileSystemURL& file_system_url,
-    base::FilePath* inside) {
+    const base::FilePath& vm_mount,
+    base::FilePath* inside,
+    bool map_crostini_home) {
   const std::string& id(file_system_url.mount_filesystem_id());
   // File system root requires strip trailing separator.
   base::FilePath path =
@@ -327,29 +330,19 @@
 
   // Reformat virtual_path() from:
   //   <mount_label>/path/to/file
-  // To either:
-  //   /<home-directory>/path/to/file   (path is already in crostini volume)
-  //   /mnt/chromeos/<mapping>/path/to/file (path is shared with crostini)
+  // To:
+  //   <vm_mount>/<mapping>/path/to/file
+  // If |map_crostini_home| is set, paths in crostini mount map to:
+  //   /<home-directory>/path/to/file
   base::FilePath base_to_exclude(id);
-  if (id == GetCrostiniMountPointName(profile)) {
-    // Crostini.
-    base::Optional<crostini::ContainerInfo> container_info =
-        crostini::CrostiniManager::GetForProfile(profile)->GetContainerInfo(
-            crostini::ContainerId::GetDefault());
-    if (!container_info) {
-      return false;
-    }
-    *inside = container_info->homedir;
-  } else if (id == GetDownloadsMountPointName(profile)) {
+  if (id == GetDownloadsMountPointName(profile)) {
     // MyFiles.
-    *inside =
-        crostini::ContainerChromeOSBaseDirectory().Append(kFolderNameMyFiles);
+    *inside = vm_mount.Append(kFolderNameMyFiles);
   } else if (!mount_point_name_drive.empty() && id == mount_point_name_drive) {
     // DriveFS has some more complicated mappings.
     std::vector<base::FilePath::StringType> components;
     path.GetComponents(&components);
-    *inside = crostini::ContainerChromeOSBaseDirectory().Append(
-        kCrostiniMapGoogleDrive);
+    *inside = vm_mount.Append(kCrostiniMapGoogleDrive);
     if (components.size() >= 2 && components[1] == kDriveFsDirRoot) {
       // root -> MyDrive.
       base_to_exclude = base_to_exclude.Append(kDriveFsDirRoot);
@@ -362,15 +355,25 @@
     }
   } else if (id == chromeos::kSystemMountNameRemovable) {
     // Removable.
-    *inside = crostini::ContainerChromeOSBaseDirectory().Append(
-        chromeos::kSystemMountNameRemovable);
+    *inside = vm_mount.Append(chromeos::kSystemMountNameRemovable);
   } else if (id == GetAndroidFilesMountPointName()) {
-    *inside = crostini::ContainerChromeOSBaseDirectory().Append(
-        kCrostiniMapPlayFiles);
+    *inside = vm_mount.Append(kCrostiniMapPlayFiles);
   } else if (id == chromeos::kSystemMountNameArchive) {
     // Archive.
-    *inside = crostini::ContainerChromeOSBaseDirectory().Append(
-        chromeos::kSystemMountNameArchive);
+    *inside = vm_mount.Append(chromeos::kSystemMountNameArchive);
+  } else if (id == GetCrostiniMountPointName(profile)) {
+    // Crostini.
+    if (map_crostini_home) {
+      base::Optional<crostini::ContainerInfo> container_info =
+          crostini::CrostiniManager::GetForProfile(profile)->GetContainerInfo(
+              crostini::ContainerId::GetDefault());
+      if (!container_info) {
+        return false;
+      }
+      *inside = container_info->homedir;
+    } else {
+      *inside = vm_mount.Append(kCrostiniMapLinuxFiles);
+    }
   } else {
     return false;
   }
@@ -378,6 +381,15 @@
          base_to_exclude.AppendRelativePath(path, inside);
 }
 
+bool ConvertFileSystemURLToPathInsideCrostini(
+    Profile* profile,
+    const storage::FileSystemURL& file_system_url,
+    base::FilePath* inside) {
+  return ConvertFileSystemURLToPathInsideVM(
+      profile, file_system_url, crostini::ContainerChromeOSBaseDirectory(),
+      inside, /*map_crostini_home=*/true);
+}
+
 bool ConvertPathToArcUrl(const base::FilePath& path, GURL* arc_url_out) {
   DCHECK_CURRENTLY_ON(content::BrowserThread::UI);
 
diff --git a/chrome/browser/chromeos/file_manager/path_util.h b/chrome/browser/chromeos/file_manager/path_util.h
index 7637f9cb..7204dcf 100644
--- a/chrome/browser/chromeos/file_manager/path_util.h
+++ b/chrome/browser/chromeos/file_manager/path_util.h
@@ -98,6 +98,14 @@
     const std::string& host_private_key,
     const std::string& container_public_key);
 
+// Convert a cracked url to a path inside a VM mounted at |vm_mount|.
+bool ConvertFileSystemURLToPathInsideVM(
+    Profile* profile,
+    const storage::FileSystemURL& file_system_url,
+    const base::FilePath& vm_mount,
+    base::FilePath* inside,
+    bool map_crostini_home = false);
+
 // Convert a cracked url to a path inside the Crostini VM.
 bool ConvertFileSystemURLToPathInsideCrostini(
     Profile* profile,
diff --git a/chrome/browser/chromeos/file_manager/path_util_unittest.cc b/chrome/browser/chromeos/file_manager/path_util_unittest.cc
index 7a06c2ac..b3ff2593 100644
--- a/chrome/browser/chromeos/file_manager/path_util_unittest.cc
+++ b/chrome/browser/chromeos/file_manager/path_util_unittest.cc
@@ -318,7 +318,7 @@
       result);
 }
 
-TEST_F(FileManagerPathUtilTest, ConvertFileSystemURLToPathInsideCrostini) {
+TEST_F(FileManagerPathUtilTest, ConvertFileSystemURLToPathInsideVM) {
   storage::ExternalMountPoints* mount_points =
       storage::ExternalMountPoints::GetSystemInstance();
   // Setup for DriveFS.
@@ -363,14 +363,31 @@
       storage::FileSystemMountOption(), base::FilePath(kArchiveMountPath));
 
   base::FilePath inside;
-  EXPECT_TRUE(ConvertFileSystemURLToPathInsideCrostini(
+  base::FilePath vm_mount("/mnt/chromeos");
+  EXPECT_TRUE(ConvertFileSystemURLToPathInsideVM(
       profile_.get(),
       mount_points->CreateExternalFileSystemURL(
           url::Origin(), "Downloads-testing_profile-hash",
           base::FilePath("path/in/myfiles")),
-      &inside));
+      vm_mount, &inside));
   EXPECT_EQ("/mnt/chromeos/MyFiles/path/in/myfiles", inside.value());
 
+  EXPECT_TRUE(ConvertFileSystemURLToPathInsideVM(
+      profile_.get(),
+      mount_points->CreateExternalFileSystemURL(
+          url::Origin(), "crostini_0123456789abcdef_termina_penguin",
+          base::FilePath("path/in/crostini")),
+      vm_mount, &inside));
+  EXPECT_EQ("/mnt/chromeos/LinuxFiles/path/in/crostini", inside.value());
+
+  // Special case for Crostini $HOME.
+  EXPECT_TRUE(ConvertFileSystemURLToPathInsideVM(
+      profile_.get(),
+      mount_points->CreateExternalFileSystemURL(
+          url::Origin(), "crostini_0123456789abcdef_termina_penguin",
+          base::FilePath("path/in/crostini")),
+      vm_mount, &inside, /*map_crostini_home=*/true));
+  EXPECT_EQ("/home/testuser/path/in/crostini", inside.value());
   EXPECT_TRUE(ConvertFileSystemURLToPathInsideCrostini(
       profile_.get(),
       mount_points->CreateExternalFileSystemURL(
@@ -379,59 +396,59 @@
       &inside));
   EXPECT_EQ("/home/testuser/path/in/crostini", inside.value());
 
-  EXPECT_FALSE(ConvertFileSystemURLToPathInsideCrostini(
+  EXPECT_FALSE(ConvertFileSystemURLToPathInsideVM(
       profile_.get(),
       mount_points->CreateExternalFileSystemURL(
           url::Origin(), "unknown", base::FilePath("path/in/unknown")),
-      &inside));
+      vm_mount, &inside));
 
-  EXPECT_TRUE(ConvertFileSystemURLToPathInsideCrostini(
+  EXPECT_TRUE(ConvertFileSystemURLToPathInsideVM(
       profile_.get(),
       mount_points->CreateExternalFileSystemURL(
           url::Origin(), "android_files", base::FilePath("path/in/android")),
-      &inside));
+      vm_mount, &inside));
   EXPECT_EQ("/mnt/chromeos/PlayFiles/path/in/android", inside.value());
 
-  EXPECT_TRUE(ConvertFileSystemURLToPathInsideCrostini(
+  EXPECT_TRUE(ConvertFileSystemURLToPathInsideVM(
       profile_.get(),
       mount_points->CreateExternalFileSystemURL(
           url::Origin(), "drivefs-84675c855b63e12f384d45f033826980",
           base::FilePath("root/path/in/mydrive")),
-      &inside));
+      vm_mount, &inside));
   EXPECT_EQ("/mnt/chromeos/GoogleDrive/MyDrive/path/in/mydrive",
             inside.value());
 
-  EXPECT_TRUE(ConvertFileSystemURLToPathInsideCrostini(
+  EXPECT_TRUE(ConvertFileSystemURLToPathInsideVM(
       profile_.get(),
       mount_points->CreateExternalFileSystemURL(
           url::Origin(), "drivefs-84675c855b63e12f384d45f033826980",
           base::FilePath("team_drives/path/in/teamdrives")),
-      &inside));
+      vm_mount, &inside));
   EXPECT_EQ("/mnt/chromeos/GoogleDrive/SharedDrives/path/in/teamdrives",
             inside.value());
 
-  EXPECT_TRUE(ConvertFileSystemURLToPathInsideCrostini(
+  EXPECT_TRUE(ConvertFileSystemURLToPathInsideVM(
       profile_.get(),
       mount_points->CreateExternalFileSystemURL(
           url::Origin(), "drivefs-84675c855b63e12f384d45f033826980",
           base::FilePath("Computers/path/in/computers")),
-      &inside));
+      vm_mount, &inside));
   EXPECT_EQ("/mnt/chromeos/GoogleDrive/Computers/path/in/computers",
             inside.value());
 
-  EXPECT_TRUE(ConvertFileSystemURLToPathInsideCrostini(
+  EXPECT_TRUE(ConvertFileSystemURLToPathInsideVM(
       profile_.get(),
       mount_points->CreateExternalFileSystemURL(
           url::Origin(), "removable",
           base::FilePath("MyUSB/path/in/removable")),
-      &inside));
+      vm_mount, &inside));
   EXPECT_EQ("/mnt/chromeos/removable/MyUSB/path/in/removable", inside.value());
 
-  EXPECT_TRUE(ConvertFileSystemURLToPathInsideCrostini(
+  EXPECT_TRUE(ConvertFileSystemURLToPathInsideVM(
       profile_.get(),
       mount_points->CreateExternalFileSystemURL(
           url::Origin(), "archive", base::FilePath("file.rar/path/in/archive")),
-      &inside));
+      vm_mount, &inside));
   EXPECT_EQ("/mnt/chromeos/archive/file.rar/path/in/archive", inside.value());
 }
 
diff --git a/chrome/browser/chromeos/guest_os/guest_os_share_path.cc b/chrome/browser/chromeos/guest_os/guest_os_share_path.cc
index ca51d9a7..dc59789 100644
--- a/chrome/browser/chromeos/guest_os/guest_os_share_path.cc
+++ b/chrome/browser/chromeos/guest_os/guest_os_share_path.cc
@@ -378,22 +378,23 @@
   }
 
   // Convert path to a virtual path relative to one of the external mounts,
-  // then get it as a FilesSystemURL to convert to a path inside crostini,
-  // then remove /mnt/chromeos/ base dir prefix to get the path to unshare.
+  // then get it as a FilesSystemURL to convert to a path inside the VM,
+  // then remove mount base dir prefix to get the path to unshare.
   storage::ExternalMountPoints* mount_points =
       storage::ExternalMountPoints::GetSystemInstance();
   base::FilePath virtual_path;
+  base::FilePath dummy_vm_mount("/");
   base::FilePath inside;
   bool result = mount_points->GetVirtualPath(path, &virtual_path);
   if (result) {
     storage::FileSystemURL url = mount_points->CreateCrackedFileSystemURL(
         url::Origin(), storage::kFileSystemTypeExternal, virtual_path);
-    result = file_manager::util::ConvertFileSystemURLToPathInsideCrostini(
-        profile_, url, &inside);
+    result = file_manager::util::ConvertFileSystemURLToPathInsideVM(
+        profile_, url, dummy_vm_mount, &inside,
+        /*map_crostini_home=*/vm_name == crostini::kCrostiniDefaultVmName);
   }
   base::FilePath unshare_path;
-  if (!result || !crostini::ContainerChromeOSBaseDirectory().AppendRelativePath(
-                     inside, &unshare_path)) {
+  if (!result || !dummy_vm_mount.AppendRelativePath(inside, &unshare_path)) {
     std::move(callback).Run(false, "Invalid path to unshare");
     return;
   }
diff --git a/chrome/browser/chromeos/policy/extension_install_event_log_collector.cc b/chrome/browser/chromeos/policy/extension_install_event_log_collector.cc
index aeb18c1..d4d4ed8 100644
--- a/chrome/browser/chromeos/policy/extension_install_event_log_collector.cc
+++ b/chrome/browser/chromeos/policy/extension_install_event_log_collector.cc
@@ -51,7 +51,7 @@
     extensions::InstallStageTracker::FailureReason failure_reason) {
   switch (failure_reason) {
     case extensions::InstallStageTracker::FailureReason::UNKNOWN:
-      return em::ExtensionInstallReportLogEvent::UNKNOWN;
+      return em::ExtensionInstallReportLogEvent::FAILURE_REASON_UNKNOWN;
     case extensions::InstallStageTracker::FailureReason::INVALID_ID:
       return em::ExtensionInstallReportLogEvent::INVALID_ID;
     case extensions::InstallStageTracker::FailureReason::
diff --git a/chrome/browser/chromeos/policy/minimum_version_policy_handler.cc b/chrome/browser/chromeos/policy/minimum_version_policy_handler.cc
index 6c8b48d..2ced7a7 100644
--- a/chrome/browser/chromeos/policy/minimum_version_policy_handler.cc
+++ b/chrome/browser/chromeos/policy/minimum_version_policy_handler.cc
@@ -186,6 +186,10 @@
   return true;
 }
 
+bool MinimumVersionPolicyHandler::IsPolicyRestrictionAppliedForUser() const {
+  return delegate_->IsUserEnterpriseManaged() || unmanaged_user_restricted_;
+}
+
 //  static
 void MinimumVersionPolicyHandler::RegisterPrefs(PrefRegistrySimple* registry) {
   registry->RegisterTimePref(prefs::kUpdateRequiredTimerStartTime,
@@ -194,8 +198,9 @@
                                   base::TimeDelta());
 }
 
-bool MinimumVersionPolicyHandler::IsUpdateRequiredEol() const {
-  return !RequirementsAreSatisfied() && eol_reached_;
+bool MinimumVersionPolicyHandler::ShouldShowUpdateRequiredEolBanner() const {
+  return !RequirementsAreSatisfied() && IsPolicyRestrictionAppliedForUser() &&
+         eol_reached_;
 }
 
 bool MinimumVersionPolicyHandler::IsDeadlineTimerRunningForTesting() const {
@@ -294,7 +299,7 @@
 }
 
 void MinimumVersionPolicyHandler::Reset() {
-  deadline_reached = false;
+  deadline_reached_ = false;
   eol_reached_ = false;
   update_required_deadline_ = base::Time();
   update_required_time_ = base::Time();
@@ -471,8 +476,7 @@
     base::TimeDelta warning) {
   const NetworkStatus status = GetCurrentNetworkStatus();
   if ((!eol_reached_ && status == NetworkStatus::kAllowed) ||
-      !delegate_->IsUserLoggedIn() ||
-      (!delegate_->IsUserEnterpriseManaged() && !unmanaged_user_restricted_)) {
+      !delegate_->IsUserLoggedIn() || !IsPolicyRestrictionAppliedForUser()) {
     return;
   }
 
@@ -621,13 +625,12 @@
 }
 
 void MinimumVersionPolicyHandler::OnDeadlineReached() {
-  deadline_reached = true;
+  deadline_reached_ = true;
   if (delegate_->IsLoginSessionState() && !delegate_->IsLoginInProgress()) {
     // Show update required screen over the login screen.
     delegate_->ShowUpdateRequiredScreen();
   } else if (delegate_->IsUserLoggedIn() &&
-             (delegate_->IsUserEnterpriseManaged() ||
-              unmanaged_user_restricted_)) {
+             IsPolicyRestrictionAppliedForUser()) {
     // Terminate the current user session to show update required
     // screen on the login screen if the user is managed or
     // |unmanaged_user_restricted_| is set to true.
diff --git a/chrome/browser/chromeos/policy/minimum_version_policy_handler.h b/chrome/browser/chromeos/policy/minimum_version_policy_handler.h
index 3a841e6..7843b51 100644
--- a/chrome/browser/chromeos/policy/minimum_version_policy_handler.h
+++ b/chrome/browser/chromeos/policy/minimum_version_policy_handler.h
@@ -148,13 +148,9 @@
   void RemoveObserver(Observer* observer);
   bool RequirementsAreSatisfied() const { return GetState() == nullptr; }
 
-  // Returns |true| if the current version satisfies the given requirement.
-  bool CurrentVersionSatisfies(
-      const MinimumVersionRequirement& requirement) const;
-
   const MinimumVersionRequirement* GetState() const { return state_.get(); }
 
-  bool DeadlineReached() { return deadline_reached; }
+  bool DeadlineReached() { return deadline_reached_; }
 
   static void RegisterPrefs(PrefRegistrySimple* registry);
 
@@ -163,9 +159,11 @@
   // deadline.
   void MaybeShowNotificationOnLogin();
 
-  // Returns true if an update is required and the device has reached
-  // End Of Life (Auto Update Expiration).
-  bool IsUpdateRequiredEol() const;
+  // Whether banner to return back the device should be visible in Settings. It
+  // is true when an update is required on a device that has reached End Of Life
+  // (Auto Update Expiration) and the currently signed in user is enterprise
+  // managed or an unmanaged user restricted by DeviceMinimumVersion policy.
+  bool ShouldShowUpdateRequiredEolBanner() const;
 
   // Returns the number of days to deadline if update is required and deadline
   // has not been reached. Returns null if update is not required.
@@ -184,6 +182,15 @@
   bool IsDeadlineTimerRunningForTesting() const;
 
  private:
+  // Returns |true| if the current version satisfies the given requirement.
+  bool CurrentVersionSatisfies(
+      const MinimumVersionRequirement& requirement) const;
+
+  // Whether the current user should receive update required notifications and
+  // force signed out on reaching the deadline. Retuns true if the user is
+  // enterprise managed or |unmanaged_user_restricted_| is true.
+  bool IsPolicyRestrictionAppliedForUser() const;
+
   void OnPolicyChanged();
   bool IsPolicyApplicable();
   void Reset();
@@ -269,7 +276,7 @@
 
   // If this flag is true, user should restricted to use the session by logging
   // out and/or showing update required screen.
-  bool deadline_reached = false;
+  bool deadline_reached_ = false;
 
   // Time when the policy is applied and with respect to which the deadline to
   // update the device is calculated.
diff --git a/chrome/browser/chromeos/policy/minimum_version_policy_handler_browsertest.cc b/chrome/browser/chromeos/policy/minimum_version_policy_handler_browsertest.cc
index d5ca2a5d2..7117af81 100644
--- a/chrome/browser/chromeos/policy/minimum_version_policy_handler_browsertest.cc
+++ b/chrome/browser/chromeos/policy/minimum_version_policy_handler_browsertest.cc
@@ -634,7 +634,8 @@
 
 IN_PROC_BROWSER_TEST_F(MinimumVersionPolicyTest,
                        NotificationOnUnmanagedUserEnabled) {
-  DisconectAllNetworks();
+  fake_update_engine_client_->set_eol_date(
+      base::DefaultClock::GetInstance()->Now() - base::TimeDelta::FromDays(1));
   LoginUnmanagedUser();
   EXPECT_FALSE(
       display_service_tester_->GetNotification(kUpdateRequiredNotificationId));
@@ -651,6 +652,8 @@
   // policy.
   EXPECT_TRUE(
       display_service_tester_->GetNotification(kUpdateRequiredNotificationId));
+  EXPECT_TRUE(
+      GetMinimumVersionPolicyHandler()->ShouldShowUpdateRequiredEolBanner());
 }
 
 IN_PROC_BROWSER_TEST_F(MinimumVersionPolicyTest, NotificationsOnLogin) {
diff --git a/chrome/browser/content_settings/content_settings_default_provider_unittest.cc b/chrome/browser/content_settings/content_settings_default_provider_unittest.cc
index 18a25e6..5d5eba5 100644
--- a/chrome/browser/content_settings/content_settings_default_provider_unittest.cc
+++ b/chrome/browser/content_settings/content_settings_default_provider_unittest.cc
@@ -170,6 +170,51 @@
 }
 
 #if !defined(OS_ANDROID)
+// Tests that file system content settings are migrated.
+TEST_F(ContentSettingsDefaultProviderTest,
+       MigrateDeprecatedFileSystemPreferences) {
+  static const char kDeprecatedNativeFileSystemReadGuardDefaultPref[] =
+      "profile.default_content_setting_values.native_file_system_read_guard";
+  static const char kDeprecatedNativeFileSystemWriteGuardDefaultPref[] =
+      "profile.default_content_setting_values.native_file_system_write_guard";
+
+  PrefService* prefs = profile_.GetPrefs();
+  // Set some pref data.
+  prefs->SetInteger(kDeprecatedNativeFileSystemReadGuardDefaultPref,
+                    CONTENT_SETTING_BLOCK);
+  prefs->SetInteger(kDeprecatedNativeFileSystemWriteGuardDefaultPref,
+                    CONTENT_SETTING_BLOCK);
+
+  // Instantiate a new DefaultProvider; can't use |provider_| because we want to
+  // test the constructor's behavior after setting the above.
+  DefaultProvider provider(prefs, false);
+
+  // Check that settings have been migrated.
+  EXPECT_FALSE(
+      prefs->HasPrefPath(kDeprecatedNativeFileSystemReadGuardDefaultPref));
+  EXPECT_FALSE(
+      prefs->HasPrefPath(kDeprecatedNativeFileSystemWriteGuardDefaultPref));
+
+  WebsiteSettingsRegistry* website_settings =
+      WebsiteSettingsRegistry::GetInstance();
+  EXPECT_TRUE(prefs->HasPrefPath(
+      website_settings->Get(ContentSettingsType::FILE_SYSTEM_READ_GUARD)
+          ->default_value_pref_name()));
+  EXPECT_EQ(
+      CONTENT_SETTING_BLOCK,
+      prefs->GetInteger(
+          website_settings->Get(ContentSettingsType::FILE_SYSTEM_READ_GUARD)
+              ->default_value_pref_name()));
+  EXPECT_TRUE(prefs->HasPrefPath(
+      website_settings->Get(ContentSettingsType::FILE_SYSTEM_WRITE_GUARD)
+          ->default_value_pref_name()));
+  EXPECT_EQ(
+      CONTENT_SETTING_BLOCK,
+      prefs->GetInteger(
+          website_settings->Get(ContentSettingsType::FILE_SYSTEM_WRITE_GUARD)
+              ->default_value_pref_name()));
+}
+
 TEST_F(ContentSettingsDefaultProviderTest, DiscardObsoletePluginsAllow) {
   PrefService* prefs = profile_.GetPrefs();
   const std::string& plugins_pref_path = WebsiteSettingsRegistry::GetInstance()
diff --git a/chrome/browser/content_settings/content_settings_pref_provider_unittest.cc b/chrome/browser/content_settings/content_settings_pref_provider_unittest.cc
index 3bf122a..52fa26d 100644
--- a/chrome/browser/content_settings/content_settings_pref_provider_unittest.cc
+++ b/chrome/browser/content_settings/content_settings_pref_provider_unittest.cc
@@ -208,6 +208,53 @@
                                          std::string(), false));
 }
 
+#if !defined(OS_ANDROID)
+// Tests that file system preferences are migrated.
+TEST_F(PrefProviderTest, MigrateDeprecatedFileSystemPreferences) {
+  static const char kDeprecatedNativeFileSystemReadGuardPref[] =
+      "profile.content_settings.exceptions.native_file_system_read_guard";
+  static const char kDeprecatedNativeFileSystemWriteGuardPref[] =
+      "profile.content_settings.exceptions.native_file_system_write_guard";
+  static const char kPattern[] = "[*.]example.com";
+
+  TestingProfile profile;
+  PrefService* prefs = profile.GetPrefs();
+
+  // Set some pref data. Each content setting type has the following value:
+  // {"[*.]example.com": {"setting": 1}}
+  base::DictionaryValue pref_data;
+  auto data_for_pattern = std::make_unique<base::DictionaryValue>();
+  data_for_pattern->SetInteger("setting", CONTENT_SETTING_BLOCK);
+  pref_data.SetWithoutPathExpansion(kPattern, std::move(data_for_pattern));
+  prefs->Set(kDeprecatedNativeFileSystemReadGuardPref, pref_data);
+  prefs->Set(kDeprecatedNativeFileSystemWriteGuardPref, pref_data);
+
+  // Instantiate a new PrefProvider here, because we want to test the
+  // constructor's behavior after setting the above.
+  PrefProvider provider(prefs, /*incognito=*/false,
+                        /*store_last_modified=*/true,
+                        /*restore_session=*/false);
+
+  // Check that settings have been migrated.
+  EXPECT_FALSE(prefs->HasPrefPath(kDeprecatedNativeFileSystemReadGuardPref));
+  EXPECT_FALSE(prefs->HasPrefPath(kDeprecatedNativeFileSystemReadGuardPref));
+
+  GURL primary_url("http://example.com/");
+  EXPECT_EQ(
+      CONTENT_SETTING_BLOCK,
+      TestUtils::GetContentSetting(&provider, primary_url, primary_url,
+                                   ContentSettingsType::FILE_SYSTEM_READ_GUARD,
+                                   std::string(), false));
+  EXPECT_EQ(
+      CONTENT_SETTING_BLOCK,
+      TestUtils::GetContentSetting(&provider, primary_url, primary_url,
+                                   ContentSettingsType::FILE_SYSTEM_WRITE_GUARD,
+                                   std::string(), false));
+
+  provider.ShutdownOnUIThread();
+}
+#endif  // !defined(OS_ANDROID)
+
 // Test for regression in which the PrefProvider modified the user pref store
 // of the OTR unintentionally: http://crbug.com/74466.
 TEST_F(PrefProviderTest, Incognito) {
diff --git a/chrome/browser/download/download_target_determiner_unittest.cc b/chrome/browser/download/download_target_determiner_unittest.cc
index 4261adb..8dab1f7 100644
--- a/chrome/browser/download/download_target_determiner_unittest.cc
+++ b/chrome/browser/download/download_target_determiner_unittest.cc
@@ -1163,7 +1163,7 @@
                 base::FilePath(FILE_PATH_LITERAL("foo.kindabad"))));
 
   // First the history service must exist.
-  ASSERT_TRUE(profile()->CreateHistoryService(false, false));
+  ASSERT_TRUE(profile()->CreateHistoryService());
 
   GURL url("http://visited.example.com/visited-link.html");
   // The time of visit is picked to be several seconds prior to the most recent
diff --git a/chrome/browser/download/drag_download_item_aura.cc b/chrome/browser/download/drag_download_item_aura.cc
index 6bbfbbcc1..3bdb9c7 100644
--- a/chrome/browser/download/drag_download_item_aura.cc
+++ b/chrome/browser/download/drag_download_item_aura.cc
@@ -15,6 +15,7 @@
 #include "ui/aura/window_event_dispatcher.h"
 #include "ui/base/dragdrop/drag_drop_types.h"
 #include "ui/base/dragdrop/file_info/file_info.h"
+#include "ui/base/dragdrop/mojom/drag_drop_types.mojom-shared.h"
 #include "ui/base/dragdrop/os_exchange_data.h"
 #include "ui/display/screen.h"
 #include "ui/gfx/geometry/point.h"
@@ -53,10 +54,10 @@
   data->SetFilenames(file_infos);
 
   gfx::Point location = display::Screen::GetScreen()->GetCursorScreenPoint();
-  // TODO(varunjain): Properly determine and send DRAG_EVENT_SOURCE below.
+  // TODO(varunjain): Properly determine and send DragEventSource below.
   aura::client::GetDragDropClient(root_window)
       ->StartDragAndDrop(
           std::move(data), root_window, view, location,
           ui::DragDropTypes::DRAG_COPY | ui::DragDropTypes::DRAG_LINK,
-          ui::DragDropTypes::DRAG_EVENT_SOURCE_MOUSE);
+          ui::mojom::DragEventSource::kMouse);
 }
diff --git a/chrome/browser/extensions/BUILD.gn b/chrome/browser/extensions/BUILD.gn
index 0d980ae..15b2aee 100644
--- a/chrome/browser/extensions/BUILD.gn
+++ b/chrome/browser/extensions/BUILD.gn
@@ -900,6 +900,7 @@
     "//ui/accessibility:ax_enums_mojo",
     "//ui/base",
     "//ui/base/clipboard",
+    "//ui/base/dragdrop/mojom:mojom_shared",
     "//ui/base/ime",
     "//ui/display/manager",
     "//ui/gfx",
diff --git a/chrome/browser/extensions/api/bookmark_manager_private/bookmark_manager_private_api.cc b/chrome/browser/extensions/api/bookmark_manager_private/bookmark_manager_private_api.cc
index cde5b9d3..00ad2b9 100644
--- a/chrome/browser/extensions/api/bookmark_manager_private/bookmark_manager_private_api.cc
+++ b/chrome/browser/extensions/api/bookmark_manager_private/bookmark_manager_private_api.cc
@@ -42,7 +42,7 @@
 #include "extensions/browser/extension_function_dispatcher.h"
 #include "extensions/browser/extension_registry.h"
 #include "extensions/browser/view_type_utils.h"
-#include "ui/base/dragdrop/drag_drop_types.h"
+#include "ui/base/dragdrop/mojom/drag_drop_types.mojom-shared.h"
 #include "ui/base/l10n/l10n_util.h"
 #include "ui/base/webui/web_ui_util.h"
 
@@ -449,10 +449,9 @@
                  base::JoinString(params->id_list, ", "));
   }
 
-  ui::DragDropTypes::DragEventSource source =
-      ui::DragDropTypes::DRAG_EVENT_SOURCE_MOUSE;
+  ui::mojom::DragEventSource source = ui::mojom::DragEventSource::kMouse;
   if (params->is_from_touch)
-    source = ui::DragDropTypes::DRAG_EVENT_SOURCE_TOUCH;
+    source = ui::mojom::DragEventSource::kTouch;
 
   chrome::DragBookmarks(GetProfile(),
                         {std::move(nodes), params->drag_node_index,
diff --git a/chrome/browser/extensions/chrome_process_manager_delegate.cc b/chrome/browser/extensions/chrome_process_manager_delegate.cc
index 435dc178..690594f7 100644
--- a/chrome/browser/extensions/chrome_process_manager_delegate.cc
+++ b/chrome/browser/extensions/chrome_process_manager_delegate.cc
@@ -114,17 +114,8 @@
   // Background hosts will be loaded later via OnProfileAdded.
   // http://crbug.com/222473
   // Unit tests may not have a profile manager.
-  if (g_browser_process->profile_manager() &&
-      !g_browser_process->profile_manager()->IsValidProfile(profile)) {
-    return true;
-  }
-
-  // There are no browser windows open and the browser process was
-  // started to show the app launcher. Background hosts will be loaded later
-  // via OnBrowserAdded(). http://crbug.com/178260
-  return chrome::GetBrowserCount(profile) == 0 &&
-         base::CommandLine::ForCurrentProcess()->HasSwitch(
-             ::switches::kShowAppList);
+  return (g_browser_process->profile_manager() &&
+          !g_browser_process->profile_manager()->IsValidProfile(profile));
 }
 
 void ChromeProcessManagerDelegate::OnBrowserAdded(Browser* browser) {
diff --git a/chrome/browser/history/history_tab_helper_unittest.cc b/chrome/browser/history/history_tab_helper_unittest.cc
index e0a5a61e..4d43a9e 100644
--- a/chrome/browser/history/history_tab_helper_unittest.cc
+++ b/chrome/browser/history/history_tab_helper_unittest.cc
@@ -30,8 +30,7 @@
   // ChromeRenderViewHostTestHarness:
   void SetUp() override {
     ChromeRenderViewHostTestHarness::SetUp();
-    ASSERT_TRUE(profile()->CreateHistoryService(/*delete_file=*/false,
-                                                /*no_db=*/false));
+    ASSERT_TRUE(profile()->CreateHistoryService());
     history_service_ = HistoryServiceFactory::GetForProfile(
         profile(), ServiceAccessType::IMPLICIT_ACCESS);
     ASSERT_TRUE(history_service_);
diff --git a/chrome/browser/lifetime/switch_utils.cc b/chrome/browser/lifetime/switch_utils.cc
index 64bc5d9..277ca2c3 100644
--- a/chrome/browser/lifetime/switch_utils.cc
+++ b/chrome/browser/lifetime/switch_utils.cc
@@ -31,7 +31,6 @@
     switches::kMakeDefaultBrowser,
     switches::kNoStartupWindow,
     switches::kRestoreLastSession,
-    switches::kShowAppList,
     switches::kWinJumplistAction};
 
 }  // namespace
diff --git a/chrome/browser/media/capture_access_handler_base.cc b/chrome/browser/media/capture_access_handler_base.cc
index f6ae754..d4635b0 100644
--- a/chrome/browser/media/capture_access_handler_base.cc
+++ b/chrome/browser/media/capture_access_handler_base.cc
@@ -163,7 +163,7 @@
     const extensions::Extension* extension) {
   const bool is_trusted = MediaCaptureDevicesDispatcher::IsOriginForCasting(
                               request.security_origin) ||
-                          IsExtensionWhitelistedForScreenCapture(extension) ||
+                          IsExtensionAllowedForScreenCapture(extension) ||
                           IsBuiltInExtension(request.security_origin);
   UpdateTrusted(request, is_trusted);
 }
@@ -304,7 +304,7 @@
   }
 }
 
-bool CaptureAccessHandlerBase::IsExtensionWhitelistedForScreenCapture(
+bool CaptureAccessHandlerBase::IsExtensionAllowedForScreenCapture(
     const extensions::Extension* extension) {
   if (!extension)
     return false;
diff --git a/chrome/browser/media/capture_access_handler_base.h b/chrome/browser/media/capture_access_handler_base.h
index 3565599..9efe561 100644
--- a/chrome/browser/media/capture_access_handler_base.h
+++ b/chrome/browser/media/capture_access_handler_base.h
@@ -49,7 +49,7 @@
                                       bool is_secure) override;
 
  protected:
-  static bool IsExtensionWhitelistedForScreenCapture(
+  static bool IsExtensionAllowedForScreenCapture(
       const extensions::Extension* extension);
 
   static bool IsBuiltInExtension(const GURL& origin);
diff --git a/chrome/browser/media/extension_media_access_handler.cc b/chrome/browser/media/extension_media_access_handler.cc
index 3832cdb..160169b2 100644
--- a/chrome/browser/media/extension_media_access_handler.cc
+++ b/chrome/browser/media/extension_media_access_handler.cc
@@ -25,8 +25,7 @@
 // 6. XKB input method component extension.
 // 7. M17n/T13n/CJK input method component extension.
 // Once http://crbug.com/292856 is fixed, remove this whitelist.
-bool IsMediaRequestWhitelistedForExtension(
-    const extensions::Extension* extension) {
+bool IsMediaRequestAllowedForExtension(const extensions::Extension* extension) {
   return extension->id() == "mppnpdlheglhdfmldimlhpnegondlapf" ||
          extension->id() == "jokbpnebhdcladagohdnfgjcpejggllo" ||
          extension->id() == "clffjmdilanldobdnedchkdbofoimcgb" ||
@@ -50,7 +49,7 @@
     const extensions::Extension* extension) {
   return extension &&
          (extension->is_platform_app() ||
-          IsMediaRequestWhitelistedForExtension(extension)) &&
+          IsMediaRequestAllowedForExtension(extension)) &&
          (type == blink::mojom::MediaStreamType::DEVICE_AUDIO_CAPTURE ||
           type == blink::mojom::MediaStreamType::DEVICE_VIDEO_CAPTURE);
 }
diff --git a/chrome/browser/media/media_engagement_service_unittest.cc b/chrome/browser/media/media_engagement_service_unittest.cc
index 8ea59461..814e633 100644
--- a/chrome/browser/media/media_engagement_service_unittest.cc
+++ b/chrome/browser/media/media_engagement_service_unittest.cc
@@ -110,6 +110,23 @@
   return service;
 }
 
+// Blocks until the HistoryBackend is completely destroyed, to ensure the
+// destruction tasks do not interfere with a newer instance of
+// HistoryService/HistoryBackend.
+void BlockUntilHistoryBackendDestroyed(Profile* profile) {
+  history::HistoryService* history_service =
+      HistoryServiceFactory::GetForProfileWithoutCreating(profile);
+
+  // Nothing to destroy
+  if (!history_service)
+    return;
+
+  base::RunLoop run_loop;
+  history_service->SetOnBackendDestroyTask(run_loop.QuitClosure());
+  HistoryServiceFactory::ShutdownForProfile(profile);
+  run_loop.Run();
+}
+
 }  // namespace
 
 class MediaEngagementServiceTest : public ChromeRenderViewHostTestHarness,
@@ -161,7 +178,7 @@
       scoped_refptr<base::SequencedTaskRunner> backend_runner) {
     // Triggers destruction of the existing HistoryService and waits for all
     // cleanup work to be done.
-    profile()->BlockUntilHistoryBackendDestroyed();
+    BlockUntilHistoryBackendDestroyed(profile());
 
     // Force the creation of a new HistoryService that runs its backend on
     // |backend_runner|.
diff --git a/chrome/browser/media/protected_media_identifier_permission_context.cc b/chrome/browser/media/protected_media_identifier_permission_context.cc
index 9ab1b251..45d98b90 100644
--- a/chrome/browser/media/protected_media_identifier_permission_context.cc
+++ b/chrome/browser/media/protected_media_identifier_permission_context.cc
@@ -125,23 +125,23 @@
   // requires user intervention is problematic. If the domain has been
   // whitelisted as safe - suppress the request and allow.
   if (content_setting == CONTENT_SETTING_ASK &&
-      IsOriginWhitelisted(requesting_origin)) {
+      IsOriginAllowed(requesting_origin)) {
     content_setting = CONTENT_SETTING_ALLOW;
   }
 
   return content_setting;
 }
 
-bool ProtectedMediaIdentifierPermissionContext::IsOriginWhitelisted(
+bool ProtectedMediaIdentifierPermissionContext::IsOriginAllowed(
     const GURL& origin) {
   const base::CommandLine& command_line =
       *base::CommandLine::ForCurrentProcess();
 
-  const std::string whitelist = command_line.GetSwitchValueASCII(
+  const std::string allowlist = command_line.GetSwitchValueASCII(
       switches::kUnsafelyAllowProtectedMediaIdentifierForDomain);
 
   for (const std::string& domain : base::SplitString(
-           whitelist, ",", base::TRIM_WHITESPACE, base::SPLIT_WANT_NONEMPTY)) {
+           allowlist, ",", base::TRIM_WHITESPACE, base::SPLIT_WANT_NONEMPTY)) {
     if (origin.DomainIs(domain)) {
       return true;
     }
diff --git a/chrome/browser/media/protected_media_identifier_permission_context.h b/chrome/browser/media/protected_media_identifier_permission_context.h
index 28d757b..5ecfc22 100644
--- a/chrome/browser/media/protected_media_identifier_permission_context.h
+++ b/chrome/browser/media/protected_media_identifier_permission_context.h
@@ -52,7 +52,7 @@
 
  private:
   friend class ProtectedMediaIdentifierPermissionContextTest;
-  static bool IsOriginWhitelisted(const GURL& origin);
+  static bool IsOriginAllowed(const GURL& origin);
 
   void UpdateTabContext(const permissions::PermissionRequestID& id,
                         const GURL& requesting_frame,
diff --git a/chrome/browser/media/protected_media_identifier_permission_context_unittest.cc b/chrome/browser/media/protected_media_identifier_permission_context_unittest.cc
index 077646b5..775cdbc 100644
--- a/chrome/browser/media/protected_media_identifier_permission_context_unittest.cc
+++ b/chrome/browser/media/protected_media_identifier_permission_context_unittest.cc
@@ -18,9 +18,8 @@
     command_line_ = scoped_command_line_.GetProcessCommandLine();
   }
 
-  bool IsOriginWhitelisted(const GURL& origin) {
-    return ProtectedMediaIdentifierPermissionContext::IsOriginWhitelisted(
-        origin);
+  bool IsOriginAllowed(const GURL& origin) {
+    return ProtectedMediaIdentifierPermissionContext::IsOriginAllowed(origin);
   }
 
   GURL requesting_origin_;
@@ -33,7 +32,7 @@
 TEST_F(ProtectedMediaIdentifierPermissionContextTest,
        BypassWithFlagWithSingleDomain) {
   // The request should need to ask for permission
-  ASSERT_FALSE(IsOriginWhitelisted(requesting_origin_));
+  ASSERT_FALSE(IsOriginAllowed(requesting_origin_));
 
   // Add the switch value that the
   // ProtectedMediaIdentifierPermissionContext reads from
@@ -41,13 +40,13 @@
       switches::kUnsafelyAllowProtectedMediaIdentifierForDomain, "example.com");
 
   // The request should no longer need to ask for permission
-  ASSERT_TRUE(IsOriginWhitelisted(requesting_origin_));
+  ASSERT_TRUE(IsOriginAllowed(requesting_origin_));
 }
 
 TEST_F(ProtectedMediaIdentifierPermissionContextTest,
        BypassWithFlagWithDomainList) {
   // The request should need to ask for permission
-  ASSERT_FALSE(IsOriginWhitelisted(requesting_origin_));
+  ASSERT_FALSE(IsOriginAllowed(requesting_origin_));
 
   // Add the switch value that the
   // ProtectedMediaIdentifierPermissionContext reads from
@@ -56,13 +55,13 @@
       "example.ca,example.com,example.edu");
 
   // The request should no longer need to ask for permission
-  ASSERT_TRUE(IsOriginWhitelisted(requesting_origin_));
+  ASSERT_TRUE(IsOriginAllowed(requesting_origin_));
 }
 
 TEST_F(ProtectedMediaIdentifierPermissionContextTest,
        BypassWithFlagAndSubdomain) {
   // The request should need to ask for permission
-  ASSERT_FALSE(IsOriginWhitelisted(requesting_sub_domain_origin_));
+  ASSERT_FALSE(IsOriginAllowed(requesting_sub_domain_origin_));
 
   // Add the switch value that the
   // ProtectedMediaIdentifierPermissionContext reads from
@@ -70,6 +69,5 @@
       switches::kUnsafelyAllowProtectedMediaIdentifierForDomain, "example.com");
 
   // The request should no longer need to ask for permission
-  ASSERT_TRUE(IsOriginWhitelisted(requesting_sub_domain_origin_));
+  ASSERT_TRUE(IsOriginAllowed(requesting_sub_domain_origin_));
 }
-
diff --git a/chrome/browser/media/router/providers/cast/cast_media_route_provider.cc b/chrome/browser/media/router/providers/cast/cast_media_route_provider.cc
index b02f6ecc..210c914 100644
--- a/chrome/browser/media/router/providers/cast/cast_media_route_provider.cc
+++ b/chrome/browser/media/router/providers/cast/cast_media_route_provider.cc
@@ -28,9 +28,8 @@
 
 constexpr char kLoggerComponent[] = "CastMediaRouteProvider";
 
-// Whitelist of origins allowed to use a PresentationRequest to initiate
-// mirroring.
-constexpr std::array<base::StringPiece, 2> kPresentationApiWhitelist = {
+// List of origins allowed to use a PresentationRequest to initiate mirroring.
+constexpr std::array<base::StringPiece, 2> kPresentationApiAllowlist = {
     "https://docs.google.com",
     "https://meet.google.com",
 };
@@ -43,8 +42,8 @@
   // using generic Presentation API.  See also cast_media_source.cc.
   std::vector<url::Origin> allowed_origins;
   if (IsSiteInitiatedMirroringSource(source_id)) {
-    allowed_origins.reserve(kPresentationApiWhitelist.size());
-    for (const auto& origin : kPresentationApiWhitelist)
+    allowed_origins.reserve(kPresentationApiAllowlist.size());
+    for (const auto& origin : kPresentationApiAllowlist)
       allowed_origins.push_back(url::Origin::Create(GURL(origin)));
   }
   return allowed_origins;
diff --git a/chrome/browser/media/webrtc/desktop_capture_access_handler.cc b/chrome/browser/media/webrtc/desktop_capture_access_handler.cc
index 25023c11..a606d080 100644
--- a/chrome/browser/media/webrtc/desktop_capture_access_handler.cc
+++ b/chrome/browser/media/webrtc/desktop_capture_access_handler.cc
@@ -172,7 +172,7 @@
           switches::kEnableUserMediaScreenCapturing) ||
       MediaCaptureDevicesDispatcher::IsOriginForCasting(
           request.security_origin) ||
-      IsExtensionWhitelistedForScreenCapture(extension) ||
+      IsExtensionAllowedForScreenCapture(extension) ||
       IsBuiltInExtension(request.security_origin);
 
   const bool origin_is_secure =
@@ -272,7 +272,7 @@
   return extension &&
          (extension->location() == extensions::Manifest::COMPONENT ||
           extension->location() == extensions::Manifest::EXTERNAL_COMPONENT ||
-          IsExtensionWhitelistedForScreenCapture(extension));
+          IsExtensionAllowedForScreenCapture(extension));
 }
 
 bool DesktopCaptureAccessHandler::SupportsStreamType(
diff --git a/chrome/browser/media/webrtc/desktop_capture_access_handler.h b/chrome/browser/media/webrtc/desktop_capture_access_handler.h
index e97d6318..b37408e1 100644
--- a/chrome/browser/media/webrtc/desktop_capture_access_handler.h
+++ b/chrome/browser/media/webrtc/desktop_capture_access_handler.h
@@ -70,7 +70,7 @@
       const extensions::Extension* extension);
 
   // Returns whether desktop capture is always approved for |extension|.
-  // Currently component extensions and some whitelisted extensions are default
+  // Currently component extensions and some external extensions are default
   // approved.
   static bool IsDefaultApproved(const extensions::Extension* extension);
 
diff --git a/chrome/browser/media/webrtc/media_capture_devices_dispatcher.cc b/chrome/browser/media/webrtc/media_capture_devices_dispatcher.cc
index 1ff0041..da0b56d 100644
--- a/chrome/browser/media/webrtc/media_capture_devices_dispatcher.cc
+++ b/chrome/browser/media/webrtc/media_capture_devices_dispatcher.cc
@@ -123,7 +123,7 @@
 }
 
 bool MediaCaptureDevicesDispatcher::IsOriginForCasting(const GURL& origin) {
-  // Whitelisted tab casting extensions.
+  // Allowed tab casting extensions.
   return
       // Media Router Dev
       origin.spec() == "chrome-extension://enhhojjnijigcajfphajepfemndkmdlo/" ||
diff --git a/chrome/browser/media/webrtc/media_stream_capture_indicator.cc b/chrome/browser/media/webrtc/media_stream_capture_indicator.cc
index ce93d30..7f6a56c 100644
--- a/chrome/browser/media/webrtc/media_stream_capture_indicator.cc
+++ b/chrome/browser/media/webrtc/media_stream_capture_indicator.cc
@@ -471,9 +471,8 @@
 
     WebContents* const web_contents = it.first;
 
-    // The audio/video icon is shown only for non-whitelisted extensions or on
-    // Android. For regular tabs on desktop, we show an indicator in the tab
-    // icon.
+    // The audio/video icon is shown for extensions or on Android. For
+    // regular tabs on desktop, we show an indicator in the tab icon.
 #if BUILDFLAG(ENABLE_EXTENSIONS)
     const extensions::Extension* extension = GetExtension(web_contents);
     if (!extension)
diff --git a/chrome/browser/media/webrtc/media_stream_device_permissions.cc b/chrome/browser/media/webrtc/media_stream_device_permissions.cc
index a1aaed0..82781e6 100644
--- a/chrome/browser/media/webrtc/media_stream_device_permissions.cc
+++ b/chrome/browser/media/webrtc/media_stream_device_permissions.cc
@@ -19,15 +19,16 @@
 MediaStreamDevicePolicy GetDevicePolicy(const Profile* profile,
                                         const GURL& security_origin,
                                         const char* policy_name,
-                                        const char* whitelist_policy_name) {
+                                        const char* allowed_urls_pref_name) {
   DCHECK_CURRENTLY_ON(content::BrowserThread::UI);
 
-  // If the security origin policy matches a value in the whitelist, allow it.
-  // Otherwise, check the |policy_name| master switch for the default behavior.
+  // If the security origin policy matches a value in allowed urls list, allow
+  // it.  Otherwise, check the |policy_name| master switch for the default
+  // behavior.
 
   const PrefService* prefs = profile->GetPrefs();
 
-  const base::ListValue* list = prefs->GetList(whitelist_policy_name);
+  const base::ListValue* list = prefs->GetList(allowed_urls_pref_name);
   std::string value;
   for (size_t i = 0; i < list->GetSize(); ++i) {
     if (list->GetString(i, &value)) {
diff --git a/chrome/browser/media/webrtc/media_stream_device_permissions.h b/chrome/browser/media/webrtc/media_stream_device_permissions.h
index 5bfbb9e2..acd3f83 100644
--- a/chrome/browser/media/webrtc/media_stream_device_permissions.h
+++ b/chrome/browser/media/webrtc/media_stream_device_permissions.h
@@ -21,6 +21,6 @@
 MediaStreamDevicePolicy GetDevicePolicy(const Profile* profile,
                                         const GURL& security_origin,
                                         const char* policy_name,
-                                        const char* whitelist_policy_name);
+                                        const char* allowed_urls_pref_name);
 
 #endif  // CHROME_BROWSER_MEDIA_WEBRTC_MEDIA_STREAM_DEVICE_PERMISSIONS_H_
diff --git a/chrome/browser/native_file_system/chrome_native_file_system_permission_context.cc b/chrome/browser/native_file_system/chrome_native_file_system_permission_context.cc
index 1295e77..ae34a44 100644
--- a/chrome/browser/native_file_system/chrome_native_file_system_permission_context.cc
+++ b/chrome/browser/native_file_system/chrome_native_file_system_permission_context.cc
@@ -323,7 +323,7 @@
     const url::Origin& origin) {
   return content_settings()->GetContentSetting(
       origin.GetURL(), origin.GetURL(),
-      ContentSettingsType::NATIVE_FILE_SYSTEM_WRITE_GUARD,
+      ContentSettingsType::FILE_SYSTEM_WRITE_GUARD,
       /*provider_id=*/std::string());
 }
 
@@ -332,7 +332,7 @@
     const url::Origin& origin) {
   return content_settings()->GetContentSetting(
       origin.GetURL(), origin.GetURL(),
-      ContentSettingsType::NATIVE_FILE_SYSTEM_READ_GUARD,
+      ContentSettingsType::FILE_SYSTEM_READ_GUARD,
       /*provider_id=*/std::string());
 }
 
diff --git a/chrome/browser/native_file_system/chrome_native_file_system_permission_context_unittest.cc b/chrome/browser/native_file_system/chrome_native_file_system_permission_context_unittest.cc
index 55b48edc..4c57db47 100644
--- a/chrome/browser/native_file_system/chrome_native_file_system_permission_context_unittest.cc
+++ b/chrome/browser/native_file_system/chrome_native_file_system_permission_context_unittest.cc
@@ -327,16 +327,15 @@
 
 TEST_F(ChromeNativeFileSystemPermissionContextTest,
        CanObtainWritePermission_ContentSettingAsk) {
-  SetDefaultContentSettingValue(
-      ContentSettingsType::NATIVE_FILE_SYSTEM_WRITE_GUARD, CONTENT_SETTING_ASK);
+  SetDefaultContentSettingValue(ContentSettingsType::FILE_SYSTEM_WRITE_GUARD,
+                                CONTENT_SETTING_ASK);
   EXPECT_TRUE(permission_context()->CanObtainWritePermission(kTestOrigin));
 }
 
 TEST_F(ChromeNativeFileSystemPermissionContextTest,
        CanObtainWritePermission_ContentSettingsBlock) {
-  SetDefaultContentSettingValue(
-      ContentSettingsType::NATIVE_FILE_SYSTEM_WRITE_GUARD,
-      CONTENT_SETTING_BLOCK);
+  SetDefaultContentSettingValue(ContentSettingsType::FILE_SYSTEM_WRITE_GUARD,
+                                CONTENT_SETTING_BLOCK);
   EXPECT_FALSE(permission_context()->CanObtainWritePermission(kTestOrigin));
 }
 
diff --git a/chrome/browser/native_file_system/origin_scoped_native_file_system_permission_context_unittest.cc b/chrome/browser/native_file_system/origin_scoped_native_file_system_permission_context_unittest.cc
index 9e8fa83..825d4b1 100644
--- a/chrome/browser/native_file_system/origin_scoped_native_file_system_permission_context_unittest.cc
+++ b/chrome/browser/native_file_system/origin_scoped_native_file_system_permission_context_unittest.cc
@@ -169,9 +169,8 @@
   EXPECT_EQ(PermissionStatus::GRANTED, grant->GetStatus());
 
   // The existing grant should not change if the permission is blocked globally.
-  SetDefaultContentSettingValue(
-      ContentSettingsType::NATIVE_FILE_SYSTEM_WRITE_GUARD,
-      CONTENT_SETTING_BLOCK);
+  SetDefaultContentSettingValue(ContentSettingsType::FILE_SYSTEM_WRITE_GUARD,
+                                CONTENT_SETTING_BLOCK);
   EXPECT_EQ(PermissionStatus::GRANTED, grant->GetStatus());
 
   // Getting a grant for the same file again should also not change the grant,
@@ -211,18 +210,17 @@
 
 TEST_F(OriginScopedNativeFileSystemPermissionContextTest,
        GetWritePermissionGrant_InitialState_OpenAction_GlobalGuardBlocked) {
-  SetDefaultContentSettingValue(
-      ContentSettingsType::NATIVE_FILE_SYSTEM_WRITE_GUARD,
-      CONTENT_SETTING_BLOCK);
+  SetDefaultContentSettingValue(ContentSettingsType::FILE_SYSTEM_WRITE_GUARD,
+                                CONTENT_SETTING_BLOCK);
 
   auto grant = permission_context()->GetWritePermissionGrant(
       kTestOrigin, kTestPath, HandleType::kFile, UserAction::kOpen);
   EXPECT_EQ(PermissionStatus::DENIED, grant->GetStatus());
   grant.reset();
 
-  SetContentSettingValueForOrigin(
-      kTestOrigin, ContentSettingsType::NATIVE_FILE_SYSTEM_WRITE_GUARD,
-      CONTENT_SETTING_ASK);
+  SetContentSettingValueForOrigin(kTestOrigin,
+                                  ContentSettingsType::FILE_SYSTEM_WRITE_GUARD,
+                                  CONTENT_SETTING_ASK);
 
   grant = permission_context()->GetWritePermissionGrant(
       kTestOrigin, kTestPath, HandleType::kFile, UserAction::kOpen);
@@ -232,18 +230,17 @@
 TEST_F(
     OriginScopedNativeFileSystemPermissionContextTest,
     GetWritePermissionGrant_InitialState_WritableImplicitState_GlobalGuardBlocked) {
-  SetDefaultContentSettingValue(
-      ContentSettingsType::NATIVE_FILE_SYSTEM_WRITE_GUARD,
-      CONTENT_SETTING_BLOCK);
+  SetDefaultContentSettingValue(ContentSettingsType::FILE_SYSTEM_WRITE_GUARD,
+                                CONTENT_SETTING_BLOCK);
 
   auto grant = permission_context()->GetWritePermissionGrant(
       kTestOrigin, kTestPath, HandleType::kFile, UserAction::kSave);
   EXPECT_EQ(PermissionStatus::DENIED, grant->GetStatus());
   grant.reset();
 
-  SetContentSettingValueForOrigin(
-      kTestOrigin, ContentSettingsType::NATIVE_FILE_SYSTEM_WRITE_GUARD,
-      CONTENT_SETTING_ASK);
+  SetContentSettingValueForOrigin(kTestOrigin,
+                                  ContentSettingsType::FILE_SYSTEM_WRITE_GUARD,
+                                  CONTENT_SETTING_ASK);
 
   grant = permission_context()->GetWritePermissionGrant(
       kTestOrigin, kTestPath, HandleType::kFile, UserAction::kSave);
@@ -253,9 +250,9 @@
 TEST_F(
     OriginScopedNativeFileSystemPermissionContextTest,
     GetWritePermissionGrant_WriteGrantedChangesExistingGrant_GlobalGuardBlocked) {
-  SetContentSettingValueForOrigin(
-      kTestOrigin, ContentSettingsType::NATIVE_FILE_SYSTEM_WRITE_GUARD,
-      CONTENT_SETTING_BLOCK);
+  SetContentSettingValueForOrigin(kTestOrigin,
+                                  ContentSettingsType::FILE_SYSTEM_WRITE_GUARD,
+                                  CONTENT_SETTING_BLOCK);
 
   auto grant1 = permission_context()->GetWritePermissionGrant(
       kTestOrigin, kTestPath, HandleType::kFile, UserAction::kOpen);
@@ -272,9 +269,8 @@
 TEST_F(
     OriginScopedNativeFileSystemPermissionContextTest,
     GetWritePermissionGrant_GrantIsRevokedWhenNoLongerUsed_GlobalGuardBlockedBeforeNewGrant) {
-  SetDefaultContentSettingValue(
-      ContentSettingsType::NATIVE_FILE_SYSTEM_WRITE_GUARD,
-      CONTENT_SETTING_BLOCK);
+  SetDefaultContentSettingValue(ContentSettingsType::FILE_SYSTEM_WRITE_GUARD,
+                                CONTENT_SETTING_BLOCK);
 
   auto grant = permission_context()->GetWritePermissionGrant(
       kTestOrigin, kTestPath, HandleType::kFile, UserAction::kSave);
@@ -302,9 +298,8 @@
       kTestOrigin, kTestPath, HandleType::kFile, UserAction::kOpen);
   EXPECT_EQ(PermissionStatus::ASK, grant->GetStatus());
 
-  SetDefaultContentSettingValue(
-      ContentSettingsType::NATIVE_FILE_SYSTEM_WRITE_GUARD,
-      CONTENT_SETTING_BLOCK);
+  SetDefaultContentSettingValue(ContentSettingsType::FILE_SYSTEM_WRITE_GUARD,
+                                CONTENT_SETTING_BLOCK);
 
   // After the guard is blocked, the permission status for |grant| should remain
   // unchanged.
@@ -419,9 +414,8 @@
   // If the guard content setting is blocked, a call to RequestPermission()
   // should update the PermissionStatus to DENIED, call the passed-in
   // callback, and return immediately without showing a prompt.
-  SetDefaultContentSettingValue(
-      ContentSettingsType::NATIVE_FILE_SYSTEM_WRITE_GUARD,
-      CONTENT_SETTING_BLOCK);
+  SetDefaultContentSettingValue(ContentSettingsType::FILE_SYSTEM_WRITE_GUARD,
+                                CONTENT_SETTING_BLOCK);
 
   auto grant = permission_context()->GetWritePermissionGrant(
       kTestOrigin, kTestPath, HandleType::kFile, UserAction::kOpen);
@@ -450,9 +444,9 @@
   EXPECT_EQ(PermissionStatus::DENIED, grant2->GetStatus());
 
   grant2.reset();
-  SetContentSettingValueForOrigin(
-      kTestOrigin2, ContentSettingsType::NATIVE_FILE_SYSTEM_WRITE_GUARD,
-      CONTENT_SETTING_ASK);
+  SetContentSettingValueForOrigin(kTestOrigin2,
+                                  ContentSettingsType::FILE_SYSTEM_WRITE_GUARD,
+                                  CONTENT_SETTING_ASK);
 
   grant2 = permission_context()->GetWritePermissionGrant(
       kTestOrigin2, kTestPath, HandleType::kFile, UserAction::kOpen);
@@ -478,9 +472,8 @@
   auto grant2 = permission_context()->GetWritePermissionGrant(
       kTestOrigin2, kTestPath, HandleType::kFile, UserAction::kOpen);
 
-  SetDefaultContentSettingValue(
-      ContentSettingsType::NATIVE_FILE_SYSTEM_WRITE_GUARD,
-      CONTENT_SETTING_BLOCK);
+  SetDefaultContentSettingValue(ContentSettingsType::FILE_SYSTEM_WRITE_GUARD,
+                                CONTENT_SETTING_BLOCK);
 
   base::RunLoop loop;
   grant->RequestPermission(
@@ -505,9 +498,9 @@
   grant.reset();
   grant2.reset();
 
-  SetContentSettingValueForOrigin(
-      kTestOrigin, ContentSettingsType::NATIVE_FILE_SYSTEM_WRITE_GUARD,
-      CONTENT_SETTING_ASK);
+  SetContentSettingValueForOrigin(kTestOrigin,
+                                  ContentSettingsType::FILE_SYSTEM_WRITE_GUARD,
+                                  CONTENT_SETTING_ASK);
   grant = permission_context()->GetWritePermissionGrant(
       kTestOrigin, kTestPath, HandleType::kFile, UserAction::kOpen);
   grant2 = permission_context()->GetWritePermissionGrant(
@@ -536,15 +529,14 @@
 
 TEST_F(OriginScopedNativeFileSystemPermissionContextTest,
        GetWritePermissionGrant_AllowlistedOrigin_InitialState) {
-  SetDefaultContentSettingValue(
-      ContentSettingsType::NATIVE_FILE_SYSTEM_WRITE_GUARD,
-      CONTENT_SETTING_BLOCK);
+  SetDefaultContentSettingValue(ContentSettingsType::FILE_SYSTEM_WRITE_GUARD,
+                                CONTENT_SETTING_BLOCK);
 
   auto* allowlist = WebUIAllowlist::GetOrCreate(browser_context());
   allowlist->RegisterAutoGrantedPermission(
-      kChromeOrigin, ContentSettingsType::NATIVE_FILE_SYSTEM_READ_GUARD);
+      kChromeOrigin, ContentSettingsType::FILE_SYSTEM_READ_GUARD);
   allowlist->RegisterAutoGrantedPermission(
-      kChromeOrigin, ContentSettingsType::NATIVE_FILE_SYSTEM_WRITE_GUARD);
+      kChromeOrigin, ContentSettingsType::FILE_SYSTEM_WRITE_GUARD);
 
   // Allowlisted origin automatically gets write permission.
   auto grant1 = permission_context()->GetWritePermissionGrant(
@@ -566,15 +558,14 @@
 
 TEST_F(OriginScopedNativeFileSystemPermissionContextTest,
        GetWritePermissionGrant_AllowlistedOrigin_ExistingGrant) {
-  SetDefaultContentSettingValue(
-      ContentSettingsType::NATIVE_FILE_SYSTEM_WRITE_GUARD,
-      CONTENT_SETTING_BLOCK);
+  SetDefaultContentSettingValue(ContentSettingsType::FILE_SYSTEM_WRITE_GUARD,
+                                CONTENT_SETTING_BLOCK);
 
   auto* allowlist = WebUIAllowlist::GetOrCreate(browser_context());
   allowlist->RegisterAutoGrantedPermission(
-      kChromeOrigin, ContentSettingsType::NATIVE_FILE_SYSTEM_READ_GUARD);
+      kChromeOrigin, ContentSettingsType::FILE_SYSTEM_READ_GUARD);
   allowlist->RegisterAutoGrantedPermission(
-      kChromeOrigin, ContentSettingsType::NATIVE_FILE_SYSTEM_WRITE_GUARD);
+      kChromeOrigin, ContentSettingsType::FILE_SYSTEM_WRITE_GUARD);
 
   // Initial grant (file).
   auto grant1 = permission_context()->GetWritePermissionGrant(
diff --git a/chrome/browser/nearby_sharing/common/nearby_share_prefs.cc b/chrome/browser/nearby_sharing/common/nearby_share_prefs.cc
index d80f34aa..2b48e25 100644
--- a/chrome/browser/nearby_sharing/common/nearby_share_prefs.cc
+++ b/chrome/browser/nearby_sharing/common/nearby_share_prefs.cc
@@ -7,28 +7,34 @@
 #include <string>
 
 #include "base/files/file_path.h"
+#include "base/time/time.h"
 #include "chrome/browser/nearby_sharing/common/nearby_share_enums.h"
 #include "components/prefs/pref_registry.h"
 #include "components/prefs/pref_registry_simple.h"
 
-const char prefs::kNearbySharingEnabledPrefName[] = "nearby_sharing.enabled";
-const char prefs::kNearbySharingActiveProfilePrefName[] =
+namespace prefs {
+
+const char kNearbySharingActiveProfilePrefName[] =
     "nearby_sharing.active_profile";
-const char prefs::kNearbySharingBackgroundVisibilityName[] =
-    "nearby_sharing.background_visibility";
-const char prefs::kNearbySharingDataUsageName[] = "nearby_sharing.data_usage";
-const char prefs::kNearbySharingDeviceIdPrefName[] = "nearby_sharing.device_id";
-const char prefs::kNearbySharingDeviceNamePrefName[] =
-    "nearby_sharing.device_name";
-const char prefs::kNearbySharingAllowedContactsPrefName[] =
+const char kNearbySharingAllowedContactsPrefName[] =
     "nearby_sharing.allowed_contacts";
-const char prefs::kNearbySharingFullNamePrefName[] = "nearby_sharing.full_name";
-const char prefs::kNearbySharingIconUrlPrefName[] = "nearby_sharing.icon_url";
-const char prefs::kNearbySharingSchedulerDownloadDeviceDataPrefName[] =
+const char kNearbySharingBackgroundVisibilityName[] =
+    "nearby_sharing.background_visibility";
+const char kNearbySharingDataUsageName[] = "nearby_sharing.data_usage";
+const char kNearbySharingDeviceIdPrefName[] = "nearby_sharing.device_id";
+const char kNearbySharingDeviceNamePrefName[] = "nearby_sharing.device_name";
+const char kNearbySharingEnabledPrefName[] = "nearby_sharing.enabled";
+const char kNearbySharingFullNamePrefName[] = "nearby_sharing.full_name";
+const char kNearbySharingIconUrlPrefName[] = "nearby_sharing.icon_url";
+const char kNearbySharingOnboardingDismissedTimePrefName[] =
+    "nearby_sharing.onboarding_dismissed_time";
+const char kNearbySharingSchedulerDownloadDeviceDataPrefName[] =
     "nearby_sharing.scheduler.download_device_data";
-const char prefs::kNearbySharingSchedulerUploadDeviceNamePrefName[] =
+const char kNearbySharingSchedulerUploadDeviceNamePrefName[] =
     "nearby_sharing.scheduler.upload_device_name";
 
+}  // namespace prefs
+
 void RegisterNearbySharingPrefs(PrefRegistrySimple* registry) {
   // These prefs are not synced across devices on purpose.
 
@@ -55,6 +61,9 @@
       prefs::kNearbySharingSchedulerDownloadDeviceDataPrefName);
   registry->RegisterDictionaryPref(
       prefs::kNearbySharingSchedulerUploadDeviceNamePrefName);
+  registry->RegisterTimePref(
+      prefs::kNearbySharingOnboardingDismissedTimePrefName,
+      /*default_value=*/base::Time());
 }
 
 void RegisterNearbySharingLocalPrefs(PrefRegistrySimple* local_state) {
diff --git a/chrome/browser/nearby_sharing/common/nearby_share_prefs.h b/chrome/browser/nearby_sharing/common/nearby_share_prefs.h
index fd733e4..585e26c 100644
--- a/chrome/browser/nearby_sharing/common/nearby_share_prefs.h
+++ b/chrome/browser/nearby_sharing/common/nearby_share_prefs.h
@@ -5,21 +5,23 @@
 #ifndef CHROME_BROWSER_NEARBY_SHARING_COMMON_NEARBY_SHARE_PREFS_H_
 #define CHROME_BROWSER_NEARBY_SHARING_COMMON_NEARBY_SHARE_PREFS_H_
 
-
 class PrefRegistrySimple;
 
 namespace prefs {
-extern const char kNearbySharingEnabledPrefName[];
+
 extern const char kNearbySharingActiveProfilePrefName[];
+extern const char kNearbySharingAllowedContactsPrefName[];
 extern const char kNearbySharingBackgroundVisibilityName[];
 extern const char kNearbySharingDataUsageName[];
 extern const char kNearbySharingDeviceIdPrefName[];
 extern const char kNearbySharingDeviceNamePrefName[];
-extern const char kNearbySharingAllowedContactsPrefName[];
+extern const char kNearbySharingEnabledPrefName[];
 extern const char kNearbySharingFullNamePrefName[];
 extern const char kNearbySharingIconUrlPrefName[];
+extern const char kNearbySharingOnboardingDismissedTimePrefName[];
 extern const char kNearbySharingSchedulerDownloadDeviceDataPrefName[];
 extern const char kNearbySharingSchedulerUploadDeviceNamePrefName[];
+
 }  // namespace prefs
 
 void RegisterNearbySharingPrefs(PrefRegistrySimple* registry);
diff --git a/chrome/browser/nearby_sharing/mock_nearby_sharing_service.h b/chrome/browser/nearby_sharing/mock_nearby_sharing_service.h
index fca3c8e..7425b305 100644
--- a/chrome/browser/nearby_sharing/mock_nearby_sharing_service.h
+++ b/chrome/browser/nearby_sharing/mock_nearby_sharing_service.h
@@ -6,11 +6,9 @@
 #define CHROME_BROWSER_NEARBY_SHARING_MOCK_NEARBY_SHARING_SERVICE_H_
 
 #include "chrome/browser/nearby_sharing/nearby_sharing_service.h"
-#include "components/keyed_service/core/keyed_service.h"
 #include "testing/gmock/include/gmock/gmock.h"
 
-class MockNearbySharingService : public NearbySharingService,
-                                 public KeyedService {
+class MockNearbySharingService : public NearbySharingService {
  public:
   MockNearbySharingService();
   ~MockNearbySharingService() override;
diff --git a/chrome/browser/nearby_sharing/nearby_notification_manager.cc b/chrome/browser/nearby_sharing/nearby_notification_manager.cc
index f710d93..ab8939ec 100644
--- a/chrome/browser/nearby_sharing/nearby_notification_manager.cc
+++ b/chrome/browser/nearby_sharing/nearby_notification_manager.cc
@@ -6,12 +6,16 @@
 
 #include "base/notreached.h"
 #include "base/strings/strcat.h"
+#include "base/strings/string16.h"
 #include "base/strings/utf_string_conversions.h"
 #include "build/build_config.h"
 #include "chrome/app/vector_icons/vector_icons.h"
+#include "chrome/browser/nearby_sharing/common/nearby_share_prefs.h"
+#include "chrome/browser/nearby_sharing/logging/logging.h"
 #include "chrome/browser/nearby_sharing/nearby_sharing_service.h"
 #include "chrome/browser/notifications/notification_display_service.h"
 #include "chrome/grit/generated_resources.h"
+#include "components/prefs/pref_service.h"
 #include "content/public/browser/browser_thread.h"
 #include "ui/base/l10n/l10n_util.h"
 #include "ui/message_center/public/cpp/notification.h"
@@ -242,15 +246,64 @@
   bool has_accept_button_;
 };
 
+class OnboardingNotificationDelegate : public NearbyNotificationDelegate {
+ public:
+  explicit OnboardingNotificationDelegate(NearbyNotificationManager* manager)
+      : manager_(manager) {}
+  ~OnboardingNotificationDelegate() override = default;
+
+  // NearbyNotificationDelegate:
+  void OnClick(const std::string& notification_id,
+               const base::Optional<int>& action_index) override {
+    manager_->OnOnboardingClicked();
+  }
+
+  void OnClose(const std::string& notification_id) override {
+    manager_->OnOnboardingDismissed();
+  }
+
+ private:
+  NearbyNotificationManager* manager_;
+};
+
+bool ShouldShowOnboardingNotification(PrefService* pref_service) {
+  base::Time last_dismissed = pref_service->GetTime(
+      prefs::kNearbySharingOnboardingDismissedTimePrefName);
+  if (last_dismissed.is_null())
+    return true;
+
+  base::TimeDelta last_dismissed_delta = base::Time::Now() - last_dismissed;
+  if (last_dismissed_delta <
+      NearbyNotificationManager::kOnboardingDismissedTimeout) {
+    NS_LOG(VERBOSE) << "Not showing onboarding notification: the user recently "
+                       "dismissed the notification.";
+    return false;
+  }
+
+  return true;
+}
+
+void UpdateOnboardingDismissedTime(PrefService* pref_service) {
+  pref_service->SetTime(prefs::kNearbySharingOnboardingDismissedTimePrefName,
+                        base::Time::Now());
+}
+
 }  // namespace
 
+// static
+constexpr base::TimeDelta
+    NearbyNotificationManager::kOnboardingDismissedTimeout;
+
 NearbyNotificationManager::NearbyNotificationManager(
     NotificationDisplayService* notification_display_service,
-    NearbySharingService* nearby_service)
+    NearbySharingService* nearby_service,
+    PrefService* pref_service)
     : notification_display_service_(notification_display_service),
-      nearby_service_(nearby_service) {
+      nearby_service_(nearby_service),
+      pref_service_(pref_service) {
   DCHECK(notification_display_service_);
   DCHECK(nearby_service_);
+  DCHECK(pref_service_);
   nearby_service_->RegisterReceiveSurface(
       this, NearbySharingService::ReceiveSurfaceState::kBackground);
   nearby_service_->RegisterSendSurface(
@@ -380,6 +433,8 @@
 
 void NearbyNotificationManager::ShowOnboarding() {
   DCHECK_CURRENTLY_ON(content::BrowserThread::UI);
+  if (!ShouldShowOnboardingNotification(pref_service_))
+    return;
 
   message_center::Notification notification =
       CreateNearbyNotification(kNearbyOnboardingNotificationId);
@@ -388,6 +443,9 @@
   notification.set_message(
       l10n_util::GetStringUTF16(IDS_NEARBY_NOTIFICATION_ONBOARDING_MESSAGE));
 
+  delegate_map_[kNearbyOnboardingNotificationId] =
+      std::make_unique<OnboardingNotificationDelegate>(this);
+
   notification_display_service_->Display(
       NotificationHandler::Type::NEARBY_SHARE, notification,
       /*metadata=*/nullptr);
@@ -428,6 +486,12 @@
                                        kNearbyNotificationId);
 }
 
+void NearbyNotificationManager::CloseOnboarding() {
+  delegate_map_.erase(kNearbyOnboardingNotificationId);
+  notification_display_service_->Close(NotificationHandler::Type::NEARBY_SHARE,
+                                       kNearbyOnboardingNotificationId);
+}
+
 NearbyNotificationDelegate* NearbyNotificationManager::GetNotificationDelegate(
     const std::string& notification_id) {
   auto iter = delegate_map_.find(notification_id);
@@ -451,3 +515,14 @@
   // Do not close the notification as it will be replaced soon.
   nearby_service_->Accept(*share_target_, base::DoNothing());
 }
+
+void NearbyNotificationManager::OnOnboardingClicked() {
+  CloseOnboarding();
+  // TODO(crbug.com/1102348): Start user onboarding or high visibility if user
+  // has been onboarded already.
+}
+
+void NearbyNotificationManager::OnOnboardingDismissed() {
+  CloseOnboarding();
+  UpdateOnboardingDismissedTime(pref_service_);
+}
diff --git a/chrome/browser/nearby_sharing/nearby_notification_manager.h b/chrome/browser/nearby_sharing/nearby_notification_manager.h
index 62f6605..72fa20e6 100644
--- a/chrome/browser/nearby_sharing/nearby_notification_manager.h
+++ b/chrome/browser/nearby_sharing/nearby_notification_manager.h
@@ -7,7 +7,6 @@
 
 #include "base/containers/flat_map.h"
 #include "base/optional.h"
-#include "base/strings/string16.h"
 #include "base/time/time.h"
 #include "chrome/browser/nearby_sharing/nearby_notification_delegate.h"
 #include "chrome/browser/nearby_sharing/share_target.h"
@@ -17,6 +16,7 @@
 
 class NearbySharingService;
 class NotificationDisplayService;
+class PrefService;
 
 // Manages notifications shown for Nearby Share. Only a single notification will
 // be shown as simultaneous connections are not supported. All methods should be
@@ -24,9 +24,13 @@
 class NearbyNotificationManager : public TransferUpdateCallback,
                                   public ShareTargetDiscoveredCallback {
  public:
+  static constexpr base::TimeDelta kOnboardingDismissedTimeout =
+      base::TimeDelta::FromMinutes(15);
+
   NearbyNotificationManager(
       NotificationDisplayService* notification_display_service,
-      NearbySharingService* nearby_service);
+      NearbySharingService* nearby_service,
+      PrefService* pref_service);
   ~NearbyNotificationManager() override;
 
   // TransferUpdateCallback:
@@ -63,6 +67,9 @@
   // connection).
   void CloseTransfer();
 
+  // Closes any currently shown onboarding notification.
+  void CloseOnboarding();
+
   // Gets the currently registered delegate for |notification_id|.
   NearbyNotificationDelegate* GetNotificationDelegate(
       const std::string& notification_id);
@@ -76,9 +83,17 @@
   // Accepts the currently in progress transfer.
   void AcceptTransfer();
 
+  // Called when the onboarding notification got clicked.
+  void OnOnboardingClicked();
+
+  // Called when the onboarding notification got dismissed. We won't show
+  // another one for a certain time period after this.
+  void OnOnboardingDismissed();
+
  private:
   NotificationDisplayService* notification_display_service_;
   NearbySharingService* nearby_service_;
+  PrefService* pref_service_;
 
   // Maps notification ids to notification delegates.
   base::flat_map<std::string, std::unique_ptr<NearbyNotificationDelegate>>
diff --git a/chrome/browser/nearby_sharing/nearby_notification_manager_unittest.cc b/chrome/browser/nearby_sharing/nearby_notification_manager_unittest.cc
index 82b23b2e..e8b07ee 100644
--- a/chrome/browser/nearby_sharing/nearby_notification_manager_unittest.cc
+++ b/chrome/browser/nearby_sharing/nearby_notification_manager_unittest.cc
@@ -10,8 +10,10 @@
 #include "base/strings/strcat.h"
 #include "base/strings/utf_string_conversions.h"
 #include "base/test/scoped_feature_list.h"
+#include "base/test/task_environment.h"
 #include "chrome/app/vector_icons/vector_icons.h"
 #include "chrome/browser/browser_features.h"
+#include "chrome/browser/nearby_sharing/common/nearby_share_prefs.h"
 #include "chrome/browser/nearby_sharing/mock_nearby_sharing_service.h"
 #include "chrome/browser/nearby_sharing/nearby_sharing_service_factory.h"
 #include "chrome/browser/nearby_sharing/share_target.h"
@@ -21,6 +23,7 @@
 #include "chrome/browser/notifications/notification_display_service_tester.h"
 #include "chrome/grit/generated_resources.h"
 #include "chrome/test/base/testing_profile.h"
+#include "components/prefs/testing_pref_service.h"
 #include "content/public/test/browser_task_environment.h"
 #include "testing/gmock/include/gmock/gmock.h"
 #include "testing/gtest/include/gtest/gtest.h"
@@ -61,6 +64,7 @@
  public:
   NearbyNotificationManagerTest() {
     scoped_feature_list_.InitAndEnableFeature(features::kNearbySharing);
+    RegisterNearbySharingPrefs(pref_service_.registry());
     notification_tester_ =
         std::make_unique<NotificationDisplayServiceTester>(&profile_);
     nearby_service_ = CreateAndUseMockNearbySharingService(&profile_);
@@ -84,12 +88,14 @@
     NotificationDisplayService* notification_display_service =
         NotificationDisplayServiceFactory::GetForProfile(&profile_);
     return std::make_unique<NearbyNotificationManager>(
-        notification_display_service, nearby_service_);
+        notification_display_service, nearby_service_, &pref_service_);
   }
 
  protected:
   base::test::ScopedFeatureList scoped_feature_list_;
-  content::BrowserTaskEnvironment task_environment_;
+  content::BrowserTaskEnvironment task_environment_{
+      base::test::TaskEnvironment::TimeSource::MOCK_TIME};
+  TestingPrefServiceSimple pref_service_;
   TestingProfile profile_;
   std::unique_ptr<NotificationDisplayServiceTester> notification_tester_;
   MockNearbySharingService* nearby_service_;
@@ -734,3 +740,41 @@
   // Notification should be closed.
   EXPECT_EQ(0u, GetDisplayedNotifications().size());
 }
+
+TEST_F(NearbyNotificationManagerTest, Onboarding_Click) {
+  manager()->ShowOnboarding();
+  std::vector<message_center::Notification> notifications =
+      GetDisplayedNotifications();
+  ASSERT_EQ(1u, notifications.size());
+
+  notification_tester_->SimulateClick(NotificationHandler::Type::NEARBY_SHARE,
+                                      notifications[0].id(),
+                                      /*action_index=*/base::nullopt,
+                                      /*reply=*/base::nullopt);
+
+  // Notification should be closed.
+  EXPECT_EQ(0u, GetDisplayedNotifications().size());
+}
+
+TEST_F(NearbyNotificationManagerTest, Onboarding_DismissTimeout) {
+  // First notification should be shown by default.
+  manager()->ShowOnboarding();
+  std::vector<message_center::Notification> notifications =
+      GetDisplayedNotifications();
+  ASSERT_EQ(1u, notifications.size());
+
+  notification_tester_->RemoveNotification(
+      NotificationHandler::Type::NEARBY_SHARE, notifications[0].id(),
+      /*by_user=*/true);
+  EXPECT_EQ(0u, GetDisplayedNotifications().size());
+
+  // Second notification should be blocked if shown before the timeout passed.
+  manager()->ShowOnboarding();
+  EXPECT_EQ(0u, GetDisplayedNotifications().size());
+
+  // Fast forward by the timeout until we can show the notification again.
+  task_environment_.FastForwardBy(
+      NearbyNotificationManager::kOnboardingDismissedTimeout);
+  manager()->ShowOnboarding();
+  EXPECT_EQ(1u, GetDisplayedNotifications().size());
+}
diff --git a/chrome/browser/nearby_sharing/nearby_sharing_service.h b/chrome/browser/nearby_sharing/nearby_sharing_service.h
index 97abce2..86624d9 100644
--- a/chrome/browser/nearby_sharing/nearby_sharing_service.h
+++ b/chrome/browser/nearby_sharing/nearby_sharing_service.h
@@ -13,6 +13,7 @@
 #include "chrome/browser/nearby_sharing/nearby_share_settings.h"
 #include "chrome/browser/nearby_sharing/share_target_discovered_callback.h"
 #include "chrome/browser/nearby_sharing/transfer_update_callback.h"
+#include "components/keyed_service/core/keyed_service.h"
 
 class NearbyNotificationDelegate;
 class NearbyShareContactManager;
@@ -23,7 +24,7 @@
 // This service implements Nearby Sharing on top of the Nearby Connections mojo.
 // Currently only single profile will be allowed to be bound at a time and only
 // after the user has enabled Nearby Sharing in prefs.
-class NearbySharingService {
+class NearbySharingService : public KeyedService {
  public:
   enum class StatusCodes {
     // The operation was successful.
@@ -53,7 +54,7 @@
   using StatusCodesCallback =
       base::OnceCallback<void(StatusCodes status_codes)>;
 
-  virtual ~NearbySharingService() = default;
+  ~NearbySharingService() override = default;
 
   // Registers a send surface for handling payload transfer status and device
   // discovery.
diff --git a/chrome/browser/nearby_sharing/nearby_sharing_service_factory.cc b/chrome/browser/nearby_sharing/nearby_sharing_service_factory.cc
index 706d6e7..738265e 100644
--- a/chrome/browser/nearby_sharing/nearby_sharing_service_factory.cc
+++ b/chrome/browser/nearby_sharing/nearby_sharing_service_factory.cc
@@ -39,7 +39,7 @@
 // static
 NearbySharingService* NearbySharingServiceFactory::GetForBrowserContext(
     content::BrowserContext* context) {
-  return static_cast<NearbySharingServiceImpl*>(
+  return static_cast<NearbySharingService*>(
       GetInstance()->GetServiceForBrowserContext(context, true /* create */));
 }
 
diff --git a/chrome/browser/nearby_sharing/nearby_sharing_service_impl.cc b/chrome/browser/nearby_sharing/nearby_sharing_service_impl.cc
index 0d1da024..db53e85 100644
--- a/chrome/browser/nearby_sharing/nearby_sharing_service_impl.cc
+++ b/chrome/browser/nearby_sharing/nearby_sharing_service_impl.cc
@@ -161,7 +161,7 @@
   GetBluetoothAdapter();
 
   nearby_notification_manager_ = std::make_unique<NearbyNotificationManager>(
-      notification_display_service, this);
+      notification_display_service, this, prefs);
 }
 
 NearbySharingServiceImpl::~NearbySharingServiceImpl() {
diff --git a/chrome/browser/nearby_sharing/nearby_sharing_service_impl.h b/chrome/browser/nearby_sharing/nearby_sharing_service_impl.h
index 858865c..f6d42740 100644
--- a/chrome/browser/nearby_sharing/nearby_sharing_service_impl.h
+++ b/chrome/browser/nearby_sharing/nearby_sharing_service_impl.h
@@ -34,7 +34,6 @@
 #include "chrome/browser/ui/webui/nearby_share/public/mojom/nearby_share_settings.mojom.h"
 #include "chrome/services/sharing/public/mojom/nearby_decoder_types.mojom.h"
 #include "chrome/services/sharing/public/proto/wire_format.pb.h"
-#include "components/keyed_service/core/keyed_service.h"
 #include "components/prefs/pref_change_registrar.h"
 
 class FastInitiationManager;
@@ -50,7 +49,6 @@
 // All methods should be called from the same sequence that created the service.
 class NearbySharingServiceImpl
     : public NearbySharingService,
-      public KeyedService,
       public nearby_share::mojom::NearbyShareSettingsObserver,
       public NearbyProcessManager::Observer,
       public device::BluetoothAdapter::Observer,
diff --git a/chrome/browser/notifications/platform_notification_service_unittest.cc b/chrome/browser/notifications/platform_notification_service_unittest.cc
index 8b54734..35a059a 100644
--- a/chrome/browser/notifications/platform_notification_service_unittest.cc
+++ b/chrome/browser/notifications/platform_notification_service_unittest.cc
@@ -250,8 +250,7 @@
 
 TEST_F(PlatformNotificationServiceTest, RecordNotificationUkmEvent) {
   // Set up UKM recording conditions.
-  ASSERT_TRUE(profile_.CreateHistoryService(/* delete_file= */ true,
-                                            /* no_db= */ false));
+  ASSERT_TRUE(profile_.CreateHistoryService());
   auto* history_service = HistoryServiceFactory::GetForProfile(
       &profile_, ServiceAccessType::EXPLICIT_ACCESS);
   history_service->AddPage(Origin(), base::Time::Now(),
diff --git a/chrome/browser/password_check/android/java/src/org/chromium/chrome/browser/password_check/PasswordCheckFragmentView.java b/chrome/browser/password_check/android/java/src/org/chromium/chrome/browser/password_check/PasswordCheckFragmentView.java
index 4c5489b..249aa57 100644
--- a/chrome/browser/password_check/android/java/src/org/chromium/chrome/browser/password_check/PasswordCheckFragmentView.java
+++ b/chrome/browser/password_check/android/java/src/org/chromium/chrome/browser/password_check/PasswordCheckFragmentView.java
@@ -34,12 +34,19 @@
     public void onCreatePreferences(Bundle savedInstanceState, String rootKey) {
         getActivity().setTitle(R.string.passwords_check_title);
         setPreferenceScreen(getPreferenceManager().createPreferenceScreen(getStyledContext()));
+        mPasswordCheckReferrer = getReferrerFromInstanceStateOrLaunchBundle(savedInstanceState);
+    }
+
+    private @PasswordCheckReferrer int getReferrerFromInstanceStateOrLaunchBundle(
+            Bundle savedInstanceState) {
+        if (savedInstanceState != null && savedInstanceState.containsKey(PASSWORD_CHECK_REFERRER)) {
+            return savedInstanceState.getInt(PASSWORD_CHECK_REFERRER);
+        }
         Bundle extras = getArguments();
         assert extras.containsKey(PASSWORD_CHECK_REFERRER)
-            : "PasswordCheckFragmentView"
-                + "must be launched with a password-check-referrer fragment argument, but none was"
-                + "provided.";
-        mPasswordCheckReferrer = extras.getInt(PASSWORD_CHECK_REFERRER);
+            : "PasswordCheckFragmentView must be launched with a password-check-referrer fragment "
+                + "argument, but none was provided.";
+        return extras.getInt(PASSWORD_CHECK_REFERRER);
     }
 
     @Override
@@ -53,6 +60,11 @@
             mComponentDelegate.destroy();
         }
     }
+    @Override
+    public void onSaveInstanceState(Bundle outState) {
+        super.onSaveInstanceState(outState);
+        outState.putInt(PASSWORD_CHECK_REFERRER, mPasswordCheckReferrer);
+    }
 
     @Override
     public boolean onOptionsItemSelected(MenuItem item) {
diff --git a/chrome/browser/predictors/autocomplete_action_predictor_unittest.cc b/chrome/browser/predictors/autocomplete_action_predictor_unittest.cc
index 482449c..48bddee70 100644
--- a/chrome/browser/predictors/autocomplete_action_predictor_unittest.cc
+++ b/chrome/browser/predictors/autocomplete_action_predictor_unittest.cc
@@ -127,7 +127,7 @@
  public:
   AutocompleteActionPredictorTest()
       : profile_(std::make_unique<TestingProfile>()), predictor_(nullptr) {
-    CHECK(profile_->CreateHistoryService(true, false));
+    CHECK(profile_->CreateHistoryService());
     predictor_ = std::make_unique<AutocompleteActionPredictor>(profile_.get());
     predictor_->CreateLocalCachesFromDatabase();
     profile_->BlockUntilHistoryProcessesPendingRequests();
diff --git a/chrome/browser/predictors/resource_prefetch_predictor_unittest.cc b/chrome/browser/predictors/resource_prefetch_predictor_unittest.cc
index 1c74254..c194c3f8 100644
--- a/chrome/browser/predictors/resource_prefetch_predictor_unittest.cc
+++ b/chrome/browser/predictors/resource_prefetch_predictor_unittest.cc
@@ -163,7 +163,7 @@
 void ResourcePrefetchPredictorTest::SetUp() {
   InitializeSampleData();
 
-  CHECK(profile_->CreateHistoryService(true, false));
+  CHECK(profile_->CreateHistoryService());
   profile_->BlockUntilHistoryProcessesPendingRequests();
   CHECK(HistoryServiceFactory::GetForProfile(
       profile_.get(), ServiceAccessType::EXPLICIT_ACCESS));
diff --git a/chrome/browser/prerender/chrome_prerender_processor_impl_delegate.cc b/chrome/browser/prerender/chrome_prerender_processor_impl_delegate.cc
new file mode 100644
index 0000000..40579b1
--- /dev/null
+++ b/chrome/browser/prerender/chrome_prerender_processor_impl_delegate.cc
@@ -0,0 +1,19 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "chrome/browser/prerender/chrome_prerender_processor_impl_delegate.h"
+
+#include "chrome/browser/prerender/prerender_link_manager.h"
+#include "chrome/browser/prerender/prerender_link_manager_factory.h"
+#include "content/public/browser/browser_context.h"
+
+namespace prerender {
+
+PrerenderLinkManager*
+ChromePrerenderProcessorImplDelegate::GetPrerenderLinkManager(
+    content::BrowserContext* browser_context) {
+  return PrerenderLinkManagerFactory::GetForBrowserContext(browser_context);
+}
+
+}  // namespace prerender
diff --git a/chrome/browser/prerender/chrome_prerender_processor_impl_delegate.h b/chrome/browser/prerender/chrome_prerender_processor_impl_delegate.h
new file mode 100644
index 0000000..10274c37
--- /dev/null
+++ b/chrome/browser/prerender/chrome_prerender_processor_impl_delegate.h
@@ -0,0 +1,31 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CHROME_BROWSER_PRERENDER_CHROME_PRERENDER_PROCESSOR_IMPL_DELEGATE_H_
+#define CHROME_BROWSER_PRERENDER_CHROME_PRERENDER_PROCESSOR_IMPL_DELEGATE_H_
+
+#include "chrome/browser/prerender/prerender_processor_impl_delegate.h"
+
+namespace content {
+class BrowserContext;
+}
+
+namespace prerender {
+
+class PrerenderLinkManager;
+
+class ChromePrerenderProcessorImplDelegate
+    : public PrerenderProcessorImplDelegate {
+ public:
+  ChromePrerenderProcessorImplDelegate() = default;
+  ~ChromePrerenderProcessorImplDelegate() override = default;
+
+  // PrerenderProcessorImplDelegate overrides,
+  PrerenderLinkManager* GetPrerenderLinkManager(
+      content::BrowserContext* browser_context) override;
+};
+
+}  // namespace prerender
+
+#endif  // CHROME_BROWSER_PRERENDER_CHROME_PRERENDER_PROCESSOR_IMPL_DELEGATE_H_
diff --git a/chrome/browser/prerender/prerender_link_manager.cc b/chrome/browser/prerender/prerender_link_manager.cc
index 537a7971..9609a08 100644
--- a/chrome/browser/prerender/prerender_link_manager.cc
+++ b/chrome/browser/prerender/prerender_link_manager.cc
@@ -16,7 +16,6 @@
 #include "chrome/browser/prerender/prerender_contents.h"
 #include "chrome/browser/prerender/prerender_handle.h"
 #include "chrome/browser/prerender/prerender_manager.h"
-#include "chrome/browser/prerender/prerender_manager_factory.h"
 #include "content/public/browser/render_process_host.h"
 #include "content/public/browser/render_view_host.h"
 #include "content/public/browser/session_storage_namespace.h"
diff --git a/chrome/browser/prerender/prerender_processor_impl.cc b/chrome/browser/prerender/prerender_processor_impl.cc
index c2e596d..aadf906 100644
--- a/chrome/browser/prerender/prerender_processor_impl.cc
+++ b/chrome/browser/prerender/prerender_processor_impl.cc
@@ -5,8 +5,6 @@
 #include "chrome/browser/prerender/prerender_processor_impl.h"
 
 #include "chrome/browser/prerender/prerender_link_manager.h"
-#include "chrome/browser/prerender/prerender_link_manager_factory.h"
-#include "chrome/browser/profiles/profile.h"
 #include "content/public/browser/child_process_security_policy.h"
 #include "content/public/browser/render_frame_host.h"
 #include "content/public/browser/render_process_host.h"
@@ -16,20 +14,25 @@
 
 namespace prerender {
 
-PrerenderProcessorImpl::PrerenderProcessorImpl(int render_process_id,
-                                               int render_frame_id)
+PrerenderProcessorImpl::PrerenderProcessorImpl(
+    int render_process_id,
+    int render_frame_id,
+    std::unique_ptr<PrerenderProcessorImplDelegate> delegate)
     : render_process_id_(render_process_id),
-      render_frame_id_(render_frame_id) {}
+      render_frame_id_(render_frame_id),
+      delegate_(std::move(delegate)) {}
 
 PrerenderProcessorImpl::~PrerenderProcessorImpl() = default;
 
 // static
 void PrerenderProcessorImpl::Create(
     content::RenderFrameHost* frame_host,
-    mojo::PendingReceiver<blink::mojom::PrerenderProcessor> receiver) {
+    mojo::PendingReceiver<blink::mojom::PrerenderProcessor> receiver,
+    std::unique_ptr<PrerenderProcessorImplDelegate> delegate) {
   mojo::MakeSelfOwnedReceiver(
       std::make_unique<PrerenderProcessorImpl>(
-          frame_host->GetProcess()->GetID(), frame_host->GetRoutingID()),
+          frame_host->GetProcess()->GetID(), frame_host->GetRoutingID(),
+          std::move(delegate)),
       std::move(receiver));
 }
 
@@ -50,9 +53,8 @@
   if (!render_frame_host)
     return;
 
-  PrerenderLinkManager* link_manager =
-      PrerenderLinkManagerFactory::GetForBrowserContext(
-          render_frame_host->GetProcess()->GetBrowserContext());
+  PrerenderLinkManager* link_manager = delegate_->GetPrerenderLinkManager(
+      render_frame_host->GetProcess()->GetBrowserContext());
   if (!link_manager)
     return;
 
diff --git a/chrome/browser/prerender/prerender_processor_impl.h b/chrome/browser/prerender/prerender_processor_impl.h
index 8df9fd1f..b7e05fc 100644
--- a/chrome/browser/prerender/prerender_processor_impl.h
+++ b/chrome/browser/prerender/prerender_processor_impl.h
@@ -5,6 +5,7 @@
 #ifndef CHROME_BROWSER_PRERENDER_PRERENDER_PROCESSOR_IMPL_H_
 #define CHROME_BROWSER_PRERENDER_PRERENDER_PROCESSOR_IMPL_H_
 
+#include "chrome/browser/prerender/prerender_processor_impl_delegate.h"
 #include "third_party/blink/public/mojom/prerender/prerender.mojom.h"
 
 namespace content {
@@ -15,12 +16,16 @@
 
 class PrerenderProcessorImpl : public blink::mojom::PrerenderProcessor {
  public:
-  PrerenderProcessorImpl(int render_process_id, int render_frame_id);
+  PrerenderProcessorImpl(
+      int render_process_id,
+      int render_frame_id,
+      std::unique_ptr<PrerenderProcessorImplDelegate> delegate);
   ~PrerenderProcessorImpl() override;
 
   static void Create(
       content::RenderFrameHost* frame_host,
-      mojo::PendingReceiver<blink::mojom::PrerenderProcessor> receiver);
+      mojo::PendingReceiver<blink::mojom::PrerenderProcessor> receiver,
+      std::unique_ptr<PrerenderProcessorImplDelegate> delegate);
 
   // blink::mojom::PrerenderProcessor implementation
   void AddPrerender(
@@ -31,6 +36,7 @@
  private:
   int render_process_id_;
   int render_frame_id_;
+  std::unique_ptr<PrerenderProcessorImplDelegate> delegate_;
 };
 
 }  // namespace prerender
diff --git a/chrome/browser/prerender/prerender_processor_impl_delegate.h b/chrome/browser/prerender/prerender_processor_impl_delegate.h
new file mode 100644
index 0000000..601ca18
--- /dev/null
+++ b/chrome/browser/prerender/prerender_processor_impl_delegate.h
@@ -0,0 +1,27 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CHROME_BROWSER_PRERENDER_PRERENDER_PROCESSOR_IMPL_DELEGATE_H_
+#define CHROME_BROWSER_PRERENDER_PRERENDER_PROCESSOR_IMPL_DELEGATE_H_
+
+namespace content {
+class BrowserContext;
+}
+
+namespace prerender {
+
+class PrerenderLinkManager;
+
+class PrerenderProcessorImplDelegate {
+ public:
+  virtual ~PrerenderProcessorImplDelegate() = default;
+
+  // Gets the PrerenderLinkManager associated with |browser_context|.
+  virtual PrerenderLinkManager* GetPrerenderLinkManager(
+      content::BrowserContext* browser_context) = 0;
+};
+
+}  // namespace prerender
+
+#endif  // CHROME_BROWSER_PRERENDER_PRERENDER_PROCESSOR_IMPL_DELEGATE_H_
diff --git a/chrome/browser/profiles/profile_statistics_unittest.cc b/chrome/browser/profiles/profile_statistics_unittest.cc
index 08e4a4d..2c0095ff 100644
--- a/chrome/browser/profiles/profile_statistics_unittest.cc
+++ b/chrome/browser/profiles/profile_statistics_unittest.cc
@@ -99,7 +99,7 @@
   TestingProfile* profile = manager()->CreateTestingProfile("Test 1");
   ASSERT_TRUE(profile);
   // We need history, autofill and password services for the test to succeed.
-  ASSERT_TRUE(profile->CreateHistoryService(true, false));
+  ASSERT_TRUE(profile->CreateHistoryService());
   profile->CreateWebDataService();
   PasswordStoreFactory::GetInstance()->SetTestingFactory(
       profile,
diff --git a/chrome/browser/profiles/profiles_state.cc b/chrome/browser/profiles/profiles_state.cc
index b25fcdb..b338e9f 100644
--- a/chrome/browser/profiles/profiles_state.cc
+++ b/chrome/browser/profiles/profiles_state.cc
@@ -68,6 +68,8 @@
   registry->RegisterBooleanPref(prefs::kBrowserGuestModeEnforced, false);
   registry->RegisterBooleanPref(prefs::kBrowserAddPersonEnabled, true);
   registry->RegisterBooleanPref(prefs::kForceBrowserSignin, false);
+  registry->RegisterBooleanPref(prefs::kBrowserShowProfilePickerOnStartup,
+                                true);
 }
 
 void SetLastUsedProfile(const std::string& profile_dir) {
diff --git a/chrome/browser/reputation/reputation_web_contents_observer.cc b/chrome/browser/reputation/reputation_web_contents_observer.cc
index cabe5ae..962d7687 100644
--- a/chrome/browser/reputation/reputation_web_contents_observer.cc
+++ b/chrome/browser/reputation/reputation_web_contents_observer.cc
@@ -24,7 +24,7 @@
 
 // Whether to show tips on server-side-flagged sites included in the component.
 const base::FeatureParam<bool> kEnableSuspiciousSiteChecks{
-    &security_state::features::kSafetyTipUI, "suspicioussites", false};
+    &security_state::features::kSafetyTipUI, "suspicioussites", true};
 
 void RecordHeuristicsUKMData(ReputationCheckResult result,
                              ukm::SourceId navigation_source_id,
diff --git a/chrome/browser/resources/settings/autofill_page/password_edit_dialog.html b/chrome/browser/resources/settings/autofill_page/password_edit_dialog.html
index 03829cb..bc68978 100644
--- a/chrome/browser/resources/settings/autofill_page/password_edit_dialog.html
+++ b/chrome/browser/resources/settings/autofill_page/password_edit_dialog.html
@@ -7,28 +7,15 @@
         margin-bottom: var(--cr-form-field-bottom-spacing);
       }
 
-      #websiteInput,
-      #usernameInput {
-        width: var(--settings-input-max-width);
-      }
-
-      #passwordInput {
-        --cr-input-width: var(--settings-input-max-width);
-      }
-
-      #passwordInput::part(row-container) {
-        justify-content: initial;
-      }
-
-      #storageDetails {
-        margin-bottom: 16px;
-        margin-inline-start: 2px;
-      }
-
       cr-icon-button {
-        --cr-icon-button-icon-size: 24px;
+        --cr-icon-button-icon-size: 16px;
         margin-inline-start: 2px;
       }
+
+      #footnote {
+        margin-inline-start: 2px;
+        margin-top: 16px;
+      }
     </style>
     <cr-dialog id="dialog" close-text="$i18n{close}">
       <div slot="title" id="title">[[getTitle_(isEditDialog_)]]</div>
diff --git a/chrome/browser/resources/settings/autofill_page/passwords_list_handler.js b/chrome/browser/resources/settings/autofill_page/passwords_list_handler.js
index 04598bb..244cf36 100644
--- a/chrome/browser/resources/settings/autofill_page/passwords_list_handler.js
+++ b/chrome/browser/resources/settings/autofill_page/passwords_list_handler.js
@@ -171,14 +171,39 @@
   },
 
   /**
-   * @param {!Event} e
+   * Requests the plaintext password for the current active password.
+   * @param {!chrome.passwordsPrivate.PlaintextReason} reason The reason why the
+   *     plaintext password is requested.
+   * @param {function(string): void} callback The callback that gets invoked
+   *     with the retrieved password.
    * @private
    */
-  onMenuEditPasswordTap_(e) {
-    // TODO(crbug.com/377410): Add authentication if isEditDialog_ is true.
-    e.preventDefault();
+  requestActivePlaintextPassword_(reason, callback) {
+    PasswordManagerImpl.getInstance()
+        .requestPlaintextPassword(this.activePassword.entry.getAnyId(), reason)
+        .then(callback, error => {
+          // <if expr="chromeos">
+          // If no password was found, refresh auth token and retry.
+          this.tokenRequestManager.request(() => {
+            this.requestActivePlaintextPassword_(reason, callback);
+          });
+          // </if>
+        });
+  },
+
+  /** @private */
+  onMenuEditPasswordTap_() {
+    if (this.isEditDialog_) {
+      // TODO(crbug.com/377410): Set plaintext password after we stop using
+      // ShowPasswordBehavior in password_list_item and password_edit_dialog.
+      this.requestActivePlaintextPassword_(
+          chrome.passwordsPrivate.PlaintextReason.EDIT, _ => {
+            this.showPasswordEditDialog_ = true;
+          });
+    } else {
+      this.showPasswordEditDialog_ = true;
+    }
     this.$.menu.close();
-    this.showPasswordEditDialog_ = true;
     this.activePassword.hide();
   },
 
@@ -215,20 +240,11 @@
   onMenuCopyPasswordButtonTap_() {
     // Copy to clipboard occurs inside C++ and we don't expect getting
     // result back to javascript.
-    PasswordManagerImpl.getInstance()
-        .requestPlaintextPassword(
-            this.activePassword.entry.getAnyId(),
-            chrome.passwordsPrivate.PlaintextReason.COPY)
-        .then(_ => {
+    this.requestActivePlaintextPassword_(
+        chrome.passwordsPrivate.PlaintextReason.COPY, _ => {
           this.activePassword = null;
-        })
-        .catch(error => {
-          // <if expr="chromeos">
-          // If no password was found, refresh auth token and retry.
-          this.tokenRequestManager.request(
-              this.onMenuCopyPasswordButtonTap_.bind(this));
-          // </if>});
         });
+
     this.$.menu.close();
   },
 
@@ -299,11 +315,9 @@
 
   /**
    * Should only be called when |activePassword| has a device copy.
-   * @param {!Event} event
    * @private
    */
-  onMenuMovePasswordToAccountTap_(event) {
-    event.preventDefault();
+  onMenuMovePasswordToAccountTap_() {
     this.$.menu.close();
     this.showPasswordMoveToAccountDialog_ = true;
   },
diff --git a/chrome/browser/resources/settings/privacy_page/privacy_page.html b/chrome/browser/resources/settings/privacy_page/privacy_page.html
index e4e88415..025a931 100644
--- a/chrome/browser/resources/settings/privacy_page/privacy_page.html
+++ b/chrome/browser/resources/settings/privacy_page/privacy_page.html
@@ -468,18 +468,18 @@
           </settings-subpage>
         </template>
       </template>
-      <template is="dom-if" if="[[enableNativeFileSystemWriteContentSetting_]]">
+      <template is="dom-if" if="[[enableFileSystemWriteContentSetting_]]">
         <template is="dom-if" route-path="/content/filesystem" no-search>
           <settings-subpage
-              page-title="$i18n{siteSettingsNativeFileSystemWrite}">
+              page-title="$i18n{siteSettingsFileSystemWrite}">
             <category-default-setting
-                toggle-off-label="$i18n{siteSettingsNativeFileSystemWriteBlock}"
+                toggle-off-label="$i18n{siteSettingsFileSystemWriteBlock}"
                 toggle-on-label=
-                    "$i18n{siteSettingsNativeFileSystemWriteAskRecommended}"
-                category="{{ContentSettingsTypes.NATIVE_FILE_SYSTEM_WRITE}}">
+                    "$i18n{siteSettingsFileSystemWriteAskRecommended}"
+                category="{{ContentSettingsTypes.FILE_SYSTEM_WRITE}}">
             </category-default-setting>
             <category-setting-exceptions
-                category="{{ContentSettingsTypes.NATIVE_FILE_SYSTEM_WRITE}}"
+                category="{{ContentSettingsTypes.FILE_SYSTEM_WRITE}}"
                 read-only-list
                 block-header="$i18n{siteSettingsBlock}"
                 search-filter="[[searchFilter_]]">
diff --git a/chrome/browser/resources/settings/privacy_page/privacy_page.js b/chrome/browser/resources/settings/privacy_page/privacy_page.js
index 7f587b3f..7193322 100644
--- a/chrome/browser/resources/settings/privacy_page/privacy_page.js
+++ b/chrome/browser/resources/settings/privacy_page/privacy_page.js
@@ -143,11 +143,10 @@
     },
 
     /** @private */
-    enableNativeFileSystemWriteContentSetting_: {
+    enableFileSystemWriteContentSetting_: {
       type: Boolean,
       value() {
-        return loadTimeData.getBoolean(
-            'enableNativeFileSystemWriteContentSetting');
+        return loadTimeData.getBoolean('enableFileSystemWriteContentSetting');
       }
     },
 
diff --git a/chrome/browser/resources/settings/route.js b/chrome/browser/resources/settings/route.js
index 29d23a5d..35fc6276 100644
--- a/chrome/browser/resources/settings/route.js
+++ b/chrome/browser/resources/settings/route.js
@@ -83,8 +83,8 @@
     r.SITE_SETTINGS_WINDOW_PLACEMENT =
         r.SITE_SETTINGS.createChild('windowPlacement');
   }
-  if (loadTimeData.getBoolean('enableNativeFileSystemWriteContentSetting')) {
-    r.SITE_SETTINGS_NATIVE_FILE_SYSTEM_WRITE =
+  if (loadTimeData.getBoolean('enableFileSystemWriteContentSetting')) {
+    r.SITE_SETTINGS_FILE_SYSTEM_WRITE =
         r.SITE_SETTINGS.createChild('filesystem');
   }
 }
diff --git a/chrome/browser/resources/settings/settings_routes.js b/chrome/browser/resources/settings/settings_routes.js
index 560c9a0..5d4415b 100644
--- a/chrome/browser/resources/settings/settings_routes.js
+++ b/chrome/browser/resources/settings/settings_routes.js
@@ -67,7 +67,7 @@
  *   SITE_SETTINGS_LOCATION: !Route,
  *   SITE_SETTINGS_MICROPHONE: !Route,
  *   SITE_SETTINGS_MIDI_DEVICES: !Route,
- *   SITE_SETTINGS_NATIVE_FILE_SYSTEM_WRITE: !Route,
+ *   SITE_SETTINGS_FILE_SYSTEM_WRITE: !Route,
  *   SITE_SETTINGS_NOTIFICATIONS: !Route,
  *   SITE_SETTINGS_PAYMENT_HANDLER: !Route,
  *   SITE_SETTINGS_PDF_DOCUMENTS: !Route,
diff --git a/chrome/browser/resources/settings/site_settings/category_default_setting.js b/chrome/browser/resources/settings/site_settings/category_default_setting.js
index 4eecb87c..83e5056 100644
--- a/chrome/browser/resources/settings/site_settings/category_default_setting.js
+++ b/chrome/browser/resources/settings/site_settings/category_default_setting.js
@@ -181,7 +181,7 @@
       case ContentSettingsTypes.SERIAL_PORTS:
       case ContentSettingsTypes.BLUETOOTH_DEVICES:
       case ContentSettingsTypes.BLUETOOTH_SCANNING:
-      case ContentSettingsTypes.NATIVE_FILE_SYSTEM_WRITE:
+      case ContentSettingsTypes.FILE_SYSTEM_WRITE:
       case ContentSettingsTypes.HID_DEVICES:
       case ContentSettingsTypes.VR:
       case ContentSettingsTypes.AR:
diff --git a/chrome/browser/resources/settings/site_settings/category_setting_exceptions.js b/chrome/browser/resources/settings/site_settings/category_setting_exceptions.js
index eefa779..cc541377 100644
--- a/chrome/browser/resources/settings/site_settings/category_setting_exceptions.js
+++ b/chrome/browser/resources/settings/site_settings/category_setting_exceptions.js
@@ -116,7 +116,7 @@
    * @private
    */
   computeShowAllowSiteList_() {
-    return this.category !== ContentSettingsTypes.NATIVE_FILE_SYSTEM_WRITE;
+    return this.category !== ContentSettingsTypes.FILE_SYSTEM_WRITE;
   },
 
   /**
diff --git a/chrome/browser/resources/settings/site_settings/constants.js b/chrome/browser/resources/settings/site_settings/constants.js
index 41b2dcf..e2aa18b 100644
--- a/chrome/browser/resources/settings/site_settings/constants.js
+++ b/chrome/browser/resources/settings/site_settings/constants.js
@@ -37,7 +37,7 @@
   PAYMENT_HANDLER: 'payment-handler',
   MIXEDSCRIPT: 'mixed-script',
   BLUETOOTH_SCANNING: 'bluetooth-scanning',
-  NATIVE_FILE_SYSTEM_WRITE: 'native-file-system-write',
+  FILE_SYSTEM_WRITE: 'file-system-write',
   HID_DEVICES: 'hid-devices',
   AR: 'ar',
   VR: 'vr',
diff --git a/chrome/browser/resources/settings/site_settings/site_details.html b/chrome/browser/resources/settings/site_settings/site_details.html
index 0485238..f0f8c82 100644
--- a/chrome/browser/resources/settings/site_settings/site_details.html
+++ b/chrome/browser/resources/settings/site_settings/site_details.html
@@ -196,11 +196,11 @@
             label="$i18n{siteSettingsBluetoothDevices}">
         </site-details-permission>
       </template>
-      <template is="dom-if" if="[[enableNativeFileSystemWriteContentSetting_]]">
+      <template is="dom-if" if="[[enableFileSystemWriteContentSetting_]]">
         <site-details-permission
-            category="{{ContentSettingsTypes.NATIVE_FILE_SYSTEM_WRITE}}"
-            icon="settings:save-original" id="nativeFileSystemWrite"
-            label="$i18n{siteSettingsNativeFileSystemWrite}">
+            category="{{ContentSettingsTypes.FILE_SYSTEM_WRITE}}"
+            icon="settings:save-original" id="fileSystemWrite"
+            label="$i18n{siteSettingsFileSystemWrite}">
         </site-details-permission>
       </template>
       <site-details-permission
diff --git a/chrome/browser/resources/settings/site_settings/site_details.js b/chrome/browser/resources/settings/site_settings/site_details.js
index 6d9a6e3..bf10bba 100644
--- a/chrome/browser/resources/settings/site_settings/site_details.js
+++ b/chrome/browser/resources/settings/site_settings/site_details.js
@@ -95,11 +95,10 @@
     },
 
     /** @private */
-    enableNativeFileSystemWriteContentSetting_: {
+    enableFileSystemWriteContentSetting_: {
       type: Boolean,
       value() {
-        return loadTimeData.getBoolean(
-            'enableNativeFileSystemWriteContentSetting');
+        return loadTimeData.getBoolean('enableFileSystemWriteContentSetting');
       }
     },
 
diff --git a/chrome/browser/resources/settings/site_settings/site_details_permission.js b/chrome/browser/resources/settings/site_settings/site_details_permission.js
index 8c494dc6..8697f265 100644
--- a/chrome/browser/resources/settings/site_settings/site_details_permission.js
+++ b/chrome/browser/resources/settings/site_settings/site_details_permission.js
@@ -251,7 +251,7 @@
         category === ContentSettingsTypes.SERIAL_PORTS ||
         category === ContentSettingsTypes.USB_DEVICES ||
         category === ContentSettingsTypes.BLUETOOTH_SCANNING ||
-        category === ContentSettingsTypes.NATIVE_FILE_SYSTEM_WRITE ||
+        category === ContentSettingsTypes.FILE_SYSTEM_WRITE ||
         category === ContentSettingsTypes.HID_DEVICES ||
         category === ContentSettingsTypes.BLUETOOTH_DEVICES);
   },
@@ -273,10 +273,10 @@
       return true;
     }
 
-    // For Bluetooth scanning permission and Native File System write permission
+    // For Bluetooth scanning permission and File System write permission
     // 'ask' takes the place of 'allow'.
     if (category === ContentSettingsTypes.BLUETOOTH_SCANNING ||
-        category === ContentSettingsTypes.NATIVE_FILE_SYSTEM_WRITE) {
+        category === ContentSettingsTypes.FILE_SYSTEM_WRITE) {
       return true;
     }
 
diff --git a/chrome/browser/resources/settings/site_settings/site_list.js b/chrome/browser/resources/settings/site_settings/site_list.js
index 0d7f173d..ba05fd6 100644
--- a/chrome/browser/resources/settings/site_settings/site_list.js
+++ b/chrome/browser/resources/settings/site_settings/site_list.js
@@ -278,7 +278,7 @@
   computeShowAddSiteButton_() {
     return !(
         this.readOnlyList ||
-        (this.category === ContentSettingsTypes.NATIVE_FILE_SYSTEM_WRITE &&
+        (this.category === ContentSettingsTypes.FILE_SYSTEM_WRITE &&
          this.categorySubtype === ContentSetting.ALLOW));
   },
 
diff --git a/chrome/browser/resources/settings/site_settings/site_settings_behavior.js b/chrome/browser/resources/settings/site_settings/site_settings_behavior.js
index c314dd8d..6d8b808e 100644
--- a/chrome/browser/resources/settings/site_settings/site_settings_behavior.js
+++ b/chrome/browser/resources/settings/site_settings/site_settings_behavior.js
@@ -223,8 +223,8 @@
         ContentSettingsTypes.PAYMENT_HANDLER,
         'enablePaymentHandlerContentSetting');
     addOrRemoveSettingWithFlag(
-        ContentSettingsTypes.NATIVE_FILE_SYSTEM_WRITE,
-        'enableNativeFileSystemWriteContentSetting');
+        ContentSettingsTypes.FILE_SYSTEM_WRITE,
+        'enableFileSystemWriteContentSetting');
     addOrRemoveSettingWithFlag(
         ContentSettingsTypes.MIXEDSCRIPT,
         'enableInsecureContentContentSetting');
diff --git a/chrome/browser/resources/settings/site_settings_page/recent_site_permissions.js b/chrome/browser/resources/settings/site_settings_page/recent_site_permissions.js
index 5076acc..b555dc10 100644
--- a/chrome/browser/resources/settings/site_settings_page/recent_site_permissions.js
+++ b/chrome/browser/resources/settings/site_settings_page/recent_site_permissions.js
@@ -166,8 +166,8 @@
         return this.i18n('siteSettingsInsecureContent');
       case ContentSettingsTypes.BLUETOOTH_SCANNING:
         return this.i18n('siteSettingsBluetoothScanning');
-      case ContentSettingsTypes.NATIVE_FILE_SYSTEM_WRITE:
-        return this.i18n('siteSettingsNativeFileSystemWrite');
+      case ContentSettingsTypes.FILE_SYSTEM_WRITE:
+        return this.i18n('siteSettingsFileSystemWrite');
       case ContentSettingsTypes.HID_DEVICES:
         return this.i18n('siteSettingsHidDevices');
       case ContentSettingsTypes.AR:
diff --git a/chrome/browser/resources/settings/site_settings_page/site_settings_page.js b/chrome/browser/resources/settings/site_settings_page/site_settings_page.js
index d4cb8fd..3cadb84 100644
--- a/chrome/browser/resources/settings/site_settings_page/site_settings_page.js
+++ b/chrome/browser/resources/settings/site_settings_page/site_settings_page.js
@@ -181,14 +181,14 @@
           loadTimeData.getBoolean('enableInsecureContentContentSetting'),
     },
     {
-      route: routes.SITE_SETTINGS_NATIVE_FILE_SYSTEM_WRITE,
-      id: Id.NATIVE_FILE_SYSTEM_WRITE,
-      label: 'siteSettingsNativeFileSystemWrite',
+      route: routes.SITE_SETTINGS_FILE_SYSTEM_WRITE,
+      id: Id.FILE_SYSTEM_WRITE,
+      label: 'siteSettingsFileSystemWrite',
       icon: 'settings:save-original',
-      enabledLabel: 'siteSettingsNativeFileSystemWriteAsk',
-      disabledLabel: 'siteSettingsNativeFileSystemWriteBlock',
+      enabledLabel: 'siteSettingsFileSystemWriteAsk',
+      disabledLabel: 'siteSettingsFileSystemWriteBlock',
       shouldShow: () =>
-          loadTimeData.getBoolean('enableNativeFileSystemWriteContentSetting'),
+          loadTimeData.getBoolean('enableFileSystemWriteContentSetting'),
     },
     {
       route: routes.SITE_SETTINGS_NOTIFICATIONS,
@@ -366,7 +366,7 @@
             Id.USB_DEVICES,
             Id.SERIAL_PORTS,
             Id.BLUETOOTH_DEVICES,
-            Id.NATIVE_FILE_SYSTEM_WRITE,
+            Id.FILE_SYSTEM_WRITE,
             Id.HID_DEVICES,
             Id.CLIPBOARD,
             Id.PAYMENT_HANDLER,
diff --git a/chrome/browser/resources/signin/profile_picker/BUILD.gn b/chrome/browser/resources/signin/profile_picker/BUILD.gn
index d25ff689..3ba44dc 100644
--- a/chrome/browser/resources/signin/profile_picker/BUILD.gn
+++ b/chrome/browser/resources/signin/profile_picker/BUILD.gn
@@ -31,7 +31,9 @@
     ":navigation_behavior",
     "//third_party/polymer/v3_0/components-chromium/iron-icon",
     "//third_party/polymer/v3_0/components-chromium/polymer:polymer_bundled",
+    "//ui/webui/resources/cr_elements/cr_checkbox:cr_checkbox.m",
     "//ui/webui/resources/cr_elements/cr_icon_button:cr_icon_button.m",
+    "//ui/webui/resources/js:load_time_data.m",
     "//ui/webui/resources/js:web_ui_listener_behavior.m",
   ]
 }
diff --git a/chrome/browser/resources/signin/profile_picker/manage_profiles_browser_proxy.js b/chrome/browser/resources/signin/profile_picker/manage_profiles_browser_proxy.js
index 5211774..8c10d78 100644
--- a/chrome/browser/resources/signin/profile_picker/manage_profiles_browser_proxy.js
+++ b/chrome/browser/resources/signin/profile_picker/manage_profiles_browser_proxy.js
@@ -38,6 +38,13 @@
   launchSelectedProfile(profilePath) {}
 
   /**
+   * Inform native the user's choice on whether to show the profile picker
+   * on startup or not.
+   * @param {boolean} shouldShow
+   */
+  askOnStartupChanged(shouldShow) {}
+
+  /**
    * Retrieves suggested theme for the new profile.
    * @return {!Promise<!AutogeneratedThemeColorInfo>} A promise firing with the
    * suggested theme info, once it has been retrieved.
@@ -58,6 +65,11 @@
   }
 
   /** @override */
+  askOnStartupChanged(shouldShow) {
+    chrome.send('askOnStartupChanged', [shouldShow]);
+  }
+
+  /** @override */
   getNewProfileSuggestedThemeInfo() {
     return sendWithPromise('getNewProfileSuggestedThemeInfo');
   }
diff --git a/chrome/browser/resources/signin/profile_picker/profile_picker_main_view.html b/chrome/browser/resources/signin/profile_picker/profile_picker_main_view.html
index 023267f..9ba2ea1 100644
--- a/chrome/browser/resources/signin/profile_picker/profile_picker_main_view.html
+++ b/chrome/browser/resources/signin/profile_picker/profile_picker_main_view.html
@@ -6,9 +6,7 @@
   }
 
   .banner {
-    bottom: 0;
     height: var(--banner-img-height);
-    margin: auto;
     overflow: hidden;
     position: absolute;
     top: 0;
@@ -93,6 +91,27 @@
 
   @media (prefers-color-scheme: dark) {
     /* TODO(msalama): Dark mode mocks not ready yet.*/
+    cr-checkbox {
+      --cr-checkbox-label-color: var(--google-grey-refresh-500);
+      background-color: rgba(var(--md-background-color), .8);
+    }
+  }
+
+  .footer {
+    bottom: 0;
+    display: flex;
+    margin-bottom: 40px;
+    position: absolute;
+    width: 100%;
+  }
+
+  cr-checkbox {
+    --cr-checkbox-label-color:  var(--google-grey-refresh-700);
+    --cr-checkbox-label-padding-start: 8px;
+    background-color: rgba(255, 255, 255, .8);
+    justify-content: flex-end;
+    margin-inline-end: 40px;
+    margin-inline-start: auto;
   }
 </style>
 
@@ -118,3 +137,10 @@
   </div>
 </div>
 <div id="rightBanner" class="banner"></div>
+
+<div class="footer">
+  <cr-checkbox checked="{{askOnStartup_}}"
+      on-change="onAskOnStartupChangedByUser_">
+    $i18n{askOnStartupCheckboxText}
+  </cr-checkbox>
+</div>
diff --git a/chrome/browser/resources/signin/profile_picker/profile_picker_main_view.js b/chrome/browser/resources/signin/profile_picker/profile_picker_main_view.js
index b1ec2b7f0..a4e819f 100644
--- a/chrome/browser/resources/signin/profile_picker/profile_picker_main_view.js
+++ b/chrome/browser/resources/signin/profile_picker/profile_picker_main_view.js
@@ -4,12 +4,15 @@
 
 import 'chrome://resources/cr_elements/cr_icon_button/cr_icon_button.m.js';
 import 'chrome://resources/cr_elements/shared_vars_css.m.js';
+import 'chrome://resources/cr_elements/cr_checkbox/cr_checkbox.m.js';
 import './icons.js';
 import './profile_card.js';
 import './profile_picker_shared_css.js';
 
