diff --git a/DEPS b/DEPS
index 35cfd74..0422008 100644
--- a/DEPS
+++ b/DEPS
@@ -40,7 +40,7 @@
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling Skia
   # and whatever else without interference from each other.
-  'skia_revision': '05fd8cf08970763832d6690ca1823168dd6f071f',
+  'skia_revision': 'a9d9ab368318cd948ca6ce2796f69ef95e7c1f1a',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling V8
   # and whatever else without interference from each other.
@@ -72,7 +72,7 @@
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling BoringSSL
   # and whatever else without interference from each other.
-  'boringssl_revision': 'ddfcc6a60bec2040b4c3668d76c0f2455ecb5594',
+  'boringssl_revision': '1e5cb820de99c754b57ab4321e1456ac6bdc1a78',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling google-toolbox-for-mac
   # and whatever else without interference from each other.
@@ -96,7 +96,7 @@
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling catapult
   # and whatever else without interference from each other.
-  'catapult_revision': '6adf18ab78fe7f20638206d2ca6ecd3d58efd9c9',
+  'catapult_revision': '59e58189c55d9c5cc0e8e30bad254b7eb2e99634',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling libFuzzer
   # and whatever else without interference from each other.
diff --git a/base/trace_event/memory_dump_manager.cc b/base/trace_event/memory_dump_manager.cc
index 8d307cef..32c93f7 100644
--- a/base/trace_event/memory_dump_manager.cc
+++ b/base/trace_event/memory_dump_manager.cc
@@ -173,11 +173,18 @@
 }
 
 MemoryDumpManager::~MemoryDumpManager() {
-  AutoLock lock(lock_);
-  if (dump_thread_) {
-    dump_thread_->Stop();
-    dump_thread_.reset();
+  Thread* dump_thread = nullptr;
+  {
+    AutoLock lock(lock_);
+    if (dump_thread_) {
+      dump_thread = dump_thread_.get();
+    }
   }
+  if (dump_thread) {
+    dump_thread->Stop();
+  }
+  AutoLock lock(lock_);
+  dump_thread_.reset();
 }
 
 void MemoryDumpManager::EnableHeapProfilingIfNeeded() {
diff --git a/base/win/scoped_comptr.h b/base/win/scoped_comptr.h
index e1535ca..8d3c9315 100644
--- a/base/win/scoped_comptr.h
+++ b/base/win/scoped_comptr.h
@@ -93,8 +93,8 @@
   // Retrieves the pointer address.
   // Used to receive object pointers as out arguments (and take ownership).
   // The function DCHECKs on the current value being NULL.
-  // Usage: Foo(p.Receive());
-  Interface** Receive() {
+  // Usage: Foo(p.GetAddressOf());
+  Interface** GetAddressOf() {
     DCHECK(!ptr_) << "Object leak. Pointer must be NULL";
     return &ptr_;
   }
@@ -120,7 +120,7 @@
   // error code from the other->QueryInterface operation.
   HRESULT QueryFrom(IUnknown* object) {
     DCHECK(object);
-    return object->QueryInterface(IID_PPV_ARGS(Receive()));
+    return object->QueryInterface(IID_PPV_ARGS(GetAddressOf()));
   }
 
   // Convenience wrapper around CoCreateInstance
@@ -224,7 +224,7 @@
 
   // ComPtr equivalent conversion operators.
   operator void**() const {
-    return reinterpret_cast<void**>(scoped_com_ptr_->Receive());
+    return reinterpret_cast<void**>(scoped_com_ptr_->GetAddressOf());
   }
 
   // Allows ScopedComPtr to be passed to functions as a pointer.
diff --git a/base/win/scoped_comptr_unittest.cc b/base/win/scoped_comptr_unittest.cc
index 0d486bd3..2493433 100644
--- a/base/win/scoped_comptr_unittest.cc
+++ b/base/win/scoped_comptr_unittest.cc
@@ -46,7 +46,7 @@
   EXPECT_TRUE(unk2.Get() != NULL);
 
   ScopedComPtr<IMalloc> mem_alloc;
-  EXPECT_TRUE(SUCCEEDED(CoGetMalloc(1, mem_alloc.Receive())));
+  EXPECT_TRUE(SUCCEEDED(CoGetMalloc(1, mem_alloc.GetAddressOf())));
 
   ScopedComPtr<IUnknown> qi_test;
   EXPECT_HRESULT_SUCCEEDED(mem_alloc.CopyTo(IID_PPV_ARGS(&qi_test)));
diff --git a/cc/README.md b/cc/README.md
index 2a18e21..cfee0ba 100644
--- a/cc/README.md
+++ b/cc/README.md
@@ -1,15 +1,49 @@
 # cc/
 
-This directory contains a compositor. Its clients include blink and the browser
-UI.
+This directory contains a compositor, used in both the renderer and the
+browser.  In the renderer, Blink is the client.  In the browser, both
+ui and Android browser compositor are the clients.
+
+The public API of the compositor is LayerTreeHost and Layer and its
+derived types.  Embedders create a LayerTreeHost (single, multithreaded,
+or synchronous) and then attach a tree of Layers to it.
+
+When Layers are updated they request a commit, which takes the data
+of and structure of the tree of Layers and the data of its host and
+atomically pushes it to a tree of LayerImpls and a LayerTreeHostImpl
+and LayerTreeImpl.  The main thread (which owns the tree of Layers
+and the embedder) is blocked during this commit operation.
+
+The commit is from the main thread Layer tree to the pending tree in
+multithreaded mode.  The pending tree is a staging tree for
+rasterization.  When enough rasterization has completed for
+invalidations and the pending tree is ready to activate.  Activate is an
+analogous operation to commit, and pushes data from the pending tree to
+the active tree.  The pending tree exists so that all the of the updates
+from the main thread can be displayed to the user atomically while
+the previous frame can be scrolled or animated.
+
+The single threaded compositor commits directly to the active
+tree and then stops drawing until the content is ready to be drawn.
+
+The active tree is responsible for drawing.  The Scheduler and its
+SchedulerStateMachine decide when to draw (along with when to commit,
+etc etc).  "Drawing" in a compositor consists of LayerImpl::AppendQuads
+which batches up a set of DrawQuads and RenderPasses into a
+CompositorFrame which is sent via a CompositorFrameSink.
+
+CompositorFrames from individual compositors are sent to the
+SurfaceManager (currently in the browser process).  The
+SurfaceAggregator combines all CompositorFrames together and asks
+the Display to finally draw the frame via Renderer, which is either
+a GLRenderer or a SoftwareRenderer, which finally draws the entire
+composited browser contents into a backbuffer or a bitmap, respectively.
 
 Design documents for the graphics stack can be found at
 [chromium-graphics](https://www.chromium.org/developers/design-documents/chromium-graphics).
 
 ## Glossaries
 
-### Stacked elements and stacking contexts
-
 ### Active CompositorFrame
 
 ### Active Tree
@@ -41,8 +75,13 @@
 for various backends, currently GL or Software.
 
 ### Layer
+A conceptual piece of content that can appear on screen and has some known
+position with respect to the viewport.  The Layer class only is used on the
+main thread.  This, along with LayerTreeHost, is the main API for the
+compositor.
 
 ### LayerImpl
+The same as Layer, but on the compositor thread.
 
 ### LayerTree
 
@@ -107,10 +146,41 @@
 final output into a single physical output.
 
 ### Invalidation
+Invalidation is a unit of content update.  Any content updates from
+Blink or ui must be accompanied by an invalidation to tell the compositor
+that a piece of content must be rerasterized.  For example, if a 10x10
+div with a background color has its width increased by 5 pixels, then
+there will be a 5x10 invalidation (at least) for the new space covered
+by the larger div.
+
+Ideally, invalidations represent the minimum amount of content that must
+be rerastered from the previous frame.  They are passed to the compositor
+via Layer::SetNeedsDisplay(Rect).  Invalidation is tracked both to
+minimize the amount of raster work needed, but also to allow for
+partial raster of Tiles.  Invalidations also eventually become damage.
 
 ### Damage
+Damage is the equivalent of invalidation, but for the final display.
+As invalidation is the difference between two frames worth of content,
+damage is the difference between two CompositorFrames.  Damage is
+tracked via the DamageTracker.  This allows for partial swap, where
+only the parts of the final CompositorFrame that touch the screen
+are drawn, and only that drawn portion is swapped, which saves quite
+a bit of power for small bits of damage.
+
+Invalidation creates damage, in that if a piece of content updates, then
+that content invalidation creates damage on screen.  Other things that
+cause damage are analogous operations to invalidations, but on Layers.
+For example, moving a Layer around, changing properties of Layers (e.g.
+opacity), and adding/removing/reordering Layers will all create damage
+(aka screen updates) but do not create invalidations (aka raster work).
 
 ### Tiles
+An abstraction of a piece of content of a Layer.  A tile may be
+rasterized or not.  It may be known to be a solid color or not.
+A PictureLayerImpl indirectly owns a sparse set of Tiles to
+represent its rasterizable content.  When tiles are invalidated,
+they are replaced with new tiles.
 
 ### Prepare Tiles
 Prioritize and schedule needed tiles for raster. This is the entry point to a
diff --git a/cc/output/software_renderer.cc b/cc/output/software_renderer.cc
index bb80108..34eda97f 100644
--- a/cc/output/software_renderer.cc
+++ b/cc/output/software_renderer.cc
@@ -99,19 +99,10 @@
 
 void SoftwareRenderer::EnsureScissorTestEnabled() {
   is_scissor_enabled_ = true;
-  SetClipRect(scissor_rect_);
 }
 
 void SoftwareRenderer::EnsureScissorTestDisabled() {
-  // There is no explicit notion of enabling/disabling scissoring in software
-  // rendering, but the underlying effect we want is to clear any existing
-  // clipRect on the current SkCanvas. This is done by setting clipRect to
-  // the viewport's dimensions.
-  if (!current_canvas_)
-    return;
   is_scissor_enabled_ = false;
-  SkISize size = current_canvas_->getBaseLayerSize();
-  SetClipRect(gfx::Rect(size.width(), size.height()));
 }
 
 void SoftwareRenderer::BindFramebufferToOutputSurface() {
@@ -140,7 +131,6 @@
 void SoftwareRenderer::SetScissorTestRect(const gfx::Rect& scissor_rect) {
   is_scissor_enabled_ = true;
   scissor_rect_ = scissor_rect;
-  SetClipRect(scissor_rect);
 }
 
 void SoftwareRenderer::SetClipRect(const gfx::Rect& rect) {
@@ -149,9 +139,13 @@
   // Skia applies the current matrix to clip rects so we reset it temporary.
   SkMatrix current_matrix = current_canvas_->getTotalMatrix();
   current_canvas_->resetMatrix();
-  // TODO(fmalita) stop using kReplace (see crbug.com/673851)
-  current_canvas_->clipRect(gfx::RectToSkRect(rect),
-                            SkClipOp::kReplace_deprecated);
+  // SetClipRect is assumed to be applied temporarily, on an
+  // otherwise-unclipped canvas.
+  DCHECK_EQ(current_canvas_->getDeviceClipBounds().width(),
+            current_canvas_->imageInfo().width());
+  DCHECK_EQ(current_canvas_->getDeviceClipBounds().height(),
+            current_canvas_->imageInfo().height());
+  current_canvas_->clipRect(gfx::RectToSkRect(rect));
   current_canvas_->setMatrix(current_matrix);
 }
 
@@ -208,11 +202,14 @@
                                   const gfx::QuadF* draw_region) {
   if (!current_canvas_)
     return;
-  if (draw_region) {
-    current_canvas_->save();
-  }
 
   TRACE_EVENT0("cc", "SoftwareRenderer::DoDrawQuad");
+  bool do_save = draw_region || is_scissor_enabled_;
+  SkAutoCanvasRestore canvas_restore(current_canvas_, do_save);
+  if (is_scissor_enabled_) {
+    SetClipRect(scissor_rect_);
+  }
+
   gfx::Transform quad_rect_matrix;
   QuadRectTransform(&quad_rect_matrix,
                     quad->shared_quad_state->quad_to_target_transform,
@@ -298,9 +295,6 @@
   }
 
   current_canvas_->resetMatrix();
-  if (draw_region) {
-    current_canvas_->restore();
-  }
 }
 
 void SoftwareRenderer::DrawDebugBorderQuad(const DebugBorderDrawQuad* quad) {
diff --git a/cc/output/software_renderer_unittest.cc b/cc/output/software_renderer_unittest.cc
index b6867fe7..19a68ca6 100644
--- a/cc/output/software_renderer_unittest.cc
+++ b/cc/output/software_renderer_unittest.cc
@@ -27,6 +27,7 @@
 #include "testing/gmock/include/gmock/gmock.h"
 #include "testing/gtest/include/gtest/gtest.h"
 #include "third_party/skia/include/core/SkCanvas.h"
+#include "third_party/skia/include/utils/SkNWayCanvas.h"
 #include "ui/gfx/skia_util.h"
 
 namespace cc {
@@ -378,26 +379,45 @@
                              interior_visible_rect.bottom() - 1));
 }
 
+class ClipTrackingCanvas : public SkNWayCanvas {
+ public:
+  ClipTrackingCanvas(int width, int height) : SkNWayCanvas(width, height) {}
+  void onClipRect(const SkRect& rect,
+                  SkClipOp op,
+                  ClipEdgeStyle style) override {
+    last_clip_rect_ = rect;
+    SkNWayCanvas::onClipRect(rect, op, style);
+  }
+
+  SkRect last_clip_rect() const { return last_clip_rect_; }
+
+ private:
+  SkRect last_clip_rect_;
+};
+
 class PartialSwapSoftwareOutputDevice : public SoftwareOutputDevice {
  public:
   // SoftwareOutputDevice overrides.
   SkCanvas* BeginPaint(const gfx::Rect& damage_rect) override {
     damage_rect_at_start_ = damage_rect;
-    canvas_ = SoftwareOutputDevice::BeginPaint(damage_rect);
-    return canvas_;
+    canvas_.reset(new ClipTrackingCanvas(viewport_pixel_size_.width(),
+                                         viewport_pixel_size_.height()));
+    canvas_->addCanvas(SoftwareOutputDevice::BeginPaint(damage_rect));
+    return canvas_.get();
   }
+
   void EndPaint() override {
-    clip_rect_at_end_ = gfx::SkIRectToRect(canvas_->getDeviceClipBounds());
+    clip_rect_at_end_ = gfx::SkRectToRectF(canvas_->last_clip_rect());
     SoftwareOutputDevice::EndPaint();
   }
 
   gfx::Rect damage_rect_at_start() const { return damage_rect_at_start_; }
-  gfx::Rect clip_rect_at_end() const { return clip_rect_at_end_; }
+  gfx::RectF clip_rect_at_end() const { return clip_rect_at_end_; }
 
  private:
-  SkCanvas* canvas_ = nullptr;
+  std::unique_ptr<ClipTrackingCanvas> canvas_;
   gfx::Rect damage_rect_at_start_;
-  gfx::Rect clip_rect_at_end_;
+  gfx::RectF clip_rect_at_end_;
 };
 
 TEST_F(SoftwareRendererTest, PartialSwap) {
@@ -428,7 +448,7 @@
   // The damage rect should be reported to the SoftwareOutputDevice.
   EXPECT_EQ(gfx::Rect(2, 2, 3, 3), device->damage_rect_at_start());
   // The SkCanvas should be clipped to the damage rect.
-  EXPECT_EQ(gfx::Rect(2, 2, 3, 3), device->clip_rect_at_end());
+  EXPECT_EQ(gfx::RectF(2, 2, 3, 3), device->clip_rect_at_end());
 }
 
 }  // namespace
diff --git a/cc/surfaces/referenced_surface_tracker.cc b/cc/surfaces/referenced_surface_tracker.cc
index 5e440d8..1922a77 100644
--- a/cc/surfaces/referenced_surface_tracker.cc
+++ b/cc/surfaces/referenced_surface_tracker.cc
@@ -36,49 +36,36 @@
     referenced_surfaces_.clear();
   }
 
-  std::unordered_set<SurfaceId, SurfaceIdHash> referenced_surface_set;
+  base::flat_set<SurfaceId> new_referenced_surfaces;
   if (active_referenced_surfaces) {
-    referenced_surface_set.insert(active_referenced_surfaces->begin(),
-                                  active_referenced_surfaces->end());
+    new_referenced_surfaces = base::flat_set<SurfaceId>(
+        active_referenced_surfaces->begin(), active_referenced_surfaces->end(),
+        base::KEEP_FIRST_OF_DUPES);
   }
+  FindReferenceDiff(new_referenced_surfaces);
 
-  ProcessNewReferences(referenced_surface_set);
+  if (!references_to_add_.empty() || !references_to_remove_.empty())
+    swap(referenced_surfaces_, new_referenced_surfaces);
 }
 
-void ReferencedSurfaceTracker::ProcessNewReferences(
-    const std::unordered_set<SurfaceId, SurfaceIdHash>&
-        new_referenced_surfaces) {
-  // Removed references for each SurfaceId in |referenced_surfaces_| if they
-  // aren't referenced anymore. Removing from a set invalidates iterators, so
-  // create a new vector then remove everything in it.
-  std::vector<SurfaceId> not_referenced;
+void ReferencedSurfaceTracker::FindReferenceDiff(
+    const base::flat_set<SurfaceId>& new_referenced_surfaces) {
+  // Find SurfaceIds in |referenced_surfaces_| that aren't referenced anymore.
   for (const SurfaceId& surface_id : referenced_surfaces_) {
-    if (new_referenced_surfaces.count(surface_id) == 0)
-      not_referenced.push_back(surface_id);
+    if (new_referenced_surfaces.count(surface_id) == 0) {
+      references_to_remove_.push_back(
+          SurfaceReference(current_surface_id_, surface_id));
+    }
   }
-  for (const SurfaceId& surface_id : not_referenced)
-    RemoveSurfaceReference(surface_id);
 
-  // Add references for each SurfaceId in |new_referenced_surfaces| if they
-  // aren't already referenced.
+  // Find SurfaceIds in |new_referenced_surfaces| that aren't already
+  // referenced.
   for (const SurfaceId& surface_id : new_referenced_surfaces) {
-    if (referenced_surfaces_.count(surface_id) == 0)
-      AddSurfaceReference(surface_id);
+    if (referenced_surfaces_.count(surface_id) == 0) {
+      references_to_add_.push_back(
+          SurfaceReference(current_surface_id_, surface_id));
+    }
   }
 }
 
-void ReferencedSurfaceTracker::AddSurfaceReference(
-    const SurfaceId& surface_id) {
-  references_to_add_.push_back(
-      SurfaceReference(current_surface_id_, surface_id));
-  referenced_surfaces_.insert(surface_id);
-}
-
-void ReferencedSurfaceTracker::RemoveSurfaceReference(
-    const SurfaceId& surface_id) {
-  references_to_remove_.push_back(
-      SurfaceReference(current_surface_id_, surface_id));
-  referenced_surfaces_.erase(surface_id);
-}
-
 }  // namespace cc
diff --git a/cc/surfaces/referenced_surface_tracker.h b/cc/surfaces/referenced_surface_tracker.h
index bfb3f3c7..ffe98984 100644
--- a/cc/surfaces/referenced_surface_tracker.h
+++ b/cc/surfaces/referenced_surface_tracker.h
@@ -5,9 +5,9 @@
 #ifndef CC_SURFACES_REFERENCED_SURFACE_TRACKER_H_
 #define CC_SURFACES_REFERENCED_SURFACE_TRACKER_H_
 
-#include <unordered_set>
 #include <vector>
 
+#include "base/containers/flat_set.h"
 #include "base/macros.h"
 #include "cc/surfaces/frame_sink_id.h"
 #include "cc/surfaces/surface_id.h"
@@ -44,24 +44,18 @@
       const std::vector<SurfaceId>* active_referenced_surfaces);
 
  private:
-  // Updates |referenced_surfaces_| based on a |new_referenced_surfaces| from a
-  // CompositorFrame. Populates |references_to_add_| and |references_to_remove_|
-  // based on the difference between the sets.
-  void ProcessNewReferences(const std::unordered_set<SurfaceId, SurfaceIdHash>&
-                                new_referenced_surfaces);
-
-  // Adds reference from |current_surface_id_| to |surface_id|.
-  void AddSurfaceReference(const SurfaceId& surface_id);
-
-  // Removes reference from |current_surface_id_| to |surface_id|.
-  void RemoveSurfaceReference(const SurfaceId& surface_id);
+  // Finds the difference between original |referenced_surfaces_| and new
+  // |new_referenced_surfaces|. Populates |references_to_add_| and
+  // |references_to_remove_| based on the difference between the sets.
+  void FindReferenceDiff(
+      const base::flat_set<SurfaceId>& new_referenced_surfaces);
 
   // The id of the client surface that is embedding other surfaces.
   SurfaceId current_surface_id_;
 
-  // TODO(samans): Use the same SurfaceId set that SurfaceManager holds.
+  // TODO(kylechar): Use the same SurfaceId set that SurfaceManager holds.
   // Set of surfaces referenced by the last submitted CompositorFrame.
-  std::unordered_set<SurfaceId, SurfaceIdHash> referenced_surfaces_;
+  base::flat_set<SurfaceId> referenced_surfaces_;
 
   // References to surfaces that should be added for the next CompositorFrame.
   std::vector<SurfaceReference> references_to_add_;
diff --git a/cc/surfaces/surface_manager.h b/cc/surfaces/surface_manager.h
index 86a1064b..293f4c8 100644
--- a/cc/surfaces/surface_manager.h
+++ b/cc/surfaces/surface_manager.h
@@ -13,6 +13,7 @@
 #include <unordered_set>
 #include <vector>
 
+#include "base/containers/flat_set.h"
 #include "base/logging.h"
 #include "base/macros.h"
 #include "base/memory/weak_ptr.h"
@@ -254,11 +255,11 @@
   // Tracks references from the child surface to parent surface. If there are
   // zero entries in the set for a SurfaceId then nothing is referencing the
   // surface and it can be garbage collected.
-  std::unordered_map<SurfaceId, SurfaceIdSet, SurfaceIdHash>
+  std::unordered_map<SurfaceId, base::flat_set<SurfaceId>, SurfaceIdHash>
       child_to_parent_refs_;
   // Tracks references from the parent surface to child surface. Is the inverse
   // of |child_to_parent_refs_|.
-  std::unordered_map<SurfaceId, SurfaceIdSet, SurfaceIdHash>
+  std::unordered_map<SurfaceId, base::flat_set<SurfaceId>, SurfaceIdHash>
       parent_to_child_refs_;
 
   // Root SurfaceId that references display root surfaces. There is no Surface
diff --git a/cc/surfaces/surface_manager_ref_unittest.cc b/cc/surfaces/surface_manager_ref_unittest.cc
index de66181..a8969ac 100644
--- a/cc/surfaces/surface_manager_ref_unittest.cc
+++ b/cc/surfaces/surface_manager_ref_unittest.cc
@@ -7,6 +7,7 @@
 #include <unordered_map>
 #include <vector>
 
+#include "base/containers/flat_set.h"
 #include "base/memory/ptr_util.h"
 #include "cc/surfaces/compositor_frame_sink_support.h"
 #include "cc/surfaces/surface.h"
@@ -81,13 +82,13 @@
   }
 
   // Returns all the references where |surface_id| is the parent.
-  const SurfaceManager::SurfaceIdSet& GetReferencesFrom(
+  const base::flat_set<SurfaceId>& GetReferencesFrom(
       const SurfaceId& surface_id) {
     return manager().parent_to_child_refs_[surface_id];
   }
 
   // Returns all the references where |surface_id| is the child.
-  const SurfaceManager::SurfaceIdSet& GetReferencesFor(
+  const base::flat_set<SurfaceId>& GetReferencesFor(
       const SurfaceId& surface_id) {
     return manager().child_to_parent_refs_[surface_id];
   }
diff --git a/cc/surfaces/surface_synchronization_unittest.cc b/cc/surfaces/surface_synchronization_unittest.cc
index 8c21486..5fa37ccf 100644
--- a/cc/surfaces/surface_synchronization_unittest.cc
+++ b/cc/surfaces/surface_synchronization_unittest.cc
@@ -2,6 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+#include "base/containers/flat_set.h"
 #include "cc/surfaces/compositor_frame_sink_support.h"
 #include "cc/surfaces/surface_id.h"
 #include "cc/surfaces/surface_manager.h"
@@ -82,7 +83,7 @@
   SurfaceManager& surface_manager() { return surface_manager_; }
 
   // Returns all the references where |surface_id| is the parent.
-  const SurfaceManager::SurfaceIdSet& GetChildReferences(
+  const base::flat_set<SurfaceId>& GetChildReferences(
       const SurfaceId& surface_id) {
     return surface_manager().parent_to_child_refs_[surface_id];
   }
diff --git a/chrome/android/java/src/org/chromium/chrome/browser/ChromeTabbedActivity.java b/chrome/android/java/src/org/chromium/chrome/browser/ChromeTabbedActivity.java
index 9e158aec..3d4d4ba3 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/ChromeTabbedActivity.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/ChromeTabbedActivity.java
@@ -716,8 +716,9 @@
                         Profile.getLastUsedProfile());
         if (!tracker.shouldTriggerHelpUI(FeatureConstants.DOWNLOAD_HOME_FEATURE)) return;
 
-        ViewAnchoredTextBubble textBubble = new ViewAnchoredTextBubble(
-                this, getToolbarManager().getMenuAnchor(), R.string.iph_download_home_text);
+        ViewAnchoredTextBubble textBubble = new ViewAnchoredTextBubble(this,
+                getToolbarManager().getMenuAnchor(), R.string.iph_download_home_text,
+                R.string.iph_download_home_accessibility_text);
         textBubble.setDismissOnTouchInteraction(true);
         textBubble.addOnDismissListener(new OnDismissListener() {
             @Override
diff --git a/chrome/android/java/src/org/chromium/chrome/browser/download/DownloadManagerService.java b/chrome/android/java/src/org/chromium/chrome/browser/download/DownloadManagerService.java
index a8cbe5e..541036dd 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/download/DownloadManagerService.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/download/DownloadManagerService.java
@@ -13,6 +13,7 @@
 import android.content.SharedPreferences;
 import android.database.Cursor;
 import android.net.ConnectivityManager;
+import android.net.NetworkInfo;
 import android.net.Uri;
 import android.os.AsyncTask;
 import android.os.Environment;
@@ -373,6 +374,39 @@
         }
         updateDownloadProgress(item, status);
         scheduleUpdateIfNeeded();
+
+        if (!isAutoResumable || sIsNetworkListenerDisabled) return;
+        ConnectivityManager cm =
+                (ConnectivityManager) mContext.getSystemService(Context.CONNECTIVITY_SERVICE);
+        NetworkInfo info = cm.getActiveNetworkInfo();
+        if (info == null || !info.isConnected()) return;
+        DownloadProgress progress = mDownloadProgressMap.get(item.getId());
+        if (progress.mCanDownloadWhileMetered && !isActiveNetworkMetered(mContext)) {
+            // Normally the download will automatically resume when network is reconnected.
+            // However, if there are multiple network connections and the interruption is caused
+            // by switching between active networks, onConnectionTypeChanged() will not get called.
+            // As a result, we should resume immediately.
+            // TODO(qinmin): Handle the case if the interruption is caused by switching between
+            // 2 metered networks or 2 non-metered networks on device with multiple antennas.
+            scheduleDownloadResumption(item);
+        }
+    }
+
+    /**
+     * Helper method to schedule a download for resumption.
+     * @param item DownloadItem to resume.
+     */
+    private void scheduleDownloadResumption(final DownloadItem item) {
+        removeAutoResumableDownload(item.getId());
+        // Post a delayed task to avoid an issue that when connectivity status just changed
+        // to CONNECTED, immediately establishing a connection will sometimes fail.
+        mHandler.postDelayed(new Runnable() {
+            @Override
+            public void run() {
+                resumeDownload(LegacyHelpers.buildLegacyContentId(false, item.getId()),
+                        item, false);
+            }
+        }, mUpdateDelayInMillis);
     }
 
     /**
@@ -1524,24 +1558,16 @@
         if (mAutoResumableDownloadIds.isEmpty()) return;
         if (connectionType == ConnectionType.CONNECTION_NONE) return;
         boolean isMetered = isActiveNetworkMetered(mContext);
-        Iterator<String> iterator = mAutoResumableDownloadIds.iterator();
+        // Make a copy of |mAutoResumableDownloadIds| as scheduleDownloadResumption() may delete
+        // elements inside the array.
+        List<String> copies = new ArrayList<String>(mAutoResumableDownloadIds);
+        Iterator<String> iterator = copies.iterator();
         while (iterator.hasNext()) {
             final String id = iterator.next();
             final DownloadProgress progress = mDownloadProgressMap.get(id);
             // Introduce some delay in each resumption so we don't start all of them immediately.
             if (progress != null && (progress.mCanDownloadWhileMetered || !isMetered)) {
-                // Remove the pending resumable item so that the task won't be posted again on the
-                // next connectivity change.
-                iterator.remove();
-                // Post a delayed task to avoid an issue that when connectivity status just changed
-                // to CONNECTED, immediately establishing a connection will sometimes fail.
-                mHandler.postDelayed(new Runnable() {
-                    @Override
-                    public void run() {
-                        resumeDownload(LegacyHelpers.buildLegacyContentId(false, id),
-                                progress.mDownloadItem, false);
-                    }
-                }, mUpdateDelayInMillis);
+                scheduleDownloadResumption(progress.mDownloadItem);
             }
         }
         stopListenToConnectionChangeIfNotNeeded();
diff --git a/chrome/android/java/src/org/chromium/chrome/browser/infobar/IPHInfoBarSupport.java b/chrome/android/java/src/org/chromium/chrome/browser/infobar/IPHInfoBarSupport.java
index 595583a0..2d9bcf5 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/infobar/IPHInfoBarSupport.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/infobar/IPHInfoBarSupport.java
@@ -34,9 +34,11 @@
 
     /** Helper class to hold all relevant display parameters for an in-product help window. */
     private static class TrackerParameters {
-        public TrackerParameters(String feature, @StringRes int textId) {
+        public TrackerParameters(
+                String feature, @StringRes int textId, @StringRes int accessibilityTextId) {
             this.feature = feature;
             this.textId = textId;
+            this.accessibilityTextId = accessibilityTextId;
         }
 
         /** @see FeatureConstants */
@@ -44,6 +46,9 @@
 
         @StringRes
         public int textId;
+
+        @StringRes
+        public int accessibilityTextId;
     }
 
     /** Helper class to manage state relating to a particular instance of an in-product window. */
@@ -103,7 +108,8 @@
 
         mCurrentState = new PopupState();
         mCurrentState.view = view;
-        mCurrentState.bubble = new ViewAnchoredTextBubble(mContext, view, params.textId);
+        mCurrentState.bubble = new ViewAnchoredTextBubble(
+                mContext, view, params.textId, params.accessibilityTextId);
         mCurrentState.bubble.addOnDismissListener(this);
         mCurrentState.bubble.setDismissOnTouchInteraction(true);
         mCurrentState.bubble.show();
@@ -153,8 +159,8 @@
     private TrackerParameters getTrackerParameters(Item infoBar) {
         switch (infoBar.getInfoBarIdentifier()) {
             case InfoBarIdentifier.DATA_REDUCTION_PROXY_PREVIEW_INFOBAR_DELEGATE:
-                return new TrackerParameters(
-                        FeatureConstants.DATA_SAVER_PREVIEW, R.string.iph_data_saver_preview_text);
+                return new TrackerParameters(FeatureConstants.DATA_SAVER_PREVIEW,
+                        R.string.iph_data_saver_preview_text, R.string.iph_data_saver_preview_text);
             default:
                 return null;
         }
diff --git a/chrome/android/java/src/org/chromium/chrome/browser/locale/LocaleManager.java b/chrome/android/java/src/org/chromium/chrome/browser/locale/LocaleManager.java
index 7643090..06f2f9c 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/locale/LocaleManager.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/locale/LocaleManager.java
@@ -14,6 +14,7 @@
 import org.chromium.base.ContextUtils;
 import org.chromium.base.ThreadUtils;
 import org.chromium.base.VisibleForTesting;
+import org.chromium.base.annotations.CalledByNative;
 import org.chromium.chrome.R;
 import org.chromium.chrome.browser.AppHooks;
 import org.chromium.chrome.browser.ChromeFeatureList;
@@ -87,6 +88,7 @@
     /**
      * @return An instance of the {@link LocaleManager}. This should only be called on UI thread.
      */
+    @CalledByNative
     public static LocaleManager getInstance() {
         assert ThreadUtils.runningOnUiThread();
         if (sInstance == null) {
@@ -274,6 +276,14 @@
     }
 
     /**
+     * @return The referral ID to be passed when searching with Yandex as the DSE.
+     */
+    @CalledByNative
+    protected String getYandexReferralId() {
+        return "";
+    }
+
+    /**
      * To be called after the user has made a selection from a search engine promo dialog.
      * @param type The type of search engine promo dialog that was shown.
      * @param keyword The keyword for the search engine chosen.
diff --git a/chrome/android/java/src/org/chromium/chrome/browser/toolbar/TabSwitcherCallout.java b/chrome/android/java/src/org/chromium/chrome/browser/toolbar/TabSwitcherCallout.java
index bbef949..a8dbcf9 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/toolbar/TabSwitcherCallout.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/toolbar/TabSwitcherCallout.java
@@ -37,8 +37,8 @@
         if (!isTabSwitcherCalloutNecessary()) return null;
         setIsTabSwitcherCalloutNecessary(false);
 
-        ViewAnchoredTextBubble bubble = new ViewAnchoredTextBubble(
-                context, tabSwitcherButton, R.string.tab_switcher_callout_body);
+        ViewAnchoredTextBubble bubble = new ViewAnchoredTextBubble(context, tabSwitcherButton,
+                R.string.tab_switcher_callout_body, R.string.tab_switcher_callout_body);
         bubble.setDismissOnTouchInteraction(true);
         bubble.setAutoDismissTimeout(TAB_SWITCHER_CALLOUT_DISMISS_MS);
         int yInsetPx = (int) (Y_OVERLAP_DP * context.getResources().getDisplayMetrics().density);
diff --git a/chrome/android/java/src/org/chromium/chrome/browser/toolbar/ToolbarManager.java b/chrome/android/java/src/org/chromium/chrome/browser/toolbar/ToolbarManager.java
index 6477a20..f2a2751 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/toolbar/ToolbarManager.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/toolbar/ToolbarManager.java
@@ -526,7 +526,8 @@
                 if (!tracker.shouldTriggerHelpUI(FeatureConstants.DOWNLOAD_PAGE_FEATURE)) return;
 
                 mTextBubble = new ViewAnchoredTextBubble(mToolbar.getContext(), getMenuAnchor(),
-                        R.string.iph_download_page_for_offline_usage_text);
+                        R.string.iph_download_page_for_offline_usage_text,
+                        R.string.iph_download_page_for_offline_usage_accessibility_text);
                 mTextBubble.setDismissOnTouchInteraction(true);
                 mTextBubble.addOnDismissListener(new OnDismissListener() {
                     @Override
diff --git a/chrome/android/java/src/org/chromium/chrome/browser/widget/bottomsheet/BottomSheet.java b/chrome/android/java/src/org/chromium/chrome/browser/widget/bottomsheet/BottomSheet.java
index 3cc5f37..8f7cbfb 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/widget/bottomsheet/BottomSheet.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/widget/bottomsheet/BottomSheet.java
@@ -1168,8 +1168,9 @@
         SharedPreferences preferences = ContextUtils.getAppSharedPreferences();
         if (preferences.getBoolean(BOTTOM_SHEET_HELP_BUBBLE_SHOWN, false)) return;
 
-        ViewAnchoredTextBubble helpBubble = new ViewAnchoredTextBubble(
-                getContext(), mControlContainer, R.string.bottom_sheet_help_bubble_message);
+        ViewAnchoredTextBubble helpBubble = new ViewAnchoredTextBubble(getContext(),
+                mControlContainer, R.string.bottom_sheet_help_bubble_message,
+                R.string.bottom_sheet_help_bubble_message);
         int inset = getContext().getResources().getDimensionPixelSize(
                 R.dimen.bottom_sheet_help_bubble_inset);
         helpBubble.setInsetPx(0, inset, 0, inset);
diff --git a/chrome/android/java/src/org/chromium/chrome/browser/widget/textbubble/TextBubble.java b/chrome/android/java/src/org/chromium/chrome/browser/widget/textbubble/TextBubble.java
index bc5e7b0..7473465 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/widget/textbubble/TextBubble.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/widget/textbubble/TextBubble.java
@@ -25,6 +25,7 @@
 import org.chromium.base.ApiCompatibilityUtils;
 import org.chromium.base.ObserverList;
 import org.chromium.chrome.R;
+import org.chromium.chrome.browser.util.AccessibilityUtil;
 import org.chromium.chrome.browser.util.MathUtils;
 
 /**
@@ -106,16 +107,23 @@
     @StringRes
     private final int mStringId;
 
+    /** The resource id for the accessibility string associated with the bubble. */
+    @StringRes
+    private final int mAccessibilityStringId;
+
     /**
      * Constructs a {@link TextBubble} instance.
      * @param context  Context to draw resources from.
      * @param rootView The {@link View} to use for size calculations and for display.
      * @param stringId The id of the string resource for the text that should be shown.
+     * @param accessibilityStringId The id of the string resource of the accessibility text.
      */
-    public TextBubble(Context context, View rootView, @StringRes int stringId) {
+    public TextBubble(Context context, View rootView, @StringRes int stringId,
+            @StringRes int accessibilityStringId) {
         mContext = context;
         mRootView = rootView.getRootView();
         mStringId = stringId;
+        mAccessibilityStringId = accessibilityStringId;
         mPopupWindow = new PopupWindow(mContext);
         mDrawable = new ArrowBubbleDrawable(context);
         mHandler = new Handler();
@@ -310,7 +318,9 @@
         if (mPopupWindow.getContentView() != null) return;
 
         View view = LayoutInflater.from(mContext).inflate(R.layout.textbubble_text, null);
-        ((TextView) view).setText(mStringId);
+        ((TextView) view)
+                .setText(AccessibilityUtil.isAccessibilityEnabled() ? mAccessibilityStringId
+                                                                    : mStringId);
         mPopupWindow.setContentView(view);
 
         // On some versions of Android, the LayoutParams aren't set until after the popup window
diff --git a/chrome/android/java/src/org/chromium/chrome/browser/widget/textbubble/ViewAnchoredTextBubble.java b/chrome/android/java/src/org/chromium/chrome/browser/widget/textbubble/ViewAnchoredTextBubble.java
index 816acb3c..2895a79 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/widget/textbubble/ViewAnchoredTextBubble.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/widget/textbubble/ViewAnchoredTextBubble.java
@@ -38,9 +38,11 @@
      * @param context    Context to draw resources from.
      * @param anchorView The {@link View} to anchor to.
      * @param stringId The id of the string resource for the text that should be shown.
+     * @param accessibilityStringId The id of the string resource of the accessibility text.
      */
-    public ViewAnchoredTextBubble(Context context, View anchorView, @StringRes int stringId) {
-        super(context, anchorView.getRootView(), stringId);
+    public ViewAnchoredTextBubble(Context context, View anchorView, @StringRes int stringId,
+            @StringRes int accessibilityStringId) {
+        super(context, anchorView.getRootView(), stringId, accessibilityStringId);
         mAnchorView = anchorView;
 
         mViewPositionObserver = new ViewPositionObserver(mAnchorView);
diff --git a/chrome/android/java/strings/android_chrome_strings.grd b/chrome/android/java/strings/android_chrome_strings.grd
index 6a41044..eab27a4 100644
--- a/chrome/android/java/strings/android_chrome_strings.grd
+++ b/chrome/android/java/strings/android_chrome_strings.grd
@@ -2974,9 +2974,15 @@
       <message name="IDS_IPH_DOWNLOAD_PAGE_FOR_OFFLINE_USAGE_TEXT" desc="The in-product-help message after a successful navigation prompting user to download the pages to view offline.">
         Download pages to use them offline
       </message>
+      <message name="IDS_IPH_DOWNLOAD_PAGE_FOR_OFFLINE_USAGE_ACCESSIBILITY_TEXT" desc="The in-product-help accessibility text after a successful navigation prompting user to download the pages to view offline.">
+        Download pages from the More options button to use them offline
+      </message>
       <message name="IDS_IPH_DOWNLOAD_HOME_TEXT" desc="The in-product-help message to open download home after a restart.">
         Find your files and pages in Downloads
       </message>
+      <message name="IDS_IPH_DOWNLOAD_HOME_ACCESSIBILITY_TEXT" desc="The in-product-help accessibility text to open download home after a restart.">
+        Find your files and pages in Downloads from the More Options button
+      </message>
 
       <!-- Search Widget strings -->
       <message name="IDS_SEARCH_WIDGET_DEFAULT" desc="Default text for the search widget">
diff --git a/chrome/android/java_sources.gni b/chrome/android/java_sources.gni
index b13c98d..8112e97 100644
--- a/chrome/android/java_sources.gni
+++ b/chrome/android/java_sources.gni
@@ -1429,6 +1429,7 @@
   "javatests/src/org/chromium/chrome/browser/invalidation/InvalidationServiceTest.java",
   "javatests/src/org/chromium/chrome/browser/locale/DefaultSearchEngineDialogHelperTest.java",
   "javatests/src/org/chromium/chrome/browser/locale/DefaultSearchEngineDialogHelperUtils.java",
+  "javatests/src/org/chromium/chrome/browser/locale/LocaleManagerReferralTest.java",
   "javatests/src/org/chromium/chrome/browser/media/RouterTestUtils.java",
   "javatests/src/org/chromium/chrome/browser/media/remote/CastNotificationTest.java",
   "javatests/src/org/chromium/chrome/browser/media/remote/CastPositionTransferTest.java",
diff --git a/chrome/android/javatests/src/org/chromium/chrome/browser/locale/LocaleManagerReferralTest.java b/chrome/android/javatests/src/org/chromium/chrome/browser/locale/LocaleManagerReferralTest.java
new file mode 100644
index 0000000..fdbd7c3
--- /dev/null
+++ b/chrome/android/javatests/src/org/chromium/chrome/browser/locale/LocaleManagerReferralTest.java
@@ -0,0 +1,116 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+package org.chromium.chrome.browser.locale;
+
+import static org.hamcrest.CoreMatchers.containsString;
+import static org.hamcrest.CoreMatchers.not;
+
+import android.support.test.InstrumentationRegistry;
+import android.support.test.filters.SmallTest;
+
+import org.junit.After;
+import org.junit.Assert;
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+
+import org.chromium.base.ThreadUtils;
+import org.chromium.base.library_loader.ProcessInitException;
+import org.chromium.base.test.BaseJUnit4ClassRunner;
+import org.chromium.base.test.util.CallbackHelper;
+import org.chromium.chrome.browser.init.ChromeBrowserInitializer;
+import org.chromium.chrome.browser.search_engines.TemplateUrlService;
+import org.chromium.chrome.test.util.ApplicationData;
+
+import java.util.Locale;
+import java.util.concurrent.TimeoutException;
+
+/**
+ * Tests that verify the end to end behavior of appending referral IDs to search engines.
+ */
+@RunWith(BaseJUnit4ClassRunner.class)
+public class LocaleManagerReferralTest {
+    private Locale mDefaultLocale;
+    private String mYandexReferralId = "";
+
+    @Before
+    public void setUp() {
+        mDefaultLocale = Locale.getDefault();
+        Locale.setDefault(new Locale("ru", "RU"));
+
+        ApplicationData.clearAppData(
+                InstrumentationRegistry.getInstrumentation().getTargetContext());
+
+        LocaleManager.setInstanceForTest(new LocaleManager() {
+            @Override
+            protected String getYandexReferralId() {
+                return mYandexReferralId;
+            }
+        });
+
+        ThreadUtils.runOnUiThreadBlocking(new Runnable() {
+            @Override
+            public void run() {
+                try {
+                    ChromeBrowserInitializer
+                            .getInstance(
+                                    InstrumentationRegistry.getInstrumentation().getTargetContext())
+                            .handleSynchronousStartup();
+                } catch (ProcessInitException e) {
+                    Assert.fail("Failed to load browser");
+                }
+            }
+        });
+    }
+
+    @After
+    public void tearDown() {
+        Locale.setDefault(mDefaultLocale);
+    }
+
+    @SmallTest
+    @Test
+    public void testYandexReferralId() throws InterruptedException, TimeoutException {
+        final CallbackHelper templateUrlServiceLoaded = new CallbackHelper();
+        ThreadUtils.runOnUiThreadBlocking(new Runnable() {
+            @Override
+            public void run() {
+                TemplateUrlService templateUrlService = TemplateUrlService.getInstance();
+                templateUrlService.registerLoadListener(new TemplateUrlService.LoadListener() {
+                    @Override
+                    public void onTemplateUrlServiceLoaded() {
+                        templateUrlServiceLoaded.notifyCalled();
+                    }
+                });
+
+                templateUrlService.load();
+            }
+        });
+
+        templateUrlServiceLoaded.waitForCallback("Template URLs never loaded", 0);
+
+        ThreadUtils.runOnUiThreadBlocking(new Runnable() {
+            @Override
+            public void run() {
+                TemplateUrlService.getInstance().setSearchEngine("yandex.ru");
+
+                // The initial param is empty, so ensure no clid param is passed.
+                String url = TemplateUrlService.getInstance().getUrlForSearchQuery("blah");
+                Assert.assertThat(url, not(containsString("&clid=")));
+
+                // Initialize the value to something and verify it is included in the generated
+                // URL.
+                mYandexReferralId = "TESTING_IS_AWESOME";
+                url = TemplateUrlService.getInstance().getUrlForSearchQuery("blah");
+                Assert.assertThat(url, containsString("&clid=TESTING_IS_AWESOME"));
+
+                // Switch to google and ensure the clid param is no longer included.
+                TemplateUrlService.getInstance().setSearchEngine("google.com");
+                url = TemplateUrlService.getInstance().getUrlForSearchQuery("blah");
+                Assert.assertThat(url, not(containsString("&clid=")));
+            }
+        });
+    }
+}
diff --git a/chrome/browser/BUILD.gn b/chrome/browser/BUILD.gn
index 39f3e73..bf646f6f 100644
--- a/chrome/browser/BUILD.gn
+++ b/chrome/browser/BUILD.gn
@@ -8,6 +8,7 @@
 import("//build/config/ui.gni")
 import("//build/split_static_library.gni")
 import("//chrome/common/features.gni")
+import("//components/offline_pages/features/features.gni")
 import("//components/os_crypt/features.gni")
 import("//components/spellcheck/spellcheck_build_features.gni")
 import("//device/vr/features/features.gni")
@@ -1524,14 +1525,7 @@
     "//components/ntp_snippets",
     "//components/ntp_tiles",
     "//components/offline_items_collection/core",
-    "//components/offline_pages/content",
-    "//components/offline_pages/content/background_loader",
-    "//components/offline_pages/core",
-    "//components/offline_pages/core/background:background_offliner",
-    "//components/offline_pages/core/downloads:offline_pages_ui_adapter",
-    "//components/offline_pages/core/prefetch",
-    "//components/offline_pages/core/recent_tabs",
-    "//components/offline_pages/core/request_header:request_header",
+    "//components/offline_pages/features:features",
     "//components/omnibox/browser",
     "//components/os_crypt",
     "//components/packed_ct_ev_whitelist",
@@ -2116,6 +2110,77 @@
       "//third_party/adobe/flash:flapper_version_h",
     ]
   }
+
+  if (enable_offline_pages) {
+    sources += [
+      "android/offline_pages/background_loader_offliner.cc",
+      "android/offline_pages/background_loader_offliner.h",
+      "android/offline_pages/background_scheduler_bridge.cc",
+      "android/offline_pages/background_scheduler_bridge.h",
+      "android/offline_pages/downloads/offline_page_download_bridge.cc",
+      "android/offline_pages/downloads/offline_page_download_bridge.h",
+      "android/offline_pages/downloads/offline_page_infobar_delegate.cc",
+      "android/offline_pages/downloads/offline_page_infobar_delegate.h",
+      "android/offline_pages/downloads/offline_page_notification_bridge.cc",
+      "android/offline_pages/downloads/offline_page_notification_bridge.h",
+      "android/offline_pages/downloads/resource_throttle.cc",
+      "android/offline_pages/downloads/resource_throttle.h",
+      "android/offline_pages/offline_page_bookmark_observer.cc",
+      "android/offline_pages/offline_page_bookmark_observer.h",
+      "android/offline_pages/offline_page_bridge.cc",
+      "android/offline_pages/offline_page_bridge.h",
+      "android/offline_pages/offline_page_info_handler.cc",
+      "android/offline_pages/offline_page_info_handler.h",
+      "android/offline_pages/offline_page_mhtml_archiver.cc",
+      "android/offline_pages/offline_page_mhtml_archiver.h",
+      "android/offline_pages/offline_page_model_factory.cc",
+      "android/offline_pages/offline_page_model_factory.h",
+      "android/offline_pages/offline_page_request_interceptor.cc",
+      "android/offline_pages/offline_page_request_interceptor.h",
+      "android/offline_pages/offline_page_request_job.cc",
+      "android/offline_pages/offline_page_request_job.h",
+      "android/offline_pages/offline_page_tab_helper.cc",
+      "android/offline_pages/offline_page_tab_helper.h",
+      "android/offline_pages/offline_page_utils.cc",
+      "android/offline_pages/offline_page_utils.h",
+      "android/offline_pages/offliner_helper.cc",
+      "android/offline_pages/offliner_helper.h",
+      "android/offline_pages/prefetch/prefetch_background_task.cc",
+      "android/offline_pages/prefetch/prefetch_background_task.h",
+      "android/offline_pages/prerender_adapter.cc",
+      "android/offline_pages/prerender_adapter.h",
+      "android/offline_pages/prerendering_loader.cc",
+      "android/offline_pages/prerendering_loader.h",
+      "android/offline_pages/prerendering_offliner.cc",
+      "android/offline_pages/prerendering_offliner.h",
+      "android/offline_pages/recent_tab_helper.cc",
+      "android/offline_pages/recent_tab_helper.h",
+      "android/offline_pages/request_coordinator_factory.cc",
+      "android/offline_pages/request_coordinator_factory.h",
+    ]
+    deps += [
+      "//components/offline_pages/content",
+      "//components/offline_pages/content/background_loader",
+      "//components/offline_pages/core",
+      "//components/offline_pages/core/background:background_offliner",
+      "//components/offline_pages/core/downloads:offline_pages_ui_adapter",
+      "//components/offline_pages/core/prefetch",
+      "//components/offline_pages/core/recent_tabs",
+      "//components/offline_pages/core/request_header:request_header",
+    ]
+  }
+
+  # Used to build test harness locally. The harness is used manually to
+  # produce multiple offline pages to evaluate quality of the snapshots.
+  if (enable_offline_pages_harness) {
+    sources += [
+      "android/offline_pages/evaluation/evaluation_test_scheduler.cc",
+      "android/offline_pages/evaluation/evaluation_test_scheduler.h",
+      "android/offline_pages/evaluation/offline_page_evaluation_bridge.cc",
+      "android/offline_pages/evaluation/offline_page_evaluation_bridge.h",
+    ]
+  }
+
   if (safe_browsing_mode != 0) {
     # "Safe Browsing Basic" files used for safe browsing in full mode
     # (safe_browsing=1) and mobile (=2)
@@ -2840,6 +2905,8 @@
       "android/intent_helper.h",
       "android/large_icon_bridge.cc",
       "android/large_icon_bridge.h",
+      "android/locale/locale_manager.cc",
+      "android/locale/locale_manager.h",
       "android/locale/special_locale_handler.cc",
       "android/locale/special_locale_handler.h",
       "android/location_settings.h",
@@ -2877,50 +2944,6 @@
       "android/ntp/recent_tabs_page_prefs.h",
       "android/ntp/suggestions_event_reporter_bridge.cc",
       "android/ntp/suggestions_event_reporter_bridge.h",
-      "android/offline_pages/background_loader_offliner.cc",
-      "android/offline_pages/background_loader_offliner.h",
-      "android/offline_pages/background_scheduler_bridge.cc",
-      "android/offline_pages/background_scheduler_bridge.h",
-      "android/offline_pages/downloads/offline_page_download_bridge.cc",
-      "android/offline_pages/downloads/offline_page_download_bridge.h",
-      "android/offline_pages/downloads/offline_page_infobar_delegate.cc",
-      "android/offline_pages/downloads/offline_page_infobar_delegate.h",
-      "android/offline_pages/downloads/offline_page_notification_bridge.cc",
-      "android/offline_pages/downloads/offline_page_notification_bridge.h",
-      "android/offline_pages/downloads/resource_throttle.cc",
-      "android/offline_pages/downloads/resource_throttle.h",
-      "android/offline_pages/offline_page_bookmark_observer.cc",
-      "android/offline_pages/offline_page_bookmark_observer.h",
-      "android/offline_pages/offline_page_bridge.cc",
-      "android/offline_pages/offline_page_bridge.h",
-      "android/offline_pages/offline_page_info_handler.cc",
-      "android/offline_pages/offline_page_info_handler.h",
-      "android/offline_pages/offline_page_mhtml_archiver.cc",
-      "android/offline_pages/offline_page_mhtml_archiver.h",
-      "android/offline_pages/offline_page_model_factory.cc",
-      "android/offline_pages/offline_page_model_factory.h",
-      "android/offline_pages/offline_page_request_interceptor.cc",
-      "android/offline_pages/offline_page_request_interceptor.h",
-      "android/offline_pages/offline_page_request_job.cc",
-      "android/offline_pages/offline_page_request_job.h",
-      "android/offline_pages/offline_page_tab_helper.cc",
-      "android/offline_pages/offline_page_tab_helper.h",
-      "android/offline_pages/offline_page_utils.cc",
-      "android/offline_pages/offline_page_utils.h",
-      "android/offline_pages/offliner_helper.cc",
-      "android/offline_pages/offliner_helper.h",
-      "android/offline_pages/prefetch/prefetch_background_task.cc",
-      "android/offline_pages/prefetch/prefetch_background_task.h",
-      "android/offline_pages/prerender_adapter.cc",
-      "android/offline_pages/prerender_adapter.h",
-      "android/offline_pages/prerendering_loader.cc",
-      "android/offline_pages/prerendering_loader.h",
-      "android/offline_pages/prerendering_offliner.cc",
-      "android/offline_pages/prerendering_offliner.h",
-      "android/offline_pages/recent_tab_helper.cc",
-      "android/offline_pages/recent_tab_helper.h",
-      "android/offline_pages/request_coordinator_factory.cc",
-      "android/offline_pages/request_coordinator_factory.h",
       "android/omnibox/answers_image_bridge.cc",
       "android/omnibox/answers_image_bridge.h",
       "android/omnibox/autocomplete_controller_android.cc",
@@ -3216,16 +3239,6 @@
         "supervised_user/child_accounts/child_account_service_android.h",
       ]
     }
-
-    # Used for testing only, should not be shipped to end users.
-    if (!is_official_build) {
-      sources += [
-        "android/offline_pages/evaluation/evaluation_test_scheduler.cc",
-        "android/offline_pages/evaluation/evaluation_test_scheduler.h",
-        "android/offline_pages/evaluation/offline_page_evaluation_bridge.cc",
-        "android/offline_pages/evaluation/offline_page_evaluation_bridge.h",
-      ]
-    }
   } else {
     # Non-Android.
     sources += [
@@ -4167,6 +4180,7 @@
       "../android/java/src/org/chromium/chrome/browser/infobar/UpdatePasswordInfoBar.java",
       "../android/java/src/org/chromium/chrome/browser/instantapps/InstantAppsSettings.java",
       "../android/java/src/org/chromium/chrome/browser/invalidation/InvalidationServiceFactory.java",
+      "../android/java/src/org/chromium/chrome/browser/locale/LocaleManager.java",
       "../android/java/src/org/chromium/chrome/browser/locale/SpecialLocaleHandler.java",
       "../android/java/src/org/chromium/chrome/browser/media/cdm/MediaDrmCredentialManager.java",
       "../android/java/src/org/chromium/chrome/browser/media/remote/RecordCastAction.java",
diff --git a/chrome/browser/android/chrome_jni_registrar.cc b/chrome/browser/android/chrome_jni_registrar.cc
index 0d87796b..5e3588b 100644
--- a/chrome/browser/android/chrome_jni_registrar.cc
+++ b/chrome/browser/android/chrome_jni_registrar.cc
@@ -184,6 +184,7 @@
 #include "components/gcm_driver/instance_id/android/component_jni_registrar.h"
 #include "components/invalidation/impl/android/component_jni_registrar.h"
 #include "components/offline_items_collection/core/android/offline_content_aggregator_bridge.h"
+#include "components/offline_pages/features/features.h"
 #include "components/payments/content/android/component_jni_registrar.h"
 #include "components/policy/core/browser/android/component_jni_registrar.h"
 #include "components/safe_browsing_db/android/jni_registrar.h"
@@ -210,7 +211,7 @@
 #include "third_party/gvr-android-sdk/native_callbacks_jni.h"
 #endif
 
-#if !defined(OFFICIAL_BUILD)
+#if BUILDFLAG(ENABLE_OFFLINE_PAGES_HARNESS)
 #include "chrome/browser/android/offline_pages/evaluation/offline_page_evaluation_bridge.h"
 #endif
 
@@ -356,7 +357,7 @@
     {"OfflinePageBridge", offline_pages::android::RegisterOfflinePageBridge},
     {"OfflinePageDownloadBridge",
      offline_pages::android::OfflinePageDownloadBridge::Register},
-#if !defined(OFFICIAL_BUILD)
+#if BUILDFLAG(ENABLE_OFFLINE_PAGES_HARNESS)
     {"OfflinePageEvaluationBridge",
      offline_pages::android::OfflinePageEvaluationBridge::Register},
 #endif
diff --git a/chrome/browser/android/locale/locale_manager.cc b/chrome/browser/android/locale/locale_manager.cc
new file mode 100644
index 0000000..e41b283
--- /dev/null
+++ b/chrome/browser/android/locale/locale_manager.cc
@@ -0,0 +1,19 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "chrome/browser/android/locale/locale_manager.h"
+
+#include "base/android/jni_android.h"
+#include "base/android/jni_string.h"
+#include "base/android/scoped_java_ref.h"
+#include "jni/LocaleManager_jni.h"
+
+// static
+std::string LocaleManager::GetYandexReferralID() {
+  JNIEnv* env = base::android::AttachCurrentThread();
+  base::android::ScopedJavaLocalRef<jobject> jlocale_manager =
+      Java_LocaleManager_getInstance(env);
+  return base::android::ConvertJavaStringToUTF8(
+      env, Java_LocaleManager_getYandexReferralId(env, jlocale_manager));
+}
diff --git a/chrome/browser/android/locale/locale_manager.h b/chrome/browser/android/locale/locale_manager.h
new file mode 100644
index 0000000..792dcf79
--- /dev/null
+++ b/chrome/browser/android/locale/locale_manager.h
@@ -0,0 +1,22 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CHROME_BROWSER_ANDROID_LOCALE_LOCALE_MANAGER_H_
+#define CHROME_BROWSER_ANDROID_LOCALE_LOCALE_MANAGER_H_
+
+#include <jni.h>
+#include <string>
+
+#include "base/macros.h"
+
+// Provides access to the locale specific customizations on Android.
+class LocaleManager {
+ public:
+  static std::string GetYandexReferralID();
+
+ private:
+  DISALLOW_IMPLICIT_CONSTRUCTORS(LocaleManager);
+};
+
+#endif  // CHROME_BROWSER_ANDROID_LOCALE_LOCALE_MANAGER_H_
diff --git a/chrome/browser/android/vr_shell/BUILD.gn b/chrome/browser/android/vr_shell/BUILD.gn
index dac1029..4115f78 100644
--- a/chrome/browser/android/vr_shell/BUILD.gn
+++ b/chrome/browser/android/vr_shell/BUILD.gn
@@ -34,6 +34,8 @@
       "mailbox_to_surface_bridge.h",
       "non_presenting_gvr_delegate.cc",
       "non_presenting_gvr_delegate.h",
+      "textures/close_button_texture.cc",
+      "textures/close_button_texture.h",
       "textures/insecure_content_permanent_texture.cc",
       "textures/insecure_content_permanent_texture.h",
       "textures/insecure_content_transient_texture.cc",
@@ -42,6 +44,8 @@
       "textures/ui_texture.h",
       "textures/url_bar_texture.cc",
       "textures/url_bar_texture.h",
+      "ui_elements/close_button.cc",
+      "ui_elements/close_button.h",
       "ui_elements/permanent_security_warning.cc",
       "ui_elements/permanent_security_warning.h",
       "ui_elements/textured_element.cc",
diff --git a/chrome/browser/android/vr_shell/textures/close_button_texture.cc b/chrome/browser/android/vr_shell/textures/close_button_texture.cc
new file mode 100644
index 0000000..a30b868a
--- /dev/null
+++ b/chrome/browser/android/vr_shell/textures/close_button_texture.cc
@@ -0,0 +1,65 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "chrome/browser/android/vr_shell/textures/close_button_texture.h"
+
+#include "cc/paint/skia_paint_canvas.h"
+#include "ui/gfx/canvas.h"
+#include "ui/gfx/geometry/rect.h"
+#include "ui/gfx/geometry/vector2d.h"
+#include "ui/gfx/paint_vector_icon.h"
+#include "ui/gfx/vector_icon_types.h"
+#include "ui/vector_icons/vector_icons.h"
+
+namespace vr_shell {
+
+namespace {
+
+const SkColor kBackgroundColor = SK_ColorWHITE;
+const SkColor kBackgroundColorHover = 0xFFE5E5E5;
+const SkColor kBackgroundColorDown = 0xFFD5D5D5;
+const SkColor kForegroundColor = 0xFF444444;
+constexpr float kIconScaleFactor = 0.75;
+
+}  // namespace
+
+CloseButtonTexture::CloseButtonTexture() = default;
+
+CloseButtonTexture::~CloseButtonTexture() = default;
+
+void CloseButtonTexture::Draw(SkCanvas* sk_canvas,
+                              const gfx::Size& texture_size) {
+  DCHECK_EQ(texture_size.height(), texture_size.width());
+  cc::SkiaPaintCanvas paint_canvas(sk_canvas);
+  gfx::Canvas gfx_canvas(&paint_canvas, 1.0f);
+  gfx::Canvas* canvas = &gfx_canvas;
+
+  size_.set_height(texture_size.height());
+  size_.set_width(texture_size.width());
+
+  cc::PaintFlags flags;
+  SkColor color =
+      (GetDrawFlags() & FLAG_HOVER) ? kBackgroundColorHover : kBackgroundColor;
+  color = (GetDrawFlags() & FLAG_DOWN) ? kBackgroundColorDown : color;
+  flags.setColor(color);
+  canvas->DrawCircle(gfx::PointF(size_.width() / 2, size_.height() / 2),
+                     size_.width() / 2, flags);
+
+  canvas->Save();
+  canvas->Translate(gfx::Vector2d(size_.height() * (1 - kIconScaleFactor) / 2,
+                                  size_.height() * (1 - kIconScaleFactor) / 2));
+  PaintVectorIcon(canvas, ui::kCloseIcon, size_.height() * kIconScaleFactor,
+                  kForegroundColor);
+  canvas->Restore();
+}
+
+gfx::Size CloseButtonTexture::GetPreferredTextureSize(int maximum_width) const {
+  return gfx::Size(maximum_width, maximum_width);
+}
+
+gfx::SizeF CloseButtonTexture::GetDrawnSize() const {
+  return size_;
+}
+
+}  // namespace vr_shell
diff --git a/chrome/browser/android/vr_shell/textures/close_button_texture.h b/chrome/browser/android/vr_shell/textures/close_button_texture.h
new file mode 100644
index 0000000..acbea1ab
--- /dev/null
+++ b/chrome/browser/android/vr_shell/textures/close_button_texture.h
@@ -0,0 +1,32 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CHROME_BROWSER_ANDROID_VR_SHELL_TEXTURES_CLOSE_BUTTON_TEXTURE_H_
+#define CHROME_BROWSER_ANDROID_VR_SHELL_TEXTURES_CLOSE_BUTTON_TEXTURE_H_
+
+#include "chrome/browser/android/vr_shell/textures/ui_texture.h"
+
+namespace vr_shell {
+
+class CloseButtonTexture : public UiTexture {
+ public:
+  enum DrawFlags {
+    FLAG_HOVER = 1 << 0,
+    FLAG_DOWN = 1 << 1,
+  };
+
+  CloseButtonTexture();
+  ~CloseButtonTexture() override;
+  gfx::Size GetPreferredTextureSize(int width) const override;
+  gfx::SizeF GetDrawnSize() const override;
+
+ private:
+  void Draw(SkCanvas* sk_canvas, const gfx::Size& texture_size) override;
+
+  gfx::SizeF size_;
+};
+
+}  // namespace vr_shell
+
+#endif  // CHROME_BROWSER_ANDROID_VR_SHELL_TEXTURES_CLOSE_BUTTON_TEXTURE_H_
diff --git a/chrome/browser/android/vr_shell/textures/ui_texture.cc b/chrome/browser/android/vr_shell/textures/ui_texture.cc
index 6d14ae5..31a36a3 100644
--- a/chrome/browser/android/vr_shell/textures/ui_texture.cc
+++ b/chrome/browser/android/vr_shell/textures/ui_texture.cc
@@ -40,6 +40,13 @@
 
 UiTexture::~UiTexture() = default;
 
+bool UiTexture::SetDrawFlags(int draw_flags) {
+  if (draw_flags == draw_flags_)
+    return false;
+  draw_flags_ = draw_flags;
+  return true;
+}
+
 void UiTexture::DrawAndLayout(SkCanvas* canvas, const gfx::Size& texture_size) {
   canvas->drawColor(SK_ColorTRANSPARENT);
   Draw(canvas, texture_size);
diff --git a/chrome/browser/android/vr_shell/textures/ui_texture.h b/chrome/browser/android/vr_shell/textures/ui_texture.h
index f1529b3..cfe1fc99 100644
--- a/chrome/browser/android/vr_shell/textures/ui_texture.h
+++ b/chrome/browser/android/vr_shell/textures/ui_texture.h
@@ -27,6 +27,9 @@
   void DrawAndLayout(SkCanvas* canvas, const gfx::Size& texture_size);
   virtual gfx::Size GetPreferredTextureSize(int maximum_width) const = 0;
   virtual gfx::SizeF GetDrawnSize() const = 0;
+  // Returns true if the state changed.
+  bool SetDrawFlags(int draw_flags);
+  int GetDrawFlags() { return draw_flags_; }
 
  protected:
   virtual void Draw(SkCanvas* canvas, const gfx::Size& texture_size) = 0;
@@ -34,6 +37,9 @@
   static bool IsRTL();
   static gfx::FontList GetDefaultFontList(int size);
   static gfx::FontList GetFontList(int size, base::string16 text);
+
+ private:
+  int draw_flags_ = 0;
 };
 
 }  // namespace vr_shell
diff --git a/chrome/browser/android/vr_shell/textures/url_bar_texture.cc b/chrome/browser/android/vr_shell/textures/url_bar_texture.cc
index 160e26d..4d055666 100644
--- a/chrome/browser/android/vr_shell/textures/url_bar_texture.cc
+++ b/chrome/browser/android/vr_shell/textures/url_bar_texture.cc
@@ -61,10 +61,6 @@
 
 UrlBarTexture::~UrlBarTexture() = default;
 
-void UrlBarTexture::SetHover(bool hover) {
-  hover_ = hover;
-}
-
 void UrlBarTexture::SetURL(const GURL& gurl) {
   gurl_ = gurl;
 }
@@ -96,7 +92,8 @@
   SkVector left_corners[4] = {rounded_corner, {0, 0}, {0, 0}, rounded_corner};
   round_rect.setRectRadii({0, 0, kHeight, kHeight}, left_corners);
   SkPaint paint;
-  paint.setColor(hover_ ? kBackgroundHover : kBackground);
+  paint.setColor((GetDrawFlags() & FLAG_HOVER) ? kBackgroundHover
+                                               : kBackground);
   canvas->drawRRect(round_rect, paint);
 
   // URL area.
diff --git a/chrome/browser/android/vr_shell/textures/url_bar_texture.h b/chrome/browser/android/vr_shell/textures/url_bar_texture.h
index 81630ead..3231f46e 100644
--- a/chrome/browser/android/vr_shell/textures/url_bar_texture.h
+++ b/chrome/browser/android/vr_shell/textures/url_bar_texture.h
@@ -13,12 +13,15 @@
 
 class UrlBarTexture : public UiTexture {
  public:
+  enum DrawFlags {
+    FLAG_HOVER = 1 << 0,
+  };
+
   UrlBarTexture();
   ~UrlBarTexture() override;
   gfx::Size GetPreferredTextureSize(int width) const override;
   gfx::SizeF GetDrawnSize() const override;
 
-  void SetHover(bool hover);
   void SetURL(const GURL& gurl);
   void SetSecurityLevel(int level);
 
@@ -27,7 +30,6 @@
   float ToPixels(float meters) const;
 
   gfx::SizeF size_;
-  bool hover_ = false;
   int security_level_;
   GURL gurl_;
 };
diff --git a/chrome/browser/android/vr_shell/ui_elements/close_button.cc b/chrome/browser/android/vr_shell/ui_elements/close_button.cc
new file mode 100644
index 0000000..cc2549f
--- /dev/null
+++ b/chrome/browser/android/vr_shell/ui_elements/close_button.cc
@@ -0,0 +1,56 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "chrome/browser/android/vr_shell/ui_elements/close_button.h"
+
+#include "base/memory/ptr_util.h"
+#include "chrome/browser/android/vr_shell/textures/close_button_texture.h"
+
+namespace vr_shell {
+
+CloseButton::CloseButton(base::Callback<void()> click_handler)
+    : TexturedElement(256),
+      texture_(base::MakeUnique<CloseButtonTexture>()),
+      click_handler_(click_handler) {}
+
+CloseButton::~CloseButton() = default;
+
+void CloseButton::OnHoverEnter(gfx::PointF position) {
+  hover_ = true;
+  OnStateUpdated();
+}
+
+void CloseButton::OnHoverLeave() {
+  hover_ = false;
+  OnStateUpdated();
+}
+
+void CloseButton::OnButtonDown(gfx::PointF position) {
+  down_ = true;
+  OnStateUpdated();
+}
+
+void CloseButton::OnButtonUp(gfx::PointF position) {
+  down_ = false;
+  OnStateUpdated();
+  if (position.x() < 0 || position.x() > 1.0f)
+    return;
+  if (position.y() < 0 || position.y() > 1.0f)
+    return;
+  click_handler_.Run();
+}
+
+UiTexture* CloseButton::GetTexture() const {
+  return texture_.get();
+}
+
+void CloseButton::OnStateUpdated() {
+  int flags = hover_ ? CloseButtonTexture::FLAG_HOVER : 0;
+  flags |= (down_ && hover_) ? CloseButtonTexture::FLAG_DOWN : 0;
+  if (!texture_->SetDrawFlags(flags))
+    return;
+  Update();
+}
+
+}  // namespace vr_shell
diff --git a/chrome/browser/android/vr_shell/ui_elements/close_button.h b/chrome/browser/android/vr_shell/ui_elements/close_button.h
new file mode 100644
index 0000000..682364d
--- /dev/null
+++ b/chrome/browser/android/vr_shell/ui_elements/close_button.h
@@ -0,0 +1,43 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CHROME_BROWSER_ANDROID_VR_SHELL_UI_ELEMENTS_CLOSE_BUTTON_H_
+#define CHROME_BROWSER_ANDROID_VR_SHELL_UI_ELEMENTS_CLOSE_BUTTON_H_
+
+#include <memory>
+
+#include "base/callback.h"
+#include "base/macros.h"
+#include "chrome/browser/android/vr_shell/ui_elements/textured_element.h"
+
+namespace vr_shell {
+
+class CloseButtonTexture;
+class UiTexture;
+
+class CloseButton : public TexturedElement {
+ public:
+  explicit CloseButton(base::Callback<void()> click_handler);
+  ~CloseButton() override;
+
+  void OnHoverLeave() override;
+  void OnHoverEnter(gfx::PointF position) override;
+  void OnButtonDown(gfx::PointF position) override;
+  void OnButtonUp(gfx::PointF position) override;
+
+ private:
+  UiTexture* GetTexture() const override;
+  void OnStateUpdated();
+
+  std::unique_ptr<CloseButtonTexture> texture_;
+  bool down_ = false;
+  bool hover_ = false;
+  base::Callback<void()> click_handler_;
+
+  DISALLOW_COPY_AND_ASSIGN(CloseButton);
+};
+
+}  // namespace vr_shell
+
+#endif  // CHROME_BROWSER_ANDROID_VR_SHELL_UI_ELEMENTS_CLOSE_BUTTON_H_
diff --git a/chrome/browser/android/vr_shell/ui_elements/ui_element.cc b/chrome/browser/android/vr_shell/ui_elements/ui_element.cc
index d3addb46..70f582a0 100644
--- a/chrome/browser/android/vr_shell/ui_elements/ui_element.cc
+++ b/chrome/browser/android/vr_shell/ui_elements/ui_element.cc
@@ -74,7 +74,7 @@
 }
 
 gfx::PointF WorldRectangle::GetUnitRectangleCoordinates(
-    const gfx::Point3F& world_point) {
+    const gfx::Point3F& world_point) const {
   // TODO(acondor): Simplify the math in this function.
   const vr::Mat4f& transform = transform_.to_world;
   gfx::Vector3dF origin =
@@ -116,13 +116,15 @@
 
 void UiElement::Initialize() {}
 
-void UiElement::OnHoverEnter() {}
+void UiElement::OnHoverEnter(gfx::PointF position) {}
 
 void UiElement::OnHoverLeave() {}
 
-void UiElement::OnButtonDown() {}
+void UiElement::OnMove(gfx::PointF position) {}
 
-void UiElement::OnButtonUp() {}
+void UiElement::OnButtonDown(gfx::PointF position) {}
+
+void UiElement::OnButtonUp(gfx::PointF position) {}
 
 void UiElement::Animate(const base::TimeTicks& time) {
   for (auto& it : animations_) {
diff --git a/chrome/browser/android/vr_shell/ui_elements/ui_element.h b/chrome/browser/android/vr_shell/ui_elements/ui_element.h
index da5d829..225d5eae 100644
--- a/chrome/browser/android/vr_shell/ui_elements/ui_element.h
+++ b/chrome/browser/android/vr_shell/ui_elements/ui_element.h
@@ -82,7 +82,8 @@
   // rectangle. This allows beam intersection points to be mapped to sprite
   // pixel coordinates. Points that fall onto the rectangle will generate X and
   // Y values on the interval [-0.5, 0.5].
-  gfx::PointF GetUnitRectangleCoordinates(const gfx::Point3F& world_point);
+  gfx::PointF GetUnitRectangleCoordinates(
+      const gfx::Point3F& world_point) const;
 
  private:
   Transform transform_;
@@ -107,10 +108,11 @@
   virtual void Initialize();
 
   // Controller interaction methods.
-  virtual void OnHoverEnter();
+  virtual void OnHoverEnter(gfx::PointF position);
   virtual void OnHoverLeave();
-  virtual void OnButtonDown();
-  virtual void OnButtonUp();
+  virtual void OnMove(gfx::PointF position);
+  virtual void OnButtonDown(gfx::PointF position);
+  virtual void OnButtonUp(gfx::PointF position);
 
   int id() const { return id_; }
   void set_id(int id) { id_ = id; }
@@ -238,7 +240,7 @@
   bool lock_to_fov_ = false;
 
   // The computed lock to the FoV, incorporating lock of parent objects.
-  bool computed_lock_to_fov_;
+  bool computed_lock_to_fov_ = false;
 
   // The size of the object.  This does not affect children.
   gfx::Vector3dF size_ = {1.0f, 1.0f, 1.0f};
@@ -257,7 +259,7 @@
   float opacity_ = 1.0f;
 
   // The computed opacity, incorporating opacity of parent objects.
-  float computed_opacity_;
+  float computed_opacity_ = 1.0f;
 
   // If anchoring is specified, the translation will be relative to the
   // specified edge(s) of the parent, rather than the center.  A parent object
@@ -281,7 +283,7 @@
   Transform inheritable_transform_;
 
   // A flag usable during transformation calculates to avoid duplicate work.
-  bool dirty_;
+  bool dirty_ = false;
 
   Transform transform_;
 
diff --git a/chrome/browser/android/vr_shell/ui_elements/url_bar.cc b/chrome/browser/android/vr_shell/ui_elements/url_bar.cc
index 87deb921..9e063df 100644
--- a/chrome/browser/android/vr_shell/ui_elements/url_bar.cc
+++ b/chrome/browser/android/vr_shell/ui_elements/url_bar.cc
@@ -19,17 +19,19 @@
   return texture_.get();
 }
 
-void UrlBar::OnHoverEnter() {
-  texture_->SetHover(true);
+void UrlBar::OnHoverEnter(gfx::PointF position) {
+  if (!texture_->SetDrawFlags(UrlBarTexture::FLAG_HOVER))
+    return;
   Update();
 }
 
 void UrlBar::OnHoverLeave() {
-  texture_->SetHover(false);
+  if (!texture_->SetDrawFlags(0))
+    return;
   Update();
 }
 
-void UrlBar::OnButtonUp() {
+void UrlBar::OnButtonUp(gfx::PointF position) {
   back_button_callback_.Run();
 }
 
diff --git a/chrome/browser/android/vr_shell/ui_elements/url_bar.h b/chrome/browser/android/vr_shell/ui_elements/url_bar.h
index 8c596f7..3ce3d80f 100644
--- a/chrome/browser/android/vr_shell/ui_elements/url_bar.h
+++ b/chrome/browser/android/vr_shell/ui_elements/url_bar.h
@@ -21,10 +21,11 @@
   explicit UrlBar(int preferred_width);
   ~UrlBar() override;
 
-  void OnHoverEnter() override;
+  void OnHoverEnter(gfx::PointF position) override;
   void OnHoverLeave() override;
-  void OnButtonUp() override;
+  void OnButtonUp(gfx::PointF position) override;
   void SetEnabled(bool enabled);
+
   void SetURL(const GURL& gurl);
   void SetSecurityLevel(int level);
   void SetBackButtonCallback(const base::Callback<void()>& callback);
diff --git a/chrome/browser/android/vr_shell/ui_scene_manager.cc b/chrome/browser/android/vr_shell/ui_scene_manager.cc
index 4dca2196..ce55844d97 100644
--- a/chrome/browser/android/vr_shell/ui_scene_manager.cc
+++ b/chrome/browser/android/vr_shell/ui_scene_manager.cc
@@ -4,8 +4,10 @@
 
 #include "chrome/browser/android/vr_shell/ui_scene_manager.h"
 
+#include "base/callback.h"
 #include "base/memory/ptr_util.h"
 #include "chrome/browser/android/vr_shell/textures/ui_texture.h"
+#include "chrome/browser/android/vr_shell/ui_elements/close_button.h"
 #include "chrome/browser/android/vr_shell/ui_elements/permanent_security_warning.h"
 #include "chrome/browser/android/vr_shell/ui_elements/transient_security_warning.h"
 #include "chrome/browser/android/vr_shell/ui_elements/ui_element.h"
@@ -67,6 +69,9 @@
   CreateContentQuad();
   CreateSecurityWarnings();
   CreateUrlBar();
+
+  if (in_cct_)
+    CreateCloseButton();
 }
 
 UiSceneManager::~UiSceneManager() {}
@@ -190,7 +195,7 @@
 void UiSceneManager::CreateUrlBar() {
   // TODO(cjgrant): Incorporate final size and position.
   // TODO(cjgrant): Add the loading progress indicator element.
-  auto element = base::MakeUnique<UrlBar>(512);
+  std::unique_ptr<UrlBar> element = base::MakeUnique<UrlBar>(512);
   element->set_id(AllocateId());
   element->set_translation({0, -0.9, -1.8});
   element->set_size({0.9, 0, 1});
@@ -201,6 +206,20 @@
   scene_->AddUiElement(std::move(element));
 }
 
+void UiSceneManager::CreateCloseButton() {
+  std::unique_ptr<CloseButton> element =
+      base::MakeUnique<CloseButton>(base::Bind(
+          &UiSceneManager::OnCloseButtonClicked, base::Unretained(this)));
+  element->set_id(AllocateId());
+  element->set_fill(vr_shell::Fill::NONE);
+  element->set_translation(
+      gfx::Vector3dF(0, kContentVerticalOffset - (kContentHeight / 2) - 0.3,
+                     -kContentDistance + 0.4));
+  element->set_size(gfx::Vector3dF(0.2, 0.2, 1));
+  browser_ui_elements_.push_back(element.get());
+  scene_->AddUiElement(std::move(element));
+}
+
 base::WeakPtr<UiSceneManager> UiSceneManager::GetWeakPtr() {
   return weak_ptr_factory_.GetWeakPtr();
 }
@@ -294,6 +313,8 @@
 void UiSceneManager::SetHistoryButtonsEnabled(bool can_go_back,
                                               bool can_go_forward) {}
 
+void UiSceneManager::OnCloseButtonClicked() {}
+
 int UiSceneManager::AllocateId() {
   return next_available_id_++;
 }
diff --git a/chrome/browser/android/vr_shell/ui_scene_manager.h b/chrome/browser/android/vr_shell/ui_scene_manager.h
index b7436da..3d54ad73 100644
--- a/chrome/browser/android/vr_shell/ui_scene_manager.h
+++ b/chrome/browser/android/vr_shell/ui_scene_manager.h
@@ -48,10 +48,12 @@
   void CreateContentQuad();
   void CreateBackground();
   void CreateUrlBar();
+  void CreateCloseButton();
 
   void ConfigureSecurityWarnings();
   void OnSecurityWarningTimer();
   void OnBackButtonClicked();
+  void OnCloseButtonClicked();
   int AllocateId();
 
   VrBrowserInterface* browser_;
diff --git a/chrome/browser/android/vr_shell/vr_controller.cc b/chrome/browser/android/vr_shell/vr_controller.cc
index 3f16fa0..ea1c1ea 100644
--- a/chrome/browser/android/vr_shell/vr_controller.cc
+++ b/chrome/browser/android/vr_shell/vr_controller.cc
@@ -13,6 +13,8 @@
 #include "base/time/time.h"
 #include "chrome/browser/android/vr_shell/elbow_model.h"
 #include "device/vr/vr_math.h"
+#include "third_party/WebKit/public/platform/WebGestureEvent.h"
+#include "third_party/WebKit/public/platform/WebInputEvent.h"
 #include "third_party/gvr-android-sdk/src/libraries/headers/vr/gvr/capi/include/gvr.h"
 #include "third_party/gvr-android-sdk/src/libraries/headers/vr/gvr/capi/include/gvr_controller.h"
 
@@ -244,12 +246,12 @@
       gvr::GvrApi::GetTimePointNow().monotonic_system_time_nanos;
 }
 
-std::vector<std::unique_ptr<WebGestureEvent>> VrController::DetectGestures() {
-  std::vector<std::unique_ptr<WebGestureEvent>> gesture_list;
-  std::unique_ptr<WebGestureEvent> gesture(new WebGestureEvent());
+std::unique_ptr<GestureList> VrController::DetectGestures() {
+  std::unique_ptr<GestureList> gesture_list = base::MakeUnique<GestureList>();
+  std::unique_ptr<blink::WebGestureEvent> gesture(new blink::WebGestureEvent());
 
   if (controller_state_->GetConnectionState() != gvr::kControllerConnected) {
-    gesture_list.push_back(std::move(gesture));
+    gesture_list->push_back(std::move(gesture));
     return gesture_list;
   }
 
@@ -259,22 +261,17 @@
     UpdateOverallVelocity();
 
   UpdateGestureFromTouchInfo(gesture.get());
-
-  if (gesture->GetType() == WebInputEvent::kUndefined &&
-      ButtonUpHappened(gvr::kControllerButtonClick)) {
-    gesture->SetType(WebInputEvent::kGestureTapDown);
-    gesture->x = 0;
-    gesture->y = 0;
-  }
   gesture->source_device = blink::kWebGestureDeviceTouchpad;
-  gesture_list.push_back(std::move(gesture));
+  gesture_list->push_back(std::move(gesture));
 
-  if (gesture_list.back()->GetType() == WebInputEvent::kGestureScrollEnd) {
+  if (gesture_list->back()->GetType() ==
+      blink::WebInputEvent::kGestureScrollEnd) {
     if (!ButtonDownHappened(gvr::kControllerButtonClick) &&
         (last_velocity_.x() != 0.0 || last_velocity_.y() != 0.0)) {
-      std::unique_ptr<WebGestureEvent> fling(new WebGestureEvent(
-          WebInputEvent::kGestureFlingStart, WebInputEvent::kNoModifiers,
-          gesture_list.back()->TimeStampSeconds()));
+      std::unique_ptr<blink::WebGestureEvent> fling(
+          new blink::WebGestureEvent(blink::WebInputEvent::kGestureFlingStart,
+                                     blink::WebInputEvent::kNoModifiers,
+                                     gesture_list->back()->TimeStampSeconds()));
       fling->source_device = blink::kWebGestureDeviceTouchpad;
       if (IsHorizontalGesture()) {
         fling->data.fling_start.velocity_x =
@@ -283,7 +280,7 @@
         fling->data.fling_start.velocity_y =
             last_velocity_.y() * kDisplacementScaleFactor;
       }
-      gesture_list.push_back(std::move(fling));
+      gesture_list->push_back(std::move(fling));
     }
     Reset();
   }
@@ -291,7 +288,7 @@
   return gesture_list;
 }
 
-void VrController::UpdateGestureFromTouchInfo(WebGestureEvent* gesture) {
+void VrController::UpdateGestureFromTouchInfo(blink::WebGestureEvent* gesture) {
   gesture->SetTimeStampSeconds(
       (base::TimeTicks::Now() - base::TimeTicks()).InSecondsF());
   switch (state_) {
@@ -313,7 +310,7 @@
   }
 }
 
-void VrController::HandleWaitingState(WebGestureEvent* gesture) {
+void VrController::HandleWaitingState(blink::WebGestureEvent* gesture) {
   // User puts finger on touch pad (or when the touch down for current gesture
   // is missed, initiate gesture from current touch point).
   if (touch_info_->touch_down || touch_info_->is_touching) {
@@ -323,12 +320,12 @@
     *cur_touch_point_ = touch_info_->touch_point;
     state_ = TOUCHING;
 
-    gesture->SetType(WebInputEvent::kGestureFlingCancel);
+    gesture->SetType(blink::WebInputEvent::kGestureFlingCancel);
     gesture->data.fling_cancel.prevent_boosting = false;
   }
 }
 
-void VrController::HandleDetectingState(WebGestureEvent* gesture) {
+void VrController::HandleDetectingState(blink::WebGestureEvent* gesture) {
   // User lifts up finger from touch pad.
   if (touch_info_->touch_up || !(touch_info_->is_touching)) {
     Reset();
@@ -339,9 +336,9 @@
   // and the Controller's button is not down.
   if (touch_position_changed_ && touch_info_->is_touching &&
       !InSlop(touch_info_->touch_point.position) &&
-      !ButtonDownHappened(gvr::kControllerButtonClick)) {
+      !ButtonState(gvr::kControllerButtonClick)) {
     state_ = SCROLLING;
-    gesture->SetType(WebInputEvent::kGestureScrollBegin);
+    gesture->SetType(blink::WebInputEvent::kGestureScrollBegin);
     UpdateGestureParameters();
     gesture->data.scroll_begin.delta_x_hint =
         displacement_.x() * kDisplacementScaleFactor;
@@ -352,15 +349,15 @@
   }
 }
 
-void VrController::HandleScrollingState(WebGestureEvent* gesture) {
+void VrController::HandleScrollingState(blink::WebGestureEvent* gesture) {
   if (touch_info_->touch_up || !(touch_info_->is_touching) ||
       ButtonDownHappened(gvr::kControllerButtonClick)) {
     // Gesture ends.
-    gesture->SetType(WebInputEvent::kGestureScrollEnd);
+    gesture->SetType(blink::WebInputEvent::kGestureScrollEnd);
     UpdateGestureParameters();
   } else if (touch_position_changed_) {
     // User continues scrolling and there is a change in touch position.
-    gesture->SetType(WebInputEvent::kGestureScrollUpdate);
+    gesture->SetType(blink::WebInputEvent::kGestureScrollUpdate);
     UpdateGestureParameters();
     if (IsHorizontalGesture()) {
       gesture->data.scroll_update.delta_x =
diff --git a/chrome/browser/android/vr_shell/vr_controller.h b/chrome/browser/android/vr_shell/vr_controller.h
index 7f6693e8..25b5fc1 100644
--- a/chrome/browser/android/vr_shell/vr_controller.h
+++ b/chrome/browser/android/vr_shell/vr_controller.h
@@ -12,12 +12,11 @@
 #include "chrome/browser/android/vr_shell/vr_controller_model.h"
 #include "device/vr/android/gvr/gvr_gamepad_data_provider.h"
 #include "device/vr/vr_types.h"
-#include "third_party/WebKit/public/platform/WebGestureEvent.h"
-#include "third_party/WebKit/public/platform/WebInputEvent.h"
 #include "third_party/gvr-android-sdk/src/libraries/headers/vr/gvr/capi/include/gvr_types.h"
 
-using blink::WebGestureEvent;
-using blink::WebInputEvent;
+namespace blink {
+class WebGestureEvent;
+}
 
 namespace gvr {
 class ControllerState;
@@ -30,6 +29,8 @@
 // Angle (radians) the beam down from the controller axis, for wrist comfort.
 constexpr float kErgoAngleOffset = 0.26f;
 
+using GestureList = std::vector<std::unique_ptr<blink::WebGestureEvent>>;
+
 class VrController {
  public:
   // Controller API entry point.
@@ -47,7 +48,7 @@
   // Must be called when the GL renderer gets OnDrawFrame().
   void UpdateState(const gfx::Vector3dF& head_direction);
 
-  std::vector<std::unique_ptr<WebGestureEvent>> DetectGestures();
+  std::unique_ptr<GestureList> DetectGestures();
 
   bool IsTouching();
 
@@ -99,18 +100,18 @@
     int64_t timestamp;
   };
 
-  void UpdateGestureFromTouchInfo(WebGestureEvent* gesture);
+  void UpdateGestureFromTouchInfo(blink::WebGestureEvent* gesture);
 
   bool GetButtonLongPressFromButtonInfo();
 
   // Handle the waiting state.
-  void HandleWaitingState(WebGestureEvent* gesture);
+  void HandleWaitingState(blink::WebGestureEvent* gesture);
 
   // Handle the detecting state.
-  void HandleDetectingState(WebGestureEvent* gesture);
+  void HandleDetectingState(blink::WebGestureEvent* gesture);
 
   // Handle the scrolling state.
-  void HandleScrollingState(WebGestureEvent* gesture);
+  void HandleScrollingState(blink::WebGestureEvent* gesture);
   void UpdateTouchInfo();
 
   // Returns true if the touch position is within the slop of the initial touch
diff --git a/chrome/browser/android/vr_shell/vr_shell_gl.cc b/chrome/browser/android/vr_shell/vr_shell_gl.cc
index 3062ff6..e58d6aeaa 100644
--- a/chrome/browser/android/vr_shell/vr_shell_gl.cc
+++ b/chrome/browser/android/vr_shell/vr_shell_gl.cc
@@ -28,6 +28,7 @@
 #include "device/vr/android/gvr/gvr_device.h"
 #include "device/vr/android/gvr/gvr_gamepad_data_provider.h"
 #include "device/vr/vr_math.h"
+#include "third_party/WebKit/public/platform/WebGestureEvent.h"
 #include "third_party/WebKit/public/platform/WebInputEvent.h"
 #include "third_party/WebKit/public/platform/WebMouseEvent.h"
 #include "ui/gl/android/scoped_java_surface.h"
@@ -137,14 +138,14 @@
   return result;
 }
 
-std::unique_ptr<blink::WebMouseEvent> MakeMouseEvent(WebInputEvent::Type type,
-                                                     double timestamp,
-                                                     float x,
-                                                     float y) {
+std::unique_ptr<blink::WebMouseEvent> MakeMouseEvent(
+    blink::WebInputEvent::Type type,
+    double timestamp,
+    const gfx::Point& loc) {
   std::unique_ptr<blink::WebMouseEvent> mouse_event(new blink::WebMouseEvent(
       type, blink::WebInputEvent::kNoModifiers, timestamp));
   mouse_event->pointer_type = blink::WebPointerProperties::PointerType::kMouse;
-  mouse_event->SetPositionInWidget(x, y);
+  mouse_event->SetPositionInWidget(loc.x(), loc.y());
   mouse_event->click_count = 1;
 
   return mouse_event;
@@ -183,6 +184,10 @@
                     rect.top - rect.bottom);
 }
 
+double NowSeconds() {
+  return (base::TimeTicks::Now() - base::TimeTicks()).InSecondsF();
+}
+
 }  // namespace
 
 VrShellGl::VrShellGl(VrBrowserInterface* browser,
@@ -507,23 +512,7 @@
 }
 
 void VrShellGl::HandleControllerInput(const gfx::Vector3dF& head_direction) {
-  if (ShouldDrawWebVr()) {
-    // Process screen touch events for Cardboard button compatibility.
-    // Also send tap events for controller "touchpad click" events.
-    if (touch_pending_ ||
-        controller_->ButtonUpHappened(
-            gvr::ControllerButton::GVR_CONTROLLER_BUTTON_CLICK)) {
-      touch_pending_ = false;
-      std::unique_ptr<WebGestureEvent> gesture(new WebGestureEvent(
-          WebInputEvent::kGestureTapDown, WebInputEvent::kNoModifiers,
-          (base::TimeTicks::Now() - base::TimeTicks()).InSecondsF()));
-      gesture->source_device = blink::kWebGestureDeviceTouchpad;
-      gesture->x = 0;
-      gesture->y = 0;
-      SendGestureToContent(std::move(gesture));
-      DVLOG(1) << __FUNCTION__ << ": sent CLICK gesture";
-    }
-  }
+  HandleWebVrCompatibilityClick();
 
   gfx::Vector3dF ergo_neutral_pose;
   if (!controller_->IsConnected()) {
@@ -543,10 +532,254 @@
 
   HandleControllerAppButtonActivity(controller_direction);
 
-  if (ShouldDrawWebVr()) {
+  if (ShouldDrawWebVr())
     return;
+  gfx::PointF target_local_point;
+  gfx::Vector3dF eye_to_target;
+  cursor_render_target_ = nullptr;
+  GetVisualTargetElement(controller_direction, eye_to_target, target_point_,
+                         &cursor_render_target_, target_local_point);
+
+  UiElement* target_element = nullptr;
+  if (input_locked_element_) {
+    gfx::Point3F plane_intersection_point;
+    float distance_to_plane;
+    GetTargetLocalPoint(eye_to_target, *input_locked_element_,
+                        2 * scene_->GetBackgroundDistance(), target_local_point,
+                        plane_intersection_point, distance_to_plane);
+    target_element = input_locked_element_;
+  } else if (!in_scroll_ && !in_click_) {
+    target_element = cursor_render_target_;
   }
 
+  // Handle input targeting on the content quad, ignoring any other elements.
+  // Content is treated specially to accomodate scrolling, flings, etc.
+  gfx::Point local_point_pixels;
+  if (target_element && (target_element->fill() == Fill::CONTENT)) {
+    gfx::RectF pixel_rect(0, 0, content_tex_css_width_,
+                          content_tex_css_height_);
+    local_point_pixels.set_x(pixel_rect.x() +
+                             pixel_rect.width() * target_local_point.x());
+    local_point_pixels.set_y(pixel_rect.y() +
+                             pixel_rect.height() * target_local_point.y());
+  }
+  std::unique_ptr<GestureList> gesture_list_ptr = controller_->DetectGestures();
+  GestureList& gesture_list = *gesture_list_ptr;
+  for (const std::unique_ptr<blink::WebGestureEvent>& gesture : gesture_list) {
+    gesture->x = local_point_pixels.x();
+    gesture->y = local_point_pixels.y();
+  }
+  SendFlingCancel(gesture_list);
+  // For simplicity, don't allow scrolling while clicking until we need to.
+  if (!in_click_) {
+    SendScrollEnd(gesture_list);
+    if (!SendScrollBegin(target_element, gesture_list)) {
+      SendScrollUpdate(gesture_list);
+    }
+  }
+  // If we're still scrolling, don't hover (and we can't be clicking, because
+  // click ends scroll).
+  if (in_scroll_)
+    return;
+  SendHoverLeave(target_element);
+  if (!SendHoverEnter(target_element, target_local_point, local_point_pixels)) {
+    SendHoverMove(target_local_point, local_point_pixels);
+  }
+  SendButtonDown(target_element, target_local_point);
+  if (!SendButtonUp(target_element, target_local_point))
+    SendTap(target_element, target_local_point, local_point_pixels);
+}
+
+void VrShellGl::HandleWebVrCompatibilityClick() {
+  if (!ShouldDrawWebVr())
+    return;
+
+  // Process screen touch events for Cardboard button compatibility.
+  // Also send tap events for controller "touchpad click" events.
+  if (touch_pending_ ||
+      controller_->ButtonUpHappened(gvr::kControllerButtonClick)) {
+    touch_pending_ = false;
+    std::unique_ptr<blink::WebGestureEvent> gesture(new blink::WebGestureEvent(
+        blink::WebInputEvent::kGestureTapDown,
+        blink::WebInputEvent::kNoModifiers, NowSeconds()));
+    gesture->source_device = blink::kWebGestureDeviceTouchpad;
+    gesture->x = 0;
+    gesture->y = 0;
+    SendGestureToContent(std::move(gesture));
+    DVLOG(1) << __FUNCTION__ << ": sent CLICK gesture";
+  }
+}
+
+void VrShellGl::SendFlingCancel(GestureList& gesture_list) {
+  if (!fling_target_)
+    return;
+  if (gesture_list.empty() || (gesture_list.front()->GetType() !=
+                               blink::WebInputEvent::kGestureFlingCancel))
+    return;
+  // Scrolling currently only supported on content window.
+  DCHECK_EQ(fling_target_->fill(), Fill::CONTENT);
+  SendGestureToContent(std::move(gesture_list.front()));
+  gesture_list.erase(gesture_list.begin());
+}
+
+void VrShellGl::SendScrollEnd(GestureList& gesture_list) {
+  if (!in_scroll_)
+    return;
+  DCHECK_NE(input_locked_element_, nullptr);
+  if (controller_->ButtonDownHappened(gvr::kControllerButtonClick)) {
+    DCHECK_GT(gesture_list.size(), 0LU);
+    DCHECK_EQ(gesture_list.front()->GetType(),
+              blink::WebInputEvent::kGestureScrollEnd);
+  }
+  // Scrolling currently only supported on content window.
+  DCHECK_EQ(input_locked_element_->fill(), Fill::CONTENT);
+  if (gesture_list.empty() || (gesture_list.front()->GetType() !=
+                               blink::WebInputEvent::kGestureScrollEnd))
+    return;
+  DCHECK_LE(gesture_list.size(), 2LU);
+  SendGestureToContent(std::move(gesture_list.front()));
+  gesture_list.erase(gesture_list.begin());
+  if (!gesture_list.empty()) {
+    DCHECK_EQ(gesture_list.front()->GetType(),
+              blink::WebInputEvent::kGestureFlingStart);
+    SendGestureToContent(std::move(gesture_list.front()));
+    fling_target_ = input_locked_element_;
+    gesture_list.erase(gesture_list.begin());
+  }
+  input_locked_element_ = nullptr;
+  in_scroll_ = false;
+}
+
+bool VrShellGl::SendScrollBegin(UiElement* target, GestureList& gesture_list) {
+  if (in_scroll_ || !target)
+    return false;
+  // Scrolling currently only supported on content window.
+  if (target->fill() != Fill::CONTENT)
+    return false;
+  if (gesture_list.empty() || (gesture_list.front()->GetType() !=
+                               blink::WebInputEvent::kGestureScrollBegin))
+    return false;
+  input_locked_element_ = target;
+  in_scroll_ = true;
+
+  SendGestureToContent(std::move(gesture_list.front()));
+  gesture_list.erase(gesture_list.begin());
+  return true;
+}
+
+void VrShellGl::SendScrollUpdate(GestureList& gesture_list) {
+  if (!in_scroll_)
+    return;
+  DCHECK(input_locked_element_);
+  if (gesture_list.empty() || (gesture_list.front()->GetType() !=
+                               blink::WebInputEvent::kGestureScrollUpdate))
+    return;
+  // Scrolling currently only supported on content window.
+  DCHECK_EQ(input_locked_element_->fill(), Fill::CONTENT);
+  SendGestureToContent(std::move(gesture_list.front()));
+  gesture_list.erase(gesture_list.begin());
+}
+
+void VrShellGl::SendHoverLeave(UiElement* target) {
+  if (!hover_target_ || (target == hover_target_))
+    return;
+  if (hover_target_->fill() == Fill::CONTENT) {
+    SendGestureToContent(MakeMouseEvent(blink::WebInputEvent::kMouseLeave,
+                                        NowSeconds(), gfx::Point()));
+  } else {
+    hover_target_->OnHoverLeave();
+  }
+  hover_target_ = nullptr;
+}
+
+bool VrShellGl::SendHoverEnter(UiElement* target,
+                               const gfx::PointF& target_point,
+                               const gfx::Point& local_point_pixels) {
+  if (!target || target == hover_target_)
+    return false;
+  if (target->fill() == Fill::CONTENT) {
+    SendGestureToContent(MakeMouseEvent(blink::WebInputEvent::kMouseEnter,
+                                        NowSeconds(), local_point_pixels));
+  } else {
+    target->OnHoverEnter(target_point);
+  }
+  hover_target_ = target;
+  return true;
+}
+
+void VrShellGl::SendHoverMove(const gfx::PointF& target_point,
+                              const gfx::Point& local_point_pixels) {
+  if (!hover_target_)
+    return;
+  if (hover_target_->fill() == Fill::CONTENT) {
+    SendGestureToContent(MakeMouseEvent(blink::WebInputEvent::kMouseMove,
+                                        NowSeconds(), local_point_pixels));
+  } else {
+    hover_target_->OnMove(target_point);
+  }
+}
+
+void VrShellGl::SendButtonDown(UiElement* target,
+                               const gfx::PointF& target_point) {
+  if (in_click_)
+    return;
+  if (!controller_->ButtonDownHappened(gvr::kControllerButtonClick))
+    return;
+  input_locked_element_ = target;
+  in_click_ = true;
+  // We don't support down/up for content yet.
+  if (!target || target->fill() == Fill::CONTENT)
+    return;
+  target->OnButtonDown(target_point);
+}
+
+bool VrShellGl::SendButtonUp(UiElement* target,
+                             const gfx::PointF& target_point) {
+  if (!in_click_)
+    return false;
+  if (!controller_->ButtonUpHappened(gvr::kControllerButtonClick))
+    return false;
+  DCHECK(input_locked_element_ == target);
+  input_locked_element_ = nullptr;
+  in_click_ = false;
+  // We don't support down/up for content yet.
+  if (target->fill() == Fill::CONTENT)
+    return false;
+  target->OnButtonUp(target_point);
+  return true;
+}
+
+void VrShellGl::SendTap(UiElement* target,
+                        const gfx::PointF& target_point,
+                        const gfx::Point& local_point_pixels) {
+  if (!target)
+    return;
+  if (controller_->ButtonUpHappened(gvr::kControllerButtonClick) &&
+      target->fill() == Fill::CONTENT)
+    touch_pending_ = true;
+  if (!touch_pending_)
+    return;
+  touch_pending_ = false;
+  if (target->fill() == Fill::CONTENT) {
+    auto gesture = base::MakeUnique<blink::WebGestureEvent>(
+        blink::WebInputEvent::kGestureTapDown,
+        blink::WebInputEvent::kNoModifiers, NowSeconds());
+    gesture->source_device = blink::kWebGestureDeviceTouchpad;
+    gesture->x = local_point_pixels.x();
+    gesture->y = local_point_pixels.y();
+    SendGestureToContent(std::move(gesture));
+  } else {
+    target->OnButtonDown(target_point);
+    target->OnButtonUp(target_point);
+  }
+}
+
+void VrShellGl::GetVisualTargetElement(
+    const gfx::Vector3dF& controller_direction,
+    gfx::Vector3dF& eye_to_target,
+    gfx::Point3F& target_point,
+    UiElement** target_element,
+    gfx::PointF& target_local_point) const {
   // If we place the reticle based on elements intersecting the controller beam,
   // we can end up with the reticle hiding behind elements, or jumping laterally
   // in the field of view. This is physically correct, but hard to use. For
@@ -562,63 +795,55 @@
   // that the sphere is centered at the controller, rather than the eye, for
   // simplicity.
   float distance = scene_->GetBackgroundDistance();
-  target_point_ =
+  target_point =
       vr::GetRayPoint(pointer_start_, controller_direction, distance);
-  gfx::Vector3dF eye_to_target = target_point_ - kOrigin;
+  eye_to_target = target_point - kOrigin;
   vr::NormalizeVector(&eye_to_target);
 
   // Determine which UI element (if any) intersects the line between the eyes
   // and the controller target position.
-  float closest_element_distance = (target_point_ - kOrigin).Length();
-  previous_target_element_ = target_element_;
-  target_element_ = nullptr;
-  float target_x;
-  float target_y;
+  float closest_element_distance = (target_point - kOrigin).Length();
 
-  for (auto& plane : scene_->GetUiElements()) {
-    if (!plane->IsHitTestable())
+  for (auto& element : scene_->GetUiElements()) {
+    if (!element->IsHitTestable())
       continue;
-
+    gfx::PointF local_point;
+    gfx::Point3F plane_intersection_point;
     float distance_to_plane;
-    if (!plane->GetRayDistance(kOrigin, eye_to_target, &distance_to_plane))
+    if (!GetTargetLocalPoint(eye_to_target, *element.get(),
+                             closest_element_distance, local_point,
+                             plane_intersection_point, distance_to_plane))
       continue;
 
-    if (distance_to_plane < 0 || distance_to_plane >= closest_element_distance)
-      continue;
-
-    gfx::Point3F plane_intersection_point =
-        vr::GetRayPoint(kOrigin, eye_to_target, distance_to_plane);
-    gfx::PointF unit_xy_point =
-        plane->GetUnitRectangleCoordinates(plane_intersection_point);
-
-    float x = 0.5f + unit_xy_point.x();
-    float y = 0.5f - unit_xy_point.y();
-    if (x < 0.0f || x >= 1.0f || y < 0.0f || y >= 1.0f)
+    if (local_point.x() < 0.0f || local_point.x() >= 1.0f ||
+        local_point.y() < 0.0f || local_point.y() >= 1.0f)
       continue;
 
     closest_element_distance = distance_to_plane;
-    target_point_ = plane_intersection_point;
-    target_element_ = plane.get();
-    target_x = x;
-    target_y = y;
+    target_point = plane_intersection_point;
+    *target_element = element.get();
+    target_local_point = local_point;
   }
+}
 
-  // Handle input targeting on the content quad, ignoring any other elements.
-  // Content is treated specially to accomodate scrolling, flings, etc.
-  InputTarget input_target = InputTarget::NONE;
-  int pixel_x = 0;
-  int pixel_y = 0;
-  if (target_element_ != nullptr && target_element_->fill() == Fill::CONTENT) {
-    input_target = InputTarget::CONTENT;
-    gfx::RectF pixel_rect(0, 0, content_tex_css_width_,
-                          content_tex_css_height_);
-    pixel_x = pixel_rect.x() + pixel_rect.width() * target_x;
-    pixel_y = pixel_rect.y() + pixel_rect.height() * target_y;
-  }
-  SendInputToContent(input_target, pixel_x, pixel_y);
+bool VrShellGl::GetTargetLocalPoint(const gfx::Vector3dF& eye_to_target,
+                                    const UiElement& element,
+                                    float max_distance_to_plane,
+                                    gfx::PointF& target_local_point,
+                                    gfx::Point3F& target_point,
+                                    float& distance_to_plane) const {
+  if (!element.GetRayDistance(kOrigin, eye_to_target, &distance_to_plane))
+    return false;
 
-  // Handle input targeting on all non-content elements.
-  SendInputToUiElements(target_element_);
+  if (distance_to_plane < 0 || distance_to_plane >= max_distance_to_plane)
+    return false;
+
+  target_point = vr::GetRayPoint(kOrigin, eye_to_target, distance_to_plane);
+  gfx::PointF unit_xy_point = element.GetUnitRectangleCoordinates(target_point);
+
+  target_local_point.set_x(0.5f + unit_xy_point.x());
+  target_local_point.set_y(0.5f - unit_xy_point.y());
+  return true;
 }
 
 void VrShellGl::HandleControllerAppButtonActivity(
@@ -651,125 +876,6 @@
   }
 }
 
-void VrShellGl::SendInputToContent(InputTarget input_target,
-                                   int pixel_x,
-                                   int pixel_y) {
-  std::vector<std::unique_ptr<WebGestureEvent>> gesture_list =
-      controller_->DetectGestures();
-  double timestamp = gesture_list.front()->TimeStampSeconds();
-
-  if (touch_pending_) {
-    touch_pending_ = false;
-    std::unique_ptr<WebGestureEvent> event(
-        new WebGestureEvent(WebInputEvent::kGestureTapDown,
-                            WebInputEvent::kNoModifiers, timestamp));
-    event->source_device = blink::kWebGestureDeviceTouchpad;
-    event->x = pixel_x;
-    event->y = pixel_y;
-    gesture_list.push_back(std::move(event));
-  }
-
-  for (auto& gesture : gesture_list) {
-    gesture->x = pixel_x;
-    gesture->y = pixel_y;
-    auto movableGesture = base::MakeUnique<WebGestureEvent>(*gesture);
-
-    switch (gesture->GetType()) {
-      // Once the user starts scrolling send all the scroll events to this
-      // element until the scrolling stops.
-      case WebInputEvent::kGestureScrollBegin:
-        current_scroll_target_ = input_target;
-        if (current_scroll_target_ != InputTarget::NONE) {
-          SendGestureToContent(std::move(movableGesture));
-        }
-        break;
-      case WebInputEvent::kGestureScrollEnd:
-        if (current_scroll_target_ != InputTarget::NONE) {
-          SendGestureToContent(std::move(movableGesture));
-        }
-        current_fling_target_ = current_scroll_target_;
-        current_scroll_target_ = InputTarget::NONE;
-        break;
-      case WebInputEvent::kGestureScrollUpdate:
-        if (current_scroll_target_ != InputTarget::NONE) {
-          SendGestureToContent(std::move(movableGesture));
-        }
-        break;
-      case WebInputEvent::kGestureFlingStart:
-        if (current_fling_target_ != InputTarget::NONE) {
-          SendGestureToContent(std::move(movableGesture));
-        }
-        current_fling_target_ = InputTarget::NONE;
-        break;
-      case WebInputEvent::kGestureFlingCancel:
-        current_fling_target_ = InputTarget::NONE;
-        if (input_target != InputTarget::NONE) {
-          SendGestureToContent(std::move(movableGesture));
-        }
-        break;
-      case WebInputEvent::kGestureTapDown:
-        current_fling_target_ = InputTarget::NONE;
-        if (input_target != InputTarget::NONE) {
-          SendGestureToContent(std::move(movableGesture));
-        }
-        break;
-      case WebInputEvent::kUndefined:
-        break;
-      default:
-        NOTREACHED();
-    }
-  }
-
-  // Hover support
-  bool new_target = input_target != current_input_target_;
-  if (new_target && current_input_target_ != InputTarget::NONE) {
-    // Send a move event indicating that the pointer moved off of an element.
-    SendGestureToContent(
-        MakeMouseEvent(WebInputEvent::kMouseLeave, timestamp, 0, 0));
-  }
-  current_input_target_ = input_target;
-  if (current_input_target_ != InputTarget::NONE) {
-    WebInputEvent::Type type =
-        new_target ? WebInputEvent::kMouseEnter : WebInputEvent::kMouseMove;
-    SendGestureToContent(MakeMouseEvent(type, timestamp, pixel_x, pixel_y));
-  }
-}
-
-void VrShellGl::SendInputToUiElements(UiElement* target_element) {
-  if (target_element != previous_target_element_) {
-    if (previous_target_element_ &&
-        previous_target_element_->fill() != Fill::CONTENT) {
-      task_runner_->PostTask(
-          FROM_HERE, base::Bind(&UiElement::OnHoverLeave,
-                                base::Unretained(previous_target_element_)));
-    }
-    if (target_element && target_element->fill() != Fill::CONTENT) {
-      task_runner_->PostTask(FROM_HERE,
-                             base::Bind(&UiElement::OnHoverEnter,
-                                        base::Unretained(target_element)));
-    }
-    click_target_element_ = nullptr;
-  }
-  if (target_element && target_element->fill() != Fill::CONTENT) {
-    if (controller_->ButtonDownHappened(
-            gvr::ControllerButton::GVR_CONTROLLER_BUTTON_CLICK)) {
-      task_runner_->PostTask(FROM_HERE,
-                             base::Bind(&UiElement::OnButtonDown,
-                                        base::Unretained(target_element)));
-      click_target_element_ = target_element;
-    }
-    if (controller_->ButtonUpHappened(
-            gvr::ControllerButton::GVR_CONTROLLER_BUTTON_CLICK)) {
-      if (click_target_element_ == target_element) {
-        task_runner_->PostTask(FROM_HERE,
-                               base::Bind(&UiElement::OnButtonUp,
-                                          base::Unretained(target_element)));
-      }
-      click_target_element_ = nullptr;
-    }
-  }
-}
-
 void VrShellGl::SendGestureToContent(
     std::unique_ptr<blink::WebInputEvent> event) {
   browser_->ProcessContentGesture(std::move(event));
@@ -1080,9 +1186,9 @@
       &mat);
 
   vr::Quatf rotation;
-  if (target_element_ != nullptr) {
+  if (cursor_render_target_ != nullptr) {
     // Make the reticle planar to the element it's hitting.
-    rotation = GetRotationFromZAxis(target_element_->GetNormal());
+    rotation = GetRotationFromZAxis(cursor_render_target_->GetNormal());
   } else {
     // Rotate the cursor to directly face the eyes.
     rotation = GetRotationFromZAxis(target_point_ - kOrigin);
diff --git a/chrome/browser/android/vr_shell/vr_shell_gl.h b/chrome/browser/android/vr_shell/vr_shell_gl.h
index df5d8a10..5da1123 100644
--- a/chrome/browser/android/vr_shell/vr_shell_gl.h
+++ b/chrome/browser/android/vr_shell/vr_shell_gl.h
@@ -15,6 +15,7 @@
 #include "base/memory/ref_counted.h"
 #include "base/memory/weak_ptr.h"
 #include "base/single_thread_task_runner.h"
+#include "chrome/browser/android/vr_shell/vr_controller.h"
 #include "chrome/browser/android/vr_shell/vr_controller_model.h"
 #include "device/vr/vr_service.mojom.h"
 #include "device/vr/vr_types.h"
@@ -63,11 +64,6 @@
 // It is not threadsafe and must only be used on the GL thread.
 class VrShellGl : public device::mojom::VRVSyncProvider {
  public:
-  enum class InputTarget {
-    NONE = 0,
-    CONTENT,
-  };
-
   VrShellGl(VrBrowserInterface* browser,
             gvr_context* gvr_api,
             bool initially_web_vr,
@@ -135,11 +131,36 @@
   bool WebVrPoseByteIsValid(int pose_index_byte);
 
   void UpdateController(const gfx::Vector3dF& head_direction);
+  void HandleWebVrCompatibilityClick();
+  void SendFlingCancel(GestureList& gesture_list);
+  void SendScrollEnd(GestureList& gesture_list);
+  bool SendScrollBegin(UiElement* target, GestureList& gesture_list);
+  void SendScrollUpdate(GestureList& gesture_list);
+  void SendHoverLeave(UiElement* target);
+  bool SendHoverEnter(UiElement* target,
+                      const gfx::PointF& target_point,
+                      const gfx::Point& local_point_pixels);
+  void SendHoverMove(const gfx::PointF& target_point,
+                     const gfx::Point& local_point_pixels);
+  void SendButtonDown(UiElement* target, const gfx::PointF& target_point);
+  bool SendButtonUp(UiElement* target, const gfx::PointF& target_point);
+  void SendTap(UiElement* target,
+               const gfx::PointF& target_point,
+               const gfx::Point& local_point_pixels);
+  void GetVisualTargetElement(const gfx::Vector3dF& controller_direction,
+                              gfx::Vector3dF& eye_to_target,
+                              gfx::Point3F& target_point,
+                              UiElement** target_element,
+                              gfx::PointF& target_local_point) const;
+  bool GetTargetLocalPoint(const gfx::Vector3dF& eye_to_target,
+                           const UiElement& element,
+                           float max_distance_to_plane,
+                           gfx::PointF& target_local_point,
+                           gfx::Point3F& target_point,
+                           float& distance_to_plane) const;
   void HandleControllerInput(const gfx::Vector3dF& head_direction);
   void HandleControllerAppButtonActivity(
       const gfx::Vector3dF& controller_direction);
-  void SendInputToContent(InputTarget input_target, int pixel_x, int pixel_y);
-  void SendInputToUiElements(UiElement* target_element);
   void SendGestureToContent(std::unique_ptr<blink::WebInputEvent> event);
   void CreateUiSurface();
   void OnContentFrameAvailable();
@@ -195,15 +216,17 @@
 
   gfx::Point3F target_point_;
 
-  // Input targeting for non-content elements.
-  UiElement* target_element_ = nullptr;
-  UiElement* previous_target_element_ = nullptr;
-  UiElement* click_target_element_ = nullptr;
-
-  // Input targeting for the content element.
-  InputTarget current_input_target_ = InputTarget::NONE;
-  InputTarget current_scroll_target_ = InputTarget::NONE;
-  InputTarget current_fling_target_ = InputTarget::NONE;
+  // TODO(mthiesse): We need to handle elements being removed, and update this
+  // state appropriately.
+  UiElement* cursor_render_target_ = nullptr;
+  UiElement* hover_target_ = nullptr;
+  // TODO(mthiesse): We shouldn't have a fling target. Elements should fling
+  // independently and we should only cancel flings on the relevant element
+  // when we do cancel flings.
+  UiElement* fling_target_ = nullptr;
+  UiElement* input_locked_element_ = nullptr;
+  bool in_scroll_ = false;
+  bool in_click_ = false;
 
   int content_tex_css_width_ = 0;
   int content_tex_css_height_ = 0;
diff --git a/chrome/browser/chromeos/policy/signin_profile_apps_policy_browsertest.cc b/chrome/browser/chromeos/policy/signin_profile_apps_policy_browsertest.cc
index aea97d5..0c51c22 100644
--- a/chrome/browser/chromeos/policy/signin_profile_apps_policy_browsertest.cc
+++ b/chrome/browser/chromeos/policy/signin_profile_apps_policy_browsertest.cc
@@ -145,31 +145,8 @@
   return profile;
 }
 
-// Tests for the sign-in profile apps being enabled via the command line flag.
-// TODO(emaxx): Remove this smoke test once it's investigated whether just
-// specifying this command line flag leads to tests being timed out.
-class SigninProfileAppsEnabledViaCommandLineTest : public InProcessBrowserTest {
- protected:
-  SigninProfileAppsEnabledViaCommandLineTest() {}
-
-  void SetUpCommandLine(base::CommandLine* command_line) override {
-    InProcessBrowserTest::SetUpCommandLine(command_line);
-    command_line->AppendSwitch(switches::kEnableLoginScreenApps);
-  }
-
- private:
-  DISALLOW_COPY_AND_ASSIGN(SigninProfileAppsEnabledViaCommandLineTest);
-};
-
 }  // namespace
 
-IN_PROC_BROWSER_TEST_F(SigninProfileAppsEnabledViaCommandLineTest,
-                       NoExtensions) {
-  EXPECT_TRUE(extensions::ExtensionSystem::Get(GetProfile())
-                  ->extension_service()
-                  ->extensions_enabled());
-}
-
 namespace {
 
 // Base class for testing sign-in profile apps that are installed via the device
@@ -183,7 +160,6 @@
     DevicePolicyCrosBrowserTest::SetUpCommandLine(command_line);
     command_line->AppendSwitch(chromeos::switches::kLoginManager);
     command_line->AppendSwitch(chromeos::switches::kForceLoginManagerInTests);
-    command_line->AppendSwitch(switches::kEnableLoginScreenApps);
   }
 
   void SetUpInProcessBrowserTestFixture() override {
@@ -325,6 +301,14 @@
 
 }  // namespace
 
+// Tests that the extension system enables non-standard extensions in the
+// sign-in profile.
+IN_PROC_BROWSER_TEST_F(SigninProfileAppsPolicyTest, ExtensionsEnabled) {
+  EXPECT_TRUE(extensions::ExtensionSystem::Get(GetProfile())
+                  ->extension_service()
+                  ->extensions_enabled());
+}
+
 // Tests that a background page is created for the installed sign-in profile
 // app.
 IN_PROC_BROWSER_TEST_F(SigninProfileAppsPolicyTest, BackgroundPage) {
diff --git a/chrome/browser/component_updater/chrome_component_updater_configurator.cc b/chrome/browser/component_updater/chrome_component_updater_configurator.cc
index 5acfc4d..6d26920 100644
--- a/chrome/browser/component_updater/chrome_component_updater_configurator.cc
+++ b/chrome/browser/component_updater/chrome_component_updater_configurator.cc
@@ -211,7 +211,8 @@
     const base::CommandLine* cmdline,
     net::URLRequestContextGetter* context_getter,
     PrefService* pref_service) {
-  return new ChromeConfigurator(cmdline, context_getter, pref_service);
+  return base::MakeShared<ChromeConfigurator>(cmdline, context_getter,
+                                              pref_service);
 }
 
 }  // namespace component_updater
diff --git a/chrome/browser/component_updater/component_patcher_operation_out_of_process.cc b/chrome/browser/component_updater/component_patcher_operation_out_of_process.cc
index 9ba253d..5068cb52 100644
--- a/chrome/browser/component_updater/component_patcher_operation_out_of_process.cc
+++ b/chrome/browser/component_updater/component_patcher_operation_out_of_process.cc
@@ -4,6 +4,8 @@
 
 #include "chrome/browser/component_updater/component_patcher_operation_out_of_process.h"
 
+#include <utility>
+
 #include "base/bind.h"
 #include "base/callback.h"
 #include "base/files/file.h"
@@ -11,6 +13,7 @@
 #include "base/sequenced_task_runner.h"
 #include "base/strings/string16.h"
 #include "chrome/grit/generated_resources.h"
+#include "components/update_client/component_patcher_operation.h"
 #include "content/public/browser/browser_thread.h"
 #include "ui/base/l10n/l10n_util.h"
 
@@ -22,15 +25,15 @@
 
 void ChromeOutOfProcessPatcher::Patch(
     const std::string& operation,
-    scoped_refptr<base::SequencedTaskRunner> task_runner,
+    const scoped_refptr<base::SequencedTaskRunner>& task_runner,
     const base::FilePath& input_path,
     const base::FilePath& patch_path,
     const base::FilePath& output_path,
-    base::Callback<void(int result)> callback) {
+    const base::Callback<void(int result)>& callback) {
   DCHECK(task_runner);
   DCHECK(!callback.is_null());
 
-  task_runner_ = std::move(task_runner);
+  task_runner_ = task_runner;
   callback_ = callback;
 
   base::File input_file(input_path,
diff --git a/chrome/browser/component_updater/component_patcher_operation_out_of_process.h b/chrome/browser/component_updater/component_patcher_operation_out_of_process.h
index 8424a01..e5ebe52 100644
--- a/chrome/browser/component_updater/component_patcher_operation_out_of_process.h
+++ b/chrome/browser/component_updater/component_patcher_operation_out_of_process.h
@@ -5,13 +5,14 @@
 #ifndef CHROME_BROWSER_COMPONENT_UPDATER_COMPONENT_PATCHER_OPERATION_OUT_OF_PROCESS_H_
 #define CHROME_BROWSER_COMPONENT_UPDATER_COMPONENT_PATCHER_OPERATION_OUT_OF_PROCESS_H_
 
+#include <memory>
 #include <string>
 
 #include "base/callback_forward.h"
 #include "base/macros.h"
 #include "base/memory/ref_counted.h"
 #include "chrome/common/file_patcher.mojom.h"
-#include "components/update_client/component_patcher_operation.h"
+#include "components/update_client/out_of_process_patcher.h"
 #include "content/public/browser/utility_process_mojo_client.h"
 
 namespace base {
@@ -27,11 +28,11 @@
 
   // update_client::OutOfProcessPatcher:
   void Patch(const std::string& operation,
-             scoped_refptr<base::SequencedTaskRunner> task_runner,
+             const scoped_refptr<base::SequencedTaskRunner>& task_runner,
              const base::FilePath& input_path,
              const base::FilePath& patch_path,
              const base::FilePath& output_path,
-             base::Callback<void(int result)> callback) override;
+             const base::Callback<void(int result)>& callback) override;
 
  private:
   ~ChromeOutOfProcessPatcher() override;
diff --git a/chrome/browser/extensions/chrome_process_manager_delegate.cc b/chrome/browser/extensions/chrome_process_manager_delegate.cc
index 0fa3935c..9e983ef 100644
--- a/chrome/browser/extensions/chrome_process_manager_delegate.cc
+++ b/chrome/browser/extensions/chrome_process_manager_delegate.cc
@@ -70,8 +70,8 @@
 
   if (is_signin_profile) {
     // Check for flag.
-    if (!base::CommandLine::ForCurrentProcess()->HasSwitch(
-            switches::kEnableLoginScreenApps)) {
+    if (base::CommandLine::ForCurrentProcess()->HasSwitch(
+            switches::kDisableLoginScreenApps)) {
       return false;
     }
 
diff --git a/chrome/browser/extensions/extension_startup_browsertest.cc b/chrome/browser/extensions/extension_startup_browsertest.cc
index 8ecfb4a..3fa5642e 100644
--- a/chrome/browser/extensions/extension_startup_browsertest.cc
+++ b/chrome/browser/extensions/extension_startup_browsertest.cc
@@ -273,20 +273,9 @@
 
 #if defined(OS_CHROMEOS)
 
-class ExtensionsLoadTestWithLoginScreenApps : public ExtensionsLoadTest {
- protected:
-  void SetUpCommandLine(base::CommandLine* command_line) override {
-    ExtensionsLoadTest::SetUpCommandLine(command_line);
-    // TODO(emaxx): Remove this test fixture class once the
-    // EnableLoginScreenApps command line flag becomes on by default.
-    // crbug.com/576464
-    command_line->AppendSwitch(switches::kEnableLoginScreenApps);
-  }
-};
-
 // Flaky test crbug.com/716727
-IN_PROC_BROWSER_TEST_F(ExtensionsLoadTestWithLoginScreenApps,
-                       DISABLED_CommandLineExtensionsDontLoad) {
+IN_PROC_BROWSER_TEST_F(ExtensionsLoadTest,
+                       DISABLED_SigninProfileCommandLineExtensionsDontLoad) {
   // The --load-extension command line flag should not be applied to the sign-in
   // profile.
   EXPECT_EQ(0, GetNonComponentEnabledExtensionCount(
diff --git a/chrome/browser/google/google_update_win.cc b/chrome/browser/google/google_update_win.cc
index 4c93b43..adbd19d 100644
--- a/chrome/browser/google/google_update_win.cc
+++ b/chrome/browser/google/google_update_win.cc
@@ -195,8 +195,8 @@
 
   ConfigureProxyBlanket(class_factory.Get());
 
-  return class_factory->CreateInstance(nullptr,
-                                       IID_PPV_ARGS(google_update->Receive()));
+  return class_factory->CreateInstance(
+      nullptr, IID_PPV_ARGS(google_update->GetAddressOf()));
 }
 
 // UpdateCheckDriver -----------------------------------------------------------
@@ -526,10 +526,10 @@
   if (!app_bundle_) {
     base::win::ScopedComPtr<IAppBundleWeb> app_bundle;
     base::win::ScopedComPtr<IDispatch> dispatch;
-    hresult = google_update_->createAppBundleWeb(dispatch.Receive());
+    hresult = google_update_->createAppBundleWeb(dispatch.GetAddressOf());
     if (FAILED(hresult))
       return hresult;
-    hresult = dispatch.CopyTo(app_bundle.Receive());
+    hresult = dispatch.CopyTo(app_bundle.GetAddressOf());
     if (FAILED(hresult))
       return hresult;
     dispatch.Reset();
@@ -572,11 +572,11 @@
     // this point onward result in it being released.
     base::win::ScopedComPtr<IAppBundleWeb> app_bundle;
     app_bundle.swap(app_bundle_);
-    hresult = app_bundle->get_appWeb(0, dispatch.Receive());
+    hresult = app_bundle->get_appWeb(0, dispatch.GetAddressOf());
     if (FAILED(hresult))
       return hresult;
     base::win::ScopedComPtr<IAppWeb> app;
-    hresult = dispatch.CopyTo(app.Receive());
+    hresult = dispatch.CopyTo(app.GetAddressOf());
     if (FAILED(hresult))
       return hresult;
     ConfigureProxyBlanket(app.Get());
@@ -595,10 +595,10 @@
     CurrentState* state_value,
     HRESULT* hresult) const {
   base::win::ScopedComPtr<IDispatch> dispatch;
-  *hresult = app_->get_currentState(dispatch.Receive());
+  *hresult = app_->get_currentState(dispatch.GetAddressOf());
   if (FAILED(*hresult))
     return false;
-  *hresult = dispatch.CopyTo(current_state->Receive());
+  *hresult = dispatch.CopyTo(current_state->GetAddressOf());
   if (FAILED(*hresult))
     return false;
   ConfigureProxyBlanket(current_state->Get());
diff --git a/chrome/browser/importer/ie_importer_browsertest_win.cc b/chrome/browser/importer/ie_importer_browsertest_win.cc
index ed6974f7..211540e 100644
--- a/chrome/browser/importer/ie_importer_browsertest_win.cc
+++ b/chrome/browser/importer/ie_importer_browsertest_win.cc
@@ -188,9 +188,8 @@
     if (FAILED(property_set_storage.QueryFrom(locator.Get())))
       return false;
     base::win::ScopedComPtr<IPropertyStorage> property_storage;
-    if (FAILED(property_set_storage->Open(FMTID_Intshcut,
-                                          STGM_WRITE,
-                                          property_storage.Receive()))) {
+    if (FAILED(property_set_storage->Open(FMTID_Intshcut, STGM_WRITE,
+                                          property_storage.GetAddressOf()))) {
       return false;
     }
     PROPSPEC properties[] = {{PRSPEC_PROPID, {PID_IS_ICONFILE}}};
diff --git a/chrome/browser/media_galleries/win/mtp_device_delegate_impl_win.cc b/chrome/browser/media_galleries/win/mtp_device_delegate_impl_win.cc
index 2e6bca4a..9de2e33c 100644
--- a/chrome/browser/media_galleries/win/mtp_device_delegate_impl_win.cc
+++ b/chrome/browser/media_galleries/win/mtp_device_delegate_impl_win.cc
@@ -247,9 +247,7 @@
   base::win::ScopedComPtr<IStream> file_stream;
   if (file_info.size > 0) {
     HRESULT hr = media_transfer_protocol::GetFileStreamForObject(
-        device,
-        file_object_id,
-        file_stream.Receive(),
+        device, file_object_id, file_stream.GetAddressOf(),
         &optimal_transfer_size);
     if (hr != S_OK)
       return base::File::FILE_ERROR_FAILED;
diff --git a/chrome/browser/media_galleries/win/mtp_device_operations_util.cc b/chrome/browser/media_galleries/win/mtp_device_operations_util.cc
index 2bc9cd8..893a646 100644
--- a/chrome/browser/media_galleries/win/mtp_device_operations_util.cc
+++ b/chrome/browser/media_galleries/win/mtp_device_operations_util.cc
@@ -59,7 +59,7 @@
   base::ThreadRestrictions::AssertIOAllowed();
   DCHECK(device);
   base::win::ScopedComPtr<IPortableDeviceContent> content;
-  if (SUCCEEDED(device->Content(content.Receive())))
+  if (SUCCEEDED(device->Content(content.GetAddressOf())))
     return content;
   return base::win::ScopedComPtr<IPortableDeviceContent>();
 }
@@ -80,7 +80,7 @@
 
   base::win::ScopedComPtr<IEnumPortableDeviceObjectIDs> enum_object_ids;
   if (SUCCEEDED(content->EnumObjects(0, parent_id.c_str(), NULL,
-                                     enum_object_ids.Receive())))
+                                     enum_object_ids.GetAddressOf())))
     return enum_object_ids;
   return base::win::ScopedComPtr<IEnumPortableDeviceObjectIDs>();
 }
@@ -186,7 +186,7 @@
     return false;
 
   base::win::ScopedComPtr<IPortableDeviceProperties> properties;
-  HRESULT hr = content->Properties(properties.Receive());
+  HRESULT hr = content->Properties(properties.GetAddressOf());
   if (FAILED(hr))
     return false;
 
@@ -207,9 +207,8 @@
     return false;
 
   base::win::ScopedComPtr<IPortableDeviceValues> properties_values;
-  hr = properties->GetValues(object_id.c_str(),
-                             properties_to_read.Get(),
-                             properties_values.Receive());
+  hr = properties->GetValues(object_id.c_str(), properties_to_read.Get(),
+                             properties_values.GetAddressOf());
   if (FAILED(hr))
     return false;
 
@@ -364,7 +363,7 @@
     return E_FAIL;
 
   base::win::ScopedComPtr<IPortableDeviceResources> resources;
-  HRESULT hr = content->Transfer(resources.Receive());
+  HRESULT hr = content->Transfer(resources.GetAddressOf());
   if (FAILED(hr))
     return hr;
   return resources->GetStream(file_object_id.c_str(), WPD_RESOURCE_DEFAULT,
diff --git a/chrome/browser/metrics/antivirus_metrics_provider_win.cc b/chrome/browser/metrics/antivirus_metrics_provider_win.cc
index c5cfad47..47681b2 100644
--- a/chrome/browser/metrics/antivirus_metrics_provider_win.cc
+++ b/chrome/browser/metrics/antivirus_metrics_provider_win.cc
@@ -347,7 +347,7 @@
   base::win::ScopedComPtr<IWbemServices> wmi_services;
   hr = wmi_locator->ConnectServer(
       base::win::ScopedBstr(L"ROOT\\SecurityCenter2"), nullptr, nullptr,
-      nullptr, 0, nullptr, nullptr, wmi_services.Receive());
+      nullptr, 0, nullptr, nullptr, wmi_services.GetAddressOf());
   if (FAILED(hr))
     return RESULT_FAILED_TO_CONNECT_TO_WMI;
 
@@ -366,7 +366,7 @@
   hr = wmi_services->ExecQuery(
       query_language, query,
       WBEM_FLAG_FORWARD_ONLY | WBEM_FLAG_RETURN_IMMEDIATELY, nullptr,
-      enumerator.Receive());
+      enumerator.GetAddressOf());
   if (FAILED(hr))
     return RESULT_FAILED_TO_EXEC_WMI_QUERY;
 
@@ -375,7 +375,7 @@
   while (true) {
     base::win::ScopedComPtr<IWbemClassObject> class_object;
     ULONG items_returned = 0;
-    hr = enumerator->Next(WBEM_INFINITE, 1, class_object.Receive(),
+    hr = enumerator->Next(WBEM_INFINITE, 1, class_object.GetAddressOf(),
                           &items_returned);
     if (FAILED(hr))
       return RESULT_FAILED_TO_ITERATE_RESULTS;
diff --git a/chrome/browser/page_load_metrics/metrics_web_contents_observer.cc b/chrome/browser/page_load_metrics/metrics_web_contents_observer.cc
index 044495e..c75afcf 100644
--- a/chrome/browser/page_load_metrics/metrics_web_contents_observer.cc
+++ b/chrome/browser/page_load_metrics/metrics_web_contents_observer.cc
@@ -607,7 +607,7 @@
   committed_load_->UpdateTiming(timing, metadata);
 
   for (auto& observer : testing_observers_)
-    observer.OnTimingUpdated(timing, metadata);
+    observer.OnTimingUpdated(true /* is_main_frame */, timing, metadata);
 }
 
 bool MetricsWebContentsObserver::ShouldTrackNavigation(
diff --git a/chrome/browser/page_load_metrics/metrics_web_contents_observer.h b/chrome/browser/page_load_metrics/metrics_web_contents_observer.h
index 07c14bf..2735b4a 100644
--- a/chrome/browser/page_load_metrics/metrics_web_contents_observer.h
+++ b/chrome/browser/page_load_metrics/metrics_web_contents_observer.h
@@ -56,7 +56,8 @@
     void OnGoingAway();
 
