diff --git a/.gn b/.gn
index a049dfd3..cd5bff31 100644
--- a/.gn
+++ b/.gn
@@ -68,10 +68,7 @@
   "//chrome/browser/safe_browsing/android:*",  # 3 errors
   "//chrome/browser/safe_browsing:*",  # 85 errors
   "//chrome/browser/safety_check/android:*",  # 3 errors
-  "//chrome/browser/share:*",  # 7 errors
   "//chrome/browser/storage_access_api:*",  # 2 errors
-  "//chrome/browser/thumbnail/cc:*",  # 4 errors
-  "//chrome/browser/thumbnail/generator:*",  # 2 errors
   "//chrome/browser/touch_to_fill/android:*",  # 8 errors
   "//chrome/browser/touch_to_fill:*",  # 5 errors
   "//chrome/browser/updates/announcement_notification:*",  # 15 errors
@@ -122,7 +119,8 @@
   "//extensions/browser/api/crash_report_private:*",  # 1 error
   "//extensions/browser/api/declarative:*",  # 20 errors
   "//extensions/browser/api/declarative_content:*",  # 2 errors
-  "//extensions/browser/api/declarative_net_request/filter_list_converter:*",  # 1 error
+  "//extensions/browser/api/declarative_net_request/filter_list_converter:*",  # 1
+                                                                               # error
   "//extensions/browser/api/declarative_net_request:*",  # 18 errors
   "//extensions/browser/api/declarative_webrequest:*",  # 29 errors
   "//extensions/browser/api/diagnostics:*",  # 2 errors
diff --git a/DEPS b/DEPS
index 137a711f..5ec4c14b 100644
--- a/DEPS
+++ b/DEPS
@@ -43,6 +43,8 @@
   'checkout_nacl',
   'checkout_oculus_sdk',
   'checkout_openxr',
+  'cros_boards',
+  'cros_boards_with_qemu_images',
   'mac_xcode_version',
 ]
 
@@ -154,11 +156,14 @@
 
   # Default to the empty board. Desktop Chrome OS builds don't need cros SDK
   # dependencies. Other Chrome OS builds should always define this explicitly.
-  'cros_boards': '',
+  'cros_boards': Str(''),
+  'cros_boards_with_qemu_images': Str(''),
   # Building for CrOS is only supported on linux currently.
   'checkout_simplechrome': '(checkout_chromeos and host_os == "linux") and ("{cros_boards}" != "")',
   # Surround the board var in quotes so gclient doesn't try parsing the string
   # as an expression.
+  # TODO(crbug.com/937821): Replace uses of this var with
+  # 'cros_boards_with_qemu_images' above.
   'cros_download_vm': '(("{cros_boards}" == "amd64-generic") or ("{cros_boards}" == "betty")) or ("{cros_boards}" == "betty-pi-arc")',
   # Should we build and test for public (ie: full) CrOS images, or private
   # (ie: release) images.
@@ -194,11 +199,11 @@
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling Skia
   # and whatever else without interference from each other.
-  'skia_revision': '14fdcdc891cc2f2f795354890b09ac528f3387c9',
+  'skia_revision': '06980dba90a4354e9d3063668a61b2eceb5dd7de',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling V8
   # and whatever else without interference from each other.
-  'v8_revision': 'b0b637030dd5b92b5ef11dad6d0d2f1e7904187e',
+  'v8_revision': 'e7945d6e6530f99c0f55a446039e310905426b8b',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling swarming_client
   # and whatever else without interference from each other.
@@ -206,11 +211,11 @@
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling ANGLE
   # and whatever else without interference from each other.
-  'angle_revision': 'c44b2b2567aeb73cca60343fcdb13a9db0f3e598',
+  'angle_revision': '9277ee741395bb20b8f23791387ed98a4efa5982',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling SwiftShader
   # and whatever else without interference from each other.
-  'swiftshader_revision': '1de497cc50ab0199e47d5ba8371654c0f6fde85a',
+  'swiftshader_revision': '0a8f44c514ce034e0f13e966081176118d5f8bbf',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling PDFium
   # and whatever else without interference from each other.
@@ -265,7 +270,7 @@
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling devtools-frontend
   # and whatever else without interference from each other.
-  'devtools_frontend_revision': '2a41471831919582f75a836c80716ebecc6f2acf',
+  'devtools_frontend_revision': 'd8d96d5f0af2533c602afe1da141442f04cf4096',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling libprotobuf-mutator
   # and whatever else without interference from each other.
@@ -354,6 +359,9 @@
   # the commit queue can handle CLs rolling ukey2
   # and whatever else without interference from each other.
   'ukey2_revision': '0275885d8e6038c39b8a8ca55e75d1d4d1727f47',
+  # the commit queue can handle CLs rolling feed
+  # and whatever else without interference from each other.
+  'tint_revision': '919011af0a2ae1b663aae0aaa4083a3f9f13e66d',
 
   # TODO(crbug.com/941824): The values below need to be kept in sync
   # between //DEPS and //buildtools/DEPS, so if you're updating one,
@@ -785,6 +793,9 @@
   'src/third_party/dawn':
     Var('dawn_git') + '/dawn.git' + '@' +  Var('dawn_revision'),
 
+  'src/third_party/tint/src':
+    Var('dawn_git') + '/tint.git' + '@' +  Var('tint_revision'),
+
   'src/third_party/glfw/src':
     Var('chromium_git') + '/external/github.com/glfw/glfw.git@' +  '2de2589f910b1a85905f425be4d32f33cec092df',
 
@@ -1241,7 +1252,7 @@
   },
 
   'src/third_party/perfetto':
-    Var('android_git') + '/platform/external/perfetto.git' + '@' + '73b607f9e3b436b7fc32f45263375b3de5a62dba',
+    Var('android_git') + '/platform/external/perfetto.git' + '@' + '1a82e68482aacc6cdeeeab15c4d95185b49a05ac',
 
   'src/third_party/perl': {
       'url': Var('chromium_git') + '/chromium/deps/perl.git' + '@' + '6f3e5028eb65d0b4c5fdd792106ac4c84eee1eb3',
@@ -1541,7 +1552,7 @@
     Var('chromium_git') + '/v8/v8.git' + '@' +  Var('v8_revision'),
 
   'src-internal': {
-    'url': 'https://chrome-internal.googlesource.com/chrome/src-internal.git@25a5e06a7d176721b02336031e210183d2d4808e',
+    'url': 'https://chrome-internal.googlesource.com/chrome/src-internal.git@ed9549e829b50f49a5112a16b257406174110d2c',
     'condition': 'checkout_src_internal',
   },
 
diff --git a/android_webview/browser/gfx/surfaces_instance.cc b/android_webview/browser/gfx/surfaces_instance.cc
index 0fba153..67c6820 100644
--- a/android_webview/browser/gfx/surfaces_instance.cc
+++ b/android_webview/browser/gfx/surfaces_instance.cc
@@ -290,6 +290,10 @@
   //  in the cases listed above. crbug.com/996434
   const viz::Surface* surface =
       frame_sink_manager_->surface_manager()->GetSurfaceForId(surface_id);
+
+  if (!surface || !surface->HasActiveFrame())
+    return false;
+
   const auto& frame = surface->GetActiveFrame();
   base::flat_set<viz::RenderPassId> backdrop_filter_passes;
   for (const auto& render_pass : frame.render_pass_list) {
diff --git a/ash/wallpaper/wallpaper_controller_impl.cc b/ash/wallpaper/wallpaper_controller_impl.cc
index 3efcae3..d3b19a2 100644
--- a/ash/wallpaper/wallpaper_controller_impl.cc
+++ b/ash/wallpaper/wallpaper_controller_impl.cc
@@ -765,8 +765,7 @@
     // Remove the color cache of the previous wallpaper if it exists.
     DictionaryPrefUpdate wallpaper_colors_update(local_state_,
                                                  prefs::kWallpaperColors);
-    wallpaper_colors_update->RemoveWithoutPathExpansion(old_info.location,
-                                                        nullptr);
+    wallpaper_colors_update->RemoveKey(old_info.location);
   }
 
   DictionaryPrefUpdate wallpaper_update(local_state_,
@@ -1521,12 +1520,11 @@
   GetUserWallpaperInfo(account_id, &info);
   DictionaryPrefUpdate prefs_wallpapers_info_update(local_state_,
                                                     prefs::kUserWallpaperInfo);
-  prefs_wallpapers_info_update->RemoveWithoutPathExpansion(
-      account_id.GetUserEmail(), nullptr);
+  prefs_wallpapers_info_update->RemoveKey(account_id.GetUserEmail());
   // Remove the color cache of the previous wallpaper if it exists.
   DictionaryPrefUpdate wallpaper_colors_update(local_state_,
                                                prefs::kWallpaperColors);
-  wallpaper_colors_update->RemoveWithoutPathExpansion(info.location, nullptr);
+  wallpaper_colors_update->RemoveKey(info.location);
 }
 
 void WallpaperControllerImpl::RemoveUserWallpaperImpl(
diff --git a/base/debug/elf_reader_unittest.cc b/base/debug/elf_reader_unittest.cc
index 7b6e288..80f792d 100644
--- a/base/debug/elf_reader_unittest.cc
+++ b/base/debug/elf_reader_unittest.cc
@@ -19,10 +19,6 @@
 namespace base {
 namespace debug {
 
-// The linker flag --build-id is passed only on official builds and Fuchsia
-// builds.
-#if defined(OFFICIAL_BUILD) || defined(OS_FUCHSIA)
-
 #if defined(OFFICIAL_BUILD)
 constexpr size_t kExpectedBuildIdStringLength = 40;  // SHA1 hash in hex.
 #else
@@ -54,7 +50,6 @@
     EXPECT_TRUE(!IsAsciiAlpha(c) || IsAsciiLower(c));
   }
 }
-#endif  // defined(OFFICIAL_BUILD) || defined(OS_FUCHSIA)
 
 TEST(ElfReaderTest, ReadElfLibraryName) {
 #if defined(OS_ANDROID)
diff --git a/base/task/sequence_manager/sequence_manager_impl_unittest.cc b/base/task/sequence_manager/sequence_manager_impl_unittest.cc
index baf3d6fb..f05a470 100644
--- a/base/task/sequence_manager/sequence_manager_impl_unittest.cc
+++ b/base/task/sequence_manager/sequence_manager_impl_unittest.cc
@@ -4761,181 +4761,6 @@
 
 namespace {
 
-EnqueueOrder RunTaskAndCaptureEnqueueOrder(scoped_refptr<TestTaskQueue> queue) {
-  EnqueueOrder enqueue_order;
-  base::RunLoop run_loop;
-  queue->GetTaskQueueImpl()->SetOnTaskStartedHandler(base::BindLambdaForTesting(
-      [&](const Task& task, const TaskQueue::TaskTiming&) {
-        EXPECT_FALSE(enqueue_order);
-        enqueue_order = task.enqueue_order();
-        run_loop.Quit();
-      }));
-  run_loop.Run();
-  queue->GetTaskQueueImpl()->SetOnTaskStartedHandler({});
-  EXPECT_TRUE(enqueue_order);
-  return enqueue_order;
-}
-
-}  // namespace
-
-// Post a task. Install a fence at the beginning of time and remove it. The
-// task's EnqueueOrder should be less than
-// GetEnqueueOrderAtWhichWeBecameUnblocked().
-TEST_P(SequenceManagerTest,
-       GetEnqueueOrderAtWhichWeBecameUnblocked_PostInsertFenceBeginningOfTime) {
-  auto queue = CreateTaskQueue();
-  queue->task_runner()->PostTask(FROM_HERE, DoNothing());
-  queue->InsertFence(TaskQueue::InsertFencePosition::kBeginningOfTime);
-  queue->RemoveFence();
-  auto enqueue_order = RunTaskAndCaptureEnqueueOrder(queue);
-  EXPECT_LT(enqueue_order, queue->GetEnqueueOrderAtWhichWeBecameUnblocked());
-}
-
-// Post a 1st task. Install a now fence. Post a 2nd task. Run the first task.
-// Remove the fence. The 2nd task's EnqueueOrder should be less than
-// GetEnqueueOrderAtWhichWeBecameUnblocked().
-TEST_P(SequenceManagerTest,
-       GetEnqueueOrderAtWhichWeBecameUnblocked_PostInsertNowFencePost) {
-  auto queue = CreateTaskQueue();
-  queue->task_runner()->PostTask(FROM_HERE, DoNothing());
-  queue->InsertFence(TaskQueue::InsertFencePosition::kNow);
-  queue->task_runner()->PostTask(FROM_HERE, DoNothing());
-  RunTaskAndCaptureEnqueueOrder(queue);
-  EXPECT_FALSE(queue->GetEnqueueOrderAtWhichWeBecameUnblocked());
-  queue->RemoveFence();
-  auto enqueue_order = RunTaskAndCaptureEnqueueOrder(queue);
-  EXPECT_LT(enqueue_order, queue->GetEnqueueOrderAtWhichWeBecameUnblocked());
-}
-
-// Post a 1st task. Install a now fence. Post a 2nd task. Remove the fence.
-// GetEnqueueOrderAtWhichWeBecameUnblocked() should indicate that the queue was
-// never blocked (front task could always run).
-TEST_P(SequenceManagerTest,
-       GetEnqueueOrderAtWhichWeBecameUnblocked_PostInsertNowFencePost2) {
-  auto queue = CreateTaskQueue();
-  queue->task_runner()->PostTask(FROM_HERE, DoNothing());
-  queue->InsertFence(TaskQueue::InsertFencePosition::kNow);
-  queue->task_runner()->PostTask(FROM_HERE, DoNothing());
-  queue->RemoveFence();
-  RunTaskAndCaptureEnqueueOrder(queue);
-  EXPECT_FALSE(queue->GetEnqueueOrderAtWhichWeBecameUnblocked());
-  RunTaskAndCaptureEnqueueOrder(queue);
-  EXPECT_FALSE(queue->GetEnqueueOrderAtWhichWeBecameUnblocked());
-}
-
-// Post a 1st task. Install a now fence. Post a 2nd task. Install a now fence
-// (moves the previous fence). GetEnqueueOrderAtWhichWeBecameUnblocked() should
-// indicate that the queue was never blocked (front task could always run).
-TEST_P(
-    SequenceManagerTest,
-    GetEnqueueOrderAtWhichWeBecameUnblocked_PostInsertNowFencePostInsertNowFence) {
-  auto queue = CreateTaskQueue();
-  queue->task_runner()->PostTask(FROM_HERE, DoNothing());
-  queue->InsertFence(TaskQueue::InsertFencePosition::kNow);
-  queue->task_runner()->PostTask(FROM_HERE, DoNothing());
-  queue->InsertFence(TaskQueue::InsertFencePosition::kNow);
-  RunTaskAndCaptureEnqueueOrder(queue);
-  EXPECT_FALSE(queue->GetEnqueueOrderAtWhichWeBecameUnblocked());
-  RunTaskAndCaptureEnqueueOrder(queue);
-  EXPECT_FALSE(queue->GetEnqueueOrderAtWhichWeBecameUnblocked());
-}
-
-// Post a 1st task. Install a delayed fence. Post a 2nd task that will run
-// after the fence. Run the first task. Remove the fence. The 2nd task's
-// EnqueueOrder should be less than GetEnqueueOrderAtWhichWeBecameUnblocked().
-TEST_P(
-    SequenceManagerTest,
-    GetEnqueueOrderAtWhichWeBecameUnblocked_PostInsertDelayedFencePostAfterFence) {
-  constexpr TimeDelta kDelay = TimeDelta::FromSeconds(42);
-  const TimeTicks start_time = mock_tick_clock()->NowTicks();
-  auto queue =
-      CreateTaskQueue(TaskQueue::Spec("test").SetDelayedFencesAllowed(true));
-  queue->task_runner()->PostTask(FROM_HERE, DoNothing());
-  queue->InsertFenceAt(start_time + kDelay);
-  queue->task_runner()->PostDelayedTask(FROM_HERE, DoNothing(), 2 * kDelay);
-  RunTaskAndCaptureEnqueueOrder(queue);
-  EXPECT_FALSE(queue->GetEnqueueOrderAtWhichWeBecameUnblocked());
-  FastForwardBy(2 * kDelay);
-  queue->RemoveFence();
-  auto enqueue_order = RunTaskAndCaptureEnqueueOrder(queue);
-  EXPECT_LT(enqueue_order, queue->GetEnqueueOrderAtWhichWeBecameUnblocked());
-}
-
-// Post a 1st task. Install a delayed fence. Post a 2nd task that will run
-// before the fence. GetEnqueueOrderAtWhichWeBecameUnblocked() should indicate
-// that the queue was never blocked (front task could always run).
-TEST_P(
-    SequenceManagerTest,
-    GetEnqueueOrderAtWhichWeBecameUnblocked_PostInsertDelayedFencePostBeforeFence) {
-  constexpr TimeDelta kDelay = TimeDelta::FromSeconds(42);
-  const TimeTicks start_time = mock_tick_clock()->NowTicks();
-  auto queue =
-      CreateTaskQueue(TaskQueue::Spec("test").SetDelayedFencesAllowed(true));
-  queue->task_runner()->PostTask(FROM_HERE, DoNothing());
-  queue->InsertFenceAt(start_time + 2 * kDelay);
-  queue->task_runner()->PostDelayedTask(FROM_HERE, DoNothing(), kDelay);
-  RunTaskAndCaptureEnqueueOrder(queue);
-  EXPECT_FALSE(queue->GetEnqueueOrderAtWhichWeBecameUnblocked());
-  FastForwardBy(3 * kDelay);
-  EXPECT_FALSE(queue->GetEnqueueOrderAtWhichWeBecameUnblocked());
-  queue->RemoveFence();
-}
-
-// Post a 1st task. Disable the queue and re-enable it. Post a 2nd task. The 1st
-// task's EnqueueOrder should be less than
-// GetEnqueueOrderAtWhichWeBecameUnblocked().
-TEST_P(SequenceManagerTest,
-       GetEnqueueOrderAtWhichWeBecameUnblocked_PostDisablePostEnable) {
-  auto queue = CreateTaskQueue();
-  queue->task_runner()->PostTask(FROM_HERE, DoNothing());
-  queue->GetTaskQueueImpl()->SetQueueEnabled(false);
-  queue->GetTaskQueueImpl()->SetQueueEnabled(true);
-  queue->task_runner()->PostTask(FROM_HERE, DoNothing());
-  auto first_enqueue_order = RunTaskAndCaptureEnqueueOrder(queue);
-  EXPECT_LT(first_enqueue_order,
-            queue->GetEnqueueOrderAtWhichWeBecameUnblocked());
-  auto second_enqueue_order = RunTaskAndCaptureEnqueueOrder(queue);
-  EXPECT_GT(second_enqueue_order,
-            queue->GetEnqueueOrderAtWhichWeBecameUnblocked());
-}
-
-// Disable the queue. Post a 1st task. Re-enable the queue. Post a 2nd task.
-// The 1st task's EnqueueOrder should be less than
-// GetEnqueueOrderAtWhichWeBecameUnblocked().
-TEST_P(SequenceManagerTest,
-       GetEnqueueOrderAtWhichWeBecameUnblocked_DisablePostEnablePost) {
-  auto queue = CreateTaskQueue();
-  queue->GetTaskQueueImpl()->SetQueueEnabled(false);
-  queue->task_runner()->PostTask(FROM_HERE, DoNothing());
-  queue->GetTaskQueueImpl()->SetQueueEnabled(true);
-  queue->task_runner()->PostTask(FROM_HERE, DoNothing());
-  auto first_enqueue_order = RunTaskAndCaptureEnqueueOrder(queue);
-  EXPECT_LT(first_enqueue_order,
-            queue->GetEnqueueOrderAtWhichWeBecameUnblocked());
-  auto second_enqueue_order = RunTaskAndCaptureEnqueueOrder(queue);
-  EXPECT_GT(second_enqueue_order,
-            queue->GetEnqueueOrderAtWhichWeBecameUnblocked());
-}
-
-TEST_P(SequenceManagerTest, OnTaskReady) {
-  auto queue = CreateTaskQueue();
-  int task_ready_count = 0;
-
-  queue->GetTaskQueueImpl()->SetOnTaskReadyHandler(
-      BindLambdaForTesting([&](const Task&, LazyNow*) { ++task_ready_count; }));
-
-  EXPECT_EQ(0, task_ready_count);
-  queue->task_runner()->PostTask(FROM_HERE, DoNothing());
-  EXPECT_EQ(1, task_ready_count);
-  queue->task_runner()->PostDelayedTask(FROM_HERE, DoNothing(),
-                                        base::TimeDelta::FromHours(1));
-  EXPECT_EQ(1, task_ready_count);
-  FastForwardBy(base::TimeDelta::FromHours(1));
-  EXPECT_EQ(2, task_ready_count);
-}
-
-namespace {
-
 class TaskObserverExpectingNoDelayedRunTime : public TaskObserver {
  public:
   TaskObserverExpectingNoDelayedRunTime() = default;
diff --git a/base/task/sequence_manager/task_queue.cc b/base/task/sequence_manager/task_queue.cc
index c73e107..c71226c 100644
--- a/base/task/sequence_manager/task_queue.cc
+++ b/base/task/sequence_manager/task_queue.cc
@@ -320,13 +320,6 @@
   return impl_->BlockedByFence();
 }
 
-EnqueueOrder TaskQueue::GetEnqueueOrderAtWhichWeBecameUnblocked() const {
-  DCHECK_CALLED_ON_VALID_THREAD(associated_thread_->thread_checker);
-  if (!impl_)
-    return EnqueueOrder();
-  return impl_->GetEnqueueOrderAtWhichWeBecameUnblocked();
-}
-
 const char* TaskQueue::GetName() const {
   return name_;
 }
diff --git a/base/task/sequence_manager/task_queue.h b/base/task/sequence_manager/task_queue.h
index 9195e37..1c1d977 100644
--- a/base/task/sequence_manager/task_queue.h
+++ b/base/task/sequence_manager/task_queue.h
@@ -320,12 +320,6 @@
   // Returns true if the queue has a fence which is blocking execution of tasks.
   bool BlockedByFence() const;
 
-  // Returns an EnqueueOrder generated at the last transition to unblocked. A
-  // queue is unblocked when it is enabled and no fence prevents the front task
-  // from running. If the EnqueueOrder of a task is greater than this when it
-  // starts running, it means that is was never blocked.
-  EnqueueOrder GetEnqueueOrderAtWhichWeBecameUnblocked() const;
-
   void SetObserver(Observer* observer);
 
   // Controls whether or not the queue will emit traces events when tasks are
diff --git a/base/task/sequence_manager/task_queue_impl.cc b/base/task/sequence_manager/task_queue_impl.cc
index 2a71aab..aedebe3f9 100644
--- a/base/task/sequence_manager/task_queue_impl.cc
+++ b/base/task/sequence_manager/task_queue_impl.cc
@@ -297,11 +297,6 @@
     any_thread_.immediate_incoming_queue.push_back(Task(
         std::move(task), delayed_run_time, sequence_number, sequence_number));
 
-    if (any_thread_.on_task_ready_handler) {
-      any_thread_.on_task_ready_handler.Run(
-          any_thread_.immediate_incoming_queue.back(), &lazy_now);
-    }
-
 #if DCHECK_IS_ON()
     any_thread_.immediate_incoming_queue.back().cross_thread_ =
         (current_thread == TaskQueueImpl::CurrentThread::kNotMainThread);
@@ -584,9 +579,6 @@
     DCHECK(!task->enqueue_order_set());
     task->set_enqueue_order(sequence_manager_->GetNextSequenceNumber());
 
-    if (main_thread_only().on_task_ready_handler)
-      main_thread_only().on_task_ready_handler.Run(*task, lazy_now);
-
     delayed_work_queue_task_pusher.Push(task);
     main_thread_only().delayed_incoming_queue.pop();
   }
@@ -888,10 +880,6 @@
   return !!main_thread_only().current_fence;
 }
 
-EnqueueOrder TaskQueueImpl::GetEnqueueOrderAtWhichWeBecameUnblocked() const {
-  return main_thread_only().enqueue_order_at_which_we_became_unblocked;
-}
-
 bool TaskQueueImpl::CouldTaskRun(EnqueueOrder enqueue_order) const {
   if (!IsQueueEnabled())
     return false;
@@ -1157,16 +1145,6 @@
          !any_thread_.immediate_incoming_queue.empty();
 }
 
-void TaskQueueImpl::SetOnTaskReadyHandler(
-    TaskQueueImpl::OnTaskReadyHandler handler) {
-  DCHECK(should_notify_observers_ || handler.is_null());
-  main_thread_only().on_task_ready_handler = handler;
-
-  base::internal::CheckedAutoLock lock(any_thread_lock_);
-  DCHECK_NE(!!any_thread_.on_task_ready_handler, !!handler);
-  any_thread_.on_task_ready_handler = std::move(handler);
-}
-
 void TaskQueueImpl::SetOnTaskStartedHandler(
     TaskQueueImpl::OnTaskStartedHandler handler) {
   DCHECK(should_notify_observers_ || handler.is_null());
diff --git a/base/task/sequence_manager/task_queue_impl.h b/base/task/sequence_manager/task_queue_impl.h
index b781bdb..538dc0c22 100644
--- a/base/task/sequence_manager/task_queue_impl.h
+++ b/base/task/sequence_manager/task_queue_impl.h
@@ -91,7 +91,6 @@
   };
 
   using OnNextWakeUpChangedCallback = RepeatingCallback<void(TimeTicks)>;
-  using OnTaskReadyHandler = RepeatingCallback<void(const Task&, LazyNow*)>;
   using OnTaskStartedHandler =
       RepeatingCallback<void(const Task&, const TaskQueue::TaskTiming&)>;
   using OnTaskCompletedHandler =
@@ -123,7 +122,6 @@
   void RemoveFence();
   bool HasActiveFence();
   bool BlockedByFence() const;
-  EnqueueOrder GetEnqueueOrderAtWhichWeBecameUnblocked() const;
 
   // Implementation of TaskQueue::SetObserver.
   void SetObserver(TaskQueue::Observer* observer);
@@ -202,11 +200,6 @@
   // addition MaybeShrinkQueue is called on all internal queues.
   void ReclaimMemory(TimeTicks now);
 
-  // Registers a handler to invoke when a task posted to this TaskQueueImpl is
-  // ready. For a non-delayed task, this is when the task is posted. For a
-  // delayed task, this is when the delay expires.
-  void SetOnTaskReadyHandler(OnTaskReadyHandler handler);
-
   // Allows wrapping TaskQueue to set a handler to subscribe for notifications
   // about started and completed tasks.
   void SetOnTaskStartedHandler(OnTaskStartedHandler handler);
@@ -381,7 +374,6 @@
     //    EnqueueOrder of any already queued task will compare less than this.
     EnqueueOrder
         enqueue_order_at_which_we_became_unblocked_with_normal_priority;
-    OnTaskReadyHandler on_task_ready_handler;
     OnTaskStartedHandler on_task_started_handler;
     OnTaskCompletedHandler on_task_completed_handler;
     // Last reported wake up, used only in UpdateWakeUp to avoid
@@ -505,8 +497,6 @@
 
     bool unregistered = false;
 
-    OnTaskReadyHandler on_task_ready_handler;
-
 #if DCHECK_IS_ON()
     // A cache of |immediate_work_queue->work_queue_set_index()| which is used
     // to index into
diff --git a/base/threading/scoped_blocking_call_unittest.cc b/base/threading/scoped_blocking_call_unittest.cc
index 9160a8c3..847eec5 100644
--- a/base/threading/scoped_blocking_call_unittest.cc
+++ b/base/threading/scoped_blocking_call_unittest.cc
@@ -310,8 +310,8 @@
               ElementsAre(std::make_pair(0, 0), std::make_pair(0, 0)));
 }
 
-// Start the jank mid-interval; that interval shouldn't be counted but the last
-// incomplete interval will count.
+// Start the jank mid-interval; that interval should be counted but the last
+// incomplete interval won't count.
 TEST_F(ScopedBlockingCallIOJankMonitoringTest, Jank7sMidInterval) {
   task_environment_.FastForwardBy(
       internal::IOJankMonitoringWindow::kIOJankInterval / 3);
@@ -332,8 +332,8 @@
   EXPECT_THAT(reports_, ElementsAre(std::make_pair(7, 7)));
 }
 
-// Start the jank mid-interval; that interval shouldn't be counted but the
-// second one should be despite being incomplete.
+// Start the jank mid-interval; that interval should be counted but the second
+// one won't count.
 TEST_F(ScopedBlockingCallIOJankMonitoringTest, Jank1sMidInterval) {
   task_environment_.FastForwardBy(
       internal::IOJankMonitoringWindow::kIOJankInterval / 3);
@@ -497,7 +497,7 @@
 #endif
 TEST_F(ScopedBlockingCallIOJankMonitoringTest,
        MAYBE_MultiThreadedOverlappedWindows) {
-  static const int kNumJankyTasks = 3;
+  constexpr int kNumJankyTasks = 3;
   static_assert(
       kNumJankyTasks <= test::TaskEnvironment::kNumForegroundThreadPoolThreads,
       "");
diff --git a/base/time/time_unittest.cc b/base/time/time_unittest.cc
index 9c0000a..a558b82 100644
--- a/base/time/time_unittest.cc
+++ b/base/time/time_unittest.cc
@@ -6,6 +6,7 @@
 
 #include <stdint.h>
 #include <time.h>
+
 #include <limits>
 #include <string>
 
@@ -1768,10 +1769,14 @@
   constexpr TimeDelta kElevenSeconds = TimeDelta::FromSeconds(11);
   constexpr TimeDelta kThreeSeconds = TimeDelta::FromSeconds(3);
 
-  EXPECT_EQ(TimeDelta::FromSeconds(14), kElevenSeconds + kThreeSeconds);
-  EXPECT_EQ(TimeDelta::FromSeconds(14), kThreeSeconds + kElevenSeconds);
-  EXPECT_EQ(TimeDelta::FromSeconds(8), kElevenSeconds - kThreeSeconds);
-  EXPECT_EQ(TimeDelta::FromSeconds(-8), kThreeSeconds - kElevenSeconds);
+  static_assert(TimeDelta::FromSeconds(14) == kElevenSeconds + kThreeSeconds,
+                "");
+  static_assert(TimeDelta::FromSeconds(14) == kThreeSeconds + kElevenSeconds,
+                "");
+  static_assert(TimeDelta::FromSeconds(8) == kElevenSeconds - kThreeSeconds,
+                "");
+  static_assert(TimeDelta::FromSeconds(-8) == kThreeSeconds - kElevenSeconds,
+                "");
   static_assert(3 == kElevenSeconds / kThreeSeconds, "");
   static_assert(0 == kThreeSeconds / kElevenSeconds, "");
   static_assert(TimeDelta::FromSeconds(2) == kElevenSeconds % kThreeSeconds,
@@ -1791,22 +1796,23 @@
   static_assert(-TimeDelta::Min() == TimeDelta::Max(), "");
   static_assert(TimeDelta() < -TimeDelta::Min(), "");
 
-  TimeDelta large_delta = TimeDelta::Max() - TimeDelta::FromMilliseconds(1);
-  TimeDelta large_negative = -large_delta;
-  EXPECT_GT(TimeDelta(), large_negative);
-  EXPECT_FALSE(large_delta.is_max());
-  EXPECT_FALSE((-large_negative).is_min());
-  constexpr TimeDelta kOneSecond = TimeDelta::FromSeconds(1);
+  constexpr TimeDelta kLargeDelta =
+      TimeDelta::Max() - TimeDelta::FromMilliseconds(1);
+  constexpr TimeDelta kLargeNegative = -kLargeDelta;
+  static_assert(TimeDelta() > kLargeNegative, "");
+  static_assert(!kLargeDelta.is_max(), "");
+  static_assert(!(-kLargeNegative).is_min(), "");
 
   // Test +, -, * and / operators.
-  EXPECT_TRUE((large_delta + kOneSecond).is_max());
-  EXPECT_TRUE((large_negative + (-kOneSecond)).is_min());
-  EXPECT_TRUE((large_negative - kOneSecond).is_min());
-  EXPECT_TRUE((large_delta - (-kOneSecond)).is_max());
-  EXPECT_TRUE((large_delta * 2).is_max());
-  EXPECT_TRUE((large_delta * -2).is_min());
-  EXPECT_TRUE((large_delta / 0.5).is_max());
-  EXPECT_TRUE((large_delta / -0.5).is_min());
+  constexpr TimeDelta kOneSecond = TimeDelta::FromSeconds(1);
+  static_assert((kLargeDelta + kOneSecond).is_max(), "");
+  static_assert((kLargeNegative + (-kOneSecond)).is_min(), "");
+  static_assert((kLargeNegative - kOneSecond).is_min(), "");
+  static_assert((kLargeDelta - (-kOneSecond)).is_max(), "");
+  static_assert((kLargeDelta * 2).is_max(), "");
+  static_assert((kLargeDelta * -2).is_min(), "");
+  EXPECT_TRUE((kLargeDelta / 0.5).is_max());
+  EXPECT_TRUE((kLargeDelta / -0.5).is_min());
 
   EXPECT_EQ(TimeDelta::FromSeconds(1) / TimeDelta::FromSeconds(0),
             std::numeric_limits<int64_t>::max());
@@ -1829,47 +1835,47 @@
             TimeDelta::FromSeconds(10));
 
   // Test that double conversions overflow to infinity.
-  EXPECT_EQ((large_delta + kOneSecond).InSecondsF(),
+  EXPECT_EQ((kLargeDelta + kOneSecond).InSecondsF(),
             std::numeric_limits<double>::infinity());
-  EXPECT_EQ((large_delta + kOneSecond).InMillisecondsF(),
+  EXPECT_EQ((kLargeDelta + kOneSecond).InMillisecondsF(),
             std::numeric_limits<double>::infinity());
-  EXPECT_EQ((large_delta + kOneSecond).InMicrosecondsF(),
+  EXPECT_EQ((kLargeDelta + kOneSecond).InMicrosecondsF(),
             std::numeric_limits<double>::infinity());
 
   // Test +=, -=, *= and /= operators.
-  TimeDelta delta = large_delta;
+  TimeDelta delta = kLargeDelta;
   delta += kOneSecond;
   EXPECT_TRUE(delta.is_max());
-  delta = large_negative;
+  delta = kLargeNegative;
   delta += -kOneSecond;
-  EXPECT_TRUE((delta).is_min());
+  EXPECT_TRUE(delta.is_min());
 
-  delta = large_negative;
+  delta = kLargeNegative;
   delta -= kOneSecond;
-  EXPECT_TRUE((delta).is_min());
-  delta = large_delta;
+  EXPECT_TRUE(delta.is_min());
+  delta = kLargeDelta;
   delta -= -kOneSecond;
   EXPECT_TRUE(delta.is_max());
 
-  delta = large_delta;
+  delta = kLargeDelta;
   delta *= 2;
   EXPECT_TRUE(delta.is_max());
-  delta = large_negative;
+  delta = kLargeNegative;
   delta *= 1.5;
-  EXPECT_TRUE((delta).is_min());
+  EXPECT_TRUE(delta.is_min());
 
-  delta = large_delta;
+  delta = kLargeDelta;
   delta /= 0.5;
   EXPECT_TRUE(delta.is_max());
-  delta = large_negative;
+  delta = kLargeNegative;
   delta /= 0.5;
-  EXPECT_TRUE((delta).is_min());
+  EXPECT_TRUE(delta.is_min());
 
   // Test operations with Time and TimeTicks.
-  EXPECT_TRUE((large_delta + Time::Now()).is_max());
-  EXPECT_TRUE((large_delta + TimeTicks::Now()).is_max());
-  EXPECT_TRUE((Time::Now() + large_delta).is_max());
-  EXPECT_TRUE((TimeTicks::Now() + large_delta).is_max());
+  EXPECT_TRUE((kLargeDelta + Time::Now()).is_max());
+  EXPECT_TRUE((kLargeDelta + TimeTicks::Now()).is_max());
+  EXPECT_TRUE((Time::Now() + kLargeDelta).is_max());
+  EXPECT_TRUE((TimeTicks::Now() + kLargeDelta).is_max());
 
   Time time_now = Time::Now();
   EXPECT_EQ(kOneSecond, (time_now + kOneSecond) - time_now);
diff --git a/build/android/gyp/turbine.py b/build/android/gyp/turbine.py
index 534cd42..e88561f 100755
--- a/build/android/gyp/turbine.py
+++ b/build/android/gyp/turbine.py
@@ -2,7 +2,7 @@
 # Copyright 2020 The Chromium Authors. All rights reserved.
 # Use of this source code is governed by a BSD-style license that can be
 # found in the LICENSE file.
-"""Wraps bin/helper/turbine and expands @FileArgs."""
+"""Wraps the turbine jar and expands @FileArgs."""
 
 import argparse
 import logging
diff --git a/build/args/chromeos/README.md b/build/args/chromeos/README.md
index 941aab8..e02e185 100644
--- a/build/args/chromeos/README.md
+++ b/build/args/chromeos/README.md
@@ -3,9 +3,12 @@
 Files in this directory are populated by running `gclient sync` with specific
 arguments set in the .gclient file. Specifically:
 * The file must have a top-level variable set: `target_os = ["chromeos"]`
-* The `"custom_vars"` parameter of the chromium/src.git solution must include the
-  parameter: `"cros_boards": "{BOARD_NAMES}"` where `{BOARD_NAMES}` is a
+* The `"custom_vars"` parameter of the chromium/src.git solution must include
+  the parameter: `"cros_boards": "{BOARD_NAMES}"` where `{BOARD_NAMES}` is a
   colon-separated list of boards you'd like to checkout.
+* If you'd like to a checkout a QEMU-bootable image for a given board, include
+  it in the `cros_boards_with_qemu_images` var rather than the `cros_boards`
+  var.
 
 A typical .gclient file is a sibling of the src/ directory, and might look like
 this:
@@ -18,7 +21,10 @@
     "custom_deps": {},
     "custom_vars" : {
         "checkout_src_internal": True,
-        "cros_boards": "eve",
+        "cros_boards": "eve:kevin",
+        # If a QEMU-bootable image is desired for any board, move it from
+        # the previous var to the following:
+        "cros_boards_with_qemu_images": "amd64-generic",
     },
   },
 ]
diff --git a/build/util/version.gni b/build/util/version.gni
index 59ca68b..c425311 100644
--- a/build/util/version.gni
+++ b/build/util/version.gni
@@ -56,7 +56,7 @@
     target_cpu,
   ]
 
-  if (defined(public_android_sdk) && !public_android_sdk) {
+  if (defined(final_android_sdk) && !final_android_sdk) {
     _script_arguments += [ "--next" ]
   }
 }
diff --git a/build_overrides/dawn.gni b/build_overrides/dawn.gni
index 597200f..84bcfbd 100644
--- a/build_overrides/dawn.gni
+++ b/build_overrides/dawn.gni
@@ -11,5 +11,6 @@
 dawn_spirv_cross_dir = "//third_party/spirv-cross/spirv-cross"
 dawn_spirv_tools_dir = "//third_party/SPIRV-Tools/src"
 dawn_swiftshader_dir = "//third_party/swiftshader"
+dawn_tint_dir = "//third_party/tint/src"
 dawn_vulkan_validation_layers_dir =
     "//third_party/angle/third_party/vulkan-validation-layers/src"
diff --git a/build_overrides/tint.gni b/build_overrides/tint.gni
new file mode 100644
index 0000000..95bb287
--- /dev/null
+++ b/build_overrides/tint.gni
@@ -0,0 +1,13 @@
+# Copyright 2020 The Chromium Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+tint_root_dir = "//third_party/tint/src"
+tint_spirv_tools_dir = "//third_party/SPIRV-Tools/src"
+tint_googletest_dir = "//third_party/googletest/src"
+tint_spirv_headers_dir = "//third_party/spirv-headers/src"
+
+tint_build_spv_reader = true
+tint_build_spv_writer = true
+tint_build_wgsl_reader = true
+tint_build_wgsl_writer = true
diff --git a/chrome/android/chrome_test_java_sources.gni b/chrome/android/chrome_test_java_sources.gni
index c373db2b2..e00b852 100644
--- a/chrome/android/chrome_test_java_sources.gni
+++ b/chrome/android/chrome_test_java_sources.gni
@@ -79,6 +79,7 @@
   "javatests/src/org/chromium/chrome/browser/browserservices/TrustedWebActivityTestUtil.java",
   "javatests/src/org/chromium/chrome/browser/browserservices/digitalgoods/DigitalGoodsTest.java",
   "javatests/src/org/chromium/chrome/browser/browserservices/digitalgoods/FakeDigitalGoods.java",
+  "javatests/src/org/chromium/chrome/browser/browserservices/permissiondelegation/TrustedWebActivityLocationDelegationTest.java",
   "javatests/src/org/chromium/chrome/browser/browserservices/permissiondelegation/TrustedWebActivityPermissionsTest.java",
   "javatests/src/org/chromium/chrome/browser/browserservices/permissiondelegation/TrustedWebActivityPreferencesUiTest.java",
   "javatests/src/org/chromium/chrome/browser/browserservices/ui/controller/trustedwebactivity/TrustedWebActivityCurrentPageVerifierTest.java",
diff --git a/chrome/android/features/autofill_assistant/BUILD.gn b/chrome/android/features/autofill_assistant/BUILD.gn
index 643bcbd..d1bcfdad 100644
--- a/chrome/android/features/autofill_assistant/BUILD.gn
+++ b/chrome/android/features/autofill_assistant/BUILD.gn
@@ -316,16 +316,25 @@
     "java/res/drawable/autofill_assistant_rounded_corner_background.xml",
     "java/res/drawable/autofill_assistant_swipe_indicator.xml",
     "java/res/drawable/ic_add_outline_white_24dp.xml",
+    "java/res/drawable/ic_airline_seat_recline_normal_black_24dp.xml",
     "java/res/drawable/ic_autofill_assistant_add_circle_24dp.xml",
     "java/res/drawable/ic_autofill_assistant_default_progress_start_black_24dp.xml",
     "java/res/drawable/ic_check_circle_black_24dp.xml",
     "java/res/drawable/ic_clear_black_24dp.xml",
+    "java/res/drawable/ic_confirmation_number_black_24dp.xml",
+    "java/res/drawable/ic_directions_car_black_24dp.xml",
     "java/res/drawable/ic_done_black_24dp.xml",
+    "java/res/drawable/ic_fastfood_black_24dp.xml",
+    "java/res/drawable/ic_grocery_black_24dp.xml",
+    "java/res/drawable/ic_local_dining_black_24dp.xml",
     "java/res/drawable/ic_logo_assistant_24dp.xml",
     "java/res/drawable/ic_payment_black_24dp.xml",
     "java/res/drawable/ic_refresh_black_24dp.xml",
     "java/res/drawable/ic_remove_outline_white_24dp.xml",
+    "java/res/drawable/ic_settings_black_24dp.xml",
     "java/res/drawable/ic_shopping_basket_black_24dp.xml",
+    "java/res/drawable/ic_shopping_basket_black_24dp.xml",
+    "java/res/drawable/ic_vpn_key_black_24dp.xml",
     "java/res/layout/autofill_assistant_address_full.xml",
     "java/res/layout/autofill_assistant_address_summary.xml",
     "java/res/layout/autofill_assistant_bottom_sheet_content.xml",
diff --git a/chrome/android/features/autofill_assistant/java/res/drawable/ic_airline_seat_recline_normal_black_24dp.xml b/chrome/android/features/autofill_assistant/java/res/drawable/ic_airline_seat_recline_normal_black_24dp.xml
new file mode 100644
index 0000000..13269ce
--- /dev/null
+++ b/chrome/android/features/autofill_assistant/java/res/drawable/ic_airline_seat_recline_normal_black_24dp.xml
@@ -0,0 +1,22 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Copyright 2020 The Chromium Authors. All rights reserved.
+     Use of this source code is governed by a BSD-style license that can be
+     found in the LICENSE file. -->
+<vector
+    xmlns:android="http://schemas.android.com/apk/res/android"
+    xmlns:tools="http://schemas.android.com/tools"
+    android:width="24dp"
+    android:height="24dp"
+    android:viewportWidth="24"
+    android:viewportHeight="24"
+    tools:targetApi="21">
+    <path
+        android:fillColor="#000000"
+        android:pathData="M8 7H6v11c0 1.1.9 2 2 2h7v-2H8V7z"/>
+    <path
+        android:fillColor="#000000"
+        android:pathData="M16 14h-2V9.5C14 8.12 12.88 7 11.5 7S9 8.12 9 9.5V15c0 1.1.9 2 2 2h5v5h2v-6c0-1.1-.9-2-2-2z"/>
+    <path
+        android:fillColor="#000000"
+        android:pathData="M 11.5, 4 m -2, 0 a 2,2 0 1, 0 4,0 a 2,2 0 1,0 -4,0"/>
+</vector>
\ No newline at end of file
diff --git a/chrome/android/features/autofill_assistant/java/res/drawable/ic_confirmation_number_black_24dp.xml b/chrome/android/features/autofill_assistant/java/res/drawable/ic_confirmation_number_black_24dp.xml
new file mode 100644
index 0000000..5657cbe8
--- /dev/null
+++ b/chrome/android/features/autofill_assistant/java/res/drawable/ic_confirmation_number_black_24dp.xml
@@ -0,0 +1,16 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Copyright 2020 The Chromium Authors. All rights reserved.
+     Use of this source code is governed by a BSD-style license that can be
+     found in the LICENSE file. -->
+<vector
+    xmlns:android="http://schemas.android.com/apk/res/android"
+    xmlns:tools="http://schemas.android.com/tools"
+    android:width="24dp"
+    android:height="24dp"
+    android:viewportWidth="24"
+    android:viewportHeight="24"
+    tools:targetApi="21">
+    <path
+        android:fillColor="#000000"
+        android:pathData="M22 10V6c0-1.11-.9-2-2-2H4c-1.1 0-1.99.89-1.99 2v4c1.1 0 1.99.9 1.99 2s-.89 2-2 2v4c0 1.1.9 2 2 2h16c1.1 0 2-.9 2-2v-4c-1.1 0-2-.9-2-2s.9-2 2-2zm-2-1.46c-1.19.69-2 1.99-2 3.46s.81 2.77 2 3.46V18H4v-2.54c1.19-.69 2-1.99 2-3.46 0-1.48-.8-2.77-1.99-3.46L4 6h16v2.54zM13 17h-2v-2h2v2zm0-4h-2v-2h2v2zm0-4h-2V7h2v2z"/>
+</vector>
\ No newline at end of file
diff --git a/chrome/android/features/autofill_assistant/java/res/drawable/ic_directions_car_black_24dp.xml b/chrome/android/features/autofill_assistant/java/res/drawable/ic_directions_car_black_24dp.xml
new file mode 100644
index 0000000..dac1e5f
--- /dev/null
+++ b/chrome/android/features/autofill_assistant/java/res/drawable/ic_directions_car_black_24dp.xml
@@ -0,0 +1,22 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Copyright 2020 The Chromium Authors. All rights reserved.
+     Use of this source code is governed by a BSD-style license that can be
+     found in the LICENSE file. -->
+<vector
+    xmlns:android="http://schemas.android.com/apk/res/android"
+    xmlns:tools="http://schemas.android.com/tools"
+    android:width="24dp"
+    android:height="24dp"
+    android:viewportWidth="24"
+    android:viewportHeight="24"
+    tools:targetApi="21">
+    <path
+        android:fillColor="#000000"
+        android:pathData="M18.92 6.01C18.72 5.42 18.16 5 17.5 5h-11c-.66 0-1.21.42-1.42 1.01L3 12v8c0 .55.45 1 1 1h1c.55 0 1-.45 1-1v-1h12v1c0 .55.45 1 1 1h1c.55 0 1-.45 1-1v-8l-2.08-5.99zM6.85 7h10.29l1.08 3.11H5.77L6.85 7zM19 17H5v-5h14v5z"/>
+    <path
+        android:fillColor="#000000"
+        android:pathData="M 7.5, 14.5 m -1.5, 0 a 1.5,1.5 0 1,0 3,0 a 1.5,1.5 0 1,0 -3,0"/>
+    <path
+        android:fillColor="#000000"
+        android:pathData="M 16.5, 14.5 m -1.5, 0 a 1.5,1.5 0 1,0 3,0 a 1.5,1.5 0 1,0 -3,0"/>
+</vector>
\ No newline at end of file
diff --git a/chrome/android/features/autofill_assistant/java/res/drawable/ic_fastfood_black_24dp.xml b/chrome/android/features/autofill_assistant/java/res/drawable/ic_fastfood_black_24dp.xml
new file mode 100644
index 0000000..25cf90b
--- /dev/null
+++ b/chrome/android/features/autofill_assistant/java/res/drawable/ic_fastfood_black_24dp.xml
@@ -0,0 +1,16 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Copyright 2020 The Chromium Authors. All rights reserved.
+     Use of this source code is governed by a BSD-style license that can be
+     found in the LICENSE file. -->
+<vector
+    xmlns:android="http://schemas.android.com/apk/res/android"
+    xmlns:tools="http://schemas.android.com/tools"
+    android:width="24dp"
+    android:height="24dp"
+    android:viewportWidth="24"
+    android:viewportHeight="24"
+    tools:targetApi="21">
+    <path
+        android:fillColor="#000000"
+        android:pathData="M1 21.98c0 .56.45 1.01 1.01 1.01H15c.56 0 1.01-.45 1.01-1.01V21H1v.98zM8.5 8.99C4.75 8.99 1 11 1 15h15c0-4-3.75-6.01-7.5-6.01zM1 17h15v2H1zM18 5V1h-2v4h-5l.23 2h9.56l-1.4 14H18v2h1.72c.84 0 1.53-.65 1.63-1.47L23 5h-5z"/>
+</vector>
\ No newline at end of file
diff --git a/chrome/android/features/autofill_assistant/java/res/drawable/ic_grocery_black_24dp.xml b/chrome/android/features/autofill_assistant/java/res/drawable/ic_grocery_black_24dp.xml
new file mode 100644
index 0000000..8a34dd8
--- /dev/null
+++ b/chrome/android/features/autofill_assistant/java/res/drawable/ic_grocery_black_24dp.xml
@@ -0,0 +1,26 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Copyright 2020 The Chromium Authors. All rights reserved.
+     Use of this source code is governed by a BSD-style license that can be
+     found in the LICENSE file. -->
+<vector
+    xmlns:android="http://schemas.android.com/apk/res/android"
+    xmlns:tools="http://schemas.android.com/tools"
+    android:width="24dp"
+    android:height="24dp"
+    android:viewportWidth="24"
+    android:viewportHeight="24"
+    tools:targetApi="21">
+    <path
+        android:fillColor="#000000"
+        android:pathData="M20.01,5.01c-1.65,0-3,1.34-3,2.99H23C23,6.35,21.66,5.01,20.01,5.01z"/>
+    <path
+        android:fillColor="#000000"
+        android:pathData="M13.99,4.99C13.99,6.65,15.34,8,17,8V1.99C15.34,1.99,13.99,3.33,13.99,4.99z"/>
+    <path
+        android:fillColor="#000000"
+        android:pathData="M16.99,10.99c2.76,0,5.01,2.25,5.01,5.01S19.75,21,16.99,21s-5.01-2.25-5.01-5.01S14.23,10.99,16.99,10.99 M16.99,8.99 c-3.87,0-7.01,3.14-7.01,7.01c0,3.87,3.14,7.01,7.01,7.01s7.01-3.14,7.01-7.01C23.99,12.12,20.86,8.99,16.99,8.99L16.99,8.99z"/>
+    <path
+        android:fillColor="#000000"
+        android:pathData="M10.02,21H2v-9.79L4.72,5h3.5l2.37,5.37l1.52-1.52l-1.72-3.9C10.72,4.9,11,4.62,11,4.27V1.7C11,1.32,10.68,1,10.3,1H2.7 C2.32,1,2,1.32,2,1.7v2.56c0,0.35,0.23,0.62,0.56,0.68l-2.48,5.64C0.03,10.72,0,10.85,0,10.99V22c0,0.55,0.45,1,1,1h11.02 L10.02,21z"/>
+
+</vector>
\ No newline at end of file
diff --git a/chrome/android/features/autofill_assistant/java/res/drawable/ic_local_dining_black_24dp.xml b/chrome/android/features/autofill_assistant/java/res/drawable/ic_local_dining_black_24dp.xml
new file mode 100644
index 0000000..e29d6dda
--- /dev/null
+++ b/chrome/android/features/autofill_assistant/java/res/drawable/ic_local_dining_black_24dp.xml
@@ -0,0 +1,16 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Copyright 2020 The Chromium Authors. All rights reserved.
+     Use of this source code is governed by a BSD-style license that can be
+     found in the LICENSE file. -->
+<vector
+    xmlns:android="http://schemas.android.com/apk/res/android"
+    xmlns:tools="http://schemas.android.com/tools"
+    android:width="24dp"
+    android:height="24dp"
+    android:viewportWidth="24"
+    android:viewportHeight="24"
+    tools:targetApi="21">
+    <path
+        android:fillColor="#000000"
+        android:pathData="M3.91 3.5c-1.56 1.56-1.56 4.09 0 5.66l4.19 4.18 2.83-2.83L3.91 3.5zm10.97 8.03c1.53.71 3.68.21 5.27-1.38 1.91-1.91 2.28-4.65.81-6.12-1.46-1.46-4.2-1.1-6.12.81-1.59 1.59-2.09 3.74-1.38 5.27L3.7 19.87l1.41 1.41L12 14.41l6.88 6.88 1.41-1.41L13.41 13l1.47-1.47z"/>
+</vector>
\ No newline at end of file
diff --git a/chrome/android/features/autofill_assistant/java/res/drawable/ic_settings_black_24dp.xml b/chrome/android/features/autofill_assistant/java/res/drawable/ic_settings_black_24dp.xml
new file mode 100644
index 0000000..5d18c41
--- /dev/null
+++ b/chrome/android/features/autofill_assistant/java/res/drawable/ic_settings_black_24dp.xml
@@ -0,0 +1,19 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Copyright 2020 The Chromium Authors. All rights reserved.
+     Use of this source code is governed by a BSD-style license that can be
+     found in the LICENSE file. -->
+<vector
+    xmlns:android="http://schemas.android.com/apk/res/android"
+    xmlns:tools="http://schemas.android.com/tools"
+    android:width="24dp"
+    android:height="24dp"
+    android:viewportWidth="24"
+    android:viewportHeight="24"
+    tools:targetApi="21">
+    <path
+        android:fillColor="#000000"
+        android:pathData="M13.85 22.25h-3.7c-.74 0-1.36-.54-1.45-1.27l-.27-1.89c-.27-.14-.53-.29-.79-.46l-1.8.72c-.7.26-1.47-.03-1.81-.65L2.2 15.53c-.35-.66-.2-1.44.36-1.88l1.53-1.19c-.01-.15-.02-.3-.02-.46 0-.15.01-.31.02-.46l-1.52-1.19c-.59-.45-.74-1.26-.37-1.88l1.85-3.19c.34-.62 1.11-.9 1.79-.63l1.81.73c.26-.17.52-.32.78-.46l.27-1.91c.09-.7.71-1.25 1.44-1.25h3.7c.74 0 1.36.54 1.45 1.27l.27 1.89c.27.14.53.29.79.46l1.8-.72c.71-.26 1.48.03 1.82.65l1.84 3.18c.36.66.2 1.44-.36 1.88l-1.52 1.19c.01.15.02.3.02.46s-.01.31-.02.46l1.52 1.19c.56.45.72 1.23.37 1.86l-1.86 3.22c-.34.62-1.11.9-1.8.63l-1.8-.72c-.26.17-.52.32-.78.46l-.27 1.91c-.1.68-.72 1.22-1.46 1.22zm-3.23-2h2.76l.37-2.55.53-.22c.44-.18.88-.44 1.34-.78l.45-.34 2.38.96 1.38-2.4-2.03-1.58.07-.56c.03-.26.06-.51.06-.78s-.03-.53-.06-.78l-.07-.56 2.03-1.58-1.39-2.4-2.39.96-.45-.35c-.42-.32-.87-.58-1.33-.77l-.52-.22-.37-2.55h-2.76l-.37 2.55-.53.21c-.44.19-.88.44-1.34.79l-.45.33-2.38-.95-1.39 2.39 2.03 1.58-.07.56c-.03.26-.06.53-.06.79s.02.53.06.78l.07.56-2.03 1.58 1.38 2.4 2.39-.96.45.35c.43.33.86.58 1.33.77l.53.22.38 2.55z"/>
+    <path
+        android:fillColor="#000000"
+        android:pathData="M 12, 12 m -3.5, 0 a 3.5,3.5 0 1,0 7,0 a 3.5,3.5 0 1,0 -7,0"/>
+</vector>
\ No newline at end of file
diff --git a/chrome/android/features/autofill_assistant/java/res/drawable/ic_vpn_key_black_24dp.xml b/chrome/android/features/autofill_assistant/java/res/drawable/ic_vpn_key_black_24dp.xml
new file mode 100644
index 0000000..024f21d
--- /dev/null
+++ b/chrome/android/features/autofill_assistant/java/res/drawable/ic_vpn_key_black_24dp.xml
@@ -0,0 +1,16 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Copyright 2020 The Chromium Authors. All rights reserved.
+     Use of this source code is governed by a BSD-style license that can be
+     found in the LICENSE file. -->
+<vector
+    xmlns:android="http://schemas.android.com/apk/res/android"
+    xmlns:tools="http://schemas.android.com/tools"
+    android:width="24dp"
+    android:height="24dp"
+    android:viewportWidth="24"
+    android:viewportHeight="24"
+    tools:targetApi="21">
+    <path
+        android:fillColor="#000000"
+        android:pathData="M12.65 10C11.83 7.67 9.61 6 7 6c-3.31 0-6 2.69-6 6s2.69 6 6 6c2.61 0 4.83-1.67 5.65-4H17v4h4v-4h2v-4H12.65zM7 14c-1.1 0-2-.9-2-2s.9-2 2-2 2 .9 2 2-.9 2-2 2z"/>
+</vector>
\ No newline at end of file
diff --git a/chrome/android/features/autofill_assistant/java/src/org/chromium/chrome/browser/autofill_assistant/generic_ui/AssistantDrawable.java b/chrome/android/features/autofill_assistant/java/src/org/chromium/chrome/browser/autofill_assistant/generic_ui/AssistantDrawable.java
index c3f9a69..9fbeb51 100644
--- a/chrome/android/features/autofill_assistant/java/src/org/chromium/chrome/browser/autofill_assistant/generic_ui/AssistantDrawable.java
+++ b/chrome/android/features/autofill_assistant/java/src/org/chromium/chrome/browser/autofill_assistant/generic_ui/AssistantDrawable.java
@@ -158,27 +158,42 @@
             mIcon = icon;
         }
 
-        @Override
-        public void getDrawable(Context context, Callback<Drawable> callback) {
-            int resourceId;
+        private int getResourceId() {
             switch (mIcon) {
                 case AssistantDrawableIcon.PROGRESSBAR_DEFAULT_INITIAL_STEP:
-                    resourceId = R.drawable.ic_autofill_assistant_default_progress_start_black_24dp;
-                    break;
+                    return R.drawable.ic_autofill_assistant_default_progress_start_black_24dp;
                 case AssistantDrawableIcon.PROGRESSBAR_DEFAULT_DATA_COLLECTION:
-                    resourceId = R.drawable.ic_shopping_basket_black_24dp;
-                    break;
+                    return R.drawable.ic_shopping_basket_black_24dp;
                 case AssistantDrawableIcon.PROGRESSBAR_DEFAULT_PAYMENT:
-                    resourceId = R.drawable.ic_payment_black_24dp;
-                    break;
+                    return R.drawable.ic_payment_black_24dp;
                 case AssistantDrawableIcon.PROGRESSBAR_DEFAULT_FINAL_STEP:
-                    resourceId = R.drawable.ic_check_circle_black_24dp;
-                    break;
-                default:
-                    resourceId = INVALID_ICON_ID;
-                    break;
+                    return R.drawable.ic_check_circle_black_24dp;
+                case AssistantDrawableIcon.SITTING_PERSON:
+                    return R.drawable.ic_airline_seat_recline_normal_black_24dp;
+                case AssistantDrawableIcon.TICKET_STUB:
+                    return R.drawable.ic_confirmation_number_black_24dp;
+                case AssistantDrawableIcon.SHOPPING_BASKET:
+                    return R.drawable.ic_shopping_basket_black_24dp;
+                case AssistantDrawableIcon.FAST_FOOD:
+                    return R.drawable.ic_fastfood_black_24dp;
+                case AssistantDrawableIcon.LOCAL_DINING:
+                    return R.drawable.ic_local_dining_black_24dp;
+                case AssistantDrawableIcon.COGWHEEL:
+                    return R.drawable.ic_settings_black_24dp;
+                case AssistantDrawableIcon.KEY:
+                    return R.drawable.ic_vpn_key_black_24dp;
+                case AssistantDrawableIcon.CAR:
+                    return R.drawable.ic_directions_car_black_24dp;
+                case AssistantDrawableIcon.GROCERY:
+                    return R.drawable.ic_grocery_black_24dp;
             }
 
+            return INVALID_ICON_ID;
+        }
+
+        @Override
+        public void getDrawable(Context context, Callback<Drawable> callback) {
+            int resourceId = getResourceId();
             callback.onResult(resourceId == INVALID_ICON_ID
                             ? null
                             : AppCompatResources.getDrawable(context, resourceId));
diff --git a/chrome/android/features/autofill_assistant/javatests/src/org/chromium/chrome/browser/autofill_assistant/AutofillAssistantNavigationIntegrationTest.java b/chrome/android/features/autofill_assistant/javatests/src/org/chromium/chrome/browser/autofill_assistant/AutofillAssistantNavigationIntegrationTest.java
index d64a962..c58469e 100644
--- a/chrome/android/features/autofill_assistant/javatests/src/org/chromium/chrome/browser/autofill_assistant/AutofillAssistantNavigationIntegrationTest.java
+++ b/chrome/android/features/autofill_assistant/javatests/src/org/chromium/chrome/browser/autofill_assistant/AutofillAssistantNavigationIntegrationTest.java
@@ -31,7 +31,6 @@
 import org.junit.runner.RunWith;
 
 import org.chromium.base.test.util.CommandLineFlags;
-import org.chromium.base.test.util.DisabledTest;
 import org.chromium.chrome.autofill_assistant.R;
 import org.chromium.chrome.browser.autofill_assistant.proto.ActionProto;
 import org.chromium.chrome.browser.autofill_assistant.proto.ChipProto;
@@ -44,6 +43,7 @@
 import org.chromium.chrome.browser.autofill_assistant.proto.SupportedScriptProto;
 import org.chromium.chrome.browser.autofill_assistant.proto.SupportedScriptProto.PresentationProto;
 import org.chromium.chrome.browser.autofill_assistant.proto.TellProto;
+import org.chromium.chrome.browser.autofill_assistant.proto.WaitForNavigationProto;
 import org.chromium.chrome.browser.flags.ChromeSwitches;
 import org.chromium.chrome.test.ChromeJUnit4ClassRunner;
 import org.chromium.chrome.test.ChromeTabbedActivityTestRule;
@@ -199,7 +199,6 @@
 
     @Test
     @MediumTest
-    @DisabledTest(message = "Flaky - https://crbug.com/1104900")
     public void navigateActionDoesNotCauseError() {
         // Push something to navigation stack so we can use back and forth.
         ChromeTabUtils.loadUrlOnUiThread(
@@ -207,25 +206,39 @@
 
         ArrayList<ActionProto> list = new ArrayList<>();
         list.add((ActionProto) ActionProto.newBuilder()
+                         .setPrompt(PromptProto.newBuilder().setMessage("Page B").addChoices(
+                                 Choice.newBuilder().setChip(
+                                         ChipProto.newBuilder().setText("Navigate"))))
+                         .build());
+        list.add((ActionProto) ActionProto.newBuilder()
                          .setNavigate(NavigateProto.newBuilder().setUrl(getURL(TEST_PAGE_A)))
                          .build());
         list.add((ActionProto) ActionProto.newBuilder()
+                         .setWaitForNavigation(WaitForNavigationProto.newBuilder())
+                         .build());
+        list.add((ActionProto) ActionProto.newBuilder()
                          .setPrompt(PromptProto.newBuilder().setMessage("Page A").addChoices(
                                  Choice.newBuilder().setChip(
-                                         ChipProto.newBuilder().setText("Next"))))
+                                         ChipProto.newBuilder().setText("Go back"))))
                          .build());
         list.add((ActionProto) ActionProto.newBuilder()
                          .setNavigate(NavigateProto.newBuilder().setGoBackward(true))
                          .build());
         list.add((ActionProto) ActionProto.newBuilder()
+                         .setWaitForNavigation(WaitForNavigationProto.newBuilder())
+                         .build());
+        list.add((ActionProto) ActionProto.newBuilder()
                          .setPrompt(PromptProto.newBuilder().setMessage("Page B").addChoices(
                                  Choice.newBuilder().setChip(
-                                         ChipProto.newBuilder().setText("Next"))))
+                                         ChipProto.newBuilder().setText("Go forward"))))
                          .build());
         list.add((ActionProto) ActionProto.newBuilder()
                          .setNavigate(NavigateProto.newBuilder().setGoForward(true))
                          .build());
         list.add((ActionProto) ActionProto.newBuilder()
+                         .setWaitForNavigation(WaitForNavigationProto.newBuilder())
+                         .build());
+        list.add((ActionProto) ActionProto.newBuilder()
                          .setPrompt(PromptProto.newBuilder().setMessage("Page A").addChoices(
                                  PromptProto.Choice.newBuilder()))
                          .build());
@@ -240,17 +253,20 @@
         setupScripts(script);
         startAutofillAssistantOnTab(TEST_PAGE_B);
 
+        waitUntilViewMatchesCondition(withText("Page B"), isCompletelyDisplayed());
+        onView(withText("Navigate")).perform(click());
+
         waitUntilViewMatchesCondition(withText("Page A"), isCompletelyDisplayed());
         waitUntil(()
                           -> mTestRule.getActivity().getActivityTab().getUrl().getSpec().equals(
                                   getURL(TEST_PAGE_A)));
-        onView(withText("Next")).perform(click());
+        onView(withText("Go back")).perform(click());
 
         waitUntilViewMatchesCondition(withText("Page B"), isCompletelyDisplayed());
         waitUntil(()
                           -> mTestRule.getActivity().getActivityTab().getUrl().getSpec().equals(
                                   getURL(TEST_PAGE_B)));
-        onView(withText("Next")).perform(click());
+        onView(withText("Go forward")).perform(click());
 
         waitUntilViewMatchesCondition(withText("Page A"), isCompletelyDisplayed());
         waitUntil(()
diff --git a/chrome/android/features/start_surface/internal/java/src/org/chromium/chrome/features/start_surface/ExploreSurfaceStreamLifecycleManager.java b/chrome/android/features/start_surface/internal/java/src/org/chromium/chrome/features/start_surface/ExploreSurfaceStreamLifecycleManager.java
index e9ecc3f..69004d0 100644
--- a/chrome/android/features/start_surface/internal/java/src/org/chromium/chrome/features/start_surface/ExploreSurfaceStreamLifecycleManager.java
+++ b/chrome/android/features/start_surface/internal/java/src/org/chromium/chrome/features/start_surface/ExploreSurfaceStreamLifecycleManager.java
@@ -9,7 +9,8 @@
 import org.chromium.chrome.browser.feed.StreamLifecycleManager;
 import org.chromium.chrome.browser.feed.shared.stream.Stream;
 import org.chromium.chrome.browser.preferences.Pref;
-import org.chromium.chrome.browser.preferences.PrefServiceBridge;
+import org.chromium.chrome.browser.profiles.Profile;
+import org.chromium.components.user_prefs.UserPrefs;
 
 /** Explore surface feed stream lifecycle manager. */
 class ExploreSurfaceStreamLifecycleManager extends StreamLifecycleManager {
@@ -39,8 +40,9 @@
         // If there is a header to opt out from article suggestions, we don't call
         // Stream#onShow to prevent feed services from being warmed up if the user
         // has opted out during the previous session.
-        return (!mHasHeader
-                || PrefServiceBridge.getInstance().getBoolean(Pref.ARTICLES_LIST_VISIBLE));
+        return !mHasHeader
+                || UserPrefs.get(Profile.getLastUsedRegularProfile())
+                           .getBoolean(Pref.ARTICLES_LIST_VISIBLE);
     }
     // TODO(crbug.com/982018): Save and restore instance state when opening the feeds in normal
     // Tabs.
diff --git a/chrome/android/javatests/src/org/chromium/chrome/browser/browserservices/TrustedWebActivityTestUtil.java b/chrome/android/javatests/src/org/chromium/chrome/browser/browserservices/TrustedWebActivityTestUtil.java
index bc6c809..152cdaf 100644
--- a/chrome/android/javatests/src/org/chromium/chrome/browser/browserservices/TrustedWebActivityTestUtil.java
+++ b/chrome/android/javatests/src/org/chromium/chrome/browser/browserservices/TrustedWebActivityTestUtil.java
@@ -60,6 +60,18 @@
         return intent;
     }
 
+    /**
+     * Creates an Intent that will launch a Custom Tab to the given |url|, caches a successful
+     * verification and creates the Custom Tabs Session from the intent.
+     */
+    public static Intent createTrustedWebActivityIntentAndVerifiedSession(
+            String url, String packageName) throws TimeoutException {
+        Intent intent = createTrustedWebActivityIntent(url);
+        spoofVerification(packageName, url);
+        createSession(intent, packageName);
+        return intent;
+    }
+
     /** Caches a successful verification for the given |packageName| and |url|. */
     public static void spoofVerification(String packageName, String url) {
         TestThreadUtils.runOnUiThreadBlocking(
diff --git a/chrome/android/javatests/src/org/chromium/chrome/browser/browserservices/permissiondelegation/TrustedWebActivityLocationDelegationTest.java b/chrome/android/javatests/src/org/chromium/chrome/browser/browserservices/permissiondelegation/TrustedWebActivityLocationDelegationTest.java
new file mode 100644
index 0000000..49d443e
--- /dev/null
+++ b/chrome/android/javatests/src/org/chromium/chrome/browser/browserservices/permissiondelegation/TrustedWebActivityLocationDelegationTest.java
@@ -0,0 +1,175 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+package org.chromium.chrome.browser.browserservices.permissiondelegation;
+
+import static org.junit.Assert.assertFalse;
+import static org.junit.Assert.assertTrue;
+
+import static org.chromium.chrome.browser.browserservices.TrustedWebActivityTestUtil.isTrustedWebActivity;
+
+import android.net.Uri;
+import android.os.RemoteException;
+import android.support.test.filters.MediumTest;
+
+import org.junit.Before;
+import org.junit.Rule;
+import org.junit.Test;
+import org.junit.rules.RuleChain;
+import org.junit.runner.RunWith;
+
+import org.chromium.base.CommandLine;
+import org.chromium.base.library_loader.LibraryLoader;
+import org.chromium.base.test.BaseJUnit4ClassRunner;
+import org.chromium.base.test.util.CommandLineFlags;
+import org.chromium.chrome.browser.browserservices.TrustedWebActivityTestUtil;
+import org.chromium.chrome.browser.customtabs.CustomTabActivityTestRule;
+import org.chromium.chrome.browser.flags.ChromeFeatureList;
+import org.chromium.chrome.browser.flags.ChromeSwitches;
+import org.chromium.chrome.browser.permissions.PermissionTestRule.PermissionUpdateWaiter;
+import org.chromium.chrome.browser.settings.SettingsActivity;
+import org.chromium.chrome.browser.site_settings.SiteSettingsTestUtils;
+import org.chromium.chrome.browser.tab.Tab;
+import org.chromium.chrome.browser.test.MockCertVerifierRuleAndroid;
+import org.chromium.components.browser_ui.settings.ChromeSwitchPreference;
+import org.chromium.components.browser_ui.site_settings.SingleCategorySettings;
+import org.chromium.components.browser_ui.site_settings.SiteSettingsCategory;
+import org.chromium.content_public.browser.test.util.TestThreadUtils;
+import org.chromium.content_public.common.ContentSwitches;
+import org.chromium.device.geolocation.LocationProviderOverrider;
+import org.chromium.device.geolocation.MockLocationProvider;
+
+import java.util.concurrent.TimeoutException;
+
+/**
+ * Tests TrustedWebActivity location delegation.
+ */
+@RunWith(BaseJUnit4ClassRunner.class)
+@CommandLineFlags.Add({ChromeSwitches.DISABLE_FIRST_RUN_EXPERIENCE,
+        "enable-features=" + ChromeFeatureList.TRUSTED_WEB_ACTIVITY_LOCATION_DELEGATION})
+public class TrustedWebActivityLocationDelegationTest {
+    public final CustomTabActivityTestRule mCustomTabActivityTestRule =
+            new CustomTabActivityTestRule();
+
+    public final MockCertVerifierRuleAndroid mCertVerifierRule =
+            new MockCertVerifierRuleAndroid(0 /* net::OK */);
+
+    @Rule
+    public final RuleChain mRuleChain =
+            RuleChain.emptyRuleChain().around(mCustomTabActivityTestRule).around(mCertVerifierRule);
+
+    private static final String TEST_FILE = "/content/test/data/android/geolocation.html";
+    private static final String TEST_SUPPORT_PACKAGE = "org.chromium.chrome.tests.support";
+
+    private String mTestPage;
+
+    @Before
+    public void setUp() throws TimeoutException, RemoteException {
+        // Initialize native.
+        LibraryLoader.getInstance().ensureInitialized();
+
+        mCustomTabActivityTestRule.getEmbeddedTestServerRule().setServerUsesHttps(true);
+        Uri mapToUri = Uri.parse(mCustomTabActivityTestRule.getTestServer().getURL("/"));
+        CommandLine.getInstance().appendSwitchWithValue(
+                ContentSwitches.HOST_RESOLVER_RULES, "MAP * " + mapToUri.getAuthority());
+
+        mTestPage = mCustomTabActivityTestRule.getTestServer().getURLWithHostName(
+                "www.example.com", TEST_FILE);
+
+        mCustomTabActivityTestRule.startCustomTabActivityWithIntent(
+                TrustedWebActivityTestUtil.createTrustedWebActivityIntentAndVerifiedSession(
+                        mTestPage, TEST_SUPPORT_PACKAGE));
+    }
+
+    @Test
+    @MediumTest
+    public void getLocationFromTestTwaService() throws TimeoutException, Exception {
+        assertTrue(ChromeFeatureList.isEnabled(
+                ChromeFeatureList.TRUSTED_WEB_ACTIVITY_LOCATION_DELEGATION));
+        Tab tab = mCustomTabActivityTestRule.getActivity().getActivityTab();
+        PermissionUpdateWaiter updateWaiter =
+                new PermissionUpdateWaiter("Count:", mCustomTabActivityTestRule.getActivity());
+        tab.addObserver(updateWaiter);
+        getGeolocation();
+        updateWaiter.waitForNumUpdates(1);
+    }
+
+    @Test
+    @MediumTest
+    @CommandLineFlags.
+    Add("disable-features=" + ChromeFeatureList.TRUSTED_WEB_ACTIVITY_LOCATION_DELEGATION)
+    public void getLocationFromChrome_delegationDisabled() throws TimeoutException, Exception {
+        assertFalse(ChromeFeatureList.isEnabled(
+                ChromeFeatureList.TRUSTED_WEB_ACTIVITY_LOCATION_DELEGATION));
+        verifyLocationFromChrome();
+    }
+
+    @Test
+    @MediumTest
+    public void getLocationFromChrome_noTwaService() throws TimeoutException, Exception {
+        String packageName = "other.package.name";
+        String testPage = mCustomTabActivityTestRule.getTestServer().getURLWithHostName(
+                "www.otherexample.com", TEST_FILE);
+
+        mCustomTabActivityTestRule.startCustomTabActivityWithIntent(
+                TrustedWebActivityTestUtil.createTrustedWebActivityIntentAndVerifiedSession(
+                        testPage, packageName));
+
+        assertTrue(isTrustedWebActivity(mCustomTabActivityTestRule.getActivity()));
+
+        verifyLocationFromChrome();
+    }
+
+    @Test
+    @MediumTest
+    public void getLocationFromChrome_afterNavigateAwayFromTrustedOrigin()
+            throws TimeoutException, Exception {
+        String other_page = mCustomTabActivityTestRule.getTestServer().getURLWithHostName(
+                "www.otherexample.com", TEST_FILE);
+
+        mCustomTabActivityTestRule.loadUrl(other_page);
+        assertFalse(isTrustedWebActivity(mCustomTabActivityTestRule.getActivity()));
+
+        verifyLocationFromChrome();
+    }
+
+    private void getGeolocation() throws TimeoutException {
+        mCustomTabActivityTestRule.runJavaScriptCodeInCurrentTab("initiate_getCurrentPosition()");
+    }
+
+    private void setAllowChromeSiteLocation(boolean enabled) {
+        LocationProviderOverrider.setLocationProviderImpl(new MockLocationProvider());
+        final SettingsActivity settingsActivity = SiteSettingsTestUtils.startSiteSettingsCategory(
+                SiteSettingsCategory.Type.DEVICE_LOCATION);
+
+        TestThreadUtils.runOnUiThreadBlocking(() -> {
+            SingleCategorySettings websitePreferences =
+                    (SingleCategorySettings) settingsActivity.getMainFragment();
+            ChromeSwitchPreference location =
+                    (ChromeSwitchPreference) websitePreferences.findPreference(
+                            SingleCategorySettings.BINARY_TOGGLE_KEY);
+
+            websitePreferences.onPreferenceChange(location, enabled);
+            settingsActivity.finish();
+        });
+    }
+
+    private void verifyLocationFromChrome() throws TimeoutException, Exception {
+        Tab tab = mCustomTabActivityTestRule.getActivity().getActivityTab();
+
+        setAllowChromeSiteLocation(false);
+        PermissionUpdateWaiter errorWaiter =
+                new PermissionUpdateWaiter("deny", mCustomTabActivityTestRule.getActivity());
+        tab.addObserver(errorWaiter);
+        getGeolocation();
+        errorWaiter.waitForNumUpdates(0);
+
+        setAllowChromeSiteLocation(true);
+        PermissionUpdateWaiter updateWaiter =
+                new PermissionUpdateWaiter("Count:", mCustomTabActivityTestRule.getActivity());
+        tab.addObserver(updateWaiter);
+        getGeolocation();
+        errorWaiter.waitForNumUpdates(1);
+    }
+}
diff --git a/chrome/app/generated_resources.grd b/chrome/app/generated_resources.grd
index 6ee6c01..a421a1e 100644
--- a/chrome/app/generated_resources.grd
+++ b/chrome/app/generated_resources.grd
@@ -1020,8 +1020,11 @@
           <message name="IDS_SAVE_PAGE" desc="The text label of the Save Page As menu item">
             Save page &amp;as...
           </message>
-          <message name="IDS_DISTILL_PAGE" desc="The text label of the 'Toggle reader mode' menu item">
-            Toggle reader mode
+          <message name="IDS_DISTILL_PAGE" desc="The text label of the 'Enter reader mode' menu item">
+            Enter reader mode
+          </message>
+          <message name="IDS_EXIT_DISTILLED_PAGE" desc="The text label of the 'Exit reader mode' menu item">
+            Exit reader mode
           </message>
           <message name="IDS_MORE_TOOLS_MENU" desc="The text label of the Tools submenu for touch">
             More too&amp;ls
@@ -1094,8 +1097,11 @@
           <message name="IDS_SAVE_PAGE" desc="In Title Case: The text label of the Save Page As menu item">
             Save Page &amp;As...
           </message>
-          <message name="IDS_DISTILL_PAGE" desc="The text label of the 'Toggle Reader Mode' menu item">
-            Toggle Reader Mode
+          <message name="IDS_DISTILL_PAGE" desc="In Title Case: The text label of the 'Enter Reader Mode' menu item">
+            Enter Reader Mode
+          </message>
+          <message name="IDS_EXIT_DISTILLED_PAGE" desc="In Title Case: The text label of the 'Exit Reader Mode' menu item">
+            Exit Reader Mode
           </message>
           <message name="IDS_MORE_TOOLS_MENU" desc="In Title Case: The text label of the Tools submenu for touch">
             More Too&amp;ls
diff --git a/chrome/app/generated_resources_grd/IDS_DISTILL_PAGE.png.sha1 b/chrome/app/generated_resources_grd/IDS_DISTILL_PAGE.png.sha1
index 8b3abcf..489491e 100644
--- a/chrome/app/generated_resources_grd/IDS_DISTILL_PAGE.png.sha1
+++ b/chrome/app/generated_resources_grd/IDS_DISTILL_PAGE.png.sha1
@@ -1 +1 @@
-638b514b9294188a006d00ded5ca5017614534a2
\ No newline at end of file
+7e6d9dc92020609a8143505c930354c770560a08
\ No newline at end of file
diff --git a/chrome/app/generated_resources_grd/IDS_EXIT_DISTILLED_PAGE.png.sha1 b/chrome/app/generated_resources_grd/IDS_EXIT_DISTILLED_PAGE.png.sha1
new file mode 100644
index 0000000..7e68ff3
--- /dev/null
+++ b/chrome/app/generated_resources_grd/IDS_EXIT_DISTILLED_PAGE.png.sha1
@@ -0,0 +1 @@
+a66ab08780f709ef54ea52758db655082ebad3fc
\ No newline at end of file
diff --git a/chrome/browser/BUILD.gn b/chrome/browser/BUILD.gn
index a2098e014..6e0d0ab 100644
--- a/chrome/browser/BUILD.gn
+++ b/chrome/browser/BUILD.gn
@@ -966,6 +966,8 @@
     "page_load_metrics/observers/ad_metrics/ads_page_load_metrics_observer.h",
     "page_load_metrics/observers/ad_metrics/frame_data.cc",
     "page_load_metrics/observers/ad_metrics/frame_data.h",
+    "page_load_metrics/observers/ad_metrics/page_ad_density_tracker.cc",
+    "page_load_metrics/observers/ad_metrics/page_ad_density_tracker.h",
     "page_load_metrics/observers/amp_page_load_metrics_observer.cc",
     "page_load_metrics/observers/amp_page_load_metrics_observer.h",
     "page_load_metrics/observers/data_saver_site_breakdown_metrics_observer.cc",
@@ -2951,6 +2953,7 @@
       "//third_party/smhasher:murmurhash2",
       "//url:origin_android",
     ]
+    allow_circular_includes_from += [ "//chrome/browser/share" ]
 
     deps += [ "//chrome/browser/engagement/android:jni_headers" ]
     deps -= [ "//components/storage_monitor" ]
diff --git a/chrome/browser/about_flags.cc b/chrome/browser/about_flags.cc
index f70e9f4..ab95886 100644
--- a/chrome/browser/about_flags.cc
+++ b/chrome/browser/about_flags.cc
@@ -2024,9 +2024,9 @@
 // Include generated flags for flag unexpiry; see //docs/flag_expiry.md and
 // //tools/flags/generate_unexpire_flags.py.
 #include "chrome/browser/unexpire_flags_gen.inc"
-    {"ignore-gpu-blacklist", flag_descriptions::kIgnoreGpuBlacklistName,
-     flag_descriptions::kIgnoreGpuBlacklistDescription, kOsAll,
-     SINGLE_VALUE_TYPE(switches::kIgnoreGpuBlacklist)},
+    {"ignore-gpu-blocklist", flag_descriptions::kIgnoreGpuBlocklistName,
+     flag_descriptions::kIgnoreGpuBlocklistDescription, kOsAll,
+     SINGLE_VALUE_TYPE(switches::kIgnoreGpuBlocklist)},
     {"disable-accelerated-2d-canvas",
      flag_descriptions::kAccelerated2dCanvasName,
      flag_descriptions::kAccelerated2dCanvasDescription, kOsAll,
diff --git a/chrome/browser/android/autofill_assistant/ui_controller_android_utils.cc b/chrome/browser/android/autofill_assistant/ui_controller_android_utils.cc
index 0215570..8404e23 100644
--- a/chrome/browser/android/autofill_assistant/ui_controller_android_utils.cc
+++ b/chrome/browser/android/autofill_assistant/ui_controller_android_utils.cc
@@ -33,6 +33,24 @@
       return DrawableIcon::PROGRESSBAR_DEFAULT_PAYMENT;
     case DrawableProto::PROGRESSBAR_DEFAULT_FINAL_STEP:
       return DrawableIcon::PROGRESSBAR_DEFAULT_FINAL_STEP;
+    case DrawableProto::SITTING_PERSON:
+      return DrawableIcon::SITTING_PERSON;
+    case DrawableProto::TICKET_STUB:
+      return DrawableIcon::TICKET_STUB;
+    case DrawableProto::SHOPPING_BASKET:
+      return DrawableIcon::SHOPPING_BASKET;
+    case DrawableProto::FAST_FOOD:
+      return DrawableIcon::FAST_FOOD;
+    case DrawableProto::LOCAL_DINING:
+      return DrawableIcon::LOCAL_DINING;
+    case DrawableProto::COGWHEEL:
+      return DrawableIcon::COGWHEEL;
+    case DrawableProto::KEY:
+      return DrawableIcon::KEY;
+    case DrawableProto::CAR:
+      return DrawableIcon::CAR;
+    case DrawableProto::GROCERY:
+      return DrawableIcon::GROCERY;
   }
 }
 
diff --git a/chrome/browser/android/bottombar/overlay_panel_content.cc b/chrome/browser/android/bottombar/overlay_panel_content.cc
index a498181..fd1b3ef 100644
--- a/chrome/browser/android/bottombar/overlay_panel_content.cc
+++ b/chrome/browser/android/bottombar/overlay_panel_content.cc
@@ -23,7 +23,6 @@
 #include "content/public/browser/render_frame_host.h"
 #include "content/public/browser/web_contents.h"
 #include "content/public/common/browser_controls_state.h"
-#include "net/url_request/url_fetcher_impl.h"
 #include "ui/android/view_android.h"
 
 using base::android::JavaParamRef;
diff --git a/chrome/browser/android/compositor/scene_layer/contextual_search_scene_layer.cc b/chrome/browser/android/compositor/scene_layer/contextual_search_scene_layer.cc
index 870d5bcc..ad8fd36c 100644
--- a/chrome/browser/android/compositor/scene_layer/contextual_search_scene_layer.cc
+++ b/chrome/browser/android/compositor/scene_layer/contextual_search_scene_layer.cc
@@ -16,6 +16,7 @@
 #include "content/public/browser/web_contents.h"
 #include "net/base/load_flags.h"
 #include "net/traffic_annotation/network_traffic_annotation.h"
+#include "net/url_request/referrer_policy.h"
 #include "services/network/public/mojom/url_loader_factory.mojom.h"
 #include "ui/android/resources/resource_manager_impl.h"
 #include "ui/android/view_android.h"
@@ -214,7 +215,7 @@
       std::make_unique<BitmapFetcher>(gurl, this, NO_TRAFFIC_ANNOTATION_YET);
   fetcher_->Init(
       std::string(),
-      net::URLRequest::REDUCE_REFERRER_GRANULARITY_ON_TRANSITION_CROSS_ORIGIN,
+      net::ReferrerPolicy::REDUCE_GRANULARITY_ON_TRANSITION_CROSS_ORIGIN,
       network::mojom::CredentialsMode::kInclude);
   fetcher_->Start(loader_factory);
 }
diff --git a/chrome/browser/android/contextualsearch/simple_search_term_resolver.cc b/chrome/browser/android/contextualsearch/simple_search_term_resolver.cc
index 456e22e..72cff73 100644
--- a/chrome/browser/android/contextualsearch/simple_search_term_resolver.cc
+++ b/chrome/browser/android/contextualsearch/simple_search_term_resolver.cc
@@ -25,7 +25,6 @@
 #include "content/public/browser/render_view_host.h"
 #include "content/public/browser/web_contents.h"
 #include "content/public/browser/web_contents_observer.h"
-#include "net/url_request/url_fetcher_impl.h"
 #include "services/network/public/cpp/shared_url_loader_factory.h"
 #include "services/service_manager/public/cpp/binder_registry.h"
 #include "services/service_manager/public/cpp/interface_provider.h"
diff --git a/chrome/browser/android/cookies/cookies_fetcher_util.cc b/chrome/browser/android/cookies/cookies_fetcher_util.cc
index fb61f10..4348ce6 100644
--- a/chrome/browser/android/cookies/cookies_fetcher_util.cc
+++ b/chrome/browser/android/cookies/cookies_fetcher_util.cc
@@ -14,7 +14,6 @@
 #include "content/public/browser/storage_partition.h"
 #include "content/public/common/content_switches.h"
 #include "net/cookies/cookie_util.h"
-#include "net/url_request/url_request_context.h"
 #include "services/network/public/mojom/cookie_manager.mojom.h"
 
 using base::android::JavaParamRef;
diff --git a/chrome/browser/android/customtabs/custom_tabs_connection.cc b/chrome/browser/android/customtabs/custom_tabs_connection.cc
index 2fec76b..b00ac36d 100644
--- a/chrome/browser/android/customtabs/custom_tabs_connection.cc
+++ b/chrome/browser/android/customtabs/custom_tabs_connection.cc
@@ -13,6 +13,7 @@
 #include "chrome/browser/profiles/profile.h"
 #include "chrome/browser/profiles/profile_android.h"
 #include "content/public/common/referrer.h"
+#include "net/url_request/referrer_policy.h"
 #include "url/gurl.h"
 
 namespace customtabs {
@@ -55,7 +56,7 @@
     base::android::ConvertJavaStringToUTF8(env, package_name, &native_package);
 
   // Java only knows about the blink referrer policy.
-  net::URLRequest::ReferrerPolicy url_request_referrer_policy =
+  net::ReferrerPolicy url_request_referrer_policy =
       content::Referrer::ReferrerPolicyForUrlRequest(
           content::Referrer::ConvertToPolicy(referrer_policy));
   DetachedResourceRequest::Motivation request_motivation =
diff --git a/chrome/browser/android/customtabs/detached_resource_request.cc b/chrome/browser/android/customtabs/detached_resource_request.cc
index 8d5504c..e90f277 100644
--- a/chrome/browser/android/customtabs/detached_resource_request.cc
+++ b/chrome/browser/android/customtabs/detached_resource_request.cc
@@ -61,7 +61,7 @@
     content::BrowserContext* browser_context,
     const GURL& url,
     const GURL& site_for_cookies,
-    const net::URLRequest::ReferrerPolicy referrer_policy,
+    const net::ReferrerPolicy referrer_policy,
     Motivation motivation,
     const std::string& package_name,
     DetachedResourceRequest::OnResultCallback cb) {
@@ -77,7 +77,7 @@
 DetachedResourceRequest::DetachedResourceRequest(
     const GURL& url,
     const GURL& site_for_cookies,
-    net::URLRequest::ReferrerPolicy referrer_policy,
+    net::ReferrerPolicy referrer_policy,
     Motivation motivation,
     const std::string& package_name,
     DetachedResourceRequest::OnResultCallback cb)
diff --git a/chrome/browser/android/customtabs/detached_resource_request.h b/chrome/browser/android/customtabs/detached_resource_request.h
index 80881dd..e3ffe34 100644
--- a/chrome/browser/android/customtabs/detached_resource_request.h
+++ b/chrome/browser/android/customtabs/detached_resource_request.h
@@ -12,7 +12,7 @@
 #include "base/bind_helpers.h"
 #include "base/callback.h"
 #include "base/time/time.h"
-#include "net/url_request/url_request.h"
+#include "net/url_request/referrer_policy.h"
 #include "services/network/public/mojom/url_response_head.mojom-forward.h"
 #include "url/gurl.h"
 
@@ -56,7 +56,7 @@
   static void CreateAndStart(content::BrowserContext* browser_context,
                              const GURL& url,
                              const GURL& first_party_for_cookies,
-                             net::URLRequest::ReferrerPolicy referer_policy,
+                             net::ReferrerPolicy referer_policy,
                              Motivation motivation,
                              const std::string& package_name,
                              OnResultCallback cb = base::DoNothing());
@@ -64,7 +64,7 @@
  private:
   DetachedResourceRequest(const GURL& url,
                           const GURL& site_for_cookies,
-                          net::URLRequest::ReferrerPolicy referer_policy,
+                          net::ReferrerPolicy referer_policy,
                           Motivation motivation,
                           const std::string& package_name,
                           OnResultCallback cb);
diff --git a/chrome/browser/android/customtabs/detached_resource_request_unittest.cc b/chrome/browser/android/customtabs/detached_resource_request_unittest.cc
index d47d74f..710b3d87d 100644
--- a/chrome/browser/android/customtabs/detached_resource_request_unittest.cc
+++ b/chrome/browser/android/customtabs/detached_resource_request_unittest.cc
@@ -282,7 +282,7 @@
 
   void SetAndCheckReferrer(const std::string& initial_referrer,
                            const std::string& expected_referrer,
-                           net::URLRequest::ReferrerPolicy policy) {
+                           net::ReferrerPolicy policy) {
     base::RunLoop request_completion_waiter;
     base::RunLoop server_request_waiter;
     HttpRequest::HeaderMap headers;
@@ -563,14 +563,13 @@
 TEST_F(DetachedResourceRequestTest, OriginReferrerPolicy) {
   // Only the origin, even for downgrades.
   SetAndCheckReferrer("https://cats.google.com/cute-cats",
-                      "https://cats.google.com/",
-                      net::URLRequest::ReferrerPolicy::ORIGIN);
+                      "https://cats.google.com/", net::ReferrerPolicy::ORIGIN);
 }
 
 TEST_F(DetachedResourceRequestTest, NeverClearReferrerPolicy) {
   SetAndCheckReferrer("https://cats.google.com/cute-cats",
                       "https://cats.google.com/cute-cats",
-                      net::URLRequest::ReferrerPolicy::NEVER_CLEAR_REFERRER);
+                      net::ReferrerPolicy::NEVER_CLEAR);
 }
 
 TEST_F(DetachedResourceRequestTest, MultipleOrigins) {
diff --git a/chrome/browser/android/devtools_server.cc b/chrome/browser/android/devtools_server.cc
index bb4f4c0..59a22ee9 100644
--- a/chrome/browser/android/devtools_server.cc
+++ b/chrome/browser/android/devtools_server.cc
@@ -40,7 +40,6 @@
 #include "content/public/common/user_agent.h"
 #include "net/base/net_errors.h"
 #include "net/socket/unix_domain_server_socket_posix.h"
-#include "net/url_request/url_request_context_getter.h"
 
 using base::android::JavaParamRef;
 using content::DevToolsAgentHost;
diff --git a/chrome/browser/android/explore_sites/explore_sites_fetcher.cc b/chrome/browser/android/explore_sites/explore_sites_fetcher.cc
index 90176e4..55c56a9 100644
--- a/chrome/browser/android/explore_sites/explore_sites_fetcher.cc
+++ b/chrome/browser/android/explore_sites/explore_sites_fetcher.cc
@@ -31,8 +31,6 @@
 #include "net/http/http_request_headers.h"
 #include "net/http/http_status_code.h"
 #include "net/traffic_annotation/network_traffic_annotation.h"
-#include "net/url_request/url_fetcher.h"
-#include "net/url_request/url_request_status.h"
 #include "services/network/public/cpp/resource_request.h"
 #include "services/network/public/cpp/simple_url_loader.h"
 #include "url/gurl.h"
diff --git a/chrome/browser/android/explore_sites/explore_sites_fetcher_unittest.cc b/chrome/browser/android/explore_sites/explore_sites_fetcher_unittest.cc
index cd857a3..4df8a54 100644
--- a/chrome/browser/android/explore_sites/explore_sites_fetcher_unittest.cc
+++ b/chrome/browser/android/explore_sites/explore_sites_fetcher_unittest.cc
@@ -19,7 +19,6 @@
 #include "chrome/browser/flags/android/chrome_feature_list.h"
 #include "net/http/http_request_headers.h"
 #include "net/http/http_status_code.h"
-#include "net/url_request/url_request_status.h"
 #include "services/network/public/cpp/weak_wrapper_shared_url_loader_factory.h"
 #include "services/network/test/test_url_loader_factory.h"
 #include "services/network/test/test_utils.h"
diff --git a/chrome/browser/android/explore_sites/ntp_json_fetcher.cc b/chrome/browser/android/explore_sites/ntp_json_fetcher.cc
index 20b42ab..2b0bf2055 100644
--- a/chrome/browser/android/explore_sites/ntp_json_fetcher.cc
+++ b/chrome/browser/android/explore_sites/ntp_json_fetcher.cc
@@ -18,8 +18,6 @@
 #include "content/public/browser/system_connector.h"
 #include "net/base/load_flags.h"
 #include "net/traffic_annotation/network_traffic_annotation.h"
-#include "net/url_request/url_fetcher.h"
-#include "net/url_request/url_request_status.h"
 #include "services/network/public/cpp/resource_request.h"
 #include "services/network/public/cpp/simple_url_loader.h"
 #include "url/gurl.h"
diff --git a/chrome/browser/android/feed/feed_host_service_factory.cc b/chrome/browser/android/feed/feed_host_service_factory.cc
index ee9f9f8..6aba65c 100644
--- a/chrome/browser/android/feed/feed_host_service_factory.cc
+++ b/chrome/browser/android/feed/feed_host_service_factory.cc
@@ -33,7 +33,6 @@
 #include "content/public/browser/browser_context.h"
 #include "content/public/browser/storage_partition.h"
 #include "google_apis/google_api_keys.h"
-#include "net/url_request/url_request_context_getter.h"
 
 namespace history {
 class HistoryService;
diff --git a/chrome/browser/android/feed/v2/feed_service_factory.cc b/chrome/browser/android/feed/v2/feed_service_factory.cc
index c056563..86339d03 100644
--- a/chrome/browser/android/feed/v2/feed_service_factory.cc
+++ b/chrome/browser/android/feed/v2/feed_service_factory.cc
@@ -30,7 +30,6 @@
 #include "content/public/browser/browser_context.h"
 #include "content/public/browser/storage_partition.h"
 #include "google_apis/google_api_keys.h"
-#include "net/url_request/url_request_context_getter.h"
 
 namespace feed {
 namespace {
diff --git a/chrome/browser/android/webapk/webapk_installer_unittest.cc b/chrome/browser/android/webapk/webapk_installer_unittest.cc
index e709f6a..7286171 100644
--- a/chrome/browser/android/webapk/webapk_installer_unittest.cc
+++ b/chrome/browser/android/webapk/webapk_installer_unittest.cc
@@ -26,7 +26,6 @@
 #include "net/test/embedded_test_server/embedded_test_server.h"
 #include "net/test/embedded_test_server/http_request.h"
 #include "net/test/embedded_test_server/http_response.h"
-#include "net/url_request/url_request_test_util.h"
 #include "testing/gmock/include/gmock/gmock.h"
 #include "testing/gtest/include/gtest/gtest.h"
 #include "third_party/skia/include/core/SkBitmap.h"
diff --git a/chrome/browser/apps/platform_apps/platform_app_navigation_redirector.cc b/chrome/browser/apps/platform_apps/platform_app_navigation_redirector.cc
index 6ef25c8..f60040d 100644
--- a/chrome/browser/apps/platform_apps/platform_app_navigation_redirector.cc
+++ b/chrome/browser/apps/platform_apps/platform_app_navigation_redirector.cc
@@ -19,7 +19,6 @@
 #include "extensions/browser/extension_registry.h"
 #include "extensions/common/extension.h"
 #include "extensions/common/extension_set.h"
-#include "net/url_request/url_request.h"
 
 using content::BrowserThread;
 using content::WebContents;
diff --git a/chrome/browser/autofill/autofill_interactive_uitest.cc b/chrome/browser/autofill/autofill_interactive_uitest.cc
index d591113..e4af6eb 100644
--- a/chrome/browser/autofill/autofill_interactive_uitest.cc
+++ b/chrome/browser/autofill/autofill_interactive_uitest.cc
@@ -80,7 +80,6 @@
 #include "net/dns/mock_host_resolver.h"
 #include "net/test/embedded_test_server/controllable_http_response.h"
 #include "net/test/embedded_test_server/embedded_test_server.h"
-#include "net/url_request/url_request_status.h"
 #include "testing/gmock/include/gmock/gmock.h"
 #include "testing/gtest/include/gtest/gtest.h"
 #include "ui/events/base_event_utils.h"
diff --git a/chrome/browser/bitmap_fetcher/bitmap_fetcher.cc b/chrome/browser/bitmap_fetcher/bitmap_fetcher.cc
index 4a33ee3..abc9160 100644
--- a/chrome/browser/bitmap_fetcher/bitmap_fetcher.cc
+++ b/chrome/browser/bitmap_fetcher/bitmap_fetcher.cc
@@ -10,9 +10,6 @@
 #include "content/public/browser/browser_thread.h"
 #include "content/public/browser/storage_partition.h"
 #include "net/base/data_url.h"
-#include "net/url_request/url_fetcher.h"
-#include "net/url_request/url_request_context_getter.h"
-#include "net/url_request/url_request_status.h"
 #include "url/url_constants.h"
 
 BitmapFetcher::BitmapFetcher(
@@ -25,7 +22,7 @@
 }
 
 void BitmapFetcher::Init(const std::string& referrer,
-                         net::URLRequest::ReferrerPolicy referrer_policy,
+                         net::ReferrerPolicy referrer_policy,
                          network::mojom::CredentialsMode credentials_mode) {
   if (simple_loader_ != NULL)
     return;
diff --git a/chrome/browser/bitmap_fetcher/bitmap_fetcher.h b/chrome/browser/bitmap_fetcher/bitmap_fetcher.h
index e077b10..d8a6133d 100644
--- a/chrome/browser/bitmap_fetcher/bitmap_fetcher.h
+++ b/chrome/browser/bitmap_fetcher/bitmap_fetcher.h
@@ -13,7 +13,7 @@
 #include "chrome/browser/bitmap_fetcher/bitmap_fetcher_delegate.h"
 #include "chrome/browser/image_decoder/image_decoder.h"
 #include "net/traffic_annotation/network_traffic_annotation.h"
-#include "net/url_request/url_request.h"
+#include "net/url_request/referrer_policy.h"
 #include "services/network/public/cpp/simple_url_loader.h"
 #include "services/network/public/mojom/fetch_api.mojom-forward.h"
 #include "services/network/public/mojom/url_loader_factory.mojom-forward.h"
@@ -37,7 +37,7 @@
   // calls will be ignored.
   // TODO(tommycli): Init and Start should likely be combined.
   virtual void Init(const std::string& referrer,
-                    net::URLRequest::ReferrerPolicy referrer_policy,
+                    net::ReferrerPolicy referrer_policy,
                     network::mojom::CredentialsMode credentials_mode);
 