+import {loadTimeData} from 'chrome://resources/js/load_time_data.m.js';
 import {WebUIListenerBehavior} from 'chrome://resources/js/web_ui_listener_behavior.m.js';
 import {html, Polymer} from 'chrome://resources/polymer/v3_0/polymer/polymer_bundled.min.js';
+import './strings.js';
 
 import {ManageProfilesBrowserProxy, ManageProfilesBrowserProxyImpl, ProfileState} from './manage_profiles_browser_proxy.js';
 import {navigateTo, NavigationBehavior, Routes} from './navigation_behavior.js';
@@ -30,6 +33,14 @@
     profilesList_: {
       type: Object,
     },
+
+    /** @private */
+    askOnStartup_: {
+      type: Boolean,
+      value() {
+        return loadTimeData.getBoolean('askOnStartup');
+      }
+    },
   },
 
   /** @private {?ManageProfilesBrowserProxy} */
@@ -69,6 +80,14 @@
     this.profilesList_ = profilesList;
   },
 
+  /**
+   * Called when the user modifies 'Ask on startup' preference.
+   * @private
+   */
+  onAskOnStartupChangedByUser_() {
+    this.manageProfilesBrowserProxy_.askOnStartupChanged(this.askOnStartup_);
+  },
+
   /** @private */
   onAddProfileClick_() {
     navigateTo(Routes.NEW_PROFILE);
diff --git a/chrome/browser/safe_browsing/android/java/res/xml/security_preferences.xml b/chrome/browser/safe_browsing/android/java/res/xml/security_preferences.xml
index d88dc0b..6220780 100644
--- a/chrome/browser/safe_browsing/android/java/res/xml/security_preferences.xml
+++ b/chrome/browser/safe_browsing/android/java/res/xml/security_preferences.xml
@@ -10,8 +10,7 @@
         android:key="safe_browsing_section"
         android:title="@string/prefs_section_safe_browsing_title"/>
 
-    <org.chromium.components.browser_ui.settings.TextMessagePreference
-        android:key="text_managed" />
+<!--  TODO(crbug.com/1097310): Add managed text view for Safe Browsing preference.  -->
 
     <org.chromium.chrome.browser.safe_browsing.settings.RadioButtonGroupSafeBrowsingPreference
         android:key="safe_browsing_radio_button_group"
diff --git a/chrome/browser/safe_browsing/android/java/src/org/chromium/chrome/browser/safe_browsing/SafeBrowsingBridge.java b/chrome/browser/safe_browsing/android/java/src/org/chromium/chrome/browser/safe_browsing/SafeBrowsingBridge.java
index d1ead1f..fd745a6 100644
--- a/chrome/browser/safe_browsing/android/java/src/org/chromium/chrome/browser/safe_browsing/SafeBrowsingBridge.java
+++ b/chrome/browser/safe_browsing/android/java/src/org/chromium/chrome/browser/safe_browsing/SafeBrowsingBridge.java
@@ -60,14 +60,6 @@
     }
 
     /**
-     * @return Whether the Safe Browsing preference is managed. It can be managed by either
-     * the SafeBrowsingEnabled policy(legacy) or the SafeBrowsingProtectionLevel policy(new).
-     */
-    public static boolean isSafeBrowsingManaged() {
-        return SafeBrowsingBridgeJni.get().isSafeBrowsingManaged();
-    }
-
-    /**
      * @return Whether there is a Google account to use for the leak detection check.
      */
     public static boolean hasAccountForLeakCheckRequest() {
@@ -84,6 +76,5 @@
         int getSafeBrowsingState();
         void setSafeBrowsingState(@SafeBrowsingState int state);
         boolean hasAccountForLeakCheckRequest();
-        boolean isSafeBrowsingManaged();
     }
 }
diff --git a/chrome/browser/safe_browsing/android/java/src/org/chromium/chrome/browser/safe_browsing/settings/RadioButtonGroupSafeBrowsingPreference.java b/chrome/browser/safe_browsing/android/java/src/org/chromium/chrome/browser/safe_browsing/settings/RadioButtonGroupSafeBrowsingPreference.java
index f5500914..1c185ce 100644
--- a/chrome/browser/safe_browsing/android/java/src/org/chromium/chrome/browser/safe_browsing/settings/RadioButtonGroupSafeBrowsingPreference.java
+++ b/chrome/browser/safe_browsing/android/java/src/org/chromium/chrome/browser/safe_browsing/settings/RadioButtonGroupSafeBrowsingPreference.java
@@ -15,8 +15,6 @@
 import androidx.preference.PreferenceViewHolder;
 
 import org.chromium.chrome.browser.safe_browsing.SafeBrowsingState;
-import org.chromium.components.browser_ui.settings.ManagedPreferenceDelegate;
-import org.chromium.components.browser_ui.settings.ManagedPreferencesUtils;
 import org.chromium.components.browser_ui.widget.RadioButtonWithDescription;
 import org.chromium.components.browser_ui.widget.RadioButtonWithDescriptionAndAuxButton;
 import org.chromium.components.browser_ui.widget.RadioButtonWithDescriptionLayout;
@@ -54,7 +52,6 @@
     private @SafeBrowsingState int mSafeBrowsingState;
     private boolean mIsEnhancedProtectionEnabled;
     private OnSafeBrowsingModeDetailsRequested mSafeBrowsingModeDetailsRequestedListener;
-    private ManagedPreferenceDelegate mManagedPrefDelegate;
 
     public RadioButtonGroupSafeBrowsingPreference(Context context, AttributeSet attrs) {
         super(context, attrs);
@@ -115,16 +112,6 @@
         }
         mStandardProtection.setChecked(mSafeBrowsingState == SafeBrowsingState.STANDARD_PROTECTION);
         mNoProtection.setChecked(mSafeBrowsingState == SafeBrowsingState.NO_SAFE_BROWSING);
-
-        // If Safe Browsing is managed, disable the radio button group, but keep the aux buttons
-        // enabled to disclose information.
-        if (mManagedPrefDelegate.isPreferenceClickDisabledByPolicy(this)) {
-            groupLayout.setEnabled(false);
-            if (mIsEnhancedProtectionEnabled) {
-                mEnhancedProtection.setAuxButtonEnabled(true);
-            }
-            mStandardProtection.setAuxButtonEnabled(true);
-        }
     }
 
     @Override
@@ -152,14 +139,6 @@
         mSafeBrowsingModeDetailsRequestedListener = listener;
     }
 
-    /**
-     * Sets the ManagedPreferenceDelegate which will determine whether this preference is managed.
-     */
-    public void setManagedPreferenceDelegate(ManagedPreferenceDelegate delegate) {
-        mManagedPrefDelegate = delegate;
-        ManagedPreferencesUtils.initPreference(mManagedPrefDelegate, this);
-    }
-
     @VisibleForTesting
     public @SafeBrowsingState int getSafeBrowsingStateForTesting() {
         return mSafeBrowsingState;
diff --git a/chrome/browser/safe_browsing/android/java/src/org/chromium/chrome/browser/safe_browsing/settings/SecuritySettingsFragment.java b/chrome/browser/safe_browsing/android/java/src/org/chromium/chrome/browser/safe_browsing/settings/SecuritySettingsFragment.java
index 941ba2c0..4d37cd21 100644
--- a/chrome/browser/safe_browsing/android/java/src/org/chromium/chrome/browser/safe_browsing/settings/SecuritySettingsFragment.java
+++ b/chrome/browser/safe_browsing/android/java/src/org/chromium/chrome/browser/safe_browsing/settings/SecuritySettingsFragment.java
@@ -12,12 +12,9 @@
 import org.chromium.chrome.browser.flags.ChromeFeatureList;
 import org.chromium.chrome.browser.safe_browsing.SafeBrowsingBridge;
 import org.chromium.chrome.browser.safe_browsing.SafeBrowsingState;
-import org.chromium.chrome.browser.settings.ChromeManagedPreferenceDelegate;
 import org.chromium.chrome.browser.settings.FragmentSettingsLauncher;
 import org.chromium.chrome.browser.settings.SettingsLauncher;
-import org.chromium.components.browser_ui.settings.ManagedPreferenceDelegate;
 import org.chromium.components.browser_ui.settings.SettingsUtils;
-import org.chromium.components.browser_ui.settings.TextMessagePreference;
 
 /**
  * Fragment containing security settings.
@@ -26,9 +23,7 @@
         implements FragmentSettingsLauncher,
                    RadioButtonGroupSafeBrowsingPreference.OnSafeBrowsingModeDetailsRequested {
     @VisibleForTesting
-    static final String PREF_TEXT_MANAGED = "text_managed";
-    @VisibleForTesting
-    static final String PREF_SAFE_BROWSING = "safe_browsing_radio_button_group";
+    public static final String PREF_SAFE_BROWSING = "safe_browsing_radio_button_group";
 
     // An instance of SettingsLauncher that is used to launch Safe Browsing subsections.
     private SettingsLauncher mSettingsLauncher;
@@ -38,26 +33,18 @@
         SettingsUtils.addPreferencesFromResource(this, R.xml.security_preferences);
         getActivity().setTitle(R.string.prefs_security_title);
 
-        ManagedPreferenceDelegate managedPreferenceDelegate = createManagedPreferenceDelegate();
-
         RadioButtonGroupSafeBrowsingPreference safeBrowsingPreference =
                 findPreference(PREF_SAFE_BROWSING);
         safeBrowsingPreference.init(SafeBrowsingBridge.getSafeBrowsingState(),
                 ChromeFeatureList.isEnabled(
                         ChromeFeatureList.SAFE_BROWSING_ENHANCED_PROTECTION_ENABLED));
         safeBrowsingPreference.setSafeBrowsingModeDetailsRequestedListener(this);
-        safeBrowsingPreference.setManagedPreferenceDelegate(managedPreferenceDelegate);
         safeBrowsingPreference.setOnPreferenceChangeListener((preference, newValue) -> {
             @SafeBrowsingState
             int newState = (int) newValue;
             SafeBrowsingBridge.setSafeBrowsingState(newState);
             return true;
         });
-
-        TextMessagePreference textManaged = findPreference(PREF_TEXT_MANAGED);
-        textManaged.setManagedPreferenceDelegate(managedPreferenceDelegate);
-        textManaged.setVisible(managedPreferenceDelegate.isPreferenceClickDisabledByPolicy(
-                safeBrowsingPreference));
     }
 
     @Override
@@ -77,16 +64,4 @@
     public void setSettingsLauncher(SettingsLauncher settingsLauncher) {
         mSettingsLauncher = settingsLauncher;
     }
-
-    private ChromeManagedPreferenceDelegate createManagedPreferenceDelegate() {
-        return preference -> {
-            String key = preference.getKey();
-            if (PREF_TEXT_MANAGED.equals(key) || PREF_SAFE_BROWSING.equals(key)) {
-                return SafeBrowsingBridge.isSafeBrowsingManaged();
-            } else {
-                assert false : "Should not be reached.";
-            }
-            return false;
-        };
-    }
 }
diff --git a/chrome/browser/safe_browsing/android/javatests/src/org/chromium/chrome/browser/safe_browsing/settings/SecuritySettingsFragmentTest.java b/chrome/browser/safe_browsing/android/javatests/src/org/chromium/chrome/browser/safe_browsing/settings/SecuritySettingsFragmentTest.java
index 47143970..f912740 100644
--- a/chrome/browser/safe_browsing/android/javatests/src/org/chromium/chrome/browser/safe_browsing/settings/SecuritySettingsFragmentTest.java
+++ b/chrome/browser/safe_browsing/android/javatests/src/org/chromium/chrome/browser/safe_browsing/settings/SecuritySettingsFragmentTest.java
@@ -16,25 +16,22 @@
 import org.mockito.Mockito;
 import org.mockito.MockitoAnnotations;
 
+import org.chromium.base.test.BaseJUnit4ClassRunner;
 import org.chromium.base.test.util.Feature;
 import org.chromium.chrome.browser.flags.ChromeFeatureList;
-import org.chromium.chrome.browser.init.ChromeBrowserInitializer;
 import org.chromium.chrome.browser.safe_browsing.SafeBrowsingBridge;
 import org.chromium.chrome.browser.safe_browsing.SafeBrowsingState;
 import org.chromium.chrome.browser.settings.SettingsActivityTestRule;
 import org.chromium.chrome.browser.settings.SettingsLauncher;
-import org.chromium.chrome.test.ChromeJUnit4ClassRunner;
 import org.chromium.chrome.test.util.browser.Features;
-import org.chromium.components.browser_ui.settings.TextMessagePreference;
 import org.chromium.components.browser_ui.widget.RadioButtonWithDescription;
 import org.chromium.components.browser_ui.widget.RadioButtonWithDescriptionAndAuxButton;
 import org.chromium.content_public.browser.test.util.TestThreadUtils;
-import org.chromium.policy.test.annotations.Policies;
 
 /**
  * Tests for {@link SecuritySettingsFragment}.
  */
-@RunWith(ChromeJUnit4ClassRunner.class)
+@RunWith(BaseJUnit4ClassRunner.class)
 // clang-format off
 @Features.EnableFeatures({ChromeFeatureList.SAFE_BROWSING_SECURITY_SECTION_UI})
 public class SecuritySettingsFragmentTest {
@@ -58,11 +55,11 @@
 
     private SecuritySettingsFragment mSecuritySettingsFragment;
     private RadioButtonGroupSafeBrowsingPreference mSafeBrowsingPreference;
-    private TextMessagePreference mManagedTextPreference;
 
     @Before
     public void setUp() {
         MockitoAnnotations.initMocks(this);
+        launchSettingsActivity();
     }
 
     private void launchSettingsActivity() {
@@ -70,11 +67,8 @@
         mSecuritySettingsFragment = mTestRule.getFragment();
         mSafeBrowsingPreference = mSecuritySettingsFragment.findPreference(
                 SecuritySettingsFragment.PREF_SAFE_BROWSING);
-        mManagedTextPreference = mSecuritySettingsFragment.findPreference(
-                SecuritySettingsFragment.PREF_TEXT_MANAGED);
         Assert.assertNotNull(
                 "Safe Browsing preference should not be null.", mSafeBrowsingPreference);
-        Assert.assertNotNull("Text managed preference should not be null.", mManagedTextPreference);
     }
 
     @Test
@@ -82,7 +76,6 @@
     @Feature({"SafeBrowsing"})
     @Features.EnableFeatures(ChromeFeatureList.SAFE_BROWSING_ENHANCED_PROTECTION_ENABLED)
     public void testOnStartup() {
-        launchSettingsActivity();
         TestThreadUtils.runOnUiThreadBlocking(() -> {
             @SafeBrowsingState
             int currentState = SafeBrowsingBridge.getSafeBrowsingState();
@@ -97,7 +90,6 @@
                     getStandardProtectionButton().isChecked());
             Assert.assertEquals(ASSERT_RADIO_BUTTON_CHECKED, no_protection_checked,
                     getNoProtectionButton().isChecked());
-            Assert.assertFalse(mManagedTextPreference.isVisible());
         });
     }
 
@@ -106,9 +98,7 @@
     @Feature({"SafeBrowsing"})
     @Features.EnableFeatures(ChromeFeatureList.SAFE_BROWSING_ENHANCED_PROTECTION_ENABLED)
     public void testCheckRadioButtons() {
-        launchSettingsActivity();
         TestThreadUtils.runOnUiThreadBlocking(() -> {
-            Assert.assertFalse(mManagedTextPreference.isVisible());
             // Click the Enhanced Protection button.
             getEnhancedProtectionButton().onClick(null);
             Assert.assertEquals(ASSERT_SAFE_BROWSING_STATE_RADIO_BUTTON_GROUP,
@@ -154,7 +144,6 @@
     @Feature({"SafeBrowsing"})
     @Features.DisableFeatures(ChromeFeatureList.SAFE_BROWSING_ENHANCED_PROTECTION_ENABLED)
     public void testEnhancedProtectionDisabled() {
-        launchSettingsActivity();
         Assert.assertNull(getEnhancedProtectionButton());
     }
 
@@ -163,7 +152,6 @@
     @Feature({"SafeBrowsing"})
     @Features.EnableFeatures(ChromeFeatureList.SAFE_BROWSING_ENHANCED_PROTECTION_ENABLED)
     public void testEnhancedProtectionAuxButtonClicked() {
-        launchSettingsActivity();
         TestThreadUtils.runOnUiThreadBlocking(() -> {
             mSecuritySettingsFragment.setSettingsLauncher(mSettingsLauncher);
             getEnhancedProtectionButton().getAuxButtonForTests().performClick();
@@ -178,7 +166,6 @@
     @Feature({"SafeBrowsing"})
     @Features.EnableFeatures(ChromeFeatureList.SAFE_BROWSING_ENHANCED_PROTECTION_ENABLED)
     public void testStandardProtectionAuxButtonClicked() {
-        launchSettingsActivity();
         TestThreadUtils.runOnUiThreadBlocking(() -> {
             mSecuritySettingsFragment.setSettingsLauncher(mSettingsLauncher);
             getStandardProtectionButton().getAuxButtonForTests().performClick();
@@ -188,28 +175,6 @@
         });
     }
 
-    @Test
-    @SmallTest
-    @Feature({"SafeBrowsing"})
-    @Features.EnableFeatures(ChromeFeatureList.SAFE_BROWSING_ENHANCED_PROTECTION_ENABLED)
-    @Policies.Add({ @Policies.Item(key = "SafeBrowsingEnabled", string = "true") })
-    public void testSafeBrowsingManaged() {
-        TestThreadUtils.runOnUiThreadBlocking(
-                () -> { ChromeBrowserInitializer.getInstance().handleSynchronousStartup(); });
-        launchSettingsActivity();
-        TestThreadUtils.runOnUiThreadBlocking(() -> {
-            Assert.assertTrue(SafeBrowsingBridge.isSafeBrowsingManaged());
-            Assert.assertTrue(mManagedTextPreference.isVisible());
-            Assert.assertFalse(getEnhancedProtectionButton().isEnabled());
-            Assert.assertFalse(getStandardProtectionButton().isEnabled());
-            Assert.assertFalse(getNoProtectionButton().isEnabled());
-            Assert.assertEquals(SafeBrowsingState.STANDARD_PROTECTION, getSafeBrowsingState());
-            // To disclose information, aux buttons should be enabled under managed mode.
-            Assert.assertTrue(getEnhancedProtectionButton().getAuxButtonForTests().isEnabled());
-            Assert.assertTrue(getStandardProtectionButton().getAuxButtonForTests().isEnabled());
-        });
-    }
-
     private @SafeBrowsingState int getSafeBrowsingState() {
         return mSafeBrowsingPreference.getSafeBrowsingStateForTesting();
     }
diff --git a/chrome/browser/safe_browsing/android/safe_browsing_bridge.cc b/chrome/browser/safe_browsing/android/safe_browsing_bridge.cc
index ea1edc3ef..d01b6af 100644
--- a/chrome/browser/safe_browsing/android/safe_browsing_bridge.cc
+++ b/chrome/browser/safe_browsing/android/safe_browsing_bridge.cc
@@ -66,10 +66,6 @@
       GetPrefService(), static_cast<SafeBrowsingState>(state));
 }
 
-static jboolean JNI_SafeBrowsingBridge_IsSafeBrowsingManaged(JNIEnv* env) {
-  return safe_browsing::IsSafeBrowsingPolicyManaged(*GetPrefService());
-}
-
 static jboolean JNI_SafeBrowsingBridge_HasAccountForLeakCheckRequest(
     JNIEnv* env) {
   signin::IdentityManager* identity_manager =
diff --git a/chrome/browser/safe_browsing/browser_feature_extractor_unittest.cc b/chrome/browser/safe_browsing/browser_feature_extractor_unittest.cc
index 32910cd..9b05a33 100644
--- a/chrome/browser/safe_browsing/browser_feature_extractor_unittest.cc
+++ b/chrome/browser/safe_browsing/browser_feature_extractor_unittest.cc
@@ -69,8 +69,7 @@
 
   void SetUp() override {
     ChromeRenderViewHostTestHarness::SetUp();
-    ASSERT_TRUE(profile()->CreateHistoryService(
-        true /* delete_file */, false /* no_db */));
+    ASSERT_TRUE(profile()->CreateHistoryService());
 
     host_.reset(new StrictMock<MockClientSideDetectionHost>(web_contents()));
     extractor_.reset(new BrowserFeatureExtractor(web_contents()));
diff --git a/chrome/browser/safe_browsing/download_protection/download_protection_service_unittest.cc b/chrome/browser/safe_browsing/download_protection/download_protection_service_unittest.cc
index bc597d1..22b3efb 100644
--- a/chrome/browser/safe_browsing/download_protection/download_protection_service_unittest.cc
+++ b/chrome/browser/safe_browsing/download_protection/download_protection_service_unittest.cc
@@ -341,8 +341,7 @@
                          .AppendASCII("safe_browsing")
                          .AppendASCII("download_protection");
 
-    ASSERT_TRUE(profile()->CreateHistoryService(true /* delete_file */,
-                                                false /* no_db */));
+    ASSERT_TRUE(profile()->CreateHistoryService());
 
     // Setup a directory to place test files in.
     ASSERT_TRUE(temp_dir_.CreateUniqueTempDir());
diff --git a/chrome/browser/safe_browsing/threat_details_unittest.cc b/chrome/browser/safe_browsing/threat_details_unittest.cc
index eec9ca3..6eb8766 100644
--- a/chrome/browser/safe_browsing/threat_details_unittest.cc
+++ b/chrome/browser/safe_browsing/threat_details_unittest.cc
@@ -205,8 +205,7 @@
 
   void SetUp() override {
     ChromeRenderViewHostTestHarness::SetUp();
-    ASSERT_TRUE(profile()->CreateHistoryService(true /* delete_file */,
-                                                false /* no_db */));
+    ASSERT_TRUE(profile()->CreateHistoryService());
     test_shared_loader_factory_ =
         base::MakeRefCounted<network::WeakWrapperSharedURLLoaderFactory>(
             &test_url_loader_factory_);
diff --git a/chrome/browser/search_engines/template_url_service_unittest.cc b/chrome/browser/search_engines/template_url_service_unittest.cc
index 0bf484ea..e06ee49 100644
--- a/chrome/browser/search_engines/template_url_service_unittest.cc
+++ b/chrome/browser/search_engines/template_url_service_unittest.cc
@@ -1224,7 +1224,7 @@
 // Make sure TemplateURLService generates a KEYWORD_GENERATED visit for
 // KEYWORD visits.
 TEST_F(TemplateURLServiceTest, GenerateVisitOnKeyword) {
-  ASSERT_TRUE(test_util()->profile()->CreateHistoryService(true, false));
+  ASSERT_TRUE(test_util()->profile()->CreateHistoryService());
   test_util()->ResetModel(true);
 
   // Create a keyword.
diff --git a/chrome/browser/shell_integration_linux_unittest.cc b/chrome/browser/shell_integration_linux_unittest.cc
index 8074c9c..5cb28d6 100644
--- a/chrome/browser/shell_integration_linux_unittest.cc
+++ b/chrome/browser/shell_integration_linux_unittest.cc
@@ -463,27 +463,6 @@
   }
 }
 
-TEST(ShellIntegrationTest, GetDesktopFileContentsAppList) {
-  const base::FilePath kChromeExePath("/opt/google/chrome/google-chrome");
-  base::CommandLine command_line(kChromeExePath);
-  command_line.AppendSwitch("--show-app-list");
-  EXPECT_EQ(
-      "#!/usr/bin/env xdg-open\n"
-      "[Desktop Entry]\n"
-      "Version=1.0\n"
-      "Terminal=false\n"
-      "Type=Application\n"
-      "Name=Chrome App Launcher\n"
-      "Exec=/opt/google/chrome/google-chrome --show-app-list\n"
-      "Icon=chrome_app_list\n"
-      "Categories=Network;WebBrowser;\n"
-      "StartupWMClass=chrome-app-list\n",
-      GetDesktopFileContentsForCommand(
-          command_line, "chrome-app-list", GURL(),
-          base::ASCIIToUTF16("Chrome App Launcher"), "chrome_app_list",
-          "Network;WebBrowser;", "", false));
-}
-
 TEST(ShellIntegrationTest, GetDirectoryFileContents) {
   const struct {
     const char* const title;
diff --git a/chrome/browser/shell_integration_win.cc b/chrome/browser/shell_integration_win.cc
index cfd3a8a..f8064640 100644
--- a/chrome/browser/shell_integration_win.cc
+++ b/chrome/browser/shell_integration_win.cc
@@ -99,13 +99,6 @@
   return profile_id;
 }
 
-base::string16 GetAppListAppName() {
-  static const base::char16 kAppListAppNameSuffix[] = L"AppList";
-  base::string16 app_name(install_static::GetBaseAppId());
-  app_name.append(kAppListAppNameSuffix);
-  return app_name;
-}
-
 // Gets expected app id for given Chrome (based on |command_line| and
 // |is_per_user_install|).
 base::string16 GetExpectedAppId(const base::CommandLine& command_line,
@@ -137,8 +130,6 @@
   } else if (command_line.HasSwitch(switches::kAppId)) {
     app_name = base::UTF8ToUTF16(web_app::GenerateApplicationNameFromAppId(
         command_line.GetSwitchValueASCII(switches::kAppId)));
-  } else if (command_line.HasSwitch(switches::kShowAppList)) {
-    app_name = GetAppListAppName();
   } else {
     app_name = ShellUtil::GetBrowserModelId(is_per_user_install);
   }
diff --git a/chrome/browser/subresource_filter/subresource_filter_content_settings_manager_unittest.cc b/chrome/browser/subresource_filter/subresource_filter_content_settings_manager_unittest.cc
index b4b0fd0..eae1ff8c 100644
--- a/chrome/browser/subresource_filter/subresource_filter_content_settings_manager_unittest.cc
+++ b/chrome/browser/subresource_filter/subresource_filter_content_settings_manager_unittest.cc
@@ -91,8 +91,7 @@
     : public SubresourceFilterContentSettingsManagerTest {
  public:
   void SetUp() override {
-    ASSERT_TRUE(profile()->CreateHistoryService(true /* delete_file */,
-                                                false /* no_db */));
+    ASSERT_TRUE(profile()->CreateHistoryService());
     SubresourceFilterContentSettingsManagerTest::SetUp();
   }
 };
diff --git a/chrome/browser/ui/BUILD.gn b/chrome/browser/ui/BUILD.gn
index 1612549b..9434978 100644
--- a/chrome/browser/ui/BUILD.gn
+++ b/chrome/browser/ui/BUILD.gn
@@ -607,16 +607,14 @@
       "//components/security_state/content/android",
     ]
     if (enable_feed_in_chrome) {
-      deps += [ "//chrome/browser/ui/webui/feed_internals:mojo_bindings" ]
+      deps += [
+        "//chrome/browser/ui/webui/feed_internals:mojo_bindings",
+        "//components/feed/core/common:feed_core_common",
+        "//components/feed/core/v2:feed_core_v2",
+      ]
     }
   } else {
     # !is_android
-
-    sources += [
-      "webui/media/media_feeds_ui.cc",
-      "webui/media/media_feeds_ui.h",
-    ]
-
     deps += [ "//components/autofill/content/browser/webauthn" ]
   }
 
@@ -798,10 +796,6 @@
         "webui/feed_internals/feedv2_internals_page_handler.cc",
         "webui/feed_internals/feedv2_internals_page_handler.h",
       ]
-      deps += [
-        "//components/feed/core/common:feed_core_common",
-        "//components/feed/core/v2:feed_core_v2",
-      ]
     }
 
     deps += [
@@ -1153,6 +1147,8 @@
       "serial/serial_chooser.h",
       "serial/serial_chooser_controller.cc",
       "serial/serial_chooser_controller.h",
+      "signin/profile_colors_util.cc",
+      "signin/profile_colors_util.h",
       "singleton_tabs.cc",
       "singleton_tabs.h",
       "startup/automation_infobar_delegate.cc",
@@ -1330,6 +1326,8 @@
       "webui/management_ui.h",
       "webui/management_ui_handler.cc",
       "webui/management_ui_handler.h",
+      "webui/media/media_feeds_ui.cc",
+      "webui/media/media_feeds_ui.h",
       "webui/media_router/media_router_internals_ui.cc",
       "webui/media_router/media_router_internals_ui.h",
       "webui/media_router/media_router_internals_webui_message_handler.cc",
@@ -1537,6 +1535,7 @@
       "//third_party/libaddressinput:strings",
       "//ui/events",
     ]
+    public_deps += [ "//ui/base/dragdrop/mojom:mojom_headers" ]
 
     if (use_ozone && !is_chromeos) {
       deps += [
@@ -3958,6 +3957,7 @@
       "//components/ui_devtools/views",
       "//device/vr/buildflags:buildflags",
       "//services/media_session/public/mojom",
+      "//ui/base/dragdrop/mojom:mojom_shared",
       "//ui/views:buildflags",
     ]
 
diff --git a/chrome/browser/ui/bookmarks/bookmark_browsertest.cc b/chrome/browser/ui/bookmarks/bookmark_browsertest.cc
index 5f00f85..7abd0d10 100644
--- a/chrome/browser/ui/bookmarks/bookmark_browsertest.cc
+++ b/chrome/browser/ui/bookmarks/bookmark_browsertest.cc
@@ -36,6 +36,7 @@
 #include "content/public/test/browser_test_utils.h"
 #include "net/test/embedded_test_server/embedded_test_server.h"
 #include "testing/gmock/include/gmock/gmock.h"
+#include "ui/base/dragdrop/mojom/drag_drop_types.mojom-shared.h"
 #include "ui/base/dragdrop/os_exchange_data.h"
 #include "ui/gfx/image/image_skia.h"
 
@@ -231,9 +232,8 @@
   chrome::DoBookmarkDragCallback cb = base::BindLambdaForTesting(
       [&run_loop, page_title, page_url, expected_point](
           std::unique_ptr<ui::OSExchangeData> drag_data,
-          gfx::NativeView native_view,
-          ui::DragDropTypes::DragEventSource source, gfx::Point point,
-          int operation) {
+          gfx::NativeView native_view, ui::mojom::DragEventSource source,
+          gfx::Point point, int operation) {
         GURL url;
         base::string16 title;
         EXPECT_TRUE(drag_data->provider().GetURLAndTitle(
@@ -257,7 +257,7 @@
       {{node},
        kDragNodeIndex,
        platform_util::GetViewForWindow(browser()->window()->GetNativeWindow()),
-       ui::DragDropTypes::DRAG_EVENT_SOURCE_MOUSE,
+       ui::mojom::DragEventSource::kMouse,
        expected_point},
       std::move(cb));
 
@@ -280,7 +280,7 @@
   chrome::DoBookmarkDragCallback cb = base::BindLambdaForTesting(
       [&run_loop, expected_point](std::unique_ptr<ui::OSExchangeData> drag_data,
                                   gfx::NativeView native_view,
-                                  ui::DragDropTypes::DragEventSource source,
+                                  ui::mojom::DragEventSource source,
                                   gfx::Point point, int operation) {
 #if !defined(OS_MAC)
         GURL url;
@@ -308,7 +308,7 @@
                                    kDragNodeIndex,
                                    platform_util::GetViewForWindow(
                                        browser()->window()->GetNativeWindow()),
-                                   ui::DragDropTypes::DRAG_EVENT_SOURCE_MOUSE,
+                                   ui::mojom::DragEventSource::kMouse,
                                    expected_point,
                                },
                                std::move(cb));
diff --git a/chrome/browser/ui/bookmarks/bookmark_drag_drop.cc b/chrome/browser/ui/bookmarks/bookmark_drag_drop.cc
index dc10b50..f348416 100644
--- a/chrome/browser/ui/bookmarks/bookmark_drag_drop.cc
+++ b/chrome/browser/ui/bookmarks/bookmark_drag_drop.cc
@@ -29,7 +29,7 @@
     std::vector<const bookmarks::BookmarkNode*> nodes,
     int drag_node_index,
     gfx::NativeView view,
-    ui::DragDropTypes::DragEventSource source,
+    ui::mojom::DragEventSource source,
     gfx::Point start_point)
     : nodes(std::move(nodes)),
       drag_node_index(drag_node_index),
diff --git a/chrome/browser/ui/bookmarks/bookmark_drag_drop.h b/chrome/browser/ui/bookmarks/bookmark_drag_drop.h
index aaf1ecef..56029de 100644
--- a/chrome/browser/ui/bookmarks/bookmark_drag_drop.h
+++ b/chrome/browser/ui/bookmarks/bookmark_drag_drop.h
@@ -10,7 +10,7 @@
 
 #include "base/callback.h"
 #include "build/build_config.h"
-#include "ui/base/dragdrop/drag_drop_types.h"
+#include "ui/base/dragdrop/mojom/drag_drop_types.mojom-forward.h"
 #include "ui/gfx/geometry/point.h"
 #include "ui/gfx/native_widget_types.h"
 
@@ -32,7 +32,7 @@
 using DoBookmarkDragCallback =
     base::OnceCallback<void(std::unique_ptr<ui::OSExchangeData> drag_data,
                             gfx::NativeView native_view,
-                            ui::DragDropTypes::DragEventSource source,
+                            ui::mojom::DragEventSource source,
                             gfx::Point start_point,
                             int operation)>;
 
@@ -40,7 +40,7 @@
   BookmarkDragParams(std::vector<const bookmarks::BookmarkNode*> nodes,
                      int drag_node_index,
                      gfx::NativeView view,
-                     ui::DragDropTypes::DragEventSource source,
+                     ui::mojom::DragEventSource source,
                      gfx::Point start_point);
   ~BookmarkDragParams();
 
@@ -54,7 +54,7 @@
   gfx::NativeView view;
 
   // The source of the drag.
-  ui::DragDropTypes::DragEventSource source;
+  ui::mojom::DragEventSource source;
 
   // The point the drag started.
   gfx::Point start_point;
diff --git a/chrome/browser/ui/content_settings/content_setting_bubble_model_unittest.cc b/chrome/browser/ui/content_settings/content_setting_bubble_model_unittest.cc
index 4ff7563..8b3809f 100644
--- a/chrome/browser/ui/content_settings/content_setting_bubble_model_unittest.cc
+++ b/chrome/browser/ui/content_settings/content_setting_bubble_model_unittest.cc
@@ -264,9 +264,7 @@
 // Tests whether a changed setting in the setting bubble is displayed again when
 // the bubble is re-opened.
 TEST_F(ContentSettingBubbleModelTest, MediastreamContentBubble) {
-  ASSERT_TRUE(profile()->CreateHistoryService(
-      /* delete_file= */ true,
-      /* no_db= */ false));
+  ASSERT_TRUE(profile()->CreateHistoryService());
 
   // Required to break dependency on BrowserMainLoop.
   MediaCaptureDevicesDispatcher::GetInstance()->
diff --git a/chrome/browser/ui/page_info/permission_menu_model.cc b/chrome/browser/ui/page_info/permission_menu_model.cc
index 9e84d93..3a0b453 100644
--- a/chrome/browser/ui/page_info/permission_menu_model.cc
+++ b/chrome/browser/ui/page_info/permission_menu_model.cc
@@ -93,8 +93,8 @@
     case ContentSettingsType::HID_GUARD:
     // Bluetooth scanning does not support CONTENT_SETTING_ALLOW.
     case ContentSettingsType::BLUETOOTH_SCANNING:
-    // Native file system write does not support CONTENT_SETTING_ALLOW.
-    case ContentSettingsType::NATIVE_FILE_SYSTEM_WRITE_GUARD:
+    // File system write does not support CONTENT_SETTING_ALLOW.
+    case ContentSettingsType::FILE_SYSTEM_WRITE_GUARD:
       return false;
     default:
       return true;
@@ -107,7 +107,7 @@
     case ContentSettingsType::SERIAL_GUARD:
     case ContentSettingsType::BLUETOOTH_GUARD:
     case ContentSettingsType::BLUETOOTH_SCANNING:
-    case ContentSettingsType::NATIVE_FILE_SYSTEM_WRITE_GUARD:
+    case ContentSettingsType::FILE_SYSTEM_WRITE_GUARD:
     case ContentSettingsType::HID_GUARD:
       return true;
     default:
diff --git a/chrome/browser/ui/search/omnibox_mojo_utils.cc b/chrome/browser/ui/search/omnibox_mojo_utils.cc
index 5254e0c..0ea425d 100644
--- a/chrome/browser/ui/search/omnibox_mojo_utils.cc
+++ b/chrome/browser/ui/search/omnibox_mojo_utils.cc
@@ -22,6 +22,7 @@
 
 base::flat_map<int32_t, search::mojom::SuggestionGroupPtr>
 CreateSuggestionGroupsMap(
+    const AutocompleteResult& result,
     PrefService* prefs,
     const SearchSuggestionParser::HeadersMap& headers_map) {
   base::flat_map<int32_t, search::mojom::SuggestionGroupPtr> result_map;
@@ -30,7 +31,7 @@
         search::mojom::SuggestionGroup::New();
     suggestion_group->header = pair.second;
     suggestion_group->hidden =
-        omnibox::IsSuggestionGroupIdHidden(prefs, pair.first);
+        result.IsSuggestionGroupIdHidden(prefs, pair.first);
     result_map.emplace(pair.first, std::move(suggestion_group));
   }
   return result_map;
@@ -143,7 +144,7 @@
     const AutocompleteResult& result,
     PrefService* prefs) {
   return search::mojom::AutocompleteResult::New(
-      input, CreateSuggestionGroupsMap(prefs, result.headers_map()),
+      input, CreateSuggestionGroupsMap(result, prefs, result.headers_map()),
       CreateAutocompleteMatches(result));
 }
 
diff --git a/chrome/browser/ui/search/search_tab_helper.cc b/chrome/browser/ui/search/search_tab_helper.cc
index 4402c13..a1eb14b4 100644
--- a/chrome/browser/ui/search/search_tab_helper.cc
+++ b/chrome/browser/ui/search/search_tab_helper.cc
@@ -752,8 +752,13 @@
   if (!autocomplete_controller_)
     return;
 
-  omnibox::ToggleSuggestionGroupIdVisibility(profile()->GetPrefs(),
-                                             suggestion_group_id);
+  omnibox::SuggestionGroupVisibility new_value =
+      autocomplete_controller_->result().IsSuggestionGroupIdHidden(
+          profile()->GetPrefs(), suggestion_group_id)
+          ? omnibox::SuggestionGroupVisibility::SHOWN
+          : omnibox::SuggestionGroupVisibility::HIDDEN;
+  omnibox::SetSuggestionGroupVisibility(profile()->GetPrefs(),
+                                        suggestion_group_id, new_value);
 }
 
 void SearchTabHelper::LogCharTypedToRepaintLatency(uint32_t latency_ms) {
diff --git a/chrome/browser/ui/signin/profile_colors_util.cc b/chrome/browser/ui/signin/profile_colors_util.cc
new file mode 100644
index 0000000..fe3d547
--- /dev/null
+++ b/chrome/browser/ui/signin/profile_colors_util.cc
@@ -0,0 +1,32 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "chrome/browser/ui/signin/profile_colors_util.h"
+
+#include "chrome/browser/browser_process.h"
+#include "chrome/browser/profiles/profile_attributes_storage.h"
+#include "chrome/browser/profiles/profile_manager.h"
+#include "ui/gfx/color_utils.h"
+
+ProfileThemeColors GetThemeColorsForProfile(Profile* profile) {
+  DCHECK(profile->IsRegularProfile());
+  ProfileAttributesEntry* entry = nullptr;
+  g_browser_process->profile_manager()
+      ->GetProfileAttributesStorage()
+      .GetProfileAttributesWithPath(profile->GetPath(), &entry);
+  DCHECK(entry);
+  return entry->GetProfileThemeColors();
+}
+
+SkColor GetProfileForegroundTextColor(SkColor profile_highlight_color) {
+  return color_utils::GetColorWithMaxContrast(profile_highlight_color);
+}
+
+SkColor GetProfileForegroundIconColor(SkColor profile_highlight_color) {
+  SkColor text_color = GetProfileForegroundTextColor(profile_highlight_color);
+  SkColor icon_color = color_utils::DeriveDefaultIconColor(text_color);
+  return color_utils::BlendForMinContrast(icon_color, profile_highlight_color,
+                                          text_color)
+      .color;
+}
diff --git a/chrome/browser/ui/signin/profile_colors_util.h b/chrome/browser/ui/signin/profile_colors_util.h
new file mode 100644
index 0000000..b94cb28f
--- /dev/null
+++ b/chrome/browser/ui/signin/profile_colors_util.h
@@ -0,0 +1,25 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CHROME_BROWSER_UI_SIGNIN_PROFILE_COLORS_UTIL_H_
+#define CHROME_BROWSER_UI_SIGNIN_PROFILE_COLORS_UTIL_H_
+
+#include "chrome/browser/profiles/profile_attributes_entry.h"
+#include "third_party/skia/include/core/SkColor.h"
+
+class Profile;
+
+// Gets the profile theme colors associated with a profile. Does not support
+// incognito or guest profiles.
+ProfileThemeColors GetThemeColorsForProfile(Profile* profile);
+
+// Returns the color that should be used to display text over the profile
+// highlight color.
+SkColor GetProfileForegroundTextColor(SkColor profile_highlight_color);
+
+// Returns the color that should be used to display icons over the profile
+// highlight color.
+SkColor GetProfileForegroundIconColor(SkColor profile_highlight_color);
+
+#endif  // CHROME_BROWSER_UI_SIGNIN_PROFILE_COLORS_UTIL_H_
diff --git a/chrome/browser/ui/startup/startup_browser_creator.cc b/chrome/browser/ui/startup/startup_browser_creator.cc
index 4fe3b67b1..070f010 100644
--- a/chrome/browser/ui/startup/startup_browser_creator.cc
+++ b/chrome/browser/ui/startup/startup_browser_creator.cc
@@ -273,6 +273,8 @@
                                   ->GetProfileAttributesStorage()
                                   .GetNumberOfProfiles();
   return !signin_util::IsForceSigninEnabled() && number_of_profiles != 1 &&
+         g_browser_process->local_state()->GetBoolean(
+             prefs::kBrowserShowProfilePickerOnStartup) &&
          base::FeatureList::IsEnabled(features::kNewProfilePicker);
 }
 #endif  // !defined(OS_CHROMEOS)
diff --git a/chrome/browser/ui/sync/profile_signin_confirmation_helper_unittest.cc b/chrome/browser/ui/sync/profile_signin_confirmation_helper_unittest.cc
index 5ac2189..aa40eea 100644
--- a/chrome/browser/ui/sync/profile_signin_confirmation_helper_unittest.cc
+++ b/chrome/browser/ui/sync/profile_signin_confirmation_helper_unittest.cc
@@ -153,7 +153,7 @@
     // Initialize the services we check.
     model_ = BookmarkModelFactory::GetForBrowserContext(profile_.get());
     bookmarks::test::WaitForBookmarkModelToLoad(model_);
-    ASSERT_TRUE(profile_->CreateHistoryService(true, false));
+    ASSERT_TRUE(profile_->CreateHistoryService());
 #if BUILDFLAG(ENABLE_EXTENSIONS)
     extensions::TestExtensionSystem* system =
         static_cast<extensions::TestExtensionSystem*>(
diff --git a/chrome/browser/ui/tabs/existing_tab_group_sub_menu_model.h b/chrome/browser/ui/tabs/existing_tab_group_sub_menu_model.h
index 468e769..85b1f49 100644
--- a/chrome/browser/ui/tabs/existing_tab_group_sub_menu_model.h
+++ b/chrome/browser/ui/tabs/existing_tab_group_sub_menu_model.h
@@ -7,7 +7,6 @@
 
 #include <stddef.h>
 
-#include "base/macros.h"
 #include "chrome/browser/ui/tabs/existing_base_sub_menu_model.h"
 
 class TabStripModel;
@@ -21,6 +20,9 @@
   ExistingTabGroupSubMenuModel(ui::SimpleMenuModel::Delegate* parent_delegate,
                                TabStripModel* model,
                                int context_index);
+  ExistingTabGroupSubMenuModel(const ExistingTabGroupSubMenuModel&) = delete;
+  ExistingTabGroupSubMenuModel& operator=(const ExistingTabGroupSubMenuModel&) =
+      delete;
   ~ExistingTabGroupSubMenuModel() override = default;
 
   // Whether the submenu should be shown in the provided context. True iff
@@ -44,8 +46,6 @@
   static bool ShouldShowGroup(TabStripModel* model,
                               int context_index,
                               tab_groups::TabGroupId group);
-
-  DISALLOW_COPY_AND_ASSIGN(ExistingTabGroupSubMenuModel);
 };
 
 #endif  // CHROME_BROWSER_UI_TABS_EXISTING_TAB_GROUP_SUB_MENU_MODEL_H_
diff --git a/chrome/browser/ui/tabs/existing_window_sub_menu_model.h b/chrome/browser/ui/tabs/existing_window_sub_menu_model.h
index 86864310..fc0141b 100644
--- a/chrome/browser/ui/tabs/existing_window_sub_menu_model.h
+++ b/chrome/browser/ui/tabs/existing_window_sub_menu_model.h
@@ -18,6 +18,9 @@
   ExistingWindowSubMenuModel(ui::SimpleMenuModel::Delegate* parent_delegate,
                              TabStripModel* model,
                              int context_index);
+  ExistingWindowSubMenuModel(const ExistingWindowSubMenuModel&) = delete;
+  ExistingWindowSubMenuModel& operator=(const ExistingWindowSubMenuModel&) =
+      delete;
   ~ExistingWindowSubMenuModel() override;
 
   // ui::SimpleMenuModel
@@ -37,8 +40,6 @@
   // ExistingBaseSubMenuModel
   void ExecuteNewCommand(int event_flags) override;
   void ExecuteExistingCommand(int command_index) override;
-
-  DISALLOW_COPY_AND_ASSIGN(ExistingWindowSubMenuModel);
 };
 
 #endif  // CHROME_BROWSER_UI_TABS_EXISTING_WINDOW_SUB_MENU_MODEL_H_
diff --git a/chrome/browser/ui/tabs/hover_tab_selector.h b/chrome/browser/ui/tabs/hover_tab_selector.h
index 5fa4cf75..c8045ad 100644
--- a/chrome/browser/ui/tabs/hover_tab_selector.h
+++ b/chrome/browser/ui/tabs/hover_tab_selector.h
@@ -5,7 +5,6 @@
 #ifndef CHROME_BROWSER_UI_TABS_HOVER_TAB_SELECTOR_H_
 #define CHROME_BROWSER_UI_TABS_HOVER_TAB_SELECTOR_H_
 
-#include "base/macros.h"
 #include "base/memory/weak_ptr.h"
 
 class TabStripModel;
@@ -15,6 +14,8 @@
 class HoverTabSelector {
  public:
   explicit HoverTabSelector(TabStripModel* tab_strip_model);
+  HoverTabSelector(const HoverTabSelector&) = delete;
+  HoverTabSelector& operator=(const HoverTabSelector&) = delete;
   ~HoverTabSelector();
 
   // Begin a delayed tab transition to the tab at |index|. Only starts
@@ -38,8 +39,6 @@
 
   // Factory for creating tab transition tasks.
   base::WeakPtrFactory<HoverTabSelector> weak_factory_{this};
-
-  DISALLOW_COPY_AND_ASSIGN(HoverTabSelector);
 };
 
 #endif  // CHROME_BROWSER_UI_TABS_HOVER_TAB_SELECTOR_H_
diff --git a/chrome/browser/ui/tabs/pinned_tab_service.h b/chrome/browser/ui/tabs/pinned_tab_service.h
index f8f047fb..4c35bfb6 100644
--- a/chrome/browser/ui/tabs/pinned_tab_service.h
+++ b/chrome/browser/ui/tabs/pinned_tab_service.h
@@ -6,7 +6,6 @@
 #define CHROME_BROWSER_UI_TABS_PINNED_TAB_SERVICE_H_
 
 #include "base/compiler_specific.h"
-#include "base/macros.h"
 #include "base/scoped_observer.h"
 #include "chrome/browser/ui/browser_list_observer.h"
 #include "chrome/browser/ui/tabs/tab_strip_model.h"
@@ -26,6 +25,8 @@
                          public KeyedService {
  public:
   explicit PinnedTabService(Profile* profile);
+  PinnedTabService(const PinnedTabService&) = delete;
+  PinnedTabService& operator=(const PinnedTabService&) = delete;
   ~PinnedTabService() override;
 
  private:
@@ -57,8 +58,6 @@
   bool need_to_write_pinned_tabs_ = true;
 
   content::NotificationRegistrar registrar_;
-
-  DISALLOW_COPY_AND_ASSIGN(PinnedTabService);
 };
 
 #endif  // CHROME_BROWSER_UI_TABS_PINNED_TAB_SERVICE_H_
diff --git a/chrome/browser/ui/tabs/pinned_tab_service_browsertest.cc b/chrome/browser/ui/tabs/pinned_tab_service_browsertest.cc
index e18f680..672b3e61 100644
--- a/chrome/browser/ui/tabs/pinned_tab_service_browsertest.cc
+++ b/chrome/browser/ui/tabs/pinned_tab_service_browsertest.cc
@@ -27,6 +27,8 @@
   explicit BrowserRemovalWaiter(const Browser* browser) : browser_(browser) {
     BrowserList::AddObserver(this);
   }
+  BrowserRemovalWaiter(const BrowserRemovalWaiter&) = delete;
+  BrowserRemovalWaiter& operator=(const BrowserRemovalWaiter&) = delete;
   ~BrowserRemovalWaiter() override = default;
 
   void WaitForRemoval() {
@@ -47,8 +49,6 @@
 
   const Browser* const browser_;
   scoped_refptr<content::MessageLoopRunner> message_loop_runner_;
-
-  DISALLOW_COPY_AND_ASSIGN(BrowserRemovalWaiter);
 };
 
 using PinnedTabServiceBrowserTest = InProcessBrowserTest;
diff --git a/chrome/browser/ui/tabs/pinned_tab_service_unittest.cc b/chrome/browser/ui/tabs/pinned_tab_service_unittest.cc
index 0f3d2be..0218672 100644
--- a/chrome/browser/ui/tabs/pinned_tab_service_unittest.cc
+++ b/chrome/browser/ui/tabs/pinned_tab_service_unittest.cc
@@ -9,7 +9,6 @@
 #include <vector>
 
 #include "base/bind.h"
-#include "base/macros.h"
 #include "chrome/browser/ui/browser.h"
 #include "chrome/browser/ui/browser_tabstrip.h"
 #include "chrome/browser/ui/tabs/pinned_tab_codec.h"
@@ -36,6 +35,8 @@
 class PinnedTabServiceTest : public BrowserWithTestWindowTest {
  public:
   PinnedTabServiceTest() : pinned_tab_service_(nullptr) {}
+  PinnedTabServiceTest(const PinnedTabServiceTest&) = delete;
+  PinnedTabServiceTest& operator=(const PinnedTabServiceTest&) = delete;
 
  protected:
   TestingProfile* CreateProfile() override {
@@ -46,8 +47,6 @@
 
  private:
   PinnedTabService* pinned_tab_service_;
-
-  DISALLOW_COPY_AND_ASSIGN(PinnedTabServiceTest);
 };
 
 // Makes sure closing a popup triggers writing pinned tabs.
diff --git a/chrome/browser/ui/tabs/tab_activity_simulator.cc b/chrome/browser/ui/tabs/tab_activity_simulator.cc
index 8e4bc41..38209b4 100644
--- a/chrome/browser/ui/tabs/tab_activity_simulator.cc
+++ b/chrome/browser/ui/tabs/tab_activity_simulator.cc
@@ -18,12 +18,11 @@
     : public content::WebContentsObserver {
  public:
   explicit TestWebContentsObserver(content::WebContents* web_contents);
+  TestWebContentsObserver(const TestWebContentsObserver&) = delete;
+  TestWebContentsObserver& operator=(const TestWebContentsObserver&) = delete;
 
   // content::WebContentsObserver:
   void WebContentsDestroyed() override;
-
- private:
-  DISALLOW_COPY_AND_ASSIGN(TestWebContentsObserver);
 };
 
 TabActivitySimulator::TestWebContentsObserver::TestWebContentsObserver(
diff --git a/chrome/browser/ui/tabs/tab_activity_simulator.h b/chrome/browser/ui/tabs/tab_activity_simulator.h
index 1fde371..368764d 100644
--- a/chrome/browser/ui/tabs/tab_activity_simulator.h
+++ b/chrome/browser/ui/tabs/tab_activity_simulator.h
@@ -8,7 +8,6 @@
 #include <memory>
 #include <vector>
 
-#include "base/macros.h"
 #include "ui/base/page_transition_types.h"
 
 class GURL;
@@ -26,6 +25,8 @@
   class TestWebContentsObserver;
 
   TabActivitySimulator();
+  TabActivitySimulator(const TabActivitySimulator&) = delete;
+  TabActivitySimulator& operator=(const TabActivitySimulator&) = delete;
   ~TabActivitySimulator();
 
   // Simulates a navigation to |url| using the given transition type.
@@ -53,8 +54,6 @@
  private:
   // Owns the observers we've created.
   std::vector<std::unique_ptr<TestWebContentsObserver>> observers_;
-
-  DISALLOW_COPY_AND_ASSIGN(TabActivitySimulator);
 };
 
 #endif  // CHROME_BROWSER_UI_TABS_TAB_ACTIVITY_SIMULATOR_H_
diff --git a/chrome/browser/ui/tabs/tab_menu_model.h b/chrome/browser/ui/tabs/tab_menu_model.h
index c250cb7c..fa467ab5 100644
--- a/chrome/browser/ui/tabs/tab_menu_model.h
+++ b/chrome/browser/ui/tabs/tab_menu_model.h
@@ -5,7 +5,6 @@
 #ifndef CHROME_BROWSER_UI_TABS_TAB_MENU_MODEL_H_
 #define CHROME_BROWSER_UI_TABS_TAB_MENU_MODEL_H_
 
-#include "base/macros.h"
 #include "chrome/browser/ui/send_tab_to_self/send_tab_to_self_sub_menu_model.h"
 #include "ui/base/models/simple_menu_model.h"
 
@@ -25,6 +24,8 @@
   TabMenuModel(ui::SimpleMenuModel::Delegate* delegate,
                TabStripModel* tab_strip,
                int index);
+  TabMenuModel(const TabMenuModel&) = delete;
+  TabMenuModel& operator=(const TabMenuModel&) = delete;
   ~TabMenuModel() override;
 
  private:
@@ -36,8 +37,6 @@
   // Send tab to self submenu.
   std::unique_ptr<send_tab_to_self::SendTabToSelfSubMenuModel>
       send_tab_to_self_sub_menu_model_;
-
-  DISALLOW_COPY_AND_ASSIGN(TabMenuModel);
 };
 
 #endif  // CHROME_BROWSER_UI_TABS_TAB_MENU_MODEL_H_
diff --git a/chrome/browser/ui/tabs/tab_strip_model.cc b/chrome/browser/ui/tabs/tab_strip_model.cc
index 7b5ace6d..4e5178b 100644
--- a/chrome/browser/ui/tabs/tab_strip_model.cc
+++ b/chrome/browser/ui/tabs/tab_strip_model.cc
@@ -11,7 +11,6 @@
 
 #include "base/auto_reset.h"
 #include "base/containers/flat_map.h"
-#include "base/macros.h"
 #include "base/metrics/histogram_macros.h"
 #include "base/metrics/user_metrics.h"
 #include "base/numerics/ranges.h"
@@ -123,6 +122,11 @@
                                       "TabSwitchVisibilityRequest", this);
   }
 
+  RenderWidgetHostVisibilityTracker(const RenderWidgetHostVisibilityTracker&) =
+      delete;
+  RenderWidgetHostVisibilityTracker& operator=(
+      const RenderWidgetHostVisibilityTracker&) = delete;
+
   ~RenderWidgetHostVisibilityTracker() override {
     if (host_)
       host_->RemoveObserver(this);
@@ -150,8 +154,6 @@
 
   content::RenderWidgetHost* host_ = nullptr;
   base::ElapsedTimer timer_;
-
-  DISALLOW_COPY_AND_ASSIGN(RenderWidgetHostVisibilityTracker);
 };
 
 }  // namespace
@@ -164,6 +166,8 @@
 class TabStripModel::WebContentsData : public content::WebContentsObserver {
  public:
   explicit WebContentsData(std::unique_ptr<WebContents> a_contents);
+  WebContentsData(const WebContentsData&) = delete;
+  WebContentsData& operator=(const WebContentsData&) = delete;
 
   // Changes the WebContents that this WebContentsData tracks.
   std::unique_ptr<WebContents> ReplaceWebContents(
@@ -225,8 +229,6 @@
   //   - The exact shape of the group-related changes to the TabStripModel API
   //     (and the relevant bits of the extension API) are TBD.
   base::Optional<tab_groups::TabGroupId> group_ = base::nullopt;
-
-  DISALLOW_COPY_AND_ASSIGN(WebContentsData);
 };
 
 TabStripModel::WebContentsData::WebContentsData(
@@ -257,6 +259,8 @@
       : contents(std::move(contents)),
         index_before_any_removals(index_before_any_removals),
         index_at_time_of_removal(index_at_time_of_removal) {}
+  DetachedWebContents(const DetachedWebContents&) = delete;
+  DetachedWebContents& operator=(const DetachedWebContents&) = delete;
   ~DetachedWebContents() = default;
   DetachedWebContents(DetachedWebContents&&) = default;
 
@@ -271,9 +275,6 @@
   // tabs are being simultaneously removed, the index reflects previously
   // removed tabs in this batch.
   const int index_at_time_of_removal;
-
- private:
-  DISALLOW_COPY_AND_ASSIGN(DetachedWebContents);
 };
 
 // Holds all state necessary to send notifications for detached tabs. Will
@@ -285,6 +286,8 @@
       : initially_active_web_contents(initially_active_web_contents),
         selection_model(selection_model),
         will_delete(will_delete) {}
+  DetachNotifications(const DetachNotifications&) = delete;
+  DetachNotifications& operator=(const DetachNotifications&) = delete;
   ~DetachNotifications() = default;
 
   // The WebContents that was active prior to any detaches happening.
@@ -305,9 +308,6 @@
 
   // Whether to delete the WebContents after sending notifications.
   const bool will_delete;
-
- private:
-  DISALLOW_COPY_AND_ASSIGN(DetachNotifications);
 };
 
 ///////////////////////////////////////////////////////////////////////////////
diff --git a/chrome/browser/ui/tabs/tab_strip_model_delegate.h b/chrome/browser/ui/tabs/tab_strip_model_delegate.h
index a4683ee..89c543ec 100644
--- a/chrome/browser/ui/tabs/tab_strip_model_delegate.h
+++ b/chrome/browser/ui/tabs/tab_strip_model_delegate.h
@@ -8,7 +8,6 @@
 #include <memory>
 #include <vector>
 
-#include "base/macros.h"
 #include "base/optional.h"
 #include "components/tab_groups/tab_group_id.h"
 
@@ -67,15 +66,14 @@
   // TabStripModelDelegate, or perhaps even move this code elsewhere.
   struct NewStripContents {
     NewStripContents();
+    NewStripContents(const NewStripContents&) = delete;
+    NewStripContents& operator=(const NewStripContents&) = delete;
     ~NewStripContents();
     NewStripContents(NewStripContents&&);
     // The WebContents to add.
     std::unique_ptr<content::WebContents> web_contents;
     // A bitmask of TabStripModel::AddTabTypes to apply to the added contents.
     int add_types = 0;
-
-   private:
-    DISALLOW_COPY_AND_ASSIGN(NewStripContents);
   };
   virtual Browser* CreateNewStripWithContents(
       std::vector<NewStripContents> contentses,
diff --git a/chrome/browser/ui/tabs/tab_strip_model_observer.h b/chrome/browser/ui/tabs/tab_strip_model_observer.h
index 6983e6a5..6218040 100644
--- a/chrome/browser/ui/tabs/tab_strip_model_observer.h
+++ b/chrome/browser/ui/tabs/tab_strip_model_observer.h
@@ -8,7 +8,6 @@
 #include <memory>
 #include <vector>
 
-#include "base/macros.h"
 #include "base/optional.h"
 #include "chrome/browser/ui/tabs/tab_change_type.h"
 #include "components/tab_groups/tab_group_id.h"
@@ -141,6 +140,8 @@
   explicit TabStripModelChange(Remove delta);
   explicit TabStripModelChange(Replace delta);
   explicit TabStripModelChange(Move delta);
+  TabStripModelChange(const TabStripModelChange&) = delete;
+  TabStripModelChange& operator=(const TabStripModelChange&) = delete;
   ~TabStripModelChange();
 
   Type type() const { return type_; }
@@ -154,8 +155,6 @@
 
   const Type type_ = kSelectionOnly;
   std::unique_ptr<Delta> delta_;
-
-  DISALLOW_COPY_AND_ASSIGN(TabStripModelChange);
 };
 
 // Struct to carry changes on selection/activation.
@@ -243,6 +242,9 @@
     kCloseAllCompleted = 1,
   };
 
+  TabStripModelObserver(const TabStripModelObserver&) = delete;
+  TabStripModelObserver& operator=(const TabStripModelObserver&) = delete;
+
   // |change| is a series of changes in tabstrip model. |change| consists
   // of changes with same type and those changes may have caused selection or
   // activation changes. |selection| is determined by comparing the state of
@@ -337,8 +339,6 @@
 
  private:
   std::set<TabStripModel*> observed_models_;
-
-  DISALLOW_COPY_AND_ASSIGN(TabStripModelObserver);
 };
 
 #endif  // CHROME_BROWSER_UI_TABS_TAB_STRIP_MODEL_OBSERVER_H_
diff --git a/chrome/browser/ui/tabs/tab_strip_model_order_controller.h b/chrome/browser/ui/tabs/tab_strip_model_order_controller.h
index 2aa5ec3..c7beebb8 100644
--- a/chrome/browser/ui/tabs/tab_strip_model_order_controller.h
+++ b/chrome/browser/ui/tabs/tab_strip_model_order_controller.h
@@ -5,7 +5,6 @@
 #ifndef CHROME_BROWSER_UI_TABS_TAB_STRIP_MODEL_ORDER_CONTROLLER_H_
 #define CHROME_BROWSER_UI_TABS_TAB_STRIP_MODEL_ORDER_CONTROLLER_H_
 
-#include "base/macros.h"
 #include "chrome/browser/ui/tabs/tab_strip_model_observer.h"
 #include "ui/base/page_transition_types.h"
 
@@ -20,6 +19,9 @@
 class TabStripModelOrderController : public TabStripModelObserver {
  public:
   explicit TabStripModelOrderController(TabStripModel* model);
+  TabStripModelOrderController(const TabStripModelOrderController&) = delete;
+  TabStripModelOrderController& operator=(const TabStripModelOrderController&) =
+      delete;
   ~TabStripModelOrderController() override;
 
   // Determine where to place a newly opened tab by using the supplied
@@ -43,8 +45,6 @@
   int GetValidIndex(int index, int removing_index) const;
 
   TabStripModel* model_;
-
-  DISALLOW_COPY_AND_ASSIGN(TabStripModelOrderController);
 };
 
 #endif  // CHROME_BROWSER_UI_TABS_TAB_STRIP_MODEL_ORDER_CONTROLLER_H_
diff --git a/chrome/browser/ui/tabs/tab_strip_model_stats_recorder.h b/chrome/browser/ui/tabs/tab_strip_model_stats_recorder.h
index 0b4f164..b5eb942 100644
--- a/chrome/browser/ui/tabs/tab_strip_model_stats_recorder.h
+++ b/chrome/browser/ui/tabs/tab_strip_model_stats_recorder.h
@@ -7,7 +7,6 @@
 
 #include <vector>
 
-#include "base/macros.h"
 #include "chrome/browser/ui/browser_tab_strip_tracker.h"
 #include "chrome/browser/ui/tabs/tab_strip_model_observer.h"
 
@@ -45,6 +44,9 @@
   };
 
   TabStripModelStatsRecorder();
+  TabStripModelStatsRecorder(const TabStripModelStatsRecorder&) = delete;
+  TabStripModelStatsRecorder& operator=(const TabStripModelStatsRecorder&) =
+      delete;
   ~TabStripModelStatsRecorder() override;
 
  private:
@@ -67,8 +69,6 @@
   std::vector<content::WebContents*> active_tab_history_;
 
   BrowserTabStripTracker browser_tab_strip_tracker_;
-
-  DISALLOW_COPY_AND_ASSIGN(TabStripModelStatsRecorder);
 };
 
 #endif  // CHROME_BROWSER_UI_TABS_TAB_STRIP_MODEL_STATS_RECORDER_H_
diff --git a/chrome/browser/ui/tabs/tab_strip_model_unittest.cc b/chrome/browser/ui/tabs/tab_strip_model_unittest.cc
index f7309d3..f31ce31 100644
--- a/chrome/browser/ui/tabs/tab_strip_model_unittest.cc
+++ b/chrome/browser/ui/tabs/tab_strip_model_unittest.cc
@@ -59,6 +59,9 @@
 class MockTabStripModelObserver : public TabStripModelObserver {
  public:
   MockTabStripModelObserver() = default;
+  MockTabStripModelObserver(const MockTabStripModelObserver&) = delete;
+  MockTabStripModelObserver& operator=(const MockTabStripModelObserver&) =
+      delete;
   ~MockTabStripModelObserver() override = default;
 
   enum TabStripModelObserverAction {
@@ -330,8 +333,6 @@
  private:
   std::vector<State> states_;
   std::map<tab_groups::TabGroupId, TabGroupUpdate> group_updates_;
-
-  DISALLOW_COPY_AND_ASSIGN(MockTabStripModelObserver);
 };
 
 const char* const MockTabStripModelObserver::State::kActionNames[]{
diff --git a/chrome/browser/ui/tabs/tab_style.h b/chrome/browser/ui/tabs/tab_style.h
index f2f445e..37538b5 100644
--- a/chrome/browser/ui/tabs/tab_style.h
+++ b/chrome/browser/ui/tabs/tab_style.h
@@ -5,7 +5,6 @@
 #ifndef CHROME_BROWSER_UI_TABS_TAB_STYLE_H_
 #define CHROME_BROWSER_UI_TABS_TAB_STYLE_H_
 
-#include "base/macros.h"
 #include "third_party/skia/include/core/SkColor.h"
 #include "ui/gfx/font_list.h"
 #include "ui/gfx/geometry/insets.h"
@@ -79,6 +78,8 @@
     SkColor background_color;
   };
 
+  TabStyle(const TabStyle&) = delete;
+  TabStyle& operator=(const TabStyle&) = delete;
   virtual ~TabStyle();
 
   // Gets the specific |path_type| associated with the specific |tab|.
@@ -156,9 +157,6 @@
   // Returns how far from the leading and trailing edges of a tab the contents
   // should actually be laid out.
   static int GetContentsHorizontalInsetSize();
-
- private:
-  DISALLOW_COPY_AND_ASSIGN(TabStyle);
 };
 
 #endif  // CHROME_BROWSER_UI_TABS_TAB_STYLE_H_
diff --git a/chrome/browser/ui/tabs/tab_switch_event_latency_recorder.h b/chrome/browser/ui/tabs/tab_switch_event_latency_recorder.h
index 483171a..fb8c229 100644
--- a/chrome/browser/ui/tabs/tab_switch_event_latency_recorder.h
+++ b/chrome/browser/ui/tabs/tab_switch_event_latency_recorder.h
@@ -6,7 +6,6 @@
 #define CHROME_BROWSER_UI_TABS_TAB_SWITCH_EVENT_LATENCY_RECORDER_H_
 
 #include "base/gtest_prod_util.h"
-#include "base/macros.h"
 #include "base/optional.h"
 #include "base/time/time.h"
 
@@ -18,6 +17,9 @@
   enum class EventType { kMouse, kKeyboard, kTouch, kWheel, kOther };
 
   TabSwitchEventLatencyRecorder();
+  TabSwitchEventLatencyRecorder(const TabSwitchEventLatencyRecorder&) = delete;
+  TabSwitchEventLatencyRecorder& operator=(
+      const TabSwitchEventLatencyRecorder&) = delete;
 
   // Starts timing the tab switch input event latency. If this is called again
   // without a following OnWillChangeActiveTab, this will overwrite the
@@ -37,8 +39,6 @@
  private:
   base::TimeTicks input_event_timestamp_ = base::TimeTicks();
   base::Optional<EventType> event_type_ = base::nullopt;
-
-  DISALLOW_COPY_AND_ASSIGN(TabSwitchEventLatencyRecorder);
 };
 
 #endif  // CHROME_BROWSER_UI_TABS_TAB_SWITCH_EVENT_LATENCY_RECORDER_H_
diff --git a/chrome/browser/ui/tabs/tab_ukm_test_helper.h b/chrome/browser/ui/tabs/tab_ukm_test_helper.h
index 7217282..571183e4 100644
--- a/chrome/browser/ui/tabs/tab_ukm_test_helper.h
+++ b/chrome/browser/ui/tabs/tab_ukm_test_helper.h
@@ -7,7 +7,6 @@
 
 #include <map>
 
-#include "base/macros.h"
 #include "base/optional.h"
 #include "components/ukm/test_ukm_recorder.h"
 
@@ -27,6 +26,8 @@
 class UkmEntryChecker {
  public:
   UkmEntryChecker();
+  UkmEntryChecker(const UkmEntryChecker&) = delete;
+  UkmEntryChecker& operator=(const UkmEntryChecker&) = delete;
   ~UkmEntryChecker();
 
   // Expects that the next untested entry for |entry_name| matches the value
@@ -72,8 +73,6 @@
   // |num_entries_| records the number of entries that have been expected via
   // calls to ExpectNewEntries() or similar.
   std::map<std::string, size_t> num_entries_;
-
-  DISALLOW_COPY_AND_ASSIGN(UkmEntryChecker);
 };
 
 #endif  // CHROME_BROWSER_UI_TABS_TAB_UKM_TEST_HELPER_H_
diff --git a/chrome/browser/ui/tabs/test_tab_strip_model_delegate.h b/chrome/browser/ui/tabs/test_tab_strip_model_delegate.h
index 0253a30..7c1bb84 100644
--- a/chrome/browser/ui/tabs/test_tab_strip_model_delegate.h
+++ b/chrome/browser/ui/tabs/test_tab_strip_model_delegate.h
@@ -6,7 +6,6 @@
 #define CHROME_BROWSER_UI_TABS_TEST_TAB_STRIP_MODEL_DELEGATE_H_
 
 #include "base/compiler_specific.h"
-#include "base/macros.h"
 #include "base/optional.h"
 #include "chrome/browser/ui/tabs/tab_strip_model_delegate.h"
 #include "components/tab_groups/tab_group_id.h"
@@ -19,6 +18,9 @@
 class TestTabStripModelDelegate : public TabStripModelDelegate {
  public:
   TestTabStripModelDelegate();
+  TestTabStripModelDelegate(const TestTabStripModelDelegate&) = delete;
+  TestTabStripModelDelegate& operator=(const TestTabStripModelDelegate&) =
+      delete;
   ~TestTabStripModelDelegate() override;
 
   // Overridden from TabStripModelDelegate:
@@ -44,9 +46,6 @@
       content::WebContents* contents) override;
   bool RunUnloadListenerBeforeClosing(content::WebContents* contents) override;
   bool ShouldDisplayFavicon(content::WebContents* web_contents) const override;
-
- private:
-  DISALLOW_COPY_AND_ASSIGN(TestTabStripModelDelegate);
 };
 
 #endif  // CHROME_BROWSER_UI_TABS_TEST_TAB_STRIP_MODEL_DELEGATE_H_
diff --git a/chrome/browser/ui/ui_features.cc b/chrome/browser/ui/ui_features.cc
index 58b6c6c..3db0665 100644
--- a/chrome/browser/ui/ui_features.cc
+++ b/chrome/browser/ui/ui_features.cc
@@ -73,14 +73,8 @@
 
 // Enables popup cards containing tab information when hovering over a tab.
 // https://crbug.com/910739
-const base::Feature kTabHoverCards {
-  "TabHoverCards",
-#if defined(OS_MAC)
-      base::FEATURE_DISABLED_BY_DEFAULT
-#else
-      base::FEATURE_ENABLED_BY_DEFAULT
-#endif  // defined(OS_MAC)
-};
+const base::Feature kTabHoverCards{"TabHoverCards",
+                                   base::FEATURE_ENABLED_BY_DEFAULT};
 
 // Parameter name used for tab hover cards user study.
 // TODO(corising): Removed this after tab hover cards user study.
diff --git a/chrome/browser/ui/views/bookmarks/bookmark_drag_drop_views.cc b/chrome/browser/ui/views/bookmarks/bookmark_drag_drop_views.cc
index 5ec506a..d9e33fa 100644
--- a/chrome/browser/ui/views/bookmarks/bookmark_drag_drop_views.cc
+++ b/chrome/browser/ui/views/bookmarks/bookmark_drag_drop_views.cc
@@ -19,6 +19,7 @@
 #include "components/bookmarks/browser/bookmark_node_data.h"
 #include "components/bookmarks/browser/bookmark_utils.h"
 #include "ui/base/dragdrop/drag_drop_types.h"
+#include "ui/base/dragdrop/mojom/drag_drop_types.mojom-shared.h"
 #include "ui/base/dragdrop/os_exchange_data.h"
 #include "ui/base/l10n/l10n_util.h"
 #include "ui/base/resource/resource_bundle.h"
@@ -262,7 +263,7 @@
   int64_t drag_node_id_ = -1;
   int count_;
   gfx::NativeView native_view_;
-  ui::DragDropTypes::DragEventSource source_;
+  ui::mojom::DragEventSource source_;
   const gfx::Point start_point_;
   int operation_;
 
@@ -280,7 +281,7 @@
 
 void DoDragImpl(std::unique_ptr<ui::OSExchangeData> drag_data,
                 gfx::NativeView native_view,
-                ui::DragDropTypes::DragEventSource source,
+                ui::mojom::DragEventSource source,
                 gfx::Point point,
                 int operation) {
   // Allow nested run loop so we get DnD events as we drag this around.
diff --git a/chrome/browser/ui/views/drag_and_drop_interactive_uitest.cc b/chrome/browser/ui/views/drag_and_drop_interactive_uitest.cc
index 53368f8..4557396 100644
--- a/chrome/browser/ui/views/drag_and_drop_interactive_uitest.cc
+++ b/chrome/browser/ui/views/drag_and_drop_interactive_uitest.cc
@@ -277,7 +277,7 @@
                        aura::Window* source_window,
                        const gfx::Point& screen_location,
                        int operation,
-                       ui::DragDropTypes::DragEventSource source) override {
+                       ui::mojom::DragEventSource source) override {
     DCHECK(!drag_started_);
     if (!drag_started_) {
       drag_started_ = true;
diff --git a/chrome/browser/ui/views/native_file_system/native_file_system_browsertest.cc b/chrome/browser/ui/views/native_file_system/native_file_system_browsertest.cc
index 4bbb80e..9d44050 100644
--- a/chrome/browser/ui/views/native_file_system/native_file_system_browsertest.cc
+++ b/chrome/browser/ui/views/native_file_system/native_file_system_browsertest.cc
@@ -376,8 +376,8 @@
   HostContentSettingsMap* host_content_settings_map =
       HostContentSettingsMapFactory::GetForProfile(browser()->profile());
   host_content_settings_map->SetContentSettingDefaultScope(
-      url, url, ContentSettingsType::NATIVE_FILE_SYSTEM_WRITE_GUARD,
-      std::string(), CONTENT_SETTING_ALLOW);
+      url, url, ContentSettingsType::FILE_SYSTEM_WRITE_GUARD, std::string(),
+      CONTENT_SETTING_ALLOW);
 
   // If a prompt shows up, deny it.
   NativeFileSystemPermissionRequestManager::FromWebContents(web_contents)
@@ -428,8 +428,8 @@
   HostContentSettingsMap* host_content_settings_map =
       HostContentSettingsMapFactory::GetForProfile(browser()->profile());
   host_content_settings_map->SetContentSettingDefaultScope(
-      url, url, ContentSettingsType::NATIVE_FILE_SYSTEM_WRITE_GUARD,
-      std::string(), CONTENT_SETTING_ALLOW);
+      url, url, ContentSettingsType::FILE_SYSTEM_WRITE_GUARD, std::string(),
+      CONTENT_SETTING_ALLOW);
 
   // If a prompt shows up, deny it.
   NativeFileSystemPermissionRequestManager::FromWebContents(web_contents)
diff --git a/chrome/browser/ui/views/omnibox/omnibox_popup_contents_view.cc b/chrome/browser/ui/views/omnibox/omnibox_popup_contents_view.cc
index 21aa803..8085a8ca 100644
--- a/chrome/browser/ui/views/omnibox/omnibox_popup_contents_view.cc
+++ b/chrome/browser/ui/views/omnibox/omnibox_popup_contents_view.cc
@@ -367,7 +367,7 @@
       // Set visibility of the result view based on whether the group is hidden.
       bool match_hidden = pref_service &&
                           match.suggestion_group_id.has_value() &&
-                          omnibox::IsSuggestionGroupIdHidden(
+                          model_->result().IsSuggestionGroupIdHidden(
                               pref_service, match.suggestion_group_id.value());
       result_view->SetVisible(!match_hidden);
 
@@ -556,8 +556,8 @@
     const AutocompleteMatch& match = model_->result().match_at(i);
     bool match_hidden =
         match.suggestion_group_id.has_value() &&
-        omnibox::IsSuggestionGroupIdHidden(GetPrefService(),
-                                           match.suggestion_group_id.value());
+        model_->result().IsSuggestionGroupIdHidden(
+            GetPrefService(), match.suggestion_group_id.value());
     if (OmniboxResultView* result_view = result_view_at(i))
       result_view->SetVisible(!match_hidden);
   }
diff --git a/chrome/browser/ui/views/omnibox/omnibox_row_view.cc b/chrome/browser/ui/views/omnibox/omnibox_row_view.cc
index b6d15e7..16142e8 100644
--- a/chrome/browser/ui/views/omnibox/omnibox_row_view.cc
+++ b/chrome/browser/ui/views/omnibox/omnibox_row_view.cc
@@ -82,8 +82,9 @@
     header_label_->SetText(base::i18n::ToUpper(header_text_));
 
     if (row_view_->pref_service_) {
-      suggestion_group_hidden_ = omnibox::IsSuggestionGroupIdHidden(
-          row_view_->pref_service_, suggestion_group_id_);
+      suggestion_group_hidden_ =
+          row_view_->popup_model_->result().IsSuggestionGroupIdHidden(
+              row_view_->pref_service_, suggestion_group_id_);
 
       header_toggle_button_->SetToggled(suggestion_group_hidden_);
     }
@@ -192,8 +193,9 @@
   void OnPrefChanged() {
     DCHECK(row_view_->pref_service_);
     bool was_hidden = suggestion_group_hidden_;
-    suggestion_group_hidden_ = omnibox::IsSuggestionGroupIdHidden(
-        row_view_->pref_service_, suggestion_group_id_);
+    suggestion_group_hidden_ =
+        row_view_->popup_model_->result().IsSuggestionGroupIdHidden(
+            row_view_->pref_service_, suggestion_group_id_);
 
     if (was_hidden != suggestion_group_hidden_) {
       NotifyAccessibilityEvent(ax::mojom::Event::kExpandedChanged, true);
diff --git a/chrome/browser/ui/views/page_info/page_info_bubble_view_unittest.cc b/chrome/browser/ui/views/page_info/page_info_bubble_view_unittest.cc
index 3867194..853e3b62 100644
--- a/chrome/browser/ui/views/page_info/page_info_bubble_view_unittest.cc
+++ b/chrome/browser/ui/views/page_info/page_info_bubble_view_unittest.cc
@@ -272,9 +272,7 @@
   TestingProfile* profile =
       static_cast<TestingProfile*>(web_contents_helper_.profile());
   ukm::TestAutoSetUkmRecorder ukm_recorder;
-  ASSERT_TRUE(profile->CreateHistoryService(
-      /* delete_file= */ true,
-      /* no_db= */ false));
+  ASSERT_TRUE(profile->CreateHistoryService());
   auto* history_service = HistoryServiceFactory::GetForProfile(
       profile, ServiceAccessType::EXPLICIT_ACCESS);
   history_service->AddPage(origin_url, base::Time::Now(),
@@ -320,9 +318,7 @@
 
   TestingProfile* profile =
       static_cast<TestingProfile*>(web_contents_helper_.profile());
-  ASSERT_TRUE(profile->CreateHistoryService(
-      /* delete_file= */ true,
-      /* no_db= */ false));
+  ASSERT_TRUE(profile->CreateHistoryService());
 
   PermissionInfoList list(1);
   list.back().type = ContentSettingsType::GEOLOCATION;
diff --git a/chrome/browser/ui/views/page_info/safety_tip_page_info_bubble_view_browsertest.cc b/chrome/browser/ui/views/page_info/safety_tip_page_info_bubble_view_browsertest.cc
index 068433d..51c6ad563 100644
--- a/chrome/browser/ui/views/page_info/safety_tip_page_info_bubble_view_browsertest.cc
+++ b/chrome/browser/ui/views/page_info/safety_tip_page_info_bubble_view_browsertest.cc
@@ -62,7 +62,7 @@
 
 enum class UIStatus {
   kDisabled,
-  kEnabledWithNoFeatures,
+  kEnabledWithDefaultFeatures,
   kEnabledWithSuspiciousSites,
   kEnabledWithAllFeatures,
 };
@@ -233,13 +233,14 @@
   UIStatus ui_status() const { return GetParam(); }
 
   bool IsSuspiciousSiteWarningEnabled() const {
-    return ui_status() == UIStatus::kEnabledWithSuspiciousSites ||
+    return ui_status() == UIStatus::kEnabledWithDefaultFeatures ||
+           ui_status() == UIStatus::kEnabledWithSuspiciousSites ||
            ui_status() == UIStatus::kEnabledWithAllFeatures;
   }
 
   bool AreLookalikeWarningsEnabled() const {
     // By default, lookalike detection is enabled unless explicitly turned off.
-    return ui_status() == UIStatus::kEnabledWithNoFeatures ||
+    return ui_status() == UIStatus::kEnabledWithDefaultFeatures ||
            ui_status() == UIStatus::kEnabledWithAllFeatures;
   }
 
@@ -249,7 +250,7 @@
         feature_list_.InitAndDisableFeature(
             security_state::features::kSafetyTipUI);
         break;
-      case UIStatus::kEnabledWithNoFeatures:
+      case UIStatus::kEnabledWithDefaultFeatures:
         feature_list_.InitAndEnableFeature(
             security_state::features::kSafetyTipUI);
         break;
@@ -325,11 +326,7 @@
   }
 
   bool IsUIShowingOrSuspiciousSitesDisabled() {
-    auto status = ui_status();
-    if (status == UIStatus::kEnabledWithSuspiciousSites ||
-        status == UIStatus::kEnabledWithAllFeatures)
-      return IsUIShowing();
-    return !IsUIShowing();
+    return IsSuspiciousSiteWarningEnabled() ? IsUIShowing() : !IsUIShowing();
   }
 
   bool IsUIShowingOrAllFeaturesEnabled() {
@@ -432,7 +429,7 @@
     All,
     SafetyTipPageInfoBubbleViewBrowserTest,
     ::testing::Values(UIStatus::kDisabled,
-                      UIStatus::kEnabledWithNoFeatures,
+                      UIStatus::kEnabledWithDefaultFeatures,
                       UIStatus::kEnabledWithSuspiciousSites,
                       UIStatus::kEnabledWithAllFeatures));
 
@@ -1096,8 +1093,7 @@
     // If a warning should show, dismiss it to ensure UKM data gets recorded.
     if ((test_case.expected_results.lookalike_heuristic_triggered ||
          test_case.expected_results.blocklist_heuristic_triggered) &&
-        (ui_status() == UIStatus::kEnabledWithAllFeatures ||
-         ui_status() == UIStatus::kEnabledWithSuspiciousSites)) {
+        IsSuspiciousSiteWarningEnabled()) {
       CloseWarningLeaveSite(browser());
     }
   }
diff --git a/chrome/browser/ui/views/profiles/incognito_menu_view.cc b/chrome/browser/ui/views/profiles/incognito_menu_view.cc
index 6f2d307..f4eac332 100644
--- a/chrome/browser/ui/views/profiles/incognito_menu_view.cc
+++ b/chrome/browser/ui/views/profiles/incognito_menu_view.cc
@@ -46,7 +46,9 @@
           browser()->profile());
 
   SetProfileIdentityInfo(
-      /*profile_name=*/base::string16(), /*edit_button=*/base::nullopt,
+      /*profile_name=*/base::string16(),
+      /*background_color=*/SK_ColorTRANSPARENT,
+      /*edit_button=*/base::nullopt,
       ui::ImageModel::FromVectorIcon(
           kIncognitoProfileIcon, ui::NativeTheme::kColorId_BubbleForeground),
       l10n_util::GetStringUTF16(IDS_INCOGNITO_PROFILE_MENU_TITLE),
diff --git a/chrome/browser/ui/views/profiles/profile_menu_view.cc b/chrome/browser/ui/views/profiles/profile_menu_view.cc
index 5ba04c8..21ac353 100644
--- a/chrome/browser/ui/views/profiles/profile_menu_view.cc
+++ b/chrome/browser/ui/views/profiles/profile_menu_view.cc
@@ -34,6 +34,7 @@
 #include "chrome/browser/ui/browser_list.h"
 #include "chrome/browser/ui/browser_navigator_params.h"
 #include "chrome/browser/ui/passwords/manage_passwords_view_utils.h"
+#include "chrome/browser/ui/signin/profile_colors_util.h"
 #include "chrome/browser/ui/sync/sync_promo_ui.h"
 #include "chrome/browser/ui/ui_features.h"
 #include "chrome/browser/ui/views/accessibility/non_accessible_image_view.h"
@@ -456,9 +457,11 @@
   }
 #endif
 
+  SkColor background_color =
+      GetThemeColorsForProfile(profile).profile_highlight_color;
   if (account_info.has_value()) {
     SetProfileIdentityInfo(
-        profile_name, edit_button_params,
+        profile_name, background_color, edit_button_params,
         ui::ImageModel::FromImage(account_info.value().account_image),
         base::UTF8ToUTF16(account_info.value().full_name),
         IsSyncPaused(profile)
@@ -466,7 +469,7 @@
             : base::UTF8ToUTF16(account_info.value().email));
   } else {
     SetProfileIdentityInfo(
-        profile_name, edit_button_params,
+        profile_name, background_color, edit_button_params,
         ui::ImageModel::FromImage(profile_attributes->GetAvatarIcon()),
         /*title=*/base::string16(),
         l10n_util::GetStringUTF16(IDS_PROFILES_LOCAL_PROFILE_STATE));
@@ -475,6 +478,7 @@
 
 void ProfileMenuView::BuildGuestIdentity() {
   SetProfileIdentityInfo(/*profile_name=*/base::string16(),
+                         /*background_color=*/SK_ColorTRANSPARENT,
                          /*edit_button=*/base::nullopt,
                          profiles::GetGuestAvatar(),
                          l10n_util::GetStringUTF16(IDS_GUEST_PROFILE_NAME));
diff --git a/chrome/browser/ui/views/profiles/profile_menu_view_base.cc b/chrome/browser/ui/views/profiles/profile_menu_view_base.cc
index 1c8c931..cb6535d 100644
--- a/chrome/browser/ui/views/profiles/profile_menu_view_base.cc
+++ b/chrome/browser/ui/views/profiles/profile_menu_view_base.cc
@@ -18,6 +18,7 @@
 #include "chrome/browser/signin/signin_ui_util.h"
 #include "chrome/browser/themes/theme_properties.h"
 #include "chrome/browser/ui/chrome_pages.h"
+#include "chrome/browser/ui/signin/profile_colors_util.h"
 #include "chrome/browser/ui/ui_features.h"
 #include "chrome/browser/ui/views/chrome_layout_provider.h"
 #include "chrome/browser/ui/views/chrome_typography.h"
@@ -155,15 +156,14 @@
 
 class CircularImageButton : public views::ImageButton {
  public:
-  CircularImageButton(
-      views::ButtonListener* listener,
-      const gfx::VectorIcon& icon,
-      const base::string16& text,
-      SkColor background_color_for_contrast = SK_ColorTRANSPARENT,
-      bool show_border = false)
+  CircularImageButton(views::ButtonListener* listener,
+                      const gfx::VectorIcon& icon,
+                      const base::string16& text,
+                      SkColor background_profile_color = SK_ColorTRANSPARENT,
+                      bool show_border = false)
       : ImageButton(listener),
         icon_(icon),
-        background_color_for_contrast_(background_color_for_contrast),
+        background_profile_color_(background_profile_color),
         show_border_(show_border) {
     SetTooltipText(text);
     SetInkDropMode(views::Button::InkDropMode::ON);
@@ -182,13 +182,8 @@
 
     SkColor icon_color = GetNativeTheme()->GetSystemColor(
         ui::NativeTheme::kColorId_DefaultIconColor);
-    if (background_color_for_contrast_ != SK_ColorTRANSPARENT) {
-      // Adjust |icon_color| to assure high enough contrast with the bg.
-      icon_color = color_utils::BlendForMinContrast(
-                       icon_color, background_color_for_contrast_)
-                       .color;
-    }
-
+    if (background_profile_color_ != SK_ColorTRANSPARENT)
+      icon_color = GetProfileForegroundIconColor(background_profile_color_);
     gfx::ImageSkia image =
         ImageForMenu(icon_, kShortcutIconToImageRatio, icon_color);
     SetImage(views::Button::STATE_NORMAL,
@@ -205,7 +200,7 @@
 
  private:
   const gfx::VectorIcon& icon_;
-  const SkColor background_color_for_contrast_;
+  const SkColor background_profile_color_;
   bool show_border_;
 };
 
@@ -506,6 +501,7 @@
 
 void ProfileMenuViewBase::SetProfileIdentityInfo(
     const base::string16& profile_name,
+    SkColor profile_background_color,
     base::Optional<EditButtonParams> edit_button_params,
     const ui::ImageModel& image_model,
     const base::string16& title,
@@ -560,13 +556,7 @@
   // Only show a colored background when there is an edit button (this
   // coincides with the profile being a real profile that can be edited).
   if (edit_button_params.has_value()) {
-    // We get the theme provider from the anchor view since our widget hasn't
-    // been created yet.
-    const ui::ThemeProvider* theme_provider =
-        anchor_button_->GetThemeProvider();
-    DCHECK(theme_provider);
-    background_color =
-        theme_provider->GetColor(ThemeProperties::COLOR_FRAME_ACTIVE);
+    background_color = profile_background_color;
   }
 
   std::unique_ptr<views::Label> heading_label;
@@ -579,9 +569,9 @@
     heading_label->SetElideBehavior(gfx::ELIDE_TAIL);
     heading_label->SetHorizontalAlignment(gfx::ALIGN_CENTER);
     if (background_color) {
-      // This only informs the label about the color it is put on so that it can
-      // assure minimum contrast automatically.
-      heading_label->SetBackgroundColor(*background_color);
+      heading_label->SetAutoColorReadabilityEnabled(false);
+      heading_label->SetEnabledColor(
+          GetProfileForegroundTextColor(*background_color));
     }
   }
 
diff --git a/chrome/browser/ui/views/profiles/profile_menu_view_base.h b/chrome/browser/ui/views/profiles/profile_menu_view_base.h
index a8e2c204b..4018409 100644
--- a/chrome/browser/ui/views/profiles/profile_menu_view_base.h
+++ b/chrome/browser/ui/views/profiles/profile_menu_view_base.h
@@ -120,6 +120,7 @@
   // If |profile_name| is empty, no heading will be displayed.
   void SetProfileIdentityInfo(
       const base::string16& profile_name,
+      SkColor profile_background_color,
       base::Optional<EditButtonParams> edit_button_params,
       const ui::ImageModel& image_model,
       const base::string16& title,
diff --git a/chrome/browser/ui/views/tabs/tab_strip_unittest.cc b/chrome/browser/ui/views/tabs/tab_strip_unittest.cc
index 43c76043..44e3b6f 100644
--- a/chrome/browser/ui/views/tabs/tab_strip_unittest.cc
+++ b/chrome/browser/ui/views/tabs/tab_strip_unittest.cc
@@ -153,6 +153,11 @@
 
     widget_ = CreateTestWidget();
     tab_strip_parent_ = widget_->SetContentsView(std::move(tab_strip_parent));
+
+    // Prevent hover cards from appearing when the mouse is over the tab. Tests
+    // don't typically account for this possibly, so it can cause unrelated
+    // tests to fail due to tab data not being set. See crbug.com/1050012.
+    Tab::SetShowHoverCardOnMouseHoverForTesting(false);
   }
 
   void TearDown() override {
diff --git a/chrome/browser/ui/views/toolbar/home_button.cc b/chrome/browser/ui/views/toolbar/home_button.cc
index b1fb3fa..1bbffb4 100644
--- a/chrome/browser/ui/views/toolbar/home_button.cc
+++ b/chrome/browser/ui/views/toolbar/home_button.cc
@@ -16,6 +16,7 @@
 #include "chrome/grit/generated_resources.h"
 #include "components/prefs/pref_service.h"
 #include "components/user_prefs/user_prefs.h"
+#include "ui/base/dragdrop/drag_drop_types.h"
 #include "ui/base/l10n/l10n_util.h"
 #include "ui/base/models/menu_model.h"
 #include "ui/views/bubble/bubble_dialog_delegate_view.h"
diff --git a/chrome/browser/ui/webui/chromeos/bluetooth_pairing_dialog.cc b/chrome/browser/ui/webui/chromeos/bluetooth_pairing_dialog.cc
index 4ff6dec..425a4bcc 100644
--- a/chrome/browser/ui/webui/chromeos/bluetooth_pairing_dialog.cc
+++ b/chrome/browser/ui/webui/chromeos/bluetooth_pairing_dialog.cc
@@ -16,6 +16,7 @@
 #include "content/public/browser/web_ui.h"
 #include "content/public/browser/web_ui_data_source.h"
 #include "device/bluetooth/bluetooth_device.h"
+#include "device/bluetooth/public/cpp/bluetooth_address.h"
 #include "ui/base/l10n/l10n_util.h"
 
 namespace chromeos {
@@ -56,7 +57,7 @@
     bool paired,
     bool connected) {
   std::string cannonical_address =
-      device::BluetoothDevice::CanonicalizeAddress(address);
+      device::CanonicalizeBluetoothAddress(address);
   if (cannonical_address.empty()) {
     LOG(ERROR) << "BluetoothPairingDialog: Invalid address: " << address;
     return nullptr;
diff --git a/chrome/browser/ui/webui/management_ui_handler.cc b/chrome/browser/ui/webui/management_ui_handler.cc
index d852549..6ef3722 100644
--- a/chrome/browser/ui/webui/management_ui_handler.cc
+++ b/chrome/browser/ui/webui/management_ui_handler.cc
@@ -644,12 +644,12 @@
       g_browser_process->platform_part()->browser_policy_connector_chromeos();
   policy::MinimumVersionPolicyHandler* handler =
       connector->GetMinimumVersionPolicyHandler();
-  return handler && handler->IsUpdateRequiredEol();
+  return handler && handler->ShouldShowUpdateRequiredEolBanner();
 }
 
 void ManagementUIHandler::AddUpdateRequiredEolInfo(
     base::Value* response) const {
-  if (!device_managed_ || !account_managed_ || !IsUpdateRequiredEol()) {
+  if (!device_managed_ || !IsUpdateRequiredEol()) {
     response->SetStringPath("eolMessage", std::string());
     return;
   }
diff --git a/chrome/browser/ui/webui/new_tab_page/new_tab_page_handler.cc b/chrome/browser/ui/webui/new_tab_page/new_tab_page_handler.cc
index d4edce8..9fcf8282 100644
--- a/chrome/browser/ui/webui/new_tab_page/new_tab_page_handler.cc
+++ b/chrome/browser/ui/webui/new_tab_page/new_tab_page_handler.cc
@@ -1014,8 +1014,16 @@
 
 void NewTabPageHandler::ToggleSuggestionGroupIdVisibility(
     int32_t suggestion_group_id) {
-  omnibox::ToggleSuggestionGroupIdVisibility(profile_->GetPrefs(),
-                                             suggestion_group_id);
+  if (!autocomplete_controller_)
+    return;
+
+  omnibox::SuggestionGroupVisibility new_value =
+      autocomplete_controller_->result().IsSuggestionGroupIdHidden(
+          profile_->GetPrefs(), suggestion_group_id)
+          ? omnibox::SuggestionGroupVisibility::SHOWN
+          : omnibox::SuggestionGroupVisibility::HIDDEN;
+  omnibox::SetSuggestionGroupVisibility(profile_->GetPrefs(),
+                                        suggestion_group_id, new_value);
 }
 
 void NewTabPageHandler::LogCharTypedToRepaintLatency(base::TimeDelta latency) {
diff --git a/chrome/browser/ui/webui/settings/chromeos/main_section.cc b/chrome/browser/ui/webui/settings/chromeos/main_section.cc
index 2a1e91a..65cd4db 100644
--- a/chrome/browser/ui/webui/settings/chromeos/main_section.cc
+++ b/chrome/browser/ui/webui/settings/chromeos/main_section.cc
@@ -65,11 +65,12 @@
       g_browser_process->platform_part()->browser_policy_connector_chromeos();
   policy::MinimumVersionPolicyHandler* handler =
       connector->GetMinimumVersionPolicyHandler();
+  bool device_managed = connector->IsEnterpriseManaged();
 
   // |eol_return_banner_text| contains the update required end of life banner
   // text which is left empty when the banner should not be shown.
   base::string16 eol_return_banner_text;
-  if (handler && handler->IsUpdateRequiredEol()) {
+  if (device_managed && handler->ShouldShowUpdateRequiredEolBanner()) {
     base::Optional<int> days = handler->GetTimeRemainingInDays();
     // We only need to show the banner if less than equal to one week remains to
     // reach the update required deadline.
diff --git a/chrome/browser/ui/webui/settings/settings_localized_strings_provider.cc b/chrome/browser/ui/webui/settings/settings_localized_strings_provider.cc
index 116217a..3738208 100644
--- a/chrome/browser/ui/webui/settings/settings_localized_strings_provider.cc
+++ b/chrome/browser/ui/webui/settings/settings_localized_strings_provider.cc
@@ -1691,13 +1691,13 @@
      IDS_SETTINGS_SITE_SETTINGS_BLUETOOTH_DEVICES_ASK_RECOMMENDED},
     {"siteSettingsBluetoothDevicesBlock",
      IDS_SETTINGS_SITE_SETTINGS_BLUETOOTH_DEVICES_BLOCK},
-    {"siteSettingsNativeFileSystemWrite",
+    {"siteSettingsFileSystemWrite",
      IDS_SETTINGS_SITE_SETTINGS_NATIVE_FILE_SYSTEM_WRITE},
-    {"siteSettingsNativeFileSystemWriteAsk",
+    {"siteSettingsFileSystemWriteAsk",
      IDS_SETTINGS_SITE_SETTINGS_NATIVE_FILE_SYSTEM_WRITE_ASK},
-    {"siteSettingsNativeFileSystemWriteAskRecommended",
+    {"siteSettingsFileSystemWriteAskRecommended",
      IDS_SETTINGS_SITE_SETTINGS_NATIVE_FILE_SYSTEM_WRITE_ASK_RECOMMENDED},
-    {"siteSettingsNativeFileSystemWriteBlock",
+    {"siteSettingsFileSystemWriteBlock",
      IDS_SETTINGS_SITE_SETTINGS_NATIVE_FILE_SYSTEM_WRITE_BLOCK},
     {"siteSettingsRemoveZoomLevel",
      IDS_SETTINGS_SITE_SETTINGS_REMOVE_ZOOM_LEVEL},
@@ -1985,7 +1985,7 @@
       cmd.HasSwitch(::switches::kEnableExperimentalWebPlatformFeatures));
 
   html_source->AddBoolean(
-      "enableNativeFileSystemWriteContentSetting",
+      "enableFileSystemWriteContentSetting",
       base::FeatureList::IsEnabled(::blink::features::kNativeFileSystemAPI));
 
   html_source->AddBoolean(
diff --git a/chrome/browser/ui/webui/settings/site_settings_handler_unittest.cc b/chrome/browser/ui/webui/settings/site_settings_handler_unittest.cc
index 939cce1..97d1f6a3 100644
--- a/chrome/browser/ui/webui/settings/site_settings_handler_unittest.cc
+++ b/chrome/browser/ui/webui/settings/site_settings_handler_unittest.cc
@@ -1214,8 +1214,7 @@
 TEST_F(SiteSettingsHandlerTest, NotificationPermissionRevokeUkm) {
   const std::string google("https://www.google.com");
   ukm::TestAutoSetUkmRecorder ukm_recorder;
-  ASSERT_TRUE(profile()->CreateHistoryService(/* delete_file= */ true,
-                                              /* no_db= */ false));
+  ASSERT_TRUE(profile()->CreateHistoryService());
   auto* history_service = HistoryServiceFactory::GetForProfile(
       profile(), ServiceAccessType::EXPLICIT_ACCESS);
   history_service->AddPage(GURL(google), base::Time::Now(),
@@ -1271,8 +1270,7 @@
 #define MAYBE_DefaultSettingSource DefaultSettingSource
 #endif
 TEST_F(SiteSettingsHandlerTest, MAYBE_DefaultSettingSource) {
-  ASSERT_TRUE(profile()->CreateHistoryService(/* delete_file= */ true,
-                                              /* no_db= */ false));
+  ASSERT_TRUE(profile()->CreateHistoryService());
 
   // Use a non-default port to verify the display name does not strip this
   // off.
diff --git a/chrome/browser/ui/webui/settings/site_settings_helper.cc b/chrome/browser/ui/webui/settings/site_settings_helper.cc
index b515768..806785b 100644
--- a/chrome/browser/ui/webui/settings/site_settings_helper.cc
+++ b/chrome/browser/ui/webui/settings/site_settings_helper.cc
@@ -102,8 +102,7 @@
     {ContentSettingsType::BLUETOOTH_SCANNING, "bluetooth-scanning"},
     {ContentSettingsType::HID_GUARD, "hid-devices"},
     {ContentSettingsType::HID_CHOOSER_DATA, kHidChooserDataGroupType},
-    {ContentSettingsType::NATIVE_FILE_SYSTEM_WRITE_GUARD,
-     "native-file-system-write"},
+    {ContentSettingsType::FILE_SYSTEM_WRITE_GUARD, "file-system-write"},
     {ContentSettingsType::MIXEDSCRIPT, "mixed-script"},
     {ContentSettingsType::VR, "vr"},
     {ContentSettingsType::AR, "ar"},
@@ -141,7 +140,7 @@
     {ContentSettingsType::INSTALLED_WEB_APP_METADATA, nullptr},
     {ContentSettingsType::NFC, nullptr},
     {ContentSettingsType::SAFE_BROWSING_URL_CHECK_DATA, nullptr},
-    {ContentSettingsType::NATIVE_FILE_SYSTEM_READ_GUARD, nullptr},
+    {ContentSettingsType::FILE_SYSTEM_READ_GUARD, nullptr},
     {ContentSettingsType::STORAGE_ACCESS, nullptr},
     {ContentSettingsType::CAMERA_PAN_TILT_ZOOM, nullptr},
 };
diff --git a/chrome/browser/ui/webui/signin/dice_web_signin_intercept_ui.cc b/chrome/browser/ui/webui/signin/dice_web_signin_intercept_ui.cc
index 173dee1..b083ed04 100644
--- a/chrome/browser/ui/webui/signin/dice_web_signin_intercept_ui.cc
+++ b/chrome/browser/ui/webui/signin/dice_web_signin_intercept_ui.cc
@@ -5,7 +5,9 @@
 #include "chrome/browser/ui/webui/signin/dice_web_signin_intercept_ui.h"
 
 #include "chrome/browser/profiles/profile.h"
+#include "chrome/browser/profiles/profile_attributes_entry.h"
 #include "chrome/browser/profiles/profile_avatar_icon_util.h"
+#include "chrome/browser/ui/signin/profile_colors_util.h"
 #include "chrome/browser/ui/webui/signin/dice_web_signin_intercept_handler.h"
 #include "chrome/browser/ui/webui/webui_util.h"
 #include "chrome/common/webui_url_constants.h"
@@ -33,14 +35,14 @@
   source->AddResourcePath("signin_shared_css.js", IDR_SIGNIN_SHARED_CSS_JS);
   source->AddResourcePath("signin_vars_css.js", IDR_SIGNIN_VARS_CSS_JS);
 
-  // TODO(droger): Use the color from the profile.
-  SkColor header_background_color = SkColorSetRGB(206, 234, 214);
-  SkColor header_text_color =
-      color_utils::GetColorWithMaxContrast(header_background_color);
+  Profile* profile = Profile::FromWebUI(web_ui);
+  SkColor background_color =
+      GetThemeColorsForProfile(profile).profile_highlight_color;
   source->AddString("headerBackgroundColor",
-                    color_utils::SkColorToRgbaString(header_background_color));
+                    color_utils::SkColorToRgbaString(background_color));
   source->AddString("headerTextColor",
-                    color_utils::SkColorToRgbaString(header_text_color));
+                    color_utils::SkColorToRgbaString(
+                        GetProfileForegroundTextColor(background_color)));
 
   // Localized strings.
   source->UseStringsJs();
@@ -64,7 +66,7 @@
   source->AddResourcePath("test_loader.js", IDR_WEBUI_JS_TEST_LOADER);
   source->AddResourcePath("test_loader.html", IDR_WEBUI_HTML_TEST_LOADER);
 
-  content::WebUIDataSource::Add(Profile::FromWebUI(web_ui), source);
+  content::WebUIDataSource::Add(profile, source);
 }
 
 DiceWebSigninInterceptUI::~DiceWebSigninInterceptUI() = default;
diff --git a/chrome/browser/ui/webui/signin/profile_picker_handler.cc b/chrome/browser/ui/webui/signin/profile_picker_handler.cc
index f837779..1fc0c268 100644
--- a/chrome/browser/ui/webui/signin/profile_picker_handler.cc
+++ b/chrome/browser/ui/webui/signin/profile_picker_handler.cc
@@ -16,6 +16,7 @@
 #include "chrome/browser/profiles/profile_window.h"
 #include "chrome/browser/ui/browser_finder.h"
 #include "chrome/browser/ui/profile_picker.h"
+#include "chrome/common/pref_names.h"
 #include "chrome/common/search/generated_colors_info.h"
 #include "ui/base/l10n/l10n_util.h"
 #include "ui/base/webui/web_ui_util.h"
@@ -42,6 +43,10 @@
       base::BindRepeating(&ProfilePickerHandler::HandleLaunchSelectedProfile,
                           base::Unretained(this)));
   web_ui()->RegisterMessageCallback(
+      "askOnStartupChanged",
+      base::BindRepeating(&ProfilePickerHandler::HandleAskOnStartupChanged,
+                          base::Unretained(this)));
+  web_ui()->RegisterMessageCallback(
       "getNewProfileSuggestedThemeInfo",
       base::BindRepeating(
           &ProfilePickerHandler::HandleGetNewProfileSuggestedThemeInfo,
@@ -97,6 +102,16 @@
                  weak_factory_.GetWeakPtr()));
 }
 
+void ProfilePickerHandler::HandleAskOnStartupChanged(
+    const base::ListValue* args) {
+  bool show_on_startup;
+  if (!args->GetBoolean(0, &show_on_startup))
+    return;
+
+  PrefService* prefs = g_browser_process->local_state();
+  prefs->SetBoolean(prefs::kBrowserShowProfilePickerOnStartup, show_on_startup);
+}
+
 void ProfilePickerHandler::HandleGetNewProfileSuggestedThemeInfo(
     const base::ListValue* args) {
   AllowJavascript();
diff --git a/chrome/browser/ui/webui/signin/profile_picker_handler.h b/chrome/browser/ui/webui/signin/profile_picker_handler.h
index 638d3565..cd6d8cc3 100644
--- a/chrome/browser/ui/webui/signin/profile_picker_handler.h
+++ b/chrome/browser/ui/webui/signin/profile_picker_handler.h
@@ -26,6 +26,7 @@
  private:
   void HandleMainViewInitialize(const base::ListValue* args);
   void HandleLaunchSelectedProfile(const base::ListValue* args);
+  void HandleAskOnStartupChanged(const base::ListValue* args);
   void HandleGetNewProfileSuggestedThemeInfo(const base::ListValue* args);
 
   void OnSwitchToProfileComplete(Profile* profile,
diff --git a/chrome/browser/ui/webui/signin/profile_picker_ui.cc b/chrome/browser/ui/webui/signin/profile_picker_ui.cc
index 2536b066..176336c 100644
--- a/chrome/browser/ui/webui/signin/profile_picker_ui.cc
+++ b/chrome/browser/ui/webui/signin/profile_picker_ui.cc
@@ -4,14 +4,17 @@
 
 #include "chrome/browser/ui/webui/signin/profile_picker_ui.h"
 
+#include "chrome/browser/browser_process.h"
 #include "chrome/browser/profiles/profile.h"
 #include "chrome/browser/ui/webui/signin/profile_picker_handler.h"
 #include "chrome/browser/ui/webui/webui_util.h"
+#include "chrome/common/pref_names.h"
 #include "chrome/common/webui_url_constants.h"
 #include "chrome/grit/chromium_strings.h"
 #include "chrome/grit/generated_resources.h"
 #include "chrome/grit/profile_picker_resources.h"
 #include "chrome/grit/profile_picker_resources_map.h"
+#include "components/prefs/pref_service.h"
 #include "content/public/browser/web_ui_data_source.h"
 #include "ui/base/webui/web_ui_util.h"
 
@@ -21,6 +24,7 @@
   static constexpr webui::LocalizedString kLocalizedStrings[] = {
       {"mainViewTitle", IDS_PROFILE_PICKER_MAIN_VIEW_TITLE},
       {"mainViewSubtitle", IDS_PROFILE_PICKER_MAIN_VIEW_SUBTITLE},
+      {"askOnStartupCheckboxText", IDS_PROFILE_PICKER_ASK_ON_STARTUP},
       {"backButtonLabel", IDS_PROFILE_PICKER_BACK_BUTTON_LABEL},
       {"profileTypeChoiceTitle",
        IDS_PROFILE_PICKER_PROFILE_CREATION_FLOW_PROFILE_TYPE_CHOICE_TITLE},
@@ -32,6 +36,9 @@
        IDS_PROFILE_PICKER_PROFILE_CREATION_FLOW_NOT_NOW_BUTTON_LABEL},
   };
   AddLocalizedStringsBulk(html_source, kLocalizedStrings);
+  html_source->AddBoolean("askOnStartup",
+                          g_browser_process->local_state()->GetBoolean(
+                              prefs::kBrowserShowProfilePickerOnStartup));
 }
 
 }  // namespace
diff --git a/chrome/browser/unexpire_flags.cc b/chrome/browser/unexpire_flags.cc
index f3d51f9..47ea869 100644
--- a/chrome/browser/unexpire_flags.cc
+++ b/chrome/browser/unexpire_flags.cc
@@ -9,6 +9,7 @@
 #include "chrome/browser/expired_flags_list.h"
 #include "chrome/browser/unexpire_flags_gen.h"
 #include "chrome/common/chrome_version.h"
+#include "components/flags_ui/flags_storage.h"
 
 namespace flags {
 
@@ -43,9 +44,27 @@
   return -1;
 }
 
+// This function is a nasty hack - normally, the logic to turn flags into
+// feature names happens inside flags_ui::FlagsState, but this function is used
+// from the setup code of FlagsState, so it can't rely on FlagsState having been
+// set up. As such, we look into the backing FlagsStorage and hardcode how
+// enabled flags look inside that storage.
+std::set<int> UnexpiredMilestonesFromStorage(
+    const flags_ui::FlagsStorage* storage) {
+  std::set<int> unexpired;
+  for (const auto& f : storage->GetFlags()) {
+    int mstone;
+    if (sscanf(f.c_str(), "temporary-unexpire-flags-m%d@1", &mstone) == 1)
+      unexpired.insert(mstone);
+  }
+  return unexpired;
+}
+
 }  // namespace
 
-bool IsFlagExpired(const char* internal_name) {
+bool IsFlagExpired(const flags_ui::FlagsStorage* storage,
+                   const char* internal_name) {
+  DCHECK(storage);
   constexpr int kChromeVersion[] = {CHROME_VERSION};
   constexpr int kChromeVersionMajor = kChromeVersion[0];
 
@@ -54,6 +73,37 @@
   if (mstone == -1)
     return false;
 
+  // This is extremely horrible:
+  //
+  // In order to know if a flag is expired or not, normally this function
+  // queries the state of base::FeatureList to check whether the unexpire
+  // feature for that milestone is enabled. However, when *creating* the initial
+  // base::FeatureList instance, these features won't be initialized yet, which
+  // leads to this issue:
+  //
+  // * Assume a flag "foo-bar" for feature FooBar that expires in M83.
+  // * Also, assume that temporary-unexpire-flags-m83 is enabled.
+  //
+  // If both of those are true, then if IsFlagExpired("foo-bar") is called
+  // *during* initial feature list setup, it will return true rather than false,
+  // which will cause FooBar to be set to its default rather than the
+  // non-default value that the flag may be to. This happens because the
+  // TemporaryUnexpireFlagsM83 feature hasn't been initialized yet, so it gets
+  // treated as its default state (disabled).
+  //
+  // To deal with that and make this function behave more correctly during
+  // FeatureList initialization, also consult the backing FlagsStorage from the
+  // FlagsState and look at the temporary-unexpire-flags-m$M flags directly, as
+  // well as looking at their features.
+  //
+  // This still has a problem: during browser startup, if the unexpire feature
+  // will be configured by some other mechanism (group policy, etc), that
+  // feature's value won't apply in time here and the bug described will happen.
+  // TODO(ellyjones): Figure out how to fix that.
+  std::set<int> unexpired_milestones = UnexpiredMilestonesFromStorage(storage);
+  if (base::Contains(unexpired_milestones, mstone))
+    return false;
+
   const base::Feature* expiry_feature = GetUnexpireFeatureForMilestone(mstone);
 
   // If there's an unexpiry feature, and the unexpiry feature is *disabled*,
diff --git a/chrome/browser/unexpire_flags.h b/chrome/browser/unexpire_flags.h
index b776e65..46e9943 100644
--- a/chrome/browser/unexpire_flags.h
+++ b/chrome/browser/unexpire_flags.h
@@ -8,9 +8,14 @@
 #include "base/callback.h"
 #include "base/feature_list.h"
 
+namespace flags_ui {
+class FlagsStorage;
+}  // namespace flags_ui
+
 namespace flags {
 
-bool IsFlagExpired(const char* internal_name);
+bool IsFlagExpired(const flags_ui::FlagsStorage* storage,
+                   const char* internal_name);
 
 namespace testing {
 
diff --git a/chrome/browser/web_applications/test/test_system_web_app_installation.cc b/chrome/browser/web_applications/test/test_system_web_app_installation.cc
index fdd78f7..1f1b1af 100644
--- a/chrome/browser/web_applications/test/test_system_web_app_installation.cc
+++ b/chrome/browser/web_applications/test/test_system_web_app_installation.cc
@@ -179,9 +179,9 @@
   auto* installation = new TestSystemWebAppInstallation(SystemAppType::MEDIA,
                                                         media_system_app_info);
   installation->RegisterAutoGrantedPermissions(
-      ContentSettingsType::NATIVE_FILE_SYSTEM_READ_GUARD);
+      ContentSettingsType::FILE_SYSTEM_READ_GUARD);
   installation->RegisterAutoGrantedPermissions(
-      ContentSettingsType::NATIVE_FILE_SYSTEM_WRITE_GUARD);
+      ContentSettingsType::FILE_SYSTEM_WRITE_GUARD);
 
   return base::WrapUnique(installation);
 }
diff --git a/chrome/build/win32.pgo.txt b/chrome/build/win32.pgo.txt
index fa0f42f9..b1efe0b 100644
--- a/chrome/build/win32.pgo.txt
+++ b/chrome/build/win32.pgo.txt
@@ -1 +1 @@
-chrome-win32-master-1596517143-2f042d93a0262e3ee661fb2ff69050debe3380fe.profdata
+chrome-win32-master-1596542250-9615b306cb5f76d5a757426ea1c30fa3bd674a0e.profdata
diff --git a/chrome/build/win64.pgo.txt b/chrome/build/win64.pgo.txt
index 622012e..d1d7bc19 100644
--- a/chrome/build/win64.pgo.txt
+++ b/chrome/build/win64.pgo.txt
@@ -1 +1 @@
-chrome-win64-master-1596520791-9a2885d858aeb98ad5bcc11e2200637e7a775fe0.profdata
+chrome-win64-master-1596542250-4b9669504bdebb7cf76d0d2b9c7cc833bb153daa.profdata
diff --git a/chrome/common/chrome_switches.cc b/chrome/common/chrome_switches.cc
index be7b42c..4b8a022 100644
--- a/chrome/common/chrome_switches.cc
+++ b/chrome/common/chrome_switches.cc
@@ -504,9 +504,6 @@
 // Sets the Reporting API delay to under a second to allow much quicker reports.
 const char kShortReportingDelay[] = "short-reporting-delay";
 
-// If true the app list will be shown.
-const char kShowAppList[]                   = "show-app-list";
-
 // Does not show an infobar when an extension attaches to a page using
 // chrome.debugger page. Required to attach to extension background pages.
 const char kSilentDebuggerExtensionAPI[]    = "silent-debugger-extension-api";
diff --git a/chrome/common/chrome_switches.h b/chrome/common/chrome_switches.h
index 78b96f7..8466848 100644
--- a/chrome/common/chrome_switches.h
+++ b/chrome/common/chrome_switches.h
@@ -148,7 +148,6 @@
 extern const char kRestoreLastSession[];
 extern const char kSavePageAsMHTML[];
 extern const char kShortReportingDelay[];
-extern const char kShowAppList[];
 extern const char kSilentDebuggerExtensionAPI[];
 extern const char kSilentLaunch[];
 extern const char kSimulateCriticalUpdate[];
diff --git a/chrome/common/pref_names.cc b/chrome/common/pref_names.cc
index b9e4ec73..7e0a121 100644
--- a/chrome/common/pref_names.cc
+++ b/chrome/common/pref_names.cc
@@ -2628,6 +2628,10 @@
 // Whether profile can be used before sign in.
 const char kForceBrowserSignin[] = "profile.force_browser_signin";
 
+// Whether to show the profile picker on startup or not.
+const char kBrowserShowProfilePickerOnStartup[] =
+    "profile.show_picker_on_startup";
+
 // Boolean which indicates if the user is allowed to sign into Chrome on the
 // next startup.
 const char kSigninAllowedOnNextStartup[] = "signin.allowed_on_next_startup";
diff --git a/chrome/common/pref_names.h b/chrome/common/pref_names.h
index 77d0aa3..ed5ea84 100644
--- a/chrome/common/pref_names.h
+++ b/chrome/common/pref_names.h
@@ -886,6 +886,7 @@
 extern const char kBrowserGuestModeEnforced[];
 extern const char kBrowserAddPersonEnabled[];
 extern const char kForceBrowserSignin[];
+extern const char kBrowserShowProfilePickerOnStartup[];
 extern const char kSigninAllowedOnNextStartup[];
 
 extern const char kCryptAuthDeviceId[];
diff --git a/chrome/installer/util/shell_util.cc b/chrome/installer/util/shell_util.cc
index c16fecc..ada69363 100644
--- a/chrome/installer/util/shell_util.cc
+++ b/chrome/installer/util/shell_util.cc
@@ -1388,7 +1388,6 @@
   const char* const kept_switches[] = {
       switches::kApp,
       switches::kAppId,
-      switches::kShowAppList,
       switches::kProfileDirectory,
   };
   base::CommandLine desired_args(base::CommandLine::NO_PROGRAM);
diff --git a/chrome/installer/util/shell_util_unittest.cc b/chrome/installer/util/shell_util_unittest.cc
index fe081c6..d2667ac 100644
--- a/chrome/installer/util/shell_util_unittest.cc
+++ b/chrome/installer/util/shell_util_unittest.cc
@@ -652,8 +652,10 @@
   ShellUtil::ShortcutProperties expected_properties3(test_properties_);
 
   // Shortcut 4: targets "chrome.exe"; has both unknown and known arguments.
+  const base::string16 kKnownArg = L"--app-id";
+  const base::string16 kExpectedArgs = L"foo.com " + kKnownArg;
   test_properties_.set_shortcut_name(L"Chrome 4");
-  test_properties_.set_arguments(L"foo.com --show-app-list");
+  test_properties_.set_arguments(kExpectedArgs);
   ASSERT_TRUE(ShellUtil::CreateOrUpdateShortcut(
       ShellUtil::SHORTCUT_LOCATION_DESKTOP, test_properties_,
       ShellUtil::SHELL_SHORTCUT_CREATE_ALWAYS));
@@ -675,7 +677,7 @@
   EXPECT_EQ(shortcut3_path, shortcut3.first);
   EXPECT_EQ(L"foo.com", shortcut3.second);
   EXPECT_EQ(shortcut4_path, shortcut4.first);
-  EXPECT_EQ(L"foo.com --show-app-list", shortcut4.second);
+  EXPECT_EQ(kExpectedArgs, shortcut4.second);
 
   // Clear shortcuts.
   shortcuts.clear();
@@ -690,7 +692,7 @@
   EXPECT_EQ(shortcut3_path, shortcut3.first);
   EXPECT_EQ(L"foo.com", shortcut3.second);
   EXPECT_EQ(shortcut4_path, shortcut4.first);
-  EXPECT_EQ(L"foo.com --show-app-list", shortcut4.second);
+  EXPECT_EQ(kExpectedArgs, shortcut4.second);
 
   ValidateChromeShortcut(ShellUtil::SHORTCUT_LOCATION_DESKTOP,
                          expected_properties1);
@@ -699,7 +701,7 @@
   expected_properties3.set_arguments(base::string16());
   ValidateChromeShortcut(ShellUtil::SHORTCUT_LOCATION_DESKTOP,
                          expected_properties3);
-  expected_properties4.set_arguments(L"--show-app-list");
+  expected_properties4.set_arguments(kKnownArg);
   ValidateChromeShortcut(ShellUtil::SHORTCUT_LOCATION_DESKTOP,
                          expected_properties4);
 }
diff --git a/chrome/test/BUILD.gn b/chrome/test/BUILD.gn
index d2867693..65285f1 100644
--- a/chrome/test/BUILD.gn
+++ b/chrome/test/BUILD.gn
@@ -745,6 +745,7 @@
       "//ui/accessibility:test_support",
       "//ui/base:test_support",
       "//ui/base/clipboard:clipboard_test_support",
+      "//ui/base/dragdrop/mojom:mojom_shared",
       "//ui/compositor:test_support",
       "//ui/native_theme:test_support",
       "//ui/resources",
diff --git a/chrome/test/base/interactive_ui_tests_main.cc b/chrome/test/base/interactive_ui_tests_main.cc
index 112c0bd..bee2ed2 100644
--- a/chrome/test/base/interactive_ui_tests_main.cc
+++ b/chrome/test/base/interactive_ui_tests_main.cc
@@ -62,8 +62,10 @@
     } else
 #endif
     {
+#if defined(USE_X11)
       ui_controls::InstallUIControlsAura(
           views::test::CreateUIControlsDesktopAura());
+#endif
     }
 #else
     ui_controls::EnableUIControls();
diff --git a/chrome/test/base/testing_profile.cc b/chrome/test/base/testing_profile.cc
index 3b88ef2..40a2eb4 100644
--- a/chrome/test/base/testing_profile.cc
+++ b/chrome/test/base/testing_profile.cc
@@ -35,9 +35,7 @@
 #include "chrome/browser/chrome_content_browser_client.h"
 #include "chrome/browser/chrome_notification_types.h"
 #include "chrome/browser/content_settings/host_content_settings_map_factory.h"
-#include "chrome/browser/history/chrome_history_client.h"
 #include "chrome/browser/history/history_service_factory.h"
-#include "chrome/browser/history/web_history_service_factory.h"
 #include "chrome/browser/policy/profile_policy_connector.h"
 #include "chrome/browser/policy/schema_registry_service.h"
 #include "chrome/browser/policy/schema_registry_service_builder.h"
@@ -67,11 +65,6 @@
 #include "components/autofill/core/browser/test_autofill_profile_validator.h"
 #include "components/autofill/core/browser/webdata/autofill_webdata_service.h"
 #include "components/content_settings/core/browser/host_content_settings_map.h"
-#include "components/history/content/browser/content_visit_delegate.h"
-#include "components/history/content/browser/history_database_helper.h"
-#include "components/history/core/browser/history_backend.h"
-#include "components/history/core/browser/history_constants.h"
-#include "components/history/core/browser/history_database_params.h"
 #include "components/history/core/browser/history_service.h"
 #include "components/history/core/test/history_service_test_util.h"
 #include "components/keyed_service/content/browser_context_dependency_manager.h"
@@ -160,27 +153,6 @@
 // Default profile name
 const char kTestingProfile[] = "testing_profile";
 
-std::unique_ptr<KeyedService> BuildHistoryService(
-    content::BrowserContext* context) {
-  return std::make_unique<history::HistoryService>(
-      std::make_unique<ChromeHistoryClient>(
-          BookmarkModelFactory::GetForBrowserContext(context)),
-      std::make_unique<history::ContentVisitDelegate>(context));
-}
-
-std::unique_ptr<KeyedService> BuildInMemoryURLIndex(
-    content::BrowserContext* context) {
-  Profile* profile = Profile::FromBrowserContext(context);
-  std::unique_ptr<InMemoryURLIndex> in_memory_url_index(
-      new InMemoryURLIndex(BookmarkModelFactory::GetForBrowserContext(profile),
-                           HistoryServiceFactory::GetForProfile(
-                               profile, ServiceAccessType::IMPLICIT_ACCESS),
-                           TemplateURLServiceFactory::GetForProfile(profile),
-                           profile->GetPath(), SchemeSet()));
-  in_memory_url_index->Init();
-  return std::move(in_memory_url_index);
-}
-
 void TestProfileErrorCallback(WebDataServiceWrapper::ErrorType error_type,
                               sql::InitStatus status,
                               const std::string& diagnostics) {
@@ -538,34 +510,20 @@
   }
 }
 