     // Invoked when a new PageLoadTiming update has been received and processed.
-    virtual void OnTimingUpdated(const PageLoadTiming& timing,
+    virtual void OnTimingUpdated(bool is_main_frame,
+                                 const PageLoadTiming& timing,
                                  const PageLoadMetadata& metadata) {}
 
    private:
diff --git a/chrome/browser/page_load_metrics/observers/ads_page_load_metrics_observer.cc b/chrome/browser/page_load_metrics/observers/ads_page_load_metrics_observer.cc
index 9b90abb..37cdf23c 100644
--- a/chrome/browser/page_load_metrics/observers/ads_page_load_metrics_observer.cc
+++ b/chrome/browser/page_load_metrics/observers/ads_page_load_metrics_observer.cc
@@ -19,7 +19,8 @@
 
 namespace {
 
-const base::Feature kAdsFeature{"AdsMetrics", base::FEATURE_ENABLED_BY_DEFAULT};
+const base::Feature kAdsFeature{"AdsMetrics",
+                                base::FEATURE_DISABLED_BY_DEFAULT};
 
 bool FrameIsAd(content::NavigationHandle* navigation_handle) {
   // Because sub-resource filtering isn't always enabled, and doesn't work
diff --git a/chrome/browser/page_load_metrics/page_load_metrics_browsertest.cc b/chrome/browser/page_load_metrics/page_load_metrics_browsertest.cc
index 1b52ea8..0ad8fbf 100644
--- a/chrome/browser/page_load_metrics/page_load_metrics_browsertest.cc
+++ b/chrome/browser/page_load_metrics/page_load_metrics_browsertest.cc
@@ -30,6 +30,7 @@
 #include "content/public/browser/render_view_host.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/download_test_observer.h"
+#include "net/base/net_errors.h"
 #include "net/http/failing_http_transaction_factory.h"
 #include "net/http/http_cache.h"
 #include "net/test/embedded_test_server/embedded_test_server.h"
@@ -39,15 +40,32 @@
 
 namespace {
 
+void FailAllNetworkTransactions(net::URLRequestContextGetter* getter) {
+  DCHECK_CURRENTLY_ON(content::BrowserThread::IO);
+  net::HttpCache* cache(
+      getter->GetURLRequestContext()->http_transaction_factory()->GetCache());
+  DCHECK(cache);
+  std::unique_ptr<net::FailingHttpTransactionFactory> factory =
+      base::MakeUnique<net::FailingHttpTransactionFactory>(cache->GetSession(),
+                                                           net::ERR_FAILED);
+  // Throw away old version; since this is a browser test, there is no
+  // need to restore the old state.
+  cache->SetHttpNetworkTransactionFactoryForTesting(std::move(factory));
+}
+
 // Waits until specified timing and metadata expectations are satisfied.
 class PageLoadMetricsWaiter
     : public page_load_metrics::MetricsWebContentsObserver::TestingObserver {
  public:
   // A bitvector to express which timing fields to match on.
-  enum ExpectedTimingFields {
-    FIRST_PAINT = 1 << 0,
-    FIRST_CONTENTFUL_PAINT = 1 << 1,
-    STYLE_UPDATE_BEFORE_FCP = 1 << 2
+  enum class TimingField : int {
+    FIRST_LAYOUT = 1 << 0,
+    FIRST_PAINT = 1 << 1,
+    FIRST_CONTENTFUL_PAINT = 1 << 2,
+    FIRST_MEANINGFUL_PAINT = 1 << 3,
+    STYLE_UPDATE_BEFORE_FCP = 1 << 4,
+    DOCUMENT_WRITE_BLOCK_RELOAD = 1 << 5,
+    LOAD_EVENT = 1 << 6
   };
 
   explicit PageLoadMetricsWaiter(content::WebContents* web_contents)
@@ -56,63 +74,119 @@
   ~PageLoadMetricsWaiter() override { DCHECK_EQ(nullptr, run_loop_.get()); }
 
   // Add the given expectation to match on.
-  void AddExpectation(ExpectedTimingFields fields) {
-    matching_fields_ |= fields;
+  void AddMainFrameExpectation(TimingField field) {
+    main_frame_expected_fields_.Set(field);
+  }
+  void AddSubFrameExpectation(TimingField field) {
+    child_frame_expected_fields_.Set(field);
   }
 
-  // Instructs observer to also watch for |count|
-  // WebLoadingBehaviorDocumentWriteBlockReload events.
-  void ExpectDocumentWriteBlockReload(int count) {
-    match_document_write_block_reload_ = count;
+  // Whether the given TimingField was observed in the main frame.
+  bool DidObserveInMainFrame(TimingField field) {
+    return observed_main_frame_fields_.IsSet(field);
   }
 
   // Waits for a TimingUpdated IPC that matches the fields set by
-  // |AddExpectation|.  All matching fields must be set in a TimingUpdated
-  // IPC for it to end this wait.
+  // |AddMainFrameExpectation| and |AddSubFrameExpectation|. All matching fields
+  // must be set in a TimingUpdated IPC for it to end this wait.
   void Wait() {
-    if (expectations_satisfied_)
+    if (expectations_satisfied())
       return;
 
     run_loop_.reset(new base::RunLoop());
     run_loop_->Run();
     run_loop_.reset(nullptr);
 
-    EXPECT_TRUE(expectations_satisfied_);
+    EXPECT_TRUE(expectations_satisfied());
   }
 
  private:
+  // Manages a bitset of TimingFields.
+  class TimingFieldBitSet {
+   public:
+    TimingFieldBitSet() {}
+
+    // Returns whether this bitset has all bits unset.
+    bool Empty() const { return bitmask_ == 0; }
+
+    // Returns whether this bitset has the given bit set.
+    bool IsSet(TimingField field) const {
+      return (bitmask_ & static_cast<int>(field)) != 0;
+    }
+
+    // Sets the bit for the given |field|.
+    void Set(TimingField field) { bitmask_ |= static_cast<int>(field); }
+
+    // Merges bits set in |other| into this bitset.
+    void Merge(const TimingFieldBitSet& other) { bitmask_ |= other.bitmask_; }
+
+    // Clears all bits set in the |other| bitset.
+    void ClearMatching(const TimingFieldBitSet& other) {
+      bitmask_ &= ~other.bitmask_;
+    }
+
+   private:
+    int bitmask_ = 0;
+  };
+
+  static TimingFieldBitSet GetMatchedBits(
+      const page_load_metrics::PageLoadTiming& timing,
+      const page_load_metrics::PageLoadMetadata& metadata) {
+    TimingFieldBitSet matched_bits;
+    if (timing.document_timing.first_layout)
+      matched_bits.Set(TimingField::FIRST_LAYOUT);
+    if (timing.document_timing.load_event_start)
+      matched_bits.Set(TimingField::LOAD_EVENT);
+    if (timing.paint_timing.first_paint)
+      matched_bits.Set(TimingField::FIRST_PAINT);
+    if (timing.paint_timing.first_contentful_paint)
+      matched_bits.Set(TimingField::FIRST_CONTENTFUL_PAINT);
+    if (timing.paint_timing.first_meaningful_paint)
+      matched_bits.Set(TimingField::FIRST_MEANINGFUL_PAINT);
+    if (timing.style_sheet_timing.update_style_duration_before_fcp)
+      matched_bits.Set(TimingField::STYLE_UPDATE_BEFORE_FCP);
+    if (metadata.behavior_flags &
+        blink::WebLoadingBehaviorFlag::
+            kWebLoadingBehaviorDocumentWriteBlockReload)
+      matched_bits.Set(TimingField::DOCUMENT_WRITE_BLOCK_RELOAD);
+
+    return matched_bits;
+  }
+
   void OnTimingUpdated(
+      bool is_main_frame,
       const page_load_metrics::PageLoadTiming& timing,
       const page_load_metrics::PageLoadMetadata& metadata) override {
-    if (match_document_write_block_reload_ > 0 &&
-        metadata.behavior_flags &
-            blink::WebLoadingBehaviorFlag::
-                kWebLoadingBehaviorDocumentWriteBlockReload) {
-      --match_document_write_block_reload_;
-    }
-
-    if (match_document_write_block_reload_ > 0) {
+    if (expectations_satisfied())
       return;
+
+    TimingFieldBitSet matched_bits = GetMatchedBits(timing, metadata);
+    if (is_main_frame) {
+      main_frame_expected_fields_.ClearMatching(matched_bits);
+      observed_main_frame_fields_.Merge(matched_bits);
+    } else {
+      child_frame_expected_fields_.ClearMatching(matched_bits);
     }
 
-    if ((!(matching_fields_ & FIRST_PAINT) ||
-         timing.paint_timing.first_paint) &&
-        (!(matching_fields_ & FIRST_CONTENTFUL_PAINT) ||
-         timing.paint_timing.first_contentful_paint) &&
-        (!(matching_fields_ & STYLE_UPDATE_BEFORE_FCP) ||
-         timing.style_sheet_timing.update_style_duration_before_fcp)) {
-      expectations_satisfied_ = true;
-      if (run_loop_)
-        run_loop_->Quit();
-    }
+    if (expectations_satisfied() && run_loop_)
+      run_loop_->Quit();
+  }
+
+  bool expectations_satisfied() const {
+    return child_frame_expected_fields_.Empty() &&
+           main_frame_expected_fields_.Empty();
   }
 
   std::unique_ptr<base::RunLoop> run_loop_;
-  int matching_fields_ = 0;  // A bitvector composed from ExpectedTimingFields.
-  bool expectations_satisfied_ = false;
-  int match_document_write_block_reload_ = 0;
+
+  TimingFieldBitSet child_frame_expected_fields_;
+  TimingFieldBitSet main_frame_expected_fields_;
+
+  TimingFieldBitSet observed_main_frame_fields_;
 };
 
+using TimingField = PageLoadMetricsWaiter::TimingField;
+
 }  // namespace
 
 class PageLoadMetricsBrowserTest : public InProcessBrowserTest {
@@ -121,6 +195,10 @@
   ~PageLoadMetricsBrowserTest() override {}
 
  protected:
+  // Force navigation to a new page, so the currently tracked page load runs its
+  // OnComplete callback. You should prefer to use PageLoadMetricsWaiter, and
+  // only use NavigateToUntrackedUrl for cases where the waiter isn't
+  // sufficient.
   void NavigateToUntrackedUrl() {
     ui_test_utils::NavigateToURL(browser(), GURL(url::kAboutBlankURL));
   }
@@ -148,19 +226,6 @@
   DISALLOW_COPY_AND_ASSIGN(PageLoadMetricsBrowserTest);
 };
 
-void FailAllNetworkTransactions(net::URLRequestContextGetter* getter) {
-  DCHECK_CURRENTLY_ON(content::BrowserThread::IO);
-  net::HttpCache* cache(
-      getter->GetURLRequestContext()->http_transaction_factory()->GetCache());
-  DCHECK(cache);
-  std::unique_ptr<net::FailingHttpTransactionFactory> factory(
-      new net::FailingHttpTransactionFactory(cache->GetSession(),
-                                             net::ERR_FAILED));
-  // Throw away old version; since this is a browser test, there is no
-  // need to restore the old state.
-  cache->SetHttpNetworkTransactionFactoryForTesting(std::move(factory));
-}
-
 IN_PROC_BROWSER_TEST_F(PageLoadMetricsBrowserTest, NoNavigation) {
   ASSERT_TRUE(embedded_test_server()->Start());
   EXPECT_TRUE(NoPageLoadMetricsRecorded());
@@ -169,18 +234,25 @@
 IN_PROC_BROWSER_TEST_F(PageLoadMetricsBrowserTest, NewPage) {
   ASSERT_TRUE(embedded_test_server()->Start());
 
+  auto waiter = CreatePageLoadMetricsWaiter();
+  waiter->AddMainFrameExpectation(TimingField::FIRST_PAINT);
   ui_test_utils::NavigateToURL(browser(),
                                embedded_test_server()->GetURL("/title1.html"));
-  NavigateToUntrackedUrl();
+  waiter->Wait();
 
   histogram_tester_.ExpectTotalCount(internal::kHistogramDomContentLoaded, 1);
   histogram_tester_.ExpectTotalCount(internal::kHistogramLoad, 1);
   histogram_tester_.ExpectTotalCount(internal::kHistogramFirstLayout, 1);
+  histogram_tester_.ExpectTotalCount(internal::kHistogramFirstPaint, 1);
   histogram_tester_.ExpectTotalCount(internal::kHistogramParseDuration, 1);
   histogram_tester_.ExpectTotalCount(
       internal::kHistogramParseBlockedOnScriptLoad, 1);
   histogram_tester_.ExpectTotalCount(
       internal::kHistogramParseBlockedOnScriptExecution, 1);
+
+  // Force navigation to another page, which should force logging of histograms
+  // persisted at the end of the page load lifetime.
+  NavigateToUntrackedUrl();
   histogram_tester_.ExpectTotalCount(internal::kHistogramTotalBytes, 1);
   histogram_tester_.ExpectTotalCount(
       internal::kHistogramPageTimingForegroundDuration, 1);
@@ -190,11 +262,39 @@
   EXPECT_FALSE(NoPageLoadMetricsRecorded());
 }
 
+IN_PROC_BROWSER_TEST_F(PageLoadMetricsBrowserTest, NoPaintForEmptyDocument) {
+  ASSERT_TRUE(embedded_test_server()->Start());
+
+  auto waiter = CreatePageLoadMetricsWaiter();
+  waiter->AddMainFrameExpectation(TimingField::FIRST_LAYOUT);
+  waiter->AddMainFrameExpectation(TimingField::LOAD_EVENT);
+  ui_test_utils::NavigateToURL(browser(),
+                               embedded_test_server()->GetURL("/empty.html"));
+  waiter->Wait();
+  EXPECT_FALSE(waiter->DidObserveInMainFrame(TimingField::FIRST_PAINT));
+
+  histogram_tester_.ExpectTotalCount(internal::kHistogramFirstLayout, 1);
+  histogram_tester_.ExpectTotalCount(internal::kHistogramLoad, 1);
+  histogram_tester_.ExpectTotalCount(internal::kHistogramFirstPaint, 0);
+  histogram_tester_.ExpectTotalCount(internal::kHistogramFirstContentfulPaint,
+                                     0);
+}
+
 IN_PROC_BROWSER_TEST_F(PageLoadMetricsBrowserTest, SameDocumentNavigation) {
   ASSERT_TRUE(embedded_test_server()->Start());
 
+  auto waiter = CreatePageLoadMetricsWaiter();
+  waiter->AddMainFrameExpectation(TimingField::FIRST_LAYOUT);
+  waiter->AddMainFrameExpectation(TimingField::LOAD_EVENT);
   ui_test_utils::NavigateToURL(browser(),
                                embedded_test_server()->GetURL("/title1.html"));
+  waiter->Wait();
+
+  histogram_tester_.ExpectTotalCount(internal::kHistogramDomContentLoaded, 1);
+  histogram_tester_.ExpectTotalCount(internal::kHistogramLoad, 1);
+  histogram_tester_.ExpectTotalCount(internal::kHistogramFirstLayout, 1);
+
+  // Perform a same-document navigation. No additional metrics should be logged.
   ui_test_utils::NavigateToURL(
       browser(), embedded_test_server()->GetURL("/title1.html#hash"));
   NavigateToUntrackedUrl();
@@ -207,11 +307,23 @@
 IN_PROC_BROWSER_TEST_F(PageLoadMetricsBrowserTest, SameUrlNavigation) {
   ASSERT_TRUE(embedded_test_server()->Start());
 
+  auto waiter = CreatePageLoadMetricsWaiter();
+  waiter->AddMainFrameExpectation(TimingField::FIRST_LAYOUT);
+  waiter->AddMainFrameExpectation(TimingField::LOAD_EVENT);
   ui_test_utils::NavigateToURL(browser(),
                                embedded_test_server()->GetURL("/title1.html"));
+  waiter->Wait();
+
+  histogram_tester_.ExpectTotalCount(internal::kHistogramDomContentLoaded, 1);
+  histogram_tester_.ExpectTotalCount(internal::kHistogramLoad, 1);
+  histogram_tester_.ExpectTotalCount(internal::kHistogramFirstLayout, 1);
+
+  waiter = CreatePageLoadMetricsWaiter();
+  waiter->AddMainFrameExpectation(TimingField::FIRST_LAYOUT);
+  waiter->AddMainFrameExpectation(TimingField::LOAD_EVENT);
   ui_test_utils::NavigateToURL(browser(),
                                embedded_test_server()->GetURL("/title1.html"));
-  NavigateToUntrackedUrl();
+  waiter->Wait();
 
   // We expect one histogram sample for each navigation to title1.html.
   histogram_tester_.ExpectTotalCount(internal::kHistogramDomContentLoaded, 2);
@@ -296,14 +408,13 @@
 IN_PROC_BROWSER_TEST_F(PageLoadMetricsBrowserTest, PreloadDocumentWrite) {
   ASSERT_TRUE(embedded_test_server()->Start());
 
-  std::unique_ptr<PageLoadMetricsWaiter> fcp_waiter =
-      CreatePageLoadMetricsWaiter();
-  fcp_waiter->AddExpectation(PageLoadMetricsWaiter::FIRST_CONTENTFUL_PAINT);
+  auto waiter = CreatePageLoadMetricsWaiter();
+  waiter->AddMainFrameExpectation(TimingField::FIRST_CONTENTFUL_PAINT);
 
   ui_test_utils::NavigateToURL(
       browser(), embedded_test_server()->GetURL(
                      "/page_load_metrics/document_write_external_script.html"));
-  fcp_waiter->Wait();
+  waiter->Wait();
 
   histogram_tester_.ExpectTotalCount(
       internal::kHistogramDocWriteParseStartToFirstContentfulPaint, 1);
@@ -312,11 +423,15 @@
 IN_PROC_BROWSER_TEST_F(PageLoadMetricsBrowserTest, NoPreloadDocumentWrite) {
   ASSERT_TRUE(embedded_test_server()->Start());
 
+  auto waiter = CreatePageLoadMetricsWaiter();
+  waiter->AddMainFrameExpectation(TimingField::FIRST_CONTENTFUL_PAINT);
   ui_test_utils::NavigateToURL(
       browser(), embedded_test_server()->GetURL(
                      "/page_load_metrics/document_write_no_script.html"));
-  NavigateToUntrackedUrl();
+  waiter->Wait();
 
+  histogram_tester_.ExpectTotalCount(internal::kHistogramFirstContentfulPaint,
+                                     1);
   histogram_tester_.ExpectTotalCount(
       internal::kHistogramDocWriteParseStartToFirstContentfulPaint, 0);
 }
@@ -324,14 +439,15 @@
 IN_PROC_BROWSER_TEST_F(PageLoadMetricsBrowserTest, NoDocumentWrite) {
   ASSERT_TRUE(embedded_test_server()->Start());
 
-  std::unique_ptr<PageLoadMetricsWaiter> fcp_waiter =
-      CreatePageLoadMetricsWaiter();
-  fcp_waiter->AddExpectation(PageLoadMetricsWaiter::FIRST_CONTENTFUL_PAINT);
+  auto waiter = CreatePageLoadMetricsWaiter();
+  waiter->AddMainFrameExpectation(TimingField::FIRST_CONTENTFUL_PAINT);
 
   ui_test_utils::NavigateToURL(browser(),
                                embedded_test_server()->GetURL("/title1.html"));
-  fcp_waiter->Wait();
+  waiter->Wait();
 
+  histogram_tester_.ExpectTotalCount(internal::kHistogramFirstContentfulPaint,
+                                     1);
   histogram_tester_.ExpectTotalCount(
       internal::kHistogramDocWriteParseStartToFirstContentfulPaint, 0);
   histogram_tester_.ExpectTotalCount(
@@ -342,14 +458,13 @@
 IN_PROC_BROWSER_TEST_F(PageLoadMetricsBrowserTest, DocumentWriteBlock) {
   ASSERT_TRUE(embedded_test_server()->Start());
 
-  std::unique_ptr<PageLoadMetricsWaiter> fcp_waiter =
-      CreatePageLoadMetricsWaiter();
-  fcp_waiter->AddExpectation(PageLoadMetricsWaiter::FIRST_CONTENTFUL_PAINT);
+  auto waiter = CreatePageLoadMetricsWaiter();
+  waiter->AddMainFrameExpectation(TimingField::FIRST_CONTENTFUL_PAINT);
 
   ui_test_utils::NavigateToURL(
       browser(), embedded_test_server()->GetURL(
                      "/page_load_metrics/document_write_script_block.html"));
-  fcp_waiter->Wait();
+  waiter->Wait();
 
   histogram_tester_.ExpectTotalCount(
       internal::kHistogramDocWriteBlockParseStartToFirstContentfulPaint, 1);
@@ -359,30 +474,37 @@
 IN_PROC_BROWSER_TEST_F(PageLoadMetricsBrowserTest, DocumentWriteReload) {
   ASSERT_TRUE(embedded_test_server()->Start());
 
-  std::unique_ptr<PageLoadMetricsWaiter> fcp_waiter =
-      CreatePageLoadMetricsWaiter();
-  fcp_waiter->AddExpectation(PageLoadMetricsWaiter::FIRST_CONTENTFUL_PAINT);
-  std::unique_ptr<PageLoadMetricsWaiter> reload_waiter =
-      CreatePageLoadMetricsWaiter();
-  reload_waiter->ExpectDocumentWriteBlockReload(2);
-
+  auto waiter = CreatePageLoadMetricsWaiter();
+  waiter->AddMainFrameExpectation(TimingField::FIRST_CONTENTFUL_PAINT);
   ui_test_utils::NavigateToURL(
       browser(), embedded_test_server()->GetURL(
                      "/page_load_metrics/document_write_script_block.html"));
-
-  // Reload should not log the histogram as the script is not blocked.
-  ui_test_utils::NavigateToURL(
-      browser(), embedded_test_server()->GetURL(
-                     "/page_load_metrics/document_write_script_block.html"));
-
-  ui_test_utils::NavigateToURL(
-      browser(), embedded_test_server()->GetURL(
-                     "/page_load_metrics/document_write_script_block.html"));
+  waiter->Wait();
 
   histogram_tester_.ExpectTotalCount(
       internal::kHistogramDocWriteBlockParseStartToFirstContentfulPaint, 1);
+  histogram_tester_.ExpectTotalCount(internal::kHistogramDocWriteBlockCount, 1);
 
-  fcp_waiter->Wait();
+  // Reload should not log the histogram as the script is not blocked.
+  auto reload_waiter = CreatePageLoadMetricsWaiter();
+  reload_waiter->AddMainFrameExpectation(
+      TimingField::DOCUMENT_WRITE_BLOCK_RELOAD);
+  reload_waiter->AddMainFrameExpectation(TimingField::FIRST_CONTENTFUL_PAINT);
+  ui_test_utils::NavigateToURL(
+      browser(), embedded_test_server()->GetURL(
+                     "/page_load_metrics/document_write_script_block.html"));
+  reload_waiter->Wait();
+
+  histogram_tester_.ExpectTotalCount(
+      internal::kHistogramDocWriteBlockReloadCount, 1);
+
+  reload_waiter = CreatePageLoadMetricsWaiter();
+  reload_waiter->AddMainFrameExpectation(
+      TimingField::DOCUMENT_WRITE_BLOCK_RELOAD);
+  reload_waiter->AddMainFrameExpectation(TimingField::FIRST_CONTENTFUL_PAINT);
+  ui_test_utils::NavigateToURL(
+      browser(), embedded_test_server()->GetURL(
+                     "/page_load_metrics/document_write_script_block.html"));
   reload_waiter->Wait();
 
   histogram_tester_.ExpectTotalCount(
@@ -396,11 +518,15 @@
 IN_PROC_BROWSER_TEST_F(PageLoadMetricsBrowserTest, DocumentWriteAsync) {
   ASSERT_TRUE(embedded_test_server()->Start());
 
+  auto waiter = CreatePageLoadMetricsWaiter();
+  waiter->AddMainFrameExpectation(TimingField::FIRST_CONTENTFUL_PAINT);
   ui_test_utils::NavigateToURL(
       browser(), embedded_test_server()->GetURL(
-                     "/page_load_metrics/document_write_script_async.html"));
-  NavigateToUntrackedUrl();
+                     "/page_load_metrics/document_write_async_script.html"));
+  waiter->Wait();
 
+  histogram_tester_.ExpectTotalCount(internal::kHistogramFirstContentfulPaint,
+                                     1);
   histogram_tester_.ExpectTotalCount(
       internal::kHistogramDocWriteBlockParseStartToFirstContentfulPaint, 0);
   histogram_tester_.ExpectTotalCount(internal::kHistogramDocWriteBlockCount, 0);
@@ -409,11 +535,15 @@
 IN_PROC_BROWSER_TEST_F(PageLoadMetricsBrowserTest, DocumentWriteSameDomain) {
   ASSERT_TRUE(embedded_test_server()->Start());
 
+  auto waiter = CreatePageLoadMetricsWaiter();
+  waiter->AddMainFrameExpectation(TimingField::FIRST_CONTENTFUL_PAINT);
   ui_test_utils::NavigateToURL(
       browser(), embedded_test_server()->GetURL(
                      "/page_load_metrics/document_write_external_script.html"));
-  NavigateToUntrackedUrl();
+  waiter->Wait();
 
+  histogram_tester_.ExpectTotalCount(internal::kHistogramFirstContentfulPaint,
+                                     1);
   histogram_tester_.ExpectTotalCount(
       internal::kHistogramDocWriteBlockParseStartToFirstContentfulPaint, 0);
   histogram_tester_.ExpectTotalCount(internal::kHistogramDocWriteBlockCount, 0);
@@ -422,11 +552,15 @@
 IN_PROC_BROWSER_TEST_F(PageLoadMetricsBrowserTest, NoDocumentWriteScript) {
   ASSERT_TRUE(embedded_test_server()->Start());
 
+  auto waiter = CreatePageLoadMetricsWaiter();
+  waiter->AddMainFrameExpectation(TimingField::FIRST_CONTENTFUL_PAINT);
   ui_test_utils::NavigateToURL(
       browser(), embedded_test_server()->GetURL(
                      "/page_load_metrics/document_write_no_script.html"));
-  NavigateToUntrackedUrl();
+  waiter->Wait();
 
+  histogram_tester_.ExpectTotalCount(internal::kHistogramFirstContentfulPaint,
+                                     1);
   histogram_tester_.ExpectTotalCount(
       internal::kHistogramDocWriteBlockParseStartToFirstContentfulPaint, 0);
   histogram_tester_.ExpectTotalCount(internal::kHistogramDocWriteBlockCount, 0);
@@ -441,9 +575,8 @@
 IN_PROC_BROWSER_TEST_F(PageLoadMetricsBrowserTest, MAYBE_BadXhtml) {
   ASSERT_TRUE(embedded_test_server()->Start());
 
-  std::unique_ptr<PageLoadMetricsWaiter> timing_waiter =
-      CreatePageLoadMetricsWaiter();
-  timing_waiter->AddExpectation(PageLoadMetricsWaiter::FIRST_PAINT);
+  auto waiter = CreatePageLoadMetricsWaiter();
+  waiter->AddMainFrameExpectation(TimingField::FIRST_PAINT);
 
   // When an XHTML page contains invalid XML, it causes a paint of the error
   // message without a layout. Page load metrics currently treats this as an
@@ -454,7 +587,7 @@
       browser(),
       embedded_test_server()->GetURL("/page_load_metrics/badxml.xhtml"));
 
-  timing_waiter->Wait();
+  waiter->Wait();
 
   histogram_tester_.ExpectTotalCount(internal::kHistogramFirstLayout, 0);
   histogram_tester_.ExpectTotalCount(internal::kHistogramFirstPaint, 0);
@@ -488,11 +621,12 @@
   GURL url2(embedded_test_server()->GetURL("/title2.html"));
   chrome::NavigateParams params2(browser(), url2,
                                  ui::PAGE_TRANSITION_FROM_ADDRESS_BAR);
-  content::TestNavigationManager manager2(
-      browser()->tab_strip_model()->GetActiveWebContents(), url2);
-  chrome::Navigate(&params2);
 
-  manager2.WaitForNavigationFinished();
+  auto waiter = CreatePageLoadMetricsWaiter();
+  waiter->AddMainFrameExpectation(TimingField::LOAD_EVENT);
+  chrome::Navigate(&params2);
+  waiter->Wait();
+
   histogram_tester_.ExpectTotalCount(
       internal::kHistogramAbortNewNavigationBeforeCommit, 1);
 }
@@ -509,11 +643,12 @@
   EXPECT_TRUE(manager.WaitForRequestStart());
 
   chrome::NavigateParams params2(browser(), url, ui::PAGE_TRANSITION_RELOAD);
-  content::TestNavigationManager manager2(
-      browser()->tab_strip_model()->GetActiveWebContents(), url);
-  chrome::Navigate(&params2);
 
-  manager2.WaitForNavigationFinished();
+  auto waiter = CreatePageLoadMetricsWaiter();
+  waiter->AddMainFrameExpectation(TimingField::LOAD_EVENT);
+  chrome::Navigate(&params2);
+  waiter->Wait();
+
   histogram_tester_.ExpectTotalCount(
       internal::kHistogramAbortReloadBeforeCommit, 1);
 }
@@ -565,15 +700,14 @@
 
   GURL url3(embedded_test_server()->GetURL("/title3.html"));
   chrome::NavigateParams params3(browser(), url3, ui::PAGE_TRANSITION_TYPED);
-  content::TestNavigationManager manager3(
-      browser()->tab_strip_model()->GetActiveWebContents(), url3);
+
+  auto waiter = CreatePageLoadMetricsWaiter();
+  waiter->AddMainFrameExpectation(TimingField::LOAD_EVENT);
   chrome::Navigate(&params3);
+  waiter->Wait();
 
-  EXPECT_TRUE(manager3.WaitForRequestStart());
   manager2.WaitForNavigationFinished();
 
-  manager3.WaitForNavigationFinished();
-
   histogram_tester_.ExpectTotalCount(
       internal::kHistogramAbortNewNavigationBeforeCommit, 2);
 }
@@ -594,11 +728,14 @@
   EXPECT_TRUE(manager.WaitForRequestStart());
 
   {
+    auto waiter = CreatePageLoadMetricsWaiter();
+    waiter->AddMainFrameExpectation(TimingField::LOAD_EVENT);
     content::TestNavigationManager reload_manager(
         browser()->tab_strip_model()->GetActiveWebContents(), first_url);
     EXPECT_TRUE(content::ExecuteScript(
         browser()->tab_strip_model()->GetActiveWebContents(),
         "window.location.reload();"));
+    waiter->Wait();
   }
 
   manager.WaitForNavigationFinished();
@@ -612,22 +749,12 @@
                        FirstMeaningfulPaintRecorded) {
   ASSERT_TRUE(embedded_test_server()->Start());
 
+  auto waiter = CreatePageLoadMetricsWaiter();
+  waiter->AddMainFrameExpectation(TimingField::FIRST_MEANINGFUL_PAINT);
   ui_test_utils::NavigateToURL(browser(),
                                embedded_test_server()->GetURL("/title1.html"));
+  waiter->Wait();
 
-  // Wait until the renderer finishes observing layouts.
-  const int kNetworkIdleTime = 3000;
-  const int kMargin = 500;
-  const std::string javascript = base::StringPrintf(
-      "setTimeout(() => window.domAutomationController.send(true), %d)",
-      kNetworkIdleTime + kMargin);
-  bool result;
-  EXPECT_TRUE(content::ExecuteScriptAndExtractBool(
-      browser()->tab_strip_model()->GetActiveWebContents(),
-      javascript, &result));
-  EXPECT_TRUE(result);
-
-  NavigateToUntrackedUrl();
   histogram_tester_.ExpectUniqueSample(
       internal::kHistogramFirstMeaningfulPaintStatus,
       internal::FIRST_MEANINGFUL_PAINT_RECORDED, 1);
@@ -641,18 +768,19 @@
                        FirstMeaningfulPaintNotRecorded) {
   ASSERT_TRUE(embedded_test_server()->Start());
 
-  std::unique_ptr<PageLoadMetricsWaiter> fcp_waiter =
-      CreatePageLoadMetricsWaiter();
-  fcp_waiter->AddExpectation(PageLoadMetricsWaiter::FIRST_CONTENTFUL_PAINT);
+  auto waiter = CreatePageLoadMetricsWaiter();
+  waiter->AddMainFrameExpectation(TimingField::FIRST_CONTENTFUL_PAINT);
 
   ui_test_utils::NavigateToURL(
       browser(), embedded_test_server()->GetURL(
                      "/page_load_metrics/page_with_active_connections.html"));
-  fcp_waiter->Wait();
+  waiter->Wait();
 
   // Navigate away before a FMP is reported.
   NavigateToUntrackedUrl();
 
+  histogram_tester_.ExpectTotalCount(internal::kHistogramFirstContentfulPaint,
+                                     1);
   histogram_tester_.ExpectUniqueSample(
       internal::kHistogramFirstMeaningfulPaintStatus,
       internal::FIRST_MEANINGFUL_PAINT_DID_NOT_REACH_NETWORK_STABLE, 1);
@@ -666,14 +794,13 @@
                        NoStatePrefetchObserverCacheable) {
   ASSERT_TRUE(embedded_test_server()->Start());
 
-  std::unique_ptr<PageLoadMetricsWaiter> fcp_waiter =
-      CreatePageLoadMetricsWaiter();
-  fcp_waiter->AddExpectation(PageLoadMetricsWaiter::FIRST_CONTENTFUL_PAINT);
+  auto waiter = CreatePageLoadMetricsWaiter();
+  waiter->AddMainFrameExpectation(TimingField::FIRST_CONTENTFUL_PAINT);
 
   ui_test_utils::NavigateToURL(browser(),
                                embedded_test_server()->GetURL("/title1.html"));
 
-  fcp_waiter->Wait();
+  waiter->Wait();
 
   histogram_tester_.ExpectTotalCount(
       "Prerender.none_PrefetchTTFCP.Reference.NoStore.Visible", 0);
@@ -685,14 +812,13 @@
                        NoStatePrefetchObserverNoStore) {
   ASSERT_TRUE(embedded_test_server()->Start());
 
-  std::unique_ptr<PageLoadMetricsWaiter> fcp_waiter =
-      CreatePageLoadMetricsWaiter();
-  fcp_waiter->AddExpectation(PageLoadMetricsWaiter::FIRST_CONTENTFUL_PAINT);
+  auto waiter = CreatePageLoadMetricsWaiter();
+  waiter->AddMainFrameExpectation(TimingField::FIRST_CONTENTFUL_PAINT);
 
   ui_test_utils::NavigateToURL(browser(),
                                embedded_test_server()->GetURL("/nostore.html"));
 
-  fcp_waiter->Wait();
+  waiter->Wait();
 
   histogram_tester_.ExpectTotalCount(
       "Prerender.none_PrefetchTTFCP.Reference.NoStore.Visible", 1);
@@ -703,9 +829,8 @@
 IN_PROC_BROWSER_TEST_F(PageLoadMetricsBrowserTest, CSSTiming) {
   ASSERT_TRUE(embedded_test_server()->Start());
 
-  std::unique_ptr<PageLoadMetricsWaiter> fcp_waiter =
-      CreatePageLoadMetricsWaiter();
-  fcp_waiter->AddExpectation(PageLoadMetricsWaiter::STYLE_UPDATE_BEFORE_FCP);
+  auto waiter = CreatePageLoadMetricsWaiter();
+  waiter->AddMainFrameExpectation(TimingField::STYLE_UPDATE_BEFORE_FCP);
 
   // Careful: Blink code clamps timestamps to 5us, so any CSS parsing we do here
   // must take >> 5us, otherwise we'll log 0 for the value and it will remain
@@ -713,8 +838,7 @@
   ui_test_utils::NavigateToURL(
       browser(),
       embedded_test_server()->GetURL("/page_load_metrics/page_with_css.html"));
-  NavigateToUntrackedUrl();
-  fcp_waiter->Wait();
+  waiter->Wait();
 
   histogram_tester_.ExpectTotalCount(internal::kHistogramFirstContentfulPaint,
                                      1);
@@ -729,8 +853,14 @@
 IN_PROC_BROWSER_TEST_F(PageLoadMetricsBrowserTest, PayloadSize) {
   ASSERT_TRUE(embedded_test_server()->Start());
 
+  auto waiter = CreatePageLoadMetricsWaiter();
+  waiter->AddMainFrameExpectation(TimingField::LOAD_EVENT);
   ui_test_utils::NavigateToURL(browser(), embedded_test_server()->GetURL(
                                               "/page_load_metrics/large.html"));
+  waiter->Wait();
+
+  // Payload histograms are only logged when a page load terminates, so force
+  // navigation to another page.
   NavigateToUntrackedUrl();
 
   histogram_tester_.ExpectTotalCount(internal::kHistogramTotalBytes, 1);
diff --git a/chrome/browser/payments/chrome_payment_request_delegate.cc b/chrome/browser/payments/chrome_payment_request_delegate.cc
index 6f1ee4f4..f402fd9 100644
--- a/chrome/browser/payments/chrome_payment_request_delegate.cc
+++ b/chrome/browser/payments/chrome_payment_request_delegate.cc
@@ -12,10 +12,13 @@
 #include "chrome/browser/browser_process.h"
 #include "chrome/browser/payments/ssl_validity_checker.h"
 #include "chrome/browser/profiles/profile.h"
+#include "chrome/browser/signin/signin_manager_factory.h"
 #include "chrome/browser/ui/browser_dialogs.h"
 #include "components/autofill/core/browser/personal_data_manager.h"
 #include "components/autofill/core/browser/region_combobox_model.h"
 #include "components/payments/content/payment_request_dialog.h"
+#include "components/payments/core/payment_prefs.h"
+#include "components/signin/core/browser/signin_manager.h"
 #include "content/public/browser/web_contents.h"
 #include "third_party/libaddressinput/chromium/chrome_metadata_source.h"
 #include "third_party/libaddressinput/chromium/chrome_storage_impl.h"
@@ -188,4 +191,23 @@
   return g_browser_process->ukm_service();
 }
 
+std::string ChromePaymentRequestDelegate::GetAuthenticatedEmail() const {
+  // Check if the profile is authenticated.  Guest profiles or incognito
+  // windows may not have a sign in manager, and are considered not
+  // authenticated.
+  Profile* profile =
+      Profile::FromBrowserContext(web_contents_->GetBrowserContext());
+  SigninManagerBase* signin_manager =
+      SigninManagerFactory::GetForProfile(profile);
+  if (signin_manager && signin_manager->IsAuthenticated())
+    return signin_manager->GetAuthenticatedAccountInfo().email;
+
+  return std::string();
+}
+
+PrefService* ChromePaymentRequestDelegate::GetPrefService() {
+  return Profile::FromBrowserContext(web_contents_->GetBrowserContext())
+      ->GetPrefs();
+}
+
 }  // namespace payments
diff --git a/chrome/browser/payments/chrome_payment_request_delegate.h b/chrome/browser/payments/chrome_payment_request_delegate.h
index b93a4178..31414319 100644
--- a/chrome/browser/payments/chrome_payment_request_delegate.h
+++ b/chrome/browser/payments/chrome_payment_request_delegate.h
@@ -41,6 +41,8 @@
   AddressNormalizer* GetAddressNormalizer() override;
   autofill::RegionDataLoader* GetRegionDataLoader() override;
   ukm::UkmService* GetUkmService() override;
+  std::string GetAuthenticatedEmail() const override;
+  PrefService* GetPrefService() override;
 
  protected:
   // Reference to the dialog so that we can satisfy calls to CloseDialog(). This
diff --git a/chrome/browser/platform_util_win.cc b/chrome/browser/platform_util_win.cc
index a52dd23f..84282394 100644
--- a/chrome/browser/platform_util_win.cc
+++ b/chrome/browser/platform_util_win.cc
@@ -73,7 +73,7 @@
   }
 
   base::win::ScopedComPtr<IShellFolder> desktop;
-  HRESULT hr = SHGetDesktopFolder(desktop.Receive());
+  HRESULT hr = SHGetDesktopFolder(desktop.GetAddressOf());
   if (FAILED(hr))
     return;
 
diff --git a/chrome/browser/prefs/browser_prefs.cc b/chrome/browser/prefs/browser_prefs.cc
index 500f488..82941a6 100644
--- a/chrome/browser/prefs/browser_prefs.cc
+++ b/chrome/browser/prefs/browser_prefs.cc
@@ -90,6 +90,7 @@
 #include "components/omnibox/browser/zero_suggest_provider.h"
 #include "components/password_manager/core/browser/password_bubble_experiment.h"
 #include "components/password_manager/core/browser/password_manager.h"
+#include "components/payments/core/payment_prefs.h"
 #include "components/policy/core/browser/browser_policy_connector.h"
 #include "components/policy/core/browser/url_blacklist_manager.h"
 #include "components/policy/core/common/policy_statistics_collector.h"
@@ -502,6 +503,7 @@
   ntp_tiles::MostVisitedSites::RegisterProfilePrefs(registry);
   password_bubble_experiment::RegisterPrefs(registry);
   password_manager::PasswordManager::RegisterProfilePrefs(registry);
+  payments::RegisterProfilePrefs(registry);
   PrefProxyConfigTrackerImpl::RegisterProfilePrefs(registry);
   PrefsTabHelper::RegisterProfilePrefs(registry);
   Profile::RegisterProfilePrefs(registry);
diff --git a/chrome/browser/prefs/incognito_mode_prefs.cc b/chrome/browser/prefs/incognito_mode_prefs.cc
index f0666247..6b36b33c 100644
--- a/chrome/browser/prefs/incognito_mode_prefs.cc
+++ b/chrome/browser/prefs/incognito_mode_prefs.cc
@@ -108,7 +108,7 @@
       return false;
 
     base::win::ScopedComPtr<IWPCSettings> settings;
-    hr = parent_controls->GetUserSettings(nullptr, settings.Receive());
+    hr = parent_controls->GetUserSettings(nullptr, settings.GetAddressOf());
     if (FAILED(hr))
       return false;
 
diff --git a/chrome/browser/profiles/profile_manager.cc b/chrome/browser/profiles/profile_manager.cc
index 8735c8b..7db85b1 100644
--- a/chrome/browser/profiles/profile_manager.cc
+++ b/chrome/browser/profiles/profile_manager.cc
@@ -1213,8 +1213,8 @@
 
   bool extensions_enabled = !go_off_the_record;
 #if defined(OS_CHROMEOS)
-  if (base::CommandLine::ForCurrentProcess()->HasSwitch(
-          switches::kEnableLoginScreenApps) &&
+  if (!base::CommandLine::ForCurrentProcess()->HasSwitch(
+          switches::kDisableLoginScreenApps) &&
       chromeos::ProfileHelper::IsSigninProfile(profile)) {
     extensions_enabled = true;
   }
diff --git a/chrome/browser/resources/print_preview/compiled_resources2.gyp b/chrome/browser/resources/print_preview/compiled_resources2.gyp
index 34ec0aad..4e9e83d 100644
--- a/chrome/browser/resources/print_preview/compiled_resources2.gyp
+++ b/chrome/browser/resources/print_preview/compiled_resources2.gyp
@@ -14,6 +14,7 @@
         '<(DEPTH)/ui/webui/resources/js/cr/compiled_resources2.gyp:event_target',
         '<(DEPTH)/ui/webui/resources/js/cr/ui/compiled_resources2.gyp:focus_manager',
         '<(DEPTH)/ui/webui/resources/js/cr/ui/compiled_resources2.gyp:focus_outline_manager',
+        '<(DEPTH)/ui/webui/resources/js/cr/ui/compiled_resources2.gyp:node_utils',
         '<(DEPTH)/ui/webui/resources/js/cr/compiled_resources2.gyp:ui',
         '<(EXTERNS_GYP):chrome_send',
       ],
diff --git a/chrome/browser/resources/print_preview/print_header.js b/chrome/browser/resources/print_preview/print_header.js
index 630c5e19..9a132f8 100644
--- a/chrome/browser/resources/print_preview/print_header.js
+++ b/chrome/browser/resources/print_preview/print_header.js
@@ -2,8 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// <include src="../../../../ui/webui/resources/js/cr/ui/node_utils.js">
-
 cr.define('print_preview', function() {
   'use strict';
 
diff --git a/chrome/browser/safe_browsing/chrome_password_protection_service.cc b/chrome/browser/safe_browsing/chrome_password_protection_service.cc
index 9c4efee..053284d 100644
--- a/chrome/browser/safe_browsing/chrome_password_protection_service.cc
+++ b/chrome/browser/safe_browsing/chrome_password_protection_service.cc
@@ -44,6 +44,7 @@
 
 ChromePasswordProtectionService::~ChromePasswordProtectionService() {
   if (content_settings()) {
+    CleanUpExpiredVerdicts();
     UMA_HISTOGRAM_COUNTS_1000(
         "PasswordProtection.NumberOfCachedVerdictBeforeShutdown",
         GetStoredVerdictCount());
diff --git a/chrome/browser/search_engines/ui_thread_search_terms_data.h b/chrome/browser/search_engines/ui_thread_search_terms_data.h
index 78e4b7df..adf4953 100644
--- a/chrome/browser/search_engines/ui_thread_search_terms_data.h
+++ b/chrome/browser/search_engines/ui_thread_search_terms_data.h
@@ -31,6 +31,10 @@
   std::string ForceInstantResultsParam(bool for_prerender) const override;
   std::string GoogleImageSearchSource() const override;
 
+#if defined(OS_ANDROID)
+  std::string GetYandexReferralID() const override;
+#endif
+
   // Used by tests to override the value for the Google base URL.  Passing the
   // empty string cancels this override.
   static void SetGoogleBaseURL(const std::string& base_url);
diff --git a/chrome/browser/search_engines/ui_thread_search_terms_data_android.cc b/chrome/browser/search_engines/ui_thread_search_terms_data_android.cc
index 4cae7e26..6f9bfb4 100644
--- a/chrome/browser/search_engines/ui_thread_search_terms_data_android.cc
+++ b/chrome/browser/search_engines/ui_thread_search_terms_data_android.cc
@@ -4,6 +4,7 @@
 
 #include "chrome/browser/search_engines/ui_thread_search_terms_data_android.h"
 
+#include "chrome/browser/android/locale/locale_manager.h"
 #include "chrome/browser/search_engines/ui_thread_search_terms_data.h"
 #include "content/public/browser/browser_thread.h"
 
@@ -28,3 +29,7 @@
          content::BrowserThread::CurrentlyOn(content::BrowserThread::UI));
   return SearchTermsDataAndroid::search_client_.Get();
 }
+
+std::string UIThreadSearchTermsData::GetYandexReferralID() const {
+  return LocaleManager::GetYandexReferralID();
+}
diff --git a/chrome/browser/speech/tts_win.cc b/chrome/browser/speech/tts_win.cc
index 828a5e11..d2d5153 100644
--- a/chrome/browser/speech/tts_win.cc
+++ b/chrome/browser/speech/tts_win.cc
@@ -191,7 +191,8 @@
     std::vector<VoiceData>* out_voices) {
   base::win::ScopedComPtr<IEnumSpObjectTokens> voice_tokens;
   unsigned long voice_count;
-  if (S_OK != SpEnumTokens(SPCAT_VOICES, NULL, NULL, voice_tokens.Receive()))
+  if (S_OK !=
+      SpEnumTokens(SPCAT_VOICES, NULL, NULL, voice_tokens.GetAddressOf()))
     return;
   if (S_OK != voice_tokens->GetCount(&voice_count))
     return;
@@ -200,7 +201,7 @@
     VoiceData voice;
 
     base::win::ScopedComPtr<ISpObjectToken> voice_token;
-    if (S_OK != voice_tokens->Next(1, voice_token.Receive(), NULL))
+    if (S_OK != voice_tokens->Next(1, voice_token.GetAddressOf(), NULL))
       return;
 
     base::win::ScopedCoMem<WCHAR> description;
@@ -209,7 +210,7 @@
     voice.name = base::WideToUTF8(description.get());
 
     base::win::ScopedComPtr<ISpDataKey> attributes;
-    if (S_OK != voice_token->OpenKey(kAttributesKey, attributes.Receive()))
+    if (S_OK != voice_token->OpenKey(kAttributesKey, attributes.GetAddressOf()))
       continue;
 
     base::win::ScopedCoMem<WCHAR> gender;
@@ -289,14 +290,15 @@
 
   base::win::ScopedComPtr<IEnumSpObjectTokens> voice_tokens;
   unsigned long voice_count;
-  if (S_OK != SpEnumTokens(SPCAT_VOICES, NULL, NULL, voice_tokens.Receive()))
+  if (S_OK !=
+      SpEnumTokens(SPCAT_VOICES, NULL, NULL, voice_tokens.GetAddressOf()))
     return;
   if (S_OK != voice_tokens->GetCount(&voice_count))
     return;
 
   for (unsigned i = 0; i < voice_count; i++) {
     base::win::ScopedComPtr<ISpObjectToken> voice_token;
-    if (S_OK != voice_tokens->Next(1, voice_token.Receive(), NULL))
+    if (S_OK != voice_tokens->Next(1, voice_token.GetAddressOf(), NULL))
       return;
 
     base::win::ScopedCoMem<WCHAR> description;
diff --git a/chrome/browser/sync/test/integration/two_client_app_list_sync_test.cc b/chrome/browser/sync/test/integration/two_client_app_list_sync_test.cc
index 2a49412..a55eaa5c 100644
--- a/chrome/browser/sync/test/integration/two_client_app_list_sync_test.cc
+++ b/chrome/browser/sync/test/integration/two_client_app_list_sync_test.cc
@@ -297,7 +297,14 @@
   ASSERT_TRUE(IsAppEnabled(GetProfile(1), 0));
 }
 
-IN_PROC_BROWSER_TEST_F(TwoClientAppListSyncTest, UpdateIncognitoEnableDisable) {
+// TODO(crbug.com/721391) Flaky on CrOS.
+#if defined(OS_CHROMEOS)
+#define MAYBE_UpdateIncognitoEnableDisable DISABLED_UpdateIncognitoEnableDisable
+#else
+#define MAYBE_UpdateIncognitoEnableDisable UpdateIncognitoEnableDisable
+#endif
+IN_PROC_BROWSER_TEST_F(TwoClientAppListSyncTest,
+                       MAYBE_UpdateIncognitoEnableDisable) {
   ASSERT_TRUE(SetupSync());
   ASSERT_TRUE(AllProfilesHaveSameAppList());
 
diff --git a/chrome/browser/ui/app_list/search_answer_web_contents_delegate.cc b/chrome/browser/ui/app_list/search_answer_web_contents_delegate.cc
index d02e086..e17d6c3a 100644
--- a/chrome/browser/ui/app_list/search_answer_web_contents_delegate.cc
+++ b/chrome/browser/ui/app_list/search_answer_web_contents_delegate.cc
@@ -95,6 +95,8 @@
   web_contents_->SetDelegate(this);
   web_view_->set_owned_by_client();
   web_view_->SetWebContents(web_contents_.get());
+  if (features::IsAnswerCardDarkRunEnabled())
+    web_view_->SetFocusBehavior(views::View::FocusBehavior::NEVER);
 
   model->AddObserver(this);
 }
@@ -153,7 +155,8 @@
 void SearchAnswerWebContentsDelegate::UpdatePreferredSize(
     content::WebContents* web_contents,
     const gfx::Size& pref_size) {
-  web_view_->SetPreferredSize(pref_size);
+  if (!features::IsAnswerCardDarkRunEnabled())
+    web_view_->SetPreferredSize(pref_size);
   if (!answer_loaded_time_.is_null()) {
     UMA_HISTOGRAM_TIMES("SearchAnswer.ResizeAfterLoadTime",
                         base::TimeTicks::Now() - answer_loaded_time_);
@@ -209,12 +212,19 @@
     return;
   }
 
-  const net::HttpResponseHeaders* headers =
-      navigation_handle->GetResponseHeaders();
-  if (!headers || headers->response_code() != net::HTTP_OK ||
-      !headers->HasHeaderValue("has_answer", "true")) {
-    RecordRequestResult(SearchAnswerRequestResult::REQUEST_RESULT_NO_ANSWER);
-    return;
+  if (!features::IsAnswerCardDarkRunEnabled()) {
+    const net::HttpResponseHeaders* headers =
+        navigation_handle->GetResponseHeaders();
+    if (!headers || headers->response_code() != net::HTTP_OK ||
+        !headers->HasHeaderValue("has_answer", "true")) {
+      RecordRequestResult(SearchAnswerRequestResult::REQUEST_RESULT_NO_ANSWER);
+      return;
+    }
+  } else {
+    // In the dark run mode, every other "server response" contains a card.
+    dark_run_received_answer_ = !dark_run_received_answer_;
+    if (!dark_run_received_answer_)
+      return;
   }
 
   received_answer_ = true;
diff --git a/chrome/browser/ui/app_list/search_answer_web_contents_delegate.h b/chrome/browser/ui/app_list/search_answer_web_contents_delegate.h
index dd65088..56fa722b 100644
--- a/chrome/browser/ui/app_list/search_answer_web_contents_delegate.h
+++ b/chrome/browser/ui/app_list/search_answer_web_contents_delegate.h
@@ -94,6 +94,10 @@
   // Time when the current server response loaded.
   base::TimeTicks answer_loaded_time_;
 
+  // When in the dark run mode, indicates whether we mimic that the server
+  // response contains an answer.
+  bool dark_run_received_answer_ = false;
+
   DISALLOW_COPY_AND_ASSIGN(SearchAnswerWebContentsDelegate);
 };
 
diff --git a/chrome/browser/ui/cocoa/fullscreen/fullscreen_menubar_tracker.mm b/chrome/browser/ui/cocoa/fullscreen/fullscreen_menubar_tracker.mm
index b9c1486..f7c326e 100644
--- a/chrome/browser/ui/cocoa/fullscreen/fullscreen_menubar_tracker.mm
+++ b/chrome/browser/ui/cocoa/fullscreen/fullscreen_menubar_tracker.mm
@@ -138,6 +138,9 @@
   else if (progress > menubarFraction_)
     state_ = FullscreenMenubarState::SHOWING;
 
+  menubarFraction_ = progress;
+  [owner_ updateToolbarLayout];
+
   // In 10.12. the toolbar to be janky since the UI doesn't update until the
   // menubar finished revealing itself. To smooth things out, animate the
   // toolbar in/out by locking/releasing its visibility instead of relying on
@@ -153,9 +156,6 @@
                                                             withAnimation:YES];
     }
   }
-
-  menubarFraction_ = progress;
-  [owner_ updateToolbarLayout];
 }
 
 - (BOOL)isMouseOnScreen {
diff --git a/chrome/browser/ui/cocoa/fullscreen/fullscreen_toolbar_mouse_tracker.mm b/chrome/browser/ui/cocoa/fullscreen/fullscreen_toolbar_mouse_tracker.mm
index 69935fc..80cf8bc6 100644
--- a/chrome/browser/ui/cocoa/fullscreen/fullscreen_toolbar_mouse_tracker.mm
+++ b/chrome/browser/ui/cocoa/fullscreen/fullscreen_toolbar_mouse_tracker.mm
@@ -15,7 +15,7 @@
 // Additional height threshold added at the toolbar's bottom. This is to mimic
 // threshold the mouse position needs to be at before the menubar automatically
 // hides.
-const CGFloat kTrackingAreaAdditionalThreshold = 20;
+const CGFloat kTrackingAreaAdditionalThreshold = 50;
 
 }  // namespace
 
diff --git a/chrome/browser/ui/cocoa/omnibox/omnibox_view_mac.mm b/chrome/browser/ui/cocoa/omnibox/omnibox_view_mac.mm
index f45a9c3..d692fc07 100644
--- a/chrome/browser/ui/cocoa/omnibox/omnibox_view_mac.mm
+++ b/chrome/browser/ui/cocoa/omnibox/omnibox_view_mac.mm
@@ -824,6 +824,11 @@
      (cmd == @selector(noop:) &&
       ([event type] == NSKeyDown || [event type] == NSKeyUp) &&
       [event keyCode] == kVK_Return)) {
+    // If the user hasn't entered any text in keyword search mode, we need to
+    // return early in order to avoid cancelling the search.
+    if (GetTextLength() == 0)
+      return true;
+
     WindowOpenDisposition disposition =
         ui::WindowOpenDispositionFromNSEvent(event);
     model()->AcceptInput(disposition, false);
diff --git a/chrome/browser/ui/page_info/page_info.cc b/chrome/browser/ui/page_info/page_info.cc
index 96f7336..b5a07be5 100644
--- a/chrome/browser/ui/page_info/page_info.cc
+++ b/chrome/browser/ui/page_info/page_info.cc
@@ -92,8 +92,8 @@
 };
 
 // The list of content settings types to display on the Page Info UI. THE
-// ORDER OF THESE ITEMS IS IMPORTANT. To propose changing it, email
-// security-dev@chromium.org.
+// ORDER OF THESE ITEMS IS IMPORTANT and comes from https://crbug.com/610358. To
+// propose changing it, email security-dev@chromium.org.
 ContentSettingsType kPermissionType[] = {
     CONTENT_SETTINGS_TYPE_GEOLOCATION,
     CONTENT_SETTINGS_TYPE_MEDIASTREAM_CAMERA,
@@ -105,16 +105,18 @@
     CONTENT_SETTINGS_TYPE_IMAGES,
 #endif
     CONTENT_SETTINGS_TYPE_POPUPS,
+    CONTENT_SETTINGS_TYPE_SUBRESOURCE_FILTER,
     CONTENT_SETTINGS_TYPE_BACKGROUND_SYNC,
     CONTENT_SETTINGS_TYPE_AUTOMATIC_DOWNLOADS,
     CONTENT_SETTINGS_TYPE_AUTOPLAY,
     CONTENT_SETTINGS_TYPE_MIDI_SYSEX,
-    CONTENT_SETTINGS_TYPE_SUBRESOURCE_FILTER,
 };
 
 // Determines whether to show permission |type| in the Page Info UI. Only
 // applies to permissions listed in |kPermissionType|.
-bool ShouldShowPermission(ContentSettingsType type) {
+bool ShouldShowPermission(ContentSettingsType type,
+                          const GURL& site_url,
+                          HostContentSettingsMap* content_settings) {
 #if !defined(OS_ANDROID)
   // Autoplay is Android-only at the moment.
   if (type == CONTENT_SETTINGS_TYPE_AUTOPLAY)
@@ -122,8 +124,16 @@
 #endif
 
   if (type == CONTENT_SETTINGS_TYPE_SUBRESOURCE_FILTER) {
-    return base::FeatureList::IsEnabled(
-        subresource_filter::kSafeBrowsingSubresourceFilterExperimentalUI);
+    if (!base::FeatureList::IsEnabled(
+            subresource_filter::kSafeBrowsingSubresourceFilterExperimentalUI)) {
+      return false;
+    }
+
+    // The setting for subresource filtering should not show up if the site is
+    // not activated, both on android and desktop platforms.
+    return content_settings->GetWebsiteSetting(
+               site_url, GURL(), CONTENT_SETTINGS_TYPE_SUBRESOURCE_FILTER_DATA,
+               std::string(), nullptr) != nullptr;
   }
 
   return true;
@@ -665,8 +675,10 @@
   for (size_t i = 0; i < arraysize(kPermissionType); ++i) {
     permission_info.type = kPermissionType[i];
 
-    if (!ShouldShowPermission(permission_info.type))
+    if (!ShouldShowPermission(permission_info.type, site_url_,
+                              content_settings_)) {
       continue;
+    }
 
     content_settings::SettingInfo info;
     std::unique_ptr<base::Value> value = content_settings_->GetWebsiteSetting(
diff --git a/chrome/browser/ui/page_info/page_info_unittest.cc b/chrome/browser/ui/page_info/page_info_unittest.cc
index bd500ab..07f5dd2 100644
--- a/chrome/browser/ui/page_info/page_info_unittest.cc
+++ b/chrome/browser/ui/page_info/page_info_unittest.cc
@@ -14,6 +14,7 @@
 #include "base/strings/string16.h"
 #include "base/strings/utf_string_conversions.h"
 #include "base/test/histogram_tester.h"
+#include "base/test/scoped_feature_list.h"
 #include "build/build_config.h"
 #include "chrome/browser/content_settings/host_content_settings_map_factory.h"
 #include "chrome/browser/infobars/infobar_service.h"
@@ -26,7 +27,9 @@
 #include "components/content_settings/core/common/content_settings.h"
 #include "components/content_settings/core/common/content_settings_types.h"
 #include "components/infobars/core/infobar.h"
+#include "components/subresource_filter/core/browser/subresource_filter_features.h"
 #include "content/public/browser/ssl_status.h"
+#include "content/public/common/content_switches.h"
 #include "device/base/mock_device_client.h"
 #include "device/usb/mock_usb_device.h"
 #include "device/usb/mock_usb_service.h"
@@ -114,11 +117,7 @@
     InfoBarService::CreateForWebContents(web_contents());
 
     // Setup mock ui.
-    mock_ui_.reset(new MockPageInfoUI());
-    // Use this rather than gmock's ON_CALL.WillByDefault(Invoke(... because
-    // gmock doesn't handle move-only types well.
-    mock_ui_->set_permission_info_callback_ =
-        base::Bind(&PageInfoTest::SetPermissionInfo, base::Unretained(this));
+    ResetMockUI();
   }
 
   void TearDown() override {
@@ -141,9 +140,17 @@
     last_chosen_object_info_.clear();
     for (auto& chosen_object_info : chosen_object_info_list)
       last_chosen_object_info_.push_back(std::move(chosen_object_info));
+    last_permission_info_list_ = permission_info_list;
   }
 
-  void ResetMockUI() { mock_ui_.reset(new MockPageInfoUI()); }
+  void ResetMockUI() {
+    mock_ui_.reset(new MockPageInfoUI());
+    // Use this rather than gmock's ON_CALL.WillByDefault(Invoke(... because
+    // gmock doesn't handle move-only types well.
+    mock_ui_->set_permission_info_callback_ =
+        base::Bind(&PageInfoTest::SetPermissionInfo, base::Unretained(this));
+  }
+
 
   void ClearPageInfo() { page_info_.reset(nullptr); }
 
@@ -155,6 +162,9 @@
   last_chosen_object_info() {
     return last_chosen_object_info_;
   }
+  const PermissionInfoList& last_permission_info_list() {
+    return last_permission_info_list_;
+  }
   TabSpecificContentSettings* tab_specific_content_settings() {
     return TabSpecificContentSettings::FromWebContents(web_contents());
   }
@@ -185,6 +195,7 @@
   GURL url_;
   std::vector<std::unique_ptr<PageInfoUI::ChosenObjectInfo>>
       last_chosen_object_info_;
+  PermissionInfoList last_permission_info_list_;
 };
 
 }  // namespace
@@ -757,3 +768,38 @@
                                  PageInfo::PageInfoAction::PAGE_INFO_OPENED, 2);
   }
 }
+
+// Tests that the SubresourceFilter setting is omitted correctly.
+TEST_F(PageInfoTest, SubresourceFilterSetting_MatchesActivation) {
+  base::test::ScopedFeatureList feature_list;
+  feature_list.InitAndEnableFeature(
+      subresource_filter::kSafeBrowsingSubresourceFilterExperimentalUI);
+  auto showing_setting = [](const PermissionInfoList& permissions) {
+    for (const auto& permission : permissions) {
+      if (permission.type == CONTENT_SETTINGS_TYPE_SUBRESOURCE_FILTER)
+        return true;
+    }
+    return false;
+  };
+
+  // By default, the setting should not appear at all.
+  SetURL("https://example.test/");
+  SetDefaultUIExpectations(mock_ui());
+  page_info();
+  EXPECT_FALSE(showing_setting(last_permission_info_list()));
+
+  // Reset state.
+  ResetMockUI();
+  ClearPageInfo();
+  SetDefaultUIExpectations(mock_ui());
+
+  // Now, simulate activation on that origin, which is encoded by the existence
+  // of the website setting. The setting should then appear in page_info.
+  HostContentSettingsMap* content_settings =
+      HostContentSettingsMapFactory::GetForProfile(profile());
+  content_settings->SetWebsiteSettingDefaultScope(
+      url(), GURL(), CONTENT_SETTINGS_TYPE_SUBRESOURCE_FILTER_DATA,
+      std::string(), base::MakeUnique<base::DictionaryValue>());
+  page_info();
+  EXPECT_TRUE(showing_setting(last_permission_info_list()));
+}
diff --git a/chrome/browser/ui/views/accessibility/navigation_accessibility_uitest_win.cc b/chrome/browser/ui/views/accessibility/navigation_accessibility_uitest_win.cc
index b3c3458..434bca4 100644
--- a/chrome/browser/ui/views/accessibility/navigation_accessibility_uitest_win.cc
+++ b/chrome/browser/ui/views/accessibility/navigation_accessibility_uitest_win.cc
@@ -121,8 +121,8 @@
   base::win::ScopedComPtr<IAccessible> acc_obj;
   base::win::ScopedVariant child_variant;
   CHECK(S_OK == AccessibleObjectFromEvent(
-      event_info.hwnd, event_info.obj_id, event_info.child_id,
-      acc_obj.Receive(), child_variant.Receive()));
+                    event_info.hwnd, event_info.obj_id, event_info.child_id,
+                    acc_obj.GetAddressOf(), child_variant.Receive()));
 
   base::win::ScopedVariant role_variant;
   if (S_OK == acc_obj->get_accRole(child_variant, role_variant.Receive()))
diff --git a/chrome/browser/ui/views/payments/contact_info_editor_view_controller.cc b/chrome/browser/ui/views/payments/contact_info_editor_view_controller.cc
index 2fb8d327..926ef21 100644
--- a/chrome/browser/ui/views/payments/contact_info_editor_view_controller.cc
+++ b/chrome/browser/ui/views/payments/contact_info_editor_view_controller.cc
@@ -40,19 +40,19 @@
     fields.push_back(EditorField(
         autofill::NAME_FULL,
         l10n_util::GetStringUTF16(IDS_PAYMENTS_NAME_FIELD_IN_CONTACT_DETAILS),
-        EditorField::LengthHint::HINT_LONG, /*required=*/true));
+        EditorField::LengthHint::HINT_SHORT, /*required=*/true));
   }
   if (spec()->request_payer_phone()) {
     fields.push_back(EditorField(
         autofill::PHONE_HOME_WHOLE_NUMBER,
         l10n_util::GetStringUTF16(IDS_PAYMENTS_PHONE_FIELD_IN_CONTACT_DETAILS),
-        EditorField::LengthHint::HINT_LONG, /*required=*/true));
+        EditorField::LengthHint::HINT_SHORT, /*required=*/true));
   }
   if (spec()->request_payer_email()) {
     fields.push_back(EditorField(
         autofill::EMAIL_ADDRESS,
         l10n_util::GetStringUTF16(IDS_PAYMENTS_EMAIL_FIELD_IN_CONTACT_DETAILS),
-        EditorField::LengthHint::HINT_LONG, /*required=*/true));
+        EditorField::LengthHint::HINT_SHORT, /*required=*/true));
   }
   return fields;
 }
diff --git a/chrome/browser/ui/views/payments/credit_card_editor_view_controller.cc b/chrome/browser/ui/views/payments/credit_card_editor_view_controller.cc
index f86e335..4562c335 100644
--- a/chrome/browser/ui/views/payments/credit_card_editor_view_controller.cc
+++ b/chrome/browser/ui/views/payments/credit_card_editor_view_controller.cc
@@ -41,6 +41,7 @@
 #include "ui/views/controls/label.h"
 #include "ui/views/controls/textfield/textfield.h"
 #include "ui/views/layout/box_layout.h"
+#include "ui/views/layout/fill_layout.h"
 #include "ui/views/layout/grid_layout.h"
 #include "ui/views/view.h"
 
@@ -118,9 +119,12 @@
 
   // 9dp is required between the first row (label) and second row (icons).
   constexpr int kRowVerticalSpacing = 9;
+  // 6dp is added to the bottom padding, for a total of 12 between the icons and
+  // the first input field.
+  constexpr int kRowBottomPadding = 6;
   views::BoxLayout* layout = new views::BoxLayout(
       views::BoxLayout::kVertical, payments::kPaymentRequestRowHorizontalInsets,
-      0, kRowVerticalSpacing);
+      kRowBottomPadding, kRowVerticalSpacing);
   layout->set_main_axis_alignment(views::BoxLayout::MAIN_AXIS_ALIGNMENT_START);
   layout->set_cross_axis_alignment(
       views::BoxLayout::CROSS_AXIS_ALIGNMENT_START);
@@ -160,66 +164,14 @@
   return view;
 }
 
-// Creates the "Billing Address" custom field view.
-//           +------------------------------------+
-// Label*    | | Combobox     | | Add button |    |
-//           +------------------------------------+
 std::unique_ptr<views::View>
-CreditCardEditorViewController::CreateCustomFieldView(
+CreditCardEditorViewController::CreateExtraViewForField(
     autofill::ServerFieldType type) {
   if (type != kBillingAddressType)
-    return std::unique_ptr<views::View>();
-  std::unique_ptr<views::View> view = base::MakeUnique<views::View>();
+    return nullptr;
 
-  std::unique_ptr<views::GridLayout> layout =
-      base::MakeUnique<views::GridLayout>(view.get());
-
-  // Combobox column.
-  views::ColumnSet* columns = layout->AddColumnSet(0);
-  columns->AddColumn(views::GridLayout::FILL, views::GridLayout::CENTER, 0,
-                     views::GridLayout::FIXED, kMaximumLabelWidth, 0);
-
-  // This is the horizontal padding between the combobox and the add button.
-  constexpr int kComboboxAddButtonHorizontalPadding = 8;
-  columns->AddPaddingColumn(0, kComboboxAddButtonHorizontalPadding);
-
-  columns->AddColumn(views::GridLayout::LEADING, views::GridLayout::CENTER, 0,
-                     views::GridLayout::USE_PREF, 0, 0);
-
-  layout->StartRow(0, 0);
-
-  EditorField billing_address_field(
-      kBillingAddressType,
-      l10n_util::GetStringUTF16(IDS_AUTOFILL_FIELD_LABEL_BILLING_ADDRESS),
-      EditorField::LengthHint::HINT_SHORT, /*required=*/true,
-      EditorField::ControlType::COMBOBOX);
-
-  // The combobox filled with potential billing addresses.
-  std::unique_ptr<autofill::AddressComboboxModel> address_combobox_model =
-      base::MakeUnique<autofill::AddressComboboxModel>(
-          *state()->GetPersonalDataManager(), state()->GetApplicationLocale());
-  int selected_index = -1;
-  if (credit_card_to_edit_ &&
-      !credit_card_to_edit_->billing_address_id().empty()) {
-    selected_index = address_combobox_model->GetIndexOfIdentifier(
-        credit_card_to_edit_->billing_address_id());
-  }
-  // This takes care of rare cases where the the billing address set on the
-  // current card isn't valid anymore.
-  if (selected_index == -1)
-    selected_index = address_combobox_model->GetDefaultIndex();
-
-  ValidatingCombobox* combobox =
-      new ValidatingCombobox(std::move(address_combobox_model),
-                             CreateValidationDelegate(billing_address_field));
-  combobox->SetSelectedIndex(selected_index);
-
-  // Using autofill field type as a view ID (for testing).
-  combobox->set_id(static_cast<int>(billing_address_field.type));
-  combobox->set_listener(this);
-
-  // |combobox| will now be owned by |row|.
-  layout->AddView(combobox);
+  std::unique_ptr<views::View> button_view = base::MakeUnique<views::View>();
+  button_view->SetLayoutManager(new views::FillLayout);
 
   // The button to add new billing addresses.
   std::unique_ptr<views::Button> add_button(
@@ -227,21 +179,18 @@
   add_button->set_id(
       static_cast<int>(DialogViewID::ADD_BILLING_ADDRESS_BUTTON));
   add_button->set_tag(add_billing_address_button_tag_);
-
-  // |add_button| will now be owned by |row|.
-  layout->AddView(add_button.release());
-  view->SetLayoutManager(layout.release());
-  return view;
+  button_view->AddChildView(add_button.release());
+  return button_view;
 }
 
 std::vector<EditorField> CreditCardEditorViewController::GetFieldDefinitions() {
   return std::vector<EditorField>{
       {autofill::CREDIT_CARD_NUMBER,
        l10n_util::GetStringUTF16(IDS_AUTOFILL_FIELD_LABEL_CREDIT_CARD_NUMBER),
-       EditorField::LengthHint::HINT_LONG, /* required= */ true},
+       EditorField::LengthHint::HINT_SHORT, /* required= */ true},
       {autofill::CREDIT_CARD_NAME_FULL,
        l10n_util::GetStringUTF16(IDS_AUTOFILL_FIELD_LABEL_NAME_ON_CARD),
-       EditorField::LengthHint::HINT_LONG, /* required= */ true},
+       EditorField::LengthHint::HINT_SHORT, /* required= */ true},
       {autofill::CREDIT_CARD_EXP_MONTH,
        l10n_util::GetStringUTF16(IDS_AUTOFILL_FIELD_LABEL_EXPIRATION_MONTH),
        EditorField::LengthHint::HINT_SHORT, /* required= */ true,
@@ -252,13 +201,13 @@
        EditorField::ControlType::COMBOBOX},
       {kBillingAddressType,
        l10n_util::GetStringUTF16(IDS_AUTOFILL_FIELD_LABEL_BILLING_ADDRESS),
-       EditorField::LengthHint::HINT_LONG, /* required= */ true,
-       EditorField::ControlType::CUSTOMFIELD}};
+       EditorField::LengthHint::HINT_SHORT, /* required= */ true,
+       EditorField::ControlType::COMBOBOX}};
 }
 
 base::string16 CreditCardEditorViewController::GetInitialValueForType(
     autofill::ServerFieldType type) {
-  if (!credit_card_to_edit_)
+  if (!credit_card_to_edit_ || type == kBillingAddressType)
     return base::string16();
 
   return credit_card_to_edit_->GetInfo(autofill::AutofillType(type),
@@ -283,25 +232,26 @@
   }
   for (const auto& field : comboboxes()) {
     // ValidatingCombobox* is the key, EditorField is the value.
-    DCHECK_EQ(autofill::CREDIT_CARD,
-              autofill::AutofillType(field.second.type).group());
     ValidatingCombobox* combobox = field.first;
     if (combobox->invalid())
       return false;
 
-    credit_card.SetInfo(autofill::AutofillType(field.second.type),
-                        combobox->GetTextForRow(combobox->selected_index()),
-                        locale);
+    if (field.second.type == kBillingAddressType) {
+      views::Combobox* address_combobox = static_cast<views::Combobox*>(
+          dialog()->GetViewByID(kBillingAddressType));
+      autofill::AddressComboboxModel* model =
+          static_cast<autofill::AddressComboboxModel*>(
+              address_combobox->model());
+
+      credit_card.set_billing_address_id(
+          model->GetItemIdentifierAt(address_combobox->selected_index()));
+    } else {
+      credit_card.SetInfo(autofill::AutofillType(field.second.type),
+                          combobox->GetTextForRow(combobox->selected_index()),
+                          locale);
+    }
   }
 
-  views::Combobox* address_combobox =
-      static_cast<views::Combobox*>(dialog()->GetViewByID(kBillingAddressType));
-  autofill::AddressComboboxModel* model =
-      static_cast<autofill::AddressComboboxModel*>(address_combobox->model());
-
-  credit_card.set_billing_address_id(
-      model->GetItemIdentifierAt(address_combobox->selected_index()));
-
   // TODO(crbug.com/711365): Display global error message.
   if (autofill::GetCompletionStatusForCard(
           credit_card, locale,
@@ -327,6 +277,10 @@
           locale);
     }
     for (const auto& field : comboboxes()) {
+      // The billing address is transfered above.
+      if (field.second.type == kBillingAddressType)
+        continue;
+
       credit_card_to_edit_->SetInfo(
           autofill::AutofillType(field.second.type),
           credit_card.GetInfo(autofill::AutofillType(field.second.type),
@@ -366,6 +320,14 @@
     case autofill::CREDIT_CARD_EXP_4_DIGIT_YEAR:
       return base::MakeUnique<ui::SimpleComboboxModel>(
           GetExpirationYearItems());
+    case kBillingAddressType:
+      // The combobox filled with potential billing addresses. It's fine to pass
+      // empty string as the default selected guid if there are no cards being
+      // edited.
+      return base::MakeUnique<autofill::AddressComboboxModel>(
+          *state()->GetPersonalDataManager(), state()->GetApplicationLocale(),
+          credit_card_to_edit_ ? credit_card_to_edit_->billing_address_id()
+                               : "");
     default:
       NOTREACHED();
       break;
diff --git a/chrome/browser/ui/views/payments/credit_card_editor_view_controller.h b/chrome/browser/ui/views/payments/credit_card_editor_view_controller.h
index 0238586..dd69630 100644
--- a/chrome/browser/ui/views/payments/credit_card_editor_view_controller.h
+++ b/chrome/browser/ui/views/payments/credit_card_editor_view_controller.h
@@ -48,7 +48,7 @@
 
   // EditorViewController:
   std::unique_ptr<views::View> CreateHeaderView() override;
-  std::unique_ptr<views::View> CreateCustomFieldView(
+  std::unique_ptr<views::View> CreateExtraViewForField(
       autofill::ServerFieldType type) override;
   std::vector<EditorField> GetFieldDefinitions() override;
   base::string16 GetInitialValueForType(
diff --git a/chrome/browser/ui/views/payments/editor_view_controller.cc b/chrome/browser/ui/views/payments/editor_view_controller.cc
index a6e926eb..44ac42a6 100644
--- a/chrome/browser/ui/views/payments/editor_view_controller.cc
+++ b/chrome/browser/ui/views/payments/editor_view_controller.cc
@@ -106,6 +106,11 @@
   return nullptr;
 }
 
+std::unique_ptr<views::View> EditorViewController::CreateExtraViewForField(
+    autofill::ServerFieldType type) {
+  return nullptr;
+}
+
 std::unique_ptr<views::Button> EditorViewController::CreatePrimaryButton() {
   std::unique_ptr<views::Button> button(
       views::MdTextButton::CreateSecondaryUiBlueButton(
@@ -205,28 +210,79 @@
   text_fields_.clear();
   comboboxes_.clear();
 
-  std::unique_ptr<views::GridLayout> editor_layout =
-      base::MakeUnique<views::GridLayout>(editor_view.get());
-
   // The editor view is padded horizontally.
   editor_view->SetBorder(views::CreateEmptyBorder(
       0, payments::kPaymentRequestRowHorizontalInsets, 0,
       payments::kPaymentRequestRowHorizontalInsets));
 
-  views::ColumnSet* columns = editor_layout->AddColumnSet(0);
-  columns->AddColumn(views::GridLayout::LEADING, views::GridLayout::CENTER, 0,
-                     views::GridLayout::USE_PREF, 0, 0);
-
-  // This is the horizontal padding between the label and the input field.
+  // All views have fixed size except the Field which stretches. The fixed
+  // padding at the end is computed so that Field views have a minimum of
+  // 176/272dp (short/long fields) as per spec.
+  // ___________________________________________________________________________
+  // |Label | 16dp pad | Field (flex) | 8dp pad | Extra View | Computed Padding|
+  // |______|__________|______________|_________|____________|_________________|
+  constexpr int kLabelWidth = 140;
+  // This is the horizontal padding between the label and the field.
   constexpr int kLabelInputFieldHorizontalPadding = 16;
-  columns->AddPaddingColumn(0, kLabelInputFieldHorizontalPadding);
+  // This is the horizontal padding between the field and the extra view.
+  constexpr int kFieldExtraViewHorizontalPadding = 8;
+  constexpr int kShortFieldMinimumWidth = 176;
+  constexpr int kLongFieldMinimumWidth = 272;
 
-  columns->AddColumn(views::GridLayout::LEADING, views::GridLayout::CENTER, 0,
-                     views::GridLayout::USE_PREF, 0, 0);
+  std::unique_ptr<views::GridLayout> editor_layout =
+      base::MakeUnique<views::GridLayout>(editor_view.get());
+  // Column set for short fields.
+  views::ColumnSet* columns_short = editor_layout->AddColumnSet(0);
+  columns_short->AddColumn(views::GridLayout::LEADING,
+                           views::GridLayout::CENTER, 0,
+                           views::GridLayout::FIXED, kLabelWidth, 0);
+  columns_short->AddPaddingColumn(0, kLabelInputFieldHorizontalPadding);
+  // The field view column stretches.
+  columns_short->AddColumn(views::GridLayout::LEADING,
+                           views::GridLayout::CENTER, 1,
+                           views::GridLayout::USE_PREF, 0, 0);
+  columns_short->AddPaddingColumn(0, kFieldExtraViewHorizontalPadding);
+  // The extra field view column is fixed size, computed from the largest
+  // extra view.
+  int short_extra_view_width =
+      ComputeWidestExtraViewWidth(EditorField::LengthHint::HINT_SHORT);
+  columns_short->AddColumn(views::GridLayout::LEADING,
+                           views::GridLayout::CENTER, 0,
+                           views::GridLayout::FIXED, short_extra_view_width, 0);
+  // The padding at the end is fixed, computed to make sure the short field
+  // maintains its minimum width.
+  int short_padding = kDialogMinWidth - kShortFieldMinimumWidth - kLabelWidth -
+                      (2 * kPaymentRequestRowHorizontalInsets) -
+                      kLabelInputFieldHorizontalPadding -
+                      kFieldExtraViewHorizontalPadding - short_extra_view_width;
+  columns_short->AddPaddingColumn(0, short_padding);
+
+  // Column set for long fields.
+  views::ColumnSet* columns_long = editor_layout->AddColumnSet(1);
+  columns_long->AddColumn(views::GridLayout::LEADING, views::GridLayout::CENTER,
+                          0, views::GridLayout::FIXED, kLabelWidth, 0);
+  columns_long->AddPaddingColumn(0, kLabelInputFieldHorizontalPadding);
+  // The field view column stretches.
+  columns_long->AddColumn(views::GridLayout::LEADING, views::GridLayout::CENTER,
+                          1, views::GridLayout::USE_PREF, 0, 0);
+  columns_long->AddPaddingColumn(0, kFieldExtraViewHorizontalPadding);
+  // The extra field view column is fixed size, computed from the largest
+  // extra view.
+  int long_extra_view_width =
+      ComputeWidestExtraViewWidth(EditorField::LengthHint::HINT_LONG);
+  columns_long->AddColumn(views::GridLayout::LEADING, views::GridLayout::CENTER,
+                          0, views::GridLayout::FIXED, long_extra_view_width,
+                          0);
+  // The padding at the end is fixed, computed to make sure the long field
+  // maintains its minimum width.
+  int long_padding = kDialogMinWidth - kLongFieldMinimumWidth - kLabelWidth -
+                     (2 * kPaymentRequestRowHorizontalInsets) -
+                     kLabelInputFieldHorizontalPadding -
+                     kFieldExtraViewHorizontalPadding - long_extra_view_width;
+  columns_long->AddPaddingColumn(0, long_padding);
 
   editor_view->SetLayoutManager(editor_layout.release());
-  std::vector<EditorField> fields = GetFieldDefinitions();
-  for (const auto& field : fields) {
+  for (const auto& field : GetFieldDefinitions()) {
     CreateInputField(
         static_cast<views::GridLayout*>(editor_view->GetLayoutManager()),
         field);
@@ -243,15 +299,17 @@
 // +----------------------------------------------------------+
 void EditorViewController::CreateInputField(views::GridLayout* layout,
                                             const EditorField& field) {
+  int column_set =
+      field.length_hint == EditorField::LengthHint::HINT_SHORT ? 0 : 1;
+
   // This is the top padding for every row.
   constexpr int kInputRowSpacing = 6;
-  layout->StartRowWithPadding(0, 0, 0, kInputRowSpacing);
+  layout->StartRowWithPadding(0, column_set, 0, kInputRowSpacing);
 
   std::unique_ptr<views::Label> label = base::MakeUnique<views::Label>(
       field.required ? field.label + base::ASCIIToUTF16("*") : field.label);
 
   label->SetMultiLine(true);
-  label->SetMaximumWidth(kMaximumLabelWidth);
   layout->AddView(label.release());
 
   constexpr int kInputFieldHeight = 28;
@@ -275,8 +333,10 @@
   } else if (field.control_type == EditorField::ControlType::COMBOBOX) {
     ValidatingCombobox* combobox = new ValidatingCombobox(
         GetComboboxModelForType(field.type), CreateValidationDelegate(field));
-    combobox->SelectValue(GetInitialValueForType(field.type));
-    // Using autofill field type as a view ID (for testing).
+    base::string16 initial_value = GetInitialValueForType(field.type);
+    if (!initial_value.empty())
+      combobox->SelectValue(initial_value);
+    // Using autofill field type as a view ID.
     combobox->set_id(static_cast<int>(field.type));
     combobox->set_listener(this);
     comboboxes_.insert(std::make_pair(combobox, field));
@@ -290,10 +350,18 @@
   } else {
     // Custom field view will now be owned by |row|. And it must be valid since
     // the derived class specified a custom view for this field.
-    layout->AddView(CreateCustomFieldView(field.type).release());
+    std::unique_ptr<views::View> field_view = CreateCustomFieldView(field.type);
+    DCHECK(field_view);
+    layout->AddView(field_view.release());
   }
 
-  layout->StartRow(0, 0);
+  // If an extra view needs to go alongside the input field view, add it to the
+  // last column.
+  std::unique_ptr<views::View> extra_view = CreateExtraViewForField(field.type);
+  if (extra_view)
+    layout->AddView(extra_view.release());
+
+  layout->StartRow(0, column_set);
   layout->SkipColumns(1);
   std::unique_ptr<views::View> error_label_view =
       base::MakeUnique<views::View>();
@@ -305,4 +373,22 @@
   layout->AddPaddingRow(0, kInputRowSpacing);
 }
 
+int EditorViewController::ComputeWidestExtraViewWidth(
+    EditorField::LengthHint size) {
+  int widest_column_width = 0;
+
+  for (const auto& field : GetFieldDefinitions()) {
+    if (field.length_hint != size)
+      continue;
+
+    std::unique_ptr<views::View> extra_view =
+        CreateExtraViewForField(field.type);
+    if (!extra_view)
+      continue;
+    widest_column_width =
+        std::max(extra_view->GetPreferredSize().width(), widest_column_width);
+  }
+  return widest_column_width;
+}
+
 }  // namespace payments
diff --git a/chrome/browser/ui/views/payments/editor_view_controller.h b/chrome/browser/ui/views/payments/editor_view_controller.h
index 0a1a28c..0246bfdf 100644
--- a/chrome/browser/ui/views/payments/editor_view_controller.h
+++ b/chrome/browser/ui/views/payments/editor_view_controller.h
@@ -107,13 +107,16 @@
   const TextFieldsMap& text_fields() const { return text_fields_; }
 
  protected:
-  // A very long label will wrap. Value picked so that left + right label
-  // padding bring the label to half-way in the dialog (~225).
-  static constexpr int kMaximumLabelWidth = 192;
-
+  // Create a header view to be inserted before all fields.
   virtual std::unique_ptr<views::View> CreateHeaderView();
+  // Create a custom view for the specified |type|.
   virtual std::unique_ptr<views::View> CreateCustomFieldView(
       autofill::ServerFieldType type);
+  // Create an extra view to go to the right of the field with |type|, which
+  // can either be a textfield, combobox, or custom view.
+  virtual std::unique_ptr<views::View> CreateExtraViewForField(
+      autofill::ServerFieldType type);
+
   // Returns the field definitions used to build the UI.
   virtual std::vector<EditorField> GetFieldDefinitions() = 0;
   virtual base::string16 GetInitialValueForType(
@@ -160,6 +163,10 @@
   // added (see implementation).
   void CreateInputField(views::GridLayout* layout, const EditorField& field);
 
+  // Returns the widest column width of across all extra views of a certain
+  // |size| type.
+  int ComputeWidestExtraViewWidth(EditorField::LengthHint size);
+
   // Used to remember the association between the input field UI element and the
   // original field definition. The ValidatingTextfield* and ValidatingCombobox*
   // are owned by their parent view, this only keeps a reference that is good as
diff --git a/chrome/browser/ui/views/payments/payment_request_dialog_view.cc b/chrome/browser/ui/views/payments/payment_request_dialog_view.cc
index 1363aae..0a770a7 100644
--- a/chrome/browser/ui/views/payments/payment_request_dialog_view.cc
+++ b/chrome/browser/ui/views/payments/payment_request_dialog_view.cc
@@ -8,6 +8,7 @@
 
 #include "base/logging.h"
 #include "base/memory/ptr_util.h"
+#include "chrome/browser/profiles/profile.h"
 #include "chrome/browser/ui/browser_dialogs.h"
 #include "chrome/browser/ui/views/payments/contact_info_editor_view_controller.h"
 #include "chrome/browser/ui/views/payments/credit_card_editor_view_controller.h"
@@ -26,6 +27,7 @@
 #include "components/payments/content/payment_request.h"
 #include "components/strings/grit/components_strings.h"
 #include "content/public/browser/browser_thread.h"
+#include "content/public/browser/web_contents.h"
 #include "ui/base/l10n/l10n_util.h"
 #include "ui/views/background.h"
 #include "ui/views/controls/label.h"
@@ -294,6 +296,11 @@
   throbber_overlay_.SetVisible(true);
 }
 
+Profile* PaymentRequestDialogView::GetProfile() {
+  return Profile::FromBrowserContext(
+      request_->web_contents()->GetBrowserContext());
+}
+
 void PaymentRequestDialogView::ShowInitialPaymentSheet() {
   view_stack_->Push(CreateViewAndInstallController(
                         base::MakeUnique<PaymentSheetViewController>(
diff --git a/chrome/browser/ui/views/payments/payment_request_dialog_view.h b/chrome/browser/ui/views/payments/payment_request_dialog_view.h
index 4f29f63..6c156710 100644
--- a/chrome/browser/ui/views/payments/payment_request_dialog_view.h
+++ b/chrome/browser/ui/views/payments/payment_request_dialog_view.h
@@ -21,6 +21,8 @@
 class CreditCard;
 }  // namespace autofill
 
+class Profile;
+
 namespace payments {
 
 class PaymentRequest;
@@ -150,6 +152,8 @@
   // a way of closing the dialog.
   void ShowProcessingSpinner();
 
+  Profile* GetProfile();
+
   ViewStack* view_stack_for_testing() { return view_stack_.get(); }
 
  private:
diff --git a/chrome/browser/ui/views/payments/payment_request_views_util.cc b/chrome/browser/ui/views/payments/payment_request_views_util.cc
index 2d3b335..ae5c5918c 100644
--- a/chrome/browser/ui/views/payments/payment_request_views_util.cc
+++ b/chrome/browser/ui/views/payments/payment_request_views_util.cc
@@ -178,7 +178,6 @@
 }  // namespace
 
 int GetActualDialogWidth() {
-  constexpr int kDialogMinWidth = 512;
   static int actual_width =
       views::LayoutProvider::Get()->GetSnappedDialogWidth(kDialogMinWidth);
   return actual_width;
diff --git a/chrome/browser/ui/views/payments/payment_request_views_util.h b/chrome/browser/ui/views/payments/payment_request_views_util.h
index 752da09..8c92321 100644
--- a/chrome/browser/ui/views/payments/payment_request_views_util.h
+++ b/chrome/browser/ui/views/payments/payment_request_views_util.h
@@ -40,6 +40,7 @@
 constexpr int kPaymentRequestButtonSpacing = 10;
 
 // Dimensions of the dialog itself.
+constexpr int kDialogMinWidth = 512;
 constexpr int kDialogHeight = 450;
 
 // Fixed width of the amount sections in the payment sheet and the order summary
diff --git a/chrome/browser/ui/views/payments/payment_sheet_view_controller.cc b/chrome/browser/ui/views/payments/payment_sheet_view_controller.cc
index 71fca35..729c55e 100644
--- a/chrome/browser/ui/views/payments/payment_sheet_view_controller.cc
+++ b/chrome/browser/ui/views/payments/payment_sheet_view_controller.cc
@@ -15,8 +15,11 @@
 #include "base/memory/ptr_util.h"
 #include "base/strings/string_number_conversions.h"
 #include "base/strings/string_util.h"
+#include "base/strings/stringprintf.h"
 #include "base/strings/utf_string_conversions.h"
 #include "chrome/browser/browser_process.h"
+#include "chrome/browser/profiles/profile.h"
+#include "chrome/browser/ui/chrome_pages.h"
 #include "chrome/browser/ui/views/payments/payment_request_dialog_view.h"
 #include "chrome/browser/ui/views/payments/payment_request_dialog_view_ids.h"
 #include "chrome/browser/ui/views/payments/payment_request_row_view.h"
@@ -28,7 +31,9 @@
 #include "components/payments/content/payment_request_state.h"
 #include "components/payments/core/currency_formatter.h"
 #include "components/payments/core/payment_instrument.h"
+#include "components/payments/core/payment_prefs.h"
 #include "components/payments/core/strings_util.h"
+#include "components/prefs/pref_service.h"
 #include "components/strings/grit/components_strings.h"
 #include "content/public/browser/web_contents.h"
 #include "ui/base/l10n/l10n_util.h"
@@ -39,6 +44,7 @@
 #include "ui/gfx/range/range.h"
 #include "ui/gfx/text_elider.h"
 #include "ui/gfx/text_utils.h"
+#include "ui/views/border.h"
 #include "ui/views/controls/button/md_text_button.h"
 #include "ui/views/controls/image_view.h"
 #include "ui/views/controls/label.h"
@@ -460,6 +466,8 @@
     layout->StartRow(0, 0);
     layout->AddView(CreateContactInfoRow().release());
   }
+  layout->StartRow(0, 0);
+  layout->AddView(CreateDataSourceRow().release());
 }
 
 // Adds the product logo to the footer.
@@ -532,6 +540,15 @@
   }
 }
 
+void PaymentSheetViewController::StyledLabelLinkClicked(
+    views::StyledLabel* label,
+    const gfx::Range& range,
+    int event_flags) {
+  // The only thing that can trigger this is the user clicking on the "settings"
+  // link in the data attribution text.
+  chrome::ShowSettingsSubPageForProfile(dialog()->GetProfile(), "");
+}
+
 void PaymentSheetViewController::UpdatePayButtonState(bool enabled) {
   pay_button_->SetEnabled(enabled);
 }
@@ -897,4 +914,70 @@
   }
 }
 
+std::unique_ptr<views::View> PaymentSheetViewController::CreateDataSourceRow() {
+  std::unique_ptr<views::View> content_view = base::MakeUnique<views::View>();
+  views::BoxLayout* layout = new views::BoxLayout(
+      views::BoxLayout::kVertical, kPaymentRequestRowHorizontalInsets, 0, 0);
+  layout->set_main_axis_alignment(views::BoxLayout::MAIN_AXIS_ALIGNMENT_START);
+  layout->set_cross_axis_alignment(
+      views::BoxLayout::CROSS_AXIS_ALIGNMENT_START);
+  content_view->SetLayoutManager(layout);
+
+  base::string16 data_source;
+  // If no transaction has been completed so far, choose which string to display
+  // as a function of the profile's signed in state. Otherwise, always show the
+  // same string.
+  bool first_transaction_completed =
+      dialog()->GetProfile()->GetPrefs()->GetBoolean(
+          payments::kPaymentsFirstTransactionCompleted);
+  if (first_transaction_completed) {
+    data_source =
+        l10n_util::GetStringUTF16(IDS_PAYMENTS_CARD_AND_ADDRESS_SETTINGS);
+  } else {
+    std::string user_email = state()->GetAuthenticatedEmail();
+    if (!user_email.empty()) {
+      // Insert the user's email into the format string.
+      data_source = base::UTF8ToUTF16(base::StringPrintf(
+          l10n_util::GetStringUTF8(
+              IDS_PAYMENTS_CARD_AND_ADDRESS_SETTINGS_SIGNED_IN)
+              .c_str(),
+          user_email.c_str()));
+    } else {
+      data_source = l10n_util::GetStringUTF16(
+          IDS_PAYMENTS_CARD_AND_ADDRESS_SETTINGS_SIGNED_OUT);
+    }
+  }
+
+  // The translated string will surround the actual "Settings" substring with
+  // BEGIN_LINK and END_LINK. Find the beginning of the link range and the
+  // length of the "settings" part, then remove the BEGIN_LINK and END_LINK
+  // parts and linkify "settings".
+  base::string16 begin_tag = base::UTF8ToUTF16("BEGIN_LINK");
+  base::string16 end_tag = base::UTF8ToUTF16("END_LINK");
+  size_t link_begin = data_source.find(begin_tag);
+  DCHECK(link_begin != base::string16::npos);
+
+  size_t link_end = data_source.find(end_tag);
+  DCHECK(link_end != base::string16::npos);
+
+  size_t link_length = link_end - link_begin - begin_tag.size();
+  data_source.erase(link_end, end_tag.size());
+  data_source.erase(link_begin, begin_tag.size());
+
+  std::unique_ptr<views::StyledLabel> data_source_label =
+      base::MakeUnique<views::StyledLabel>(data_source, this);
+  data_source_label->SetBorder(views::CreateEmptyBorder(22, 0, 0, 0));
+
+  views::StyledLabel::RangeStyleInfo default_style;
+  default_style.color = data_source_label->GetNativeTheme()->GetSystemColor(
+      ui::NativeTheme::kColorId_LabelDisabledColor);
+  data_source_label->SetDefaultStyle(default_style);
+  data_source_label->AddStyleRange(
+      gfx::Range(link_begin, link_begin + link_length),
+      views::StyledLabel::RangeStyleInfo::CreateForLink());
+  data_source_label->SizeToFit(0);
+  content_view->AddChildView(data_source_label.release());
+  return content_view;
+}
+
 }  // namespace payments
diff --git a/chrome/browser/ui/views/payments/payment_sheet_view_controller.h b/chrome/browser/ui/views/payments/payment_sheet_view_controller.h
index b3120d5..9260e6a 100644
--- a/chrome/browser/ui/views/payments/payment_sheet_view_controller.h
+++ b/chrome/browser/ui/views/payments/payment_sheet_view_controller.h
@@ -11,6 +11,11 @@
 #include "chrome/browser/ui/views/payments/payment_request_sheet_controller.h"
 #include "components/payments/content/payment_request_spec.h"
 #include "components/payments/content/payment_request_state.h"
+#include "ui/views/controls/styled_label_listener.h"
+
+namespace views {
+class StyledLabel;
+}
 
 namespace payments {
 
@@ -20,7 +25,8 @@
 // Payment Request dialog.
 class PaymentSheetViewController : public PaymentRequestSheetController,
                                    public PaymentRequestSpec::Observer,
-                                   public PaymentRequestState::Observer {
+                                   public PaymentRequestState::Observer,
+                                   public views::StyledLabelListener {
  public:
   // Does not take ownership of the arguments, which should outlive this object.
   PaymentSheetViewController(PaymentRequestSpec* spec,
@@ -44,6 +50,11 @@
   std::unique_ptr<views::View> CreateExtraFooterView() override;
   void ButtonPressed(views::Button* sender, const ui::Event& event) override;
 
+  // views::StyledLabelListener:
+  void StyledLabelLinkClicked(views::StyledLabel* label,
+                              const gfx::Range& range,
+                              int event_flags) override;
+
   void UpdatePayButtonState(bool enabled);
 
   std::unique_ptr<views::View> CreateShippingSectionContent();
@@ -53,6 +64,7 @@
   std::unique_ptr<views::View> CreateContactInfoSectionContent();
   std::unique_ptr<views::Button> CreateContactInfoRow();
   std::unique_ptr<views::Button> CreateShippingOptionRow();
+  std::unique_ptr<views::View> CreateDataSourceRow();
 
   views::Button* pay_button_;
 
diff --git a/chrome/browser/ui/views/payments/shipping_address_editor_view_controller.cc b/chrome/browser/ui/views/payments/shipping_address_editor_view_controller.cc
index ea3f6943..a5f43f9 100644
--- a/chrome/browser/ui/views/payments/shipping_address_editor_view_controller.cc
+++ b/chrome/browser/ui/views/payments/shipping_address_editor_view_controller.cc
@@ -267,11 +267,11 @@
         NOTREACHED();
         return;
       }
-      EditorField::LengthHint length_hint = EditorField::LengthHint::HINT_LONG;
-      if (field_length == autofill::kShortField)
-        length_hint = EditorField::LengthHint::HINT_SHORT;
+      EditorField::LengthHint length_hint = EditorField::LengthHint::HINT_SHORT;
+      if (field_length == autofill::kLongField)
+        length_hint = EditorField::LengthHint::HINT_LONG;
       else
-        DCHECK_EQ(autofill::kLongField, field_length);
+        DCHECK_EQ(autofill::kShortField, field_length);
       autofill::ServerFieldType server_field_type =
           GetFieldTypeFromString(field_type);
       EditorField::ControlType control_type =
@@ -291,7 +291,7 @@
             autofill::ADDRESS_HOME_COUNTRY,
             l10n_util::GetStringUTF16(
                 IDS_LIBADDRESSINPUT_COUNTRY_OR_REGION_LABEL),
-            EditorField::LengthHint::HINT_LONG, /*required=*/true,
+            EditorField::LengthHint::HINT_SHORT, /*required=*/true,
             EditorField::ControlType::COMBOBOX);
       }
     }
@@ -300,7 +300,7 @@
   editor_fields_.emplace_back(
       autofill::PHONE_HOME_WHOLE_NUMBER,
       l10n_util::GetStringUTF16(IDS_AUTOFILL_FIELD_LABEL_PHONE),
-      EditorField::LengthHint::HINT_LONG, /*required=*/true,
+      EditorField::LengthHint::HINT_SHORT, /*required=*/true,
       EditorField::ControlType::TEXTFIELD);
 }
 
diff --git a/chrome/browser/win/jumplist_updater.cc b/chrome/browser/win/jumplist_updater.cc
index c729529..e5ca674f 100644
--- a/chrome/browser/win/jumplist_updater.cc
+++ b/chrome/browser/win/jumplist_updater.cc
@@ -63,7 +63,7 @@
   // shortcut which doesn't have titles.
   // So, we should use the IPropertyStore interface to set its title.
   base::win::ScopedComPtr<IPropertyStore> property_store;
-  result = link.CopyTo(property_store.Receive());
+  result = link.CopyTo(property_store.GetAddressOf());
   if (FAILED(result))
     return false;
 
@@ -194,7 +194,7 @@
   // interface to retrieve each item in the list. So, we retrieve the
   // IObjectArray interface from the EnumerableObjectCollection object.
   base::win::ScopedComPtr<IObjectArray> object_array;
-  result = collection.CopyTo(object_array.Receive());
+  result = collection.CopyTo(object_array.GetAddressOf());
   if (FAILED(result))
     return false;
 
@@ -244,7 +244,7 @@
   // It seems the ICustomDestinationList::AppendCategory() function just
   // replaces all items in the given category with the ones in the new list.
   base::win::ScopedComPtr<IObjectArray> object_array;
-  result = collection.CopyTo(object_array.Receive());
+  result = collection.CopyTo(object_array.GetAddressOf());
   if (FAILED(result))
     return false;
 
diff --git a/chrome/browser/win/settings_app_monitor.cc b/chrome/browser/win/settings_app_monitor.cc
index fd47977..c1d90c99 100644
--- a/chrome/browser/win/settings_app_monitor.cc
+++ b/chrome/browser/win/settings_app_monitor.cc
@@ -222,17 +222,18 @@
   base::win::ScopedVariant class_name(L"Flyout");
   base::win::ScopedComPtr<IUIAutomationCondition> condition;
   HRESULT result = automation->CreatePropertyCondition(
-      UIA_ClassNamePropertyId, class_name, condition.Receive());
+      UIA_ClassNamePropertyId, class_name, condition.GetAddressOf());
   if (FAILED(result))
     return base::string16();
 
   base::win::ScopedComPtr<IUIAutomationTreeWalker> tree_walker;
-  result = automation->CreateTreeWalker(condition.Get(), tree_walker.Receive());
+  result =
+      automation->CreateTreeWalker(condition.Get(), tree_walker.GetAddressOf());
   if (FAILED(result))
     return base::string16();
 
   base::win::ScopedComPtr<IUIAutomationCacheRequest> cache_request;
-  result = automation->CreateCacheRequest(cache_request.Receive());
+  result = automation->CreateCacheRequest(cache_request.GetAddressOf());
   if (FAILED(result))
     return base::string16();
   ConfigureCacheRequest(cache_request.Get());
@@ -723,7 +724,7 @@
     if (SUCCEEDED(result)) {
       obj->Initialize(task_runner_, weak_ptr_factory_.GetWeakPtr(),
                       automation_);
-      obj->QueryInterface(event_handler_.Receive());
+      obj->QueryInterface(event_handler_.GetAddressOf());
     }
   }
   return event_handler_;
@@ -752,7 +753,8 @@
   // Create a cache request so that elements received by way of events contain
   // all data needed for procesing.
   base::win::ScopedComPtr<IUIAutomationCacheRequest> cache_request;
-  HRESULT result = automation_->CreateCacheRequest(cache_request.Receive());
+  HRESULT result =
+      automation_->CreateCacheRequest(cache_request.GetAddressOf());
   if (FAILED(result))
     return result;
   ConfigureCacheRequest(cache_request.Get());
@@ -765,7 +767,7 @@
 
   // Observe invocations.
   base::win::ScopedComPtr<IUIAutomationElement> desktop;
-  result = automation_->GetRootElement(desktop.Receive());
+  result = automation_->GetRootElement(desktop.GetAddressOf());
   if (desktop) {
     result = automation_->AddAutomationEventHandler(
         UIA_Invoke_InvokedEventId, desktop.Get(), TreeScope_Subtree,
diff --git a/chrome/common/chrome_switches.cc b/chrome/common/chrome_switches.cc
index ab862a9..ada7ed6b 100644
--- a/chrome/common/chrome_switches.cc
+++ b/chrome/common/chrome_switches.cc
@@ -925,11 +925,12 @@
 // Custom crosh command.
 const char kCroshCommand[] = "crosh-command";
 
+// Disables apps on the login screen. By default, they are allowed and can be
+// installed through policy.
+const char kDisableLoginScreenApps[] = "disable-login-screen-apps";
+
 // Disables native cups integration
 const char kDisableNativeCups[] = "disable-native-cups";
-
-// Enables apps on the login screen.
-const char kEnableLoginScreenApps[] = "enable-login-screen-apps";
 #endif  // defined(OS_CHROMEOS)
 
 #if defined(USE_ASH)
diff --git a/chrome/common/chrome_switches.h b/chrome/common/chrome_switches.h
index 86906f4d..ee8e929 100644
--- a/chrome/common/chrome_switches.h
+++ b/chrome/common/chrome_switches.h
@@ -271,8 +271,8 @@
 
 #if defined(OS_CHROMEOS)
 extern const char kCroshCommand[];
+extern const char kDisableLoginScreenApps[];
 extern const char kDisableNativeCups[];
-extern const char kEnableLoginScreenApps[];
 #endif  // defined(OS_CHROMEOS)
 
 #if defined(USE_ASH)
diff --git a/chrome/installer/util/advanced_firewall_manager_win.cc b/chrome/installer/util/advanced_firewall_manager_win.cc
index cd4625f..d5ea41c 100644
--- a/chrome/installer/util/advanced_firewall_manager_win.cc
+++ b/chrome/installer/util/advanced_firewall_manager_win.cc
@@ -29,7 +29,7 @@
     firewall_policy_ = NULL;
     return false;
   }
-  hr = firewall_policy_->get_Rules(firewall_rules_.Receive());
+  hr = firewall_policy_->get_Rules(firewall_rules_.GetAddressOf());
   if (FAILED(hr)) {
     DLOG(ERROR) << logging::SystemErrorCodeToString(hr);
     firewall_rules_ = NULL;
@@ -151,7 +151,7 @@
 void AdvancedFirewallManager::GetAllRules(
     std::vector<base::win::ScopedComPtr<INetFwRule> >* rules) {
   base::win::ScopedComPtr<IUnknown> rules_enum_unknown;
-  HRESULT hr = firewall_rules_->get__NewEnum(rules_enum_unknown.Receive());
+  HRESULT hr = firewall_rules_->get__NewEnum(rules_enum_unknown.GetAddressOf());
   if (FAILED(hr)) {
     DLOG(ERROR) << logging::SystemErrorCodeToString(hr);
     return;
diff --git a/chrome/installer/util/legacy_firewall_manager_win.cc b/chrome/installer/util/legacy_firewall_manager_win.cc
index a27a8d91..f9f88d1 100644
--- a/chrome/installer/util/legacy_firewall_manager_win.cc
+++ b/chrome/installer/util/legacy_firewall_manager_win.cc
@@ -23,13 +23,13 @@
   }
 
   base::win::ScopedComPtr<INetFwPolicy> firewall_policy;
-  hr = firewall_manager->get_LocalPolicy(firewall_policy.Receive());
+  hr = firewall_manager->get_LocalPolicy(firewall_policy.GetAddressOf());
   if (FAILED(hr)) {
     DLOG(ERROR) << logging::SystemErrorCodeToString(hr);
     return false;
   }
 
-  hr = firewall_policy->get_CurrentProfile(current_profile_.Receive());
+  hr = firewall_policy->get_CurrentProfile(current_profile_.GetAddressOf());
   if (FAILED(hr)) {
     DLOG(ERROR) << logging::SystemErrorCodeToString(hr);
     current_profile_ = NULL;
@@ -56,9 +56,9 @@
     return false;
 
   base::win::ScopedComPtr<INetFwAuthorizedApplication> chrome_application;
-  HRESULT hr = authorized_apps->Item(
-      base::win::ScopedBstr(app_path_.value().c_str()),
-      chrome_application.Receive());
+  HRESULT hr =
+      authorized_apps->Item(base::win::ScopedBstr(app_path_.value().c_str()),
+                            chrome_application.GetAddressOf());
   if (FAILED(hr))
     return false;
   VARIANT_BOOL is_enabled = VARIANT_FALSE;
@@ -98,8 +98,8 @@
 base::win::ScopedComPtr<INetFwAuthorizedApplications>
 LegacyFirewallManager::GetAuthorizedApplications() {
   base::win::ScopedComPtr<INetFwAuthorizedApplications> authorized_apps;
-  HRESULT hr =
-      current_profile_->get_AuthorizedApplications(authorized_apps.Receive());
+  HRESULT hr = current_profile_->get_AuthorizedApplications(
+      authorized_apps.GetAddressOf());
   if (FAILED(hr)) {
     DLOG(ERROR) << logging::SystemErrorCodeToString(hr);
     return base::win::ScopedComPtr<INetFwAuthorizedApplications>();
diff --git a/chrome/installer/util/wmi.cc b/chrome/installer/util/wmi.cc
index 217a8c3..e381223d 100644
--- a/chrome/installer/util/wmi.cc
+++ b/chrome/installer/util/wmi.cc
@@ -24,9 +24,9 @@
     return false;
 
   base::win::ScopedComPtr<IWbemServices> wmi_services_r;
-  hr = wmi_locator->ConnectServer(base::win::ScopedBstr(L"ROOT\\CIMV2"),
-                                  NULL, NULL, 0, NULL, 0, 0,
-                                  wmi_services_r.Receive());
+  hr = wmi_locator->ConnectServer(base::win::ScopedBstr(L"ROOT\\CIMV2"), NULL,
+                                  NULL, 0, NULL, 0, 0,
+                                  wmi_services_r.GetAddressOf());
   if (FAILED(hr))
     return false;
 
@@ -53,12 +53,13 @@
   base::win::ScopedComPtr<IWbemClassObject> class_object;
   HRESULT hr;
   hr = wmi_services->GetObject(b_class_name, 0, NULL,
-                               class_object.Receive(), NULL);
+                               class_object.GetAddressOf(), NULL);
   if (FAILED(hr))
     return false;
 
   base::win::ScopedComPtr<IWbemClassObject> params_def;
-  hr = class_object->GetMethod(b_method_name, 0, params_def.Receive(), NULL);
+  hr = class_object->GetMethod(b_method_name, 0, params_def.GetAddressOf(),
+                               NULL);
   if (FAILED(hr))
     return false;
 
@@ -88,14 +89,14 @@
 
 bool WMIProcess::Launch(const std::wstring& command_line, int* process_id) {
   base::win::ScopedComPtr<IWbemServices> wmi_local;
-  if (!WMI::CreateLocalConnection(true, wmi_local.Receive()))
+  if (!WMI::CreateLocalConnection(true, wmi_local.GetAddressOf()))
     return false;
 
   const wchar_t class_name[] = L"Win32_Process";
   const wchar_t method_name[] = L"Create";
   base::win::ScopedComPtr<IWbemClassObject> process_create;
   if (!WMI::CreateClassMethodObject(wmi_local.Get(), class_name, method_name,
-                                    process_create.Receive()))
+                                    process_create.GetAddressOf()))
     return false;
 
   ScopedVariant b_command_line(command_line.c_str());
@@ -107,7 +108,7 @@
   base::win::ScopedComPtr<IWbemClassObject> out_params;
   HRESULT hr = wmi_local->ExecMethod(
       base::win::ScopedBstr(class_name), base::win::ScopedBstr(method_name), 0,
-      NULL, process_create.Get(), out_params.Receive(), NULL);
+      NULL, process_create.Get(), out_params.GetAddressOf(), NULL);
   if (FAILED(hr))
     return false;
 
@@ -131,22 +132,22 @@
 
 base::string16 WMIComputerSystem::GetModel() {
   base::win::ScopedComPtr<IWbemServices> services;
-  if (!WMI::CreateLocalConnection(true, services.Receive()))
+  if (!WMI::CreateLocalConnection(true, services.GetAddressOf()))
     return base::string16();
 
   base::win::ScopedBstr query_language(L"WQL");
   base::win::ScopedBstr query(L"SELECT * FROM Win32_ComputerSystem");
   base::win::ScopedComPtr<IEnumWbemClassObject> enumerator;
-  HRESULT hr = services->ExecQuery(
-      query_language, query,
-      WBEM_FLAG_FORWARD_ONLY | WBEM_FLAG_RETURN_IMMEDIATELY, NULL,
-      enumerator.Receive());
+  HRESULT hr =
+      services->ExecQuery(query_language, query,
+                          WBEM_FLAG_FORWARD_ONLY | WBEM_FLAG_RETURN_IMMEDIATELY,
+                          NULL, enumerator.GetAddressOf());
   if (FAILED(hr) || !enumerator.Get())
     return base::string16();
 
   base::win::ScopedComPtr<IWbemClassObject> class_object;
   ULONG items_returned = 0;
-  hr = enumerator->Next(WBEM_INFINITE, 1,  class_object.Receive(),
+  hr = enumerator->Next(WBEM_INFINITE, 1, class_object.GetAddressOf(),
                         &items_returned);
   if (!items_returned)
     return base::string16();
diff --git a/chrome/service/cloud_print/print_system_win.cc b/chrome/service/cloud_print/print_system_win.cc
index 3f15320c..d299ac9 100644
--- a/chrome/service/cloud_print/print_system_win.cc
+++ b/chrome/service/cloud_print/print_system_win.cc
@@ -477,8 +477,8 @@
               base::UTF8ToWide(printer_name).c_str(),
               base::UTF8ToWide(job_title).c_str(), nullptr,
               job_progress_event_.Get(), nullptr, nullptr, 0,
-              xps_print_job_.Receive(), doc_stream.Receive(),
-              print_ticket_stream.Receive()))) {
+              xps_print_job_.GetAddressOf(), doc_stream.GetAddressOf(),
+              print_ticket_stream.GetAddressOf()))) {
         return false;
       }
 
@@ -730,7 +730,7 @@
                                     &provider);
   if (provider) {
     base::win::ScopedComPtr<IStream> print_ticket_stream;
-    CreateStreamOnHGlobal(NULL, TRUE, print_ticket_stream.Receive());
+    CreateStreamOnHGlobal(NULL, TRUE, print_ticket_stream.GetAddressOf());
     ULONG bytes_written = 0;
     print_ticket_stream->Write(print_ticket_data.c_str(),
                                print_ticket_data.length(),
@@ -741,7 +741,7 @@
     print_ticket_stream->Seek(pos, STREAM_SEEK_SET, &new_pos);
     base::win::ScopedBstr error;
     base::win::ScopedComPtr<IStream> result_ticket_stream;
-    CreateStreamOnHGlobal(NULL, TRUE, result_ticket_stream.Receive());
+    CreateStreamOnHGlobal(NULL, TRUE, result_ticket_stream.GetAddressOf());
     ret = SUCCEEDED(printing::XPSModule::MergeAndValidatePrintTicket(
         provider,
         print_ticket_stream.Get(),
diff --git a/chrome/test/android/javatests/src/org/chromium/chrome/test/BottomSheetTestCaseBase.java b/chrome/test/android/javatests/src/org/chromium/chrome/test/BottomSheetTestCaseBase.java
index 916ef14..ce1f2b08 100644
--- a/chrome/test/android/javatests/src/org/chromium/chrome/test/BottomSheetTestCaseBase.java
+++ b/chrome/test/android/javatests/src/org/chromium/chrome/test/BottomSheetTestCaseBase.java
@@ -6,13 +6,11 @@
 
 import static org.chromium.chrome.test.util.ChromeRestriction.RESTRICTION_TYPE_PHONE;
 
-import android.os.Build;
 import android.support.v7.widget.RecyclerView;
 
 import org.chromium.base.ThreadUtils;
 import org.chromium.base.test.util.CallbackHelper;
 import org.chromium.base.test.util.CommandLineFlags;
-import org.chromium.base.test.util.MinAndroidSdkLevel;
 import org.chromium.base.test.util.Restriction;
 import org.chromium.chrome.R;
 import org.chromium.chrome.browser.preferences.ChromePreferenceManager;
@@ -27,7 +25,6 @@
  */
 @CommandLineFlags.Add({"enable-features=ChromeHome"})
 @Restriction(RESTRICTION_TYPE_PHONE) // ChromeHome is only enabled on phones
-@MinAndroidSdkLevel(Build.VERSION_CODES.LOLLIPOP_MR1)
 public abstract class BottomSheetTestCaseBase extends ChromeTabbedActivityTestBase {
     /** A handle to the sheet's observer. */
     protected TestBottomSheetObserver mObserver;
diff --git a/chrome/test/data/page_load_metrics/document_write_async_script.html b/chrome/test/data/page_load_metrics/document_write_async_script.html
index 00cc8874..3eeff18 100644
--- a/chrome/test/data/page_load_metrics/document_write_async_script.html
+++ b/chrome/test/data/page_load_metrics/document_write_async_script.html
@@ -4,7 +4,7 @@
     var crossOrigin = 'http://localhost:8000';
     var filePath = "/page_load_metrics/empty.js";
     var src = crossOrigin + filePath;
-    document.write('<scr' + 'ipt src="' + src + ' async"></scr' + 'ipt>');
+    document.write('<scr' + 'ipt src="' + src + '" async></scr' + 'ipt>');
   })();
 </script>
 <body>
diff --git a/chrome/utility/importer/ie_importer_win.cc b/chrome/utility/importer/ie_importer_win.cc
index 9c5fc30..ecf1b1dd 100644
--- a/chrome/utility/importer/ie_importer_win.cc
+++ b/chrome/utility/importer/ie_importer_win.cc
@@ -323,7 +323,7 @@
 
   base::win::ScopedComPtr<IPropertyStorage> property_storage;
   if (FAILED(property_set_storage->Open(FMTID_Intshcut, STGM_READ,
-                                        property_storage.Receive()))) {
+                                        property_storage.GetAddressOf()))) {
     return GURL();
   }
 
@@ -513,7 +513,7 @@
     return;
   }
   base::win::ScopedComPtr<IEnumSTATURL> enum_url;
-  if (SUCCEEDED(url_history_stg2->EnumUrls(enum_url.Receive()))) {
+  if (SUCCEEDED(url_history_stg2->EnumUrls(enum_url.GetAddressOf()))) {
     std::vector<ImporterURLRow> rows;
     STATURL stat_url;
 
@@ -589,7 +589,7 @@
   }
 
   base::win::ScopedComPtr<IPStore, &IID_IPStore> pstore;
-  HRESULT result = PStoreCreateInstance(pstore.Receive(), 0, 0, 0);
+  HRESULT result = PStoreCreateInstance(pstore.GetAddressOf(), 0, 0, 0);
   if (result != S_OK) {
     FreeLibrary(pstorec_dll);
     return;
@@ -599,8 +599,8 @@
 
   // Enumerates AutoComplete items in the protected database.
   base::win::ScopedComPtr<IEnumPStoreItems, &IID_IEnumPStoreItems> item;
-  result = pstore->EnumItems(0, &AutocompleteGUID,
-                             &AutocompleteGUID, 0, item.Receive());
+  result = pstore->EnumItems(0, &AutocompleteGUID, &AutocompleteGUID, 0,
+                             item.GetAddressOf());
   if (result != PST_E_OK) {
     pstore.Reset();
     FreeLibrary(pstorec_dll);
diff --git a/chrome/utility/shell_handler_impl_win.cc b/chrome/utility/shell_handler_impl_win.cc
index bd88cb89..fc29fa8 100644
--- a/chrome/utility/shell_handler_impl_win.cc
+++ b/chrome/utility/shell_handler_impl_win.cc
@@ -97,7 +97,7 @@
   base::win::ScopedComPtr<Folder> folder;
   hresult = shell_dispatch->NameSpace(
       base::win::ScopedVariant(shortcut.DirName().value().c_str()),
-      folder.Receive());
+      folder.GetAddressOf());
   if (FAILED(hresult) || !folder) {
     error_occured_ = true;
     return false;
@@ -106,14 +106,14 @@
   base::win::ScopedComPtr<FolderItem> item;
   hresult = folder->ParseName(
       base::win::ScopedBstr(shortcut.BaseName().value().c_str()),
-      item.Receive());
+      item.GetAddressOf());
   if (FAILED(hresult) || !item) {
     error_occured_ = true;
     return false;
   }
 
   base::win::ScopedComPtr<FolderItemVerbs> verbs;
-  hresult = item->Verbs(verbs.Receive());
+  hresult = item->Verbs(verbs.GetAddressOf());
   if (FAILED(hresult) || !verbs) {
     error_occured_ = true;
     return false;
@@ -129,7 +129,8 @@
   long error_count = 0;
   for (long i = 0; i < verb_count; ++i) {
     base::win::ScopedComPtr<FolderItemVerb> verb;
-    hresult = verbs->Item(base::win::ScopedVariant(i, VT_I4), verb.Receive());
+    hresult =
+        verbs->Item(base::win::ScopedVariant(i, VT_I4), verb.GetAddressOf());
     if (FAILED(hresult) || !verb) {
       error_count++;
       continue;
diff --git a/components/autofill/core/browser/address_combobox_model.cc b/components/autofill/core/browser/address_combobox_model.cc
index 21559089..5a908af 100644
--- a/components/autofill/core/browser/address_combobox_model.cc
+++ b/components/autofill/core/browser/address_combobox_model.cc
@@ -23,8 +23,9 @@
 
 AddressComboboxModel::AddressComboboxModel(
     const PersonalDataManager& personal_data_manager,
-    const std::string& app_locale)
-    : app_locale_(app_locale) {
+    const std::string& app_locale,
+    const std::string& default_selected_guid)
+    : app_locale_(app_locale), default_selected_guid_(default_selected_guid) {
   for (const auto* profile : personal_data_manager.GetProfilesToSuggest()) {
     profiles_cache_.push_back(base::MakeUnique<AutofillProfile>(*profile));
   }
@@ -72,6 +73,15 @@
   return index == 1;
 }
 
+int AddressComboboxModel::GetDefaultIndex() const {
+  if (!default_selected_guid_.empty()) {
+    int address_index = GetIndexOfIdentifier(default_selected_guid_);
+    if (address_index != -1)
+      return address_index;
+  }
+  return ui::ComboboxModel::GetDefaultIndex();
+}
+
 void AddressComboboxModel::AddObserver(ui::ComboboxModelObserver* observer) {
   observers_.AddObserver(observer);
 }
@@ -95,7 +105,8 @@
   return addresses_[index - kNbHeaderEntries].first;
 }
 
-int AddressComboboxModel::GetIndexOfIdentifier(const std::string& identifier) {
+int AddressComboboxModel::GetIndexOfIdentifier(
+    const std::string& identifier) const {
   for (size_t i = 0; i < addresses_.size(); ++i) {
     if (addresses_[i].first == identifier)
       return i + kNbHeaderEntries;
diff --git a/components/autofill/core/browser/address_combobox_model.h b/components/autofill/core/browser/address_combobox_model.h
index 48edb33..f8b09f4 100644
--- a/components/autofill/core/browser/address_combobox_model.h
+++ b/components/autofill/core/browser/address_combobox_model.h
@@ -25,15 +25,19 @@
 class AddressComboboxModel : public ui::ComboboxModel {
  public:
   // Enumerate the profiles from |personal_data_manager| to expose them in a
-  // combobox using |app_locale| for proper format.
+  // combobox using |app_locale| for proper format. |default_selected_guid| is
+  // an optional argument to specify which address should be selected by
+  // default.
   AddressComboboxModel(const PersonalDataManager& personal_data_manager,
-                       const std::string& app_locale);
+                       const std::string& app_locale,
+                       const std::string& default_selected_guid);
   ~AddressComboboxModel() override;
 
   // ui::ComboboxModel implementation:
   int GetItemCount() const override;
   base::string16 GetItemAt(int index) override;
   bool IsItemSeparatorAt(int index) override;
+  int GetDefaultIndex() const override;
   void AddObserver(ui::ComboboxModelObserver* observer) override;
   void RemoveObserver(ui::ComboboxModelObserver* observer) override;
 
@@ -47,7 +51,7 @@
 
   // Returns the combobox index of the item with the given id or -1 if it's not
   // found.
-  int GetIndexOfIdentifier(const std::string& identifier);
+  int GetIndexOfIdentifier(const std::string& identifier) const;
 
  private:
   // Update |addresses_| based on |profiles_cache_| and notify observers.
@@ -64,6 +68,9 @@
   // Application locale, also needed when a new profile is added.
   std::string app_locale_;
 
+  // If non empty, the guid of the address that should be selected by default.
+  std::string default_selected_guid_;
+
   // To be called when the data for the given country code was loaded.
   base::ObserverList<ui::ComboboxModelObserver> observers_;
 
diff --git a/components/autofill/core/browser/address_combobox_model_unittest.cc b/components/autofill/core/browser/address_combobox_model_unittest.cc
index 2543a9b3..d05efb0 100644
--- a/components/autofill/core/browser/address_combobox_model_unittest.cc
+++ b/components/autofill/core/browser/address_combobox_model_unittest.cc
@@ -18,7 +18,7 @@
 TEST(AddressComboboxModelTest, Empty) {
   TestPersonalDataManager test_personal_data_manager;
 
-  AddressComboboxModel model(test_personal_data_manager, kAppLocale);
+  AddressComboboxModel model(test_personal_data_manager, kAppLocale, "");
   EXPECT_EQ(1, model.GetItemCount());
   EXPECT_FALSE(model.IsItemSeparatorAt(0));
   EXPECT_TRUE(model.GetItemIdentifierAt(0).empty());
@@ -30,7 +30,8 @@
   AutofillProfile profile1(test::GetFullProfile());
   test_personal_data_manager.AddTestingProfile(&profile1);
 
-  AddressComboboxModel model(test_personal_data_manager, kAppLocale);
+  AddressComboboxModel model(test_personal_data_manager, kAppLocale,
+                             profile1.guid());
   EXPECT_EQ(3, model.GetItemCount());
   EXPECT_FALSE(model.IsItemSeparatorAt(0));
   EXPECT_TRUE(model.IsItemSeparatorAt(1));
@@ -39,6 +40,7 @@
   EXPECT_EQ(-1, model.GetIndexOfIdentifier("Anything"));
   EXPECT_EQ(profile1.guid(), model.GetItemIdentifierAt(2));
   EXPECT_EQ(2, model.GetIndexOfIdentifier(profile1.guid()));
+  EXPECT_EQ(2, model.GetDefaultIndex());
 }
 
 TEST(AddressComboboxModelTest, TwoAddresses) {
@@ -51,7 +53,8 @@
   test_personal_data_manager.AddTestingProfile(&profile1);
   test_personal_data_manager.AddTestingProfile(&profile2);
 
-  AddressComboboxModel model(test_personal_data_manager, kAppLocale);
+  AddressComboboxModel model(test_personal_data_manager, kAppLocale,
+                             profile2.guid());
   EXPECT_EQ(4, model.GetItemCount());
   EXPECT_FALSE(model.IsItemSeparatorAt(0));
   EXPECT_TRUE(model.IsItemSeparatorAt(1));
@@ -62,6 +65,7 @@
   EXPECT_EQ(profile2.guid(), model.GetItemIdentifierAt(3));
   EXPECT_EQ(2, model.GetIndexOfIdentifier(profile1.guid()));
   EXPECT_EQ(3, model.GetIndexOfIdentifier(profile2.guid()));
+  EXPECT_EQ(3, model.GetDefaultIndex());
 }
 
 TEST(AddressComboboxModelTest, AddAnAddress) {
@@ -69,7 +73,7 @@
   AutofillProfile profile1(test::GetFullProfile());
   test_personal_data_manager.AddTestingProfile(&profile1);
 
-  AddressComboboxModel model(test_personal_data_manager, kAppLocale);
+  AddressComboboxModel model(test_personal_data_manager, kAppLocale, "");
   EXPECT_EQ(3, model.GetItemCount());
   EXPECT_EQ(profile1.guid(), model.GetItemIdentifierAt(2));
   EXPECT_EQ(2, model.GetIndexOfIdentifier(profile1.guid()));
diff --git a/components/network_session_configurator/network_session_configurator.cc b/components/network_session_configurator/network_session_configurator.cc
index b06afa1..e885f4ae 100644
--- a/components/network_session_configurator/network_session_configurator.cc
+++ b/components/network_session_configurator/network_session_configurator.cc
@@ -219,14 +219,6 @@
       "true");
 }
 
-bool ShouldQuicDoNotMarkAsBrokenOnNetworkChange(
-    const VariationParameters& quic_trial_params) {
-  return base::LowerCaseEqualsASCII(
-      GetVariationParam(quic_trial_params,
-                        "do_not_mark_as_broken_on_network_change"),
-      "true");
-}
-
 size_t GetQuicMaxPacketLength(const VariationParameters& quic_trial_params) {
   unsigned value;
   if (base::StringToUint(
@@ -302,8 +294,6 @@
         ShouldQuicMigrateSessionsEarly(quic_trial_params);
     params->quic_allow_server_migration =
         ShouldQuicAllowServerMigration(quic_trial_params);
-    params->quic_do_not_mark_as_broken_on_network_change =
-        ShouldQuicDoNotMarkAsBrokenOnNetworkChange(quic_trial_params);
   }
 
   size_t max_packet_length = GetQuicMaxPacketLength(quic_trial_params);
diff --git a/components/offline_pages/features/BUILD.gn b/components/offline_pages/features/BUILD.gn
new file mode 100644
index 0000000..fdf4451
--- /dev/null
+++ b/components/offline_pages/features/BUILD.gn
@@ -0,0 +1,19 @@
+# Copyright 2017 The Chromium Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+import("//build/buildflag_header.gni")
+import("//components/offline_pages/features/features.gni")
+
+# This file is in a separate directory so all targets in the build can refer to
+# the buildflag header to get the necessary preprocessor defines without
+# bringing in all of offline_pages. Other targets can depend on this target
+# regardless of whether extensions are enabled.
+
+buildflag_header("features") {
+  header = "features.h"
+  flags = [
+    "ENABLE_OFFLINE_PAGES=$enable_offline_pages",
+    "ENABLE_OFFLINE_PAGES_HARNESS=$enable_offline_pages_harness",
+  ]
+}
diff --git a/components/offline_pages/features/features.gni b/components/offline_pages/features/features.gni
new file mode 100644
index 0000000..2c8c75b
--- /dev/null
+++ b/components/offline_pages/features/features.gni
@@ -0,0 +1,13 @@
+# Copyright 2017 The Chromium Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+declare_args() {
+  # Whether to enable OfflinePages support. Currently user-visible features
+  # are Android-only.
+  enable_offline_pages = is_android
+
+  # This enables test API for locally-built harness which is used for quality
+  # evaluations. Requires setting this variable manually at local environment.
+  enable_offline_pages_harness = false
+}
diff --git a/components/payments/content/BUILD.gn b/components/payments/content/BUILD.gn
index 49c1e13..6396049 100644
--- a/components/payments/content/BUILD.gn
+++ b/components/payments/content/BUILD.gn
@@ -25,6 +25,7 @@
     "//components/keyed_service/content",
     "//components/payments/core",
     "//components/payments/mojom",
+    "//components/prefs",
     "//components/strings:components_strings_grit",
     "//content/public/browser",
     "//mojo/public/cpp/bindings",
diff --git a/components/payments/content/DEPS b/components/payments/content/DEPS
index 2cf753e70..de79a74ac 100644
--- a/components/payments/content/DEPS
+++ b/components/payments/content/DEPS
@@ -5,6 +5,7 @@
   "+components/data_use_measurement",
   "+components/keyed_service/content",
   "+components/link_header_util",
+  "+components/prefs",
   "+components/strings",
   "+content/public",
   "+mojo/public/cpp",
diff --git a/components/payments/content/payment_request.cc b/components/payments/content/payment_request.cc
index 69a13a702..7b84a8c0 100644
--- a/components/payments/content/payment_request.cc
+++ b/components/payments/content/payment_request.cc
@@ -13,6 +13,8 @@
 #include "components/payments/content/payment_details_validation.h"
 #include "components/payments/content/payment_request_web_contents_manager.h"
 #include "components/payments/core/can_make_payment_query.h"
+#include "components/payments/core/payment_prefs.h"
+#include "components/prefs/pref_service.h"
 #include "content/public/browser/browser_thread.h"
 #include "content/public/browser/render_frame_host.h"
 #include "content/public/browser/web_contents.h"
@@ -165,6 +167,8 @@
   } else {
     journey_logger_.RecordJourneyStatsHistograms(
         JourneyLogger::COMPLETION_STATUS_COMPLETED);
+    delegate_->GetPrefService()->SetBoolean(kPaymentsFirstTransactionCompleted,
+                                            true);
     // When the renderer closes the connection,
     // PaymentRequest::OnConnectionTerminated will be called.
     client_->OnComplete();
diff --git a/components/payments/content/payment_request_state.cc b/components/payments/content/payment_request_state.cc
index dac01e50..831449b0 100644
--- a/components/payments/content/payment_request_state.cc
+++ b/components/payments/content/payment_request_state.cc
@@ -88,6 +88,10 @@
   return !spec_->supported_card_networks().empty();
 }
 
+std::string PaymentRequestState::GetAuthenticatedEmail() const {
+  return payment_request_delegate_->GetAuthenticatedEmail();
+}
+
 void PaymentRequestState::AddObserver(Observer* observer) {
   CHECK(observer);
   observers_.AddObserver(observer);
diff --git a/components/payments/content/payment_request_state.h b/components/payments/content/payment_request_state.h
index ece3bc0..63af7cd1 100644
--- a/components/payments/content/payment_request_state.h
+++ b/components/payments/content/payment_request_state.h
@@ -95,6 +95,9 @@
   // false for "https://bobpay.com".
   bool AreRequestedMethodsSupported() const;
 
+  // Returns authenticated user email, or empty string.
+  std::string GetAuthenticatedEmail() const;
+
   void AddObserver(Observer* observer);
   void RemoveObserver(Observer* observer);
 
diff --git a/components/payments/content/payment_response_helper.cc b/components/payments/content/payment_response_helper.cc
index 9a3a8e5e..4e6a299 100644
--- a/components/payments/content/payment_response_helper.cc
+++ b/components/payments/content/payment_response_helper.cc
@@ -4,6 +4,8 @@
 
 #include "components/payments/content/payment_response_helper.h"
 
+#include <string>
+
 #include "base/strings/string_split.h"
 #include "base/strings/utf_string_conversions.h"
 #include "components/autofill/core/browser/autofill_country.h"
@@ -61,9 +63,9 @@
   // Start to get the instrument details. Will call back into
   // OnInstrumentDetailsReady.
   selected_instrument_->InvokePaymentApp(this);
-};
+}
 
-PaymentResponseHelper::~PaymentResponseHelper(){};
+PaymentResponseHelper::~PaymentResponseHelper() {}
 
 // static
 mojom::PaymentAddressPtr
diff --git a/components/payments/core/BUILD.gn b/components/payments/core/BUILD.gn
index 5094bd22..8cfd8f3 100644
--- a/components/payments/core/BUILD.gn
+++ b/components/payments/core/BUILD.gn
@@ -24,6 +24,8 @@
     "payment_method_data.cc",
     "payment_method_data.h",
     "payment_options_provider.h",
+    "payment_prefs.cc",
+    "payment_prefs.h",
     "payment_request_data_util.cc",
     "payment_request_data_util.h",
     "payment_request_delegate.h",
@@ -37,6 +39,7 @@
     "//base",
     "//components/autofill/core/browser",
     "//components/keyed_service/core",
+    "//components/pref_registry",
     "//components/strings:components_strings_grit",
     "//components/ukm",
     "//third_party/libphonenumber",
diff --git a/components/payments/core/DEPS b/components/payments/core/DEPS
index 9117b76..20bc8d9 100644
--- a/components/payments/core/DEPS
+++ b/components/payments/core/DEPS
@@ -4,6 +4,7 @@
   "+components/autofill/core",
   "+components/keyed_service/core",
   "+components/metrics",
+  "+components/pref_registry",
   "+components/strings",
   "+components/ukm",
   "+third_party/libaddressinput",
diff --git a/components/payments/core/payment_prefs.cc b/components/payments/core/payment_prefs.cc
new file mode 100644
index 0000000..854769da
--- /dev/null
+++ b/components/payments/core/payment_prefs.cc
@@ -0,0 +1,18 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "components/payments/core/payment_prefs.h"
+
+#include "components/pref_registry/pref_registry_syncable.h"
+
+namespace payments {
+
+const char kPaymentsFirstTransactionCompleted[] =
+    "payments.first_transaction_completed";
+
+void RegisterProfilePrefs(user_prefs::PrefRegistrySyncable* registry) {
+  registry->RegisterBooleanPref(kPaymentsFirstTransactionCompleted, false);
+}
+
+}  // namespace payments
diff --git a/components/payments/core/payment_prefs.h b/components/payments/core/payment_prefs.h
new file mode 100644
index 0000000..1d5917f
--- /dev/null
+++ b/components/payments/core/payment_prefs.h
@@ -0,0 +1,22 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef COMPONENTS_PAYMENTS_CORE_PAYMENT_PREFS_H_
+#define COMPONENTS_PAYMENTS_CORE_PAYMENT_PREFS_H_
+
+namespace user_prefs {
+class PrefRegistrySyncable;
+}
+
+namespace payments {
+
+// True if the profile has already successfully completed at least one payment
+// request transaction.
+extern const char kPaymentsFirstTransactionCompleted[];
+
+void RegisterProfilePrefs(user_prefs::PrefRegistrySyncable* registry);
+
+}  // namespace payments
+
+#endif  // COMPONENTS_PAYMENTS_CORE_PAYMENT_PREFS_H_
diff --git a/components/payments/core/payment_request_delegate.h b/components/payments/core/payment_request_delegate.h
index f859979..864f015 100644
--- a/components/payments/core/payment_request_delegate.h
+++ b/components/payments/core/payment_request_delegate.h
@@ -19,6 +19,8 @@
 class RegionDataLoader;
 }  // namespace autofill
 
+class PrefService;
+
 namespace ukm {
 class UkmService;
 }  // namespace ukm
@@ -74,6 +76,14 @@
 
   // Returns a pointer to the UKM service.
   virtual ukm::UkmService* GetUkmService() = 0;
+
+  // Returns the user's signed-in email address, or empty string if not signed
+  // in.
+  virtual std::string GetAuthenticatedEmail() const = 0;
+
+  // Gets the pref service for the browser context associated with this
+  // PaymentRequest.
+  virtual PrefService* GetPrefService() = 0;
 };
 
 }  // namespace payments
diff --git a/components/payments/core/test_payment_request_delegate.cc b/components/payments/core/test_payment_request_delegate.cc
index 5309b1a..92765cb4d 100644
--- a/components/payments/core/test_payment_request_delegate.cc
+++ b/components/payments/core/test_payment_request_delegate.cc
@@ -77,4 +77,12 @@
       full_card_request_card_, base::ASCIIToUTF16("123"));
 }
 
+std::string TestPaymentRequestDelegate::GetAuthenticatedEmail() const {
+  return "";
+}
+
+PrefService* TestPaymentRequestDelegate::GetPrefService() {
+  return nullptr;
+}
+
 }  // namespace payments
diff --git a/components/payments/core/test_payment_request_delegate.h b/components/payments/core/test_payment_request_delegate.h
index eb815653..e9f2c02 100644
--- a/components/payments/core/test_payment_request_delegate.h
+++ b/components/payments/core/test_payment_request_delegate.h
@@ -5,6 +5,8 @@
 #ifndef COMPONENTS_PAYMENTS_CORE_TEST_PAYMENT_REQUEST_DELEGATE_H_
 #define COMPONENTS_PAYMENTS_CORE_TEST_PAYMENT_REQUEST_DELEGATE_H_
 
+#include <string>
+
 #include "components/payments/core/payment_request_delegate.h"
 #include "components/payments/core/test_address_normalizer.h"
 
@@ -32,6 +34,8 @@
   AddressNormalizer* GetAddressNormalizer() override;
   autofill::RegionDataLoader* GetRegionDataLoader() override;
   ukm::UkmService* GetUkmService() override;
+  std::string GetAuthenticatedEmail() const override;
+  PrefService* GetPrefService() override;
 
   TestAddressNormalizer* test_address_normalizer();
   void DelayFullCardRequestCompletion();
diff --git a/components/policy/resources/policy_templates.json b/components/policy/resources/policy_templates.json
index c1e982b..a9699fe 100644
--- a/components/policy/resources/policy_templates.json
+++ b/components/policy/resources/policy_templates.json
@@ -8952,8 +8952,7 @@
         'type': 'array',
         'items': { 'type': 'string' },
       },
-      'supported_on': ['chrome_os:58-'],
-      'future': True,
+      'supported_on': ['chrome_os:60-'],
       'device_only': True,
       'features': {
         'dynamic_refresh': True,
@@ -8969,6 +8968,8 @@
       implicitly, without user interaction, including any additional
       permissions requested by future versions of the app.
 