   // Start fetching the URL with the fetcher. The delegate is notified
diff --git a/chrome/browser/bitmap_fetcher/bitmap_fetcher_browsertest.cc b/chrome/browser/bitmap_fetcher/bitmap_fetcher_browsertest.cc
index b7c65ec..88fe392 100644
--- a/chrome/browser/bitmap_fetcher/bitmap_fetcher_browsertest.cc
+++ b/chrome/browser/bitmap_fetcher/bitmap_fetcher_browsertest.cc
@@ -20,7 +20,7 @@
 #include "net/test/embedded_test_server/http_request.h"
 #include "net/test/embedded_test_server/http_response.h"
 #include "net/traffic_annotation/network_traffic_annotation_test_helper.h"
-#include "net/url_request/url_request_status.h"
+#include "net/url_request/referrer_policy.h"
 #include "testing/gtest/include/gtest/gtest.h"
 #include "third_party/skia/include/core/SkBitmap.h"
 #include "ui/gfx/codec/png_codec.h"
@@ -151,7 +151,7 @@
   // an image in a callback to OnImageDecoded().
   fetcher.Init(
       std::string(),
-      net::URLRequest::REDUCE_REFERRER_GRANULARITY_ON_TRANSITION_CROSS_ORIGIN,
+      net::ReferrerPolicy::REDUCE_GRANULARITY_ON_TRANSITION_CROSS_ORIGIN,
       network::mojom::CredentialsMode::kInclude);
   fetcher.Start(
       content::BrowserContext::GetDefaultStoragePartition(browser()->profile())
@@ -197,7 +197,7 @@
 
   fetcher.Init(
       std::string(),
-      net::URLRequest::REDUCE_REFERRER_GRANULARITY_ON_TRANSITION_CROSS_ORIGIN,
+      net::ReferrerPolicy::REDUCE_GRANULARITY_ON_TRANSITION_CROSS_ORIGIN,
       network::mojom::CredentialsMode::kInclude);
   fetcher.Start(
       content::BrowserContext::GetDefaultStoragePartition(browser()->profile())
@@ -217,7 +217,7 @@
 
   fetcher.Init(
       std::string(),
-      net::URLRequest::REDUCE_REFERRER_GRANULARITY_ON_TRANSITION_CROSS_ORIGIN,
+      net::ReferrerPolicy::REDUCE_GRANULARITY_ON_TRANSITION_CROSS_ORIGIN,
       network::mojom::CredentialsMode::kInclude);
   fetcher.Start(
       content::BrowserContext::GetDefaultStoragePartition(browser()->profile())
@@ -237,7 +237,7 @@
 
   fetcher.Init(
       std::string(),
-      net::URLRequest::REDUCE_REFERRER_GRANULARITY_ON_TRANSITION_CROSS_ORIGIN,
+      net::ReferrerPolicy::REDUCE_GRANULARITY_ON_TRANSITION_CROSS_ORIGIN,
       network::mojom::CredentialsMode::kInclude);
   fetcher.Start(
       content::BrowserContext::GetDefaultStoragePartition(browser()->profile())
@@ -260,7 +260,7 @@
 
   fetcher.Init(
       std::string(),
-      net::URLRequest::REDUCE_REFERRER_GRANULARITY_ON_TRANSITION_CROSS_ORIGIN,
+      net::ReferrerPolicy::REDUCE_GRANULARITY_ON_TRANSITION_CROSS_ORIGIN,
       network::mojom::CredentialsMode::kInclude);
   fetcher.Start(
       content::BrowserContext::GetDefaultStoragePartition(browser()->profile())
diff --git a/chrome/browser/bitmap_fetcher/bitmap_fetcher_service.cc b/chrome/browser/bitmap_fetcher/bitmap_fetcher_service.cc
index 31207b772..4ab44144 100644
--- a/chrome/browser/bitmap_fetcher/bitmap_fetcher_service.cc
+++ b/chrome/browser/bitmap_fetcher/bitmap_fetcher_service.cc
@@ -184,7 +184,7 @@
 
   new_fetcher->Init(
       std::string(),
-      net::URLRequest::REDUCE_REFERRER_GRANULARITY_ON_TRANSITION_CROSS_ORIGIN,
+      net::ReferrerPolicy::REDUCE_GRANULARITY_ON_TRANSITION_CROSS_ORIGIN,
       network::mojom::CredentialsMode::kInclude);
   new_fetcher->Start(
       content::BrowserContext::GetDefaultStoragePartition(context_)
diff --git a/chrome/browser/browsing_data/cookies_tree_model.cc b/chrome/browser/browsing_data/cookies_tree_model.cc
index 1fbd942..02ecc1e 100644
--- a/chrome/browser/browsing_data/cookies_tree_model.cc
+++ b/chrome/browser/browsing_data/cookies_tree_model.cc
@@ -47,7 +47,6 @@
 #include "net/base/registry_controlled_domains/registry_controlled_domain.h"
 #include "net/cookies/canonical_cookie.h"
 #include "net/cookies/cookie_util.h"
-#include "net/url_request/url_request_context.h"
 #include "ui/base/l10n/l10n_util.h"
 #include "ui/base/resource/resource_bundle.h"
 #include "ui/gfx/color_palette.h"
diff --git a/chrome/browser/browsing_data/cookies_tree_model_unittest.cc b/chrome/browser/browsing_data/cookies_tree_model_unittest.cc
index ea5b1e5..e4aea65 100644
--- a/chrome/browser/browsing_data/cookies_tree_model_unittest.cc
+++ b/chrome/browser/browsing_data/cookies_tree_model_unittest.cc
@@ -38,8 +38,6 @@
 #include "content/public/browser/storage_usage_info.h"
 #include "content/public/test/browser_task_environment.h"
 #include "extensions/buildflags/buildflags.h"
-#include "net/url_request/url_request_context.h"
-#include "net/url_request/url_request_context_getter.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
 #if BUILDFLAG(ENABLE_EXTENSIONS)
diff --git a/chrome/browser/browsing_data/counters/site_data_counting_helper.cc b/chrome/browser/browsing_data/counters/site_data_counting_helper.cc
index 5e97a4c2..9724073 100644
--- a/chrome/browser/browsing_data/counters/site_data_counting_helper.cc
+++ b/chrome/browser/browsing_data/counters/site_data_counting_helper.cc
@@ -19,8 +19,6 @@
 #include "content/public/browser/storage_usage_info.h"
 #include "media/media_buildflags.h"
 #include "net/cookies/cookie_util.h"
-#include "net/url_request/url_request_context.h"
-#include "net/url_request/url_request_context_getter.h"
 #include "ppapi/buildflags/buildflags.h"
 #include "services/network/public/mojom/cookie_manager.mojom.h"
 #include "storage/browser/file_system/file_system_context.h"
diff --git a/chrome/browser/captive_portal/captive_portal_browsertest.cc b/chrome/browser/captive_portal/captive_portal_browsertest.cc
index 161d1df..7acc8a0 100644
--- a/chrome/browser/captive_portal/captive_portal_browsertest.cc
+++ b/chrome/browser/captive_portal/captive_portal_browsertest.cc
@@ -78,12 +78,6 @@
 #include "net/test/cert_test_util.h"
 #include "net/test/embedded_test_server/embedded_test_server.h"
 #include "net/test/test_data_directory.h"
-#include "net/test/url_request/url_request_failed_job.h"
-#include "net/test/url_request/url_request_mock_http_job.h"
-#include "net/url_request/url_request.h"
-#include "net/url_request/url_request_context.h"
-#include "net/url_request/url_request_context_getter.h"
-#include "net/url_request/url_request_status.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
 #if defined(OS_WIN)
diff --git a/chrome/browser/chrome_content_browser_client.cc b/chrome/browser/chrome_content_browser_client.cc
index 5641c6e..8dd8fe0 100644
--- a/chrome/browser/chrome_content_browser_client.cc
+++ b/chrome/browser/chrome_content_browser_client.cc
@@ -2397,9 +2397,10 @@
     command_line->CopySwitchesFrom(browser_command_line, kSwitchNames,
                                    base::size(kSwitchNames));
   } else if (process_type == switches::kGpuProcess) {
-    // If --ignore-gpu-blacklist is passed in, don't send in crash reports
+    // If --ignore-gpu-blocklist is passed in, don't send in crash reports
     // because GPU is expected to be unreliable.
-    if (browser_command_line.HasSwitch(switches::kIgnoreGpuBlacklist) &&
+    if ((browser_command_line.HasSwitch(switches::kIgnoreGpuBlocklist) ||
+         browser_command_line.HasSwitch(switches::kIgnoreGpuBlacklist)) &&
         !command_line->HasSwitch(switches::kDisableBreakpad))
       command_line->AppendSwitch(switches::kDisableBreakpad);
   }
diff --git a/chrome/browser/chromeos/arc/policy/arc_policy_bridge_unittest.cc b/chrome/browser/chromeos/arc/policy/arc_policy_bridge_unittest.cc
index 1f421d80..e41eb92 100644
--- a/chrome/browser/chromeos/arc/policy/arc_policy_bridge_unittest.cc
+++ b/chrome/browser/chromeos/arc/policy/arc_policy_bridge_unittest.cc
@@ -515,10 +515,10 @@
                   "}],"
                   "\"defaultPermissionPolicy\":\"GRANT\"}"),
       nullptr);
-  policy_map().Set(
-      policy::key::kHomepageLocation, policy::POLICY_LEVEL_MANDATORY,
-      policy::POLICY_SCOPE_USER, policy::POLICY_SOURCE_CLOUD,
-      std::make_unique<base::Value>("http://chromium.org"), nullptr);
+  policy_map().Set(policy::key::kHomepageLocation,
+                   policy::POLICY_LEVEL_MANDATORY, policy::POLICY_SCOPE_USER,
+                   policy::POLICY_SOURCE_CLOUD,
+                   base::Value("http://chromium.org"), nullptr);
   policy_map().Set(policy::key::kVideoCaptureAllowed,
                    policy::POLICY_LEVEL_MANDATORY, policy::POLICY_SCOPE_USER,
                    policy::POLICY_SOURCE_CLOUD, base::Value(false), nullptr);
diff --git a/chrome/browser/chromeos/policy/device_cloud_policy_manager_chromeos_unittest.cc b/chrome/browser/chromeos/policy/device_cloud_policy_manager_chromeos_unittest.cc
index a1c849d9..b6d877ec 100644
--- a/chrome/browser/chromeos/policy/device_cloud_policy_manager_chromeos_unittest.cc
+++ b/chrome/browser/chromeos/policy/device_cloud_policy_manager_chromeos_unittest.cc
@@ -64,7 +64,6 @@
 #include "content/public/test/test_utils.h"
 #include "google_apis/gaia/gaia_oauth_client.h"
 #include "google_apis/gaia/gaia_urls.h"
-#include "net/url_request/url_request_test_util.h"
 #include "services/network/public/cpp/weak_wrapper_shared_url_loader_factory.h"
 #include "services/network/test/test_url_loader_factory.h"
 #include "services/network/test/test_utils.h"
diff --git a/chrome/browser/chromeos/policy/network_policy_application_browsertest.cc b/chrome/browser/chromeos/policy/network_policy_application_browsertest.cc
index 7637c987..48d9885 100644
--- a/chrome/browser/chromeos/policy/network_policy_application_browsertest.cc
+++ b/chrome/browser/chromeos/policy/network_policy_application_browsertest.cc
@@ -174,20 +174,20 @@
 
   void SetDeviceOpenNetworkConfiguration(
       const std::string& device_onc_policy_blob) {
-    current_policy_.Set(
-        policy::key::kDeviceOpenNetworkConfiguration,
-        policy::POLICY_LEVEL_MANDATORY, policy::POLICY_SCOPE_MACHINE,
-        policy::POLICY_SOURCE_CLOUD,
-        std::make_unique<base::Value>(device_onc_policy_blob), nullptr);
+    current_policy_.Set(policy::key::kDeviceOpenNetworkConfiguration,
+                        policy::POLICY_LEVEL_MANDATORY,
+                        policy::POLICY_SCOPE_MACHINE,
+                        policy::POLICY_SOURCE_CLOUD,
+                        base::Value(device_onc_policy_blob), nullptr);
     policy_provider_.UpdateChromePolicy(current_policy_);
   }
 
   void SetUserOpenNetworkConfiguration(
       const std::string& user_onc_policy_blob) {
-    current_policy_.Set(
-        policy::key::kOpenNetworkConfiguration, policy::POLICY_LEVEL_MANDATORY,
-        policy::POLICY_SCOPE_USER, policy::POLICY_SOURCE_CLOUD,
-        std::make_unique<base::Value>(user_onc_policy_blob), nullptr);
+    current_policy_.Set(policy::key::kOpenNetworkConfiguration,
+                        policy::POLICY_LEVEL_MANDATORY,
+                        policy::POLICY_SCOPE_USER, policy::POLICY_SOURCE_CLOUD,
+                        base::Value(user_onc_policy_blob), nullptr);
     policy_provider_.UpdateChromePolicy(current_policy_);
   }
 
diff --git a/chrome/browser/chromeos/policy/system_features_disable_list_policy_handler_unittest.cc b/chrome/browser/chromeos/policy/system_features_disable_list_policy_handler_unittest.cc
index 60e8986e..d1e3a58 100644
--- a/chrome/browser/chromeos/policy/system_features_disable_list_policy_handler_unittest.cc
+++ b/chrome/browser/chromeos/policy/system_features_disable_list_policy_handler_unittest.cc
@@ -30,11 +30,10 @@
   PrefValueMap prefs;
   base::Value* value = nullptr;
   SystemFeaturesDisableListPolicyHandler policy_handler;
-  std::unique_ptr<base::Value> features_list =
-      std::make_unique<base::Value>(base::Value::Type::LIST);
+  base::Value features_list(base::Value::Type::LIST);
 
-  features_list->Append("camera");
-  features_list->Append("browser_settings");
+  features_list.Append("camera");
+  features_list.Append("browser_settings");
 
   policy_map.Set(policy::key::kSystemFeaturesDisableList,
                  policy::POLICY_LEVEL_MANDATORY, policy::POLICY_SCOPE_USER,
@@ -66,10 +65,10 @@
                                       SystemFeature::UNKNOWN_SYSTEM_FEATURE,
                                       /*amount*/ 0);
 
-  features_list = std::make_unique<base::Value>(base::Value::Type::LIST);
-  features_list->Append("camera");
-  features_list->Append("os_settings");
-  features_list->Append("gallery");
+  features_list.ClearList();
+  features_list.Append("camera");
+  features_list.Append("os_settings");
+  features_list.Append("gallery");
 
   policy_map.Set(policy::key::kSystemFeaturesDisableList,
                  policy::POLICY_LEVEL_MANDATORY, policy::POLICY_SCOPE_USER,
diff --git a/chrome/browser/chromeos/policy/user_cloud_policy_manager_chromeos_unittest.cc b/chrome/browser/chromeos/policy/user_cloud_policy_manager_chromeos_unittest.cc
index 0109667b..6671dda 100644
--- a/chrome/browser/chromeos/policy/user_cloud_policy_manager_chromeos_unittest.cc
+++ b/chrome/browser/chromeos/policy/user_cloud_policy_manager_chromeos_unittest.cc
@@ -181,8 +181,7 @@
     GetExpectedDefaultPolicy(&policy_map_);
     policy_map_.Set(key::kHomepageLocation, POLICY_LEVEL_MANDATORY,
                     POLICY_SCOPE_USER, POLICY_SOURCE_CLOUD,
-                    std::make_unique<base::Value>("http://chromium.org"),
-                    nullptr);
+                    base::Value("http://chromium.org"), nullptr);
     expected_bundle_.Get(PolicyNamespace(POLICY_DOMAIN_CHROME, std::string()))
         .CopyFrom(policy_map_);
 
diff --git a/chrome/browser/chromeos/policy/user_cloud_policy_store_chromeos_unittest.cc b/chrome/browser/chromeos/policy/user_cloud_policy_store_chromeos_unittest.cc
index 3b97d59..6c8c17c 100644
--- a/chrome/browser/chromeos/policy/user_cloud_policy_store_chromeos_unittest.cc
+++ b/chrome/browser/chromeos/policy/user_cloud_policy_store_chromeos_unittest.cc
@@ -208,8 +208,7 @@
     if (previous_value) {
       previous_policy.Set(key::kHomepageLocation, POLICY_LEVEL_MANDATORY,
                           POLICY_SCOPE_USER, POLICY_SOURCE_CLOUD,
-                          std::make_unique<base::Value>(previous_value),
-                          nullptr);
+                          base::Value(previous_value), nullptr);
     }
     EXPECT_TRUE(previous_policy.Equals(store_->policy_map()));
     EXPECT_EQ(initial_status, store_->status());
diff --git a/chrome/browser/chromeos/power/ml/idle_event_notifier.cc b/chrome/browser/chromeos/power/ml/idle_event_notifier.cc
index 32d6120e7..c68f78b 100644
--- a/chrome/browser/chromeos/power/ml/idle_event_notifier.cc
+++ b/chrome/browser/chromeos/power/ml/idle_event_notifier.cc
@@ -19,6 +19,7 @@
 
 using TimeSinceBoot = base::TimeDelta;
 
+// static
 constexpr base::TimeDelta IdleEventNotifier::kIdleDelay;
 constexpr base::TimeDelta IdleEventNotifier::kUserInputEventsDuration;
 constexpr int IdleEventNotifier::kNumUserInputEventsBuckets;
diff --git a/chrome/browser/component_updater/supervised_user_whitelist_installer.cc b/chrome/browser/component_updater/supervised_user_whitelist_installer.cc
index 4ff74b8c..07fd940 100644
--- a/chrome/browser/component_updater/supervised_user_whitelist_installer.cc
+++ b/chrome/browser/component_updater/supervised_user_whitelist_installer.cc
@@ -459,7 +459,7 @@
   if (!clients->empty())
     return removed;
 
-  pref_dict->RemoveWithoutPathExpansion(crx_id, nullptr);
+  pref_dict->RemoveKey(crx_id);
   const bool result = cus_->UnregisterComponent(crx_id);
   DCHECK(result);
 
@@ -531,7 +531,7 @@
 
   // Clean up stale whitelists as determined above.
   for (const std::string& id : stale_whitelists)
-    whitelists->RemoveWithoutPathExpansion(id, nullptr);
+    whitelists->RemoveKey(id);
 
   sequenced_task_runner_->PostTask(
       FROM_HERE, base::BindOnce(&RemoveUnregisteredWhitelistsOnTaskRunner,
diff --git a/chrome/browser/devtools/devtools_eye_dropper.cc b/chrome/browser/devtools/devtools_eye_dropper.cc
index 9d63b98..f6657b86 100644
--- a/chrome/browser/devtools/devtools_eye_dropper.cc
+++ b/chrome/browser/devtools/devtools_eye_dropper.cc
@@ -16,7 +16,6 @@
 #include "content/public/browser/render_widget_host_view.h"
 #include "content/public/browser/web_contents.h"
 #include "content/public/common/content_features.h"
-#include "content/public/common/screen_info.h"
 #include "media/base/limits.h"
 #include "media/base/video_frame.h"
 #include "media/capture/mojom/video_capture_types.mojom.h"
@@ -178,9 +177,7 @@
   const float kPixelSize = 10;
 #endif
 
-  content::ScreenInfo screen_info;
-  host_->GetScreenInfo(&screen_info);
-  double device_scale_factor = screen_info.device_scale_factor;
+  float device_scale_factor = host_->GetDeviceScaleFactor();
 
   SkBitmap result;
   result.allocN32Pixels(kCursorSize * device_scale_factor,
diff --git a/chrome/browser/devtools/devtools_sanity_browsertest.cc b/chrome/browser/devtools/devtools_sanity_browsertest.cc
index 96fc50e..437451d0 100644
--- a/chrome/browser/devtools/devtools_sanity_browsertest.cc
+++ b/chrome/browser/devtools/devtools_sanity_browsertest.cc
@@ -102,8 +102,6 @@
 #include "extensions/test/test_extension_dir.h"
 #include "net/dns/mock_host_resolver.h"
 #include "net/test/spawned_test_server/spawned_test_server.h"
-#include "net/url_request/url_request_context.h"
-#include "net/url_request/url_request_context_getter.h"
 #include "services/network/public/cpp/features.h"
 #include "services/network/public/mojom/url_response_head.mojom.h"
 #include "third_party/blink/public/common/input/web_input_event.h"
diff --git a/chrome/browser/download/android/download_controller_base.cc b/chrome/browser/download/android/download_controller_base.cc
index f4b0801..6f6e4c0 100644
--- a/chrome/browser/download/android/download_controller_base.cc
+++ b/chrome/browser/download/android/download_controller_base.cc
@@ -6,7 +6,6 @@
 #include "chrome/browser/chrome_content_browser_client.h"
 #include "content/public/browser/render_view_host.h"
 #include "content/public/browser/web_contents.h"
-#include "net/url_request/url_request.h"
 
 const char kOMADrmMessageMimeType[] = "application/vnd.oma.drm.message";
 const char kOMADrmContentMimeType[] = "application/vnd.oma.drm.content";
diff --git a/chrome/browser/download/android/download_manager_service.cc b/chrome/browser/download/android/download_manager_service.cc
index 5ea015b..91b1f36 100644
--- a/chrome/browser/download/android/download_manager_service.cc
+++ b/chrome/browser/download/android/download_manager_service.cc
@@ -49,6 +49,7 @@
 #include "content/public/browser/browser_context.h"
 #include "content/public/browser/download_item_utils.h"
 #include "content/public/browser/download_request_utils.h"
+#include "net/url_request/referrer_policy.h"
 #include "third_party/blink/public/common/mime_util/mime_util.h"
 #include "url/origin.h"
 
@@ -574,8 +575,7 @@
   // TODO(xingliu): See if we need to persist the referrer policy. Never clear
   // referrer potentially may result in delivering unexpected referrer to web
   // servers.
-  download_url_params->set_referrer_policy(
-      net::URLRequest::NEVER_CLEAR_REFERRER);
+  download_url_params->set_referrer_policy(net::ReferrerPolicy::NEVER_CLEAR);
   download_url_params->set_referrer(item->GetReferrerUrl());
   download_url_params->set_download_source(download::DownloadSource::RETRY);
 
diff --git a/chrome/browser/download/download_dir_policy_handler_unittest.cc b/chrome/browser/download/download_dir_policy_handler_unittest.cc
index 6ac5c5c..79246af 100644
--- a/chrome/browser/download/download_dir_policy_handler_unittest.cc
+++ b/chrome/browser/download/download_dir_policy_handler_unittest.cc
@@ -60,7 +60,7 @@
   EXPECT_FALSE(store_->GetValue(prefs::kPromptForDownload, NULL));
   policy.Set(policy::key::kDownloadDirectory, policy::POLICY_LEVEL_MANDATORY,
              policy::POLICY_SCOPE_USER, policy::POLICY_SOURCE_CLOUD,
-             std::make_unique<base::Value>(std::string()), nullptr);
+             base::Value(std::string()), nullptr);
   UpdateProviderPolicy(policy);
 
   // Setting a DownloadDirectory should disable the PromptForDownload pref.
@@ -81,8 +81,7 @@
   policy::PolicyMap policy;
   policy.Set(policy::key::kDownloadDirectory, policy::POLICY_LEVEL_MANDATORY,
              policy::POLICY_SCOPE_USER, policy::POLICY_SOURCE_CLOUD,
-             std::make_unique<base::Value>(
-                 download_dir_util::kDriveNamePolicyVariableName),
+             base::Value(download_dir_util::kDriveNamePolicyVariableName),
              nullptr);
   UpdateProviderPolicy(policy);
 
@@ -108,16 +107,16 @@
 
   policy.Set(policy::key::kDownloadDirectory, policy::POLICY_LEVEL_MANDATORY,
              policy::POLICY_SCOPE_USER, policy::POLICY_SOURCE_CLOUD,
-             std::make_unique<base::Value>(kUserIDHash), nullptr);
+             base::Value(kUserIDHash), nullptr);
   UpdateProviderPolicy(policy);
   EXPECT_FALSE(recommended_store_->GetValue(drive::prefs::kDisableDrive, NULL));
 
-  policy.Set(policy::key::kDownloadDirectory, policy::POLICY_LEVEL_RECOMMENDED,
-             policy::POLICY_SCOPE_USER, policy::POLICY_SOURCE_CLOUD,
-             std::make_unique<base::Value>(
-                 std::string(download_dir_util::kDriveNamePolicyVariableName) +
-                 kRelativeToDriveRoot),
-             nullptr);
+  policy.Set(
+      policy::key::kDownloadDirectory, policy::POLICY_LEVEL_RECOMMENDED,
+      policy::POLICY_SCOPE_USER, policy::POLICY_SOURCE_CLOUD,
+      base::Value(std::string(download_dir_util::kDriveNamePolicyVariableName) +
+                  kRelativeToDriveRoot),
+      nullptr);
   UpdateProviderPolicy(policy);
 
   EXPECT_FALSE(recommended_store_->GetValue(prefs::kPromptForDownload, NULL));
@@ -133,7 +132,7 @@
 
   policy.Set(policy::key::kDownloadDirectory, policy::POLICY_LEVEL_RECOMMENDED,
              policy::POLICY_SCOPE_USER, policy::POLICY_SOURCE_CLOUD,
-             std::make_unique<base::Value>(kUserIDHash), nullptr);
+             base::Value(kUserIDHash), nullptr);
   UpdateProviderPolicy(policy);
 
   EXPECT_FALSE(recommended_store_->GetValue(prefs::kPromptForDownload, NULL));
diff --git a/chrome/browser/download/download_ui_model.cc b/chrome/browser/download/download_ui_model.cc
index 2015cdd..7c2dc8b 100644
--- a/chrome/browser/download/download_ui_model.cc
+++ b/chrome/browser/download/download_ui_model.cc
@@ -17,7 +17,6 @@
 #include "components/download/public/common/download_danger_type.h"
 #include "components/safe_browsing/buildflags.h"
 #include "net/base/mime_util.h"
-#include "net/url_request/url_request_status.h"
 #include "third_party/blink/public/common/mime_util/mime_util.h"
 #include "ui/base/l10n/l10n_util.h"
 #include "ui/base/l10n/time_format.h"
diff --git a/chrome/browser/enterprise/connectors/enterprise_connectors_policy_handler_unittest.cc b/chrome/browser/enterprise/connectors/enterprise_connectors_policy_handler_unittest.cc
index 1845c90..a01bc24 100644
--- a/chrome/browser/enterprise/connectors/enterprise_connectors_policy_handler_unittest.cc
+++ b/chrome/browser/enterprise/connectors/enterprise_connectors_policy_handler_unittest.cc
@@ -8,6 +8,7 @@
 #include <tuple>
 
 #include "base/json/json_reader.h"
+#include "base/optional.h"
 #include "base/values.h"
 #include "components/policy/core/browser/policy_error_map.h"
 #include "components/policy/core/common/policy_map.h"
@@ -87,9 +88,8 @@
             source() == policy::PolicySource::POLICY_SOURCE_PRIORITY_CLOUD);
   }
 
-  std::unique_ptr<base::Value> policy_value() const {
-    return base::Value::ToUniquePtrValue(
-        *base::JSONReader::Read(policy(), base::JSON_ALLOW_TRAILING_COMMAS));
+  base::Optional<base::Value> policy_value() const {
+    return base::JSONReader::Read(policy(), base::JSON_ALLOW_TRAILING_COMMAS);
   }
 };
 
diff --git a/chrome/browser/enterprise/reporting/profile_report_generator_unittest.cc b/chrome/browser/enterprise/reporting/profile_report_generator_unittest.cc
index 3b5cced..62d5b91 100644
--- a/chrome/browser/enterprise/reporting/profile_report_generator_unittest.cc
+++ b/chrome/browser/enterprise/reporting/profile_report_generator_unittest.cc
@@ -82,11 +82,10 @@
   void InitPolicyMap() {
     policy_map_.Set("kPolicyName1", policy::POLICY_LEVEL_MANDATORY,
                     policy::POLICY_SCOPE_USER, policy::POLICY_SOURCE_CLOUD,
-                    std::make_unique<base::Value>(std::vector<base::Value>()),
-                    nullptr);
+                    base::Value(std::vector<base::Value>()), nullptr);
     policy_map_.Set("kPolicyName2", policy::POLICY_LEVEL_RECOMMENDED,
                     policy::POLICY_SCOPE_MACHINE, policy::POLICY_SOURCE_MERGED,
-                    std::make_unique<base::Value>(true), nullptr);
+                    base::Value(true), nullptr);
   }
 
   std::unique_ptr<em::ChromeUserProfileInfo> GenerateReport(
diff --git a/chrome/browser/extensions/api/certificate_provider/certificate_provider_apitest.cc b/chrome/browser/extensions/api/certificate_provider/certificate_provider_apitest.cc
index faf607a..811c851 100644
--- a/chrome/browser/extensions/api/certificate_provider/certificate_provider_apitest.cc
+++ b/chrome/browser/extensions/api/certificate_provider/certificate_provider_apitest.cc
@@ -143,8 +143,8 @@
     // certificate selection dialog.
     const std::string autoselect_pattern = R"({"pattern": "*", "filter": {}})";
 
-    std::unique_ptr<base::ListValue> autoselect_policy(new base::ListValue);
-    autoselect_policy->AppendString(autoselect_pattern);
+    base::Value autoselect_policy(base::Value::Type::LIST);
+    autoselect_policy.Append(autoselect_pattern);
 
     policy::PolicyMap policy;
     policy.Set(policy::key::kAutoSelectCertificateForUrls,
diff --git a/chrome/browser/extensions/api/dashboard_private/dashboard_private_api.cc b/chrome/browser/extensions/api/dashboard_private/dashboard_private_api.cc
index b8d2c3b..a51bcdb 100644
--- a/chrome/browser/extensions/api/dashboard_private/dashboard_private_api.cc
+++ b/chrome/browser/extensions/api/dashboard_private/dashboard_private_api.cc
@@ -15,7 +15,6 @@
 #include "content/public/browser/storage_partition.h"
 #include "extensions/common/extension.h"
 #include "net/base/load_flags.h"
-#include "net/url_request/url_request.h"
 #include "url/gurl.h"
 
 namespace extensions {
diff --git a/chrome/browser/extensions/api/image_writer_private/write_from_url_operation.cc b/chrome/browser/extensions/api/image_writer_private/write_from_url_operation.cc
index 53e015b9..efcab34 100644
--- a/chrome/browser/extensions/api/image_writer_private/write_from_url_operation.cc
+++ b/chrome/browser/extensions/api/image_writer_private/write_from_url_operation.cc
@@ -10,7 +10,6 @@
 #include "content/public/browser/browser_thread.h"
 #include "mojo/public/cpp/bindings/remote.h"
 #include "net/traffic_annotation/network_traffic_annotation.h"
-#include "net/url_request/url_fetcher.h"
 #include "services/network/public/cpp/simple_url_loader.h"
 #include "services/network/public/mojom/url_loader_factory.mojom.h"
 #include "services/network/public/mojom/url_response_head.mojom.h"
diff --git a/chrome/browser/extensions/api/networking_private/networking_private_apitest.cc b/chrome/browser/extensions/api/networking_private/networking_private_apitest.cc
index 73919c3..4771cf6 100644
--- a/chrome/browser/extensions/api/networking_private/networking_private_apitest.cc
+++ b/chrome/browser/extensions/api/networking_private/networking_private_apitest.cc
@@ -50,15 +50,13 @@
 
   // Asynchronous methods
   void GetProperties(const std::string& guid,
-                     const DictionaryCallback& success_callback,
-                     const FailureCallback& failure_callback) override {
-    DictionaryResult(guid, success_callback, failure_callback);
+                     PropertiesCallback callback) override {
+    ValueResult(guid, std::move(callback));
   }
 
   void GetManagedProperties(const std::string& guid,
-                            const DictionaryCallback& success_callback,
-                            const FailureCallback& failure_callback) override {
-    DictionaryResult(guid, success_callback, failure_callback);
+                            PropertiesCallback callback) override {
+    ValueResult(guid, std::move(callback));
   }
 
   void GetState(const std::string& guid,
@@ -252,6 +250,18 @@
     }
   }
 
+  void ValueResult(const std::string& guid, PropertiesCallback callback) {
+    if (fail_) {
+      std::move(callback).Run(base::nullopt, kFailure);
+      return;
+    }
+    base::Value result(base::Value::Type::DICTIONARY);
+    result.SetStringKey(::onc::network_config::kGUID, guid);
+    result.SetStringKey(::onc::network_config::kType,
+                        ::onc::network_config::kWiFi);
+    std::move(callback).Run(std::move(result), base::nullopt);
+  }
+
  private:
   bool fail_;
   std::map<std::string, bool> enabled_;
diff --git a/chrome/browser/extensions/api/networking_private/networking_private_chromeos_apitest.cc b/chrome/browser/extensions/api/networking_private/networking_private_chromeos_apitest.cc
index 93e1ae6..349d244 100644
--- a/chrome/browser/extensions/api/networking_private/networking_private_chromeos_apitest.cc
+++ b/chrome/browser/extensions/api/networking_private/networking_private_chromeos_apitest.cc
@@ -670,8 +670,8 @@
   policy::PolicyMap policy;
   policy.Set(policy::key::kOpenNetworkConfiguration,
              policy::POLICY_LEVEL_MANDATORY, policy::POLICY_SCOPE_USER,
-             policy::POLICY_SOURCE_CLOUD,
-             std::make_unique<base::Value>(kUserPolicyBlob), nullptr);
+             policy::POLICY_SOURCE_CLOUD, base::Value(kUserPolicyBlob),
+             nullptr);
   provider_.UpdateChromePolicy(policy);
 
   content::RunAllPendingInMessageLoop();
@@ -705,8 +705,8 @@
   policy::PolicyMap policy;
   policy.Set(policy::key::kOpenNetworkConfiguration,
              policy::POLICY_LEVEL_MANDATORY, policy::POLICY_SCOPE_USER,
-             policy::POLICY_SOURCE_CLOUD,
-             std::make_unique<base::Value>(kUserPolicyBlob), nullptr);
+             policy::POLICY_SOURCE_CLOUD, base::Value(kUserPolicyBlob),
+             nullptr);
   provider_.UpdateChromePolicy(policy);
 
   content::RunAllPendingInMessageLoop();
@@ -754,8 +754,8 @@
   policy::PolicyMap policy;
   policy.Set(policy::key::kOpenNetworkConfiguration,
              policy::POLICY_LEVEL_MANDATORY, policy::POLICY_SCOPE_USER,
-             policy::POLICY_SOURCE_CLOUD,
-             std::make_unique<base::Value>(kUserPolicyBlob), nullptr);
+             policy::POLICY_SOURCE_CLOUD, base::Value(kUserPolicyBlob),
+             nullptr);
   provider_.UpdateChromePolicy(policy);
 
   content::RunAllPendingInMessageLoop();
diff --git a/chrome/browser/extensions/api/platform_keys/platform_keys_apitest_nss.cc b/chrome/browser/extensions/api/platform_keys/platform_keys_apitest_nss.cc
index c5b7309..0f82a4d 100644
--- a/chrome/browser/extensions/api/platform_keys/platform_keys_apitest_nss.cc
+++ b/chrome/browser/extensions/api/platform_keys/platform_keys_apitest_nss.cc
@@ -89,14 +89,12 @@
 
     // Set up the test policy that gives |extension_| the permission to access
     // corporate keys.
-    std::unique_ptr<base::DictionaryValue> key_permissions_policy =
-        std::make_unique<base::DictionaryValue>();
+    base::Value key_permissions_policy(base::Value::Type::DICTIONARY);
     {
-      std::unique_ptr<base::DictionaryValue> cert1_key_permission(
-          new base::DictionaryValue);
-      cert1_key_permission->SetKey("allowCorporateKeyUsage", base::Value(true));
-      key_permissions_policy->SetWithoutPathExpansion(
-          extension_->id(), std::move(cert1_key_permission));
+      base::Value cert1_key_permission(base::Value::Type::DICTIONARY);
+      cert1_key_permission.SetKey("allowCorporateKeyUsage", base::Value(true));
+      key_permissions_policy.SetKey(extension_->id(),
+                                    std::move(cert1_key_permission));
     }
 
     policy.Set(policy::key::kKeyPermissions, policy::POLICY_LEVEL_MANDATORY,
diff --git a/chrome/browser/extensions/api/safe_browsing_private/safe_browsing_private_api_unittest.cc b/chrome/browser/extensions/api/safe_browsing_private/safe_browsing_private_api_unittest.cc
index dcb7e10..a04813a 100644
--- a/chrome/browser/extensions/api/safe_browsing_private/safe_browsing_private_api_unittest.cc
+++ b/chrome/browser/extensions/api/safe_browsing_private/safe_browsing_private_api_unittest.cc
@@ -27,8 +27,6 @@
 #include "content/public/browser/navigation_entry.h"
 #include "content/public/test/browser_task_environment.h"
 #include "content/public/test/web_contents_tester.h"
-#include "net/url_request/url_request_context_getter.h"
-#include "net/url_request/url_request_test_util.h"
 
 namespace extensions {
 
diff --git a/chrome/browser/extensions/api/web_request/web_request_apitest.cc b/chrome/browser/extensions/api/web_request/web_request_apitest.cc
index ed98786..ef09e1289 100644
--- a/chrome/browser/extensions/api/web_request/web_request_apitest.cc
+++ b/chrome/browser/extensions/api/web_request/web_request_apitest.cc
@@ -109,10 +109,7 @@
 #include "net/test/embedded_test_server/http_response.h"
 #include "net/test/embedded_test_server/request_handler_util.h"
 #include "net/test/test_data_directory.h"
-#include "net/test/url_request/url_request_mock_http_job.h"
 #include "net/traffic_annotation/network_traffic_annotation_test_helper.h"
-#include "net/url_request/url_request_filter.h"
-#include "net/url_request/url_request_interceptor.h"
 #include "services/network/public/cpp/features.h"
 #include "services/network/public/cpp/resource_request.h"
 #include "services/network/public/cpp/simple_url_loader.h"
@@ -665,8 +662,7 @@
         feature_list_.InitWithFeatures(
             {network::features::kOutOfBlinkCors},
             {features::kHideCorsLegacyModeEnabledPolicySupport});
-        UpdatePolicy(policy::key::kCorsLegacyModeEnabled,
-                     std::make_unique<base::Value>(true));
+        UpdatePolicy(policy::key::kCorsLegacyModeEnabled, base::Value(true));
         test_name_ += "?cors_mode=blink";
         break;
       case ExtraHeadersRequirementMode::kEnabledWithCorsMitigationListPolicy:
@@ -674,7 +670,7 @@
             {network::features::kOutOfBlinkCors},
             {features::kHideCorsMitigationListPolicySupport});
         UpdatePolicy(policy::key::kCorsMitigationList,
-                     std::make_unique<base::ListValue>());
+                     base::Value(base::Value::Type::LIST));
         test_name_ += "?cors_mode=network_service&with_force_extra_headers";
         break;
       case ExtraHeadersRequirementMode::
@@ -683,8 +679,7 @@
             {features::kHideCorsLegacyModeEnabledPolicySupport,
              network::features::kOutOfBlinkCors},
             {});
-        UpdatePolicy(policy::key::kCorsLegacyModeEnabled,
-                     std::make_unique<base::Value>(true));
+        UpdatePolicy(policy::key::kCorsLegacyModeEnabled, base::Value(true));
         test_name_ += "?cors_mode=network_service";
         break;
       case ExtraHeadersRequirementMode::
@@ -694,7 +689,7 @@
              network::features::kOutOfBlinkCors},
             {});
         UpdatePolicy(policy::key::kCorsMitigationList,
-                     std::make_unique<base::ListValue>());
+                     base::Value(base::Value::Type::LIST));
         test_name_ += "?cors_mode=network_service";
         break;
     }
@@ -702,8 +697,7 @@
     ExtensionWebRequestApiTest::SetUpInProcessBrowserTestFixture();
   }
 
-  void UpdatePolicy(const std::string& policy,
-                    std::unique_ptr<base::Value> value) {
+  void UpdatePolicy(const std::string& policy, base::Value value) {
     policy::PolicyMap policy_map;
     policy_map.Set(policy, policy::POLICY_LEVEL_MANDATORY,
                    policy::POLICY_SCOPE_USER, policy::POLICY_SOURCE_CLOUD,
diff --git a/chrome/browser/extensions/api/webrtc_logging_private/webrtc_logging_private_apitest.cc b/chrome/browser/extensions/api/webrtc_logging_private/webrtc_logging_private_apitest.cc
index 00dd743..25c6edd 100644
--- a/chrome/browser/extensions/api/webrtc_logging_private/webrtc_logging_private_apitest.cc
+++ b/chrome/browser/extensions/api/webrtc_logging_private/webrtc_logging_private_apitest.cc
@@ -704,8 +704,7 @@
     values.Set(policy::key::kWebRtcEventLogCollectionAllowed,
                policy::POLICY_LEVEL_MANDATORY, policy::POLICY_SCOPE_USER,
                policy::POLICY_SOURCE_ENTERPRISE_DEFAULT,
-               std::make_unique<base::Value>(WebRtcEventLogCollectionPolicy()),
-               nullptr);
+               base::Value(WebRtcEventLogCollectionPolicy()), nullptr);
 
     provider_.UpdateChromePolicy(values);
   }
diff --git a/chrome/browser/extensions/api/webstore_private/webstore_private_api.cc b/chrome/browser/extensions/api/webstore_private/webstore_private_api.cc
index b1adcbb..a155246e 100644
--- a/chrome/browser/extensions/api/webstore_private/webstore_private_api.cc
+++ b/chrome/browser/extensions/api/webstore_private/webstore_private_api.cc
@@ -54,7 +54,6 @@
 #include "extensions/common/manifest_handlers/permissions_parser.h"
 #include "extensions/common/permissions/permission_set.h"
 #include "net/base/load_flags.h"
-#include "net/url_request/url_request.h"
 #include "ui/base/l10n/l10n_util.h"
 #include "url/gurl.h"
 
diff --git a/chrome/browser/extensions/data_deleter.cc b/chrome/browser/extensions/data_deleter.cc
index 1a0d7db..419f5419 100644
--- a/chrome/browser/extensions/data_deleter.cc
+++ b/chrome/browser/extensions/data_deleter.cc
@@ -27,8 +27,6 @@
 #include "extensions/common/constants.h"
 #include "extensions/common/extension.h"
 #include "extensions/common/manifest_handlers/app_isolation_info.h"
-#include "net/url_request/url_request_context.h"
-#include "net/url_request/url_request_context_getter.h"
 
 using base::WeakPtr;
 using content::BrowserContext;
diff --git a/chrome/browser/extensions/extension_assets_manager_chromeos.cc b/chrome/browser/extensions/extension_assets_manager_chromeos.cc
index 53bff26..22348c0 100644
--- a/chrome/browser/extensions/extension_assets_manager_chromeos.cc
+++ b/chrome/browser/extensions/extension_assets_manager_chromeos.cc
@@ -233,7 +233,7 @@
       return false;
     }
     if (extension_info->empty())
-      shared_extensions->RemoveWithoutPathExpansion(*it, NULL);
+      shared_extensions->RemoveKey(*it);
   }
 
   return true;
@@ -467,11 +467,11 @@
           FROM_HERE,
           base::BindOnce(&ExtensionAssetsManagerChromeOS::DeleteSharedVersion,
                          base::FilePath(shared_path)));
-      extension_info->RemoveWithoutPathExpansion(*it, NULL);
+      extension_info->RemoveKey(*it);
     }
   }
   if (extension_info->empty()) {
-    shared_extensions->RemoveWithoutPathExpansion(id, NULL);
+    shared_extensions->RemoveKey(id);
     // Don't remove extension dir in shared location. It will be removed by GC
     // when it is safe to do so, and this avoids a race condition between
     // concurrent uninstall by one user and install by another.
@@ -559,7 +559,7 @@
       live_extension_paths->insert(
           std::make_pair(id, base::FilePath(shared_path)));
     } else {
-      extension_info->RemoveWithoutPathExpansion(*it, NULL);
+      extension_info->RemoveKey(*it);
     }
   }
 
diff --git a/chrome/browser/extensions/extension_management_test_util.cc b/chrome/browser/extensions/extension_management_test_util.cc
index 5fe15fd..41c2a955 100644
--- a/chrome/browser/extensions/extension_management_test_util.cc
+++ b/chrome/browser/extensions/extension_management_test_util.cc
@@ -46,7 +46,7 @@
 void ExtensionManagementPrefUpdaterBase::UnsetPerExtensionSettings(
     const ExtensionId& id) {
   DCHECK(crx_file::id_util::IdIsValid(id));
-  pref_->RemoveWithoutPathExpansion(id, nullptr);
+  pref_->RemoveKey(id);
 }
 
 void ExtensionManagementPrefUpdaterBase::ClearPerExtensionSettings(
diff --git a/chrome/browser/extensions/extension_service_unittest.cc b/chrome/browser/extensions/extension_service_unittest.cc
index 3ad154f6..60c58bc 100644
--- a/chrome/browser/extensions/extension_service_unittest.cc
+++ b/chrome/browser/extensions/extension_service_unittest.cc
@@ -145,8 +145,6 @@
 #include "net/cookies/cookie_options.h"
 #include "net/cookies/cookie_store.h"
 #include "net/cookies/cookie_util.h"
-#include "net/url_request/url_request_context.h"
-#include "net/url_request/url_request_context_getter.h"
 #include "ppapi/buildflags/buildflags.h"
 #include "services/network/public/mojom/cookie_manager.mojom.h"
 #include "services/network/public/mojom/network_service.mojom.h"
diff --git a/chrome/browser/extensions/policy_test_utils.cc b/chrome/browser/extensions/policy_test_utils.cc
index 5bf5668e4..11b5f1b 100644
--- a/chrome/browser/extensions/policy_test_utils.cc
+++ b/chrome/browser/extensions/policy_test_utils.cc
@@ -76,8 +76,7 @@
   policy::PolicyMap policy;
   policy.Set(policy::key::kExtensionInstallForcelist,
              policy::POLICY_LEVEL_MANDATORY, policy::POLICY_SCOPE_MACHINE,
-             policy::POLICY_SOURCE_CLOUD,
-             base::Value::ToUniquePtrValue(std::move(forcelist)), nullptr);
+             policy::POLICY_SOURCE_CLOUD, std::move(forcelist), nullptr);
 
   // Set the policy and wait until the extension is installed.
   extensions::TestExtensionRegistryObserver observer(
diff --git a/chrome/browser/extensions/webstore_data_fetcher.cc b/chrome/browser/extensions/webstore_data_fetcher.cc
index d1e568e..13f5854 100644
--- a/chrome/browser/extensions/webstore_data_fetcher.cc
+++ b/chrome/browser/extensions/webstore_data_fetcher.cc
@@ -17,8 +17,6 @@
 #include "extensions/common/extension_urls.h"
 #include "net/base/load_flags.h"
 #include "net/traffic_annotation/network_traffic_annotation.h"
-#include "net/url_request/url_fetcher.h"
-#include "net/url_request/url_request_status.h"
 #include "services/network/public/cpp/resource_request.h"
 #include "services/network/public/cpp/simple_url_loader.h"
 #include "services/network/public/mojom/url_loader_factory.mojom.h"
diff --git a/chrome/browser/extensions/webstore_install_helper.cc b/chrome/browser/extensions/webstore_install_helper.cc
index b3ae28b..21a1a67 100644
--- a/chrome/browser/extensions/webstore_install_helper.cc
+++ b/chrome/browser/extensions/webstore_install_helper.cc
@@ -10,7 +10,7 @@
 #include "content/public/browser/browser_thread.h"
 #include "net/base/load_flags.h"
 #include "net/traffic_annotation/network_traffic_annotation.h"
-#include "net/url_request/url_request.h"
+#include "net/url_request/referrer_policy.h"
 
 using content::BrowserThread;
 
@@ -80,7 +80,7 @@
     icon_fetcher_.reset(new BitmapFetcher(icon_url_, this, traffic_annotation));
     icon_fetcher_->Init(
         std::string(),
-        net::URLRequest::REDUCE_REFERRER_GRANULARITY_ON_TRANSITION_CROSS_ORIGIN,
+        net::ReferrerPolicy::REDUCE_GRANULARITY_ON_TRANSITION_CROSS_ORIGIN,
         network::mojom::CredentialsMode::kOmit);
     icon_fetcher_->Start(loader_factory);
   }
diff --git a/chrome/browser/extensions/webstore_standalone_installer.h b/chrome/browser/extensions/webstore_standalone_installer.h
index 52f4c59..b70309d 100644
--- a/chrome/browser/extensions/webstore_standalone_installer.h
+++ b/chrome/browser/extensions/webstore_standalone_installer.h
@@ -17,7 +17,6 @@
 #include "chrome/browser/extensions/webstore_install_helper.h"
 #include "chrome/browser/extensions/webstore_installer.h"
 #include "chrome/common/extensions/webstore_install_result.h"
-#include "net/url_request/url_fetcher_delegate.h"
 #include "third_party/skia/include/core/SkBitmap.h"
 
 namespace base {
diff --git a/chrome/browser/flag-metadata.json b/chrome/browser/flag-metadata.json
index bdb9fe2..bd595f1 100644
--- a/chrome/browser/flag-metadata.json
+++ b/chrome/browser/flag-metadata.json
@@ -2439,7 +2439,7 @@
   {
     "name": "force-color-profile",
     "owners": [ "ccameron" ],
-    "expiry_milestone": 81
+    "expiry_milestone": 89
   },
   {
     "name": "force-effective-connection-type",
@@ -2653,7 +2653,12 @@
     "expiry_milestone": 86
   },
   {
-    "name": "ignore-gpu-blacklist",
+    "name": "http-auth-committed-interstitials",
+    "owners": [ "jdeblasio", "estark" ],
+    "expiry_milestone": 77
+  },
+  {
+    "name": "ignore-gpu-blocklist",
     "owners": [ "kbr", "zmo" ],
     // A debugging flag intended for end-users where there may not be any other
     // way to turn off graphics features.
diff --git a/chrome/browser/flag-never-expire-list.json b/chrome/browser/flag-never-expire-list.json
index bf3cd27..1f476ec0 100644
--- a/chrome/browser/flag-never-expire-list.json
+++ b/chrome/browser/flag-never-expire-list.json
@@ -65,7 +65,7 @@
   "force-update-menu-type",
   "fullscreen-viewport-adjustment-experiment",
   "gesture-properties-dbus-service",
-  "ignore-gpu-blacklist",
+  "ignore-gpu-blocklist",
   "ignore-previews-blocklist",
   "in-product-help-demo-mode-choice",
   "instant-tethering",
diff --git a/chrome/browser/flag_descriptions.cc b/chrome/browser/flag_descriptions.cc
index 26f606f8..74da40a 100644
--- a/chrome/browser/flag_descriptions.cc
+++ b/chrome/browser/flag_descriptions.cc
@@ -1225,8 +1225,8 @@
 const char kHostedAppShimCreationDescription[] =
     "Create app shims on Mac when creating a hosted app.";
 
-const char kIgnoreGpuBlacklistName[] = "Override software rendering list";
-const char kIgnoreGpuBlacklistDescription[] =
+const char kIgnoreGpuBlocklistName[] = "Override software rendering list";
+const char kIgnoreGpuBlocklistDescription[] =
     "Overrides the built-in software rendering list and enables "
     "GPU-acceleration on unsupported system configurations.";
 
diff --git a/chrome/browser/flag_descriptions.h b/chrome/browser/flag_descriptions.h
index b12f41c..859a186 100644
--- a/chrome/browser/flag_descriptions.h
+++ b/chrome/browser/flag_descriptions.h
@@ -715,8 +715,8 @@
 extern const char kHostedAppShimCreationName[];
 extern const char kHostedAppShimCreationDescription[];
 
-extern const char kIgnoreGpuBlacklistName[];
-extern const char kIgnoreGpuBlacklistDescription[];
+extern const char kIgnoreGpuBlocklistName[];
+extern const char kIgnoreGpuBlocklistDescription[];
 
 extern const char kIgnorePreviewsBlocklistName[];
 extern const char kIgnorePreviewsBlocklistDescription[];
diff --git a/chrome/browser/installable/digital_asset_links/digital_asset_links_handler_unittest.cc b/chrome/browser/installable/digital_asset_links/digital_asset_links_handler_unittest.cc
index b120c01..1495e66b 100644
--- a/chrome/browser/installable/digital_asset_links/digital_asset_links_handler_unittest.cc
+++ b/chrome/browser/installable/digital_asset_links/digital_asset_links_handler_unittest.cc
@@ -14,7 +14,6 @@
 #include "content/public/test/browser_task_environment.h"
 #include "net/base/net_errors.h"
 #include "net/http/http_status_code.h"
-#include "net/url_request/url_request_status.h"
 #include "services/data_decoder/public/cpp/test_support/in_process_data_decoder.h"
 #include "services/network/public/cpp/weak_wrapper_shared_url_loader_factory.h"
 #include "services/network/test/test_url_loader_factory.h"
diff --git a/chrome/browser/invalidation/profile_invalidation_provider_factory.cc b/chrome/browser/invalidation/profile_invalidation_provider_factory.cc
index d4d8440..f5baecc 100644
--- a/chrome/browser/invalidation/profile_invalidation_provider_factory.cc
+++ b/chrome/browser/invalidation/profile_invalidation_provider_factory.cc
@@ -29,7 +29,6 @@
 #include "components/pref_registry/pref_registry_syncable.h"
 #include "components/prefs/pref_registry.h"
 #include "content/public/browser/storage_partition.h"
-#include "net/url_request/url_request_context_getter.h"
 #include "services/network/public/cpp/shared_url_loader_factory.h"
 
 #if defined(OS_CHROMEOS)
diff --git a/chrome/browser/loader/signed_exchange_policy_browsertest.cc b/chrome/browser/loader/signed_exchange_policy_browsertest.cc
index 5a5d2ea..08bf3af7 100644
--- a/chrome/browser/loader/signed_exchange_policy_browsertest.cc
+++ b/chrome/browser/loader/signed_exchange_policy_browsertest.cc
@@ -72,7 +72,7 @@
   policy::PolicyMap policies;
   policies.Set(policy::key::kURLBlacklist, policy::POLICY_LEVEL_MANDATORY,
                policy::POLICY_SCOPE_USER, policy::POLICY_SOURCE_CLOUD,
-               blacklist.CreateDeepCopy(), nullptr);
+               blacklist.Clone(), nullptr);
 
 #if defined(OS_CHROMEOS)
   policy::SetEnterpriseUsersDefaults(&policies);
diff --git a/chrome/browser/media/history/media_history_store.cc b/chrome/browser/media/history/media_history_store.cc
index 5e3f656a..6acbf7a 100644
--- a/chrome/browser/media/history/media_history_store.cc
+++ b/chrome/browser/media/history/media_history_store.cc
@@ -174,6 +174,8 @@
     scoped_refptr<base::UpdateableSequencedTaskRunner> db_task_runner)
     : db_task_runner_(db_task_runner),
       db_path_(GetDBPath(profile)),
+      db_(std::make_unique<sql::Database>()),
+      meta_table_(std::make_unique<sql::MetaTable>()),
       origin_table_(new MediaHistoryOriginTable(db_task_runner_)),
       playback_table_(new MediaHistoryPlaybackTable(db_task_runner_)),
       session_table_(new MediaHistorySessionTable(db_task_runner_)),
@@ -186,7 +188,14 @@
       feed_items_table_(IsMediaFeedsEnabled()
                             ? new MediaHistoryFeedItemsTable(db_task_runner_)
                             : nullptr),
-      initialization_successful_(false) {}
+      initialization_successful_(false) {
+  db_->set_histogram_tag("MediaHistory");
+  db_->set_exclusive_locking();
+
+  // To recover from corruption.
+  db_->set_error_callback(
+      base::BindRepeating(&DatabaseErrorCallback, db_.get(), db_path_));
+}
 
 MediaHistoryStore::~MediaHistoryStore() {
   // The connection pointer needs to be deleted on the DB sequence since there
@@ -304,16 +313,6 @@
 MediaHistoryStore::InitResult MediaHistoryStore::InitializeInternal() {
   DCHECK(db_task_runner_->RunsTasksInCurrentSequence());
 
-  db_ = std::make_unique<sql::Database>();
-  db_->set_histogram_tag("MediaHistory");
-  db_->set_exclusive_locking();
-
-  // To recover from corruption.
-  db_->set_error_callback(
-      base::BindRepeating(&DatabaseErrorCallback, db_.get(), db_path_));
-
-  meta_table_ = std::make_unique<sql::MetaTable>();
-
   if (db_path_.empty()) {
     if (IsCancelled() || !db_ || !db_->OpenInMemory()) {
       LOG(ERROR) << "Failed to open the in-memory database.";
@@ -336,8 +335,6 @@
     }
   }
 
-  db_->Preload();
-
   if (IsCancelled() || !db_ || !db_->Execute("PRAGMA foreign_keys=1")) {
     LOG(ERROR) << "Failed to enable foreign keys on the media history store.";
 
diff --git a/chrome/browser/media/history/media_history_store_unittest.cc b/chrome/browser/media/history/media_history_store_unittest.cc
index 3eaf0f6..c546b4c 100644
--- a/chrome/browser/media/history/media_history_store_unittest.cc
+++ b/chrome/browser/media/history/media_history_store_unittest.cc
@@ -286,13 +286,7 @@
                     TestState::kIncognito,
                     TestState::kSavingBrowserHistoryDisabled));
 
-// TODO(crbug.com/1087974).
-#if defined(THREAD_SANITIZER)
-#define MAYBE_SavePlayback DISABLED_SavePlayback
-#else
-#define MAYBE_SavePlayback SavePlayback
-#endif
-TEST_P(MediaHistoryStoreUnitTest, MAYBE_SavePlayback) {
+TEST_P(MediaHistoryStoreUnitTest, SavePlayback) {
   base::HistogramTester histogram_tester;
 
   const auto now_before =
@@ -360,13 +354,7 @@
       MediaHistoryStore::PlaybackWriteResult::kSuccess, IsReadOnly() ? 0 : 2);
 }
 
-// TODO(crbug.com/1087974).
-#if defined(THREAD_SANITIZER)
-#define MAYBE_SavePlayback_BadOrigin DISABLED_SavePlayback_BadOrigin
-#else
-#define MAYBE_SavePlayback_BadOrigin SavePlayback_BadOrigin
-#endif
-TEST_P(MediaHistoryStoreUnitTest, MAYBE_SavePlayback_BadOrigin) {
+TEST_P(MediaHistoryStoreUnitTest, SavePlayback_BadOrigin) {
   GURL url("http://google.com/test");
   GURL url2("http://google.co.uk/test");
   content::MediaPlayerWatchTime watch_time(url, url2.GetOrigin(),
@@ -382,13 +370,7 @@
   EXPECT_TRUE(origins.empty());
 }
 
-// TODO(crbug.com/1087974).
-#if defined(THREAD_SANITIZER)
-#define MAYBE_GetStats DISABLED_GetStats
-#else
-#define MAYBE_GetStats GetStats
-#endif
-TEST_P(MediaHistoryStoreUnitTest, MAYBE_GetStats) {
+TEST_P(MediaHistoryStoreUnitTest, GetStats) {
   {
     // Check all the tables are empty.
     mojom::MediaHistoryStatsPtr stats = GetStatsSync(service());
@@ -448,13 +430,7 @@
   }
 }
 
-// TODO(crbug.com/1087974).
-#if defined(THREAD_SANITIZER)
-#define MAYBE_UrlShouldBeUniqueForSessions DISABLED_UrlShouldBeUniqueForSessions
-#else
-#define MAYBE_UrlShouldBeUniqueForSessions UrlShouldBeUniqueForSessions
-#endif
-TEST_P(MediaHistoryStoreUnitTest, MAYBE_UrlShouldBeUniqueForSessions) {
+TEST_P(MediaHistoryStoreUnitTest, UrlShouldBeUniqueForSessions) {
   base::HistogramTester histogram_tester;
 
   GURL url_a("https://www.google.com");
@@ -528,16 +504,7 @@
       MediaHistoryStore::SessionWriteResult::kSuccess, IsReadOnly() ? 0 : 3);
 }
 
-// TODO(crbug.com/1087974).
-#if defined(THREAD_SANITIZER)
-#define MAYBE_SavePlayback_IncrementAggregateWatchtime \
-  DISABLED_SavePlayback_IncrementAggregateWatchtime
-#else
-#define MAYBE_SavePlayback_IncrementAggregateWatchtime \
-  SavePlayback_IncrementAggregateWatchtime
-#endif
-TEST_P(MediaHistoryStoreUnitTest,
-       MAYBE_SavePlayback_IncrementAggregateWatchtime) {
+TEST_P(MediaHistoryStoreUnitTest, SavePlayback_IncrementAggregateWatchtime) {
   GURL url("http://google.com/test");
   GURL url_alt("http://example.org/test");
 
@@ -643,13 +610,7 @@
   EXPECT_EQ(origins, GetOriginRowsSync(otr_service()));
 }
 
-// TODO(crbug.com/1087974).
-#if defined(THREAD_SANITIZER)
-#define MAYBE_GetOriginsWithHighWatchTime DISABLED_GetOriginsWithHighWatchTime
-#else
-#define MAYBE_GetOriginsWithHighWatchTime GetOriginsWithHighWatchTime
-#endif
-TEST_P(MediaHistoryStoreUnitTest, MAYBE_GetOriginsWithHighWatchTime) {
+TEST_P(MediaHistoryStoreUnitTest, GetOriginsWithHighWatchTime) {
   const GURL url("http://google.com/test");
   const GURL url_alt("http://example.org/test");
   const base::TimeDelta min_watch_time = base::TimeDelta::FromMinutes(30);
@@ -994,13 +955,7 @@
                          testing::Values(TestState::kNormal,
                                          TestState::kIncognito));
 
-// TODO(crbug.com/1087974).
-#if defined(THREAD_SANITIZER)
-#define MAYBE_DiscoverMediaFeed DISABLED_DiscoverMediaFeed
-#else
-#define MAYBE_DiscoverMediaFeed DiscoverMediaFeed
-#endif
-TEST_P(MediaHistoryStoreFeedsTest, MAYBE_DiscoverMediaFeed) {
+TEST_P(MediaHistoryStoreFeedsTest, DiscoverMediaFeed) {
   GURL url_a("https://www.google.com/feed");
   GURL url_b("https://www.google.co.uk/feed");
   GURL url_c("https://www.google.com/feed2");
@@ -1067,13 +1022,7 @@
   }
 }
 
-// TODO(crbug.com/1087974).
-#if defined(THREAD_SANITIZER)
-#define MAYBE_StoreMediaFeedFetchResult DISABLED_StoreMediaFeedFetchResult
-#else
-#define MAYBE_StoreMediaFeedFetchResult StoreMediaFeedFetchResult
-#endif
-TEST_P(MediaHistoryStoreFeedsTest, MAYBE_StoreMediaFeedFetchResult) {
+TEST_P(MediaHistoryStoreFeedsTest, StoreMediaFeedFetchResult) {
   const GURL feed_url("https://www.google.com/feed");
   DiscoverMediaFeed(feed_url);
   WaitForDB();
@@ -1228,15 +1177,7 @@
   }
 }
 
-// TODO(crbug.com/1087974).
-#if defined(THREAD_SANITIZER)
-#define MAYBE_StoreMediaFeedFetchResult_WithEmpty \
-  DISABLED_StoreMediaFeedFetchResult_WithEmpty
-#else
-#define MAYBE_StoreMediaFeedFetchResult_WithEmpty \
-  StoreMediaFeedFetchResult_WithEmpty
-#endif
-TEST_P(MediaHistoryStoreFeedsTest, MAYBE_StoreMediaFeedFetchResult_WithEmpty) {
+TEST_P(MediaHistoryStoreFeedsTest, StoreMediaFeedFetchResult_WithEmpty) {
   DiscoverMediaFeed(GURL("https://www.google.com/feed"));
   WaitForDB();
 
@@ -1280,16 +1221,7 @@
   }
 }
 
-// TODO(crbug.com/1087974).
-#if defined(THREAD_SANITIZER)
-#define MAYBE_StoreMediaFeedFetchResult_MultipleFeeds \
-  DISABLED_StoreMediaFeedFetchResult_MultipleFeeds
-#else
-#define MAYBE_StoreMediaFeedFetchResult_MultipleFeeds \
-  StoreMediaFeedFetchResult_MultipleFeeds
-#endif
-TEST_P(MediaHistoryStoreFeedsTest,
-       MAYBE_StoreMediaFeedFetchResult_MultipleFeeds) {
+TEST_P(MediaHistoryStoreFeedsTest, StoreMediaFeedFetchResult_MultipleFeeds) {
   const GURL feed_a_url("https://www.google.com/feed");
   const GURL feed_b_url("https://www.google.co.uk/feed");
 
@@ -1367,13 +1299,7 @@
   }
 }
 
-// TODO(crbug.com/1087974).
-#if defined(THREAD_SANITIZER)
-#define MAYBE_RediscoverMediaFeed DISABLED_RediscoverMediaFeed
-#else
-#define MAYBE_RediscoverMediaFeed RediscoverMediaFeed
-#endif
-TEST_P(MediaHistoryStoreFeedsTest, MAYBE_RediscoverMediaFeed) {
+TEST_P(MediaHistoryStoreFeedsTest, RediscoverMediaFeed) {
   GURL feed_url("https://www.google.com/feed");
   DiscoverMediaFeed(feed_url);
   WaitForDB();
@@ -1466,16 +1392,7 @@
   }
 }
 
-// TODO(crbug.com/1087974).
-#if defined(THREAD_SANITIZER)
-#define MAYBE_StoreMediaFeedFetchResult_IncreaseFailed \
-  DISABLED_StoreMediaFeedFetchResult_IncreaseFailed
-#else
-#define MAYBE_StoreMediaFeedFetchResult_IncreaseFailed \
-  StoreMediaFeedFetchResult_IncreaseFailed
-#endif
-TEST_P(MediaHistoryStoreFeedsTest,
-       MAYBE_StoreMediaFeedFetchResult_IncreaseFailed) {
+TEST_P(MediaHistoryStoreFeedsTest, StoreMediaFeedFetchResult_IncreaseFailed) {
   DiscoverMediaFeed(GURL("https://www.google.com/feed"));
   WaitForDB();
 
@@ -1558,16 +1475,7 @@
   }
 }
 
-// TODO(crbug.com/1087974).
-#if defined(THREAD_SANITIZER)
-#define MAYBE_StoreMediaFeedFetchResult_CheckLogoMax \
-  DISABLED_StoreMediaFeedFetchResult_CheckLogoMax
-#else
-#define MAYBE_StoreMediaFeedFetchResult_CheckLogoMax \
-  StoreMediaFeedFetchResult_CheckLogoMax
-#endif
-TEST_P(MediaHistoryStoreFeedsTest,
-       MAYBE_StoreMediaFeedFetchResult_CheckLogoMax) {
+TEST_P(MediaHistoryStoreFeedsTest, StoreMediaFeedFetchResult_CheckLogoMax) {
   DiscoverMediaFeed(GURL("https://www.google.com/feed"));
   WaitForDB();
 
@@ -1644,16 +1552,7 @@
   }
 }
 
-// TODO(crbug.com/1087974).
-#if defined(THREAD_SANITIZER)
-#define MAYBE_StoreMediaFeedFetchResult_CheckImageMax \
-  DISABLED_StoreMediaFeedFetchResult_CheckImageMax
-#else
-#define MAYBE_StoreMediaFeedFetchResult_CheckImageMax \
-  StoreMediaFeedFetchResult_CheckImageMax
-#endif
-TEST_P(MediaHistoryStoreFeedsTest,
-       MAYBE_StoreMediaFeedFetchResult_CheckImageMax) {
+TEST_P(MediaHistoryStoreFeedsTest, StoreMediaFeedFetchResult_CheckImageMax) {
   DiscoverMediaFeed(GURL("https://www.google.com/feed"));
   WaitForDB();
 
@@ -1733,16 +1632,8 @@
   }
 }
 
-// TODO(crbug.com/1087974).
-#if defined(THREAD_SANITIZER)
-#define MAYBE_StoreMediaFeedFetchResult_DefaultSafeSearchResult \
-  DISABLED_StoreMediaFeedFetchResult_DefaultSafeSearchResult
-#else
-#define MAYBE_StoreMediaFeedFetchResult_DefaultSafeSearchResult \
-  StoreMediaFeedFetchResult_DefaultSafeSearchResult
-#endif
 TEST_P(MediaHistoryStoreFeedsTest,
-       MAYBE_StoreMediaFeedFetchResult_DefaultSafeSearchResult) {
+       StoreMediaFeedFetchResult_DefaultSafeSearchResult) {
   DiscoverMediaFeed(GURL("https://www.google.com/feed"));
   WaitForDB();
 
@@ -1780,13 +1671,7 @@
   }
 }
 
-// TODO(crbug.com/1087974).
-#if defined(THREAD_SANITIZER)
-#define MAYBE_SafeSearchCheck DISABLED_SafeSearchCheck
-#else
-#define MAYBE_SafeSearchCheck SafeSearchCheck
-#endif
-TEST_P(MediaHistoryStoreFeedsTest, MAYBE_SafeSearchCheck) {
+TEST_P(MediaHistoryStoreFeedsTest, SafeSearchCheck) {
   const GURL feed_url_a("https://www.google.com/feed");
   const GURL feed_url_b("https://www.google.co.uk/feed");
 
@@ -1913,16 +1798,7 @@
   }
 }
 
-// TODO(crbug.com/1087974).
-#if defined(THREAD_SANITIZER)
-#define MAYBE_GetMediaFeedsSortByWatchtimePercentile \
-  DISABLED_GetMediaFeedsSortByWatchtimePercentile
-#else
-#define MAYBE_GetMediaFeedsSortByWatchtimePercentile \
-  GetMediaFeedsSortByWatchtimePercentile
-#endif
-TEST_P(MediaHistoryStoreFeedsTest,
-       MAYBE_GetMediaFeedsSortByWatchtimePercentile) {
+TEST_P(MediaHistoryStoreFeedsTest, GetMediaFeedsSortByWatchtimePercentile) {
   // We add 111 origins with watchtime and feeds for all but one of these. Half
   // of the feeds will have items.
   const unsigned kNumberOfOrigins = 111;
@@ -2178,13 +2054,7 @@
   }
 }
 
-// TODO(crbug.com/1087974).
-#if defined(THREAD_SANITIZER)
-#define MAYBE_FeedItemsClickAndShown DISABLED_FeedItemsClickAndShown
-#else
-#define MAYBE_FeedItemsClickAndShown FeedItemsClickAndShown
-#endif
-TEST_P(MediaHistoryStoreFeedsTest, MAYBE_FeedItemsClickAndShown) {
+TEST_P(MediaHistoryStoreFeedsTest, FeedItemsClickAndShown) {
   DiscoverMediaFeed(GURL("https://www.google.com/feed"));
   WaitForDB();
 
@@ -2300,13 +2170,7 @@
   }
 }
 
-// TODO(crbug.com/1087974).
-#if defined(THREAD_SANITIZER)
-#define MAYBE_ResetMediaFeed DISABLED_ResetMediaFeed
-#else
-#define MAYBE_ResetMediaFeed ResetMediaFeed
-#endif
-TEST_P(MediaHistoryStoreFeedsTest, MAYBE_ResetMediaFeed) {
+TEST_P(MediaHistoryStoreFeedsTest, ResetMediaFeed) {
   const GURL feed_url_a("https://www.google.com/feed");
   const GURL feed_url_b("https://www.google.co.uk/feed");
 
@@ -2468,14 +2332,7 @@
   }
 }
 
-// TODO(crbug.com/1087974).
-#if defined(THREAD_SANITIZER)
-#define MAYBE_ResetMediaFeedDueToCacheClearing \
-  DISABLED_ResetMediaFeedDueToCacheClearing
-#else
-#define MAYBE_ResetMediaFeedDueToCacheClearing ResetMediaFeedDueToCacheClearing
-#endif
-TEST_P(MediaHistoryStoreFeedsTest, MAYBE_ResetMediaFeedDueToCacheClearing) {
+TEST_P(MediaHistoryStoreFeedsTest, ResetMediaFeedDueToCacheClearing) {
   const GURL feed_url_a("https://www.google.com/feed");
   const GURL feed_url_b("https://www.google.co.uk/feed");
 
@@ -2728,13 +2585,7 @@
   }
 }
 
-// TODO(crbug.com/1087974).
-#if defined(THREAD_SANITIZER)
-#define MAYBE_DeleteMediaFeed DISABLED_DeleteMediaFeed
-#else
-#define MAYBE_DeleteMediaFeed DeleteMediaFeed
-#endif
-TEST_P(MediaHistoryStoreFeedsTest, MAYBE_DeleteMediaFeed) {
+TEST_P(MediaHistoryStoreFeedsTest, DeleteMediaFeed) {
   DiscoverMediaFeed(GURL("https://www.google.com/feed"));
   DiscoverMediaFeed(GURL("https://www.google.co.uk/feed"));
   WaitForDB();
@@ -2805,13 +2656,7 @@
   }
 }
 
-// TODO(crbug.com/1087974).
-#if defined(THREAD_SANITIZER)
-#define MAYBE_GetMediaFeedFetchDetails DISABLED_GetMediaFeedFetchDetails
-#else
-#define MAYBE_GetMediaFeedFetchDetails GetMediaFeedFetchDetails
-#endif
-TEST_P(MediaHistoryStoreFeedsTest, MAYBE_GetMediaFeedFetchDetails) {
+TEST_P(MediaHistoryStoreFeedsTest, GetMediaFeedFetchDetails) {
   const GURL feed_url("https://www.google.com/feed");
 
   DiscoverMediaFeed(feed_url);
diff --git a/chrome/browser/media/router/providers/cast/cast_media_controller.cc b/chrome/browser/media/router/providers/cast/cast_media_controller.cc
index 761a038..c4dc60ab 100644
--- a/chrome/browser/media/router/providers/cast/cast_media_controller.cc
+++ b/chrome/browser/media/router/providers/cast/cast_media_controller.cc
@@ -56,7 +56,7 @@
 // If |value| has "width" and "height" fields with positive values, it gets
 // converted into gfx::Size. Otherwise base::nullopt is returned.
 base::Optional<gfx::Size> GetValidSize(const base::Value* value) {
-  if (!value)
+  if (!value || !value->is_dict())
     return base::nullopt;
   int width = 0;
   int height = 0;
@@ -216,6 +216,8 @@
   if (images && images->is_list()) {
     media_status_.images.clear();
     for (const base::Value& image_value : images->GetList()) {
+      if (!image_value.is_dict())
+        continue;
       const std::string* url_string = image_value.FindStringKey("url");
       if (!url_string)
         continue;
diff --git a/chrome/browser/media/router/providers/cast/cast_media_controller_unittest.cc b/chrome/browser/media/router/providers/cast/cast_media_controller_unittest.cc
index ce38f89..5d0ba94b 100644
--- a/chrome/browser/media/router/providers/cast/cast_media_controller_unittest.cc
+++ b/chrome/browser/media/router/providers/cast/cast_media_controller_unittest.cc
@@ -85,6 +85,26 @@
   return image_list;
 }
 
+Value CreateMediaStatus(const mojom::MediaStatus& status) {
+  Value status_value(Value::Type::DICTIONARY);
+  status_value.SetKey("mediaSessionId", Value(kMediaSessionId));
+  status_value.SetKey("media", Value(Value::Type::DICTIONARY));
+  status_value.SetPath("media.metadata", Value(Value::Type::DICTIONARY));
+  status_value.SetPath("media.metadata.title", Value(status.title));
+  status_value.SetPath("media.metadata.images",
+                       CreateImagesValue(status.images));
+  status_value.SetPath("media.duration", Value(status.duration.InSecondsF()));
+  status_value.SetPath("currentTime", Value(status.current_time.InSecondsF()));
+  status_value.SetPath("playerState", GetPlayerStateValue(status));
+  status_value.SetPath("supportedMediaCommands",
+                       GetSupportedMediaCommandsValue(status));
+  status_value.SetPath("volume", Value(Value::Type::DICTIONARY));
+  status_value.SetPath("volume.level", Value(status.volume));
+  status_value.SetPath("volume.muted", Value(status.is_muted));
+
+  return status_value;
+}
+
 mojom::MediaStatusPtr CreateSampleMediaStatus() {
   mojom::MediaStatusPtr status = mojom::MediaStatus::New();
   status->title = "media title";
@@ -158,27 +178,15 @@
   }
 
   void SetMediaStatus(const mojom::MediaStatus& status) {
-    Value status_value(Value::Type::DICTIONARY);
-    status_value.SetKey("mediaSessionId", Value(kMediaSessionId));
-    status_value.SetKey("media", Value(Value::Type::DICTIONARY));
-    status_value.SetPath("media.metadata", Value(Value::Type::DICTIONARY));
-    status_value.SetPath("media.metadata.title", Value(status.title));
-    status_value.SetPath("media.metadata.images",
-                         CreateImagesValue(status.images));
-    status_value.SetPath("media.duration", Value(status.duration.InSecondsF()));
-    status_value.SetPath("currentTime",
-                         Value(status.current_time.InSecondsF()));
-    status_value.SetPath("playerState", GetPlayerStateValue(status));
-    status_value.SetPath("supportedMediaCommands",
-                         GetSupportedMediaCommandsValue(status));
-    status_value.SetPath("volume", Value(Value::Type::DICTIONARY));
-    status_value.SetPath("volume.level", Value(status.volume));
-    status_value.SetPath("volume.muted", Value(status.is_muted));
+    SetMediaStatus(CreateMediaStatus(status));
+  }
 
+  void SetMediaStatus(Value status_value) {
     Value status_list(Value::Type::DICTIONARY);
     status_list.SetKey("status", Value(Value::Type::LIST));
     status_list.FindKey("status")->Append(std::move(status_value));
-    controller_->SetMediaStatus(std::move(status_list));
+
+    controller_->SetMediaStatus(status_list);
   }
 
  protected:
@@ -345,6 +353,24 @@
   VerifyAndClearExpectations();
 }
 
+TEST_F(CastMediaControllerTest, IgnoreInvalidImage) {
+  // Set one valid image and one invalid image.
+  mojom::MediaStatusPtr expected_status = CreateSampleMediaStatus();
+  expected_status->images.emplace_back(
+      base::in_place, GURL("https://example.com/1.png"), gfx::Size(123, 456));
+  const mojom::MediaImage& valid_image = *expected_status->images.at(0);
+  Value status_value = CreateMediaStatus(*expected_status);
+  status_value.FindListPath("media.metadata.images")->Append("invalid image");
+
+  EXPECT_CALL(*status_observer_, OnMediaStatusUpdated(_))
+      .WillOnce([&](const mojom::MediaStatusPtr& status) {
+        ASSERT_EQ(1u, status->images.size());
+        EXPECT_EQ(valid_image.url.spec(), status->images.at(0)->url.spec());
+      });
+  SetMediaStatus(std::move(status_value));
+  VerifyAndClearExpectations();
+}
+
 TEST_F(CastMediaControllerTest, UpdateVolumeStatus) {
   auto session = CreateSampleSession();
   const float session_volume =
diff --git a/chrome/browser/media_galleries/fileapi/media_file_system_backend.cc b/chrome/browser/media_galleries/fileapi/media_file_system_backend.cc
index f740d0e..69e97bf 100644
--- a/chrome/browser/media_galleries/fileapi/media_file_system_backend.cc
+++ b/chrome/browser/media_galleries/fileapi/media_file_system_backend.cc
@@ -34,7 +34,6 @@
 #include "content/public/browser/render_view_host.h"
 #include "content/public/browser/web_contents.h"
 #include "extensions/browser/extension_registry.h"
-#include "net/url_request/url_request.h"
 #include "storage/browser/file_system/copy_or_move_file_validator.h"
 #include "storage/browser/file_system/file_stream_reader.h"
 #include "storage/browser/file_system/file_stream_writer.h"
diff --git a/chrome/browser/metrics/perf/perf_events_collector.cc b/chrome/browser/metrics/perf/perf_events_collector.cc
index 4449f26f..be7c35d 100644
--- a/chrome/browser/metrics/perf/perf_events_collector.cc
+++ b/chrome/browser/metrics/perf/perf_events_collector.cc
@@ -116,7 +116,7 @@
 // we sample on the branches retired event.
 const char kPerfLBRCmdAtom[] = "perf record -a -e rc4 -b -c 300001";
 
-// The following events count misses in the level 1 caches and level 2 TLBs.
+// The following events count misses in the last level caches and level 2 TLBs.
 
 // TLB miss cycles for IvyBridge, Haswell, Broadwell and SandyBridge.
 const char kPerfITLBMissCyclesCmdIvyBridge[] =
@@ -139,7 +139,9 @@
 const char kPerfDTLBMissCyclesCmdAtom[] =
     "perf record -a -e page_walks.d_side_cycles -c 20001";
 
-const char kPerfCacheMissesCmd[] = "perf record -a -e cache-misses -c 12007";
+const char kPerfLLCMissesCmd[] = "perf record -a -e r412e -c 12007";
+// Precise events (request zero skid) for last level cache misses.
+const char kPerfLLCMissesPreciseCmd[] = "perf record -a -e r412e:pp -c 12007";
 
 const std::vector<RandomSelector::WeightAndValue> GetDefaultCommands_x86_64(
     const CPUIdentity& cpuid) {
@@ -188,13 +190,26 @@
     cmds.push_back(WeightAndValue(15.0, lbr_cmd));
     cmds.push_back(WeightAndValue(5.0, itlb_miss_cycles_cmd));
     cmds.push_back(WeightAndValue(5.0, dtlb_miss_cycles_cmd));
-    cmds.push_back(WeightAndValue(5.0, kPerfCacheMissesCmd));
+    // Only atom family and big Intel cores newer than haswell support precise
+    // events on last level cache misses.
+    if (cpu_uarch != "IvyBridge" && cpu_uarch != "Haswell" &&
+        cpu_uarch != "SandyBridge") {
+      cmds.push_back(WeightAndValue(5.0, kPerfLLCMissesPreciseCmd));
+    } else {
+      cmds.push_back(WeightAndValue(5.0, kPerfLLCMissesCmd));
+    }
     return cmds;
   }
-  // Other 64-bit x86
-  cmds.push_back(WeightAndValue(75.0, kPerfCyclesCmd));
+  // Other 64-bit x86. We collect LLC misses for other Intel CPUs, but not for
+  // non-Intel CPUs such as AMD, since the event code provided for LLC is
+  // Intel specific.
+  if (cpuid.vendor=="GenuineIntel"){
+    cmds.push_back(WeightAndValue(75.0, kPerfCyclesCmd));
+    cmds.push_back(WeightAndValue(5.0, kPerfLLCMissesCmd));
+  } else {
+    cmds.push_back(WeightAndValue(80.0, kPerfCyclesCmd));
+  }
   cmds.push_back(WeightAndValue(20.0, kPerfFPCallgraphCmd));
-  cmds.push_back(WeightAndValue(5.0, kPerfCacheMissesCmd));
   return cmds;
 }
 
diff --git a/chrome/browser/metrics/perf/perf_events_collector_unittest.cc b/chrome/browser/metrics/perf/perf_events_collector_unittest.cc
index eaa37ce0..a93cda51 100644
--- a/chrome/browser/metrics/perf/perf_events_collector_unittest.cc
+++ b/chrome/browser/metrics/perf/perf_events_collector_unittest.cc
@@ -40,7 +40,8 @@
     "perf record -a -e itlb_misses.walk_pending -c 20001";
 const char kPerfITLBMissCyclesCmdAtom[] =
     "perf record -a -e page_walks.i_side_cycles -c 20001";
-const char kPerfCacheMissesCmd[] = "perf record -a -e cache-misses -c 12007";
+const char kPerfLLCMissesCmd[] = "perf record -a -e r412e -c 12007";
+const char kPerfLLCMissesPreciseCmd[] = "perf record -a -e r412e:pp -c 12007";
 
 // Converts a protobuf to serialized format as a byte vector.
 std::vector<uint8_t> SerializeMessageToVector(
@@ -359,7 +360,7 @@
   EXPECT_NE(cmds.end(), found);
   found = std::find_if(cmds.begin(), cmds.end(),
                        [](const RandomSelector::WeightAndValue& cmd) -> bool {
-                         return cmd.value == kPerfCacheMissesCmd;
+                         return cmd.value == kPerfLLCMissesCmd;
                        });
   EXPECT_NE(cmds.end(), found);
   found = std::find_if(cmds.begin(), cmds.end(),
@@ -390,7 +391,7 @@
   EXPECT_NE(cmds.end(), found);
   found = std::find_if(cmds.begin(), cmds.end(),
                        [](const RandomSelector::WeightAndValue& cmd) -> bool {
-                         return cmd.value == kPerfCacheMissesCmd;
+                         return cmd.value == kPerfLLCMissesCmd;
                        });
   EXPECT_NE(cmds.end(), found);
   found = std::find_if(cmds.begin(), cmds.end(),
@@ -427,7 +428,7 @@
   EXPECT_NE(cmds.end(), found);
   found = std::find_if(cmds.begin(), cmds.end(),
                        [](const RandomSelector::WeightAndValue& cmd) -> bool {
-                         return cmd.value == kPerfCacheMissesCmd;
+                         return cmd.value == kPerfLLCMissesCmd;
                        });
   EXPECT_NE(cmds.end(), found);
   found = std::find_if(cmds.begin(), cmds.end(),
@@ -460,7 +461,7 @@
   EXPECT_NE(cmds.end(), found);
   found = std::find_if(cmds.begin(), cmds.end(),
                        [](const RandomSelector::WeightAndValue& cmd) -> bool {
-                         return cmd.value == kPerfCacheMissesCmd;
+                         return cmd.value == kPerfLLCMissesPreciseCmd;
                        });
   EXPECT_NE(cmds.end(), found);
   found = std::find_if(cmds.begin(), cmds.end(),
@@ -497,7 +498,7 @@
   EXPECT_NE(cmds.end(), found);
   found = std::find_if(cmds.begin(), cmds.end(),
                        [](const RandomSelector::WeightAndValue& cmd) -> bool {
-                         return cmd.value == kPerfCacheMissesCmd;
+                         return cmd.value == kPerfLLCMissesPreciseCmd;
                        });
   EXPECT_NE(cmds.end(), found);
   found = std::find_if(cmds.begin(), cmds.end(),
@@ -507,6 +508,26 @@
   EXPECT_NE(cmds.end(), found);
 }
 
+TEST_F(PerfCollectorTest, DefaultCommandsBasedOnUarch_Excavator) {
+  CPUIdentity cpuid;
+  cpuid.arch = "x86_64";
+  cpuid.vendor = "AuthenticAMD";
+  cpuid.family = 0x15;
+  cpuid.model = 0x70;  // Excavator
+  cpuid.model_name = "";
+  std::vector<RandomSelector::WeightAndValue> cmds =
+      internal::GetDefaultCommandsForCpu(cpuid);
+  ASSERT_GE(cmds.size(), 2UL);
+  EXPECT_EQ(cmds[0].value, kPerfCyclesCmd);
+  EXPECT_EQ(cmds[1].value, kPerfFPCallgraphCmd);
+  auto found =
+      std::find_if(cmds.begin(), cmds.end(),
+                   [](const RandomSelector::WeightAndValue& cmd) -> bool {
+                     return cmd.value == kPerfLLCMissesCmd;
+                   });
+  EXPECT_EQ(cmds.end(), found) << "Excavator does not support this command";
+}
+
 TEST_F(PerfCollectorTest, DefaultCommandsBasedOnArch_Arm32) {
   CPUIdentity cpuid;
   cpuid.arch = "armv7l";
@@ -527,7 +548,7 @@
   EXPECT_EQ(cmds.end(), found) << "ARM32 does not support this command";
   found = std::find_if(cmds.begin(), cmds.end(),
                        [](const RandomSelector::WeightAndValue& cmd) -> bool {
-                         return cmd.value == kPerfCacheMissesCmd;
+                         return cmd.value == kPerfLLCMissesCmd;
                        });
   EXPECT_EQ(cmds.end(), found) << "ARM32 does not support this command";
 }
@@ -552,7 +573,7 @@
   EXPECT_EQ(cmds.end(), found) << "ARM64 does not support this command";
   found = std::find_if(cmds.begin(), cmds.end(),
                        [](const RandomSelector::WeightAndValue& cmd) -> bool {
-                         return cmd.value == kPerfCacheMissesCmd;
+                         return cmd.value == kPerfLLCMissesCmd;
                        });
   EXPECT_EQ(cmds.end(), found) << "ARM64 does not support this command";
 }
@@ -577,7 +598,7 @@
   EXPECT_EQ(cmds.end(), found) << "x86_32 does not support this command";
   found = std::find_if(cmds.begin(), cmds.end(),
                        [](const RandomSelector::WeightAndValue& cmd) -> bool {
-                         return cmd.value == kPerfCacheMissesCmd;
+                         return cmd.value == kPerfLLCMissesCmd;
                        });
   EXPECT_EQ(cmds.end(), found) << "x86_32 does not support this command";
 }
diff --git a/chrome/browser/net/errorpage_browsertest.cc b/chrome/browser/net/errorpage_browsertest.cc
index ccdadf3..89981d1 100644
--- a/chrome/browser/net/errorpage_browsertest.cc
+++ b/chrome/browser/net/errorpage_browsertest.cc
@@ -77,11 +77,7 @@
 #include "net/test/url_request/url_request_failed_job.h"
 #include "net/test/url_request/url_request_mock_data_job.h"
 #include "net/test/url_request/url_request_mock_http_job.h"
-#include "net/url_request/url_request_context.h"
-#include "net/url_request/url_request_context_getter.h"
-#include "net/url_request/url_request_job.h"
 #include "net/url_request/url_request_test_job.h"
-#include "net/url_request/url_request_test_util.h"
 #include "services/network/public/cpp/features.h"
 #include "ui/base/l10n/l10n_util.h"
 
@@ -870,11 +866,10 @@
       SetEnterpriseUsersDefaults(&policy_map);
 #endif
     if (set_allow_dinosaur_easter_egg_) {
-      policy_map.Set(
-          policy::key::kAllowDinosaurEasterEgg, policy::POLICY_LEVEL_MANDATORY,
-          policy::POLICY_SCOPE_USER, policy::POLICY_SOURCE_CLOUD,
-          std::make_unique<base::Value>(value_of_allow_dinosaur_easter_egg_),
-          nullptr);
+      policy_map.Set(policy::key::kAllowDinosaurEasterEgg,
+                     policy::POLICY_LEVEL_MANDATORY, policy::POLICY_SCOPE_USER,
+                     policy::POLICY_SOURCE_CLOUD,
+                     base::Value(value_of_allow_dinosaur_easter_egg_), nullptr);
     }
     policy_provider_.UpdateChromePolicy(policy_map);
 
diff --git a/chrome/browser/net/network_context_configuration_browsertest.cc b/chrome/browser/net/network_context_configuration_browsertest.cc
index f40e582..c9c5b7ea 100644
--- a/chrome/browser/net/network_context_configuration_browsertest.cc
+++ b/chrome/browser/net/network_context_configuration_browsertest.cc
@@ -85,7 +85,7 @@
 #include "net/test/gtest_util.h"
 #include "net/test/spawned_test_server/spawned_test_server.h"
 #include "net/traffic_annotation/network_traffic_annotation_test_helper.h"
-#include "net/url_request/url_request.h"
+#include "net/url_request/referrer_policy.h"
 #include "services/network/public/cpp/features.h"
 #include "services/network/public/cpp/network_connection_tracker.h"
 #include "services/network/public/cpp/simple_url_loader.h"
@@ -1487,7 +1487,7 @@
       std::make_unique<network::ResourceRequest>();
   request->url = embedded_test_server()->GetURL("/echoheader?Referer");
   request->referrer = GURL("http://referrer/");
-  request->referrer_policy = net::URLRequest::NO_REFERRER;
+  request->referrer_policy = net::ReferrerPolicy::NO_REFERRER;
   content::SimpleURLLoaderTestHelper simple_loader_helper;
   std::unique_ptr<network::SimpleURLLoader> simple_loader =
       network::SimpleURLLoader::Create(std::move(request),
diff --git a/chrome/browser/net/trial_comparison_cert_verifier_controller_unittest.cc b/chrome/browser/net/trial_comparison_cert_verifier_controller_unittest.cc
index 8fa14070..3cc9e4d4 100644
--- a/chrome/browser/net/trial_comparison_cert_verifier_controller_unittest.cc
+++ b/chrome/browser/net/trial_comparison_cert_verifier_controller_unittest.cc
@@ -36,7 +36,6 @@
 #include "net/test/cert_test_util.h"
 #include "net/test/gtest_util.h"
 #include "net/test/test_data_directory.h"
-#include "net/url_request/url_request_test_util.h"
 #include "services/network/public/cpp/features.h"
 #include "services/network/public/mojom/trial_comparison_cert_verifier.mojom.h"
 #include "testing/gmock/include/gmock/gmock.h"
diff --git a/chrome/browser/ntp_snippets/content_suggestions_service_factory.cc b/chrome/browser/ntp_snippets/content_suggestions_service_factory.cc
index e86abbf7..d5d5f21 100644
--- a/chrome/browser/ntp_snippets/content_suggestions_service_factory.cc
+++ b/chrome/browser/ntp_snippets/content_suggestions_service_factory.cc
@@ -50,7 +50,6 @@
 #include "content/public/browser/browser_thread.h"
 #include "content/public/browser/storage_partition.h"
 #include "google_apis/google_api_keys.h"
-#include "net/url_request/url_request_context_getter.h"
 #include "services/data_decoder/public/cpp/data_decoder.h"
 #include "services/network/public/cpp/shared_url_loader_factory.h"
 
diff --git a/chrome/browser/offline_pages/offline_page_url_loader.cc b/chrome/browser/offline_pages/offline_page_url_loader.cc
index 8946bfe..989b84d 100644
--- a/chrome/browser/offline_pages/offline_page_url_loader.cc
+++ b/chrome/browser/offline_pages/offline_page_url_loader.cc
@@ -18,7 +18,7 @@
 #include "content/public/common/previews_state.h"
 #include "mojo/public/cpp/system/simple_watcher.h"
 #include "net/base/io_buffer.h"
-#include "net/url_request/url_request.h"
+#include "net/url_request/referrer_policy.h"
 #include "services/network/public/cpp/resource_request.h"
 #include "services/network/public/mojom/url_response_head.mojom.h"
 #include "third_party/blink/public/mojom/loader/resource_load_info.mojom-shared.h"
@@ -41,7 +41,7 @@
                                      int response_code) {
   net::RedirectInfo redirect_info;
   redirect_info.new_url = redirected_url;
-  redirect_info.new_referrer_policy = net::URLRequest::NO_REFERRER;
+  redirect_info.new_referrer_policy = net::ReferrerPolicy::NO_REFERRER;
   redirect_info.new_method = "GET";
   redirect_info.status_code = response_code;
   redirect_info.new_site_for_cookies =
diff --git a/chrome/browser/page_load_metrics/observers/ad_metrics/ads_page_load_metrics_observer.cc b/chrome/browser/page_load_metrics/observers/ad_metrics/ads_page_load_metrics_observer.cc
index c6b695a..c4f985ba9 100644
--- a/chrome/browser/page_load_metrics/observers/ad_metrics/ads_page_load_metrics_observer.cc
+++ b/chrome/browser/page_load_metrics/observers/ad_metrics/ads_page_load_metrics_observer.cc
@@ -47,6 +47,8 @@
 #include "third_party/blink/public/mojom/devtools/inspector_issue.mojom-shared.h"
 #include "third_party/blink/public/mojom/web_feature/web_feature.mojom.h"
 #include "ui/base/page_transition_types.h"
+#include "ui/gfx/geometry/point.h"
+#include "ui/gfx/geometry/rect.h"
 #include "ui/gfx/geometry/size.h"
 #include "url/gurl.h"
 
@@ -333,6 +335,7 @@
 
     if (should_ignore_detected_ad &&
         (ad_id == previous_data->root_frame_tree_node_id())) {
+      page_ad_density_tracker_.RemoveRect(id_and_data->first);
       ad_frames_data_storage_.erase(id_and_data->second);
       ad_frames_data_.erase(id_and_data);
 
@@ -553,6 +556,35 @@
     ancestor_data->set_media_status(FrameData::MediaStatus::kPlayed);
 }
 
+void AdsPageLoadMetricsObserver::OnFrameIntersectionUpdate(
+    content::RenderFrameHost* render_frame_host,
+    const page_load_metrics::mojom::FrameIntersectionUpdate&
+        intersection_update) {
+  if (!intersection_update.main_frame_intersection_rect)
+    return;
+
+  int frame_tree_node_id = render_frame_host->GetFrameTreeNodeId();
+  if (render_frame_host == GetDelegate().GetWebContents()->GetMainFrame()) {
+    page_ad_density_tracker_.UpdateMainFrameRect(
+        *intersection_update.main_frame_intersection_rect);
+    return;
+  }
+
+  // If the frame whose size has changed is the root of the ad ancestry chain,
+  // then update it.
+  FrameData* ancestor_data = FindFrameData(frame_tree_node_id);
+  if (ancestor_data &&
+      frame_tree_node_id == ancestor_data->root_frame_tree_node_id()) {
+    page_ad_density_tracker_.RemoveRect(frame_tree_node_id);
+    // Only add frames if they are visible.
+    if (!ancestor_data->is_display_none()) {
+      page_ad_density_tracker_.AddRect(
+          frame_tree_node_id,
+          *intersection_update.main_frame_intersection_rect);
+    }
+  }
+}
+
 void AdsPageLoadMetricsObserver::OnFrameDeleted(
     content::RenderFrameHost* render_frame_host) {
   if (!render_frame_host)
@@ -578,6 +610,7 @@
     ancestor_data->RecordAdFrameLoadUkmEvent(GetDelegate().GetSourceId());
     DCHECK(id_and_data->second != ad_frames_data_storage_.end());
     ad_frames_data_storage_.erase(id_and_data->second);
+    page_ad_density_tracker_.RemoveRect(id_and_data->first);
   }
 
   // Delete this frame's entry from the map now that the store is deleted.
@@ -708,6 +741,24 @@
     return;
   PAGE_BYTES_HISTOGRAM("PageLoad.Clients.Ads.Resources.Bytes.Ads2",
                        aggregate_frame_data_->ad_network_bytes());
+
+  if (page_ad_density_tracker_.MaxPageAdDensityByArea() != -1) {
+    UMA_HISTOGRAM_PERCENTAGE("PageLoad.Clients.Ads.AdDensity.MaxPercentByArea",
+                             page_ad_density_tracker_.MaxPageAdDensityByArea());
+  }
+
+  if (page_ad_density_tracker_.MaxPageAdDensityByHeight() != -1) {
+    UMA_HISTOGRAM_PERCENTAGE(
+        "PageLoad.Clients.Ads.AdDensity.MaxPercentByHeight",
+        page_ad_density_tracker_.MaxPageAdDensityByHeight());
+  }
+
+  // Records true if both of the density calculations succeeded on the page.
+  UMA_HISTOGRAM_BOOLEAN(
+      "PageLoad.Clients.Ads.AdDensity.Recorded",
+      page_ad_density_tracker_.MaxPageAdDensityByArea() != -1 &&
+          page_ad_density_tracker_.MaxPageAdDensityByHeight() != -1);
+
   auto* ukm_recorder = ukm::UkmRecorder::Get();
   ukm::builders::AdPageLoad builder(source_id);
   builder.SetTotalBytes(aggregate_frame_data_->network_bytes() >> 10)
@@ -719,7 +770,10 @@
                            FrameData::ResourceMimeType::kVideo) >>
                        10)
       .SetMainframeAdBytes(ukm::GetExponentialBucketMinForBytes(
-          main_frame_data_->ad_network_bytes()));
+          main_frame_data_->ad_network_bytes()))
+      .SetMaxAdDensityByArea(page_ad_density_tracker_.MaxPageAdDensityByArea())
+      .SetMaxAdDensityByHeight(
+          page_ad_density_tracker_.MaxPageAdDensityByHeight());
 
   // Record cpu metrics for the page.
   builder.SetAdCpuTime(
diff --git a/chrome/browser/page_load_metrics/observers/ad_metrics/ads_page_load_metrics_observer.h b/chrome/browser/page_load_metrics/observers/ad_metrics/ads_page_load_metrics_observer.h
index 66c9785..07483ca9 100644
--- a/chrome/browser/page_load_metrics/observers/ad_metrics/ads_page_load_metrics_observer.h
+++ b/chrome/browser/page_load_metrics/observers/ad_metrics/ads_page_load_metrics_observer.h
@@ -14,6 +14,7 @@
 #include "base/scoped_observer.h"
 #include "base/time/tick_clock.h"
 #include "chrome/browser/page_load_metrics/observers/ad_metrics/frame_data.h"
+#include "chrome/browser/page_load_metrics/observers/ad_metrics/page_ad_density_tracker.h"
 #include "components/page_load_metrics/browser/page_load_metrics_observer.h"
 #include "components/page_load_metrics/common/page_load_metrics.mojom-forward.h"
 #include "components/subresource_filter/content/browser/subresource_filter_observer.h"
@@ -120,6 +121,10 @@
   void MediaStartedPlaying(
       const content::WebContentsObserver::MediaPlayerInfo& video_type,
       content::RenderFrameHost* render_frame_host) override;
+  void OnFrameIntersectionUpdate(
+      content::RenderFrameHost* render_frame_host,
+      const page_load_metrics::mojom::FrameIntersectionUpdate&
+          intersection_update) override;
   void OnFrameDeleted(content::RenderFrameHost* render_frame_host) override;
 
   void SetHeavyAdThresholdNoiseProviderForTesting(
@@ -270,6 +275,9 @@
   std::unique_ptr<HeavyAdThresholdNoiseProvider>
       heavy_ad_threshold_noise_provider_;
 
+  // The maximum ad density measurements for the page during it's lifecycle.
+  PageAdDensityTracker page_ad_density_tracker_;
+
   DISALLOW_COPY_AND_ASSIGN(AdsPageLoadMetricsObserver);
 };
 
diff --git a/chrome/browser/page_load_metrics/observers/ad_metrics/ads_page_load_metrics_observer_browsertest.cc b/chrome/browser/page_load_metrics/observers/ad_metrics/ads_page_load_metrics_observer_browsertest.cc
index 8231fe19..166fc78c 100644
--- a/chrome/browser/page_load_metrics/observers/ad_metrics/ads_page_load_metrics_observer_browsertest.cc
+++ b/chrome/browser/page_load_metrics/observers/ad_metrics/ads_page_load_metrics_observer_browsertest.cc
@@ -83,6 +83,15 @@
 const char kHeavyAdInterventionTypeHistogramId[] =
     "PageLoad.Clients.Ads.HeavyAds.InterventionType2";
 
+const char kMaxAdDensityByAreaHistogramId[] =
+    "PageLoad.Clients.Ads.AdDensity.MaxPercentByArea";
+
+const char kMaxAdDensityByHeightHistogramId[] =
+    "PageLoad.Clients.Ads.AdDensity.MaxPercentByHeight";
+
+const char kMaxAdDensityRecordedHistogramId[] =
+    "PageLoad.Clients.Ads.AdDensity.Recorded";
+
 const char kHttpOkResponseHeader[] =
     "HTTP/1.1 200 OK\r\n"
     "Content-Type: text/html; charset=utf-8\r\n"
@@ -237,6 +246,244 @@
       static_cast<int>(FrameData::OriginStatus::kCross));
 }
 