-bool TestingProfile::CreateHistoryService(bool delete_file, bool no_db) {
+bool TestingProfile::CreateHistoryService() {
   // Should never be created multiple times.
   DCHECK(!HistoryServiceFactory::GetForProfileWithoutCreating(this));
 
-  if (delete_file) {
-    base::FilePath path = GetPath();
-    path = path.Append(history::kHistoryFilename);
-    if (!base::DeleteFile(path) || base::PathExists(path))
-      return false;
-  }
   // This will create and init the history service.
   history::HistoryService* history_service =
       static_cast<history::HistoryService*>(
           HistoryServiceFactory::GetInstance()->SetTestingFactoryAndUse(
-              this, base::BindRepeating(&BuildHistoryService)));
-  if (!history_service->Init(
-          no_db, history::HistoryDatabaseParamsForPath(GetPath()))) {
+              this, HistoryServiceFactory::GetDefaultFactory()));
+  if (!history_service) {
     HistoryServiceFactory::GetInstance()->SetTestingFactory(
         this, BrowserContextKeyedServiceFactory::TestingFactory());
     return false;
   }
-  // Some tests expect that CreateHistoryService() will also make the
-  // InMemoryURLIndex available.
-  InMemoryURLIndexFactory::GetInstance()->SetTestingFactory(
-      this, base::BindRepeating(&BuildInMemoryURLIndex));
-  // Disable WebHistoryService by default, since it makes network requests.
-  WebHistoryServiceFactory::GetInstance()->SetTestingFactory(
-      this, BrowserContextKeyedServiceFactory::TestingFactory());
   return true;
 }
 
@@ -574,41 +532,6 @@
       this, base::BindRepeating(&BuildWebDataService));
 }
 
-void TestingProfile::BlockUntilHistoryBackendDestroyed() {
-  // Only get the history service if it actually exists since the caller of the
-  // test should explicitly call CreateHistoryService to build it.
-  history::HistoryService* history_service =
-      HistoryServiceFactory::GetForProfileWithoutCreating(this);
-
-  // Nothing to destroy
-  if (!history_service) {
-    return;
-  }
-
-  base::RunLoop run_loop;
-  history_service->SetOnBackendDestroyTask(run_loop.QuitClosure());
-  HistoryServiceFactory::ShutdownForProfile(this);
-  run_loop.Run();
-}
-
-void TestingProfile::BlockUntilHistoryIndexIsRefreshed() {
-  // Only get the history service if it actually exists since the caller of the
-  // test should explicitly call CreateHistoryService to build it.
-  history::HistoryService* history_service =
-      HistoryServiceFactory::GetForProfileWithoutCreating(this);
-  DCHECK(history_service);
-  InMemoryURLIndex* index = InMemoryURLIndexFactory::GetForProfile(this);
-  if (!index || index->restored())
-    return;
-  base::RunLoop run_loop;
-  HistoryIndexRestoreObserver observer(
-      content::GetDeferredQuitTaskForRunLoop(&run_loop));
-  index->set_restore_cache_observer(&observer);
-  run_loop.Run();
-  index->set_restore_cache_observer(nullptr);
-  DCHECK(index->restored());
-}
-
 void TestingProfile::SetGuestSession(bool guest) {
   guest_session_ = guest;
 }
diff --git a/chrome/test/base/testing_profile.h b/chrome/test/base/testing_profile.h
index 9c4bb0e7..256c8c1 100644
--- a/chrome/test/base/testing_profile.h
+++ b/chrome/test/base/testing_profile.h
@@ -226,28 +226,14 @@
   // pointers.
   // Instead, use Builder::AddTestingFactory to inject your own factories.
   // !!!!!!!! WARNING: THIS IS GENERALLY NOT SAFE TO CALL! !!!!!!!!
-  // Creates the history service. If |delete_file| is true, the history file is
-  // deleted first, then the HistoryService is created. As TestingProfile
-  // deletes the directory containing the files used by HistoryService, this
-  // only matters if you're recreating the HistoryService.  If |no_db| is true,
-  // the history backend will fail to initialize its database; this is useful
-  // for testing error conditions. Returns true on success.
+  // Creates the history service. Returns true on success.
   // TODO(crbug.com/1106699): Remove this API and adopt the Builder instead.
-  bool CreateHistoryService(bool delete_file, bool no_db) WARN_UNUSED_RESULT;
+  bool CreateHistoryService() WARN_UNUSED_RESULT;
 
   // Creates a WebDataService. If not invoked, the web data service is NULL.
   // TODO(crbug.com/1106699): Remove this API and adopt the Builder instead.
   void CreateWebDataService();
 
-  // Blocks until the HistoryService finishes restoring its in-memory cache.
-  // This is NOT invoked from CreateHistoryService.
-  void BlockUntilHistoryIndexIsRefreshed();
-
-  // Blocks until the HistoryBackend is completely destroyed. This is mostly
-  // useful to ensure the destruction tasks do not outlive this class on which
-  // they depend.
-  void BlockUntilHistoryBackendDestroyed();
-
   // Allow setting a profile as Guest after-the-fact to simplify some tests.
   void SetGuestSession(bool guest);
 
diff --git a/chrome/test/data/webui/settings/category_setting_exceptions_tests.js b/chrome/test/data/webui/settings/category_setting_exceptions_tests.js
index cf36c46..85df478 100644
--- a/chrome/test/data/webui/settings/category_setting_exceptions_tests.js
+++ b/chrome/test/data/webui/settings/category_setting_exceptions_tests.js
@@ -84,8 +84,8 @@
         });
       });
 
-  test('allow site list is hidden for NATIVE_FILE_SYSTEM_WRITE', function() {
-    testElement.category = ContentSettingsTypes.NATIVE_FILE_SYSTEM_WRITE;
+  test('allow site list is hidden for FILE_SYSTEM_WRITE', function() {
+    testElement.category = ContentSettingsTypes.FILE_SYSTEM_WRITE;
 
     // Flush to be sure that the container is updated.
     flush();
diff --git a/chrome/test/data/webui/settings/passwords_section_test.js b/chrome/test/data/webui/settings/passwords_section_test.js
index 674f8be..cf21133 100644
--- a/chrome/test/data/webui/settings/passwords_section_test.js
+++ b/chrome/test/data/webui/settings/passwords_section_test.js
@@ -1239,6 +1239,22 @@
         });
   });
 
+  test('onEditPasswordListItem', function() {
+    const expectedItem =
+        createPasswordEntry({url: 'goo.gl', username: 'bart', id: 1});
+    const passwordsSection = elementFactory.createPasswordsSection(
+        passwordManager, [expectedItem], []);
+
+    getFirstPasswordListItem(passwordsSection).$.moreActionsButton.click();
+    passwordsSection.$.passwordsListHandler.$$('#menuEditPassword').click();
+
+    return passwordManager.whenCalled('requestPlaintextPassword')
+        .then(({id, reason}) => {
+          assertEquals(1, id);
+          assertEquals('EDIT', reason);
+        });
+  });
+
   test('closingPasswordsSectionHidesUndoToast', function() {
     const passwordEntry =
         createPasswordEntry({url: 'goo.gl', username: 'bart'});
diff --git a/chrome/test/data/webui/settings/site_details_permission_tests.js b/chrome/test/data/webui/settings/site_details_permission_tests.js
index 2a77fdc..aac8c9a 100644
--- a/chrome/test/data/webui/settings/site_details_permission_tests.js
+++ b/chrome/test/data/webui/settings/site_details_permission_tests.js
@@ -474,11 +474,10 @@
       });
 
   test(
-      'Native File System Write: ASK/BLOCK can be chosen as a preference by ' +
-          'users',
+      'File System Write: ASK/BLOCK can be chosen as a preference by users',
       function() {
         const origin = 'https://www.example.com';
-        testElement.category = ContentSettingsTypes.NATIVE_FILE_SYSTEM_WRITE;
+        testElement.category = ContentSettingsTypes.FILE_SYSTEM_WRITE;
         testElement.label = 'Save to original files';
         testElement.site = {
           origin: origin,
diff --git a/chrome/test/data/webui/settings/site_details_tests.js b/chrome/test/data/webui/settings/site_details_tests.js
index e338fe8..c9ceee6 100644
--- a/chrome/test/data/webui/settings/site_details_tests.js
+++ b/chrome/test/data/webui/settings/site_details_tests.js
@@ -136,7 +136,7 @@
               ContentSettingsTypes.BLUETOOTH_SCANNING,
               [createRawSiteException('https://foo.com:443')]),
           createContentSettingTypeToValuePair(
-              ContentSettingsTypes.NATIVE_FILE_SYSTEM_WRITE,
+              ContentSettingsTypes.FILE_SYSTEM_WRITE,
               [createRawSiteException('https://foo.com:443', {
                 setting: ContentSetting.BLOCK,
               })]),
@@ -216,8 +216,8 @@
     optionalSiteDetailsContentSettingsTypes[ContentSettingsTypes.MIXEDSCRIPT] =
         'enableInsecureContentContentSetting';
     optionalSiteDetailsContentSettingsTypes[ContentSettingsTypes
-                                                .NATIVE_FILE_SYSTEM_WRITE] =
-        'enableNativeFileSystemWriteContentSetting';
+                                                .FILE_SYSTEM_WRITE] =
+        'enableFileSystemWriteContentSetting';
     optionalSiteDetailsContentSettingsTypes[ContentSettingsTypes
                                                 .PAYMENT_HANDLER] =
         'enablePaymentHandlerContentSetting';
@@ -231,7 +231,7 @@
 
     controlledSettingsCount['enableExperimentalWebPlatformFeatures'] = 2;
     controlledSettingsCount['enableInsecureContentContentSetting'] = 1;
-    controlledSettingsCount['enableNativeFileSystemWriteContentSetting'] = 1;
+    controlledSettingsCount['enableFileSystemWriteContentSetting'] = 1;
     controlledSettingsCount['enablePaymentHandlerContentSetting'] = 1;
     controlledSettingsCount['enableSafeBrowsingSubresourceFilter'] = 1;
     controlledSettingsCount['enableWebBluetoothNewPermissionsBackend'] = 1;
@@ -362,7 +362,7 @@
     loadTimeData.overrideValues({
       enableExperimentalWebPlatformFeatures: true,
       enableInsecureContentContentSetting: true,
-      enableNativeFileSystemWriteContentSetting: true,
+      enableFileSystemWriteContentSetting: true,
       enablePaymentHandlerContentSetting: true,
       enableSafeBrowsingSubresourceFilter: true,
       enableWebBluetoothNewPermissionsBackend: true,
@@ -400,7 +400,7 @@
                     siteDetailsPermission.category ===
                         ContentSettingsTypes.POPUPS ||
                     siteDetailsPermission.category ===
-                        ContentSettingsTypes.NATIVE_FILE_SYSTEM_WRITE) {
+                        ContentSettingsTypes.FILE_SYSTEM_WRITE) {
                   expectedSetting =
                       prefs.exceptions[siteDetailsPermission.category][0]
                           .setting;
diff --git a/chrome/test/data/webui/settings/site_list_tests.js b/chrome/test/data/webui/settings/site_list_tests.js
index 32789498..c1744ad 100644
--- a/chrome/test/data/webui/settings/site_list_tests.js
+++ b/chrome/test/data/webui/settings/site_list_tests.js
@@ -58,10 +58,10 @@
 let prefsMixedEmbeddingOrigin;
 
 /**
- * An example pref with native file system write
+ * An example pref with file system write
  * @type {SiteSettingsPref}
  */
-let prefsNativeFileSystemWrite;
+let prefsFileSystemWrite;
 
 /**
  * An example pref with multiple categories and multiple allow/block
@@ -279,9 +279,9 @@
 
   prefsGeolocationEmpty = createSiteSettingsPrefs([], []);
 
-  prefsNativeFileSystemWrite = createSiteSettingsPrefs(
+  prefsFileSystemWrite = createSiteSettingsPrefs(
       [], [createContentSettingTypeToValuePair(
-              ContentSettingsTypes.NATIVE_FILE_SYSTEM_WRITE,
+              ContentSettingsTypes.FILE_SYSTEM_WRITE,
               [createRawSiteException('http://foo.com', {
                 setting: ContentSetting.BLOCK,
               })])]);
@@ -1075,8 +1075,8 @@
       'Add site button is hidden for content settings that don\'t allow it',
       function() {
         setUpCategory(
-            ContentSettingsTypes.NATIVE_FILE_SYSTEM_WRITE, ContentSetting.ALLOW,
-            prefsNativeFileSystemWrite);
+            ContentSettingsTypes.FILE_SYSTEM_WRITE, ContentSetting.ALLOW,
+            prefsFileSystemWrite);
         return browserProxy.whenCalled('getExceptionList').then(() => {
           flush();
           assertTrue(testElement.$$('#addSite').hidden);
diff --git a/chrome/test/data/xr/e2e_test_files/html/webxr_test_basic_hittest_results_availability.html b/chrome/test/data/xr/e2e_test_files/html/webxr_test_basic_hittest_results_availability.html
index 4a9cab02..08f3639 100644
--- a/chrome/test/data/xr/e2e_test_files/html/webxr_test_basic_hittest_results_availability.html
+++ b/chrome/test/data/xr/e2e_test_files/html/webxr_test_basic_hittest_results_availability.html
@@ -40,7 +40,9 @@
         // feature points, and then to actually finding the plane. Given that, we should allow
         // for retry logic in the test - the initial hit tests may return empty results until
         // ARCore detects a plane.
-        let retries_left = 30;
+        // Since we try every frame and we currently run at 30FPS, it should mean we'll retry for
+        // 5 seconds.
+        let retries_left = 30 * 5;
 
         onARFrameCallback = (session, frame) => {
           switch(testState) {
diff --git a/chrome/updater/control_service_in_process.cc b/chrome/updater/control_service_in_process.cc
index 8d788a41..b7ad95f 100644
--- a/chrome/updater/control_service_in_process.cc
+++ b/chrome/updater/control_service_in_process.cc
@@ -11,7 +11,7 @@
 #include "base/time/time.h"
 #include "chrome/updater/configurator.h"
 #include "chrome/updater/prefs.h"
-#include "chrome/updater/update_service.h"
+#include "chrome/updater/update_service_in_process.h"
 #include "components/prefs/pref_service.h"
 
 namespace updater {
@@ -32,7 +32,8 @@
   if (timeSinceUpdate >=
           base::TimeDelta::FromSeconds(config_->NextCheckDelay()) ||
       timeSinceUpdate < base::TimeDelta()) {
-    scoped_refptr<UpdateService> update_service = CreateUpdateService(config_);
+    scoped_refptr<UpdateServiceInProcess> update_service =
+        base::MakeRefCounted<UpdateServiceInProcess>(config_);
 
     update_service->UpdateAll(
         base::BindRepeating([](UpdateService::UpdateState) {}),
diff --git a/chromeos/components/camera_app_ui/camera_app_ui.cc b/chromeos/components/camera_app_ui/camera_app_ui.cc
index d97e546..cab39e1b 100644
--- a/chromeos/components/camera_app_ui/camera_app_ui.cc
+++ b/chromeos/components/camera_app_ui/camera_app_ui.cc
@@ -192,9 +192,9 @@
   allowlist->RegisterAutoGrantedPermission(
       host_origin, ContentSettingsType::MEDIASTREAM_CAMERA);
   allowlist->RegisterAutoGrantedPermission(
-      host_origin, ContentSettingsType::NATIVE_FILE_SYSTEM_READ_GUARD);
+      host_origin, ContentSettingsType::FILE_SYSTEM_READ_GUARD);
   allowlist->RegisterAutoGrantedPermission(
-      host_origin, ContentSettingsType::NATIVE_FILE_SYSTEM_WRITE_GUARD);
+      host_origin, ContentSettingsType::FILE_SYSTEM_WRITE_GUARD);
   allowlist->RegisterAutoGrantedPermission(host_origin,
                                            ContentSettingsType::COOKIES);
   // The notifications permissison is needed by the IdleManager, which we use
diff --git a/chromeos/components/media_app_ui/media_app_ui.cc b/chromeos/components/media_app_ui/media_app_ui.cc
index e1abf0d5..00e8781 100644
--- a/chromeos/components/media_app_ui/media_app_ui.cc
+++ b/chromeos/components/media_app_ui/media_app_ui.cc
@@ -83,9 +83,9 @@
   const url::Origin host_origin =
       url::Origin::Create(GURL(kChromeUIMediaAppURL));
   allowlist->RegisterAutoGrantedPermission(
-      host_origin, ContentSettingsType::NATIVE_FILE_SYSTEM_READ_GUARD);
+      host_origin, ContentSettingsType::FILE_SYSTEM_READ_GUARD);
   allowlist->RegisterAutoGrantedPermission(
-      host_origin, ContentSettingsType::NATIVE_FILE_SYSTEM_WRITE_GUARD);
+      host_origin, ContentSettingsType::FILE_SYSTEM_WRITE_GUARD);
 
   content::WebUIDataSource* untrusted_source =
       CreateMediaAppUntrustedDataSource(delegate_.get());
diff --git a/chromeos/components/telemetry_extension_ui/resources/trusted.js b/chromeos/components/telemetry_extension_ui/resources/trusted.js
index b334ecd..548623bd 100644
--- a/chromeos/components/telemetry_extension_ui/resources/trusted.js
+++ b/chromeos/components/telemetry_extension_ui/resources/trusted.js
@@ -2,100 +2,147 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+let diagnosticsService = null;
+let probeService = null;
+
+/**
+ * Lazy creates pointer to remote implementation of diagnostics service.
+ * @return {!chromeos.health.mojom.DiagnosticsServiceRemote}
+ */
+function getOrCreateDiagnosticsService() {
+  if (diagnosticsService === null) {
+    diagnosticsService = chromeos.health.mojom.DiagnosticsService.getRemote();
+  }
+  return /** @type {!chromeos.health.mojom.DiagnosticsServiceRemote} */ (
+      diagnosticsService);
+}
+
+/**
+ * Lazy creates pointer to remote implementation of probe service.
+ * @return {!chromeos.health.mojom.ProbeServiceRemote}
+ */
+function getOrCreateProbeService() {
+  if (probeService === null) {
+    probeService = chromeos.health.mojom.ProbeService.getRemote();
+  }
+  return /** @type {!chromeos.health.mojom.ProbeServiceRemote} */ (
+      probeService);
+}
+
+/**
+ * Proxying telemetry requests between TelemetryRequester on
+ * chrome-untrusted:// side with WebIDL types and ProbeService on chrome://
+ * side with Mojo types.
+ */
+class TelemetryProxy {
+  constructor() {
+    const categoryEnum = chromeos.health.mojom.ProbeCategoryEnum;
+
+    /**
+     * @type { !Map<!string, !chromeos.health.mojom.ProbeCategoryEnum> }
+     * @const
+     */
+    this.categoryToEnum_ = new Map([
+      ['battery', categoryEnum.kBattery],
+      ['non-removable-block-devices', categoryEnum.kNonRemovableBlockDevices],
+      ['cached-vpd-data', categoryEnum.kCachedVpdData],
+      ['cpu', categoryEnum.kCpu], ['timezone', categoryEnum.kTimezone],
+      ['memory', categoryEnum.kMemory], ['backlight', categoryEnum.kBacklight],
+      ['fan', categoryEnum.kFan],
+      ['stateful-partition', categoryEnum.kStatefulPartition],
+      ['bluetooth', categoryEnum.kBluetooth]
+    ]);
+  }
+
+  /**
+   * @param { !Array<!string> } categories
+   * @return { !Array<!chromeos.health.mojom.ProbeCategoryEnum> }
+   */
+  convertCategories(categories) {
+    return categories.map((category) => {
+      if (!this.categoryToEnum_.has(category)) {
+        throw TypeError(`Telemetry category '${category}' is unknown.`);
+      }
+      return this.categoryToEnum_.get(category);
+    });
+  }
+
+  /**
+   * This method converts Mojo types to WebIDL types applying next rules:
+   *   1. convert objects like { value: X } to X, where X is a number;
+   *   2. omit null/undefined properties;
+   *   3. convert objects without properties to null.
+   * @param {?Object|string|number|null|undefined} input
+   * @return {?Object|string|number|null}
+   */
+  convert(input) {
+    // After this closure compiler knows that input is not null.
+    if (input === null || typeof input === 'undefined') {
+      return null;
+    }
+
+    // After this closure compiler knows that input is {!Object}.
+    if (typeof input !== 'object') {
+      return input;
+    }
+
+    // 1 rule: convert objects like { value: X } to X, where X is a number.
+    if (Object.entries(input).length === 1 &&
+        typeof input['value'] === 'number') {
+      return input['value'];
+    }
+
+    let output = {};
+    Object.entries(input).forEach(kv => {
+      const key = /** @type {!string} */ (kv[0]);
+      const value = /** @type {?Object|string|number|null|undefined} */ (kv[1]);
+      const converted = this.convert(value);
+
+      // 2 rule: omit null/undefined properties.
+      if (converted !== null && typeof converted !== 'undefined') {
+        output[key] = converted;
+      }
+    });
+
+    // 3 rule. convert objects without properties to null.
+    if (Object.entries(output).length === 0) {
+      return null;
+    }
+    return output;
+  };
+
+  /**
+   * Requests telemetry info.
+   * @param { Object } message
+   * @return { !Object }
+   */
+  async handleProbeTelemetryInfo(message) {
+    const request =
+        /** @type {!dpsl_internal.ProbeTelemetryInfoRequest} */ (message);
+
+    /** @type {!Array<!chromeos.health.mojom.ProbeCategoryEnum>} */
+    let categories = [];
+    try {
+      categories = this.convertCategories(request);
+    } catch (/** @type {!Error}*/ error) {
+      return {error};
+    }
+
+    const telemetryInfo =
+        await getOrCreateProbeService().probeTelemetryInfo(categories);
+    return /** @type {Object} */ (this.convert(telemetryInfo)) ||
+        {telemetryInfo: {}};
+  }
+};
+
+const telemetryProxy = new TelemetryProxy();
+
 /**
  * @type { MessagePipe|null }
  */
 var untrustedMessagePipe = null;
 
 document.addEventListener('DOMContentLoaded', async () => {
-  let diagnosticsService = null;
-  let probeService = null;
-
-  /**
-   * Lazy creates pointer to remote implementation of diagnostics service.
-   * @return {!chromeos.health.mojom.DiagnosticsServiceRemote}
-   */
-  function getOrCreateDiagnosticsService() {
-    if (diagnosticsService === null) {
-      diagnosticsService = chromeos.health.mojom.DiagnosticsService.getRemote();
-    }
-    return /** @type {!chromeos.health.mojom.DiagnosticsServiceRemote} */ (
-        diagnosticsService);
-  }
-
-  /**
-   * Lazy creates pointer to remote implementation of probe service.
-   * @return {!chromeos.health.mojom.ProbeServiceRemote}
-   */
-  function getOrCreateProbeService() {
-    if (probeService === null) {
-      probeService = chromeos.health.mojom.ProbeService.getRemote();
-    }
-    return /** @type {!chromeos.health.mojom.ProbeServiceRemote} */ (
-        probeService);
-  }
-
-  /**
-   * Proxying telemetry requests between TelemetryRequester on
-   * chrome-untrusted:// side with WebIDL types and ProbeService on chrome://
-   * side with Mojo types.
-   */
-  class TelemetryProxy {
-    constructor() {
-      const categoryEnum = chromeos.health.mojom.ProbeCategoryEnum;
-
-      /**
-       * @type { !Map<!string, !chromeos.health.mojom.ProbeCategoryEnum> }
-       * @const
-       */
-      this.categoryToEnum_ = new Map([
-        ['battery', categoryEnum.kBattery],
-        ['non-removable-block-devices', categoryEnum.kNonRemovableBlockDevices],
-        ['cached-vpd-data', categoryEnum.kCachedVpdData],
-        ['cpu', categoryEnum.kCpu], ['timezone', categoryEnum.kTimezone],
-        ['memory', categoryEnum.kMemory],
-        ['backlight', categoryEnum.kBacklight], ['fan', categoryEnum.kFan],
-        ['stateful-partition', categoryEnum.kStatefulPartition],
-        ['bluetooth', categoryEnum.kBluetooth]
-      ]);
-    }
-
-    /**
-     * @param { !Array<!string> } categories
-     * @return { !Array<!chromeos.health.mojom.ProbeCategoryEnum> }
-     */
-    convertCategories(categories) {
-      return categories.map((category) => {
-        if (!this.categoryToEnum_.has(category)) {
-          throw TypeError(`Telemetry category '${category}' is unknown.`);
-        }
-        return this.categoryToEnum_.get(category);
-      });
-    }
-
-    /**
-     * Requests telemetry info.
-     * @param { Object } message
-     * @return { dpsl_internal.ProbeTelemetryInfoResponse }
-     */
-    async handleProbeTelemetryInfo(message) {
-      const request =
-          /** @type {!dpsl_internal.ProbeTelemetryInfoRequest} */ (message);
-
-      /** @type {!Array<!chromeos.health.mojom.ProbeCategoryEnum>} */
-      let categories = [];
-      try {
-        categories = telemetryProxy.convertCategories(request);
-      } catch (/** @type {!Error}*/ error) {
-        return {error};
-      }
-
-      return await getOrCreateProbeService().probeTelemetryInfo(categories);
-    }
-  };
-
-  const telemetryProxy = new TelemetryProxy();
-
   const untrustedMessagePipe =
       new MessagePipe('chrome-untrusted://telemetry-extension');
 
diff --git a/chromeos/components/telemetry_extension_ui/resources/untrusted.html b/chromeos/components/telemetry_extension_ui/resources/untrusted.html
index c26350e0..c4ec6d8 100644
--- a/chromeos/components/telemetry_extension_ui/resources/untrusted.html
+++ b/chromeos/components/telemetry_extension_ui/resources/untrusted.html
@@ -9,5 +9,4 @@
 
 <script src="mojo_bindings_lite.js"></script>
 <script src="diagnostics_service.mojom-lite.js"></script>
-<script src="probe_service.mojom-lite.js"></script>
 <script src="untrusted_scripts.js"></script>
diff --git a/chromeos/components/telemetry_extension_ui/telemetry_extension_ui.cc b/chromeos/components/telemetry_extension_ui/telemetry_extension_ui.cc
index 572b79e1..f0bcb96 100644
--- a/chromeos/components/telemetry_extension_ui/telemetry_extension_ui.cc
+++ b/chromeos/components/telemetry_extension_ui/telemetry_extension_ui.cc
@@ -77,9 +77,6 @@
   untrusted_source->AddResourcePath(
       "diagnostics_service.mojom-lite.js",
       IDR_TELEMETRY_EXTENSION_DIAGNOSTICS_SERVICE_MOJO_LITE_JS);
-  untrusted_source->AddResourcePath(
-      "probe_service.mojom-lite.js",
-      IDR_TELEMETRY_EXTENSION_PROBE_SERVICE_MOJO_LITE_JS);
 
   untrusted_source->OverrideContentSecurityPolicy(
       network::mojom::CSPDirectiveName::FrameAncestors,
diff --git a/chromeos/components/telemetry_extension_ui/test/telemetry_extension_ui_browsertest.cc b/chromeos/components/telemetry_extension_ui/test/telemetry_extension_ui_browsertest.cc
index 081b80c5..a3f427a 100644
--- a/chromeos/components/telemetry_extension_ui/test/telemetry_extension_ui_browsertest.cc
+++ b/chromeos/components/telemetry_extension_ui/test/telemetry_extension_ui_browsertest.cc
@@ -65,5 +65,34 @@
         ->SetAvailableRoutinesForTesting(input);
   }
 
+  {
+    auto battery_info = chromeos::cros_healthd::mojom::BatteryInfo::New();
+    battery_info->cycle_count = 100000000000000;
+    battery_info->voltage_now = 1234567890.123456;
+    battery_info->vendor = "Google";
+    battery_info->serial_number = "abcdef";
+    battery_info->charge_full_design = 3000000000000000;
+    battery_info->charge_full = 9000000000000000;
+    battery_info->voltage_min_design = 1000000000.1001;
+    battery_info->model_name = "Google Battery";
+    battery_info->charge_now = 7777777777.777;
+    battery_info->current_now = 0.9999999999999;
+    battery_info->technology = "Li-ion";
+    battery_info->status = "Charging";
+    battery_info->manufacture_date = "2020-07-30";
+    battery_info->temperature =
+        chromeos::cros_healthd::mojom::UInt64Value::New(7777777777777777);
+
+    auto info = chromeos::cros_healthd::mojom::TelemetryInfo::New();
+    info->battery_result =
+        chromeos::cros_healthd::mojom::BatteryResult::NewBatteryInfo(
+            std::move(battery_info));
+
+    DCHECK(chromeos::cros_healthd::FakeCrosHealthdClient::Get());
+
+    chromeos::cros_healthd::FakeCrosHealthdClient::Get()
+        ->SetProbeTelemetryInfoResponseForTesting(info);
+  }
+
   SandboxedWebUiAppTestBase::SetUpOnMainThread();
 }
diff --git a/chromeos/components/telemetry_extension_ui/test/telemetry_extension_ui_browsertest.js b/chromeos/components/telemetry_extension_ui/test/telemetry_extension_ui_browsertest.js
index 2c6881a4..f818f0e 100644
--- a/chromeos/components/telemetry_extension_ui/test/telemetry_extension_ui_browsertest.js
+++ b/chromeos/components/telemetry_extension_ui/test/telemetry_extension_ui_browsertest.js
@@ -67,6 +67,51 @@
   testDone();
 });
 
+// Tests that Telemetry.convert method correctly converts Mojo types into WebIDL
+// types.
+TEST_F(
+    'TelemetryExtensionUIBrowserTest', 'ConvertTelemetryMojoTypesToWebIDLTypes',
+    () => {
+      // null/undefined --> null.
+      assertEquals(telemetryProxy.convert(null), null);
+      assertEquals(telemetryProxy.convert(undefined), null);
+
+      // number/string --> number/string.
+      assertEquals(telemetryProxy.convert('simple string'), 'simple string');
+      assertEquals(telemetryProxy.convert(2020), 2020);
+
+      // {value: X} --> X if X is a number.
+      assertEquals(telemetryProxy.convert({value: 15}), 15);
+      assertEquals(telemetryProxy.convert({value: 777.555}), 777.555);
+
+      // {value: X} --> {value: X} if X is not a number.
+      assertDeepEquals(telemetryProxy.convert({value: 'ABC'}), {value: 'ABC'});
+      assertDeepEquals(
+          telemetryProxy.convert({value: {k: 'v'}}), {value: {k: 'v'}});
+
+      // omit null/undefined properties.
+      assertDeepEquals(
+          telemetryProxy.convert({a: 1, b: null, c: undefined}), {a: 1});
+      assertDeepEquals(
+          telemetryProxy.convert({a: {x: null, y: undefined, z: 'zZz'}}),
+          {a: {z: 'zZz'}});
+
+      // convert objects without properties to null.
+      assertEquals(telemetryProxy.convert({}), null);
+      assertEquals(telemetryProxy.convert({a: null, b: undefined}), null);
+      assertEquals(telemetryProxy.convert({a: {x: null, y: undefined}}), null);
+
+      assertDeepEquals(
+          telemetryProxy.convert({
+            a: 1,
+            b: null,
+            c: {x: {value: 1000}, y: 'YYY', z: {value: 'ZzZ'}}
+          }),
+          {a: 1, c: {x: 1000, y: 'YYY', z: {value: 'ZzZ'}}});
+
+      testDone();
+    });
+
 // Test cases injected into the untrusted context.
 // See implementations in untrusted_browsertest.js.
 
@@ -90,6 +135,13 @@
       testDone();
     });
 
+TEST_F(
+    'TelemetryExtensionUIBrowserTest', 'UntrustedRequestTelemetryInfo',
+    async () => {
+      await runTestInUntrusted('UntrustedRequestTelemetryInfo');
+      testDone();
+    });
+
 /**
  * @implements {chromeos.health.mojom.ProbeServiceInterface}
  */
@@ -123,18 +175,19 @@
   probeTelemetryInfo(categories) {
     this.probeTelemetryInfoCategories = categories;
 
-    const telemetryInfo = /** @type {!chromeos.health.mojom.TelemetryInfo} */ ({
-      backlightResult: null,
-      batteryResult: null,
-      blockDeviceResult: null,
-      bluetoothResult: null,
-      cpuResult: null,
-      fanResult: null,
-      memoryResult: null,
-      statefulPartitionResult: null,
-      timezoneResult: null,
-      vpdResult: null,
-    });
+    const telemetryInfo =
+        /** @type {!chromeos.health.mojom.TelemetryInfo} */ ({
+          backlightResult: null,
+          batteryResult: null,
+          blockDeviceResult: null,
+          bluetoothResult: null,
+          cpuResult: null,
+          fanResult: null,
+          memoryResult: null,
+          statefulPartitionResult: null,
+          timezoneResult: null,
+          vpdResult: null,
+        });
     return Promise.resolve({telemetryInfo});
   }
 };
@@ -173,8 +226,8 @@
 
 TEST_F(
     'TelemetryExtensionUIWithInterceptorBrowserTest',
-    'UntrustedRequestTelemetryInfo', async function() {
-      await runTestInUntrusted('UntrustedRequestTelemetryInfo');
+    'UntrustedRequestTelemetryInfoWithInterceptor', async function() {
+      await runTestInUntrusted('UntrustedRequestTelemetryInfoWithInterceptor');
 
       assertDeepEquals(this.probeService.probeTelemetryInfoCategories, [
         chromeos.health.mojom.ProbeCategoryEnum.kBattery,
diff --git a/chromeos/components/telemetry_extension_ui/test/untrusted_browsertest.js b/chromeos/components/telemetry_extension_ui/test/untrusted_browsertest.js
index 6f1e99a..d1ecfa9 100644
--- a/chromeos/components/telemetry_extension_ui/test/untrusted_browsertest.js
+++ b/chromeos/components/telemetry_extension_ui/test/untrusted_browsertest.js
@@ -56,8 +56,7 @@
   let caughtError = {};
 
   try {
-    await chromeos.telemetry.probeTelemetryInfo(
-        ['unknown-category']);
+    await chromeos.telemetry.probeTelemetryInfo(['unknown-category']);
   } catch (error) {
     caughtError = error;
   }
@@ -93,23 +92,39 @@
 // Tests that TelemetryInfo can be successfully requested from
 // from chrome-untrusted://.
 UNTRUSTED_TEST('UntrustedRequestTelemetryInfo', async () => {
-  /**
-   * @type {!chromeos.health.mojom.TelemetryInfo}
-   */
   const response = await chromeos.telemetry.probeTelemetryInfo([
     'battery', 'non-removable-block-devices', 'cached-vpd-data', 'cpu',
     'timezone', 'memory', 'backlight', 'fan', 'stateful-partition', 'bluetooth'
   ]);
+
   assertDeepEquals(response, {
-    'backlightResult': null,
-    'batteryResult': null,
-    'blockDeviceResult': null,
-    'bluetoothResult': null,
-    'cpuResult': null,
-    'fanResult': null,
-    'memoryResult': null,
-    'statefulPartitionResult': null,
-    'timezoneResult': null,
-    'vpdResult': null,
+    batteryResult: {
+      batteryInfo: {
+        cycleCount: 100000000000000,
+        voltageNow: 1234567890.123456,
+        vendor: 'Google',
+        serialNumber: 'abcdef',
+        chargeFullDesign: 3000000000000000,
+        chargeFull: 9000000000000000,
+        voltageMinDesign: 1000000000.1001,
+        modelName: 'Google Battery',
+        chargeNow: 7777777777.777,
+        currentNow: 0.9999999999999,
+        technology: 'Li-ion',
+        status: 'Charging',
+        manufactureDate: '2020-07-30',
+        temperature: 7777777777777777,
+      }
+    },
   });
 });
+
+// Tests that TelemetryInfo can be successfully requested from
+// from chrome-untrusted://.
+UNTRUSTED_TEST('UntrustedRequestTelemetryInfoWithInterceptor', async () => {
+  const response = await chromeos.telemetry.probeTelemetryInfo([
+    'battery', 'non-removable-block-devices', 'cached-vpd-data', 'cpu',
+    'timezone', 'memory', 'backlight', 'fan', 'stateful-partition', 'bluetooth'
+  ]);
+  assertDeepEquals(response, {});
+});
diff --git a/chromeos/constants/chromeos_features.cc b/chromeos/constants/chromeos_features.cc
index 6d19a77..ad8922a8 100644
--- a/chromeos/constants/chromeos_features.cc
+++ b/chromeos/constants/chromeos_features.cc
@@ -300,7 +300,7 @@
 
 // Enables or disables the display password button on login / lock screen.
 const base::Feature kLoginDisplayPasswordButton{
-    "LoginDisplayPasswordButton", base::FEATURE_DISABLED_BY_DEFAULT};
+    "LoginDisplayPasswordButton", base::FEATURE_ENABLED_BY_DEFAULT};
 
 // Controls whether to enable the requirement of a minimum chrome version on the
 // device through the policy MinimumChromeVersionEnforced. If the requirement is
diff --git a/components/arc/bluetooth/bluetooth_type_converters.cc b/components/arc/bluetooth/bluetooth_type_converters.cc
index d3b9f39..ea5c86c 100644
--- a/components/arc/bluetooth/bluetooth_type_converters.cc
+++ b/components/arc/bluetooth/bluetooth_type_converters.cc
@@ -16,6 +16,7 @@
 #include "components/arc/bluetooth/bluetooth_type_converters.h"
 #include "device/bluetooth/bluetooth_device.h"
 #include "device/bluetooth/bluetooth_gatt_service.h"
+#include "device/bluetooth/public/cpp/bluetooth_address.h"
 #include "device/bluetooth/public/cpp/bluetooth_uuid.h"
 
 namespace {
@@ -43,7 +44,7 @@
       arc::mojom::BluetoothAddress::New();
 
   mojo_addr->address.resize(kAddressSize);
-  if (!device::BluetoothDevice::ParseAddress(address, mojo_addr->address))
+  if (!device::ParseBluetoothAddress(address, mojo_addr->address))
     mojo_addr->address.clear();
 
   return mojo_addr;
diff --git a/components/autofill/core/browser/data_model/autofill_structured_address_component.cc b/components/autofill/core/browser/data_model/autofill_structured_address_component.cc
index d228959..5b6f529cb 100644
--- a/components/autofill/core/browser/data_model/autofill_structured_address_component.cc
+++ b/components/autofill/core/browser/data_model/autofill_structured_address_component.cc
@@ -9,6 +9,7 @@
 #include <string>
 #include <utility>
 
+#include "base/notreached.h"
 #include "base/strings/strcat.h"
 #include "base/strings/string16.h"
 #include "base/strings/string_piece.h"
@@ -16,6 +17,7 @@
 #include "base/strings/string_util.h"
 #include "base/strings/utf_string_conversions.h"
 #include "components/autofill/core/browser/autofill_type.h"
+#include "components/autofill/core/browser/data_model/autofill_structured_address_constants.h"
 #include "components/autofill/core/browser/data_model/autofill_structured_address_utils.h"
 #include "components/autofill/core/browser/field_types.h"
 
@@ -52,8 +54,13 @@
   if (this == &right)
     return *this;
 
-  value_ = right.value_;
-  value_verification_status_ = right.value_verification_status_;
+  if (right.IsValueAssigned()) {
+    value_ = right.value_;
+    value_verification_status_ = right.value_verification_status_;
+    sorted_normalized_tokens_ = right.sorted_normalized_tokens_;
+  } else {
+    UnsetValue();
+  }
 
   DCHECK(right.subcomponents_.size() == subcomponents_.size());
 
@@ -107,10 +114,12 @@
                                 VerificationStatus status) {
   value_ = std::move(value);
   value_verification_status_ = status;
+  sorted_normalized_tokens_ = TokenizeValue(value_.value());
 }
 
 void AddressComponent::UnsetValue() {
   value_.reset();
+  sorted_normalized_tokens_.clear();
   value_verification_status_ = VerificationStatus::kNoStatus;
 }
 
@@ -342,6 +351,9 @@
       for (const auto& result_entry : result_map) {
         std::string field_type = result_entry.first;
         base::string16 field_value = base::UTF8ToUTF16(result_entry.second);
+        // Do not reassign the value of this node.
+        if (field_type == GetStorageTypeName())
+          continue;
         bool success = SetValueForTypeIfPossible(field_type, field_value,
                                                  VerificationStatus::kParsed);
         // Setting the value should always work unless the regular expression is
@@ -559,6 +571,127 @@
   GetRootNode().RecursivelyUnsetParsedAndFormattedValues();
 }
 
+bool AddressComponent::MergeWithComponent(
+    const AddressComponent& newer_component) {
+  // If both components are the same, there is nothing to do.
+  if (*this == newer_component)
+    return true;
+
+  // Applies the merging strategy for two token-equivalent components.
+  if (AreSortedTokensEqual(GetSortedTokens(),
+                           newer_component.GetSortedTokens())) {
+    return MergeTokenEquivalentComponent(newer_component);
+  }
+  return false;
+}
+
+bool AddressComponent::MergeTokenEquivalentComponent(
+    const AddressComponent& newer_component) {
+  // Assumption:
+  // The values of both components are a permutation of the same tokens.
+  // The componentization of the components can be different in terms of
+  // how the tokens are divided between the subomponents. The valdiation
+  // status of the component and its subcomponent can be different.
+  //
+  // Merge Strategy:
+  // * Adopt the exact value (and validation status) of the node with the higher
+  // validation status.
+  //
+  // * For all subcomponents that have the same value, make a recursive call and
+  // use the result.
+  //
+  // * For the set of all non-matching subcomponents. Either use the ones from
+  // this component or the other depending on which substructure is better in
+  // terms of the number of validated tokens.
+
+  if (newer_component.GetVerificationStatus() > GetVerificationStatus())
+    SetValue(newer_component.GetValue(),
+             newer_component.GetVerificationStatus());
+
+  // Now, the substructure of the node must be merged. There are three cases:
+  //
+  // * All nodes of the substructure are pairwise mergeable. In this case it
+  // is sufficient to apply a recursive merging strategy.
+  //
+  // * None of the nodes of the substructure are pairwise mergeable. In this
+  // case, either the complete substructure of |this| or |newer_component|
+  // must be used. Which one to use can be decided by the higher validation
+  // score.
+  //
+  // * In a mixed scenario, there is at least one pair of mergeable nodes
+  // in the substructure and at least on pair of non-mergeable nodes. Here,
+  // the mergeable nodes are merged while all other nodes are taken either
+  // from |this| or the |newer_component| decided by the higher validation
+  // score of the unmerged nodes.
+  //
+  // The following algorithm combines the three cases by first trying to merge
+  // all components pair-wise. For all components that couldn't be merged, the
+  // verification score is summed for this and the other component. If the other
+  // component has an equal or larger score, finalize the merge by using its
+  // components. It is assumed that the other component is the newer of the two
+  // components. By favoring the other component in a tie, the most recently
+  // used structure wins.
+
+  const std::vector<AddressComponent*> other_subcomponents =
+      newer_component.Subcomponents();
+
+  DCHECK(subcomponents_.size() == newer_component.Subcomponents().size());
+
+  int this_component_verification_score = 0;
+  int newer_component_verification_score = 0;
+
+  std::vector<int> unmerged_indices;
+  unmerged_indices.reserve(subcomponents_.size());
+
+  for (size_t i = 0; i < subcomponents_.size(); i++) {
+    DCHECK(subcomponents_[i]->GetStorageType() ==
+           other_subcomponents.at(i)->GetStorageType());
+
+    // If the components can't be merged directly, store the ungermed index and
+    // sum the verification scores to decide which component's substructure to
+    // use.
+    if (!subcomponents_[i]->MergeWithComponent(*other_subcomponents.at(i))) {
+      this_component_verification_score +=
+          subcomponents_[i]->GetStructureVerificationScore();
+      newer_component_verification_score +=
+          other_subcomponents.at(i)->GetStructureVerificationScore();
+      unmerged_indices.emplace_back(i);
+    }
+  }
+
+  // If the total verification score of all unmerged components of the other
+  // component is equal or larger than the score of this component, use its
+  // subcomponents including their substructure for all unmerged components.
+  if (newer_component_verification_score >= this_component_verification_score) {
+    for (size_t i : unmerged_indices)
+      *subcomponents_[i] = *other_subcomponents[i];
+  }
+
+  return true;
+}
+
+int AddressComponent::GetStructureVerificationScore() const {
+  int result = 0;
+  switch (GetVerificationStatus()) {
+    case VerificationStatus::kNoStatus:
+    case VerificationStatus::kParsed:
+    case VerificationStatus::kFormatted:
+      break;
+    case VerificationStatus::kObserved:
+      result += 1;
+      break;
+    case VerificationStatus::kUserVerified:
+      // In the current implementation, only the root not can be verified by
+      // the user.
+      NOTREACHED();
+      break;
+  }
+  for (const AddressComponent* component : subcomponents_)
+    result += component->GetStructureVerificationScore();
+
+  return result;
+}
+
 }  // namespace structured_address
 
 }  // namespace autofill
diff --git a/components/autofill/core/browser/data_model/autofill_structured_address_component.h b/components/autofill/core/browser/data_model/autofill_structured_address_component.h
index c6abab4..ed4d5a74 100644
--- a/components/autofill/core/browser/data_model/autofill_structured_address_component.h
+++ b/components/autofill/core/browser/data_model/autofill_structured_address_component.h
@@ -241,6 +241,29 @@
   // Unassigns all nodes with parsed or formatted values.
   void RecursivelyUnsetParsedAndFormattedValues();
 
+  // Merge |newer_component| into this AddressComponent.
+  // Returns false if the merging is not possible.
+  // The state of the component is not altered by a failed merging attempt.
+  virtual bool MergeWithComponent(const AddressComponent& newer_component);
+
+  // Merge |newer_component| into this AddressComponent.
+  // The merging is possible iff the value of both root nodes is token
+  // equivalent, meaning they contain the same tokens in an arbitrary order.
+  // Returns false if the merging is not possible.
+  // The state of the component is not altered by a failed merging attempt.
+  bool MergeTokenEquivalentComponent(const AddressComponent& newer_component);
+
+  // Returns a constant vector of pointers to the child nodes of the component.
+  const std::vector<AddressComponent*>& Subcomponents() const {
+    return subcomponents_;
+  }
+
+  // Returns a constant reference to the sorted canonicalized tokens of the
+  // value of the component.
+  const std::vector<base::string16>& GetSortedTokens() const {
+    return sorted_normalized_tokens_;
+  }
+
 #ifdef UNIT_TEST
   // Initiates the formatting of the values from the subcomponents.
   void FormatValueFromSubcomponentsForTesting() {
@@ -276,6 +299,10 @@
 #endif
 
  protected:
+  // Returns the verification score of this component and its substructure.
+  // Each observed node contributes to the validation score by 1.
+  virtual int GetStructureVerificationScore() const;
+
   // Returns a vector containing the |storage_types_| of all direct
   // subcomponents.
   std::vector<ServerFieldType> GetSubcomponentTypes() const;
@@ -370,6 +397,12 @@
   // A pointer to the parent node. It is set to nullptr if the node is the root
   // node of the AddressComponent tree.
   AddressComponent* const parent_;
+
+  // A vector that contains the tokens of |value_| after normalization,
+  // meaning that it was converted to lower case and diacritics have been
+  // removed. |value_| is tokenized by splitting the string by white spaces and
+  // commas. It is calculated when |value_| is set.
+  std::vector<base::string16> sorted_normalized_tokens_;
 };
 
 }  // namespace structured_address
diff --git a/components/autofill/core/browser/data_model/autofill_structured_address_component_unittest.cc b/components/autofill/core/browser/data_model/autofill_structured_address_component_unittest.cc
index 52d1934..33a7447 100644
--- a/components/autofill/core/browser/data_model/autofill_structured_address_component_unittest.cc
+++ b/components/autofill/core/browser/data_model/autofill_structured_address_component_unittest.cc
@@ -16,6 +16,7 @@
 #include "testing/gtest/include/gtest/gtest.h"
 
 using base::ASCIIToUTF16;
+using base::UTF8ToUTF16;
 
 namespace autofill {
 namespace structured_address {
@@ -161,7 +162,7 @@
 
   // Introduces a custom format with a leading last name.
   base::string16 GetBestFormatString() const override {
-    return base::ASCIIToUTF16("${NAME_LAST}, ${NAME_FIRST}");
+    return ASCIIToUTF16("${NAME_LAST}, ${NAME_FIRST}");
   }
 
  private:
@@ -185,7 +186,7 @@
 
   // Introduce a custom format with a leading last name.
   base::string16 GetBestFormatString() const override {
-    return base::ASCIIToUTF16("${NAME_LAST}, ${NAME_FIRST} ${NOT_SUPPORTED}");
+    return ASCIIToUTF16("${NAME_LAST}, ${NAME_FIRST} ${NOT_SUPPORTED}");
   }
 
  private:
@@ -280,20 +281,19 @@
 TEST(AutofillStructuredAddressAddressComponent, TestSetFieldTypeValue) {
   TestCompoundNameAddressComponent compound_name;
   EXPECT_TRUE(compound_name.SetValueForTypeIfPossible(
-      NAME_MIDDLE_INITIAL, base::UTF8ToUTF16("M"),
-      VerificationStatus::kObserved));
+      NAME_MIDDLE_INITIAL, UTF8ToUTF16("M"), VerificationStatus::kObserved));
 
-  EXPECT_EQ(compound_name.GetValueForType(NAME_MIDDLE), base::UTF8ToUTF16("M"));
+  EXPECT_EQ(compound_name.GetValueForType(NAME_MIDDLE), UTF8ToUTF16("M"));
 }
 
 // Tests retrieving an additional field type.
 TEST(AutofillStructuredAddressAddressComponent, TestGetFieldTypeValue) {
   TestCompoundNameAddressComponent compound_name;
   EXPECT_TRUE(compound_name.SetValueForTypeIfPossible(
-      NAME_MIDDLE, base::UTF8ToUTF16("Middle"), VerificationStatus::kObserved));
+      NAME_MIDDLE, UTF8ToUTF16("Middle"), VerificationStatus::kObserved));
 
   EXPECT_EQ(compound_name.GetValueForType(NAME_MIDDLE_INITIAL),
-            base::UTF8ToUTF16("M"));
+            UTF8ToUTF16("M"));
   EXPECT_EQ(compound_name.GetVerificationStatusForType(NAME_MIDDLE_INITIAL),
             VerificationStatus::kObserved);
 }
@@ -329,8 +329,8 @@
   AddressComponent left(NAME_FIRST);
   AddressComponent right(NAME_FIRST);
 
-  left.SetValue(base::UTF8ToUTF16("some value"), VerificationStatus::kParsed);
-  right.SetValue(base::UTF8ToUTF16("some other value"),
+  left.SetValue(UTF8ToUTF16("some value"), VerificationStatus::kParsed);
+  right.SetValue(UTF8ToUTF16("some other value"),
                  VerificationStatus::kFormatted);
   EXPECT_NE(left.GetValue(), right.GetValue());
   EXPECT_NE(left.GetVerificationStatus(), right.GetVerificationStatus());
@@ -338,7 +338,7 @@
   EXPECT_FALSE(left == right);
   EXPECT_TRUE(left != right);
 
-  right.SetValue(base::UTF8ToUTF16("some value"), VerificationStatus::kParsed);
+  right.SetValue(UTF8ToUTF16("some value"), VerificationStatus::kParsed);
 
   EXPECT_TRUE(left == right);
   EXPECT_FALSE(left != right);
@@ -370,15 +370,13 @@
   TestCompoundNameAddressComponent right;
 
   // Set left to a value and verify its state.
-  left.SetValueForTypeIfPossible(NAME_FULL,
-                                 base::UTF8ToUTF16("First Middle Last"),
+  left.SetValueForTypeIfPossible(NAME_FULL, UTF8ToUTF16("First Middle Last"),
                                  VerificationStatus::kObserved);
   EXPECT_TRUE(left.CompleteFullTree());
-  EXPECT_EQ(left.GetValueForType(NAME_FULL),
-            base::UTF8ToUTF16("First Middle Last"));
-  EXPECT_EQ(left.GetValueForType(NAME_FIRST), base::UTF8ToUTF16("First"));
-  EXPECT_EQ(left.GetValueForType(NAME_MIDDLE), base::UTF8ToUTF16("Middle"));
-  EXPECT_EQ(left.GetValueForType(NAME_LAST), base::UTF8ToUTF16("Last"));
+  EXPECT_EQ(left.GetValueForType(NAME_FULL), UTF8ToUTF16("First Middle Last"));
+  EXPECT_EQ(left.GetValueForType(NAME_FIRST), UTF8ToUTF16("First"));
+  EXPECT_EQ(left.GetValueForType(NAME_MIDDLE), UTF8ToUTF16("Middle"));
+  EXPECT_EQ(left.GetValueForType(NAME_LAST), UTF8ToUTF16("Last"));
   EXPECT_EQ(left.GetVerificationStatusForType(NAME_FULL),
             VerificationStatus::kObserved);
   EXPECT_EQ(left.GetVerificationStatusForType(NAME_FIRST),
@@ -389,15 +387,13 @@
             VerificationStatus::kParsed);
 
   // Set right to another value and verify its state.
-  right.SetValueForTypeIfPossible(NAME_FULL,
-                                  base::UTF8ToUTF16("The Dark Knight"),
+  right.SetValueForTypeIfPossible(NAME_FULL, UTF8ToUTF16("The Dark Knight"),
                                   VerificationStatus::kUserVerified);
   EXPECT_TRUE(right.CompleteFullTree());
-  EXPECT_EQ(right.GetValueForType(NAME_FULL),
-            base::UTF8ToUTF16("The Dark Knight"));
-  EXPECT_EQ(right.GetValueForType(NAME_FIRST), base::UTF8ToUTF16("The"));
-  EXPECT_EQ(right.GetValueForType(NAME_MIDDLE), base::UTF8ToUTF16("Dark"));
-  EXPECT_EQ(right.GetValueForType(NAME_LAST), base::UTF8ToUTF16("Knight"));
+  EXPECT_EQ(right.GetValueForType(NAME_FULL), UTF8ToUTF16("The Dark Knight"));
+  EXPECT_EQ(right.GetValueForType(NAME_FIRST), UTF8ToUTF16("The"));
+  EXPECT_EQ(right.GetValueForType(NAME_MIDDLE), UTF8ToUTF16("Dark"));
+  EXPECT_EQ(right.GetValueForType(NAME_LAST), UTF8ToUTF16("Knight"));
   EXPECT_EQ(right.GetVerificationStatusForType(NAME_FULL),
             VerificationStatus::kUserVerified);
   EXPECT_EQ(right.GetVerificationStatusForType(NAME_FIRST),
@@ -413,7 +409,7 @@
   // Set left to the same values as right and verify that it is now equal.
   TestCompoundNameAddressComponent same_right;
   same_right.SetValueForTypeIfPossible(NAME_FULL,
-                                       base::UTF8ToUTF16("The Dark Knight"),
+                                       UTF8ToUTF16("The Dark Knight"),
                                        VerificationStatus::kUserVerified);
   EXPECT_TRUE(same_right.CompleteFullTree());
 
@@ -421,7 +417,7 @@
   EXPECT_FALSE(right != same_right);
 
   // Change one subcomponent and verify that it is not equal anymore.
-  same_right.SetValueForTypeIfPossible(NAME_LAST, base::UTF8ToUTF16("Joker"),
+  same_right.SetValueForTypeIfPossible(NAME_LAST, UTF8ToUTF16("Joker"),
                                        VerificationStatus::kParsed);
   EXPECT_TRUE(right != same_right);
   EXPECT_FALSE(right == same_right);
@@ -432,12 +428,12 @@
   AddressComponent left(NAME_FIRST);
   AddressComponent right(NAME_FIRST);
 
-  left.SetValue(base::UTF8ToUTF16("some value"), VerificationStatus::kParsed);
-  right.SetValue(base::UTF8ToUTF16("some other value"),
+  left.SetValue(UTF8ToUTF16("some value"), VerificationStatus::kParsed);
+  right.SetValue(UTF8ToUTF16("some other value"),
                  VerificationStatus::kFormatted);
   EXPECT_FALSE(left == right);
 
-  left.SetValue(base::UTF8ToUTF16("some other value"),
+  left.SetValue(UTF8ToUTF16("some other value"),
                 VerificationStatus::kFormatted);
   EXPECT_TRUE(left == right);
 }
@@ -448,13 +444,11 @@
   TestCompoundNameAddressComponent left;
   TestCompoundNameAddressComponent right;
 
-  left.SetValueForTypeIfPossible(NAME_FULL,
-                                 base::UTF8ToUTF16("First Middle Last"),
+  left.SetValueForTypeIfPossible(NAME_FULL, UTF8ToUTF16("First Middle Last"),
                                  VerificationStatus::kObserved);
   left.RecursivelyCompleteTree();
 
-  right.SetValueForTypeIfPossible(NAME_FULL,
-                                  base::UTF8ToUTF16("The Dark Knight"),
+  right.SetValueForTypeIfPossible(NAME_FULL, UTF8ToUTF16("The Dark Knight"),
                                   VerificationStatus::kParsed);
   right.RecursivelyCompleteTree();
 
@@ -468,13 +462,11 @@
 TEST(AutofillStructuredAddressAddressComponent, SelfAssignment) {
   TestCompoundNameAddressComponent left;
 
-  left.SetValueForTypeIfPossible(NAME_FULL,
-                                 base::UTF8ToUTF16("First Middle Last"),
+  left.SetValueForTypeIfPossible(NAME_FULL, UTF8ToUTF16("First Middle Last"),
                                  VerificationStatus::kObserved);
   left = *(&left);
 
-  EXPECT_EQ(left.GetValueForType(NAME_FULL),
-            base::UTF8ToUTF16("First Middle Last"));
+  EXPECT_EQ(left.GetValueForType(NAME_FULL), UTF8ToUTF16("First Middle Last"));
 }
 
 // Tests that the correct storage types are returned.
@@ -508,7 +500,7 @@
 
 // Tests directly setting and retrieving values.
 TEST(AutofillStructuredAddressAddressComponent, DirectlyGetSetAndUnsetValue) {
-  base::string16 test_value = base::ASCIIToUTF16("test_value");
+  base::string16 test_value = ASCIIToUTF16("test_value");
 
   // Create an atomic structured component and verify its initial unset state
   TestAtomicFirstNameAddressComponent first_name_component;
@@ -535,7 +527,7 @@
 // Tests recursively setting and retrieving values.
 TEST(AutofillStructuredAddressAddressComponent,
      RecursivelySettingAndGettingValues) {
-  base::string16 test_value = base::ASCIIToUTF16("test_value");
+  base::string16 test_value = ASCIIToUTF16("test_value");
 
   // Create a compound component that has a child of type NAME_FIRST.
   TestCompoundNameAddressComponent compound_component;
@@ -583,7 +575,7 @@
 TEST(AutofillStructuredAddressAddressComponent, GetBestFormatString_ForAtom) {
   TestAtomicFirstNameAddressComponent first_name_component;
   EXPECT_EQ(first_name_component.GetBestFormatStringForTesting(),
-            base::UTF8ToUTF16("${NAME_FIRST}"));
+            UTF8ToUTF16("${NAME_FIRST}"));
 }
 
 // Tests getting the best format string using the fallback mechanism.
@@ -780,12 +772,12 @@
 TEST(AutofillStructuredAddressAddressComponent,
      TestParseValueAndAssignSubcomponentsByFallbackMethod_Atom) {
   TestAtomicFirstNameAddressComponent atomic_component;
-  atomic_component.SetValue(base::UTF8ToUTF16("Dangerzone"),
+  atomic_component.SetValue(UTF8ToUTF16("Dangerzone"),
                             VerificationStatus::kObserved);
   atomic_component.ParseValueAndAssignSubcomponents();
 
   // The parsing should not crash the browser and keep the initial value intact.
-  EXPECT_EQ(base::UTF8ToUTF16("Dangerzone"), atomic_component.GetValue());
+  EXPECT_EQ(UTF8ToUTF16("Dangerzone"), atomic_component.GetValue());
 }
 
 // Tests the fallback method to parse a value into its components if there are
@@ -1012,8 +1004,8 @@
 
   // Change the value of FULL_NAME and invalidate all child and ancestor nodes.
   compound_component.SetValueForTypeIfPossible(
-      NAME_FULL, base::UTF8ToUTF16("Oh' Brian"), VerificationStatus::kObserved,
-      true, true);
+      NAME_FULL, UTF8ToUTF16("Oh' Brian"), VerificationStatus::kObserved, true,
+      true);
   EXPECT_EQ(compound_component.GetValueForType(CREDIT_CARD_NAME_FULL),
             base::string16());
   EXPECT_EQ(compound_component.GetValueForType(NAME_FIRST), base::string16());
@@ -1081,7 +1073,7 @@
   // Set a value somewhere in the tree, complete and verify that another node is
   // assigned.
   compound_component.SetValueForTypeIfPossible(
-      NAME_FULL, base::UTF8ToUTF16("Winston Brian Smith"),
+      NAME_FULL, UTF8ToUTF16("Winston Brian Smith"),
       VerificationStatus::kObserved);
   EXPECT_EQ(VerificationStatus::kObserved,
             compound_component.GetVerificationStatusForType(NAME_FULL));
@@ -1103,5 +1095,186 @@
       compound_component.GetVerificationStatusForType(CREDIT_CARD_NAME_FULL));
 }
 
+TEST(AutofillStructuredAddressAddressComponent,
+     MergeAtomicComponentsWithDifferentValues) {
+  TestAtomicFirstNameAddressComponent one;
+  one.SetValue(ASCIIToUTF16("Peter"), VerificationStatus::kFormatted);
+
+  TestAtomicFirstNameAddressComponent two;
+  two.SetValue(ASCIIToUTF16("Hook"), VerificationStatus::kUserVerified);
+
+  // |one| and |two| are note mergeable because they contain completely
+  // different values.
+  EXPECT_FALSE(one.MergeWithComponent(two));
+  // Since |one| and |two| are not mergeable, it is expected that the value of
+  // |one| is preserved.
+  EXPECT_EQ(one.GetValue(), ASCIIToUTF16("Peter"));
+  EXPECT_EQ(one.GetVerificationStatus(), VerificationStatus::kFormatted);
+}
+
+TEST(AutofillStructuredAddressAddressComponent,
+     MergeAtomicComponentsWithSameValue) {
+  TestAtomicFirstNameAddressComponent one;
+  one.SetValue(ASCIIToUTF16("Peter"), VerificationStatus::kFormatted);
+
+  TestAtomicFirstNameAddressComponent two;
+  two.SetValue(ASCIIToUTF16("Peter"), VerificationStatus::kUserVerified);
+
+  EXPECT_TRUE(one.MergeWithComponent(two));
+  EXPECT_EQ(one.GetValue(), ASCIIToUTF16("Peter"));
+
+  // The actual action is that the higher verification status is picked.
+  EXPECT_EQ(one.GetVerificationStatus(), VerificationStatus::kUserVerified);
+}
+
+TEST(AutofillStructuredAddressAddressComponent,
+     MergeAtomicComponentsSimilarValueThatContainsSameNormalizedValue) {
+  TestAtomicFirstNameAddressComponent one;
+  one.SetValue(UTF8ToUTF16("müller"), VerificationStatus::kFormatted);
+
+  TestAtomicFirstNameAddressComponent two;
+  two.SetValue(UTF8ToUTF16("Muller"), VerificationStatus::kUserVerified);
+
+  // Should be mergeable because the values are the same after normalization.
+  EXPECT_TRUE(one.MergeWithComponent(two));
+  // The value should be Muller bebause of its higher validation status.
+  EXPECT_EQ(one.GetValue(), ASCIIToUTF16("Muller"));
+
+  // The actual action is that the higher verification status is picked.
+  EXPECT_EQ(one.GetVerificationStatus(), VerificationStatus::kUserVerified);
+}
+
+TEST(AutofillStructuredAddressAddressComponent,
+     MergeAtomicComponentsWithPermutatedValue) {
+  TestAtomicFirstNameAddressComponent one;
+  one.SetValue(ASCIIToUTF16("Peter Pan"), VerificationStatus::kFormatted);
+
+  TestAtomicFirstNameAddressComponent two;
+  two.SetValue(ASCIIToUTF16("Pan Peter"), VerificationStatus::kUserVerified);
+
+  EXPECT_TRUE(one.MergeWithComponent(two));
+  EXPECT_EQ(one.GetValue(), ASCIIToUTF16("Pan Peter"));
+  EXPECT_EQ(one.GetVerificationStatus(), VerificationStatus::kUserVerified);
+
+  // If the merging is applied the other way round, the value of two is not
+  // altered because |two| has the higher validation status.
+  one.SetValue(ASCIIToUTF16("Peter Pan"), VerificationStatus::kFormatted);
+  EXPECT_TRUE(two.MergeWithComponent(one));
+  EXPECT_EQ(two.GetValue(), ASCIIToUTF16("Pan Peter"));
+  EXPECT_EQ(two.GetVerificationStatus(), VerificationStatus::kUserVerified);
+}
+
+// This test verifies that if two value-equal components are merged, the higher
+// verification statuses are picked.
+TEST(AutofillStructuredAddressAddressComponent,
+     MergeTriviallyMergeableCompoundComponents) {
+  TestCompoundNameAddressComponent one;
+  TestCompoundNameAddressComponent two;
+
+  EXPECT_TRUE(one.SetValueForTypeIfPossible(
+      NAME_FULL, ASCIIToUTF16("First LastFirst LastSecond"),
+      VerificationStatus::kUserVerified));
+  one.CompleteFullTree();
+
+  EXPECT_EQ(one.GetValueForType(NAME_FIRST), ASCIIToUTF16("First"));
+  EXPECT_EQ(one.GetValueForType(NAME_MIDDLE), ASCIIToUTF16("LastFirst"));
+  EXPECT_EQ(one.GetValueForType(NAME_LAST), ASCIIToUTF16("LastSecond"));
+  EXPECT_EQ(one.GetVerificationStatusForType(NAME_FIRST),
+            VerificationStatus::kParsed);
+  EXPECT_EQ(one.GetVerificationStatusForType(NAME_MIDDLE),
+            VerificationStatus::kParsed);
+  EXPECT_EQ(one.GetVerificationStatusForType(NAME_LAST),
+            VerificationStatus::kParsed);
+
+  EXPECT_TRUE(two.SetValueForTypeIfPossible(NAME_FIRST, ASCIIToUTF16("First"),
+                                            VerificationStatus::kObserved));
+  EXPECT_TRUE(two.SetValueForTypeIfPossible(
+      NAME_LAST, ASCIIToUTF16("LastFirst LastSecond"),
+      VerificationStatus::kObserved));
+  two.CompleteFullTree();
+  EXPECT_EQ(two.GetValueForType(NAME_FULL),
+            ASCIIToUTF16("First LastFirst LastSecond"));
+  EXPECT_EQ(two.GetValueForType(NAME_MIDDLE), ASCIIToUTF16(""));
+
+  EXPECT_TRUE(one.MergeWithComponent(two));
+  EXPECT_EQ(one.GetValueForType(NAME_FULL),
+            ASCIIToUTF16("First LastFirst LastSecond"));
+  EXPECT_EQ(one.GetVerificationStatusForType(NAME_FULL),
+            VerificationStatus::kUserVerified);
+  EXPECT_EQ(one.GetValueForType(NAME_FIRST), ASCIIToUTF16("First"));
+  EXPECT_EQ(one.GetVerificationStatusForType(NAME_FIRST),
+            VerificationStatus::kObserved);
+  EXPECT_EQ(one.GetValueForType(NAME_MIDDLE), ASCIIToUTF16(""));
+  EXPECT_EQ(one.GetValueForType(NAME_LAST),
+            ASCIIToUTF16("LastFirst LastSecond"));
+  EXPECT_EQ(one.GetVerificationStatusForType(NAME_LAST),
+            VerificationStatus::kObserved);
+}
+
+// This test verifies that the formatted value is successfully replaced by the
+// user-verified value while the substructure is corrected by the observation.
+TEST(AutofillStructuredAddressAddressComponent, MergePermutatedComponent) {
+  TestCompoundNameAddressComponent one;
+  TestCompoundNameAddressComponent two;
+
+  // The first component has the unstructured representation as the user
+  // verified it, but a wrong componentization.
+  EXPECT_TRUE(one.SetValueForTypeIfPossible(NAME_FULL,
+                                            ASCIIToUTF16("Last First Middle"),
+                                            VerificationStatus::kUserVerified));
+  EXPECT_TRUE(one.SetValueForTypeIfPossible(NAME_FIRST, ASCIIToUTF16("Last"),
+                                            VerificationStatus::kParsed));
+  EXPECT_TRUE(one.SetValueForTypeIfPossible(NAME_MIDDLE, ASCIIToUTF16("First"),
+                                            VerificationStatus::kParsed));
+  EXPECT_TRUE(one.SetValueForTypeIfPossible(NAME_LAST, ASCIIToUTF16("Middle"),
+                                            VerificationStatus::kParsed));
+
+  // The second component has a correct componentization but not the
+  // unstructured representation the user prefers.
+  EXPECT_TRUE(two.SetValueForTypeIfPossible(NAME_FULL,
+                                            ASCIIToUTF16("First Last Middle"),
+                                            VerificationStatus::kFormatted));
+  EXPECT_TRUE(two.SetValueForTypeIfPossible(NAME_FIRST, ASCIIToUTF16("First"),
+                                            VerificationStatus::kObserved));
+  EXPECT_TRUE(two.SetValueForTypeIfPossible(NAME_MIDDLE, ASCIIToUTF16("Middle"),
+                                            VerificationStatus::kObserved));
+  EXPECT_TRUE(two.SetValueForTypeIfPossible(NAME_LAST, ASCIIToUTF16("Last"),
+                                            VerificationStatus::kObserved));
+
+  TestCompoundNameAddressComponent copy_of_one;
+  copy_of_one = one;
+  EXPECT_TRUE(one.MergeWithComponent(two));
+
+  // As a result of the merging, the unstructured representation should be
+  // maintained, but the substructure should be corrected
+  EXPECT_EQ(one.GetValueForType(NAME_FULL), ASCIIToUTF16("Last First Middle"));
+  EXPECT_EQ(one.GetVerificationStatusForType(NAME_FULL),
+            VerificationStatus::kUserVerified);
+  EXPECT_EQ(one.GetValueForType(NAME_FIRST), ASCIIToUTF16("First"));
+  EXPECT_EQ(one.GetVerificationStatusForType(NAME_FIRST),
+            VerificationStatus::kObserved);
+  EXPECT_EQ(one.GetValueForType(NAME_MIDDLE), ASCIIToUTF16("Middle"));
+  EXPECT_EQ(one.GetVerificationStatusForType(NAME_MIDDLE),
+            VerificationStatus::kObserved);
+  EXPECT_EQ(one.GetValueForType(NAME_LAST), ASCIIToUTF16("Last"));
+  EXPECT_EQ(one.GetVerificationStatusForType(NAME_LAST),
+            VerificationStatus::kObserved);
+
+  // The merging should work in both directions the same way.
+  EXPECT_TRUE(two.MergeWithComponent(copy_of_one));
+  EXPECT_EQ(two.GetValueForType(NAME_FULL), ASCIIToUTF16("Last First Middle"));
+  EXPECT_EQ(two.GetVerificationStatusForType(NAME_FULL),
+            VerificationStatus::kUserVerified);
+  EXPECT_EQ(two.GetValueForType(NAME_FIRST), ASCIIToUTF16("First"));
+  EXPECT_EQ(two.GetVerificationStatusForType(NAME_FIRST),
+            VerificationStatus::kObserved);
+  EXPECT_EQ(two.GetValueForType(NAME_MIDDLE), ASCIIToUTF16("Middle"));
+  EXPECT_EQ(two.GetVerificationStatusForType(NAME_MIDDLE),
+            VerificationStatus::kObserved);
+  EXPECT_EQ(two.GetValueForType(NAME_LAST), ASCIIToUTF16("Last"));
+  EXPECT_EQ(two.GetVerificationStatusForType(NAME_LAST),
+            VerificationStatus::kObserved);
+}
+
 }  // namespace structured_address
 }  // namespace autofill
diff --git a/components/autofill/core/browser/data_model/autofill_structured_address_name_unittest.cc b/components/autofill/core/browser/data_model/autofill_structured_address_name_unittest.cc
index 2fdea8b..19594dc 100644
--- a/components/autofill/core/browser/data_model/autofill_structured_address_name_unittest.cc
+++ b/components/autofill/core/browser/data_model/autofill_structured_address_name_unittest.cc
@@ -362,5 +362,164 @@
   EXPECT_EQ(full_name.GetValueForType(NAME_MIDDLE), base::UTF8ToUTF16("M"));
 }
 
+TEST(AutofillStructuredName, MergePermutatedNames) {
+  NameFull one;
+  NameFull two;
+
+  // The first component has an observed substructure of the full name.
+  EXPECT_TRUE(one.SetValueForTypeIfPossible(
+      NAME_FIRST, base::ASCIIToUTF16("First"), VerificationStatus::kObserved));
+  EXPECT_TRUE(one.SetValueForTypeIfPossible(
+      NAME_LAST, base::ASCIIToUTF16("Last"), VerificationStatus::kObserved));
+  one.CompleteFullTree();
+
+  // The formatted full name has the canonical representation "FIRST LAST".
+  EXPECT_EQ(one.GetValueForType(NAME_FULL), base::ASCIIToUTF16("First Last"));
+  EXPECT_EQ(one.GetVerificationStatusForType(NAME_FULL),
+            VerificationStatus::kFormatted);
+
+  // In contrast, the second component has a verified name in an alternative
+  // representation "LAST, FIRST"
+  EXPECT_TRUE(two.SetValueForTypeIfPossible(NAME_FULL,
+                                            base::ASCIIToUTF16("Last, First"),
+                                            VerificationStatus::kUserVerified));
+  EXPECT_EQ(two.GetVerificationStatusForType(NAME_FULL),
+            VerificationStatus::kUserVerified);
+  EXPECT_TRUE(two.CompleteFullTree());
+  EXPECT_EQ(two.GetVerificationStatusForType(NAME_FULL),
+            VerificationStatus::kUserVerified);
+
+  EXPECT_EQ(two.GetValueForType(NAME_FIRST), base::ASCIIToUTF16("First"));
+  EXPECT_EQ(two.GetValueForType(NAME_LAST), base::ASCIIToUTF16("Last"));
+
+  EXPECT_TRUE(one.MergeWithComponent(two));
+
+  // It is expected that the alternative representation of the second component
+  // is merged into the first one, while maintaining the observed substructure.
+  EXPECT_EQ(one.GetValueForType(NAME_FULL), base::ASCIIToUTF16("Last, First"));
+  EXPECT_EQ(one.GetVerificationStatusForType(NAME_FULL),
+            VerificationStatus::kUserVerified);
+  EXPECT_EQ(one.GetValueForType(NAME_FIRST), base::ASCIIToUTF16("First"));
+  EXPECT_EQ(one.GetVerificationStatusForType(NAME_FIRST),
+            VerificationStatus::kObserved);
+  EXPECT_EQ(one.GetValueForType(NAME_LAST), base::ASCIIToUTF16("Last"));
+  EXPECT_EQ(one.GetVerificationStatusForType(NAME_LAST),
+            VerificationStatus::kObserved);
+}
+
+TEST(AutofillStructuredName, MergeNamesByCombiningSubstructureObservations) {
+  NameFull one;
+  NameFull two;
+
+  // The first name has an incorrect componentization of the last name, but a
+  // correctly observed structure of title, first, middle, last.
+  one.SetValueForTypeIfPossible(
+      NAME_FULL, base::ASCIIToUTF16("Mr Pablo Diego Ruiz y Picasso"),
+      VerificationStatus::kUserVerified);
+  one.SetValueForTypeIfPossible(NAME_HONORIFIC_PREFIX, base::ASCIIToUTF16("Mr"),
+                                VerificationStatus::kObserved);
+  one.SetValueForTypeIfPossible(NAME_FIRST, base::ASCIIToUTF16("Pablo Diego"),
+                                VerificationStatus::kObserved);
+  one.SetValueForTypeIfPossible(NAME_MIDDLE, base::ASCIIToUTF16(""),
+                                VerificationStatus::kObserved);
+  one.SetValueForTypeIfPossible(NAME_LAST, base::ASCIIToUTF16("Ruiz y Picasso"),
+                                VerificationStatus::kObserved);
+  one.SetValueForTypeIfPossible(NAME_LAST_SECOND,
+                                base::ASCIIToUTF16("Ruiz y Picasso"),
+                                VerificationStatus::kParsed);
+
+  // The second name has a correct componentization of the last name, but an
+  // incorrectly parsed structure of title,first,middle,last.
+  two.SetValueForTypeIfPossible(
+      NAME_FULL, base::ASCIIToUTF16("Mr Pablo Diego Ruiz y Picasso"),
+      VerificationStatus::kUserVerified);
+  two.SetValueForTypeIfPossible(NAME_HONORIFIC_PREFIX, base::ASCIIToUTF16(""),
+                                VerificationStatus::kParsed);
+  two.SetValueForTypeIfPossible(NAME_FIRST, base::ASCIIToUTF16("Mr Pablo"),
+                                VerificationStatus::kParsed);
+  two.SetValueForTypeIfPossible(NAME_MIDDLE, base::ASCIIToUTF16("Diege"),
+                                VerificationStatus::kParsed);
+  two.SetValueForTypeIfPossible(NAME_LAST, base::ASCIIToUTF16("Ruiz y Picasso"),
+                                VerificationStatus::kParsed);
+  two.SetValueForTypeIfPossible(NAME_LAST_FIRST, base::ASCIIToUTF16("Ruiz"),
+                                VerificationStatus::kObserved);
+  two.SetValueForTypeIfPossible(NAME_LAST_CONJUNCTION, base::ASCIIToUTF16("y"),
+                                VerificationStatus::kObserved);
+  two.SetValueForTypeIfPossible(NAME_LAST_SECOND, base::ASCIIToUTF16("Picasso"),
+                                VerificationStatus::kObserved);
+
+  // By merging both, it is expected that the title, first, middle, last
+  // structure of |one| is maintained, while the substructure of the last name
+  // is taken from two.
+  NameFull copy_of_one;
+  copy_of_one = one;
+  EXPECT_TRUE(one.MergeWithComponent(two));
+
+  EXPECT_EQ(one.GetValueForType(NAME_FULL),
+            base::ASCIIToUTF16("Mr Pablo Diego Ruiz y Picasso"));
+  EXPECT_EQ(one.GetValueForType(NAME_HONORIFIC_PREFIX),
+            base::ASCIIToUTF16("Mr"));
+  EXPECT_EQ(one.GetValueForType(NAME_FIRST), base::ASCIIToUTF16("Pablo Diego"));
+  EXPECT_EQ(one.GetValueForType(NAME_MIDDLE), base::ASCIIToUTF16(""));
+  EXPECT_EQ(one.GetValueForType(NAME_LAST),
+            base::ASCIIToUTF16("Ruiz y Picasso"));
+  EXPECT_EQ(one.GetValueForType(NAME_LAST_FIRST), base::ASCIIToUTF16("Ruiz"));
+  EXPECT_EQ(one.GetValueForType(NAME_LAST_CONJUNCTION),
+            base::ASCIIToUTF16("y"));
+  EXPECT_EQ(one.GetValueForType(NAME_LAST_SECOND),
+            base::ASCIIToUTF16("Picasso"));
+
+  EXPECT_EQ(one.GetVerificationStatusForType(NAME_FULL),
+            VerificationStatus::kUserVerified);
+  EXPECT_EQ(one.GetVerificationStatusForType(NAME_HONORIFIC_PREFIX),
+            VerificationStatus::kObserved);
+  EXPECT_EQ(one.GetVerificationStatusForType(NAME_FIRST),
+            VerificationStatus::kObserved);
+  EXPECT_EQ(one.GetVerificationStatusForType(NAME_MIDDLE),
+            VerificationStatus::kObserved);
+  EXPECT_EQ(one.GetVerificationStatusForType(NAME_LAST),
+            VerificationStatus::kObserved);
+  EXPECT_EQ(one.GetVerificationStatusForType(NAME_LAST_FIRST),
+            VerificationStatus::kObserved);
+  EXPECT_EQ(one.GetVerificationStatusForType(NAME_LAST_CONJUNCTION),
+            VerificationStatus::kObserved);
+  EXPECT_EQ(one.GetVerificationStatusForType(NAME_LAST_SECOND),
+            VerificationStatus::kObserved);
+
+  // The merging should work in both directions equally.
+  EXPECT_TRUE(two.MergeWithComponent(copy_of_one));
+
+  EXPECT_EQ(two.GetValueForType(NAME_FULL),
+            base::ASCIIToUTF16("Mr Pablo Diego Ruiz y Picasso"));
+  EXPECT_EQ(two.GetValueForType(NAME_HONORIFIC_PREFIX),
+            base::ASCIIToUTF16("Mr"));
+  EXPECT_EQ(two.GetValueForType(NAME_FIRST), base::ASCIIToUTF16("Pablo Diego"));
+  EXPECT_EQ(two.GetValueForType(NAME_MIDDLE), base::ASCIIToUTF16(""));
+  EXPECT_EQ(two.GetValueForType(NAME_LAST),
+            base::ASCIIToUTF16("Ruiz y Picasso"));
+  EXPECT_EQ(two.GetValueForType(NAME_LAST_FIRST), base::ASCIIToUTF16("Ruiz"));
+  EXPECT_EQ(two.GetValueForType(NAME_LAST_CONJUNCTION),
+            base::ASCIIToUTF16("y"));
+  EXPECT_EQ(two.GetValueForType(NAME_LAST_SECOND),
+            base::ASCIIToUTF16("Picasso"));
+
+  EXPECT_EQ(two.GetVerificationStatusForType(NAME_FULL),
+            VerificationStatus::kUserVerified);
+  EXPECT_EQ(two.GetVerificationStatusForType(NAME_HONORIFIC_PREFIX),
+            VerificationStatus::kObserved);
+  EXPECT_EQ(two.GetVerificationStatusForType(NAME_FIRST),
+            VerificationStatus::kObserved);
+  EXPECT_EQ(two.GetVerificationStatusForType(NAME_MIDDLE),
+            VerificationStatus::kObserved);
+  EXPECT_EQ(two.GetVerificationStatusForType(NAME_LAST),
+            VerificationStatus::kObserved);
+  EXPECT_EQ(two.GetVerificationStatusForType(NAME_LAST_FIRST),
+            VerificationStatus::kObserved);
+  EXPECT_EQ(two.GetVerificationStatusForType(NAME_LAST_CONJUNCTION),
+            VerificationStatus::kObserved);
+  EXPECT_EQ(two.GetVerificationStatusForType(NAME_LAST_SECOND),
+            VerificationStatus::kObserved);
+}
+
 }  // namespace structured_address
 }  // namespace autofill
diff --git a/components/autofill/core/browser/data_model/autofill_structured_address_utils.cc b/components/autofill/core/browser/data_model/autofill_structured_address_utils.cc
index c6d471b..bd66d4a 100644
--- a/components/autofill/core/browser/data_model/autofill_structured_address_utils.cc
+++ b/components/autofill/core/browser/data_model/autofill_structured_address_utils.cc
@@ -12,8 +12,14 @@
 #include "base/check.h"
 #include "base/debug/alias.h"
 #include "base/debug/dump_without_crashing.h"
+#include "base/i18n/case_conversion.h"
 #include "base/strings/strcat.h"
+#include "base/strings/string_piece.h"
+#include "base/strings/string_split.h"
+#include "base/strings/string_util.h"
+#include "base/strings/utf_string_conversions.h"
 #include "components/autofill/core/browser/data_model/autofill_structured_address_regex_provider.h"
+#include "components/autofill/core/browser/data_model/borrowed_transliterator.h"
 
 namespace autofill {
 namespace structured_address {
@@ -192,5 +198,37 @@
   return CaptureTypeWithPattern(type, pattern, CaptureOptions());
 }
 
+base::string16 NormalizeValue(const base::string16& value) {
+  return RemoveDiacriticsAndConvertToLowerCase(
+      base::CollapseWhitespace(value, /*trim_sequence_with_line_breaks=*/true));
+}
+
+bool AreSortedTokensEqual(const std::vector<base::string16>& first,
+                          const std::vector<base::string16>& second) {
+  // It is assumed that the vectors are sorted.
+  DCHECK(std::is_sorted(first.begin(), first.end()) &&
+         std::is_sorted(second.begin(), second.end()));
+  // If there is a different number of tokens, it can't be a permutation.
+  if (first.size() != second.size())
+    return false;
+  // Return true if both vectors are component-wise equal.
+  return std::equal(first.begin(), first.end(), second.begin());
+}
+
+std::vector<base::string16> TokenizeValue(const base::string16 value) {
+  // Canonicalize the value.
+  base::string16 cannonicalized_value = NormalizeValue(value);
+
+  // Split it by white spaces and commas into non-empty values.
+  std::vector<base::string16> tokens =
+      base::SplitString(cannonicalized_value, base::ASCIIToUTF16(", "),
+                        base::TRIM_WHITESPACE, base::SPLIT_WANT_NONEMPTY);
+
+  // Sort the tokens lexicographically.
+  std::sort(tokens.begin(), tokens.end());
+
+  return tokens;
+}
+
 }  // namespace structured_address
 }  // namespace autofill
diff --git a/components/autofill/core/browser/data_model/autofill_structured_address_utils.h b/components/autofill/core/browser/data_model/autofill_structured_address_utils.h
index f656d26..00efd45 100644
--- a/components/autofill/core/browser/data_model/autofill_structured_address_utils.h
+++ b/components/autofill/core/browser/data_model/autofill_structured_address_utils.h
@@ -15,6 +15,7 @@
 #include "base/no_destructor.h"
 #include "base/synchronization/lock.h"
 #include "components/autofill/core/browser/autofill_type.h"
+#include "components/autofill/core/browser/data_model/autofill_structured_address_constants.h"
 #include "components/autofill/core/browser/field_types.h"
 #include "third_party/re2/src/re2/re2.h"
 
@@ -146,6 +147,19 @@
 std::string CaptureTypeWithPattern(const ServerFieldType& type,
                                    const std::string& pattern);
 
+// Collapses white spaces and line breaks, converts the string to lower case and
+// removes diacritics.
+base::string16 NormalizeValue(const base::string16& value);
+
+// Returns true of both vectors contain the same tokens in the same order.
+bool AreSortedTokensEqual(const std::vector<base::string16>& first,
+                          const std::vector<base::string16>& second);
+
+// Returns a sorted vector containing the tokens of |value| after |value| was
+// canonicalized. |value| is tokenized by splitting it by white spaces and
+// commas.
+std::vector<base::string16> TokenizeValue(const base::string16 value);
+
 }  // namespace structured_address
 
 }  // namespace autofill
diff --git a/components/autofill/core/browser/data_model/autofill_structured_address_utils_unittest.cc b/components/autofill/core/browser/data_model/autofill_structured_address_utils_unittest.cc
index fb2a434..01f73157 100644
--- a/components/autofill/core/browser/data_model/autofill_structured_address_utils_unittest.cc
+++ b/components/autofill/core/browser/data_model/autofill_structured_address_utils_unittest.cc
@@ -9,6 +9,8 @@
 #include <string>
 #include <vector>
 
+#include "base/strings/utf_string_conversions.h"
+
 #include "base/test/gtest_util.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
@@ -207,5 +209,33 @@
             CaptureTypeWithPattern(NAME_FULL, "abs\\w", {.separator = "_"}));
 }
 
+TEST(AutofillStructuredAddressUtils, TokenizeValue) {
+  std::vector<base::string16> expected_tokens = {
+      base::ASCIIToUTF16("and"), base::ASCIIToUTF16("anotherone"),
+      base::ASCIIToUTF16("value")};
+
+  EXPECT_EQ(TokenizeValue(base::ASCIIToUTF16("  valUe AnD    anotherOne")),
+            expected_tokens);
+}
+
+TEST(AutofillStructuredAddressUtils, NormalizeValue) {
+  EXPECT_EQ(NormalizeValue(base::UTF8ToUTF16(" MÜLLeR   Örber")),
+            base::UTF8ToUTF16("muller orber"));
+}
+
+TEST(AutofillStructuredAddressUtils, AreSortedTokensEqual) {
+  EXPECT_FALSE(AreSortedTokensEqual(
+      {base::ASCIIToUTF16("aaaa"), base::ASCIIToUTF16("bbb")},
+      {base::ASCIIToUTF16("aaa"), base::ASCIIToUTF16("bbb")}));
+
+  EXPECT_TRUE(AreSortedTokensEqual(
+      {base::ASCIIToUTF16("aaa"), base::ASCIIToUTF16("bbb")},
+      {base::ASCIIToUTF16("aaa"), base::ASCIIToUTF16("bbb")}));
+
+  EXPECT_FALSE(AreSortedTokensEqual(
+      {base::ASCIIToUTF16("aaa")},
+      {base::ASCIIToUTF16("aaa"), base::ASCIIToUTF16("bbb")}));
+}
+
 }  // namespace structured_address
 }  // namespace autofill
diff --git a/components/content_settings/core/browser/content_settings_default_provider.cc b/components/content_settings/core/browser/content_settings_default_provider.cc
index fcc5a69..da646e6d 100644
--- a/components/content_settings/core/browser/content_settings_default_provider.cc
+++ b/components/content_settings/core/browser/content_settings_default_provider.cc
@@ -12,6 +12,7 @@
 #include "base/bind.h"
 #include "base/memory/ptr_util.h"
 #include "base/metrics/histogram_macros.h"
+#include "build/build_config.h"
 #include "components/content_settings/core/browser/content_settings_info.h"
 #include "components/content_settings/core/browser/content_settings_registry.h"
 #include "components/content_settings/core/browser/content_settings_rule.h"
@@ -42,6 +43,15 @@
 #endif  // !defined(OS_ANDROID)
 #endif  // !defined(OS_IOS)
 
+// These settings were renamed, and should be migrated on profile startup.
+// Deprecated 8/2020
+#if !defined(OS_ANDROID)
+const char kDeprecatedNativeFileSystemReadGuardDefaultPref[] =
+    "profile.default_content_setting_values.native_file_system_read_guard";
+const char kDeprecatedNativeFileSystemWriteGuardDefaultPref[] =
+    "profile.default_content_setting_values.native_file_system_write_guard";
+#endif  // !defined(OS_ANDROID)
+
 ContentSetting GetDefaultValue(const WebsiteSettingsInfo* info) {
   const base::Value* initial_default = info->initial_default_value();
   if (!initial_default)
@@ -116,6 +126,14 @@
       user_prefs::PrefRegistrySyncable::SYNCABLE_PREF);
 #endif  // !defined(OS_ANDROID)
 #endif  // !defined(OS_IOS)
+
+#if !defined(OS_ANDROID)
+  registry->RegisterIntegerPref(kDeprecatedNativeFileSystemReadGuardDefaultPref,
+                                static_cast<int>(CONTENT_SETTING_ASK));
+  registry->RegisterIntegerPref(
+      kDeprecatedNativeFileSystemWriteGuardDefaultPref,
+      static_cast<int>(CONTENT_SETTING_ASK));
+#endif  // !defined(OS_ANDROID)
 }
 
 DefaultProvider::DefaultProvider(PrefService* prefs, bool incognito)
@@ -125,7 +143,7 @@
   DCHECK(prefs_);
 
   // Remove the obsolete preferences from the pref file.
-  DiscardObsoletePreferences();
+  DiscardOrMigrateObsoletePreferences();
 
   // Read global defaults.
   ReadDefaultSettings();
@@ -377,7 +395,7 @@
   return ContentSettingToValue(IntToContentSetting(int_value));
 }
 
-void DefaultProvider::DiscardObsoletePreferences() {
+void DefaultProvider::DiscardOrMigrateObsoletePreferences() {
   if (is_incognito_)
     return;
   // These prefs were never stored on iOS/Android so they don't need to be
@@ -396,6 +414,32 @@
   }
 #endif  // !defined(OS_ANDROID)
 #endif  // !defined(OS_IOS)
+
+#if !defined(OS_ANDROID)
+  // TODO(https://crbug.com/1111559): Remove this migration logic in M90.
+  WebsiteSettingsRegistry* website_settings =
+      WebsiteSettingsRegistry::GetInstance();
+
+  const PrefService::Preference* deprecated_nfs_read_guard_default_pref =
+      prefs_->FindPreference(kDeprecatedNativeFileSystemReadGuardDefaultPref);
+  if (!deprecated_nfs_read_guard_default_pref->IsDefaultValue()) {
+    prefs_->Set(
+        website_settings->Get(ContentSettingsType::FILE_SYSTEM_READ_GUARD)
+            ->default_value_pref_name(),
+        *deprecated_nfs_read_guard_default_pref->GetValue());
+  }
+  prefs_->ClearPref(kDeprecatedNativeFileSystemReadGuardDefaultPref);
+
+  const PrefService::Preference* deprecated_nfs_write_guard_default_pref =
+      prefs_->FindPreference(kDeprecatedNativeFileSystemWriteGuardDefaultPref);
+  if (!deprecated_nfs_write_guard_default_pref->IsDefaultValue()) {
+    prefs_->Set(
+        website_settings->Get(ContentSettingsType::FILE_SYSTEM_WRITE_GUARD)
+            ->default_value_pref_name(),
+        *deprecated_nfs_write_guard_default_pref->GetValue());
+  }
+  prefs_->ClearPref(kDeprecatedNativeFileSystemWriteGuardDefaultPref);
+#endif  // !defined(OS_ANDROID)
 }
 
 }  // namespace content_settings
diff --git a/components/content_settings/core/browser/content_settings_default_provider.h b/components/content_settings/core/browser/content_settings_default_provider.h
index 5f0d3f7..79688ba 100644
--- a/components/content_settings/core/browser/content_settings_default_provider.h
+++ b/components/content_settings/core/browser/content_settings_default_provider.h
@@ -75,7 +75,7 @@
   void OnPreferenceChanged(const std::string& pref_name);
 
   // Clean up the obsolete preferences from the user's profile.
-  void DiscardObsoletePreferences();
+  void DiscardOrMigrateObsoletePreferences();
 
   // Copies of the pref data, so that we can read it on the IO thread.
   std::map<ContentSettingsType, std::unique_ptr<base::Value>> default_settings_;
diff --git a/components/content_settings/core/browser/content_settings_info.cc b/components/content_settings/core/browser/content_settings_info.cc
index 885e339..b70e9dc0 100644
--- a/components/content_settings/core/browser/content_settings_info.cc
+++ b/components/content_settings/core/browser/content_settings_info.cc
@@ -56,14 +56,9 @@
     return false;
   }
 
-  // Don't support ALLOW for the native file system write access.
-  if (type == ContentSettingsType::NATIVE_FILE_SYSTEM_WRITE_GUARD &&
-      setting == CONTENT_SETTING_ALLOW) {
-    return false;
-  }
-
-  // Don't support ALLOW for the native file system read access.
-  if (type == ContentSettingsType::NATIVE_FILE_SYSTEM_READ_GUARD &&
+  // Don't support ALLOW for the file system settings.
+  if ((type == ContentSettingsType::FILE_SYSTEM_WRITE_GUARD ||
+       type == ContentSettingsType::FILE_SYSTEM_READ_GUARD) &&
       setting == CONTENT_SETTING_ALLOW) {
     return false;
   }
diff --git a/components/content_settings/core/browser/content_settings_pref_provider.cc b/components/content_settings/core/browser/content_settings_pref_provider.cc
index 6cb3bad..6d2a5c0 100644
--- a/components/content_settings/core/browser/content_settings_pref_provider.cc
+++ b/components/content_settings/core/browser/content_settings_pref_provider.cc
@@ -16,6 +16,7 @@
 #include "base/metrics/histogram_macros.h"
 #include "base/time/default_clock.h"
 #include "base/trace_event/trace_event.h"
+#include "build/build_config.h"
 #include "components/content_settings/core/browser/content_settings_info.h"
 #include "components/content_settings/core/browser/content_settings_pref.h"
 #include "components/content_settings/core/browser/content_settings_registry.h"
@@ -50,6 +51,15 @@
 #endif  // !defined(OS_ANDROID)
 #endif  // !defined(OS_IOS)
 
+// These settings were renamed, and should be migrated on profile startup.
+// Deprecated 8/2020
+#if !defined(OS_ANDROID)
+const char kDeprecatedNativeFileSystemReadGuardPref[] =
+    "profile.content_settings.exceptions.native_file_system_read_guard";
+const char kDeprecatedNativeFileSystemWriteGuardPref[] =
+    "profile.content_settings.exceptions.native_file_system_write_guard";
+#endif  // !defined(OS_ANDROID)
+
 }  // namespace
 
 // ////////////////////////////////////////////////////////////////////////////
@@ -85,6 +95,11 @@
       user_prefs::PrefRegistrySyncable::SYNCABLE_PREF);
 #endif  // !defined(OS_ANDROID)
 #endif  // !defined(OS_IOS)
+
+#if !defined(OS_ANDROID)
+  registry->RegisterDictionaryPref(kDeprecatedNativeFileSystemReadGuardPref);
+  registry->RegisterDictionaryPref(kDeprecatedNativeFileSystemWriteGuardPref);
+#endif  // !defined(OS_ANDROID)
 }
 
 PrefProvider::PrefProvider(PrefService* prefs,
@@ -108,7 +123,7 @@
     return;
   }
 
-  DiscardObsoletePreferences();
+  DiscardOrMigrateObsoletePreferences();
 
   pref_change_registrar_.Init(prefs_);
 
@@ -267,7 +282,7 @@
                   resource_identifier);
 }
 
-void PrefProvider::DiscardObsoletePreferences() {
+void PrefProvider::DiscardOrMigrateObsoletePreferences() {
   if (off_the_record_)
     return;
 
@@ -281,6 +296,32 @@
   prefs_->ClearPref(kObsoleteMouseLockExceptionsPref);
 #endif  // !defined(OS_ANDROID)
 #endif  // !defined(OS_IOS)
+
+#if !defined(OS_ANDROID)
+  // TODO(https://crbug.com/1111559): Remove this migration logic in M90.
+  WebsiteSettingsRegistry* website_settings =
+      WebsiteSettingsRegistry::GetInstance();
+
+  const PrefService::Preference* deprecated_nfs_read_guard_pref =
+      prefs_->FindPreference(kDeprecatedNativeFileSystemReadGuardPref);
+  if (!deprecated_nfs_read_guard_pref->IsDefaultValue()) {
+    prefs_->Set(
+        website_settings->Get(ContentSettingsType::FILE_SYSTEM_READ_GUARD)
+            ->pref_name(),
+        *deprecated_nfs_read_guard_pref->GetValue());
+  }
+  prefs_->ClearPref(kDeprecatedNativeFileSystemReadGuardPref);
+
+  const PrefService::Preference* deprecated_nfs_write_guard_pref =
+      prefs_->FindPreference(kDeprecatedNativeFileSystemWriteGuardPref);
+  if (!deprecated_nfs_write_guard_pref->IsDefaultValue()) {
+    prefs_->Set(
+        website_settings->Get(ContentSettingsType::FILE_SYSTEM_WRITE_GUARD)
+            ->pref_name(),
+        *deprecated_nfs_write_guard_pref->GetValue());
+  }
+  prefs_->ClearPref(kDeprecatedNativeFileSystemWriteGuardPref);
+#endif  // !defined(OS_ANDROID)
 }
 
 void PrefProvider::SetClockForTesting(base::Clock* clock) {
diff --git a/components/content_settings/core/browser/content_settings_pref_provider.h b/components/content_settings/core/browser/content_settings_pref_provider.h
index d5c24d7..4a9ce3a 100644
--- a/components/content_settings/core/browser/content_settings_pref_provider.h
+++ b/components/content_settings/core/browser/content_settings_pref_provider.h
@@ -75,7 +75,7 @@
               const std::string& resource_identifier);
 
   // Clean up the obsolete preferences from the user's profile.
-  void DiscardObsoletePreferences();
+  void DiscardOrMigrateObsoletePreferences();
 
   // Returns true if this provider supports the given |content_type|.
   bool supports_type(ContentSettingsType content_type) const {
diff --git a/components/content_settings/core/browser/content_settings_registry.cc b/components/content_settings/core/browser/content_settings_registry.cc
index 6941b2f..81b9c3da 100644
--- a/components/content_settings/core/browser/content_settings_registry.cc
+++ b/components/content_settings/core/browser/content_settings_registry.cc
@@ -501,8 +501,8 @@
            ContentSettingsInfo::PERSISTENT,
            ContentSettingsInfo::EXCEPTIONS_ON_SECURE_ORIGINS_ONLY);
 
-  Register(ContentSettingsType::NATIVE_FILE_SYSTEM_WRITE_GUARD,
-           "native-file-system-write-guard", CONTENT_SETTING_ASK,
+  Register(ContentSettingsType::FILE_SYSTEM_WRITE_GUARD,
+           "file-system-write-guard", CONTENT_SETTING_ASK,
            WebsiteSettingsInfo::UNSYNCABLE, WhitelistedSchemes(),
            ValidSettings(CONTENT_SETTING_ALLOW, CONTENT_SETTING_ASK,
                          CONTENT_SETTING_BLOCK),
@@ -512,8 +512,8 @@
            ContentSettingsInfo::PERSISTENT,
            ContentSettingsInfo::EXCEPTIONS_ON_SECURE_ORIGINS_ONLY);
 
-  Register(ContentSettingsType::NATIVE_FILE_SYSTEM_READ_GUARD,
-           "native-file-system-read-guard", CONTENT_SETTING_ASK,
+  Register(ContentSettingsType::FILE_SYSTEM_READ_GUARD,
+           "file-system-read-guard", CONTENT_SETTING_ASK,
            WebsiteSettingsInfo::UNSYNCABLE, WhitelistedSchemes(),
            ValidSettings(CONTENT_SETTING_ALLOW, CONTENT_SETTING_ASK,
                          CONTENT_SETTING_BLOCK),
diff --git a/components/content_settings/core/browser/content_settings_registry_unittest.cc b/components/content_settings/core/browser/content_settings_registry_unittest.cc
index 1d975a4..1ede29b 100644
--- a/components/content_settings/core/browser/content_settings_registry_unittest.cc
+++ b/components/content_settings/core/browser/content_settings_registry_unittest.cc
@@ -182,7 +182,7 @@
 #endif
 
 #if !defined(OS_IOS) && !defined(OS_ANDROID)
-  info = registry()->Get(ContentSettingsType::NATIVE_FILE_SYSTEM_WRITE_GUARD);
+  info = registry()->Get(ContentSettingsType::FILE_SYSTEM_WRITE_GUARD);
   EXPECT_FALSE(info->IsDefaultSettingValid(CONTENT_SETTING_ALLOW));
 #endif
 }
diff --git a/components/content_settings/core/common/content_settings.cc b/components/content_settings/core/common/content_settings.cc
index a27c4b5..ef104c8 100644
--- a/components/content_settings/core/common/content_settings.cc
+++ b/components/content_settings/core/common/content_settings.cc
@@ -77,7 +77,7 @@
     {ContentSettingsType::WAKE_LOCK_SCREEN, 54},
     {ContentSettingsType::WAKE_LOCK_SYSTEM, 55},
     {ContentSettingsType::LEGACY_COOKIE_ACCESS, 56},
-    {ContentSettingsType::NATIVE_FILE_SYSTEM_WRITE_GUARD, 57},
+    {ContentSettingsType::FILE_SYSTEM_WRITE_GUARD, 57},
     {ContentSettingsType::INSTALLED_WEB_APP_METADATA, 58},
     {ContentSettingsType::NFC, 59},
     {ContentSettingsType::BLUETOOTH_CHOOSER_DATA, 60},
@@ -86,7 +86,7 @@
     {ContentSettingsType::SAFE_BROWSING_URL_CHECK_DATA, 63},
     {ContentSettingsType::VR, 64},
     {ContentSettingsType::AR, 65},
-    {ContentSettingsType::NATIVE_FILE_SYSTEM_READ_GUARD, 66},
+    {ContentSettingsType::FILE_SYSTEM_READ_GUARD, 66},
     {ContentSettingsType::STORAGE_ACCESS, 67},
     {ContentSettingsType::CAMERA_PAN_TILT_ZOOM, 68},
     {ContentSettingsType::WINDOW_PLACEMENT, 69},
diff --git a/components/content_settings/core/common/content_settings_types.h b/components/content_settings/core/common/content_settings_types.h
index cd765ef..9a42255 100644
--- a/components/content_settings/core/common/content_settings_types.h
+++ b/components/content_settings/core/common/content_settings_types.h
@@ -160,9 +160,9 @@
   LEGACY_COOKIE_ACCESS,
 
   // Content settings which stores whether to allow sites to ask for permission
-  // to save changes to an original file selected by the user through the Native
+  // to save changes to an original file selected by the user through the
   // File System API.
-  NATIVE_FILE_SYSTEM_WRITE_GUARD,
+  FILE_SYSTEM_WRITE_GUARD,
 
   // Content settings for installed web apps that browsing history may be
   // inferred from e.g. last update check timestamp.
@@ -197,8 +197,8 @@
   AR,
 
   // Content setting which stores whether to allow site to open and read files
-  // and directories selected through the Native File System API.
-  NATIVE_FILE_SYSTEM_READ_GUARD,
+  // and directories selected through the File System API.
+  FILE_SYSTEM_READ_GUARD,
 
   // Access to first party storage in a third-party context. Exceptions are
   // scoped to the combination of requesting/top-level origin, and are managed
diff --git a/components/exo/BUILD.gn b/components/exo/BUILD.gn
index 8088685..5799987 100644
--- a/components/exo/BUILD.gn
+++ b/components/exo/BUILD.gn
@@ -106,6 +106,7 @@
   public_deps = [
     "//ui/base/cursor:cursor_base",
     "//ui/base/cursor/mojom:cursor_type",
+    "//ui/base/dragdrop/mojom:mojom_headers",
   ]
 
   if (is_chromeos) {
@@ -274,6 +275,7 @@
       "//chromeos/constants",
       "//ui/base:test_support",
       "//ui/base/cursor/mojom:cursor_type",
+      "//ui/base/dragdrop/mojom:mojom_shared",
     ]
   }
 
diff --git a/components/exo/data_device.cc b/components/exo/data_device.cc
index 4682130..62ed63f 100644
--- a/components/exo/data_device.cc
+++ b/components/exo/data_device.cc
@@ -65,7 +65,7 @@
 void DataDevice::StartDrag(DataSource* source,
                            Surface* origin,
                            Surface* icon,
-                           ui::DragDropTypes::DragEventSource event_source) {
+                           ui::mojom::DragEventSource event_source) {
   seat_->StartDrag(source, origin, icon, event_source);
 }
 
diff --git a/components/exo/data_device.h b/components/exo/data_device.h
index 8b0bb19..bd6d23210 100644
--- a/components/exo/data_device.h
+++ b/components/exo/data_device.h
@@ -13,7 +13,7 @@
 #include "components/exo/surface.h"
 #include "components/exo/surface_observer.h"
 #include "ui/base/clipboard/clipboard_observer.h"
-#include "ui/base/dragdrop/drag_drop_types.h"
+#include "ui/base/dragdrop/mojom/drag_drop_types.mojom-forward.h"
 
 namespace ui {
 class DropTargetEvent;
@@ -52,7 +52,7 @@
   void StartDrag(DataSource* source,
                  Surface* origin,
                  Surface* icon,
-                 ui::DragDropTypes::DragEventSource event_source);
+                 ui::mojom::DragEventSource event_source);
 
   // Sets selection data to the clipboard.
   // |source| represents data comes from the client.
diff --git a/components/exo/drag_drop_operation.cc b/components/exo/drag_drop_operation.cc
index e7ad6b3..5224320 100644
--- a/components/exo/drag_drop_operation.cc
+++ b/components/exo/drag_drop_operation.cc
@@ -13,6 +13,7 @@
 #include "components/viz/common/frame_sinks/copy_output_request.h"
 #include "components/viz/common/frame_sinks/copy_output_result.h"
 #include "ui/aura/client/drag_drop_client.h"
+#include "ui/base/dragdrop/drag_drop_types.h"
 #include "ui/base/dragdrop/os_exchange_data.h"
 #include "ui/display/display.h"
 #include "ui/display/screen.h"
@@ -79,18 +80,17 @@
     Surface* origin,
     Surface* icon,
     const gfx::Point& drag_start_point,
-    ui::DragDropTypes::DragEventSource event_source) {
+    ui::mojom::DragEventSource event_source) {
   auto* dnd_op = new DragDropOperation(source, origin, icon, drag_start_point,
                                        event_source);
   return dnd_op->weak_ptr_factory_.GetWeakPtr();
 }
 
-DragDropOperation::DragDropOperation(
-    DataSource* source,
-    Surface* origin,
-    Surface* icon,
-    const gfx::Point& drag_start_point,
-    ui::DragDropTypes::DragEventSource event_source)
+DragDropOperation::DragDropOperation(DataSource* source,
+                                     Surface* origin,
+                                     Surface* icon,
+                                     const gfx::Point& drag_start_point,
+                                     ui::mojom::DragEventSource event_source)
     : SurfaceTreeHost("ExoDragDropOperation"),
       source_(std::make_unique<ScopedDataSource>(source, this)),
       origin_(std::make_unique<ScopedSurface>(origin, this)),
diff --git a/components/exo/drag_drop_operation.h b/components/exo/drag_drop_operation.h
index 823258c..436cec3 100644
--- a/components/exo/drag_drop_operation.h
+++ b/components/exo/drag_drop_operation.h
@@ -12,7 +12,7 @@
 #include "components/exo/surface_tree_host.h"
 #include "components/exo/wm_helper.h"
 #include "ui/aura/client/drag_drop_client_observer.h"
-#include "ui/base/dragdrop/drag_drop_types.h"
+#include "ui/base/dragdrop/mojom/drag_drop_types.mojom-forward.h"
 
 namespace ash {
 class DragDropController;
@@ -51,7 +51,7 @@
       Surface* origin,
       Surface* icon,
       const gfx::Point& drag_start_point,
-      ui::DragDropTypes::DragEventSource event_source);
+      ui::mojom::DragEventSource event_source);
 
   // Abort the operation if it hasn't been started yet, otherwise do nothing.
   void AbortIfPending();
@@ -79,7 +79,7 @@
                     Surface* origin,
                     Surface* icon,
                     const gfx::Point& drag_start_point,
-                    ui::DragDropTypes::DragEventSource event_source);
+                    ui::mojom::DragEventSource event_source);
   ~DragDropOperation() override;
 
   void CaptureDragIcon();
@@ -119,7 +119,7 @@
   // change in the future.
   std::string mime_type_;
 
-  ui::DragDropTypes::DragEventSource event_source_;
+  ui::mojom::DragEventSource event_source_;
 
   base::WeakPtrFactory<DragDropOperation> weak_ptr_factory_;
 
diff --git a/components/exo/drag_drop_operation_unittest.cc b/components/exo/drag_drop_operation_unittest.cc
index 9e02d45..4cccc4c 100644
--- a/components/exo/drag_drop_operation_unittest.cc
+++ b/components/exo/drag_drop_operation_unittest.cc
@@ -16,6 +16,7 @@
 #include "components/exo/surface.h"
 #include "components/exo/test/exo_test_base.h"
 #include "ui/aura/client/drag_drop_client.h"
+#include "ui/base/dragdrop/mojom/drag_drop_types.mojom-shared.h"
 
 namespace exo {
 namespace {
@@ -103,7 +104,7 @@
 
   auto operation = DragDropOperation::Create(
       data_source.get(), origin_surface.get(), icon_surface.get(), gfx::Point(),
-      ui::DragDropTypes::DRAG_EVENT_SOURCE_MOUSE);
+      ui::mojom::DragEventSource::kMouse);
   icon_surface->Commit();
 
   base::RunLoop run_loop;
diff --git a/components/exo/pointer_unittest.cc b/components/exo/pointer_unittest.cc
index 90612f1..34098cf 100644
--- a/components/exo/pointer_unittest.cc
+++ b/components/exo/pointer_unittest.cc
@@ -30,6 +30,7 @@
 #include "ui/aura/client/cursor_client.h"
 #include "ui/aura/client/focus_client.h"
 #include "ui/base/cursor/mojom/cursor_type.mojom-shared.h"
+#include "ui/base/dragdrop/mojom/drag_drop_types.mojom-shared.h"
 #include "ui/events/event_utils.h"
 #include "ui/events/test/event_generator.h"
 #include "ui/views/widget/widget.h"
@@ -937,8 +938,7 @@
   EXPECT_CALL(pointer_delegate, OnPointerEnter(&origin, gfx::PointF(), 0));
   generator.MoveMouseTo(origin.window()->GetBoundsInScreen().origin());
 
-  seat.StartDrag(&source, &origin, &icon,
-                 ui::DragDropTypes::DragEventSource::DRAG_EVENT_SOURCE_MOUSE);
+  seat.StartDrag(&source, &origin, &icon, ui::mojom::DragEventSource::kMouse);
   EXPECT_TRUE(seat.get_drag_drop_operation_for_testing());
 
   EXPECT_CALL(pointer_delegate, OnPointerButton).Times(2);
diff --git a/components/exo/seat.cc b/components/exo/seat.cc
index e4915ff..5a19ee3 100644
--- a/components/exo/seat.cc
+++ b/components/exo/seat.cc
@@ -81,7 +81,7 @@
 void Seat::StartDrag(DataSource* source,
                      Surface* origin,
                      Surface* icon,
-                     ui::DragDropTypes::DragEventSource event_source) {
+                     ui::mojom::DragEventSource event_source) {
   // DragDropOperation manages its own lifetime.
   drag_drop_operation_ = DragDropOperation::Create(
       source, origin, icon, last_location_, event_source);
diff --git a/components/exo/seat.h b/components/exo/seat.h
index d5730af..e2b028ad 100644
--- a/components/exo/seat.h
+++ b/components/exo/seat.h
@@ -13,7 +13,7 @@
 #include "ui/aura/client/focus_change_observer.h"
 #include "ui/base/clipboard/clipboard_observer.h"
 #include "ui/base/clipboard/scoped_clipboard_writer.h"
-#include "ui/base/dragdrop/drag_drop_types.h"
+#include "ui/base/dragdrop/mojom/drag_drop_types.mojom-forward.h"
 #include "ui/events/event_handler.h"
 #include "ui/events/keycodes/dom/dom_codes.h"
 #include "ui/events/platform/platform_event_observer.h"
@@ -70,7 +70,7 @@
   void StartDrag(DataSource* source,
                  Surface* origin,
                  Surface* icon,
-                 ui::DragDropTypes::DragEventSource event_source);
+                 ui::mojom::DragEventSource event_source);
 
   // Sets the last location in screen coordinates, irrespective of mouse or
   // touch.
diff --git a/components/exo/seat_unittest.cc b/components/exo/seat_unittest.cc
index ac490f0..bde042f 100644
--- a/components/exo/seat_unittest.cc
+++ b/components/exo/seat_unittest.cc
@@ -16,6 +16,7 @@
 #include "testing/gtest/include/gtest/gtest.h"
 #include "ui/base/clipboard/clipboard.h"
 #include "ui/base/clipboard/scoped_clipboard_writer.h"
+#include "ui/base/dragdrop/mojom/drag_drop_types.mojom-shared.h"
 #include "ui/events/event.h"
 #include "ui/events/event_utils.h"
 
@@ -491,8 +492,7 @@
   // Give origin a root window for DragDropOperation.
   GetContext()->AddChild(origin.window());
 
-  seat.StartDrag(&source, &origin, &icon,
-                 ui::DragDropTypes::DragEventSource::DRAG_EVENT_SOURCE_MOUSE);
+  seat.StartDrag(&source, &origin, &icon, ui::mojom::DragEventSource::kMouse);
   EXPECT_TRUE(seat.get_drag_drop_operation_for_testing());
   seat.AbortPendingDragOperation();
   EXPECT_FALSE(seat.get_drag_drop_operation_for_testing());
diff --git a/components/exo/touch_unittest.cc b/components/exo/touch_unittest.cc
index 217216f2..9c4c6b61 100644
--- a/components/exo/touch_unittest.cc
+++ b/components/exo/touch_unittest.cc
@@ -19,6 +19,7 @@
 #include "components/exo/touch_delegate.h"
 #include "components/exo/touch_stylus_delegate.h"
 #include "testing/gmock/include/gmock/gmock.h"
+#include "ui/base/dragdrop/mojom/drag_drop_types.mojom-shared.h"
 #include "ui/events/base_event_utils.h"
 #include "ui/events/test/event_generator.h"
 #include "ui/views/widget/widget.h"
@@ -519,8 +520,7 @@
   EXPECT_CALL(touch_delegate, OnTouchFrame()).Times(2);
   generator.MoveTouch(origin.window()->GetBoundsInScreen().origin());
 
-  seat.StartDrag(&source, &origin, &icon,
-                 ui::DragDropTypes::DragEventSource::DRAG_EVENT_SOURCE_MOUSE);
+  seat.StartDrag(&source, &origin, &icon, ui::mojom::DragEventSource::kMouse);
   EXPECT_TRUE(seat.get_drag_drop_operation_for_testing());
 
   EXPECT_CALL(touch_delegate, OnTouchDown).Times(1);
diff --git a/components/exo/wayland/BUILD.gn b/components/exo/wayland/BUILD.gn
index 8af1488..ae2f536 100644
--- a/components/exo/wayland/BUILD.gn
+++ b/components/exo/wayland/BUILD.gn
@@ -101,6 +101,7 @@
     "//third_party/wayland-protocols:xdg_shell_protocol",
     "//ui/aura",
     "//ui/base",
+    "//ui/base/dragdrop/mojom:mojom_shared",
     "//ui/display/manager",
     "//ui/events:dom_keycode_converter",
     "//ui/events:events_base",
diff --git a/components/exo/wayland/wl_data_device_manager.cc b/components/exo/wayland/wl_data_device_manager.cc
index 5d08696c85..a34b13c 100644
--- a/components/exo/wayland/wl_data_device_manager.cc
+++ b/components/exo/wayland/wl_data_device_manager.cc
@@ -20,6 +20,7 @@
 #include "components/exo/display.h"
 #include "components/exo/wayland/serial_tracker.h"
 #include "components/exo/wayland/server_util.h"
+#include "ui/base/dragdrop/mojom/drag_drop_types.mojom-shared.h"
 
 namespace exo {
 namespace wayland {
@@ -310,14 +311,12 @@
     }
     if (event_type == wayland::SerialTracker::EventType::POINTER_BUTTON_DOWN &&
         serial_tracker_->GetPointerDownSerial() == serial) {
-      data_device->StartDrag(
-          source, origin, icon,
-          ui::DragDropTypes::DragEventSource::DRAG_EVENT_SOURCE_MOUSE);
+      data_device->StartDrag(source, origin, icon,
+                             ui::mojom::DragEventSource::kMouse);
     } else if (event_type == wayland::SerialTracker::EventType::TOUCH_DOWN &&
                serial_tracker_->GetTouchDownSerial() == serial) {
-      data_device->StartDrag(
-          source, origin, icon,
-          ui::DragDropTypes::DragEventSource::DRAG_EVENT_SOURCE_TOUCH);
+      data_device->StartDrag(source, origin, icon,
+                             ui::mojom::DragEventSource::kTouch);
     } else {
       LOG(ERROR) << "The serial passed to StartDrag does not match its "
                     "expected types.";
diff --git a/components/exo/wayland/zwp_linux_dmabuf.cc b/components/exo/wayland/zwp_linux_dmabuf.cc
index 7704a8b..03ea9c34 100644
--- a/components/exo/wayland/zwp_linux_dmabuf.cc
+++ b/components/exo/wayland/zwp_linux_dmabuf.cc
@@ -51,7 +51,6 @@
     base::ScopedFD fd;
     uint32_t stride;
     uint32_t offset;
-    uint64_t modifier;
   };
 
   explicit LinuxBufferParams(Display* display) : display(display) {}
@@ -75,8 +74,7 @@
   LinuxBufferParams* linux_buffer_params =
       GetUserDataAs<LinuxBufferParams>(resource);
 
-  const uint64_t modifier = (static_cast<uint64_t>(modifier_hi) << 32) | modifier_lo;
-  LinuxBufferParams::Plane plane{base::ScopedFD(fd), stride, offset, modifier};
+  LinuxBufferParams::Plane plane{base::ScopedFD(fd), stride, offset};
 
   const auto& inserted = linux_buffer_params->planes.insert(
       std::pair<uint32_t, LinuxBufferParams::Plane>(plane_idx,
@@ -108,16 +106,8 @@
 
   LinuxBufferParams* linux_buffer_params =
       GetUserDataAs<LinuxBufferParams>(resource);
+  size_t num_planes = gfx::NumberOfPlanesForLinearBufferFormat(format);
 
-  size_t num_planes = linux_buffer_params->planes.size();
-  if (num_planes == 0) {
-    wl_resource_post_error(resource,
-                          ZWP_LINUX_BUFFER_PARAMS_V1_ERROR_INCOMPLETE,
-                          "no planes given");
-    return false;
-  }
-
-  // Validate that we have planes 0..num_planes-1
   for (uint32_t i = 0; i < num_planes; ++i) {
     auto plane_it = linux_buffer_params->planes.find(i);
     if (plane_it == linux_buffer_params->planes.end()) {
@@ -128,24 +118,7 @@
     }
   }
 
-  // All planes must have the same modifier.
-  uint64_t modifier = linux_buffer_params->planes[0].modifier;
-  for (uint32_t i = 0; i < num_planes; ++i) {
-    if (linux_buffer_params->planes[i].modifier != modifier) {
-      wl_resource_post_error(resource,
-                             ZWP_LINUX_BUFFER_PARAMS_V1_ERROR_INVALID_FORMAT,
-                             "all planes must have same modifier");
-      return false;
-    }
-  }
-
-  // For linear layouts we know how many planes to expect, so check
-  // that.  Otherwise, we have to trust that the client gave us the
-  // right number and fail later when importing the EGLImage if that's
-  // wrong.
-  if (modifier == DRM_FORMAT_MOD_LINEAR &&
-      linux_buffer_params->planes.size() !=
-          gfx::NumberOfPlanesForLinearBufferFormat(format)) {
+  if (linux_buffer_params->planes.size() != num_planes) {
     wl_resource_post_error(resource, ZWP_LINUX_BUFFER_PARAMS_V1_ERROR_PLANE_IDX,
                            "plane idx out of bounds");
     return false;
@@ -180,12 +153,14 @@
   LinuxBufferParams* linux_buffer_params =
       GetUserDataAs<LinuxBufferParams>(resource);
 
+  size_t num_planes =
+      gfx::NumberOfPlanesForLinearBufferFormat(supported_format->buffer_format);
+
   gfx::NativePixmapHandle handle;
 
-  handle.modifier = linux_buffer_params->planes[0].modifier;
-
-  for (uint32_t i = 0; i < linux_buffer_params->planes.size(); ++i) {
-    auto& plane = linux_buffer_params->planes[i];
+  for (uint32_t i = 0; i < num_planes; ++i) {
+    auto plane_it = linux_buffer_params->planes.find(i);
+    LinuxBufferParams::Plane& plane = plane_it->second;
     handle.planes.emplace_back(plane.stride, plane.offset, 0,
                                std::move(plane.fd));
   }
diff --git a/components/favicon/core/favicon_handler.cc b/components/favicon/core/favicon_handler.cc
index 08ccec9..0ab34fe 100644
--- a/components/favicon/core/favicon_handler.cc
+++ b/components/favicon/core/favicon_handler.cc
@@ -190,6 +190,12 @@
 }
 
 void FaviconHandler::FetchFavicon(const GURL& page_url, bool is_same_document) {
+  // Some same document navigations (such as those done by
+  // history.replaceState) do not change the url. No need to start over in this
+  // case.
+  if (is_same_document && page_url == last_page_url_)
+    return;
+
   cancelable_task_tracker_for_page_url_.TryCancelAll();
   cancelable_task_tracker_for_candidates_.TryCancelAll();
 
diff --git a/components/favicon/core/favicon_handler_unittest.cc b/components/favicon/core/favicon_handler_unittest.cc
index a7bac2d1..d87b86d 100644
--- a/components/favicon/core/favicon_handler_unittest.cc
+++ b/components/favicon/core/favicon_handler_unittest.cc
@@ -579,6 +579,18 @@
   RunHandlerWithSimpleFaviconCandidates({kIconURL16x16});
 }
 
+// Verifies same document navigation to the last page does not trigger fetch.
+TEST_F(FaviconHandlerTest, SameDocumentNavigationToLastUrlDoesNotFetchAgain) {
+  EXPECT_CALL(favicon_service_,
+              UpdateFaviconMappingsAndFetch(base::flat_set<GURL>{kPageURL},
+                                            kIconURL16x16, kFavicon,
+                                            /*desired_size_in_dip=*/16, _, _));
+  EXPECT_CALL(favicon_service_, GetFaviconForPageURL(_, _, _, _, _)).Times(1);
+
+  auto handler = RunHandlerWithSimpleFaviconCandidates({kIconURL16x16});
+  handler->FetchFavicon(kPageURL, true);
+}
+
 // Test that we don't try to delete favicon mappings when a page URL is not in
 // history even if the page lists no favicons.
 TEST_F(FaviconHandlerTest, DoNotDeleteFaviconMappingsIfNotInHistory) {
diff --git a/components/flags_ui/flags_state.cc b/components/flags_ui/flags_state.cc
index 2e1303b4..e251f1a 100644
--- a/components/flags_ui/flags_state.cc
+++ b/components/flags_ui/flags_state.cc
@@ -339,7 +339,8 @@
   SwitchEntry() : feature_state(false) {}
 };
 