+      Note that, for security and privacy reasons, extensions are not allowed to be installed using this policy. Moreover, the devices on the Stable channel will only install the apps that belong to the whitelist bundled into <ph name="PRODUCT_NAME">$1<ex>Google Chrome</ex></ph>. Any items that don't conform to these conditions will be ignored.
+
       If an app that previously had been force-installed is removed from this list, it is automatically uninstalled by <ph name="PRODUCT_NAME">$1<ex>Google Chrome</ex></ph>.
 
       Each list item of the policy is a string that contains an extension ID and an "update" URL separated by a semicolon (<ph name="SEMICOLON">;</ph>). The extension ID is the 32-letter string found e.g. on <ph name="CHROME_EXTENSIONS_LINK">chrome://extensions</ph> when in developer mode. The "update" URL should point to an Update Manifest XML document as described at <ph name="LINK_TO_EXTENSION_DOC1">https://developer.chrome.com/extensions/autoupdate</ph>. Note that the "update" URL set in this policy is only used for the initial installation; subsequent updates of the extension employ the update URL indicated in the extension's manifest.
diff --git a/components/printing/browser/BUILD.gn b/components/printing/browser/BUILD.gn
index bddd3a6..3cce73a 100644
--- a/components/printing/browser/BUILD.gn
+++ b/components/printing/browser/BUILD.gn
@@ -10,10 +10,13 @@
     "print_manager_utils.h",
   ]
 
+  public_deps = [
+    "//content/public/browser",
+  ]
+
   deps = [
     "//base",
     "//components/printing/common",
-    "//content/public/browser",
     "//printing",
   ]
 }
diff --git a/components/safe_browsing/password_protection/password_protection_service.cc b/components/safe_browsing/password_protection/password_protection_service.cc
index ee3af7c..8433e273b 100644
--- a/components/safe_browsing/password_protection/password_protection_service.cc
+++ b/components/safe_browsing/password_protection/password_protection_service.cc
@@ -201,6 +201,62 @@
       std::string(), std::move(verdict_dictionary));
 }
 
+void PasswordProtectionService::CleanUpExpiredVerdicts() {
+  DCHECK(content_settings_);
+  if (GetStoredVerdictCount() <= 0)
+    return;
+
+  ContentSettingsForOneType password_protection_settings;
+  content_settings_->GetSettingsForOneType(
+      CONTENT_SETTINGS_TYPE_PASSWORD_PROTECTION, std::string(),
+      &password_protection_settings);
+
+  for (const ContentSettingPatternSource& source :
+       password_protection_settings) {
+    GURL primary_pattern_url = GURL(source.primary_pattern.ToString());
+    // Find all verdicts associated with this origin.
+    std::unique_ptr<base::DictionaryValue> verdict_dictionary =
+        base::DictionaryValue::From(content_settings_->GetWebsiteSetting(
+            primary_pattern_url, GURL(),
+            CONTENT_SETTINGS_TYPE_PASSWORD_PROTECTION, std::string(), nullptr));
+    std::vector<std::string> expired_keys;
+    for (base::DictionaryValue::Iterator it(*verdict_dictionary.get());
+         !it.IsAtEnd(); it.Advance()) {
+      base::DictionaryValue* verdict_entry = nullptr;
+      CHECK(verdict_dictionary->GetDictionaryWithoutPathExpansion(
+          it.key(), &verdict_entry));
+      int verdict_received_time;
+      LoginReputationClientResponse verdict;
+      CHECK(ParseVerdictEntry(verdict_entry, &verdict_received_time, &verdict));
+
+      if (IsCacheExpired(verdict_received_time, verdict.cache_duration_sec())) {
+        // Since DictionaryValue::Iterator cannot be used to modify the
+        // dictionary, we record the keys of expired verdicts in |expired_keys|
+        // and remove them in the next for-loop.
+        expired_keys.push_back(it.key());
+      }
+    }
+
+    for (const std::string& key : expired_keys) {
+      verdict_dictionary->RemoveWithoutPathExpansion(key, nullptr);
+      stored_verdict_count_--;
+    }
+
+    if (verdict_dictionary->size() == 0u) {
+      content_settings_->ClearSettingsForOneTypeWithPredicate(
+          CONTENT_SETTINGS_TYPE_PASSWORD_PROTECTION, base::Time(),
+          base::Bind(&OriginMatchPrimaryPattern, primary_pattern_url));
+    } else if (expired_keys.size() > 0u) {
+      // Set the website setting of this origin with the updated
+      // |verdict_diectionary|.
+      content_settings_->SetWebsiteSettingDefaultScope(
+          primary_pattern_url, GURL(),
+          CONTENT_SETTINGS_TYPE_PASSWORD_PROTECTION, std::string(),
+          std::move(verdict_dictionary));
+    }
+  }
+}
+
 void PasswordProtectionService::StartRequest(
     const GURL& main_frame_url,
     const GURL& password_form_action,
diff --git a/components/safe_browsing/password_protection/password_protection_service.h b/components/safe_browsing/password_protection/password_protection_service.h
index e688efc..20c3214 100644
--- a/components/safe_browsing/password_protection/password_protection_service.h
+++ b/components/safe_browsing/password_protection/password_protection_service.h
@@ -71,6 +71,9 @@
                     LoginReputationClientResponse* verdict,
                     const base::Time& receive_time);
 
+  // Removes all the expired verdicts from cache.
+  void CleanUpExpiredVerdicts();
+
   // Creates an instance of PasswordProtectionRequest and call Start() on that
   // instance. This function also insert this request object in |requests_| for
   // record keeping.
@@ -150,7 +153,9 @@
   FRIEND_TEST_ALL_PREFIXES(PasswordProtectionServiceTest,
                            TestPathVariantsMatchCacheExpression);
   FRIEND_TEST_ALL_PREFIXES(PasswordProtectionServiceTest,
-                           TestCleanUpCachedVerdicts);
+                           TestRemoveCachedVerdictOnURLsDeleted);
+  FRIEND_TEST_ALL_PREFIXES(PasswordProtectionServiceTest,
+                           TestCleanUpExpiredVerdict);
 
   // Overridden from history::HistoryServiceObserver.
   void OnURLsDeleted(history::HistoryService* history_service,
diff --git a/components/safe_browsing/password_protection/password_protection_service_unittest.cc b/components/safe_browsing/password_protection/password_protection_service_unittest.cc
index 547f23c..89995be2 100644
--- a/components/safe_browsing/password_protection/password_protection_service_unittest.cc
+++ b/components/safe_browsing/password_protection/password_protection_service_unittest.cc
@@ -367,7 +367,7 @@
                 GURL("http://test.com/def/ghi/index.html"), &actual_verdict));
 }
 
-TEST_F(PasswordProtectionServiceTest, TestCleanUpCachedVerdicts) {
+TEST_F(PasswordProtectionServiceTest, TestRemoveCachedVerdictOnURLsDeleted) {
   ASSERT_EQ(0U, GetStoredVerdictCount());
   // Prepare 2 verdicts. One is for origin "http://foo.com", and the other is
   // for "http://bar.com".
@@ -403,6 +403,7 @@
       true /* all_history */, history::URLRows());
   EXPECT_EQ(0U, GetStoredVerdictCount());
 }
+
 TEST_F(PasswordProtectionServiceTest,
        TestNoRequestCreatedIfMainFrameURLIsNotValid) {
   ASSERT_EQ(0u, password_protection_service_->GetPendingRequestsCount());
@@ -538,4 +539,43 @@
   EXPECT_THAT(histograms_.GetAllSamples(kRequestOutcomeHistogramName),
               testing::ElementsAre(base::Bucket(2 /* CANCELED */, 1)));
 }
+
+TEST_F(PasswordProtectionServiceTest, TestCleanUpExpiredVerdict) {
+  ASSERT_EQ(0U, GetStoredVerdictCount());
+  // Prepare 4 verdicts:
+  // (1) "foo.com/abc" valid
+  // (2) "foo.com/def" expired
+  // (3) "bar.com/abc" expired
+  // (4) "bar.com/def" expired
+  base::Time now = base::Time::Now();
+  CacheVerdict(GURL("https://foo.com/abc/index.jsp"),
+               LoginReputationClientResponse::LOW_REPUTATION, 10 * 60,
+               "foo.com/abc", now);
+  CacheVerdict(GURL("https://foo.com/def/index.jsp"),
+               LoginReputationClientResponse::LOW_REPUTATION, 0, "foo.com/def",
+               now);
+  CacheVerdict(GURL("https://bar.com/abc/index.jsp"),
+               LoginReputationClientResponse::PHISHING, 0, "bar.com/abc", now);
+  CacheVerdict(GURL("https://bar.com/def/index.jsp"),
+               LoginReputationClientResponse::PHISHING, 0, "bar.com/def", now);
+  ASSERT_EQ(4U, GetStoredVerdictCount());
+
+  password_protection_service_->CleanUpExpiredVerdicts();
+
+  ASSERT_EQ(1U, GetStoredVerdictCount());
+  LoginReputationClientResponse actual_verdict;
+  // Has cached verdict for foo.com/abc.
+  EXPECT_EQ(LoginReputationClientResponse::LOW_REPUTATION,
+            password_protection_service_->GetCachedVerdict(
+                GURL("https://foo.com/abc/test.jsp"), &actual_verdict));
+  // No cached verdict for foo.com/def.
+  EXPECT_EQ(LoginReputationClientResponse::VERDICT_TYPE_UNSPECIFIED,
+            password_protection_service_->GetCachedVerdict(
+                GURL("https://foo.com/def/index.jsp"), &actual_verdict));
+  // Nothing in content setting for bar.com.
+  EXPECT_EQ(nullptr, content_setting_map_->GetWebsiteSetting(
+                         GURL("https://bar.com"), GURL(),
+                         CONTENT_SETTINGS_TYPE_PASSWORD_PROTECTION,
+                         std::string(), nullptr));
+}
 }  // namespace safe_browsing
diff --git a/components/search_engines/prepopulated_engines.json b/components/search_engines/prepopulated_engines.json
index 3ebf56b..58f4ae0 100644
--- a/components/search_engines/prepopulated_engines.json
+++ b/components/search_engines/prepopulated_engines.json
@@ -616,7 +616,7 @@
       "name": "\u042f\u043d\u0434\u0435\u043a\u0441",
       "keyword": "yandex.ru",
       "favicon_url": "https://yastatic.net/lego/_/pDu9OWAQKB0s2J9IojKpiS_Eho.ico",
-      "search_url": "https://yandex.ru/{yandex:searchPath}?text={searchTerms}",
+      "search_url": "https://yandex.ru/{yandex:searchPath}?text={searchTerms}&{yandex:referralID}",
       "suggest_url": "https://suggest.yandex.ru/suggest-ff.cgi?part={searchTerms}",
       "image_url": "https://yandex.ru/images/search/?rpt=imageview",
       "image_url_post_params": "upfile={google:imageThumbnail},original_width={google:imageOriginalWidth},original_height={google:imageOriginalHeight},prg=1",
diff --git a/components/search_engines/search_terms_data.cc b/components/search_engines/search_terms_data.cc
index f0ef783..d532ae6 100644
--- a/components/search_engines/search_terms_data.cc
+++ b/components/search_engines/search_terms_data.cc
@@ -66,3 +66,7 @@
 std::string SearchTermsData::GoogleImageSearchSource() const {
   return std::string();
 }
+
+std::string SearchTermsData::GetYandexReferralID() const {
+  return std::string();
+}
diff --git a/components/search_engines/search_terms_data.h b/components/search_engines/search_terms_data.h
index 50f7ed2..c72b992 100644
--- a/components/search_engines/search_terms_data.h
+++ b/components/search_engines/search_terms_data.h
@@ -61,6 +61,10 @@
   // GOOGLE_IMAGE_SEARCH_SOURCE.
   virtual std::string GoogleImageSearchSource() const;
 
+  // Returns the optional referral ID to be passed to Yandex when searching from
+  // the omnibox (returns the empty string if not supported/applicable).
+  virtual std::string GetYandexReferralID() const;
+
  private:
   DISALLOW_COPY_AND_ASSIGN(SearchTermsData);
 };
diff --git a/components/search_engines/template_url.cc b/components/search_engines/template_url.cc
index b4fb1516..9df068a 100644
--- a/components/search_engines/template_url.cc
+++ b/components/search_engines/template_url.cc
@@ -649,6 +649,8 @@
     replacements->push_back(Replacement(GOOGLE_SUGGEST_REQUEST_ID, start));
   } else if (parameter == kGoogleUnescapedSearchTermsParameter) {
     replacements->push_back(Replacement(GOOGLE_UNESCAPED_SEARCH_TERMS, start));
+  } else if (parameter == "yandex:referralID") {
+    replacements->push_back(Replacement(YANDEX_REFERRAL_ID, start));
   } else if (parameter == "yandex:searchPath") {
     switch (ui::GetDeviceFormFactor()) {
       case ui::DEVICE_FORM_FACTOR_DESKTOP:
@@ -1125,6 +1127,13 @@
 #endif
         break;
 
+      case YANDEX_REFERRAL_ID: {
+        std::string referral_id = search_terms_data.GetYandexReferralID();
+        if (!referral_id.empty())
+          HandleReplacement("clid", referral_id, *i, &url);
+        break;
+      }
+
       default:
         NOTREACHED();
         break;
diff --git a/components/search_engines/template_url.h b/components/search_engines/template_url.h
index a3c83ce..242b4784 100644
--- a/components/search_engines/template_url.h
+++ b/components/search_engines/template_url.h
@@ -321,6 +321,7 @@
     GOOGLE_UNESCAPED_SEARCH_TERMS,
     LANGUAGE,
     SEARCH_TERMS,
+    YANDEX_REFERRAL_ID,
   };
 
   // Used to identify an element of the raw url that can be replaced.
diff --git a/components/storage_monitor/portable_device_watcher_win.cc b/components/storage_monitor/portable_device_watcher_win.cc
index 368c4cf2..826a2af8 100644
--- a/components/storage_monitor/portable_device_watcher_win.cc
+++ b/components/storage_monitor/portable_device_watcher_win.cc
@@ -211,14 +211,14 @@
   DCHECK(device);
   DCHECK(unique_id);
   base::win::ScopedComPtr<IPortableDeviceContent> content;
-  HRESULT hr = device->Content(content.Receive());
+  HRESULT hr = device->Content(content.GetAddressOf());
   if (FAILED(hr)) {
     DPLOG(ERROR) << "Failed to get IPortableDeviceContent interface";
     return false;
   }
 
   base::win::ScopedComPtr<IPortableDeviceProperties> properties;
-  hr = content->Properties(properties.Receive());
+  hr = content->Properties(properties.GetAddressOf());
   if (FAILED(hr)) {
     DPLOG(ERROR) << "Failed to get IPortableDeviceProperties interface";
     return false;
@@ -229,9 +229,8 @@
     return false;
 
   base::win::ScopedComPtr<IPortableDeviceValues> properties_values;
-  if (FAILED(properties->GetValues(object_id.c_str(),
-                                   properties_to_read.Get(),
-                                   properties_values.Receive()))) {
+  if (FAILED(properties->GetValues(object_id.c_str(), properties_to_read.Get(),
+                                   properties_values.GetAddressOf()))) {
     return false;
   }
 
@@ -262,7 +261,7 @@
   DCHECK(device);
   DCHECK(storage_object_ids);
   base::win::ScopedComPtr<IPortableDeviceCapabilities> capabilities;
-  HRESULT hr = device->Capabilities(capabilities.Receive());
+  HRESULT hr = device->Capabilities(capabilities.GetAddressOf());
   if (FAILED(hr)) {
     DPLOG(ERROR) << "Failed to get IPortableDeviceCapabilities interface";
     return false;
@@ -270,7 +269,7 @@
 
   base::win::ScopedComPtr<IPortableDevicePropVariantCollection> storage_ids;
   hr = capabilities->GetFunctionalObjects(WPD_FUNCTIONAL_CATEGORY_STORAGE,
-                                          storage_ids.Receive());
+                                          storage_ids.GetAddressOf());
   if (FAILED(hr)) {
     DPLOG(ERROR) << "Failed to get IPortableDevicePropVariantCollection";
     return false;
diff --git a/components/translate/core/browser/translate_ranker_impl.cc b/components/translate/core/browser/translate_ranker_impl.cc
index 1c84e84..b68c27f 100644
--- a/components/translate/core/browser/translate_ranker_impl.cc
+++ b/components/translate/core/browser/translate_ranker_impl.cc
@@ -82,9 +82,6 @@
 const base::Feature kTranslateRankerEnforcement{
     "TranslateRankerEnforcement", base::FEATURE_DISABLED_BY_DEFAULT};
 
-const base::Feature kTranslateRankerLogging{"TranslateRankerLogging",
-                                            base::FEATURE_ENABLED_BY_DEFAULT};
-
 const base::Feature kTranslateRankerDecisionOverride{
     "TranslateRankerDecisionOverride", base::FEATURE_DISABLED_BY_DEFAULT};
 
@@ -141,8 +138,7 @@
                                          const GURL& model_url,
                                          ukm::UkmService* ukm_service)
     : ukm_service_(ukm_service),
-      is_logging_enabled_(
-          base::FeatureList::IsEnabled(kTranslateRankerLogging)),
+      is_logging_enabled_(true),
       is_query_enabled_(base::FeatureList::IsEnabled(kTranslateRankerQuery)),
       is_enforcement_enabled_(
           base::FeatureList::IsEnabled(kTranslateRankerEnforcement)),
diff --git a/components/translate/core/browser/translate_ranker_impl.h b/components/translate/core/browser/translate_ranker_impl.h
index 97edc000..c19f594 100644
--- a/components/translate/core/browser/translate_ranker_impl.h
+++ b/components/translate/core/browser/translate_ranker_impl.h
@@ -40,7 +40,6 @@
 // enabling enforcement implies (forces) enabling queries.
 extern const base::Feature kTranslateRankerQuery;
 extern const base::Feature kTranslateRankerEnforcement;
-extern const base::Feature kTranslateRankerLogging;
 extern const base::Feature kTranslateRankerDecisionOverride;
 
 struct TranslateRankerFeatures {
@@ -96,7 +95,7 @@
   // from Finch.
   static GURL GetModelURL();
 
-  // Over-ride the default enabled/disabled state of translate event logging.
+  // Override the default enabled/disabled state of translate event logging.
   void EnableLogging(bool value);
 
   // TranslateRanker...
diff --git a/components/translate/core/browser/translate_ranker_impl_unittest.cc b/components/translate/core/browser/translate_ranker_impl_unittest.cc
index 172e507a..10cca59 100644
--- a/components/translate/core/browser/translate_ranker_impl_unittest.cc
+++ b/components/translate/core/browser/translate_ranker_impl_unittest.cc
@@ -33,7 +33,6 @@
 namespace {
 
 using translate::kTranslateRankerEnforcement;
-using translate::kTranslateRankerLogging;
 using translate::kTranslateRankerQuery;
 using translate::kTranslateRankerDecisionOverride;
 using translate::TranslateDownloadManager;
@@ -333,7 +332,6 @@
 }
 
 TEST_F(TranslateRankerImplTest, RecordAndFlushEvents) {
-  InitFeatures({kTranslateRankerLogging}, {});
   std::unique_ptr<translate::TranslateRanker> ranker = GetRankerForTest(0.0f);
   std::vector<metrics::TranslateEventProto> flushed_events;
 
@@ -371,26 +369,7 @@
       GetTestUkmService()->GetSourceForUrl(url1.spec().c_str())->url().spec());
 }
 
-TEST_F(TranslateRankerImplTest, LoggingDisabled) {
-  InitFeatures({}, {kTranslateRankerLogging});
-  std::unique_ptr<translate::TranslateRanker> ranker = GetRankerForTest(0.0f);
-  std::vector<metrics::TranslateEventProto> flushed_events;
-
-  ranker->FlushTranslateEvents(&flushed_events);
-  EXPECT_EQ(0U, flushed_events.size());
-
-  ranker->RecordTranslateEvent(0, GURL(), &tep1_);
-  ranker->RecordTranslateEvent(1, GURL(), &tep2_);
-  ranker->RecordTranslateEvent(2, GURL(), &tep3_);
-
-  // Logging is disabled, so no events should be cached.
-  ranker->FlushTranslateEvents(&flushed_events);
-  EXPECT_EQ(0U, flushed_events.size());
-  EXPECT_EQ(0ul, GetTestUkmService()->sources_count());
-}
-
 TEST_F(TranslateRankerImplTest, LoggingDisabledViaOverride) {
-  InitFeatures({kTranslateRankerLogging}, {});
   std::unique_ptr<translate::TranslateRankerImpl> ranker =
       GetRankerForTest(0.0f);
   std::vector<metrics::TranslateEventProto> flushed_events;
@@ -402,7 +381,7 @@
   ranker->RecordTranslateEvent(1, GURL(), &tep2_);
   ranker->RecordTranslateEvent(2, GURL(), &tep3_);
 
-  // Logging is disabled, so no events should be cached.
+  // Logging is enabled by default, so events should be cached.
   ranker->FlushTranslateEvents(&flushed_events);
   EXPECT_EQ(3U, flushed_events.size());
 
diff --git a/components/update_client/BUILD.gn b/components/update_client/BUILD.gn
index 0a66f436..99b4dd8 100644
--- a/components/update_client/BUILD.gn
+++ b/components/update_client/BUILD.gn
@@ -20,6 +20,7 @@
     "crx_downloader.cc",
     "crx_downloader.h",
     "crx_update_item.h",
+    "out_of_process_patcher.h",
     "persisted_data.cc",
     "persisted_data.h",
     "ping_manager.cc",
diff --git a/components/update_client/background_downloader_win.cc b/components/update_client/background_downloader_win.cc
index 152ad54..5a0d089 100644
--- a/components/update_client/background_downloader_win.cc
+++ b/components/update_client/background_downloader_win.cc
@@ -169,7 +169,7 @@
 HRESULT GetFilesInJob(IBackgroundCopyJob* job,
                       std::vector<ScopedComPtr<IBackgroundCopyFile>>* files) {
   ScopedComPtr<IEnumBackgroundCopyFiles> enum_files;
-  HRESULT hr = job->EnumFiles(enum_files.Receive());
+  HRESULT hr = job->EnumFiles(enum_files.GetAddressOf());
   if (FAILED(hr))
     return hr;
 
@@ -180,7 +180,7 @@
 
   for (ULONG i = 0; i != num_files; ++i) {
     ScopedComPtr<IBackgroundCopyFile> file;
-    if (enum_files->Next(1, file.Receive(), NULL) == S_OK && file.Get())
+    if (enum_files->Next(1, file.GetAddressOf(), NULL) == S_OK && file.Get())
       files->push_back(file);
   }
 
@@ -265,7 +265,7 @@
 HRESULT GetJobError(IBackgroundCopyJob* job, HRESULT* error_code_out) {
   *error_code_out = S_OK;
   ScopedComPtr<IBackgroundCopyError> copy_error;
-  HRESULT hr = job->GetError(copy_error.Receive());
+  HRESULT hr = job->GetError(copy_error.GetAddressOf());
   if (FAILED(hr))
     return hr;
 
@@ -287,7 +287,7 @@
                       IBackgroundCopyManager* bits_manager,
                       std::vector<ScopedComPtr<IBackgroundCopyJob>>* jobs) {
   ScopedComPtr<IEnumBackgroundCopyJobs> enum_jobs;
-  HRESULT hr = bits_manager->EnumJobs(0, enum_jobs.Receive());
+  HRESULT hr = bits_manager->EnumJobs(0, enum_jobs.GetAddressOf());
   if (FAILED(hr))
     return hr;
 
@@ -300,7 +300,7 @@
   // the job description matches the component updater jobs.
   for (ULONG i = 0; i != job_count; ++i) {
     ScopedComPtr<IBackgroundCopyJob> current_job;
-    if (enum_jobs->Next(1, current_job.Receive(), NULL) == S_OK &&
+    if (enum_jobs->Next(1, current_job.GetAddressOf(), NULL) == S_OK &&
         pred(current_job.Get())) {
       base::string16 job_description;
       hr = GetJobDescription(current_job.Get(), &job_description);
@@ -484,7 +484,7 @@
   if (FAILED(hr))
     return hr;
 
-  hr = CreateBitsManager(bits_manager_.Receive());
+  hr = CreateBitsManager(bits_manager_.GetAddressOf());
   if (FAILED(hr))
     return hr;
 
@@ -492,7 +492,7 @@
   if (FAILED(hr))
     return hr;
 
-  hr = QueueBitsJob(url, job_.Receive());
+  hr = QueueBitsJob(url, job_.GetAddressOf());
   if (FAILED(hr))
     return hr;
 
@@ -717,7 +717,7 @@
   DCHECK(task_runner()->RunsTasksOnCurrentThread());
 
   ScopedComPtr<IBackgroundCopyJob> p;
-  HRESULT hr = CreateOrOpenJob(url, p.Receive());
+  HRESULT hr = CreateOrOpenJob(url, p.GetAddressOf());
   if (FAILED(hr))
     return hr;
 
diff --git a/components/update_client/component.cc b/components/update_client/component.cc
index 2f894ad1..e83e325 100644
--- a/components/update_client/component.cc
+++ b/components/update_client/component.cc
@@ -15,6 +15,7 @@
 #include "base/memory/ptr_util.h"
 #include "base/single_thread_task_runner.h"
 #include "base/threading/thread_task_runner_handle.h"
+#include "components/update_client/component_unpacker.h"
 #include "components/update_client/configurator.h"
 #include "components/update_client/update_client.h"
 #include "components/update_client/update_client_errors.h"
diff --git a/components/update_client/component.h b/components/update_client/component.h
index 758550d..99ce74b 100644
--- a/components/update_client/component.h
+++ b/components/update_client/component.h
@@ -19,7 +19,6 @@
 #include "base/threading/thread_checker.h"
 #include "base/time/time.h"
 #include "base/version.h"
-#include "components/update_client/component_unpacker.h"
 #include "components/update_client/crx_downloader.h"
 #include "components/update_client/update_client.h"
 #include "components/update_client/update_response.h"
@@ -32,6 +31,7 @@
 namespace update_client {
 
 struct CrxUpdateItem;
+class ComponentUnpacker;
 struct UpdateContext;
 
 // Describes a CRX component managed by the UpdateEngine. Each |Component| is
diff --git a/components/update_client/component_patcher_operation.cc b/components/update_client/component_patcher_operation.cc
index f3fa282..be7be1f3 100644
--- a/components/update_client/component_patcher_operation.cc
+++ b/components/update_client/component_patcher_operation.cc
@@ -12,6 +12,7 @@
 #include "base/files/memory_mapped_file.h"
 #include "base/location.h"
 #include "base/strings/string_number_conversions.h"
+#include "components/update_client/out_of_process_patcher.h"
 #include "components/update_client/update_client.h"
 #include "components/update_client/update_client_errors.h"
 #include "components/update_client/utils.h"
@@ -169,7 +170,7 @@
 
 DeltaUpdateOpPatch::DeltaUpdateOpPatch(
     const std::string& operation,
-    scoped_refptr<OutOfProcessPatcher> out_of_process_patcher)
+    const scoped_refptr<OutOfProcessPatcher>& out_of_process_patcher)
     : operation_(operation), out_of_process_patcher_(out_of_process_patcher) {
   DCHECK(operation == kBsdiff || operation == kCourgette);
 }
diff --git a/components/update_client/component_patcher_operation.h b/components/update_client/component_patcher_operation.h
index aaf09c7b..08c55a1 100644
--- a/components/update_client/component_patcher_operation.h
+++ b/components/update_client/component_patcher_operation.h
@@ -27,6 +27,7 @@
 extern const char kPatch[];
 
 class CrxInstaller;
+class OutOfProcessPatcher;
 enum class UnpackerError;
 
 class DeltaUpdateOp : public base::RefCountedThreadSafe<DeltaUpdateOp> {
@@ -126,24 +127,6 @@
   DISALLOW_COPY_AND_ASSIGN(DeltaUpdateOpCreate);
 };
 
-// An interface an embedder may fulfill to enable out-of-process patching.
-class OutOfProcessPatcher
-    : public base::RefCountedThreadSafe<OutOfProcessPatcher> {
- public:
-  virtual void Patch(
-      const std::string& operation,
-      scoped_refptr<base::SequencedTaskRunner> task_runner,
-      const base::FilePath& input_abs_path,
-      const base::FilePath& patch_abs_path,
-      const base::FilePath& output_abs_path,
-      base::Callback<void(int result)> callback) = 0;
-
- protected:
-  friend class base::RefCountedThreadSafe<OutOfProcessPatcher>;
-
-  virtual ~OutOfProcessPatcher() {}
-};
-
 // Both 'bsdiff' and 'courgette' operations take an existing file on disk,
 // and a bsdiff- or Courgette-format patch file provided in the delta update
 // package, and run bsdiff or Courgette to construct an output file in the
@@ -151,8 +134,9 @@
 class DeltaUpdateOpPatch : public DeltaUpdateOp {
  public:
   // |out_of_process_patcher| may be NULL.
-  DeltaUpdateOpPatch(const std::string& operation,
-                     scoped_refptr<OutOfProcessPatcher> out_of_process_patcher);
+  DeltaUpdateOpPatch(
+      const std::string& operation,
+      const scoped_refptr<OutOfProcessPatcher>& out_of_process_patcher);
 
  private:
   ~DeltaUpdateOpPatch() override;
@@ -170,7 +154,7 @@
   void DonePatching(const ComponentPatcher::Callback& callback, int result);
 
   std::string operation_;
-  scoped_refptr<OutOfProcessPatcher> out_of_process_patcher_;
+  const scoped_refptr<OutOfProcessPatcher> out_of_process_patcher_;
   base::FilePath patch_abs_path_;
   base::FilePath input_abs_path_;
 
diff --git a/components/update_client/component_unpacker.cc b/components/update_client/component_unpacker.cc
index 6dd555cc..a5d1abd 100644
--- a/components/update_client/component_unpacker.cc
+++ b/components/update_client/component_unpacker.cc
@@ -23,7 +23,6 @@
 #include "base/values.h"
 #include "components/crx_file/crx_file.h"
 #include "components/update_client/component_patcher.h"
-#include "components/update_client/component_patcher_operation.h"
 #include "components/update_client/update_client.h"
 #include "components/update_client/update_client_errors.h"
 #include "crypto/secure_hash.h"
diff --git a/components/update_client/component_unpacker.h b/components/update_client/component_unpacker.h
index dead6b6..54fc6a9 100644
--- a/components/update_client/component_unpacker.h
+++ b/components/update_client/component_unpacker.h
@@ -17,13 +17,13 @@
 #include "base/macros.h"
 #include "base/memory/ref_counted.h"
 #include "base/sequenced_task_runner.h"
+#include "components/update_client/out_of_process_patcher.h"
 #include "components/update_client/update_client_errors.h"
 
 namespace update_client {
 
 class CrxInstaller;
 class ComponentPatcher;
-class OutOfProcessPatcher;
 
 // Deserializes the CRX manifest. The top level must be a dictionary.
 std::unique_ptr<base::DictionaryValue> ReadManifest(
diff --git a/components/update_client/component_unpacker_unittest.cc b/components/update_client/component_unpacker_unittest.cc
index 5b1a28cc..f986913 100644
--- a/components/update_client/component_unpacker_unittest.cc
+++ b/components/update_client/component_unpacker_unittest.cc
@@ -16,7 +16,6 @@
 #include "base/path_service.h"
 #include "base/run_loop.h"
 #include "base/test/sequenced_worker_pool_owner.h"
-#include "components/update_client/component_patcher_operation.h"
 #include "components/update_client/component_unpacker.h"
 #include "components/update_client/test_configurator.h"
 #include "components/update_client/test_installer.h"
diff --git a/components/update_client/out_of_process_patcher.h b/components/update_client/out_of_process_patcher.h
new file mode 100644
index 0000000..a41f01b2
--- /dev/null
+++ b/components/update_client/out_of_process_patcher.h
@@ -0,0 +1,40 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef COMPONENTS_UPDATE_CLIENT_OUT_OF_PROCESS_PATCHER_H_
+#define COMPONENTS_UPDATE_CLIENT_OUT_OF_PROCESS_PATCHER_H_
+
+#include <string>
+
+#include "base/callback_forward.h"
+#include "base/memory/ref_counted.h"
+
+namespace base {
+class FilePath;
+class SequencedTaskRunner;
+}
+
+namespace update_client {
+
+// An interface an embedder can implement to enable out-of-process patching.
+class OutOfProcessPatcher
+    : public base::RefCountedThreadSafe<OutOfProcessPatcher> {
+ public:
+  virtual void Patch(
+      const std::string& operation,
+      const scoped_refptr<base::SequencedTaskRunner>& task_runner,
+      const base::FilePath& input_abs_path,
+      const base::FilePath& patch_abs_path,
+      const base::FilePath& output_abs_path,
+      const base::Callback<void(int result)>& callback) = 0;
+
+ protected:
+  friend class base::RefCountedThreadSafe<OutOfProcessPatcher>;
+
+  virtual ~OutOfProcessPatcher() {}
+};
+
+}  // namespace update_client
+
+#endif  // COMPONENTS_UPDATE_CLIENT_OUT_OF_PROCESS_PATCHER_H_
diff --git a/components/update_client/test_configurator.cc b/components/update_client/test_configurator.cc
index 322044a..b2bf95dd 100644
--- a/components/update_client/test_configurator.cc
+++ b/components/update_client/test_configurator.cc
@@ -8,7 +8,7 @@
 #include "base/single_thread_task_runner.h"
 #include "base/version.h"
 #include "components/prefs/pref_service.h"
-#include "components/update_client/component_patcher_operation.h"
+#include "components/update_client/out_of_process_patcher.h"
 #include "net/url_request/url_request_test_util.h"
 #include "url/gurl.h"
 
diff --git a/components/update_client/update_engine.h b/components/update_client/update_engine.h
index cec91f9..df643b1 100644
--- a/components/update_client/update_engine.h
+++ b/components/update_client/update_engine.h
@@ -20,7 +20,6 @@
 #include "base/threading/thread_checker.h"
 #include "base/time/time.h"
 #include "components/update_client/component.h"
-#include "components/update_client/component_patcher_operation.h"
 #include "components/update_client/crx_downloader.h"
 #include "components/update_client/crx_update_item.h"
 #include "components/update_client/ping_manager.h"
diff --git a/content/browser/accessibility/accessibility_event_recorder_win.cc b/content/browser/accessibility/accessibility_event_recorder_win.cc
index 33ac6743..c236671 100644
--- a/content/browser/accessibility/accessibility_event_recorder_win.cc
+++ b/content/browser/accessibility/accessibility_event_recorder_win.cc
@@ -39,7 +39,7 @@
 
 HRESULT QueryIAccessible2(IAccessible* accessible, IAccessible2** accessible2) {
   base::win::ScopedComPtr<IServiceProvider> service_provider;
-  HRESULT hr = accessible->QueryInterface(service_provider.Receive());
+  HRESULT hr = accessible->QueryInterface(service_provider.GetAddressOf());
   return SUCCEEDED(hr) ?
       service_provider->QueryService(IID_IAccessible2, accessible2) : hr;
 }
@@ -47,7 +47,7 @@
 HRESULT QueryIAccessibleText(IAccessible* accessible,
                              IAccessibleText** accessible_text) {
   base::win::ScopedComPtr<IServiceProvider> service_provider;
-  HRESULT hr = accessible->QueryInterface(service_provider.Receive());
+  HRESULT hr = accessible->QueryInterface(service_provider.GetAddressOf());
   return SUCCEEDED(hr) ?
       service_provider->QueryService(IID_IAccessibleText, accessible_text) : hr;
 }
@@ -165,10 +165,8 @@
     DWORD event_time) {
   base::win::ScopedComPtr<IAccessible> browser_accessible;
   HRESULT hr = AccessibleObjectFromWindowWrapper(
-      hwnd,
-      obj_id,
-      IID_IAccessible,
-      reinterpret_cast<void**>(browser_accessible.Receive()));
+      hwnd, obj_id, IID_IAccessible,
+      reinterpret_cast<void**>(browser_accessible.GetAddressOf()));
   if (!SUCCEEDED(hr)) {
     // Note: our event hook will pick up some superfluous events we
     // don't care about, so it's safe to just ignore these failures.
@@ -179,7 +177,8 @@
 
   base::win::ScopedVariant childid_variant(child_id);
   base::win::ScopedComPtr<IDispatch> dispatch;
-  hr = browser_accessible->get_accChild(childid_variant, dispatch.Receive());
+  hr = browser_accessible->get_accChild(childid_variant,
+                                        dispatch.GetAddressOf());
   if (!SUCCEEDED(hr) || !dispatch) {
     VLOG(1) << "Ignoring result " << hr << " and result " << dispatch
             << " from get_accChild";
@@ -187,7 +186,7 @@
   }
 
   base::win::ScopedComPtr<IAccessible> iaccessible;
-  hr = dispatch.CopyTo(iaccessible.Receive());
+  hr = dispatch.CopyTo(iaccessible.GetAddressOf());
   if (!SUCCEEDED(hr)) {
     VLOG(1) << "Ignoring result " << hr << " from QueryInterface";
     return;
@@ -228,7 +227,7 @@
 
   AccessibleStates ia2_state = 0;
   base::win::ScopedComPtr<IAccessible2> iaccessible2;
-  hr = QueryIAccessible2(iaccessible.Get(), iaccessible2.Receive());
+  hr = QueryIAccessible2(iaccessible.Get(), iaccessible2.GetAddressOf());
   if (SUCCEEDED(hr))
     iaccessible2->get_states(&ia2_state);
 
@@ -246,7 +245,7 @@
   // For TEXT_REMOVED and TEXT_INSERTED events, query the text that was
   // inserted or removed and include that in the log.
   base::win::ScopedComPtr<IAccessibleText> accessible_text;
-  hr = QueryIAccessibleText(iaccessible.Get(), accessible_text.Receive());
+  hr = QueryIAccessibleText(iaccessible.Get(), accessible_text.GetAddressOf());
   if (SUCCEEDED(hr)) {
     if (event == IA2_EVENT_TEXT_REMOVED) {
       IA2TextSegment old_text;
diff --git a/content/browser/accessibility/accessibility_tree_formatter_win.cc b/content/browser/accessibility/accessibility_tree_formatter_win.cc
index eeb0914..2eeb2b06 100644
--- a/content/browser/accessibility/accessibility_tree_formatter_win.cc
+++ b/content/browser/accessibility/accessibility_tree_formatter_win.cc
@@ -131,10 +131,10 @@
       DCHECK_GE(index_of_embed, 0);
       base::win::ScopedComPtr<IAccessibleHyperlink> embedded_object;
       hr = ax_object.GetCOM()->get_hyperlink(index_of_embed,
-                                             embedded_object.Receive());
+                                             embedded_object.GetAddressOf());
       DCHECK(SUCCEEDED(hr));
       base::win::ScopedComPtr<IAccessible2> ax_embed;
-      hr = embedded_object.CopyTo(ax_embed.Receive());
+      hr = embedded_object.CopyTo(ax_embed.GetAddressOf());
       DCHECK(SUCCEEDED(hr));
       hr = ax_embed->get_indexInParent(&child_index);
       DCHECK(SUCCEEDED(hr));
diff --git a/content/browser/accessibility/accessibility_win_browsertest.cc b/content/browser/accessibility/accessibility_win_browsertest.cc
index f1589f3..aab571f0 100644
--- a/content/browser/accessibility/accessibility_win_browsertest.cc
+++ b/content/browser/accessibility/accessibility_win_browsertest.cc
@@ -2,6 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+#include <objbase.h>
 #include <stddef.h>
 #include <stdint.h>
 
@@ -146,7 +147,7 @@
   ASSERT_HRESULT_SUCCEEDED(QueryIAccessible2(
       GetAccessibleFromVariant(document.Get(), document_children[0].AsInput())
           .Get(),
-      form.Receive()));
+      form.GetAddressOf()));
   std::vector<base::win::ScopedVariant> form_children =
       GetAllAccessibleChildren(form.Get());
   ASSERT_EQ(2u, form_children.size());
@@ -155,13 +156,13 @@
   base::win::ScopedComPtr<IAccessible2> input;
   ASSERT_HRESULT_SUCCEEDED(QueryIAccessible2(
       GetAccessibleFromVariant(form.Get(), form_children[1].AsInput()).Get(),
-      input.Receive()));
+      input.GetAddressOf()));
   LONG input_role = 0;
   ASSERT_HRESULT_SUCCEEDED(input->role(&input_role));
   ASSERT_EQ(ROLE_SYSTEM_TEXT, input_role);
 
   // Retrieve the IAccessibleText interface for the field.
-  ASSERT_HRESULT_SUCCEEDED(input.CopyTo(input_text->Receive()));
+  ASSERT_HRESULT_SUCCEEDED(input.CopyTo(input_text->GetAddressOf()));
 
   // Set the caret on the last character.
   AccessibilityNotificationWaiter waiter(shell()->web_contents(),
@@ -197,7 +198,7 @@
   ASSERT_HRESULT_SUCCEEDED(QueryIAccessible2(
       GetAccessibleFromVariant(document.Get(), document_children[0].AsInput())
           .Get(),
-      section.Receive()));
+      section.GetAddressOf()));
   std::vector<base::win::ScopedVariant> section_children =
       GetAllAccessibleChildren(section.Get());
   ASSERT_EQ(1u, section_children.size());
@@ -207,13 +208,13 @@
   ASSERT_HRESULT_SUCCEEDED(QueryIAccessible2(
       GetAccessibleFromVariant(section.Get(), section_children[0].AsInput())
           .Get(),
-      textarea.Receive()));
+      textarea.GetAddressOf()));
   LONG textarea_role = 0;
   ASSERT_HRESULT_SUCCEEDED(textarea->role(&textarea_role));
   ASSERT_EQ(ROLE_SYSTEM_TEXT, textarea_role);
 
   // Retrieve the IAccessibleText interface for the field.
-  ASSERT_HRESULT_SUCCEEDED(textarea.CopyTo(textarea_text->Receive()));
+  ASSERT_HRESULT_SUCCEEDED(textarea.CopyTo(textarea_text->GetAddressOf()));
 
   // Set the caret on the last character.
   AccessibilityNotificationWaiter waiter(shell()->web_contents(),
@@ -253,12 +254,11 @@
   ASSERT_HRESULT_SUCCEEDED(QueryIAccessible2(
       GetAccessibleFromVariant(document.Get(), document_children[0].AsInput())
           .Get(),
-      paragraph.Receive()));
+      paragraph.GetAddressOf()));
   LONG paragraph_role = 0;
   ASSERT_HRESULT_SUCCEEDED(paragraph->role(&paragraph_role));
   ASSERT_EQ(IA2_ROLE_PARAGRAPH, paragraph_role);
-  ASSERT_HRESULT_SUCCEEDED(paragraph.CopyTo(
-      accessible_text->Receive()));
+  ASSERT_HRESULT_SUCCEEDED(paragraph.CopyTo(accessible_text->GetAddressOf()));
 }
 
 // Static helpers ------------------------------------------------
@@ -272,16 +272,16 @@
     case VT_DISPATCH: {
       IDispatch* dispatch = V_DISPATCH(var);
       if (dispatch)
-        dispatch->QueryInterface(ptr.Receive());
+        dispatch->QueryInterface(ptr.GetAddressOf());
       break;
     }
 
     case VT_I4: {
       base::win::ScopedComPtr<IDispatch> dispatch;
-      HRESULT hr = parent->get_accChild(*var, dispatch.Receive());
+      HRESULT hr = parent->get_accChild(*var, dispatch.GetAddressOf());
       EXPECT_TRUE(SUCCEEDED(hr));
       if (dispatch.Get())
-        dispatch.CopyTo(ptr.Receive());
+        dispatch.CopyTo(ptr.GetAddressOf());
       break;
     }
   }
@@ -294,7 +294,7 @@
   // IA2 Spec dictates that IServiceProvider should be used instead of
   // QueryInterface when retrieving IAccessible2.
   base::win::ScopedComPtr<IServiceProvider> service_provider;
-  HRESULT hr = accessible->QueryInterface(service_provider.Receive());
+  HRESULT hr = accessible->QueryInterface(service_provider.GetAddressOf());
   return SUCCEEDED(hr) ?
       service_provider->QueryService(IID_IAccessible2, accessible2) : hr;
 }
@@ -547,7 +547,7 @@
 void AccessibilityWinBrowserTest::AccessibleChecker::CheckIA2Role(
     IAccessible* accessible) {
   base::win::ScopedComPtr<IAccessible2> accessible2;
-  HRESULT hr = QueryIAccessible2(accessible, accessible2.Receive());
+  HRESULT hr = QueryIAccessible2(accessible, accessible2.GetAddressOf());
   ASSERT_EQ(S_OK, hr);
   long ia2_role = 0;
   hr = accessible2->role(&ia2_role);
@@ -889,10 +889,8 @@
   CHECK(hwnd);
   base::win::ScopedComPtr<IAccessible> browser_accessible;
   HRESULT hr = AccessibleObjectFromWindow(
-      hwnd,
-      OBJID_WINDOW,
-      IID_IAccessible,
-      reinterpret_cast<void**>(browser_accessible.Receive()));
+      hwnd, OBJID_WINDOW, IID_IAccessible,
+      reinterpret_cast<void**>(browser_accessible.GetAddressOf()));
   ASSERT_EQ(S_OK, hr);
 
   bool found = false;
@@ -914,17 +912,15 @@
   // Get the ISimpleDOM object for the document.
   base::win::ScopedComPtr<IServiceProvider> service_provider;
   HRESULT hr = static_cast<IAccessible*>(document_accessible.Get())
-                   ->QueryInterface(service_provider.Receive());
+                   ->QueryInterface(service_provider.GetAddressOf());
   ASSERT_EQ(S_OK, hr);
   const GUID refguid = {0x0c539790,
                         0x12e4,
                         0x11cf,
                         {0xb6, 0x61, 0x00, 0xaa, 0x00, 0x4c, 0xd6, 0xd8}};
   base::win::ScopedComPtr<ISimpleDOMNode> document_isimpledomnode;
-  hr = static_cast<IServiceProvider*>(service_provider.Get())
-           ->QueryService(
-               refguid, IID_ISimpleDOMNode,
-               reinterpret_cast<void**>(document_isimpledomnode.Receive()));
+  hr = service_provider->QueryService(refguid,
+                                      IID_PPV_ARGS(&document_isimpledomnode));
   ASSERT_EQ(S_OK, hr);
 
   base::win::ScopedBstr node_name;
@@ -944,7 +940,7 @@
 
   base::win::ScopedComPtr<ISimpleDOMNode> body_isimpledomnode;
   hr = document_isimpledomnode->get_firstChild(
-      body_isimpledomnode.Receive());
+      body_isimpledomnode.GetAddressOf());
   ASSERT_EQ(S_OK, hr);
   hr = body_isimpledomnode->get_nodeInfo(
       node_name.Receive(), &name_space_id, node_value.Receive(), &num_children,
@@ -958,7 +954,7 @@
 
   base::win::ScopedComPtr<ISimpleDOMNode> checkbox_isimpledomnode;
   hr = body_isimpledomnode->get_firstChild(
-      checkbox_isimpledomnode.Receive());
+      checkbox_isimpledomnode.GetAddressOf());
   ASSERT_EQ(S_OK, hr);
   hr = checkbox_isimpledomnode->get_nodeInfo(
       node_name.Receive(), &name_space_id, node_value.Receive(), &num_children,
@@ -1867,7 +1863,7 @@
   ASSERT_HRESULT_SUCCEEDED(QueryIAccessible2(
       GetAccessibleFromVariant(document.Get(), document_children[0].AsInput())
           .Get(),
-      div.Receive()));
+      div.GetAddressOf()));
   std::vector<base::win::ScopedVariant> div_children =
       GetAllAccessibleChildren(div.Get());
   ASSERT_EQ(1u, div_children.size());
@@ -1875,13 +1871,13 @@
   base::win::ScopedComPtr<IAccessible2> image;
   ASSERT_HRESULT_SUCCEEDED(QueryIAccessible2(
       GetAccessibleFromVariant(div.Get(), div_children[0].AsInput()).Get(),
-      image.Receive()));
+      image.GetAddressOf()));
   LONG image_role = 0;
   ASSERT_HRESULT_SUCCEEDED(image->role(&image_role));
   ASSERT_EQ(ROLE_SYSTEM_GRAPHIC, image_role);
 
   base::win::ScopedComPtr<IAccessibleAction> image_action;
-  ASSERT_HRESULT_SUCCEEDED(image.CopyTo(image_action.Receive()));
+  ASSERT_HRESULT_SUCCEEDED(image.CopyTo(image_action.GetAddressOf()));
 
   LONG n_actions = 0;
   EXPECT_HRESULT_SUCCEEDED(image_action->nActions(&n_actions));
@@ -1969,7 +1965,7 @@
   ASSERT_HRESULT_SUCCEEDED(QueryIAccessible2(
       GetAccessibleFromVariant(document.Get(), document_children[0].AsInput())
           .Get(),
-      table.Receive()));
+      table.GetAddressOf()));
   LONG role = 0;
   ASSERT_HRESULT_SUCCEEDED(table->role(&role));
   ASSERT_EQ(ROLE_SYSTEM_TABLE, role);
@@ -1978,9 +1974,9 @@
   base::win::ScopedComPtr<IAccessibleTable2> table2;
   base::win::ScopedComPtr<IUnknown> cell;
   base::win::ScopedComPtr<IAccessible2> cell1;
-  EXPECT_HRESULT_SUCCEEDED(table.CopyTo(table2.Receive()));
-  EXPECT_HRESULT_SUCCEEDED(table2->get_cellAt(0, 0, cell.Receive()));
-  EXPECT_HRESULT_SUCCEEDED(cell.CopyTo(cell1.Receive()));
+  EXPECT_HRESULT_SUCCEEDED(table.CopyTo(table2.GetAddressOf()));
+  EXPECT_HRESULT_SUCCEEDED(table2->get_cellAt(0, 0, cell.GetAddressOf()));
+  EXPECT_HRESULT_SUCCEEDED(cell.CopyTo(cell1.GetAddressOf()));
 
   base::win::ScopedBstr name;
   base::win::ScopedVariant childid_self(CHILDID_SELF);
@@ -1991,7 +1987,7 @@
   EXPECT_EQ(ROLE_SYSTEM_CELL, role);
   EXPECT_HRESULT_SUCCEEDED(cell1->get_accName(childid_self, name.Receive()));
   // EXPECT_STREQ(L"AD", name);
-  EXPECT_HRESULT_SUCCEEDED(cell1.CopyTo(accessible_cell.Receive()));
+  EXPECT_HRESULT_SUCCEEDED(cell1.CopyTo(accessible_cell.GetAddressOf()));
   EXPECT_HRESULT_SUCCEEDED(accessible_cell->get_rowIndex(&row_index));
   EXPECT_HRESULT_SUCCEEDED(accessible_cell->get_columnIndex(&column_index));
   EXPECT_EQ(0, row_index);
@@ -2012,12 +2008,12 @@
       cell1->accNavigate(NAVDIR_RIGHT, childid_self, variant.Receive()));
   ASSERT_NE(nullptr, V_DISPATCH(variant.AsInput()));
   ASSERT_EQ(VT_DISPATCH, variant.type());
-  V_DISPATCH(variant.AsInput())->QueryInterface(cell2.Receive());
+  V_DISPATCH(variant.AsInput())->QueryInterface(cell2.GetAddressOf());
   EXPECT_HRESULT_SUCCEEDED(cell2->role(&role));
   EXPECT_EQ(ROLE_SYSTEM_CELL, role);
   EXPECT_HRESULT_SUCCEEDED(cell2->get_accName(childid_self, name.Receive()));
   // EXPECT_STREQ(L"BC", name);
-  EXPECT_HRESULT_SUCCEEDED(cell2.CopyTo(accessible_cell.Receive()));
+  EXPECT_HRESULT_SUCCEEDED(cell2.CopyTo(accessible_cell.GetAddressOf()));
   EXPECT_HRESULT_SUCCEEDED(accessible_cell->get_rowIndex(&row_index));
   EXPECT_HRESULT_SUCCEEDED(accessible_cell->get_columnIndex(&column_index));
   EXPECT_EQ(0, row_index);
@@ -2032,12 +2028,12 @@
       cell2->accNavigate(NAVDIR_DOWN, childid_self, variant.Receive()));
   ASSERT_NE(nullptr, V_DISPATCH(variant.AsInput()));
   ASSERT_EQ(VT_DISPATCH, variant.type());
-  V_DISPATCH(variant.AsInput())->QueryInterface(cell3.Receive());
+  V_DISPATCH(variant.AsInput())->QueryInterface(cell3.GetAddressOf());
   EXPECT_HRESULT_SUCCEEDED(cell3->role(&role));
   EXPECT_EQ(ROLE_SYSTEM_CELL, role);
   EXPECT_HRESULT_SUCCEEDED(cell3->get_accName(childid_self, name.Receive()));
   // EXPECT_STREQ(L"EF", name);
-  EXPECT_HRESULT_SUCCEEDED(cell3.CopyTo(accessible_cell.Receive()));
+  EXPECT_HRESULT_SUCCEEDED(cell3.CopyTo(accessible_cell.GetAddressOf()));
   EXPECT_HRESULT_SUCCEEDED(accessible_cell->get_rowIndex(&row_index));
   EXPECT_HRESULT_SUCCEEDED(accessible_cell->get_columnIndex(&column_index));
   EXPECT_EQ(1, row_index);
diff --git a/content/browser/accessibility/browser_accessibility_win_unittest.cc b/content/browser/accessibility/browser_accessibility_win_unittest.cc
index 96a48706..f2bede0 100644
--- a/content/browser/accessibility/browser_accessibility_win_unittest.cc
+++ b/content/browser/accessibility/browser_accessibility_win_unittest.cc
@@ -4,6 +4,7 @@
 
 #include "content/browser/accessibility/browser_accessibility_win.h"
 
+#include <objbase.h>
 #include <stdint.h>
 
 #include <memory>
@@ -142,11 +143,11 @@
   base::win::ScopedComPtr<IDispatch> text_dispatch;
   HRESULT hr = ToBrowserAccessibilityWin(manager->GetRoot())
                    ->GetCOM()
-                   ->get_accChild(one, text_dispatch.Receive());
+                   ->get_accChild(one, text_dispatch.GetAddressOf());
   ASSERT_EQ(S_OK, hr);
 
   base::win::ScopedComPtr<IAccessible> text_accessible;
-  hr = text_dispatch.CopyTo(text_accessible.Receive());
+  hr = text_dispatch.CopyTo(text_accessible.GetAddressOf());
   ASSERT_EQ(S_OK, hr);
 
   base::win::ScopedVariant childid_self(CHILDID_SELF);
@@ -176,10 +177,10 @@
   // as its value.
   hr = ToBrowserAccessibilityWin(manager->GetRoot())
            ->GetCOM()
-           ->get_accChild(one, text_dispatch.Receive());
+           ->get_accChild(one, text_dispatch.GetAddressOf());
   ASSERT_EQ(S_OK, hr);
 
-  hr = text_dispatch.CopyTo(text_accessible.Receive());
+  hr = text_dispatch.CopyTo(text_accessible.GetAddressOf());
   ASSERT_EQ(S_OK, hr);
 
   hr = text_accessible->get_accName(childid_self, name.Receive());
@@ -449,12 +450,13 @@
   EXPECT_EQ(0, hyperlink_count);
 
   base::win::ScopedComPtr<IAccessibleHyperlink> hyperlink;
-  EXPECT_EQ(E_INVALIDARG, root_obj->get_hyperlink(-1, hyperlink.Receive()));
-  EXPECT_EQ(E_INVALIDARG, root_obj->get_hyperlink(0, hyperlink.Receive()));
   EXPECT_EQ(E_INVALIDARG,
-            root_obj->get_hyperlink(text_name_len, hyperlink.Receive()));
+            root_obj->get_hyperlink(-1, hyperlink.GetAddressOf()));
+  EXPECT_EQ(E_INVALIDARG, root_obj->get_hyperlink(0, hyperlink.GetAddressOf()));
   EXPECT_EQ(E_INVALIDARG,
-            root_obj->get_hyperlink(text_name_len + 1, hyperlink.Receive()));
+            root_obj->get_hyperlink(text_name_len, hyperlink.GetAddressOf()));
+  EXPECT_EQ(E_INVALIDARG, root_obj->get_hyperlink(text_name_len + 1,
+                                                  hyperlink.GetAddressOf()));
 
   long hyperlink_index;
   EXPECT_EQ(S_FALSE, root_obj->get_hyperlinkIndex(0, &hyperlink_index));
@@ -570,13 +572,14 @@
 
   base::win::ScopedComPtr<IAccessibleHyperlink> hyperlink;
   base::win::ScopedComPtr<IAccessibleText> hypertext;
-  EXPECT_EQ(E_INVALIDARG, root_obj->get_hyperlink(-1, hyperlink.Receive()));
-  EXPECT_EQ(E_INVALIDARG, root_obj->get_hyperlink(4, hyperlink.Receive()));
+  EXPECT_EQ(E_INVALIDARG,
+            root_obj->get_hyperlink(-1, hyperlink.GetAddressOf()));
+  EXPECT_EQ(E_INVALIDARG, root_obj->get_hyperlink(4, hyperlink.GetAddressOf()));
 
   // Get the text of the combo box.
   // It should be its value.
-  EXPECT_EQ(S_OK, root_obj->get_hyperlink(0, hyperlink.Receive()));
-  EXPECT_EQ(S_OK, hyperlink.CopyTo(hypertext.Receive()));
+  EXPECT_EQ(S_OK, root_obj->get_hyperlink(0, hyperlink.GetAddressOf()));
+  EXPECT_EQ(S_OK, hyperlink.CopyTo(hypertext.GetAddressOf()));
   EXPECT_EQ(S_OK,
             hypertext->get_text(0, IA2_TEXT_OFFSET_LENGTH, text.Receive()));
   EXPECT_STREQ(combo_box_value.c_str(), text);
@@ -586,8 +589,8 @@
 
   // Get the text of the check box.
   // It should be its name.
-  EXPECT_EQ(S_OK, root_obj->get_hyperlink(1, hyperlink.Receive()));
-  EXPECT_EQ(S_OK, hyperlink.CopyTo(hypertext.Receive()));
+  EXPECT_EQ(S_OK, root_obj->get_hyperlink(1, hyperlink.GetAddressOf()));
+  EXPECT_EQ(S_OK, hyperlink.CopyTo(hypertext.GetAddressOf()));
   EXPECT_EQ(S_OK,
             hypertext->get_text(0, IA2_TEXT_OFFSET_LENGTH, text.Receive()));
   EXPECT_STREQ(check_box_name.c_str(), text);
@@ -596,8 +599,8 @@
   hypertext.Reset();
 
   // Get the text of the button.
-  EXPECT_EQ(S_OK, root_obj->get_hyperlink(2, hyperlink.Receive()));
-  EXPECT_EQ(S_OK, hyperlink.CopyTo(hypertext.Receive()));
+  EXPECT_EQ(S_OK, root_obj->get_hyperlink(2, hyperlink.GetAddressOf()));
+  EXPECT_EQ(S_OK, hyperlink.CopyTo(hypertext.GetAddressOf()));
   EXPECT_EQ(S_OK,
             hypertext->get_text(0, IA2_TEXT_OFFSET_LENGTH, text.Receive()));
   EXPECT_STREQ(button_text_name.c_str(), text);
@@ -606,8 +609,8 @@
   hypertext.Reset();
 
   // Get the text of the link.
-  EXPECT_EQ(S_OK, root_obj->get_hyperlink(3, hyperlink.Receive()));
-  EXPECT_EQ(S_OK, hyperlink.CopyTo(hypertext.Receive()));
+  EXPECT_EQ(S_OK, root_obj->get_hyperlink(3, hyperlink.GetAddressOf()));
+  EXPECT_EQ(S_OK, hyperlink.CopyTo(hypertext.GetAddressOf()));
   EXPECT_EQ(S_OK, hypertext->get_text(0, 4, text.Receive()));
   EXPECT_STREQ(link_text_name.c_str(), text);
   text.Reset();
@@ -1052,11 +1055,11 @@
   base::win::ScopedComPtr<IAccessibleText> textarea_object;
   EXPECT_HRESULT_SUCCEEDED(textarea_accessible->GetCOM()->QueryInterface(
       IID_IAccessibleText,
-      reinterpret_cast<void**>(textarea_object.Receive())));
+      reinterpret_cast<void**>(textarea_object.GetAddressOf())));
   base::win::ScopedComPtr<IAccessibleText> text_field_object;
   EXPECT_HRESULT_SUCCEEDED(text_field_accessible->GetCOM()->QueryInterface(
       IID_IAccessibleText,
-      reinterpret_cast<void**>(text_field_object.Receive())));
+      reinterpret_cast<void**>(text_field_object.GetAddressOf())));
 
   LONG offset = 0;
   while (offset < static_cast<LONG>(text.length())) {
@@ -1540,17 +1543,17 @@
   div_hypertext.push_back(BrowserAccessibilityComWin::kEmbeddedCharacter);
 
   // div_accessible and link_accessible are the only IA2 hyperlinks.
-  EXPECT_HRESULT_FAILED(root_accessible->GetCOM()->QueryInterface(
-      IID_IAccessibleHyperlink, reinterpret_cast<void**>(hyperlink.Receive())));
+  EXPECT_HRESULT_FAILED(
+      root_accessible->GetCOM()->QueryInterface(IID_PPV_ARGS(&hyperlink)));
   hyperlink.Reset();
-  EXPECT_HRESULT_SUCCEEDED(div_accessible->GetCOM()->QueryInterface(
-      IID_IAccessibleHyperlink, reinterpret_cast<void**>(hyperlink.Receive())));
+  EXPECT_HRESULT_SUCCEEDED(
+      div_accessible->GetCOM()->QueryInterface(IID_PPV_ARGS(&hyperlink)));
   hyperlink.Reset();
-  EXPECT_HRESULT_FAILED(text_accessible->GetCOM()->QueryInterface(
-      IID_IAccessibleHyperlink, reinterpret_cast<void**>(hyperlink.Receive())));
+  EXPECT_HRESULT_FAILED(
+      text_accessible->GetCOM()->QueryInterface(IID_PPV_ARGS(&hyperlink)));
   hyperlink.Reset();
-  EXPECT_HRESULT_SUCCEEDED(link_accessible->GetCOM()->QueryInterface(
-      IID_IAccessibleHyperlink, reinterpret_cast<void**>(hyperlink.Receive())));
+  EXPECT_HRESULT_SUCCEEDED(
+      link_accessible->GetCOM()->QueryInterface(IID_PPV_ARGS(&hyperlink)));
   hyperlink.Reset();
 
   EXPECT_HRESULT_SUCCEEDED(root_accessible->GetCOM()->nActions(&n_actions));
@@ -2220,26 +2223,26 @@
   base::win::ScopedVariant old_root_variant(-root_unique_id);
   base::win::ScopedComPtr<IDispatch> old_root_dispatch;
   HRESULT hr = ToBrowserAccessibilityWin(root)->GetCOM()->get_accChild(
-      old_root_variant, old_root_dispatch.Receive());
+      old_root_variant, old_root_dispatch.GetAddressOf());
   EXPECT_EQ(E_INVALIDARG, hr);
 
   base::win::ScopedVariant old_child_variant(-child_unique_id);
   base::win::ScopedComPtr<IDispatch> old_child_dispatch;
   hr = ToBrowserAccessibilityWin(root)->GetCOM()->get_accChild(
-      old_child_variant, old_child_dispatch.Receive());
+      old_child_variant, old_child_dispatch.GetAddressOf());
   EXPECT_EQ(E_INVALIDARG, hr);
 
   // Trying to access the unique IDs of the new objects should succeed.
   base::win::ScopedVariant new_root_variant(-root_unique_id_2);
   base::win::ScopedComPtr<IDispatch> new_root_dispatch;
   hr = ToBrowserAccessibilityWin(root)->GetCOM()->get_accChild(
-      new_root_variant, new_root_dispatch.Receive());
+      new_root_variant, new_root_dispatch.GetAddressOf());
   EXPECT_EQ(S_OK, hr);
 
   base::win::ScopedVariant new_child_variant(-child_unique_id_2);
   base::win::ScopedComPtr<IDispatch> new_child_dispatch;
   hr = ToBrowserAccessibilityWin(root)->GetCOM()->get_accChild(
-      new_child_variant, new_child_dispatch.Receive());
+      new_child_variant, new_child_dispatch.GetAddressOf());
   EXPECT_EQ(S_OK, hr);
 }
 
@@ -2264,11 +2267,11 @@
   base::win::ScopedComPtr<IDispatch> result;
   EXPECT_EQ(E_INVALIDARG,
             ToBrowserAccessibilityWin(child)->GetCOM()->get_accChild(
-                root_unique_id_variant, result.Receive()));
+                root_unique_id_variant, result.GetAddressOf()));
 
   base::win::ScopedVariant child_unique_id_variant(-child->unique_id());
   EXPECT_EQ(S_OK, ToBrowserAccessibilityWin(root)->GetCOM()->get_accChild(
-                      child_unique_id_variant, result.Receive()));
+                      child_unique_id_variant, result.GetAddressOf()));
 }
 
 TEST_F(BrowserAccessibilityTest, TestIAccessible2Relations) {
@@ -2317,7 +2320,7 @@
   EXPECT_EQ(1, n_relations);
 
   EXPECT_HRESULT_SUCCEEDED(
-      ax_root->GetCOM()->get_relation(0, describedby_relation.Receive()));
+      ax_root->GetCOM()->get_relation(0, describedby_relation.GetAddressOf()));
   EXPECT_HRESULT_SUCCEEDED(
       describedby_relation->get_relationType(relation_type.Receive()));
   EXPECT_EQ(L"describedBy", base::string16(relation_type));
@@ -2327,16 +2330,16 @@
   EXPECT_EQ(2, n_targets);
 
   EXPECT_HRESULT_SUCCEEDED(
-      describedby_relation->get_target(0, target.Receive()));
-  target.CopyTo(ax_target.Receive());
+      describedby_relation->get_target(0, target.GetAddressOf()));
+  target.CopyTo(ax_target.GetAddressOf());
   EXPECT_HRESULT_SUCCEEDED(ax_target->get_uniqueID(&unique_id));
   EXPECT_EQ(-ax_child1->unique_id(), unique_id);
   ax_target.Reset();
   target.Reset();
 
   EXPECT_HRESULT_SUCCEEDED(
-      describedby_relation->get_target(1, target.Receive()));
-  target.CopyTo(ax_target.Receive());
+      describedby_relation->get_target(1, target.GetAddressOf()));
+  target.CopyTo(ax_target.GetAddressOf());
   EXPECT_HRESULT_SUCCEEDED(ax_target->get_uniqueID(&unique_id));
   EXPECT_EQ(-ax_child2->unique_id(), unique_id);
   ax_target.Reset();
@@ -2347,8 +2350,8 @@
   EXPECT_HRESULT_SUCCEEDED(ax_child1->GetCOM()->get_nRelations(&n_relations));
   EXPECT_EQ(1, n_relations);
 
-  EXPECT_HRESULT_SUCCEEDED(
-      ax_child1->GetCOM()->get_relation(0, description_for_relation.Receive()));
+  EXPECT_HRESULT_SUCCEEDED(ax_child1->GetCOM()->get_relation(
+      0, description_for_relation.GetAddressOf()));
   EXPECT_HRESULT_SUCCEEDED(
       description_for_relation->get_relationType(relation_type.Receive()));
   EXPECT_EQ(L"descriptionFor", base::string16(relation_type));
@@ -2358,8 +2361,8 @@
   EXPECT_EQ(1, n_targets);
 
   EXPECT_HRESULT_SUCCEEDED(
-      description_for_relation->get_target(0, target.Receive()));
-  target.CopyTo(ax_target.Receive());
+      description_for_relation->get_target(0, target.GetAddressOf()));
+  target.CopyTo(ax_target.GetAddressOf());
   EXPECT_HRESULT_SUCCEEDED(ax_target->get_uniqueID(&unique_id));
   EXPECT_EQ(-ax_root->unique_id(), unique_id);
   ax_target.Reset();
@@ -2369,8 +2372,8 @@
   EXPECT_HRESULT_SUCCEEDED(ax_child2->GetCOM()->get_nRelations(&n_relations));
   EXPECT_EQ(1, n_relations);
 
-  EXPECT_HRESULT_SUCCEEDED(
-      ax_child2->GetCOM()->get_relation(0, description_for_relation.Receive()));
+  EXPECT_HRESULT_SUCCEEDED(ax_child2->GetCOM()->get_relation(
+      0, description_for_relation.GetAddressOf()));
   EXPECT_HRESULT_SUCCEEDED(
       description_for_relation->get_relationType(relation_type.Receive()));
   EXPECT_EQ(L"descriptionFor", base::string16(relation_type));
@@ -2380,8 +2383,8 @@
   EXPECT_EQ(1, n_targets);
 
   EXPECT_HRESULT_SUCCEEDED(
-      description_for_relation->get_target(0, target.Receive()));
-  target.CopyTo(ax_target.Receive());
+      description_for_relation->get_target(0, target.GetAddressOf()));
+  target.CopyTo(ax_target.GetAddressOf());
   EXPECT_HRESULT_SUCCEEDED(ax_target->get_uniqueID(&unique_id));
   EXPECT_EQ(-ax_root->unique_id(), unique_id);
   ax_target.Reset();
diff --git a/content/browser/download/download_file_impl.cc b/content/browser/download/download_file_impl.cc
index 13ce1604..edde01e 100644
--- a/content/browser/download/download_file_impl.cc
+++ b/content/browser/download/download_file_impl.cc
@@ -441,9 +441,19 @@
         break;
       case ByteStreamReader::STREAM_COMPLETE:
         {
-          reason = static_cast<DownloadInterruptReason>(
+        reason = static_cast<DownloadInterruptReason>(
             source_stream->stream_reader()->GetStatus());
-          SendUpdate();
+        if (source_stream->length() == DownloadSaveInfo::kLengthFullContent &&
+            !received_slices_.empty() &&
+            (source_stream->offset() == received_slices_.back().offset +
+                received_slices_.back().received_bytes) &&
+            reason == DownloadInterruptReason::
+                          DOWNLOAD_INTERRUPT_REASON_SERVER_NO_RANGE) {
+          // We are probably reaching the end of the stream, don't treat this
+          // as an error.
+          reason = DOWNLOAD_INTERRUPT_REASON_NONE;
+        }
+        SendUpdate();
         }
         break;
       default:
diff --git a/content/browser/download/download_job.cc b/content/browser/download/download_job.cc
index cd7f619..b7f5dfc5 100644
--- a/content/browser/download/download_job.cc
+++ b/content/browser/download/download_job.cc
@@ -28,11 +28,6 @@
   download_item_->StartDownload();
 }
 
-void DownloadJob::Interrupt(DownloadInterruptReason reason) {
-  download_item_->InterruptAndDiscardPartialState(reason);
-  download_item_->UpdateObservers();
-}
-
 bool DownloadJob::AddByteStream(std::unique_ptr<ByteStreamReader> stream_reader,
                                 int64_t offset,
                                 int64_t length) {
@@ -51,17 +46,6 @@
   return true;
 }
 
-void DownloadJob::SetPotentialFileLength(int64_t length) {
-  DCHECK_CURRENTLY_ON(BrowserThread::UI);
-  DownloadFile* download_file = download_item_->download_file_.get();
-  if (download_file) {
-    BrowserThread::PostTask(
-        BrowserThread::FILE, FROM_HERE,
-        base::Bind(&DownloadFile::SetPotentialFileLength,
-                   base::Unretained(download_file), length));
-  }
-}
-
 void DownloadJob::CancelRequestWithOffset(int64_t offset) {
   NOTREACHED();
 }
diff --git a/content/browser/download/download_job.h b/content/browser/download/download_job.h
index cae4f1ab..cef1c47 100644
--- a/content/browser/download/download_job.h
+++ b/content/browser/download/download_job.h
@@ -51,7 +51,6 @@
 
  protected:
   void StartDownload() const;
-  void Interrupt(DownloadInterruptReason reason);
 
   // Add a byte stream to the download sink. Return false if we start to
   // destroy download file.
@@ -59,9 +58,6 @@
                      int64_t offset,
                      int64_t length);
 
-  // Sets the potential length of the file.
-  void SetPotentialFileLength(int64_t length);
-
   DownloadItemImpl* download_item_;
 
  private:
diff --git a/content/browser/download/download_stats.cc b/content/browser/download/download_stats.cc
index 80be40f4e..ed241731 100644
--- a/content/browser/download/download_stats.cc
+++ b/content/browser/download/download_stats.cc
@@ -817,21 +817,21 @@
   if (!uses_parallel_requests)
     return;
 
+  base::TimeDelta time_saved;
   if (bytes_downloaded_with_parallel_streams > 0) {
     RecordBandwidthMetric(
         "Download.ParallelizableDownloadBandwidth."
         "WithParallelRequestsMultipleStreams",
         CalculateBandwidthBytesPerSecond(bytes_downloaded_with_parallel_streams,
                                          time_with_parallel_streams));
+    if (bandwidth_without_parallel_streams > 0) {
+      time_saved = base::TimeDelta::FromMilliseconds(
+                       1000.0 * bytes_downloaded_with_parallel_streams /
+                       bandwidth_without_parallel_streams) -
+                   time_with_parallel_streams;
+    }
   }
 
-  base::TimeDelta time_saved;
-  if (bandwidth_without_parallel_streams > 0) {
-    time_saved = base::TimeDelta::FromMilliseconds(
-                     1000.0 * bytes_downloaded_with_parallel_streams /
-                     bandwidth_without_parallel_streams) -
-                 time_with_parallel_streams;
-  }
   int kMillisecondsPerHour =
       base::checked_cast<int>(base::Time::kMillisecondsPerSecond * 60 * 60);
   if (time_saved >= base::TimeDelta()) {
diff --git a/content/browser/download/download_worker.cc b/content/browser/download/download_worker.cc
index 6e330a2..5eff1cf 100644
--- a/content/browser/download/download_worker.cc
+++ b/content/browser/download/download_worker.cc
@@ -13,6 +13,23 @@
 
 const int kVerboseLevel = 1;
 
+class CompletedByteStreamReader : public ByteStreamReader {
+ public:
+  CompletedByteStreamReader(int status) : status_(status) {};
+  ~CompletedByteStreamReader() override = default;
+
+  // ByteStreamReader implementations:
+  ByteStreamReader::StreamState Read(scoped_refptr<net::IOBuffer>* data,
+                                     size_t* length) override {
+    return ByteStreamReader::STREAM_COMPLETE;
+  }
+  int GetStatus() const override { return status_; }
+  void RegisterCallback(const base::Closure& sink_callback) override {};
+
+ private:
+  int status_;
+};
+
 std::unique_ptr<UrlDownloader, BrowserThread::DeleteOnIOThread>
 CreateUrlDownloader(std::unique_ptr<DownloadUrlParameters> params,
                     base::WeakPtr<UrlDownloader::Delegate> delegate) {
@@ -94,9 +111,7 @@
       DownloadInterruptReason::DOWNLOAD_INTERRUPT_REASON_NONE) {
     VLOG(kVerboseLevel) << "Parallel download sub-request failed. reason = "
                         << create_info->result;
-
-    delegate_->OnServerResponseError(this, create_info->result);
-    return;
+    stream_reader.reset(new CompletedByteStreamReader(create_info->result));
   }
 
   request_handle_ = std::move(create_info->request_handle);
diff --git a/content/browser/download/download_worker.h b/content/browser/download/download_worker.h
index 45b85b5..ecfb182 100644
--- a/content/browser/download/download_worker.h
+++ b/content/browser/download/download_worker.h
@@ -32,9 +32,6 @@
     virtual void OnByteStreamReady(
         DownloadWorker* worker,
         std::unique_ptr<ByteStreamReader> stream_reader) = 0;
-    // Called when there is an error caused by the server response.
-    virtual void OnServerResponseError(DownloadWorker* worker,
-                                       DownloadInterruptReason reason) = 0;
   };
 
   DownloadWorker(DownloadWorker::Delegate* delegate,
diff --git a/content/browser/download/parallel_download_job.cc b/content/browser/download/parallel_download_job.cc
index 5f282c3..e83df49 100644
--- a/content/browser/download/parallel_download_job.cc
+++ b/content/browser/download/parallel_download_job.cc
@@ -128,21 +128,6 @@
   }
 }
 
-void ParallelDownloadJob::OnServerResponseError(
-    DownloadWorker* worker,
-    DownloadInterruptReason reason) {
-  // TODO(xingliu): Consider to let the original request to cover the full
-  // content if the sub-requests get invalid response. Consider retry on certain
-  // error.
-  if (worker->length() == DownloadSaveInfo::kLengthFullContent &&
-      reason ==
-          DownloadInterruptReason::DOWNLOAD_INTERRUPT_REASON_SERVER_NO_RANGE) {
-    SetPotentialFileLength(worker->offset());
-    return;
-  }
-  DownloadJob::Interrupt(reason);
-}
-
 void ParallelDownloadJob::BuildParallelRequests() {
   DCHECK(!requests_sent_);
   DCHECK(!is_paused());
diff --git a/content/browser/download/parallel_download_job.h b/content/browser/download/parallel_download_job.h
index eb1f9dbc..907bd5d 100644
--- a/content/browser/download/parallel_download_job.h
+++ b/content/browser/download/parallel_download_job.h
@@ -56,8 +56,6 @@
   void OnByteStreamReady(
       DownloadWorker* worker,
       std::unique_ptr<ByteStreamReader> stream_reader) override;
-  void OnServerResponseError(DownloadWorker* worker,
-                             DownloadInterruptReason reason) override;
 
   // Build parallel requests after a delay, to effectively measure the single
   // stream bandwidth.
diff --git a/content/browser/net/view_http_cache_job_factory.cc b/content/browser/net/view_http_cache_job_factory.cc
index ca64341e..179c55be 100644
--- a/content/browser/net/view_http_cache_job_factory.cc
+++ b/content/browser/net/view_http_cache_job_factory.cc
@@ -57,8 +57,7 @@
    public:
     Core()
         : data_offset_(0),
-          callback_(base::Bind(&Core::OnIOComplete, this)) {
-    }
+          callback_(base::Bind(&Core::OnIOComplete, base::Unretained(this))) {}
 
     int Start(const net::URLRequest& request, const base::Closure& callback);
 
diff --git a/content/browser/permissions/permission_service_context.cc b/content/browser/permissions/permission_service_context.cc
index 7f0a370..6cc2396 100644
--- a/content/browser/permissions/permission_service_context.cc
+++ b/content/browser/permissions/permission_service_context.cc
@@ -74,8 +74,8 @@
 void PermissionServiceContext::CreateService(
     const service_manager::BindSourceInfo& source_info,
     blink::mojom::PermissionServiceRequest request) {
-  services_.push_back(
-      base::MakeUnique<PermissionServiceImpl>(this, std::move(request)));
+  services_.AddBinding(base::MakeUnique<PermissionServiceImpl>(this),
+                       std::move(request));
 }
 
 void PermissionServiceContext::CreateSubscription(
@@ -102,17 +102,6 @@
   subscriptions_[subscription_id] = std::move(subscription);
 }
 
-void PermissionServiceContext::ServiceHadConnectionError(
-    PermissionServiceImpl* service) {
-  auto it = std::find_if(
-      services_.begin(), services_.end(),
-      [service](const std::unique_ptr<PermissionServiceImpl>& this_service) {
-        return service == this_service.get();
-      });
-  DCHECK(it != services_.end());
-  services_.erase(it);
-}
-
 void PermissionServiceContext::ObserverHadConnectionError(int subscription_id) {
   auto it = subscriptions_.find(subscription_id);
   DCHECK(it != subscriptions_.end());
@@ -122,12 +111,12 @@
 void PermissionServiceContext::RenderFrameHostChanged(
     RenderFrameHost* old_host,
     RenderFrameHost* new_host) {
-  CancelPendingOperations(old_host);
+  CloseBindings(old_host);
 }
 
 void PermissionServiceContext::FrameDeleted(
     RenderFrameHost* render_frame_host) {
-  CancelPendingOperations(render_frame_host);
+  CloseBindings(render_frame_host);
 }
 
 void PermissionServiceContext::DidFinishNavigation(
@@ -135,18 +124,16 @@
   if (!navigation_handle->HasCommitted() || navigation_handle->IsSameDocument())
     return;
 
-  CancelPendingOperations(navigation_handle->GetRenderFrameHost());
+  CloseBindings(navigation_handle->GetRenderFrameHost());
 }
 
-void PermissionServiceContext::CancelPendingOperations(
+void PermissionServiceContext::CloseBindings(
     RenderFrameHost* render_frame_host) {
   DCHECK(render_frame_host_);
   if (render_frame_host != render_frame_host_)
     return;
 
-  for (const auto& service : services_)
-    service->CancelPendingOperations();
-
+  services_.CloseAllBindings();
   subscriptions_.clear();
 }
 
diff --git a/content/browser/permissions/permission_service_context.h b/content/browser/permissions/permission_service_context.h
index 87b7592..347808e 100644
--- a/content/browser/permissions/permission_service_context.h
+++ b/content/browser/permissions/permission_service_context.h
@@ -8,7 +8,7 @@
 #include "base/macros.h"
 #include "content/public/browser/permission_type.h"
 #include "content/public/browser/web_contents_observer.h"
-#include "mojo/public/cpp/bindings/interface_request.h"
+#include "mojo/public/cpp/bindings/strong_binding_set.h"
 #include "third_party/WebKit/public/platform/modules/permissions/permission.mojom.h"
 
 namespace service_manager {
@@ -21,7 +21,6 @@
 
 namespace content {
 
-class PermissionServiceImpl;
 class RenderFrameHost;
 class RenderProcessHost;
 
@@ -39,14 +38,9 @@
   void CreateService(const service_manager::BindSourceInfo& source_info,
                      blink::mojom::PermissionServiceRequest request);
 
-  void CreateSubscription(
-      PermissionType permission_type,
-      const url::Origin& origin,
-      mojo::InterfacePtr<blink::mojom::PermissionObserver> observer);
-
-  // Called by a PermissionServiceImpl identified as |service| when it has a
-  // connection error in order to get unregistered and killed.
-  void ServiceHadConnectionError(PermissionServiceImpl* service);
+  void CreateSubscription(PermissionType permission_type,
+                          const url::Origin& origin,
+                          blink::mojom::PermissionObserverPtr observer);
 
   // Called when the connection to a PermissionObserver has an error.
   void ObserverHadConnectionError(int subscription_id);
@@ -65,11 +59,11 @@
   void FrameDeleted(RenderFrameHost* render_frame_host) override;
   void DidFinishNavigation(NavigationHandle* navigation_handle) override;
 
-  void CancelPendingOperations(RenderFrameHost*);
+  void CloseBindings(RenderFrameHost*);
 
   RenderFrameHost* render_frame_host_;
   RenderProcessHost* render_process_host_;
-  std::vector<std::unique_ptr<PermissionServiceImpl>> services_;
+  mojo::StrongBindingSet<blink::mojom::PermissionService> services_;
   std::unordered_map<int, std::unique_ptr<PermissionSubscription>>
       subscriptions_;
 
diff --git a/content/browser/permissions/permission_service_impl.cc b/content/browser/permissions/permission_service_impl.cc
index 90767d0..50f13c5 100644
--- a/content/browser/permissions/permission_service_impl.cc
+++ b/content/browser/permissions/permission_service_impl.cc
@@ -82,25 +82,23 @@
   callback.Run(result);
 }
 
-PermissionServiceImpl::PermissionServiceImpl(
-    PermissionServiceContext* context,
-    mojo::InterfaceRequest<blink::mojom::PermissionService> request)
-    : context_(context),
-      binding_(this, std::move(request)),
-      weak_factory_(this) {
-  binding_.set_connection_error_handler(
-      base::Bind(&PermissionServiceImpl::OnConnectionError,
-                 base::Unretained(this)));
-}
+PermissionServiceImpl::PermissionServiceImpl(PermissionServiceContext* context)
+    : context_(context), weak_factory_(this) {}
 
 PermissionServiceImpl::~PermissionServiceImpl() {
-  DCHECK(pending_requests_.IsEmpty());
-}
+  DCHECK(context_->GetBrowserContext());
 
-void PermissionServiceImpl::OnConnectionError() {
-  CancelPendingOperations();
-  context_->ServiceHadConnectionError(this);
-  // After that call, |this| will be deleted.
+  PermissionManager* permission_manager =
+      context_->GetBrowserContext()->GetPermissionManager();
+  if (!permission_manager)
+    return;
+
+  // Cancel pending requests.
+  for (RequestsMap::Iterator<PendingRequest> it(&pending_requests_);
+       !it.IsAtEnd(); it.Advance()) {
+    permission_manager->CancelPermissionRequest(it.GetCurrentValue()->id);
+  }
+  pending_requests_.Clear();
 }
 
 void PermissionServiceImpl::RequestPermission(
@@ -201,23 +199,6 @@
   callback.Run(result);
 }
 
-void PermissionServiceImpl::CancelPendingOperations() {
-  DCHECK(context_->GetBrowserContext());
-
-  PermissionManager* permission_manager =
-      context_->GetBrowserContext()->GetPermissionManager();
-  if (!permission_manager)
-    return;
-
-  // Cancel pending requests.
-  for (RequestsMap::Iterator<PendingRequest> it(&pending_requests_);
-       !it.IsAtEnd(); it.Advance()) {
-    permission_manager->CancelPermissionRequest(
-        it.GetCurrentValue()->id);
-  }
-  pending_requests_.Clear();
-}
-
 void PermissionServiceImpl::HasPermission(
     PermissionDescriptorPtr permission,
     const url::Origin& origin,
diff --git a/content/browser/permissions/permission_service_impl.h b/content/browser/permissions/permission_service_impl.h
index 7617697a..cfce915 100644
--- a/content/browser/permissions/permission_service_impl.h
+++ b/content/browser/permissions/permission_service_impl.h
@@ -10,7 +10,6 @@
 #include "base/macros.h"
 #include "base/memory/weak_ptr.h"
 #include "content/browser/permissions/permission_service_context.h"
-#include "mojo/public/cpp/bindings/binding.h"
 #include "third_party/WebKit/public/platform/modules/permissions/permission.mojom.h"
 #include "url/origin.h"
 
@@ -27,16 +26,9 @@
 // WebContents for example.
 class PermissionServiceImpl : public blink::mojom::PermissionService {
  public:
-  PermissionServiceImpl(
-      PermissionServiceContext* context,
-      mojo::InterfaceRequest<blink::mojom::PermissionService> request);
+  PermissionServiceImpl(PermissionServiceContext* context);
   ~PermissionServiceImpl() override;
 
-  // Clear pending operations currently run by the service. This will be called
-  // by PermissionServiceContext when it will need the service to clear its
-  // state for example, if the frame changes.
-  void CancelPendingOperations();
-
  private:
   using PermissionStatusCallback =
       base::Callback<void(blink::mojom::PermissionStatus)>;
@@ -75,8 +67,6 @@
       blink::mojom::PermissionStatus last_known_status,
       blink::mojom::PermissionObserverPtr observer) override;
 
-  void OnConnectionError();
-
   void OnRequestPermissionResponse(int pending_request_id,
                                    blink::mojom::PermissionStatus status);
   void OnRequestPermissionsResponse(
@@ -94,7 +84,6 @@
   RequestsMap pending_requests_;
   // context_ owns |this|.
   PermissionServiceContext* context_;
-  mojo::Binding<blink::mojom::PermissionService> binding_;
   base::WeakPtrFactory<PermissionServiceImpl> weak_factory_;
 
   DISALLOW_COPY_AND_ASSIGN(PermissionServiceImpl);
diff --git a/content/browser/renderer_host/legacy_render_widget_host_win.cc b/content/browser/renderer_host/legacy_render_widget_host_win.cc
index 7d9c181aa..c0eff5b 100644
--- a/content/browser/renderer_host/legacy_render_widget_host_win.cc
+++ b/content/browser/renderer_host/legacy_render_widget_host_win.cc
@@ -4,6 +4,8 @@
 
 #include "content/browser/renderer_host/legacy_render_widget_host_win.h"
 
+#include <objbase.h>
+
 #include <memory>
 
 #include "base/command_line.h"
@@ -114,9 +116,8 @@
   if (base::win::GetVersion() >= base::win::VERSION_WIN7)
     RegisterTouchWindow(hwnd(), TWF_WANTPALM);
 
-  HRESULT hr = ::CreateStdAccessibleObject(
-      hwnd(), OBJID_WINDOW, IID_IAccessible,
-      reinterpret_cast<void **>(window_accessible_.Receive()));
+  HRESULT hr = ::CreateStdAccessibleObject(hwnd(), OBJID_WINDOW,
+                                           IID_PPV_ARGS(&window_accessible_));
   DCHECK(SUCCEEDED(hr));
 
   AccessibilityMode mode =
diff --git a/content/browser/webui/web_ui_browsertest.cc b/content/browser/webui/web_ui_browsertest.cc
new file mode 100644
index 0000000..a89a9e9
--- /dev/null
+++ b/content/browser/webui/web_ui_browsertest.cc
@@ -0,0 +1,30 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "content/public/common/url_constants.h"
+#include "content/public/test/browser_test_utils.h"
+#include "content/public/test/content_browser_test.h"
+#include "content/public/test/content_browser_test_utils.h"
+#include "content/shell/browser/shell.h"
+#include "net/test/embedded_test_server/embedded_test_server.h"
+#include "testing/gtest/include/gtest/gtest.h"
+
+namespace content {
+
+using WebUIBrowserTest = ContentBrowserTest;
+
+IN_PROC_BROWSER_TEST_F(WebUIBrowserTest, ViewCache) {
+  ASSERT_TRUE(embedded_test_server()->Start());
+  NavigateToURL(shell(), embedded_test_server()->GetURL("/simple_page.html"));
+  int result = -1;
+  NavigateToURL(shell(), GURL(kChromeUINetworkViewCacheURL));
+  std::string script(
+      "document.documentElement.innerHTML.indexOf('simple_page.html')");
+  ASSERT_TRUE(ExecuteScriptAndExtractInt(
+      shell()->web_contents(), "domAutomationController.send(" + script + ")",
+      &result));
+  ASSERT_NE(-1, result);
+}
+
+}  // namespace content
diff --git a/content/browser/webui/web_ui_url_loader_factory.cc b/content/browser/webui/web_ui_url_loader_factory.cc
index d73b516..a349bd9 100644
--- a/content/browser/webui/web_ui_url_loader_factory.cc
+++ b/content/browser/webui/web_ui_url_loader_factory.cc
@@ -20,12 +20,16 @@
 #include "content/browser/webui/network_error_url_loader.h"
 #include "content/browser/webui/url_data_manager_backend.h"
 #include "content/browser/webui/url_data_source_impl.h"
+#include "content/common/network_service.mojom.h"
 #include "content/public/browser/browser_context.h"
 #include "content/public/browser/browser_thread.h"
 #include "content/public/browser/render_process_host.h"
 #include "content/public/browser/web_contents.h"
+#include "content/public/common/service_manager_connection.h"
+#include "content/public/common/service_names.mojom.h"
 #include "content/public/common/url_constants.h"
 #include "mojo/public/cpp/bindings/binding_set.h"
+#include "services/service_manager/public/cpp/connector.h"
 #include "third_party/zlib/google/compression_utils.h"
 #include "ui/base/template_expressions.h"
 
@@ -241,6 +245,14 @@
                             const ResourceRequest& request,
                             mojom::URLLoaderClientPtr client) override {
     DCHECK_CURRENTLY_ON(BrowserThread::UI);
+    if (request.url.host_piece() == kChromeUINetworkViewCacheHost) {
+      mojom::NetworkServicePtr network_service;
+      ServiceManagerConnection::GetForProcess()->GetConnector()->BindInterface(
+          mojom::kNetworkServiceName, &network_service);
+      network_service->HandleViewCacheRequest(request, std::move(client));
+      return;
+    }
+
     if (request.url.host_piece() == kChromeUIBlobInternalsHost) {
       BrowserThread::PostTask(
           BrowserThread::IO, FROM_HERE,
@@ -249,11 +261,15 @@
               base::Unretained(
                   ChromeBlobStorageContext::GetFor(browser_context_))));
       return;
-    } else if (request.url.host_piece() == kChromeUINetworkErrorHost ||
-               request.url.host_piece() == kChromeUIDinoHost) {
+    }
+
+    if (request.url.host_piece() == kChromeUINetworkErrorHost ||
+        request.url.host_piece() == kChromeUIDinoHost) {
       StartNetworkErrorsURLLoader(request, std::move(client));
       return;
-    } else if (request.url.host_piece() == kChromeUIHistogramHost) {
+    }
+
+    if (request.url.host_piece() == kChromeUIHistogramHost) {
       StartHistogramInternalsURLLoader(request, std::move(client));
       return;
     }
diff --git a/content/common/BUILD.gn b/content/common/BUILD.gn
index 16bd2fe..af19509 100644
--- a/content/common/BUILD.gn
+++ b/content/common/BUILD.gn
@@ -604,6 +604,7 @@
     "media/renderer_audio_output_stream_factory.mojom",
     "memory_coordinator.mojom",
     "native_types.mojom",
+    "network_service.mojom",
     "push_messaging.mojom",
     "render_frame_message_filter.mojom",
     "render_message_filter.mojom",
diff --git a/content/common/network_service.mojom b/content/common/network_service.mojom
new file mode 100644
index 0000000..4067316
--- /dev/null
+++ b/content/common/network_service.mojom
@@ -0,0 +1,13 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+module content.mojom;
+
+import "url_loader.mojom";
+
+// Browser interface to the network service.
+interface NetworkService {
+  HandleViewCacheRequest(URLRequest request,
+                         URLLoaderClient client);
+};
diff --git a/content/network/BUILD.gn b/content/network/BUILD.gn
index 819d194a..4031986 100644
--- a/content/network/BUILD.gn
+++ b/content/network/BUILD.gn
@@ -28,6 +28,8 @@
   ]
 
   sources = [
+    "cache_url_loader.cc",
+    "cache_url_loader.h",
     "net_adapters.cc",
     "net_adapters.h",
     "network_context.cc",
diff --git a/content/network/DEPS b/content/network/DEPS
index c5ce9ee..1960e889 100644
--- a/content/network/DEPS
+++ b/content/network/DEPS
@@ -3,6 +3,7 @@
   "-content",
   "+content/common/content_export.h",
   "+content/common/resource_request.h",
+  "+content/common/network_service.mojom.h",
   "+content/common/url_loader.mojom.h",
   "+content/common/url_loader_factory.mojom.h",
   "+content/network",
@@ -10,6 +11,7 @@
   "+content/public/common/content_switches.h",
   "+content/public/common/referrer.h",
   "+content/public/common/resource_response.h",
+  "+content/public/common/url_constants.h",
   "+services/service_manager/public",
 ]
 
diff --git a/content/network/cache_url_loader.cc b/content/network/cache_url_loader.cc
new file mode 100644
index 0000000..dc8cc192
--- /dev/null
+++ b/content/network/cache_url_loader.cc
@@ -0,0 +1,96 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "content/network/cache_url_loader.h"
+
+#include "base/bind.h"
+#include "base/macros.h"
+#include "base/strings/string_util.h"
+#include "base/threading/thread_task_runner_handle.h"
+#include "content/public/common/url_constants.h"
+#include "mojo/common/data_pipe_utils.h"
+#include "net/url_request/view_cache_helper.h"
+
+namespace content {
+
+namespace {
+
+class CacheURLLoader {
+ public:
+  CacheURLLoader(const ResourceRequest& request,
+                 net::URLRequestContext* request_context,
+                 mojom::URLLoaderClientPtr client)
+      : client_(std::move(client)) {
+    scoped_refptr<net::HttpResponseHeaders> headers(
+        new net::HttpResponseHeaders("HTTP/1.1 200 OK"));
+    ResourceResponseHead resource_response;
+    resource_response.headers = headers;
+    resource_response.mime_type = "text/html";
+    client_->OnReceiveResponse(resource_response, base::nullopt, nullptr);
+
+    std::string cache_key =
+        request.url.spec().substr(strlen(kChromeUINetworkViewCacheURL));
+
+    int rv;
+    if (cache_key.empty()) {
+      rv = cache_helper_.GetContentsHTML(
+          request_context, kChromeUINetworkViewCacheURL, &data_,
+          base::Bind(&CacheURLLoader::DataAvailable, base::Unretained(this)));
+    } else {
+      rv = cache_helper_.GetEntryInfoHTML(
+          cache_key, request_context, &data_,
+          base::Bind(&CacheURLLoader::DataAvailable, base::Unretained(this)));
+    }
+
+    if (rv != net::ERR_IO_PENDING)
+      DataAvailable(rv);
+  }
+
+  ~CacheURLLoader() {}
+
+ private:
+  void DataAvailable(int result) {
+    DCHECK_EQ(net::OK, result);
+    MojoCreateDataPipeOptions options;
+    options.struct_size = sizeof(MojoCreateDataPipeOptions);
+    options.flags = MOJO_CREATE_DATA_PIPE_OPTIONS_FLAG_NONE;
+    options.element_num_bytes = 1;
+    options.capacity_num_bytes = data_.size();
+    mojo::DataPipe data_pipe(options);
+
+    DCHECK(data_pipe.producer_handle.is_valid());
+    DCHECK(data_pipe.consumer_handle.is_valid());
+
+    CHECK(
+        mojo::common::BlockingCopyFromString(data_, data_pipe.producer_handle));
+
+    client_->OnStartLoadingResponseBody(std::move(data_pipe.consumer_handle));
+
+    ResourceRequestCompletionStatus request_complete_data;
+    request_complete_data.error_code = net::OK;
+    request_complete_data.exists_in_cache = false;
+    request_complete_data.completion_time = base::TimeTicks::Now();
+    request_complete_data.encoded_data_length = data_.size();
+    request_complete_data.encoded_body_length = data_.size();
+    client_->OnComplete(request_complete_data);
+
+    // So we don't delete |this| in the constructor.
+    base::ThreadTaskRunnerHandle::Get()->DeleteSoon(FROM_HERE, this);
+  }
+
+  std::string data_;
+  mojom::URLLoaderClientPtr client_;
+  net::ViewCacheHelper cache_helper_;
+
+  DISALLOW_COPY_AND_ASSIGN(CacheURLLoader);
+};
+}
+
+void StartCacheURLLoader(const ResourceRequest& request,
+                         net::URLRequestContext* request_context,
+                         mojom::URLLoaderClientPtr client) {
+  new CacheURLLoader(request, request_context, std::move(client));
+}
+
+}  // namespace content
diff --git a/content/network/cache_url_loader.h b/content/network/cache_url_loader.h
new file mode 100644
index 0000000..f6f7e21
--- /dev/null
+++ b/content/network/cache_url_loader.h
@@ -0,0 +1,23 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_NETWORK_CACHE_URL_LOADER_H_
+#define CONTENT_NETWORK_CACHE_URL_LOADER_H_
+
+#include "content/common/url_loader.mojom.h"
+
+namespace net {
+class URLRequestContext;
+}
+
+namespace content {
+
+// Creates a URLLoader that responds to developer requests to view the cache.
+void StartCacheURLLoader(const ResourceRequest& request,
+                         net::URLRequestContext* request_context,
+                         mojom::URLLoaderClientPtr client);
+
+}  // namespace content
+
+#endif  // CONTENT_NETWORK_CACHE_URL_LOADER_H_
diff --git a/content/network/manifest.json b/content/network/manifest.json
index 41af5e80..645e68ce 100644
--- a/content/network/manifest.json
+++ b/content/network/manifest.json
@@ -4,6 +4,9 @@
   "interface_provider_specs": {
     "service_manager:connector": {
       "provides": {
+        "network_service": [
+          "content::mojom::NetworkService"
+        ],
         "test": [
           "content::mojom::NetworkServiceTest"
         ],
diff --git a/content/network/network_service.cc b/content/network/network_service.cc
index 4ced686..f4bcd48f 100644
--- a/content/network/network_service.cc
+++ b/content/network/network_service.cc
@@ -6,6 +6,7 @@
 
 #include "base/logging.h"
 #include "base/memory/ptr_util.h"
+#include "content/network/cache_url_loader.h"
 #include "content/network/network_service_url_loader_factory_impl.h"
 #include "services/service_manager/public/cpp/bind_source_info.h"
 
@@ -14,8 +15,10 @@
 NetworkService::NetworkService(
     std::unique_ptr<service_manager::BinderRegistry> registry)
     : registry_(std::move(registry)) {
-  registry_->AddInterface<mojom::URLLoaderFactory>(
-      base::Bind(&NetworkService::Create, base::Unretained(this)));
+  registry_->AddInterface<mojom::URLLoaderFactory>(base::Bind(
+      &NetworkService::CreateURLLoaderFactory, base::Unretained(this)));
+  registry_->AddInterface<mojom::NetworkService>(base::Bind(
+      &NetworkService::CreateNetworkService, base::Unretained(this)));
 }
 
 NetworkService::~NetworkService() = default;
@@ -28,11 +31,24 @@
                            std::move(interface_pipe));
 }
 
-void NetworkService::Create(const service_manager::BindSourceInfo& source_info,
-                            mojom::URLLoaderFactoryRequest request) {
+void NetworkService::CreateURLLoaderFactory(
+    const service_manager::BindSourceInfo& source_info,
+    mojom::URLLoaderFactoryRequest request) {
   loader_factory_bindings_.AddBinding(
       base::MakeUnique<NetworkServiceURLLoaderFactoryImpl>(&context_),
       std::move(request));
 }
 
+void NetworkService::CreateNetworkService(
+    const service_manager::BindSourceInfo& source_info,
+    mojom::NetworkServiceRequest request) {
+  network_service_bindings_.AddBinding(this, std::move(request));
+}
+
+void NetworkService::HandleViewCacheRequest(const ResourceRequest& request,
+                                            mojom::URLLoaderClientPtr client) {
+  StartCacheURLLoader(request, context_.url_request_context(),
+                      std::move(client));
+}
+
 }  // namespace content
diff --git a/content/network/network_service.h b/content/network/network_service.h
index a0dd1f3..3641e040 100644
--- a/content/network/network_service.h
+++ b/content/network/network_service.h
@@ -8,15 +8,18 @@
 #include <memory>
 
 #include "base/macros.h"
+#include "content/common/network_service.mojom.h"
 #include "content/common/url_loader_factory.mojom.h"
 #include "content/network/network_context.h"
+#include "mojo/public/cpp/bindings/binding_set.h"
 #include "mojo/public/cpp/bindings/strong_binding_set.h"
 #include "services/service_manager/public/cpp/binder_registry.h"
 #include "services/service_manager/public/cpp/service.h"
 
 namespace content {
 
-class NetworkService : public service_manager::Service {
+class NetworkService : public service_manager::Service,
+                       public mojom::NetworkService {
  public:
   explicit NetworkService(
       std::unique_ptr<service_manager::BinderRegistry> registry);
@@ -28,8 +31,15 @@
                        const std::string& interface_name,
                        mojo::ScopedMessagePipeHandle interface_pipe) override;
 
-  void Create(const service_manager::BindSourceInfo& source_info,
-              mojom::URLLoaderFactoryRequest request);
+  void CreateURLLoaderFactory(
+      const service_manager::BindSourceInfo& source_info,
+      mojom::URLLoaderFactoryRequest request);
+  void CreateNetworkService(const service_manager::BindSourceInfo& source_info,
+                            mojom::NetworkServiceRequest request);
+
+  // mojom::NetworkService implementation:
+  void HandleViewCacheRequest(const ResourceRequest& request,
+                              mojom::URLLoaderClientPtr client) override;
 
   std::unique_ptr<service_manager::BinderRegistry> registry_;
 
@@ -39,6 +49,8 @@
   // NetworkServiceURLLoaderFactoryImpl instances.
   mojo::StrongBindingSet<mojom::URLLoaderFactory> loader_factory_bindings_;
 
+  mojo::BindingSet<mojom::NetworkService> network_service_bindings_;
+
   DISALLOW_COPY_AND_ASSIGN(NetworkService);
 };
 
diff --git a/content/public/app/mojo/content_browser_manifest.json b/content/public/app/mojo/content_browser_manifest.json
index 888c43e..4e85584 100644
--- a/content/public/app/mojo/content_browser_manifest.json
+++ b/content/public/app/mojo/content_browser_manifest.json
@@ -65,6 +65,7 @@
         "file": [ "file:filesystem", "file:leveldb" ],
         "media": [ "media:media" ],
         "network": [
+          "network_service",
           "test",
           "url_loader"
         ],
diff --git a/content/renderer/input/input_handler_wrapper.cc b/content/renderer/input/input_handler_wrapper.cc
index 2e64cdb..1605e40 100644
--- a/content/renderer/input/input_handler_wrapper.cc
+++ b/content/renderer/input/input_handler_wrapper.cc
@@ -91,4 +91,22 @@
   input_handler_manager_->DidAnimateForInput();
 }
 
+void InputHandlerWrapper::GenerateScrollBeginAndSendToMainThread(
+    const blink::WebGestureEvent& update_event) {
+  DCHECK_EQ(update_event.GetType(), blink::WebInputEvent::kGestureScrollUpdate);
+  blink::WebGestureEvent scroll_begin(update_event);
+  scroll_begin.SetType(blink::WebInputEvent::kGestureScrollBegin);
+  scroll_begin.data.scroll_begin.inertial_phase =
+      update_event.data.scroll_update.inertial_phase;
+  scroll_begin.data.scroll_begin.delta_x_hint =
+      update_event.data.scroll_update.delta_x;
+  scroll_begin.data.scroll_begin.delta_y_hint =
+      update_event.data.scroll_update.delta_y;
+  scroll_begin.data.scroll_begin.delta_hint_units =
+      update_event.data.scroll_update.delta_units;
+
+  DispatchNonBlockingEventToMainThread(
+      ui::WebInputEventTraits::Clone(scroll_begin), ui::LatencyInfo());
+}
+
 }  // namespace content
diff --git a/content/renderer/input/input_handler_wrapper.h b/content/renderer/input/input_handler_wrapper.h
index 809cb05..178df26 100644
--- a/content/renderer/input/input_handler_wrapper.h
+++ b/content/renderer/input/input_handler_wrapper.h
@@ -55,6 +55,8 @@
                      const gfx::PointF& causal_event_viewport_point) override;
   void DidStopFlinging() override;
   void DidAnimateForInput() override;
+  void GenerateScrollBeginAndSendToMainThread(
+      const blink::WebGestureEvent& update_event) override;
 
  private:
   InputHandlerManager* input_handler_manager_;
diff --git a/content/test/BUILD.gn b/content/test/BUILD.gn
index e447adf..012dc476 100644
--- a/content/test/BUILD.gn
+++ b/content/test/BUILD.gn
@@ -699,6 +699,7 @@
     "../browser/web_contents/web_contents_view_aura_browsertest.cc",
     "../browser/web_contents_binding_set_browsertest.cc",
     "../browser/webkit_browsertest.cc",
+    "../browser/webui/web_ui_browsertest.cc",
     "../browser/webui/web_ui_mojo_browsertest.cc",
     "../browser/zoom_browsertest.cc",
     "../child/site_isolation_stats_gatherer_browsertest.cc",
diff --git a/device/generic_sensor/platform_sensor_reader_win.cc b/device/generic_sensor/platform_sensor_reader_win.cc
index 566d6968..89d7819 100644
--- a/device/generic_sensor/platform_sensor_reader_win.cc
+++ b/device/generic_sensor/platform_sensor_reader_win.cc
@@ -357,15 +357,15 @@
     base::win::ScopedComPtr<ISensorManager> sensor_manager) {
   base::win::ScopedComPtr<ISensor> sensor;
   base::win::ScopedComPtr<ISensorCollection> sensor_collection;
-  HRESULT hr = sensor_manager->GetSensorsByType(sensor_type,
-                                                sensor_collection.Receive());
+  HRESULT hr = sensor_manager->GetSensorsByType(
+      sensor_type, sensor_collection.GetAddressOf());
   if (FAILED(hr) || !sensor_collection)
     return sensor;
 
   ULONG count = 0;
   hr = sensor_collection->GetCount(&count);
   if (SUCCEEDED(hr) && count > 0)
-    sensor_collection->GetAt(0, sensor.Receive());
+    sensor_collection->GetAt(0, sensor.GetAddressOf());
   return sensor;
 }
 
@@ -439,7 +439,7 @@
 
     if (SUCCEEDED(hr)) {
       base::win::ScopedComPtr<IPortableDeviceValues> return_props;
-      hr = sensor_->SetProperties(props.Get(), return_props.Receive());
+      hr = sensor_->SetProperties(props.Get(), return_props.GetAddressOf());
       return SUCCEEDED(hr);
     }
   }
diff --git a/device/sensors/data_fetcher_shared_memory_win.cc b/device/sensors/data_fetcher_shared_memory_win.cc
index 1c1cd35..9405d00 100644
--- a/device/sensors/data_fetcher_shared_memory_win.cc
+++ b/device/sensors/data_fetcher_shared_memory_win.cc
@@ -234,8 +234,9 @@
           static_cast<DeviceOrientationHardwareBuffer*>(buffer);
       scoped_refptr<SensorEventSink> sink(
           new SensorEventSinkOrientation(orientation_buffer_));
-      bool inclinometer_available = RegisterForSensor(
-          SENSOR_TYPE_INCLINOMETER_3D, sensor_inclinometer_.Receive(), sink);
+      bool inclinometer_available =
+          RegisterForSensor(SENSOR_TYPE_INCLINOMETER_3D,
+                            sensor_inclinometer_.GetAddressOf(), sink);
       UMA_HISTOGRAM_BOOLEAN("InertialSensor.InclinometerWindowsAvailable",
                             inclinometer_available);
       if (inclinometer_available)
@@ -252,7 +253,7 @@
       // absolute angles.
       bool inclinometer_available =
           RegisterForSensor(SENSOR_TYPE_INCLINOMETER_3D,
-                            sensor_inclinometer_absolute_.Receive(), sink);
+                            sensor_inclinometer_absolute_.GetAddressOf(), sink);
       // TODO(timvolodine): consider adding UMA.
       if (inclinometer_available)
         return true;
@@ -263,10 +264,11 @@
       motion_buffer_ = static_cast<DeviceMotionHardwareBuffer*>(buffer);
       scoped_refptr<SensorEventSink> sink(
           new SensorEventSinkMotion(motion_buffer_));
-      bool accelerometer_available = RegisterForSensor(
-          SENSOR_TYPE_ACCELEROMETER_3D, sensor_accelerometer_.Receive(), sink);
+      bool accelerometer_available =
+          RegisterForSensor(SENSOR_TYPE_ACCELEROMETER_3D,
+                            sensor_accelerometer_.GetAddressOf(), sink);
       bool gyrometer_available = RegisterForSensor(
-          SENSOR_TYPE_GYROMETER_3D, sensor_gyrometer_.Receive(), sink);
+          SENSOR_TYPE_GYROMETER_3D, sensor_gyrometer_.GetAddressOf(), sink);
       UMA_HISTOGRAM_BOOLEAN("InertialSensor.AccelerometerWindowsAvailable",
                             accelerometer_available);
       UMA_HISTOGRAM_BOOLEAN("InertialSensor.GyrometerWindowsAvailable",
@@ -321,7 +323,7 @@
 
   base::win::ScopedComPtr<ISensorCollection> sensor_collection;
   hr = sensor_manager->GetSensorsByType(sensor_type,
-                                        sensor_collection.Receive());
+                                        sensor_collection.GetAddressOf());
 
   if (FAILED(hr) || !sensor_collection.Get())
     return false;
@@ -341,7 +343,8 @@
             SENSOR_PROPERTY_CURRENT_REPORT_INTERVAL,
             GetInterval().InMilliseconds()))) {
       base::win::ScopedComPtr<IPortableDeviceValues> return_values;
-      (*sensor)->SetProperties(device_values.Get(), return_values.Receive());
+      (*sensor)->SetProperties(device_values.Get(),
+                               return_values.GetAddressOf());
     }
   }
 
diff --git a/gpu/ipc/service/direct_composition_surface_win.cc b/gpu/ipc/service/direct_composition_surface_win.cc
index c12786ad..13b9a03 100644
--- a/gpu/ipc/service/direct_composition_surface_win.cc
+++ b/gpu/ipc/service/direct_composition_surface_win.cc
@@ -130,17 +130,17 @@
   }
 
   base::win::ScopedComPtr<IDXGIDevice> dxgi_device;
-  d3d11_device.CopyTo(dxgi_device.Receive());
+  d3d11_device.CopyTo(dxgi_device.GetAddressOf());
   base::win::ScopedComPtr<IDXGIAdapter> dxgi_adapter;
-  dxgi_device->GetAdapter(dxgi_adapter.Receive());
+  dxgi_device->GetAdapter(dxgi_adapter.GetAddressOf());
 
   unsigned int i = 0;
   while (true) {
     base::win::ScopedComPtr<IDXGIOutput> output;
-    if (FAILED(dxgi_adapter->EnumOutputs(i++, output.Receive())))
+    if (FAILED(dxgi_adapter->EnumOutputs(i++, output.GetAddressOf())))
       break;
     base::win::ScopedComPtr<IDXGIOutput3> output3;
-    if (FAILED(output.CopyTo(output3.Receive())))
+    if (FAILED(output.CopyTo(output3.GetAddressOf())))
       continue;
 
     UINT flags = 0;
@@ -313,20 +313,20 @@
 };
 
 bool DCLayerTree::Initialize(HWND window) {
-  d3d11_device_.CopyTo(video_device_.Receive());
+  d3d11_device_.CopyTo(video_device_.GetAddressOf());
   base::win::ScopedComPtr<ID3D11DeviceContext> context;
-  d3d11_device_->GetImmediateContext(context.Receive());
-  context.CopyTo(video_context_.Receive());
+  d3d11_device_->GetImmediateContext(context.GetAddressOf());
+  context.CopyTo(video_context_.GetAddressOf());
 
   base::win::ScopedComPtr<IDCompositionDesktopDevice> desktop_device;
-  dcomp_device_.CopyTo(desktop_device.Receive());
+  dcomp_device_.CopyTo(desktop_device.GetAddressOf());
 
-  HRESULT hr = desktop_device->CreateTargetForHwnd(window, TRUE,
-                                                   dcomp_target_.Receive());
+  HRESULT hr = desktop_device->CreateTargetForHwnd(
+      window, TRUE, dcomp_target_.GetAddressOf());
   if (FAILED(hr))
     return false;
 
-  hr = dcomp_device_->CreateVisual(root_visual_.Receive());
+  hr = dcomp_device_->CreateVisual(root_visual_.GetAddressOf());
   if (FAILED(hr))
     return false;
 
@@ -356,11 +356,11 @@
   desc.OutputHeight = output_size.height();
   desc.Usage = D3D11_VIDEO_USAGE_PLAYBACK_NORMAL;
   HRESULT hr = video_device_->CreateVideoProcessorEnumerator(
-      &desc, video_processor_enumerator_.Receive());
+      &desc, video_processor_enumerator_.GetAddressOf());
   CHECK(SUCCEEDED(hr));
 
   hr = video_device_->CreateVideoProcessor(video_processor_enumerator_.Get(), 0,
-                                           video_processor_.Receive());
+                                           video_processor_.GetAddressOf());
   CHECK(SUCCEEDED(hr));
 }
 
@@ -375,10 +375,10 @@
     DCLayerTree* surface,
     base::win::ScopedComPtr<ID3D11Device> d3d11_device)
     : surface_(surface), d3d11_device_(d3d11_device) {
-  d3d11_device_.CopyTo(video_device_.Receive());
+  d3d11_device_.CopyTo(video_device_.GetAddressOf());
   base::win::ScopedComPtr<ID3D11DeviceContext> context;
-  d3d11_device_->GetImmediateContext(context.Receive());
-  context.CopyTo(video_context_.Receive());
+  d3d11_device_->GetImmediateContext(context.GetAddressOf());
+  context.CopyTo(video_context_.GetAddressOf());
   HMODULE dcomp = ::GetModuleHandleA("dcomp.dll");
   CHECK(dcomp);
   create_surface_handle_function_ =
@@ -439,14 +439,14 @@
     desc.MiscFlags = 0;
     desc.SampleDesc.Count = 1;
     base::win::ScopedComPtr<ID3D11Texture2D> texture;
-    HRESULT hr = d3d11_device_->CreateTexture2D(&desc, nullptr,
-                                                staging_texture_.Receive());
+    HRESULT hr = d3d11_device_->CreateTexture2D(
+        &desc, nullptr, staging_texture_.GetAddressOf());
     CHECK(SUCCEEDED(hr)) << "Creating D3D11 video upload texture failed: "
                          << std::hex << hr;
     staging_texture_size_ = texture_size;
   }
   base::win::ScopedComPtr<ID3D11DeviceContext> context;
-  d3d11_device_->GetImmediateContext(context.Receive());
+  d3d11_device_->GetImmediateContext(context.GetAddressOf());
   D3D11_MAPPED_SUBRESOURCE mapped_resource;
   HRESULT hr = context->Map(staging_texture_.Get(), 0, D3D11_MAP_WRITE_DISCARD,
                             0, &mapped_resource);
@@ -544,20 +544,20 @@
 
   if (!out_view_) {
     base::win::ScopedComPtr<ID3D11Texture2D> texture;
-    swap_chain_->GetBuffer(0, IID_PPV_ARGS(texture.Receive()));
+    swap_chain_->GetBuffer(0, IID_PPV_ARGS(texture.GetAddressOf()));
     D3D11_VIDEO_PROCESSOR_OUTPUT_VIEW_DESC out_desc = {};
     out_desc.ViewDimension = D3D11_VPOV_DIMENSION_TEXTURE2D;
     out_desc.Texture2D.MipSlice = 0;
     HRESULT hr = video_device_->CreateVideoProcessorOutputView(
         texture.Get(), video_processor_enumerator_.Get(), &out_desc,
-        out_view_.Receive());
+        out_view_.GetAddressOf());
     CHECK(SUCCEEDED(hr));
   }
 
   // TODO(jbauman): Use correct colorspace.
   gfx::ColorSpace src_color_space = gfx::ColorSpace::CreateREC709();
   base::win::ScopedComPtr<ID3D11VideoContext1> context1;
-  if (SUCCEEDED(video_context_.CopyTo(context1.Receive()))) {
+  if (SUCCEEDED(video_context_.CopyTo(context1.GetAddressOf()))) {
     context1->VideoProcessorSetStreamColorSpace1(
         video_processor_.Get(), 0,
         gfx::ColorSpaceWin::GetDXGIColorSpace(src_color_space));
@@ -578,7 +578,7 @@
   }
 
   base::win::ScopedComPtr<IDXGISwapChain3> swap_chain3;
-  if (SUCCEEDED(swap_chain_.CopyTo(swap_chain3.Receive()))) {
+  if (SUCCEEDED(swap_chain_.CopyTo(swap_chain3.GetAddressOf()))) {
     DXGI_COLOR_SPACE_TYPE color_space =
         gfx::ColorSpaceWin::GetDXGIColorSpace(output_color_space);
     HRESULT hr = swap_chain3->SetColorSpace1(color_space);
@@ -601,7 +601,7 @@
     base::win::ScopedComPtr<ID3D11VideoProcessorInputView> in_view;
     HRESULT hr = video_device_->CreateVideoProcessorInputView(
         input_texture.Get(), video_processor_enumerator_.Get(), &in_desc,
-        in_view.Receive());
+        in_view.GetAddressOf());
     CHECK(SUCCEEDED(hr));
 
     D3D11_VIDEO_PROCESSOR_STREAM stream = {};
@@ -642,13 +642,13 @@
     // workaround doesn't help.
     base::win::ScopedComPtr<ID3D11Texture2D> dest_texture;
     HRESULT hr =
-        swap_chain_->GetBuffer(0, IID_PPV_ARGS(dest_texture.Receive()));
+        swap_chain_->GetBuffer(0, IID_PPV_ARGS(dest_texture.GetAddressOf()));
     DCHECK(SUCCEEDED(hr));
     base::win::ScopedComPtr<ID3D11Texture2D> src_texture;
-    hr = swap_chain_->GetBuffer(1, IID_PPV_ARGS(src_texture.Receive()));
+    hr = swap_chain_->GetBuffer(1, IID_PPV_ARGS(src_texture.GetAddressOf()));
     DCHECK(SUCCEEDED(hr));
     base::win::ScopedComPtr<ID3D11DeviceContext> context;
-    d3d11_device_->GetImmediateContext(context.Receive());
+    d3d11_device_->GetImmediateContext(context.GetAddressOf());
     context->CopyResource(dest_texture.Get(), src_texture.Get());
   }
 
@@ -659,7 +659,7 @@
   frames_since_color_space_change_++;
 
   base::win::ScopedComPtr<IDXGISwapChainMedia> swap_chain_media;
-  if (SUCCEEDED(swap_chain_.CopyTo(swap_chain_media.Receive()))) {
+  if (SUCCEEDED(swap_chain_.CopyTo(swap_chain_media.GetAddressOf()))) {
     DXGI_FRAME_STATISTICS_MEDIA stats = {};
     if (SUCCEEDED(swap_chain_media->GetFrameStatisticsMedia(&stats))) {
       UMA_HISTOGRAM_SPARSE_SLOWLY("GPU.DirectComposition.CompositionMode",
@@ -692,14 +692,14 @@
   DCHECK(!swap_chain_);
 
   base::win::ScopedComPtr<IDXGIDevice> dxgi_device;
-  d3d11_device_.CopyTo(dxgi_device.Receive());
+  d3d11_device_.CopyTo(dxgi_device.GetAddressOf());
   base::win::ScopedComPtr<IDXGIAdapter> dxgi_adapter;
-  dxgi_device->GetAdapter(dxgi_adapter.Receive());
+  dxgi_device->GetAdapter(dxgi_adapter.GetAddressOf());
   base::win::ScopedComPtr<IDXGIFactory2> dxgi_factory;
-  dxgi_adapter->GetParent(IID_PPV_ARGS(dxgi_factory.Receive()));
+  dxgi_adapter->GetParent(IID_PPV_ARGS(dxgi_factory.GetAddressOf()));
 
   base::win::ScopedComPtr<IDXGIFactoryMedia> media_factory;
-  dxgi_factory.CopyTo(media_factory.Receive());
+  dxgi_factory.CopyTo(media_factory.GetAddressOf());
   DXGI_SWAP_CHAIN_DESC1 desc = {};
   desc.Width = swap_chain_size_.width();
   desc.Height = swap_chain_size_.height();
@@ -734,7 +734,7 @@
   if (yuy2) {
     hr = media_factory->CreateSwapChainForCompositionSurfaceHandle(
         d3d11_device_.Get(), swap_chain_handle_.Get(), &desc, nullptr,
-        swap_chain_.Receive());
+        swap_chain_.GetAddressOf());
     is_yuy2_swapchain_ = SUCCEEDED(hr);
     failed_to_create_yuy2_swapchain_ = !is_yuy2_swapchain_;
   }
@@ -748,7 +748,7 @@
     desc.Flags = 0;
     hr = media_factory->CreateSwapChainForCompositionSurfaceHandle(
         d3d11_device_.Get(), swap_chain_handle_.Get(), &desc, nullptr,
-        swap_chain_.Receive());
+        swap_chain_.GetAddressOf());
     CHECK(SUCCEEDED(hr));
   }
   out_view_.Reset();
@@ -761,8 +761,8 @@
     return;
   DCHECK(!visual_info->clip_visual);
   base::win::ScopedComPtr<IDCompositionVisual2> visual;
-  dcomp_device_->CreateVisual(visual_info->clip_visual.Receive());
-  dcomp_device_->CreateVisual(visual.Receive());
+  dcomp_device_->CreateVisual(visual_info->clip_visual.GetAddressOf());
+  dcomp_device_->CreateVisual(visual.GetAddressOf());
   visual_info->content_visual = visual;
   visual_info->clip_visual->AddVisual(visual.Get(), FALSE, nullptr);
 
@@ -814,7 +814,7 @@
     dc_visual->SetOffsetX(bounds_rect.x());
     dc_visual->SetOffsetY(bounds_rect.y());
     base::win::ScopedComPtr<IDCompositionMatrixTransform> dcomp_transform;
-    dcomp_device_->CreateMatrixTransform(dcomp_transform.Receive());
+    dcomp_device_->CreateMatrixTransform(dcomp_transform.GetAddressOf());
     D2D_MATRIX_3X2_F d2d_matrix = {{{final_transform.matrix().get(0, 0),
                                      final_transform.matrix().get(0, 1),
                                      final_transform.matrix().get(1, 0),
@@ -868,7 +868,7 @@
     visual_info->clip_rect = params.clip_rect;
     if (params.is_clipped) {
       base::win::ScopedComPtr<IDCompositionRectangleClip> clip;
-      dcomp_device_->CreateRectangleClip(clip.Receive());
+      dcomp_device_->CreateRectangleClip(clip.GetAddressOf());
       gfx::Rect offset_clip = params.clip_rect;
       clip->SetLeft(offset_clip.x());
       clip->SetRight(offset_clip.right());
@@ -1024,18 +1024,18 @@
     // become transparent.
     HRESULT hr = dcomp_device_->CreateSurface(
         size_.width(), size_.height(), output_format,
-        DXGI_ALPHA_MODE_PREMULTIPLIED, dcomp_surface_.Receive());
+        DXGI_ALPHA_MODE_PREMULTIPLIED, dcomp_surface_.GetAddressOf());
     has_been_rendered_to_ = false;
     CHECK(SUCCEEDED(hr));
   } else {
     DXGI_ALPHA_MODE alpha_mode =
         has_alpha_ ? DXGI_ALPHA_MODE_PREMULTIPLIED : DXGI_ALPHA_MODE_IGNORE;
     base::win::ScopedComPtr<IDXGIDevice> dxgi_device;
-    d3d11_device_.CopyTo(dxgi_device.Receive());
+    d3d11_device_.CopyTo(dxgi_device.GetAddressOf());
     base::win::ScopedComPtr<IDXGIAdapter> dxgi_adapter;
-    dxgi_device->GetAdapter(dxgi_adapter.Receive());
+    dxgi_device->GetAdapter(dxgi_adapter.GetAddressOf());
     base::win::ScopedComPtr<IDXGIFactory2> dxgi_factory;
-    dxgi_adapter->GetParent(IID_PPV_ARGS(dxgi_factory.Receive()));
+    dxgi_adapter->GetParent(IID_PPV_ARGS(dxgi_factory.GetAddressOf()));
 
     DXGI_SWAP_CHAIN_DESC1 desc = {};
     desc.Width = size_.width();
@@ -1050,7 +1050,7 @@
     desc.AlphaMode = alpha_mode;
     desc.Flags = 0;
     HRESULT hr = dxgi_factory->CreateSwapChainForComposition(
-        d3d11_device_.Get(), &desc, nullptr, swap_chain_.Receive());
+        d3d11_device_.Get(), &desc, nullptr, swap_chain_.GetAddressOf());
     has_been_rendered_to_ = false;
     first_swap_ = true;
     CHECK(SUCCEEDED(hr));
@@ -1078,7 +1078,7 @@
         // committing the DirectComposition tree, or else the swapchain
         // may flicker black when it's first presented.
         base::win::ScopedComPtr<IDXGIDevice2> dxgi_device2;
-        HRESULT hr = d3d11_device_.CopyTo(dxgi_device2.Receive());
+        HRESULT hr = d3d11_device_.CopyTo(dxgi_device2.GetAddressOf());
         DCHECK(SUCCEEDED(hr));
         base::WaitableEvent event(
             base::WaitableEvent::ResetPolicy::AUTOMATIC,
@@ -1240,12 +1240,12 @@
   if (dcomp_surface_) {
     POINT update_offset;
     HRESULT hr = dcomp_surface_->BeginDraw(
-        &rect, IID_PPV_ARGS(draw_texture_.Receive()), &update_offset);
+        &rect, IID_PPV_ARGS(draw_texture_.GetAddressOf()), &update_offset);
     draw_offset_ = gfx::Point(update_offset) - gfx::Rect(rect).origin();
     CHECK(SUCCEEDED(hr));
   } else {
     HRESULT hr =
-        swap_chain_->GetBuffer(0, IID_PPV_ARGS(draw_texture_.Receive()));
+        swap_chain_->GetBuffer(0, IID_PPV_ARGS(draw_texture_.GetAddressOf()));
     swap_rect_ = rectangle;
     draw_offset_ = gfx::Vector2d();
     CHECK(SUCCEEDED(hr));
diff --git a/gpu/ipc/service/direct_composition_surface_win_unittest.cc b/gpu/ipc/service/direct_composition_surface_win_unittest.cc
index f1e824a..fe1d83c 100644
--- a/gpu/ipc/service/direct_composition_surface_win_unittest.cc
+++ b/gpu/ipc/service/direct_composition_surface_win_unittest.cc
@@ -121,7 +121,8 @@
   data.SysMemPitch = size.width();
 
   base::win::ScopedComPtr<ID3D11Texture2D> texture;
-  HRESULT hr = d3d11_device->CreateTexture2D(&desc, &data, texture.Receive());
+  HRESULT hr =
+      d3d11_device->CreateTexture2D(&desc, &data, texture.GetAddressOf());
   CHECK(SUCCEEDED(hr));
   return texture;
 }
diff --git a/headless/BUILD.gn b/headless/BUILD.gn
index ff2c8076..d74479a 100644
--- a/headless/BUILD.gn
+++ b/headless/BUILD.gn
@@ -324,7 +324,7 @@
   ]
 
   if (enable_basic_printing) {
-    public_deps += [ "//skia" ]
+    public_deps += [ "//components/printing/browser" ]
   }
 
   deps = [
@@ -355,10 +355,7 @@
   }
 
   if (enable_basic_printing) {
-    deps += [
-      "//components/printing/browser",
-      "//components/printing/renderer",
-    ]
+    deps += [ "//components/printing/renderer" ]
   }
 
   if (headless_use_embedded_resources) {
diff --git a/ios/chrome/browser/component_updater/ios_component_updater_configurator.cc b/ios/chrome/browser/component_updater/ios_component_updater_configurator.cc
index 84baa7b..f171fb32 100644
--- a/ios/chrome/browser/component_updater/ios_component_updater_configurator.cc
+++ b/ios/chrome/browser/component_updater/ios_component_updater_configurator.cc
@@ -10,7 +10,7 @@
 #include "base/threading/sequenced_worker_pool.h"
 #include "base/version.h"
 #include "components/component_updater/configurator_impl.h"
-#include "components/update_client/component_patcher_operation.h"
+#include "components/update_client/out_of_process_patcher.h"
 #include "components/update_client/update_query_params.h"
 #include "ios/chrome/browser/application_context.h"
 #include "ios/chrome/browser/google/google_brand.h"
@@ -174,7 +174,7 @@
 scoped_refptr<update_client::Configurator> MakeIOSComponentUpdaterConfigurator(
     const base::CommandLine* cmdline,
     net::URLRequestContextGetter* context_getter) {
-  return new IOSConfigurator(cmdline, context_getter);
+  return base::MakeShared<IOSConfigurator>(cmdline, context_getter);
 }
 
 }  // namespace component_updater
diff --git a/ios/chrome/browser/tabs/BUILD.gn b/ios/chrome/browser/tabs/BUILD.gn
index 4e28b1c..c7d2f34 100644
--- a/ios/chrome/browser/tabs/BUILD.gn
+++ b/ios/chrome/browser/tabs/BUILD.gn
@@ -34,8 +34,6 @@
 source_set("tabs_internal") {
   sources = [
     "tab_model.mm",
-    "tab_model_synced_window_delegate.mm",
-    "tab_model_synced_window_delegate_getter.mm",
   ]
   deps = [
     ":tabs",
@@ -134,6 +132,8 @@
     "tab_model_observers_bridge.mm",
     "tab_model_selected_tab_observer.h",
     "tab_model_selected_tab_observer.mm",
+    "tab_model_synced_window_delegate.mm",
+    "tab_model_synced_window_delegate_getter.mm",
     "tab_model_web_state_list_delegate.h",
     "tab_model_web_state_list_delegate.mm",
     "tab_parenting_observer.h",
diff --git a/ios/chrome/browser/tabs/tab_model.mm b/ios/chrome/browser/tabs/tab_model.mm
index 3e0ed5a7..278d1394 100644
--- a/ios/chrome/browser/tabs/tab_model.mm
+++ b/ios/chrome/browser/tabs/tab_model.mm
@@ -289,8 +289,8 @@
       // Set up the usage recorder before tabs are created.
       _tabUsageRecorder = base::MakeUnique<TabUsageRecorder>(self);
     }
-    _syncedWindowDelegate =
-        base::MakeUnique<TabModelSyncedWindowDelegate>(self);
+    _syncedWindowDelegate = base::MakeUnique<TabModelSyncedWindowDelegate>(
+        _webStateList.get(), _sessionID);
 
     // There must be a valid session service defined to consume session windows.
     DCHECK(service);
diff --git a/ios/chrome/browser/tabs/tab_model_synced_window_delegate.h b/ios/chrome/browser/tabs/tab_model_synced_window_delegate.h
index 01368a8..4e0e6f0 100644
--- a/ios/chrome/browser/tabs/tab_model_synced_window_delegate.h
+++ b/ios/chrome/browser/tabs/tab_model_synced_window_delegate.h
@@ -9,7 +9,7 @@
 #include "components/sessions/core/session_id.h"
 #include "components/sync_sessions/synced_window_delegate.h"
 
-@class TabModel;
+class WebStateList;
 
 namespace browser_sync {
 class SyncedTabDelegate;
@@ -20,7 +20,8 @@
 class TabModelSyncedWindowDelegate
     : public sync_sessions::SyncedWindowDelegate {
  public:
-  explicit TabModelSyncedWindowDelegate(TabModel* tab_model);
+  TabModelSyncedWindowDelegate(WebStateList* web_state_list,
+                               SessionID session_id);
   ~TabModelSyncedWindowDelegate() override;
 
   // SyncedWindowDelegate:
@@ -39,7 +40,8 @@
   bool ShouldSync() const override;
 
  private:
-  TabModel* tab_model_;  // weak, owns us.
+  WebStateList* web_state_list_;
+  SessionID session_id_;
 
   DISALLOW_COPY_AND_ASSIGN(TabModelSyncedWindowDelegate);
 };
diff --git a/ios/chrome/browser/tabs/tab_model_synced_window_delegate.mm b/ios/chrome/browser/tabs/tab_model_synced_window_delegate.mm
index 1dc244c..e59baee 100644
--- a/ios/chrome/browser/tabs/tab_model_synced_window_delegate.mm
+++ b/ios/chrome/browser/tabs/tab_model_synced_window_delegate.mm
@@ -4,17 +4,20 @@
 
 #include "ios/chrome/browser/tabs/tab_model_synced_window_delegate.h"
 
-#include <set>
-
 #include "base/logging.h"
 #include "ios/chrome/browser/browser_state/chrome_browser_state.h"
 #include "ios/chrome/browser/sync/ios_chrome_synced_tab_delegate.h"
-#include "ios/chrome/browser/tabs/tab.h"
-#include "ios/chrome/browser/tabs/tab_model.h"
+#import "ios/chrome/browser/web_state_list/web_state_list.h"
 #import "ios/web/public/web_state/web_state.h"
 
-TabModelSyncedWindowDelegate::TabModelSyncedWindowDelegate(TabModel* tab_model)
-    : tab_model_(tab_model) {}
+#if !defined(__has_feature) || !__has_feature(objc_arc)
+#error "This file requires ARC support."
+#endif
+
+TabModelSyncedWindowDelegate::TabModelSyncedWindowDelegate(
+    WebStateList* web_state_list,
+    SessionID session_id)
+    : web_state_list_(web_state_list), session_id_(session_id) {}
 
 TabModelSyncedWindowDelegate::~TabModelSyncedWindowDelegate() {}
 
@@ -25,13 +28,8 @@
 
 sync_sessions::SyncedTabDelegate* TabModelSyncedWindowDelegate::GetTabAt(
     int index) const {
-  sync_sessions::SyncedTabDelegate* delegate =
-      IOSChromeSyncedTabDelegate::FromWebState(
-          [tab_model_ tabAtIndex:index].webState);
-  if (!delegate) {
-    return nullptr;
-  }
-  return delegate;
+  return IOSChromeSyncedTabDelegate::FromWebState(
+      web_state_list_->GetWebStateAt(index));
 }
 