+// Verifies that the page ad density records the maximum value during
+// a page's lifecycling by creating a large ad frame, destroying it, and
+// creating a smaller iframe. The ad density recorded is the density with
+// the first larger frame.
+IN_PROC_BROWSER_TEST_F(AdsPageLoadMetricsObserverBrowserTest,
+                       PageAdDensityRecordsPageMax) {
+  base::HistogramTester histogram_tester;
+  ukm::TestAutoSetUkmRecorder ukm_recorder;
+  auto waiter = CreatePageLoadMetricsTestWaiter();
+  content::WebContents* web_contents =
+      browser()->tab_strip_model()->GetActiveWebContents();
+
+  // Evaluate the height and width of the page as the browser_test can
+  // vary the dimensions.
+  int document_height =
+      EvalJs(web_contents, "document.body.scrollHeight").ExtractInt();
+  int document_width =
+      EvalJs(web_contents, "document.body.scrollWidth").ExtractInt();
+
+  // Expectation is before NavigateToUrl for this test as the expectation can be
+  // met after NavigateToUrl and before the Wait.
+  waiter->AddMainFrameIntersectionExpectation(
+      gfx::Rect(0, 0, document_width,
+                document_height));  // Initial main frame rect.
+  ui_test_utils::NavigateToURL(
+      browser(), embedded_test_server()->GetURL(
+                     "a.com", "/ads_observer/blank_with_adiframe_writer.html"));
+  waiter->Wait();
+  web_contents = browser()->tab_strip_model()->GetActiveWebContents();
+
+  // Create a frame at 100,100 of size 200,200.
+  waiter->AddMainFrameIntersectionExpectation(gfx::Rect(100, 100, 200, 200));
+
+  // Create the frame with b.com as origin to not get caught by
+  // restricted ad tagging.
+  EXPECT_TRUE(ExecJs(
+      web_contents,
+      content::JsReplace(
+          "let frame = createAdIframeAtRect(100, 100, 200, 200); "
+          "frame.src = $1; ",
+          embedded_test_server()->GetURL("b.com", "/ads_observer/pixel.png"))));
+  waiter->Wait();
+
+  // Load should stop before we remove the frame.
+  EXPECT_TRUE(WaitForLoadStop(web_contents));
+  EXPECT_TRUE(ExecJs(web_contents,
+                     "let frames = document.getElementsByTagName('iframe'); "
+                     "frames[0].remove(); "));
+  waiter->AddMainFrameIntersectionExpectation(gfx::Rect(400, 400, 10, 10));
+
+  // Delete the frame and create a new frame at 400,400 of size 10x10. The
+  // ad density resulting from this frame is lower than the 200x200.
+  EXPECT_TRUE(ExecJs(
+      web_contents,
+      content::JsReplace("let frame = createAdIframeAtRect(400, 400, 10, 10); "
+                         "frame.src = $1; ",
+                         embedded_test_server()
+                             ->GetURL("b.com", "/ads_observer/pixel.png")
+                             .spec())));
+  waiter->Wait();
+
+  // Evaluate the height and width of the page as the browser_test can
+  // vary the dimensions.
+  document_height =
+      EvalJs(web_contents, "document.body.scrollHeight").ExtractInt();
+  document_width =
+      EvalJs(web_contents, "document.body.scrollWidth").ExtractInt();
+
+  int page_area = document_width * document_height;
+  int ad_area = 200 * 200;  // The area of the first larger ad iframe.
+  int expected_page_density_area = ad_area * 100 / page_area;
+  int expected_page_density_height = 200 * 100 / document_height;
+
+  ui_test_utils::NavigateToURL(browser(), GURL(url::kAboutBlankURL));
+
+  histogram_tester.ExpectUniqueSample(kMaxAdDensityByAreaHistogramId,
+                                      expected_page_density_area, 1);
+  histogram_tester.ExpectUniqueSample(kMaxAdDensityByHeightHistogramId,
+                                      expected_page_density_height, 1);
+  histogram_tester.ExpectUniqueSample(kMaxAdDensityRecordedHistogramId, true,
+                                      1);
+  auto entries =
+      ukm_recorder.GetEntriesByName(ukm::builders::AdPageLoad::kEntryName);
+  EXPECT_EQ(1u, entries.size());
+  ukm_recorder.ExpectEntryMetric(
+      entries.front(), ukm::builders::AdPageLoad::kMaxAdDensityByAreaName,
+      expected_page_density_area);
+  ukm_recorder.ExpectEntryMetric(
+      entries.front(), ukm::builders::AdPageLoad::kMaxAdDensityByHeightName,
+      expected_page_density_height);
+}
+
+// Creates multiple overlapping frames and verifies the page ad density.
+IN_PROC_BROWSER_TEST_F(AdsPageLoadMetricsObserverBrowserTest,
+                       PageAdDensityMultipleFrames) {
+  base::HistogramTester histogram_tester;
+  ukm::TestAutoSetUkmRecorder ukm_recorder;
+  auto waiter = CreatePageLoadMetricsTestWaiter();
+  content::WebContents* web_contents =
+      browser()->tab_strip_model()->GetActiveWebContents();
+
+  int document_height =
+      EvalJs(web_contents, "document.body.scrollHeight").ExtractInt();
+  int document_width =
+      EvalJs(web_contents, "document.body.scrollWidth").ExtractInt();
+
+  // Expectation is before NavigateToUrl for this test as the expectation can be
+  // met after NavigateToUrl and before the Wait.
+  waiter->AddMainFrameIntersectionExpectation(
+      gfx::Rect(0, 0, document_width,
+                document_height));  // Initial main frame rect.
+
+  ui_test_utils::NavigateToURL(
+      browser(), embedded_test_server()->GetURL(
+                     "a.com", "/ads_observer/blank_with_adiframe_writer.html"));
+  waiter->Wait();
+  web_contents = browser()->tab_strip_model()->GetActiveWebContents();
+
+  // Create a frame of size 400,400 at 100,100.
+  waiter->AddMainFrameIntersectionExpectation(gfx::Rect(400, 400, 100, 100));
+
+  // Create the frame with b.com as origin to not get caught by
+  // restricted ad tagging.
+  EXPECT_TRUE(ExecJs(
+      web_contents, content::JsReplace(
+                        "let frame = createAdIframeAtRect(400, 400, 100, 100); "
+                        "frame.src = $1",
+                        embedded_test_server()
+                            ->GetURL("b.com", "/ads_observer/pixel.png")
+                            .spec())));
+
+  waiter->Wait();
+
+  // Create a frame at of size 200,200 at 450,450.
+  waiter->AddMainFrameIntersectionExpectation(gfx::Rect(450, 450, 200, 200));
+  EXPECT_TRUE(ExecJs(
+      web_contents, content::JsReplace(
+                        "let frame = createAdIframeAtRect(450, 450, 200, 200); "
+                        "frame.src = $1",
+                        embedded_test_server()
+                            ->GetURL("b.com", "/ads_observer/pixel.png")
+                            .spec())));
+  waiter->Wait();
+
+  // Evaluate the height and width of the page as the browser_test can
+  // vary the dimensions.
+  document_height =
+      EvalJs(web_contents, "document.body.scrollHeight").ExtractInt();
+  document_width =
+      EvalJs(web_contents, "document.body.scrollWidth").ExtractInt();
+
+  ui_test_utils::NavigateToURL(browser(), GURL(url::kAboutBlankURL));
+
+  int page_area = document_width * document_height;
+  // The area of the two iframes minus the area of the overlapping section.
+  int ad_area = 100 * 100 + 200 * 200 - 50 * 50;
+  int expected_page_density_area = ad_area * 100 / page_area;
+  int expected_page_density_height = 250 * 100 / document_height;
+
+  histogram_tester.ExpectUniqueSample(kMaxAdDensityByAreaHistogramId,
+                                      expected_page_density_area, 1);
+  histogram_tester.ExpectUniqueSample(kMaxAdDensityByHeightHistogramId,
+                                      expected_page_density_height, 1);
+  histogram_tester.ExpectUniqueSample(kMaxAdDensityRecordedHistogramId, true,
+                                      1);
+  auto entries =
+      ukm_recorder.GetEntriesByName(ukm::builders::AdPageLoad::kEntryName);
+  EXPECT_EQ(1u, entries.size());
+  ukm_recorder.ExpectEntryMetric(
+      entries.front(), ukm::builders::AdPageLoad::kMaxAdDensityByAreaName,
+      expected_page_density_area);
+  ukm_recorder.ExpectEntryMetric(
+      entries.front(), ukm::builders::AdPageLoad::kMaxAdDensityByHeightName,
+      expected_page_density_height);
+}
+
+// Creates a frame with display:none styling and verifies that it has an
+// empty intersection with the main frame.
+IN_PROC_BROWSER_TEST_F(AdsPageLoadMetricsObserverBrowserTest,
+                       PageAdDensityIgnoreDisplayNoneFrame) {
+  base::HistogramTester histogram_tester;
+  ukm::TestAutoSetUkmRecorder ukm_recorder;
+  auto waiter = CreatePageLoadMetricsTestWaiter();
+  content::WebContents* web_contents =
+      browser()->tab_strip_model()->GetActiveWebContents();
+
+  // Evaluate the height and width of the page as the browser_test can
+  // vary the dimensions.
+  int document_height =
+      EvalJs(web_contents, "document.body.scrollHeight").ExtractInt();
+  int document_width =
+      EvalJs(web_contents, "document.body.scrollWidth").ExtractInt();
+
+  // Expectation is before NavigateToUrl for this test as the expectation can be
+  // met after NavigateToUrl and before the Wait.
+  waiter->AddMainFrameIntersectionExpectation(
+      gfx::Rect(0, 0, document_width,
+                document_height));  // Initial main frame rect.
+
+  ui_test_utils::NavigateToURL(
+      browser(), embedded_test_server()->GetURL(
+                     "a.com", "/ads_observer/blank_with_adiframe_writer.html"));
+  waiter->Wait();
+  web_contents = browser()->tab_strip_model()->GetActiveWebContents();
+
+  // Create a frame at 100,100 of size 200,200. The expectation is an empty rect
+  // as the frame is display:none and as a result has no main frame
+  // intersection.
+  waiter->AddMainFrameIntersectionExpectation(gfx::Rect(0, 0, 0, 0));
+
+  // Create the frame with b.com as origin to not get caught by
+  // restricted ad tagging.
+  EXPECT_TRUE(ExecJs(
+      web_contents, content::JsReplace(
+                        "let frame = createAdIframeAtRect(100, 100, 200, 200); "
+                        "frame.src = $1; "
+                        "frame.style.display = \"none\";",
+                        embedded_test_server()
+                            ->GetURL("b.com", "/ads_observer/pixel.png")
+                            .spec())));
+
+  waiter->Wait();
+
+  ui_test_utils::NavigateToURL(browser(), GURL(url::kAboutBlankURL));
+
+  histogram_tester.ExpectUniqueSample(kMaxAdDensityByAreaHistogramId, 0, 1);
+  histogram_tester.ExpectUniqueSample(kMaxAdDensityByHeightHistogramId, 0, 1);
+  histogram_tester.ExpectUniqueSample(kMaxAdDensityRecordedHistogramId, true,
+                                      1);
+  auto entries =
+      ukm_recorder.GetEntriesByName(ukm::builders::AdPageLoad::kEntryName);
+  EXPECT_EQ(1u, entries.size());
+  ukm_recorder.ExpectEntryMetric(
+      entries.front(), ukm::builders::AdPageLoad::kMaxAdDensityByAreaName, 0);
+  ukm_recorder.ExpectEntryMetric(
+      entries.front(), ukm::builders::AdPageLoad::kMaxAdDensityByHeightName, 0);
+}
+
 // Each CreativeOriginStatus* browser test inputs a pointer to a frame object
 // representing the frame tree path of a website with with a (possibly null)
 // ad subframe, which itself may have linearly nested subframes.
diff --git a/chrome/browser/page_load_metrics/observers/ad_metrics/frame_data.h b/chrome/browser/page_load_metrics/observers/ad_metrics/frame_data.h
index 4fd6937..8f1000e 100644
--- a/chrome/browser/page_load_metrics/observers/ad_metrics/frame_data.h
+++ b/chrome/browser/page_load_metrics/observers/ad_metrics/frame_data.h
@@ -238,6 +238,8 @@
 
   gfx::Size frame_size() const { return frame_size_; }
 
+  bool is_display_none() const { return is_display_none_; }
+
   MediaStatus media_status() const { return media_status_; }
 
   void set_media_status(MediaStatus media_status) {
diff --git a/chrome/browser/page_load_metrics/observers/ad_metrics/page_ad_density_tracker.cc b/chrome/browser/page_load_metrics/observers/ad_metrics/page_ad_density_tracker.cc
new file mode 100644
index 0000000..4daffc7
--- /dev/null
+++ b/chrome/browser/page_load_metrics/observers/ad_metrics/page_ad_density_tracker.cc
@@ -0,0 +1,297 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "chrome/browser/page_load_metrics/observers/ad_metrics/page_ad_density_tracker.h"
+#include "base/metrics/histogram_macros.h"
+#include "base/numerics/checked_math.h"
+#include "base/optional.h"
+
+namespace {
+
+// Calculates the combined length of a set of line segments. This counts
+// each overlapping area a single time and does not include areas where there
+// is no line segment.
+//
+// TODO(https://crbug.com/1068586): Optimize segment length calculation.
+// AddSegment and RemoveSegment are both logarithmic operations, making this
+// linearithmic with the number of segments. However the expected number
+// of segments at any given time in the density calculation is low.
+class SegmentLength {
+ public:
+  // An event to process corresponding to the left or right point of each
+  // line segment.
+  struct SegmentEvent {
+    SegmentEvent(int segment_id, int pos, bool is_segment_start)
+        : segment_id(segment_id),
+          pos(pos),
+          is_segment_start(is_segment_start) {}
+    SegmentEvent(const SegmentEvent& other) = default;
+
+    // Tiebreak with position with |is_segment_start| and |segment_id|.
+    bool operator<(const SegmentEvent& rhs) const {
+      if (pos == rhs.pos) {
+        if (segment_id == rhs.segment_id) {
+          return is_segment_start != rhs.is_segment_start;
+        } else {
+          return segment_id < rhs.segment_id;
+        }
+      } else {
+        return pos < rhs.pos;
+      }
+    }
+
+    int segment_id;
+    int pos;
+    bool is_segment_start;
+  };
+
+  // Iterators into the set of segment events for efficient removal of
+  // segment events by segment_id. Maintained by |segment_event_iterators_|.
+  struct SegmentEventSetIterators {
+    SegmentEventSetIterators(std::set<SegmentEvent>::iterator start,
+                             std::set<SegmentEvent>::iterator end)
+        : start_it(start), end_it(end) {}
+
+    SegmentEventSetIterators(const SegmentEventSetIterators& other) = default;
+
+    std::set<SegmentEvent>::const_iterator start_it;
+    std::set<SegmentEvent>::const_iterator end_it;
+  };
+
+  SegmentLength() = default;
+  ~SegmentLength() = default;
+
+  // Add a line segment to the set of active line segments, the segment
+  // corresponds to the bottom or top of a rect.
+  void AddSegment(int segment_id, int start, int end) {
+    // Safe as insert will never return an invalid iterator, it will
+    // point to the existing element if already in the set.
+    auto start_it =
+        active_segments_
+            .insert(SegmentEvent(segment_id, start, true /*is_segment_start*/))
+            .first;
+    auto end_it =
+        active_segments_
+            .insert(SegmentEvent(segment_id, end, false /*is_segment_start*/))
+            .first;
+
+    segment_event_iterators_.emplace(
+        segment_id, SegmentEventSetIterators(start_it, end_it));
+  }
+
+  // Remove a segment from the set of active line segmnets.
+  void RemoveSegment(int segment_id) {
+    auto it = segment_event_iterators_.find(segment_id);
+    DCHECK(it != segment_event_iterators_.end());
+
+    const SegmentEventSetIterators& set_its = it->second;
+    active_segments_.erase(set_its.start_it);
+    active_segments_.erase(set_its.end_it);
+    segment_event_iterators_.erase(segment_id);
+  }
+
+  // Calculate the combined length of segments in the active set of segments by
+  // iterating over the the sorted set of segment events.
+  base::Optional<int> Length() {
+    base::CheckedNumeric<int> length = 0;
+    int last_event_pos = -1;
+    int num_active = 0;
+    for (const auto& segment_event : active_segments_) {
+      if (last_event_pos == -1) {
+        DCHECK(segment_event.is_segment_start);
+        last_event_pos = segment_event.pos;
+      }
+
+      if (num_active > 0)
+        length += segment_event.pos - last_event_pos;
+
+      last_event_pos = segment_event.pos;
+      if (segment_event.is_segment_start) {
+        num_active += 1;
+      } else {
+        num_active -= 1;
+      }
+    }
+
+    base::Optional<int> total_length;
+    if (length.IsValid())
+      total_length = length.ValueOrDie();
+
+    return total_length;
+  }
+
+ private:
+  std::set<SegmentEvent> active_segments_;
+
+  // Map from the segment_id passed by user to the Segment struct.
+  std::unordered_map<int, SegmentEventSetIterators> segment_event_iterators_;
+
+  DISALLOW_COPY_AND_ASSIGN(SegmentLength);
+};
+
+}  // namespace
+
+PageAdDensityTracker::RectEvent::RectEvent(int id,
+                                           bool is_bottom,
+                                           const gfx::Rect& rect)
+    : rect_id(id), is_bottom(is_bottom), rect(rect) {}
+
+PageAdDensityTracker::RectEvent::RectEvent(const RectEvent& other) = default;
+
+PageAdDensityTracker::RectEventSetIterators::RectEventSetIterators(
+    std::set<RectEvent>::iterator top,
+    std::set<RectEvent>::iterator bottom)
+    : top_it(top), bottom_it(bottom) {}
+
+PageAdDensityTracker::RectEventSetIterators::RectEventSetIterators(
+    const RectEventSetIterators& other) = default;
+
+PageAdDensityTracker::PageAdDensityTracker() = default;
+
+PageAdDensityTracker::~PageAdDensityTracker() = default;
+
+int PageAdDensityTracker::MaxPageAdDensityByHeight() {
+  return max_page_ad_density_by_height_;
+}
+
+int PageAdDensityTracker::MaxPageAdDensityByArea() {
+  return max_page_ad_density_by_area_;
+}
+
+void PageAdDensityTracker::AddRect(int rect_id, const gfx::Rect& rect) {
+  // Check that we do not already have rect events for the rect.
+  DCHECK(rect_events_iterators_.find(rect_id) == rect_events_iterators_.end());
+
+  // We do not track empty rects.
+  if (rect.IsEmpty())
+    return;
+
+  // Limit the maximum number of rects tracked to 50 due to poor worst
+  // case performance.
+  const int kMaxRectsTracked = 50;
+  if (rect_events_iterators_.size() > kMaxRectsTracked)
+    return;
+
+  auto top_it =
+      rect_events_.insert(RectEvent(rect_id, true /*is_bottom*/, rect)).first;
+  auto bottom_it =
+      rect_events_.insert(RectEvent(rect_id, false /*is_bottom*/, rect)).first;
+  rect_events_iterators_.emplace(rect_id,
+                                 RectEventSetIterators(top_it, bottom_it));
+
+  // TODO(https://crbug.com/1068586): Improve performance by adding additional
+  // throttling to only calculate when max density can decrease (frame deleted
+  // or moved).
+  CalculateDensity();
+}
+
+void PageAdDensityTracker::RemoveRect(int rect_id) {
+  auto it = rect_events_iterators_.find(rect_id);
+
+  if (it == rect_events_iterators_.end())
+    return;
+
+  const RectEventSetIterators& set_its = it->second;
+  rect_events_.erase(set_its.top_it);
+  rect_events_.erase(set_its.bottom_it);
+  rect_events_iterators_.erase(rect_id);
+}
+
+void PageAdDensityTracker::UpdateMainFrameRect(const gfx::Rect& rect) {
+  if (!last_main_frame_size_ || rect != *last_main_frame_size_) {
+    last_main_frame_size_ = rect;
+    CalculateDensity();
+  }
+}
+
+// Ad density measurement uses a modified Bentley's Algorithm, the high level
+// approach is described on: http://jeffe.cs.illinois.edu/open/klee.html.
+void PageAdDensityTracker::CalculateDensity() {
+  // Cannot calculate density if there is no main frame rect.
+  if (!last_main_frame_size_)
+    return;
+
+  SegmentLength segment_length_tracker;
+
+  int last_y = -1;
+  base::CheckedNumeric<int> total_area = 0;
+  base::CheckedNumeric<int> total_height = 0;
+  for (const auto& rect_event : rect_events_) {
+    if (last_y == -1) {
+      DCHECK(rect_event.is_bottom);
+      segment_length_tracker.AddSegment(
+          rect_event.rect_id, rect_event.rect.x(),
+          rect_event.rect.x() + rect_event.rect.width());
+      last_y =
+          rect_event.is_bottom ? rect_event.rect.bottom() : rect_event.rect.y();
+    }
+
+    int current_y =
+        rect_event.is_bottom ? rect_event.rect.bottom() : rect_event.rect.y();
+    DCHECK_LE(current_y, last_y);
+
+    // If the segment length value is invalid, skip this ad density calculation.
+    base::Optional<int> segment_length = segment_length_tracker.Length();
+    if (!segment_length)
+      return;
+
+    // Check that the segment length multiplied by the height of the block
+    // does not overflow an int.
+    base::CheckedNumeric<int> current_area = *segment_length;
+    current_area *= (last_y - current_y);
+    if (!current_area.IsValid())
+      return;
+
+    total_area += *segment_length * (last_y - current_y);
+
+    if (*segment_length > 0)
+      total_height += (last_y - current_y);
+
+    // As we are iterating from the bottom of the page to the top, add segments
+    // when we see the start (bottom) of a new rect.
+    if (rect_event.is_bottom) {
+      segment_length_tracker.AddSegment(
+          rect_event.rect_id, rect_event.rect.x(),
+          rect_event.rect.x() + rect_event.rect.width());
+    } else {
+      segment_length_tracker.RemoveSegment(rect_event.rect_id);
+    }
+    last_y = current_y;
+  }
+
+  // If the measured height or area is invalid, skip recording this ad density
+  // calculation.
+  if (!total_height.IsValid() || !total_area.IsValid())
+    return;
+
+  base::CheckedNumeric<int> ad_density_by_height =
+      total_height * 100 / last_main_frame_size_->height();
+  if (ad_density_by_height.IsValid() &&
+      ad_density_by_height.ValueOrDie() > max_page_ad_density_by_height_)
+    max_page_ad_density_by_height_ = ad_density_by_height.ValueOrDie();
+
+  // Invalidate the check numeric if the checked area is invalid.
+  base::CheckedNumeric<int> ad_density_by_area =
+      total_area * 100 /
+      (last_main_frame_size_->size().GetCheckedArea().ValueOrDefault(0));
+  if (ad_density_by_area.IsValid() &&
+      ad_density_by_area.ValueOrDie() > max_page_ad_density_by_area_)
+    max_page_ad_density_by_area_ = ad_density_by_area.ValueOrDie();
+}
+
+bool PageAdDensityTracker::RectEvent::operator<(const RectEvent& rhs) const {
+  int lhs_y = is_bottom ? rect.bottom() : rect.y();
+  int rhs_y = rhs.is_bottom ? rhs.rect.bottom() : rhs.rect.y();
+
+  // Tiebreak with |rect_id| and |is_bottom|.
+  if (lhs_y == rhs_y) {
+    if (rect_id == rhs.rect_id) {
+      return is_bottom == rhs.is_bottom;
+    } else {
+      return rect_id < rhs.rect_id;
+    }
+  } else {
+    return lhs_y > rhs_y;
+  }
+}
diff --git a/chrome/browser/page_load_metrics/observers/ad_metrics/page_ad_density_tracker.h b/chrome/browser/page_load_metrics/observers/ad_metrics/page_ad_density_tracker.h
new file mode 100644
index 0000000..b2f013d
--- /dev/null
+++ b/chrome/browser/page_load_metrics/observers/ad_metrics/page_ad_density_tracker.h
@@ -0,0 +1,96 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CHROME_BROWSER_PAGE_LOAD_METRICS_OBSERVERS_AD_METRICS_PAGE_AD_DENSITY_TRACKER_H_
+#define CHROME_BROWSER_PAGE_LOAD_METRICS_OBSERVERS_AD_METRICS_PAGE_AD_DENSITY_TRACKER_H_
+
+#include <set>
+#include <unordered_map>
+
+#include "base/optional.h"
+#include "ui/gfx/geometry/rect.h"
+
+// Tracks the ad density of a page through the page's lifecycle.
+// It has the following usage:
+//    1. Set subframe and mainframe rects using subframe and mainframe rect
+//        operations (AddRect, RemoveRect, UpdateMainFrameRect).
+//    2. Once a page has a main frame rect, get current density using
+//        DensityByHeight or DensityByArea.
+class PageAdDensityTracker {
+ public:
+  PageAdDensityTracker();
+  ~PageAdDensityTracker();
+
+  PageAdDensityTracker(const PageAdDensityTracker&) = delete;
+  PageAdDensityTracker& operator=(const PageAdDensityTracker&) = delete;
+
+  // Operations to track sub frame rects in the page density calcluation.
+  void AddRect(int rect_id, const gfx::Rect& rect);
+
+  // Removes a rect from the tracker if it is currently being tracked.
+  // Otherwise RemoveRect is a no op.
+  void RemoveRect(int rect_id);
+
+  // Operations to track the main frame dimensions. The main frame rect has to
+  // be set to calculate density.
+  void UpdateMainFrameRect(const gfx::Rect& rect);
+
+  // Returns the density by height, as a value from 0-100. If the density
+  // calculation fails (i.e. no main frame size), this returns -1. Percentage
+  // density by height is calculated as the the combined height of ads divided
+  // by the page's height.
+  int MaxPageAdDensityByHeight();
+
+  // Returns the density by area, as a value from 0-100. If the density
+  // calculation fails (i.e. no main frame size), this returns -1.
+  int MaxPageAdDensityByArea();
+
+ private:
+  // An event to process corresponding to the top or bottom of each rect.
+  struct RectEvent {
+    RectEvent(int id, bool is_bottom, const gfx::Rect& rect);
+    RectEvent(const RectEvent& other);
+
+    // A unique identifier set when adding and removing rect events
+    // corresponding to a single rect.
+    int rect_id;
+    bool is_bottom;
+    gfx::Rect rect;
+
+    // RectEvents are sorted by descending y value of the segment associated
+    // with the event.
+    bool operator<(const RectEvent& rhs) const;
+  };
+
+  // Iterators into the set of rect events for efficient removal of
+  // rect events by rect_id. Maintained by |rect_events_iterators_|.
+  struct RectEventSetIterators {
+    RectEventSetIterators(std::set<RectEvent>::iterator top,
+                          std::set<RectEvent>::iterator bottom);
+    RectEventSetIterators(const RectEventSetIterators& other);
+
+    std::set<RectEvent>::const_iterator top_it;
+    std::set<RectEvent>::const_iterator bottom_it;
+  };
+
+  // Calculates the combined area and height of the set of rects, this populates
+  // total_height_ and total_area_.
+  void CalculateDensity();
+
+  // Maintain a sorted set of rect events for use in calculating ad area.
+  std::set<RectEvent> rect_events_;
+
+  // Map from rect_id to iterators of rect events in rect_events_. This allows
+  // efficient removal according to rect_id.
+  std::unordered_map<int, RectEventSetIterators> rect_events_iterators_;
+
+  // Percentage of page ad density as a value from 0-100. These only have
+  // a value of -1 when ad density has not yet been calculated successfully.
+  int max_page_ad_density_by_area_ = -1;
+  int max_page_ad_density_by_height_ = -1;
+
+  base::Optional<gfx::Rect> last_main_frame_size_;
+};
+
+#endif  // CHROME_BROWSER_PAGE_LOAD_METRICS_OBSERVERS_AD_METRICS_PAGE_AD_DENSITY_TRACKER_H_"
diff --git a/chrome/browser/page_load_metrics/observers/ad_metrics/page_ad_density_tracker_unittest.cc b/chrome/browser/page_load_metrics/observers/ad_metrics/page_ad_density_tracker_unittest.cc
new file mode 100644
index 0000000..65d92c7
--- /dev/null
+++ b/chrome/browser/page_load_metrics/observers/ad_metrics/page_ad_density_tracker_unittest.cc
@@ -0,0 +1,98 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include <limits>
+
+#include "chrome/browser/page_load_metrics/observers/ad_metrics/page_ad_density_tracker.h"
+#include "testing/gtest/include/gtest/gtest.h"
+#include "ui/gfx/geometry/rect.h"
+
+TEST(PageAdDensityTrackerTest, MultipleRects_MaxPageDensityByAreaCalculated) {
+  PageAdDensityTracker tracker;
+
+  // Page ad density is -1 before there is a main frame or subframes.
+  EXPECT_EQ(tracker.MaxPageAdDensityByArea(), -1);
+
+  tracker.UpdateMainFrameRect(gfx::Rect(0, 0, 100, 100));
+  tracker.AddRect(1 /* rect_id */, gfx::Rect(0, 0, 100, 10));
+  EXPECT_EQ(tracker.MaxPageAdDensityByArea(), 10);
+
+  tracker.AddRect(2 /* rect_id */, gfx::Rect(5, 5, 100, 10));
+  EXPECT_EQ(tracker.MaxPageAdDensityByArea(), 15);
+
+  tracker.AddRect(3 /* rect_id */, gfx::Rect(50, 50, 50, 50));
+  EXPECT_EQ(tracker.MaxPageAdDensityByArea(), 40);
+
+  // Removing a rect should not change the maximum ad density.
+  tracker.RemoveRect(3 /* rect_id */);
+  EXPECT_EQ(tracker.MaxPageAdDensityByArea(), 40);
+}
+
+TEST(PageAdDensityTrackerTest, MultipleRects_MaxPageDensityByHeightCalculated) {
+  PageAdDensityTracker tracker;
+
+  // Page ad density is -1 before there is a main frame or subframes.
+  EXPECT_EQ(tracker.MaxPageAdDensityByHeight(), -1);
+
+  tracker.UpdateMainFrameRect(gfx::Rect(0, 0, 100, 100));
+  tracker.AddRect(1 /* rect_id */, gfx::Rect(0, 0, 100, 10));
+  EXPECT_EQ(tracker.MaxPageAdDensityByHeight(), 10);
+
+  tracker.AddRect(2 /* rect_id */, gfx::Rect(5, 5, 100, 10));
+  EXPECT_EQ(tracker.MaxPageAdDensityByHeight(), 15);
+
+  tracker.AddRect(3 /* rect_id */, gfx::Rect(50, 50, 50, 50));
+  EXPECT_EQ(tracker.MaxPageAdDensityByHeight(), 65);
+
+  // Removing a rect should not change the maximum ad density.
+  tracker.RemoveRect(3 /* rect_id */);
+  EXPECT_EQ(tracker.MaxPageAdDensityByHeight(), 65);
+}
+
+// Remove a rect that was added twice, the second RemoveRect is
+// ignored as it is no longer being tracked.
+TEST(PageAdDensityTrackerTest, RemoveRectTwice_SecondRemoveIgnored) {
+  PageAdDensityTracker tracker;
+
+  tracker.AddRect(1 /* rect_id */, gfx::Rect(0, 0, 100, 10));
+  tracker.RemoveRect(1 /* rect_id */);
+  tracker.RemoveRect(1 /* rect_id */);
+}
+
+// Ensures that two rects with the same dimensions hash to different
+// values in the density tracker's frame set.
+TEST(PageAdDensityTrackerTest, SeperateRects_SameDimensions) {
+  PageAdDensityTracker tracker;
+
+  tracker.UpdateMainFrameRect(gfx::Rect(0, 0, 100, 100));
+
+  tracker.AddRect(1 /* rect_id */, gfx::Rect(0, 0, 100, 10));
+  tracker.AddRect(2 /* rect_id */, gfx::Rect(0, 0, 100, 10));
+  EXPECT_EQ(tracker.MaxPageAdDensityByArea(), 10);
+
+  tracker.RemoveRect(1 /* rect_id */);
+  tracker.RemoveRect(2 /* rect_id */);
+  EXPECT_EQ(tracker.MaxPageAdDensityByArea(), 10);
+}
+
+// Create 2 rects whose total area overflow an int.
+TEST(PageAdDensityTrackerTest, OverflowTotalAreaAndHeight) {
+  PageAdDensityTracker tracker;
+
+  tracker.AddRect(1 /* rect_id */, gfx::Rect(std::numeric_limits<int>::min(), 0,
+                                             std::numeric_limits<int>::max(),
+                                             std::numeric_limits<int>::max()));
+  tracker.AddRect(2 /* rect_id */, gfx::Rect(std::numeric_limits<int>::min(),
+                                             std::numeric_limits<int>::max(),
+                                             std::numeric_limits<int>::max(),
+                                             std::numeric_limits<int>::max()));
+
+  // Update main frame rect to force a calculation.
+  tracker.UpdateMainFrameRect(gfx::Rect(0, 0, 100, 100));
+
+  // Density should not be updated as the sum of area
+  // or height overflows.
+  EXPECT_EQ(tracker.MaxPageAdDensityByArea(), -1);
+  EXPECT_EQ(tracker.MaxPageAdDensityByHeight(), -1);
+}
diff --git a/chrome/browser/page_load_metrics/observers/amp_page_load_metrics_observer.cc b/chrome/browser/page_load_metrics/observers/amp_page_load_metrics_observer.cc
index eee08cf..c1191622 100644
--- a/chrome/browser/page_load_metrics/observers/amp_page_load_metrics_observer.cc
+++ b/chrome/browser/page_load_metrics/observers/amp_page_load_metrics_observer.cc
@@ -130,6 +130,10 @@
   if (!navigation_handle->HasCommitted())
     return;
 
+  // Ignore same document navigations; see crbug.com/1104365
+  if (navigation_handle->IsSameDocument())
+    return;
+
   // A new navigation is committing, so ensure any old information associated
   // with this frame is discarded.
   amp_subframe_info_.erase(navigation_handle->GetRenderFrameHost());
diff --git a/chrome/browser/page_load_metrics/page_load_metrics_browsertest.cc b/chrome/browser/page_load_metrics/page_load_metrics_browsertest.cc
index 26bc504d..d504670 100644
--- a/chrome/browser/page_load_metrics/page_load_metrics_browsertest.cc
+++ b/chrome/browser/page_load_metrics/page_load_metrics_browsertest.cc
@@ -78,14 +78,8 @@
 #include "content/public/test/test_navigation_observer.h"
 #include "net/base/net_errors.h"
 #include "net/dns/mock_host_resolver.h"
-#include "net/http/http_cache.h"
 #include "net/test/embedded_test_server/controllable_http_response.h"
 #include "net/test/embedded_test_server/embedded_test_server.h"
-#include "net/test/url_request/url_request_failed_job.h"
-#include "net/test/url_request/url_request_mock_http_job.h"
-#include "net/url_request/url_request_context.h"
-#include "net/url_request/url_request_context_getter.h"
-#include "net/url_request/url_request_filter.h"
 #include "services/metrics/public/cpp/ukm_builders.h"
 #include "services/network/public/cpp/features.h"
 #include "testing/gmock/include/gmock/gmock.h"
diff --git a/chrome/browser/password_manager/password_manager_test_base.cc b/chrome/browser/password_manager/password_manager_test_base.cc
index eb8199a..450225e7 100644
--- a/chrome/browser/password_manager/password_manager_test_base.cc
+++ b/chrome/browser/password_manager/password_manager_test_base.cc
@@ -40,8 +40,6 @@
 #include "net/dns/mock_host_resolver.h"
 #include "net/http/transport_security_state.h"
 #include "net/test/embedded_test_server/embedded_test_server.h"
-#include "net/url_request/url_request_context.h"
-#include "net/url_request/url_request_context_getter.h"
 #include "testing/gmock/include/gmock/gmock.h"
 
 namespace {
diff --git a/chrome/browser/payments/manifest_verifier_browsertest.cc b/chrome/browser/payments/manifest_verifier_browsertest.cc
index 2dcf3aa..840ed420 100644
--- a/chrome/browser/payments/manifest_verifier_browsertest.cc
+++ b/chrome/browser/payments/manifest_verifier_browsertest.cc
@@ -21,7 +21,6 @@
 #include "content/public/browser/storage_partition.h"
 #include "content/public/test/browser_test.h"
 #include "net/test/embedded_test_server/embedded_test_server.h"
-#include "net/url_request/url_request_context_getter.h"
 #include "testing/gtest/include/gtest/gtest.h"
 #include "third_party/re2/src/re2/re2.h"
 #include "url/origin.h"
diff --git a/chrome/browser/payments/service_worker_payment_app_finder_browsertest.cc b/chrome/browser/payments/service_worker_payment_app_finder_browsertest.cc
index 0162a3e..56d289a1 100644
--- a/chrome/browser/payments/service_worker_payment_app_finder_browsertest.cc
+++ b/chrome/browser/payments/service_worker_payment_app_finder_browsertest.cc
@@ -28,7 +28,6 @@
 #include "content/public/test/browser_test.h"
 #include "net/dns/mock_host_resolver.h"
 #include "net/test/embedded_test_server/embedded_test_server.h"
-#include "net/url_request/url_request_context_getter.h"
 #include "testing/gtest/include/gtest/gtest.h"
 #include "third_party/re2/src/re2/re2.h"
 
diff --git a/chrome/browser/policy/cloud/cloud_policy_browsertest.cc b/chrome/browser/policy/cloud/cloud_policy_browsertest.cc
index 175ac62..f71013b 100644
--- a/chrome/browser/policy/cloud/cloud_policy_browsertest.cc
+++ b/chrome/browser/policy/cloud/cloud_policy_browsertest.cc
@@ -55,7 +55,6 @@
 #include "content/public/browser/notification_source.h"
 #include "content/public/test/browser_test.h"
 #include "content/public/test/test_utils.h"
-#include "net/url_request/url_request_context_getter.h"
 #include "testing/gmock/include/gmock/gmock.h"
 #include "testing/gtest/include/gtest/gtest.h"
 #include "url/gurl.h"
diff --git a/chrome/browser/policy/cloud/component_cloud_policy_browsertest.cc b/chrome/browser/policy/cloud/component_cloud_policy_browsertest.cc
index 4c087a7..a2e39169 100644
--- a/chrome/browser/policy/cloud/component_cloud_policy_browsertest.cc
+++ b/chrome/browser/policy/cloud/component_cloud_policy_browsertest.cc
@@ -36,7 +36,6 @@
 #include "content/public/test/browser_test.h"
 #include "extensions/common/extension.h"
 #include "extensions/test/extension_test_message_listener.h"
-#include "net/url_request/url_request_context_getter.h"
 #include "testing/gmock/include/gmock/gmock.h"
 #include "testing/gtest/include/gtest/gtest.h"
 #if defined(OS_CHROMEOS)
diff --git a/chrome/browser/policy/cloud/device_management_service_browsertest.cc b/chrome/browser/policy/cloud/device_management_service_browsertest.cc
index 8076940..c2295fed 100644
--- a/chrome/browser/policy/cloud/device_management_service_browsertest.cc
+++ b/chrome/browser/policy/cloud/device_management_service_browsertest.cc
@@ -23,7 +23,6 @@
 #include "content/public/test/browser_test.h"
 #include "net/base/upload_bytes_element_reader.h"
 #include "net/base/upload_data_stream.h"
-#include "net/url_request/url_request.h"
 #include "services/network/public/cpp/weak_wrapper_shared_url_loader_factory.h"
 #include "services/network/test/test_url_loader_factory.h"
 #include "services/network/test/test_utils.h"
diff --git a/chrome/browser/policy/cloud/user_policy_signin_service_factory.cc b/chrome/browser/policy/cloud/user_policy_signin_service_factory.cc
index 25ce174..44af5e6 100644
--- a/chrome/browser/policy/cloud/user_policy_signin_service_factory.cc
+++ b/chrome/browser/policy/cloud/user_policy_signin_service_factory.cc
@@ -16,7 +16,6 @@
 #include "components/policy/core/browser/browser_policy_connector.h"
 #include "components/pref_registry/pref_registry_syncable.h"
 #include "components/prefs/pref_service.h"
-#include "net/url_request/url_request_context_getter.h"
 #include "services/network/public/cpp/shared_url_loader_factory.h"
 
 #if defined(OS_ANDROID)
diff --git a/chrome/browser/policy/cloud/user_policy_signin_service_mobile.cc b/chrome/browser/policy/cloud/user_policy_signin_service_mobile.cc
index eda3f02..c7a338bf 100644
--- a/chrome/browser/policy/cloud/user_policy_signin_service_mobile.cc
+++ b/chrome/browser/policy/cloud/user_policy_signin_service_mobile.cc
@@ -22,7 +22,6 @@
 #include "components/prefs/pref_service.h"
 #include "components/signin/public/identity_manager/identity_manager.h"
 #include "net/base/network_change_notifier.h"
-#include "net/url_request/url_request_context_getter.h"
 #include "services/network/public/cpp/shared_url_loader_factory.h"
 
 namespace em = enterprise_management;
diff --git a/chrome/browser/policy/file_selection_dialogs_policy_handler_unittest.cc b/chrome/browser/policy/file_selection_dialogs_policy_handler_unittest.cc
index 65b4145..4db1b4b 100644
--- a/chrome/browser/policy/file_selection_dialogs_policy_handler_unittest.cc
+++ b/chrome/browser/policy/file_selection_dialogs_policy_handler_unittest.cc
@@ -31,8 +31,8 @@
 
 TEST_F(FileSelectionDialogsPolicyTest, EnableFileSelectionDialogs) {
   policy_.Set(key::kAllowFileSelectionDialogs, POLICY_LEVEL_MANDATORY,
-              POLICY_SCOPE_USER, POLICY_SOURCE_CLOUD,
-              std::make_unique<base::Value>(true), nullptr);
+              POLICY_SCOPE_USER, POLICY_SOURCE_CLOUD, base::Value(true),
+              nullptr);
   handler_.ApplyPolicySettings(policy_, &prefs_);
 
   // Allowing file-selection dialogs should not influence the PromptForDownload
@@ -42,8 +42,8 @@
 
 TEST_F(FileSelectionDialogsPolicyTest, DisableFileSelectionDialogs) {
   policy_.Set(key::kAllowFileSelectionDialogs, POLICY_LEVEL_MANDATORY,
-              POLICY_SCOPE_USER, POLICY_SOURCE_CLOUD,
-              std::make_unique<base::Value>(false), nullptr);
+              POLICY_SCOPE_USER, POLICY_SOURCE_CLOUD, base::Value(false),
+              nullptr);
   handler_.ApplyPolicySettings(policy_, &prefs_);
 
   // Disabling file-selection dialogs should disable the PromptForDownload pref.
diff --git a/chrome/browser/policy/messaging_layer/storage/storage_queue.cc b/chrome/browser/policy/messaging_layer/storage/storage_queue.cc
index 8512059..065824c 100644
--- a/chrome/browser/policy/messaging_layer/storage/storage_queue.cc
+++ b/chrome/browser/policy/messaging_layer/storage/storage_queue.cc
@@ -250,13 +250,23 @@
       LOG(ERROR) << "Incomplete record in file " << last_file->name();
       break;
     }
-    // Everything looks all right. Advance the sequencing number.
+    // Verify sequencing number.
     if (header.record_seq_number != next_seq_number_) {
       LOG(ERROR) << "Sequencing number mismatch, expected=" << next_seq_number_
                  << ", actual=" << header.record_seq_number << ", file "
                  << last_file->name();
       break;
     }
+    // Verify record hash.
+    uint32_t actual_record_hash = base::PersistentHash(
+        read_result.ValueOrDie().data(), header.record_size);
+    if (header.record_hash != actual_record_hash) {
+      LOG(ERROR) << "Hash mismatch, seq=" << header.record_seq_number
+                 << " expected_hash=" << std::hex << actual_record_hash
+                 << " actual_hash=" << std::hex << header.record_hash;
+      break;
+    }
+    // Everything looks all right. Advance the sequencing number.
     ++next_seq_number_;
   }
   return Status::StatusOK();
@@ -313,7 +323,7 @@
   RecordHeader header;
   // Assign sequence number.
   header.record_seq_number = next_seq_number_++;
-  header.record_hash = 0;  // TODO(b/157940996): Add hash calculation
+  header.record_hash = base::PersistentHash(data);
   header.record_size = data.size();
   // Write to the last file, update sequencing number.
   auto open_status = file->Open(/*read_only=*/false);
@@ -497,8 +507,9 @@
       return Status(error::INTERNAL,
                     base::StrCat({"File corrupt: ", (*current_file_)->name()}));
     }
-    // Check the header match.
-    const RecordHeader& header =
+    // Copy the header out (its memory can be overwritten when reading rest of
+    // the data).
+    const RecordHeader header =
         *reinterpret_cast<const RecordHeader*>(header_data.data());
     if (header.record_seq_number != seq_number) {
       return Status(
@@ -507,9 +518,10 @@
                         " seq=", base::NumberToString(header.record_seq_number),
                         " expected=", base::NumberToString(seq_number)}));
     }
-    // TODO(b/157940996): Add hash verification.
     // Read the record blob (align size to FRAME_SIZE).
     const size_t data_size = RoundUpToFrameSize(header.record_size);
+    // From this point on, header in memory is no longer used and can be
+    // overwritten when reading rest of the data.
     read_result = (*current_file_)->Read(current_pos_, data_size);
     RETURN_IF_ERROR(read_result.status());
     current_pos_ += read_result.ValueOrDie().size();
@@ -521,6 +533,23 @@
                         base::NumberToString(read_result.ValueOrDie().size()),
                         " expected=", base::NumberToString(data_size)}));
     }
+    // Verify record hash.
+    uint32_t actual_record_hash = base::PersistentHash(
+        read_result.ValueOrDie().data(), header.record_size);
+    if (header.record_hash != actual_record_hash) {
+      return Status(
+          error::INTERNAL,
+          base::StrCat(
+              {"File corrupt: ", (*current_file_)->name(), " seq=",
+               base::NumberToString(header.record_seq_number), " hash=",
+               base::HexEncode(
+                   reinterpret_cast<const uint8_t*>(&header.record_hash),
+                   sizeof(header.record_hash)),
+               " expected=",
+               base::HexEncode(
+                   reinterpret_cast<const uint8_t*>(&actual_record_hash),
+                   sizeof(actual_record_hash))}));
+    }
     return read_result.ValueOrDie().first(header.record_size);
   }
 
diff --git a/chrome/browser/predictors/loading_data_collector.cc b/chrome/browser/predictors/loading_data_collector.cc
index e531759..f566291 100644
--- a/chrome/browser/predictors/loading_data_collector.cc
+++ b/chrome/browser/predictors/loading_data_collector.cc
@@ -18,7 +18,6 @@
 #include "content/public/browser/browser_thread.h"
 #include "net/base/mime_util.h"
 #include "net/http/http_response_headers.h"
-#include "net/url_request/url_request.h"
 #include "services/network/public/mojom/fetch_api.mojom-shared.h"
 #include "third_party/blink/public/common/loader/resource_type_util.h"
 #include "third_party/blink/public/common/mime_util/mime_util.h"
diff --git a/chrome/browser/predictors/loading_predictor_browsertest.cc b/chrome/browser/predictors/loading_predictor_browsertest.cc
index ad68683..63bd581 100644
--- a/chrome/browser/predictors/loading_predictor_browsertest.cc
+++ b/chrome/browser/predictors/loading_predictor_browsertest.cc
@@ -58,9 +58,6 @@
 #include "net/test/embedded_test_server/http_response.h"
 #include "net/test/embedded_test_server/request_handler_util.h"
 #include "net/traffic_annotation/network_traffic_annotation_test_helper.h"
-#include "net/url_request/url_request_filter.h"
-#include "net/url_request/url_request_interceptor.h"
-#include "net/url_request/url_request_test_job.h"
 #include "services/network/public/cpp/resource_request.h"
 #include "services/network/public/cpp/simple_url_loader.h"
 #include "testing/gmock/include/gmock/gmock.h"
diff --git a/chrome/browser/predictors/loading_predictor_unittest.cc b/chrome/browser/predictors/loading_predictor_unittest.cc
index ff09e04..e5507c0 100644
--- a/chrome/browser/predictors/loading_predictor_unittest.cc
+++ b/chrome/browser/predictors/loading_predictor_unittest.cc
@@ -19,7 +19,6 @@
 #include "content/public/test/browser_task_environment.h"
 #include "content/public/test/test_utils.h"
 #include "net/base/network_isolation_key.h"
-#include "net/url_request/url_request_context.h"
 #include "testing/gmock/include/gmock/gmock.h"
 #include "testing/gtest/include/gtest/gtest.h"
 #include "url/origin.h"
diff --git a/chrome/browser/predictors/loading_test_util.cc b/chrome/browser/predictors/loading_test_util.cc
index 3339bde..e16f779 100644
--- a/chrome/browser/predictors/loading_test_util.cc
+++ b/chrome/browser/predictors/loading_test_util.cc
@@ -8,9 +8,8 @@
 #include <memory>
 #include <utility>
 
-#include "net/http/http_response_headers.h"
+#include "net/base/request_priority.h"
 #include "net/traffic_annotation/network_traffic_annotation_test_helper.h"
-#include "net/url_request/url_request_test_util.h"
 
 namespace {
 
diff --git a/chrome/browser/prerender/isolated/isolated_prerender_from_string_url_loader.cc b/chrome/browser/prerender/isolated/isolated_prerender_from_string_url_loader.cc
index 74aee10..f5689f0 100644
--- a/chrome/browser/prerender/isolated/isolated_prerender_from_string_url_loader.cc
+++ b/chrome/browser/prerender/isolated/isolated_prerender_from_string_url_loader.cc
@@ -13,7 +13,6 @@
 #include "content/public/browser/web_contents.h"
 #include "mojo/public/cpp/system/simple_watcher.h"
 #include "net/base/io_buffer.h"
-#include "net/url_request/url_request.h"
 #include "services/network/public/cpp/resource_request.h"
 #include "services/network/public/mojom/url_response_head.mojom.h"
 
diff --git a/chrome/browser/prerender/prerender_nostate_prefetch_browsertest.cc b/chrome/browser/prerender/prerender_nostate_prefetch_browsertest.cc
index 942ba32..c6b6b96 100644
--- a/chrome/browser/prerender/prerender_nostate_prefetch_browsertest.cc
+++ b/chrome/browser/prerender/prerender_nostate_prefetch_browsertest.cc
@@ -58,11 +58,10 @@
 #include "net/base/escape.h"
 #include "net/base/features.h"
 #include "net/base/load_flags.h"
+#include "net/base/request_priority.h"
 #include "net/cookies/cookie_store.h"
 #include "net/dns/mock_host_resolver.h"
 #include "net/test/embedded_test_server/request_handler_util.h"
-#include "net/url_request/url_request_context.h"
-#include "net/url_request/url_request_context_getter.h"
 #include "services/network/public/cpp/features.h"
 #include "services/network/public/mojom/cookie_manager.mojom.h"
 #include "testing/gtest/include/gtest/gtest.h"
diff --git a/chrome/browser/printing/cloud_print/gcd_api_flow_impl.cc b/chrome/browser/printing/cloud_print/gcd_api_flow_impl.cc
index a2bdf7f..4a8b984 100644
--- a/chrome/browser/printing/cloud_print/gcd_api_flow_impl.cc
+++ b/chrome/browser/printing/cloud_print/gcd_api_flow_impl.cc
@@ -23,9 +23,9 @@
 #include "components/signin/public/identity_manager/scope_set.h"
 #include "google_apis/gaia/google_service_auth_error.h"
 #include "net/base/load_flags.h"
+#include "net/base/net_errors.h"
 #include "net/base/url_util.h"
 #include "net/http/http_status_code.h"
-#include "net/url_request/url_request_status.h"
 #include "services/network/public/cpp/resource_request.h"
 #include "services/network/public/cpp/shared_url_loader_factory.h"
 #include "services/network/public/cpp/simple_url_loader.h"
diff --git a/chrome/browser/printing/cloud_print/privet_local_printer_lister_unittest.cc b/chrome/browser/printing/cloud_print/privet_local_printer_lister_unittest.cc
index c9e4ada..8ce760c 100644
--- a/chrome/browser/printing/cloud_print/privet_local_printer_lister_unittest.cc
+++ b/chrome/browser/printing/cloud_print/privet_local_printer_lister_unittest.cc
@@ -14,7 +14,6 @@
 #include "chrome/browser/local_discovery/test_service_discovery_client.h"
 #include "chrome/browser/printing/cloud_print/privet_http_asynchronous_factory_impl.h"
 #include "content/public/test/browser_task_environment.h"
-#include "net/url_request/url_request_test_util.h"
 #include "services/network/public/cpp/weak_wrapper_shared_url_loader_factory.h"
 #include "services/network/test/test_url_loader_factory.h"
 #include "testing/gmock/include/gmock/gmock.h"
diff --git a/chrome/browser/profiles/android/profile_manager_utils.cc b/chrome/browser/profiles/android/profile_manager_utils.cc
index c77419f..d5c3aa9 100644
--- a/chrome/browser/profiles/android/profile_manager_utils.cc
+++ b/chrome/browser/profiles/android/profile_manager_utils.cc
@@ -14,8 +14,6 @@
 #include "content/public/browser/browser_context.h"
 #include "content/public/browser/browser_thread.h"
 #include "content/public/browser/storage_partition.h"
-#include "net/url_request/url_request_context.h"
-#include "net/url_request/url_request_context_getter.h"
 #include "services/network/public/mojom/cookie_manager.mojom.h"
 
 using base::android::JavaParamRef;
diff --git a/chrome/browser/profiles/profile_avatar_downloader.cc b/chrome/browser/profiles/profile_avatar_downloader.cc
index 93cd389..40913ea 100644
--- a/chrome/browser/profiles/profile_avatar_downloader.cc
+++ b/chrome/browser/profiles/profile_avatar_downloader.cc
@@ -14,6 +14,7 @@
 #include "chrome/browser/profiles/profile_avatar_icon_util.h"
 #include "net/base/load_flags.h"
 #include "net/traffic_annotation/network_traffic_annotation.h"
+#include "net/url_request/referrer_policy.h"
 #include "ui/gfx/image/image.h"
 
 namespace {
@@ -66,7 +67,7 @@
   if (loader_factory) {
     fetcher_->Init(
         std::string(),
-        net::URLRequest::REDUCE_REFERRER_GRANULARITY_ON_TRANSITION_CROSS_ORIGIN,
+        net::ReferrerPolicy::REDUCE_GRANULARITY_ON_TRANSITION_CROSS_ORIGIN,
         network::mojom::CredentialsMode::kInclude);
     fetcher_->Start(loader_factory);
   }
diff --git a/chrome/browser/profiles/profile_manager.cc b/chrome/browser/profiles/profile_manager.cc
index eef9591..c69b4d78 100644
--- a/chrome/browser/profiles/profile_manager.cc
+++ b/chrome/browser/profiles/profile_manager.cc
@@ -101,10 +101,6 @@
 #include "content/public/browser/storage_partition.h"
 #include "content/public/common/content_switches.h"
 #include "extensions/buildflags/buildflags.h"
-#include "net/http/http_transaction_factory.h"
-#include "net/url_request/url_request_context.h"
-#include "net/url_request/url_request_context_getter.h"
-#include "net/url_request/url_request_job.h"
 #include "ui/base/l10n/l10n_util.h"
 
 #if BUILDFLAG(ENABLE_EXTENSIONS)
diff --git a/chrome/browser/resources/chromeos/login/update_required_card.html b/chrome/browser/resources/chromeos/login/update_required_card.html
index 0043668..389e2a26 100644
--- a/chrome/browser/resources/chromeos/login/update_required_card.html
+++ b/chrome/browser/resources/chromeos/login/update_required_card.html
@@ -17,7 +17,8 @@
 
     <oobe-dialog has-buttons hidden="[[showOn_(ui_state,
         'update-required-message')]]" id="update-required-dialog"
-        title-key="updateRequiredTitle">
+        title-key="updateRequiredTitle" role="dialog"
+        aria-label$="[[i18nDynamic(locale, 'updateRequiredTitle')]]">
       <hd-iron-icon slot="oobe-icon"
           icon1x="oobe-32:enterprise" icon2x="oobe-64:enterprise">
       </hd-iron-icon>
@@ -38,9 +39,9 @@
     </oobe-dialog>
 
     <oobe-dialog has-buttons hidden="[[showOn_(ui_state,
-        'update-error')]]" id="update-required-error-dialog"
-        title-key="updateRequiredTitle"
-        subtitle-key="errorMessage">
+        'update-error')]]" id="update-required-error-dialog" role="dialog"
+        title-key="updateRequiredTitle" subtitle-key="errorMessage"
+        aria-label$="[[i18nDynamic(locale, 'updateRequiredTitle')]]">
       <hd-iron-icon slot="oobe-icon"
           icon1x="oobe-32:enterprise" icon2x="oobe-64:enterprise">
       </hd-iron-icon>
@@ -55,6 +56,7 @@
     </oobe-dialog>
 
     <checking-downloading-update id="checking-downloading-update"
+        aria-label$="[[i18nDynamic(locale, 'updateScreenAccessibleTitle')]]"
         hidden="[[showOn_(ui_state, 'update-process',
                 'update-completed-need-reboot')]]"
         checking-for-update="[[updateProgressUnavailable]]"
@@ -70,7 +72,8 @@
 
     <oobe-dialog hidden="[[showOn_(ui_state, 'update-need-permission')]]"
         has-buttons title-key="updateRequiredTitle"
-        id="update-need-permission-dialog">
+        id="update-need-permission-dialog" role="dialog"
+        aria-label$="[[i18nDynamic(locale, 'updateRequiredTitle')]]">
       <hd-iron-icon slot="oobe-icon"
           icon1x="oobe-32:enterprise" icon2x="oobe-64:enterprise">
       </hd-iron-icon>
@@ -93,7 +96,8 @@
 
     <oobe-dialog hidden="[[showOn_(ui_state, 'update-no-network')]]"
         has-buttons title-key="updateRequiredTitle"
-        id="update-required-no-network-dialog">
+        id="update-required-no-network-dialog" role="dialog"
+        aria-label$="[[i18nDynamic(locale, 'updateRequiredTitle')]]">
       <hd-iron-icon slot="oobe-icon"
         icon1x="oobe-32:enterprise" icon2x="oobe-64:enterprise">
       </hd-iron-icon>
@@ -116,8 +120,8 @@
 
     <oobe-dialog
         hidden="[[showOn_(ui_state, 'eol')]]" id="eolDialog"
-        title-key="eolTitle"
-        subtitle-key="eolMessage">
+        title-key="eolTitle" subtitle-key="eolMessage" role="dialog"
+        aria-label$="[[i18nDynamic(locale, 'eolTitle')]]">
       <hd-iron-icon slot="oobe-icon" id="eolAlertIcon"
           icon1x="oobe-32:warning" icon2x="oobe-64:warning">
       </hd-iron-icon>
diff --git a/chrome/browser/resources/inline_login/inline_login.js b/chrome/browser/resources/inline_login/inline_login.js
index a0988731..eff9fe3b 100644
--- a/chrome/browser/resources/inline_login/inline_login.js
+++ b/chrome/browser/resources/inline_login/inline_login.js
@@ -69,6 +69,7 @@
     cr.addWebUIListener('show-back-button', showBackButton);
     cr.addWebUIListener('load-auth-extension', loadAuthExtension);
     cr.addWebUIListener('close-dialog', closeDialog);
+    cr.addWebUIListener('send-lst-fetch-results', sendLSTFetchResults);
 
     authExtHost = new cr.login.Authenticator('signin-frame');
     authExtHost.addEventListener('dropLink', onDropLink);
@@ -155,7 +156,6 @@
 
   return {
     closeDialog: closeDialog,
-    sendLSTFetchResults: sendLSTFetchResults,
     getAuthExtHost: getAuthExtHost,
     handleOAuth2TokenFailure: handleOAuth2TokenFailure,
     initialize: initialize,
diff --git a/chrome/browser/safe_browsing/client_side_detection_host.cc b/chrome/browser/safe_browsing/client_side_detection_host.cc
index 2c4909e8..0e72a7cd 100644
--- a/chrome/browser/safe_browsing/client_side_detection_host.cc
+++ b/chrome/browser/safe_browsing/client_side_detection_host.cc
@@ -575,16 +575,18 @@
   csd_service_ = service;
 }
 
-void ClientSideDetectionHost::set_safe_browsing_managers(
-    SafeBrowsingUIManager* ui_manager,
-    SafeBrowsingDatabaseManager* database_manager) {
+void ClientSideDetectionHost::set_ui_manager(
+    SafeBrowsingUIManager* ui_manager) {
   if (ui_manager_.get())
     ui_manager_->RemoveObserver(this);
 
   ui_manager_ = ui_manager;
   if (ui_manager)
     ui_manager_->AddObserver(this);
+}
 
+void ClientSideDetectionHost::set_database_manager(
+    SafeBrowsingDatabaseManager* database_manager) {
   database_manager_ = database_manager;
 }
 
diff --git a/chrome/browser/safe_browsing/client_side_detection_host.h b/chrome/browser/safe_browsing/client_side_detection_host.h
index 9f0a69df..71c891a 100644
--- a/chrome/browser/safe_browsing/client_side_detection_host.h
+++ b/chrome/browser/safe_browsing/client_side_detection_host.h
@@ -70,14 +70,15 @@
   void RenderFrameCreated(content::RenderFrameHost* render_frame_host) override;
 
   // Used for testing.
-  void set_safe_browsing_managers(
-      SafeBrowsingUIManager* ui_manager,
-      SafeBrowsingDatabaseManager* database_manager);
+  void set_ui_manager(SafeBrowsingUIManager* ui_manager);
+  void set_database_manager(SafeBrowsingDatabaseManager* database_manager);
 
  private:
   friend class ClientSideDetectionHostTestBase;
   class ShouldClassifyUrlRequest;
   friend class ShouldClassifyUrlRequest;
+  FRIEND_TEST_ALL_PREFIXES(ClientSideDetectionHostBrowserTest,
+                           VerifyVisualFeatureCollection);
 
   // Called when pre-classification checks are done for the phishing
   // classifiers.
diff --git a/chrome/browser/safe_browsing/client_side_detection_host_browsertest.cc b/chrome/browser/safe_browsing/client_side_detection_host_browsertest.cc
index da14d3d..5a0ef8d 100644
--- a/chrome/browser/safe_browsing/client_side_detection_host_browsertest.cc
+++ b/chrome/browser/safe_browsing/client_side_detection_host_browsertest.cc
@@ -6,75 +6,138 @@
 
 #include "base/run_loop.h"
 #include "chrome/browser/profiles/profile.h"
+#include "chrome/browser/safe_browsing/client_side_detection_service.h"
 #include "chrome/browser/ui/browser.h"
 #include "chrome/browser/ui/tabs/tab_strip_model.h"
 #include "chrome/test/base/in_process_browser_test.h"
 #include "chrome/test/base/ui_test_utils.h"
 #include "components/prefs/pref_service.h"
+#include "components/safe_browsing/core/proto/client_model.pb.h"
+#include "content/public/test/browser_test.h"
+#include "testing/gmock/include/gmock/gmock.h"
 #include "testing/gtest/include/gtest/gtest.h"
 #include "url/gurl.h"
 
-using content::WebContents;
-
 namespace safe_browsing {
 namespace {
 
-class TestClientSideDetectionHost : public ClientSideDetectionHost {
- public:
-  explicit TestClientSideDetectionHost(WebContents* tab)
-      : ClientSideDetectionHost(tab) {}
+using ::testing::_;
+using ::testing::StrictMock;
 
- private:
-  void OnMalwarePreClassificationDone(bool should_classify_not_used) override {
-    ClientSideDetectionHost::OnMalwarePreClassificationDone(true);
+class FakeClientSideDetectionService : public ClientSideDetectionService {
+ public:
+  FakeClientSideDetectionService() : ClientSideDetectionService(nullptr) {}
+
+  void SendClientReportPhishingRequest(
+      ClientPhishingRequest* verdict,
+      bool is_extended_reporting,
+      bool is_enhanced_protection,
+      const ClientReportPhishingRequestCallback& callback) override {
+    saved_request_ = *verdict;
+    // TODO(drubery): This can be removed if SendClientReportPhishingRequest
+    // takes a unique_ptr<ClientPhishingRequest>, while also providing better
+    // guarantees about memory safety.
+    delete verdict;
+    saved_callback_ = callback;
+    request_callback_.Run();
   }
 
-  void DidStopLoading() override {}
+  const ClientPhishingRequest& saved_request() { return saved_request_; }
+  const ClientReportPhishingRequestCallback& saved_callback() {
+    return saved_callback_;
+  }
+
+  void SetModel(const ClientSideModel& model) { model_ = model; }
+
+  std::string GetModelStr() override { return model_.SerializeAsString(); }
+
+  void SetRequestCallback(const base::RepeatingClosure& closure) {
+    request_callback_ = closure;
+  }
+
+ private:
+  ClientPhishingRequest saved_request_;
+  ClientReportPhishingRequestCallback saved_callback_;
+  ClientSideModel model_;
+  base::RepeatingClosure request_callback_;
 };
 
-bool FindExpectedIPUrlInfo(const IPUrlInfo& expected_info,
-                           const std::vector<IPUrlInfo>& ip_url_vector) {
-  auto result = std::find_if(
-      ip_url_vector.begin(), ip_url_vector.end(),
-      [expected_info](const IPUrlInfo& ip_url_info) {
-        return expected_info.origin_of_final_url ==
-                   ip_url_info.origin_of_final_url &&
-               expected_info.method == ip_url_info.method &&
-               expected_info.referrer == ip_url_info.referrer &&
-               expected_info.resource_type == ip_url_info.resource_type;
-      });
-  return result != ip_url_vector.end();
-}
+class MockSafeBrowsingUIManager : public SafeBrowsingUIManager {
+ public:
+  MockSafeBrowsingUIManager() : SafeBrowsingUIManager(nullptr) {}
+
+  MOCK_METHOD1(DisplayBlockingPage, void(const UnsafeResource& resource));
+
+ protected:
+  ~MockSafeBrowsingUIManager() override = default;
+
+ private:
+  DISALLOW_COPY_AND_ASSIGN(MockSafeBrowsingUIManager);
+};
 
 }  // namespace
 
-using ClientSideDetectionHostBrowserTest = InProcessBrowserTest;
+class ClientSideDetectionHostBrowserTest : public InProcessBrowserTest {
+ public:
+  ClientSideDetectionHostBrowserTest() = default;
+  ~ClientSideDetectionHostBrowserTest() override = default;
+};
 
 IN_PROC_BROWSER_TEST_F(ClientSideDetectionHostBrowserTest,
-                       VerifyIPAddressCollection) {
-  browser()->profile()->GetPrefs()->SetBoolean(prefs::kSafeBrowsingEnabled,
-                                               false);
+                       VerifyVisualFeatureCollection) {
+  FakeClientSideDetectionService fake_csd_service;
+
+  ClientSideModel model;
+  model.set_version(123);
+  model.set_max_words_per_term(1);
+  VisualTarget* target = model.mutable_vision_model()->add_targets();
+
+  target->set_digest("target1_digest");
+  // Create a hash corresponding to a blank screen.
+  std::string hash = "\x30";
+  for (int i = 0; i < 288; i++)
+    hash += "\xff";
+  target->set_hash(hash);
+  target->set_dimension_size(48);
+  MatchRule* match_rule = target->mutable_match_config()->add_match_rule();
+  // The actual hash distance is 76, so set the distance to 100 for safety.
+  match_rule->set_hash_distance(100);
+
+  fake_csd_service.SetModel(model);
+
+  scoped_refptr<StrictMock<MockSafeBrowsingUIManager>> mock_ui_manager =
+      new StrictMock<MockSafeBrowsingUIManager>();
+
   ASSERT_TRUE(embedded_test_server()->Start());
-  std::unique_ptr<TestClientSideDetectionHost> csd_host =
-      std::make_unique<TestClientSideDetectionHost>(
+  std::unique_ptr<ClientSideDetectionHost> csd_host =
+      ClientSideDetectionHost::Create(
           browser()->tab_strip_model()->GetActiveWebContents());
+  csd_host->set_client_side_detection_service(&fake_csd_service);
+  csd_host->SendModelToRenderFrame();
+  csd_host->set_ui_manager(mock_ui_manager.get());
+
   GURL page_url(embedded_test_server()->GetURL("/safe_browsing/malware.html"));
   ui_test_utils::NavigateToURL(browser(), page_url);
 
-  BrowseInfo* browse_info = csd_host->GetBrowseInfo();
-  EXPECT_EQ(1u, browse_info->ips.size());
-  const std::vector<IPUrlInfo>& ip_urls =
-      browse_info->ips[embedded_test_server()->base_url().host()];
-  url::Origin expected_origin_of_final_url =
-      url::Origin::Create(embedded_test_server()->GetURL("/"));
-  IPUrlInfo expected_result_1(expected_origin_of_final_url.Serialize(), "GET",
-                              page_url.spec(),
-                              blink::mojom::ResourceType::kImage);
-  IPUrlInfo expected_result_2(expected_origin_of_final_url.Serialize(), "GET",
-                              page_url.spec(),
-                              blink::mojom::ResourceType::kSubFrame);
-  EXPECT_TRUE(FindExpectedIPUrlInfo(expected_result_1, ip_urls));
-  EXPECT_TRUE(FindExpectedIPUrlInfo(expected_result_2, ip_urls));
+  base::RunLoop run_loop;
+  fake_csd_service.SetRequestCallback(run_loop.QuitClosure());
+
+  // Bypass the pre-classification checks
+  csd_host->OnPhishingPreClassificationDone(/*should_classify=*/true);
+
+  run_loop.Run();
+
+  ASSERT_FALSE(fake_csd_service.saved_callback().is_null());
+
+  EXPECT_EQ(fake_csd_service.saved_request().model_version(), 123);
+  ASSERT_EQ(fake_csd_service.saved_request().vision_match_size(), 1);
+  EXPECT_EQ(
+      fake_csd_service.saved_request().vision_match(0).matched_target_digest(),
+      "target1_digest");
+
+  // Expect an interstitail to be shown
+  EXPECT_CALL(*mock_ui_manager, DisplayBlockingPage(_));
+  fake_csd_service.saved_callback().Run(page_url, true);
 }
 
 }  // namespace safe_browsing
diff --git a/chrome/browser/safe_browsing/client_side_detection_host_unittest.cc b/chrome/browser/safe_browsing/client_side_detection_host_unittest.cc
index 9cd71d9..2c8b614 100644
--- a/chrome/browser/safe_browsing/client_side_detection_host_unittest.cc
+++ b/chrome/browser/safe_browsing/client_side_detection_host_unittest.cc
@@ -295,8 +295,8 @@
 
     csd_host_ = ClientSideDetectionHost::Create(web_contents());
     csd_host_->set_client_side_detection_service(csd_service_.get());
-    csd_host_->set_safe_browsing_managers(ui_manager_.get(),
-                                          database_manager_.get());
+    csd_host_->set_ui_manager(ui_manager_.get());
+    csd_host_->set_database_manager(database_manager_.get());
     csd_host_->set_tick_clock_for_testing(&clock_);
 
     // We need to create this here since we don't call DidStopLanding in
diff --git a/chrome/browser/safe_browsing/client_side_model_loader_unittest.cc b/chrome/browser/safe_browsing/client_side_model_loader_unittest.cc
index 60656d59..9d9d597 100644
--- a/chrome/browser/safe_browsing/client_side_model_loader_unittest.cc
+++ b/chrome/browser/safe_browsing/client_side_model_loader_unittest.cc
@@ -25,7 +25,7 @@
 #include "components/variations/variations_associated_data.h"
 #include "content/public/test/browser_task_environment.h"
 #include "net/base/load_flags.h"
-#include "net/url_request/url_request_status.h"
+#include "net/base/net_errors.h"
 #include "services/network/public/cpp/weak_wrapper_shared_url_loader_factory.h"
 #include "services/network/test/test_url_loader_factory.h"
 #include "testing/gmock/include/gmock/gmock.h"
diff --git a/chrome/browser/safe_browsing/download_protection/download_feedback_service_unittest.cc b/chrome/browser/safe_browsing/download_protection/download_feedback_service_unittest.cc
index e87db3e..6161f7a 100644
--- a/chrome/browser/safe_browsing/download_protection/download_feedback_service_unittest.cc
+++ b/chrome/browser/safe_browsing/download_protection/download_feedback_service_unittest.cc
@@ -24,7 +24,6 @@
 #include "content/public/browser/browser_thread.h"
 #include "content/public/test/browser_task_environment.h"
 #include "content/public/test/test_utils.h"
-#include "net/url_request/url_request_test_util.h"
 #include "services/network/public/cpp/shared_url_loader_factory.h"
 #include "testing/gmock/include/gmock/gmock.h"
 #include "testing/gtest/include/gtest/gtest.h"
diff --git a/chrome/browser/safe_browsing/download_protection/download_protection_service_unittest.cc b/chrome/browser/safe_browsing/download_protection/download_protection_service_unittest.cc
index 326270b0..f8d1ef9 100644
--- a/chrome/browser/safe_browsing/download_protection/download_protection_service_unittest.cc
+++ b/chrome/browser/safe_browsing/download_protection/download_protection_service_unittest.cc
@@ -97,7 +97,6 @@
 #include "net/cert/x509_certificate.h"
 #include "net/cert/x509_util.h"
 #include "net/http/http_status_code.h"
-#include "net/url_request/url_request_test_util.h"
 #include "services/network/public/cpp/shared_url_loader_factory.h"
 #include "services/network/public/cpp/weak_wrapper_shared_url_loader_factory.h"
 #include "services/network/test/test_url_loader_factory.h"
diff --git a/chrome/browser/safe_browsing/download_protection/ppapi_download_request.cc b/chrome/browser/safe_browsing/download_protection/ppapi_download_request.cc
index 1ac58b83..cff21de 100644
--- a/chrome/browser/safe_browsing/download_protection/ppapi_download_request.cc
+++ b/chrome/browser/safe_browsing/download_protection/ppapi_download_request.cc
@@ -26,7 +26,6 @@
 #include "net/base/load_flags.h"
 #include "net/http/http_cache.h"
 #include "net/http/http_status_code.h"
-#include "net/url_request/url_fetcher.h"
 #include "services/network/public/cpp/shared_url_loader_factory.h"
 #include "services/network/public/cpp/simple_url_loader.h"
 
diff --git a/chrome/browser/safe_browsing/download_protection/two_phase_uploader.cc b/chrome/browser/safe_browsing/download_protection/two_phase_uploader.cc
index 3d40cd6..8481ab7 100644
--- a/chrome/browser/safe_browsing/download_protection/two_phase_uploader.cc
+++ b/chrome/browser/safe_browsing/download_protection/two_phase_uploader.cc
@@ -15,9 +15,6 @@
 #include "content/public/browser/browser_thread.h"
 #include "net/base/net_errors.h"
 #include "net/http/http_response_headers.h"
-#include "net/url_request/url_fetcher.h"
-#include "net/url_request/url_fetcher_delegate.h"
-#include "net/url_request/url_request_status.h"
 #include "services/network/public/cpp/shared_url_loader_factory.h"
 #include "services/network/public/cpp/simple_url_loader.h"
 
diff --git a/chrome/browser/safe_browsing/incident_reporting/resource_request_detector.cc b/chrome/browser/safe_browsing/incident_reporting/resource_request_detector.cc
index f4ac410d..b7277142 100644
--- a/chrome/browser/safe_browsing/incident_reporting/resource_request_detector.cc
+++ b/chrome/browser/safe_browsing/incident_reporting/resource_request_detector.cc
@@ -17,7 +17,6 @@
 #include "content/public/browser/render_process_host.h"
 #include "content/public/browser/site_instance.h"
 #include "crypto/sha2.h"
-#include "net/url_request/url_request.h"
 #include "third_party/blink/public/mojom/loader/resource_load_info.mojom-shared.h"
 #include "url/gurl.h"
 
diff --git a/chrome/browser/safe_browsing/telemetry/android/android_telemetry_service_unittest.cc b/chrome/browser/safe_browsing/telemetry/android/android_telemetry_service_unittest.cc
index 38275f6..fcf9b6d 100644
--- a/chrome/browser/safe_browsing/telemetry/android/android_telemetry_service_unittest.cc
+++ b/chrome/browser/safe_browsing/telemetry/android/android_telemetry_service_unittest.cc
@@ -22,7 +22,6 @@
 #include "content/public/browser/browser_thread.h"
 #include "content/public/browser/download_item_utils.h"
 #include "content/public/test/browser_task_environment.h"
-#include "net/url_request/url_request_test_util.h"
 #include "testing/gmock/include/gmock/gmock.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
diff --git a/chrome/browser/safe_browsing/ui_manager.cc b/chrome/browser/safe_browsing/ui_manager.cc
index 2c28202..8e7f709a 100644
--- a/chrome/browser/safe_browsing/ui_manager.cc
+++ b/chrome/browser/safe_browsing/ui_manager.cc
@@ -36,10 +36,6 @@
 #include "content/public/browser/notification_service.h"
 #include "content/public/browser/web_contents.h"
 #include "ipc/ipc_message.h"
-#include "net/base/registry_controlled_domains/registry_controlled_domain.h"
-#include "net/ssl/ssl_info.h"
-#include "net/url_request/url_request_context.h"
-#include "net/url_request/url_request_context_getter.h"
 #include "url/gurl.h"
 
 using content::BrowserThread;
diff --git a/chrome/browser/safe_browsing/ui_manager_unittest.cc b/chrome/browser/safe_browsing/ui_manager_unittest.cc
index 4a6244e7..b706fe9d 100644
--- a/chrome/browser/safe_browsing/ui_manager_unittest.cc
+++ b/chrome/browser/safe_browsing/ui_manager_unittest.cc
@@ -31,7 +31,6 @@
 #include "content/public/test/browser_task_environment.h"
 #include "content/public/test/navigation_simulator.h"
 #include "content/public/test/web_contents_tester.h"
-#include "net/url_request/url_request_test_util.h"
 #include "testing/gtest/include/gtest/gtest.h"
 #include "url/gurl.h"
 
diff --git a/chrome/browser/sessions/better_session_restore_browsertest.cc b/chrome/browser/sessions/better_session_restore_browsertest.cc
index 5de88cd..3b41723 100644
--- a/chrome/browser/sessions/better_session_restore_browsertest.cc
+++ b/chrome/browser/sessions/better_session_restore_browsertest.cc
@@ -53,7 +53,6 @@
 #include "content/public/test/url_loader_interceptor.h"
 #include "net/base/upload_bytes_element_reader.h"
 #include "net/base/upload_data_stream.h"
-#include "net/url_request/url_request.h"
 #include "services/network/public/cpp/features.h"
 #include "services/network/test/test_utils.h"
 
diff --git a/chrome/browser/share/BUILD.gn b/chrome/browser/share/BUILD.gn
index fdc0f51..331fc7d 100644
--- a/chrome/browser/share/BUILD.gn
+++ b/chrome/browser/share/BUILD.gn
@@ -19,7 +19,9 @@
     "//chrome/browser/share/android:jni_headers",
     "//chrome/services/qrcode_generator/public/cpp",
     "//chrome/services/qrcode_generator/public/mojom",
+    "//content/public/browser",
     "//skia",
+    "//ui/gfx",
   ]
 }
 
diff --git a/chrome/browser/signin/chrome_signin_helper.cc b/chrome/browser/signin/chrome_signin_helper.cc
index 50d17cd..c0ab45d 100644
--- a/chrome/browser/signin/chrome_signin_helper.cc
+++ b/chrome/browser/signin/chrome_signin_helper.cc
@@ -44,7 +44,6 @@
 #include "content/public/browser/browser_thread.h"
 #include "google_apis/gaia/gaia_auth_util.h"
 #include "net/http/http_response_headers.h"
-#include "net/url_request/url_request.h"
 #include "third_party/blink/public/mojom/loader/resource_load_info.mojom-shared.h"
 
 #if defined(OS_ANDROID)
diff --git a/chrome/browser/signin/dice_browsertest.cc b/chrome/browser/signin/dice_browsertest.cc
index 91ef6e3d..cc41a54 100644
--- a/chrome/browser/signin/dice_browsertest.cc
+++ b/chrome/browser/signin/dice_browsertest.cc
@@ -21,6 +21,7 @@
 #include "base/threading/thread_task_runner_handle.h"
 #include "base/time/time.h"
 #include "build/build_config.h"
+#include "chrome/browser/apps/platform_apps/shortcut_manager.h"
 #include "chrome/browser/browser_process.h"
 #include "chrome/browser/extensions/api/identity/web_auth_flow.h"
 #include "chrome/browser/policy/cloud/user_policy_signin_service.h"
@@ -1036,6 +1037,15 @@
             &policy::internal::g_force_prohibit_signout_for_tests,
             true) {}
 
+  void SetUp() override {
+#if defined(OS_WIN)
+    // Shortcut deletion delays tests shutdown on Win-7 and results in time out.
+    // See crbug.com/1073451.
+    AppShortcutManager::SuppressDeleteAllShortcutsForTesting();
+#endif
+    DiceBrowserTest::SetUp();
+  }
+
  protected:
   base::AutoReset<bool> skip_message_box_auto_reset_;
   base::AutoReset<bool> prohibit_sigout_auto_reset_;
@@ -1062,9 +1072,8 @@
       prefs::kSigninAllowedOnNextStartup, false);
 }
 
-// TODO(https://crbug.com/1075896) disabling test due to flakiness
 IN_PROC_BROWSER_TEST_F(DiceManageAccountBrowserTest,
-                       DISABLED_ClearManagedProfileOnStartup) {
+                       ClearManagedProfileOnStartup) {
   // Initial profile should have been deleted as sign-in and sign out were no
   // longer allowed.
   PrefService* local_state = g_browser_process->local_state();
diff --git a/chrome/browser/ssl/certificate_reporting_test_utils.cc b/chrome/browser/ssl/certificate_reporting_test_utils.cc
index 5c7742c..15ca961 100644
--- a/chrome/browser/ssl/certificate_reporting_test_utils.cc
+++ b/chrome/browser/ssl/certificate_reporting_test_utils.cc
@@ -20,7 +20,6 @@
 #include "components/security_interstitials/content/certificate_error_report.h"
 #include "components/variations/variations_associated_data.h"
 #include "net/url_request/report_sender.h"
-#include "net/url_request/url_request_context.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
 #if !defined(OS_ANDROID)
diff --git a/chrome/browser/ssl/ssl_client_certificate_selector_test.cc b/chrome/browser/ssl/ssl_client_certificate_selector_test.cc
index 675bfc6..d806231b 100644
--- a/chrome/browser/ssl/ssl_client_certificate_selector_test.cc
+++ b/chrome/browser/ssl/ssl_client_certificate_selector_test.cc
@@ -17,7 +17,6 @@
 #include "net/http/http_transaction_factory.h"
 #include "net/ssl/ssl_cert_request_info.h"
 #include "net/traffic_annotation/network_traffic_annotation_test_helper.h"
-#include "net/url_request/url_request.h"
 
 using ::testing::Mock;
 using ::testing::StrictMock;
diff --git a/chrome/browser/subresource_filter/subresource_filter_test_harness.cc b/chrome/browser/subresource_filter/subresource_filter_test_harness.cc
index 618b1b7..496fa4b 100644
--- a/chrome/browser/subresource_filter/subresource_filter_test_harness.cc
+++ b/chrome/browser/subresource_filter/subresource_filter_test_harness.cc
@@ -34,7 +34,6 @@
 #include "content/public/browser/navigation_throttle.h"
 #include "content/public/test/navigation_simulator.h"
 #include "content/public/test/test_renderer_host.h"
-#include "net/url_request/url_request_test_util.h"
 #include "testing/gtest/include/gtest/gtest.h"
 #include "url/gurl.h"
 
diff --git a/chrome/browser/supervised_user/child_accounts/family_info_fetcher_unittest.cc b/chrome/browser/supervised_user/child_accounts/family_info_fetcher_unittest.cc
index a18a1a6..4d2d0ba 100644
--- a/chrome/browser/supervised_user/child_accounts/family_info_fetcher_unittest.cc
+++ b/chrome/browser/supervised_user/child_accounts/family_info_fetcher_unittest.cc
@@ -22,7 +22,6 @@
 #include "components/signin/public/identity_manager/identity_test_environment.h"
 #include "net/base/net_errors.h"
 #include "net/http/http_status_code.h"
-#include "net/url_request/url_request_test_util.h"
 #include "services/network/public/cpp/shared_url_loader_factory.h"
 #include "services/network/public/cpp/weak_wrapper_shared_url_loader_factory.h"
 #include "services/network/test/test_url_loader_factory.h"
diff --git a/chrome/browser/supervised_user/kids_chrome_management/kids_chrome_management_client.cc b/chrome/browser/supervised_user/kids_chrome_management/kids_chrome_management_client.cc
index 2386a8b..929ee50 100644
--- a/chrome/browser/supervised_user/kids_chrome_management/kids_chrome_management_client.cc
+++ b/chrome/browser/supervised_user/kids_chrome_management/kids_chrome_management_client.cc
@@ -28,7 +28,6 @@
 #include "net/base/load_flags.h"
 #include "net/http/http_status_code.h"
 #include "net/traffic_annotation/network_traffic_annotation.h"
-#include "net/url_request/url_request_status.h"
 #include "services/network/public/cpp/resource_request.h"
 #include "services/network/public/cpp/shared_url_loader_factory.h"
 #include "services/network/public/cpp/simple_url_loader.h"
diff --git a/chrome/browser/sync_file_system/drive_backend/drive_uploader_on_worker.cc b/chrome/browser/sync_file_system/drive_backend/drive_uploader_on_worker.cc
index eb90530..944a46d 100644
--- a/chrome/browser/sync_file_system/drive_backend/drive_uploader_on_worker.cc
+++ b/chrome/browser/sync_file_system/drive_backend/drive_uploader_on_worker.cc
@@ -33,7 +33,7 @@
 void DriveUploaderOnWorker::StopBatchProcessing() {
 }
 
-google_apis::CancelCallback DriveUploaderOnWorker::UploadNewFile(
+google_apis::CancelCallbackOnce DriveUploaderOnWorker::UploadNewFile(
     const std::string& parent_resource_id,
     const base::FilePath& local_file_path,
     const std::string& title,
@@ -51,10 +51,10 @@
           RelayCallbackToTaskRunner(worker_task_runner_.get(), FROM_HERE,
                                     std::move(callback))));
 
-  return google_apis::CancelCallback();
+  return google_apis::CancelCallbackOnce();
 }
 
-google_apis::CancelCallback DriveUploaderOnWorker::UploadExistingFile(
+google_apis::CancelCallbackOnce DriveUploaderOnWorker::UploadExistingFile(
     const std::string& resource_id,
     const base::FilePath& local_file_path,
     const std::string& content_type,
@@ -71,17 +71,17 @@
           RelayCallbackToTaskRunner(worker_task_runner_.get(), FROM_HERE,
                                     std::move(callback))));
 
-  return google_apis::CancelCallback();
+  return google_apis::CancelCallbackOnce();
 }
 
-google_apis::CancelCallback DriveUploaderOnWorker::ResumeUploadFile(
+google_apis::CancelCallbackOnce DriveUploaderOnWorker::ResumeUploadFile(
     const GURL& upload_location,
     const base::FilePath& local_file_path,
     const std::string& content_type,
     drive::UploadCompletionCallback callback,
     google_apis::ProgressCallback progress_callback) {
   NOTREACHED();
-  return google_apis::CancelCallback();
+  return google_apis::CancelCallbackOnce();
 }
 
 }  // namespace drive_backend
diff --git a/chrome/browser/sync_file_system/drive_backend/drive_uploader_on_worker.h b/chrome/browser/sync_file_system/drive_backend/drive_uploader_on_worker.h
index 8ac5ff8..5aeb6dd 100644
--- a/chrome/browser/sync_file_system/drive_backend/drive_uploader_on_worker.h
+++ b/chrome/browser/sync_file_system/drive_backend/drive_uploader_on_worker.h
@@ -37,7 +37,7 @@
 
   void StartBatchProcessing() override;
   void StopBatchProcessing() override;
-  google_apis::CancelCallback UploadNewFile(
+  google_apis::CancelCallbackOnce UploadNewFile(
       const std::string& parent_resource_id,
       const base::FilePath& local_file_path,
       const std::string& title,
@@ -46,7 +46,7 @@
       drive::UploadCompletionCallback callback,
       google_apis::ProgressCallback progress_callback) override;
 
-  google_apis::CancelCallback UploadExistingFile(
+  google_apis::CancelCallbackOnce UploadExistingFile(
       const std::string& resource_id,
       const base::FilePath& local_file_path,
       const std::string& content_type,
@@ -55,7 +55,7 @@
       google_apis::ProgressCallback progress_callback) override;
 
   // Following method is expected not to be used.
-  google_apis::CancelCallback ResumeUploadFile(
+  google_apis::CancelCallbackOnce ResumeUploadFile(
       const GURL& upload_location,
       const base::FilePath& local_file_path,
       const std::string& content_type,
diff --git a/chrome/browser/sync_file_system/drive_backend/fake_drive_uploader.cc b/chrome/browser/sync_file_system/drive_backend/fake_drive_uploader.cc
index 3665844..b8c97b42 100644
--- a/chrome/browser/sync_file_system/drive_backend/fake_drive_uploader.cc
+++ b/chrome/browser/sync_file_system/drive_backend/fake_drive_uploader.cc
@@ -11,14 +11,16 @@
 #include "base/run_loop.h"
 #include "base/threading/thread_task_runner_handle.h"
 #include "google_apis/drive/drive_api_parser.h"
+#include "google_apis/drive/drive_common_callbacks.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
 using drive::FakeDriveService;
 using drive::UploadCompletionCallback;
 using google_apis::CancelCallback;
+using google_apis::CancelCallbackOnce;
+using google_apis::DriveApiErrorCode;
 using google_apis::FileResource;
 using google_apis::FileResourceCallback;
-using google_apis::DriveApiErrorCode;
 using google_apis::ProgressCallback;
 
 namespace sync_file_system {
@@ -85,7 +87,7 @@
 void FakeDriveUploader::StopBatchProcessing() {
 }
 
-CancelCallback FakeDriveUploader::UploadNewFile(
+CancelCallbackOnce FakeDriveUploader::UploadNewFile(
     const std::string& parent_resource_id,
     const base::FilePath& local_file_path,
     const std::string& title,
@@ -109,10 +111,10 @@
       base::BindOnce(&DidAddFileForUploadNew, std::move(callback)));
   base::RunLoop().RunUntilIdle();
 
-  return CancelCallback();
+  return CancelCallbackOnce();
 }
 
-CancelCallback FakeDriveUploader::UploadExistingFile(
+CancelCallbackOnce FakeDriveUploader::UploadExistingFile(
     const std::string& resource_id,
     const base::FilePath& local_file_path,
     const std::string& content_type,
@@ -120,12 +122,13 @@
     UploadCompletionCallback callback,
     ProgressCallback progress_callback) {
   DCHECK(!callback.is_null());
-  return fake_drive_service_->GetFileResource(
+  fake_drive_service_->GetFileResource(
       resource_id, base::BindOnce(&DidGetFileResourceForUploadExisting,
                                   std::move(callback)));
+  return CancelCallbackOnce();
 }
 
-CancelCallback FakeDriveUploader::ResumeUploadFile(
+CancelCallbackOnce FakeDriveUploader::ResumeUploadFile(
     const GURL& upload_location,
     const base::FilePath& local_file_path,
     const std::string& content_type,
@@ -134,7 +137,7 @@
   // At the moment, sync file system doesn't support resuming of the uploading.
   // So this method shouldn't be reached.
   NOTREACHED();
-  return CancelCallback();
+  return CancelCallbackOnce();
 }
 
 }  // namespace drive_backend
diff --git a/chrome/browser/sync_file_system/drive_backend/fake_drive_uploader.h b/chrome/browser/sync_file_system/drive_backend/fake_drive_uploader.h
index 81d3390a..981e61f 100644
--- a/chrome/browser/sync_file_system/drive_backend/fake_drive_uploader.h
+++ b/chrome/browser/sync_file_system/drive_backend/fake_drive_uploader.h
@@ -52,7 +52,7 @@
   // DriveUploaderInterface overrides.
   void StartBatchProcessing() override;
   void StopBatchProcessing() override;
-  google_apis::CancelCallback UploadNewFile(
+  google_apis::CancelCallbackOnce UploadNewFile(
       const std::string& parent_resource_id,
       const base::FilePath& local_file_path,
       const std::string& title,
@@ -60,14 +60,14 @@
       const drive::UploadNewFileOptions& options,
       drive::UploadCompletionCallback callback,
       google_apis::ProgressCallback progress_callback) override;
-  google_apis::CancelCallback UploadExistingFile(
+  google_apis::CancelCallbackOnce UploadExistingFile(
       const std::string& resource_id,
       const base::FilePath& local_file_path,
       const std::string& content_type,
       const drive::UploadExistingFileOptions& options,
       drive::UploadCompletionCallback callback,
       google_apis::ProgressCallback progress_callback) override;
-  google_apis::CancelCallback ResumeUploadFile(
+  google_apis::CancelCallbackOnce ResumeUploadFile(
       const GURL& upload_location,
       const base::FilePath& local_file_path,
       const std::string& content_type,
diff --git a/chrome/browser/sync_file_system/local/syncable_file_system_operation.cc b/chrome/browser/sync_file_system/local/syncable_file_system_operation.cc
index b4acf91..6808f439 100644
--- a/chrome/browser/sync_file_system/local/syncable_file_system_operation.cc
+++ b/chrome/browser/sync_file_system/local/syncable_file_system_operation.cc
@@ -15,7 +15,6 @@
 #include "chrome/browser/sync_file_system/local/syncable_file_operation_runner.h"
 #include "chrome/browser/sync_file_system/syncable_file_system_util.h"
 #include "content/public/browser/browser_thread.h"
-#include "net/url_request/url_request.h"
 #include "storage/browser/blob/shareable_file_reference.h"
 #include "storage/browser/file_system/file_system_context.h"
 #include "storage/browser/file_system/file_system_operation.h"
diff --git a/chrome/browser/thumbnail/cc/BUILD.gn b/chrome/browser/thumbnail/cc/BUILD.gn
index 9d20cff..9c709a7 100644
--- a/chrome/browser/thumbnail/cc/BUILD.gn
+++ b/chrome/browser/thumbnail/cc/BUILD.gn
@@ -30,6 +30,13 @@
     "thumbnail_cache.cc",
     "thumbnail_cache.h",
   ]
+
+  if (is_android) {
+    deps += [
+      "//third_party/android_opengl/etc1",
+      "//ui/android",
+    ]
+  }
 }
 
 source_set("unit_tests") {
diff --git a/chrome/browser/thumbnail/generator/BUILD.gn b/chrome/browser/thumbnail/generator/BUILD.gn
index 9c7d930..3e4e7395 100644
--- a/chrome/browser/thumbnail/generator/BUILD.gn
+++ b/chrome/browser/thumbnail/generator/BUILD.gn
@@ -49,6 +49,8 @@
         "android/thumbnail_media_parser_impl.cc",
         "android/thumbnail_media_parser_impl.h",
       ]
+
+      deps += [ "//services/viz/public/cpp/gpu" ]
     } else {
       sources += [
         "android/noop_thumbnail_media_parser.cc",
@@ -58,6 +60,7 @@
 
     deps += [
       ":jni_headers",
+      "//media/mojo/clients",
       "//third_party/android_opengl/etc1",
     ]
   }
diff --git a/chrome/browser/ui/android/default_browser_promo/java/src/org/chromium/chrome/browser/ui/default_browser_promo/DefaultBrowserPromoManager.java b/chrome/browser/ui/android/default_browser_promo/java/src/org/chromium/chrome/browser/ui/default_browser_promo/DefaultBrowserPromoManager.java
index a16f265..d29f9093 100644
--- a/chrome/browser/ui/android/default_browser_promo/java/src/org/chromium/chrome/browser/ui/default_browser_promo/DefaultBrowserPromoManager.java
+++ b/chrome/browser/ui/android/default_browser_promo/java/src/org/chromium/chrome/browser/ui/default_browser_promo/DefaultBrowserPromoManager.java
@@ -82,7 +82,7 @@
             } else {
                 promoByDisambiguationSheet();
             }
-        } else if (sdkInt >= Build.VERSION_CODES.M) {
+        } else if (sdkInt >= Build.VERSION_CODES.N) {
             promoBySystemSettings();
         } else {
             destroy();
diff --git a/chrome/browser/ui/android/default_browser_promo/java/src/org/chromium/chrome/browser/ui/default_browser_promo/DefaultBrowserPromoUtils.java b/chrome/browser/ui/android/default_browser_promo/java/src/org/chromium/chrome/browser/ui/default_browser_promo/DefaultBrowserPromoUtils.java
index 4a14e5d..f6fdbe4 100644
--- a/chrome/browser/ui/android/default_browser_promo/java/src/org/chromium/chrome/browser/ui/default_browser_promo/DefaultBrowserPromoUtils.java
+++ b/chrome/browser/ui/android/default_browser_promo/java/src/org/chromium/chrome/browser/ui/default_browser_promo/DefaultBrowserPromoUtils.java
@@ -8,6 +8,8 @@
 import android.content.Intent;
 import android.content.pm.ResolveInfo;
 import android.net.Uri;
+import android.os.Build;
+import android.provider.Settings;
 import android.text.TextUtils;
 
 import androidx.annotation.IntDef;
@@ -69,6 +71,8 @@
      *      4. On Chrome stable while no default browser is set and multiple chrome channels
      *         are installed.
      *      5. Less than the promo interval if re-promoing.
+     *      6. A browser other than chrome channel is default and default app setting is not
+     *         available in the current system.
      *
      * @param activity The context.
      * @param dispatcher The {@link ActivityLifecycleDispatcher} of the current activity.
@@ -125,8 +129,12 @@
         // Already default
         if (state == DefaultBrowserState.CHROME_DEFAULT) return false;
 
-        // Criteria 3
-        if (state == DefaultBrowserState.OTHER_DEFAULT && isCurrentDefaultBrowserChrome(info)) {
+        // Criteria 3 & Criteria 6
+        if (state == DefaultBrowserState.OTHER_DEFAULT
+                && (isCurrentDefaultBrowserChrome(info)
+                        || !doesManageDefaultAppsSettingsActivityExist())) {
+            // Default apps setting activity does not exist on L and M.  Early return
+            // before we write prefs and record metrics to skip the call to promo.
             return false;
         }
 
@@ -234,4 +242,11 @@
         }
         return DefaultBrowserState.OTHER_DEFAULT;
     }
+
+    private static boolean doesManageDefaultAppsSettingsActivityExist() {
+        if (Build.VERSION.SDK_INT < Build.VERSION_CODES.N) return false;
+        ResolveInfo info = PackageManagerUtils.resolveActivity(
+                new Intent(Settings.ACTION_MANAGE_DEFAULT_APPS_SETTINGS), 0);
+        return info != null && info.match != 0;
+    }
 }
diff --git a/chrome/browser/ui/ash/image_downloader_impl.cc b/chrome/browser/ui/ash/image_downloader_impl.cc
index 336dbe2..d068d960 100644
--- a/chrome/browser/ui/ash/image_downloader_impl.cc
+++ b/chrome/browser/ui/ash/image_downloader_impl.cc
@@ -13,6 +13,7 @@
 #include "content/public/browser/browser_context.h"
 #include "content/public/browser/storage_partition.h"
 #include "net/base/load_flags.h"
+#include "net/url_request/referrer_policy.h"
 
 namespace {
 
@@ -60,7 +61,7 @@
         std::make_unique<BitmapFetcher>(url, this, annotation_tag);
 
     bitmap_fetcher_->Init(
-        /*referrer=*/std::string(), net::URLRequest::NEVER_CLEAR_REFERRER,
+        /*referrer=*/std::string(), net::ReferrerPolicy::NEVER_CLEAR,
         network::mojom::CredentialsMode::kOmit);
 
     bitmap_fetcher_->Start(profile->GetURLLoaderFactory().get());
diff --git a/chrome/browser/ui/global_media_controls/cast_media_notification_item.cc b/chrome/browser/ui/global_media_controls/cast_media_notification_item.cc
index 6ab263c..3d1f9d3 100644
--- a/chrome/browser/ui/global_media_controls/cast_media_notification_item.cc
+++ b/chrome/browser/ui/global_media_controls/cast_media_notification_item.cc
@@ -20,6 +20,7 @@
 #include "content/public/browser/storage_partition.h"
 #include "net/base/load_flags.h"
 #include "net/traffic_annotation/network_traffic_annotation.h"
+#include "net/url_request/referrer_policy.h"
 #include "services/media_session/public/cpp/util.h"
 #include "services/media_session/public/mojom/media_session.mojom.h"
 
@@ -269,7 +270,7 @@
                         : std::make_unique<BitmapFetcher>(
                               url_, this, GetTrafficAnnotationTag());
   bitmap_fetcher_->Init(
-      /* referrer */ "", net::URLRequest::NEVER_CLEAR_REFERRER,
+      /* referrer */ "", net::ReferrerPolicy::NEVER_CLEAR,
       network::mojom::CredentialsMode::kOmit);
   bitmap_fetcher_->Start(url_loader_factory_.get());
 }
diff --git a/chrome/browser/ui/global_media_controls/cast_media_notification_item_unittest.cc b/chrome/browser/ui/global_media_controls/cast_media_notification_item_unittest.cc
index dec75f3..5de280a5 100644
--- a/chrome/browser/ui/global_media_controls/cast_media_notification_item_unittest.cc
+++ b/chrome/browser/ui/global_media_controls/cast_media_notification_item_unittest.cc
@@ -11,6 +11,7 @@
 #include "components/media_message_center/media_notification_view.h"
 #include "components/vector_icons/vector_icons.h"
 #include "content/public/test/browser_task_environment.h"
+#include "net/url_request/referrer_policy.h"
 #include "testing/gmock/include/gmock/gmock.h"
 #include "testing/gtest/include/gtest/gtest.h"
 #include "third_party/skia/include/core/SkBitmap.h"
@@ -48,7 +49,7 @@
 
   MOCK_METHOD3(Init,
                void(const std::string& referrer,
-                    net::URLRequest::ReferrerPolicy referrer_policy,
+                    net::ReferrerPolicy referrer_policy,
                     network::mojom::CredentialsMode credentials_mode));
   MOCK_METHOD1(Start, void(network::mojom::URLLoaderFactory* loader_factory));
 };
diff --git a/chrome/browser/ui/omnibox/chrome_omnibox_navigation_observer.h b/chrome/browser/ui/omnibox/chrome_omnibox_navigation_observer.h
index fdb810d..cd56496 100644
--- a/chrome/browser/ui/omnibox/chrome_omnibox_navigation_observer.h
+++ b/chrome/browser/ui/omnibox/chrome_omnibox_navigation_observer.h
@@ -17,7 +17,6 @@
 #include "content/public/browser/notification_registrar.h"
 #include "content/public/browser/reload_type.h"
 #include "content/public/browser/web_contents_observer.h"
-#include "net/url_request/url_fetcher_delegate.h"
 #include "services/network/public/mojom/url_response_head.mojom-forward.h"
 
 class Profile;
diff --git a/chrome/browser/ui/passwords/account_avatar_fetcher.cc b/chrome/browser/ui/passwords/account_avatar_fetcher.cc
index 1821b07..4993027 100644
--- a/chrome/browser/ui/passwords/account_avatar_fetcher.cc
+++ b/chrome/browser/ui/passwords/account_avatar_fetcher.cc
@@ -6,6 +6,7 @@
 
 #include "net/base/load_flags.h"
 #include "net/traffic_annotation/network_traffic_annotation.h"
+#include "net/url_request/referrer_policy.h"
 #include "ui/gfx/image/image.h"
 #include "ui/gfx/image/image_skia.h"
 #include "ui/gfx/image/image_skia_operations.h"
@@ -55,7 +56,7 @@
 
 void AccountAvatarFetcher::Start(
     network::mojom::URLLoaderFactory* loader_factory) {
-  fetcher_.Init(std::string(), net::URLRequest::NEVER_CLEAR_REFERRER,
+  fetcher_.Init(std::string(), net::ReferrerPolicy::NEVER_CLEAR,
                 network::mojom::CredentialsMode::kOmit);
   fetcher_.Start(loader_factory);
 }
diff --git a/chrome/browser/ui/toolbar/app_menu_model.cc b/chrome/browser/ui/toolbar/app_menu_model.cc
index 214ba5e..fb204880 100644
--- a/chrome/browser/ui/toolbar/app_menu_model.cc
+++ b/chrome/browser/ui/toolbar/app_menu_model.cc
@@ -822,7 +822,7 @@
                 ->GetActiveWebContents()
                 ->GetLastCommittedURL())) {
       // Show the menu option if we are on a distilled page.
-      AddItemWithStringId(IDC_DISTILL_PAGE, IDS_DISTILL_PAGE);
+      AddItemWithStringId(IDC_DISTILL_PAGE, IDS_EXIT_DISTILLED_PAGE);
     } else if (dom_distiller::ShowReaderModeOption(
                    browser_->profile()->GetPrefs())) {
       // Show the menu option if the page is distillable.
diff --git a/chrome/browser/ui/views/download/download_item_view.cc b/chrome/browser/ui/views/download/download_item_view.cc
index 80c1490..e3cf208 100644
--- a/chrome/browser/ui/views/download/download_item_view.cc
+++ b/chrome/browser/ui/views/download/download_item_view.cc
@@ -253,17 +253,10 @@
       mode_(Mode::kNormal),
       dragging_(false),
       model_(std::move(download)),
-      save_button_(nullptr),
-      discard_button_(nullptr),
-      dangerous_download_label_(nullptr),
-      dangerous_download_label_sized_(false),
       creation_time_(base::Time::Now()),
       time_download_warning_shown_(base::Time()),
       accessible_alert_(accessible_alert),
-      announce_accessible_alert_soon_(false),
-      deep_scanning_label_(nullptr),
-      open_now_button_(nullptr),
-      scan_button_(nullptr) {
+      announce_accessible_alert_soon_(false) {
   views::InstallRectHighlightPathGenerator(this);
   model_->AddObserver(this);
 
@@ -293,10 +286,46 @@
   status_label->GetViewAccessibility().OverrideIsIgnored(true);
   status_label_ = AddChildView(std::move(status_label));
 
+  auto dangerous_download_label = std::make_unique<views::StyledLabel>(
+      base::string16(), /*listener=*/nullptr);
+  dangerous_download_label->SetTextContext(CONTEXT_DOWNLOAD_SHELF);
+  dangerous_download_label->SetHorizontalAlignment(gfx::ALIGN_LEFT);
+  dangerous_download_label->SetAutoColorReadabilityEnabled(false);
+  dangerous_download_label->set_can_process_events_within_subtree(false);
+  dangerous_download_label_ = AddChildView(std::move(dangerous_download_label));
+  dangerous_download_label_->SetVisible(false);
+
+  auto deep_scanning_label = std::make_unique<views::StyledLabel>(
+      base::string16(), /*listener=*/nullptr);
+  deep_scanning_label->SetTextContext(CONTEXT_DOWNLOAD_SHELF);
+  deep_scanning_label->SetHorizontalAlignment(gfx::ALIGN_LEFT);
+  deep_scanning_label->SetAutoColorReadabilityEnabled(false);
+  deep_scanning_label->set_can_process_events_within_subtree(false);
+  deep_scanning_label_ = AddChildView(std::move(deep_scanning_label));
+  deep_scanning_label_->SetVisible(false);
+
+  auto open_now_button = views::MdTextButton::Create(
+      this, l10n_util::GetStringUTF16(IDS_OPEN_DOWNLOAD_NOW));
+  open_now_button_ = AddChildView(std::move(open_now_button));
+  open_now_button_->SetVisible(false);
+
+  auto save_button = views::MdTextButton::Create(this, base::string16());
+  save_button_ = AddChildView(std::move(save_button));
+  save_button_->SetVisible(false);
+
+  auto discard_button = views::MdTextButton::Create(
+      this, l10n_util::GetStringUTF16(IDS_DISCARD_DOWNLOAD));
+  discard_button_ = AddChildView(std::move(discard_button));
+  discard_button_->SetVisible(false);
+
+  auto scan_button = views::MdTextButton::Create(
+      this, l10n_util::GetStringUTF16(IDS_SCAN_DOWNLOAD));
+  scan_button_ = AddChildView(std::move(scan_button));
+  scan_button_->SetVisible(false);
+
   auto dropdown_button = views::CreateVectorImageButton(this);
   dropdown_button->SetAccessibleName(l10n_util::GetStringUTF16(
       IDS_DOWNLOAD_ITEM_DROPDOWN_BUTTON_ACCESSIBLE_TEXT));
-
   dropdown_button->SetBorder(views::CreateEmptyBorder(gfx::Insets(10)));
   dropdown_button->set_has_ink_drop_action_on_click(false);
   dropdown_button->SetFocusForPlatform();
@@ -332,13 +361,13 @@
     child_origin.Offset(dangerous_download_label_->width() + kLabelPadding, 0);
     gfx::Size button_size = GetButtonSize();
     child_origin.set_y((height() - button_size.height()) / 2);
-    if (save_button_) {
+    if (save_button_->GetVisible()) {
       save_button_->SetBoundsRect(gfx::Rect(child_origin, button_size));
       child_origin.Offset(button_size.width() + kSaveDiscardButtonPadding, 0);
     }
-    if (discard_button_)
+    if (discard_button_->GetVisible())
       discard_button_->SetBoundsRect(gfx::Rect(child_origin, button_size));
-    if (scan_button_)
+    if (scan_button_->GetVisible())
       scan_button_->SetBoundsRect(gfx::Rect(child_origin, button_size));
   } else if (is_mixed_content(mode_)) {
     gfx::Point child_origin(
@@ -349,9 +378,9 @@
     child_origin.Offset(dangerous_download_label_->width() + kLabelPadding, 0);
     gfx::Size button_size = GetButtonSize();
     child_origin.set_y((height() - button_size.height()) / 2);
-    if (save_button_)
+    if (save_button_->GetVisible())
       save_button_->SetBoundsRect(gfx::Rect(child_origin, button_size));
-    if (discard_button_)
+    if (discard_button_->GetVisible())
       discard_button_->SetBoundsRect(gfx::Rect(child_origin, button_size));
   } else if (mode_ == Mode::kDeepScanning) {
     gfx::Point child_origin(
@@ -359,7 +388,7 @@
         (height() - deep_scanning_label_->height()) / 2);
     deep_scanning_label_->SetPosition(child_origin);
 
-    if (open_now_button_) {
+    if (open_now_button_->GetVisible()) {
       child_origin.set_y(
           (height() - open_now_button_->GetPreferredSize().height()) / 2);
       child_origin.Offset(deep_scanning_label_->width() + kLabelPadding, 0);
@@ -626,7 +655,7 @@
     width = kStartPadding + GetWarningIconSize() + kStartPadding +
             dangerous_download_label_->width() + kLabelPadding;
     gfx::Size button_size = GetButtonSize();
-    if (save_button_ && discard_button_)
+    if (save_button_->GetVisible() && discard_button_->GetVisible())
       width += button_size.width() + kSaveDiscardButtonPadding;
     width += button_size.width() + kEndPadding;
 
@@ -636,7 +665,7 @@
   } else if (mode_ == Mode::kDeepScanning) {
     width = kStartPadding + GetWarningIconSize() + kStartPadding +
             deep_scanning_label_->width() + kLabelPadding;
-    if (open_now_button_) {
+    if (open_now_button_->GetVisible()) {
       width += open_now_button_->GetPreferredSize().width();
       // Height: make sure the button fits and the warning icon fits.
       child_height =
@@ -851,14 +880,10 @@
   file_name_label_->SetBackgroundColor(background_color);
   status_label_->SetBackgroundColor(background_color);
 
-  if (save_button_)
-    shelf_->ConfigureButtonForTheme(save_button_);
-  if (discard_button_)
-    shelf_->ConfigureButtonForTheme(discard_button_);
-  if (open_now_button_)
-    shelf_->ConfigureButtonForTheme(open_now_button_);
-  if (scan_button_)
-    shelf_->ConfigureButtonForTheme(scan_button_);
+  shelf_->ConfigureButtonForTheme(open_now_button_);
+  shelf_->ConfigureButtonForTheme(save_button_);
+  shelf_->ConfigureButtonForTheme(discard_button_);
+  shelf_->ConfigureButtonForTheme(scan_button_);
 }
 
 void DownloadItemView::UpdateDropdownButton() {
@@ -999,16 +1024,11 @@
   SetMode(Mode::kNormal);
   dropdown_state_ = NORMAL;
 
-  // Remove the views used by the mixed content dialog.
-  delete save_button_;
-  save_button_ = nullptr;
-  delete discard_button_;
-  discard_button_ = nullptr;
-  delete scan_button_;
-  scan_button_ = nullptr;
-  delete dangerous_download_label_;
-  dangerous_download_label_ = nullptr;
-  dangerous_download_label_sized_ = false;
+  // Hide the views used by the mixed content dialog.
+  save_button_->SetVisible(false);
+  discard_button_->SetVisible(false);
+  scan_button_->SetVisible(false);
+  dangerous_download_label_->SetVisible(false);
 
   // We need to load the icon now that the download has the real path.
   LoadIcon();
@@ -1030,24 +1050,17 @@
   dropdown_state_ = NORMAL;
 
   if (mode_ == Mode::kMixedContentWarn) {
-    auto save_button = views::MdTextButton::Create(
-        this, model_->GetWarningConfirmButtonText());
-    save_button_ = AddChildView(std::move(save_button));
+    save_button_->SetVisible(true);
+    save_button_->SetText(model_->GetWarningConfirmButtonText());
   } else {
-    auto discard_button = views::MdTextButton::Create(
-        this, l10n_util::GetStringUTF16(IDS_DISCARD_DOWNLOAD));
-    discard_button_ = AddChildView(std::move(discard_button));
+    discard_button_->SetVisible(true);
   }
 