-bool FlagsState::Delegate::ShouldExcludeFlag(const FeatureEntry& entry) {
+bool FlagsState::Delegate::ShouldExcludeFlag(const FlagsStorage* state,
+                                             const FeatureEntry& entry) {
   return false;
 }
 
@@ -613,6 +614,7 @@
     base::ListValue* supported_entries,
     base::ListValue* unsupported_entries,
     base::RepeatingCallback<bool(const FeatureEntry&)> skip_feature_entry) {
+  DCHECK(flags_storage);
   std::set<std::string> enabled_entries;
   GetSanitizedEnabledFlags(flags_storage, &enabled_entries);
 
@@ -824,6 +826,7 @@
 }
 
 std::set<std::string> FlagsState::SanitizeList(
+    const FlagsStorage* storage,
     const std::set<std::string>& enabled_entries,
     int platform_mask) const {
   std::set<std::string> new_enabled_entries;
@@ -834,7 +837,7 @@
   // |feature_entries_| first because |feature_entries_| is large and
   // |enabled_entries| should generally be small/empty.
   for (const std::string& entry_name : enabled_entries) {
-    if (IsSupportedFeature(entry_name, platform_mask))
+    if (IsSupportedFeature(storage, entry_name, platform_mask))
       new_enabled_entries.insert(entry_name);
   }
 
@@ -844,7 +847,8 @@
 void FlagsState::GetSanitizedEnabledFlags(FlagsStorage* flags_storage,
                                           std::set<std::string>* result) const {
   std::set<std::string> enabled_entries = flags_storage->GetFlags();
-  std::set<std::string> new_enabled_entries = SanitizeList(enabled_entries, -1);
+  std::set<std::string> new_enabled_entries =
+      SanitizeList(flags_storage, enabled_entries, -1);
   if (new_enabled_entries.size() != enabled_entries.size())
     flags_storage->SetFlags(new_enabled_entries);
   result->swap(new_enabled_entries);
@@ -861,7 +865,8 @@
 #if defined(OS_CHROMEOS)
   platform_mask |= kOsCrOSOwnerOnly;
 #endif
-  std::set<std::string> platform_entries = SanitizeList(*result, platform_mask);
+  std::set<std::string> platform_entries =
+      SanitizeList(flags_storage, *result, platform_mask);
   result->swap(platform_entries);
 }
 
@@ -942,7 +947,8 @@
   return nullptr;
 }
 
-bool FlagsState::IsSupportedFeature(const std::string& name,
+bool FlagsState::IsSupportedFeature(const FlagsStorage* storage,
+                                    const std::string& name,
                                     int platform_mask) const {
   for (const auto& entry : feature_entries_) {
     DCHECK(IsValidFeatureEntry(entry));
@@ -950,7 +956,7 @@
       continue;
     if (!entry.InternalNameMatches(name))
       continue;
-    if (delegate_ && delegate_->ShouldExcludeFlag(entry))
+    if (delegate_ && delegate_->ShouldExcludeFlag(storage, entry))
       continue;
     return true;
   }
diff --git a/components/flags_ui/flags_state.h b/components/flags_ui/flags_state.h
index 43042ce..cab1448 100644
--- a/components/flags_ui/flags_state.h
+++ b/components/flags_ui/flags_state.h
@@ -71,7 +71,8 @@
    public:
     // Returns whether |entry| should be excluded from the sets of
     // switches/features generated by ConvertFlagsToSwitches().
-    virtual bool ShouldExcludeFlag(const FeatureEntry& entry);
+    virtual bool ShouldExcludeFlag(const FlagsStorage* state,
+                                   const FeatureEntry& entry);
 
    protected:
     Delegate();
@@ -209,6 +210,7 @@
   // |feature_entries_| and whose |supported_platforms| matches |platform_mask|.
   // Pass -1 to |platform_mask| to not do platform filtering.
   std::set<std::string> SanitizeList(
+      const FlagsStorage* storage,
       const std::set<std::string>& enabled_entries,
       int platform_mask) const;
 
@@ -242,7 +244,9 @@
   // a) Is supported on this |platform_mask|, and
   // b) Is not excluded by |exclude_predicate_|, if it is set (i.e. for which
   //    |exclude_predicate_| returns false).
-  bool IsSupportedFeature(const std::string& name, int platform_mask) const;
+  bool IsSupportedFeature(const FlagsStorage* storage,
+                          const std::string& name,
+                          int platform_mask) const;
 
   const base::span<const FeatureEntry> feature_entries_;
 
diff --git a/components/flags_ui/flags_state_unittest.cc b/components/flags_ui/flags_state_unittest.cc
index 57db24e..d3a867e 100644
--- a/components/flags_ui/flags_state_unittest.cc
+++ b/components/flags_ui/flags_state_unittest.cc
@@ -172,7 +172,8 @@
   }
 
   // FlagsState::Delegate:
-  bool ShouldExcludeFlag(const FeatureEntry& entry) override {
+  bool ShouldExcludeFlag(const FlagsStorage* storage,
+                         const FeatureEntry& entry) override {
     return exclude_flags_.count(entry.internal_name) != 0;
   }
 
diff --git a/components/history/core/browser/expire_history_backend.h b/components/history/core/browser/expire_history_backend.h
index 035b0a9..e9118f42 100644
--- a/components/history/core/browser/expire_history_backend.h
+++ b/components/history/core/browser/expire_history_backend.h
@@ -18,7 +18,6 @@
 #include "components/history/core/browser/history_types.h"
 
 class GURL;
-class TestingProfile;
 
 namespace base {
 class SequencedTaskRunner;
@@ -127,8 +126,6 @@
       ExpireHistoryTest,
       ClearOldOnDemandFaviconsDoesNotDeleteAfterShortDelay);
 
-  friend class ::TestingProfile;
-
   struct DeleteEffects {
     DeleteEffects();
     ~DeleteEffects();
diff --git a/components/history/core/browser/history_backend.h b/components/history/core/browser/history_backend.h
index 8c60751..ca546be 100644
--- a/components/history/core/browser/history_backend.h
+++ b/components/history/core/browser/history_backend.h
@@ -39,7 +39,6 @@
 #include "sql/init_status.h"
 
 class SkBitmap;
-class TestingProfile;
 
 namespace base {
 class SingleThreadTaskRunner;
@@ -633,7 +632,6 @@
   FRIEND_TEST_ALL_PREFIXES(HistoryBackendTest, DeleteFTSIndexDatabases);
   FRIEND_TEST_ALL_PREFIXES(ProfileSyncServiceTypedUrlTest,
                            ProcessUserChangeRemove);
-  friend class ::TestingProfile;
 
   // Returns the name of the Favicons database.
   base::FilePath GetFaviconsFileName() const;
diff --git a/components/history/core/browser/history_service.h b/components/history/core/browser/history_service.h
index 5d60e72..fe52e03 100644
--- a/components/history/core/browser/history_service.h
+++ b/components/history/core/browser/history_service.h
@@ -46,8 +46,6 @@
 class HistoryURLProvider;
 class InMemoryURLIndexTest;
 class SkBitmap;
-class SyncBookmarkDataTypeControllerTest;
-class TestingProfile;
 
 namespace base {
 class FilePath;
@@ -574,8 +572,6 @@
   friend class ::HistoryURLProvider;
   friend class HQPPerfTestOnePopularURL;
   friend class ::InMemoryURLIndexTest;
-  friend class ::SyncBookmarkDataTypeControllerTest;
-  friend class ::TestingProfile;
   friend std::unique_ptr<HistoryService> CreateHistoryService(
       const base::FilePath& history_dir,
       bool create_db);
diff --git a/components/omnibox/browser/autocomplete_result.cc b/components/omnibox/browser/autocomplete_result.cc
index 7da3bc5..b643e12 100644
--- a/components/omnibox/browser/autocomplete_result.cc
+++ b/components/omnibox/browser/autocomplete_result.cc
@@ -755,8 +755,9 @@
   return base::string16();
 }
 
-bool AutocompleteResult::IsSuggestionGroupIdHidden(PrefService* prefs,
-                                                   int suggestion_group_id) {
+bool AutocompleteResult::IsSuggestionGroupIdHidden(
+    PrefService* prefs,
+    int suggestion_group_id) const {
   omnibox::SuggestionGroupVisibility user_preference =
       omnibox::GetUserPreferenceForSuggestionGroupVisibility(
           prefs, suggestion_group_id);
diff --git a/components/omnibox/browser/autocomplete_result.h b/components/omnibox/browser/autocomplete_result.h
index 6384b68..14057e9 100644
--- a/components/omnibox/browser/autocomplete_result.h
+++ b/components/omnibox/browser/autocomplete_result.h
@@ -171,7 +171,8 @@
   // Returns whether or not |suggestion_group_id| should be collapsed in the UI.
   // This method takes into account both the user's stored |prefs| as well as
   // the server-provided visibility hint for |suggestion_group_id|.
-  bool IsSuggestionGroupIdHidden(PrefService* prefs, int suggestion_group_id);
+  bool IsSuggestionGroupIdHidden(PrefService* prefs,
+                                 int suggestion_group_id) const;
 
   // Logs metrics for when |new_result| replaces |old_result| asynchronously.
   // |old_result| a list of the comparators for the old matches.
diff --git a/components/omnibox/browser/omnibox_popup_model.cc b/components/omnibox/browser/omnibox_popup_model.cc
index 69e77557..0cca6c1 100644
--- a/components/omnibox/browser/omnibox_popup_model.cc
+++ b/components/omnibox/browser/omnibox_popup_model.cc
@@ -477,7 +477,7 @@
   // user is trying to focus the header itself (which is still shown).
   if (selection.state != FOCUSED_BUTTON_HEADER &&
       match.suggestion_group_id.has_value() && pref_service_ &&
-      omnibox::IsSuggestionGroupIdHidden(pref_service_,
+      result().IsSuggestionGroupIdHidden(pref_service_,
                                          match.suggestion_group_id.value())) {
     return false;
   }
@@ -534,12 +534,18 @@
 
   auto& match = result().match_at(selection.line);
   switch (selection.state) {
-    case FOCUSED_BUTTON_HEADER:
+    case FOCUSED_BUTTON_HEADER: {
       DCHECK(match.suggestion_group_id.has_value());
-      omnibox::ToggleSuggestionGroupIdVisibility(
-          pref_service_, match.suggestion_group_id.value());
-      break;
 
+      omnibox::SuggestionGroupVisibility new_value =
+          result().IsSuggestionGroupIdHidden(pref_service_,
+                                             match.suggestion_group_id.value())
+              ? omnibox::SuggestionGroupVisibility::SHOWN
+              : omnibox::SuggestionGroupVisibility::HIDDEN;
+      omnibox::SetSuggestionGroupVisibility(
+          pref_service_, match.suggestion_group_id.value(), new_value);
+      break;
+    }
     case FOCUSED_BUTTON_KEYWORD:
       // TODO(yoangela): Merge logic with mouse/gesture events in
       // OmniboxSuggestionButtonRowView::ButtonPressed - This case currently
@@ -593,7 +599,7 @@
   int additional_message_id = 0;
   switch (selection_.state) {
     case FOCUSED_BUTTON_HEADER: {
-      bool group_hidden = omnibox::IsSuggestionGroupIdHidden(
+      bool group_hidden = result().IsSuggestionGroupIdHidden(
           pref_service_, match.suggestion_group_id.value());
       int message_id = group_hidden ? IDS_ACC_HEADER_SHOW_SUGGESTIONS_BUTTON
                                     : IDS_ACC_HEADER_HIDE_SUGGESTIONS_BUTTON;
diff --git a/components/omnibox/browser/omnibox_popup_model_unittest.cc b/components/omnibox/browser/omnibox_popup_model_unittest.cc
index 6c49d88..9a12709 100644
--- a/components/omnibox/browser/omnibox_popup_model_unittest.cc
+++ b/components/omnibox/browser/omnibox_popup_model_unittest.cc
@@ -285,7 +285,8 @@
   // Hide the second two matches.
   matches[2].suggestion_group_id = 7;
   matches[3].suggestion_group_id = 7;
-  omnibox::ToggleSuggestionGroupIdVisibility(pref_service(), 7);
+  omnibox::SetSuggestionGroupVisibility(
+      pref_service(), 7, omnibox::SuggestionGroupVisibility::HIDDEN);
 
   auto* result = &model()->autocomplete_controller()->result_;
   AutocompleteInput input(base::UTF8ToUTF16("match"),
diff --git a/components/omnibox/browser/omnibox_prefs.cc b/components/omnibox/browser/omnibox_prefs.cc
index 9821fe4..ed03e73 100644
--- a/components/omnibox/browser/omnibox_prefs.cc
+++ b/components/omnibox/browser/omnibox_prefs.cc
@@ -60,13 +60,6 @@
   return SuggestionGroupVisibility::DEFAULT;
 }
 
-bool IsSuggestionGroupIdHidden(PrefService* prefs, int suggestion_group_id) {
-  // TODO(tommycli): Migrate all callsites to
-  // AutocompleteResult::IsSuggestionGroupIdHidden().
-  return GetUserPreferenceForSuggestionGroupVisibility(
-             prefs, suggestion_group_id) == SuggestionGroupVisibility::HIDDEN;
-}
-
 void SetSuggestionGroupVisibility(PrefService* prefs,
                                   int suggestion_group_id,
                                   SuggestionGroupVisibility new_value) {
@@ -83,15 +76,4 @@
       ->Add(suggestion_group_id);
 }
 
-void ToggleSuggestionGroupIdVisibility(PrefService* prefs,
-                                       int suggestion_group_id) {
-  // TODO(tommycli): Migrate all callsites to use SetSuggestionGroupVisibility()
-  // instead of this method.
-  SuggestionGroupVisibility new_value =
-      IsSuggestionGroupIdHidden(prefs, suggestion_group_id)
-          ? SuggestionGroupVisibility::SHOWN
-          : SuggestionGroupVisibility::HIDDEN;
-  SetSuggestionGroupVisibility(prefs, suggestion_group_id, new_value);
-}
-
 }  // namespace omnibox
diff --git a/components/omnibox/browser/omnibox_prefs.h b/components/omnibox/browser/omnibox_prefs.h
index 24012e1..0c3eb746 100644
--- a/components/omnibox/browser/omnibox_prefs.h
+++ b/components/omnibox/browser/omnibox_prefs.h
@@ -46,33 +46,16 @@
 //
 // Warning: UI code should use AutocompleteResult::IsSuggestionGroupIdHidden()
 // instead, which uses the server-provided hint on default-hidden groups.
-//
-// TODO(tommycli): Once all UI code has migrated to calling
-// AutocompleteResult::IsSuggestionGroupIdHidden(), we can likely make this
-// method an inaccessible anonymous function.
+// This method is accessible for testing only.
 SuggestionGroupVisibility GetUserPreferenceForSuggestionGroupVisibility(
     PrefService* prefs,
     int suggestion_group_id);
 
-// Returns whether the given suggestion group ID is allowed to appear in the
-// results.
-//
-// DEPRECATED: Use AutocompleteResult::IsSuggestionGroupIdHidden() instead.
-bool IsSuggestionGroupIdHidden(PrefService* prefs, int suggestion_group_id);
-
 // Sets the group visibility of |suggestion_group_id| to |new_value|.
 void SetSuggestionGroupVisibility(PrefService* prefs,
                                   int suggestion_group_id,
                                   SuggestionGroupVisibility new_value);
 
-// Allows suggestions with the given suggestion group ID to appear in the
-// results if they currently are not allowed to or prevents them from
-// appearing in the results if they are currently permitted to.
-//
-// DEPRECATED: Use SetSuggestionGroupVisibility() instead.
-void ToggleSuggestionGroupIdVisibility(PrefService* prefs,
-                                       int suggestion_group_id);
-
 }  // namespace omnibox
 
 #endif  // COMPONENTS_OMNIBOX_BROWSER_OMNIBOX_PREFS_H_
diff --git a/components/omnibox/browser/omnibox_prefs_unittest.cc b/components/omnibox/browser/omnibox_prefs_unittest.cc
index c55e9364..aec0329 100644
--- a/components/omnibox/browser/omnibox_prefs_unittest.cc
+++ b/components/omnibox/browser/omnibox_prefs_unittest.cc
@@ -7,10 +7,7 @@
 #include "components/prefs/testing_pref_service.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
-using omnibox::IsSuggestionGroupIdHidden;
-using omnibox::kToggleSuggestionGroupIdOffHistogram;
-using omnibox::kToggleSuggestionGroupIdOnHistogram;
-using omnibox::ToggleSuggestionGroupIdVisibility;
+namespace omnibox {
 
 class OmniboxPrefsTest : public ::testing::Test {
  public:
@@ -35,41 +32,58 @@
   const int kOnboardingGroupId = 40001;
   const int kRZPSGroupId = 40009;
   {
-    // Expect |kOnboardingGroupId| to be visible.
-    EXPECT_FALSE(IsSuggestionGroupIdHidden(GetPrefs(), kOnboardingGroupId));
+    // Expect |kOnboardingGroupId| to be in the default state.
+    EXPECT_EQ(SuggestionGroupVisibility::DEFAULT,
+              GetUserPreferenceForSuggestionGroupVisibility(
+                  GetPrefs(), kOnboardingGroupId));
     histogram()->ExpectTotalCount(kToggleSuggestionGroupIdOffHistogram, 0);
 
-    // Expect |kRZPSGroupId| to be visible.
-    EXPECT_FALSE(IsSuggestionGroupIdHidden(GetPrefs(), kRZPSGroupId));
+    // Expect |kRZPSGroupId| to be in the default state.
+    EXPECT_EQ(SuggestionGroupVisibility::DEFAULT,
+              GetUserPreferenceForSuggestionGroupVisibility(GetPrefs(),
+                                                            kRZPSGroupId));
     histogram()->ExpectTotalCount(kToggleSuggestionGroupIdOnHistogram, 0);
   }
   {
-    ToggleSuggestionGroupIdVisibility(GetPrefs(), kOnboardingGroupId);
+    SetSuggestionGroupVisibility(GetPrefs(), kOnboardingGroupId,
+                                 SuggestionGroupVisibility::HIDDEN);
 
     // Expect |kOnboardingGroupId| to have been toggled hidden.
-    EXPECT_TRUE(IsSuggestionGroupIdHidden(GetPrefs(), kOnboardingGroupId));
+    EXPECT_EQ(SuggestionGroupVisibility::HIDDEN,
+              GetUserPreferenceForSuggestionGroupVisibility(
+                  GetPrefs(), kOnboardingGroupId));
     histogram()->ExpectTotalCount(kToggleSuggestionGroupIdOffHistogram, 1);
     histogram()->ExpectBucketCount(kToggleSuggestionGroupIdOffHistogram,
                                    kOnboardingGroupId, 1);
 
-    // Expect |kRZPSGroupId| to have remained visible.
-    EXPECT_FALSE(IsSuggestionGroupIdHidden(GetPrefs(), kRZPSGroupId));
+    // Expect |kRZPSGroupId| to have remained in the default state.
+    EXPECT_EQ(SuggestionGroupVisibility::DEFAULT,
+              GetUserPreferenceForSuggestionGroupVisibility(GetPrefs(),
+                                                            kRZPSGroupId));
     histogram()->ExpectTotalCount(kToggleSuggestionGroupIdOnHistogram, 0);
   }
   {
-    ToggleSuggestionGroupIdVisibility(GetPrefs(), kOnboardingGroupId);
-    ToggleSuggestionGroupIdVisibility(GetPrefs(), kRZPSGroupId);
-
-    // Expect |kRZPSGroupId| to have been toggled hidden.
-    EXPECT_TRUE(IsSuggestionGroupIdHidden(GetPrefs(), kRZPSGroupId));
-    histogram()->ExpectTotalCount(kToggleSuggestionGroupIdOffHistogram, 2);
-    histogram()->ExpectBucketCount(kToggleSuggestionGroupIdOffHistogram,
-                                   kRZPSGroupId, 1);
+    SetSuggestionGroupVisibility(GetPrefs(), kOnboardingGroupId,
+                                 SuggestionGroupVisibility::SHOWN);
+    SetSuggestionGroupVisibility(GetPrefs(), kRZPSGroupId,
+                                 SuggestionGroupVisibility::HIDDEN);
 
     // Expect |kOnboardingGroupId| to have been toggled visible again.
-    EXPECT_FALSE(IsSuggestionGroupIdHidden(GetPrefs(), kOnboardingGroupId));
+    EXPECT_EQ(SuggestionGroupVisibility::SHOWN,
+              GetUserPreferenceForSuggestionGroupVisibility(
+                  GetPrefs(), kOnboardingGroupId));
     histogram()->ExpectTotalCount(kToggleSuggestionGroupIdOnHistogram, 1);
     histogram()->ExpectBucketCount(kToggleSuggestionGroupIdOnHistogram,
                                    kOnboardingGroupId, 1);
+
+    // Expect |kRZPSGroupId| to have been toggled hidden.
+    EXPECT_EQ(SuggestionGroupVisibility::HIDDEN,
+              GetUserPreferenceForSuggestionGroupVisibility(GetPrefs(),
+                                                            kRZPSGroupId));
+    histogram()->ExpectTotalCount(kToggleSuggestionGroupIdOffHistogram, 2);
+    histogram()->ExpectBucketCount(kToggleSuggestionGroupIdOffHistogram,
+                                   kRZPSGroupId, 1);
   }
 }
+
+}  // namespace omnibox
diff --git a/components/page_info/page_info.cc b/components/page_info/page_info.cc
index 38306ee..6b6769cc 100644
--- a/components/page_info/page_info.cc
+++ b/components/page_info/page_info.cc
@@ -115,7 +115,7 @@
 #if !defined(OS_ANDROID)
     ContentSettingsType::HID_GUARD,
     ContentSettingsType::SERIAL_GUARD,
-    ContentSettingsType::NATIVE_FILE_SYSTEM_WRITE_GUARD,
+    ContentSettingsType::FILE_SYSTEM_WRITE_GUARD,
 #endif
     ContentSettingsType::BLUETOOTH_GUARD,
     ContentSettingsType::BLUETOOTH_SCANNING,
@@ -184,8 +184,8 @@
   if (info.type == ContentSettingsType::GEOLOCATION && !info.is_incognito)
     return true;
 
-  // The Native File System write permission is desktop only at the moment.
-  if (info.type == ContentSettingsType::NATIVE_FILE_SYSTEM_WRITE_GUARD)
+  // The File System write permission is desktop only at the moment.
+  if (info.type == ContentSettingsType::FILE_SYSTEM_WRITE_GUARD)
     return false;
 #else
   // Flash is shown if the user has ever changed its setting for |site_url|.
@@ -200,9 +200,9 @@
   if (info.type == ContentSettingsType::NFC)
     return false;
 
-  // Display the Native File System write permission if the Native File System
-  // API is currently being used.
-  if (info.type == ContentSettingsType::NATIVE_FILE_SYSTEM_WRITE_GUARD &&
+  // Display the File System write permission if the File System API is
+  // currently being used.
+  if (info.type == ContentSettingsType::FILE_SYSTEM_WRITE_GUARD &&
       web_contents->HasNativeFileSystemHandles()) {
     return true;
   }
diff --git a/components/page_info/page_info_ui.cc b/components/page_info/page_info_ui.cc
index a373120..35b8130e 100644
--- a/components/page_info/page_info_ui.cc
+++ b/components/page_info/page_info_ui.cc
@@ -173,7 +173,7 @@
     {ContentSettingsType::SERIAL_GUARD, IDS_PAGE_INFO_TYPE_SERIAL},
 #endif
     {ContentSettingsType::BLUETOOTH_GUARD, IDS_PAGE_INFO_TYPE_BLUETOOTH},
-    {ContentSettingsType::NATIVE_FILE_SYSTEM_WRITE_GUARD,
+    {ContentSettingsType::FILE_SYSTEM_WRITE_GUARD,
      IDS_PAGE_INFO_TYPE_NATIVE_FILE_SYSTEM_WRITE},
     {ContentSettingsType::BLUETOOTH_SCANNING,
      IDS_PAGE_INFO_TYPE_BLUETOOTH_SCANNING},
@@ -622,7 +622,7 @@
     case ContentSettingsType::BLUETOOTH_SCANNING:
       icon = &vector_icons::kBluetoothScanningIcon;
       break;
-    case ContentSettingsType::NATIVE_FILE_SYSTEM_WRITE_GUARD:
+    case ContentSettingsType::FILE_SYSTEM_WRITE_GUARD:
       icon = &vector_icons::kSaveOriginalFileIcon;
       break;
     case ContentSettingsType::VR:
diff --git a/components/page_load_metrics/browser/observers/core_page_load_metrics_observer.cc b/components/page_load_metrics/browser/observers/core_page_load_metrics_observer.cc
index cba4ff8..2ed4651 100644
--- a/components/page_load_metrics/browser/observers/core_page_load_metrics_observer.cc
+++ b/components/page_load_metrics/browser/observers/core_page_load_metrics_observer.cc
@@ -168,6 +168,9 @@
 const char kHistogramFirstContentfulPaintNotOnBattery[] =
     "PageLoad.PaintTiming.NavigationToFirstContentfulPaint.NotOnBattery";
 
+const char kHistogramFirstContentfulPaintHiddenWhileFlushing[] =
+    "PageLoad.PaintTiming.NavigationToFirstContentfulPaint.HiddenWhileFlushing";
+
 const char kHistogramLoadTypeFirstContentfulPaintReload[] =
     "PageLoad.PaintTiming.NavigationToFirstContentfulPaint.LoadType."
     "Reload";
@@ -554,6 +557,16 @@
       }
     }
 
+    if (GetDelegate().GetFirstBackgroundTime()) {
+      // We were started in the foreground, and got FCP while in foreground, but
+      // became hidden while propagating the FCP value from Blink into the PLM
+      // observer. In this case, we will have missed the FCP UKM value, since it
+      // is logged in UkmPageLoadMetricsObserver::OnHidden.
+      PAGE_LOAD_HISTOGRAM(
+          internal::kHistogramFirstContentfulPaintHiddenWhileFlushing,
+          timing.paint_timing->first_contentful_paint.value());
+    }
+
     switch (GetPageLoadType(transition_)) {
       case LOAD_TYPE_RELOAD:
         PAGE_LOAD_HISTOGRAM(
diff --git a/components/policy/proto/device_management_backend.proto b/components/policy/proto/device_management_backend.proto
index d6dafed..1317f9a 100644
--- a/components/policy/proto/device_management_backend.proto
+++ b/components/policy/proto/device_management_backend.proto
@@ -2832,7 +2832,7 @@
   // details. InstallStageTracker::FailureReason is the main enum and this is
   // a copy used for reporting purposes.
   enum FailureReason {
-    UNKNOWN = 0;
+    FAILURE_REASON_UNKNOWN = 0;
 
     INVALID_ID = 1;
 
diff --git a/components/policy/resources/policy_templates.json b/components/policy/resources/policy_templates.json
index 7474662..cc31438 100644
--- a/components/policy/resources/policy_templates.json
+++ b/components/policy/resources/policy_templates.json
@@ -2119,6 +2119,7 @@
         'dynamic_refresh': True,
         'per_profile': False,
       },
+      'deprecated': True,
       'example_value': '{ "RemoteAccessHostMatchUsername": true }',
       'id': 289,
       'caption': '''Policy overrides for Debug builds of the remote access host''',
@@ -3527,6 +3528,7 @@
         'dynamic_refresh': False,
         'per_profile': False,
       },
+      'deprecated': True,
       'example_value': 104857600,
       'id': 111,
       'caption': '''Set media disk cache size in bytes''',
@@ -5681,6 +5683,7 @@
         'dynamic_refresh': True,
         'per_profile': True,
       },
+      'deprecated': True,
       'example_value': 2,
       'id': 313,
       'caption': '''Default key generation setting''',
@@ -6304,6 +6307,7 @@
         'dynamic_refresh': True,
         'per_profile': True,
       },
+      'deprecated': True,
       'example_value': ['https://www.example.com', '[*.]example.edu'],
       'id': 314,
       'caption': '''Allow key generation on these sites''',
@@ -6327,6 +6331,7 @@
         'dynamic_refresh': True,
         'per_profile': True,
       },
+      'deprecated': True,
       'example_value': ['https://www.example.com', '[*.]example.edu'],
       'id': 315,
       'caption': '''Block key generation on these sites''',
@@ -6862,6 +6867,7 @@
       'features': {
         'dynamic_refresh': False,
       },
+      'deprecated': True,
       'example_value': 1,
       'id': 57,
       'caption': '''Default HTML renderer for <ph name="PRODUCT_FRAME_NAME">$3<ex>Google Chrome Frame</ex></ph>''',
@@ -6881,6 +6887,7 @@
       'features': {
         'dynamic_refresh': False,
       },
+      'deprecated': True,
       'example_value': ['https://www.example.com', 'https://www.example.edu'],
       'id': 58,
       'caption': '''Always render the following URL patterns in <ph name="PRODUCT_FRAME_NAME">$3<ex>Google Chrome Frame</ex></ph>''',
@@ -6903,6 +6910,7 @@
       'features': {
         'dynamic_refresh': False,
       },
+      'deprecated': True,
       'example_value': ['https://www.example.com', 'https://www.example.edu'],
       'id': 59,
       'caption': '''Always render the following URL patterns in the host browser''',
@@ -6922,6 +6930,7 @@
       'features': {
         'dynamic_refresh': False,
       },
+      'deprecated': True,
       'example_value': '--enable-media-stream --enable-media-source',
       'id': 141,
       'caption': '''Additional command line parameters for <ph name="PRODUCT_NAME">$1<ex>Google Chrome</ex></ph>''',
@@ -6939,6 +6948,7 @@
       'features': {
         'dynamic_refresh': False,
       },
+      'deprecated': True,
       'example_value': False,
       'id': 238,
       'caption': '''Skip the meta tag check in <ph name="PRODUCT_FRAME_NAME">$3<ex>Google Chrome Frame</ex></ph>''',
@@ -6963,6 +6973,7 @@
       'features': {
         'dynamic_refresh': False,
       },
+      'deprecated': True,
       'example_value': ['text/xml', 'application/xml'],
       'id': 60,
       'caption': '''Allow <ph name="PRODUCT_FRAME_NAME">$3<ex>Google Chrome Frame</ex></ph> to handle the listed content types''',
@@ -7336,6 +7347,7 @@
       'features': {
         'dynamic_refresh': False,
       },
+      'deprecated': True,
       'example_value': '${user_home}/Chrome Frame',
       'id': 87,
       'caption': '''Set <ph name="PRODUCT_FRAME_NAME">$3<ex>Google Chrome Frame</ex></ph> user data directory''',
@@ -8218,6 +8230,7 @@
         'dynamic_refresh': True,
         'per_profile': False,
       },
+      'deprecated': True,
       'example_value': True,
       'id': 118,
       'caption': '''Disable TLS False Start''',
@@ -8274,6 +8287,7 @@
         'dynamic_refresh': True,
         'per_profile': False,
       },
+      'deprecated': True,
       'example_value': False,
       'id': 340,
       'caption': '''Allow SHA-1 signed certificates issued by local trust anchors''',
@@ -8315,6 +8329,7 @@
         'dynamic_refresh': True,
         'per_profile': False,
       },
+      'deprecated': True,
       'example_value': False,
       'id': 413,
       'caption': '''Enable trust in Symantec Corporation's Legacy PKI Infrastructure''',
@@ -9305,6 +9320,7 @@
       'features': {
         'dynamic_refresh': True,
       },
+      'deprecated': True,
       'example_value': [ 'https://google.com', 'chrome-extension://aaaaaaaaaaaaaaaaaaaaaaaa/' ],
       'id': 137,
       'caption': '''Load specified urls on demo login''',
@@ -9323,6 +9339,7 @@
       'features': {
         'dynamic_refresh': True,
       },
+      'deprecated': True,
       'example_value': 60000,
       'id': 130,
       'caption': '''Timeout until idle user log-out is executed''',
@@ -9343,6 +9360,7 @@
       'features': {
         'dynamic_refresh': True,
       },
+      'deprecated': True,
       'example_value': 15000,
       'id': 131,
       'caption': '''Duration of the idle log-out warning message''',
@@ -9363,6 +9381,7 @@
       'features': {
         'dynamic_refresh': True,
       },
+      'deprecated': True,
       'example_value': 'fhblcfnmnbehmifidkddcenilbpddlfk',
       'id': 132,
       'caption': '''Screen saver to be used on the sign-in screen in retail mode''',
@@ -9381,6 +9400,7 @@
       'features': {
         'dynamic_refresh': True,
       },
+      'deprecated': True,
       'example_value': 120000,
       'id': 133,
       'caption': '''Duration of inactivity before the screen saver is shown on the sign-in screen in retail mode''',
@@ -9404,6 +9424,7 @@
       'features': {
         'dynamic_refresh': True,
       },
+      'deprecated': True,
       'example_value': [ '{ "extension-id": "khgabmflimjjbclkmljlpmgaleanedem", "update-url": "https://clients2.google.com/service/update2/crx" }' ],
       'id': 135,
       'caption': '''List of AppPack extensions''',
@@ -12811,6 +12832,7 @@
       'features': {
         'dynamic_refresh': False,
       },
+      'deprecated': True,
       'example_value': True,
       'id': 221,
     },
@@ -13481,6 +13503,7 @@
         'dynamic_refresh': True,
         'per_profile': False,
       },
+      'deprecated': True,
       'example_value': 'tls1.2',
       'id': 361,
       'caption': '''Maximum SSL version enabled''',
@@ -13814,6 +13837,7 @@
         'dynamic_refresh': False,
         'per_profile': False
       },
+      'deprecated': True,
       'example_value': False
     },
     {
@@ -14575,6 +14599,7 @@
         'dynamic_refresh': False,
         'per_profile': False,
       },
+      'deprecated': True,
       'example_value': False,
       'id': 337,
       'caption': '''Enable Android Backup Service''',
@@ -14592,6 +14617,7 @@
         'dynamic_refresh': False,
         'per_profile': False,
       },
+      'deprecated': True,
       'example_value': False,
       'id': 363,
       'caption': '''Enable Android Google Location Service''',
@@ -16208,6 +16234,7 @@
         'dynamic_refresh': False,
         'per_profile': False,
       },
+      'deprecated': True,
       'example_value': 'https://example.com/,https://othersite.org/',
       'id': 417,
       'caption': '''Enable Site Isolation for specified origins''',
@@ -16230,6 +16257,7 @@
         'dynamic_refresh': False,
         'per_profile': False,
       },
+      'deprecated': True,
       'example_value': True,
       'id': 418,
       'caption': '''Enable Site Isolation for every site''',
@@ -16305,6 +16333,7 @@
         'dynamic_refresh': False,
         'per_profile': False,
       },
+      'deprecated': True,
       'example_value': True,
       'id': 414,
       'caption': '''Allow WebDriver to Override Incompatible Policies''',
@@ -17977,6 +18006,7 @@
         'dynamic_refresh': True,
         'per_profile': False,
       },
+      'deprecated': True,
       'example_value': False,
       'id': 460,
       'caption': '''Allow background tabs freeze''',
@@ -21172,6 +21202,7 @@
         'per_profile': True,
       },
       'supported_on': ['chrome.*:79-85', 'chrome_os:79-85', 'android:79-85'],
+      'deprecated': True,
       'caption': '''Enable a TLS 1.3 security feature for local trust anchors.''',
       'tags': ['system-security'],
       'desc': '''This policy controls a security feature in TLS 1.3 which protects connections against downgrade attacks. It is backwards-compatible and will not affect connections to compliant TLS 1.2 servers or proxies. However, older versions of some TLS-intercepting proxies have an implementation flaw which causes them to be incompatible.
diff --git a/components/policy/tools/syntax_check_policy_template_json.py b/components/policy/tools/syntax_check_policy_template_json.py
index c9d6b32..b90d4a6 100755
--- a/components/policy/tools/syntax_check_policy_template_json.py
+++ b/components/policy/tools/syntax_check_policy_template_json.py
@@ -167,6 +167,32 @@
   return platforms
 
 
+def _GetSupportedVersionPlatformAndRange(supported_on):
+  (supported_on_platform, supported_on_versions) = supported_on.split(':')
+
+  (supported_on_from, supported_on_to) = supported_on_versions.split('-')
+
+  return supported_on_platform, (int(supported_on_from) if supported_on_from
+                                 else None), (int(supported_on_to)
+                                              if supported_on_to else None)
+
+
+def _PolicyStillSupported(supported_on, current_version):
+  for s in supported_on:
+    _, _, supported_on_to = _GetSupportedVersionPlatformAndRange(s)
+
+    # If supported_on_to isn't given, this policy is still supported.
+    if supported_on_to is None:
+      return True
+
+    # If supported_on_to is equal or greater than the current version, it's
+    # still supported.
+    if current_version <= int(supported_on_to):
+      return True
+
+  return False
+
+
 def MergeDict(*dicts):
   result = {}
   for dictionary in dicts:
@@ -435,7 +461,8 @@
                       "Field '%s' not present in device policy proto." %
                       (policy, field))
 
-  def _CheckPolicy(self, policy, is_in_group, policy_ids, deleted_policy_ids):
+  def _CheckPolicy(self, policy, is_in_group, policy_ids, deleted_policy_ids,
+                   current_version):
     if not isinstance(policy, dict):
       self._Error('Each policy must be a dictionary.', 'policy', None, policy)
       return
@@ -564,7 +591,7 @@
               supported_on_platform,
               supported_on_from,
               supported_on_to,
-          ) = self._GetSupportedVersionPlatformAndRange(s)
+          ) = _GetSupportedVersionPlatformAndRange(s)
 
           supported_platforms.append(supported_on_platform)
           if not isinstance(supported_on_platform,
@@ -584,6 +611,13 @@
                 'supported version must have a version larger than the '
                 'starting supported version.', 'policy', policy, supported_on)
 
+        if (not _PolicyStillSupported(supported_on, current_version)
+            and not policy.get('deprecated', False)):
+          self._Error(
+              'Policy %s is marked as no longer supported (%s), but isn\'t '
+              'marked as deprecated. Unsupported policies must be marked as '
+              '"deprecated": True' % (policy.get('name'), supported_on))
+
       supported_platforms = ExpandChromeStar(supported_platforms)
       future_on = ExpandChromeStar(
           self._CheckContains(policy, 'future_on', list, optional=True))
@@ -862,15 +896,6 @@
       if vkey not in ('desc', 'text'):
         self._Warning('In message %s: Warning: Unknown key: %s' % (key, vkey))
 
-  def _GetSupportedVersionPlatformAndRange(self, supported_on):
-    (supported_on_platform, supported_on_versions) = supported_on.split(':')
-
-    (supported_on_from, supported_on_to) = supported_on_versions.split('-')
-
-    return supported_on_platform, (
-        int(supported_on_from) if supported_on_from else None), (
-            int(supported_on_to) if supported_on_to else None)
-
   def _GetReleasedPlatforms(self, policy, current_version):
     '''
     Returns a dictionary that contains released platforms and their released
@@ -902,7 +927,7 @@
 
     for supported_on in policy.get('supported_on', []):
       supported_platform, supported_from, _ = \
-              self._GetSupportedVersionPlatformAndRange(supported_on)
+              _GetSupportedVersionPlatformAndRange(supported_on)
       if supported_from < current_version - 1:
         released_platforms[supported_platform] = supported_from
       else:
@@ -1578,7 +1603,8 @@
     if policy_definitions is not None:
       policy_ids = set()
       for policy in policy_definitions:
-        self._CheckPolicy(policy, False, policy_ids, deleted_policy_ids)
+        self._CheckPolicy(policy, False, policy_ids, deleted_policy_ids,
+                          current_version)
         self._CheckDevicePolicyProtoMappingDeviceOnly(
             policy, device_policy_proto_map, legacy_device_policy_proto_map)
       self._CheckPolicyIDs(policy_ids, deleted_policy_ids)
diff --git a/components/safe_browsing/core/common/safe_browsing_prefs.cc b/components/safe_browsing/core/common/safe_browsing_prefs.cc
index d73acc34..e0b3f47 100644
--- a/components/safe_browsing/core/common/safe_browsing_prefs.cc
+++ b/components/safe_browsing/core/common/safe_browsing_prefs.cc
@@ -185,11 +185,6 @@
   return prefs.IsManagedPreference(prefs::kSafeBrowsingScoutReportingEnabled);
 }
 
-bool IsSafeBrowsingPolicyManaged(const PrefService& prefs) {
-  return prefs.IsManagedPreference(prefs::kSafeBrowsingEnabled) ||
-         prefs.IsManagedPreference(prefs::kSafeBrowsingEnhanced);
-}
-
 void RecordExtendedReportingMetrics(const PrefService& prefs) {
   // This metric tracks the extended browsing opt-in based on whichever setting
   // the user is currently seeing. It tells us whether extended reporting is
diff --git a/components/safe_browsing/core/common/safe_browsing_prefs.h b/components/safe_browsing/core/common/safe_browsing_prefs.h
index 9482089..ba20f9ca 100644
--- a/components/safe_browsing/core/common/safe_browsing_prefs.h
+++ b/components/safe_browsing/core/common/safe_browsing_prefs.h
@@ -291,11 +291,6 @@
 // enterprise policy, meaning the user can't change it.
 bool IsExtendedReportingPolicyManaged(const PrefService& prefs);
 
-// Return whether the Safe Browsing preference is managed. It can be managed by
-// either the SafeBrowsingEnabled policy(legacy) or the
-// SafeBrowsingProtectionLevel policy(new).
-bool IsSafeBrowsingPolicyManaged(const PrefService& prefs);
-
 // Updates UMA metrics about Safe Browsing Extended Reporting states.
 void RecordExtendedReportingMetrics(const PrefService& prefs);
 
diff --git a/components/translate/core/browser/translate_ui_delegate.cc b/components/translate/core/browser/translate_ui_delegate.cc
index 50366bb..ec67ee836 100644
--- a/components/translate/core/browser/translate_ui_delegate.cc
+++ b/components/translate/core/browser/translate_ui_delegate.cc
@@ -4,6 +4,8 @@
 
 #include "components/translate/core/browser/translate_ui_delegate.h"
 
+#include <algorithm>
+
 #include "base/i18n/string_compare.h"
 #include "base/metrics/histogram_macros.h"
 #include "base/strings/string_number_conversions.h"
@@ -90,34 +92,41 @@
   std::unique_ptr<icu::Collator> collator = CreateCollator(locale);
 
   languages_.reserve(language_codes.size());
-  for (std::vector<std::string>::const_iterator iter = language_codes.begin();
-       iter != language_codes.end(); ++iter) {
-    std::string language_code = *iter;
-
+  for (std::string& language_code : language_codes) {
     base::string16 language_name =
         l10n_util::GetDisplayNameForLocale(language_code, locale, true);
-    // Insert the language in languages_ in alphabetical order.
-    std::vector<LanguageNamePair>::iterator iter2;
-    if (collator) {
-      for (iter2 = languages_.begin(); iter2 != languages_.end(); ++iter2) {
-        int result = base::i18n::CompareString16WithCollator(
-            *collator, language_name, iter2->second);
-        if (result == UCOL_LESS)
-          break;
-      }
-    } else {
-      // |locale| may not be supported by ICU collator (crbug/54833). In this
-      // case, let's order the languages in UTF-8.
-      for (iter2 = languages_.begin(); iter2 != languages_.end(); ++iter2) {
-        if (language_name.compare(iter2->second) < 0)
-          break;
-      }
-    }
-    languages_.insert(iter2, LanguageNamePair(language_code, language_name));
+    languages_.emplace_back(std::move(language_code), std::move(language_name));
   }
+
+  // Sort |languages_| in alphabetical order according to the display name.
+  std::sort(
+      languages_.begin(), languages_.end(),
+      [&collator](const LanguageNamePair& lhs, const LanguageNamePair& rhs) {
+        if (collator) {
+          switch (base::i18n::CompareString16WithCollator(*collator, lhs.second,
+                                                          rhs.second)) {
+            case UCOL_LESS:
+              return true;
+            case UCOL_GREATER:
+              return false;
+            case UCOL_EQUAL:
+              break;
+          }
+        } else {
+          // |locale| may not be supported by ICU collator (crbug/54833). In
+          // this case, let's order the languages in UTF-8.
+          int result = lhs.second.compare(rhs.second);
+          if (result != 0)
+            return result < 0;
+        }
+        // Matching display names will be ordered alphabetically according to
+        // the language codes.
+        return lhs.first < rhs.first;
+      });
+
   for (std::vector<LanguageNamePair>::const_iterator iter = languages_.begin();
        iter != languages_.end(); ++iter) {
-    std::string language_code = iter->first;
+    const std::string& language_code = iter->first;
     if (language_code == original_language) {
       original_language_index_ = iter - languages_.begin();
       initial_original_language_index_ = original_language_index_;
@@ -125,7 +134,6 @@
     if (language_code == target_language)
       target_language_index_ = iter - languages_.begin();
   }
-
 }
 
 TranslateUIDelegate::~TranslateUIDelegate() {}
@@ -149,10 +157,6 @@
   return languages_.size();
 }
 
-size_t TranslateUIDelegate::GetOriginalLanguageIndex() const {
-  return original_language_index_;
-}
-
 void TranslateUIDelegate::UpdateOriginalLanguageIndex(size_t language_index) {
   if (original_language_index_ == language_index)
     return;
@@ -174,10 +178,6 @@
   }
 }
 
-size_t TranslateUIDelegate::GetTargetLanguageIndex() const {
-  return target_language_index_;
-}
-
 void TranslateUIDelegate::UpdateTargetLanguageIndex(size_t language_index) {
   if (target_language_index_ == language_index)
     return;
diff --git a/components/translate/core/browser/translate_ui_delegate.h b/components/translate/core/browser/translate_ui_delegate.h
index 26af3825..e8f144e0 100644
--- a/components/translate/core/browser/translate_ui_delegate.h
+++ b/components/translate/core/browser/translate_ui_delegate.h
@@ -53,7 +53,7 @@
   size_t GetNumberOfLanguages() const;
 
   // Returns the original language index.
-  size_t GetOriginalLanguageIndex() const;
+  size_t GetOriginalLanguageIndex() const { return original_language_index_; }
 
   // Returns the original language code.
   std::string GetOriginalLanguageCode() const;
@@ -64,7 +64,7 @@
   void UpdateOriginalLanguage(const std::string& language_code);
 
   // Returns the target language index.
-  size_t GetTargetLanguageIndex() const;
+  size_t GetTargetLanguageIndex() const { return target_language_index_; }
 
   // Returns the target language code.
   std::string GetTargetLanguageCode() const;
diff --git a/components/viz/common/gpu/dawn_context_provider.h b/components/viz/common/gpu/dawn_context_provider.h
index 3ad751a..8ec5c96d 100644
--- a/components/viz/common/gpu/dawn_context_provider.h
+++ b/components/viz/common/gpu/dawn_context_provider.h
@@ -13,8 +13,6 @@
 #include "third_party/skia/include/gpu/GrDirectContext.h"
 #include "third_party/skia/include/gpu/dawn/GrDawnTypes.h"
 
-class GrContext;
-
 namespace viz {
 
 class VIZ_DAWN_CONTEXT_PROVIDER_EXPORT DawnContextProvider {
@@ -24,7 +22,7 @@
 
   wgpu::Device GetDevice() { return device_; }
   wgpu::Instance GetInstance() { return instance_.Get(); }
-  GrContext* GetGrContext() { return gr_context_.get(); }
+  GrDirectContext* GetGrContext() { return gr_context_.get(); }
   bool IsValid() { return !!gr_context_; }
 
  private:
diff --git a/components/viz/service/display/skia_renderer.cc b/components/viz/service/display/skia_renderer.cc
index 56d0510..382fdd9 100644
--- a/components/viz/service/display/skia_renderer.cc
+++ b/components/viz/service/display/skia_renderer.cc
@@ -393,21 +393,6 @@
          src == SkBlendModeCoeff::kDC;
 }
 
-sk_sp<SkColorFilter> TintCompositedContentColorTransformFilter() {
-  SkColorMatrix matrix;
-  auto color_transform =
-      cc::DebugColors::TintCompositedContentColorTransformMatrix();
-  std::array<float, 20> transposed;
-  transposed.fill(0.0f);
-  for (int r = 0; r < 4; r++) {
-    for (int c = 0; c < 4; c++) {
-      transposed[r * 5 + c] = color_transform[c * 4 + r];
-    }
-  }
-  matrix.setRowMajor(transposed.data());
-  return SkColorFilters::Matrix(matrix);
-}
-
 }  // namespace
 
 // chrome style prevents this from going in skia_renderer.h, but since it
@@ -506,10 +491,10 @@
   // |scissor_rect_| of the renderer.
   base::Optional<gfx::Rect> scissor_rect;
 
-  SkPaint paint(bool tint_content) const {
+  SkPaint paint(sk_sp<SkColorFilter> color_filter) const {
     SkPaint p;
-    if (tint_content) {
-      p.setColorFilter(TintCompositedContentColorTransformFilter());
+    if (color_filter) {
+      p.setColorFilter(color_filter);
     }
     p.setFilterQuality(filter_quality);
     p.setBlendMode(blend_mode);
@@ -1077,7 +1062,7 @@
   bool aa = params->aa_flags != SkCanvas::kNone_QuadAAFlags;
   current_canvas_->clipRect(gfx::RectToSkRect(rpdq_params.filter_bounds), aa);
 
-  SkPaint layer_paint = params->paint(false);
+  SkPaint layer_paint = params->paint(nullptr /* color_filter */);
   // The layer always consumes the opacity, but its blend mode depends on if
   // it was initialized with backdrop content or not.
   params->opacity = 1.f;
@@ -1652,10 +1637,9 @@
                 batched_quad_state_.rounded_corner_bounds, nullptr);
 
   SkPaint paint;
-  if (debug_settings_->tint_composited_content &&
-      current_canvas_ == root_canvas_) {
-    paint.setColorFilter(TintCompositedContentColorTransformFilter());
-  }
+  sk_sp<SkColorFilter> color_filter = GetContentColorFilter();
+  if (color_filter)
+    paint.setColorFilter(color_filter);
   paint.setFilterQuality(batched_quad_state_.filter_quality);
   paint.setBlendMode(batched_quad_state_.blend_mode);
 
@@ -1690,10 +1674,9 @@
     }
   }
 
-  if (debug_settings_->tint_composited_content &&
-      current_canvas_ == root_canvas_) {
-    color = TintCompositedContentColorTransformFilter()->filterColor(color);
-  }
+  sk_sp<SkColorFilter> color_filter = GetContentColorFilter();
+  if (color_filter)
+    color = color_filter->filterColor(color);
   // PrepareCanvasForRPDQ will have updated params->opacity and blend_mode to
   // account for the layer applying those effects.
   color = SkColorSetA(color, params->opacity * SkColorGetA(color));
@@ -1772,7 +1755,7 @@
   }
   path.transform(cdt);
 
-  SkPaint paint = params->paint(false);
+  SkPaint paint = params->paint(nullptr /* color_filter */);
   paint.setColor(quad->color);  // Must correct alpha afterwards
   paint.setAlphaf(params->opacity * paint.getAlphaf());
   paint.setStyle(SkPaint::kStroke_Style);
@@ -1804,8 +1787,7 @@
   // these represent the valid windows of content to show for the display list,
   // so they need to be used as a clip in Skia.
   SkRect visible_rect = gfx::RectFToSkRect(params->visible_rect);
-  SkPaint paint = params->paint(debug_settings_->tint_composited_content &&
-                                current_canvas_ == root_canvas_);
+  SkPaint paint = params->paint(GetContentColorFilter());
 
   if (params->draw_region.has_value()) {
     SkPath clip;
@@ -1877,8 +1859,7 @@
           : gfx::RectF(gfx::SizeF(quad->resource_size_in_pixels()));
 
   if (rpdq_params) {
-    SkPaint paint = params->paint(debug_settings_->tint_composited_content &&
-                                  current_canvas_ == root_canvas_);
+    SkPaint paint = params->paint(GetContentColorFilter());
     DrawSingleImage(image, valid_texel_bounds, rpdq_params, &paint, params);
   } else {
     AddQuadToBatch(image, valid_texel_bounds, params);
@@ -1938,8 +1919,7 @@
   if (!batched_quads_.empty())
     FlushBatchedQuads();
 
-  SkPaint paint = params->paint(debug_settings_->tint_composited_content &&
-                                current_canvas_ == root_canvas_);
+  SkPaint paint = params->paint(GetContentColorFilter());
 
   float quad_alpha;
   if (rpdq_params) {
@@ -2019,8 +1999,8 @@
   if (needs_color_conversion_filter) {
     // Skia won't perform color conversion.
     DCHECK(!image->colorSpace());
-    sk_sp<SkColorFilter> color_filter =
-        GetColorFilter(src_color_space, CurrentRenderPassColorSpace());
+    sk_sp<SkColorFilter> color_filter = GetColorSpaceConversionFilter(
+        src_color_space, CurrentRenderPassColorSpace());
     paint.setColorFilter(color_filter->makeComposed(paint.refColorFilter()));
   }
 
@@ -2064,8 +2044,7 @@
   }
 
   if (rpdq_params) {
-    SkPaint paint = params->paint(debug_settings_->tint_composited_content &&
-                                  current_canvas_ == root_canvas_);
+    SkPaint paint = params->paint(GetContentColorFilter());
     DrawSingleImage(image, valid_texel_bounds, rpdq_params, &paint, params);
   } else {
     AddQuadToBatch(image, valid_texel_bounds, params);
@@ -2132,12 +2111,11 @@
   // Use provided, unclipped texture coordinates as the content area, which will
   // force coord clamping unless the geometry was clipped, or they span the
   // entire YUV image.
-  SkPaint paint = params->paint(debug_settings_->tint_composited_content &&
-                                current_canvas_ == root_canvas_);
+  SkPaint paint = params->paint(GetContentColorFilter());
 
-  sk_sp<SkColorFilter> color_filter =
-      GetColorFilter(src_color_space, dst_color_space, quad->resource_offset,
-                     quad->resource_multiplier);
+  sk_sp<SkColorFilter> color_filter = GetColorSpaceConversionFilter(
+      src_color_space, dst_color_space, quad->resource_offset,
+      quad->resource_multiplier);
   paint.setColorFilter(color_filter->makeComposed(paint.refColorFilter()));
 
   DrawSingleImage(image, quad->ya_tex_coord_rect, rpdq_params, &paint, params);
@@ -2250,10 +2228,11 @@
 #endif
 }
 
-sk_sp<SkColorFilter> SkiaRenderer::GetColorFilter(const gfx::ColorSpace& src,
-                                                  const gfx::ColorSpace& dst,
-                                                  float resource_offset,
-                                                  float resource_multiplier) {
+sk_sp<SkColorFilter> SkiaRenderer::GetColorSpaceConversionFilter(
+    const gfx::ColorSpace& src,
+    const gfx::ColorSpace& dst,
+    float resource_offset,
+    float resource_multiplier) {
   // If the input color space is HDR, and it did not specify a white level,
   // override it with the frame's white level.
   gfx::ColorSpace adjusted_src = src.GetWithSDRWhiteLevel(
@@ -2298,6 +2277,42 @@
   return effect->makeColorFilter(std::move(data));
 }
 
+sk_sp<SkColorFilter> SkiaRenderer::GetContentColorFilter() {
+  sk_sp<SkColorFilter> color_transform = nullptr;
+  if (current_canvas_ == root_canvas_ &&
+      !output_surface_->color_matrix().isIdentity()) {
+    std::array<float, 20> values;
+    values.fill(0.0f);
+    for (uint32_t r = 0; r < 4; r++) {
+      for (uint32_t c = 0; c < 4; c++) {
+        values[r * 5 + c] = output_surface_->color_matrix().getFloat(r, c);
+      }
+    }
+    color_transform = SkColorFilters::Matrix(values.data());
+  }
+
+  sk_sp<SkColorFilter> tint_transform = nullptr;
+  if (current_canvas_ == root_canvas_ &&
+      debug_settings_->tint_composited_content) {
+    std::array<float, 20> values;
+    values.fill(0.0f);
+    auto tint = cc::DebugColors::TintCompositedContentColorTransformMatrix();
+    for (int r = 0; r < 4; r++) {
+      for (int c = 0; c < 4; c++) {
+        values[r * 5 + c] = tint[c * 4 + r];
+      }
+    }
+    tint_transform = SkColorFilters::Matrix(values.data());
+  }
+
+  if (color_transform) {
+    return tint_transform ? color_transform->makeComposed(tint_transform)
+                          : color_transform;
+  } else {
+    return tint_transform;
+  }
+}
+
 SkiaRenderer::DrawRPDQParams SkiaRenderer::CalculateRPDQParams(
     const RenderPassDrawQuad* quad,
     DrawQuadParams* params) {
@@ -2511,8 +2526,7 @@
   if (!batched_quads_.empty())
     FlushBatchedQuads();
 
-  SkPaint paint = params->paint(debug_settings_->tint_composited_content &&
-                                current_canvas_ == root_canvas_);
+  SkPaint paint = params->paint(GetContentColorFilter());
 
   DrawSingleImage(content_image.get(), valid_texel_bounds, &rpdq_params, &paint,
                   params);
diff --git a/components/viz/service/display/skia_renderer.h b/components/viz/service/display/skia_renderer.h
index b106b068..b6f81ae 100644
--- a/components/viz/service/display/skia_renderer.h
+++ b/components/viz/service/display/skia_renderer.h
@@ -236,10 +236,13 @@
   // filters are cached in |color_filter_cache_|.  Resource offset and
   // multiplier are used to adjust the RGB output of the shader for YUV video
   // quads. The default values perform no adjustment.
-  sk_sp<SkColorFilter> GetColorFilter(const gfx::ColorSpace& src,
-                                      const gfx::ColorSpace& dst,
-                                      float resource_offset = 0.0f,
-                                      float resource_multiplier = 1.0f);
+  sk_sp<SkColorFilter> GetColorSpaceConversionFilter(
+      const gfx::ColorSpace& src,
+      const gfx::ColorSpace& dst,
+      float resource_offset = 0.0f,
+      float resource_multiplier = 1.0f);
+  // Returns the color filter that should be applied to the current canvas.
+  sk_sp<SkColorFilter> GetContentColorFilter();
   // A map from RenderPass id to the texture used to draw the RenderPass from.
   struct RenderPassBacking {
     sk_sp<SkSurface> render_pass_surface;
diff --git a/content/browser/BUILD.gn b/content/browser/BUILD.gn
index 580fc1a..2864ee1 100644
--- a/content/browser/BUILD.gn
+++ b/content/browser/BUILD.gn
@@ -784,6 +784,8 @@
     "devtools/protocol/emulation_handler.h",
     "devtools/protocol/fetch_handler.cc",
     "devtools/protocol/fetch_handler.h",
+    "devtools/protocol/handler_helpers.cc",
+    "devtools/protocol/handler_helpers.h",
     "devtools/protocol/input_handler.cc",
     "devtools/protocol/input_handler.h",
     "devtools/protocol/inspector_handler.cc",
diff --git a/content/browser/accessibility/browser_accessibility.cc b/content/browser/accessibility/browser_accessibility.cc
index 013b4fb..1ee2423 100644
--- a/content/browser/accessibility/browser_accessibility.cc
+++ b/content/browser/accessibility/browser_accessibility.cc
@@ -1036,30 +1036,6 @@
          ax::mojom::NameFrom::kAttributeExplicitlyEmpty;
 }
 
-std::string BrowserAccessibility::ComputeAccessibleNameFromDescendants() const {
-  std::string name;
-  for (InternalChildIterator it = InternalChildrenBegin();
-       it != InternalChildrenEnd(); ++it) {
-    const BrowserAccessibility* child = it.get();
-    std::string child_name;
-    if (child->GetStringAttribute(ax::mojom::StringAttribute::kName,
-                                  &child_name)) {
-      if (!name.empty())
-        name += " ";
-      name += child_name;
-    } else if (!child->HasState(ax::mojom::State::kFocusable)) {
-      child_name = child->ComputeAccessibleNameFromDescendants();
-      if (!child_name.empty()) {
-        if (!name.empty())
-          name += " ";
-        name += child_name;
-      }
-    }
-  }
-
-  return name;
-}
-
 std::string BrowserAccessibility::GetLiveRegionText() const {
   if (IsIgnored())
     return "";
diff --git a/content/browser/accessibility/browser_accessibility.h b/content/browser/accessibility/browser_accessibility.h
index 16c7908f..9cf722b 100644
--- a/content/browser/accessibility/browser_accessibility.h
+++ b/content/browser/accessibility/browser_accessibility.h
@@ -382,9 +382,6 @@
   // Returns true if the accessible name was explicitly set to "" by the author
   bool HasExplicitlyEmptyName() const;
 
-  // TODO(nektar): Remove this method and replace with GetInnerText.
-  std::string ComputeAccessibleNameFromDescendants() const;
-
   // Get text to announce for a live region change, for ATs that do not
   // implement this functionality.
   std::string GetLiveRegionText() const;
diff --git a/content/browser/accessibility/browser_accessibility_cocoa.mm b/content/browser/accessibility/browser_accessibility_cocoa.mm
index 3fec0a1c..0104027 100644
--- a/content/browser/accessibility/browser_accessibility_cocoa.mm
+++ b/content/browser/accessibility/browser_accessibility_cocoa.mm
@@ -1206,19 +1206,6 @@
     }
   }
 
-  // If it's focusable but didn't have any other name or value, compute a name
-  // from its descendants. Note that this is a workaround because VoiceOver
-  // does not always present focus changes if the new focus lacks a name.
-  base::string16 value = _owner->GetValue();
-  if (_owner->HasState(ax::mojom::State::kFocusable) &&
-      !ui::IsControl(_owner->GetRole()) && value.empty() &&
-      [self internalRole] != ax::mojom::Role::kDateTime &&
-      [self internalRole] != ax::mojom::Role::kWebArea &&
-      [self internalRole] != ax::mojom::Role::kRootWebArea) {
-    return base::SysUTF8ToNSString(
-        _owner->ComputeAccessibleNameFromDescendants());
-  }
-
   return @"";
 }
 
diff --git a/content/browser/devtools/protocol/handler_helpers.cc b/content/browser/devtools/protocol/handler_helpers.cc
new file mode 100644
index 0000000..7fbd42d
--- /dev/null
+++ b/content/browser/devtools/protocol/handler_helpers.cc
@@ -0,0 +1,28 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "content/browser/devtools/protocol/handler_helpers.h"
+#include "content/browser/frame_host/frame_tree_node.h"
+
+namespace content {
+
+namespace protocol {
+
+FrameTreeNode* FrameTreeNodeFromDevToolsFrameToken(
+    FrameTreeNode* root,
+    const std::string& devtools_frame_token) {
+  if (root->devtools_frame_token().ToString() == devtools_frame_token) {
+    return root;
+  } else {
+    for (FrameTreeNode* node : root->frame_tree()->SubtreeNodes(root)) {
+      if (node->devtools_frame_token().ToString() == devtools_frame_token) {
+        return node;
+      }
+    }
+  }
+  return nullptr;
+}
+
+}  // namespace protocol
+}  // namespace content
diff --git a/content/browser/devtools/protocol/handler_helpers.h b/content/browser/devtools/protocol/handler_helpers.h
new file mode 100644
index 0000000..21c26ba
--- /dev/null
+++ b/content/browser/devtools/protocol/handler_helpers.h
@@ -0,0 +1,23 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_BROWSER_DEVTOOLS_PROTOCOL_HANDLER_HELPERS_H_
+#define CONTENT_BROWSER_DEVTOOLS_PROTOCOL_HANDLER_HELPERS_H_
+
+#include <string>
+
+namespace content {
+
+class FrameTreeNode;
+
+namespace protocol {
+
+FrameTreeNode* FrameTreeNodeFromDevToolsFrameToken(
+    FrameTreeNode* root,
+    const std::string& devtools_frame_token);
+
+}  // namespace protocol
+}  // namespace content
+
+#endif  // CONTENT_BROWSER_DEVTOOLS_PROTOCOL_HANDLER_HELPERS_H_
diff --git a/content/browser/devtools/protocol/page_handler.cc b/content/browser/devtools/protocol/page_handler.cc
index 27ea920..f1aef41 100644
--- a/content/browser/devtools/protocol/page_handler.cc
+++ b/content/browser/devtools/protocol/page_handler.cc
@@ -29,6 +29,7 @@
 #include "content/browser/devtools/protocol/browser_handler.h"
 #include "content/browser/devtools/protocol/devtools_mhtml_helper.h"
 #include "content/browser/devtools/protocol/emulation_handler.h"
+#include "content/browser/devtools/protocol/handler_helpers.h"
 #include "content/browser/frame_host/navigation_request.h"
 #include "content/browser/frame_host/navigator.h"
 #include "content/browser/manifest/manifest_manager_host.h"
@@ -470,20 +471,10 @@
   else
     type = ui::PAGE_TRANSITION_TYPED;
 
-  FrameTreeNode* frame_tree_node = nullptr;
   std::string out_frame_id = frame_id.fromMaybe(
       host_->frame_tree_node()->devtools_frame_token().ToString());
-  FrameTreeNode* root = host_->frame_tree_node();
-  if (root->devtools_frame_token().ToString() == out_frame_id) {
-    frame_tree_node = root;
-  } else {
-    for (FrameTreeNode* node : root->frame_tree()->SubtreeNodes(root)) {
-      if (node->devtools_frame_token().ToString() == out_frame_id) {
-        frame_tree_node = node;
-        break;
-      }
-    }
-  }
+  FrameTreeNode* frame_tree_node = FrameTreeNodeFromDevToolsFrameToken(
+      host_->frame_tree_node(), out_frame_id);
 
   if (!frame_tree_node) {
     callback->sendFailure(
diff --git a/content/browser/frame_host/navigation_controller_impl.cc b/content/browser/frame_host/navigation_controller_impl.cc
index 2173b19..c7e2973 100644
--- a/content/browser/frame_host/navigation_controller_impl.cc
+++ b/content/browser/frame_host/navigation_controller_impl.cc
@@ -3329,7 +3329,7 @@
           GURL() /* base_url_override_for_web_bundle */,
           node->pending_frame_policy(),
           std::vector<std::string>() /* force_enabled_origin_trials */,
-          false /* origin_isolation_restricted */,
+          false /* origin_isolated */,
           std::vector<
               network::mojom::WebClientHintsType>() /* enabled_client_hints */,
           false /* is_cross_browsing_instance */);
diff --git a/content/browser/frame_host/navigation_entry_impl.cc b/content/browser/frame_host/navigation_entry_impl.cc
index e0bb9b5..0df3b800 100644
--- a/content/browser/frame_host/navigation_entry_impl.cc
+++ b/content/browser/frame_host/navigation_entry_impl.cc
@@ -830,7 +830,7 @@
           GURL() /* web_bundle_physical_url */,
           GURL() /* base_url_override_for_web_bundle */, frame_policy,
           std::vector<std::string>() /* force_enabled_origin_trials */,
-          false /* origin_isolation_restricted */,
+          false /* origin_isolated */,
           std::vector<
               network::mojom::WebClientHintsType>() /* enabled_client_hints */,
           false /* is_cross_browsing_instance */);
diff --git a/content/browser/frame_host/navigation_request.cc b/content/browser/frame_host/navigation_request.cc
index 519c5fd..eabb4ce6 100644
--- a/content/browser/frame_host/navigation_request.cc
+++ b/content/browser/frame_host/navigation_request.cc
@@ -939,7 +939,7 @@
           GURL() /* base_url_override_for_web_bundle */,
           frame_tree_node->pending_frame_policy(),
           std::vector<std::string>() /* force_enabled_origin_trials */,
-          false /* origin_isolation_restricted */,
+          false /* origin_isolated */,
           std::vector<
               network::mojom::WebClientHintsType>() /* enabled_client_hints */,
           false /* is_cross_browsing_instance */);
@@ -1030,7 +1030,7 @@
           GURL() /* base_url_override_for_web_bundle */,
           frame_tree_node->pending_frame_policy(),
           std::vector<std::string>() /* force_enabled_origin_trials */,
-          false /* origin_isolation_restricted */,
+          false /* origin_isolated */,
           std::vector<
               network::mojom::WebClientHintsType>() /* enabled_client_hints
                                                      */
@@ -2060,7 +2060,7 @@
       break;
   }
 
-  commit_params_->origin_isolation_restricted =
+  commit_params_->origin_isolated =
       origin_isolation_end_result_ ==
           OptInOriginIsolationEndResult::kRequestedViaOriginPolicyAndIsolated ||
       origin_isolation_end_result_ ==
diff --git a/content/browser/web_contents/web_contents_view_aura_browsertest.cc b/content/browser/web_contents/web_contents_view_aura_browsertest.cc
index bfecb782..38dd74f 100644
--- a/content/browser/web_contents/web_contents_view_aura_browsertest.cc
+++ b/content/browser/web_contents/web_contents_view_aura_browsertest.cc
@@ -48,6 +48,7 @@
 #include "third_party/blink/public/common/input/synthetic_web_input_event_builders.h"
 #include "ui/aura/window.h"
 #include "ui/aura/window_tree_host.h"
+#include "ui/base/dragdrop/drag_drop_types.h"
 #include "ui/base/dragdrop/drop_target_event.h"
 #include "ui/base/dragdrop/os_exchange_data.h"
 #include "ui/compositor/scoped_animation_duration_scale_mode.h"
diff --git a/content/browser/worker_host/shared_worker_host_unittest.cc b/content/browser/worker_host/shared_worker_host_unittest.cc
index 4c382e4..7837e41 100644
--- a/content/browser/worker_host/shared_worker_host_unittest.cc
+++ b/content/browser/worker_host/shared_worker_host_unittest.cc
@@ -23,13 +23,13 @@
 #include "content/public/test/mock_render_process_host.h"
 #include "content/public/test/test_browser_context.h"
 #include "content/public/test/test_utils.h"
-#include "content/test/not_implemented_network_url_loader_factory.h"
 #include "mojo/public/cpp/bindings/pending_associated_receiver.h"
 #include "mojo/public/cpp/bindings/pending_associated_remote.h"
 #include "mojo/public/cpp/bindings/self_owned_receiver.h"
 #include "mojo/public/cpp/test_support/test_utils.h"
 #include "services/metrics/public/cpp/ukm_source_id.h"
 #include "services/network/public/cpp/features.h"
+#include "services/network/public/cpp/not_implemented_url_loader_factory.h"
 #include "testing/gtest/include/gtest/gtest.h"
 #include "third_party/blink/public/common/messaging/message_port_channel.h"
 #include "third_party/blink/public/common/messaging/message_port_descriptor.h"
@@ -93,7 +93,7 @@
         SubresourceLoaderParams();
     mojo::PendingRemote<network::mojom::URLLoaderFactory> loader_factory_remote;
     mojo::MakeSelfOwnedReceiver(
-        std::make_unique<NotImplementedNetworkURLLoaderFactory>(),
+        std::make_unique<network::NotImplementedURLLoaderFactory>(),
         loader_factory_remote.InitWithNewPipeAndPassReceiver());
     subresource_loader_params->pending_appcache_loader_factory =
         std::move(loader_factory_remote);
diff --git a/content/browser/worker_host/shared_worker_service_impl_unittest.cc b/content/browser/worker_host/shared_worker_service_impl_unittest.cc
index e1b662f..fc0869f 100644
--- a/content/browser/worker_host/shared_worker_service_impl_unittest.cc
+++ b/content/browser/worker_host/shared_worker_service_impl_unittest.cc
@@ -24,7 +24,6 @@
 #include "content/public/test/test_browser_context.h"
 #include "content/public/test/test_utils.h"
 #include "content/test/fake_network_url_loader_factory.h"
-#include "content/test/not_implemented_network_url_loader_factory.h"
 #include "content/test/test_render_frame_host.h"
 #include "content/test/test_render_view_host.h"
 #include "content/test/test_web_contents.h"
diff --git a/content/common/BUILD.gn b/content/common/BUILD.gn
index 2e096b7..13d4d9f 100644
--- a/content/common/BUILD.gn
+++ b/content/common/BUILD.gn
@@ -218,6 +218,8 @@
     "//ui/accessibility/mojom",
     "//ui/base/cursor:cursor_base",
     "//ui/base/cursor/mojom:cursor_type",
+    "//ui/base/dragdrop/mojom:mojom_headers",
+    "//ui/base/dragdrop/mojom:mojom_shared",
     "//ui/events/ipc",
   ]
   deps = [
diff --git a/content/common/drag_event_source_info.h b/content/common/drag_event_source_info.h
index d78ac45..f454779 100644
--- a/content/common/drag_event_source_info.h
+++ b/content/common/drag_event_source_info.h
@@ -6,7 +6,7 @@
 #define CONTENT_COMMON_DRAG_EVENT_SOURCE_INFO_H_
 
 #include "content/common/content_export.h"
-#include "ui/base/dragdrop/drag_drop_types.h"
+#include "ui/base/dragdrop/mojom/drag_drop_types.mojom-forward.h"
 #include "ui/gfx/geometry/point.h"
 
 namespace content {
@@ -14,7 +14,7 @@
 // Information about the event that started a drag session.
 struct CONTENT_EXPORT DragEventSourceInfo {
   gfx::Point event_location;
-  ui::DragDropTypes::DragEventSource event_source;
+  ui::mojom::DragEventSource event_source;
 };
 
 }  // namespace content
diff --git a/content/common/drag_traits.h b/content/common/drag_traits.h
index f165ec0..b4aa9dc 100644
--- a/content/common/drag_traits.h
+++ b/content/common/drag_traits.h
@@ -7,6 +7,7 @@
 
 #include "content/common/drag_event_source_info.h"
 #include "ipc/ipc_message_macros.h"
+#include "ui/base/dragdrop/mojom/drag_drop_types.mojom-shared.h"
 #include "ui/gfx/geometry/point.h"
 
 #define IPC_MESSAGE_START DragMsgStart
@@ -16,4 +17,7 @@
   IPC_STRUCT_TRAITS_MEMBER(event_source)
 IPC_STRUCT_TRAITS_END()
 
+IPC_ENUM_TRAITS_MAX_VALUE(ui::mojom::DragEventSource,
+                          ui::mojom::DragEventSource::kMaxValue)
+
 #endif  // CONTENT_COMMON_DRAG_TRAITS_H_
diff --git a/content/common/navigation_params.mojom b/content/common/navigation_params.mojom
index 4816a96..9a0f1f2 100644
--- a/content/common/navigation_params.mojom
+++ b/content/common/navigation_params.mojom
@@ -421,8 +421,9 @@
   // The names of origin trials to be force enabled for this navigation.
   array<string> force_enabled_origin_trials;
 
-  // Whether origin isolation is restricting certain cross-origin web APIs.
-  bool origin_isolation_restricted = false;
+  // Whether the page is origin isolated.
+  // https://github.com/WICG/origin-isolation
+  bool origin_isolated = false;
 
   // Client-hints enabled; this is based on the top-level frame and should be
   // further narrowed down by feature policy.
diff --git a/content/public/common/common_param_traits_macros.h b/content/public/common/common_param_traits_macros.h
index aa7b5ad..1c6f22d 100644
--- a/content/public/common/common_param_traits_macros.h
+++ b/content/public/common/common_param_traits_macros.h
@@ -27,7 +27,6 @@
 #include "third_party/blink/public/platform/web_rect.h"
 #include "third_party/blink/public/platform/web_url_request.h"
 #include "ui/accessibility/ax_param_traits.h"
-#include "ui/base/dragdrop/drag_drop_types.h"
 #include "ui/base/page_transition_types.h"
 #include "ui/base/window_open_disposition.h"
 #include "ui/gfx/ipc/geometry/gfx_param_traits.h"
@@ -338,8 +337,6 @@
 IPC_STRUCT_TRAITS_END()
 
 IPC_ENUM_TRAITS(blink::WebDragOperation)  // Bitmask.
-IPC_ENUM_TRAITS_MAX_VALUE(ui::DragDropTypes::DragEventSource,
-                          ui::DragDropTypes::DRAG_EVENT_SOURCE_LAST)
 IPC_ENUM_TRAITS_MAX_VALUE(content::DropData::Kind,
                           content::DropData::Kind::LAST)
 
diff --git a/content/renderer/BUILD.gn b/content/renderer/BUILD.gn
index aa9c757..39f15d88 100644
--- a/content/renderer/BUILD.gn
+++ b/content/renderer/BUILD.gn
@@ -379,6 +379,7 @@
     "//ui/base",
     "//ui/base/clipboard",
     "//ui/base/cursor:cursor_base",
+    "//ui/base/dragdrop/mojom:mojom_shared",
     "//ui/base/ime",
     "//ui/display",
     "//ui/events:dom_keycode_converter",
diff --git a/content/renderer/loader/child_url_loader_factory_bundle.cc b/content/renderer/loader/child_url_loader_factory_bundle.cc
index c3ecec1..b96816c 100644
--- a/content/renderer/loader/child_url_loader_factory_bundle.cc
+++ b/content/renderer/loader/child_url_loader_factory_bundle.cc
@@ -243,6 +243,7 @@
   DCHECK(request.request_initiator.has_value());
   if (is_deprecated_process_wide_factory_ &&
       !request.request_initiator->opaque()) {
+    NOTREACHED();
     ScopedRequestCrashKeys crash_keys(request);
     base::debug::DumpWithoutCrashing();
   }
diff --git a/content/renderer/loader/child_url_loader_factory_bundle.h b/content/renderer/loader/child_url_loader_factory_bundle.h
index 880c826..ea60d57 100644
--- a/content/renderer/loader/child_url_loader_factory_bundle.h
+++ b/content/renderer/loader/child_url_loader_factory_bundle.h
@@ -15,6 +15,7 @@
 #include "mojo/public/cpp/bindings/pending_receiver.h"
 #include "mojo/public/cpp/bindings/pending_remote.h"
 #include "mojo/public/cpp/bindings/remote.h"
+#include "mojo/public/cpp/bindings/self_owned_receiver.h"
 #include "services/network/public/mojom/url_loader_factory.mojom-forward.h"
 #include "third_party/blink/public/common/loader/url_loader_factory_bundle.h"
 #include "third_party/blink/public/mojom/loader/transferrable_url_loader.mojom.h"
@@ -49,6 +50,26 @@
       bool bypass_redirect_checks);
   ~ChildPendingURLLoaderFactoryBundle() override;
 
+  template <typename T>
+  static std::unique_ptr<ChildPendingURLLoaderFactoryBundle>
+  CreateFromDefaultFactoryImpl(std::unique_ptr<T> default_factory_impl) {
+    mojo::PendingRemote<network::mojom::URLLoaderFactory> pending_remote;
+    mojo::MakeSelfOwnedReceiver(
+        std::move(default_factory_impl),
+        pending_remote.InitWithNewPipeAndPassReceiver());
+
+    std::unique_ptr<ChildPendingURLLoaderFactoryBundle> pending_bundle(
+        new ChildPendingURLLoaderFactoryBundle(
+            std::move(pending_remote),  // pending_default_factory
+            {},                         // pending_default_network_factory
+            {},                         // pending_scheme_specific_factories
+            {},                         // pending_isolated_world_factories
+            {},                         // direct_network_factory_remote
+            {},                         // pending_prefetch_loader_factory
+            false));                    // bypass_redirect_checks
+    return pending_bundle;
+  }
+
   mojo::PendingRemote<network::mojom::URLLoaderFactory>&
   direct_network_factory_remote() {
     return direct_network_factory_remote_;
diff --git a/content/renderer/render_frame_impl.cc b/content/renderer/render_frame_impl.cc
index 23b8582..9de559c 100644
--- a/content/renderer/render_frame_impl.cc
+++ b/content/renderer/render_frame_impl.cc
@@ -147,6 +147,7 @@
 #include "net/http/http_util.h"
 #include "ppapi/buildflags/buildflags.h"
 #include "services/network/public/cpp/features.h"
+#include "services/network/public/cpp/not_implemented_url_loader_factory.h"
 #include "services/network/public/cpp/weak_wrapper_shared_url_loader_factory.h"
 #include "services/network/public/mojom/url_loader.mojom.h"
 #include "services/network/public/mojom/url_response_head.mojom.h"
@@ -1018,8 +1019,7 @@
         blink::mojom::FetchCacheMode::kDefault;
   }
 
-  navigation_params->origin_isolation_restricted =
-      commit_params.origin_isolation_restricted;
+  navigation_params->origin_isolated = commit_params.origin_isolated;
 
   navigation_params->enabled_client_hints.reserve(
       commit_params.enabled_client_hints.size());
@@ -3266,6 +3266,8 @@
         std::move(subresource_loader_factories),
         std::move(subresource_overrides), std::move(prefetch_loader_factory));
   }
+  DCHECK(new_loader_factories);
+  DCHECK(new_loader_factories->HasBoundDefaultFactory());
 
   // If the navigation is for "view source", the WebLocalFrame needs to be put
   // in a special mode.
@@ -3361,6 +3363,7 @@
           std::move(subresource_loader_factories),
           base::nullopt /* subresource_overrides */,
           mojo::NullRemote() /* prefetch_loader_factory */);
+  DCHECK(new_loader_factories->HasBoundDefaultFactory());
 
   // Send the provisional load failure.
   WebURLError error(
@@ -3611,6 +3614,8 @@
   // workaround to paper-over the crash in https://crbug.com/1013254.
   if (!loader_factories_)
     loader_factories_ = GetLoaderFactoryBundleFromCreator();
+  if (!loader_factories_)
+    loader_factories_ = GetLoaderFactoryBundleFallback();
 
   if (loader_factories_->IsHostChildURLLoaderFactoryBundle()) {
     static_cast<HostChildURLLoaderFactoryBundle*>(loader_factories_.get())
@@ -4168,6 +4173,8 @@
     // initialized).
     loader_factories_ = GetLoaderFactoryBundleFromCreator();
   }
+  DCHECK(loader_factories_);
+  DCHECK(loader_factories_->HasBoundDefaultFactory());
 
   // TODO(dgozman): call DidStartNavigation in various places where we call
   // CommitNavigation() on the frame.
@@ -5793,10 +5800,19 @@
 ChildURLLoaderFactoryBundle* RenderFrameImpl::GetLoaderFactoryBundle() {
   if (!loader_factories_)
     loader_factories_ = GetLoaderFactoryBundleFromCreator();
+  if (!loader_factories_)
+    loader_factories_ = GetLoaderFactoryBundleFallback();
   return loader_factories_.get();
 }
 
 scoped_refptr<ChildURLLoaderFactoryBundle>
+RenderFrameImpl::GetLoaderFactoryBundleFallback() {
+  return CreateLoaderFactoryBundle(
+      nullptr, base::nullopt /* subresource_overrides */,
+      mojo::NullRemote() /* prefetch_loader_factory */);
+}
+
+scoped_refptr<ChildURLLoaderFactoryBundle>
 RenderFrameImpl::GetLoaderFactoryBundleFromCreator() {
   RenderFrameImpl* creator = RenderFrameImpl::FromWebFrame(
       frame_->Parent() ? frame_->Parent() : frame_->Opener());
@@ -5807,9 +5823,7 @@
     return base::MakeRefCounted<TrackedChildURLLoaderFactoryBundle>(
         std::move(bundle_info));
   }
-  return CreateLoaderFactoryBundle(
-      nullptr, base::nullopt /* subresource_overrides */,
-      mojo::NullRemote() /* prefetch_loader_factory */);
+  return nullptr;
 }
 
 scoped_refptr<ChildURLLoaderFactoryBundle>
@@ -6324,6 +6338,12 @@
                                      const std::string& text_encoding,
                                      const GURL& unreachable_url,
                                      bool replace_current_item) {
+  pending_loader_factories_ = CreateLoaderFactoryBundle(
+      ChildPendingURLLoaderFactoryBundle::CreateFromDefaultFactoryImpl(
+          std::make_unique<network::NotImplementedURLLoaderFactory>()),
+      base::nullopt,  // |subresource_overrides|
+      {});            // prefetch_loader_factory
+
   auto navigation_params = std::make_unique<WebNavigationParams>();
   navigation_params->url = base_url;
   WebNavigationParams::FillStaticResponse(navigation_params.get(), "text/html",
diff --git a/content/renderer/render_frame_impl.h b/content/renderer/render_frame_impl.h
index 6780010..ef81b1a 100644
--- a/content/renderer/render_frame_impl.h
+++ b/content/renderer/render_frame_impl.h
@@ -1032,6 +1032,13 @@
   scoped_refptr<ChildURLLoaderFactoryBundle>
   GetLoaderFactoryBundleFromCreator();
 
+  // Returns a mostly empty bundle, with a fallback that uses a process-wide,
+  // direct-network factory.
+  //
+  // TODO(lukasza): https://crbug.com/1098938: Remove once the fallback is no
+  // longer needed.
+  scoped_refptr<ChildURLLoaderFactoryBundle> GetLoaderFactoryBundleFallback();
+
   scoped_refptr<ChildURLLoaderFactoryBundle> CreateLoaderFactoryBundle(
       std::unique_ptr<blink::PendingURLLoaderFactoryBundle> info,
       base::Optional<std::vector<blink::mojom::TransferrableURLLoaderPtr>>
diff --git a/content/renderer/render_widget.cc b/content/renderer/render_widget.cc
index 31e8817..47ceac9 100644
--- a/content/renderer/render_widget.cc
+++ b/content/renderer/render_widget.cc
@@ -102,6 +102,7 @@
 #include "third_party/blink/public/web/web_widget.h"
 #include "third_party/skia/include/core/SkShader.h"
 #include "ui/base/clipboard/clipboard_constants.h"
+#include "ui/base/dragdrop/mojom/drag_drop_types.mojom-shared.h"
 #include "ui/base/ui_base_features.h"
 #include "ui/base/ui_base_switches.h"
 #include "ui/events/base_event_utils.h"
@@ -918,8 +919,7 @@
 }
 
 bool RenderWidget::WillHandleGestureEvent(const blink::WebGestureEvent& event) {
-  possible_drag_event_info_.event_source =
-      ui::DragDropTypes::DRAG_EVENT_SOURCE_TOUCH;
+  possible_drag_event_info_.event_source = ui::mojom::DragEventSource::kTouch;
   possible_drag_event_info_.event_location =
       gfx::ToFlooredPoint(event.PositionInScreen());
 
@@ -930,8 +930,7 @@
   for (auto& observer : render_frames_)
     observer.RenderWidgetWillHandleMouseEvent();
 
-  possible_drag_event_info_.event_source =
-      ui::DragDropTypes::DRAG_EVENT_SOURCE_MOUSE;
+  possible_drag_event_info_.event_source = ui::mojom::DragEventSource::kMouse;
   possible_drag_event_info_.event_location =
       gfx::Point(event.PositionInScreen().x(), event.PositionInScreen().y());
 
diff --git a/content/shell/browser/web_test/web_test_bluetooth_adapter_provider.cc b/content/shell/browser/web_test/web_test_bluetooth_adapter_provider.cc
index 40931c52..c77e703 100644
--- a/content/shell/browser/web_test/web_test_bluetooth_adapter_provider.cc
+++ b/content/shell/browser/web_test/web_test_bluetooth_adapter_provider.cc
@@ -21,6 +21,7 @@
 #include "device/bluetooth/bluetooth_adapter.h"
 #include "device/bluetooth/bluetooth_device.h"
 #include "device/bluetooth/bluetooth_discovery_session.h"
+#include "device/bluetooth/public/cpp/bluetooth_address.h"
 #include "device/bluetooth/public/cpp/bluetooth_uuid.h"
 #include "device/bluetooth/test/mock_bluetooth_adapter.h"
 #include "device/bluetooth/test/mock_bluetooth_gatt_connection.h"
@@ -1794,7 +1795,7 @@
 
 // static
 std::string WebTestBluetoothAdapterProvider::makeMACAddress(uint64_t addr) {
-  return BluetoothDevice::CanonicalizeAddress(
+  return device::CanonicalizeBluetoothAddress(
       base::StringPrintf("%012" PRIx64, addr));
 }
 
diff --git a/content/test/BUILD.gn b/content/test/BUILD.gn
index 2c853b5..dbb6610 100644
--- a/content/test/BUILD.gn
+++ b/content/test/BUILD.gn
@@ -301,8 +301,6 @@
     "mock_widget_input_handler.h",
     "navigation_simulator_impl.cc",
     "navigation_simulator_impl.h",
-    "not_implemented_network_url_loader_factory.cc",
-    "not_implemented_network_url_loader_factory.h",
     "portal/portal_activated_observer.cc",
     "portal/portal_activated_observer.h",
     "portal/portal_created_observer.cc",
diff --git a/content/test/data/accessibility/aria/aria-atomic-expected-mac.txt b/content/test/data/accessibility/aria/aria-atomic-expected-mac.txt
index f6779b8..3d5a0be 100644
--- a/content/test/data/accessibility/aria/aria-atomic-expected-mac.txt
+++ b/content/test/data/accessibility/aria/aria-atomic-expected-mac.txt
@@ -1,9 +1,9 @@
 AXWebArea
-++AXGroup AXARIAAtomic=0 AXDescription='This test is for aria-atomic="false"'
+++AXGroup AXARIAAtomic=0
 ++++AXStaticText AXARIAAtomic=0 AXValue='This test is for aria-atomic="false"'
-++AXGroup AXARIAAtomic=1 AXDescription='This test is for aria-atomic="true"'
+++AXGroup AXARIAAtomic=1
 ++++AXStaticText AXARIAAtomic=0 AXValue='This test is for aria-atomic="true"'
-++AXGroup AXARIAAtomic=1 AXDescription='This test is for alert.'
+++AXGroup AXARIAAtomic=1
 ++++AXStaticText AXARIAAtomic=0 AXValue='This test is for alert.'
-++AXGroup AXARIAAtomic=1 AXDescription='This test is for status.'
+++AXGroup AXARIAAtomic=1
 ++++AXStaticText AXARIAAtomic=0 AXValue='This test is for status.'
diff --git a/content/test/data/accessibility/aria/aria-feed-expected-mac.txt b/content/test/data/accessibility/aria/aria-feed-expected-mac.txt
index 8c4fa38..5d46b30e 100644
--- a/content/test/data/accessibility/aria/aria-feed-expected-mac.txt
+++ b/content/test/data/accessibility/aria/aria-feed-expected-mac.txt
@@ -1,5 +1,5 @@
 AXWebArea AXRoleDescription='HTML content'
-++AXGroup AXDescription='First' AXRoleDescription='article'
+++AXGroup AXRoleDescription='article'
 ++++AXStaticText AXRoleDescription='text' AXValue='First'
-++AXGroup AXDescription='Second' AXRoleDescription='article'
+++AXGroup AXRoleDescription='article'
 ++++AXStaticText AXRoleDescription='text' AXValue='Second'
diff --git a/content/test/data/accessibility/html/input-date-with-popup-open-expected-mac.txt b/content/test/data/accessibility/html/input-date-with-popup-open-expected-mac.txt
index 964a37a5..2798338 100644
--- a/content/test/data/accessibility/html/input-date-with-popup-open-expected-mac.txt
+++ b/content/test/data/accessibility/html/input-date-with-popup-open-expected-mac.txt
@@ -24,7 +24,7 @@
 ++++++++++++++++AXGroup AXRoleDescription='group'
 ++++++++++++++AXButton AXDescription='Show next month' AXRoleDescription='button'
 ++++++++++++++++AXGroup AXRoleDescription='group'
-++++++++++++++AXTable AXDescription='S M T W T F S Sunday, August 31, 2008 Monday, September 1, 2008 Tuesday, September 2, 2008 Wednesday, September 3, 2008 Thursday, September 4, 2008 Friday, September 5, 2008 Saturday, September 6, 2008 Sunday, September 7, 2008 Monday, September 8, 2008 Tuesday, September 9, 2008 Wednesday, September 10, 2008 Thursday, September 11, 2008 Friday, September 12, 2008 Saturday, September 13, 2008 Sunday, September 14, 2008 Monday, September 15, 2008 Tuesday, September 16, 2008 Wednesday, September 17, 2008 Thursday, September 18, 2008 Friday, September 19, 2008 Saturday, September 20, 2008 Sunday, September 21, 2008 Monday, September 22, 2008 Tuesday, September 23, 2008 Wednesday, September 24, 2008 Thursday, September 25, 2008 Friday, September 26, 2008 Saturday, September 27, 2008 Sunday, September 28, 2008 Monday, September 29, 2008 Tuesday, September 30, 2008 Wednesday, October 1, 2008 Thursday, October 2, 2008 Friday, October 3, 2008 Saturday, October 4, 2008 Sunday, October 5, 2008 Monday, October 6, 2008 Tuesday, October 7, 2008 Wednesday, October 8, 2008 Thursday, October 9, 2008 Friday, October 10, 2008 Saturday, October 11, 2008 Today' AXRoleDescription='table'
+++++++++++++++AXTable AXRoleDescription='table'
 ++++++++++++++++AXGroup AXRoleDescription='group'
 ++++++++++++++++++AXGroup AXRoleDescription='group'
 ++++++++++++++++++++AXStaticText AXRoleDescription='text' AXValue='S'
diff --git a/content/test/data/accessibility/html/table-focusable-sections-expected-mac.txt b/content/test/data/accessibility/html/table-focusable-sections-expected-mac.txt
index 2b740db..f676fa5 100644
--- a/content/test/data/accessibility/html/table-focusable-sections-expected-mac.txt
+++ b/content/test/data/accessibility/html/table-focusable-sections-expected-mac.txt
@@ -1,12 +1,12 @@
 AXWebArea AXTitle='Table example - focusable thead, tbody, tfoot'
 ++AXTable
-++++AXGroup AXDescription='Sum Subtraction'
+++++AXGroup
 ++++++AXRow AXIndex=0
 ++++++++AXCell AXColumnIndexRange={len: 1, loc: 0} AXRowIndexRange={len: 1, loc: 0}
 ++++++++++AXStaticText AXValue='Sum'
 ++++++++AXCell AXColumnIndexRange={len: 1, loc: 1} AXRowIndexRange={len: 1, loc: 0}
 ++++++++++AXStaticText AXValue='Subtraction'
-++++AXGroup AXDescription='10 7 2 4'
+++++AXGroup
 ++++++AXRow AXIndex=1
 ++++++++AXCell AXColumnIndexRange={len: 1, loc: 0} AXRowIndexRange={len: 1, loc: 1}
 ++++++++++AXStaticText AXValue='10'
@@ -17,7 +17,7 @@
 ++++++++++AXStaticText AXValue='2'
 ++++++++AXCell AXColumnIndexRange={len: 1, loc: 1} AXRowIndexRange={len: 1, loc: 2}
 ++++++++++AXStaticText AXValue='4'
-++++AXGroup AXDescription='12 3'
+++++AXGroup
 ++++++AXRow AXIndex=3
 ++++++++AXCell AXColumnIndexRange={len: 1, loc: 0} AXRowIndexRange={len: 1, loc: 3}
 ++++++++++AXStaticText AXValue='12'
diff --git a/content/test/gpu/gpu_tests/test_expectations/webgl_conformance_expectations.txt b/content/test/gpu/gpu_tests/test_expectations/webgl_conformance_expectations.txt
index 3682dfac..7cc5531 100644
--- a/content/test/gpu/gpu_tests/test_expectations/webgl_conformance_expectations.txt
+++ b/content/test/gpu/gpu_tests/test_expectations/webgl_conformance_expectations.txt
@@ -153,6 +153,9 @@
 crbug.com/angleproject/2914 [ vulkan passthrough ] conformance/textures/misc/texture-copying-feedback-loops.html [ Failure ]
 crbug.com/angleproject/4684 [ vulkan passthrough ] conformance/textures/misc/texture-mips.html [ Failure ]
 
+# Win / Intel / Vulkan / Passthrough command decoder
+crbug.com/angleproject/4922 [ win intel vulkan passthrough ] conformance/context/context-attributes-alpha-depth-stencil-antialias.html [ RetryOnFailure ]
+
 ####################
 # Fuchsia failures     #
 ####################
diff --git a/content/test/test_render_frame.cc b/content/test/test_render_frame.cc
index efbf905..5ccb57a 100644
--- a/content/test/test_render_frame.cc
+++ b/content/test/test_render_frame.cc
@@ -26,6 +26,7 @@
 #include "mojo/public/cpp/bindings/pending_remote.h"
 #include "mojo/public/cpp/bindings/remote.h"
 #include "net/base/data_url.h"
+#include "services/network/public/cpp/not_implemented_url_loader_factory.h"
 #include "services/network/public/mojom/url_response_head.mojom.h"
 #include "third_party/blink/public/common/associated_interfaces/associated_interface_provider.h"
 #include "third_party/blink/public/web/web_local_frame.h"
@@ -280,21 +281,23 @@
 void TestRenderFrame::Navigate(network::mojom::URLResponseHeadPtr head,
                                mojom::CommonNavigationParamsPtr common_params,
                                mojom::CommitNavigationParamsPtr commit_params) {
-    mock_navigation_client_.reset();
-    BindNavigationClient(
-        mock_navigation_client_
-            .BindNewEndpointAndPassDedicatedReceiverForTesting());
-    CommitNavigation(std::move(common_params), std::move(commit_params),
-                     std::move(head), mojo::ScopedDataPipeConsumerHandle(),
-                     network::mojom::URLLoaderClientEndpointsPtr(),
-                     std::make_unique<blink::PendingURLLoaderFactoryBundle>(),
-                     base::nullopt,
-                     blink::mojom::ControllerServiceWorkerInfoPtr(),
-                     blink::mojom::ServiceWorkerContainerInfoForClientPtr(),
-                     mojo::NullRemote() /* prefetch_loader_factory */,
-                     base::UnguessableToken::Create(),
-                     base::BindOnce(&MockFrameHost::DidCommitProvisionalLoad,
-                                    base::Unretained(mock_frame_host_.get())));
+  mock_navigation_client_.reset();
+  BindNavigationClient(
+      mock_navigation_client_
+          .BindNewEndpointAndPassDedicatedReceiverForTesting());
+  std::unique_ptr<blink::PendingURLLoaderFactoryBundle> pending_factory_bundle =
+      ChildPendingURLLoaderFactoryBundle::CreateFromDefaultFactoryImpl(
+          std::make_unique<network::NotImplementedURLLoaderFactory>());
+  CommitNavigation(std::move(common_params), std::move(commit_params),
+                   std::move(head), mojo::ScopedDataPipeConsumerHandle(),
+                   network::mojom::URLLoaderClientEndpointsPtr(),
+                   std::move(pending_factory_bundle), base::nullopt,
+                   blink::mojom::ControllerServiceWorkerInfoPtr(),
+                   blink::mojom::ServiceWorkerContainerInfoForClientPtr(),
+                   mojo::NullRemote() /* prefetch_loader_factory */,
+                   base::UnguessableToken::Create(),
+                   base::BindOnce(&MockFrameHost::DidCommitProvisionalLoad,
+                                  base::Unretained(mock_frame_host_.get())));
 }
 
 void TestRenderFrame::Navigate(mojom::CommonNavigationParamsPtr common_params,
@@ -313,10 +316,13 @@
   BindNavigationClient(
       mock_navigation_client_
           .BindNewEndpointAndPassDedicatedReceiverForTesting());
+  std::unique_ptr<blink::PendingURLLoaderFactoryBundle> pending_factory_bundle =
+      ChildPendingURLLoaderFactoryBundle::CreateFromDefaultFactoryImpl(
+          std::make_unique<network::NotImplementedURLLoaderFactory>());
   mock_navigation_client_->CommitFailedNavigation(
       std::move(common_params), std::move(commit_params),
       false /* has_stale_copy_in_cache */, error_code, resolve_error_info,
-      error_page_content, nullptr,
+      error_page_content, std::move(pending_factory_bundle),
       base::BindOnce(&MockFrameHost::DidCommitProvisionalLoad,
                      base::Unretained(mock_frame_host_.get())));
 }
diff --git a/device/BUILD.gn b/device/BUILD.gn
index 7dd22ae..1fcc3be 100644
--- a/device/BUILD.gn
+++ b/device/BUILD.gn
@@ -15,7 +15,7 @@
   import("//build/config/mac/mac_sdk.gni")
 }
 
-is_linux_without_udev = is_linux && !use_udev
+is_linux_without_udev = (is_linux || is_chromeos) && !use_udev
 
 test("device_unittests") {
   sources = [
@@ -227,7 +227,7 @@
     }
   }
 
-  if (is_linux) {
+  if (is_linux || is_chromeos) {
     if (is_chromecast) {
       # Cast does not support GATT server mode.
       sources -= [
diff --git a/device/bluetooth/BUILD.gn b/device/bluetooth/BUILD.gn
index 7648ac3c..0d8d1f95 100644
--- a/device/bluetooth/BUILD.gn
+++ b/device/bluetooth/BUILD.gn
@@ -23,7 +23,7 @@
       "/DELAYLOAD:setupapi.dll",
     ]
   }
-  if (is_linux && is_chromecast) {
+  if ((is_linux || is_chromeos) && is_chromecast) {
     defines = [ "USE_CAST_BLUETOOTH_ADAPTER" ]
   }
 }
@@ -378,7 +378,7 @@
         "dbus/bluez_dbus_manager.cc",
         "dbus/bluez_dbus_manager.h",
       ]
-      if (is_linux) {
+      if (is_linux || is_chromeos) {
         sources += [
           "dbus/bluez_dbus_thread_manager.cc",
           "dbus/bluez_dbus_thread_manager.h",
@@ -438,7 +438,7 @@
       }
       deps += [ "//dbus" ]
     } else {  # !use_dbus
-      if (is_chromecast && is_linux) {
+      if (is_chromecast && (is_linux || is_chromeos)) {
         sources += [
           "cast/bluetooth_adapter_cast.cc",
           "cast/bluetooth_adapter_cast.h",
@@ -464,7 +464,7 @@
         sources += [ "bluetooth_adapter_stub.cc" ]
       }
 
-      if (is_linux) {
+      if (is_linux || is_chromeos) {
         defines += [ "LINUX_WITHOUT_DBUS" ]
         sources += [
           "dbus/dbus_bluez_manager_wrapper_linux.h",
diff --git a/device/bluetooth/bluetooth_adapter.cc b/device/bluetooth/bluetooth_adapter.cc
index 00c5d08..21bbdf51 100644
--- a/device/bluetooth/bluetooth_adapter.cc
+++ b/device/bluetooth/bluetooth_adapter.cc
@@ -22,6 +22,7 @@
 #include "device/bluetooth/bluetooth_remote_gatt_characteristic.h"
 #include "device/bluetooth/bluetooth_remote_gatt_descriptor.h"
 #include "device/bluetooth/bluetooth_remote_gatt_service.h"
+#include "device/bluetooth/public/cpp/bluetooth_address.h"
 
 namespace device {
 
@@ -224,8 +225,7 @@
 
 const BluetoothDevice* BluetoothAdapter::GetDevice(
     const std::string& address) const {
-  std::string canonicalized_address =
-      BluetoothDevice::CanonicalizeAddress(address);
+  std::string canonicalized_address = CanonicalizeBluetoothAddress(address);
   if (canonicalized_address.empty())
     return nullptr;
 
diff --git a/device/bluetooth/bluetooth_adapter_mac.mm b/device/bluetooth/bluetooth_adapter_mac.mm
index 3aec8bc1..933483c 100644
--- a/device/bluetooth/bluetooth_adapter_mac.mm
+++ b/device/bluetooth/bluetooth_adapter_mac.mm
@@ -35,6 +35,7 @@
 #include "device/bluetooth/bluetooth_low_energy_device_watcher_mac.h"
 #include "device/bluetooth/bluetooth_low_energy_peripheral_manager_delegate.h"
 #include "device/bluetooth/bluetooth_socket_mac.h"
+#include "device/bluetooth/public/cpp/bluetooth_address.h"
 
 extern "C" {
 // Undocumented IOBluetooth Preference API [1]. Used by `blueutil` [2] and
@@ -321,7 +322,7 @@
   if (controller != nil) {
     state.classic_powered =
         ([controller powerState] == kBluetoothHCIPowerStateON);
-    state.address = BluetoothDevice::CanonicalizeAddress(
+    state.address = CanonicalizeBluetoothAddress(
         base::SysNSStringToUTF8([controller addressAsString]));
     state.is_present = !state.address.empty();
   }
diff --git a/device/bluetooth/bluetooth_adapter_win.cc b/device/bluetooth/bluetooth_adapter_win.cc
index 6043bf9..50df93ce 100644
--- a/device/bluetooth/bluetooth_adapter_win.cc
+++ b/device/bluetooth/bluetooth_adapter_win.cc
@@ -28,6 +28,7 @@
 #include "device/bluetooth/bluetooth_socket_thread.h"
 #include "device/bluetooth/bluetooth_socket_win.h"
 #include "device/bluetooth/bluetooth_task_manager_win.h"
+#include "device/bluetooth/public/cpp/bluetooth_address.h"
 #include "device/bluetooth/public/cpp/bluetooth_uuid.h"
 
 namespace device {
@@ -192,7 +193,7 @@
   name_ = state.name;
   bool was_present = IsPresent();
   bool is_present = !state.address.empty();
-  address_ = BluetoothDevice::CanonicalizeAddress(state.address);
+  address_ = CanonicalizeBluetoothAddress(state.address);
   if (was_present != is_present) {
     for (auto& observer : observers_)
       observer.AdapterPresentChanged(this, is_present);
diff --git a/device/bluetooth/bluetooth_adapter_winrt.cc b/device/bluetooth/bluetooth_adapter_winrt.cc
index abaa67c0..a51515d 100644
--- a/device/bluetooth/bluetooth_adapter_winrt.cc
+++ b/device/bluetooth/bluetooth_adapter_winrt.cc
@@ -41,6 +41,7 @@
 #include "device/bluetooth/bluetooth_discovery_filter.h"
 #include "device/bluetooth/bluetooth_discovery_session_outcome.h"
 #include "device/bluetooth/event_utils_winrt.h"
+#include "device/bluetooth/public/cpp/bluetooth_address.h"
 
 namespace device {
 
@@ -1085,8 +1086,8 @@
     return;
   }
 
-  address_ = BluetoothDevice::CanonicalizeAddress(
-      base::StringPrintf("%012llX", raw_address));
+  address_ =
+      CanonicalizeBluetoothAddress(base::StringPrintf("%012llX", raw_address));
   DCHECK(!address_.empty());
 
   HSTRING device_id;
diff --git a/device/bluetooth/bluetooth_classic_device_mac.mm b/device/bluetooth/bluetooth_classic_device_mac.mm
index ef34c6071..839aca9 100644
--- a/device/bluetooth/bluetooth_classic_device_mac.mm
+++ b/device/bluetooth/bluetooth_classic_device_mac.mm
@@ -14,6 +14,7 @@
 #include "base/strings/sys_string_conversions.h"
 #include "base/time/time.h"
 #include "device/bluetooth/bluetooth_socket_mac.h"
+#include "device/bluetooth/public/cpp/bluetooth_address.h"
 #include "device/bluetooth/public/cpp/bluetooth_uuid.h"
 
 // Undocumented API for accessing the Bluetooth transmit power level.
@@ -287,7 +288,8 @@
 // static
 std::string BluetoothClassicDeviceMac::GetDeviceAddress(
     IOBluetoothDevice* device) {
-  return CanonicalizeAddress(base::SysNSStringToUTF8([device addressString]));
+  return CanonicalizeBluetoothAddress(
+      base::SysNSStringToUTF8([device addressString]));
 }
 
 }  // namespace device
diff --git a/device/bluetooth/bluetooth_device.cc b/device/bluetooth/bluetooth_device.cc
index 6d7e98a..cb2f951e 100644
--- a/device/bluetooth/bluetooth_device.cc
+++ b/device/bluetooth/bluetooth_device.cc
@@ -407,55 +407,6 @@
   return it->second.get();
 }
 
-// static
-std::string BluetoothDevice::CanonicalizeAddress(base::StringPiece address) {
-  std::array<uint8_t, 6> bytes;
-
-  if (!ParseAddress(address, bytes))
-    return std::string();
-
-  std::string canonicalized;
-  canonicalized.reserve(17);
-
-  for (size_t i = 0; i < bytes.size(); ++i) {
-    if (i != 0)
-      canonicalized.push_back(':');
-    base::StringAppendF(&canonicalized, "%02X", bytes[i]);
-  }
-
-  return canonicalized;
-}
-
-bool BluetoothDevice::ParseAddress(base::StringPiece input,
-                                   base::span<uint8_t> output) {
-  if (output.size() != 6)
-    return false;
-
-  // Try parsing addresses that lack separators, like "1A2B3C4D5E6F".
-  if (input.size() == 12)
-    return base::HexStringToSpan(input, output);
-
-  // Try parsing MAC address with separators like: "00:11:22:33:44:55" or
-  // "00-11-22-33-44-55". Separator can be either '-' or ':', but must use the
-  // same style throughout.
-  if (input.size() == 17) {
-    const char separator = input[2];
-    if (separator != '-' && separator != ':')
-      return false;
-    return (input[2] == separator) && (input[5] == separator) &&
-           (input[8] == separator) && (input[11] == separator) &&
-           (input[14] == separator) &&
-           base::HexStringToSpan(input.substr(0, 2), output.subspan<0, 1>()) &&
-           base::HexStringToSpan(input.substr(3, 2), output.subspan<1, 1>()) &&
-           base::HexStringToSpan(input.substr(6, 2), output.subspan<2, 1>()) &&
-           base::HexStringToSpan(input.substr(9, 2), output.subspan<3, 1>()) &&
-           base::HexStringToSpan(input.substr(12, 2), output.subspan<4, 1>()) &&
-           base::HexStringToSpan(input.substr(15, 2), output.subspan<5, 1>());
-  }
-
-  return false;
-}
-
 std::string BluetoothDevice::GetIdentifier() const {
   return GetAddress();
 }
diff --git a/device/bluetooth/bluetooth_device.h b/device/bluetooth/bluetooth_device.h
index bef7bca9..8bdf528 100644
--- a/device/bluetooth/bluetooth_device.h
+++ b/device/bluetooth/bluetooth_device.h
@@ -548,19 +548,6 @@
   virtual BluetoothRemoteGattService* GetGattService(
       const std::string& identifier) const;
 
-  // Returns the |address| in the canonical format: XX:XX:XX:XX:XX:XX, where
-  // each 'X' is a hex digit.  If the input |address| is invalid, returns an
-  // empty string.
-  static std::string CanonicalizeAddress(base::StringPiece address);
-
-  // Parses a Bluetooth address to an output buffer. The output buffer must be
-  // exactly 6 bytes in size. The address can be formatted in one of three ways:
-  //
-  //   1A:2B:3C:4D:5E:6F
-  //   1A-2B-3C-4D-5E-6F
-  //   1A2B3C4D5E6F
-  static bool ParseAddress(base::StringPiece input, base::span<uint8_t> output);
-
   // Update the last time this device was seen.
   void UpdateTimestamp();
 
diff --git a/device/bluetooth/bluetooth_device_unittest.cc b/device/bluetooth/bluetooth_device_unittest.cc
index d278640..3906a21 100644
--- a/device/bluetooth/bluetooth_device_unittest.cc
+++ b/device/bluetooth/bluetooth_device_unittest.cc
@@ -14,6 +14,7 @@
 #include "base/test/bind_test_util.h"
 #include "build/build_config.h"
 #include "device/bluetooth/bluetooth_remote_gatt_service.h"
+#include "device/bluetooth/public/cpp/bluetooth_address.h"
 #include "device/bluetooth/test/test_bluetooth_adapter_observer.h"
 #include "device/bluetooth/test/test_pairing_delegate.h"
 #include "testing/gtest/include/gtest/gtest.h"
@@ -70,10 +71,10 @@
   for (size_t i = 0; i < base::size(kValidFormats); ++i) {
     SCOPED_TRACE(std::string("Input format: '") + kValidFormats[i] + "'");
     EXPECT_EQ("1A:2B:3C:4D:5E:6F",
-              BluetoothDevice::CanonicalizeAddress(kValidFormats[i]));
+              CanonicalizeBluetoothAddress(kValidFormats[i]));
 
     std::array<uint8_t, 6> parsed;
-    EXPECT_TRUE(BluetoothDevice::ParseAddress(kValidFormats[i], parsed));
+    EXPECT_TRUE(ParseBluetoothAddress(kValidFormats[i], parsed));
     EXPECT_EQ("\x1a\x2b\x3c\x4d\x5e\x6f",
               std::string(parsed.begin(), parsed.end()));
   }
@@ -101,11 +102,10 @@
 
   for (size_t i = 0; i < base::size(kInvalidFormats); ++i) {
     SCOPED_TRACE(std::string("Input format: '") + kInvalidFormats[i] + "'");
-    EXPECT_EQ(std::string(),
-              BluetoothDevice::CanonicalizeAddress(kInvalidFormats[i]));
+    EXPECT_EQ(std::string(), CanonicalizeBluetoothAddress(kInvalidFormats[i]));
 
     std::array<uint8_t, 6> parsed;
-    EXPECT_FALSE(BluetoothDevice::ParseAddress(kInvalidFormats[i], parsed));
+    EXPECT_FALSE(ParseBluetoothAddress(kInvalidFormats[i], parsed));
   }
 }
 
diff --git a/device/bluetooth/bluetooth_device_win.cc b/device/bluetooth/bluetooth_device_win.cc
index fa8f17b5..82b7e0f 100644
--- a/device/bluetooth/bluetooth_device_win.cc
+++ b/device/bluetooth/bluetooth_device_win.cc
@@ -19,6 +19,7 @@
 #include "device/bluetooth/bluetooth_socket_thread.h"
 #include "device/bluetooth/bluetooth_socket_win.h"
 #include "device/bluetooth/bluetooth_task_manager_win.h"
+#include "device/bluetooth/public/cpp/bluetooth_address.h"
 #include "device/bluetooth/public/cpp/bluetooth_uuid.h"
 
 namespace {
@@ -260,7 +261,7 @@
     const BluetoothTaskManagerWin::DeviceState& device_state) {
   address_ = device_state.address;
   // Note: Callers are responsible for providing a canonicalized address.
-  DCHECK_EQ(address_, BluetoothDevice::CanonicalizeAddress(address_));
+  DCHECK_EQ(address_, CanonicalizeBluetoothAddress(address_));
   name_ = device_state.name;
   bluetooth_class_ = device_state.bluetooth_class;
   visible_ = device_state.visible;
diff --git a/device/bluetooth/bluetooth_device_winrt.cc b/device/bluetooth/bluetooth_device_winrt.cc
index df3676e..482c9f1 100644
--- a/device/bluetooth/bluetooth_device_winrt.cc
+++ b/device/bluetooth/bluetooth_device_winrt.cc
@@ -24,6 +24,7 @@
 #include "device/bluetooth/bluetooth_pairing_winrt.h"
 #include "device/bluetooth/bluetooth_remote_gatt_service_winrt.h"
 #include "device/bluetooth/event_utils_winrt.h"
+#include "device/bluetooth/public/cpp/bluetooth_address.h"
 #include "device/bluetooth/public/cpp/bluetooth_uuid.h"
 
 namespace device {
@@ -437,8 +438,8 @@
 
 // static
 std::string BluetoothDeviceWinrt::CanonicalizeAddress(uint64_t address) {
-  std::string bluetooth_address = BluetoothDevice::CanonicalizeAddress(
-      base::StringPrintf("%012llX", address));
+  std::string bluetooth_address =
+      CanonicalizeBluetoothAddress(base::StringPrintf("%012llX", address));
   DCHECK(!bluetooth_address.empty());
   return bluetooth_address;
 }
diff --git a/device/bluetooth/bluetooth_low_energy_device_mac.mm b/device/bluetooth/bluetooth_low_energy_device_mac.mm
index 204e3a3..df268cf 100644
--- a/device/bluetooth/bluetooth_low_energy_device_mac.mm
+++ b/device/bluetooth/bluetooth_low_energy_device_mac.mm
@@ -20,6 +20,7 @@
 #include "device/bluetooth/bluetooth_remote_gatt_characteristic_mac.h"
 #include "device/bluetooth/bluetooth_remote_gatt_descriptor_mac.h"
 #include "device/bluetooth/bluetooth_remote_gatt_service_mac.h"
+#include "device/bluetooth/public/cpp/bluetooth_address.h"
 
 // Remove when Chrome no longer supports 10.12.
 #if defined(MAC_OS_X_VERSION_10_13)
@@ -415,8 +416,7 @@
   const size_t kCanonicalAddressNumberOfBytes = 6;
   char raw[kCanonicalAddressNumberOfBytes];
   crypto::SHA256HashString(device_identifier, raw, sizeof(raw));
-  return BluetoothDevice::CanonicalizeAddress(
-      base::HexEncode(raw, sizeof(raw)));
+  return CanonicalizeBluetoothAddress(base::HexEncode(raw, sizeof(raw)));
 }
 
 void BluetoothLowEnergyDeviceMac::DidConnectPeripheral() {
diff --git a/device/bluetooth/bluetooth_task_manager_win.cc b/device/bluetooth/bluetooth_task_manager_win.cc
index 599e34cb..10c778f 100644
--- a/device/bluetooth/bluetooth_task_manager_win.cc
+++ b/device/bluetooth/bluetooth_task_manager_win.cc
@@ -26,6 +26,7 @@
 #include "device/bluetooth/bluetooth_device.h"
 #include "device/bluetooth/bluetooth_init_win.h"
 #include "device/bluetooth/bluetooth_service_record_win.h"
+#include "device/bluetooth/public/cpp/bluetooth_address.h"
 #include "net/base/winsock_init.h"
 
 namespace {
@@ -43,7 +44,7 @@
 typedef device::BluetoothTaskManagerWin::ServiceRecordState ServiceRecordState;
 
 // Note: The string returned here must have the same format as
-// BluetoothDevice::CanonicalizeAddress.
+// CanonicalizeBluetoothAddress.
 std::string BluetoothAddressToCanonicalString(const BLUETOOTH_ADDRESS& btha) {
   std::string result = base::StringPrintf("%02X:%02X:%02X:%02X:%02X:%02X",
                                           btha.rgBytes[5],
@@ -52,7 +53,7 @@
                                           btha.rgBytes[2],
                                           btha.rgBytes[1],
                                           btha.rgBytes[0]);
-  DCHECK_EQ(result, device::BluetoothDevice::CanonicalizeAddress(result));
+  DCHECK_EQ(result, device::CanonicalizeBluetoothAddress(result));
   return result;
 }
 
diff --git a/device/bluetooth/bluez/bluetooth_adapter_bluez.cc b/device/bluetooth/bluez/bluetooth_adapter_bluez.cc
index fca0365..b097d41 100644
--- a/device/bluetooth/bluez/bluetooth_adapter_bluez.cc
+++ b/device/bluetooth/bluez/bluetooth_adapter_bluez.cc
@@ -47,6 +47,7 @@
 #include "device/bluetooth/dbus/bluetooth_input_client.h"
 #include "device/bluetooth/dbus/bluetooth_le_advertising_manager_client.h"
 #include "device/bluetooth/dbus/bluez_dbus_manager.h"
+#include "device/bluetooth/public/cpp/bluetooth_address.h"
 #include "device/bluetooth/public/cpp/bluetooth_uuid.h"
 #include "third_party/cros_system_api/dbus/service_constants.h"
 
@@ -325,7 +326,7 @@
           ->GetProperties(object_path_);
   DCHECK(properties);
 
-  return BluetoothDevice::CanonicalizeAddress(properties->address.value());
+  return device::CanonicalizeBluetoothAddress(properties->address.value());
 }
 
 std::string BluetoothAdapterBlueZ::GetName() const {
diff --git a/device/bluetooth/bluez/bluetooth_device_bluez.cc b/device/bluetooth/bluez/bluetooth_device_bluez.cc
index 7136518..0bf76e6 100644
--- a/device/bluetooth/bluez/bluetooth_device_bluez.cc
+++ b/device/bluetooth/bluez/bluetooth_device_bluez.cc
@@ -32,6 +32,7 @@
 #include "device/bluetooth/dbus/bluetooth_gatt_service_client.h"
 #include "device/bluetooth/dbus/bluetooth_input_client.h"
 #include "device/bluetooth/dbus/bluez_dbus_manager.h"
+#include "device/bluetooth/public/cpp/bluetooth_address.h"
 #include "device/bluetooth/public/cpp/bluetooth_uuid.h"
 #include "third_party/cros_system_api/dbus/service_constants.h"
 
@@ -298,7 +299,7 @@
           object_path_);
   DCHECK(properties);
 
-  return CanonicalizeAddress(properties->address.value());
+  return device::CanonicalizeBluetoothAddress(properties->address.value());
 }
 
 BluetoothDevice::VendorIDSource BluetoothDeviceBlueZ::GetVendorIDSource()
diff --git a/device/bluetooth/cast/bluetooth_utils.cc b/device/bluetooth/cast/bluetooth_utils.cc
index cc5a86a..e425054 100644
--- a/device/bluetooth/cast/bluetooth_utils.cc
+++ b/device/bluetooth/cast/bluetooth_utils.cc
@@ -7,12 +7,13 @@
 #include "base/strings/string_piece.h"
 #include "chromecast/device/bluetooth/bluetooth_util.h"
 #include "device/bluetooth/bluetooth_device.h"
+#include "device/bluetooth/public/cpp/bluetooth_address.h"
 
 namespace device {
 
 std::string GetCanonicalBluetoothAddress(
     const chromecast::bluetooth_v2_shlib::Addr& addr) {
-  return device::BluetoothDevice::CanonicalizeAddress(
+  return device::CanonicalizeBluetoothAddress(
       chromecast::bluetooth::util::AddrToString(addr));
 }
 
diff --git a/device/bluetooth/public/cpp/BUILD.gn b/device/bluetooth/public/cpp/BUILD.gn
index ded001e..d001561 100644
--- a/device/bluetooth/public/cpp/BUILD.gn
+++ b/device/bluetooth/public/cpp/BUILD.gn
@@ -4,6 +4,8 @@
 
 source_set("cpp") {
   sources = [
+    "bluetooth_address.cc",
+    "bluetooth_address.h",
     "bluetooth_uuid.cc",
     "bluetooth_uuid.h",
   ]
diff --git a/device/bluetooth/public/cpp/bluetooth_address.cc b/device/bluetooth/public/cpp/bluetooth_address.cc
new file mode 100644
index 0000000..b222569
--- /dev/null
+++ b/device/bluetooth/public/cpp/bluetooth_address.cc
@@ -0,0 +1,61 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "device/bluetooth/public/cpp/bluetooth_address.h"
+
+#include "base/strings/string_number_conversions.h"
+#include "base/strings/string_piece.h"
+#include "base/strings/stringprintf.h"
+
+namespace device {
+
+bool ParseBluetoothAddress(base::StringPiece input,
+                           base::span<uint8_t> output) {
+  if (output.size() != 6)
+    return false;
+
+  // Try parsing addresses that lack separators, like "1A2B3C4D5E6F".
+  if (input.size() == 12)
+    return base::HexStringToSpan(input, output);
+
+  // Try parsing MAC address with separators like: "00:11:22:33:44:55" or
+  // "00-11-22-33-44-55". Separator can be either '-' or ':', but must use the
+  // same style throughout.
+  if (input.size() == 17) {
+    const char separator = input[2];
+    if (separator != '-' && separator != ':')
+      return false;
+    return (input[2] == separator) && (input[5] == separator) &&
+           (input[8] == separator) && (input[11] == separator) &&
+           (input[14] == separator) &&
+           base::HexStringToSpan(input.substr(0, 2), output.subspan<0, 1>()) &&
+           base::HexStringToSpan(input.substr(3, 2), output.subspan<1, 1>()) &&
+           base::HexStringToSpan(input.substr(6, 2), output.subspan<2, 1>()) &&
+           base::HexStringToSpan(input.substr(9, 2), output.subspan<3, 1>()) &&
+           base::HexStringToSpan(input.substr(12, 2), output.subspan<4, 1>()) &&
+           base::HexStringToSpan(input.substr(15, 2), output.subspan<5, 1>());
+  }
+
+  return false;
+}
+
+std::string CanonicalizeBluetoothAddress(base::StringPiece address) {
+  std::array<uint8_t, 6> bytes;
+
+  if (!ParseBluetoothAddress(address, bytes))
+    return std::string();
+
+  std::string canonicalized;
+  canonicalized.reserve(17);
+
+  for (size_t i = 0; i < bytes.size(); ++i) {
+    if (i != 0)
+      canonicalized.push_back(':');
+    base::StringAppendF(&canonicalized, "%02X", bytes[i]);
+  }
+
+  return canonicalized;
+}
+
+}  // namespace device
diff --git a/device/bluetooth/public/cpp/bluetooth_address.h b/device/bluetooth/public/cpp/bluetooth_address.h
new file mode 100644
index 0000000..ee41edf
--- /dev/null
+++ b/device/bluetooth/public/cpp/bluetooth_address.h
@@ -0,0 +1,31 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef DEVICE_BLUETOOTH_PUBLIC_CPP_BLUETOOTH_ADDRESS_H_
+#define DEVICE_BLUETOOTH_PUBLIC_CPP_BLUETOOTH_ADDRESS_H_
+
+#include <stdint.h>
+
+#include <string>
+
+#include "base/containers/span.h"
+#include "base/strings/string_piece_forward.h"
+
+namespace device {
+
+// Parses a Bluetooth address to an output buffer. The output buffer must be
+// exactly 6 bytes in size. The address can be formatted in one of three ways:
+//
+//   1A:2B:3C:4D:5E:6F
+//   1A-2B-3C-4D-5E-6F
+//   1A2B3C4D5E6F
+bool ParseBluetoothAddress(base::StringPiece input, base::span<uint8_t> output);
+
+// Returns |address| in the canonical format: XX:XX:XX:XX:XX:XX, where each 'X'
+// is a hex digit.  If the input |address| is invalid, returns an empty string.
+std::string CanonicalizeBluetoothAddress(base::StringPiece address);
+
+}  // namespace device
+
+#endif  // DEVICE_BLUETOOTH_PUBLIC_CPP_BLUETOOTH_ADDRESS_H_
diff --git a/device/fido/BUILD.gn b/device/fido/BUILD.gn
index 7ae406a..29effcf 100644
--- a/device/fido/BUILD.gn
+++ b/device/fido/BUILD.gn
@@ -333,7 +333,7 @@
   libfuzzer_options = [ "max_len=2048" ]
 }
 
-is_linux_without_udev = is_linux && !use_udev
+is_linux_without_udev = (is_linux || is_chromeos) && !use_udev
 
 source_set("test_support") {
   testonly = true
diff --git a/device/gamepad/BUILD.gn b/device/gamepad/BUILD.gn
index 0db379f..e03b5cc 100644
--- a/device/gamepad/BUILD.gn
+++ b/device/gamepad/BUILD.gn
@@ -113,7 +113,7 @@
         [ "/wd4267" ]  # conversion from 'size_t' (64 bit) to 'type'(32 bit).
   }
 
-  if (is_linux) {
+  if (is_linux || is_chromeos) {
     if (use_udev) {
       deps += [ "//device/udev_linux" ]
     } else {
diff --git a/docs/closure_compilation.md b/docs/closure_compilation.md
index 2cfd9e8..52031907 100644
--- a/docs/closure_compilation.md
+++ b/docs/closure_compilation.md
@@ -120,7 +120,8 @@
 python, depot_tools). Note: on Ubuntu, you can probably just run `sudo apt-get
 install openjdk-7-jre`.
 