 SessionID::id_type TabModelSyncedWindowDelegate::GetTabIdAt(int index) const {
@@ -47,17 +45,16 @@
 }
 
 SessionID::id_type TabModelSyncedWindowDelegate::GetSessionId() const {
-  return tab_model_.sessionID.id();
+  return session_id_.id();
 }
 
 int TabModelSyncedWindowDelegate::GetTabCount() const {
-  return [tab_model_ count];
+  return web_state_list_->count();
 }
 
 int TabModelSyncedWindowDelegate::GetActiveIndex() const {
-  Tab* current_tab = [tab_model_ currentTab];
-  DCHECK(current_tab);
-  return [tab_model_ indexOfTab:current_tab];
+  DCHECK_NE(web_state_list_->active_index(), WebStateList::kInvalidIndex);
+  return web_state_list_->active_index();
 }
 
 bool TabModelSyncedWindowDelegate::IsApp() const {
diff --git a/ios/chrome/browser/tabs/tab_model_synced_window_delegate_getter.mm b/ios/chrome/browser/tabs/tab_model_synced_window_delegate_getter.mm
index 4e24de1ce..04c110e 100644
--- a/ios/chrome/browser/tabs/tab_model_synced_window_delegate_getter.mm
+++ b/ios/chrome/browser/tabs/tab_model_synced_window_delegate_getter.mm
@@ -12,6 +12,10 @@
 #import "ios/chrome/browser/tabs/tab_model_list.h"
 #import "ios/chrome/browser/tabs/tab_model_synced_window_delegate.h"
 
+#if !defined(__has_feature) || !__has_feature(objc_arc)
+#error "This file requires ARC support."
+#endif
+
 TabModelSyncedWindowDelegatesGetter::TabModelSyncedWindowDelegatesGetter() {}
 
 TabModelSyncedWindowDelegatesGetter::~TabModelSyncedWindowDelegatesGetter() {}
diff --git a/ios/chrome/browser/ui/autofill/autofill_ui_type.h b/ios/chrome/browser/ui/autofill/autofill_ui_type.h
index 87ba345..82a0de3 100644
--- a/ios/chrome/browser/ui/autofill/autofill_ui_type.h
+++ b/ios/chrome/browser/ui/autofill/autofill_ui_type.h
@@ -14,6 +14,7 @@
   AutofillUITypeCreditCardHolderFullName,
   AutofillUITypeCreditCardExpMonth,
   AutofillUITypeCreditCardExpYear,
+  AutofillUITypeCreditCardBillingAddress,
   AutofillUITypeProfileFullName,
   AutofillUITypeProfileCompanyName,
   AutofillUITypeProfileHomeAddressLine1,
diff --git a/ios/chrome/browser/ui/autofill/autofill_ui_type_util.mm b/ios/chrome/browser/ui/autofill/autofill_ui_type_util.mm
index 0b0cf8a..e9e0ed6 100644
--- a/ios/chrome/browser/ui/autofill/autofill_ui_type_util.mm
+++ b/ios/chrome/browser/ui/autofill/autofill_ui_type_util.mm
@@ -80,6 +80,7 @@
       return autofill::PHONE_HOME_WHOLE_NUMBER;
     case AutofillUITypeProfileEmailAddress:
       return autofill::EMAIL_ADDRESS;
+    case AutofillUITypeCreditCardBillingAddress:
     default:
       NOTREACHED();
       return autofill::UNKNOWN_TYPE;
diff --git a/ios/chrome/browser/ui/payments/cells/BUILD.gn b/ios/chrome/browser/ui/payments/cells/BUILD.gn
index 5dfd08d..4e0069c 100644
--- a/ios/chrome/browser/ui/payments/cells/BUILD.gn
+++ b/ios/chrome/browser/ui/payments/cells/BUILD.gn
@@ -13,6 +13,8 @@
     "payment_method_item.h",
     "payment_method_item.mm",
     "payments_has_accessory_type.h",
+    "payments_selector_edit_item.h",
+    "payments_selector_edit_item.mm",
     "payments_text_item.h",
     "payments_text_item.mm",
     "price_item.h",
@@ -21,6 +23,7 @@
 
   deps = [
     "//ios/chrome/browser/ui",
+    "//ios/chrome/browser/ui/autofill:autofill_ui",
     "//ios/chrome/browser/ui/collection_view/cells",
     "//ios/chrome/browser/ui/colors",
     "//ios/third_party/material_components_ios",
@@ -37,12 +40,14 @@
     "autofill_profile_item_unittest.mm",
     "page_info_item_unittest.mm",
     "payment_method_item_unittest.mm",
+    "payments_selector_edit_item_unittests.mm",
     "payments_text_item_unittest.mm",
     "price_item_unittest.mm",
   ]
 
   deps = [
     ":cells",
+    "//ios/chrome/browser/ui/collection_view/cells",
     "//ios/chrome/browser/ui/collection_view/cells:test_support",
     "//ios/third_party/material_components_ios",
     "//testing/gtest",
diff --git a/ios/chrome/browser/ui/payments/cells/payments_selector_edit_item.h b/ios/chrome/browser/ui/payments/cells/payments_selector_edit_item.h
new file mode 100644
index 0000000..b59b0712
--- /dev/null
+++ b/ios/chrome/browser/ui/payments/cells/payments_selector_edit_item.h
@@ -0,0 +1,49 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef IOS_CHROME_BROWSER_UI_PAYMENTS_CELLS_PAYMENTS_SELECTOR_EDIT_ITEM_H_
+#define IOS_CHROME_BROWSER_UI_PAYMENTS_CELLS_PAYMENTS_SELECTOR_EDIT_ITEM_H_
+
+#import <UIKit/UIKit.h>
+
+#import "ios/chrome/browser/ui/autofill/autofill_ui_type.h"
+#import "ios/chrome/browser/ui/collection_view/cells/collection_view_item.h"
+#import "ios/chrome/browser/ui/payments/cells/payments_has_accessory_type.h"
+
+// Item that configures a CollectionViewDetailCell in order to represent a
+// selector-backed editor form field.
+@interface PaymentsSelectorEditItem
+    : CollectionViewItem<PaymentsHasAccessoryType>
+
+// The name of the field.
+@property(nonatomic, nullable, copy) NSString* name;
+
+// The value of the field. This is displayed in the UI.
+@property(nonatomic, nullable, copy) NSString* value;
+
+// The field type this item is describing.
+@property(nonatomic, assign) AutofillUIType autofillUIType;
+
+// Whether this field is required. If YES, an "*" is appended to the name of the
+// text field to indicate that the field is required. It is also used for
+// validation purposes.
+@property(nonatomic, getter=isRequired) BOOL required;
+
+// The font of the name text. Default is the medium Roboto font of size 14.
+@property(nonatomic, null_resettable, copy) UIFont* nameFont;
+
+// The color of the name text. Default is the 900 tint color of the grey
+// palette.
+@property(nonatomic, null_resettable, copy) UIColor* nameColor;
+
+// The font of the value text. Default is the regular Roboto font of size 14.
+@property(nonatomic, null_resettable, copy) UIFont* valueFont;
+
+// The color of the value text. Default is the 600 tint color of the blue
+// palette.
+@property(nonatomic, null_resettable, copy) UIColor* valueColor;
+
+@end
+
+#endif  // IOS_CHROME_BROWSER_UI_PAYMENTS_CELLS_PAYMENTS_SELECTOR_EDIT_ITEM_H_
diff --git a/ios/chrome/browser/ui/payments/cells/payments_selector_edit_item.mm b/ios/chrome/browser/ui/payments/cells/payments_selector_edit_item.mm
new file mode 100644
index 0000000..5aef7f9
--- /dev/null
+++ b/ios/chrome/browser/ui/payments/cells/payments_selector_edit_item.mm
@@ -0,0 +1,79 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#import "ios/chrome/browser/ui/payments/cells/payments_selector_edit_item.h"
+
+#import "ios/chrome/browser/ui/collection_view/cells/collection_view_detail_item.h"
+#import "ios/chrome/browser/ui/colors/MDCPalette+CrAdditions.h"
+#import "ios/third_party/material_components_ios/src/components/Typography/src/MaterialTypography.h"
+
+#if !defined(__has_feature) || !__has_feature(objc_arc)
+#error "This file requires ARC support."
+#endif
+
+@implementation PaymentsSelectorEditItem
+
+@synthesize accessoryType = _accessoryType;
+@synthesize name = _name;
+@synthesize value = _value;
+@synthesize autofillUIType = _autofillUIType;
+@synthesize required = _required;
+@synthesize nameFont = _nameFont;
+@synthesize nameColor = _nameColor;
+@synthesize valueFont = _valueFont;
+@synthesize valueColor = _valueColor;
+
+- (instancetype)initWithType:(NSInteger)type {
+  self = [super initWithType:type];
+  if (self) {
+    self.cellClass = [CollectionViewDetailCell class];
+  }
+  return self;
+}
+
+- (UIFont*)nameFont {
+  if (!_nameFont) {
+    _nameFont = [MDCTypography body2Font];
+  }
+  return _nameFont;
+}
+
+- (UIColor*)nameColor {
+  if (!_nameColor) {
+    _nameColor = [[MDCPalette greyPalette] tint900];
+  }
+  return _nameColor;
+}
+
+- (UIFont*)valueFont {
+  if (!_valueFont) {
+    _valueFont = [MDCTypography body1Font];
+  }
+  return _valueFont;
+}
+
+- (UIColor*)valueColor {
+  if (!_valueColor) {
+    _valueColor = [[MDCPalette cr_bluePalette] tint600];
+  }
+  return _valueColor;
+}
+
+#pragma mark CollectionViewItem
+
+- (void)configureCell:(CollectionViewDetailCell*)cell {
+  [super configureCell:cell];
+  cell.accessoryType = self.accessoryType;
+  NSString* textLabelFormat = self.required ? @"%@*" : @"%@";
+  cell.textLabel.text = [NSString stringWithFormat:textLabelFormat, self.name];
+  cell.detailTextLabel.text = self.value;
+
+  // Styling.
+  cell.textLabel.font = self.nameFont;
+  cell.textLabel.textColor = self.nameColor;
+  cell.detailTextLabel.font = self.valueFont;
+  cell.detailTextLabel.textColor = self.valueColor;
+}
+
+@end
diff --git a/ios/chrome/browser/ui/payments/cells/payments_selector_edit_item_unittests.mm b/ios/chrome/browser/ui/payments/cells/payments_selector_edit_item_unittests.mm
new file mode 100644
index 0000000..de11de4
--- /dev/null
+++ b/ios/chrome/browser/ui/payments/cells/payments_selector_edit_item_unittests.mm
@@ -0,0 +1,44 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#import "ios/chrome/browser/ui/payments/cells/payments_selector_edit_item.h"
+
+#import "ios/chrome/browser/ui/collection_view/cells/collection_view_detail_item.h"
+#import "ios/chrome/browser/ui/collection_view/cells/test_utils.h"
+#include "testing/gtest/include/gtest/gtest.h"
+#include "testing/gtest_mac.h"
+
+#if !defined(__has_feature) || !__has_feature(objc_arc)
+#error "This file requires ARC support."
+#endif
+
+namespace {
+
+// Tests that the UILabels are set properly after a call to |configureCell:|.
+TEST(PaymentRequestPaymentsSelectorEditItemTest, TextLabels) {
+  PaymentsSelectorEditItem* item = [[PaymentsSelectorEditItem alloc] init];
+  NSString* name = @"Name text";
+  NSString* value = @"Value text";
+
+  item.name = name;
+  item.value = value;
+
+  id cell = [[[item cellClass] alloc] init];
+  ASSERT_TRUE([cell isMemberOfClass:[CollectionViewDetailCell class]]);
+
+  CollectionViewDetailCell* detailCell = cell;
+  EXPECT_FALSE(detailCell.textLabel.text);
+  EXPECT_FALSE(detailCell.detailTextLabel.text);
+
+  [item configureCell:cell];
+  EXPECT_NSEQ(name, detailCell.textLabel.text);
+  EXPECT_NSEQ(value, detailCell.detailTextLabel.text);
+
+  item.required = YES;
+  NSString* requiredName = [NSString stringWithFormat:@"%@*", name];
+  [item configureCell:cell];
+  EXPECT_NSEQ(requiredName, detailCell.textLabel.text);
+}
+
+}  // namespace
diff --git a/media/audio/cras/audio_manager_cras.cc b/media/audio/cras/audio_manager_cras.cc
index 49d9b87..118d384 100644
--- a/media/audio/cras/audio_manager_cras.cc
+++ b/media/audio/cras/audio_manager_cras.cc
@@ -50,8 +50,9 @@
 const char kBeamformingOnDeviceId[] = "default-beamforming-on";
 const char kBeamformingOffDeviceId[] = "default-beamforming-off";
 
-const char kInternalInputDevice[] = "Built-in mic";
-const char kInternalOutputDevice[] = "Built-in speaker";
+const char kInternalInputVirtualDevice[] = "Built-in mic";
+const char kInternalOutputVirtualDevice[] = "Built-in speaker";
+const char kHeadphoneLineOutVirtualDevice[] = "Headphone/Line Out";
 
 enum CrosBeamformingDeviceState {
   BEAMFORMING_DEFAULT_ENABLED = 0,
@@ -87,6 +88,27 @@
   return "";
 }
 
+// Process |device_list| that two shares the same dev_index by creating a
+// virtual device name for them.
+void ProcessVirtualDeviceName(AudioDeviceNames* device_names,
+                              const chromeos::AudioDeviceList& device_list) {
+  DCHECK_EQ(2, device_list.size());
+  if (device_list[0].type == chromeos::AUDIO_TYPE_LINEOUT ||
+      device_list[1].type == chromeos::AUDIO_TYPE_LINEOUT) {
+    device_names->emplace_back(kHeadphoneLineOutVirtualDevice,
+                               base::Uint64ToString(device_list[0].id));
+  } else if (device_list[0].type == chromeos::AUDIO_TYPE_INTERNAL_SPEAKER ||
+             device_list[1].type == chromeos::AUDIO_TYPE_INTERNAL_SPEAKER) {
+    device_names->emplace_back(kInternalOutputVirtualDevice,
+                               base::Uint64ToString(device_list[0].id));
+  } else {
+    DCHECK(device_list[0].type == chromeos::AUDIO_TYPE_INTERNAL_MIC ||
+           device_list[1].type == chromeos::AUDIO_TYPE_INTERNAL_MIC);
+    device_names->emplace_back(kInternalInputVirtualDevice,
+                               base::Uint64ToString(device_list[0].id));
+  }
+}
+
 }  // namespace
 
 // Adds the beamforming on and off devices to |device_names|.
@@ -169,36 +191,24 @@
     chromeos::AudioDeviceList devices;
     chromeos::CrasAudioHandler::Get()->GetAudioDevices(&devices);
 
-    int internal_input_dev_index = 0;
-    int internal_output_dev_index = 0;
+    // |dev_idx_map| is a map of dev_index and their audio devices.
+    std::map<int, chromeos::AudioDeviceList> dev_idx_map;
     for (const auto& device : devices) {
-      if (device.type == chromeos::AUDIO_TYPE_INTERNAL_MIC)
-        internal_input_dev_index = dev_index_of(device.id);
-      else if (device.type == chromeos::AUDIO_TYPE_INTERNAL_SPEAKER)
-        internal_output_dev_index = dev_index_of(device.id);
+      if (device.is_input != is_input || !device.is_for_simple_usage())
+        continue;
+
+      dev_idx_map[dev_index_of(device.id)].push_back(device);
     }
 
-    bool has_internal_input = false;
-    bool has_internal_output = false;
-    for (const auto& device : devices) {
-      if (device.is_input == is_input && device.is_for_simple_usage()) {
-        int dev_index = dev_index_of(device.id);
-        if (dev_index == internal_input_dev_index) {
-          if (!has_internal_input) {
-            device_names->emplace_back(kInternalInputDevice,
-                                       base::Uint64ToString(device.id));
-            has_internal_input = true;
-          }
-        } else if (dev_index == internal_output_dev_index) {
-          if (!has_internal_output) {
-            device_names->emplace_back(kInternalOutputDevice,
-                                       base::Uint64ToString(device.id));
-            has_internal_output = true;
-          }
-        } else {
-          device_names->emplace_back(device.display_name,
-                                     base::Uint64ToString(device.id));
-        }
+    for (const auto& item : dev_idx_map) {
+      if (1 == item.second.size()) {
+        const chromeos::AudioDevice& device = item.second.front();
+        device_names->emplace_back(device.display_name,
+                                   base::Uint64ToString(device.id));
+      } else {
+        // Create virtual device name for audio nodes that share the same device
+        // index.
+        ProcessVirtualDeviceName(device_names, item.second);
       }
     }
   }
diff --git a/media/audio/win/audio_low_latency_input_win.cc b/media/audio/win/audio_low_latency_input_win.cc
index 4169554..c105638c 100644
--- a/media/audio/win/audio_low_latency_input_win.cc
+++ b/media/audio/win/audio_low_latency_input_win.cc
@@ -528,24 +528,24 @@
     // Note that, in Windows Vista, the MMDevice API supports device roles
     // but the system-supplied user interface programs do not.
     hr = enumerator->GetDefaultAudioEndpoint(eCapture, eConsole,
-                                             endpoint_device_.Receive());
+                                             endpoint_device_.GetAddressOf());
   } else if (device_id_ == AudioDeviceDescription::kCommunicationsDeviceId) {
     hr = enumerator->GetDefaultAudioEndpoint(eCapture, eCommunications,
-                                             endpoint_device_.Receive());
+                                             endpoint_device_.GetAddressOf());
   } else if (device_id_ == AudioDeviceDescription::kLoopbackWithMuteDeviceId) {
     // Capture the default playback stream.
     hr = enumerator->GetDefaultAudioEndpoint(eRender, eConsole,
-                                             endpoint_device_.Receive());
+                                             endpoint_device_.GetAddressOf());
 
     endpoint_device_->Activate(__uuidof(IAudioEndpointVolume), CLSCTX_ALL, NULL,
                                &system_audio_volume_);
   } else if (device_id_ == AudioDeviceDescription::kLoopbackInputDeviceId) {
     // Capture the default playback stream.
     hr = enumerator->GetDefaultAudioEndpoint(eRender, eConsole,
-                                             endpoint_device_.Receive());
+                                             endpoint_device_.GetAddressOf());
   } else {
     hr = enumerator->GetDevice(base::UTF8ToUTF16(device_id_).c_str(),
-                               endpoint_device_.Receive());
+                               endpoint_device_.GetAddressOf());
   }
 
   if (FAILED(hr)) {
diff --git a/media/audio/win/core_audio_util_win.cc b/media/audio/win/core_audio_util_win.cc
index 57df0db..731352c4 100644
--- a/media/audio/win/core_audio_util_win.cc
+++ b/media/audio/win/core_audio_util_win.cc
@@ -155,7 +155,7 @@
   // Retrieve user-friendly name of endpoint device.
   // Example: "Microphone (Realtek High Definition Audio)".
   ScopedComPtr<IPropertyStore> properties;
-  HRESULT hr = device->OpenPropertyStore(STGM_READ, properties.Receive());
+  HRESULT hr = device->OpenPropertyStore(STGM_READ, properties.GetAddressOf());
   if (FAILED(hr))
     return hr;
 
@@ -261,9 +261,8 @@
   // devices for the specified data-flow direction.
   // This method will succeed even if all devices are disabled.
   ScopedComPtr<IMMDeviceCollection> collection;
-  HRESULT hr = device_enumerator->EnumAudioEndpoints(data_flow,
-                                                     DEVICE_STATE_ACTIVE,
-                                                     collection.Receive());
+  HRESULT hr = device_enumerator->EnumAudioEndpoints(
+      data_flow, DEVICE_STATE_ACTIVE, collection.GetAddressOf());
   if (FAILED(hr)) {
     LOG(ERROR) << "IMMDeviceCollection::EnumAudioEndpoints: " << std::hex << hr;
     return 0;
@@ -294,7 +293,7 @@
   // Retrieve the default audio endpoint for the specified data-flow
   // direction and role.
   HRESULT hr = device_enumerator->GetDefaultAudioEndpoint(
-      data_flow, role, endpoint_device.Receive());
+      data_flow, role, endpoint_device.GetAddressOf());
 
   if (FAILED(hr)) {
     DVLOG(1) << "IMMDeviceEnumerator::GetDefaultAudioEndpoint: "
@@ -329,7 +328,7 @@
   // Retrieve an audio device specified by an endpoint device-identification
   // string.
   HRESULT hr = device_enumerator->GetDevice(
-      base::UTF8ToUTF16(device_id).c_str(), endpoint_device.Receive());
+      base::UTF8ToUTF16(device_id).c_str(), endpoint_device.GetAddressOf());
   DVLOG_IF(1, FAILED(hr)) << "IMMDeviceEnumerator::GetDevice: "
                           << std::hex << hr;
 
@@ -377,11 +376,11 @@
   ScopedComPtr<IConnector> connector;
   ScopedCoMem<WCHAR> filter_id;
   if (FAILED(device->Activate(__uuidof(IDeviceTopology), CLSCTX_ALL, NULL,
-             &topology)) ||
+                              &topology)) ||
       // For our purposes checking the first connected device should be enough
       // and if there are cases where there are more than one device connected
       // we're not sure how to handle that anyway. So we pass 0.
-      FAILED(topology->GetConnector(0, connector.Receive())) ||
+      FAILED(topology->GetConnector(0, connector.GetAddressOf())) ||
       FAILED(connector->GetDeviceIdConnectedTo(&filter_id))) {
     DLOG(ERROR) << "Failed to get the device identifier of the audio device";
     return std::string();
@@ -393,8 +392,9 @@
   ScopedComPtr<IMMDevice> device_node;
   ScopedComPtr<IPropertyStore> properties;
   base::win::ScopedPropVariant instance_id;
-  if (FAILED(enumerator->GetDevice(filter_id, device_node.Receive())) ||
-      FAILED(device_node->OpenPropertyStore(STGM_READ, properties.Receive())) ||
+  if (FAILED(enumerator->GetDevice(filter_id, device_node.GetAddressOf())) ||
+      FAILED(device_node->OpenPropertyStore(STGM_READ,
+                                            properties.GetAddressOf())) ||
       FAILED(properties->GetValue(PKEY_Device_InstanceId,
                                   instance_id.Receive())) ||
       instance_id.get().vt != VT_LPWSTR) {
@@ -445,7 +445,7 @@
   // them is associated with the same controller.
   ScopedComPtr<IMMDeviceCollection> collection;
   enumerator->EnumAudioEndpoints(eRender, DEVICE_STATE_ACTIVE,
-      collection.Receive());
+                                 collection.GetAddressOf());
   if (!collection.Get())
     return std::string();
 
@@ -453,7 +453,7 @@
   collection->GetCount(&count);
   ScopedComPtr<IMMDevice> output_device;
   for (UINT i = 0; i < count; ++i) {
-    collection->Item(i, output_device.Receive());
+    collection->Item(i, output_device.GetAddressOf());
     std::string output_controller_id(
         GetAudioControllerID(output_device.Get(), enumerator.Get()));
     if (output_controller_id == controller_id)
@@ -490,7 +490,7 @@
 
 EDataFlow CoreAudioUtil::GetDataFlow(IMMDevice* device) {
   ScopedComPtr<IMMEndpoint> endpoint;
-  HRESULT hr = device->QueryInterface(endpoint.Receive());
+  HRESULT hr = device->QueryInterface(endpoint.GetAddressOf());
   if (FAILED(hr)) {
     DVLOG(1) << "IMMDevice::QueryInterface: " << std::hex << hr;
     return eAll;
@@ -890,7 +890,7 @@
     return false;
 
   ScopedComPtr<IDxDiagContainer, &IID_IDxDiagContainer> root;
-  hr = provider->GetRootContainer(root.Receive());
+  hr = provider->GetRootContainer(root.GetAddressOf());
   if (FAILED(hr))
     return false;
 
@@ -898,7 +898,7 @@
   // enormous and only this branch contains useful information.
   ScopedComPtr<IDxDiagContainer, &IID_IDxDiagContainer> sound_devices;
   hr = root->GetChildContainer(L"DxDiag_DirectSound.DxDiag_SoundDevices.0",
-                               sound_devices.Receive());
+                               sound_devices.GetAddressOf());
   if (FAILED(hr))
     return false;
 
diff --git a/media/audio/win/core_audio_util_win_unittest.cc b/media/audio/win/core_audio_util_win_unittest.cc
index 6a13f26..215d425 100644
--- a/media/audio/win/core_audio_util_win_unittest.cc
+++ b/media/audio/win/core_audio_util_win_unittest.cc
@@ -159,13 +159,13 @@
   EDataFlow flows[] = { eRender , eCapture };
   for (size_t i = 0; i < arraysize(flows); ++i) {
     ScopedComPtr<IMMDeviceCollection> collection;
-    ASSERT_TRUE(SUCCEEDED(enumerator->EnumAudioEndpoints(flows[i],
-        DEVICE_STATE_ACTIVE, collection.Receive())));
+    ASSERT_TRUE(SUCCEEDED(enumerator->EnumAudioEndpoints(
+        flows[i], DEVICE_STATE_ACTIVE, collection.GetAddressOf())));
     UINT count = 0;
     collection->GetCount(&count);
     for (UINT j = 0; j < count; ++j) {
       ScopedComPtr<IMMDevice> device;
-      collection->Item(j, device.Receive());
+      collection->Item(j, device.GetAddressOf());
       std::string controller_id(
           CoreAudioUtil::GetAudioControllerID(device.Get(), enumerator.Get()));
       EXPECT_FALSE(controller_id.empty());
@@ -485,13 +485,13 @@
   // Enumerate all active input and output devices and fetch the ID of
   // the associated device.
   ScopedComPtr<IMMDeviceCollection> collection;
-  ASSERT_TRUE(SUCCEEDED(enumerator->EnumAudioEndpoints(eCapture,
-      DEVICE_STATE_ACTIVE, collection.Receive())));
+  ASSERT_TRUE(SUCCEEDED(enumerator->EnumAudioEndpoints(
+      eCapture, DEVICE_STATE_ACTIVE, collection.GetAddressOf())));
   UINT count = 0;
   collection->GetCount(&count);
   for (UINT i = 0; i < count && !found_a_pair; ++i) {
     ScopedComPtr<IMMDevice> device;
-    collection->Item(i, device.Receive());
+    collection->Item(i, device.GetAddressOf());
     base::win::ScopedCoMem<WCHAR> wide_id;
     device->GetId(&wide_id);
     std::string id;
diff --git a/media/audio/win/device_enumeration_win.cc b/media/audio/win/device_enumeration_win.cc
index b333204..894b61c 100644
--- a/media/audio/win/device_enumeration_win.cc
+++ b/media/audio/win/device_enumeration_win.cc
@@ -41,7 +41,7 @@
   // This method will succeed even if all devices are disabled.
   ScopedComPtr<IMMDeviceCollection> collection;
   hr = enumerator->EnumAudioEndpoints(data_flow, DEVICE_STATE_ACTIVE,
-                                      collection.Receive());
+                                      collection.GetAddressOf());
   if (FAILED(hr))
     return false;
 
@@ -59,7 +59,7 @@
     // Retrieve unique name of endpoint device.
     // Example: "{0.0.1.00000000}.{8db6020f-18e3-4f25-b6f5-7726c9122574}".
     ScopedComPtr<IMMDevice> audio_device;
-    hr = collection->Item(i, audio_device.Receive());
+    hr = collection->Item(i, audio_device.GetAddressOf());
     if (FAILED(hr))
       continue;
 
@@ -72,7 +72,7 @@
     // Retrieve user-friendly name of endpoint device.
     // Example: "Microphone (Realtek High Definition Audio)".
     ScopedComPtr<IPropertyStore> properties;
-    hr = audio_device->OpenPropertyStore(STGM_READ, properties.Receive());
+    hr = audio_device->OpenPropertyStore(STGM_READ, properties.GetAddressOf());
     if (SUCCEEDED(hr)) {
       base::win::ScopedPropVariant friendly_name;
       hr = properties->GetValue(PKEY_Device_FriendlyName,
diff --git a/media/base/win/mf_helpers.cc b/media/base/win/mf_helpers.cc
index b04ef674..9322b0c 100644
--- a/media/base/win/mf_helpers.cc
+++ b/media/base/win/mf_helpers.cc
@@ -19,7 +19,7 @@
   CHECK_GT(buffer_length, 0U);
 
   base::win::ScopedComPtr<IMFSample> sample;
-  HRESULT hr = MFCreateSample(sample.Receive());
+  HRESULT hr = MFCreateSample(sample.GetAddressOf());
   RETURN_ON_HR_FAILURE(hr, "MFCreateSample failed",
                        base::win::ScopedComPtr<IMFSample>());
 
@@ -27,10 +27,10 @@
   if (align == 0) {
     // Note that MFCreateMemoryBuffer is same as MFCreateAlignedMemoryBuffer
     // with the align argument being 0.
-    hr = MFCreateMemoryBuffer(buffer_length, buffer.Receive());
+    hr = MFCreateMemoryBuffer(buffer_length, buffer.GetAddressOf());
   } else {
-    hr =
-        MFCreateAlignedMemoryBuffer(buffer_length, align - 1, buffer.Receive());
+    hr = MFCreateAlignedMemoryBuffer(buffer_length, align - 1,
+                                     buffer.GetAddressOf());
   }
   RETURN_ON_HR_FAILURE(hr, "Failed to create memory buffer for sample",
                        base::win::ScopedComPtr<IMFSample>());
diff --git a/media/capture/video/win/video_capture_device_factory_win.cc b/media/capture/video/win/video_capture_device_factory_win.cc
index c88bed3..78a11f9 100644
--- a/media/capture/video/win/video_capture_device_factory_win.cc
+++ b/media/capture/video/win/video_capture_device_factory_win.cc
@@ -95,7 +95,8 @@
 static bool CreateVideoCaptureDeviceMediaFoundation(const char* sym_link,
                                                     IMFMediaSource** source) {
   ScopedComPtr<IMFAttributes> attributes;
-  if (!PrepareVideoCaptureAttributesMediaFoundation(attributes.Receive(), 2))
+  if (!PrepareVideoCaptureAttributesMediaFoundation(attributes.GetAddressOf(),
+                                                    2))
     return false;
 
   attributes->SetString(MF_DEVSOURCE_ATTRIBUTE_SOURCE_TYPE_VIDCAP_SYMBOLIC_LINK,
@@ -107,7 +108,8 @@
 static bool EnumerateVideoDevicesMediaFoundation(IMFActivate*** devices,
                                                  UINT32* count) {
   ScopedComPtr<IMFAttributes> attributes;
-  if (!PrepareVideoCaptureAttributesMediaFoundation(attributes.Receive(), 1))
+  if (!PrepareVideoCaptureAttributesMediaFoundation(attributes.GetAddressOf(),
+                                                    1))
     return false;
 
   return SUCCEEDED(MFEnumDeviceSources(attributes.Get(), devices, count));
@@ -160,7 +162,7 @@
 
   ScopedComPtr<IEnumMoniker> enum_moniker;
   hr = dev_enum->CreateClassEnumerator(CLSID_VideoInputDeviceCategory,
-                                       enum_moniker.Receive(), 0);
+                                       enum_moniker.GetAddressOf(), 0);
   // CreateClassEnumerator returns S_FALSE on some Windows OS
   // when no camera exist. Therefore the FAILED macro can't be used.
   if (hr != S_OK)
@@ -168,7 +170,7 @@
 
   // Enumerate all video capture devices.
   for (ScopedComPtr<IMoniker> moniker;
-       enum_moniker->Next(1, moniker.Receive(), NULL) == S_OK;
+       enum_moniker->Next(1, moniker.GetAddressOf(), NULL) == S_OK;
        moniker.Reset()) {
     ScopedComPtr<IPropertyBag> prop_bag;
     hr = moniker->BindToStorage(0, 0, IID_PPV_ARGS(&prop_bag));
@@ -251,7 +253,7 @@
 
   ScopedComPtr<IEnumMoniker> enum_moniker;
   hr = dev_enum->CreateClassEnumerator(CLSID_VideoInputDeviceCategory,
-                                       enum_moniker.Receive(), 0);
+                                       enum_moniker.GetAddressOf(), 0);
   // CreateClassEnumerator returns S_FALSE on some Windows OS when no camera
   // exists. Therefore the FAILED macro can't be used.
   if (hr != S_OK)
@@ -262,7 +264,7 @@
   // VFW devices are already skipped previously in GetDeviceNames() enumeration.
   base::win::ScopedComPtr<IBaseFilter> capture_filter;
   hr = VideoCaptureDeviceWin::GetDeviceFilter(descriptor.device_id,
-                                              capture_filter.Receive());
+                                              capture_filter.GetAddressOf());
   if (!capture_filter.Get()) {
     DLOG(ERROR) << "Failed to create capture filter: "
                 << logging::SystemErrorCodeToString(hr);
@@ -278,7 +280,7 @@
   }
 
   ScopedComPtr<IAMStreamConfig> stream_config;
-  hr = output_capture_pin.CopyTo(stream_config.Receive());
+  hr = output_capture_pin.CopyTo(stream_config.GetAddressOf());
   if (FAILED(hr)) {
     DLOG(ERROR) << "Failed to get IAMStreamConfig interface from "
                    "capture device: " << logging::SystemErrorCodeToString(hr);
@@ -335,13 +337,13 @@
            << descriptor.display_name;
   ScopedComPtr<IMFMediaSource> source;
   if (!CreateVideoCaptureDeviceMediaFoundation(descriptor.device_id.c_str(),
-                                               source.Receive())) {
+                                               source.GetAddressOf())) {
     return;
   }
 
   base::win::ScopedComPtr<IMFSourceReader> reader;
-  HRESULT hr =
-      MFCreateSourceReaderFromMediaSource(source.Get(), NULL, reader.Receive());
+  HRESULT hr = MFCreateSourceReaderFromMediaSource(source.Get(), NULL,
+                                                   reader.GetAddressOf());
   if (FAILED(hr)) {
     DLOG(ERROR) << "MFCreateSourceReaderFromMediaSource failed: "
                 << logging::SystemErrorCodeToString(hr);
@@ -351,7 +353,7 @@
   DWORD stream_index = 0;
   ScopedComPtr<IMFMediaType> type;
   while (SUCCEEDED(reader->GetNativeMediaType(kFirstVideoStream, stream_index,
-                                              type.Receive()))) {
+                                              type.GetAddressOf()))) {
     UINT32 width, height;
     hr = MFGetAttributeSize(type.Get(), MF_MT_FRAME_SIZE, &width, &height);
     if (FAILED(hr)) {
@@ -424,7 +426,7 @@
     DVLOG(1) << " MediaFoundation Device: " << device_descriptor.display_name;
     ScopedComPtr<IMFMediaSource> source;
     if (!CreateVideoCaptureDeviceMediaFoundation(
-            device_descriptor.device_id.c_str(), source.Receive())) {
+            device_descriptor.device_id.c_str(), source.GetAddressOf())) {
       return std::unique_ptr<VideoCaptureDevice>();
     }
     if (!static_cast<VideoCaptureDeviceMFWin*>(device.get())->Init(source))
diff --git a/media/capture/video/win/video_capture_device_mf_win.cc b/media/capture/video/win/video_capture_device_mf_win.cc
index ea1abd7f..6c91d20 100644
--- a/media/capture/video/win/video_capture_device_mf_win.cc
+++ b/media/capture/video/win/video_capture_device_mf_win.cc
@@ -63,7 +63,7 @@
   ScopedComPtr<IMFMediaType> type;
   HRESULT hr;
   while (SUCCEEDED(hr = source->GetNativeMediaType(
-                       kFirstVideoStream, stream_index, type.Receive()))) {
+                       kFirstVideoStream, stream_index, type.GetAddressOf()))) {
     VideoCaptureFormat format;
     if (FillFormat(type.Get(), &format))
       capabilities->emplace_back(stream_index, format);
@@ -123,7 +123,7 @@
 
     for (DWORD i = 0; i < count; ++i) {
       ScopedComPtr<IMFMediaBuffer> buffer;
-      sample->GetBufferByIndex(i, buffer.Receive());
+      sample->GetBufferByIndex(i, buffer.GetAddressOf());
       if (buffer.Get()) {
         DWORD length = 0, max_length = 0;
         BYTE* data = NULL;
@@ -202,14 +202,14 @@
   DCHECK(!reader_.Get());
 
   ScopedComPtr<IMFAttributes> attributes;
-  MFCreateAttributes(attributes.Receive(), 1);
+  MFCreateAttributes(attributes.GetAddressOf(), 1);
   DCHECK(attributes.Get());
 
   callback_ = new MFReaderCallback(this);
   attributes->SetUnknown(MF_SOURCE_READER_ASYNC_CALLBACK, callback_.get());
 
   return SUCCEEDED(MFCreateSourceReaderFromMediaSource(
-      source.Get(), attributes.Get(), reader_.Receive()));
+      source.Get(), attributes.Get(), reader_.GetAddressOf()));
 }
 
 void VideoCaptureDeviceMFWin::AllocateAndStart(
@@ -230,8 +230,9 @@
       const CapabilityWin found_capability =
           GetBestMatchedCapability(params.requested_format, capabilities);
       ScopedComPtr<IMFMediaType> type;
-      hr = reader_->GetNativeMediaType(
-          kFirstVideoStream, found_capability.stream_index, type.Receive());
+      hr = reader_->GetNativeMediaType(kFirstVideoStream,
+                                       found_capability.stream_index,
+                                       type.GetAddressOf());
       if (SUCCEEDED(hr)) {
         hr = reader_->SetCurrentMediaType(kFirstVideoStream, NULL, type.Get());
         if (SUCCEEDED(hr)) {
diff --git a/media/capture/video/win/video_capture_device_win.cc b/media/capture/video/win/video_capture_device_win.cc
index 43bd83a..3811b58 100644
--- a/media/capture/video/win/video_capture_device_win.cc
+++ b/media/capture/video/win/video_capture_device_win.cc
@@ -116,7 +116,7 @@
 
   ScopedComPtr<IEnumMoniker> enum_moniker;
   hr = dev_enum->CreateClassEnumerator(CLSID_VideoInputDeviceCategory,
-                                       enum_moniker.Receive(), 0);
+                                       enum_moniker.GetAddressOf(), 0);
   // CreateClassEnumerator returns S_FALSE on some Windows OS
   // when no camera exist. Therefore the FAILED macro can't be used.
   if (hr != S_OK)
@@ -124,7 +124,7 @@
 
   ScopedComPtr<IBaseFilter> capture_filter;
   for (ScopedComPtr<IMoniker> moniker;
-       enum_moniker->Next(1, moniker.Receive(), NULL) == S_OK;
+       enum_moniker->Next(1, moniker.GetAddressOf(), NULL) == S_OK;
        moniker.Reset()) {
     ScopedComPtr<IPropertyBag> prop_bag;
     hr = moniker->BindToStorage(0, 0, IID_PPV_ARGS(&prop_bag));
@@ -171,13 +171,13 @@
                                                  REFGUID major_type) {
   ScopedComPtr<IPin> pin;
   ScopedComPtr<IEnumPins> pin_enum;
-  HRESULT hr = filter->EnumPins(pin_enum.Receive());
+  HRESULT hr = filter->EnumPins(pin_enum.GetAddressOf());
   if (pin_enum.Get() == NULL)
     return pin;
 
   // Get first unconnected pin.
   hr = pin_enum->Reset();  // set to first pin
-  while ((hr = pin_enum->Next(1, pin.Receive(), NULL)) == S_OK) {
+  while ((hr = pin_enum->Next(1, pin.GetAddressOf(), NULL)) == S_OK) {
     PIN_DIRECTION this_pin_dir = static_cast<PIN_DIRECTION>(-1);
     hr = pin->QueryDirection(&this_pin_dir);
     if (pin_dir == this_pin_dir) {
@@ -294,7 +294,8 @@
   DCHECK(thread_checker_.CalledOnValidThread());
   HRESULT hr;
 
-  hr = GetDeviceFilter(device_descriptor_.device_id, capture_filter_.Receive());
+  hr = GetDeviceFilter(device_descriptor_.device_id,
+                       capture_filter_.GetAddressOf());
   DLOG_IF_FAILED_WITH_HRESULT("Failed to create capture filter", hr);
   if (!capture_filter_.Get())
     return false;
@@ -333,7 +334,7 @@
   if (FAILED(hr))
     return false;
 
-  hr = graph_builder_.CopyTo(media_control_.Receive());
+  hr = graph_builder_.CopyTo(media_control_.GetAddressOf());
   DLOG_IF_FAILED_WITH_HRESULT("Failed to create media control builder", hr);
   if (FAILED(hr))
     return false;
@@ -358,11 +359,11 @@
 
   hr = capture_graph_builder_->FindInterface(
       &PIN_CATEGORY_CAPTURE, &MEDIATYPE_Interleaved, capture_filter_.Get(),
-      IID_IAMStreamConfig, (void**)stream_config.Receive());
+      IID_IAMStreamConfig, (void**)stream_config.GetAddressOf());
   if (FAILED(hr)) {
     hr = capture_graph_builder_->FindInterface(
         &PIN_CATEGORY_CAPTURE, &MEDIATYPE_Video, capture_filter_.Get(),
-        IID_IAMStreamConfig, (void**)stream_config.Receive());
+        IID_IAMStreamConfig, (void**)stream_config.GetAddressOf());
     DLOG_IF_FAILED_WITH_HRESULT("Failed to find CapFilter:IAMStreamConfig", hr);
   }
 
@@ -389,7 +390,7 @@
                found_capability.supported_format.frame_rate);
 
   ScopedComPtr<IAMStreamConfig> stream_config;
-  HRESULT hr = output_capture_pin_.CopyTo(stream_config.Receive());
+  HRESULT hr = output_capture_pin_.CopyTo(stream_config.GetAddressOf());
   if (FAILED(hr)) {
     SetErrorState(FROM_HERE, "Can't get the Capture format settings", hr);
     return;
@@ -497,7 +498,7 @@
   DCHECK(thread_checker_.CalledOnValidThread());
 
   base::win::ScopedComPtr<IKsTopologyInfo> info;
-  HRESULT hr = capture_filter_.CopyTo(info.Receive());
+  HRESULT hr = capture_filter_.CopyTo(info.GetAddressOf());
   if (FAILED(hr)) {
     SetErrorState(FROM_HERE, "Failed to obtain the topology info.", hr);
     return;
@@ -517,7 +518,7 @@
   for (size_t i = 0; i < num_nodes; i++) {
     info->get_NodeType(i, &node_type);
     if (IsEqualGUID(node_type, KSNODETYPE_VIDEO_CAMERA_TERMINAL)) {
-      hr = info->CreateNodeInstance(i, IID_PPV_ARGS(camera_control.Receive()));
+      hr = info->CreateNodeInstance(i, IID_PPV_ARGS(&camera_control));
       if (SUCCEEDED(hr))
         break;
       SetErrorState(FROM_HERE, "Failed to retrieve the ICameraControl.", hr);
@@ -530,7 +531,7 @@
   for (size_t i = 0; i < num_nodes; i++) {
     info->get_NodeType(i, &node_type);
     if (IsEqualGUID(node_type, KSNODETYPE_VIDEO_PROCESSING)) {
-      hr = info->CreateNodeInstance(i, IID_PPV_ARGS(video_control.Receive()));
+      hr = info->CreateNodeInstance(i, IID_PPV_ARGS(&video_control));
       if (SUCCEEDED(hr))
         break;
       SetErrorState(FROM_HERE, "Failed to retrieve the IVideoProcAmp.", hr);
@@ -649,7 +650,7 @@
 bool VideoCaptureDeviceWin::CreateCapabilityMap() {
   DCHECK(thread_checker_.CalledOnValidThread());
   ScopedComPtr<IAMStreamConfig> stream_config;
-  HRESULT hr = output_capture_pin_.CopyTo(stream_config.Receive());
+  HRESULT hr = output_capture_pin_.CopyTo(stream_config.GetAddressOf());
   DLOG_IF_FAILED_WITH_HRESULT(
       "Failed to get IAMStreamConfig from capture device", hr);
   if (FAILED(hr))
@@ -657,7 +658,7 @@
 
   // Get interface used for getting the frame rate.
   ScopedComPtr<IAMVideoControl> video_control;
-  hr = capture_filter_.CopyTo(video_control.Receive());
+  hr = capture_filter_.CopyTo(video_control.GetAddressOf());
 
   int count = 0, size = 0;
   hr = stream_config->GetNumberOfCapabilities(&count, &size);
diff --git a/media/gpu/d3d11_h264_accelerator.cc b/media/gpu/d3d11_h264_accelerator.cc
index b325f68..1eb18bc 100644
--- a/media/gpu/d3d11_h264_accelerator.cc
+++ b/media/gpu/d3d11_h264_accelerator.cc
@@ -48,7 +48,7 @@
   view_desc.Texture2D.ArraySlice = (UINT)level_;
 
   HRESULT hr = video_device->CreateVideoDecoderOutputView(
-      texture.Get(), &view_desc, output_view_.Receive());
+      texture.Get(), &view_desc, output_view_.GetAddressOf());
 
   CHECK(SUCCEEDED(hr));
   EGLDisplay egl_display = gl::GLSurfaceEGL::GetHardwareDisplay();
diff --git a/media/gpu/d3d11_video_decode_accelerator_win.cc b/media/gpu/d3d11_video_decode_accelerator_win.cc
index 31acce7..386bdac 100644
--- a/media/gpu/d3d11_video_decode_accelerator_win.cc
+++ b/media/gpu/d3d11_video_decode_accelerator_win.cc
@@ -48,12 +48,12 @@
   make_context_current_cb_.Run();
 
   device_ = gl::QueryD3D11DeviceObjectFromANGLE();
-  device_->GetImmediateContext(device_context_.Receive());
+  device_->GetImmediateContext(device_context_.GetAddressOf());
 
-  HRESULT hr = device_context_.CopyTo(video_context_.Receive());
+  HRESULT hr = device_context_.CopyTo(video_context_.GetAddressOf());
   CHECK(SUCCEEDED(hr));
 
-  hr = device_.CopyTo(video_device_.Receive());
+  hr = device_.CopyTo(video_device_.GetAddressOf());
   CHECK(SUCCEEDED(hr));
 
   bool is_h264 =
@@ -104,7 +104,7 @@
 
   base::win::ScopedComPtr<ID3D11VideoDecoder> video_decoder;
   hr = video_device_->CreateVideoDecoder(&desc, &dec_config,
-                                         video_decoder.Receive());
+                                         video_decoder.GetAddressOf());
   CHECK(video_decoder.Get());
 
   h264_accelerator_.reset(new D3D11H264Accelerator(
@@ -178,8 +178,8 @@
   texture_desc.MiscFlags = D3D11_RESOURCE_MISC_SHARED;
 
   base::win::ScopedComPtr<ID3D11Texture2D> out_texture;
-  HRESULT hr =
-      device_->CreateTexture2D(&texture_desc, nullptr, out_texture.Receive());
+  HRESULT hr = device_->CreateTexture2D(&texture_desc, nullptr,
+                                        out_texture.GetAddressOf());
   CHECK(SUCCEEDED(hr));
 
   make_context_current_cb_.Run();
diff --git a/media/gpu/dxva_picture_buffer_win.cc b/media/gpu/dxva_picture_buffer_win.cc
index e7394567..0defe96 100644
--- a/media/gpu/dxva_picture_buffer_win.cc
+++ b/media/gpu/dxva_picture_buffer_win.cc
@@ -237,7 +237,7 @@
                          : D3D11_RESOURCE_MISC_SHARED;
 
     HRESULT hr = decoder.d3d11_device_->CreateTexture2D(
-        &desc, nullptr, dx11_decoding_texture_.Receive());
+        &desc, nullptr, dx11_decoding_texture_.GetAddressOf());
     RETURN_ON_HR_FAILURE(hr, "Failed to create texture", false);
     if (decoder.use_keyed_mutex_) {
       hr = dx11_keyed_mutex_.QueryFrom(dx11_decoding_texture_.Get());
@@ -256,7 +256,8 @@
     hr = decoder.d3d9_device_ex_->CreateTexture(
         picture_buffer_.size().width(), picture_buffer_.size().height(), 1,
         D3DUSAGE_RENDERTARGET, use_rgb ? D3DFMT_X8R8G8B8 : D3DFMT_A8R8G8B8,
-        D3DPOOL_DEFAULT, decoding_texture_.Receive(), &texture_share_handle_);
+        D3DPOOL_DEFAULT, decoding_texture_.GetAddressOf(),
+        &texture_share_handle_);
     RETURN_ON_HR_FAILURE(hr, "Failed to create texture", false);
     RETURN_ON_FAILURE(texture_share_handle_, "Failed to query shared handle",
                       false);
@@ -318,7 +319,7 @@
   // references will be released when we receive a notification that the
   // copy was completed or when the DXVAPictureBuffer instance is destroyed.
   // We hold references here as it is easier to manage their lifetimes.
-  hr = decoding_texture_->GetSurfaceLevel(0, target_surface_.Receive());
+  hr = decoding_texture_->GetSurfaceLevel(0, target_surface_.GetAddressOf());
   RETURN_ON_HR_FAILURE(hr, "Failed to get surface from texture", false);
 
   decoder_surface_ = dest_surface;
@@ -482,14 +483,15 @@
 
   base::win::ScopedComPtr<IMFMediaBuffer> output_buffer;
   HRESULT hr =
-      current_d3d_sample_->GetBufferByIndex(0, output_buffer.Receive());
+      current_d3d_sample_->GetBufferByIndex(0, output_buffer.GetAddressOf());
   RETURN_ON_HR_FAILURE(hr, "Failed to get buffer from output sample", false);
 
   base::win::ScopedComPtr<IMFDXGIBuffer> dxgi_buffer;
   hr = dxgi_buffer.QueryFrom(output_buffer.Get());
   RETURN_ON_HR_FAILURE(hr, "Failed to get DXGIBuffer from output sample",
                        false);
-  hr = dxgi_buffer->GetResource(IID_PPV_ARGS(dx11_decoding_texture_.Receive()));
+  hr = dxgi_buffer->GetResource(
+      IID_PPV_ARGS(dx11_decoding_texture_.GetAddressOf()));
   RETURN_ON_HR_FAILURE(hr, "Failed to get texture from output sample", false);
   UINT subresource;
   dxgi_buffer->GetSubresourceIndex(&subresource);
@@ -585,7 +587,7 @@
   desc.MiscFlags = D3D11_RESOURCE_MISC_SHARED_KEYEDMUTEX;
 
   HRESULT hr = decoder.d3d11_device_->CreateTexture2D(
-      &desc, nullptr, decoder_copy_texture_.Receive());
+      &desc, nullptr, decoder_copy_texture_.GetAddressOf());
   RETURN_ON_HR_FAILURE(hr, "Failed to create texture", false);
   DCHECK(decoder.use_keyed_mutex_);
   hr = dx11_keyed_mutex_.QueryFrom(decoder_copy_texture_.Get());
@@ -599,7 +601,7 @@
                     "Failed to query shared handle", false);
 
   hr = decoder.angle_device_->OpenSharedResource(
-      texture_share_handle_, IID_PPV_ARGS(angle_copy_texture_.Receive()));
+      texture_share_handle_, IID_PPV_ARGS(angle_copy_texture_.GetAddressOf()));
   RETURN_ON_HR_FAILURE(hr, "Failed to open shared resource", false);
   hr = egl_keyed_mutex_.QueryFrom(angle_copy_texture_.Get());
   RETURN_ON_HR_FAILURE(hr, "Failed to get ANGLE mutex", false);
diff --git a/media/gpu/dxva_video_decode_accelerator_win.cc b/media/gpu/dxva_video_decode_accelerator_win.cc
index aac2695..e60de7e14a 100644
--- a/media/gpu/dxva_video_decode_accelerator_win.cc
+++ b/media/gpu/dxva_video_decode_accelerator_win.cc
@@ -291,7 +291,7 @@
                     base::win::ScopedComPtr<IMFSample>());
 
   base::win::ScopedComPtr<IMFMediaBuffer> buffer;
-  HRESULT hr = sample->GetBufferByIndex(0, buffer.Receive());
+  HRESULT hr = sample->GetBufferByIndex(0, buffer.GetAddressOf());
   RETURN_ON_HR_FAILURE(hr, "Failed to get buffer from sample",
                        base::win::ScopedComPtr<IMFSample>());
 
@@ -656,7 +656,7 @@
 
   HRESULT hr = E_FAIL;
 
-  hr = Direct3DCreate9Ex(D3D_SDK_VERSION, d3d9_.Receive());
+  hr = Direct3DCreate9Ex(D3D_SDK_VERSION, d3d9_.GetAddressOf());
   RETURN_ON_HR_FAILURE(hr, "Direct3DCreate9Ex failed", false);
 
   hr = d3d9_->CheckDeviceFormatConversion(
@@ -692,19 +692,19 @@
         D3DADAPTER_DEFAULT, D3DDEVTYPE_HAL, NULL,
         D3DCREATE_FPU_PRESERVE | D3DCREATE_MIXED_VERTEXPROCESSING |
             D3DCREATE_MULTITHREADED,
-        &present_params, NULL, d3d9_device_ex_.Receive());
+        &present_params, NULL, d3d9_device_ex_.GetAddressOf());
     RETURN_ON_HR_FAILURE(hr, "Failed to create D3D device", false);
   }
 
   hr = DXVA2CreateDirect3DDeviceManager9(&dev_manager_reset_token_,
-                                         device_manager_.Receive());
+                                         device_manager_.GetAddressOf());
   RETURN_ON_HR_FAILURE(hr, "DXVA2CreateDirect3DDeviceManager9 failed", false);
 
   hr = device_manager_->ResetDevice(d3d9_device_ex_.Get(),
                                     dev_manager_reset_token_);
   RETURN_ON_HR_FAILURE(hr, "Failed to reset device", false);
 
-  hr = d3d9_device_ex_->CreateQuery(D3DQUERYTYPE_EVENT, query_.Receive());
+  hr = d3d9_device_ex_->CreateQuery(D3DQUERYTYPE_EVENT, query_.GetAddressOf());
   RETURN_ON_HR_FAILURE(hr, "Failed to create D3D device query", false);
   // Ensure query_ API works (to avoid an infinite loop later in
   // CopyOutputSampleDataToPictureBuffer).
@@ -778,7 +778,7 @@
 
     // Create video processor
     hr = video_processor_service_->CreateVideoProcessor(
-        guids[g], &inputDesc, D3DFMT_X8R8G8B8, 0, processor_.Receive());
+        guids[g], &inputDesc, D3DFMT_X8R8G8B8, 0, processor_.GetAddressOf());
     if (hr)
       continue;
 
@@ -801,8 +801,8 @@
   // The device may exist if the last state was a config change.
   if (D3D11Device())
     return true;
-  HRESULT hr = create_dxgi_device_manager_(&dx11_dev_manager_reset_token_,
-                                           d3d11_device_manager_.Receive());
+  HRESULT hr = create_dxgi_device_manager_(
+      &dx11_dev_manager_reset_token_, d3d11_device_manager_.GetAddressOf());
   RETURN_ON_HR_FAILURE(hr, "MFCreateDXGIDeviceManager failed", false);
 
   angle_device_ = gl::QueryD3D11DeviceObjectFromANGLE();
@@ -831,8 +831,9 @@
 
     hr = D3D11CreateDevice(NULL, D3D_DRIVER_TYPE_HARDWARE, NULL, flags,
                            feature_levels, arraysize(feature_levels),
-                           D3D11_SDK_VERSION, d3d11_device_.Receive(),
-                           &feature_level_out, d3d11_device_context_.Receive());
+                           D3D11_SDK_VERSION, d3d11_device_.GetAddressOf(),
+                           &feature_level_out,
+                           d3d11_device_context_.GetAddressOf());
     if (hr == DXGI_ERROR_SDK_COMPONENT_MISSING) {
       LOG(ERROR)
           << "Debug DXGI device creation failed, falling back to release.";
@@ -842,17 +843,18 @@
     }
 #endif
     if (!d3d11_device_context_) {
-      hr = D3D11CreateDevice(
-          NULL, D3D_DRIVER_TYPE_HARDWARE, NULL, flags, feature_levels,
-          arraysize(feature_levels), D3D11_SDK_VERSION, d3d11_device_.Receive(),
-          &feature_level_out, d3d11_device_context_.Receive());
+      hr = D3D11CreateDevice(NULL, D3D_DRIVER_TYPE_HARDWARE, NULL, flags,
+                             feature_levels, arraysize(feature_levels),
+                             D3D11_SDK_VERSION, d3d11_device_.GetAddressOf(),
+                             &feature_level_out,
+                             d3d11_device_context_.GetAddressOf());
       RETURN_ON_HR_FAILURE(hr, "Failed to create DX11 device", false);
     }
 
-    hr = d3d11_device_.CopyTo(video_device_.Receive());
+    hr = d3d11_device_.CopyTo(video_device_.GetAddressOf());
     RETURN_ON_HR_FAILURE(hr, "Failed to get video device", false);
 
-    hr = d3d11_device_context_.CopyTo(video_context_.Receive());
+    hr = d3d11_device_context_.CopyTo(video_context_.GetAddressOf());
     RETURN_ON_HR_FAILURE(hr, "Failed to get video context", false);
   }
 
@@ -896,7 +898,7 @@
   D3D11_QUERY_DESC query_desc;
   query_desc.Query = D3D11_QUERY_EVENT;
   query_desc.MiscFlags = 0;
-  hr = D3D11Device()->CreateQuery(&query_desc, d3d11_query_.Receive());
+  hr = D3D11Device()->CreateQuery(&query_desc, d3d11_query_.GetAddressOf());
   RETURN_ON_HR_FAILURE(hr, "Failed to create DX11 device query", false);
 
   return true;
@@ -1376,7 +1378,7 @@
 
       base::win::ScopedComPtr<ID3D11VideoDecoder> video_decoder;
       hr = video_device->CreateVideoDecoder(&desc, &config,
-                                            video_decoder.Receive());
+                                            video_decoder.GetAddressOf());
       if (!video_decoder.Get())
         return max_resolution;
 
@@ -1407,7 +1409,7 @@
     return legacy_gpu;
 
   base::win::ScopedComPtr<IDXGIAdapter> adapter;
-  hr = dxgi_device->GetAdapter(adapter.Receive());
+  hr = dxgi_device->GetAdapter(adapter.GetAddressOf());
   if (FAILED(hr))
     return legacy_gpu;
 
@@ -1597,7 +1599,7 @@
 
 bool DXVAVideoDecodeAccelerator::CheckDecoderDxvaSupport() {
   base::win::ScopedComPtr<IMFAttributes> attributes;
-  HRESULT hr = decoder_->GetAttributes(attributes.Receive());
+  HRESULT hr = decoder_->GetAttributes(attributes.GetAddressOf());
   RETURN_ON_HR_FAILURE(hr, "Failed to get decoder attributes", false);
 
   UINT32 dxva = 0;
@@ -1664,7 +1666,7 @@
 
 bool DXVAVideoDecodeAccelerator::SetDecoderInputMediaType() {
   base::win::ScopedComPtr<IMFMediaType> media_type;
-  HRESULT hr = MFCreateMediaType(media_type.Receive());
+  HRESULT hr = MFCreateMediaType(media_type.GetAddressOf());
   RETURN_ON_HR_FAILURE(hr, "MFCreateMediaType failed", false);
 
   hr = media_type->SetGUID(MF_MT_MAJOR_TYPE, MFMediaType_Video);
@@ -1711,7 +1713,7 @@
   if (share_nv12_textures_) {
     base::win::ScopedComPtr<IMFAttributes> out_attributes;
     HRESULT hr =
-        decoder_->GetOutputStreamAttributes(0, out_attributes.Receive());
+        decoder_->GetOutputStreamAttributes(0, out_attributes.GetAddressOf());
     RETURN_ON_HR_FAILURE(hr, "Failed to get stream attributes", false);
     out_attributes->SetUINT32(MF_SA_D3D11_BINDFLAGS,
                               D3D11_BIND_SHADER_RESOURCE | D3D11_BIND_DECODER);
@@ -1948,7 +1950,7 @@
 
       base::win::ScopedComPtr<IMFMediaBuffer> output_buffer;
       HRESULT hr = pending_sample->output_sample->GetBufferByIndex(
-          0, output_buffer.Receive());
+          0, output_buffer.GetAddressOf());
       RETURN_AND_NOTIFY_ON_HR_FAILURE(
           hr, "Failed to get buffer from output sample", PLATFORM_FAILURE, );
 
@@ -1963,10 +1965,10 @@
             PLATFORM_FAILURE, );
         hr = dxgi_buffer->GetResource(
             __uuidof(ID3D11Texture2D),
-            reinterpret_cast<void**>(d3d11_texture.Receive()));
+            reinterpret_cast<void**>(d3d11_texture.GetAddressOf()));
       } else {
         hr = MFGetService(output_buffer.Get(), MR_BUFFER_SERVICE,
-                          IID_PPV_ARGS(surface.Receive()));
+                          IID_PPV_ARGS(surface.GetAddressOf()));
       }
       RETURN_AND_NOTIFY_ON_HR_FAILURE(
           hr, "Failed to get surface from output sample", PLATFORM_FAILURE, );
@@ -2687,7 +2689,7 @@
   }
 
   base::win::ScopedComPtr<IMFMediaBuffer> output_buffer;
-  hr = input_sample->GetBufferByIndex(0, output_buffer.Receive());
+  hr = input_sample->GetBufferByIndex(0, output_buffer.GetAddressOf());
   RETURN_AND_NOTIFY_ON_HR_FAILURE(hr, "Failed to get buffer from output sample",
                                   PLATFORM_FAILURE, );
 
@@ -2701,7 +2703,8 @@
                                   PLATFORM_FAILURE, );
 
   base::win::ScopedComPtr<ID3D11Texture2D> dx11_decoding_texture;
-  hr = dxgi_buffer->GetResource(IID_PPV_ARGS(dx11_decoding_texture.Receive()));
+  hr = dxgi_buffer->GetResource(
+      IID_PPV_ARGS(dx11_decoding_texture.GetAddressOf()));
   RETURN_AND_NOTIFY_ON_HR_FAILURE(
       hr, "Failed to get resource from output sample", PLATFORM_FAILURE, );
 
@@ -2711,7 +2714,7 @@
   base::win::ScopedComPtr<ID3D11VideoProcessorOutputView> output_view;
   hr = video_device_->CreateVideoProcessorOutputView(
       dest_texture, enumerator_.Get(), &output_view_desc,
-      output_view.Receive());
+      output_view.GetAddressOf());
   RETURN_AND_NOTIFY_ON_HR_FAILURE(hr, "Failed to get output view",
                                   PLATFORM_FAILURE, );
 
@@ -2722,7 +2725,7 @@
   base::win::ScopedComPtr<ID3D11VideoProcessorInputView> input_view;
   hr = video_device_->CreateVideoProcessorInputView(
       dx11_decoding_texture.Get(), enumerator_.Get(), &input_view_desc,
-      input_view.Receive());
+      input_view.GetAddressOf());
   RETURN_AND_NOTIFY_ON_HR_FAILURE(hr, "Failed to get input view",
                                   PLATFORM_FAILURE, );
 
@@ -2830,12 +2833,12 @@
     desc.Usage = D3D11_VIDEO_USAGE_PLAYBACK_NORMAL;
 
     HRESULT hr = video_device_->CreateVideoProcessorEnumerator(
-        &desc, enumerator_.Receive());
+        &desc, enumerator_.GetAddressOf());
     RETURN_ON_HR_FAILURE(hr, "Failed to enumerate video processors", false);
 
     // TODO(Hubbe): Find correct index
     hr = video_device_->CreateVideoProcessor(enumerator_.Get(), 0,
-                                             d3d11_processor_.Receive());
+                                             d3d11_processor_.GetAddressOf());
     RETURN_ON_HR_FAILURE(hr, "Failed to create video processor.", false);
     processor_width_ = width;
     processor_height_ = height;
@@ -2861,7 +2864,7 @@
     dx11_converter_output_color_space_ = gfx::ColorSpace::CreateSRGB();
     if (use_color_info_ || use_fp16_) {
       base::win::ScopedComPtr<ID3D11VideoContext1> video_context1;
-      HRESULT hr = video_context_.CopyTo(video_context1.Receive());
+      HRESULT hr = video_context_.CopyTo(video_context1.GetAddressOf());
       if (SUCCEEDED(hr)) {
         if (use_fp16_ &&
             base::CommandLine::ForCurrentProcess()->HasSwitch(
@@ -2923,7 +2926,7 @@
                                                          int* width,
                                                          int* height) {
   base::win::ScopedComPtr<IMFMediaBuffer> output_buffer;
-  HRESULT hr = sample->GetBufferByIndex(0, output_buffer.Receive());
+  HRESULT hr = sample->GetBufferByIndex(0, output_buffer.GetAddressOf());
   RETURN_ON_HR_FAILURE(hr, "Failed to get buffer from output sample", false);
 
   if (use_dx11_) {
@@ -2934,7 +2937,7 @@
                          false);
     hr = dxgi_buffer->GetResource(
         __uuidof(ID3D11Texture2D),
-        reinterpret_cast<void**>(d3d11_texture.Receive()));
+        reinterpret_cast<void**>(d3d11_texture.GetAddressOf()));
     RETURN_ON_HR_FAILURE(hr, "Failed to get D3D11Texture from output buffer",
                          false);
     D3D11_TEXTURE2D_DESC d3d11_texture_desc;
@@ -2945,7 +2948,7 @@
   } else {
     base::win::ScopedComPtr<IDirect3DSurface9> surface;
     hr = MFGetService(output_buffer.Get(), MR_BUFFER_SERVICE,
-                      IID_PPV_ARGS(surface.Receive()));
+                      IID_PPV_ARGS(surface.GetAddressOf()));
     RETURN_ON_HR_FAILURE(hr, "Failed to get D3D surface from output sample",
                          false);
     D3DSURFACE_DESC surface_desc;
@@ -2964,8 +2967,8 @@
   HRESULT hr = E_FAIL;
   base::win::ScopedComPtr<IMFMediaType> media_type;
 
-  for (uint32_t i = 0;
-       SUCCEEDED(transform->GetOutputAvailableType(0, i, media_type.Receive()));
+  for (uint32_t i = 0; SUCCEEDED(
+           transform->GetOutputAvailableType(0, i, media_type.GetAddressOf()));
        ++i) {
     GUID out_subtype = {0};
     hr = media_type->GetGUID(MF_MT_SUBTYPE, &out_subtype);
@@ -2992,7 +2995,7 @@
     return S_FALSE;
 
   base::win::ScopedComPtr<IMFMediaBuffer> buffer;
-  HRESULT hr = sample->GetBufferByIndex(0, buffer.Receive());
+  HRESULT hr = sample->GetBufferByIndex(0, buffer.GetAddressOf());
   RETURN_ON_HR_FAILURE(hr, "Failed to get buffer from input sample", hr);
 
   mf::MediaBufferScopedPointer scoped_media_buffer(buffer.Get());
diff --git a/media/gpu/media_foundation_video_encode_accelerator_win.cc b/media/gpu/media_foundation_video_encode_accelerator_win.cc
index c70e301..fea0fb9 100644
--- a/media/gpu/media_foundation_video_encode_accelerator_win.cc
+++ b/media/gpu/media_foundation_video_encode_accelerator_win.cc
@@ -391,7 +391,7 @@
   }
 
   // Initialize output parameters.
-  hr = MFCreateMediaType(imf_output_media_type_.Receive());
+  hr = MFCreateMediaType(imf_output_media_type_.GetAddressOf());
   RETURN_ON_HR_FAILURE(hr, "Couldn't create media type", false);
   hr = imf_output_media_type_->SetGUID(MF_MT_MAJOR_TYPE, MFMediaType_Video);
   RETURN_ON_HR_FAILURE(hr, "Couldn't set media type", false);
@@ -417,7 +417,7 @@
   RETURN_ON_HR_FAILURE(hr, "Couldn't set output media type", false);
 
   // Initialize input parameters.
-  hr = MFCreateMediaType(imf_input_media_type_.Receive());
+  hr = MFCreateMediaType(imf_input_media_type_.GetAddressOf());
   RETURN_ON_HR_FAILURE(hr, "Couldn't create media type", false);
   hr = imf_input_media_type_->SetGUID(MF_MT_MAJOR_TYPE, MFMediaType_Video);
   RETURN_ON_HR_FAILURE(hr, "Couldn't set media type", false);
@@ -444,7 +444,7 @@
   RETURN_ON_FAILURE((encoder_.Get() != nullptr),
                     "No HW encoder instance created", false);
 
-  HRESULT hr = encoder_.CopyTo(codec_api_.Receive());
+  HRESULT hr = encoder_.CopyTo(codec_api_.GetAddressOf());
   RETURN_ON_HR_FAILURE(hr, "Couldn't get ICodecAPI", false);
   VARIANT var;
   var.vt = VT_UI4;
@@ -500,7 +500,7 @@
   DCHECK(encoder_thread_task_runner_->BelongsToCurrentThread());
 
   base::win::ScopedComPtr<IMFMediaBuffer> input_buffer;
-  input_sample_->GetBufferByIndex(0, input_buffer.Receive());
+  input_sample_->GetBufferByIndex(0, input_buffer.GetAddressOf());
 
   {
     MediaBufferScopedPointer scoped_buffer(input_buffer.Get());
@@ -579,7 +579,7 @@
   DVLOG(3) << "Got encoded data " << hr;
 
   base::win::ScopedComPtr<IMFMediaBuffer> output_buffer;
-  hr = output_sample_->GetBufferByIndex(0, output_buffer.Receive());
+  hr = output_sample_->GetBufferByIndex(0, output_buffer.GetAddressOf());
   RETURN_ON_HR_FAILURE(hr, "Couldn't get buffer by index", );
   DWORD size = 0;
   hr = output_buffer->GetCurrentLength(&size);
diff --git a/media/midi/midi_manager_winrt.cc b/media/midi/midi_manager_winrt.cc
index 5a0dedfe..8b2b643 100644
--- a/media/midi/midi_manager_winrt.cc
+++ b/media/midi/midi_manager_winrt.cc
@@ -387,7 +387,7 @@
       return false;
 
     hr = dev_info_statics->CreateWatcherAqsFilter(device_selector,
-                                                  watcher_.Receive());
+                                                  watcher_.GetAddressOf());
     if (FAILED(hr)) {
       VLOG(1) << "CreateWatcherAqsFilter failed: " << PrintHr(hr);
       return false;
@@ -794,14 +794,14 @@
               std::string dev_id = GetDeviceIdString(handle);
 
               ScopedComPtr<IMidiMessage> message;
-              HRESULT hr = args->get_Message(message.Receive());
+              HRESULT hr = args->get_Message(message.GetAddressOf());
               if (FAILED(hr)) {
                 VLOG(1) << "get_Message failed: " << PrintHr(hr);
                 return hr;
               }
 
               ScopedComPtr<IBuffer> buffer;
-              hr = message->get_RawData(buffer.Receive());
+              hr = message->get_RawData(buffer.GetAddressOf());
               if (FAILED(hr)) {
                 VLOG(1) << "get_RawData failed: " << PrintHr(hr);
                 return hr;
@@ -1014,7 +1014,7 @@
 
   ScopedComPtr<IBuffer> buffer;
   HRESULT hr = buffer_factory->Create(static_cast<UINT32>(data.size()),
-                                      buffer.Receive());
+                                      buffer.GetAddressOf());
   if (FAILED(hr)) {
     VLOG(1) << "Create failed: " << PrintHr(hr);
     return;
diff --git a/mojo/public/tools/bindings/generators/js_templates/interface_definition.tmpl b/mojo/public/tools/bindings/generators/js_templates/interface_definition.tmpl
index 85d95d6a..afee2ba 100644
--- a/mojo/public/tools/bindings/generators/js_templates/interface_definition.tmpl
+++ b/mojo/public/tools/bindings/generators/js_templates/interface_definition.tmpl
@@ -204,7 +204,7 @@
   }
 
   var {{interface.name}} = {
-    name: '{{namespace|replace(".","::")}}::{{interface.name}}',
+    name: '{{module.namespace|replace(".","::")}}::{{interface.name}}',
     kVersion: {{interface.version}},
     ptrClass: {{interface.name}}Ptr,
     proxyClass: {{interface.name}}Proxy,
diff --git a/mojo/public/tools/bindings/generators/mojom_cpp_generator.py b/mojo/public/tools/bindings/generators/mojom_cpp_generator.py
index d2930d11..7b55afc 100644
--- a/mojo/public/tools/bindings/generators/mojom_cpp_generator.py
+++ b/mojo/public/tools/bindings/generators/mojom_cpp_generator.py
@@ -278,12 +278,10 @@
           yield param.kind
 
   def _GetJinjaExports(self):
-    structs = self.GetStructs()
-    interfaces = self.GetInterfaces()
     all_enums = list(self.module.enums)
-    for struct in structs:
+    for struct in self.module.structs:
       all_enums.extend(struct.enums)
-    for interface in interfaces:
+    for interface in self.module.interfaces:
       all_enums.extend(interface.enums)
 
     return {
@@ -294,9 +292,9 @@
       "kinds": self.module.kinds,
       "enums": self.module.enums,
       "all_enums": all_enums,
-      "structs": structs,
-      "unions": self.GetUnions(),
-      "interfaces": interfaces,
+      "structs": self.module.structs,
+      "unions": self.module.unions,
+      "interfaces": self.module.interfaces,
       "variant": self.variant,
       "extra_traits_headers": self._GetExtraTraitsHeaders(),
       "extra_public_headers": self._GetExtraPublicHeaders(),
@@ -356,7 +354,7 @@
       "is_union_kind": mojom.IsUnionKind,
       "passes_associated_kinds": mojom.PassesAssociatedKinds,
       "struct_constructors": self._GetStructConstructors,
-      "under_to_camel": generator.UnderToCamel,
+      "under_to_camel": generator.ToCamel,
       "unmapped_type_for_serializer": self._GetUnmappedTypeForSerializer,
       "wtf_hash_fn_name_for_enum": GetWtfHashFnNameForEnum,
     }
diff --git a/mojo/public/tools/bindings/generators/mojom_java_generator.py b/mojo/public/tools/bindings/generators/mojom_java_generator.py
index 33c47c8..3e6f63a1 100644
--- a/mojo/public/tools/bindings/generators/mojom_java_generator.py
+++ b/mojo/public/tools/bindings/generators/mojom_java_generator.py
@@ -486,9 +486,7 @@
   def _DoGenerateFiles(self):
     fileutil.EnsureDirectoryExists(self.output_dir)
 
-    # Keep this above the others as .GetStructs() changes the state of the
-    # module, annotating structs with required information.
-    for struct in self.GetStructs():
+    for struct in self.module.structs:
       self.Write(self._GenerateStructSource(struct),
                  '%s.java' % GetNameForElement(struct))
 
@@ -500,7 +498,7 @@
       self.Write(self._GenerateEnumSource(enum),
                  '%s.java' % GetNameForElement(enum))
 
-    for interface in self.GetInterfaces():
+    for interface in self.module.interfaces:
       self.Write(self._GenerateInterfaceSource(interface),
                  '%s.java' % GetNameForElement(interface))
       self.Write(self._GenerateInterfaceInternalSource(interface),
diff --git a/mojo/public/tools/bindings/generators/mojom_js_generator.py b/mojo/public/tools/bindings/generators/mojom_js_generator.py
index 20a2b23..ef4c2ef7 100644
--- a/mojo/public/tools/bindings/generators/mojom_js_generator.py
+++ b/mojo/public/tools/bindings/generators/mojom_js_generator.py
@@ -95,16 +95,14 @@
 class Generator(generator.Generator):
   def _GetParameters(self):
     return {
-      "namespace": self.module.namespace,
-      "imports": self._GetImports(),
-      "kinds": self.module.kinds,
       "enums": self.module.enums,
+      "imports": self.module.imports,
+      "interfaces": self.module.interfaces,
+      "kinds": self.module.kinds,
       "module": self.module,
-      "structs": self.GetStructs() + self.GetStructsFromMethods(),
-      "unions": self.GetUnions(),
+      "structs": self.module.structs + self._GetStructsFromMethods(),
+      "unions": self.module.unions,
       "use_new_js_bindings": self.use_new_js_bindings,
-      "interfaces": self.GetInterfaces(),
-      "imported_interfaces": self._GetImportedInterfaces(),
     }
 
   @staticmethod
@@ -118,6 +116,7 @@
       "encode_snippet": self._JavaScriptEncodeSnippet,
       "expression_to_text": self._ExpressionToText,
       "field_offset": JavaScriptFieldOffset,
+      "get_relative_path": GetRelativePath,
       "has_callbacks": mojom.HasCallbacks,
       "is_any_handle_or_interface_kind": mojom.IsAnyHandleOrInterfaceKind,
       "is_array_kind": mojom.IsArrayKind,
@@ -137,8 +136,8 @@
       "js_type": self._JavaScriptType,
       "method_passes_associated_kinds": mojom.MethodPassesAssociatedKinds,
       "payload_size": JavaScriptPayloadSize,
-      "get_relative_path": GetRelativePath,
-      "stylize_method": generator.StudlyCapsToCamel,
+      "stylize_method": lambda x: generator.ToCamel(x, lower_initial=True),
+      "to_camel": generator.ToCamel,
       "union_decode_snippet": self._JavaScriptUnionDecodeSnippet,
       "union_encode_snippet": self._JavaScriptUnionEncodeSnippet,
       "validate_array_params": self._JavaScriptValidateArrayParams,
@@ -158,11 +157,13 @@
     if self.variant:
       raise Exception("Variants not supported in JavaScript bindings.")
 
+    # TODO(yzshen): Remove this method once the old JS bindings go away.
+    self._SetUniqueNameForImports()
+
     self.Write(self._GenerateAMDModule(),
         self.MatchMojomFilePath("%s.js" % self.module.name))
 
-  def _GetImports(self):
-    # TODO(yzshen): Remove this method once the old JS bindings go away.
+  def _SetUniqueNameForImports(self):
     used_names = set()
     for each_import in self.module.imports:
       simple_name = each_import.name.split(".")[0]
@@ -178,15 +179,6 @@
       used_names.add(unique_name)
       each_import.unique_name = unique_name + "$"
       counter += 1
-    return self.module.imports
-
-  def _GetImportedInterfaces(self):
-    interface_to_import = {};
-    for each_import in self.module.imports:
-      for each_interface in each_import.interfaces:
-        name = each_interface.name
-        interface_to_import[name] = each_import.unique_name + "." + name
-    return interface_to_import;
 
   def _JavaScriptType(self, kind):
     name = []
@@ -381,3 +373,11 @@
   def _ExpressionToText(self, value):
     return self._TranslateConstants(value)
 
+  def _GetStructsFromMethods(self):
+    result = []
+    for interface in self.module.interfaces:
+      for method in interface.methods:
+        result.append(method.param_struct)
+        if method.response_param_struct is not None:
+          result.append(method.response_param_struct)
+    return result
diff --git a/mojo/public/tools/bindings/mojom_bindings_generator.py b/mojo/public/tools/bindings/mojom_bindings_generator.py
index 24fe610c..c6f90a3cc 100755
--- a/mojo/public/tools/bindings/mojom_bindings_generator.py
+++ b/mojo/public/tools/bindings/mojom_bindings_generator.py
@@ -41,6 +41,7 @@
 import mojom.fileutil as fileutil
 from mojom.generate import translate
 from mojom.generate import template_expander
+from mojom.generate.generator import AddComputedData
 from mojom.parse.parser import Parse
 
 
@@ -198,6 +199,7 @@
     module.path = module.path.replace('\\', '/')
 
     if self._should_generate(rel_filename.path):
+      AddComputedData(module)
       for language, generator_module in generator_modules.iteritems():
         generator = generator_module.Generator(
             module, args.output_dir, typemap=self._typemap.get(language, {}),
diff --git a/mojo/public/tools/bindings/pylib/mojom/generate/generator.py b/mojo/public/tools/bindings/pylib/mojom/generate/generator.py
index 0e64af7..04850d71 100644
--- a/mojo/public/tools/bindings/pylib/mojom/generate/generator.py
+++ b/mojo/public/tools/bindings/pylib/mojom/generate/generator.py
@@ -12,17 +12,25 @@
 import mojom.fileutil as fileutil
 import pack
 
+
 def ExpectedArraySize(kind):
   if mojom.IsArrayKind(kind):
     return kind.length
   return None
 
-def StudlyCapsToCamel(studly):
-  return studly[0].lower() + studly[1:]
 
-def UnderToCamel(under):
-  """Converts underscore_separated strings to CamelCase strings."""
-  return ''.join(word.capitalize() for word in under.split('_'))
+def ToCamel(identifier, lower_initial=False, dilimiter='_'):
+  """Splits |identifier| using |dilimiter|, makes the first character of each
+  word uppercased (but makes the first character of the first word lowercased
+  if |lower_initial| is set to True), and joins the words. Please note that for
+  each word, all the characters except the first one are untouched.
+  """
+  result = ''.join(
+      word[0].upper() + word[1:] for word in identifier.split(dilimiter))
+  if lower_initial:
+    result = result[0].lower() + result[1:]
+  return result
+
 
 def WriteFile(contents, full_path):
   # Make sure the containing directory exists.
@@ -33,6 +41,76 @@
   with open(full_path, "w+") as f:
     f.write(contents)
 
+
+def AddComputedData(module):
+  """Adds computed data to the given module. The data is computed once and
+  used repeatedly in the generation process."""
+
+  def _AddStructComputedData(exported, struct):
+    struct.packed = pack.PackedStruct(struct)
+    struct.bytes = pack.GetByteLayout(struct.packed)
+    struct.versions = pack.GetVersionInfo(struct.packed)
+    struct.exported = exported
+
+  def _AddUnionComputedData(union):
+    ordinal = 0
+    for field in union.fields:
+      if field.ordinal is not None:
+        ordinal = field.ordinal
+      field.ordinal = ordinal
+      ordinal += 1
+
+  def _AddInterfaceComputedData(interface):
+    next_ordinal = 0
+    interface.version = 0
+    for method in interface.methods:
+      if method.ordinal is None:
+        method.ordinal = next_ordinal
+      next_ordinal = method.ordinal + 1
+
+      if method.min_version is not None:
+        interface.version = max(interface.version, method.min_version)
+
+      method.param_struct = _GetStructFromMethod(method)
+      interface.version = max(interface.version,
+                              method.param_struct.versions[-1].version)
+
+      if method.response_parameters is not None:
+        method.response_param_struct = _GetResponseStructFromMethod(method)
+        interface.version = max(
+            interface.version,
+            method.response_param_struct.versions[-1].version)
+      else:
+        method.response_param_struct = None
+
+  def _GetStructFromMethod(method):
+    """Converts a method's parameters into the fields of a struct."""
+    params_class = "%s_%s_Params" % (method.interface.name, method.name)
+    struct = mojom.Struct(params_class, module=method.interface.module)
+    for param in method.parameters:
+      struct.AddField(param.name, param.kind, param.ordinal,
+                      attributes=param.attributes)
+    _AddStructComputedData(False, struct)
+    return struct
+
+  def _GetResponseStructFromMethod(method):
+    """Converts a method's response_parameters into the fields of a struct."""
+    params_class = "%s_%s_ResponseParams" % (method.interface.name, method.name)
+    struct = mojom.Struct(params_class, module=method.interface.module)
+    for param in method.response_parameters:
+      struct.AddField(param.name, param.kind, param.ordinal,
+                      attributes=param.attributes)
+    _AddStructComputedData(False, struct)
+    return struct
+
+  for struct in module.structs:
+    _AddStructComputedData(True, struct)
+  for union in module.unions:
+    _AddUnionComputedData(union)
+  for interface in module.interfaces:
+    _AddInterfaceComputedData(interface)
+
+
 class Generator(object):
   # Pass |output_dir| to emit files to disk. Omit |output_dir| to echo all
   # files to stdout.
@@ -52,24 +130,6 @@
     self.export_header = export_header
     self.generate_non_variant_code = generate_non_variant_code
 
-  def GetStructsFromMethods(self):
-    result = []
-    for interface in self.module.interfaces:
-      for method in interface.methods:
-        result.append(self._GetStructFromMethod(method))
-        if method.response_parameters != None:
-          result.append(self._GetResponseStructFromMethod(method))
-    return result
-
-  def GetStructs(self):
-    return map(partial(self._AddStructComputedData, True), self.module.structs)
-
-  def GetUnions(self):
-    return map(self._AddUnionComputedData, self.module.unions)
-
-  def GetInterfaces(self):
-    return map(self._AddInterfaceComputedData, self.module.interfaces)
-
   # Prepend the filename with a directory that matches the directory of the
   # original .mojom file, relative to the import root.
   def MatchMojomFilePath(self, filename):
@@ -93,61 +153,3 @@
     """Returns global mappings for the template generation."""
     return {}
 
-  def _AddStructComputedData(self, exported, struct):
-    """Adds computed data to the given struct. The data is computed once and
-    used repeatedly in the generation process."""
-    struct.packed = pack.PackedStruct(struct)
-    struct.bytes = pack.GetByteLayout(struct.packed)
-    struct.versions = pack.GetVersionInfo(struct.packed)
-    struct.exported = exported
-    return struct
-
-  def _AddUnionComputedData(self, union):
-    """Adds computed data to the given union. The data is computed once and
-    used repeatedly in the generation process."""
-    ordinal = 0
-    for field in union.fields:
-      if field.ordinal is not None:
-        ordinal = field.ordinal
-      field.ordinal = ordinal
-      ordinal += 1
-    return union
-
-  def _AddInterfaceComputedData(self, interface):
-    """Adds computed data to the given interface. The data is computed once and
-    used repeatedly in the generation process."""
-    interface.version = 0
-    for method in interface.methods:
-      if method.min_version is not None:
-        interface.version = max(interface.version, method.min_version)
-
-      method.param_struct = self._GetStructFromMethod(method)
-      interface.version = max(interface.version,
-                              method.param_struct.versions[-1].version)
-
-      if method.response_parameters is not None:
-        method.response_param_struct = self._GetResponseStructFromMethod(method)
-        interface.version = max(
-            interface.version,
-            method.response_param_struct.versions[-1].version)
-      else:
-        method.response_param_struct = None
-    return interface
-
-  def _GetStructFromMethod(self, method):
-    """Converts a method's parameters into the fields of a struct."""
-    params_class = "%s_%s_Params" % (method.interface.name, method.name)
-    struct = mojom.Struct(params_class, module=method.interface.module)
-    for param in method.parameters:
-      struct.AddField(param.name, param.kind, param.ordinal,
-                      attributes=param.attributes)
-    return self._AddStructComputedData(False, struct)
-
-  def _GetResponseStructFromMethod(self, method):
-    """Converts a method's response_parameters into the fields of a struct."""
-    params_class = "%s_%s_ResponseParams" % (method.interface.name, method.name)
-    struct = mojom.Struct(params_class, module=method.interface.module)
-    for param in method.response_parameters:
-      struct.AddField(param.name, param.kind, param.ordinal,
-                      attributes=param.attributes)
-    return self._AddStructComputedData(False, struct)
diff --git a/mojo/public/tools/bindings/pylib/mojom/generate/generator_unittest.py b/mojo/public/tools/bindings/pylib/mojom/generate/generator_unittest.py
deleted file mode 100644
index 9966b0b..0000000
--- a/mojo/public/tools/bindings/pylib/mojom/generate/generator_unittest.py
+++ /dev/null
@@ -1,24 +0,0 @@
-# Copyright 2015 The Chromium Authors. All rights reserved.
-# Use of this source code is governed by a BSD-style license that can be
-# found in the LICENSE file.
-
-import unittest
-
-import module as mojom
-import generator
-
-class TestGenerator(unittest.TestCase):
-
-  def testGetUnionsAddsOrdinals(self):
-    module = mojom.Module()
-    union = module.AddUnion('a')
-    union.AddField('a', mojom.BOOL)
-    union.AddField('b', mojom.BOOL)
-    union.AddField('c', mojom.BOOL, ordinal=10)
-    union.AddField('d', mojom.BOOL)
-
-    gen = generator.Generator(module)
-    union = gen.GetUnions()[0]
-    ordinals = [field.ordinal for field in union.fields]
-
-    self.assertEquals([0, 1, 10, 11], ordinals)
diff --git a/mojo/public/tools/bindings/pylib/mojom/generate/module.py b/mojo/public/tools/bindings/pylib/mojom/generate/module.py
index fd346e2..906d3fd 100644
--- a/mojo/public/tools/bindings/pylib/mojom/generate/module.py
+++ b/mojo/public/tools/bindings/pylib/mojom/generate/module.py
@@ -623,9 +623,8 @@
 
 
 class Module(object):
-  def __init__(self, name=None, namespace=None, attributes=None):
-    self.name = name
-    self.path = name
+  def __init__(self, path=None, namespace=None, attributes=None):
+    self.path = path
     self.namespace = namespace
     self.structs = []
     self.unions = []
@@ -639,10 +638,10 @@
 
   def Repr(self, as_ref=True):
     if as_ref:
-      return '<%s name=%r namespace=%r>' % (
-          self.__class__.__name__, self.name, self.namespace)
+      return '<%s path=%r namespace=%r>' % (
+          self.__class__.__name__, self.path, self.namespace)
     else:
-      return GenericRepr(self, {'name': False, 'namespace': False,
+      return GenericRepr(self, {'path': False, 'namespace': False,
                                 'attributes': False, 'structs': False,
                                 'interfaces': False, 'unions': False})
 
diff --git a/mojo/public/tools/bindings/pylib/mojom/generate/translate.py b/mojo/public/tools/bindings/pylib/mojom/generate/translate.py
index bd5f3267..5e4183a63 100644
--- a/mojo/public/tools/bindings/pylib/mojom/generate/translate.py
+++ b/mojo/public/tools/bindings/pylib/mojom/generate/translate.py
@@ -608,10 +608,4 @@
     {mojom.Module} An AST for the mojom.
   """
   module = _Module(tree, name, imports)
-  for interface in module.interfaces:
-    next_ordinal = 0
-    for method in interface.methods:
-      if method.ordinal is None:
-        method.ordinal = next_ordinal
-      next_ordinal = method.ordinal + 1
   return module
diff --git a/mojo/public/tools/bindings/pylib/mojom_tests/generate/generator_unittest.py b/mojo/public/tools/bindings/pylib/mojom_tests/generate/generator_unittest.py
index a684773..e037c96 100644
--- a/mojo/public/tools/bindings/pylib/mojom_tests/generate/generator_unittest.py
+++ b/mojo/public/tools/bindings/pylib/mojom_tests/generate/generator_unittest.py
@@ -27,10 +27,14 @@
 class StringManipulationTest(unittest.TestCase):
   """generator contains some string utilities, this tests only those."""
 
-  def testUnderToCamel(self):
-    """Tests UnderToCamel which converts underscore_separated to CamelCase."""
-    self.assertEquals("CamelCase", generator.UnderToCamel("camel_case"))
-    self.assertEquals("CamelCase", generator.UnderToCamel("CAMEL_CASE"))
+  def testToCamel(self):
+    self.assertEquals("CamelCase", generator.ToCamel("camel_case"))
+    self.assertEquals("CAMELCASE", generator.ToCamel("CAMEL_CASE"))
+    self.assertEquals("camelCase", generator.ToCamel("camel_case",
+                                                     lower_initial=True))
+    self.assertEquals("CamelCase", generator.ToCamel("camel case",
+                                                     dilimiter=' '))
+    self.assertEquals("CaMelCaSe", generator.ToCamel("caMel_caSe"))
 
 if __name__ == "__main__":
   unittest.main()
diff --git a/net/disk_cache/backend_unittest.cc b/net/disk_cache/backend_unittest.cc
index 79fcdf7..ca0e0ee 100644
--- a/net/disk_cache/backend_unittest.cc
+++ b/net/disk_cache/backend_unittest.cc
@@ -3886,41 +3886,6 @@
   EXPECT_TRUE(keys_to_match.empty());
 }
 
-TEST_F(DiskCacheBackendTest, SimpleCacheIndexRecovery) {
-  // Make sure we can recover set of entries when the index was removed.
-  SetSimpleCacheMode();
-  InitCache();
-  std::set<std::string> key_pool;
-  ASSERT_TRUE(CreateSetOfRandomEntries(&key_pool));
-
-  cache_.reset();
-
-  // Give it a chance to write out the index, so we can delete it (rather
-  // than have it write it after we delete it).
-  disk_cache::SimpleBackendImpl::FlushWorkerPoolForTesting();
-  base::RunLoop().RunUntilIdle();
-
-  base::FilePath index_path =
-      cache_path_.AppendASCII("index-dir").AppendASCII("the-real-index");
-  ASSERT_TRUE(base::DeleteFile(index_path, false));
-
-  DisableFirstCleanup();
-  InitCache();
-  // A bit surprising, but it calls it "NEWCACHE" if there was no index,
-  // even if it reconstructed non-zero things.
-  EXPECT_EQ(disk_cache::SimpleIndex::INITIALIZE_METHOD_NEWCACHE,
-            simple_cache_impl_->index()->init_method());
-
-  // Check that enumeration returns all entries.
-  std::set<std::string> keys_to_match(key_pool);
-  std::unique_ptr<TestIterator> iter = CreateIterator();
-  size_t count = 0;
-  ASSERT_TRUE(EnumerateAndMatchKeys(-1, iter.get(), &keys_to_match, &count));
-  iter.reset();
-  EXPECT_EQ(key_pool.size(), count);
-  EXPECT_TRUE(keys_to_match.empty());
-}
-
 // Tests that the enumerations are not affected by dooming an entry in the
 // middle.
 TEST_F(DiskCacheBackendTest, SimpleCacheEnumerationWhileDoomed) {
diff --git a/net/http/http_network_session.cc b/net/http/http_network_session.cc
index e0001510..dc6b262 100644
--- a/net/http/http_network_session.cc
+++ b/net/http/http_network_session.cc
@@ -142,7 +142,6 @@
       quic_force_hol_blocking(false),
       quic_race_cert_verification(false),
       quic_do_not_fragment(false),
-      quic_do_not_mark_as_broken_on_network_change(false),
       quic_estimate_initial_rtt(false),
       proxy_delegate(nullptr),
       enable_token_binding(false),
@@ -345,8 +344,6 @@
   dict->SetBoolean("allow_server_migration",
                    params_.quic_allow_server_migration);
   dict->SetBoolean("do_not_fragment", params_.quic_do_not_fragment);
-  dict->SetBoolean("do_not_mark_as_broken_on_network_change",
-                   params_.quic_do_not_mark_as_broken_on_network_change);
   dict->SetBoolean("estimate_initial_rtt", params_.quic_estimate_initial_rtt);
   dict->SetBoolean("force_hol_blocking", params_.quic_force_hol_blocking);
 
diff --git a/net/http/http_network_session.h b/net/http/http_network_session.h
index f3eb086..d8e867f 100644
--- a/net/http/http_network_session.h
+++ b/net/http/http_network_session.h
@@ -175,9 +175,6 @@
     bool quic_race_cert_verification;
     // If true, configure QUIC sockets to not fragment packets.
     bool quic_do_not_fragment;
-    // If true, alternative service is not marked as broken if the alternative
-    // job fails due to a network change event.
-    bool quic_do_not_mark_as_broken_on_network_change;
     // If true, estimate the initial RTT for QUIC connections based on network.
     bool quic_estimate_initial_rtt;
 
diff --git a/net/http/http_stream_factory_impl_job_controller.cc b/net/http/http_stream_factory_impl_job_controller.cc
index 3978ac2..11a3d60 100644
--- a/net/http/http_stream_factory_impl_job_controller.cc
+++ b/net/http/http_stream_factory_impl_job_controller.cc
@@ -862,9 +862,8 @@
   UMA_HISTOGRAM_SPARSE_SLOWLY("Net.AlternateServiceFailed",
                               -alternative_job_net_error_);
 
-  if (session_->params().quic_do_not_mark_as_broken_on_network_change &&
-      (alternative_job_net_error_ == ERR_NETWORK_CHANGED ||
-       alternative_job_net_error_ == ERR_INTERNET_DISCONNECTED)) {
+  if (alternative_job_net_error_ == ERR_NETWORK_CHANGED ||
+      alternative_job_net_error_ == ERR_INTERNET_DISCONNECTED) {
     // No need to mark alternative service or proxy as broken.
     return;
   }
diff --git a/net/http/http_stream_factory_impl_job_controller_unittest.cc b/net/http/http_stream_factory_impl_job_controller_unittest.cc
index 422b2453..84a9491 100644
--- a/net/http/http_stream_factory_impl_job_controller_unittest.cc
+++ b/net/http/http_stream_factory_impl_job_controller_unittest.cc
@@ -641,7 +641,6 @@
   session_deps_.proxy_service.reset(
       new ProxyService(base::MakeUnique<ProxyConfigServiceFixed>(proxy_config),
                        base::WrapUnique(proxy_resolver_factory), nullptr));
-  session_deps_.quic_do_not_mark_as_broken_on_network_change = true;
 
   HttpRequestInfo request_info;
   request_info.method = "GET";
diff --git a/net/http/url_security_manager_win.cc b/net/http/url_security_manager_win.cc
index d56a1b8..4460366 100644
--- a/net/http/url_security_manager_win.cc
+++ b/net/http/url_security_manager_win.cc
@@ -104,9 +104,8 @@
 
 bool URLSecurityManagerWin::EnsureSystemSecurityManager() {
   if (!security_manager_.Get()) {
-    HRESULT hr = CoInternetCreateSecurityManager(NULL,
-                                                 security_manager_.Receive(),
-                                                 NULL);
+    HRESULT hr = CoInternetCreateSecurityManager(
+        NULL, security_manager_.GetAddressOf(), NULL);
     if (FAILED(hr) || !security_manager_.Get()) {
       LOG(ERROR) << "Unable to create the Windows Security Manager instance";
       return false;
diff --git a/net/spdy/chromium/spdy_test_util_common.cc b/net/spdy/chromium/spdy_test_util_common.cc
index 8373c2d1..e59d0ef0 100644
--- a/net/spdy/chromium/spdy_test_util_common.cc
+++ b/net/spdy/chromium/spdy_test_util_common.cc
@@ -350,8 +350,7 @@
       time_func(&base::TimeTicks::Now),
       enable_http2_alternative_service(false),
       net_log(nullptr),
-      http_09_on_non_default_ports_enabled(false),
-      quic_do_not_mark_as_broken_on_network_change(false) {
+      http_09_on_non_default_ports_enabled(false) {
   // Note: The CancelledTransaction test does cleanup by running all
   // tasks in the message loop (RunAllPending).  Unfortunately, that
   // doesn't clean up tasks on the host resolver thread; and
@@ -418,8 +417,6 @@
   params.net_log = session_deps->net_log;
   params.http_09_on_non_default_ports_enabled =
       session_deps->http_09_on_non_default_ports_enabled;
-  params.quic_do_not_mark_as_broken_on_network_change =
-      session_deps->quic_do_not_mark_as_broken_on_network_change;
   return params;
 }
 
diff --git a/net/spdy/chromium/spdy_test_util_common.h b/net/spdy/chromium/spdy_test_util_common.h
index 840fd6d..6f3cec8 100644
--- a/net/spdy/chromium/spdy_test_util_common.h
+++ b/net/spdy/chromium/spdy_test_util_common.h
@@ -216,7 +216,6 @@
   bool enable_http2_alternative_service;
   NetLog* net_log;
   bool http_09_on_non_default_ports_enabled;
-  bool quic_do_not_mark_as_broken_on_network_change;
 };
 
 class SpdyURLRequestContext : public URLRequestContext {
diff --git a/net/url_request/url_request_unittest.cc b/net/url_request/url_request_unittest.cc
index 25b603b..ebfe6653 100644
--- a/net/url_request/url_request_unittest.cc
+++ b/net/url_request/url_request_unittest.cc
@@ -1271,7 +1271,7 @@
     ASSERT_TRUE(SUCCEEDED(shell.CreateInstance(CLSID_ShellLink, NULL,
                                                CLSCTX_INPROC_SERVER)));
     base::win::ScopedComPtr<IPersistFile> persist;
-    ASSERT_TRUE(SUCCEEDED(shell.CopyTo(persist.Receive())));
+    ASSERT_TRUE(SUCCEEDED(shell.CopyTo(persist.GetAddressOf())));
     EXPECT_TRUE(SUCCEEDED(shell->SetPath(app_path.value().c_str())));
     EXPECT_TRUE(SUCCEEDED(shell->SetDescription(L"ResolveShortcutTest")));
     EXPECT_TRUE(SUCCEEDED(persist->Save(lnk_path.c_str(), TRUE)));
diff --git a/printing/backend/print_backend_win.cc b/printing/backend/print_backend_win.cc
index 0466bb5..7a657142 100644
--- a/printing/backend/print_backend_win.cc
+++ b/printing/backend/print_backend_win.cc
@@ -322,7 +322,7 @@
   if (provider) {
     base::win::ScopedComPtr<IStream> print_capabilities_stream;
     hr = CreateStreamOnHGlobal(NULL, TRUE,
-                               print_capabilities_stream.Receive());
+                               print_capabilities_stream.GetAddressOf());
     DCHECK(SUCCEEDED(hr));
     if (print_capabilities_stream.Get()) {
       base::win::ScopedBstr error;
@@ -345,7 +345,7 @@
         return false;
       base::win::ScopedComPtr<IStream> printer_defaults_stream;
       hr = CreateStreamOnHGlobal(NULL, TRUE,
-                                 printer_defaults_stream.Receive());
+                                 printer_defaults_stream.GetAddressOf());
       DCHECK(SUCCEEDED(hr));
       if (printer_defaults_stream.Get()) {
         DWORD dm_size = devmode_out->dmSize + devmode_out->dmDriverExtra;
diff --git a/printing/backend/win_helper.cc b/printing/backend/win_helper.cc
index 693fc1e7..3527aee 100644
--- a/printing/backend/win_helper.cc
+++ b/printing/backend/win_helper.cc
@@ -405,7 +405,7 @@
     return dev_mode;
 
   base::win::ScopedComPtr<IStream> pt_stream;
-  HRESULT hr = StreamFromPrintTicket(print_ticket, pt_stream.Receive());
+  HRESULT hr = StreamFromPrintTicket(print_ticket, pt_stream.GetAddressOf());
   if (FAILED(hr))
     return dev_mode;
 
diff --git a/remoting/host/audio_capturer_win.cc b/remoting/host/audio_capturer_win.cc
index 1250ca4d..c00a3f9 100644
--- a/remoting/host/audio_capturer_win.cc
+++ b/remoting/host/audio_capturer_win.cc
@@ -115,7 +115,7 @@
 
   // Get the audio endpoint.
   hr = mm_device_enumerator->GetDefaultAudioEndpoint(eRender, eConsole,
-                                                     mm_device_.Receive());
+                                                     mm_device_.GetAddressOf());
   if (FAILED(hr)) {
     LOG(ERROR) << "Failed to get IMMDevice. Error " << hr;
     return false;
diff --git a/remoting/host/it2me/it2me_native_messaging_host.cc b/remoting/host/it2me/it2me_native_messaging_host.cc
index 043795f..a79ac05 100644
--- a/remoting/host/it2me/it2me_native_messaging_host.cc
+++ b/remoting/host/it2me/it2me_native_messaging_host.cc
@@ -61,22 +61,22 @@
     FILE_PATH_LITERAL("remote_assistance_host_uiaccess.exe");
 #endif  // defined(OS_WIN)
 
-// Helper function to run |callback| on the correct thread using |task_runner|.
+// Helper functions to run |callback| asynchronously on the correct thread
+// using |task_runner|.
 void PolicyUpdateCallback(
     scoped_refptr<base::SingleThreadTaskRunner> task_runner,
     remoting::PolicyWatcher::PolicyUpdatedCallback callback,
     std::unique_ptr<base::DictionaryValue> policies) {
-  DCHECK(!callback.is_null());
-
-  // Always post the task so the execution is consistent (always asynchronous).
+  DCHECK(callback);
   task_runner->PostTask(FROM_HERE,
                         base::Bind(callback, base::Passed(&policies)));
 }
 
-// Called when malformed policies are detected.
-void OnPolicyError() {
-  // TODO(joedow): Report the policy error to the user.  crbug.com/433009
-  NOTIMPLEMENTED();
+void PolicyErrorCallback(
+    scoped_refptr<base::SingleThreadTaskRunner> task_runner,
+    remoting::PolicyWatcher::PolicyErrorCallback callback) {
+  DCHECK(callback);
+  task_runner->PostTask(FROM_HERE, callback);
 }
 
 }  // namespace
@@ -94,13 +94,14 @@
   weak_ptr_ = weak_factory_.GetWeakPtr();
 
   // The policy watcher runs on the |file_task_runner| but we want to run the
-  // update code on |task_runner| so we use a shim to post the callback to the
-  // preferred task runner.
+  // callbacks on |task_runner| so we use a shim to post them to it.
   PolicyWatcher::PolicyUpdatedCallback update_callback =
       base::Bind(&It2MeNativeMessagingHost::OnPolicyUpdate, weak_ptr_);
+  PolicyWatcher::PolicyErrorCallback error_callback =
+      base::Bind(&It2MeNativeMessagingHost::OnPolicyError, weak_ptr_);
   policy_watcher_->StartWatching(
       base::Bind(&PolicyUpdateCallback, task_runner(), update_callback),
-      base::Bind(&OnPolicyError));
+      base::Bind(&PolicyErrorCallback, task_runner(), error_callback));
 }
 
 It2MeNativeMessagingHost::~It2MeNativeMessagingHost() {
@@ -314,11 +315,22 @@
   }
 #endif  // !defined(NDEBUG)
 
+  std::unique_ptr<base::DictionaryValue> policies =
+      policy_watcher_->GetCurrentPolicies();
+  if (policies->size() == 0) {
+    // At this point policies have been read, so if there are none set then
+    // it indicates an error. Since this can be fixed by end users it has a
+    // dedicated message type rather than the generic "error" so that the
+    // right error message can be displayed.
+    SendPolicyErrorAndExit();
+    return;
+  }
+
   // Create the It2Me host and start connecting.
   it2me_host_ = factory_->CreateIt2MeHost(host_context_->Copy(), weak_ptr_,
                                           std::move(signal_strategy), username,
                                           directory_bot_jid);
-  it2me_host_->OnPolicyUpdate(policy_watcher_->GetCurrentPolicies());
+  it2me_host_->OnPolicyUpdate(std::move(policies));
   it2me_host_->Connect();
 
   SendMessageToClient(std::move(response));
@@ -385,6 +397,15 @@
   client_->CloseChannel(std::string());
 }
 
+void It2MeNativeMessagingHost::SendPolicyErrorAndExit() const {
+  DCHECK(task_runner()->BelongsToCurrentThread());
+
+  auto message = base::MakeUnique<base::DictionaryValue>();
+  message->SetString("type", "policyError");
+  SendMessageToClient(std::move(message));
+  client_->CloseChannel(std::string());
+}
+
 void It2MeNativeMessagingHost::OnStateChanged(
     It2MeHostState state,
     const std::string& error_message) {
@@ -427,6 +448,11 @@
   SendMessageToClient(std::move(message));
 }
 
+void It2MeNativeMessagingHost::SetPolicyErrorClosureForTesting(
+    const base::Closure& closure) {
+  policy_error_closure_for_testing_ = closure;
+}
+
 void It2MeNativeMessagingHost::OnNatPolicyChanged(bool nat_traversal_enabled) {
   DCHECK(task_runner()->BelongsToCurrentThread());
 
@@ -498,6 +524,28 @@
   }
 }
 
+void It2MeNativeMessagingHost::OnPolicyError() {
+  LOG(ERROR) << "Malformed policies detected.";
+  policy_received_ = true;
+
+  if (policy_error_closure_for_testing_) {
+    policy_error_closure_for_testing_.Run();
+  }
+
+  if (it2me_host_) {
+    // If there is already a connection, close it and notify the webapp.
+    it2me_host_->Disconnect();
+    it2me_host_ = nullptr;
+    SendPolicyErrorAndExit();
+  } else if (pending_connect_) {
+    // If there is no connection, run the pending connection callback if there
+    // is one, but otherwise do nothing. The policy error will be sent when a
+    // connection is made; doing so beforehand would break assumptions made by
+    // the Chrome app.
+    base::ResetAndReturn(&pending_connect_).Run();
+  }
+}
+
 #if defined(OS_WIN)
 
 bool It2MeNativeMessagingHost::DelegateToElevatedHost(
diff --git a/remoting/host/it2me/it2me_native_messaging_host.h b/remoting/host/it2me/it2me_native_messaging_host.h
index 948c41a..28ca6cdc 100644
--- a/remoting/host/it2me/it2me_native_messaging_host.h
+++ b/remoting/host/it2me/it2me_native_messaging_host.h
@@ -56,6 +56,10 @@
   void OnStateChanged(It2MeHostState state,
                       const std::string& error_message) override;
 
+  // Set a callback to be called when a policy error notification has been
+  // processed.
+  void SetPolicyErrorClosureForTesting(const base::Closure& closure);
+
   static std::string HostStateToString(It2MeHostState host_state);
 
  private:
@@ -72,6 +76,7 @@
                          std::unique_ptr<base::DictionaryValue> response);
   void SendErrorAndExit(std::unique_ptr<base::DictionaryValue> response,
                         const std::string& description) const;
+  void SendPolicyErrorAndExit() const;
   void SendMessageToClient(std::unique_ptr<base::Value> message) const;
 
   // Callback for DelegatingSignalStrategy.
@@ -80,6 +85,9 @@
   // Called when initial policies are read and when they change.
   void OnPolicyUpdate(std::unique_ptr<base::DictionaryValue> policies);
 
+  // Called when malformed policies are detected.
+  void OnPolicyError();
+
   // Returns whether the request was successfully sent to the elevated host.
   bool DelegateToElevatedHost(std::unique_ptr<base::DictionaryValue> message);
 
@@ -125,6 +133,8 @@
   // variable contains the thunk if it is necessary.
   base::Closure pending_connect_;
 
+  base::Closure policy_error_closure_for_testing_;
+
   base::WeakPtr<It2MeNativeMessagingHost> weak_ptr_;
   base::WeakPtrFactory<It2MeNativeMessagingHost> weak_factory_;
 
diff --git a/remoting/host/it2me/it2me_native_messaging_host_unittest.cc b/remoting/host/it2me/it2me_native_messaging_host_unittest.cc
index 830e2b38..5c2c4b8 100644
--- a/remoting/host/it2me/it2me_native_messaging_host_unittest.cc
+++ b/remoting/host/it2me/it2me_native_messaging_host_unittest.cc
@@ -24,6 +24,7 @@
 #include "base/values.h"
 #include "components/policy/core/common/fake_async_policy_loader.h"
 #include "components/policy/core/common/mock_policy_service.h"
+#include "components/policy/policy_constants.h"
 #include "net/base/file_stream.h"
 #include "remoting/base/auto_thread_task_runner.h"
 #include "remoting/host/chromoting_host_context.h"
@@ -195,6 +196,7 @@
   void TearDown() override;
 
  protected:
+  void SetPolicies(const base::DictionaryValue& dict);
   std::unique_ptr<base::DictionaryValue> ReadMessageFromOutputPipe();
   void WriteMessageToInputPipe(const base::Value& message);
 
@@ -202,6 +204,7 @@
   void VerifyErrorResponse();
   void VerifyConnectResponses(int request_id);
   void VerifyDisconnectResponses(int request_id);
+  void VerifyPolicyErrorResponse();
 
   // The Host process should shut down when it receives a malformed request.
   // This is tested by sending a known-good request, followed by |message|,
@@ -210,9 +213,13 @@
   void TestBadRequest(const base::Value& message, bool expect_error_response);
   void TestConnect();
 
+  void SendConnectMessage(int id);
+  void SendDisconnectMessage(int id);
+
  private:
   void StartHost();
   void ExitTest();
+  void ExitPolicyRunLoop();
 
   // Each test creates two unidirectional pipes: "input" and "output".
   // It2MeNativeMessagingHost reads from input_read_file and writes to
@@ -230,6 +237,12 @@
   std::unique_ptr<base::Thread> host_thread_;
   std::unique_ptr<base::RunLoop> host_run_loop_;
 
+  std::unique_ptr<base::RunLoop> policy_run_loop_;
+
+  // Retain a raw pointer to |policy_loader_| in order to control the policy
+  // contents.
+  policy::FakeAsyncPolicyLoader* policy_loader_ = nullptr;
+
   // Task runner of the host thread.
   scoped_refptr<AutoThreadTaskRunner> host_task_runner_;
   std::unique_ptr<remoting::NativeMessagingPipe> pipe_;
@@ -281,6 +294,26 @@
   output_read_file_.Close();
 }
 
+void It2MeNativeMessagingHostTest::SetPolicies(
+    const base::DictionaryValue& dict) {
+  DCHECK(test_message_loop_->task_runner()->RunsTasksOnCurrentThread());
+  // Copy |dict| into |policy_bundle|.
+  policy::PolicyNamespace policy_namespace =
+      policy::PolicyNamespace(policy::POLICY_DOMAIN_CHROME, std::string());
+  policy::PolicyBundle policy_bundle;
+  policy::PolicyMap& policy_map = policy_bundle.Get(policy_namespace);
+  policy_map.LoadFrom(&dict, policy::POLICY_LEVEL_MANDATORY,
+                      policy::POLICY_SCOPE_MACHINE,
+                      policy::POLICY_SOURCE_CLOUD);
+
+  // Simulate a policy update and wait for it to complete.
+  policy_run_loop_.reset(new base::RunLoop);
+  policy_loader_->SetPolicies(policy_bundle);
+  policy_loader_->PostReloadOnBackgroundThread(true /* force reload asap */);
+  policy_run_loop_->Run();
+  policy_run_loop_.reset(nullptr);
+}
+
 std::unique_ptr<base::DictionaryValue>
 It2MeNativeMessagingHostTest::ReadMessageFromOutputPipe() {
   while (true) {
@@ -441,6 +474,14 @@
   }
 }
 
+void It2MeNativeMessagingHostTest::VerifyPolicyErrorResponse() {
+  std::unique_ptr<base::DictionaryValue> response = ReadMessageFromOutputPipe();
+  ASSERT_TRUE(response);
+  std::string type;
+  ASSERT_TRUE(response->GetString("type", &type));
+  ASSERT_EQ("policyError", type);
+}
+
 void It2MeNativeMessagingHostTest::TestBadRequest(const base::Value& message,
                                                   bool expect_error_response) {
   base::DictionaryValue good_message;
@@ -476,17 +517,24 @@
       new PipeMessagingChannel(std::move(input_read_file),
                                std::move(output_write_file)));
 
-  // Creating a native messaging host with a mock It2MeHostFactory.
+  // Creating a native messaging host with a mock It2MeHostFactory and policy
+  // loader.
   std::unique_ptr<ChromotingHostContext> context =
       ChromotingHostContext::Create(host_task_runner_);
+  auto policy_loader =
+      base::MakeUnique<policy::FakeAsyncPolicyLoader>(host_task_runner_);
+  policy_loader_ = policy_loader.get();
   std::unique_ptr<PolicyWatcher> policy_watcher =
-      PolicyWatcher::CreateFromPolicyLoaderForTesting(
-          base::MakeUnique<policy::FakeAsyncPolicyLoader>(
-              base::ThreadTaskRunnerHandle::Get()));
-  std::unique_ptr<extensions::NativeMessageHost> it2me_host(
+      PolicyWatcher::CreateFromPolicyLoaderForTesting(std::move(policy_loader));
+  std::unique_ptr<It2MeNativeMessagingHost> it2me_host(
       new It2MeNativeMessagingHost(
           /*needs_elevation=*/false, std::move(policy_watcher),
           std::move(context), base::WrapUnique(new MockIt2MeHostFactory())));
+  it2me_host->SetPolicyErrorClosureForTesting(
+      base::Bind(base::IgnoreResult(&base::TaskRunner::PostTask),
+                 test_message_loop_->task_runner(), FROM_HERE,
+                 base::Bind(&It2MeNativeMessagingHostTest::ExitPolicyRunLoop,
+                            base::Unretained(this))));
   it2me_host->Start(pipe_.get());
 
   pipe_->Start(std::move(it2me_host), std::move(channel));
@@ -507,12 +555,16 @@
   test_run_loop_->Quit();
 }
 
-void It2MeNativeMessagingHostTest::TestConnect() {
-  base::DictionaryValue connect_message;
-  int next_id = 0;
+void It2MeNativeMessagingHostTest::ExitPolicyRunLoop() {
+  DCHECK(test_message_loop_->task_runner()->RunsTasksOnCurrentThread());
+  if (policy_run_loop_) {
+    policy_run_loop_->Quit();
+  }
+}
 
-  // Send the "connect" request.
-  connect_message.SetInteger("id", ++next_id);
+void It2MeNativeMessagingHostTest::SendConnectMessage(int id) {
+  base::DictionaryValue connect_message;
+  connect_message.SetInteger("id", id);
   connect_message.SetString("type", "connect");
   connect_message.SetString("xmppServerAddress", "talk.google.com:5222");
   connect_message.SetBoolean("xmppServerUseTls", true);
@@ -520,14 +572,21 @@
   connect_message.SetString("userName", "chromo.pyauto@gmail.com");
   connect_message.SetString("authServiceWithToken", "oauth2:sometoken");
   WriteMessageToInputPipe(connect_message);
+}
 
-  VerifyConnectResponses(next_id);
-
+void It2MeNativeMessagingHostTest::SendDisconnectMessage(int id) {
   base::DictionaryValue disconnect_message;
-  disconnect_message.SetInteger("id", ++next_id);
+  disconnect_message.SetInteger("id", id);
   disconnect_message.SetString("type", "disconnect");
   WriteMessageToInputPipe(disconnect_message);
+}
 
+void It2MeNativeMessagingHostTest::TestConnect() {
+  int next_id = 1;
+  SendConnectMessage(next_id);
+  VerifyConnectResponses(next_id);
+  ++next_id;
+  SendDisconnectMessage(next_id);
   VerifyDisconnectResponses(next_id);
 }
 
@@ -590,4 +649,23 @@
   TestBadRequest(message, true);
 }
 
+// Verify rejection if type is unrecognized.
+TEST_F(It2MeNativeMessagingHostTest, BadPoliciesBeforeConnect) {
+  base::DictionaryValue bad_policy;
+  bad_policy.SetInteger(policy::key::kRemoteAccessHostFirewallTraversal, 1);
+  SetPolicies(bad_policy);
+  SendConnectMessage(1);
+  VerifyPolicyErrorResponse();
+}
+
+// Verify rejection if type is unrecognized.
+TEST_F(It2MeNativeMessagingHostTest, BadPoliciesAfterConnect) {
+  base::DictionaryValue bad_policy;
+  bad_policy.SetInteger(policy::key::kRemoteAccessHostFirewallTraversal, 1);
+  SendConnectMessage(1);
+  VerifyConnectResponses(1);
+  SetPolicies(bad_policy);
+  VerifyPolicyErrorResponse();
+}
+
 }  // namespace remoting
diff --git a/remoting/host/policy_watcher.cc b/remoting/host/policy_watcher.cc
index 4dc8beb..2b9a60a4 100644
--- a/remoting/host/policy_watcher.cc
+++ b/remoting/host/policy_watcher.cc
@@ -159,11 +159,7 @@
 }
 
 std::unique_ptr<base::DictionaryValue> PolicyWatcher::GetCurrentPolicies() {
-  // If |old_policies_| is empty, then the PolicyService has not yet provided
-  // policies, so just return the default values. Otherwise, |old_policies_|
-  // already contains all the supported policies, defaults and overrides.
-  return old_policies_->size() == 0 ? GetDefaultPolicies()
-                                    : old_policies_->CreateDeepCopy();
+  return old_policies_->CreateDeepCopy();
 }
 
 std::unique_ptr<base::DictionaryValue> PolicyWatcher::GetDefaultPolicies() {
diff --git a/remoting/host/policy_watcher.h b/remoting/host/policy_watcher.h
index 49d0dd5..37195c5 100644
--- a/remoting/host/policy_watcher.h
+++ b/remoting/host/policy_watcher.h
@@ -59,7 +59,8 @@
       const PolicyUpdatedCallback& policy_updated_callback,
       const PolicyErrorCallback& policy_error_callback);
 
-  // Return the current policies.
+  // Return the current policies. If the policies have not yet been read, or if
+  // an error occurred, the returned dictionary will be empty.
   std::unique_ptr<base::DictionaryValue> GetCurrentPolicies();
 
   // Return the default policies.
diff --git a/remoting/host/policy_watcher_unittest.cc b/remoting/host/policy_watcher_unittest.cc
index 3447f569..2b220a21 100644
--- a/remoting/host/policy_watcher_unittest.cc
+++ b/remoting/host/policy_watcher_unittest.cc
@@ -784,4 +784,14 @@
   ASSERT_TRUE(*current_policies == nat_false_others_default_);
 }
 
+TEST_F(PolicyWatcherTest, GetCurrentPoliciesError) {
+  EXPECT_CALL(mock_policy_callback_, OnPolicyError());
+
+  SetPolicies(nat_one_);
+  StartWatching();
+  std::unique_ptr<base::DictionaryValue> current_policies =
+      policy_watcher_->GetCurrentPolicies();
+  ASSERT_EQ(0u, current_policies->size());
+}
+
 }  // namespace remoting
diff --git a/remoting/host/win/rdp_client_window.cc b/remoting/host/win/rdp_client_window.cc
index 02ccc66..32e7a26 100644
--- a/remoting/host/win/rdp_client_window.cc
+++ b/remoting/host/win/rdp_client_window.cc
@@ -278,16 +278,13 @@
 
   // Instantiate the RDP ActiveX control.
   result = activex_window.CreateControlEx(
-      OLESTR("MsTscAx.MsTscAx"),
-      nullptr,
-      nullptr,
-      control.Receive(),
+      OLESTR("MsTscAx.MsTscAx"), nullptr, nullptr, control.GetAddressOf(),
       __uuidof(mstsc::IMsTscAxEvents),
       reinterpret_cast<IUnknown*>(static_cast<RdpEventsSink*>(this)));
   if (FAILED(result))
     return LogOnCreateError(result);
 
-  result = control.CopyTo(client_.Receive());
+  result = control.CopyTo(client_.GetAddressOf());
   if (FAILED(result))
     return LogOnCreateError(result);
 
@@ -305,7 +302,7 @@
     return LogOnCreateError(result);
 
   // Check to see if the platform exposes the interface used for resizing.
-  result = client_.CopyTo(client_9_.Receive());
+  result = client_.CopyTo(client_9_.GetAddressOf());
   if (FAILED(result) && result != E_NOINTERFACE) {
     return LogOnCreateError(result);
   }
@@ -316,7 +313,7 @@
     return LogOnCreateError(result);
 
   // Fetch IMsRdpClientAdvancedSettings interface for the client.
-  result = client_->get_AdvancedSettings2(client_settings_.Receive());
+  result = client_->get_AdvancedSettings2(client_settings_.GetAddressOf());
   if (FAILED(result))
     return LogOnCreateError(result);
 
@@ -370,7 +367,7 @@
   if (FAILED(result))
     return LogOnCreateError(result);
 
-  result = client_->get_SecuredSettings2(secured_settings2.Receive());
+  result = client_->get_SecuredSettings2(secured_settings2.GetAddressOf());
   if (SUCCEEDED(result)) {
     result =
         secured_settings2->put_AudioRedirectionMode(kRdpAudioModeRedirect);
@@ -378,7 +375,7 @@
       return LogOnCreateError(result);
   }
 
-  result = client_->get_SecuredSettings(secured_settings.Receive());
+  result = client_->get_SecuredSettings(secured_settings.GetAddressOf());
   if (FAILED(result))
     return LogOnCreateError(result);
 
@@ -469,7 +466,7 @@
   // Get the error message as well.
   base::win::ScopedBstr error_message;
   base::win::ScopedComPtr<mstsc::IMsRdpClient5> client5;
-  result = client_.CopyTo(client5.Receive());
+  result = client_.CopyTo(client5.GetAddressOf());
   if (SUCCEEDED(result)) {
     result = client5->GetErrorDescription(reason, extended_code,
                                           error_message.Receive());
diff --git a/remoting/protocol/webrtc_dummy_video_encoder.cc b/remoting/protocol/webrtc_dummy_video_encoder.cc
index 184ea93..52cc34e9 100644
--- a/remoting/protocol/webrtc_dummy_video_encoder.cc
+++ b/remoting/protocol/webrtc_dummy_video_encoder.cc
@@ -171,10 +171,8 @@
     : main_task_runner_(base::ThreadTaskRunnerHandle::Get()) {
   // TODO(isheriff): These do not really affect anything internally
   // in webrtc.
-  codecs_.push_back(cricket::WebRtcVideoEncoderFactory::VideoCodec(
-      webrtc::kVideoCodecVP9, "VP8", 1280, 720, 30));
-  codecs_.push_back(cricket::WebRtcVideoEncoderFactory::VideoCodec(
-      webrtc::kVideoCodecVP9, "VP9", 1280, 720, 30));
+  codecs_.push_back(cricket::VideoCodec("VP8"));
+  codecs_.push_back(cricket::VideoCodec("VP9"));
 }
 
 WebrtcDummyVideoEncoderFactory::~WebrtcDummyVideoEncoderFactory() {
@@ -182,7 +180,9 @@
 }
 
 webrtc::VideoEncoder* WebrtcDummyVideoEncoderFactory::CreateVideoEncoder(
-    webrtc::VideoCodecType type) {
+    const cricket::VideoCodec& codec) {
+  webrtc::VideoCodecType type = webrtc::PayloadNameToCodecType(codec.name)
+                                    .value_or(webrtc::kVideoCodecUnknown);
   WebrtcDummyVideoEncoder* encoder = new WebrtcDummyVideoEncoder(
       main_task_runner_, video_channel_state_observer_, type);
   base::AutoLock lock(lock_);
@@ -194,8 +194,8 @@
   return encoder;
 }
 
-const std::vector<cricket::WebRtcVideoEncoderFactory::VideoCodec>&
-WebrtcDummyVideoEncoderFactory::codecs() const {
+const std::vector<cricket::VideoCodec>&
+WebrtcDummyVideoEncoderFactory::supported_codecs() const {
   return codecs_;
 }
 
diff --git a/remoting/protocol/webrtc_dummy_video_encoder.h b/remoting/protocol/webrtc_dummy_video_encoder.h
index 7ce2cfa45..c90139a 100644
--- a/remoting/protocol/webrtc_dummy_video_encoder.h
+++ b/remoting/protocol/webrtc_dummy_video_encoder.h
@@ -79,9 +79,8 @@
 
   // cricket::WebRtcVideoEncoderFactory interface.
   webrtc::VideoEncoder* CreateVideoEncoder(
-      webrtc::VideoCodecType type) override;
-  const std::vector<cricket::WebRtcVideoEncoderFactory::VideoCodec>& codecs()
-      const override;
+      const cricket::VideoCodec& codec) override;
+  const std::vector<cricket::VideoCodec>& supported_codecs() const override;
   bool EncoderTypeHasInternalSource(webrtc::VideoCodecType type) const override;
   void DestroyVideoEncoder(webrtc::VideoEncoder* encoder) override;
 
@@ -104,7 +103,7 @@
  private:
   scoped_refptr<base::SingleThreadTaskRunner> main_task_runner_;
 
-  std::vector<cricket::WebRtcVideoEncoderFactory::VideoCodec> codecs_;
+  std::vector<cricket::VideoCodec> codecs_;
 
   // Protects |video_channel_state_observer_| and |encoders_|.
   base::Lock lock_;
diff --git a/remoting/resources/remoting_strings.grd b/remoting/resources/remoting_strings.grd
index 7139649..57841ffa0 100644
--- a/remoting/resources/remoting_strings.grd
+++ b/remoting/resources/remoting_strings.grd
@@ -356,6 +356,9 @@
         <message name="IDS_MAC_UNINSTALLER_BUNDLE_NAME" desc="The bundle name specified in the property list of Chrome Remote Desktop Host Uninstaller bundle on MacOS. The Chrome Remote Desktop host allows a user to connect to their computer remotely (it 'hosts' a connection from a remote computer).">
           Chrome Remote Desktop Host Uninstaller
         </message>
+        <message desc="Error displayed when the local computer is configured badly." name="IDS_ERROR_POLICY">
+          There is an error with the policy settings for Chrome Remote Desktop. Contact your system administrator for assistance.
+        </message>
       </if>  <!-- _google_chrome -->
 
       <if expr="not _google_chrome">
@@ -458,6 +461,9 @@
         <message name="IDS_MAC_UNINSTALLER_BUNDLE_NAME" desc="The bundle name specified in the property list of Chromoting Host Uninstaller bundle on MacOS.">
           Chromoting Host Uninstaller
         </message>
+        <message desc="Error displayed when the local computer is configured badly." name="IDS_ERROR_POLICY">
+          There is an error with the policy settings for Chrome Remote Desktop. Contact your system administrator for assistance.
+        </message>
       </if>  <!-- not _google_chrome -->
 
       <message desc="Error that is shown on the client side when incompatible Chrome Remote Desktop versions are installed on host and client." name="IDS_ERROR_INCOMPATIBLE_PROTOCOL" formatter_data="android_java">
diff --git a/remoting/webapp/base/js/error.js b/remoting/webapp/base/js/error.js
index 2c473e08..359c558 100644
--- a/remoting/webapp/base/js/error.js
+++ b/remoting/webapp/base/js/error.js
@@ -193,6 +193,7 @@
   // TODO(garykac): Move app-specific errors into separate location.
   APP_NOT_AUTHORIZED: /*i18n-content*/ 'ERROR_APP_NOT_AUTHORIZED',
   NACL_DISABLED: /*i18n-content*/ 'ERROR_NACL_DISABLED',
+  POLICY_ERROR: /*i18n-content*/ 'ERROR_POLICY',
 };
 
 // A whole bunch of semi-redundant constants, mostly to reduce to size
diff --git a/remoting/webapp/crd/js/host_screen.js b/remoting/webapp/crd/js/host_screen.js
index 3cfaa267..ea14506 100644
--- a/remoting/webapp/crd/js/host_screen.js
+++ b/remoting/webapp/crd/js/host_screen.js
@@ -125,7 +125,7 @@
       function(/** string */ email) {
         hostSession_.connect(
             hostFacade, email, token, onHostStateChanged_,
-            onNatTraversalPolicyChanged_, logDebugInfo_, it2meConnectFailed_);
+            onNatTraversalPolicyChanged_, logDebugInfo_, showShareError_);
       });
 };
 
@@ -247,15 +247,6 @@
   cleanUp();
 }
 
-/**
- * Show a sharing error with error code UNEXPECTED .
- *
- * @return {void} Nothing.
- */
-function it2meConnectFailed_() {
-  showShareError_(remoting.Error.unexpected());
-}
-
 function cleanUp() {
   base.dispose(hostSession_);
   hostSession_ = null;
diff --git a/remoting/webapp/crd/js/host_session.js b/remoting/webapp/crd/js/host_session.js
index 36de9024..fe59ade 100644
--- a/remoting/webapp/crd/js/host_session.js
+++ b/remoting/webapp/crd/js/host_session.js
@@ -70,7 +70,8 @@
  *     for notification of changes to the NAT traversal policy.
  * @param {function(string):void} logDebugInfo Callback allowing the plugin
  *     to log messages to the debug log.
- * @param {function():void} onError Callback to invoke in case of an error.
+ * @param {function(remoting.Error):void} onError Callback to invoke in case
+ *     of an error.
  */
 remoting.HostSession.prototype.connect =
     function(hostFacade, email, accessToken, onStateChanged,
diff --git a/remoting/webapp/crd/js/it2me_host_facade.js b/remoting/webapp/crd/js/it2me_host_facade.js
index 0d517ad..1f240f47 100644
--- a/remoting/webapp/crd/js/it2me_host_facade.js
+++ b/remoting/webapp/crd/js/it2me_host_facade.js
@@ -287,6 +287,12 @@
       }
       break;
 
+    case 'policyError':
+      if (this.onError_) {
+        this.onError_(new remoting.Error(remoting.Error.Tag.POLICY_ERROR));
+      }
+      break;
+
     case 'error':
       console.error(base.getStringAttr(message, 'description'));
       if (this.onError_) {
diff --git a/services/shape_detection/android/java/src/org/chromium/shape_detection/SharedBufferUtils.java b/services/shape_detection/android/java/src/org/chromium/shape_detection/SharedBufferUtils.java
index 807b18d..9112e26 100644
--- a/services/shape_detection/android/java/src/org/chromium/shape_detection/SharedBufferUtils.java
+++ b/services/shape_detection/android/java/src/org/chromium/shape_detection/SharedBufferUtils.java
@@ -8,6 +8,7 @@
 
 import com.google.android.gms.vision.Frame;
 
+import org.chromium.mojo.system.MojoException;
 import org.chromium.mojo.system.SharedBufferHandle;
 import org.chromium.mojo.system.SharedBufferHandle.MapFlags;
 