+  dangerous_download_label_->SetVisible(true);
   const base::string16 filename = ElidedFilename();
   size_t filename_offset;
-  auto dangerous_download_label = std::make_unique<views::StyledLabel>(
-      model_->GetWarningText(filename, &filename_offset), /*listener=*/nullptr);
-  dangerous_download_label->SetTextContext(CONTEXT_DOWNLOAD_SHELF);
-  dangerous_download_label->SetHorizontalAlignment(gfx::ALIGN_LEFT);
-  dangerous_download_label->SetAutoColorReadabilityEnabled(false);
-  dangerous_download_label->set_can_process_events_within_subtree(false);
-  dangerous_download_label_ = AddChildView(std::move(dangerous_download_label));
+  dangerous_download_label_->SetText(
+      model_->GetWarningText(filename, &filename_offset));
   StyleFilename(*dangerous_download_label_, filename_offset, filename.length());
   dangerous_download_label_->SizeToFit(
       GetLabelWidth(*dangerous_download_label_));
@@ -1080,16 +1093,11 @@
   SetMode(Mode::kNormal);
   dropdown_state_ = NORMAL;
 
-  // Remove the views used by the warning dialog.
-  delete save_button_;
-  save_button_ = nullptr;
-  delete discard_button_;
-  discard_button_ = nullptr;
-  delete scan_button_;
-  scan_button_ = nullptr;
-  delete dangerous_download_label_;
-  dangerous_download_label_ = nullptr;
-  dangerous_download_label_sized_ = false;
+  // Hide the views used by the warning dialog.
+  save_button_->SetVisible(false);
+  discard_button_->SetVisible(false);
+  scan_button_->SetVisible(false);
+  dangerous_download_label_->SetVisible(false);
 
   // We need to load the icon now that the download has the real path.
   LoadIcon();
@@ -1109,42 +1117,32 @@
 
   dropdown_state_ = NORMAL;
   if (mode_ == Mode::kDangerous) {
-    auto save_button = views::MdTextButton::Create(
-        this, model_->GetWarningConfirmButtonText());
-    save_button_ = AddChildView(std::move(save_button));
+    save_button_->SetVisible(true);
+    save_button_->SetText(model_->GetWarningConfirmButtonText());
   }
 
   const base::string16 unelided_filename =
       model_->GetFileNameToReportUser().LossyDisplayName();
   if (danger_type == download::DOWNLOAD_DANGER_TYPE_PROMPT_FOR_SCANNING) {
-    auto scan_button = views::MdTextButton::Create(
-        this, l10n_util::GetStringUTF16(IDS_SCAN_DOWNLOAD));
-    scan_button_ = AddChildView(std::move(scan_button));
+    scan_button_->SetVisible(true);
     announce_accessible_alert_soon_ = true;
     UpdateAccessibleAlert(
         l10n_util::GetStringFUTF16(
             IDS_PROMPT_APP_DEEP_SCANNING_ACCESSIBLE_ALERT, unelided_filename),
         false);
   } else {
-    if (!ChromeDownloadManagerDelegate::IsDangerTypeBlocked(danger_type)) {
-      auto discard_button = views::MdTextButton::Create(
-          this, l10n_util::GetStringUTF16(IDS_DISCARD_DOWNLOAD));
-      discard_button_ = AddChildView(std::move(discard_button));
-    }
+    if (!ChromeDownloadManagerDelegate::IsDangerTypeBlocked(danger_type))
+      discard_button_->SetVisible(true);
     size_t ignore;
     UpdateAccessibleAlert(model_->GetWarningText(unelided_filename, &ignore),
                           true);
   }
 
+  dangerous_download_label_->SetVisible(true);
   const base::string16 filename = ElidedFilename();
   size_t filename_offset;
-  auto dangerous_download_label = std::make_unique<views::StyledLabel>(
-      model_->GetWarningText(filename, &filename_offset), /*listener=*/nullptr);
-  dangerous_download_label->SetTextContext(CONTEXT_DOWNLOAD_SHELF);
-  dangerous_download_label->SetHorizontalAlignment(gfx::ALIGN_LEFT);
-  dangerous_download_label->SetAutoColorReadabilityEnabled(false);
-  dangerous_download_label->set_can_process_events_within_subtree(false);
-  dangerous_download_label_ = AddChildView(std::move(dangerous_download_label));
+  dangerous_download_label_->SetText(
+      model_->GetWarningText(filename, &filename_offset));
   StyleFilename(*dangerous_download_label_, filename_offset, filename.length());
   dangerous_download_label_->SizeToFit(
       GetLabelWidth(*dangerous_download_label_));
@@ -1186,11 +1184,9 @@
   SetMode(Mode::kNormal);
   dropdown_state_ = NORMAL;
 
-  delete deep_scanning_label_;
-  deep_scanning_label_ = nullptr;
+  deep_scanning_label_->SetVisible(false);
 
-  delete open_now_button_;
-  open_now_button_ = nullptr;
+  open_now_button_->SetVisible(false);
 
   LoadIcon();
 
@@ -1208,16 +1204,11 @@
                       model_->download()))
                      ? IDS_PROMPT_DEEP_SCANNING_DOWNLOAD
                      : IDS_PROMPT_DEEP_SCANNING_APP_DOWNLOAD;
+  deep_scanning_label_->SetVisible(true);
   const base::string16 filename = ElidedFilename();
   size_t filename_offset;
-  auto deep_scanning_label = std::make_unique<views::StyledLabel>(
-      l10n_util::GetStringFUTF16(id, filename, &filename_offset),
-      /*listener=*/nullptr);
-  deep_scanning_label->SetTextContext(CONTEXT_DOWNLOAD_SHELF);
-  deep_scanning_label->SetHorizontalAlignment(gfx::ALIGN_LEFT);
-  deep_scanning_label->SetAutoColorReadabilityEnabled(false);
-  deep_scanning_label->set_can_process_events_within_subtree(false);
-  deep_scanning_label_ = AddChildView(std::move(deep_scanning_label));
+  deep_scanning_label_->SetText(
+      l10n_util::GetStringFUTF16(id, filename, &filename_offset));
   StyleFilename(*deep_scanning_label_, filename_offset, filename.length());
   deep_scanning_label_->SizeToFit(GetLabelWidth(*deep_scanning_label_));
 
@@ -1226,9 +1217,7 @@
               enterprise_connectors::AnalysisConnector::FILE_DOWNLOADED)) {
     open_button_->SetEnabled(false);
   } else {
-    auto open_now_button = views::MdTextButton::Create(
-        this, l10n_util::GetStringUTF16(IDS_OPEN_DOWNLOAD_NOW));
-    open_now_button_ = AddChildView(std::move(open_now_button));
+    open_now_button_->SetVisible(true);
     open_button_->SetEnabled(true);
   }
 
@@ -1310,11 +1299,11 @@
 
 gfx::Size DownloadItemView::GetButtonSize() const {
   gfx::Size size;
-  if (discard_button_)
+  if (discard_button_->GetVisible())
     size.SetToMax(discard_button_->GetPreferredSize());
-  if (save_button_)
+  if (save_button_->GetVisible())
     size.SetToMax(save_button_->GetPreferredSize());
-  if (scan_button_)
+  if (scan_button_->GetVisible())
     size.SetToMax(scan_button_->GetPreferredSize());
   return size;
 }
diff --git a/chrome/browser/ui/views/download/download_item_view.h b/chrome/browser/ui/views/download/download_item_view.h
index 0bfc2e0..7bae371 100644
--- a/chrome/browser/ui/views/download/download_item_view.h
+++ b/chrome/browser/ui/views/download/download_item_view.h
@@ -321,32 +321,24 @@
   // Progress animation
   base::RepeatingTimer progress_timer_;
 
-  // Dangerous mode and mixed content mode buttons.
-  views::MdTextButton* save_button_;
-  views::MdTextButton* discard_button_;
-
-  // The file name label.
-  views::Label* file_name_label_;
-
-  // The status text label.
-  views::Label* status_label_;
-
   // The "open download" button. This button is visually transparent and fills
   // the entire bounds of the DownloadItemView, to make the DownloadItemView
   // itself seem to be clickable while not requiring DownloadItemView itself to
   // be a button. This is necessary because buttons are not allowed to have
   // children in macOS Accessibility, and to avoid reimplementing much of the
   // button logic in DownloadItemView.
-  views::Button* open_button_ = nullptr;
+  views::Button* open_button_;
 
-  // The drop down button.
-  views::ImageButton* dropdown_button_ = nullptr;
-
-  // Dangerous mode label. Also used by mixed content warning.
+  views::Label* file_name_label_;
+  views::Label* status_label_;
   views::StyledLabel* dangerous_download_label_;
+  views::StyledLabel* deep_scanning_label_;
 
-  // Whether the dangerous mode label has been sized yet.
-  bool dangerous_download_label_sized_;
+  views::MdTextButton* open_now_button_;
+  views::MdTextButton* save_button_;
+  views::MdTextButton* discard_button_;
+  views::MdTextButton* scan_button_;
+  views::ImageButton* dropdown_button_;
 
   // The time at which this view was created.
   base::Time creation_time_;
@@ -376,21 +368,12 @@
   // and reload the icon.
   base::FilePath last_download_item_path_;
 
-  // Deep scanning mode label.
-  views::StyledLabel* deep_scanning_label_ = nullptr;
-
-  // Deep scanning open now button.
-  views::MdTextButton* open_now_button_ = nullptr;
-
   // Deep scanning modal dialog confirming choice to "open now".
   TabModalConfirmDialog* open_now_modal_dialog_;
 
   // Icon for the download.
   gfx::ImageSkia icon_;
 
-  // Button used to consent to deep scanning.
-  views::MdTextButton* scan_button_ = nullptr;
-
   // Method factory used to delay reenabling of the item when opening the
   // downloaded file.
   base::WeakPtrFactory<DownloadItemView> weak_ptr_factory_{this};
diff --git a/chrome/browser/ui/views/frame/browser_frame_mac.mm b/chrome/browser/ui/views/frame/browser_frame_mac.mm
index 57f7b604..e1f1f23 100644
--- a/chrome/browser/ui/views/frame/browser_frame_mac.mm
+++ b/chrome/browser/ui/views/frame/browser_frame_mac.mm
@@ -22,6 +22,8 @@
 #include "chrome/common/pref_names.h"
 #include "chrome/grit/generated_resources.h"
 #include "components/bookmarks/common/bookmark_pref_names.h"
+#include "components/dom_distiller/content/browser/distillable_page_utils.h"
+#include "components/dom_distiller/core/url_utils.h"
 #include "components/omnibox/browser/omnibox_prefs.h"
 #import "components/remote_cocoa/app_shim/native_widget_mac_nswindow.h"
 #import "components/remote_cocoa/app_shim/native_widget_ns_window_bridge.h"
@@ -187,6 +189,22 @@
           !media_router::MediaRouterEnabled(browser->profile());
       break;
     }
+    case IDC_DISTILL_PAGE: {
+      // Enable the reader mode option if the page is a distilled page
+      // or if the page is distillable.
+      content::WebContents* web_contents =
+          browser->tab_strip_model()->GetActiveWebContents();
+      base::Optional<dom_distiller::DistillabilityResult> distillability =
+          dom_distiller::GetLatestResult(web_contents);
+      bool distillable =
+          distillability && distillability.value().is_distillable;
+      bool is_distilled = dom_distiller::url_utils::IsDistilledPage(
+          web_contents->GetLastCommittedURL());
+      result->new_title.emplace(l10n_util::GetStringUTF16(
+          is_distilled ? IDS_EXIT_DISTILLED_PAGE : IDS_DISTILL_PAGE));
+      result->enable = distillable || is_distilled;
+      break;
+    }
     default:
       break;
   }
diff --git a/chrome/browser/ui/views/frame/browser_non_client_frame_view_mac.mm b/chrome/browser/ui/views/frame/browser_non_client_frame_view_mac.mm
index 526465e..f2d3f67 100644
--- a/chrome/browser/ui/views/frame/browser_non_client_frame_view_mac.mm
+++ b/chrome/browser/ui/views/frame/browser_non_client_frame_view_mac.mm
@@ -130,7 +130,7 @@
 
   // Do not draw caption buttons on fullscreen.
   if (!frame()->IsFullscreen()) {
-    constexpr int kCaptionWidth = 70;
+    const int kCaptionWidth = base::mac::IsAtMostOS10_15() ? 70 : 85;
     if (CaptionButtonsOnLeadingEdge())
       bounds.Inset(gfx::Insets(0, kCaptionWidth, 0, 0));
     else
diff --git a/chrome/browser/ui/views/media_router/cast_dialog_view.cc b/chrome/browser/ui/views/media_router/cast_dialog_view.cc
index 2263a15..35618524 100644
--- a/chrome/browser/ui/views/media_router/cast_dialog_view.cc
+++ b/chrome/browser/ui/views/media_router/cast_dialog_view.cc
@@ -122,10 +122,6 @@
   return instance_ ? instance_->GetWidget() : nullptr;
 }
 
-bool CastDialogView::ShouldShowCloseButton() const {
-  return true;
-}
-
 base::string16 CastDialogView::GetWindowTitle() const {
   switch (selected_source_) {
     case SourceType::kTab:
@@ -264,6 +260,7 @@
       controller_(controller),
       profile_(profile),
       metrics_(start_time, activation_location, profile) {
+  SetShowCloseButton(true);
   SetButtons(ui::DIALOG_BUTTON_NONE);
   sources_button_ = SetExtraView(CreateSourcesButton(this));
   ShowNoSinksView();
diff --git a/chrome/browser/ui/views/media_router/cast_dialog_view.h b/chrome/browser/ui/views/media_router/cast_dialog_view.h
index a3d7035f..645126a 100644
--- a/chrome/browser/ui/views/media_router/cast_dialog_view.h
+++ b/chrome/browser/ui/views/media_router/cast_dialog_view.h
@@ -83,9 +83,6 @@
   // Returns nullptr if the dialog is currently not shown.
   static views::Widget* GetCurrentDialogWidget();
 
-  // views::WidgetDelegateView:
-  bool ShouldShowCloseButton() const override;
-
   // views::WidgetDelegate:
   base::string16 GetWindowTitle() const override;
 
diff --git a/chrome/browser/ui/views/media_router/cloud_services_dialog_view.cc b/chrome/browser/ui/views/media_router/cloud_services_dialog_view.cc
index 29fd60c..a132762 100644
--- a/chrome/browser/ui/views/media_router/cloud_services_dialog_view.cc
+++ b/chrome/browser/ui/views/media_router/cloud_services_dialog_view.cc
@@ -65,15 +65,6 @@
   return instance_;
 }
 
-bool CloudServicesDialogView::ShouldShowCloseButton() const {
-  return true;
-}
-
-base::string16 CloudServicesDialogView::GetWindowTitle() const {
-  return l10n_util::GetStringUTF16(
-      IDS_MEDIA_ROUTER_CLOUD_SERVICES_DIALOG_TITLE);
-}
-
 void CloudServicesDialogView::OnDialogAccepted() {
   PrefService* pref_service = browser_->profile()->GetPrefs();
   pref_service->SetBoolean(::prefs::kMediaRouterEnableCloudServices, true);
@@ -91,6 +82,8 @@
                                                  Browser* browser)
     : BubbleDialogDelegateView(anchor_view, views::BubbleBorder::TOP_RIGHT),
       browser_(browser) {
+  SetShowCloseButton(true);
+  SetTitle(IDS_MEDIA_ROUTER_CLOUD_SERVICES_DIALOG_TITLE);
   SetButtonLabel(
       ui::DIALOG_BUTTON_OK,
       l10n_util::GetStringUTF16(IDS_MEDIA_ROUTER_CLOUD_SERVICES_DIALOG_ENABLE));
diff --git a/chrome/browser/ui/views/media_router/cloud_services_dialog_view.h b/chrome/browser/ui/views/media_router/cloud_services_dialog_view.h
index 10d67d6..4bccf3c 100644
--- a/chrome/browser/ui/views/media_router/cloud_services_dialog_view.h
+++ b/chrome/browser/ui/views/media_router/cloud_services_dialog_view.h
@@ -29,12 +29,6 @@
   // Called by tests. Returns the singleton dialog instance.
   static CloudServicesDialogView* GetDialogForTest();
 
-  // views::WidgetDelegateView:
-  bool ShouldShowCloseButton() const override;
-
-  // views::WidgetDelegate:
-  base::string16 GetWindowTitle() const override;
-
   // views::View:
   gfx::Size CalculatePreferredSize() const override;
 
diff --git a/chrome/browser/ui/views/media_router/media_remoting_dialog_view.cc b/chrome/browser/ui/views/media_router/media_remoting_dialog_view.cc
index 5a7b3cbe..1f1d2a0 100644
--- a/chrome/browser/ui/views/media_router/media_remoting_dialog_view.cc
+++ b/chrome/browser/ui/views/media_router/media_remoting_dialog_view.cc
@@ -74,14 +74,6 @@
   return instance_ != nullptr;
 }
 
-bool MediaRemotingDialogView::ShouldShowCloseButton() const {
-  return true;
-}
-
-base::string16 MediaRemotingDialogView::GetWindowTitle() const {
-  return dialog_title_;
-}
-
 gfx::Size MediaRemotingDialogView::CalculatePreferredSize() const {
   const int width = ChromeLayoutProvider::Get()->GetDistanceMetric(
                         DISTANCE_BUBBLE_PREFERRED_WIDTH) -
@@ -97,10 +89,10 @@
     : BubbleDialogDelegateView(anchor_view, views::BubbleBorder::TOP_RIGHT),
       permission_callback_(std::move(callback)),
       pref_service_(pref_service),
-      action_controller_(action_controller),
-      dialog_title_(
-          l10n_util::GetStringUTF16(IDS_MEDIA_ROUTER_REMOTING_DIALOG_TITLE)) {
+      action_controller_(action_controller) {
   DCHECK(pref_service_);
+  SetShowCloseButton(true);
+  SetTitle(IDS_MEDIA_ROUTER_REMOTING_DIALOG_TITLE);
   SetButtonLabel(ui::DIALOG_BUTTON_OK,
                  l10n_util::GetStringUTF16(
                      IDS_MEDIA_ROUTER_REMOTING_DIALOG_OPTIMIZE_BUTTON));
diff --git a/chrome/browser/ui/views/media_router/media_remoting_dialog_view.h b/chrome/browser/ui/views/media_router/media_remoting_dialog_view.h
index 8b752c8..f7b3723 100644
--- a/chrome/browser/ui/views/media_router/media_remoting_dialog_view.h
+++ b/chrome/browser/ui/views/media_router/media_remoting_dialog_view.h
@@ -39,12 +39,6 @@
 
   static bool IsShowing();
 
-  // views::WidgetDelegateView:
-  bool ShouldShowCloseButton() const override;
-
-  // views::WidgetDelegate:
-  base::string16 GetWindowTitle() const override;
-
   // views::View:
   gfx::Size CalculatePreferredSize() const override;
 
@@ -71,9 +65,6 @@
   PrefService* const pref_service_;
   MediaRouterActionController* const action_controller_;
 
-  // Title shown at the top of the dialog.
-  base::string16 dialog_title_;
-
   // Checkbox the user can use to indicate whether the preference should be
   // sticky. If this is checked, we record the preference and don't show the
   // dialog again.
diff --git a/chrome/browser/ui/views/payments/payment_request_payment_app_browsertest.cc b/chrome/browser/ui/views/payments/payment_request_payment_app_browsertest.cc
index d1ca0a8f..ec367f5 100644
--- a/chrome/browser/ui/views/payments/payment_request_payment_app_browsertest.cc
+++ b/chrome/browser/ui/views/payments/payment_request_payment_app_browsertest.cc
@@ -26,7 +26,6 @@
 #include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "net/dns/mock_host_resolver.h"
-#include "net/url_request/url_request_context_getter.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
 namespace payments {
diff --git a/chrome/browser/ui/views/reader_mode/reader_mode_icon_view.cc b/chrome/browser/ui/views/reader_mode/reader_mode_icon_view.cc
index 5836cc7..d80ee7a6 100644
--- a/chrome/browser/ui/views/reader_mode/reader_mode_icon_view.cc
+++ b/chrome/browser/ui/views/reader_mode/reader_mode_icon_view.cc
@@ -127,7 +127,8 @@
 }
 
 base::string16 ReaderModeIconView::GetTextForTooltipAndAccessibleName() const {
-  return l10n_util::GetStringUTF16(IDS_DISTILL_PAGE);
+  return l10n_util::GetStringUTF16(active() ? IDS_EXIT_DISTILLED_PAGE
+                                            : IDS_DISTILL_PAGE);
 }
 
 const char* ReaderModeIconView::GetClassName() const {
diff --git a/chrome/browser/ui/webui/favicon_source.cc b/chrome/browser/ui/webui/favicon_source.cc
index 00551a6..78866ed 100644
--- a/chrome/browser/ui/webui/favicon_source.cc
+++ b/chrome/browser/ui/webui/favicon_source.cc
@@ -26,7 +26,6 @@
 #include "extensions/browser/extension_registry.h"
 #include "extensions/common/constants.h"
 #include "extensions/common/manifest.h"
-#include "net/url_request/url_request.h"
 #include "third_party/skia/include/core/SkBitmap.h"
 #include "ui/base/layout.h"
 #include "ui/base/resource/resource_bundle.h"
diff --git a/chrome/browser/ui/webui/management_ui_handler.cc b/chrome/browser/ui/webui/management_ui_handler.cc
index 5094c6b..c9007bb 100644
--- a/chrome/browser/ui/webui/management_ui_handler.cc
+++ b/chrome/browser/ui/webui/management_ui_handler.cc
@@ -26,7 +26,6 @@
 #include "chrome/browser/profiles/profile.h"
 #include "chrome/common/chrome_features.h"
 #include "chrome/common/pref_names.h"
-
 #include "components/safe_browsing/core/common/safe_browsing_prefs.h"
 #include "components/strings/grit/components_strings.h"
 #include "content/public/browser/storage_partition.h"
@@ -35,6 +34,7 @@
 #include "google_apis/gaia/gaia_auth_util.h"
 #include "net/base/load_flags.h"
 #include "net/traffic_annotation/network_traffic_annotation.h"
+#include "net/url_request/referrer_policy.h"
 #include "ui/base/l10n/l10n_util.h"
 #include "ui/base/webui/web_ui_util.h"
 
@@ -837,7 +837,7 @@
   if (!url.empty() && GURL(url) != logo_url_) {
     icon_fetcher_ = std::make_unique<BitmapFetcher>(
         GURL(url), this, GetManagementUICustomerLogoAnnotation());
-    icon_fetcher_->Init(std::string(), net::URLRequest::NEVER_CLEAR_REFERRER,
+    icon_fetcher_->Init(std::string(), net::ReferrerPolicy::NEVER_CLEAR,
                         network::mojom::CredentialsMode::kOmit);
     auto* profile = Profile::FromWebUI(web_ui());
     icon_fetcher_->Start(
diff --git a/chrome/browser/ui/webui/quota_internals/quota_internals_types.cc b/chrome/browser/ui/webui/quota_internals/quota_internals_types.cc
index ec87f96..5d21d50 100644
--- a/chrome/browser/ui/webui/quota_internals/quota_internals_types.cc
+++ b/chrome/browser/ui/webui/quota_internals/quota_internals_types.cc
@@ -73,7 +73,7 @@
                                            blink::mojom::StorageType type)
     : origin_(origin),
       type_(type),
-      host_(net::GetHostOrSpecFromURL(origin)),
+      host_(origin.host()),
       in_use_(-1),
       used_count_(-1) {}
 
diff --git a/chrome/browser/ui/webui/signin/inline_login_handler_impl.cc b/chrome/browser/ui/webui/signin/inline_login_handler_impl.cc
index c0cf761..5c9e89c 100644
--- a/chrome/browser/ui/webui/signin/inline_login_handler_impl.cc
+++ b/chrome/browser/ui/webui/signin/inline_login_handler_impl.cc
@@ -819,7 +819,7 @@
 void InlineLoginHandlerImpl::SendLSTFetchResultsMessage(
     const base::Value& arg) {
   if (IsJavascriptAllowed())
-    CallJavascriptFunction("inline.login.sendLSTFetchResults", arg);
+    FireWebUIListener("send-lst-fetch-results", arg);
 }
 
 Browser* InlineLoginHandlerImpl::GetDesktopBrowser() {
diff --git a/chrome/browser/ui/webui/tab_strip/chrome_content_browser_client_tab_strip_part.cc b/chrome/browser/ui/webui/tab_strip/chrome_content_browser_client_tab_strip_part.cc
index 08451da..0891024 100644
--- a/chrome/browser/ui/webui/tab_strip/chrome_content_browser_client_tab_strip_part.cc
+++ b/chrome/browser/ui/webui/tab_strip/chrome_content_browser_client_tab_strip_part.cc
@@ -36,4 +36,5 @@
   web_prefs->minimum_font_size = default_prefs.minimum_font_size;
   web_prefs->minimum_logical_font_size =
       default_prefs.minimum_logical_font_size;
+  web_prefs->touch_drag_drop_enabled = true;
 }
diff --git a/chrome/browser/ui/webui/theme_source.cc b/chrome/browser/ui/webui/theme_source.cc
index 44a0466..1386ed6 100644
--- a/chrome/browser/ui/webui/theme_source.cc
+++ b/chrome/browser/ui/webui/theme_source.cc
@@ -26,7 +26,6 @@
 #include "content/public/browser/browser_thread.h"
 #include "content/public/browser/url_data_source.h"
 #include "content/public/common/url_constants.h"
-#include "net/url_request/url_request.h"
 #include "services/network/public/mojom/content_security_policy.mojom.h"
 #include "ui/base/layout.h"
 #include "ui/base/resource/resource_bundle.h"
diff --git a/chrome/browser/ui/webui/welcome/ntp_background_fetcher.cc b/chrome/browser/ui/webui/welcome/ntp_background_fetcher.cc
index 8715328..bc4d719 100644
--- a/chrome/browser/ui/webui/welcome/ntp_background_fetcher.cc
+++ b/chrome/browser/ui/webui/welcome/ntp_background_fetcher.cc
@@ -12,7 +12,6 @@
 #include "chrome/browser/search/background/ntp_backgrounds.h"
 #include "net/base/load_flags.h"
 #include "net/traffic_annotation/network_traffic_annotation.h"
-#include "net/url_request/url_request.h"
 #include "services/network/public/cpp/simple_url_loader.h"
 #include "services/network/public/mojom/url_loader_factory.mojom.h"
 #include "url/gurl.h"
diff --git a/chrome/services/sharing/nearby/test_support/mock_bluetooth_adapter.cc b/chrome/services/sharing/nearby/test_support/mock_bluetooth_adapter.cc
index 1c35903..718a629b 100644
--- a/chrome/services/sharing/nearby/test_support/mock_bluetooth_adapter.cc
+++ b/chrome/services/sharing/nearby/test_support/mock_bluetooth_adapter.cc
@@ -6,25 +6,25 @@
 
 namespace bluetooth {
 
-MockBluetoothAdapater::MockBluetoothAdapater() = default;
+MockBluetoothAdapter::MockBluetoothAdapter() = default;
 
-MockBluetoothAdapater::~MockBluetoothAdapater() = default;
+MockBluetoothAdapter::~MockBluetoothAdapter() = default;
 
-void MockBluetoothAdapater::ConnectToDevice(const std::string& address,
-                                            ConnectToDeviceCallback callback) {}
+void MockBluetoothAdapter::ConnectToDevice(const std::string& address,
+                                           ConnectToDeviceCallback callback) {}
 
-void MockBluetoothAdapater::GetDevices(GetDevicesCallback callback) {}
+void MockBluetoothAdapter::GetDevices(GetDevicesCallback callback) {}
 
-void MockBluetoothAdapater::GetInfo(GetInfoCallback callback) {
+void MockBluetoothAdapter::GetInfo(GetInfoCallback callback) {
   mojom::AdapterInfoPtr adapter_info = mojom::AdapterInfo::New();
   adapter_info->present = present;
   std::move(callback).Run(std::move(adapter_info));
 }
 
-void MockBluetoothAdapater::SetClient(
+void MockBluetoothAdapter::SetClient(
     ::mojo::PendingRemote<mojom::AdapterClient> client) {}
 
-void MockBluetoothAdapater::StartDiscoverySession(
+void MockBluetoothAdapter::StartDiscoverySession(
     StartDiscoverySessionCallback callback) {}
 
 }  // namespace bluetooth
diff --git a/chrome/services/sharing/nearby/test_support/mock_bluetooth_adapter.h b/chrome/services/sharing/nearby/test_support/mock_bluetooth_adapter.h
index 74ca462..9ed5482 100644
--- a/chrome/services/sharing/nearby/test_support/mock_bluetooth_adapter.h
+++ b/chrome/services/sharing/nearby/test_support/mock_bluetooth_adapter.h
@@ -10,12 +10,12 @@
 
 namespace bluetooth {
 
-class MockBluetoothAdapater : public mojom::Adapter {
+class MockBluetoothAdapter : public mojom::Adapter {
  public:
-  MockBluetoothAdapater();
-  MockBluetoothAdapater(const MockBluetoothAdapater&) = delete;
-  MockBluetoothAdapater& operator=(const MockBluetoothAdapater&) = delete;
-  ~MockBluetoothAdapater() override;
+  MockBluetoothAdapter();
+  MockBluetoothAdapter(const MockBluetoothAdapter&) = delete;
+  MockBluetoothAdapter& operator=(const MockBluetoothAdapter&) = delete;
+  ~MockBluetoothAdapter() override;
 
   // mojom::Adapter
   void ConnectToDevice(const std::string& address,
diff --git a/chrome/services/sharing/sharing_impl_unittest.cc b/chrome/services/sharing/sharing_impl_unittest.cc
index cc92371d..b3ea554 100644
--- a/chrome/services/sharing/sharing_impl_unittest.cc
+++ b/chrome/services/sharing/sharing_impl_unittest.cc
@@ -121,7 +121,7 @@
 }
 
 TEST_F(SharingImplTest, NearbyConnections_Create) {
-  bluetooth::MockBluetoothAdapater bluetooth_adapter;
+  bluetooth::MockBluetoothAdapter bluetooth_adapter;
   sharing::MockWebRtcSignalingMessenger webrtc_signaling_messenger;
   mojo::Remote<NearbyConnectionsMojom> connections = CreateNearbyConnections(
       bluetooth_adapter.adapter.BindNewPipeAndPassRemote(),
@@ -131,7 +131,7 @@
 }
 
 TEST_F(SharingImplTest, NearbyConnections_CreateMultiple) {
-  bluetooth::MockBluetoothAdapater bluetooth_adapter_1;
+  bluetooth::MockBluetoothAdapter bluetooth_adapter_1;
   sharing::MockWebRtcSignalingMessenger webrtc_signaling_messenger_1;
   mojo::Remote<NearbyConnectionsMojom> connections_1 = CreateNearbyConnections(
       bluetooth_adapter_1.adapter.BindNewPipeAndPassRemote(),
@@ -139,7 +139,7 @@
   EXPECT_TRUE(connections_1.is_connected());
 
   // Calling CreateNearbyConnections() again should disconnect the old instance.
-  bluetooth::MockBluetoothAdapater bluetooth_adapter_2;
+  bluetooth::MockBluetoothAdapter bluetooth_adapter_2;
   sharing::MockWebRtcSignalingMessenger webrtc_signaling_messenger_2;
   mojo::Remote<NearbyConnectionsMojom> connections_2 = CreateNearbyConnections(
       bluetooth_adapter_2.adapter.BindNewPipeAndPassRemote(),
@@ -153,7 +153,7 @@
 }
 
 TEST_F(SharingImplTest, NearbyConnections_BluetoothDisconnects) {
-  bluetooth::MockBluetoothAdapater bluetooth_adapter;
+  bluetooth::MockBluetoothAdapter bluetooth_adapter;
   sharing::MockWebRtcSignalingMessenger webrtc_signaling_messenger;
   mojo::Remote<NearbyConnectionsMojom> connections = CreateNearbyConnections(
       bluetooth_adapter.adapter.BindNewPipeAndPassRemote(),
@@ -171,7 +171,7 @@
 }
 
 TEST_F(SharingImplTest, NearbyConnections_WebRtcSignalingMessengerDisconnects) {
-  bluetooth::MockBluetoothAdapater bluetooth_adapter;
+  bluetooth::MockBluetoothAdapter bluetooth_adapter;
   sharing::MockWebRtcSignalingMessenger webrtc_signaling_messenger;
   mojo::Remote<NearbyConnectionsMojom> connections = CreateNearbyConnections(
       bluetooth_adapter.adapter.BindNewPipeAndPassRemote(),
diff --git a/chrome/test/BUILD.gn b/chrome/test/BUILD.gn
index 5000e82..ec325b0 100644
--- a/chrome/test/BUILD.gn
+++ b/chrome/test/BUILD.gn
@@ -1129,6 +1129,7 @@
       "../browser/resource_coordinator/tab_activity_watcher_browsertest.cc",
       "../browser/resource_coordinator/tab_manager_browsertest.cc",
       "../browser/safe_browsing/chrome_cleaner/reporter_runner_browsertest_win.cc",
+      "../browser/safe_browsing/client_side_detection_host_browsertest.cc",
       "../browser/safe_browsing/client_side_detection_service_browsertest.cc",
       "../browser/safe_browsing/cloud_content_scanning/deep_scanning_browsertest_base.cc",
       "../browser/safe_browsing/cloud_content_scanning/deep_scanning_browsertest_base.h",
@@ -3263,6 +3264,7 @@
     "../browser/page_load_metrics/metrics_web_contents_observer_unittest.cc",
     "../browser/page_load_metrics/observers/aborts_page_load_metrics_observer_unittest.cc",
     "../browser/page_load_metrics/observers/ad_metrics/ads_page_load_metrics_observer_unittest.cc",
+    "../browser/page_load_metrics/observers/ad_metrics/page_ad_density_tracker_unittest.cc",
     "../browser/page_load_metrics/observers/amp_page_load_metrics_observer_unittest.cc",
     "../browser/page_load_metrics/observers/data_reduction_proxy_metrics_observer_test_utils.cc",
     "../browser/page_load_metrics/observers/data_reduction_proxy_metrics_observer_test_utils.h",
diff --git a/chrome/test/android/chrome_public_test_support/AndroidManifest.xml b/chrome/test/android/chrome_public_test_support/AndroidManifest.xml
index f0956b5..c118a93 100644
--- a/chrome/test/android/chrome_public_test_support/AndroidManifest.xml
+++ b/chrome/test/android/chrome_public_test_support/AndroidManifest.xml
@@ -6,6 +6,7 @@
       xmlns:tools="http://schemas.android.com/tools"
       package="org.chromium.chrome.tests.support">
     <uses-permission android:name="android.permission.INTERNET" />
+    <uses-permission android:name="android.permission.ACCESS_COARSE_LOCATION" />
     <application>
         <service android:name="org.chromium.chrome.browser.media.TestMediaRouteProviderService"
                 android:label="testMediaRouteProviderService"
diff --git a/chrome/test/android/test_trusted_web_activity/src/org/chromium/chrome/browser/browserservices/TestTrustedWebActivityService.java b/chrome/test/android/test_trusted_web_activity/src/org/chromium/chrome/browser/browserservices/TestTrustedWebActivityService.java
index 3bca35aa..75f99d0 100644
--- a/chrome/test/android/test_trusted_web_activity/src/org/chromium/chrome/browser/browserservices/TestTrustedWebActivityService.java
+++ b/chrome/test/android/test_trusted_web_activity/src/org/chromium/chrome/browser/browserservices/TestTrustedWebActivityService.java
@@ -98,6 +98,7 @@
                 Bundle locationResult = new Bundle();
                 locationResult.putDouble("latitude", 1.0);
                 locationResult.putDouble("longitude", -2.0);
+                locationResult.putDouble("accuracy", 0.5);
                 locationResult.putLong("timeStamp", System.currentTimeMillis());
                 runCallback(callback, EXTRA_NEW_LOCATION_AVAILABLE_CALLBACK, locationResult);
                 break;
diff --git a/chrome/test/base/testing_profile.cc b/chrome/test/base/testing_profile.cc
index 394a0c4..6cbe5673 100644
--- a/chrome/test/base/testing_profile.cc
+++ b/chrome/test/base/testing_profile.cc
@@ -118,9 +118,6 @@
 #include "extensions/buildflags/buildflags.h"
 #include "extensions/common/constants.h"
 #include "net/cookies/cookie_store.h"
-#include "net/url_request/url_request_context.h"
-#include "net/url_request/url_request_context_getter.h"
-#include "net/url_request/url_request_test_util.h"
 #include "services/network/public/cpp/features.h"
 #include "services/network/test/test_network_connection_tracker.h"
 #include "services/service_manager/public/cpp/service.h"
diff --git a/chrome/test/chromedriver/net/websocket_unittest.cc b/chrome/test/chromedriver/net/websocket_unittest.cc
index b8ae067..dbc3867 100644
--- a/chrome/test/chromedriver/net/websocket_unittest.cc
+++ b/chrome/test/chromedriver/net/websocket_unittest.cc
@@ -20,7 +20,6 @@
 #include "base/threading/thread.h"
 #include "base/time/time.h"
 #include "chrome/test/chromedriver/net/test_http_server.h"
-#include "net/url_request/url_request_test_util.h"
 #include "testing/gtest/include/gtest/gtest.h"
 #include "url/gurl.h"
 
diff --git a/chrome/test/data/ads_observer/ad_iframe_writer.js b/chrome/test/data/ads_observer/ad_iframe_writer.js
index 547188d..b49e3a29 100644
--- a/chrome/test/data/ads_observer/ad_iframe_writer.js
+++ b/chrome/test/data/ads_observer/ad_iframe_writer.js
@@ -16,3 +16,19 @@
   document.body.appendChild(frame);
   return frame;
 }
+
+function createAdIframeAtRect(x, y, width, height) {
+  let frame = document.createElement('iframe');
+  frame.style.border = "0px none transparent";
+  frame.style.overflow = "hidden";
+  frame.style.position = "fixed";
+  frame.style.left = x;
+  frame.style.top = y;
+  frame.scrolling = "no";
+  frame.frameborder="0";
+  frame.allowTransparency="true";
+  frame.width = width;
+  frame.height = height;
+  document.body.appendChild(frame);
+  return frame;
+}
diff --git a/chrome/test/data/extensions/api_test/networking_private/alias/test.js b/chrome/test/data/extensions/api_test/networking_private/alias/test.js
index 4853418..6ec912b 100644
--- a/chrome/test/data/extensions/api_test/networking_private/alias/test.js
+++ b/chrome/test/data/extensions/api_test/networking_private/alias/test.js
@@ -40,13 +40,15 @@
                   Country: 'us',
                   Name: 'Cellular1_Provider'
                 },
+                // ENS, ICCID, IMEI, MDN, MEID, and MIN are filtered for
+                // networkingOnc.
                 ModelID:"test_model_id",
                 NetworkTechnology: 'GSM',
                 RoamingState: 'Home',
                 SIMLockStatus: {
                   LockEnabled: true,
                   LockType: '',
-                  RetriesLeft: 3,
+                  RetriesLeft: 3
                 },
                 Scanning: false,
               },
diff --git a/chrome/test/data/webui/cr_elements/BUILD.gn b/chrome/test/data/webui/cr_elements/BUILD.gn
index 198515a2..e589396 100644
--- a/chrome/test/data/webui/cr_elements/BUILD.gn
+++ b/chrome/test/data/webui/cr_elements/BUILD.gn
@@ -85,9 +85,7 @@
     ":cr_toast_manager_test.m",
     ":cr_toast_test.m",
     ":cr_toggle_test.m",
-
-    #":cr_toolbar_search_field_tests",
-
+    ":cr_toolbar_search_field_tests.m",
     ":cr_toolbar_tests.m",
     ":cr_view_manager_test.m",
     ":iron_list_focus_test.m",
@@ -457,6 +455,18 @@
   extra_deps = [ ":modulize" ]
 }
 
+js_library("cr_toolbar_search_field_tests.m") {
+  sources = [ "$root_gen_dir/chrome/test/data/webui/cr_elements/cr_toolbar_search_field_tests.m.js" ]
+  deps = [
+    "..:chai_assert",
+    "//third_party/polymer/v3_0/components-chromium/iron-test-helpers:mock-interactions",
+    "//third_party/polymer/v3_0/components-chromium/polymer:polymer_bundled",
+    "//ui/webui/resources/cr_elements/cr_toolbar:cr_toolbar_search_field.m",
+  ]
+  externs_list = [ "$externs_path/mocha-2.5.js" ]
+  extra_deps = [ ":modulize" ]
+}
+
 js_library("cr_toolbar_tests.m") {
   sources = [
     "$root_gen_dir/chrome/test/data/webui/cr_elements/cr_toolbar_tests.m.js",
diff --git a/chrome/test/data/webui/cr_elements/cr_toolbar_search_field_tests.js b/chrome/test/data/webui/cr_elements/cr_toolbar_search_field_tests.js
index 0a32bde..e3a421a 100644
--- a/chrome/test/data/webui/cr_elements/cr_toolbar_search_field_tests.js
+++ b/chrome/test/data/webui/cr_elements/cr_toolbar_search_field_tests.js
@@ -6,27 +6,29 @@
 // #import 'chrome://resources/cr_elements/cr_toolbar/cr_toolbar_search_field.m.js';
 //
 // #import {flush} from 'chrome://resources/polymer/v3_0/polymer/polymer_bundled.min.js';
-// #import {blur, pressAndReleaseKeyOn} from 'chrome://resources/polymer/v3_0/iron-test-helpers/mock-interactions.js';
+// #import {pressAndReleaseKeyOn} from 'chrome://resources/polymer/v3_0/iron-test-helpers/mock-interactions.js';
+// #import {assertEquals, assertDeepEquals, assertFalse, assertNotEquals, assertTrue} from '../chai_assert.js';
 // clang-format on
 
 /** @fileoverview Suite of tests for cr-toolbar-search-field. */
 suite('cr-toolbar-search-field', function() {
-  /** @type {?CrToolbarSearchFieldElement} */
-  let field = null;
+  /** @type {!CrToolbarSearchFieldElement} */
+  let field;
 
   /** @type {?Array<string>} */
   let searches = null;
 
   /** @param {string} term */
   function simulateSearch(term) {
-    field.$.searchInput.value = term;
+    field.$$('#searchInput').value = term;
     field.onSearchTermInput();
     field.onSearchTermSearch();
   }
 
   setup(function() {
-    PolymerTest.clearBody();
-    field = document.createElement('cr-toolbar-search-field');
+    document.body.innerHTML = '';
+    field = /** @type {!CrToolbarSearchFieldElement} */ (
+        document.createElement('cr-toolbar-search-field'));
     searches = [];
     field.addEventListener('search-changed', function(event) {
       searches.push(event.detail);
@@ -34,12 +36,6 @@
     document.body.appendChild(field);
   });
 
-  teardown(function() {
-    field.remove();
-    field = null;
-    searches = null;
-  });
-
   // Test that no initial 'search-changed' event is fired during
   // construction and initialization of the cr-toolbar-search-field element.
   test('no initial search-changed event', function() {
@@ -63,18 +59,18 @@
     assertFalse(field.showingSearch);
     field.click();
     assertTrue(field.showingSearch);
-    assertEquals(field.$.searchInput, field.root.activeElement);
+    const searchInput = /** @type {!HTMLElement} */ (field.$$('#searchInput'));
+    assertEquals(searchInput, field.root.activeElement);
 
-    MockInteractions.blur(field.$.searchInput);
+    field.$$('#searchInput').blur();
     assertFalse(field.showingSearch);
 
     field.click();
-    assertEquals(field.$.searchInput, field.root.activeElement);
+    assertEquals(searchInput, field.root.activeElement);
 
-    MockInteractions.pressAndReleaseKeyOn(
-        field.$.searchInput, 27, '', 'Escape');
+    MockInteractions.pressAndReleaseKeyOn(searchInput, 27, '', 'Escape');
     assertFalse(field.showingSearch, 'Pressing escape closes field.');
-    assertNotEquals(field.$.searchInput, field.root.activeElement);
+    assertNotEquals(searchInput, field.root.activeElement);
   });
 
   test('clear search button clears and refocuses input', function() {
@@ -88,7 +84,7 @@
     clearSearch.click();
     assertTrue(field.showingSearch);
     assertEquals('', field.getValue());
-    assertEquals(field.$.searchInput, field.root.activeElement);
+    assertEquals(field.$$('#searchInput'), field.root.activeElement);
     assertFalse(field.hasSearchText);
     assertFalse(field.spinnerActive);
   });
@@ -197,7 +193,7 @@
   test('blur does not close field when a search is active', function() {
     field.click();
     simulateSearch('test');
-    MockInteractions.blur(field.$.searchInput);
+    field.$$('#searchInput').blur();
 
     assertTrue(field.showingSearch);
   });
@@ -217,7 +213,7 @@
   });
 
   test('closes when value is cleared while unfocused', function() {
-    MockInteractions.focus(field.$.searchInput);
+    field.$$('#searchInput').focus();
     simulateSearch('test');
     Polymer.dom.flush();
 
@@ -228,7 +224,7 @@
 
     // Does close the field if it is blurred before being cleared.
     simulateSearch('test');
-    MockInteractions.blur(field.$.searchInput);
+    field.$$('#searchInput').blur();
     field.setValue('');
     assertFalse(field.showingSearch);
   });
@@ -238,7 +234,8 @@
     assertFalse(field.getSearchInput().hasAttribute('autofocus'));
 
     field.remove();
-    field = document.createElement('cr-toolbar-search-field');
+    field = /** @type {!CrToolbarSearchFieldElement} */ (
+        document.createElement('cr-toolbar-search-field'));
     field.autofocus = true;
 
     document.body.appendChild(field);
diff --git a/chrome/test/data/webui/print_preview/BUILD.gn b/chrome/test/data/webui/print_preview/BUILD.gn
index 75bb493..b777b4f4 100644
--- a/chrome/test/data/webui/print_preview/BUILD.gn
+++ b/chrome/test/data/webui/print_preview/BUILD.gn
@@ -24,9 +24,9 @@
     ":custom_margins_test",
     ":destination_dialog_interactive_test",
     ":destination_dialog_test",
+    ":destination_item_test",
+    ":destination_list_test",
 
-    #":destination_item_test",
-    #":destination_list_test",
     #":destination_search_test_chromeos",
     #":destination_search_test",
     #":destination_select_test",
@@ -223,6 +223,27 @@
   externs_list = [ "$externs_path/mocha-2.5.js" ]
 }
 
+js_library("destination_list_test") {
+  deps = [
+    "..:chai_assert",
+    "..:test_util.m",
+    "//chrome/browser/resources/print_preview:print_preview",
+    "//ui/webui/resources/js:assert.m",
+  ]
+  externs_list = [ "$externs_path/mocha-2.5.js" ]
+}
+
+js_library("destination_item_test") {
+  deps = [
+    ":print_preview_test_utils",
+    "..:chai_assert",
+    "//chrome/browser/resources/print_preview:print_preview",
+    "//ui/webui/resources/js:assert.m",
+    "//ui/webui/resources/js:load_time_data.m",
+  ]
+  externs_list = [ "$externs_path/mocha-2.5.js" ]
+}
+
 if (is_chromeos) {
   js_library("destination_dropdown_cros_test") {
     deps = [
diff --git a/chrome/test/data/webui/print_preview/destination_item_test.js b/chrome/test/data/webui/print_preview/destination_item_test.js
index 133ed99..cae6c2b 100644
--- a/chrome/test/data/webui/print_preview/destination_item_test.js
+++ b/chrome/test/data/webui/print_preview/destination_item_test.js
@@ -4,9 +4,14 @@
 
 import {Destination, DestinationConnectionStatus, DestinationOrigin, DestinationType} from 'chrome://print/print_preview.js';
 import {assert} from 'chrome://resources/js/assert.m.js';
-import {createDestinationWithCertificateStatus} from 'chrome://test/print_preview/print_preview_test_utils.js';
+import {loadTimeData} from 'chrome://resources/js/load_time_data.m.js';
+
+import {assertEquals, assertFalse, assertTrue} from '../chai_assert.js';
+
+import {createDestinationWithCertificateStatus} from './print_preview_test_utils.js';
 
 window.destination_item_test = {};
+const destination_item_test = window.destination_item_test;
 destination_item_test.suiteName = 'DestinationItemTest';
 /** @enum {string} */
 destination_item_test.TestNames = {
@@ -18,8 +23,8 @@
 };
 
 suite(destination_item_test.suiteName, function() {
-  /** @type {?PrintPreviewDestinationListItemElement} */
-  let item = null;
+  /** @type {!PrintPreviewDestinationListItemElement} */
+  let item;
 
   /** @type {string} */
   const printerId = 'FooDevice';
@@ -29,8 +34,9 @@
 
   /** @override */
   setup(function() {
-    PolymerTest.clearBody();
-    item = document.createElement('print-preview-destination-list-item');
+    document.body.innerHTML = '';
+    item = /** @type {!PrintPreviewDestinationListItemElement} */ (
+        document.createElement('print-preview-destination-list-item'));
 
     // Create destination
     item.destination = new Destination(
diff --git a/chrome/test/data/webui/print_preview/destination_list_test.js b/chrome/test/data/webui/print_preview/destination_list_test.js
index 9cfee17..7eb2031 100644
--- a/chrome/test/data/webui/print_preview/destination_list_test.js
+++ b/chrome/test/data/webui/print_preview/destination_list_test.js
@@ -6,9 +6,12 @@
 import {assert} from 'chrome://resources/js/assert.m.js';
 import {keyEventOn} from 'chrome://resources/polymer/v3_0/iron-test-helpers/mock-interactions.js';
 import {flush} from 'chrome://resources/polymer/v3_0/polymer/polymer_bundled.min.js';
-import {eventToPromise} from 'chrome://test/test_util.m.js';
+
+import {assertEquals, assertFalse, assertTrue} from '../chai_assert.js';
+import {eventToPromise} from '../test_util.m.js';
 
 window.destination_list_test = {};
+const destination_list_test = window.destination_list_test;
 destination_list_test.suiteName = 'DestinationListTest';
 /** @enum {string} */
 destination_list_test.TestNames = {
@@ -17,8 +20,8 @@
 };
 
 suite(destination_list_test.suiteName, function() {
-  /** @type {?PrintPreviewDestinationListElement} */
-  let list = null;
+  /** @type {!PrintPreviewDestinationListElement} */
+  let list;
 
   /** @override */
   setup(function() {
@@ -49,7 +52,8 @@
           <print-preview-destination-list id="testList" has-action-link=true
               loading-destinations=false list-name="test">
           </print-preview-destination-list>`;
-    list = document.body.querySelector('#testList');
+    list = /** @type {!PrintPreviewDestinationListElement} */ (
+        document.body.querySelector('#testList'));
     list.searchQuery = null;
     list.destinations = destinations;
     list.loadingDestinations = false;
diff --git a/chrome/test/nacl/pnacl_header_test.cc b/chrome/test/nacl/pnacl_header_test.cc
index cd26bd4..1c4592f 100644
--- a/chrome/test/nacl/pnacl_header_test.cc
+++ b/chrome/test/nacl/pnacl_header_test.cc
@@ -19,7 +19,6 @@
 #include "net/test/embedded_test_server/embedded_test_server.h"
 #include "net/test/embedded_test_server/http_request.h"
 #include "net/test/embedded_test_server/http_response.h"
-#include "net/url_request/url_request.h"
 
 using net::test_server::BasicHttpResponse;
 using net::test_server::HttpRequest;
diff --git a/chrome/updater/app/server/mac/server.mm b/chrome/updater/app/server/mac/server.mm
index 2f8e198..0998bda 100644
--- a/chrome/updater/app/server/mac/server.mm
+++ b/chrome/updater/app/server/mac/server.mm
@@ -26,8 +26,7 @@
 
 namespace updater {
 
-AppServerMac::AppServerMac()
-    : main_task_runner_(base::SequencedTaskRunnerHandle::Get()) {}
+AppServerMac::AppServerMac() = default;
 AppServerMac::~AppServerMac() = default;
 
 void AppServerMac::Uninitialize() {
@@ -42,6 +41,11 @@
 
 void AppServerMac::ActiveDuty() {
   DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
+  // TODO: crbug 1105506
+  // Move the initialization of the task runner into the ctor when work to set
+  // up the main thread of the updater as a sequnece is done.
+  main_task_runner_ = base::SequencedTaskRunnerHandle::Get();
+
   @autoreleasepool {
     // Sets up a listener and delegate for the CRUUpdateChecking XPC
     // connection
diff --git a/chrome/updater/mac/.install.sh b/chrome/updater/mac/.install.sh
index f2e8545..d9cd4f6 100755
--- a/chrome/updater/mac/.install.sh
+++ b/chrome/updater/mac/.install.sh
@@ -299,11 +299,13 @@
   # The app directory, product name, etc. can all be gotten from the
   # installed_app_path.
   readonly APP_DIR="$(basename "${installed_app_path}")"
-  readonly PRODUCT_NAME="${APP_DIR%.*}"
-  readonly FRAMEWORK_NAME="${PRODUCT_NAME} Framework"
-  readonly FRAMEWORK_DIR="${FRAMEWORK_NAME}.framework"
   readonly CONTENTS_DIR="Contents"
   readonly APP_PLIST="${CONTENTS_DIR}/Info"
+  readonly BUNDLE_NAME_KEY="CFBundleDisplayName"
+  readonly PRODUCT_NAME=\
+"$(infoplist_read ${APP_DIR}/${APP_PLIST} ${BUNDLE_NAME_KEY})"
+  readonly FRAMEWORK_NAME="${PRODUCT_NAME} Framework"
+  readonly FRAMEWORK_DIR="${FRAMEWORK_NAME}.framework"
   readonly VERSIONS_DIR_NEW=\
 "${CONTENTS_DIR}/Frameworks/${FRAMEWORK_DIR}/Versions"
   readonly APP_VERSION_KEY="CFBundleShortVersionString"
diff --git a/chrome/updater/mac/BUILD.gn b/chrome/updater/mac/BUILD.gn
index c61124bc..6fff45d1 100644
--- a/chrome/updater/mac/BUILD.gn
+++ b/chrome/updater/mac/BUILD.gn
@@ -2,6 +2,7 @@
 # Use of this source code is governed by a BSD-style license that can be
 # found in the LICENSE file.
 
+import("//build/apple/tweak_info_plist.gni")
 import("//build/config/mac/rules.gni")
 import("//build/util/version.gni")
 import("//chrome/updater/branding.gni")
@@ -46,8 +47,12 @@
   ]
 }
 
-mac_app_bundle("updater_bundle") {
+tweak_info_plist("updater_plist") {
   info_plist = "Info.plist"
+}
+
+mac_app_bundle("updater_bundle") {
+  info_plist_target = ":updater_plist"
   output_name = updater_product_full_name
   extra_substitutions =
       [ "MAC_BUNDLE_IDENTIFIER=$mac_updater_bundle_identifier" ]
diff --git a/chromecast/browser/cast_browser_main_parts.cc b/chromecast/browser/cast_browser_main_parts.cc
index cfe2aed2..49962d6 100644
--- a/chromecast/browser/cast_browser_main_parts.cc
+++ b/chromecast/browser/cast_browser_main_parts.cc
@@ -322,7 +322,7 @@
 #if defined(ARCH_CPU_X86_FAMILY)
     // This is needed for now to enable the x11 Ozone platform to work with
     // current Linux/NVidia OpenGL drivers.
-    {switches::kIgnoreGpuBlacklist, ""},
+    {switches::kIgnoreGpuBlocklist, ""},
 #elif defined(ARCH_CPU_ARM_FAMILY)
 #if !BUILDFLAG(IS_CAST_AUDIO_ONLY)
     {switches::kEnableHardwareOverlays, "cast"},
diff --git a/chromeos/BUILD.gn b/chromeos/BUILD.gn
index aedabf79..a0e138e4 100644
--- a/chromeos/BUILD.gn
+++ b/chromeos/BUILD.gn
@@ -310,10 +310,6 @@
 
       # crbug.com/1099695
       "platform.Drivefs",
-
-      # crbug.com/1105335
-      "graphics.VAAPIUnittest.jpeg_decoder",
-      "graphics.VAAPIUnittest.common",
     ]
   }
 
diff --git a/chromeos/dbus/shill/fake_shill_device_client.cc b/chromeos/dbus/shill/fake_shill_device_client.cc
index 60684fb..ac82995 100644
--- a/chromeos/dbus/shill/fake_shill_device_client.cc
+++ b/chromeos/dbus/shill/fake_shill_device_client.cc
@@ -130,7 +130,7 @@
     PostVoidCallback(std::move(callback), false);
     return;
   }
-  device_properties->RemoveWithoutPathExpansion(name, nullptr);
+  device_properties->RemoveKey(name);
   PostVoidCallback(std::move(callback), true);
 }
 
@@ -408,7 +408,7 @@
 
 void FakeShillDeviceClient::RemoveDevice(const std::string& device_path) {
   ShillManagerClient::Get()->GetTestInterface()->RemoveDevice(device_path);
-  stub_devices_.RemoveWithoutPathExpansion(device_path, nullptr);
+  stub_devices_.RemoveKey(device_path);
 }
 
 void FakeShillDeviceClient::ClearDevices() {
diff --git a/chromeos/dbus/shill/fake_shill_profile_client.cc b/chromeos/dbus/shill/fake_shill_profile_client.cc
index 7d21182..75ceb25a 100644
--- a/chromeos/dbus/shill/fake_shill_profile_client.cc
+++ b/chromeos/dbus/shill/fake_shill_profile_client.cc
@@ -113,7 +113,7 @@
     return;
   }
 
-  if (!profile->entries.RemoveWithoutPathExpansion(entry_path, nullptr)) {
+  if (!profile->entries.RemoveKey(entry_path)) {
     base::ThreadTaskRunnerHandle::Get()->PostTask(
         FROM_HERE, base::BindOnce(std::move(error_callback),
                                   "Error.InvalidProfileEntry", entry_path));
diff --git a/chromeos/dbus/shill/fake_shill_service_client.cc b/chromeos/dbus/shill/fake_shill_service_client.cc
index 6abeb9f..d1355f15 100644
--- a/chromeos/dbus/shill/fake_shill_service_client.cc
+++ b/chromeos/dbus/shill/fake_shill_service_client.cc
@@ -223,7 +223,7 @@
     std::move(error_callback).Run("Error.InvalidService", "Invalid Service");
     return;
   }
-  dict->RemoveWithoutPathExpansion(name, nullptr);
+  dict->RemoveKey(name);
   // Note: Shill does not send notifications when properties are cleared.
   base::ThreadTaskRunnerHandle::Get()->PostTask(FROM_HERE, std::move(callback));
 }
@@ -446,7 +446,7 @@
 }
 
 void FakeShillServiceClient::RemoveService(const std::string& service_path) {
-  stub_services_.RemoveWithoutPathExpansion(service_path, nullptr);
+  stub_services_.RemoveKey(service_path);
   connect_behavior_.erase(service_path);
   ShillManagerClient::Get()->GetTestInterface()->RemoveManagerService(
       service_path);
diff --git a/chromeos/network/managed_network_configuration_handler.h b/chromeos/network/managed_network_configuration_handler.h
index da0793dc..887fa2e 100644
--- a/chromeos/network/managed_network_configuration_handler.h
+++ b/chromeos/network/managed_network_configuration_handler.h
@@ -21,7 +21,6 @@
 namespace base {
 class DictionaryValue;
 class ListValue;
-class Value;
 }  // namespace base
 
 namespace chromeos {
@@ -69,11 +68,9 @@
   // Provides the properties of the network with |service_path| to |callback|.
   // |userhash| is used to set the "Source" property. If not provided then
   // user policies will be ignored.
-  virtual void GetProperties(
-      const std::string& userhash,
-      const std::string& service_path,
-      network_handler::DictionaryResultCallback callback,
-      const network_handler::ErrorCallback& error_callback) = 0;
+  virtual void GetProperties(const std::string& userhash,
+                             const std::string& service_path,
+                             network_handler::PropertiesCallback callback) = 0;
 
   // Provides the managed properties of the network with |service_path| to
   // |callback|. |userhash| is used to ensure that the user's policy is
@@ -82,8 +79,7 @@
   virtual void GetManagedProperties(
       const std::string& userhash,
       const std::string& service_path,
-      network_handler::DictionaryResultCallback callback,
-      const network_handler::ErrorCallback& error_callback) = 0;
+      network_handler::PropertiesCallback callback) = 0;
 
   // Sets the user's settings of an already configured network with
   // |service_path|. A network can be initially configured by calling
@@ -96,12 +92,6 @@
       const base::Closure& callback,
       const network_handler::ErrorCallback& error_callback) = 0;
 
-  virtual void SetManagerProperty(
-      const std::string& property_name,
-      const base::Value& value,
-      const base::Closure& callback,
-      const network_handler::ErrorCallback& error_callback) = 0;
-
   // Initially configures an unconfigured network with the given user settings
   // and returns the new identifier to |callback| if successful. Fails if the
   // network was already configured by a call to this function or because of a
diff --git a/chromeos/network/managed_network_configuration_handler_impl.cc b/chromeos/network/managed_network_configuration_handler_impl.cc
index dc4bbe3f..e6f674c 100644
--- a/chromeos/network/managed_network_configuration_handler_impl.cc
+++ b/chromeos/network/managed_network_configuration_handler_impl.cc
@@ -182,10 +182,12 @@
 void ManagedNetworkConfigurationHandlerImpl::GetManagedProperties(
     const std::string& userhash,
     const std::string& service_path,
-    network_handler::DictionaryResultCallback callback,
-    const network_handler::ErrorCallback& error_callback) {
+    network_handler::PropertiesCallback callback) {
   if (!GetPoliciesForUser(userhash) || !GetPoliciesForUser(std::string())) {
-    InvokeErrorCallback(service_path, error_callback, kPoliciesNotInitialized);
+    NET_LOG(ERROR) << "GetManagedProperties failed: "
+                   << kPoliciesNotInitialized;
+    std::move(callback).Run(service_path, base::nullopt,
+                            kPoliciesNotInitialized);
     return;
   }
   NET_LOG(USER) << "GetManagedProperties: " << NetworkPathId(service_path);
@@ -194,21 +196,20 @@
       base::BindOnce(
           &ManagedNetworkConfigurationHandlerImpl::GetPropertiesCallback,
           weak_ptr_factory_.GetWeakPtr(), PropertiesType::kManaged, userhash,
-          std::move(callback), error_callback));
+          std::move(callback)));
 }
 
 void ManagedNetworkConfigurationHandlerImpl::GetProperties(
     const std::string& userhash,
     const std::string& service_path,
-    network_handler::DictionaryResultCallback callback,
-    const network_handler::ErrorCallback& error_callback) {
+    network_handler::PropertiesCallback callback) {
   NET_LOG(USER) << "GetProperties for: " << NetworkPathId(service_path);
   network_configuration_handler_->GetShillProperties(
       service_path,
       base::BindOnce(
           &ManagedNetworkConfigurationHandlerImpl::GetPropertiesCallback,
           weak_ptr_factory_.GetWeakPtr(), PropertiesType::kUnmanaged, userhash,
-          std::move(callback), error_callback));
+          std::move(callback)));
 }
 
 void ManagedNetworkConfigurationHandlerImpl::SetProperties(
@@ -303,15 +304,6 @@
                      error_callback);
 }
 
-void ManagedNetworkConfigurationHandlerImpl::SetManagerProperty(
-    const std::string& property_name,
-    const base::Value& value,
-    const base::Closure& callback,
-    const network_handler::ErrorCallback& error_callback) {
-  network_configuration_handler_->SetManagerProperty(property_name, value,
-                                                     callback, error_callback);
-}
-
 void ManagedNetworkConfigurationHandlerImpl::SetManagedActiveProxyValues(
     const std::string& guid,
     base::DictionaryValue* dictionary) {
@@ -955,13 +947,12 @@
 void ManagedNetworkConfigurationHandlerImpl::GetPropertiesCallback(
     PropertiesType properties_type,
     const std::string& userhash,
-    network_handler::DictionaryResultCallback callback,
-    const network_handler::ErrorCallback& error_callback,
+    network_handler::PropertiesCallback callback,
     const std::string& service_path,
     base::Optional<base::Value> shill_properties) {
   if (!shill_properties) {
     SendProperties(properties_type, userhash, service_path, std::move(callback),
-                   error_callback, base::nullopt);
+                   base::nullopt);
     return;
   }
 
@@ -993,7 +984,7 @@
   if (!network_device_handler_ || *type != shill::kTypeCellular ||
       !device_path || device_path->empty()) {
     SendProperties(properties_type, userhash, service_path, std::move(callback),
-                   error_callback, std::move(shill_properties));
+                   std::move(shill_properties));
     return;
   }
 
@@ -1004,16 +995,14 @@
       base::BindOnce(
           &ManagedNetworkConfigurationHandlerImpl::OnGetDeviceProperties,
           weak_ptr_factory_.GetWeakPtr(), properties_type, userhash,
-          service_path, std::move(callback), error_callback,
-          std::move(shill_properties)));
+          service_path, std::move(callback), std::move(shill_properties)));
 }
 
 void ManagedNetworkConfigurationHandlerImpl::OnGetDeviceProperties(
     PropertiesType properties_type,
     const std::string& userhash,
     const std::string& service_path,
-    network_handler::DictionaryResultCallback callback,
-    const network_handler::ErrorCallback& error_callback,
+    network_handler::PropertiesCallback callback,
     base::Optional<base::Value> network_properties,
     const std::string& device_path,
     base::Optional<base::Value> device_properties) {
@@ -1027,26 +1016,36 @@
                                std::move(*device_properties));
   }
   SendProperties(properties_type, userhash, service_path, std::move(callback),
-                 error_callback, std::move(network_properties));
+                 std::move(network_properties));
 }
 
 void ManagedNetworkConfigurationHandlerImpl::SendProperties(
     PropertiesType properties_type,
     const std::string& userhash,
     const std::string& service_path,
-    network_handler::DictionaryResultCallback callback,
-    const network_handler::ErrorCallback& error_callback,
+    network_handler::PropertiesCallback callback,
     base::Optional<base::Value> shill_properties) {
+  auto get_name = [](PropertiesType properties_type) {
+    switch (properties_type) {
+      case PropertiesType::kUnmanaged:
+        return "GetProperties";
+      case PropertiesType::kManaged:
+        return "GetManagedProperties";
+    }
+    return "";
+  };
+
   if (!shill_properties) {
-    if (!error_callback.is_null())
-      error_callback.Run("Get Properties failed", nullptr);
+    NET_LOG(ERROR) << get_name(properties_type) << " Failed.";
+    std::move(callback).Run(service_path, base::nullopt,
+                            network_handler::kDBusFailedError);
     return;
   }
   const std::string* guid =
       shill_properties->FindStringKey(shill::kGuidProperty);
   if (!guid) {
-    if (!error_callback.is_null())
-      error_callback.Run("Properties missing guid", nullptr);
+    NET_LOG(ERROR) << get_name(properties_type) << " Missing GUID.";
+    std::move(callback).Run(service_path, base::nullopt, kUnknownNetwork);
     return;
   }
 
@@ -1060,7 +1059,10 @@
           &onc::kNetworkWithStateSignature, network_state));
 
   if (properties_type == PropertiesType::kUnmanaged) {
-    std::move(callback).Run(service_path, *onc_network);
+    std::move(callback).Run(service_path,
+                            base::make_optional(base::Value::FromUniquePtrValue(
+                                std::move(onc_network))),
+                            base::nullopt);
     return;
   }
 
@@ -1097,8 +1099,10 @@
   if (profile) {
     const Policies* policies = GetPoliciesForProfile(*profile);
     if (!policies) {
-      InvokeErrorCallback(service_path, error_callback,
-                          kPoliciesNotInitialized);
+      NET_LOG(ERROR) << "GetManagedProperties failed: "
+                     << kPoliciesNotInitialized;
+      std::move(callback).Run(service_path, base::nullopt,
+                              kPoliciesNotInitialized);
       return;
     }
     if (!guid->empty())
@@ -1110,7 +1114,10 @@
       policy_util::CreateManagedONC(global_policy, network_policy,
                                     user_settings, onc_network.get(), profile));
   SetManagedActiveProxyValues(*guid, augmented_properties.get());
-  std::move(callback).Run(service_path, *augmented_properties);
+  std::move(callback).Run(service_path,
+                          base::make_optional(base::Value::FromUniquePtrValue(
+                              std::move(augmented_properties))),
+                          base::nullopt);
 }
 
 }  // namespace chromeos
diff --git a/chromeos/network/managed_network_configuration_handler_impl.h b/chromeos/network/managed_network_configuration_handler_impl.h
index d07a10d0..d3f74d2 100644
--- a/chromeos/network/managed_network_configuration_handler_impl.h
+++ b/chromeos/network/managed_network_configuration_handler_impl.h
@@ -42,17 +42,14 @@
   void AddObserver(NetworkPolicyObserver* observer) override;
   void RemoveObserver(NetworkPolicyObserver* observer) override;
 
-  void GetProperties(
-      const std::string& userhash,
-      const std::string& service_path,
-      network_handler::DictionaryResultCallback callback,
-      const network_handler::ErrorCallback& error_callback) override;
+  void GetProperties(const std::string& userhash,
+                     const std::string& service_path,
+                     network_handler::PropertiesCallback callback) override;
 
   void GetManagedProperties(
       const std::string& userhash,
       const std::string& service_path,
-      network_handler::DictionaryResultCallback callback,
-      const network_handler::ErrorCallback& error_callback) override;
+      network_handler::PropertiesCallback callback) override;
 
   void SetProperties(
       const std::string& service_path,
@@ -60,12 +57,6 @@
       const base::Closure& callback,
       const network_handler::ErrorCallback& error_callback) override;
 
-  void SetManagerProperty(
-      const std::string& property_name,
-      const base::Value& value,
-      const base::Closure& callback,
-      const network_handler::ErrorCallback& error_callback) override;
-
   void CreateConfiguration(
       const std::string& userhash,
       const base::DictionaryValue& properties,
@@ -182,29 +173,24 @@
   // Note: Requesting Device properties requires an additional fetch and
   // additional copying of data, so we only do it for Cellular networks which
   // contain a lot of necessary state in the associated Device object.
-  void GetPropertiesCallback(
-      PropertiesType properties_type,
-      const std::string& userhash,
-      network_handler::DictionaryResultCallback callback,
-      const network_handler::ErrorCallback& error_callback,
-      const std::string& service_path,
-      base::Optional<base::Value> shill_properties);
+  void GetPropertiesCallback(PropertiesType properties_type,
+                             const std::string& userhash,
+                             network_handler::PropertiesCallback callback,
+                             const std::string& service_path,
+                             base::Optional<base::Value> shill_properties);
 
-  void OnGetDeviceProperties(
-      PropertiesType properties_type,
-      const std::string& userhash,
-      const std::string& service_path,
-      network_handler::DictionaryResultCallback callback,
-      const network_handler::ErrorCallback& error_callback,
-      base::Optional<base::Value> network_properties,
-      const std::string& device_path,
-      base::Optional<base::Value> device_properties);
+  void OnGetDeviceProperties(PropertiesType properties_type,
+                             const std::string& userhash,
+                             const std::string& service_path,
+                             network_handler::PropertiesCallback callback,
+                             base::Optional<base::Value> network_properties,
+                             const std::string& device_path,
+                             base::Optional<base::Value> device_properties);
 
   void SendProperties(PropertiesType properties_type,
                       const std::string& userhash,
                       const std::string& service_path,
-                      network_handler::DictionaryResultCallback callback,
-                      const network_handler::ErrorCallback& error_callback,
+                      network_handler::PropertiesCallback callback,
                       base::Optional<base::Value> shill_properties);
 
   // Called from SetProperties, calls NCH::SetShillProperties.
diff --git a/chromeos/network/managed_network_configuration_handler_unittest.cc b/chromeos/network/managed_network_configuration_handler_unittest.cc
index cdd2c84e..4097882 100644
--- a/chromeos/network/managed_network_configuration_handler_unittest.cc
+++ b/chromeos/network/managed_network_configuration_handler_unittest.cc
@@ -742,21 +742,27 @@
       base::ListValue(),         // no device network policy
       base::DictionaryValue());  // no device global config
 
+  base::RunLoop get_properties_run_loop;
   std::unique_ptr<base::DictionaryValue> dictionary;
   managed_handler()->GetManagedProperties(
       kUser1, wifi2_service_path,
       base::BindOnce(
           [](std::unique_ptr<base::DictionaryValue>* dictionary_out,
+             base::RepeatingClosure quit_closure,
              const std::string& service_path,
-             const base::DictionaryValue& dictionary) {
-            *dictionary_out = base::DictionaryValue::From(
-                base::Value::ToUniquePtrValue(dictionary.Clone()));
+             base::Optional<base::Value> dictionary,
+             base::Optional<std::string> error) {
+            if (dictionary) {
+              *dictionary_out = base::DictionaryValue::From(
+                  base::Value::ToUniquePtrValue(std::move(*dictionary)));
+            } else {
+              FAIL();
+            }
+            quit_closure.Run();
           },
-          &dictionary),
-      base::Bind(
-          [](const std::string& error_name,
-             std::unique_ptr<base::DictionaryValue> error_data) { FAIL(); }));
-  base::RunLoop().RunUntilIdle();
+          &dictionary, get_properties_run_loop.QuitClosure()));
+
+  get_properties_run_loop.Run();
 
   ASSERT_TRUE(dictionary.get());
   std::unique_ptr<base::DictionaryValue> expected_managed_onc =
@@ -958,19 +964,17 @@
           [](std::unique_ptr<base::DictionaryValue>* dictionary_out,
              base::RepeatingClosure quit_closure,
              const std::string& service_path,
-             const base::DictionaryValue& dictionary) {
-            *dictionary_out = base::DictionaryValue::From(
-                base::Value::ToUniquePtrValue(dictionary.Clone()));
+             base::Optional<base::Value> dictionary,
+             base::Optional<std::string> error) {
+            if (dictionary) {
+              *dictionary_out = base::DictionaryValue::From(
+                  base::Value::ToUniquePtrValue(std::move(*dictionary)));
+            } else {
+              ADD_FAILURE() << error.value_or("Failed");
+            }
             quit_closure.Run();
           },
           &dictionary_before_pref,
-          get_initial_properties_run_loop.QuitClosure()),
-      base::Bind(
-          [](base::RepeatingClosure quit_closure, const std::string& error_name,
-             std::unique_ptr<base::DictionaryValue> error_data) {
-            ADD_FAILURE() << error_name;
-            quit_closure.Run();
-          },
           get_initial_properties_run_loop.QuitClosure()));
 
   get_initial_properties_run_loop.Run();
@@ -995,18 +999,17 @@
           [](std::unique_ptr<base::DictionaryValue>* dictionary_out,
              base::RepeatingClosure quit_closure,
              const std::string& service_path,
-             const base::DictionaryValue& dictionary) {
-            *dictionary_out = base::DictionaryValue::From(
-                base::Value::ToUniquePtrValue(dictionary.Clone()));
+             base::Optional<base::Value> dictionary,
+             base::Optional<std::string> error) {
+            if (dictionary) {
+              *dictionary_out = base::DictionaryValue::From(
+                  base::Value::ToUniquePtrValue(std::move(*dictionary)));
+            } else {
+              ADD_FAILURE() << error.value_or("Failed");
+            }
             quit_closure.Run();
           },
-          &dictionary_after_pref, get_merged_properties_run_loop.QuitClosure()),
-      base::Bind(
-          [](base::RepeatingClosure quit_closure, const std::string& error_name,
-             std::unique_ptr<base::DictionaryValue> error_data) {
-            ADD_FAILURE() << error_name;
-            quit_closure.Run();
-          },
+          &dictionary_after_pref,
           get_merged_properties_run_loop.QuitClosure()));
 
   get_merged_properties_run_loop.Run();
diff --git a/chromeos/network/mock_managed_network_configuration_handler.h b/chromeos/network/mock_managed_network_configuration_handler.h
index ffb0158..77d04894 100644
--- a/chromeos/network/mock_managed_network_configuration_handler.h
+++ b/chromeos/network/mock_managed_network_configuration_handler.h
@@ -24,26 +24,19 @@
   // ManagedNetworkConfigurationHandler overrides
   MOCK_METHOD1(AddObserver, void(NetworkPolicyObserver* observer));
   MOCK_METHOD1(RemoveObserver, void(NetworkPolicyObserver* observer));
-  MOCK_METHOD4(GetProperties,
+  MOCK_METHOD3(GetProperties,
                void(const std::string& userhash,
                     const std::string& service_path,
-                    network_handler::DictionaryResultCallback callback,
-                    const network_handler::ErrorCallback& error_callback));
-  MOCK_METHOD4(GetManagedProperties,
+                    network_handler::PropertiesCallback callback));
+  MOCK_METHOD3(GetManagedProperties,
                void(const std::string& userhash,
                     const std::string& service_path,
-                    network_handler::DictionaryResultCallback callback,
-                    const network_handler::ErrorCallback& error_callback));
+                    network_handler::PropertiesCallback callback));
   MOCK_METHOD4(SetProperties,
                void(const std::string& service_path,
                     const base::DictionaryValue& user_settings,
                     const base::Closure& callback,
                     const network_handler::ErrorCallback& error_callback));
-  MOCK_METHOD4(SetManagerProperty,
-               void(const std::string& property_name,
-                    const base::Value& value,
-                    const base::Closure& callback,
-                    const network_handler::ErrorCallback& error_callback));
   MOCK_CONST_METHOD4(
       CreateConfiguration,
       void(const std::string& userhash,
diff --git a/chromeos/network/network_cert_migrator.cc b/chromeos/network/network_cert_migrator.cc
index 4a98522..5d3a244b 100644
--- a/chromeos/network/network_cert_migrator.cc
+++ b/chromeos/network/network_cert_migrator.cc
@@ -15,6 +15,7 @@
 #include "base/metrics/histogram_macros.h"
 #include "chromeos/dbus/shill/shill_service_client.h"
 #include "chromeos/network/client_cert_util.h"
+#include "chromeos/network/network_event_log.h"
 #include "chromeos/network/network_handler_callbacks.h"
 #include "chromeos/network/network_state.h"
 #include "chromeos/network/network_state_handler.h"
@@ -64,21 +65,28 @@
 
       ShillServiceClient::Get()->GetProperties(
           dbus::ObjectPath(service_path),
-          base::BindOnce(&network_handler::GetPropertiesCallback,
-                         base::BindOnce(&MigrationTask::MigrateNetwork, this),
-                         network_handler::ErrorCallback(), service_path));
+          base::BindOnce(&MigrationTask::MigrateNetwork, this, service_path));
     }
   }
 
   void MigrateNetwork(const std::string& service_path,
-                      const base::DictionaryValue& properties) {
+                      DBusMethodCallStatus call_status,
+                      base::Value properties) {
     if (!cert_migrator_) {
       VLOG(2) << "NetworkCertMigrator already destroyed. Aborting migration.";
       return;
     }
 
+    if (call_status != DBUS_METHOD_CALL_SUCCESS) {
+      NET_LOG(ERROR) << "GetProperties failed: " << NetworkPathId(service_path)
+                     << " Status: " << call_status;
+      return;
+    }
+
     base::DictionaryValue new_properties;
-    MigrateClientCertProperties(service_path, properties, &new_properties);
+    MigrateClientCertProperties(service_path,
+                                base::Value::AsDictionaryValue(properties),
+                                &new_properties);
 
     if (new_properties.empty())
       return;
diff --git a/chromeos/network/network_configuration_handler.cc b/chromeos/network/network_configuration_handler.cc
index 8e62110d..1ece0299 100644
--- a/chromeos/network/network_configuration_handler.cc
+++ b/chromeos/network/network_configuration_handler.cc
@@ -64,12 +64,11 @@
 }
 
 void ManagerSetPropertiesErrorCallback(
-    const network_handler::ErrorCallback& error_callback,
     const std::string& dbus_error_name,
     const std::string& dbus_error_message) {
   network_handler::ShillErrorCallbackFunction(
-      "ShillManagerClient.SetProperties Failed", std::string(), error_callback,
-      dbus_error_name, dbus_error_message);
+      "ShillManagerClient.SetProperties Failed", std::string(),
+      base::NullCallback(), dbus_error_name, dbus_error_message);
 }
 
 void LogConfigProperties(const std::string& desc,
@@ -451,13 +450,11 @@
 
 void NetworkConfigurationHandler::SetManagerProperty(
     const std::string& property_name,
-    const base::Value& value,
-    const base::Closure& callback,
-    const network_handler::ErrorCallback& error_callback) {
+    const base::Value& value) {
   NET_LOG(USER) << "SetManagerProperty: " << property_name << ": " << value;
   ShillManagerClient::Get()->SetProperty(
-      property_name, value, callback,
-      base::BindOnce(&ManagerSetPropertiesErrorCallback, error_callback));
+      property_name, value, base::DoNothing(),
+      base::BindOnce(&ManagerSetPropertiesErrorCallback));
 }
 
 // NetworkStateHandlerObserver methods
diff --git a/chromeos/network/network_configuration_handler.h b/chromeos/network/network_configuration_handler.h
index 8ceb90c..4baa97f 100644
--- a/chromeos/network/network_configuration_handler.h
+++ b/chromeos/network/network_configuration_handler.h
@@ -121,9 +121,7 @@
 
   // Changes the value of a shill manager property.
   void SetManagerProperty(const std::string& property_name,
-                          const base::Value& value,
-                          const base::Closure& callback,
-                          const network_handler::ErrorCallback& error_callback);
+                          const base::Value& value);
 
   // NetworkStateHandlerObserver
   void NetworkListChanged() override;
diff --git a/chromeos/network/network_configuration_handler_unittest.cc b/chromeos/network/network_configuration_handler_unittest.cc
index ae0c886..a12e474 100644
--- a/chromeos/network/network_configuration_handler_unittest.cc
+++ b/chromeos/network/network_configuration_handler_unittest.cc
@@ -758,8 +758,7 @@
   const std::string vpn_package = "com.android.vpn";
 
   network_configuration_handler_->SetManagerProperty(
-      shill::kAlwaysOnVpnPackageProperty, base::Value(vpn_package),
-      base::DoNothing(), base::Bind(&ErrorCallback));
+      shill::kAlwaysOnVpnPackageProperty, base::Value(vpn_package));
 
   ShillManagerClient::Get()->GetProperties(
       BindOnce(&NetworkConfigurationHandlerTest::ManagerGetPropertiesCallback,
diff --git a/chromeos/network/network_handler_callbacks.cc b/chromeos/network/network_handler_callbacks.cc
index 088e41c..5756dd1a 100644
--- a/chromeos/network/network_handler_callbacks.cc
+++ b/chromeos/network/network_handler_callbacks.cc
@@ -90,20 +90,5 @@
   error_callback.Run(error_name, std::move(error_data));
 }
 
-void GetPropertiesCallback(DictionaryResultCallback callback,
-                           const ErrorCallback& error_callback,
-                           const std::string& path,
-                           DBusMethodCallStatus call_status,
-                           base::Value value) {
-  if (call_status != DBUS_METHOD_CALL_SUCCESS) {
-    NET_LOG(ERROR) << "GetProperties failed: " << NetworkPathId(path)
-                   << " Status: " << call_status;
-    RunErrorCallback(
-        error_callback, path, kDBusFailedError, kDBusFailedErrorMessage);
-  } else if (!callback.is_null()) {
-    std::move(callback).Run(path, base::Value::AsDictionaryValue(value));
-  }
-}
-
 }  // namespace network_handler
 }  // namespace chromeos
diff --git a/chromeos/network/network_handler_callbacks.h b/chromeos/network/network_handler_callbacks.h
index 0675d5b..24b44c8 100644
--- a/chromeos/network/network_handler_callbacks.h
+++ b/chromeos/network/network_handler_callbacks.h
@@ -23,12 +23,18 @@
 COMPONENT_EXPORT(CHROMEOS_NETWORK) extern const char kDbusErrorName[];
 COMPONENT_EXPORT(CHROMEOS_NETWORK) extern const char kDbusErrorMessage[];
 
-// Modern callback for updated methods using a single OnceCallback with an
-// optional result. This can be used when error logging is handled at the point
-// of failure and there is no need to pass additional details to the caller,
-// other than a nullopt to indicate failure.
-using ResultCallback = base::OnceCallback<void(const std::string& service_path,
-                                               base::Optional<base::Value>)>;
+// On success, |result| contains the result. On failure, |result| is nullopt.
+using ResultCallback =
+    base::OnceCallback<void(const std::string& service_path,
+                            base::Optional<base::Value> result)>;
+
+// On success, |properties| contains the resulting properties and |error| is
+// nullopt. On failure, |result| is nullopt and |error| may contain an error
+// identifier.
+using PropertiesCallback =
+    base::OnceCallback<void(const std::string& service_path,
+                            base::Optional<base::Value> properties,
+                            base::Optional<std::string> error)>;
 
 // An error callback used by both the configuration handler and the state
 // handler to receive error results from the API.
@@ -37,10 +43,6 @@
     std::unique_ptr<base::DictionaryValue> error_data)>
     ErrorCallback;
 
-typedef base::OnceCallback<void(const std::string& service_path,
-                                const base::DictionaryValue& dictionary)>
-    DictionaryResultCallback;
-
 typedef base::Callback<void(const std::string& string_result)>
     StringResultCallback;
 
@@ -82,17 +84,6 @@
                                 const std::string& dbus_error_name,
                                 const std::string& dbus_error_message);
 
-// Callback for property getters used by NetworkConfigurationHandler
-// (for Network Services) and by NetworkDeviceHandler. Used to translate
-// the DBus Dictionary callback into one that calls the error callback
-// if |call_status| != DBUS_METHOD_CALL_SUCCESS.
-COMPONENT_EXPORT(CHROMEOS_NETWORK)
-void GetPropertiesCallback(DictionaryResultCallback callback,
-                           const ErrorCallback& error_callback,
-                           const std::string& path,
-                           DBusMethodCallStatus call_status,
-                           base::Value value);
-
 }  // namespace network_handler
 }  // namespace chromeos
 
diff --git a/chromeos/services/network_config/cros_network_config.cc b/chromeos/services/network_config/cros_network_config.cc
index 3f5f8a4..2958274 100644
--- a/chromeos/services/network_config/cros_network_config.cc
+++ b/chromeos/services/network_config/cros_network_config.cc
@@ -1185,7 +1185,7 @@
 mojom::ManagedPropertiesPtr ManagedPropertiesToMojo(
     const NetworkState* network_state,
     const std::vector<mojom::VpnProviderPtr>& vpn_providers,
-    const base::DictionaryValue* properties) {
+    const base::Value* properties) {
   DCHECK(network_state);
   DCHECK(properties);
   base::Optional<std::string> onc_type =
@@ -1873,33 +1873,32 @@
     return;
   }
 
-  int callback_id = callback_id_++;
-  get_managed_properties_callbacks_[callback_id] = std::move(callback);
-
   network_configuration_handler_->GetManagedProperties(
       chromeos::LoginState::Get()->primary_user_hash(), network->path(),
-      base::BindOnce(&CrosNetworkConfig::GetManagedPropertiesSuccess,
-                     weak_factory_.GetWeakPtr(), callback_id),
-      base::Bind(&CrosNetworkConfig::GetManagedPropertiesFailure,
-                 weak_factory_.GetWeakPtr(), guid, callback_id));
+      base::BindOnce(&CrosNetworkConfig::OnGetManagedProperties,
+                     weak_factory_.GetWeakPtr(), std::move(callback), guid));
 }
 
-void CrosNetworkConfig::GetManagedPropertiesSuccess(
-    int callback_id,
+void CrosNetworkConfig::OnGetManagedProperties(
+    GetManagedPropertiesCallback callback,
+    std::string guid,
     const std::string& service_path,
-    const base::DictionaryValue& properties) {
-  auto iter = get_managed_properties_callbacks_.find(callback_id);
-  DCHECK(iter != get_managed_properties_callbacks_.end());
+    base::Optional<base::Value> properties,
+    base::Optional<std::string> error) {
+  if (!properties) {
+    NET_LOG(ERROR) << "GetManagedProperties failed for: " << guid
+                   << " Error: " << error.value_or("Failed");
+    std::move(callback).Run(nullptr);
+  }
   const NetworkState* network_state =
       network_state_handler_->GetNetworkState(service_path);
   if (!network_state) {
     NET_LOG(ERROR) << "Network not found: " << service_path;
-    std::move(iter->second).Run(nullptr);
-    get_managed_properties_callbacks_.erase(iter);
+    std::move(callback).Run(nullptr);
     return;
   }
-  mojom::ManagedPropertiesPtr managed_properties =
-      ManagedPropertiesToMojo(network_state, vpn_providers_, &properties);
+  mojom::ManagedPropertiesPtr managed_properties = ManagedPropertiesToMojo(
+      network_state, vpn_providers_, &properties.value());
 
   // For Ethernet networks with no authentication, check for a separate
   // EthernetEAP configuration.
@@ -1915,8 +1914,7 @@
   }
   if (!eap_state) {
     // No EAP properties, return the managed properties as-is.
-    std::move(iter->second).Run(std::move(managed_properties));
-    get_managed_properties_callbacks_.erase(iter);
+    std::move(callback).Run(std::move(managed_properties));
     return;
   }
 
@@ -1925,74 +1923,35 @@
   // be returned as-is.
   NET_LOG(DEBUG) << "Requesting EAP state for: " + service_path
                  << " from: " << eap_state->path();
-  managed_properties_[callback_id] = std::move(managed_properties);
   network_configuration_handler_->GetManagedProperties(
       chromeos::LoginState::Get()->primary_user_hash(), eap_state->path(),
-      base::BindOnce(&CrosNetworkConfig::GetManagedPropertiesSuccessEap,
-                     weak_factory_.GetWeakPtr(), callback_id),
-      base::Bind(&CrosNetworkConfig::GetManagedPropertiesSuccessNoEap,
-                 weak_factory_.GetWeakPtr(), callback_id));
+      base::BindOnce(&CrosNetworkConfig::OnGetManagedPropertiesEap,
+                     weak_factory_.GetWeakPtr(), std::move(callback),
+                     std::move(managed_properties)));
 }
 
-void CrosNetworkConfig::GetManagedPropertiesSuccessEap(
-    int callback_id,
+void CrosNetworkConfig::OnGetManagedPropertiesEap(
+    GetManagedPropertiesCallback callback,
+    mojom::ManagedPropertiesPtr managed_properties,
     const std::string& service_path,
-    const base::DictionaryValue& eap_properties) {
-  auto iter = get_managed_properties_callbacks_.find(callback_id);
-  DCHECK(iter != get_managed_properties_callbacks_.end());
-
-  auto properties_iter = managed_properties_.find(callback_id);
-  DCHECK(properties_iter != managed_properties_.end());
-  mojom::ManagedPropertiesPtr managed_properties =
-      std::move(properties_iter->second);
-  managed_properties_.erase(properties_iter);
-
-  // Copy the EAP properties to |managed_properties_| before sending.
-  const base::Value* ethernet_dict =
-      GetDictionary(&eap_properties, ::onc::network_config::kEthernet);
-  if (ethernet_dict) {
-    auto ethernet = mojom::ManagedEthernetProperties::New();
-    ethernet->authentication =
-        GetManagedString(ethernet_dict, ::onc::ethernet::kAuthentication);
-    ethernet->eap =
-        GetManagedEAPProperties(ethernet_dict, ::onc::ethernet::kEAP);
-    managed_properties->type_properties =
-        mojom::NetworkTypeManagedProperties::NewEthernet(std::move(ethernet));
+    base::Optional<base::Value> eap_properties,
+    base::Optional<std::string> error) {
+  if (eap_properties) {
+    // Copy the EAP properties to |managed_properties| before sending.
+    const base::Value* ethernet_dict =
+        eap_properties->FindDictKey(::onc::network_config::kEthernet);
+    if (ethernet_dict) {
+      auto ethernet = mojom::ManagedEthernetProperties::New();
+      ethernet->authentication =
+          GetManagedString(ethernet_dict, ::onc::ethernet::kAuthentication);
+      ethernet->eap =
+          GetManagedEAPProperties(ethernet_dict, ::onc::ethernet::kEAP);
+      managed_properties->type_properties =
+          mojom::NetworkTypeManagedProperties::NewEthernet(std::move(ethernet));
+    }
   }
 
-  std::move(iter->second).Run(std::move(managed_properties));
-  get_managed_properties_callbacks_.erase(iter);
-}
-
-void CrosNetworkConfig::GetManagedPropertiesSuccessNoEap(
-    int callback_id,
-    const std::string& error_name,
-    std::unique_ptr<base::DictionaryValue> error_data) {
-  auto iter = get_managed_properties_callbacks_.find(callback_id);
-  DCHECK(iter != get_managed_properties_callbacks_.end());
-
-  auto properties_iter = managed_properties_.find(callback_id);
-  DCHECK(properties_iter != managed_properties_.end());
-  mojom::ManagedPropertiesPtr managed_properties =
-      std::move(properties_iter->second);
-  managed_properties_.erase(properties_iter);
-
-  // No EAP properties, send the unmodified managed_properties_.
-  std::move(iter->second).Run(std::move(managed_properties));
-  get_managed_properties_callbacks_.erase(iter);
-}
-
-void CrosNetworkConfig::GetManagedPropertiesFailure(
-    std::string guid,
-    int callback_id,
-    const std::string& error_name,
-    std::unique_ptr<base::DictionaryValue> error_data) {
-  auto iter = get_managed_properties_callbacks_.find(callback_id);
-  DCHECK(iter != get_managed_properties_callbacks_.end());
-  NET_LOG(ERROR) << "Failed to get network properties: " << guid
-                 << " Error: " << error_name;
-  std::move(iter->second).Run(nullptr);
-  get_managed_properties_callbacks_.erase(iter);
+  std::move(callback).Run(std::move(managed_properties));
 }
 
 void CrosNetworkConfig::SetProperties(const std::string& guid,
diff --git a/chromeos/services/network_config/cros_network_config.h b/chromeos/services/network_config/cros_network_config.h
index f62e6e4..99d2617 100644
--- a/chromeos/services/network_config/cros_network_config.h
+++ b/chromeos/services/network_config/cros_network_config.h
@@ -87,22 +87,16 @@
   void GetNetworkCertificates(GetNetworkCertificatesCallback callback) override;
 
  private:
-  void GetManagedPropertiesSuccess(int callback_id,
-                                   const std::string& service_path,
-                                   const base::DictionaryValue& properties);
-  void GetManagedPropertiesSuccessEap(
-      int callback_id,
-      const std::string& service_path,
-      const base::DictionaryValue& eap_properties);
-  void GetManagedPropertiesSuccessNoEap(
-      int callback_id,
-      const std::string& error_name,
-      std::unique_ptr<base::DictionaryValue> error_data);
-  void GetManagedPropertiesFailure(
-      std::string guid,
-      int callback_id,
-      const std::string& error_name,
-      std::unique_ptr<base::DictionaryValue> error_data);
+  void OnGetManagedProperties(GetManagedPropertiesCallback callback,
+                              std::string guid,
+                              const std::string& service_path,
+                              base::Optional<base::Value> properties,
+                              base::Optional<std::string> error);
+  void OnGetManagedPropertiesEap(GetManagedPropertiesCallback callback,
+                                 mojom::ManagedPropertiesPtr managed_properties,
+                                 const std::string& service_path,
+                                 base::Optional<base::Value> properties,
+                                 base::Optional<std::string> error);
   void SetPropertiesSuccess(int callback_id);
   void SetPropertiesConfigureSuccess(int callback_id,
                                      const std::string& service_path,
@@ -169,8 +163,6 @@
   mojo::ReceiverSet<mojom::CrosNetworkConfig> receivers_;
 
   int callback_id_ = 1;
-  base::flat_map<int, GetManagedPropertiesCallback>
-      get_managed_properties_callbacks_;
   base::flat_map<int, SetPropertiesCallback> set_properties_callbacks_;
   base::flat_map<int, ConfigureNetworkCallback> configure_network_callbacks_;
   base::flat_map<int, ForgetNetworkCallback> forget_network_callbacks_;
@@ -183,10 +175,6 @@
 
   std::vector<mojom::VpnProviderPtr> vpn_providers_;
 
-  // GetManagedProperties may require multiple async calls so we need to store
-  // an owned copy of the mojo properties by callback id.
-  base::flat_map<int, mojom::ManagedPropertiesPtr> managed_properties_;
-
   base::WeakPtrFactory<CrosNetworkConfig> weak_factory_{this};
 
   DISALLOW_COPY_AND_ASSIGN(CrosNetworkConfig);
diff --git a/components/arc/net/always_on_vpn_manager.cc b/components/arc/net/always_on_vpn_manager.cc
index b0d1615..477801e6d 100644
--- a/components/arc/net/always_on_vpn_manager.cc
+++ b/components/arc/net/always_on_vpn_manager.cc
@@ -10,22 +10,11 @@
 #include "base/bind_helpers.h"
 #include "base/logging.h"
 #include "base/values.h"
-#include "chromeos/network/managed_network_configuration_handler.h"
+#include "chromeos/network/network_configuration_handler.h"
 #include "chromeos/network/network_handler.h"
 #include "components/arc/arc_prefs.h"
 #include "third_party/cros_system_api/dbus/service_constants.h"
 
-namespace {
-
-void SetPackageErrorCallback(
-    const std::string& error_name,
-    std::unique_ptr<base::DictionaryValue> error_data) {
-  DVLOG(1) << "Error while setting Always-On VPN package in shill: "
-           << error_name << ", " << *error_data;
-}
-
-}  // namespace
-
 namespace arc {
 
 AlwaysOnVpnManager::AlwaysOnVpnManager(PrefService* pref_service) {
@@ -46,10 +35,9 @@
   bool lockdown = registrar_.prefs()->GetBoolean(prefs::kAlwaysOnVpnLockdown);
   if (lockdown && !package.empty()) {
     chromeos::NetworkHandler::Get()
-        ->managed_network_configuration_handler()
+        ->network_configuration_handler()
         ->SetManagerProperty(shill::kAlwaysOnVpnPackageProperty,
-                             base::Value(std::string()), base::DoNothing(),
-                             base::Bind(&SetPackageErrorCallback));
+                             base::Value(std::string()));
   }
   registrar_.RemoveAll();
 }
@@ -63,11 +51,9 @@
         registrar_.prefs()->GetString(prefs::kAlwaysOnVpnPackage);
   }
   chromeos::NetworkHandler::Get()
-      ->managed_network_configuration_handler()
+      ->network_configuration_handler()
       ->SetManagerProperty(shill::kAlwaysOnVpnPackageProperty,
-                           base::Value(always_on_vpn_package),
-                           base::DoNothing(),
-                           base::Bind(&SetPackageErrorCallback));
+                           base::Value(always_on_vpn_package));
 }
 
 }  // namespace arc
diff --git a/components/autofill/content/browser/risk/fingerprint.cc b/components/autofill/content/browser/risk/fingerprint.cc
index 9a7714f6..e23505a 100644
--- a/components/autofill/content/browser/risk/fingerprint.cc
+++ b/components/autofill/content/browser/risk/fingerprint.cc
@@ -37,7 +37,6 @@
 #include "content/public/browser/render_widget_host.h"
 #include "content/public/browser/render_widget_host_view.h"
 #include "content/public/browser/web_contents.h"
-#include "content/public/common/screen_info.h"
 #include "content/public/common/webplugininfo.h"
 #include "gpu/config/gpu_info.h"
 #include "mojo/public/cpp/bindings/remote.h"
@@ -136,7 +135,7 @@
 //   (d) the size of the screen unavailable to web page content,
 //       i.e. the Taskbar size on Windows
 // into the |machine|.
-void AddScreenInfoToFingerprint(const content::ScreenInfo& screen_info,
+void AddScreenInfoToFingerprint(const blink::ScreenInfo& screen_info,
                                 Fingerprint::MachineCharacteristics* machine) {
   machine->set_screen_count(display::Screen::GetScreen()->GetNumDisplays());
 
@@ -188,7 +187,7 @@
       uint64_t obfuscated_gaia_id,
       const gfx::Rect& window_bounds,
       const gfx::Rect& content_bounds,
-      const content::ScreenInfo& screen_info,
+      const blink::ScreenInfo& screen_info,
       const std::string& version,
       const std::string& charset,
       const std::string& accept_languages,
@@ -230,7 +229,7 @@
   const uint64_t obfuscated_gaia_id_;
   const gfx::Rect window_bounds_;
   const gfx::Rect content_bounds_;
-  const content::ScreenInfo screen_info_;
+  const blink::ScreenInfo screen_info_;
   const std::string version_;
   const std::string charset_;
   const std::string accept_languages_;
@@ -264,7 +263,7 @@
     uint64_t obfuscated_gaia_id,
     const gfx::Rect& window_bounds,
     const gfx::Rect& content_bounds,
-    const content::ScreenInfo& screen_info,
+    const blink::ScreenInfo& screen_info,
     const std::string& version,
     const std::string& charset,
     const std::string& accept_languages,
@@ -447,7 +446,7 @@
     uint64_t obfuscated_gaia_id,
     const gfx::Rect& window_bounds,
     const gfx::Rect& content_bounds,
-    const content::ScreenInfo& screen_info,
+    const blink::ScreenInfo& screen_info,
     const std::string& version,
     const std::string& charset,
     const std::string& accept_languages,
@@ -479,7 +478,7 @@
     base::OnceCallback<void(std::unique_ptr<Fingerprint>)> callback) {
   gfx::Rect content_bounds = web_contents->GetContainerBounds();
 
-  content::ScreenInfo screen_info;
+  blink::ScreenInfo screen_info;
   content::RenderWidgetHostView* host_view =
       web_contents->GetRenderWidgetHostView();
   if (host_view)
diff --git a/components/autofill/content/browser/risk/fingerprint_browsertest.cc b/components/autofill/content/browser/risk/fingerprint_browsertest.cc
index 14337283..663ebea 100644
--- a/components/autofill/content/browser/risk/fingerprint_browsertest.cc
+++ b/components/autofill/content/browser/risk/fingerprint_browsertest.cc
@@ -14,7 +14,6 @@
 #include "components/autofill/content/browser/risk/proto/fingerprint.pb.h"
 #include "components/autofill/core/common/autofill_clock.h"
 #include "content/public/browser/gpu_data_manager.h"
-#include "content/public/common/screen_info.h"
 #include "content/public/test/browser_test.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/test_utils.h"
@@ -37,7 +36,7 @@
     uint64_t obfuscated_gaia_id,
     const gfx::Rect& window_bounds,
     const gfx::Rect& content_bounds,
-    const content::ScreenInfo& screen_info,
+    const blink::ScreenInfo& screen_info,
     const std::string& version,
     const std::string& charset,
     const std::string& accept_languages,
@@ -201,7 +200,7 @@
 
 // Test that getting a fingerprint works on some basic level.
 IN_PROC_BROWSER_TEST_F(AutofillRiskFingerprintTest, GetFingerprint) {
-  content::ScreenInfo screen_info;
+  blink::ScreenInfo screen_info;
   screen_info.depth = kScreenColorDepth;
   screen_info.rect = screen_bounds_;
   screen_info.available_rect = available_screen_bounds_;
diff --git a/components/autofill_assistant/browser/generic_ui_java_generated_enums.h b/components/autofill_assistant/browser/generic_ui_java_generated_enums.h
index 604e942..23d29a1a 100644
--- a/components/autofill_assistant/browser/generic_ui_java_generated_enums.h
+++ b/components/autofill_assistant/browser/generic_ui_java_generated_enums.h
@@ -27,7 +27,16 @@
   PROGRESSBAR_DEFAULT_INITIAL_STEP = 1,
   PROGRESSBAR_DEFAULT_DATA_COLLECTION = 2,
   PROGRESSBAR_DEFAULT_PAYMENT = 3,
-  PROGRESSBAR_DEFAULT_FINAL_STEP = 4
+  PROGRESSBAR_DEFAULT_FINAL_STEP = 4,
+  SITTING_PERSON = 5,
+  TICKET_STUB = 6,
+  SHOPPING_BASKET = 7,
+  FAST_FOOD = 8,
+  LOCAL_DINING = 9,
+  COGWHEEL = 10,
+  KEY = 11,
+  CAR = 12,
+  GROCERY = 13,
 };
 
 }  // namespace autofill_assistant
diff --git a/components/autofill_assistant/browser/retry_timer.cc b/components/autofill_assistant/browser/retry_timer.cc
index c69a7e4..482a4d7 100644
--- a/components/autofill_assistant/browser/retry_timer.cc
+++ b/components/autofill_assistant/browser/retry_timer.cc
@@ -4,8 +4,11 @@
 
 #include "components/autofill_assistant/browser/retry_timer.h"
 