-After you set closure_compile = true in your gn args, you should be able to run:
+After you set enable_js_type_check = true in your gn args, you should be able to
+run:
 
 ```shell
 ninja -C out/Default webui_closure_compile
diff --git a/docs/enterprise/add_new_policy.md b/docs/enterprise/add_new_policy.md
index e89f231b..5cac32d 100644
--- a/docs/enterprise/add_new_policy.md
+++ b/docs/enterprise/add_new_policy.md
@@ -181,6 +181,56 @@
 confusion and is source for support requests. Use the step 3 above if the policy
 needs external testers before being officially announced.
 
+## Deprecating a policy
+
+A policy is deprecated when admins should stop using it. This is often because
+a new policy was been released that should be used instead.
+
+When marking a policy as deprecated, it still needs to work the same as before
+in Chrome. If you wish to remove the functionality, you'll need to changed the
+supported_on field. See "Removing support for a policy" below for more details.
+
+### Steps
+1. Update policy_templates.json, marking the policy as deprecated and updating
+   the description to describe when and why the policy as deprecated and what
+   admins should be doing instead.
+1. Update the policy handling code. This is generally ensuring that if the old
+   policy is set, the values are propagated to the new policies if they were
+   unset.
+1. Notify chromium-enterprise@chromium.org to ensure this deprecation is
+   mentioned in the enterprise release notes.
+
+## Removing support for a policy
+
+Generally speaking, policies shouldn't be removed from Chrome. Although they can
+be deprecated fairly easily, removing support for a policy is a much bigger
+issue, because admins might be relying on that functionality.
+
+The two main reasons for removing support for a policy are:
+1.  It was a policy that was always documented as having a limited lifespan,
+    such as an escape hatch policy.
+1.  The feature this policy impacts was removed from Chrome.
+
+If the policy was never launched, it can also be deleted from
+policy_templates.json instead of just being marked as no longer supported.
+In this case, please remember to add the deleted id to deleted_policy_ids.
+
+If you want to remove support for another reason, please reach out to someone in [ENTERPRISE_POLICY_OWNERS](https://cs.chromium.org/chromium/src/components/policy/resources/ENTERPRISE_POLICY_OWNERS)
+to ensure this is okay. The general preference is to leave policies as
+deprecated, but still supported.
+
+When removing support for a policy, update `supported_on` to correctly list the
+last milestone the policy is supported on. Please also set 'deprecated' to True
+if the policy skipped past the deprecation state.
+
+### Steps
+1. Update policy_templates.json, marking the policy as no longer supported.
+   Also marking as deprecated if not previously done.
+1. Remove the related policy_test_case.json code one milestone before support is removed.
+1. Remove the policy handling code.
+1. Notify chromium-enterprise@chromium.org to ensure this removal of support is
+   mentioned in the enterprise release notes.
+
 ## Examples
 
 Here is an example based on the instructions above. It's a good, simple place to
diff --git a/extensions/shell/BUILD.gn b/extensions/shell/BUILD.gn
index 6193c24ad..2c6094ce 100644
--- a/extensions/shell/BUILD.gn
+++ b/extensions/shell/BUILD.gn
@@ -12,7 +12,7 @@
 import("//tools/grit/grit_rule.gni")
 import("//tools/v8_context_snapshot/v8_context_snapshot.gni")
 
-if (is_linux) {
+if (is_linux || is_chromeos) {
   import("//build/linux/extract_symbols.gni")
 }
 
@@ -246,7 +246,7 @@
       "//ppapi/shared_impl:shared_impl",
     ]
 
-    if (is_linux) {
+    if (is_linux || is_chromeos) {
       deps += [ "//components/nacl/loader:nacl_helper" ]
 
       if (enable_nacl_nonsfi) {
diff --git a/gpu/BUILD.gn b/gpu/BUILD.gn
index 190c333..26e1ec8d 100644
--- a/gpu/BUILD.gn
+++ b/gpu/BUILD.gn
@@ -157,7 +157,7 @@
       libs += [ "android" ]
       deps += [ "//ui/android:ui_java" ]
     }
-    if (is_linux && !is_component_build) {
+    if ((is_linux || is_chromeos) && !is_component_build) {
       configs += [ "//build/config/gcc:rpath_for_built_shared_libraries" ]
     }
 
@@ -585,7 +585,7 @@
     ]
   }
 
-  if (is_linux || use_ozone) {
+  if (is_linux || is_chromeos || use_ozone) {
     sources += [
       "ipc/common/gpu_memory_buffer_impl_native_pixmap_unittest.cc",
       "ipc/service/gpu_memory_buffer_factory_native_pixmap_unittest.cc",
@@ -605,13 +605,13 @@
     ]
   }
 
-  if (is_linux || is_android || is_chromeos) {
+  if (is_linux || is_chromeos || is_android || is_chromeos) {
     sources += [ "command_buffer/service/gpu_fence_manager_unittest.cc" ]
   }
 
   # TODO(geofflang): Run passthrough command decoder unittests on more platforms
   # once initialization of ANGLE's NULL context is supported
-  if ((is_win || (is_linux && !use_ozone)) && !is_asan) {
+  if ((is_win || ((is_linux || is_chromeos) && !use_ozone)) && !is_asan) {
     sources += [
       "command_buffer/service/gles2_cmd_decoder_passthrough_unittest_buffers.cc",
       "command_buffer/service/gles2_cmd_decoder_passthrough_unittest_commands.cc",
@@ -769,7 +769,7 @@
   libfuzzer_options = [ "max_len=16384" ]
 }
 
-if (is_linux) {
+if (is_linux || is_chromeos) {
   fuzzer_test("gpu_angle_fuzzer") {
     sources = [ "command_buffer/tests/fuzzer_main.cc" ]
 
diff --git a/gpu/command_buffer/service/BUILD.gn b/gpu/command_buffer/service/BUILD.gn
index 0cc20756c..6920bc9 100644
--- a/gpu/command_buffer/service/BUILD.gn
+++ b/gpu/command_buffer/service/BUILD.gn
@@ -340,7 +340,7 @@
       "//gpu/vulkan",
     ]
 
-    if (is_linux || is_fuchsia || is_android || is_win) {
+    if (is_linux || is_chromeos || is_fuchsia || is_android || is_win) {
       sources += [
         "external_semaphore.cc",
         "external_semaphore.h",
@@ -368,7 +368,7 @@
       ]
     }
 
-    if (is_linux && use_dawn) {
+    if ((is_linux || is_chromeos) && use_dawn) {
       sources += [
         "external_vk_image_dawn_representation.cc",
         "external_vk_image_dawn_representation.h",
diff --git a/gpu/command_buffer/service/gr_cache_controller_unittest.cc b/gpu/command_buffer/service/gr_cache_controller_unittest.cc
index 724f94b..ac70b9c 100644
--- a/gpu/command_buffer/service/gr_cache_controller_unittest.cc
+++ b/gpu/command_buffer/service/gr_cache_controller_unittest.cc
@@ -56,7 +56,7 @@
     gl::init::ShutdownGL(false);
   }
 
-  GrContext* gr_context() { return context_state_->gr_context(); }
+  GrDirectContext* gr_context() { return context_state_->gr_context(); }
 
  protected:
   scoped_refptr<SharedContextState> context_state_;
diff --git a/gpu/command_buffer/service/raster_decoder.cc b/gpu/command_buffer/service/raster_decoder.cc
index 6c00779a..b157561 100644
--- a/gpu/command_buffer/service/raster_decoder.cc
+++ b/gpu/command_buffer/service/raster_decoder.cc
@@ -67,7 +67,7 @@
 #include "third_party/skia/include/core/SkTypeface.h"
 #include "third_party/skia/include/gpu/GrBackendSemaphore.h"
 #include "third_party/skia/include/gpu/GrBackendSurface.h"
-#include "third_party/skia/include/gpu/GrContext.h"
+#include "third_party/skia/include/gpu/GrDirectContext.h"
 #include "third_party/skia/include/gpu/GrTypes.h"
 #include "ui/gfx/buffer_format_util.h"
 #include "ui/gfx/skia_util.h"
@@ -131,7 +131,7 @@
   ScopedTextureBinder(gles2::ContextState* state,
                       GLenum target,
                       GLuint texture,
-                      GrContext* gr_context)
+                      GrDirectContext* gr_context)
       : state_(state), target_(target) {
     auto* api = state->api();
     api->glActiveTextureFn(GL_TEXTURE0);
@@ -155,7 +155,7 @@
 class ScopedPixelUnpackState {
  public:
   explicit ScopedPixelUnpackState(gles2::ContextState* state,
-                                  GrContext* gr_context,
+                                  GrDirectContext* gr_context,
                                   const gles2::FeatureInfo* feature_info) {
     DCHECK(state);
     auto* api = state->api();
@@ -181,8 +181,8 @@
 };
 
 // Commands that are explicitly listed as OK to occur between
-// BeginRasterCHROMIUM and EndRasterCHROMIUM. They do not invalidate GrContext
-// state tracking.
+// BeginRasterCHROMIUM and EndRasterCHROMIUM. They do not invalidate
+// GrDirectContext state tracking.
 bool AllowedBetweenBeginEndRaster(CommandId command) {
   switch (command) {
     case kCreateTransferCacheEntryINTERNAL:
@@ -298,8 +298,8 @@
 }  // namespace
 
 // RasterDecoderImpl uses two separate state trackers (gpu::gles2::ContextState
-// and GrContext) that cache the current GL driver state. Each class sees a
-// fraction of the GL calls issued and can easily become inconsistent with GL
+// and GrDirectContext) that cache the current GL driver state. Each class sees
+// a fraction of the GL calls issued and can easily become inconsistent with GL
 // state. We guard against that by resetting. But resetting is expensive, so we
 // avoid it as much as possible.
 class RasterDecoderImpl final : public RasterDecoder,
@@ -474,7 +474,9 @@
     return shared_context_state_->context_state();
   }
   gl::GLApi* api() const { return api_; }
-  GrContext* gr_context() const { return shared_context_state_->gr_context(); }
+  GrDirectContext* gr_context() const {
+    return shared_context_state_->gr_context();
+  }
   ServiceTransferCache* transfer_cache() {
     return shared_context_state_->transfer_cache();
   }
@@ -3156,7 +3158,7 @@
 
   // If the entry is going to use skia during deserialization, make sure we
   // mark the context state dirty.
-  GrContext* context_for_entry =
+  GrDirectContext* context_for_entry =
       cc::ServiceTransferCacheEntry::UsesGrContext(entry_type) ? gr_context()
                                                                : nullptr;
   if (context_for_entry)
diff --git a/gpu/command_buffer/service/service_transfer_cache.cc b/gpu/command_buffer/service/service_transfer_cache.cc
index 25d7e01..5e474e4 100644
--- a/gpu/command_buffer/service/service_transfer_cache.cc
+++ b/gpu/command_buffer/service/service_transfer_cache.cc
@@ -151,7 +151,7 @@
 
 bool ServiceTransferCache::CreateLockedEntry(const EntryKey& key,
                                              ServiceDiscardableHandle handle,
-                                             GrContext* context,
+                                             GrDirectContext* context,
                                              base::span<uint8_t> data) {
   auto found = entries_.Peek(key);
   if (found != entries_.end())
@@ -278,7 +278,7 @@
     int decoder_id,
     uint32_t entry_id,
     ServiceDiscardableHandle handle,
-    GrContext* context,
+    GrDirectContext* context,
     std::vector<sk_sp<SkImage>> plane_images,
     cc::YUVDecodeFormat plane_images_format,
     SkYUVColorSpace yuv_color_space,
diff --git a/gpu/command_buffer/service/service_transfer_cache.h b/gpu/command_buffer/service/service_transfer_cache.h
index c51b336..e63656bc 100644
--- a/gpu/command_buffer/service/service_transfer_cache.h
+++ b/gpu/command_buffer/service/service_transfer_cache.h
@@ -22,7 +22,7 @@
 #include "third_party/skia/include/core/SkImageInfo.h"
 #include "third_party/skia/include/core/SkRefCnt.h"
 
-class GrContext;
+class GrDirectContext;
 class SkImage;
 
 namespace gpu {
@@ -53,7 +53,7 @@
 
   bool CreateLockedEntry(const EntryKey& key,
                          ServiceDiscardableHandle handle,
-                         GrContext* context,
+                         GrDirectContext* context,
                          base::span<uint8_t> data);
   void CreateLocalEntry(const EntryKey& key,
                         std::unique_ptr<cc::ServiceTransferCacheEntry> entry);
@@ -72,7 +72,7 @@
       int decoder_id,
       uint32_t entry_id,
       ServiceDiscardableHandle handle,
-      GrContext* context,
+      GrDirectContext* context,
       std::vector<sk_sp<SkImage>> plane_images,
       cc::YUVDecodeFormat plane_images_format,
       SkYUVColorSpace yuv_color_space,
diff --git a/gpu/command_buffer/service/shared_context_state.h b/gpu/command_buffer/service/shared_context_state.h
index 34c75c9..21d8e16 100644
--- a/gpu/command_buffer/service/shared_context_state.h
+++ b/gpu/command_buffer/service/shared_context_state.h
@@ -129,7 +129,7 @@
     return dawn_context_provider_;
   }
   gl::ProgressReporter* progress_reporter() const { return progress_reporter_; }
-  GrContext* gr_context() { return gr_context_; }
+  GrDirectContext* gr_context() { return gr_context_; }
   GrContextType gr_context_type() const { return gr_context_type_; }
   // Handles Skia-reported shader compilation errors.
   void compileError(const char* shader, const char* errors) override;
@@ -267,7 +267,7 @@
   viz::VulkanContextProvider* const vk_context_provider_;
   viz::MetalContextProvider* const metal_context_provider_;
   viz::DawnContextProvider* const dawn_context_provider_;
-  GrContext* gr_context_ = nullptr;
+  GrDirectContext* gr_context_ = nullptr;
 
   scoped_refptr<gl::GLShareGroup> share_group_;
   scoped_refptr<gl::GLContext> context_;
diff --git a/gpu/config/BUILD.gn b/gpu/config/BUILD.gn
index 7e0c2355..2a0ff86 100644
--- a/gpu/config/BUILD.gn
+++ b/gpu/config/BUILD.gn
@@ -216,7 +216,7 @@
   if (is_mac) {
     frameworks = [ "OpenGL.framework" ]
   }
-  if (is_linux || is_mac) {
+  if (is_linux || is_chromeos || is_mac) {
     deps += [ "//third_party/angle:angle_gpu_info_util" ]
   }
   if (use_x11) {
diff --git a/gpu/gles2_conform_support/BUILD.gn b/gpu/gles2_conform_support/BUILD.gn
index c3bd1393..74da3e1 100644
--- a/gpu/gles2_conform_support/BUILD.gn
+++ b/gpu/gles2_conform_support/BUILD.gn
@@ -59,7 +59,7 @@
     "//gpu/gles2_conform_support/egl",
     "//ui/gl",
   ]
-  if (is_linux) {
+  if (is_linux || is_chromeos) {
     sources += [
       "native/egl_native_aura.cc",
       "native/egl_native_x11.cc",
diff --git a/gpu/gles2_conform_support/native/BUILD.gn b/gpu/gles2_conform_support/native/BUILD.gn
index 78ae38df..64ba6b6e 100644
--- a/gpu/gles2_conform_support/native/BUILD.gn
+++ b/gpu/gles2_conform_support/native/BUILD.gn
@@ -20,7 +20,7 @@
     "//gpu/gles2_conform_support/egl",
     "//ui/gl",
   ]
-  if (is_linux) {
+  if (is_linux || is_chromeos) {
     sources += [
       "egl_native_aura.cc",
       "egl_native_x11.cc",
diff --git a/gpu/ipc/client/shared_image_interface_proxy.cc b/gpu/ipc/client/shared_image_interface_proxy.cc
index 3e7052b..0e8db63 100644
--- a/gpu/ipc/client/shared_image_interface_proxy.cc
+++ b/gpu/ipc/client/shared_image_interface_proxy.cc
@@ -48,6 +48,26 @@
   return region.mapping.GetMemoryAs<uint8_t>() + offset;
 }
 
+std::vector<SyncToken> GenerateDependenciesFromSyncToken(
+    SyncToken sync_token,
+    GpuChannelHost* const host) {
+  DCHECK(host);
+  std::vector<SyncToken> dependencies;
+  if (sync_token.HasData()) {
+    dependencies.push_back(sync_token);
+    SyncToken& new_token = dependencies.back();
+    if (!new_token.verified_flush()) {
+      // Only allow unverified sync tokens for the same channel.
+      DCHECK_EQ(sync_token.namespace_id(), gpu::CommandBufferNamespace::GPU_IO);
+      int sync_token_channel_id =
+          ChannelIdFromCommandBufferId(sync_token.command_buffer_id());
+      DCHECK_EQ(sync_token_channel_id, host->channel_id());
+      new_token.SetVerifyFlush();
+    }
+  }
+  return dependencies;
+}
+
 }  // namespace
 
 SharedImageInterfaceProxy::SharedImageInterfaceProxy(GpuChannelHost* host,
@@ -193,21 +213,11 @@
     const SyncToken& sync_token,
     std::unique_ptr<gfx::GpuFence> acquire_fence,
     const Mailbox& mailbox) {
-  std::vector<SyncToken> dependencies;
-  if (sync_token.HasData()) {
+  // If there is a valid SyncToken, there should not be any GpuFence.
+  if (sync_token.HasData())
     DCHECK(!acquire_fence);
-
-    dependencies.push_back(sync_token);
-    SyncToken& new_token = dependencies.back();
-    if (!new_token.verified_flush()) {
-      // Only allow unverified sync tokens for the same channel.
-      DCHECK_EQ(sync_token.namespace_id(), gpu::CommandBufferNamespace::GPU_IO);
-      int sync_token_channel_id =
-          ChannelIdFromCommandBufferId(sync_token.command_buffer_id());
-      DCHECK_EQ(sync_token_channel_id, host_->channel_id());
-      new_token.SetVerifyFlush();
-    }
-  }
+  std::vector<SyncToken> dependencies =
+      GenerateDependenciesFromSyncToken(std::move(sync_token), host_);
   {
     base::AutoLock lock(lock_);
     gfx::GpuFenceHandle acquire_fence_handle;
@@ -231,19 +241,8 @@
 
 void SharedImageInterfaceProxy::DestroySharedImage(const SyncToken& sync_token,
                                                    const Mailbox& mailbox) {
-  std::vector<SyncToken> dependencies;
-  if (sync_token.HasData()) {
-    dependencies.push_back(sync_token);
-    SyncToken& new_token = dependencies.back();
-    if (!new_token.verified_flush()) {
-      // Only allow unverified sync tokens for the same channel.
-      DCHECK_EQ(sync_token.namespace_id(), gpu::CommandBufferNamespace::GPU_IO);
-      int sync_token_channel_id =
-          ChannelIdFromCommandBufferId(sync_token.command_buffer_id());
-      DCHECK_EQ(sync_token_channel_id, host_->channel_id());
-      new_token.SetVerifyFlush();
-    }
-  }
+  std::vector<SyncToken> dependencies =
+      GenerateDependenciesFromSyncToken(std::move(sync_token), host_);
   {
     base::AutoLock lock(lock_);
 
@@ -276,17 +275,8 @@
   if (!sync_token.HasData())
     return;
 
-  std::vector<SyncToken> dependencies;
-  dependencies.push_back(sync_token);
-  SyncToken& new_token = dependencies.back();
-  if (!new_token.verified_flush()) {
-    // Only allow unverified sync tokens for the same channel.
-    DCHECK_EQ(sync_token.namespace_id(), gpu::CommandBufferNamespace::GPU_IO);
-    int sync_token_channel_id =
-        ChannelIdFromCommandBufferId(sync_token.command_buffer_id());
-    DCHECK_EQ(sync_token_channel_id, host_->channel_id());
-    new_token.SetVerifyFlush();
-  }
+  std::vector<SyncToken> dependencies =
+      GenerateDependenciesFromSyncToken(std::move(sync_token), host_);
   {
     base::AutoLock lock(lock_);
     last_flush_id_ = host_->EnqueueDeferredMessage(GpuChannelMsg_Nop(),
@@ -399,19 +389,8 @@
 void SharedImageInterfaceProxy::PresentSwapChain(const SyncToken& sync_token,
                                                  const Mailbox& mailbox) {
 #if defined(OS_WIN)
-  std::vector<SyncToken> dependencies;
-  if (sync_token.HasData()) {
-    dependencies.push_back(sync_token);
-    SyncToken& new_token = dependencies.back();
-    if (!new_token.verified_flush()) {
-      // Only allow unverified sync tokens for the same channel.
-      DCHECK_EQ(sync_token.namespace_id(), gpu::CommandBufferNamespace::GPU_IO);
-      int sync_token_channel_id =
-          ChannelIdFromCommandBufferId(sync_token.command_buffer_id());
-      DCHECK_EQ(sync_token_channel_id, host_->channel_id());
-      new_token.SetVerifyFlush();
-    }
-  }
+  std::vector<SyncToken> dependencies =
+      GenerateDependenciesFromSyncToken(std::move(sync_token), host_);
   {
     base::AutoLock lock(lock_);
     uint32_t release_id = ++next_release_id_;
diff --git a/gpu/ipc/common/BUILD.gn b/gpu/ipc/common/BUILD.gn
index f81d1413..1d80a64 100644
--- a/gpu/ipc/common/BUILD.gn
+++ b/gpu/ipc/common/BUILD.gn
@@ -98,7 +98,7 @@
       "gpu_memory_buffer_impl_dxgi.h",
     ]
   }
-  if (is_linux || use_ozone) {
+  if (is_linux || is_chromeos || use_ozone) {
     sources += [
       "gpu_memory_buffer_impl_native_pixmap.cc",
       "gpu_memory_buffer_impl_native_pixmap.h",
diff --git a/gpu/ipc/service/BUILD.gn b/gpu/ipc/service/BUILD.gn
index c2b5cda..8d25f31 100644
--- a/gpu/ipc/service/BUILD.gn
+++ b/gpu/ipc/service/BUILD.gn
@@ -124,10 +124,10 @@
     ]
     libs += [ "android" ]
   }
-  if (is_linux) {
+  if (is_linux || is_chromeos) {
     sources += [ "image_transport_surface_linux.cc" ]
   }
-  if (is_linux || use_ozone) {
+  if (is_linux || is_chromeos || use_ozone) {
     sources += [
       "gpu_memory_buffer_factory_native_pixmap.cc",
       "gpu_memory_buffer_factory_native_pixmap.h",
diff --git a/gpu/khronos_glcts_support/BUILD.gn b/gpu/khronos_glcts_support/BUILD.gn
index 067641d0..f9a997a 100644
--- a/gpu/khronos_glcts_support/BUILD.gn
+++ b/gpu/khronos_glcts_support/BUILD.gn
@@ -44,7 +44,7 @@
       "GTF_API=GTF_GLES20",
     ]
 
-    if (is_linux) {
+    if (is_linux || is_chromeos) {
       defines += [ "_XOPEN_SOURCE=500" ]
     }
   }
@@ -79,7 +79,7 @@
 
     public_configs = [ ":debase_config" ]
 
-    if (is_linux) {
+    if (is_linux || is_chromeos) {
       cflags_c = [ "-Wno-implicit-function-declaration" ]
     }
   }
@@ -147,7 +147,7 @@
 
     public_configs = [ ":dethread_config" ]
 
-    if (is_linux) {
+    if (is_linux || is_chromeos) {
       sources += [
         "//third_party/khronos_glcts/framework/delibs/dethread/unix/deMutexUnix.c",
         "//third_party/khronos_glcts/framework/delibs/dethread/unix/deSemaphoreUnix.c",
@@ -194,7 +194,7 @@
 
     public_configs = [ ":deutil_config" ]
 
-    if (is_linux) {
+    if (is_linux || is_chromeos) {
       cflags_c = [ "-Wno-string-conversion" ]
     }
   }
@@ -306,7 +306,7 @@
 
     public_configs = [ ":qphelper_config" ]
 
-    if (is_linux) {
+    if (is_linux || is_chromeos) {
       cflags_c = [ "-Wno-string-conversion" ]
     }
   }
@@ -394,7 +394,7 @@
 
     public_configs = [ ":tcutil_config" ]
 
-    if (is_linux) {
+    if (is_linux || is_chromeos) {
       cflags_cc = [ "-Wno-int-to-pointer-cast" ]
     }
   }
@@ -532,7 +532,7 @@
       "//third_party/khronos:khronos_headers",
     ]
 
-    if (is_linux) {
+    if (is_linux || is_chromeos) {
       cflags_cc = [ "-Wno-int-to-void-pointer-cast" ]
     }
   }
@@ -611,7 +611,7 @@
 
     public_configs = [ ":glcts_common_config" ]
 
-    if (is_linux) {
+    if (is_linux || is_chromeos) {
       cflags_cc = [ "-Wno-string-conversion" ]
     }
   }
@@ -819,7 +819,7 @@
 
     public_configs = [ ":gtf_es_config" ]
 
-    if (is_linux) {
+    if (is_linux || is_chromeos) {
       cflags_c = [
         "-Wno-pointer-sign",
         "-Wno-incompatible-pointer-types",
diff --git a/gpu/tools/compositor_model_bench/BUILD.gn b/gpu/tools/compositor_model_bench/BUILD.gn
index ca103ac..11f5dc66 100644
--- a/gpu/tools/compositor_model_bench/BUILD.gn
+++ b/gpu/tools/compositor_model_bench/BUILD.gn
@@ -4,7 +4,7 @@
 
 import("//build/config/ui.gni")
 
-if (is_linux && use_x11 && current_cpu != "arm") {
+if ((is_linux || is_chromeos) && use_x11 && current_cpu != "arm") {
   executable("compositor_model_bench") {
     sources = [
       "compositor_model_bench.cc",
diff --git a/gpu/vulkan/BUILD.gn b/gpu/vulkan/BUILD.gn
index e9ffe4e..c6892dd 100644
--- a/gpu/vulkan/BUILD.gn
+++ b/gpu/vulkan/BUILD.gn
@@ -171,26 +171,21 @@
       "//ui/gfx:native_widget_types",
     ]
 
-    if (use_x11 && !use_ozone) {
+    if (use_x11 || use_ozone) {
       sources += [ "tests/native_window.cc" ]
-      deps += [
-        "//ui/platform_window",
-        "//ui/platform_window/x11",
-      ]
+      deps += [ "//ui/platform_window" ]
+      if (use_x11) {
+        deps += [ "//ui/platform_window/x11" ]
+      }
+      if (use_ozone) {
+        deps += [ "//ui/ozone" ]
+      }
     }
 
     if (is_win) {
       sources += [ "tests/native_window_win.cc" ]
     }
 
-    if (use_ozone) {
-      sources += [ "tests/native_window.cc" ]
-      deps += [
-        "//ui/ozone",
-        "//ui/platform_window",
-      ]
-    }
-
     if (is_android) {
       sources += [ "tests/native_window_android.cc" ]
       deps += [
diff --git a/gpu/vulkan/features.gni b/gpu/vulkan/features.gni
index 045a5484..7a98011 100644
--- a/gpu/vulkan/features.gni
+++ b/gpu/vulkan/features.gni
@@ -8,7 +8,7 @@
 # For details see declare_args() in build/config/BUILDCONFIG.gn.
 declare_args() {
   # Enable experimental vulkan backend.
-  enable_vulkan = is_linux || is_android || is_fuchsia || is_win
+  enable_vulkan = is_linux || is_chromeos || is_android || is_fuchsia || is_win
 
   # Enable swiftshader vulkan. Disabling it can save build time, however
   # --use-vulkan=swiftshader and some tests which use swiftshader vulkan will
diff --git a/ios/chrome/browser/browser_state/test_chrome_browser_state.h b/ios/chrome/browser/browser_state/test_chrome_browser_state.h
index c3789c8..08f6dec 100644
--- a/ios/chrome/browser/browser_state/test_chrome_browser_state.h
+++ b/ios/chrome/browser/browser_state/test_chrome_browser_state.h
@@ -74,11 +74,8 @@
   void CreateBookmarkModel(bool delete_file);
 
   // !!!!!!!! WARNING: THIS IS GENERALLY NOT SAFE TO CALL! !!!!!!!!
-  // Creates the history service. If |delete_file| is true, the history file is
-  // deleted first, then the HistoryService is created. As
-  // TestChromeBrowserState deletes the directory containing the files used by
-  // HistoryService, this only matters if you're recreating the HistoryService.
-  bool CreateHistoryService(bool delete_file) WARN_UNUSED_RESULT;
+  // Creates the history service.
+  bool CreateHistoryService() WARN_UNUSED_RESULT;
 
   // Returns the preferences as a TestingPrefServiceSyncable if possible or
   // null. Returns null for off-the-record TestChromeBrowserState and also
diff --git a/ios/chrome/browser/browser_state/test_chrome_browser_state.mm b/ios/chrome/browser/browser_state/test_chrome_browser_state.mm
index ea6287f..bf753f2 100644
--- a/ios/chrome/browser/browser_state/test_chrome_browser_state.mm
+++ b/ios/chrome/browser/browser_state/test_chrome_browser_state.mm
@@ -19,7 +19,6 @@
 #include "base/threading/thread_task_runner_handle.h"
 #include "components/bookmarks/browser/bookmark_model.h"
 #include "components/bookmarks/common/bookmark_constants.h"
-#include "components/history/core/browser/history_constants.h"
 #include "components/history/core/browser/history_database_params.h"
 #include "components/history/core/browser/history_service.h"
 #include "components/history/core/browser/top_sites.h"
@@ -321,19 +320,11 @@
           this, base::BindRepeating(&BuildBookmarkModel)));
 }
 
-bool TestChromeBrowserState::CreateHistoryService(bool delete_file) {
+bool TestChromeBrowserState::CreateHistoryService() {
   // Should never be created multiple times.
   DCHECK(!ios::HistoryServiceFactory::GetForBrowserStateIfExists(
       this, ServiceAccessType::EXPLICIT_ACCESS));
 
-  if (delete_file) {
-    base::FilePath path =
-        GetOriginalChromeBrowserState()->GetStatePath().Append(
-            history::kHistoryFilename);
-    if (!base::DeleteFile(path) && base::PathExists(path))
-      return false;
-  }
-
   // Create and initialize the HistoryService, but destroy it if the init fails.
   history::HistoryService* history_service =
       static_cast<history::HistoryService*>(
diff --git a/ios/chrome/browser/history/history_tab_helper_unittest.mm b/ios/chrome/browser/history/history_tab_helper_unittest.mm
index 7fdd1d85..f13f165 100644
--- a/ios/chrome/browser/history/history_tab_helper_unittest.mm
+++ b/ios/chrome/browser/history/history_tab_helper_unittest.mm
@@ -36,7 +36,7 @@
     test_cbs_builder.SetPath(state_dir_.GetPath());
 
     chrome_browser_state_ = test_cbs_builder.Build();
-    ASSERT_TRUE(chrome_browser_state_->CreateHistoryService(true));
+    ASSERT_TRUE(chrome_browser_state_->CreateHistoryService());
 
     web_state_.SetBrowserState(chrome_browser_state_.get());
     HistoryTabHelper::CreateForWebState(&web_state_);
diff --git a/ios/chrome/browser/test/perf_test_with_bvc_ios.mm b/ios/chrome/browser/test/perf_test_with_bvc_ios.mm
index 669e41a..5cac8d6 100644
--- a/ios/chrome/browser/test/perf_test_with_bvc_ios.mm
+++ b/ios/chrome/browser/test/perf_test_with_bvc_ios.mm
@@ -89,7 +89,7 @@
   bookmarks::test::WaitForBookmarkModelToLoad(
       ios::BookmarkModelFactory::GetForBrowserState(
           chrome_browser_state_.get()));
-  ASSERT_TRUE(chrome_browser_state_->CreateHistoryService(false));
+  ASSERT_TRUE(chrome_browser_state_->CreateHistoryService());
 
   // Force creation of AutocompleteClassifier instance.
   ios::AutocompleteClassifierFactory::GetForBrowserState(
diff --git a/ios/chrome/browser/ui/browser_view/browser_view_controller_unittest.mm b/ios/chrome/browser/ui/browser_view/browser_view_controller_unittest.mm
index 0019de5..ee0a344 100644
--- a/ios/chrome/browser/ui/browser_view/browser_view_controller_unittest.mm
+++ b/ios/chrome/browser/ui/browser_view/browser_view_controller_unittest.mm
@@ -89,7 +89,7 @@
         ios::FaviconServiceFactory::GetDefaultFactory());
 
     chrome_browser_state_ = test_cbs_builder.Build();
-    ASSERT_TRUE(chrome_browser_state_->CreateHistoryService(true));
+    ASSERT_TRUE(chrome_browser_state_->CreateHistoryService());
 
     id passKitController =
         [OCMockObject niceMockForClass:[PKAddPassesViewController class]];
diff --git a/ios/chrome/browser/ui/location_bar/location_bar_coordinator_unittest.mm b/ios/chrome/browser/ui/location_bar/location_bar_coordinator_unittest.mm
index ef31fb1..7a8823cde 100644
--- a/ios/chrome/browser/ui/location_bar/location_bar_coordinator_unittest.mm
+++ b/ios/chrome/browser/ui/location_bar/location_bar_coordinator_unittest.mm
@@ -91,7 +91,7 @@
         ios::FaviconServiceFactory::GetDefaultFactory());
 
     browser_state_ = test_cbs_builder.Build();
-    ASSERT_TRUE(browser_state_->CreateHistoryService(true));
+    ASSERT_TRUE(browser_state_->CreateHistoryService());
 
     browser_ =
         std::make_unique<TestBrowser>(browser_state_.get(), &web_state_list_);
diff --git a/ios/chrome/browser/ui/overlays/infobar_banner/infobar_banner_overlay_coordinator.mm b/ios/chrome/browser/ui/overlays/infobar_banner/infobar_banner_overlay_coordinator.mm
index 90cb92cb..eef9ba3 100644
--- a/ios/chrome/browser/ui/overlays/infobar_banner/infobar_banner_overlay_coordinator.mm
+++ b/ios/chrome/browser/ui/overlays/infobar_banner/infobar_banner_overlay_coordinator.mm
@@ -106,16 +106,26 @@
                                         [self finishPresentation];
                                       }];
   self.started = YES;
+
+  if (!UIAccessibilityIsVoiceOverRunning()) {
+    // Auto-dismiss the banner after timeout if VoiceOver is off (banner should
+    // persist until user explicitly swipes it away).
+    [self performSelector:@selector(dismissBannerIfReady)
+               withObject:nil
+               afterDelay:kInfobarBannerDefaultPresentationDurationInSeconds];
+  }
 }
 
 - (void)stopAnimated:(BOOL)animated {
   if (!self.started)
     return;
+  // Mark started as NO before calling dismissal callback to prevent dup
+  // stopAnimated: executions.
+  self.started = NO;
   [self.baseViewController dismissViewControllerAnimated:animated
                                               completion:^{
                                                 [self finishDismissal];
                                               }];
-  self.started = NO;
 }
 
 - (UIViewController*)viewController {
@@ -155,4 +165,10 @@
   return mediator;
 }
 
+// Indicate to the UI to dismiss itself if it is ready (e.g. the user is not
+// currently interaction with it).
+- (void)dismissBannerIfReady {
+  [self.bannerViewController dismissWhenInteractionIsFinished];
+}
+
 @end
diff --git a/ios/chrome/browser/ui/overlays/infobar_banner/translate/translate_infobar_placeholder_overlay_coordinator.mm b/ios/chrome/browser/ui/overlays/infobar_banner/translate/translate_infobar_placeholder_overlay_coordinator.mm
index f1766c42..2269fc8 100644
--- a/ios/chrome/browser/ui/overlays/infobar_banner/translate/translate_infobar_placeholder_overlay_coordinator.mm
+++ b/ios/chrome/browser/ui/overlays/infobar_banner/translate/translate_infobar_placeholder_overlay_coordinator.mm
@@ -39,11 +39,14 @@
 - (void)stopAnimated:(BOOL)animated {
   if (!self.started)
     return;
+
+  // Mark started as NO before calling dismissal callback to prevent dup
+  // stopAnimated: executions.
+  self.started = NO;
   // Notify the presentation context that the dismissal has finished.  This
   // is necessary to synchronize OverlayPresenter scheduling logic with the UI
   // layer.
   self.delegate->OverlayUIDidFinishDismissal(self.request);
-  self.started = NO;
 }
 
 @end
diff --git a/ios/chrome/browser/ui/overlays/infobar_modal/infobar_modal_overlay_coordinator.mm b/ios/chrome/browser/ui/overlays/infobar_modal/infobar_modal_overlay_coordinator.mm
index 9b6ffc4b..d8af6ba 100644
--- a/ios/chrome/browser/ui/overlays/infobar_modal/infobar_modal_overlay_coordinator.mm
+++ b/ios/chrome/browser/ui/overlays/infobar_modal/infobar_modal_overlay_coordinator.mm
@@ -52,11 +52,13 @@
 - (void)stopAnimated:(BOOL)animated {
   if (!self.started)
     return;
+  // Mark started as NO before calling dismissal callback to prevent dup
+  // stopAnimated: executions.
+  self.started = NO;
   [self.baseViewController dismissViewControllerAnimated:animated
                                               completion:^{
                                                 [self finishDismissal];
                                               }];
-  self.started = NO;
 }
 
 - (UIViewController*)viewController {
diff --git a/ios/chrome/browser/ui/overlays/infobar_modal/infobar_modal_overlay_coordinator_unittest.mm b/ios/chrome/browser/ui/overlays/infobar_modal/infobar_modal_overlay_coordinator_unittest.mm
index 08ff82c..facc0f1 100644
--- a/ios/chrome/browser/ui/overlays/infobar_modal/infobar_modal_overlay_coordinator_unittest.mm
+++ b/ios/chrome/browser/ui/overlays/infobar_modal/infobar_modal_overlay_coordinator_unittest.mm
@@ -152,3 +152,33 @@
     return !root_view_controller_.presentedViewController;
   }));
 }
+
+// Tests the modal dismiss flow for a FakeInfobarModalOverlayCoordinator.
+TEST_F(InfobarModalOverlayCoordinatorTest, ModalDismiss) {
+  // Start the coordinator, expecting OverlayUIDidFinishPresentation() to be
+  // executed.
+  EXPECT_CALL(delegate_, OverlayUIDidFinishPresentation(request_.get()));
+  [coordinator_ startAnimated:NO];
+
+  // Wait for presentation to finish.
+  EXPECT_TRUE(WaitUntilConditionOrTimeout(kWaitForUIElementTimeout, ^BOOL {
+    UIViewController* presented_view_controller =
+        root_view_controller_.presentedViewController;
+    return presented_view_controller &&
+           !presented_view_controller.beingPresented;
+  }));
+
+  // Stop the coordinator, expecting OverlayUIDidFinishDismissal() to be
+  // executed once.
+  EXPECT_CALL(delegate_, OverlayUIDidFinishDismissal(request_.get())).Times(1);
+  [coordinator_ stopAnimated:NO];
+
+  // Stop coordinator again. It should be a no-op since stop has been called
+  // already (i.e. No OverlayUIDidFinishDismissal called).
+  [coordinator_ stopAnimated:NO];
+
+  // Wait for dismissal to finish.
+  EXPECT_TRUE(WaitUntilConditionOrTimeout(kWaitForUIElementTimeout, ^BOOL {
+    return !root_view_controller_.presentedViewController;
+  }));
+}
diff --git a/ios/chrome/browser/ui/settings/password/passwords_table_view_controller.mm b/ios/chrome/browser/ui/settings/password/passwords_table_view_controller.mm
index fad7a89d..782af3d 100644
--- a/ios/chrome/browser/ui/settings/password/passwords_table_view_controller.mm
+++ b/ios/chrome/browser/ui/settings/password/passwords_table_view_controller.mm
@@ -446,16 +446,17 @@
       _passwordProblemsItem = [self passwordProblemsItem];
     }
 
+    [self updatePasswordCheckStatusLabelWithState:_passwordCheckState];
     [model addItem:_passwordProblemsItem
         toSectionWithIdentifier:SectionIdentifierPasswordCheck];
+
     if (!_checkForProblemsItem) {
       _checkForProblemsItem = [self checkForProblemsItem];
     }
 
+    [self updatePasswordCheckButtonWithState:_passwordCheckState];
     [model addItem:_checkForProblemsItem
         toSectionWithIdentifier:SectionIdentifierPasswordCheck];
-    [self updatePasswordCheckButtonWithState:_passwordCheckState];
-    [self updatePasswordCheckStatusLabelWithState:_passwordCheckState];
   }
 
   // Saved passwords.
@@ -708,8 +709,14 @@
 
 - (void)setPasswordCheckUIState:(PasswordCheckUIState)state {
   _passwordCheckState = state;
-  [self updatePasswordCheckButtonWithState:state];
-  [self updatePasswordCheckStatusLabelWithState:state];
+  if (_checkForProblemsItem) {
+    [self updatePasswordCheckButtonWithState:state];
+    [self reconfigureCellsForItems:@[ _checkForProblemsItem ]];
+  }
+  if (_passwordProblemsItem) {
+    [self updatePasswordCheckStatusLabelWithState:state];
+    [self reconfigureCellsForItems:@[ _passwordProblemsItem ]];
+  }
 }
 
 - (void)setPasswordsForms:
@@ -1020,7 +1027,6 @@
           UIAccessibilityTraitNotEnabled;
       break;
   }
-  [self reconfigureCellsForItems:@[ _checkForProblemsItem ]];
 }
 
 // Updates password check status label according to provided state.
@@ -1081,7 +1087,6 @@
       break;
     }
   }
-  [self reconfigureCellsForItems:@[ _passwordProblemsItem ]];
 }
 
 - (void)updateExportPasswordsButton {
diff --git a/ios/chrome/browser/ui/settings/password/passwords_table_view_controller_unittest.mm b/ios/chrome/browser/ui/settings/password/passwords_table_view_controller_unittest.mm
index f84dcb12..c844b291 100644
--- a/ios/chrome/browser/ui/settings/password/passwords_table_view_controller_unittest.mm
+++ b/ios/chrome/browser/ui/settings/password/passwords_table_view_controller_unittest.mm
@@ -761,6 +761,12 @@
   EXPECT_EQ(1, NumberOfItemsInSection(GetSectionIndex(SavedPasswords)));
   AddSavedForm2();
   EXPECT_EQ(2, NumberOfItemsInSection(GetSectionIndex(SavedPasswords)));
+
+  auto password =
+      GetTestStore().stored_passwords().at("http://www.example.com/").at(0);
+  GetTestStore().RemoveLogin(password);
+  RunUntilIdle();
+  EXPECT_EQ(1, NumberOfItemsInSection(GetSectionIndex(SavedPasswords)));
 }
 
 // Test verifies Passwords View Controller handles deletion of passwords.
diff --git a/ios/chrome/browser/ui/settings/search_engine_table_view_controller_unittest.mm b/ios/chrome/browser/ui/settings/search_engine_table_view_controller_unittest.mm
index 75dca1c..5624c168 100644
--- a/ios/chrome/browser/ui/settings/search_engine_table_view_controller_unittest.mm
+++ b/ios/chrome/browser/ui/settings/search_engine_table_view_controller_unittest.mm
@@ -64,7 +64,7 @@
         IOSChromeFaviconLoaderFactory::GetInstance(),
         IOSChromeFaviconLoaderFactory::GetDefaultFactory());
     chrome_browser_state_ = test_cbs_builder.Build();
-    ASSERT_TRUE(chrome_browser_state_->CreateHistoryService(true));
+    ASSERT_TRUE(chrome_browser_state_->CreateHistoryService());
     DefaultSearchManager::SetFallbackSearchEnginesDisabledForTesting(true);
     template_url_service_ = ios::TemplateURLServiceFactory::GetForBrowserState(
         chrome_browser_state_.get());
diff --git a/media/audio/BUILD.gn b/media/audio/BUILD.gn
index bf4b736..0e8a590 100644
--- a/media/audio/BUILD.gn
+++ b/media/audio/BUILD.gn
@@ -232,7 +232,7 @@
     ]
   }
 
-  if (is_linux) {
+  if (is_linux || is_chromeos) {
     sources += [ "linux/audio_manager_linux.cc" ]
   }
 
diff --git a/media/base/BUILD.gn b/media/base/BUILD.gn
index 5dc0415..a2888e42 100644
--- a/media/base/BUILD.gn
+++ b/media/base/BUILD.gn
@@ -400,7 +400,7 @@
     defines += [ "DISABLE_USER_INPUT_MONITOR" ]
   }
 
-  if (is_linux || is_win) {
+  if (is_linux || is_chromeos || is_win) {
     sources += [
       "keyboard_event_counter.cc",
       "keyboard_event_counter.h",
@@ -408,7 +408,7 @@
   }
 
   # Note: should also work on is_posix || is_fuchsia
-  if (is_linux) {
+  if (is_linux || is_chromeos) {
     sources += [
       "scopedfd_helper.cc",
       "scopedfd_helper.h",
@@ -613,7 +613,7 @@
     deps += [ "//media/base/mac:unit_tests" ]
   }
 
-  if (is_linux || is_win) {
+  if (is_linux || is_chromeos || is_win) {
     sources += [ "keyboard_event_counter_unittest.cc" ]
   }
   if (is_win) {
diff --git a/media/capture/BUILD.gn b/media/capture/BUILD.gn
index 1e4d5aa..340f1d4 100644
--- a/media/capture/BUILD.gn
+++ b/media/capture/BUILD.gn
@@ -227,7 +227,9 @@
   }
 
   # This includes the case of ChromeOS
-  if (is_linux) {
+  # TODO: As we move to separately version Chrome from ChromeOS, we may need to split
+  # these sources into linux, chromeos, and common.
+  if (is_linux || is_chromeos) {
     sources += [
       "video/linux/camera_config_chromeos.cc",
       "video/linux/camera_config_chromeos.h",
diff --git a/media/capture/video/linux/v4l2_capture_delegate.cc b/media/capture/video/linux/v4l2_capture_delegate.cc
index 221f3a59..242aef3 100644
--- a/media/capture/video/linux/v4l2_capture_delegate.cc
+++ b/media/capture/video/linux/v4l2_capture_delegate.cc
@@ -141,7 +141,7 @@
 #if !defined(V4L2_CID_PANTILT_CMD)
 #define V4L2_CID_PANTILT_CMD (V4L2_CID_CAMERA_CLASS_BASE + 34)
 #endif
-bool IsBlacklistedControl(int control_id) {
+bool IsBlockedControl(int control_id) {
   switch (control_id) {
     case V4L2_CID_PAN_RELATIVE:
     case V4L2_CID_TILT_RELATIVE:
@@ -730,7 +730,7 @@
 
       if (IsSpecialControl(range.id & ~V4L2_CTRL_FLAG_NEXT_CTRL))
         continue;
-      if (IsBlacklistedControl(range.id & ~V4L2_CTRL_FLAG_NEXT_CTRL))
+      if (IsBlockedControl(range.id & ~V4L2_CTRL_FLAG_NEXT_CTRL))
         continue;
 
       struct v4l2_ext_control ext_control = {};
diff --git a/media/capture/video/linux/v4l2_capture_delegate_unittest.cc b/media/capture/video/linux/v4l2_capture_delegate_unittest.cc
index 1219169..6d40429 100644
--- a/media/capture/video/linux/v4l2_capture_delegate_unittest.cc
+++ b/media/capture/video/linux/v4l2_capture_delegate_unittest.cc
@@ -36,7 +36,7 @@
                        {V4L2_CID_CAMERA_CLASS_BASE, V4L2_CID_CAMERA_CLASS}};
 
 // Determines if |control_id| is special, i.e. controls another one's state, or
-// if it should be skipped (blacklisted, https://crbug.com/697885).
+// if it should be denied (see https://crbug.com/697885).
 #if !defined(V4L2_CID_PAN_SPEED)
 #define V4L2_CID_PAN_SPEED (V4L2_CID_CAMERA_CLASS_BASE + 32)
 #endif
@@ -46,7 +46,7 @@
 #if !defined(V4L2_CID_PANTILT_CMD)
 #define V4L2_CID_PANTILT_CMD (V4L2_CID_CAMERA_CLASS_BASE + 34)
 #endif
-static bool IsSpecialOrBlacklistedControl(int control_id) {
+static bool IsSpecialOrBlockedControl(int control_id) {
   switch (control_id) {
     case V4L2_CID_AUTO_WHITE_BALANCE:
     case V4L2_CID_EXPOSURE_AUTO:
@@ -111,7 +111,7 @@
         break;
       range.id |= V4L2_CTRL_FLAG_NEXT_CTRL;
 
-      if (IsSpecialOrBlacklistedControl(range.id & ~V4L2_CTRL_FLAG_NEXT_CTRL))
+      if (IsSpecialOrBlockedControl(range.id & ~V4L2_CTRL_FLAG_NEXT_CTRL))
         continue;
       DVLOG(1) << __func__ << " " << range.name << " set to " << range.maximum;
 
@@ -136,7 +136,7 @@
         break;
       range.id |= V4L2_CTRL_FLAG_NEXT_CTRL;
 
-      if (IsSpecialOrBlacklistedControl(range.id & ~V4L2_CTRL_FLAG_NEXT_CTRL))
+      if (IsSpecialOrBlockedControl(range.id & ~V4L2_CTRL_FLAG_NEXT_CTRL))
         continue;
       DVLOG(1) << __func__ << " " << range.name << " set to " << range.maximum;
 
diff --git a/media/capture/video/mac/video_capture_device_factory_mac.mm b/media/capture/video/mac/video_capture_device_factory_mac.mm
index 8942352..4249595 100644
--- a/media/capture/video/mac/video_capture_device_factory_mac.mm
+++ b/media/capture/video/mac/video_capture_device_factory_mac.mm
@@ -34,9 +34,9 @@
   }
 }
 
-// Blacklisted devices are identified by a characteristic trailing substring of
+// Blocked devices are identified by a characteristic trailing substring of
 // uniqueId. At the moment these are just Blackmagic devices.
-const char* kBlacklistedCamerasIdSignature[] = {"-01FDA82C8A9C"};
+const char* kBlockedCamerasIdSignature[] = {"-01FDA82C8A9C"};
 
 int32_t get_device_descriptors_retry_count = 0;
 
@@ -44,20 +44,18 @@
 
 namespace media {
 
-static bool IsDeviceBlacklisted(
-    const VideoCaptureDeviceDescriptor& descriptor) {
-  bool is_device_blacklisted = false;
+static bool IsDeviceBlocked(const VideoCaptureDeviceDescriptor& descriptor) {
+  bool is_device_blocked = false;
   for (size_t i = 0;
-       !is_device_blacklisted && i < base::size(kBlacklistedCamerasIdSignature);
-       ++i) {
-    is_device_blacklisted =
-        base::EndsWith(descriptor.device_id, kBlacklistedCamerasIdSignature[i],
+       !is_device_blocked && i < base::size(kBlockedCamerasIdSignature); ++i) {
+    is_device_blocked =
+        base::EndsWith(descriptor.device_id, kBlockedCamerasIdSignature[i],
                        base::CompareCase::INSENSITIVE_ASCII);
   }
-  DVLOG_IF(2, is_device_blacklisted)
-      << "Blacklisted camera: " << descriptor.display_name()
+  DVLOG_IF(2, is_device_blocked)
+      << "Blocked camera: " << descriptor.display_name()
       << ", id: " << descriptor.device_id;
-  return is_device_blacklisted;
+  return is_device_blocked;
 }
 
 VideoCaptureDeviceFactoryMac::VideoCaptureDeviceFactoryMac() {
@@ -125,7 +123,7 @@
         [[[capture_devices valueForKey:key] deviceName] UTF8String], device_id,
         model_id, capture_api,
         /*pan_tilt_zoom_supported=*/false, device_transport_type);
-    if (IsDeviceBlacklisted(descriptor))
+    if (IsDeviceBlocked(descriptor))
       continue;
     devices_info.emplace_back(descriptor);
 
diff --git a/media/capture/video/win/video_capture_device_factory_win_unittest.cc b/media/capture/video/win/video_capture_device_factory_win_unittest.cc
index 6d18f0f..d443d5a 100644
--- a/media/capture/video/win/video_capture_device_factory_win_unittest.cc
+++ b/media/capture/video/win/video_capture_device_factory_win_unittest.cc
@@ -1287,8 +1287,8 @@
   EXPECT_FALSE(it->descriptor.pan_tilt_zoom_supported());
 
   // Devices that are listed in both MediaFoundation and DirectShow but are
-  // blacklisted for use with MediaFoundation are expected to get enumerated
-  // with VideoCaptureApi::WIN_DIRECT_SHOW.
+  // blocked for use with MediaFoundation are expected to get enumerated with
+  // VideoCaptureApi::WIN_DIRECT_SHOW.
   it = FindDeviceInRange(devices_info.begin(), devices_info.end(),
                          base::SysWideToUTF8(kDirectShowDeviceId6));
   ASSERT_NE(it, devices_info.end());
diff --git a/media/cdm/library_cdm/cdm_paths.gni b/media/cdm/library_cdm/cdm_paths.gni
index 59781c3..dc4ca4f 100644
--- a/media/cdm/library_cdm/cdm_paths.gni
+++ b/media/cdm/library_cdm/cdm_paths.gni
@@ -21,18 +21,12 @@
   component_os = "unsupported_platform"
 }
 
-if (current_cpu == "x86" || current_cpu == "x64" || current_cpu == "arm") {
-  component_arch = "$current_cpu"
-} else {
-  component_arch = "unsupported_arch"
-}
+component_arch = "$current_cpu"
 
 # Enable platform specific paths. This is required when the CDMs are Chrome
 # components, but is optional for other platforms.
-# Note: |cdm_platform_specific_path| is exported as a BUILDFLAG to
-# cdm_paths.cc.
-if ((is_win || is_mac || is_desktop_linux) &&
-    (current_cpu == "x86" || current_cpu == "x64")) {
+# Note: |cdm_platform_specific_path| is exported as a BUILDFLAG to cdm_paths.cc.
+if (is_win || is_mac || is_desktop_linux) {
   cdm_platform_specific_path =
       "_platform_specific/$component_os" + "_" + "$component_arch"
 
diff --git a/media/gpu/chromeos/BUILD.gn b/media/gpu/chromeos/BUILD.gn
index c5e474b3..d9c66039 100644
--- a/media/gpu/chromeos/BUILD.gn
+++ b/media/gpu/chromeos/BUILD.gn
@@ -7,8 +7,8 @@
 
 assert(use_v4l2_codec || use_vaapi)
 
-# V4L2 or Vaapi imply the OS is Linux.
-assert(is_linux)
+# V4L2 or Vaapi imply the OS is Linux or ChromeOS
+assert(is_linux || is_chromeos)
 
 # This target can depend on targets in //media/gpu/{v4l2,vaapi}.
 source_set("chromeos") {
diff --git a/media/gpu/vaapi/BUILD.gn b/media/gpu/vaapi/BUILD.gn
index dabfd7e..1f3a775 100644
--- a/media/gpu/vaapi/BUILD.gn
+++ b/media/gpu/vaapi/BUILD.gn
@@ -10,7 +10,7 @@
 import("//ui/gl/features.gni")
 import("//ui/ozone/ozone.gni")
 
-assert(is_linux)  # is_chromeos is a subset of is_linux
+assert(is_linux || is_chromeos)
 assert(use_vaapi)
 
 generate_stubs("libva_stubs") {
diff --git a/mojo/public/cpp/bindings/README.md b/mojo/public/cpp/bindings/README.md
index db9b37d..30fbb9f3 100644
--- a/mojo/public/cpp/bindings/README.md
+++ b/mojo/public/cpp/bindings/README.md
@@ -738,7 +738,7 @@
 ```
 
 As noted in the
-[Mojom IDL documentation](/mojo/public/tools/bindings/README.md#Primitive-Types), // need to update this page too!
+[Mojom IDL documentation](/mojo/public/tools/bindings/README.md#Primitive-Types),
 the `pending_receiver<Table>` syntax corresponds
 precisely to the `PendingReceiver<T>` type discussed in the sections above, and
 in fact the generated code for these interfaces is approximately:
@@ -1002,31 +1002,30 @@
 
 ### Mojom
 
-A new keyword `associated` is introduced for remote/receiver
-fields. For example:
+New types `pending_associated_remote` and `pending_associated_receiver` are
+introduced for remote/receiver fields. For example:
 
 ``` cpp
 interface Bar {};
 
 struct Qux {
-  pending_associated_remote<Bar> bar3;
+  pending_associated_remote<Bar> bar;
 };
 
 interface Foo {
   // Uses associated remote.
-  SetBar(pending_associated_remote<Bar> bar1);
+  PassBarRemote(pending_associated_remote<Bar> bar);
   // Uses associated receiver.
-  GetBar(pending_associated_receiver<Bar> bar2);
+  PassBarReceiver(pending_associated_receiver<Bar> bar);
   // Passes a struct with associated interface pointer.
   PassQux(Qux qux);
   // Uses associated interface pointer in callback.
-  AsyncGetBar() => (pending_associated_remote<Bar> bar4);
+  AsyncGetBar() => (pending_associated_remote<Bar> bar);
 };
 ```
 
-It means the interface impl/client will communicate using the same
-message pipe over which the associated remote/receiver is
-passed.
+In each case the interface impl/client will communicate using the same message
+pipe over which the associated remote/receiver is passed.
 
 ### Using associated interfaces in C++
 
@@ -1038,29 +1037,29 @@
 // In mojom:
 interface Foo {
   ...
-  SetBar(pending_associated_remote<Bar> bar1);
-  GetBar(pending_associated_receiver<Bar> bar2);
+  PassBarRemote(pending_associated_remote<Bar> bar);
+  PassBarReceiver(pending_associated_receiver<Bar> bar);
   ...
 };
 
 // In C++:
 class Foo {
   ...
-  virtual void SetBar(mojo::PendingAssociatedRemote<Bar> bar1) = 0;
-  virtual void GetBar(mojo::PendingAssociatedReceiver<Bar> bar2) = 0;
+  virtual void PassBarRemote(mojo::PendingAssociatedRemote<Bar> bar) = 0;
+  virtual void PassBarReceiver(mojo::PendingAssociatedReceiver<Bar> bar) = 0;
   ...
 };
 ```
 
 #### Passing pending associated receivers
 
-Assume you have already got an `Remote<Foo> foo`, and you would like
-to call `GetBar()` on it. You can do:
+Assume you already have a `Remote<Foo> foo`, and you would like to call
+`PassBarReceiver()` on it. You can do:
 
 ``` cpp
 mojo::PendingAssociatedRemote<Bar> pending_bar;
 mojo::PendingAssociatedReceiver<Bar> bar_receiver = pending_bar.InitWithNewEndpointAndPassReceiver();
-foo->GetBar(std::move(bar_receiver));
+foo->PassBarReceiver(std::move(bar_receiver));
 
 mojo::AssociatedRemote<Bar> bar;
 bar.Bind(std::move(pending_bar));
@@ -1087,7 +1086,7 @@
 
 ``` cpp
 mojo::AssociatedRemote<Bar> bar;
-foo->GetBar(bar.BindNewEndpointAndPassReceiver());
+foo->PassBarReceiver(bar.BindNewEndpointAndPassReceiver());
 bar->DoSomething();
 ```
 
@@ -1096,8 +1095,8 @@
 ``` cpp
 class FooImpl : public Foo {
   ...
-  void GetBar(mojo::AssociatedReceiver<Bar> bar2) override {
-    bar_receiver_.Bind(std::move(bar2));
+  void PassBarReceiver(mojo::AssociatedReceiver<Bar> bar) override {
+    bar_receiver_.Bind(std::move(bar));
     ...
   }
   ...
@@ -1118,13 +1117,13 @@
 #### Passing associated remotes
 
 Similarly, assume you have already got an `Remote<Foo> foo`, and you
-would like to call `SetBar()` on it. You can do:
+would like to call `PassBarRemote()` on it. You can do:
 
 ``` cpp
 mojo::AssociatedReceiver<Bar> bar_receiver(some_bar_impl);
 mojo::PendingAssociatedRemote<Bar> bar;
 mojo::PendingAssociatedReceiver<Bar> bar_pending_receiver = bar.InitWithNewEndpointAndPassReceiver();
-foo->SetBar(std::move(bar));
+foo->PassBarRemote(std::move(bar));
 bar_receiver.Bind(std::move(bar_pending_receiver));
 ```
 
@@ -1134,7 +1133,7 @@
 mojo::AssociatedReceiver<Bar> bar_receiver(some_bar_impl);
 mojo::PendingAssociatedRemote<Bar> bar;
 bar_receiver.Bind(bar.InitWithNewPipeAndPassReceiver());
-foo->SetBar(std::move(bar));
+foo->PassBarRemote(std::move(bar));
 ```
 
 ### Performance considerations
diff --git a/net/base/backoff_entry_serializer_fuzzer.cc b/net/base/backoff_entry_serializer_fuzzer.cc
index 2ec426af..08bb64fc 100644
--- a/net/base/backoff_entry_serializer_fuzzer.cc
+++ b/net/base/backoff_entry_serializer_fuzzer.cc
@@ -110,14 +110,14 @@
 
   // Due to fuzzy interpretation in BackoffEntrySerializer::
   // DeserializeFromValue, we cannot assert that |*reserialized == *value|.
-  // Rather, we can deserialize |reserialized| and check that the result is
-  // equivalent to |entry|.
+  // Rather, we can deserialize |reserialized| and check that some weaker
+  // properties are preserved.
   std::unique_ptr<BackoffEntry> entry_reparsed =
       BackoffEntrySerializer::DeserializeFromValue(
           *reserialized, &policy, &clock, translator.parse_time());
   CHECK(entry_reparsed);
-  CHECK_EQ(entry->failure_count(), entry_reparsed->failure_count());
-  CHECK_EQ(entry->GetReleaseTime(), entry_reparsed->GetReleaseTime());
+  CHECK_EQ(entry_reparsed->failure_count(), entry->failure_count());
+  CHECK_LE(entry_reparsed->GetReleaseTime(), entry->GetReleaseTime());
 }
 
 // Tests the "serialize-deserialize" property. Serializes an arbitrary
diff --git a/net/http/transport_security_state_static.json b/net/http/transport_security_state_static.json
index 5c39f93..cef760e 100644
--- a/net/http/transport_security_state_static.json
+++ b/net/http/transport_security_state_static.json
@@ -12059,7 +12059,6 @@
     { "name": "aiois.com", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "airbnbopen.com", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "airhelp.com", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
-    { "name": "akpwebdesign.com", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "alexberts.ch", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "algolia.com", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "aljaspod.net", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
@@ -15240,7 +15239,6 @@
     { "name": "zvxr.net", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "xo.tc", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "xmedius.eu", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
-    { "name": "wtf.ninja", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "unrelated.net.au", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "weizenke.im", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "yeswehack.com", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
@@ -16313,10 +16311,8 @@
     { "name": "sodiao.cc", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "spamloco.net", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "slimk1nd.nl", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
-    { "name": "snowhaze.com", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "standards.gov", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "ssky.cn", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
-    { "name": "snowhaze.ch", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "sunyanzi.tk", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "starandshield.com", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "stcomex.com", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
@@ -22486,7 +22482,6 @@
     { "name": "asana.studio", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "ashleakunowski.com", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "ashleyadum.com", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
-    { "name": "asperti.com", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "astenretail.com", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "astronomie-fulda.de", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "at-one.ca", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
@@ -26732,7 +26727,6 @@
     { "name": "flumble.nl", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "fornoreason.net.au", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "filmserver.de", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
-    { "name": "firecry.org", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "flyssh.net", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "fougner.co", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "eswap.cz", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
@@ -27435,7 +27429,6 @@
     { "name": "josephv.website", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "ludwigpro.net", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "mailflank.com", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
-    { "name": "maartenprovo.be", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "makeshiftco.de", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "malasuk.com", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "maedchenflohmarkt.at", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
@@ -28579,7 +28572,6 @@
     { "name": "trendydips.com", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "transcend.org", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "trancendances.fr", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
-    { "name": "tokic.hr", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "turnonsocial.com", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "triageo.com.au", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "tsumi.moe", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
@@ -30578,7 +30570,6 @@
     { "name": "sparkwood.org", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "speedsportofhull.co.uk", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "smexpt.com", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
-    { "name": "smsappointment.com", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "spacemo.com", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "sprint.ml", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "sparkasse.de", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
@@ -41378,7 +41369,6 @@
     { "name": "owid.cloud", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "owl-hakkei.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "owl-square.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
-    { "name": "paass.net", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "pamsorel.co.za", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "paris-store.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "parkhillsbaptist.church", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
@@ -60444,7 +60434,6 @@
     { "name": "monitoringd.de", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "mozilla-hispano.org", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "mpu-ibbi.de", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
-    { "name": "muffs.ru", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "mussalains.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "mxdvl.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "mycamshowhub.to", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
@@ -62260,7 +62249,6 @@
     { "name": "galaxus.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "galaxus.de", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "galaxus.fr", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
-    { "name": "gardeningdirect.co.uk", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "generationr.nl", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "gfourmis.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "glassemployees.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
@@ -62559,7 +62547,6 @@
     { "name": "cyber-wolfs.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "d4b.in.ua", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "datvexehue.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
-    { "name": "decayshop.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "deped.io", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "detao.org", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "determapp.de", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
@@ -67454,7 +67441,6 @@
     { "name": "918sn.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "918ta.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "918tj.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
-    { "name": "918tr.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "918tw.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "918uh.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "918um.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
@@ -83587,7 +83573,6 @@
     { "name": "70160365.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "80160365.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "8888esb.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
-    { "name": "888am8.net", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "8901178.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "8901178.net", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "8910899.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
@@ -84737,7 +84722,6 @@
     { "name": "foxeffect.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "francisplaza.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "friendsofparks.org", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
-    { "name": "fromtinythings.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "g7035.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "games2kids.net", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "gamingmonitortest.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
@@ -86409,7 +86393,6 @@
     { "name": "webplace4u.nl", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "weekendcandy.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "whitespace.se", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
-    { "name": "woodreface.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "woohay.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "wordpress-experts.net", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "wplibrary.net", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
@@ -87310,7 +87293,6 @@
     { "name": "simcongroup.ir", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "simplertrading.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "simyayayinlari.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
-    { "name": "sitatravel.gr", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "sjyachting.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "sku-partei.de", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "skxpl.eu.org", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
@@ -110079,7 +110061,6 @@
     { "name": "92ganb.xyz", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "99casinos.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "9ss6.cloud", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
-    { "name": "a05webapp.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "abatex.cl", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "abellanillos.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "aceofdiamondspainting.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
@@ -113415,7 +113396,6 @@
     { "name": "amevoice.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "androidmovile.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "anihonetwallpaper.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
-    { "name": "answerit.io", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "apkteen.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "arcadia.com.ph", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "artexhibition.jp", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
@@ -114026,7 +114006,6 @@
     { "name": "amadvocates.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "amilesportes.com.br", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "animalworld.club", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
-    { "name": "antonmcclure.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "apcpky.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "aradiantlife.org", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "aravo.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
@@ -114900,7 +114879,6 @@
     { "name": "lu2343.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "lui.vn", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "magsdata.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
-    { "name": "majionggang.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "malrox.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "marcatostaging.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "marglotfabadi.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
@@ -115174,6 +115152,552 @@
     { "name": "zilver.nl", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "zirbenholz-welt.de", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "zonagratisan.ga", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "22b31.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "4cdesigners.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "4nikola.de", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "7it-latam.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "805lifeguard.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "808arts.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "8duhu.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "911ifix.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "abc-kinderbetreuung.at", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "aclipt.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "acropolis.edu.mx", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "adventuresinparanoia.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "agateh.com.au", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "agentpoint.website", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "agro-dom.solutions", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "akp.photos", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "akubadaura.org", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "alisonmcalpine.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "almadeviajante.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "alojamientos-cuba.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "alonsoluzgas.es", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "altadancesport.cz", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "alvarojacome.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "amalbansode.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "ampdes.com.au", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "andislaw.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "apruebaexamenes.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "aquaviaspa.es", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "arca.live", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "arete.net", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "areyoubaroque.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "aritmetic.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "artchic.vn", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "arthurlewis.me", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "artia.live", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "assomydesk.fr", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "astrolojiyorumcusu.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "aurorasa.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "ayurveda-france.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "babygender.info", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "bacom1.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "becomemoreconfident.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "bestpaintballmask.net", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "betwinner.cm", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "bilibili.ooo", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "bizzvisor.site", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "bkgatl.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "blsindia.sg", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "bmipestcontrol.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "boomersclub.com.au", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "boulevardbuildingdsm.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "braindiamond.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "braindiamonds.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "breathfinder.io", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "brightview.net.cn", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "brunhilde.ml", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "burnimage.co.uk", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "buyitnowfast.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "bxin.de", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "cacavazamentomillclean.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "cahfee.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "cambramanresa.cat", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "capellan.pe", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "carpinteriacaballeroleon.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "carry.luxe", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "cartuchoonline.com.br", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "casthull.co.uk", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "catalogador.ml", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "celsusnicosia.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "chatintime.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "chemgenes.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "chiapasfutbol.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "christianwong.blog", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "chuying.ltd", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "cintapersonalizada.es", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "classicz.xyz", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "cleanshield99.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "clevyr.biz", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "clevyr.careers", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "clevyr.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "clevyr.info", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "clevyr.mobi", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "clevyr.ninja", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "clevyr.org", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "clevyr.us", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "clevyrapps.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "clevyrgames.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "clevyrhosting.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "clevyrstudios.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "clubsuccessjapan.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "coasteering.co.uk", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "codetheweb.blog", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "cofinco.nl", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "coggin.church", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "coldfusion.co.jp", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "colean.cc", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "colonialfilings.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "contemplativelens.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "contenedoresdereciclaje.online", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "contributopia.org", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "coolink.pub", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "corporateinbound.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "cortadoradeplasma.online", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "cortapelos.site", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "cosmoswaterdamagerestoration.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "courtsunlimitedut.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "creartcompany.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "creatapeak.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "crystalcave.nl", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "csgoyournal.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "cturpoc.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "cvsmash.io", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "davepullig.co.uk", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "davids.online", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "dawidpotocki.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "de-google-ify.org", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "degooglisons-internet.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "degooglisons-internet.fr", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "degooglisons-internet.org", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "degooglisons.org", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "degooglisonsinternet.org", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "degooglize.org", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "delpilarrungue.cl", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "dental-reboot.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "dentalcareerfinder.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "dentistsgainesvillega.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "dentistslilburnga.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "derejilla.online", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "desergo.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "dfwwp.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "diebasis-partei.de", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "diegovasconcelos.com.br", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "diemperu.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "digital-workshop.at", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "digitalservices.lk", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "dimequebuscas.cl", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "doctruyencotich.vn", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "dormi.hu", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "dothesecurity.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "dr-maike-juergens.de", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "drgazivet.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "dscsigncert.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "dunneworthy.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "echtebewertungen.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "eduerror.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "elektromet.com.pl", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "elektromet.pl", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "empowernation.org", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "equitytrack.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "ergonomic-products.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "ericleuthardtphotography.club", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "eroticgirlfriend.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "erronort.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "espace-tech.ru", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "espace.spb.ru", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "espressob2b.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "eternegy.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "eurban.life", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "eveetcie.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "extraspaces.co.uk", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "faunatrek.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "fedrooms.gov", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "fermier-mag.ro", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "ferrarichat.fr", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "financieracademy.com.br", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "finion.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "flagcdn.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "flavio.click", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "floline.fr", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "flying-press.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "foodfriek.nl", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "forcemasonry.net", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "forcemasonryinc.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "formulaveevictoria.com.au", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "fornarisandres.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "fotopremium.cz", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "frama.link", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "frama.site", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "frama.wiki", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "framabag.org", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "framabee.org", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "framabin.org", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "framablog.org", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "framaboard.org", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "framabook.org", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "framabookin.org", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "framacalc.org", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "framacarte.org", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "framaclic.org", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "framacolibri.org", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "framadate.org", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "framadrive.org", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "framadrop.org", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "framadvd.org", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "framaestro.org", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "framaform.org", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "framaforms.org", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "framagames.org", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "framagenda.org", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "framagit.org", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "framakey.org", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "framalab.org", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "framalang.org", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "framalibre.org", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "framalistes.org", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "framandroid.org", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "framanews.org", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "framanote.org", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "framanotes.org", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "framapack.org", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "framapad.org", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "framapiaf.org", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "framapic.org", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "framasite.org", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "framasites.org", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "framaslides.org", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "framasoft.org", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "framasphere.org", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "framastart.org", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "framastats.org", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "framastory.org", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "framatalk.org", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "framateam.org", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "framavectoriel.org", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "framavox.org", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "framawiki.org", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "framazic.org", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "framemo.org", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "framindmap.org", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "framinetest.org", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "fregona.online", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "frothy285.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "gamesbap.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "generateur-thot.fr", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "genesisgold.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "get-x-web-link2.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "ghobot.ai", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "giaminh.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "giff.com.mx", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "glyam.nl", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "goldspark8.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "goodandsnarky.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "grabtech.vn", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "gracodesign.eu", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "greenheartclean.co.uk", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "guiadeprofesionales.com.ar", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "guiaminhasaude.net", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "guiaturismovallarta.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "guusu.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "handyoutdoorgoods.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "havendetoxnow.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "hbr.link", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "hclsrilanka.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "holi-coresdaindia.com.br", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "huanqiu1988.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "huit.re", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "huohu-sports.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "hygh.tech", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "hyndax.com.ar", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "iamtrucking.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "ianloe.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "ianloe.rocks", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "ignite.cz", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "igscountertops.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "imdb.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "impay.one", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "implude.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "improvebusinessonline.info", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "inlink.ltd", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "innopharmaeducation.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "innoutmarket.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "inrage.fr", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "insidebitcoins.de", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "internet-israel.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "interwebz.nz", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "intrasac.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "intwiff.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "istekparcam.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "italiamour.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "itcreative.ro", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "itouriria.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "its-em.ma", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "jarofthread.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "jasonisclever.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "jeanmichelaudet.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "jemezsprings-nm.gov", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "jestyc.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "jhoncampos.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "jimsheatandcool.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "jkloli.tk", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "joinmobilizon.org", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "joinpeertube.org", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "juliebradford.co.uk", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "jumbo-air.de", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "kaliocommerce.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "keke125.idv.tw", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "kerbin.org", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "kiwicoworking.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "kokankart.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "konaqua.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "kuisus.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "kwx.gg", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "l4s.me", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "landoftherisingson.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "langyamk.xyz", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "lanoticia.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "lastrourbanismo.com.br", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "legba.in", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "letechgranby.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "letnet.ddnss.de", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "lettersvertalingen.nl", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "levabilligt.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "levapsych.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "lily.flowers", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "lincolnil.gov", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "lindaquerida.com.br", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "lisahutson.co.uk", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "littleorangecookbook.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "livewell-counseling.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "lojal19.com.br", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "lojasti.com.br", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "louloulovestreats.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "lunai.re", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "lut.im", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "madsgencydemo.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "mahadsunnah.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "maiscuidar.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "mantaoilco.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "matehierba.cl", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "mattisclever.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "meaqua.love", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "medidordecampo.online", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "metalmonocle.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "michaelglaser.de", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "milr.dk", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "minermonitoring.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "misclick.net", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "mkboynton.org", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "mobilizon.org", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "moliporex.pt", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "montessori-oberhaching.de", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "mrfd.nl", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "mtr123.cn", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "mundopatchwork.online", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "mundosai.online", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "mutuocasafacile.it", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "myofficerenovation.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "mypaperpress.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "mytribus.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "nanxin.wtf", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "naturalcakrawala.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "naturesportcentral.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "nbwp.uk", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "ndns.ga", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "neesousunebonneetoile.ca", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "neutron.ch", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "nextairgen.be", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "nigelvm.xyz", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "nomadaregalos.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "northsegment.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "nudesharing.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "nutriclub.co.id", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "oeno.link", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "omintmais.azurewebsites.net", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "omnisky.dk", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "onestoptown.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "onlyfans.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "onyx-groups.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "opensourcecombat.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "ordr.net", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "origamiking.wiki", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "osmarks.tk", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "outdoorlearningmap.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "packliberte.org", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "pae.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "palulu-products.be", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "paru-design.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "pediatricdentistsdaculaga.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "pediatricdentistslilburnga.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "pedradatattoo.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "pedradatattoosupplies.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "peelmachineryrepair.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "percherosdepared.online", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "petevagabond.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "peya.tokyo", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "photosight.ru", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "pigeons-rings.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "pilatesavenue.co.uk", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "pirateproxy.cloud", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "pocketfullofkittens.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "pokia.ir", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "politicalle.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "politiciancompare.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "politicnation.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "ponpon05.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "porno-geschichten.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "portaequipajes.online", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "powderspraymachine.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "preconstruct.ca", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "privally.global", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "prmihoc.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "probationnotes.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "proxybay.gdn", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "pyjiaoyi.cc", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "quarep.org", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "quarkcore.pt", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "qwitsmoking.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "radarcoupon.ch", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "radiantwonder.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "ragprint.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "rainierpros.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "rarlab.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "razhayezendegi.ir", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "recupero.it", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "regiamo.ch", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "restauranthugo.nl", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "resultscommercial.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "reversecrucifixkm.altervista.org", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "rewiredweightloss.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "ricettesemplicieveloci.altervista.org", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "riesurya.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "risecomedy.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "rixcloud.moe", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "rockset.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "ropingsupply.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "rtestore.eu", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "saludakeuring.nl", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "saygoodbyetoie.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "scevity.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "semillasdelucha.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "serra.me", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "shawfactor.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "shopdopescador.com.br", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "shortshadows.band", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "shuo.li", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "sierradecalar.online", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "silvertonmd.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "simplexdigital.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "simpservices.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "skindb.net", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "skylinehk.org", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "skyterraathome.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "skyterrawellness.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "sl.al", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "smart-profile.ro", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "sociopampers.com.ar", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "solocalcetines.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "sonometro.online", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "souravbhor.gq", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "sparanoid.net", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "sqhs.club", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "ssslelectricfencing.co.za", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "ssslintercomsystems.co.za", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "steelfxpatinas.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "stlucievillagefl.gov", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "stonecutgods.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "studio-impress.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "submeet.vet", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "successful-online-business.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "superfaktura.at", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "superfastpress.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "sven-erik.org", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "swimpool.co.il", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "takosen.co.jp", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "tardics.eu", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "tebodentalgroup.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "tebodentistryatlanta.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "tebodentistryforkids.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "teboexperience.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "tebokidsstore.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "tebothetooth.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "tech3araby.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "techacad.net", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "testcu.be", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "testingben.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "thebrushcreekdistillery.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "thecedarsbb.co.za", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "thegolden.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "theillustrators.com.au", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "theshivrajofficial.in", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "thetebodifference.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "thethinktankpodcast.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "theunbox.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "thewebcully.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "thfaid.org", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "threadythready.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "tiendatecnologica.net", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "tiktok.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "tishsglitches.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "titiansgirl.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "tmstats.fr", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "tontonroger.org", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "top1.com.vn", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "toplevel.mx", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "tornos.site", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "townofgoldenmeadow-la.gov", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "trouvons.org", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "ttcmed.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "tubach.org", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "tuckmeintebo.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "tudorrosesamplerguild.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "turkmen.news", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "turnbacktogod.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "twidy.uk", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "tyiblog.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "ucybodyinc.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "umzug-fuer-muenchen.de", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "unblockit.win", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "ungooglize.org", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "unicintas.com.br", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "unimeias.com.br", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "unreal.dk", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "upperskagittribe-nsn.gov", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "uruharushia.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "uvcleanfrance.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "vap.llc", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "vigo-select.de", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "viktorovi.cz", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "virginiagardens-fl.gov", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "visitorsguide.is", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "volcano.lt", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "vyuticonsulting.in", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "walden-interiors.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "wasatchcleanair.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "watermission.org", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "wearekiwi.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "webyazilim.biz.tr", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "well.bayern", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "wgrlc.vic.gov.au", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "win-rar.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "workatclever.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "workatclever.us", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "workatclevyr.us", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "workspace.pt", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "wpsuites.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "wycombetoday.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "xion.nu", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "xn--6m1a86p.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "xvpn.io", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "xxzacg.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "yardandgardenguru.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "yasminedewolf.be", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "yousifsaeed.xyz", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "youtubex.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "zovovo.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "zrgmedical.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     // END OF 1-YEAR BULK HSTS ENTRIES
 
     // Only eTLD+1 domains can be submitted automatically to hstspreload.org,
diff --git a/services/device/bluetooth/bluetooth_system.cc b/services/device/bluetooth/bluetooth_system.cc
index b63cd07..7925dac8 100644
--- a/services/device/bluetooth/bluetooth_system.cc
+++ b/services/device/bluetooth/bluetooth_system.cc
@@ -19,6 +19,7 @@
 #include "device/bluetooth/dbus/bluetooth_adapter_client.h"
 #include "device/bluetooth/dbus/bluetooth_device_client.h"
 #include "device/bluetooth/dbus/bluez_dbus_manager.h"
+#include "device/bluetooth/public/cpp/bluetooth_address.h"
 #include "mojo/public/cpp/bindings/self_owned_receiver.h"
 
 namespace device {
@@ -209,8 +210,7 @@
   for (const auto& device_path : device_paths) {
     auto* properties = GetBluetoothDeviceClient()->GetProperties(device_path);
     std::array<uint8_t, 6> parsed_address;
-    if (!BluetoothDevice::ParseAddress(properties->address.value(),
-                                       parsed_address)) {
+    if (!ParseBluetoothAddress(properties->address.value(), parsed_address)) {
       LOG(WARNING) << "Failed to parse device address '"
                    << properties->address.value() << "' for "
                    << device_path.value();
diff --git a/services/network/public/cpp/BUILD.gn b/services/network/public/cpp/BUILD.gn
index ab633177..bef82fa 100644
--- a/services/network/public/cpp/BUILD.gn
+++ b/services/network/public/cpp/BUILD.gn
@@ -82,6 +82,8 @@
     "network_quality_tracker.h",
     "network_switches.cc",
     "network_switches.h",
+    "not_implemented_url_loader_factory.cc",
+    "not_implemented_url_loader_factory.h",
     "origin_isolation_parser.cc",
     "origin_isolation_parser.h",
     "parsed_headers.cc",
diff --git a/content/test/not_implemented_network_url_loader_factory.cc b/services/network/public/cpp/not_implemented_url_loader_factory.cc
similarity index 67%
rename from content/test/not_implemented_network_url_loader_factory.cc
rename to services/network/public/cpp/not_implemented_url_loader_factory.cc
index 336f6d6..149e673 100644
--- a/content/test/not_implemented_network_url_loader_factory.cc
+++ b/services/network/public/cpp/not_implemented_url_loader_factory.cc
@@ -2,20 +2,19 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "content/test/not_implemented_network_url_loader_factory.h"
+#include "services/network/public/cpp/not_implemented_url_loader_factory.h"
 
+#include "base/logging.h"
 #include "mojo/public/cpp/bindings/remote.h"
 #include "services/network/public/mojom/url_loader.mojom.h"
 
-namespace content {
+namespace network {
 
-NotImplementedNetworkURLLoaderFactory::NotImplementedNetworkURLLoaderFactory() =
-    default;
+NotImplementedURLLoaderFactory::NotImplementedURLLoaderFactory() = default;
 
-NotImplementedNetworkURLLoaderFactory::
-    ~NotImplementedNetworkURLLoaderFactory() = default;
+NotImplementedURLLoaderFactory::~NotImplementedURLLoaderFactory() = default;
 
-void NotImplementedNetworkURLLoaderFactory::CreateLoaderAndStart(
+void NotImplementedURLLoaderFactory::CreateLoaderAndStart(
     mojo::PendingReceiver<network::mojom::URLLoader> receiver,
     int32_t routing_id,
     int32_t request_id,
@@ -23,15 +22,16 @@
     const network::ResourceRequest& url_request,
     mojo::PendingRemote<network::mojom::URLLoaderClient> client,
     const net::MutableNetworkTrafficAnnotationTag& traffic_annotation) {
+  NOTREACHED();
   network::URLLoaderCompletionStatus status;
   status.error_code = net::ERR_NOT_IMPLEMENTED;
   mojo::Remote<network::mojom::URLLoaderClient>(std::move(client))
       ->OnComplete(status);
 }
 
-void NotImplementedNetworkURLLoaderFactory::Clone(
+void NotImplementedURLLoaderFactory::Clone(
     mojo::PendingReceiver<network::mojom::URLLoaderFactory> receiver) {
   receivers_.Add(this, std::move(receiver));
 }
 
-}  // namespace content
+}  // namespace network
diff --git a/content/test/not_implemented_network_url_loader_factory.h b/services/network/public/cpp/not_implemented_url_loader_factory.h
similarity index 63%
rename from content/test/not_implemented_network_url_loader_factory.h
rename to services/network/public/cpp/not_implemented_url_loader_factory.h
index 60506f3..baca98d 100644
--- a/content/test/not_implemented_network_url_loader_factory.h
+++ b/services/network/public/cpp/not_implemented_url_loader_factory.h
@@ -2,22 +2,24 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef CONTENT_TEST_NOT_IMPLEMENTED_NETWORK_URL_LOADER_FACTORY_H_
-#define CONTENT_TEST_NOT_IMPLEMENTED_NETWORK_URL_LOADER_FACTORY_H_
+#ifndef SERVICES_NETWORK_PUBLIC_CPP_NOT_IMPLEMENTED_URL_LOADER_FACTORY_H_
+#define SERVICES_NETWORK_PUBLIC_CPP_NOT_IMPLEMENTED_URL_LOADER_FACTORY_H_
 
+#include "base/component_export.h"
 #include "mojo/public/cpp/bindings/pending_receiver.h"
 #include "mojo/public/cpp/bindings/pending_remote.h"
 #include "mojo/public/cpp/bindings/receiver_set.h"
 #include "services/network/public/mojom/url_loader_factory.mojom.h"
 
-namespace content {
+namespace network {
 
-// A mock URLLoaderFactory which just fails to create a loader.
-class NotImplementedNetworkURLLoaderFactory final
+// A URLLoaderFactory which just fails to create a loader with
+// net::ERR_NOT_IMPLEMENTED.
+class COMPONENT_EXPORT(NETWORK_CPP) NotImplementedURLLoaderFactory final
     : public network::mojom::URLLoaderFactory {
  public:
-  NotImplementedNetworkURLLoaderFactory();
-  ~NotImplementedNetworkURLLoaderFactory() override;
+  NotImplementedURLLoaderFactory();
+  ~NotImplementedURLLoaderFactory() override;
 
   // network::mojom::URLLoaderFactory implementation.
   void CreateLoaderAndStart(
@@ -36,9 +38,9 @@
  private:
   mojo::ReceiverSet<network::mojom::URLLoaderFactory> receivers_;
 
-  DISALLOW_COPY_AND_ASSIGN(NotImplementedNetworkURLLoaderFactory);
+  DISALLOW_COPY_AND_ASSIGN(NotImplementedURLLoaderFactory);
 };
 
-}  // namespace content
+}  // namespace network
 
-#endif  // CONTENT_TEST_NOT_IMPLEMENTED_NETWORK_URL_LOADER_FACTORY_H_
+#endif  // SERVICES_NETWORK_PUBLIC_CPP_NOT_IMPLEMENTED_URL_LOADER_FACTORY_H_
diff --git a/services/tracing/tracing_service.cc b/services/tracing/tracing_service.cc
index 80dda85..b21f2db9 100644
--- a/services/tracing/tracing_service.cc
+++ b/services/tracing/tracing_service.cc
@@ -15,6 +15,10 @@
 
 namespace {
 
+void OnProcessConnectFailed(PerfettoService* perfetto_service, uint32_t pid) {
+  perfetto_service->RemoveActiveServicePid(pid);
+}
+
 void OnProcessConnected(
     PerfettoService* perfetto_service,
     mojo::Remote<mojom::TracedProcess> traced_process,
@@ -44,12 +48,22 @@
 }
 
 void TracingService::AddClient(mojom::ClientInfoPtr client) {
+  mojo::Remote<mojom::TracedProcess> process(std::move(client->process));
+
   perfetto_service_->AddActiveServicePid(client->pid);
 
-  mojo::Remote<mojom::TracedProcess> process(std::move(client->process));
+  // If the remote traced process goes away before ConnectToTracingService
+  // responds, the PID should be removed from the list of active service PID.
+  // Note that the perfetto service will start monitoring disconnects after the
+  // service receiver is bound to it in OnProcessConnected().
+  process.set_disconnect_handler(
+      base::BindOnce(&OnProcessConnectFailed,
+                     base::Unretained(perfetto_service_), client->pid));
+
   auto new_connection_request = mojom::ConnectToTracingRequest::New();
   auto service_receiver =
       new_connection_request->perfetto_service.InitWithNewPipeAndPassReceiver();
+
   mojom::TracedProcess* raw_process = process.get();
   raw_process->ConnectToTracingService(
       std::move(new_connection_request),
diff --git a/skia/config/SkUserConfig.h b/skia/config/SkUserConfig.h
index 0059cadb..18c51ce 100644
--- a/skia/config/SkUserConfig.h
+++ b/skia/config/SkUserConfig.h
@@ -231,15 +231,9 @@
 // Staging for https://review.skia.org/302290
 #define SK_IMAGE_MAKE_COLOR_TYPE_AND_SPACE_USE_SOURCE_CONTEXT
 
-// Staging for https://review.skia.org/302643
-#define SK_IMAGE_MAKE_TEXTURE_IMAGE_ALLOW_GR_CONTEXT
-
 // Staging for https://review.skia.org/304003
 #define SK_IMAGE_MAKE_WITH_FILTER_LEGACY_API
 
-// Staging for https://review.skia.org/304797
-#define SK_IMAGE_FLUSH_LEGACY_API
-
 // Staging for https://review.skia.org/305102
 #define SK_IMAGE_MAKE_FROM_TEXTURE_LEGACY_API
 
diff --git a/third_party/blink/common/BUILD.gn b/third_party/blink/common/BUILD.gn
index ab4c854c..e9f9cc7 100644
--- a/third_party/blink/common/BUILD.gn
+++ b/third_party/blink/common/BUILD.gn
@@ -243,6 +243,7 @@
     "origin_trials/trial_token_unittest.cc",
     "origin_trials/trial_token_validator_unittest.cc",
     "test/run_all_unittests.cc",
+    "tokens/multi_token_unittest.cc",
     "user_agent/user_agent_metadata_unittest.cc",
     "web_package/web_package_request_matcher_unittest.cc",
   ]
diff --git a/third_party/blink/common/tokens/multi_token_unittest.cc b/third_party/blink/common/tokens/multi_token_unittest.cc
new file mode 100644
index 0000000..224304df
--- /dev/null
+++ b/third_party/blink/common/tokens/multi_token_unittest.cc
@@ -0,0 +1,124 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "third_party/blink/public/common/tokens/multi_token.h"
+
+#include <algorithm>
+
+#include "base/unguessable_token.h"
+#include "base/util/type_safety/token_type.h"
+#include "testing/gtest/include/gtest/gtest.h"
+
+namespace blink {
+
+using FooToken = util::TokenType<class FooTokenTag>;
+using BarToken = util::TokenType<class BarTokenTag>;
+using BazToken = util::TokenType<class BazTokenTag>;
+
+// Test MultiTokenVariantCount.
+static_assert(internal::MultiTokenVariantCount<FooToken, BarToken>::kValue == 2,
+              "unexpected count");
+static_assert(
+    internal::MultiTokenVariantCount<FooToken, BarToken, BazToken>::kValue == 3,
+    "unexpected count");
+
+// Test MultiTokenTypeRepeated.
+static_assert(!internal::MultiTokenTypeRepeated<FooToken>::kValue,
+              "unexpected repeated value");
+static_assert(!internal::MultiTokenTypeRepeated<FooToken, FooToken>::kValue,
+              "unexpected repeated value");
+static_assert(
+    !internal::MultiTokenTypeRepeated<FooToken, FooToken, BarToken>::kValue,
+    "unexpected repeated value");
+static_assert(
+    internal::MultiTokenTypeRepeated<FooToken, FooToken, BarToken, FooToken>::
+        kValue,
+    "unexpected repeated value");
+static_assert(
+    internal::MultiTokenTypeRepeated<FooToken, BarToken, FooToken, FooToken>::
+        kValue,
+    "unexpected repeated value");
+
+// Test MultiTokenAnyTypeRepeated.
+static_assert(!internal::MultiTokenAnyTypeRepeated<FooToken>::kValue,
+              "unexpected any repeated value");
+static_assert(!internal::MultiTokenAnyTypeRepeated<FooToken, BarToken>::kValue,
+              "unexpected any repeated value");
+static_assert(
+    !internal::MultiTokenAnyTypeRepeated<FooToken, BarToken, BazToken>::kValue,
+    "unexpected any repeated value");
+static_assert(
+    internal::MultiTokenAnyTypeRepeated<FooToken, BarToken, FooToken>::kValue,
+    "unexpected any repeated value");
+static_assert(
+    internal::MultiTokenAnyTypeRepeated<FooToken, BarToken, BarToken>::kValue,
+    "unexpected any repeated value");
+
+// Test MultiTokenVariantIsTokenType.
+static_assert(internal::MultiTokenVariantIsTokenType<FooToken>::kValue,
+              "unexpected is token type value");
+static_assert(!internal::MultiTokenVariantIsTokenType<int>::kValue,
+              "unexpected is token type value");
+
+// Test MultiTokenAllVariantsAreTokenType.
+static_assert(
+    internal::MultiTokenAllVariantsAreTokenType<FooToken, BarToken>::kValue,
+    "unexpected all variants are token type value");
+static_assert(!internal::MultiTokenAllVariantsAreTokenType<FooToken,
+                                                           BarToken,
+                                                           int>::kValue,
+              "unexpected all variants are token type value");
+
+using FooBarToken = MultiToken<FooToken, BarToken>;
+using FooBarBazToken = MultiToken<FooToken, BarToken, BazToken>;
+
+TEST(MultiTokenTest, MultiTokenWorks) {
+  // Test default initialization.
+  FooBarToken token1;
+  EXPECT_FALSE(token1.value().is_empty());
+  EXPECT_EQ(0u, token1.variant_index());
+  EXPECT_TRUE(token1.Is<FooToken>());
+  EXPECT_FALSE(token1.Is<BarToken>());
+
+  // Test copy construction.
+  BarToken bar = BarToken::Create();
+  FooBarToken token2(bar);
+  EXPECT_EQ(token2.value(), bar.value());
+  EXPECT_FALSE(token2.value().is_empty());
+  EXPECT_EQ(1u, token2.variant_index());
+  EXPECT_FALSE(token2.Is<FooToken>());
+  EXPECT_TRUE(token2.Is<BarToken>());
+
+  // Test assignment.
+  FooBarToken token3;
+  token3 = token2;
+  EXPECT_EQ(token3.value(), token2.value());
+  EXPECT_FALSE(token3.value().is_empty());
+  EXPECT_EQ(token2.variant_index(), token3.variant_index());
+  EXPECT_FALSE(token3.Is<FooToken>());
+  EXPECT_TRUE(token3.Is<BarToken>());
+
+  // Test comparison operators.
+  EXPECT_FALSE(token1 == token2);
+  EXPECT_TRUE(token1 != token2);
+  EXPECT_TRUE(token2 == token3);
+  EXPECT_FALSE(token2 != token3);
+  EXPECT_EQ(token1 < token2, token1.value() < token2.value());
+  EXPECT_FALSE(token2 < token3);
+  EXPECT_FALSE(token3 < token2);
+
+  // Test hasher.
+  EXPECT_EQ(FooBarToken::Hasher()(token2),
+            base::UnguessableTokenHash()(token2.value()));
+
+  // Test string representation.
+  EXPECT_EQ(token2.ToString(), token2.value().ToString());
+
+  // Test type conversions.
+  FooToken foo(token1.value());
+  EXPECT_EQ(foo, token1.GetAs<FooToken>());
+  EXPECT_EQ(token2.GetAs<BarToken>(), token3.GetAs<BarToken>());
+}
+
+}  // namespace blink
diff --git a/third_party/blink/public/common/BUILD.gn b/third_party/blink/public/common/BUILD.gn
index e528eaa..6fba9a49a 100644
--- a/third_party/blink/public/common/BUILD.gn
+++ b/third_party/blink/public/common/BUILD.gn
@@ -167,6 +167,8 @@
     "sms/sms_receiver_destroyed_reason.h",
     "sms/sms_receiver_outcome.h",
     "switches.h",
+    "tokens/multi_token.h",
+    "tokens/multi_token_internal.h",
     "tokens/token_mojom_traits_helper.h",
     "tokens/tokens.h",
     "tokens/tokens_mojom_traits.h",
diff --git a/third_party/blink/public/common/loader/url_loader_factory_bundle.h b/third_party/blink/public/common/loader/url_loader_factory_bundle.h
index 711fc3a6..4361ec8 100644
--- a/third_party/blink/public/common/loader/url_loader_factory_bundle.h
+++ b/third_party/blink/public/common/loader/url_loader_factory_bundle.h
@@ -119,6 +119,8 @@
   // existing bundle.
   void Update(std::unique_ptr<PendingURLLoaderFactoryBundle> pending_factories);
 
+  bool HasBoundDefaultFactory() const { return default_factory_.is_bound(); }
+
  protected:
   ~URLLoaderFactoryBundle() override;
 
diff --git a/third_party/blink/public/common/tokens/multi_token.h b/third_party/blink/public/common/tokens/multi_token.h
new file mode 100644
index 0000000..7922bea
--- /dev/null
+++ b/third_party/blink/public/common/tokens/multi_token.h
@@ -0,0 +1,173 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Helper class for a strongly-typed multiple variant token. Allows creating
+// a token that can represent one of a collection of distinct token types.
+// It would be great to replace this with a much simpler C++17 std::variant
+// when that is available.
+
+#ifndef THIRD_PARTY_BLINK_PUBLIC_COMMON_TOKENS_MULTI_TOKEN_H_
+#define THIRD_PARTY_BLINK_PUBLIC_COMMON_TOKENS_MULTI_TOKEN_H_
+
+#include <type_traits>
+
+#include "base/unguessable_token.h"
+#include "third_party/blink/public/common/tokens/multi_token_internal.h"
+
+namespace blink {
+
+// Defines MultiToken, which is effectively a variant over 2 or more
+// instances of util::TokenType.
+//
+// A MultiToken<..> emulates a token like interface. When default constructed
+// it will construct itself as an instance of |TokenVariant0|. Additionally it
+// offers the following functions allowing casting and querying token types at
+// runtime:
+//
+//   // Determines whether this token stores an instance of a TokenType.
+//   bool Is<TokenType>() const;
+//
+//   // Extracts the stored token in its original type. The stored token must
+//   // be of the provided type otherwise this will explode at runtime.
+//   const TokenType& GetAs<TokenType>() const;
+//
+// A variant must have at least 2 valid input types, but can have arbitrarily
+// many. They must all be distinct, and they must all be instances of
+// util::TokenType.
+template <typename TokenVariant0,
+          typename TokenVariant1,
+          typename... TokenVariants>
+class MultiToken : public internal::MultiTokenBase<TokenVariant0,
+                                                   TokenVariant1,
+                                                   TokenVariants...> {
+ public:
+  using Base =
+      internal::MultiTokenBase<TokenVariant0, TokenVariant1, TokenVariants...>;
+
+  // The total number of types.
+  static const uint32_t kVariantCount = Base::VariantCount::kValue;
+
+  // Default constructor. The resulting token will be a valid token of type
+  // TokenVariant0.
+  MultiToken() = default;
+
+  // Copy constructors.
+  MultiToken(const MultiToken& other) = default;
+  template <typename InputTokenType,
+            typename = typename std::enable_if<
+                Base::template ValidType<InputTokenType>::kValue>::type>
+  explicit MultiToken(const InputTokenType& input_token)
+      : value_(input_token.value()),
+        variant_index_(Base::template TypeIndex<InputTokenType>::kValue) {}
+
+  ~MultiToken() = default;
+
+  // Assignment operators.
+  MultiToken& operator=(const MultiToken& other) = default;
+  template <typename InputTokenType,
+            typename = typename std::enable_if<
+                Base::template ValidType<InputTokenType>::kValue>::type>
+  MultiToken& operator=(const InputTokenType& input_token) {
+    value_ = input_token.value();
+    variant_index_ = Base::template TypeIndex<InputTokenType>::kValue;
+    return *this;
+  }
+
+  const base::UnguessableToken& value() const { return value_; }
+  uint32_t variant_index() const { return variant_index_; }
+  std::string ToString() const { return value().ToString(); }
+
+  // Type checking.
+  template <typename InputTokenType,
+            typename = typename std::enable_if<
+                Base::template ValidType<InputTokenType>::kValue>::type>
+  bool Is() const {
+    return variant_index_ == Base::template TypeIndex<InputTokenType>::kValue;
+  }
+
+  // Type conversion. Allows extracting the underlying token type. This should
+  // only be called for the actual type that is stored in this token. This can
+  // be checked by calling "Is<>" first.
+  template <typename InputTokenType,
+            typename = typename std::enable_if<
+                Base::template ValidType<InputTokenType>::kValue>::type>
+  InputTokenType GetAs() const {
+    CHECK(Is<InputTokenType>()) << "invalid token type cast";
+    // Type-punning via casting is undefined behaviour, so we return by value.
+    return InputTokenType(value_);
+  }
+
+  // Comparison with untyped tokens. Only compares the token value, ignoring the
+  // type.
+  int Compare(const base::UnguessableToken& other) const {
+    return Base::CompareImpl(value_, other);
+  }
+  bool operator<(const base::UnguessableToken& other) const {
+    return Compare(other) == -1;
+  }
+  bool operator==(const base::UnguessableToken& other) const {
+    return Compare(other) == 0;
+  }
+  bool operator!=(const base::UnguessableToken& other) const {
+    return Compare(other) != 0;
+  }
+
+  // Comparison with other MultiTokens. Compares by token, then type.
+  int Compare(const MultiToken& other) const {
+    return Base::CompareImpl(std::tie(value_, variant_index_),
+                             std::tie(other.value_, other.variant_index_));
+  }
+  bool operator<(const MultiToken& other) const { return Compare(other) == -1; }
+  bool operator==(const MultiToken& other) const { return Compare(other) == 0; }
+  bool operator!=(const MultiToken& other) const { return Compare(other) != 0; }
+
+  // Comparison with individual typed tokens. Compares by token, then type.
+  template <typename InputTokenType,
+            typename = typename std::enable_if<
+                Base::template ValidType<InputTokenType>::kValue>::type>
+  int Compare(const InputTokenType& other) const {
+    static constexpr uint32_t kInputTokenTypeIndex =
+        Base::template TypeIndex<InputTokenType>::kValue;
+    return Base::CompareImpl(std::tie(value_, variant_index_),
+                             std::tie(other.value_, kInputTokenTypeIndex));
+  }
+  template <typename InputTokenType,
+            typename = typename std::enable_if<
+                Base::template ValidType<InputTokenType>::kValue>::type>
+  bool operator<(const InputTokenType& other) const {
+    return Compare(other) == -1;
+  }
+  template <typename InputTokenType,
+            typename = typename std::enable_if<
+                Base::template ValidType<InputTokenType>::kValue>::type>
+  bool operator==(const InputTokenType& other) const {
+    return Compare(other) == 0;
+  }
+  template <typename InputTokenType,
+            typename = typename std::enable_if<
+                Base::template ValidType<InputTokenType>::kValue>::type>
+  bool operator!=(const InputTokenType& other) const {
+    return Compare(other) != 0;
+  }
+
+  // Hash functor for use in unordered containers.
+  struct Hasher {
+    using argument_type = MultiToken;
+    using result_type = size_t;
+    result_type operator()(const MultiToken& token) const {
+      return base::UnguessableTokenHash()(token.value_);
+    }
+  };
+
+ private:
+  // The underlying untyped token value. This will *never* be null initialized.
+  base::UnguessableToken value_ = base::UnguessableToken::Create();
+
+  // The index of the variant type that is currently stored in this token.
+  uint32_t variant_index_ = 0;
+};
+
+}  // namespace blink
+
+#endif  // THIRD_PARTY_BLINK_PUBLIC_COMMON_TOKENS_MULTI_TOKEN_H_
diff --git a/third_party/blink/public/common/tokens/multi_token_internal.h b/third_party/blink/public/common/tokens/multi_token_internal.h
new file mode 100644
index 0000000..8c2f7f37
--- /dev/null
+++ b/third_party/blink/public/common/tokens/multi_token_internal.h
@@ -0,0 +1,230 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Internal implementation details for MultiToken. Only intended to be included
+// from multi_token.h.
+
+#ifndef THIRD_PARTY_BLINK_PUBLIC_COMMON_TOKENS_MULTI_TOKEN_INTERNAL_H_
+#define THIRD_PARTY_BLINK_PUBLIC_COMMON_TOKENS_MULTI_TOKEN_INTERNAL_H_
+
+#include <algorithm>
+#include <cstring>
+#include <type_traits>
+
+#include "base/unguessable_token.h"
+#include "base/util/type_safety/token_type.h"
+
+namespace blink {
+
+namespace internal {
+
+////////////////////////////////////////////////////////////////////////////////
+// MultiTokenVariantCount
+//
+// Counts the number of token types.
+
+template <typename... VariantTypes>
+struct MultiTokenVariantCount;
+
+// Recursive case.
+template <typename FirstVariantType, typename... OtherVariantTypes>
+struct MultiTokenVariantCount<FirstVariantType, OtherVariantTypes...> {
+  // Deliberately use uint32_t here so as not to incur an extra 4 bytes of
+  // overhead on 64-bit systems, as this is the same type used by the
+  // |variant_index_|.
+  static constexpr uint32_t kValue =
+      1 + MultiTokenVariantCount<OtherVariantTypes...>::kValue;
+};
+
+// Base case.
+template <>
+struct MultiTokenVariantCount<> {
+  static constexpr uint32_t kValue = 0;
+};
+
+////////////////////////////////////////////////////////////////////////////////
+// MultiTokenVariantIsTokenType
+//
+// Ensures if a QueryType is a a util::TokenType<>.
+
+// Default case.
+template <typename QueryType>
+struct MultiTokenVariantIsTokenType {
+  static constexpr bool kValue = false;
+};
+
+// Specialization for util::TokenType<>.
+template <typename TokenTypeTag>
+struct MultiTokenVariantIsTokenType<::util::TokenType<TokenTypeTag>> {
+  static constexpr bool kValue = true;
+
+  // We expect an identical layout, which allows us to reinterpret_cast between
+  // types. The spec does not guarantee this, but sane compilers do. Thankfully
+  // we can check whether or not the compiler is sane (and if the behaviour is
+  // safe) at compile-time.
+  static_assert(
+      sizeof(::util::TokenType<TokenTypeTag>) ==
+          sizeof(::base::UnguessableToken),
+      "util::TokenType must have the same sizeof as base::UnguessableToken");
+  static_assert(
+      alignof(::util::TokenType<TokenTypeTag>) ==
+          alignof(::base::UnguessableToken),
+      "util::TokenType must have the same alignof as base::UnguessableToken");
+};
+
+////////////////////////////////////////////////////////////////////////////////
+// MultiTokenAllVariantsAreTokenType
+//
+// Ensures that all variants are of type util::TokenType.
+
+template <typename... VariantTypes>
+struct MultiTokenAllVariantsAreTokenType;
+
+// Recursive case.
+template <typename FirstVariantType, typename... OtherVariantTypes>
+struct MultiTokenAllVariantsAreTokenType<FirstVariantType,
+                                         OtherVariantTypes...> {
+  static constexpr bool kValue =
+      MultiTokenVariantIsTokenType<FirstVariantType>::kValue &&
+      MultiTokenAllVariantsAreTokenType<OtherVariantTypes...>::kValue;
+};
+
+// Base case.
+template <>
+struct MultiTokenAllVariantsAreTokenType<> {
+  static constexpr bool kValue = true;
+};
+
+////////////////////////////////////////////////////////////////////////////////
+// MultiTokenTypeRepeated
+//
+// Determines if a QueryType is repeated in a variadic list of types.
+
+template <typename QueryType, typename... VariantTypes>
+struct MultiTokenTypeRepeated;
+
+// Recursive case.
+template <typename QueryType,
+          typename FirstVariantType,
+          typename... OtherVariantTypes>
+struct MultiTokenTypeRepeated<QueryType,
+                              FirstVariantType,
+                              OtherVariantTypes...> {
+  static constexpr size_t kCount =
+      (std::is_same<QueryType, FirstVariantType>::value ? 1 : 0) +
+      MultiTokenTypeRepeated<QueryType, OtherVariantTypes...>::kCount;
+  static constexpr bool kValue = kCount > 1;
+};
+
+// Base case.
+template <typename QueryType>
+struct MultiTokenTypeRepeated<QueryType> {
+  static constexpr size_t kCount = 0;
+  static constexpr bool kValue = false;
+};
+
+////////////////////////////////////////////////////////////////////////////////
+// MultiTokenAnyTypeRepeated
+//
+// Determines if any type is repeated in a variadic list of types.
+
+template <typename... VariantTypes>
+struct MultiTokenAnyTypeRepeated;
+
+// Recursive case.
+template <typename FirstVariantType, typename... OtherVariantTypes>
+struct MultiTokenAnyTypeRepeated<FirstVariantType, OtherVariantTypes...> {
+  static constexpr bool kValue =
+      MultiTokenTypeRepeated<FirstVariantType,
+                             FirstVariantType,
+                             OtherVariantTypes...>::kValue ||
+      MultiTokenAnyTypeRepeated<OtherVariantTypes...>::kValue;
+};
+
+// Base case.
+template <>
+struct MultiTokenAnyTypeRepeated<> {
+  static constexpr bool kValue = false;
+};
+
+////////////////////////////////////////////////////////////////////////////////
+// MultiTokenTypeIndex
+//
+// Returns the index of a QueryType from a variadic list of N types, or N if the
+// QueryType is not found in the list.
+
+template <typename QueryType, typename... VariantTypes>
+struct MultiTokenTypeIndex;
+
+// Recursive case.
+template <typename QueryType,
+          typename FirstVariantType,
+          typename... OtherVariantTypes>
+struct MultiTokenTypeIndex<QueryType, FirstVariantType, OtherVariantTypes...> {
+  static constexpr size_t kValue =
+      (std::is_same<QueryType, FirstVariantType>::value
+           ? 0
+           : (1 +
+              MultiTokenTypeIndex<QueryType, OtherVariantTypes...>::kValue));
+};
+
+// Base case.
+template <typename QueryType>
+struct MultiTokenTypeIndex<QueryType> {
+  static constexpr size_t kValue = 0;
+};
+
+////////////////////////////////////////////////////////////////////////////////
+// MultiTokenBase
+//
+// Base class that brings helper structs into a single namespace for
+// convenience.
+template <typename... TokenVariants>
+class MultiTokenBase {
+ public:
+  // Ensures that no types are repeated, as that's non-sensical.
+  using AnyRepeated = internal::MultiTokenAnyTypeRepeated<TokenVariants...>;
+  static_assert(!AnyRepeated::kValue, "input types must not be repeated");
+
+  // Ensures that all variants are instances of util::TokenType.
+  using AllVariantsAreTokenType =
+      internal::MultiTokenAllVariantsAreTokenType<TokenVariants...>;
+  static_assert(AllVariantsAreTokenType::kValue,
+                "input types must be instances of util::TokenType");
+
+  // Counts the number of variants.
+  using VariantCount = internal::MultiTokenVariantCount<TokenVariants...>;
+
+  // For determining the index of a type. Used to assign an integer ID to a
+  // type, as a kind of untyped enum.
+  template <typename QueryType>
+  struct TypeIndex
+      : public internal::MultiTokenTypeIndex<QueryType, TokenVariants...> {};
+
+  // For determining if a type is valid for this variant. Useful in enable_if
+  // statements.
+  template <typename QueryType>
+  struct ValidType {
+    static constexpr bool kValue =
+        TypeIndex<QueryType>::kValue != VariantCount::kValue;
+  };
+
+  // Helper comparator. Compares underlying types using only < and == to
+  // return -1, 0, or 1 depending on their relative values.
+  template <typename InputType>
+  static int CompareImpl(const InputType& lhs, const InputType& rhs) {
+    if (lhs < rhs)
+      return -1;
+    if (lhs == rhs)
+      return 0;
+    DCHECK(rhs < lhs);
+    return 1;
+  }
+};
+
+}  // namespace internal
+
+}  // namespace blink
+
+#endif  // THIRD_PARTY_BLINK_PUBLIC_COMMON_TOKENS_MULTI_TOKEN_INTERNAL_H_
diff --git a/third_party/blink/public/devtools_protocol/browser_protocol.pdl b/third_party/blink/public/devtools_protocol/browser_protocol.pdl
index 544a487..8a7a058 100644
--- a/third_party/blink/public/devtools_protocol/browser_protocol.pdl
+++ b/third_party/blink/public/devtools_protocol/browser_protocol.pdl
@@ -623,6 +623,7 @@
       ContentSecurityPolicyViolationType contentSecurityPolicyViolationType
       optional AffectedFrame frameAncestor
       optional SourceCodeLocation sourceCodeLocation
+      optional integer violatingNodeId
 
   # A unique identifier for the type of issue. Each type may use one of the
   # optional fields in InspectorIssueDetails to convey more specific
diff --git a/third_party/blink/public/mojom/devtools/inspector_issue.mojom b/third_party/blink/public/mojom/devtools/inspector_issue.mojom
index bc216a49..deb59e2 100644
--- a/third_party/blink/public/mojom/devtools/inspector_issue.mojom
+++ b/third_party/blink/public/mojom/devtools/inspector_issue.mojom
@@ -82,6 +82,8 @@
   ContentSecurityPolicyViolationType content_security_policy_violation_type;
   AffectedFrame? frame_ancestor;
   network.mojom.SourceLocation? source_location;
+  // 0 is not a valid node id and is used to indicate absence.
+  int32 violating_node_id = 0;
 };
 
 enum SameSiteCookieOperation {
diff --git a/third_party/blink/public/mojom/web_feature/web_feature.mojom b/third_party/blink/public/mojom/web_feature/web_feature.mojom
index 450ef426..4ebb83bf 100644
--- a/third_party/blink/public/mojom/web_feature/web_feature.mojom
+++ b/third_party/blink/public/mojom/web_feature/web_feature.mojom
@@ -2693,6 +2693,7 @@
   kMainFrameCSPViaOriginPolicy = 3361,
   kHtmlClipboardApiRead = 3362,
   kHtmlClipboardApiWrite = 3363,
+  kCSSSystemColorComputeToSelf = 3364,
 
   // Add new features immediately above this line. Don't change assigned
   // numbers of any item, and don't reuse removed slots.
diff --git a/third_party/blink/public/web/web_navigation_params.h b/third_party/blink/public/web/web_navigation_params.h
index 9b020fd9..27539d30 100644
--- a/third_party/blink/public/web/web_navigation_params.h
+++ b/third_party/blink/public/web/web_navigation_params.h
@@ -391,8 +391,9 @@
   // A list of origin trial names to enable for the document being loaded.
   WebVector<WebString> force_enabled_origin_trials;
 
-  // Whether origin isolation is restricting certain cross-origin web APIs.
-  bool origin_isolation_restricted = false;
+  // Whether the page is origin isolated.
+  // https://github.com/WICG/origin-isolation
+  bool origin_isolated = false;
 
   // List of client hints enabled for top-level frame. These still need to be
   // checked against feature policy before use.
diff --git a/third_party/blink/renderer/bindings/core/v8/script_controller.cc b/third_party/blink/renderer/bindings/core/v8/script_controller.cc
index b76aeb8..98b409b 100644
--- a/third_party/blink/renderer/bindings/core/v8/script_controller.cc
+++ b/third_party/blink/renderer/bindings/core/v8/script_controller.cc
@@ -61,6 +61,7 @@
 #include "third_party/blink/renderer/core/loader/frame_loader.h"
 #include "third_party/blink/renderer/core/loader/progress_tracker.h"
 #include "third_party/blink/renderer/core/probe/core_probes.h"
+#include "third_party/blink/renderer/core/script/classic_script.h"
 #include "third_party/blink/renderer/platform/bindings/dom_wrapper_world.h"
 #include "third_party/blink/renderer/platform/instrumentation/histogram.h"
 #include "third_party/blink/renderer/platform/instrumentation/tracing/trace_event.h"
@@ -290,21 +291,23 @@
 
   bool had_navigation_before = GetFrame()->Loader().HasProvisionalNavigation();
 
-  v8::HandleScope handle_scope(GetIsolate());
+  // https://html.spec.whatwg.org/multipage/browsing-the-web.html#javascript-protocol
+  // Step 6. "Let baseURL be settings's API base URL." [spec text]
+  const KURL base_url = GetFrame()->GetDocument()->BaseURL();
 
-  // https://html.spec.whatwg.org/C/#navigate
-  // Step 12.8 "Let base URL be settings object's API base URL." [spec text]
-  KURL base_url = GetFrame()->GetDocument()->BaseURL();
-
-  // Step 12.9 "Let script be result of creating a classic script given script
-  // source, settings, base URL, and the default classic script fetch options."
-  // [spec text]
+  // Step 7. "Let script be the result of creating a classic script given
+  // scriptSource, settings, baseURL, and the default classic script fetch
+  // options." [spec text]
+  //
   // We pass |SanitizeScriptErrors::kDoNotSanitize| because |muted errors| is
   // false by default.
-  v8::Local<v8::Value> v8_result = EvaluateScriptInMainWorld(
+  ClassicScript* script = MakeGarbageCollected<ClassicScript>(
       ScriptSourceCode(script_source, ScriptSourceLocationType::kJavascriptUrl),
-      base_url, SanitizeScriptErrors::kDoNotSanitize, ScriptFetchOptions(),
-      kDoNotExecuteScriptWhenScriptsDisabled);
+      base_url, ScriptFetchOptions(), SanitizeScriptErrors::kDoNotSanitize);
+
+  DCHECK_EQ(&GetFrame()->GetScriptController(), this);
+  v8::HandleScope handle_scope(GetIsolate());
+  v8::Local<v8::Value> v8_result = script->RunScriptAndReturnValue(GetFrame());
   UseCounter::Count(*GetFrame()->GetDocument(),
                     WebFeature::kExecutedJavaScriptURL);
 
@@ -355,11 +358,11 @@
     const ScriptSourceCode& source_code,
     const KURL& base_url,
     SanitizeScriptErrors sanitize_script_errors,
-    const ScriptFetchOptions& fetch_options) {
+    const ScriptFetchOptions& fetch_options,
+    ExecuteScriptPolicy policy) {
   v8::HandleScope handle_scope(GetIsolate());
   EvaluateScriptInMainWorld(source_code, base_url, sanitize_script_errors,
-                            fetch_options,
-                            kDoNotExecuteScriptWhenScriptsDisabled);
+                            fetch_options, policy);
 }
 
 v8::Local<v8::Value> ScriptController::ExecuteScriptInMainWorldAndReturnValue(
diff --git a/third_party/blink/renderer/bindings/core/v8/script_controller.h b/third_party/blink/renderer/bindings/core/v8/script_controller.h
index 67d188e1..efebf482d 100644
--- a/third_party/blink/renderer/bindings/core/v8/script_controller.h
+++ b/third_party/blink/renderer/bindings/core/v8/script_controller.h
@@ -86,7 +86,8 @@
       const ScriptSourceCode&,
       const KURL& base_url,
       SanitizeScriptErrors,
-      const ScriptFetchOptions& = ScriptFetchOptions());
+      const ScriptFetchOptions& = ScriptFetchOptions(),
+      ExecuteScriptPolicy = kDoNotExecuteScriptWhenScriptsDisabled);
   v8::Local<v8::Value> ExecuteScriptInMainWorldAndReturnValue(
       const ScriptSourceCode&,
       const KURL& base_url,
diff --git a/third_party/blink/renderer/bindings/core/v8/worker_or_worklet_script_controller.cc b/third_party/blink/renderer/bindings/core/v8/worker_or_worklet_script_controller.cc
index 72b80a1..a138c265 100644
--- a/third_party/blink/renderer/bindings/core/v8/worker_or_worklet_script_controller.cc
+++ b/third_party/blink/renderer/bindings/core/v8/worker_or_worklet_script_controller.cc
@@ -433,7 +433,6 @@
                                state.exception, world_.get());
       }
     } else {
-      DCHECK_EQ(sanitize_script_errors, SanitizeScriptErrors::kDoNotSanitize);
       ErrorEvent* event = nullptr;
       if (state.error_event_from_imported_script_) {
         event = state.error_event_from_imported_script_;
diff --git a/third_party/blink/renderer/controller/dev_tools_frontend_impl.cc b/third_party/blink/renderer/controller/dev_tools_frontend_impl.cc
index 2466870..257aad1 100644
--- a/third_party/blink/renderer/controller/dev_tools_frontend_impl.cc
+++ b/third_party/blink/renderer/controller/dev_tools_frontend_impl.cc
@@ -30,7 +30,6 @@
 
 #include "third_party/blink/renderer/controller/dev_tools_frontend_impl.h"
 
-#include "third_party/blink/renderer/bindings/core/v8/script_controller.h"
 #include "third_party/blink/renderer/bindings/core/v8/v8_binding_for_core.h"
 #include "third_party/blink/renderer/bindings/core/v8/v8_dev_tools_host.h"
 #include "third_party/blink/renderer/core/exported/web_view_impl.h"
@@ -39,6 +38,7 @@
 #include "third_party/blink/renderer/core/frame/web_local_frame_impl.h"
 #include "third_party/blink/renderer/core/inspector/dev_tools_host.h"
 #include "third_party/blink/renderer/core/page/page.h"
+#include "third_party/blink/renderer/core/script/classic_script.h"
 
 namespace blink {
 
@@ -98,8 +98,8 @@
   }
 
   if (!api_script_.IsEmpty()) {
-    GetSupplementable()->GetScriptController().ExecuteScriptInMainWorld(
-        api_script_);
+    ClassicScript::CreateUnspecifiedScript(ScriptSourceCode(api_script_))
+        ->RunScript(GetSupplementable());
   }
 }
 
diff --git a/third_party/blink/renderer/core/animation/README.md b/third_party/blink/renderer/core/animation/README.md
index 10dc3e3..56c167e 100644
--- a/third_party/blink/renderer/core/animation/README.md
+++ b/third_party/blink/renderer/core/animation/README.md
@@ -319,7 +319,7 @@
 derived classes. Refer to the web-animation section under animation types for a
 description of Element.animate.
 