@@ -35,6 +36,11 @@
 
         Bitmap bitmap = Bitmap.createBitmap(width, height, Bitmap.Config.ARGB_8888);
         bitmap.copyPixelsFromBuffer(imageBuffer);
+        try {
+            frameData.unmap(imageBuffer);
+            frameData.close();
+        } catch (MojoException e) {
+        }
 
         try {
             // This constructor implies a pixel format conversion to YUV.
diff --git a/testing/legion/tools/legion.py b/testing/legion/tools/legion.py
index 85073a9..74014cc 100755
--- a/testing/legion/tools/legion.py
+++ b/testing/legion/tools/legion.py
@@ -53,6 +53,7 @@
 
 
 def GetArgs(cmd_args):
+  default_dimension = ['pool', 'Legion']
   parser = argparse.ArgumentParser(description=__doc__)
   parser.add_argument('action', choices=['run', 'trigger'],
                       help='The swarming action to perform.')
@@ -68,7 +69,8 @@
   parser.add_argument('--task-name', help='Optional. The swarming task name '
                       'to use.')
   parser.add_argument('--dimension', action='append', dest='dimensions',
-                      nargs=2, default=[], help='Dimensions to pass to '
+                      nargs=2, default=default_dimension,
+                      help='Dimensions to pass to '
                       'swarming.py. This is in the form of --dimension key '
                       'value. The minimum required is --dimension os <OS>')
   parser.add_argument('--task', action='append', dest='tasks',
diff --git a/testing/scripts/run_gtest_perf_test.py b/testing/scripts/run_gtest_perf_test.py
index 638929f..06ade5f0 100755
--- a/testing/scripts/run_gtest_perf_test.py
+++ b/testing/scripts/run_gtest_perf_test.py
@@ -88,6 +88,13 @@
       extra_flags = []
       if len(rest_args) > 1:
         extra_flags = rest_args[1:]
+
+      # These flags are to make sure that test output perf metrics in the log.
+      if not '--verbose' in extra_flags:
+        extra_flags.append('--verbose')
+      if not '--test-launcher-print-test-stdio=always' in extra_flags:
+        extra_flags.append('--test-launcher-print-test-stdio=always')
+
       if IsWindows():
         executable = '.\%s.exe' % executable
       else:
diff --git a/testing/variations/fieldtrial_testing_config.json b/testing/variations/fieldtrial_testing_config.json
index 25cc051..9b07021 100644
--- a/testing/variations/fieldtrial_testing_config.json
+++ b/testing/variations/fieldtrial_testing_config.json
@@ -3023,26 +3023,6 @@
             ]
         }
     ],
-    "TranslateRankerLogging": [
-        {
-            "platforms": [
-                "android",
-                "chromeos",
-                "ios",
-                "linux",
-                "mac",
-                "win"
-            ],
-            "experiments": [
-                {
-                    "name": "TranslateRankerLogging",
-                    "enable_features": [
-                        "TranslateRankerLogging"
-                    ]
-                }
-            ]
-        }
-    ],
     "TranslateRankerModel": [
         {
             "platforms": [
diff --git a/third_party/WebKit/LayoutTests/FlagExpectations/enable-blink-features=LayoutNG b/third_party/WebKit/LayoutTests/FlagExpectations/enable-blink-features=LayoutNG
index 7691886..45753d7 100644
--- a/third_party/WebKit/LayoutTests/FlagExpectations/enable-blink-features=LayoutNG
+++ b/third_party/WebKit/LayoutTests/FlagExpectations/enable-blink-features=LayoutNG
@@ -26397,7 +26397,6 @@
 crbug.com/591099 webaudio/OfflineAudioContext/offlineaudiocontext-detached-no-crash.html [ Failure ]
 crbug.com/591099 webaudio/ScriptProcessor/scriptprocessornode-detached-no-crash.html [ Failure ]
 crbug.com/591099 webaudio/ScriptProcessor/scriptprocessornode-rewrap.html [ Failure ]
-crbug.com/591099 webaudio/unit-tests/jstest-test.html [ Failure ]
 crbug.com/591099 webexposed/custom-elements.html [ Failure ]
 crbug.com/591099 webexposed/element-instance-property-listing.html [ Timeout ]
 crbug.com/591099 webexposed/event-target-in-prototype.html [ Failure ]
diff --git a/third_party/WebKit/LayoutTests/FlagExpectations/enable-slimming-paint-v2 b/third_party/WebKit/LayoutTests/FlagExpectations/enable-slimming-paint-v2
index d5c8c14c..d4483dd 100644
--- a/third_party/WebKit/LayoutTests/FlagExpectations/enable-slimming-paint-v2
+++ b/third_party/WebKit/LayoutTests/FlagExpectations/enable-slimming-paint-v2
@@ -1026,36 +1026,35 @@
 Bug(none) fast/writing-mode/border-radius-clipping-vertical-lr.html [ Failure ]
 Bug(none) fast/writing-mode/fieldsets.html [ Failure ]
 Bug(none) paint/invalidation/background-scaling.html [ Crash ]
-Bug(none) paint/invalidation/caret-contenteditable-content-after.html [ Crash ]
-Bug(none) paint/invalidation/composited-iframe-scroll-repaint.html [ Crash ]
+Bug(none) paint/invalidation/caret-contenteditable-content-after.html [ Failure ]
+Bug(none) paint/invalidation/composited-iframe-scroll-repaint.html [ Failure ]
 Bug(none) paint/invalidation/compositing/page-scale-repaint.html [ Crash ]
 Bug(none) paint/invalidation/fixed-in-page-scale.html [ Crash ]
 Bug(none) paint/invalidation/fixed-move-after-keyboard-scroll.html [ Crash ]
 Bug(none) paint/invalidation/fixed-right-bottom-in-page-scale.html [ Crash ]
-Bug(none) paint/invalidation/iframe-scroll-repaint.html [ Crash ]
+Bug(none) paint/invalidation/iframe-scroll-repaint.html [ Failure ]
 Bug(none) paint/invalidation/relayout-fixed-position-after-scale.html [ Crash ]
-Bug(none) paint/invalidation/repaint-subrect-grid.html [ Crash ]
+Bug(none) paint/invalidation/repaint-subrect-grid.html [ Failure ]
 Bug(none) paint/invalidation/scale-page-shrink.html [ Crash ]
-Bug(none) paint/invalidation/scrolled-iframe-scrollbar-change.html [ Crash ]
+Bug(none) paint/invalidation/scrolled-iframe-scrollbar-change.html [ Failure ]
 Bug(none) paint/invalidation/single-line-cells-repeating-thead-break-inside-on-thead-only.html [ Crash ]
 Bug(none) paint/invalidation/svg/absolute-sized-content-with-resources.xhtml [ Crash ]
 Bug(none) paint/invalidation/svg/animate-path-discrete.svg [ Crash ]
 Bug(none) paint/invalidation/svg/animate-path-morphing.svg [ Crash ]
 Bug(none) paint/invalidation/svg/animate-target-removed-from-document.svg [ Crash ]
-Bug(none) paint/invalidation/svg/deep-nested-embedded-svg-size-changes-no-layout-triggers-1.html [ Crash ]
-Bug(none) paint/invalidation/svg/deep-nested-embedded-svg-size-changes-no-layout-triggers-2.html [ Crash ]
+Bug(none) paint/invalidation/svg/deep-nested-embedded-svg-size-changes-no-layout-triggers-1.html [ Failure ]
+Bug(none) paint/invalidation/svg/deep-nested-embedded-svg-size-changes-no-layout-triggers-2.html [ Failure ]
 Bug(none) paint/invalidation/svg/feImage-animated-transform-on-target-rect.svg [ Crash ]
 Bug(none) paint/invalidation/svg/js-late-mask-and-object-creation.svg [ Crash ]
 Bug(none) paint/invalidation/svg/js-late-mask-creation.svg [ Crash ]
-Bug(none) paint/invalidation/svg/js-update-container2.svg [ Crash ]
 Bug(none) paint/invalidation/svg/mask-child-changes.svg [ Crash ]
 Bug(none) paint/invalidation/svg/mask-clip-target-transform.svg [ Crash ]
 Bug(none) paint/invalidation/svg/mask-invalidation.svg [ Crash ]
-Bug(none) paint/invalidation/svg/repaint-moving-svg-and-div.xhtml [ Crash ]
-Bug(none) paint/invalidation/svg/resource-client-removal.svg [ Crash ]
+Bug(none) paint/invalidation/svg/repaint-moving-svg-and-div.xhtml [ Failure ]
+Bug(none) paint/invalidation/svg/resource-client-removal.svg [ Failure ]
 Bug(none) paint/invalidation/svg/resource-invalidate-on-target-update.svg [ Crash ]
 Bug(none) paint/invalidation/svg/text-mask-update.svg [ Crash ]
-Bug(none) paint/invalidation/svg/use-detach.svg [ Crash ]
+Bug(none) paint/invalidation/svg/use-detach.svg [ Failure ]
 Bug(none) paint/invalidation/svg/use-instanceRoot-event-bubbling.xhtml [ Crash ]
 Bug(none) paint/invalidation/svg/viewport-mask-update.html [ Crash ]
 Bug(none) paint/invalidation/table-cell-collapsed-border.html [ Crash ]
@@ -1425,6 +1424,7 @@
 Bug(none) paint/invalidation/overflow-flipped-writing-mode-block.html [ Failure ]
 Bug(none) paint/invalidation/overflow-flipped-writing-mode-table.html [ Failure ]
 Bug(none) paint/invalidation/overflow-hidden-in-overflow-hidden-scrolled.html [ Failure ]
+Bug(none) paint/invalidation/overflow-hidden-to-visible.html [ Failure ]
 Bug(none) paint/invalidation/overflow-hidden-yet-scrolled-with-custom-scrollbar.html [ Failure ]
 Bug(none) paint/invalidation/overflow-hidden-yet-scrolled.html [ Failure ]
 Bug(none) paint/invalidation/overflow-hide.html [ Failure ]
@@ -1724,6 +1724,7 @@
 Bug(none) paint/invalidation/table/resize-table-repaint-percent-size-cell.html [ Failure ]
 Bug(none) paint/invalidation/table/resize-table-repaint-vertical-align-cell.html [ Failure ]
 Bug(none) paint/invalidation/table/resize-table-row-repaint.html [ Failure ]
+Bug(none) paint/invalidation/table/row-change-background-rowspan-cell.html [ Failure ]
 Bug(none) paint/invalidation/text-append-dirty-lines.html [ Failure ]
 Bug(none) paint/invalidation/text-in-relative-positioned-inline.html [ Failure ]
 Bug(none) paint/invalidation/text-match-document-change.html [ Failure ]
@@ -1775,6 +1776,7 @@
 Bug(none) paint/pagination/pagination-change-clip-crash.html [ Failure ]
 Bug(none) paint/selection/text-selection-newline-mixed-ltr-rtl.html [ Failure ]
 Bug(none) paint/selection/text-selection-newline-rtl-double-linebreak.html [ Failure ]
+Bug(none) paint/transparency/compositing-alpha-fold-crash.html [ Failure ]
 Bug(none) svg/as-background-image/tiled-background-image.html [ Crash Timeout ]
 # Mask does not work correctly
 crbug.com/707444 svg/as-background-image/svg-as-background-6.html [ Failure Crash ]
diff --git a/third_party/WebKit/LayoutTests/TestExpectations b/third_party/WebKit/LayoutTests/TestExpectations
index ebef1dc..acce1a9a 100644
--- a/third_party/WebKit/LayoutTests/TestExpectations
+++ b/third_party/WebKit/LayoutTests/TestExpectations
@@ -3257,6 +3257,8 @@
 
 crbug.com/701445 external/wpt/dom/events/EventListener-invoke-legacy.html [ Timeout Pass ]
 
+crbug.com/718394 virtual/enable_asmjs/http/tests/asmjs/asm-warnings.html [ NeedsManualRebaseline ]
+
 # When WebAssembly is exposed in V8 (soon), this test has the wrong number of expected Object.getOwnPropertyNames() for global object.
 
 crbug.com/681468 fast/forms/suggestion-picker/date-suggestion-picker-appearance-zoom125.html [ Failure Pass ]
@@ -3337,6 +3339,16 @@
 # Sheriff failure 2017-05-05
 crbug.com/703533 [ Mac ] shapedetection/detection-security-test.html  [ Crash Pass Timeout ]
 
+# Sheriff failures 2017-05-11
+crbug.com/720511 [ Linux ] http/tests/misc/non-utf8-header-name.php [ Failure Pass Timeout ]
+crbug.com/720511 [ Linux ] http/tests/security/contentSecurityPolicy/directive-parsing-03.html [ Failure Pass Timeout ]
+crbug.com/720511 [ Linux ] http/tests/security/contentSecurityPolicy/source-list-parsing-04.html [ Failure Pass Timeout ]
+crbug.com/720511 [ Linux ] http/tests/security/document-domain-canonicalizes.html [ Failure Pass Timeout ]
+crbug.com/720511 [ Linux ] virtual/mojo-loading/http/tests/misc/non-utf8-header-name.php [ Failure Pass Timeout ]
+crbug.com/720511 [ Linux ] virtual/mojo-loading/http/tests/security/contentSecurityPolicy/directive-parsing-03.html [ Failure Pass Timeout ]
+crbug.com/720511 [ Linux ] virtual/mojo-loading/http/tests/security/contentSecurityPolicy/source-list-parsing-04.html [ Failure Pass Timeout ]
+crbug.com/720511 [ Linux ] virtual/mojo-loading/http/tests/security/document-domain-canonicalizes.html [ Failure Pass Timeout ]
+
 # Tests to be run only under virtual/experimental-canvas-features/
 crbug.com/682753 fast/canvas-experimental [ Skip ]
 
diff --git a/third_party/WebKit/LayoutTests/http/tests/wasm/resources/load-wasm.php b/third_party/WebKit/LayoutTests/http/tests/wasm/resources/load-wasm.php
new file mode 100644
index 0000000..3294a7b0
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/http/tests/wasm/resources/load-wasm.php
@@ -0,0 +1,15 @@
+<?php
+
+    $fileName = "incrementer.wasm";
+    $fileSize = filesize($fileName);
+
+    header("Content-Type: " . "application/wasm");
+
+    $fn = fopen($fileName, "rb");
+    $buffer = fread($fn, $fileSize);
+    print($buffer);
+    flush();
+    fclose($fn);
+
+    exit;
+?>
diff --git a/third_party/WebKit/LayoutTests/http/tests/wasm_streaming/wasm_response_apis.html b/third_party/WebKit/LayoutTests/http/tests/wasm_streaming/wasm_response_apis.html
index 0e9c22a5..3548886 100644
--- a/third_party/WebKit/LayoutTests/http/tests/wasm_streaming/wasm_response_apis.html
+++ b/third_party/WebKit/LayoutTests/http/tests/wasm_streaming/wasm_response_apis.html
@@ -6,6 +6,8 @@
 <script src="../wasm/resources/wasm-module-builder.js"></script>
 <script>
   promise_test(TestStreamedCompile, "test streamed compile");
+  promise_test(TestCompileMimeTypeIsChecked, "test MIME type is verified (compile)");
+  promise_test(TestInstantiateMimeTypeIsChecked, "test MIME type is verified (instantiate)");
   promise_test(TestShortFormStreamedCompile, "test streamed compile with promise parameter");
   promise_test(NegativeTestStreamedCompilePromise, "promise must produce a Response");
   promise_test(CompileBlankResponse, "compile blank response");
diff --git a/third_party/WebKit/LayoutTests/http/tests/wasm_streaming/wasm_response_apis.js b/third_party/WebKit/LayoutTests/http/tests/wasm_streaming/wasm_response_apis.js
index 26d6e3bd..21c2e75 100644
--- a/third_party/WebKit/LayoutTests/http/tests/wasm_streaming/wasm_response_apis.js
+++ b/third_party/WebKit/LayoutTests/http/tests/wasm_streaming/wasm_response_apis.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-const incrementer_url = '../wasm/incrementer.wasm';
+const incrementer_url = '../wasm/resources/load-wasm.php';
 
 function TestStreamedCompile() {
   return fetch(incrementer_url)
@@ -11,6 +11,18 @@
     .then(i => assert_equals(5, i.exports.increment(4)));
 }
 
+function TestCompileMimeTypeIsChecked() {
+  return fetch('../wasm/resources/incrementer.wasm')
+    .then(WebAssembly.compile)
+    .catch(e => e instanceof TypeError);
+}
+
+function TestInstantiateMimeTypeIsChecked() {
+  return fetch('../wasm/resources/incrementer.wasm')
+    .then(WebAssembly.instantiate)
+    .catch(e => e instanceof TypeError);
+}
+
 function TestShortFormStreamedCompile() {
   return WebAssembly.compile(fetch(incrementer_url))
     .then(m => new WebAssembly.Instance(m))
@@ -38,7 +50,7 @@
 function CompileFromArrayBuffer() {
   return fetch(incrementer_url)
     .then(r => r.arrayBuffer())
-    .then(arr => new Response(arr))
+    .then(arr => new Response(arr, {headers:{"Content-Type":"application/wasm"}}))
     .then(WebAssembly.compile)
     .then(m => new WebAssembly.Instance(m))
     .then(i => assert_equals(6, i.exports.increment(5)));
diff --git a/third_party/WebKit/LayoutTests/virtual/enable_asmjs/http/tests/asmjs/asm-warnings-expected.txt b/third_party/WebKit/LayoutTests/virtual/enable_asmjs/http/tests/asmjs/asm-warnings-expected.txt
new file mode 100644
index 0000000..c9915986
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/virtual/enable_asmjs/http/tests/asmjs/asm-warnings-expected.txt
@@ -0,0 +1,3 @@
+CONSOLE WARNING: line 13: Invalid asm.js: Invalid type annotation - forbidden literal.
+CONSOLE WARNING: line 5: Invalid asm.js: Invalid initializer for foreign import - unrecognized annotation.
+
diff --git a/third_party/WebKit/LayoutTests/webaudio/resources/audio-testing.js b/third_party/WebKit/LayoutTests/webaudio/resources/audio-testing.js
deleted file mode 100644
index 41c7edc..0000000
--- a/third_party/WebKit/LayoutTests/webaudio/resources/audio-testing.js
+++ /dev/null
@@ -1,921 +0,0 @@
-/* global self */
-
-// testharness.js has the higher priority.
-var TESTHARNESS = true;
-var JSTEST = false;
-
-(function () {
-    // Selected properies from testharness.js
-    var testharnessProperties = [
-        'test', 'async_test', 'promise_test', 'promise_rejects',
-        'generate_tests', 'setup', 'done', 'assert_true', 'assert_false'
-    ];
-
-    // Selected properties from js-test.js
-    var jsTestProperties = [
-        'isJsTest', 'testPassed', 'testFailed', 'gc', 'finishJSTest'
-    ];
-
-    // Check if testharness.js is properly loaded and set up a flag for it.
-    for (var name in testharnessProperties) {
-        if (!self.hasOwnProperty(testharnessProperties[name])) {
-            TESTHARNESS = false;
-            break;
-        }
-    }
-
-    // Immediately return here because testharness.js is ready.
-    if (TESTHARNESS)
-        return;
-
-    // Because testharness.js is not loaded, let us assume that js-test.js might
-    // be in use. Check if js-test.js is properly loaded and set up a flag for
-    // it.
-    JSTEST = true;
-    for (var name in jsTestProperties) {
-        if (!self.hasOwnProperty(jsTestProperties[name])) {
-            JSTEST = false;
-            break;
-        }
-    }
-
-    // If both are not loaded at all, throw here.
-    if (!JSTEST)
-        throw new Error('Cannot proceed. No test infrastructure is loaded.');
-})();
-
-
-// |Audit| is a task runner for web audio test. It makes asynchronous web audio
-// testing simple and manageable.
-//
-// EXAMPLE:
-//
-//   var audit = Audit.createTaskRunner();
-//   // Define test routine. Make sure to call done() when reached at the end.
-//   audit.defineTask('foo', function (done) {
-//     var context = new AudioContext();
-//     // do things
-//     context.oncomplete = function () {
-//       // verification here
-//       done();
-//     };
-//   });
-//
-//   audit.defineTask('bar', function (done) {
-//     // your code here
-//     done();
-//   });
-//
-//   // Queue tasks by readable task names.
-//   audit.runTasks('foo', 'bar');
-//
-//   // Alternatively, if you want to run all of the defined tasks in the order in which they were
-//   // defined, use no arguments:
-//   audit.runTasks();
- var Audit = (function () {
-
-    'use strict';
-
-    function Tasks() {
-        this.tasks = {};
-        this.queue = [];
-        this.currentTask = 0;
-    }
-
-    // This is to prime the task runner for the testharness.js async operation.
-    Tasks.prototype._initialize = function () {
-        if (TESTHARNESS) {
-            setup(new Function(), {
-                explicit_done: true
-            });
-        }
-    };
-
-    // Finalize the task runner by notifying testharness and testRunner that
-    // all the task is completed.
-    Tasks.prototype._finalize = function () {
-        if (TESTHARNESS) {
-            // From testharness.js
-            done();
-        }
-    };
-
-    Tasks.prototype.defineTask = function (taskName, taskFunc) {
-        // Check if there is a task defined with the same name.  If found, do
-        // not add the task to the roster.
-        if (this.tasks.hasOwnProperty(taskName)) {
-            debug('>> Audit.defineTask:: Duplicate task definition. ("' + taskName + '")');
-            return;
-        }
-
-        this.tasks[taskName] = taskFunc;
-
-        // Push the task name in the order of definition.
-        this.queue.push(taskName);
-    };
-
-    // If arguments are given, only run the requested tasks.  Check for any
-    // undefined or duplicate task in the requested task arguments.  If there
-    // is no argument, run all the defined tasks.
-    Tasks.prototype.runTasks = function () {
-
-        this._initialize();
-
-        if (arguments.length > 0) {
-
-            // Reset task queue and refill it with the with the given arguments,
-            // in argument order.
-            this.queue = [];
-
-            for (var i = 0; i < arguments.length; i++) {
-                if (!this.tasks.hasOwnProperty(arguments[i]))
-                    debug('>> Audit.runTasks:: Ignoring undefined task. ("' + arguments[i] + '")');
-                else if (this.queue.indexOf(arguments[i]) > -1)
-                    debug('>> Audit.runTasks:: Ignoring duplicate task request. ("' + arguments[i] + '")');
-                else
-                    this.queue.push(arguments[i]);
-            }
-        }
-
-        if (this.queue.length === 0) {
-            debug('>> Audit.runTasks:: No task to run.');
-            return;
-        }
-
-        // taskDone() callback from each task.  Increase the task index and call
-        // the next task.  Note that explicit signaling by taskDone() in each
-        // task is needed because some of tests run asynchronously.
-        var taskDone = function () {
-            if (this.currentTask !== this.queue.length - 1) {
-                ++this.currentTask;
-                // debug('>> Audit.runTasks: ' + this.queue[this.currentTask]);
-                this.tasks[this.queue[this.currentTask]](taskDone);
-            } else {
-                this._finalize();
-            }
-            return;
-        }.bind(this);
-
-        // Start the first task.
-        // debug('>> Audit.runTasks: ' + this.queue[this.currentTask]);
-        this.tasks[this.queue[this.currentTask]](taskDone);
-    };
-
-    return {
-        createTaskRunner: function () {
-            return new Tasks();
-        }
-    };
-
-})();
-
-
-// |Should| JS layout test utility.
-// Dependency: ../resources/js-test.js
-var Should = (function () {
-
-    'use strict';
-
-    // ShouldModel internal class. For the exposed (factory) method, it is the
-    // return value of this closure.
-    function ShouldModel(desc, target, opts) {
-        this.desc = desc;
-        this.target = target;
-
-        // Check if the target contains any NaN value.
-        this._checkNaN(this.target, 'ACTUAL');
-
-        // |_testPassed| and |_testFailed| set this appropriately.
-        this._success = false;
-
-        // If the number of errors is greater than this, the rest of error
-        // messages are suppressed. the value is fairly arbitrary, but shouldn't
-        // be too small or too large.
-        this.NUM_ERRORS_LOG = opts.numberOfErrorLog;
-
-        // If the number of array elements is greater than this, the rest of
-        // elements will be omitted.
-        this.NUM_ARRAY_LOG = opts.numberOfArrayLog;
-
-        // If true, verbose output for the failure case is printed, for methods where this makes
-        // sense.
-        this.verbose = !opts.brief;
-
-        // If set, this is the precision with which numbers will be printed.
-        this.PRINT_PRECISION = opts.precision;
-    }
-
-    // Internal methods starting with a underscore.
-    ShouldModel.prototype._testPassed = function (msg, addNewline) {
-        this._success = true;
-        var newLine = addNewline ? '\n' : '';
-        if (TESTHARNESS) {
-            // Using testharness.js
-            test(function () {
-                assert_true(true);
-                }, this.desc + ' ' + msg + '.' + newLine);
-        } else {
-            // Using js-test.js
-            testPassed(this.desc + ' ' + msg + '.' + newLine);
-        }
-    };
-
-    ShouldModel.prototype._testFailed = function (msg, addNewline) {
-        this._success = false;
-        var that = this;
-        var newLine = addNewline ? '\n' : '';
-        if (TESTHARNESS) {
-            test(function () {
-                assert_true(false, that.desc + ' ' + msg + '.' + newLine);
-                }, this.desc);
-        } else {
-            testFailed(this.desc + ' ' + msg + '.' + newLine);
-        }
-    };
-
-    ShouldModel.prototype._isArray = function (arg) {
-      return arg instanceof Array || arg instanceof Float32Array || arg instanceof Uint8Array ||
-        arg instanceof Uint16Array || arg instanceof Uint32Array || arg instanceof Int8Array ||
-        arg instanceof Int16Array || arg instanceof Int32Array || arg instanceof Uint8ClampedArray ||
-        arg instanceof Float64Array;
-    };
-
-    ShouldModel.prototype._assert = function (expression, reason, value) {
-        if (expression)
-            return;
-
-        var failureMessage = 'Assertion failed: ' + reason + ' ' + this.desc +'.';
-        if (arguments.length >= 3)
-            failureMessage += ": " + value;
-
-        if (TESTHARNESS) {
-            test(function () {
-                assert_true(false, reason + ' (' + value + ')');
-            }, this.desc)
-        } else {
-            testFailed(failureMessage);
-        }
-
-        throw failureMessage;
-    };
-
-    // Check the expected value if it is a NaN (Number) or has NaN(s) in
-    // its content (Array or Float32Array). Returns a string depends on the
-    // result of check.
-    ShouldModel.prototype._checkNaN = function (value, label) {
-        var failureMessage = 'NaN found in ' + label + ' while testing "' +
-            this.desc + '"';
-
-        // Checking a single variable first.
-        if (Number.isNaN(value)) {
-            if (TESTHARNESS) {
-                test(function () {
-                    assert_true(false, failureMessage);
-                }, this.desc)
-            } else {
-                testFailed(failureMessage);
-            }
-
-            throw failureMessage;
-        }
-
-        // If the value is not a NaN nor array, we can assume it is safe.
-        if (!this._isArray(value))
-            return;
-
-        // Otherwise, check the array array.
-        var indices = [];
-        for (var i = 0; i < value.length; i++) {
-            if (Number.isNaN(value[i]))
-                indices.push(i);
-        }
-
-        if (indices.length === 0)
-            return;
-
-        var failureDetail = ' (' + indices.length + ' instances total)\n';
-        for (var n = 0; n < indices.length; n++) {
-            failureDetail += '   >> [' + indices[n] + '] = NaN\n';
-            if (n >= this.NUM_ERRORS_LOG) {
-                failureDetail += ' and ' + (indices.length - n) +
-                ' more NaNs...';
-                break;
-            }
-        }
-
-        if (TESTHARNESS) {
-            test(function () {
-                assert_true(false, failureMessage + failureDetail);
-            }, this.desc)
-        } else {
-            testFailed(failureMessage + failureDetail);
-        }
-
-        throw failureMessage;
-    };
-
-    // Check if |target| exists.
-    //
-    // Example:
-    // Should('Object', {}).exist();
-    // Result:
-    // "PASS Object exists."
-    ShouldModel.prototype.exist = function () {
-        if (this.target !== null && this.target !== undefined) {
-            this._testPassed('exists');
-        } else {
-            this._testFailed('does not exist');
-        }
-
-        return this._success;
-    };
-
-    // Check if |target| is equal to |value|.
-    //
-    // Example:
-    // Should('Zero', 0).beEqualTo(0);
-    // Result:
-    // "PASS Zero is equal to 0."
-    ShouldModel.prototype.beEqualTo = function (value) {
-        if (value != null) {
-            var type = typeof value;
-            this._assert(type === 'number' || type === 'string' || type === 'boolean',
-                         'value should be number, string, or boolean for', value);
-        }
-
-        this._checkNaN(value, 'EXPECTED');
-
-        var outputValue = value;
-        if (type === 'string')
-            outputValue = '"' + outputValue + '"';
-        if (this.target === value) {
-            var outputValue = (type === 'string') ? '"' + value + '"' : value;
-            this._testPassed('is equal to ' + outputValue);
-        } else {
-            var targetValue = this.target;
-            if (typeof this.target === 'string')
-                targetValue = '"' + targetValue + '"';
-            this._testFailed('was ' + targetValue + ' instead of ' + outputValue);
-        }
-        return this._success;
-    };
-
-    // Check if |target| is not equal to |value|.
-    //
-    // Example:
-    // Should('One', one).notBeEqualTo(0);
-    // Result:
-    // "PASS One is not equal to 0."
-    ShouldModel.prototype.notBeEqualTo = function (value) {
-        var type = typeof value;
-        this._assert(type === 'number' || type === 'string' || type === "boolean",
-            'value should be number, string, or boolean for', value);
-
-        this._checkNaN(value, 'EXPECTED');
-
-        if (this.target === value)
-            this._testFailed('should not be equal to ' + value);
-        else
-            this._testPassed('is not equal to ' + value);
-        return this._success;
-    };
-
-    // Check if |target| is greater than or equal to |value|.
-    //
-    // Example:
-    // Should("SNR", snr).beGreaterThanOrEqualTo(100);
-    // Result:
-    // "PASS SNR exceeds 100"
-    // "FAIL SNR (n) is not greater than or equal to 100"
-    ShouldModel.prototype.beGreaterThanOrEqualTo = function (value) {
-        var type = typeof value;
-        this._assert(type === 'number' || type === 'string',
-            'value should be number or string for', value);
-
-        this._checkNaN(value, 'EXPECTED');
-
-        var prefix = '(' + this.target + ') ';
-
-        if (this.target >= value) {
-            if (!this.verbose)
-                prefix = '';
-            this._testPassed(prefix + "is greater than or equal to " + value);
-        } else {
-            this._testFailed(prefix + "is not greater than or equal to " + value);
-        }
-        return this._success;
-    }
-
-    // Check if |target| is greater than |value|.
-    //
-    // Example:
-    // Should("SNR", snr).beGreaterThan(100);
-    // Result:
-    // "PASS SNR is greater than 100"
-    // "FAIL SNR (n) is not greater than 100"
-    ShouldModel.prototype.beGreaterThan = function (value) {
-        var type = typeof value;
-        this._assert(type === 'number' || type === 'string',
-            'value should be number or string for', value);
-
-        this._checkNaN(value, 'EXPECTED');
-
-        if (this.target > value)
-            this._testPassed("is greater than " + value);
-        else
-            this._testFailed("(" + this.target + ") is not greater than " + value);
-        return this._success;
-    }
-
-    // Check if |target| is lest than or equal to |value|.
-    //
-    // Example:
-    // maxError = 1e-6;
-    // Should("max error", maxError).beLessThanOrEqualTo(1e-5);
-    // Should("max error", maxError).beLessThanOrEqualTo(-1);
-    // Result:
-    // "PASS max error is less than or equal to 1e-5"
-    // "FAIL max error (1e-6) is not less than or equal to -1"
-    ShouldModel.prototype.beLessThanOrEqualTo = function (value) {
-        var type = typeof value;
-        this._assert(type === 'number', 'value should be number or string for', value);
-
-        this._checkNaN(value, 'EXPECTED');
-
-        var prefix = '(' + this.target + ') ';
-
-        if (this.target <= value) {
-            if (!this.verbose)
-                prefix = '';
-            this._testPassed(prefix + "is less than or equal to " + value);
-        } else {
-            this._testFailed(prefix + "is not less than or equal to " + value);
-        }
-        return this._success;
-    }
-
-    // Check if |target| is close to |value| using the given relative error |threshold|.  |value|
-    // should not be zero, but no check is made for that.  The |target| value is printed to
-    // precision |precision|, with |precision| defaulting to 7.
-    //
-    // If |value| is 0, however, |threshold| is treated as an absolute threshold.
-    //
-    // Example:
-    // Should("One", 1.001).beCloseTo(1, .1);
-    // Should("One", 2).beCloseTo(1, .1);
-    // Result:
-    // "PASS One is 1 within a relative error of 0.1."
-    // "FAIL One is not 1 within a relative error of 0.1: 2"
-    ShouldModel.prototype.beCloseTo = function (value, errorThreshold) {
-        var type = typeof value;
-        this._assert(type === 'number', 'value should be number for', value);
-
-        this._checkNaN(value, 'EXPECTED');
-
-        if (value) {
-            var relativeError = Math.abs(this.target - value) / Math.abs(value);
-            if (relativeError <= errorThreshold) {
-                this._testPassed("is " + value.toPrecision(this.PRINT_PRECISION) +
-                    " within a relative error of " + errorThreshold);
-            } else {
-                // Include actual relative error so the failed test case can be updated with the actual
-                // relative error, if appropriate.
-                this._testFailed("is not " + value.toPrecision(this.PRINT_PRECISION) +
-                    " within a relative error of " + errorThreshold +
-                    ": " + this.target + " with relative error " + relativeError
-                );
-            }
-        } else {
-            var absoluteError = Math.abs(this.target - value);
-            if (absoluteError <= errorThreshold) {
-                this._testPassed("is " + value.toPrecision(this.PRINT_PRECISION) +
-                    " within an absolute error of " + errorThreshold);
-            } else {
-                // Include actual absolute error so the failed test case can be updated with the
-                // actual error, if appropriate.
-                this._testFailed("is not " + value.toPrecision(this.PRINT_PRECISION) +
-                    " within an absolute error of " + errorThreshold +
-                    ": " + this.target + " with absolute error " + absoluteError
-                );
-            }
-        }
-        return this._success;
-    }
-
-    // Check if |func| throws an exception with a certain |errorType| correctly.
-    // |errorType| is optional.
-    //
-    // Example:
-    // Should('A bad code', function () { var a = b; }).throw();
-    // Result:
-    // "PASS A bad code threw an exception."
-    // Example:
-    // Should('var c = d', function () { var c = d; }).throw('ReferenceError');
-    // "PASS var c = d threw ReferenceError."
-    ShouldModel.prototype.throw = function (errorType) {
-        if (typeof this.target !== 'function') {
-            console.log('target is not a function. test halted.');
-            return;
-        }
-
-        try {
-            this.target();
-            this._testFailed('did not throw an exception');
-        } catch (error) {
-            if (errorType === undefined)
-                this._testPassed('threw an exception of type ' + error.name);
-            else if (error.name === errorType)
-                this._testPassed('threw ' + errorType + ': ' + error.message);
-            else if (self.hasOwnProperty(errorType) && error instanceof self[errorType])
-                this._testPassed('threw ' + errorType + ': ' + error.message);
-            else
-                this._testFailed('threw ' + error.name + ' instead of ' + errorType);
-        }
-        return this._success;
-    };
-
-    // Check if |func| does not throw an exception.
-    //
-    // Example:
-    // Should('var foo = "bar"', function () { var foo = 'bar'; }).notThrow();
-    // Result:
-    // "PASS var foo = "bar" did not throw an exception."
-    ShouldModel.prototype.notThrow = function () {
-        try {
-            this.target();
-            this._testPassed('did not throw an exception');
-        } catch (error) {
-            this._testFailed('threw ' + error.name + ': ' + error.message);
-        }
-        return this._success;
-    };
-
-    // Check if |target| array is filled with constant values.
-    //
-    // Example:
-    // Should('[2, 2, 2]', [2, 2, 2]).beConstantValueOf(2);
-    // Result:
-    // "PASS [2, 2, 2] has constant values of 2."
-    ShouldModel.prototype.beConstantValueOf = function (value) {
-        this._checkNaN(value, 'EXPECTED');
-
-        var mismatches = {};
-        for (var i = 0; i < this.target.length; i++) {
-            if (this.target[i] !== value)
-            mismatches[i] = this.target[i];
-        }
-
-        var numberOfmismatches = Object.keys(mismatches).length;
-
-        if (numberOfmismatches === 0) {
-            this._testPassed('contains only the constant ' + value);
-        } else {
-            var counter = 0;
-            var failureMessage = 'contains ' + numberOfmismatches +
-            ' values that are NOT equal to ' + value + ':';
-            for (var index in mismatches) {
-                failureMessage += '\n[' + index + '] : ' + mismatches[index];
-                if (++counter >= this.NUM_ERRORS_LOG) {
-                    failureMessage += '\nand ' + (numberOfmismatches - counter) +
-                    ' more differences...';
-                    break;
-                }
-            }
-            this._testFailed(failureMessage);
-        }
-        return this._success;
-    };
-
-    // Check if |target| array is identical to |expected| array element-wise.
-    //
-    // Example:
-    // Should('[1, 2, 3]', [1, 2, 3]).beEqualToArray([1, 2, 3]);
-    // Result:
-    // "PASS [1, 2, 3] is identical to the array [1,2,3]."
-    ShouldModel.prototype.beEqualToArray = function (array) {
-        this._assert(this._isArray(array) && this.target.length === array.length,
-            'Invalid array or the length does not match.', array);
-
-        this._checkNaN(array, 'EXPECTED');
-
-        var mismatches = {};
-        for (var i = 0; i < this.target.length; i++) {
-            if (this.target[i] !== array[i])
-                mismatches[i] = this.target[i];
-        }
-
-        var numberOfmismatches = Object.keys(mismatches).length;
-        var arrSlice = array.slice(0, this.NUM_ARRAY_LOG);
-        var arrStr = arrSlice[0].toPrecision(this.PRINT_PRECISION);
-        for (var k = 1; k < arrSlice.length; ++k)
-            arrStr += ',' + arrSlice[k].toPrecision(this.PRINT_PRECISION);
-        if (array.length > this.NUM_ARRAY_LOG)
-            arrStr += ',...';
-
-        if (numberOfmismatches === 0) {
-            this._testPassed('is identical to the array [' + arrStr + ']');
-        } else {
-            var counter = 0;
-            var failureMessage = 'is not equal to the array [' + arrStr + ']';
-            if (this.verbose)
-                failureMessage += '\nindex\tActual\t\tExpected';
-            for (var index in mismatches) {
-                failureMessage += '\n[' + index + '] : ' + mismatches[index];
-                if (this.verbose)
-                    failureMessage += '\t' + array[index];
-                if (++counter >= this.NUM_ERRORS_LOG) {
-                    failureMessage += '\nand ' + (numberOfmismatches - counter) +
-                    ' more differences...';
-                    break;
-                }
-            }
-
-            this._testFailed(failureMessage);
-        }
-        return this._success;
-    };
-
-    // Check if |target| array is close to |expected| array element-wise within
-    // an certain error bound given by |absoluteThresholdOrOptions|.
-    //
-    // The error criterion is:
-    //
-    //   Math.abs(target[k] - expected[k]) < Math.max(abserr, relerr * Math.abs(expected))
-    //
-    // If |absoluteThresholdOrOptions| is a number, t, then abserr = t and relerr = 0.  That is the
-    // max difference is bounded by t.
-    //
-    // If |absoluteThresholdOrOptions| is a property bag, then abserr is the value of the
-    // absoluteThreshold property and relerr is the value of the relativeThreshold property.  If
-    // nothing is given, then abserr = relerr = 0.  If abserr = 0, then the error criterion is a
-    // relative error.  A non-zero abserr value produces a mix intended to handle the case where the
-    // expected value is 0, allowing the target value to differ by abserr from the expected.
-    //
-    // Example:
-    // Should('My array', [0.11, 0.19]).beCloseToArray([0.1, 0.2], 0.02);
-    // Result:
-    // "PASS My array equals [0.1,0.2] within an element-wise tolerance of 0.02."
-    ShouldModel.prototype.beCloseToArray = function (expected, absoluteThresholdOrOptions) {
-        // For the comparison, the target length must be bigger than the expected.
-        this._assert(this.target.length >= expected.length,
-            'The target array length must be longer than ' + expected.length +
-            ' but got ' + this.target.length + '.');
-
-        this._checkNaN(expected, 'EXPECTED');
-
-        var absoluteErrorThreshold = 0;
-        var relativeErrorThreshold = 0;
-
-        // A collection of all of the values that satisfy the error criterion.  This holds the
-        // absolute difference between the target element and the expected element.
-        var mismatches = {};
-
-        // Keep track of the max absolute error found
-        var maxAbsError = -Infinity;
-        var maxAbsErrorIndex = -1;
-        // Keep trac of the max relative error found, ignoring cases where the relative error is
-        // Infinity because the expected value is 0.
-        var maxRelError = -Infinity;
-        var maxRelErrorIndex = -1;
-
-        // A number or string for printing out the actual thresholds used for the error criterion.
-        var maxAllowedError;
-
-        // Set up the thresholds based on |absoluteThresholdOrOptions|.
-        if (typeof(absoluteThresholdOrOptions) === 'number') {
-            absoluteErrorThreshold = absoluteThresholdOrOptions;
-            maxAllowedError = absoluteErrorThreshold;
-        } else {
-            var opts = absoluteThresholdOrOptions;
-            if (opts.hasOwnProperty('absoluteThreshold'))
-                absoluteErrorThreshold = opts.absoluteThreshold;
-            if (opts.hasOwnProperty('relativeThreshold'))
-                relativeErrorThreshold = opts.relativeThreshold;
-            maxAllowedError = '{absoluteThreshold: ' + absoluteErrorThreshold
-              + ', relativeThreshold: ' + relativeErrorThreshold
-              + '}';
-        }
-
-        for (var i = 0; i < expected.length; i++) {
-            var diff = Math.abs(this.target[i] - expected[i]);
-            if (diff > Math.max(absoluteErrorThreshold, relativeErrorThreshold * Math.abs(expected[i]))) {
-                mismatches[i] = diff;
-                // Keep track of the location of the absolute max difference.
-                if (diff > maxAbsError) {
-                    maxAbsErrorIndex = i;
-                    maxAbsError = diff;
-                }
-                // Keep track of the location of the max relative error, ignoring cases where the
-                // relative error is NaN.
-                var relError = diff / Math.abs(expected[i]);
-                if (!isNaN(relError) && relError > maxRelError) {
-                    maxRelErrorIndex = i;
-                    maxRelError = relError;
-                }
-            }
-        }
-
-        var numberOfmismatches = Object.keys(mismatches).length;
-        var arrSlice = expected.slice(0, Math.min(expected.length, this.NUM_ARRAY_LOG));
-        var arrStr;
-
-        arrStr = arrSlice[0].toPrecision(this.PRINT_PRECISION);
-        for (var k = 1; k < arrSlice.length; ++k)
-            arrStr += ',' + arrSlice[k].toPrecision(this.PRINT_PRECISION);
-
-        if (expected.length > this.NUM_ARRAY_LOG)
-            arrStr += ',...';
-        if (numberOfmismatches === 0) {
-            this._testPassed('equals [' + arrStr +
-                '] with an element-wise tolerance of ' + maxAllowedError);
-        } else {
-            var counter = 0;
-            var failureMessage = 'does not equal [' + arrStr +
-                '] with an element-wise tolerance of ' + maxAllowedError;
-
-            // Print a nice header for the  table to follow.
-            if (this.verbose)
-                failureMessage += "\nIndex     Actual                  Expected                Diff                   Relative";
-            else
-                failureMessage += "\nDifference between expected and actual:";
-
-            for (var index in mismatches) {
-                failureMessage += '\n[' + index + ']:    ';
-                if (this.verbose) {
-                    // When verbose, print out actual, expected, absolute error, and relative error.
-                    // TODO: print these out in nice columns to make it easier to read.
-                    var relError = Math.abs(this.target[index] - expected[index]) / Math.abs(expected[index]);
-                    failureMessage += this.target[index].toExponential(16) + '   '
-                            + expected[index].toExponential(16) + '   '
-                            + mismatches[index].toExponential(16) + '  '
-                            + relError.toExponential(16) + '  '
-                            + Math.max(absoluteErrorThreshold,
-                                       relativeErrorThreshold * Math.abs(expected[index]));
-                } else {
-                    // Otherwise, just the print the absolute error.
-                    failureMessage += mismatches[index];
-                }
-                if (++counter >= this.NUM_ERRORS_LOG) {
-                    failureMessage += '\nand ' + (numberOfmismatches - counter) +
-                            ' more differences, with max absolute error';
-                    if (this.verbose) {
-                        // When verbose, print out the location of both the max absolute error and
-                        // the max relative error so we can adjust thresholds appropriately in the
-                        // test.
-                        var relError = Math.abs(this.target[maxAbsErrorIndex] - expected[maxAbsErrorIndex])
-                                / Math.abs(expected[maxAbsErrorIndex]);
-                        failureMessage += ' at index ' + maxAbsErrorIndex + ':';
-                        failureMessage += '\n[' + maxAbsErrorIndex + ']:    ';
-                        failureMessage += this.target[maxAbsErrorIndex].toExponential(16) + '   '
-                                + expected[maxAbsErrorIndex].toExponential(16) + '   '
-                                + mismatches[maxAbsErrorIndex].toExponential(16) + '   '
-                                + relError.toExponential(16) + '  '
-                                + Math.max(absoluteErrorThreshold,
-                                    relativeErrorThreshold * Math.abs(expected[maxAbsErrorIndex]));
-                        failureMessage += '\nand max relative error';
-                        failureMessage += ' at index ' + maxRelErrorIndex + ':';
-                        failureMessage += '\n[' + maxRelErrorIndex + ']:    ';
-                        failureMessage += this.target[maxRelErrorIndex].toExponential(16) + '   '
-                                + expected[maxRelErrorIndex].toExponential(16) + '   '
-                                + mismatches[maxRelErrorIndex].toExponential(16) + '   '
-                                + maxRelError.toExponential(16) + '  '
-                                + Math.max(absoluteErrorThreshold,
-                                    relativeErrorThreshold * Math.abs(expected[maxRelErrorIndex]));
-                    } else {
-                        // Not verbose, so just print out the max absolute error
-                        failureMessage += ' of ' + maxAbsError + ' at index ' + maxAbsErrorIndex;
-                    }
-                    break;
-                }
-            }
-
-            this._testFailed(failureMessage);
-        }
-        return this._success;
-    };
-
-    // Check if |target| array contains a set of values in a certain order.
-    //
-    // Example:
-    // Should('My random array', [1, 1, 3, 3, 2]).containValues([1, 3, 2]);
-    // Result:
-    // "PASS My random array contains all the expected values in the correct
-    //  order: [1,3,2]."
-    ShouldModel.prototype.containValues = function (expected) {
-        this._checkNaN(expected, 'EXPECTED');
-
-        var indexExpected = 0, indexActual = 0;
-        while (indexExpected < expected.length && indexActual < this.target.length) {
-            if (expected[indexExpected] === this.target[indexActual])
-                indexActual++;
-            else
-                indexExpected++;
-        }
-
-        if (indexExpected < expected.length-1 || indexActual < this.target.length-1) {
-            this._testFailed('contains an unexpected value ' + this.target[indexActual] +
-            ' at index ' + indexActual);
-        } else {
-            this._testPassed('contains all the expected values in the correct order: [' +
-            expected + ']');
-        }
-        return this._success;
-    };
-
-    // Check if |target| array does not have any glitches. Note that |threshold|
-    // is not optional and is to define the desired threshold value.
-    //
-    // Example:
-    // Should('Channel #0', chanL).notGlitch(0.0005);
-    // Result:
-    // "PASS Channel #0 has no glitch above the threshold of 0.0005."
-    ShouldModel.prototype.notGlitch = function (threshold) {
-        this._checkNaN(threshold, 'EXPECTED');
-
-        for (var i = 1; i < this.target.length; i++) {
-            var diff = Math.abs(this.target[i-1] - this.target[i]);
-            if (diff >= threshold) {
-                this._testFailed('has a glitch at index ' + i + ' of size ' + diff);
-                return this._success;
-            }
-        }
-        this._testPassed('has no glitch above the threshold of ' + threshold);
-        return this._success;
-    };
-
-    // Check if the target promise is resolved correctly.
-    //
-    // Example:
-    // Should('My promise', promise).beResolved().then(nextStuff);
-    // Result:
-    // "PASS My promise resolved correctly."
-    // "FAIL My promise rejected incorrectly (with _ERROR_)."
-    ShouldModel.prototype.beResolved = function () {
-        return this.target.then(function () {
-            this._testPassed('resolved correctly');
-        }.bind(this), function (err) {
-            this._testFailed('rejected incorrectly (with ' + err + ')');
-        }.bind(this));
-    };
-
-    // Check if the target promise is rejected correctly.
-    //
-    // Example:
-    // Should('My promise', promise).beRejected().then(nextStuff);
-    // Result:
-    // "PASS My promise rejected correctly (with _ERROR_)."
-    // "FAIL My promise resolved incorrectly."
-    ShouldModel.prototype.beRejected = function () {
-        return this.target.then(function () {
-            this._testFailed('resolved incorrectly');
-        }.bind(this), function (err) {
-            this._testPassed('rejected correctly (with ' + err + ')');
-        }.bind(this));
-    };
-
-    // A summary message
-    //
-    // Example:
-    // Should("Summary1", true).summarize("passed1", "failed1");
-    // Should("Summary2", false).summarize("passed2", "failed2");
-    // Result:
-    // "PASS Summary1: passed1."
-    // "FAIL Summary2: failed2."
-    ShouldModel.prototype.summarize = function (pass, fail) {
-        // It's really nice to have blank lines after the summary, but
-        // testharness thinks the whole testsuite fails if we do that.
-        if (this.target)
-            this._testPassed(pass, false);
-        else
-            this._testFailed(fail, false);
-        return this._success;
-    }
-
-    // Should() method.
-    //
-    // |desc| is the description of the task or check and |target| is a value
-    // needs to be checked or a task to be performed. |opt| contains options for
-    // printing out log messages: options are |opt.numberOfErrorLog| and
-    // |opts.numberOfArrayLog|.
-    return function (desc, target, opts) {
-        var _opts = {
-            numberOfErrorLog: 8,
-            numberOfArrayLog: 16,
-            verbose: true
-        };
-
-        if (opts instanceof Object) {
-            if (opts.hasOwnProperty('numberOfErrorLog'))
-                _opts.numberOfErrorLog = opts.numberOfErrorLog;
-            if (opts.hasOwnProperty('numberOfArrayLog'))
-                _opts.numberOfArrayLog = opts.numberOfArrayLog;
-            if (opts.hasOwnProperty('brief'))
-                _opts.brief = opts.brief;
-            if (opts.hasOwnProperty('precision'))
-                _opts.precision = opts.precision;
-        }
-
-        return new ShouldModel(desc, target, _opts);
-    };
-
-})();
diff --git a/third_party/WebKit/LayoutTests/webaudio/unit-tests/jstest-test.html b/third_party/WebKit/LayoutTests/webaudio/unit-tests/jstest-test.html
deleted file mode 100644
index d7cb0a5..0000000
--- a/third_party/WebKit/LayoutTests/webaudio/unit-tests/jstest-test.html
+++ /dev/null
@@ -1,48 +0,0 @@
-<!DOCTYPE html>
-<html>
-<head>
-  <title>A simple unit testing for audio-testing.js and js-test.js</title>
-  <script src="../../resources/js-test.js"></script>
-  <script src="../resources/audit-util.js"></script>
-  <script src="../resources/audio-testing.js"></script>
-</head>
-<body>
-  <script>
-    description('A simple unit testing for audio-testing.js and js-test.js');
-    window.jsTestIsAsync = true;
-    
-    var audit = Audit.createTaskRunner();
-
-    audit.defineTask('foo', function (taskDone) {
-      Should('Zero', 0).beEqualTo(0);
-      Should('One', 1).notBeEqualTo(0);
-      Should('Expected SNR', 110).beGreaterThanOrEqualTo(100);
-      taskDone();
-    });
-
-    audit.defineTask('bar', function (taskDone) {
-      var maxError = 1e-6;
-      Should("Maximum error value", maxError).beLessThanOrEqualTo(1e-5);
-      Should("max error", maxError).beLessThanOrEqualTo(-1);
-      Should('One point double zero one', 1.001).beCloseTo(1, .1);
-      Should('Two', 2).beCloseTo(1, .1);
-      taskDone();
-    });
-
-    audit.defineTask('boo', function (taskDone) {
-      Should('[2, 2, 2]', [2, 2, 2]).beConstantValueOf(2);
-      Should('[1, 2, 3]', [1, 2, 3]).beEqualToArray([1, 2, 3]);
-      Should('My array', [0.11, 0.19]).beCloseToArray([0.1, 0.2], 0.02);
-      Should('My random array', [1, 1, 3, 3, 2]).containValues([1, 3, 2]);
-      taskDone();
-    });
-
-    audit.defineTask("finish", function (done) {
-      finishJSTest();
-      done();
-    });
-
-    audit.runTasks();
-  </script>
-</body>
-</html>
diff --git a/third_party/WebKit/LayoutTests/webaudio/unit-tests/testharness-test.html b/third_party/WebKit/LayoutTests/webaudio/unit-tests/testharness-test.html
deleted file mode 100644
index b74ae440..0000000
--- a/third_party/WebKit/LayoutTests/webaudio/unit-tests/testharness-test.html
+++ /dev/null
@@ -1,44 +0,0 @@
-<!DOCTYPE html>
-<html>
-<head>
-  <title>A simple unit testing for audio-testing.js and testharness.js</title>
-  
-  <!-- This is the required dependency for testharness + audio-testing. Note
-    that the including order matters because audio-testing.js depends on
-    testharness.js -->
-  <script src="../../resources/testharness.js"></script>
-  <script src="../../resources/testharnessreport.js"></script>
-  <script src="../resources/audit-util.js"></script>
-  <script src="../resources/audio-testing.js"></script>
-
-</head>
-<body>
-  <script>
-    var audit = Audit.createTaskRunner();
-
-    audit.defineTask('foo', function (taskDone) {
-      Should('Zero', 0).beEqualTo(0);
-      Should('One', 1).notBeEqualTo(0);
-      Should('Expected SNR', 110).beGreaterThanOrEqualTo(100);
-      taskDone();
-    });
-
-    audit.defineTask('bar', function (taskDone) {
-      var maxError = 1e-6;
-      Should("Maximum error value", maxError).beLessThanOrEqualTo(1e-5);
-      Should('One point double zero one', 1.001).beCloseTo(1, .1);
-      taskDone();
-    });
-
-    audit.defineTask('boo', function (taskDone) {
-      Should('[2, 2, 2]', [2, 2, 2]).beConstantValueOf(2);
-      Should('[1, 2, 3]', [1, 2, 3]).beEqualToArray([1, 2, 3]);
-      Should('My array', [0.11, 0.19]).beCloseToArray([0.1, 0.2], 0.02);
-      Should('My random array', [1, 1, 3, 3, 2]).containValues([1, 3, 2]);
-      taskDone();
-    });
-
-    audit.runTasks();
-  </script>
-</body>
-</html>
diff --git a/third_party/WebKit/Source/bindings/modules/v8/wasm/WasmResponseExtensions.cpp b/third_party/WebKit/Source/bindings/modules/v8/wasm/WasmResponseExtensions.cpp
index 6072d24..52be3ff 100644
--- a/third_party/WebKit/Source/bindings/modules/v8/wasm/WasmResponseExtensions.cpp
+++ b/third_party/WebKit/Source/bindings/modules/v8/wasm/WasmResponseExtensions.cpp
@@ -168,6 +168,17 @@
   }
 
   Response* response = V8Response::toImpl(v8::Local<v8::Object>::Cast(args[0]));
+  if (response->MimeType() != "application/wasm") {
+    V8SetReturnValue(
+        args,
+        ScriptPromise::Reject(
+            script_state,
+            V8ThrowException::CreateTypeError(
+                script_state->GetIsolate(),
+                "Incorrect response MIME type. Expected 'application/wasm'."))
+            .V8Value());
+    return;
+  }
   ScriptPromise promise;
   if (response->IsBodyLocked() || response->bodyUsed()) {
     promise = ScriptPromise::Reject(
diff --git a/third_party/WebKit/Source/core/editing/spellcheck/HotModeSpellCheckRequester.cpp b/third_party/WebKit/Source/core/editing/spellcheck/HotModeSpellCheckRequester.cpp
index b8a8f14..801413f 100644
--- a/third_party/WebKit/Source/core/editing/spellcheck/HotModeSpellCheckRequester.cpp
+++ b/third_party/WebKit/Source/core/editing/spellcheck/HotModeSpellCheckRequester.cpp
@@ -19,6 +19,7 @@
 
 namespace {
 
+const int kHotModeCheckAllThreshold = 128;
 const int kHotModeChunkSize = 1024;
 
 EphemeralRange AdjacentWordIfExists(const Position& pos) {
@@ -65,12 +66,25 @@
 
 EphemeralRange CalculateHotModeCheckingRange(const Element& editable,
                                              const Position& position) {
+  // Check everything in |editable| if its total length is short.
   const EphemeralRange& full_range = EphemeralRange::RangeOfContents(editable);
   const int full_length = TextIterator::RangeLength(full_range.StartPosition(),
                                                     full_range.EndPosition());
-  if (full_length <= kHotModeChunkSize)
+  // TODO(xiaochengh): There is no need to check if |full_length <= 2|, since
+  // we don't consider two characters as misspelled. However, a lot of layout
+  // tests depend on "zz" as misspelled, which should be changed.
+  if (full_length <= kHotModeCheckAllThreshold)
     return full_range;
 
+  // Otherwise, if |position| is in a short paragraph, check the paragraph.
+  const EphemeralRange& paragraph_range =
+      ExpandToParagraphBoundary(EphemeralRange(position));
+  const int paragraph_length = TextIterator::RangeLength(
+      paragraph_range.StartPosition(), paragraph_range.EndPosition());
+  if (paragraph_length <= kHotModeChunkSize)
+    return paragraph_range;
+
+  // Otherwise, check a chunk of text centered at |position|.
   TextIteratorBehavior behavior = TextIteratorBehavior::Builder()
                                       .SetEmitsObjectReplacementCharacter(true)
                                       .Build();
diff --git a/third_party/WebKit/Source/core/frame/FrameView.cpp b/third_party/WebKit/Source/core/frame/FrameView.cpp
index 4c78203..8d4c481c 100644
--- a/third_party/WebKit/Source/core/frame/FrameView.cpp
+++ b/third_party/WebKit/Source/core/frame/FrameView.cpp
@@ -3744,10 +3744,12 @@
                               ? new Vector<ObjectPaintInvalidation>
                               : nullptr);
       if (RuntimeEnabledFeatures::slimmingPaintV2Enabled()) {
+        if (!paint_controller_)
+          paint_controller_ = PaintController::Create();
         paint_controller_->SetTracksRasterInvalidations(
             track_paint_invalidations);
-        paint_artifact_compositor_->SetTracksRasterInvalidations(
-            track_paint_invalidations);
+        if (paint_artifact_compositor_)
+          paint_artifact_compositor_->ResetTrackedRasterInvalidations();
       } else {
         layout_view.Compositor()->SetTracksRasterInvalidations(
             track_paint_invalidations);
diff --git a/third_party/WebKit/Source/platform/graphics/paint/PaintController.cpp b/third_party/WebKit/Source/platform/graphics/paint/PaintController.cpp
index c5ee0d2..f39d34c 100644
--- a/third_party/WebKit/Source/platform/graphics/paint/PaintController.cpp
+++ b/third_party/WebKit/Source/platform/graphics/paint/PaintController.cpp
@@ -21,7 +21,8 @@
 namespace blink {
 
 void PaintController::SetTracksRasterInvalidations(bool value) {
-  if (value) {
+  if (value ||
+      RuntimeEnabledFeatures::paintUnderInvalidationCheckingEnabled()) {
     paint_chunks_raster_invalidation_tracking_map_ =
         WTF::WrapUnique(new RasterInvalidationTrackingMap<const PaintChunk>);
   } else {
@@ -597,9 +598,15 @@
 
   // The new list will not be appended to again so we can release unused memory.
   new_display_item_list_.ShrinkToFit();
+
+  if (paint_chunks_raster_invalidation_tracking_map_) {
+    for (const auto& chunk : current_paint_artifact_.PaintChunks())
+      paint_chunks_raster_invalidation_tracking_map_->Remove(&chunk);
+  }
   current_paint_artifact_ = PaintArtifact(
       std::move(new_display_item_list_), new_paint_chunks_.ReleasePaintChunks(),
       num_slow_paths <= kMaxNumberOfSlowPathsBeforeVeto);
+
   ResetCurrentListIndices();
   out_of_order_item_indices_.clear();
   out_of_order_chunk_indices_.clear();
diff --git a/third_party/boringssl/BUILD.generated.gni b/third_party/boringssl/BUILD.generated.gni
index c8b140ab..e706de9 100644
--- a/third_party/boringssl/BUILD.generated.gni
+++ b/third_party/boringssl/BUILD.generated.gni
@@ -59,21 +59,18 @@
   "src/crypto/bytestring/cbs.c",
   "src/crypto/bytestring/internal.h",
   "src/crypto/chacha/chacha.c",
-  "src/crypto/cipher/aead.c",
-  "src/crypto/cipher/cipher.c",
-  "src/crypto/cipher/derive_key.c",
-  "src/crypto/cipher/e_aes.c",
-  "src/crypto/cipher/e_aesctrhmac.c",
-  "src/crypto/cipher/e_aesgcmsiv.c",
-  "src/crypto/cipher/e_chacha20poly1305.c",
-  "src/crypto/cipher/e_des.c",
-  "src/crypto/cipher/e_null.c",
-  "src/crypto/cipher/e_rc2.c",
-  "src/crypto/cipher/e_rc4.c",
-  "src/crypto/cipher/e_ssl3.c",
-  "src/crypto/cipher/e_tls.c",
-  "src/crypto/cipher/internal.h",
-  "src/crypto/cipher/tls_cbc.c",
+  "src/crypto/cipher_extra/cipher_extra.c",
+  "src/crypto/cipher_extra/derive_key.c",
+  "src/crypto/cipher_extra/e_aesctrhmac.c",
+  "src/crypto/cipher_extra/e_aesgcmsiv.c",
+  "src/crypto/cipher_extra/e_chacha20poly1305.c",
+  "src/crypto/cipher_extra/e_null.c",
+  "src/crypto/cipher_extra/e_rc2.c",
+  "src/crypto/cipher_extra/e_rc4.c",
+  "src/crypto/cipher_extra/e_ssl3.c",
+  "src/crypto/cipher_extra/e_tls.c",
+  "src/crypto/cipher_extra/internal.h",
+  "src/crypto/cipher_extra/tls_cbc.c",
   "src/crypto/cmac/cmac.c",
   "src/crypto/conf/conf.c",
   "src/crypto/conf/conf_def.h",
@@ -96,23 +93,9 @@
   "src/crypto/digest_extra/internal.h",
   "src/crypto/dsa/dsa.c",
   "src/crypto/dsa/dsa_asn1.c",
-  "src/crypto/ec/ec.c",
-  "src/crypto/ec/ec_asn1.c",
-  "src/crypto/ec/ec_key.c",
-  "src/crypto/ec/ec_montgomery.c",
-  "src/crypto/ec/internal.h",
-  "src/crypto/ec/oct.c",
-  "src/crypto/ec/p224-64.c",
-  "src/crypto/ec/p256-64.c",
-  "src/crypto/ec/p256-x86_64-table.h",
-  "src/crypto/ec/p256-x86_64.c",
-  "src/crypto/ec/p256-x86_64.h",
-  "src/crypto/ec/simple.c",
-  "src/crypto/ec/util-64.c",
-  "src/crypto/ec/wnaf.c",
+  "src/crypto/ec_extra/ec_asn1.c",
   "src/crypto/ecdh/ecdh.c",
-  "src/crypto/ecdsa/ecdsa.c",
-  "src/crypto/ecdsa/ecdsa_asn1.c",
+  "src/crypto/ecdsa_extra/ecdsa_asn1.c",
   "src/crypto/engine/engine.c",
   "src/crypto/err/err.c",
   "src/crypto/evp/digestsign.c",
@@ -131,16 +114,22 @@
   "src/crypto/evp/print.c",
   "src/crypto/evp/sign.c",
   "src/crypto/ex_data.c",
+  "src/crypto/fipsmodule/aes/internal.h",
   "src/crypto/fipsmodule/bcm.c",
   "src/crypto/fipsmodule/bn/internal.h",
   "src/crypto/fipsmodule/bn/rsaz_exp.h",
+  "src/crypto/fipsmodule/cipher/internal.h",
   "src/crypto/fipsmodule/delocate.h",
   "src/crypto/fipsmodule/des/internal.h",
   "src/crypto/fipsmodule/digest/internal.h",
   "src/crypto/fipsmodule/digest/md32_common.h",
+  "src/crypto/fipsmodule/ec/internal.h",
+  "src/crypto/fipsmodule/ec/p256-x86_64-table.h",
+  "src/crypto/fipsmodule/ec/p256-x86_64.h",
   "src/crypto/fipsmodule/is_fips.c",
   "src/crypto/fipsmodule/modes/internal.h",
   "src/crypto/fipsmodule/rand/internal.h",
+  "src/crypto/fipsmodule/rsa/internal.h",
   "src/crypto/hkdf/hkdf.c",
   "src/crypto/internal.h",
   "src/crypto/lhash/lhash.c",
@@ -177,12 +166,7 @@
   "src/crypto/rc4/rc4.c",
   "src/crypto/refcount_c11.c",
   "src/crypto/refcount_lock.c",
-  "src/crypto/rsa/blinding.c",
-  "src/crypto/rsa/internal.h",
-  "src/crypto/rsa/padding.c",
-  "src/crypto/rsa/rsa.c",
-  "src/crypto/rsa/rsa_asn1.c",
-  "src/crypto/rsa/rsa_impl.c",
+  "src/crypto/rsa_extra/rsa_asn1.c",
   "src/crypto/stack/stack.c",
   "src/crypto/thread.c",
   "src/crypto/thread_none.c",
@@ -436,14 +420,15 @@
 
 crypto_sources_linux_x86_64 = [
   "linux-x86_64/crypto/chacha/chacha-x86_64.S",
-  "linux-x86_64/crypto/cipher/chacha20_poly1305_x86_64.S",
-  "linux-x86_64/crypto/ec/p256-x86_64-asm.S",
+  "linux-x86_64/crypto/cipher_extra/aes128gcmsiv-x86_64.S",
+  "linux-x86_64/crypto/cipher_extra/chacha20_poly1305_x86_64.S",
   "linux-x86_64/crypto/fipsmodule/aes-x86_64.S",
   "linux-x86_64/crypto/fipsmodule/aesni-gcm-x86_64.S",
   "linux-x86_64/crypto/fipsmodule/aesni-x86_64.S",
   "linux-x86_64/crypto/fipsmodule/bsaes-x86_64.S",
   "linux-x86_64/crypto/fipsmodule/ghash-x86_64.S",
   "linux-x86_64/crypto/fipsmodule/md5-x86_64.S",
+  "linux-x86_64/crypto/fipsmodule/p256-x86_64-asm.S",
   "linux-x86_64/crypto/fipsmodule/rdrand-x86_64.S",
   "linux-x86_64/crypto/fipsmodule/rsaz-avx2.S",
   "linux-x86_64/crypto/fipsmodule/sha1-x86_64.S",
@@ -472,14 +457,15 @@
 
 crypto_sources_mac_x86_64 = [
   "mac-x86_64/crypto/chacha/chacha-x86_64.S",
-  "mac-x86_64/crypto/cipher/chacha20_poly1305_x86_64.S",
-  "mac-x86_64/crypto/ec/p256-x86_64-asm.S",
+  "mac-x86_64/crypto/cipher_extra/aes128gcmsiv-x86_64.S",
+  "mac-x86_64/crypto/cipher_extra/chacha20_poly1305_x86_64.S",
   "mac-x86_64/crypto/fipsmodule/aes-x86_64.S",
   "mac-x86_64/crypto/fipsmodule/aesni-gcm-x86_64.S",
   "mac-x86_64/crypto/fipsmodule/aesni-x86_64.S",
   "mac-x86_64/crypto/fipsmodule/bsaes-x86_64.S",
   "mac-x86_64/crypto/fipsmodule/ghash-x86_64.S",
   "mac-x86_64/crypto/fipsmodule/md5-x86_64.S",
+  "mac-x86_64/crypto/fipsmodule/p256-x86_64-asm.S",
   "mac-x86_64/crypto/fipsmodule/rdrand-x86_64.S",
   "mac-x86_64/crypto/fipsmodule/rsaz-avx2.S",
   "mac-x86_64/crypto/fipsmodule/sha1-x86_64.S",
@@ -508,14 +494,15 @@
 
 crypto_sources_win_x86_64 = [
   "win-x86_64/crypto/chacha/chacha-x86_64.asm",
-  "win-x86_64/crypto/cipher/chacha20_poly1305_x86_64.asm",
-  "win-x86_64/crypto/ec/p256-x86_64-asm.asm",
+  "win-x86_64/crypto/cipher_extra/aes128gcmsiv-x86_64.asm",
+  "win-x86_64/crypto/cipher_extra/chacha20_poly1305_x86_64.asm",
   "win-x86_64/crypto/fipsmodule/aes-x86_64.asm",
   "win-x86_64/crypto/fipsmodule/aesni-gcm-x86_64.asm",
   "win-x86_64/crypto/fipsmodule/aesni-x86_64.asm",
   "win-x86_64/crypto/fipsmodule/bsaes-x86_64.asm",
   "win-x86_64/crypto/fipsmodule/ghash-x86_64.asm",
   "win-x86_64/crypto/fipsmodule/md5-x86_64.asm",
+  "win-x86_64/crypto/fipsmodule/p256-x86_64-asm.asm",
   "win-x86_64/crypto/fipsmodule/rdrand-x86_64.asm",
   "win-x86_64/crypto/fipsmodule/rsaz-avx2.asm",
   "win-x86_64/crypto/fipsmodule/sha1-x86_64.asm",
diff --git a/third_party/boringssl/BUILD.generated_tests.gni b/third_party/boringssl/BUILD.generated_tests.gni
index f68c386..77fe830 100644
--- a/third_party/boringssl/BUILD.generated_tests.gni
+++ b/third_party/boringssl/BUILD.generated_tests.gni
@@ -29,11 +29,11 @@
   "src/crypto/curve25519/x25519_test.cc",
   "src/crypto/dh/dh_test.cc",
   "src/crypto/dsa/dsa_test.cc",
-  "src/crypto/ec/ec_test.cc",
   "src/crypto/err/err_test.cc",
   "src/crypto/evp/evp_extra_test.cc",
+  "src/crypto/fipsmodule/ec/ec_test.cc",
   "src/crypto/fipsmodule/rand/ctrdrbg_test.cc",
-  "src/crypto/rsa/rsa_test.cc",
+  "src/crypto/rsa_extra/rsa_test.cc",
   "src/crypto/test/gtest_main.cc",
 ]
 
@@ -45,7 +45,7 @@
 template("create_tests") {
   executable("boringssl_aead_test") {
     sources = [
-      "src/crypto/cipher/aead_test.cc",
+      "src/crypto/cipher_extra/aead_test.cc",
     ]
     sources += test_support_sources
     if (defined(invoker.configs_exclude)) {
@@ -57,7 +57,7 @@
 
   executable("boringssl_cipher_test") {
     sources = [
-      "src/crypto/cipher/cipher_test.cc",
+      "src/crypto/cipher_extra/cipher_test.cc",
     ]
     sources += test_support_sources
     if (defined(invoker.configs_exclude)) {
@@ -91,30 +91,6 @@
     deps = invoker.deps
   }
 
-  executable("boringssl_example_mul") {
-    sources = [
-      "src/crypto/ec/example_mul.c",
-    ]
-    sources += test_support_sources
-    if (defined(invoker.configs_exclude)) {
-      configs -= invoker.configs_exclude
-    }
-    configs += invoker.configs
-    deps = invoker.deps
-  }
-
-  executable("boringssl_p256-x86_64_test") {
-    sources = [
-      "src/crypto/ec/p256-x86_64_test.cc",
-    ]
-    sources += test_support_sources
-    if (defined(invoker.configs_exclude)) {
-      configs -= invoker.configs_exclude
-    }
-    configs += invoker.configs
-    deps = invoker.deps
-  }
-
   executable("boringssl_ecdh_test") {
     sources = [
       "src/crypto/ecdh/ecdh_test.cc",
@@ -127,42 +103,6 @@
     deps = invoker.deps
   }
 
-  executable("boringssl_ecdsa_sign_test") {
-    sources = [
-      "src/crypto/ecdsa/ecdsa_sign_test.cc",
-    ]
-    sources += test_support_sources
-    if (defined(invoker.configs_exclude)) {
-      configs -= invoker.configs_exclude
-    }
-    configs += invoker.configs
-    deps = invoker.deps
-  }
-
-  executable("boringssl_ecdsa_test") {
-    sources = [
-      "src/crypto/ecdsa/ecdsa_test.cc",
-    ]
-    sources += test_support_sources
-    if (defined(invoker.configs_exclude)) {
-      configs -= invoker.configs_exclude
-    }
-    configs += invoker.configs
-    deps = invoker.deps
-  }
-
-  executable("boringssl_ecdsa_verify_test") {
-    sources = [
-      "src/crypto/ecdsa/ecdsa_verify_test.cc",
-    ]
-    sources += test_support_sources
-    if (defined(invoker.configs_exclude)) {
-      configs -= invoker.configs_exclude
-    }
-    configs += invoker.configs
-    deps = invoker.deps
-  }
-
   executable("boringssl_evp_test") {
     sources = [
       "src/crypto/evp/evp_test.cc",
@@ -211,6 +151,66 @@
     deps = invoker.deps
   }
 