+#include <algorithm>
+
 #include "base/bind.h"
 #include "base/bind_helpers.h"
+#include "base/numerics/clamped_math.h"
 #include "components/autofill_assistant/browser/client_status.h"
 
 namespace autofill_assistant {
@@ -21,12 +24,8 @@
   Reset();
   task_ = std::move(task);
   on_done_ = std::move(on_done);
-  if (max_wait_time <= base::TimeDelta::FromSeconds(0)) {
-    remaining_attempts_ = 1;
-  } else {
-    remaining_attempts_ = (max_wait_time + period_) / period_;
-  }
-  DCHECK_GE(remaining_attempts_, 1);
+  remaining_attempts_ =
+      base::ClampAdd(1, std::max(int64_t{0}, max_wait_time / period_));
   RunTask();
 }
 
diff --git a/components/autofill_assistant/browser/view_layout.proto b/components/autofill_assistant/browser/view_layout.proto
index 45e230d..fd0f6a1 100644
--- a/components/autofill_assistant/browser/view_layout.proto
+++ b/components/autofill_assistant/browser/view_layout.proto
@@ -80,6 +80,15 @@
     PROGRESSBAR_DEFAULT_DATA_COLLECTION = 2;
     PROGRESSBAR_DEFAULT_PAYMENT = 3;
     PROGRESSBAR_DEFAULT_FINAL_STEP = 4;
+    SITTING_PERSON = 5;
+    TICKET_STUB = 6;
+    SHOPPING_BASKET = 7;
+    FAST_FOOD = 8;
+    LOCAL_DINING = 9;
+    COGWHEEL = 10;
+    KEY = 11;
+    CAR = 12;
+    GROCERY = 13;
   }
 
   oneof drawable {
diff --git a/components/content_settings/core/browser/cookie_settings_policy_handler_unittest.cc b/components/content_settings/core/browser/cookie_settings_policy_handler_unittest.cc
index 93a15d0..df829ac 100644
--- a/components/content_settings/core/browser/cookie_settings_policy_handler_unittest.cc
+++ b/components/content_settings/core/browser/cookie_settings_policy_handler_unittest.cc
@@ -27,11 +27,10 @@
  protected:
   void SetThirdPartyCookiePolicy(bool third_party_cookie_blocking_enabled) {
     policy::PolicyMap policy;
-    policy.Set(
-        policy::key::kBlockThirdPartyCookies, policy::POLICY_LEVEL_MANDATORY,
-        policy::POLICY_SCOPE_USER, policy::POLICY_SOURCE_CLOUD,
-        std::make_unique<base::Value>(third_party_cookie_blocking_enabled),
-        nullptr);
+    policy.Set(policy::key::kBlockThirdPartyCookies,
+               policy::POLICY_LEVEL_MANDATORY, policy::POLICY_SCOPE_USER,
+               policy::POLICY_SOURCE_CLOUD,
+               base::Value(third_party_cookie_blocking_enabled), nullptr);
     UpdateProviderPolicy(policy);
   }
 };
diff --git a/components/download/internal/common/DEPS b/components/download/internal/common/DEPS
index 8eaf2cdd6..5ca4d58 100644
--- a/components/download/internal/common/DEPS
+++ b/components/download/internal/common/DEPS
@@ -23,10 +23,11 @@
   "+net/http/http_content_disposition.h",
   "+net/http/http_request_headers.h",
   "+net/http/http_response_headers.h",
+  "+net/http/http_response_info.h",
   "+net/http/http_status_code.h",
   "+net/http/http_util.h",
   "+net/traffic_annotation/network_traffic_annotation.h",
-  "+net/url_request/url_request_context_getter.h",
+  "+net/url_request/referrer_policy.h",
   "+services/device/public/mojom",
   "+services/metrics/public/cpp",
   "+services/network/public/cpp",
diff --git a/components/download/internal/common/download_create_info.cc b/components/download/internal/common/download_create_info.cc
index 7d45b181..bba0342 100644
--- a/components/download/internal/common/download_create_info.cc
+++ b/components/download/internal/common/download_create_info.cc
@@ -17,8 +17,8 @@
     const base::Time& start_time,
     std::unique_ptr<DownloadSaveInfo> save_info)
     : is_new_download(true),
-      referrer_policy(net::URLRequest::
-                          CLEAR_REFERRER_ON_TRANSITION_FROM_SECURE_TO_INSECURE),
+      referrer_policy(
+          net::ReferrerPolicy::CLEAR_ON_TRANSITION_FROM_SECURE_TO_INSECURE),
       start_time(start_time),
       total_bytes(0),
       offset(0),
diff --git a/components/download/internal/common/download_item_impl.cc b/components/download/internal/common/download_item_impl.cc
index b4c6ecb..acc02bc 100644
--- a/components/download/internal/common/download_item_impl.cc
+++ b/components/download/internal/common/download_item_impl.cc
@@ -60,6 +60,7 @@
 #include "net/http/http_response_headers.h"
 #include "net/http/http_status_code.h"
 #include "net/traffic_annotation/network_traffic_annotation.h"
+#include "net/url_request/referrer_policy.h"
 
 #if defined(OS_ANDROID)
 #include "components/download/internal/common/android/download_collection_bridge.h"
@@ -2598,7 +2599,7 @@
   // (which is the contents of the Referer header for the last download request)
   // will only be sent to the URL returned by GetURL().
   download_params->set_referrer(GetReferrerUrl());
-  download_params->set_referrer_policy(net::URLRequest::NEVER_CLEAR_REFERRER);
+  download_params->set_referrer_policy(net::ReferrerPolicy::NEVER_CLEAR);
   download_params->set_cross_origin_redirects(
       network::mojom::RedirectMode::kError);
 
diff --git a/components/download/internal/common/download_job_factory.cc b/components/download/internal/common/download_job_factory.cc
index 03658d7..052f69f 100644
--- a/components/download/internal/common/download_job_factory.cc
+++ b/components/download/internal/common/download_job_factory.cc
@@ -14,7 +14,7 @@
 #include "components/download/public/common/download_features.h"
 #include "components/download/public/common/download_item.h"
 #include "components/download/public/common/download_stats.h"
-#include "net/url_request/url_request_context_getter.h"
+#include "net/http/http_response_info.h"
 
 namespace download {
 
diff --git a/components/download/internal/common/parallel_download_job.cc b/components/download/internal/common/parallel_download_job.cc
index 155653f..c8355e740 100644
--- a/components/download/internal/common/parallel_download_job.cc
+++ b/components/download/internal/common/parallel_download_job.cc
@@ -14,6 +14,7 @@
 #include "components/download/public/common/download_stats.h"
 #include "mojo/public/cpp/bindings/pending_remote.h"
 #include "net/traffic_annotation/network_traffic_annotation.h"
+#include "net/url_request/referrer_policy.h"
 
 namespace download {
 namespace {
@@ -278,7 +279,7 @@
   // Subsequent range requests have the same referrer URL as the original
   // download request.
   download_params->set_referrer(download_item_->GetReferrerUrl());
-  download_params->set_referrer_policy(net::URLRequest::NEVER_CLEAR_REFERRER);
+  download_params->set_referrer_policy(net::ReferrerPolicy::NEVER_CLEAR);
 
   // TODO(xingliu): We should not support redirect at all for parallel requests.
   // Currently the network service code path still can redirect as long as it's
diff --git a/components/download/public/common/DEPS b/components/download/public/common/DEPS
index 379c63c..b6a658a 100644
--- a/components/download/public/common/DEPS
+++ b/components/download/public/common/DEPS
@@ -11,7 +11,7 @@
   "+net/cert/cert_status_flags.h",
   "+net/http/http_response_headers.h",
   "+net/http/http_response_info.h",
-  "+net/url_request/url_request.h",
+  "+net/url_request/referrer_policy.h",
   "+net/traffic_annotation/network_traffic_annotation.h",
   "+services/device/public",
   "+services/metrics/public/cpp",
diff --git a/components/download/public/common/download_create_info.h b/components/download/public/common/download_create_info.h
index d1699c6..b8c6e21b 100644
--- a/components/download/public/common/download_create_info.h
+++ b/components/download/public/common/download_create_info.h
@@ -23,7 +23,7 @@
 #include "components/download/public/common/download_source.h"
 #include "components/download/public/common/download_url_parameters.h"
 #include "net/http/http_response_info.h"
-#include "net/url_request/url_request.h"
+#include "net/url_request/referrer_policy.h"
 #include "services/metrics/public/cpp/ukm_source_id.h"
 #include "ui/base/page_transition_types.h"
 #include "url/gurl.h"
@@ -66,7 +66,7 @@
 
   // The URL and referrer policy that referred us.
   GURL referrer_url;
-  net::URLRequest::ReferrerPolicy referrer_policy;
+  net::ReferrerPolicy referrer_policy;
 
   // Site URL for the site instance that initiated the download.
   GURL site_url;
diff --git a/components/download/public/common/download_response_handler.h b/components/download/public/common/download_response_handler.h
index 1fd2fe8e9..7736c27 100644
--- a/components/download/public/common/download_response_handler.h
+++ b/components/download/public/common/download_response_handler.h
@@ -88,7 +88,7 @@
   std::vector<GURL> url_chain_;
   std::string method_;
   GURL referrer_;
-  net::URLRequest::ReferrerPolicy referrer_policy_;
+  net::ReferrerPolicy referrer_policy_;
   bool is_transient_;
   bool fetch_error_body_;
   network::mojom::RedirectMode cross_origin_redirects_;
diff --git a/components/download/public/common/download_url_parameters.cc b/components/download/public/common/download_url_parameters.cc
index 17c3ffc..5f879b8 100644
--- a/components/download/public/common/download_url_parameters.cc
+++ b/components/download/public/common/download_url_parameters.cc
@@ -23,8 +23,7 @@
       post_id_(-1),
       prefer_cache_(false),
       referrer_policy_(
-          net::URLRequest::
-              CLEAR_REFERRER_ON_TRANSITION_FROM_SECURE_TO_INSECURE),
+          net::ReferrerPolicy::CLEAR_ON_TRANSITION_FROM_SECURE_TO_INSECURE),
       render_process_host_id_(render_process_host_id),
       render_view_host_routing_id_(render_view_host_routing_id),
       render_frame_host_routing_id_(render_frame_host_routing_id),
diff --git a/components/download/public/common/download_url_parameters.h b/components/download/public/common/download_url_parameters.h
index 35f6c6e2..569faaa 100644
--- a/components/download/public/common/download_url_parameters.h
+++ b/components/download/public/common/download_url_parameters.h
@@ -19,7 +19,7 @@
 #include "components/download/public/common/download_save_info.h"
 #include "components/download/public/common/download_source.h"
 #include "net/traffic_annotation/network_traffic_annotation.h"
-#include "net/url_request/url_request.h"
+#include "net/url_request/referrer_policy.h"
 #include "services/network/public/cpp/resource_request_body.h"
 #include "services/network/public/mojom/fetch_api.mojom-shared.h"
 #include "storage/browser/blob/blob_data_handle.h"
@@ -105,7 +105,7 @@
 
   // HTTP Referrer, referrer policy and encoding.
   void set_referrer(const GURL& referrer) { referrer_ = referrer; }
-  void set_referrer_policy(net::URLRequest::ReferrerPolicy referrer_policy) {
+  void set_referrer_policy(net::ReferrerPolicy referrer_policy) {
     referrer_policy_ = referrer_policy;
   }
   void set_referrer_encoding(const std::string& referrer_encoding) {
@@ -265,9 +265,7 @@
   int64_t post_id() const { return post_id_; }
   bool prefer_cache() const { return prefer_cache_; }
   const GURL& referrer() const { return referrer_; }
-  net::URLRequest::ReferrerPolicy referrer_policy() const {
-    return referrer_policy_;
-  }
+  net::ReferrerPolicy referrer_policy() const { return referrer_policy_; }
   const std::string& referrer_encoding() const { return referrer_encoding_; }
   const base::Optional<url::Origin>& initiator() const { return initiator_; }
   const std::string& request_origin() const { return request_origin_; }
@@ -336,7 +334,7 @@
   int64_t post_id_;
   bool prefer_cache_;
   GURL referrer_;
-  net::URLRequest::ReferrerPolicy referrer_policy_;
+  net::ReferrerPolicy referrer_policy_;
   base::Optional<url::Origin> initiator_;
   std::string referrer_encoding_;
   int render_process_host_id_;
diff --git a/components/drive/drive_uploader.cc b/components/drive/drive_uploader.cc
index d68a84a..ec3e76f 100644
--- a/components/drive/drive_uploader.cc
+++ b/components/drive/drive_uploader.cc
@@ -20,10 +20,11 @@
 #include "services/device/public/mojom/wake_lock.mojom.h"
 
 using google_apis::CancelCallback;
-using google_apis::FileResource;
+using google_apis::CancelCallbackOnce;
 using google_apis::DRIVE_CANCELLED;
-using google_apis::DriveApiErrorCode;
 using google_apis::DRIVE_NO_SPACE;
+using google_apis::DriveApiErrorCode;
+using google_apis::FileResource;
 using google_apis::HTTP_CONFLICT;
 using google_apis::HTTP_CREATED;
 using google_apis::HTTP_FORBIDDEN;
@@ -120,8 +121,9 @@
   }
 
   // Returns the callback to cancel the upload represented by this struct.
-  CancelCallback GetCancelCallback() {
-    return base::Bind(&UploadFileInfo::Cancel, weak_ptr_factory_.GetWeakPtr());
+  CancelCallbackOnce GetCancelCallback() {
+    return base::BindOnce(&UploadFileInfo::Cancel,
+                          weak_ptr_factory_.GetWeakPtr());
   }
 
   // The local file path of the file to be uploaded.
@@ -179,7 +181,7 @@
 
 DriveUploader::~DriveUploader() = default;
 
-CancelCallback DriveUploader::UploadNewFile(
+CancelCallbackOnce DriveUploader::UploadNewFile(
     const std::string& parent_resource_id,
     const base::FilePath& local_file_path,
     const std::string& title,
@@ -213,7 +215,7 @@
   current_batch_request_ = nullptr;
 }
 
-CancelCallback DriveUploader::UploadExistingFile(
+CancelCallbackOnce DriveUploader::UploadExistingFile(
     const std::string& resource_id,
     const base::FilePath& local_file_path,
     const std::string& content_type,
@@ -235,7 +237,7 @@
                      current_batch_request_));
 }
 
-CancelCallback DriveUploader::ResumeUploadFile(
+CancelCallbackOnce DriveUploader::ResumeUploadFile(
     const GURL& upload_location,
     const base::FilePath& local_file_path,
     const std::string& content_type,
@@ -256,7 +258,7 @@
                                         weak_ptr_factory_.GetWeakPtr()));
 }
 
-CancelCallback DriveUploader::StartUploadFile(
+CancelCallbackOnce DriveUploader::StartUploadFile(
     std::unique_ptr<UploadFileInfo> upload_file_info,
     StartInitiateUploadCallback start_initiate_upload_callback) {
   DCHECK(thread_checker_.CalledOnValidThread());
diff --git a/components/drive/drive_uploader.h b/components/drive/drive_uploader.h
index 93adcc6..867f882 100644
--- a/components/drive/drive_uploader.h
+++ b/components/drive/drive_uploader.h
@@ -79,7 +79,7 @@
   // progress_callback:
   //   Periodically called back with the total number of bytes sent so far.
   //   May be null if the information is not needed.
-  virtual google_apis::CancelCallback UploadNewFile(
+  virtual google_apis::CancelCallbackOnce UploadNewFile(
       const std::string& parent_resource_id,
       const base::FilePath& local_file_path,
       const std::string& title,
@@ -99,7 +99,7 @@
   //   Expected ETag for the destination file. If it does not match, the upload
   //   fails with UPLOAD_ERROR_CONFLICT.
   //   If |etag| is empty, the test is skipped.
-  virtual google_apis::CancelCallback UploadExistingFile(
+  virtual google_apis::CancelCallbackOnce UploadExistingFile(
       const std::string& resource_id,
       const base::FilePath& local_file_path,
       const std::string& content_type,
@@ -113,7 +113,7 @@
   // |content_type| must be set to the same ones for previous invocation.
   //
   // See comments at UploadNewFile about common parameters and the return value.
-  virtual google_apis::CancelCallback ResumeUploadFile(
+  virtual google_apis::CancelCallbackOnce ResumeUploadFile(
       const GURL& upload_location,
       const base::FilePath& local_file_path,
       const std::string& content_type,
@@ -134,7 +134,7 @@
   // DriveUploaderInterface overrides.
   void StartBatchProcessing() override;
   void StopBatchProcessing() override;
-  google_apis::CancelCallback UploadNewFile(
+  google_apis::CancelCallbackOnce UploadNewFile(
       const std::string& parent_resource_id,
       const base::FilePath& local_file_path,
       const std::string& title,
@@ -142,14 +142,14 @@
       const UploadNewFileOptions& options,
       UploadCompletionCallback callback,
       google_apis::ProgressCallback progress_callback) override;
-  google_apis::CancelCallback UploadExistingFile(
+  google_apis::CancelCallbackOnce UploadExistingFile(
       const std::string& resource_id,
       const base::FilePath& local_file_path,
       const std::string& content_type,
       const UploadExistingFileOptions& options,
       UploadCompletionCallback callback,
       google_apis::ProgressCallback progress_callback) override;
-  google_apis::CancelCallback ResumeUploadFile(
+  google_apis::CancelCallbackOnce ResumeUploadFile(
       const GURL& upload_location,
       const base::FilePath& local_file_path,
       const std::string& content_type,
@@ -164,7 +164,7 @@
       StartInitiateUploadCallback;
 
   // Starts uploading a file with |upload_file_info|.
-  google_apis::CancelCallback StartUploadFile(
+  google_apis::CancelCallbackOnce StartUploadFile(
       std::unique_ptr<UploadFileInfo> upload_file_info,
       StartInitiateUploadCallback start_initiate_upload_callback);
   void StartUploadFileAfterGetFileSize(
diff --git a/components/history/core/browser/top_sites_impl.cc b/components/history/core/browser/top_sites_impl.cc
index 3d18e0a1..25a0a7b 100644
--- a/components/history/core/browser/top_sites_impl.cc
+++ b/components/history/core/browser/top_sites_impl.cc
@@ -166,7 +166,7 @@
   {
     DictionaryPrefUpdate update(pref_service_, kMostVisitedURLsBlacklist);
     base::DictionaryValue* blacklist = update.Get();
-    blacklist->RemoveWithoutPathExpansion(GetURLHash(url), nullptr);
+    blacklist->RemoveKey(GetURLHash(url));
   }
   ResetThreadSafeCache();
   NotifyTopSitesChanged(TopSitesObserver::ChangeReason::BLACKLIST);
diff --git a/components/image_fetcher/core/image_data_fetcher.cc b/components/image_fetcher/core/image_data_fetcher.cc
index 01f4be8..dd2ad50 100644
--- a/components/image_fetcher/core/image_data_fetcher.cc
+++ b/components/image_fetcher/core/image_data_fetcher.cc
@@ -13,7 +13,6 @@
 #include "net/base/load_flags.h"
 #include "net/http/http_response_headers.h"
 #include "net/http/http_status_code.h"
-#include "net/url_request/url_request.h"  // for ReferrerPolicy
 #include "services/network/public/cpp/resource_request.h"
 #include "services/network/public/cpp/shared_url_loader_factory.h"
 #include "services/network/public/cpp/simple_url_loader.h"
@@ -69,7 +68,7 @@
                                       bool send_cookies) {
   FetchImageData(
       image_url, std::move(callback), params, /*referrer=*/std::string(),
-      net::URLRequest::CLEAR_REFERRER_ON_TRANSITION_FROM_SECURE_TO_INSECURE,
+      net::ReferrerPolicy::CLEAR_ON_TRANSITION_FROM_SECURE_TO_INSECURE,
       send_cookies);
 }
 
@@ -82,7 +81,7 @@
       image_url, std::move(callback),
       ImageFetcherParams(traffic_annotation, kNoUmaClient),
       /*referrer=*/std::string(),
-      net::URLRequest::CLEAR_REFERRER_ON_TRANSITION_FROM_SECURE_TO_INSECURE,
+      net::ReferrerPolicy::CLEAR_ON_TRANSITION_FROM_SECURE_TO_INSECURE,
       send_cookies);
 }
 
@@ -90,7 +89,7 @@
     const GURL& image_url,
     ImageDataFetcherCallback callback,
     const std::string& referrer,
-    net::URLRequest::ReferrerPolicy referrer_policy,
+    net::ReferrerPolicy referrer_policy,
     const net::NetworkTrafficAnnotationTag& traffic_annotation,
     bool send_cookies) {
   FetchImageData(image_url, std::move(callback),
@@ -98,13 +97,12 @@
                  referrer_policy, send_cookies);
 }
 
-void ImageDataFetcher::FetchImageData(
-    const GURL& image_url,
-    ImageDataFetcherCallback callback,
-    ImageFetcherParams params,
-    const std::string& referrer,
-    net::URLRequest::ReferrerPolicy referrer_policy,
-    bool send_cookies) {
+void ImageDataFetcher::FetchImageData(const GURL& image_url,
+                                      ImageDataFetcherCallback callback,
+                                      ImageFetcherParams params,
+                                      const std::string& referrer,
+                                      net::ReferrerPolicy referrer_policy,
+                                      bool send_cookies) {
   DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
 
   // Handle data urls explicitly since SimpleURLLoader doesn't.
diff --git a/components/image_fetcher/core/image_data_fetcher.h b/components/image_fetcher/core/image_data_fetcher.h
index 7acb298..ef6740951 100644
--- a/components/image_fetcher/core/image_data_fetcher.h
+++ b/components/image_fetcher/core/image_data_fetcher.h
@@ -18,7 +18,7 @@
 #include "components/image_fetcher/core/image_fetcher_types.h"
 #include "components/image_fetcher/core/request_metadata.h"
 #include "net/traffic_annotation/network_traffic_annotation.h"
-#include "net/url_request/url_request.h"
+#include "net/url_request/referrer_policy.h"
 #include "url/gurl.h"
 
 namespace network {
@@ -55,7 +55,7 @@
                       ImageDataFetcherCallback callback,
                       ImageFetcherParams params,
                       const std::string& referrer,
-                      net::URLRequest::ReferrerPolicy referrer_policy,
+                      net::ReferrerPolicy referrer_policy,
                       bool send_cookies = false);
 
   // Like above, but supports providing only a traffic annotation.
@@ -70,7 +70,7 @@
       const GURL& image_url,
       ImageDataFetcherCallback callback,
       const std::string& referrer,
-      net::URLRequest::ReferrerPolicy referrer_policy,
+      net::ReferrerPolicy referrer_policy,
       const net::NetworkTrafficAnnotationTag& traffic_annotation,
       bool send_cookies = false);
 
diff --git a/components/image_fetcher/ios/ios_image_data_fetcher_wrapper.h b/components/image_fetcher/ios/ios_image_data_fetcher_wrapper.h
index 3263af0..15d7c24 100644
--- a/components/image_fetcher/ios/ios_image_data_fetcher_wrapper.h
+++ b/components/image_fetcher/ios/ios_image_data_fetcher_wrapper.h
@@ -10,6 +10,7 @@
 #include "base/memory/ref_counted.h"
 #include "components/image_fetcher/core/image_data_fetcher.h"
 #include "components/image_fetcher/core/image_fetcher_types.h"
+#include "net/url_request/referrer_policy.h"
 
 namespace network {
 class SharedURLLoaderFactory;
@@ -38,12 +39,11 @@
   // The |referrer| and |referrer_policy| will be passed on to the underlying
   // URLLoader.
   // |callback| cannot be nil.
-  void FetchImageDataWebpDecoded(
-      const GURL& image_url,
-      ImageDataFetcherBlock callback,
-      const std::string& referrer,
-      net::URLRequest::ReferrerPolicy referrer_policy,
-      bool send_cookies = false);
+  void FetchImageDataWebpDecoded(const GURL& image_url,
+                                 ImageDataFetcherBlock callback,
+                                 const std::string& referrer,
+                                 net::ReferrerPolicy referrer_policy,
+                                 bool send_cookies = false);
 
   // Test-only accessor for underlying ImageDataFetcher.
   ImageDataFetcher* AccessImageDataFetcherForTesting() {
diff --git a/components/image_fetcher/ios/ios_image_data_fetcher_wrapper.mm b/components/image_fetcher/ios/ios_image_data_fetcher_wrapper.mm
index 5caec94..0d1f877 100644
--- a/components/image_fetcher/ios/ios_image_data_fetcher_wrapper.mm
+++ b/components/image_fetcher/ios/ios_image_data_fetcher_wrapper.mm
@@ -41,7 +41,7 @@
     const GURL& image_url,
     ImageDataFetcherBlock callback,
     const std::string& referrer,
-    net::URLRequest::ReferrerPolicy referrer_policy,
+    net::ReferrerPolicy referrer_policy,
     bool send_cookies) {
   DCHECK(callback);
 
diff --git a/components/paint_preview/player/android/BUILD.gn b/components/paint_preview/player/android/BUILD.gn
index 372766f..3ac2aade 100644
--- a/components/paint_preview/player/android/BUILD.gn
+++ b/components/paint_preview/player/android/BUILD.gn
@@ -57,6 +57,7 @@
     "java/src/org/chromium/components/paintpreview/player/PlayerUserActionRecorder.java",
     "java/src/org/chromium/components/paintpreview/player/frame/PlayerFrameBitmapPainter.java",
     "java/src/org/chromium/components/paintpreview/player/frame/PlayerFrameBitmapState.java",
+    "java/src/org/chromium/components/paintpreview/player/frame/PlayerFrameBitmapStateController.java",
     "java/src/org/chromium/components/paintpreview/player/frame/PlayerFrameCoordinator.java",
     "java/src/org/chromium/components/paintpreview/player/frame/PlayerFrameGestureDetector.java",
     "java/src/org/chromium/components/paintpreview/player/frame/PlayerFrameMediator.java",
@@ -157,6 +158,9 @@
     "junit/src/org/chromium/components/paintpreview/player/frame/PaintPreviewCustomFlingingShadowScroller.java",
     "junit/src/org/chromium/components/paintpreview/player/frame/PlayerFrameBitmapPainterTest.java",
     "junit/src/org/chromium/components/paintpreview/player/frame/PlayerFrameMediatorTest.java",
+    "junit/src/org/chromium/components/paintpreview/player/frame/PlayerFrameScaleControllerTest.java",
+    "junit/src/org/chromium/components/paintpreview/player/frame/PlayerFrameScrollControllerTest.java",
+    "junit/src/org/chromium/components/paintpreview/player/frame/PlayerFrameViewportTest.java",
   ]
   deps = [
     ":java",
diff --git a/components/paint_preview/player/android/java/src/org/chromium/components/paintpreview/player/frame/PlayerFrameBitmapState.java b/components/paint_preview/player/android/java/src/org/chromium/components/paintpreview/player/frame/PlayerFrameBitmapState.java
index 12bf3d642..1a20cb33 100644
--- a/components/paint_preview/player/android/java/src/org/chromium/components/paintpreview/player/frame/PlayerFrameBitmapState.java
+++ b/components/paint_preview/player/android/java/src/org/chromium/components/paintpreview/player/frame/PlayerFrameBitmapState.java
@@ -14,6 +14,9 @@
 import org.chromium.base.UnguessableToken;
 import org.chromium.components.paintpreview.player.PlayerCompositorDelegate;
 
+import java.util.HashSet;
+import java.util.Set;
+
 /**
  * Manages the bitmaps shown in the PlayerFrameView at a given scale factor.
  */
@@ -31,20 +34,20 @@
      * Whether we currently need a bitmap tile. This is used for deleting bitmaps that we don't
      * need and freeing up memory.
      */
-    @VisibleForTesting
-    boolean[][] mRequiredBitmaps;
+    private boolean[][] mRequiredBitmaps;
     /** Delegate for accessing native to request bitmaps. */
     private final PlayerCompositorDelegate mCompositorDelegate;
-    private final PlayerFrameMediatorDelegate mMediatorDelegate;
+    private final PlayerFrameBitmapStateController mStateController;
+    private Set<Integer> mInitialMissingVisibleBitmaps = new HashSet<>();
 
     PlayerFrameBitmapState(UnguessableToken guid, int tileWidth, int tileHeight, float scaleFactor,
             Size contentSize, PlayerCompositorDelegate compositorDelegate,
-            PlayerFrameMediatorDelegate mediatorDelegate) {
+            PlayerFrameBitmapStateController stateController) {
         mGuid = guid;
         mTileSize = new Size(tileWidth, tileHeight);
         mScaleFactor = scaleFactor;
         mCompositorDelegate = compositorDelegate;
-        mMediatorDelegate = mediatorDelegate;
+        mStateController = stateController;
 
         // Each tile is as big as the initial view port. Here we determine the number of
         // columns and rows for the current scale factor.
@@ -56,6 +59,11 @@
         mRequiredBitmaps = new boolean[rows][cols];
     }
 
+    @VisibleForTesting
+    boolean[][] getRequiredBitmapsForTest() {
+        return mRequiredBitmaps;
+    }
+
     Bitmap[][] getMatrix() {
         return mBitmapMatrix;
     }
@@ -74,6 +82,20 @@
     }
 
     /**
+     * Whether this bitmap state has loaded all the initial bitmaps.
+     */
+    boolean isReadyToShow() {
+        return mInitialMissingVisibleBitmaps == null;
+    }
+
+    /**
+     * Skips waiting for all visible bitmaps before showing.
+     */
+    void skipWaitingForVisibleBitmaps() {
+        mInitialMissingVisibleBitmaps = null;
+    }
+
+    /**
      * Clears all the required bitmaps before they are re-set in {@link #requestBitmapForRect()}
      */
     void clearRequiredBitmaps() {
@@ -92,7 +114,7 @@
      * @param viewportRect The rect of the viewport for which bitmaps are needed.
      */
     void requestBitmapForRect(Rect viewportRect) {
-        if (mRequiredBitmaps == null) return;
+        if (mRequiredBitmaps == null || mBitmapMatrix == null) return;
 
         final int rowStart =
                 Math.max(0, (int) Math.floor((double) viewportRect.top / mTileSize.getHeight()));
@@ -107,6 +129,9 @@
         for (int col = colStart; col < colEnd; col++) {
             for (int row = rowStart; row < rowEnd; row++) {
                 requestBitmapForTile(row, col);
+                if (mInitialMissingVisibleBitmaps != null) {
+                    mInitialMissingVisibleBitmaps.add(row * mBitmapMatrix.length + col);
+                }
             }
         }
 
@@ -176,6 +201,26 @@
     }
 
     /**
+     * Marks the bitmap at row and col as being loaded. If all bitmaps that were initially requested
+     * for loading are present then this swaps the currently loading bitmap state to be the visible
+     * bitmap state.
+     * @param row The row of the bitmap that was loaded.
+     * @param col The column of the bitmap that was loaded.
+     */
+    private void markBitmapReceived(int row, int col) {
+        if (mBitmapMatrix == null) return;
+
+        if (mInitialMissingVisibleBitmaps != null) {
+            mInitialMissingVisibleBitmaps.remove(row * mBitmapMatrix.length + col);
+            if (!mInitialMissingVisibleBitmaps.isEmpty()) return;
+
+            mInitialMissingVisibleBitmaps = null;
+        }
+
+        mStateController.stateUpdated(this);
+    }
+
+    /**
      * Used as the callback for bitmap requests from the Paint Preview compositor.
      */
     private class BitmapRequestHandler implements Callback<Bitmap> {
@@ -208,7 +253,7 @@
 
             mPendingBitmapRequests[mRequestRow][mRequestCol] = false;
             mBitmapMatrix[mRequestRow][mRequestCol] = result;
-            mMediatorDelegate.updateBitmapMatrix(mBitmapMatrix);
+            markBitmapReceived(mRequestRow, mRequestCol);
             deleteUnrequiredBitmaps();
         }
 
@@ -224,6 +269,7 @@
             assert mPendingBitmapRequests[mRequestRow][mRequestCol];
 
             mPendingBitmapRequests[mRequestRow][mRequestCol] = false;
+            markBitmapReceived(mRequestRow, mRequestCol);
         }
     }
 }
diff --git a/components/paint_preview/player/android/java/src/org/chromium/components/paintpreview/player/frame/PlayerFrameBitmapStateController.java b/components/paint_preview/player/android/java/src/org/chromium/components/paintpreview/player/frame/PlayerFrameBitmapStateController.java
new file mode 100644
index 0000000..77448be
--- /dev/null
+++ b/components/paint_preview/player/android/java/src/org/chromium/components/paintpreview/player/frame/PlayerFrameBitmapStateController.java
@@ -0,0 +1,116 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+package org.chromium.components.paintpreview.player.frame;
+
+import android.util.Size;
+
+import androidx.annotation.VisibleForTesting;
+
+import org.chromium.base.UnguessableToken;
+import org.chromium.components.paintpreview.player.PlayerCompositorDelegate;
+
+/**
+ * Class for managing which bitmap state is shown.
+ */
+public class PlayerFrameBitmapStateController {
+    private PlayerFrameBitmapState mLoadingBitmapState;
+    private PlayerFrameBitmapState mVisibleBitmapState;
+
+    private final UnguessableToken mGuid;
+    private final PlayerFrameViewport mViewport;
+    private final Size mContentSize;
+    private final PlayerCompositorDelegate mCompositorDelegate;
+    private final PlayerFrameMediatorDelegate mMediatorDelegate;
+
+    PlayerFrameBitmapStateController(UnguessableToken guid, PlayerFrameViewport viewport,
+            Size contentSize, PlayerCompositorDelegate compositorDelegate,
+            PlayerFrameMediatorDelegate mediatorDelegate) {
+        mGuid = guid;
+        mViewport = viewport;
+        mContentSize = contentSize;
+        mCompositorDelegate = compositorDelegate;
+        mMediatorDelegate = mediatorDelegate;
+    }
+
+    @VisibleForTesting
+    void swapForTest() {
+        swap(mLoadingBitmapState);
+    }
+
+    /**
+     * Gets the bitmap state for loading.
+     * @param scaleUpdated Whether the scale was updated.
+     * @return The bitmap state to load new bitmaps to.
+     */
+    PlayerFrameBitmapState getBitmapState(boolean scaleUpdated) {
+        // Prefer mLoadingBitmapState if one exist. Otherwise use mVisibleBitmapState.
+        PlayerFrameBitmapState activeLoadingState =
+                (mLoadingBitmapState == null) ? mVisibleBitmapState : mLoadingBitmapState;
+        if (scaleUpdated || activeLoadingState == null) {
+            invalidateLoadingBitmaps();
+            mLoadingBitmapState =
+                    new PlayerFrameBitmapState(mGuid, mViewport.getWidth(), mViewport.getHeight(),
+                            mViewport.getScale(), mContentSize, mCompositorDelegate, this);
+            if (mVisibleBitmapState == null) {
+                mLoadingBitmapState.skipWaitingForVisibleBitmaps();
+                swap(mLoadingBitmapState);
+                activeLoadingState = mVisibleBitmapState;
+            } else {
+                activeLoadingState = mLoadingBitmapState;
+            }
+        }
+        return activeLoadingState;
+    }
+
+    /**
+     * Swaps the state to be new state.
+     * @param newState The new visible bitmap state.
+     */
+    void swap(PlayerFrameBitmapState newState) {
+        assert mLoadingBitmapState == newState;
+        // Clear the state to stop potential stragling updates.
+        if (mVisibleBitmapState != null) {
+            mVisibleBitmapState.clear();
+        }
+        mVisibleBitmapState = newState;
+        mLoadingBitmapState = null;
+        mMediatorDelegate.onSwapState();
+    }
+
+    /**
+     * Signals the bitmap state was updated.
+     * @param bitmapState The bitmap state that was updated.
+     */
+    void stateUpdated(PlayerFrameBitmapState bitmapState) {
+        if (isVisible(bitmapState)) {
+            mMediatorDelegate.updateBitmapMatrix(bitmapState.getMatrix());
+            return;
+        }
+
+        if (!bitmapState.isReadyToShow()) return;
+
+        swap(bitmapState);
+    }
+
+    /**
+     * Whether the bitmap state is visible.
+     */
+    boolean isVisible(PlayerFrameBitmapState state) {
+        return state == mVisibleBitmapState;
+    }
+
+    /**
+     * Invalidates loading bitmaps.
+     */
+    void invalidateLoadingBitmaps() {
+        if (mLoadingBitmapState == null) return;
+
+        // Invalidate an in-progress load if there is one. We only want one new scale factor fetched
+        // at a time. NOTE: we clear then null as the bitmap callbacks still hold a reference to the
+        // state so it won't be GC'd right away.
+        mLoadingBitmapState.clear();
+        mLoadingBitmapState = null;
+    }
+}
diff --git a/components/paint_preview/player/android/java/src/org/chromium/components/paintpreview/player/frame/PlayerFrameMediator.java b/components/paint_preview/player/android/java/src/org/chromium/components/paintpreview/player/frame/PlayerFrameMediator.java
index fa0c7c89..e09899e 100644
--- a/components/paint_preview/player/android/java/src/org/chromium/components/paintpreview/player/frame/PlayerFrameMediator.java
+++ b/components/paint_preview/player/android/java/src/org/chromium/components/paintpreview/player/frame/PlayerFrameMediator.java
@@ -72,8 +72,7 @@
     /** Handles scaling. */
     private final PlayerFrameScaleController mScaleController;
 
-    @VisibleForTesting
-    PlayerFrameBitmapState mBitmapState;
+    private final PlayerFrameBitmapStateController mBitmapStateController;
 
     PlayerFrameMediator(PropertyModel model, PlayerCompositorDelegate compositorDelegate,
             PlayerFrameViewport viewport, OverScroller scroller,
@@ -86,6 +85,8 @@
         mViewport = viewport;
         mGuid = frameGuid;
         mContentSize = new Size(contentWidth, contentHeight);
+        mBitmapStateController = new PlayerFrameBitmapStateController(
+                mGuid, mViewport, mContentSize, mCompositorDelegate, this);
         mScrollController = new PlayerFrameScrollController(
                 scroller, mViewport, mContentSize, this, userInteractionCallback);
         mScaleController = new PlayerFrameScaleController(
@@ -94,6 +95,11 @@
         mViewport.setScale(0f);
     }
 
+    @VisibleForTesting
+    PlayerFrameBitmapStateController getBitmapStateControllerForTest() {
+        return mBitmapStateController;
+    }
+
     void updateViewportSize(int width, int height, float scaleFactor) {
         if (width <= 0 || height <= 0) return;
 
@@ -197,6 +203,36 @@
 
     // PlayerFrameMediatorDelegate
 
+    @Override
+    public void onStartScaling() {
+        mBitmapStateController.invalidateLoadingBitmaps();
+    }
+
+    @Override
+    public void onSwapState() {
+        PlayerFrameBitmapState bitmapState = mBitmapStateController.getBitmapState(false);
+        mBitmapScaleMatrix.reset();
+        setBitmapScaleMatrix(mBitmapScaleMatrix, 1f);
+        mModel.set(PlayerFrameProperties.TILE_DIMENSIONS, bitmapState.getTileDimensions());
+        mModel.set(PlayerFrameProperties.VIEWPORT, mViewport.asRect());
+        mModel.set(PlayerFrameProperties.BITMAP_MATRIX, bitmapState.getMatrix());
+    }
+
+    @Override
+    public void offsetBitmapScaleMatrix(float dx, float dy) {
+        // If we are still waiting on new bitmaps after a scale operation, the scroll should scroll
+        // the bitmaps we currently have. In order to do so we apply an opposite transform to the
+        // bitmaps that are shown on the screen.
+        if (!mBitmapScaleMatrix.isIdentity()) {
+            float[] bitmapScaleMatrixValues = new float[9];
+            mBitmapScaleMatrix.getValues(bitmapScaleMatrixValues);
+            bitmapScaleMatrixValues[Matrix.MTRANS_X] -= dx;
+            bitmapScaleMatrixValues[Matrix.MTRANS_Y] -= dy;
+            mBitmapScaleMatrix.setValues(bitmapScaleMatrixValues);
+            setBitmapScaleMatrix(mBitmapScaleMatrix, mViewport.getScale());
+        }
+    }
+
     /**
      * Called when the viewport is moved or the scale factor is changed. Updates the viewport
      * and requests bitmap tiles for portion of the view port that don't have bitmap tiles.
@@ -205,34 +241,23 @@
     @Override
     public void updateVisuals(boolean scaleUpdated) {
         final float scaleFactor = mViewport.getScale();
-        if (scaleUpdated || mBitmapState == null) {
-            if (mBitmapState != null) {
-                mBitmapState.clear();
-            }
-            mBitmapState =
-                    new PlayerFrameBitmapState(mGuid, mViewport.getWidth(), mViewport.getHeight(),
-                            mViewport.getScale(), mContentSize, mCompositorDelegate, this);
-        }
-
+        PlayerFrameBitmapState activeLoadingState =
+                mBitmapStateController.getBitmapState(scaleUpdated);
         Rect viewportRect = mViewport.asRect();
-        updateSubframes(viewportRect, mViewport.getScale());
+        updateSubframes(viewportRect, scaleFactor);
         // Let the view know |mViewport| changed. PropertyModelChangeProcessor is smart about
         // this and will only update the view if |mViewport|'s rect is actually changed.
-        mModel.set(PlayerFrameProperties.TILE_DIMENSIONS, mBitmapState.getTileDimensions());
-        mModel.set(PlayerFrameProperties.VIEWPORT, mViewport.asRect());
+        if (mBitmapStateController.isVisible(activeLoadingState)) {
+            mModel.set(
+                    PlayerFrameProperties.TILE_DIMENSIONS, activeLoadingState.getTileDimensions());
+            mModel.set(PlayerFrameProperties.VIEWPORT, viewportRect);
+        }
 
         // Clear the required bitmaps matrix. It will be updated in #requestBitmapForTile.
-        mBitmapState.clearRequiredBitmaps();
+        activeLoadingState.clearRequiredBitmaps();
 
         // Request bitmaps for tiles inside the view port that don't already have a bitmap.
-        mBitmapState.requestBitmapForRect(mViewport.asRect());
-
-        // If the scale factor is changed, the view should get the correct bitmap matrix.
-        // TODO(crbug/1090804): "Double buffer" this such that there is no period where there is a
-        // blank screen between scale finishing and new bitmaps being fetched.
-        if (scaleUpdated) {
-            mModel.set(PlayerFrameProperties.BITMAP_MATRIX, mBitmapState.getMatrix());
-        }
+        activeLoadingState.requestBitmapForRect(viewportRect);
     }
 
     @Override
@@ -263,6 +288,7 @@
             scaleRect(mSubFrameRects.get(i), subFrameScaledRect, scaleFactor);
             if (!Rect.intersects(subFrameScaledRect, viewport)) {
                 mSubFrameViews.get(i).setVisibility(View.GONE);
+                subFrameScaledRect.set(0, 0, 0, 0);
                 continue;
             }
 
@@ -325,5 +351,4 @@
                 (int) (((float) inRect.right) * scaleFactor),
                 (int) (((float) inRect.bottom) * scaleFactor));
     }
-
 }
diff --git a/components/paint_preview/player/android/java/src/org/chromium/components/paintpreview/player/frame/PlayerFrameMediatorDelegate.java b/components/paint_preview/player/android/java/src/org/chromium/components/paintpreview/player/frame/PlayerFrameMediatorDelegate.java
index e0773b5a..a62ce89f 100644
--- a/components/paint_preview/player/android/java/src/org/chromium/components/paintpreview/player/frame/PlayerFrameMediatorDelegate.java
+++ b/components/paint_preview/player/android/java/src/org/chromium/components/paintpreview/player/frame/PlayerFrameMediatorDelegate.java
@@ -52,4 +52,21 @@
      * Updates the bitmap matrix in the model.
      */
     void updateBitmapMatrix(Bitmap[][] bitmapMatrix);
+
+    /**
+     * Update the model when the bitmap state is swapped.
+     */
+    void onSwapState();
+
+    /**
+     * To be called when scaling is started to prevent double-buffering from swapping mid-scale.
+     */
+    void onStartScaling();
+
+    /**
+     * Offsets the bitmap scale matrix when scrolling if applicable.
+     * @param dx Offset on the x-axis.
+     * @param dy Offset on the y-axis.
+     */
+    void offsetBitmapScaleMatrix(float dx, float dy);
 }
diff --git a/components/paint_preview/player/android/java/src/org/chromium/components/paintpreview/player/frame/PlayerFrameScaleController.java b/components/paint_preview/player/android/java/src/org/chromium/components/paintpreview/player/frame/PlayerFrameScaleController.java
index 223e502d..67ab5639 100644
--- a/components/paint_preview/player/android/java/src/org/chromium/components/paintpreview/player/frame/PlayerFrameScaleController.java
+++ b/components/paint_preview/player/android/java/src/org/chromium/components/paintpreview/player/frame/PlayerFrameScaleController.java
@@ -88,13 +88,30 @@
         // This is filtered to only apply to the top level view upstream.
         if (mUncommittedScaleFactor == 0f) {
             mUncommittedScaleFactor = mViewport.getScale();
+            mMediatorDelegate.onStartScaling();
         }
-        mUncommittedScaleFactor *= scaleFactor;
-
         // Don't scale outside of the acceptable range. The value is still accumulated such that the
         // continuous gesture feels smooth.
-        if (mUncommittedScaleFactor < mInitialScaleFactor) return true;
-        if (mUncommittedScaleFactor > MAX_SCALE_FACTOR) return true;
+        final float lastUncommittedScaleFactor = mUncommittedScaleFactor;
+        mUncommittedScaleFactor *= scaleFactor;
+        // Compute a corrected and bounded scale factor when close to the max/min scale.
+        if (mUncommittedScaleFactor < mInitialScaleFactor
+                && lastUncommittedScaleFactor > mInitialScaleFactor) {
+            scaleFactor = mInitialScaleFactor / lastUncommittedScaleFactor;
+        } else if (mUncommittedScaleFactor > MAX_SCALE_FACTOR
+                && lastUncommittedScaleFactor < MAX_SCALE_FACTOR) {
+            scaleFactor = MAX_SCALE_FACTOR / lastUncommittedScaleFactor;
+        } else if (mUncommittedScaleFactor > mInitialScaleFactor
+                && lastUncommittedScaleFactor < mInitialScaleFactor) {
+            scaleFactor = mUncommittedScaleFactor / mInitialScaleFactor;
+        } else if (mUncommittedScaleFactor < MAX_SCALE_FACTOR
+                && lastUncommittedScaleFactor > MAX_SCALE_FACTOR) {
+            scaleFactor = mUncommittedScaleFactor / MAX_SCALE_FACTOR;
+        } else if (mUncommittedScaleFactor < mInitialScaleFactor
+                || lastUncommittedScaleFactor > MAX_SCALE_FACTOR) {
+            return true;
+        }
+        final float correctedAggregateScaleFactor = lastUncommittedScaleFactor * scaleFactor;
 
         // TODO(crbug/1090804): trigger a fetch of new bitmaps periodically when zooming out.
 
@@ -106,13 +123,15 @@
 
         // It is possible the scale pushed the viewport outside the content bounds. These new values
         // are forced to be within bounds.
-        Rect uncorrectedViewportRect = mViewport.asRect();
+        final float uncorrectedX = mViewport.getTransX();
+        final float uncorrectedY = mViewport.getTransY();
         final float correctedX = Math.max(0f,
-                Math.min(uncorrectedViewportRect.left,
-                        mContentSize.getWidth() * mUncommittedScaleFactor - mViewport.getWidth()));
+                Math.min(uncorrectedX,
+                        mContentSize.getWidth() * correctedAggregateScaleFactor
+                                - mViewport.getWidth()));
         final float correctedY = Math.max(0f,
-                Math.min(uncorrectedViewportRect.top,
-                        mContentSize.getHeight() * mUncommittedScaleFactor
+                Math.min(uncorrectedY,
+                        mContentSize.getHeight() * correctedAggregateScaleFactor
                                 - mViewport.getHeight()));
         final int correctedXRounded = Math.abs(Math.round(correctedX));
         final int correctedYRounded = Math.abs(Math.round(correctedY));
@@ -121,12 +140,11 @@
                                                   correctedYRounded + mViewport.getHeight()),
                 mUncommittedScaleFactor);
 
-        if (correctedX != uncorrectedViewportRect.left
-                || correctedY != uncorrectedViewportRect.top) {
+        if (uncorrectedX != correctedX || uncorrectedY != correctedY) {
             // This is the delta required to force the viewport to be inside the bounds of the
             // content.
-            final float deltaX = uncorrectedViewportRect.left - correctedX;
-            final float deltaY = uncorrectedViewportRect.top - correctedY;
+            final float deltaX = uncorrectedX - correctedX;
+            final float deltaY = uncorrectedY - correctedY;
 
             // Directly used the forced bounds of the viewport reference frame for the viewport
             // scale matrix.
@@ -138,7 +156,8 @@
             bitmapScaleMatrixValues[Matrix.MTRANS_Y] += deltaY;
             mBitmapScaleMatrix.setValues(bitmapScaleMatrixValues);
         }
-        mMediatorDelegate.setBitmapScaleMatrix(mBitmapScaleMatrix, mUncommittedScaleFactor);
+
+        mMediatorDelegate.setBitmapScaleMatrix(mBitmapScaleMatrix, correctedAggregateScaleFactor);
         if (mUserInteractionCallback != null) mUserInteractionCallback.run();
         return true;
     }
@@ -151,28 +170,12 @@
      * @return Whether the scale event was consumed.
      */
     boolean scaleFinished(float scaleFactor, float focalPointX, float focalPointY) {
-        // Remove the bitmap scaling to avoid issues when new bitmaps are requested.
-        // TODO(crbug/1090804): Defer clearing this so that double buffering can occur.
-        mBitmapScaleMatrix.reset();
-        mMediatorDelegate.setBitmapScaleMatrix(mBitmapScaleMatrix, 1f);
-
-        final float finalScaleFactor =
-                Math.max(mInitialScaleFactor, Math.min(mUncommittedScaleFactor, MAX_SCALE_FACTOR));
-        mUncommittedScaleFactor = 0f;
-
-        final float correctedX = Math.max(0f,
-                Math.min(mViewport.getTransX(),
-                        mContentSize.getWidth() * finalScaleFactor - mViewport.getWidth()));
-        final float correctedY = Math.max(0f,
-                Math.min(mViewport.getTransY(),
-                        mContentSize.getHeight() * finalScaleFactor - mViewport.getHeight()));
-        mViewport.setTrans(correctedX, correctedY);
-        mViewport.setScale(finalScaleFactor);
-
+        // All correction/scaling happens in scaleBy() here we just update the mediator.
         mMediatorDelegate.resetScaleFactorOfAllSubframes();
         mMediatorDelegate.updateVisuals(true);
         mMediatorDelegate.forceRedrawVisibleSubframes();
         PlayerUserActionRecorder.recordZoom();
+        mUncommittedScaleFactor = 0f;
         return true;
     }
 }
diff --git a/components/paint_preview/player/android/java/src/org/chromium/components/paintpreview/player/frame/PlayerFrameScrollController.java b/components/paint_preview/player/android/java/src/org/chromium/components/paintpreview/player/frame/PlayerFrameScrollController.java
index 2f10f194..23a35ea 100644
--- a/components/paint_preview/player/android/java/src/org/chromium/components/paintpreview/player/frame/PlayerFrameScrollController.java
+++ b/components/paint_preview/player/android/java/src/org/chromium/components/paintpreview/player/frame/PlayerFrameScrollController.java
@@ -145,6 +145,7 @@
             return false;
         }
 
+        mMediatorDelegate.offsetBitmapScaleMatrix(validDistanceX, validDistanceY);
         mViewport.offset(validDistanceX, validDistanceY);
         mMediatorDelegate.updateVisuals(false);
         if (mUserInteractionCallback != null) mUserInteractionCallback.run();
diff --git a/components/paint_preview/player/android/junit/src/org/chromium/components/paintpreview/player/frame/PlayerFrameMediatorTest.java b/components/paint_preview/player/android/junit/src/org/chromium/components/paintpreview/player/frame/PlayerFrameMediatorTest.java
index 1564d8c..eee2ffda2 100644
--- a/components/paint_preview/player/android/junit/src/org/chromium/components/paintpreview/player/frame/PlayerFrameMediatorTest.java
+++ b/components/paint_preview/player/android/junit/src/org/chromium/components/paintpreview/player/frame/PlayerFrameMediatorTest.java
@@ -6,7 +6,7 @@
 
 import static org.mockito.Matchers.argThat;
 import static org.mockito.Matchers.eq;
-import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.inOrder;
 
 import android.app.Activity;
 import android.content.Context;
@@ -25,6 +25,7 @@
 import org.junit.Test;
 import org.junit.runner.RunWith;
 import org.mockito.ArgumentMatcher;
+import org.mockito.InOrder;
 import org.mockito.Mockito;
 import org.robolectric.Robolectric;
 import org.robolectric.annotation.Config;
@@ -43,7 +44,9 @@
 import java.util.List;
 
 /**
- * Tests for the {@link PlayerFrameMediator} class.
+ * Tests for the {@link PlayerFrameMediator} class. This also serves as a sort of integration test
+ * for the {@link PlayerFrameScrollController}, {@link PlayerFrameScaleController},
+ * {@link PlayerFrameViewport}, and {@link PlayerFrameBitmapState}.
  */
 @RunWith(BaseRobolectricTestRunner.class)
 @Config(shadows = {PaintPreviewCustomFlingingShadowScroller.class, ShadowView.class})
@@ -59,6 +62,7 @@
     private Runnable mUserInteractionCallback;
     private PlayerFrameViewport mViewport;
     private PlayerFrameMediator mMediator;
+    private PlayerFrameBitmapStateController mBitmapStateController;
 
     /**
      * Generate an UnguessableToken with a static value.
@@ -73,6 +77,13 @@
     }
 
     /**
+     * Gets the visible bitmap state from the bitmap state controller.
+     */
+    private PlayerFrameBitmapState getVisibleBitmapState() {
+        return mBitmapStateController.getBitmapState(false);
+    }
+
+    /**
      * Used for keeping track of all bitmap requests that {@link PlayerFrameMediator} makes.
      */
     private class RequestedBitmap {
@@ -196,6 +207,7 @@
         mViewport = new PlayerFrameViewport();
         mMediator = new PlayerFrameMediator(mModel, mCompositorDelegate, mViewport, mScroller,
                 mUserInteractionCallback, mFrameGuid, CONTENT_WIDTH, CONTENT_HEIGHT, 0, 0);
+        mBitmapStateController = mMediator.getBitmapStateControllerForTest();
     }
 
     private static Rect getRectForTile(int tileWidth, int tileHeight, int row, int col) {
@@ -401,7 +413,7 @@
         expectedRequiredBitmaps[0][1] = true;
         expectedRequiredBitmaps[1][0] = true;
         Assert.assertTrue(Arrays.deepEquals(
-                expectedRequiredBitmaps, mMediator.mBitmapState.mRequiredBitmaps));
+                expectedRequiredBitmaps, getVisibleBitmapState().getRequiredBitmapsForTest()));
 
         mMediator.scrollBy(10, 15);
         // The current viewport covers portions of the 4 top left bitmap tiles.
@@ -423,7 +435,7 @@
         expectedRequiredBitmaps[2][0] = true;
         expectedRequiredBitmaps[2][1] = true;
         Assert.assertTrue(Arrays.deepEquals(
-                expectedRequiredBitmaps, mMediator.mBitmapState.mRequiredBitmaps));
+                expectedRequiredBitmaps, getVisibleBitmapState().getRequiredBitmapsForTest()));
 
         mMediator.scrollBy(200, 400);
         // The current view port contains portions of the middle 4 tiles.
@@ -457,7 +469,7 @@
         expectedRequiredBitmaps[4][2] = true;
         expectedRequiredBitmaps[4][3] = true;
         Assert.assertTrue(Arrays.deepEquals(
-                expectedRequiredBitmaps, mMediator.mBitmapState.mRequiredBitmaps));
+                expectedRequiredBitmaps, getVisibleBitmapState().getRequiredBitmapsForTest()));
 
         mMediator.scrollBy(200, 400);
         // The current view port contains portions of the 4 bottom right tiles.
@@ -492,7 +504,7 @@
         expectedRequiredBitmaps[5][4] = true;
         expectedRequiredBitmaps[5][5] = true;
         Assert.assertTrue(Arrays.deepEquals(
-                expectedRequiredBitmaps, mMediator.mBitmapState.mRequiredBitmaps));
+                expectedRequiredBitmaps, getVisibleBitmapState().getRequiredBitmapsForTest()));
     }
 
     /**
@@ -561,7 +573,8 @@
     }
 
     /**
-     * View port should be updated on scroll events, but it shouldn't go out of content bounds.
+     * View port should be updated on scroll events. Bounds checks are verified in
+     * {@link PlayerFrameScrollControllerTest}.
      */
     @Test
     public void testViewPortOnScrollBy() {
@@ -574,61 +587,6 @@
         Assert.assertTrue(mMediator.scrollBy(250f, 80f));
         expectedViewPort.offset(250, 80);
         Assert.assertEquals(expectedViewPort, mModel.get(PlayerFrameProperties.VIEWPORT));
-
-        // Scroll by an out of bounds horizontal value. Should be scrolled to the rightmost point.
-        Assert.assertTrue(mMediator.scrollBy(1000f, 50f));
-        expectedViewPort.offset(210, 50);
-        Assert.assertEquals(expectedViewPort, mModel.get(PlayerFrameProperties.VIEWPORT));
-
-        // Scroll by an out of bounds horizontal and vertical value.
-        // Should be scrolled to the bottom right point.
-        Assert.assertTrue(mMediator.scrollBy(600f, 5000f));
-        expectedViewPort.offset(0, 820);
-        Assert.assertEquals(expectedViewPort, mModel.get(PlayerFrameProperties.VIEWPORT));
-
-        // Scroll right and down. Should be impossible since we're already at the bottom right
-        // point.
-        Assert.assertFalse(mMediator.scrollBy(10f, 15f));
-        expectedViewPort.offset(0, 0);
-        Assert.assertEquals(expectedViewPort, mModel.get(PlayerFrameProperties.VIEWPORT));
-
-        // Scroll right and up. Horizontal scroll should be ignored and should be scrolled to the
-        // top.
-        Assert.assertTrue(mMediator.scrollBy(100f, -2000f));
-        expectedViewPort.offset(0, -950);
-        Assert.assertEquals(expectedViewPort, mModel.get(PlayerFrameProperties.VIEWPORT));
-
-        // Scroll right and up. Both scroll directions should be ignored.
-        Assert.assertFalse(mMediator.scrollBy(100f, -2000f));
-        expectedViewPort.offset(0, 0);
-        Assert.assertEquals(expectedViewPort, mModel.get(PlayerFrameProperties.VIEWPORT));
-
-        // Scroll left and up. Vertical scroll should be ignored and should be scrolled to the
-        // left.
-        Assert.assertTrue(mMediator.scrollBy(-1000f, -2000f));
-        expectedViewPort.offset(-460, 0);
-        Assert.assertEquals(expectedViewPort, mModel.get(PlayerFrameProperties.VIEWPORT));
-
-        // Scroll left and up. Both scroll directions should be ignored.
-        Assert.assertFalse(mMediator.scrollBy(-1000f, -2000f));
-        expectedViewPort.offset(0, 0);
-        Assert.assertEquals(expectedViewPort, mModel.get(PlayerFrameProperties.VIEWPORT));
-
-        // Scroll left and down. Horizontal scroll should be ignored and should be scrolled to the
-        // bottom.
-        Assert.assertTrue(mMediator.scrollBy(-1000f, 2000f));
-        expectedViewPort.offset(0, 950);
-        Assert.assertEquals(expectedViewPort, mModel.get(PlayerFrameProperties.VIEWPORT));
-
-        // Scroll left and down. Both scroll directions should be ignored.
-        Assert.assertFalse(mMediator.scrollBy(-1000f, 2000f));
-        expectedViewPort.offset(0, 0);
-        Assert.assertEquals(expectedViewPort, mModel.get(PlayerFrameProperties.VIEWPORT));
-
-        // Scroll right and up. Both scroll values should be reflected.
-        Assert.assertTrue(mMediator.scrollBy(200, -100));
-        expectedViewPort.offset(200, -100);
-        Assert.assertEquals(expectedViewPort, mModel.get(PlayerFrameProperties.VIEWPORT));
     }
 
     /**
@@ -663,7 +621,7 @@
         expectedViews.add(subFrame3.first);
         expectedRects.add(subFrame1.second);
         expectedRects.add(subFrame2.second);
-        expectedRects.add(subFrame3.second);
+        expectedRects.add(new Rect(0, 0, 0, 0));
         expectedVisibility.add(true);
         expectedVisibility.add(true);
         expectedVisibility.add(false);
@@ -673,6 +631,8 @@
                 getVisibilities(mModel.get(PlayerFrameProperties.SUBFRAME_VIEWS)));
 
         mMediator.scrollBy(100, 0);
+        expectedRects.set(0, new Rect(0, 0, 0, 0));
+        expectedRects.set(1, new Rect(0, 0, 0, 0));
         expectedRects.set(2, new Rect(20, 35, 50, 65));
         expectedVisibility.clear();
         expectedVisibility.add(false);
@@ -699,9 +659,9 @@
 
         mMediator.scrollBy(0, 200);
         expectedRects.clear();
-        expectedRects.add(subFrame1.second);
-        expectedRects.add(subFrame2.second);
-        expectedRects.add(subFrame3.second);
+        expectedRects.add(new Rect(0, 0, 0, 0));
+        expectedRects.add(new Rect(0, 0, 0, 0));
+        expectedRects.add(new Rect(0, 0, 0, 0));
         expectedVisibility.clear();
         expectedVisibility.add(false);
         expectedVisibility.add(false);
@@ -713,7 +673,8 @@
     }
 
     /**
-     * View port should be updated on fling events, but it shouldn't go out of content bounds.
+     * View port should be updated on fling events. There are more extensive tests for this in
+     * {@link PlayerFrameScrollControllerTest}.
      */
     @Test
     public void testViewPortOnFling() {
@@ -726,36 +687,6 @@
         ShadowLooper.runUiThreadTasks();
         Assert.assertTrue(mScroller.isFinished());
         Assert.assertEquals(expectedViewPort, mModel.get(PlayerFrameProperties.VIEWPORT));
-
-        mMediator.onFling(-100, 0);
-        expectedViewPort.offsetTo(mScroller.getFinalX(), mScroller.getFinalY());
-        ShadowLooper.runUiThreadTasks();
-        Assert.assertTrue(mScroller.isFinished());
-        Assert.assertEquals(expectedViewPort, mModel.get(PlayerFrameProperties.VIEWPORT));
-
-        mMediator.onFling(0, 200);
-        expectedViewPort.offsetTo(mScroller.getFinalX(), mScroller.getFinalY());
-        ShadowLooper.runUiThreadTasks();
-        Assert.assertTrue(mScroller.isFinished());
-        Assert.assertEquals(expectedViewPort, mModel.get(PlayerFrameProperties.VIEWPORT));
-
-        mMediator.onFling(0, -200);
-        expectedViewPort.offsetTo(mScroller.getFinalX(), mScroller.getFinalY());
-        ShadowLooper.runUiThreadTasks();
-        Assert.assertTrue(mScroller.isFinished());
-        Assert.assertEquals(expectedViewPort, mModel.get(PlayerFrameProperties.VIEWPORT));
-
-        mMediator.onFling(100, 200);
-        expectedViewPort.offsetTo(mScroller.getFinalX(), mScroller.getFinalY());
-        ShadowLooper.runUiThreadTasks();
-        Assert.assertTrue(mScroller.isFinished());
-        Assert.assertEquals(expectedViewPort, mModel.get(PlayerFrameProperties.VIEWPORT));
-
-        mMediator.onFling(-100, -200);
-        expectedViewPort.offsetTo(mScroller.getFinalX(), mScroller.getFinalY());
-        ShadowLooper.runUiThreadTasks();
-        Assert.assertTrue(mScroller.isFinished());
-        Assert.assertEquals(expectedViewPort, mModel.get(PlayerFrameProperties.VIEWPORT));
     }
 
     /**
@@ -787,8 +718,9 @@
     }
 
     /**
-     * Tests that {@link PlayerFrameMediator} correctly consumes scale events and scales between
-     * the allowed range.
+     * Tests that {@link PlayerFrameMediator} correctly consumes scale events. There are more
+     * extensive tests for keeping the viewport in bounds and ensuring limits on scaling in
+     * {@link PlayerFrameScaleControllerTest}.
      */
     @Test
     public void testViewPortOnScaleBy() {
@@ -815,68 +747,34 @@
         expectedRequiredBitmaps[0][0] = true;
         expectedRequiredBitmaps[0][1] = true;
         expectedRequiredBitmaps[1][0] = true;
+        mBitmapStateController.swapForTest();
         Assert.assertTrue(Arrays.deepEquals(
-                expectedRequiredBitmaps, mMediator.mBitmapState.mRequiredBitmaps));
+                expectedRequiredBitmaps, getVisibleBitmapState().getRequiredBitmapsForTest()));
 
         // Now a scale factor of 2 will be applied. This will happen at a focal point of 0, 0.
         // The same bitmaps will be required but the grid will be double the size.
         Assert.assertTrue(mMediator.scaleBy(2f, 0, 0));
         Assert.assertTrue(mMediator.scaleFinished(1f, 0, 0));
+        mBitmapStateController.swapForTest();
 
         expectedRequiredBitmaps = new boolean[12][12];
         expectedRequiredBitmaps[0][0] = true;
         expectedRequiredBitmaps[0][1] = true;
         expectedRequiredBitmaps[1][0] = true;
         Assert.assertTrue(Arrays.deepEquals(
-                expectedRequiredBitmaps, mMediator.mBitmapState.mRequiredBitmaps));
+                expectedRequiredBitmaps, getVisibleBitmapState().getRequiredBitmapsForTest()));
 
         // Reduce the scale factor by 0.5 returning to a scale of 1.
         Assert.assertTrue(mMediator.scaleBy(0.5f, 0, 0));
         Assert.assertTrue(mMediator.scaleFinished(1f, 0, 0));
+        mBitmapStateController.swapForTest();
 
         expectedRequiredBitmaps = new boolean[6][6];
         expectedRequiredBitmaps[0][0] = true;
         expectedRequiredBitmaps[0][1] = true;
         expectedRequiredBitmaps[1][0] = true;
         Assert.assertTrue(Arrays.deepEquals(
-                expectedRequiredBitmaps, mMediator.mBitmapState.mRequiredBitmaps));
-
-        // Increase the scale factor to 6 which is above the maximum limit returning to a scale
-        // of 5. Note that the grid is smaller than 30x30 as the viewport is not a multiple of the
-        // content width and height so there is difference.
-        Assert.assertTrue(mMediator.scaleBy(6f, 0, 0));
-        Assert.assertTrue(mMediator.scaleFinished(1f, 0, 0));
-
-        expectedRequiredBitmaps = new boolean[29][28];
-        expectedRequiredBitmaps[0][0] = true;
-        expectedRequiredBitmaps[0][1] = true;
-        expectedRequiredBitmaps[1][0] = true;
-        Assert.assertTrue(Arrays.deepEquals(
-                expectedRequiredBitmaps, mMediator.mBitmapState.mRequiredBitmaps));
-
-        // Reduce the scale factor back to 1.
-        Assert.assertTrue(mMediator.scaleBy(0.2f, 0, 0));
-        Assert.assertTrue(mMediator.scaleFinished(1f, 0, 0));
-
-        expectedRequiredBitmaps = new boolean[6][6];
-        expectedRequiredBitmaps[0][0] = true;
-        expectedRequiredBitmaps[0][1] = true;
-        expectedRequiredBitmaps[1][0] = true;
-        Assert.assertTrue(Arrays.deepEquals(
-                expectedRequiredBitmaps, mMediator.mBitmapState.mRequiredBitmaps));
-
-        // We now reduce the scale factor to less than mInitialScaleFactor; however, the maximum
-        // scale out is limited to mInitialScaleFactor.
-        float initialScaleFactor = 100f / 560f;
-        Assert.assertTrue(mMediator.scaleBy(initialScaleFactor, 0, 0));
-        Assert.assertTrue(mMediator.scaleBy(0.5f, 0, 0));
-        Assert.assertTrue(mMediator.scaleFinished(1f, 0, 0));
-
-        expectedRequiredBitmaps = new boolean[2][1];
-        expectedRequiredBitmaps[0][0] = true;
-        expectedRequiredBitmaps[1][0] = true;
-        Assert.assertTrue(Arrays.deepEquals(
-                expectedRequiredBitmaps, mMediator.mBitmapState.mRequiredBitmaps));
+                expectedRequiredBitmaps, getVisibleBitmapState().getRequiredBitmapsForTest()));
     }
 
     /**
@@ -921,7 +819,7 @@
         Assert.assertTrue(mModel.get(PlayerFrameProperties.SCALE_MATRIX).isIdentity());
         // Ensure the correct bitmaps are required and requested.
         Assert.assertTrue(Arrays.deepEquals(
-                expectedRequiredBitmaps, mMediator.mBitmapState.mRequiredBitmaps));
+                expectedRequiredBitmaps, getVisibleBitmapState().getRequiredBitmapsForTest()));
         Assert.assertEquals(expectedRequestedBitmaps, mCompositorDelegate.mRequestedBitmap);
 
         // STEP 2: Scroll slightly.
@@ -945,7 +843,7 @@
         expectedRequiredBitmaps[2][0] = true;
         expectedRequiredBitmaps[2][1] = true;
         Assert.assertTrue(Arrays.deepEquals(
-                expectedRequiredBitmaps, mMediator.mBitmapState.mRequiredBitmaps));
+                expectedRequiredBitmaps, getVisibleBitmapState().getRequiredBitmapsForTest()));
 
         expectedRequestedBitmaps.add(
                 new RequestedBitmap(mFrameGuid, getRectForTile(100, 200, 1, 1), 1f));
@@ -987,6 +885,7 @@
         expectedRequestedBitmaps.clear();
 
         Assert.assertTrue(mMediator.scaleFinished(1f, 0, 0));
+        mBitmapStateController.swapForTest();
 
         expectedRequiredBitmaps = new boolean[12][12];
         expectedRequiredBitmaps[0][0] = true;
@@ -998,7 +897,7 @@
         expectedRequiredBitmaps[2][0] = true;
         expectedRequiredBitmaps[2][1] = true;
         Assert.assertTrue(Arrays.deepEquals(
-                expectedRequiredBitmaps, mMediator.mBitmapState.mRequiredBitmaps));
+                expectedRequiredBitmaps, getVisibleBitmapState().getRequiredBitmapsForTest()));
 
         expectedRequestedBitmaps.add(
                 new RequestedBitmap(mFrameGuid, getRectForTile(100, 200, 0, 0), 2f));
@@ -1038,6 +937,7 @@
         expectedRequestedBitmaps.clear();
 
         Assert.assertTrue(mMediator.scaleFinished(1f, 0, 0));
+        mBitmapStateController.swapForTest();
 
         expectedRequiredBitmaps = new boolean[6][6];
         expectedRequiredBitmaps[0][0] = true;
@@ -1049,7 +949,7 @@
         expectedRequiredBitmaps[2][0] = true;
         expectedRequiredBitmaps[2][1] = true;
         Assert.assertTrue(Arrays.deepEquals(
-                expectedRequiredBitmaps, mMediator.mBitmapState.mRequiredBitmaps));
+                expectedRequiredBitmaps, getVisibleBitmapState().getRequiredBitmapsForTest()));
 
         expectedRequestedBitmaps.add(
                 new RequestedBitmap(mFrameGuid, getRectForTile(100, 200, 0, 0), 1f));
@@ -1098,6 +998,7 @@
         expectedRequestedBitmaps.clear();
 
         Assert.assertTrue(mMediator.scaleFinished(1f, 0, 0));
+        mBitmapStateController.swapForTest();
 
         expectedRequiredBitmaps = new boolean[12][12];
         expectedRequiredBitmaps[0][1] = true;
@@ -1113,7 +1014,7 @@
         expectedRequiredBitmaps[3][1] = true;
         expectedRequiredBitmaps[3][2] = true;
         Assert.assertTrue(Arrays.deepEquals(
-                expectedRequiredBitmaps, mMediator.mBitmapState.mRequiredBitmaps));
+                expectedRequiredBitmaps, getVisibleBitmapState().getRequiredBitmapsForTest()));
 
         expectedRequestedBitmaps.add(
                 new RequestedBitmap(mFrameGuid, getRectForTile(100, 200, 1, 1), 2f));
@@ -1158,6 +1059,8 @@
         Pair<View, Rect> subFrame1 = new Pair<>(subFrame1View, new Rect(10, 20, 60, 40));
         PlayerFrameMediator subFrame2Mediator = Mockito.mock(PlayerFrameMediator.class);
         Pair<View, Rect> subFrame2 = new Pair<>(subFrame2View, new Rect(30, 50, 70, 160));
+        InOrder inOrderMediator1 = inOrder(subFrame1Mediator);
+        InOrder inOrderMediator2 = inOrder(subFrame2Mediator);
 
         mMediator.addSubFrame(subFrame1.first, subFrame1.second, subFrame1Mediator);
         mMediator.addSubFrame(subFrame2.first, subFrame2.second, subFrame2Mediator);
@@ -1180,7 +1083,7 @@
 
         expectedRects.clear();
         expectedRects.add(new Rect(20, 40, 120, 80));
-        expectedRects.add(new Rect(60, 100, 140, 320));
+        expectedRects.add(new Rect(0, 0, 0, 0));
         expectedVisibility.set(1, false);
 
         // During scaling the second subframe should disappear from the viewport.
@@ -1191,19 +1094,20 @@
                 getVisibilities(mModel.get(PlayerFrameProperties.SUBFRAME_VIEWS)));
         Matrix expectedMatrix = new Matrix();
         expectedMatrix.setScale(2f, 2f);
-        verify(subFrame1Mediator)
+        inOrderMediator1.verify(subFrame1Mediator)
                 .setBitmapScaleMatrixOfSubframe(argThat(new MatrixMatcher(expectedMatrix)), eq(2f));
 
         Assert.assertTrue(mMediator.scaleFinished(1f, 0f, 0f));
+        mBitmapStateController.swapForTest();
+        inOrderMediator1.verify(subFrame1Mediator).resetScaleFactor();
+        inOrderMediator1.verify(subFrame1Mediator).forceRedraw();
         Assert.assertEquals(expectedViews, mModel.get(PlayerFrameProperties.SUBFRAME_VIEWS));
         Assert.assertEquals(expectedRects, mModel.get(PlayerFrameProperties.SUBFRAME_RECTS));
         Assert.assertEquals(expectedVisibility,
                 getVisibilities(mModel.get(PlayerFrameProperties.SUBFRAME_VIEWS)));
         expectedMatrix.reset();
-        verify(subFrame1Mediator)
+        inOrderMediator1.verify(subFrame1Mediator)
                 .setBitmapScaleMatrixOfSubframe(argThat(new MatrixMatcher(expectedMatrix)), eq(1f));
-        verify(subFrame1Mediator).forceRedraw();
-        verify(subFrame1Mediator).resetScaleFactor();
 
         // Scroll so the second subframe is back in the viewport..
         mMediator.scrollBy(20, 40);
@@ -1228,84 +1132,15 @@
         Assert.assertEquals(expectedVisibility,
                 getVisibilities(mModel.get(PlayerFrameProperties.SUBFRAME_VIEWS)));
         expectedMatrix.setScale(0.75f, 0.75f);
-        verify(subFrame1Mediator)
+        inOrderMediator1.verify(subFrame1Mediator)
                 .setBitmapScaleMatrixOfSubframe(
                         argThat(new MatrixMatcher(expectedMatrix)), eq(1.5f));
-        verify(subFrame2Mediator)
+        inOrderMediator2.verify(subFrame2Mediator)
                 .setBitmapScaleMatrixOfSubframe(
                         argThat(new MatrixMatcher(expectedMatrix)), eq(1.5f));
     }
 
     /**
-     * Tests that {@link PlayerFrameMediator} correctly scales and keeps the content in bounds.
-     */
-    @Test
-    public void testViewPortOnScaleByWithinBounds() {
-        // Initial view port setup.
-        mMediator.updateViewportSize(100, 200, 1f);
-
-        boolean[][] expectedRequiredBitmaps = new boolean[6][6];
-
-        // The current view port fully matches the top left bitmap tile.
-        // Below is a schematic of the entire bitmap matrix. Tiles marked with x are required for
-        // the current view port.
-        // -------------------------
-        // | x | x |   |   |   |   |
-        // -------------------------
-        // | x |   |   |   |   |   |
-        // -------------------------
-        // |   |   |   |   |   |   |
-        // -------------------------
-        // |   |   |   |   |   |   |
-        // -------------------------
-        // |   |   |   |   |   |   |
-        // -------------------------
-        // |   |   |   |   |   |   |
-        expectedRequiredBitmaps[0][0] = true;
-        expectedRequiredBitmaps[0][1] = true;
-        expectedRequiredBitmaps[1][0] = true;
-        Assert.assertTrue(Arrays.deepEquals(
-                expectedRequiredBitmaps, mMediator.mBitmapState.mRequiredBitmaps));
-
-        // Now a scale factor of 2 will be applied. This will happen at a focal point of 0, 0.
-        // The same bitmaps will be required but the grid will be double the size.
-        Assert.assertTrue(mMediator.scaleBy(2f, 0, 0));
-        Matrix expectedViewportMatrix = new Matrix();
-        Matrix expectedBitmapMatrix = new Matrix();
-        expectedViewportMatrix.postScale(2f, 2f, 0f, 0f);
-        expectedBitmapMatrix.postScale(2f, 2f, 0f, 0f);
-        assertViewportStateIs(expectedViewportMatrix, mViewport);
-        Assert.assertEquals(expectedBitmapMatrix, mModel.get(PlayerFrameProperties.SCALE_MATRIX));
-
-        Assert.assertTrue(mMediator.scaleFinished(1f, 0, 0));
-
-        expectedRequiredBitmaps = new boolean[12][12];
-        expectedRequiredBitmaps[0][0] = true;
-        expectedRequiredBitmaps[0][1] = true;
-        expectedRequiredBitmaps[1][0] = true;
-        Assert.assertTrue(Arrays.deepEquals(
-                expectedRequiredBitmaps, mMediator.mBitmapState.mRequiredBitmaps));
-
-        // Reduce the scale factor by 0.5 returning to a scale of 1 but try to do so with a focal
-        // point that causes translation outside the bounds. The focal point should be ignored.
-        Assert.assertTrue(mMediator.scaleBy(0.5f, 50f, 50f));
-        expectedViewportMatrix.postScale(0.5f, 0.5f, 0f, 0f);
-        expectedBitmapMatrix.reset();
-        expectedBitmapMatrix.postScale(0.5f, 0.5f, 0f, 0f);
-        assertViewportStateIs(expectedViewportMatrix, mViewport);
-        Assert.assertEquals(expectedBitmapMatrix, mModel.get(PlayerFrameProperties.SCALE_MATRIX));
-
-        Assert.assertTrue(mMediator.scaleFinished(1f, -50f, -50f));
-
-        expectedRequiredBitmaps = new boolean[6][6];
-        expectedRequiredBitmaps[0][0] = true;
-        expectedRequiredBitmaps[0][1] = true;
-        expectedRequiredBitmaps[1][0] = true;
-        Assert.assertTrue(Arrays.deepEquals(
-                expectedRequiredBitmaps, mMediator.mBitmapState.mRequiredBitmaps));
-    }
-
-    /**
      * Tests that {@link PlayerFrameMediator} works correctly with nested subframes. This test
      * pretends that mMediator is for a subframe. The calls made to this mediator are verified
      * to occur in {@link testViewPortOnScaleByWithSubFrames}.
@@ -1318,6 +1153,7 @@
         PlayerFrameMediator subFrameMediator = Mockito.mock(PlayerFrameMediator.class);
         Pair<View, Rect> subFrame = new Pair<>(subframeView, new Rect(10, 20, 60, 40));
         mMediator.addSubFrame(subFrame.first, subFrame.second, subFrameMediator);
+        InOrder inOrder = inOrder(subFrameMediator);
 
         // The subframe should be visible.
         mMediator.updateViewportSize(50, 100, 1f);
@@ -1339,7 +1175,7 @@
         mMediator.setBitmapScaleMatrixOfSubframe(scaleMatrix, 2f);
         Assert.assertEquals(expectedVisibleViews, mModel.get(PlayerFrameProperties.SUBFRAME_VIEWS));
         Assert.assertEquals(expectedVisibleRects, mModel.get(PlayerFrameProperties.SUBFRAME_RECTS));
-        verify(subFrameMediator)
+        inOrder.verify(subFrameMediator)
                 .setBitmapScaleMatrixOfSubframe(argThat(new MatrixMatcher(scaleMatrix)), eq(2f));
 
         expectedVisibleViews.clear();
@@ -1352,15 +1188,16 @@
         mMediator.setBitmapScaleMatrixOfSubframe(scaleMatrix, 1.5f);
         Assert.assertEquals(expectedVisibleViews, mModel.get(PlayerFrameProperties.SUBFRAME_VIEWS));
         Assert.assertEquals(expectedVisibleRects, mModel.get(PlayerFrameProperties.SUBFRAME_RECTS));
-        verify(subFrameMediator)
+        inOrder.verify(subFrameMediator)
                 .setBitmapScaleMatrixOfSubframe(argThat(new MatrixMatcher(scaleMatrix)), eq(1.5f));
 
         // Simulate scaleFinished() by force a scale factor clear and redraw.
         mMediator.resetScaleFactor();
-        verify(subFrameMediator).resetScaleFactor();
+        inOrder.verify(subFrameMediator).resetScaleFactor();
         mMediator.forceRedraw();
-        verify(subFrameMediator).forceRedraw();
+        inOrder.verify(subFrameMediator).forceRedraw();
     }
+
     /**
      * Tests that {@link PlayerFrameMediator} calls the user interaction callback.
      */
diff --git a/components/paint_preview/player/android/junit/src/org/chromium/components/paintpreview/player/frame/PlayerFrameScaleControllerTest.java b/components/paint_preview/player/android/junit/src/org/chromium/components/paintpreview/player/frame/PlayerFrameScaleControllerTest.java
new file mode 100644
index 0000000..6af7f50d
--- /dev/null
+++ b/components/paint_preview/player/android/junit/src/org/chromium/components/paintpreview/player/frame/PlayerFrameScaleControllerTest.java
@@ -0,0 +1,324 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+package org.chromium.components.paintpreview.player.frame;
+
+import static org.mockito.ArgumentMatchers.argThat;
+import static org.mockito.ArgumentMatchers.eq;
+import static org.mockito.Mockito.inOrder;
+
+import android.graphics.Matrix;
+import android.util.Size;
+
+import org.junit.Assert;
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.ArgumentMatcher;
+import org.mockito.InOrder;
+import org.mockito.Mock;
+import org.mockito.MockitoAnnotations;
+
+import org.chromium.base.test.BaseRobolectricTestRunner;
+
+/**
+ * Tests for the {@link PlayerFrameScaleController} class.
+ */
+@RunWith(BaseRobolectricTestRunner.class)
+public class PlayerFrameScaleControllerTest {
+    private static final int CONTENT_WIDTH = 500;
+    private static final int CONTENT_HEIGHT = 1000;
+    private static final float TOLERANCE = 0.001f;
+
+    private Matrix mBitmapScaleMatrix;
+    private PlayerFrameViewport mViewport;
+    private PlayerFrameScaleController mScaleController;
+    @Mock
+    private PlayerFrameMediatorDelegate mMediatorDelegateMock;
+    private boolean mHasUserInteraction;
+    private Runnable mUserInteractionCallback;
+
+    private class MatrixMatcher implements ArgumentMatcher<Matrix> {
+        private Matrix mLeft;
+
+        MatrixMatcher(Matrix left) {
+            mLeft = left;
+        }
+
+        @Override
+        public boolean matches(Matrix right) {
+            return mLeft.equals(right);
+        }
+    }
+
+    @Before
+    public void setUp() {
+        MockitoAnnotations.initMocks(this);
+        mHasUserInteraction = false;
+        mUserInteractionCallback = () -> mHasUserInteraction = true;
+        mViewport = new PlayerFrameViewport();
+        mBitmapScaleMatrix = new Matrix();
+        mScaleController =
+                new PlayerFrameScaleController(mViewport, new Size(CONTENT_WIDTH, CONTENT_HEIGHT),
+                        mBitmapScaleMatrix, mMediatorDelegateMock, mUserInteractionCallback);
+        mScaleController.calculateInitialScaleFactor(CONTENT_WIDTH);
+        mViewport.setScale(mScaleController.getInitialScaleFactor());
+        mViewport.setSize(100, 100);
+    }
+
+    /**
+     * Tests calculating and getting the initial scale factor.
+     */
+    @Test
+    public void testInitialScaleFactor() {
+        mScaleController.calculateInitialScaleFactor(CONTENT_WIDTH);
+        Assert.assertEquals(1f, mScaleController.getInitialScaleFactor(), TOLERANCE);
+
+        mScaleController.calculateInitialScaleFactor(250);
+        Assert.assertEquals(0.5f, mScaleController.getInitialScaleFactor(), TOLERANCE);
+
+        mScaleController.calculateInitialScaleFactor(1000);
+        Assert.assertEquals(2f, mScaleController.getInitialScaleFactor(), TOLERANCE);
+    }
+
+    /**
+     * Tests the limits of scaling.
+     */
+    @Test
+    public void testScaleLimits() {
+        Assert.assertTrue(mScaleController.scaleBy(10f, 0, 0));
+        Assert.assertTrue(mScaleController.scaleFinished(1f, 0, 0));
+        Assert.assertEquals(5f, mViewport.getScale(), TOLERANCE);
+
+        Assert.assertTrue(mScaleController.scaleBy(0.00001f, 0, 0));
+        Assert.assertTrue(mScaleController.scaleFinished(1f, 0, 0));
+        Assert.assertEquals(1f, mViewport.getScale(), TOLERANCE);
+    }
+
+    /**
+     * Scales the viewport in and out in the middle so no correction occurs.
+     */
+    @Test
+    public void testZoomInAndOutAtMiddle() {
+        mViewport.setTrans(100, 150);
+        InOrder inOrder = inOrder(mMediatorDelegateMock);
+
+        // Zoom in.
+        Assert.assertTrue(mScaleController.scaleBy(2f, 50, 50));
+        Matrix expectedBitmapMatrix = new Matrix();
+        expectedBitmapMatrix.postScale(2f, 2f, 50, 50);
+        Assert.assertEquals(2f, mViewport.getScale(), TOLERANCE);
+        Assert.assertEquals(250f, mViewport.getTransX(), TOLERANCE);
+        Assert.assertEquals(350f, mViewport.getTransY(), TOLERANCE);
+        Assert.assertEquals(expectedBitmapMatrix, mBitmapScaleMatrix);
+        inOrder.verify(mMediatorDelegateMock)
+                .setBitmapScaleMatrix(argThat(new MatrixMatcher(expectedBitmapMatrix)), eq(2f));
+        Assert.assertTrue(mHasUserInteraction);
+
+        Assert.assertTrue(mScaleController.scaleFinished(1f, 0, 0));
+        Assert.assertEquals(2f, mViewport.getScale(), TOLERANCE);
+        Assert.assertEquals(250f, mViewport.getTransX(), TOLERANCE);
+        Assert.assertEquals(350f, mViewport.getTransY(), TOLERANCE);
+        expectedBitmapMatrix.reset();
+        inOrder.verify(mMediatorDelegateMock).resetScaleFactorOfAllSubframes();
+        inOrder.verify(mMediatorDelegateMock).updateVisuals(eq(true));
+        inOrder.verify(mMediatorDelegateMock).forceRedrawVisibleSubframes();
+
+        // Pretend images were fetched and bitmap scale is reset.
+        mBitmapScaleMatrix.reset();
+
+        // Zoom out.
+        Assert.assertTrue(mScaleController.scaleBy(0.5f, 50, 50));
+        expectedBitmapMatrix.postScale(0.5f, 0.5f, 50, 50);
+        Assert.assertEquals(1f, mViewport.getScale(), TOLERANCE);
+        Assert.assertEquals(100f, mViewport.getTransX(), TOLERANCE);
+        Assert.assertEquals(150f, mViewport.getTransY(), TOLERANCE);
+        Assert.assertEquals(expectedBitmapMatrix, mBitmapScaleMatrix);
+        inOrder.verify(mMediatorDelegateMock)
+                .setBitmapScaleMatrix(argThat(new MatrixMatcher(expectedBitmapMatrix)), eq(1f));
+        Assert.assertTrue(mHasUserInteraction);
+
+        Assert.assertTrue(mScaleController.scaleFinished(1f, 0, 0));
+        Assert.assertEquals(1f, mViewport.getScale(), TOLERANCE);
+        Assert.assertEquals(100f, mViewport.getTransX(), TOLERANCE);
+        Assert.assertEquals(150f, mViewport.getTransY(), TOLERANCE);
+        expectedBitmapMatrix.reset();
+        inOrder.verify(mMediatorDelegateMock).resetScaleFactorOfAllSubframes();
+        inOrder.verify(mMediatorDelegateMock).updateVisuals(eq(true));
+        inOrder.verify(mMediatorDelegateMock).forceRedrawVisibleSubframes();
+    }
+
+    /**
+     * Scales the viewport in and out in the top left so correction occurs.
+     */
+    @Test
+    public void testZoomInAndOutAtTopLeft() {
+        InOrder inOrder = inOrder(mMediatorDelegateMock);
+
+        // Zoom in.
+        Assert.assertTrue(mScaleController.scaleBy(2f, 0, 0));
+        Matrix expectedBitmapMatrix = new Matrix();
+        expectedBitmapMatrix.postScale(2f, 2f, 0, 0);
+        Assert.assertEquals(2f, mViewport.getScale(), TOLERANCE);
+        Assert.assertEquals(0f, mViewport.getTransX(), TOLERANCE);
+        Assert.assertEquals(0f, mViewport.getTransY(), TOLERANCE);
+        Assert.assertEquals(expectedBitmapMatrix, mBitmapScaleMatrix);
+        inOrder.verify(mMediatorDelegateMock)
+                .setBitmapScaleMatrix(argThat(new MatrixMatcher(expectedBitmapMatrix)), eq(2f));
+        Assert.assertTrue(mHasUserInteraction);
+
+        Assert.assertTrue(mScaleController.scaleFinished(1f, 0, 0));
+        Assert.assertEquals(2f, mViewport.getScale(), TOLERANCE);
+        Assert.assertEquals(0f, mViewport.getTransX(), TOLERANCE);
+        Assert.assertEquals(0f, mViewport.getTransY(), TOLERANCE);
+        expectedBitmapMatrix.reset();
+        inOrder.verify(mMediatorDelegateMock).resetScaleFactorOfAllSubframes();
+        inOrder.verify(mMediatorDelegateMock).updateVisuals(eq(true));
+        inOrder.verify(mMediatorDelegateMock).forceRedrawVisibleSubframes();
+
+        // Pretend images were fetched and bitmap scale is reset.
+        mBitmapScaleMatrix.reset();
+
+        // Zoom out.
+        Assert.assertTrue(mScaleController.scaleBy(0.75f, 50, 50));
+        expectedBitmapMatrix.postScale(0.75f, 0.75f, 0f, 0f);
+        // Positional compensation due to smaller bitmaps.
+        Assert.assertEquals(1.5f, mViewport.getScale(), TOLERANCE);
+        Assert.assertEquals(0f, mViewport.getTransX(), TOLERANCE);
+        Assert.assertEquals(0f, mViewport.getTransY(), TOLERANCE);
+        Assert.assertEquals(expectedBitmapMatrix, mBitmapScaleMatrix);
+        inOrder.verify(mMediatorDelegateMock)
+                .setBitmapScaleMatrix(argThat(new MatrixMatcher(expectedBitmapMatrix)), eq(1.5f));
+        Assert.assertTrue(mHasUserInteraction);
+
+        Assert.assertTrue(mScaleController.scaleFinished(1f, 0, 0));
+        Assert.assertEquals(1.5f, mViewport.getScale(), TOLERANCE);
+        Assert.assertEquals(0f, mViewport.getTransX(), TOLERANCE);
+        Assert.assertEquals(0f, mViewport.getTransY(), TOLERANCE);
+        expectedBitmapMatrix.reset();
+        inOrder.verify(mMediatorDelegateMock).resetScaleFactorOfAllSubframes();
+        inOrder.verify(mMediatorDelegateMock).updateVisuals(eq(true));
+        inOrder.verify(mMediatorDelegateMock).forceRedrawVisibleSubframes();
+    }
+
+    /**
+     * Scales the viewport in and out in the bottom right so correction occurs.
+     */
+    @Test
+    public void testZoomInAndOutAtBottomRight() {
+        InOrder inOrder = inOrder(mMediatorDelegateMock);
+
+        // Zoom in.
+        Assert.assertTrue(mScaleController.scaleBy(1.5f, 0, 0));
+        Matrix expectedBitmapMatrix = new Matrix();
+        expectedBitmapMatrix.postScale(1.5f, 1.5f, 0, 0);
+        Assert.assertEquals(1.5f, mViewport.getScale(), TOLERANCE);
+        Assert.assertEquals(0f, mViewport.getTransX(), TOLERANCE);
+        Assert.assertEquals(0f, mViewport.getTransY(), TOLERANCE);
+        Assert.assertEquals(expectedBitmapMatrix, mBitmapScaleMatrix);
+        inOrder.verify(mMediatorDelegateMock)
+                .setBitmapScaleMatrix(argThat(new MatrixMatcher(expectedBitmapMatrix)), eq(1.5f));
+        Assert.assertTrue(mHasUserInteraction);
+
+        Assert.assertTrue(mScaleController.scaleFinished(1f, 0, 0));
+        Assert.assertEquals(1.5f, mViewport.getScale(), TOLERANCE);
+        Assert.assertEquals(0f, mViewport.getTransX(), TOLERANCE);
+        Assert.assertEquals(0f, mViewport.getTransY(), TOLERANCE);
+        expectedBitmapMatrix.reset();
+        inOrder.verify(mMediatorDelegateMock).resetScaleFactorOfAllSubframes();
+        inOrder.verify(mMediatorDelegateMock).updateVisuals(eq(true));
+        inOrder.verify(mMediatorDelegateMock).forceRedrawVisibleSubframes();
+
+        // Pretend images were fetched and bitmap scale is reset.
+        mBitmapScaleMatrix.reset();
+
+        // Move to the bottom right corner.
+        float scale = mViewport.getScale();
+        float scaledContentWidth = scale * CONTENT_WIDTH;
+        float scaledContentHeight = scale * CONTENT_HEIGHT;
+        mViewport.setTrans(scaledContentWidth - mViewport.getWidth(),
+                scaledContentHeight - mViewport.getHeight());
+
+        // Zoom out.
+        Assert.assertTrue(mScaleController.scaleBy(0.75f, -50, -50));
+        expectedBitmapMatrix.postScale(0.75f, 0.75f, 0f, 0f);
+        // Positional compensation due to smaller bitmaps.
+        expectedBitmapMatrix.postTranslate(25f, 25f);
+        Assert.assertEquals(1.125f, mViewport.getScale(), TOLERANCE);
+        scale = mViewport.getScale();
+        scaledContentWidth = scale * CONTENT_WIDTH;
+        scaledContentHeight = scale * CONTENT_HEIGHT;
+        final float expectedX = scaledContentWidth - mViewport.getWidth();
+        final float expectedY = scaledContentHeight - mViewport.getHeight();
+        Assert.assertEquals(expectedX, mViewport.getTransX(), TOLERANCE);
+        Assert.assertEquals(expectedY, mViewport.getTransY(), TOLERANCE);
+        Assert.assertEquals(expectedBitmapMatrix, mBitmapScaleMatrix);
+        inOrder.verify(mMediatorDelegateMock)
+                .setBitmapScaleMatrix(argThat(new MatrixMatcher(expectedBitmapMatrix)), eq(1.125f));
+        Assert.assertTrue(mHasUserInteraction);
+
+        Assert.assertTrue(mScaleController.scaleFinished(1f, 0, 0));
+        Assert.assertEquals(1.125f, mViewport.getScale(), TOLERANCE);
+        Assert.assertEquals(expectedX, mViewport.getTransX(), TOLERANCE);
+        Assert.assertEquals(expectedY, mViewport.getTransY(), TOLERANCE);
+        expectedBitmapMatrix.reset();
+        inOrder.verify(mMediatorDelegateMock).resetScaleFactorOfAllSubframes();
+        inOrder.verify(mMediatorDelegateMock).updateVisuals(eq(true));
+        inOrder.verify(mMediatorDelegateMock).forceRedrawVisibleSubframes();
+    }
+
+    /**
+     * Scales the viewport without a reset of the bitmap scale matrix.
+     */
+    @Test
+    public void testZoomInAndOutWithoutReset() {
+        mViewport.setTrans(100, 150);
+        InOrder inOrder = inOrder(mMediatorDelegateMock);
+
+        // Zoom in.
+        Assert.assertTrue(mScaleController.scaleBy(2f, 50, 50));
+        Matrix expectedBitmapMatrix = new Matrix();
+        expectedBitmapMatrix.postScale(2f, 2f, 50, 50);
+        Assert.assertEquals(2f, mViewport.getScale(), TOLERANCE);
+        Assert.assertEquals(250f, mViewport.getTransX(), TOLERANCE);
+        Assert.assertEquals(350f, mViewport.getTransY(), TOLERANCE);
+        Assert.assertEquals(expectedBitmapMatrix, mBitmapScaleMatrix);
+        inOrder.verify(mMediatorDelegateMock)
+                .setBitmapScaleMatrix(argThat(new MatrixMatcher(expectedBitmapMatrix)), eq(2f));
+        Assert.assertTrue(mHasUserInteraction);
+
+        Assert.assertTrue(mScaleController.scaleFinished(1f, 0, 0));
+        Assert.assertEquals(2f, mViewport.getScale(), TOLERANCE);
+        Assert.assertEquals(250f, mViewport.getTransX(), TOLERANCE);
+        Assert.assertEquals(350f, mViewport.getTransY(), TOLERANCE);
+        expectedBitmapMatrix.reset();
+        inOrder.verify(mMediatorDelegateMock).resetScaleFactorOfAllSubframes();
+        inOrder.verify(mMediatorDelegateMock).updateVisuals(eq(true));
+        inOrder.verify(mMediatorDelegateMock).forceRedrawVisibleSubframes();
+
+        // Pretend images weren't fetched and bitmap scale is not reset.
+
+        // Zoom out.
+        Assert.assertTrue(mScaleController.scaleBy(0.75f, 50, 50));
+        expectedBitmapMatrix.reset();
+        expectedBitmapMatrix.postScale(1.5f, 1.5f);
+        expectedBitmapMatrix.postTranslate(-25, -25);
+        Assert.assertEquals(1.5f, mViewport.getScale(), TOLERANCE);
+        Assert.assertEquals(175f, mViewport.getTransX(), TOLERANCE);
+        Assert.assertEquals(250f, mViewport.getTransY(), TOLERANCE);
+        Assert.assertEquals(expectedBitmapMatrix, mBitmapScaleMatrix);
+        inOrder.verify(mMediatorDelegateMock)
+                .setBitmapScaleMatrix(argThat(new MatrixMatcher(expectedBitmapMatrix)), eq(1.5f));
+        Assert.assertTrue(mHasUserInteraction);
+
+        Assert.assertTrue(mScaleController.scaleFinished(1f, 0, 0));
+        Assert.assertEquals(1.5f, mViewport.getScale(), TOLERANCE);
+        Assert.assertEquals(175f, mViewport.getTransX(), TOLERANCE);
+        Assert.assertEquals(250f, mViewport.getTransY(), TOLERANCE);
+        expectedBitmapMatrix.reset();
+        inOrder.verify(mMediatorDelegateMock).resetScaleFactorOfAllSubframes();
+        inOrder.verify(mMediatorDelegateMock).updateVisuals(eq(true));
+        inOrder.verify(mMediatorDelegateMock).forceRedrawVisibleSubframes();
+    }
+}
diff --git a/components/paint_preview/player/android/junit/src/org/chromium/components/paintpreview/player/frame/PlayerFrameScrollControllerTest.java b/components/paint_preview/player/android/junit/src/org/chromium/components/paintpreview/player/frame/PlayerFrameScrollControllerTest.java
new file mode 100644
index 0000000..e88ad33
--- /dev/null
+++ b/components/paint_preview/player/android/junit/src/org/chromium/components/paintpreview/player/frame/PlayerFrameScrollControllerTest.java
@@ -0,0 +1,240 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+package org.chromium.components.paintpreview.player.frame;
+
+import static org.mockito.ArgumentMatchers.eq;
+import static org.mockito.Mockito.inOrder;
+import static org.mockito.Mockito.never;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+import android.graphics.Matrix;
+import android.util.Size;
+import android.widget.OverScroller;
+
+import org.junit.Assert;
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.InOrder;
+import org.mockito.Mock;
+import org.mockito.MockitoAnnotations;
+import org.robolectric.annotation.Config;
+import org.robolectric.shadows.ShadowLooper;
+
+import org.chromium.base.ContextUtils;
+import org.chromium.base.test.BaseRobolectricTestRunner;
+import org.chromium.components.paintpreview.player.OverscrollHandler;
+
+/**
+ * Tests for the {@link PlayerFrameScrollController} class.
+ */
+@RunWith(BaseRobolectricTestRunner.class)
+@Config(shadows = {PaintPreviewCustomFlingingShadowScroller.class})
+public class PlayerFrameScrollControllerTest {
+    private static final int CONTENT_WIDTH = 500;
+    private static final int CONTENT_HEIGHT = 1000;
+    private static final float TOLERANCE = 0.001f;
+
+    private OverScroller mScroller;
+    private PlayerFrameViewport mViewport;
+    @Mock
+    private PlayerFrameMediatorDelegate mMediatorDelegateMock;
+    @Mock
+    private OverscrollHandler mOverscrollHandlerMock;
+    private Runnable mUserInteractionCallback;
+    private boolean mHasUserInteraction;
+    private PlayerFrameScrollController mScrollController;
+
+    @Before
+    public void setUp() {
+        MockitoAnnotations.initMocks(this);
+        mScroller = new OverScroller(ContextUtils.getApplicationContext());
+        mHasUserInteraction = false;
+        mUserInteractionCallback = () -> mHasUserInteraction = true;
+        mViewport = new PlayerFrameViewport();
+        mScrollController = new PlayerFrameScrollController(mScroller, mViewport,
+                new Size(CONTENT_WIDTH, CONTENT_HEIGHT), mMediatorDelegateMock,
+                mUserInteractionCallback);
+    }
+
+    /**
+     * Test that scrolling updates the viewport correctly and triggers expected callbacks.
+     */
+    @Test
+    public void testScrollBy() {
+        mViewport.setSize(100, 100);
+
+        Assert.assertEquals(0f, mViewport.getTransX(), TOLERANCE);
+        Assert.assertEquals(0f, mViewport.getTransY(), TOLERANCE);
+
+        Assert.assertTrue(mScrollController.scrollBy(100, 100));
+        Assert.assertEquals(100f, mViewport.getTransX(), TOLERANCE);
+        Assert.assertEquals(100f, mViewport.getTransY(), TOLERANCE);
+        verify(mMediatorDelegateMock).updateVisuals(eq(false));
+        Assert.assertTrue(mHasUserInteraction);
+    }
+
+    /**
+     * Test that scrolling won't exceed content bounds.
+     */
+    @Test
+    public void testScrollByWithinBounds() {
+        mViewport.setSize(100, 100);
+
+        // Attempt to scroll out-of-bounds left.
+        Assert.assertFalse(mScrollController.scrollBy(-100, 0));
+        Assert.assertEquals(0f, mViewport.getTransX(), TOLERANCE);
+        Assert.assertEquals(0f, mViewport.getTransY(), TOLERANCE);
+
+        // Attempt to scroll out-of-bounds up.
+        Assert.assertFalse(mScrollController.scrollBy(0, -100));
+        Assert.assertEquals(0f, mViewport.getTransX(), TOLERANCE);
+        Assert.assertEquals(0f, mViewport.getTransY(), TOLERANCE);
+
+        // Overscroll downwards.
+        Assert.assertTrue(mScrollController.scrollBy(0, 2000));
+        Assert.assertEquals(0f, mViewport.getTransX(), TOLERANCE);
+        Assert.assertEquals(900f, mViewport.getTransY(), TOLERANCE);
+
+        // Overscroll right.
+        Assert.assertTrue(mScrollController.scrollBy(1000, 0));
+        Assert.assertEquals(400f, mViewport.getTransX(), TOLERANCE);
+        Assert.assertEquals(900f, mViewport.getTransY(), TOLERANCE);
+
+        // Attempt to scroll out-of-bounds right.
+        Assert.assertFalse(mScrollController.scrollBy(100, 0));
+        Assert.assertEquals(400f, mViewport.getTransX(), TOLERANCE);
+        Assert.assertEquals(900f, mViewport.getTransY(), TOLERANCE);
+
+        // Attempt to scroll out-of-bounds down.
+        Assert.assertFalse(mScrollController.scrollBy(0, 100));
+        Assert.assertEquals(400f, mViewport.getTransX(), TOLERANCE);
+        Assert.assertEquals(900f, mViewport.getTransY(), TOLERANCE);
+
+        // Overscroll upward.
+        Assert.assertTrue(mScrollController.scrollBy(0, -2000));
+        Assert.assertEquals(400f, mViewport.getTransX(), TOLERANCE);
+        Assert.assertEquals(0f, mViewport.getTransY(), TOLERANCE);
+
+        // Overscroll left.
+        Assert.assertTrue(mScrollController.scrollBy(-1000, 0));
+        Assert.assertEquals(0f, mViewport.getTransX(), TOLERANCE);
+        Assert.assertEquals(0f, mViewport.getTransY(), TOLERANCE);
+    }
+
+    /**
+     * Test that flinging updates the viewport correctly and triggers expected callbacks. NOTE: this
+     * uses a custom shadow for the OverScroller that immediately scrolls to top or bottom of the
+     * page in one step.
+     */
+    @Test
+    public void testOnFling() {
+        mViewport.setSize(100, 100);
+
+        Assert.assertTrue(mScrollController.onFling(100, 0));
+        ShadowLooper.runUiThreadTasks();
+        Assert.assertTrue(mScroller.isFinished());
+        Assert.assertEquals(mScroller.getFinalX(), mViewport.getTransX(), TOLERANCE);
+        Assert.assertEquals(mScroller.getFinalY(), mViewport.getTransY(), TOLERANCE);
+
+        Assert.assertTrue(mScrollController.onFling(-100, 0));
+        ShadowLooper.runUiThreadTasks();
+        Assert.assertTrue(mScroller.isFinished());
+        Assert.assertEquals(mScroller.getFinalX(), mViewport.getTransX(), TOLERANCE);
+        Assert.assertEquals(mScroller.getFinalY(), mViewport.getTransY(), TOLERANCE);
+
+        Assert.assertTrue(mScrollController.onFling(0, 100));
+        ShadowLooper.runUiThreadTasks();
+        Assert.assertTrue(mScroller.isFinished());
+        Assert.assertEquals(mScroller.getFinalX(), mViewport.getTransX(), TOLERANCE);
+        Assert.assertEquals(mScroller.getFinalY(), mViewport.getTransY(), TOLERANCE);
+
+        Assert.assertTrue(mScrollController.onFling(0, -100));
+        ShadowLooper.runUiThreadTasks();
+        Assert.assertTrue(mScroller.isFinished());
+        Assert.assertEquals(mScroller.getFinalX(), mViewport.getTransX(), TOLERANCE);
+        Assert.assertEquals(mScroller.getFinalY(), mViewport.getTransY(), TOLERANCE);
+
+        Assert.assertTrue(mScrollController.onFling(100, 100));
+        ShadowLooper.runUiThreadTasks();
+        Assert.assertTrue(mScroller.isFinished());
+        Assert.assertEquals(mScroller.getFinalX(), mViewport.getTransX(), TOLERANCE);
+        Assert.assertEquals(mScroller.getFinalY(), mViewport.getTransY(), TOLERANCE);
+
+        Assert.assertTrue(mScrollController.onFling(-100, -100));
+        ShadowLooper.runUiThreadTasks();
+        Assert.assertTrue(mScroller.isFinished());
+        Assert.assertEquals(mScroller.getFinalX(), mViewport.getTransX(), TOLERANCE);
+        Assert.assertEquals(mScroller.getFinalY(), mViewport.getTransY(), TOLERANCE);
+    }
+
+    /**
+     * Test that the overscroll-to-refresh handler is called when appropriate.
+     */
+    @Test
+    public void testOverscrollToRefresh() {
+        mScrollController.setOverscrollHandler(mOverscrollHandlerMock);
+        mViewport.setSize(100, 100);
+        Assert.assertEquals(0f, mViewport.getTransX(), TOLERANCE);
+        Assert.assertEquals(0f, mViewport.getTransY(), TOLERANCE);
+
+        when(mOverscrollHandlerMock.start()).thenReturn(true);
+        Assert.assertTrue(mScrollController.scrollBy(0, -100));
+        verify(mOverscrollHandlerMock).start();
+        verify(mOverscrollHandlerMock).pull(eq(100f));
+
+        mScrollController.onRelease();
+        verify(mOverscrollHandlerMock).release();
+    }
+
+    /**
+     * Test that the overscroll-to-refresh handler is eased correctly.
+     */
+    @Test
+    public void testOverscrollToRefreshEasedOff() {
+        mScrollController.setOverscrollHandler(mOverscrollHandlerMock);
+        mViewport.setSize(100, 100);
+        Assert.assertEquals(0f, mViewport.getTransX(), TOLERANCE);
+        Assert.assertEquals(0f, mViewport.getTransY(), TOLERANCE);
+
+        when(mOverscrollHandlerMock.start()).thenReturn(true);
+        Assert.assertTrue(mScrollController.scrollBy(0, -100));
+        verify(mOverscrollHandlerMock).start();
+        verify(mOverscrollHandlerMock).pull(eq(100f));
+
+        Assert.assertTrue(mScrollController.scrollBy(0, 100));
+        verify(mOverscrollHandlerMock).reset();
+
+        mScrollController.onRelease();
+        verify(mOverscrollHandlerMock, never()).release();
+    }
+
+    /**
+     * Test that the bitmap scale matrix updates correctly if it isn't identity.
+     */
+    @Test
+    public void testOffsetBitmapScaleMatrix() {
+        mViewport.setSize(100, 100);
+        mViewport.setScale(2f);
+        InOrder inOrder = inOrder(mMediatorDelegateMock);
+        Matrix expectedMatrix = new Matrix();
+
+        // Overscroll downwards.
+        expectedMatrix.postScale(2f, 2f);
+        expectedMatrix.postTranslate(0, -1900);
+        Assert.assertTrue(mScrollController.scrollBy(0, 2000));
+        Assert.assertEquals(0f, mViewport.getTransX(), TOLERANCE);
+        Assert.assertEquals(1900f, mViewport.getTransY(), TOLERANCE);
+        inOrder.verify(mMediatorDelegateMock).offsetBitmapScaleMatrix(eq(0f), eq(1900f));
+
+        // Overscroll right.
+        expectedMatrix.postTranslate(-900, 0);
+        Assert.assertTrue(mScrollController.scrollBy(1000, 0));
+        Assert.assertEquals(900f, mViewport.getTransX(), TOLERANCE);
+        Assert.assertEquals(1900f, mViewport.getTransY(), TOLERANCE);
+        inOrder.verify(mMediatorDelegateMock).offsetBitmapScaleMatrix(eq(900f), eq(0f));
+    }
+}
diff --git a/components/paint_preview/player/android/junit/src/org/chromium/components/paintpreview/player/frame/PlayerFrameViewportTest.java b/components/paint_preview/player/android/junit/src/org/chromium/components/paintpreview/player/frame/PlayerFrameViewportTest.java
new file mode 100644
index 0000000..e6d6617
--- /dev/null
+++ b/components/paint_preview/player/android/junit/src/org/chromium/components/paintpreview/player/frame/PlayerFrameViewportTest.java
@@ -0,0 +1,113 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+package org.chromium.components.paintpreview.player.frame;
+
+import android.graphics.Rect;
+
+import org.junit.Assert;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+
+import org.chromium.base.test.BaseRobolectricTestRunner;
+
+/**
+ * Tests for the {@link PlayerFrameViewport} class.
+ */
+@RunWith(BaseRobolectricTestRunner.class)
+public class PlayerFrameViewportTest {
+    private static final float TOLERANCE = 0.001f;
+
+    /**
+     * Tests that viewport size is set/get correctly.
+     */
+    @Test
+    public void testViewportSize() {
+        PlayerFrameViewport viewport = new PlayerFrameViewport();
+        viewport.setSize(100, 200);
+
+        Assert.assertEquals(100, viewport.getWidth());
+        Assert.assertEquals(200, viewport.getHeight());
+
+        Rect viewportRect = viewport.asRect();
+        Assert.assertEquals(0, viewportRect.left);
+        Assert.assertEquals(0, viewportRect.top);
+        Assert.assertEquals(100, viewportRect.width());
+        Assert.assertEquals(200, viewportRect.height());
+    }
+
+    /**
+     * Tests that viewport translation is set/get correctly.
+     */
+    @Test
+    public void testViewportTranslation() {
+        PlayerFrameViewport viewport = new PlayerFrameViewport();
+        viewport.setSize(100, 200);
+
+        viewport.offset(50, 60);
+        Assert.assertEquals(50f, viewport.getTransX(), TOLERANCE);
+        Assert.assertEquals(60f, viewport.getTransY(), TOLERANCE);
+
+        Rect viewportRect = viewport.asRect();
+        Assert.assertEquals(50, viewportRect.left);
+        Assert.assertEquals(60, viewportRect.top);
+        Assert.assertEquals(100, viewportRect.width());
+        Assert.assertEquals(200, viewportRect.height());
+
+        viewport.offset(-200, -110);
+        Assert.assertEquals(-150f, viewport.getTransX(), TOLERANCE);
+        Assert.assertEquals(-50f, viewport.getTransY(), TOLERANCE);
+
+        viewportRect = viewport.asRect();
+        Assert.assertEquals(-150, viewportRect.left);
+        Assert.assertEquals(-50, viewportRect.top);
+        Assert.assertEquals(100, viewportRect.width());
+        Assert.assertEquals(200, viewportRect.height());
+
+        viewport.setTrans(123, 456);
+        Assert.assertEquals(123f, viewport.getTransX(), TOLERANCE);
+        Assert.assertEquals(456f, viewport.getTransY(), TOLERANCE);
+
+        viewportRect = viewport.asRect();
+        Assert.assertEquals(123, viewportRect.left);
+        Assert.assertEquals(456, viewportRect.top);
+        Assert.assertEquals(100, viewportRect.width());
+        Assert.assertEquals(200, viewportRect.height());
+    }
+
+    /**
+     * Tests that viewport scaling works correctly.
+     */
+    @Test
+    public void testViewportScaling() {
+        PlayerFrameViewport viewport = new PlayerFrameViewport();
+        viewport.setSize(100, 200);
+
+        Assert.assertEquals(1f, viewport.getScale(), TOLERANCE);
+
+        // Resetting the scale to 0 is an "invalid state" used to indicate the scale needs to be
+        // updated.
+        viewport.setScale(0f);
+        Assert.assertEquals(0f, viewport.getScale(), TOLERANCE);
+
+        viewport.setScale(2f);
+        Assert.assertEquals(2f, viewport.getScale(), TOLERANCE);
+
+        viewport.scale(0.5f, 0, 0);
+        Assert.assertEquals(1f, viewport.getScale(), TOLERANCE);
+
+        viewport.scale(0.5f, 0, 0);
+        Assert.assertEquals(0.5f, viewport.getScale(), TOLERANCE);
+
+        viewport.scale(5f, 0, 0);
+        Assert.assertEquals(2.5f, viewport.getScale(), TOLERANCE);
+
+        // Try scaling about a pivot.
+        viewport.setTrans(100, 50);
+        viewport.scale(0.5f, -30, -40);
+        Assert.assertEquals(1.25f, viewport.getScale(), TOLERANCE);
+        Assert.assertEquals(65f, viewport.getTransX(), TOLERANCE);
+        Assert.assertEquals(45f, viewport.getTransY(), TOLERANCE);
+    }
+}
diff --git a/components/plugins/renderer/webview_plugin.cc b/components/plugins/renderer/webview_plugin.cc
index 5ac3ac97..0551d9c 100644
--- a/components/plugins/renderer/webview_plugin.cc
+++ b/components/plugins/renderer/webview_plugin.cc
@@ -305,10 +305,10 @@
   return true;
 }
 