-The animatable interface also includes a getAniamtions method, which returns all
+The animatable interface also includes a getAnimations method, which returns all
 active animations associated with the element in composite ordering. The rules
 for composite ordering are quite involved and presently span three
 specifications:
@@ -1143,7 +1143,7 @@
 [DocumentAnimations::getAnimations]: https://cs.chromium.org/search/?q=function:blink::DocumentAnimations::getAnimations$
 
 
-# The interpolation stack
+## The interpolation stack
 
 Animation keyframes serve as mileposts indicating property values at specific
 points through the progress of the animation. Most commonly, keyframes are
@@ -1254,7 +1254,7 @@
    // Styles are flushed when retrieving the list of animations. The left and
    // top transitions are created within the same style update and thus sorted
    // alphabetically.
-   const transitions = div.getAniamtions();
+   const transitions = div.getAnimations();
    assert_equals(transitions[0].transitionProperty, 'left');
    assert_equals(transitions[1].transitionProperty, 'top');
 
@@ -1262,7 +1262,7 @@
 
    // The opacity transition is at the end since created in a separate style
    // update cycle.
-   const updated_transitions = div.getAniamtions();
+   const updated_transitions = div.getAnimations();
    assert_equals(transitions[0].transitionProperty, 'left');
    assert_equals(transitions[1].transitionProperty, 'top');
    assert_equals(transitions[1].transitionProperty, 'opacity');
@@ -1271,7 +1271,7 @@
 CSS animations that are applied to a single element are ordered by index within
 the animation-name property. Pseudo-element selectors have a strict ordering by
 selector name. CSS animations applying to different elements are sorted in DOM
-order. Note that the DOM order sort is only applied for getAniamtions calls as
+order. Note that the DOM order sort is only applied for getAnimations calls as
 it is too expensive too apply in general and does not affect rendering if
 internally sorted for style calculations in creation order instead.
 
diff --git a/third_party/blink/renderer/core/animation/animation_test_helper.cc b/third_party/blink/renderer/core/animation/animation_test_helper.cc
index c30e8111..1a7a2917 100644
--- a/third_party/blink/renderer/core/animation/animation_test_helper.cc
+++ b/third_party/blink/renderer/core/animation/animation_test_helper.cc
@@ -61,7 +61,7 @@
   return MakeGarbageCollected<KeyframeEffect>(target, model, timing);
 }
 
-void EnsureInterpolatedValueCached(const ActiveInterpolations& interpolations,
+void EnsureInterpolatedValueCached(ActiveInterpolations* interpolations,
                                    Document& document,
                                    Element* element) {
   // TODO(smcgruer): We should be able to use a saner API approach like
diff --git a/third_party/blink/renderer/core/animation/animation_test_helper.h b/third_party/blink/renderer/core/animation/animation_test_helper.h
index d1ba4a8..49ab1cad 100644
--- a/third_party/blink/renderer/core/animation/animation_test_helper.h
+++ b/third_party/blink/renderer/core/animation/animation_test_helper.h
@@ -38,9 +38,7 @@
 //
 // All members of the ActiveInterpolations must be instances of
 // InvalidatableInterpolation.
-void EnsureInterpolatedValueCached(const ActiveInterpolations&,
-                                   Document&,
-                                   Element*);
+void EnsureInterpolatedValueCached(ActiveInterpolations*, Document&, Element*);
 }  // namespace blink
 
 #endif  // THIRD_PARTY_BLINK_RENDERER_CORE_ANIMATION_ANIMATION_TEST_HELPER_H_
diff --git a/third_party/blink/renderer/core/animation/animation_utils_test.cc b/third_party/blink/renderer/core/animation/animation_utils_test.cc
index bc30f20..968fe780 100644
--- a/third_party/blink/renderer/core/animation/animation_utils_test.cc
+++ b/third_party/blink/renderer/core/animation/animation_utils_test.cc
@@ -38,9 +38,9 @@
   void AddInterpolation(ActiveInterpolationsMap& interpolations_map,
                         const StringKeyframeVector& keyframes,
                         PropertyHandle property_handle) {
-    ActiveInterpolationsMap::AddResult entry =
-        interpolations_map.insert(property_handle, ActiveInterpolations());
-    ActiveInterpolations& active_interpolations = entry.stored_value->value;
+    ActiveInterpolationsMap::AddResult entry = interpolations_map.insert(
+        property_handle, MakeGarbageCollected<ActiveInterpolations>());
+    ActiveInterpolations* active_interpolations = entry.stored_value->value;
 
     PropertySpecificKeyframe* from_keyframe =
         CreatePropertySpecificKeyframe(keyframes[0], property_handle, 0);
@@ -51,7 +51,7 @@
         MakeGarbageCollected<InvalidatableInterpolation>(
             property_handle, from_keyframe, to_keyframe);
     interpolation->Interpolate(/*iteration=*/0, /*progress=*/1);
-    active_interpolations.push_back(interpolation);
+    active_interpolations->push_back(interpolation);
   }
 
   PropertySpecificKeyframe* CreatePropertySpecificKeyframe(
diff --git a/third_party/blink/renderer/core/animation/css/css_animation_update.cc b/third_party/blink/renderer/core/animation/css/css_animation_update.cc
index 98dff85e..8fd81d08 100644
--- a/third_party/blink/renderer/core/animation/css/css_animation_update.cc
+++ b/third_party/blink/renderer/core/animation/css/css_animation_update.cc
@@ -55,14 +55,14 @@
     scoped_refptr<const ComputedStyle> reversing_adjusted_start_value,
     double reversing_shortening_factor,
     const InertEffect& effect) {
-  NewTransition new_transition;
-  new_transition.property = property;
-  new_transition.from = std::move(from);
-  new_transition.to = std::move(to);
-  new_transition.reversing_adjusted_start_value =
+  NewTransition* new_transition = MakeGarbageCollected<NewTransition>();
+  new_transition->property = property;
+  new_transition->from = std::move(from);
+  new_transition->to = std::move(to);
+  new_transition->reversing_adjusted_start_value =
       std::move(reversing_adjusted_start_value);
-  new_transition.reversing_shortening_factor = reversing_shortening_factor;
-  new_transition.effect = &effect;
+  new_transition->reversing_shortening_factor = reversing_shortening_factor;
+  new_transition->effect = &effect;
   new_transitions_.Set(property, new_transition);
 }
 
diff --git a/third_party/blink/renderer/core/animation/css/css_animation_update.h b/third_party/blink/renderer/core/animation/css/css_animation_update.h
index 9e83651..cb7283e1 100644
--- a/third_party/blink/renderer/core/animation/css/css_animation_update.h
+++ b/third_party/blink/renderer/core/animation/css/css_animation_update.h
@@ -183,12 +183,10 @@
     return updated_compositor_keyframes_;
   }
 
-  struct NewTransition {
-    DISALLOW_NEW();
-
+  struct NewTransition : public GarbageCollected<NewTransition> {
    public:
     NewTransition();
-    ~NewTransition();
+    virtual ~NewTransition();
     void Trace(Visitor* visitor) const { visitor->Trace(effect); }
 
     PropertyHandle property = HashTraits<blink::PropertyHandle>::EmptyValue();
@@ -198,7 +196,7 @@
     double reversing_shortening_factor;
     Member<const InertEffect> effect;
   };
-  using NewTransitionMap = HeapHashMap<PropertyHandle, NewTransition>;
+  using NewTransitionMap = HeapHashMap<PropertyHandle, Member<NewTransition>>;
   const NewTransitionMap& NewTransitions() const { return new_transitions_; }
   const HashSet<PropertyHandle>& CancelledTransitions() const {
     return cancelled_transitions_;
diff --git a/third_party/blink/renderer/core/animation/css/css_animations.cc b/third_party/blink/renderer/core/animation/css/css_animations.cc
index eca9a55..585d642 100644
--- a/third_party/blink/renderer/core/animation/css/css_animations.cc
+++ b/third_party/blink/renderer/core/animation/css/css_animations.cc
@@ -836,7 +836,7 @@
     snapshot(updated_animation.effect.Get());
 
   for (const auto& new_transition : update.NewTransitions())
-    snapshot(new_transition.value.effect.Get());
+    snapshot(new_transition.value->effect.Get());
 }
 
 void CSSAnimations::MaybeApplyPendingUpdate(Element* element) {
@@ -926,7 +926,7 @@
        pending_update_.CancelledTransitions()) {
     DCHECK(transitions_.Contains(property));
 
-    Animation* animation = transitions_.Take(property).animation;
+    Animation* animation = transitions_.Take(property)->animation;
     auto* effect = To<KeyframeEffect>(animation->effect());
     if (effect && effect->HasActiveAnimationsOnCompositor(property) &&
         pending_update_.NewTransitions().find(property) !=
@@ -947,7 +947,7 @@
   for (const PropertyHandle& property : pending_update_.FinishedTransitions()) {
     // This transition can also be cancelled and finished at the same time
     if (transitions_.Contains(property)) {
-      Animation* animation = transitions_.Take(property).animation;
+      Animation* animation = transitions_.Take(property)->animation;
       // Transition must be downgraded
       if (auto* effect = DynamicTo<KeyframeEffect>(animation->effect()))
         effect->DowngradeToNormal();
@@ -961,18 +961,19 @@
   }
 
   for (const auto& entry : pending_update_.NewTransitions()) {
-    const CSSAnimationUpdate::NewTransition& new_transition = entry.value;
+    const CSSAnimationUpdate::NewTransition* new_transition = entry.value;
 
-    RunningTransition running_transition;
-    running_transition.from = new_transition.from;
-    running_transition.to = new_transition.to;
-    running_transition.reversing_adjusted_start_value =
-        new_transition.reversing_adjusted_start_value;
-    running_transition.reversing_shortening_factor =
-        new_transition.reversing_shortening_factor;
+    RunningTransition* running_transition =
+        MakeGarbageCollected<RunningTransition>();
+    running_transition->from = new_transition->from;
+    running_transition->to = new_transition->to;
+    running_transition->reversing_adjusted_start_value =
+        new_transition->reversing_adjusted_start_value;
+    running_transition->reversing_shortening_factor =
+        new_transition->reversing_shortening_factor;
 
-    const PropertyHandle& property = new_transition.property;
-    const InertEffect* inert_animation = new_transition.effect.Get();
+    const PropertyHandle& property = new_transition->property;
+    const InertEffect* inert_animation = new_transition->effect.Get();
     TransitionEventDelegate* event_delegate =
         MakeGarbageCollected<TransitionEventDelegate>(element, property);
 
@@ -994,7 +995,7 @@
       animation->setStartTime(element->GetDocument().Timeline().currentTime());
     }
     animation->Update(kTimingUpdateOnDemand);
-    running_transition.animation = animation;
+    running_transition->animation = animation;
     transitions_.Set(property, running_transition);
     DCHECK(isValidCSSPropertyID(property.GetCSSProperty().PropertyID()));
     element->GetDocument().CountAnimatedProperty(
@@ -1038,7 +1039,7 @@
         state.active_transitions->find(property);
     if (active_transition_iter != state.active_transitions->end()) {
       const RunningTransition* running_transition =
-          &active_transition_iter->value;
+          active_transition_iter->value;
       if (CSSPropertyEquality::PropertiesEqual(property, state.style,
                                                *running_transition->to)) {
         return;
@@ -1325,7 +1326,7 @@
           UseCounter::Count(animating_element->GetDocument(),
                             WebFeature::kCSSTransitionCancelledByRemovingStyle);
         }
-      } else if (entry.value.animation->FinishedInternal()) {
+      } else if (entry.value->animation->FinishedInternal()) {
         update.FinishTransition(property);
       }
     }
@@ -1350,8 +1351,8 @@
     // all declarative animations. Currently, only including transitions.
     HeapVector<Member<Animation>> animations;
     for (const auto& entry : transition_map) {
-      RunningTransition transition = entry.value;
-      Animation* animation = transition.animation;
+      RunningTransition* transition = entry.value;
+      Animation* animation = transition->animation;
       animations.push_back(animation);
     }
     std::sort(animations.begin(), animations.end(),
@@ -1379,10 +1380,10 @@
 
       for (const auto& interpolation : sample) {
         PropertyHandle handle = interpolation->GetProperty();
-        auto interpolation_map_entry =
-            interpolations_map.insert(handle, ActiveInterpolations());
+        auto interpolation_map_entry = interpolations_map.insert(
+            handle, MakeGarbageCollected<ActiveInterpolations>());
         auto& active_interpolations =
-            interpolation_map_entry.stored_value->value;
+            *interpolation_map_entry.stored_value->value;
         if (!interpolation->DependsOnUnderlyingValue())
           active_interpolations.clear();
         active_interpolations.push_back(interpolation);
@@ -1402,8 +1403,8 @@
   }
 
   for (const auto& entry : transitions_) {
-    entry.value.animation->cancel();
-    entry.value.animation->Update(kTimingUpdateOnDemand);
+    entry.value->animation->cancel();
+    entry.value->animation->Update(kTimingUpdateOnDemand);
   }
 
   running_animations_.clear();
@@ -1513,7 +1514,7 @@
   } else {
     HeapVector<Member<const InertEffect>> new_transitions;
     for (const auto& entry : update.NewTransitions())
-      new_transitions.push_back(entry.value.effect.Get());
+      new_transitions.push_back(entry.value->effect.Get());
 
     HeapHashSet<Member<const Animation>> cancelled_animations;
     if (!update.CancelledTransitions().IsEmpty()) {
@@ -1523,7 +1524,7 @@
       for (const PropertyHandle& property : update.CancelledTransitions()) {
         DCHECK(transition_map.Contains(property));
         cancelled_animations.insert(
-            transition_map.at(property).animation.Get());
+            transition_map.at(property)->animation.Get());
       }
     }
 
diff --git a/third_party/blink/renderer/core/animation/css/css_animations.h b/third_party/blink/renderer/core/animation/css/css_animations.h
index 6c7ea3c..a0ffc01 100644
--- a/third_party/blink/renderer/core/animation/css/css_animations.h
+++ b/third_party/blink/renderer/core/animation/css/css_animations.h
@@ -151,10 +151,10 @@
     Vector<EAnimPlayState> play_state_list;
   };
 
-  struct RunningTransition {
-    DISALLOW_NEW();
-
+  struct RunningTransition : public GarbageCollected<RunningTransition> {
    public:
+    virtual ~RunningTransition() = default;
+
     void Trace(Visitor* visitor) const { visitor->Trace(animation); }
 
     Member<Animation> animation;
@@ -166,7 +166,7 @@
 
   HeapVector<Member<RunningAnimation>> running_animations_;
 
-  using TransitionMap = HeapHashMap<PropertyHandle, RunningTransition>;
+  using TransitionMap = HeapHashMap<PropertyHandle, Member<RunningTransition>>;
   TransitionMap transitions_;
 
   CSSAnimationUpdate pending_update_;
diff --git a/third_party/blink/renderer/core/animation/effect_stack.cc b/third_party/blink/renderer/core/animation/effect_stack.cc
index a3d51a451..0b5911b 100644
--- a/third_party/blink/renderer/core/animation/effect_stack.cc
+++ b/third_party/blink/renderer/core/animation/effect_stack.cc
@@ -50,8 +50,8 @@
       continue;
 
     ActiveInterpolationsMap::AddResult entry =
-        target.insert(property, ActiveInterpolations());
-    ActiveInterpolations& active_interpolations = entry.stored_value->value;
+        target.insert(property, MakeGarbageCollected<ActiveInterpolations>());
+    ActiveInterpolations* active_interpolations = entry.stored_value->value;
 
     // Assuming stacked effects are enabled, interpolations that depend on
     // underlying values (e.g. have a non-replace composite mode) should be
@@ -66,8 +66,8 @@
         To<InvalidatableInterpolation>(*interpolation.Get())
             .DependsOnUnderlyingValue();
     if (!allow_stacked_effects || !effect_depends_on_underlying_value)
-      active_interpolations.clear();
-    active_interpolations.push_back(interpolation);
+      active_interpolations->clear();
+    active_interpolations->push_back(interpolation);
   }
 }
 
diff --git a/third_party/blink/renderer/core/animation/effect_stack_test.cc b/third_party/blink/renderer/core/animation/effect_stack_test.cc
index c74693b0..de28526 100644
--- a/third_party/blink/renderer/core/animation/effect_stack_test.cc
+++ b/third_party/blink/renderer/core/animation/effect_stack_test.cc
@@ -80,12 +80,12 @@
 
   double GetFontSizeValue(
       const ActiveInterpolationsMap& active_interpolations) {
-    const ActiveInterpolations& interpolations =
+    ActiveInterpolations* interpolations =
         active_interpolations.at(PropertyHandle(GetCSSPropertyFontSize()));
     EnsureInterpolatedValueCached(interpolations, GetDocument(), element);
 
     const auto* typed_value =
-        To<InvalidatableInterpolation>(*interpolations.at(0))
+        To<InvalidatableInterpolation>(*interpolations->at(0))
             .GetCachedValueForTesting();
     // font-size is stored as an |InterpolableLength|; here we assume pixels.
     EXPECT_TRUE(typed_value->GetInterpolableValue().IsLength());
@@ -95,12 +95,12 @@
   }
 
   double GetZIndexValue(const ActiveInterpolationsMap& active_interpolations) {
-    const ActiveInterpolations& interpolations =
+    ActiveInterpolations* interpolations =
         active_interpolations.at(PropertyHandle(GetCSSPropertyZIndex()));
     EnsureInterpolatedValueCached(interpolations, GetDocument(), element);
 
     const auto* typed_value =
-        To<InvalidatableInterpolation>(*interpolations.at(0))
+        To<InvalidatableInterpolation>(*interpolations->at(0))
             .GetCachedValueForTesting();
     // z-index is stored as a straight number value.
     EXPECT_TRUE(typed_value->GetInterpolableValue().IsNumber());
diff --git a/third_party/blink/renderer/core/animation/interpolation.h b/third_party/blink/renderer/core/animation/interpolation.h
index 1f511cd3..f70e08fb 100644
--- a/third_party/blink/renderer/core/animation/interpolation.h
+++ b/third_party/blink/renderer/core/animation/interpolation.h
@@ -83,7 +83,7 @@
 
 using ActiveInterpolations = HeapVector<Member<Interpolation>, 1>;
 using ActiveInterpolationsMap =
-    HeapHashMap<PropertyHandle, ActiveInterpolations>;
+    HeapHashMap<PropertyHandle, Member<ActiveInterpolations>>;
 
 }  // namespace blink
 
diff --git a/third_party/blink/renderer/core/animation/keyframe_effect_model_test.cc b/third_party/blink/renderer/core/animation/keyframe_effect_model_test.cc
index 95150de..13115a93 100644
--- a/third_party/blink/renderer/core/animation/keyframe_effect_model_test.cc
+++ b/third_party/blink/renderer/core/animation/keyframe_effect_model_test.cc
@@ -64,8 +64,9 @@
 
   void ExpectLengthValue(double expected_value,
                          Interpolation* interpolation_value) {
-    ActiveInterpolations interpolations;
-    interpolations.push_back(interpolation_value);
+    ActiveInterpolations* interpolations =
+        MakeGarbageCollected<ActiveInterpolations>();
+    interpolations->push_back(interpolation_value);
     EnsureInterpolatedValueCached(interpolations, GetDocument(), element);
 
     const auto* typed_value =
@@ -85,8 +86,9 @@
 
   void ExpectNonInterpolableValue(const String& expected_value,
                                   Interpolation* interpolation_value) {
-    ActiveInterpolations interpolations;
-    interpolations.push_back(interpolation_value);
+    ActiveInterpolations* interpolations =
+        MakeGarbageCollected<ActiveInterpolations>();
+    interpolations->push_back(interpolation_value);
     EnsureInterpolatedValueCached(interpolations, GetDocument(), element);
 
     const auto* typed_value =
diff --git a/third_party/blink/renderer/core/animation/scroll_timeline.cc b/third_party/blink/renderer/core/animation/scroll_timeline.cc
index 0af4c19..30bbc29 100644
--- a/third_party/blink/renderer/core/animation/scroll_timeline.cc
+++ b/third_party/blink/renderer/core/animation/scroll_timeline.cc
@@ -27,7 +27,8 @@
 
 namespace {
 using ScrollTimelineSet =
-    HeapHashMap<WeakMember<Node>, HeapHashSet<WeakMember<ScrollTimeline>>>;
+    HeapHashMap<WeakMember<Node>,
+                Member<HeapHashSet<WeakMember<ScrollTimeline>>>>;
 ScrollTimelineSet& GetScrollTimelineSet() {
   DEFINE_STATIC_LOCAL(Persistent<ScrollTimelineSet>, set,
                       (MakeGarbageCollected<ScrollTimelineSet>()));
@@ -198,11 +199,12 @@
   if (resolved_scroll_source_) {
     ScrollTimelineSet& set = GetScrollTimelineSet();
     if (!set.Contains(resolved_scroll_source_)) {
-      set.insert(resolved_scroll_source_,
-                 HeapHashSet<WeakMember<ScrollTimeline>>());
+      set.insert(
+          resolved_scroll_source_,
+          MakeGarbageCollected<HeapHashSet<WeakMember<ScrollTimeline>>>());
     }
     auto it = set.find(resolved_scroll_source_);
-    it->value.insert(this);
+    it->value->insert(this);
   }
   SnapshotState();
 }
@@ -518,7 +520,7 @@
   if (it == set.end())
     return false;
 
-  for (auto& timeline : it->value) {
+  for (auto& timeline : *it->value) {
     if (timeline->HasAnimations())
       return true;
   }
@@ -532,7 +534,7 @@
   if (it == set.end())
     return;
 
-  for (auto& timeline : it->value) {
+  for (auto& timeline : *it->value) {
     timeline->Invalidate();
   }
 }
diff --git a/third_party/blink/renderer/core/css/resolver/style_builder_converter.cc b/third_party/blink/renderer/core/css/resolver/style_builder_converter.cc
index c13f123..8a5dfbf 100644
--- a/third_party/blink/renderer/core/css/resolver/style_builder_converter.cc
+++ b/third_party/blink/renderer/core/css/resolver/style_builder_converter.cc
@@ -1529,6 +1529,20 @@
   return array;
 }
 
+void StyleBuilderConverter::CountSystemColorComputeToSelfUsage(
+    const StyleResolverState& state) {
+  // Count cases where a system color keyword is used on an element whose
+  // color-scheme is different from its parent.
+  // This is a superset of when the feature will change the resolved color
+  // (inheriting the keyword is also required) but it should be a reasonable
+  // approximation for use counting purposes.
+  if (state.Style()->ComputedColorScheme() !=
+      state.ParentStyle()->ComputedColorScheme()) {
+    UseCounter::Count(state.GetDocument(),
+                      WebFeature::kCSSSystemColorComputeToSelf);
+  }
+}
+
 StyleColor StyleBuilderConverter::ConvertStyleColor(StyleResolverState& state,
                                                     const CSSValue& value,
                                                     bool for_visited_link) {
@@ -1537,9 +1551,10 @@
     CSSValueID value_id = identifier_value->GetValueID();
     if (value_id == CSSValueID::kCurrentcolor)
       return StyleColor::CurrentColor();
-    if (StyleColor::IsSystemColor(value_id) &&
-        RuntimeEnabledFeatures::CSSSystemColorComputeToSelfEnabled()) {
-      return StyleColor(value_id);
+    if (StyleColor::IsSystemColor(value_id)) {
+      CountSystemColorComputeToSelfUsage(state);
+      if (RuntimeEnabledFeatures::CSSSystemColorComputeToSelfEnabled())
+        return StyleColor(value_id);
     }
   }
   return StyleColor(state.GetDocument().GetTextLinkColors().ColorFromCSSValue(
@@ -1563,9 +1578,10 @@
       return StyleAutoColor::CurrentColor();
     if (value_id == CSSValueID::kAuto)
       return StyleAutoColor::AutoColor();
-    if (StyleColor::IsSystemColor(value_id) &&
-        RuntimeEnabledFeatures::CSSSystemColorComputeToSelfEnabled()) {
-      return StyleAutoColor(value_id);
+    if (StyleColor::IsSystemColor(value_id)) {
+      CountSystemColorComputeToSelfUsage(state);
+      if (RuntimeEnabledFeatures::CSSSystemColorComputeToSelfEnabled())
+        return StyleAutoColor(value_id);
     }
   }
   return StyleAutoColor(
diff --git a/third_party/blink/renderer/core/css/resolver/style_builder_converter.h b/third_party/blink/renderer/core/css/resolver/style_builder_converter.h
index ffca6d1..92ff03c 100644
--- a/third_party/blink/renderer/core/css/resolver/style_builder_converter.h
+++ b/third_party/blink/renderer/core/css/resolver/style_builder_converter.h
@@ -293,6 +293,9 @@
 
   static ScrollbarGutter ConvertScrollbarGutter(StyleResolverState& state,
                                                 const CSSValue& value);
+
+  static void CountSystemColorComputeToSelfUsage(
+      const StyleResolverState& state);
 };
 
 template <typename T>
diff --git a/third_party/blink/renderer/core/css/resolver/style_cascade.cc b/third_party/blink/renderer/core/css/resolver/style_cascade.cc
index 4797fba..df50839 100644
--- a/third_party/blink/renderer/core/css/resolver/style_cascade.cc
+++ b/third_party/blink/renderer/core/css/resolver/style_cascade.cc
@@ -385,7 +385,7 @@
     }
     *p = priority;
 
-    ApplyInterpolation(property, priority, entry.value, resolver);
+    ApplyInterpolation(property, priority, *entry.value, resolver);
   }
 }
 
@@ -496,7 +496,7 @@
   PropertyHandle handle = ToPropertyHandle(property, priority);
   const auto& entry = map.find(handle);
   DCHECK_NE(entry, map.end());
-  ApplyInterpolation(property, priority, entry->value, resolver);
+  ApplyInterpolation(property, priority, *entry->value, resolver);
 }
 
 bool StyleCascade::IsRootElement() const {
diff --git a/third_party/blink/renderer/core/css/resolver/style_rule_usage_tracker.cc b/third_party/blink/renderer/core/css/resolver/style_rule_usage_tracker.cc
index c854c5e..c7db43f 100644
--- a/third_party/blink/renderer/core/css/resolver/style_rule_usage_tracker.cc
+++ b/third_party/blink/renderer/core/css/resolver/style_rule_usage_tracker.cc
@@ -34,11 +34,12 @@
     return;
   auto it = used_rules_delta_.find(parent_sheet);
   if (it != used_rules_delta_.end()) {
-    it->value.push_back(rule);
+    it->value->push_back(rule);
   } else {
     used_rules_delta_
-        .insert(parent_sheet, HeapVector<Member<const StyleRule>>())
-        .stored_value->value.push_back(rule);
+        .insert(parent_sheet,
+                MakeGarbageCollected<HeapVector<Member<const StyleRule>>>())
+        .stored_value->value->push_back(rule);
   }
 }
 
diff --git a/third_party/blink/renderer/core/css/resolver/style_rule_usage_tracker.h b/third_party/blink/renderer/core/css/resolver/style_rule_usage_tracker.h
index 54132c6..e794244d 100644
--- a/third_party/blink/renderer/core/css/resolver/style_rule_usage_tracker.h
+++ b/third_party/blink/renderer/core/css/resolver/style_rule_usage_tracker.h
@@ -13,8 +13,9 @@
 
 class StyleRuleUsageTracker : public GarbageCollected<StyleRuleUsageTracker> {
  public:
-  using RuleListByStyleSheet = HeapHashMap<Member<const CSSStyleSheet>,
-                                           HeapVector<Member<const StyleRule>>>;
+  using RuleListByStyleSheet =
+      HeapHashMap<Member<const CSSStyleSheet>,
+                  Member<HeapVector<Member<const StyleRule>>>>;
 
   void Track(const CSSStyleSheet*, const StyleRule*);
   RuleListByStyleSheet TakeDelta();
diff --git a/third_party/blink/renderer/core/css/style_engine_test.cc b/third_party/blink/renderer/core/css/style_engine_test.cc
index 6109e57..71747f8 100644
--- a/third_party/blink/renderer/core/css/style_engine_test.cc
+++ b/third_party/blink/renderer/core/css/style_engine_test.cc
@@ -2922,6 +2922,26 @@
   EXPECT_EQ("30px", ComputedValue(GetDocument().body(), "--y")->CssText());
 }
 
+TEST_F(StyleEngineTest, SystemColorComputeToSelfUseCount) {
+  // Don't count system color use by itself - only in conjunction with
+  // color-scheme.
+  GetDocument().body()->setInnerHTML(
+      "<style>div { color: MenuText; }</style><div></div>");
+  UpdateAllLifecyclePhases();
+  EXPECT_FALSE(
+      GetDocument().IsUseCounted(WebFeature::kCSSSystemColorComputeToSelf));
+
+  // Count system color use when used on an element with a different
+  // color-scheme from its parent.
+  GetDocument().body()->setInnerHTML(
+      "<style>"
+      "div { color: MenuText; color-scheme: dark; }"
+      "</style><div></div>");
+  UpdateAllLifecyclePhases();
+  EXPECT_TRUE(
+      GetDocument().IsUseCounted(WebFeature::kCSSSystemColorComputeToSelf));
+}
+
 class ParameterizedStyleEngineTest
     : public testing::WithParamInterface<bool>,
       private ScopedCSSReducedFontLoadingInvalidationsForTest,
diff --git a/third_party/blink/renderer/core/exported/local_frame_client_impl.cc b/third_party/blink/renderer/core/exported/local_frame_client_impl.cc
index a94a4805..887c0c0 100644
--- a/third_party/blink/renderer/core/exported/local_frame_client_impl.cc
+++ b/third_party/blink/renderer/core/exported/local_frame_client_impl.cc
@@ -59,7 +59,6 @@
 #include "third_party/blink/public/web/web_plugin.h"
 #include "third_party/blink/public/web/web_plugin_params.h"
 #include "third_party/blink/public/web/web_view_client.h"
-#include "third_party/blink/renderer/bindings/core/v8/script_controller.h"
 #include "third_party/blink/renderer/core/core_initializer.h"
 #include "third_party/blink/renderer/core/events/current_input_event.h"
 #include "third_party/blink/renderer/core/events/message_event.h"
@@ -92,6 +91,7 @@
 #include "third_party/blink/renderer/core/page/page.h"
 #include "third_party/blink/renderer/core/page/plugin_data.h"
 #include "third_party/blink/renderer/core/probe/core_probes.h"
+#include "third_party/blink/renderer/core/script/classic_script.h"
 #include "third_party/blink/renderer/platform/exported/wrapped_resource_request.h"
 #include "third_party/blink/renderer/platform/exported/wrapped_resource_response.h"
 #include "third_party/blink/renderer/platform/instrumentation/histogram.h"
@@ -367,9 +367,10 @@
 }
 createShadowRootWithin(document.body);
 )";
-    web_frame_->GetFrame()->GetScriptController().ExecuteScriptInMainWorld(
-        script, ScriptSourceLocationType::kInternal,
-        ScriptController::kExecuteScriptWhenScriptsDisabled);
+    ClassicScript::CreateUnspecifiedScript(
+        ScriptSourceCode(script, ScriptSourceLocationType::kInternal))
+        ->RunScript(web_frame_->GetFrame(),
+                    ScriptController::kExecuteScriptWhenScriptsDisabled);
   }
 
   if (web_frame_->Client()) {
diff --git a/third_party/blink/renderer/core/exported/web_plugin_container_impl.cc b/third_party/blink/renderer/core/exported/web_plugin_container_impl.cc
index cb63670..3e2d0be 100644
--- a/third_party/blink/renderer/core/exported/web_plugin_container_impl.cc
+++ b/third_party/blink/renderer/core/exported/web_plugin_container_impl.cc
@@ -51,7 +51,6 @@
 #include "third_party/blink/public/web/web_print_preset_options.h"
 #include "third_party/blink/public/web/web_view_client.h"
 #include "third_party/blink/renderer/bindings/core/v8/sanitize_script_errors.h"
-#include "third_party/blink/renderer/bindings/core/v8/script_controller.h"
 #include "third_party/blink/renderer/bindings/core/v8/script_source_code.h"
 #include "third_party/blink/renderer/bindings/core/v8/v8_binding_for_core.h"
 #include "third_party/blink/renderer/bindings/core/v8/v8_element.h"
@@ -94,6 +93,7 @@
 #include "third_party/blink/renderer/core/page/page.h"
 #include "third_party/blink/renderer/core/page/scrolling/scrolling_coordinator.h"
 #include "third_party/blink/renderer/core/paint/paint_layer.h"
+#include "third_party/blink/renderer/core/script/classic_script.h"
 #include "third_party/blink/renderer/core/scroll/scroll_animator_base.h"
 #include "third_party/blink/renderer/core/scroll/scrollbar_theme.h"
 #include "third_party/blink/renderer/platform/exported/wrapped_resource_response.h"
@@ -518,6 +518,7 @@
   return v8::Local<v8::Object>::Cast(v8value);
 }
 
+// TODO(hiroshige): Consider merging with LocalFrame::ExecuteJavaScriptURL().
 WebString WebPluginContainerImpl::ExecuteScriptURL(const WebURL& url,
                                                    bool popups_allowed) {
   LocalFrame* frame = element_->GetDocument().GetFrame();
@@ -545,9 +546,9 @@
 
   v8::HandleScope handle_scope(ToIsolate(frame));
   v8::Local<v8::Value> result =
-      frame->GetScriptController().ExecuteScriptInMainWorldAndReturnValue(
-          ScriptSourceCode(script, ScriptSourceLocationType::kJavascriptUrl),
-          KURL(), SanitizeScriptErrors::kSanitize);
+      ClassicScript::CreateUnspecifiedScript(
+          ScriptSourceCode(script, ScriptSourceLocationType::kJavascriptUrl))
+          ->RunScriptAndReturnValue(frame);
 
   // Failure is reported as a null string.
   if (result.IsEmpty() || !result->IsString())
diff --git a/third_party/blink/renderer/core/exported/web_shared_worker_impl.cc b/third_party/blink/renderer/core/exported/web_shared_worker_impl.cc
index 4fcdd2d..e15c6f29 100644
--- a/third_party/blink/renderer/core/exported/web_shared_worker_impl.cc
+++ b/third_party/blink/renderer/core/exported/web_shared_worker_impl.cc
@@ -125,14 +125,7 @@
   // DidTerminateWorkerThread() will be called asynchronously.
 }
 
-void WebSharedWorkerImpl::DidEvaluateClassicScript(bool success) {
-  DCHECK(IsMainThread());
-  DCHECK(!running_);
-  running_ = true;
-  DispatchPendingConnections();
-}
-
-void WebSharedWorkerImpl::DidEvaluateModuleScript(bool success) {
+void WebSharedWorkerImpl::DidEvaluateTopLevelScript(bool success) {
   DCHECK(IsMainThread());
   DCHECK(!running_);
   running_ = true;
diff --git a/third_party/blink/renderer/core/exported/web_shared_worker_impl.h b/third_party/blink/renderer/core/exported/web_shared_worker_impl.h
index bf94274..ebe4764 100644
--- a/third_party/blink/renderer/core/exported/web_shared_worker_impl.h
+++ b/third_party/blink/renderer/core/exported/web_shared_worker_impl.h
@@ -81,8 +81,7 @@
   void CountFeature(WebFeature);
   void DidFailToFetchClassicScript();
   void DidFailToFetchModuleScript();
-  void DidEvaluateClassicScript(bool success);
-  void DidEvaluateModuleScript(bool success);
+  void DidEvaluateTopLevelScript(bool success);
   void DidCloseWorkerGlobalScope();
   // This synchronously destroys |this|.
   void DidTerminateWorkerThread();
diff --git a/third_party/blink/renderer/core/frame/csp/content_security_policy.cc b/third_party/blink/renderer/core/frame/csp/content_security_policy.cc
index cc15b1b..e370394 100644
--- a/third_party/blink/renderer/core/frame/csp/content_security_policy.cc
+++ b/third_party/blink/renderer/core/frame/csp/content_security_policy.cc
@@ -40,6 +40,7 @@
 #include "third_party/blink/renderer/bindings/core/v8/script_controller.h"
 #include "third_party/blink/renderer/bindings/core/v8/v8_binding_for_core.h"
 #include "third_party/blink/renderer/bindings/core/v8/v8_security_policy_violation_event_init.h"
+#include "third_party/blink/renderer/core/dom/dom_node_ids.h"
 #include "third_party/blink/renderer/core/dom/dom_string_list.h"
 #include "third_party/blink/renderer/core/dom/element.h"
 #include "third_party/blink/renderer/core/dom/events/event_queue.h"
@@ -1148,7 +1149,7 @@
     delegate_->DispatchViolationEvent(*violation_data, element);
 
   ReportContentSecurityPolicyIssue(*violation_data, violation_type,
-                                   context_frame);
+                                   context_frame, element);
 }
 
 void ContentSecurityPolicy::PostViolationReport(
@@ -1425,7 +1426,8 @@
 void ContentSecurityPolicy::ReportContentSecurityPolicyIssue(
     const blink::SecurityPolicyViolationEventInit& violation_data,
     ContentSecurityPolicyViolationType violation_type,
-    LocalFrame* frame_ancestor) {
+    LocalFrame* frame_ancestor,
+    Element* element) {
   auto cspDetails = mojom::blink::ContentSecurityPolicyIssueDetails::New();
   if (violation_type == ContentSecurityPolicyViolationType::kURLViolation ||
       violation_data.violatedDirective() == "frame-ancestors") {
@@ -1448,6 +1450,9 @@
     source_location->column = violation_data.columnNumber();
     cspDetails->source_location = std::move(source_location);
   }
+  if (element) {
+    cspDetails->violating_node_id = DOMNodeIds::IdForNode(element);
+  }
 
   auto details = mojom::blink::InspectorIssueDetails::New();
   details->csp_issue_details = std::move(cspDetails);
@@ -1460,7 +1465,10 @@
   // TODO(crbug.com/1082628): Add handling of other CSP violation types later as
   // they'll need more work.
   if (violation_type == blink::ContentSecurityPolicy::
-                            ContentSecurityPolicyViolationType::kURLViolation) {
+                            ContentSecurityPolicyViolationType::kURLViolation ||
+      violation_type ==
+          blink::ContentSecurityPolicy::ContentSecurityPolicyViolationType::
+              kInlineViolation) {
     if (frame_ancestor)
       frame_ancestor->AddInspectorIssue(std::move(info));
     else if (delegate_)
diff --git a/third_party/blink/renderer/core/frame/csp/content_security_policy.h b/third_party/blink/renderer/core/frame/csp/content_security_policy.h
index 7985122..3d820757 100644
--- a/third_party/blink/renderer/core/frame/csp/content_security_policy.h
+++ b/third_party/blink/renderer/core/frame/csp/content_security_policy.h
@@ -578,7 +578,8 @@
   void ReportContentSecurityPolicyIssue(
       const blink::SecurityPolicyViolationEventInit& violation_data,
       ContentSecurityPolicyViolationType violation_type,
-      LocalFrame* = nullptr);
+      LocalFrame* = nullptr,
+      Element* = nullptr);
 
   Member<ContentSecurityPolicyDelegate> delegate_;
   bool override_inline_style_allowed_;
diff --git a/third_party/blink/renderer/core/frame/local_dom_window.cc b/third_party/blink/renderer/core/frame/local_dom_window.cc
index 4a673626..c637d01 100644
--- a/third_party/blink/renderer/core/frame/local_dom_window.cc
+++ b/third_party/blink/renderer/core/frame/local_dom_window.cc
@@ -1745,6 +1745,7 @@
   origin_policy_ids_ = ids;
 }
 
+// TODO(https://crbug.com/1103866): rename to originIsolated
 bool LocalDOMWindow::originIsolationRestricted() const {
   return GetAgent()->IsOriginIsolated();
 }
diff --git a/third_party/blink/renderer/core/frame/local_dom_window.h b/third_party/blink/renderer/core/frame/local_dom_window.h
index 27af699..19937dd7 100644
--- a/third_party/blink/renderer/core/frame/local_dom_window.h
+++ b/third_party/blink/renderer/core/frame/local_dom_window.h
@@ -294,6 +294,7 @@
   void SetOriginPolicyIds(const Vector<String>&);
 
   // https://github.com/whatwg/html/pull/5545
+  // TODO(https://crbug.com/1103866): rename to originIsolated
   bool originIsolationRestricted() const;
 
   // Idle callback extensions
diff --git a/third_party/blink/renderer/core/frame/pausable_script_executor.cc b/third_party/blink/renderer/core/frame/pausable_script_executor.cc
index bc8a98e..2e7dcdc 100644
--- a/third_party/blink/renderer/core/frame/pausable_script_executor.cc
+++ b/third_party/blink/renderer/core/frame/pausable_script_executor.cc
@@ -11,13 +11,13 @@
 #include "third_party/blink/public/platform/web_vector.h"
 #include "third_party/blink/public/web/web_script_execution_callback.h"
 #include "third_party/blink/renderer/bindings/core/v8/sanitize_script_errors.h"
-#include "third_party/blink/renderer/bindings/core/v8/script_controller.h"
 #include "third_party/blink/renderer/bindings/core/v8/script_source_code.h"
 #include "third_party/blink/renderer/bindings/core/v8/v8_binding_for_core.h"
 #include "third_party/blink/renderer/bindings/core/v8/window_proxy.h"
 #include "third_party/blink/renderer/core/dom/document.h"
 #include "third_party/blink/renderer/core/frame/local_dom_window.h"
 #include "third_party/blink/renderer/core/frame/local_frame.h"
+#include "third_party/blink/renderer/core/script/classic_script.h"
 #include "third_party/blink/renderer/platform/bindings/trace_wrapper_v8_reference.h"
 #include "third_party/blink/renderer/platform/heap/heap.h"
 #include "third_party/blink/renderer/platform/heap/heap_allocator.h"
@@ -64,14 +64,12 @@
   for (const auto& source : sources_) {
     // Note: An error event in an isolated world will never be dispatched to
     // a foreign world.
+    ClassicScript* classic_script = ClassicScript::CreateUnspecifiedScript(
+        source, SanitizeScriptErrors::kDoNotSanitize);
     v8::Local<v8::Value> script_value =
-        world_id_
-            ? frame->GetScriptController().ExecuteScriptInIsolatedWorld(
-                  world_id_, source, KURL(),
-                  SanitizeScriptErrors::kDoNotSanitize)
-            : frame->GetScriptController()
-                  .ExecuteScriptInMainWorldAndReturnValue(
-                      source, KURL(), SanitizeScriptErrors::kDoNotSanitize);
+        world_id_ ? classic_script->RunScriptInIsolatedWorldAndReturnValue(
+                        frame, world_id_)
+                  : classic_script->RunScriptAndReturnValue(frame);
     results.push_back(script_value);
   }
 
diff --git a/third_party/blink/renderer/core/frame/reporting_context.cc b/third_party/blink/renderer/core/frame/reporting_context.cc
index dfc324b..18940eb 100644
--- a/third_party/blink/renderer/core/frame/reporting_context.cc
+++ b/third_party/blink/renderer/core/frame/reporting_context.cc
@@ -95,7 +95,7 @@
 
   observer->ClearBuffered();
   for (auto type : report_buffer_) {
-    for (Report* report : type.value) {
+    for (Report* report : *type.value) {
       observer->QueueReport(report);
     }
   }
@@ -152,14 +152,17 @@
 
 void ReportingContext::NotifyInternal(Report* report) {
   // Buffer the report.
-  if (!report_buffer_.Contains(report->type()))
-    report_buffer_.insert(report->type(), HeapListHashSet<Member<Report>>());
-  report_buffer_.find(report->type())->value.insert(report);
+  if (!report_buffer_.Contains(report->type())) {
+    report_buffer_.insert(
+        report->type(),
+        MakeGarbageCollected<HeapListHashSet<Member<Report>>>());
+  }
+  report_buffer_.find(report->type())->value->insert(report);
 
   // Only the most recent 100 reports will remain buffered, per report type.
   // https://w3c.github.io/reporting/#notify-observers
-  if (report_buffer_.at(report->type()).size() > 100)
-    report_buffer_.find(report->type())->value.RemoveFirst();
+  if (report_buffer_.at(report->type())->size() > 100)
+    report_buffer_.find(report->type())->value->RemoveFirst();
 
   // Queue the report in all registered observers.
   for (auto observer : observers_)
diff --git a/third_party/blink/renderer/core/frame/reporting_context.h b/third_party/blink/renderer/core/frame/reporting_context.h
index 32fab72..4e914b6 100644
--- a/third_party/blink/renderer/core/frame/reporting_context.h
+++ b/third_party/blink/renderer/core/frame/reporting_context.h
@@ -62,7 +62,7 @@
   void SendToReportingAPI(Report* report, const String& endpoint) const;
 
   HeapListHashSet<Member<blink::ReportingObserver>> observers_;
-  HeapHashMap<String, HeapListHashSet<Member<Report>>> report_buffer_;
+  HeapHashMap<String, Member<HeapListHashSet<Member<Report>>>> report_buffer_;
   Member<ExecutionContext> execution_context_;
 
   // This is declared mutable so that the service endpoint can be cached by
diff --git a/third_party/blink/renderer/core/frame/web_local_frame_impl.cc b/third_party/blink/renderer/core/frame/web_local_frame_impl.cc
index 3928916..f5d4b39 100644
--- a/third_party/blink/renderer/core/frame/web_local_frame_impl.cc
+++ b/third_party/blink/renderer/core/frame/web_local_frame_impl.cc
@@ -233,6 +233,7 @@
 #include "third_party/blink/renderer/core/paint/paint_layer.h"
 #include "third_party/blink/renderer/core/paint/paint_layer_scrollable_area.h"
 #include "third_party/blink/renderer/core/paint/paint_timing.h"
+#include "third_party/blink/renderer/core/script/classic_script.h"
 #include "third_party/blink/renderer/core/scroll/scroll_types.h"
 #include "third_party/blink/renderer/core/scroll/scrollbar_theme.h"
 #include "third_party/blink/renderer/core/timing/dom_window_performance.h"
@@ -778,9 +779,7 @@
 
 void WebLocalFrameImpl::ExecuteScript(const WebScriptSource& source) {
   DCHECK(GetFrame());
-  v8::HandleScope handle_scope(ToIsolate(GetFrame()));
-  GetFrame()->GetScriptController().ExecuteScriptInMainWorld(
-      source, KURL(), SanitizeScriptErrors::kSanitize);
+  ClassicScript::CreateUnspecifiedScript(source)->RunScript(GetFrame());
 }
 
 void WebLocalFrameImpl::ExecuteScriptInIsolatedWorld(
@@ -793,8 +792,9 @@
   // Note: An error event in an isolated world will never be dispatched to
   // a foreign world.
   v8::HandleScope handle_scope(ToIsolate(GetFrame()));
-  GetFrame()->GetScriptController().ExecuteScriptInIsolatedWorld(
-      world_id, source_in, KURL(), SanitizeScriptErrors::kDoNotSanitize);
+  ClassicScript::CreateUnspecifiedScript(source_in,
+                                         SanitizeScriptErrors::kDoNotSanitize)
+      ->RunScriptInIsolatedWorldAndReturnValue(GetFrame(), world_id);
 }
 
 v8::Local<v8::Value>
@@ -807,8 +807,9 @@
 
   // Note: An error event in an isolated world will never be dispatched to
   // a foreign world.
-  return GetFrame()->GetScriptController().ExecuteScriptInIsolatedWorld(
-      world_id, source_in, KURL(), SanitizeScriptErrors::kDoNotSanitize);
+  return ClassicScript::CreateUnspecifiedScript(
+             source_in, SanitizeScriptErrors::kDoNotSanitize)
+      ->RunScriptInIsolatedWorldAndReturnValue(GetFrame(), world_id);
 }
 
 void WebLocalFrameImpl::ClearIsolatedWorldCSPForTesting(int32_t world_id) {
@@ -855,11 +856,8 @@
 v8::Local<v8::Value> WebLocalFrameImpl::ExecuteScriptAndReturnValue(
     const WebScriptSource& source) {
   DCHECK(GetFrame());
-
-  return GetFrame()
-      ->GetScriptController()
-      .ExecuteScriptInMainWorldAndReturnValue(source, KURL(),
-                                              SanitizeScriptErrors::kSanitize);
+  return ClassicScript::CreateUnspecifiedScript(source)
+      ->RunScriptAndReturnValue(GetFrame());
 }
 
 void WebLocalFrameImpl::RequestExecuteScriptAndReturnValue(
diff --git a/third_party/blink/renderer/core/html/html_collection.h b/third_party/blink/renderer/core/html/html_collection.h
index fb8342d6..2492966 100644
--- a/third_party/blink/renderer/core/html/html_collection.h
+++ b/third_party/blink/renderer/core/html/html_collection.h
@@ -125,14 +125,14 @@
       auto it = id_cache_.find(id.Impl());
       if (it == id_cache_.end())
         return nullptr;
-      return &it->value;
+      return it->value;
     }
     const HeapVector<Member<Element>>* GetElementsByName(
         const AtomicString& name) const {
       auto it = name_cache_.find(name.Impl());
       if (it == name_cache_.end())
         return nullptr;
-      return &it->value;
+      return it->value;
     }
     void AddElementWithId(const AtomicString& id, Element* element) {
       AddElementToMap(id_cache_, id, element);
@@ -147,15 +147,16 @@
     }
 
    private:
-    typedef HeapHashMap<StringImpl*, HeapVector<Member<Element>>>
+    typedef HeapHashMap<StringImpl*, Member<HeapVector<Member<Element>>>>
         StringToElementsMap;
     static void AddElementToMap(StringToElementsMap& map,
                                 const AtomicString& key,
                                 Element* element) {
-      HeapVector<Member<Element>>& vector =
-          map.insert(key.Impl(), HeapVector<Member<Element>>())
+      HeapVector<Member<Element>>* vector =
+          map.insert(key.Impl(),
+                     MakeGarbageCollected<HeapVector<Member<Element>>>())
               .stored_value->value;
-      vector.push_back(element);
+      vector->push_back(element);
     }
 
     StringToElementsMap id_cache_;
diff --git a/third_party/blink/renderer/core/html/media/autoplay_policy.cc b/third_party/blink/renderer/core/html/media/autoplay_policy.cc
index 9aa401d..b7ec37b 100644
--- a/third_party/blink/renderer/core/html/media/autoplay_policy.cc
+++ b/third_party/blink/renderer/core/html/media/autoplay_policy.cc
@@ -381,7 +381,8 @@
 }
 
 bool AutoplayPolicy::ShouldAutoplay() {
-  if (element_->GetExecutionContext()->IsSandboxed(
+  if (!element_->GetExecutionContext() ||
+      element_->GetExecutionContext()->IsSandboxed(
           network::mojom::blink::WebSandboxFlags::kAutomaticFeatures)) {
     return false;
   }
diff --git a/third_party/blink/renderer/core/input/event_handler.cc b/third_party/blink/renderer/core/input/event_handler.cc
index 72d4e66a..3d6f721 100644
--- a/third_party/blink/renderer/core/input/event_handler.cc
+++ b/third_party/blink/renderer/core/input/event_handler.cc
@@ -96,6 +96,7 @@
 #include "third_party/blink/renderer/core/scroll/scrollbar.h"
 #include "third_party/blink/renderer/core/style/computed_style.h"
 #include "third_party/blink/renderer/core/style/cursor_data.h"
+#include "third_party/blink/renderer/core/svg/graphics/svg_image.h"
 #include "third_party/blink/renderer/platform/bindings/exception_state.h"
 #include "third_party/blink/renderer/platform/cursors.h"
 #include "third_party/blink/renderer/platform/geometry/float_point.h"
@@ -617,6 +618,15 @@
       }
 
       Image* image = cached_image->GetImage();
+
+      // If the image is an SVG, then adjust the scale to reflect the device
+      // scale factor so that the SVG can be rasterized in the native
+      // resolution and scaled down to the correct size for the cursor.
+      if (image && image->IsSVGImage()) {
+        scale *=
+            page->GetChromeClient().GetScreenInfo(*frame_).device_scale_factor;
+      }
+
       // Ensure no overflow possible in calculations above.
       if (scale < kMinimumCursorScale)
         continue;
@@ -625,9 +635,22 @@
       hot_spot.Scale(scale, scale);
 
       ui::Cursor cursor(ui::mojom::blink::CursorType::kCustom);
-      cursor.set_custom_bitmap(
-          image ? image->AsSkBitmapForCurrentFrame(kRespectImageOrientation)
-                : SkBitmap());
+      if (image) {
+        // Special case for SVG so that it can be rasterized in the appropriate
+        // resolution for high DPI displays.
+        if (image->IsSVGImage()) {
+          SVGImage* svg = static_cast<SVGImage*>(image);
+          cursor.set_custom_bitmap(
+              svg->AsSkBitmapForCursor(page->GetChromeClient()
+                                           .GetScreenInfo(*frame_)
+                                           .device_scale_factor));
+        } else {
+          cursor.set_custom_bitmap(
+              image->AsSkBitmapForCurrentFrame(kRespectImageOrientation));
+        }
+      } else {
+        cursor.set_custom_bitmap(SkBitmap());
+      }
       cursor.set_custom_hotspot(
           DetermineHotSpot(*image, hot_spot_specified, hot_spot));
       cursor.set_image_scale_factor(scale);
diff --git a/third_party/blink/renderer/core/input/pointer_event_manager.cc b/third_party/blink/renderer/core/input/pointer_event_manager.cc
index db1556a..fd4d7c55 100644
--- a/third_party/blink/renderer/core/input/pointer_event_manager.cc
+++ b/third_party/blink/renderer/core/input/pointer_event_manager.cc
@@ -252,19 +252,21 @@
 void PointerEventManager::SetElementUnderPointer(PointerEvent* pointer_event,
                                                  Element* target) {
   if (element_under_pointer_.Contains(pointer_event->pointerId())) {
-    EventTargetAttributes node =
+    EventTargetAttributes* node =
         element_under_pointer_.at(pointer_event->pointerId());
     if (!target) {
       element_under_pointer_.erase(pointer_event->pointerId());
     } else if (target !=
-               element_under_pointer_.at(pointer_event->pointerId()).target) {
-      element_under_pointer_.Set(pointer_event->pointerId(),
-                                 EventTargetAttributes(target));
+               element_under_pointer_.at(pointer_event->pointerId())->target) {
+      element_under_pointer_.Set(
+          pointer_event->pointerId(),
+          MakeGarbageCollected<EventTargetAttributes>(target));
     }
-    SendBoundaryEvents(node.target, target, pointer_event);
+    SendBoundaryEvents(node->target, target, pointer_event);
   } else if (target) {
-    element_under_pointer_.insert(pointer_event->pointerId(),
-                                  EventTargetAttributes(target));
+    element_under_pointer_.insert(
+        pointer_event->pointerId(),
+        MakeGarbageCollected<EventTargetAttributes>(target));
     SendBoundaryEvents(nullptr, target, pointer_event);
   }
 }
@@ -305,7 +307,7 @@
     // target before.
     DCHECK(element_under_pointer_.Contains(pointer_event->pointerId()));
     Element* target =
-        element_under_pointer_.at(pointer_event->pointerId()).target;
+        element_under_pointer_.at(pointer_event->pointerId())->target;
 
     DispatchPointerEvent(
         GetEffectiveTargetForPointerEvent(target, pointer_event->pointerId()),
@@ -1054,7 +1056,7 @@
                                                    LocalFrame* frame) const {
   Element* last_element_receiving_event =
       element_under_pointer_.Contains(pointer_id)
-          ? element_under_pointer_.at(pointer_id).target
+          ? element_under_pointer_.at(pointer_id)->target
           : nullptr;
   return last_element_receiving_event &&
          last_element_receiving_event->GetDocument().GetFrame() == frame;
@@ -1086,7 +1088,7 @@
   PointerId pointer_id =
       pointer_event_factory_.GetPointerEventId(web_pointer_event);
   Element* last_target = element_under_pointer_.Contains(pointer_id)
-                             ? element_under_pointer_.at(pointer_id).target
+                             ? element_under_pointer_.at(pointer_id)->target
                              : nullptr;
   if (!new_target) {
     pointer_event_factory_.RemoveLastPosition(pointer_id);
diff --git a/third_party/blink/renderer/core/input/pointer_event_manager.h b/third_party/blink/renderer/core/input/pointer_event_manager.h
index 39a4fa15..1f0132c 100644
--- a/third_party/blink/renderer/core/input/pointer_event_manager.h
+++ b/third_party/blink/renderer/core/input/pointer_event_manager.h
@@ -108,9 +108,7 @@
   WebInputEventResult FlushEvents();
 
  private:
-  class EventTargetAttributes {
-    DISALLOW_NEW();
-
+  class EventTargetAttributes : public GarbageCollected<EventTargetAttributes> {
    public:
     void Trace(Visitor* visitor) const { visitor->Trace(target); }
     Member<Element> target;
@@ -126,7 +124,7 @@
                   WTF::IntHash<int64_t>,
                   WTF::UnsignedWithZeroKeyHashTraits<int64_t>>;
   using PointerCapturingMap = PointerIdKeyMap<Member<Element>>;
-  using ElementUnderPointerMap = PointerIdKeyMap<EventTargetAttributes>;
+  using ElementUnderPointerMap = PointerIdKeyMap<Member<EventTargetAttributes>>;
 
   class PointerEventBoundaryEventDispatcher : public BoundaryEventDispatcher {
    public:
diff --git a/third_party/blink/renderer/core/inspector/inspector_audits_agent.cc b/third_party/blink/renderer/core/inspector/inspector_audits_agent.cc
index 81a444f..1d6d210c 100644
--- a/third_party/blink/renderer/core/inspector/inspector_audits_agent.cc
+++ b/third_party/blink/renderer/core/inspector/inspector_audits_agent.cc
@@ -512,6 +512,8 @@
                                  .build();
       cspDetails.setSourceCodeLocation(std::move(source_location));
     }
+    if (d->violating_node_id)
+      cspDetails.setViolatingNodeId(d->violating_node_id);
     issueDetails.setContentSecurityPolicyIssueDetails(cspDetails.build());
   }
 
diff --git a/third_party/blink/renderer/core/inspector/inspector_css_agent.cc b/third_party/blink/renderer/core/inspector/inspector_css_agent.cc
index a45fd65..7200f0b 100644
--- a/third_party/blink/renderer/core/inspector/inspector_css_agent.cc
+++ b/third_party/blink/renderer/core/inspector/inspector_css_agent.cc
@@ -2598,7 +2598,7 @@
       CSSStyleRule* css_style_rule = AsCSSStyleRule(css_rule);
       rule_to_css_rule.Set(css_style_rule->GetStyleRule(), css_style_rule);
     }
-    for (auto used_rule : entry.value) {
+    for (auto used_rule : *entry.value) {
       CSSStyleRule* css_style_rule = rule_to_css_rule.at(used_rule);
       if (std::unique_ptr<protocol::CSS::RuleUsage> rule_usage_object =
               style_sheet->BuildObjectForRuleUsage(css_style_rule, true)) {
diff --git a/third_party/blink/renderer/core/inspector/inspector_dom_agent.cc b/third_party/blink/renderer/core/inspector/inspector_dom_agent.cc
index 4541c545..f8798c4 100644
--- a/third_party/blink/renderer/core/inspector/inspector_dom_agent.cc
+++ b/third_party/blink/renderer/core/inspector/inspector_dom_agent.cc
@@ -1097,8 +1097,9 @@
 
   *search_id = IdentifiersFactory::CreateIdentifier();
   HeapVector<Member<Node>>* results_it =
-      &search_results_.insert(*search_id, HeapVector<Member<Node>>())
-           .stored_value->value;
+      search_results_
+          .insert(*search_id, MakeGarbageCollected<HeapVector<Member<Node>>>())
+          .stored_value->value;
 
   for (auto& result : result_collector)
     results_it->push_back(result);
@@ -1116,13 +1117,13 @@
   if (it == search_results_.end())
     return Response::ServerError("No search session with given id found");
 
-  int size = it->value.size();
+  int size = it->value->size();
   if (from_index < 0 || to_index > size || from_index >= to_index)
     return Response::ServerError("Invalid search result range");
 
   *node_ids = std::make_unique<protocol::Array<int>>();
   for (int i = from_index; i < to_index; ++i)
-    (*node_ids)->emplace_back(PushNodePathToFrontend((it->value)[i].Get()));
+    (*node_ids)->emplace_back(PushNodePathToFrontend((*it->value)[i].Get()));
   return Response::Success();
 }
 
diff --git a/third_party/blink/renderer/core/inspector/inspector_dom_agent.h b/third_party/blink/renderer/core/inspector/inspector_dom_agent.h
index 9df493c..06c6b4bf 100644
--- a/third_party/blink/renderer/core/inspector/inspector_dom_agent.h
+++ b/third_party/blink/renderer/core/inspector/inspector_dom_agent.h
@@ -380,7 +380,7 @@
   HashMap<int, int> cached_child_count_;
   int last_node_id_;
   Member<Document> document_;
-  typedef HeapHashMap<String, HeapVector<Member<Node>>> SearchResults;
+  typedef HeapHashMap<String, Member<HeapVector<Member<Node>>>> SearchResults;
   SearchResults search_results_;
   Member<InspectorRevalidateDOMTask> revalidate_task_;
   Member<InspectorHistory> history_;
diff --git a/third_party/blink/renderer/core/inspector/inspector_overlay_agent.cc b/third_party/blink/renderer/core/inspector/inspector_overlay_agent.cc
index 41b6996..a130efe 100644
--- a/third_party/blink/renderer/core/inspector/inspector_overlay_agent.cc
+++ b/third_party/blink/renderer/core/inspector/inspector_overlay_agent.cc
@@ -40,8 +40,6 @@
 #include "third_party/blink/public/platform/web_data.h"
 #include "third_party/blink/public/resources/grit/inspector_overlay_resources_map.h"
 #include "third_party/blink/public/web/web_widget_client.h"
-#include "third_party/blink/renderer/bindings/core/v8/sanitize_script_errors.h"
-#include "third_party/blink/renderer/bindings/core/v8/script_controller.h"
 #include "third_party/blink/renderer/bindings/core/v8/script_source_code.h"
 #include "third_party/blink/renderer/bindings/core/v8/v8_binding_for_core.h"
 #include "third_party/blink/renderer/bindings/core/v8/v8_inspector_overlay_host.h"
@@ -73,6 +71,7 @@
 #include "third_party/blink/renderer/core/loader/frame_load_request.h"
 #include "third_party/blink/renderer/core/page/chrome_client.h"
 #include "third_party/blink/renderer/core/page/page.h"
+#include "third_party/blink/renderer/core/script/classic_script.h"
 #include "third_party/blink/renderer/platform/bindings/script_forbidden_scope.h"
 #include "third_party/blink/renderer/platform/data_resource_helper.h"
 #include "third_party/blink/renderer/platform/graphics/color.h"
@@ -1167,14 +1166,14 @@
   command->pushValue(protocol::StringValue::create(argument));
   std::vector<uint8_t> json;
   ConvertCBORToJSON(SpanFrom(command->Serialize()), &json);
-  To<LocalFrame>(OverlayMainFrame())
-      ->GetScriptController()
-      .ExecuteScriptInMainWorld(
+  ClassicScript::CreateUnspecifiedScript(
+      ScriptSourceCode(
           "dispatch(" +
               String(reinterpret_cast<const char*>(json.data()), json.size()) +
               ")",
-          ScriptSourceLocationType::kInspector,
-          ScriptController::kExecuteScriptWhenScriptsDisabled);
+          ScriptSourceLocationType::kInspector))
+      ->RunScript(To<LocalFrame>(OverlayMainFrame()),
+                  ScriptController::kExecuteScriptWhenScriptsDisabled);
 }
 
 void InspectorOverlayAgent::EvaluateInOverlay(
@@ -1186,25 +1185,24 @@
   command->pushValue(std::move(argument));
   std::vector<uint8_t> json;
   ConvertCBORToJSON(SpanFrom(command->Serialize()), &json);
-  To<LocalFrame>(OverlayMainFrame())
-      ->GetScriptController()
-      .ExecuteScriptInMainWorld(
+  ClassicScript::CreateUnspecifiedScript(
+      ScriptSourceCode(
           "dispatch(" +
               String(reinterpret_cast<const char*>(json.data()), json.size()) +
               ")",
-          ScriptSourceLocationType::kInspector,
-          ScriptController::kExecuteScriptWhenScriptsDisabled);
+          ScriptSourceLocationType::kInspector))
+      ->RunScript(To<LocalFrame>(OverlayMainFrame()),
+                  ScriptController::kExecuteScriptWhenScriptsDisabled);
 }
 
 String InspectorOverlayAgent::EvaluateInOverlayForTest(const String& script) {
   ScriptForbiddenScope::AllowUserAgentScript allow_script;
   v8::HandleScope handle_scope(ToIsolate(OverlayMainFrame()));
   v8::Local<v8::Value> string =
-      To<LocalFrame>(OverlayMainFrame())
-          ->GetScriptController()
-          .ExecuteScriptInMainWorldAndReturnValue(
-              ScriptSourceCode(script, ScriptSourceLocationType::kInspector),
-              KURL(), SanitizeScriptErrors::kSanitize, ScriptFetchOptions(),
+      ClassicScript::CreateUnspecifiedScript(
+          ScriptSourceCode(script, ScriptSourceLocationType::kInspector))
+          ->RunScriptAndReturnValue(
+              To<LocalFrame>(OverlayMainFrame()),
               ScriptController::kExecuteScriptWhenScriptsDisabled);
   return ToCoreStringWithUndefinedOrNullCheck(string);
 }
diff --git a/third_party/blink/renderer/core/inspector/inspector_page_agent.cc b/third_party/blink/renderer/core/inspector/inspector_page_agent.cc
index 16d609e..25c711c 100644
--- a/third_party/blink/renderer/core/inspector/inspector_page_agent.cc
+++ b/third_party/blink/renderer/core/inspector/inspector_page_agent.cc
@@ -70,6 +70,7 @@
 #include "third_party/blink/renderer/core/page/page.h"
 #include "third_party/blink/renderer/core/paint/paint_layer_scrollable_area.h"
 #include "third_party/blink/renderer/core/probe/core_probes.h"
+#include "third_party/blink/renderer/core/script/classic_script.h"
 #include "third_party/blink/renderer/core/style/computed_style.h"
 #include "third_party/blink/renderer/platform/bindings/dom_wrapper_world.h"
 #include "third_party/blink/renderer/platform/loader/fetch/memory_cache.h"
@@ -882,9 +883,9 @@
     const String source = scripts_to_evaluate_on_load_.Get(key);
     const String world_name = worlds_to_evaluate_on_load_.Get(key);
     if (world_name.IsEmpty()) {
-      frame->GetScriptController().ExecuteScriptInMainWorld(
-          source, ScriptSourceLocationType::kUnknown,
-          ScriptController::kExecuteScriptWhenScriptsDisabled);
+      ClassicScript::CreateUnspecifiedScript(ScriptSourceCode(source))
+          ->RunScript(frame,
+                      ScriptController::kExecuteScriptWhenScriptsDisabled);
       continue;
     }
 
@@ -896,14 +897,14 @@
     // Note: An error event in an isolated world will never be dispatched to
     // a foreign world.
     v8::HandleScope handle_scope(V8PerIsolateData::MainThreadIsolate());
-    frame->GetScriptController().ExecuteScriptInIsolatedWorld(
-        world->GetWorldId(), source, KURL(), SanitizeScriptErrors::kSanitize);
+    ClassicScript::CreateUnspecifiedScript(ScriptSourceCode(source))
+        ->RunScriptInIsolatedWorldAndReturnValue(frame, world->GetWorldId());
   }
 
   if (!script_to_evaluate_on_load_once_.IsEmpty()) {
-    frame->GetScriptController().ExecuteScriptInMainWorld(
-        script_to_evaluate_on_load_once_, ScriptSourceLocationType::kUnknown,
-        ScriptController::kExecuteScriptWhenScriptsDisabled);
+    ClassicScript::CreateUnspecifiedScript(
+        ScriptSourceCode(script_to_evaluate_on_load_once_))
+        ->RunScript(frame, ScriptController::kExecuteScriptWhenScriptsDisabled);
   }
 }
 
diff --git a/third_party/blink/renderer/core/layout/layout_box.cc b/third_party/blink/renderer/core/layout/layout_box.cc
index 068728f1b..31c84f3 100644
--- a/third_party/blink/renderer/core/layout/layout_box.cc
+++ b/third_party/blink/renderer/core/layout/layout_box.cc
@@ -6760,22 +6760,6 @@
       GetLayoutBox().PhysicalSelfVisualOverflowRect();
 }
 
-void LayoutBox::MutableForPainting::SetPreviousSizeAndLayoutOverflowRect(
-    const LayoutSize& previous_size,
-    const PhysicalRect& previous_layout_overflow_rect) {
-  GetLayoutBox().previous_size_ = previous_size;
-  if (!previous_layout_overflow_rect.offset.IsZero() ||
-      previous_layout_overflow_rect.size !=
-          PhysicalSizeToBeNoop(previous_size)) {
-    auto& rare_data = GetLayoutBox().EnsureRareData();
-    rare_data.has_previous_content_box_and_overflow_rects_ = true;
-    rare_data.previous_physical_layout_overflow_rect_ =
-        previous_layout_overflow_rect;
-    // Other previous_* fields don't matter because they are used for paint
-    // invalidation and we always do full paint invalidation on reattachment.
-  }
-}
-
 RasterEffectOutset LayoutBox::VisualRectOutsetForRasterEffects() const {
   // If the box has subpixel visual effect outsets, as the visual effect may be
   // painted along the pixel-snapped border box, the pixels on the anti-aliased
diff --git a/third_party/blink/renderer/core/layout/layout_box.h b/third_party/blink/renderer/core/layout/layout_box.h
index 10a69f21..7acd06c 100644
--- a/third_party/blink/renderer/core/layout/layout_box.h
+++ b/third_party/blink/renderer/core/layout/layout_box.h
@@ -1619,13 +1619,6 @@
           false;
     }
 
-    // Called from LayoutShiftTracker when we attach this LayoutBox to a node
-    // for which we saved these values when the node was detached from its
-    // original LayoutBox.
-    void SetPreviousSizeAndLayoutOverflowRect(
-        const LayoutSize& previous_size,
-        const PhysicalRect& previous_layout_overflow_rect);
-
    protected:
     friend class LayoutBox;
     MutableForPainting(const LayoutBox& box)
diff --git a/third_party/blink/renderer/core/layout/layout_object.cc b/third_party/blink/renderer/core/layout/layout_object.cc
index 51a8884f..9ce8f553 100644
--- a/third_party/blink/renderer/core/layout/layout_object.cc
+++ b/third_party/blink/renderer/core/layout/layout_object.cc
@@ -177,6 +177,7 @@
   Member<void*> members[1];
   // The following fields are in FragmentData.
   PhysicalOffset paint_offset_;
+  PhysicalRect visual_rect_for_layout_shift_tracking;
   std::unique_ptr<int> rare_data_;
 };
 
diff --git a/third_party/blink/renderer/core/layout/layout_shift_tracker.cc b/third_party/blink/renderer/core/layout/layout_shift_tracker.cc
index bde56304..c0a2f1d 100644
--- a/third_party/blink/renderer/core/layout/layout_shift_tracker.cc
+++ b/third_party/blink/renderer/core/layout/layout_shift_tracker.cc
@@ -31,9 +31,6 @@
 
 using ReattachHook = LayoutShiftTracker::ReattachHook;
 
-using ContainingBlockScope = LayoutShiftTracker::ContainingBlockScope;
-ContainingBlockScope* ContainingBlockScope::top_ = nullptr;
-
 namespace {
 
 ReattachHook& GetReattachHook() {
@@ -45,56 +42,33 @@
 constexpr base::TimeDelta kTimerDelay = base::TimeDelta::FromMilliseconds(500);
 const float kMovementThreshold = 3.0;  // CSS pixels.
 
-// Calculates the physical coordinates of the starting point in the current
-// coordinate space. |paint_offset| is the physical offset of the top-left
-// corner. The starting point can be any of the four corners of the box,
-// depending on the writing mode and text direction. Note that the result is
-// still in physical coordinates, just may be of a different corner.
-// See https://wicg.github.io/layout-instability/#starting-point.
-FloatPoint StartingPoint(const PhysicalOffset& paint_offset,
-                         const LayoutBox& box,
-                         const LayoutSize& size) {
-  PhysicalOffset starting_point = paint_offset;
-  auto writing_direction = box.StyleRef().GetWritingDirection();
-  if (UNLIKELY(writing_direction.IsFlippedBlocks()))
-    starting_point.left += size.Width();
-  if (UNLIKELY(writing_direction.IsRtl())) {
-    if (writing_direction.IsHorizontal())
-      starting_point.left += size.Width();
-    else
-      starting_point.top += size.Height();
-  }
-  return FloatPoint(starting_point);
+FloatPoint LogicalStart(const FloatRect& rect, const LayoutObject& object) {
+  const ComputedStyle* style = object.Style();
+  DCHECK(style);
+  auto logical =
+      PhysicalToLogical<float>(style->GetWritingMode(), style->Direction(),
+                               rect.Y(), rect.MaxX(), rect.MaxY(), rect.X());
+  return FloatPoint(logical.InlineStart(), logical.BlockStart());
 }
 
-// Returns the part a rect logically below a starting point.
-PhysicalRect RectBelowStartingPoint(const PhysicalRect& rect,
-                                    const PhysicalOffset& starting_point,
-                                    WritingDirectionMode writing_direction) {
-  PhysicalRect result = rect;
-  if (writing_direction.IsHorizontal())
-    result.ShiftTopEdgeTo(starting_point.top);
-  else if (writing_direction.IsFlippedBlocks())
-    result.ShiftRightEdgeTo(starting_point.left);
-  else
-    result.ShiftLeftEdgeTo(starting_point.left);
-  return result;
-}
-
-float GetMoveDistance(const FloatPoint& old_starting_point,
-                      const FloatPoint& new_starting_point) {
-  FloatSize location_delta = new_starting_point - old_starting_point;
+float GetMoveDistance(const FloatRect& old_rect,
+                      const FloatRect& new_rect,
+                      const LayoutObject& object) {
+  FloatSize location_delta =
+      LogicalStart(new_rect, object) - LogicalStart(old_rect, object);
   return std::max(fabs(location_delta.Width()), fabs(location_delta.Height()));
 }
 
 bool EqualWithinMovementThreshold(const FloatPoint& a,
                                   const FloatPoint& b,
-                                  float threshold_physical_px) {
+                                  const LayoutObject& object) {
+  float threshold_physical_px =
+      kMovementThreshold * object.StyleRef().EffectiveZoom();
   return fabs(a.X() - b.X()) < threshold_physical_px &&
          fabs(a.Y() - b.Y()) < threshold_physical_px;
 }
 
-bool SmallerThanRegionGranularity(const PhysicalRect& rect) {
+bool SmallerThanRegionGranularity(const FloatRect& rect) {
   // The region uses integer coordinates, so the rects are snapped to
   // pixel boundaries. Ignore rects smaller than half a pixel.
   return rect.Width() < 0.5 || rect.Height() < 0.5;
@@ -136,10 +110,6 @@
 
 LayoutShiftTracker::LayoutShiftTracker(LocalFrameView* frame_view)
     : frame_view_(frame_view),
-      // This eliminates noise from the private Page object created by
-      // SVGImage::DataChanged.
-      is_active_(
-          !frame_view_->GetFrame().GetChromeClient().IsSVGImageChromeClient()),
       score_(0.0),
       weighted_score_(0.0),
       timer_(frame_view->GetFrame().GetTaskRunner(TaskType::kInternalDefault),
@@ -150,138 +120,105 @@
       observed_input_or_scroll_(false),
       most_recent_input_timestamp_initialized_(false) {}
 
-bool LayoutShiftTracker::NeedsToTrack(const LayoutObject& object) const {
-  if (!is_active_)
-    return false;
-
-  // SVG elements don't participate in the normal layout algorithms and are
-  // more likely to be used for animations.
-  if (object.IsSVGChild())
-    return false;
-
-  if (object.IsText())
-    return ContainingBlockScope::top_;
-
-  if (!object.IsBox())
-    return false;
-
-  // Don't report shift of anonymous objects. Will report the children because
-  // we want report real DOM nodes.
-  if (object.IsAnonymous())
-    return true;
-
-  // Ignore layout objects that move (in the coordinate space of the paint
-  // invalidation container) on scroll.
-  // TODO(skobes): Find a way to detect when these objects shift.
-  if (object.IsFixedPositioned() || object.IsStickyPositioned())
-    return false;
-
-  if (object.IsLayoutView())
-    return false;
-
-  if (Element* element = DynamicTo<Element>(object.GetNode())) {
-    if (element->IsSliderThumbElement())
-      return false;
-  }
-
-  return true;
-}
-
 void LayoutShiftTracker::ObjectShifted(
-    const LayoutObject& object,
+    const LayoutObject& source,
     const PropertyTreeStateOrAlias& property_tree_state,
-    const PhysicalRect& old_rect,
-    const PhysicalRect& new_rect,
-    const FloatPoint& old_starting_point,
-    const FloatPoint& new_starting_point) {
-  // The caller should ensure these conditions.
-  DCHECK(!old_rect.IsEmpty());
-  DCHECK(!new_rect.IsEmpty());
+    FloatRect old_rect,
+    FloatRect new_rect) {
+  if (old_rect.IsEmpty() || new_rect.IsEmpty())
+    return;
 
-  float threshold_physical_px =
-      kMovementThreshold * object.StyleRef().EffectiveZoom();
-
-  if (EqualWithinMovementThreshold(old_starting_point, new_starting_point,
-                                   threshold_physical_px))
+  if (EqualWithinMovementThreshold(LogicalStart(old_rect, source),
+                                   LogicalStart(new_rect, source), source))
     return;
 
   if (SmallerThanRegionGranularity(old_rect) &&
       SmallerThanRegionGranularity(new_rect))
     return;
 
+  // Ignore layout objects that move (in the coordinate space of the paint
+  // invalidation container) on scroll.
+  // TODO(skobes): Find a way to detect when these objects shift.
+  if (source.IsFixedPositioned() || source.IsStickyPositioned())
+    return;
+
+  // SVG elements don't participate in the normal layout algorithms and are
+  // more likely to be used for animations.
+  if (source.IsSVG())
+    return;
+
+  if (Element* element = DynamicTo<Element>(source.GetNode())) {
+    if (element->IsSliderThumbElement())
+      return;
+  }
+
   const auto& root_state =
-      object.View()->FirstFragment().LocalBorderBoxProperties();
+      source.View()->FirstFragment().LocalBorderBoxProperties();
   FloatClipRect clip_rect =
       GeometryMapper::LocalToAncestorClipRect(property_tree_state, root_state);
-  clip_rect.Intersect(FloatClipRect(FloatRect(
-      FloatPoint(),
-      FloatSize(
-          frame_view_->GetScrollableArea()->VisibleContentRect().Size()))));
 
   // If the clip region is empty, then the resulting layout shift isn't visible
   // in the viewport so ignore it.
-  if (clip_rect.Rect().IsEmpty())
+  if (!clip_rect.IsInfinite() && clip_rect.Rect().IsEmpty())
     return;
 
-  auto transform = GeometryMapper::SourceToDestinationProjection(
-      property_tree_state.Transform(), root_state.Transform());
-  FloatPoint old_starting_point_in_root =
-      transform.MapPoint(old_starting_point);
-  FloatPoint new_starting_point_in_root =
-      transform.MapPoint(new_starting_point);
+  GeometryMapper::SourceToDestinationRect(property_tree_state.Transform(),
+                                          root_state.Transform(), old_rect);
+  GeometryMapper::SourceToDestinationRect(property_tree_state.Transform(),
+                                          root_state.Transform(), new_rect);
 
-  if (EqualWithinMovementThreshold(old_starting_point_in_root,
-                                   new_starting_point_in_root,
-                                   threshold_physical_px))
+  if (EqualWithinMovementThreshold(old_rect.Location(), new_rect.Location(),
+                                   source)) {
     return;
+  }
 
-  if (EqualWithinMovementThreshold(
-          old_starting_point_in_root + frame_scroll_delta_,
-          new_starting_point_in_root, threshold_physical_px)) {
+  if (EqualWithinMovementThreshold(old_rect.Location() + frame_scroll_delta_,
+                                   new_rect.Location(), source)) {
     // TODO(skobes): Checking frame_scroll_delta_ is an imperfect solution to
     // allowing counterscrolled layout shifts. Ideally, we would map old_rect
     // to viewport coordinates using the previous frame's scroll tree.
     return;
   }
 
-  FloatRect old_rect_in_root(old_rect);
-  transform.MapRect(old_rect_in_root);
-  FloatRect new_rect_in_root(new_rect);
-  transform.MapRect(new_rect_in_root);
+  FloatRect clipped_old_rect(old_rect), clipped_new_rect(new_rect);
+  if (!clip_rect.IsInfinite()) {
+    clipped_old_rect.Intersect(clip_rect.Rect());
+    clipped_new_rect.Intersect(clip_rect.Rect());
+  }
 
-  IntRect visible_old_rect =
-      RoundedIntRect(Intersection(old_rect_in_root, clip_rect.Rect()));
-  IntRect visible_new_rect =
-      RoundedIntRect(Intersection(new_rect_in_root, clip_rect.Rect()));
+  IntRect viewport =
+      IntRect(IntPoint(),
+              frame_view_->GetScrollableArea()->VisibleContentRect().Size());
+
+  IntRect visible_old_rect = RoundedIntRect(clipped_old_rect);
+  visible_old_rect.Intersect(viewport);
+  IntRect visible_new_rect = RoundedIntRect(clipped_new_rect);
+  visible_new_rect.Intersect(viewport);
+
   if (visible_old_rect.IsEmpty() && visible_new_rect.IsEmpty())
     return;
 
   // Compute move distance based on unclipped rects, to accurately determine how
   // much the element moved.
-  float move_distance =
-      GetMoveDistance(old_starting_point_in_root, new_starting_point_in_root);
+  float move_distance = GetMoveDistance(old_rect, new_rect, source);
   frame_max_distance_ = std::max(frame_max_distance_, move_distance);
 
 #if DCHECK_IS_ON()
   LocalFrame& frame = frame_view_->GetFrame();
   if (ShouldLog(frame)) {
     DVLOG(2) << "in " << (frame.IsMainFrame() ? "" : "subframe ")
-             << frame.GetDocument()->Url() << ", " << object << " moved from "
-             << old_rect_in_root << " to " << new_rect_in_root
-             << " (visible from " << visible_old_rect << " to "
-             << visible_new_rect << ")";
-    if (old_starting_point_in_root != old_rect_in_root.Location() ||
-        new_starting_point_in_root != new_rect_in_root.Location()) {
-      DVLOG(2) << " (starting point from " << old_starting_point_in_root
-               << " to " << new_starting_point_in_root << ")";
-    }
+             << frame.GetDocument()->Url().GetString() << ", "
+             << source.DebugName() << " moved from " << old_rect.ToString()
+             << " to " << new_rect.ToString() << " (visible from "
+             << visible_old_rect.ToString() << " to "
+             << visible_new_rect.ToString() << ")";
   }
 #endif
 
   region_.AddRect(visible_old_rect);
   region_.AddRect(visible_new_rect);
 
-  if (Node* node = object.GetNode()) {
+  if (Node* node = source.GetNode()) {
     MaybeRecordAttribution(
         {DOMNodeIds::IdForNode(node), visible_old_rect, visible_new_rect});
   }
@@ -336,60 +273,16 @@
     *smallest = attribution;
 }
 
-void LayoutShiftTracker::NotifyBoxPrePaint(
-    const LayoutBox& box,
+void LayoutShiftTracker::NotifyObjectPrePaint(
+    const LayoutObject& object,
     const PropertyTreeStateOrAlias& property_tree_state,
-    const PhysicalRect& old_rect,
-    const PhysicalRect& new_rect,
-    const PhysicalOffset& old_paint_offset,
-    const PhysicalOffset& new_paint_offset) {
-  DCHECK(NeedsToTrack(box));
-  ObjectShifted(box, property_tree_state, old_rect, new_rect,
-                StartingPoint(old_paint_offset, box, box.PreviousSize()),
-                StartingPoint(new_paint_offset, box, box.Size()));
-}
-
-void LayoutShiftTracker::NotifyTextPrePaint(
-    const LayoutText& text,
-    const PropertyTreeStateOrAlias& property_tree_state,
-    const LogicalOffset& old_starting_point,
-    const LogicalOffset& new_starting_point,
-    const PhysicalOffset& old_paint_offset,
-    const PhysicalOffset& new_paint_offset) {
-  DCHECK(NeedsToTrack(text));
-  auto* block = ContainingBlockScope::top_;
-  DCHECK(block);
-  LayoutUnit distance = std::max(
-      (new_starting_point.inline_offset - old_starting_point.inline_offset)
-          .Abs(),
-      (new_starting_point.block_offset - old_starting_point.block_offset)
-          .Abs());
-  if (distance <= block->max_text_shift_distance_)
+    const PhysicalRect& old_visual_rect,
+    const PhysicalRect& new_visual_rect) {
+  if (!IsActive())
     return;
 
-  block->max_text_shift_distance_ = distance;
-  auto writing_direction = text.StyleRef().GetWritingDirection();
-  PhysicalOffset old_physical_starting_point =
-      old_paint_offset + old_starting_point.ConvertToPhysical(writing_direction,
-                                                              block->old_size_,
-                                                              PhysicalSize());
-  PhysicalOffset new_physical_starting_point =
-      new_paint_offset + new_starting_point.ConvertToPhysical(writing_direction,
-                                                              block->new_size_,
-                                                              PhysicalSize());
-
-  PhysicalRect old_rect = RectBelowStartingPoint(
-      block->old_rect_, old_physical_starting_point, writing_direction);
-  if (old_rect.IsEmpty())
-    return;
-  PhysicalRect new_rect = RectBelowStartingPoint(
-      block->new_rect_, new_physical_starting_point, writing_direction);
-  if (new_rect.IsEmpty())
-    return;
-
-  ObjectShifted(text, property_tree_state, old_rect, new_rect,
-                FloatPoint(old_physical_starting_point),
-                FloatPoint(new_physical_starting_point));
+  ObjectShifted(object, property_tree_state, FloatRect(old_visual_rect),
+                FloatRect(new_visual_rect));
 }
 
 double LayoutShiftTracker::SubframeWeightingFactor() const {
@@ -418,7 +311,7 @@
 }
 
 void LayoutShiftTracker::NotifyPrePaintFinished() {
-  if (!is_active_)
+  if (!IsActive())
     return;
   if (region_.IsEmpty())
     return;
@@ -446,7 +339,7 @@
   LocalFrame& frame = frame_view_->GetFrame();
   if (ShouldLog(frame)) {
     DVLOG(1) << "in " << (frame.IsMainFrame() ? "" : "subframe ")
-             << frame.GetDocument()->Url() << ", viewport was "
+             << frame.GetDocument()->Url().GetString() << ", viewport was "
              << (impact_fraction * 100) << "% impacted with distance fraction "
              << move_distance_factor;
   }
@@ -599,6 +492,14 @@
   UpdateInputTimestamp(base::TimeTicks::Now());
 }
 
+bool LayoutShiftTracker::IsActive() {
+  // This eliminates noise from the private Page object created by
+  // SVGImage::DataChanged.
+  if (frame_view_->GetFrame().GetChromeClient().IsSVGImageChromeClient())
+    return false;
+  return true;
+}
+
 std::unique_ptr<TracedValue> LayoutShiftTracker::PerFrameTraceData(
     double score_delta,
     bool input_detected) const {
@@ -676,7 +577,7 @@
     auto& hook = GetReattachHook();
     hook.scope_ = outer_;
     if (!outer_)
-      hook.geometries_before_detach_.clear();
+      hook.visual_rects_.clear();
   }
 }
 
@@ -685,19 +586,17 @@
   if (!hook.scope_)
     return;
   auto* layout_object = node.GetLayoutObject();
-  if (!layout_object || !layout_object->IsBox())
+  if (!layout_object)
     return;
 
-  auto& map = hook.geometries_before_detach_;
+  auto& map = hook.visual_rects_;
   auto& fragment = layout_object->GetMutableForPainting().FirstFragment();
 
   // Save the visual rect for restoration on future reattachment.
-  const auto& box = ToLayoutBox(*layout_object);
-  PhysicalRect layout_overflow_rect = box.PreviousPhysicalLayoutOverflowRect();
-  if (layout_overflow_rect.IsEmpty())
+  PhysicalRect visual_rect = fragment.VisualRectForLayoutShiftTracking();
+  if (visual_rect.IsEmpty())
     return;
-  map.Set(&node, Geometry{layout_overflow_rect, fragment.PaintOffset(),
-                          box.PreviousSize()});
+  map.Set(&node, visual_rect);
 }
 
 void ReattachHook::NotifyAttach(const Node& node) {
@@ -705,25 +604,20 @@
   if (!hook.scope_)
     return;
   auto* layout_object = node.GetLayoutObject();
-  if (!layout_object || !layout_object->IsBox())
+  if (!layout_object)
     return;
-  auto& map = hook.geometries_before_detach_;
+  auto& map = hook.visual_rects_;
   auto& fragment = layout_object->GetMutableForPainting().FirstFragment();
 
-  // Restore geometries that was saved during detach. Note: this does not
-  // affect paint invalidation; we will fully invalidate the new layout object.
+  // Restore the visual rect that was saved during detach.
   auto iter = map.find(&node);
   if (iter == map.end())
     return;
-  ToLayoutBox(layout_object)
-      ->GetMutableForPainting()
-      .SetPreviousSizeAndLayoutOverflowRect(iter->value.size,
-                                            iter->value.layout_overflow_rect);
-  fragment.SetPaintOffset(iter->value.paint_offset);
+  fragment.SetVisualRectForLayoutShiftTracking(iter->value);
 }
 
 void ReattachHook::Trace(Visitor* visitor) const {
-  visitor->Trace(geometries_before_detach_);
+  visitor->Trace(visual_rects_);
 }
 
 }  // namespace blink
diff --git a/third_party/blink/renderer/core/layout/layout_shift_tracker.h b/third_party/blink/renderer/core/layout/layout_shift_tracker.h
index 10d3cc0..e855351 100644
--- a/third_party/blink/renderer/core/layout/layout_shift_tracker.h
+++ b/third_party/blink/renderer/core/layout/layout_shift_tracker.h
@@ -18,13 +18,12 @@
 
 namespace blink {
 
-class LayoutBox;
 class LayoutObject;
-class LayoutText;
 class LocalFrameView;
 class PropertyTreeStateOrAlias;
 class TracedValue;
 class WebInputEvent;
+struct PhysicalRect;
 
 // Tracks "layout shifts" from layout objects changing their visual location
 // between animation frames. See https://github.com/WICG/layout-instability.
@@ -33,38 +32,26 @@
  public:
   explicit LayoutShiftTracker(LocalFrameView*);
   ~LayoutShiftTracker() = default;
-
-  bool NeedsToTrack(const LayoutObject&) const;
-
-  // |old_rect| and |new_rect| are layout overflow rects if the box has layout
-  // overflow and doesn't clip overflow, or border box rect, in the local
-  // transform space (property_tree_state.Transform()). |old_paint_offset| and
-  // |new_paint_offset| are the offsets of the border box rect in the local
-  // transform space, which are the same as |old_rect.offset| and
-  // |new_rect.offset| respectively if the rects are border box rects.
-  // As we don't save the old property tree state, the caller should adjust
-  // |old_rect| and |old_paint_offset| so that we can calculate the correct old
-  // visual representation and old starting point in the initial containing
-  // block and the viewport with the new property tree state in most cases.
-  void NotifyBoxPrePaint(const LayoutBox& box,
-                         const PropertyTreeStateOrAlias& property_tree_state,
-                         const PhysicalRect& old_rect,
-                         const PhysicalRect& new_rect,
-                         const PhysicalOffset& old_paint_offset,
-                         const PhysicalOffset& new_paint_offset);
-
-  void NotifyTextPrePaint(const LayoutText& text,
-                          const PropertyTreeStateOrAlias& property_tree_state,
-                          const LogicalOffset& old_starting_point,
-                          const LogicalOffset& new_starting_point,
-                          const PhysicalOffset& old_paint_offset,
-                          const PhysicalOffset& new_paint_offset);
-
+  // |old_visual_rect| and |new_visual_rect| are in the local transform space:
+  // |property_tree_state.Transform()|. As we don't save the old property tree
+  // state, the caller should adjust |old_visual_rect| as if the difference
+  // between the old and new additional offsets to the layout shift root[1]
+  // caused the difference between the locations of |old_visual_rect| and
+  // |new_visual_rect|, in addition to that caused by the difference between
+  // the old and new paint offsets in the local transform space, so that we can
+  // calculate the total shift from the layout shift root by comparing locations
+  // of |old_visual_rect| and |new_visual_rect|.
+  // [1] See PaintPropertyTreeBuilderFragmentContext::ContainingBlockContext
+  // ::additional_offset_to_layout_shift_root_delta.
+  void NotifyObjectPrePaint(const LayoutObject& object,
+                            const PropertyTreeStateOrAlias& property_tree_state,
+                            const PhysicalRect& old_visual_rect,
+                            const PhysicalRect& new_visual_rect);
   void NotifyPrePaintFinished();
   void NotifyInput(const WebInputEvent&);
   void NotifyScroll(mojom::blink::ScrollType, ScrollOffset delta);
   void NotifyViewportSizeChanged();
-  bool IsActive() const { return is_active_; }
+  bool IsActive();
   double Score() const { return score_; }
   double WeightedScore() const { return weighted_score_; }
   float OverallMaxDistance() const { return overall_max_distance_; }
@@ -96,51 +83,14 @@
 
    private:
     Scope* scope_ = nullptr;
-    struct Geometry {
-      PhysicalRect layout_overflow_rect;
-      PhysicalOffset paint_offset;
-      LayoutSize size;
-    };
-    HeapHashMap<Member<const Node>, Geometry> geometries_before_detach_;
-  };
-
-  class CORE_EXPORT ContainingBlockScope {
-   public:
-    // |old_size| and |new_size| are the border box sizes.
-    // |old_rect| and |new_rect| have the same definition as in
-    // NotifyBoxPrePaint().
-    explicit ContainingBlockScope(const PhysicalSize& old_size,
-                                  const PhysicalSize& new_size,
-                                  const PhysicalRect& old_rect,
-                                  const PhysicalRect& new_rect)
-        : outer_(top_),
-          old_size_(old_size),
-          new_size_(new_size),
-          old_rect_(old_rect),
-          new_rect_(new_rect) {
-      top_ = this;
-    }
-    ~ContainingBlockScope() { top_ = outer_; }
-
-   private:
-    friend class LayoutShiftTracker;
-    ContainingBlockScope* outer_;
-    static ContainingBlockScope* top_;
-    PhysicalSize old_size_;
-    PhysicalSize new_size_;
-    PhysicalRect old_rect_;
-    PhysicalRect new_rect_;
-    LayoutUnit max_text_shift_distance_;
+    HeapHashMap<Member<const Node>, PhysicalRect> visual_rects_;
   };
 
  private:
   void ObjectShifted(const LayoutObject&,
                      const PropertyTreeStateOrAlias&,
-                     const PhysicalRect& old_rect,
-                     const PhysicalRect& new_rect,
-                     const FloatPoint& old_starting_point,
-                     const FloatPoint& new_starting_point);
-
+                     FloatRect old_rect,
+                     FloatRect new_rect);
   void ReportShift(double score_delta, double weighted_score_delta);
   void TimerFired(TimerBase*) {}
   std::unique_ptr<TracedValue> PerFrameTraceData(double score_delta,
@@ -153,7 +103,6 @@
   void SubmitPerformanceEntry(double score_delta, bool input_detected) const;
 
   Member<LocalFrameView> frame_view_;
-  bool is_active_;
 
   // The document cumulative layout shift (DCLS) score for this LocalFrame,
   // unweighted, with move distance applied.
diff --git a/third_party/blink/renderer/core/layout/layout_text.cc b/third_party/blink/renderer/core/layout/layout_text.cc
index ded42b7..6d286c25 100644
--- a/third_party/blink/renderer/core/layout/layout_text.cc
+++ b/third_party/blink/renderer/core/layout/layout_text.cc
@@ -84,11 +84,10 @@
 
 struct SameSizeAsLayoutText : public LayoutObject {
   uint32_t bitfields : 12;
-  DOMNodeId node_id;
   float widths[4];
   String text;
   void* pointers[2];
-  PhysicalOffset previous_starting_point;
+  DOMNodeId node_id;
 };
 
 ASSERT_SIZE(LayoutText, SameSizeAsLayoutText);
@@ -1691,25 +1690,6 @@
   return PhysicalOffset();
 }
 
-LogicalOffset LayoutText::LogicalStartingPoint() const {
-  if (IsInLayoutNGInlineFormattingContext()) {
-    NGInlineCursor cursor;
-    cursor.MoveTo(*this);
-    if (!cursor)
-      return LogicalOffset();
-    PhysicalOffset physical_offset = cursor.Current().OffsetInContainerBlock();
-    if (StyleRef().GetWritingDirection().IsHorizontalLtr())
-      return {physical_offset.left, physical_offset.top};
-    return physical_offset.ConvertToLogical(
-        StyleRef().GetWritingDirection(),
-        PhysicalSizeToBeNoop(ContainingBlock()->Size()),
-        cursor.Current().Size());
-  }
-  if (const auto* text_box = FirstTextBox())
-    return {text_box->LogicalLeft(), text_box->LogicalTop()};
-  return LogicalOffset();
-}
-
 bool LayoutText::CanOptimizeSetText() const {
   // If we have only one line of text and "contain: layout size" we can avoid
   // doing a layout and only paint in the SetText() operation.
diff --git a/third_party/blink/renderer/core/layout/layout_text.h b/third_party/blink/renderer/core/layout/layout_text.h
index 989653f..0ebfc63 100644
--- a/third_party/blink/renderer/core/layout/layout_text.h
+++ b/third_party/blink/renderer/core/layout/layout_text.h
@@ -332,24 +332,6 @@
 
   void DetachAbstractInlineTextBoxesIfNeeded();
 
-  // Returns the logical location of the first line box.
-  LogicalOffset LogicalStartingPoint() const;
-
-  // For LayoutShiftTracker. Saves the value of LogicalStartingPoint() value
-  // during the previous paint invalidation.
-  LogicalOffset PreviousLogicalStartingPoint() const {
-    return previous_logical_starting_point_;
-  }
-  // This is const because LayoutObjects are const for paint invalidation.
-  void SetPreviousLogicalStartingPoint(const LogicalOffset& point) const {
-    DCHECK_EQ(GetDocument().Lifecycle().GetState(),
-              DocumentLifecycle::kInPrePaint);
-    previous_logical_starting_point_ = point;
-  }
-  static LogicalOffset UninitializedLogicalStartingPoint() {
-    return {LayoutUnit::Max(), LayoutUnit::Max()};
-  }
-
  protected:
   void WillBeDestroyed() override;
 
@@ -466,9 +448,6 @@
   // Used for LayoutNG with accessibility. True if inline fragments are
   // associated to |NGAbstractInlineTextBox|.
   unsigned has_abstract_inline_text_box_ : 1;
-
-  DOMNodeId node_id_ = kInvalidDOMNodeId;
-
   float min_width_;
   float max_width_;
   float first_line_min_width_;
@@ -476,10 +455,6 @@
 
   String text_;
 
-  // This is mutable for paint invalidation.
-  mutable LogicalOffset previous_logical_starting_point_ =
-      UninitializedLogicalStartingPoint();
-
   union {
     // The line boxes associated with this object.
     // Read the LINE BOXES OWNERSHIP section in the class header comment.
@@ -493,6 +468,7 @@
     // Valid only when IsInLayoutNGInlineFormattingContext().
     wtf_size_t first_fragment_item_index_;
   };
+  DOMNodeId node_id_ = kInvalidDOMNodeId;
 };
 
 inline InlineTextBoxList& LayoutText::MutableTextBoxes() {
diff --git a/third_party/blink/renderer/core/loader/document_loader.cc b/third_party/blink/renderer/core/loader/document_loader.cc
index fca6bf0..501097a 100644
--- a/third_party/blink/renderer/core/loader/document_loader.cc
+++ b/third_party/blink/renderer/core/loader/document_loader.cc
@@ -245,7 +245,7 @@
           CopyInitiatorOriginTrials(params_->initiator_origin_trial_features)),
       force_enabled_origin_trials_(
           CopyForceEnabledOriginTrials(params_->force_enabled_origin_trials)),
-      origin_isolation_restricted_(params_->origin_isolation_restricted),
+      origin_isolated_(params_->origin_isolated),
       is_cross_browsing_context_group_navigation_(
           params_->is_cross_browsing_context_group_navigation) {
   DCHECK(frame_);
@@ -1706,7 +1706,7 @@
     // multiple times *with different values*, but ideally we would use a better
     // architecture.
     if (!Document::ShouldInheritSecurityOriginFromOwner(Url())) {
-      agent->SetIsOriginIsolated(origin_isolation_restricted_);
+      agent->SetIsOriginIsolated(origin_isolated_);
     }
   } else {
     if (frame_->GetSettings()->GetShouldReuseGlobalForUnownedMainFrame() &&
diff --git a/third_party/blink/renderer/core/loader/document_loader.h b/third_party/blink/renderer/core/loader/document_loader.h
index d2c8aea9..e682741 100644
--- a/third_party/blink/renderer/core/loader/document_loader.h
+++ b/third_party/blink/renderer/core/loader/document_loader.h
@@ -558,7 +558,7 @@
   // Whether the document can be scrolled on load
   bool navigation_scroll_allowed_ = true;
 
-  bool origin_isolation_restricted_ = false;
+  bool origin_isolated_ = false;
 
   // Whether this load request is cross browsing context group.
   bool is_cross_browsing_context_group_navigation_ = false;
diff --git a/third_party/blink/renderer/core/paint/box_paint_invalidator.cc b/third_party/blink/renderer/core/paint/box_paint_invalidator.cc
index 4207af62..cbd4c0b 100644
--- a/third_party/blink/renderer/core/paint/box_paint_invalidator.cc
+++ b/third_party/blink/renderer/core/paint/box_paint_invalidator.cc
@@ -400,9 +400,8 @@
       box_.ContentSize() != box_.Size())
     return true;
   if ((BackgroundGeometryDependsOnLayoutOverflowRect() ||
-       BackgroundPaintsOntoScrollingContentsLayer() ||
-       !box_.HasOverflowClip()) &&
-      box_.HasLayoutOverflow())
+       BackgroundPaintsOntoScrollingContentsLayer()) &&
+      box_.LayoutOverflowRect() != box_.BorderBoxRect())
     return true;
 
   return false;
diff --git a/third_party/blink/renderer/core/paint/compositing/compositing_requirements_updater.cc b/third_party/blink/renderer/core/paint/compositing/compositing_requirements_updater.cc
index faf4b89..c983a14 100644
--- a/third_party/blink/renderer/core/paint/compositing/compositing_requirements_updater.cc
+++ b/third_party/blink/renderer/core/paint/compositing/compositing_requirements_updater.cc
@@ -27,6 +27,7 @@
 #include "third_party/blink/renderer/core/paint/compositing/compositing_requirements_updater.h"
 
 #include "base/macros.h"
+#include "third_party/blink/renderer/core/html/media/html_media_element.h"
 #include "third_party/blink/renderer/core/layout/layout_embedded_content.h"
 #include "third_party/blink/renderer/core/layout/layout_view.h"
 #include "third_party/blink/renderer/core/paint/compositing/paint_layer_compositor.h"
@@ -183,6 +184,13 @@
     subtree_reasons |= CompositingReason::kIsolateCompositedDescendants;
   }
 
+  if (layer->GetLayoutObject().IsVideo() &&
+      To<HTMLMediaElement>(layer->GetLayoutObject().GetNode())
+          ->IsFullscreen()) {
+    subtree_reasons |=
+        CompositingReason::kFullscreenVideoWithCompositedDescendants;
+  }
+
   // A layer with preserve-3d or perspective only needs to be composited if
   // there are descendant layers that will be affected by the preserve-3d or
   // perspective.
diff --git a/third_party/blink/renderer/core/paint/fragment_data.h b/third_party/blink/renderer/core/paint/fragment_data.h
index a4fa933..f4a3ab0 100644
--- a/third_party/blink/renderer/core/paint/fragment_data.h
+++ b/third_party/blink/renderer/core/paint/fragment_data.h
@@ -35,6 +35,14 @@
     paint_offset_ = paint_offset;
   }
 
+  // Visual rect in the space of the the local transform space.
+  const PhysicalRect& VisualRectForLayoutShiftTracking() const {
+    return visual_rect_for_layout_shift_tracking_;
+  }
+  void SetVisualRectForLayoutShiftTracking(const PhysicalRect& rect) {
+    visual_rect_for_layout_shift_tracking_ = rect;
+  }
+
   // An id for this object that is unique for the lifetime of the WebView.
   UniqueObjectId UniqueId() const {
     DCHECK(rare_data_);
@@ -242,6 +250,8 @@
   RareData& EnsureRareData();
 
   PhysicalOffset paint_offset_;
+  PhysicalRect visual_rect_for_layout_shift_tracking_;
+
   std::unique_ptr<RareData> rare_data_;
 };
 
diff --git a/third_party/blink/renderer/core/paint/paint_invalidator.cc b/third_party/blink/renderer/core/paint/paint_invalidator.cc
index 02f7af7..e92d928 100644
--- a/third_party/blink/renderer/core/paint/paint_invalidator.cc
+++ b/third_party/blink/renderer/core/paint/paint_invalidator.cc
@@ -141,129 +141,45 @@
   DCHECK(context.painting_layer == object.PaintingLayer());
 }
 
-void PaintInvalidator::UpdateFromTreeBuilderContext(
-    const PaintPropertyTreeBuilderFragmentContext& tree_builder_context,
+void PaintInvalidator::UpdateForPaintOffsetChange(
+    const LayoutObject& object,
+    FragmentData& fragment_data,
     PaintInvalidatorContext& context) {
-  DCHECK_EQ(tree_builder_context.current.paint_offset,
-            context.fragment_data->PaintOffset());
+  const auto* tree_context = context.tree_builder_context_;
+  DCHECK(tree_context);
+  DCHECK_EQ(tree_context->current.paint_offset, fragment_data.PaintOffset());
+
+  // LayoutShiftTracker doesn't track SVG children. Also the visual rect
+  // calculation below works for non-SVG-child objects only.
+  if (!object.IsSVGChild()) {
+    PhysicalRect new_visual_rect = object.LocalVisualRect();
+    new_visual_rect.Move(fragment_data.PaintOffset());
+    // If the layout shift root has changed, LayoutShiftTracker can't use the
+    // current paint property tree to map the old visual rect.
+    if (!tree_context->current.layout_shift_root_changed) {
+      // Adjust old_visual_rect so that LayoutShiftTracker can see the change of
+      // offset caused by change of transforms below the 2d translation root.
+      PhysicalRect old_visual_rect =
+          fragment_data.VisualRectForLayoutShiftTracking();
+      old_visual_rect.Move(
+          -tree_context->current.additional_offset_to_layout_shift_root_delta);
+      object.GetFrameView()->GetLayoutShiftTracker().NotifyObjectPrePaint(
+          object,
+          PropertyTreeStateOrAlias(*tree_context->current.transform,
+                                   *tree_context->current.clip,
+                                   *tree_context->current_effect),
+          old_visual_rect, new_visual_rect);
+    }
+    fragment_data.SetVisualRectForLayoutShiftTracking(new_visual_rect);
+  }
 
   // For performance, we ignore subpixel movement of composited layers for paint
   // invalidation. This will result in imperfect pixel-snapped painting.
   // See crbug.com/833083 for details.
-  if (tree_builder_context.current
+  if (tree_context->current
           .directly_composited_container_paint_offset_subpixel_delta ==
-      tree_builder_context.current.paint_offset -
-          tree_builder_context.old_paint_offset) {
-    context.old_paint_offset = tree_builder_context.current.paint_offset;
-  } else {
-    context.old_paint_offset = tree_builder_context.old_paint_offset;
-  }
-
-  context.transform_ = tree_builder_context.current.transform;
-}
-
-void PaintInvalidator::UpdateLayoutShiftTracking(
-    const LayoutObject& object,
-    const PaintPropertyTreeBuilderFragmentContext& tree_builder_context,
-    PaintInvalidatorContext& context) {
-  if (!object.ShouldCheckGeometryForPaintInvalidation())
-    return;
-
-  auto& layout_shift_tracker = object.GetFrameView()->GetLayoutShiftTracker();
-  if (!layout_shift_tracker.NeedsToTrack(object))
-    return;
-
-  PropertyTreeStateOrAlias property_tree_state(
-      *tree_builder_context.current.transform,
-      *tree_builder_context.current.clip, *tree_builder_context.current_effect);
-
-  if (object.IsText()) {
-    const auto& text = ToLayoutText(object);
-    LogicalOffset new_starting_point = text.LogicalStartingPoint();
-    LogicalOffset old_starting_point = text.PreviousLogicalStartingPoint();
-    if (new_starting_point == old_starting_point)
-      return;
-    text.SetPreviousLogicalStartingPoint(new_starting_point);
-    if (old_starting_point == LayoutText::UninitializedLogicalStartingPoint())
-      return;
-    // If the layout shift root has changed, LayoutShiftTracker can't use the
-    // current paint property tree to map the old rect.
-    if (tree_builder_context.current.layout_shift_root_changed)
-      return;
-
-    layout_shift_tracker.NotifyTextPrePaint(
-        text, property_tree_state, old_starting_point, new_starting_point,
-        // Similar to the adjustment of old_paint_offset for LayoutBox.
-        context.old_paint_offset -
-            tree_builder_context.current
-                .additional_offset_to_layout_shift_root_delta,
-        tree_builder_context.current.paint_offset);
-    return;
-  }
-
-  DCHECK(object.IsBox());
-  const auto& box = ToLayoutBox(object);
-
-  PhysicalRect new_rect = box.HasOverflowClip()
-                              ? box.PhysicalBorderBoxRect()
-                              : box.PhysicalLayoutOverflowRect();
-  // If we didn't save the previous physical layout overflow rect, (e.g. if
-  // there was no layout overflow or we clipped overflow and there was no other
-  // reason for saving the value) this is the previous PhysicalBorderBoxRect(),
-  // so it is mostly the correct previous rect for layout shift tracking.
-  PhysicalRect old_rect = box.PreviousPhysicalLayoutOverflowRect();
-
-  bool should_report_layout_shift = [&]() -> bool {
-    // If the layout shift root has changed, LayoutShiftTracker can't use the
-    // current paint property tree to map the old rect.
-    if (tree_builder_context.current.layout_shift_root_changed)
-      return false;
-    if (new_rect.IsEmpty() || old_rect.IsEmpty())
-      return false;
-    // The parent of out-of-flow-positioned object may not be its container.
-    if (object.IsOutOfFlowPositioned())
-      return true;
-    // We don't report shift for anonymous objects but report for the children.
-    if (object.Parent()->IsAnonymous())
-      return true;
-    // Report if the parent is in a different transform space.
-    const auto* parent_context = context.ParentContext();
-    if (!parent_context || !parent_context->transform_ ||
-        parent_context->transform_ != tree_builder_context.current.transform)
-      return true;
-    // Report if this object has local movement (i.e. delta of paint offset is
-    // different from that of the parent).
-    return parent_context->fragment_data->PaintOffset() -
-               parent_context->old_paint_offset !=
-           tree_builder_context.current.paint_offset - context.old_paint_offset;
-  }();
-
-  if (!should_report_layout_shift && !box.ChildrenInline())
-    return;
-
-  new_rect.Move(tree_builder_context.current.paint_offset);
-  old_rect.Move(context.old_paint_offset);
-  // Adjust old_visual_rect so that LayoutShiftTracker can see the change of
-  // offset caused by change of transforms below the 2d translation root.
-  old_rect.Move(-tree_builder_context.current
-                     .additional_offset_to_layout_shift_root_delta);
-
-  if (box.ChildrenInline()) {
-    // For layout shift tracking of contained LayoutTexts.
-    context.containing_block_scope_.emplace(
-        PhysicalSizeToBeNoop(box.PreviousSize()),
-        PhysicalSizeToBeNoop(box.Size()), old_rect, new_rect);
-    if (!should_report_layout_shift)
-      return;
-  }
-
-  // Adjust old_paint_offset similarly.
-  PhysicalOffset old_paint_offset =
-      context.old_paint_offset -
-      tree_builder_context.current.additional_offset_to_layout_shift_root_delta;
-  layout_shift_tracker.NotifyBoxPrePaint(
-      box, property_tree_state, old_rect, new_rect, old_paint_offset,
-      tree_builder_context.current.paint_offset);
+      fragment_data.PaintOffset() - context.old_paint_offset)
+    context.old_paint_offset = fragment_data.PaintOffset();
 }
 
 bool PaintInvalidator::InvalidatePaint(
@@ -306,11 +222,12 @@
 
     if (tree_builder_context) {
       DCHECK_EQ(tree_builder_context->fragments.size(), 1u);
-      const auto& fragment_tree_builder_context =
-          tree_builder_context->fragments[0];
-      UpdateFromTreeBuilderContext(fragment_tree_builder_context, context);
-      UpdateLayoutShiftTracking(object, fragment_tree_builder_context, context);
+      context.tree_builder_context_ = &tree_builder_context->fragments[0];
+      context.old_paint_offset =
+          context.tree_builder_context_->old_paint_offset;
+      UpdateForPaintOffsetChange(object, fragment_data, context);
     } else {
+      context.tree_builder_context_ = nullptr;
       context.old_paint_offset = fragment_data.PaintOffset();
     }
 
@@ -327,12 +244,13 @@
              tree_builder_index < tree_builder_context->fragments.size());
 
       if (tree_builder_context) {
-        const auto& fragment_tree_builder_context =
-            tree_builder_context->fragments[tree_builder_index];
-        UpdateFromTreeBuilderContext(fragment_tree_builder_context, context);
-        UpdateLayoutShiftTracking(object, fragment_tree_builder_context,
-                                  context);
+        context.tree_builder_context_ =
+            &tree_builder_context->fragments[tree_builder_index];
+        context.old_paint_offset =
+            context.tree_builder_context_->old_paint_offset;
+        UpdateForPaintOffsetChange(object, *fragment_data, context);
       } else {
+        context.tree_builder_context_ = nullptr;
         context.old_paint_offset = fragment_data->PaintOffset();
       }
 
diff --git a/third_party/blink/renderer/core/paint/paint_invalidator.h b/third_party/blink/renderer/core/paint/paint_invalidator.h
index 9b49aced..3417989c 100644
--- a/third_party/blink/renderer/core/paint/paint_invalidator.h
+++ b/third_party/blink/renderer/core/paint/paint_invalidator.h
@@ -6,7 +6,6 @@
 #define THIRD_PARTY_BLINK_RENDERER_CORE_PAINT_PAINT_INVALIDATOR_H_
 
 #include "third_party/blink/renderer/core/layout/layout_object.h"
-#include "third_party/blink/renderer/core/layout/layout_shift_tracker.h"
 #include "third_party/blink/renderer/core/paint/paint_property_tree_builder.h"
 #include "third_party/blink/renderer/platform/geometry/layout_rect.h"
 #include "third_party/blink/renderer/platform/graphics/paint_invalidation_reason.h"
@@ -104,9 +103,8 @@
  private:
   friend class PaintInvalidator;
 
-  base::Optional<LayoutShiftTracker::ContainingBlockScope>
-      containing_block_scope_;
-  const TransformPaintPropertyNodeOrAlias* transform_ = nullptr;
+  const PaintPropertyTreeBuilderFragmentContext* tree_builder_context_ =
+      nullptr;
 };
 
 class PaintInvalidator {
@@ -136,13 +134,9 @@
   ALWAYS_INLINE void UpdateDirectlyCompositedContainer(const LayoutObject&,
                                                        PaintInvalidatorContext&,
                                                        bool is_ng_painting);
-  ALWAYS_INLINE void UpdateFromTreeBuilderContext(
-      const PaintPropertyTreeBuilderFragmentContext&,
-      PaintInvalidatorContext&);
-  ALWAYS_INLINE void UpdateLayoutShiftTracking(
-      const LayoutObject&,
-      const PaintPropertyTreeBuilderFragmentContext&,
-      PaintInvalidatorContext&);
+  ALWAYS_INLINE void UpdateForPaintOffsetChange(const LayoutObject&,
+                                                FragmentData&,
+                                                PaintInvalidatorContext&);
 
   Vector<const LayoutObject*> pending_delayed_paint_invalidations_;
 };
diff --git a/third_party/blink/renderer/core/script/classic_script.cc b/third_party/blink/renderer/core/script/classic_script.cc
index a548826..2712d24 100644
--- a/third_party/blink/renderer/core/script/classic_script.cc
+++ b/third_party/blink/renderer/core/script/classic_script.cc
@@ -8,11 +8,18 @@
 #include "third_party/blink/renderer/bindings/core/v8/script_source_code.h"
 #include "third_party/blink/renderer/bindings/core/v8/worker_or_worklet_script_controller.h"
 #include "third_party/blink/renderer/core/frame/local_frame.h"
-#include "third_party/blink/renderer/core/workers/worker_global_scope.h"
+#include "third_party/blink/renderer/core/workers/worker_or_worklet_global_scope.h"
 #include "third_party/blink/renderer/core/workers/worker_reporting_proxy.h"
 
 namespace blink {
 
+ClassicScript* ClassicScript::CreateUnspecifiedScript(
+    const ScriptSourceCode& script_source_code,
+    SanitizeScriptErrors sanitize_script_errors) {
+  return MakeGarbageCollected<ClassicScript>(
+      script_source_code, KURL(), ScriptFetchOptions(), sanitize_script_errors);
+}
+
 void ClassicScript::Trace(Visitor* visitor) const {
   Script::Trace(visitor);
   visitor->Trace(script_source_code_);
@@ -24,21 +31,45 @@
       FetchOptions());
 }
 
-void ClassicScript::RunScriptOnWorker(WorkerGlobalScope& worker_global_scope) {
-  DCHECK(worker_global_scope.IsContextThread());
+void ClassicScript::RunScript(LocalFrame* frame,
+                              ScriptController::ExecuteScriptPolicy policy) {
+  frame->GetScriptController().ExecuteScriptInMainWorld(
+      GetScriptSourceCode(), BaseURL(), sanitize_script_errors_, FetchOptions(),
+      policy);
+}
 
-  WorkerReportingProxy& worker_reporting_proxy =
-      worker_global_scope.ReportingProxy();
+v8::Local<v8::Value> ClassicScript::RunScriptAndReturnValue(
+    LocalFrame* frame,
+    ScriptController::ExecuteScriptPolicy policy) {
+  return frame->GetScriptController().ExecuteScriptInMainWorldAndReturnValue(
+      GetScriptSourceCode(), BaseURL(), sanitize_script_errors_, FetchOptions(),
+      policy);
+}
 
-  worker_reporting_proxy.WillEvaluateClassicScript(
-      GetScriptSourceCode().Source().length(),
+v8::Local<v8::Value> ClassicScript::RunScriptInIsolatedWorldAndReturnValue(
+    LocalFrame* frame,
+    int32_t world_id) {
+  return frame->GetScriptController().ExecuteScriptInIsolatedWorld(
+      world_id, GetScriptSourceCode(), BaseURL(), sanitize_script_errors_);
+}
+
+bool ClassicScript::RunScriptOnWorkerOrWorklet(
+    WorkerOrWorkletGlobalScope& global_scope) {
+  DCHECK(global_scope.IsContextThread());
+
+  bool success = global_scope.ScriptController()->Evaluate(
+      GetScriptSourceCode(), sanitize_script_errors_, nullptr /* error_event */,
+      global_scope.GetV8CacheOptions());
+  return success;
+}
+
+std::pair<size_t, size_t> ClassicScript::GetClassicScriptSizes() const {
+  size_t cached_metadata_size =
       GetScriptSourceCode().CacheHandler()
           ? GetScriptSourceCode().CacheHandler()->GetCodeCacheSize()
-          : 0);
-  bool success = worker_global_scope.ScriptController()->Evaluate(
-      GetScriptSourceCode(), sanitize_script_errors_, nullptr /* error_event */,
-      worker_global_scope.GetV8CacheOptions());
-  worker_reporting_proxy.DidEvaluateClassicScript(success);
+          : 0;
+  return std::pair<size_t, size_t>(GetScriptSourceCode().Source().length(),
+                                   cached_metadata_size);
 }
 
 }  // namespace blink
diff --git a/third_party/blink/renderer/core/script/classic_script.h b/third_party/blink/renderer/core/script/classic_script.h
index ff9c5e2..309ba7f 100644
--- a/third_party/blink/renderer/core/script/classic_script.h
+++ b/third_party/blink/renderer/core/script/classic_script.h
@@ -6,6 +6,7 @@
 #define THIRD_PARTY_BLINK_RENDERER_CORE_SCRIPT_CLASSIC_SCRIPT_H_
 
 #include "third_party/blink/renderer/bindings/core/v8/sanitize_script_errors.h"
+#include "third_party/blink/renderer/bindings/core/v8/script_controller.h"
 #include "third_party/blink/renderer/bindings/core/v8/script_source_code.h"
 #include "third_party/blink/renderer/core/core_export.h"
 #include "third_party/blink/renderer/core/loader/resource/script_resource.h"
@@ -16,6 +17,9 @@
 
 class CORE_EXPORT ClassicScript final : public Script {
  public:
+  // For scripts specified in the HTML spec.
+  // Please leave spec comments and spec links that explain given argument
+  // values at callers.
   ClassicScript(const ScriptSourceCode& script_source_code,
                 const KURL& base_url,
                 const ScriptFetchOptions& fetch_options,
@@ -24,18 +28,45 @@
         script_source_code_(script_source_code),
         sanitize_script_errors_(sanitize_script_errors) {}
 
+  // For scripts not specified in the HTML spec.
+  //
+  // New callers should use SanitizeScriptErrors::kSanitize as a safe default
+  // value, while some existing callers uses kDoNotSanitize to preserve existing
+  // behavior.
+  // TODO(crbug/1112266): Use kSanitize for all existing callers if possible, or
+  // otherwise add comments why kDoNotSanitize should be used.
+  static ClassicScript* CreateUnspecifiedScript(
+      const ScriptSourceCode&,
+      SanitizeScriptErrors = SanitizeScriptErrors::kSanitize);
+
   void Trace(Visitor*) const override;
 
   const ScriptSourceCode& GetScriptSourceCode() const {
     return script_source_code_;
   }
 
+  // TODO(crbug/1111134): The RunScript() with ExecuteScriptPolicy is declared
+  // and overloaded here to avoid modifying Script::RunScript(), because this is
+  // a tentative interface. When crbug/1111134 is done, this should be gone.
+  void RunScript(LocalFrame*) override;
+  void RunScript(LocalFrame*, ScriptController::ExecuteScriptPolicy);
+  bool RunScriptOnWorkerOrWorklet(WorkerOrWorkletGlobalScope&) override;
+
+  // Unlike RunScript() and RunScriptOnWorkerOrWorklet(), callers of the
+  // following methods must enter a v8::HandleScope before calling.
+  v8::Local<v8::Value> RunScriptAndReturnValue(
+      LocalFrame*,
+      ScriptController::ExecuteScriptPolicy = ScriptController::
+          ExecuteScriptPolicy::kDoNotExecuteScriptWhenScriptsDisabled);
+  v8::Local<v8::Value> RunScriptInIsolatedWorldAndReturnValue(LocalFrame*,
+                                                              int32_t world_id);
+
  private:
   mojom::ScriptType GetScriptType() const override {
     return mojom::ScriptType::kClassic;
   }
-  void RunScript(LocalFrame*) override;
-  void RunScriptOnWorker(WorkerGlobalScope&) override;
+
+  std::pair<size_t, size_t> GetClassicScriptSizes() const override;
 
   const ScriptSourceCode script_source_code_;
   const SanitizeScriptErrors sanitize_script_errors_;
diff --git a/third_party/blink/renderer/core/script/module_script.cc b/third_party/blink/renderer/core/script/module_script.cc
index c4e4bce..bb775ea 100644
--- a/third_party/blink/renderer/core/script/module_script.cc
+++ b/third_party/blink/renderer/core/script/module_script.cc
@@ -7,8 +7,7 @@
 #include "third_party/blink/renderer/bindings/core/v8/module_record.h"
 #include "third_party/blink/renderer/bindings/core/v8/script_value.h"
 #include "third_party/blink/renderer/core/script/module_record_resolver.h"
-#include "third_party/blink/renderer/core/workers/worker_global_scope.h"
-#include "third_party/blink/renderer/core/workers/worker_reporting_proxy.h"
+#include "third_party/blink/renderer/core/workers/worker_or_worklet_global_scope.h"
 #include "third_party/blink/renderer/platform/bindings/script_state.h"
 #include "v8/include/v8.h"
 
@@ -111,22 +110,23 @@
                                   Modulator::CaptureEvalErrorFlag::kReport);
 }
 
-void ModuleScript::RunScriptOnWorker(WorkerGlobalScope& worker_global_scope) {
+bool ModuleScript::RunScriptOnWorkerOrWorklet(
+    WorkerOrWorkletGlobalScope& global_scope) {
   // We need a HandleScope for the ModuleEvaluationResult that is created
   // in ::ExecuteModule(...).
   ScriptState::Scope scope(SettingsObject()->GetScriptState());
-  DCHECK(worker_global_scope.IsContextThread());
+  DCHECK(global_scope.IsContextThread());
 
-  WorkerReportingProxy& worker_reporting_proxy =
-      worker_global_scope.ReportingProxy();
-
-  worker_reporting_proxy.WillEvaluateModuleScript();
   // This |error| is always null because the second argument is |kReport|.
   // TODO(nhiroki): Catch an error when an evaluation error happens.
   // (https://crbug.com/680046)
   ModuleEvaluationResult result = SettingsObject()->ExecuteModule(
       this, Modulator::CaptureEvalErrorFlag::kReport);
-  worker_reporting_proxy.DidEvaluateModuleScript(result.IsSuccess());
+  return result.IsSuccess();
+}
+
+std::pair<size_t, size_t> ModuleScript::GetClassicScriptSizes() const {
+  return std::pair<size_t, size_t>(0, 0);
 }
 
 std::ostream& operator<<(std::ostream& stream,
diff --git a/third_party/blink/renderer/core/script/module_script.h b/third_party/blink/renderer/core/script/module_script.h
index b892202..646a00c 100644
--- a/third_party/blink/renderer/core/script/module_script.h
+++ b/third_party/blink/renderer/core/script/module_script.h
@@ -68,7 +68,9 @@
     return mojom::ScriptType::kModule;
   }
   void RunScript(LocalFrame*) override;
-  void RunScriptOnWorker(WorkerGlobalScope&) override;
+  bool RunScriptOnWorkerOrWorklet(WorkerOrWorkletGlobalScope&) override;
+
+  std::pair<size_t, size_t> GetClassicScriptSizes() const override;
 
   friend class ModuleTreeLinkerTestModulator;
 
diff --git a/third_party/blink/renderer/core/script/script.h b/third_party/blink/renderer/core/script/script.h
index e10dd39..3d19ef8 100644
--- a/third_party/blink/renderer/core/script/script.h
+++ b/third_party/blink/renderer/core/script/script.h
@@ -16,7 +16,7 @@
 namespace blink {
 
 class LocalFrame;
-class WorkerGlobalScope;
+class WorkerOrWorkletGlobalScope;
 
 // https://html.spec.whatwg.org/C/#concept-script
 class CORE_EXPORT Script : public GarbageCollected<Script> {
@@ -34,12 +34,20 @@
   // https://html.spec.whatwg.org/C/#run-a-module-script,
   // depending on the script type,
   // on Window or on WorkerGlobalScope, respectively.
+  // RunScriptOnWorkerOrWorklet returns true if evaluated successfully.
   virtual void RunScript(LocalFrame*) = 0;
-  virtual void RunScriptOnWorker(WorkerGlobalScope&) = 0;
+  virtual bool RunScriptOnWorkerOrWorklet(WorkerOrWorkletGlobalScope&) = 0;
 
   const ScriptFetchOptions& FetchOptions() const { return fetch_options_; }
   const KURL& BaseURL() const { return base_url_; }
 