+  executable("boringssl_example_mul") {
+    sources = [
+      "src/crypto/fipsmodule/ec/example_mul.c",
+    ]
+    sources += test_support_sources
+    if (defined(invoker.configs_exclude)) {
+      configs -= invoker.configs_exclude
+    }
+    configs += invoker.configs
+    deps = invoker.deps
+  }
+
+  executable("boringssl_p256-x86_64_test") {
+    sources = [
+      "src/crypto/fipsmodule/ec/p256-x86_64_test.cc",
+    ]
+    sources += test_support_sources
+    if (defined(invoker.configs_exclude)) {
+      configs -= invoker.configs_exclude
+    }
+    configs += invoker.configs
+    deps = invoker.deps
+  }
+
+  executable("boringssl_ecdsa_sign_test") {
+    sources = [
+      "src/crypto/fipsmodule/ecdsa/ecdsa_sign_test.cc",
+    ]
+    sources += test_support_sources
+    if (defined(invoker.configs_exclude)) {
+      configs -= invoker.configs_exclude
+    }
+    configs += invoker.configs
+    deps = invoker.deps
+  }
+
+  executable("boringssl_ecdsa_test") {
+    sources = [
+      "src/crypto/fipsmodule/ecdsa/ecdsa_test.cc",
+    ]
+    sources += test_support_sources
+    if (defined(invoker.configs_exclude)) {
+      configs -= invoker.configs_exclude
+    }
+    configs += invoker.configs
+    deps = invoker.deps
+  }
+
+  executable("boringssl_ecdsa_verify_test") {
+    sources = [
+      "src/crypto/fipsmodule/ecdsa/ecdsa_verify_test.cc",
+    ]
+    sources += test_support_sources
+    if (defined(invoker.configs_exclude)) {
+      configs -= invoker.configs_exclude
+    }
+    configs += invoker.configs
+    deps = invoker.deps
+  }
+
   executable("boringssl_gcm_test") {
     sources = [
       "src/crypto/fipsmodule/modes/gcm_test.cc",
diff --git a/third_party/boringssl/linux-x86_64/crypto/cipher_extra/aes128gcmsiv-x86_64.S b/third_party/boringssl/linux-x86_64/crypto/cipher_extra/aes128gcmsiv-x86_64.S
new file mode 100644
index 0000000..daf82d9e
--- /dev/null
+++ b/third_party/boringssl/linux-x86_64/crypto/cipher_extra/aes128gcmsiv-x86_64.S
@@ -0,0 +1,3066 @@
+#if defined(__x86_64__) && !defined(OPENSSL_NO_ASM)
+.data	
+
+.align	16
+one:
+.quad	1,0
+two:
+.quad	2,0
+three:
+.quad	3,0
+four:
+.quad	4,0
+five:
+.quad	5,0
+six:
+.quad	6,0
+seven:
+.quad	7,0
+eight:
+.quad	8,0
+
+OR_MASK:
+.long	0x00000000,0x00000000,0x00000000,0x80000000
+poly:
+.quad	0x1, 0xc200000000000000
+mask:
+.long	0x0c0f0e0d,0x0c0f0e0d,0x0c0f0e0d,0x0c0f0e0d
+con1:
+.long	1,1,1,1
+con2:
+.long	0x1b,0x1b,0x1b,0x1b
+con3:
+.byte	-1,-1,-1,-1,-1,-1,-1,-1,4,5,6,7,4,5,6,7
+and_mask:
+.long	0,0xffffffff, 0xffffffff, 0xffffffff
+.text	
+.type	GFMUL,@function
+.align	16
+GFMUL:
+.cfi_startproc	
+	vpclmulqdq	$0x00,%xmm1,%xmm0,%xmm2
+	vpclmulqdq	$0x11,%xmm1,%xmm0,%xmm5
+	vpclmulqdq	$0x10,%xmm1,%xmm0,%xmm3
+	vpclmulqdq	$0x01,%xmm1,%xmm0,%xmm4
+	vpxor	%xmm4,%xmm3,%xmm3
+	vpslldq	$8,%xmm3,%xmm4
+	vpsrldq	$8,%xmm3,%xmm3
+	vpxor	%xmm4,%xmm2,%xmm2
+	vpxor	%xmm3,%xmm5,%xmm5
+
+	vpclmulqdq	$0x10,poly(%rip),%xmm2,%xmm3
+	vpshufd	$78,%xmm2,%xmm4
+	vpxor	%xmm4,%xmm3,%xmm2
+
+	vpclmulqdq	$0x10,poly(%rip),%xmm2,%xmm3
+	vpshufd	$78,%xmm2,%xmm4
+	vpxor	%xmm4,%xmm3,%xmm2
+
+	vpxor	%xmm5,%xmm2,%xmm0
+	.byte	0xf3,0xc3
+.cfi_endproc	
+.size	GFMUL, .-GFMUL
+.globl	aesgcmsiv_htable_init
+.hidden aesgcmsiv_htable_init
+.type	aesgcmsiv_htable_init,@function
+.align	16
+aesgcmsiv_htable_init:
+.cfi_startproc	
+	vmovdqa	(%rsi),%xmm0
+	vmovdqa	%xmm0,%xmm1
+	vmovdqa	%xmm0,(%rdi)
+	call	GFMUL
+	vmovdqa	%xmm0,16(%rdi)
+	call	GFMUL
+	vmovdqa	%xmm0,32(%rdi)
+	call	GFMUL
+	vmovdqa	%xmm0,48(%rdi)
+	call	GFMUL
+	vmovdqa	%xmm0,64(%rdi)
+	call	GFMUL
+	vmovdqa	%xmm0,80(%rdi)
+	call	GFMUL
+	vmovdqa	%xmm0,96(%rdi)
+	call	GFMUL
+	vmovdqa	%xmm0,112(%rdi)
+	.byte	0xf3,0xc3
+.cfi_endproc	
+.size	aesgcmsiv_htable_init, .-aesgcmsiv_htable_init
+.globl	aesgcmsiv_htable6_init
+.hidden aesgcmsiv_htable6_init
+.type	aesgcmsiv_htable6_init,@function
+.align	16
+aesgcmsiv_htable6_init:
+.cfi_startproc	
+	vmovdqa	(%rsi),%xmm0
+	vmovdqa	%xmm0,%xmm1
+	vmovdqa	%xmm0,(%rdi)
+	call	GFMUL
+	vmovdqa	%xmm0,16(%rdi)
+	call	GFMUL
+	vmovdqa	%xmm0,32(%rdi)
+	call	GFMUL
+	vmovdqa	%xmm0,48(%rdi)
+	call	GFMUL
+	vmovdqa	%xmm0,64(%rdi)
+	call	GFMUL
+	vmovdqa	%xmm0,80(%rdi)
+	.byte	0xf3,0xc3
+.cfi_endproc	
+.size	aesgcmsiv_htable6_init, .-aesgcmsiv_htable6_init
+.globl	aesgcmsiv_htable_polyval
+.hidden aesgcmsiv_htable_polyval
+.type	aesgcmsiv_htable_polyval,@function
+.align	16
+aesgcmsiv_htable_polyval:
+.cfi_startproc	
+	testq	%rdx,%rdx
+	jnz	.Lhtable_polyval_start
+	.byte	0xf3,0xc3
+
+.Lhtable_polyval_start:
+	vzeroall
+
+
+
+	movq	%rdx,%r11
+	andq	$127,%r11
+
+	jz	.Lhtable_polyval_no_prefix
+
+	vpxor	%xmm9,%xmm9,%xmm9
+	vmovdqa	(%rcx),%xmm1
+	subq	%r11,%rdx
+
+	subq	$16,%r11
+
+
+	vmovdqu	(%rsi),%xmm0
+	vpxor	%xmm1,%xmm0,%xmm0
+
+	vpclmulqdq	$0x01,(%rdi,%r11,1),%xmm0,%xmm5
+	vpclmulqdq	$0x00,(%rdi,%r11,1),%xmm0,%xmm3
+	vpclmulqdq	$0x11,(%rdi,%r11,1),%xmm0,%xmm4
+	vpclmulqdq	$0x10,(%rdi,%r11,1),%xmm0,%xmm6
+	vpxor	%xmm6,%xmm5,%xmm5
+
+	leaq	16(%rsi),%rsi
+	testq	%r11,%r11
+	jnz	.Lhtable_polyval_prefix_loop
+	jmp	.Lhtable_polyval_prefix_complete
+
+
+.align	64
+.Lhtable_polyval_prefix_loop:
+	subq	$16,%r11
+
+	vmovdqu	(%rsi),%xmm0
+
+	vpclmulqdq	$0x00,(%rdi,%r11,1),%xmm0,%xmm6
+	vpxor	%xmm6,%xmm3,%xmm3
+	vpclmulqdq	$0x11,(%rdi,%r11,1),%xmm0,%xmm6
+	vpxor	%xmm6,%xmm4,%xmm4
+	vpclmulqdq	$0x01,(%rdi,%r11,1),%xmm0,%xmm6
+	vpxor	%xmm6,%xmm5,%xmm5
+	vpclmulqdq	$0x10,(%rdi,%r11,1),%xmm0,%xmm6
+	vpxor	%xmm6,%xmm5,%xmm5
+
+	testq	%r11,%r11
+
+	leaq	16(%rsi),%rsi
+
+	jnz	.Lhtable_polyval_prefix_loop
+
+.Lhtable_polyval_prefix_complete:
+	vpsrldq	$8,%xmm5,%xmm6
+	vpslldq	$8,%xmm5,%xmm5
+
+	vpxor	%xmm6,%xmm4,%xmm9
+	vpxor	%xmm5,%xmm3,%xmm1
+
+	jmp	.Lhtable_polyval_main_loop
+
+.Lhtable_polyval_no_prefix:
+
+
+
+
+	vpxor	%xmm1,%xmm1,%xmm1
+	vmovdqa	(%rcx),%xmm9
+
+.align	64
+.Lhtable_polyval_main_loop:
+	subq	$0x80,%rdx
+	jb	.Lhtable_polyval_out
+
+	vmovdqu	112(%rsi),%xmm0
+
+	vpclmulqdq	$0x01,(%rdi),%xmm0,%xmm5
+	vpclmulqdq	$0x00,(%rdi),%xmm0,%xmm3
+	vpclmulqdq	$0x11,(%rdi),%xmm0,%xmm4
+	vpclmulqdq	$0x10,(%rdi),%xmm0,%xmm6
+	vpxor	%xmm6,%xmm5,%xmm5
+
+
+	vmovdqu	96(%rsi),%xmm0
+	vpclmulqdq	$0x01,16(%rdi),%xmm0,%xmm6
+	vpxor	%xmm6,%xmm5,%xmm5
+	vpclmulqdq	$0x00,16(%rdi),%xmm0,%xmm6
+	vpxor	%xmm6,%xmm3,%xmm3
+	vpclmulqdq	$0x11,16(%rdi),%xmm0,%xmm6
+	vpxor	%xmm6,%xmm4,%xmm4
+	vpclmulqdq	$0x10,16(%rdi),%xmm0,%xmm6
+	vpxor	%xmm6,%xmm5,%xmm5
+
+
+
+	vmovdqu	80(%rsi),%xmm0
+
+	vpclmulqdq	$0x10,poly(%rip),%xmm1,%xmm7
+	vpalignr	$8,%xmm1,%xmm1,%xmm1
+
+	vpclmulqdq	$0x01,32(%rdi),%xmm0,%xmm6
+	vpxor	%xmm6,%xmm5,%xmm5
+	vpclmulqdq	$0x00,32(%rdi),%xmm0,%xmm6
+	vpxor	%xmm6,%xmm3,%xmm3
+	vpclmulqdq	$0x11,32(%rdi),%xmm0,%xmm6
+	vpxor	%xmm6,%xmm4,%xmm4
+	vpclmulqdq	$0x10,32(%rdi),%xmm0,%xmm6
+	vpxor	%xmm6,%xmm5,%xmm5
+
+
+	vpxor	%xmm7,%xmm1,%xmm1
+
+	vmovdqu	64(%rsi),%xmm0
+
+	vpclmulqdq	$0x01,48(%rdi),%xmm0,%xmm6
+	vpxor	%xmm6,%xmm5,%xmm5
+	vpclmulqdq	$0x00,48(%rdi),%xmm0,%xmm6
+	vpxor	%xmm6,%xmm3,%xmm3
+	vpclmulqdq	$0x11,48(%rdi),%xmm0,%xmm6
+	vpxor	%xmm6,%xmm4,%xmm4
+	vpclmulqdq	$0x10,48(%rdi),%xmm0,%xmm6
+	vpxor	%xmm6,%xmm5,%xmm5
+
+
+	vmovdqu	48(%rsi),%xmm0
+
+	vpclmulqdq	$0x10,poly(%rip),%xmm1,%xmm7
+	vpalignr	$8,%xmm1,%xmm1,%xmm1
+
+	vpclmulqdq	$0x01,64(%rdi),%xmm0,%xmm6
+	vpxor	%xmm6,%xmm5,%xmm5
+	vpclmulqdq	$0x00,64(%rdi),%xmm0,%xmm6
+	vpxor	%xmm6,%xmm3,%xmm3
+	vpclmulqdq	$0x11,64(%rdi),%xmm0,%xmm6
+	vpxor	%xmm6,%xmm4,%xmm4
+	vpclmulqdq	$0x10,64(%rdi),%xmm0,%xmm6
+	vpxor	%xmm6,%xmm5,%xmm5
+
+
+	vpxor	%xmm7,%xmm1,%xmm1
+
+	vmovdqu	32(%rsi),%xmm0
+
+	vpclmulqdq	$0x01,80(%rdi),%xmm0,%xmm6
+	vpxor	%xmm6,%xmm5,%xmm5
+	vpclmulqdq	$0x00,80(%rdi),%xmm0,%xmm6
+	vpxor	%xmm6,%xmm3,%xmm3
+	vpclmulqdq	$0x11,80(%rdi),%xmm0,%xmm6
+	vpxor	%xmm6,%xmm4,%xmm4
+	vpclmulqdq	$0x10,80(%rdi),%xmm0,%xmm6
+	vpxor	%xmm6,%xmm5,%xmm5
+
+
+	vpxor	%xmm9,%xmm1,%xmm1
+
+	vmovdqu	16(%rsi),%xmm0
+
+	vpclmulqdq	$0x01,96(%rdi),%xmm0,%xmm6
+	vpxor	%xmm6,%xmm5,%xmm5
+	vpclmulqdq	$0x00,96(%rdi),%xmm0,%xmm6
+	vpxor	%xmm6,%xmm3,%xmm3
+	vpclmulqdq	$0x11,96(%rdi),%xmm0,%xmm6
+	vpxor	%xmm6,%xmm4,%xmm4
+	vpclmulqdq	$0x10,96(%rdi),%xmm0,%xmm6
+	vpxor	%xmm6,%xmm5,%xmm5
+
+
+	vmovdqu	0(%rsi),%xmm0
+	vpxor	%xmm1,%xmm0,%xmm0
+
+	vpclmulqdq	$0x01,112(%rdi),%xmm0,%xmm6
+	vpxor	%xmm6,%xmm5,%xmm5
+	vpclmulqdq	$0x00,112(%rdi),%xmm0,%xmm6
+	vpxor	%xmm6,%xmm3,%xmm3
+	vpclmulqdq	$0x11,112(%rdi),%xmm0,%xmm6
+	vpxor	%xmm6,%xmm4,%xmm4
+	vpclmulqdq	$0x10,112(%rdi),%xmm0,%xmm6
+	vpxor	%xmm6,%xmm5,%xmm5
+
+
+	vpsrldq	$8,%xmm5,%xmm6
+	vpslldq	$8,%xmm5,%xmm5
+
+	vpxor	%xmm6,%xmm4,%xmm9
+	vpxor	%xmm5,%xmm3,%xmm1
+
+	leaq	128(%rsi),%rsi
+	jmp	.Lhtable_polyval_main_loop
+
+
+
+.Lhtable_polyval_out:
+	vpclmulqdq	$0x10,poly(%rip),%xmm1,%xmm6
+	vpalignr	$8,%xmm1,%xmm1,%xmm1
+	vpxor	%xmm6,%xmm1,%xmm1
+
+	vpclmulqdq	$0x10,poly(%rip),%xmm1,%xmm6
+	vpalignr	$8,%xmm1,%xmm1,%xmm1
+	vpxor	%xmm6,%xmm1,%xmm1
+	vpxor	%xmm9,%xmm1,%xmm1
+
+	vmovdqu	%xmm1,(%rcx)
+	vzeroupper
+	.byte	0xf3,0xc3
+.cfi_endproc	
+.size	aesgcmsiv_htable_polyval,.-aesgcmsiv_htable_polyval
+.globl	aesgcmsiv_polyval_horner
+.hidden aesgcmsiv_polyval_horner
+.type	aesgcmsiv_polyval_horner,@function
+.align	16
+aesgcmsiv_polyval_horner:
+.cfi_startproc	
+	testq	%rcx,%rcx
+	jnz	.Lpolyval_horner_start
+	.byte	0xf3,0xc3
+
+.Lpolyval_horner_start:
+
+
+
+	xorq	%r10,%r10
+	shlq	$4,%rcx
+
+	vmovdqa	(%rsi),%xmm1
+	vmovdqa	(%rdi),%xmm0
+
+.Lpolyval_horner_loop:
+	vpxor	(%rdx,%r10,1),%xmm0,%xmm0
+	call	GFMUL
+
+	addq	$16,%r10
+	cmpq	%r10,%rcx
+	jne	.Lpolyval_horner_loop
+
+
+	vmovdqa	%xmm0,(%rdi)
+	.byte	0xf3,0xc3
+.cfi_endproc	
+.size	aesgcmsiv_polyval_horner,.-aesgcmsiv_polyval_horner
+.globl	aes128gcmsiv_aes_ks
+.hidden aes128gcmsiv_aes_ks
+.type	aes128gcmsiv_aes_ks,@function
+.align	16
+aes128gcmsiv_aes_ks:
+.cfi_startproc	
+	vmovdqa	(%rdi),%xmm1
+	vmovdqa	%xmm1,(%rsi)
+
+	vmovdqa	con1(%rip),%xmm0
+	vmovdqa	mask(%rip),%xmm15
+
+	movq	$8,%rax
+
+.Lks128_loop:
+	addq	$16,%rsi
+	subq	$1,%rax
+	vpshufb	%xmm15,%xmm1,%xmm2
+	vaesenclast	%xmm0,%xmm2,%xmm2
+	vpslld	$1,%xmm0,%xmm0
+	vpslldq	$4,%xmm1,%xmm3
+	vpxor	%xmm3,%xmm1,%xmm1
+	vpslldq	$4,%xmm3,%xmm3
+	vpxor	%xmm3,%xmm1,%xmm1
+	vpslldq	$4,%xmm3,%xmm3
+	vpxor	%xmm3,%xmm1,%xmm1
+	vpxor	%xmm2,%xmm1,%xmm1
+	vmovdqa	%xmm1,(%rsi)
+	jne	.Lks128_loop
+
+	vmovdqa	con2(%rip),%xmm0
+	vpshufb	%xmm15,%xmm1,%xmm2
+	vaesenclast	%xmm0,%xmm2,%xmm2
+	vpslld	$1,%xmm0,%xmm0
+	vpslldq	$4,%xmm1,%xmm3
+	vpxor	%xmm3,%xmm1,%xmm1
+	vpslldq	$4,%xmm3,%xmm3
+	vpxor	%xmm3,%xmm1,%xmm1
+	vpslldq	$4,%xmm3,%xmm3
+	vpxor	%xmm3,%xmm1,%xmm1
+	vpxor	%xmm2,%xmm1,%xmm1
+	vmovdqa	%xmm1,16(%rsi)
+
+	vpshufb	%xmm15,%xmm1,%xmm2
+	vaesenclast	%xmm0,%xmm2,%xmm2
+	vpslldq	$4,%xmm1,%xmm3
+	vpxor	%xmm3,%xmm1,%xmm1
+	vpslldq	$4,%xmm3,%xmm3
+	vpxor	%xmm3,%xmm1,%xmm1
+	vpslldq	$4,%xmm3,%xmm3
+	vpxor	%xmm3,%xmm1,%xmm1
+	vpxor	%xmm2,%xmm1,%xmm1
+	vmovdqa	%xmm1,32(%rsi)
+	.byte	0xf3,0xc3
+.cfi_endproc	
+.size	aes128gcmsiv_aes_ks,.-aes128gcmsiv_aes_ks
+.globl	aes256gcmsiv_aes_ks
+.hidden aes256gcmsiv_aes_ks
+.type	aes256gcmsiv_aes_ks,@function
+.align	16
+aes256gcmsiv_aes_ks:
+.cfi_startproc	
+	vmovdqa	(%rdi),%xmm1
+	vmovdqa	16(%rdi),%xmm3
+	vmovdqa	%xmm1,(%rsi)
+	vmovdqa	%xmm3,16(%rsi)
+	vmovdqa	con1(%rip),%xmm0
+	vmovdqa	mask(%rip),%xmm15
+	vpxor	%xmm14,%xmm14,%xmm14
+	movq	$6,%rax
+
+.Lks256_loop:
+	addq	$32,%rsi
+	subq	$1,%rax
+	vpshufb	%xmm15,%xmm3,%xmm2
+	vaesenclast	%xmm0,%xmm2,%xmm2
+	vpslld	$1,%xmm0,%xmm0
+	vpsllq	$32,%xmm1,%xmm4
+	vpxor	%xmm4,%xmm1,%xmm1
+	vpshufb	con3(%rip),%xmm1,%xmm4
+	vpxor	%xmm4,%xmm1,%xmm1
+	vpxor	%xmm2,%xmm1,%xmm1
+	vmovdqa	%xmm1,(%rsi)
+	vpshufd	$0xff,%xmm1,%xmm2
+	vaesenclast	%xmm14,%xmm2,%xmm2
+	vpsllq	$32,%xmm3,%xmm4
+	vpxor	%xmm4,%xmm3,%xmm3
+	vpshufb	con3(%rip),%xmm3,%xmm4
+	vpxor	%xmm4,%xmm3,%xmm3
+	vpxor	%xmm2,%xmm3,%xmm3
+	vmovdqa	%xmm3,16(%rsi)
+	jne	.Lks256_loop
+
+	vpshufb	%xmm15,%xmm3,%xmm2
+	vaesenclast	%xmm0,%xmm2,%xmm2
+	vpsllq	$32,%xmm1,%xmm4
+	vpxor	%xmm4,%xmm1,%xmm1
+	vpshufb	con3(%rip),%xmm1,%xmm4
+	vpxor	%xmm4,%xmm1,%xmm1
+	vpxor	%xmm2,%xmm1,%xmm1
+	vmovdqa	%xmm1,32(%rsi)
+	.byte	0xf3,0xc3
+.cfi_endproc	
+.globl	aes128gcmsiv_aes_ks_enc_x1
+.hidden aes128gcmsiv_aes_ks_enc_x1
+.type	aes128gcmsiv_aes_ks_enc_x1,@function
+.align	16
+aes128gcmsiv_aes_ks_enc_x1:
+.cfi_startproc	
+	vmovdqa	(%rcx),%xmm1
+	vmovdqa	0(%rdi),%xmm4
+
+	vmovdqa	%xmm1,(%rdx)
+	vpxor	%xmm1,%xmm4,%xmm4
+
+	vmovdqa	con1(%rip),%xmm0
+	vmovdqa	mask(%rip),%xmm15
+
+	vpshufb	%xmm15,%xmm1,%xmm2
+	vaesenclast	%xmm0,%xmm2,%xmm2
+	vpslld	$1,%xmm0,%xmm0
+	vpsllq	$32,%xmm1,%xmm3
+	vpxor	%xmm3,%xmm1,%xmm1
+	vpshufb	con3(%rip),%xmm1,%xmm3
+	vpxor	%xmm3,%xmm1,%xmm1
+	vpxor	%xmm2,%xmm1,%xmm1
+
+	vaesenc	%xmm1,%xmm4,%xmm4
+	vmovdqa	%xmm1,16(%rdx)
+
+	vpshufb	%xmm15,%xmm1,%xmm2
+	vaesenclast	%xmm0,%xmm2,%xmm2
+	vpslld	$1,%xmm0,%xmm0
+	vpsllq	$32,%xmm1,%xmm3
+	vpxor	%xmm3,%xmm1,%xmm1
+	vpshufb	con3(%rip),%xmm1,%xmm3
+	vpxor	%xmm3,%xmm1,%xmm1
+	vpxor	%xmm2,%xmm1,%xmm1
+
+	vaesenc	%xmm1,%xmm4,%xmm4
+	vmovdqa	%xmm1,32(%rdx)
+
+	vpshufb	%xmm15,%xmm1,%xmm2
+	vaesenclast	%xmm0,%xmm2,%xmm2
+	vpslld	$1,%xmm0,%xmm0
+	vpsllq	$32,%xmm1,%xmm3
+	vpxor	%xmm3,%xmm1,%xmm1
+	vpshufb	con3(%rip),%xmm1,%xmm3
+	vpxor	%xmm3,%xmm1,%xmm1
+	vpxor	%xmm2,%xmm1,%xmm1
+
+	vaesenc	%xmm1,%xmm4,%xmm4
+	vmovdqa	%xmm1,48(%rdx)
+
+	vpshufb	%xmm15,%xmm1,%xmm2
+	vaesenclast	%xmm0,%xmm2,%xmm2
+	vpslld	$1,%xmm0,%xmm0
+	vpsllq	$32,%xmm1,%xmm3
+	vpxor	%xmm3,%xmm1,%xmm1
+	vpshufb	con3(%rip),%xmm1,%xmm3
+	vpxor	%xmm3,%xmm1,%xmm1
+	vpxor	%xmm2,%xmm1,%xmm1
+
+	vaesenc	%xmm1,%xmm4,%xmm4
+	vmovdqa	%xmm1,64(%rdx)
+
+	vpshufb	%xmm15,%xmm1,%xmm2
+	vaesenclast	%xmm0,%xmm2,%xmm2
+	vpslld	$1,%xmm0,%xmm0
+	vpsllq	$32,%xmm1,%xmm3
+	vpxor	%xmm3,%xmm1,%xmm1
+	vpshufb	con3(%rip),%xmm1,%xmm3
+	vpxor	%xmm3,%xmm1,%xmm1
+	vpxor	%xmm2,%xmm1,%xmm1
+
+	vaesenc	%xmm1,%xmm4,%xmm4
+	vmovdqa	%xmm1,80(%rdx)
+
+	vpshufb	%xmm15,%xmm1,%xmm2
+	vaesenclast	%xmm0,%xmm2,%xmm2
+	vpslld	$1,%xmm0,%xmm0
+	vpsllq	$32,%xmm1,%xmm3
+	vpxor	%xmm3,%xmm1,%xmm1
+	vpshufb	con3(%rip),%xmm1,%xmm3
+	vpxor	%xmm3,%xmm1,%xmm1
+	vpxor	%xmm2,%xmm1,%xmm1
+
+	vaesenc	%xmm1,%xmm4,%xmm4
+	vmovdqa	%xmm1,96(%rdx)
+
+	vpshufb	%xmm15,%xmm1,%xmm2
+	vaesenclast	%xmm0,%xmm2,%xmm2
+	vpslld	$1,%xmm0,%xmm0
+	vpsllq	$32,%xmm1,%xmm3
+	vpxor	%xmm3,%xmm1,%xmm1
+	vpshufb	con3(%rip),%xmm1,%xmm3
+	vpxor	%xmm3,%xmm1,%xmm1
+	vpxor	%xmm2,%xmm1,%xmm1
+
+	vaesenc	%xmm1,%xmm4,%xmm4
+	vmovdqa	%xmm1,112(%rdx)
+
+	vpshufb	%xmm15,%xmm1,%xmm2
+	vaesenclast	%xmm0,%xmm2,%xmm2
+	vpslld	$1,%xmm0,%xmm0
+	vpsllq	$32,%xmm1,%xmm3
+	vpxor	%xmm3,%xmm1,%xmm1
+	vpshufb	con3(%rip),%xmm1,%xmm3
+	vpxor	%xmm3,%xmm1,%xmm1
+	vpxor	%xmm2,%xmm1,%xmm1
+
+	vaesenc	%xmm1,%xmm4,%xmm4
+	vmovdqa	%xmm1,128(%rdx)
+
+
+	vmovdqa	con2(%rip),%xmm0
+
+	vpshufb	%xmm15,%xmm1,%xmm2
+	vaesenclast	%xmm0,%xmm2,%xmm2
+	vpslld	$1,%xmm0,%xmm0
+	vpsllq	$32,%xmm1,%xmm3
+	vpxor	%xmm3,%xmm1,%xmm1
+	vpshufb	con3(%rip),%xmm1,%xmm3
+	vpxor	%xmm3,%xmm1,%xmm1
+	vpxor	%xmm2,%xmm1,%xmm1
+
+	vaesenc	%xmm1,%xmm4,%xmm4
+	vmovdqa	%xmm1,144(%rdx)
+
+	vpshufb	%xmm15,%xmm1,%xmm2
+	vaesenclast	%xmm0,%xmm2,%xmm2
+	vpsllq	$32,%xmm1,%xmm3
+	vpxor	%xmm3,%xmm1,%xmm1
+	vpshufb	con3(%rip),%xmm1,%xmm3
+	vpxor	%xmm3,%xmm1,%xmm1
+	vpxor	%xmm2,%xmm1,%xmm1
+
+	vaesenclast	%xmm1,%xmm4,%xmm4
+	vmovdqa	%xmm1,160(%rdx)
+
+
+	vmovdqa	%xmm4,0(%rsi)
+	.byte	0xf3,0xc3
+.cfi_endproc	
+.size	aes128gcmsiv_aes_ks_enc_x1,.-aes128gcmsiv_aes_ks_enc_x1
+.globl	aes128gcmsiv_kdf
+.hidden aes128gcmsiv_kdf
+.type	aes128gcmsiv_kdf,@function
+.align	16
+aes128gcmsiv_kdf:
+.cfi_startproc	
+
+
+
+
+	vmovdqa	(%rdx),%xmm1
+	vmovdqa	0(%rdi),%xmm9
+	vmovdqa	and_mask(%rip),%xmm12
+	vmovdqa	one(%rip),%xmm13
+	vpshufd	$0x90,%xmm9,%xmm9
+	vpand	%xmm12,%xmm9,%xmm9
+	vpaddd	%xmm13,%xmm9,%xmm10
+	vpaddd	%xmm13,%xmm10,%xmm11
+	vpaddd	%xmm13,%xmm11,%xmm12
+
+	vpxor	%xmm1,%xmm9,%xmm9
+	vpxor	%xmm1,%xmm10,%xmm10
+	vpxor	%xmm1,%xmm11,%xmm11
+	vpxor	%xmm1,%xmm12,%xmm12
+
+	vmovdqa	16(%rdx),%xmm1
+	vaesenc	%xmm1,%xmm9,%xmm9
+	vaesenc	%xmm1,%xmm10,%xmm10
+	vaesenc	%xmm1,%xmm11,%xmm11
+	vaesenc	%xmm1,%xmm12,%xmm12
+
+	vmovdqa	32(%rdx),%xmm2
+	vaesenc	%xmm2,%xmm9,%xmm9
+	vaesenc	%xmm2,%xmm10,%xmm10
+	vaesenc	%xmm2,%xmm11,%xmm11
+	vaesenc	%xmm2,%xmm12,%xmm12
+
+	vmovdqa	48(%rdx),%xmm1
+	vaesenc	%xmm1,%xmm9,%xmm9
+	vaesenc	%xmm1,%xmm10,%xmm10
+	vaesenc	%xmm1,%xmm11,%xmm11
+	vaesenc	%xmm1,%xmm12,%xmm12
+
+	vmovdqa	64(%rdx),%xmm2
+	vaesenc	%xmm2,%xmm9,%xmm9
+	vaesenc	%xmm2,%xmm10,%xmm10
+	vaesenc	%xmm2,%xmm11,%xmm11
+	vaesenc	%xmm2,%xmm12,%xmm12
+
+	vmovdqa	80(%rdx),%xmm1
+	vaesenc	%xmm1,%xmm9,%xmm9
+	vaesenc	%xmm1,%xmm10,%xmm10
+	vaesenc	%xmm1,%xmm11,%xmm11
+	vaesenc	%xmm1,%xmm12,%xmm12
+
+	vmovdqa	96(%rdx),%xmm2
+	vaesenc	%xmm2,%xmm9,%xmm9
+	vaesenc	%xmm2,%xmm10,%xmm10
+	vaesenc	%xmm2,%xmm11,%xmm11
+	vaesenc	%xmm2,%xmm12,%xmm12
+
+	vmovdqa	112(%rdx),%xmm1
+	vaesenc	%xmm1,%xmm9,%xmm9
+	vaesenc	%xmm1,%xmm10,%xmm10
+	vaesenc	%xmm1,%xmm11,%xmm11
+	vaesenc	%xmm1,%xmm12,%xmm12
+
+	vmovdqa	128(%rdx),%xmm2
+	vaesenc	%xmm2,%xmm9,%xmm9
+	vaesenc	%xmm2,%xmm10,%xmm10
+	vaesenc	%xmm2,%xmm11,%xmm11
+	vaesenc	%xmm2,%xmm12,%xmm12
+
+	vmovdqa	144(%rdx),%xmm1
+	vaesenc	%xmm1,%xmm9,%xmm9
+	vaesenc	%xmm1,%xmm10,%xmm10
+	vaesenc	%xmm1,%xmm11,%xmm11
+	vaesenc	%xmm1,%xmm12,%xmm12
+
+	vmovdqa	160(%rdx),%xmm2
+	vaesenclast	%xmm2,%xmm9,%xmm9
+	vaesenclast	%xmm2,%xmm10,%xmm10
+	vaesenclast	%xmm2,%xmm11,%xmm11
+	vaesenclast	%xmm2,%xmm12,%xmm12
+
+
+	vmovdqa	%xmm9,0(%rsi)
+	vmovdqa	%xmm10,16(%rsi)
+	vmovdqa	%xmm11,32(%rsi)
+	vmovdqa	%xmm12,48(%rsi)
+	.byte	0xf3,0xc3
+.cfi_endproc	
+.size	aes128gcmsiv_kdf,.-aes128gcmsiv_kdf
+.globl	aes128gcmsiv_enc_msg_x4
+.hidden aes128gcmsiv_enc_msg_x4
+.type	aes128gcmsiv_enc_msg_x4,@function
+.align	16
+aes128gcmsiv_enc_msg_x4:
+.cfi_startproc	
+	testq	%r8,%r8
+	jnz	.L128_enc_msg_x4_start
+	.byte	0xf3,0xc3
+
+.L128_enc_msg_x4_start:
+	pushq	%r12
+.cfi_adjust_cfa_offset	8
+.cfi_offset	%r12,-16
+	pushq	%r13
+.cfi_adjust_cfa_offset	8
+.cfi_offset	%r13,-24
+
+	shrq	$4,%r8
+	movq	%r8,%r10
+	shlq	$62,%r10
+	shrq	$62,%r10
+
+
+	vmovdqa	(%rdx),%xmm15
+	vpor	OR_MASK(%rip),%xmm15,%xmm15
+
+	vmovdqu	four(%rip),%xmm4
+	vmovdqa	%xmm15,%xmm0
+	vpaddd	one(%rip),%xmm15,%xmm1
+	vpaddd	two(%rip),%xmm15,%xmm2
+	vpaddd	three(%rip),%xmm15,%xmm3
+
+	shrq	$2,%r8
+	je	.L128_enc_msg_x4_check_remainder
+
+	subq	$64,%rsi
+	subq	$64,%rdi
+
+.L128_enc_msg_x4_loop1:
+	addq	$64,%rsi
+	addq	$64,%rdi
+
+	vmovdqa	%xmm0,%xmm5
+	vmovdqa	%xmm1,%xmm6
+	vmovdqa	%xmm2,%xmm7
+	vmovdqa	%xmm3,%xmm8
+
+	vpxor	(%rcx),%xmm5,%xmm5
+	vpxor	(%rcx),%xmm6,%xmm6
+	vpxor	(%rcx),%xmm7,%xmm7
+	vpxor	(%rcx),%xmm8,%xmm8
+
+	vmovdqu	16(%rcx),%xmm12
+	vaesenc	%xmm12,%xmm5,%xmm5
+	vaesenc	%xmm12,%xmm6,%xmm6
+	vaesenc	%xmm12,%xmm7,%xmm7
+	vaesenc	%xmm12,%xmm8,%xmm8
+
+	vpaddd	%xmm4,%xmm0,%xmm0
+	vmovdqu	32(%rcx),%xmm12
+	vaesenc	%xmm12,%xmm5,%xmm5
+	vaesenc	%xmm12,%xmm6,%xmm6
+	vaesenc	%xmm12,%xmm7,%xmm7
+	vaesenc	%xmm12,%xmm8,%xmm8
+
+	vpaddd	%xmm4,%xmm1,%xmm1
+	vmovdqu	48(%rcx),%xmm12
+	vaesenc	%xmm12,%xmm5,%xmm5
+	vaesenc	%xmm12,%xmm6,%xmm6
+	vaesenc	%xmm12,%xmm7,%xmm7
+	vaesenc	%xmm12,%xmm8,%xmm8
+
+	vpaddd	%xmm4,%xmm2,%xmm2
+	vmovdqu	64(%rcx),%xmm12
+	vaesenc	%xmm12,%xmm5,%xmm5
+	vaesenc	%xmm12,%xmm6,%xmm6
+	vaesenc	%xmm12,%xmm7,%xmm7
+	vaesenc	%xmm12,%xmm8,%xmm8
+
+	vpaddd	%xmm4,%xmm3,%xmm3
+
+	vmovdqu	80(%rcx),%xmm12
+	vaesenc	%xmm12,%xmm5,%xmm5
+	vaesenc	%xmm12,%xmm6,%xmm6
+	vaesenc	%xmm12,%xmm7,%xmm7
+	vaesenc	%xmm12,%xmm8,%xmm8
+
+	vmovdqu	96(%rcx),%xmm12
+	vaesenc	%xmm12,%xmm5,%xmm5
+	vaesenc	%xmm12,%xmm6,%xmm6
+	vaesenc	%xmm12,%xmm7,%xmm7
+	vaesenc	%xmm12,%xmm8,%xmm8
+
+	vmovdqu	112(%rcx),%xmm12
+	vaesenc	%xmm12,%xmm5,%xmm5
+	vaesenc	%xmm12,%xmm6,%xmm6
+	vaesenc	%xmm12,%xmm7,%xmm7
+	vaesenc	%xmm12,%xmm8,%xmm8
+
+	vmovdqu	128(%rcx),%xmm12
+	vaesenc	%xmm12,%xmm5,%xmm5
+	vaesenc	%xmm12,%xmm6,%xmm6
+	vaesenc	%xmm12,%xmm7,%xmm7
+	vaesenc	%xmm12,%xmm8,%xmm8
+
+	vmovdqu	144(%rcx),%xmm12
+	vaesenc	%xmm12,%xmm5,%xmm5
+	vaesenc	%xmm12,%xmm6,%xmm6
+	vaesenc	%xmm12,%xmm7,%xmm7
+	vaesenc	%xmm12,%xmm8,%xmm8
+
+	vmovdqu	160(%rcx),%xmm12
+	vaesenclast	%xmm12,%xmm5,%xmm5
+	vaesenclast	%xmm12,%xmm6,%xmm6
+	vaesenclast	%xmm12,%xmm7,%xmm7
+	vaesenclast	%xmm12,%xmm8,%xmm8
+
+
+
+	vpxor	0(%rdi),%xmm5,%xmm5
+	vpxor	16(%rdi),%xmm6,%xmm6
+	vpxor	32(%rdi),%xmm7,%xmm7
+	vpxor	48(%rdi),%xmm8,%xmm8
+
+	subq	$1,%r8
+
+	vmovdqu	%xmm5,0(%rsi)
+	vmovdqu	%xmm6,16(%rsi)
+	vmovdqu	%xmm7,32(%rsi)
+	vmovdqu	%xmm8,48(%rsi)
+
+	jne	.L128_enc_msg_x4_loop1
+
+	addq	$64,%rsi
+	addq	$64,%rdi
+
+.L128_enc_msg_x4_check_remainder:
+	cmpq	$0,%r10
+	je	.L128_enc_msg_x4_out
+
+.L128_enc_msg_x4_loop2:
+
+
+	vmovdqa	%xmm0,%xmm5
+	vpaddd	one(%rip),%xmm0,%xmm0
+
+	vpxor	(%rcx),%xmm5,%xmm5
+	vaesenc	16(%rcx),%xmm5,%xmm5
+	vaesenc	32(%rcx),%xmm5,%xmm5
+	vaesenc	48(%rcx),%xmm5,%xmm5
+	vaesenc	64(%rcx),%xmm5,%xmm5
+	vaesenc	80(%rcx),%xmm5,%xmm5
+	vaesenc	96(%rcx),%xmm5,%xmm5
+	vaesenc	112(%rcx),%xmm5,%xmm5
+	vaesenc	128(%rcx),%xmm5,%xmm5
+	vaesenc	144(%rcx),%xmm5,%xmm5
+	vaesenclast	160(%rcx),%xmm5,%xmm5
+
+
+	vpxor	(%rdi),%xmm5,%xmm5
+	vmovdqu	%xmm5,(%rsi)
+
+	addq	$16,%rdi
+	addq	$16,%rsi
+
+	subq	$1,%r10
+	jne	.L128_enc_msg_x4_loop2
+
+.L128_enc_msg_x4_out:
+	popq	%r13
+.cfi_adjust_cfa_offset	-8
+.cfi_restore	%r13
+	popq	%r12
+.cfi_adjust_cfa_offset	-8
+.cfi_restore	%r12
+	.byte	0xf3,0xc3
+.cfi_endproc	
+.size	aes128gcmsiv_enc_msg_x4,.-aes128gcmsiv_enc_msg_x4
+.globl	aes128gcmsiv_enc_msg_x8
+.hidden aes128gcmsiv_enc_msg_x8
+.type	aes128gcmsiv_enc_msg_x8,@function
+.align	16
+aes128gcmsiv_enc_msg_x8:
+.cfi_startproc	
+	testq	%r8,%r8
+	jnz	.L128_enc_msg_x8_start
+	.byte	0xf3,0xc3
+
+.L128_enc_msg_x8_start:
+	pushq	%r12
+.cfi_adjust_cfa_offset	8
+.cfi_offset	%r12,-16
+	pushq	%r13
+.cfi_adjust_cfa_offset	8
+.cfi_offset	%r13,-24
+	pushq	%rbp
+.cfi_adjust_cfa_offset	8
+.cfi_offset	%rbp,-32
+	movq	%rsp,%rbp
+.cfi_def_cfa_register	rbp
+
+
+	subq	$128,%rsp
+	andq	$-64,%rsp
+
+	shrq	$4,%r8
+	movq	%r8,%r10
+	shlq	$61,%r10
+	shrq	$61,%r10
+
+
+	vmovdqu	(%rdx),%xmm1
+	vpor	OR_MASK(%rip),%xmm1,%xmm1
+
+
+	vpaddd	seven(%rip),%xmm1,%xmm0
+	vmovdqu	%xmm0,(%rsp)
+	vpaddd	one(%rip),%xmm1,%xmm9
+	vpaddd	two(%rip),%xmm1,%xmm10
+	vpaddd	three(%rip),%xmm1,%xmm11
+	vpaddd	four(%rip),%xmm1,%xmm12
+	vpaddd	five(%rip),%xmm1,%xmm13
+	vpaddd	six(%rip),%xmm1,%xmm14
+	vmovdqa	%xmm1,%xmm0
+
+	shrq	$3,%r8
+	je	.L128_enc_msg_x8_check_remainder
+
+	subq	$128,%rsi
+	subq	$128,%rdi
+
+.L128_enc_msg_x8_loop1:
+	addq	$128,%rsi
+	addq	$128,%rdi
+
+	vmovdqa	%xmm0,%xmm1
+	vmovdqa	%xmm9,%xmm2
+	vmovdqa	%xmm10,%xmm3
+	vmovdqa	%xmm11,%xmm4
+	vmovdqa	%xmm12,%xmm5
+	vmovdqa	%xmm13,%xmm6
+	vmovdqa	%xmm14,%xmm7
+
+	vmovdqu	(%rsp),%xmm8
+
+	vpxor	(%rcx),%xmm1,%xmm1
+	vpxor	(%rcx),%xmm2,%xmm2
+	vpxor	(%rcx),%xmm3,%xmm3
+	vpxor	(%rcx),%xmm4,%xmm4
+	vpxor	(%rcx),%xmm5,%xmm5
+	vpxor	(%rcx),%xmm6,%xmm6
+	vpxor	(%rcx),%xmm7,%xmm7
+	vpxor	(%rcx),%xmm8,%xmm8
+
+	vmovdqu	16(%rcx),%xmm15
+	vaesenc	%xmm15,%xmm1,%xmm1
+	vaesenc	%xmm15,%xmm2,%xmm2
+	vaesenc	%xmm15,%xmm3,%xmm3
+	vaesenc	%xmm15,%xmm4,%xmm4
+	vaesenc	%xmm15,%xmm5,%xmm5
+	vaesenc	%xmm15,%xmm6,%xmm6
+	vaesenc	%xmm15,%xmm7,%xmm7
+	vaesenc	%xmm15,%xmm8,%xmm8
+
+	vmovdqu	(%rsp),%xmm14
+	vpaddd	eight(%rip),%xmm14,%xmm14
+	vmovdqu	%xmm14,(%rsp)
+	vmovdqu	32(%rcx),%xmm15
+	vaesenc	%xmm15,%xmm1,%xmm1
+	vaesenc	%xmm15,%xmm2,%xmm2
+	vaesenc	%xmm15,%xmm3,%xmm3
+	vaesenc	%xmm15,%xmm4,%xmm4
+	vaesenc	%xmm15,%xmm5,%xmm5
+	vaesenc	%xmm15,%xmm6,%xmm6
+	vaesenc	%xmm15,%xmm7,%xmm7
+	vaesenc	%xmm15,%xmm8,%xmm8
+
+	vpsubd	one(%rip),%xmm14,%xmm14
+	vmovdqu	48(%rcx),%xmm15
+	vaesenc	%xmm15,%xmm1,%xmm1
+	vaesenc	%xmm15,%xmm2,%xmm2
+	vaesenc	%xmm15,%xmm3,%xmm3
+	vaesenc	%xmm15,%xmm4,%xmm4
+	vaesenc	%xmm15,%xmm5,%xmm5
+	vaesenc	%xmm15,%xmm6,%xmm6
+	vaesenc	%xmm15,%xmm7,%xmm7
+	vaesenc	%xmm15,%xmm8,%xmm8
+
+	vpaddd	eight(%rip),%xmm0,%xmm0
+	vmovdqu	64(%rcx),%xmm15
+	vaesenc	%xmm15,%xmm1,%xmm1
+	vaesenc	%xmm15,%xmm2,%xmm2
+	vaesenc	%xmm15,%xmm3,%xmm3
+	vaesenc	%xmm15,%xmm4,%xmm4
+	vaesenc	%xmm15,%xmm5,%xmm5
+	vaesenc	%xmm15,%xmm6,%xmm6
+	vaesenc	%xmm15,%xmm7,%xmm7
+	vaesenc	%xmm15,%xmm8,%xmm8
+
+	vpaddd	eight(%rip),%xmm9,%xmm9
+	vmovdqu	80(%rcx),%xmm15
+	vaesenc	%xmm15,%xmm1,%xmm1
+	vaesenc	%xmm15,%xmm2,%xmm2
+	vaesenc	%xmm15,%xmm3,%xmm3
+	vaesenc	%xmm15,%xmm4,%xmm4
+	vaesenc	%xmm15,%xmm5,%xmm5
+	vaesenc	%xmm15,%xmm6,%xmm6
+	vaesenc	%xmm15,%xmm7,%xmm7
+	vaesenc	%xmm15,%xmm8,%xmm8
+
+	vpaddd	eight(%rip),%xmm10,%xmm10
+	vmovdqu	96(%rcx),%xmm15
+	vaesenc	%xmm15,%xmm1,%xmm1
+	vaesenc	%xmm15,%xmm2,%xmm2
+	vaesenc	%xmm15,%xmm3,%xmm3
+	vaesenc	%xmm15,%xmm4,%xmm4
+	vaesenc	%xmm15,%xmm5,%xmm5
+	vaesenc	%xmm15,%xmm6,%xmm6
+	vaesenc	%xmm15,%xmm7,%xmm7
+	vaesenc	%xmm15,%xmm8,%xmm8
+
+	vpaddd	eight(%rip),%xmm11,%xmm11
+	vmovdqu	112(%rcx),%xmm15
+	vaesenc	%xmm15,%xmm1,%xmm1
+	vaesenc	%xmm15,%xmm2,%xmm2
+	vaesenc	%xmm15,%xmm3,%xmm3
+	vaesenc	%xmm15,%xmm4,%xmm4
+	vaesenc	%xmm15,%xmm5,%xmm5
+	vaesenc	%xmm15,%xmm6,%xmm6
+	vaesenc	%xmm15,%xmm7,%xmm7
+	vaesenc	%xmm15,%xmm8,%xmm8
+
+	vpaddd	eight(%rip),%xmm12,%xmm12
+	vmovdqu	128(%rcx),%xmm15
+	vaesenc	%xmm15,%xmm1,%xmm1
+	vaesenc	%xmm15,%xmm2,%xmm2
+	vaesenc	%xmm15,%xmm3,%xmm3
+	vaesenc	%xmm15,%xmm4,%xmm4
+	vaesenc	%xmm15,%xmm5,%xmm5
+	vaesenc	%xmm15,%xmm6,%xmm6
+	vaesenc	%xmm15,%xmm7,%xmm7
+	vaesenc	%xmm15,%xmm8,%xmm8
+
+	vpaddd	eight(%rip),%xmm13,%xmm13
+	vmovdqu	144(%rcx),%xmm15
+	vaesenc	%xmm15,%xmm1,%xmm1
+	vaesenc	%xmm15,%xmm2,%xmm2
+	vaesenc	%xmm15,%xmm3,%xmm3
+	vaesenc	%xmm15,%xmm4,%xmm4
+	vaesenc	%xmm15,%xmm5,%xmm5
+	vaesenc	%xmm15,%xmm6,%xmm6
+	vaesenc	%xmm15,%xmm7,%xmm7
+	vaesenc	%xmm15,%xmm8,%xmm8
+
+	vmovdqu	160(%rcx),%xmm15
+	vaesenclast	%xmm15,%xmm1,%xmm1
+	vaesenclast	%xmm15,%xmm2,%xmm2
+	vaesenclast	%xmm15,%xmm3,%xmm3
+	vaesenclast	%xmm15,%xmm4,%xmm4
+	vaesenclast	%xmm15,%xmm5,%xmm5
+	vaesenclast	%xmm15,%xmm6,%xmm6
+	vaesenclast	%xmm15,%xmm7,%xmm7
+	vaesenclast	%xmm15,%xmm8,%xmm8
+
+
+
+	vpxor	0(%rdi),%xmm1,%xmm1
+	vpxor	16(%rdi),%xmm2,%xmm2
+	vpxor	32(%rdi),%xmm3,%xmm3
+	vpxor	48(%rdi),%xmm4,%xmm4
+	vpxor	64(%rdi),%xmm5,%xmm5
+	vpxor	80(%rdi),%xmm6,%xmm6
+	vpxor	96(%rdi),%xmm7,%xmm7
+	vpxor	112(%rdi),%xmm8,%xmm8
+
+	decq	%r8
+
+	vmovdqu	%xmm1,0(%rsi)
+	vmovdqu	%xmm2,16(%rsi)
+	vmovdqu	%xmm3,32(%rsi)
+	vmovdqu	%xmm4,48(%rsi)
+	vmovdqu	%xmm5,64(%rsi)
+	vmovdqu	%xmm6,80(%rsi)
+	vmovdqu	%xmm7,96(%rsi)
+	vmovdqu	%xmm8,112(%rsi)
+
+	jne	.L128_enc_msg_x8_loop1
+
+	addq	$128,%rsi
+	addq	$128,%rdi
+
+.L128_enc_msg_x8_check_remainder:
+	cmpq	$0,%r10
+	je	.L128_enc_msg_x8_out
+
+.L128_enc_msg_x8_loop2:
+
+
+	vmovdqa	%xmm0,%xmm1
+	vpaddd	one(%rip),%xmm0,%xmm0
+
+	vpxor	(%rcx),%xmm1,%xmm1
+	vaesenc	16(%rcx),%xmm1,%xmm1
+	vaesenc	32(%rcx),%xmm1,%xmm1
+	vaesenc	48(%rcx),%xmm1,%xmm1
+	vaesenc	64(%rcx),%xmm1,%xmm1
+	vaesenc	80(%rcx),%xmm1,%xmm1
+	vaesenc	96(%rcx),%xmm1,%xmm1
+	vaesenc	112(%rcx),%xmm1,%xmm1
+	vaesenc	128(%rcx),%xmm1,%xmm1
+	vaesenc	144(%rcx),%xmm1,%xmm1
+	vaesenclast	160(%rcx),%xmm1,%xmm1
+
+
+	vpxor	(%rdi),%xmm1,%xmm1
+
+	vmovdqu	%xmm1,(%rsi)
+
+	addq	$16,%rdi
+	addq	$16,%rsi
+
+	decq	%r10
+	jne	.L128_enc_msg_x8_loop2
+
+.L128_enc_msg_x8_out:
+	movq	%rbp,%rsp
+.cfi_def_cfa_register	%rsp
+	popq	%rbp
+.cfi_adjust_cfa_offset	-8
+.cfi_restore	%rbp
+	popq	%r13
+.cfi_adjust_cfa_offset	-8
+.cfi_restore	%r13
+	popq	%r12
+.cfi_adjust_cfa_offset	-8
+.cfi_restore	%r12
+	.byte	0xf3,0xc3
+.cfi_endproc	
+.size	aes128gcmsiv_enc_msg_x8,.-aes128gcmsiv_enc_msg_x8
+.globl	aes128gcmsiv_dec
+.hidden aes128gcmsiv_dec
+.type	aes128gcmsiv_dec,@function
+.align	16
+aes128gcmsiv_dec:
+.cfi_startproc	
+	testq	$~15,%r9
+	jnz	.L128_dec_start
+	.byte	0xf3,0xc3
+
+.L128_dec_start:
+	vzeroupper
+	vmovdqa	(%rdx),%xmm0
+	movq	%rdx,%rax
+
+	leaq	32(%rax),%rax
+	leaq	32(%rcx),%rcx
+
+
+	vmovdqu	(%rdi,%r9,1),%xmm15
+	vpor	OR_MASK(%rip),%xmm15,%xmm15
+	andq	$~15,%r9
+
+
+	cmpq	$96,%r9
+	jb	.L128_dec_loop2
+
+
+	subq	$96,%r9
+	vmovdqa	%xmm15,%xmm7
+	vpaddd	one(%rip),%xmm7,%xmm8
+	vpaddd	two(%rip),%xmm7,%xmm9
+	vpaddd	one(%rip),%xmm9,%xmm10
+	vpaddd	two(%rip),%xmm9,%xmm11
+	vpaddd	one(%rip),%xmm11,%xmm12
+	vpaddd	two(%rip),%xmm11,%xmm15
+
+	vpxor	(%r8),%xmm7,%xmm7
+	vpxor	(%r8),%xmm8,%xmm8
+	vpxor	(%r8),%xmm9,%xmm9
+	vpxor	(%r8),%xmm10,%xmm10
+	vpxor	(%r8),%xmm11,%xmm11
+	vpxor	(%r8),%xmm12,%xmm12
+
+	vmovdqu	16(%r8),%xmm4
+	vaesenc	%xmm4,%xmm7,%xmm7
+	vaesenc	%xmm4,%xmm8,%xmm8
+	vaesenc	%xmm4,%xmm9,%xmm9
+	vaesenc	%xmm4,%xmm10,%xmm10
+	vaesenc	%xmm4,%xmm11,%xmm11
+	vaesenc	%xmm4,%xmm12,%xmm12
+
+	vmovdqu	32(%r8),%xmm4
+	vaesenc	%xmm4,%xmm7,%xmm7
+	vaesenc	%xmm4,%xmm8,%xmm8
+	vaesenc	%xmm4,%xmm9,%xmm9
+	vaesenc	%xmm4,%xmm10,%xmm10
+	vaesenc	%xmm4,%xmm11,%xmm11
+	vaesenc	%xmm4,%xmm12,%xmm12
+
+	vmovdqu	48(%r8),%xmm4
+	vaesenc	%xmm4,%xmm7,%xmm7
+	vaesenc	%xmm4,%xmm8,%xmm8
+	vaesenc	%xmm4,%xmm9,%xmm9
+	vaesenc	%xmm4,%xmm10,%xmm10
+	vaesenc	%xmm4,%xmm11,%xmm11
+	vaesenc	%xmm4,%xmm12,%xmm12
+
+	vmovdqu	64(%r8),%xmm4
+	vaesenc	%xmm4,%xmm7,%xmm7
+	vaesenc	%xmm4,%xmm8,%xmm8
+	vaesenc	%xmm4,%xmm9,%xmm9
+	vaesenc	%xmm4,%xmm10,%xmm10
+	vaesenc	%xmm4,%xmm11,%xmm11
+	vaesenc	%xmm4,%xmm12,%xmm12
+
+	vmovdqu	80(%r8),%xmm4
+	vaesenc	%xmm4,%xmm7,%xmm7
+	vaesenc	%xmm4,%xmm8,%xmm8
+	vaesenc	%xmm4,%xmm9,%xmm9
+	vaesenc	%xmm4,%xmm10,%xmm10
+	vaesenc	%xmm4,%xmm11,%xmm11
+	vaesenc	%xmm4,%xmm12,%xmm12
+
+	vmovdqu	96(%r8),%xmm4
+	vaesenc	%xmm4,%xmm7,%xmm7
+	vaesenc	%xmm4,%xmm8,%xmm8
+	vaesenc	%xmm4,%xmm9,%xmm9
+	vaesenc	%xmm4,%xmm10,%xmm10
+	vaesenc	%xmm4,%xmm11,%xmm11
+	vaesenc	%xmm4,%xmm12,%xmm12
+
+	vmovdqu	112(%r8),%xmm4
+	vaesenc	%xmm4,%xmm7,%xmm7
+	vaesenc	%xmm4,%xmm8,%xmm8
+	vaesenc	%xmm4,%xmm9,%xmm9
+	vaesenc	%xmm4,%xmm10,%xmm10
+	vaesenc	%xmm4,%xmm11,%xmm11
+	vaesenc	%xmm4,%xmm12,%xmm12
+
+	vmovdqu	128(%r8),%xmm4
+	vaesenc	%xmm4,%xmm7,%xmm7
+	vaesenc	%xmm4,%xmm8,%xmm8
+	vaesenc	%xmm4,%xmm9,%xmm9
+	vaesenc	%xmm4,%xmm10,%xmm10
+	vaesenc	%xmm4,%xmm11,%xmm11
+	vaesenc	%xmm4,%xmm12,%xmm12
+
+	vmovdqu	144(%r8),%xmm4
+	vaesenc	%xmm4,%xmm7,%xmm7
+	vaesenc	%xmm4,%xmm8,%xmm8
+	vaesenc	%xmm4,%xmm9,%xmm9
+	vaesenc	%xmm4,%xmm10,%xmm10
+	vaesenc	%xmm4,%xmm11,%xmm11
+	vaesenc	%xmm4,%xmm12,%xmm12
+
+	vmovdqu	160(%r8),%xmm4
+	vaesenclast	%xmm4,%xmm7,%xmm7
+	vaesenclast	%xmm4,%xmm8,%xmm8
+	vaesenclast	%xmm4,%xmm9,%xmm9
+	vaesenclast	%xmm4,%xmm10,%xmm10
+	vaesenclast	%xmm4,%xmm11,%xmm11
+	vaesenclast	%xmm4,%xmm12,%xmm12
+
+
+	vpxor	0(%rdi),%xmm7,%xmm7
+	vpxor	16(%rdi),%xmm8,%xmm8
+	vpxor	32(%rdi),%xmm9,%xmm9
+	vpxor	48(%rdi),%xmm10,%xmm10
+	vpxor	64(%rdi),%xmm11,%xmm11
+	vpxor	80(%rdi),%xmm12,%xmm12
+
+	vmovdqu	%xmm7,0(%rsi)
+	vmovdqu	%xmm8,16(%rsi)
+	vmovdqu	%xmm9,32(%rsi)
+	vmovdqu	%xmm10,48(%rsi)
+	vmovdqu	%xmm11,64(%rsi)
+	vmovdqu	%xmm12,80(%rsi)
+
+	addq	$96,%rdi
+	addq	$96,%rsi
+	jmp	.L128_dec_loop1
+
+
+.align	64
+.L128_dec_loop1:
+	cmpq	$96,%r9
+	jb	.L128_dec_finish_96
+	subq	$96,%r9
+
+	vmovdqa	%xmm12,%xmm6
+	vmovdqa	%xmm11,16-32(%rax)
+	vmovdqa	%xmm10,32-32(%rax)
+	vmovdqa	%xmm9,48-32(%rax)
+	vmovdqa	%xmm8,64-32(%rax)
+	vmovdqa	%xmm7,80-32(%rax)
+
+	vmovdqa	%xmm15,%xmm7
+	vpaddd	one(%rip),%xmm7,%xmm8
+	vpaddd	two(%rip),%xmm7,%xmm9
+	vpaddd	one(%rip),%xmm9,%xmm10
+	vpaddd	two(%rip),%xmm9,%xmm11
+	vpaddd	one(%rip),%xmm11,%xmm12
+	vpaddd	two(%rip),%xmm11,%xmm15
+
+	vmovdqa	(%r8),%xmm4
+	vpxor	%xmm4,%xmm7,%xmm7
+	vpxor	%xmm4,%xmm8,%xmm8
+	vpxor	%xmm4,%xmm9,%xmm9
+	vpxor	%xmm4,%xmm10,%xmm10
+	vpxor	%xmm4,%xmm11,%xmm11
+	vpxor	%xmm4,%xmm12,%xmm12
+
+	vmovdqu	0-32(%rcx),%xmm4
+	vpclmulqdq	$0x11,%xmm4,%xmm6,%xmm2
+	vpclmulqdq	$0x00,%xmm4,%xmm6,%xmm3
+	vpclmulqdq	$0x01,%xmm4,%xmm6,%xmm1
+	vpclmulqdq	$0x10,%xmm4,%xmm6,%xmm4
+	vpxor	%xmm4,%xmm1,%xmm1
+
+	vmovdqu	16(%r8),%xmm4
+	vaesenc	%xmm4,%xmm7,%xmm7
+	vaesenc	%xmm4,%xmm8,%xmm8
+	vaesenc	%xmm4,%xmm9,%xmm9
+	vaesenc	%xmm4,%xmm10,%xmm10
+	vaesenc	%xmm4,%xmm11,%xmm11
+	vaesenc	%xmm4,%xmm12,%xmm12
+
+	vmovdqu	-16(%rax),%xmm6
+	vmovdqu	-16(%rcx),%xmm13
+
+	vpclmulqdq	$0x10,%xmm13,%xmm6,%xmm4
+	vpxor	%xmm4,%xmm1,%xmm1
+	vpclmulqdq	$0x11,%xmm13,%xmm6,%xmm4
+	vpxor	%xmm4,%xmm2,%xmm2
+	vpclmulqdq	$0x00,%xmm13,%xmm6,%xmm4
+	vpxor	%xmm4,%xmm3,%xmm3
+	vpclmulqdq	$0x01,%xmm13,%xmm6,%xmm4
+	vpxor	%xmm4,%xmm1,%xmm1
+
+
+	vmovdqu	32(%r8),%xmm4
+	vaesenc	%xmm4,%xmm7,%xmm7
+	vaesenc	%xmm4,%xmm8,%xmm8
+	vaesenc	%xmm4,%xmm9,%xmm9
+	vaesenc	%xmm4,%xmm10,%xmm10
+	vaesenc	%xmm4,%xmm11,%xmm11
+	vaesenc	%xmm4,%xmm12,%xmm12
+
+	vmovdqu	0(%rax),%xmm6
+	vmovdqu	0(%rcx),%xmm13
+
+	vpclmulqdq	$0x10,%xmm13,%xmm6,%xmm4
+	vpxor	%xmm4,%xmm1,%xmm1
+	vpclmulqdq	$0x11,%xmm13,%xmm6,%xmm4
+	vpxor	%xmm4,%xmm2,%xmm2
+	vpclmulqdq	$0x00,%xmm13,%xmm6,%xmm4
+	vpxor	%xmm4,%xmm3,%xmm3
+	vpclmulqdq	$0x01,%xmm13,%xmm6,%xmm4
+	vpxor	%xmm4,%xmm1,%xmm1
+
+
+	vmovdqu	48(%r8),%xmm4
+	vaesenc	%xmm4,%xmm7,%xmm7
+	vaesenc	%xmm4,%xmm8,%xmm8
+	vaesenc	%xmm4,%xmm9,%xmm9
+	vaesenc	%xmm4,%xmm10,%xmm10
+	vaesenc	%xmm4,%xmm11,%xmm11
+	vaesenc	%xmm4,%xmm12,%xmm12
+
+	vmovdqu	16(%rax),%xmm6
+	vmovdqu	16(%rcx),%xmm13
+
+	vpclmulqdq	$0x10,%xmm13,%xmm6,%xmm4
+	vpxor	%xmm4,%xmm1,%xmm1
+	vpclmulqdq	$0x11,%xmm13,%xmm6,%xmm4
+	vpxor	%xmm4,%xmm2,%xmm2
+	vpclmulqdq	$0x00,%xmm13,%xmm6,%xmm4
+	vpxor	%xmm4,%xmm3,%xmm3
+	vpclmulqdq	$0x01,%xmm13,%xmm6,%xmm4
+	vpxor	%xmm4,%xmm1,%xmm1
+
+
+	vmovdqu	64(%r8),%xmm4
+	vaesenc	%xmm4,%xmm7,%xmm7
+	vaesenc	%xmm4,%xmm8,%xmm8
+	vaesenc	%xmm4,%xmm9,%xmm9
+	vaesenc	%xmm4,%xmm10,%xmm10
+	vaesenc	%xmm4,%xmm11,%xmm11
+	vaesenc	%xmm4,%xmm12,%xmm12
+
+	vmovdqu	32(%rax),%xmm6
+	vmovdqu	32(%rcx),%xmm13
+
+	vpclmulqdq	$0x10,%xmm13,%xmm6,%xmm4
+	vpxor	%xmm4,%xmm1,%xmm1
+	vpclmulqdq	$0x11,%xmm13,%xmm6,%xmm4
+	vpxor	%xmm4,%xmm2,%xmm2
+	vpclmulqdq	$0x00,%xmm13,%xmm6,%xmm4
+	vpxor	%xmm4,%xmm3,%xmm3
+	vpclmulqdq	$0x01,%xmm13,%xmm6,%xmm4
+	vpxor	%xmm4,%xmm1,%xmm1
+
+
+	vmovdqu	80(%r8),%xmm4
+	vaesenc	%xmm4,%xmm7,%xmm7
+	vaesenc	%xmm4,%xmm8,%xmm8
+	vaesenc	%xmm4,%xmm9,%xmm9
+	vaesenc	%xmm4,%xmm10,%xmm10
+	vaesenc	%xmm4,%xmm11,%xmm11
+	vaesenc	%xmm4,%xmm12,%xmm12
+
+	vmovdqu	96(%r8),%xmm4
+	vaesenc	%xmm4,%xmm7,%xmm7
+	vaesenc	%xmm4,%xmm8,%xmm8
+	vaesenc	%xmm4,%xmm9,%xmm9
+	vaesenc	%xmm4,%xmm10,%xmm10
+	vaesenc	%xmm4,%xmm11,%xmm11
+	vaesenc	%xmm4,%xmm12,%xmm12
+
+	vmovdqu	112(%r8),%xmm4
+	vaesenc	%xmm4,%xmm7,%xmm7
+	vaesenc	%xmm4,%xmm8,%xmm8
+	vaesenc	%xmm4,%xmm9,%xmm9
+	vaesenc	%xmm4,%xmm10,%xmm10
+	vaesenc	%xmm4,%xmm11,%xmm11
+	vaesenc	%xmm4,%xmm12,%xmm12
+
+
+	vmovdqa	80-32(%rax),%xmm6
+	vpxor	%xmm0,%xmm6,%xmm6
+	vmovdqu	80-32(%rcx),%xmm5
+
+	vpclmulqdq	$0x01,%xmm5,%xmm6,%xmm4
+	vpxor	%xmm4,%xmm1,%xmm1
+	vpclmulqdq	$0x11,%xmm5,%xmm6,%xmm4
+	vpxor	%xmm4,%xmm2,%xmm2
+	vpclmulqdq	$0x00,%xmm5,%xmm6,%xmm4
+	vpxor	%xmm4,%xmm3,%xmm3
+	vpclmulqdq	$0x10,%xmm5,%xmm6,%xmm4
+	vpxor	%xmm4,%xmm1,%xmm1
+
+	vmovdqu	128(%r8),%xmm4
+	vaesenc	%xmm4,%xmm7,%xmm7
+	vaesenc	%xmm4,%xmm8,%xmm8
+	vaesenc	%xmm4,%xmm9,%xmm9
+	vaesenc	%xmm4,%xmm10,%xmm10
+	vaesenc	%xmm4,%xmm11,%xmm11
+	vaesenc	%xmm4,%xmm12,%xmm12
+
+
+	vpsrldq	$8,%xmm1,%xmm4
+	vpxor	%xmm4,%xmm2,%xmm5
+	vpslldq	$8,%xmm1,%xmm4
+	vpxor	%xmm4,%xmm3,%xmm0
+
+	vmovdqa	poly(%rip),%xmm3
+
+	vmovdqu	144(%r8),%xmm4
+	vaesenc	%xmm4,%xmm7,%xmm7
+	vaesenc	%xmm4,%xmm8,%xmm8
+	vaesenc	%xmm4,%xmm9,%xmm9
+	vaesenc	%xmm4,%xmm10,%xmm10
+	vaesenc	%xmm4,%xmm11,%xmm11
+	vaesenc	%xmm4,%xmm12,%xmm12
+
+	vmovdqu	160(%r8),%xmm6
+	vpalignr	$8,%xmm0,%xmm0,%xmm2
+	vpclmulqdq	$0x10,%xmm3,%xmm0,%xmm0
+	vpxor	%xmm0,%xmm2,%xmm0
+
+	vpxor	0(%rdi),%xmm6,%xmm4
+	vaesenclast	%xmm4,%xmm7,%xmm7
+	vpxor	16(%rdi),%xmm6,%xmm4
+	vaesenclast	%xmm4,%xmm8,%xmm8
+	vpxor	32(%rdi),%xmm6,%xmm4
+	vaesenclast	%xmm4,%xmm9,%xmm9
+	vpxor	48(%rdi),%xmm6,%xmm4
+	vaesenclast	%xmm4,%xmm10,%xmm10
+	vpxor	64(%rdi),%xmm6,%xmm4
+	vaesenclast	%xmm4,%xmm11,%xmm11
+	vpxor	80(%rdi),%xmm6,%xmm4
+	vaesenclast	%xmm4,%xmm12,%xmm12
+
+	vpalignr	$8,%xmm0,%xmm0,%xmm2
+	vpclmulqdq	$0x10,%xmm3,%xmm0,%xmm0
+	vpxor	%xmm0,%xmm2,%xmm0
+
+	vmovdqu	%xmm7,0(%rsi)
+	vmovdqu	%xmm8,16(%rsi)
+	vmovdqu	%xmm9,32(%rsi)
+	vmovdqu	%xmm10,48(%rsi)
+	vmovdqu	%xmm11,64(%rsi)
+	vmovdqu	%xmm12,80(%rsi)
+
+	vpxor	%xmm5,%xmm0,%xmm0
+
+	leaq	96(%rdi),%rdi
+	leaq	96(%rsi),%rsi
+	jmp	.L128_dec_loop1
+
+.L128_dec_finish_96:
+	vmovdqa	%xmm12,%xmm6
+	vmovdqa	%xmm11,16-32(%rax)
+	vmovdqa	%xmm10,32-32(%rax)
+	vmovdqa	%xmm9,48-32(%rax)
+	vmovdqa	%xmm8,64-32(%rax)
+	vmovdqa	%xmm7,80-32(%rax)
+
+	vmovdqu	0-32(%rcx),%xmm4
+	vpclmulqdq	$0x10,%xmm4,%xmm6,%xmm1
+	vpclmulqdq	$0x11,%xmm4,%xmm6,%xmm2
+	vpclmulqdq	$0x00,%xmm4,%xmm6,%xmm3
+	vpclmulqdq	$0x01,%xmm4,%xmm6,%xmm4
+	vpxor	%xmm4,%xmm1,%xmm1
+
+	vmovdqu	-16(%rax),%xmm6
+	vmovdqu	-16(%rcx),%xmm13
+
+	vpclmulqdq	$0x10,%xmm13,%xmm6,%xmm4
+	vpxor	%xmm4,%xmm1,%xmm1
+	vpclmulqdq	$0x11,%xmm13,%xmm6,%xmm4
+	vpxor	%xmm4,%xmm2,%xmm2
+	vpclmulqdq	$0x00,%xmm13,%xmm6,%xmm4
+	vpxor	%xmm4,%xmm3,%xmm3
+	vpclmulqdq	$0x01,%xmm13,%xmm6,%xmm4
+	vpxor	%xmm4,%xmm1,%xmm1
+
+	vmovdqu	0(%rax),%xmm6
+	vmovdqu	0(%rcx),%xmm13
+
+	vpclmulqdq	$0x10,%xmm13,%xmm6,%xmm4
+	vpxor	%xmm4,%xmm1,%xmm1
+	vpclmulqdq	$0x11,%xmm13,%xmm6,%xmm4
+	vpxor	%xmm4,%xmm2,%xmm2
+	vpclmulqdq	$0x00,%xmm13,%xmm6,%xmm4
+	vpxor	%xmm4,%xmm3,%xmm3
+	vpclmulqdq	$0x01,%xmm13,%xmm6,%xmm4
+	vpxor	%xmm4,%xmm1,%xmm1
+
+	vmovdqu	16(%rax),%xmm6
+	vmovdqu	16(%rcx),%xmm13
+
+	vpclmulqdq	$0x10,%xmm13,%xmm6,%xmm4
+	vpxor	%xmm4,%xmm1,%xmm1
+	vpclmulqdq	$0x11,%xmm13,%xmm6,%xmm4
+	vpxor	%xmm4,%xmm2,%xmm2
+	vpclmulqdq	$0x00,%xmm13,%xmm6,%xmm4
+	vpxor	%xmm4,%xmm3,%xmm3
+	vpclmulqdq	$0x01,%xmm13,%xmm6,%xmm4
+	vpxor	%xmm4,%xmm1,%xmm1
+
+	vmovdqu	32(%rax),%xmm6
+	vmovdqu	32(%rcx),%xmm13
+
+	vpclmulqdq	$0x10,%xmm13,%xmm6,%xmm4
+	vpxor	%xmm4,%xmm1,%xmm1
+	vpclmulqdq	$0x11,%xmm13,%xmm6,%xmm4
+	vpxor	%xmm4,%xmm2,%xmm2
+	vpclmulqdq	$0x00,%xmm13,%xmm6,%xmm4
+	vpxor	%xmm4,%xmm3,%xmm3
+	vpclmulqdq	$0x01,%xmm13,%xmm6,%xmm4
+	vpxor	%xmm4,%xmm1,%xmm1
+
+
+	vmovdqu	80-32(%rax),%xmm6
+	vpxor	%xmm0,%xmm6,%xmm6
+	vmovdqu	80-32(%rcx),%xmm5
+	vpclmulqdq	$0x11,%xmm5,%xmm6,%xmm4
+	vpxor	%xmm4,%xmm2,%xmm2
+	vpclmulqdq	$0x00,%xmm5,%xmm6,%xmm4
+	vpxor	%xmm4,%xmm3,%xmm3
+	vpclmulqdq	$0x10,%xmm5,%xmm6,%xmm4
+	vpxor	%xmm4,%xmm1,%xmm1
+	vpclmulqdq	$0x01,%xmm5,%xmm6,%xmm4
+	vpxor	%xmm4,%xmm1,%xmm1
+
+	vpsrldq	$8,%xmm1,%xmm4
+	vpxor	%xmm4,%xmm2,%xmm5
+	vpslldq	$8,%xmm1,%xmm4
+	vpxor	%xmm4,%xmm3,%xmm0
+
+	vmovdqa	poly(%rip),%xmm3
+
+	vpalignr	$8,%xmm0,%xmm0,%xmm2
+	vpclmulqdq	$0x10,%xmm3,%xmm0,%xmm0
+	vpxor	%xmm0,%xmm2,%xmm0
+
+	vpalignr	$8,%xmm0,%xmm0,%xmm2
+	vpclmulqdq	$0x10,%xmm3,%xmm0,%xmm0
+	vpxor	%xmm0,%xmm2,%xmm0
+
+	vpxor	%xmm5,%xmm0,%xmm0
+
+.L128_dec_loop2:
+
+
+
+	cmpq	$16,%r9
+	jb	.L128_dec_out
+	subq	$16,%r9
+
+	vmovdqa	%xmm15,%xmm2
+	vpaddd	one(%rip),%xmm15,%xmm15
+
+	vpxor	0(%r8),%xmm2,%xmm2
+	vaesenc	16(%r8),%xmm2,%xmm2
+	vaesenc	32(%r8),%xmm2,%xmm2
+	vaesenc	48(%r8),%xmm2,%xmm2
+	vaesenc	64(%r8),%xmm2,%xmm2
+	vaesenc	80(%r8),%xmm2,%xmm2
+	vaesenc	96(%r8),%xmm2,%xmm2
+	vaesenc	112(%r8),%xmm2,%xmm2
+	vaesenc	128(%r8),%xmm2,%xmm2
+	vaesenc	144(%r8),%xmm2,%xmm2
+	vaesenclast	160(%r8),%xmm2,%xmm2
+	vpxor	(%rdi),%xmm2,%xmm2
+	vmovdqu	%xmm2,(%rsi)
+	addq	$16,%rdi
+	addq	$16,%rsi
+
+	vpxor	%xmm2,%xmm0,%xmm0
+	vmovdqa	-32(%rcx),%xmm1
+	call	GFMUL
+
+	jmp	.L128_dec_loop2
+
+.L128_dec_out:
+	vmovdqu	%xmm0,(%rdx)
+	.byte	0xf3,0xc3
+.cfi_endproc	
+.size	aes128gcmsiv_dec, .-aes128gcmsiv_dec
+.globl	aes128gcmsiv_ecb_enc_block
+.hidden aes128gcmsiv_ecb_enc_block
+.type	aes128gcmsiv_ecb_enc_block,@function
+.align	16
+aes128gcmsiv_ecb_enc_block:
+.cfi_startproc	
+	vmovdqa	(%rdi),%xmm1
+
+	vpxor	(%rdx),%xmm1,%xmm1
+	vaesenc	16(%rdx),%xmm1,%xmm1
+	vaesenc	32(%rdx),%xmm1,%xmm1
+	vaesenc	48(%rdx),%xmm1,%xmm1
+	vaesenc	64(%rdx),%xmm1,%xmm1
+	vaesenc	80(%rdx),%xmm1,%xmm1
+	vaesenc	96(%rdx),%xmm1,%xmm1
+	vaesenc	112(%rdx),%xmm1,%xmm1
+	vaesenc	128(%rdx),%xmm1,%xmm1
+	vaesenc	144(%rdx),%xmm1,%xmm1
+	vaesenclast	160(%rdx),%xmm1,%xmm1
+
+	vmovdqa	%xmm1,(%rsi)
+
+	.byte	0xf3,0xc3
+.cfi_endproc	
+.size	aes128gcmsiv_ecb_enc_block,.-aes128gcmsiv_ecb_enc_block
+.globl	aes256gcmsiv_aes_ks_enc_x1
+.hidden aes256gcmsiv_aes_ks_enc_x1
+.type	aes256gcmsiv_aes_ks_enc_x1,@function
+.align	16
+aes256gcmsiv_aes_ks_enc_x1:
+.cfi_startproc	
+	vmovdqa	con1(%rip),%xmm0
+	vmovdqa	mask(%rip),%xmm15
+	vmovdqa	(%rdi),%xmm8
+	vmovdqa	(%rcx),%xmm1
+	vmovdqa	16(%rcx),%xmm3
+	vpxor	%xmm1,%xmm8,%xmm8
+	vaesenc	%xmm3,%xmm8,%xmm8
+	vmovdqu	%xmm1,(%rdx)
+	vmovdqu	%xmm3,16(%rdx)
+	vpxor	%xmm14,%xmm14,%xmm14
+
+	vpshufb	%xmm15,%xmm3,%xmm2
+	vaesenclast	%xmm0,%xmm2,%xmm2
+	vpslld	$1,%xmm0,%xmm0
+	vpslldq	$4,%xmm1,%xmm4
+	vpxor	%xmm4,%xmm1,%xmm1
+	vpslldq	$4,%xmm4,%xmm4
+	vpxor	%xmm4,%xmm1,%xmm1
+	vpslldq	$4,%xmm4,%xmm4
+	vpxor	%xmm4,%xmm1,%xmm1
+	vpxor	%xmm2,%xmm1,%xmm1
+	vaesenc	%xmm1,%xmm8,%xmm8
+	vmovdqu	%xmm1,32(%rdx)
+
+	vpshufd	$0xff,%xmm1,%xmm2
+	vaesenclast	%xmm14,%xmm2,%xmm2
+	vpslldq	$4,%xmm3,%xmm4
+	vpxor	%xmm4,%xmm3,%xmm3
+	vpslldq	$4,%xmm4,%xmm4
+	vpxor	%xmm4,%xmm3,%xmm3
+	vpslldq	$4,%xmm4,%xmm4
+	vpxor	%xmm4,%xmm3,%xmm3
+	vpxor	%xmm2,%xmm3,%xmm3
+	vaesenc	%xmm3,%xmm8,%xmm8
+	vmovdqu	%xmm3,48(%rdx)
+
+	vpshufb	%xmm15,%xmm3,%xmm2
+	vaesenclast	%xmm0,%xmm2,%xmm2
+	vpslld	$1,%xmm0,%xmm0
+	vpslldq	$4,%xmm1,%xmm4
+	vpxor	%xmm4,%xmm1,%xmm1
+	vpslldq	$4,%xmm4,%xmm4
+	vpxor	%xmm4,%xmm1,%xmm1
+	vpslldq	$4,%xmm4,%xmm4
+	vpxor	%xmm4,%xmm1,%xmm1
+	vpxor	%xmm2,%xmm1,%xmm1
+	vaesenc	%xmm1,%xmm8,%xmm8
+	vmovdqu	%xmm1,64(%rdx)
+
+	vpshufd	$0xff,%xmm1,%xmm2
+	vaesenclast	%xmm14,%xmm2,%xmm2
+	vpslldq	$4,%xmm3,%xmm4
+	vpxor	%xmm4,%xmm3,%xmm3
+	vpslldq	$4,%xmm4,%xmm4
+	vpxor	%xmm4,%xmm3,%xmm3
+	vpslldq	$4,%xmm4,%xmm4
+	vpxor	%xmm4,%xmm3,%xmm3
+	vpxor	%xmm2,%xmm3,%xmm3
+	vaesenc	%xmm3,%xmm8,%xmm8
+	vmovdqu	%xmm3,80(%rdx)
+
+	vpshufb	%xmm15,%xmm3,%xmm2
+	vaesenclast	%xmm0,%xmm2,%xmm2
+	vpslld	$1,%xmm0,%xmm0
+	vpslldq	$4,%xmm1,%xmm4
+	vpxor	%xmm4,%xmm1,%xmm1
+	vpslldq	$4,%xmm4,%xmm4
+	vpxor	%xmm4,%xmm1,%xmm1
+	vpslldq	$4,%xmm4,%xmm4
+	vpxor	%xmm4,%xmm1,%xmm1
+	vpxor	%xmm2,%xmm1,%xmm1
+	vaesenc	%xmm1,%xmm8,%xmm8
+	vmovdqu	%xmm1,96(%rdx)
+
+	vpshufd	$0xff,%xmm1,%xmm2
+	vaesenclast	%xmm14,%xmm2,%xmm2
+	vpslldq	$4,%xmm3,%xmm4
+	vpxor	%xmm4,%xmm3,%xmm3
+	vpslldq	$4,%xmm4,%xmm4
+	vpxor	%xmm4,%xmm3,%xmm3
+	vpslldq	$4,%xmm4,%xmm4
+	vpxor	%xmm4,%xmm3,%xmm3
+	vpxor	%xmm2,%xmm3,%xmm3
+	vaesenc	%xmm3,%xmm8,%xmm8
+	vmovdqu	%xmm3,112(%rdx)
+
+	vpshufb	%xmm15,%xmm3,%xmm2
+	vaesenclast	%xmm0,%xmm2,%xmm2
+	vpslld	$1,%xmm0,%xmm0
+	vpslldq	$4,%xmm1,%xmm4
+	vpxor	%xmm4,%xmm1,%xmm1
+	vpslldq	$4,%xmm4,%xmm4
+	vpxor	%xmm4,%xmm1,%xmm1
+	vpslldq	$4,%xmm4,%xmm4
+	vpxor	%xmm4,%xmm1,%xmm1
+	vpxor	%xmm2,%xmm1,%xmm1
+	vaesenc	%xmm1,%xmm8,%xmm8
+	vmovdqu	%xmm1,128(%rdx)
+
+	vpshufd	$0xff,%xmm1,%xmm2
+	vaesenclast	%xmm14,%xmm2,%xmm2
+	vpslldq	$4,%xmm3,%xmm4
+	vpxor	%xmm4,%xmm3,%xmm3
+	vpslldq	$4,%xmm4,%xmm4
+	vpxor	%xmm4,%xmm3,%xmm3
+	vpslldq	$4,%xmm4,%xmm4
+	vpxor	%xmm4,%xmm3,%xmm3
+	vpxor	%xmm2,%xmm3,%xmm3
+	vaesenc	%xmm3,%xmm8,%xmm8
+	vmovdqu	%xmm3,144(%rdx)
+
+	vpshufb	%xmm15,%xmm3,%xmm2
+	vaesenclast	%xmm0,%xmm2,%xmm2
+	vpslld	$1,%xmm0,%xmm0
+	vpslldq	$4,%xmm1,%xmm4
+	vpxor	%xmm4,%xmm1,%xmm1
+	vpslldq	$4,%xmm4,%xmm4
+	vpxor	%xmm4,%xmm1,%xmm1
+	vpslldq	$4,%xmm4,%xmm4
+	vpxor	%xmm4,%xmm1,%xmm1
+	vpxor	%xmm2,%xmm1,%xmm1
+	vaesenc	%xmm1,%xmm8,%xmm8
+	vmovdqu	%xmm1,160(%rdx)
+
+	vpshufd	$0xff,%xmm1,%xmm2
+	vaesenclast	%xmm14,%xmm2,%xmm2
+	vpslldq	$4,%xmm3,%xmm4
+	vpxor	%xmm4,%xmm3,%xmm3
+	vpslldq	$4,%xmm4,%xmm4
+	vpxor	%xmm4,%xmm3,%xmm3
+	vpslldq	$4,%xmm4,%xmm4
+	vpxor	%xmm4,%xmm3,%xmm3
+	vpxor	%xmm2,%xmm3,%xmm3
+	vaesenc	%xmm3,%xmm8,%xmm8
+	vmovdqu	%xmm3,176(%rdx)
+
+	vpshufb	%xmm15,%xmm3,%xmm2
+	vaesenclast	%xmm0,%xmm2,%xmm2
+	vpslld	$1,%xmm0,%xmm0
+	vpslldq	$4,%xmm1,%xmm4
+	vpxor	%xmm4,%xmm1,%xmm1
+	vpslldq	$4,%xmm4,%xmm4
+	vpxor	%xmm4,%xmm1,%xmm1
+	vpslldq	$4,%xmm4,%xmm4
+	vpxor	%xmm4,%xmm1,%xmm1
+	vpxor	%xmm2,%xmm1,%xmm1
+	vaesenc	%xmm1,%xmm8,%xmm8
+	vmovdqu	%xmm1,192(%rdx)
+
+	vpshufd	$0xff,%xmm1,%xmm2
+	vaesenclast	%xmm14,%xmm2,%xmm2
+	vpslldq	$4,%xmm3,%xmm4
+	vpxor	%xmm4,%xmm3,%xmm3
+	vpslldq	$4,%xmm4,%xmm4
+	vpxor	%xmm4,%xmm3,%xmm3
+	vpslldq	$4,%xmm4,%xmm4
+	vpxor	%xmm4,%xmm3,%xmm3
+	vpxor	%xmm2,%xmm3,%xmm3
+	vaesenc	%xmm3,%xmm8,%xmm8
+	vmovdqu	%xmm3,208(%rdx)
+
+	vpshufb	%xmm15,%xmm3,%xmm2
+	vaesenclast	%xmm0,%xmm2,%xmm2
+	vpslldq	$4,%xmm1,%xmm4
+	vpxor	%xmm4,%xmm1,%xmm1
+	vpslldq	$4,%xmm4,%xmm4
+	vpxor	%xmm4,%xmm1,%xmm1
+	vpslldq	$4,%xmm4,%xmm4
+	vpxor	%xmm4,%xmm1,%xmm1
+	vpxor	%xmm2,%xmm1,%xmm1
+	vaesenclast	%xmm1,%xmm8,%xmm8
+	vmovdqu	%xmm1,224(%rdx)
+
+	vmovdqa	%xmm8,(%rsi)
+	.byte	0xf3,0xc3
+.cfi_endproc	
+.size	aes256gcmsiv_aes_ks_enc_x1,.-aes256gcmsiv_aes_ks_enc_x1
+.globl	aes256gcmsiv_ecb_enc_block
+.hidden aes256gcmsiv_ecb_enc_block
+.type	aes256gcmsiv_ecb_enc_block,@function
+.align	16
+aes256gcmsiv_ecb_enc_block:
+.cfi_startproc	
+	vmovdqa	(%rdi),%xmm1
+	vpxor	(%rdx),%xmm1,%xmm1
+	vaesenc	16(%rdx),%xmm1,%xmm1
+	vaesenc	32(%rdx),%xmm1,%xmm1
+	vaesenc	48(%rdx),%xmm1,%xmm1
+	vaesenc	64(%rdx),%xmm1,%xmm1
+	vaesenc	80(%rdx),%xmm1,%xmm1
+	vaesenc	96(%rdx),%xmm1,%xmm1
+	vaesenc	112(%rdx),%xmm1,%xmm1
+	vaesenc	128(%rdx),%xmm1,%xmm1
+	vaesenc	144(%rdx),%xmm1,%xmm1
+	vaesenc	160(%rdx),%xmm1,%xmm1
+	vaesenc	176(%rdx),%xmm1,%xmm1
+	vaesenc	192(%rdx),%xmm1,%xmm1
+	vaesenc	208(%rdx),%xmm1,%xmm1
+	vaesenclast	224(%rdx),%xmm1,%xmm1
+	vmovdqa	%xmm1,(%rsi)
+	.byte	0xf3,0xc3
+.cfi_endproc	
+.size	aes256gcmsiv_ecb_enc_block,.-aes256gcmsiv_ecb_enc_block
+.globl	aes256gcmsiv_enc_msg_x4
+.hidden aes256gcmsiv_enc_msg_x4
+.type	aes256gcmsiv_enc_msg_x4,@function
+.align	16
+aes256gcmsiv_enc_msg_x4:
+.cfi_startproc	
+	testq	%r8,%r8
+	jnz	.L256_enc_msg_x4_start
+	.byte	0xf3,0xc3
+
+.L256_enc_msg_x4_start:
+	movq	%r8,%r10
+	shrq	$4,%r8
+	shlq	$60,%r10
+	jz	.L256_enc_msg_x4_start2
+	addq	$1,%r8
+
+.L256_enc_msg_x4_start2:
+	movq	%r8,%r10
+	shlq	$62,%r10
+	shrq	$62,%r10
+
+
+	vmovdqa	(%rdx),%xmm15
+	vpor	OR_MASK(%rip),%xmm15,%xmm15
+
+	vmovdqa	four(%rip),%xmm4
+	vmovdqa	%xmm15,%xmm0
+	vpaddd	one(%rip),%xmm15,%xmm1
+	vpaddd	two(%rip),%xmm15,%xmm2
+	vpaddd	three(%rip),%xmm15,%xmm3
+
+	shrq	$2,%r8
+	je	.L256_enc_msg_x4_check_remainder
+
+	subq	$64,%rsi
+	subq	$64,%rdi
+
+.L256_enc_msg_x4_loop1:
+	addq	$64,%rsi
+	addq	$64,%rdi
+
+	vmovdqa	%xmm0,%xmm5
+	vmovdqa	%xmm1,%xmm6
+	vmovdqa	%xmm2,%xmm7
+	vmovdqa	%xmm3,%xmm8
+
+	vpxor	(%rcx),%xmm5,%xmm5
+	vpxor	(%rcx),%xmm6,%xmm6
+	vpxor	(%rcx),%xmm7,%xmm7
+	vpxor	(%rcx),%xmm8,%xmm8
+
+	vmovdqu	16(%rcx),%xmm12
+	vaesenc	%xmm12,%xmm5,%xmm5
+	vaesenc	%xmm12,%xmm6,%xmm6
+	vaesenc	%xmm12,%xmm7,%xmm7
+	vaesenc	%xmm12,%xmm8,%xmm8
+
+	vpaddd	%xmm4,%xmm0,%xmm0
+	vmovdqu	32(%rcx),%xmm12
+	vaesenc	%xmm12,%xmm5,%xmm5
+	vaesenc	%xmm12,%xmm6,%xmm6
+	vaesenc	%xmm12,%xmm7,%xmm7
+	vaesenc	%xmm12,%xmm8,%xmm8
+
+	vpaddd	%xmm4,%xmm1,%xmm1
+	vmovdqu	48(%rcx),%xmm12
+	vaesenc	%xmm12,%xmm5,%xmm5
+	vaesenc	%xmm12,%xmm6,%xmm6
+	vaesenc	%xmm12,%xmm7,%xmm7
+	vaesenc	%xmm12,%xmm8,%xmm8
+
+	vpaddd	%xmm4,%xmm2,%xmm2
+	vmovdqu	64(%rcx),%xmm12
+	vaesenc	%xmm12,%xmm5,%xmm5
+	vaesenc	%xmm12,%xmm6,%xmm6
+	vaesenc	%xmm12,%xmm7,%xmm7
+	vaesenc	%xmm12,%xmm8,%xmm8
+
+	vpaddd	%xmm4,%xmm3,%xmm3
+
+	vmovdqu	80(%rcx),%xmm12
+	vaesenc	%xmm12,%xmm5,%xmm5
+	vaesenc	%xmm12,%xmm6,%xmm6
+	vaesenc	%xmm12,%xmm7,%xmm7
+	vaesenc	%xmm12,%xmm8,%xmm8
+
+	vmovdqu	96(%rcx),%xmm12
+	vaesenc	%xmm12,%xmm5,%xmm5
+	vaesenc	%xmm12,%xmm6,%xmm6
+	vaesenc	%xmm12,%xmm7,%xmm7
+	vaesenc	%xmm12,%xmm8,%xmm8
+
+	vmovdqu	112(%rcx),%xmm12
+	vaesenc	%xmm12,%xmm5,%xmm5
+	vaesenc	%xmm12,%xmm6,%xmm6
+	vaesenc	%xmm12,%xmm7,%xmm7
+	vaesenc	%xmm12,%xmm8,%xmm8
+
+	vmovdqu	128(%rcx),%xmm12
+	vaesenc	%xmm12,%xmm5,%xmm5
+	vaesenc	%xmm12,%xmm6,%xmm6
+	vaesenc	%xmm12,%xmm7,%xmm7
+	vaesenc	%xmm12,%xmm8,%xmm8
+
+	vmovdqu	144(%rcx),%xmm12
+	vaesenc	%xmm12,%xmm5,%xmm5
+	vaesenc	%xmm12,%xmm6,%xmm6
+	vaesenc	%xmm12,%xmm7,%xmm7
+	vaesenc	%xmm12,%xmm8,%xmm8
+
+	vmovdqu	160(%rcx),%xmm12
+	vaesenc	%xmm12,%xmm5,%xmm5
+	vaesenc	%xmm12,%xmm6,%xmm6
+	vaesenc	%xmm12,%xmm7,%xmm7
+	vaesenc	%xmm12,%xmm8,%xmm8
+
+	vmovdqu	176(%rcx),%xmm12
+	vaesenc	%xmm12,%xmm5,%xmm5
+	vaesenc	%xmm12,%xmm6,%xmm6
+	vaesenc	%xmm12,%xmm7,%xmm7
+	vaesenc	%xmm12,%xmm8,%xmm8
+
+	vmovdqu	192(%rcx),%xmm12
+	vaesenc	%xmm12,%xmm5,%xmm5
+	vaesenc	%xmm12,%xmm6,%xmm6
+	vaesenc	%xmm12,%xmm7,%xmm7
+	vaesenc	%xmm12,%xmm8,%xmm8
+
+	vmovdqu	208(%rcx),%xmm12
+	vaesenc	%xmm12,%xmm5,%xmm5
+	vaesenc	%xmm12,%xmm6,%xmm6
+	vaesenc	%xmm12,%xmm7,%xmm7
+	vaesenc	%xmm12,%xmm8,%xmm8
+
+	vmovdqu	224(%rcx),%xmm12
+	vaesenclast	%xmm12,%xmm5,%xmm5
+	vaesenclast	%xmm12,%xmm6,%xmm6
+	vaesenclast	%xmm12,%xmm7,%xmm7
+	vaesenclast	%xmm12,%xmm8,%xmm8
+
+
+
+	vpxor	0(%rdi),%xmm5,%xmm5
+	vpxor	16(%rdi),%xmm6,%xmm6
+	vpxor	32(%rdi),%xmm7,%xmm7
+	vpxor	48(%rdi),%xmm8,%xmm8
+
+	subq	$1,%r8
+
+	vmovdqu	%xmm5,0(%rsi)
+	vmovdqu	%xmm6,16(%rsi)
+	vmovdqu	%xmm7,32(%rsi)
+	vmovdqu	%xmm8,48(%rsi)
+
+	jne	.L256_enc_msg_x4_loop1
+
+	addq	$64,%rsi
+	addq	$64,%rdi
+
+.L256_enc_msg_x4_check_remainder:
+	cmpq	$0,%r10
+	je	.L256_enc_msg_x4_out
+
+.L256_enc_msg_x4_loop2:
+
+
+
+	vmovdqa	%xmm0,%xmm5
+	vpaddd	one(%rip),%xmm0,%xmm0
+	vpxor	(%rcx),%xmm5,%xmm5
+	vaesenc	16(%rcx),%xmm5,%xmm5
+	vaesenc	32(%rcx),%xmm5,%xmm5
+	vaesenc	48(%rcx),%xmm5,%xmm5
+	vaesenc	64(%rcx),%xmm5,%xmm5
+	vaesenc	80(%rcx),%xmm5,%xmm5
+	vaesenc	96(%rcx),%xmm5,%xmm5
+	vaesenc	112(%rcx),%xmm5,%xmm5
+	vaesenc	128(%rcx),%xmm5,%xmm5
+	vaesenc	144(%rcx),%xmm5,%xmm5
+	vaesenc	160(%rcx),%xmm5,%xmm5
+	vaesenc	176(%rcx),%xmm5,%xmm5
+	vaesenc	192(%rcx),%xmm5,%xmm5
+	vaesenc	208(%rcx),%xmm5,%xmm5
+	vaesenclast	224(%rcx),%xmm5,%xmm5
+
+
+	vpxor	(%rdi),%xmm5,%xmm5
+
+	vmovdqu	%xmm5,(%rsi)
+
+	addq	$16,%rdi
+	addq	$16,%rsi
+
+	subq	$1,%r10
+	jne	.L256_enc_msg_x4_loop2
+
+.L256_enc_msg_x4_out:
+	.byte	0xf3,0xc3
+.cfi_endproc	
+.size	aes256gcmsiv_enc_msg_x4,.-aes256gcmsiv_enc_msg_x4
+.globl	aes256gcmsiv_enc_msg_x8
+.hidden aes256gcmsiv_enc_msg_x8
+.type	aes256gcmsiv_enc_msg_x8,@function
+.align	16
+aes256gcmsiv_enc_msg_x8:
+.cfi_startproc	
+	testq	%r8,%r8
+	jnz	.L256_enc_msg_x8_start
+	.byte	0xf3,0xc3
+
+.L256_enc_msg_x8_start:
+
+	movq	%rsp,%r11
+	subq	$16,%r11
+	andq	$-64,%r11
+
+	movq	%r8,%r10
+	shrq	$4,%r8
+	shlq	$60,%r10
+	jz	.L256_enc_msg_x8_start2
+	addq	$1,%r8
+
+.L256_enc_msg_x8_start2:
+	movq	%r8,%r10
+	shlq	$61,%r10
+	shrq	$61,%r10
+
+
+	vmovdqa	(%rdx),%xmm1
+	vpor	OR_MASK(%rip),%xmm1,%xmm1
+
+
+	vpaddd	seven(%rip),%xmm1,%xmm0
+	vmovdqa	%xmm0,(%r11)
+	vpaddd	one(%rip),%xmm1,%xmm9
+	vpaddd	two(%rip),%xmm1,%xmm10
+	vpaddd	three(%rip),%xmm1,%xmm11
+	vpaddd	four(%rip),%xmm1,%xmm12
+	vpaddd	five(%rip),%xmm1,%xmm13
+	vpaddd	six(%rip),%xmm1,%xmm14
+	vmovdqa	%xmm1,%xmm0
+
+	shrq	$3,%r8
+	jz	.L256_enc_msg_x8_check_remainder
+
+	subq	$128,%rsi
+	subq	$128,%rdi
+
+.L256_enc_msg_x8_loop1:
+	addq	$128,%rsi
+	addq	$128,%rdi
+
+	vmovdqa	%xmm0,%xmm1
+	vmovdqa	%xmm9,%xmm2
+	vmovdqa	%xmm10,%xmm3
+	vmovdqa	%xmm11,%xmm4
+	vmovdqa	%xmm12,%xmm5
+	vmovdqa	%xmm13,%xmm6
+	vmovdqa	%xmm14,%xmm7
+
+	vmovdqa	(%r11),%xmm8
+
+	vpxor	(%rcx),%xmm1,%xmm1
+	vpxor	(%rcx),%xmm2,%xmm2
+	vpxor	(%rcx),%xmm3,%xmm3
+	vpxor	(%rcx),%xmm4,%xmm4
+	vpxor	(%rcx),%xmm5,%xmm5
+	vpxor	(%rcx),%xmm6,%xmm6
+	vpxor	(%rcx),%xmm7,%xmm7
+	vpxor	(%rcx),%xmm8,%xmm8
+
+	vmovdqu	16(%rcx),%xmm15
+	vaesenc	%xmm15,%xmm1,%xmm1
+	vaesenc	%xmm15,%xmm2,%xmm2
+	vaesenc	%xmm15,%xmm3,%xmm3
+	vaesenc	%xmm15,%xmm4,%xmm4
+	vaesenc	%xmm15,%xmm5,%xmm5
+	vaesenc	%xmm15,%xmm6,%xmm6
+	vaesenc	%xmm15,%xmm7,%xmm7
+	vaesenc	%xmm15,%xmm8,%xmm8
+
+	vmovdqa	(%r11),%xmm14
+	vpaddd	eight(%rip),%xmm14,%xmm14
+	vmovdqa	%xmm14,(%r11)
+	vmovdqu	32(%rcx),%xmm15
+	vaesenc	%xmm15,%xmm1,%xmm1
+	vaesenc	%xmm15,%xmm2,%xmm2
+	vaesenc	%xmm15,%xmm3,%xmm3
+	vaesenc	%xmm15,%xmm4,%xmm4
+	vaesenc	%xmm15,%xmm5,%xmm5
+	vaesenc	%xmm15,%xmm6,%xmm6
+	vaesenc	%xmm15,%xmm7,%xmm7
+	vaesenc	%xmm15,%xmm8,%xmm8
+
+	vpsubd	one(%rip),%xmm14,%xmm14
+	vmovdqu	48(%rcx),%xmm15
+	vaesenc	%xmm15,%xmm1,%xmm1
+	vaesenc	%xmm15,%xmm2,%xmm2
+	vaesenc	%xmm15,%xmm3,%xmm3
+	vaesenc	%xmm15,%xmm4,%xmm4
+	vaesenc	%xmm15,%xmm5,%xmm5
+	vaesenc	%xmm15,%xmm6,%xmm6
+	vaesenc	%xmm15,%xmm7,%xmm7
+	vaesenc	%xmm15,%xmm8,%xmm8
+
+	vpaddd	eight(%rip),%xmm0,%xmm0
+	vmovdqu	64(%rcx),%xmm15
+	vaesenc	%xmm15,%xmm1,%xmm1
+	vaesenc	%xmm15,%xmm2,%xmm2
+	vaesenc	%xmm15,%xmm3,%xmm3
+	vaesenc	%xmm15,%xmm4,%xmm4
+	vaesenc	%xmm15,%xmm5,%xmm5
+	vaesenc	%xmm15,%xmm6,%xmm6
+	vaesenc	%xmm15,%xmm7,%xmm7
+	vaesenc	%xmm15,%xmm8,%xmm8
+
+	vpaddd	eight(%rip),%xmm9,%xmm9
+	vmovdqu	80(%rcx),%xmm15
+	vaesenc	%xmm15,%xmm1,%xmm1
+	vaesenc	%xmm15,%xmm2,%xmm2
+	vaesenc	%xmm15,%xmm3,%xmm3
+	vaesenc	%xmm15,%xmm4,%xmm4
+	vaesenc	%xmm15,%xmm5,%xmm5
+	vaesenc	%xmm15,%xmm6,%xmm6
+	vaesenc	%xmm15,%xmm7,%xmm7
+	vaesenc	%xmm15,%xmm8,%xmm8
+
+	vpaddd	eight(%rip),%xmm10,%xmm10
+	vmovdqu	96(%rcx),%xmm15
+	vaesenc	%xmm15,%xmm1,%xmm1
+	vaesenc	%xmm15,%xmm2,%xmm2
+	vaesenc	%xmm15,%xmm3,%xmm3
+	vaesenc	%xmm15,%xmm4,%xmm4
+	vaesenc	%xmm15,%xmm5,%xmm5
+	vaesenc	%xmm15,%xmm6,%xmm6
+	vaesenc	%xmm15,%xmm7,%xmm7
+	vaesenc	%xmm15,%xmm8,%xmm8
+
+	vpaddd	eight(%rip),%xmm11,%xmm11
+	vmovdqu	112(%rcx),%xmm15
+	vaesenc	%xmm15,%xmm1,%xmm1
+	vaesenc	%xmm15,%xmm2,%xmm2
+	vaesenc	%xmm15,%xmm3,%xmm3
+	vaesenc	%xmm15,%xmm4,%xmm4
+	vaesenc	%xmm15,%xmm5,%xmm5
+	vaesenc	%xmm15,%xmm6,%xmm6
+	vaesenc	%xmm15,%xmm7,%xmm7
+	vaesenc	%xmm15,%xmm8,%xmm8
+
+	vpaddd	eight(%rip),%xmm12,%xmm12
+	vmovdqu	128(%rcx),%xmm15
+	vaesenc	%xmm15,%xmm1,%xmm1
+	vaesenc	%xmm15,%xmm2,%xmm2
+	vaesenc	%xmm15,%xmm3,%xmm3
+	vaesenc	%xmm15,%xmm4,%xmm4
+	vaesenc	%xmm15,%xmm5,%xmm5
+	vaesenc	%xmm15,%xmm6,%xmm6
+	vaesenc	%xmm15,%xmm7,%xmm7
+	vaesenc	%xmm15,%xmm8,%xmm8
+
+	vpaddd	eight(%rip),%xmm13,%xmm13
+	vmovdqu	144(%rcx),%xmm15
+	vaesenc	%xmm15,%xmm1,%xmm1
+	vaesenc	%xmm15,%xmm2,%xmm2
+	vaesenc	%xmm15,%xmm3,%xmm3
+	vaesenc	%xmm15,%xmm4,%xmm4
+	vaesenc	%xmm15,%xmm5,%xmm5
+	vaesenc	%xmm15,%xmm6,%xmm6
+	vaesenc	%xmm15,%xmm7,%xmm7
+	vaesenc	%xmm15,%xmm8,%xmm8
+
+	vmovdqu	160(%rcx),%xmm15
+	vaesenc	%xmm15,%xmm1,%xmm1
+	vaesenc	%xmm15,%xmm2,%xmm2
+	vaesenc	%xmm15,%xmm3,%xmm3
+	vaesenc	%xmm15,%xmm4,%xmm4
+	vaesenc	%xmm15,%xmm5,%xmm5
+	vaesenc	%xmm15,%xmm6,%xmm6
+	vaesenc	%xmm15,%xmm7,%xmm7
+	vaesenc	%xmm15,%xmm8,%xmm8
+
+	vmovdqu	176(%rcx),%xmm15
+	vaesenc	%xmm15,%xmm1,%xmm1
+	vaesenc	%xmm15,%xmm2,%xmm2
+	vaesenc	%xmm15,%xmm3,%xmm3
+	vaesenc	%xmm15,%xmm4,%xmm4
+	vaesenc	%xmm15,%xmm5,%xmm5
+	vaesenc	%xmm15,%xmm6,%xmm6
+	vaesenc	%xmm15,%xmm7,%xmm7
+	vaesenc	%xmm15,%xmm8,%xmm8
+
+	vmovdqu	192(%rcx),%xmm15
+	vaesenc	%xmm15,%xmm1,%xmm1
+	vaesenc	%xmm15,%xmm2,%xmm2
+	vaesenc	%xmm15,%xmm3,%xmm3
+	vaesenc	%xmm15,%xmm4,%xmm4
+	vaesenc	%xmm15,%xmm5,%xmm5
+	vaesenc	%xmm15,%xmm6,%xmm6
+	vaesenc	%xmm15,%xmm7,%xmm7
+	vaesenc	%xmm15,%xmm8,%xmm8
+
+	vmovdqu	208(%rcx),%xmm15
+	vaesenc	%xmm15,%xmm1,%xmm1
+	vaesenc	%xmm15,%xmm2,%xmm2
+	vaesenc	%xmm15,%xmm3,%xmm3
+	vaesenc	%xmm15,%xmm4,%xmm4
+	vaesenc	%xmm15,%xmm5,%xmm5
+	vaesenc	%xmm15,%xmm6,%xmm6
+	vaesenc	%xmm15,%xmm7,%xmm7
+	vaesenc	%xmm15,%xmm8,%xmm8
+
+	vmovdqu	224(%rcx),%xmm15
+	vaesenclast	%xmm15,%xmm1,%xmm1
+	vaesenclast	%xmm15,%xmm2,%xmm2
+	vaesenclast	%xmm15,%xmm3,%xmm3
+	vaesenclast	%xmm15,%xmm4,%xmm4
+	vaesenclast	%xmm15,%xmm5,%xmm5
+	vaesenclast	%xmm15,%xmm6,%xmm6
+	vaesenclast	%xmm15,%xmm7,%xmm7
+	vaesenclast	%xmm15,%xmm8,%xmm8
+
+
+
+	vpxor	0(%rdi),%xmm1,%xmm1
+	vpxor	16(%rdi),%xmm2,%xmm2
+	vpxor	32(%rdi),%xmm3,%xmm3
+	vpxor	48(%rdi),%xmm4,%xmm4
+	vpxor	64(%rdi),%xmm5,%xmm5
+	vpxor	80(%rdi),%xmm6,%xmm6
+	vpxor	96(%rdi),%xmm7,%xmm7
+	vpxor	112(%rdi),%xmm8,%xmm8
+
+	subq	$1,%r8
+
+	vmovdqu	%xmm1,0(%rsi)
+	vmovdqu	%xmm2,16(%rsi)
+	vmovdqu	%xmm3,32(%rsi)
+	vmovdqu	%xmm4,48(%rsi)
+	vmovdqu	%xmm5,64(%rsi)
+	vmovdqu	%xmm6,80(%rsi)
+	vmovdqu	%xmm7,96(%rsi)
+	vmovdqu	%xmm8,112(%rsi)
+
+	jne	.L256_enc_msg_x8_loop1
+
+	addq	$128,%rsi
+	addq	$128,%rdi
+
+.L256_enc_msg_x8_check_remainder:
+	cmpq	$0,%r10
+	je	.L256_enc_msg_x8_out
+
+.L256_enc_msg_x8_loop2:
+
+
+	vmovdqa	%xmm0,%xmm1
+	vpaddd	one(%rip),%xmm0,%xmm0
+
+	vpxor	(%rcx),%xmm1,%xmm1
+	vaesenc	16(%rcx),%xmm1,%xmm1
+	vaesenc	32(%rcx),%xmm1,%xmm1
+	vaesenc	48(%rcx),%xmm1,%xmm1
+	vaesenc	64(%rcx),%xmm1,%xmm1
+	vaesenc	80(%rcx),%xmm1,%xmm1
+	vaesenc	96(%rcx),%xmm1,%xmm1
+	vaesenc	112(%rcx),%xmm1,%xmm1
+	vaesenc	128(%rcx),%xmm1,%xmm1
+	vaesenc	144(%rcx),%xmm1,%xmm1
+	vaesenc	160(%rcx),%xmm1,%xmm1
+	vaesenc	176(%rcx),%xmm1,%xmm1
+	vaesenc	192(%rcx),%xmm1,%xmm1
+	vaesenc	208(%rcx),%xmm1,%xmm1
+	vaesenclast	224(%rcx),%xmm1,%xmm1
+
+
+	vpxor	(%rdi),%xmm1,%xmm1
+
+	vmovdqu	%xmm1,(%rsi)
+
+	addq	$16,%rdi
+	addq	$16,%rsi
+	subq	$1,%r10
+	jnz	.L256_enc_msg_x8_loop2
+
+.L256_enc_msg_x8_out:
+	.byte	0xf3,0xc3
+
+.cfi_endproc	
+.size	aes256gcmsiv_enc_msg_x8,.-aes256gcmsiv_enc_msg_x8
+.globl	aes256gcmsiv_dec
+.hidden aes256gcmsiv_dec
+.type	aes256gcmsiv_dec,@function
+.align	16
+aes256gcmsiv_dec:
+.cfi_startproc	
+	testq	$~15,%r9
+	jnz	.L256_dec_start
+	.byte	0xf3,0xc3
+
+.L256_dec_start:
+	vzeroupper
+	vmovdqa	(%rdx),%xmm0
+	movq	%rdx,%rax
+
+	leaq	32(%rax),%rax
+	leaq	32(%rcx),%rcx
+
+
+	vmovdqu	(%rdi,%r9,1),%xmm15
+	vpor	OR_MASK(%rip),%xmm15,%xmm15
+	andq	$~15,%r9
+
+
+	cmpq	$96,%r9
+	jb	.L256_dec_loop2
+
+
+	subq	$96,%r9
+	vmovdqa	%xmm15,%xmm7
+	vpaddd	one(%rip),%xmm7,%xmm8
+	vpaddd	two(%rip),%xmm7,%xmm9
+	vpaddd	one(%rip),%xmm9,%xmm10
+	vpaddd	two(%rip),%xmm9,%xmm11
+	vpaddd	one(%rip),%xmm11,%xmm12
+	vpaddd	two(%rip),%xmm11,%xmm15
+
+	vpxor	(%r8),%xmm7,%xmm7
+	vpxor	(%r8),%xmm8,%xmm8
+	vpxor	(%r8),%xmm9,%xmm9
+	vpxor	(%r8),%xmm10,%xmm10
+	vpxor	(%r8),%xmm11,%xmm11
+	vpxor	(%r8),%xmm12,%xmm12
+
+	vmovdqu	16(%r8),%xmm4
+	vaesenc	%xmm4,%xmm7,%xmm7
+	vaesenc	%xmm4,%xmm8,%xmm8
+	vaesenc	%xmm4,%xmm9,%xmm9
+	vaesenc	%xmm4,%xmm10,%xmm10
+	vaesenc	%xmm4,%xmm11,%xmm11
+	vaesenc	%xmm4,%xmm12,%xmm12
+
+	vmovdqu	32(%r8),%xmm4
+	vaesenc	%xmm4,%xmm7,%xmm7
+	vaesenc	%xmm4,%xmm8,%xmm8
+	vaesenc	%xmm4,%xmm9,%xmm9
+	vaesenc	%xmm4,%xmm10,%xmm10
+	vaesenc	%xmm4,%xmm11,%xmm11
+	vaesenc	%xmm4,%xmm12,%xmm12
+
+	vmovdqu	48(%r8),%xmm4
+	vaesenc	%xmm4,%xmm7,%xmm7
+	vaesenc	%xmm4,%xmm8,%xmm8
+	vaesenc	%xmm4,%xmm9,%xmm9
+	vaesenc	%xmm4,%xmm10,%xmm10
+	vaesenc	%xmm4,%xmm11,%xmm11
+	vaesenc	%xmm4,%xmm12,%xmm12
+
+	vmovdqu	64(%r8),%xmm4
+	vaesenc	%xmm4,%xmm7,%xmm7
+	vaesenc	%xmm4,%xmm8,%xmm8
+	vaesenc	%xmm4,%xmm9,%xmm9
+	vaesenc	%xmm4,%xmm10,%xmm10
+	vaesenc	%xmm4,%xmm11,%xmm11
+	vaesenc	%xmm4,%xmm12,%xmm12
+
+	vmovdqu	80(%r8),%xmm4
+	vaesenc	%xmm4,%xmm7,%xmm7
+	vaesenc	%xmm4,%xmm8,%xmm8
+	vaesenc	%xmm4,%xmm9,%xmm9
+	vaesenc	%xmm4,%xmm10,%xmm10
+	vaesenc	%xmm4,%xmm11,%xmm11
+	vaesenc	%xmm4,%xmm12,%xmm12
+
+	vmovdqu	96(%r8),%xmm4
+	vaesenc	%xmm4,%xmm7,%xmm7
+	vaesenc	%xmm4,%xmm8,%xmm8
+	vaesenc	%xmm4,%xmm9,%xmm9
+	vaesenc	%xmm4,%xmm10,%xmm10
+	vaesenc	%xmm4,%xmm11,%xmm11
+	vaesenc	%xmm4,%xmm12,%xmm12
+
+	vmovdqu	112(%r8),%xmm4
+	vaesenc	%xmm4,%xmm7,%xmm7
+	vaesenc	%xmm4,%xmm8,%xmm8
+	vaesenc	%xmm4,%xmm9,%xmm9
+	vaesenc	%xmm4,%xmm10,%xmm10
+	vaesenc	%xmm4,%xmm11,%xmm11
+	vaesenc	%xmm4,%xmm12,%xmm12
+
+	vmovdqu	128(%r8),%xmm4
+	vaesenc	%xmm4,%xmm7,%xmm7
+	vaesenc	%xmm4,%xmm8,%xmm8
+	vaesenc	%xmm4,%xmm9,%xmm9
+	vaesenc	%xmm4,%xmm10,%xmm10
+	vaesenc	%xmm4,%xmm11,%xmm11
+	vaesenc	%xmm4,%xmm12,%xmm12
+
+	vmovdqu	144(%r8),%xmm4
+	vaesenc	%xmm4,%xmm7,%xmm7
+	vaesenc	%xmm4,%xmm8,%xmm8
+	vaesenc	%xmm4,%xmm9,%xmm9
+	vaesenc	%xmm4,%xmm10,%xmm10
+	vaesenc	%xmm4,%xmm11,%xmm11
+	vaesenc	%xmm4,%xmm12,%xmm12
+
+	vmovdqu	160(%r8),%xmm4
+	vaesenc	%xmm4,%xmm7,%xmm7
+	vaesenc	%xmm4,%xmm8,%xmm8
+	vaesenc	%xmm4,%xmm9,%xmm9
+	vaesenc	%xmm4,%xmm10,%xmm10
+	vaesenc	%xmm4,%xmm11,%xmm11
+	vaesenc	%xmm4,%xmm12,%xmm12
+
+	vmovdqu	176(%r8),%xmm4
+	vaesenc	%xmm4,%xmm7,%xmm7
+	vaesenc	%xmm4,%xmm8,%xmm8
+	vaesenc	%xmm4,%xmm9,%xmm9
+	vaesenc	%xmm4,%xmm10,%xmm10
+	vaesenc	%xmm4,%xmm11,%xmm11
+	vaesenc	%xmm4,%xmm12,%xmm12
+
+	vmovdqu	192(%r8),%xmm4
+	vaesenc	%xmm4,%xmm7,%xmm7
+	vaesenc	%xmm4,%xmm8,%xmm8
+	vaesenc	%xmm4,%xmm9,%xmm9
+	vaesenc	%xmm4,%xmm10,%xmm10
+	vaesenc	%xmm4,%xmm11,%xmm11
+	vaesenc	%xmm4,%xmm12,%xmm12
+
+	vmovdqu	208(%r8),%xmm4
+	vaesenc	%xmm4,%xmm7,%xmm7
+	vaesenc	%xmm4,%xmm8,%xmm8
+	vaesenc	%xmm4,%xmm9,%xmm9
+	vaesenc	%xmm4,%xmm10,%xmm10
+	vaesenc	%xmm4,%xmm11,%xmm11
+	vaesenc	%xmm4,%xmm12,%xmm12
+
+	vmovdqu	224(%r8),%xmm4
+	vaesenclast	%xmm4,%xmm7,%xmm7
+	vaesenclast	%xmm4,%xmm8,%xmm8
+	vaesenclast	%xmm4,%xmm9,%xmm9
+	vaesenclast	%xmm4,%xmm10,%xmm10
+	vaesenclast	%xmm4,%xmm11,%xmm11
+	vaesenclast	%xmm4,%xmm12,%xmm12
+
+
+	vpxor	0(%rdi),%xmm7,%xmm7
+	vpxor	16(%rdi),%xmm8,%xmm8
+	vpxor	32(%rdi),%xmm9,%xmm9
+	vpxor	48(%rdi),%xmm10,%xmm10
+	vpxor	64(%rdi),%xmm11,%xmm11
+	vpxor	80(%rdi),%xmm12,%xmm12
+
+	vmovdqu	%xmm7,0(%rsi)
+	vmovdqu	%xmm8,16(%rsi)
+	vmovdqu	%xmm9,32(%rsi)
+	vmovdqu	%xmm10,48(%rsi)
+	vmovdqu	%xmm11,64(%rsi)
+	vmovdqu	%xmm12,80(%rsi)
+
+	addq	$96,%rdi
+	addq	$96,%rsi
+	jmp	.L256_dec_loop1
+
+
+.align	64
+.L256_dec_loop1:
+	cmpq	$96,%r9
+	jb	.L256_dec_finish_96
+	subq	$96,%r9
+
+	vmovdqa	%xmm12,%xmm6
+	vmovdqa	%xmm11,16-32(%rax)
+	vmovdqa	%xmm10,32-32(%rax)
+	vmovdqa	%xmm9,48-32(%rax)
+	vmovdqa	%xmm8,64-32(%rax)
+	vmovdqa	%xmm7,80-32(%rax)
+
+	vmovdqa	%xmm15,%xmm7
+	vpaddd	one(%rip),%xmm7,%xmm8
+	vpaddd	two(%rip),%xmm7,%xmm9
+	vpaddd	one(%rip),%xmm9,%xmm10
+	vpaddd	two(%rip),%xmm9,%xmm11
+	vpaddd	one(%rip),%xmm11,%xmm12
+	vpaddd	two(%rip),%xmm11,%xmm15
+
+	vmovdqa	(%r8),%xmm4
+	vpxor	%xmm4,%xmm7,%xmm7
+	vpxor	%xmm4,%xmm8,%xmm8
+	vpxor	%xmm4,%xmm9,%xmm9
+	vpxor	%xmm4,%xmm10,%xmm10
+	vpxor	%xmm4,%xmm11,%xmm11
+	vpxor	%xmm4,%xmm12,%xmm12
+
+	vmovdqu	0-32(%rcx),%xmm4
+	vpclmulqdq	$0x11,%xmm4,%xmm6,%xmm2
+	vpclmulqdq	$0x00,%xmm4,%xmm6,%xmm3
+	vpclmulqdq	$0x01,%xmm4,%xmm6,%xmm1
+	vpclmulqdq	$0x10,%xmm4,%xmm6,%xmm4
+	vpxor	%xmm4,%xmm1,%xmm1
+
+	vmovdqu	16(%r8),%xmm4
+	vaesenc	%xmm4,%xmm7,%xmm7
+	vaesenc	%xmm4,%xmm8,%xmm8
+	vaesenc	%xmm4,%xmm9,%xmm9
+	vaesenc	%xmm4,%xmm10,%xmm10
+	vaesenc	%xmm4,%xmm11,%xmm11
+	vaesenc	%xmm4,%xmm12,%xmm12
+
+	vmovdqu	-16(%rax),%xmm6
+	vmovdqu	-16(%rcx),%xmm13
+
+	vpclmulqdq	$0x10,%xmm13,%xmm6,%xmm4
+	vpxor	%xmm4,%xmm1,%xmm1
+	vpclmulqdq	$0x11,%xmm13,%xmm6,%xmm4
+	vpxor	%xmm4,%xmm2,%xmm2
+	vpclmulqdq	$0x00,%xmm13,%xmm6,%xmm4
+	vpxor	%xmm4,%xmm3,%xmm3
+	vpclmulqdq	$0x01,%xmm13,%xmm6,%xmm4
+	vpxor	%xmm4,%xmm1,%xmm1
+
+
+	vmovdqu	32(%r8),%xmm4
+	vaesenc	%xmm4,%xmm7,%xmm7
+	vaesenc	%xmm4,%xmm8,%xmm8
+	vaesenc	%xmm4,%xmm9,%xmm9
+	vaesenc	%xmm4,%xmm10,%xmm10
+	vaesenc	%xmm4,%xmm11,%xmm11
+	vaesenc	%xmm4,%xmm12,%xmm12
+
+	vmovdqu	0(%rax),%xmm6
+	vmovdqu	0(%rcx),%xmm13
+
+	vpclmulqdq	$0x10,%xmm13,%xmm6,%xmm4
+	vpxor	%xmm4,%xmm1,%xmm1
+	vpclmulqdq	$0x11,%xmm13,%xmm6,%xmm4
+	vpxor	%xmm4,%xmm2,%xmm2
+	vpclmulqdq	$0x00,%xmm13,%xmm6,%xmm4
+	vpxor	%xmm4,%xmm3,%xmm3
+	vpclmulqdq	$0x01,%xmm13,%xmm6,%xmm4
+	vpxor	%xmm4,%xmm1,%xmm1
+
+
+	vmovdqu	48(%r8),%xmm4
+	vaesenc	%xmm4,%xmm7,%xmm7
+	vaesenc	%xmm4,%xmm8,%xmm8
+	vaesenc	%xmm4,%xmm9,%xmm9
+	vaesenc	%xmm4,%xmm10,%xmm10
+	vaesenc	%xmm4,%xmm11,%xmm11
+	vaesenc	%xmm4,%xmm12,%xmm12
+
+	vmovdqu	16(%rax),%xmm6
+	vmovdqu	16(%rcx),%xmm13
+
+	vpclmulqdq	$0x10,%xmm13,%xmm6,%xmm4
+	vpxor	%xmm4,%xmm1,%xmm1
+	vpclmulqdq	$0x11,%xmm13,%xmm6,%xmm4
+	vpxor	%xmm4,%xmm2,%xmm2
+	vpclmulqdq	$0x00,%xmm13,%xmm6,%xmm4
+	vpxor	%xmm4,%xmm3,%xmm3
+	vpclmulqdq	$0x01,%xmm13,%xmm6,%xmm4
+	vpxor	%xmm4,%xmm1,%xmm1
+
+
+	vmovdqu	64(%r8),%xmm4
+	vaesenc	%xmm4,%xmm7,%xmm7
+	vaesenc	%xmm4,%xmm8,%xmm8
+	vaesenc	%xmm4,%xmm9,%xmm9
+	vaesenc	%xmm4,%xmm10,%xmm10
+	vaesenc	%xmm4,%xmm11,%xmm11
+	vaesenc	%xmm4,%xmm12,%xmm12
+
+	vmovdqu	32(%rax),%xmm6
+	vmovdqu	32(%rcx),%xmm13
+
+	vpclmulqdq	$0x10,%xmm13,%xmm6,%xmm4
+	vpxor	%xmm4,%xmm1,%xmm1
+	vpclmulqdq	$0x11,%xmm13,%xmm6,%xmm4
+	vpxor	%xmm4,%xmm2,%xmm2
+	vpclmulqdq	$0x00,%xmm13,%xmm6,%xmm4
+	vpxor	%xmm4,%xmm3,%xmm3
+	vpclmulqdq	$0x01,%xmm13,%xmm6,%xmm4
+	vpxor	%xmm4,%xmm1,%xmm1
+
+
+	vmovdqu	80(%r8),%xmm4
+	vaesenc	%xmm4,%xmm7,%xmm7
+	vaesenc	%xmm4,%xmm8,%xmm8
+	vaesenc	%xmm4,%xmm9,%xmm9
+	vaesenc	%xmm4,%xmm10,%xmm10
+	vaesenc	%xmm4,%xmm11,%xmm11
+	vaesenc	%xmm4,%xmm12,%xmm12
+
+	vmovdqu	96(%r8),%xmm4
+	vaesenc	%xmm4,%xmm7,%xmm7
+	vaesenc	%xmm4,%xmm8,%xmm8
+	vaesenc	%xmm4,%xmm9,%xmm9
+	vaesenc	%xmm4,%xmm10,%xmm10
+	vaesenc	%xmm4,%xmm11,%xmm11
+	vaesenc	%xmm4,%xmm12,%xmm12
+
+	vmovdqu	112(%r8),%xmm4
+	vaesenc	%xmm4,%xmm7,%xmm7
+	vaesenc	%xmm4,%xmm8,%xmm8
+	vaesenc	%xmm4,%xmm9,%xmm9
+	vaesenc	%xmm4,%xmm10,%xmm10
+	vaesenc	%xmm4,%xmm11,%xmm11
+	vaesenc	%xmm4,%xmm12,%xmm12
+
+
+	vmovdqa	80-32(%rax),%xmm6
+	vpxor	%xmm0,%xmm6,%xmm6
+	vmovdqu	80-32(%rcx),%xmm5
+
+	vpclmulqdq	$0x01,%xmm5,%xmm6,%xmm4
+	vpxor	%xmm4,%xmm1,%xmm1
+	vpclmulqdq	$0x11,%xmm5,%xmm6,%xmm4
+	vpxor	%xmm4,%xmm2,%xmm2
+	vpclmulqdq	$0x00,%xmm5,%xmm6,%xmm4
+	vpxor	%xmm4,%xmm3,%xmm3
+	vpclmulqdq	$0x10,%xmm5,%xmm6,%xmm4
+	vpxor	%xmm4,%xmm1,%xmm1
+
+	vmovdqu	128(%r8),%xmm4
+	vaesenc	%xmm4,%xmm7,%xmm7
+	vaesenc	%xmm4,%xmm8,%xmm8
+	vaesenc	%xmm4,%xmm9,%xmm9
+	vaesenc	%xmm4,%xmm10,%xmm10
+	vaesenc	%xmm4,%xmm11,%xmm11
+	vaesenc	%xmm4,%xmm12,%xmm12
+
+
+	vpsrldq	$8,%xmm1,%xmm4
+	vpxor	%xmm4,%xmm2,%xmm5
+	vpslldq	$8,%xmm1,%xmm4
+	vpxor	%xmm4,%xmm3,%xmm0
+
+	vmovdqa	poly(%rip),%xmm3
+
+	vmovdqu	144(%r8),%xmm4
+	vaesenc	%xmm4,%xmm7,%xmm7
+	vaesenc	%xmm4,%xmm8,%xmm8
+	vaesenc	%xmm4,%xmm9,%xmm9
+	vaesenc	%xmm4,%xmm10,%xmm10
+	vaesenc	%xmm4,%xmm11,%xmm11
+	vaesenc	%xmm4,%xmm12,%xmm12
+
+	vmovdqu	160(%r8),%xmm4
+	vaesenc	%xmm4,%xmm7,%xmm7
+	vaesenc	%xmm4,%xmm8,%xmm8
+	vaesenc	%xmm4,%xmm9,%xmm9
+	vaesenc	%xmm4,%xmm10,%xmm10
+	vaesenc	%xmm4,%xmm11,%xmm11
+	vaesenc	%xmm4,%xmm12,%xmm12
+
+	vmovdqu	176(%r8),%xmm4
+	vaesenc	%xmm4,%xmm7,%xmm7
+	vaesenc	%xmm4,%xmm8,%xmm8
+	vaesenc	%xmm4,%xmm9,%xmm9
+	vaesenc	%xmm4,%xmm10,%xmm10
+	vaesenc	%xmm4,%xmm11,%xmm11
+	vaesenc	%xmm4,%xmm12,%xmm12
+
+	vmovdqu	192(%r8),%xmm4
+	vaesenc	%xmm4,%xmm7,%xmm7
+	vaesenc	%xmm4,%xmm8,%xmm8
+	vaesenc	%xmm4,%xmm9,%xmm9
+	vaesenc	%xmm4,%xmm10,%xmm10
+	vaesenc	%xmm4,%xmm11,%xmm11
+	vaesenc	%xmm4,%xmm12,%xmm12
+
+	vmovdqu	208(%r8),%xmm4
+	vaesenc	%xmm4,%xmm7,%xmm7
+	vaesenc	%xmm4,%xmm8,%xmm8
+	vaesenc	%xmm4,%xmm9,%xmm9
+	vaesenc	%xmm4,%xmm10,%xmm10
+	vaesenc	%xmm4,%xmm11,%xmm11
+	vaesenc	%xmm4,%xmm12,%xmm12
+
+	vmovdqu	224(%r8),%xmm6
+	vpalignr	$8,%xmm0,%xmm0,%xmm2
+	vpclmulqdq	$0x10,%xmm3,%xmm0,%xmm0
+	vpxor	%xmm0,%xmm2,%xmm0
+
+	vpxor	0(%rdi),%xmm6,%xmm4
+	vaesenclast	%xmm4,%xmm7,%xmm7
+	vpxor	16(%rdi),%xmm6,%xmm4
+	vaesenclast	%xmm4,%xmm8,%xmm8
+	vpxor	32(%rdi),%xmm6,%xmm4
+	vaesenclast	%xmm4,%xmm9,%xmm9
+	vpxor	48(%rdi),%xmm6,%xmm4
+	vaesenclast	%xmm4,%xmm10,%xmm10
+	vpxor	64(%rdi),%xmm6,%xmm4
+	vaesenclast	%xmm4,%xmm11,%xmm11
+	vpxor	80(%rdi),%xmm6,%xmm4
+	vaesenclast	%xmm4,%xmm12,%xmm12
+
+	vpalignr	$8,%xmm0,%xmm0,%xmm2
+	vpclmulqdq	$0x10,%xmm3,%xmm0,%xmm0
+	vpxor	%xmm0,%xmm2,%xmm0
+
+	vmovdqu	%xmm7,0(%rsi)
+	vmovdqu	%xmm8,16(%rsi)
+	vmovdqu	%xmm9,32(%rsi)
+	vmovdqu	%xmm10,48(%rsi)
+	vmovdqu	%xmm11,64(%rsi)
+	vmovdqu	%xmm12,80(%rsi)
+
+	vpxor	%xmm5,%xmm0,%xmm0
+
+	leaq	96(%rdi),%rdi
+	leaq	96(%rsi),%rsi
+	jmp	.L256_dec_loop1
+
+.L256_dec_finish_96:
+	vmovdqa	%xmm12,%xmm6
+	vmovdqa	%xmm11,16-32(%rax)
+	vmovdqa	%xmm10,32-32(%rax)
+	vmovdqa	%xmm9,48-32(%rax)
+	vmovdqa	%xmm8,64-32(%rax)
+	vmovdqa	%xmm7,80-32(%rax)
+
+	vmovdqu	0-32(%rcx),%xmm4
+	vpclmulqdq	$0x10,%xmm4,%xmm6,%xmm1
+	vpclmulqdq	$0x11,%xmm4,%xmm6,%xmm2
+	vpclmulqdq	$0x00,%xmm4,%xmm6,%xmm3
+	vpclmulqdq	$0x01,%xmm4,%xmm6,%xmm4
+	vpxor	%xmm4,%xmm1,%xmm1
+
+	vmovdqu	-16(%rax),%xmm6
+	vmovdqu	-16(%rcx),%xmm13
+
+	vpclmulqdq	$0x10,%xmm13,%xmm6,%xmm4
+	vpxor	%xmm4,%xmm1,%xmm1
+	vpclmulqdq	$0x11,%xmm13,%xmm6,%xmm4
+	vpxor	%xmm4,%xmm2,%xmm2
+	vpclmulqdq	$0x00,%xmm13,%xmm6,%xmm4
+	vpxor	%xmm4,%xmm3,%xmm3
+	vpclmulqdq	$0x01,%xmm13,%xmm6,%xmm4
+	vpxor	%xmm4,%xmm1,%xmm1
+
+	vmovdqu	0(%rax),%xmm6
+	vmovdqu	0(%rcx),%xmm13
+
+	vpclmulqdq	$0x10,%xmm13,%xmm6,%xmm4
+	vpxor	%xmm4,%xmm1,%xmm1
+	vpclmulqdq	$0x11,%xmm13,%xmm6,%xmm4
+	vpxor	%xmm4,%xmm2,%xmm2
+	vpclmulqdq	$0x00,%xmm13,%xmm6,%xmm4
+	vpxor	%xmm4,%xmm3,%xmm3
+	vpclmulqdq	$0x01,%xmm13,%xmm6,%xmm4
+	vpxor	%xmm4,%xmm1,%xmm1
+
+	vmovdqu	16(%rax),%xmm6
+	vmovdqu	16(%rcx),%xmm13
+
+	vpclmulqdq	$0x10,%xmm13,%xmm6,%xmm4
+	vpxor	%xmm4,%xmm1,%xmm1
+	vpclmulqdq	$0x11,%xmm13,%xmm6,%xmm4
+	vpxor	%xmm4,%xmm2,%xmm2
+	vpclmulqdq	$0x00,%xmm13,%xmm6,%xmm4
+	vpxor	%xmm4,%xmm3,%xmm3
+	vpclmulqdq	$0x01,%xmm13,%xmm6,%xmm4
+	vpxor	%xmm4,%xmm1,%xmm1
+
+	vmovdqu	32(%rax),%xmm6
+	vmovdqu	32(%rcx),%xmm13
+
+	vpclmulqdq	$0x10,%xmm13,%xmm6,%xmm4
+	vpxor	%xmm4,%xmm1,%xmm1
+	vpclmulqdq	$0x11,%xmm13,%xmm6,%xmm4
+	vpxor	%xmm4,%xmm2,%xmm2
+	vpclmulqdq	$0x00,%xmm13,%xmm6,%xmm4
+	vpxor	%xmm4,%xmm3,%xmm3
+	vpclmulqdq	$0x01,%xmm13,%xmm6,%xmm4
+	vpxor	%xmm4,%xmm1,%xmm1
+
+
+	vmovdqu	80-32(%rax),%xmm6
+	vpxor	%xmm0,%xmm6,%xmm6
+	vmovdqu	80-32(%rcx),%xmm5
+	vpclmulqdq	$0x11,%xmm5,%xmm6,%xmm4
+	vpxor	%xmm4,%xmm2,%xmm2
+	vpclmulqdq	$0x00,%xmm5,%xmm6,%xmm4
+	vpxor	%xmm4,%xmm3,%xmm3
+	vpclmulqdq	$0x10,%xmm5,%xmm6,%xmm4
+	vpxor	%xmm4,%xmm1,%xmm1
+	vpclmulqdq	$0x01,%xmm5,%xmm6,%xmm4
+	vpxor	%xmm4,%xmm1,%xmm1
+
+	vpsrldq	$8,%xmm1,%xmm4
+	vpxor	%xmm4,%xmm2,%xmm5
+	vpslldq	$8,%xmm1,%xmm4
+	vpxor	%xmm4,%xmm3,%xmm0
+
+	vmovdqa	poly(%rip),%xmm3
+
+	vpalignr	$8,%xmm0,%xmm0,%xmm2
+	vpclmulqdq	$0x10,%xmm3,%xmm0,%xmm0
+	vpxor	%xmm0,%xmm2,%xmm0
+
+	vpalignr	$8,%xmm0,%xmm0,%xmm2
+	vpclmulqdq	$0x10,%xmm3,%xmm0,%xmm0
+	vpxor	%xmm0,%xmm2,%xmm0
+
+	vpxor	%xmm5,%xmm0,%xmm0
+
+.L256_dec_loop2:
+
+
+
+	cmpq	$16,%r9
+	jb	.L256_dec_out
+	subq	$16,%r9
+
+	vmovdqa	%xmm15,%xmm2
+	vpaddd	one(%rip),%xmm15,%xmm15
+
+	vpxor	0(%r8),%xmm2,%xmm2
+	vaesenc	16(%r8),%xmm2,%xmm2
+	vaesenc	32(%r8),%xmm2,%xmm2
+	vaesenc	48(%r8),%xmm2,%xmm2
+	vaesenc	64(%r8),%xmm2,%xmm2
+	vaesenc	80(%r8),%xmm2,%xmm2
+	vaesenc	96(%r8),%xmm2,%xmm2
+	vaesenc	112(%r8),%xmm2,%xmm2
+	vaesenc	128(%r8),%xmm2,%xmm2
+	vaesenc	144(%r8),%xmm2,%xmm2
+	vaesenc	160(%r8),%xmm2,%xmm2
+	vaesenc	176(%r8),%xmm2,%xmm2
+	vaesenc	192(%r8),%xmm2,%xmm2
+	vaesenc	208(%r8),%xmm2,%xmm2
+	vaesenclast	224(%r8),%xmm2,%xmm2
+	vpxor	(%rdi),%xmm2,%xmm2
+	vmovdqu	%xmm2,(%rsi)
+	addq	$16,%rdi
+	addq	$16,%rsi
+
+	vpxor	%xmm2,%xmm0,%xmm0
+	vmovdqa	-32(%rcx),%xmm1
+	call	GFMUL
+
+	jmp	.L256_dec_loop2
+
+.L256_dec_out:
+	vmovdqu	%xmm0,(%rdx)
+	.byte	0xf3,0xc3
+.cfi_endproc	
+.size	aes256gcmsiv_dec, .-aes256gcmsiv_dec
+.globl	aes256gcmsiv_kdf
+.hidden aes256gcmsiv_kdf
+.type	aes256gcmsiv_kdf,@function
+.align	16
+aes256gcmsiv_kdf:
+.cfi_startproc	
+
+
+
+
+	vmovdqa	(%rdx),%xmm1
+	vmovdqa	0(%rdi),%xmm4
+	vmovdqa	and_mask(%rip),%xmm11
+	vmovdqa	one(%rip),%xmm8
+	vpshufd	$0x90,%xmm4,%xmm4
+	vpand	%xmm11,%xmm4,%xmm4
+	vpaddd	%xmm8,%xmm4,%xmm6
+	vpaddd	%xmm8,%xmm6,%xmm7
+	vpaddd	%xmm8,%xmm7,%xmm11
+	vpaddd	%xmm8,%xmm11,%xmm12
+	vpaddd	%xmm8,%xmm12,%xmm13
+
+	vpxor	%xmm1,%xmm4,%xmm4
+	vpxor	%xmm1,%xmm6,%xmm6
+	vpxor	%xmm1,%xmm7,%xmm7
+	vpxor	%xmm1,%xmm11,%xmm11
+	vpxor	%xmm1,%xmm12,%xmm12
+	vpxor	%xmm1,%xmm13,%xmm13
+
+	vmovdqa	16(%rdx),%xmm1
+	vaesenc	%xmm1,%xmm4,%xmm4
+	vaesenc	%xmm1,%xmm6,%xmm6
+	vaesenc	%xmm1,%xmm7,%xmm7
+	vaesenc	%xmm1,%xmm11,%xmm11
+	vaesenc	%xmm1,%xmm12,%xmm12
+	vaesenc	%xmm1,%xmm13,%xmm13
+
+	vmovdqa	32(%rdx),%xmm2
+	vaesenc	%xmm2,%xmm4,%xmm4
+	vaesenc	%xmm2,%xmm6,%xmm6
+	vaesenc	%xmm2,%xmm7,%xmm7
+	vaesenc	%xmm2,%xmm11,%xmm11
+	vaesenc	%xmm2,%xmm12,%xmm12
+	vaesenc	%xmm2,%xmm13,%xmm13
+
+	vmovdqa	48(%rdx),%xmm1
+	vaesenc	%xmm1,%xmm4,%xmm4
+	vaesenc	%xmm1,%xmm6,%xmm6
+	vaesenc	%xmm1,%xmm7,%xmm7
+	vaesenc	%xmm1,%xmm11,%xmm11
+	vaesenc	%xmm1,%xmm12,%xmm12
+	vaesenc	%xmm1,%xmm13,%xmm13
+
+	vmovdqa	64(%rdx),%xmm2
+	vaesenc	%xmm2,%xmm4,%xmm4
+	vaesenc	%xmm2,%xmm6,%xmm6
+	vaesenc	%xmm2,%xmm7,%xmm7
+	vaesenc	%xmm2,%xmm11,%xmm11
+	vaesenc	%xmm2,%xmm12,%xmm12
+	vaesenc	%xmm2,%xmm13,%xmm13
+
+	vmovdqa	80(%rdx),%xmm1
+	vaesenc	%xmm1,%xmm4,%xmm4
+	vaesenc	%xmm1,%xmm6,%xmm6
+	vaesenc	%xmm1,%xmm7,%xmm7
+	vaesenc	%xmm1,%xmm11,%xmm11
+	vaesenc	%xmm1,%xmm12,%xmm12
+	vaesenc	%xmm1,%xmm13,%xmm13
+
+	vmovdqa	96(%rdx),%xmm2
+	vaesenc	%xmm2,%xmm4,%xmm4
+	vaesenc	%xmm2,%xmm6,%xmm6
+	vaesenc	%xmm2,%xmm7,%xmm7
+	vaesenc	%xmm2,%xmm11,%xmm11
+	vaesenc	%xmm2,%xmm12,%xmm12
+	vaesenc	%xmm2,%xmm13,%xmm13
+
+	vmovdqa	112(%rdx),%xmm1
+	vaesenc	%xmm1,%xmm4,%xmm4
+	vaesenc	%xmm1,%xmm6,%xmm6
+	vaesenc	%xmm1,%xmm7,%xmm7
+	vaesenc	%xmm1,%xmm11,%xmm11
+	vaesenc	%xmm1,%xmm12,%xmm12
+	vaesenc	%xmm1,%xmm13,%xmm13
+
+	vmovdqa	128(%rdx),%xmm2
+	vaesenc	%xmm2,%xmm4,%xmm4
+	vaesenc	%xmm2,%xmm6,%xmm6
+	vaesenc	%xmm2,%xmm7,%xmm7
+	vaesenc	%xmm2,%xmm11,%xmm11
+	vaesenc	%xmm2,%xmm12,%xmm12
+	vaesenc	%xmm2,%xmm13,%xmm13
+
+	vmovdqa	144(%rdx),%xmm1
+	vaesenc	%xmm1,%xmm4,%xmm4
+	vaesenc	%xmm1,%xmm6,%xmm6
+	vaesenc	%xmm1,%xmm7,%xmm7
+	vaesenc	%xmm1,%xmm11,%xmm11
+	vaesenc	%xmm1,%xmm12,%xmm12
+	vaesenc	%xmm1,%xmm13,%xmm13
+
+	vmovdqa	160(%rdx),%xmm2
+	vaesenc	%xmm2,%xmm4,%xmm4
+	vaesenc	%xmm2,%xmm6,%xmm6
+	vaesenc	%xmm2,%xmm7,%xmm7
+	vaesenc	%xmm2,%xmm11,%xmm11
+	vaesenc	%xmm2,%xmm12,%xmm12
+	vaesenc	%xmm2,%xmm13,%xmm13
+
+	vmovdqa	176(%rdx),%xmm1
+	vaesenc	%xmm1,%xmm4,%xmm4
+	vaesenc	%xmm1,%xmm6,%xmm6
+	vaesenc	%xmm1,%xmm7,%xmm7
+	vaesenc	%xmm1,%xmm11,%xmm11
+	vaesenc	%xmm1,%xmm12,%xmm12
+	vaesenc	%xmm1,%xmm13,%xmm13
+
+	vmovdqa	192(%rdx),%xmm2
+	vaesenc	%xmm2,%xmm4,%xmm4
+	vaesenc	%xmm2,%xmm6,%xmm6
+	vaesenc	%xmm2,%xmm7,%xmm7
+	vaesenc	%xmm2,%xmm11,%xmm11
+	vaesenc	%xmm2,%xmm12,%xmm12
+	vaesenc	%xmm2,%xmm13,%xmm13
+
+	vmovdqa	208(%rdx),%xmm1
+	vaesenc	%xmm1,%xmm4,%xmm4
+	vaesenc	%xmm1,%xmm6,%xmm6
+	vaesenc	%xmm1,%xmm7,%xmm7
+	vaesenc	%xmm1,%xmm11,%xmm11
+	vaesenc	%xmm1,%xmm12,%xmm12
+	vaesenc	%xmm1,%xmm13,%xmm13
+
+	vmovdqa	224(%rdx),%xmm2
+	vaesenclast	%xmm2,%xmm4,%xmm4
+	vaesenclast	%xmm2,%xmm6,%xmm6
+	vaesenclast	%xmm2,%xmm7,%xmm7
+	vaesenclast	%xmm2,%xmm11,%xmm11
+	vaesenclast	%xmm2,%xmm12,%xmm12
+	vaesenclast	%xmm2,%xmm13,%xmm13
+
+
+	vmovdqa	%xmm4,0(%rsi)
+	vmovdqa	%xmm6,16(%rsi)
+	vmovdqa	%xmm7,32(%rsi)
+	vmovdqa	%xmm11,48(%rsi)
+	vmovdqa	%xmm12,64(%rsi)
+	vmovdqa	%xmm13,80(%rsi)
+	.byte	0xf3,0xc3
+.cfi_endproc	
+.size	aes256gcmsiv_kdf, .-aes256gcmsiv_kdf
+#endif
diff --git a/third_party/boringssl/linux-x86_64/crypto/cipher/chacha20_poly1305_x86_64.S b/third_party/boringssl/linux-x86_64/crypto/cipher_extra/chacha20_poly1305_x86_64.S
similarity index 100%
rename from third_party/boringssl/linux-x86_64/crypto/cipher/chacha20_poly1305_x86_64.S
rename to third_party/boringssl/linux-x86_64/crypto/cipher_extra/chacha20_poly1305_x86_64.S
diff --git a/third_party/boringssl/linux-x86_64/crypto/ec/p256-x86_64-asm.S b/third_party/boringssl/linux-x86_64/crypto/fipsmodule/p256-x86_64-asm.S
similarity index 100%
rename from third_party/boringssl/linux-x86_64/crypto/ec/p256-x86_64-asm.S
rename to third_party/boringssl/linux-x86_64/crypto/fipsmodule/p256-x86_64-asm.S
diff --git a/third_party/boringssl/mac-x86_64/crypto/cipher_extra/aes128gcmsiv-x86_64.S b/third_party/boringssl/mac-x86_64/crypto/cipher_extra/aes128gcmsiv-x86_64.S
new file mode 100644
index 0000000..e9e11a0
--- /dev/null
+++ b/third_party/boringssl/mac-x86_64/crypto/cipher_extra/aes128gcmsiv-x86_64.S
@@ -0,0 +1,3056 @@
+#if defined(__x86_64__) && !defined(OPENSSL_NO_ASM)
+.data	
+
+.p2align	4
+one:
+.quad	1,0
+two:
+.quad	2,0
+three:
+.quad	3,0
+four:
+.quad	4,0
+five:
+.quad	5,0
+six:
+.quad	6,0
+seven:
+.quad	7,0
+eight:
+.quad	8,0
+
+OR_MASK:
+.long	0x00000000,0x00000000,0x00000000,0x80000000
+poly:
+.quad	0x1, 0xc200000000000000
+mask:
+.long	0x0c0f0e0d,0x0c0f0e0d,0x0c0f0e0d,0x0c0f0e0d
+con1:
+.long	1,1,1,1
+con2:
+.long	0x1b,0x1b,0x1b,0x1b
+con3:
+.byte	-1,-1,-1,-1,-1,-1,-1,-1,4,5,6,7,4,5,6,7
+and_mask:
+.long	0,0xffffffff, 0xffffffff, 0xffffffff
+.text	
+
+.p2align	4
+GFMUL:
+
+	vpclmulqdq	$0x00,%xmm1,%xmm0,%xmm2
+	vpclmulqdq	$0x11,%xmm1,%xmm0,%xmm5
+	vpclmulqdq	$0x10,%xmm1,%xmm0,%xmm3
+	vpclmulqdq	$0x01,%xmm1,%xmm0,%xmm4
+	vpxor	%xmm4,%xmm3,%xmm3
+	vpslldq	$8,%xmm3,%xmm4
+	vpsrldq	$8,%xmm3,%xmm3
+	vpxor	%xmm4,%xmm2,%xmm2
+	vpxor	%xmm3,%xmm5,%xmm5
+
+	vpclmulqdq	$0x10,poly(%rip),%xmm2,%xmm3
+	vpshufd	$78,%xmm2,%xmm4
+	vpxor	%xmm4,%xmm3,%xmm2
+
+	vpclmulqdq	$0x10,poly(%rip),%xmm2,%xmm3
+	vpshufd	$78,%xmm2,%xmm4
+	vpxor	%xmm4,%xmm3,%xmm2
+
+	vpxor	%xmm5,%xmm2,%xmm0
+	.byte	0xf3,0xc3
+
+
+.globl	_aesgcmsiv_htable_init
+.private_extern _aesgcmsiv_htable_init
+
+.p2align	4
+_aesgcmsiv_htable_init:
+
+	vmovdqa	(%rsi),%xmm0
+	vmovdqa	%xmm0,%xmm1
+	vmovdqa	%xmm0,(%rdi)
+	call	GFMUL
+	vmovdqa	%xmm0,16(%rdi)
+	call	GFMUL
+	vmovdqa	%xmm0,32(%rdi)
+	call	GFMUL
+	vmovdqa	%xmm0,48(%rdi)
+	call	GFMUL
+	vmovdqa	%xmm0,64(%rdi)
+	call	GFMUL
+	vmovdqa	%xmm0,80(%rdi)
+	call	GFMUL
+	vmovdqa	%xmm0,96(%rdi)
+	call	GFMUL
+	vmovdqa	%xmm0,112(%rdi)
+	.byte	0xf3,0xc3
+
+
+.globl	_aesgcmsiv_htable6_init
+.private_extern _aesgcmsiv_htable6_init
+
+.p2align	4
+_aesgcmsiv_htable6_init:
+
+	vmovdqa	(%rsi),%xmm0
+	vmovdqa	%xmm0,%xmm1
+	vmovdqa	%xmm0,(%rdi)
+	call	GFMUL
+	vmovdqa	%xmm0,16(%rdi)
+	call	GFMUL
+	vmovdqa	%xmm0,32(%rdi)
+	call	GFMUL
+	vmovdqa	%xmm0,48(%rdi)
+	call	GFMUL
+	vmovdqa	%xmm0,64(%rdi)
+	call	GFMUL
+	vmovdqa	%xmm0,80(%rdi)
+	.byte	0xf3,0xc3
+
+
+.globl	_aesgcmsiv_htable_polyval
+.private_extern _aesgcmsiv_htable_polyval
+
+.p2align	4
+_aesgcmsiv_htable_polyval:
+
+	testq	%rdx,%rdx
+	jnz	L$htable_polyval_start
+	.byte	0xf3,0xc3
+
+L$htable_polyval_start:
+	vzeroall
+
+
+
+	movq	%rdx,%r11
+	andq	$127,%r11
+
+	jz	L$htable_polyval_no_prefix
+
+	vpxor	%xmm9,%xmm9,%xmm9
+	vmovdqa	(%rcx),%xmm1
+	subq	%r11,%rdx
+
+	subq	$16,%r11
+
+
+	vmovdqu	(%rsi),%xmm0
+	vpxor	%xmm1,%xmm0,%xmm0
+
+	vpclmulqdq	$0x01,(%rdi,%r11,1),%xmm0,%xmm5
+	vpclmulqdq	$0x00,(%rdi,%r11,1),%xmm0,%xmm3
+	vpclmulqdq	$0x11,(%rdi,%r11,1),%xmm0,%xmm4
+	vpclmulqdq	$0x10,(%rdi,%r11,1),%xmm0,%xmm6
+	vpxor	%xmm6,%xmm5,%xmm5
+
+	leaq	16(%rsi),%rsi
+	testq	%r11,%r11
+	jnz	L$htable_polyval_prefix_loop
+	jmp	L$htable_polyval_prefix_complete
+
+
+.p2align	6
+L$htable_polyval_prefix_loop:
+	subq	$16,%r11
+
+	vmovdqu	(%rsi),%xmm0
+
+	vpclmulqdq	$0x00,(%rdi,%r11,1),%xmm0,%xmm6
+	vpxor	%xmm6,%xmm3,%xmm3
+	vpclmulqdq	$0x11,(%rdi,%r11,1),%xmm0,%xmm6
+	vpxor	%xmm6,%xmm4,%xmm4
+	vpclmulqdq	$0x01,(%rdi,%r11,1),%xmm0,%xmm6
+	vpxor	%xmm6,%xmm5,%xmm5
+	vpclmulqdq	$0x10,(%rdi,%r11,1),%xmm0,%xmm6
+	vpxor	%xmm6,%xmm5,%xmm5
+
+	testq	%r11,%r11
+
+	leaq	16(%rsi),%rsi
+
+	jnz	L$htable_polyval_prefix_loop
+
+L$htable_polyval_prefix_complete:
+	vpsrldq	$8,%xmm5,%xmm6
+	vpslldq	$8,%xmm5,%xmm5
+
+	vpxor	%xmm6,%xmm4,%xmm9
+	vpxor	%xmm5,%xmm3,%xmm1
+
+	jmp	L$htable_polyval_main_loop
+
+L$htable_polyval_no_prefix:
+
+
+
+
+	vpxor	%xmm1,%xmm1,%xmm1
+	vmovdqa	(%rcx),%xmm9
+
+.p2align	6
+L$htable_polyval_main_loop:
+	subq	$0x80,%rdx
+	jb	L$htable_polyval_out
+
+	vmovdqu	112(%rsi),%xmm0
+
+	vpclmulqdq	$0x01,(%rdi),%xmm0,%xmm5
+	vpclmulqdq	$0x00,(%rdi),%xmm0,%xmm3
+	vpclmulqdq	$0x11,(%rdi),%xmm0,%xmm4
+	vpclmulqdq	$0x10,(%rdi),%xmm0,%xmm6
+	vpxor	%xmm6,%xmm5,%xmm5
+
+
+	vmovdqu	96(%rsi),%xmm0
+	vpclmulqdq	$0x01,16(%rdi),%xmm0,%xmm6
+	vpxor	%xmm6,%xmm5,%xmm5
+	vpclmulqdq	$0x00,16(%rdi),%xmm0,%xmm6
+	vpxor	%xmm6,%xmm3,%xmm3
+	vpclmulqdq	$0x11,16(%rdi),%xmm0,%xmm6
+	vpxor	%xmm6,%xmm4,%xmm4
+	vpclmulqdq	$0x10,16(%rdi),%xmm0,%xmm6
+	vpxor	%xmm6,%xmm5,%xmm5
+
+
+
+	vmovdqu	80(%rsi),%xmm0
+
+	vpclmulqdq	$0x10,poly(%rip),%xmm1,%xmm7
+	vpalignr	$8,%xmm1,%xmm1,%xmm1
+
+	vpclmulqdq	$0x01,32(%rdi),%xmm0,%xmm6
+	vpxor	%xmm6,%xmm5,%xmm5
+	vpclmulqdq	$0x00,32(%rdi),%xmm0,%xmm6
+	vpxor	%xmm6,%xmm3,%xmm3
+	vpclmulqdq	$0x11,32(%rdi),%xmm0,%xmm6
+	vpxor	%xmm6,%xmm4,%xmm4
+	vpclmulqdq	$0x10,32(%rdi),%xmm0,%xmm6
+	vpxor	%xmm6,%xmm5,%xmm5
+
+
+	vpxor	%xmm7,%xmm1,%xmm1
+
+	vmovdqu	64(%rsi),%xmm0
+
+	vpclmulqdq	$0x01,48(%rdi),%xmm0,%xmm6
+	vpxor	%xmm6,%xmm5,%xmm5
+	vpclmulqdq	$0x00,48(%rdi),%xmm0,%xmm6
+	vpxor	%xmm6,%xmm3,%xmm3
+	vpclmulqdq	$0x11,48(%rdi),%xmm0,%xmm6
+	vpxor	%xmm6,%xmm4,%xmm4
+	vpclmulqdq	$0x10,48(%rdi),%xmm0,%xmm6
+	vpxor	%xmm6,%xmm5,%xmm5
+
+
+	vmovdqu	48(%rsi),%xmm0
+
+	vpclmulqdq	$0x10,poly(%rip),%xmm1,%xmm7
+	vpalignr	$8,%xmm1,%xmm1,%xmm1
+
+	vpclmulqdq	$0x01,64(%rdi),%xmm0,%xmm6
+	vpxor	%xmm6,%xmm5,%xmm5
+	vpclmulqdq	$0x00,64(%rdi),%xmm0,%xmm6
+	vpxor	%xmm6,%xmm3,%xmm3
+	vpclmulqdq	$0x11,64(%rdi),%xmm0,%xmm6
+	vpxor	%xmm6,%xmm4,%xmm4
+	vpclmulqdq	$0x10,64(%rdi),%xmm0,%xmm6
+	vpxor	%xmm6,%xmm5,%xmm5
+
+
+	vpxor	%xmm7,%xmm1,%xmm1
+
+	vmovdqu	32(%rsi),%xmm0
+
+	vpclmulqdq	$0x01,80(%rdi),%xmm0,%xmm6
+	vpxor	%xmm6,%xmm5,%xmm5
+	vpclmulqdq	$0x00,80(%rdi),%xmm0,%xmm6
+	vpxor	%xmm6,%xmm3,%xmm3
+	vpclmulqdq	$0x11,80(%rdi),%xmm0,%xmm6
+	vpxor	%xmm6,%xmm4,%xmm4
+	vpclmulqdq	$0x10,80(%rdi),%xmm0,%xmm6
+	vpxor	%xmm6,%xmm5,%xmm5
+
+
+	vpxor	%xmm9,%xmm1,%xmm1
+
+	vmovdqu	16(%rsi),%xmm0
+
+	vpclmulqdq	$0x01,96(%rdi),%xmm0,%xmm6
+	vpxor	%xmm6,%xmm5,%xmm5
+	vpclmulqdq	$0x00,96(%rdi),%xmm0,%xmm6
+	vpxor	%xmm6,%xmm3,%xmm3
+	vpclmulqdq	$0x11,96(%rdi),%xmm0,%xmm6
+	vpxor	%xmm6,%xmm4,%xmm4
+	vpclmulqdq	$0x10,96(%rdi),%xmm0,%xmm6
+	vpxor	%xmm6,%xmm5,%xmm5
+
+
+	vmovdqu	0(%rsi),%xmm0
+	vpxor	%xmm1,%xmm0,%xmm0
+
+	vpclmulqdq	$0x01,112(%rdi),%xmm0,%xmm6
+	vpxor	%xmm6,%xmm5,%xmm5
+	vpclmulqdq	$0x00,112(%rdi),%xmm0,%xmm6
+	vpxor	%xmm6,%xmm3,%xmm3
+	vpclmulqdq	$0x11,112(%rdi),%xmm0,%xmm6
+	vpxor	%xmm6,%xmm4,%xmm4
+	vpclmulqdq	$0x10,112(%rdi),%xmm0,%xmm6
+	vpxor	%xmm6,%xmm5,%xmm5
+
+
+	vpsrldq	$8,%xmm5,%xmm6
+	vpslldq	$8,%xmm5,%xmm5
+
+	vpxor	%xmm6,%xmm4,%xmm9
+	vpxor	%xmm5,%xmm3,%xmm1
+
+	leaq	128(%rsi),%rsi
+	jmp	L$htable_polyval_main_loop
+
+
+
+L$htable_polyval_out:
+	vpclmulqdq	$0x10,poly(%rip),%xmm1,%xmm6
+	vpalignr	$8,%xmm1,%xmm1,%xmm1
+	vpxor	%xmm6,%xmm1,%xmm1
+
+	vpclmulqdq	$0x10,poly(%rip),%xmm1,%xmm6
+	vpalignr	$8,%xmm1,%xmm1,%xmm1
+	vpxor	%xmm6,%xmm1,%xmm1
+	vpxor	%xmm9,%xmm1,%xmm1
+
+	vmovdqu	%xmm1,(%rcx)
+	vzeroupper
+	.byte	0xf3,0xc3
+
+
+.globl	_aesgcmsiv_polyval_horner
+.private_extern _aesgcmsiv_polyval_horner
+
+.p2align	4
+_aesgcmsiv_polyval_horner:
+
+	testq	%rcx,%rcx
+	jnz	L$polyval_horner_start
+	.byte	0xf3,0xc3
+
+L$polyval_horner_start:
+
+
+
+	xorq	%r10,%r10
+	shlq	$4,%rcx
+
+	vmovdqa	(%rsi),%xmm1
+	vmovdqa	(%rdi),%xmm0
+
+L$polyval_horner_loop:
+	vpxor	(%rdx,%r10,1),%xmm0,%xmm0
+	call	GFMUL
+
+	addq	$16,%r10
+	cmpq	%r10,%rcx
+	jne	L$polyval_horner_loop
+
+
+	vmovdqa	%xmm0,(%rdi)
+	.byte	0xf3,0xc3
+
+
+.globl	_aes128gcmsiv_aes_ks
+.private_extern _aes128gcmsiv_aes_ks
+
+.p2align	4
+_aes128gcmsiv_aes_ks:
+
+	vmovdqa	(%rdi),%xmm1
+	vmovdqa	%xmm1,(%rsi)
+
+	vmovdqa	con1(%rip),%xmm0
+	vmovdqa	mask(%rip),%xmm15
+
+	movq	$8,%rax
+
+L$ks128_loop:
+	addq	$16,%rsi
+	subq	$1,%rax
+	vpshufb	%xmm15,%xmm1,%xmm2
+	vaesenclast	%xmm0,%xmm2,%xmm2
+	vpslld	$1,%xmm0,%xmm0
+	vpslldq	$4,%xmm1,%xmm3
+	vpxor	%xmm3,%xmm1,%xmm1
+	vpslldq	$4,%xmm3,%xmm3
+	vpxor	%xmm3,%xmm1,%xmm1
+	vpslldq	$4,%xmm3,%xmm3
+	vpxor	%xmm3,%xmm1,%xmm1
+	vpxor	%xmm2,%xmm1,%xmm1
+	vmovdqa	%xmm1,(%rsi)
+	jne	L$ks128_loop
+
+	vmovdqa	con2(%rip),%xmm0
+	vpshufb	%xmm15,%xmm1,%xmm2
+	vaesenclast	%xmm0,%xmm2,%xmm2
+	vpslld	$1,%xmm0,%xmm0
+	vpslldq	$4,%xmm1,%xmm3
+	vpxor	%xmm3,%xmm1,%xmm1
+	vpslldq	$4,%xmm3,%xmm3
+	vpxor	%xmm3,%xmm1,%xmm1
+	vpslldq	$4,%xmm3,%xmm3
+	vpxor	%xmm3,%xmm1,%xmm1
+	vpxor	%xmm2,%xmm1,%xmm1
+	vmovdqa	%xmm1,16(%rsi)
+
+	vpshufb	%xmm15,%xmm1,%xmm2
+	vaesenclast	%xmm0,%xmm2,%xmm2
+	vpslldq	$4,%xmm1,%xmm3
+	vpxor	%xmm3,%xmm1,%xmm1
+	vpslldq	$4,%xmm3,%xmm3
+	vpxor	%xmm3,%xmm1,%xmm1
+	vpslldq	$4,%xmm3,%xmm3
+	vpxor	%xmm3,%xmm1,%xmm1
+	vpxor	%xmm2,%xmm1,%xmm1
+	vmovdqa	%xmm1,32(%rsi)
+	.byte	0xf3,0xc3
+
+
+.globl	_aes256gcmsiv_aes_ks
+.private_extern _aes256gcmsiv_aes_ks
+
+.p2align	4
+_aes256gcmsiv_aes_ks:
+
+	vmovdqa	(%rdi),%xmm1
+	vmovdqa	16(%rdi),%xmm3
+	vmovdqa	%xmm1,(%rsi)
+	vmovdqa	%xmm3,16(%rsi)
+	vmovdqa	con1(%rip),%xmm0
+	vmovdqa	mask(%rip),%xmm15
+	vpxor	%xmm14,%xmm14,%xmm14
+	movq	$6,%rax
+
+L$ks256_loop:
+	addq	$32,%rsi
+	subq	$1,%rax
+	vpshufb	%xmm15,%xmm3,%xmm2
+	vaesenclast	%xmm0,%xmm2,%xmm2
+	vpslld	$1,%xmm0,%xmm0
+	vpsllq	$32,%xmm1,%xmm4
+	vpxor	%xmm4,%xmm1,%xmm1
+	vpshufb	con3(%rip),%xmm1,%xmm4
+	vpxor	%xmm4,%xmm1,%xmm1
+	vpxor	%xmm2,%xmm1,%xmm1
+	vmovdqa	%xmm1,(%rsi)
+	vpshufd	$0xff,%xmm1,%xmm2
+	vaesenclast	%xmm14,%xmm2,%xmm2
+	vpsllq	$32,%xmm3,%xmm4
+	vpxor	%xmm4,%xmm3,%xmm3
+	vpshufb	con3(%rip),%xmm3,%xmm4
+	vpxor	%xmm4,%xmm3,%xmm3
+	vpxor	%xmm2,%xmm3,%xmm3
+	vmovdqa	%xmm3,16(%rsi)
+	jne	L$ks256_loop
+
+	vpshufb	%xmm15,%xmm3,%xmm2
+	vaesenclast	%xmm0,%xmm2,%xmm2
+	vpsllq	$32,%xmm1,%xmm4
+	vpxor	%xmm4,%xmm1,%xmm1
+	vpshufb	con3(%rip),%xmm1,%xmm4
+	vpxor	%xmm4,%xmm1,%xmm1
+	vpxor	%xmm2,%xmm1,%xmm1
+	vmovdqa	%xmm1,32(%rsi)
+	.byte	0xf3,0xc3
+
+.globl	_aes128gcmsiv_aes_ks_enc_x1
+.private_extern _aes128gcmsiv_aes_ks_enc_x1
+
+.p2align	4
+_aes128gcmsiv_aes_ks_enc_x1:
+
+	vmovdqa	(%rcx),%xmm1
+	vmovdqa	0(%rdi),%xmm4
+
+	vmovdqa	%xmm1,(%rdx)
+	vpxor	%xmm1,%xmm4,%xmm4
+
+	vmovdqa	con1(%rip),%xmm0
+	vmovdqa	mask(%rip),%xmm15
+
+	vpshufb	%xmm15,%xmm1,%xmm2
+	vaesenclast	%xmm0,%xmm2,%xmm2
+	vpslld	$1,%xmm0,%xmm0
+	vpsllq	$32,%xmm1,%xmm3
+	vpxor	%xmm3,%xmm1,%xmm1
+	vpshufb	con3(%rip),%xmm1,%xmm3
+	vpxor	%xmm3,%xmm1,%xmm1
+	vpxor	%xmm2,%xmm1,%xmm1
+
+	vaesenc	%xmm1,%xmm4,%xmm4
+	vmovdqa	%xmm1,16(%rdx)
+
+	vpshufb	%xmm15,%xmm1,%xmm2
+	vaesenclast	%xmm0,%xmm2,%xmm2
+	vpslld	$1,%xmm0,%xmm0
+	vpsllq	$32,%xmm1,%xmm3
+	vpxor	%xmm3,%xmm1,%xmm1
+	vpshufb	con3(%rip),%xmm1,%xmm3
+	vpxor	%xmm3,%xmm1,%xmm1
+	vpxor	%xmm2,%xmm1,%xmm1
+
+	vaesenc	%xmm1,%xmm4,%xmm4
+	vmovdqa	%xmm1,32(%rdx)
+
+	vpshufb	%xmm15,%xmm1,%xmm2
+	vaesenclast	%xmm0,%xmm2,%xmm2
+	vpslld	$1,%xmm0,%xmm0
+	vpsllq	$32,%xmm1,%xmm3
+	vpxor	%xmm3,%xmm1,%xmm1
+	vpshufb	con3(%rip),%xmm1,%xmm3
+	vpxor	%xmm3,%xmm1,%xmm1
+	vpxor	%xmm2,%xmm1,%xmm1
+
+	vaesenc	%xmm1,%xmm4,%xmm4
+	vmovdqa	%xmm1,48(%rdx)
+
+	vpshufb	%xmm15,%xmm1,%xmm2
+	vaesenclast	%xmm0,%xmm2,%xmm2
+	vpslld	$1,%xmm0,%xmm0
+	vpsllq	$32,%xmm1,%xmm3
+	vpxor	%xmm3,%xmm1,%xmm1
+	vpshufb	con3(%rip),%xmm1,%xmm3
+	vpxor	%xmm3,%xmm1,%xmm1
+	vpxor	%xmm2,%xmm1,%xmm1
+
+	vaesenc	%xmm1,%xmm4,%xmm4
+	vmovdqa	%xmm1,64(%rdx)
+
+	vpshufb	%xmm15,%xmm1,%xmm2
+	vaesenclast	%xmm0,%xmm2,%xmm2
+	vpslld	$1,%xmm0,%xmm0
+	vpsllq	$32,%xmm1,%xmm3
+	vpxor	%xmm3,%xmm1,%xmm1
+	vpshufb	con3(%rip),%xmm1,%xmm3
+	vpxor	%xmm3,%xmm1,%xmm1
+	vpxor	%xmm2,%xmm1,%xmm1
+
+	vaesenc	%xmm1,%xmm4,%xmm4
+	vmovdqa	%xmm1,80(%rdx)
+
+	vpshufb	%xmm15,%xmm1,%xmm2
+	vaesenclast	%xmm0,%xmm2,%xmm2
+	vpslld	$1,%xmm0,%xmm0
+	vpsllq	$32,%xmm1,%xmm3
+	vpxor	%xmm3,%xmm1,%xmm1
+	vpshufb	con3(%rip),%xmm1,%xmm3
+	vpxor	%xmm3,%xmm1,%xmm1
+	vpxor	%xmm2,%xmm1,%xmm1
+
+	vaesenc	%xmm1,%xmm4,%xmm4
+	vmovdqa	%xmm1,96(%rdx)
+
+	vpshufb	%xmm15,%xmm1,%xmm2
+	vaesenclast	%xmm0,%xmm2,%xmm2
+	vpslld	$1,%xmm0,%xmm0
+	vpsllq	$32,%xmm1,%xmm3
+	vpxor	%xmm3,%xmm1,%xmm1
+	vpshufb	con3(%rip),%xmm1,%xmm3
+	vpxor	%xmm3,%xmm1,%xmm1
+	vpxor	%xmm2,%xmm1,%xmm1
+
+	vaesenc	%xmm1,%xmm4,%xmm4
+	vmovdqa	%xmm1,112(%rdx)
+
+	vpshufb	%xmm15,%xmm1,%xmm2
+	vaesenclast	%xmm0,%xmm2,%xmm2
+	vpslld	$1,%xmm0,%xmm0
+	vpsllq	$32,%xmm1,%xmm3
+	vpxor	%xmm3,%xmm1,%xmm1
+	vpshufb	con3(%rip),%xmm1,%xmm3
+	vpxor	%xmm3,%xmm1,%xmm1
+	vpxor	%xmm2,%xmm1,%xmm1
+
+	vaesenc	%xmm1,%xmm4,%xmm4
+	vmovdqa	%xmm1,128(%rdx)
+
+
+	vmovdqa	con2(%rip),%xmm0
+
+	vpshufb	%xmm15,%xmm1,%xmm2
+	vaesenclast	%xmm0,%xmm2,%xmm2
+	vpslld	$1,%xmm0,%xmm0
+	vpsllq	$32,%xmm1,%xmm3
+	vpxor	%xmm3,%xmm1,%xmm1
+	vpshufb	con3(%rip),%xmm1,%xmm3
+	vpxor	%xmm3,%xmm1,%xmm1
+	vpxor	%xmm2,%xmm1,%xmm1
+
+	vaesenc	%xmm1,%xmm4,%xmm4
+	vmovdqa	%xmm1,144(%rdx)
+
+	vpshufb	%xmm15,%xmm1,%xmm2
+	vaesenclast	%xmm0,%xmm2,%xmm2
+	vpsllq	$32,%xmm1,%xmm3
+	vpxor	%xmm3,%xmm1,%xmm1
+	vpshufb	con3(%rip),%xmm1,%xmm3
+	vpxor	%xmm3,%xmm1,%xmm1
+	vpxor	%xmm2,%xmm1,%xmm1
+
+	vaesenclast	%xmm1,%xmm4,%xmm4
+	vmovdqa	%xmm1,160(%rdx)
+
+
+	vmovdqa	%xmm4,0(%rsi)
+	.byte	0xf3,0xc3
+
+
+.globl	_aes128gcmsiv_kdf
+.private_extern _aes128gcmsiv_kdf
+
+.p2align	4
+_aes128gcmsiv_kdf:
+
+
+
+
+
+	vmovdqa	(%rdx),%xmm1
+	vmovdqa	0(%rdi),%xmm9
+	vmovdqa	and_mask(%rip),%xmm12
+	vmovdqa	one(%rip),%xmm13
+	vpshufd	$0x90,%xmm9,%xmm9
+	vpand	%xmm12,%xmm9,%xmm9
+	vpaddd	%xmm13,%xmm9,%xmm10
+	vpaddd	%xmm13,%xmm10,%xmm11
+	vpaddd	%xmm13,%xmm11,%xmm12
+
+	vpxor	%xmm1,%xmm9,%xmm9
+	vpxor	%xmm1,%xmm10,%xmm10
+	vpxor	%xmm1,%xmm11,%xmm11
+	vpxor	%xmm1,%xmm12,%xmm12
+
+	vmovdqa	16(%rdx),%xmm1
+	vaesenc	%xmm1,%xmm9,%xmm9
+	vaesenc	%xmm1,%xmm10,%xmm10
+	vaesenc	%xmm1,%xmm11,%xmm11
+	vaesenc	%xmm1,%xmm12,%xmm12
+
+	vmovdqa	32(%rdx),%xmm2
+	vaesenc	%xmm2,%xmm9,%xmm9
+	vaesenc	%xmm2,%xmm10,%xmm10
+	vaesenc	%xmm2,%xmm11,%xmm11
+	vaesenc	%xmm2,%xmm12,%xmm12
+
+	vmovdqa	48(%rdx),%xmm1
+	vaesenc	%xmm1,%xmm9,%xmm9
+	vaesenc	%xmm1,%xmm10,%xmm10
+	vaesenc	%xmm1,%xmm11,%xmm11
+	vaesenc	%xmm1,%xmm12,%xmm12
+
+	vmovdqa	64(%rdx),%xmm2
+	vaesenc	%xmm2,%xmm9,%xmm9
+	vaesenc	%xmm2,%xmm10,%xmm10
+	vaesenc	%xmm2,%xmm11,%xmm11
+	vaesenc	%xmm2,%xmm12,%xmm12
+
+	vmovdqa	80(%rdx),%xmm1
+	vaesenc	%xmm1,%xmm9,%xmm9
+	vaesenc	%xmm1,%xmm10,%xmm10
+	vaesenc	%xmm1,%xmm11,%xmm11
+	vaesenc	%xmm1,%xmm12,%xmm12
+
+	vmovdqa	96(%rdx),%xmm2
+	vaesenc	%xmm2,%xmm9,%xmm9
+	vaesenc	%xmm2,%xmm10,%xmm10
+	vaesenc	%xmm2,%xmm11,%xmm11
+	vaesenc	%xmm2,%xmm12,%xmm12
+
+	vmovdqa	112(%rdx),%xmm1
+	vaesenc	%xmm1,%xmm9,%xmm9
+	vaesenc	%xmm1,%xmm10,%xmm10
+	vaesenc	%xmm1,%xmm11,%xmm11
+	vaesenc	%xmm1,%xmm12,%xmm12
+
+	vmovdqa	128(%rdx),%xmm2
+	vaesenc	%xmm2,%xmm9,%xmm9
+	vaesenc	%xmm2,%xmm10,%xmm10
+	vaesenc	%xmm2,%xmm11,%xmm11
+	vaesenc	%xmm2,%xmm12,%xmm12
+
+	vmovdqa	144(%rdx),%xmm1
+	vaesenc	%xmm1,%xmm9,%xmm9
+	vaesenc	%xmm1,%xmm10,%xmm10
+	vaesenc	%xmm1,%xmm11,%xmm11
+	vaesenc	%xmm1,%xmm12,%xmm12
+
+	vmovdqa	160(%rdx),%xmm2
+	vaesenclast	%xmm2,%xmm9,%xmm9
+	vaesenclast	%xmm2,%xmm10,%xmm10
+	vaesenclast	%xmm2,%xmm11,%xmm11
+	vaesenclast	%xmm2,%xmm12,%xmm12
+
+
+	vmovdqa	%xmm9,0(%rsi)
+	vmovdqa	%xmm10,16(%rsi)
+	vmovdqa	%xmm11,32(%rsi)
+	vmovdqa	%xmm12,48(%rsi)
+	.byte	0xf3,0xc3
+
+
+.globl	_aes128gcmsiv_enc_msg_x4
+.private_extern _aes128gcmsiv_enc_msg_x4
+
+.p2align	4
+_aes128gcmsiv_enc_msg_x4:
+
+	testq	%r8,%r8
+	jnz	L$128_enc_msg_x4_start
+	.byte	0xf3,0xc3
+
+L$128_enc_msg_x4_start:
+	pushq	%r12
+
+	pushq	%r13
+
+
+	shrq	$4,%r8
+	movq	%r8,%r10
+	shlq	$62,%r10
+	shrq	$62,%r10
+
+
+	vmovdqa	(%rdx),%xmm15
+	vpor	OR_MASK(%rip),%xmm15,%xmm15
+
+	vmovdqu	four(%rip),%xmm4
+	vmovdqa	%xmm15,%xmm0
+	vpaddd	one(%rip),%xmm15,%xmm1
+	vpaddd	two(%rip),%xmm15,%xmm2
+	vpaddd	three(%rip),%xmm15,%xmm3
+
+	shrq	$2,%r8
+	je	L$128_enc_msg_x4_check_remainder
+
+	subq	$64,%rsi
+	subq	$64,%rdi
+
+L$128_enc_msg_x4_loop1:
+	addq	$64,%rsi
+	addq	$64,%rdi
+
+	vmovdqa	%xmm0,%xmm5
+	vmovdqa	%xmm1,%xmm6
+	vmovdqa	%xmm2,%xmm7
+	vmovdqa	%xmm3,%xmm8
+
+	vpxor	(%rcx),%xmm5,%xmm5
+	vpxor	(%rcx),%xmm6,%xmm6
+	vpxor	(%rcx),%xmm7,%xmm7
+	vpxor	(%rcx),%xmm8,%xmm8
+
+	vmovdqu	16(%rcx),%xmm12
+	vaesenc	%xmm12,%xmm5,%xmm5
+	vaesenc	%xmm12,%xmm6,%xmm6
+	vaesenc	%xmm12,%xmm7,%xmm7
+	vaesenc	%xmm12,%xmm8,%xmm8
+
+	vpaddd	%xmm4,%xmm0,%xmm0
+	vmovdqu	32(%rcx),%xmm12
+	vaesenc	%xmm12,%xmm5,%xmm5
+	vaesenc	%xmm12,%xmm6,%xmm6
+	vaesenc	%xmm12,%xmm7,%xmm7
+	vaesenc	%xmm12,%xmm8,%xmm8
+
+	vpaddd	%xmm4,%xmm1,%xmm1
+	vmovdqu	48(%rcx),%xmm12
+	vaesenc	%xmm12,%xmm5,%xmm5
+	vaesenc	%xmm12,%xmm6,%xmm6
+	vaesenc	%xmm12,%xmm7,%xmm7
+	vaesenc	%xmm12,%xmm8,%xmm8
+
+	vpaddd	%xmm4,%xmm2,%xmm2
+	vmovdqu	64(%rcx),%xmm12
+	vaesenc	%xmm12,%xmm5,%xmm5
+	vaesenc	%xmm12,%xmm6,%xmm6
+	vaesenc	%xmm12,%xmm7,%xmm7
+	vaesenc	%xmm12,%xmm8,%xmm8
+
+	vpaddd	%xmm4,%xmm3,%xmm3
+
+	vmovdqu	80(%rcx),%xmm12
+	vaesenc	%xmm12,%xmm5,%xmm5
+	vaesenc	%xmm12,%xmm6,%xmm6
+	vaesenc	%xmm12,%xmm7,%xmm7
+	vaesenc	%xmm12,%xmm8,%xmm8
+
+	vmovdqu	96(%rcx),%xmm12
+	vaesenc	%xmm12,%xmm5,%xmm5
+	vaesenc	%xmm12,%xmm6,%xmm6
+	vaesenc	%xmm12,%xmm7,%xmm7
+	vaesenc	%xmm12,%xmm8,%xmm8
+
+	vmovdqu	112(%rcx),%xmm12
+	vaesenc	%xmm12,%xmm5,%xmm5
+	vaesenc	%xmm12,%xmm6,%xmm6
+	vaesenc	%xmm12,%xmm7,%xmm7
+	vaesenc	%xmm12,%xmm8,%xmm8
+
+	vmovdqu	128(%rcx),%xmm12
+	vaesenc	%xmm12,%xmm5,%xmm5
+	vaesenc	%xmm12,%xmm6,%xmm6
+	vaesenc	%xmm12,%xmm7,%xmm7
+	vaesenc	%xmm12,%xmm8,%xmm8
+
+	vmovdqu	144(%rcx),%xmm12
+	vaesenc	%xmm12,%xmm5,%xmm5
+	vaesenc	%xmm12,%xmm6,%xmm6
+	vaesenc	%xmm12,%xmm7,%xmm7
+	vaesenc	%xmm12,%xmm8,%xmm8
+
+	vmovdqu	160(%rcx),%xmm12
+	vaesenclast	%xmm12,%xmm5,%xmm5
+	vaesenclast	%xmm12,%xmm6,%xmm6
+	vaesenclast	%xmm12,%xmm7,%xmm7
+	vaesenclast	%xmm12,%xmm8,%xmm8
+
+
+
+	vpxor	0(%rdi),%xmm5,%xmm5
+	vpxor	16(%rdi),%xmm6,%xmm6
+	vpxor	32(%rdi),%xmm7,%xmm7
+	vpxor	48(%rdi),%xmm8,%xmm8
+
+	subq	$1,%r8
+
+	vmovdqu	%xmm5,0(%rsi)
+	vmovdqu	%xmm6,16(%rsi)
+	vmovdqu	%xmm7,32(%rsi)
+	vmovdqu	%xmm8,48(%rsi)
+
+	jne	L$128_enc_msg_x4_loop1
+
+	addq	$64,%rsi
+	addq	$64,%rdi
+
+L$128_enc_msg_x4_check_remainder:
+	cmpq	$0,%r10
+	je	L$128_enc_msg_x4_out
+
+L$128_enc_msg_x4_loop2:
+
+
+	vmovdqa	%xmm0,%xmm5
+	vpaddd	one(%rip),%xmm0,%xmm0
+
+	vpxor	(%rcx),%xmm5,%xmm5
+	vaesenc	16(%rcx),%xmm5,%xmm5
+	vaesenc	32(%rcx),%xmm5,%xmm5
+	vaesenc	48(%rcx),%xmm5,%xmm5
+	vaesenc	64(%rcx),%xmm5,%xmm5
+	vaesenc	80(%rcx),%xmm5,%xmm5
+	vaesenc	96(%rcx),%xmm5,%xmm5
+	vaesenc	112(%rcx),%xmm5,%xmm5
+	vaesenc	128(%rcx),%xmm5,%xmm5
+	vaesenc	144(%rcx),%xmm5,%xmm5
+	vaesenclast	160(%rcx),%xmm5,%xmm5
+
+
+	vpxor	(%rdi),%xmm5,%xmm5
+	vmovdqu	%xmm5,(%rsi)
+
+	addq	$16,%rdi
+	addq	$16,%rsi
+
+	subq	$1,%r10
+	jne	L$128_enc_msg_x4_loop2
+
+L$128_enc_msg_x4_out:
+	popq	%r13
+
+	popq	%r12
+
+	.byte	0xf3,0xc3
+
+
+.globl	_aes128gcmsiv_enc_msg_x8
+.private_extern _aes128gcmsiv_enc_msg_x8
+
+.p2align	4
+_aes128gcmsiv_enc_msg_x8:
+
+	testq	%r8,%r8
+	jnz	L$128_enc_msg_x8_start
+	.byte	0xf3,0xc3
+
+L$128_enc_msg_x8_start:
+	pushq	%r12
+
+	pushq	%r13
+
+	pushq	%rbp
+
+	movq	%rsp,%rbp
+
+
+
+	subq	$128,%rsp
+	andq	$-64,%rsp
+
+	shrq	$4,%r8
+	movq	%r8,%r10
+	shlq	$61,%r10
+	shrq	$61,%r10
+
+
+	vmovdqu	(%rdx),%xmm1
+	vpor	OR_MASK(%rip),%xmm1,%xmm1
+
+
+	vpaddd	seven(%rip),%xmm1,%xmm0
+	vmovdqu	%xmm0,(%rsp)
+	vpaddd	one(%rip),%xmm1,%xmm9
+	vpaddd	two(%rip),%xmm1,%xmm10
+	vpaddd	three(%rip),%xmm1,%xmm11
+	vpaddd	four(%rip),%xmm1,%xmm12
+	vpaddd	five(%rip),%xmm1,%xmm13
+	vpaddd	six(%rip),%xmm1,%xmm14
+	vmovdqa	%xmm1,%xmm0
+
+	shrq	$3,%r8
+	je	L$128_enc_msg_x8_check_remainder
+
+	subq	$128,%rsi
+	subq	$128,%rdi
+
+L$128_enc_msg_x8_loop1:
+	addq	$128,%rsi
+	addq	$128,%rdi
+
+	vmovdqa	%xmm0,%xmm1
+	vmovdqa	%xmm9,%xmm2
+	vmovdqa	%xmm10,%xmm3
+	vmovdqa	%xmm11,%xmm4
+	vmovdqa	%xmm12,%xmm5
+	vmovdqa	%xmm13,%xmm6
+	vmovdqa	%xmm14,%xmm7
+
+	vmovdqu	(%rsp),%xmm8
+
+	vpxor	(%rcx),%xmm1,%xmm1
+	vpxor	(%rcx),%xmm2,%xmm2
+	vpxor	(%rcx),%xmm3,%xmm3
+	vpxor	(%rcx),%xmm4,%xmm4
+	vpxor	(%rcx),%xmm5,%xmm5
+	vpxor	(%rcx),%xmm6,%xmm6
+	vpxor	(%rcx),%xmm7,%xmm7
+	vpxor	(%rcx),%xmm8,%xmm8
+
+	vmovdqu	16(%rcx),%xmm15
+	vaesenc	%xmm15,%xmm1,%xmm1
+	vaesenc	%xmm15,%xmm2,%xmm2
+	vaesenc	%xmm15,%xmm3,%xmm3
+	vaesenc	%xmm15,%xmm4,%xmm4
+	vaesenc	%xmm15,%xmm5,%xmm5
+	vaesenc	%xmm15,%xmm6,%xmm6
+	vaesenc	%xmm15,%xmm7,%xmm7
+	vaesenc	%xmm15,%xmm8,%xmm8
+
+	vmovdqu	(%rsp),%xmm14
+	vpaddd	eight(%rip),%xmm14,%xmm14
+	vmovdqu	%xmm14,(%rsp)
+	vmovdqu	32(%rcx),%xmm15
+	vaesenc	%xmm15,%xmm1,%xmm1
+	vaesenc	%xmm15,%xmm2,%xmm2
+	vaesenc	%xmm15,%xmm3,%xmm3
+	vaesenc	%xmm15,%xmm4,%xmm4
+	vaesenc	%xmm15,%xmm5,%xmm5
+	vaesenc	%xmm15,%xmm6,%xmm6
+	vaesenc	%xmm15,%xmm7,%xmm7
+	vaesenc	%xmm15,%xmm8,%xmm8
+
+	vpsubd	one(%rip),%xmm14,%xmm14
+	vmovdqu	48(%rcx),%xmm15
+	vaesenc	%xmm15,%xmm1,%xmm1
+	vaesenc	%xmm15,%xmm2,%xmm2
+	vaesenc	%xmm15,%xmm3,%xmm3
+	vaesenc	%xmm15,%xmm4,%xmm4
+	vaesenc	%xmm15,%xmm5,%xmm5
+	vaesenc	%xmm15,%xmm6,%xmm6
+	vaesenc	%xmm15,%xmm7,%xmm7
+	vaesenc	%xmm15,%xmm8,%xmm8
+
+	vpaddd	eight(%rip),%xmm0,%xmm0
+	vmovdqu	64(%rcx),%xmm15
+	vaesenc	%xmm15,%xmm1,%xmm1
+	vaesenc	%xmm15,%xmm2,%xmm2
+	vaesenc	%xmm15,%xmm3,%xmm3
+	vaesenc	%xmm15,%xmm4,%xmm4
+	vaesenc	%xmm15,%xmm5,%xmm5
+	vaesenc	%xmm15,%xmm6,%xmm6
+	vaesenc	%xmm15,%xmm7,%xmm7
+	vaesenc	%xmm15,%xmm8,%xmm8
+
+	vpaddd	eight(%rip),%xmm9,%xmm9
+	vmovdqu	80(%rcx),%xmm15
+	vaesenc	%xmm15,%xmm1,%xmm1
+	vaesenc	%xmm15,%xmm2,%xmm2
+	vaesenc	%xmm15,%xmm3,%xmm3
+	vaesenc	%xmm15,%xmm4,%xmm4
+	vaesenc	%xmm15,%xmm5,%xmm5
+	vaesenc	%xmm15,%xmm6,%xmm6
+	vaesenc	%xmm15,%xmm7,%xmm7
+	vaesenc	%xmm15,%xmm8,%xmm8
+
+	vpaddd	eight(%rip),%xmm10,%xmm10
+	vmovdqu	96(%rcx),%xmm15
+	vaesenc	%xmm15,%xmm1,%xmm1
+	vaesenc	%xmm15,%xmm2,%xmm2
+	vaesenc	%xmm15,%xmm3,%xmm3
+	vaesenc	%xmm15,%xmm4,%xmm4
+	vaesenc	%xmm15,%xmm5,%xmm5
+	vaesenc	%xmm15,%xmm6,%xmm6
+	vaesenc	%xmm15,%xmm7,%xmm7
+	vaesenc	%xmm15,%xmm8,%xmm8
+
+	vpaddd	eight(%rip),%xmm11,%xmm11
+	vmovdqu	112(%rcx),%xmm15
+	vaesenc	%xmm15,%xmm1,%xmm1
+	vaesenc	%xmm15,%xmm2,%xmm2
+	vaesenc	%xmm15,%xmm3,%xmm3
+	vaesenc	%xmm15,%xmm4,%xmm4
+	vaesenc	%xmm15,%xmm5,%xmm5
+	vaesenc	%xmm15,%xmm6,%xmm6
+	vaesenc	%xmm15,%xmm7,%xmm7
+	vaesenc	%xmm15,%xmm8,%xmm8
+
+	vpaddd	eight(%rip),%xmm12,%xmm12
+	vmovdqu	128(%rcx),%xmm15
+	vaesenc	%xmm15,%xmm1,%xmm1
+	vaesenc	%xmm15,%xmm2,%xmm2
+	vaesenc	%xmm15,%xmm3,%xmm3
+	vaesenc	%xmm15,%xmm4,%xmm4
+	vaesenc	%xmm15,%xmm5,%xmm5
+	vaesenc	%xmm15,%xmm6,%xmm6
+	vaesenc	%xmm15,%xmm7,%xmm7
+	vaesenc	%xmm15,%xmm8,%xmm8
+
+	vpaddd	eight(%rip),%xmm13,%xmm13
+	vmovdqu	144(%rcx),%xmm15
+	vaesenc	%xmm15,%xmm1,%xmm1
+	vaesenc	%xmm15,%xmm2,%xmm2
+	vaesenc	%xmm15,%xmm3,%xmm3
+	vaesenc	%xmm15,%xmm4,%xmm4
+	vaesenc	%xmm15,%xmm5,%xmm5
+	vaesenc	%xmm15,%xmm6,%xmm6
+	vaesenc	%xmm15,%xmm7,%xmm7
+	vaesenc	%xmm15,%xmm8,%xmm8
+
+	vmovdqu	160(%rcx),%xmm15
+	vaesenclast	%xmm15,%xmm1,%xmm1
+	vaesenclast	%xmm15,%xmm2,%xmm2
+	vaesenclast	%xmm15,%xmm3,%xmm3
+	vaesenclast	%xmm15,%xmm4,%xmm4
+	vaesenclast	%xmm15,%xmm5,%xmm5
+	vaesenclast	%xmm15,%xmm6,%xmm6
+	vaesenclast	%xmm15,%xmm7,%xmm7
+	vaesenclast	%xmm15,%xmm8,%xmm8
+
+
+
+	vpxor	0(%rdi),%xmm1,%xmm1
+	vpxor	16(%rdi),%xmm2,%xmm2
+	vpxor	32(%rdi),%xmm3,%xmm3
+	vpxor	48(%rdi),%xmm4,%xmm4
+	vpxor	64(%rdi),%xmm5,%xmm5
+	vpxor	80(%rdi),%xmm6,%xmm6
+	vpxor	96(%rdi),%xmm7,%xmm7
+	vpxor	112(%rdi),%xmm8,%xmm8
+
+	decq	%r8
+
+	vmovdqu	%xmm1,0(%rsi)
+	vmovdqu	%xmm2,16(%rsi)
+	vmovdqu	%xmm3,32(%rsi)
+	vmovdqu	%xmm4,48(%rsi)
+	vmovdqu	%xmm5,64(%rsi)
+	vmovdqu	%xmm6,80(%rsi)
+	vmovdqu	%xmm7,96(%rsi)
+	vmovdqu	%xmm8,112(%rsi)
+
+	jne	L$128_enc_msg_x8_loop1
+
+	addq	$128,%rsi
+	addq	$128,%rdi
+
+L$128_enc_msg_x8_check_remainder:
+	cmpq	$0,%r10
+	je	L$128_enc_msg_x8_out
+
+L$128_enc_msg_x8_loop2:
+
+
+	vmovdqa	%xmm0,%xmm1
+	vpaddd	one(%rip),%xmm0,%xmm0
+
+	vpxor	(%rcx),%xmm1,%xmm1
+	vaesenc	16(%rcx),%xmm1,%xmm1
+	vaesenc	32(%rcx),%xmm1,%xmm1
+	vaesenc	48(%rcx),%xmm1,%xmm1
+	vaesenc	64(%rcx),%xmm1,%xmm1
+	vaesenc	80(%rcx),%xmm1,%xmm1
+	vaesenc	96(%rcx),%xmm1,%xmm1
+	vaesenc	112(%rcx),%xmm1,%xmm1
+	vaesenc	128(%rcx),%xmm1,%xmm1
+	vaesenc	144(%rcx),%xmm1,%xmm1
+	vaesenclast	160(%rcx),%xmm1,%xmm1
+
+
+	vpxor	(%rdi),%xmm1,%xmm1
+
+	vmovdqu	%xmm1,(%rsi)
+
+	addq	$16,%rdi
+	addq	$16,%rsi
+
+	decq	%r10
+	jne	L$128_enc_msg_x8_loop2
+
+L$128_enc_msg_x8_out:
+	movq	%rbp,%rsp
+
+	popq	%rbp
+
+	popq	%r13
+
+	popq	%r12
+
+	.byte	0xf3,0xc3
+
+
+.globl	_aes128gcmsiv_dec
+.private_extern _aes128gcmsiv_dec
+
+.p2align	4
+_aes128gcmsiv_dec:
+
+	testq	$~15,%r9
+	jnz	L$128_dec_start
+	.byte	0xf3,0xc3
+
+L$128_dec_start:
+	vzeroupper
+	vmovdqa	(%rdx),%xmm0
+	movq	%rdx,%rax
+
+	leaq	32(%rax),%rax
+	leaq	32(%rcx),%rcx
+
+
+	vmovdqu	(%rdi,%r9,1),%xmm15
+	vpor	OR_MASK(%rip),%xmm15,%xmm15
+	andq	$~15,%r9
+
+
+	cmpq	$96,%r9
+	jb	L$128_dec_loop2
+
+
+	subq	$96,%r9
+	vmovdqa	%xmm15,%xmm7
+	vpaddd	one(%rip),%xmm7,%xmm8
+	vpaddd	two(%rip),%xmm7,%xmm9
+	vpaddd	one(%rip),%xmm9,%xmm10
+	vpaddd	two(%rip),%xmm9,%xmm11
+	vpaddd	one(%rip),%xmm11,%xmm12
+	vpaddd	two(%rip),%xmm11,%xmm15
+
+	vpxor	(%r8),%xmm7,%xmm7
+	vpxor	(%r8),%xmm8,%xmm8
+	vpxor	(%r8),%xmm9,%xmm9
+	vpxor	(%r8),%xmm10,%xmm10
+	vpxor	(%r8),%xmm11,%xmm11
+	vpxor	(%r8),%xmm12,%xmm12
+
+	vmovdqu	16(%r8),%xmm4
+	vaesenc	%xmm4,%xmm7,%xmm7
+	vaesenc	%xmm4,%xmm8,%xmm8
+	vaesenc	%xmm4,%xmm9,%xmm9
+	vaesenc	%xmm4,%xmm10,%xmm10
+	vaesenc	%xmm4,%xmm11,%xmm11
+	vaesenc	%xmm4,%xmm12,%xmm12
+
+	vmovdqu	32(%r8),%xmm4
+	vaesenc	%xmm4,%xmm7,%xmm7
+	vaesenc	%xmm4,%xmm8,%xmm8
+	vaesenc	%xmm4,%xmm9,%xmm9
+	vaesenc	%xmm4,%xmm10,%xmm10
+	vaesenc	%xmm4,%xmm11,%xmm11
+	vaesenc	%xmm4,%xmm12,%xmm12
+
+	vmovdqu	48(%r8),%xmm4
+	vaesenc	%xmm4,%xmm7,%xmm7
+	vaesenc	%xmm4,%xmm8,%xmm8
+	vaesenc	%xmm4,%xmm9,%xmm9
+	vaesenc	%xmm4,%xmm10,%xmm10
+	vaesenc	%xmm4,%xmm11,%xmm11
+	vaesenc	%xmm4,%xmm12,%xmm12
+
+	vmovdqu	64(%r8),%xmm4
+	vaesenc	%xmm4,%xmm7,%xmm7
+	vaesenc	%xmm4,%xmm8,%xmm8
+	vaesenc	%xmm4,%xmm9,%xmm9
+	vaesenc	%xmm4,%xmm10,%xmm10
+	vaesenc	%xmm4,%xmm11,%xmm11
+	vaesenc	%xmm4,%xmm12,%xmm12
+
+	vmovdqu	80(%r8),%xmm4
+	vaesenc	%xmm4,%xmm7,%xmm7
+	vaesenc	%xmm4,%xmm8,%xmm8
+	vaesenc	%xmm4,%xmm9,%xmm9
+	vaesenc	%xmm4,%xmm10,%xmm10
+	vaesenc	%xmm4,%xmm11,%xmm11
+	vaesenc	%xmm4,%xmm12,%xmm12
+
+	vmovdqu	96(%r8),%xmm4
+	vaesenc	%xmm4,%xmm7,%xmm7
+	vaesenc	%xmm4,%xmm8,%xmm8
+	vaesenc	%xmm4,%xmm9,%xmm9
+	vaesenc	%xmm4,%xmm10,%xmm10
+	vaesenc	%xmm4,%xmm11,%xmm11
+	vaesenc	%xmm4,%xmm12,%xmm12
+
+	vmovdqu	112(%r8),%xmm4
+	vaesenc	%xmm4,%xmm7,%xmm7
+	vaesenc	%xmm4,%xmm8,%xmm8
+	vaesenc	%xmm4,%xmm9,%xmm9
+	vaesenc	%xmm4,%xmm10,%xmm10
+	vaesenc	%xmm4,%xmm11,%xmm11
+	vaesenc	%xmm4,%xmm12,%xmm12
+
+	vmovdqu	128(%r8),%xmm4
+	vaesenc	%xmm4,%xmm7,%xmm7
+	vaesenc	%xmm4,%xmm8,%xmm8
+	vaesenc	%xmm4,%xmm9,%xmm9
+	vaesenc	%xmm4,%xmm10,%xmm10
+	vaesenc	%xmm4,%xmm11,%xmm11
+	vaesenc	%xmm4,%xmm12,%xmm12
+
+	vmovdqu	144(%r8),%xmm4
+	vaesenc	%xmm4,%xmm7,%xmm7
+	vaesenc	%xmm4,%xmm8,%xmm8
+	vaesenc	%xmm4,%xmm9,%xmm9
+	vaesenc	%xmm4,%xmm10,%xmm10
+	vaesenc	%xmm4,%xmm11,%xmm11
+	vaesenc	%xmm4,%xmm12,%xmm12
+
+	vmovdqu	160(%r8),%xmm4
+	vaesenclast	%xmm4,%xmm7,%xmm7
+	vaesenclast	%xmm4,%xmm8,%xmm8
+	vaesenclast	%xmm4,%xmm9,%xmm9
+	vaesenclast	%xmm4,%xmm10,%xmm10
+	vaesenclast	%xmm4,%xmm11,%xmm11
+	vaesenclast	%xmm4,%xmm12,%xmm12
+
+
+	vpxor	0(%rdi),%xmm7,%xmm7
+	vpxor	16(%rdi),%xmm8,%xmm8
+	vpxor	32(%rdi),%xmm9,%xmm9
+	vpxor	48(%rdi),%xmm10,%xmm10
+	vpxor	64(%rdi),%xmm11,%xmm11
+	vpxor	80(%rdi),%xmm12,%xmm12
+
+	vmovdqu	%xmm7,0(%rsi)
+	vmovdqu	%xmm8,16(%rsi)
+	vmovdqu	%xmm9,32(%rsi)
+	vmovdqu	%xmm10,48(%rsi)
+	vmovdqu	%xmm11,64(%rsi)
+	vmovdqu	%xmm12,80(%rsi)
+
+	addq	$96,%rdi
+	addq	$96,%rsi
+	jmp	L$128_dec_loop1
+
+
+.p2align	6
+L$128_dec_loop1:
+	cmpq	$96,%r9
+	jb	L$128_dec_finish_96
+	subq	$96,%r9
+
+	vmovdqa	%xmm12,%xmm6
+	vmovdqa	%xmm11,16-32(%rax)
+	vmovdqa	%xmm10,32-32(%rax)
+	vmovdqa	%xmm9,48-32(%rax)
+	vmovdqa	%xmm8,64-32(%rax)
+	vmovdqa	%xmm7,80-32(%rax)
+
+	vmovdqa	%xmm15,%xmm7
+	vpaddd	one(%rip),%xmm7,%xmm8
+	vpaddd	two(%rip),%xmm7,%xmm9
+	vpaddd	one(%rip),%xmm9,%xmm10
+	vpaddd	two(%rip),%xmm9,%xmm11
+	vpaddd	one(%rip),%xmm11,%xmm12
+	vpaddd	two(%rip),%xmm11,%xmm15
+
+	vmovdqa	(%r8),%xmm4
+	vpxor	%xmm4,%xmm7,%xmm7
+	vpxor	%xmm4,%xmm8,%xmm8
+	vpxor	%xmm4,%xmm9,%xmm9
+	vpxor	%xmm4,%xmm10,%xmm10
+	vpxor	%xmm4,%xmm11,%xmm11
+	vpxor	%xmm4,%xmm12,%xmm12
+
+	vmovdqu	0-32(%rcx),%xmm4
+	vpclmulqdq	$0x11,%xmm4,%xmm6,%xmm2
+	vpclmulqdq	$0x00,%xmm4,%xmm6,%xmm3
+	vpclmulqdq	$0x01,%xmm4,%xmm6,%xmm1
+	vpclmulqdq	$0x10,%xmm4,%xmm6,%xmm4
+	vpxor	%xmm4,%xmm1,%xmm1
+
+	vmovdqu	16(%r8),%xmm4
+	vaesenc	%xmm4,%xmm7,%xmm7
+	vaesenc	%xmm4,%xmm8,%xmm8
+	vaesenc	%xmm4,%xmm9,%xmm9
+	vaesenc	%xmm4,%xmm10,%xmm10
+	vaesenc	%xmm4,%xmm11,%xmm11
+	vaesenc	%xmm4,%xmm12,%xmm12
+
+	vmovdqu	-16(%rax),%xmm6
+	vmovdqu	-16(%rcx),%xmm13
+
+	vpclmulqdq	$0x10,%xmm13,%xmm6,%xmm4
+	vpxor	%xmm4,%xmm1,%xmm1
+	vpclmulqdq	$0x11,%xmm13,%xmm6,%xmm4
+	vpxor	%xmm4,%xmm2,%xmm2
+	vpclmulqdq	$0x00,%xmm13,%xmm6,%xmm4
+	vpxor	%xmm4,%xmm3,%xmm3
+	vpclmulqdq	$0x01,%xmm13,%xmm6,%xmm4
+	vpxor	%xmm4,%xmm1,%xmm1
+
+
+	vmovdqu	32(%r8),%xmm4
+	vaesenc	%xmm4,%xmm7,%xmm7
+	vaesenc	%xmm4,%xmm8,%xmm8
+	vaesenc	%xmm4,%xmm9,%xmm9
+	vaesenc	%xmm4,%xmm10,%xmm10
+	vaesenc	%xmm4,%xmm11,%xmm11
+	vaesenc	%xmm4,%xmm12,%xmm12
+
+	vmovdqu	0(%rax),%xmm6
+	vmovdqu	0(%rcx),%xmm13
+
+	vpclmulqdq	$0x10,%xmm13,%xmm6,%xmm4
+	vpxor	%xmm4,%xmm1,%xmm1
+	vpclmulqdq	$0x11,%xmm13,%xmm6,%xmm4
+	vpxor	%xmm4,%xmm2,%xmm2
+	vpclmulqdq	$0x00,%xmm13,%xmm6,%xmm4
+	vpxor	%xmm4,%xmm3,%xmm3
+	vpclmulqdq	$0x01,%xmm13,%xmm6,%xmm4
+	vpxor	%xmm4,%xmm1,%xmm1
+
+
+	vmovdqu	48(%r8),%xmm4
+	vaesenc	%xmm4,%xmm7,%xmm7
+	vaesenc	%xmm4,%xmm8,%xmm8
+	vaesenc	%xmm4,%xmm9,%xmm9
+	vaesenc	%xmm4,%xmm10,%xmm10
+	vaesenc	%xmm4,%xmm11,%xmm11
+	vaesenc	%xmm4,%xmm12,%xmm12
+
+	vmovdqu	16(%rax),%xmm6
+	vmovdqu	16(%rcx),%xmm13
+
+	vpclmulqdq	$0x10,%xmm13,%xmm6,%xmm4
+	vpxor	%xmm4,%xmm1,%xmm1
+	vpclmulqdq	$0x11,%xmm13,%xmm6,%xmm4
+	vpxor	%xmm4,%xmm2,%xmm2
+	vpclmulqdq	$0x00,%xmm13,%xmm6,%xmm4
+	vpxor	%xmm4,%xmm3,%xmm3
+	vpclmulqdq	$0x01,%xmm13,%xmm6,%xmm4
+	vpxor	%xmm4,%xmm1,%xmm1
+
+
+	vmovdqu	64(%r8),%xmm4
+	vaesenc	%xmm4,%xmm7,%xmm7
+	vaesenc	%xmm4,%xmm8,%xmm8
+	vaesenc	%xmm4,%xmm9,%xmm9
+	vaesenc	%xmm4,%xmm10,%xmm10
+	vaesenc	%xmm4,%xmm11,%xmm11
+	vaesenc	%xmm4,%xmm12,%xmm12
+
+	vmovdqu	32(%rax),%xmm6
+	vmovdqu	32(%rcx),%xmm13
+
+	vpclmulqdq	$0x10,%xmm13,%xmm6,%xmm4
+	vpxor	%xmm4,%xmm1,%xmm1
+	vpclmulqdq	$0x11,%xmm13,%xmm6,%xmm4
+	vpxor	%xmm4,%xmm2,%xmm2
+	vpclmulqdq	$0x00,%xmm13,%xmm6,%xmm4
+	vpxor	%xmm4,%xmm3,%xmm3
+	vpclmulqdq	$0x01,%xmm13,%xmm6,%xmm4
+	vpxor	%xmm4,%xmm1,%xmm1
+
+
+	vmovdqu	80(%r8),%xmm4
+	vaesenc	%xmm4,%xmm7,%xmm7
+	vaesenc	%xmm4,%xmm8,%xmm8
+	vaesenc	%xmm4,%xmm9,%xmm9
+	vaesenc	%xmm4,%xmm10,%xmm10
+	vaesenc	%xmm4,%xmm11,%xmm11
+	vaesenc	%xmm4,%xmm12,%xmm12
+
+	vmovdqu	96(%r8),%xmm4
+	vaesenc	%xmm4,%xmm7,%xmm7
+	vaesenc	%xmm4,%xmm8,%xmm8
+	vaesenc	%xmm4,%xmm9,%xmm9
+	vaesenc	%xmm4,%xmm10,%xmm10
+	vaesenc	%xmm4,%xmm11,%xmm11
+	vaesenc	%xmm4,%xmm12,%xmm12
+
+	vmovdqu	112(%r8),%xmm4
+	vaesenc	%xmm4,%xmm7,%xmm7
+	vaesenc	%xmm4,%xmm8,%xmm8
+	vaesenc	%xmm4,%xmm9,%xmm9
+	vaesenc	%xmm4,%xmm10,%xmm10
+	vaesenc	%xmm4,%xmm11,%xmm11
+	vaesenc	%xmm4,%xmm12,%xmm12
+
+
+	vmovdqa	80-32(%rax),%xmm6
+	vpxor	%xmm0,%xmm6,%xmm6
+	vmovdqu	80-32(%rcx),%xmm5
+
+	vpclmulqdq	$0x01,%xmm5,%xmm6,%xmm4
+	vpxor	%xmm4,%xmm1,%xmm1
+	vpclmulqdq	$0x11,%xmm5,%xmm6,%xmm4
+	vpxor	%xmm4,%xmm2,%xmm2
+	vpclmulqdq	$0x00,%xmm5,%xmm6,%xmm4
+	vpxor	%xmm4,%xmm3,%xmm3
+	vpclmulqdq	$0x10,%xmm5,%xmm6,%xmm4
+	vpxor	%xmm4,%xmm1,%xmm1
+
+	vmovdqu	128(%r8),%xmm4
+	vaesenc	%xmm4,%xmm7,%xmm7
+	vaesenc	%xmm4,%xmm8,%xmm8
+	vaesenc	%xmm4,%xmm9,%xmm9
+	vaesenc	%xmm4,%xmm10,%xmm10
+	vaesenc	%xmm4,%xmm11,%xmm11
+	vaesenc	%xmm4,%xmm12,%xmm12
+
+
+	vpsrldq	$8,%xmm1,%xmm4
+	vpxor	%xmm4,%xmm2,%xmm5
+	vpslldq	$8,%xmm1,%xmm4
+	vpxor	%xmm4,%xmm3,%xmm0
+
+	vmovdqa	poly(%rip),%xmm3
+
+	vmovdqu	144(%r8),%xmm4
+	vaesenc	%xmm4,%xmm7,%xmm7
+	vaesenc	%xmm4,%xmm8,%xmm8
+	vaesenc	%xmm4,%xmm9,%xmm9
+	vaesenc	%xmm4,%xmm10,%xmm10
+	vaesenc	%xmm4,%xmm11,%xmm11
+	vaesenc	%xmm4,%xmm12,%xmm12
+
+	vmovdqu	160(%r8),%xmm6
+	vpalignr	$8,%xmm0,%xmm0,%xmm2
+	vpclmulqdq	$0x10,%xmm3,%xmm0,%xmm0
+	vpxor	%xmm0,%xmm2,%xmm0
+
+	vpxor	0(%rdi),%xmm6,%xmm4
+	vaesenclast	%xmm4,%xmm7,%xmm7
+	vpxor	16(%rdi),%xmm6,%xmm4
+	vaesenclast	%xmm4,%xmm8,%xmm8
+	vpxor	32(%rdi),%xmm6,%xmm4
+	vaesenclast	%xmm4,%xmm9,%xmm9
+	vpxor	48(%rdi),%xmm6,%xmm4
+	vaesenclast	%xmm4,%xmm10,%xmm10
+	vpxor	64(%rdi),%xmm6,%xmm4
+	vaesenclast	%xmm4,%xmm11,%xmm11
+	vpxor	80(%rdi),%xmm6,%xmm4
+	vaesenclast	%xmm4,%xmm12,%xmm12
+
+	vpalignr	$8,%xmm0,%xmm0,%xmm2
+	vpclmulqdq	$0x10,%xmm3,%xmm0,%xmm0
+	vpxor	%xmm0,%xmm2,%xmm0
+
+	vmovdqu	%xmm7,0(%rsi)
+	vmovdqu	%xmm8,16(%rsi)
+	vmovdqu	%xmm9,32(%rsi)
+	vmovdqu	%xmm10,48(%rsi)
+	vmovdqu	%xmm11,64(%rsi)
+	vmovdqu	%xmm12,80(%rsi)
+
+	vpxor	%xmm5,%xmm0,%xmm0
+
+	leaq	96(%rdi),%rdi
+	leaq	96(%rsi),%rsi
+	jmp	L$128_dec_loop1
+
+L$128_dec_finish_96:
+	vmovdqa	%xmm12,%xmm6
+	vmovdqa	%xmm11,16-32(%rax)
+	vmovdqa	%xmm10,32-32(%rax)
+	vmovdqa	%xmm9,48-32(%rax)
+	vmovdqa	%xmm8,64-32(%rax)
+	vmovdqa	%xmm7,80-32(%rax)
+
+	vmovdqu	0-32(%rcx),%xmm4
+	vpclmulqdq	$0x10,%xmm4,%xmm6,%xmm1
+	vpclmulqdq	$0x11,%xmm4,%xmm6,%xmm2
+	vpclmulqdq	$0x00,%xmm4,%xmm6,%xmm3
+	vpclmulqdq	$0x01,%xmm4,%xmm6,%xmm4
+	vpxor	%xmm4,%xmm1,%xmm1
+
+	vmovdqu	-16(%rax),%xmm6
+	vmovdqu	-16(%rcx),%xmm13
+
+	vpclmulqdq	$0x10,%xmm13,%xmm6,%xmm4
+	vpxor	%xmm4,%xmm1,%xmm1
+	vpclmulqdq	$0x11,%xmm13,%xmm6,%xmm4
+	vpxor	%xmm4,%xmm2,%xmm2
+	vpclmulqdq	$0x00,%xmm13,%xmm6,%xmm4
+	vpxor	%xmm4,%xmm3,%xmm3
+	vpclmulqdq	$0x01,%xmm13,%xmm6,%xmm4
+	vpxor	%xmm4,%xmm1,%xmm1
+
+	vmovdqu	0(%rax),%xmm6
+	vmovdqu	0(%rcx),%xmm13
+
+	vpclmulqdq	$0x10,%xmm13,%xmm6,%xmm4
+	vpxor	%xmm4,%xmm1,%xmm1
+	vpclmulqdq	$0x11,%xmm13,%xmm6,%xmm4
+	vpxor	%xmm4,%xmm2,%xmm2
+	vpclmulqdq	$0x00,%xmm13,%xmm6,%xmm4
+	vpxor	%xmm4,%xmm3,%xmm3
+	vpclmulqdq	$0x01,%xmm13,%xmm6,%xmm4
+	vpxor	%xmm4,%xmm1,%xmm1
+
+	vmovdqu	16(%rax),%xmm6
+	vmovdqu	16(%rcx),%xmm13
+
+	vpclmulqdq	$0x10,%xmm13,%xmm6,%xmm4
+	vpxor	%xmm4,%xmm1,%xmm1
+	vpclmulqdq	$0x11,%xmm13,%xmm6,%xmm4
+	vpxor	%xmm4,%xmm2,%xmm2
+	vpclmulqdq	$0x00,%xmm13,%xmm6,%xmm4
+	vpxor	%xmm4,%xmm3,%xmm3
+	vpclmulqdq	$0x01,%xmm13,%xmm6,%xmm4
+	vpxor	%xmm4,%xmm1,%xmm1
+
+	vmovdqu	32(%rax),%xmm6
+	vmovdqu	32(%rcx),%xmm13
+
+	vpclmulqdq	$0x10,%xmm13,%xmm6,%xmm4
+	vpxor	%xmm4,%xmm1,%xmm1
+	vpclmulqdq	$0x11,%xmm13,%xmm6,%xmm4
+	vpxor	%xmm4,%xmm2,%xmm2
+	vpclmulqdq	$0x00,%xmm13,%xmm6,%xmm4
+	vpxor	%xmm4,%xmm3,%xmm3
+	vpclmulqdq	$0x01,%xmm13,%xmm6,%xmm4
+	vpxor	%xmm4,%xmm1,%xmm1
+
+
+	vmovdqu	80-32(%rax),%xmm6
+	vpxor	%xmm0,%xmm6,%xmm6
+	vmovdqu	80-32(%rcx),%xmm5
+	vpclmulqdq	$0x11,%xmm5,%xmm6,%xmm4
+	vpxor	%xmm4,%xmm2,%xmm2
+	vpclmulqdq	$0x00,%xmm5,%xmm6,%xmm4
+	vpxor	%xmm4,%xmm3,%xmm3
+	vpclmulqdq	$0x10,%xmm5,%xmm6,%xmm4
+	vpxor	%xmm4,%xmm1,%xmm1
+	vpclmulqdq	$0x01,%xmm5,%xmm6,%xmm4
+	vpxor	%xmm4,%xmm1,%xmm1
+
+	vpsrldq	$8,%xmm1,%xmm4
+	vpxor	%xmm4,%xmm2,%xmm5
+	vpslldq	$8,%xmm1,%xmm4
+	vpxor	%xmm4,%xmm3,%xmm0
+
+	vmovdqa	poly(%rip),%xmm3
+
+	vpalignr	$8,%xmm0,%xmm0,%xmm2
+	vpclmulqdq	$0x10,%xmm3,%xmm0,%xmm0
+	vpxor	%xmm0,%xmm2,%xmm0
+
+	vpalignr	$8,%xmm0,%xmm0,%xmm2
+	vpclmulqdq	$0x10,%xmm3,%xmm0,%xmm0
+	vpxor	%xmm0,%xmm2,%xmm0
+
+	vpxor	%xmm5,%xmm0,%xmm0
+
+L$128_dec_loop2:
+
+
+
+	cmpq	$16,%r9
+	jb	L$128_dec_out
+	subq	$16,%r9
+
+	vmovdqa	%xmm15,%xmm2
+	vpaddd	one(%rip),%xmm15,%xmm15
+
+	vpxor	0(%r8),%xmm2,%xmm2
+	vaesenc	16(%r8),%xmm2,%xmm2
+	vaesenc	32(%r8),%xmm2,%xmm2
+	vaesenc	48(%r8),%xmm2,%xmm2
+	vaesenc	64(%r8),%xmm2,%xmm2
+	vaesenc	80(%r8),%xmm2,%xmm2
+	vaesenc	96(%r8),%xmm2,%xmm2
+	vaesenc	112(%r8),%xmm2,%xmm2
+	vaesenc	128(%r8),%xmm2,%xmm2
+	vaesenc	144(%r8),%xmm2,%xmm2