-blink::WebScreenInfo WebViewPlugin::WebViewHelper::GetScreenInfo() {
+blink::ScreenInfo WebViewPlugin::WebViewHelper::GetScreenInfo() {
   // TODO(danakj): This should probably return the screen info for the
   // RenderView.
-  return blink::WebScreenInfo();
+  return blink::ScreenInfo();
 }
 
 void WebViewPlugin::WebViewHelper::SetToolTipText(
diff --git a/components/plugins/renderer/webview_plugin.h b/components/plugins/renderer/webview_plugin.h
index b615db6..aa9c13ce 100644
--- a/components/plugins/renderer/webview_plugin.h
+++ b/components/plugins/renderer/webview_plugin.h
@@ -172,7 +172,7 @@
     bool AcceptsLoadDrops() override;
     bool CanHandleGestureEvent() override;
     bool CanUpdateLayout() override;
-    blink::WebScreenInfo GetScreenInfo() override;
+    blink::ScreenInfo GetScreenInfo() override;
     void DidInvalidateRect(const blink::WebRect&) override;
 
     // WebWidgetClient methods:
diff --git a/components/policy/core/common/cloud/user_cloud_policy_manager_unittest.cc b/components/policy/core/common/cloud/user_cloud_policy_manager_unittest.cc
index 89ae141..001aeef 100644
--- a/components/policy/core/common/cloud/user_cloud_policy_manager_unittest.cc
+++ b/components/policy/core/common/cloud/user_cloud_policy_manager_unittest.cc
@@ -35,8 +35,7 @@
   void SetUp() override {
     // Set up a policy map for testing.
     policy_map_.Set("key", POLICY_LEVEL_MANDATORY, POLICY_SCOPE_USER,
-                    POLICY_SOURCE_CLOUD, std::make_unique<base::Value>("value"),
-                    nullptr);
+                    POLICY_SOURCE_CLOUD, base::Value("value"), nullptr);
     expected_bundle_.Get(PolicyNamespace(POLICY_DOMAIN_CHROME, std::string()))
         .CopyFrom(policy_map_);
   }
diff --git a/components/policy/proto/record_constants.proto b/components/policy/proto/record_constants.proto
index 17f7c79..b082002c 100644
--- a/components/policy/proto/record_constants.proto
+++ b/components/policy/proto/record_constants.proto
@@ -46,9 +46,19 @@
   SLOW_BATCH = 3;
 
   // |BACKGROUND_BATCH| queues transfer large amounts of non-immediate data.
-  // These records are the first to be rate limited.
-  // |BACKGROUND_BATCH| records are the first to be shed.
+  // These records will be rate limited before |SLOW_BATCH| records.
+  // |BACKGROUND_BATCH| records are shed before |SLOW_BATCH| records.
   // Log files are a perfect examples of records that need to be
   // |BACKGROUND_BATCH|.
   BACKGROUND_BATCH = 4;
+
+  // |MANUAL_BATCH| queues transfer data only on explicit request.
+  // Note that since a queue can hold records submitted by multiple clients,
+  // one client requesting to transfer data will do so for all collected
+  // records of the same priority, including those enqueued by other clients.
+  // |MANUAL_BATCH| records are the first to be rate limited, and since there
+  // is no automatic transfer, it is important to explicitly flush them often
+  // enough to avoid loss of data.
+  // |MANUAL_BATCH| records are the first to be shed.
+  MANUAL_BATCH = 5;
 }
diff --git a/components/printing/renderer/print_render_frame_helper.cc b/components/printing/renderer/print_render_frame_helper.cc
index 2a97938d..3fe2858 100644
--- a/components/printing/renderer/print_render_frame_helper.cc
+++ b/components/printing/renderer/print_render_frame_helper.cc
@@ -803,7 +803,7 @@
  private:
   // blink::WebViewClient:
   void DidStopLoading() override;
-  blink::WebScreenInfo GetScreenInfo() override;
+  blink::ScreenInfo GetScreenInfo() override;
 
   // blink::WebLocalFrameClient:
   void BindToFrame(blink::WebNavigationControl* frame) override;
@@ -981,8 +981,8 @@
       nullptr /* extra_data */);
 }
 
-blink::WebScreenInfo PrepareFrameAndViewForPrint::GetScreenInfo() {
-  return blink::WebScreenInfo();
+blink::ScreenInfo PrepareFrameAndViewForPrint::GetScreenInfo() {
+  return blink::ScreenInfo();
 }
 
 void PrepareFrameAndViewForPrint::DidStopLoading() {
diff --git a/components/safe_browsing/content/web_ui/safe_browsing_ui.cc b/components/safe_browsing/content/web_ui/safe_browsing_ui.cc
index 52f8fb7..e49b045 100644
--- a/components/safe_browsing/content/web_ui/safe_browsing_ui.cc
+++ b/components/safe_browsing/content/web_ui/safe_browsing_ui.cc
@@ -1372,9 +1372,10 @@
     request_data.SetStringKey("url", request.request_data().url());
     request_data.SetStringKey("filename", request.request_data().filename());
     request_data.SetStringKey("digest", request.request_data().digest());
-    // TODO(domfc): Improve this once csd is populated for this proto.
-    request_data.SetStringKey("csd",
-                              request.request_data().csd().SerializeAsString());
+    if (request.request_data().has_csd()) {
+      request_data.SetStringKey(
+          "csd", request.request_data().csd().SerializeAsString());
+    }
     request_dict.SetKey("request_data", std::move(request_data));
   }
 
diff --git a/components/viz/service/display/gl_renderer.cc b/components/viz/service/display/gl_renderer.cc
index 296f9b9..1e539555 100644
--- a/components/viz/service/display/gl_renderer.cc
+++ b/components/viz/service/display/gl_renderer.cc
@@ -71,7 +71,7 @@
 #include "third_party/skia/include/core/SkTypes.h"
 #include "third_party/skia/include/effects/SkShaderMaskFilter.h"
 #include "third_party/skia/include/gpu/GrBackendSurface.h"
-#include "third_party/skia/include/gpu/GrContext.h"
+#include "third_party/skia/include/gpu/GrDirectContext.h"
 #include "third_party/skia/include/gpu/gl/GrGLInterface.h"
 #include "third_party/skia/include/gpu/gl/GrGLTypes.h"
 #include "ui/gfx/color_space.h"
@@ -319,7 +319,9 @@
     // is lost.
     // TODO(vmiura,bsalomon): crbug.com/487850 Ensure that
     // ContextProvider::GrContext() does not return NULL.
-    if (renderer->output_surface_->context_provider()->GrContext())
+    GrDirectContext* direct = GrAsDirectContext(
+        renderer->output_surface_->context_provider()->GrContext());
+    if (direct)
       return base::WrapUnique(new ScopedUseGrContext(renderer));
     return nullptr;
   }
@@ -330,8 +332,9 @@
     renderer_->RestoreGLStateAfterSkia();
   }
 
-  GrContext* context() const {
-    return renderer_->output_surface_->context_provider()->GrContext();
+  GrDirectContext* context() const {
+    return GrAsDirectContext(
+        renderer_->output_surface_->context_provider()->GrContext());
   }
 
  private:
@@ -1068,7 +1071,8 @@
     if (filter_clip != src_rect) {
       filter_clip = gfx::ScaleToEnclosingRect(filter_clip,
                                               params->backdrop_filter_quality);
-      src_image = src_image->makeSubset(RectToSkIRect(filter_clip));
+      src_image = src_image->makeSubset(RectToSkIRect(filter_clip),
+                                        use_gr_context->context());
       src_image_rect = gfx::RectF(filter_clip.width(), filter_clip.height());
       dest_rect = RectToSkRect(filter_clip);
     }
diff --git a/components/viz/service/display/software_renderer.cc b/components/viz/service/display/software_renderer.cc
index fa593a38..7c55e460 100644
--- a/components/viz/service/display/software_renderer.cc
+++ b/components/viz/service/display/software_renderer.cc
@@ -4,6 +4,10 @@
 
 #include "components/viz/service/display/software_renderer.h"
 
+#include <memory>
+#include <utility>
+#include <vector>
+
 #include "base/process/memory.h"
 #include "base/trace_event/trace_event.h"
 #include "cc/base/math_util.h"
@@ -834,7 +838,8 @@
       return nullptr;
     // Crop the source image to the backdrop_filter_bounds.
     sk_sp<SkImage> cropped_image = SkImage::MakeFromBitmap(backdrop_bitmap);
-    cropped_image = cropped_image->makeSubset(RectToSkIRect(filter_clip));
+    cropped_image =
+        cropped_image->makeSubset(RectToSkIRect(filter_clip), nullptr);
     cropped_image->asLegacyBitmap(&backdrop_bitmap);
     image_offset = filter_clip.origin();
   }
diff --git a/components/viz/test/fake_skia_output_surface.cc b/components/viz/test/fake_skia_output_surface.cc
index ee9ddb0..946b3e80 100644
--- a/components/viz/test/fake_skia_output_surface.cc
+++ b/components/viz/test/fake_skia_output_surface.cc
@@ -21,7 +21,7 @@
 #include "third_party/khronos/GLES2/gl2ext.h"
 #include "third_party/skia/include/core/SkPixelRef.h"
 #include "third_party/skia/include/gpu/GrBackendSurface.h"
-#include "third_party/skia/include/gpu/GrContext.h"
+#include "third_party/skia/include/gpu/GrDirectContext.h"
 #include "third_party/skia/include/gpu/gl/GrGLTypes.h"
 #include "ui/gfx/swap_result.h"
 #include "ui/gl/gl_utils.h"
@@ -292,8 +292,9 @@
     return;
   }
 
+  GrDirectContext* direct = GrAsDirectContext(gr_context());
   auto copy_image = surface->makeImageSnapshot()->makeSubset(
-      RectToSkIRect(geometry.sampling_bounds));
+      RectToSkIRect(geometry.sampling_bounds), direct);
   // Send copy request by copying into a bitmap.
   SkBitmap bitmap;
   copy_image->asLegacyBitmap(&bitmap);
diff --git a/content/browser/DEPS b/content/browser/DEPS
index f47e00f..12d2a06 100644
--- a/content/browser/DEPS
+++ b/content/browser/DEPS
@@ -110,7 +110,7 @@
   "+third_party/blink/public/common/page/web_drag_operation.h",
   "+third_party/blink/public/platform/web_fullscreen_video_status.h",
   "+third_party/blink/public/platform/web_mixed_content_context_type.h",
-  "+third_party/blink/public/platform/web_screen_info.h",
+  "+third_party/blink/public/common/widget/screen_info.h",
   "+third_party/blink/public/platform/web_text_autosizer_page_info.h",
   "+third_party/blink/public/platform/web_text_input_type.h",
   "+third_party/blink/public/platform/mac/web_scrollbar_theme.h",
diff --git a/content/browser/child_process_security_policy_impl.cc b/content/browser/child_process_security_policy_impl.cc
index 2d9c4fc..06347a9 100644
--- a/content/browser/child_process_security_policy_impl.cc
+++ b/content/browser/child_process_security_policy_impl.cc
@@ -483,7 +483,7 @@
   void SetProcessLock(const ProcessLock& lock,
                       BrowsingInstanceId browsing_instance_id) {
     DCHECK(process_lock_.is_empty());
-    DCHECK_NE(SiteInstanceImpl::GetDefaultSiteURL(), process_lock_.lock_url());
+    DCHECK_NE(SiteInstanceImpl::GetDefaultSiteURL(), lock.lock_url());
     process_lock_ = lock;
     DCHECK(lowest_browsing_instance_id_.is_null());
     lowest_browsing_instance_id_ = browsing_instance_id;
diff --git a/content/browser/devtools/devtools_url_loader_interceptor.cc b/content/browser/devtools/devtools_url_loader_interceptor.cc
index aaa9a15..fb8e481 100644
--- a/content/browser/devtools/devtools_url_loader_interceptor.cc
+++ b/content/browser/devtools/devtools_url_loader_interceptor.cc
@@ -27,7 +27,7 @@
 #include "net/cookies/cookie_util.h"
 #include "net/http/http_util.h"
 #include "net/url_request/redirect_util.h"
-#include "net/url_request/url_request.h"
+#include "net/url_request/referrer_policy.h"
 #include "services/network/public/cpp/cors/cors.h"
 #include "services/network/public/cpp/resource_request_body.h"
 #include "services/network/public/mojom/network_context.mojom.h"
@@ -971,7 +971,7 @@
       if (base::EqualsCaseInsensitiveASCII(entry.first,
                                            net::HttpRequestHeaders::kReferer)) {
         request->referrer = GURL(entry.second);
-        request->referrer_policy = net::URLRequest::NEVER_CLEAR_REFERRER;
+        request->referrer_policy = net::ReferrerPolicy::NEVER_CLEAR;
       } else {
         request->headers.SetHeader(entry.first, entry.second);
       }
diff --git a/content/browser/devtools/protocol/emulation_handler.cc b/content/browser/devtools/protocol/emulation_handler.cc
index 1a8e5b84..bf405d0 100644
--- a/content/browser/devtools/protocol/emulation_handler.cc
+++ b/content/browser/devtools/protocol/emulation_handler.cc
@@ -305,11 +305,11 @@
     params.viewport_offset.SetPoint(viewport.fromJust()->GetX(),
                                     viewport.fromJust()->GetY());
 
-    ScreenInfo screen_info;
-    host_->GetRenderWidgetHost()->GetScreenInfo(&screen_info);
-    double dpfactor = device_scale_factor ? device_scale_factor /
-                                                screen_info.device_scale_factor
-                                          : 1;
+    double dpfactor =
+        device_scale_factor
+            ? device_scale_factor /
+                  host_->GetRenderWidgetHost()->GetDeviceScaleFactor()
+            : 1;
     params.viewport_scale = viewport.fromJust()->GetScale() * dpfactor;
 
     // Resize the RenderWidgetHostView to the size of the overridden viewport.
diff --git a/content/browser/devtools/protocol/network_handler.cc b/content/browser/devtools/protocol/network_handler.cc
index f68bbfc2b..55cbbdf 100644
--- a/content/browser/devtools/protocol/network_handler.cc
+++ b/content/browser/devtools/protocol/network_handler.cc
@@ -71,6 +71,7 @@
 #include "net/http/http_util.h"
 #include "net/ssl/ssl_cipher_suite_names.h"
 #include "net/ssl/ssl_connection_status_flags.h"
+#include "net/url_request/referrer_policy.h"
 #include "services/network/public/cpp/data_element.h"
 #include "services/network/public/cpp/features.h"
 #include "services/network/public/cpp/http_raw_request_response_info.h"
@@ -380,7 +381,7 @@
   return Network::Request::ReferrerPolicyEnum::NoReferrerWhenDowngrade;
 }
 
-String referrerPolicy(net::URLRequest::ReferrerPolicy referrer_policy) {
+String referrerPolicy(net::ReferrerPolicy referrer_policy) {
   return referrerPolicy(
       Referrer::NetReferrerPolicyToBlinkReferrerPolicy(referrer_policy));
 }
diff --git a/content/browser/devtools/protocol/page_handler.cc b/content/browser/devtools/protocol/page_handler.cc
index 0a34a6d3..ba1f65f0 100644
--- a/content/browser/devtools/protocol/page_handler.cc
+++ b/content/browser/devtools/protocol/page_handler.cc
@@ -725,8 +725,7 @@
   gfx::Size emulated_view_size = modified_params.view_size;
 
   double dpfactor = 1;
-  ScreenInfo screen_info;
-  widget_host->GetScreenInfo(&screen_info);
+  float widget_host_device_scale_factor = widget_host->GetDeviceScaleFactor();
   if (emulation_enabled) {
     // When emulating, emulate again and scale to make resulting image match
     // physical DP resolution. If view_size is not overriden, use actual view
@@ -744,7 +743,7 @@
 
     dpfactor = modified_params.device_scale_factor
                    ? modified_params.device_scale_factor /
-                         screen_info.device_scale_factor
+                         widget_host_device_scale_factor
                    : 1;
     // When clip is specified, we scale viewport via clip, otherwise we use
     // scale.
@@ -767,7 +766,7 @@
                                              clip.fromJust()->GetY());
     modified_params.viewport_scale = clip.fromJust()->GetScale() * dpfactor;
     if (IsUseZoomForDSFEnabled()) {
-      modified_params.viewport_offset.Scale(screen_info.device_scale_factor);
+      modified_params.viewport_offset.Scale(widget_host_device_scale_factor);
     }
   }
 
@@ -793,7 +792,7 @@
       requested_image_size = emulated_view_size;
     }
     double scale = emulation_enabled ? original_params.device_scale_factor
-                                     : screen_info.device_scale_factor;
+                                     : widget_host_device_scale_factor;
     if (clip.isJust())
       scale *= clip.fromJust()->GetScale();
     requested_image_size = gfx::ScaleToRoundedSize(requested_image_size, scale);
diff --git a/content/browser/frame_host/cross_process_frame_connector.cc b/content/browser/frame_host/cross_process_frame_connector.cc
index 385b190..f2b9905 100644
--- a/content/browser/frame_host/cross_process_frame_connector.cc
+++ b/content/browser/frame_host/cross_process_frame_connector.cc
@@ -20,7 +20,6 @@
 #include "content/browser/renderer_host/render_widget_host_view_base.h"
 #include "content/browser/renderer_host/render_widget_host_view_child_frame.h"
 #include "content/common/frame_messages.h"
-#include "content/public/common/screen_info.h"
 #include "content/public/common/use_zoom_for_dsf_policy.h"
 #include "gpu/ipc/common/gpu_messages.h"
 #include "third_party/blink/public/common/input/web_input_event.h"
diff --git a/content/browser/frame_host/render_frame_host_impl.cc b/content/browser/frame_host/render_frame_host_impl.cc
index f4d53cf..9a3b529 100644
--- a/content/browser/frame_host/render_frame_host_impl.cc
+++ b/content/browser/frame_host/render_frame_host_impl.cc
@@ -2032,7 +2032,7 @@
   if (owned_render_widget_host_) {
     DCHECK(parent_);
     DCHECK_NE(parent_routing_id, MSG_ROUTING_NONE);
-    ScreenInfo screen_info;
+    blink::ScreenInfo screen_info;
     parent_->GetRenderWidgetHost()->GetScreenInfo(&screen_info);
     RenderWidgetHostView* rwhv = RenderWidgetHostViewChildFrame::Create(
         owned_render_widget_host_.get(), screen_info);
@@ -4837,7 +4837,7 @@
   // nonsense with a semi-valid but incorrect ScreenInfo (it needs a
   // RenderWidgetHostView to be correct). An updates VisualProperties will get
   // to the RenderWidget eventually.
-  VisualProperties visual_properties;
+  blink::VisualProperties visual_properties;
   main_frame->GetLocalRenderWidgetHost()->GetScreenInfo(
       &visual_properties.screen_info);
   main_frame->GetLocalRenderWidgetHost()->BindFrameWidgetInterfaces(
diff --git a/content/browser/renderer_host/browser_compositor_view_mac.h b/content/browser/renderer_host/browser_compositor_view_mac.h
index af7b324..5d8eae8 100644
--- a/content/browser/renderer_host/browser_compositor_view_mac.h
+++ b/content/browser/renderer_host/browser_compositor_view_mac.h
@@ -14,7 +14,7 @@
 #include "components/viz/common/surfaces/parent_local_surface_id_allocator.h"
 #include "components/viz/common/surfaces/scoped_surface_id_allocator.h"
 #include "content/browser/renderer_host/delegated_frame_host.h"
-#include "content/public/common/screen_info.h"
+#include "third_party/blink/public/common/widget/screen_info.h"
 #include "ui/compositor/compositor.h"
 #include "ui/compositor/compositor_observer.h"
 #include "ui/compositor/layer_observer.h"
@@ -109,7 +109,7 @@
   }
 
   const gfx::Size& GetRendererSize() const { return dfh_size_dip_; }
-  void GetRendererScreenInfo(ScreenInfo* screen_info) const;
+  void GetRendererScreenInfo(blink::ScreenInfo* screen_info) const;
   viz::ScopedSurfaceIdAllocator GetScopedRendererSurfaceIdAllocator(
       base::OnceCallback<void()> allocation_task);
   const viz::LocalSurfaceIdAllocation& GetRendererLocalSurfaceIdAllocation();
diff --git a/content/browser/renderer_host/browser_compositor_view_mac.mm b/content/browser/renderer_host/browser_compositor_view_mac.mm
index ac9fdeb..07e91e2 100644
--- a/content/browser/renderer_host/browser_compositor_view_mac.mm
+++ b/content/browser/renderer_host/browser_compositor_view_mac.mm
@@ -387,7 +387,7 @@
 }
 
 void BrowserCompositorMac::GetRendererScreenInfo(
-    ScreenInfo* screen_info) const {
+    blink::ScreenInfo* screen_info) const {
   DisplayUtil::DisplayToScreenInfo(screen_info, dfh_display_);
 }
 
diff --git a/content/browser/renderer_host/dip_util.cc b/content/browser/renderer_host/dip_util.cc
index 4b4e814..c4185d2 100644
--- a/content/browser/renderer_host/dip_util.cc
+++ b/content/browser/renderer_host/dip_util.cc
@@ -20,24 +20,9 @@
 float GetScaleFactorForView(RenderWidgetHostView* view) {
   if (view)
     return view->GetDeviceScaleFactor();
-  ScreenInfo screen_info;
+  blink::ScreenInfo screen_info;
   DisplayUtil::GetDefaultScreenInfo(&screen_info);
   return screen_info.device_scale_factor;
 }
 
-gfx::Point ConvertViewPointToDIP(RenderWidgetHostView* view,
-                                 const gfx::Point& point_in_pixel) {
-  return gfx::ConvertPointToDIP(GetScaleFactorForView(view), point_in_pixel);
-}
-
-gfx::Size ConvertViewSizeToPixel(RenderWidgetHostView* view,
-                                 const gfx::Size& size_in_dip) {
-  return gfx::ConvertSizeToPixel(GetScaleFactorForView(view), size_in_dip);
-}
-
-gfx::Rect ConvertViewRectToPixel(RenderWidgetHostView* view,
-                                 const gfx::Rect& rect_in_dip) {
-  return gfx::ConvertRectToPixel(GetScaleFactorForView(view), rect_in_dip);
-}
-
 }  // namespace content
diff --git a/content/browser/renderer_host/dip_util.h b/content/browser/renderer_host/dip_util.h
index d9e2fc1..9e92c391 100644
--- a/content/browser/renderer_host/dip_util.h
+++ b/content/browser/renderer_host/dip_util.h
@@ -7,12 +7,6 @@
 
 #include "content/common/content_export.h"
 
-namespace gfx {
-class Point;
-class Rect;
-class Size;
-}  // namespace gfx
-
 namespace content {
 class RenderWidgetHostView;
 
@@ -20,16 +14,6 @@
 // guess when |view| is nullptr.
 CONTENT_EXPORT float GetScaleFactorForView(RenderWidgetHostView* view);
 
-// Utility functions that convert point/size/rect between DIP and pixel
-// coordinate system.
-CONTENT_EXPORT gfx::Point ConvertViewPointToDIP(
-    RenderWidgetHostView* view,
-    const gfx::Point& point_in_pixel);
-CONTENT_EXPORT gfx::Size ConvertViewSizeToPixel(RenderWidgetHostView* view,
-                                                const gfx::Size& size_in_dip);
-CONTENT_EXPORT gfx::Rect ConvertViewRectToPixel(RenderWidgetHostView* view,
-                                                const gfx::Rect& rect_in_dip);
-
 }  // namespace content
 
 #endif  // CONTENT_BROWSER_RENDERER_HOST_DIP_UTIL_H_
diff --git a/content/browser/renderer_host/display_util.cc b/content/browser/renderer_host/display_util.cc
index 7bec9b6..4142c36 100644
--- a/content/browser/renderer_host/display_util.cc
+++ b/content/browser/renderer_host/display_util.cc
@@ -6,7 +6,6 @@
 
 #include "build/build_config.h"
 #include "content/browser/renderer_host/render_widget_host_view_base.h"
-#include "content/public/common/screen_info.h"
 #include "ui/display/display.h"
 #include "ui/display/screen.h"
 #include "ui/gfx/icc_profile.h"
@@ -14,7 +13,7 @@
 namespace content {
 
 // static
-void DisplayUtil::DisplayToScreenInfo(ScreenInfo* screen_info,
+void DisplayUtil::DisplayToScreenInfo(blink::ScreenInfo* screen_info,
                                       const display::Display& display) {
   screen_info->rect = display.bounds();
   // TODO(husky): Remove any Android system controls from availableRect.
@@ -37,7 +36,7 @@
   // other words, relative to the physical display.
   // Spec: https://w3c.github.io/screen-orientation/#dom-screenorientation-angle
   // TODO(ccameron): Should this apply to macOS? Should this be reconciled at a
-  // higher level (say, in conversion to WebScreenInfo)?
+  // higher level (say, in conversion to ScreenInfo)?
   if (screen_info->orientation_angle == 90)
     screen_info->orientation_angle = 270;
   else if (screen_info->orientation_angle == 270)
@@ -52,17 +51,17 @@
 }
 
 // static
-void DisplayUtil::GetDefaultScreenInfo(ScreenInfo* screen_info) {
+void DisplayUtil::GetDefaultScreenInfo(blink::ScreenInfo* screen_info) {
   return GetNativeViewScreenInfo(screen_info, nullptr);
 }
 
 // static
-void DisplayUtil::GetNativeViewScreenInfo(ScreenInfo* screen_info,
+void DisplayUtil::GetNativeViewScreenInfo(blink::ScreenInfo* screen_info,
                                           gfx::NativeView native_view) {
   // Some tests are run with no Screen initialized.
   display::Screen* screen = display::Screen::GetScreen();
   if (!screen) {
-    *screen_info = ScreenInfo();
+    *screen_info = blink::ScreenInfo();
     return;
   }
   display::Display display = native_view
diff --git a/content/browser/renderer_host/display_util.h b/content/browser/renderer_host/display_util.h
index 0cc0fd9..4aeb901 100644
--- a/content/browser/renderer_host/display_util.h
+++ b/content/browser/renderer_host/display_util.h
@@ -6,7 +6,7 @@
 #define CONTENT_BROWSER_RENDERER_HOST_DISPLAY_UTIL_H_
 
 #include "content/common/content_export.h"
-#include "content/public/common/screen_info.h"
+#include "third_party/blink/public/common/widget/screen_info.h"
 #include "ui/display/display.h"
 #include "ui/gfx/native_widget_types.h"
 
@@ -14,13 +14,13 @@
 
 class CONTENT_EXPORT DisplayUtil {
  public:
-  static void DisplayToScreenInfo(ScreenInfo* screen_info,
+  static void DisplayToScreenInfo(blink::ScreenInfo* screen_info,
                                   const display::Display& display);
 
-  static void GetNativeViewScreenInfo(ScreenInfo* screen_info,
+  static void GetNativeViewScreenInfo(blink::ScreenInfo* screen_info,
                                       gfx::NativeView native_view);
 
-  static void GetDefaultScreenInfo(ScreenInfo* screen_info);
+  static void GetDefaultScreenInfo(blink::ScreenInfo* screen_info);
 
   // Compute the orientation type of the display assuming it is a mobile device.
   static blink::mojom::ScreenOrientation GetOrientationTypeForMobile(
diff --git a/content/browser/renderer_host/frame_connector_delegate.h b/content/browser/renderer_host/frame_connector_delegate.h
index 52131588..f97300257 100644
--- a/content/browser/renderer_host/frame_connector_delegate.h
+++ b/content/browser/renderer_host/frame_connector_delegate.h
@@ -12,7 +12,7 @@
 #include "components/viz/host/hit_test/hit_test_query.h"
 #include "content/browser/renderer_host/event_with_latency_info.h"
 #include "content/common/content_export.h"
-#include "content/public/common/screen_info.h"
+#include "third_party/blink/public/common/widget/screen_info.h"
 #include "third_party/blink/public/mojom/frame/intrinsic_sizing_info.mojom-forward.h"
 #include "third_party/blink/public/mojom/input/input_event_result.mojom-shared.h"
 #include "third_party/blink/public/mojom/input/pointer_lock_result.mojom-shared.h"
@@ -177,9 +177,9 @@
 
   // Returns the ScreenInfo propagated from the parent to be used by this
   // child frame.
-  const ScreenInfo& screen_info() const { return screen_info_; }
+  const blink::ScreenInfo& screen_info() const { return screen_info_; }
 
-  void SetScreenInfoForTesting(const ScreenInfo& screen_info) {
+  void SetScreenInfoForTesting(const blink::ScreenInfo& screen_info) {
     screen_info_ = screen_info;
   }
 
@@ -247,7 +247,7 @@
   // intersection_state() can return a reference.
   blink::ViewportIntersectionState intersection_state_;
 
-  ScreenInfo screen_info_;
+  blink::ScreenInfo screen_info_;
   gfx::Size local_frame_size_in_dip_;
   gfx::Size local_frame_size_in_pixels_;
   gfx::Rect screen_space_rect_in_dip_;
diff --git a/content/browser/renderer_host/input/synthetic_gesture_target_aura.cc b/content/browser/renderer_host/input/synthetic_gesture_target_aura.cc
index 93a1bd66..ce12390 100644
--- a/content/browser/renderer_host/input/synthetic_gesture_target_aura.cc
+++ b/content/browser/renderer_host/input/synthetic_gesture_target_aura.cc
@@ -45,9 +45,7 @@
 SyntheticGestureTargetAura::SyntheticGestureTargetAura(
     RenderWidgetHostImpl* host)
     : SyntheticGestureTargetBase(host) {
-  ScreenInfo screen_info;
-  host->GetScreenInfo(&screen_info);
-  device_scale_factor_ = screen_info.device_scale_factor;
+  device_scale_factor_ = host->GetDeviceScaleFactor();
 }
 
 void SyntheticGestureTargetAura::DispatchWebTouchEventToPlatform(
diff --git a/content/browser/renderer_host/render_widget_host_browsertest.cc b/content/browser/renderer_host/render_widget_host_browsertest.cc
index 9defea0..5d2f980 100644
--- a/content/browser/renderer_host/render_widget_host_browsertest.cc
+++ b/content/browser/renderer_host/render_widget_host_browsertest.cc
@@ -625,7 +625,7 @@
 }
 #endif
 
-// Tests that the renderer receives the blink::WebScreenInfo size overrides
+// Tests that the renderer receives the blink::ScreenInfo size overrides
 // while the page is in fullscreen mode. This is a regression test for
 // https://crbug.com/1060795.
 IN_PROC_BROWSER_TEST_F(RenderWidgetHostBrowserTest,
@@ -656,7 +656,7 @@
   ASSERT_FALSE(web_contents()->IsFullscreen());
 
   // While not fullscreened, expect the screen size to not be overridden.
-  ScreenInfo screen_info;
+  blink::ScreenInfo screen_info;
   host()->GetScreenInfo(&screen_info);
   WaitForVisualPropertiesAck();
   EXPECT_EQ(screen_info.rect.size().ToString(),
diff --git a/content/browser/renderer_host/render_widget_host_impl.cc b/content/browser/renderer_host/render_widget_host_impl.cc
index 4c7812b..32fb705 100644
--- a/content/browser/renderer_host/render_widget_host_impl.cc
+++ b/content/browser/renderer_host/render_widget_host_impl.cc
@@ -73,7 +73,6 @@
 #include "content/common/frame_messages.h"
 #include "content/common/input_messages.h"
 #include "content/common/view_messages.h"
-#include "content/common/visual_properties.h"
 #include "content/common/widget_messages.h"
 #include "content/public/browser/browser_context.h"
 #include "content/public/browser/browser_thread.h"
@@ -103,6 +102,7 @@
 #include "skia/ext/platform_canvas.h"
 #include "storage/browser/file_system/isolated_context.h"
 #include "third_party/blink/public/common/input/synthetic_web_input_event_builders.h"
+#include "third_party/blink/public/common/widget/visual_properties.h"
 #include "third_party/blink/public/mojom/page/drag.mojom.h"
 #include "ui/base/clipboard/clipboard_constants.h"
 #include "ui/base/ui_base_switches.h"
@@ -825,8 +825,8 @@
 }
 #endif
 
-VisualProperties RenderWidgetHostImpl::GetInitialVisualProperties() {
-  VisualProperties initial_props = GetVisualProperties();
+blink::VisualProperties RenderWidgetHostImpl::GetInitialVisualProperties() {
+  blink::VisualProperties initial_props = GetVisualProperties();
 
   // A RenderWidget being created in the renderer means the browser should
   // reset any state that may be set for the previous RenderWidget but which
@@ -836,7 +836,7 @@
   return initial_props;
 }
 
-VisualProperties RenderWidgetHostImpl::GetVisualProperties() {
+blink::VisualProperties RenderWidgetHostImpl::GetVisualProperties() {
   // This is only called while the RenderWidgetHost is attached to a delegate
   // still.
   DCHECK(delegate_);
@@ -850,7 +850,7 @@
   // frame.
   const bool is_frame_widget = owner_delegate_ || owned_by_render_frame_host_;
 
-  VisualProperties visual_properties;
+  blink::VisualProperties visual_properties;
 
   GetScreenInfo(&visual_properties.screen_info);
   // Note: Later in this method, ScreenInfo rects might be overridden!
@@ -1072,7 +1072,7 @@
     return false;
   }
 
-  auto visual_properties = std::make_unique<VisualProperties>();
+  auto visual_properties = std::make_unique<blink::VisualProperties>();
   *visual_properties = GetVisualProperties();
   if (!StoredVisualPropertiesNeedsUpdate(old_visual_properties_,
                                          *visual_properties))
@@ -1748,7 +1748,7 @@
   observers_.RemoveObserver(observer);
 }
 
-void RenderWidgetHostImpl::GetScreenInfo(ScreenInfo* result) {
+void RenderWidgetHostImpl::GetScreenInfo(blink::ScreenInfo* result) {
   TRACE_EVENT0("renderer_host", "RenderWidgetHostImpl::GetScreenInfo");
   if (view_)
     view_->GetScreenInfo(result);
@@ -1764,6 +1764,10 @@
     input_router_->SetDeviceScaleFactor(result->device_scale_factor);
 }
 
+float RenderWidgetHostImpl::GetDeviceScaleFactor() {
+  return GetScaleFactorForView(view_.get());
+}
+
 base::Optional<cc::TouchAction> RenderWidgetHostImpl::GetAllowedTouchAction() {
   return input_router_->AllowedTouchAction();
 }
@@ -2067,14 +2071,15 @@
 }
 
 void RenderWidgetHostImpl::ResetStateForCreatedRenderWidget(
-    const VisualProperties& initial_props) {
+    const blink::VisualProperties& initial_props) {
   // When the RenderWidget was destroyed, the ack may never come back. Don't
   // let that prevent us from speaking to the next RenderWidget.
   waiting_for_screen_rects_ack_ = false;
 
   visual_properties_ack_pending_ =
       DoesVisualPropertiesNeedAck(nullptr, initial_props);
-  old_visual_properties_ = std::make_unique<VisualProperties>(initial_props);
+  old_visual_properties_ =
+      std::make_unique<blink::VisualProperties>(initial_props);
 
   // Reconstruct the input router to ensure that it has fresh state for a new
   // RenderWidget. Otherwise it may be stuck waiting for the old renderer to ack
@@ -2424,8 +2429,8 @@
 
 // static
 bool RenderWidgetHostImpl::DidVisualPropertiesSizeChange(
-    const VisualProperties& old_visual_properties,
-    const VisualProperties& new_visual_properties) {
+    const blink::VisualProperties& old_visual_properties,
+    const blink::VisualProperties& new_visual_properties) {
   return old_visual_properties.auto_resize_enabled !=
              new_visual_properties.auto_resize_enabled ||
          (old_visual_properties.auto_resize_enabled &&
@@ -2441,8 +2446,8 @@
 
 // static
 bool RenderWidgetHostImpl::DoesVisualPropertiesNeedAck(
-    const std::unique_ptr<VisualProperties>& old_visual_properties,
-    const VisualProperties& new_visual_properties) {
+    const std::unique_ptr<blink::VisualProperties>& old_visual_properties,
+    const blink::VisualProperties& new_visual_properties) {
   // We should throttle sending updated VisualProperties to the renderer to
   // the rate of commit. This ensures we don't overwhelm the renderer with
   // visual updates faster than it can keep up.  |needs_ack| corresponds to
@@ -2465,8 +2470,8 @@
 
 // static
 bool RenderWidgetHostImpl::StoredVisualPropertiesNeedsUpdate(
-    const std::unique_ptr<VisualProperties>& old_visual_properties,
-    const VisualProperties& new_visual_properties) {
+    const std::unique_ptr<blink::VisualProperties>& old_visual_properties,
+    const blink::VisualProperties& new_visual_properties) {
   if (!old_visual_properties)
     return true;
 
diff --git a/content/browser/renderer_host/render_widget_host_impl.h b/content/browser/renderer_host/render_widget_host_impl.h
index a5d2634..37e7c602 100644
--- a/content/browser/renderer_host/render_widget_host_impl.h
+++ b/content/browser/renderer_host/render_widget_host_impl.h
@@ -105,8 +105,6 @@
 class TimeoutMonitor;
 class TouchEmulator;
 class WebCursor;
-struct VisualProperties;
-struct ScreenInfo;
 
 // This implements the RenderWidgetHost interface that is exposed to
 // embedders of content, and adds things only visible to content.
@@ -223,7 +221,8 @@
       RenderWidgetHost::InputEventObserver* observer) override;
   void AddObserver(RenderWidgetHostObserver* observer) override;
   void RemoveObserver(RenderWidgetHostObserver* observer) override;
-  void GetScreenInfo(content::ScreenInfo* result) override;
+  void GetScreenInfo(blink::ScreenInfo* result) override;
+  float GetDeviceScaleFactor() override;
   base::Optional<cc::TouchAction> GetAllowedTouchAction() override;
   // |drop_data| must have been filtered. The embedder should call
   // FilterDropData before passing the drop data to RWHI.
@@ -636,7 +635,7 @@
   //
   // This has the side effect of resetting state that should match a newly
   // created RenderWidget in the renderer.
-  VisualProperties GetInitialVisualProperties();
+  blink::VisualProperties GetInitialVisualProperties();
 
   // Pushes updated visual properties to the renderer as well as whether the
   // focused node should be scrolled into view.
@@ -924,29 +923,30 @@
 
   // When the RenderWidget is destroyed and recreated, this resets states in the
   // browser to match the clean start for the renderer side.
-  void ResetStateForCreatedRenderWidget(const VisualProperties& initial_props);
+  void ResetStateForCreatedRenderWidget(
+      const blink::VisualProperties& initial_props);
 
   // Generates a filled in VisualProperties struct representing the current
   // properties of this widget.
-  VisualProperties GetVisualProperties();
+  blink::VisualProperties GetVisualProperties();
 
   // Returns true if the |new_visual_properties| differs from
   // |old_page_visual_properties| in a way that indicates a size changed.
   static bool DidVisualPropertiesSizeChange(
-      const VisualProperties& old_visual_properties,
-      const VisualProperties& new_visual_properties);
+      const blink::VisualProperties& old_visual_properties,
+      const blink::VisualProperties& new_visual_properties);
 
   // Returns true if the new visual properties requires an ack from a
   // synchronization message.
   static bool DoesVisualPropertiesNeedAck(
-      const std::unique_ptr<VisualProperties>& old_visual_properties,
-      const VisualProperties& new_visual_properties);
+      const std::unique_ptr<blink::VisualProperties>& old_visual_properties,
+      const blink::VisualProperties& new_visual_properties);
 
   // Returns true if |old_visual_properties| is out of sync with
   // |new_visual_properties|.
   static bool StoredVisualPropertiesNeedsUpdate(
-      const std::unique_ptr<VisualProperties>& old_visual_properties,
-      const VisualProperties& new_visual_properties);
+      const std::unique_ptr<blink::VisualProperties>& old_visual_properties,
+      const blink::VisualProperties& new_visual_properties);
 
   // Give key press listeners a chance to handle this key press. This allow
   // widgets that don't have focus to still handle key presses.
@@ -1106,7 +1106,7 @@
   bool visual_properties_ack_pending_ = false;
 
   // Visual properties that were most recently sent to the renderer.
-  std::unique_ptr<VisualProperties> old_visual_properties_;
+  std::unique_ptr<blink::VisualProperties> old_visual_properties_;
 
   // True if the render widget host should track the render widget's size as
   // opposed to visa versa.
diff --git a/content/browser/renderer_host/render_widget_host_input_event_router_unittest.cc b/content/browser/renderer_host/render_widget_host_input_event_router_unittest.cc
index 0eef81f..9a08214 100644
--- a/content/browser/renderer_host/render_widget_host_input_event_router_unittest.cc
+++ b/content/browser/renderer_host/render_widget_host_input_event_router_unittest.cc
@@ -74,7 +74,7 @@
     : public RenderWidgetHostViewChildFrame {
  public:
   explicit TestRenderWidgetHostViewChildFrame(RenderWidgetHost* widget)
-      : RenderWidgetHostViewChildFrame(widget, ScreenInfo()) {
+      : RenderWidgetHostViewChildFrame(widget, blink::ScreenInfo()) {
     Init();
   }
   ~TestRenderWidgetHostViewChildFrame() override = default;
diff --git a/content/browser/renderer_host/render_widget_host_owner_delegate.h b/content/browser/renderer_host/render_widget_host_owner_delegate.h
index fef5ef5..054f910 100644
--- a/content/browser/renderer_host/render_widget_host_owner_delegate.h
+++ b/content/browser/renderer_host/render_widget_host_owner_delegate.h
@@ -7,7 +7,7 @@
 
 #include "build/build_config.h"
 #include "content/common/content_export.h"
-#include "content/common/visual_properties.h"
+#include "third_party/blink/public/common/widget/visual_properties.h"
 
 namespace blink {
 class WebMouseEvent;
diff --git a/content/browser/renderer_host/render_widget_host_unittest.cc b/content/browser/renderer_host/render_widget_host_unittest.cc
index 816401b..24910364 100644
--- a/content/browser/renderer_host/render_widget_host_unittest.cc
+++ b/content/browser/renderer_host/render_widget_host_unittest.cc
@@ -38,7 +38,6 @@
 #include "content/common/content_constants_internal.h"
 #include "content/common/input_messages.h"
 #include "content/common/render_frame_metadata.mojom.h"
-#include "content/common/visual_properties.h"
 #include "content/common/widget_messages.h"
 #include "content/public/browser/keyboard_event_processing_result.h"
 #include "content/public/common/content_features.h"
@@ -56,6 +55,7 @@
 #include "testing/gtest/include/gtest/gtest.h"
 #include "third_party/blink/public/common/input/synthetic_web_input_event_builders.h"
 #include "third_party/blink/public/common/page/page_zoom.h"
+#include "third_party/blink/public/common/widget/visual_properties.h"
 #include "third_party/blink/public/mojom/input/input_handler.mojom-shared.h"
 #include "ui/display/screen.h"
 #include "ui/events/base_event_utils.h"
@@ -137,7 +137,7 @@
     local_surface_id_allocator_.GenerateId();
   }
 
-  void SetScreenInfo(const ScreenInfo& screen_info) {
+  void SetScreenInfo(const blink::ScreenInfo& screen_info) {
     if (screen_info_ == screen_info)
       return;
     screen_info_ = screen_info;
@@ -146,7 +146,7 @@
 
   void InvalidateLocalSurfaceId() { local_surface_id_allocator_.Invalidate(); }
 
-  void GetScreenInfo(ScreenInfo* screen_info) override {
+  void GetScreenInfo(blink::ScreenInfo* screen_info) override {
     *screen_info = screen_info_;
   }
 
@@ -234,7 +234,7 @@
   gfx::Size mock_compositor_viewport_pixel_size_;
   blink::mojom::InputEventResultState ack_result_;
   viz::ParentLocalSurfaceIdAllocator local_surface_id_allocator_;
-  ScreenInfo screen_info_;
+  blink::ScreenInfo screen_info_;
   gfx::Insets insets_;
 
  private:
@@ -482,8 +482,6 @@
     : public StubRenderWidgetHostOwnerDelegate {
  public:
   MOCK_METHOD1(SetBackgroundOpaque, void(bool opaque));
-  MOCK_METHOD1(UpdatePageVisualProperties,
-               void(const VisualProperties& visual_properties));
   MOCK_METHOD0(IsMainFrameActive, bool());
 };
 
@@ -951,7 +949,7 @@
 // Test that a resize event is sent if SynchronizeVisualProperties() is called
 // after a ScreenInfo change.
 TEST_F(RenderWidgetHostTest, ResizeScreenInfo) {
-  ScreenInfo screen_info;
+  blink::ScreenInfo screen_info;
   screen_info.device_scale_factor = 1.f;
   screen_info.rect = blink::WebRect(0, 0, 800, 600);
   screen_info.available_rect = blink::WebRect(0, 0, 800, 600);
@@ -1009,7 +1007,7 @@
   const gfx::Rect kScreenBounds(0, 0, 800, 600);
   const gfx::Rect kViewBounds(55, 66, 600, 500);
 
-  ScreenInfo screen_info;
+  blink::ScreenInfo screen_info;
   screen_info.device_scale_factor = 1.f;
   screen_info.rect = kScreenBounds;
   screen_info.available_rect = kScreenBounds;
@@ -1029,7 +1027,7 @@
   WidgetMsg_UpdateVisualProperties::Param param;
   ASSERT_TRUE(
       WidgetMsg_UpdateVisualProperties::Read(sink_->GetMessageAt(0), &param));
-  VisualProperties props = std::get<0>(param);
+  blink::VisualProperties props = std::get<0>(param);
   EXPECT_EQ(kScreenBounds, props.screen_info.rect);
   EXPECT_EQ(kScreenBounds, props.screen_info.available_rect);
 
@@ -1058,7 +1056,7 @@
 
 TEST_F(RenderWidgetHostTest, RootWindowSegments) {
   gfx::Rect screen_rect(0, 0, 800, 600);
-  ScreenInfo screen_info;
+  blink::ScreenInfo screen_info;
   screen_info.device_scale_factor = 1.f;
   screen_info.rect = screen_rect;
   screen_info.available_rect = screen_rect;
@@ -1184,7 +1182,7 @@
   host_->SetView(view_.get());
   // Make a new RenderWidget when the renderer is recreated and inform that a
   // RenderWidget is being created.
-  VisualProperties props = host_->GetInitialVisualProperties();
+  blink::VisualProperties props = host_->GetInitialVisualProperties();
   // The RenderWidget is recreated with the initial VisualProperties.
   ReinitalizeHost();
 
@@ -1210,7 +1208,7 @@
 
   // Make a new RenderWidget when the renderer is recreated and inform that a
   // RenderWidget is being created.
-  VisualProperties props = host_->GetInitialVisualProperties();
+  blink::VisualProperties props = host_->GetInitialVisualProperties();
   // The RenderWidget is recreated with the initial VisualProperties.
   EXPECT_CALL(mock_owner_delegate_, IsMainFrameActive())
       .WillRepeatedly(Return(true));
@@ -1835,7 +1833,7 @@
   host_->SetView(view_.get());
   // Make a new RenderWidget when the renderer is recreated and inform that a
   // RenderWidget is being created.
-  VisualProperties props = host_->GetInitialVisualProperties();
+  blink::VisualProperties props = host_->GetInitialVisualProperties();
   // The RenderWidget is recreated with the initial VisualProperties.
   ReinitalizeHost();
 
@@ -1864,7 +1862,7 @@
 
   // Make a new RenderWidget when the renderer is recreated and inform that a
   // RenderWidget is being created.
-  VisualProperties props = host_->GetInitialVisualProperties();
+  blink::VisualProperties props = host_->GetInitialVisualProperties();
   // The RenderWidget is recreated with the initial VisualProperties.
   EXPECT_CALL(mock_owner_delegate_, IsMainFrameActive())
       .WillRepeatedly(Return(true));
@@ -1904,7 +1902,7 @@
   host_->SetView(view_.get());
   // Make a new RenderWidget when the renderer is recreated and inform that a
   // RenderWidget is being created.
-  VisualProperties props = host_->GetInitialVisualProperties();
+  blink::VisualProperties props = host_->GetInitialVisualProperties();
   // The RenderWidget is recreated with the initial VisualProperties.
   ReinitalizeHost();
 
@@ -1941,7 +1939,7 @@
 
   // Make a new RenderWidget when the renderer is recreated and inform that a
   // RenderWidget is being created.
-  VisualProperties props = host_->GetInitialVisualProperties();
+  blink::VisualProperties props = host_->GetInitialVisualProperties();
   // The RenderWidget is recreated with the initial VisualProperties.
   EXPECT_CALL(mock_owner_delegate_, IsMainFrameActive())
       .WillRepeatedly(Return(true));
@@ -1973,7 +1971,7 @@
   view_->SetMockCompositorViewportPixelSize(
       compositor_viewport_pixel_rect.size());
 
-  VisualProperties visual_properties = host_->GetVisualProperties();
+  blink::VisualProperties visual_properties = host_->GetVisualProperties();
   EXPECT_EQ(bounds.size(), visual_properties.new_size);
   EXPECT_EQ(compositor_viewport_pixel_rect,
             visual_properties.compositor_viewport_pixel_rect);
@@ -2021,7 +2019,6 @@
   // with the reqiest to new up the RenderView and so subsequent
   // SynchronizeVisualProperties calls should not result in new IPC (unless the
   // size has actually changed).
-  EXPECT_CALL(mock_owner_delegate_, UpdatePageVisualProperties(_)).Times(0);
   EXPECT_FALSE(host_->SynchronizeVisualProperties());
   EXPECT_EQ(initial_size_, host_->old_visual_properties_->new_size);
   EXPECT_TRUE(host_->visual_properties_ack_pending_);
@@ -2038,7 +2035,7 @@
     ASSERT_EQ(WidgetMsg_UpdateVisualProperties::ID, msg->type());
     WidgetMsg_UpdateVisualProperties::Param params;
     WidgetMsg_UpdateVisualProperties::Read(msg, &params);
-    VisualProperties visual_properties = std::get<0>(params);
+    blink::VisualProperties visual_properties = std::get<0>(params);
     // Size sent to the renderer.
     EXPECT_EQ(gfx::Size(100, 100), visual_properties.new_size);
   }
diff --git a/content/browser/renderer_host/render_widget_host_view_android.cc b/content/browser/renderer_host/render_widget_host_view_android.cc
index d6bc68f9..3a7abe75 100644
--- a/content/browser/renderer_host/render_widget_host_view_android.cc
+++ b/content/browser/renderer_host/render_widget_host_view_android.cc
@@ -2317,7 +2317,8 @@
   return viz::ScopedSurfaceIdAllocator(std::move(allocation_task));
 }
 
-void RenderWidgetHostViewAndroid::GetScreenInfo(ScreenInfo* screen_info) {
+void RenderWidgetHostViewAndroid::GetScreenInfo(
+    blink::ScreenInfo* screen_info) {
   bool use_window_wide_color_gamut =
       GetContentClient()->browser()->GetWideColorGamutHeuristic() ==
       ContentBrowserClient::WideColorGamutHeuristic::kUseWindow;
diff --git a/content/browser/renderer_host/render_widget_host_view_android.h b/content/browser/renderer_host/render_widget_host_view_android.h
index 8b037dd8..ede0fee 100644
--- a/content/browser/renderer_host/render_widget_host_view_android.h
+++ b/content/browser/renderer_host/render_widget_host_view_android.h
@@ -176,7 +176,7 @@
   void DidNavigate() override;
   viz::ScopedSurfaceIdAllocator DidUpdateVisualProperties(
       const cc::RenderFrameMetadata& metadata) override;
-  void GetScreenInfo(ScreenInfo* screen_info) override;
+  void GetScreenInfo(blink::ScreenInfo* screen_info) override;
   std::vector<std::unique_ptr<ui::TouchEvent>> ExtractAndCancelActiveTouches()
       override;
   void TransferTouches(
diff --git a/content/browser/renderer_host/render_widget_host_view_aura_unittest.cc b/content/browser/renderer_host/render_widget_host_view_aura_unittest.cc
index ee8e690..8ef4ff1 100644
--- a/content/browser/renderer_host/render_widget_host_view_aura_unittest.cc
+++ b/content/browser/renderer_host/render_widget_host_view_aura_unittest.cc
@@ -2546,7 +2546,7 @@
     ASSERT_EQ(WidgetMsg_UpdateVisualProperties::ID, msg->type());
     WidgetMsg_UpdateVisualProperties::Param params;
     WidgetMsg_UpdateVisualProperties::Read(msg, &params);
-    VisualProperties visual_properties = std::get<0>(params);
+    blink::VisualProperties visual_properties = std::get<0>(params);
     // DIP size.
     EXPECT_EQ(gfx::Size(100, 100), visual_properties.new_size);
     // Physical pixel size.
@@ -2576,7 +2576,7 @@
     ASSERT_EQ(WidgetMsg_UpdateVisualProperties::ID, msg->type());
     WidgetMsg_UpdateVisualProperties::Param params;
     WidgetMsg_UpdateVisualProperties::Read(msg, &params);
-    VisualProperties visual_properties = std::get<0>(params);
+    blink::VisualProperties visual_properties = std::get<0>(params);
     // DIP size.
     EXPECT_EQ(gfx::Size(100, 100), visual_properties.new_size);
     // Physical pixel size.
@@ -2604,7 +2604,7 @@
     ASSERT_EQ(WidgetMsg_UpdateVisualProperties::ID, msg->type());
     WidgetMsg_UpdateVisualProperties::Param params;
     WidgetMsg_UpdateVisualProperties::Read(msg, &params);
-    VisualProperties visual_properties = std::get<0>(params);
+    blink::VisualProperties visual_properties = std::get<0>(params);
     // DIP size.
     EXPECT_EQ(gfx::Size(100, 100), visual_properties.new_size);
     // Physical pixel size.
@@ -2637,7 +2637,7 @@
     ASSERT_EQ(WidgetMsg_UpdateVisualProperties::ID, msg->type());
     WidgetMsg_UpdateVisualProperties::Param params;
     WidgetMsg_UpdateVisualProperties::Read(msg, &params);
-    VisualProperties visual_properties = std::get<0>(params);
+    blink::VisualProperties visual_properties = std::get<0>(params);
     // Auto resize parameters that we set above.
     EXPECT_EQ(gfx::Size(50, 50), visual_properties.min_size_for_auto_resize);
     EXPECT_EQ(gfx::Size(100, 100), visual_properties.max_size_for_auto_resize);
@@ -2681,7 +2681,7 @@
     ASSERT_TRUE(msg);
     WidgetMsg_UpdateVisualProperties::Param params;
     WidgetMsg_UpdateVisualProperties::Read(msg, &params);
-    VisualProperties visual_properties = std::get<0>(params);
+    blink::VisualProperties visual_properties = std::get<0>(params);
     // Auto resize parameters did not change as they DIP values.
     EXPECT_EQ(gfx::Size(50, 50), visual_properties.min_size_for_auto_resize);
     EXPECT_EQ(gfx::Size(100, 100), visual_properties.max_size_for_auto_resize);
@@ -2717,7 +2717,7 @@
     ASSERT_EQ(WidgetMsg_UpdateVisualProperties::ID, msg->type());
     WidgetMsg_UpdateVisualProperties::Param params;
     WidgetMsg_UpdateVisualProperties::Read(msg, &params);
-    VisualProperties visual_properties = std::get<0>(params);
+    blink::VisualProperties visual_properties = std::get<0>(params);
     // Auto-resizve limits sent to the renderer.
     EXPECT_EQ(gfx::Size(50, 50), visual_properties.min_size_for_auto_resize);
     EXPECT_EQ(gfx::Size(100, 100), visual_properties.max_size_for_auto_resize);
@@ -2757,7 +2757,7 @@
     ASSERT_EQ(WidgetMsg_UpdateVisualProperties::ID, msg->type());
     WidgetMsg_UpdateVisualProperties::Param params;
     WidgetMsg_UpdateVisualProperties::Read(msg, &params);
-    VisualProperties visual_properties = std::get<0>(params);
+    blink::VisualProperties visual_properties = std::get<0>(params);
     // Auto-resizve limits sent to the renderer.
     EXPECT_EQ(gfx::Size(50, 50), visual_properties.min_size_for_auto_resize);
     EXPECT_EQ(gfx::Size(100, 100), visual_properties.max_size_for_auto_resize);
@@ -3042,7 +3042,7 @@
     ASSERT_EQ(WidgetMsg_UpdateVisualProperties::ID, msg->type());
     WidgetMsg_UpdateVisualProperties::Param params;
     WidgetMsg_UpdateVisualProperties::Read(msg, &params);
-    VisualProperties visual_properties = std::get<0>(params);
+    blink::VisualProperties visual_properties = std::get<0>(params);
     // Empty size is sent.
     EXPECT_EQ(gfx::Size(), visual_properties.new_size);
     // A LocalSurfaceIdAllocation is sent too.
@@ -3414,7 +3414,7 @@
     ASSERT_EQ(WidgetMsg_UpdateVisualProperties::ID, msg->type());
     WidgetMsg_UpdateVisualProperties::Param params;
     WidgetMsg_UpdateVisualProperties::Read(msg, &params);
-    VisualProperties visual_properties = std::get<0>(params);
+    blink::VisualProperties visual_properties = std::get<0>(params);
     EXPECT_EQ(gfx::Size(100, 100), visual_properties.new_size);
     EXPECT_EQ(gfx::Size(100, 100), visual_properties.visible_viewport_size);
   }
@@ -3438,7 +3438,7 @@
     ASSERT_EQ(WidgetMsg_UpdateVisualProperties::ID, msg->type());
     WidgetMsg_UpdateVisualProperties::Param params;
     WidgetMsg_UpdateVisualProperties::Read(msg, &params);
-    VisualProperties visual_properties = std::get<0>(params);
+    blink::VisualProperties visual_properties = std::get<0>(params);
     EXPECT_EQ(gfx::Size(100, 100), visual_properties.new_size);
     EXPECT_EQ(gfx::Size(100, 60), visual_properties.visible_viewport_size);
   }
diff --git a/content/browser/renderer_host/render_widget_host_view_base.cc b/content/browser/renderer_host/render_widget_host_view_base.cc
index 85b265f..4482c6d 100644
--- a/content/browser/renderer_host/render_widget_host_view_base.cc
+++ b/content/browser/renderer_host/render_widget_host_view_base.cc
@@ -555,12 +555,12 @@
   return weak_factory_.GetWeakPtr();
 }
 
-void RenderWidgetHostViewBase::GetScreenInfo(ScreenInfo* screen_info) {
+void RenderWidgetHostViewBase::GetScreenInfo(blink::ScreenInfo* screen_info) {
   DisplayUtil::GetNativeViewScreenInfo(screen_info, GetNativeView());
 }
 
 float RenderWidgetHostViewBase::GetDeviceScaleFactor() {
-  ScreenInfo screen_info;
+  blink::ScreenInfo screen_info;
   GetScreenInfo(&screen_info);
   return screen_info.device_scale_factor;
 }
diff --git a/content/browser/renderer_host/render_widget_host_view_base.h b/content/browser/renderer_host/render_widget_host_view_base.h
index 6a17e52..11ff9718 100644
--- a/content/browser/renderer_host/render_widget_host_view_base.h
+++ b/content/browser/renderer_host/render_widget_host_view_base.h
@@ -29,7 +29,6 @@
 #include "content/common/content_to_visible_time_reporter.h"
 #include "content/public/browser/render_frame_metadata_provider.h"
 #include "content/public/browser/render_widget_host_view.h"
-#include "content/public/common/screen_info.h"
 #include "content/public/common/widget_type.h"
 #include "services/viz/public/mojom/hit_test/hit_test_region_list.mojom.h"
 #include "third_party/blink/public/mojom/frame/intrinsic_sizing_info.mojom-forward.h"
@@ -111,7 +110,7 @@
       base::OnceCallback<void(const SkBitmap&)> callback) override;
   std::unique_ptr<viz::ClientFrameSinkVideoCapturer> CreateVideoCapturer()
       override;
-  void GetScreenInfo(ScreenInfo* screen_info) override;
+  void GetScreenInfo(blink::ScreenInfo* screen_info) override;
   void EnableAutoResize(const gfx::Size& min_size,
                         const gfx::Size& max_size) override;
   void DisableAutoResize(const gfx::Size& new_size) override;
diff --git a/content/browser/renderer_host/render_widget_host_view_child_frame.cc b/content/browser/renderer_host/render_widget_host_view_child_frame.cc
index 87ab7cc..fa64873 100644
--- a/content/browser/renderer_host/render_widget_host_view_child_frame.cc
+++ b/content/browser/renderer_host/render_widget_host_view_child_frame.cc
@@ -48,7 +48,7 @@
 // static
 RenderWidgetHostViewChildFrame* RenderWidgetHostViewChildFrame::Create(
     RenderWidgetHost* widget,
-    const ScreenInfo& screen_info) {
+    const blink::ScreenInfo& screen_info) {
   RenderWidgetHostViewChildFrame* view =
       new RenderWidgetHostViewChildFrame(widget, screen_info);
   view->Init();
@@ -57,7 +57,7 @@
 
 RenderWidgetHostViewChildFrame::RenderWidgetHostViewChildFrame(
     RenderWidgetHost* widget_host,
-    const ScreenInfo& screen_info)
+    const blink::ScreenInfo& screen_info)
     : RenderWidgetHostViewBase(widget_host),
       frame_sink_id_(
           base::checked_cast<uint32_t>(widget_host->GetProcess()->GetID()),
@@ -768,7 +768,7 @@
   if (src_subrect.IsEmpty()) {
     request->set_area(gfx::Rect(GetCompositorViewportPixelSize()));
   } else {
-    ScreenInfo screen_info;
+    blink::ScreenInfo screen_info;
     GetScreenInfo(&screen_info);
     // |src_subrect| is in DIP coordinates; convert to Surface coordinates.
     request->set_area(
@@ -892,7 +892,8 @@
       BrowserAccessibilityManager::GetEmptyDocument(), delegate);
 }
 
-void RenderWidgetHostViewChildFrame::GetScreenInfo(ScreenInfo* screen_info) {
+void RenderWidgetHostViewChildFrame::GetScreenInfo(
+    blink::ScreenInfo* screen_info) {
   if (frame_connector_)
     screen_info_ = frame_connector_->screen_info();
   *screen_info = screen_info_;
diff --git a/content/browser/renderer_host/render_widget_host_view_child_frame.h b/content/browser/renderer_host/render_widget_host_view_child_frame.h
index 88709bc5..aa45039 100644
--- a/content/browser/renderer_host/render_widget_host_view_child_frame.h
+++ b/content/browser/renderer_host/render_widget_host_view_child_frame.h
@@ -52,8 +52,9 @@
       public TouchSelectionControllerClientManager::Observer,
       public viz::HostFrameSinkClient {
  public:
-  static RenderWidgetHostViewChildFrame* Create(RenderWidgetHost* widget,
-                                                const ScreenInfo& screen_info);
+  static RenderWidgetHostViewChildFrame* Create(
+      RenderWidgetHost* widget,
+      const blink::ScreenInfo& screen_info);
   ~RenderWidgetHostViewChildFrame() override;
 
   void SetFrameConnectorDelegate(FrameConnectorDelegate* frame_connector);
@@ -155,7 +156,7 @@
   BrowserAccessibilityManager* CreateBrowserAccessibilityManager(
       BrowserAccessibilityDelegate* delegate,
       bool for_root_frame) override;
-  void GetScreenInfo(ScreenInfo* screen_info) override;
+  void GetScreenInfo(blink::ScreenInfo* screen_info) override;
   void EnableAutoResize(const gfx::Size& min_size,
                         const gfx::Size& max_size) override;
   void DisableAutoResize(const gfx::Size& new_size) override;
@@ -198,7 +199,7 @@
                            ForwardsBeginFrameAcks);
 
   explicit RenderWidgetHostViewChildFrame(RenderWidgetHost* widget,
-                                          const ScreenInfo& screen_info);
+                                          const blink::ScreenInfo& screen_info);
   void Init();
 
   // Sets |parent_frame_sink_id_| and registers frame sink hierarchy. If the
@@ -280,7 +281,7 @@
   // created, to be used before this view is connected to its FrameDelegate.
   // This is kept up to date anytime GetScreenInfo() is called and we have
   // a FrameDelegate.
-  ScreenInfo screen_info_;
+  blink::ScreenInfo screen_info_;
 
   base::WeakPtrFactory<RenderWidgetHostViewChildFrame> weak_factory_{this};
   DISALLOW_COPY_AND_ASSIGN(RenderWidgetHostViewChildFrame);
diff --git a/content/browser/renderer_host/render_widget_host_view_child_frame_browsertest.cc b/content/browser/renderer_host/render_widget_host_view_child_frame_browsertest.cc
index 4a537c1..858d0d8a 100644
--- a/content/browser/renderer_host/render_widget_host_view_child_frame_browsertest.cc
+++ b/content/browser/renderer_host/render_widget_host_view_child_frame_browsertest.cc
@@ -167,7 +167,7 @@
   OutgoingVisualPropertiesIPCWatcher(
       RenderProcessHostImpl* rph,
       FrameTreeNode* root,
-      base::RepeatingCallback<void(const VisualProperties&)> callback)
+      base::RepeatingCallback<void(const blink::VisualProperties&)> callback)
       : rph_(rph), root_(root), callback_(std::move(callback)) {
     rph_->SetIpcSendWatcherForTesting(
         base::BindRepeating(&OutgoingVisualPropertiesIPCWatcher::OnMessage,
@@ -197,11 +197,13 @@
     IPC_END_MESSAGE_MAP()
   }
 
-  void ProcessMessage(const VisualProperties& props) { callback_.Run(props); }
+  void ProcessMessage(const blink::VisualProperties& props) {
+    callback_.Run(props);
+  }
 
   RenderProcessHostImpl* const rph_;
   FrameTreeNode* const root_;
-  base::RepeatingCallback<void(const VisualProperties&)> callback_;
+  base::RepeatingCallback<void(const blink::VisualProperties&)> callback_;
 };
 
 // Auto-resize is only implemented for Ash and GuestViews. So we need to inject
@@ -275,7 +277,7 @@
     gfx::Size child_visible_viewport_size;
     OutgoingVisualPropertiesIPCWatcher child_watcher(
         child_rph, root,
-        base::BindLambdaForTesting([&](const VisualProperties& props) {
+        base::BindLambdaForTesting([&](const blink::VisualProperties& props) {
           child_visible_viewport_size = props.visible_viewport_size;
 
           if (child_visible_viewport_size == initial_size)
@@ -300,7 +302,7 @@
     gfx::Size child_visible_viewport_size;
     OutgoingVisualPropertiesIPCWatcher child_watcher(
         nested_child_rph, nested_root,
-        base::BindLambdaForTesting([&](const VisualProperties& props) {
+        base::BindLambdaForTesting([&](const blink::VisualProperties& props) {
           child_visible_viewport_size = props.visible_viewport_size;
 
           if (child_visible_viewport_size == nested_initial_size)
@@ -340,12 +342,12 @@
     gfx::Size child_visible_viewport_size;
     OutgoingVisualPropertiesIPCWatcher root_watcher(
         root_rph, root,
-        base::BindLambdaForTesting([&](const VisualProperties& props) {
+        base::BindLambdaForTesting([&](const blink::VisualProperties& props) {
           root_visible_viewport_size = props.visible_viewport_size;
         }));
     OutgoingVisualPropertiesIPCWatcher child_watcher(
         child_rph, root,
-        base::BindLambdaForTesting([&](const VisualProperties& props) {
+        base::BindLambdaForTesting([&](const blink::VisualProperties& props) {
           child_visible_viewport_size = props.visible_viewport_size;
 
           if (child_visible_viewport_size == resize_to)
@@ -377,12 +379,12 @@
     gfx::Size child_visible_viewport_size;
     OutgoingVisualPropertiesIPCWatcher root_watcher(
         nested_root_rph, nested_root,
-        base::BindLambdaForTesting([&](const VisualProperties& props) {
+        base::BindLambdaForTesting([&](const blink::VisualProperties& props) {
           root_visible_viewport_size = props.visible_viewport_size;
         }));
     OutgoingVisualPropertiesIPCWatcher child_watcher(
         nested_child_rph, nested_root,
-        base::BindLambdaForTesting([&](const VisualProperties& props) {
+        base::BindLambdaForTesting([&](const blink::VisualProperties& props) {
           child_visible_viewport_size = props.visible_viewport_size;
 
           if (child_visible_viewport_size == resize_to)
@@ -419,17 +421,16 @@
     base::RunLoop loop;
 
     const gfx::Size auto_resize_to(105, 100);
-
     gfx::Size root_visible_viewport_size;
     gfx::Size child_visible_viewport_size;
     OutgoingVisualPropertiesIPCWatcher root_watcher(
         root_rph, root,
-        base::BindLambdaForTesting([&](const VisualProperties& props) {
+        base::BindLambdaForTesting([&](const blink::VisualProperties& props) {
           root_visible_viewport_size = props.visible_viewport_size;
         }));
     OutgoingVisualPropertiesIPCWatcher child_watcher(
         child_rph, root,
-        base::BindLambdaForTesting([&](const VisualProperties& props) {
+        base::BindLambdaForTesting([&](const blink::VisualProperties& props) {
           child_visible_viewport_size = props.visible_viewport_size;
 
           if (child_visible_viewport_size == auto_resize_to)
@@ -641,14 +642,14 @@
     std::vector<gfx::Rect> oopchild_root_window_segments;
     OutgoingVisualPropertiesIPCWatcher oopchild_watcher(
         oopchild_rph, root,
-        base::BindLambdaForTesting([&](const VisualProperties& props) {
+        base::BindLambdaForTesting([&](const blink::VisualProperties& props) {
           oopchild_root_window_segments = props.root_widget_window_segments;
         }));
 
     std::vector<gfx::Rect> oopdescendant_root_window_segments;
     OutgoingVisualPropertiesIPCWatcher oopdescendant_watcher(
         oopdescendant_rph, root,
-        base::BindLambdaForTesting([&](const VisualProperties& props) {
+        base::BindLambdaForTesting([&](const blink::VisualProperties& props) {
           oopdescendant_root_window_segments =
               props.root_widget_window_segments;
           if (oopdescendant_root_window_segments == expected_segments)
@@ -672,7 +673,7 @@
     std::vector<gfx::Rect> new_frame_root_window_segments;
     OutgoingVisualPropertiesIPCWatcher oopdescendant_watcher(
         oopdescendant_rph, root,
-        base::BindLambdaForTesting([&](const VisualProperties& props) {
+        base::BindLambdaForTesting([&](const blink::VisualProperties& props) {
           new_frame_root_window_segments = props.root_widget_window_segments;
           // This check is needed, since we'll get an IPC originating from
           // RenderWidgetHostImpl immediately after the frame is added with the
diff --git a/content/browser/renderer_host/render_widget_host_view_child_frame_unittest.cc b/content/browser/renderer_host/render_widget_host_view_child_frame_unittest.cc
index 1038435..c7385554 100644
--- a/content/browser/renderer_host/render_widget_host_view_child_frame_unittest.cc
+++ b/content/browser/renderer_host/render_widget_host_view_child_frame_unittest.cc
@@ -140,11 +140,11 @@
         frame_widget_host.BindNewEndpointAndPassDedicatedReceiverForTesting(),
         frame_widget.Unbind());
 
-    ScreenInfo screen_info;
+    blink::ScreenInfo screen_info;
     screen_info.rect = gfx::Rect(1, 2, 3, 4);
     view_ = RenderWidgetHostViewChildFrame::Create(widget_host_, screen_info);
     // Test we get the expected ScreenInfo before the FrameDelegate is set.
-    ScreenInfo actual_screen_info;
+    blink::ScreenInfo actual_screen_info;
     view_->GetScreenInfo(&actual_screen_info);
     EXPECT_EQ(screen_info, actual_screen_info);
 
@@ -257,7 +257,7 @@
 // Tests that moving the child around does not affect the physical backing size.
 TEST_F(RenderWidgetHostViewChildFrameZoomForDSFTest,
        CompositorViewportPixelSize) {
-  ScreenInfo screen_info;
+  blink::ScreenInfo screen_info;
   screen_info.device_scale_factor = 2.0f;
   test_frame_connector_->SetScreenInfoForTesting(screen_info);
 
@@ -311,7 +311,7 @@
     ASSERT_EQ(WidgetMsg_UpdateVisualProperties::ID, msg->type());
     WidgetMsg_UpdateVisualProperties::Param params;
     WidgetMsg_UpdateVisualProperties::Read(msg, &params);
-    VisualProperties sent_visual_properties = std::get<0>(params);
+    blink::VisualProperties sent_visual_properties = std::get<0>(params);
 
     EXPECT_EQ(compositor_viewport_pixel_rect,
               sent_visual_properties.compositor_viewport_pixel_rect);
diff --git a/content/browser/renderer_host/render_widget_host_view_mac.h b/content/browser/renderer_host/render_widget_host_view_mac.h
index d5610b3..90f5455 100644
--- a/content/browser/renderer_host/render_widget_host_view_mac.h
+++ b/content/browser/renderer_host/render_widget_host_view_mac.h
@@ -115,7 +115,7 @@
   void SetActive(bool active) override;
   void ShowDefinitionForSelection() override;
   void SpeakSelection() override;
-  void GetScreenInfo(ScreenInfo* screen_info) override;
+  void GetScreenInfo(blink::ScreenInfo* screen_info) override;
   void TakeFallbackContentFrom(RenderWidgetHostView* view) override;
 
   // Implementation of RenderWidgetHostViewBase.
diff --git a/content/browser/renderer_host/render_widget_host_view_mac.mm b/content/browser/renderer_host/render_widget_host_view_mac.mm
index bca6e5fe..ed223cd 100644
--- a/content/browser/renderer_host/render_widget_host_view_mac.mm
+++ b/content/browser/renderer_host/render_widget_host_view_mac.mm
@@ -422,7 +422,7 @@
   }
 }
 
-void RenderWidgetHostViewMac::GetScreenInfo(ScreenInfo* screen_info) {
+void RenderWidgetHostViewMac::GetScreenInfo(blink::ScreenInfo* screen_info) {
   browser_compositor_->GetRendererScreenInfo(screen_info);
 }
 
diff --git a/content/browser/screen_orientation/screen_orientation_browsertest.cc b/content/browser/screen_orientation/screen_orientation_browsertest.cc
index 21b8eec..9aa95a4 100644
--- a/content/browser/screen_orientation/screen_orientation_browsertest.cc
+++ b/content/browser/screen_orientation/screen_orientation_browsertest.cc
@@ -59,11 +59,6 @@
     }
     ASSERT_NE(blink::mojom::ScreenOrientation::kUndefined, type);
 
-    ScreenInfo screen_info;
-    main_frame_rwh->GetScreenInfo(&screen_info);
-    screen_info.orientation_angle = angle;
-    screen_info.orientation_type = type;
-
     std::set<RenderWidgetHost*> rwhs;
     for (RenderFrameHost* rfh : web_contents()->GetAllFrames()) {
       if (rfh == web_contents()->GetMainFrame())
@@ -360,7 +355,7 @@
   // Set up a fake Resize message with a screen orientation change.
   RenderWidgetHost* main_frame_rwh =
       web_contents()->GetMainFrame()->GetRenderWidgetHost();
-  ScreenInfo screen_info;
+  blink::ScreenInfo screen_info;
   main_frame_rwh->GetScreenInfo(&screen_info);
   int expected_angle = (screen_info.orientation_angle + 90) % 360;
 
diff --git a/content/browser/screen_orientation/screen_orientation_provider.cc b/content/browser/screen_orientation/screen_orientation_provider.cc
index f0e8bd63..4a66e0ba 100644
--- a/content/browser/screen_orientation/screen_orientation_provider.cc
+++ b/content/browser/screen_orientation/screen_orientation_provider.cc
@@ -153,7 +153,7 @@
   if (!rwh)
     return device::mojom::ScreenOrientationLockType::DEFAULT;
 
-  ScreenInfo screen_info;
+  blink::ScreenInfo screen_info;
   rwh->GetScreenInfo(&screen_info);
 
   switch (screen_info.orientation_type) {
@@ -185,7 +185,7 @@
   if (!rwh)
     return false;
 
-  ScreenInfo screen_info;
+  blink::ScreenInfo screen_info;
   rwh->GetScreenInfo(&screen_info);
 
   switch (lock) {
diff --git a/content/browser/site_per_process_browsertest.cc b/content/browser/site_per_process_browsertest.cc
index 0f0b4a5..1b77750 100644
--- a/content/browser/site_per_process_browsertest.cc
+++ b/content/browser/site_per_process_browsertest.cc
@@ -12216,7 +12216,7 @@
   // +4 for a 2px border on each iframe.
   gfx::PointF expected(iframe_b_offset_left + iframe_c_offset_left + 4,
                        iframe_b_offset_top + iframe_c_offset_top + 4);
-  ScreenInfo screen_info;
+  blink::ScreenInfo screen_info;
   root->render_manager()->GetRenderWidgetHostView()->GetScreenInfo(
       &screen_info);
   // Convert from CSS to physical pixels
@@ -15646,7 +15646,7 @@
   ASSERT_TRUE(b2_to_c2_message_filter->MessageReceived());
 
   // Window scroll offset will be scaled by device scale factor
-  ScreenInfo screen_info;
+  blink::ScreenInfo screen_info;
   a_node->render_manager()->GetRenderWidgetHostView()->GetScreenInfo(
       &screen_info);
   int expected_y = roundf(screen_info.device_scale_factor * 5.0);
diff --git a/content/browser/site_per_process_hit_test_browsertest.cc b/content/browser/site_per_process_hit_test_browsertest.cc
index b395790..77313e47 100644
--- a/content/browser/site_per_process_hit_test_browsertest.cc
+++ b/content/browser/site_per_process_hit_test_browsertest.cc
@@ -35,7 +35,6 @@
 #include "content/public/browser/context_menu_params.h"
 #include "content/public/common/content_features.h"
 #include "content/public/common/content_switches.h"
-#include "content/public/common/screen_info.h"
 #include "content/public/common/use_zoom_for_dsf_policy.h"
 #include "content/public/common/web_preferences.h"
 #include "content/public/test/browser_test.h"
@@ -671,7 +670,7 @@
 };
 
 #if !defined(OS_MACOSX) && !defined(OS_ANDROID)
-bool IsScreenTooSmallForPopup(const ScreenInfo& screen_info) {
+bool IsScreenTooSmallForPopup(const blink::ScreenInfo& screen_info) {
   // Small display size will cause popup positions to be adjusted,
   // causing test failures.
   //
@@ -5750,7 +5749,7 @@
   SetWebEventPositions(&click_event, gfx::Point(1, 1), rwhv_root);
   rwhv_child->ProcessMouseEvent(click_event, ui::LatencyInfo());
 
-  ScreenInfo screen_info;
+  blink::ScreenInfo screen_info;
   shell()->web_contents()->GetRenderWidgetHostView()->GetScreenInfo(
       &screen_info);
 
@@ -5897,7 +5896,7 @@
   EXPECT_EQ(popup_rect.x(), 9);
   EXPECT_EQ(popup_rect.y(), 9);
 #else
-  ScreenInfo screen_info;
+  blink::ScreenInfo screen_info;
   shell()->web_contents()->GetRenderWidgetHostView()->GetScreenInfo(
       &screen_info);
   if (!IsScreenTooSmallForPopup(screen_info)) {
diff --git a/content/browser/web_contents/web_contents_view_child_frame.cc b/content/browser/web_contents/web_contents_view_child_frame.cc
index 0a0f015..ac8d6b0 100644
--- a/content/browser/web_contents/web_contents_view_child_frame.cc
+++ b/content/browser/web_contents/web_contents_view_child_frame.cc
@@ -79,7 +79,7 @@
 
 RenderWidgetHostViewBase* WebContentsViewChildFrame::CreateViewForWidget(
     RenderWidgetHost* render_widget_host) {
-  ScreenInfo screen_info;
+  blink::ScreenInfo screen_info;
   if (auto* view = web_contents_->GetRenderWidgetHostView())
     view->GetScreenInfo(&screen_info);
   else
diff --git a/content/common/BUILD.gn b/content/common/BUILD.gn
index 0511ba0..6cf30bf 100644
--- a/content/common/BUILD.gn
+++ b/content/common/BUILD.gn
@@ -195,8 +195,6 @@
     "url_schemes.h",
     "user_agent.cc",
     "view_messages.h",
-    "visual_properties.cc",
-    "visual_properties.h",
     "web_package/signed_exchange_utils.cc",
     "web_package/signed_exchange_utils.h",
     "widget_messages.h",
@@ -577,7 +575,7 @@
         },
         {
           mojom = "content.mojom.VisualProperties"
-          cpp = "::content::VisualProperties"
+          cpp = "::blink::VisualProperties"
         },
         {
           mojom = "content.mojom.WebCursor"
@@ -598,7 +596,7 @@
         "//content/common/input/synthetic_smooth_drag_gesture_params.h",
         "//content/common/input/synthetic_smooth_scroll_gesture_params.h",
         "//content/common/input/synthetic_tap_gesture_params.h",
-        "//content/common/visual_properties.h",
+        "//third_party/blink/public/common/widget/visual_properties.h",
         "//content/public/common/web_preferences.h",
         "//net/base/network_change_notifier.h",
         "//third_party/blink/public/common/input/web_coalesced_input_event_mojom_traits.h",
diff --git a/content/common/DEPS b/content/common/DEPS
index 28a4c00..f80aac4 100644
--- a/content/common/DEPS
+++ b/content/common/DEPS
@@ -30,7 +30,7 @@
   "+third_party/blink/public/platform/web_http_body.h",
   "+third_party/blink/public/platform/web_history_scroll_restoration_type.h",
   "+third_party/blink/public/platform/web_mixed_content_context_type.h",
-  "+third_party/blink/public/platform/web_screen_info.h",
+  "+third_party/blink/public/common/widget/screen_info.h",
   "+third_party/blink/public/platform/web_storage_area.h",
   "+third_party/blink/public/platform/web_text_autosizer_page_info.h",
   "+third_party/blink/public/platform/linux/web_fallback_font.h",
diff --git a/content/common/common_param_traits_macros.h b/content/common/common_param_traits_macros.h
index 93b42b6..e9c42b31 100644
--- a/content/common/common_param_traits_macros.h
+++ b/content/common/common_param_traits_macros.h
@@ -10,9 +10,9 @@
 
 #include "cc/trees/browser_controls_params.h"
 #include "content/common/frame_messages.h"
-#include "content/common/visual_properties.h"
 #include "ipc/ipc_message_macros.h"
 #include "services/device/public/mojom/screen_orientation_lock_types.mojom-shared.h"
+#include "third_party/blink/public/common/widget/visual_properties.h"
 #include "third_party/blink/public/web/web_device_emulation_params.h"
 
 #undef IPC_MESSAGE_EXPORT
@@ -40,7 +40,7 @@
   IPC_STRUCT_TRAITS_MEMBER(browser_controls_shrink_blink_size)
 IPC_STRUCT_TRAITS_END()
 
-IPC_STRUCT_TRAITS_BEGIN(content::VisualProperties)
+IPC_STRUCT_TRAITS_BEGIN(blink::VisualProperties)
   IPC_STRUCT_TRAITS_MEMBER(screen_info)
   IPC_STRUCT_TRAITS_MEMBER(auto_resize_enabled)
   IPC_STRUCT_TRAITS_MEMBER(min_size_for_auto_resize)
diff --git a/content/common/frame_messages.h b/content/common/frame_messages.h
index 391b67f5..e5632a9 100644
--- a/content/common/frame_messages.h
+++ b/content/common/frame_messages.h
@@ -36,7 +36,6 @@
 #include "content/public/common/page_state.h"
 #include "content/public/common/previews_state.h"
 #include "content/public/common/referrer.h"
-#include "content/public/common/screen_info.h"
 #include "content/public/common/stop_find_action.h"
 #include "content/public/common/three_d_api_types.h"
 #include "content/public/common/untrustworthy_context_menu_params.h"
@@ -245,7 +244,7 @@
   IPC_STRUCT_TRAITS_MEMBER(contents_mime_type)
 IPC_STRUCT_TRAITS_END()
 
-IPC_STRUCT_TRAITS_BEGIN(content::ScreenInfo)
+IPC_STRUCT_TRAITS_BEGIN(blink::ScreenInfo)
   IPC_STRUCT_TRAITS_MEMBER(device_scale_factor)
   IPC_STRUCT_TRAITS_MEMBER(color_space)
   IPC_STRUCT_TRAITS_MEMBER(depth)
diff --git a/content/common/frame_visual_properties.h b/content/common/frame_visual_properties.h
index fc6c7ed..c59e2e5e7 100644
--- a/content/common/frame_visual_properties.h
+++ b/content/common/frame_visual_properties.h
@@ -9,7 +9,7 @@
 #include "base/time/time.h"
 #include "components/viz/common/surfaces/local_surface_id_allocation.h"
 #include "content/common/content_export.h"
-#include "content/public/common/screen_info.h"
+#include "third_party/blink/public/common/widget/screen_info.h"
 #include "ui/gfx/geometry/size.h"
 
 namespace content {
@@ -28,7 +28,7 @@
   // renderer process up to the RenderWidgetHost for a child RenderWidget in
   // another renderer process. That RenderWidgetHost would then be responsible
   // for passing it along to the child RenderWidget.
-  ScreenInfo screen_info;
+  blink::ScreenInfo screen_info;
   bool auto_resize_enabled = false;
   bool is_pinch_gesture_active = false;
   uint32_t capture_sequence_number = 0u;
diff --git a/content/common/page_messages.h b/content/common/page_messages.h
index ad73d34..599697f8 100644
--- a/content/common/page_messages.h
+++ b/content/common/page_messages.h
@@ -7,7 +7,6 @@
 
 #include "content/public/common/common_param_traits.h"
 #include "content/public/common/page_visibility_state.h"
-#include "content/public/common/screen_info.h"
 #include "ipc/ipc_message_macros.h"
 #include "third_party/blink/public/platform/web_text_autosizer_page_info.h"
 #include "ui/gfx/geometry/rect.h"
diff --git a/content/common/visual_properties.cc b/content/common/visual_properties.cc
deleted file mode 100644
index 34c16c3..0000000
--- a/content/common/visual_properties.cc
+++ /dev/null
@@ -1,18 +0,0 @@
-// Copyright 2015 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "content/common/visual_properties.h"
-
-namespace content {
-
-VisualProperties::VisualProperties() = default;
-
-VisualProperties::VisualProperties(const VisualProperties& other) = default;
-
-VisualProperties::~VisualProperties() = default;
-
-VisualProperties& VisualProperties::operator=(const VisualProperties& other) =
-    default;
-
-}  // namespace content
diff --git a/content/common/widget_messages.h b/content/common/widget_messages.h
index fa5f9cd8..80b86994 100644
--- a/content/common/widget_messages.h
+++ b/content/common/widget_messages.h
@@ -13,9 +13,9 @@
 #include "content/common/common_param_traits_macros.h"
 #include "content/common/content_param_traits.h"
 #include "content/common/content_to_visible_time_reporter.h"
-#include "content/common/visual_properties.h"
 #include "content/public/common/common_param_traits.h"
 #include "ipc/ipc_message_macros.h"
+#include "third_party/blink/public/common/widget/visual_properties.h"
 #include "third_party/blink/public/platform/viewport_intersection_state.h"
 #include "third_party/blink/public/platform/web_float_rect.h"
 #include "ui/base/ime/text_input_action.h"
@@ -97,7 +97,7 @@
 // Updates a RenderWidget's visual properties. This should include all
 // geometries and compositing inputs so that they are updated atomically.
 IPC_MESSAGE_ROUTED1(WidgetMsg_UpdateVisualProperties,
-                    content::VisualProperties /* visual_properties */)
+                    blink::VisualProperties /* visual_properties */)
 
 // Informs the RenderWidget of its position on the user's screen, as well as
 // the position of the native window holding the RenderWidget.
diff --git a/content/public/browser/render_widget_host.h b/content/public/browser/render_widget_host.h
index d930028..7b0917c1c 100644
--- a/content/public/browser/render_widget_host.h
+++ b/content/public/browser/render_widget_host.h
@@ -22,6 +22,7 @@
 #include "third_party/blink/public/common/input/web_gesture_event.h"
 #include "third_party/blink/public/common/input/web_input_event.h"
 #include "third_party/blink/public/common/page/web_drag_operation.h"
+#include "third_party/blink/public/common/widget/screen_info.h"
 #include "third_party/blink/public/mojom/input/input_event_result.mojom-shared.h"
 #include "ui/base/ui_base_types.h"
 #include "ui/surface/transport_dib.h"
@@ -53,7 +54,6 @@
 class RenderWidgetHostIterator;
 class RenderWidgetHostObserver;
 class RenderWidgetHostView;
-struct ScreenInfo;
 
 // A RenderWidgetHost manages the browser side of a browser<->renderer
 // HWND connection.  The HWND lives in the browser process, and
@@ -281,7 +281,10 @@
   virtual void RemoveObserver(RenderWidgetHostObserver* observer) = 0;
 
   // Get the screen info corresponding to this render widget.
-  virtual void GetScreenInfo(ScreenInfo* result) = 0;
+  virtual void GetScreenInfo(blink::ScreenInfo* screen_info) = 0;
+
+  // This must always return the same device scale factor as GetScreenInfo.
+  virtual float GetDeviceScaleFactor() = 0;
 
   // Get the allowed touch action corresponding to this render widget.
   virtual base::Optional<cc::TouchAction> GetAllowedTouchAction() = 0;
diff --git a/content/public/browser/render_widget_host_view.h b/content/public/browser/render_widget_host_view.h
index 4810a45a..2317a00 100644
--- a/content/public/browser/render_widget_host_view.h
+++ b/content/public/browser/render_widget_host_view.h
@@ -12,6 +12,7 @@
 #include "build/build_config.h"
 #include "content/common/content_export.h"
 #include "third_party/blink/public/common/input/web_input_event.h"
+#include "third_party/blink/public/common/widget/screen_info.h"
 #include "third_party/blink/public/mojom/input/pointer_lock_result.mojom.h"
 #include "third_party/skia/include/core/SkBitmap.h"
 #include "third_party/skia/include/core/SkColor.h"
@@ -39,7 +40,6 @@
 
 class RenderWidgetHost;
 class TouchSelectionControllerClientManager;
-struct ScreenInfo;
 
 // RenderWidgetHostView is an interface implemented by an object that acts as
 // the "View" portion of a RenderWidgetHost. The RenderWidgetHost and its
@@ -238,7 +238,7 @@
   // This method returns the ScreenInfo used by the view to render. If the
   // information is not knowable (e.g, because the view is not attached to a
   // screen yet), then a default best-guess will be used.
-  virtual void GetScreenInfo(ScreenInfo* screen_info) = 0;
+  virtual void GetScreenInfo(blink::ScreenInfo* screen_info) = 0;
 
   // This must always return the same device scale factor as GetScreenInfo.
   virtual float GetDeviceScaleFactor() = 0;
diff --git a/content/public/common/BUILD.gn b/content/public/common/BUILD.gn
index c54bf62..22651bb 100644
--- a/content/public/common/BUILD.gn
+++ b/content/public/common/BUILD.gn
@@ -166,8 +166,6 @@
     "sandbox_init.h",
     "sandboxed_process_launcher_delegate.cc",
     "sandboxed_process_launcher_delegate.h",
-    "screen_info.cc",
-    "screen_info.h",
     "service_manager_connection.h",
     "socket_permission_request.h",
     "stop_find_action.h",
diff --git a/content/public/common/common_param_traits_macros.h b/content/public/common/common_param_traits_macros.h
index 05b0244..a7f8944a 100644
--- a/content/public/common/common_param_traits_macros.h
+++ b/content/public/common/common_param_traits_macros.h
@@ -247,6 +247,7 @@
   IPC_STRUCT_TRAITS_MEMBER(lazy_image_first_k_fully_load)
   IPC_STRUCT_TRAITS_MEMBER(allow_mixed_content_upgrades)
   IPC_STRUCT_TRAITS_MEMBER(always_show_focus)
+  IPC_STRUCT_TRAITS_MEMBER(touch_drag_drop_enabled)
 IPC_STRUCT_TRAITS_END()
 
 IPC_STRUCT_TRAITS_BEGIN(blink::mojom::WindowFeatures)
diff --git a/content/public/common/referrer.cc b/content/public/common/referrer.cc
index d7221ea..4542c0f 100644
--- a/content/public/common/referrer.cc
+++ b/content/public/common/referrer.cc
@@ -82,7 +82,7 @@
 }
 
 // static
-net::URLRequest::ReferrerPolicy Referrer::ReferrerPolicyForUrlRequest(
+net::ReferrerPolicy Referrer::ReferrerPolicyForUrlRequest(
     network::mojom::ReferrerPolicy referrer_policy) {
   if (referrer_policy == network::mojom::ReferrerPolicy::kDefault) {
     return GetDefaultReferrerPolicy();
@@ -92,24 +92,24 @@
 
 // static
 network::mojom::ReferrerPolicy Referrer::NetReferrerPolicyToBlinkReferrerPolicy(
-    net::URLRequest::ReferrerPolicy net_policy) {
+    net::ReferrerPolicy net_policy) {
   switch (net_policy) {
-    case net::URLRequest::CLEAR_REFERRER_ON_TRANSITION_FROM_SECURE_TO_INSECURE:
+    case net::ReferrerPolicy::CLEAR_ON_TRANSITION_FROM_SECURE_TO_INSECURE:
       return network::mojom::ReferrerPolicy::kNoReferrerWhenDowngrade;
-    case net::URLRequest::
-        REDUCE_REFERRER_GRANULARITY_ON_TRANSITION_CROSS_ORIGIN:
+    case net::ReferrerPolicy::REDUCE_GRANULARITY_ON_TRANSITION_CROSS_ORIGIN:
       return network::mojom::ReferrerPolicy::kStrictOriginWhenCrossOrigin;
-    case net::URLRequest::ORIGIN_ONLY_ON_TRANSITION_CROSS_ORIGIN:
+    case net::ReferrerPolicy::ORIGIN_ONLY_ON_TRANSITION_CROSS_ORIGIN:
       return network::mojom::ReferrerPolicy::kOriginWhenCrossOrigin;
-    case net::URLRequest::NEVER_CLEAR_REFERRER:
+    case net::ReferrerPolicy::NEVER_CLEAR:
       return network::mojom::ReferrerPolicy::kAlways;
-    case net::URLRequest::ORIGIN:
+    case net::ReferrerPolicy::ORIGIN:
       return network::mojom::ReferrerPolicy::kOrigin;
-    case net::URLRequest::CLEAR_REFERRER_ON_TRANSITION_CROSS_ORIGIN:
+    case net::ReferrerPolicy::CLEAR_ON_TRANSITION_CROSS_ORIGIN:
       return network::mojom::ReferrerPolicy::kSameOrigin;
-    case net::URLRequest::ORIGIN_CLEAR_ON_TRANSITION_FROM_SECURE_TO_INSECURE:
+    case net::ReferrerPolicy::
+        ORIGIN_CLEAR_ON_TRANSITION_FROM_SECURE_TO_INSECURE:
       return network::mojom::ReferrerPolicy::kStrictOrigin;
-    case net::URLRequest::NO_REFERRER:
+    case net::ReferrerPolicy::NO_REFERRER:
       return network::mojom::ReferrerPolicy::kNever;
   }
   NOTREACHED();
@@ -117,7 +117,7 @@
 }
 
 // static
-net::URLRequest::ReferrerPolicy Referrer::GetDefaultReferrerPolicy() {
+net::ReferrerPolicy Referrer::GetDefaultReferrerPolicy() {
   // The ReducedReferrerGranularity feature sets the default referrer
   // policy to strict-origin-when-cross-origin unless forbidden
   // by the "force legacy policy" global.
@@ -126,14 +126,12 @@
 
   // Short-circuit to avoid acquiring the lock unless necessary.
   if (!base::FeatureList::IsEnabled(features::kReducedReferrerGranularity))
-    return net::URLRequest::
-        CLEAR_REFERRER_ON_TRANSITION_FROM_SECURE_TO_INSECURE;
+    return net::ReferrerPolicy::CLEAR_ON_TRANSITION_FROM_SECURE_TO_INSECURE;
 
   return ShouldForceLegacyDefaultReferrerPolicy()
-             ? net::URLRequest::
-                   CLEAR_REFERRER_ON_TRANSITION_FROM_SECURE_TO_INSECURE
-             : net::URLRequest::
-                   REDUCE_REFERRER_GRANULARITY_ON_TRANSITION_CROSS_ORIGIN;
+             ? net::ReferrerPolicy::CLEAR_ON_TRANSITION_FROM_SECURE_TO_INSECURE
+             : net::ReferrerPolicy::
+                   REDUCE_GRANULARITY_ON_TRANSITION_CROSS_ORIGIN;
 }
 
 // static
diff --git a/content/public/common/referrer.h b/content/public/common/referrer.h
index 91dcc51..e895e42 100644
--- a/content/public/common/referrer.h
+++ b/content/public/common/referrer.h
@@ -6,10 +6,11 @@
 #define CONTENT_PUBLIC_COMMON_REFERRER_H_
 
 #include "content/common/content_export.h"
-#include "net/url_request/url_request.h"
+#include "net/url_request/referrer_policy.h"
 #include "services/network/public/mojom/referrer_policy.mojom-shared.h"
 #include "third_party/blink/public/mojom/referrer.mojom-forward.h"
 #include "url/gurl.h"
+#include "url/origin.h"
 
 namespace content {
 
@@ -46,13 +47,13 @@
       const url::Origin& initiator,
       network::mojom::ReferrerPolicy policy);
 
-  static net::URLRequest::ReferrerPolicy ReferrerPolicyForUrlRequest(
+  static net::ReferrerPolicy ReferrerPolicyForUrlRequest(
       network::mojom::ReferrerPolicy referrer_policy);
 
   static network::mojom::ReferrerPolicy NetReferrerPolicyToBlinkReferrerPolicy(
-      net::URLRequest::ReferrerPolicy net_policy);
+      net::ReferrerPolicy net_policy);
 
-  static net::URLRequest::ReferrerPolicy GetDefaultReferrerPolicy();
+  static net::ReferrerPolicy GetDefaultReferrerPolicy();
 
   // Configures retaining the pre-M80 default referrer
   // policy of no-referrer-when-downgrade.
diff --git a/content/public/common/screen_info.cc b/content/public/common/screen_info.cc
deleted file mode 100644
index 3789daea..0000000
--- a/content/public/common/screen_info.cc
+++ /dev/null
@@ -1,29 +0,0 @@
-// Copyright 2016 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "content/public/common/screen_info.h"
-
-namespace content {
-
-ScreenInfo::ScreenInfo() = default;
-ScreenInfo::ScreenInfo(const ScreenInfo& other) = default;
-ScreenInfo::~ScreenInfo() = default;
-
-bool ScreenInfo::operator==(const ScreenInfo& other) const {
-  return device_scale_factor == other.device_scale_factor &&
-         color_space == other.color_space && depth == other.depth &&
-         depth_per_component == other.depth_per_component &&
-         is_monochrome == other.is_monochrome &&
-         display_frequency == other.display_frequency && rect == other.rect &&
-         available_rect == other.available_rect &&
-         orientation_type == other.orientation_type &&
-         orientation_angle == other.orientation_angle;
-}
-
-bool ScreenInfo::operator!=(const ScreenInfo& other) const {
-  return !(*this == other);
-}
-
-
-}  // namespace content
diff --git a/content/public/common/screen_info.h b/content/public/common/screen_info.h
deleted file mode 100644
index 706ee42..0000000
--- a/content/public/common/screen_info.h
+++ /dev/null
@@ -1,66 +0,0 @@
-// Copyright 2016 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef CONTENT_PUBLIC_COMMON_SCREEN_INFO_H_
-#define CONTENT_PUBLIC_COMMON_SCREEN_INFO_H_
-
-#include "build/build_config.h"
-#include "content/common/content_export.h"
-#include "third_party/blink/public/mojom/widget/screen_orientation.mojom-shared.h"
-#include "ui/gfx/color_space.h"
-#include "ui/gfx/geometry/rect.h"
-#include "ui/gfx/icc_profile.h"
-
-namespace content {
-
-// Information about the screen on which a RenderWidget is being displayed. This
-// is the content counterpart to WebScreenInfo in blink.
-struct CONTENT_EXPORT ScreenInfo {
-    ScreenInfo();
-    ScreenInfo(const ScreenInfo& other);
-    ~ScreenInfo();
-
-    // Device scale factor. Specifies the ratio between physical and logical
-    // pixels.
-    float device_scale_factor = 1.f;
-
-    // The color space of the output display.
-    gfx::ColorSpace color_space = gfx::ColorSpace::CreateSRGB();
-
-    // The screen depth in bits per pixel
-    uint32_t depth = 0;
-
-    // The bits per colour component. This assumes that the colours are balanced
-    // equally.
-    uint32_t depth_per_component = 0;
-
-    // This can be true for black and white printers
-    bool is_monochrome = false;
-
-    // The display frequency in Hz of the monitor. Set to 0 if it fails in the
-    // monitor frequency query.
-    int display_frequency = 0;
-
-    // The display monitor rectangle in virtual-screen coordinates. Note that
-    // this may be negative.
-    gfx::Rect rect;
-
-    // The portion of the monitor's rectangle that can be used by applications.
-    gfx::Rect available_rect;
-
-    // The monitor's orientation.
-    blink::mojom::ScreenOrientation orientation_type =
-        blink::mojom::ScreenOrientation::kUndefined;
-
-    // This is the orientation angle of the displayed content in degrees.
-    // It is the opposite of the physical rotation.
-    uint16_t orientation_angle = 0;
-
-    bool operator==(const ScreenInfo& other) const;
-    bool operator!=(const ScreenInfo& other) const;
-};
-
-}  // namespace content
-
-#endif  // CONTENT_PUBLIC_COMMON_SCREEN_INFO_H_
diff --git a/content/public/common/web_preferences.cc b/content/public/common/web_preferences.cc
index f85ad51..0cc0c87 100644
--- a/content/public/common/web_preferences.cc
+++ b/content/public/common/web_preferences.cc
@@ -8,9 +8,21 @@
 #include "base/strings/utf_string_conversions.h"
 #include "build/build_config.h"
 #include "third_party/blink/public/web/web_settings.h"
+#include "ui/base/ui_base_switches_util.h"
 
 using blink::WebSettings;
 
+namespace {
+
+bool IsTouchDragDropEnabled() {
+  // Cache the enabled state so it isn't queried on every WebPreferences
+  // creation. Note that this means unit tests can't override the state.
+  static const bool enabled = switches::IsTouchDragDropEnabled();
+  return enabled;
+}
+
+}  // namespace
+
 namespace content {
 
 // "Zyyy" is the ISO 15924 script code for undetermined script aka Common.
@@ -228,7 +240,8 @@
       network_quality_estimator_web_holdback(
           net::EFFECTIVE_CONNECTION_TYPE_UNKNOWN),
       allow_mixed_content_upgrades(true),
-      always_show_focus(false) {
+      always_show_focus(false),
+      touch_drag_drop_enabled(IsTouchDragDropEnabled()) {
   standard_font_family_map[kCommonScript] =
       base::ASCIIToUTF16("Times New Roman");
   fixed_font_family_map[kCommonScript] = base::ASCIIToUTF16("Courier New");
diff --git a/content/public/common/web_preferences.h b/content/public/common/web_preferences.h
index bf98747..e2183b7 100644
--- a/content/public/common/web_preferences.h
+++ b/content/public/common/web_preferences.h
@@ -360,6 +360,10 @@
   // forcing :focus-visible to match regardless of focus method).
   bool always_show_focus;
 
+  // Whether touch input can trigger HTML drag-and-drop operations. The
+  // default value depends on the platform.
+  bool touch_drag_drop_enabled;
+
   // We try to keep the default values the same as the default values in
   // chrome, except for the cases where it would require lots of extra work for
   // the embedder to use the same default value.
diff --git a/content/public/test/referrer_unittest.cc b/content/public/test/referrer_unittest.cc
index b3a4e02..0637fe79 100644
--- a/content/public/test/referrer_unittest.cc
+++ b/content/public/test/referrer_unittest.cc
@@ -7,6 +7,7 @@
 #include "base/test/gtest_util.h"
 #include "base/test/scoped_feature_list.h"
 #include "content/public/common/content_features.h"
+#include "net/url_request/referrer_policy.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
 namespace content {
@@ -90,15 +91,15 @@
 }
 
 TEST(ReferrerTest, BlinkNetRoundTripConversion) {
-  const net::URLRequest::ReferrerPolicy policies[] = {
-      net::URLRequest::CLEAR_REFERRER_ON_TRANSITION_FROM_SECURE_TO_INSECURE,
-      net::URLRequest::REDUCE_REFERRER_GRANULARITY_ON_TRANSITION_CROSS_ORIGIN,
-      net::URLRequest::ORIGIN_ONLY_ON_TRANSITION_CROSS_ORIGIN,
-      net::URLRequest::NEVER_CLEAR_REFERRER,
-      net::URLRequest::ORIGIN,
-      net::URLRequest::CLEAR_REFERRER_ON_TRANSITION_CROSS_ORIGIN,
-      net::URLRequest::ORIGIN_CLEAR_ON_TRANSITION_FROM_SECURE_TO_INSECURE,
-      net::URLRequest::NO_REFERRER,
+  const net::ReferrerPolicy policies[] = {
+      net::ReferrerPolicy::CLEAR_ON_TRANSITION_FROM_SECURE_TO_INSECURE,
+      net::ReferrerPolicy::REDUCE_GRANULARITY_ON_TRANSITION_CROSS_ORIGIN,
+      net::ReferrerPolicy::ORIGIN_ONLY_ON_TRANSITION_CROSS_ORIGIN,
+      net::ReferrerPolicy::NEVER_CLEAR,
+      net::ReferrerPolicy::ORIGIN,
+      net::ReferrerPolicy::CLEAR_ON_TRANSITION_CROSS_ORIGIN,
+      net::ReferrerPolicy::ORIGIN_CLEAR_ON_TRANSITION_FROM_SECURE_TO_INSECURE,
+      net::ReferrerPolicy::NO_REFERRER,
   };
 
   for (auto policy : policies) {
@@ -109,17 +110,15 @@
 }
 
 TEST(DefaultReferrerPolicyTest, Unconfigured) {
-  EXPECT_EQ(
-      Referrer::GetDefaultReferrerPolicy(),
-      net::URLRequest::CLEAR_REFERRER_ON_TRANSITION_FROM_SECURE_TO_INSECURE);
+  EXPECT_EQ(Referrer::GetDefaultReferrerPolicy(),
+            net::ReferrerPolicy::CLEAR_ON_TRANSITION_FROM_SECURE_TO_INSECURE);
 }
 
 TEST(DefaultReferrerPolicyTest, FeatureOnly) {
   base::test::ScopedFeatureList f;
   f.InitAndEnableFeature(features::kReducedReferrerGranularity);
-  EXPECT_EQ(
-      Referrer::GetDefaultReferrerPolicy(),
-      net::URLRequest::REDUCE_REFERRER_GRANULARITY_ON_TRANSITION_CROSS_ORIGIN);
+  EXPECT_EQ(Referrer::GetDefaultReferrerPolicy(),
+            net::ReferrerPolicy::REDUCE_GRANULARITY_ON_TRANSITION_CROSS_ORIGIN);
 }
 
 TEST(DefaultReferrerPolicyTest, SetAndGetForceLegacy) {
@@ -130,18 +129,16 @@
 
 TEST(DefaultReferrerPolicyTest, ForceLegacyOnly) {
   content::Referrer::SetForceLegacyDefaultReferrerPolicy(true);
-  EXPECT_EQ(
-      Referrer::GetDefaultReferrerPolicy(),
-      net::URLRequest::CLEAR_REFERRER_ON_TRANSITION_FROM_SECURE_TO_INSECURE);
+  EXPECT_EQ(Referrer::GetDefaultReferrerPolicy(),
+            net::ReferrerPolicy::CLEAR_ON_TRANSITION_FROM_SECURE_TO_INSECURE);
 }
 
 TEST(DefaultReferrerPolicyTest, FeatureAndForceLegacy) {
   base::test::ScopedFeatureList f;
   f.InitAndEnableFeature(features::kReducedReferrerGranularity);
   content::Referrer::SetForceLegacyDefaultReferrerPolicy(true);
-  EXPECT_EQ(
-      Referrer::GetDefaultReferrerPolicy(),
-      net::URLRequest::CLEAR_REFERRER_ON_TRANSITION_FROM_SECURE_TO_INSECURE);
+  EXPECT_EQ(Referrer::GetDefaultReferrerPolicy(),
+            net::ReferrerPolicy::CLEAR_ON_TRANSITION_FROM_SECURE_TO_INSECURE);
 }
 
 }  // namespace content
diff --git a/content/public/test/render_view_test.cc b/content/public/test/render_view_test.cc
index d71372a..ad276b82 100644
--- a/content/public/test/render_view_test.cc
+++ b/content/public/test/render_view_test.cc
@@ -19,7 +19,6 @@
 #include "content/common/input_messages.h"
 #include "content/common/renderer.mojom.h"
 #include "content/common/view_messages.h"
-#include "content/common/visual_properties.h"
 #include "content/common/widget_messages.h"
 #include "content/public/browser/content_browser_client.h"
 #include "content/public/browser/native_web_keyboard_event.h"
@@ -48,6 +47,7 @@
 #include "third_party/blink/public/common/input/web_gesture_event.h"
 #include "third_party/blink/public/common/input/web_input_event.h"
 #include "third_party/blink/public/common/input/web_mouse_event.h"
+#include "third_party/blink/public/common/widget/visual_properties.h"
 #include "third_party/blink/public/mojom/leak_detector/leak_detector.mojom.h"
 #include "third_party/blink/public/mojom/renderer_preferences.mojom.h"
 #include "third_party/blink/public/platform/platform.h"
@@ -731,8 +731,8 @@
   RenderWidget* render_widget =
       view->GetMainRenderFrame()->GetLocalRootRenderWidget();
 
-  VisualProperties visual_properties;
-  visual_properties.screen_info = ScreenInfo();
+  blink::VisualProperties visual_properties;
+  visual_properties.screen_info = blink::ScreenInfo();
   visual_properties.new_size = new_size;
   visual_properties.compositor_viewport_pixel_rect = gfx::Rect(new_size);
   visual_properties.is_fullscreen_granted = is_fullscreen_granted;
@@ -837,8 +837,8 @@
   return std::make_unique<FakeRenderWidgetHost>();
 }
 
-VisualProperties RenderViewTest::InitialVisualProperties() {
-  VisualProperties initial_visual_properties;
+blink::VisualProperties RenderViewTest::InitialVisualProperties() {
+  blink::VisualProperties initial_visual_properties;
   // Ensure the view has some size so tests involving scrolling bounds work.
   initial_visual_properties.new_size = gfx::Size(400, 300);
   initial_visual_properties.visible_viewport_size = gfx::Size(400, 300);
diff --git a/content/public/test/render_view_test.h b/content/public/test/render_view_test.h
index 5fd41ad1..4cdd8ac 100644
--- a/content/public/test/render_view_test.h
+++ b/content/public/test/render_view_test.h
@@ -29,6 +29,7 @@
 namespace scheduler {
 class WebThreadScheduler;
 }
+struct VisualProperties;
 class WebGestureEvent;
 class WebInputElement;
 class WebMouseEvent;
@@ -51,7 +52,6 @@
 class RendererBlinkPlatformImplTestOverrideImpl;
 class RenderProcess;
 class RenderView;
-struct VisualProperties;
 
 class RenderViewTest : public testing::Test {
  public:
@@ -195,7 +195,7 @@
   virtual std::unique_ptr<FakeRenderWidgetHost> CreateRenderWidgetHost();
 
   // Allows a subclass to customize the initial size of the RenderView.
-  virtual VisualProperties InitialVisualProperties();
+  virtual blink::VisualProperties InitialVisualProperties();
 
   // Override this to change the CompositorDependencies for the test.
   virtual std::unique_ptr<CompositorDependencies>
diff --git a/content/renderer/loader/resource_dispatcher.cc b/content/renderer/loader/resource_dispatcher.cc
index 70b959e..4baa207 100644
--- a/content/renderer/loader/resource_dispatcher.cc
+++ b/content/renderer/loader/resource_dispatcher.cc
@@ -38,6 +38,7 @@
 #include "net/base/net_errors.h"
 #include "net/base/request_priority.h"
 #include "net/http/http_response_headers.h"
+#include "net/url_request/referrer_policy.h"
 #include "services/network/public/cpp/features.h"
 #include "services/network/public/cpp/resource_request.h"
 #include "services/network/public/cpp/url_loader_completion_status.h"
@@ -64,8 +65,7 @@
 void CheckSchemeForReferrerPolicy(const network::ResourceRequest& request) {
   if ((request.referrer_policy == Referrer::GetDefaultReferrerPolicy() ||
        request.referrer_policy ==
-           net::URLRequest::
-               CLEAR_REFERRER_ON_TRANSITION_FROM_SECURE_TO_INSECURE) &&
+           net::ReferrerPolicy::CLEAR_ON_TRANSITION_FROM_SECURE_TO_INSECURE) &&
       request.referrer.SchemeIsCryptographic() &&
       !url::Origin::Create(request.url).opaque() &&
       !IsOriginSecure(request.url)) {
diff --git a/content/renderer/pepper/pepper_plugin_instance_impl.cc b/content/renderer/pepper/pepper_plugin_instance_impl.cc
index 2af2127..dbf1834 100644
--- a/content/renderer/pepper/pepper_plugin_instance_impl.cc
+++ b/content/renderer/pepper/pepper_plugin_instance_impl.cc
@@ -2617,7 +2617,7 @@
     // All other cases: Report the screen size.
     if (!render_frame_)
       return PP_FALSE;
-    blink::WebScreenInfo info =
+    blink::ScreenInfo info =
         render_frame_->GetLocalRootRenderWidget()->GetScreenInfo();
     *size = PP_MakeSize(info.rect.width(), info.rect.height());
   }
@@ -3201,7 +3201,7 @@
   // behavior, the width and height should probably be set to 100%, rather than
   // a fixed screen size.
 