+  // Returns a pair of (script's size, cached metadata's size) only for classic
+  // scripts. This is used only for metrics via
+  // ServiceWorkerGlobalScopeProxy::WillEvaluateClassicScript().
+  // TODO(asamidoi, hiroshige): Remove this once the metrics are no longer
+  // referenced.
+  virtual std::pair<size_t, size_t> GetClassicScriptSizes() const = 0;
+
  protected:
   explicit Script(const ScriptFetchOptions& fetch_options, const KURL& base_url)
       : fetch_options_(fetch_options), base_url_(base_url) {}
diff --git a/third_party/blink/renderer/core/style/computed_style.h b/third_party/blink/renderer/core/style/computed_style.h
index 952cf28..1330d337 100644
--- a/third_party/blink/renderer/core/style/computed_style.h
+++ b/third_party/blink/renderer/core/style/computed_style.h
@@ -2552,15 +2552,18 @@
   // Load the images of CSS properties that were deferred by LazyLoad.
   void LoadDeferredImages(Document&) const;
 
+  enum WebColorScheme ComputedColorScheme() const {
+    return DarkColorScheme() ? WebColorScheme::kDark : WebColorScheme::kLight;
+  }
+
   enum WebColorScheme UsedColorScheme() const {
-    return DarkColorScheme() &&
-                   RuntimeEnabledFeatures::CSSColorSchemeUARenderingEnabled()
-               ? WebColorScheme::kDark
+    return RuntimeEnabledFeatures::CSSColorSchemeUARenderingEnabled()
+               ? ComputedColorScheme()
                : WebColorScheme::kLight;
   }
 
   enum WebColorScheme UsedColorSchemeForInitialColors() const {
-    return DarkColorScheme() ? WebColorScheme::kDark : WebColorScheme::kLight;
+    return ComputedColorScheme();
   }
 
   StyleColor InitialColorForColorScheme() const {
diff --git a/third_party/blink/renderer/core/svg/graphics/filters/svg_filter_builder.cc b/third_party/blink/renderer/core/svg/graphics/filters/svg_filter_builder.cc
index 1ebaa99..288e68fe 100644
--- a/third_party/blink/renderer/core/svg/graphics/filters/svg_filter_builder.cc
+++ b/third_party/blink/renderer/core/svg/graphics/filters/svg_filter_builder.cc
@@ -66,7 +66,7 @@
 SVGFilterGraphNodeMap::SVGFilterGraphNodeMap() = default;
 
 void SVGFilterGraphNodeMap::AddBuiltinEffect(FilterEffect* effect) {
-  effect_references_.insert(effect, FilterEffectSet());
+  effect_references_.insert(effect, MakeGarbageCollected<FilterEffectSet>());
 }
 
 void SVGFilterGraphNodeMap::AddPrimitive(
@@ -75,7 +75,7 @@
   // The effect must be a newly created filter effect.
   DCHECK(!effect_references_.Contains(effect));
   DCHECK(!effect_element_.Contains(&primitive));
-  effect_references_.insert(effect, FilterEffectSet());
+  effect_references_.insert(effect, MakeGarbageCollected<FilterEffectSet>());
 
   // Add references from the inputs of this effect to the effect itself, to
   // allow determining what effects needs to be invalidated when a certain
diff --git a/third_party/blink/renderer/core/svg/graphics/filters/svg_filter_builder.h b/third_party/blink/renderer/core/svg/graphics/filters/svg_filter_builder.h
index 29a25445..6153e4f4 100644
--- a/third_party/blink/renderer/core/svg/graphics/filters/svg_filter_builder.h
+++ b/third_party/blink/renderer/core/svg/graphics/filters/svg_filter_builder.h
@@ -66,12 +66,12 @@
   FilterEffectSet& EffectReferences(FilterEffect* effect) {
     // Only allowed for effects that are part of this node map.
     DCHECK(effect_references_.Contains(effect));
-    return effect_references_.find(effect)->value;
+    return *effect_references_.find(effect)->value;
   }
 
   // The value is the set of filter effects that depend on the key
   // filter effect.
-  HeapHashMap<Member<FilterEffect>, FilterEffectSet> effect_references_;
+  HeapHashMap<Member<FilterEffect>, Member<FilterEffectSet>> effect_references_;
   HeapHashMap<WeakMember<SVGFilterPrimitiveStandardAttributes>,
               Member<FilterEffect>>
       effect_element_;
diff --git a/third_party/blink/renderer/core/svg/graphics/svg_image.cc b/third_party/blink/renderer/core/svg/graphics/svg_image.cc
index 19ba9b1..dc635ae 100644
--- a/third_party/blink/renderer/core/svg/graphics/svg_image.cc
+++ b/third_party/blink/renderer/core/svg/graphics/svg_image.cc
@@ -924,4 +924,31 @@
   return "svg";
 }
 
+SkBitmap SVGImage::AsSkBitmapForCursor(float device_scale_factor) {
+  // The size should be scaled by the device scale factor for the cursor so that
+  // the SVG can be drawn at the correct resolution for a crisp image on high
+  // DPI displays. Scaling the size here causes the SVG to be rasterized at the
+  // correct resolution and causes the canvas that it is rasterized into being
+  // the correct size so that the cursor is not clipped.
+  IntSize scaled_size = Size();
+  scaled_size.Scale(device_scale_factor);
+
+  auto builder =
+      CreatePaintImageBuilder().set_completion_state(completion_state());
+  PopulatePaintRecordForCurrentFrameForContainer(builder, NullURL(),
+                                                 scaled_size);
+
+  PaintImage paint_image = builder.TakePaintImage();
+  if (!paint_image)
+    return {};
+
+  sk_sp<SkImage> sk_image = paint_image.GetSkImage();
+  if (!sk_image)
+    return {};
+
+  SkBitmap bitmap;
+  sk_image->asLegacyBitmap(&bitmap);
+  return bitmap;
+}
+
 }  // namespace blink
diff --git a/third_party/blink/renderer/core/svg/graphics/svg_image.h b/third_party/blink/renderer/core/svg/graphics/svg_image.h
index 2977258..a888240 100644
--- a/third_party/blink/renderer/core/svg/graphics/svg_image.h
+++ b/third_party/blink/renderer/core/svg/graphics/svg_image.h
@@ -126,6 +126,8 @@
 
   PaintImage PaintImageForCurrentFrame() override;
 
+  SkBitmap AsSkBitmapForCursor(float device_scale_factor);
+
  protected:
   // Whether or not size is available yet.
   bool IsSizeAvailable() override;
diff --git a/third_party/blink/renderer/core/svg/svg_element.cc b/third_party/blink/renderer/core/svg/svg_element.cc
index e4f9acaf..a151680 100644
--- a/third_party/blink/renderer/core/svg/svg_element.cc
+++ b/third_party/blink/renderer/core/svg/svg_element.cc
@@ -196,7 +196,7 @@
     SVGInterpolationTypesMap map;
     SVGInterpolationEnvironment environment(
         map, *this, PropertyFromAttribute(attribute)->BaseValueBase());
-    InvalidatableInterpolation::ApplyStack(entry.value, environment);
+    InvalidatableInterpolation::ApplyStack(*entry.value, environment);
   }
   if (!HasSVGRareData())
     return;
diff --git a/third_party/blink/renderer/core/timing/performance_user_timing.cc b/third_party/blink/renderer/core/timing/performance_user_timing.cc
index 380276e..eabcca3 100644
--- a/third_party/blink/renderer/core/timing/performance_user_timing.cc
+++ b/third_party/blink/renderer/core/timing/performance_user_timing.cc
@@ -41,10 +41,11 @@
                                    PerformanceEntry& entry) {
   PerformanceEntryMap::iterator it = performance_entry_map.find(entry.name());
   if (it != performance_entry_map.end()) {
-    it->value.push_back(&entry);
+    it->value->push_back(&entry);
   } else {
-    PerformanceEntryVector vector(1);
-    vector[0] = Member<PerformanceEntry>(entry);
+    PerformanceEntryVector* vector =
+        MakeGarbageCollected<PerformanceEntryVector>(1);
+    (*vector)[0] = Member<PerformanceEntry>(entry);
     performance_entry_map.Set(entry.name(), vector);
   }
 }
@@ -80,7 +81,7 @@
   PerformanceEntryMap::const_iterator existing_marks =
       marks_map_.find(mark_name);
   if (existing_marks != marks_map_.end()) {
-    return existing_marks->value.back()->startTime();
+    return existing_marks->value->back()->startTime();
   }
 
   PerformanceTiming::PerformanceTimingGetter timing_function =
@@ -203,7 +204,7 @@
   PerformanceEntryVector entries;
 
   for (const auto& entry : performance_entry_map)
-    entries.AppendVector(entry.value);
+    entries.AppendVector(*entry.value);
 
   return entries;
 }
@@ -215,7 +216,7 @@
 
   PerformanceEntryMap::const_iterator it = performance_entry_map.find(name);
   if (it != performance_entry_map.end())
-    entries.AppendVector(it->value);
+    entries.AppendVector(*it->value);
 
   return entries;
 }
diff --git a/third_party/blink/renderer/core/timing/performance_user_timing.h b/third_party/blink/renderer/core/timing/performance_user_timing.h
index ae6c48d..ecc30132 100644
--- a/third_party/blink/renderer/core/timing/performance_user_timing.h
+++ b/third_party/blink/renderer/core/timing/performance_user_timing.h
@@ -36,7 +36,8 @@
 class ExceptionState;
 class Performance;
 
-using PerformanceEntryMap = HeapHashMap<AtomicString, PerformanceEntryVector>;
+using PerformanceEntryMap =
+    HeapHashMap<AtomicString, Member<PerformanceEntryVector>>;
 
 class UserTiming final : public GarbageCollected<UserTiming> {
  public:
diff --git a/third_party/blink/renderer/core/workers/dedicated_worker_object_proxy.cc b/third_party/blink/renderer/core/workers/dedicated_worker_object_proxy.cc
index 71e20537c..fb3df92 100644
--- a/third_party/blink/renderer/core/workers/dedicated_worker_object_proxy.cc
+++ b/third_party/blink/renderer/core/workers/dedicated_worker_object_proxy.cc
@@ -109,15 +109,7 @@
                           messaging_proxy_weak_ptr_));
 }
 
-void DedicatedWorkerObjectProxy::DidEvaluateClassicScript(bool success) {
-  PostCrossThreadTask(
-      *GetParentExecutionContextTaskRunners()->Get(TaskType::kInternalDefault),
-      FROM_HERE,
-      CrossThreadBindOnce(&DedicatedWorkerMessagingProxy::DidEvaluateScript,
-                          messaging_proxy_weak_ptr_, success));
-}
-
-void DedicatedWorkerObjectProxy::DidEvaluateModuleScript(bool success) {
+void DedicatedWorkerObjectProxy::DidEvaluateTopLevelScript(bool success) {
   PostCrossThreadTask(
       *GetParentExecutionContextTaskRunners()->Get(TaskType::kInternalDefault),
       FROM_HERE,
diff --git a/third_party/blink/renderer/core/workers/dedicated_worker_object_proxy.h b/third_party/blink/renderer/core/workers/dedicated_worker_object_proxy.h
index f8b0b92a..ee83dd4 100644
--- a/third_party/blink/renderer/core/workers/dedicated_worker_object_proxy.h
+++ b/third_party/blink/renderer/core/workers/dedicated_worker_object_proxy.h
@@ -70,8 +70,7 @@
                        int exception_id) override;
   void DidFailToFetchClassicScript() final;
   void DidFailToFetchModuleScript() final;
-  void DidEvaluateClassicScript(bool success) override;
-  void DidEvaluateModuleScript(bool success) override;
+  void DidEvaluateTopLevelScript(bool success) override;
 
   const DedicatedWorkerToken& token() const { return token_; }
 
diff --git a/third_party/blink/renderer/core/workers/shared_worker_reporting_proxy.cc b/third_party/blink/renderer/core/workers/shared_worker_reporting_proxy.cc
index bec9262..32abc02 100644
--- a/third_party/blink/renderer/core/workers/shared_worker_reporting_proxy.cc
+++ b/third_party/blink/renderer/core/workers/shared_worker_reporting_proxy.cc
@@ -73,21 +73,12 @@
                           CrossThreadUnretained(worker_)));
 }
 
-void SharedWorkerReportingProxy::DidEvaluateClassicScript(bool success) {
+void SharedWorkerReportingProxy::DidEvaluateTopLevelScript(bool success) {
   DCHECK(!IsMainThread());
   PostCrossThreadTask(
       *parent_execution_context_task_runners_->Get(TaskType::kInternalDefault),
       FROM_HERE,
-      CrossThreadBindOnce(&WebSharedWorkerImpl::DidEvaluateClassicScript,
-                          CrossThreadUnretained(worker_), success));
-}
-
-void SharedWorkerReportingProxy::DidEvaluateModuleScript(bool success) {
-  DCHECK(!IsMainThread());
-  PostCrossThreadTask(
-      *parent_execution_context_task_runners_->Get(TaskType::kInternalDefault),
-      FROM_HERE,
-      CrossThreadBindOnce(&WebSharedWorkerImpl::DidEvaluateModuleScript,
+      CrossThreadBindOnce(&WebSharedWorkerImpl::DidEvaluateTopLevelScript,
                           CrossThreadUnretained(worker_), success));
 }
 
diff --git a/third_party/blink/renderer/core/workers/shared_worker_reporting_proxy.h b/third_party/blink/renderer/core/workers/shared_worker_reporting_proxy.h
index 2d1eaf4..c4ee20b 100644
--- a/third_party/blink/renderer/core/workers/shared_worker_reporting_proxy.h
+++ b/third_party/blink/renderer/core/workers/shared_worker_reporting_proxy.h
@@ -36,8 +36,7 @@
                             SourceLocation*) override;
   void DidFailToFetchClassicScript() override;
   void DidFailToFetchModuleScript() override;
-  void DidEvaluateClassicScript(bool success) override;
-  void DidEvaluateModuleScript(bool success) override;
+  void DidEvaluateTopLevelScript(bool success) override;
   void DidCloseWorkerGlobalScope() override;
   void WillDestroyWorkerGlobalScope() override {}
   void DidTerminateWorkerThread() override;
diff --git a/third_party/blink/renderer/core/workers/worker_global_scope.cc b/third_party/blink/renderer/core/workers/worker_global_scope.cc
index 2387116..85876142 100644
--- a/third_party/blink/renderer/core/workers/worker_global_scope.cc
+++ b/third_party/blink/renderer/core/workers/worker_global_scope.cc
@@ -443,9 +443,23 @@
   if (debugger && stack_id_)
     debugger->ExternalAsyncTaskStarted(*stack_id_);
 
+  switch (worker_script_->GetScriptType()) {
+    case mojom::blink::ScriptType::kClassic: {
+      auto sizes = worker_script_->GetClassicScriptSizes();
+      ReportingProxy().WillEvaluateClassicScript(sizes.first, sizes.second);
+      break;
+    }
+    case mojom::blink::ScriptType::kModule:
+      ReportingProxy().WillEvaluateModuleScript();
+      break;
+  }
+
   // Step 24. If script is a classic script, then run the classic script script.
   // Otherwise, it is a module script; run the module script script. [spec text]
-  std::move(worker_script_)->RunScriptOnWorker(*this);
+  bool is_success =
+      std::move(worker_script_)->RunScriptOnWorkerOrWorklet(*this);
+
+  ReportingProxy().DidEvaluateTopLevelScript(is_success);
 
   if (debugger && stack_id_)
     debugger->ExternalAsyncTaskFinished(*stack_id_);
diff --git a/third_party/blink/renderer/core/workers/worker_reporting_proxy.h b/third_party/blink/renderer/core/workers/worker_reporting_proxy.h
index 436990be..5990e90 100644
--- a/third_party/blink/renderer/core/workers/worker_reporting_proxy.h
+++ b/third_party/blink/renderer/core/workers/worker_reporting_proxy.h
@@ -97,13 +97,9 @@
   // Invoked when the worker's main module script is about to be evaluated.
   virtual void WillEvaluateModuleScript() {}
 
-  // Invoked when the main classic script is evaluated. |success| is true if the
+  // Invoked when the worker main script is evaluated. |success| is true if the
   // evaluation completed with no uncaught exception.
-  virtual void DidEvaluateClassicScript(bool success) {}
-
-  // Invoked when the worker's main module script is evaluated. |success| is
-  // true if the evaluation completed with no uncaught exception.
-  virtual void DidEvaluateModuleScript(bool success) {}
+  virtual void DidEvaluateTopLevelScript(bool success) {}
 
   // Invoked when close() is invoked on the worker context.
   virtual void DidCloseWorkerGlobalScope() {}
diff --git a/third_party/blink/renderer/core/workers/worker_thread_test.cc b/third_party/blink/renderer/core/workers/worker_thread_test.cc
index 19d23ec8..67ecf55 100644
--- a/third_party/blink/renderer/core/workers/worker_thread_test.cc
+++ b/third_party/blink/renderer/core/workers/worker_thread_test.cc
@@ -103,7 +103,7 @@
               WillEvaluateClassicScriptMock(_, _))
       .Times(1);
   EXPECT_CALL(*nested_worker_helper->reporting_proxy,
-              DidEvaluateClassicScript(true))
+              DidEvaluateTopLevelScript(true))
       .Times(1);
   EXPECT_CALL(*nested_worker_helper->reporting_proxy,
               WillDestroyWorkerGlobalScope())
@@ -191,7 +191,7 @@
     EXPECT_CALL(*reporting_proxy_, DidCreateWorkerGlobalScope(_)).Times(1);
     EXPECT_CALL(*reporting_proxy_, WillEvaluateClassicScriptMock(_, _))
         .Times(1);
-    EXPECT_CALL(*reporting_proxy_, DidEvaluateClassicScript(true)).Times(1);
+    EXPECT_CALL(*reporting_proxy_, DidEvaluateTopLevelScript(true)).Times(1);
     EXPECT_CALL(*reporting_proxy_, WillDestroyWorkerGlobalScope()).Times(1);
     EXPECT_CALL(*reporting_proxy_, DidTerminateWorkerThread()).Times(1);
   }
@@ -200,7 +200,7 @@
     EXPECT_CALL(*reporting_proxy_, DidCreateWorkerGlobalScope(_)).Times(1);
     EXPECT_CALL(*reporting_proxy_, WillEvaluateClassicScriptMock(_, _))
         .Times(AtMost(1));
-    EXPECT_CALL(*reporting_proxy_, DidEvaluateClassicScript(_))
+    EXPECT_CALL(*reporting_proxy_, DidEvaluateTopLevelScript(_))
         .Times(AtMost(1));
     EXPECT_CALL(*reporting_proxy_, WillDestroyWorkerGlobalScope())
         .Times(AtMost(1));
@@ -211,7 +211,7 @@
     EXPECT_CALL(*reporting_proxy_, DidCreateWorkerGlobalScope(_)).Times(1);
     EXPECT_CALL(*reporting_proxy_, WillEvaluateClassicScriptMock(_, _))
         .Times(1);
-    EXPECT_CALL(*reporting_proxy_, DidEvaluateClassicScript(false)).Times(1);
+    EXPECT_CALL(*reporting_proxy_, DidEvaluateTopLevelScript(false)).Times(1);
     EXPECT_CALL(*reporting_proxy_, WillDestroyWorkerGlobalScope()).Times(1);
     EXPECT_CALL(*reporting_proxy_, DidTerminateWorkerThread()).Times(1);
   }
diff --git a/third_party/blink/renderer/core/workers/worker_thread_test_helper.h b/third_party/blink/renderer/core/workers/worker_thread_test_helper.h
index 1ae7a81..5223433 100644
--- a/third_party/blink/renderer/core/workers/worker_thread_test_helper.h
+++ b/third_party/blink/renderer/core/workers/worker_thread_test_helper.h
@@ -182,7 +182,7 @@
   MOCK_METHOD1(DidCreateWorkerGlobalScope, void(WorkerOrWorkletGlobalScope*));
   MOCK_METHOD2(WillEvaluateClassicScriptMock,
                void(size_t scriptSize, size_t cachedMetadataSize));
-  MOCK_METHOD1(DidEvaluateClassicScript, void(bool success));
+  MOCK_METHOD1(DidEvaluateTopLevelScript, void(bool success));
   MOCK_METHOD0(DidCloseWorkerGlobalScope, void());
   MOCK_METHOD0(WillDestroyWorkerGlobalScope, void());
   MOCK_METHOD0(DidTerminateWorkerThread, void());
diff --git a/third_party/blink/renderer/core/workers/worklet_module_tree_client.cc b/third_party/blink/renderer/core/workers/worklet_module_tree_client.cc
index 45fdc92..f0a1614 100644
--- a/third_party/blink/renderer/core/workers/worklet_module_tree_client.cc
+++ b/third_party/blink/renderer/core/workers/worklet_module_tree_client.cc
@@ -78,7 +78,7 @@
   auto* global_scope =
       To<WorkletGlobalScope>(ExecutionContext::From(script_state_));
 
-  global_scope->ReportingProxy().DidEvaluateModuleScript(result.IsSuccess());
+  global_scope->ReportingProxy().DidEvaluateTopLevelScript(result.IsSuccess());
 
   // Step 6: "Queue a task on outsideSettings's responsible event loop to run
   // these steps:"
diff --git a/third_party/blink/renderer/modules/accessibility/accessibility_object_model_test.cc b/third_party/blink/renderer/modules/accessibility/accessibility_object_model_test.cc
index 9700746..b1e28d4 100644
--- a/third_party/blink/renderer/modules/accessibility/accessibility_object_model_test.cc
+++ b/third_party/blink/renderer/modules/accessibility/accessibility_object_model_test.cc
@@ -276,7 +276,7 @@
   HashMap<AXUIntAttribute, uint32_t> uint_attributes;
   HashMap<AXStringAttribute, String> string_attributes;
   HeapHashMap<AXObjectAttribute, Member<AXObject>> object_attributes;
-  HeapHashMap<AXObjectVectorAttribute, VectorOf<AXObject>>
+  HeapHashMap<AXObjectVectorAttribute, Member<HeapVector<Member<AXObject>>>>
       object_vector_attributes;
 
  private:
@@ -308,7 +308,7 @@
   }
 
   void AddObjectVectorAttribute(AXObjectVectorAttribute attribute,
-                                VectorOf<AXObject>& value) override {
+                                HeapVector<Member<AXObject>>* value) override {
     ASSERT_TRUE(object_vector_attributes.find(attribute) ==
                 object_vector_attributes.end());
     object_vector_attributes.insert(attribute, value);
@@ -350,8 +350,8 @@
                 .at(AXObjectAttribute::kAriaActiveDescendant)
                 ->RoleValue());
   ASSERT_EQ(ax::mojom::Role::kContentInfo,
-            sparse_attributes.object_vector_attributes
-                .at(AXObjectVectorAttribute::kAriaDetails)[0]
+            (*sparse_attributes.object_vector_attributes.at(
+                AXObjectVectorAttribute::kAriaDetails))[0]
                 ->RoleValue());
   ASSERT_EQ(ax::mojom::Role::kArticle,
             sparse_attributes.object_attributes
@@ -382,8 +382,8 @@
                 .at(AXObjectAttribute::kAriaActiveDescendant)
                 ->RoleValue());
   ASSERT_EQ(ax::mojom::Role::kContentInfo,
-            sparse_attributes2.object_vector_attributes
-                .at(AXObjectVectorAttribute::kAriaDetails)[0]
+            (*sparse_attributes2.object_vector_attributes.at(
+                AXObjectVectorAttribute::kAriaDetails))[0]
                 ->RoleValue());
   ASSERT_EQ(ax::mojom::Role::kArticle,
             sparse_attributes2.object_attributes
diff --git a/third_party/blink/renderer/modules/accessibility/ax_object.h b/third_party/blink/renderer/modules/accessibility/ax_object.h
index d86307f..e759ca3 100644
--- a/third_party/blink/renderer/modules/accessibility/ax_object.h
+++ b/third_party/blink/renderer/modules/accessibility/ax_object.h
@@ -87,7 +87,7 @@
   virtual void AddStringAttribute(AXStringAttribute, const String&) = 0;
   virtual void AddObjectAttribute(AXObjectAttribute, AXObject&) = 0;
   virtual void AddObjectVectorAttribute(AXObjectVectorAttribute,
-                                        HeapVector<Member<AXObject>>&) = 0;
+                                        HeapVector<Member<AXObject>>*) = 0;
 };
 
 class IgnoredReason {
diff --git a/third_party/blink/renderer/modules/accessibility/ax_sparse_attribute_setter.cc b/third_party/blink/renderer/modules/accessibility/ax_sparse_attribute_setter.cc
index b9e250e..03304d21 100644
--- a/third_party/blink/renderer/modules/accessibility/ax_sparse_attribute_setter.cc
+++ b/third_party/blink/renderer/modules/accessibility/ax_sparse_attribute_setter.cc
@@ -139,7 +139,8 @@
         element->GetElementArrayAttribute(GetAttributeQualifiedName());
     if (!attr_associated_elements)
       return;
-    HeapVector<Member<AXObject>> objects;
+    HeapVector<Member<AXObject>>* objects =
+        MakeGarbageCollected<HeapVector<Member<AXObject>>>();
     for (const auto& associated_element : attr_associated_elements.value()) {
       AXObject* ax_element =
           obj.AXObjectCache().GetOrCreate(associated_element);
@@ -148,7 +149,7 @@
       if (AXObject* parent = ax_element->ParentObject())
         parent->UpdateChildrenIfNecessary();
       if (!ax_element->AccessibilityIsIgnored())
-        objects.push_back(ax_element);
+        objects->push_back(ax_element);
     }
     attribute_map.AddObjectVectorAttribute(attribute_, objects);
   }
@@ -290,14 +291,15 @@
       return;
   }
 
-  HeapVector<Member<AXObject>> objects;
+  HeapVector<Member<AXObject>>* objects =
+      MakeGarbageCollected<HeapVector<Member<AXObject>>>();
   for (unsigned i = 0; i < relations.length(); ++i) {
     AccessibleNode* accessible_node = relations.item(i);
     if (accessible_node) {
       Element* element = accessible_node->element();
       AXObject* ax_element = ax_object_cache_->GetOrCreate(element);
       if (ax_element && !ax_element->AccessibilityIsIgnored())
-        objects.push_back(ax_element);
+        objects->push_back(ax_element);
     }
   }
 
diff --git a/third_party/blink/renderer/modules/accessibility/inspector_accessibility_agent.cc b/third_party/blink/renderer/modules/accessibility/inspector_accessibility_agent.cc
index b6e8dbc..15f3abc7d 100644
--- a/third_party/blink/renderer/modules/accessibility/inspector_accessibility_agent.cc
+++ b/third_party/blink/renderer/modules/accessibility/inspector_accessibility_agent.cc
@@ -440,21 +440,21 @@
 
   void AddObjectVectorAttribute(
       AXObjectVectorAttribute attribute,
-      HeapVector<Member<AXObject>>& objects) override {
+      HeapVector<Member<AXObject>>* objects) override {
     switch (attribute) {
       case AXObjectVectorAttribute::kAriaControls:
         properties_.emplace_back(CreateRelatedNodeListProperty(
-            AXPropertyNameEnum::Controls, objects,
+            AXPropertyNameEnum::Controls, *objects,
             html_names::kAriaControlsAttr, *ax_object_));
         break;
       case AXObjectVectorAttribute::kAriaDetails:
         properties_.emplace_back(CreateRelatedNodeListProperty(
-            AXPropertyNameEnum::Details, objects, html_names::kAriaDetailsAttr,
+            AXPropertyNameEnum::Details, *objects, html_names::kAriaDetailsAttr,
             *ax_object_));
         break;
       case AXObjectVectorAttribute::kAriaFlowTo:
         properties_.emplace_back(CreateRelatedNodeListProperty(
-            AXPropertyNameEnum::Flowto, objects, html_names::kAriaFlowtoAttr,
+            AXPropertyNameEnum::Flowto, *objects, html_names::kAriaFlowtoAttr,
             *ax_object_));
         break;
     }
@@ -497,7 +497,7 @@
 
 using EnabledAgentsMultimap =
     HeapHashMap<WeakMember<LocalFrame>,
-                HeapHashSet<Member<InspectorAccessibilityAgent>>>;
+                Member<HeapHashSet<Member<InspectorAccessibilityAgent>>>>;
 
 EnabledAgentsMultimap& EnabledAgents() {
   DEFINE_STATIC_LOCAL(Persistent<EnabledAgentsMultimap>, enabled_agents,
@@ -843,10 +843,11 @@
   enabled_.Set(true);
   LocalFrame* frame = inspected_frames_->Root();
   if (!EnabledAgents().Contains(frame)) {
-    EnabledAgents().Set(frame,
-                        HeapHashSet<Member<InspectorAccessibilityAgent>>());
+    EnabledAgents().Set(
+        frame, MakeGarbageCollected<
+                   HeapHashSet<Member<InspectorAccessibilityAgent>>>());
   }
-  EnabledAgents().find(frame)->value.insert(this);
+  EnabledAgents().find(frame)->value->insert(this);
   CreateAXContext();
 }
 
@@ -864,8 +865,8 @@
   LocalFrame* frame = inspected_frames_->Root();
   DCHECK(EnabledAgents().Contains(frame));
   auto it = EnabledAgents().find(frame);
-  it->value.erase(this);
-  if (it->value.IsEmpty())
+  it->value->erase(this);
+  if (it->value->IsEmpty())
     EnabledAgents().erase(frame);
   return Response::Success();
 }
@@ -878,7 +879,7 @@
 void InspectorAccessibilityAgent::ProvideTo(LocalFrame* frame) {
   if (!EnabledAgents().Contains(frame))
     return;
-  for (InspectorAccessibilityAgent* agent : EnabledAgents().find(frame)->value)
+  for (InspectorAccessibilityAgent* agent : *EnabledAgents().find(frame)->value)
     agent->CreateAXContext();
 }
 
diff --git a/third_party/blink/renderer/modules/exported/web_ax_object.cc b/third_party/blink/renderer/modules/exported/web_ax_object.cc
index eddbc3b..0d2cc302 100644
--- a/third_party/blink/renderer/modules/exported/web_ax_object.cc
+++ b/third_party/blink/renderer/modules/exported/web_ax_object.cc
@@ -124,9 +124,9 @@
   }
 
   void AddObjectVectorAttribute(AXObjectVectorAttribute attribute,
-                                HeapVector<Member<AXObject>>& value) override {
-    WebVector<WebAXObject> result(value.size());
-    std::copy(value.begin(), value.end(), result.begin());
+                                HeapVector<Member<AXObject>>* value) override {
+    WebVector<WebAXObject> result(value->size());
+    std::copy(value->begin(), value->end(), result.begin());
     attribute_map_.AddObjectVectorAttribute(
         static_cast<WebAXObjectVectorAttribute>(attribute), result);
   }
diff --git a/third_party/blink/renderer/modules/indexeddb/idb_observer_changes.cc b/third_party/blink/renderer/modules/indexeddb/idb_observer_changes.cc
index 97cf33aa..ab40936 100644
--- a/third_party/blink/renderer/modules/indexeddb/idb_observer_changes.cc
+++ b/third_party/blink/renderer/modules/indexeddb/idb_observer_changes.cc
@@ -22,7 +22,7 @@
   for (const auto& it : records_) {
     v8::Local<v8::String> key =
         V8String(isolate, database_->GetObjectStoreName(it.key));
-    v8::Local<v8::Value> value = ToV8(it.value, context->Global(), isolate);
+    v8::Local<v8::Value> value = ToV8(*it.value, context->Global(), isolate);
     map->Set(context, key, value).ToLocalChecked();
   }
   return ScriptValue::From(script_state, map);
@@ -44,8 +44,8 @@
   for (const auto& idx : observation_indices) {
     records_
         .insert(observations[idx]->object_store_id(),
-                HeapVector<Member<IDBObservation>>())
-        .stored_value->value.emplace_back(observations[idx]);
+                MakeGarbageCollected<HeapVector<Member<IDBObservation>>>())
+        .stored_value->value->emplace_back(observations[idx]);
   }
 }
 
diff --git a/third_party/blink/renderer/modules/indexeddb/idb_observer_changes.h b/third_party/blink/renderer/modules/indexeddb/idb_observer_changes.h
index e0dd4ff16..8a516e5b 100644
--- a/third_party/blink/renderer/modules/indexeddb/idb_observer_changes.h
+++ b/third_party/blink/renderer/modules/indexeddb/idb_observer_changes.h
@@ -39,7 +39,7 @@
   Member<IDBDatabase> database_;
   Member<IDBTransaction> transaction_;
   // Map object_store_id to IDBObservation list.
-  HeapHashMap<int64_t, HeapVector<Member<IDBObservation>>> records_;
+  HeapHashMap<int64_t, Member<HeapVector<Member<IDBObservation>>>> records_;
 };
 
 }  // namespace blink
diff --git a/third_party/blink/renderer/modules/service_worker/service_worker_global_scope_proxy.cc b/third_party/blink/renderer/modules/service_worker/service_worker_global_scope_proxy.cc
index 4daa620..397d579e 100644
--- a/third_party/blink/renderer/modules/service_worker/service_worker_global_scope_proxy.cc
+++ b/third_party/blink/renderer/modules/service_worker/service_worker_global_scope_proxy.cc
@@ -175,7 +175,7 @@
     size_t cached_metadata_size) {
   DCHECK_CALLED_ON_VALID_THREAD(worker_thread_checker_);
   TRACE_EVENT_NESTABLE_ASYNC_BEGIN0(
-      "ServiceWorker", "ServiceWorkerGlobalScopeProxy::EvaluateClassicScript",
+      "ServiceWorker", "ServiceWorkerGlobalScopeProxy::EvaluateTopLevelScript",
       TRACE_ID_LOCAL(this));
   // TODO(asamidoi): Remove CountWorkerScript which is called for recording
   // metrics if the metrics are no longer referenced, and then merge
@@ -197,27 +197,24 @@
 
 void ServiceWorkerGlobalScopeProxy::WillEvaluateModuleScript() {
   DCHECK_CALLED_ON_VALID_THREAD(worker_thread_checker_);
+  TRACE_EVENT_NESTABLE_ASYNC_BEGIN0(
+      "ServiceWorker", "ServiceWorkerGlobalScopeProxy::EvaluateTopLevelScript",
+      TRACE_ID_LOCAL(this));
   ScriptState::Scope scope(
       WorkerGlobalScope()->ScriptController()->GetScriptState());
   Client().WillEvaluateScript(
       WorkerGlobalScope()->ScriptController()->GetContext());
 }
 
-void ServiceWorkerGlobalScopeProxy::DidEvaluateClassicScript(bool success) {
+void ServiceWorkerGlobalScopeProxy::DidEvaluateTopLevelScript(bool success) {
   DCHECK_CALLED_ON_VALID_THREAD(worker_thread_checker_);
   WorkerGlobalScope()->DidEvaluateScript();
   Client().DidEvaluateScript(success);
   TRACE_EVENT_NESTABLE_ASYNC_END1(
-      "ServiceWorker", "ServiceWorkerGlobalScopeProxy::EvaluateClassicScript",
+      "ServiceWorker", "ServiceWorkerGlobalScopeProxy::EvaluateTopLevelScript",
       TRACE_ID_LOCAL(this), "success", success);
 }
 
-void ServiceWorkerGlobalScopeProxy::DidEvaluateModuleScript(bool success) {
-  DCHECK_CALLED_ON_VALID_THREAD(worker_thread_checker_);
-  WorkerGlobalScope()->DidEvaluateScript();
-  Client().DidEvaluateScript(success);
-}
-
 void ServiceWorkerGlobalScopeProxy::DidCloseWorkerGlobalScope() {
   DCHECK_CALLED_ON_VALID_THREAD(worker_thread_checker_);
   // close() is not web-exposed for ServiceWorker. This is called when
diff --git a/third_party/blink/renderer/modules/service_worker/service_worker_global_scope_proxy.h b/third_party/blink/renderer/modules/service_worker/service_worker_global_scope_proxy.h
index 26b3465..c302c09 100644
--- a/third_party/blink/renderer/modules/service_worker/service_worker_global_scope_proxy.h
+++ b/third_party/blink/renderer/modules/service_worker/service_worker_global_scope_proxy.h
@@ -121,8 +121,7 @@
   void WillEvaluateImportedClassicScript(size_t script_size,
                                          size_t cached_metadata_size) override;
   void WillEvaluateModuleScript() override;
-  void DidEvaluateClassicScript(bool success) override;
-  void DidEvaluateModuleScript(bool success) override;
+  void DidEvaluateTopLevelScript(bool success) override;
   void DidCloseWorkerGlobalScope() override;
   void WillDestroyWorkerGlobalScope() override;
   void DidTerminateWorkerThread() override;
diff --git a/third_party/blink/renderer/modules/webaudio/audio_worklet_object_proxy.cc b/third_party/blink/renderer/modules/webaudio/audio_worklet_object_proxy.cc
index 2607d5b..a9b9f5cb 100644
--- a/third_party/blink/renderer/modules/webaudio/audio_worklet_object_proxy.cc
+++ b/third_party/blink/renderer/modules/webaudio/audio_worklet_object_proxy.cc
@@ -28,7 +28,7 @@
   global_scope_->SetSampleRate(context_sample_rate_);
 }
 
-void AudioWorkletObjectProxy::DidEvaluateModuleScript(bool success) {
+void AudioWorkletObjectProxy::DidEvaluateTopLevelScript(bool success) {
   DCHECK(global_scope_);
 
   if (!success || global_scope_->NumberOfRegisteredDefinitions() == 0)
diff --git a/third_party/blink/renderer/modules/webaudio/audio_worklet_object_proxy.h b/third_party/blink/renderer/modules/webaudio/audio_worklet_object_proxy.h
index 5d356ce..5f70b4c 100644
--- a/third_party/blink/renderer/modules/webaudio/audio_worklet_object_proxy.h
+++ b/third_party/blink/renderer/modules/webaudio/audio_worklet_object_proxy.h
@@ -21,7 +21,7 @@
 
   // Implements WorkerReportingProxy.
   void DidCreateWorkerGlobalScope(WorkerOrWorkletGlobalScope*) override;
-  void DidEvaluateModuleScript(bool success) override;
+  void DidEvaluateTopLevelScript(bool success) override;
   void WillDestroyWorkerGlobalScope() override;
 
  private:
diff --git a/third_party/blink/renderer/modules/webtransport/outgoing_stream.cc b/third_party/blink/renderer/modules/webtransport/outgoing_stream.cc
index eb5f53ed..61bba5dc1 100644
--- a/third_party/blink/renderer/modules/webtransport/outgoing_stream.cc
+++ b/third_party/blink/renderer/modules/webtransport/outgoing_stream.cc
@@ -211,6 +211,7 @@
 void OutgoingStream::HandlePipeClosed() {
   DVLOG(1) << "OutgoingStream::HandlePipeClosed() this=" << this;
 
+  ScriptState::Scope scope(script_state_);
   ErrorStreamAbortAndReset(IsLocalAbort(false));
 }
 
diff --git a/third_party/blink/renderer/modules/xr/xr_frame_request_callback_collection.cc b/third_party/blink/renderer/modules/xr/xr_frame_request_callback_collection.cc
index c94be870..09219d5 100644
--- a/third_party/blink/renderer/modules/xr/xr_frame_request_callback_collection.cc
+++ b/third_party/blink/renderer/modules/xr/xr_frame_request_callback_collection.cc
@@ -21,20 +21,25 @@
 XRFrameRequestCallbackCollection::RegisterCallback(
     V8XRFrameRequestCallback* callback) {
   CallbackId id = ++next_callback_id_;
-  auto add_result = callbacks_.Set(
-      id,
-      CallbackAndAsyncTask(callback, std::make_unique<probe::AsyncTaskId>()));
+  auto add_result_frame_request = callback_frame_requests_.Set(id, callback);
+  auto add_result_async_task =
+      callback_async_tasks_.Set(id, std::make_unique<probe::AsyncTaskId>());
+  DCHECK_EQ(add_result_frame_request.is_new_entry,
+            add_result_async_task.is_new_entry);
   pending_callbacks_.push_back(id);
 
   probe::AsyncTaskScheduledBreakable(
-      context_, "XRRequestFrame", add_result.stored_value->value.second.get());
+      context_, "XRRequestFrame",
+      add_result_async_task.stored_value->value.get());
   return id;
 }
 
 void XRFrameRequestCallbackCollection::CancelCallback(CallbackId id) {
   if (IsValidCallbackId(id)) {
-    callbacks_.erase(id);
-    current_callbacks_.erase(id);
+    callback_frame_requests_.erase(id);
+    callback_async_tasks_.erase(id);
+    current_callback_frame_requests_.erase(id);
+    current_callback_async_tasks_.erase(id);
   }
 }
 
@@ -51,28 +56,36 @@
   // of ids for iteration purposes.  current_callback_ids is the set of ids for
   // callbacks we will call, and is kept in sync with current_callbacks_ but
   // safe to iterate over.
-  DCHECK(current_callbacks_.IsEmpty());
-  current_callbacks_.swap(callbacks_);
+  DCHECK(current_callback_frame_requests_.IsEmpty());
+  DCHECK(current_callback_async_tasks_.IsEmpty());
+  current_callback_frame_requests_.swap(callback_frame_requests_);
+  current_callback_async_tasks_.swap(callback_async_tasks_);
 
   Vector<CallbackId> current_callback_ids;
   current_callback_ids.swap(pending_callbacks_);
 
   for (const auto& id : current_callback_ids) {
-    auto it = current_callbacks_.find(id);
-    if (it == current_callbacks_.end())
+    auto it_frame_request = current_callback_frame_requests_.find(id);
+    auto it_async_task = current_callback_async_tasks_.find(id);
+    if (it_frame_request == current_callback_frame_requests_.end()) {
+      DCHECK_EQ(current_callback_async_tasks_.end(), it_async_task);
       continue;
+    }
+    DCHECK_NE(current_callback_async_tasks_.end(), it_async_task);
 
-    probe::AsyncTask async_task(context_, it->value.second.get());
+    probe::AsyncTask async_task(context_, it_async_task->value.get());
     probe::UserCallback probe(context_, "XRRequestFrame", AtomicString(), true);
-    it->value.first->InvokeAndReportException(session, timestamp, frame);
+    it_frame_request->value->InvokeAndReportException(session, timestamp,
+                                                      frame);
   }
 
-  current_callbacks_.clear();
+  current_callback_frame_requests_.clear();
+  current_callback_async_tasks_.clear();
 }
 
 void XRFrameRequestCallbackCollection::Trace(Visitor* visitor) const {
-  visitor->Trace(callbacks_);
-  visitor->Trace(current_callbacks_);
+  visitor->Trace(callback_frame_requests_);
+  visitor->Trace(current_callback_frame_requests_);
   visitor->Trace(context_);
 }
 
diff --git a/third_party/blink/renderer/modules/xr/xr_frame_request_callback_collection.h b/third_party/blink/renderer/modules/xr/xr_frame_request_callback_collection.h
index f211fa71..ff3c6a7e0 100644
--- a/third_party/blink/renderer/modules/xr/xr_frame_request_callback_collection.h
+++ b/third_party/blink/renderer/modules/xr/xr_frame_request_callback_collection.h
@@ -30,7 +30,10 @@
   void CancelCallback(CallbackId);
   void ExecuteCallbacks(XRSession*, double timestamp, XRFrame*);
 
-  bool IsEmpty() const { return !callbacks_.size(); }
+  bool IsEmpty() const {
+    DCHECK_EQ(callback_frame_requests_.size(), callback_async_tasks_.size());
+    return !callback_frame_requests_.size();
+  }
 
   void Trace(Visitor*) const;
   const char* NameInHeapSnapshot() const override {
@@ -44,15 +47,18 @@
            !WTF::IsHashTraitsEmptyValue<Traits, CallbackId>(id);
   }
 
-  using CallbackAndAsyncTask = std::pair<Member<V8XRFrameRequestCallback>,
-                                         std::unique_ptr<probe::AsyncTaskId>>;
-  using CallbackMap = HeapHashMap<CallbackId, CallbackAndAsyncTask>;
+  using CallbackFrameRequestMap =
+      HeapHashMap<CallbackId, Member<V8XRFrameRequestCallback>>;
+  using CallbackAsyncTaskMap =
+      HashMap<CallbackId, std::unique_ptr<probe::AsyncTaskId>>;
 
-  CallbackMap callbacks_;
+  CallbackFrameRequestMap callback_frame_requests_;
+  CallbackAsyncTaskMap callback_async_tasks_;
   Vector<CallbackId> pending_callbacks_;
 
   // Only non-empty while inside executeCallbacks.
-  CallbackMap current_callbacks_;
+  CallbackFrameRequestMap current_callback_frame_requests_;
+  CallbackAsyncTaskMap current_callback_async_tasks_;
 
   CallbackId next_callback_id_ = 0;
 
diff --git a/third_party/blink/renderer/platform/graphics/compositing_reasons.cc b/third_party/blink/renderer/platform/graphics/compositing_reasons.cc
index d1dcd177..17a6cfe 100644
--- a/third_party/blink/renderer/platform/graphics/compositing_reasons.cc
+++ b/third_party/blink/renderer/platform/graphics/compositing_reasons.cc
@@ -104,6 +104,9 @@
     {CompositingReason::kIsolateCompositedDescendants,
      "isolateCompositedDescendants",
      "Should isolate descendants to apply a blend effect"},
+    {CompositingReason::kFullscreenVideoWithCompositedDescendants,
+     "fullscreenVideoWithCompositedDescendants",
+     "Is a fullscreen video element with composited descendants"},
     {CompositingReason::kRoot, "root", "Is the root layer"},
     {CompositingReason::kLayerForHorizontalScrollbar,
      "layerForHorizontalScrollbar",
diff --git a/third_party/blink/renderer/platform/graphics/compositing_reasons.h b/third_party/blink/renderer/platform/graphics/compositing_reasons.h
index e25a258..0528128 100644
--- a/third_party/blink/renderer/platform/graphics/compositing_reasons.h
+++ b/third_party/blink/renderer/platform/graphics/compositing_reasons.h
@@ -64,6 +64,7 @@
   V(PerspectiveWith3DDescendants)                                             \
   V(Preserve3DWith3DDescendants)                                              \
   V(IsolateCompositedDescendants)                                             \
+  V(FullscreenVideoWithCompositedDescendants)                                 \
                                                                               \
   /* The root layer is a special case. It may be forced to be a layer, but it \
   also needs to be a layer if anything else in the subtree is composited. */  \
diff --git a/third_party/blink/renderer/platform/heap/heap_allocator.h b/third_party/blink/renderer/platform/heap/heap_allocator.h
index f35ad4d8..54409e5 100644
--- a/third_party/blink/renderer/platform/heap/heap_allocator.h
+++ b/third_party/blink/renderer/platform/heap/heap_allocator.h
@@ -415,6 +415,13 @@
                       !WTF::IsTraceable<KeyArg>::value,
                   "HeapHashMap supports only Member, WeakMember and "
                   "non-traceable types as keys.");
+    static_assert(internal::IsMemberOrWeakMemberType<MappedArg> ||
+                      !WTF::IsTraceable<MappedArg>::value ||
+                      WTF::IsSubclassOfTemplate<MappedArg,
+                                                TraceWrapperV8Reference>::value,
+                  "HeapHashMap supports only Member, WeakMember, "
+                  "TraceWrapperV8Reference and "
+                  "non-traceable types as values.");
   }
 
  public:
diff --git a/third_party/blink/renderer/platform/heap/test/heap_compact_test.cc b/third_party/blink/renderer/platform/heap/test/heap_compact_test.cc
index 9cbaf2b..39d1994 100644
--- a/third_party/blink/renderer/platform/heap/test/heap_compact_test.cc
+++ b/third_party/blink/renderer/platform/heap/test/heap_compact_test.cc
@@ -175,23 +175,23 @@
 TEST_F(HeapCompactTest, CompactHashPartVector) {
   ClearOutOldGarbage();
 
-  using IntVectorMap = HeapHashMap<int, IntVector>;
+  using IntVectorMap = HeapHashMap<int, Member<IntVector>>;
 
   Persistent<IntVectorMap> int_vector_map =
       MakeGarbageCollected<IntVectorMap>();
   for (wtf_size_t i = 0; i < 10; ++i) {
-    IntVector vector;
+    IntVector* vector = MakeGarbageCollected<IntVector>();
     for (wtf_size_t j = 0; j < 10; ++j) {
-      vector.push_back(IntWrapper::Create(j, HashTablesAreCompacted));
+      vector->push_back(IntWrapper::Create(j, HashTablesAreCompacted));
     }
     int_vector_map->insert(1 + i, vector);
   }
 
   EXPECT_EQ(10u, int_vector_map->size());
-  for (const IntVector& int_vector : int_vector_map->Values()) {
-    EXPECT_EQ(10u, int_vector.size());
-    for (wtf_size_t i = 0; i < int_vector.size(); ++i) {
-      EXPECT_EQ(static_cast<int>(i), int_vector[i]->Value());
+  for (const IntVector* int_vector : int_vector_map->Values()) {
+    EXPECT_EQ(10u, int_vector->size());
+    for (wtf_size_t i = 0; i < int_vector->size(); ++i) {
+      EXPECT_EQ(static_cast<int>(i), (*int_vector)[i]->Value());
     }
   }
 
@@ -199,10 +199,10 @@
   EXPECT_TRUE(IntWrapper::did_verify_at_least_once);
 
   EXPECT_EQ(10u, int_vector_map->size());
-  for (const IntVector& int_vector : int_vector_map->Values()) {
-    EXPECT_EQ(10u, int_vector.size());
-    for (wtf_size_t i = 0; i < int_vector.size(); ++i) {
-      EXPECT_EQ(static_cast<int>(i), int_vector[i]->Value());
+  for (const IntVector* int_vector : int_vector_map->Values()) {
+    EXPECT_EQ(10u, int_vector->size());
+    for (wtf_size_t i = 0; i < int_vector->size(); ++i) {
+      EXPECT_EQ(static_cast<int>(i), (*int_vector)[i]->Value());
     }
   }
 }
@@ -479,18 +479,19 @@
   // The internal forwarding pointer to the inlined storage needs to be handled
   // by compaction.
   using Value = HeapVector<Member<IntWrapper>, 64>;
-  using MapWithInlinedBacking = HeapHashMap<Key, Value>;
+  using MapWithInlinedBacking = HeapHashMap<Key, Member<Value>>;
 
   Persistent<MapWithInlinedBacking> map =
       MakeGarbageCollected<MapWithInlinedBacking>();
   {
     // Create a map that is reclaimed during compaction.
     (MakeGarbageCollected<MapWithInlinedBacking>())
-        ->insert(IntWrapper::Create(1, HashTablesAreCompacted), Value());
+        ->insert(IntWrapper::Create(1, HashTablesAreCompacted),
+                 MakeGarbageCollected<Value>());
 
     IntWrapper* wrapper = IntWrapper::Create(1, HashTablesAreCompacted);
-    Value storage;
-    storage.push_front(wrapper);
+    Value* storage = MakeGarbageCollected<Value>();
+    storage->push_front(wrapper);
     map->insert(wrapper, std::move(storage));
   }
   PerformHeapCompaction();
diff --git a/third_party/blink/renderer/platform/heap/test/heap_test.cc b/third_party/blink/renderer/platform/heap/test/heap_test.cc
index 8fd5c8f3..bd9e06d 100644
--- a/third_party/blink/renderer/platform/heap/test/heap_test.cc
+++ b/third_party/blink/renderer/platform/heap/test/heap_test.cc
@@ -2874,9 +2874,7 @@
   }
 }
 
-class NonTrivialObject final {
-  DISALLOW_NEW();
-
+class NonTrivialObject final : public GarbageCollected<NonTrivialObject> {
  public:
   NonTrivialObject() = default;
   explicit NonTrivialObject(int num) {
@@ -2894,9 +2892,9 @@
 };
 
 TEST_F(HeapTest, HeapHashMapWithInlinedObject) {
-  HeapHashMap<int, NonTrivialObject> map;
+  HeapHashMap<int, Member<NonTrivialObject>> map;
   for (int num = 1; num < 1000; num++) {
-    NonTrivialObject object(num);
+    NonTrivialObject* object = MakeGarbageCollected<NonTrivialObject>(num);
     map.insert(num, object);
   }
 }
@@ -3866,42 +3864,42 @@
   IntWrapper::destructor_calls_ = 0;
   typedef HeapVector<Member<IntWrapper>> IntVector;
   typedef HeapDeque<Member<IntWrapper>> IntDeque;
-  HeapHashMap<void*, IntVector>* map =
-      MakeGarbageCollected<HeapHashMap<void*, IntVector>>();
-  HeapHashMap<void*, IntDeque>* map2 =
-      MakeGarbageCollected<HeapHashMap<void*, IntDeque>>();
+  HeapHashMap<void*, Member<IntVector>>* map =
+      MakeGarbageCollected<HeapHashMap<void*, Member<IntVector>>>();
+  HeapHashMap<void*, Member<IntDeque>>* map2 =
+      MakeGarbageCollected<HeapHashMap<void*, Member<IntDeque>>>();
   static_assert(WTF::IsTraceable<IntVector>::value,
                 "Failed to recognize HeapVector as traceable");
   static_assert(WTF::IsTraceable<IntDeque>::value,
                 "Failed to recognize HeapDeque as traceable");
 
-  map->insert(key, IntVector());
-  map2->insert(key, IntDeque());
+  map->insert(key, MakeGarbageCollected<IntVector>());
+  map2->insert(key, MakeGarbageCollected<IntDeque>());
 
-  HeapHashMap<void*, IntVector>::iterator it = map->find(key);
-  EXPECT_EQ(0u, map->at(key).size());
+  HeapHashMap<void*, Member<IntVector>>::iterator it = map->find(key);
+  EXPECT_EQ(0u, map->at(key)->size());
 
-  HeapHashMap<void*, IntDeque>::iterator it2 = map2->find(key);
-  EXPECT_EQ(0u, map2->at(key).size());
+  HeapHashMap<void*, Member<IntDeque>>::iterator it2 = map2->find(key);
+  EXPECT_EQ(0u, map2->at(key)->size());
 
-  it->value.push_back(MakeGarbageCollected<IntWrapper>(42));
-  EXPECT_EQ(1u, map->at(key).size());
+  it->value->push_back(MakeGarbageCollected<IntWrapper>(42));
+  EXPECT_EQ(1u, map->at(key)->size());
 
-  it2->value.push_back(MakeGarbageCollected<IntWrapper>(42));
-  EXPECT_EQ(1u, map2->at(key).size());
+  it2->value->push_back(MakeGarbageCollected<IntWrapper>(42));
+  EXPECT_EQ(1u, map2->at(key)->size());
 
-  Persistent<HeapHashMap<void*, IntVector>> keep_alive(map);
-  Persistent<HeapHashMap<void*, IntDeque>> keep_alive2(map2);
+  Persistent<HeapHashMap<void*, Member<IntVector>>> keep_alive(map);
+  Persistent<HeapHashMap<void*, Member<IntDeque>>> keep_alive2(map2);
 
   for (int i = 0; i < 100; i++) {
-    map->insert(key + 1 + i, IntVector());
-    map2->insert(key + 1 + i, IntDeque());
+    map->insert(key + 1 + i, MakeGarbageCollected<IntVector>());
+    map2->insert(key + 1 + i, MakeGarbageCollected<IntDeque>());
   }
 
   PreciselyCollectGarbage();
 
-  EXPECT_EQ(1u, map->at(key).size());
-  EXPECT_EQ(1u, map2->at(key).size());
+  EXPECT_EQ(1u, map->at(key)->size());
+  EXPECT_EQ(1u, map2->at(key)->size());
   EXPECT_EQ(0, IntWrapper::destructor_calls_);
 
   keep_alive = nullptr;
@@ -3954,20 +3952,20 @@
   void* key = &IntWrapper::destructor_calls_;
   IntWrapper::destructor_calls_ = 0;
   typedef HeapHashSet<Member<IntWrapper>> IntSet;
-  HeapHashMap<void*, IntSet>* map =
-      MakeGarbageCollected<HeapHashMap<void*, IntSet>>();
+  HeapHashMap<void*, Member<IntSet>>* map =
+      MakeGarbageCollected<HeapHashMap<void*, Member<IntSet>>>();
 
-  map->insert(key, IntSet());
+  map->insert(key, MakeGarbageCollected<IntSet>());
 
-  HeapHashMap<void*, IntSet>::iterator it = map->find(key);
-  EXPECT_EQ(0u, map->at(key).size());
+  HeapHashMap<void*, Member<IntSet>>::iterator it = map->find(key);
+  EXPECT_EQ(0u, map->at(key)->size());
 
-  it->value.insert(MakeGarbageCollected<IntWrapper>(42));
-  EXPECT_EQ(1u, map->at(key).size());
+  it->value->insert(MakeGarbageCollected<IntWrapper>(42));
+  EXPECT_EQ(1u, map->at(key)->size());
 
-  Persistent<HeapHashMap<void*, IntSet>> keep_alive(map);
+  Persistent<HeapHashMap<void*, Member<IntSet>>> keep_alive(map);
   PreciselyCollectGarbage();
-  EXPECT_EQ(1u, map->at(key).size());
+  EXPECT_EQ(1u, map->at(key)->size());
   EXPECT_EQ(0, IntWrapper::destructor_calls_);
 }
 
@@ -4498,29 +4496,29 @@
 
 TEST_F(HeapTest, EphemeronsInEphemerons) {
   typedef HeapHashMap<WeakMember<IntWrapper>, Member<IntWrapper>> InnerMap;
-  typedef HeapHashMap<WeakMember<IntWrapper>, InnerMap> OuterMap;
+  typedef HeapHashMap<WeakMember<IntWrapper>, Member<InnerMap>> OuterMap;
 
   for (int keep_outer_alive = 0; keep_outer_alive <= 1; keep_outer_alive++) {
     for (int keep_inner_alive = 0; keep_inner_alive <= 1; keep_inner_alive++) {
       Persistent<OuterMap> outer = MakeGarbageCollected<OuterMap>();
       Persistent<IntWrapper> one = MakeGarbageCollected<IntWrapper>(1);
       Persistent<IntWrapper> two = MakeGarbageCollected<IntWrapper>(2);
-      outer->insert(one, InnerMap());
-      outer->begin()->value.insert(two, MakeGarbageCollected<IntWrapper>(3));
-      EXPECT_EQ(1u, outer->at(one).size());
+      outer->insert(one, MakeGarbageCollected<InnerMap>());
+      outer->begin()->value->insert(two, MakeGarbageCollected<IntWrapper>(3));
+      EXPECT_EQ(1u, outer->at(one)->size());
       if (!keep_outer_alive)
         one.Clear();
       if (!keep_inner_alive)
         two.Clear();
       PreciselyCollectGarbage();
       if (keep_outer_alive) {
-        const InnerMap& inner = outer->at(one);
+        const InnerMap* inner = outer->at(one);
         if (keep_inner_alive) {
-          EXPECT_EQ(1u, inner.size());
-          IntWrapper* three = inner.at(two);
+          EXPECT_EQ(1u, inner->size());
+          IntWrapper* three = inner->at(two);
           EXPECT_EQ(3, three->Value());
         } else {
-          EXPECT_EQ(0u, inner.size());
+          EXPECT_EQ(0u, inner->size());
         }
       } else {
         EXPECT_EQ(0u, outer->size());
@@ -4534,9 +4532,10 @@
       for (int i = 0; i < 10000; i++) {
         auto* value = MakeGarbageCollected<IntWrapper>(i);
         keep_alive->push_back(value);
-        OuterMap::AddResult new_entry = outer->insert(value, InnerMap());
-        new_entry.stored_value->value.insert(deep, home);
-        new_entry.stored_value->value.insert(composite, home);
+        OuterMap::AddResult new_entry =
+            outer->insert(value, MakeGarbageCollected<InnerMap>());
+        new_entry.stored_value->value->insert(deep, home);
+        new_entry.stored_value->value->insert(composite, home);
       }
       composite.Clear();
       PreciselyCollectGarbage();
@@ -4545,7 +4544,7 @@
         IntWrapper* value = keep_alive->at(i);
         EXPECT_EQ(1u,
                   outer->at(value)
-                      .size());  // Other one was deleted by weak handling.
+                      ->size());  // Other one was deleted by weak handling.
         if (i & 1)
           keep_alive->at(i) = nullptr;
       }
diff --git a/third_party/blink/web_tests/NeverFixTests b/third_party/blink/web_tests/NeverFixTests
index 6daf107..20cce55 100644
--- a/third_party/blink/web_tests/NeverFixTests
+++ b/third_party/blink/web_tests/NeverFixTests
@@ -2152,3 +2152,18 @@
 
 # CPU test is enough for this one as there are gradient issues on the GPU
 virtual/gpu/fast/canvas/conic-gradient.html [ Skip ]
+crbug.com/626703 [ Linux ] external/wpt/html/webappapis/system-state-and-capabilities/the-navigator-object/protocol-handler-query-nosw-manual.https.html [ Skip ]
+crbug.com/626703 [ Mac ] external/wpt/html/webappapis/system-state-and-capabilities/the-navigator-object/protocol-handler-query-nosw-manual.https.html [ Skip ]
+crbug.com/626703 [ Win ] external/wpt/html/webappapis/system-state-and-capabilities/the-navigator-object/protocol-handler-query-nosw-manual.https.html [ Skip ]
+crbug.com/626703 [ Linux ] external/wpt/html/webappapis/system-state-and-capabilities/the-navigator-object/protocol-handler-fragment-manual.https.html [ Skip ]
+crbug.com/626703 [ Mac ] external/wpt/html/webappapis/system-state-and-capabilities/the-navigator-object/protocol-handler-fragment-manual.https.html [ Skip ]
+crbug.com/626703 [ Win ] external/wpt/html/webappapis/system-state-and-capabilities/the-navigator-object/protocol-handler-fragment-manual.https.html [ Skip ]
+crbug.com/626703 [ Linux ] external/wpt/html/webappapis/system-state-and-capabilities/the-navigator-object/protocol-handler-query-manual.https.html [ Skip ]
+crbug.com/626703 [ Mac ] external/wpt/html/webappapis/system-state-and-capabilities/the-navigator-object/protocol-handler-query-manual.https.html [ Skip ]
+crbug.com/626703 [ Win ] external/wpt/html/webappapis/system-state-and-capabilities/the-navigator-object/protocol-handler-query-manual.https.html [ Skip ]
+crbug.com/626703 [ Linux ] external/wpt/html/webappapis/system-state-and-capabilities/the-navigator-object/protocol-handler-path-manual.https.html [ Skip ]
+crbug.com/626703 [ Mac ] external/wpt/html/webappapis/system-state-and-capabilities/the-navigator-object/protocol-handler-path-manual.https.html [ Skip ]
+crbug.com/626703 [ Win ] external/wpt/html/webappapis/system-state-and-capabilities/the-navigator-object/protocol-handler-path-manual.https.html [ Skip ]
+crbug.com/626703 [ Linux ] external/wpt/html/webappapis/system-state-and-capabilities/the-navigator-object/protocol-handler-fragment-nosw-manual.https.html [ Skip ]
+crbug.com/626703 [ Mac ] external/wpt/html/webappapis/system-state-and-capabilities/the-navigator-object/protocol-handler-fragment-nosw-manual.https.html [ Skip ]
+crbug.com/626703 [ Win ] external/wpt/html/webappapis/system-state-and-capabilities/the-navigator-object/protocol-handler-fragment-nosw-manual.https.html [ Skip ]
diff --git a/third_party/blink/web_tests/TestExpectations b/third_party/blink/web_tests/TestExpectations
index 9ce878e..b4d3164 100644
--- a/third_party/blink/web_tests/TestExpectations
+++ b/third_party/blink/web_tests/TestExpectations
@@ -1307,8 +1307,6 @@
 
 # Fieldset in NG
 #
-crbug.com/875235 virtual/layout_ng_fieldset/external/wpt/html/rendering/non-replaced-elements/the-fieldset-and-legend-elements/fieldset-flexbox.html [ Pass ]
-crbug.com/875235 virtual/layout_ng_fieldset/external/wpt/html/rendering/non-replaced-elements/the-fieldset-and-legend-elements/fieldset-percentage-block-size.html [ Failure ]
 crbug.com/875235 virtual/layout_ng_fieldset/external/wpt/html/rendering/non-replaced-elements/the-fieldset-and-legend-elements/legend-align.html [ Failure ]
 crbug.com/875235 virtual/layout_ng_fieldset/external/wpt/html/rendering/non-replaced-elements/the-fieldset-and-legend-elements/legend-auto-margins.html [ Failure ]
 crbug.com/875235 virtual/layout_ng_fieldset/external/wpt/html/rendering/non-replaced-elements/the-fieldset-and-legend-elements/legend-margin-inline.html [ Failure ]
@@ -2717,6 +2715,12 @@
 crbug.com/1105958 external/wpt/payment-request/payment-is-showing.https.html [ Timeout ]
 
 # ====== New tests from wpt-importer added here ======
+crbug.com/626703 [ Linux ] external/wpt/input-events/input-events-get-target-ranges-backspace.tentative.html [ Timeout ]
+crbug.com/626703 [ Mac ] external/wpt/input-events/input-events-get-target-ranges-backspace.tentative.html [ Timeout ]
+crbug.com/626703 [ Win ] external/wpt/input-events/input-events-get-target-ranges-backspace.tentative.html [ Timeout ]
+crbug.com/626703 [ Linux ] external/wpt/input-events/input-events-get-target-ranges-forwarddelete.tentative.html [ Timeout ]
+crbug.com/626703 [ Mac ] external/wpt/input-events/input-events-get-target-ranges-forwarddelete.tentative.html [ Timeout ]
+crbug.com/626703 [ Win ] external/wpt/input-events/input-events-get-target-ranges-forwarddelete.tentative.html [ Timeout ]
 crbug.com/626703 [ Linux ] external/wpt/css/css-grid/layout-algorithm/flex-and-intrinsic-sizes-002.html [ Failure ]
 crbug.com/626703 [ Mac ] external/wpt/css/css-grid/layout-algorithm/flex-and-intrinsic-sizes-002.html [ Failure ]
 crbug.com/626703 [ Win ] external/wpt/css/css-grid/layout-algorithm/flex-and-intrinsic-sizes-002.html [ Failure ]
@@ -3263,7 +3267,6 @@
 crbug.com/367760 external/wpt/svg/pservers/reftests/meshgradient-basic-005.svg [ Failure ]
 crbug.com/367760 external/wpt/svg/pservers/reftests/meshgradient-basic-002.svg [ Failure ]
 crbug.com/367760 external/wpt/svg/pservers/reftests/meshgradient-basic-003.svg [ Failure ]
-crbug.com/875235 external/wpt/html/rendering/non-replaced-elements/the-fieldset-and-legend-elements/fieldset-flexbox.html [ Failure ]
 crbug.com/626703 external/wpt/html/rendering/non-replaced-elements/the-fieldset-and-legend-elements/legend-block-margins.html [ Failure ]
 crbug.com/626703 external/wpt/html/rendering/non-replaced-elements/the-fieldset-and-legend-elements/legend-display-rendering.html [ Failure ]
 crbug.com/626703 external/wpt/html/rendering/non-replaced-elements/the-fieldset-and-legend-elements/legend-tall.html [ Failure ]
@@ -6867,3 +6870,9 @@
 crbug.com/1108423 external/wpt/referrer-policy/gen/worker-classic.http-rp/unset/worker-classic.http.html [ Pass Timeout ]
 crbug.com/1106429 virtual/percent-based-scrolling/max-percent-delta-page-zoom.html [ Pass Failure ]
 crbug.com/1112304 external/wpt/html/cross-origin-opener-policy/popup-coop-by-sw-from-coop.https.html [ Pass Timeout ]
+
+# Sheriff 2020-08-04: New wpt tests are failing
+crbug.com/1112771 external/wpt/css/css-grid/grid-definition/grid-template-columns-rows-resolved-values-001.tentative.html [ Failure ]
+crbug.com/1112771 external/wpt/css/css-grid/layout-algorithm/grid-flex-track-intrinsic-sizes-001.html [ Failure ]
+crbug.com/1112771 external/wpt/webhid/idlharness.https.window.html [ Failure ]
+crbug.com/1112771 external/wpt/css/css-grid/grid-definition/grid-inline-template-columns-rows-resolved-values-001.tentative.html [ Failure ]
diff --git a/third_party/blink/web_tests/external/WPT_BASE_MANIFEST_8.json b/third_party/blink/web_tests/external/WPT_BASE_MANIFEST_8.json
index cd6fb49..9d261e1 100644
--- a/third_party/blink/web_tests/external/WPT_BASE_MANIFEST_8.json
+++ b/third_party/blink/web_tests/external/WPT_BASE_MANIFEST_8.json
@@ -8238,6 +8238,41 @@
          null,
          {}
         ]
+       ],
+       "protocol-handler-fragment-manual.https.html": [
+        "15617865691878af2069dfbbf4d397bf3a442600",
+        [
+         null,
+         {}
+        ]
+       ],
+       "protocol-handler-fragment-nosw-manual.https.html": [
+        "be3a6be6665246ccffa1d60f0e11f376b3280cb5",
+        [
+         null,
+         {}
+        ]
+       ],
+       "protocol-handler-path-manual.https.html": [
+        "085c5723ec412d027ef0ccca13855839477ffe70",
+        [
+         null,
+         {}
+        ]
+       ],
+       "protocol-handler-query-manual.https.html": [
+        "8ce65a5bad8826326dc4b5c85c6476174bbd5954",
+        [
+         null,
+         {}
+        ]
+       ],
+       "protocol-handler-query-nosw-manual.https.html": [
+        "9b4473fb8952ba93c79d17b71725b97c6bf2b208",
+        [
+         null,
+         {}
+        ]
        ]
       }
      },
@@ -159039,6 +159074,14 @@
        "6d1eedb1fcbfda2bf27f74af1b34763adc62d599",
        []
       ],
+      "not-embeddable-frame.html": [
+       "e69de29bb2d1d6434b8b29ae775ad8c2e48c5391",
+       []
+      ],
+      "not-embeddable-frame.html.sub.headers": [
+       "beecdb765cd02cc6f15700d773e66e8844b941da",
+       []
+      ],
       "redirect-throw-function.sub.py": [
        "1bc89abf7176bbada8f0c8c35fd699f52bb0e8a9",
        []
@@ -159084,7 +159127,15 @@
      ]
     },
     "sandbox": {
+     "meta-element.sub-expected.txt": [
+      "329b19aeb83a744ca44e05ddf619002ffbadf33e",
+      []
+     ],
      "support": {
+      "post-origin-on-load-worker.js": [
+       "21ce5748ab8b1edbfd04c8f77a3fba54739a73d5",
+       []
+      ],
       "sandboxed-data-iframe.sub.html": [
        "fafd4dc7707ab0d26ed2c67f34c26920649795f8",
        []
@@ -197523,7 +197574,7 @@
       []
      ],
      "from-local-system.md": [
-      "8c71e535baa907f1ef86641ee6211adb7d0c2423",
+      "91823444d5d4813afb020d00b2fca188f4a22f21",
       []
      ],
      "from-web.md": [
@@ -214586,10 +214637,48 @@
          []
         ],
         "dynamic-import": {
+         "alpha": {
+          "base-url-worker.sub-expected.txt": [
+           "d6fa4d1f1ddd7d400080e6375a553663dffbbb9d",
+           []
+          ],
+          "base-url.sub-expected.txt": [
+           "15485c46651450d0b0349488713db94f2e61be47",
+           []
+          ],
+          "import.js": [
+           "b2ac52df2a18d4bdcf49310352c2bafbeb0269c4",
+           []
+          ],
+          "worker-importScripts.sub.js": [
+           "904d32f9bfd7110c1cb1c7104f54118c86aba30e",
+           []
+          ]
+         },
+         "beta": {
+          "import.js": [
+           "7de1c68182571b80afabd79661f3fed025a2a34f",
+           []
+          ],
+          "redirect.py": [
+           "f2fd1ebd51d4ad5f4ef0582510600eb3731fd2c7",
+           []
+          ]
+         },
          "dynamic-imports-credentials.sub-expected.txt": [
           "6e9f8aa345e49d4a771efa4b2600369f2a1ef753",
           []
          ],
+         "gamma": {
+          "base-url.sub.js": [
+           "ec7784983d1182831d3ab910bca7eb54322eec62",
+           []
+          ],
+          "import.js": [
+           "435c1369be2f7a214b003ee8efa734ba8478cc7b",
+           []
+          ]
+         },
          "propagate-nonce-external.js": [
           "3b97d2f40e914af5d22ecc338913dcb0591927ba",
           []
@@ -216361,7 +216450,21 @@
        "navigatorcookies-cookieenabled-false-manual-expected.txt": [
         "a95972302bfe24a2e207a7085bde0d103426de8f",
         []
-       ]
+       ],
+       "resources": {
+        "handler-sw.js": [
+         "5fd915d17f98d8fa9c3c81451f46d71bc6cd024e",
+         []
+        ],
+        "handler-tools.js": [
+         "073287265cfe5f5b219ad6f61ffed89556a1e5cb",
+         []
+        ],
+        "handler.html": [
+         "552e5417842e67bb5b917268e0250a951614267c",
+         []
+        ]
+       }
       }
      },
      "the-windoworworkerglobalscope-mixin": {
@@ -242194,6 +242297,18 @@
         "a17a9a3a12cefe883a5d4dee4d5a45bef120d050",
         []
        ],
+       "catch.sub.any.serviceworker-expected.txt": [
+        "32ebda0c8b37e79f90b858c1ef45a67617f93b1d",
+        []
+       ],
+       "catch.sub.any.sharedworker-expected.txt": [
+        "1942e64d2b3db7f803cee2ffc391ab1129665704",
+        []
+       ],
+       "catch.sub.any.worker-expected.txt": [
+        "1942e64d2b3db7f803cee2ffc391ab1129665704",
+        []
+       ],
        "null": [
         "8e54b66c50eca7d504b52a9155c9d44eeb1e8d40",
         []
@@ -242202,6 +242317,50 @@
         "a17a9a3a12cefe883a5d4dee4d5a45bef120d050",
         []
        ],
+       "report-error-cross-origin.sub.any.sharedworker-expected.txt": [
+        "db4107573033fe7b73aaf3de3269360bcf20e688",
+        []
+       ],
+       "report-error-cross-origin.sub.any.worker-expected.txt": [
+        "db4107573033fe7b73aaf3de3269360bcf20e688",
+        []
+       ],
+       "report-error-helper.js": [
+        "7fc6d0dd64bc82527621a90f848d080a195ed212",
+        []
+       ],
+       "report-error-redirect-to-cross-origin.sub.any.sharedworker-expected.txt": [
+        "db4107573033fe7b73aaf3de3269360bcf20e688",
+        []
+       ],
+       "report-error-redirect-to-cross-origin.sub.any.worker-expected.txt": [
+        "db4107573033fe7b73aaf3de3269360bcf20e688",
+        []
+       ],
+       "report-error-setTimeout-cross-origin.sub.any.sharedworker-expected.txt": [
+        "81bc6acab7090cb262edb0eccec8c647cb60fb51",
+        []
+       ],
+       "report-error-setTimeout-cross-origin.sub.any.worker-expected.txt": [
+        "81bc6acab7090cb262edb0eccec8c647cb60fb51",
+        []
+       ],
+       "report-error-setTimeout-redirect-to-cross-origin.sub.any.sharedworker-expected.txt": [
+        "81bc6acab7090cb262edb0eccec8c647cb60fb51",
+        []
+       ],
+       "report-error-setTimeout-redirect-to-cross-origin.sub.any.worker-expected.txt": [
+        "81bc6acab7090cb262edb0eccec8c647cb60fb51",
+        []
+       ],
+       "report-error-setTimeout-same-origin.sub.any.sharedworker-expected.txt": [
+        "736c8c65d74da0142b46e7bb36540b06be6b5ed3",
+        []
+       ],
+       "report-error-setTimeout-same-origin.sub.any.worker-expected.txt": [
+        "736c8c65d74da0142b46e7bb36540b06be6b5ed3",
+        []
+       ],
        "undefined": [
         "f99ba4be744c40c45ec3f9c58d2d1379f514c5d5",
         []
@@ -242428,6 +242587,10 @@
       "syntax-error.js": [
        "8c5c4df671bcc3f75ac1e474fc651927e57e8701",
        []
+      ],
+      "throw.js": [
+       "3d876d43d930d281c1d6aa595e527497b622e80b",
+       []
       ]
      },
      "shared-worker-import-meta-expected.txt": [
@@ -263726,6 +263889,13 @@
        }
       ]
      ],
+     "report-frame-ancestors.sub.html": [
+      "a5aa1661c1085a61bedfe88b41ee389f62f577d2",
+      [
+       null,
+       {}
+      ]
+     ],
      "report-multiple-violations-01.html": [
       "7a92f1b955639eb26bfd4a737ee1a930fdec6592",
       [
@@ -263895,6 +264065,13 @@
        {}
       ]
      ],
+     "meta-element.sub.html": [
+      "cd8da8f14c4ad775b9034131315867dec08cd2e8",
+      [
+       null,
+       {}
+      ]
+     ],
      "sandbox-allow-scripts-subframe.sub.html": [
       "1d6db3cde71cddb66f5536720a632b537465cbff",
       [
@@ -336688,7 +336865,7 @@
         ]
        ],
        "reporting-redirect-with-same-origin-allow-popups.https.html": [
-        "7dba76c4ef5434d49d7800da14eb980f79728f44",
+        "bb76df811da5949c2d6f5196428a4a09d8bd9a56",
         [
          null,
          {
@@ -347912,6 +348089,22 @@
          ]
         ],
         "dynamic-import": {
+         "alpha": {
+          "base-url-worker.sub.html": [
+           "ca4b005349e16db3c510ed6774e5d89f53c1a876",
+           [
+            null,
+            {}
+           ]
+          ],
+          "base-url.sub.html": [
+           "f7d4927a104c78e2f3d41e0899c7deadb5ca3d1c",
+           [
+            null,
+            {}
+           ]
+          ]
+         },
          "dynamic-imports-credentials.sub.html": [
           "b939a3ef1639db8027519ac004cd3197e254c0b9",
           [
@@ -354505,6 +354698,24 @@
       {}
      ]
     ],
+    "input-events-get-target-ranges-backspace.tentative.html": [
+     "cf512269b07e0177214f7d9059150a77b85eb225",
+     [
+      null,
+      {
+       "testdriver": true
+      }
+     ]
+    ],
+    "input-events-get-target-ranges-forwarddelete.tentative.html": [
+     "3780324cf92bfa0c712045d89e43e903e3a1c9c6",
+     [
+      null,
+      {
+       "testdriver": true
+      }
+     ]
+    ],
     "input-events-typing.html": [
      "a894beea9bd381313b999e45abe0b4b8f61c804b",
      [
@@ -411650,6 +411861,240 @@
          null,
          {}
         ]
+       ],
+       "catch.sub.any.js": [
+        "52da60be91f62ce048f5ae1a2f81a9307a734479",
+        [
+         "workers/interfaces/WorkerUtils/importScripts/catch.sub.any.serviceworker.html",
+         {
+          "script_metadata": [
+           [
+            "global",
+            "worker"
+           ]
+          ]
+         }
+        ],
+        [
+         "workers/interfaces/WorkerUtils/importScripts/catch.sub.any.sharedworker.html",
+         {
+          "script_metadata": [
+           [
+            "global",
+            "worker"
+           ]
+          ]
+         }
+        ],
+        [
+         "workers/interfaces/WorkerUtils/importScripts/catch.sub.any.worker.html",
+         {
+          "script_metadata": [
+           [
+            "global",
+            "worker"
+           ]
+          ]
+         }
+        ]
+       ],
+       "report-error-cross-origin.sub.any.js": [
+        "4fd8914856b5a6cb5a70849126110705c45ae51d",
+        [
+         "workers/interfaces/WorkerUtils/importScripts/report-error-cross-origin.sub.any.sharedworker.html",
+         {
+          "script_metadata": [
+           [
+            "global",
+            "dedicatedworker,sharedworker"
+           ],
+           [
+            "script",
+            "report-error-helper.js"
+           ]
+          ]
+         }
+        ],
+        [
+         "workers/interfaces/WorkerUtils/importScripts/report-error-cross-origin.sub.any.worker.html",
+         {
+          "script_metadata": [
+           [
+            "global",
+            "dedicatedworker,sharedworker"
+           ],
+           [
+            "script",
+            "report-error-helper.js"
+           ]
+          ]
+         }
+        ]
+       ],
+       "report-error-redirect-to-cross-origin.sub.any.js": [
+        "2b9600973fb80a8cc8dc2da38818a7b7c1014e46",
+        [
+         "workers/interfaces/WorkerUtils/importScripts/report-error-redirect-to-cross-origin.sub.any.sharedworker.html",
+         {
+          "script_metadata": [
+           [
+            "global",
+            "dedicatedworker,sharedworker"
+           ],
+           [
+            "script",
+            "report-error-helper.js"
+           ]
+          ]
+         }
+        ],
+        [
+         "workers/interfaces/WorkerUtils/importScripts/report-error-redirect-to-cross-origin.sub.any.worker.html",
+         {
+          "script_metadata": [
+           [
+            "global",
+            "dedicatedworker,sharedworker"
+           ],
+           [
+            "script",
+            "report-error-helper.js"
+           ]
+          ]
+         }
+        ]
+       ],
+       "report-error-same-origin.sub.any.js": [
+        "f7de416e117086f636f4bff69805d7d55d70e02b",
+        [
+         "workers/interfaces/WorkerUtils/importScripts/report-error-same-origin.sub.any.sharedworker.html",
+         {
+          "script_metadata": [
+           [
+            "global",
+            "dedicatedworker,sharedworker"
+           ],
+           [
+            "script",
+            "report-error-helper.js"
+           ]
+          ]
+         }
+        ],
+        [
+         "workers/interfaces/WorkerUtils/importScripts/report-error-same-origin.sub.any.worker.html",
+         {
+          "script_metadata": [
+           [
+            "global",
+            "dedicatedworker,sharedworker"
+           ],
+           [
+            "script",
+            "report-error-helper.js"
+           ]
+          ]
+         }
+        ]
+       ],
+       "report-error-setTimeout-cross-origin.sub.any.js": [
+        "a1bbef7bc45a4455bf367d0ff7650f6d2910d037",
+        [
+         "workers/interfaces/WorkerUtils/importScripts/report-error-setTimeout-cross-origin.sub.any.sharedworker.html",
+         {
+          "script_metadata": [
+           [
+            "global",
+            "dedicatedworker,sharedworker"
+           ],
+           [
+            "script",
+            "report-error-helper.js"
+           ]
+          ]
+         }
+        ],
+        [
+         "workers/interfaces/WorkerUtils/importScripts/report-error-setTimeout-cross-origin.sub.any.worker.html",
+         {
+          "script_metadata": [
+           [
+            "global",
+            "dedicatedworker,sharedworker"
+           ],
+           [
+            "script",
+            "report-error-helper.js"
+           ]
+          ]
+         }
+        ]
+       ],
+       "report-error-setTimeout-redirect-to-cross-origin.sub.any.js": [
+        "2755b337d3dacf1b1d545e467d950042c9fd91d0",
+        [
+         "workers/interfaces/WorkerUtils/importScripts/report-error-setTimeout-redirect-to-cross-origin.sub.any.sharedworker.html",
+         {
+          "script_metadata": [
+           [
+            "global",
+            "dedicatedworker,sharedworker"
+           ],
+           [
+            "script",
+            "report-error-helper.js"
+           ]
+          ]
+         }
+        ],
+        [
+         "workers/interfaces/WorkerUtils/importScripts/report-error-setTimeout-redirect-to-cross-origin.sub.any.worker.html",
+         {
+          "script_metadata": [
+           [
+            "global",
+            "dedicatedworker,sharedworker"
+           ],
+           [
+            "script",
+            "report-error-helper.js"
+           ]
+          ]
+         }
+        ]
+       ],
+       "report-error-setTimeout-same-origin.sub.any.js": [
+        "c4f70ebec973de42c3e5ec00edbc6c9a765d8983",
+        [
+         "workers/interfaces/WorkerUtils/importScripts/report-error-setTimeout-same-origin.sub.any.sharedworker.html",
+         {
+          "script_metadata": [
+           [
+            "global",
+            "dedicatedworker,sharedworker"
+           ],
+           [
+            "script",
+            "report-error-helper.js"
+           ]
+          ]
+         }
+        ],
+        [
+         "workers/interfaces/WorkerUtils/importScripts/report-error-setTimeout-same-origin.sub.any.worker.html",
+         {
+          "script_metadata": [
+           [
+            "global",
+            "dedicatedworker,sharedworker"
+           ],
+           [
+            "script",
+            "report-error-helper.js"
+           ]
+          ]
+         }
+        ]
        ]
       },
       "navigator": {
diff --git a/third_party/blink/web_tests/external/wpt/content-security-policy/reporting/report-frame-ancestors.sub.html b/third_party/blink/web_tests/external/wpt/content-security-policy/reporting/report-frame-ancestors.sub.html
new file mode 100644
index 0000000..a5aa166
--- /dev/null
+++ b/third_party/blink/web_tests/external/wpt/content-security-policy/reporting/report-frame-ancestors.sub.html
@@ -0,0 +1,12 @@
+<!DOCTYPE html>
+<html>
+<head>
+    <script src="/resources/testharness.js"></script>
+    <script src="/resources/testharnessreport.js"></script>
+    <title>Reporting works with frame-ancestors</title>
+</head>
+<body>
+    <iframe src="./support/not-embeddable-frame.html?reportID={{$id:uuid()}}"></iframe>
+    <script async defer src='../support/checkReport.sub.js?reportField=violated-directive&reportValue=frame-ancestors&reportID={{$id}}'></script>
+</body>
+</html>
diff --git a/third_party/blink/web_tests/external/wpt/content-security-policy/reporting/support/not-embeddable-frame.html b/third_party/blink/web_tests/external/wpt/content-security-policy/reporting/support/not-embeddable-frame.html
new file mode 100644
index 0000000..e69de29
--- /dev/null
+++ b/third_party/blink/web_tests/external/wpt/content-security-policy/reporting/support/not-embeddable-frame.html
diff --git a/third_party/blink/web_tests/external/wpt/content-security-policy/reporting/support/not-embeddable-frame.html.sub.headers b/third_party/blink/web_tests/external/wpt/content-security-policy/reporting/support/not-embeddable-frame.html.sub.headers
new file mode 100644
index 0000000..beecdb76
--- /dev/null
+++ b/third_party/blink/web_tests/external/wpt/content-security-policy/reporting/support/not-embeddable-frame.html.sub.headers
@@ -0,0 +1,5 @@
+Expires: Mon, 26 Jul 1997 05:00:00 GMT
+Cache-Control: no-store, no-cache, must-revalidate
+Cache-Control: post-check=0, pre-check=0, false
+Pragma: no-cache
+Content-Security-Policy: frame-ancestors 'none'; report-uri ../../support/report.py?op=put&reportID={{GET[reportID]}}
\ No newline at end of file
diff --git a/third_party/blink/web_tests/external/wpt/docs/running-tests/from-local-system.md b/third_party/blink/web_tests/external/wpt/docs/running-tests/from-local-system.md
index 8c71e535..91823444 100644
--- a/third_party/blink/web_tests/external/wpt/docs/running-tests/from-local-system.md
+++ b/third_party/blink/web_tests/external/wpt/docs/running-tests/from-local-system.md
@@ -39,9 +39,6 @@
 See also [additional setup required to run Safari](safari.md).
 
 ### Windows Setup
-**Note:** In general, Windows Subsystem for Linux will provide the smoothest
-user experience for running web-platform-tests on Windows, where installation
-and usage are similar to Linux.
 