+	vaesenclast	160(%r8),%xmm2,%xmm2
+	vpxor	(%rdi),%xmm2,%xmm2
+	vmovdqu	%xmm2,(%rsi)
+	addq	$16,%rdi
+	addq	$16,%rsi
+
+	vpxor	%xmm2,%xmm0,%xmm0
+	vmovdqa	-32(%rcx),%xmm1
+	call	GFMUL
+
+	jmp	L$128_dec_loop2
+
+L$128_dec_out:
+	vmovdqu	%xmm0,(%rdx)
+	.byte	0xf3,0xc3
+
+
+.globl	_aes128gcmsiv_ecb_enc_block
+.private_extern _aes128gcmsiv_ecb_enc_block
+
+.p2align	4
+_aes128gcmsiv_ecb_enc_block:
+
+	vmovdqa	(%rdi),%xmm1
+
+	vpxor	(%rdx),%xmm1,%xmm1
+	vaesenc	16(%rdx),%xmm1,%xmm1
+	vaesenc	32(%rdx),%xmm1,%xmm1
+	vaesenc	48(%rdx),%xmm1,%xmm1
+	vaesenc	64(%rdx),%xmm1,%xmm1
+	vaesenc	80(%rdx),%xmm1,%xmm1
+	vaesenc	96(%rdx),%xmm1,%xmm1
+	vaesenc	112(%rdx),%xmm1,%xmm1
+	vaesenc	128(%rdx),%xmm1,%xmm1
+	vaesenc	144(%rdx),%xmm1,%xmm1
+	vaesenclast	160(%rdx),%xmm1,%xmm1
+
+	vmovdqa	%xmm1,(%rsi)
+
+	.byte	0xf3,0xc3
+
+
+.globl	_aes256gcmsiv_aes_ks_enc_x1
+.private_extern _aes256gcmsiv_aes_ks_enc_x1
+
+.p2align	4
+_aes256gcmsiv_aes_ks_enc_x1:
+
+	vmovdqa	con1(%rip),%xmm0
+	vmovdqa	mask(%rip),%xmm15
+	vmovdqa	(%rdi),%xmm8
+	vmovdqa	(%rcx),%xmm1
+	vmovdqa	16(%rcx),%xmm3
+	vpxor	%xmm1,%xmm8,%xmm8
+	vaesenc	%xmm3,%xmm8,%xmm8
+	vmovdqu	%xmm1,(%rdx)
+	vmovdqu	%xmm3,16(%rdx)
+	vpxor	%xmm14,%xmm14,%xmm14
+
+	vpshufb	%xmm15,%xmm3,%xmm2
+	vaesenclast	%xmm0,%xmm2,%xmm2
+	vpslld	$1,%xmm0,%xmm0
+	vpslldq	$4,%xmm1,%xmm4
+	vpxor	%xmm4,%xmm1,%xmm1
+	vpslldq	$4,%xmm4,%xmm4
+	vpxor	%xmm4,%xmm1,%xmm1
+	vpslldq	$4,%xmm4,%xmm4
+	vpxor	%xmm4,%xmm1,%xmm1
+	vpxor	%xmm2,%xmm1,%xmm1
+	vaesenc	%xmm1,%xmm8,%xmm8
+	vmovdqu	%xmm1,32(%rdx)
+
+	vpshufd	$0xff,%xmm1,%xmm2
+	vaesenclast	%xmm14,%xmm2,%xmm2
+	vpslldq	$4,%xmm3,%xmm4
+	vpxor	%xmm4,%xmm3,%xmm3
+	vpslldq	$4,%xmm4,%xmm4
+	vpxor	%xmm4,%xmm3,%xmm3
+	vpslldq	$4,%xmm4,%xmm4
+	vpxor	%xmm4,%xmm3,%xmm3
+	vpxor	%xmm2,%xmm3,%xmm3
+	vaesenc	%xmm3,%xmm8,%xmm8
+	vmovdqu	%xmm3,48(%rdx)
+
+	vpshufb	%xmm15,%xmm3,%xmm2
+	vaesenclast	%xmm0,%xmm2,%xmm2
+	vpslld	$1,%xmm0,%xmm0
+	vpslldq	$4,%xmm1,%xmm4
+	vpxor	%xmm4,%xmm1,%xmm1
+	vpslldq	$4,%xmm4,%xmm4
+	vpxor	%xmm4,%xmm1,%xmm1
+	vpslldq	$4,%xmm4,%xmm4
+	vpxor	%xmm4,%xmm1,%xmm1
+	vpxor	%xmm2,%xmm1,%xmm1
+	vaesenc	%xmm1,%xmm8,%xmm8
+	vmovdqu	%xmm1,64(%rdx)
+
+	vpshufd	$0xff,%xmm1,%xmm2
+	vaesenclast	%xmm14,%xmm2,%xmm2
+	vpslldq	$4,%xmm3,%xmm4
+	vpxor	%xmm4,%xmm3,%xmm3
+	vpslldq	$4,%xmm4,%xmm4
+	vpxor	%xmm4,%xmm3,%xmm3
+	vpslldq	$4,%xmm4,%xmm4
+	vpxor	%xmm4,%xmm3,%xmm3
+	vpxor	%xmm2,%xmm3,%xmm3
+	vaesenc	%xmm3,%xmm8,%xmm8
+	vmovdqu	%xmm3,80(%rdx)
+
+	vpshufb	%xmm15,%xmm3,%xmm2
+	vaesenclast	%xmm0,%xmm2,%xmm2
+	vpslld	$1,%xmm0,%xmm0
+	vpslldq	$4,%xmm1,%xmm4
+	vpxor	%xmm4,%xmm1,%xmm1
+	vpslldq	$4,%xmm4,%xmm4
+	vpxor	%xmm4,%xmm1,%xmm1
+	vpslldq	$4,%xmm4,%xmm4
+	vpxor	%xmm4,%xmm1,%xmm1
+	vpxor	%xmm2,%xmm1,%xmm1
+	vaesenc	%xmm1,%xmm8,%xmm8
+	vmovdqu	%xmm1,96(%rdx)
+
+	vpshufd	$0xff,%xmm1,%xmm2
+	vaesenclast	%xmm14,%xmm2,%xmm2
+	vpslldq	$4,%xmm3,%xmm4
+	vpxor	%xmm4,%xmm3,%xmm3
+	vpslldq	$4,%xmm4,%xmm4
+	vpxor	%xmm4,%xmm3,%xmm3
+	vpslldq	$4,%xmm4,%xmm4
+	vpxor	%xmm4,%xmm3,%xmm3
+	vpxor	%xmm2,%xmm3,%xmm3
+	vaesenc	%xmm3,%xmm8,%xmm8
+	vmovdqu	%xmm3,112(%rdx)
+
+	vpshufb	%xmm15,%xmm3,%xmm2
+	vaesenclast	%xmm0,%xmm2,%xmm2
+	vpslld	$1,%xmm0,%xmm0
+	vpslldq	$4,%xmm1,%xmm4
+	vpxor	%xmm4,%xmm1,%xmm1
+	vpslldq	$4,%xmm4,%xmm4
+	vpxor	%xmm4,%xmm1,%xmm1
+	vpslldq	$4,%xmm4,%xmm4
+	vpxor	%xmm4,%xmm1,%xmm1
+	vpxor	%xmm2,%xmm1,%xmm1
+	vaesenc	%xmm1,%xmm8,%xmm8
+	vmovdqu	%xmm1,128(%rdx)
+
+	vpshufd	$0xff,%xmm1,%xmm2
+	vaesenclast	%xmm14,%xmm2,%xmm2
+	vpslldq	$4,%xmm3,%xmm4
+	vpxor	%xmm4,%xmm3,%xmm3
+	vpslldq	$4,%xmm4,%xmm4
+	vpxor	%xmm4,%xmm3,%xmm3
+	vpslldq	$4,%xmm4,%xmm4
+	vpxor	%xmm4,%xmm3,%xmm3
+	vpxor	%xmm2,%xmm3,%xmm3
+	vaesenc	%xmm3,%xmm8,%xmm8
+	vmovdqu	%xmm3,144(%rdx)
+
+	vpshufb	%xmm15,%xmm3,%xmm2
+	vaesenclast	%xmm0,%xmm2,%xmm2
+	vpslld	$1,%xmm0,%xmm0
+	vpslldq	$4,%xmm1,%xmm4
+	vpxor	%xmm4,%xmm1,%xmm1
+	vpslldq	$4,%xmm4,%xmm4
+	vpxor	%xmm4,%xmm1,%xmm1
+	vpslldq	$4,%xmm4,%xmm4
+	vpxor	%xmm4,%xmm1,%xmm1
+	vpxor	%xmm2,%xmm1,%xmm1
+	vaesenc	%xmm1,%xmm8,%xmm8
+	vmovdqu	%xmm1,160(%rdx)
+
+	vpshufd	$0xff,%xmm1,%xmm2
+	vaesenclast	%xmm14,%xmm2,%xmm2
+	vpslldq	$4,%xmm3,%xmm4
+	vpxor	%xmm4,%xmm3,%xmm3
+	vpslldq	$4,%xmm4,%xmm4
+	vpxor	%xmm4,%xmm3,%xmm3
+	vpslldq	$4,%xmm4,%xmm4
+	vpxor	%xmm4,%xmm3,%xmm3
+	vpxor	%xmm2,%xmm3,%xmm3
+	vaesenc	%xmm3,%xmm8,%xmm8
+	vmovdqu	%xmm3,176(%rdx)
+
+	vpshufb	%xmm15,%xmm3,%xmm2
+	vaesenclast	%xmm0,%xmm2,%xmm2
+	vpslld	$1,%xmm0,%xmm0
+	vpslldq	$4,%xmm1,%xmm4
+	vpxor	%xmm4,%xmm1,%xmm1
+	vpslldq	$4,%xmm4,%xmm4
+	vpxor	%xmm4,%xmm1,%xmm1
+	vpslldq	$4,%xmm4,%xmm4
+	vpxor	%xmm4,%xmm1,%xmm1
+	vpxor	%xmm2,%xmm1,%xmm1
+	vaesenc	%xmm1,%xmm8,%xmm8
+	vmovdqu	%xmm1,192(%rdx)
+
+	vpshufd	$0xff,%xmm1,%xmm2
+	vaesenclast	%xmm14,%xmm2,%xmm2
+	vpslldq	$4,%xmm3,%xmm4
+	vpxor	%xmm4,%xmm3,%xmm3
+	vpslldq	$4,%xmm4,%xmm4
+	vpxor	%xmm4,%xmm3,%xmm3
+	vpslldq	$4,%xmm4,%xmm4
+	vpxor	%xmm4,%xmm3,%xmm3
+	vpxor	%xmm2,%xmm3,%xmm3
+	vaesenc	%xmm3,%xmm8,%xmm8
+	vmovdqu	%xmm3,208(%rdx)
+
+	vpshufb	%xmm15,%xmm3,%xmm2
+	vaesenclast	%xmm0,%xmm2,%xmm2
+	vpslldq	$4,%xmm1,%xmm4
+	vpxor	%xmm4,%xmm1,%xmm1
+	vpslldq	$4,%xmm4,%xmm4
+	vpxor	%xmm4,%xmm1,%xmm1
+	vpslldq	$4,%xmm4,%xmm4
+	vpxor	%xmm4,%xmm1,%xmm1
+	vpxor	%xmm2,%xmm1,%xmm1
+	vaesenclast	%xmm1,%xmm8,%xmm8
+	vmovdqu	%xmm1,224(%rdx)
+
+	vmovdqa	%xmm8,(%rsi)
+	.byte	0xf3,0xc3
+
+
+.globl	_aes256gcmsiv_ecb_enc_block
+.private_extern _aes256gcmsiv_ecb_enc_block
+
+.p2align	4
+_aes256gcmsiv_ecb_enc_block:
+
+	vmovdqa	(%rdi),%xmm1
+	vpxor	(%rdx),%xmm1,%xmm1
+	vaesenc	16(%rdx),%xmm1,%xmm1
+	vaesenc	32(%rdx),%xmm1,%xmm1
+	vaesenc	48(%rdx),%xmm1,%xmm1
+	vaesenc	64(%rdx),%xmm1,%xmm1
+	vaesenc	80(%rdx),%xmm1,%xmm1
+	vaesenc	96(%rdx),%xmm1,%xmm1
+	vaesenc	112(%rdx),%xmm1,%xmm1
+	vaesenc	128(%rdx),%xmm1,%xmm1
+	vaesenc	144(%rdx),%xmm1,%xmm1
+	vaesenc	160(%rdx),%xmm1,%xmm1
+	vaesenc	176(%rdx),%xmm1,%xmm1
+	vaesenc	192(%rdx),%xmm1,%xmm1
+	vaesenc	208(%rdx),%xmm1,%xmm1
+	vaesenclast	224(%rdx),%xmm1,%xmm1
+	vmovdqa	%xmm1,(%rsi)
+	.byte	0xf3,0xc3
+
+
+.globl	_aes256gcmsiv_enc_msg_x4
+.private_extern _aes256gcmsiv_enc_msg_x4
+
+.p2align	4
+_aes256gcmsiv_enc_msg_x4:
+
+	testq	%r8,%r8
+	jnz	L$256_enc_msg_x4_start
+	.byte	0xf3,0xc3
+
+L$256_enc_msg_x4_start:
+	movq	%r8,%r10
+	shrq	$4,%r8
+	shlq	$60,%r10
+	jz	L$256_enc_msg_x4_start2
+	addq	$1,%r8
+
+L$256_enc_msg_x4_start2:
+	movq	%r8,%r10
+	shlq	$62,%r10
+	shrq	$62,%r10
+
+
+	vmovdqa	(%rdx),%xmm15
+	vpor	OR_MASK(%rip),%xmm15,%xmm15
+
+	vmovdqa	four(%rip),%xmm4
+	vmovdqa	%xmm15,%xmm0
+	vpaddd	one(%rip),%xmm15,%xmm1
+	vpaddd	two(%rip),%xmm15,%xmm2
+	vpaddd	three(%rip),%xmm15,%xmm3
+
+	shrq	$2,%r8
+	je	L$256_enc_msg_x4_check_remainder
+
+	subq	$64,%rsi
+	subq	$64,%rdi
+
+L$256_enc_msg_x4_loop1:
+	addq	$64,%rsi
+	addq	$64,%rdi
+
+	vmovdqa	%xmm0,%xmm5
+	vmovdqa	%xmm1,%xmm6
+	vmovdqa	%xmm2,%xmm7
+	vmovdqa	%xmm3,%xmm8
+
+	vpxor	(%rcx),%xmm5,%xmm5
+	vpxor	(%rcx),%xmm6,%xmm6
+	vpxor	(%rcx),%xmm7,%xmm7
+	vpxor	(%rcx),%xmm8,%xmm8
+
+	vmovdqu	16(%rcx),%xmm12
+	vaesenc	%xmm12,%xmm5,%xmm5
+	vaesenc	%xmm12,%xmm6,%xmm6
+	vaesenc	%xmm12,%xmm7,%xmm7
+	vaesenc	%xmm12,%xmm8,%xmm8
+
+	vpaddd	%xmm4,%xmm0,%xmm0
+	vmovdqu	32(%rcx),%xmm12
+	vaesenc	%xmm12,%xmm5,%xmm5
+	vaesenc	%xmm12,%xmm6,%xmm6
+	vaesenc	%xmm12,%xmm7,%xmm7
+	vaesenc	%xmm12,%xmm8,%xmm8
+
+	vpaddd	%xmm4,%xmm1,%xmm1
+	vmovdqu	48(%rcx),%xmm12
+	vaesenc	%xmm12,%xmm5,%xmm5
+	vaesenc	%xmm12,%xmm6,%xmm6
+	vaesenc	%xmm12,%xmm7,%xmm7
+	vaesenc	%xmm12,%xmm8,%xmm8
+
+	vpaddd	%xmm4,%xmm2,%xmm2
+	vmovdqu	64(%rcx),%xmm12
+	vaesenc	%xmm12,%xmm5,%xmm5
+	vaesenc	%xmm12,%xmm6,%xmm6
+	vaesenc	%xmm12,%xmm7,%xmm7
+	vaesenc	%xmm12,%xmm8,%xmm8
+
+	vpaddd	%xmm4,%xmm3,%xmm3
+
+	vmovdqu	80(%rcx),%xmm12
+	vaesenc	%xmm12,%xmm5,%xmm5
+	vaesenc	%xmm12,%xmm6,%xmm6
+	vaesenc	%xmm12,%xmm7,%xmm7
+	vaesenc	%xmm12,%xmm8,%xmm8
+
+	vmovdqu	96(%rcx),%xmm12
+	vaesenc	%xmm12,%xmm5,%xmm5
+	vaesenc	%xmm12,%xmm6,%xmm6
+	vaesenc	%xmm12,%xmm7,%xmm7
+	vaesenc	%xmm12,%xmm8,%xmm8
+
+	vmovdqu	112(%rcx),%xmm12
+	vaesenc	%xmm12,%xmm5,%xmm5
+	vaesenc	%xmm12,%xmm6,%xmm6
+	vaesenc	%xmm12,%xmm7,%xmm7
+	vaesenc	%xmm12,%xmm8,%xmm8
+
+	vmovdqu	128(%rcx),%xmm12
+	vaesenc	%xmm12,%xmm5,%xmm5
+	vaesenc	%xmm12,%xmm6,%xmm6
+	vaesenc	%xmm12,%xmm7,%xmm7
+	vaesenc	%xmm12,%xmm8,%xmm8
+
+	vmovdqu	144(%rcx),%xmm12
+	vaesenc	%xmm12,%xmm5,%xmm5
+	vaesenc	%xmm12,%xmm6,%xmm6
+	vaesenc	%xmm12,%xmm7,%xmm7
+	vaesenc	%xmm12,%xmm8,%xmm8
+
+	vmovdqu	160(%rcx),%xmm12
+	vaesenc	%xmm12,%xmm5,%xmm5
+	vaesenc	%xmm12,%xmm6,%xmm6
+	vaesenc	%xmm12,%xmm7,%xmm7
+	vaesenc	%xmm12,%xmm8,%xmm8
+
+	vmovdqu	176(%rcx),%xmm12
+	vaesenc	%xmm12,%xmm5,%xmm5
+	vaesenc	%xmm12,%xmm6,%xmm6
+	vaesenc	%xmm12,%xmm7,%xmm7
+	vaesenc	%xmm12,%xmm8,%xmm8
+
+	vmovdqu	192(%rcx),%xmm12
+	vaesenc	%xmm12,%xmm5,%xmm5
+	vaesenc	%xmm12,%xmm6,%xmm6
+	vaesenc	%xmm12,%xmm7,%xmm7
+	vaesenc	%xmm12,%xmm8,%xmm8
+
+	vmovdqu	208(%rcx),%xmm12
+	vaesenc	%xmm12,%xmm5,%xmm5
+	vaesenc	%xmm12,%xmm6,%xmm6
+	vaesenc	%xmm12,%xmm7,%xmm7
+	vaesenc	%xmm12,%xmm8,%xmm8
+
+	vmovdqu	224(%rcx),%xmm12
+	vaesenclast	%xmm12,%xmm5,%xmm5
+	vaesenclast	%xmm12,%xmm6,%xmm6
+	vaesenclast	%xmm12,%xmm7,%xmm7
+	vaesenclast	%xmm12,%xmm8,%xmm8
+
+
+
+	vpxor	0(%rdi),%xmm5,%xmm5
+	vpxor	16(%rdi),%xmm6,%xmm6
+	vpxor	32(%rdi),%xmm7,%xmm7
+	vpxor	48(%rdi),%xmm8,%xmm8
+
+	subq	$1,%r8
+
+	vmovdqu	%xmm5,0(%rsi)
+	vmovdqu	%xmm6,16(%rsi)
+	vmovdqu	%xmm7,32(%rsi)
+	vmovdqu	%xmm8,48(%rsi)
+
+	jne	L$256_enc_msg_x4_loop1
+
+	addq	$64,%rsi
+	addq	$64,%rdi
+
+L$256_enc_msg_x4_check_remainder:
+	cmpq	$0,%r10
+	je	L$256_enc_msg_x4_out
+
+L$256_enc_msg_x4_loop2:
+
+
+
+	vmovdqa	%xmm0,%xmm5
+	vpaddd	one(%rip),%xmm0,%xmm0
+	vpxor	(%rcx),%xmm5,%xmm5
+	vaesenc	16(%rcx),%xmm5,%xmm5
+	vaesenc	32(%rcx),%xmm5,%xmm5
+	vaesenc	48(%rcx),%xmm5,%xmm5
+	vaesenc	64(%rcx),%xmm5,%xmm5
+	vaesenc	80(%rcx),%xmm5,%xmm5
+	vaesenc	96(%rcx),%xmm5,%xmm5
+	vaesenc	112(%rcx),%xmm5,%xmm5
+	vaesenc	128(%rcx),%xmm5,%xmm5
+	vaesenc	144(%rcx),%xmm5,%xmm5
+	vaesenc	160(%rcx),%xmm5,%xmm5
+	vaesenc	176(%rcx),%xmm5,%xmm5
+	vaesenc	192(%rcx),%xmm5,%xmm5
+	vaesenc	208(%rcx),%xmm5,%xmm5
+	vaesenclast	224(%rcx),%xmm5,%xmm5
+
+
+	vpxor	(%rdi),%xmm5,%xmm5
+
+	vmovdqu	%xmm5,(%rsi)
+
+	addq	$16,%rdi
+	addq	$16,%rsi
+
+	subq	$1,%r10
+	jne	L$256_enc_msg_x4_loop2
+
+L$256_enc_msg_x4_out:
+	.byte	0xf3,0xc3
+
+
+.globl	_aes256gcmsiv_enc_msg_x8
+.private_extern _aes256gcmsiv_enc_msg_x8
+
+.p2align	4
+_aes256gcmsiv_enc_msg_x8:
+
+	testq	%r8,%r8
+	jnz	L$256_enc_msg_x8_start
+	.byte	0xf3,0xc3
+
+L$256_enc_msg_x8_start:
+
+	movq	%rsp,%r11
+	subq	$16,%r11
+	andq	$-64,%r11
+
+	movq	%r8,%r10
+	shrq	$4,%r8
+	shlq	$60,%r10
+	jz	L$256_enc_msg_x8_start2
+	addq	$1,%r8
+
+L$256_enc_msg_x8_start2:
+	movq	%r8,%r10
+	shlq	$61,%r10
+	shrq	$61,%r10
+
+
+	vmovdqa	(%rdx),%xmm1
+	vpor	OR_MASK(%rip),%xmm1,%xmm1
+
+
+	vpaddd	seven(%rip),%xmm1,%xmm0
+	vmovdqa	%xmm0,(%r11)
+	vpaddd	one(%rip),%xmm1,%xmm9
+	vpaddd	two(%rip),%xmm1,%xmm10
+	vpaddd	three(%rip),%xmm1,%xmm11
+	vpaddd	four(%rip),%xmm1,%xmm12
+	vpaddd	five(%rip),%xmm1,%xmm13
+	vpaddd	six(%rip),%xmm1,%xmm14
+	vmovdqa	%xmm1,%xmm0
+
+	shrq	$3,%r8
+	jz	L$256_enc_msg_x8_check_remainder
+
+	subq	$128,%rsi
+	subq	$128,%rdi
+
+L$256_enc_msg_x8_loop1:
+	addq	$128,%rsi
+	addq	$128,%rdi
+
+	vmovdqa	%xmm0,%xmm1
+	vmovdqa	%xmm9,%xmm2
+	vmovdqa	%xmm10,%xmm3
+	vmovdqa	%xmm11,%xmm4
+	vmovdqa	%xmm12,%xmm5
+	vmovdqa	%xmm13,%xmm6
+	vmovdqa	%xmm14,%xmm7
+
+	vmovdqa	(%r11),%xmm8
+
+	vpxor	(%rcx),%xmm1,%xmm1
+	vpxor	(%rcx),%xmm2,%xmm2
+	vpxor	(%rcx),%xmm3,%xmm3
+	vpxor	(%rcx),%xmm4,%xmm4
+	vpxor	(%rcx),%xmm5,%xmm5
+	vpxor	(%rcx),%xmm6,%xmm6
+	vpxor	(%rcx),%xmm7,%xmm7
+	vpxor	(%rcx),%xmm8,%xmm8
+
+	vmovdqu	16(%rcx),%xmm15
+	vaesenc	%xmm15,%xmm1,%xmm1
+	vaesenc	%xmm15,%xmm2,%xmm2
+	vaesenc	%xmm15,%xmm3,%xmm3
+	vaesenc	%xmm15,%xmm4,%xmm4
+	vaesenc	%xmm15,%xmm5,%xmm5
+	vaesenc	%xmm15,%xmm6,%xmm6
+	vaesenc	%xmm15,%xmm7,%xmm7
+	vaesenc	%xmm15,%xmm8,%xmm8
+
+	vmovdqa	(%r11),%xmm14
+	vpaddd	eight(%rip),%xmm14,%xmm14
+	vmovdqa	%xmm14,(%r11)
+	vmovdqu	32(%rcx),%xmm15
+	vaesenc	%xmm15,%xmm1,%xmm1
+	vaesenc	%xmm15,%xmm2,%xmm2
+	vaesenc	%xmm15,%xmm3,%xmm3
+	vaesenc	%xmm15,%xmm4,%xmm4
+	vaesenc	%xmm15,%xmm5,%xmm5
+	vaesenc	%xmm15,%xmm6,%xmm6
+	vaesenc	%xmm15,%xmm7,%xmm7
+	vaesenc	%xmm15,%xmm8,%xmm8
+
+	vpsubd	one(%rip),%xmm14,%xmm14
+	vmovdqu	48(%rcx),%xmm15
+	vaesenc	%xmm15,%xmm1,%xmm1
+	vaesenc	%xmm15,%xmm2,%xmm2
+	vaesenc	%xmm15,%xmm3,%xmm3
+	vaesenc	%xmm15,%xmm4,%xmm4
+	vaesenc	%xmm15,%xmm5,%xmm5
+	vaesenc	%xmm15,%xmm6,%xmm6
+	vaesenc	%xmm15,%xmm7,%xmm7
+	vaesenc	%xmm15,%xmm8,%xmm8
+
+	vpaddd	eight(%rip),%xmm0,%xmm0
+	vmovdqu	64(%rcx),%xmm15
+	vaesenc	%xmm15,%xmm1,%xmm1
+	vaesenc	%xmm15,%xmm2,%xmm2
+	vaesenc	%xmm15,%xmm3,%xmm3
+	vaesenc	%xmm15,%xmm4,%xmm4
+	vaesenc	%xmm15,%xmm5,%xmm5
+	vaesenc	%xmm15,%xmm6,%xmm6
+	vaesenc	%xmm15,%xmm7,%xmm7
+	vaesenc	%xmm15,%xmm8,%xmm8
+
+	vpaddd	eight(%rip),%xmm9,%xmm9
+	vmovdqu	80(%rcx),%xmm15
+	vaesenc	%xmm15,%xmm1,%xmm1
+	vaesenc	%xmm15,%xmm2,%xmm2
+	vaesenc	%xmm15,%xmm3,%xmm3
+	vaesenc	%xmm15,%xmm4,%xmm4
+	vaesenc	%xmm15,%xmm5,%xmm5
+	vaesenc	%xmm15,%xmm6,%xmm6
+	vaesenc	%xmm15,%xmm7,%xmm7
+	vaesenc	%xmm15,%xmm8,%xmm8
+
+	vpaddd	eight(%rip),%xmm10,%xmm10
+	vmovdqu	96(%rcx),%xmm15
+	vaesenc	%xmm15,%xmm1,%xmm1
+	vaesenc	%xmm15,%xmm2,%xmm2
+	vaesenc	%xmm15,%xmm3,%xmm3
+	vaesenc	%xmm15,%xmm4,%xmm4
+	vaesenc	%xmm15,%xmm5,%xmm5
+	vaesenc	%xmm15,%xmm6,%xmm6
+	vaesenc	%xmm15,%xmm7,%xmm7
+	vaesenc	%xmm15,%xmm8,%xmm8
+
+	vpaddd	eight(%rip),%xmm11,%xmm11
+	vmovdqu	112(%rcx),%xmm15
+	vaesenc	%xmm15,%xmm1,%xmm1
+	vaesenc	%xmm15,%xmm2,%xmm2
+	vaesenc	%xmm15,%xmm3,%xmm3
+	vaesenc	%xmm15,%xmm4,%xmm4
+	vaesenc	%xmm15,%xmm5,%xmm5
+	vaesenc	%xmm15,%xmm6,%xmm6
+	vaesenc	%xmm15,%xmm7,%xmm7
+	vaesenc	%xmm15,%xmm8,%xmm8
+
+	vpaddd	eight(%rip),%xmm12,%xmm12
+	vmovdqu	128(%rcx),%xmm15
+	vaesenc	%xmm15,%xmm1,%xmm1
+	vaesenc	%xmm15,%xmm2,%xmm2
+	vaesenc	%xmm15,%xmm3,%xmm3
+	vaesenc	%xmm15,%xmm4,%xmm4
+	vaesenc	%xmm15,%xmm5,%xmm5
+	vaesenc	%xmm15,%xmm6,%xmm6
+	vaesenc	%xmm15,%xmm7,%xmm7
+	vaesenc	%xmm15,%xmm8,%xmm8
+
+	vpaddd	eight(%rip),%xmm13,%xmm13
+	vmovdqu	144(%rcx),%xmm15
+	vaesenc	%xmm15,%xmm1,%xmm1
+	vaesenc	%xmm15,%xmm2,%xmm2
+	vaesenc	%xmm15,%xmm3,%xmm3
+	vaesenc	%xmm15,%xmm4,%xmm4
+	vaesenc	%xmm15,%xmm5,%xmm5
+	vaesenc	%xmm15,%xmm6,%xmm6
+	vaesenc	%xmm15,%xmm7,%xmm7
+	vaesenc	%xmm15,%xmm8,%xmm8
+
+	vmovdqu	160(%rcx),%xmm15
+	vaesenc	%xmm15,%xmm1,%xmm1
+	vaesenc	%xmm15,%xmm2,%xmm2
+	vaesenc	%xmm15,%xmm3,%xmm3
+	vaesenc	%xmm15,%xmm4,%xmm4
+	vaesenc	%xmm15,%xmm5,%xmm5
+	vaesenc	%xmm15,%xmm6,%xmm6
+	vaesenc	%xmm15,%xmm7,%xmm7
+	vaesenc	%xmm15,%xmm8,%xmm8
+
+	vmovdqu	176(%rcx),%xmm15
+	vaesenc	%xmm15,%xmm1,%xmm1
+	vaesenc	%xmm15,%xmm2,%xmm2
+	vaesenc	%xmm15,%xmm3,%xmm3
+	vaesenc	%xmm15,%xmm4,%xmm4
+	vaesenc	%xmm15,%xmm5,%xmm5
+	vaesenc	%xmm15,%xmm6,%xmm6
+	vaesenc	%xmm15,%xmm7,%xmm7
+	vaesenc	%xmm15,%xmm8,%xmm8
+
+	vmovdqu	192(%rcx),%xmm15
+	vaesenc	%xmm15,%xmm1,%xmm1
+	vaesenc	%xmm15,%xmm2,%xmm2
+	vaesenc	%xmm15,%xmm3,%xmm3
+	vaesenc	%xmm15,%xmm4,%xmm4
+	vaesenc	%xmm15,%xmm5,%xmm5
+	vaesenc	%xmm15,%xmm6,%xmm6
+	vaesenc	%xmm15,%xmm7,%xmm7
+	vaesenc	%xmm15,%xmm8,%xmm8
+
+	vmovdqu	208(%rcx),%xmm15
+	vaesenc	%xmm15,%xmm1,%xmm1
+	vaesenc	%xmm15,%xmm2,%xmm2
+	vaesenc	%xmm15,%xmm3,%xmm3
+	vaesenc	%xmm15,%xmm4,%xmm4
+	vaesenc	%xmm15,%xmm5,%xmm5
+	vaesenc	%xmm15,%xmm6,%xmm6
+	vaesenc	%xmm15,%xmm7,%xmm7
+	vaesenc	%xmm15,%xmm8,%xmm8
+
+	vmovdqu	224(%rcx),%xmm15
+	vaesenclast	%xmm15,%xmm1,%xmm1
+	vaesenclast	%xmm15,%xmm2,%xmm2
+	vaesenclast	%xmm15,%xmm3,%xmm3
+	vaesenclast	%xmm15,%xmm4,%xmm4
+	vaesenclast	%xmm15,%xmm5,%xmm5
+	vaesenclast	%xmm15,%xmm6,%xmm6
+	vaesenclast	%xmm15,%xmm7,%xmm7
+	vaesenclast	%xmm15,%xmm8,%xmm8
+
+
+
+	vpxor	0(%rdi),%xmm1,%xmm1
+	vpxor	16(%rdi),%xmm2,%xmm2
+	vpxor	32(%rdi),%xmm3,%xmm3
+	vpxor	48(%rdi),%xmm4,%xmm4
+	vpxor	64(%rdi),%xmm5,%xmm5
+	vpxor	80(%rdi),%xmm6,%xmm6
+	vpxor	96(%rdi),%xmm7,%xmm7
+	vpxor	112(%rdi),%xmm8,%xmm8
+
+	subq	$1,%r8
+
+	vmovdqu	%xmm1,0(%rsi)
+	vmovdqu	%xmm2,16(%rsi)
+	vmovdqu	%xmm3,32(%rsi)
+	vmovdqu	%xmm4,48(%rsi)
+	vmovdqu	%xmm5,64(%rsi)
+	vmovdqu	%xmm6,80(%rsi)
+	vmovdqu	%xmm7,96(%rsi)
+	vmovdqu	%xmm8,112(%rsi)
+
+	jne	L$256_enc_msg_x8_loop1
+
+	addq	$128,%rsi
+	addq	$128,%rdi
+
+L$256_enc_msg_x8_check_remainder:
+	cmpq	$0,%r10
+	je	L$256_enc_msg_x8_out
+
+L$256_enc_msg_x8_loop2:
+
+
+	vmovdqa	%xmm0,%xmm1
+	vpaddd	one(%rip),%xmm0,%xmm0
+
+	vpxor	(%rcx),%xmm1,%xmm1
+	vaesenc	16(%rcx),%xmm1,%xmm1
+	vaesenc	32(%rcx),%xmm1,%xmm1
+	vaesenc	48(%rcx),%xmm1,%xmm1
+	vaesenc	64(%rcx),%xmm1,%xmm1
+	vaesenc	80(%rcx),%xmm1,%xmm1
+	vaesenc	96(%rcx),%xmm1,%xmm1
+	vaesenc	112(%rcx),%xmm1,%xmm1
+	vaesenc	128(%rcx),%xmm1,%xmm1
+	vaesenc	144(%rcx),%xmm1,%xmm1
+	vaesenc	160(%rcx),%xmm1,%xmm1
+	vaesenc	176(%rcx),%xmm1,%xmm1
+	vaesenc	192(%rcx),%xmm1,%xmm1
+	vaesenc	208(%rcx),%xmm1,%xmm1
+	vaesenclast	224(%rcx),%xmm1,%xmm1
+
+
+	vpxor	(%rdi),%xmm1,%xmm1
+
+	vmovdqu	%xmm1,(%rsi)
+
+	addq	$16,%rdi
+	addq	$16,%rsi
+	subq	$1,%r10
+	jnz	L$256_enc_msg_x8_loop2
+
+L$256_enc_msg_x8_out:
+	.byte	0xf3,0xc3
+
+
+
+.globl	_aes256gcmsiv_dec
+.private_extern _aes256gcmsiv_dec
+
+.p2align	4
+_aes256gcmsiv_dec:
+
+	testq	$~15,%r9
+	jnz	L$256_dec_start
+	.byte	0xf3,0xc3
+
+L$256_dec_start:
+	vzeroupper
+	vmovdqa	(%rdx),%xmm0
+	movq	%rdx,%rax
+
+	leaq	32(%rax),%rax
+	leaq	32(%rcx),%rcx
+
+
+	vmovdqu	(%rdi,%r9,1),%xmm15
+	vpor	OR_MASK(%rip),%xmm15,%xmm15
+	andq	$~15,%r9
+
+
+	cmpq	$96,%r9
+	jb	L$256_dec_loop2
+
+
+	subq	$96,%r9
+	vmovdqa	%xmm15,%xmm7
+	vpaddd	one(%rip),%xmm7,%xmm8
+	vpaddd	two(%rip),%xmm7,%xmm9
+	vpaddd	one(%rip),%xmm9,%xmm10
+	vpaddd	two(%rip),%xmm9,%xmm11
+	vpaddd	one(%rip),%xmm11,%xmm12
+	vpaddd	two(%rip),%xmm11,%xmm15
+
+	vpxor	(%r8),%xmm7,%xmm7
+	vpxor	(%r8),%xmm8,%xmm8
+	vpxor	(%r8),%xmm9,%xmm9
+	vpxor	(%r8),%xmm10,%xmm10
+	vpxor	(%r8),%xmm11,%xmm11
+	vpxor	(%r8),%xmm12,%xmm12
+
+	vmovdqu	16(%r8),%xmm4
+	vaesenc	%xmm4,%xmm7,%xmm7
+	vaesenc	%xmm4,%xmm8,%xmm8
+	vaesenc	%xmm4,%xmm9,%xmm9
+	vaesenc	%xmm4,%xmm10,%xmm10
+	vaesenc	%xmm4,%xmm11,%xmm11
+	vaesenc	%xmm4,%xmm12,%xmm12
+
+	vmovdqu	32(%r8),%xmm4
+	vaesenc	%xmm4,%xmm7,%xmm7
+	vaesenc	%xmm4,%xmm8,%xmm8
+	vaesenc	%xmm4,%xmm9,%xmm9
+	vaesenc	%xmm4,%xmm10,%xmm10
+	vaesenc	%xmm4,%xmm11,%xmm11
+	vaesenc	%xmm4,%xmm12,%xmm12
+
+	vmovdqu	48(%r8),%xmm4
+	vaesenc	%xmm4,%xmm7,%xmm7
+	vaesenc	%xmm4,%xmm8,%xmm8
+	vaesenc	%xmm4,%xmm9,%xmm9
+	vaesenc	%xmm4,%xmm10,%xmm10
+	vaesenc	%xmm4,%xmm11,%xmm11
+	vaesenc	%xmm4,%xmm12,%xmm12
+
+	vmovdqu	64(%r8),%xmm4
+	vaesenc	%xmm4,%xmm7,%xmm7
+	vaesenc	%xmm4,%xmm8,%xmm8
+	vaesenc	%xmm4,%xmm9,%xmm9
+	vaesenc	%xmm4,%xmm10,%xmm10
+	vaesenc	%xmm4,%xmm11,%xmm11
+	vaesenc	%xmm4,%xmm12,%xmm12
+
+	vmovdqu	80(%r8),%xmm4
+	vaesenc	%xmm4,%xmm7,%xmm7
+	vaesenc	%xmm4,%xmm8,%xmm8
+	vaesenc	%xmm4,%xmm9,%xmm9
+	vaesenc	%xmm4,%xmm10,%xmm10
+	vaesenc	%xmm4,%xmm11,%xmm11
+	vaesenc	%xmm4,%xmm12,%xmm12
+
+	vmovdqu	96(%r8),%xmm4
+	vaesenc	%xmm4,%xmm7,%xmm7
+	vaesenc	%xmm4,%xmm8,%xmm8
+	vaesenc	%xmm4,%xmm9,%xmm9
+	vaesenc	%xmm4,%xmm10,%xmm10
+	vaesenc	%xmm4,%xmm11,%xmm11
+	vaesenc	%xmm4,%xmm12,%xmm12
+
+	vmovdqu	112(%r8),%xmm4
+	vaesenc	%xmm4,%xmm7,%xmm7
+	vaesenc	%xmm4,%xmm8,%xmm8
+	vaesenc	%xmm4,%xmm9,%xmm9
+	vaesenc	%xmm4,%xmm10,%xmm10
+	vaesenc	%xmm4,%xmm11,%xmm11
+	vaesenc	%xmm4,%xmm12,%xmm12
+
+	vmovdqu	128(%r8),%xmm4
+	vaesenc	%xmm4,%xmm7,%xmm7
+	vaesenc	%xmm4,%xmm8,%xmm8
+	vaesenc	%xmm4,%xmm9,%xmm9
+	vaesenc	%xmm4,%xmm10,%xmm10
+	vaesenc	%xmm4,%xmm11,%xmm11
+	vaesenc	%xmm4,%xmm12,%xmm12
+
+	vmovdqu	144(%r8),%xmm4
+	vaesenc	%xmm4,%xmm7,%xmm7
+	vaesenc	%xmm4,%xmm8,%xmm8
+	vaesenc	%xmm4,%xmm9,%xmm9
+	vaesenc	%xmm4,%xmm10,%xmm10
+	vaesenc	%xmm4,%xmm11,%xmm11
+	vaesenc	%xmm4,%xmm12,%xmm12
+
+	vmovdqu	160(%r8),%xmm4
+	vaesenc	%xmm4,%xmm7,%xmm7
+	vaesenc	%xmm4,%xmm8,%xmm8
+	vaesenc	%xmm4,%xmm9,%xmm9
+	vaesenc	%xmm4,%xmm10,%xmm10
+	vaesenc	%xmm4,%xmm11,%xmm11
+	vaesenc	%xmm4,%xmm12,%xmm12
+
+	vmovdqu	176(%r8),%xmm4
+	vaesenc	%xmm4,%xmm7,%xmm7
+	vaesenc	%xmm4,%xmm8,%xmm8
+	vaesenc	%xmm4,%xmm9,%xmm9
+	vaesenc	%xmm4,%xmm10,%xmm10
+	vaesenc	%xmm4,%xmm11,%xmm11
+	vaesenc	%xmm4,%xmm12,%xmm12
+
+	vmovdqu	192(%r8),%xmm4
+	vaesenc	%xmm4,%xmm7,%xmm7
+	vaesenc	%xmm4,%xmm8,%xmm8
+	vaesenc	%xmm4,%xmm9,%xmm9
+	vaesenc	%xmm4,%xmm10,%xmm10
+	vaesenc	%xmm4,%xmm11,%xmm11
+	vaesenc	%xmm4,%xmm12,%xmm12
+
+	vmovdqu	208(%r8),%xmm4
+	vaesenc	%xmm4,%xmm7,%xmm7
+	vaesenc	%xmm4,%xmm8,%xmm8
+	vaesenc	%xmm4,%xmm9,%xmm9
+	vaesenc	%xmm4,%xmm10,%xmm10
+	vaesenc	%xmm4,%xmm11,%xmm11
+	vaesenc	%xmm4,%xmm12,%xmm12
+
+	vmovdqu	224(%r8),%xmm4
+	vaesenclast	%xmm4,%xmm7,%xmm7
+	vaesenclast	%xmm4,%xmm8,%xmm8
+	vaesenclast	%xmm4,%xmm9,%xmm9
+	vaesenclast	%xmm4,%xmm10,%xmm10
+	vaesenclast	%xmm4,%xmm11,%xmm11
+	vaesenclast	%xmm4,%xmm12,%xmm12
+
+
+	vpxor	0(%rdi),%xmm7,%xmm7
+	vpxor	16(%rdi),%xmm8,%xmm8
+	vpxor	32(%rdi),%xmm9,%xmm9
+	vpxor	48(%rdi),%xmm10,%xmm10
+	vpxor	64(%rdi),%xmm11,%xmm11
+	vpxor	80(%rdi),%xmm12,%xmm12
+
+	vmovdqu	%xmm7,0(%rsi)
+	vmovdqu	%xmm8,16(%rsi)
+	vmovdqu	%xmm9,32(%rsi)
+	vmovdqu	%xmm10,48(%rsi)
+	vmovdqu	%xmm11,64(%rsi)
+	vmovdqu	%xmm12,80(%rsi)
+
+	addq	$96,%rdi
+	addq	$96,%rsi
+	jmp	L$256_dec_loop1
+
+
+.p2align	6
+L$256_dec_loop1:
+	cmpq	$96,%r9
+	jb	L$256_dec_finish_96
+	subq	$96,%r9
+
+	vmovdqa	%xmm12,%xmm6
+	vmovdqa	%xmm11,16-32(%rax)
+	vmovdqa	%xmm10,32-32(%rax)
+	vmovdqa	%xmm9,48-32(%rax)
+	vmovdqa	%xmm8,64-32(%rax)
+	vmovdqa	%xmm7,80-32(%rax)
+
+	vmovdqa	%xmm15,%xmm7
+	vpaddd	one(%rip),%xmm7,%xmm8
+	vpaddd	two(%rip),%xmm7,%xmm9
+	vpaddd	one(%rip),%xmm9,%xmm10
+	vpaddd	two(%rip),%xmm9,%xmm11
+	vpaddd	one(%rip),%xmm11,%xmm12
+	vpaddd	two(%rip),%xmm11,%xmm15
+
+	vmovdqa	(%r8),%xmm4
+	vpxor	%xmm4,%xmm7,%xmm7
+	vpxor	%xmm4,%xmm8,%xmm8
+	vpxor	%xmm4,%xmm9,%xmm9
+	vpxor	%xmm4,%xmm10,%xmm10
+	vpxor	%xmm4,%xmm11,%xmm11
+	vpxor	%xmm4,%xmm12,%xmm12
+
+	vmovdqu	0-32(%rcx),%xmm4
+	vpclmulqdq	$0x11,%xmm4,%xmm6,%xmm2
+	vpclmulqdq	$0x00,%xmm4,%xmm6,%xmm3
+	vpclmulqdq	$0x01,%xmm4,%xmm6,%xmm1
+	vpclmulqdq	$0x10,%xmm4,%xmm6,%xmm4
+	vpxor	%xmm4,%xmm1,%xmm1
+
+	vmovdqu	16(%r8),%xmm4
+	vaesenc	%xmm4,%xmm7,%xmm7
+	vaesenc	%xmm4,%xmm8,%xmm8
+	vaesenc	%xmm4,%xmm9,%xmm9
+	vaesenc	%xmm4,%xmm10,%xmm10
+	vaesenc	%xmm4,%xmm11,%xmm11
+	vaesenc	%xmm4,%xmm12,%xmm12
+
+	vmovdqu	-16(%rax),%xmm6
+	vmovdqu	-16(%rcx),%xmm13
+
+	vpclmulqdq	$0x10,%xmm13,%xmm6,%xmm4
+	vpxor	%xmm4,%xmm1,%xmm1
+	vpclmulqdq	$0x11,%xmm13,%xmm6,%xmm4
+	vpxor	%xmm4,%xmm2,%xmm2
+	vpclmulqdq	$0x00,%xmm13,%xmm6,%xmm4
+	vpxor	%xmm4,%xmm3,%xmm3
+	vpclmulqdq	$0x01,%xmm13,%xmm6,%xmm4
+	vpxor	%xmm4,%xmm1,%xmm1
+
+
+	vmovdqu	32(%r8),%xmm4
+	vaesenc	%xmm4,%xmm7,%xmm7
+	vaesenc	%xmm4,%xmm8,%xmm8
+	vaesenc	%xmm4,%xmm9,%xmm9
+	vaesenc	%xmm4,%xmm10,%xmm10
+	vaesenc	%xmm4,%xmm11,%xmm11
+	vaesenc	%xmm4,%xmm12,%xmm12
+
+	vmovdqu	0(%rax),%xmm6
+	vmovdqu	0(%rcx),%xmm13
+
+	vpclmulqdq	$0x10,%xmm13,%xmm6,%xmm4
+	vpxor	%xmm4,%xmm1,%xmm1
+	vpclmulqdq	$0x11,%xmm13,%xmm6,%xmm4
+	vpxor	%xmm4,%xmm2,%xmm2
+	vpclmulqdq	$0x00,%xmm13,%xmm6,%xmm4
+	vpxor	%xmm4,%xmm3,%xmm3
+	vpclmulqdq	$0x01,%xmm13,%xmm6,%xmm4
+	vpxor	%xmm4,%xmm1,%xmm1
+
+
+	vmovdqu	48(%r8),%xmm4
+	vaesenc	%xmm4,%xmm7,%xmm7
+	vaesenc	%xmm4,%xmm8,%xmm8
+	vaesenc	%xmm4,%xmm9,%xmm9
+	vaesenc	%xmm4,%xmm10,%xmm10
+	vaesenc	%xmm4,%xmm11,%xmm11
+	vaesenc	%xmm4,%xmm12,%xmm12
+
+	vmovdqu	16(%rax),%xmm6
+	vmovdqu	16(%rcx),%xmm13
+
+	vpclmulqdq	$0x10,%xmm13,%xmm6,%xmm4
+	vpxor	%xmm4,%xmm1,%xmm1
+	vpclmulqdq	$0x11,%xmm13,%xmm6,%xmm4
+	vpxor	%xmm4,%xmm2,%xmm2
+	vpclmulqdq	$0x00,%xmm13,%xmm6,%xmm4
+	vpxor	%xmm4,%xmm3,%xmm3
+	vpclmulqdq	$0x01,%xmm13,%xmm6,%xmm4
+	vpxor	%xmm4,%xmm1,%xmm1
+
+
+	vmovdqu	64(%r8),%xmm4
+	vaesenc	%xmm4,%xmm7,%xmm7
+	vaesenc	%xmm4,%xmm8,%xmm8
+	vaesenc	%xmm4,%xmm9,%xmm9
+	vaesenc	%xmm4,%xmm10,%xmm10
+	vaesenc	%xmm4,%xmm11,%xmm11
+	vaesenc	%xmm4,%xmm12,%xmm12
+
+	vmovdqu	32(%rax),%xmm6
+	vmovdqu	32(%rcx),%xmm13
+
+	vpclmulqdq	$0x10,%xmm13,%xmm6,%xmm4
+	vpxor	%xmm4,%xmm1,%xmm1
+	vpclmulqdq	$0x11,%xmm13,%xmm6,%xmm4
+	vpxor	%xmm4,%xmm2,%xmm2
+	vpclmulqdq	$0x00,%xmm13,%xmm6,%xmm4
+	vpxor	%xmm4,%xmm3,%xmm3
+	vpclmulqdq	$0x01,%xmm13,%xmm6,%xmm4
+	vpxor	%xmm4,%xmm1,%xmm1
+
+
+	vmovdqu	80(%r8),%xmm4
+	vaesenc	%xmm4,%xmm7,%xmm7
+	vaesenc	%xmm4,%xmm8,%xmm8
+	vaesenc	%xmm4,%xmm9,%xmm9
+	vaesenc	%xmm4,%xmm10,%xmm10
+	vaesenc	%xmm4,%xmm11,%xmm11
+	vaesenc	%xmm4,%xmm12,%xmm12
+
+	vmovdqu	96(%r8),%xmm4
+	vaesenc	%xmm4,%xmm7,%xmm7
+	vaesenc	%xmm4,%xmm8,%xmm8
+	vaesenc	%xmm4,%xmm9,%xmm9
+	vaesenc	%xmm4,%xmm10,%xmm10
+	vaesenc	%xmm4,%xmm11,%xmm11
+	vaesenc	%xmm4,%xmm12,%xmm12
+
+	vmovdqu	112(%r8),%xmm4
+	vaesenc	%xmm4,%xmm7,%xmm7
+	vaesenc	%xmm4,%xmm8,%xmm8
+	vaesenc	%xmm4,%xmm9,%xmm9
+	vaesenc	%xmm4,%xmm10,%xmm10
+	vaesenc	%xmm4,%xmm11,%xmm11
+	vaesenc	%xmm4,%xmm12,%xmm12
+
+
+	vmovdqa	80-32(%rax),%xmm6
+	vpxor	%xmm0,%xmm6,%xmm6
+	vmovdqu	80-32(%rcx),%xmm5
+
+	vpclmulqdq	$0x01,%xmm5,%xmm6,%xmm4
+	vpxor	%xmm4,%xmm1,%xmm1
+	vpclmulqdq	$0x11,%xmm5,%xmm6,%xmm4
+	vpxor	%xmm4,%xmm2,%xmm2
+	vpclmulqdq	$0x00,%xmm5,%xmm6,%xmm4
+	vpxor	%xmm4,%xmm3,%xmm3
+	vpclmulqdq	$0x10,%xmm5,%xmm6,%xmm4
+	vpxor	%xmm4,%xmm1,%xmm1
+
+	vmovdqu	128(%r8),%xmm4
+	vaesenc	%xmm4,%xmm7,%xmm7
+	vaesenc	%xmm4,%xmm8,%xmm8
+	vaesenc	%xmm4,%xmm9,%xmm9
+	vaesenc	%xmm4,%xmm10,%xmm10
+	vaesenc	%xmm4,%xmm11,%xmm11
+	vaesenc	%xmm4,%xmm12,%xmm12
+
+
+	vpsrldq	$8,%xmm1,%xmm4
+	vpxor	%xmm4,%xmm2,%xmm5
+	vpslldq	$8,%xmm1,%xmm4
+	vpxor	%xmm4,%xmm3,%xmm0
+
+	vmovdqa	poly(%rip),%xmm3
+
+	vmovdqu	144(%r8),%xmm4
+	vaesenc	%xmm4,%xmm7,%xmm7
+	vaesenc	%xmm4,%xmm8,%xmm8
+	vaesenc	%xmm4,%xmm9,%xmm9
+	vaesenc	%xmm4,%xmm10,%xmm10
+	vaesenc	%xmm4,%xmm11,%xmm11
+	vaesenc	%xmm4,%xmm12,%xmm12
+
+	vmovdqu	160(%r8),%xmm4
+	vaesenc	%xmm4,%xmm7,%xmm7
+	vaesenc	%xmm4,%xmm8,%xmm8
+	vaesenc	%xmm4,%xmm9,%xmm9
+	vaesenc	%xmm4,%xmm10,%xmm10
+	vaesenc	%xmm4,%xmm11,%xmm11
+	vaesenc	%xmm4,%xmm12,%xmm12
+
+	vmovdqu	176(%r8),%xmm4
+	vaesenc	%xmm4,%xmm7,%xmm7
+	vaesenc	%xmm4,%xmm8,%xmm8
+	vaesenc	%xmm4,%xmm9,%xmm9
+	vaesenc	%xmm4,%xmm10,%xmm10
+	vaesenc	%xmm4,%xmm11,%xmm11
+	vaesenc	%xmm4,%xmm12,%xmm12
+
+	vmovdqu	192(%r8),%xmm4
+	vaesenc	%xmm4,%xmm7,%xmm7
+	vaesenc	%xmm4,%xmm8,%xmm8
+	vaesenc	%xmm4,%xmm9,%xmm9
+	vaesenc	%xmm4,%xmm10,%xmm10
+	vaesenc	%xmm4,%xmm11,%xmm11
+	vaesenc	%xmm4,%xmm12,%xmm12
+
+	vmovdqu	208(%r8),%xmm4
+	vaesenc	%xmm4,%xmm7,%xmm7
+	vaesenc	%xmm4,%xmm8,%xmm8
+	vaesenc	%xmm4,%xmm9,%xmm9
+	vaesenc	%xmm4,%xmm10,%xmm10
+	vaesenc	%xmm4,%xmm11,%xmm11
+	vaesenc	%xmm4,%xmm12,%xmm12
+
+	vmovdqu	224(%r8),%xmm6
+	vpalignr	$8,%xmm0,%xmm0,%xmm2
+	vpclmulqdq	$0x10,%xmm3,%xmm0,%xmm0
+	vpxor	%xmm0,%xmm2,%xmm0
+
+	vpxor	0(%rdi),%xmm6,%xmm4
+	vaesenclast	%xmm4,%xmm7,%xmm7
+	vpxor	16(%rdi),%xmm6,%xmm4
+	vaesenclast	%xmm4,%xmm8,%xmm8
+	vpxor	32(%rdi),%xmm6,%xmm4
+	vaesenclast	%xmm4,%xmm9,%xmm9
+	vpxor	48(%rdi),%xmm6,%xmm4
+	vaesenclast	%xmm4,%xmm10,%xmm10
+	vpxor	64(%rdi),%xmm6,%xmm4
+	vaesenclast	%xmm4,%xmm11,%xmm11
+	vpxor	80(%rdi),%xmm6,%xmm4
+	vaesenclast	%xmm4,%xmm12,%xmm12
+
+	vpalignr	$8,%xmm0,%xmm0,%xmm2
+	vpclmulqdq	$0x10,%xmm3,%xmm0,%xmm0
+	vpxor	%xmm0,%xmm2,%xmm0
+
+	vmovdqu	%xmm7,0(%rsi)
+	vmovdqu	%xmm8,16(%rsi)
+	vmovdqu	%xmm9,32(%rsi)
+	vmovdqu	%xmm10,48(%rsi)
+	vmovdqu	%xmm11,64(%rsi)
+	vmovdqu	%xmm12,80(%rsi)
+
+	vpxor	%xmm5,%xmm0,%xmm0
+
+	leaq	96(%rdi),%rdi
+	leaq	96(%rsi),%rsi
+	jmp	L$256_dec_loop1
+
+L$256_dec_finish_96:
+	vmovdqa	%xmm12,%xmm6
+	vmovdqa	%xmm11,16-32(%rax)
+	vmovdqa	%xmm10,32-32(%rax)
+	vmovdqa	%xmm9,48-32(%rax)
+	vmovdqa	%xmm8,64-32(%rax)
+	vmovdqa	%xmm7,80-32(%rax)
+
+	vmovdqu	0-32(%rcx),%xmm4
+	vpclmulqdq	$0x10,%xmm4,%xmm6,%xmm1
+	vpclmulqdq	$0x11,%xmm4,%xmm6,%xmm2
+	vpclmulqdq	$0x00,%xmm4,%xmm6,%xmm3
+	vpclmulqdq	$0x01,%xmm4,%xmm6,%xmm4
+	vpxor	%xmm4,%xmm1,%xmm1
+
+	vmovdqu	-16(%rax),%xmm6
+	vmovdqu	-16(%rcx),%xmm13
+
+	vpclmulqdq	$0x10,%xmm13,%xmm6,%xmm4
+	vpxor	%xmm4,%xmm1,%xmm1
+	vpclmulqdq	$0x11,%xmm13,%xmm6,%xmm4
+	vpxor	%xmm4,%xmm2,%xmm2
+	vpclmulqdq	$0x00,%xmm13,%xmm6,%xmm4
+	vpxor	%xmm4,%xmm3,%xmm3
+	vpclmulqdq	$0x01,%xmm13,%xmm6,%xmm4
+	vpxor	%xmm4,%xmm1,%xmm1
+
+	vmovdqu	0(%rax),%xmm6
+	vmovdqu	0(%rcx),%xmm13
+
+	vpclmulqdq	$0x10,%xmm13,%xmm6,%xmm4
+	vpxor	%xmm4,%xmm1,%xmm1
+	vpclmulqdq	$0x11,%xmm13,%xmm6,%xmm4
+	vpxor	%xmm4,%xmm2,%xmm2
+	vpclmulqdq	$0x00,%xmm13,%xmm6,%xmm4
+	vpxor	%xmm4,%xmm3,%xmm3
+	vpclmulqdq	$0x01,%xmm13,%xmm6,%xmm4
+	vpxor	%xmm4,%xmm1,%xmm1
+
+	vmovdqu	16(%rax),%xmm6
+	vmovdqu	16(%rcx),%xmm13
+
+	vpclmulqdq	$0x10,%xmm13,%xmm6,%xmm4
+	vpxor	%xmm4,%xmm1,%xmm1
+	vpclmulqdq	$0x11,%xmm13,%xmm6,%xmm4
+	vpxor	%xmm4,%xmm2,%xmm2
+	vpclmulqdq	$0x00,%xmm13,%xmm6,%xmm4
+	vpxor	%xmm4,%xmm3,%xmm3
+	vpclmulqdq	$0x01,%xmm13,%xmm6,%xmm4
+	vpxor	%xmm4,%xmm1,%xmm1
+
+	vmovdqu	32(%rax),%xmm6
+	vmovdqu	32(%rcx),%xmm13
+
+	vpclmulqdq	$0x10,%xmm13,%xmm6,%xmm4
+	vpxor	%xmm4,%xmm1,%xmm1
+	vpclmulqdq	$0x11,%xmm13,%xmm6,%xmm4
+	vpxor	%xmm4,%xmm2,%xmm2
+	vpclmulqdq	$0x00,%xmm13,%xmm6,%xmm4
+	vpxor	%xmm4,%xmm3,%xmm3
+	vpclmulqdq	$0x01,%xmm13,%xmm6,%xmm4
+	vpxor	%xmm4,%xmm1,%xmm1
+
+
+	vmovdqu	80-32(%rax),%xmm6
+	vpxor	%xmm0,%xmm6,%xmm6
+	vmovdqu	80-32(%rcx),%xmm5
+	vpclmulqdq	$0x11,%xmm5,%xmm6,%xmm4
+	vpxor	%xmm4,%xmm2,%xmm2
+	vpclmulqdq	$0x00,%xmm5,%xmm6,%xmm4
+	vpxor	%xmm4,%xmm3,%xmm3
+	vpclmulqdq	$0x10,%xmm5,%xmm6,%xmm4
+	vpxor	%xmm4,%xmm1,%xmm1
+	vpclmulqdq	$0x01,%xmm5,%xmm6,%xmm4
+	vpxor	%xmm4,%xmm1,%xmm1
+
+	vpsrldq	$8,%xmm1,%xmm4
+	vpxor	%xmm4,%xmm2,%xmm5
+	vpslldq	$8,%xmm1,%xmm4
+	vpxor	%xmm4,%xmm3,%xmm0
+
+	vmovdqa	poly(%rip),%xmm3
+
+	vpalignr	$8,%xmm0,%xmm0,%xmm2
+	vpclmulqdq	$0x10,%xmm3,%xmm0,%xmm0
+	vpxor	%xmm0,%xmm2,%xmm0
+
+	vpalignr	$8,%xmm0,%xmm0,%xmm2
+	vpclmulqdq	$0x10,%xmm3,%xmm0,%xmm0
+	vpxor	%xmm0,%xmm2,%xmm0
+
+	vpxor	%xmm5,%xmm0,%xmm0
+
+L$256_dec_loop2:
+
+
+
+	cmpq	$16,%r9
+	jb	L$256_dec_out
+	subq	$16,%r9
+
+	vmovdqa	%xmm15,%xmm2
+	vpaddd	one(%rip),%xmm15,%xmm15
+
+	vpxor	0(%r8),%xmm2,%xmm2
+	vaesenc	16(%r8),%xmm2,%xmm2
+	vaesenc	32(%r8),%xmm2,%xmm2
+	vaesenc	48(%r8),%xmm2,%xmm2
+	vaesenc	64(%r8),%xmm2,%xmm2
+	vaesenc	80(%r8),%xmm2,%xmm2
+	vaesenc	96(%r8),%xmm2,%xmm2
+	vaesenc	112(%r8),%xmm2,%xmm2
+	vaesenc	128(%r8),%xmm2,%xmm2
+	vaesenc	144(%r8),%xmm2,%xmm2
+	vaesenc	160(%r8),%xmm2,%xmm2
+	vaesenc	176(%r8),%xmm2,%xmm2
+	vaesenc	192(%r8),%xmm2,%xmm2
+	vaesenc	208(%r8),%xmm2,%xmm2
+	vaesenclast	224(%r8),%xmm2,%xmm2
+	vpxor	(%rdi),%xmm2,%xmm2
+	vmovdqu	%xmm2,(%rsi)
+	addq	$16,%rdi
+	addq	$16,%rsi
+
+	vpxor	%xmm2,%xmm0,%xmm0
+	vmovdqa	-32(%rcx),%xmm1
+	call	GFMUL
+
+	jmp	L$256_dec_loop2
+
+L$256_dec_out:
+	vmovdqu	%xmm0,(%rdx)
+	.byte	0xf3,0xc3
+
+
+.globl	_aes256gcmsiv_kdf
+.private_extern _aes256gcmsiv_kdf
+
+.p2align	4
+_aes256gcmsiv_kdf:
+
+
+
+
+
+	vmovdqa	(%rdx),%xmm1
+	vmovdqa	0(%rdi),%xmm4
+	vmovdqa	and_mask(%rip),%xmm11
+	vmovdqa	one(%rip),%xmm8
+	vpshufd	$0x90,%xmm4,%xmm4
+	vpand	%xmm11,%xmm4,%xmm4
+	vpaddd	%xmm8,%xmm4,%xmm6
+	vpaddd	%xmm8,%xmm6,%xmm7
+	vpaddd	%xmm8,%xmm7,%xmm11
+	vpaddd	%xmm8,%xmm11,%xmm12
+	vpaddd	%xmm8,%xmm12,%xmm13
+
+	vpxor	%xmm1,%xmm4,%xmm4
+	vpxor	%xmm1,%xmm6,%xmm6
+	vpxor	%xmm1,%xmm7,%xmm7
+	vpxor	%xmm1,%xmm11,%xmm11
+	vpxor	%xmm1,%xmm12,%xmm12
+	vpxor	%xmm1,%xmm13,%xmm13
+
+	vmovdqa	16(%rdx),%xmm1
+	vaesenc	%xmm1,%xmm4,%xmm4
+	vaesenc	%xmm1,%xmm6,%xmm6
+	vaesenc	%xmm1,%xmm7,%xmm7
+	vaesenc	%xmm1,%xmm11,%xmm11
+	vaesenc	%xmm1,%xmm12,%xmm12
+	vaesenc	%xmm1,%xmm13,%xmm13
+
+	vmovdqa	32(%rdx),%xmm2
+	vaesenc	%xmm2,%xmm4,%xmm4
+	vaesenc	%xmm2,%xmm6,%xmm6
+	vaesenc	%xmm2,%xmm7,%xmm7
+	vaesenc	%xmm2,%xmm11,%xmm11
+	vaesenc	%xmm2,%xmm12,%xmm12
+	vaesenc	%xmm2,%xmm13,%xmm13
+
+	vmovdqa	48(%rdx),%xmm1
+	vaesenc	%xmm1,%xmm4,%xmm4
+	vaesenc	%xmm1,%xmm6,%xmm6
+	vaesenc	%xmm1,%xmm7,%xmm7
+	vaesenc	%xmm1,%xmm11,%xmm11
+	vaesenc	%xmm1,%xmm12,%xmm12
+	vaesenc	%xmm1,%xmm13,%xmm13
+
+	vmovdqa	64(%rdx),%xmm2
+	vaesenc	%xmm2,%xmm4,%xmm4
+	vaesenc	%xmm2,%xmm6,%xmm6
+	vaesenc	%xmm2,%xmm7,%xmm7
+	vaesenc	%xmm2,%xmm11,%xmm11
+	vaesenc	%xmm2,%xmm12,%xmm12
+	vaesenc	%xmm2,%xmm13,%xmm13
+
+	vmovdqa	80(%rdx),%xmm1
+	vaesenc	%xmm1,%xmm4,%xmm4
+	vaesenc	%xmm1,%xmm6,%xmm6
+	vaesenc	%xmm1,%xmm7,%xmm7
+	vaesenc	%xmm1,%xmm11,%xmm11
+	vaesenc	%xmm1,%xmm12,%xmm12
+	vaesenc	%xmm1,%xmm13,%xmm13
+
+	vmovdqa	96(%rdx),%xmm2
+	vaesenc	%xmm2,%xmm4,%xmm4
+	vaesenc	%xmm2,%xmm6,%xmm6
+	vaesenc	%xmm2,%xmm7,%xmm7
+	vaesenc	%xmm2,%xmm11,%xmm11
+	vaesenc	%xmm2,%xmm12,%xmm12
+	vaesenc	%xmm2,%xmm13,%xmm13
+
+	vmovdqa	112(%rdx),%xmm1
+	vaesenc	%xmm1,%xmm4,%xmm4
+	vaesenc	%xmm1,%xmm6,%xmm6
+	vaesenc	%xmm1,%xmm7,%xmm7
+	vaesenc	%xmm1,%xmm11,%xmm11
+	vaesenc	%xmm1,%xmm12,%xmm12
+	vaesenc	%xmm1,%xmm13,%xmm13
+
+	vmovdqa	128(%rdx),%xmm2
+	vaesenc	%xmm2,%xmm4,%xmm4
+	vaesenc	%xmm2,%xmm6,%xmm6
+	vaesenc	%xmm2,%xmm7,%xmm7
+	vaesenc	%xmm2,%xmm11,%xmm11
+	vaesenc	%xmm2,%xmm12,%xmm12
+	vaesenc	%xmm2,%xmm13,%xmm13
+
+	vmovdqa	144(%rdx),%xmm1
+	vaesenc	%xmm1,%xmm4,%xmm4
+	vaesenc	%xmm1,%xmm6,%xmm6
+	vaesenc	%xmm1,%xmm7,%xmm7
+	vaesenc	%xmm1,%xmm11,%xmm11
+	vaesenc	%xmm1,%xmm12,%xmm12
+	vaesenc	%xmm1,%xmm13,%xmm13
+
+	vmovdqa	160(%rdx),%xmm2
+	vaesenc	%xmm2,%xmm4,%xmm4
+	vaesenc	%xmm2,%xmm6,%xmm6
+	vaesenc	%xmm2,%xmm7,%xmm7
+	vaesenc	%xmm2,%xmm11,%xmm11
+	vaesenc	%xmm2,%xmm12,%xmm12
+	vaesenc	%xmm2,%xmm13,%xmm13
+
+	vmovdqa	176(%rdx),%xmm1
+	vaesenc	%xmm1,%xmm4,%xmm4
+	vaesenc	%xmm1,%xmm6,%xmm6
+	vaesenc	%xmm1,%xmm7,%xmm7
+	vaesenc	%xmm1,%xmm11,%xmm11
+	vaesenc	%xmm1,%xmm12,%xmm12
+	vaesenc	%xmm1,%xmm13,%xmm13
+
+	vmovdqa	192(%rdx),%xmm2
+	vaesenc	%xmm2,%xmm4,%xmm4
+	vaesenc	%xmm2,%xmm6,%xmm6
+	vaesenc	%xmm2,%xmm7,%xmm7
+	vaesenc	%xmm2,%xmm11,%xmm11
+	vaesenc	%xmm2,%xmm12,%xmm12
+	vaesenc	%xmm2,%xmm13,%xmm13
+
+	vmovdqa	208(%rdx),%xmm1
+	vaesenc	%xmm1,%xmm4,%xmm4
+	vaesenc	%xmm1,%xmm6,%xmm6
+	vaesenc	%xmm1,%xmm7,%xmm7
+	vaesenc	%xmm1,%xmm11,%xmm11
+	vaesenc	%xmm1,%xmm12,%xmm12
+	vaesenc	%xmm1,%xmm13,%xmm13
+
+	vmovdqa	224(%rdx),%xmm2
+	vaesenclast	%xmm2,%xmm4,%xmm4
+	vaesenclast	%xmm2,%xmm6,%xmm6
+	vaesenclast	%xmm2,%xmm7,%xmm7
+	vaesenclast	%xmm2,%xmm11,%xmm11
+	vaesenclast	%xmm2,%xmm12,%xmm12
+	vaesenclast	%xmm2,%xmm13,%xmm13
+
+
+	vmovdqa	%xmm4,0(%rsi)
+	vmovdqa	%xmm6,16(%rsi)
+	vmovdqa	%xmm7,32(%rsi)
+	vmovdqa	%xmm11,48(%rsi)
+	vmovdqa	%xmm12,64(%rsi)
+	vmovdqa	%xmm13,80(%rsi)
+	.byte	0xf3,0xc3
+
+
+#endif
diff --git a/third_party/boringssl/mac-x86_64/crypto/cipher/chacha20_poly1305_x86_64.S b/third_party/boringssl/mac-x86_64/crypto/cipher_extra/chacha20_poly1305_x86_64.S
similarity index 100%
rename from third_party/boringssl/mac-x86_64/crypto/cipher/chacha20_poly1305_x86_64.S
rename to third_party/boringssl/mac-x86_64/crypto/cipher_extra/chacha20_poly1305_x86_64.S
diff --git a/third_party/boringssl/mac-x86_64/crypto/ec/p256-x86_64-asm.S b/third_party/boringssl/mac-x86_64/crypto/fipsmodule/p256-x86_64-asm.S
similarity index 100%
rename from third_party/boringssl/mac-x86_64/crypto/ec/p256-x86_64-asm.S
rename to third_party/boringssl/mac-x86_64/crypto/fipsmodule/p256-x86_64-asm.S
diff --git a/third_party/boringssl/win-x86_64/crypto/cipher_extra/aes128gcmsiv-x86_64.asm b/third_party/boringssl/win-x86_64/crypto/cipher_extra/aes128gcmsiv-x86_64.asm
new file mode 100644
index 0000000..1c7360d08
--- /dev/null
+++ b/third_party/boringssl/win-x86_64/crypto/cipher_extra/aes128gcmsiv-x86_64.asm
@@ -0,0 +1,3270 @@
+default	rel
+%define XMMWORD
+%define YMMWORD
+%define ZMMWORD
+section	.data data align=8
+
+
+ALIGN	16
+one:
+	DQ	1,0
+two:
+	DQ	2,0
+three:
+	DQ	3,0
+four:
+	DQ	4,0
+five:
+	DQ	5,0
+six:
+	DQ	6,0
+seven:
+	DQ	7,0
+eight:
+	DQ	8,0
+
+OR_MASK:
+	DD	0x00000000,0x00000000,0x00000000,0x80000000
+poly:
+	DQ	0x1,0xc200000000000000
+mask:
+	DD	0x0c0f0e0d,0x0c0f0e0d,0x0c0f0e0d,0x0c0f0e0d
+con1:
+	DD	1,1,1,1
+con2:
+	DD	0x1b,0x1b,0x1b,0x1b
+con3:
+DB	-1,-1,-1,-1,-1,-1,-1,-1,4,5,6,7,4,5,6,7
+and_mask:
+	DD	0,0xffffffff,0xffffffff,0xffffffff
+section	.text code align=64
+
+
+ALIGN	16
+GFMUL:
+
+	vpclmulqdq	xmm2,xmm0,xmm1,0x00
+	vpclmulqdq	xmm5,xmm0,xmm1,0x11
+	vpclmulqdq	xmm3,xmm0,xmm1,0x10
+	vpclmulqdq	xmm4,xmm0,xmm1,0x01
+	vpxor	xmm3,xmm3,xmm4
+	vpslldq	xmm4,xmm3,8
+	vpsrldq	xmm3,xmm3,8
+	vpxor	xmm2,xmm2,xmm4
+	vpxor	xmm5,xmm5,xmm3
+
+	vpclmulqdq	xmm3,xmm2,XMMWORD[poly],0x10
+	vpshufd	xmm4,xmm2,78
+	vpxor	xmm2,xmm3,xmm4
+
+	vpclmulqdq	xmm3,xmm2,XMMWORD[poly],0x10
+	vpshufd	xmm4,xmm2,78
+	vpxor	xmm2,xmm3,xmm4
+
+	vpxor	xmm0,xmm2,xmm5
+	DB	0F3h,0C3h		;repret
+
+
+global	aesgcmsiv_htable_init
+
+ALIGN	16
+aesgcmsiv_htable_init:
+	mov	QWORD[8+rsp],rdi	;WIN64 prologue
+	mov	QWORD[16+rsp],rsi
+	mov	rax,rsp
+$L$SEH_begin_aesgcmsiv_htable_init:
+	mov	rdi,rcx
+	mov	rsi,rdx
+
+
+
+	vmovdqa	xmm0,XMMWORD[rsi]
+	vmovdqa	xmm1,xmm0
+	vmovdqa	XMMWORD[rdi],xmm0
+	call	GFMUL
+	vmovdqa	XMMWORD[16+rdi],xmm0
+	call	GFMUL
+	vmovdqa	XMMWORD[32+rdi],xmm0
+	call	GFMUL
+	vmovdqa	XMMWORD[48+rdi],xmm0
+	call	GFMUL
+	vmovdqa	XMMWORD[64+rdi],xmm0
+	call	GFMUL
+	vmovdqa	XMMWORD[80+rdi],xmm0
+	call	GFMUL
+	vmovdqa	XMMWORD[96+rdi],xmm0
+	call	GFMUL
+	vmovdqa	XMMWORD[112+rdi],xmm0
+	mov	rdi,QWORD[8+rsp]	;WIN64 epilogue
+	mov	rsi,QWORD[16+rsp]
+	DB	0F3h,0C3h		;repret
+
+$L$SEH_end_aesgcmsiv_htable_init:
+global	aesgcmsiv_htable6_init
+
+ALIGN	16
+aesgcmsiv_htable6_init:
+	mov	QWORD[8+rsp],rdi	;WIN64 prologue
+	mov	QWORD[16+rsp],rsi
+	mov	rax,rsp
+$L$SEH_begin_aesgcmsiv_htable6_init:
+	mov	rdi,rcx
+	mov	rsi,rdx
+
+
+
+	vmovdqa	xmm0,XMMWORD[rsi]
+	vmovdqa	xmm1,xmm0
+	vmovdqa	XMMWORD[rdi],xmm0
+	call	GFMUL
+	vmovdqa	XMMWORD[16+rdi],xmm0
+	call	GFMUL
+	vmovdqa	XMMWORD[32+rdi],xmm0
+	call	GFMUL
+	vmovdqa	XMMWORD[48+rdi],xmm0
+	call	GFMUL
+	vmovdqa	XMMWORD[64+rdi],xmm0
+	call	GFMUL
+	vmovdqa	XMMWORD[80+rdi],xmm0
+	mov	rdi,QWORD[8+rsp]	;WIN64 epilogue
+	mov	rsi,QWORD[16+rsp]
+	DB	0F3h,0C3h		;repret
+
+$L$SEH_end_aesgcmsiv_htable6_init:
+global	aesgcmsiv_htable_polyval
+
+ALIGN	16
+aesgcmsiv_htable_polyval:
+	mov	QWORD[8+rsp],rdi	;WIN64 prologue
+	mov	QWORD[16+rsp],rsi
+	mov	rax,rsp
+$L$SEH_begin_aesgcmsiv_htable_polyval:
+	mov	rdi,rcx
+	mov	rsi,rdx
+	mov	rdx,r8
+	mov	rcx,r9
+
+
+
+	test	rdx,rdx
+	jnz	NEAR $L$htable_polyval_start
+	mov	rdi,QWORD[8+rsp]	;WIN64 epilogue
+	mov	rsi,QWORD[16+rsp]
+	DB	0F3h,0C3h		;repret
+
+$L$htable_polyval_start:
+	vzeroall
+
+
+
+	mov	r11,rdx
+	and	r11,127
+
+	jz	NEAR $L$htable_polyval_no_prefix
+
+	vpxor	xmm9,xmm9,xmm9
+	vmovdqa	xmm1,XMMWORD[rcx]
+	sub	rdx,r11
+
+	sub	r11,16
+
+
+	vmovdqu	xmm0,XMMWORD[rsi]
+	vpxor	xmm0,xmm0,xmm1
+
+	vpclmulqdq	xmm5,xmm0,XMMWORD[r11*1+rdi],0x01
+	vpclmulqdq	xmm3,xmm0,XMMWORD[r11*1+rdi],0x00
+	vpclmulqdq	xmm4,xmm0,XMMWORD[r11*1+rdi],0x11
+	vpclmulqdq	xmm6,xmm0,XMMWORD[r11*1+rdi],0x10
+	vpxor	xmm5,xmm5,xmm6
+
+	lea	rsi,[16+rsi]
+	test	r11,r11
+	jnz	NEAR $L$htable_polyval_prefix_loop
+	jmp	NEAR $L$htable_polyval_prefix_complete
+
+
+ALIGN	64
+$L$htable_polyval_prefix_loop:
+	sub	r11,16
+
+	vmovdqu	xmm0,XMMWORD[rsi]
+
+	vpclmulqdq	xmm6,xmm0,XMMWORD[r11*1+rdi],0x00
+	vpxor	xmm3,xmm3,xmm6
+	vpclmulqdq	xmm6,xmm0,XMMWORD[r11*1+rdi],0x11
+	vpxor	xmm4,xmm4,xmm6
+	vpclmulqdq	xmm6,xmm0,XMMWORD[r11*1+rdi],0x01
+	vpxor	xmm5,xmm5,xmm6
+	vpclmulqdq	xmm6,xmm0,XMMWORD[r11*1+rdi],0x10
+	vpxor	xmm5,xmm5,xmm6
+
+	test	r11,r11
+
+	lea	rsi,[16+rsi]
+
+	jnz	NEAR $L$htable_polyval_prefix_loop
+
+$L$htable_polyval_prefix_complete:
+	vpsrldq	xmm6,xmm5,8
+	vpslldq	xmm5,xmm5,8
+
+	vpxor	xmm9,xmm4,xmm6
+	vpxor	xmm1,xmm3,xmm5
+
+	jmp	NEAR $L$htable_polyval_main_loop
+
+$L$htable_polyval_no_prefix:
+
+
+
+
+	vpxor	xmm1,xmm1,xmm1
+	vmovdqa	xmm9,XMMWORD[rcx]
+
+ALIGN	64
+$L$htable_polyval_main_loop:
+	sub	rdx,0x80
+	jb	NEAR $L$htable_polyval_out
+
+	vmovdqu	xmm0,XMMWORD[112+rsi]
+
+	vpclmulqdq	xmm5,xmm0,XMMWORD[rdi],0x01
+	vpclmulqdq	xmm3,xmm0,XMMWORD[rdi],0x00
+	vpclmulqdq	xmm4,xmm0,XMMWORD[rdi],0x11
+	vpclmulqdq	xmm6,xmm0,XMMWORD[rdi],0x10
+	vpxor	xmm5,xmm5,xmm6
+
+
+	vmovdqu	xmm0,XMMWORD[96+rsi]
+	vpclmulqdq	xmm6,xmm0,XMMWORD[16+rdi],0x01
+	vpxor	xmm5,xmm5,xmm6
+	vpclmulqdq	xmm6,xmm0,XMMWORD[16+rdi],0x00
+	vpxor	xmm3,xmm3,xmm6
+	vpclmulqdq	xmm6,xmm0,XMMWORD[16+rdi],0x11
+	vpxor	xmm4,xmm4,xmm6
+	vpclmulqdq	xmm6,xmm0,XMMWORD[16+rdi],0x10
+	vpxor	xmm5,xmm5,xmm6
+
+
+
+	vmovdqu	xmm0,XMMWORD[80+rsi]
+
+	vpclmulqdq	xmm7,xmm1,XMMWORD[poly],0x10
+	vpalignr	xmm1,xmm1,xmm1,8
+
+	vpclmulqdq	xmm6,xmm0,XMMWORD[32+rdi],0x01
+	vpxor	xmm5,xmm5,xmm6
+	vpclmulqdq	xmm6,xmm0,XMMWORD[32+rdi],0x00
+	vpxor	xmm3,xmm3,xmm6
+	vpclmulqdq	xmm6,xmm0,XMMWORD[32+rdi],0x11
+	vpxor	xmm4,xmm4,xmm6
+	vpclmulqdq	xmm6,xmm0,XMMWORD[32+rdi],0x10
+	vpxor	xmm5,xmm5,xmm6
+
+
+	vpxor	xmm1,xmm1,xmm7
+
+	vmovdqu	xmm0,XMMWORD[64+rsi]
+
+	vpclmulqdq	xmm6,xmm0,XMMWORD[48+rdi],0x01
+	vpxor	xmm5,xmm5,xmm6
+	vpclmulqdq	xmm6,xmm0,XMMWORD[48+rdi],0x00
+	vpxor	xmm3,xmm3,xmm6
+	vpclmulqdq	xmm6,xmm0,XMMWORD[48+rdi],0x11
+	vpxor	xmm4,xmm4,xmm6
+	vpclmulqdq	xmm6,xmm0,XMMWORD[48+rdi],0x10
+	vpxor	xmm5,xmm5,xmm6
+
+
+	vmovdqu	xmm0,XMMWORD[48+rsi]
+
+	vpclmulqdq	xmm7,xmm1,XMMWORD[poly],0x10
+	vpalignr	xmm1,xmm1,xmm1,8
+
+	vpclmulqdq	xmm6,xmm0,XMMWORD[64+rdi],0x01
+	vpxor	xmm5,xmm5,xmm6
+	vpclmulqdq	xmm6,xmm0,XMMWORD[64+rdi],0x00
+	vpxor	xmm3,xmm3,xmm6
+	vpclmulqdq	xmm6,xmm0,XMMWORD[64+rdi],0x11
+	vpxor	xmm4,xmm4,xmm6
+	vpclmulqdq	xmm6,xmm0,XMMWORD[64+rdi],0x10
+	vpxor	xmm5,xmm5,xmm6
+
+
+	vpxor	xmm1,xmm1,xmm7
+
+	vmovdqu	xmm0,XMMWORD[32+rsi]
+
+	vpclmulqdq	xmm6,xmm0,XMMWORD[80+rdi],0x01
+	vpxor	xmm5,xmm5,xmm6
+	vpclmulqdq	xmm6,xmm0,XMMWORD[80+rdi],0x00
+	vpxor	xmm3,xmm3,xmm6
+	vpclmulqdq	xmm6,xmm0,XMMWORD[80+rdi],0x11
+	vpxor	xmm4,xmm4,xmm6
+	vpclmulqdq	xmm6,xmm0,XMMWORD[80+rdi],0x10
+	vpxor	xmm5,xmm5,xmm6
+
+
+	vpxor	xmm1,xmm1,xmm9
+
+	vmovdqu	xmm0,XMMWORD[16+rsi]
+
+	vpclmulqdq	xmm6,xmm0,XMMWORD[96+rdi],0x01
+	vpxor	xmm5,xmm5,xmm6
+	vpclmulqdq	xmm6,xmm0,XMMWORD[96+rdi],0x00
+	vpxor	xmm3,xmm3,xmm6
+	vpclmulqdq	xmm6,xmm0,XMMWORD[96+rdi],0x11
+	vpxor	xmm4,xmm4,xmm6
+	vpclmulqdq	xmm6,xmm0,XMMWORD[96+rdi],0x10
+	vpxor	xmm5,xmm5,xmm6
+
+
+	vmovdqu	xmm0,XMMWORD[rsi]
+	vpxor	xmm0,xmm0,xmm1
+
+	vpclmulqdq	xmm6,xmm0,XMMWORD[112+rdi],0x01
+	vpxor	xmm5,xmm5,xmm6
+	vpclmulqdq	xmm6,xmm0,XMMWORD[112+rdi],0x00
+	vpxor	xmm3,xmm3,xmm6
+	vpclmulqdq	xmm6,xmm0,XMMWORD[112+rdi],0x11
+	vpxor	xmm4,xmm4,xmm6
+	vpclmulqdq	xmm6,xmm0,XMMWORD[112+rdi],0x10
+	vpxor	xmm5,xmm5,xmm6
+
+
+	vpsrldq	xmm6,xmm5,8
+	vpslldq	xmm5,xmm5,8
+
+	vpxor	xmm9,xmm4,xmm6
+	vpxor	xmm1,xmm3,xmm5
+
+	lea	rsi,[128+rsi]
+	jmp	NEAR $L$htable_polyval_main_loop
+
+
+
+$L$htable_polyval_out:
+	vpclmulqdq	xmm6,xmm1,XMMWORD[poly],0x10
+	vpalignr	xmm1,xmm1,xmm1,8
+	vpxor	xmm1,xmm1,xmm6
+
+	vpclmulqdq	xmm6,xmm1,XMMWORD[poly],0x10
+	vpalignr	xmm1,xmm1,xmm1,8
+	vpxor	xmm1,xmm1,xmm6
+	vpxor	xmm1,xmm1,xmm9
+
+	vmovdqu	XMMWORD[rcx],xmm1
+	vzeroupper
+	mov	rdi,QWORD[8+rsp]	;WIN64 epilogue
+	mov	rsi,QWORD[16+rsp]
+	DB	0F3h,0C3h		;repret
+
+$L$SEH_end_aesgcmsiv_htable_polyval:
+global	aesgcmsiv_polyval_horner
+
+ALIGN	16
+aesgcmsiv_polyval_horner:
+	mov	QWORD[8+rsp],rdi	;WIN64 prologue
+	mov	QWORD[16+rsp],rsi
+	mov	rax,rsp
+$L$SEH_begin_aesgcmsiv_polyval_horner:
+	mov	rdi,rcx
+	mov	rsi,rdx
+	mov	rdx,r8
+	mov	rcx,r9
+
+
+
+	test	rcx,rcx
+	jnz	NEAR $L$polyval_horner_start
+	mov	rdi,QWORD[8+rsp]	;WIN64 epilogue
+	mov	rsi,QWORD[16+rsp]
+	DB	0F3h,0C3h		;repret
+
+$L$polyval_horner_start:
+
+
+
+	xor	r10,r10
+	shl	rcx,4
+
+	vmovdqa	xmm1,XMMWORD[rsi]
+	vmovdqa	xmm0,XMMWORD[rdi]
+
+$L$polyval_horner_loop:
+	vpxor	xmm0,xmm0,XMMWORD[r10*1+rdx]
+	call	GFMUL
+
+	add	r10,16
+	cmp	rcx,r10
+	jne	NEAR $L$polyval_horner_loop
+
+
+	vmovdqa	XMMWORD[rdi],xmm0
+	mov	rdi,QWORD[8+rsp]	;WIN64 epilogue
+	mov	rsi,QWORD[16+rsp]
+	DB	0F3h,0C3h		;repret
+
+$L$SEH_end_aesgcmsiv_polyval_horner:
+global	aes128gcmsiv_aes_ks
+
+ALIGN	16
+aes128gcmsiv_aes_ks:
+	mov	QWORD[8+rsp],rdi	;WIN64 prologue
+	mov	QWORD[16+rsp],rsi
+	mov	rax,rsp
+$L$SEH_begin_aes128gcmsiv_aes_ks:
+	mov	rdi,rcx
+	mov	rsi,rdx
+
+
+
+	vmovdqa	xmm1,XMMWORD[rdi]
+	vmovdqa	XMMWORD[rsi],xmm1
+
+	vmovdqa	xmm0,XMMWORD[con1]
+	vmovdqa	xmm15,XMMWORD[mask]
+
+	mov	rax,8
+
+$L$ks128_loop:
+	add	rsi,16
+	sub	rax,1
+	vpshufb	xmm2,xmm1,xmm15
+	vaesenclast	xmm2,xmm2,xmm0
+	vpslld	xmm0,xmm0,1
+	vpslldq	xmm3,xmm1,4
+	vpxor	xmm1,xmm1,xmm3
+	vpslldq	xmm3,xmm3,4
+	vpxor	xmm1,xmm1,xmm3
+	vpslldq	xmm3,xmm3,4
+	vpxor	xmm1,xmm1,xmm3
+	vpxor	xmm1,xmm1,xmm2
+	vmovdqa	XMMWORD[rsi],xmm1
+	jne	NEAR $L$ks128_loop
+
+	vmovdqa	xmm0,XMMWORD[con2]
+	vpshufb	xmm2,xmm1,xmm15
+	vaesenclast	xmm2,xmm2,xmm0
+	vpslld	xmm0,xmm0,1
+	vpslldq	xmm3,xmm1,4
+	vpxor	xmm1,xmm1,xmm3
+	vpslldq	xmm3,xmm3,4
+	vpxor	xmm1,xmm1,xmm3
+	vpslldq	xmm3,xmm3,4
+	vpxor	xmm1,xmm1,xmm3
+	vpxor	xmm1,xmm1,xmm2
+	vmovdqa	XMMWORD[16+rsi],xmm1
+
+	vpshufb	xmm2,xmm1,xmm15
+	vaesenclast	xmm2,xmm2,xmm0
+	vpslldq	xmm3,xmm1,4
+	vpxor	xmm1,xmm1,xmm3
+	vpslldq	xmm3,xmm3,4
+	vpxor	xmm1,xmm1,xmm3
+	vpslldq	xmm3,xmm3,4
+	vpxor	xmm1,xmm1,xmm3
+	vpxor	xmm1,xmm1,xmm2
+	vmovdqa	XMMWORD[32+rsi],xmm1
+	mov	rdi,QWORD[8+rsp]	;WIN64 epilogue
+	mov	rsi,QWORD[16+rsp]
+	DB	0F3h,0C3h		;repret
+
+$L$SEH_end_aes128gcmsiv_aes_ks:
+global	aes256gcmsiv_aes_ks
+
+ALIGN	16
+aes256gcmsiv_aes_ks:
+	mov	QWORD[8+rsp],rdi	;WIN64 prologue
+	mov	QWORD[16+rsp],rsi
+	mov	rax,rsp
+$L$SEH_begin_aes256gcmsiv_aes_ks:
+	mov	rdi,rcx
+	mov	rsi,rdx
+
+
+
+	vmovdqa	xmm1,XMMWORD[rdi]
+	vmovdqa	xmm3,XMMWORD[16+rdi]
+	vmovdqa	XMMWORD[rsi],xmm1
+	vmovdqa	XMMWORD[16+rsi],xmm3
+	vmovdqa	xmm0,XMMWORD[con1]
+	vmovdqa	xmm15,XMMWORD[mask]
+	vpxor	xmm14,xmm14,xmm14
+	mov	rax,6
+
+$L$ks256_loop:
+	add	rsi,32
+	sub	rax,1
+	vpshufb	xmm2,xmm3,xmm15
+	vaesenclast	xmm2,xmm2,xmm0
+	vpslld	xmm0,xmm0,1
+	vpsllq	xmm4,xmm1,32
+	vpxor	xmm1,xmm1,xmm4
+	vpshufb	xmm4,xmm1,XMMWORD[con3]
+	vpxor	xmm1,xmm1,xmm4
+	vpxor	xmm1,xmm1,xmm2
+	vmovdqa	XMMWORD[rsi],xmm1
+	vpshufd	xmm2,xmm1,0xff
+	vaesenclast	xmm2,xmm2,xmm14
+	vpsllq	xmm4,xmm3,32
+	vpxor	xmm3,xmm3,xmm4
+	vpshufb	xmm4,xmm3,XMMWORD[con3]
+	vpxor	xmm3,xmm3,xmm4
+	vpxor	xmm3,xmm3,xmm2
+	vmovdqa	XMMWORD[16+rsi],xmm3
+	jne	NEAR $L$ks256_loop
+
+	vpshufb	xmm2,xmm3,xmm15
+	vaesenclast	xmm2,xmm2,xmm0
+	vpsllq	xmm4,xmm1,32
+	vpxor	xmm1,xmm1,xmm4
+	vpshufb	xmm4,xmm1,XMMWORD[con3]
+	vpxor	xmm1,xmm1,xmm4
+	vpxor	xmm1,xmm1,xmm2
+	vmovdqa	XMMWORD[32+rsi],xmm1
+	mov	rdi,QWORD[8+rsp]	;WIN64 epilogue
+	mov	rsi,QWORD[16+rsp]
+	DB	0F3h,0C3h		;repret
+
+global	aes128gcmsiv_aes_ks_enc_x1
+
+ALIGN	16
+aes128gcmsiv_aes_ks_enc_x1:
+	mov	QWORD[8+rsp],rdi	;WIN64 prologue
+	mov	QWORD[16+rsp],rsi
+	mov	rax,rsp
+$L$SEH_begin_aes128gcmsiv_aes_ks_enc_x1:
+	mov	rdi,rcx
+	mov	rsi,rdx
+	mov	rdx,r8
+	mov	rcx,r9
+
+
+
+	vmovdqa	xmm1,XMMWORD[rcx]
+	vmovdqa	xmm4,XMMWORD[rdi]
+
+	vmovdqa	XMMWORD[rdx],xmm1
+	vpxor	xmm4,xmm4,xmm1
+
+	vmovdqa	xmm0,XMMWORD[con1]
+	vmovdqa	xmm15,XMMWORD[mask]
+
+	vpshufb	xmm2,xmm1,xmm15
+	vaesenclast	xmm2,xmm2,xmm0
+	vpslld	xmm0,xmm0,1
+	vpsllq	xmm3,xmm1,32
+	vpxor	xmm1,xmm1,xmm3
+	vpshufb	xmm3,xmm1,XMMWORD[con3]
+	vpxor	xmm1,xmm1,xmm3
+	vpxor	xmm1,xmm1,xmm2
+
+	vaesenc	xmm4,xmm4,xmm1
+	vmovdqa	XMMWORD[16+rdx],xmm1
+
+	vpshufb	xmm2,xmm1,xmm15
+	vaesenclast	xmm2,xmm2,xmm0
+	vpslld	xmm0,xmm0,1
+	vpsllq	xmm3,xmm1,32
+	vpxor	xmm1,xmm1,xmm3
+	vpshufb	xmm3,xmm1,XMMWORD[con3]
+	vpxor	xmm1,xmm1,xmm3
+	vpxor	xmm1,xmm1,xmm2
+
+	vaesenc	xmm4,xmm4,xmm1
+	vmovdqa	XMMWORD[32+rdx],xmm1
+
+	vpshufb	xmm2,xmm1,xmm15
+	vaesenclast	xmm2,xmm2,xmm0
+	vpslld	xmm0,xmm0,1
+	vpsllq	xmm3,xmm1,32
+	vpxor	xmm1,xmm1,xmm3
+	vpshufb	xmm3,xmm1,XMMWORD[con3]
+	vpxor	xmm1,xmm1,xmm3
+	vpxor	xmm1,xmm1,xmm2
+
+	vaesenc	xmm4,xmm4,xmm1
+	vmovdqa	XMMWORD[48+rdx],xmm1
+
+	vpshufb	xmm2,xmm1,xmm15
+	vaesenclast	xmm2,xmm2,xmm0
+	vpslld	xmm0,xmm0,1
+	vpsllq	xmm3,xmm1,32
+	vpxor	xmm1,xmm1,xmm3
+	vpshufb	xmm3,xmm1,XMMWORD[con3]
+	vpxor	xmm1,xmm1,xmm3
+	vpxor	xmm1,xmm1,xmm2
+
+	vaesenc	xmm4,xmm4,xmm1
+	vmovdqa	XMMWORD[64+rdx],xmm1
+
+	vpshufb	xmm2,xmm1,xmm15
+	vaesenclast	xmm2,xmm2,xmm0
+	vpslld	xmm0,xmm0,1
+	vpsllq	xmm3,xmm1,32
+	vpxor	xmm1,xmm1,xmm3
+	vpshufb	xmm3,xmm1,XMMWORD[con3]
+	vpxor	xmm1,xmm1,xmm3
+	vpxor	xmm1,xmm1,xmm2
+
+	vaesenc	xmm4,xmm4,xmm1
+	vmovdqa	XMMWORD[80+rdx],xmm1
+
+	vpshufb	xmm2,xmm1,xmm15
+	vaesenclast	xmm2,xmm2,xmm0
+	vpslld	xmm0,xmm0,1
+	vpsllq	xmm3,xmm1,32
+	vpxor	xmm1,xmm1,xmm3
+	vpshufb	xmm3,xmm1,XMMWORD[con3]
+	vpxor	xmm1,xmm1,xmm3
+	vpxor	xmm1,xmm1,xmm2
+
+	vaesenc	xmm4,xmm4,xmm1
+	vmovdqa	XMMWORD[96+rdx],xmm1
+
+	vpshufb	xmm2,xmm1,xmm15
+	vaesenclast	xmm2,xmm2,xmm0
+	vpslld	xmm0,xmm0,1
+	vpsllq	xmm3,xmm1,32
+	vpxor	xmm1,xmm1,xmm3
+	vpshufb	xmm3,xmm1,XMMWORD[con3]
+	vpxor	xmm1,xmm1,xmm3
+	vpxor	xmm1,xmm1,xmm2
+
+	vaesenc	xmm4,xmm4,xmm1
+	vmovdqa	XMMWORD[112+rdx],xmm1
+
+	vpshufb	xmm2,xmm1,xmm15
+	vaesenclast	xmm2,xmm2,xmm0
+	vpslld	xmm0,xmm0,1
+	vpsllq	xmm3,xmm1,32
+	vpxor	xmm1,xmm1,xmm3
+	vpshufb	xmm3,xmm1,XMMWORD[con3]
+	vpxor	xmm1,xmm1,xmm3
+	vpxor	xmm1,xmm1,xmm2
+
+	vaesenc	xmm4,xmm4,xmm1
+	vmovdqa	XMMWORD[128+rdx],xmm1
+
+
+	vmovdqa	xmm0,XMMWORD[con2]
+
+	vpshufb	xmm2,xmm1,xmm15
+	vaesenclast	xmm2,xmm2,xmm0
+	vpslld	xmm0,xmm0,1
+	vpsllq	xmm3,xmm1,32
+	vpxor	xmm1,xmm1,xmm3
+	vpshufb	xmm3,xmm1,XMMWORD[con3]
+	vpxor	xmm1,xmm1,xmm3
+	vpxor	xmm1,xmm1,xmm2
+
+	vaesenc	xmm4,xmm4,xmm1
+	vmovdqa	XMMWORD[144+rdx],xmm1
+
+	vpshufb	xmm2,xmm1,xmm15
+	vaesenclast	xmm2,xmm2,xmm0
+	vpsllq	xmm3,xmm1,32
+	vpxor	xmm1,xmm1,xmm3
+	vpshufb	xmm3,xmm1,XMMWORD[con3]
+	vpxor	xmm1,xmm1,xmm3
+	vpxor	xmm1,xmm1,xmm2
+
+	vaesenclast	xmm4,xmm4,xmm1
+	vmovdqa	XMMWORD[160+rdx],xmm1
+
+
+	vmovdqa	XMMWORD[rsi],xmm4
+	mov	rdi,QWORD[8+rsp]	;WIN64 epilogue
+	mov	rsi,QWORD[16+rsp]
+	DB	0F3h,0C3h		;repret
+
+$L$SEH_end_aes128gcmsiv_aes_ks_enc_x1:
+global	aes128gcmsiv_kdf
+
+ALIGN	16
+aes128gcmsiv_kdf:
+	mov	QWORD[8+rsp],rdi	;WIN64 prologue
+	mov	QWORD[16+rsp],rsi
+	mov	rax,rsp
+$L$SEH_begin_aes128gcmsiv_kdf:
+	mov	rdi,rcx
+	mov	rsi,rdx
+	mov	rdx,r8
+
+
+
+
+
+
+
+	vmovdqa	xmm1,XMMWORD[rdx]
+	vmovdqa	xmm9,XMMWORD[rdi]
+	vmovdqa	xmm12,XMMWORD[and_mask]
+	vmovdqa	xmm13,XMMWORD[one]
+	vpshufd	xmm9,xmm9,0x90
+	vpand	xmm9,xmm9,xmm12
+	vpaddd	xmm10,xmm9,xmm13
+	vpaddd	xmm11,xmm10,xmm13
+	vpaddd	xmm12,xmm11,xmm13
+
+	vpxor	xmm9,xmm9,xmm1
+	vpxor	xmm10,xmm10,xmm1
+	vpxor	xmm11,xmm11,xmm1
+	vpxor	xmm12,xmm12,xmm1
+
+	vmovdqa	xmm1,XMMWORD[16+rdx]
+	vaesenc	xmm9,xmm9,xmm1
+	vaesenc	xmm10,xmm10,xmm1
+	vaesenc	xmm11,xmm11,xmm1
+	vaesenc	xmm12,xmm12,xmm1
+
+	vmovdqa	xmm2,XMMWORD[32+rdx]
+	vaesenc	xmm9,xmm9,xmm2
+	vaesenc	xmm10,xmm10,xmm2
+	vaesenc	xmm11,xmm11,xmm2
+	vaesenc	xmm12,xmm12,xmm2
+
+	vmovdqa	xmm1,XMMWORD[48+rdx]
+	vaesenc	xmm9,xmm9,xmm1
+	vaesenc	xmm10,xmm10,xmm1
+	vaesenc	xmm11,xmm11,xmm1
+	vaesenc	xmm12,xmm12,xmm1
+
+	vmovdqa	xmm2,XMMWORD[64+rdx]
+	vaesenc	xmm9,xmm9,xmm2
+	vaesenc	xmm10,xmm10,xmm2
+	vaesenc	xmm11,xmm11,xmm2
+	vaesenc	xmm12,xmm12,xmm2
+
+	vmovdqa	xmm1,XMMWORD[80+rdx]
+	vaesenc	xmm9,xmm9,xmm1
+	vaesenc	xmm10,xmm10,xmm1
+	vaesenc	xmm11,xmm11,xmm1
+	vaesenc	xmm12,xmm12,xmm1
+
+	vmovdqa	xmm2,XMMWORD[96+rdx]
+	vaesenc	xmm9,xmm9,xmm2
+	vaesenc	xmm10,xmm10,xmm2
+	vaesenc	xmm11,xmm11,xmm2
+	vaesenc	xmm12,xmm12,xmm2
+
+	vmovdqa	xmm1,XMMWORD[112+rdx]
+	vaesenc	xmm9,xmm9,xmm1
+	vaesenc	xmm10,xmm10,xmm1
+	vaesenc	xmm11,xmm11,xmm1
+	vaesenc	xmm12,xmm12,xmm1
+
+	vmovdqa	xmm2,XMMWORD[128+rdx]
+	vaesenc	xmm9,xmm9,xmm2
+	vaesenc	xmm10,xmm10,xmm2
+	vaesenc	xmm11,xmm11,xmm2
+	vaesenc	xmm12,xmm12,xmm2
+
+	vmovdqa	xmm1,XMMWORD[144+rdx]
+	vaesenc	xmm9,xmm9,xmm1
+	vaesenc	xmm10,xmm10,xmm1
+	vaesenc	xmm11,xmm11,xmm1
+	vaesenc	xmm12,xmm12,xmm1
+
+	vmovdqa	xmm2,XMMWORD[160+rdx]
+	vaesenclast	xmm9,xmm9,xmm2
+	vaesenclast	xmm10,xmm10,xmm2
+	vaesenclast	xmm11,xmm11,xmm2
+	vaesenclast	xmm12,xmm12,xmm2
+
+
+	vmovdqa	XMMWORD[rsi],xmm9
+	vmovdqa	XMMWORD[16+rsi],xmm10
+	vmovdqa	XMMWORD[32+rsi],xmm11
+	vmovdqa	XMMWORD[48+rsi],xmm12
+	mov	rdi,QWORD[8+rsp]	;WIN64 epilogue
+	mov	rsi,QWORD[16+rsp]
+	DB	0F3h,0C3h		;repret
+
+$L$SEH_end_aes128gcmsiv_kdf:
+global	aes128gcmsiv_enc_msg_x4
+
+ALIGN	16
+aes128gcmsiv_enc_msg_x4:
+	mov	QWORD[8+rsp],rdi	;WIN64 prologue
+	mov	QWORD[16+rsp],rsi
+	mov	rax,rsp
+$L$SEH_begin_aes128gcmsiv_enc_msg_x4:
+	mov	rdi,rcx
+	mov	rsi,rdx
+	mov	rdx,r8
+	mov	rcx,r9
+	mov	r8,QWORD[40+rsp]
+
+
+
+	test	r8,r8
+	jnz	NEAR $L$128_enc_msg_x4_start
+	mov	rdi,QWORD[8+rsp]	;WIN64 epilogue
+	mov	rsi,QWORD[16+rsp]
+	DB	0F3h,0C3h		;repret
+
+$L$128_enc_msg_x4_start:
+	push	r12
+
+	push	r13
+
+
+	shr	r8,4
+	mov	r10,r8
+	shl	r10,62
+	shr	r10,62
+
+
+	vmovdqa	xmm15,XMMWORD[rdx]
+	vpor	xmm15,xmm15,XMMWORD[OR_MASK]
+
+	vmovdqu	xmm4,XMMWORD[four]
+	vmovdqa	xmm0,xmm15
+	vpaddd	xmm1,xmm15,XMMWORD[one]
+	vpaddd	xmm2,xmm15,XMMWORD[two]
+	vpaddd	xmm3,xmm15,XMMWORD[three]
+
+	shr	r8,2
+	je	NEAR $L$128_enc_msg_x4_check_remainder
+
+	sub	rsi,64
+	sub	rdi,64
+
+$L$128_enc_msg_x4_loop1:
+	add	rsi,64
+	add	rdi,64
+
+	vmovdqa	xmm5,xmm0
+	vmovdqa	xmm6,xmm1
+	vmovdqa	xmm7,xmm2
+	vmovdqa	xmm8,xmm3
+
+	vpxor	xmm5,xmm5,XMMWORD[rcx]
+	vpxor	xmm6,xmm6,XMMWORD[rcx]
+	vpxor	xmm7,xmm7,XMMWORD[rcx]
+	vpxor	xmm8,xmm8,XMMWORD[rcx]
+
+	vmovdqu	xmm12,XMMWORD[16+rcx]
+	vaesenc	xmm5,xmm5,xmm12
+	vaesenc	xmm6,xmm6,xmm12
+	vaesenc	xmm7,xmm7,xmm12
+	vaesenc	xmm8,xmm8,xmm12
+
+	vpaddd	xmm0,xmm0,xmm4
+	vmovdqu	xmm12,XMMWORD[32+rcx]
+	vaesenc	xmm5,xmm5,xmm12
+	vaesenc	xmm6,xmm6,xmm12
+	vaesenc	xmm7,xmm7,xmm12
+	vaesenc	xmm8,xmm8,xmm12
+
+	vpaddd	xmm1,xmm1,xmm4
+	vmovdqu	xmm12,XMMWORD[48+rcx]
+	vaesenc	xmm5,xmm5,xmm12
+	vaesenc	xmm6,xmm6,xmm12
+	vaesenc	xmm7,xmm7,xmm12
+	vaesenc	xmm8,xmm8,xmm12
+
+	vpaddd	xmm2,xmm2,xmm4
+	vmovdqu	xmm12,XMMWORD[64+rcx]
+	vaesenc	xmm5,xmm5,xmm12
+	vaesenc	xmm6,xmm6,xmm12
+	vaesenc	xmm7,xmm7,xmm12
+	vaesenc	xmm8,xmm8,xmm12
+
+	vpaddd	xmm3,xmm3,xmm4
+
+	vmovdqu	xmm12,XMMWORD[80+rcx]
+	vaesenc	xmm5,xmm5,xmm12
+	vaesenc	xmm6,xmm6,xmm12
+	vaesenc	xmm7,xmm7,xmm12
+	vaesenc	xmm8,xmm8,xmm12
+
+	vmovdqu	xmm12,XMMWORD[96+rcx]
+	vaesenc	xmm5,xmm5,xmm12
+	vaesenc	xmm6,xmm6,xmm12
+	vaesenc	xmm7,xmm7,xmm12
+	vaesenc	xmm8,xmm8,xmm12
+
+	vmovdqu	xmm12,XMMWORD[112+rcx]
+	vaesenc	xmm5,xmm5,xmm12
+	vaesenc	xmm6,xmm6,xmm12
+	vaesenc	xmm7,xmm7,xmm12
+	vaesenc	xmm8,xmm8,xmm12
+
+	vmovdqu	xmm12,XMMWORD[128+rcx]
+	vaesenc	xmm5,xmm5,xmm12
+	vaesenc	xmm6,xmm6,xmm12
+	vaesenc	xmm7,xmm7,xmm12
+	vaesenc	xmm8,xmm8,xmm12
+
+	vmovdqu	xmm12,XMMWORD[144+rcx]
+	vaesenc	xmm5,xmm5,xmm12
+	vaesenc	xmm6,xmm6,xmm12
+	vaesenc	xmm7,xmm7,xmm12
+	vaesenc	xmm8,xmm8,xmm12
+
+	vmovdqu	xmm12,XMMWORD[160+rcx]
+	vaesenclast	xmm5,xmm5,xmm12
+	vaesenclast	xmm6,xmm6,xmm12
+	vaesenclast	xmm7,xmm7,xmm12
+	vaesenclast	xmm8,xmm8,xmm12
+
+
+
+	vpxor	xmm5,xmm5,XMMWORD[rdi]
+	vpxor	xmm6,xmm6,XMMWORD[16+rdi]
+	vpxor	xmm7,xmm7,XMMWORD[32+rdi]
+	vpxor	xmm8,xmm8,XMMWORD[48+rdi]
+
+	sub	r8,1
+
+	vmovdqu	XMMWORD[rsi],xmm5
+	vmovdqu	XMMWORD[16+rsi],xmm6
+	vmovdqu	XMMWORD[32+rsi],xmm7
+	vmovdqu	XMMWORD[48+rsi],xmm8
+
+	jne	NEAR $L$128_enc_msg_x4_loop1
+
+	add	rsi,64
+	add	rdi,64
+
+$L$128_enc_msg_x4_check_remainder:
+	cmp	r10,0
+	je	NEAR $L$128_enc_msg_x4_out
+
+$L$128_enc_msg_x4_loop2:
+
+
+	vmovdqa	xmm5,xmm0
+	vpaddd	xmm0,xmm0,XMMWORD[one]
+
+	vpxor	xmm5,xmm5,XMMWORD[rcx]
+	vaesenc	xmm5,xmm5,XMMWORD[16+rcx]
+	vaesenc	xmm5,xmm5,XMMWORD[32+rcx]
+	vaesenc	xmm5,xmm5,XMMWORD[48+rcx]
+	vaesenc	xmm5,xmm5,XMMWORD[64+rcx]
+	vaesenc	xmm5,xmm5,XMMWORD[80+rcx]
+	vaesenc	xmm5,xmm5,XMMWORD[96+rcx]
+	vaesenc	xmm5,xmm5,XMMWORD[112+rcx]
+	vaesenc	xmm5,xmm5,XMMWORD[128+rcx]
+	vaesenc	xmm5,xmm5,XMMWORD[144+rcx]
+	vaesenclast	xmm5,xmm5,XMMWORD[160+rcx]
+
+
+	vpxor	xmm5,xmm5,XMMWORD[rdi]
+	vmovdqu	XMMWORD[rsi],xmm5
+
+	add	rdi,16
+	add	rsi,16
+
+	sub	r10,1
+	jne	NEAR $L$128_enc_msg_x4_loop2
+
+$L$128_enc_msg_x4_out:
+	pop	r13
+
+	pop	r12
+
+	mov	rdi,QWORD[8+rsp]	;WIN64 epilogue
+	mov	rsi,QWORD[16+rsp]
+	DB	0F3h,0C3h		;repret
+
+$L$SEH_end_aes128gcmsiv_enc_msg_x4:
+global	aes128gcmsiv_enc_msg_x8
+
+ALIGN	16
+aes128gcmsiv_enc_msg_x8:
+	mov	QWORD[8+rsp],rdi	;WIN64 prologue
+	mov	QWORD[16+rsp],rsi
+	mov	rax,rsp
+$L$SEH_begin_aes128gcmsiv_enc_msg_x8:
+	mov	rdi,rcx
+	mov	rsi,rdx
+	mov	rdx,r8
+	mov	rcx,r9
+	mov	r8,QWORD[40+rsp]
+
+
+
+	test	r8,r8
+	jnz	NEAR $L$128_enc_msg_x8_start
+	mov	rdi,QWORD[8+rsp]	;WIN64 epilogue
+	mov	rsi,QWORD[16+rsp]
+	DB	0F3h,0C3h		;repret
+
+$L$128_enc_msg_x8_start:
+	push	r12
+
+	push	r13
+
+	push	rbp
+
+	mov	rbp,rsp
+
+
+
+	sub	rsp,128
+	and	rsp,-64
+
+	shr	r8,4
+	mov	r10,r8
+	shl	r10,61
+	shr	r10,61
+
+
+	vmovdqu	xmm1,XMMWORD[rdx]
+	vpor	xmm1,xmm1,XMMWORD[OR_MASK]
+
+
+	vpaddd	xmm0,xmm1,XMMWORD[seven]
+	vmovdqu	XMMWORD[rsp],xmm0
+	vpaddd	xmm9,xmm1,XMMWORD[one]
+	vpaddd	xmm10,xmm1,XMMWORD[two]
+	vpaddd	xmm11,xmm1,XMMWORD[three]
+	vpaddd	xmm12,xmm1,XMMWORD[four]
+	vpaddd	xmm13,xmm1,XMMWORD[five]
+	vpaddd	xmm14,xmm1,XMMWORD[six]
+	vmovdqa	xmm0,xmm1
+
+	shr	r8,3
+	je	NEAR $L$128_enc_msg_x8_check_remainder
+
+	sub	rsi,128
+	sub	rdi,128
+
+$L$128_enc_msg_x8_loop1:
+	add	rsi,128
+	add	rdi,128
+
+	vmovdqa	xmm1,xmm0
+	vmovdqa	xmm2,xmm9
+	vmovdqa	xmm3,xmm10
+	vmovdqa	xmm4,xmm11
+	vmovdqa	xmm5,xmm12
+	vmovdqa	xmm6,xmm13
+	vmovdqa	xmm7,xmm14
+
+	vmovdqu	xmm8,XMMWORD[rsp]
+
+	vpxor	xmm1,xmm1,XMMWORD[rcx]
+	vpxor	xmm2,xmm2,XMMWORD[rcx]
+	vpxor	xmm3,xmm3,XMMWORD[rcx]
+	vpxor	xmm4,xmm4,XMMWORD[rcx]
+	vpxor	xmm5,xmm5,XMMWORD[rcx]
+	vpxor	xmm6,xmm6,XMMWORD[rcx]
+	vpxor	xmm7,xmm7,XMMWORD[rcx]
+	vpxor	xmm8,xmm8,XMMWORD[rcx]
+
+	vmovdqu	xmm15,XMMWORD[16+rcx]
+	vaesenc	xmm1,xmm1,xmm15
+	vaesenc	xmm2,xmm2,xmm15
+	vaesenc	xmm3,xmm3,xmm15
+	vaesenc	xmm4,xmm4,xmm15
+	vaesenc	xmm5,xmm5,xmm15
+	vaesenc	xmm6,xmm6,xmm15
+	vaesenc	xmm7,xmm7,xmm15
+	vaesenc	xmm8,xmm8,xmm15
+
+	vmovdqu	xmm14,XMMWORD[rsp]
+	vpaddd	xmm14,xmm14,XMMWORD[eight]
+	vmovdqu	XMMWORD[rsp],xmm14
+	vmovdqu	xmm15,XMMWORD[32+rcx]
+	vaesenc	xmm1,xmm1,xmm15
+	vaesenc	xmm2,xmm2,xmm15
+	vaesenc	xmm3,xmm3,xmm15
+	vaesenc	xmm4,xmm4,xmm15
+	vaesenc	xmm5,xmm5,xmm15
+	vaesenc	xmm6,xmm6,xmm15
+	vaesenc	xmm7,xmm7,xmm15
+	vaesenc	xmm8,xmm8,xmm15
+
+	vpsubd	xmm14,xmm14,XMMWORD[one]
+	vmovdqu	xmm15,XMMWORD[48+rcx]
+	vaesenc	xmm1,xmm1,xmm15
+	vaesenc	xmm2,xmm2,xmm15
+	vaesenc	xmm3,xmm3,xmm15
+	vaesenc	xmm4,xmm4,xmm15
+	vaesenc	xmm5,xmm5,xmm15
+	vaesenc	xmm6,xmm6,xmm15
+	vaesenc	xmm7,xmm7,xmm15
+	vaesenc	xmm8,xmm8,xmm15
+
+	vpaddd	xmm0,xmm0,XMMWORD[eight]
+	vmovdqu	xmm15,XMMWORD[64+rcx]
+	vaesenc	xmm1,xmm1,xmm15
+	vaesenc	xmm2,xmm2,xmm15
+	vaesenc	xmm3,xmm3,xmm15
+	vaesenc	xmm4,xmm4,xmm15
+	vaesenc	xmm5,xmm5,xmm15
+	vaesenc	xmm6,xmm6,xmm15
+	vaesenc	xmm7,xmm7,xmm15
+	vaesenc	xmm8,xmm8,xmm15
+
+	vpaddd	xmm9,xmm9,XMMWORD[eight]
+	vmovdqu	xmm15,XMMWORD[80+rcx]
+	vaesenc	xmm1,xmm1,xmm15
+	vaesenc	xmm2,xmm2,xmm15
+	vaesenc	xmm3,xmm3,xmm15
+	vaesenc	xmm4,xmm4,xmm15
+	vaesenc	xmm5,xmm5,xmm15
+	vaesenc	xmm6,xmm6,xmm15
+	vaesenc	xmm7,xmm7,xmm15
+	vaesenc	xmm8,xmm8,xmm15
+
+	vpaddd	xmm10,xmm10,XMMWORD[eight]
+	vmovdqu	xmm15,XMMWORD[96+rcx]
+	vaesenc	xmm1,xmm1,xmm15
+	vaesenc	xmm2,xmm2,xmm15
+	vaesenc	xmm3,xmm3,xmm15
+	vaesenc	xmm4,xmm4,xmm15
+	vaesenc	xmm5,xmm5,xmm15
+	vaesenc	xmm6,xmm6,xmm15
+	vaesenc	xmm7,xmm7,xmm15
+	vaesenc	xmm8,xmm8,xmm15
+
+	vpaddd	xmm11,xmm11,XMMWORD[eight]
+	vmovdqu	xmm15,XMMWORD[112+rcx]
+	vaesenc	xmm1,xmm1,xmm15
+	vaesenc	xmm2,xmm2,xmm15
+	vaesenc	xmm3,xmm3,xmm15
+	vaesenc	xmm4,xmm4,xmm15
+	vaesenc	xmm5,xmm5,xmm15
+	vaesenc	xmm6,xmm6,xmm15
+	vaesenc	xmm7,xmm7,xmm15
+	vaesenc	xmm8,xmm8,xmm15
+
+	vpaddd	xmm12,xmm12,XMMWORD[eight]
+	vmovdqu	xmm15,XMMWORD[128+rcx]
+	vaesenc	xmm1,xmm1,xmm15
+	vaesenc	xmm2,xmm2,xmm15
+	vaesenc	xmm3,xmm3,xmm15
+	vaesenc	xmm4,xmm4,xmm15
+	vaesenc	xmm5,xmm5,xmm15
+	vaesenc	xmm6,xmm6,xmm15
+	vaesenc	xmm7,xmm7,xmm15
+	vaesenc	xmm8,xmm8,xmm15
+
+	vpaddd	xmm13,xmm13,XMMWORD[eight]
+	vmovdqu	xmm15,XMMWORD[144+rcx]
+	vaesenc	xmm1,xmm1,xmm15
+	vaesenc	xmm2,xmm2,xmm15
+	vaesenc	xmm3,xmm3,xmm15
+	vaesenc	xmm4,xmm4,xmm15
+	vaesenc	xmm5,xmm5,xmm15
+	vaesenc	xmm6,xmm6,xmm15
+	vaesenc	xmm7,xmm7,xmm15
+	vaesenc	xmm8,xmm8,xmm15
+
+	vmovdqu	xmm15,XMMWORD[160+rcx]
+	vaesenclast	xmm1,xmm1,xmm15
+	vaesenclast	xmm2,xmm2,xmm15
+	vaesenclast	xmm3,xmm3,xmm15
+	vaesenclast	xmm4,xmm4,xmm15
+	vaesenclast	xmm5,xmm5,xmm15
+	vaesenclast	xmm6,xmm6,xmm15
+	vaesenclast	xmm7,xmm7,xmm15
+	vaesenclast	xmm8,xmm8,xmm15
+
+
+
+	vpxor	xmm1,xmm1,XMMWORD[rdi]
+	vpxor	xmm2,xmm2,XMMWORD[16+rdi]
+	vpxor	xmm3,xmm3,XMMWORD[32+rdi]
+	vpxor	xmm4,xmm4,XMMWORD[48+rdi]
+	vpxor	xmm5,xmm5,XMMWORD[64+rdi]
+	vpxor	xmm6,xmm6,XMMWORD[80+rdi]
+	vpxor	xmm7,xmm7,XMMWORD[96+rdi]
+	vpxor	xmm8,xmm8,XMMWORD[112+rdi]
+
+	dec	r8
+
+	vmovdqu	XMMWORD[rsi],xmm1
+	vmovdqu	XMMWORD[16+rsi],xmm2
+	vmovdqu	XMMWORD[32+rsi],xmm3
+	vmovdqu	XMMWORD[48+rsi],xmm4
+	vmovdqu	XMMWORD[64+rsi],xmm5
+	vmovdqu	XMMWORD[80+rsi],xmm6
+	vmovdqu	XMMWORD[96+rsi],xmm7
+	vmovdqu	XMMWORD[112+rsi],xmm8
+
+	jne	NEAR $L$128_enc_msg_x8_loop1
+
+	add	rsi,128
+	add	rdi,128
+
+$L$128_enc_msg_x8_check_remainder:
+	cmp	r10,0
+	je	NEAR $L$128_enc_msg_x8_out
+
+$L$128_enc_msg_x8_loop2:
+
+
+	vmovdqa	xmm1,xmm0
+	vpaddd	xmm0,xmm0,XMMWORD[one]
+
+	vpxor	xmm1,xmm1,XMMWORD[rcx]
+	vaesenc	xmm1,xmm1,XMMWORD[16+rcx]
+	vaesenc	xmm1,xmm1,XMMWORD[32+rcx]
+	vaesenc	xmm1,xmm1,XMMWORD[48+rcx]
+	vaesenc	xmm1,xmm1,XMMWORD[64+rcx]
+	vaesenc	xmm1,xmm1,XMMWORD[80+rcx]
+	vaesenc	xmm1,xmm1,XMMWORD[96+rcx]
+	vaesenc	xmm1,xmm1,XMMWORD[112+rcx]
+	vaesenc	xmm1,xmm1,XMMWORD[128+rcx]
+	vaesenc	xmm1,xmm1,XMMWORD[144+rcx]
+	vaesenclast	xmm1,xmm1,XMMWORD[160+rcx]
+
+
+	vpxor	xmm1,xmm1,XMMWORD[rdi]
+
+	vmovdqu	XMMWORD[rsi],xmm1
+
+	add	rdi,16
+	add	rsi,16
+
+	dec	r10
+	jne	NEAR $L$128_enc_msg_x8_loop2
+
+$L$128_enc_msg_x8_out:
+	mov	rsp,rbp
+
+	pop	rbp
+
+	pop	r13
+
+	pop	r12
+
+	mov	rdi,QWORD[8+rsp]	;WIN64 epilogue
+	mov	rsi,QWORD[16+rsp]
+	DB	0F3h,0C3h		;repret
+
+$L$SEH_end_aes128gcmsiv_enc_msg_x8:
+global	aes128gcmsiv_dec
+
+ALIGN	16
+aes128gcmsiv_dec:
+	mov	QWORD[8+rsp],rdi	;WIN64 prologue
+	mov	QWORD[16+rsp],rsi
+	mov	rax,rsp
+$L$SEH_begin_aes128gcmsiv_dec:
+	mov	rdi,rcx
+	mov	rsi,rdx
+	mov	rdx,r8
+	mov	rcx,r9
+	mov	r8,QWORD[40+rsp]
+	mov	r9,QWORD[48+rsp]
+
+
+
+	test	r9,~15
+	jnz	NEAR $L$128_dec_start
+	mov	rdi,QWORD[8+rsp]	;WIN64 epilogue
+	mov	rsi,QWORD[16+rsp]
+	DB	0F3h,0C3h		;repret
+
+$L$128_dec_start:
+	vzeroupper
+	vmovdqa	xmm0,XMMWORD[rdx]
+	mov	rax,rdx
+
+	lea	rax,[32+rax]
+	lea	rcx,[32+rcx]
+
+
+	vmovdqu	xmm15,XMMWORD[r9*1+rdi]
+	vpor	xmm15,xmm15,XMMWORD[OR_MASK]
+	and	r9,~15
+
+
+	cmp	r9,96
+	jb	NEAR $L$128_dec_loop2
+
+
+	sub	r9,96
+	vmovdqa	xmm7,xmm15
+	vpaddd	xmm8,xmm7,XMMWORD[one]
+	vpaddd	xmm9,xmm7,XMMWORD[two]
+	vpaddd	xmm10,xmm9,XMMWORD[one]
+	vpaddd	xmm11,xmm9,XMMWORD[two]
+	vpaddd	xmm12,xmm11,XMMWORD[one]
+	vpaddd	xmm15,xmm11,XMMWORD[two]
+
+	vpxor	xmm7,xmm7,XMMWORD[r8]
+	vpxor	xmm8,xmm8,XMMWORD[r8]
+	vpxor	xmm9,xmm9,XMMWORD[r8]
+	vpxor	xmm10,xmm10,XMMWORD[r8]
+	vpxor	xmm11,xmm11,XMMWORD[r8]
+	vpxor	xmm12,xmm12,XMMWORD[r8]
+
+	vmovdqu	xmm4,XMMWORD[16+r8]
+	vaesenc	xmm7,xmm7,xmm4
+	vaesenc	xmm8,xmm8,xmm4
+	vaesenc	xmm9,xmm9,xmm4
+	vaesenc	xmm10,xmm10,xmm4
+	vaesenc	xmm11,xmm11,xmm4
+	vaesenc	xmm12,xmm12,xmm4
+
+	vmovdqu	xmm4,XMMWORD[32+r8]
+	vaesenc	xmm7,xmm7,xmm4
+	vaesenc	xmm8,xmm8,xmm4
+	vaesenc	xmm9,xmm9,xmm4
+	vaesenc	xmm10,xmm10,xmm4
+	vaesenc	xmm11,xmm11,xmm4
+	vaesenc	xmm12,xmm12,xmm4
+
+	vmovdqu	xmm4,XMMWORD[48+r8]
+	vaesenc	xmm7,xmm7,xmm4
+	vaesenc	xmm8,xmm8,xmm4
+	vaesenc	xmm9,xmm9,xmm4
+	vaesenc	xmm10,xmm10,xmm4
+	vaesenc	xmm11,xmm11,xmm4
+	vaesenc	xmm12,xmm12,xmm4
+
+	vmovdqu	xmm4,XMMWORD[64+r8]
+	vaesenc	xmm7,xmm7,xmm4
+	vaesenc	xmm8,xmm8,xmm4
+	vaesenc	xmm9,xmm9,xmm4
+	vaesenc	xmm10,xmm10,xmm4
+	vaesenc	xmm11,xmm11,xmm4
+	vaesenc	xmm12,xmm12,xmm4
+
+	vmovdqu	xmm4,XMMWORD[80+r8]
+	vaesenc	xmm7,xmm7,xmm4
+	vaesenc	xmm8,xmm8,xmm4
+	vaesenc	xmm9,xmm9,xmm4
+	vaesenc	xmm10,xmm10,xmm4
+	vaesenc	xmm11,xmm11,xmm4
+	vaesenc	xmm12,xmm12,xmm4
+
+	vmovdqu	xmm4,XMMWORD[96+r8]
+	vaesenc	xmm7,xmm7,xmm4
+	vaesenc	xmm8,xmm8,xmm4
+	vaesenc	xmm9,xmm9,xmm4
+	vaesenc	xmm10,xmm10,xmm4
+	vaesenc	xmm11,xmm11,xmm4
+	vaesenc	xmm12,xmm12,xmm4
+
+	vmovdqu	xmm4,XMMWORD[112+r8]
+	vaesenc	xmm7,xmm7,xmm4
+	vaesenc	xmm8,xmm8,xmm4
+	vaesenc	xmm9,xmm9,xmm4
+	vaesenc	xmm10,xmm10,xmm4
+	vaesenc	xmm11,xmm11,xmm4
+	vaesenc	xmm12,xmm12,xmm4
+
+	vmovdqu	xmm4,XMMWORD[128+r8]
+	vaesenc	xmm7,xmm7,xmm4
+	vaesenc	xmm8,xmm8,xmm4
+	vaesenc	xmm9,xmm9,xmm4
+	vaesenc	xmm10,xmm10,xmm4
+	vaesenc	xmm11,xmm11,xmm4
+	vaesenc	xmm12,xmm12,xmm4
+
+	vmovdqu	xmm4,XMMWORD[144+r8]
+	vaesenc	xmm7,xmm7,xmm4
+	vaesenc	xmm8,xmm8,xmm4
+	vaesenc	xmm9,xmm9,xmm4
+	vaesenc	xmm10,xmm10,xmm4
+	vaesenc	xmm11,xmm11,xmm4
+	vaesenc	xmm12,xmm12,xmm4
+
+	vmovdqu	xmm4,XMMWORD[160+r8]
+	vaesenclast	xmm7,xmm7,xmm4
+	vaesenclast	xmm8,xmm8,xmm4
+	vaesenclast	xmm9,xmm9,xmm4
+	vaesenclast	xmm10,xmm10,xmm4
+	vaesenclast	xmm11,xmm11,xmm4
+	vaesenclast	xmm12,xmm12,xmm4
+
+
+	vpxor	xmm7,xmm7,XMMWORD[rdi]
+	vpxor	xmm8,xmm8,XMMWORD[16+rdi]
+	vpxor	xmm9,xmm9,XMMWORD[32+rdi]
+	vpxor	xmm10,xmm10,XMMWORD[48+rdi]
+	vpxor	xmm11,xmm11,XMMWORD[64+rdi]
+	vpxor	xmm12,xmm12,XMMWORD[80+rdi]
+
+	vmovdqu	XMMWORD[rsi],xmm7
+	vmovdqu	XMMWORD[16+rsi],xmm8
+	vmovdqu	XMMWORD[32+rsi],xmm9
+	vmovdqu	XMMWORD[48+rsi],xmm10
+	vmovdqu	XMMWORD[64+rsi],xmm11
+	vmovdqu	XMMWORD[80+rsi],xmm12
+
+	add	rdi,96
+	add	rsi,96
+	jmp	NEAR $L$128_dec_loop1
+
+
+ALIGN	64
+$L$128_dec_loop1:
+	cmp	r9,96
+	jb	NEAR $L$128_dec_finish_96
+	sub	r9,96
+
+	vmovdqa	xmm6,xmm12
+	vmovdqa	XMMWORD[(16-32)+rax],xmm11
+	vmovdqa	XMMWORD[(32-32)+rax],xmm10
+	vmovdqa	XMMWORD[(48-32)+rax],xmm9
+	vmovdqa	XMMWORD[(64-32)+rax],xmm8
+	vmovdqa	XMMWORD[(80-32)+rax],xmm7
+
+	vmovdqa	xmm7,xmm15
+	vpaddd	xmm8,xmm7,XMMWORD[one]
+	vpaddd	xmm9,xmm7,XMMWORD[two]
+	vpaddd	xmm10,xmm9,XMMWORD[one]
+	vpaddd	xmm11,xmm9,XMMWORD[two]
+	vpaddd	xmm12,xmm11,XMMWORD[one]
+	vpaddd	xmm15,xmm11,XMMWORD[two]
+
+	vmovdqa	xmm4,XMMWORD[r8]
+	vpxor	xmm7,xmm7,xmm4
+	vpxor	xmm8,xmm8,xmm4
+	vpxor	xmm9,xmm9,xmm4
+	vpxor	xmm10,xmm10,xmm4
+	vpxor	xmm11,xmm11,xmm4
+	vpxor	xmm12,xmm12,xmm4
+
+	vmovdqu	xmm4,XMMWORD[((0-32))+rcx]
+	vpclmulqdq	xmm2,xmm6,xmm4,0x11
+	vpclmulqdq	xmm3,xmm6,xmm4,0x00
+	vpclmulqdq	xmm1,xmm6,xmm4,0x01
+	vpclmulqdq	xmm4,xmm6,xmm4,0x10
+	vpxor	xmm1,xmm1,xmm4
+
+	vmovdqu	xmm4,XMMWORD[16+r8]
+	vaesenc	xmm7,xmm7,xmm4
+	vaesenc	xmm8,xmm8,xmm4
+	vaesenc	xmm9,xmm9,xmm4
+	vaesenc	xmm10,xmm10,xmm4
+	vaesenc	xmm11,xmm11,xmm4
+	vaesenc	xmm12,xmm12,xmm4
+
+	vmovdqu	xmm6,XMMWORD[((-16))+rax]
+	vmovdqu	xmm13,XMMWORD[((-16))+rcx]
+
+	vpclmulqdq	xmm4,xmm6,xmm13,0x10
+	vpxor	xmm1,xmm1,xmm4
+	vpclmulqdq	xmm4,xmm6,xmm13,0x11
+	vpxor	xmm2,xmm2,xmm4
+	vpclmulqdq	xmm4,xmm6,xmm13,0x00
+	vpxor	xmm3,xmm3,xmm4
+	vpclmulqdq	xmm4,xmm6,xmm13,0x01
+	vpxor	xmm1,xmm1,xmm4
+
+
+	vmovdqu	xmm4,XMMWORD[32+r8]
+	vaesenc	xmm7,xmm7,xmm4
+	vaesenc	xmm8,xmm8,xmm4
+	vaesenc	xmm9,xmm9,xmm4
+	vaesenc	xmm10,xmm10,xmm4
+	vaesenc	xmm11,xmm11,xmm4
+	vaesenc	xmm12,xmm12,xmm4
+
+	vmovdqu	xmm6,XMMWORD[rax]
+	vmovdqu	xmm13,XMMWORD[rcx]
+
+	vpclmulqdq	xmm4,xmm6,xmm13,0x10
+	vpxor	xmm1,xmm1,xmm4
+	vpclmulqdq	xmm4,xmm6,xmm13,0x11
+	vpxor	xmm2,xmm2,xmm4
+	vpclmulqdq	xmm4,xmm6,xmm13,0x00
+	vpxor	xmm3,xmm3,xmm4
+	vpclmulqdq	xmm4,xmm6,xmm13,0x01
+	vpxor	xmm1,xmm1,xmm4
+
+
+	vmovdqu	xmm4,XMMWORD[48+r8]
+	vaesenc	xmm7,xmm7,xmm4
+	vaesenc	xmm8,xmm8,xmm4
+	vaesenc	xmm9,xmm9,xmm4
+	vaesenc	xmm10,xmm10,xmm4
+	vaesenc	xmm11,xmm11,xmm4
+	vaesenc	xmm12,xmm12,xmm4
+
+	vmovdqu	xmm6,XMMWORD[16+rax]
+	vmovdqu	xmm13,XMMWORD[16+rcx]
+
+	vpclmulqdq	xmm4,xmm6,xmm13,0x10
+	vpxor	xmm1,xmm1,xmm4
+	vpclmulqdq	xmm4,xmm6,xmm13,0x11
+	vpxor	xmm2,xmm2,xmm4
+	vpclmulqdq	xmm4,xmm6,xmm13,0x00
+	vpxor	xmm3,xmm3,xmm4
+	vpclmulqdq	xmm4,xmm6,xmm13,0x01
+	vpxor	xmm1,xmm1,xmm4
+
+
+	vmovdqu	xmm4,XMMWORD[64+r8]
+	vaesenc	xmm7,xmm7,xmm4
+	vaesenc	xmm8,xmm8,xmm4
+	vaesenc	xmm9,xmm9,xmm4
+	vaesenc	xmm10,xmm10,xmm4
+	vaesenc	xmm11,xmm11,xmm4
+	vaesenc	xmm12,xmm12,xmm4
+
+	vmovdqu	xmm6,XMMWORD[32+rax]
+	vmovdqu	xmm13,XMMWORD[32+rcx]
+
+	vpclmulqdq	xmm4,xmm6,xmm13,0x10
+	vpxor	xmm1,xmm1,xmm4
+	vpclmulqdq	xmm4,xmm6,xmm13,0x11
+	vpxor	xmm2,xmm2,xmm4
+	vpclmulqdq	xmm4,xmm6,xmm13,0x00
+	vpxor	xmm3,xmm3,xmm4
+	vpclmulqdq	xmm4,xmm6,xmm13,0x01
+	vpxor	xmm1,xmm1,xmm4
+
+
+	vmovdqu	xmm4,XMMWORD[80+r8]
+	vaesenc	xmm7,xmm7,xmm4
+	vaesenc	xmm8,xmm8,xmm4
+	vaesenc	xmm9,xmm9,xmm4
+	vaesenc	xmm10,xmm10,xmm4
+	vaesenc	xmm11,xmm11,xmm4
+	vaesenc	xmm12,xmm12,xmm4
+
+	vmovdqu	xmm4,XMMWORD[96+r8]
+	vaesenc	xmm7,xmm7,xmm4
+	vaesenc	xmm8,xmm8,xmm4
+	vaesenc	xmm9,xmm9,xmm4
+	vaesenc	xmm10,xmm10,xmm4
+	vaesenc	xmm11,xmm11,xmm4
+	vaesenc	xmm12,xmm12,xmm4
+
+	vmovdqu	xmm4,XMMWORD[112+r8]
+	vaesenc	xmm7,xmm7,xmm4
+	vaesenc	xmm8,xmm8,xmm4
+	vaesenc	xmm9,xmm9,xmm4
+	vaesenc	xmm10,xmm10,xmm4
+	vaesenc	xmm11,xmm11,xmm4
+	vaesenc	xmm12,xmm12,xmm4
+
+
+	vmovdqa	xmm6,XMMWORD[((80-32))+rax]
+	vpxor	xmm6,xmm6,xmm0
+	vmovdqu	xmm5,XMMWORD[((80-32))+rcx]
+
+	vpclmulqdq	xmm4,xmm6,xmm5,0x01
+	vpxor	xmm1,xmm1,xmm4
+	vpclmulqdq	xmm4,xmm6,xmm5,0x11
+	vpxor	xmm2,xmm2,xmm4
+	vpclmulqdq	xmm4,xmm6,xmm5,0x00
+	vpxor	xmm3,xmm3,xmm4
+	vpclmulqdq	xmm4,xmm6,xmm5,0x10
+	vpxor	xmm1,xmm1,xmm4
+
+	vmovdqu	xmm4,XMMWORD[128+r8]
+	vaesenc	xmm7,xmm7,xmm4
+	vaesenc	xmm8,xmm8,xmm4
+	vaesenc	xmm9,xmm9,xmm4
+	vaesenc	xmm10,xmm10,xmm4
+	vaesenc	xmm11,xmm11,xmm4
+	vaesenc	xmm12,xmm12,xmm4
+
+
+	vpsrldq	xmm4,xmm1,8
+	vpxor	xmm5,xmm2,xmm4
+	vpslldq	xmm4,xmm1,8
+	vpxor	xmm0,xmm3,xmm4
+
+	vmovdqa	xmm3,XMMWORD[poly]
+
+	vmovdqu	xmm4,XMMWORD[144+r8]
+	vaesenc	xmm7,xmm7,xmm4
+	vaesenc	xmm8,xmm8,xmm4
+	vaesenc	xmm9,xmm9,xmm4
+	vaesenc	xmm10,xmm10,xmm4
+	vaesenc	xmm11,xmm11,xmm4
+	vaesenc	xmm12,xmm12,xmm4
+
+	vmovdqu	xmm6,XMMWORD[160+r8]
+	vpalignr	xmm2,xmm0,xmm0,8
+	vpclmulqdq	xmm0,xmm0,xmm3,0x10
+	vpxor	xmm0,xmm2,xmm0
+
+	vpxor	xmm4,xmm6,XMMWORD[rdi]
+	vaesenclast	xmm7,xmm7,xmm4
+	vpxor	xmm4,xmm6,XMMWORD[16+rdi]
+	vaesenclast	xmm8,xmm8,xmm4
+	vpxor	xmm4,xmm6,XMMWORD[32+rdi]
+	vaesenclast	xmm9,xmm9,xmm4
+	vpxor	xmm4,xmm6,XMMWORD[48+rdi]
+	vaesenclast	xmm10,xmm10,xmm4
+	vpxor	xmm4,xmm6,XMMWORD[64+rdi]
+	vaesenclast	xmm11,xmm11,xmm4
+	vpxor	xmm4,xmm6,XMMWORD[80+rdi]
+	vaesenclast	xmm12,xmm12,xmm4
+
+	vpalignr	xmm2,xmm0,xmm0,8
+	vpclmulqdq	xmm0,xmm0,xmm3,0x10
+	vpxor	xmm0,xmm2,xmm0
+
+	vmovdqu	XMMWORD[rsi],xmm7
+	vmovdqu	XMMWORD[16+rsi],xmm8
+	vmovdqu	XMMWORD[32+rsi],xmm9
+	vmovdqu	XMMWORD[48+rsi],xmm10
+	vmovdqu	XMMWORD[64+rsi],xmm11
+	vmovdqu	XMMWORD[80+rsi],xmm12
+
+	vpxor	xmm0,xmm0,xmm5
+
+	lea	rdi,[96+rdi]
+	lea	rsi,[96+rsi]
+	jmp	NEAR $L$128_dec_loop1
+
+$L$128_dec_finish_96:
+	vmovdqa	xmm6,xmm12
+	vmovdqa	XMMWORD[(16-32)+rax],xmm11
+	vmovdqa	XMMWORD[(32-32)+rax],xmm10
+	vmovdqa	XMMWORD[(48-32)+rax],xmm9
+	vmovdqa	XMMWORD[(64-32)+rax],xmm8
+	vmovdqa	XMMWORD[(80-32)+rax],xmm7
+
+	vmovdqu	xmm4,XMMWORD[((0-32))+rcx]
+	vpclmulqdq	xmm1,xmm6,xmm4,0x10
+	vpclmulqdq	xmm2,xmm6,xmm4,0x11
+	vpclmulqdq	xmm3,xmm6,xmm4,0x00
+	vpclmulqdq	xmm4,xmm6,xmm4,0x01
+	vpxor	xmm1,xmm1,xmm4
+
+	vmovdqu	xmm6,XMMWORD[((-16))+rax]
+	vmovdqu	xmm13,XMMWORD[((-16))+rcx]
+
+	vpclmulqdq	xmm4,xmm6,xmm13,0x10
+	vpxor	xmm1,xmm1,xmm4
+	vpclmulqdq	xmm4,xmm6,xmm13,0x11
+	vpxor	xmm2,xmm2,xmm4
+	vpclmulqdq	xmm4,xmm6,xmm13,0x00
+	vpxor	xmm3,xmm3,xmm4
+	vpclmulqdq	xmm4,xmm6,xmm13,0x01
+	vpxor	xmm1,xmm1,xmm4
+
+	vmovdqu	xmm6,XMMWORD[rax]
+	vmovdqu	xmm13,XMMWORD[rcx]
+
+	vpclmulqdq	xmm4,xmm6,xmm13,0x10
+	vpxor	xmm1,xmm1,xmm4
+	vpclmulqdq	xmm4,xmm6,xmm13,0x11
+	vpxor	xmm2,xmm2,xmm4
+	vpclmulqdq	xmm4,xmm6,xmm13,0x00
+	vpxor	xmm3,xmm3,xmm4
+	vpclmulqdq	xmm4,xmm6,xmm13,0x01
+	vpxor	xmm1,xmm1,xmm4
+
+	vmovdqu	xmm6,XMMWORD[16+rax]
+	vmovdqu	xmm13,XMMWORD[16+rcx]
+
+	vpclmulqdq	xmm4,xmm6,xmm13,0x10
+	vpxor	xmm1,xmm1,xmm4
+	vpclmulqdq	xmm4,xmm6,xmm13,0x11
+	vpxor	xmm2,xmm2,xmm4
+	vpclmulqdq	xmm4,xmm6,xmm13,0x00
+	vpxor	xmm3,xmm3,xmm4
+	vpclmulqdq	xmm4,xmm6,xmm13,0x01
+	vpxor	xmm1,xmm1,xmm4
+
+	vmovdqu	xmm6,XMMWORD[32+rax]
+	vmovdqu	xmm13,XMMWORD[32+rcx]
+
+	vpclmulqdq	xmm4,xmm6,xmm13,0x10
+	vpxor	xmm1,xmm1,xmm4
+	vpclmulqdq	xmm4,xmm6,xmm13,0x11
+	vpxor	xmm2,xmm2,xmm4
+	vpclmulqdq	xmm4,xmm6,xmm13,0x00
+	vpxor	xmm3,xmm3,xmm4
+	vpclmulqdq	xmm4,xmm6,xmm13,0x01
+	vpxor	xmm1,xmm1,xmm4
+
+
+	vmovdqu	xmm6,XMMWORD[((80-32))+rax]
+	vpxor	xmm6,xmm6,xmm0
+	vmovdqu	xmm5,XMMWORD[((80-32))+rcx]
+	vpclmulqdq	xmm4,xmm6,xmm5,0x11
+	vpxor	xmm2,xmm2,xmm4
+	vpclmulqdq	xmm4,xmm6,xmm5,0x00
+	vpxor	xmm3,xmm3,xmm4
+	vpclmulqdq	xmm4,xmm6,xmm5,0x10
+	vpxor	xmm1,xmm1,xmm4
+	vpclmulqdq	xmm4,xmm6,xmm5,0x01
+	vpxor	xmm1,xmm1,xmm4
+
+	vpsrldq	xmm4,xmm1,8
+	vpxor	xmm5,xmm2,xmm4
+	vpslldq	xmm4,xmm1,8
+	vpxor	xmm0,xmm3,xmm4
+
+	vmovdqa	xmm3,XMMWORD[poly]
+
+	vpalignr	xmm2,xmm0,xmm0,8
+	vpclmulqdq	xmm0,xmm0,xmm3,0x10
+	vpxor	xmm0,xmm2,xmm0
+
+	vpalignr	xmm2,xmm0,xmm0,8
+	vpclmulqdq	xmm0,xmm0,xmm3,0x10
+	vpxor	xmm0,xmm2,xmm0
+
+	vpxor	xmm0,xmm0,xmm5
+
+$L$128_dec_loop2:
+
+
+
+	cmp	r9,16
+	jb	NEAR $L$128_dec_out
+	sub	r9,16
+
+	vmovdqa	xmm2,xmm15
+	vpaddd	xmm15,xmm15,XMMWORD[one]
+
+	vpxor	xmm2,xmm2,XMMWORD[r8]
+	vaesenc	xmm2,xmm2,XMMWORD[16+r8]
+	vaesenc	xmm2,xmm2,XMMWORD[32+r8]
+	vaesenc	xmm2,xmm2,XMMWORD[48+r8]
+	vaesenc	xmm2,xmm2,XMMWORD[64+r8]
+	vaesenc	xmm2,xmm2,XMMWORD[80+r8]
+	vaesenc	xmm2,xmm2,XMMWORD[96+r8]
+	vaesenc	xmm2,xmm2,XMMWORD[112+r8]
+	vaesenc	xmm2,xmm2,XMMWORD[128+r8]
+	vaesenc	xmm2,xmm2,XMMWORD[144+r8]
+	vaesenclast	xmm2,xmm2,XMMWORD[160+r8]
+	vpxor	xmm2,xmm2,XMMWORD[rdi]
+	vmovdqu	XMMWORD[rsi],xmm2
+	add	rdi,16
+	add	rsi,16
+
+	vpxor	xmm0,xmm0,xmm2
+	vmovdqa	xmm1,XMMWORD[((-32))+rcx]
+	call	GFMUL
+
+	jmp	NEAR $L$128_dec_loop2
+
+$L$128_dec_out:
+	vmovdqu	XMMWORD[rdx],xmm0
+	mov	rdi,QWORD[8+rsp]	;WIN64 epilogue
+	mov	rsi,QWORD[16+rsp]
+	DB	0F3h,0C3h		;repret
+
+$L$SEH_end_aes128gcmsiv_dec:
+global	aes128gcmsiv_ecb_enc_block
+
+ALIGN	16
+aes128gcmsiv_ecb_enc_block:
+	mov	QWORD[8+rsp],rdi	;WIN64 prologue
+	mov	QWORD[16+rsp],rsi
+	mov	rax,rsp
+$L$SEH_begin_aes128gcmsiv_ecb_enc_block:
+	mov	rdi,rcx
+	mov	rsi,rdx
+	mov	rdx,r8
+
+
+
+	vmovdqa	xmm1,XMMWORD[rdi]
+
+	vpxor	xmm1,xmm1,XMMWORD[rdx]
+	vaesenc	xmm1,xmm1,XMMWORD[16+rdx]
+	vaesenc	xmm1,xmm1,XMMWORD[32+rdx]
+	vaesenc	xmm1,xmm1,XMMWORD[48+rdx]
+	vaesenc	xmm1,xmm1,XMMWORD[64+rdx]
+	vaesenc	xmm1,xmm1,XMMWORD[80+rdx]
+	vaesenc	xmm1,xmm1,XMMWORD[96+rdx]
+	vaesenc	xmm1,xmm1,XMMWORD[112+rdx]
+	vaesenc	xmm1,xmm1,XMMWORD[128+rdx]
+	vaesenc	xmm1,xmm1,XMMWORD[144+rdx]
+	vaesenclast	xmm1,xmm1,XMMWORD[160+rdx]
+
+	vmovdqa	XMMWORD[rsi],xmm1
+
+	mov	rdi,QWORD[8+rsp]	;WIN64 epilogue
+	mov	rsi,QWORD[16+rsp]
+	DB	0F3h,0C3h		;repret
+
+$L$SEH_end_aes128gcmsiv_ecb_enc_block:
+global	aes256gcmsiv_aes_ks_enc_x1
+
+ALIGN	16
+aes256gcmsiv_aes_ks_enc_x1:
+	mov	QWORD[8+rsp],rdi	;WIN64 prologue
+	mov	QWORD[16+rsp],rsi
+	mov	rax,rsp
+$L$SEH_begin_aes256gcmsiv_aes_ks_enc_x1:
+	mov	rdi,rcx
+	mov	rsi,rdx
+	mov	rdx,r8
+	mov	rcx,r9
+
+
+
+	vmovdqa	xmm0,XMMWORD[con1]
+	vmovdqa	xmm15,XMMWORD[mask]
+	vmovdqa	xmm8,XMMWORD[rdi]
+	vmovdqa	xmm1,XMMWORD[rcx]
+	vmovdqa	xmm3,XMMWORD[16+rcx]
+	vpxor	xmm8,xmm8,xmm1
+	vaesenc	xmm8,xmm8,xmm3
+	vmovdqu	XMMWORD[rdx],xmm1
+	vmovdqu	XMMWORD[16+rdx],xmm3
+	vpxor	xmm14,xmm14,xmm14
+
+	vpshufb	xmm2,xmm3,xmm15
+	vaesenclast	xmm2,xmm2,xmm0
+	vpslld	xmm0,xmm0,1
+	vpslldq	xmm4,xmm1,4
+	vpxor	xmm1,xmm1,xmm4
+	vpslldq	xmm4,xmm4,4
+	vpxor	xmm1,xmm1,xmm4
+	vpslldq	xmm4,xmm4,4
+	vpxor	xmm1,xmm1,xmm4
+	vpxor	xmm1,xmm1,xmm2
+	vaesenc	xmm8,xmm8,xmm1
+	vmovdqu	XMMWORD[32+rdx],xmm1
+
+	vpshufd	xmm2,xmm1,0xff
+	vaesenclast	xmm2,xmm2,xmm14
+	vpslldq	xmm4,xmm3,4
+	vpxor	xmm3,xmm3,xmm4
+	vpslldq	xmm4,xmm4,4
+	vpxor	xmm3,xmm3,xmm4
+	vpslldq	xmm4,xmm4,4
+	vpxor	xmm3,xmm3,xmm4
+	vpxor	xmm3,xmm3,xmm2
+	vaesenc	xmm8,xmm8,xmm3
+	vmovdqu	XMMWORD[48+rdx],xmm3
+
+	vpshufb	xmm2,xmm3,xmm15
+	vaesenclast	xmm2,xmm2,xmm0
+	vpslld	xmm0,xmm0,1
+	vpslldq	xmm4,xmm1,4
+	vpxor	xmm1,xmm1,xmm4
+	vpslldq	xmm4,xmm4,4
+	vpxor	xmm1,xmm1,xmm4
+	vpslldq	xmm4,xmm4,4
+	vpxor	xmm1,xmm1,xmm4
+	vpxor	xmm1,xmm1,xmm2
+	vaesenc	xmm8,xmm8,xmm1
+	vmovdqu	XMMWORD[64+rdx],xmm1
+
+	vpshufd	xmm2,xmm1,0xff
+	vaesenclast	xmm2,xmm2,xmm14
+	vpslldq	xmm4,xmm3,4
+	vpxor	xmm3,xmm3,xmm4
+	vpslldq	xmm4,xmm4,4
+	vpxor	xmm3,xmm3,xmm4
+	vpslldq	xmm4,xmm4,4
+	vpxor	xmm3,xmm3,xmm4
+	vpxor	xmm3,xmm3,xmm2
+	vaesenc	xmm8,xmm8,xmm3
+	vmovdqu	XMMWORD[80+rdx],xmm3
+
+	vpshufb	xmm2,xmm3,xmm15
+	vaesenclast	xmm2,xmm2,xmm0
+	vpslld	xmm0,xmm0,1
+	vpslldq	xmm4,xmm1,4
+	vpxor	xmm1,xmm1,xmm4
+	vpslldq	xmm4,xmm4,4
+	vpxor	xmm1,xmm1,xmm4
+	vpslldq	xmm4,xmm4,4
+	vpxor	xmm1,xmm1,xmm4
+	vpxor	xmm1,xmm1,xmm2
+	vaesenc	xmm8,xmm8,xmm1
+	vmovdqu	XMMWORD[96+rdx],xmm1
+
+	vpshufd	xmm2,xmm1,0xff
+	vaesenclast	xmm2,xmm2,xmm14
+	vpslldq	xmm4,xmm3,4
+	vpxor	xmm3,xmm3,xmm4
+	vpslldq	xmm4,xmm4,4
+	vpxor	xmm3,xmm3,xmm4
+	vpslldq	xmm4,xmm4,4
+	vpxor	xmm3,xmm3,xmm4
+	vpxor	xmm3,xmm3,xmm2
+	vaesenc	xmm8,xmm8,xmm3
+	vmovdqu	XMMWORD[112+rdx],xmm3
+
+	vpshufb	xmm2,xmm3,xmm15
+	vaesenclast	xmm2,xmm2,xmm0
+	vpslld	xmm0,xmm0,1
+	vpslldq	xmm4,xmm1,4
+	vpxor	xmm1,xmm1,xmm4
+	vpslldq	xmm4,xmm4,4
+	vpxor	xmm1,xmm1,xmm4
+	vpslldq	xmm4,xmm4,4
+	vpxor	xmm1,xmm1,xmm4
+	vpxor	xmm1,xmm1,xmm2
+	vaesenc	xmm8,xmm8,xmm1
+	vmovdqu	XMMWORD[128+rdx],xmm1
+
+	vpshufd	xmm2,xmm1,0xff
+	vaesenclast	xmm2,xmm2,xmm14
+	vpslldq	xmm4,xmm3,4
+	vpxor	xmm3,xmm3,xmm4
+	vpslldq	xmm4,xmm4,4
+	vpxor	xmm3,xmm3,xmm4
+	vpslldq	xmm4,xmm4,4
+	vpxor	xmm3,xmm3,xmm4
+	vpxor	xmm3,xmm3,xmm2
+	vaesenc	xmm8,xmm8,xmm3
+	vmovdqu	XMMWORD[144+rdx],xmm3
+
+	vpshufb	xmm2,xmm3,xmm15
+	vaesenclast	xmm2,xmm2,xmm0
+	vpslld	xmm0,xmm0,1
+	vpslldq	xmm4,xmm1,4
+	vpxor	xmm1,xmm1,xmm4
+	vpslldq	xmm4,xmm4,4
+	vpxor	xmm1,xmm1,xmm4
+	vpslldq	xmm4,xmm4,4
+	vpxor	xmm1,xmm1,xmm4
+	vpxor	xmm1,xmm1,xmm2
+	vaesenc	xmm8,xmm8,xmm1
+	vmovdqu	XMMWORD[160+rdx],xmm1
+
+	vpshufd	xmm2,xmm1,0xff
+	vaesenclast	xmm2,xmm2,xmm14
+	vpslldq	xmm4,xmm3,4
+	vpxor	xmm3,xmm3,xmm4
+	vpslldq	xmm4,xmm4,4
+	vpxor	xmm3,xmm3,xmm4
+	vpslldq	xmm4,xmm4,4
+	vpxor	xmm3,xmm3,xmm4
+	vpxor	xmm3,xmm3,xmm2
+	vaesenc	xmm8,xmm8,xmm3
+	vmovdqu	XMMWORD[176+rdx],xmm3
+
+	vpshufb	xmm2,xmm3,xmm15
+	vaesenclast	xmm2,xmm2,xmm0
+	vpslld	xmm0,xmm0,1
+	vpslldq	xmm4,xmm1,4
+	vpxor	xmm1,xmm1,xmm4
+	vpslldq	xmm4,xmm4,4
+	vpxor	xmm1,xmm1,xmm4
+	vpslldq	xmm4,xmm4,4
+	vpxor	xmm1,xmm1,xmm4
+	vpxor	xmm1,xmm1,xmm2
+	vaesenc	xmm8,xmm8,xmm1
+	vmovdqu	XMMWORD[192+rdx],xmm1
+
+	vpshufd	xmm2,xmm1,0xff
+	vaesenclast	xmm2,xmm2,xmm14
+	vpslldq	xmm4,xmm3,4
+	vpxor	xmm3,xmm3,xmm4
+	vpslldq	xmm4,xmm4,4
+	vpxor	xmm3,xmm3,xmm4
+	vpslldq	xmm4,xmm4,4
+	vpxor	xmm3,xmm3,xmm4
+	vpxor	xmm3,xmm3,xmm2
+	vaesenc	xmm8,xmm8,xmm3
+	vmovdqu	XMMWORD[208+rdx],xmm3
+
+	vpshufb	xmm2,xmm3,xmm15
+	vaesenclast	xmm2,xmm2,xmm0
+	vpslldq	xmm4,xmm1,4
+	vpxor	xmm1,xmm1,xmm4
+	vpslldq	xmm4,xmm4,4
+	vpxor	xmm1,xmm1,xmm4
+	vpslldq	xmm4,xmm4,4
+	vpxor	xmm1,xmm1,xmm4
+	vpxor	xmm1,xmm1,xmm2
+	vaesenclast	xmm8,xmm8,xmm1
+	vmovdqu	XMMWORD[224+rdx],xmm1
+
+	vmovdqa	XMMWORD[rsi],xmm8
+	mov	rdi,QWORD[8+rsp]	;WIN64 epilogue
+	mov	rsi,QWORD[16+rsp]
+	DB	0F3h,0C3h		;repret
+
+$L$SEH_end_aes256gcmsiv_aes_ks_enc_x1:
+global	aes256gcmsiv_ecb_enc_block
+
+ALIGN	16
+aes256gcmsiv_ecb_enc_block:
+	mov	QWORD[8+rsp],rdi	;WIN64 prologue
+	mov	QWORD[16+rsp],rsi
+	mov	rax,rsp
+$L$SEH_begin_aes256gcmsiv_ecb_enc_block:
+	mov	rdi,rcx
+	mov	rsi,rdx
+	mov	rdx,r8
+
+
+
+	vmovdqa	xmm1,XMMWORD[rdi]
+	vpxor	xmm1,xmm1,XMMWORD[rdx]
+	vaesenc	xmm1,xmm1,XMMWORD[16+rdx]
+	vaesenc	xmm1,xmm1,XMMWORD[32+rdx]
+	vaesenc	xmm1,xmm1,XMMWORD[48+rdx]
+	vaesenc	xmm1,xmm1,XMMWORD[64+rdx]
+	vaesenc	xmm1,xmm1,XMMWORD[80+rdx]
+	vaesenc	xmm1,xmm1,XMMWORD[96+rdx]
+	vaesenc	xmm1,xmm1,XMMWORD[112+rdx]
+	vaesenc	xmm1,xmm1,XMMWORD[128+rdx]
+	vaesenc	xmm1,xmm1,XMMWORD[144+rdx]
+	vaesenc	xmm1,xmm1,XMMWORD[160+rdx]
+	vaesenc	xmm1,xmm1,XMMWORD[176+rdx]
+	vaesenc	xmm1,xmm1,XMMWORD[192+rdx]
+	vaesenc	xmm1,xmm1,XMMWORD[208+rdx]
+	vaesenclast	xmm1,xmm1,XMMWORD[224+rdx]
+	vmovdqa	XMMWORD[rsi],xmm1
+	mov	rdi,QWORD[8+rsp]	;WIN64 epilogue
+	mov	rsi,QWORD[16+rsp]
+	DB	0F3h,0C3h		;repret
+
+$L$SEH_end_aes256gcmsiv_ecb_enc_block:
+global	aes256gcmsiv_enc_msg_x4
+
+ALIGN	16
+aes256gcmsiv_enc_msg_x4:
+	mov	QWORD[8+rsp],rdi	;WIN64 prologue
+	mov	QWORD[16+rsp],rsi
+	mov	rax,rsp
+$L$SEH_begin_aes256gcmsiv_enc_msg_x4:
+	mov	rdi,rcx
+	mov	rsi,rdx
+	mov	rdx,r8
+	mov	rcx,r9
+	mov	r8,QWORD[40+rsp]
+
+
+
+	test	r8,r8
+	jnz	NEAR $L$256_enc_msg_x4_start
+	mov	rdi,QWORD[8+rsp]	;WIN64 epilogue
+	mov	rsi,QWORD[16+rsp]
+	DB	0F3h,0C3h		;repret
+
+$L$256_enc_msg_x4_start:
+	mov	r10,r8
+	shr	r8,4
+	shl	r10,60
+	jz	NEAR $L$256_enc_msg_x4_start2
+	add	r8,1
+
+$L$256_enc_msg_x4_start2:
+	mov	r10,r8
+	shl	r10,62
+	shr	r10,62
+
+
+	vmovdqa	xmm15,XMMWORD[rdx]
+	vpor	xmm15,xmm15,XMMWORD[OR_MASK]
+
+	vmovdqa	xmm4,XMMWORD[four]
+	vmovdqa	xmm0,xmm15
+	vpaddd	xmm1,xmm15,XMMWORD[one]
+	vpaddd	xmm2,xmm15,XMMWORD[two]
+	vpaddd	xmm3,xmm15,XMMWORD[three]
+
+	shr	r8,2
+	je	NEAR $L$256_enc_msg_x4_check_remainder
+
+	sub	rsi,64
+	sub	rdi,64
+
+$L$256_enc_msg_x4_loop1:
+	add	rsi,64
+	add	rdi,64
+
+	vmovdqa	xmm5,xmm0
+	vmovdqa	xmm6,xmm1
+	vmovdqa	xmm7,xmm2
+	vmovdqa	xmm8,xmm3
+
+	vpxor	xmm5,xmm5,XMMWORD[rcx]
+	vpxor	xmm6,xmm6,XMMWORD[rcx]
+	vpxor	xmm7,xmm7,XMMWORD[rcx]
+	vpxor	xmm8,xmm8,XMMWORD[rcx]
+
+	vmovdqu	xmm12,XMMWORD[16+rcx]
+	vaesenc	xmm5,xmm5,xmm12
+	vaesenc	xmm6,xmm6,xmm12
+	vaesenc	xmm7,xmm7,xmm12
+	vaesenc	xmm8,xmm8,xmm12
+
+	vpaddd	xmm0,xmm0,xmm4
+	vmovdqu	xmm12,XMMWORD[32+rcx]
+	vaesenc	xmm5,xmm5,xmm12
+	vaesenc	xmm6,xmm6,xmm12
+	vaesenc	xmm7,xmm7,xmm12
+	vaesenc	xmm8,xmm8,xmm12
+
+	vpaddd	xmm1,xmm1,xmm4
+	vmovdqu	xmm12,XMMWORD[48+rcx]
+	vaesenc	xmm5,xmm5,xmm12
+	vaesenc	xmm6,xmm6,xmm12
+	vaesenc	xmm7,xmm7,xmm12
+	vaesenc	xmm8,xmm8,xmm12
+
+	vpaddd	xmm2,xmm2,xmm4
+	vmovdqu	xmm12,XMMWORD[64+rcx]
+	vaesenc	xmm5,xmm5,xmm12
+	vaesenc	xmm6,xmm6,xmm12
+	vaesenc	xmm7,xmm7,xmm12
+	vaesenc	xmm8,xmm8,xmm12
+
+	vpaddd	xmm3,xmm3,xmm4
+
+	vmovdqu	xmm12,XMMWORD[80+rcx]
+	vaesenc	xmm5,xmm5,xmm12
+	vaesenc	xmm6,xmm6,xmm12
+	vaesenc	xmm7,xmm7,xmm12
+	vaesenc	xmm8,xmm8,xmm12
+
+	vmovdqu	xmm12,XMMWORD[96+rcx]
+	vaesenc	xmm5,xmm5,xmm12
+	vaesenc	xmm6,xmm6,xmm12
+	vaesenc	xmm7,xmm7,xmm12
+	vaesenc	xmm8,xmm8,xmm12
+
+	vmovdqu	xmm12,XMMWORD[112+rcx]
+	vaesenc	xmm5,xmm5,xmm12
+	vaesenc	xmm6,xmm6,xmm12
+	vaesenc	xmm7,xmm7,xmm12
+	vaesenc	xmm8,xmm8,xmm12
+
+	vmovdqu	xmm12,XMMWORD[128+rcx]
+	vaesenc	xmm5,xmm5,xmm12
+	vaesenc	xmm6,xmm6,xmm12
+	vaesenc	xmm7,xmm7,xmm12
+	vaesenc	xmm8,xmm8,xmm12
+
+	vmovdqu	xmm12,XMMWORD[144+rcx]
+	vaesenc	xmm5,xmm5,xmm12
+	vaesenc	xmm6,xmm6,xmm12
+	vaesenc	xmm7,xmm7,xmm12
+	vaesenc	xmm8,xmm8,xmm12
+
+	vmovdqu	xmm12,XMMWORD[160+rcx]
+	vaesenc	xmm5,xmm5,xmm12
+	vaesenc	xmm6,xmm6,xmm12
+	vaesenc	xmm7,xmm7,xmm12
+	vaesenc	xmm8,xmm8,xmm12
+
+	vmovdqu	xmm12,XMMWORD[176+rcx]
+	vaesenc	xmm5,xmm5,xmm12
+	vaesenc	xmm6,xmm6,xmm12
+	vaesenc	xmm7,xmm7,xmm12
+	vaesenc	xmm8,xmm8,xmm12
+
+	vmovdqu	xmm12,XMMWORD[192+rcx]
+	vaesenc	xmm5,xmm5,xmm12
+	vaesenc	xmm6,xmm6,xmm12
+	vaesenc	xmm7,xmm7,xmm12
+	vaesenc	xmm8,xmm8,xmm12
+
+	vmovdqu	xmm12,XMMWORD[208+rcx]
+	vaesenc	xmm5,xmm5,xmm12
+	vaesenc	xmm6,xmm6,xmm12
+	vaesenc	xmm7,xmm7,xmm12
+	vaesenc	xmm8,xmm8,xmm12
+
+	vmovdqu	xmm12,XMMWORD[224+rcx]
+	vaesenclast	xmm5,xmm5,xmm12
+	vaesenclast	xmm6,xmm6,xmm12
+	vaesenclast	xmm7,xmm7,xmm12
+	vaesenclast	xmm8,xmm8,xmm12
+
+
+
+	vpxor	xmm5,xmm5,XMMWORD[rdi]
+	vpxor	xmm6,xmm6,XMMWORD[16+rdi]
+	vpxor	xmm7,xmm7,XMMWORD[32+rdi]
+	vpxor	xmm8,xmm8,XMMWORD[48+rdi]
+
+	sub	r8,1
+
+	vmovdqu	XMMWORD[rsi],xmm5
+	vmovdqu	XMMWORD[16+rsi],xmm6
+	vmovdqu	XMMWORD[32+rsi],xmm7
+	vmovdqu	XMMWORD[48+rsi],xmm8
+
+	jne	NEAR $L$256_enc_msg_x4_loop1
+
+	add	rsi,64
+	add	rdi,64
+
+$L$256_enc_msg_x4_check_remainder:
+	cmp	r10,0
+	je	NEAR $L$256_enc_msg_x4_out
+
+$L$256_enc_msg_x4_loop2:
+
+
+
+	vmovdqa	xmm5,xmm0
+	vpaddd	xmm0,xmm0,XMMWORD[one]
+	vpxor	xmm5,xmm5,XMMWORD[rcx]
+	vaesenc	xmm5,xmm5,XMMWORD[16+rcx]
+	vaesenc	xmm5,xmm5,XMMWORD[32+rcx]
+	vaesenc	xmm5,xmm5,XMMWORD[48+rcx]
+	vaesenc	xmm5,xmm5,XMMWORD[64+rcx]
+	vaesenc	xmm5,xmm5,XMMWORD[80+rcx]
+	vaesenc	xmm5,xmm5,XMMWORD[96+rcx]
+	vaesenc	xmm5,xmm5,XMMWORD[112+rcx]
+	vaesenc	xmm5,xmm5,XMMWORD[128+rcx]
+	vaesenc	xmm5,xmm5,XMMWORD[144+rcx]
+	vaesenc	xmm5,xmm5,XMMWORD[160+rcx]
+	vaesenc	xmm5,xmm5,XMMWORD[176+rcx]
+	vaesenc	xmm5,xmm5,XMMWORD[192+rcx]
+	vaesenc	xmm5,xmm5,XMMWORD[208+rcx]
+	vaesenclast	xmm5,xmm5,XMMWORD[224+rcx]
+
+
+	vpxor	xmm5,xmm5,XMMWORD[rdi]
+
+	vmovdqu	XMMWORD[rsi],xmm5
+
+	add	rdi,16
+	add	rsi,16
+
+	sub	r10,1
+	jne	NEAR $L$256_enc_msg_x4_loop2
+
+$L$256_enc_msg_x4_out:
+	mov	rdi,QWORD[8+rsp]	;WIN64 epilogue
+	mov	rsi,QWORD[16+rsp]
+	DB	0F3h,0C3h		;repret
+
+$L$SEH_end_aes256gcmsiv_enc_msg_x4:
+global	aes256gcmsiv_enc_msg_x8
+
+ALIGN	16
+aes256gcmsiv_enc_msg_x8:
+	mov	QWORD[8+rsp],rdi	;WIN64 prologue
+	mov	QWORD[16+rsp],rsi
+	mov	rax,rsp
+$L$SEH_begin_aes256gcmsiv_enc_msg_x8:
+	mov	rdi,rcx
+	mov	rsi,rdx
+	mov	rdx,r8
+	mov	rcx,r9
+	mov	r8,QWORD[40+rsp]
+
+
+
+	test	r8,r8
+	jnz	NEAR $L$256_enc_msg_x8_start
+	mov	rdi,QWORD[8+rsp]	;WIN64 epilogue
+	mov	rsi,QWORD[16+rsp]
+	DB	0F3h,0C3h		;repret
+
+$L$256_enc_msg_x8_start:
+
+	mov	r11,rsp
+	sub	r11,16
+	and	r11,-64
+
+	mov	r10,r8
+	shr	r8,4
+	shl	r10,60
+	jz	NEAR $L$256_enc_msg_x8_start2
+	add	r8,1
+
+$L$256_enc_msg_x8_start2:
+	mov	r10,r8
+	shl	r10,61
+	shr	r10,61
+
+
+	vmovdqa	xmm1,XMMWORD[rdx]
+	vpor	xmm1,xmm1,XMMWORD[OR_MASK]
+
+
+	vpaddd	xmm0,xmm1,XMMWORD[seven]
+	vmovdqa	XMMWORD[r11],xmm0
+	vpaddd	xmm9,xmm1,XMMWORD[one]
+	vpaddd	xmm10,xmm1,XMMWORD[two]
+	vpaddd	xmm11,xmm1,XMMWORD[three]
+	vpaddd	xmm12,xmm1,XMMWORD[four]
+	vpaddd	xmm13,xmm1,XMMWORD[five]
+	vpaddd	xmm14,xmm1,XMMWORD[six]
+	vmovdqa	xmm0,xmm1
+
+	shr	r8,3
+	jz	NEAR $L$256_enc_msg_x8_check_remainder
+
+	sub	rsi,128
+	sub	rdi,128
+
+$L$256_enc_msg_x8_loop1:
+	add	rsi,128
+	add	rdi,128
+
+	vmovdqa	xmm1,xmm0
+	vmovdqa	xmm2,xmm9
+	vmovdqa	xmm3,xmm10
+	vmovdqa	xmm4,xmm11
+	vmovdqa	xmm5,xmm12
+	vmovdqa	xmm6,xmm13
+	vmovdqa	xmm7,xmm14
+
+	vmovdqa	xmm8,XMMWORD[r11]
+
+	vpxor	xmm1,xmm1,XMMWORD[rcx]
+	vpxor	xmm2,xmm2,XMMWORD[rcx]
+	vpxor	xmm3,xmm3,XMMWORD[rcx]
+	vpxor	xmm4,xmm4,XMMWORD[rcx]
+	vpxor	xmm5,xmm5,XMMWORD[rcx]
+	vpxor	xmm6,xmm6,XMMWORD[rcx]
+	vpxor	xmm7,xmm7,XMMWORD[rcx]
+	vpxor	xmm8,xmm8,XMMWORD[rcx]
+
+	vmovdqu	xmm15,XMMWORD[16+rcx]
+	vaesenc	xmm1,xmm1,xmm15
+	vaesenc	xmm2,xmm2,xmm15
+	vaesenc	xmm3,xmm3,xmm15
+	vaesenc	xmm4,xmm4,xmm15
+	vaesenc	xmm5,xmm5,xmm15
+	vaesenc	xmm6,xmm6,xmm15
+	vaesenc	xmm7,xmm7,xmm15
+	vaesenc	xmm8,xmm8,xmm15
+
+	vmovdqa	xmm14,XMMWORD[r11]
+	vpaddd	xmm14,xmm14,XMMWORD[eight]
+	vmovdqa	XMMWORD[r11],xmm14
+	vmovdqu	xmm15,XMMWORD[32+rcx]
+	vaesenc	xmm1,xmm1,xmm15
+	vaesenc	xmm2,xmm2,xmm15
+	vaesenc	xmm3,xmm3,xmm15
+	vaesenc	xmm4,xmm4,xmm15
+	vaesenc	xmm5,xmm5,xmm15
+	vaesenc	xmm6,xmm6,xmm15
+	vaesenc	xmm7,xmm7,xmm15
+	vaesenc	xmm8,xmm8,xmm15
+
+	vpsubd	xmm14,xmm14,XMMWORD[one]
+	vmovdqu	xmm15,XMMWORD[48+rcx]
+	vaesenc	xmm1,xmm1,xmm15
+	vaesenc	xmm2,xmm2,xmm15
+	vaesenc	xmm3,xmm3,xmm15
+	vaesenc	xmm4,xmm4,xmm15
+	vaesenc	xmm5,xmm5,xmm15
+	vaesenc	xmm6,xmm6,xmm15
+	vaesenc	xmm7,xmm7,xmm15
+	vaesenc	xmm8,xmm8,xmm15
+
+	vpaddd	xmm0,xmm0,XMMWORD[eight]
+	vmovdqu	xmm15,XMMWORD[64+rcx]
+	vaesenc	xmm1,xmm1,xmm15
+	vaesenc	xmm2,xmm2,xmm15
+	vaesenc	xmm3,xmm3,xmm15
+	vaesenc	xmm4,xmm4,xmm15
+	vaesenc	xmm5,xmm5,xmm15
+	vaesenc	xmm6,xmm6,xmm15
+	vaesenc	xmm7,xmm7,xmm15
+	vaesenc	xmm8,xmm8,xmm15
+
+	vpaddd	xmm9,xmm9,XMMWORD[eight]
+	vmovdqu	xmm15,XMMWORD[80+rcx]
+	vaesenc	xmm1,xmm1,xmm15
+	vaesenc	xmm2,xmm2,xmm15
+	vaesenc	xmm3,xmm3,xmm15
+	vaesenc	xmm4,xmm4,xmm15
+	vaesenc	xmm5,xmm5,xmm15
+	vaesenc	xmm6,xmm6,xmm15
+	vaesenc	xmm7,xmm7,xmm15
+	vaesenc	xmm8,xmm8,xmm15
+
+	vpaddd	xmm10,xmm10,XMMWORD[eight]
+	vmovdqu	xmm15,XMMWORD[96+rcx]
+	vaesenc	xmm1,xmm1,xmm15
+	vaesenc	xmm2,xmm2,xmm15
+	vaesenc	xmm3,xmm3,xmm15
+	vaesenc	xmm4,xmm4,xmm15
+	vaesenc	xmm5,xmm5,xmm15
+	vaesenc	xmm6,xmm6,xmm15
+	vaesenc	xmm7,xmm7,xmm15
+	vaesenc	xmm8,xmm8,xmm15
+
+	vpaddd	xmm11,xmm11,XMMWORD[eight]
+	vmovdqu	xmm15,XMMWORD[112+rcx]
+	vaesenc	xmm1,xmm1,xmm15
+	vaesenc	xmm2,xmm2,xmm15
+	vaesenc	xmm3,xmm3,xmm15
+	vaesenc	xmm4,xmm4,xmm15
+	vaesenc	xmm5,xmm5,xmm15
+	vaesenc	xmm6,xmm6,xmm15
+	vaesenc	xmm7,xmm7,xmm15
+	vaesenc	xmm8,xmm8,xmm15
+
+	vpaddd	xmm12,xmm12,XMMWORD[eight]
+	vmovdqu	xmm15,XMMWORD[128+rcx]
+	vaesenc	xmm1,xmm1,xmm15
+	vaesenc	xmm2,xmm2,xmm15
+	vaesenc	xmm3,xmm3,xmm15
+	vaesenc	xmm4,xmm4,xmm15
+	vaesenc	xmm5,xmm5,xmm15
+	vaesenc	xmm6,xmm6,xmm15
+	vaesenc	xmm7,xmm7,xmm15
+	vaesenc	xmm8,xmm8,xmm15
+
+	vpaddd	xmm13,xmm13,XMMWORD[eight]
+	vmovdqu	xmm15,XMMWORD[144+rcx]
+	vaesenc	xmm1,xmm1,xmm15
+	vaesenc	xmm2,xmm2,xmm15
+	vaesenc	xmm3,xmm3,xmm15
+	vaesenc	xmm4,xmm4,xmm15
+	vaesenc	xmm5,xmm5,xmm15
+	vaesenc	xmm6,xmm6,xmm15
+	vaesenc	xmm7,xmm7,xmm15
+	vaesenc	xmm8,xmm8,xmm15
+
+	vmovdqu	xmm15,XMMWORD[160+rcx]
+	vaesenc	xmm1,xmm1,xmm15
+	vaesenc	xmm2,xmm2,xmm15
+	vaesenc	xmm3,xmm3,xmm15
+	vaesenc	xmm4,xmm4,xmm15
+	vaesenc	xmm5,xmm5,xmm15
+	vaesenc	xmm6,xmm6,xmm15
+	vaesenc	xmm7,xmm7,xmm15
+	vaesenc	xmm8,xmm8,xmm15
+
+	vmovdqu	xmm15,XMMWORD[176+rcx]
+	vaesenc	xmm1,xmm1,xmm15
+	vaesenc	xmm2,xmm2,xmm15
+	vaesenc	xmm3,xmm3,xmm15
+	vaesenc	xmm4,xmm4,xmm15
+	vaesenc	xmm5,xmm5,xmm15
+	vaesenc	xmm6,xmm6,xmm15
+	vaesenc	xmm7,xmm7,xmm15
+	vaesenc	xmm8,xmm8,xmm15
+
+	vmovdqu	xmm15,XMMWORD[192+rcx]
+	vaesenc	xmm1,xmm1,xmm15
+	vaesenc	xmm2,xmm2,xmm15
+	vaesenc	xmm3,xmm3,xmm15
+	vaesenc	xmm4,xmm4,xmm15
+	vaesenc	xmm5,xmm5,xmm15
+	vaesenc	xmm6,xmm6,xmm15
+	vaesenc	xmm7,xmm7,xmm15
+	vaesenc	xmm8,xmm8,xmm15
+
+	vmovdqu	xmm15,XMMWORD[208+rcx]
+	vaesenc	xmm1,xmm1,xmm15
+	vaesenc	xmm2,xmm2,xmm15
+	vaesenc	xmm3,xmm3,xmm15
+	vaesenc	xmm4,xmm4,xmm15
+	vaesenc	xmm5,xmm5,xmm15
+	vaesenc	xmm6,xmm6,xmm15
+	vaesenc	xmm7,xmm7,xmm15
+	vaesenc	xmm8,xmm8,xmm15
+
+	vmovdqu	xmm15,XMMWORD[224+rcx]
+	vaesenclast	xmm1,xmm1,xmm15
+	vaesenclast	xmm2,xmm2,xmm15
+	vaesenclast	xmm3,xmm3,xmm15
+	vaesenclast	xmm4,xmm4,xmm15
+	vaesenclast	xmm5,xmm5,xmm15
+	vaesenclast	xmm6,xmm6,xmm15
+	vaesenclast	xmm7,xmm7,xmm15
+	vaesenclast	xmm8,xmm8,xmm15
+
+
+
+	vpxor	xmm1,xmm1,XMMWORD[rdi]
+	vpxor	xmm2,xmm2,XMMWORD[16+rdi]
+	vpxor	xmm3,xmm3,XMMWORD[32+rdi]
+	vpxor	xmm4,xmm4,XMMWORD[48+rdi]
+	vpxor	xmm5,xmm5,XMMWORD[64+rdi]
+	vpxor	xmm6,xmm6,XMMWORD[80+rdi]
+	vpxor	xmm7,xmm7,XMMWORD[96+rdi]
+	vpxor	xmm8,xmm8,XMMWORD[112+rdi]
+
+	sub	r8,1
+
+	vmovdqu	XMMWORD[rsi],xmm1
+	vmovdqu	XMMWORD[16+rsi],xmm2
+	vmovdqu	XMMWORD[32+rsi],xmm3
+	vmovdqu	XMMWORD[48+rsi],xmm4
+	vmovdqu	XMMWORD[64+rsi],xmm5
+	vmovdqu	XMMWORD[80+rsi],xmm6
+	vmovdqu	XMMWORD[96+rsi],xmm7
+	vmovdqu	XMMWORD[112+rsi],xmm8
+
+	jne	NEAR $L$256_enc_msg_x8_loop1
+
+	add	rsi,128
+	add	rdi,128
+
+$L$256_enc_msg_x8_check_remainder:
+	cmp	r10,0
+	je	NEAR $L$256_enc_msg_x8_out
+
+$L$256_enc_msg_x8_loop2:
+
+
+	vmovdqa	xmm1,xmm0
+	vpaddd	xmm0,xmm0,XMMWORD[one]
+
+	vpxor	xmm1,xmm1,XMMWORD[rcx]
+	vaesenc	xmm1,xmm1,XMMWORD[16+rcx]
+	vaesenc	xmm1,xmm1,XMMWORD[32+rcx]
+	vaesenc	xmm1,xmm1,XMMWORD[48+rcx]
+	vaesenc	xmm1,xmm1,XMMWORD[64+rcx]
+	vaesenc	xmm1,xmm1,XMMWORD[80+rcx]
+	vaesenc	xmm1,xmm1,XMMWORD[96+rcx]
+	vaesenc	xmm1,xmm1,XMMWORD[112+rcx]
+	vaesenc	xmm1,xmm1,XMMWORD[128+rcx]
+	vaesenc	xmm1,xmm1,XMMWORD[144+rcx]
+	vaesenc	xmm1,xmm1,XMMWORD[160+rcx]
+	vaesenc	xmm1,xmm1,XMMWORD[176+rcx]
+	vaesenc	xmm1,xmm1,XMMWORD[192+rcx]
+	vaesenc	xmm1,xmm1,XMMWORD[208+rcx]
+	vaesenclast	xmm1,xmm1,XMMWORD[224+rcx]
+
+
+	vpxor	xmm1,xmm1,XMMWORD[rdi]
+
+	vmovdqu	XMMWORD[rsi],xmm1
+
+	add	rdi,16
+	add	rsi,16
+	sub	r10,1
+	jnz	NEAR $L$256_enc_msg_x8_loop2
+
+$L$256_enc_msg_x8_out:
+	mov	rdi,QWORD[8+rsp]	;WIN64 epilogue
+	mov	rsi,QWORD[16+rsp]
+	DB	0F3h,0C3h		;repret
+
+
+$L$SEH_end_aes256gcmsiv_enc_msg_x8:
+global	aes256gcmsiv_dec
+
+ALIGN	16
+aes256gcmsiv_dec:
+	mov	QWORD[8+rsp],rdi	;WIN64 prologue
+	mov	QWORD[16+rsp],rsi
+	mov	rax,rsp
+$L$SEH_begin_aes256gcmsiv_dec:
+	mov	rdi,rcx
+	mov	rsi,rdx
+	mov	rdx,r8
+	mov	rcx,r9
+	mov	r8,QWORD[40+rsp]
+	mov	r9,QWORD[48+rsp]
+
+
+
+	test	r9,~15
+	jnz	NEAR $L$256_dec_start
+	mov	rdi,QWORD[8+rsp]	;WIN64 epilogue
+	mov	rsi,QWORD[16+rsp]
+	DB	0F3h,0C3h		;repret
+
+$L$256_dec_start:
+	vzeroupper
+	vmovdqa	xmm0,XMMWORD[rdx]
+	mov	rax,rdx
+
+	lea	rax,[32+rax]
+	lea	rcx,[32+rcx]
+
+
+	vmovdqu	xmm15,XMMWORD[r9*1+rdi]
+	vpor	xmm15,xmm15,XMMWORD[OR_MASK]
+	and	r9,~15
+
+
+	cmp	r9,96
+	jb	NEAR $L$256_dec_loop2
+
+
+	sub	r9,96
+	vmovdqa	xmm7,xmm15
+	vpaddd	xmm8,xmm7,XMMWORD[one]
+	vpaddd	xmm9,xmm7,XMMWORD[two]
+	vpaddd	xmm10,xmm9,XMMWORD[one]
+	vpaddd	xmm11,xmm9,XMMWORD[two]
+	vpaddd	xmm12,xmm11,XMMWORD[one]
+	vpaddd	xmm15,xmm11,XMMWORD[two]
+
+	vpxor	xmm7,xmm7,XMMWORD[r8]
+	vpxor	xmm8,xmm8,XMMWORD[r8]
+	vpxor	xmm9,xmm9,XMMWORD[r8]
+	vpxor	xmm10,xmm10,XMMWORD[r8]
+	vpxor	xmm11,xmm11,XMMWORD[r8]
+	vpxor	xmm12,xmm12,XMMWORD[r8]
+
+	vmovdqu	xmm4,XMMWORD[16+r8]
+	vaesenc	xmm7,xmm7,xmm4
+	vaesenc	xmm8,xmm8,xmm4
+	vaesenc	xmm9,xmm9,xmm4
+	vaesenc	xmm10,xmm10,xmm4
+	vaesenc	xmm11,xmm11,xmm4
+	vaesenc	xmm12,xmm12,xmm4
+
+	vmovdqu	xmm4,XMMWORD[32+r8]
+	vaesenc	xmm7,xmm7,xmm4
+	vaesenc	xmm8,xmm8,xmm4
+	vaesenc	xmm9,xmm9,xmm4
+	vaesenc	xmm10,xmm10,xmm4
+	vaesenc	xmm11,xmm11,xmm4
+	vaesenc	xmm12,xmm12,xmm4
+
+	vmovdqu	xmm4,XMMWORD[48+r8]
+	vaesenc	xmm7,xmm7,xmm4
+	vaesenc	xmm8,xmm8,xmm4
+	vaesenc	xmm9,xmm9,xmm4
+	vaesenc	xmm10,xmm10,xmm4
+	vaesenc	xmm11,xmm11,xmm4
+	vaesenc	xmm12,xmm12,xmm4
+
+	vmovdqu	xmm4,XMMWORD[64+r8]
+	vaesenc	xmm7,xmm7,xmm4
+	vaesenc	xmm8,xmm8,xmm4
+	vaesenc	xmm9,xmm9,xmm4
+	vaesenc	xmm10,xmm10,xmm4
+	vaesenc	xmm11,xmm11,xmm4
+	vaesenc	xmm12,xmm12,xmm4
+
+	vmovdqu	xmm4,XMMWORD[80+r8]
+	vaesenc	xmm7,xmm7,xmm4
+	vaesenc	xmm8,xmm8,xmm4
+	vaesenc	xmm9,xmm9,xmm4
+	vaesenc	xmm10,xmm10,xmm4
+	vaesenc	xmm11,xmm11,xmm4
+	vaesenc	xmm12,xmm12,xmm4
+
+	vmovdqu	xmm4,XMMWORD[96+r8]
+	vaesenc	xmm7,xmm7,xmm4
+	vaesenc	xmm8,xmm8,xmm4
+	vaesenc	xmm9,xmm9,xmm4
+	vaesenc	xmm10,xmm10,xmm4
+	vaesenc	xmm11,xmm11,xmm4
+	vaesenc	xmm12,xmm12,xmm4
+
+	vmovdqu	xmm4,XMMWORD[112+r8]
+	vaesenc	xmm7,xmm7,xmm4
+	vaesenc	xmm8,xmm8,xmm4
+	vaesenc	xmm9,xmm9,xmm4
+	vaesenc	xmm10,xmm10,xmm4
+	vaesenc	xmm11,xmm11,xmm4
+	vaesenc	xmm12,xmm12,xmm4
+
+	vmovdqu	xmm4,XMMWORD[128+r8]
+	vaesenc	xmm7,xmm7,xmm4
+	vaesenc	xmm8,xmm8,xmm4
+	vaesenc	xmm9,xmm9,xmm4
+	vaesenc	xmm10,xmm10,xmm4
+	vaesenc	xmm11,xmm11,xmm4
+	vaesenc	xmm12,xmm12,xmm4
+
+	vmovdqu	xmm4,XMMWORD[144+r8]
+	vaesenc	xmm7,xmm7,xmm4
+	vaesenc	xmm8,xmm8,xmm4
+	vaesenc	xmm9,xmm9,xmm4
+	vaesenc	xmm10,xmm10,xmm4
+	vaesenc	xmm11,xmm11,xmm4
+	vaesenc	xmm12,xmm12,xmm4
+
+	vmovdqu	xmm4,XMMWORD[160+r8]
+	vaesenc	xmm7,xmm7,xmm4
+	vaesenc	xmm8,xmm8,xmm4
+	vaesenc	xmm9,xmm9,xmm4
+	vaesenc	xmm10,xmm10,xmm4
+	vaesenc	xmm11,xmm11,xmm4
+	vaesenc	xmm12,xmm12,xmm4
+
+	vmovdqu	xmm4,XMMWORD[176+r8]
+	vaesenc	xmm7,xmm7,xmm4
+	vaesenc	xmm8,xmm8,xmm4
+	vaesenc	xmm9,xmm9,xmm4
+	vaesenc	xmm10,xmm10,xmm4
+	vaesenc	xmm11,xmm11,xmm4
+	vaesenc	xmm12,xmm12,xmm4
+
+	vmovdqu	xmm4,XMMWORD[192+r8]
+	vaesenc	xmm7,xmm7,xmm4
+	vaesenc	xmm8,xmm8,xmm4
+	vaesenc	xmm9,xmm9,xmm4
+	vaesenc	xmm10,xmm10,xmm4
+	vaesenc	xmm11,xmm11,xmm4
+	vaesenc	xmm12,xmm12,xmm4
+
+	vmovdqu	xmm4,XMMWORD[208+r8]
+	vaesenc	xmm7,xmm7,xmm4
+	vaesenc	xmm8,xmm8,xmm4
+	vaesenc	xmm9,xmm9,xmm4
+	vaesenc	xmm10,xmm10,xmm4
+	vaesenc	xmm11,xmm11,xmm4
+	vaesenc	xmm12,xmm12,xmm4
+
+	vmovdqu	xmm4,XMMWORD[224+r8]
+	vaesenclast	xmm7,xmm7,xmm4
+	vaesenclast	xmm8,xmm8,xmm4
+	vaesenclast	xmm9,xmm9,xmm4
+	vaesenclast	xmm10,xmm10,xmm4
+	vaesenclast	xmm11,xmm11,xmm4
+	vaesenclast	xmm12,xmm12,xmm4
+
+
+	vpxor	xmm7,xmm7,XMMWORD[rdi]
+	vpxor	xmm8,xmm8,XMMWORD[16+rdi]
+	vpxor	xmm9,xmm9,XMMWORD[32+rdi]
+	vpxor	xmm10,xmm10,XMMWORD[48+rdi]
+	vpxor	xmm11,xmm11,XMMWORD[64+rdi]
+	vpxor	xmm12,xmm12,XMMWORD[80+rdi]
+
+	vmovdqu	XMMWORD[rsi],xmm7
+	vmovdqu	XMMWORD[16+rsi],xmm8
+	vmovdqu	XMMWORD[32+rsi],xmm9
+	vmovdqu	XMMWORD[48+rsi],xmm10
+	vmovdqu	XMMWORD[64+rsi],xmm11
+	vmovdqu	XMMWORD[80+rsi],xmm12
+
+	add	rdi,96
+	add	rsi,96
+	jmp	NEAR $L$256_dec_loop1
+
+
+ALIGN	64
+$L$256_dec_loop1:
+	cmp	r9,96
+	jb	NEAR $L$256_dec_finish_96
+	sub	r9,96
+
+	vmovdqa	xmm6,xmm12
+	vmovdqa	XMMWORD[(16-32)+rax],xmm11
+	vmovdqa	XMMWORD[(32-32)+rax],xmm10
+	vmovdqa	XMMWORD[(48-32)+rax],xmm9
+	vmovdqa	XMMWORD[(64-32)+rax],xmm8
+	vmovdqa	XMMWORD[(80-32)+rax],xmm7
+
+	vmovdqa	xmm7,xmm15
+	vpaddd	xmm8,xmm7,XMMWORD[one]
+	vpaddd	xmm9,xmm7,XMMWORD[two]
+	vpaddd	xmm10,xmm9,XMMWORD[one]
+	vpaddd	xmm11,xmm9,XMMWORD[two]
+	vpaddd	xmm12,xmm11,XMMWORD[one]
+	vpaddd	xmm15,xmm11,XMMWORD[two]
+
+	vmovdqa	xmm4,XMMWORD[r8]
+	vpxor	xmm7,xmm7,xmm4
+	vpxor	xmm8,xmm8,xmm4
+	vpxor	xmm9,xmm9,xmm4
+	vpxor	xmm10,xmm10,xmm4
+	vpxor	xmm11,xmm11,xmm4
+	vpxor	xmm12,xmm12,xmm4
+
+	vmovdqu	xmm4,XMMWORD[((0-32))+rcx]
+	vpclmulqdq	xmm2,xmm6,xmm4,0x11
+	vpclmulqdq	xmm3,xmm6,xmm4,0x00
+	vpclmulqdq	xmm1,xmm6,xmm4,0x01
+	vpclmulqdq	xmm4,xmm6,xmm4,0x10
+	vpxor	xmm1,xmm1,xmm4
+
+	vmovdqu	xmm4,XMMWORD[16+r8]
+	vaesenc	xmm7,xmm7,xmm4
+	vaesenc	xmm8,xmm8,xmm4
+	vaesenc	xmm9,xmm9,xmm4
+	vaesenc	xmm10,xmm10,xmm4
+	vaesenc	xmm11,xmm11,xmm4
+	vaesenc	xmm12,xmm12,xmm4
+
+	vmovdqu	xmm6,XMMWORD[((-16))+rax]
+	vmovdqu	xmm13,XMMWORD[((-16))+rcx]
+
+	vpclmulqdq	xmm4,xmm6,xmm13,0x10
+	vpxor	xmm1,xmm1,xmm4
+	vpclmulqdq	xmm4,xmm6,xmm13,0x11
+	vpxor	xmm2,xmm2,xmm4
+	vpclmulqdq	xmm4,xmm6,xmm13,0x00
+	vpxor	xmm3,xmm3,xmm4
+	vpclmulqdq	xmm4,xmm6,xmm13,0x01
+	vpxor	xmm1,xmm1,xmm4
+
+
+	vmovdqu	xmm4,XMMWORD[32+r8]
+	vaesenc	xmm7,xmm7,xmm4
+	vaesenc	xmm8,xmm8,xmm4
+	vaesenc	xmm9,xmm9,xmm4
+	vaesenc	xmm10,xmm10,xmm4
+	vaesenc	xmm11,xmm11,xmm4
+	vaesenc	xmm12,xmm12,xmm4
+
+	vmovdqu	xmm6,XMMWORD[rax]
+	vmovdqu	xmm13,XMMWORD[rcx]
+
+	vpclmulqdq	xmm4,xmm6,xmm13,0x10
+	vpxor	xmm1,xmm1,xmm4
+	vpclmulqdq	xmm4,xmm6,xmm13,0x11
+	vpxor	xmm2,xmm2,xmm4
+	vpclmulqdq	xmm4,xmm6,xmm13,0x00
+	vpxor	xmm3,xmm3,xmm4
+	vpclmulqdq	xmm4,xmm6,xmm13,0x01
+	vpxor	xmm1,xmm1,xmm4
+
+
+	vmovdqu	xmm4,XMMWORD[48+r8]
+	vaesenc	xmm7,xmm7,xmm4
+	vaesenc	xmm8,xmm8,xmm4
+	vaesenc	xmm9,xmm9,xmm4
+	vaesenc	xmm10,xmm10,xmm4
+	vaesenc	xmm11,xmm11,xmm4
+	vaesenc	xmm12,xmm12,xmm4
+
+	vmovdqu	xmm6,XMMWORD[16+rax]
+	vmovdqu	xmm13,XMMWORD[16+rcx]
+
+	vpclmulqdq	xmm4,xmm6,xmm13,0x10
+	vpxor	xmm1,xmm1,xmm4
+	vpclmulqdq	xmm4,xmm6,xmm13,0x11
+	vpxor	xmm2,xmm2,xmm4
+	vpclmulqdq	xmm4,xmm6,xmm13,0x00
+	vpxor	xmm3,xmm3,xmm4
+	vpclmulqdq	xmm4,xmm6,xmm13,0x01
+	vpxor	xmm1,xmm1,xmm4
+
+
+	vmovdqu	xmm4,XMMWORD[64+r8]
+	vaesenc	xmm7,xmm7,xmm4
+	vaesenc	xmm8,xmm8,xmm4
+	vaesenc	xmm9,xmm9,xmm4
+	vaesenc	xmm10,xmm10,xmm4
+	vaesenc	xmm11,xmm11,xmm4
+	vaesenc	xmm12,xmm12,xmm4
+
+	vmovdqu	xmm6,XMMWORD[32+rax]
+	vmovdqu	xmm13,XMMWORD[32+rcx]
+
+	vpclmulqdq	xmm4,xmm6,xmm13,0x10
+	vpxor	xmm1,xmm1,xmm4
+	vpclmulqdq	xmm4,xmm6,xmm13,0x11
+	vpxor	xmm2,xmm2,xmm4
+	vpclmulqdq	xmm4,xmm6,xmm13,0x00
+	vpxor	xmm3,xmm3,xmm4
+	vpclmulqdq	xmm4,xmm6,xmm13,0x01
+	vpxor	xmm1,xmm1,xmm4
+
+
+	vmovdqu	xmm4,XMMWORD[80+r8]
+	vaesenc	xmm7,xmm7,xmm4
+	vaesenc	xmm8,xmm8,xmm4
+	vaesenc	xmm9,xmm9,xmm4
+	vaesenc	xmm10,xmm10,xmm4
+	vaesenc	xmm11,xmm11,xmm4
+	vaesenc	xmm12,xmm12,xmm4
+
+	vmovdqu	xmm4,XMMWORD[96+r8]
+	vaesenc	xmm7,xmm7,xmm4
+	vaesenc	xmm8,xmm8,xmm4
+	vaesenc	xmm9,xmm9,xmm4
+	vaesenc	xmm10,xmm10,xmm4
+	vaesenc	xmm11,xmm11,xmm4
+	vaesenc	xmm12,xmm12,xmm4
+
+	vmovdqu	xmm4,XMMWORD[112+r8]
+	vaesenc	xmm7,xmm7,xmm4
+	vaesenc	xmm8,xmm8,xmm4
+	vaesenc	xmm9,xmm9,xmm4
+	vaesenc	xmm10,xmm10,xmm4
+	vaesenc	xmm11,xmm11,xmm4
+	vaesenc	xmm12,xmm12,xmm4
+
+
+	vmovdqa	xmm6,XMMWORD[((80-32))+rax]
+	vpxor	xmm6,xmm6,xmm0
+	vmovdqu	xmm5,XMMWORD[((80-32))+rcx]
+
+	vpclmulqdq	xmm4,xmm6,xmm5,0x01
+	vpxor	xmm1,xmm1,xmm4
+	vpclmulqdq	xmm4,xmm6,xmm5,0x11
+	vpxor	xmm2,xmm2,xmm4
+	vpclmulqdq	xmm4,xmm6,xmm5,0x00
+	vpxor	xmm3,xmm3,xmm4
+	vpclmulqdq	xmm4,xmm6,xmm5,0x10
+	vpxor	xmm1,xmm1,xmm4
+
+	vmovdqu	xmm4,XMMWORD[128+r8]
+	vaesenc	xmm7,xmm7,xmm4
+	vaesenc	xmm8,xmm8,xmm4
+	vaesenc	xmm9,xmm9,xmm4
+	vaesenc	xmm10,xmm10,xmm4
+	vaesenc	xmm11,xmm11,xmm4
+	vaesenc	xmm12,xmm12,xmm4
+
+
+	vpsrldq	xmm4,xmm1,8
+	vpxor	xmm5,xmm2,xmm4
+	vpslldq	xmm4,xmm1,8
+	vpxor	xmm0,xmm3,xmm4
+
+	vmovdqa	xmm3,XMMWORD[poly]
+
+	vmovdqu	xmm4,XMMWORD[144+r8]
+	vaesenc	xmm7,xmm7,xmm4
+	vaesenc	xmm8,xmm8,xmm4
+	vaesenc	xmm9,xmm9,xmm4
+	vaesenc	xmm10,xmm10,xmm4
+	vaesenc	xmm11,xmm11,xmm4
+	vaesenc	xmm12,xmm12,xmm4
+
+	vmovdqu	xmm4,XMMWORD[160+r8]
+	vaesenc	xmm7,xmm7,xmm4
+	vaesenc	xmm8,xmm8,xmm4
+	vaesenc	xmm9,xmm9,xmm4
+	vaesenc	xmm10,xmm10,xmm4
+	vaesenc	xmm11,xmm11,xmm4
+	vaesenc	xmm12,xmm12,xmm4
+
+	vmovdqu	xmm4,XMMWORD[176+r8]
+	vaesenc	xmm7,xmm7,xmm4
+	vaesenc	xmm8,xmm8,xmm4
+	vaesenc	xmm9,xmm9,xmm4
+	vaesenc	xmm10,xmm10,xmm4
+	vaesenc	xmm11,xmm11,xmm4
+	vaesenc	xmm12,xmm12,xmm4
+
+	vmovdqu	xmm4,XMMWORD[192+r8]
+	vaesenc	xmm7,xmm7,xmm4
+	vaesenc	xmm8,xmm8,xmm4
+	vaesenc	xmm9,xmm9,xmm4
+	vaesenc	xmm10,xmm10,xmm4
+	vaesenc	xmm11,xmm11,xmm4
+	vaesenc	xmm12,xmm12,xmm4
+
+	vmovdqu	xmm4,XMMWORD[208+r8]
+	vaesenc	xmm7,xmm7,xmm4
+	vaesenc	xmm8,xmm8,xmm4
+	vaesenc	xmm9,xmm9,xmm4
+	vaesenc	xmm10,xmm10,xmm4
+	vaesenc	xmm11,xmm11,xmm4
+	vaesenc	xmm12,xmm12,xmm4
+
+	vmovdqu	xmm6,XMMWORD[224+r8]
+	vpalignr	xmm2,xmm0,xmm0,8
+	vpclmulqdq	xmm0,xmm0,xmm3,0x10
+	vpxor	xmm0,xmm2,xmm0
+
+	vpxor	xmm4,xmm6,XMMWORD[rdi]
+	vaesenclast	xmm7,xmm7,xmm4
+	vpxor	xmm4,xmm6,XMMWORD[16+rdi]
+	vaesenclast	xmm8,xmm8,xmm4
+	vpxor	xmm4,xmm6,XMMWORD[32+rdi]
+	vaesenclast	xmm9,xmm9,xmm4
+	vpxor	xmm4,xmm6,XMMWORD[48+rdi]
+	vaesenclast	xmm10,xmm10,xmm4
+	vpxor	xmm4,xmm6,XMMWORD[64+rdi]
+	vaesenclast	xmm11,xmm11,xmm4
+	vpxor	xmm4,xmm6,XMMWORD[80+rdi]
+	vaesenclast	xmm12,xmm12,xmm4
+
+	vpalignr	xmm2,xmm0,xmm0,8
+	vpclmulqdq	xmm0,xmm0,xmm3,0x10
+	vpxor	xmm0,xmm2,xmm0
+
+	vmovdqu	XMMWORD[rsi],xmm7
+	vmovdqu	XMMWORD[16+rsi],xmm8
+	vmovdqu	XMMWORD[32+rsi],xmm9
+	vmovdqu	XMMWORD[48+rsi],xmm10
+	vmovdqu	XMMWORD[64+rsi],xmm11
+	vmovdqu	XMMWORD[80+rsi],xmm12
+
+	vpxor	xmm0,xmm0,xmm5
+
+	lea	rdi,[96+rdi]
+	lea	rsi,[96+rsi]
+	jmp	NEAR $L$256_dec_loop1
+
+$L$256_dec_finish_96:
+	vmovdqa	xmm6,xmm12
+	vmovdqa	XMMWORD[(16-32)+rax],xmm11
+	vmovdqa	XMMWORD[(32-32)+rax],xmm10
+	vmovdqa	XMMWORD[(48-32)+rax],xmm9
+	vmovdqa	XMMWORD[(64-32)+rax],xmm8
+	vmovdqa	XMMWORD[(80-32)+rax],xmm7
+
+	vmovdqu	xmm4,XMMWORD[((0-32))+rcx]
+	vpclmulqdq	xmm1,xmm6,xmm4,0x10
+	vpclmulqdq	xmm2,xmm6,xmm4,0x11
+	vpclmulqdq	xmm3,xmm6,xmm4,0x00
+	vpclmulqdq	xmm4,xmm6,xmm4,0x01
+	vpxor	xmm1,xmm1,xmm4
+
+	vmovdqu	xmm6,XMMWORD[((-16))+rax]
+	vmovdqu	xmm13,XMMWORD[((-16))+rcx]
+
+	vpclmulqdq	xmm4,xmm6,xmm13,0x10
+	vpxor	xmm1,xmm1,xmm4
+	vpclmulqdq	xmm4,xmm6,xmm13,0x11
+	vpxor	xmm2,xmm2,xmm4
+	vpclmulqdq	xmm4,xmm6,xmm13,0x00
+	vpxor	xmm3,xmm3,xmm4
+	vpclmulqdq	xmm4,xmm6,xmm13,0x01
+	vpxor	xmm1,xmm1,xmm4
+
+	vmovdqu	xmm6,XMMWORD[rax]
+	vmovdqu	xmm13,XMMWORD[rcx]
+
+	vpclmulqdq	xmm4,xmm6,xmm13,0x10
+	vpxor	xmm1,xmm1,xmm4
+	vpclmulqdq	xmm4,xmm6,xmm13,0x11
+	vpxor	xmm2,xmm2,xmm4
+	vpclmulqdq	xmm4,xmm6,xmm13,0x00
+	vpxor	xmm3,xmm3,xmm4
+	vpclmulqdq	xmm4,xmm6,xmm13,0x01
+	vpxor	xmm1,xmm1,xmm4
+
+	vmovdqu	xmm6,XMMWORD[16+rax]
+	vmovdqu	xmm13,XMMWORD[16+rcx]
+
+	vpclmulqdq	xmm4,xmm6,xmm13,0x10
+	vpxor	xmm1,xmm1,xmm4
+	vpclmulqdq	xmm4,xmm6,xmm13,0x11
+	vpxor	xmm2,xmm2,xmm4
+	vpclmulqdq	xmm4,xmm6,xmm13,0x00
+	vpxor	xmm3,xmm3,xmm4
+	vpclmulqdq	xmm4,xmm6,xmm13,0x01
+	vpxor	xmm1,xmm1,xmm4
+
+	vmovdqu	xmm6,XMMWORD[32+rax]
+	vmovdqu	xmm13,XMMWORD[32+rcx]
+
+	vpclmulqdq	xmm4,xmm6,xmm13,0x10
+	vpxor	xmm1,xmm1,xmm4
+	vpclmulqdq	xmm4,xmm6,xmm13,0x11
+	vpxor	xmm2,xmm2,xmm4
+	vpclmulqdq	xmm4,xmm6,xmm13,0x00
+	vpxor	xmm3,xmm3,xmm4
+	vpclmulqdq	xmm4,xmm6,xmm13,0x01
+	vpxor	xmm1,xmm1,xmm4
+
+
+	vmovdqu	xmm6,XMMWORD[((80-32))+rax]
+	vpxor	xmm6,xmm6,xmm0
+	vmovdqu	xmm5,XMMWORD[((80-32))+rcx]
+	vpclmulqdq	xmm4,xmm6,xmm5,0x11
+	vpxor	xmm2,xmm2,xmm4
+	vpclmulqdq	xmm4,xmm6,xmm5,0x00
+	vpxor	xmm3,xmm3,xmm4
+	vpclmulqdq	xmm4,xmm6,xmm5,0x10
+	vpxor	xmm1,xmm1,xmm4
+	vpclmulqdq	xmm4,xmm6,xmm5,0x01
+	vpxor	xmm1,xmm1,xmm4
+
+	vpsrldq	xmm4,xmm1,8
+	vpxor	xmm5,xmm2,xmm4
+	vpslldq	xmm4,xmm1,8
+	vpxor	xmm0,xmm3,xmm4
+
+	vmovdqa	xmm3,XMMWORD[poly]
+
+	vpalignr	xmm2,xmm0,xmm0,8
+	vpclmulqdq	xmm0,xmm0,xmm3,0x10
+	vpxor	xmm0,xmm2,xmm0
+
+	vpalignr	xmm2,xmm0,xmm0,8
+	vpclmulqdq	xmm0,xmm0,xmm3,0x10
+	vpxor	xmm0,xmm2,xmm0
+
+	vpxor	xmm0,xmm0,xmm5
+
+$L$256_dec_loop2:
+
+
+
+	cmp	r9,16
+	jb	NEAR $L$256_dec_out
+	sub	r9,16
+
+	vmovdqa	xmm2,xmm15
+	vpaddd	xmm15,xmm15,XMMWORD[one]
+
+	vpxor	xmm2,xmm2,XMMWORD[r8]
+	vaesenc	xmm2,xmm2,XMMWORD[16+r8]
+	vaesenc	xmm2,xmm2,XMMWORD[32+r8]
+	vaesenc	xmm2,xmm2,XMMWORD[48+r8]
+	vaesenc	xmm2,xmm2,XMMWORD[64+r8]
+	vaesenc	xmm2,xmm2,XMMWORD[80+r8]
+	vaesenc	xmm2,xmm2,XMMWORD[96+r8]
+	vaesenc	xmm2,xmm2,XMMWORD[112+r8]
+	vaesenc	xmm2,xmm2,XMMWORD[128+r8]
+	vaesenc	xmm2,xmm2,XMMWORD[144+r8]
+	vaesenc	xmm2,xmm2,XMMWORD[160+r8]
+	vaesenc	xmm2,xmm2,XMMWORD[176+r8]
+	vaesenc	xmm2,xmm2,XMMWORD[192+r8]
+	vaesenc	xmm2,xmm2,XMMWORD[208+r8]
+	vaesenclast	xmm2,xmm2,XMMWORD[224+r8]
+	vpxor	xmm2,xmm2,XMMWORD[rdi]
+	vmovdqu	XMMWORD[rsi],xmm2
+	add	rdi,16
+	add	rsi,16
+
+	vpxor	xmm0,xmm0,xmm2
+	vmovdqa	xmm1,XMMWORD[((-32))+rcx]
+	call	GFMUL
+
+	jmp	NEAR $L$256_dec_loop2
+
+$L$256_dec_out:
+	vmovdqu	XMMWORD[rdx],xmm0
+	mov	rdi,QWORD[8+rsp]	;WIN64 epilogue
+	mov	rsi,QWORD[16+rsp]
+	DB	0F3h,0C3h		;repret
+
+$L$SEH_end_aes256gcmsiv_dec:
+global	aes256gcmsiv_kdf
+
+ALIGN	16
+aes256gcmsiv_kdf:
+	mov	QWORD[8+rsp],rdi	;WIN64 prologue
+	mov	QWORD[16+rsp],rsi
+	mov	rax,rsp
+$L$SEH_begin_aes256gcmsiv_kdf:
+	mov	rdi,rcx
+	mov	rsi,rdx
+	mov	rdx,r8
+
+
+
+
+
+
+
+	vmovdqa	xmm1,XMMWORD[rdx]
+	vmovdqa	xmm4,XMMWORD[rdi]
+	vmovdqa	xmm11,XMMWORD[and_mask]
+	vmovdqa	xmm8,XMMWORD[one]
+	vpshufd	xmm4,xmm4,0x90
+	vpand	xmm4,xmm4,xmm11
+	vpaddd	xmm6,xmm4,xmm8
+	vpaddd	xmm7,xmm6,xmm8
+	vpaddd	xmm11,xmm7,xmm8
+	vpaddd	xmm12,xmm11,xmm8
+	vpaddd	xmm13,xmm12,xmm8
+
+	vpxor	xmm4,xmm4,xmm1
+	vpxor	xmm6,xmm6,xmm1
+	vpxor	xmm7,xmm7,xmm1
+	vpxor	xmm11,xmm11,xmm1
+	vpxor	xmm12,xmm12,xmm1
+	vpxor	xmm13,xmm13,xmm1
+
+	vmovdqa	xmm1,XMMWORD[16+rdx]
+	vaesenc	xmm4,xmm4,xmm1
+	vaesenc	xmm6,xmm6,xmm1
+	vaesenc	xmm7,xmm7,xmm1
+	vaesenc	xmm11,xmm11,xmm1
+	vaesenc	xmm12,xmm12,xmm1
+	vaesenc	xmm13,xmm13,xmm1
+
+	vmovdqa	xmm2,XMMWORD[32+rdx]
+	vaesenc	xmm4,xmm4,xmm2
+	vaesenc	xmm6,xmm6,xmm2
+	vaesenc	xmm7,xmm7,xmm2
+	vaesenc	xmm11,xmm11,xmm2
+	vaesenc	xmm12,xmm12,xmm2
+	vaesenc	xmm13,xmm13,xmm2
+
+	vmovdqa	xmm1,XMMWORD[48+rdx]
+	vaesenc	xmm4,xmm4,xmm1
+	vaesenc	xmm6,xmm6,xmm1
+	vaesenc	xmm7,xmm7,xmm1
+	vaesenc	xmm11,xmm11,xmm1
+	vaesenc	xmm12,xmm12,xmm1
+	vaesenc	xmm13,xmm13,xmm1
+
+	vmovdqa	xmm2,XMMWORD[64+rdx]
+	vaesenc	xmm4,xmm4,xmm2
+	vaesenc	xmm6,xmm6,xmm2
+	vaesenc	xmm7,xmm7,xmm2
+	vaesenc	xmm11,xmm11,xmm2
+	vaesenc	xmm12,xmm12,xmm2
+	vaesenc	xmm13,xmm13,xmm2
+
+	vmovdqa	xmm1,XMMWORD[80+rdx]
+	vaesenc	xmm4,xmm4,xmm1
+	vaesenc	xmm6,xmm6,xmm1
+	vaesenc	xmm7,xmm7,xmm1
+	vaesenc	xmm11,xmm11,xmm1
+	vaesenc	xmm12,xmm12,xmm1
+	vaesenc	xmm13,xmm13,xmm1
+
+	vmovdqa	xmm2,XMMWORD[96+rdx]
+	vaesenc	xmm4,xmm4,xmm2
+	vaesenc	xmm6,xmm6,xmm2
+	vaesenc	xmm7,xmm7,xmm2
+	vaesenc	xmm11,xmm11,xmm2
+	vaesenc	xmm12,xmm12,xmm2
+	vaesenc	xmm13,xmm13,xmm2
+
+	vmovdqa	xmm1,XMMWORD[112+rdx]
+	vaesenc	xmm4,xmm4,xmm1
+	vaesenc	xmm6,xmm6,xmm1
+	vaesenc	xmm7,xmm7,xmm1
+	vaesenc	xmm11,xmm11,xmm1
+	vaesenc	xmm12,xmm12,xmm1
+	vaesenc	xmm13,xmm13,xmm1
+
+	vmovdqa	xmm2,XMMWORD[128+rdx]
+	vaesenc	xmm4,xmm4,xmm2
+	vaesenc	xmm6,xmm6,xmm2
+	vaesenc	xmm7,xmm7,xmm2
+	vaesenc	xmm11,xmm11,xmm2
+	vaesenc	xmm12,xmm12,xmm2
+	vaesenc	xmm13,xmm13,xmm2
+
+	vmovdqa	xmm1,XMMWORD[144+rdx]
+	vaesenc	xmm4,xmm4,xmm1
+	vaesenc	xmm6,xmm6,xmm1
+	vaesenc	xmm7,xmm7,xmm1
+	vaesenc	xmm11,xmm11,xmm1
+	vaesenc	xmm12,xmm12,xmm1
+	vaesenc	xmm13,xmm13,xmm1
+
+	vmovdqa	xmm2,XMMWORD[160+rdx]
+	vaesenc	xmm4,xmm4,xmm2
+	vaesenc	xmm6,xmm6,xmm2
+	vaesenc	xmm7,xmm7,xmm2
+	vaesenc	xmm11,xmm11,xmm2
+	vaesenc	xmm12,xmm12,xmm2
+	vaesenc	xmm13,xmm13,xmm2
+
+	vmovdqa	xmm1,XMMWORD[176+rdx]
+	vaesenc	xmm4,xmm4,xmm1
+	vaesenc	xmm6,xmm6,xmm1
+	vaesenc	xmm7,xmm7,xmm1
+	vaesenc	xmm11,xmm11,xmm1
+	vaesenc	xmm12,xmm12,xmm1
+	vaesenc	xmm13,xmm13,xmm1
+
+	vmovdqa	xmm2,XMMWORD[192+rdx]
+	vaesenc	xmm4,xmm4,xmm2
+	vaesenc	xmm6,xmm6,xmm2
+	vaesenc	xmm7,xmm7,xmm2
+	vaesenc	xmm11,xmm11,xmm2
+	vaesenc	xmm12,xmm12,xmm2
+	vaesenc	xmm13,xmm13,xmm2
+
+	vmovdqa	xmm1,XMMWORD[208+rdx]
+	vaesenc	xmm4,xmm4,xmm1
+	vaesenc	xmm6,xmm6,xmm1
+	vaesenc	xmm7,xmm7,xmm1
+	vaesenc	xmm11,xmm11,xmm1
+	vaesenc	xmm12,xmm12,xmm1
+	vaesenc	xmm13,xmm13,xmm1
+
+	vmovdqa	xmm2,XMMWORD[224+rdx]
+	vaesenclast	xmm4,xmm4,xmm2
+	vaesenclast	xmm6,xmm6,xmm2
+	vaesenclast	xmm7,xmm7,xmm2
+	vaesenclast	xmm11,xmm11,xmm2
+	vaesenclast	xmm12,xmm12,xmm2
+	vaesenclast	xmm13,xmm13,xmm2
+
+
+	vmovdqa	XMMWORD[rsi],xmm4
+	vmovdqa	XMMWORD[16+rsi],xmm6
+	vmovdqa	XMMWORD[32+rsi],xmm7
+	vmovdqa	XMMWORD[48+rsi],xmm11
+	vmovdqa	XMMWORD[64+rsi],xmm12
+	vmovdqa	XMMWORD[80+rsi],xmm13
+	mov	rdi,QWORD[8+rsp]	;WIN64 epilogue
+	mov	rsi,QWORD[16+rsp]
+	DB	0F3h,0C3h		;repret
+
+$L$SEH_end_aes256gcmsiv_kdf:
diff --git a/third_party/boringssl/win-x86_64/crypto/cipher/chacha20_poly1305_x86_64.asm b/third_party/boringssl/win-x86_64/crypto/cipher_extra/chacha20_poly1305_x86_64.asm
similarity index 100%
rename from third_party/boringssl/win-x86_64/crypto/cipher/chacha20_poly1305_x86_64.asm
rename to third_party/boringssl/win-x86_64/crypto/cipher_extra/chacha20_poly1305_x86_64.asm
diff --git a/third_party/boringssl/win-x86_64/crypto/ec/p256-x86_64-asm.asm b/third_party/boringssl/win-x86_64/crypto/fipsmodule/p256-x86_64-asm.asm
similarity index 100%
rename from third_party/boringssl/win-x86_64/crypto/ec/p256-x86_64-asm.asm
rename to third_party/boringssl/win-x86_64/crypto/fipsmodule/p256-x86_64-asm.asm
diff --git a/tools/metrics/ukm/model.py b/tools/metrics/ukm/model.py
index f0c7ebe..6d95140 100644
--- a/tools/metrics/ukm/model.py
+++ b/tools/metrics/ukm/model.py
@@ -28,7 +28,7 @@
 _EVENT_TYPE =  models.ObjectNodeType(
     'event',
     alphabetization=('metric', _LOWERCASE_NAME_FN),
-    attributes=[('name', unicode)],
+    attributes=[('name', unicode), ('singular', bool)],
     extra_newlines=(1, 1, 1),
     children=[
         models.ChildType('obsolete', _OBSOLETE_TYPE, False),
diff --git a/tools/metrics/ukm/ukm.xml b/tools/metrics/ukm/ukm.xml
index 85d38826..2b809c8 100644
--- a/tools/metrics/ukm/ukm.xml
+++ b/tools/metrics/ukm/ukm.xml
@@ -7,6 +7,10 @@
 <!--
 This file is used to generate a comprehensive list of Chrome UKM metrics
 along with a detailed description for each metric.
+
+Events may be marked with the attribute singular="True" to indicate that
+the event will only occur once per source, and multiple entries will just
+be describing additional metrics about the same event.
 -->
 