-  blink::WebScreenInfo info =
+  blink::ScreenInfo info =
       render_frame_->GetLocalRootRenderWidget()->GetScreenInfo();
   screen_size_for_fullscreen_ = info.rect.size();
   std::string width = base::NumberToString(screen_size_for_fullscreen_.width());
diff --git a/content/renderer/render_frame_impl_browsertest.cc b/content/renderer/render_frame_impl_browsertest.cc
index 96c2384..ee4f8a5e 100644
--- a/content/renderer/render_frame_impl_browsertest.cc
+++ b/content/renderer/render_frame_impl_browsertest.cc
@@ -211,7 +211,7 @@
 TEST_F(RenderFrameImplTest, FrameResize) {
   // Make an update where the widget's size and the visible_viewport_size
   // are not the same.
-  VisualProperties visual_properties;
+  blink::VisualProperties visual_properties;
   gfx::Size widget_size(400, 200);
   gfx::Size visible_size(350, 170);
   visual_properties.new_size = widget_size;
diff --git a/content/renderer/render_frame_proxy.cc b/content/renderer/render_frame_proxy.cc
index 44235f4..781f1545 100644
--- a/content/renderer/render_frame_proxy.cc
+++ b/content/renderer/render_frame_proxy.cc
@@ -22,7 +22,6 @@
 #include "content/public/common/content_client.h"
 #include "content/public/common/content_switches.h"
 #include "content/public/common/impression.h"
-#include "content/public/common/screen_info.h"
 #include "content/public/common/use_zoom_for_dsf_policy.h"
 #include "content/public/renderer/content_renderer_client.h"
 #include "content/renderer/child_frame_compositing_helper.h"
@@ -278,7 +277,8 @@
   SynchronizeVisualProperties();
 }
 
-void RenderFrameProxy::OnScreenInfoChanged(const ScreenInfo& screen_info) {
+void RenderFrameProxy::OnScreenInfoChanged(
+    const blink::ScreenInfo& screen_info) {
   DCHECK(ancestor_render_widget_);
 
   pending_visual_properties_.screen_info = screen_info;
diff --git a/content/renderer/render_frame_proxy.h b/content/renderer/render_frame_proxy.h
index 17d302d..b8f3363 100644
--- a/content/renderer/render_frame_proxy.h
+++ b/content/renderer/render_frame_proxy.h
@@ -13,7 +13,6 @@
 #include "content/common/frame_messages.h"
 #include "content/common/frame_proxy.mojom.h"
 #include "content/common/frame_visual_properties.h"
-#include "content/public/common/screen_info.h"
 #include "content/renderer/child_frame_compositor.h"
 #include "ipc/ipc_listener.h"
 #include "ipc/ipc_sender.h"
@@ -23,6 +22,7 @@
 #include "third_party/blink/public/common/associated_interfaces/associated_interface_provider.h"
 #include "third_party/blink/public/common/associated_interfaces/associated_interface_registry.h"
 #include "third_party/blink/public/common/feature_policy/feature_policy.h"
+#include "third_party/blink/public/common/widget/screen_info.h"
 #include "third_party/blink/public/mojom/frame/frame.mojom.h"
 #include "third_party/blink/public/mojom/frame/user_activation_update_types.mojom.h"
 #include "third_party/blink/public/mojom/input/focus_type.mojom-forward.h"
@@ -137,7 +137,7 @@
   // would only get one update per UpdateVisualProperties IPC received in the
   // RenderWidget, and we would only need to send one update to the browser as
   // a result.
-  void OnScreenInfoChanged(const ScreenInfo& screen_info);
+  void OnScreenInfoChanged(const blink::ScreenInfo& screen_info);
   void OnZoomLevelChanged(double zoom_level);
   void OnRootWindowSegmentsChanged(
       std::vector<gfx::Rect> root_widget_window_segments);
@@ -171,7 +171,7 @@
     return pending_visual_properties_.local_frame_size;
   }
 
-  const ScreenInfo& screen_info() const {
+  const blink::ScreenInfo& screen_info() const {
     return pending_visual_properties_.screen_info;
   }
 
diff --git a/content/renderer/render_thread_impl_browsertest.cc b/content/renderer/render_thread_impl_browsertest.cc
index 9adedad..dcc8274 100644
--- a/content/renderer/render_thread_impl_browsertest.cc
+++ b/content/renderer/render_thread_impl_browsertest.cc
@@ -175,9 +175,9 @@
     cmd->AppendSwitchASCII(switches::kNumRasterThreads, "1");
 
     // To avoid creating a GPU channel to query if
-    // accelerated_video_decode is blacklisted on older Android system
+    // accelerated_video_decode is blocklisted on older Android system
     // in RenderThreadImpl::Init().
-    cmd->AppendSwitch(switches::kIgnoreGpuBlacklist);
+    cmd->AppendSwitch(switches::kIgnoreGpuBlocklist);
 
     blink::Platform::InitializeBlink();
     auto main_thread_scheduler =
diff --git a/content/renderer/render_view_browsertest.cc b/content/renderer/render_view_browsertest.cc
index 6d3d1b8b..fe0e574 100644
--- a/content/renderer/render_view_browsertest.cc
+++ b/content/renderer/render_view_browsertest.cc
@@ -518,8 +518,8 @@
     ASSERT_EQ(dsf, widget->GetOriginalScreenInfo().device_scale_factor);
   }
 
-  VisualProperties MakeVisualPropertiesWithDeviceScaleFactor(float dsf) {
-    VisualProperties visual_properties;
+  blink::VisualProperties MakeVisualPropertiesWithDeviceScaleFactor(float dsf) {
+    blink::VisualProperties visual_properties;
     visual_properties.screen_info.device_scale_factor = dsf;
     visual_properties.new_size = gfx::Size(100, 100);
     visual_properties.compositor_viewport_pixel_rect = gfx::Rect(200, 200);
@@ -667,8 +667,8 @@
 
 class RenderViewImplEmulatingPopupTest : public RenderViewImplTest {
  protected:
-  VisualProperties InitialVisualProperties() override {
-    VisualProperties visual_properties =
+  blink::VisualProperties InitialVisualProperties() override {
+    blink::VisualProperties visual_properties =
         RenderViewImplTest::InitialVisualProperties();
     visual_properties.screen_info.rect = gfx::Rect(800, 600);
     return visual_properties;
@@ -1222,7 +1222,7 @@
 
   // Early grab testing values as the main-frame widget becomes inaccessible
   // when it unloads.
-  VisualProperties test_visual_properties =
+  blink::VisualProperties test_visual_properties =
       MakeVisualPropertiesWithDeviceScaleFactor(device_scale);
 
   // Unload the main frame after which it should become a WebRemoteFrame.
diff --git a/content/renderer/render_view_impl.cc b/content/renderer/render_view_impl.cc
index c6a990f..aec83ad 100644
--- a/content/renderer/render_view_impl.cc
+++ b/content/renderer/render_view_impl.cc
@@ -351,9 +351,6 @@
   settings->SetThreadedScrollingEnabled(
       !command_line.HasSwitch(switches::kDisableThreadedScrolling));
 
-  if (switches::IsTouchDragDropEnabled())
-    settings->SetTouchDragDropEnabled(true);
-
   WebSettings::SelectionStrategyType selection_strategy;
   if (command_line.GetSwitchValueASCII(switches::kTouchTextSelectionStrategy) ==
       "direction")
@@ -954,6 +951,8 @@
     NOTREACHED();
   }
 
+  settings->SetTouchDragDropEnabled(prefs.touch_drag_drop_enabled);
+
 #if defined(OS_MACOSX)
   web_view->SetMaximumLegibleScale(prefs.default_maximum_page_scale_factor);
 #endif
diff --git a/content/renderer/render_widget.cc b/content/renderer/render_widget.cc
index ee6e21c..0b3a871 100644
--- a/content/renderer/render_widget.cc
+++ b/content/renderer/render_widget.cc
@@ -341,7 +341,7 @@
 void RenderWidget::InitForPopup(ShowCallback show_callback,
                                 RenderWidget* opener_widget,
                                 blink::WebPagePopup* web_page_popup,
-                                const ScreenInfo& screen_info) {
+                                const blink::ScreenInfo& screen_info) {
   popup_ = true;
   Initialize(std::move(show_callback), web_page_popup, screen_info);
 
@@ -354,22 +354,23 @@
   }
 }
 
-void RenderWidget::InitForPepperFullscreen(ShowCallback show_callback,
-                                           blink::WebWidget* web_widget,
-                                           const ScreenInfo& screen_info) {
+void RenderWidget::InitForPepperFullscreen(
+    ShowCallback show_callback,
+    blink::WebWidget* web_widget,
+    const blink::ScreenInfo& screen_info) {
   pepper_fullscreen_ = true;
   Initialize(std::move(show_callback), web_widget, screen_info);
 }
 
 void RenderWidget::InitForMainFrame(ShowCallback show_callback,
                                     blink::WebFrameWidget* web_frame_widget,
-                                    const ScreenInfo& screen_info) {
+                                    const blink::ScreenInfo& screen_info) {
   Initialize(std::move(show_callback), web_frame_widget, screen_info);
 }
 
 void RenderWidget::InitForChildLocalRoot(
     blink::WebFrameWidget* web_frame_widget,
-    const ScreenInfo& screen_info) {
+    const blink::ScreenInfo& screen_info) {
   for_child_local_root_frame_ = true;
   Initialize(base::NullCallback(), web_frame_widget, screen_info);
 }
@@ -383,7 +384,7 @@
 
 void RenderWidget::Initialize(ShowCallback show_callback,
                               WebWidget* web_widget,
-                              const ScreenInfo& screen_info) {
+                              const blink::ScreenInfo& screen_info) {
   DCHECK_NE(routing_id_, MSG_ROUTING_NONE);
   DCHECK(web_widget);
 
@@ -475,7 +476,7 @@
 }
 
 void RenderWidget::OnUpdateVisualProperties(
-    const VisualProperties& visual_properties_from_browser) {
+    const blink::VisualProperties& visual_properties_from_browser) {
   TRACE_EVENT0("renderer", "RenderWidget::OnUpdateVisualProperties");
 
   // UpdateVisualProperties is used to receive properties from the browser
@@ -533,7 +534,7 @@
   //   See also:
   //   https://docs.google.com/document/d/1G_fR1D_0c1yke8CqDMddoKrDGr3gy5t_ImEH4hKNIII/edit#
 
-  VisualProperties visual_properties = visual_properties_from_browser;
+  blink::VisualProperties visual_properties = visual_properties_from_browser;
   // Web tests can override the device scale factor in the renderer.
   if (device_scale_factor_for_testing_) {
     visual_properties.screen_info.device_scale_factor =
@@ -1132,7 +1133,7 @@
 }
 
 void RenderWidget::SetScreenInfoAndSize(
-    const ScreenInfo& screen_info,
+    const blink::ScreenInfo& screen_info,
     const gfx::Size& widget_size,
     const gfx::Size& visible_viewport_size) {
   // Emulation only happens on the main frame.
@@ -1262,7 +1263,7 @@
   SetPendingWindowRect(initial_rect_);
 }
 
-void RenderWidget::InitCompositing(const ScreenInfo& screen_info) {
+void RenderWidget::InitCompositing(const blink::ScreenInfo& screen_info) {
   TRACE_EVENT0("blink", "RenderWidget::InitializeLayerTreeView");
 
   layer_tree_host_ = webwidget_->InitializeCompositing(
@@ -1369,21 +1370,8 @@
                          opener_emulator_scale_);
 }
 
-blink::WebScreenInfo RenderWidget::GetScreenInfo() {
-  const ScreenInfo& info = screen_info_;
-
-  blink::WebScreenInfo web_screen_info;
-  web_screen_info.device_scale_factor = info.device_scale_factor;
-  web_screen_info.color_space = info.color_space;
-  web_screen_info.depth = info.depth;
-  web_screen_info.depth_per_component = info.depth_per_component;
-  web_screen_info.is_monochrome = info.is_monochrome;
-  web_screen_info.rect = info.rect;
-  web_screen_info.available_rect = info.available_rect;
-  web_screen_info.orientation_type = info.orientation_type;
-  web_screen_info.orientation_angle = info.orientation_angle;
-
-  return web_screen_info;
+blink::ScreenInfo RenderWidget::GetScreenInfo() {
+  return screen_info_;
 }
 
 WebRect RenderWidget::WindowRect() {
@@ -1507,13 +1495,13 @@
 void RenderWidget::UpdateSurfaceAndScreenInfo(
     const viz::LocalSurfaceIdAllocation& new_local_surface_id_allocation,
     const gfx::Rect& compositor_viewport_pixel_rect,
-    const ScreenInfo& new_screen_info) {
+    const blink::ScreenInfo& new_screen_info) {
   // Same logic is used in RenderWidgetHostImpl::SynchronizeVisualProperties to
   // detect if there is a screen orientation change.
   bool orientation_changed =
       screen_info_.orientation_angle != new_screen_info.orientation_angle ||
       screen_info_.orientation_type != new_screen_info.orientation_type;
-  ScreenInfo previous_original_screen_info = GetOriginalScreenInfo();
+  blink::ScreenInfo previous_original_screen_info = GetOriginalScreenInfo();
 
   local_surface_id_allocation_from_parent_ = new_local_surface_id_allocation;
   screen_info_ = new_screen_info;
@@ -1805,7 +1793,7 @@
       main_frame_thread_observer_routing_id));
 }
 
-const ScreenInfo& RenderWidget::GetOriginalScreenInfo() const {
+const blink::ScreenInfo& RenderWidget::GetOriginalScreenInfo() const {
   if (device_emulator_)
     return device_emulator_->original_screen_info();
   return screen_info_;
@@ -1907,7 +1895,7 @@
   // new viz::LocalSurfaceId to avoid surface invariants violations in tests.
   layer_tree_host_->RequestNewLocalSurfaceId();
 
-  ScreenInfo info = screen_info_;
+  blink::ScreenInfo info = screen_info_;
   info.device_scale_factor = factor;
   gfx::Size viewport_pixel_size = gfx::ScaleToCeiledSize(size_, factor);
   UpdateSurfaceAndScreenInfo(local_surface_id_allocation_from_parent_,
@@ -1944,7 +1932,7 @@
   // new viz::LocalSurfaceId to avoid surface invariants violations in tests.
   layer_tree_host_->RequestNewLocalSurfaceId();
 
-  ScreenInfo info = screen_info_;
+  blink::ScreenInfo info = screen_info_;
   info.color_space = color_space;
   UpdateSurfaceAndScreenInfo(local_surface_id_allocation_from_parent_,
                              CompositorViewportRect(), info);
diff --git a/content/renderer/render_widget.h b/content/renderer/render_widget.h
index dbb380b..5887954 100644
--- a/content/renderer/render_widget.h
+++ b/content/renderer/render_widget.h
@@ -35,7 +35,6 @@
 #include "content/common/content_to_visible_time_reporter.h"
 #include "content/common/drag_event_source_info.h"
 #include "content/public/common/drop_data.h"
-#include "content/public/common/screen_info.h"
 #include "content/renderer/mouse_lock_dispatcher.h"
 #include "content/renderer/render_widget_delegate.h"
 #include "content/renderer/render_widget_mouse_lock_dispatcher.h"
@@ -48,6 +47,7 @@
 #include "ppapi/buildflags/buildflags.h"
 #include "services/network/public/mojom/referrer_policy.mojom.h"
 #include "third_party/blink/public/common/input/web_input_event.h"
+#include "third_party/blink/public/common/widget/screen_info.h"
 #include "third_party/blink/public/platform/viewport_intersection_state.h"
 #include "third_party/blink/public/platform/web_rect.h"
 #include "third_party/blink/public/platform/web_text_input_info.h"
@@ -70,6 +70,7 @@
 }
 
 namespace blink {
+struct VisualProperties;
 struct WebDeviceEmulationParams;
 class WebDragData;
 class WebFrameWidget;
@@ -98,7 +99,6 @@
 class RenderViewImpl;
 class RenderWidgetDelegate;
 class RenderWidgetScreenMetricsEmulator;
-struct VisualProperties;
 
 // RenderWidget provides a communication bridge between a WebWidget and
 // a RenderWidgetHost, the latter of which lives in a different process.
@@ -178,25 +178,25 @@
   void InitForPopup(ShowCallback show_callback,
                     RenderWidget* opener_widget,
                     blink::WebPagePopup* web_page_popup,
-                    const ScreenInfo& screen_info);
+                    const blink::ScreenInfo& screen_info);
 
   // Initialize a new RenderWidget for pepper fullscreen. The |show_callback| is
   // called when RenderWidget::Show() happens.
   void InitForPepperFullscreen(ShowCallback show_callback,
                                blink::WebWidget* web_widget,
-                               const ScreenInfo& screen_info);
+                               const blink::ScreenInfo& screen_info);
 
   // Initialize a new RenderWidget that will be attached to a RenderFrame (via
   // the WebFrameWidget), for a frame that is a main frame.
   void InitForMainFrame(ShowCallback show_callback,
                         blink::WebFrameWidget* web_frame_widget,
-                        const ScreenInfo& screen_info);
+                        const blink::ScreenInfo& screen_info);
 
   // Initialize a new RenderWidget that will be attached to a RenderFrame (via
   // the WebFrameWidget), for a frame that is a local root, but not the main
   // frame.
   void InitForChildLocalRoot(blink::WebFrameWidget* web_frame_widget,
-                             const ScreenInfo& screen_info);
+                             const blink::ScreenInfo& screen_info);
 
   // Sets a delegate to handle certain RenderWidget operations that need an
   // escape to the RenderView.
@@ -258,7 +258,7 @@
   void SetScreenMetricsEmulationParameters(
       bool enabled,
       const blink::WebDeviceEmulationParams& params) override;
-  void SetScreenInfoAndSize(const ScreenInfo& screen_info,
+  void SetScreenInfoAndSize(const blink::ScreenInfo& screen_info,
                             const gfx::Size& widget_size,
                             const gfx::Size& visible_viewport_size) override;
   void SetScreenRects(const gfx::Rect& widget_screen_rect,
@@ -269,7 +269,7 @@
   void DidMeaningfulLayout(blink::WebMeaningfulLayout layout_type) override;
   void ClosePopupWidgetSoon() override;
   void Show(blink::WebNavigationPolicy) override;
-  blink::WebScreenInfo GetScreenInfo() override;
+  blink::ScreenInfo GetScreenInfo() override;
   blink::WebRect WindowRect() override;
   blink::WebRect ViewRect() override;
   void SetWindowRect(const blink::WebRect&) override;
@@ -362,7 +362,7 @@
   }
 
   // When emulated, this returns the original (non-emulated) ScreenInfo.
-  const ScreenInfo& GetOriginalScreenInfo() const;
+  const blink::ScreenInfo& GetOriginalScreenInfo() const;
 
   void DidNavigate(ukm::SourceId source_id, const GURL& url);
 
@@ -429,10 +429,10 @@
 
   void Initialize(ShowCallback show_callback,
                   blink::WebWidget* web_widget,
-                  const ScreenInfo& screen_info);
+                  const blink::ScreenInfo& screen_info);
   // Initializes the compositor and dependent systems, as part of the
   // Initialize() process.
-  void InitCompositing(const ScreenInfo& screen_info);
+  void InitCompositing(const blink::ScreenInfo& screen_info);
 
   // Request the window to close from the renderer by sending the request to the
   // browser.
@@ -459,7 +459,7 @@
 
   // RenderWidget IPC message handlers.
   void OnClose();
-  void OnUpdateVisualProperties(const VisualProperties& properties);
+  void OnUpdateVisualProperties(const blink::VisualProperties& properties);
   void OnCreatingNewAck();
   void OnEnableDeviceEmulation(const blink::WebDeviceEmulationParams& params);
   void OnDisableDeviceEmulation();
@@ -531,7 +531,7 @@
   void UpdateSurfaceAndScreenInfo(
       const viz::LocalSurfaceIdAllocation& new_local_surface_id_allocation,
       const gfx::Rect& compositor_viewport_pixel_rect,
-      const ScreenInfo& new_screen_info);
+      const blink::ScreenInfo& new_screen_info);
 
   // Used to force the size of a window when running web tests.
   void SetWindowRectSynchronously(const gfx::Rect& new_window_rect);
@@ -661,7 +661,7 @@
   // Properties of the screen hosting the RenderWidget. Rects in this structure
   // do not include any scaling by device scale factor, so are logical pixels
   // not physical device pixels.
-  ScreenInfo screen_info_;
+  blink::ScreenInfo screen_info_;
   // The screen rects of the view and the window that contains it. These do not
   // include any scaling by device scale factor, so are logical pixels not
   // physical device pixels.
diff --git a/content/renderer/render_widget_browsertest.cc b/content/renderer/render_widget_browsertest.cc
index aa7ffbc..6b26dba 100644
--- a/content/renderer/render_widget_browsertest.cc
+++ b/content/renderer/render_widget_browsertest.cc
@@ -5,7 +5,6 @@
 #include "base/strings/utf_string_conversions.h"
 #include "components/viz/common/surfaces/local_surface_id.h"
 #include "components/viz/common/surfaces/parent_local_surface_id_allocator.h"
-#include "content/common/visual_properties.h"
 #include "content/common/widget_messages.h"
 #include "content/public/renderer/render_frame_visitor.h"
 #include "content/public/test/fake_render_widget_host.h"
@@ -14,6 +13,7 @@
 #include "content/renderer/render_thread_impl.h"
 #include "content/renderer/render_view_impl.h"
 #include "content/renderer/render_widget.h"
+#include "third_party/blink/public/common/widget/visual_properties.h"
 #include "third_party/blink/public/platform/web_runtime_features.h"
 #include "third_party/blink/public/web/web_frame_widget.h"
 #include "third_party/blink/public/web/web_input_method_controller.h"
@@ -32,7 +32,7 @@
   }
 
   void OnSynchronizeVisualProperties(
-      const VisualProperties& visual_properties) {
+      const blink::VisualProperties& visual_properties) {
     WidgetMsg_UpdateVisualProperties msg(widget()->routing_id(),
                                          visual_properties);
     widget()->OnMessageReceived(msg);
@@ -80,8 +80,8 @@
   widget()->DidNavigate(ukm::SourceId(42), GURL(""));
   // The initial bounds is empty, so setting it to the same thing should do
   // nothing.
-  VisualProperties visual_properties;
-  visual_properties.screen_info = ScreenInfo();
+  blink::VisualProperties visual_properties;
+  visual_properties.screen_info = blink::ScreenInfo();
   visual_properties.new_size = gfx::Size();
   visual_properties.compositor_viewport_pixel_rect = gfx::Rect();
   visual_properties.is_fullscreen_granted = false;
@@ -126,8 +126,8 @@
 
 class RenderWidgetInitialSizeTest : public RenderWidgetTest {
  protected:
-  VisualProperties InitialVisualProperties() override {
-    VisualProperties initial_visual_properties;
+  blink::VisualProperties InitialVisualProperties() override {
+    blink::VisualProperties initial_visual_properties;
     initial_visual_properties.new_size = initial_size_;
     initial_visual_properties.compositor_viewport_pixel_rect =
         gfx::Rect(initial_size_);
@@ -376,7 +376,7 @@
 TEST_F(RenderWidgetTest, ActivePinchGestureUpdatesLayerTreeHost) {
   auto* layer_tree_host = widget()->layer_tree_host();
   EXPECT_FALSE(layer_tree_host->is_external_pinch_gesture_active_for_testing());
-  content::VisualProperties visual_properties;
+  blink::VisualProperties visual_properties;
 
   // Sync visual properties on a mainframe RenderWidget.
   visual_properties.is_pinch_gesture_active = true;
diff --git a/content/renderer/render_widget_fullscreen_pepper.cc b/content/renderer/render_widget_fullscreen_pepper.cc
index f122381..39c925b1 100644
--- a/content/renderer/render_widget_fullscreen_pepper.cc
+++ b/content/renderer/render_widget_fullscreen_pepper.cc
@@ -172,7 +172,7 @@
     int32_t routing_id,
     RenderWidget::ShowCallback show_callback,
     CompositorDependencies* compositor_deps,
-    const ScreenInfo& screen_info,
+    const blink::ScreenInfo& screen_info,
     PepperPluginInstanceImpl* plugin,
     const blink::WebURL& local_main_frame_url,
     mojo::PendingAssociatedRemote<blink::mojom::WidgetHost> blink_widget_host,
diff --git a/content/renderer/render_widget_fullscreen_pepper.h b/content/renderer/render_widget_fullscreen_pepper.h
index f903922..35302dc5f 100644
--- a/content/renderer/render_widget_fullscreen_pepper.h
+++ b/content/renderer/render_widget_fullscreen_pepper.h
@@ -40,7 +40,7 @@
       int32_t routing_id,
       RenderWidget::ShowCallback show_callback,
       CompositorDependencies* compositor_deps,
-      const ScreenInfo& screen_info,
+      const blink::ScreenInfo& screen_info,
       PepperPluginInstanceImpl* plugin,
       const blink::WebURL& local_main_frame_url,
       mojo::PendingAssociatedRemote<blink::mojom::WidgetHost> blink_widget_host,
diff --git a/content/renderer/render_widget_screen_metrics_emulator.cc b/content/renderer/render_widget_screen_metrics_emulator.cc
index 7ef03b65..7b25b6e 100644
--- a/content/renderer/render_widget_screen_metrics_emulator.cc
+++ b/content/renderer/render_widget_screen_metrics_emulator.cc
@@ -12,7 +12,7 @@
 
 RenderWidgetScreenMetricsEmulator::RenderWidgetScreenMetricsEmulator(
     RenderWidgetScreenMetricsEmulatorDelegate* delegate,
-    const ScreenInfo& screen_info,
+    const blink::ScreenInfo& screen_info,
     const gfx::Size& widget_size,
     const gfx::Size& visible_viewport_size,
     const gfx::Rect& view_screen_rect,
@@ -130,7 +130,7 @@
   delegate_->SetScreenRects(gfx::Rect(widget_pos, widget_size),
                             gfx::Rect(window_pos, window_size));
 
-  ScreenInfo screen_info = original_screen_info();
+  blink::ScreenInfo screen_info = original_screen_info();
   screen_info.device_scale_factor = device_scale_factor;
   screen_info.rect = screen_rect;
   screen_info.available_rect = screen_rect;
@@ -141,7 +141,7 @@
 }
 
 void RenderWidgetScreenMetricsEmulator::OnSynchronizeVisualProperties(
-    const ScreenInfo& screen_info,
+    const blink::ScreenInfo& screen_info,
     const gfx::Size& widget_size,
     const gfx::Size& visible_viewport_size) {
   original_screen_info_ = screen_info;
diff --git a/content/renderer/render_widget_screen_metrics_emulator.h b/content/renderer/render_widget_screen_metrics_emulator.h
index 469a46d..a5a32d1 100644
--- a/content/renderer/render_widget_screen_metrics_emulator.h
+++ b/content/renderer/render_widget_screen_metrics_emulator.h
@@ -8,7 +8,7 @@
 #include <memory>
 
 #include "content/common/content_export.h"
-#include "content/public/common/screen_info.h"
+#include "third_party/blink/public/common/widget/screen_info.h"
 #include "third_party/blink/public/web/web_device_emulation_params.h"
 #include "ui/gfx/geometry/rect.h"
 #include "ui/gfx/geometry/size.h"
@@ -24,14 +24,14 @@
  public:
   RenderWidgetScreenMetricsEmulator(
       RenderWidgetScreenMetricsEmulatorDelegate* delegate,
-      const ScreenInfo& screen_info,
+      const blink::ScreenInfo& screen_info,
       const gfx::Size& widget_size,
       const gfx::Size& visible_viewport_size,
       const gfx::Rect& view_screen_rect,
       const gfx::Rect& window_screen_rect);
   ~RenderWidgetScreenMetricsEmulator();
 
-  const ScreenInfo& original_screen_info() const {
+  const blink::ScreenInfo& original_screen_info() const {
     return original_screen_info_;
   }
   // This rect is the WidgetScreenRect or ViewRect, which is the main frame
@@ -59,7 +59,7 @@
   // Sets new parameters and applies them to the RenderWidget.
   void ChangeEmulationParams(const blink::WebDeviceEmulationParams& params);
 
-  void OnSynchronizeVisualProperties(const ScreenInfo& screen_info,
+  void OnSynchronizeVisualProperties(const blink::ScreenInfo& screen_info,
                                      const gfx::Size& widget_size,
                                      const gfx::Size& visible_viewport_size);
   void OnUpdateScreenRects(const gfx::Rect& view_screen_rect,
@@ -80,7 +80,7 @@
   blink::WebDeviceEmulationParams emulation_params_;
 
   // Original values to restore back after emulation ends.
-  ScreenInfo original_screen_info_;
+  blink::ScreenInfo original_screen_info_;
   gfx::Size original_widget_size_;
   gfx::Size original_visible_viewport_size_;
   gfx::Rect original_view_screen_rect_;
diff --git a/content/renderer/render_widget_screen_metrics_emulator_delegate.h b/content/renderer/render_widget_screen_metrics_emulator_delegate.h
index 2ad2536..414323e 100644
--- a/content/renderer/render_widget_screen_metrics_emulator_delegate.h
+++ b/content/renderer/render_widget_screen_metrics_emulator_delegate.h
@@ -6,6 +6,7 @@
 #define CONTENT_RENDERER_RENDER_WIDGET_SCREEN_METRICS_EMULATOR_DELEGATE_H_
 
 #include "content/common/content_export.h"
+#include "third_party/blink/public/common/widget/screen_info.h"
 
 namespace blink {
 struct WebDeviceEmulationParams;
@@ -23,7 +24,7 @@
       const blink::WebDeviceEmulationParams& params) = 0;
 
   // Passes an updated ScreenInfo and sizes to the delegate.
-  virtual void SetScreenInfoAndSize(const ScreenInfo& screen_info,
+  virtual void SetScreenInfoAndSize(const blink::ScreenInfo& screen_info,
                                     const gfx::Size& widget_size,
                                     const gfx::Size& visible_viewport_size) = 0;
 
diff --git a/content/renderer/render_widget_unittest.cc b/content/renderer/render_widget_unittest.cc
index f3cb4cb..5c83b78c 100644
--- a/content/renderer/render_widget_unittest.cc
+++ b/content/renderer/render_widget_unittest.cc
@@ -24,7 +24,6 @@
 #include "content/common/frame_replication_state.h"
 #include "content/common/input_messages.h"
 #include "content/common/view_messages.h"
-#include "content/common/visual_properties.h"
 #include "content/common/widget_messages.h"
 #include "content/public/common/content_features.h"
 #include "content/public/test/fake_render_widget_host.h"
@@ -40,6 +39,7 @@
 #include "testing/gtest/include/gtest/gtest.h"
 #include "third_party/blink/public/common/input/synthetic_web_input_event_builders.h"
 #include "third_party/blink/public/common/input/web_coalesced_input_event.h"
+#include "third_party/blink/public/common/widget/visual_properties.h"
 #include "third_party/blink/public/mojom/input/input_handler.mojom.h"
 #include "third_party/blink/public/mojom/page/widget.mojom-test-utils.h"
 #include "third_party/blink/public/platform/scheduler/test/renderer_scheduler_test_support.h"
@@ -156,7 +156,7 @@
                      /*is_hidden=*/false,
                      /*never_composited=*/false) {}
 
-  void Init(blink::WebWidget* widget, const ScreenInfo& screen_info) {
+  void Init(blink::WebWidget* widget, const blink::ScreenInfo& screen_info) {
     Initialize(base::NullCallback(), widget, screen_info);
   }
 
@@ -243,7 +243,7 @@
         widget_.get(), web_local_frame_, frame_widget_host.Unbind(),
         std::move(frame_widget_receiver), widget_host.Unbind(),
         std::move(widget_receiver));
-    widget_->Init(web_frame_widget_, ScreenInfo());
+    widget_->Init(web_frame_widget_, blink::ScreenInfo());
     web_view_->DidAttachLocalMainFrame();
   }
 
@@ -297,7 +297,7 @@
         std::move(widget_host_remote), std::move(widget_receiver));
 
     widget_ = std::make_unique<InteractiveRenderWidget>(&compositor_deps_);
-    widget_->Init(external_web_widget_.get(), ScreenInfo());
+    widget_->Init(external_web_widget_.get(), blink::ScreenInfo());
   }
 
   void TearDown() override {
@@ -539,7 +539,7 @@
   viz::ParentLocalSurfaceIdAllocator allocator;
 
   // Enable auto-resize.
-  content::VisualProperties visual_properties;
+  blink::VisualProperties visual_properties;
   visual_properties.auto_resize_enabled = true;
   visual_properties.min_size_for_auto_resize = gfx::Size(100, 100);
   visual_properties.max_size_for_auto_resize = gfx::Size(200, 200);
@@ -591,7 +591,7 @@
 TEST_F(RenderWidgetUnittest, ActivePinchGestureUpdatesLayerTreeHostSubFrame) {
   cc::LayerTreeHost* layer_tree_host = widget()->layer_tree_host();
   EXPECT_FALSE(layer_tree_host->is_external_pinch_gesture_active_for_testing());
-  content::VisualProperties visual_properties;
+  blink::VisualProperties visual_properties;
 
   // Sync visual properties on a child RenderWidget.
   visual_properties.is_pinch_gesture_active = true;
diff --git a/content/shell/renderer/web_test/web_widget_test_proxy.cc b/content/shell/renderer/web_test/web_widget_test_proxy.cc
index 3b022be..71e8873 100644
--- a/content/shell/renderer/web_test/web_widget_test_proxy.cc
+++ b/content/shell/renderer/web_test/web_widget_test_proxy.cc
@@ -135,8 +135,8 @@
   event_sender_.DoDragDrop(data, mask);
 }
 
-blink::WebScreenInfo WebWidgetTestProxy::GetScreenInfo() {
-  blink::WebScreenInfo info = RenderWidget::GetScreenInfo();
+blink::ScreenInfo WebWidgetTestProxy::GetScreenInfo() {
+  blink::ScreenInfo info = RenderWidget::GetScreenInfo();
 
   MockScreenOrientationClient* mock_client =
       GetTestRunner()->GetMockScreenOrientationClient();
diff --git a/content/shell/renderer/web_test/web_widget_test_proxy.h b/content/shell/renderer/web_test/web_widget_test_proxy.h
index a786d510..ad66a4a 100644
--- a/content/shell/renderer/web_test/web_widget_test_proxy.h
+++ b/content/shell/renderer/web_test/web_widget_test_proxy.h
@@ -77,7 +77,7 @@
                      blink::WebDragOperationsMask mask,
                      const SkBitmap& drag_image,
                      const gfx::Point& image_offset) override;
-  blink::WebScreenInfo GetScreenInfo() override;
+  blink::ScreenInfo GetScreenInfo() override;
 
   // In the test runner code, it can be expected that the RenderViewImpl will
   // actually be a WebViewTestProxy as the creation of RenderView/Frame/Widget
diff --git a/docs/configuration.md b/docs/configuration.md
index b44a1a7..81cec02 100644
--- a/docs/configuration.md
+++ b/docs/configuration.md
@@ -76,7 +76,7 @@
 
 ## Flags
 
-Example: chrome://flags/#ignore-gpu-blacklist
+Example: chrome://flags/#ignore-gpu-blocklist
 
 These are implemented by adding an entry in [about_flags.cc][about-flags]
 describing the flag, as well as metadata in [flag-metadata][flag-metadata].
@@ -90,7 +90,7 @@
 Permanent flags (those with expiration -1) should only be used when either:
 
 * The flag is regularly used for support/debugging purposes, by asking users to
-  flip it to eliminate a possible problem (such as ignore-gpu-blacklist)
+  flip it to eliminate a possible problem (such as ignore-gpu-blocklist)
 * The flag is used for ongoing QA/test purposes in environments where command-line
   switches can't be used (e.g. on mobile)
 
diff --git a/docs/flag_ownership.md b/docs/flag_ownership.md
index 6e8302d..0f435a4 100644
--- a/docs/flag_ownership.md
+++ b/docs/flag_ownership.md
@@ -44,7 +44,7 @@
 ## I Don't Want My Flag To Expire!
 
 Some flags do not control UI features, but rather are commonly-used debugging
-controls, such as `ignore-gpu-blacklist`. For these flags, see the instructions
+controls, such as `ignore-gpu-blocklist`. For these flags, see the instructions
 at the head of `flag-metadata.json`. Please be very judicious about
 never-expiring flags, since they represent ongoing engineering, test and support
 burden. The flags team will probably only approve your non-expiring flag if:
diff --git a/docs/gpu/debugging_gpu_related_code.md b/docs/gpu/debugging_gpu_related_code.md
index 27f3c2ce..af232c3 100644
--- a/docs/gpu/debugging_gpu_related_code.md
+++ b/docs/gpu/debugging_gpu_related_code.md
@@ -56,7 +56,7 @@
 **Note:** If `about:gpu` is telling you that your GPU is disabled and
 hardware acceleration is unavailable, it might be a problem with your GPU being
 unsupported. To override this and turn on hardware acceleration anyway, you can
-use the `--ignore-gpu-blacklist` command line option when starting Chromium.
+use the `--ignore-gpu-blocklist` command line option when starting Chromium.
 
 ### Breaking on GL Error
 
diff --git a/docs/gpu/vaapi.md b/docs/gpu/vaapi.md
index d8f6d67..4b8e44c 100644
--- a/docs/gpu/vaapi.md
+++ b/docs/gpu/vaapi.md
@@ -205,11 +205,11 @@
 up.
 
 To run Chromium using VaAPI two arguments are necessary:
-* `--ignore-gpu-blacklist`
+* `--ignore-gpu-blocklist`
 * `--use-gl=desktop` or `--use-gl=egl`
 
 ```shell
-./out/gn/chrome --ignore-gpu-blacklist --use-gl=egl
+./out/gn/chrome --ignore-gpu-blocklist --use-gl=egl
 ```
 
 Note that you can set the environment variable `MESA_GLSL_CACHE_DISABLE=false`
diff --git a/extensions/browser/api/networking_config/networking_config_service.cc b/extensions/browser/api/networking_config/networking_config_service.cc
index 1e35be51..025f907 100644
--- a/extensions/browser/api/networking_config/networking_config_service.cc
+++ b/extensions/browser/api/networking_config/networking_config_service.cc
@@ -162,42 +162,35 @@
   }
 }
 
-void NetworkingConfigService::OnGotProperties(
+void NetworkingConfigService::OnGetProperties(
     const std::string& extension_id,
     const std::string& guid,
     const base::Closure& authentication_callback,
     const std::string& service_path,
-    const base::DictionaryValue& onc_network_config) {
+    base::Optional<base::Value> onc_network_config,
+    base::Optional<std::string> error) {
+  if (!onc_network_config) {
+    LOG(WARNING) << "Failed to determine BSSID for network with guid " << guid
+                 << ": " << error.value_or("Failed");
+    std::unique_ptr<Event> event =
+        CreatePortalDetectedEventAndDispatch(extension_id, guid, nullptr);
+    EventRouter::Get(browser_context_)
+        ->DispatchEventToExtension(extension_id, std::move(event));
+    return;
+  }
   authentication_result_ = NetworkingConfigService::AuthenticationResult(
       std::string(), guid, NetworkingConfigService::NOTRY);
   authentication_callback_ = authentication_callback;
 
   // Try to extract |bssid| field.
-  const base::DictionaryValue* wifi_with_state = nullptr;
-  std::string bssid;
-  std::unique_ptr<Event> event;
-  if (onc_network_config.GetDictionaryWithoutPathExpansion(
-          ::onc::network_config::kWiFi, &wifi_with_state) &&
-      wifi_with_state->GetStringWithoutPathExpansion(::onc::wifi::kBSSID,
-                                                     &bssid)) {
-    event = CreatePortalDetectedEventAndDispatch(extension_id, guid, &bssid);
-  } else {
-    event = CreatePortalDetectedEventAndDispatch(extension_id, guid, nullptr);
-  }
-
-  EventRouter::Get(browser_context_)
-      ->DispatchEventToExtension(extension_id, std::move(event));
-}
-
-void NetworkingConfigService::OnGetPropertiesFailed(
-    const std::string& extension_id,
-    const std::string& guid,
-    const std::string& error_name,
-    std::unique_ptr<base::DictionaryValue> error_data) {
-  LOG(WARNING) << "Failed to determine BSSID for network with guid " << guid
-               << ": " << error_name;
+  const base::Value* wifi_with_state =
+      onc_network_config->FindDictKey(::onc::network_config::kWiFi);
+  const std::string* bssid =
+      wifi_with_state ? wifi_with_state->FindStringKey(::onc::wifi::kBSSID)
+                      : nullptr;
   std::unique_ptr<Event> event =
-      CreatePortalDetectedEventAndDispatch(extension_id, guid, nullptr);
+      CreatePortalDetectedEventAndDispatch(extension_id, guid, bssid);
+
   EventRouter::Get(browser_context_)
       ->DispatchEventToExtension(extension_id, std::move(event));
 }
@@ -252,11 +245,9 @@
   // that are not affected by policy, i.e BSSID.
   network_handler->managed_network_configuration_handler()->GetProperties(
       "" /* empty userhash */, service_path,
-      base::BindOnce(&NetworkingConfigService::OnGotProperties,
+      base::BindOnce(&NetworkingConfigService::OnGetProperties,
                      weak_factory_.GetWeakPtr(), extension_id, guid,
-                     authentication_callback),
-      base::Bind(&NetworkingConfigService::OnGetPropertiesFailed,
-                 weak_factory_.GetWeakPtr(), extension_id, guid));
+                     authentication_callback));
 }
 
 }  // namespace extensions
diff --git a/extensions/browser/api/networking_config/networking_config_service.h b/extensions/browser/api/networking_config/networking_config_service.h
index bb579a9..e43f354 100644
--- a/extensions/browser/api/networking_config/networking_config_service.h
+++ b/extensions/browser/api/networking_config/networking_config_service.h
@@ -107,16 +107,12 @@
       const base::Closure& authentication_callback);
 
  private:
-  void OnGotProperties(const std::string& extension_id,
+  void OnGetProperties(const std::string& extension_id,
                        const std::string& guid,
                        const base::Closure& authentication_callback,
                        const std::string& service_path,
-                       const base::DictionaryValue& onc_network_config);
-
-  void OnGetPropertiesFailed(const std::string& extension_id,
-                             const std::string& guid,
-                             const std::string& error_name,
-                             std::unique_ptr<base::DictionaryValue> error_data);
+                       base::Optional<base::Value> onc_network_config,
+                       base::Optional<std::string> error);
 
   // Creates the captive portal event about the network with guid |guid| that is
   // to be dispatched to the extension identified by |extension_id|. |bssid|
diff --git a/extensions/browser/api/networking_private/networking_private_api.cc b/extensions/browser/api/networking_private/networking_private_api.cc
index ef2ad1c..38410b8 100644
--- a/extensions/browser/api/networking_private/networking_private_api.cc
+++ b/extensions/browser/api/networking_private/networking_private_api.cc
@@ -29,12 +29,12 @@
 
 const char kPrivateOnlyError[] = "Requires networkingPrivate API access.";
 
-const char* const kPrivatePropertiesForSet[] = {
+const char* const kPrivatePropertyPathsForSet[] = {
     "Cellular.APN", "ProxySettings", "StaticIPConfig", "VPN.Host",
     "VPN.IPsec",    "VPN.L2TP",      "VPN.OpenVPN",    "VPN.ThirdPartyVPN",
 };
 
-const char* const kPrivatePropertiesForGet[] = {
+const char* const kPrivatePropertyPathsForGet[] = {
     "Cellular.APN",  "Cellular.APNList", "Cellular.LastGoodAPN",
     "Cellular.ESN",  "Cellular.ICCID",   "Cellular.IMEI",
     "Cellular.IMSI", "Cellular.MDN",     "Cellular.MEID",
@@ -66,7 +66,7 @@
 // Filters out all properties that are not allowed for the extension in the
 // provided context.
 // Returns list of removed keys.
-std::vector<std::string> FilterProperties(base::DictionaryValue* properties,
+std::vector<std::string> FilterProperties(base::Value* properties,
                                           PropertiesType type,
                                           const Extension* extension,
                                           Feature::Context context,
@@ -77,17 +77,18 @@
   const char* const* filter = nullptr;
   size_t filter_size = 0;
   if (type == PropertiesType::GET) {
-    filter = kPrivatePropertiesForGet;
-    filter_size = base::size(kPrivatePropertiesForGet);
+    filter = kPrivatePropertyPathsForGet;
+    filter_size = base::size(kPrivatePropertyPathsForGet);
   } else {
-    filter = kPrivatePropertiesForSet;
-    filter_size = base::size(kPrivatePropertiesForSet);
+    filter = kPrivatePropertyPathsForSet;
+    filter_size = base::size(kPrivatePropertyPathsForSet);
   }
 
   std::vector<std::string> removed_properties;
   for (size_t i = 0; i < filter_size; ++i) {
-    base::Value property;
-    if (properties->Remove(filter[i], nullptr)) {
+    // networkingPrivate uses sub dictionaries for Shill properties with a
+    // '.' separator, so we use RemovePath here, not RemoveKey.
+    if (properties->RemovePath(filter[i])) {
       removed_properties.push_back(filter[i]);
     }
   }
@@ -156,23 +157,23 @@
   GetDelegate(browser_context())
       ->GetProperties(
           params->network_guid,
-          base::Bind(&NetworkingPrivateGetPropertiesFunction::Success, this),
-          base::Bind(&NetworkingPrivateGetPropertiesFunction::Failure, this));
+          base::Bind(&NetworkingPrivateGetPropertiesFunction::Result, this));
   // Success() or Failure() might have been called synchronously at this point.
   // In that case this function has already called Respond(). Return
   // AlreadyResponded() in that case.
   return did_respond() ? AlreadyResponded() : RespondLater();
 }
 
-void NetworkingPrivateGetPropertiesFunction::Success(
-    std::unique_ptr<base::DictionaryValue> result) {
-  FilterProperties(result.get(), PropertiesType::GET, extension(),
+void NetworkingPrivateGetPropertiesFunction::Result(
+    base::Optional<base::Value> result,
+    base::Optional<std::string> error) {
+  if (!result) {
+    Respond(Error(error.value_or("Failed")));
+    return;
+  }
+  FilterProperties(&result.value(), PropertiesType::GET, extension(),
                    source_context_type(), source_url());
-  Respond(OneArgument(std::move(result)));
-}
-
-void NetworkingPrivateGetPropertiesFunction::Failure(const std::string& error) {
-  Respond(Error(error));
+  Respond(OneArgument(base::Value::ToUniquePtrValue(std::move(*result))));
 }
 
 ////////////////////////////////////////////////////////////////////////////////
@@ -191,9 +192,7 @@
   GetDelegate(browser_context())
       ->GetManagedProperties(
           params->network_guid,
-          base::Bind(&NetworkingPrivateGetManagedPropertiesFunction::Success,
-                     this),
-          base::Bind(&NetworkingPrivateGetManagedPropertiesFunction::Failure,
+          base::Bind(&NetworkingPrivateGetManagedPropertiesFunction::Result,
                      this));
   // Success() or Failure() might have been called synchronously at this point.
   // In that case this function has already called Respond(). Return
@@ -201,16 +200,16 @@
   return did_respond() ? AlreadyResponded() : RespondLater();
 }
 
-void NetworkingPrivateGetManagedPropertiesFunction::Success(
-    std::unique_ptr<base::DictionaryValue> result) {
-  FilterProperties(result.get(), PropertiesType::GET, extension(),
+void NetworkingPrivateGetManagedPropertiesFunction::Result(
+    base::Optional<base::Value> result,
+    base::Optional<std::string> error) {
+  if (!result) {
+    Respond(Error(error.value_or("Failed")));
+    return;
+  }
+  FilterProperties(&result.value(), PropertiesType::GET, extension(),
                    source_context_type(), source_url());
-  Respond(OneArgument(std::move(result)));
-}
-
-void NetworkingPrivateGetManagedPropertiesFunction::Failure(
-    const std::string& error) {
-  Respond(Error(error));
+  Respond(OneArgument(base::Value::ToUniquePtrValue(std::move(*result))));
 }
 
 ////////////////////////////////////////////////////////////////////////////////
diff --git a/extensions/browser/api/networking_private/networking_private_api.h b/extensions/browser/api/networking_private/networking_private_api.h
index 7a8891e..33b6902 100644
--- a/extensions/browser/api/networking_private/networking_private_api.h
+++ b/extensions/browser/api/networking_private/networking_private_api.h
@@ -9,6 +9,7 @@
 #include <string>
 
 #include "base/macros.h"
+#include "base/optional.h"
 #include "base/values.h"
 #include "extensions/browser/extension_function.h"
 
@@ -43,8 +44,8 @@
   ResponseAction Run() override;
 
  private:
-  void Success(std::unique_ptr<base::DictionaryValue> result);
-  void Failure(const std::string& error_name);
+  void Result(base::Optional<base::Value> result,
+              base::Optional<std::string> error);
 
   DISALLOW_COPY_AND_ASSIGN(NetworkingPrivateGetPropertiesFunction);
 };
@@ -63,8 +64,8 @@
   ResponseAction Run() override;
 
  private:
-  void Success(std::unique_ptr<base::DictionaryValue> result);
-  void Failure(const std::string& error);
+  void Result(base::Optional<base::Value> result,
+              base::Optional<std::string> error);
 
   DISALLOW_COPY_AND_ASSIGN(NetworkingPrivateGetManagedPropertiesFunction);
 };
diff --git a/extensions/browser/api/networking_private/networking_private_chromeos.cc b/extensions/browser/api/networking_private/networking_private_chromeos.cc
index 2ca1b83..07d6448 100644
--- a/extensions/browser/api/networking_private/networking_private_chromeos.cc
+++ b/extensions/browser/api/networking_private/networking_private_chromeos.cc
@@ -174,34 +174,31 @@
 // Returns the string corresponding to |key|. If the property is a managed
 // dictionary, returns the active value. If the property does not exist or
 // has no active value, returns an empty string.
-std::string GetStringFromDictionary(const base::DictionaryValue& dictionary,
+std::string GetStringFromDictionary(const base::Value& dictionary,
                                     const std::string& key) {
-  std::string result;
-  if (!dictionary.GetStringWithoutPathExpansion(key, &result)) {
-    const base::DictionaryValue* managed = nullptr;
-    if (dictionary.GetDictionaryWithoutPathExpansion(key, &managed)) {
-      managed->GetStringWithoutPathExpansion(::onc::kAugmentationActiveSetting,
-                                             &result);
-    }
-  }
-  return result;
+  const std::string* result = dictionary.FindStringKey(key);
+  if (result)
+    return *result;
+  const base::Value* managed = dictionary.FindDictKey(key);
+  if (managed)
+    result = managed->FindStringKey(::onc::kAugmentationActiveSetting);
+  return result ? *result : std::string();
 }
 
-base::DictionaryValue* GetThirdPartyVPNDictionary(
-    base::DictionaryValue* dictionary) {
+base::Value* GetThirdPartyVPNDictionary(base::Value* dictionary) {
   const std::string type =
       GetStringFromDictionary(*dictionary, ::onc::network_config::kType);
   if (type != ::onc::network_config::kVPN)
     return nullptr;
-  base::DictionaryValue* vpn_dict = nullptr;
-  if (!dictionary->GetDictionary(::onc::network_config::kVPN, &vpn_dict))
+  base::Value* vpn_dict = dictionary->FindDictKey(::onc::network_config::kVPN);
+  if (!vpn_dict)
     return nullptr;
   if (GetStringFromDictionary(*vpn_dict, ::onc::vpn::kType) !=
       ::onc::vpn::kThirdPartyVpn) {
     return nullptr;
   }
-  base::DictionaryValue* third_party_vpn = nullptr;
-  vpn_dict->GetDictionary(::onc::vpn::kThirdPartyVpn, &third_party_vpn);
+  base::Value* third_party_vpn =
+      dictionary->FindDictKey(::onc::vpn::kThirdPartyVpn);
   return third_party_vpn;
 }
 
@@ -248,52 +245,51 @@
 
 NetworkingPrivateChromeOS::~NetworkingPrivateChromeOS() {}
 
-void NetworkingPrivateChromeOS::GetProperties(
-    const std::string& guid,
-    const DictionaryCallback& success_callback,
-    const FailureCallback& failure_callback) {
+void NetworkingPrivateChromeOS::GetProperties(const std::string& guid,
+                                              PropertiesCallback callback) {
   std::string service_path, error;
   if (!GetServicePathFromGuid(guid, &service_path, &error)) {
-    failure_callback.Run(error);
+    NET_LOG(ERROR) << "GetProperties failed: " << error;
+    std::move(callback).Run(base::nullopt, error);
     return;
   }
 
   std::string user_id_hash;
   if (!GetPrimaryUserIdHash(browser_context_, &user_id_hash, &error)) {
-    failure_callback.Run(error);
+    NET_LOG(ERROR) << "GetProperties failed: " << error;
+    std::move(callback).Run(base::nullopt, error);
     return;
   }
 
   GetManagedConfigurationHandler()->GetProperties(
       user_id_hash, service_path,
       base::BindOnce(&NetworkingPrivateChromeOS::GetPropertiesCallback,
-                     weak_ptr_factory_.GetWeakPtr(), guid, false /* managed */,
-                     success_callback),
-      base::Bind(&NetworkHandlerFailureCallback, failure_callback));
+                     weak_ptr_factory_.GetWeakPtr(), guid,
+                     std::move(callback)));
 }
 
 void NetworkingPrivateChromeOS::GetManagedProperties(
     const std::string& guid,
-    const DictionaryCallback& success_callback,
-    const FailureCallback& failure_callback) {
+    PropertiesCallback callback) {
   std::string service_path, error;
   if (!GetServicePathFromGuid(guid, &service_path, &error)) {
-    failure_callback.Run(error);
+    NET_LOG(ERROR) << "GetManagedProperties failed: " << error;
+    std::move(callback).Run(base::nullopt, error);
     return;
   }
 
   std::string user_id_hash;
   if (!GetPrimaryUserIdHash(browser_context_, &user_id_hash, &error)) {
-    failure_callback.Run(error);
+    NET_LOG(ERROR) << "GetManagedProperties failed: " << error;
+    std::move(callback).Run(base::nullopt, error);
     return;
   }
 
   GetManagedConfigurationHandler()->GetManagedProperties(
       user_id_hash, service_path,
       base::BindOnce(&NetworkingPrivateChromeOS::GetPropertiesCallback,
-                     weak_ptr_factory_.GetWeakPtr(), guid, true /* managed */,
-                     success_callback),
-      base::Bind(&NetworkHandlerFailureCallback, failure_callback));
+                     weak_ptr_factory_.GetWeakPtr(), guid,
+                     std::move(callback)));
 }
 
 void NetworkingPrivateChromeOS::GetState(
@@ -735,20 +731,18 @@
 
 void NetworkingPrivateChromeOS::GetPropertiesCallback(
     const std::string& guid,
-    bool managed,
-    const DictionaryCallback& callback,
+    PropertiesCallback callback,
     const std::string& service_path,
-    const base::DictionaryValue& dictionary) {
-  std::unique_ptr<base::DictionaryValue> dictionary_copy =
-      dictionary.CreateDeepCopy();
-  AppendThirdPartyProviderName(dictionary_copy.get());
-  callback.Run(std::move(dictionary_copy));
+    base::Optional<base::Value> dictionary,
+    base::Optional<std::string> error) {
+  if (dictionary)
+    AppendThirdPartyProviderName(&dictionary.value());
+  std::move(callback).Run(std::move(dictionary), std::move(error));
 }
 
 void NetworkingPrivateChromeOS::AppendThirdPartyProviderName(
-    base::DictionaryValue* dictionary) {
-  base::DictionaryValue* third_party_vpn =
-      GetThirdPartyVPNDictionary(dictionary);
+    base::Value* dictionary) {
+  base::Value* third_party_vpn = GetThirdPartyVPNDictionary(dictionary);
   if (!third_party_vpn)
     return;
 
diff --git a/extensions/browser/api/networking_private/networking_private_chromeos.h b/extensions/browser/api/networking_private/networking_private_chromeos.h
index fc8be6f..33e87c27 100644
--- a/extensions/browser/api/networking_private/networking_private_chromeos.h
+++ b/extensions/browser/api/networking_private/networking_private_chromeos.h
@@ -10,12 +10,10 @@
 
 #include "base/macros.h"
 #include "base/memory/weak_ptr.h"
+#include "base/optional.h"
+#include "base/values.h"
 #include "extensions/browser/api/networking_private/networking_private_delegate.h"
 
-namespace base {
-class DictionaryValue;
-}
-
 namespace content {
 class BrowserContext;
 }
@@ -32,11 +30,9 @@
 
   // NetworkingPrivateApi
   void GetProperties(const std::string& guid,
-                     const DictionaryCallback& success_callback,
-                     const FailureCallback& failure_callback) override;
+                     PropertiesCallback callback) override;
   void GetManagedProperties(const std::string& guid,
-                            const DictionaryCallback& success_callback,
-                            const FailureCallback& failure_callback) override;
+                            PropertiesCallback callback) override;
   void GetState(const std::string& guid,
                 const DictionaryCallback& success_callback,
                 const FailureCallback& failure_callback) override;
@@ -101,15 +97,15 @@
   // |dictionary| and appends any networkingPrivate API specific properties,
   // then calls |callback| with the result.
   void GetPropertiesCallback(const std::string& guid,
-                             bool managed,
-                             const DictionaryCallback& callback,
+                             PropertiesCallback callback,
                              const std::string& service_path,
-                             const base::DictionaryValue& dictionary);
+                             base::Optional<base::Value> dictionary,
+                             base::Optional<std::string> error);
 
   // Populate ThirdPartyVPN.ProviderName with the provider name for third-party
   // VPNs. The provider name needs to be looked up from the list of extensions
   // which is not available to the chromeos/network module.
-  void AppendThirdPartyProviderName(base::DictionaryValue* dictionary);
+  void AppendThirdPartyProviderName(base::Value* dictionary);
 
   content::BrowserContext* browser_context_;
   base::WeakPtrFactory<NetworkingPrivateChromeOS> weak_ptr_factory_{this};
diff --git a/extensions/browser/api/networking_private/networking_private_delegate.h b/extensions/browser/api/networking_private/networking_private_delegate.h
index 59f2da4..62dac59 100644
--- a/extensions/browser/api/networking_private/networking_private_delegate.h
+++ b/extensions/browser/api/networking_private/networking_private_delegate.h
@@ -11,6 +11,7 @@
 
 #include "base/callback.h"
 #include "base/macros.h"
+#include "base/optional.h"
 #include "base/values.h"
 #include "components/keyed_service/core/keyed_service.h"
 #include "extensions/common/api/networking_private.h"
@@ -35,6 +36,11 @@
   using DeviceStateList = std::vector<
       std::unique_ptr<api::networking_private::DeviceStateProperties>>;
 
+  // Returns |result| on success, or |result|=nullopt and |error| on failure.
+  using PropertiesCallback =
+      base::OnceCallback<void(base::Optional<base::Value> result,
+                              base::Optional<std::string> error)>;
+
   // Delegate for forwarding UI requests, e.g. for showing the account UI.
   class UIDelegate {
    public:
@@ -60,12 +66,9 @@
 
   // Asynchronous methods
   virtual void GetProperties(const std::string& guid,
-                             const DictionaryCallback& success_callback,
-                             const FailureCallback& failure_callback) = 0;
-  virtual void GetManagedProperties(
-      const std::string& guid,
-      const DictionaryCallback& success_callback,
-      const FailureCallback& failure_callback) = 0;
+                             PropertiesCallback callback) = 0;
+  virtual void GetManagedProperties(const std::string& guid,
+                                    PropertiesCallback callback) = 0;
   virtual void GetState(const std::string& guid,
                         const DictionaryCallback& success_callback,
                         const FailureCallback& failure_callback) = 0;
diff --git a/extensions/browser/api/networking_private/networking_private_linux.cc b/extensions/browser/api/networking_private/networking_private_linux.cc
index a356a32..1c4712f 100644
--- a/extensions/browser/api/networking_private/networking_private_linux.cc
+++ b/extensions/browser/api/networking_private/networking_private_linux.cc
@@ -132,6 +132,20 @@
   success_callback.Run(std::move(properties));
 }
 
+// Fires the appropriate callback when the network properties are returned
+// from the |dbus_thread_|.
+void GetCachedNetworkPropertiesResultCallback(
+    std::unique_ptr<std::string> error,
+    std::unique_ptr<base::DictionaryValue> properties,
+    NetworkingPrivateDelegate::PropertiesCallback callback) {
+  if (!error->empty()) {
+    LOG(ERROR) << "GetCachedNetworkProperties failed: " << *error;
+    std::move(callback).Run(base::nullopt, *error);
+    return;
+  }
+  std::move(callback).Run(std::move(*properties), base::nullopt);
+}
+
 }  // namespace
 
 NetworkingPrivateLinux::NetworkingPrivateLinux()
@@ -189,18 +203,38 @@
   return true;
 }
 
-void NetworkingPrivateLinux::GetProperties(
-    const std::string& guid,
-    const DictionaryCallback& success_callback,
-    const FailureCallback& failure_callback) {
-  GetState(guid, success_callback, failure_callback);
+void NetworkingPrivateLinux::GetProperties(const std::string& guid,
+                                           PropertiesCallback callback) {
+  if (!network_manager_proxy_) {
+    LOG(WARNING) << "NetworkManager over DBus is not supported";
+    std::move(callback).Run(base::nullopt,
+                            extensions::networking_private::kErrorNotSupported);
+    return;
+  }
+
+  std::unique_ptr<std::string> error(new std::string);
+  std::unique_ptr<base::DictionaryValue> network_properties(
+      new base::DictionaryValue);
+
+  // Runs GetCachedNetworkProperties on |dbus_thread|.
+  std::string* error_ptr = error.get();
+  base::DictionaryValue* network_prop_ptr = network_properties.get();
+  dbus_thread_.task_runner()->PostTaskAndReply(
+      FROM_HERE,
+      base::BindOnce(&NetworkingPrivateLinux::GetCachedNetworkProperties,
+                     base::Unretained(this), guid,
+                     base::Unretained(network_prop_ptr),
+                     base::Unretained(error_ptr)),
+      base::BindOnce(&GetCachedNetworkPropertiesResultCallback,
+                     base::Passed(&error), base::Passed(&network_properties),
+                     std::move(callback)));
 }
 
-void NetworkingPrivateLinux::GetManagedProperties(
-    const std::string& guid,
-    const DictionaryCallback& success_callback,
-    const FailureCallback& failure_callback) {
-  ReportNotSupported("GetManagedProperties", failure_callback);
+void NetworkingPrivateLinux::GetManagedProperties(const std::string& guid,
+                                                  PropertiesCallback callback) {
+  LOG(WARNING) << "GetManagedProperties is not supported";
+  std::move(callback).Run(base::nullopt,
+                          extensions::networking_private::kErrorNotSupported);
 }
 
 void NetworkingPrivateLinux::GetState(
diff --git a/extensions/browser/api/networking_private/networking_private_linux.h b/extensions/browser/api/networking_private/networking_private_linux.h
index 75528d5..a677d152 100644
--- a/extensions/browser/api/networking_private/networking_private_linux.h
+++ b/extensions/browser/api/networking_private/networking_private_linux.h
@@ -37,11 +37,9 @@
 
   // NetworkingPrivateDelegate
   void GetProperties(const std::string& guid,
-                     const DictionaryCallback& success_callback,
-                     const FailureCallback& failure_callback) override;
+                     PropertiesCallback callback) override;
   void GetManagedProperties(const std::string& guid,
-                            const DictionaryCallback& success_callback,
-                            const FailureCallback& failure_callback) override;
+                            PropertiesCallback callback) override;
   void GetState(const std::string& guid,
                 const DictionaryCallback& success_callback,
                 const FailureCallback& failure_callback) override;
diff --git a/extensions/browser/api/networking_private/networking_private_service_client.cc b/extensions/browser/api/networking_private/networking_private_service_client.cc
index 4a168849..ddd8b6a8 100644
--- a/extensions/browser/api/networking_private/networking_private_service_client.cc
+++ b/extensions/browser/api/networking_private/networking_private_service_client.cc
@@ -42,11 +42,9 @@
 
 }  // namespace
 
-NetworkingPrivateServiceClient::ServiceCallbacks::ServiceCallbacks() {
-}
+NetworkingPrivateServiceClient::ServiceCallbacks::ServiceCallbacks() {}
 
-NetworkingPrivateServiceClient::ServiceCallbacks::~ServiceCallbacks() {
-}
+NetworkingPrivateServiceClient::ServiceCallbacks::~ServiceCallbacks() {}
 
 NetworkingPrivateServiceClient::NetworkingPrivateServiceClient(
     std::unique_ptr<WiFiService> wifi_service)
@@ -123,12 +121,7 @@
 
 void NetworkingPrivateServiceClient::GetProperties(
     const std::string& guid,
-    const DictionaryCallback& success_callback,
-    const FailureCallback& failure_callback) {
-  ServiceCallbacks* service_callbacks = AddServiceCallbacks();
-  service_callbacks->failure_callback = failure_callback;
-  service_callbacks->get_properties_callback = success_callback;
-
+    PropertiesCallback callback) {
   std::unique_ptr<base::DictionaryValue> properties(new base::DictionaryValue);
   std::string* error = new std::string;
 
@@ -139,18 +132,13 @@
                      base::Unretained(wifi_service_.get()), guid,
                      properties_ptr, error),
       base::BindOnce(&NetworkingPrivateServiceClient::AfterGetProperties,
-                     weak_factory_.GetWeakPtr(), service_callbacks->id, guid,
+                     weak_factory_.GetWeakPtr(), std::move(callback), guid,
                      base::Passed(&properties), base::Owned(error)));
 }
 
 void NetworkingPrivateServiceClient::GetManagedProperties(
     const std::string& guid,
-    const DictionaryCallback& success_callback,
-    const FailureCallback& failure_callback) {
-  ServiceCallbacks* service_callbacks = AddServiceCallbacks();
-  service_callbacks->failure_callback = failure_callback;
-  service_callbacks->get_properties_callback = success_callback;
-
+    PropertiesCallback callback) {
   std::unique_ptr<base::DictionaryValue> properties(new base::DictionaryValue);
   std::string* error = new std::string;
 
@@ -161,7 +149,7 @@
                      base::Unretained(wifi_service_.get()), guid,
                      properties_ptr, error),
       base::BindOnce(&NetworkingPrivateServiceClient::AfterGetProperties,
-                     weak_factory_.GetWeakPtr(), service_callbacks->id, guid,
+                     weak_factory_.GetWeakPtr(), std::move(callback), guid,
                      base::Passed(&properties), base::Owned(error)));
 }
 
@@ -182,7 +170,7 @@
       base::BindOnce(&WiFiService::GetState,
                      base::Unretained(wifi_service_.get()), guid,
                      properties_ptr, error),
-      base::BindOnce(&NetworkingPrivateServiceClient::AfterGetProperties,
+      base::BindOnce(&NetworkingPrivateServiceClient::AfterGetState,
                      weak_factory_.GetWeakPtr(), service_callbacks->id, guid,
                      base::Passed(&properties), base::Owned(error)));
 }
@@ -389,6 +377,18 @@
 ////////////////////////////////////////////////////////////////////////////////
 
 void NetworkingPrivateServiceClient::AfterGetProperties(
+    PropertiesCallback callback,
+    const std::string& network_guid,
+    std::unique_ptr<base::DictionaryValue> properties,
+    const std::string* error) {
+  if (!error->empty()) {
+    std::move(callback).Run(base::nullopt, *error);
+    return;
+  }
+  std::move(callback).Run(std::move(*properties), base::nullopt);
+}
+
+void NetworkingPrivateServiceClient::AfterGetState(
     ServiceCallbacksID callback_id,
     const std::string& network_guid,
     std::unique_ptr<base::DictionaryValue> properties,
diff --git a/extensions/browser/api/networking_private/networking_private_service_client.h b/extensions/browser/api/networking_private/networking_private_service_client.h
index 324f1f1b..2269553 100644
--- a/extensions/browser/api/networking_private/networking_private_service_client.h
+++ b/extensions/browser/api/networking_private/networking_private_service_client.h
@@ -47,11 +47,9 @@
 
   // NetworkingPrivateDelegate
   void GetProperties(const std::string& guid,
-                     const DictionaryCallback& success_callback,
-                     const FailureCallback& failure_callback) override;
+                     PropertiesCallback callback) override;
   void GetManagedProperties(const std::string& guid,
-                            const DictionaryCallback& success_callback,
-                            const FailureCallback& failure_callback) override;
+                            PropertiesCallback callback) override;
   void GetState(const std::string& guid,
                 const DictionaryCallback& success_callback,
                 const FailureCallback& failure_callback) override;
@@ -136,10 +134,14 @@
   ~NetworkingPrivateServiceClient() override;
 
   // Callback wrappers.
-  void AfterGetProperties(ServiceCallbacksID callback_id,
+  void AfterGetProperties(PropertiesCallback callback,
                           const std::string& network_guid,
                           std::unique_ptr<base::DictionaryValue> properties,
                           const std::string* error);
+  void AfterGetState(ServiceCallbacksID callback_id,
+                     const std::string& network_guid,
+                     std::unique_ptr<base::DictionaryValue> properties,
+                     const std::string* error);
   void AfterSetProperties(ServiceCallbacksID callback_id,
                           const std::string* error);
   void AfterCreateNetwork(ServiceCallbacksID callback_id,
diff --git a/extensions/browser/api/web_request/web_request_info.h b/extensions/browser/api/web_request/web_request_info.h
index 5063da7..d75e9628 100644
--- a/extensions/browser/api/web_request/web_request_info.h
+++ b/extensions/browser/api/web_request/web_request_info.h
@@ -22,6 +22,7 @@
 #include "extensions/browser/extension_api_frame_id_map.h"
 #include "ipc/ipc_message.h"
 #include "net/http/http_request_headers.h"
+#include "net/http/http_response_headers.h"
 #include "services/network/public/cpp/resource_request.h"
 #include "services/network/public/mojom/url_response_head.mojom-forward.h"
 #include "url/gurl.h"
diff --git a/google_apis/drive/drive_common_callbacks.h b/google_apis/drive/drive_common_callbacks.h
index cc625a6..2613d35 100644
--- a/google_apis/drive/drive_common_callbacks.h
+++ b/google_apis/drive/drive_common_callbacks.h
@@ -23,6 +23,8 @@
 // this type of closure. If it is called during the request is in-flight, the
 // callback passed with the request is invoked with DRIVE_CANCELLED. If the
 // request is already finished, nothing happens.
+typedef base::OnceClosure CancelCallbackOnce;
+// TODO(https://crbug.com/1007686): Remove usage of CancelCallback
 typedef base::Closure CancelCallback;
 
 }  // namespace google_apis
diff --git a/gpu/command_buffer/service/service_utils.cc b/gpu/command_buffer/service/service_utils.cc
index 24a1926..edc6cbb 100644
--- a/gpu/command_buffer/service/service_utils.cc
+++ b/gpu/command_buffer/service/service_utils.cc
@@ -7,6 +7,7 @@
 #include <string>
 
 #include "base/command_line.h"
+#include "base/logging.h"
 #include "base/strings/string_number_conversions.h"
 #include "build/build_config.h"
 #include "gpu/command_buffer/common/gles2_cmd_utils.h"
@@ -159,7 +160,15 @@
   gpu_preferences.use_passthrough_cmd_decoder =
       gpu::gles2::UsePassthroughCommandDecoder(command_line);
   gpu_preferences.ignore_gpu_blocklist =
-      command_line->HasSwitch(switches::kIgnoreGpuBlacklist);
+      command_line->HasSwitch(switches::kIgnoreGpuBlacklist) ||
+      command_line->HasSwitch(switches::kIgnoreGpuBlocklist);
+
+  if (command_line->HasSwitch(switches::kIgnoreGpuBlacklist)) {
+    LOG(ERROR) << "--" << switches::kIgnoreGpuBlacklist
+               << " is deprecated and will be removed in 2020Q4, use --"
+               << switches::kIgnoreGpuBlocklist << " instead.";
+  }
+
   gpu_preferences.enable_webgpu =
       command_line->HasSwitch(switches::kEnableUnsafeWebGPU);
   gpu_preferences.enable_dawn_backend_validation =
diff --git a/gpu/config/gpu_switches.cc b/gpu/config/gpu_switches.cc
index 9df5641..76af74c 100644
--- a/gpu/config/gpu_switches.cc
+++ b/gpu/config/gpu_switches.cc
@@ -26,7 +26,10 @@
 const char kGpuPreferences[] = "gpu-preferences";
 
 // Ignores GPU blocklist.
-// TODO(crbug.com/1101491): migrate to a more intentional name.
+const char kIgnoreGpuBlocklist[] = "ignore-gpu-blocklist";
+
+// Ignores GPU blocklist.
+// TODO(crbug.com/1101491): remove in 2020Q4 in favor of --ignore-gpu-blocklist.
 const char kIgnoreGpuBlacklist[] = "ignore-gpu-blacklist";
 
 // Allows explicitly specifying the shader disk cache size for embedded devices.
diff --git a/gpu/config/gpu_switches.h b/gpu/config/gpu_switches.h
index 55dc444..8d2f036 100644
--- a/gpu/config/gpu_switches.h
+++ b/gpu/config/gpu_switches.h
@@ -14,6 +14,7 @@
 GPU_EXPORT extern const char kGpuBlocklistTestGroup[];
 GPU_EXPORT extern const char kGpuDriverBugListTestGroup[];
 GPU_EXPORT extern const char kGpuPreferences[];
+GPU_EXPORT extern const char kIgnoreGpuBlocklist[];
 GPU_EXPORT extern const char kIgnoreGpuBlacklist[];
 GPU_EXPORT extern const char kShaderDiskCacheSizeKB[];
 GPU_EXPORT extern const char kDisableGpuProcessForDX12InfoCollection[];
diff --git a/infra/config/generated/cr-buildbucket.cfg b/infra/config/generated/cr-buildbucket.cfg
index f35f99c..e8eede12 100644
--- a/infra/config/generated/cr-buildbucket.cfg
+++ b/infra/config/generated/cr-buildbucket.cfg
@@ -11337,6 +11337,35 @@
       }
     }
     builders {
+      name: "metadata_exporter"
+      swarming_host: "chromium-swarm.appspot.com"
+      swarming_tags: "vpython:native-python-wrapper"
+      dimensions: "builderless:1"
+      dimensions: "cores:8"
+      dimensions: "cpu:x86-64"
+      dimensions: "os:Ubuntu-16.04"
+      dimensions: "pool:luci.chromium.ci"
+      dimensions: "ssd:0"
+      exe {
+        cipd_package: "infra/recipe_bundles/chromium.googlesource.com/chromium/tools/build"
+        cipd_version: "refs/heads/master"
+        cmd: "luciexe"
+      }
+      properties: "{\"$build/goma\":{\"enable_ats\":true,\"jobs\":500,\"rpc_extra_params\":\"?prod\",\"server_host\":\"goma.chromium.org\"},\"$kitchen\":{\"devshell\":true,\"git_auth\":true},\"mastername\":\"chromium.linux\",\"recipe\":\"chromium_export_metadata\"}"
+      execution_timeout_secs: 10800
+      build_numbers: YES
+      service_account: "component-mapping-updater@chops-service-accounts.iam.gserviceaccount.com"
+      resultdb {
+        enable: true
+        bq_exports {
+          project: "luci-resultdb"
+          dataset: "chromium"
+          table: "ci_test_results"
+          test_results {}
+        }
+      }
+    }
+    builders {
       name: "win-annotator-rel"
       swarming_host: "chromium-swarm.appspot.com"
       swarming_tags: "vpython:native-python-wrapper"
@@ -33255,11 +33284,11 @@
         cipd_version: "refs/heads/master"
         cmd: "recipes"
       }
-      properties: "{\"$build/goma\":{\"rpc_extra_params\":\"?prod\",\"server_host\":\"goma.chromium.org\"},\"mastername\":\"chromium.webrtc.fyi\",\"recipe\":\"webrtc/chromium_ios\"}"
+      properties: "{\"$build/goma\":{\"rpc_extra_params\":\"?prod\",\"server_host\":\"goma.chromium.org\"},\"mastername\":\"chromium.webrtc.fyi\",\"recipe\":\"webrtc/chromium_ios\",\"xcode_build_version\":\"11e146\"}"
       execution_timeout_secs: 7200
       caches {
-        name: "xcode_ios_11c29"
-        path: "xcode_ios_11c29.app"
+        name: "xcode_ios_11e146"
+        path: "xcode_ios_11e146.app"
       }
       build_numbers: YES
       service_account: "chromium-ci-builder@chops-service-accounts.iam.gserviceaccount.com"
@@ -33279,11 +33308,11 @@
         cipd_version: "refs/heads/master"
         cmd: "recipes"
       }
-      properties: "{\"$build/goma\":{\"rpc_extra_params\":\"?prod\",\"server_host\":\"goma.chromium.org\"},\"mastername\":\"chromium.webrtc.fyi\",\"recipe\":\"webrtc/chromium_ios\"}"
+      properties: "{\"$build/goma\":{\"rpc_extra_params\":\"?prod\",\"server_host\":\"goma.chromium.org\"},\"mastername\":\"chromium.webrtc.fyi\",\"recipe\":\"webrtc/chromium_ios\",\"xcode_build_version\":\"11e146\"}"
       execution_timeout_secs: 7200
       caches {
-        name: "xcode_ios_11c29"
-        path: "xcode_ios_11c29.app"
+        name: "xcode_ios_11e146"
+        path: "xcode_ios_11e146.app"
       }
       build_numbers: YES
       service_account: "chromium-ci-builder@chops-service-accounts.iam.gserviceaccount.com"
diff --git a/infra/config/generated/luci-milo.cfg b/infra/config/generated/luci-milo.cfg
index 6796647..86c6026 100644
--- a/infra/config/generated/luci-milo.cfg
+++ b/infra/config/generated/luci-milo.cfg
@@ -9701,11 +9701,6 @@
     short_name: "anno"
   }
   builders {
-    name: "buildbucket/luci.chromium.ci/linux_chromium_component_updater"
-    category: "week3a|linux"
-    short_name: "cc_upd"
-  }
-  builders {
     name: "buildbucket/luci.chromium.ci/linux-code-coverage"
     category: "week3a|linux"
     short_name: "code"
@@ -15474,6 +15469,19 @@
   builder_view_only: true
 }
 consoles {
+  id: "metadata.exporter"
+  name: "metadata.exporter"
+  repo_url: "https://chromium.googlesource.com/chromium/src"
+  refs: "regexp:refs/heads/master"
+  manifest_name: "REVISION"
+  builders {
+    name: "buildbucket/luci.chromium.ci/linux_chromium_component_updater"
+  }
+  builders {
+    name: "buildbucket/luci.chromium.ci/metadata_exporter"
+  }
+}
+consoles {
   id: "tryserver.blink"
   name: "tryserver.blink"
   builders {
diff --git a/infra/config/generated/luci-notify.cfg b/infra/config/generated/luci-notify.cfg
index 07be0da..17cdee6 100644
--- a/infra/config/generated/luci-notify.cfg
+++ b/infra/config/generated/luci-notify.cfg
@@ -2943,6 +2943,36 @@
 }
 notifiers {
   notifications {
+    on_occurrence: FAILURE
+    failed_step_regexp: "bot_update|compile|gclient runhooks|runhooks|update"
+    email {
+      rotation_urls: "https://chrome-ops-rotation-proxy.appspot.com/current/oncallator:chrome-build-sheriff"
+    }
+  }
+  notifications {
+    on_occurrence: FAILURE
+    failed_step_regexp: "bot_update|compile|gclient runhooks|runhooks|update"
+    email {
+      recipients: "thomasanderson@chromium.org"
+    }
+  }
+  notifications {
+    on_new_status: FAILURE
+    email {
+      recipients: "chromium-component-mapping@google.com"
+    }
+  }
+  builders {
+    bucket: "ci"
+    name: "metadata_exporter"
+  }
+  tree_closers {
+    tree_status_host: "chromium-status.appspot.com"
+    failed_step_regexp: "bot_update|compile|gclient runhooks|runhooks|update"
+  }
+}
+notifiers {
+  notifications {
     on_new_status: FAILURE
     email {
       recipients: "pastarmovj@chromium.org"
diff --git a/infra/config/generated/luci-scheduler.cfg b/infra/config/generated/luci-scheduler.cfg
index 8d4f477..496c080 100644
--- a/infra/config/generated/luci-scheduler.cfg
+++ b/infra/config/generated/luci-scheduler.cfg
@@ -11140,6 +11140,16 @@
   }
 }
 job {
+  id: "metadata_exporter"
+  schedule: "0 0,6,12,18 * * *"
+  acl_sets: "ci"
+  buildbucket {
+    server: "cr-buildbucket.appspot.com"
+    bucket: "luci.chromium.ci"
+    builder: "metadata_exporter"
+  }
+}
+job {
   id: "win-annotator-rel"
   acl_sets: "ci"
   buildbucket {
diff --git a/infra/config/notifiers.star b/infra/config/notifiers.star
index d9f9f7a..6bd2230 100644
--- a/infra/config/notifiers.star
+++ b/infra/config/notifiers.star
@@ -35,7 +35,7 @@
 )
 
 luci.notifier(
-    name = 'component-mapping',
+    name = 'metadata-mapping',
     on_new_status = ['FAILURE'],
     notify_emails = ['chromium-component-mapping@google.com'],
 )
diff --git a/infra/config/recipes.star b/infra/config/recipes.star
index 3fc5310..a898114 100644
--- a/infra/config/recipes.star
+++ b/infra/config/recipes.star
@@ -72,6 +72,11 @@
 )
 
 build_recipe(
+    name = 'recipe:chromium_export_metadata',
+    use_bbagent = True,
+)
+
+build_recipe(
     name = 'recipe:chromium_libfuzzer',
 )
 
diff --git a/infra/config/subprojects/chromium/master-only/ci.star b/infra/config/subprojects/chromium/master-only/ci.star
index e066598d..348a8c9 100644
--- a/infra/config/subprojects/chromium/master-only/ci.star
+++ b/infra/config/subprojects/chromium/master-only/ci.star
@@ -2899,15 +2899,25 @@
     os = os.LINUX_TRUSTY,
 )
 
+# TODO(crbug.com/1102997): remove this in favor of new "metadata_exporter"
+# builder.
 ci.linux_builder(
     name = 'linux_chromium_component_updater',
     executable = 'recipe:findit/chromium/update_components',
     schedule = '0 0,6,12,18 * * *',
     service_account = 'component-mapping-updater@chops-service-accounts.iam.gserviceaccount.com',
     triggered_by = [],
-    extra_notifies = ['component-mapping'],
+    extra_notifies = ['metadata-mapping'],
 )
 
+ci.linux_builder(
+    name = 'metadata_exporter',
+    executable = 'recipe:chromium_export_metadata',
+    schedule = '0 0,6,12,18 * * *',
+    service_account = 'component-mapping-updater@chops-service-accounts.iam.gserviceaccount.com',
+    triggered_by = [],
+    extra_notifies = ['metadata-mapping'],
+)
 
 ci.mac_ios_builder(
     name = 'ios-device',
diff --git a/infra/config/subprojects/chromium/master-only/consoles/metadata.exporter.star b/infra/config/subprojects/chromium/master-only/consoles/metadata.exporter.star
new file mode 100644
index 0000000..989ceeb6
--- /dev/null
+++ b/infra/config/subprojects/chromium/master-only/consoles/metadata.exporter.star
@@ -0,0 +1,18 @@
+# Copyright 2020 The Chromium Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+luci.console_view(
+    name = 'metadata.exporter',
+    repo = 'https://chromium.googlesource.com/chromium/src',
+    entries = [
+        # TODO(crbug.com/1102997): remove this in favor of new
+        # "metadata_exporter" builder.
+        luci.console_view_entry(
+            builder = 'ci/linux_chromium_component_updater',
+        ),
+        luci.console_view_entry(
+            builder = 'ci/metadata_exporter',
+        ),
+    ],
+)
diff --git a/infra/config/subprojects/chromium/master-only/main.star b/infra/config/subprojects/chromium/master-only/main.star
index a45a4d3..5db0040f 100644
--- a/infra/config/subprojects/chromium/master-only/main.star
+++ b/infra/config/subprojects/chromium/master-only/main.star
@@ -9,6 +9,7 @@
 
 exec('./consoles/android.packager.star')
 exec('./consoles/luci.chromium.try.star')
+exec('./consoles/metadata.exporter.star')
 exec('./consoles/sheriff.ios.star')
 
 exec('./fallback-cq.star')
diff --git a/infra/config/subprojects/goma/consoles/chromium.goma.migration.star b/infra/config/subprojects/goma/consoles/chromium.goma.migration.star
index 15f653c..c5914b16 100644
--- a/infra/config/subprojects/goma/consoles/chromium.goma.migration.star
+++ b/infra/config/subprojects/goma/consoles/chromium.goma.migration.star
@@ -375,11 +375,6 @@
             short_name = 'anno',
         ),
         luci.console_view_entry(
-            builder = 'ci/linux_chromium_component_updater',
-            category = 'week3a|linux',
-            short_name = 'cc_upd',
-        ),
-        luci.console_view_entry(
             builder = 'ci/linux-code-coverage',
             category = 'week3a|linux',
             short_name = 'code',
diff --git a/infra/config/subprojects/webrtc/webrtc.fyi.star b/infra/config/subprojects/webrtc/webrtc.fyi.star
index 61c52ef..65573a24 100644
--- a/infra/config/subprojects/webrtc/webrtc.fyi.star
+++ b/infra/config/subprojects/webrtc/webrtc.fyi.star
@@ -153,16 +153,22 @@
 
 builder(
     name = 'WebRTC Chromium FYI ios-device',
-    caches = [xcode_cache.x11c29],
+    caches = [xcode_cache.x11e146],
     executable = 'recipe:webrtc/chromium_ios',
     goma_backend = goma.backend.RBE_PROD,
     os = os.MAC_ANY,
+    properties = {
+        'xcode_build_version': '11e146',
+    },
 )
 
 builder(
     name = 'WebRTC Chromium FYI ios-simulator',
-    caches = [xcode_cache.x11c29],
+    caches = [xcode_cache.x11e146],
     executable = 'recipe:webrtc/chromium_ios',
     goma_backend = goma.backend.RBE_PROD,
     os = os.MAC_ANY,
+    properties = {
+        'xcode_build_version': '11e146',
+    },
 )
diff --git a/ios/chrome/app/main_application_delegate.mm b/ios/chrome/app/main_application_delegate.mm
index 5655bf9..49cb017 100644
--- a/ios/chrome/app/main_application_delegate.mm
+++ b/ios/chrome/app/main_application_delegate.mm
@@ -87,7 +87,6 @@
       // TODO(crbug.com/1040501): remove this.
       // This is temporary plumbing that's not supposed to be here.
       _sceneController.mainController = (id<MainControllerGuts>)_mainController;
-      _mainController.sceneController = _sceneController;
       _tabSwitcherProtocol = _sceneController;
       _tabOpener = _sceneController;
     }
diff --git a/ios/chrome/app/main_controller.h b/ios/chrome/app/main_controller.h
index 7607338..16641e3 100644
--- a/ios/chrome/app/main_controller.h
+++ b/ios/chrome/app/main_controller.h
@@ -11,16 +11,11 @@
 #import "ios/chrome/app/application_delegate/browser_launcher.h"
 #import "ios/chrome/app/application_delegate/startup_information.h"
 #import "ios/chrome/app/main_controller_guts.h"
-#import "ios/chrome/browser/ui/commands/application_commands.h"
 #import "ios/chrome/browser/ui/commands/browsing_data_commands.h"
 
 @class AppState;
 @class MetricsMediator;
 @protocol BrowsingDataCommands;
-@protocol ConnectionInformation;
-@protocol SceneControllerGuts;
-@protocol TabOpening;
-@protocol TabSwitcherDelegate;
 
 // The main controller of the application, owned by the MainWindow nib. Also
 // serves as the delegate for the app. Owns all the various top-level
@@ -45,14 +40,6 @@
 // to the user preferences.
 @property(nonatomic, weak) MetricsMediator* metricsMediator;
 
-// For temporary plumbing only.
-@property(nonatomic, weak) id<ApplicationCommands,
-                              TabSwitcherDelegate,
-                              ConnectionInformation,
-                              SceneControllerGuts,
-                              TabOpening>
-    sceneController;
-
 @end
 
 #endif  // IOS_CHROME_APP_MAIN_CONTROLLER_H_
diff --git a/ios/chrome/app/main_controller.mm b/ios/chrome/app/main_controller.mm
index bfc937fcc..f638a2d 100644
--- a/ios/chrome/app/main_controller.mm
+++ b/ios/chrome/app/main_controller.mm
@@ -587,8 +587,9 @@
     }
   }
 
-  [self.sceneController startUpChromeUIPostCrash:postCrashLaunch
-                                 needRestoration:needRestore];
+  SceneState* sceneState = self.appState.connectedScenes.firstObject;
+  [sceneState.controller startUpChromeUIPostCrash:postCrashLaunch
+                                  needRestoration:needRestore];
   [self startUpAfterFirstWindowCreated];
 }
 
@@ -649,7 +650,6 @@
         base::mac::ObjCCastStrict<UIWindowScene>(notification.object);
     SceneDelegate* sceneDelegate =
         base::mac::ObjCCastStrict<SceneDelegate>(scene.delegate);
-    self.sceneController = sceneDelegate.sceneController;
     sceneDelegate.sceneController.mainController = self;
   }
 }
@@ -1292,7 +1292,8 @@
 - (void)setStartupParametersWithURL:(const GURL&)launchURL {
   DCHECK(!IsSceneStartupSupported());
   NSString* sourceApplication = @"Fake App";
-  self.sceneController.startupParameters = [ChromeAppStartupParameters
+  SceneState* sceneState = self.appState.foregroundActiveScene;
+  sceneState.controller.startupParameters = [ChromeAppStartupParameters
       newChromeAppStartupParametersWithURL:net::NSURLWithGURL(launchURL)
                      fromSourceApplication:sourceApplication];
 }
diff --git a/ios/chrome/browser/ui/browser_view/browser_view_controller.mm b/ios/chrome/browser/ui/browser_view/browser_view_controller.mm
index 9135959b..490bb81 100644
--- a/ios/chrome/browser/ui/browser_view/browser_view_controller.mm
+++ b/ios/chrome/browser/ui/browser_view/browser_view_controller.mm
@@ -10,7 +10,6 @@
 #import <MaterialComponents/MaterialSnackbar.h>
 
 #include "base/base64.h"
-#include "base/ios/ios_util.h"
 #include "base/mac/bundle_locations.h"
 #include "base/mac/foundation_util.h"
 #include "base/metrics/histogram_macros.h"
@@ -3401,19 +3400,15 @@
 