 Download and install [Python 2.7](https://www.python.org/downloads). The
 installer includes `pip` by default.
@@ -63,6 +60,15 @@
 python wpt serve
 ```
 
+#### Windows Subsystem for Linux
+
+Optionally on Windows you can use the [Windows Subsystem for
+Linux](https://docs.microsoft.com/en-us/windows/wsl/about) (WSL). If doing so,
+installation and usage are similar to the Linux instructions. Be aware that WSL
+may attempt to override `/etc/hosts` each time it is launched, which would then
+require you to re-run [`hosts` File Setup](#hosts-file-setup). This behavior
+[can be configured](https://docs.microsoft.com/en-us/windows/wsl/wsl-config#network).
+
 ### `hosts` File Setup
 
 To get the tests running, you need to set up the test domains in your
diff --git a/third_party/blink/web_tests/external/wpt/html/semantics/scripting-1/the-script-element/module/dynamic-import/alpha/base-url-worker.sub-expected.txt b/third_party/blink/web_tests/external/wpt/html/semantics/scripting-1/the-script-element/module/dynamic-import/alpha/base-url-worker.sub-expected.txt
new file mode 100644
index 0000000..d6fa4d1f
--- /dev/null
+++ b/third_party/blink/web_tests/external/wpt/html/semantics/scripting-1/the-script-element/module/dynamic-import/alpha/base-url-worker.sub-expected.txt
@@ -0,0 +1,9 @@
+This is a testharness.js-based test.
+PASS Relative URL-like from worker top-level script
+PASS Absolute URL-like from worker top-level script
+FAIL Relative URL-like from same-origin importScripts() assert_equals: expected "gamma/import.js" but got "beta/import.js"
+PASS Absolute URL-like from same-origin importScripts()
+FAIL Relative URL-like from cross-origin importScripts() assert_equals: Relative URL-like specifier resolution should fail expected "(unreached)" but got "beta/import.js"
+PASS Absolute URL-like from cross-origin importScripts()
+Harness: the test ran to completion.
+
diff --git a/third_party/blink/web_tests/external/wpt/html/semantics/scripting-1/the-script-element/module/dynamic-import/alpha/base-url-worker.sub.html b/third_party/blink/web_tests/external/wpt/html/semantics/scripting-1/the-script-element/module/dynamic-import/alpha/base-url-worker.sub.html
new file mode 100644
index 0000000..ca4b005
--- /dev/null
+++ b/third_party/blink/web_tests/external/wpt/html/semantics/scripting-1/the-script-element/module/dynamic-import/alpha/base-url-worker.sub.html
@@ -0,0 +1,10 @@
+<!DOCTYPE html>
+<title>Base URLs used in resolving specifiers in dynamic imports from workers</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+fetch_tests_from_worker(new Worker(
+    "../beta/redirect.py?location=http://{{host}}:{{ports[http][0]}}/html/semantics/scripting-1/the-script-element/module/dynamic-import/gamma/base-url.sub.js"));
+fetch_tests_from_worker(new Worker(
+    "./worker-importScripts.sub.js"));
+</script>
diff --git a/third_party/blink/web_tests/external/wpt/html/semantics/scripting-1/the-script-element/module/dynamic-import/alpha/base-url.sub-expected.txt b/third_party/blink/web_tests/external/wpt/html/semantics/scripting-1/the-script-element/module/dynamic-import/alpha/base-url.sub-expected.txt
new file mode 100644
index 0000000..15485c46
--- /dev/null
+++ b/third_party/blink/web_tests/external/wpt/html/semantics/scripting-1/the-script-element/module/dynamic-import/alpha/base-url.sub-expected.txt
@@ -0,0 +1,11 @@
+This is a testharness.js-based test.
+FAIL Relative URL-like from same origin classic <script> assert_equals: expected "gamma/import.js" but got "beta/import.js"
+PASS Absolute URL-like from same origin classic <script>
+FAIL Relative URL-like from cross origin classic <script> without crossorigin attribute assert_equals: Relative URL-like specifier resolution should fail expected "(unreached)" but got "beta/import.js"
+PASS Absolute URL-like from cross origin classic <script> without crossorigin attribute
+FAIL Relative URL-like from cross origin classic <script> with crossorigin attribute assert_equals: expected "gamma/import.js" but got "beta/import.js"
+PASS Absolute URL-like from cross origin classic <script> with crossorigin attribute
+PASS Relative URL-like from cross origin module <script>
+PASS Absolute URL-like from cross origin module <script>
+Harness: the test ran to completion.
+
diff --git a/third_party/blink/web_tests/external/wpt/html/semantics/scripting-1/the-script-element/module/dynamic-import/alpha/base-url.sub.html b/third_party/blink/web_tests/external/wpt/html/semantics/scripting-1/the-script-element/module/dynamic-import/alpha/base-url.sub.html
new file mode 100644
index 0000000..f7d4927
--- /dev/null
+++ b/third_party/blink/web_tests/external/wpt/html/semantics/scripting-1/the-script-element/module/dynamic-import/alpha/base-url.sub.html
@@ -0,0 +1,28 @@
+<!DOCTYPE html>
+<title>Base URLs used in resolving specifiers in dynamic imports</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+
+<script>
+self.testName = "same origin classic <script>";
+self.baseUrlSanitized = false;
+</script>
+<script src="../beta/redirect.py?location=http://{{host}}:{{ports[http][0]}}/html/semantics/scripting-1/the-script-element/module/dynamic-import/gamma/base-url.sub.js"></script>
+
+<script>
+self.testName = "cross origin classic <script> without crossorigin attribute";
+self.baseUrlSanitized = true;
+</script>
+<script src="../beta/redirect.py?location=http://{{hosts[alt][]}}:{{ports[http][0]}}/html/semantics/scripting-1/the-script-element/module/dynamic-import/gamma/base-url.sub.js"></script>
+
+<script>
+self.testName = "cross origin classic <script> with crossorigin attribute";
+self.baseUrlSanitized = false;
+</script>
+<script src="../beta/redirect.py?location=http://{{hosts[alt][]}}:{{ports[http][0]}}/html/semantics/scripting-1/the-script-element/module/dynamic-import/gamma/base-url.sub.js%3Fpipe=header(Access-Control-Allow-Origin,*)" crossorigin></script>
+
+<script>
+self.testName = "cross origin module <script>";
+self.baseUrlSanitized = false;
+</script>
+<script src="../beta/redirect.py?location=http://{{hosts[alt][]}}:{{ports[http][0]}}/html/semantics/scripting-1/the-script-element/module/dynamic-import/gamma/base-url.sub.js%3Fpipe=header(Access-Control-Allow-Origin,*)" type="module"></script>
diff --git a/third_party/blink/web_tests/external/wpt/html/semantics/scripting-1/the-script-element/module/dynamic-import/alpha/import.js b/third_party/blink/web_tests/external/wpt/html/semantics/scripting-1/the-script-element/module/dynamic-import/alpha/import.js
new file mode 100644
index 0000000..b2ac52d
--- /dev/null
+++ b/third_party/blink/web_tests/external/wpt/html/semantics/scripting-1/the-script-element/module/dynamic-import/alpha/import.js
@@ -0,0 +1 @@
+export const A = { "from": "alpha/import.js" };
diff --git a/third_party/blink/web_tests/external/wpt/html/semantics/scripting-1/the-script-element/module/dynamic-import/alpha/worker-importScripts.sub.js b/third_party/blink/web_tests/external/wpt/html/semantics/scripting-1/the-script-element/module/dynamic-import/alpha/worker-importScripts.sub.js
new file mode 100644
index 0000000..904d32f9
--- /dev/null
+++ b/third_party/blink/web_tests/external/wpt/html/semantics/scripting-1/the-script-element/module/dynamic-import/alpha/worker-importScripts.sub.js
@@ -0,0 +1,15 @@
+"use strict";
+
+importScripts("/resources/testharness.js");
+
+// CORS-same-origin
+self.testName = "same-origin importScripts()";
+self.baseUrlSanitized = false;
+importScripts("../beta/redirect.py?location=http://{{host}}:{{ports[http][0]}}/html/semantics/scripting-1/the-script-element/module/dynamic-import/gamma/base-url.sub.js");
+
+// CORS-cross-origin
+self.testName = "cross-origin importScripts()";
+self.baseUrlSanitized = true;
+importScripts("../beta/redirect.py?location=http://{{hosts[alt][]}}:{{ports[http][0]}}/html/semantics/scripting-1/the-script-element/module/dynamic-import/gamma/base-url.sub.js");
+
+done();
diff --git a/third_party/blink/web_tests/external/wpt/html/semantics/scripting-1/the-script-element/module/dynamic-import/beta/import.js b/third_party/blink/web_tests/external/wpt/html/semantics/scripting-1/the-script-element/module/dynamic-import/beta/import.js
new file mode 100644
index 0000000..7de1c68
--- /dev/null
+++ b/third_party/blink/web_tests/external/wpt/html/semantics/scripting-1/the-script-element/module/dynamic-import/beta/import.js
@@ -0,0 +1 @@
+export const A = { "from": "beta/import.js" };
diff --git a/third_party/blink/web_tests/external/wpt/html/semantics/scripting-1/the-script-element/module/dynamic-import/beta/redirect.py b/third_party/blink/web_tests/external/wpt/html/semantics/scripting-1/the-script-element/module/dynamic-import/beta/redirect.py
new file mode 100644
index 0000000..f2fd1ebd
--- /dev/null
+++ b/third_party/blink/web_tests/external/wpt/html/semantics/scripting-1/the-script-element/module/dynamic-import/beta/redirect.py
@@ -0,0 +1,19 @@
+def main(request, response):
+    """Simple handler that causes redirection.
+
+    The request should typically have two query parameters:
+    status - The status to use for the redirection. Defaults to 302.
+    location - The resource to redirect to.
+    """
+    status = 302
+    if b"status" in request.GET:
+        try:
+            status = int(request.GET.first(b"status"))
+        except ValueError:
+            pass
+
+    response.status = status
+
+    location = request.GET.first(b"location")
+
+    response.headers.set(b"Location", location)
diff --git a/third_party/blink/web_tests/external/wpt/html/semantics/scripting-1/the-script-element/module/dynamic-import/gamma/base-url.sub.js b/third_party/blink/web_tests/external/wpt/html/semantics/scripting-1/the-script-element/module/dynamic-import/gamma/base-url.sub.js
new file mode 100644
index 0000000..ec77849
--- /dev/null
+++ b/third_party/blink/web_tests/external/wpt/html/semantics/scripting-1/the-script-element/module/dynamic-import/gamma/base-url.sub.js
@@ -0,0 +1,58 @@
+"use strict";
+
+// This script triggers import(), and thus the base URL of this script
+// (either loaded by `<script>` or `importScripts()`) is used as the base URL
+// of resolving relative URL-like specifiers in `import()`.
+
+// The following fields should be set by the callers of this script
+// (unless loaded as the worker top-level script):
+// - self.testName (string)
+// - self.baseUrlSanitized (boolean)
+
+// When this script is loaded as the worker top-level script:
+if ('DedicatedWorkerGlobalScope' in self &&
+    self instanceof DedicatedWorkerGlobalScope &&
+    !self.testName) {
+  importScripts("/resources/testharness.js");
+  self.testName = 'worker top-level script';
+  // Worker top-level scripts are always same-origin.
+  self.baseUrlSanitized = false;
+}
+
+{
+  // This could change by the time the test is executed, so we save it now.
+  // As this script is loaded multiple times, savedBaseUrlSanitized is scoped.
+  const savedBaseUrlSanitized = self.baseUrlSanitized;
+
+  promise_test(() => {
+      const promise = import("./import.js?pipe=header(Access-Control-Allow-Origin,*)&label=relative-" + self.testName);
+      if (savedBaseUrlSanitized) {
+        // The base URL is "about:blank" and thus import() here should fail.
+        return promise.then(module => {
+            // This code should be unreached, but assert_equals() is used here
+            // to log `module.A["from"]` in case of unexpected resolution.
+            assert_equals(module.A["from"], "(unreached)",
+              "Relative URL-like specifier resolution should fail");
+            assert_unreached();
+          },
+          () => {});
+      } else {
+        // The base URL is the response URL of this script, i.e.
+        // `.../gamma/base-url.sub.js`.
+        return promise.then(module => {
+            assert_equals(module.A["from"], "gamma/import.js");
+          });
+      }
+    },
+    "Relative URL-like from " + self.testName);
+}
+
+promise_test(() => {
+    return import("http://{{hosts[alt][]}}:{{ports[http][0]}}/html/semantics/scripting-1/the-script-element/module/dynamic-import/gamma/import.js?pipe=header(Access-Control-Allow-Origin,*)&label=absolute-" + self.testName)
+      .then(module => {
+          assert_equals(module.A["from"], "gamma/import.js");
+        })
+  },
+  "Absolute URL-like from " + self.testName);
+
+done();
diff --git a/third_party/blink/web_tests/external/wpt/html/semantics/scripting-1/the-script-element/module/dynamic-import/gamma/import.js b/third_party/blink/web_tests/external/wpt/html/semantics/scripting-1/the-script-element/module/dynamic-import/gamma/import.js
new file mode 100644
index 0000000..435c136
--- /dev/null
+++ b/third_party/blink/web_tests/external/wpt/html/semantics/scripting-1/the-script-element/module/dynamic-import/gamma/import.js
@@ -0,0 +1 @@
+export const A = { "from": "gamma/import.js" };
diff --git a/third_party/blink/web_tests/external/wpt/html/webappapis/system-state-and-capabilities/the-navigator-object/protocol-handler-fragment-manual.https.html b/third_party/blink/web_tests/external/wpt/html/webappapis/system-state-and-capabilities/the-navigator-object/protocol-handler-fragment-manual.https.html
new file mode 100644
index 0000000..156178656
--- /dev/null
+++ b/third_party/blink/web_tests/external/wpt/html/webappapis/system-state-and-capabilities/the-navigator-object/protocol-handler-fragment-manual.https.html
@@ -0,0 +1,20 @@
+<!doctype html>
+<!-- Use a non-UTF-8 encoding to see how the handler URL is parsed -->
+<meta charset=windows-1254>
+<meta name=timeout content=long>
+<title>registerProtocolHandler() and a handler with %s in the fragment</title>
+<script src=/resources/testharness.js></script>
+<script src=/resources/testharnessreport.js></script>
+<script src=/service-workers/service-worker/resources/test-helpers.sub.js></script>
+<script>
+// Configure expectations for individual test
+window.type = "fragment";
+window.noSW = false;
+</script>
+<script src=resources/handler-tools.js></script>
+<ol>
+ <li><p>First, register the handler: <button onclick='register()'>Register</button>.
+ <li><p>Then, run the test: <button onclick='runTest()'>Run</button>.
+ <li><p>Or, run the test with U+0000 NULL: <button onclick='runTest({ includeNull: true })'>Run NULL</button>.
+</ol>
+<div id=log></div>
diff --git a/third_party/blink/web_tests/external/wpt/html/webappapis/system-state-and-capabilities/the-navigator-object/protocol-handler-fragment-nosw-manual.https.html b/third_party/blink/web_tests/external/wpt/html/webappapis/system-state-and-capabilities/the-navigator-object/protocol-handler-fragment-nosw-manual.https.html
new file mode 100644
index 0000000..be3a6be6
--- /dev/null
+++ b/third_party/blink/web_tests/external/wpt/html/webappapis/system-state-and-capabilities/the-navigator-object/protocol-handler-fragment-nosw-manual.https.html
@@ -0,0 +1,20 @@
+<!doctype html>
+<!-- Use a non-UTF-8 encoding to see how the handler URL is parsed -->
+<meta charset=windows-1254>
+<meta name=timeout content=long>
+<title>registerProtocolHandler() and a handler with %s in the fragment (does not use a service worker)</title>
+<script src=/resources/testharness.js></script>
+<script src=/resources/testharnessreport.js></script>
+<script src=/service-workers/service-worker/resources/test-helpers.sub.js></script>
+<script>
+// Configure expectations for individual test
+window.type = "fragment";
+window.noSW = true;
+</script>
+<script src=resources/handler-tools.js></script>
+<ol>
+ <li><p>First, register the handler: <button onclick='register()'>Register</button>.
+ <li><p>Then, run the test: <button onclick='runTest()'>Run</button>.
+ <li><p>Or, run the test with U+0000 NULL: <button onclick='runTest({ includeNull: true })'>Run NULL</button>.
+</ol>
+<div id=log></div>
diff --git a/third_party/blink/web_tests/external/wpt/html/webappapis/system-state-and-capabilities/the-navigator-object/protocol-handler-path-manual.https.html b/third_party/blink/web_tests/external/wpt/html/webappapis/system-state-and-capabilities/the-navigator-object/protocol-handler-path-manual.https.html
new file mode 100644
index 0000000..085c5723
--- /dev/null
+++ b/third_party/blink/web_tests/external/wpt/html/webappapis/system-state-and-capabilities/the-navigator-object/protocol-handler-path-manual.https.html
@@ -0,0 +1,20 @@
+<!doctype html>
+<!-- Use a non-UTF-8 encoding to see how the handler URL is parsed -->
+<meta charset=windows-1254>
+<meta name=timeout content=long>
+<title>registerProtocolHandler() and a handler with %s in the path</title>
+<script src=/resources/testharness.js></script>
+<script src=/resources/testharnessreport.js></script>
+<script src=/service-workers/service-worker/resources/test-helpers.sub.js></script>
+<script>
+// Configure expectations for individual test
+window.type = "path";
+window.noSW = false;
+</script>
+<script src=resources/handler-tools.js></script>
+<ol>
+ <li><p>First, register the handler: <button onclick='register()'>Register</button>.
+ <li><p>Then, run the test: <button onclick='runTest()'>Run</button>.
+ <li><p>Or, run the test with U+0000 NULL: <button onclick='runTest({ includeNull: true })'>Run NULL</button>.
+</ol>
+<div id=log></div>
diff --git a/third_party/blink/web_tests/external/wpt/html/webappapis/system-state-and-capabilities/the-navigator-object/protocol-handler-query-manual.https.html b/third_party/blink/web_tests/external/wpt/html/webappapis/system-state-and-capabilities/the-navigator-object/protocol-handler-query-manual.https.html
new file mode 100644
index 0000000..8ce65a5
--- /dev/null
+++ b/third_party/blink/web_tests/external/wpt/html/webappapis/system-state-and-capabilities/the-navigator-object/protocol-handler-query-manual.https.html
@@ -0,0 +1,20 @@
+<!doctype html>
+<!-- Use a non-UTF-8 encoding to see how the handler URL is parsed -->
+<meta charset=windows-1254>
+<meta name=timeout content=long>
+<title>registerProtocolHandler() and a handler with %s in the query</title>
+<script src=/resources/testharness.js></script>
+<script src=/resources/testharnessreport.js></script>
+<script src=/service-workers/service-worker/resources/test-helpers.sub.js></script>
+<script>
+// Configure expectations for individual test
+window.type = "query";
+window.noSW = false;
+</script>
+<script src=resources/handler-tools.js></script>
+<ol>
+ <li><p>First, register the handler: <button onclick='register()'>Register</button>.
+ <li><p>Then, run the test: <button onclick='runTest()'>Run</button>.
+ <li><p>Or, run the test with U+0000 NULL: <button onclick='runTest({ includeNull: true })'>Run NULL</button>.
+</ol>
+<div id=log></div>
diff --git a/third_party/blink/web_tests/external/wpt/html/webappapis/system-state-and-capabilities/the-navigator-object/protocol-handler-query-nosw-manual.https.html b/third_party/blink/web_tests/external/wpt/html/webappapis/system-state-and-capabilities/the-navigator-object/protocol-handler-query-nosw-manual.https.html
new file mode 100644
index 0000000..9b4473f
--- /dev/null
+++ b/third_party/blink/web_tests/external/wpt/html/webappapis/system-state-and-capabilities/the-navigator-object/protocol-handler-query-nosw-manual.https.html
@@ -0,0 +1,20 @@
+<!doctype html>
+<!-- Use a non-UTF-8 encoding to see how the handler URL is parsed -->
+<meta charset=windows-1254>
+<meta name=timeout content=long>
+<title>registerProtocolHandler() and a handler with %s in the query (does not use a service worker)</title>
+<script src=/resources/testharness.js></script>
+<script src=/resources/testharnessreport.js></script>
+<script src=/service-workers/service-worker/resources/test-helpers.sub.js></script>
+<script>
+// Configure expectations for individual test
+window.type = "query";
+window.noSW = true;
+</script>
+<script src=resources/handler-tools.js></script>
+<ol>
+ <li><p>First, register the handler: <button onclick='register()'>Register</button>.
+ <li><p>Then, run the test: <button onclick='runTest()'>Run</button>.
+ <li><p>Or, run the test with U+0000 NULL: <button onclick='runTest({ includeNull: true })'>Run NULL</button>.
+</ol>
+<div id=log></div>
diff --git a/third_party/blink/web_tests/external/wpt/html/webappapis/system-state-and-capabilities/the-navigator-object/resources/handler-sw.js b/third_party/blink/web_tests/external/wpt/html/webappapis/system-state-and-capabilities/the-navigator-object/resources/handler-sw.js
new file mode 100644
index 0000000..5fd915d
--- /dev/null
+++ b/third_party/blink/web_tests/external/wpt/html/webappapis/system-state-and-capabilities/the-navigator-object/resources/handler-sw.js
@@ -0,0 +1,3 @@
+onfetch = e => {
+  e.respondWith(fetch("handler.html"));
+}
diff --git a/third_party/blink/web_tests/external/wpt/html/webappapis/system-state-and-capabilities/the-navigator-object/resources/handler-tools.js b/third_party/blink/web_tests/external/wpt/html/webappapis/system-state-and-capabilities/the-navigator-object/resources/handler-tools.js
new file mode 100644
index 0000000..0732872
--- /dev/null
+++ b/third_party/blink/web_tests/external/wpt/html/webappapis/system-state-and-capabilities/the-navigator-object/resources/handler-tools.js
@@ -0,0 +1,53 @@
+// These can be used in an environment that has these global variables defined:
+// * type (one of "path", "query", or "fragment")
+// * noSW (a boolean)
+
+if (type === "path" && noSW) {
+  throw new Error("There is no support for a path handler without a service worker.");
+}
+
+const swString = noSW ? "" : "sw";
+const handler = {
+  "path": "PSS%sPSE/?QES\u2020QEE#FES\u2020FEE",
+  "query": "?QES\u2020QEEPSS%sPSE#FES\u2020FEE",
+  "fragment": "?QES\u2020QEE#FES\u2020FEEPSS%sPSE"
+}[type];
+const scheme = `web+wpt${type}${swString}`;
+
+function register() {
+  const handlerURL = noSW ? `resources/handler.html${handler}${type}` : `resources/handler/${type}/${handler}`;
+  navigator.registerProtocolHandler(scheme, handlerURL, `WPT ${type} handler${noSW ? ", without service worker" : ""}`);
+}
+
+function runTest({ includeNull = false } = {}) {
+  promise_test(async t => {
+    const bc = new BroadcastChannel(`protocol-handler-${type}${swString}`);
+    if (!noSW) {
+      const reg = await service_worker_unregister_and_register(t, "resources/handler-sw.js", "resources/handler/");
+      t.add_cleanup(async () => await reg.unregister());
+      await wait_for_state(t, reg.installing, 'activated');
+    }
+    const a = document.body.appendChild(document.createElement("a"));
+    const codePoints = [];
+    let i = includeNull ? 0 : 1;
+    for (; i < 0x82; i++) {
+      codePoints.push(String.fromCharCode(i));
+    }
+    a.href = `${scheme}:${codePoints.join("")}`;
+    a.target = "_blank";
+    a.click();
+    await new Promise(resolve => {
+      bc.onmessage = t.step_func(e => {
+        resultingURL = e.data;
+        assert_equals(stringBetweenMarkers(resultingURL, "QES", "QEE"), "%86", "query baseline");
+        assert_equals(stringBetweenMarkers(resultingURL, "FES", "FEE"), "%E2%80%A0", "fragment baseline");
+        assert_equals(stringBetweenMarkers(resultingURL, "PSS", "PSE"), `${encodeURIComponent(scheme)}%3A${includeNull ? "%2500" : ""}%2501%2502%2503%2504%2505%2506%2507%2508%250B%250C%250E%250F%2510%2511%2512%2513%2514%2515%2516%2517%2518%2519%251A%251B%251C%251D%251E%251F%20!%22%23%24%25%26${type === "query" ? "%27" : "'"}()*%2B%2C-.%2F0123456789%3A%3B%3C%3D%3E%3F%40ABCDEFGHIJKLMNOPQRSTUVWXYZ%5B%5C%5D%5E_%60abcdefghijklmnopqrstuvwxyz%7B%7C%7D~%257F%25C2%2580%25C2%2581`, "actual test");
+        resolve();
+      });
+    });
+  });
+}
+
+function stringBetweenMarkers(string, start, end) {
+  return string.substring(string.indexOf(start) + start.length, string.indexOf(end));
+}
diff --git a/third_party/blink/web_tests/external/wpt/html/webappapis/system-state-and-capabilities/the-navigator-object/resources/handler.html b/third_party/blink/web_tests/external/wpt/html/webappapis/system-state-and-capabilities/the-navigator-object/resources/handler.html
new file mode 100644
index 0000000..552e5417
--- /dev/null
+++ b/third_party/blink/web_tests/external/wpt/html/webappapis/system-state-and-capabilities/the-navigator-object/resources/handler.html
@@ -0,0 +1,23 @@
+<!doctype html>
+<p>This popup can be closed if it does not close itself.
+<p>
+<script>
+// This resource either gets navigated to through a service worker as a result of a URL that looks
+// like:
+// https://.../html/webappapis/system-state-and-capabilities/the-navigator-object/resources/handler/{type}/...
+// (the host is excluded to not upset the lint tool)
+// or it gets navigated to directly with the type appended to the end of the URL. In that case type
+// can only be fragment or query.
+
+let type = null;
+let swString = null;
+if (new URL(document.URL).pathname.endsWith("handler.html")) {
+  swString = "";
+  type = (document.URL.endsWith("fragment")) ? "fragment" : "query";
+} else {
+  type = document.URL.split("/")[9];
+  swString = "sw";
+}
+new BroadcastChannel(`protocol-handler-${type}${swString}`).postMessage(document.URL);
+window.close();
+</script>
diff --git a/third_party/blink/web_tests/external/wpt/input-events/input-events-get-target-ranges-backspace.tentative.html b/third_party/blink/web_tests/external/wpt/input-events/input-events-get-target-ranges-backspace.tentative.html
new file mode 100644
index 0000000..cf51226
--- /dev/null
+++ b/third_party/blink/web_tests/external/wpt/input-events/input-events-get-target-ranges-backspace.tentative.html
@@ -0,0 +1,811 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>InputEvent.getTargetRanges() at Backspace</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/resources/testdriver.js"></script>
+<script src="/resources/testdriver-vendor.js"></script>
+<script src="/resources/testdriver-actions.js"></script>
+<div contenteditable></div>
+<script>
+const kBackspaceKey = "\uE003";
+const kShift =        "\uE008";
+const kMeta =         "\uE03d";
+const kControl =      "\uE009";
+const kAlt =          "\uE00A";
+
+let selection = getSelection();
+let editor = document.querySelector("div[contenteditable]");
+let beforeinput = [];
+let input = [];
+editor.addEventListener("beforeinput", (e) => {
+  // NOTE: Blink makes `getTargetRanges()` return empty range after propagaion,
+  //       but this test wants to check the result during propagation.
+  //       Therefore, we need to cache the result, but will assert if
+  //       `getTargetRanges()` returns different ranges after checking the
+  //       cached ranges.
+  e.cachedRanges = e.getTargetRanges();
+  beforeinput.push(e);
+});
+editor.addEventListener("input", (e) => {
+  e.cachedRanges = e.getTargetRanges();
+  input.push(e);
+});
+
+function reset() {
+  editor.focus();
+  beforeinput = [];
+  input = [];
+}
+
+function getRangeDescription(range) {
+  function getNodeDescription(node) {
+    if (!node) {
+      return "null";
+    }
+    switch (node.nodeType) {
+      case Node.TEXT_NODE:
+      case Node.COMMENT_NODE:
+      case Node.CDATA_SECTION_NODE:
+        return `${node.nodeName} "${node.data}"`;
+      case Node.ELEMENT_NODE:
+        return `<${node.nodeName.toLowerCase()}>`;
+      default:
+        return `${node.nodeName}`;
+    }
+  }
+  if (range === null) {
+    return "null";
+  }
+  if (range === undefined) {
+    return "undefined";
+  }
+  return range.startContainer == range.endContainer && range.startOffset == range.endOffset
+      ? `(${getNodeDescription(range.startContainer)}, ${range.startOffset})`
+      : `(${getNodeDescription(range.startContainer)}, ${range.startOffset}) - (${getNodeDescription(range.endContainer)}, ${range.endOffset})`;
+}
+
+function getArrayOfRangesDescription(arrayOfRanges) {
+  if (arrayOfRanges === null) {
+    return "null";
+  }
+  if (arrayOfRanges === undefined) {
+    return "undefined";
+  }
+  if (!Array.isArray(arrayOfRanges)) {
+    return "Unknown Object";
+  }
+  if (arrayOfRanges.length === 0) {
+    return "[]";
+  }
+  let result = "[";
+  for (let range of arrayOfRanges) {
+    result += `{${getRangeDescription(range)}},`;
+  }
+  result += "]";
+  return result;
+}
+
+function sendBackspaceKey(modifier) {
+  if (!modifier) {
+    return new test_driver.Actions()
+        .keyDown(kBackspaceKey)
+        .keyUp(kBackspaceKey)
+        .send();
+  }
+  return new test_driver.Actions()
+      .keyDown(modifier)
+      .keyDown(kBackspaceKey)
+      .keyUp(kBackspaceKey)
+      .keyUp(modifier)
+      .send();
+}
+
+function checkGetTargetRangesKeepReturningSameValue(event) {
+  // https://github.com/w3c/input-events/issues/114
+  assert_equals(getArrayOfRangesDescription(event.getTargetRanges()),
+      getArrayOfRangesDescription(event.cachedRanges),
+      `${event.type}.getTargetRanges() should keep returning the same array of ranges even after its propagation finished`);
+}
+
+function checkGetTargetRangesOfBeforeinputOnDeleteSomething(expectedRange) {
+  assert_equals(beforeinput.length, 1,
+      "One beforeinput event should be fired if the key operation deletes something");
+  assert_true(Array.isArray(beforeinput[0].cachedRanges),
+      "beforeinput[0].getTargetRanges() should return an array of StaticRange instances during propagation");
+  // Before checking the length of array of ranges, we should check first range
+  // first because the first range data is more important than whether there
+  // are additional unexpected ranges.
+  if (beforeinput[0].cachedRanges.length > 0) {
+    assert_equals(
+        getRangeDescription(beforeinput[0].cachedRanges[0]),
+        getRangeDescription(expectedRange),
+        `beforeinput.getTargetRanges() should return expected range (inputType is "${beforeinput[0].inputType}")`);
+    assert_equals(beforeinput[0].cachedRanges.length, 1,
+        "beforeinput.getTargetRanges() should return one range within an array");
+  }
+  assert_equals(beforeinput[0].cachedRanges, 1,
+      "One range should be returned from getTargetRanges() when the key operation deletes something");
+  checkGetTargetRangesKeepReturningSameValue(beforeinput[0]);
+}
+
+function checkGetTargetRangesOfInputOnDeleteSomething() {
+  assert_equals(input.length, 1,
+      "One input event should be fired if the key operation deletes something");
+  // https://github.com/w3c/input-events/issues/113
+  assert_true(Array.isArray(input[0].cachedRanges),
+      "input[0].getTargetRanges() should return an array of StaticRange instances during propagation");
+  assert_equals(input[0].cachedRanges.length, 0,
+      "input[0].getTargetRanges() should return empty array during propagation");
+  checkGetTargetRangesKeepReturningSameValue(input[0]);
+}
+
+function checkBeforeinputAndInputEventsOnNOOP() {
+  assert_equals(beforeinput.length, 0,
+      "beforeinput event shouldn't be fired when the key operation does not cause modifying the DOM tree");
+  assert_equals(input.length, 0,
+      "input event shouldn't be fired when the key operation does not cause modifying the DOM tree");
+}
+
+// Simply deletes the previous ASCII character of caret position.
+promise_test(async () => {
+  reset();
+  editor.innerHTML = "<p>abc</p>";
+  selection.collapse(editor.firstChild.firstChild, 1);
+  await sendBackspaceKey();
+  assert_equals(editor.innerHTML, "<p>bc</p>");
+  checkGetTargetRangesOfBeforeinputOnDeleteSomething({
+    startContainer: editor.firstChild.firstChild,
+    startOffset: 0,
+    endContainer: editor.firstChild.firstChild,
+    endOffset: 1,
+  });
+  checkGetTargetRangesOfInput();
+}, 'Backspace at "<p>a[]bc</p>"');
+
+// Simply deletes the previous ASCII character of caret position.
+promise_test(async () => {
+  reset();
+  editor.innerHTML = "<p>abc</p>";
+  selection.collapse(editor.firstChild.firstChild, 2);
+  await sendBackspaceKey();
+  assert_equals(editor.innerHTML, "<p>ac</p>");
+  checkGetTargetRangesOfBeforeinputOnDeleteSomething({
+    startContainer: editor.firstChild.firstChild,
+    startOffset: 1,
+    endContainer: editor.firstChild.firstChild,
+    endOffset: 2,
+  });
+  checkGetTargetRangesOfInput();
+}, 'Backspace at "<p>ab[]c</p>"');
+
+// Simply deletes the previous ASCII character of caret position.
+promise_test(async () => {
+  reset();
+  editor.innerHTML = "<p>abc</p>";
+  selection.collapse(editor.firstChild.firstChild, 3);
+  await sendBackspaceKey();
+  assert_equals(editor.innerHTML, "<p>ab</p>");
+  checkGetTargetRangesOfBeforeinputOnDeleteSomething({
+    startContainer: editor.firstChild.firstChild,
+    startOffset: 2,
+    endContainer: editor.firstChild.firstChild,
+    endOffset: 3,
+  });
+  checkGetTargetRangesOfInput();
+}, 'Backspace at "<p>abc[]</p>"');
+
+// Should delete the `<span>` element becase it becomes empty.
+// However, we need discussion whether the `<span>` element should be
+// contained by a range of `getTargetRanges()`.
+// https://github.com/w3c/input-events/issues/112
+promise_test(async () => {
+  reset();
+  editor.innerHTML = "<p>a<span>b</span>c</p>";
+  let c = editor.querySelector("span").nextSibling;
+  selection.collapse(c, 0);
+  await sendBackspaceKey();
+  assert_equals(editor.innerHTML, "<p>ac</p>");
+  checkGetTargetRangesOfBeforeinputOnDeleteSomething({
+    startContainer: editor.firstChild,
+    startOffset: 1,
+    endContainer: c,
+    endOffset: 0,
+  });
+  checkGetTargetRangesOfInput();
+}, 'Backspace at "<p>a<span>b</span>[]c</p>"');
+
+// Should delete the `<span>` element becase it becomes empty.
+// However, we need discussion whether the `<span>` element should be
+// contained by a range of `getTargetRanges()`.
+// https://github.com/w3c/input-events/issues/112
+promise_test(async () => {
+  reset();
+  editor.innerHTML = "<p>a<span>b</span>c</p>";
+  let b = editor.querySelector("span").firstChild;
+  selection.collapse(b, 1);
+  await sendBackspaceKey();
+  assert_equals(editor.innerHTML, "<p>ac</p>");
+  checkGetTargetRangesOfBeforeinputOnDeleteSomething({
+    startContainer: editor.firstChild,
+    startOffset: 1,
+    endContainer: editor.firstChild,
+    endOffset: 2,
+  });
+  checkGetTargetRangesOfInput();
+}, 'Backspace at "<p>a<span>b[]</span>c</p>"');
+
+// Invisible leading white-space may be deleted when the first visible
+// character is deleted.  If it's deleted, it should be contained by
+// the range of `getTargetRanges()`, but needs discussion.
+// https://github.com/w3c/input-events/issues/112
+promise_test(async () => {
+  reset();
+  editor.innerHTML = "<p> abc</p>";
+  selection.collapse(editor.firstChild.firstChild, 2);
+  await sendBackspaceKey();
+  assert_in_array(editor.innerHTML, ["<p>bc</p>", "<p> bc</p>"]);
+  checkGetTargetRangesOfBeforeinputOnDeleteSomething({
+    startContainer: editor.firstChild.firstChild,
+    startOffset: editor.firstChild.firstChild.length == 2 ? 0 : 1,
+    endContainer: editor.firstChild.firstChild,
+    endOffset: 2,
+  });
+  checkGetTargetRangesOfInput();
+}, 'Backspace at "<p> a[]bc</p>"');
+
+// Invisible leading white-spaces in current block and invisible trailing
+// white-spaces in the previous block should be deleted for avoiding they
+// becoming visible when the blocks are joined.  Perhaps, they should be
+// contained by the range of `getTargetRanges()`, but needs discussion.
+// https://github.com/w3c/input-events/issues/112
+promise_test(async () => {
+  reset();
+  editor.innerHTML = "<p>abc   </p><p>   def</p>";
+  let p1 = editor.firstChild;
+  let abc = p1.firstChild;
+  let p2 = p1.nextSibling;
+  let def = p2.firstChild;
+  selection.collapse(def, 3);
+  await sendBackspaceKey();
+  assert_equals(editor.innerHTML, "<p>abcdef</p>");
+  checkGetTargetRangesOfBeforeinputOnDeleteSomething({
+    startContainer: abc,
+    startOffset: 3,
+    endContainer: def,
+    endOffset: 3,
+  });
+  checkGetTargetRangesOfInput();
+}, 'Backspace at "<p>abc   </p><p>   []def</p>"');
+
+// Invisible leading white-spaces in current block and invisible trailing
+// white-spaces in the previous block should be deleted for avoiding they
+// becoming visible when the blocks are joined.  Perhaps, they should be
+// contained by the range of `getTargetRanges()`, but needs discussion.
+// https://github.com/w3c/input-events/issues/112
+promise_test(async () => {
+  reset();
+  editor.innerHTML = "<p>abc   </p><p>   def</p>";
+  let p1 = editor.firstChild;
+  let abc = p1.firstChild;
+  let p2 = p1.nextSibling;
+  let def = p2.firstChild;
+  selection.collapse(def, 2);
+  await sendBackspaceKey();
+  assert_equals(editor.innerHTML, "<p>abcdef</p>");
+  checkGetTargetRangesOfBeforeinputOnDeleteSomething({
+    startContainer: abc,
+    startOffset: 3,
+    endContainer: def,
+    endOffset: 3,
+  });
+  checkGetTargetRangesOfInput();
+}, 'Backspace at "<p>abc   </p><p>  [] def</p>"');
+
+// Invisible leading white-spaces in current block and invisible trailing
+// white-spaces in the previous block should be deleted for avoiding they
+// becoming visible when the blocks are joined.  Perhaps, they should be
+// contained by the range of `getTargetRanges()`, but needs discussion.
+// https://github.com/w3c/input-events/issues/112
+promise_test(async () => {
+  reset();
+  editor.innerHTML = "<p>abc   </p><p>   def</p>";
+  let p1 = editor.firstChild;
+  let abc = p1.firstChild;
+  let p2 = p1.nextSibling;
+  let def = p2.firstChild;
+  selection.collapse(def, 1);
+  await sendBackspaceKey();
+  assert_equals(editor.innerHTML, "<p>abcdef</p>");
+  checkGetTargetRangesOfBeforeinputOnDeleteSomething({
+    startContainer: abc,
+    startOffset: 3,
+    endContainer: def,
+    endOffset: 3,
+  });
+  checkGetTargetRangesOfInput();
+}, 'Backspace at "<p>abc   </p><p> []  def</p>"');
+
+// Invisible leading white-spaces in current block and invisible trailing
+// white-spaces in the previous block should be deleted for avoiding they
+// becoming visible when the blocks are joined.  Perhaps, they should be
+// contained by the range of `getTargetRanges()`, but needs discussion.
+// https://github.com/w3c/input-events/issues/112
+promise_test(async () => {
+  reset();
+  editor.innerHTML = "<p>abc   </p><p>   def</p>";
+  let p1 = editor.firstChild;
+  let abc = p1.firstChild;
+  let p2 = p1.nextSibling;
+  let def = p2.firstChild;
+  selection.collapse(def, 0);
+  await sendBackspaceKey();
+  assert_equals(editor.innerHTML, "<p>abcdef</p>");
+  checkGetTargetRangesOfBeforeinputOnDeleteSomething({
+    startContainer: abc,
+    startOffset: 3,
+    endContainer: def,
+    endOffset: 3,
+  });
+  checkGetTargetRangesOfInput();
+}, 'Backspace at "<p>abc   </p><p>[]   def</p>"');
+
+// Invisible leading white-spaces in current block and invisible trailing
+// white-spaces in the previous block should be deleted for avoiding they
+// becoming visible when the blocks are joined.  Perhaps, they should be
+// contained by the range of `getTargetRanges()`, but needs discussion.
+// https://github.com/w3c/input-events/issues/112
+promise_test(async () => {
+  reset();
+  editor.innerHTML = "<p>abc   </p><p>   def</p>";
+  let p1 = editor.firstChild;
+  let abc = p1.firstChild;
+  let p2 = p1.nextSibling;
+  let def = p2.firstChild;
+  selection.setBaseAndExtent(abc, 6, def, 0);
+  await sendBackspaceKey();
+  assert_equals(editor.innerHTML, "<p>abcdef</p>");
+  checkGetTargetRangesOfBeforeinputOnDeleteSomething({
+    startContainer: abc,
+    startOffset: 3,
+    endContainer: def,
+    endOffset: 3,
+  });
+  checkGetTargetRangesOfInput();
+}, 'Backspace at "<p>abc   [</p><p>]   def</p>"');
+
+// Invisible leading white-spaces in the current block should be deleted
+// for avoiding they becoming visible when the blocks are joined, but
+// preformatted trailing white-spaces in the first block shouldn't be
+// deleted.  Perhaps, the invisible white-spaces should be contained by
+// the range of `getTargetRanges()`, but needs discussion.
+// https://github.com/w3c/input-events/issues/112
+promise_test(async () => {
+  reset();
+  editor.innerHTML = "<pre>abc   </pre><p>   def</p>";
+  let pre = editor.firstChild;
+  let abc = pre.firstChild;
+  let p = pre.nextSibling;
+  let def = p.firstChild;
+  selection.collapse(def, 3);
+  await sendBackspaceKey();
+  // https://github.com/w3c/input-events/issues/112
+  // Shouldn't make the invisible white-spaces visible.
+  assert_equals(editor.innerHTML, "<pre>abc   def</pre>");
+  checkGetTargetRangesOfBeforeinputOnDeleteSomething({
+    startContainer: abc,
+    startOffset: 6,
+    endContainer: def,
+    endOffset: 3,
+  });
+  checkGetTargetRangesOfInput();
+}, 'Backspace at "<pre>abc   </pre><p>   []def</p>"');
+
+// Invisible leading/trailing white-spaces in the current block should be
+// deleted for avoiding they becoming visible when the blocks are joined, but
+// preformatted trailing white-spaces in the first block shouldn't be
+// deleted.  Perhaps, the invisible leading white-spaces should be contained
+// by the range of `getTargetRanges()`, but needs discussion.
+// And also not sure whether the trailing white-spaces should be contained
+// by additional range of `getTargetRanges()` or not because of the
+// implementation cost and runtime cost.  Needs discuss.
+// https://github.com/w3c/input-events/issues/112
+promise_test(async () => {
+  reset();
+  editor.innerHTML = "<pre>abc   </pre><p>   def   </p>";
+  let pre = editor.firstChild;
+  let abc = pre.firstChild;
+  let p = pre.nextSibling;
+  let def = p.firstChild;
+  selection.collapse(def, 3);
+  await sendBackspaceKey();
+  assert_equals(editor.innerHTML, "<pre>abc   def   </pre>");
+  checkGetTargetRangesOfBeforeinputOnDeleteSomething({
+    startContainer: abc,
+    startOffset: 6,
+    endContainer: def,
+    endOffset: 3,
+  });
+  checkGetTargetRangesOfInput();
+}, 'Backspace at "<pre>abc   </pre><p>   []def   </p>"');
+
+// Invisible trailing white-spaces in the first block should be deleted
+// when the block is joined with the preformated following block, but
+// the leading white-spaces in the preformatted block shouldn't be
+// removed.  So, in this case, the invisible trailing white-spaces should
+// be in the range of `getTargetRanges()`, but not so for the preformatted
+// visible leading white-spaces.  But needs discussion.
+// https://github.com/w3c/input-events/issues/112
+promise_test(async () => {
+  reset();
+  editor.innerHTML = "<p>abc   </p><pre>   def</pre>";
+  let p = editor.firstChild;
+  let abc = p.firstChild;
+  let pre = p.nextSibling;
+  let def = pre.firstChild;
+  selection.collapse(def, 0);
+  await sendBackspaceKey();
+  assert_in_array(editor.innerHTML, ["<p>abc &nbsp; def</p>",
+                                     "<p>abc&nbsp;&nbsp; def</p>",
+                                     "<p>abc&nbsp; &nbsp;def</p>",
+                                     "<p>abc &nbsp;&nbsp;def</p>"]);
+  checkGetTargetRangesOfBeforeinputOnDeleteSomething({
+    startContainer: abc,
+    startOffset: 6,
+    endContainer: def,
+    endOffset: 0,
+  });
+  checkGetTargetRangesOfInput();
+}, 'Backspace at "<p>abc   </p><pre>[]   def</pre>"');
+
+// If the first block has invisible `<br>` element and joining it with
+// the following block, the invisible trailing `<br>` element should be
+// deleted and join the blocks.  Therefore, the target range should contain
+// the `<br>` element and block boundaries. But maybe needs discussion.
+// https://github.com/w3c/input-events/issues/112
+promise_test(async () => {
+  reset();
+  editor.innerHTML = "<p>abc<br></p><p>def</p>";
+  let p1 = editor.firstChild;
+  let abc = p1.firstChild;
+  let p2 = p1.nextSibling;
+  let def = p2.firstChild;
+  selection.collapse(def, 0);
+  await sendBackspaceKey();
+  assert_equals(editor.innerHTML, "<p>abcdef</p>");
+  checkGetTargetRangesOfBeforeinputOnDeleteSomething({
+    startContainer: p1,
+    startOffset: 1,
+    endContainer: def,
+    endOffset: 0,
+  });
+  checkGetTargetRangesOfInput();
+}, 'Backspace at "<p>abc<br></p><p>[]def</p>"');
+
+// If the first block has invisible `<br>` element for empty last line and
+// joining it with the following block, the invisible trailing `<br>` element
+// should be deleted and join the blocks.  Therefore, the target range should
+// contain the `<br>` element and block boundaries. But maybe needs discussion.
+// https://github.com/w3c/input-events/issues/112
+promise_test(async () => {
+  reset();
+  editor.innerHTML = "<p>abc<br><br></p><p>def</p>";
+  let p1 = editor.firstChild;
+  let abc = p1.firstChild;
+  let p2 = p1.nextSibling;
+  let def = p2.firstChild;
+  selection.collapse(def, 0);
+  await sendBackspaceKey();
+  assert_equals(editor.innerHTML, "<p>abc<br>def</p>");
+  checkGetTargetRangesOfBeforeinputOnDeleteSomething({
+    startContainer: p1,
+    startOffset: 2,
+    endContainer: def,
+    endOffset: 0,
+  });
+  checkGetTargetRangesOfInput();
+}, 'Backspace at "<p>abc<br><br></p><p>[]def</p>"');
+
+// Deleting visible `<br>` element should be contained by a range of
+// `getTargetRanges()`.
+promise_test(async () => {
+  reset();
+  editor.innerHTML = "<p>abc<br>def</p>";
+  let def = editor.querySelector("br").nextSibling;
+  selection.collapse(def, 0);
+  await sendBackspaceKey();
+  assert_equals(editor.innerHTML, "<p>abcdef</p>");
+  checkGetTargetRangesOfBeforeinputOnDeleteSomething({
+    startContainer: editor.firstChild,
+    startOffset: 1,
+    endContainer: def,
+    endOffset: 0,
+  });
+  checkGetTargetRangesOfInput();
+}, 'Backspace at "<p>abc<br>[]def</p>"');
+
+// Deleting visible `<br>` element should be contained by a range of
+// `getTargetRanges()`.  However, when only the `<br>` element is selected,
+// the range shouldn't start from nor end by surrounding text nodes?
+// https://github.com/w3c/input-events/issues/112
+promise_test(async () => {
+  reset();
+  editor.innerHTML = "<p>abc<br>def</p>";
+  selection.setBaseAndExtent(editor.firstChild, 1, editor.firstChild, 2);
+  await sendBackspaceKey();
+  assert_equals(editor.innerHTML, "<p>abcdef</p>");
+  checkGetTargetRangesOfBeforeinputOnDeleteSomething({
+    startContainer: editor.firstChild,
+    startOffset: 1,
+    endContainer: editor.firstChild,
+    endOffset: 2,
+  });
+  checkGetTargetRangesOfInput();
+}, 'Backspace at "<p>abc{<br>}def</p>"');
+
+// Joining parent block and child block should remove invisible preceding
+// white-spaces of the child block and invisible leading white-spaces in
+// the child block, and they should be contained in a range of
+// `getTargetRanges()`, but maybe needs discussion.
+// https://github.com/w3c/input-events/issues/112
+promise_test(async () => {
+  reset();
+  editor.innerHTML = "<div>abc   <p>   def<br>ghi</p></div>";
+  let p = editor.querySelector("p");
+  let def = p.firstChild;
+  let abc = editor.firstChild.firstChild;
+  selection.collapse(def, 3);
+  await sendBackspaceKey();
+  assert_equals(editor.innerHTML, "<div>abcdef<p>ghi</p></div>");
+  checkGetTargetRangesOfBeforeinputOnDeleteSomething({
+    startContainer: abc,
+    startOffset: 3,
+    endContainer: def,
+    endOffset: 3,
+  });
+  checkGetTargetRangesOfInput();
+}, 'Backspace at "<div>abc   <p>   []def<br>ghi</p></div>"');
+
+// Joining child block and parent block should remove invisible trailing
+// white-spaces of the child block and invisible following white-spaces
+// in the parent block, and they should be contained by a range of
+// `getTaregetRanges()`, but maybe needs discussion.
+// https://github.com/w3c/input-events/issues/112
+promise_test(async () => {
+  reset();
+  editor.innerHTML = "<div><p>abc   </p>   def</div>";
+  let abc = editor.querySelector("p").firstChild;
+  let def = editor.querySelector("p").nextSibling;
+  selection.collapse(def, 3);
+  await sendBackspaceKey();
+  assert_equals(editor.innerHTML, "<div><p>abcdef</p></div>");
+  checkGetTargetRangesOfBeforeinputOnDeleteSomething({
+    startContainer: abc,
+    startOffset: 3,
+    endContainer: def,
+    endOffset: 3,
+  });
+  checkGetTargetRangesOfInput();
+}, 'Backspace at "<div><p>abc   </p>   []def</div>"');
+
+// The following tests check whether the range returned from
+// `beforeinput[0].getTargetRanges()` is modified or different range is
+// modified instead.  I.e., they don't test which type of deletion should
+// occur.  Therefore, their result depends on browser's key bindings,
+// system settings and running OS.
+
+function getFirstDifferentOffset(currentString, originalString) {
+  for (let i = 0; i < currentString.length; i++) {
+    if (currentString.charAt(i) !== originalString.charAt(i) &&
+        (originalString.charAt(i) !== " " || !currentString.charAt("\u00A0"))) {
+      return i;
+    }
+  }
+  return currentString.length;
+}
+
+promise_test(async () => {
+  reset();
+  const kText = "abc def ghi";
+  editor.innerHTML = `<p>${kText}</p>`;
+  let p = editor.querySelector("p");
+  selection.collapse(p.firstChild, "abc def".length);
+  await sendBackspaceKey(kShift);
+  let startOffset = getFirstDifferentOffset(p.firstChild.data, kText);
+  let length = kText.length - p.firstChild.data.length;
+  assert_equals(editor.innerHTML.replace(/&nbsp;/g, " "),
+      `<p>${kText.substr(0, startOffset) + kText.substr(startOffset + length)}</p>`);
+  if (startOffset === kText.length) {
+    checkBeforeinputAndInputEventsOnNOOP();
+    return;
+  }
+  checkGetTargetRangesOfBeforeinputOnDeleteSomething({
+    startContainer: p.firstChild,
+    startOffset: startOffset,
+    endContainer: p.firstChild,
+    endOffset: startOffset + length,
+  });
+  checkGetTargetRangesOfInput();
+}, 'Shift + Backspace at "<p>abc def[] ghi</p>"');
+
+promise_test(async () => {
+  reset();
+  const kText = "abc def ghi";
+  editor.innerHTML = `<p>${kText}</p>`;
+  let p = editor.querySelector("p");
+  selection.collapse(p.firstChild, "abc def".length);
+  await sendBackspaceKey(kControl);
+  let startOffset = getFirstDifferentOffset(p.firstChild.data, kText);
+  let length = kText.length - p.firstChild.data.length;
+  assert_equals(editor.innerHTML.replace(/&nbsp;/g, " "),
+      `<p>${kText.substr(0, startOffset) + kText.substr(startOffset + length)}</p>`);
+  if (startOffset === kText.length) {
+    checkBeforeinputAndInputEventsOnNOOP();
+    return;
+  }
+  checkGetTargetRangesOfBeforeinputOnDeleteSomething({
+    startContainer: p.firstChild,
+    startOffset: startOffset,
+    endContainer: p.firstChild,
+    endOffset: startOffset + length,
+  });
+  checkGetTargetRangesOfInput();
+}, 'Control + Backspace at "<p>abc def[] ghi</p>"');
+
+promise_test(async () => {
+  reset();
+  const kText = "abc def ghi";
+  editor.innerHTML = `<p>${kText}</p>`;
+  let p = editor.querySelector("p");
+  selection.collapse(p.firstChild, "abc def".length);
+  await sendBackspaceKey(kAlt);
+  let startOffset = getFirstDifferentOffset(p.firstChild.data, kText);
+  let length = kText.length - p.firstChild.data.length;
+  assert_equals(editor.innerHTML.replace(/&nbsp;/g, " "),
+      `<p>${kText.substr(0, startOffset) + kText.substr(startOffset + length)}</p>`);
+  if (startOffset === kText.length) {
+    checkBeforeinputAndInputEventsOnNOOP();
+    return;
+  }
+  checkGetTargetRangesOfBeforeinputOnDeleteSomething({
+    startContainer: p.firstChild,
+    startOffset: startOffset,
+    endContainer: p.firstChild,
+    endOffset: startOffset + length,
+  });
+  checkGetTargetRangesOfInput();
+}, 'Alt + Backspace at "<p>abc def[] ghi</p>"');
+
+promise_test(async () => {
+  reset();
+  const kText = "abc def ghi";
+  editor.innerHTML = `<p>${kText}</p>`;
+  let p = editor.querySelector("p");
+  selection.collapse(p.firstChild, "abc def".length);
+  await sendBackspaceKey(kMeta);
+  let startOffset = getFirstDifferentOffset(p.firstChild.data, kText);
+  let length = kText.length - p.firstChild.data.length;
+  assert_equals(editor.innerHTML.replace(/&nbsp;/g, " "),
+      `<p>${kText.substr(0, startOffset) + kText.substr(startOffset + length)}</p>`);
+  if (startOffset === kText.length) {
+    checkBeforeinputAndInputEventsOnNOOP();
+    return;
+  }
+  checkGetTargetRangesOfBeforeinputOnDeleteSomething({
+    startContainer: p.firstChild,
+    startOffset: startOffset,
+    endContainer: p.firstChild,
+    endOffset: startOffset + length,
+  });
+  checkGetTargetRangesOfInput();
+}, 'Meta + Backspace at "<p>abc def[] ghi</p>"');
+
+promise_test(async () => {
+  reset();
+  const kText = "abc def";
+  editor.innerHTML = `<p>   ${kText}</p>`;
+  let p = editor.querySelector("p");
+  selection.collapse(p.firstChild, "abc".length);
+  await sendBackspaceKey(kShift);
+  let visibleText = p.firstChild.data.replace(/^\s+/, "");
+  let invisibleWhiteSpaces = " ".repeat(p.firstChild.data.length - visibleText.length);
+  let startOffset = invisibleWhiteSpaces.length + getFirstDifferentOffset(visibleText, kText);
+  let length = kText.length + 3 - p.firstChild.data.length;
+  // If invisible white-spaces are deleted, they should be contained in the target range.
+  assert_equals(editor.innerHTML.replace(/&nbsp;/g, " "),
+      `<p>${invisibleWhiteSpaces + kText.substr(0, startOffset) + kText.substr(startOffset + length)}</p>`);
+  if (startOffset === kText.length) {
+    checkBeforeinputAndInputEventsOnNOOP();
+    return;
+  }
+  checkGetTargetRangesOfBeforeinputOnDeleteSomething({
+    startContainer: p.firstChild,
+    startOffset: startOffset,
+    endContainer: p.firstChild,
+    endOffset: startOffset + length,
+  });
+  checkGetTargetRangesOfInput();
+}, 'Shift + Backspace at "<p>   abc[] def</p>"');
+
+promise_test(async () => {
+  reset();
+  const kText = "abc def";
+  editor.innerHTML = `<p>   ${kText}</p>`;
+  let p = editor.querySelector("p");
+  selection.collapse(p.firstChild, "abc".length);
+  await sendBackspaceKey(kControl);
+  let visibleText = p.firstChild.data.replace(/^\s+/, "");
+  let invisibleWhiteSpaces = " ".repeat(p.firstChild.data.length - visibleText.length);
+  let startOffset = invisibleWhiteSpaces.length + getFirstDifferentOffset(visibleText, kText);
+  let length = kText.length + 3 - p.firstChild.data.length;
+  // If invisible white-spaces are deleted, they should be contained in the target range.
+  assert_equals(editor.innerHTML.replace(/&nbsp;/g, " "),
+      `<p>${invisibleWhiteSpaces + kText.substr(0, startOffset) + kText.substr(startOffset + length)}</p>`);
+  if (startOffset === kText.length) {
+    checkBeforeinputAndInputEventsOnNOOP();
+    return;
+  }
+  checkGetTargetRangesOfBeforeinputOnDeleteSomething({
+    startContainer: p.firstChild,
+    startOffset: startOffset,
+    endContainer: p.firstChild,
+    endOffset: startOffset + length,
+  });
+  checkGetTargetRangesOfInput();
+}, 'Control + Backspace at "<p>   abc[] def</p>"');
+
+promise_test(async () => {
+  reset();
+  const kText = "abc def";
+  editor.innerHTML = `<p>   ${kText}</p>`;
+  let p = editor.querySelector("p");
+  selection.collapse(p.firstChild, "abc".length);
+  await sendBackspaceKey(kAlt);
+  let visibleText = p.firstChild.data.replace(/^\s+/, "");
+  let invisibleWhiteSpaces = " ".repeat(p.firstChild.data.length - visibleText.length);
+  let startOffset = invisibleWhiteSpaces.length + getFirstDifferentOffset(visibleText, kText);
+  let length = kText.length + 3 - p.firstChild.data.length;
+  // If invisible white-spaces are deleted, they should be contained in the target range.
+  assert_equals(editor.innerHTML.replace(/&nbsp;/g, " "),
+      `<p>${invisibleWhiteSpaces + kText.substr(0, startOffset) + kText.substr(startOffset + length)}</p>`);
+  if (startOffset === kText.length) {
+    checkBeforeinputAndInputEventsOnNOOP();
+    return;
+  }
+  checkGetTargetRangesOfBeforeinputOnDeleteSomething({
+    startContainer: p.firstChild,
+    startOffset: startOffset,
+    endContainer: p.firstChild,
+    endOffset: startOffset + length,
+  });
+  checkGetTargetRangesOfInput();
+}, 'Alt + Backspace at "<p>   abc[] def</p>"');
+
+promise_test(async () => {
+  reset();
+  const kText = "abc def";
+  editor.innerHTML = `<p>   ${kText}</p>`;
+  let p = editor.querySelector("p");
+  selection.collapse(p.firstChild, "abc".length);
+  await sendBackspaceKey(kMeta);
+  let visibleText = p.firstChild.data.replace(/^\s+/, "");
+  let invisibleWhiteSpaces = " ".repeat(p.firstChild.data.length - visibleText.length);
+  let startOffset = invisibleWhiteSpaces.length + getFirstDifferentOffset(visibleText, kText);
+  let length = kText.length + 3 - p.firstChild.data.length;
+  // If invisible white-spaces are deleted, they should be contained in the target range.
+  assert_equals(editor.innerHTML.replace(/&nbsp;/g, " "),
+      `<p>${invisibleWhiteSpaces + kText.substr(0, startOffset) + kText.substr(startOffset + length)}</p>`);
+  if (startOffset === kText.length) {
+    checkBeforeinputAndInputEventsOnNOOP();
+    return;
+  }
+  checkGetTargetRangesOfBeforeinputOnDeleteSomething({
+    startContainer: p.firstChild,
+    startOffset: startOffset,
+    endContainer: p.firstChild,
+    endOffset: startOffset + length,
+  });
+  checkGetTargetRangesOfInput();
+}, 'Meta + Backspace at "<p>   abc[] def</p>"');
+
+</script>
diff --git a/third_party/blink/web_tests/external/wpt/input-events/input-events-get-target-ranges-forwarddelete.tentative.html b/third_party/blink/web_tests/external/wpt/input-events/input-events-get-target-ranges-forwarddelete.tentative.html
new file mode 100644
index 0000000..3780324
--- /dev/null
+++ b/third_party/blink/web_tests/external/wpt/input-events/input-events-get-target-ranges-forwarddelete.tentative.html
@@ -0,0 +1,808 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>InputEvent.getTargetRanges() at Delete (forward delete)</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/resources/testdriver.js"></script>
+<script src="/resources/testdriver-vendor.js"></script>
+<script src="/resources/testdriver-actions.js"></script>
+<div contenteditable></div>
+<script>
+const kDeleteKey = "\uE017";
+const kShift =     "\uE008";
+const kMeta =      "\uE03d";
+const kControl =   "\uE009";
+const kAlt =       "\uE00A";
+
+let selection = getSelection();
+let editor = document.querySelector("div[contenteditable]");
+let beforeinput = [];
+let input = [];
+editor.addEventListener("beforeinput", (e) => {
+  // NOTE: Blink makes `getTargetRanges()` return empty range after propagaion,
+  //       but this test wants to check the result during propagation.
+  //       Therefore, we need to cache the result, but will assert if
+  //       `getTargetRanges()` returns different ranges after checking the
+  //       cached ranges.
+  e.cachedRanges = e.getTargetRanges();
+  beforeinput.push(e);
+});
+editor.addEventListener("input", (e) => {
+  e.cachedRanges = e.getTargetRanges();
+  input.push(e);
+});
+
+function reset() {
+  editor.focus();
+  beforeinput = [];
+  input = [];
+}
+
+function getRangeDescription(range) {
+  function getNodeDescription(node) {
+    if (!node) {
+      return "null";
+    }
+    switch (node.nodeType) {
+      case Node.TEXT_NODE:
+      case Node.COMMENT_NODE:
+      case Node.CDATA_SECTION_NODE:
+        return `${node.nodeName} "${node.data}"`;
+      case Node.ELEMENT_NODE:
+        return `<${node.nodeName.toLowerCase()}>`;
+      default:
+        return `${node.nodeName}`;
+    }
+  }
+  if (range === null) {
+    return "null";
+  }
+  if (range === undefined) {
+    return "undefined";
+  }
+  return range.startContainer == range.endContainer && range.startOffset == range.endOffset
+      ? `(${getNodeDescription(range.startContainer)}, ${range.startOffset})`
+      : `(${getNodeDescription(range.startContainer)}, ${range.startOffset}) - (${getNodeDescription(range.endContainer)}, ${range.endOffset})`;
+}
+
+function getArrayOfRangesDescription(arrayOfRanges) {
+  if (arrayOfRanges === null) {
+    return "null";
+  }
+  if (arrayOfRanges === undefined) {
+    return "undefined";
+  }
+  if (!Array.isArray(arrayOfRanges)) {
+    return "Unknown Object";
+  }
+  if (arrayOfRanges.length === 0) {
+    return "[]";
+  }
+  let result = "[";
+  for (let range of arrayOfRanges) {
+    result += `{${getRangeDescription(range)}},`;
+  }
+  result += "]";
+  return result;
+}
+
+function sendDeleteKey(modifier) {
+  if (!modifier) {
+    return new test_driver.Actions()
+        .keyDown(kDeleteKey)
+        .keyUp(kDeleteKey)
+        .send();
+  }
+  return new test_driver.Actions()
+      .keyDown(modifier)
+      .keyDown(kDeleteKey)
+      .keyUp(kDeleteKey)
+      .keyUp(modifier)
+      .send();
+}
+
+function checkGetTargetRangesKeepReturningSameValue(event) {
+  // https://github.com/w3c/input-events/issues/114
+  assert_equals(getArrayOfRangesDescription(event.getTargetRanges()),
+      getArrayOfRangesDescription(event.cachedRanges),
+      `${event.type}.getTargetRanges() should keep returning the same array of ranges even after its propagation finished`);
+}
+
+function checkGetTargetRangesOfBeforeinputOnDeleteSomething(expectedRange) {
+  assert_equals(beforeinput.length, 1,
+      "One beforeinput event should be fired if the key operation deletes something");
+  assert_true(Array.isArray(beforeinput[0].cachedRanges),
+      "beforeinput[0].getTargetRanges() should return an array of StaticRange instances during propagation");
+  // Before checking the length of array of ranges, we should check the first
+  // range first because the first range data is more important than whether
+  // there are additional unexpected ranges.
+  if (beforeinput[0].cachedRanges.length > 0) {
+    assert_equals(
+        getRangeDescription(beforeinput[0].cachedRanges[0]),
+        getRangeDescription(expectedRange),
+        `beforeinput.getTargetRanges() should return expected range (inputType is "${beforeinput[0].inputType}")`);
+    assert_equals(beforeinput[0].cachedRanges.length, 1,
+        "beforeinput.getTargetRanges() should return one range within an array");
+  }
+  assert_equals(beforeinput[0].cachedRanges, 1,
+      "One range should be returned from getTargetRanges() when the key operation deletes something");
+  checkGetTargetRangesKeepReturningSameValue(beforeinput[0]);
+}
+
+function checkGetTargetRangesOfInputOnDeleteSomething() {
+  assert_equals(input.length, 1,
+      "One input event should be fired if the key operation deletes something");
+  // https://github.com/w3c/input-events/issues/113
+  assert_true(Array.isArray(input[0].cachedRanges),
+      "input[0].getTargetRanges() should return an array of StaticRange instances during propagation");
+  assert_equals(input[0].cachedRanges.length, 0,
+      "input[0].getTargetRanges() should return empty array during propagation");
+  checkGetTargetRangesKeepReturningSameValue(input[0]);
+}
+
+function checkBeforeinputAndInputEventsOnNOOP() {
+  assert_equals(beforeinput.length, 0,
+      "beforeinput event shouldn't be fired when the key operation does not cause modifying the DOM tree");
+  assert_equals(input.length, 0,
+      "input event shouldn't be fired when the key operation does not cause modifying the DOM tree");
+}
+
+// Simply deletes the next ASCII character of caret position.
+promise_test(async () => {
+  reset();
+  editor.innerHTML = "<p>abc</p>";
+  selection.collapse(editor.firstChild.firstChild, 2);
+  await sendDeleteKey();
+  assert_equals(editor.innerHTML, "<p>ab</p>");
+  checkGetTargetRangesOfBeforeinputOnDeleteSomething({
+    startContainer: editor.firstChild.firstChild,
+    startOffset: 2,
+    endContainer: editor.firstChild.firstChild,
+    endOffset: 3,
+  });
+  checkGetTargetRangesOfInputOnDeleteSomething();
+}, 'Delete at "<p>ab[]c</p>"');
+
+// Simply deletes the next ASCII character of caret position.
+promise_test(async () => {
+  reset();
+  editor.innerHTML = "<p>abc</p>";
+  selection.collapse(editor.firstChild.firstChild, 1);
+  await sendDeleteKey();
+  assert_equals(editor.innerHTML, "<p>ac</p>");
+  checkGetTargetRangesOfBeforeinputOnDeleteSomething({
+    startContainer: editor.firstChild.firstChild,
+    startOffset: 1,
+    endContainer: editor.firstChild.firstChild,
+    endOffset: 2,
+  });
+  checkGetTargetRangesOfInputOnDeleteSomething();
+}, 'Delete at "<p>a[]bc</p>"');
+
+// Simply deletes the next ASCII character of caret position.
+promise_test(async () => {
+  reset();
+  editor.innerHTML = "<p>abc</p>";
+  selection.collapse(editor.firstChild.firstChild, 0);
+  await sendDeleteKey();
+  assert_equals(editor.innerHTML, "<p>bc</p>");
+  checkGetTargetRangesOfBeforeinputOnDeleteSomething({
+    startContainer: editor.firstChild.firstChild,
+    startOffset: 0,
+    endContainer: editor.firstChild.firstChild,
+    endOffset: 1,
+  });
+  checkGetTargetRangesOfInputOnDeleteSomething();
+}, 'Delete at "<p>[]abc</p>"');
+
+// Should delete the `<span>` element becase it becomes empty.
+// However, we need discussion whether the `<span>` element should be
+// contained by a range of `getTargetRanges()`.
+// https://github.com/w3c/input-events/issues/112
+promise_test(async () => {
+  reset();
+  editor.innerHTML = "<p>a<span>b</span>c</p>";
+  let a = editor.querySelector("span").previousSibling;
+  selection.collapse(a, 1);
+  await sendDeleteKey();
+  assert_equals(editor.innerHTML, "<p>ac</p>");
+  checkGetTargetRangesOfBeforeinputOnDeleteSomething({
+    startContainer: a,
+    startOffset: 1,
+    endContainer: editor.firstChild,
+    endOffset: 2,
+  });
+  checkGetTargetRangesOfInputOnDeleteSomething();
+}, 'Delete at "<p>a[]<span>b</span>c</p>"');
+
+// Should delete the `<span>` element becase it becomes empty.
+// However, we need discussion whether the `<span>` element should be
+// contained by a range of `getTargetRanges()`.
+// https://github.com/w3c/input-events/issues/112
+promise_test(async () => {
+  reset();
+  editor.innerHTML = "<p>a<span>b</span>c</p>";
+  let b = editor.querySelector("span").firstChild;
+  selection.collapse(b, 0);
+  await sendDeleteKey();
+  assert_equals(editor.innerHTML, "<p>ac</p>");
+  checkGetTargetRangesOfBeforeinputOnDeleteSomething({
+    startContainer: editor.firstChild,
+    startOffset: 1,
+    endContainer: editor.firstChild,
+    endOffset: 2,
+  });
+  checkGetTargetRangesOfInputOnDeleteSomething();
+}, 'Delete at "<p>a<span>[]b</span>c</p>"');
+
+// Invisible trailing white-space may be deleted when the last visible
+// character is deleted.  If it's deleted, it should be contained by
+// the range of `getTargetRanges()`, but needs discussion.
+// https://github.com/w3c/input-events/issues/112
+promise_test(async () => {
+  reset();
+  editor.innerHTML = "<p>abc </p>";
+  selection.collapse(editor.firstChild.firstChild, 2);
+  await sendDeleteKey();
+  assert_in_array(editor.innerHTML, ["<p>ab</p>", "<p>ab </p>"]);
+  checkGetTargetRangesOfBeforeinputOnDeleteSomething({
+    startContainer: editor.firstChild.firstChild,
+    startOffset: 2,
+    endContainer: editor.firstChild.firstChild,
+    endOffset: editor.firstChild.firstChild.data.length == 2 ? 4 : 3,
+  });
+  checkGetTargetRangesOfInputOnDeleteSomething();
+}, 'Delete at "<p>ab[]c </p>"');
+
+// Invisible trailing white-spaces in current block and invisible leading
+// white-spaces in the following block should be deleted for avoiding they
+// becoming visible when the blocks are joined.  Perhaps, they should be
+// contained by the range of `getTargetRanges()`, but needs discussion.
+// https://github.com/w3c/input-events/issues/112
+promise_test(async () => {
+  reset();
+  editor.innerHTML = "<p>abc   </p><p>   def</p>";
+  let p1 = editor.firstChild;
+  let abc = p1.firstChild;
+  let p2 = p1.nextSibling;
+  let def = p2.firstChild;
+  selection.collapse(abc, 3);
+  await sendDeleteKey();
+  assert_equals(editor.innerHTML, "<p>abcdef</p>");
+  checkGetTargetRangesOfBeforeinputOnDeleteSomething({
+    startContainer: abc,
+    startOffset: 3,
+    endContainer: def,
+    endOffset: 3,
+  });
+  checkGetTargetRangesOfInputOnDeleteSomething();
+}, 'Delete at "<p>abc[]   </p><p>   def</p>"');
+
+// Invisible trailing white-spaces in current block and invisible leading
+// white-spaces in the following block should be deleted for avoiding they
+// becoming visible when the blocks are joined.  Perhaps, they should be
+// contained by the range of `getTargetRanges()`, but needs discussion.
+// https://github.com/w3c/input-events/issues/112
+promise_test(async () => {
+  reset();
+  editor.innerHTML = "<p>abc   </p><p>   def</p>";
+  let p1 = editor.firstChild;
+  let abc = p1.firstChild;
+  let p2 = p1.nextSibling;
+  let def = p2.firstChild;
+  selection.collapse(abc, 4);
+  await sendDeleteKey();
+  assert_equals(editor.innerHTML, "<p>abcdef</p>");
+  checkGetTargetRangesOfBeforeinputOnDeleteSomething({
+    startContainer: abc,
+    startOffset: 3,
+    endContainer: def,
+    endOffset: 3,
+  });
+  checkGetTargetRangesOfInputOnDeleteSomething();
+}, 'Delete at "<p>abc []  </p><p>   def</p>"');
+
+// Invisible trailing white-spaces in current block and invisible leading
+// white-spaces in the following block should be deleted for avoiding they
+// becoming visible when the blocks are joined.  Perhaps, they should be
+// contained by the range of `getTargetRanges()`, but needs discussion.
+// https://github.com/w3c/input-events/issues/112
+promise_test(async () => {
+  reset();
+  editor.innerHTML = "<p>abc   </p><p>   def</p>";
+  let p1 = editor.firstChild;
+  let abc = p1.firstChild;
+  let p2 = p1.nextSibling;
+  let def = p2.firstChild;
+  selection.collapse(abc, 5);
+  await sendDeleteKey();
+  assert_equals(editor.innerHTML, "<p>abcdef</p>");
+  checkGetTargetRangesOfBeforeinputOnDeleteSomething({
+    startContainer: abc,
+    startOffset: 3,
+    endContainer: def,
+    endOffset: 3,
+  });
+  checkGetTargetRangesOfInputOnDeleteSomething();
+}, 'Delete at "<p>abc  [] </p><p>   def</p>"');
+
+// Invisible trailing white-spaces in current block and invisible leading
+// white-spaces in the following block should be deleted for avoiding they
+// becoming visible when the blocks are joined.  Perhaps, they should be
+// contained by the range of `getTargetRanges()`, but needs discussion.
+// https://github.com/w3c/input-events/issues/112
+promise_test(async () => {
+  reset();
+  editor.innerHTML = "<p>abc   </p><p>   def</p>";
+  let p1 = editor.firstChild;
+  let abc = p1.firstChild;
+  let p2 = p1.nextSibling;
+  let def = p2.firstChild;
+  selection.collapse(abc, 6);
+  await sendDeleteKey();
+  assert_equals(editor.innerHTML, "<p>abcdef</p>");
+  checkGetTargetRangesOfBeforeinputOnDeleteSomething({
+    startContainer: abc,
+    startOffset: 3,
+    endContainer: def,
+    endOffset: 3,
+  });
+  checkGetTargetRangesOfInputOnDeleteSomething();
+}, 'Delete at "<p>abc   []</p><p>   def</p>"');
+
+// Invisible trailing white-spaces in current block and invisible leading
+// white-spaces in the following block should be deleted for avoiding they
+// becoming visible when the blocks are joined.  Perhaps, they should be
+// contained by the range of `getTargetRanges()`, but needs discussion.
+promise_test(async () => {
+  reset();
+  editor.innerHTML = "<p>abc   </p><p>   def</p>";
+  let p1 = editor.firstChild;
+  let abc = p1.firstChild;
+  let p2 = p1.nextSibling;
+  let def = p2.firstChild;
+  selection.setBaseAndExtent(abc, 6, def, 0);
+  await sendDeleteKey();
+  assert_equals(editor.innerHTML, "<p>abcdef</p>");
+  checkGetTargetRangesOfBeforeinputOnDeleteSomething({
+    startContainer: abc,
+    startOffset: 3,
+    endContainer: def,
+    endOffset: 3,
+  });
+  checkGetTargetRangesOfInputOnDeleteSomething();
+}, 'Delete at "<p>abc   [</p><p>]   def</p>"');
+
+// Invisible leading white-spaces in the following block should be deleted
+// for avoiding they becoming visible when the blocks are joined, but
+// preformatted trailing white-spaces in the first block shouldn't be
+// deleted.  Perhaps, the invisible white-spaces should be contained by
+// the range of `getTargetRanges()`, but needs discussion.
+// https://github.com/w3c/input-events/issues/112
+promise_test(async () => {
+  reset();
+  editor.innerHTML = "<pre>abc   </pre><p>   def</p>";
+  let pre = editor.firstChild;
+  let abc = pre.firstChild;
+  let p = pre.nextSibling;
+  let def = p.firstChild;
+  selection.collapse(abc, 6);
+  await sendDeleteKey();
+  assert_equals(editor.innerHTML, "<pre>abc   def</pre>");
+  checkGetTargetRangesOfBeforeinputOnDeleteSomething({
+    startContainer: abc,
+    startOffset: 6,
+    endContainer: def,
+    endOffset: 3,
+  });
+  checkGetTargetRangesOfInputOnDeleteSomething();
+}, 'Delete at "<pre>abc   []</pre><p>   def</p>"');
+
+// Invisible leading/trailing white-spaces in the following block should be
+// deleted for avoiding they becoming visible when the blocks are joined, but
+// preformatted trailing white-spaces in the first block shouldn't be
+// deleted.  Perhaps, the invisible leading white-spaces should be contained
+// by the range of `getTargetRanges()`, but needs discussion.
+// And also not sure whether the trailing white-spaces should be contained
+// by additional range of `getTargetRanges()` or not because of the
+// implementation cost and runtime cost.  Needs discuss.
+// https://github.com/w3c/input-events/issues/112
+promise_test(async () => {
+  reset();
+  editor.innerHTML = "<pre>abc   </pre><p>   def</p>";
+  let pre = editor.firstChild;
+  let abc = pre.firstChild;
+  let p = pre.nextSibling;
+  let def = p.firstChild;
+  selection.collapse(abc, 6);
+  await sendDeleteKey();
+  assert_equals(editor.innerHTML, "<pre>abc   def</pre>");
+  checkGetTargetRangesOfBeforeinputOnDeleteSomething({
+    startContainer: abc,
+    startOffset: 6,
+    endContainer: def,
+    endOffset: 3,
+  });
+  checkGetTargetRangesOfInputOnDeleteSomething();
+}, 'Delete at "<pre>abc   []</pre><p>   def   </p>"');
+
+// Invisible trailing white-spaces in the first block should be deleted
+// when the block is joined with the preformated following block, but
+// the leading white-spaces in the preformatted block shouldn't be
+// removed.  So, in this case, the invisible trailing white-spaces should
+// be in the range of `getTargetRanges()`, but not so for the preformatted
+// visible leading white-spaces.  But needs discussion.
+// https://github.com/w3c/input-events/issues/112
+promise_test(async () => {
+  reset();
+  editor.innerHTML = "<p>abc   </p><pre>   def</pre>";
+  let p = editor.firstChild;
+  let abc = p.firstChild;
+  let pre = p.nextSibling;
+  let def = pre.firstChild;
+  selection.collapse(abc, 3);
+  await sendDeleteKey();
+  assert_in_array(editor.innerHTML, ["<p>abc &nbsp; def</p>",
+                                     "<p>abc&nbsp;&nbsp; def</p>",
+                                     "<p>abc&nbsp; &nbsp;def</p>",
+                                     "<p>abc &nbsp;&nbsp;def</p>"]);
+  checkGetTargetRangesOfBeforeinputOnDeleteSomething({
+    startContainer: abc,
+    startOffset: 3,
+    endContainer: def,
+    endOffset: 0,
+  });
+  checkGetTargetRangesOfInputOnDeleteSomething();
+}, 'Delete at "<p>abc[]   </p><pre>   def</pre>"');
+
+// Deleting from before invisible trailing `<br>` element of a block
+// should delete the `<br>` element and join the blocks.  Therefore,
+// the target range should contain the `<br>` element and block boundaries.
+// But maybe needs discussion.
+// https://github.com/w3c/input-events/issues/112
+promise_test(async () => {
+  reset();
+  editor.innerHTML = "<p>abc<br></p><p>def</p>";
+  let p1 = editor.firstChild;
+  let abc = p1.firstChild;
+  let p2 = p1.nextSibling;
+  let def = p2.firstChild;
+  selection.collapse(abc, 3);
+  await sendDeleteKey();
+  assert_equals(editor.innerHTML, "<p>abcdef</p>");
+  checkGetTargetRangesOfBeforeinputOnDeleteSomething({
+    startContainer: abc,
+    startOffset: 3,
+    endContainer: def,
+    endOffset: 0,
+  });
+  checkGetTargetRangesOfInputOnDeleteSomething();
+}, 'Delete at "<p>abc[]<br></p><p>def</p>"');
+
+// Deleting from last empty line in the first block should delete the
+// invisible `<br>` element for the last empty line and join the blocks.
+// In this case, the invisible `<br>` element should be contained in the
+// range of `getTargetRanges()`, but needs discussion.
+// https://github.com/w3c/input-events/issues/112
+promise_test(async () => {
+  reset();
+  editor.innerHTML = "<p>abc<br><br></p><p>def</p>";
+  let p1 = editor.firstChild;
+  let abc = p1.firstChild;
+  let p2 = p1.nextSibling;
+  let def = p2.firstChild;
+  selection.collapse(p1, 2);
+  await sendDeleteKey();
+  assert_equals(editor.innerHTML, "<p>abc<br>def</p>");
+  checkGetTargetRangesOfBeforeinputOnDeleteSomething({
+    startContainer: p1,
+    startOffset: 2,
+    endContainer: def,
+    endOffset: 0,
+  });
+  checkGetTargetRangesOfInputOnDeleteSomething();
+}, 'Delete at "<p>abc<br>{}<br></p><p>def</p>"');
+
+// Deleting visible `<br>` element should be contained by a range of
+// `getTargetRanges()`.
+promise_test(async () => {
+  reset();
+  editor.innerHTML = "<p>abc<br>def</p>";
+  let abc = editor.firstChild.firstChild;
+  selection.collapse(abc, 3);
+  await sendDeleteKey();
+  assert_equals(editor.innerHTML, "<p>abcdef</p>");
+  checkGetTargetRangesOfBeforeinputOnDeleteSomething({
+    startContainer: abc,
+    startOffset: 3,
+    endContainer: editor.querySelector("p"),
+    endOffset: 2,
+  });
+  checkGetTargetRangesOfInputOnDeleteSomething();
+}, 'Delete at "<p>abc[]<br>def</p>"');
+
+// Deleting visible `<br>` element should be contained by a range of
+// `getTargetRanges()`.  However, when only the `<br>` element is selected,
+// the range shouldn't start from nor end by surrounding text nodes?
+// https://github.com/w3c/input-events/issues/112
+promise_test(async () => {
+  reset();
+  editor.innerHTML = "<p>abc<br>def</p>";
+  selection.setBaseAndExtent(editor.firstChild, 1, editor.firstChild, 2);
+  await sendDeleteKey();
+  assert_equals(editor.innerHTML, "<p>abcdef</p>");
+  checkGetTargetRangesOfBeforeinputOnDeleteSomething({
+    startContainer: editor.firstChild,
+    startOffset: 1,
+    endContainer: editor.firstChild,
+    endOffset: 2,
+  });
+  checkGetTargetRangesOfInputOnDeleteSomething();
+}, 'Delete at "<p>abc{<br>}def</p>"');
+
+// Joining parent block and child block should remove invisible preceding
+// white-spaces of the child block and invisible leading white-spaces in
+// the child block, and they should be contained in a range of
+// `getTargetRanges()`, but maybe needs discussion.
+// https://github.com/w3c/input-events/issues/112
+promise_test(async () => {
+  reset();
+  editor.innerHTML = "<div>abc   <p>   def<br>ghi</p></div>";
+  let p = editor.querySelector("p");
+  let def = p.firstChild;
+  let abc = editor.firstChild.firstChild;
+  selection.collapse(abc, 3);
+  await sendDeleteKey();
+  assert_equals(editor.innerHTML, "<div>abcdef<p>ghi</p></div>");
+  checkGetTargetRangesOfBeforeinputOnDeleteSomething({
+    startContainer: abc,
+    startOffset: 3,
+    endContainer: def,
+    endOffset: 3,
+  });
+  checkGetTargetRangesOfInputOnDeleteSomething();
+}, 'Delete at "<div>abc[]   <p>   def<br>ghi</p></div>"');
+
+// Joining child block and parent block should remove invisible trailing
+// white-spaces of the child block and invisible following white-spaces
+// in the parent block, and they should be contained by a range of
+// `getTaregetRanges()`, but maybe needs discussion.
+// https://github.com/w3c/input-events/issues/112
+promise_test(async () => {
+  reset();
+  editor.innerHTML = "<div><p>abc   </p>   def</div>";
+  let abc = editor.querySelector("p").firstChild;
+  let def = editor.querySelector("p").nextSibling;
+  selection.collapse(abc, 3);
+  await sendDeleteKey();
+  assert_equals(editor.innerHTML, "<div><p>abcdef</p></div>");
+  checkGetTargetRangesOfBeforeinputOnDeleteSomething({
+    startContainer: abc,
+    startOffset: 3,
+    endContainer: def,
+    endOffset: 3,
+  });
+  checkGetTargetRangesOfInputOnDeleteSomething();
+}, 'Delete at "<div><p>abc[]   </p>   def</div>"');
+
+// The following tests check whether the range returned from
+// `beforeinput[0].getTargetRanges()` is modified or different range is
+// modified instead.  I.e., they don't test which type of deletion should
+// occur.  Therefore, their result depends on browser's key bindings,
+// system settings and running OS.
+
+function getFirstDifferentOffset(currentString, originalString) {
+  for (let i = 0; i < currentString.length; i++) {
+    if (currentString.charAt(i) !== originalString.charAt(i) &&
+        (originalString.charAt(i) !== " " || !currentString.charAt("\u00A0"))) {
+      return i;
+    }
+  }
+  return currentString.length;
+}
+
+promise_test(async () => {
+  reset();
+  const kText = "abc def ghi";
+  editor.innerHTML = `<p>${kText}</p>`;
+  let p = editor.querySelector("p");
+  selection.collapse(p.firstChild, "abc ".length);
+  await sendDeleteKey(kShift);
+  let startOffset = getFirstDifferentOffset(p.firstChild.data, kText);
+  let length = kText.length - p.firstChild.data.length;
+  assert_equals(editor.innerHTML.replace(/&nbsp;/g, " "),
+      `<p>${kText.substr(0, startOffset) + kText.substr(startOffset + length)}</p>`);
+  if (startOffset === kText.length) {
+    checkBeforeinputAndInputEventsOnNOOP();
+    return;
+  }
+  checkGetTargetRangesOfBeforeinputOnDeleteSomething({
+    startContainer: p.firstChild,
+    startOffset: startOffset,
+    endContainer: p.firstChild,
+    endOffset: startOffset + length,
+  });
+  checkGetTargetRangesOfInputOnDeleteSomething();
+}, 'Shift + Delete at "<p>abc []def ghi</p>"');
+
+promise_test(async () => {
+  reset();
+  const kText = "abc def ghi";
+  editor.innerHTML = `<p>${kText}</p>`;
+  let p = editor.querySelector("p");
+  selection.collapse(p.firstChild, "abc ".length);
+  await sendDeleteKey(kControl);
+  let startOffset = getFirstDifferentOffset(p.firstChild.data, kText);
+  let length = kText.length - p.firstChild.data.length;
+  assert_equals(editor.innerHTML.replace(/&nbsp;/g, " "),
+      `<p>${kText.substr(0, startOffset) + kText.substr(startOffset + length)}</p>`);
+  if (startOffset === kText.length) {
+    checkBeforeinputAndInputEventsOnNOOP();
+    return;
+  }
+  checkGetTargetRangesOfBeforeinputOnDeleteSomething({
+    startContainer: p.firstChild,
+    startOffset: startOffset,
+    endContainer: p.firstChild,
+    endOffset: startOffset + length,
+  });
+  checkGetTargetRangesOfInputOnDeleteSomething();
+}, 'Control + Delete at "<p>abc []def ghi</p>"');
+
+promise_test(async () => {
+  reset();
+  const kText = "abc def ghi";
+  editor.innerHTML = `<p>${kText}</p>`;
+  let p = editor.querySelector("p");
+  selection.collapse(p.firstChild, "abc ".length);
+  await sendDeleteKey(kAlt);
+  let startOffset = getFirstDifferentOffset(p.firstChild.data, kText);
+  let length = kText.length - p.firstChild.data.length;
+  assert_equals(editor.innerHTML.replace(/&nbsp;/g, " "),
+      `<p>${kText.substr(0, startOffset) + kText.substr(startOffset + length)}</p>`);
+  if (startOffset === kText.length) {
+    checkBeforeinputAndInputEventsOnNOOP();
+    return;
+  }
+  checkGetTargetRangesOfBeforeinputOnDeleteSomething({
+    startContainer: p.firstChild,
+    startOffset: startOffset,
+    endContainer: p.firstChild,
+    endOffset: startOffset + length,
+  });
+  checkGetTargetRangesOfInputOnDeleteSomething();
+}, 'Alt + Delete at "<p>abc []def ghi</p>"');
+
+promise_test(async () => {
+  reset();
+  const kText = "abc def ghi";
+  editor.innerHTML = `<p>${kText}</p>`;
+  let p = editor.querySelector("p");
+  selection.collapse(p.firstChild, "abc ".length);
+  await sendDeleteKey(kMeta);
+  let startOffset = getFirstDifferentOffset(p.firstChild.data, kText);
+  let length = kText.length - p.firstChild.data.length;
+  assert_equals(editor.innerHTML.replace(/&nbsp;/g, " "),
+      `<p>${kText.substr(0, startOffset) + kText.substr(startOffset + length)}</p>`);
+  if (startOffset === kText.length) {
+    checkBeforeinputAndInputEventsOnNOOP();
+    return;
+  }
+  checkGetTargetRangesOfBeforeinputOnDeleteSomething({
+    startContainer: p.firstChild,
+    startOffset: startOffset,
+    endContainer: p.firstChild,
+    endOffset: startOffset + length,
+  });
+  checkGetTargetRangesOfInputOnDeleteSomething();
+}, 'Meta + Delete at "<p>abc []def ghi</p>"');
+
+promise_test(async () => {
+  reset();
+  const kText = "abc def";
+  editor.innerHTML = `<p>${kText}   </p>`;
+  let p = editor.querySelector("p");
+  selection.collapse(p.firstChild, "abc ".length);
+  await sendDeleteKey(kShift);
+  let visibleText = p.firstChild.data.replace(/%s+$/, "");
+  let invisibleWhiteSpaces = " ".repeat(p.firstChild.data.length - visibleText.length);
+  let startOffset = invisibleWhiteSpaces.length + getFirstDifferentOffset(visibleText, kText);
+  let length = kText.length + 3 - p.firstChild.data.length;
+  // If invisible white-spaces are deleted, they should be contained in the target range.
+  assert_equals(editor.innerHTML.replace(/&nbsp;/g, " "),
+      `<p>${kText.substr(0, startOffset) + kText.substr(startOffset + length) + invisibleWhiteSpaces}</p>`);
+  if (startOffset === kText.length) {
+    checkBeforeinputAndInputEventsOnNOOP();
+    return;
+  }
+  checkGetTargetRangesOfBeforeinputOnDeleteSomething({
+    startContainer: p.firstChild,
+    startOffset: startOffset,
+    endContainer: p.firstChild,
+    endOffset: startOffset + length,
+  });
+  checkGetTargetRangesOfInputOnDeleteSomething();
+}, 'Shift + Delete at "<p>abc []def   </p>"');
+
+promise_test(async () => {
+  reset();
+  const kText = "abc def";
+  editor.innerHTML = `<p>${kText}   </p>`;
+  let p = editor.querySelector("p");
+  selection.collapse(p.firstChild, "abc ".length);
+  await sendDeleteKey(kControl);
+  let visibleText = p.firstChild.data.replace(/%s+$/, "");
+  let invisibleWhiteSpaces = " ".repeat(p.firstChild.data.length - visibleText.length);
+  let startOffset = invisibleWhiteSpaces.length + getFirstDifferentOffset(visibleText, kText);
+  let length = kText.length + 3 - p.firstChild.data.length;
+  // If invisible white-spaces are deleted, they should be contained in the target range.
+  assert_equals(editor.innerHTML.replace(/&nbsp;/g, " "),
+      `<p>${kText.substr(0, startOffset) + kText.substr(startOffset + length) + invisibleWhiteSpaces}</p>`);
+  if (startOffset === kText.length) {
+    checkBeforeinputAndInputEventsOnNOOP();
+    return;
+  }
+  checkGetTargetRangesOfBeforeinputOnDeleteSomething({
+    startContainer: p.firstChild,
+    startOffset: startOffset,
+    endContainer: p.firstChild,
+    endOffset: startOffset + length,
+  });
+  checkGetTargetRangesOfInputOnDeleteSomething();
+}, 'Control + Delete at "<p>abc []def   </p>"');
+
+promise_test(async () => {
+  reset();
+  const kText = "abc def";
+  editor.innerHTML = `<p>${kText}   </p>`;
+  let p = editor.querySelector("p");
+  selection.collapse(p.firstChild, "abc ".length);
+  await sendDeleteKey(kAlt);
+  let visibleText = p.firstChild.data.replace(/%s+$/, "");
+  let invisibleWhiteSpaces = " ".repeat(p.firstChild.data.length - visibleText.length);
+  let startOffset = invisibleWhiteSpaces.length + getFirstDifferentOffset(visibleText, kText);
+  let length = kText.length + 3 - p.firstChild.data.length;
+  // If invisible white-spaces are deleted, they should be contained in the target range.
+  assert_equals(editor.innerHTML.replace(/&nbsp;/g, " "),
+      `<p>${kText.substr(0, startOffset) + kText.substr(startOffset + length) + invisibleWhiteSpaces}</p>`);
+  if (startOffset === kText.length) {
+    checkBeforeinputAndInputEventsOnNOOP();
+    return;
+  }
+  checkGetTargetRangesOfBeforeinputOnDeleteSomething({
+    startContainer: p.firstChild,
+    startOffset: startOffset,
+    endContainer: p.firstChild,
+    endOffset: startOffset + length,
+  });
+  checkGetTargetRangesOfInputOnDeleteSomething();
+}, 'Alt + Delete at "<p>abc []def   </p>"');
+
+promise_test(async () => {
+  reset();
+  const kText = "abc def";
+  editor.innerHTML = `<p>${kText}   s</p>`;
+  let p = editor.querySelector("p");
+  selection.collapse(p.firstChild, "abc ".length);
+  await sendDeleteKey(kMeta);
+  let visibleText = p.firstChild.data.replace(/%s+$/, "");
+  let invisibleWhiteSpaces = " ".repeat(p.firstChild.data.length - visibleText.length);
+  let startOffset = invisibleWhiteSpaces.length + getFirstDifferentOffset(visibleText, kText);
+  let length = kText.length + 3 - p.firstChild.data.length;
+  // If invisible white-spaces are deleted, they should be contained in the target range.
+  assert_equals(editor.innerHTML.replace(/&nbsp;/g, " "),
+      `<p>${kText.substr(0, startOffset) + kText.substr(startOffset + length) + invisibleWhiteSpaces}</p>`);
+  if (startOffset === kText.length) {
+    checkBeforeinputAndInputEventsOnNOOP();
+    return;
+  }
+  checkGetTargetRangesOfBeforeinputOnDeleteSomething({
+    startContainer: p.firstChild,
+    startOffset: startOffset,
+    endContainer: p.firstChild,
+    endOffset: startOffset + length,
+  });
+  checkGetTargetRangesOfInputOnDeleteSomething();
+}, 'Meta + Delete at "<p>abc []def</p>"');
+
+</script>
diff --git a/third_party/blink/web_tests/external/wpt/layout-instability/inline-flow-shift-vertical-rl.html b/third_party/blink/web_tests/external/wpt/layout-instability/inline-flow-shift-vertical-rl.html
deleted file mode 100644
index 06bc34c..0000000
--- a/third_party/blink/web_tests/external/wpt/layout-instability/inline-flow-shift-vertical-rl.html
+++ /dev/null
@@ -1,44 +0,0 @@
-<!DOCTYPE html>
-<title>Layout Instability: simple block movement is detected</title>
-<link rel="help" href="https://wicg.github.io/layout-instability/" />
-<script src="/resources/testharness.js"></script>
-<script src="/resources/testharnessreport.js"></script>
-<script src="resources/util.js"></script>
-<body style="writing-mode: vertical-rl">
-<div style="height: 200px; font-size: 20px; line-height: 25px">
-  1AAAAAAA<br>
-  2AAAAAAA<br>
-  3AAAAAAA<br>
-  <div id="inline-block" style="display: inline-block; width: 50px">4AAAAAAA</div><br>
-  5AAAAAAA<br>
-  6AAAAAAA<br>
-  7AAAAAAA<br>
-</div>
-<script>
-
-promise_test(async () => {
-  const watcher = new ScoreWatcher;
-
-  // Wait for the initial render to complete.
-  await waitForAnimationFrames(2);
-
-  // Modify the position of the div.
-  const inline_block = document.querySelector("#inline-block");
-  inline_block.style.width = '100px';
-
-  // The lines below the inline-block are shifted down by 50px.
-  // The implementation may measure the real width of the shifted text
-  // or use the available width (i.e. width of the containing block).
-  // Also tolerate extra 10% error.
-  const text_width = inline_block.offsetWidth;
-  const expectedScoreMin = computeExpectedScore(text_width * (30 * 3 + 50), 50) * 0.9;
-  const expectedScoreMax = computeExpectedScore(200 * (30 * 3 + 50), 50) * 1.1;
-
-  // Observer fires after the frame is painted.
-  assert_equals(watcher.score, 0);
-  await watcher.promise;
-  assert_between_exclusive(watcher.score, expectedScoreMin, expectedScoreMax);
-}, 'Inline flow movement.');
-
-</script>
-</body>
diff --git a/third_party/blink/web_tests/external/wpt/layout-instability/inline-flow-shift.html b/third_party/blink/web_tests/external/wpt/layout-instability/inline-flow-shift.html
deleted file mode 100644
index 39550da..0000000
--- a/third_party/blink/web_tests/external/wpt/layout-instability/inline-flow-shift.html
+++ /dev/null
@@ -1,42 +0,0 @@
-<!DOCTYPE html>
-<title>Layout Instability: simple block movement is detected</title>
-<link rel="help" href="https://wicg.github.io/layout-instability/" />
-<script src="/resources/testharness.js"></script>
-<script src="/resources/testharnessreport.js"></script>
-<script src="resources/util.js"></script>
-<div style="width: 200px; font-size: 20px; line-height: 25px">
-  1AAAAAAA<br>
-  2AAAAAAA<br>
-  3AAAAAAA<br>
-  <div id="inline-block" style="display: inline-block; height: 50px">4AAAAAAA</div><br>
-  5AAAAAAA<br>
-  6AAAAAAA<br>
-  7AAAAAAA<br>
-</div>
-<script>
-
-promise_test(async () => {
-  const watcher = new ScoreWatcher;
-
-  // Wait for the initial render to complete.
-  await waitForAnimationFrames(2);
-
-  // Modify the position of the div.
-  const inline_block = document.querySelector("#inline-block");
-  inline_block.style.height = '100px';
-
-  // The lines below the inline-block are shifted down by 50px.
-  // The implementation may measure the real width of the shifted text
-  // or use the available width (i.e. width of the containing block).
-  // Also tolerate extra 10% error.
-  const text_width = inline_block.offsetWidth;
-  const expectedScoreMin = computeExpectedScore(text_width * (30 * 3 + 50), 50) * 0.9;
-  const expectedScoreMax = computeExpectedScore(200 * (30 * 3 + 50), 50) * 1.1;
-
-  // Observer fires after the frame is painted.
-  assert_equals(watcher.score, 0);
-  await watcher.promise;
-  assert_between_exclusive(watcher.score, expectedScoreMin, expectedScoreMax);
-}, 'Inline flow movement.');
-
-</script>
diff --git a/third_party/blink/web_tests/external/wpt/layout-instability/outline.html b/third_party/blink/web_tests/external/wpt/layout-instability/outline.html
deleted file mode 100644
index 1fed8e9..0000000
--- a/third_party/blink/web_tests/external/wpt/layout-instability/outline.html
+++ /dev/null
@@ -1,21 +0,0 @@
-<!DOCTYPE html>
-<title>Layout Instability: outline doesn't contribute to layout shift</title>
-<link rel="help" href="https://wicg.github.io/layout-instability/" />
-<script src="/resources/testharness.js"></script>
-<script src="/resources/testharnessreport.js"></script>
-<script src="resources/util.js"></script>
-<div id="target" style="width: 300px; height: 300px"></div>
-<script>
-promise_test(async () => {
-  const watcher = new ScoreWatcher;
-
-  // Wait for the initial render to complete.
-  await waitForAnimationFrames(2);
-
-  // Add outline for target. This should not generate a shift.
-  target.style.outline = "10px solid blue";
-
-  await waitForAnimationFrames(3);
-  assert_equals(watcher.score, 0);
-}, "Outline.");
-</script>
diff --git a/third_party/blink/web_tests/fast/events/mouse-cursor-image-set-expected.txt b/third_party/blink/web_tests/fast/events/mouse-cursor-image-set-expected.txt
index efac1960..e0611d25b 100644
--- a/third_party/blink/web_tests/fast/events/mouse-cursor-image-set-expected.txt
+++ b/third_party/blink/web_tests/fast/events/mouse-cursor-image-set-expected.txt
@@ -12,42 +12,82 @@
 Cursor Info: type=Custom hotSpot=0,0 image=25x25
 
 
+TEST CASE: 25x25 SVG image at 1x
+Cursor Info: type=Custom hotSpot=0,0 image=25x25
+
+
 TEST CASE: 25x25 image at 2x
 Cursor Info: type=Custom hotSpot=0,0 image=25x25 scale=2
 
 
+TEST CASE: 25x25 SVG image at 2x
+Cursor Info: type=Custom hotSpot=0,0 image=25x25 scale=2
+
+
 TEST CASE: 25x25 image at 1x, 30x30 image at 2x
 Cursor Info: type=Custom hotSpot=0,0 image=25x25
 
 
+TEST CASE: 25x25 SVG image at 1x, 30x30 SVG image at 2x
+Cursor Info: type=Custom hotSpot=0,0 image=25x25
+
+
 TEST CASE: 25x25 image at 1.5x, 30x30 image at 5x
 Cursor Info: type=Custom hotSpot=0,0 image=25x25 scale=1.5
 
 
+TEST CASE: 25x25 SVG image at 1.5x, 30x30 SVG image at 5x
+Cursor Info: type=Custom hotSpot=0,0 image=25x25 scale=1.5
+
+
 TEST CASE: Invalid tiny scale with fallback to pointer
 Cursor Info: type=Hand
 
 
+TEST CASE: Invalid tiny scale on SVG with fallback to pointer
+Cursor Info: type=Hand
+
+
 TEST CASE: Over-large image with fallback to pointer
 Cursor Info: type=Hand
 
 
+TEST CASE: Over-large SVG image with fallback to pointer
+Cursor Info: type=Hand
+
+
 TEST CASE: 200x200 image at 4x (not over-large in UI pixels)
 Cursor Info: type=Custom hotSpot=0,0 image=200x200 scale=4
 
 
+TEST CASE: 200x200 SVG image at 4x (not over-large in UI pixels)
+Cursor Info: type=Custom hotSpot=0,0 image=200x200 scale=4
+
+
 TEST CASE: Non-existent image in image-set with fallback to 25x25 image
 Cursor Info: type=Custom hotSpot=0,0 image=25x25
 
 
+TEST CASE: Non-existent SVG image in image-set with fallback to 25x25 SVG image
+Cursor Info: type=Custom hotSpot=0,0 image=25x25
+
+
 TEST CASE: Explicit hotspot at (5,3) logical in 1x and 2x
 Cursor Info: type=Custom hotSpot=5,3 image=25x25
 
 
+TEST CASE: Explicit hotspot at (5,3) logical in 1x and 2x - SVG
+Cursor Info: type=Custom hotSpot=5,3 image=25x25
+
+
 TEST CASE: Explicit hotspot at (7,3) logical in 0.7x and 1.4x - should round to nearest integer
 Cursor Info: type=Custom hotSpot=10,4 image=30x30 scale=1.4
 
 
+TEST CASE: Explicit hotspot at (7,3) logical in 0.7x and 1.4x - SVG - should round to nearest integer
+Cursor Info: type=Custom hotSpot=10,4 image=30x30 scale=1.4
+
+
 TEST CASE: Implicit hot-spot at (5,4) physical for 1x and (28,3) physical for 2x
 Cursor Info: type=Custom hotSpot=5,4 image=25x25
 
@@ -58,42 +98,82 @@
 Cursor Info: type=Custom hotSpot=0,0 image=25x25
 
 
+TEST CASE: 25x25 SVG image at 1x
+Cursor Info: type=Custom hotSpot=0,0 image=50x50 scale=2
+
+
 TEST CASE: 25x25 image at 2x
 Cursor Info: type=Custom hotSpot=0,0 image=25x25 scale=2
 
 
+TEST CASE: 25x25 SVG image at 2x
+Cursor Info: type=Custom hotSpot=0,0 image=50x50 scale=4
+
+
 TEST CASE: 25x25 image at 1x, 30x30 image at 2x
 Cursor Info: type=Custom hotSpot=0,0 image=30x30 scale=2
 
 
+TEST CASE: 25x25 SVG image at 1x, 30x30 SVG image at 2x
+Cursor Info: type=Custom hotSpot=0,0 image=60x60 scale=4
+
+
 TEST CASE: 25x25 image at 1.5x, 30x30 image at 5x
 Cursor Info: type=Custom hotSpot=0,0 image=30x30 scale=5
 
 
+TEST CASE: 25x25 SVG image at 1.5x, 30x30 SVG image at 5x
+Cursor Info: type=Custom hotSpot=0,0 image=60x60 scale=10
+
+
 TEST CASE: Invalid tiny scale with fallback to pointer
 Cursor Info: type=Hand
 
 
+TEST CASE: Invalid tiny scale on SVG with fallback to pointer
+Cursor Info: type=Hand
+
+
 TEST CASE: Over-large image with fallback to pointer
 Cursor Info: type=Hand
 
 
+TEST CASE: Over-large SVG image with fallback to pointer
+Cursor Info: type=Hand
+
+
 TEST CASE: 200x200 image at 4x (not over-large in UI pixels)
 Cursor Info: type=Custom hotSpot=0,0 image=200x200 scale=4
 
 
+TEST CASE: 200x200 SVG image at 4x (not over-large in UI pixels)
+Cursor Info: type=Custom hotSpot=0,0 image=400x400 scale=8
+
+
 TEST CASE: Non-existent image in image-set with fallback to 25x25 image
 Cursor Info: type=Custom hotSpot=0,0 image=25x25
 
 
+TEST CASE: Non-existent SVG image in image-set with fallback to 25x25 SVG image
+Cursor Info: type=Custom hotSpot=0,0 image=50x50 scale=2
+
+
 TEST CASE: Explicit hotspot at (5,3) logical in 1x and 2x
 Cursor Info: type=Custom hotSpot=10,6 image=30x30 scale=2
 
 
+TEST CASE: Explicit hotspot at (5,3) logical in 1x and 2x - SVG
+Cursor Info: type=Custom hotSpot=20,12 image=60x60 scale=4
+
+
 TEST CASE: Explicit hotspot at (7,3) logical in 0.7x and 1.4x - should round to nearest integer
 Cursor Info: type=Custom hotSpot=10,4 image=30x30 scale=1.4
 
 
+TEST CASE: Explicit hotspot at (7,3) logical in 0.7x and 1.4x - SVG - should round to nearest integer
+Cursor Info: type=Custom hotSpot=20,8 image=60x60 scale=2.8
+
+
 TEST CASE: Implicit hot-spot at (5,4) physical for 1x and (28,3) physical for 2x
 Cursor Info: type=Custom hotSpot=28,3 image=30x30 scale=2
 
diff --git a/third_party/blink/web_tests/fast/events/mouse-cursor-image-set.html b/third_party/blink/web_tests/fast/events/mouse-cursor-image-set.html
index ee37bd2..8883b063 100644
--- a/third_party/blink/web_tests/fast/events/mouse-cursor-image-set.html
+++ b/third_party/blink/web_tests/fast/events/mouse-cursor-image-set.html
@@ -11,15 +11,25 @@
 <p><a href=https://bugs.webkit.org/show_bug.cgi?id=99493>Bug 99493</a></p>
 <div id="test-container">
   <div style='cursor: -webkit-image-set(url(resources/greenbox.png) 1x), pointer'>25x25 image at 1x</div>
+  <div style='cursor: -webkit-image-set(url(resources/greenbox.svg) 1x), pointer'>25x25 SVG image at 1x</div>
   <div style='cursor: -webkit-image-set(url(resources/greenbox.png) 2x), pointer'>25x25 image at 2x</div>
+  <div style='cursor: -webkit-image-set(url(resources/greenbox.svg) 2x), pointer'>25x25 SVG image at 2x</div>
   <div style='cursor: -webkit-image-set(url(resources/greenbox.png) 1x, url(resources/greenbox30.png) 2x), pointer'>25x25 image at 1x, 30x30 image at 2x</div>
+  <div style='cursor: -webkit-image-set(url(resources/greenbox.svg) 1x, url(resources/greenbox30.svg) 2x), pointer'>25x25 SVG image at 1x, 30x30 SVG image at 2x</div>
   <div style='cursor: -webkit-image-set(url(resources/greenbox.png) 1.5x, url(resources/greenbox30.png) 5x), pointer'>25x25 image at 1.5x, 30x30 image at 5x</div>
+  <div style='cursor: -webkit-image-set(url(resources/greenbox.svg) 1.5x, url(resources/greenbox30.svg) 5x), pointer'>25x25 SVG image at 1.5x, 30x30 SVG image at 5x</div>
   <div style='cursor: -webkit-image-set(url(resources/greenbox.png) 0.0001x), pointer'>Invalid tiny scale with fallback to pointer</div>
+  <div style='cursor: -webkit-image-set(url(resources/greenbox.svg) 0.0001x), pointer'>Invalid tiny scale on SVG with fallback to pointer</div>
   <div style='cursor: -webkit-image-set(url(resources/greenbox200.png) 1x), pointer'>Over-large image with fallback to pointer</div>
+  <div style='cursor: -webkit-image-set(url(resources/greenbox200.svg) 1x), pointer'>Over-large SVG image with fallback to pointer</div>
   <div style='cursor: -webkit-image-set(url(resources/greenbox200.png) 4x), pointer'>200x200 image at 4x (not over-large in UI pixels)</div>
+  <div style='cursor: -webkit-image-set(url(resources/greenbox200.svg) 4x), pointer'>200x200 SVG image at 4x (not over-large in UI pixels)</div>
   <div style='cursor: -webkit-image-set(url(doesntexist.png) 1x), url(resources/greenbox.png), pointer'>Non-existent image in image-set with fallback to 25x25 image</div>
+  <div style='cursor: -webkit-image-set(url(doesntexist.svg) 1x), url(resources/greenbox.svg), pointer'>Non-existent SVG image in image-set with fallback to 25x25 SVG image</div>
   <div style='cursor: -webkit-image-set(url(resources/greenbox.png) 1x, url(resources/greenbox30.png) 2x) 5 3, pointer'>Explicit hotspot at (5,3) logical in 1x and 2x</div>
+  <div style='cursor: -webkit-image-set(url(resources/greenbox.svg) 1x, url(resources/greenbox30.svg) 2x) 5 3, pointer'>Explicit hotspot at (5,3) logical in 1x and 2x - SVG</div>
   <div style='cursor: -webkit-image-set(url(resources/greenbox.png) 0.7x, url(resources/greenbox30.png) 1.4x) 7 3, pointer'>Explicit hotspot at (7,3) logical in 0.7x and 1.4x - should round to nearest integer</div>
+  <div style='cursor: -webkit-image-set(url(resources/greenbox.svg) 0.7x, url(resources/greenbox30.svg) 1.4x) 7 3, pointer'>Explicit hotspot at (7,3) logical in 0.7x and 1.4x - SVG - should round to nearest integer</div>
   <div style='cursor: -webkit-image-set(url(resources/greenbox-hotspot5-4.cur) 1x, url(resources/greenbox30-hotspot28-3.cur) 2x), pointer'>Implicit hot-spot at (5,4) physical for 1x and (28,3) physical for 2x</div>
 </div>
 <br/>
@@ -55,7 +65,9 @@
         // Repeat in high-dpi mode
         testRunner.setBackingScaleFactor(2, function() {
             // Failed images are apparently reset on scale factor change. 
-            loadImages([{ url: 'doesntexist.png', error: true }], function() {
+            loadImages([{ url: 'doesntexist.png', error: true },
+                        { url: 'doesntexist.svg', error: true }],
+                        function() {
                 checkCursors();
                 testContainer.style.display = 'none';
                 finishJSTest();
@@ -80,7 +92,7 @@
 
 // Now wait for each image to load or fail to load before starting tests.
 // Without this we can get null images in the cursors - eg. no known size.
-preloadImagesFromStyle(testContainer, 6, runTests, /doesntexist/);
+preloadImagesFromStyle(testContainer, 10, runTests, /doesntexist/);
 
 </script>
 </body>
diff --git a/third_party/blink/web_tests/fast/events/resources/greenbox.svg b/third_party/blink/web_tests/fast/events/resources/greenbox.svg
new file mode 100644
index 0000000..c029cfb
--- /dev/null
+++ b/third_party/blink/web_tests/fast/events/resources/greenbox.svg
@@ -0,0 +1,3 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="25" height="25">
+  <rect width="25" height="25" style="fill:lime"/>
+</svg>
\ No newline at end of file
diff --git a/third_party/blink/web_tests/fast/events/resources/greenbox200.svg b/third_party/blink/web_tests/fast/events/resources/greenbox200.svg
new file mode 100644
index 0000000..0e43247d
--- /dev/null
+++ b/third_party/blink/web_tests/fast/events/resources/greenbox200.svg
@@ -0,0 +1,3 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="200" height="200">
+  <rect width="200" height="200" style="fill:lime"/>
+</svg>
\ No newline at end of file
diff --git a/third_party/blink/web_tests/fast/events/resources/greenbox30.svg b/third_party/blink/web_tests/fast/events/resources/greenbox30.svg
new file mode 100644
index 0000000..02d8b43
--- /dev/null
+++ b/third_party/blink/web_tests/fast/events/resources/greenbox30.svg
@@ -0,0 +1,3 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="30" height="30">
+  <rect width="30" height="30" style="fill:lime"/>
+</svg>
\ No newline at end of file
diff --git a/third_party/blink/web_tests/fast/media/readystate-update-in-detached-context-expected.txt b/third_party/blink/web_tests/fast/media/readystate-update-in-detached-context-expected.txt
new file mode 100644
index 0000000..4c5caa9
--- /dev/null
+++ b/third_party/blink/web_tests/fast/media/readystate-update-in-detached-context-expected.txt
@@ -0,0 +1 @@
+PASS if no crash. 
diff --git a/third_party/blink/web_tests/fast/media/readystate-update-in-detached-context.html b/third_party/blink/web_tests/fast/media/readystate-update-in-detached-context.html
new file mode 100644
index 0000000..747246d
--- /dev/null
+++ b/third_party/blink/web_tests/fast/media/readystate-update-in-detached-context.html
@@ -0,0 +1,21 @@
+PASS if no crash.
+<noscript>
+<iframe></iframe>
+</noscript>
+<object id='o'>
+<video id='v1'></video>
+</object>
+<object data='http:///'>
+<video id='v2' src='data:video/webm;base64,GkXfowEAAAAAAAAfQoaBAUL3gQFC8oEEQvOBCEKChHdlYm1Ch4ECQoWBAhhTgGcBAAAAAAAB6BFNm3RALE27i1OrhBVJqWZTrIHfTbuMU6uEFlSua1OsggEwTbuMU6uEHFO7a1OsggHL7AEAAAAAAACkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAVSalmAQAAAAAAAEUq17GDD0JATYCNTGF2ZjU3LjI5LjEwMVdBjUxhdmY1Ny4yOS4xMDFzpJBAb17Yv2oNAF1ZEESuco33RImIQFCAAAAAAAAWVK5rAQAAAAAAADyuAQAAAAAAADPXgQFzxYEBnIEAIrWcg3VuZIaFVl9WUDmDgQEj44OEAfygVeABAAAAAAAAB7CCAUC6gfAfQ7Z1AQAAAAAAAEfngQCjqYEAAICCSYNCABPwDvYAOCQcGFQAAFBh9jAAABML7AAATEnjdRwIJ+gAo5eBACEAhgBAkpwATEAABCasAABekcXgABxTu2sBAAAAAAAAEbuPs4EAt4r3gQHxggF48IED'>
+</video>
+<script>
+if (window.testRunner)
+  testRunner.dumpAsText();
+
+document.addEventListener("DOMContentLoaded", () => {
+  o.width = 0;
+  window.frames[0].document.body.appendChild(v2);
+  var v1 = document.getElementById('v1');
+  o.removeChild(v1);
+});
+</script>
diff --git a/third_party/blink/web_tests/platform/linux/external/wpt/html/rendering/non-replaced-elements/the-fieldset-and-legend-elements/fieldset-flexbox-expected.txt b/third_party/blink/web_tests/platform/linux/external/wpt/html/rendering/non-replaced-elements/the-fieldset-and-legend-elements/fieldset-flexbox-expected.txt
new file mode 100644
index 0000000..357f001
--- /dev/null
+++ b/third_party/blink/web_tests/platform/linux/external/wpt/html/rendering/non-replaced-elements/the-fieldset-and-legend-elements/fieldset-flexbox-expected.txt
@@ -0,0 +1,5 @@
+This is a testharness.js-based test.
+FAIL Flex assert_equals: height expected "20px" but got "180px"
+FAIL Inline flex assert_equals: height expected "20px" but got "180px"
+Harness: the test ran to completion.
+
diff --git a/third_party/blink/web_tests/platform/mac/external/wpt/html/rendering/non-replaced-elements/the-fieldset-and-legend-elements/fieldset-flexbox-expected.txt b/third_party/blink/web_tests/platform/mac/external/wpt/html/rendering/non-replaced-elements/the-fieldset-and-legend-elements/fieldset-flexbox-expected.txt
new file mode 100644
index 0000000..4a8b751
--- /dev/null
+++ b/third_party/blink/web_tests/platform/mac/external/wpt/html/rendering/non-replaced-elements/the-fieldset-and-legend-elements/fieldset-flexbox-expected.txt
@@ -0,0 +1,5 @@
+This is a testharness.js-based test.
+FAIL Flex assert_equals: height expected "18px" but got "162px"
+FAIL Inline flex assert_equals: height expected "18px" but got "162px"
+Harness: the test ran to completion.
+
diff --git a/third_party/blink/web_tests/platform/win/external/wpt/html/rendering/non-replaced-elements/the-fieldset-and-legend-elements/fieldset-flexbox-expected.txt b/third_party/blink/web_tests/platform/win/external/wpt/html/rendering/non-replaced-elements/the-fieldset-and-legend-elements/fieldset-flexbox-expected.txt
new file mode 100644
index 0000000..357f001
--- /dev/null
+++ b/third_party/blink/web_tests/platform/win/external/wpt/html/rendering/non-replaced-elements/the-fieldset-and-legend-elements/fieldset-flexbox-expected.txt
@@ -0,0 +1,5 @@
+This is a testharness.js-based test.
+FAIL Flex assert_equals: height expected "20px" but got "180px"
+FAIL Inline flex assert_equals: height expected "20px" but got "180px"
+Harness: the test ran to completion.
+
diff --git a/third_party/blink/web_tests/virtual/layout_ng_fieldset/external/wpt/html/rendering/non-replaced-elements/the-fieldset-and-legend-elements/fieldset-flexbox-expected.txt b/third_party/blink/web_tests/virtual/layout_ng_fieldset/external/wpt/html/rendering/non-replaced-elements/the-fieldset-and-legend-elements/fieldset-flexbox-expected.txt
new file mode 100644
index 0000000..0919d152
--- /dev/null
+++ b/third_party/blink/web_tests/virtual/layout_ng_fieldset/external/wpt/html/rendering/non-replaced-elements/the-fieldset-and-legend-elements/fieldset-flexbox-expected.txt
@@ -0,0 +1,5 @@
+This is a testharness.js-based test.
+PASS Flex
+PASS Inline flex
+Harness: the test ran to completion.
+
diff --git a/third_party/blink/web_tests/virtual/layout_ng_fieldset/external/wpt/html/rendering/non-replaced-elements/the-fieldset-and-legend-elements/fieldset-percentage-block-size-expected.txt b/third_party/blink/web_tests/virtual/layout_ng_fieldset/external/wpt/html/rendering/non-replaced-elements/the-fieldset-and-legend-elements/fieldset-percentage-block-size-expected.txt
new file mode 100644
index 0000000..6105087f
--- /dev/null
+++ b/third_party/blink/web_tests/virtual/layout_ng_fieldset/external/wpt/html/rendering/non-replaced-elements/the-fieldset-and-legend-elements/fieldset-percentage-block-size-expected.txt
@@ -0,0 +1,12 @@
+This is a testharness.js-based test.
+PASS rendered legend (writing-mode: horizontal-tb)
+PASS second legend (writing-mode: horizontal-tb)
+PASS div (writing-mode: horizontal-tb)
+PASS rendered legend (writing-mode: vertical-lr)
+PASS second legend (writing-mode: vertical-lr)
+PASS div (writing-mode: vertical-lr)
+PASS rendered legend (writing-mode: vertical-rl)
+PASS second legend (writing-mode: vertical-rl)
+PASS div (writing-mode: vertical-rl)
+Harness: the test ran to completion.
+
diff --git a/third_party/widevine/cdm/widevine.gni b/third_party/widevine/cdm/widevine.gni
index 6c828f73..769489b 100644
--- a/third_party/widevine/cdm/widevine.gni
+++ b/third_party/widevine/cdm/widevine.gni
@@ -21,11 +21,10 @@
 # Widevine CDM is available as a library CDM on the following platforms and
 # architectures. Notably on Android library CDM is not used and Widevine is
 # supported via Android MediaDrm API.
-# TODO(hmchen): Provide support on "arm64".
 library_widevine_cdm_available =
     (is_chromeos && (target_cpu == "x64" || target_cpu == "arm")) ||
     (is_desktop_linux && (target_cpu == "x86" || target_cpu == "x64")) ||
-    (is_mac && target_cpu == "x64") ||
+    (is_mac && (target_cpu == "x64" || target_cpu == "arm64")) ||
     (is_win && (target_cpu == "x86" || target_cpu == "x64"))
 
 # Widevine CDM is available as a library CDM and it's supported by Chromium.
@@ -43,6 +42,11 @@
 # Widevine CDM is bundled as part of Google Chrome builds.
 bundle_widevine_cdm = enable_library_widevine_cdm && is_chrome_branded
 
+# TODO(crbug.com/1111381): Remove this when MacOS ARM64 CDM is checked in.
+if (is_mac && target_cpu == "arm64") {
+  bundle_widevine_cdm = false
+}
+
 enable_widevine_cdm_host_verification =
     enable_library_widevine_cdm && enable_cdm_host_verification
 
diff --git a/third_party/zlib/contrib/optimizations/chunkcopy.h b/third_party/zlib/contrib/optimizations/chunkcopy.h
index 25d4fe1..9c0b7cb 100644
--- a/third_party/zlib/contrib/optimizations/chunkcopy.h
+++ b/third_party/zlib/contrib/optimizations/chunkcopy.h
@@ -429,15 +429,14 @@
      w/ GCC on ARM (tested gcc 6.3 and 7.5) and avoids
      undefined behavior.
   */
-  out = chunkcopy_core_safe(out, out - dist, len, limit);
+  return chunkcopy_core_safe(out, out - dist, len, limit);
 #elif defined(__clang__) && defined(ARMV8_OS_ANDROID) && !defined(__aarch64__)
   /* Seems to perform better on 32bit (i.e. Android). */
-  out = chunkcopy_core_safe(out, out - dist, len, limit);
-#elif defined(__clang__)
+  return chunkcopy_core_safe(out, out - dist, len, limit);
+#else
   /* Seems to perform better on 64bit. */
-  out = chunkcopy_lapped_safe(out, dist, len, limit);
+  return chunkcopy_lapped_safe(out, dist, len, limit);
 #endif
-  return out;
 }
 
 /*
diff --git a/tools/flags/generate_unexpire_flags.py b/tools/flags/generate_unexpire_flags.py
index 95d2d82..a5565d5 100755
--- a/tools/flags/generate_unexpire_flags.py
+++ b/tools/flags/generate_unexpire_flags.py
@@ -128,6 +128,9 @@
   This creates a C++ source fragment defining flags, which are bound to the
   features described in gen_features_impl().
   """
+  # Note: The exact format of the flag name (temporary-unexpire-flags-m{m}) is
+  # depended on by a hack in UnexpiredMilestonesFromStorage(). See
+  # https://crbug.com/1101828 for more details.
   fragment = """
     {{"temporary-unexpire-flags-m{m}",
      "Temporarily unexpire M{m} flags.",
diff --git a/tools/metrics/histograms/enums.xml b/tools/metrics/histograms/enums.xml
index ed799d8..73ac5a1e 100644
--- a/tools/metrics/histograms/enums.xml
+++ b/tools/metrics/histograms/enums.xml
@@ -15982,6 +15982,7 @@
   <int value="39" label="Tab moved to drawer"/>
   <int value="40" label="Tab moved to main panel"/>
   <int value="41" label="Capture CSS Overview clicked"/>
+  <int value="42" label="Virtual authenticator environment enabled"/>
 </enum>
 
 <enum name="DevToolsBackgroundService">
@@ -28626,6 +28627,7 @@
   <int value="3361" label="MainFrameCSPViaOriginPolicy"/>
   <int value="3362" label="HtmlClipboardApiRead"/>
   <int value="3363" label="HtmlClipboardApiWrite"/>
+  <int value="3364" label="CSSSystemColorComputeToSelf"/>
 </enum>
 
 <enum name="FeaturePolicyAllowlistType">
diff --git a/tools/metrics/histograms/histograms.xml b/tools/metrics/histograms/histograms.xml
index 6260b11e..6191be8 100644
--- a/tools/metrics/histograms/histograms.xml
+++ b/tools/metrics/histograms/histograms.xml
@@ -86886,7 +86886,7 @@
 </histogram>
 
 <histogram name="Memory.Renderer.BlinkCachedMetadataGetResult"
-    enum="CachedMetadataHandlerState" expires_after="M84">
+    enum="CachedMetadataHandlerState" expires_after="M87">
   <owner>pasko@chromium.org</owner>
   <owner>leszeks@chromium.org</owner>
   <summary>
@@ -205222,6 +205222,13 @@
       name="SiteIsolation.CORBProtection.ProtectedMimeType.BlockedWithoutSniffing.HasNoSniff"/>
 </histogram_suffixes>
 
+<histogram_suffixes name="HiddenWhileFlushing" separator=".">
+  <suffix name="HiddenWhileFlushing"
+      label="Tab hidden while flushing FCP value."/>
+  <affected-histogram
+      name="PageLoad.PaintTiming.NavigationToFirstContentfulPaint"/>
+</histogram_suffixes>
+
 <histogram_suffixes name="HighDownloadBandwidth" separator=".">
   <suffix name="HighDownloadBandwidth" label="download with high bandwidth."/>
   <affected-histogram name="Download.Parallelizable.DownloadTime"/>
diff --git a/tools/perf/core/perfetto_binary_roller/binary_deps.json b/tools/perf/core/perfetto_binary_roller/binary_deps.json
index 8a7b9cf6..024d5cc 100644
--- a/tools/perf/core/perfetto_binary_roller/binary_deps.json
+++ b/tools/perf/core/perfetto_binary_roller/binary_deps.json
@@ -1,16 +1,16 @@
 {
     "trace_processor_shell": {
         "win": {
-            "hash": "ab4ea3f046201acbfc7ba7ece3e0495f6c2b82c7",
-            "remote_path": "perfetto_binaries/trace_processor_shell/win/9a482652ab182496ba1ea2d3f391b187f5ff80f7/trace_processor_shell.exe"
+            "hash": "c3f650eb5d76f8320c288295bcb161c6cfb2c66e",
+            "remote_path": "perfetto_binaries/trace_processor_shell/win/46b0d8780f6664c080dbec70c09bdd207cff12e9/trace_processor_shell.exe"
         },
         "mac": {
-            "hash": "e96bb6c284b4f78dbde71411edbd1856769f0d63",
-            "remote_path": "perfetto_binaries/trace_processor_shell/mac/9a482652ab182496ba1ea2d3f391b187f5ff80f7/trace_processor_shell"
+            "hash": "9a50d74839047b8d474b63ea675c09f71adb6442",
+            "remote_path": "perfetto_binaries/trace_processor_shell/mac/d14d99cd75b8ec9f83cc738b3162c3fff0b74ef1/trace_processor_shell"
         },
         "linux": {
-            "hash": "8e5359ee0d4eb46c60cd654a9f918ead325ab596",
-            "remote_path": "perfetto_binaries/trace_processor_shell/linux/f3bd050745701c186d8ee974b4843526ae154185/trace_processor_shell"
+            "hash": "5f81c2536af920c9e7bcee3484f6db396cd9e618",
+            "remote_path": "perfetto_binaries/trace_processor_shell/linux/46b0d8780f6664c080dbec70c09bdd207cff12e9/trace_processor_shell"
         }
     },
     "power_profile.sql": {
diff --git a/ui/aura/BUILD.gn b/ui/aura/BUILD.gn
index 54dce2a..0299d0f 100644
--- a/ui/aura/BUILD.gn
+++ b/ui/aura/BUILD.gn
@@ -136,6 +136,7 @@
 
   public_deps = [
     "//ui/base/cursor:cursor_base",
+    "//ui/base/dragdrop/mojom:mojom_headers",
     "//ui/base/ime",
     "//ui/compositor",
   ]
diff --git a/ui/aura/client/drag_drop_client.h b/ui/aura/client/drag_drop_client.h
index 3d08256..a6fa5ef 100644
--- a/ui/aura/client/drag_drop_client.h
+++ b/ui/aura/client/drag_drop_client.h
@@ -8,7 +8,7 @@
 #include <memory>
 
 #include "ui/aura/aura_export.h"
-#include "ui/base/dragdrop/drag_drop_types.h"
+#include "ui/base/dragdrop/mojom/drag_drop_types.mojom-forward.h"
 #include "ui/gfx/native_widget_types.h"
 
 namespace gfx {
@@ -39,7 +39,7 @@
                                aura::Window* source_window,
                                const gfx::Point& screen_location,
                                int operation,
-                               ui::DragDropTypes::DragEventSource source) = 0;
+                               ui::mojom::DragEventSource source) = 0;
 
   // Called when a drag and drop session is cancelled.
   virtual void DragCancel() = 0;
diff --git a/ui/base/dragdrop/drag_drop_types.h b/ui/base/dragdrop/drag_drop_types.h
index ae89b85..a6f0495 100644
--- a/ui/base/dragdrop/drag_drop_types.h
+++ b/ui/base/dragdrop/drag_drop_types.h
@@ -21,13 +21,6 @@
     DRAG_LINK = 1 << 2
   };
 
-  enum DragEventSource {
-    DRAG_EVENT_SOURCE_MOUSE = 0,
-    DRAG_EVENT_SOURCE_TOUCH,
-    DRAG_EVENT_SOURCE_LAST = DRAG_EVENT_SOURCE_TOUCH,
-    DRAG_EVENT_SOURCE_COUNT
-  };
-
 #if defined(OS_WIN)
   static uint32_t DragOperationToDropEffect(int drag_operation);
   static int DropEffectToDragOperation(uint32_t effect);
diff --git a/ui/base/dragdrop/mojom/BUILD.gn b/ui/base/dragdrop/mojom/BUILD.gn
new file mode 100644
index 0000000..501cb0e
--- /dev/null
+++ b/ui/base/dragdrop/mojom/BUILD.gn
@@ -0,0 +1,9 @@
+# Copyright 2020 The Chromium Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+import("//mojo/public/tools/bindings/mojom.gni")
+
+mojom("mojom") {
+  sources = [ "drag_drop_types.mojom" ]
+}
diff --git a/ui/base/dragdrop/mojom/OWNERS b/ui/base/dragdrop/mojom/OWNERS
new file mode 100644
index 0000000..08850f4
--- /dev/null
+++ b/ui/base/dragdrop/mojom/OWNERS
@@ -0,0 +1,2 @@
+per-file *.mojom=set noparent
+per-file *.mojom=file://ipc/SECURITY_OWNERS
diff --git a/ui/base/dragdrop/mojom/drag_drop_types.mojom b/ui/base/dragdrop/mojom/drag_drop_types.mojom
new file mode 100644
index 0000000..bd378c3
--- /dev/null
+++ b/ui/base/dragdrop/mojom/drag_drop_types.mojom
@@ -0,0 +1,10 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+module ui.mojom;
+
+enum DragEventSource {
+  kMouse,
+  kTouch
+};
diff --git a/ui/views/BUILD.gn b/ui/views/BUILD.gn
index 9c43bbb..29ebfd2 100644
--- a/ui/views/BUILD.gn
+++ b/ui/views/BUILD.gn
@@ -484,6 +484,7 @@
     "//third_party/icu",
     "//ui/accessibility",
     "//ui/base/clipboard",
+    "//ui/base/dragdrop/mojom:mojom_shared",
     "//ui/display",
     "//ui/latency",
     "//ui/native_theme",
@@ -503,6 +504,7 @@
     "//ui/base",
     "//ui/base/clipboard",
     "//ui/base/cursor:cursor_base",
+    "//ui/base/dragdrop/mojom:mojom_headers",
     "//ui/base/ime/init",
     "//ui/compositor",
     "//ui/display",
@@ -1150,6 +1152,7 @@
     "//ui/base:test_support",
     "//ui/base/clipboard",
     "//ui/base/clipboard:clipboard_test_support",
+    "//ui/base/dragdrop/mojom:mojom_shared",
     "//ui/base/ime/init",
     "//ui/compositor:test_support",
     "//ui/display:test_support",
diff --git a/ui/views/bubble/bubble_frame_view.cc b/ui/views/bubble/bubble_frame_view.cc
index 6a7a3fd..f61e398 100644
--- a/ui/views/bubble/bubble_frame_view.cc
+++ b/ui/views/bubble/bubble_frame_view.cc
@@ -532,9 +532,13 @@
   delete footnote_container_;
   footnote_container_ = nullptr;
   if (view) {
+    // Insert the footnote container before |close_| so that the footnote is
+    // inserted before caption buttons in the focus cycle.
     int radius = bubble_border_ ? bubble_border_->corner_radius() : 0;
-    footnote_container_ = AddChildView(std::make_unique<FootnoteContainerView>(
-        footnote_margins_, std::move(view), radius));
+    footnote_container_ =
+        AddChildViewAt(std::make_unique<FootnoteContainerView>(
+                           footnote_margins_, std::move(view), radius),
+                       GetIndexOf(close_));
   }
   InvalidateLayout();
 }
diff --git a/ui/views/cocoa/drag_drop_client_mac.h b/ui/views/cocoa/drag_drop_client_mac.h
index 608e73a..6e48ad44 100644
--- a/ui/views/cocoa/drag_drop_client_mac.h
+++ b/ui/views/cocoa/drag_drop_client_mac.h
@@ -12,7 +12,7 @@
 #include "base/callback.h"
 #include "base/macros.h"
 #include "components/remote_cocoa/app_shim/drag_drop_client.h"
-#include "ui/base/dragdrop/drag_drop_types.h"
+#include "ui/base/dragdrop/mojom/drag_drop_types.mojom-forward.h"
 #include "ui/base/dragdrop/os_exchange_data.h"
 #include "ui/views/views_export.h"
 #include "ui/views/widget/drop_helper.h"
@@ -46,7 +46,7 @@
   void StartDragAndDrop(View* view,
                         std::unique_ptr<ui::OSExchangeData> data,
                         int operation,
-                        ui::DragDropTypes::DragEventSource source);
+                        ui::mojom::DragEventSource source);
 
   DropHelper* drop_helper() { return &drop_helper_; }
 
diff --git a/ui/views/cocoa/drag_drop_client_mac.mm b/ui/views/cocoa/drag_drop_client_mac.mm
index 16ed882..eb361a9 100644
--- a/ui/views/cocoa/drag_drop_client_mac.mm
+++ b/ui/views/cocoa/drag_drop_client_mac.mm
@@ -9,6 +9,7 @@
 #include "base/strings/sys_string_conversions.h"
 #import "components/remote_cocoa/app_shim/bridged_content_view.h"
 #import "components/remote_cocoa/app_shim/native_widget_ns_window_bridge.h"
+#include "ui/base/dragdrop/drag_drop_types.h"
 #import "ui/base/dragdrop/os_exchange_data_provider_mac.h"
 #include "ui/gfx/image/image_skia_util_mac.h"
 #include "ui/views/drag_utils.h"
@@ -29,7 +30,7 @@
     View* view,
     std::unique_ptr<ui::OSExchangeData> data,
     int operation,
-    ui::DragDropTypes::DragEventSource source) {
+    ui::mojom::DragEventSource source) {
   exchange_data_ = std::move(data);
   source_operation_ = operation;
   is_drag_source_ = true;
diff --git a/ui/views/cocoa/drag_drop_client_mac_unittest.mm b/ui/views/cocoa/drag_drop_client_mac_unittest.mm
index 17c83e4..8fb1b38 100644
--- a/ui/views/cocoa/drag_drop_client_mac_unittest.mm
+++ b/ui/views/cocoa/drag_drop_client_mac_unittest.mm
@@ -12,6 +12,8 @@
 #include "base/threading/thread_task_runner_handle.h"
 #import "components/remote_cocoa/app_shim/native_widget_ns_window_bridge.h"
 #import "ui/base/clipboard/clipboard_util_mac.h"
+#import "ui/base/dragdrop/drag_drop_types.h"
+#import "ui/base/dragdrop/mojom/drag_drop_types.mojom-shared.h"
 #include "ui/gfx/image/image_unittest_util.h"
 #import "ui/views/cocoa/native_widget_mac_ns_window_host.h"
 #include "ui/views/test/widget_test.h"
@@ -262,8 +264,8 @@
                                 base::Unretained(drag_drop_client())));
 
   // It will call ReleaseCapture().
-  drag_drop_client()->StartDragAndDrop(
-      target_, std::move(data), 0, ui::DragDropTypes::DRAG_EVENT_SOURCE_MOUSE);
+  drag_drop_client()->StartDragAndDrop(target_, std::move(data), 0,
+                                       ui::mojom::DragEventSource::kMouse);
 
   // The capture should be released.
   EXPECT_FALSE(ns_window_host_->IsMouseCaptureActive());
diff --git a/ui/views/controls/button/menu_button_unittest.cc b/ui/views/controls/button/menu_button_unittest.cc
index 77204842..0a51358 100644
--- a/ui/views/controls/button/menu_button_unittest.cc
+++ b/ui/views/controls/button/menu_button_unittest.cc
@@ -26,6 +26,7 @@
 #if defined(USE_AURA)
 #include "ui/aura/client/drag_drop_client.h"
 #include "ui/aura/client/drag_drop_client_observer.h"
+#include "ui/base/dragdrop/mojom/drag_drop_types.mojom-shared.h"
 #include "ui/events/event.h"
 #include "ui/events/event_handler.h"
 #endif
@@ -228,7 +229,7 @@
                        aura::Window* source_window,
                        const gfx::Point& screen_location,
                        int operation,
-                       ui::DragDropTypes::DragEventSource source) override;
+                       ui::mojom::DragEventSource source) override;
   void DragCancel() override;
   bool IsDragDropInProgress() override;
   void AddObserver(aura::client::DragDropClientObserver* observer) override {}
@@ -258,7 +259,7 @@
     aura::Window* source_window,
     const gfx::Point& screen_location,
     int operation,
-    ui::DragDropTypes::DragEventSource source) {
+    ui::mojom::DragEventSource source) {
   if (IsDragDropInProgress())
     return ui::DragDropTypes::DRAG_NONE;
   drag_in_progress_ = true;
diff --git a/ui/views/controls/menu/menu_controller.cc b/ui/views/controls/menu/menu_controller.cc
index 968a37a..bc95f2a1 100644
--- a/ui/views/controls/menu/menu_controller.cc
+++ b/ui/views/controls/menu/menu_controller.cc
@@ -17,6 +17,7 @@
 #include "base/strings/utf_string_conversions.h"
 #include "base/time/time.h"
 #include "build/build_config.h"
+#include "ui/base/dragdrop/mojom/drag_drop_types.mojom-shared.h"
 #include "ui/base/dragdrop/os_exchange_data.h"
 #include "ui/display/screen.h"
 #include "ui/events/event.h"
@@ -1476,10 +1477,9 @@
   int drag_ops = item->GetDelegate()->GetDragOperations(item);
   did_initiate_drag_ = true;
   base::WeakPtr<MenuController> this_ref = AsWeakPtr();
-  // TODO(varunjain): Properly determine and send DRAG_EVENT_SOURCE below.
+  // TODO(varunjain): Properly determine and send DragEventSource below.
   item->GetWidget()->RunShellDrag(nullptr, std::move(data), widget_loc,
-                                  drag_ops,
-                                  ui::DragDropTypes::DRAG_EVENT_SOURCE_MOUSE);
+                                  drag_ops, ui::mojom::DragEventSource::kMouse);
   // MenuController may have been deleted so check before accessing member
   // variables.
   if (this_ref)
diff --git a/ui/views/controls/menu/menu_controller_unittest.cc b/ui/views/controls/menu/menu_controller_unittest.cc
index 7daab60..e44796e 100644
--- a/ui/views/controls/menu/menu_controller_unittest.cc
+++ b/ui/views/controls/menu/menu_controller_unittest.cc
@@ -45,6 +45,7 @@
 #include "ui/aura/null_window_targeter.h"
 #include "ui/aura/scoped_window_targeter.h"
 #include "ui/aura/window.h"
+#include "ui/base/dragdrop/mojom/drag_drop_types.mojom-shared.h"
 #include "ui/views/controls/menu/menu_pre_target_handler.h"
 #endif
 
@@ -201,7 +202,7 @@
                        aura::Window* source_window,
                        const gfx::Point& screen_location,
                        int operation,
-                       ui::DragDropTypes::DragEventSource source) override;
+                       ui::mojom::DragEventSource source) override;
   void DragCancel() override;
   bool IsDragDropInProgress() override;
 
@@ -222,7 +223,7 @@
     aura::Window* source_window,
     const gfx::Point& screen_location,
     int operation,
-    ui::DragDropTypes::DragEventSource source) {
+    ui::mojom::DragEventSource source) {
   drag_in_progress_ = true;
   start_drag_and_drop_callback_.Run();
   return 0;
diff --git a/ui/views/drag_utils.h b/ui/views/drag_utils.h
index 1604d9ec..40cf7b70 100644
--- a/ui/views/drag_utils.h
+++ b/ui/views/drag_utils.h
@@ -7,7 +7,7 @@
 
 #include <memory>
 
-#include "ui/base/dragdrop/drag_drop_types.h"
+#include "ui/base/dragdrop/mojom/drag_drop_types.mojom-forward.h"
 #include "ui/base/dragdrop/os_exchange_data.h"
 #include "ui/gfx/native_widget_types.h"
 #include "ui/views/views_export.h"
@@ -24,7 +24,7 @@
                                std::unique_ptr<ui::OSExchangeData> data,
                                const gfx::Point& location,
                                int operation,
-                               ui::DragDropTypes::DragEventSource source);
+                               ui::mojom::DragEventSource source);
 
 // Returns the device scale for the display associated with this |widget|'s
 // native view.
diff --git a/ui/views/drag_utils_aura.cc b/ui/views/drag_utils_aura.cc
index 3142d9c0f..f888369 100644
--- a/ui/views/drag_utils_aura.cc
+++ b/ui/views/drag_utils_aura.cc
@@ -15,7 +15,7 @@
                   std::unique_ptr<ui::OSExchangeData> data,
                   const gfx::Point& location,
                   int operation,
-                  ui::DragDropTypes::DragEventSource source) {
+                  ui::mojom::DragEventSource source) {
   gfx::Point screen_location(location);
   wm::ConvertPointToScreen(view, &screen_location);
   aura::Window* root_window = view->GetRootWindow();
diff --git a/ui/views/drag_utils_mac.mm b/ui/views/drag_utils_mac.mm
index 59dc6ea..256913a 100644
--- a/ui/views/drag_utils_mac.mm
+++ b/ui/views/drag_utils_mac.mm
@@ -10,7 +10,7 @@
                   std::unique_ptr<ui::OSExchangeData> data,
                   const gfx::Point& location,
                   int operation,
-                  ui::DragDropTypes::DragEventSource source) {
+                  ui::mojom::DragEventSource source) {
   NOTIMPLEMENTED();
 }
 
diff --git a/ui/views/view.cc b/ui/views/view.cc
index a000a81..174013d 100644
--- a/ui/views/view.cc
+++ b/ui/views/view.cc
@@ -26,6 +26,7 @@
 #include "ui/accessibility/ax_enums.mojom.h"
 #include "ui/base/cursor/cursor.h"
 #include "ui/base/dragdrop/drag_drop_types.h"
+#include "ui/base/dragdrop/mojom/drag_drop_types.mojom-shared.h"
 #include "ui/base/ime/input_method.h"
 #include "ui/compositor/clip_recorder.h"
 #include "ui/compositor/compositor.h"
@@ -2779,7 +2780,7 @@
        drag_controller_->CanStartDragForView(this, GetDragInfo()->start_pt,
                                              event->location()))) {
     if (DoDrag(*event, GetDragInfo()->start_pt,
-               ui::DragDropTypes::DRAG_EVENT_SOURCE_MOUSE)) {
+               ui::mojom::DragEventSource::kMouse)) {
       event->StopPropagation();
       return;
     }
@@ -2965,7 +2966,7 @@
 
 bool View::DoDrag(const ui::LocatedEvent& event,
                   const gfx::Point& press_pt,
-                  ui::DragDropTypes::DragEventSource source) {
+                  ui::mojom::DragEventSource source) {
   int drag_operations = GetDragOperations(press_pt);
   if (drag_operations == ui::DragDropTypes::DRAG_NONE)
     return false;
diff --git a/ui/views/view.h b/ui/views/view.h
index 3c45851..3caacb00 100644
--- a/ui/views/view.h
+++ b/ui/views/view.h
@@ -30,8 +30,8 @@
 #include "ui/base/accelerators/accelerator.h"
 #include "ui/base/class_property.h"
 #include "ui/base/clipboard/clipboard_format_type.h"
-#include "ui/base/dragdrop/drag_drop_types.h"
 #include "ui/base/dragdrop/drop_target_event.h"
+#include "ui/base/dragdrop/mojom/drag_drop_types.mojom-forward.h"
 #include "ui/base/dragdrop/os_exchange_data.h"
 #include "ui/base/ui_base_types.h"
 #include "ui/compositor/layer_delegate.h"
@@ -1868,7 +1868,7 @@
   // Returns true if a drag was started.
   bool DoDrag(const ui::LocatedEvent& event,
               const gfx::Point& press_pt,
-              ui::DragDropTypes::DragEventSource source);
+              ui::mojom::DragEventSource source);
 
   // Property support ----------------------------------------------------------
 
diff --git a/ui/views/widget/desktop_aura/desktop_drag_drop_client_ozone.cc b/ui/views/widget/desktop_aura/desktop_drag_drop_client_ozone.cc
index 27e55c05..ab68d6d 100644
--- a/ui/views/widget/desktop_aura/desktop_drag_drop_client_ozone.cc
+++ b/ui/views/widget/desktop_aura/desktop_drag_drop_client_ozone.cc
@@ -128,7 +128,7 @@
     aura::Window* source_window,
     const gfx::Point& root_location,
     int operation,
-    ui::DragDropTypes::DragEventSource source) {
+    ui::mojom::DragEventSource source) {
   if (!drag_handler_)
     return ui::DragDropTypes::DragOperation::DRAG_NONE;
 
diff --git a/ui/views/widget/desktop_aura/desktop_drag_drop_client_ozone.h b/ui/views/widget/desktop_aura/desktop_drag_drop_client_ozone.h
index 631000d..ad8c8568 100644
--- a/ui/views/widget/desktop_aura/desktop_drag_drop_client_ozone.h
+++ b/ui/views/widget/desktop_aura/desktop_drag_drop_client_ozone.h
@@ -77,7 +77,7 @@
                        aura::Window* source_window,
                        const gfx::Point& root_location,
                        int operation,
-                       ui::DragDropTypes::DragEventSource source) override;
+                       ui::mojom::DragEventSource source) override;
   void DragCancel() override;
   bool IsDragDropInProgress() override;
   void AddObserver(aura::client::DragDropClientObserver* observer) override;
diff --git a/ui/views/widget/desktop_aura/desktop_drag_drop_client_ozone_unittest.cc b/ui/views/widget/desktop_aura/desktop_drag_drop_client_ozone_unittest.cc
index cfc7236c..a23b5cb 100644
--- a/ui/views/widget/desktop_aura/desktop_drag_drop_client_ozone_unittest.cc
+++ b/ui/views/widget/desktop_aura/desktop_drag_drop_client_ozone_unittest.cc
@@ -12,6 +12,7 @@
 #include "base/threading/thread_task_runner_handle.h"
 #include "ui/aura/window.h"
 #include "ui/aura/window_tree_host.h"
+#include "ui/base/dragdrop/mojom/drag_drop_types.mojom-shared.h"
 #include "ui/base/dragdrop/os_exchange_data.h"
 #include "ui/platform_window/platform_window.h"
 #include "ui/platform_window/platform_window_handler/wm_drag_handler.h"
@@ -212,7 +213,7 @@
     return client_->StartDragAndDrop(
         std::move(data), widget_->GetNativeWindow()->GetRootWindow(),
         widget_->GetNativeWindow(), gfx::Point(), operation,
-        ui::DragDropTypes::DRAG_EVENT_SOURCE_MOUSE);
+        ui::mojom::DragEventSource::kMouse);
   }
 
   // ViewsTestBase:
diff --git a/ui/views/widget/desktop_aura/desktop_drag_drop_client_win.cc b/ui/views/widget/desktop_aura/desktop_drag_drop_client_win.cc
index e3bd6355..a4a9ebd9 100644
--- a/ui/views/widget/desktop_aura/desktop_drag_drop_client_win.cc
+++ b/ui/views/widget/desktop_aura/desktop_drag_drop_client_win.cc
@@ -9,6 +9,7 @@
 #include "ui/base/dragdrop/drag_drop_types.h"
 #include "ui/base/dragdrop/drag_source_win.h"
 #include "ui/base/dragdrop/drop_target_event.h"
+#include "ui/base/dragdrop/mojom/drag_drop_types.mojom-shared.h"
 #include "ui/base/dragdrop/os_exchange_data_provider_win.h"
 #include "ui/base/win/event_creation_utils.h"
 #include "ui/display/win/screen_win.h"
@@ -39,10 +40,10 @@
     aura::Window* source_window,
     const gfx::Point& screen_location,
     int operation,
-    ui::DragDropTypes::DragEventSource source) {
+    ui::mojom::DragEventSource source) {
   drag_drop_in_progress_ = true;
   drag_operation_ = operation;
-  if (source == ui::DragDropTypes::DRAG_EVENT_SOURCE_TOUCH) {
+  if (source == ui::mojom::DragEventSource::kTouch) {
     gfx::Point screen_point = display::win::ScreenWin::DIPToScreenPoint(
         {screen_location.x(), screen_location.y()});
     // Send a mouse down and mouse move before do drag drop runs its own event
@@ -66,7 +67,7 @@
       ui::OSExchangeDataProviderWin::GetIDataObject(*data.get()),
       drag_source_.Get(),
       ui::DragDropTypes::DragOperationToDropEffect(operation), &effect);
-  if (alive && source == ui::DragDropTypes::DRAG_EVENT_SOURCE_TOUCH) {
+  if (alive && source == ui::mojom::DragEventSource::kTouch) {
     desktop_host_->SetInTouchDrag(false);
     // Gesture state gets left in a state where you can't start
     // another drag, unless it's cleaned up.
diff --git a/ui/views/widget/desktop_aura/desktop_drag_drop_client_win.h b/ui/views/widget/desktop_aura/desktop_drag_drop_client_win.h
index a55fe96..644de0c 100644
--- a/ui/views/widget/desktop_aura/desktop_drag_drop_client_win.h
+++ b/ui/views/widget/desktop_aura/desktop_drag_drop_client_win.h
@@ -44,7 +44,7 @@
                        aura::Window* source_window,
                        const gfx::Point& screen_location,
                        int operation,
-                       ui::DragDropTypes::DragEventSource source) override;
+                       ui::mojom::DragEventSource source) override;
   void DragCancel() override;
   bool IsDragDropInProgress() override;
   void AddObserver(aura::client::DragDropClientObserver* observer) override;
diff --git a/ui/views/widget/desktop_aura/desktop_native_widget_aura.cc b/ui/views/widget/desktop_aura/desktop_native_widget_aura.cc
index fa9eeb3..48a9115 100644
--- a/ui/views/widget/desktop_aura/desktop_native_widget_aura.cc
+++ b/ui/views/widget/desktop_aura/desktop_native_widget_aura.cc
@@ -25,6 +25,7 @@
 #include "ui/aura/window_occlusion_tracker.h"
 #include "ui/aura/window_tree_host.h"
 #include "ui/base/class_property.h"
+#include "ui/base/dragdrop/drag_drop_types.h"
 #include "ui/base/hit_test.h"
 #include "ui/base/ime/input_method.h"
 #include "ui/base/ui_base_features.h"
@@ -924,7 +925,7 @@
     std::unique_ptr<ui::OSExchangeData> data,
     const gfx::Point& location,
     int operation,
-    ui::DragDropTypes::DragEventSource source) {
+    ui::mojom::DragEventSource source) {
   views::RunShellDrag(content_window_, std::move(data), location, operation,
                       source);
 }
diff --git a/ui/views/widget/desktop_aura/desktop_native_widget_aura.h b/ui/views/widget/desktop_aura/desktop_native_widget_aura.h
index 4e10aad..41a7b8af 100644
--- a/ui/views/widget/desktop_aura/desktop_native_widget_aura.h
+++ b/ui/views/widget/desktop_aura/desktop_native_widget_aura.h
@@ -177,7 +177,7 @@
                     std::unique_ptr<ui::OSExchangeData> data,
                     const gfx::Point& location,
                     int operation,
-                    ui::DragDropTypes::DragEventSource source) override;
+                    ui::mojom::DragEventSource source) override;
   void SchedulePaintInRect(const gfx::Rect& rect) override;
   void ScheduleLayout() override;
   void SetCursor(gfx::NativeCursor cursor) override;
diff --git a/ui/views/widget/desktop_aura/x11_drag_drop_client_unittest.cc b/ui/views/widget/desktop_aura/x11_drag_drop_client_unittest.cc
index 7beb018d7..882fc751 100644
--- a/ui/views/widget/desktop_aura/x11_drag_drop_client_unittest.cc
+++ b/ui/views/widget/desktop_aura/x11_drag_drop_client_unittest.cc
@@ -22,6 +22,7 @@
 #include "ui/aura/test/test_screen.h"
 #include "ui/aura/window.h"
 #include "ui/aura/window_tree_host.h"
+#include "ui/base/dragdrop/mojom/drag_drop_types.mojom-shared.h"
 #include "ui/base/dragdrop/os_exchange_data.h"
 #include "ui/base/x/x11_cursor.h"
 #include "ui/base/x/x11_move_loop.h"
@@ -121,7 +122,7 @@
                        aura::Window* source_window,
                        const gfx::Point& screen_location,
                        int operation,
-                       ui::DragDropTypes::DragEventSource source) override;
+                       ui::mojom::DragEventSource source) override;
   void DragCancel() override;
   bool IsDragDropInProgress() override;
   void AddObserver(aura::client::DragDropClientObserver* observer) override;
@@ -312,7 +313,7 @@
     aura::Window* source_window,
     const gfx::Point& screen_location,
     int operation,
-    ui::DragDropTypes::DragEventSource source) {
+    ui::mojom::DragEventSource source) {
   InitDrag(operation, data.get());
 
   auto loop = CreateMoveLoop(this);
@@ -478,7 +479,7 @@
     return client_->StartDragAndDrop(
         std::move(data), widget_->GetNativeWindow()->GetRootWindow(),
         widget_->GetNativeWindow(), gfx::Point(), ui::DragDropTypes::DRAG_COPY,
-        ui::DragDropTypes::DRAG_EVENT_SOURCE_MOUSE);
+        ui::mojom::DragEventSource::kMouse);
   }
 
   // ViewsTestBase:
diff --git a/ui/views/widget/native_widget_aura.cc b/ui/views/widget/native_widget_aura.cc
index fa0d7ec..a5dedf7 100644
--- a/ui/views/widget/native_widget_aura.cc
+++ b/ui/views/widget/native_widget_aura.cc
@@ -700,7 +700,7 @@
                                     std::unique_ptr<ui::OSExchangeData> data,
                                     const gfx::Point& location,
                                     int operation,
-                                    ui::DragDropTypes::DragEventSource source) {
+                                    ui::mojom::DragEventSource source) {
   if (window_)
     views::RunShellDrag(window_, std::move(data), location, operation, source);
 }
diff --git a/ui/views/widget/native_widget_aura.h b/ui/views/widget/native_widget_aura.h
index 2eba4ccf..d70aa0a 100644
--- a/ui/views/widget/native_widget_aura.h
+++ b/ui/views/widget/native_widget_aura.h
@@ -137,7 +137,7 @@
                     std::unique_ptr<ui::OSExchangeData> data,
                     const gfx::Point& location,
                     int operation,
-                    ui::DragDropTypes::DragEventSource source) override;
+                    ui::mojom::DragEventSource source) override;
   void SchedulePaintInRect(const gfx::Rect& rect) override;
   void ScheduleLayout() override;
   void SetCursor(gfx::NativeCursor cursor) override;
diff --git a/ui/views/widget/native_widget_mac.h b/ui/views/widget/native_widget_mac.h
index 0fbd95a..227123b 100644
--- a/ui/views/widget/native_widget_mac.h
+++ b/ui/views/widget/native_widget_mac.h
@@ -162,7 +162,7 @@
                     std::unique_ptr<ui::OSExchangeData> data,
                     const gfx::Point& location,
                     int operation,
-                    ui::DragDropTypes::DragEventSource source) override;
+                    ui::mojom::DragEventSource source) override;
   void SchedulePaintInRect(const gfx::Rect& rect) override;
   void ScheduleLayout() override;
   void SetCursor(gfx::NativeCursor cursor) override;
diff --git a/ui/views/widget/native_widget_mac.mm b/ui/views/widget/native_widget_mac.mm
index c3e62ff..4b1cf53 100644
--- a/ui/views/widget/native_widget_mac.mm
+++ b/ui/views/widget/native_widget_mac.mm
@@ -676,7 +676,7 @@
                                    std::unique_ptr<ui::OSExchangeData> data,
                                    const gfx::Point& location,
                                    int operation,
-                                   ui::DragDropTypes::DragEventSource source) {
+                                   ui::mojom::DragEventSource source) {
   ns_window_host_->drag_drop_client()->StartDragAndDrop(view, std::move(data),
                                                         operation, source);
 }
diff --git a/ui/views/widget/native_widget_private.h b/ui/views/widget/native_widget_private.h
index ba3c722..73539269 100644
--- a/ui/views/widget/native_widget_private.h
+++ b/ui/views/widget/native_widget_private.h
@@ -9,6 +9,7 @@
 #include <string>
 
 #include "base/strings/string16.h"
+#include "ui/base/dragdrop/mojom/drag_drop_types.mojom-forward.h"
 #include "ui/base/ui_base_types.h"
 #include "ui/gfx/native_widget_types.h"
 #include "ui/views/widget/native_widget.h"
@@ -206,7 +207,7 @@
                             std::unique_ptr<ui::OSExchangeData> data,
                             const gfx::Point& location,
                             int operation,
-                            ui::DragDropTypes::DragEventSource source) = 0;
+                            ui::mojom::DragEventSource source) = 0;
   virtual void SchedulePaintInRect(const gfx::Rect& rect) = 0;
   virtual void ScheduleLayout() = 0;
   virtual void SetCursor(gfx::NativeCursor cursor) = 0;
diff --git a/ui/views/widget/root_view.cc b/ui/views/widget/root_view.cc
index fd8d126..01224fe 100644
--- a/ui/views/widget/root_view.cc
+++ b/ui/views/widget/root_view.cc
@@ -13,7 +13,7 @@
 #include "ui/accessibility/ax_enums.mojom.h"
 #include "ui/accessibility/ax_node_data.h"
 #include "ui/base/cursor/cursor.h"
-#include "ui/base/dragdrop/drag_drop_types.h"
+#include "ui/base/dragdrop/mojom/drag_drop_types.mojom-shared.h"
 #include "ui/base/ui_base_switches_util.h"
 #include "ui/compositor/layer.h"
 #include "ui/events/event.h"
@@ -149,7 +149,7 @@
          target->drag_controller()->CanStartDragForView(target, location,
                                                         location))) {
       if (target->DoDrag(*event, location,
-                         ui::DragDropTypes::DRAG_EVENT_SOURCE_TOUCH)) {
+                         ui::mojom::DragEventSource::kTouch)) {
         event->StopPropagation();
         return;
       }
diff --git a/ui/views/widget/widget.cc b/ui/views/widget/widget.cc
index ff906de..f025085 100644
--- a/ui/views/widget/widget.cc
+++ b/ui/views/widget/widget.cc
@@ -798,7 +798,7 @@
                           std::unique_ptr<ui::OSExchangeData> data,
                           const gfx::Point& location,
                           int operation,
-                          ui::DragDropTypes::DragEventSource source) {
+                          ui::mojom::DragEventSource source) {
   dragged_view_ = view;
   OnDragWillStart();
 
diff --git a/ui/views/widget/widget.h b/ui/views/widget/widget.h
index ef79785..032f77d 100644
--- a/ui/views/widget/widget.h
+++ b/ui/views/widget/widget.h
@@ -16,6 +16,7 @@
 #include "base/optional.h"
 #include "base/scoped_observer.h"
 #include "build/build_config.h"
+#include "ui/base/dragdrop/mojom/drag_drop_types.mojom-forward.h"
 #include "ui/base/ui_base_types.h"
 #include "ui/events/event_source.h"
 #include "ui/gfx/geometry/rect.h"
@@ -717,7 +718,7 @@
                     std::unique_ptr<ui::OSExchangeData> data,
                     const gfx::Point& location,
                     int operation,
-                    ui::DragDropTypes::DragEventSource source);
+                    ui::mojom::DragEventSource source);
 
   // Returns the view that requested the current drag operation via
   // RunShellDrag(), or NULL if there is no such view or drag operation.