 <ukm-configuration>
@@ -155,7 +159,7 @@
   </metric>
 </event>
 
-<event name="PageLoad">
+<event name="PageLoad" singular="True">
   <owner>bmcquade@chromium.org</owner>
   <summary>
     Recorded when Pageload observer events fire.
diff --git a/tools/perf/contrib/blink_perf_cmdline/OWNERS b/tools/perf/contrib/blink_perf_cmdline/OWNERS
new file mode 100644
index 0000000..93a9996c
--- /dev/null
+++ b/tools/perf/contrib/blink_perf_cmdline/OWNERS
@@ -0,0 +1,3 @@
+charliea@chromium.org
+nednguyen@google.com
+wangxianzhu@chromium.org
diff --git a/ui/accessibility/platform/ax_platform_node_win.cc b/ui/accessibility/platform/ax_platform_node_win.cc
index 43dc94dd..79d9b08 100644
--- a/ui/accessibility/platform/ax_platform_node_win.cc
+++ b/ui/accessibility/platform/ax_platform_node_win.cc
@@ -183,7 +183,7 @@
   if (!accessible)
     return nullptr;
   base::win::ScopedComPtr<AXPlatformNodeWin> ax_platform_node;
-  accessible->QueryInterface(ax_platform_node.Receive());
+  accessible->QueryInterface(ax_platform_node.GetAddressOf());
   return ax_platform_node.Get();
 }
 
@@ -243,9 +243,9 @@
 int AXPlatformNodeWin::GetIndexInParent() {
   base::win::ScopedComPtr<IDispatch> parent_dispatch;
   base::win::ScopedComPtr<IAccessible> parent_accessible;
-  if (S_OK != get_accParent(parent_dispatch.Receive()))
+  if (S_OK != get_accParent(parent_dispatch.GetAddressOf()))
     return -1;
-  if (S_OK != parent_dispatch.CopyTo(parent_accessible.Receive()))
+  if (S_OK != parent_dispatch.CopyTo(parent_accessible.GetAddressOf()))
     return -1;
 
   LONG child_count = 0;
@@ -255,9 +255,9 @@
     base::win::ScopedVariant childid_index(index);
     base::win::ScopedComPtr<IDispatch> child_dispatch;
     base::win::ScopedComPtr<IAccessible> child_accessible;
-    if (S_OK == parent_accessible->get_accChild(childid_index,
-                                                child_dispatch.Receive()) &&
-        S_OK == child_dispatch.CopyTo(child_accessible.Receive())) {
+    if (S_OK == parent_accessible->get_accChild(
+                    childid_index, child_dispatch.GetAddressOf()) &&
+        S_OK == child_dispatch.CopyTo(child_accessible.GetAddressOf())) {
       if (child_accessible.Get() == this)
         return index - 1;
     }
diff --git a/ui/accessibility/platform/ax_platform_node_win_unittest.cc b/ui/accessibility/platform/ax_platform_node_win_unittest.cc
index 5dcfb79..38be292 100644
--- a/ui/accessibility/platform/ax_platform_node_win_unittest.cc
+++ b/ui/accessibility/platform/ax_platform_node_win_unittest.cc
@@ -99,8 +99,8 @@
     ScopedComPtr<IServiceProvider> service_provider;
     service_provider.QueryFrom(accessible.Get());
     ScopedComPtr<IAccessible2> result;
-    CHECK(SUCCEEDED(
-        service_provider->QueryService(IID_IAccessible2, result.Receive())));
+    CHECK(SUCCEEDED(service_provider->QueryService(IID_IAccessible2,
+                                                   result.GetAddressOf())));
     return result;
   }
 
@@ -290,21 +290,24 @@
 
   {
     ScopedComPtr<IDispatch> result;
-    EXPECT_EQ(S_OK, root_iaccessible->get_accChild(SELF, result.Receive()));
+    EXPECT_EQ(S_OK,
+              root_iaccessible->get_accChild(SELF, result.GetAddressOf()));
     EXPECT_EQ(result.Get(), root_iaccessible);
   }
 
   {
     ScopedComPtr<IDispatch> result;
     ScopedVariant child1(1);
-    EXPECT_EQ(S_OK, root_iaccessible->get_accChild(child1, result.Receive()));
+    EXPECT_EQ(S_OK,
+              root_iaccessible->get_accChild(child1, result.GetAddressOf()));
     EXPECT_EQ(result.Get(), button_iaccessible);
   }
 
   {
     ScopedComPtr<IDispatch> result;
     ScopedVariant child2(2);
-    EXPECT_EQ(S_OK, root_iaccessible->get_accChild(child2, result.Receive()));
+    EXPECT_EQ(S_OK,
+              root_iaccessible->get_accChild(child2, result.GetAddressOf()));
     EXPECT_EQ(result.Get(), checkbox_iaccessible);
   }
 
@@ -313,7 +316,7 @@
     ScopedComPtr<IDispatch> result;
     ScopedVariant child3(3);
     EXPECT_EQ(E_INVALIDARG,
-              root_iaccessible->get_accChild(child3, result.Receive()));
+              root_iaccessible->get_accChild(child3, result.GetAddressOf()));
   }
 
   // We should be able to ask for the button by its unique id too.
@@ -326,7 +329,7 @@
     ScopedComPtr<IDispatch> result;
     ScopedVariant button_id_variant(button_unique_id);
     EXPECT_EQ(S_OK, root_iaccessible->get_accChild(button_id_variant,
-                                                   result.Receive()));
+                                                   result.GetAddressOf()));
     EXPECT_EQ(result.Get(), button_iaccessible);
   }
 
@@ -340,26 +343,26 @@
   {
     ScopedComPtr<IDispatch> result;
     ScopedVariant root_id_variant(root_unique_id);
-    EXPECT_EQ(E_INVALIDARG, button_iaccessible->get_accChild(root_id_variant,
-                                                             result.Receive()));
+    EXPECT_EQ(E_INVALIDARG, button_iaccessible->get_accChild(
+                                root_id_variant, result.GetAddressOf()));
   }
 
   // Now check parents.
   {
     ScopedComPtr<IDispatch> result;
-    EXPECT_EQ(S_OK, button_iaccessible->get_accParent(result.Receive()));
+    EXPECT_EQ(S_OK, button_iaccessible->get_accParent(result.GetAddressOf()));
     EXPECT_EQ(result.Get(), root_iaccessible);
   }
 
   {
     ScopedComPtr<IDispatch> result;
-    EXPECT_EQ(S_OK, checkbox_iaccessible->get_accParent(result.Receive()));
+    EXPECT_EQ(S_OK, checkbox_iaccessible->get_accParent(result.GetAddressOf()));
     EXPECT_EQ(result.Get(), root_iaccessible);
   }
 
   {
     ScopedComPtr<IDispatch> result;
-    EXPECT_EQ(S_FALSE, root_iaccessible->get_accParent(result.Receive()));
+    EXPECT_EQ(S_FALSE, root_iaccessible->get_accParent(result.GetAddressOf()));
   }
 }
 
diff --git a/ui/app_list/app_list_features.cc b/ui/app_list/app_list_features.cc
index 36cadbf..d00e82a1 100644
--- a/ui/app_list/app_list_features.cc
+++ b/ui/app_list/app_list_features.cc
@@ -12,6 +12,8 @@
 
 const base::Feature kEnableAnswerCard{"EnableAnswerCard",
                                       base::FEATURE_DISABLED_BY_DEFAULT};
+const base::Feature kEnableAnswerCardDarkRun{"EnableAnswerCardDarkRun",
+                                             base::FEATURE_DISABLED_BY_DEFAULT};
 const base::Feature kEnableFullscreenAppList{"EnableFullscreenAppList",
                                              base::FEATURE_DISABLED_BY_DEFAULT};
 
@@ -20,6 +22,12 @@
   return enabled;
 }
 
+bool IsAnswerCardDarkRunEnabled() {
+  static const bool enabled =
+      base::FeatureList::IsEnabled(kEnableAnswerCardDarkRun);
+  return enabled;
+}
+
 bool IsFullscreenAppListEnabled() {
   // Not using local static variable to allow tests to change this value.
   return base::FeatureList::IsEnabled(kEnableFullscreenAppList);
diff --git a/ui/app_list/app_list_features.h b/ui/app_list/app_list_features.h
index 5e2aaeb..7d2992b0 100644
--- a/ui/app_list/app_list_features.h
+++ b/ui/app_list/app_list_features.h
@@ -21,10 +21,15 @@
 // Enables the answer card in the app list.
 APP_LIST_EXPORT extern const base::Feature kEnableAnswerCard;
 
+// Enables the dark run answer card in the app list. In this mode, answer cards
+// may be loaded via mock URLs and are not shown to the user.
+APP_LIST_EXPORT extern const base::Feature kEnableAnswerCardDarkRun;
+
 // Enables the fullscreen app list.
 APP_LIST_EXPORT extern const base::Feature kEnableFullscreenAppList;
 
 bool APP_LIST_EXPORT IsAnswerCardEnabled();
+bool APP_LIST_EXPORT IsAnswerCardDarkRunEnabled();
 bool APP_LIST_EXPORT IsFullscreenAppListEnabled();
 std::string APP_LIST_EXPORT AnswerServerUrl();
 
diff --git a/ui/base/dragdrop/os_exchange_data_win_unittest.cc b/ui/base/dragdrop/os_exchange_data_win_unittest.cc
index 51eae0a..e7966bf 100644
--- a/ui/base/dragdrop/os_exchange_data_win_unittest.cc
+++ b/ui/base/dragdrop/os_exchange_data_win_unittest.cc
@@ -185,7 +185,7 @@
       OSExchangeDataProviderWin::GetIDataObject(data));
   base::win::ScopedComPtr<IEnumFORMATETC> enumerator;
   EXPECT_EQ(S_OK, com_data.Get()->EnumFormatEtc(DATADIR_GET,
-                                                enumerator.Receive()));
+                                                enumerator.GetAddressOf()));
 
   // Test that we can get one item.
   {
@@ -238,7 +238,7 @@
     EXPECT_EQ(S_OK, enumerator->Reset());
     EXPECT_EQ(S_OK, enumerator->Skip(1));
     base::win::ScopedComPtr<IEnumFORMATETC> cloned_enumerator;
-    EXPECT_EQ(S_OK, enumerator.Get()->Clone(cloned_enumerator.Receive()));
+    EXPECT_EQ(S_OK, enumerator.Get()->Clone(cloned_enumerator.GetAddressOf()));
     EXPECT_EQ(S_OK, enumerator.Get()->Reset());
 
     {
diff --git a/ui/base/win/shell.cc b/ui/base/win/shell.cc
index d6a98df..0cace9b 100644
--- a/ui/base/win/shell.cc
+++ b/ui/base/win/shell.cc
@@ -104,8 +104,8 @@
     return false;
 
   base::win::ScopedComPtr<IPropertyStore> pps;
-  if (FAILED(SHGetPropertyStoreForWindow(hwnd,
-                                         IID_PPV_ARGS(pps.Receive()))))
+  if (FAILED(
+          SHGetPropertyStoreForWindow(hwnd, IID_PPV_ARGS(pps.GetAddressOf()))))
     return false;
 
   return base::win::SetBooleanValueForPropertyStore(
@@ -127,8 +127,8 @@
     return;
 
   base::win::ScopedComPtr<IPropertyStore> pps;
-  if (FAILED(SHGetPropertyStoreForWindow(hwnd,
-                                         IID_PPV_ARGS(pps.Receive()))))
+  if (FAILED(
+          SHGetPropertyStoreForWindow(hwnd, IID_PPV_ARGS(pps.GetAddressOf()))))
     return;
 
   if (!app_id.empty())
@@ -181,8 +181,8 @@
     return;
 
   base::win::ScopedComPtr<IPropertyStore> pps;
-  if (FAILED(SHGetPropertyStoreForWindow(hwnd,
-                                         IID_PPV_ARGS(pps.Receive()))))
+  if (FAILED(
+          SHGetPropertyStoreForWindow(hwnd, IID_PPV_ARGS(pps.GetAddressOf()))))
     return;
 
   DWORD property_count;
diff --git a/ui/events/blink/input_handler_proxy.cc b/ui/events/blink/input_handler_proxy.cc
index 0805248..abc8bb79a 100644
--- a/ui/events/blink/input_handler_proxy.cc
+++ b/ui/events/blink/input_handler_proxy.cc
@@ -910,6 +910,8 @@
       gesture_event.source_device == blink::kWebGestureDeviceTouchpad &&
       touchpad_and_wheel_scroll_latching_enabled_) {
     gesture_scroll_on_impl_thread_ = false;
+    client_->GenerateScrollBeginAndSendToMainThread(gesture_event);
+
     if (!gesture_pinch_on_impl_thread_)
       return DID_NOT_HANDLE;
   }
diff --git a/ui/events/blink/input_handler_proxy_client.h b/ui/events/blink/input_handler_proxy_client.h
index 74110c3..42d73d0c 100644
--- a/ui/events/blink/input_handler_proxy_client.h
+++ b/ui/events/blink/input_handler_proxy_client.h
@@ -55,6 +55,11 @@
 
   virtual void DidAnimateForInput() = 0;
 
+  // Used to send a GSB to the main thread when the wheel scroll latching is
+  // enabled and the scrolling should switch to the main thread.
+  virtual void GenerateScrollBeginAndSendToMainThread(
+      const blink::WebGestureEvent& update_event) = 0;
+
  protected:
   virtual ~InputHandlerProxyClient() {}
 };
diff --git a/ui/events/blink/input_handler_proxy_unittest.cc b/ui/events/blink/input_handler_proxy_unittest.cc
index 10ac758..24b6a2ba 100644
--- a/ui/events/blink/input_handler_proxy_unittest.cc
+++ b/ui/events/blink/input_handler_proxy_unittest.cc
@@ -289,6 +289,9 @@
   MOCK_METHOD1(DispatchNonBlockingEventToMainThread_,
                void(const WebInputEvent&));
 
+  MOCK_METHOD1(GenerateScrollBeginAndSendToMainThread,
+               void(const blink::WebGestureEvent& update_event));
+
   void DispatchNonBlockingEventToMainThread(
       WebScopedInputEvent event,
       const ui::LatencyInfo& latency_info) override {
@@ -1036,6 +1039,53 @@
   GestureFlingStartedTouchpad();
 }
 
+TEST_P(InputHandlerProxyTest, GestureScrollHandlingSwitchedToMainThread) {
+  // We shouldn't send any events to the widget for this gesture.
+  expected_disposition_ = InputHandlerProxy::DID_HANDLE;
+  VERIFY_AND_RESET_MOCKS();
+
+  EXPECT_CALL(mock_input_handler_, ScrollBegin(::testing::_, ::testing::_))
+      .WillOnce(testing::Return(kImplThreadScrollState));
+
+  // HandleGestureScrollBegin will set gesture_scroll_on_impl_thread_.
+  gesture_.SetType(WebInputEvent::kGestureScrollBegin);
+  EXPECT_EQ(expected_disposition_, input_handler_->HandleInputEvent(gesture_));
+  EXPECT_TRUE(input_handler_->gesture_scroll_on_impl_thread_for_testing());
+
+  VERIFY_AND_RESET_MOCKS();
+
+  gesture_.SetType(WebInputEvent::kGestureScrollUpdate);
+  gesture_.data.scroll_update.delta_y = -40;
+  EXPECT_CALL(
+      mock_input_handler_,
+      ScrollBy(testing::Property(&cc::ScrollState::delta_y, testing::Gt(0))))
+      .WillOnce(testing::Return(scroll_result_did_scroll_));
+  EXPECT_EQ(expected_disposition_, input_handler_->HandleInputEvent(gesture_));
+  EXPECT_TRUE(input_handler_->gesture_scroll_on_impl_thread_for_testing());
+
+  // The scroll handling switches to the main thread, a GSB is sent to the main
+  // thread to initiate the hit testing and compute the scroll chain.
+  expected_disposition_ = InputHandlerProxy::DID_NOT_HANDLE;
+  EXPECT_CALL(
+      mock_input_handler_,
+      ScrollBy(testing::Property(&cc::ScrollState::delta_y, testing::Gt(0))))
+      .WillOnce(testing::Return(scroll_result_did_not_scroll_));
+  EXPECT_CALL(mock_input_handler_, ScrollingShouldSwitchtoMainThread())
+      .WillOnce(testing::Return(true));
+  EXPECT_CALL(mock_client_,
+              GenerateScrollBeginAndSendToMainThread(::testing::_));
+  EXPECT_EQ(expected_disposition_, input_handler_->HandleInputEvent(gesture_));
+  EXPECT_FALSE(input_handler_->gesture_scroll_on_impl_thread_for_testing());
+
+  VERIFY_AND_RESET_MOCKS();
+
+  gesture_.SetType(WebInputEvent::kGestureScrollEnd);
+  EXPECT_CALL(mock_input_handler_, ScrollEnd(testing::_));
+  EXPECT_EQ(expected_disposition_, input_handler_->HandleInputEvent(gesture_));
+
+  VERIFY_AND_RESET_MOCKS();
+}
+
 TEST_P(InputHandlerProxyTest, GestureFlingTouchpadScrollLatchingEnabled) {
   // Reset the input_handler_ with wheel scroll latching enabled.
   input_handler_.reset(
diff --git a/ui/gfx/font_fallback_win.cc b/ui/gfx/font_fallback_win.cc
index d01547d..1610e27 100644
--- a/ui/gfx/font_fallback_win.cc
+++ b/ui/gfx/font_fallback_win.cc
@@ -357,16 +357,16 @@
   text_length = std::min(wcslen(text), static_cast<size_t>(text_length));
 
   base::win::ScopedComPtr<IDWriteFactory> factory;
-  gfx::win::CreateDWriteFactory(factory.Receive());
+  gfx::win::CreateDWriteFactory(factory.GetAddressOf());
   base::win::ScopedComPtr<IDWriteFactory2> factory2;
-  factory.CopyTo(factory2.Receive());
+  factory.CopyTo(factory2.GetAddressOf());
   if (!factory2) {
     // IDWriteFactory2 is not available before Win8.1
     return GetUniscribeFallbackFont(font, text, text_length, result);
   }
 
   base::win::ScopedComPtr<IDWriteFontFallback> fallback;
-  if (FAILED(factory2->GetSystemFontFallback(fallback.Receive())))
+  if (FAILED(factory2->GetSystemFontFallback(fallback.GetAddressOf())))
     return false;
 
   base::string16 locale = base::UTF8ToUTF16(base::i18n::GetConfiguredLocale());
@@ -374,7 +374,7 @@
   base::win::ScopedComPtr<IDWriteNumberSubstitution> number_substitution;
   if (FAILED(factory2->CreateNumberSubstitution(
           DWRITE_NUMBER_SUBSTITUTION_METHOD_NONE, locale.c_str(),
-          true /* ignoreUserOverride */, number_substitution.Receive()))) {
+          true /* ignoreUserOverride */, number_substitution.GetAddressOf()))) {
     return false;
   }
 
@@ -386,7 +386,7 @@
       base::i18n::IsRTL() ? DWRITE_READING_DIRECTION_RIGHT_TO_LEFT
                           : DWRITE_READING_DIRECTION_LEFT_TO_RIGHT;
   if (FAILED(Microsoft::WRL::MakeAndInitialize<gfx::win::TextAnalysisSource>(
-          text_analysis.Receive(), text, locale.c_str(),
+          text_analysis.GetAddressOf(), text, locale.c_str(),
           number_substitution.Get(), reading_direction))) {
     return false;
   }
@@ -397,8 +397,8 @@
   if (FAILED(fallback->MapCharacters(
           text_analysis.Get(), 0, text_length, nullptr, original_name.c_str(),
           static_cast<DWRITE_FONT_WEIGHT>(font.GetWeight()), font_style,
-          DWRITE_FONT_STRETCH_NORMAL, &mapped_length, mapped_font.Receive(),
-          &scale))) {
+          DWRITE_FONT_STRETCH_NORMAL, &mapped_length,
+          mapped_font.GetAddressOf(), &scale))) {
     return false;
   }
 
diff --git a/ui/gfx/platform_font_win.cc b/ui/gfx/platform_font_win.cc
index e3bbd20..100ee94 100644
--- a/ui/gfx/platform_font_win.cc
+++ b/ui/gfx/platform_font_win.cc
@@ -81,7 +81,7 @@
                                       LOGFONT* font_info,
                                       IDWriteFont** dwrite_font) {
   base::win::ScopedComPtr<IDWriteGdiInterop> gdi_interop;
-  HRESULT hr = factory->GetGdiInterop(gdi_interop.Receive());
+  HRESULT hr = factory->GetGdiInterop(gdi_interop.GetAddressOf());
   if (FAILED(hr)) {
     CHECK(false);
     return hr;
@@ -92,7 +92,7 @@
     return hr;
 
   base::win::ScopedComPtr<IDWriteFontCollection> font_collection;
-  hr = factory->GetSystemFontCollection(font_collection.Receive());
+  hr = factory->GetSystemFontCollection(font_collection.GetAddressOf());
   if (FAILED(hr)) {
     CHECK(false);
     return hr;
@@ -106,7 +106,7 @@
   base::win::ScopedSelectObject scoped_font(screen_dc, font.get());
 
   base::win::ScopedComPtr<IDWriteFontFace> font_face;
-  hr = gdi_interop->CreateFontFaceFromHdc(screen_dc, font_face.Receive());
+  hr = gdi_interop->CreateFontFaceFromHdc(screen_dc, font_face.GetAddressOf());
   if (FAILED(hr))
     return hr;
 
@@ -142,7 +142,7 @@
   // Get a matching font from the system font collection exposed by
   // DirectWrite.
   base::win::ScopedComPtr<IDWriteFontCollection> font_collection;
-  hr = factory->GetSystemFontCollection(font_collection.Receive());
+  hr = factory->GetSystemFontCollection(font_collection.GetAddressOf());
   if (FAILED(hr)) {
     CHECK(false);
     return hr;
@@ -196,11 +196,11 @@
   }
 
   if (index != UINT_MAX && exists) {
-    hr = font_collection->GetFontFamily(index, font_family.Receive());
+    hr = font_collection->GetFontFamily(index, font_family.GetAddressOf());
   } else {
     // If we fail to find a matching font, then fallback to the first font in
     // the list. This is what skia does as well.
-    hr = font_collection->GetFontFamily(0, font_family.Receive());
+    hr = font_collection->GetFontFamily(0, font_family.GetAddressOf());
   }
 
   if (FAILED(hr)) {
@@ -229,7 +229,7 @@
   // state in canary.
   base::win::ScopedComPtr<IDWriteFontList> matching_font_list;
   hr = font_family->GetMatchingFonts(weight, stretch, style,
-                                     matching_font_list.Receive());
+                                     matching_font_list.GetAddressOf());
   uint32_t matching_font_count = 0;
   if (SUCCEEDED(hr))
     matching_font_count = matching_font_list->GetFontCount();
@@ -267,12 +267,12 @@
 HRESULT GetFamilyNameFromDirectWriteFont(IDWriteFont* dwrite_font,
                                          base::string16* family_name) {
   base::win::ScopedComPtr<IDWriteFontFamily> font_family;
-  HRESULT hr = dwrite_font->GetFontFamily(font_family.Receive());
+  HRESULT hr = dwrite_font->GetFontFamily(font_family.GetAddressOf());
   if (FAILED(hr))
     CHECK(false);
 
   base::win::ScopedComPtr<IDWriteLocalizedStrings> family_names;
-  hr = font_family->GetFamilyNames(family_names.Receive());
+  hr = font_family->GetFamilyNames(family_names.GetAddressOf());
   if (FAILED(hr))
     CHECK(false);
 
@@ -525,7 +525,7 @@
   // DirectWrite to calculate the cap height.
   base::win::ScopedComPtr<IDWriteFont> dwrite_font;
   HRESULT hr = GetMatchingDirectWriteFont(
-      &font_info, italic, direct_write_factory_, dwrite_font.Receive());
+      &font_info, italic, direct_write_factory_, dwrite_font.GetAddressOf());
   if (FAILED(hr)) {
     CHECK(false);
     return nullptr;
diff --git a/ui/gfx/win/direct_manipulation.cc b/ui/gfx/win/direct_manipulation.cc
index 7f6a094..92f98982 100644
--- a/ui/gfx/win/direct_manipulation.cc
+++ b/ui/gfx/win/direct_manipulation.cc
@@ -40,7 +40,7 @@
       nullptr, CLSCTX_INPROC_SERVER);
   CHECK(SUCCEEDED(hr));
 
-  hr = manager_->GetUpdateManager(IID_PPV_ARGS(update_manager_.Receive()));
+  hr = manager_->GetUpdateManager(IID_PPV_ARGS(update_manager_.GetAddressOf()));
   CHECK(SUCCEEDED(hr));
 
   hr = compositor_->SetUpdateManager(update_manager_.Get());
@@ -50,7 +50,7 @@
   CHECK(SUCCEEDED(hr));
 
   hr = manager_->CreateViewport(frame_info_.Get(), window,
-      IID_PPV_ARGS(view_port_outer_.Receive()));
+                                IID_PPV_ARGS(view_port_outer_.GetAddressOf()));
   CHECK(SUCCEEDED(hr));
 
   //
@@ -74,7 +74,7 @@
   base::win::ScopedComPtr<IDirectManipulationPrimaryContent>
       primary_content_outer;
   HRESULT hr = view_port_outer_->GetPrimaryContent(
-      IID_PPV_ARGS(primary_content_outer.Receive()));
+      IID_PPV_ARGS(primary_content_outer.GetAddressOf()));
   CHECK(SUCCEEDED(hr));
 
   base::win::ScopedComPtr<IDirectManipulationContent> content_outer;
diff --git a/ui/gfx/win/direct_write.cc b/ui/gfx/win/direct_write.cc
index 341ffe9..5680ecc9 100644
--- a/ui/gfx/win/direct_write.cc
+++ b/ui/gfx/win/direct_write.cc
@@ -23,7 +23,7 @@
   base::win::ScopedComPtr<IUnknown> factory_unknown;
   HRESULT hr =
       DWriteCreateFactory(DWRITE_FACTORY_TYPE_SHARED, __uuidof(IDWriteFactory),
-                          factory_unknown.Receive());
+                          factory_unknown.GetAddressOf());
   if (FAILED(hr)) {
     base::debug::Alias(&hr);
     CHECK(false);
@@ -44,7 +44,7 @@
   }
 
   base::win::ScopedComPtr<IDWriteFactory> factory;
-  CreateDWriteFactory(factory.Receive());
+  CreateDWriteFactory(factory.GetAddressOf());
 
   if (!factory)
     return;
diff --git a/ui/gl/gl_angle_util_win.cc b/ui/gl/gl_angle_util_win.cc
index 29d8dcf..45e37ab4 100644
--- a/ui/gl/gl_angle_util_win.cc
+++ b/ui/gl/gl_angle_util_win.cc
@@ -119,14 +119,14 @@
     return dcomp_device;
 
   base::win::ScopedComPtr<IDXGIDevice> dxgi_device;
-  d3d11_device.CopyTo(dxgi_device.Receive());
+  d3d11_device.CopyTo(dxgi_device.GetAddressOf());
   base::win::ScopedComPtr<IDCompositionDesktopDevice> desktop_device;
   hr = create_device_function(dxgi_device.Get(),
-                              IID_PPV_ARGS(desktop_device.Receive()));
+                              IID_PPV_ARGS(desktop_device.GetAddressOf()));
   if (FAILED(hr))
     return dcomp_device;
 
-  hr = desktop_device.CopyTo(dcomp_device.Receive());
+  hr = desktop_device.CopyTo(dcomp_device.GetAddressOf());
   CHECK(SUCCEEDED(hr));
   d3d11_device->SetPrivateDataInterface(kDirectCompositionGUID,
                                         dcomp_device.Get());
diff --git a/ui/shell_dialogs/select_file_dialog_win.cc b/ui/shell_dialogs/select_file_dialog_win.cc
index 46804d2..411b8bd 100644
--- a/ui/shell_dialogs/select_file_dialog_win.cc
+++ b/ui/shell_dialogs/select_file_dialog_win.cc
@@ -549,7 +549,7 @@
     ZeroMemory(&out_dir_buffer, sizeof(out_dir_buffer));
     out_dir_buffer.uType = STRRET_WSTR;
     base::win::ScopedComPtr<IShellFolder> shell_folder;
-    if (SHGetDesktopFolder(shell_folder.Receive()) == NOERROR) {
+    if (SHGetDesktopFolder(shell_folder.GetAddressOf()) == NOERROR) {
       HRESULT hr = shell_folder->GetDisplayNameOf(list, SHGDN_FORPARSING,
                                                   &out_dir_buffer);
       if (SUCCEEDED(hr) && out_dir_buffer.uType == STRRET_WSTR) {
diff --git a/ui/views/accessibility/native_view_accessibility_win_unittest.cc b/ui/views/accessibility/native_view_accessibility_win_unittest.cc
index f28a2ee..1888168 100644
--- a/ui/views/accessibility/native_view_accessibility_win_unittest.cc
+++ b/ui/views/accessibility/native_view_accessibility_win_unittest.cc
@@ -51,7 +51,7 @@
     ScopedComPtr<IAccessible> view_accessible(
         view->GetNativeViewAccessible());
     ScopedComPtr<IServiceProvider> service_provider;
-    ASSERT_EQ(S_OK, view_accessible.CopyTo(service_provider.Receive()));
+    ASSERT_EQ(S_OK, view_accessible.CopyTo(service_provider.GetAddressOf()));
     ASSERT_EQ(S_OK,
         service_provider->QueryService(IID_IAccessible2_2, result));
   }
@@ -82,9 +82,9 @@
   ScopedComPtr<IAccessible> textfield_accessible;
   ScopedVariant child_index(1);
   ASSERT_EQ(S_OK, content_accessible->get_accChild(
-      child_index, textfield_dispatch.Receive()));
-  ASSERT_EQ(S_OK, textfield_dispatch.CopyTo(
-      textfield_accessible.Receive()));
+                      child_index, textfield_dispatch.GetAddressOf()));
+  ASSERT_EQ(S_OK,
+            textfield_dispatch.CopyTo(textfield_accessible.GetAddressOf()));
 
   ScopedBstr name;
   ScopedVariant childid_self(CHILDID_SELF);
@@ -121,9 +121,9 @@
   ScopedComPtr<IAccessible> child_view_accessible;
   ScopedVariant child_index_1(1);
   ASSERT_EQ(S_OK, root_view_accessible->get_accChild(
-      child_index_1, child_view_dispatch.Receive()));
-  ASSERT_EQ(S_OK, child_view_dispatch.CopyTo(
-      child_view_accessible.Receive()));
+                      child_index_1, child_view_dispatch.GetAddressOf()));
+  ASSERT_EQ(S_OK,
+            child_view_dispatch.CopyTo(child_view_accessible.GetAddressOf()));
 
   Widget owned_widget;
   Widget::InitParams owned_init_params =
@@ -140,9 +140,9 @@
   ScopedComPtr<IAccessible> child_widget_accessible;
   ScopedVariant child_index_2(2);
   ASSERT_EQ(S_OK, root_view_accessible->get_accChild(
-      child_index_2, child_widget_dispatch.Receive()));
+                      child_index_2, child_widget_dispatch.GetAddressOf()));
   ASSERT_EQ(S_OK, child_widget_dispatch.CopyTo(
-      child_widget_accessible.Receive()));
+                      child_widget_accessible.GetAddressOf()));
 
   ScopedComPtr<IDispatch> child_widget_sibling_dispatch;
   ScopedComPtr<IAccessible> child_widget_sibling_accessible;
@@ -153,15 +153,15 @@
   ASSERT_EQ(VT_DISPATCH, V_VT(result.ptr()));
   child_widget_sibling_dispatch = V_DISPATCH(result.ptr());
   ASSERT_EQ(S_OK, child_widget_sibling_dispatch.CopyTo(
-      child_widget_sibling_accessible.Receive()));
+                      child_widget_sibling_accessible.GetAddressOf()));
   ASSERT_EQ(child_view_accessible.Get(), child_widget_sibling_accessible.Get());
 
   ScopedComPtr<IDispatch> child_widget_parent_dispatch;
   ScopedComPtr<IAccessible> child_widget_parent_accessible;
   ASSERT_EQ(S_OK, child_widget_accessible->get_accParent(
-      child_widget_parent_dispatch.Receive()));
+                      child_widget_parent_dispatch.GetAddressOf()));
   ASSERT_EQ(S_OK, child_widget_parent_dispatch.CopyTo(
-      child_widget_parent_accessible.Receive()));
+                      child_widget_parent_accessible.GetAddressOf()));
   ASSERT_EQ(root_view_accessible.Get(), child_widget_parent_accessible.Get());
 }
 
@@ -186,13 +186,14 @@
   ASSERT_EQ(NULL, root_view->parent());
 
   ScopedComPtr<IAccessible2_2> root_view_accessible;
-  GetIAccessible2InterfaceForView(root_view, root_view_accessible.Receive());
+  GetIAccessible2InterfaceForView(root_view,
+                                  root_view_accessible.GetAddressOf());
 
   ScopedComPtr<IAccessible2_2> infobar_accessible;
-  GetIAccessible2InterfaceForView(infobar, infobar_accessible.Receive());
+  GetIAccessible2InterfaceForView(infobar, infobar_accessible.GetAddressOf());
 
   ScopedComPtr<IAccessible2_2> infobar2_accessible;
-  GetIAccessible2InterfaceForView(infobar2, infobar2_accessible.Receive());
+  GetIAccessible2InterfaceForView(infobar2, infobar2_accessible.GetAddressOf());
 
   // Initially, there are no alerts
   ScopedBstr alerts_bstr(L"alerts");
diff --git a/ui/webui/resources/js/cr/ui/compiled_resources2.gyp b/ui/webui/resources/js/cr/ui/compiled_resources2.gyp
index 2151fa7..d6d5a601 100644
--- a/ui/webui/resources/js/cr/ui/compiled_resources2.gyp
+++ b/ui/webui/resources/js/cr/ui/compiled_resources2.gyp
@@ -190,6 +190,13 @@
       'includes': ['../../../../../../third_party/closure_compiler/compile_js2.gypi'],
     },
     {
+      'target_name': 'node_utils',
+      'dependencies': [
+        '../../compiled_resources2.gyp:cr',
+      ],
+      'includes': ['../../../../../../third_party/closure_compiler/compile_js2.gypi'],
+    },
+    {
       'target_name': 'overlay',
       'dependencies': [
         '../../compiled_resources2.gyp:cr',