   // If there is no first responder, try to make the webview or the NTP first
   // responder to have it answer keyboard commands (e.g. space bar to scroll).
-  // TODO(crbug.com/1103822): Investigate why this is causing EG2 tests to spin
-  // on iOS14.
-  if (!base::ios::IsRunningOnIOS14OrLater()) {
-    if (!GetFirstResponder() && self.currentWebState) {
-      NewTabPageTabHelper* NTPHelper =
-          NewTabPageTabHelper::FromWebState(webState);
-      if (NTPHelper && NTPHelper->IsActive()) {
-        UIViewController* viewController =
-            _ntpCoordinatorsForWebStates[webState].viewController;
-        [viewController becomeFirstResponder];
-      } else {
-        [self.currentWebState->GetWebViewProxy() becomeFirstResponder];
-      }
+  if (!GetFirstResponder() && self.currentWebState) {
+    NewTabPageTabHelper* NTPHelper =
+        NewTabPageTabHelper::FromWebState(webState);
+    if (NTPHelper && NTPHelper->IsActive()) {
+      UIViewController* viewController =
+          _ntpCoordinatorsForWebStates[webState].viewController;
+      [viewController becomeFirstResponder];
+    } else {
+      [self.currentWebState->GetWebViewProxy() becomeFirstResponder];
     }
   }
 }
diff --git a/ios/chrome/browser/ui/keyboard/keyboard_commands_egtest.mm b/ios/chrome/browser/ui/keyboard/keyboard_commands_egtest.mm
index 80e205fe..520d343 100644
--- a/ios/chrome/browser/ui/keyboard/keyboard_commands_egtest.mm
+++ b/ios/chrome/browser/ui/keyboard/keyboard_commands_egtest.mm
@@ -177,12 +177,6 @@
 // Tests that when the app is opened on a web page and a key is pressed, the
 // web view is the first responder.
 - (void)testWebViewIsFirstResponderUponKeyPress {
-  // TODO(crbug.com/1103822) GetFirstResponder/becomeFirstResponder disabled
-  // on iOS14.
-  if (@available(iOS 14, *)) {
-    EARL_GREY_TEST_DISABLED(@"Test disabled on iOS14.");
-  }
-
   GREYAssertTrue(self.testServer->Start(), @"Test server failed to start.");
   [ChromeEarlGrey loadURL:self.testServer->GetURL("/pony.html")];
 
diff --git a/ios/chrome/browser/ui/omnibox/omnibox_egtest.mm b/ios/chrome/browser/ui/omnibox/omnibox_egtest.mm
index 33b6f9d..4e3002f 100644
--- a/ios/chrome/browser/ui/omnibox/omnibox_egtest.mm
+++ b/ios/chrome/browser/ui/omnibox/omnibox_egtest.mm
@@ -631,7 +631,7 @@
 #define MAYBE_testNoDefaultMatch DISABLED_testNoDefaultMatch
 #endif
 - (void)MAYBE_testNoDefaultMatch {
-  // TODO(crbug.com/1098722) Omnibox pasteboard suggestions are currently
+  // TODO(crbug.com/1105869) Omnibox pasteboard suggestions are currently
   // disabled on iOS14.
   if (@available(iOS 14, *)) {
     EARL_GREY_TEST_DISABLED(@"Test disabled on iOS14.");
diff --git a/ios/chrome/browser/ui/popup_menu/popup_menu_coordinator.mm b/ios/chrome/browser/ui/popup_menu/popup_menu_coordinator.mm
index 9e99fb8..7181592 100644
--- a/ios/chrome/browser/ui/popup_menu/popup_menu_coordinator.mm
+++ b/ios/chrome/browser/ui/popup_menu/popup_menu_coordinator.mm
@@ -8,6 +8,7 @@
 #include "base/metrics/histogram_macros.h"
 #include "base/metrics/user_metrics.h"
 #include "base/metrics/user_metrics_action.h"
+#include "ios/chrome/browser/application_context.h"
 #include "ios/chrome/browser/bookmarks/bookmark_model_factory.h"
 #include "ios/chrome/browser/browser_state/chrome_browser_state.h"
 #include "ios/chrome/browser/feature_engagement/tracker_factory.h"
@@ -230,7 +231,9 @@
                                     ->IsOffTheRecord()
                readingListModel:ReadingListModelFactory::GetForBrowserState(
                                     self.browser->GetBrowserState())
-      triggerNewIncognitoTabTip:triggerNewIncognitoTabTip];
+      triggerNewIncognitoTabTip:triggerNewIncognitoTabTip
+         browserPolicyConnector:GetApplicationContext()
+                                    ->GetBrowserPolicyConnector()];
   self.mediator.engagementTracker =
       feature_engagement::TrackerFactory::GetForBrowserState(
           self.browser->GetBrowserState());
diff --git a/ios/chrome/browser/ui/popup_menu/popup_menu_mediator.h b/ios/chrome/browser/ui/popup_menu/popup_menu_mediator.h
index fdb4b70e..c688c6c 100644
--- a/ios/chrome/browser/ui/popup_menu/popup_menu_mediator.h
+++ b/ios/chrome/browser/ui/popup_menu/popup_menu_mediator.h
@@ -23,6 +23,7 @@
 class ReadingListModel;
 class TemplateURLService;
 class WebStateList;
+class BrowserPolicyConnectorIOS;
 
 // Mediator for the popup menu. This object is in charge of creating and
 // updating the items of the popup menu.
@@ -30,11 +31,13 @@
 
 // Initializes the mediator with a |type| of popup menu, whether it
 // |isIncognito|, a |readingListModel| used to display the badge for the reading
-// list entry, and whether the mediator should |triggerNewIncognitoTabTip|.
+// list entry, whether the mediator should |triggerNewIncognitoTabTip|, and a
+// |browserPolicyConnector| used to check if the browser is managed by policy.
 - (instancetype)initWithType:(PopupMenuType)type
                   isIncognito:(BOOL)isIncognito
              readingListModel:(ReadingListModel*)readingListModel
     triggerNewIncognitoTabTip:(BOOL)triggerNewIncognitoTabTip
+       browserPolicyConnector:(BrowserPolicyConnectorIOS*)browserPolicyConnector
     NS_DESIGNATED_INITIALIZER;
 - (instancetype)init NS_UNAVAILABLE;
 
diff --git a/ios/chrome/browser/ui/popup_menu/popup_menu_mediator.mm b/ios/chrome/browser/ui/popup_menu/popup_menu_mediator.mm
index 139741b..1763fb0 100644
--- a/ios/chrome/browser/ui/popup_menu/popup_menu_mediator.mm
+++ b/ios/chrome/browser/ui/popup_menu/popup_menu_mediator.mm
@@ -21,7 +21,6 @@
 #include "components/prefs/pref_service.h"
 #include "components/translate/core/browser/translate_manager.h"
 #include "components/translate/core/browser/translate_prefs.h"
-#include "ios/chrome/browser/application_context.h"
 #import "ios/chrome/browser/browser_state/chrome_browser_state.h"
 #include "ios/chrome/browser/chrome_url_constants.h"
 #import "ios/chrome/browser/find_in_page/find_tab_helper.h"
@@ -147,6 +146,9 @@
 // Whether the hint for the "New Incognito Tab" item should be triggered.
 @property(nonatomic, assign) BOOL triggerNewIncognitoTabTip;
 
+// The current browser policy connector.
+@property(nonatomic, assign) BrowserPolicyConnectorIOS* browserPolicyConnector;
+
 // Whether an overlay is currently presented over the web content area.
 @property(nonatomic, assign, getter=isWebContentAreaShowingOverlay)
     BOOL webContentAreaShowingOverlay;
@@ -177,7 +179,9 @@
 - (instancetype)initWithType:(PopupMenuType)type
                   isIncognito:(BOOL)isIncognito
              readingListModel:(ReadingListModel*)readingListModel
-    triggerNewIncognitoTabTip:(BOOL)triggerNewIncognitoTabTip {
+    triggerNewIncognitoTabTip:(BOOL)triggerNewIncognitoTabTip
+       browserPolicyConnector:
+           (BrowserPolicyConnectorIOS*)browserPolicyConnector {
   self = [super init];
   if (self) {
     _isIncognito = isIncognito;
@@ -189,6 +193,7 @@
     _overlayPresenterObserver =
         std::make_unique<OverlayPresenterObserverBridge>(self);
     _triggerNewIncognitoTabTip = triggerNewIncognitoTabTip;
+    _browserPolicyConnector = browserPolicyConnector;
   }
   return self;
 }
@@ -833,10 +838,8 @@
   NSArray* collectionActions = [self collectionItems];
 
   if (base::FeatureList::IsEnabled(kEnableIOSManagedSettingsUI) &&
-      GetApplicationContext()->GetBrowserPolicyConnector() &&
-      GetApplicationContext()
-          ->GetBrowserPolicyConnector()
-          ->HasMachineLevelPolicies()) {
+      _browserPolicyConnector &&
+      _browserPolicyConnector->HasMachineLevelPolicies()) {
     // Show enterprise infomation when chrome is managed by policy and the
     // settings UI flag is enabled.
     NSArray* textActions = [self enterpriseInfoSection];
diff --git a/ios/chrome/browser/ui/popup_menu/popup_menu_mediator_unittest.mm b/ios/chrome/browser/ui/popup_menu/popup_menu_mediator_unittest.mm
index 68ef230..9e9275c6 100644
--- a/ios/chrome/browser/ui/popup_menu/popup_menu_mediator_unittest.mm
+++ b/ios/chrome/browser/ui/popup_menu/popup_menu_mediator_unittest.mm
@@ -123,7 +123,8 @@
         [[PopupMenuMediator alloc] initWithType:type
                                     isIncognito:is_incognito
                                readingListModel:reading_list_model_.get()
-                      triggerNewIncognitoTabTip:trigger_incognito_hint];
+                      triggerNewIncognitoTabTip:trigger_incognito_hint
+                         browserPolicyConnector:nil];
     return mediator_;
   }
 
diff --git a/ios/chrome/browser/ui/util/uikit_ui_util.mm b/ios/chrome/browser/ui/util/uikit_ui_util.mm
index d419a359..f3c964eb 100644
--- a/ios/chrome/browser/ui/util/uikit_ui_util.mm
+++ b/ios/chrome/browser/ui/util/uikit_ui_util.mm
@@ -643,11 +643,7 @@
 
 UIResponder* GetFirstResponder() {
   DCHECK_CURRENTLY_ON(web::WebThread::UI);
-  // TODO(crbug.com/1103822): Finding the first responder with
-  // GetFirstResponderSubview() fails on iOS 14 on simulator when running EG2
-  // tests.
-  if (base::ios::IsRunningOnIOS14OrLater() ||
-      base::FeatureList::IsEnabled(kFirstResponderSendAction)) {
+  if (base::FeatureList::IsEnabled(kFirstResponderSendAction)) {
     DCHECK_CURRENTLY_ON(web::WebThread::UI);
     DCHECK(!g_first_responder);
     [[UIApplication sharedApplication]
diff --git a/ios/chrome/test/earl_grey/chrome_test_case.mm b/ios/chrome/test/earl_grey/chrome_test_case.mm
index 3e31a7a..571e613 100644
--- a/ios/chrome/test/earl_grey/chrome_test_case.mm
+++ b/ios/chrome/test/earl_grey/chrome_test_case.mm
@@ -9,6 +9,7 @@
 #include <memory>
 
 #include "base/command_line.h"
+#include "base/ios/ios_util.h"
 #include "base/strings/sys_string_conversions.h"
 #import "ios/chrome/test/earl_grey/chrome_earl_grey.h"
 #import "ios/chrome/test/earl_grey/chrome_test_case_app_interface.h"
@@ -411,6 +412,14 @@
   GREYAssertTrue([ChromeEarlGrey isCustomWebKitLoadedIfRequested],
                  @"Unable to load custom WebKit");
 
+  // TODO(crbug.com/1103822): Investigate why this is causing EG2 tests to spin
+  // on iOS14.
+  if (base::ios::IsRunningOnIOS14OrLater()) {
+    [[GREYConfiguration sharedConfiguration]
+            setValue:@0
+        forConfigKey:kGREYConfigKeyDispatchAfterMaxTrackableDelay];
+  }
+
   [[self class] startHTTPServer];
   [[self class] enableMockAuthentication];
 
diff --git a/ios/net/protocol_handler_util.mm b/ios/net/protocol_handler_util.mm
index 72a74943..ac6df128 100644
--- a/ios/net/protocol_handler_util.mm
+++ b/ios/net/protocol_handler_util.mm
@@ -17,6 +17,7 @@
 #include "net/http/http_request_headers.h"
 #include "net/http/http_response_headers.h"
 #include "net/http/http_version.h"
+#include "net/url_request/referrer_policy.h"
 #include "net/url_request/url_request.h"
 #include "url/buildflags.h"
 #include "url/gurl.h"
@@ -176,7 +177,7 @@
           base::SysNSStringToUTF8([headers objectForKey:key]));
       // If the referrer is explicitly set, we don't want the network stack to
       // strip it.
-      out_request->set_referrer_policy(URLRequest::NEVER_CLEAR_REFERRER);
+      out_request->set_referrer_policy(net::ReferrerPolicy::NEVER_CLEAR);
       continue;
     }
     // Copy over all headers that were set on NSURLRequest
diff --git a/ios/web/common/referrer_util.cc b/ios/web/common/referrer_util.cc
index 8c352a3..42030a6 100644
--- a/ios/web/common/referrer_util.cc
+++ b/ios/web/common/referrer_util.cc
@@ -6,6 +6,7 @@
 
 #include "base/notreached.h"
 #include "ios/web/public/navigation/referrer.h"
+#include "net/url_request/referrer_policy.h"
 #include "url/gurl.h"
 
 namespace web {
@@ -49,35 +50,32 @@
   return std::string();
 }
 
-net::URLRequest::ReferrerPolicy PolicyForNavigation(
-    const GURL& destination,
-    const web::Referrer& referrer) {
+net::ReferrerPolicy PolicyForNavigation(const GURL& destination,
+                                        const web::Referrer& referrer) {
   // Based on the matching logic in content's
   // resource_dispatcher_host_impl.cc
   switch (referrer.policy) {
     case ReferrerPolicyAlways:
-      return net::URLRequest::NEVER_CLEAR_REFERRER;
+      return net::ReferrerPolicy::NEVER_CLEAR;
     case ReferrerPolicyNever:
-      return net::URLRequest::NO_REFERRER;
+      return net::ReferrerPolicy::NO_REFERRER;
     case ReferrerPolicyOrigin:
-      return net::URLRequest::ORIGIN;
+      return net::ReferrerPolicy::ORIGIN;
     case ReferrerPolicyNoReferrerWhenDowngrade:
     case ReferrerPolicyDefault:
-      return net::URLRequest::
-          CLEAR_REFERRER_ON_TRANSITION_FROM_SECURE_TO_INSECURE;
+      return net::ReferrerPolicy::CLEAR_ON_TRANSITION_FROM_SECURE_TO_INSECURE;
     case ReferrerPolicyOriginWhenCrossOrigin:
-      return net::URLRequest::ORIGIN_ONLY_ON_TRANSITION_CROSS_ORIGIN;
+      return net::ReferrerPolicy::ORIGIN_ONLY_ON_TRANSITION_CROSS_ORIGIN;
     case ReferrerPolicySameOrigin:
-      return net::URLRequest::CLEAR_REFERRER_ON_TRANSITION_CROSS_ORIGIN;
+      return net::ReferrerPolicy::CLEAR_ON_TRANSITION_CROSS_ORIGIN;
     case ReferrerPolicyStrictOrigin:
-      return net::URLRequest::
+      return net::ReferrerPolicy::
           ORIGIN_CLEAR_ON_TRANSITION_FROM_SECURE_TO_INSECURE;
     case ReferrerPolicyStrictOriginWhenCrossOrigin:
-      return net::URLRequest::
-          REDUCE_REFERRER_GRANULARITY_ON_TRANSITION_CROSS_ORIGIN;
+      return net::ReferrerPolicy::REDUCE_GRANULARITY_ON_TRANSITION_CROSS_ORIGIN;
   }
   NOTREACHED();
-  return net::URLRequest::CLEAR_REFERRER_ON_TRANSITION_FROM_SECURE_TO_INSECURE;
+  return net::ReferrerPolicy::CLEAR_ON_TRANSITION_FROM_SECURE_TO_INSECURE;
 }
 
 ReferrerPolicy ReferrerPolicyFromString(const std::string& policy) {
diff --git a/ios/web/common/referrer_util.h b/ios/web/common/referrer_util.h
index bc53bd9..edb698b 100644
--- a/ios/web/common/referrer_util.h
+++ b/ios/web/common/referrer_util.h
@@ -8,7 +8,7 @@
 #include <string>
 
 #include "ios/web/public/navigation/referrer.h"
-#include "net/url_request/url_request.h"
+#include "net/url_request/referrer_policy.h"
 
 class GURL;
 
@@ -24,9 +24,8 @@
 // any.
 // TODO(stuartmorgan): Replace this with ReferrerForNavigation, since it should
 // always be used with ReferrerHeaderValueForNavigation anyway.
-net::URLRequest::ReferrerPolicy PolicyForNavigation(
-    const GURL& destination,
-    const web::Referrer& referrer);
+net::ReferrerPolicy PolicyForNavigation(const GURL& destination,
+                                        const web::Referrer& referrer);
 
 // Returns the WebReferrerPolicy corresponding to the given policy string
 // (e.g., 'always', 'never', 'origin', 'default'). The string is assumed to
diff --git a/ios/web/common/referrer_util_unittest.cc b/ios/web/common/referrer_util_unittest.cc
index 0875d0d..5cdb881 100644
--- a/ios/web/common/referrer_util_unittest.cc
+++ b/ios/web/common/referrer_util_unittest.cc
@@ -6,6 +6,7 @@
 
 #include "base/stl_util.h"
 #include "ios/web/public/navigation/referrer.h"
+#include "net/url_request/referrer_policy.h"
 #include "testing/gtest/include/gtest/gtest.h"
 #include "testing/platform_test.h"
 #include "url/gurl.h"
@@ -197,40 +198,39 @@
   GURL dummy_url;
   for (unsigned int policy = 0; policy <= ReferrerPolicyLast; ++policy) {
     Referrer referrer(dummy_url, static_cast<ReferrerPolicy>(policy));
-    net::URLRequest::ReferrerPolicy net_request_policy =
+    net::ReferrerPolicy net_request_policy =
         PolicyForNavigation(dummy_url, referrer);
     // The test here is deliberately backward from the way the test would
     // intuitively work so that it's structured differently from the code it's
     // testing, and thus less likely to have a copy/paste bug that passes
     // incorrect mappings.
     switch (net_request_policy) {
-      case net::URLRequest::
-          CLEAR_REFERRER_ON_TRANSITION_FROM_SECURE_TO_INSECURE:
+      case net::ReferrerPolicy::CLEAR_ON_TRANSITION_FROM_SECURE_TO_INSECURE:
         // This corresponds directly to ReferrerPolicyNoReferrerWhenDowngrade,
         // which is also how Default works on iOS.
         EXPECT_TRUE(policy == ReferrerPolicyDefault ||
                     policy == ReferrerPolicyNoReferrerWhenDowngrade);
         break;
-      case net::URLRequest::
-          REDUCE_REFERRER_GRANULARITY_ON_TRANSITION_CROSS_ORIGIN:
+      case net::ReferrerPolicy::REDUCE_GRANULARITY_ON_TRANSITION_CROSS_ORIGIN:
         EXPECT_EQ(ReferrerPolicyStrictOriginWhenCrossOrigin, policy);
         break;
-      case net::URLRequest::ORIGIN_ONLY_ON_TRANSITION_CROSS_ORIGIN:
+      case net::ReferrerPolicy::ORIGIN_ONLY_ON_TRANSITION_CROSS_ORIGIN:
         EXPECT_EQ(ReferrerPolicyOriginWhenCrossOrigin, policy);
         break;
-      case net::URLRequest::NEVER_CLEAR_REFERRER:
+      case net::ReferrerPolicy::NEVER_CLEAR:
         EXPECT_EQ(ReferrerPolicyAlways, policy);
         break;
-      case net::URLRequest::ORIGIN:
+      case net::ReferrerPolicy::ORIGIN:
         EXPECT_EQ(ReferrerPolicyOrigin, policy);
         break;
-      case net::URLRequest::CLEAR_REFERRER_ON_TRANSITION_CROSS_ORIGIN:
+      case net::ReferrerPolicy::CLEAR_ON_TRANSITION_CROSS_ORIGIN:
         EXPECT_EQ(ReferrerPolicySameOrigin, policy);
         break;
-      case net::URLRequest::ORIGIN_CLEAR_ON_TRANSITION_FROM_SECURE_TO_INSECURE:
+      case net::ReferrerPolicy::
+          ORIGIN_CLEAR_ON_TRANSITION_FROM_SECURE_TO_INSECURE:
         EXPECT_EQ(ReferrerPolicyStrictOrigin, policy);
         break;
-      case net::URLRequest::NO_REFERRER:
+      case net::ReferrerPolicy::NO_REFERRER:
         EXPECT_EQ(ReferrerPolicyNever, policy);
         break;
     }
diff --git a/media/base/android/java/src/org/chromium/media/AudioManagerAndroid.java b/media/base/android/java/src/org/chromium/media/AudioManagerAndroid.java
index ea16664..a6fd374 100644
--- a/media/base/android/java/src/org/chromium/media/AudioManagerAndroid.java
+++ b/media/base/android/java/src/org/chromium/media/AudioManagerAndroid.java
@@ -4,7 +4,6 @@
 
 package org.chromium.media;
 
-import android.annotation.TargetApi;
 import android.bluetooth.BluetoothAdapter;
 import android.bluetooth.BluetoothManager;
 import android.content.BroadcastReceiver;
@@ -669,11 +668,9 @@
      * peripheral and automatically routes audio playback and capture appropriately on Android5.0
      * and higher in the order of wired headset first, then USB audio device and earpiece at last.
      */
-    @TargetApi(Build.VERSION_CODES.LOLLIPOP)
     private boolean hasUsbAudio() {
         // Android 5.0 (API level 21) and above supports USB audio class 1 (UAC1) features for
         // audio functions, capture and playback, in host mode.
-        if (Build.VERSION.SDK_INT < Build.VERSION_CODES.LOLLIPOP) return false;
 
         boolean hasUsbAudio = false;
         // UsbManager fails internally with NullPointerException on the emulator created without
diff --git a/media/base/android/java/src/org/chromium/media/MaxAnticipatedResolutionEstimator.java b/media/base/android/java/src/org/chromium/media/MaxAnticipatedResolutionEstimator.java
index d09a6454..c7b8c3e 100644
--- a/media/base/android/java/src/org/chromium/media/MaxAnticipatedResolutionEstimator.java
+++ b/media/base/android/java/src/org/chromium/media/MaxAnticipatedResolutionEstimator.java
@@ -4,7 +4,6 @@
 
 package org.chromium.media;
 
-import android.annotation.TargetApi;
 import android.content.Context;
 import android.hardware.display.DisplayManager;
 import android.media.MediaFormat;
@@ -22,7 +21,6 @@
  * A utility class to make an estimate for the hints provided to MediaFormat as
  * to the expected maximum resolution to prepare for.
  */
-@TargetApi(Build.VERSION_CODES.LOLLIPOP)
 public class MaxAnticipatedResolutionEstimator {
     private Context mContext;
     private DisplayManager mDisplayManager;
diff --git a/media/base/android/java/src/org/chromium/media/MediaCodecBridge.java b/media/base/android/java/src/org/chromium/media/MediaCodecBridge.java
index 54386a7..1f5103b8 100644
--- a/media/base/android/java/src/org/chromium/media/MediaCodecBridge.java
+++ b/media/base/android/java/src/org/chromium/media/MediaCodecBridge.java
@@ -55,10 +55,6 @@
     private static final String KEY_CROP_TOP = "crop-top";
 
     protected MediaCodec mMediaCodec;
-
-    private ByteBuffer[] mInputBuffers;
-    private ByteBuffer[] mOutputBuffers;
-
     private @BitrateAdjuster.Type int mBitrateAdjuster;
 
     // To support both the synchronous and asynchronous version of MediaCodec
@@ -216,7 +212,7 @@
         @Override
         public void onError(MediaCodec codec, MediaCodec.CodecException e) {
             // TODO(dalecurtis): We may want to drop transient errors here.
-            Log.e(TAG, "MediaCodec.onError: " + e.getDiagnosticInfo());
+            Log.e(TAG, "MediaCodec.onError: %s", e.getDiagnosticInfo());
             mMediaCodecBridge.onError(e);
         }
 
@@ -341,7 +337,7 @@
         try {
             String codecName = mMediaCodec.getName();
             // This logging is to help us identify hung MediaCodecs in crash reports.
-            Log.w(TAG, "Releasing: " + codecName);
+            Log.w(TAG, "Releasing: %s", codecName);
             mMediaCodec.release();
             Log.w(TAG, "Codec released");
         } catch (IllegalStateException e) {
@@ -382,10 +378,6 @@
             }
 
             mMediaCodec.start();
-            if (Build.VERSION.SDK_INT <= Build.VERSION_CODES.KITKAT) {
-                mInputBuffers = mMediaCodec.getInputBuffers();
-                mOutputBuffers = mMediaCodec.getOutputBuffers();
-            }
         } catch (IllegalStateException e) {
             Log.e(TAG, "Cannot start the media codec", e);
             return false;
@@ -418,7 +410,7 @@
             } else if (indexOrStatus == MediaCodec.INFO_TRY_AGAIN_LATER) {
                 status = MediaCodecStatus.TRY_AGAIN_LATER;
             } else {
-                Log.e(TAG, "Unexpected index_or_status: " + indexOrStatus);
+                Log.e(TAG, "Unexpected index_or_status: %d", indexOrStatus);
                 assert false;
             }
         } catch (Exception e) {
@@ -460,7 +452,6 @@
         }
     }
 
-    @TargetApi(Build.VERSION_CODES.KITKAT)
     @CalledByNative
     private String getName() {
         String codecName = "unknown";
@@ -488,33 +479,25 @@
     }
 
     /** Returns null if MediaCodec throws IllegalStateException. */
-    @SuppressLint("NewApi")
     @CalledByNative
     private ByteBuffer getInputBuffer(int index) {
-        if (Build.VERSION.SDK_INT > Build.VERSION_CODES.KITKAT) {
-            try {
-                return mMediaCodec.getInputBuffer(index);
-            } catch (IllegalStateException e) {
-                Log.e(TAG, "Failed to get input buffer", e);
-                return null;
-            }
+        try {
+            return mMediaCodec.getInputBuffer(index);
+        } catch (IllegalStateException e) {
+            Log.e(TAG, "Failed to get input buffer", e);
+            return null;
         }
-        return mInputBuffers[index];
     }
 
     /** Returns null if MediaCodec throws IllegalStateException. */
-    @SuppressLint("NewApi")
     @CalledByNative
     protected ByteBuffer getOutputBuffer(int index) {
-        if (Build.VERSION.SDK_INT > Build.VERSION_CODES.KITKAT) {
-            try {
-                return mMediaCodec.getOutputBuffer(index);
-            } catch (IllegalStateException e) {
-                Log.e(TAG, "Failed to get output buffer", e);
-                return null;
-            }
+        try {
+            return mMediaCodec.getOutputBuffer(index);
+        } catch (IllegalStateException e) {
+            Log.e(TAG, "Failed to get output buffer", e);
+            return null;
         }
-        return mOutputBuffers[index];
     }
 
     @CalledByNative
@@ -529,7 +512,6 @@
         return MediaCodecStatus.OK;
     }
 
-    @TargetApi(Build.VERSION_CODES.KITKAT)
     @CalledByNative
     private void setVideoBitrate(int bps, int frameRate) {
         int targetBps = BitrateAdjuster.getTargetBitrate(mBitrateAdjuster, bps, frameRate);
@@ -540,11 +522,9 @@
         } catch (IllegalStateException e) {
             Log.e(TAG, "Failed to set MediaCodec parameters", e);
         }
-        Log.v(TAG,
-                "setVideoBitrate: input " + bps + "bps@" + frameRate + ", targetBps " + targetBps);
+        Log.v(TAG, "setVideoBitrate: input %dbps@%d, targetBps %d", bps, frameRate, targetBps);
     }
 
-    @TargetApi(Build.VERSION_CODES.KITKAT)
     @CalledByNative
     private void requestKeyFrameSoon() {
         Bundle b = new Bundle();
@@ -568,7 +548,7 @@
             case EncryptionScheme.CBCS:
                 return MediaCodec.CRYPTO_MODE_AES_CBC;
             default:
-                Log.e(TAG, "Unsupported cipher mode: " + nativeValue);
+                Log.e(TAG, "Unsupported cipher mode: %d", nativeValue);
                 return MEDIA_CODEC_UNKNOWN_CIPHER_MODE;
         }
     }
@@ -606,17 +586,15 @@
                 Log.d(TAG, "Failed to queue secure input buffer: CryptoException.ERROR_NO_KEY");
                 return MediaCodecStatus.NO_KEY;
             }
-            Log.e(TAG,
-                    "Failed to queue secure input buffer, CryptoException with error code "
-                            + e.getErrorCode());
+            Log.e(TAG, "Failed to queue secure input buffer. Error code %d", e.getErrorCode(), e);
             return MediaCodecStatus.ERROR;
         } catch (IllegalArgumentException e) {
             // IllegalArgumentException can occur when release() is called on the MediaCrypto
             // object, but the MediaCodecBridge is unaware of the change.
-            Log.e(TAG, "Failed to queue secure input buffer, IllegalArgumentException " + e);
+            Log.e(TAG, "Failed to queue secure input buffer.", e);
             return MediaCodecStatus.ERROR;
         } catch (IllegalStateException e) {
-            Log.e(TAG, "Failed to queue secure input buffer, IllegalStateException " + e);
+            Log.e(TAG, "Failed to queue secure input buffer.", e);
             return MediaCodecStatus.ERROR;
         }
         return MediaCodecStatus.OK;
@@ -663,7 +641,6 @@
                 status = MediaCodecStatus.OK;
                 index = indexOrStatus;
             } else if (indexOrStatus == MediaCodec.INFO_OUTPUT_BUFFERS_CHANGED) {
-                mOutputBuffers = mMediaCodec.getOutputBuffers();
                 status = MediaCodecStatus.OUTPUT_BUFFERS_CHANGED;
             } else if (indexOrStatus == MediaCodec.INFO_OUTPUT_FORMAT_CHANGED) {
                 status = MediaCodecStatus.OUTPUT_FORMAT_CHANGED;
@@ -671,7 +648,7 @@
             } else if (indexOrStatus == MediaCodec.INFO_TRY_AGAIN_LATER) {
                 status = MediaCodecStatus.TRY_AGAIN_LATER;
             } else {
-                Log.e(TAG, "Unexpected index_or_status: " + indexOrStatus);
+                Log.e(TAG, "Unexpected index_or_status: %d", indexOrStatus);
                 assert false;
             }
         } catch (IllegalStateException e) {
diff --git a/media/base/android/java/src/org/chromium/media/MediaCodecUtil.java b/media/base/android/java/src/org/chromium/media/MediaCodecUtil.java
index 72fa8d6..86bebc6 100644
--- a/media/base/android/java/src/org/chromium/media/MediaCodecUtil.java
+++ b/media/base/android/java/src/org/chromium/media/MediaCodecUtil.java
@@ -4,7 +4,6 @@
 
 package org.chromium.media;
 
-import android.annotation.TargetApi;
 import android.media.MediaCodec;
 import android.media.MediaCodec.CryptoInfo;
 import android.media.MediaCodecInfo;
@@ -65,15 +64,12 @@
      * the MediaCodecList.
      */
     private static class MediaCodecListHelper implements Iterable<MediaCodecInfo> {
-        @TargetApi(Build.VERSION_CODES.LOLLIPOP)
         public MediaCodecListHelper() {
-            if (supportsNewMediaCodecList()) {
-                try {
-                    mCodecList = new MediaCodecList(MediaCodecList.ALL_CODECS).getCodecInfos();
-                } catch (Throwable e) {
-                    // Swallow the exception due to bad Android implementation and pretend
-                    // MediaCodecList is not supported.
-                }
+            try {
+                mCodecList = new MediaCodecList(MediaCodecList.ALL_CODECS).getCodecInfos();
+            } catch (Throwable e) {
+                // Swallow the exception due to bad Android implementation and pretend
+                // MediaCodecList is not supported.
             }
         }
 
@@ -100,12 +96,8 @@
             return MediaCodecList.getCodecInfoAt(index);
         }
 
-        private static boolean supportsNewMediaCodecList() {
-            return Build.VERSION.SDK_INT >= Build.VERSION_CODES.LOLLIPOP;
-        }
-
         private boolean hasNewMediaCodecList() {
-            return supportsNewMediaCodecList() && mCodecList != null;
+            return mCodecList != null;
         }
 
         private MediaCodecInfo[] mCodecList;
@@ -211,8 +203,6 @@
             return false;
         }
 
-        // MediaCodecInfo.CodecCapabilities.FEATURE_SecurePlayback is available as of
-        // API 21 (LOLLIPOP), which is the same as NewMediaCodecList.
         MediaCodecListHelper codecListHelper = new MediaCodecListHelper();
         if (codecListHelper.hasNewMediaCodecList()) {
             for (MediaCodecInfo info : codecListHelper) {
@@ -270,7 +260,6 @@
       * @param profileLevels The CodecProfileLevelList to add supported profile levels to.
       * @param videoCapabilities The MediaCodecInfo.VideoCapabilities used to infer support.
       */
-    @TargetApi(Build.VERSION_CODES.LOLLIPOP)
     private static void addVp9CodecProfileLevels(CodecProfileLevelList profileLevels,
             MediaCodecInfo.CodecCapabilities codecCapabilities) {
         // https://www.webmproject.org/vp9/levels
@@ -310,9 +299,7 @@
                 // https://developer.android.com/reference/android/media/MediaCodecInfo.CodecProfileLevel.html
                 try {
                     CodecCapabilities codecCapabilities = info.getCapabilitiesForType(mime);
-                    if (mime.endsWith("vp9")
-                            && Build.VERSION_CODES.LOLLIPOP <= Build.VERSION.SDK_INT
-                            && Build.VERSION.SDK_INT <= Build.VERSION_CODES.M) {
+                    if (mime.endsWith("vp9") && Build.VERSION.SDK_INT <= Build.VERSION_CODES.M) {
                         addVp9CodecProfileLevels(profileLevels, codecCapabilities);
                         continue;
                     }
@@ -372,20 +359,18 @@
                 // API support.
                 String decoderName = getDefaultCodecName(mime, MediaCodecDirection.DECODER, false);
                 if (decoderName.equals("")) return result;
-                if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.KITKAT) {
-                    // To work around an issue that we cannot get the codec info
-                    // from the secure decoder, create an insecure decoder first
-                    // so that we can query its codec info. http://b/15587335.
-                    // Futhermore, it is impossible to create an insecure
-                    // decoder if the secure one is already created.
-                    MediaCodec insecureCodec = MediaCodec.createByCodecName(decoderName);
-                    result.supportsAdaptivePlayback =
-                            codecSupportsAdaptivePlayback(insecureCodec, mime);
-                    insecureCodec.release();
-                }
+
+                // To work around an issue that we cannot get the codec info
+                // from the secure decoder, create an insecure decoder first
+                // so that we can query its codec info. http://b/15587335.
+                // Futhermore, it is impossible to create an insecure
+                // decoder if the secure one is already created.
+                MediaCodec insecureCodec = MediaCodec.createByCodecName(decoderName);
+                result.supportsAdaptivePlayback =
+                        codecSupportsAdaptivePlayback(insecureCodec, mime);
+                insecureCodec.release();
 
                 result.mediaCodec = MediaCodec.createByCodecName(decoderName + ".secure");
-
             } else {
                 if (codecType == CodecType.SOFTWARE) {
                     String decoderName =
@@ -425,73 +410,24 @@
             if (Build.MANUFACTURER.toLowerCase(Locale.getDefault()).equals("samsung")) {
                 // Some Samsung devices cannot render VP8 video directly to the surface.
 
-                // Samsung Galaxy S4.
-                // Only GT-I9505G with Android 4.3 and SPH-L720 (Sprint) with Android 5.0.1
-                // were tested. Only the first device has the problem.
-                // We blacklist popular Samsung Galaxy S4 models before Android L.
-                if (Build.VERSION.SDK_INT < Build.VERSION_CODES.LOLLIPOP
-                        && (Build.MODEL.startsWith("GT-I9505")
-                                   || Build.MODEL.startsWith("GT-I9500"))) {
-                    return false;
-                }
-
                 // Samsung Galaxy S4 Mini.
                 // Only GT-I9190 was tested with Android 4.4.2
                 // We blacklist it and the popular GT-I9195 for all Android versions.
                 if (Build.MODEL.startsWith("GT-I9190") || Build.MODEL.startsWith("GT-I9195")) {
                     return false;
                 }
-
-                // Some Samsung devices have problems with WebRTC.
-                // We copy blacklisting patterns from software_renderin_list_json.cc
-                // although they are broader than the bugs they refer to.
-
-                if (Build.VERSION.SDK_INT <= Build.VERSION_CODES.KITKAT) {
-                    // Samsung Galaxy Note 2, http://crbug.com/308721.
-                    if (Build.MODEL.startsWith("GT-")) return false;
-
-                    // Samsung Galaxy S4, http://crbug.com/329072.
-                    if (Build.MODEL.startsWith("SCH-")) return false;
-
-                    // Samsung Galaxy Tab, http://crbug.com/408353.
-                    if (Build.MODEL.startsWith("SM-T")) return false;
-
-                    // http://crbug.com/600454
-                    if (Build.MODEL.startsWith("SM-G")) return false;
-                }
             }
 
             // MediaTek decoders do not work properly on vp8. See http://crbug.com/446974 and
             // http://crbug.com/597836.
             if (Build.HARDWARE.startsWith("mt")) return false;
-
-            // http://crbug.com/600454
-            if (Build.VERSION.SDK_INT <= Build.VERSION_CODES.KITKAT
-                    && Build.MODEL.startsWith("Lenovo A6000")) {
-                return false;
-            }
         } else if (mime.equals(MimeTypes.VIDEO_VP9)) {
-            if (Build.VERSION.SDK_INT < Build.VERSION_CODES.KITKAT) return false;
-
-            // MediaTek decoders do not work properly on vp9 before Lollipop. See
-            // http://crbug.com/597836.
-            if (Build.VERSION.SDK_INT < Build.VERSION_CODES.LOLLIPOP
-                    && Build.HARDWARE.startsWith("mt")) {
-                return false;
-            }
-
             // Nexus Player VP9 decoder performs poorly at >= 1080p resolution.
             if (Build.MODEL.equals("Nexus Player")) {
                 return false;
             }
         } else if (mime.equals(MimeTypes.VIDEO_AV1)) {
             if (!BuildInfo.isAtLeastQ()) return false;
-        } else if (mime.equals(MimeTypes.AUDIO_OPUS)
-                && Build.VERSION.SDK_INT < Build.VERSION_CODES.LOLLIPOP) {
-            return false;
-        } else if (mime.equals(MimeTypes.VIDEO_HEVC)
-                && Build.VERSION.SDK_INT < Build.VERSION_CODES.LOLLIPOP) {
-            return false;
         }
         // *************************************************************
         // *** DO NOT ADD ANY NEW CODECS WITHOUT UPDATING MIME_UTIL. ***
@@ -528,9 +464,8 @@
      * @param mime MIME type that corresponds to the codec creation.
      * @return true if this codec and mime type combination supports adaptive playback.
      */
-    @TargetApi(Build.VERSION_CODES.KITKAT)
     private static boolean codecSupportsAdaptivePlayback(MediaCodec mediaCodec, String mime) {
-        if (Build.VERSION.SDK_INT < Build.VERSION_CODES.KITKAT || mediaCodec == null) {
+        if (mediaCodec == null) {
             return false;
         }
         try {
@@ -597,11 +532,10 @@
         switch (decoder) {
             case HWEncoder.QcomVp8:
             case HWEncoder.QcomH264:
-                return Build.VERSION_CODES.KITKAT;
-            case HWEncoder.ExynosVp8:
-                return Build.VERSION_CODES.M;
             case HWEncoder.ExynosH264:
                 return Build.VERSION_CODES.LOLLIPOP;
+            case HWEncoder.ExynosVp8:
+                return Build.VERSION_CODES.M;
             case HWEncoder.MediatekH264:
                 return Build.VERSION_CODES.O_MR1;
         }
diff --git a/media/base/android/java/src/org/chromium/media/MediaDrmBridge.java b/media/base/android/java/src/org/chromium/media/MediaDrmBridge.java
index 658baca..bd6eaad 100644
--- a/media/base/android/java/src/org/chromium/media/MediaDrmBridge.java
+++ b/media/base/android/java/src/org/chromium/media/MediaDrmBridge.java
@@ -8,6 +8,7 @@
 import android.annotation.TargetApi;
 import android.media.MediaCrypto;
 import android.media.MediaDrm;
+import android.media.MediaDrm.MediaDrmStateException;
 import android.os.Build;
 
 import org.chromium.base.ApiCompatibilityUtils;
@@ -59,7 +60,6 @@
 @JNINamespace("media")
 @MainDex
 @SuppressLint("WrongConstant")
-@TargetApi(Build.VERSION_CODES.KITKAT)
 public class MediaDrmBridge {
     private static final String TAG = "media";
     private static final String SECURITY_LEVEL = "securityLevel";
@@ -731,12 +731,9 @@
                     keyType == MediaDrm.KEY_TYPE_RELEASE ? sessionId.keySetId() : sessionId.drmId();
             assert scopeId != null;
             request = mMediaDrm.getKeyRequest(scopeId, data, mime, keyType, optionalParameters);
-        } catch (IllegalStateException e) {
-            if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.LOLLIPOP
-                    && e instanceof android.media.MediaDrm.MediaDrmStateException) {
-                // See b/21307186 for details.
-                Log.e(TAG, "MediaDrmStateException fired during getKeyRequest().", e);
-            }
+        } catch (MediaDrmStateException e) {
+            // See b/21307186 for details.
+            Log.e(TAG, "MediaDrmStateException fired during getKeyRequest().", e);
         }
 
         String result = (request != null) ? "successed" : "failed";
diff --git a/media/base/android/java/src/org/chromium/media/ScreenResolutionUtil.java b/media/base/android/java/src/org/chromium/media/ScreenResolutionUtil.java
index adb1388..fbd790c4 100644
--- a/media/base/android/java/src/org/chromium/media/ScreenResolutionUtil.java
+++ b/media/base/android/java/src/org/chromium/media/ScreenResolutionUtil.java
@@ -4,17 +4,14 @@
 
 package org.chromium.media;
 
-import android.annotation.TargetApi;
 import android.media.MediaCodecInfo;
 import android.media.MediaCodecList;
-import android.os.Build;
 import android.util.Size;
 
 /**
  * This class is used as a means to guess the actual screen resolution that the
  * device is capable of playing.
  */
-@TargetApi(Build.VERSION_CODES.LOLLIPOP)
 public class ScreenResolutionUtil {
     public static boolean isResolutionSupportedForType(String mimeType, Size targetResolution) {
         MediaCodecInfo[] codecInfos = new MediaCodecList(MediaCodecList.ALL_CODECS).getCodecInfos();
diff --git a/media/base/android/media_service_throttler_unittest.cc b/media/base/android/media_service_throttler_unittest.cc
index c116c4b..69f6c89 100644
--- a/media/base/android/media_service_throttler_unittest.cc
+++ b/media/base/android/media_service_throttler_unittest.cc
@@ -138,7 +138,7 @@
 // Makes sure that after a certain amount of inactivity, the scheduling clock is
 // reset.
 TEST_F(MediaServiceThrottlerTest, NoCrash_LongInactivity_ShouldReset) {
-  // Schedule two minute's worth of clients
+  // Schedule two minutes' worth of clients.
   SimulateClientCreations(base::TimeDelta::FromMinutes(2) / base_delay_);
 
   // Advance the time so the scheduler perceived a full minute of inactivity.
diff --git a/media/base/media_switches.cc b/media/base/media_switches.cc
index eb30231..d00e4fe 100644
--- a/media/base/media_switches.cc
+++ b/media/base/media_switches.cc
@@ -410,7 +410,7 @@
 
 // Enables using the media history store to store media engagement metrics.
 const base::Feature kUseMediaHistoryStore{"UseMediaHistoryStore",
-                                          base::FEATURE_DISABLED_BY_DEFAULT};
+                                          base::FEATURE_ENABLED_BY_DEFAULT};
 
 // Use R16 texture for 9-16 bit channel instead of half-float conversion by CPU.
 const base::Feature kUseR16Texture{"use-r16-texture",
diff --git a/media/capture/content/android/java/src/org/chromium/media/ScreenCapture.java b/media/capture/content/android/java/src/org/chromium/media/ScreenCapture.java
index 2d5faa4..835ff8e 100644
--- a/media/capture/content/android/java/src/org/chromium/media/ScreenCapture.java
+++ b/media/capture/content/android/java/src/org/chromium/media/ScreenCapture.java
@@ -4,7 +4,6 @@
 
 package org.chromium.media;
 
-import android.annotation.TargetApi;
 import android.app.Activity;
 import android.app.Fragment;
 import android.app.FragmentManager;
@@ -19,7 +18,6 @@
 import android.media.ImageReader;
 import android.media.projection.MediaProjection;
 import android.media.projection.MediaProjectionManager;
-import android.os.Build;
 import android.os.Handler;
 import android.os.HandlerThread;
 import android.util.DisplayMetrics;
@@ -45,7 +43,6 @@
  * download takes place in another thread used by ImageReader.
  **/
 @JNINamespace("media")
-@TargetApi(Build.VERSION_CODES.LOLLIPOP)
 public class ScreenCapture extends Fragment {
     private static final String TAG = "ScreenCapture";
 
@@ -99,10 +96,7 @@
     // Factory method.
     @CalledByNative
     static ScreenCapture createScreenCaptureMachine(long nativeScreenCaptureMachineAndroid) {
-        if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.LOLLIPOP) {
-            return new ScreenCapture(nativeScreenCaptureMachineAndroid);
-        }
-        return null;
+        return new ScreenCapture(nativeScreenCaptureMachineAndroid);
     }
 
     // Internal class implementing the ImageReader listener. Gets pinged when a
diff --git a/media/capture/video/android/java/src/org/chromium/media/VideoCaptureFactory.java b/media/capture/video/android/java/src/org/chromium/media/VideoCaptureFactory.java
index 6fb1e26..8c30888 100644
--- a/media/capture/video/android/java/src/org/chromium/media/VideoCaptureFactory.java
+++ b/media/capture/video/android/java/src/org/chromium/media/VideoCaptureFactory.java
@@ -46,24 +46,16 @@
                     Log.w(TAG, "Missing android.permission.CAMERA permission, "
                                     + "no system camera available.");
                 } else {
-                    if (isLReleaseOrLater()) {
-                        sNumberOfSystemCameras = VideoCaptureCamera2.getNumberOfCameras();
-                    } else {
-                        sNumberOfSystemCameras = VideoCaptureCamera.getNumberOfCameras();
-                    }
+                    sNumberOfSystemCameras = VideoCaptureCamera2.getNumberOfCameras();
                 }
             }
             return sNumberOfSystemCameras;
         }
     }
 
-    private static boolean isLReleaseOrLater() {
-        return Build.VERSION.SDK_INT >= Build.VERSION_CODES.LOLLIPOP;
-    }
-
     @CalledByNative
     static boolean isLegacyOrDeprecatedDevice(int id) {
-        return !isLReleaseOrLater() || VideoCaptureCamera2.isLegacyDevice(id);
+        return VideoCaptureCamera2.isLegacyDevice(id);
     }
 
     // Factory methods.
diff --git a/media/cast/test/utility/audio_utility.cc b/media/cast/test/utility/audio_utility.cc
index 7f29a22..e70928a0 100644
--- a/media/cast/test/utility/audio_utility.cc
+++ b/media/cast/test/utility/audio_utility.cc
@@ -104,7 +104,7 @@
   std::vector<double> frequencies;
   for (size_t i = 0; i < kNumBits; i++) {
     if ((timestamp >> i) & 1) {
-      frequencies.push_back(kBaseFrequency * (i+1));
+      frequencies.push_back(kBaseFrequency * (i + 1));
     }
   }
   // Carrier sense frequency
diff --git a/media/filters/source_buffer_stream_unittest.cc b/media/filters/source_buffer_stream_unittest.cc
index 4f50fcc..6ae21d2 100644
--- a/media/filters/source_buffer_stream_unittest.cc
+++ b/media/filters/source_buffer_stream_unittest.cc
@@ -222,12 +222,11 @@
     std::stringstream ss;
     ss << "{ ";
     for (size_t i = 0; i < r.size(); ++i) {
-      int64_t start = r.start(i).InMicroseconds();
-      int64_t end = r.end(i).InMicroseconds();
-      if (granularity == TimeGranularity::kMillisecond) {
-        start /= base::Time::kMicrosecondsPerMillisecond;
-        end /= base::Time::kMicrosecondsPerMillisecond;
-      }
+      auto conversion = (granularity == TimeGranularity::kMillisecond)
+                            ? &base::TimeDelta::InMilliseconds
+                            : &base::TimeDelta::InMicroseconds;
+      int64_t start = (r.start(i).*conversion)();
+      int64_t end = (r.end(i).*conversion)();
       ss << "[" << start << "," << end << ") ";
     }
     ss << "}";
diff --git a/media/filters/video_cadence_estimator_unittest.cc b/media/filters/video_cadence_estimator_unittest.cc
index e6296fd..0ce77a0 100644
--- a/media/filters/video_cadence_estimator_unittest.cc
+++ b/media/filters/video_cadence_estimator_unittest.cc
@@ -230,70 +230,69 @@
 }
 
 TEST(VideoCadenceEstimatorTest, CadenceVariesWithAcceptableGlitchTime) {
-  std::unique_ptr<VideoCadenceEstimator> estimator(
-      new VideoCadenceEstimator(kMinimumAcceptableTimeBetweenGlitches));
-  estimator->set_cadence_hysteresis_threshold_for_testing(base::TimeDelta());
+  VideoCadenceEstimator estimator(kMinimumAcceptableTimeBetweenGlitches);
+  estimator.set_cadence_hysteresis_threshold_for_testing(base::TimeDelta());
 
   const base::TimeDelta render_interval = Interval(NTSC(60));
   const base::TimeDelta frame_interval = Interval(120);
   const base::TimeDelta acceptable_drift = frame_interval / 2;
 
-  EXPECT_FALSE(estimator->UpdateCadenceEstimate(
+  EXPECT_FALSE(estimator.UpdateCadenceEstimate(
       render_interval, frame_interval, base::TimeDelta(), acceptable_drift));
-  EXPECT_FALSE(estimator->has_cadence());
+  EXPECT_FALSE(estimator.has_cadence());
 
   // Decreasing the acceptable glitch time should be result in more permissive
   // detection of cadence.
-  estimator.reset(
-      new VideoCadenceEstimator(kMinimumAcceptableTimeBetweenGlitches / 2));
-  estimator->set_cadence_hysteresis_threshold_for_testing(base::TimeDelta());
-  EXPECT_TRUE(estimator->UpdateCadenceEstimate(
+  VideoCadenceEstimator permissive_estimator(
+      kMinimumAcceptableTimeBetweenGlitches / 2);
+  permissive_estimator.set_cadence_hysteresis_threshold_for_testing(
+      base::TimeDelta());
+  EXPECT_TRUE(permissive_estimator.UpdateCadenceEstimate(
       render_interval, frame_interval, base::TimeDelta(), acceptable_drift));
-  EXPECT_TRUE(estimator->has_cadence());
-  EXPECT_EQ("[1:0]", estimator->GetCadenceForTesting());
+  EXPECT_TRUE(permissive_estimator.has_cadence());
+  EXPECT_EQ("[1:0]", permissive_estimator.GetCadenceForTesting());
 }
 
 TEST(VideoCadenceEstimatorTest, CadenceHystersisPreventsOscillation) {
-  std::unique_ptr<VideoCadenceEstimator> estimator(
-      new VideoCadenceEstimator(kMinimumAcceptableTimeBetweenGlitches));
+  VideoCadenceEstimator estimator(kMinimumAcceptableTimeBetweenGlitches);
 
   const base::TimeDelta render_interval = Interval(30);
   const base::TimeDelta frame_interval = Interval(60);
   const base::TimeDelta acceptable_drift = frame_interval / 2;
-  estimator->set_cadence_hysteresis_threshold_for_testing(render_interval * 2);
+  estimator.set_cadence_hysteresis_threshold_for_testing(render_interval * 2);
 
   // Cadence hysteresis should prevent the cadence from taking effect yet.
-  EXPECT_FALSE(estimator->UpdateCadenceEstimate(
+  EXPECT_FALSE(estimator.UpdateCadenceEstimate(
       render_interval, frame_interval, base::TimeDelta(), acceptable_drift));
-  EXPECT_FALSE(estimator->has_cadence());
+  EXPECT_FALSE(estimator.has_cadence());
 
   // A second call should exceed cadence hysteresis and take into effect.
-  EXPECT_TRUE(estimator->UpdateCadenceEstimate(
+  EXPECT_TRUE(estimator.UpdateCadenceEstimate(
       render_interval, frame_interval, base::TimeDelta(), acceptable_drift));
-  EXPECT_TRUE(estimator->has_cadence());
+  EXPECT_TRUE(estimator.has_cadence());
 
   // One bad interval shouldn't cause cadence to drop
   EXPECT_FALSE(
-      estimator->UpdateCadenceEstimate(render_interval, frame_interval * 0.75,
-                                       base::TimeDelta(), acceptable_drift));
-  EXPECT_TRUE(estimator->has_cadence());
+      estimator.UpdateCadenceEstimate(render_interval, frame_interval * 0.75,
+                                      base::TimeDelta(), acceptable_drift));
+  EXPECT_TRUE(estimator.has_cadence());
 
   // Resumption of cadence should clear bad interval count.
-  EXPECT_FALSE(estimator->UpdateCadenceEstimate(
+  EXPECT_FALSE(estimator.UpdateCadenceEstimate(
       render_interval, frame_interval, base::TimeDelta(), acceptable_drift));
-  EXPECT_TRUE(estimator->has_cadence());
+  EXPECT_TRUE(estimator.has_cadence());
 
   // So one more bad interval shouldn't cause cadence to drop
   EXPECT_FALSE(
-      estimator->UpdateCadenceEstimate(render_interval, frame_interval * 0.75,
-                                       base::TimeDelta(), acceptable_drift));
-  EXPECT_TRUE(estimator->has_cadence());
+      estimator.UpdateCadenceEstimate(render_interval, frame_interval * 0.75,
+                                      base::TimeDelta(), acceptable_drift));
+  EXPECT_TRUE(estimator.has_cadence());
 
   // Two bad intervals should.
   EXPECT_TRUE(
-      estimator->UpdateCadenceEstimate(render_interval, frame_interval * 0.75,
-                                       base::TimeDelta(), acceptable_drift));
-  EXPECT_FALSE(estimator->has_cadence());
+      estimator.UpdateCadenceEstimate(render_interval, frame_interval * 0.75,
+                                      base::TimeDelta(), acceptable_drift));
+  EXPECT_FALSE(estimator.has_cadence());
 }
 
 void VerifyCadenceSequence(VideoCadenceEstimator* estimator,
diff --git a/media/mojo/clients/BUILD.gn b/media/mojo/clients/BUILD.gn
index 6f470bae..85833a8 100644
--- a/media/mojo/clients/BUILD.gn
+++ b/media/mojo/clients/BUILD.gn
@@ -23,6 +23,8 @@
 
     "//chrome/browser:*",
 
+    "//chrome/browser/thumbnail/generator",
+
     "//content/gpu:*",
 
     # TODO(liberato): can we avoid this?
diff --git a/media/renderers/paint_canvas_video_renderer.cc b/media/renderers/paint_canvas_video_renderer.cc
index 248f46e..2e96535 100644
--- a/media/renderers/paint_canvas_video_renderer.cc
+++ b/media/renderers/paint_canvas_video_renderer.cc
@@ -38,7 +38,7 @@
 #include "third_party/skia/include/core/SkImageGenerator.h"
 #include "third_party/skia/include/core/SkImageInfo.h"
 #include "third_party/skia/include/gpu/GrBackendSurface.h"
-#include "third_party/skia/include/gpu/GrContext.h"
+#include "third_party/skia/include/gpu/GrDirectContext.h"
 #include "third_party/skia/include/gpu/gl/GrGLTypes.h"
 #include "ui/gfx/geometry/rect_f.h"
 #include "ui/gfx/skia_util.h"
@@ -1642,8 +1642,10 @@
       cache_->raster_context_provider = raster_context_provider;
       cache_->coded_size = video_frame->coded_size();
       cache_->visible_rect = video_frame->visible_rect();
-      sk_sp<SkImage> source_subset =
-          source_image->makeSubset(gfx::RectToSkIRect(cache_->visible_rect));
+      GrDirectContext* direct =
+          GrAsDirectContext(raster_context_provider->GrContext());
+      sk_sp<SkImage> source_subset = source_image->makeSubset(
+          gfx::RectToSkIRect(cache_->visible_rect), direct);
       if (source_subset) {
         // We use the flushPendingGrContextIO = true so we can flush any pending
         // GPU work on the GrContext to ensure that skia exectues the work for
diff --git a/net/BUILD.gn b/net/BUILD.gn
index a499040..48c8d60b 100644
--- a/net/BUILD.gn
+++ b/net/BUILD.gn
@@ -1080,6 +1080,7 @@
       "url_request/redirect_info.h",
       "url_request/redirect_util.cc",
       "url_request/redirect_util.h",
+      "url_request/referrer_policy.h",
       "url_request/report_sender.cc",
       "url_request/report_sender.h",
       "url_request/static_http_user_agent_settings.cc",
diff --git a/net/quic/quic_flags_list.h b/net/quic/quic_flags_list.h
index 4216091..3a76df3 100644
--- a/net/quic/quic_flags_list.h
+++ b/net/quic/quic_flags_list.h
@@ -286,7 +286,7 @@
 
 // If true, QUIC will free writer-allocated packet buffer if writer->WritePacket
 // is not called.
-QUIC_FLAG(bool, FLAGS_quic_reloadable_flag_quic_avoid_leak_writer_buffer, false)
+QUIC_FLAG(bool, FLAGS_quic_reloadable_flag_quic_avoid_leak_writer_buffer, true)
 
 // If true, the B2HI connection option limits reduction of inflight_hi to
 // (1-Beta)*CWND.
diff --git a/net/url_request/redirect_info.cc b/net/url_request/redirect_info.cc
index 11912143..c1445e2c 100644
--- a/net/url_request/redirect_info.cc
+++ b/net/url_request/redirect_info.cc
@@ -35,10 +35,10 @@
 // (https://w3c.github.io/webappsec-referrer-policy/). This function checks for
 // a Referrer-Policy header, and parses it if present. Returns the referrer
 // policy that should be used for the request.
-URLRequest::ReferrerPolicy ProcessReferrerPolicyHeaderOnRedirect(
-    URLRequest::ReferrerPolicy original_referrer_policy,
+ReferrerPolicy ProcessReferrerPolicyHeaderOnRedirect(
+    ReferrerPolicy original_referrer_policy,
     const base::Optional<std::string>& referrer_policy_header) {
-  URLRequest::ReferrerPolicy new_policy = original_referrer_policy;
+  ReferrerPolicy new_policy = original_referrer_policy;
   std::vector<base::StringPiece> policy_tokens;
   if (referrer_policy_header) {
     policy_tokens = base::SplitStringPiece(*referrer_policy_header, ",",
@@ -53,48 +53,47 @@
   // use the last recognized policy value, and ignore unknown policies.
   for (const auto& token : policy_tokens) {
     if (base::CompareCaseInsensitiveASCII(token, "no-referrer") == 0) {
-      new_policy = URLRequest::NO_REFERRER;
+      new_policy = ReferrerPolicy::NO_REFERRER;
       continue;
     }
 
     if (base::CompareCaseInsensitiveASCII(token,
                                           "no-referrer-when-downgrade") == 0) {
-      new_policy =
-          URLRequest::CLEAR_REFERRER_ON_TRANSITION_FROM_SECURE_TO_INSECURE;
+      new_policy = ReferrerPolicy::CLEAR_ON_TRANSITION_FROM_SECURE_TO_INSECURE;
       continue;
     }
 
     if (base::CompareCaseInsensitiveASCII(token, "origin") == 0) {
-      new_policy = URLRequest::ORIGIN;
+      new_policy = ReferrerPolicy::ORIGIN;
       continue;
     }
 
     if (base::CompareCaseInsensitiveASCII(token, "origin-when-cross-origin") ==
         0) {
-      new_policy = URLRequest::ORIGIN_ONLY_ON_TRANSITION_CROSS_ORIGIN;
+      new_policy = ReferrerPolicy::ORIGIN_ONLY_ON_TRANSITION_CROSS_ORIGIN;
       continue;
     }
 
     if (base::CompareCaseInsensitiveASCII(token, "unsafe-url") == 0) {
-      new_policy = URLRequest::NEVER_CLEAR_REFERRER;
+      new_policy = ReferrerPolicy::NEVER_CLEAR;
       continue;
     }
 
     if (base::CompareCaseInsensitiveASCII(token, "same-origin") == 0) {
-      new_policy = URLRequest::CLEAR_REFERRER_ON_TRANSITION_CROSS_ORIGIN;
+      new_policy = ReferrerPolicy::CLEAR_ON_TRANSITION_CROSS_ORIGIN;
       continue;
     }
 
     if (base::CompareCaseInsensitiveASCII(token, "strict-origin") == 0) {
       new_policy =
-          URLRequest::ORIGIN_CLEAR_ON_TRANSITION_FROM_SECURE_TO_INSECURE;
+          ReferrerPolicy::ORIGIN_CLEAR_ON_TRANSITION_FROM_SECURE_TO_INSECURE;
       continue;
     }
 
     if (base::CompareCaseInsensitiveASCII(
             token, "strict-origin-when-cross-origin") == 0) {
       new_policy =
-          URLRequest::REDUCE_REFERRER_GRANULARITY_ON_TRANSITION_CROSS_ORIGIN;
+          ReferrerPolicy::REDUCE_GRANULARITY_ON_TRANSITION_CROSS_ORIGIN;
       continue;
     }
   }
@@ -108,7 +107,7 @@
       insecure_scheme_was_upgraded(false),
       is_signed_exchange_fallback_redirect(false),
       new_referrer_policy(
-          URLRequest::CLEAR_REFERRER_ON_TRANSITION_FROM_SECURE_TO_INSECURE) {}
+          ReferrerPolicy::CLEAR_ON_TRANSITION_FROM_SECURE_TO_INSECURE) {}
 
 RedirectInfo::RedirectInfo(const RedirectInfo& other) = default;
 
@@ -119,7 +118,7 @@
     const GURL& original_url,
     const SiteForCookies& original_site_for_cookies,
     URLRequest::FirstPartyURLPolicy original_first_party_url_policy,
-    URLRequest::ReferrerPolicy original_referrer_policy,
+    ReferrerPolicy original_referrer_policy,
     const std::string& original_referrer,
     int http_status_code,
     const GURL& new_location,
diff --git a/net/url_request/redirect_info.h b/net/url_request/redirect_info.h
index 67ed940..1d37b357 100644
--- a/net/url_request/redirect_info.h
+++ b/net/url_request/redirect_info.h
@@ -8,6 +8,7 @@
 #include <string>
 
 #include "net/base/net_export.h"
+#include "net/url_request/referrer_policy.h"
 #include "net/url_request/url_request.h"
 #include "url/gurl.h"
 
@@ -29,7 +30,7 @@
       const GURL& original_url,
       const SiteForCookies& original_site_for_cookies,
       URLRequest::FirstPartyURLPolicy original_first_party_url_policy,
-      URLRequest::ReferrerPolicy original_referrer_policy,
+      ReferrerPolicy original_referrer_policy,
       const std::string& original_referrer,
       // The HTTP status code of the redirect response.
       int http_status_code,
@@ -74,7 +75,7 @@
 
   // The new referrer policy that should be obeyed if there are
   // subsequent redirects.
-  URLRequest::ReferrerPolicy new_referrer_policy;
+  ReferrerPolicy new_referrer_policy;
 };
 
 }  // namespace net
diff --git a/net/url_request/redirect_info_unittest.cc b/net/url_request/redirect_info_unittest.cc
index d4047b2..f786a94 100644
--- a/net/url_request/redirect_info_unittest.cc
+++ b/net/url_request/redirect_info_unittest.cc
@@ -7,6 +7,7 @@
 #include "base/strings/string_number_conversions.h"
 #include "net/http/http_util.h"
 #include "net/url_request/redirect_util.h"
+#include "net/url_request/referrer_policy.h"
 #include "testing/gtest/include/gtest/gtest.h"
 #include "url/gurl.h"
 
@@ -35,8 +36,7 @@
   const url::Origin kOriginalTopFrameOrigin = url::Origin::Create(kOriginalUrl);
   const URLRequest::FirstPartyURLPolicy kOriginalFirstPartyUrlPolicy =
       net::URLRequest::NEVER_CHANGE_FIRST_PARTY_URL;
-  const URLRequest::ReferrerPolicy kOriginalReferrerPolicy =
-      net::URLRequest::NEVER_CLEAR_REFERRER;
+  const ReferrerPolicy kOriginalReferrerPolicy = ReferrerPolicy::NEVER_CLEAR;
   const std::string kOriginalReferrer = "";
   const GURL kNewLocation = GURL("https://foo.test/redirected");
   const bool kInsecureSchemeWasUpgraded = false;
@@ -87,8 +87,7 @@
       SiteForCookies::FromUrl(GURL("https://foo.test/"));
   const URLRequest::FirstPartyURLPolicy kOriginalFirstPartyUrlPolicy =
       net::URLRequest::NEVER_CHANGE_FIRST_PARTY_URL;
-  const URLRequest::ReferrerPolicy kOriginalReferrerPolicy =
-      net::URLRequest::NEVER_CLEAR_REFERRER;
+  const ReferrerPolicy kOriginalReferrerPolicy = ReferrerPolicy::NEVER_CLEAR;
   const std::string kOriginalReferrer = "";
   const int kHttpStatusCode = 301;
   const bool kInsecureSchemeWasUpgraded = false;
@@ -125,8 +124,7 @@
   const GURL kOriginalUrl = GURL("https://foo.test/");
   const SiteForCookies kOriginalSiteForCookies =
       SiteForCookies::FromUrl(GURL("https://foo.test/"));
-  const URLRequest::ReferrerPolicy kOriginalReferrerPolicy =
-      net::URLRequest::NEVER_CLEAR_REFERRER;
+  const ReferrerPolicy kOriginalReferrerPolicy = ReferrerPolicy::NEVER_CLEAR;
   const std::string kOriginalReferrer = "";
   const GURL kNewLocation = GURL("https://foo.test/redirected");
   const bool kInsecureSchemeWasUpgraded = false;
@@ -155,8 +153,8 @@
     const char* original_url;
     const char* original_referrer;
     const char* response_headers;
-    URLRequest::ReferrerPolicy original_referrer_policy;
-    URLRequest::ReferrerPolicy expected_new_referrer_policy;
+    ReferrerPolicy original_referrer_policy;
+    ReferrerPolicy expected_new_referrer_policy;
     const char* expected_referrer;
   };
 
@@ -168,8 +166,8 @@
        "Location: http://foo.test/test\n"
        "Referrer-Policy: no-referrer\n",
        // original policy
-       URLRequest::CLEAR_REFERRER_ON_TRANSITION_FROM_SECURE_TO_INSECURE,
-       URLRequest::NO_REFERRER /* expected new policy */,
+       ReferrerPolicy::CLEAR_ON_TRANSITION_FROM_SECURE_TO_INSECURE,
+       ReferrerPolicy::NO_REFERRER /* expected new policy */,
        "" /* expected new referrer */},
 
       // Same as above but for the legacy keyword 'never', which should not be
@@ -178,9 +176,9 @@
        "http://foo.test/one" /* original referrer */,
        "Location: http://foo.test/test\nReferrer-Policy: never\n",
        // original policy
-       URLRequest::CLEAR_REFERRER_ON_TRANSITION_FROM_SECURE_TO_INSECURE,
+       ReferrerPolicy::CLEAR_ON_TRANSITION_FROM_SECURE_TO_INSECURE,
        // expected new policy
-       URLRequest::CLEAR_REFERRER_ON_TRANSITION_FROM_SECURE_TO_INSECURE,
+       ReferrerPolicy::CLEAR_ON_TRANSITION_FROM_SECURE_TO_INSECURE,
        "http://foo.test/one" /* expected new referrer */},
 
       // If a redirect serves 'Referrer-Policy: no-referrer-when-downgrade',
@@ -190,9 +188,9 @@
        "https://foo.test/one" /* original referrer */,
        "Location: http://foo.test\n"
        "Referrer-Policy: no-referrer-when-downgrade\n",
-       URLRequest::NEVER_CLEAR_REFERRER /* original policy */,
+       ReferrerPolicy::NEVER_CLEAR /* original policy */,
        // expected new policy
-       URLRequest::CLEAR_REFERRER_ON_TRANSITION_FROM_SECURE_TO_INSECURE,
+       ReferrerPolicy::CLEAR_ON_TRANSITION_FROM_SECURE_TO_INSECURE,
        "" /* expected new referrer */},
 
       // Same as above but for the legacy keyword 'default', which should not be
@@ -201,9 +199,9 @@
        "https://foo.test/one" /* original referrer */,
        "Location: http://foo.test\n"
        "Referrer-Policy: default\n",
-       URLRequest::NEVER_CLEAR_REFERRER /* original policy */,
+       ReferrerPolicy::NEVER_CLEAR /* original policy */,
        // expected new policy
-       URLRequest::NEVER_CLEAR_REFERRER,
+       ReferrerPolicy::NEVER_CLEAR,
        "https://foo.test/one" /* expected new referrer */},
 
       // If a redirect serves 'Referrer-Policy: no-referrer-when-downgrade',
@@ -213,9 +211,9 @@
        "https://foo.test/one" /* original referrer */,
        "Location: https://foo.test\n"
        "Referrer-Policy: no-referrer-when-downgrade\n",
-       URLRequest::NEVER_CLEAR_REFERRER /* original policy */,
+       ReferrerPolicy::NEVER_CLEAR /* original policy */,
        // expected new policy
-       URLRequest::CLEAR_REFERRER_ON_TRANSITION_FROM_SECURE_TO_INSECURE,
+       ReferrerPolicy::CLEAR_ON_TRANSITION_FROM_SECURE_TO_INSECURE,
        "https://foo.test/one" /* expected new referrer */},
 
       // If a redirect serves 'Referrer-Policy: origin', then the referrer
@@ -225,8 +223,8 @@
        "https://foo.test/one" /* original referrer */,
        "Location: https://foo.test/two\n"
        "Referrer-Policy: origin\n",
-       URLRequest::NEVER_CLEAR_REFERRER /* original policy */,
-       URLRequest::ORIGIN /* expected new policy */,
+       ReferrerPolicy::NEVER_CLEAR /* original policy */,
+       ReferrerPolicy::ORIGIN /* expected new policy */,
        "https://foo.test/" /* expected new referrer */},
 
       // If a redirect serves 'Referrer-Policy: origin-when-cross-origin', then
@@ -235,8 +233,8 @@
        "https://foo.test/referrer" /* original referrer */,
        "Location: https://foo.test/two\n"
        "Referrer-Policy: origin-when-cross-origin\n",
-       URLRequest::NEVER_CLEAR_REFERRER /* original policy */,
-       URLRequest::
+       ReferrerPolicy::NEVER_CLEAR /* original policy */,
+       ReferrerPolicy::
            ORIGIN_ONLY_ON_TRANSITION_CROSS_ORIGIN /* expected new policy */,
        "https://foo.test/referrer" /* expected new referrer */},
 
@@ -245,8 +243,8 @@
        "https://foo.test/one" /* original referrer */,
        "Location: https://bar.test/two\n"
        "Referrer-Policy: origin-when-cross-origin\n",
-       URLRequest::NEVER_CLEAR_REFERRER /* original policy */,
-       URLRequest::
+       ReferrerPolicy::NEVER_CLEAR /* original policy */,
+       ReferrerPolicy::
            ORIGIN_ONLY_ON_TRANSITION_CROSS_ORIGIN /* expected new policy */,
        "https://foo.test/" /* expected new referrer */},
 
@@ -256,8 +254,8 @@
        "https://foo.test/referrer" /* original referrer */,
        "Location: https://foo.test/two\n"
        "Referrer-Policy: same-origin\n",
-       URLRequest::NEVER_CLEAR_REFERRER /* original policy */,
-       URLRequest::CLEAR_REFERRER_ON_TRANSITION_CROSS_ORIGIN /* new policy */
+       ReferrerPolicy::NEVER_CLEAR /* original policy */,
+       ReferrerPolicy::CLEAR_ON_TRANSITION_CROSS_ORIGIN /* new policy */
        ,
        "https://foo.test/referrer" /* expected new referrer */},
 
@@ -266,8 +264,8 @@
        "https://foo.test/referrer" /* original referrer */,
        "Location: https://bar.test/two\n"
        "Referrer-Policy: same-origin\n",
-       URLRequest::NEVER_CLEAR_REFERRER /* original policy */,
-       URLRequest::CLEAR_REFERRER_ON_TRANSITION_CROSS_ORIGIN,
+       ReferrerPolicy::NEVER_CLEAR /* original policy */,
+       ReferrerPolicy::CLEAR_ON_TRANSITION_CROSS_ORIGIN,
        "" /* expected new referrer */},
 
       // If a redirect serves 'Referrer-Policy: strict-origin', then the
@@ -277,15 +275,15 @@
        "https://foo.test/referrer" /* original referrer */,
        "Location: https://bar.test/two\n"
        "Referrer-Policy: strict-origin\n",
-       URLRequest::NEVER_CLEAR_REFERRER /* original policy */,
-       URLRequest::ORIGIN_CLEAR_ON_TRANSITION_FROM_SECURE_TO_INSECURE,
+       ReferrerPolicy::NEVER_CLEAR /* original policy */,
+       ReferrerPolicy::ORIGIN_CLEAR_ON_TRANSITION_FROM_SECURE_TO_INSECURE,
        "https://foo.test/" /* expected new referrer */},
       {"http://foo.test/one" /* original url */,
        "http://foo.test/referrer" /* original referrer */,
        "Location: http://bar.test/two\n"
        "Referrer-Policy: strict-origin\n",
-       URLRequest::NEVER_CLEAR_REFERRER /* original policy */,
-       URLRequest::ORIGIN_CLEAR_ON_TRANSITION_FROM_SECURE_TO_INSECURE,
+       ReferrerPolicy::NEVER_CLEAR /* original policy */,
+       ReferrerPolicy::ORIGIN_CLEAR_ON_TRANSITION_FROM_SECURE_TO_INSECURE,
        "http://foo.test/" /* expected new referrer */},
 
       // ... but should be cleared for a downgrading redirect.
@@ -293,8 +291,8 @@
        "https://foo.test/referrer" /* original referrer */,
        "Location: http://foo.test/two\n"
        "Referrer-Policy: strict-origin\n",
-       URLRequest::NEVER_CLEAR_REFERRER /* original policy */,
-       URLRequest::ORIGIN_CLEAR_ON_TRANSITION_FROM_SECURE_TO_INSECURE,
+       ReferrerPolicy::NEVER_CLEAR /* original policy */,
+       ReferrerPolicy::ORIGIN_CLEAR_ON_TRANSITION_FROM_SECURE_TO_INSECURE,
        "" /* expected new referrer */},
 
       // If a redirect serves 'Referrer-Policy:
@@ -304,15 +302,15 @@
        "https://foo.test/referrer" /* original referrer */,
        "Location: https://foo.test/two\n"
        "Referrer-Policy: strict-origin-when-cross-origin\n",
-       URLRequest::NEVER_CLEAR_REFERRER /* original policy */,
-       URLRequest::REDUCE_REFERRER_GRANULARITY_ON_TRANSITION_CROSS_ORIGIN,
+       ReferrerPolicy::NEVER_CLEAR /* original policy */,
+       ReferrerPolicy::REDUCE_GRANULARITY_ON_TRANSITION_CROSS_ORIGIN,
        "https://foo.test/referrer" /* expected new referrer */},
       {"http://foo.test/one" /* original url */,
        "http://foo.test/referrer" /* original referrer */,
        "Location: http://foo.test/two\n"
        "Referrer-Policy: strict-origin-when-cross-origin\n",
-       URLRequest::NEVER_CLEAR_REFERRER /* original policy */,
-       URLRequest::REDUCE_REFERRER_GRANULARITY_ON_TRANSITION_CROSS_ORIGIN,
+       ReferrerPolicy::NEVER_CLEAR /* original policy */,
+       ReferrerPolicy::REDUCE_GRANULARITY_ON_TRANSITION_CROSS_ORIGIN,
        "http://foo.test/referrer" /* expected new referrer */},
 
       // ... but should be stripped to the origin for a cross-origin
@@ -321,15 +319,15 @@
        "https://foo.test/referrer" /* original referrer */,
        "Location: https://bar.test/two\n"
        "Referrer-Policy: strict-origin-when-cross-origin\n",
-       URLRequest::NEVER_CLEAR_REFERRER /* original policy */,
-       URLRequest::REDUCE_REFERRER_GRANULARITY_ON_TRANSITION_CROSS_ORIGIN,
+       ReferrerPolicy::NEVER_CLEAR /* original policy */,
+       ReferrerPolicy::REDUCE_GRANULARITY_ON_TRANSITION_CROSS_ORIGIN,
        "https://foo.test/" /* expected new referrer */},
       {"http://foo.test/one" /* original url */,
        "http://foo.test/referrer" /* original referrer */,
        "Location: http://bar.test/two\n"
        "Referrer-Policy: strict-origin-when-cross-origin\n",
-       URLRequest::NEVER_CLEAR_REFERRER /* original policy */,
-       URLRequest::REDUCE_REFERRER_GRANULARITY_ON_TRANSITION_CROSS_ORIGIN,
+       ReferrerPolicy::NEVER_CLEAR /* original policy */,
+       ReferrerPolicy::REDUCE_GRANULARITY_ON_TRANSITION_CROSS_ORIGIN,
        "http://foo.test/" /* expected new referrer */},
 
       // ... and should be cleared for a downgrading redirect.
@@ -337,8 +335,8 @@
        "https://foo.test/referrer" /* original referrer */,
        "Location: http://foo.test/two\n"
        "Referrer-Policy: strict-origin-when-cross-origin\n",
-       URLRequest::NEVER_CLEAR_REFERRER /* original policy */,
-       URLRequest::REDUCE_REFERRER_GRANULARITY_ON_TRANSITION_CROSS_ORIGIN,
+       ReferrerPolicy::NEVER_CLEAR /* original policy */,
+       ReferrerPolicy::REDUCE_GRANULARITY_ON_TRANSITION_CROSS_ORIGIN,
        "" /* expected new referrer */},
 
       // If a redirect serves 'Referrer-Policy: unsafe-url', then the referrer
@@ -347,8 +345,9 @@
        "https://foo.test/one" /* original referrer */,
        "Location: http://bar.test/two\n"
        "Referrer-Policy: unsafe-url\n",
-       URLRequest::ORIGIN_ONLY_ON_TRANSITION_CROSS_ORIGIN /* original policy */,
-       URLRequest::NEVER_CLEAR_REFERRER /* expected new policy */,
+       ReferrerPolicy::
+           ORIGIN_ONLY_ON_TRANSITION_CROSS_ORIGIN /* original policy */,
+       ReferrerPolicy::NEVER_CLEAR /* expected new policy */,
        "https://foo.test/one" /* expected new referrer */},
 
       // Same as above but for the legacy keyword 'always', which should not be
@@ -357,8 +356,9 @@
        "https://foo.test/one" /* original referrer */,
        "Location: http://bar.test/two\n"
        "Referrer-Policy: always\n",
-       URLRequest::ORIGIN_ONLY_ON_TRANSITION_CROSS_ORIGIN /* original policy */,
-       URLRequest::
+       ReferrerPolicy::
+           ORIGIN_ONLY_ON_TRANSITION_CROSS_ORIGIN /* original policy */,
+       ReferrerPolicy::
            ORIGIN_ONLY_ON_TRANSITION_CROSS_ORIGIN /* expected new policy */,
        "https://foo.test/" /* expected new referrer */},
 
@@ -367,8 +367,9 @@
        "https://foo.test/one" /* original referrer */,
        "Location: https://bar.test/two\n"
        "Referrer-Policy: not-a-valid-policy\n",
-       URLRequest::ORIGIN_ONLY_ON_TRANSITION_CROSS_ORIGIN /* original policy */,
-       URLRequest::
+       ReferrerPolicy::
+           ORIGIN_ONLY_ON_TRANSITION_CROSS_ORIGIN /* original policy */,
+       ReferrerPolicy::
            ORIGIN_ONLY_ON_TRANSITION_CROSS_ORIGIN /* expected new policy */,
        "https://foo.test/" /* expected new referrer */},
 
@@ -377,9 +378,9 @@
        "Location: http://bar.test/two\n"
        "Referrer-Policy: not-a-valid-policy\n",
        // original policy
-       URLRequest::CLEAR_REFERRER_ON_TRANSITION_FROM_SECURE_TO_INSECURE,
+       ReferrerPolicy::CLEAR_ON_TRANSITION_FROM_SECURE_TO_INSECURE,
        // expected new policy
-       URLRequest::CLEAR_REFERRER_ON_TRANSITION_FROM_SECURE_TO_INSECURE,
+       ReferrerPolicy::CLEAR_ON_TRANSITION_FROM_SECURE_TO_INSECURE,
        "" /* expected new referrer */},
 
       // The last valid keyword should take precedence.
@@ -388,8 +389,9 @@
        "Location: https://bar.test/two\n"
        "Referrer-Policy: unsafe-url\n"
        "Referrer-Policy: not-a-valid-policy\n",
-       URLRequest::ORIGIN_ONLY_ON_TRANSITION_CROSS_ORIGIN /* original policy */,
-       URLRequest::NEVER_CLEAR_REFERRER /* expected new policy */,
+       ReferrerPolicy::
+           ORIGIN_ONLY_ON_TRANSITION_CROSS_ORIGIN /* original policy */,
+       ReferrerPolicy::NEVER_CLEAR /* expected new policy */,
        "https://foo.test/one" /* expected new referrer */},
 
       {"https://foo.test/one" /* original url */,
@@ -397,8 +399,9 @@
        "Location: https://bar.test/two\n"
        "Referrer-Policy: unsafe-url\n"
        "Referrer-Policy: origin\n",
-       URLRequest::ORIGIN_ONLY_ON_TRANSITION_CROSS_ORIGIN /* original policy */,
-       URLRequest::ORIGIN /* expected new policy */,
+       ReferrerPolicy::
+           ORIGIN_ONLY_ON_TRANSITION_CROSS_ORIGIN /* original policy */,
+       ReferrerPolicy::ORIGIN /* expected new policy */,
        "https://foo.test/" /* expected new referrer */},
 
       // An empty header should not affect the request.
@@ -406,8 +409,9 @@
        "https://foo.test/one" /* original referrer */,
        "Location: https://bar.test/two\n"
        "Referrer-Policy: \n",
-       URLRequest::ORIGIN_ONLY_ON_TRANSITION_CROSS_ORIGIN /* original policy */,
-       URLRequest::
+       ReferrerPolicy::
+           ORIGIN_ONLY_ON_TRANSITION_CROSS_ORIGIN /* original policy */,
+       ReferrerPolicy::
            ORIGIN_ONLY_ON_TRANSITION_CROSS_ORIGIN /* expected new policy */,
        "https://foo.test/" /* expected new referrer */},
 
@@ -417,9 +421,9 @@
        "http://foo.test/one" /* original referrer */,
        "Location: http://foo.test/test\n",
        // original policy
-       URLRequest::CLEAR_REFERRER_ON_TRANSITION_FROM_SECURE_TO_INSECURE,
+       ReferrerPolicy::CLEAR_ON_TRANSITION_FROM_SECURE_TO_INSECURE,
        // expected new policy
-       URLRequest::CLEAR_REFERRER_ON_TRANSITION_FROM_SECURE_TO_INSECURE,
+       ReferrerPolicy::CLEAR_ON_TRANSITION_FROM_SECURE_TO_INSECURE,
        "http://foo.test/one" /* expected new referrer */},
   };
 
diff --git a/net/url_request/referrer_policy.h b/net/url_request/referrer_policy.h
new file mode 100644
index 0000000..1ac465f
--- /dev/null
+++ b/net/url_request/referrer_policy.h
@@ -0,0 +1,50 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef NET_URL_REQUEST_REFERRER_POLICY_H_
+#define NET_URL_REQUEST_REFERRER_POLICY_H_
+
+namespace net {
+
+// A ReferrerPolicy controls the contents of the Referer header when URLRequest
+// following HTTP redirects. Note that setting a ReferrerPolicy on the request
+// has no effect on the Referer header of the initial leg of the request; the
+// caller is responsible for setting the initial Referer, and the ReferrerPolicy
+// only controls what happens to the Referer while following redirects.
+//
+// NOTE: This enum is persisted to histograms. Do not change or reorder values.
+// TODO(~M89): Once the Net.URLRequest.ReferrerPolicyForRequest metric is
+// retired.
+enum class ReferrerPolicy {
+  // Clear the referrer header if the header value is HTTPS but the request
+  // destination is HTTP. This is the default behavior of URLRequest.
+  CLEAR_ON_TRANSITION_FROM_SECURE_TO_INSECURE = 0,
+  // A slight variant on CLEAR_ON_TRANSITION_FROM_SECURE_TO_INSECURE:
+  // If the request destination is HTTP, an HTTPS referrer will be cleared. If
+  // the request's destination is cross-origin with the referrer (but does not
+  // downgrade), the referrer's granularity will be stripped down to an origin
+  // rather than a full URL. Same-origin requests will send the full referrer.
+  REDUCE_GRANULARITY_ON_TRANSITION_CROSS_ORIGIN = 1,
+  // Strip the referrer down to an origin when the origin of the referrer is
+  // different from the destination's origin.
+  ORIGIN_ONLY_ON_TRANSITION_CROSS_ORIGIN = 2,
+  // Never change the referrer.
+  NEVER_CLEAR = 3,
+  // Strip the referrer down to the origin regardless of the redirect
+  // location.
+  ORIGIN = 4,
+  // Clear the referrer when the request's referrer is cross-origin with
+  // the request's destination.
+  CLEAR_ON_TRANSITION_CROSS_ORIGIN = 5,
+  // Strip the referrer down to the origin, but clear it entirely if the
+  // referrer value is HTTPS and the destination is HTTP.
+  ORIGIN_CLEAR_ON_TRANSITION_FROM_SECURE_TO_INSECURE = 6,
+  // Always clear the referrer regardless of the request destination.
+  NO_REFERRER = 7,
+  MAX = NO_REFERRER,
+};
+
+}  // namespace net
+
+#endif  // NET_URL_REQUEST_REFERRER_POLICY_H_
diff --git a/net/url_request/test_url_fetcher_factory.cc b/net/url_request/test_url_fetcher_factory.cc
index 61a4438..098708c 100644
--- a/net/url_request/test_url_fetcher_factory.cc
+++ b/net/url_request/test_url_fetcher_factory.cc
@@ -105,9 +105,7 @@
 void TestURLFetcher::SetReferrer(const std::string& referrer) {
 }
 
-void TestURLFetcher::SetReferrerPolicy(
-    URLRequest::ReferrerPolicy referrer_policy) {
-}
+void TestURLFetcher::SetReferrerPolicy(ReferrerPolicy referrer_policy) {}
 
 void TestURLFetcher::SetExtraRequestHeaders(
     const std::string& extra_request_headers) {
diff --git a/net/url_request/test_url_fetcher_factory.h b/net/url_request/test_url_fetcher_factory.h
index f94eec96..4168030 100644
--- a/net/url_request/test_url_fetcher_factory.h
+++ b/net/url_request/test_url_fetcher_factory.h
@@ -25,6 +25,7 @@
 #include "net/http/http_request_headers.h"
 #include "net/http/http_status_code.h"
 #include "net/traffic_annotation/network_traffic_annotation_test_helper.h"
+#include "net/url_request/referrer_policy.h"
 #include "net/url_request/url_fetcher_factory.h"
 #include "net/url_request/url_request_status.h"
 #include "url/gurl.h"
@@ -114,7 +115,7 @@
   int GetLoadFlags() const override;
   void SetAllowCredentials(bool allow_credentials) override {}
   void SetReferrer(const std::string& referrer) override;
-  void SetReferrerPolicy(URLRequest::ReferrerPolicy referrer_policy) override;
+  void SetReferrerPolicy(ReferrerPolicy referrer_policy) override;
   void SetExtraRequestHeaders(
       const std::string& extra_request_headers) override;
   void AddExtraRequestHeader(const std::string& header_line) override;
diff --git a/net/url_request/url_fetcher.h b/net/url_request/url_fetcher.h
index 2a0b0ac1..004079d 100644
--- a/net/url_request/url_fetcher.h
+++ b/net/url_request/url_fetcher.h
@@ -18,6 +18,7 @@
 #include "net/base/ip_endpoint.h"
 #include "net/base/net_export.h"
 #include "net/traffic_annotation/network_traffic_annotation.h"
+#include "net/url_request/referrer_policy.h"
 #include "net/url_request/url_request.h"
 #include "net/url_request/url_request_status.h"
 
@@ -203,8 +204,7 @@
 
   // The referrer policy to apply when updating the referrer during redirects.
   // The referrer policy may only be changed before Start() is called.
-  virtual void SetReferrerPolicy(
-      URLRequest::ReferrerPolicy referrer_policy) = 0;
+  virtual void SetReferrerPolicy(ReferrerPolicy referrer_policy) = 0;
 
   // Set extra headers on the request.  Must be called before the request
   // is started.
diff --git a/net/url_request/url_fetcher_core.cc b/net/url_request/url_fetcher_core.cc
index f4e1f4b..d810bbc 100644
--- a/net/url_request/url_fetcher_core.cc
+++ b/net/url_request/url_fetcher_core.cc
@@ -90,7 +90,7 @@
       upload_range_offset_(0),
       upload_range_length_(0),
       referrer_policy_(
-          URLRequest::CLEAR_REFERRER_ON_TRANSITION_FROM_SECURE_TO_INSECURE),
+          ReferrerPolicy::CLEAR_ON_TRANSITION_FROM_SECURE_TO_INSECURE),
       is_chunked_upload_(false),
       was_cancelled_(false),
       stop_on_redirect_(false),
@@ -227,8 +227,7 @@
   referrer_ = referrer;
 }
 
-void URLFetcherCore::SetReferrerPolicy(
-    URLRequest::ReferrerPolicy referrer_policy) {
+void URLFetcherCore::SetReferrerPolicy(ReferrerPolicy referrer_policy) {
   referrer_policy_ = referrer_policy;
 }
 
diff --git a/net/url_request/url_fetcher_core.h b/net/url_request/url_fetcher_core.h
index 33a39ee9..f441994 100644
--- a/net/url_request/url_fetcher_core.h
+++ b/net/url_request/url_fetcher_core.h
@@ -22,6 +22,7 @@
 #include "net/base/proxy_server.h"
 #include "net/http/http_request_headers.h"
 #include "net/traffic_annotation/network_traffic_annotation.h"
+#include "net/url_request/referrer_policy.h"
 #include "net/url_request/url_fetcher.h"
 #include "net/url_request/url_request.h"
 #include "net/url_request/url_request_context_getter_observer.h"
@@ -88,7 +89,7 @@
   int GetLoadFlags() const;
   void SetAllowCredentials(bool allow_credentials);
   void SetReferrer(const std::string& referrer);
-  void SetReferrerPolicy(URLRequest::ReferrerPolicy referrer_policy);
+  void SetReferrerPolicy(ReferrerPolicy referrer_policy);
   void SetExtraRequestHeaders(const std::string& extra_request_headers);
   void AddExtraRequestHeader(const std::string& header_line);
   void SetRequestContext(URLRequestContextGetter* request_context_getter);
@@ -277,7 +278,7 @@
       upload_stream_factory_;        // Callback to create HTTP POST payload.
   std::string upload_content_type_;  // MIME type of POST payload
   std::string referrer_;             // HTTP Referer header value and policy
-  URLRequest::ReferrerPolicy referrer_policy_;
+  ReferrerPolicy referrer_policy_;
   bool is_chunked_upload_;           // True if using chunked transfer encoding
 
   // Used to write to |chunked_stream|, even after ownership has been passed to
diff --git a/net/url_request/url_fetcher_impl.cc b/net/url_request/url_fetcher_impl.cc
index 0c82b35..7ad2523 100644
--- a/net/url_request/url_fetcher_impl.cc
+++ b/net/url_request/url_fetcher_impl.cc
@@ -59,8 +59,7 @@
   core_->SetReferrer(referrer);
 }
 
-void URLFetcherImpl::SetReferrerPolicy(
-    URLRequest::ReferrerPolicy referrer_policy) {
+void URLFetcherImpl::SetReferrerPolicy(ReferrerPolicy referrer_policy) {
   core_->SetReferrerPolicy(referrer_policy);
 }
 
diff --git a/net/url_request/url_fetcher_impl.h b/net/url_request/url_fetcher_impl.h
index c9c8a3c..86de47dc 100644
--- a/net/url_request/url_fetcher_impl.h
+++ b/net/url_request/url_fetcher_impl.h
@@ -23,6 +23,7 @@
 #include "net/base/ip_endpoint.h"
 #include "net/base/net_export.h"
 #include "net/traffic_annotation/network_traffic_annotation.h"
+#include "net/url_request/referrer_policy.h"
 #include "net/url_request/url_fetcher.h"
 
 namespace net {
@@ -53,7 +54,7 @@
   void SetAllowCredentials(bool allow_credentials) override;
   int GetLoadFlags() const override;
   void SetReferrer(const std::string& referrer) override;
-  void SetReferrerPolicy(URLRequest::ReferrerPolicy referrer_policy) override;
+  void SetReferrerPolicy(ReferrerPolicy referrer_policy) override;
   void SetExtraRequestHeaders(
       const std::string& extra_request_headers) override;
   void AddExtraRequestHeader(const std::string& header_line) override;
diff --git a/net/url_request/url_request.cc b/net/url_request/url_request.cc
index b09e02a1..65341184f 100644
--- a/net/url_request/url_request.cc
+++ b/net/url_request/url_request.cc
@@ -541,7 +541,8 @@
       url_chain_(1, url),
       force_ignore_site_for_cookies_(false),
       method_("GET"),
-      referrer_policy_(CLEAR_REFERRER_ON_TRANSITION_FROM_SECURE_TO_INSECURE),
+      referrer_policy_(
+          ReferrerPolicy::CLEAR_ON_TRANSITION_FROM_SECURE_TO_INSECURE),
       first_party_url_policy_(NEVER_CHANGE_FIRST_PARTY_URL),
       load_flags_(LOAD_NORMAL),
       privacy_mode_(PRIVACY_MODE_ENABLED),
@@ -1129,14 +1130,14 @@
   if (request_is_same_origin) {
     UMA_HISTOGRAM_ENUMERATION(
         "Net.URLRequest.ReferrerPolicyForRequest.SameOrigin", referrer_policy_,
-        MAX_REFERRER_POLICY + 1);
+        static_cast<int>(ReferrerPolicy::MAX) + 1);
     UMA_HISTOGRAM_BOOLEAN(
         "Net.URLRequest.ReferrerHasInformativePath.SameOrigin",
         referrer_more_descriptive_than_its_origin);
   } else {
     UMA_HISTOGRAM_ENUMERATION(
         "Net.URLRequest.ReferrerPolicyForRequest.CrossOrigin", referrer_policy_,
-        MAX_REFERRER_POLICY + 1);
+        static_cast<int>(ReferrerPolicy::MAX) + 1);
     UMA_HISTOGRAM_BOOLEAN(
         "Net.URLRequest.ReferrerHasInformativePath.CrossOrigin",
         referrer_more_descriptive_than_its_origin);
diff --git a/net/url_request/url_request.h b/net/url_request/url_request.h
index 0a3d8dd..6a69bf2 100644
--- a/net/url_request/url_request.h
+++ b/net/url_request/url_request.h
@@ -42,6 +42,7 @@
 #include "net/socket/connection_attempts.h"
 #include "net/socket/socket_tag.h"
 #include "net/traffic_annotation/network_traffic_annotation.h"
+#include "net/url_request/referrer_policy.h"
 #include "url/gurl.h"
 #include "url/origin.h"
 
@@ -84,47 +85,6 @@
                                           NetworkDelegate* network_delegate,
                                           const std::string& scheme);
 
-  // A ReferrerPolicy for the request can be set with
-  // set_referrer_policy() and controls the contents of the Referer
-  // header when URLRequest follows server redirects. Note that setting
-  // a ReferrerPolicy on the request has no effect on the Referer header
-  // of the initial leg of the request; the caller is responsible for
-  // setting the initial Referer, and the ReferrerPolicy only controls
-  // what happens to the Referer while following redirects.
-  //
-  // NOTE: This enum is persisted to histograms. Do not change or reorder
-  // values.
-  // TODO(~M82): Once the Net.URLRequest.ReferrerPolicyForRequest
-  // metric is retired, remove this notice.
-  enum ReferrerPolicy {
-    // Clear the referrer header if the header value is HTTPS but the request
-    // destination is HTTP. This is the default behavior of URLRequest.
-    CLEAR_REFERRER_ON_TRANSITION_FROM_SECURE_TO_INSECURE = 0,
-    // A slight variant on CLEAR_REFERRER_ON_TRANSITION_FROM_SECURE_TO_INSECURE:
-    // If the request destination is HTTP, an HTTPS referrer will be cleared. If
-    // the request's destination is cross-origin with the referrer (but does not
-    // downgrade), the referrer's granularity will be stripped down to an origin
-    // rather than a full URL. Same-origin requests will send the full referrer.
-    REDUCE_REFERRER_GRANULARITY_ON_TRANSITION_CROSS_ORIGIN = 1,
-    // Strip the referrer down to an origin when the origin of the referrer is
-    // different from the destination's origin.
-    ORIGIN_ONLY_ON_TRANSITION_CROSS_ORIGIN = 2,
-    // Never change the referrer.
-    NEVER_CLEAR_REFERRER = 3,
-    // Strip the referrer down to the origin regardless of the redirect
-    // location.
-    ORIGIN = 4,
-    // Clear the referrer when the request's referrer is cross-origin with
-    // the request's destination.
-    CLEAR_REFERRER_ON_TRANSITION_CROSS_ORIGIN = 5,
-    // Strip the referrer down to the origin, but clear it entirely if the
-    // referrer value is HTTPS and the destination is HTTP.
-    ORIGIN_CLEAR_ON_TRANSITION_FROM_SECURE_TO_INSECURE = 6,
-    // Always clear the referrer regardless of the request destination.
-    NO_REFERRER = 7,
-    MAX_REFERRER_POLICY = NO_REFERRER
-  };
-
   // First-party URL redirect policy: During server redirects, the first-party
   // URL for cookies normally doesn't change. However, if the request is a
   // top-level first-party request, the first-party URL should be updated to the
diff --git a/net/url_request/url_request_job.cc b/net/url_request/url_request_job.cc
index bf062d0f..e1e4d408 100644
--- a/net/url_request/url_request_job.cc
+++ b/net/url_request/url_request_job.cc
@@ -290,7 +290,7 @@
 
 // static
 GURL URLRequestJob::ComputeReferrerForPolicy(
-    URLRequest::ReferrerPolicy policy,
+    ReferrerPolicy policy,
     const GURL& original_referrer,
     const GURL& destination,
     bool* same_origin_out_for_metrics) {
@@ -335,13 +335,13 @@
       !destination.SchemeIsCryptographic();
 
   switch (policy) {
-    case URLRequest::CLEAR_REFERRER_ON_TRANSITION_FROM_SECURE_TO_INSECURE:
+    case ReferrerPolicy::CLEAR_ON_TRANSITION_FROM_SECURE_TO_INSECURE:
       if (secure_referrer_but_insecure_destination)
         return GURL();
       return MaybeStripToOrigin(std::move(stripped_referrer),
                                 should_strip_to_origin);
 
-    case URLRequest::REDUCE_REFERRER_GRANULARITY_ON_TRANSITION_CROSS_ORIGIN:
+    case ReferrerPolicy::REDUCE_GRANULARITY_ON_TRANSITION_CROSS_ORIGIN:
       if (secure_referrer_but_insecure_destination)
         return GURL();
       if (!same_origin)
@@ -349,35 +349,35 @@
       return MaybeStripToOrigin(std::move(stripped_referrer),
                                 should_strip_to_origin);
 
-    case URLRequest::ORIGIN_ONLY_ON_TRANSITION_CROSS_ORIGIN:
+    case ReferrerPolicy::ORIGIN_ONLY_ON_TRANSITION_CROSS_ORIGIN:
       if (!same_origin)
         should_strip_to_origin = true;
       return MaybeStripToOrigin(std::move(stripped_referrer),
                                 should_strip_to_origin);
 
-    case URLRequest::NEVER_CLEAR_REFERRER:
+    case ReferrerPolicy::NEVER_CLEAR:
       return MaybeStripToOrigin(std::move(stripped_referrer),
                                 should_strip_to_origin);
 
-    case URLRequest::ORIGIN:
+    case ReferrerPolicy::ORIGIN:
       should_strip_to_origin = true;
       return MaybeStripToOrigin(std::move(stripped_referrer),
                                 should_strip_to_origin);
 
-    case URLRequest::CLEAR_REFERRER_ON_TRANSITION_CROSS_ORIGIN:
+    case ReferrerPolicy::CLEAR_ON_TRANSITION_CROSS_ORIGIN:
       if (!same_origin)
         return GURL();
       return MaybeStripToOrigin(std::move(stripped_referrer),
                                 should_strip_to_origin);
 
-    case URLRequest::ORIGIN_CLEAR_ON_TRANSITION_FROM_SECURE_TO_INSECURE:
+    case ReferrerPolicy::ORIGIN_CLEAR_ON_TRANSITION_FROM_SECURE_TO_INSECURE:
       if (secure_referrer_but_insecure_destination)
         return GURL();
       should_strip_to_origin = true;
       return MaybeStripToOrigin(std::move(stripped_referrer),
                                 should_strip_to_origin);
 
-    case URLRequest::NO_REFERRER:
+    case ReferrerPolicy::NO_REFERRER:
       return GURL();
   }
 
diff --git a/net/url_request/url_request_job.h b/net/url_request/url_request_job.h
index 24ced73..7e34fff 100644
--- a/net/url_request/url_request_job.h
+++ b/net/url_request/url_request_job.h
@@ -27,6 +27,7 @@
 #include "net/http/http_response_headers.h"
 #include "net/socket/connection_attempts.h"
 #include "net/url_request/redirect_info.h"
+#include "net/url_request/referrer_policy.h"
 #include "net/url_request/url_request.h"
 #include "url/gurl.h"
 
@@ -249,7 +250,7 @@
   // (This allows reporting in a UMA whether the request is same-origin, without
   // recomputing that information.)
   static GURL ComputeReferrerForPolicy(
-      URLRequest::ReferrerPolicy policy,
+      ReferrerPolicy policy,
       const GURL& original_referrer,
       const GURL& destination,
       bool* same_origin_out_for_metrics = nullptr);
diff --git a/net/url_request/url_request_job_unittest.cc b/net/url_request/url_request_job_unittest.cc
index 4f6ed2d..7db8a73 100644
--- a/net/url_request/url_request_job_unittest.cc
+++ b/net/url_request/url_request_job_unittest.cc
@@ -16,6 +16,7 @@
 #include "net/test/test_data_directory.h"
 #include "net/test/test_with_task_environment.h"
 #include "net/traffic_annotation/network_traffic_annotation_test_helper.h"
+#include "net/url_request/referrer_policy.h"
 #include "net/url_request/url_request.h"
 #include "net/url_request/url_request_test_util.h"
 #include "testing/gmock/include/gmock/gmock.h"
@@ -439,8 +440,8 @@
     const char* original_url;
     const char* original_referrer;
     const char* response_headers;
-    URLRequest::ReferrerPolicy original_referrer_policy;
-    URLRequest::ReferrerPolicy expected_final_referrer_policy;
+    ReferrerPolicy original_referrer_policy;
+    ReferrerPolicy expected_final_referrer_policy;
     const char* expected_final_referrer;
   };
 
@@ -453,8 +454,8 @@
        "Location: http://foo.test/test\n"
        "Referrer-Policy: no-referrer\n",
        // original policy
-       URLRequest::CLEAR_REFERRER_ON_TRANSITION_FROM_SECURE_TO_INSECURE,
-       URLRequest::NO_REFERRER /* expected final policy */,
+       ReferrerPolicy::CLEAR_ON_TRANSITION_FROM_SECURE_TO_INSECURE,
+       ReferrerPolicy::NO_REFERRER /* expected final policy */,
        "" /* expected final referrer */},
 
       // A redirect response without Referrer-Policy header should not affect
@@ -463,9 +464,9 @@
        "http://foo.test/one" /* original referrer */,
        "Location: http://foo.test/test\n",
        // original policy
-       URLRequest::CLEAR_REFERRER_ON_TRANSITION_FROM_SECURE_TO_INSECURE,
+       ReferrerPolicy::CLEAR_ON_TRANSITION_FROM_SECURE_TO_INSECURE,
        // expected final policy
-       URLRequest::CLEAR_REFERRER_ON_TRANSITION_FROM_SECURE_TO_INSECURE,
+       ReferrerPolicy::CLEAR_ON_TRANSITION_FROM_SECURE_TO_INSECURE,
        "http://foo.test/one" /* expected final referrer */},
   };
 
@@ -640,7 +641,7 @@
 TEST(URLRequestJobComputeReferrer, SetsSameOriginForMetricsOnSameOrigin) {
   bool same_origin = false;
   URLRequestJob::ComputeReferrerForPolicy(
-      URLRequest::ReferrerPolicy(),
+      ReferrerPolicy(),
       /*original_referrer=*/GURL("http://google.com"),
       /*destination=*/GURL("http://google.com"), &same_origin);
   EXPECT_TRUE(same_origin);
@@ -649,7 +650,7 @@
 TEST(URLRequestJobComputeReferrer, SetsSameOriginForMetricsOnCrossOrigin) {
   bool same_origin = true;
   URLRequestJob::ComputeReferrerForPolicy(
-      URLRequest::ReferrerPolicy(),
+      ReferrerPolicy(),
       /*original_referrer=*/GURL("http://google.com"),
       /*destination=*/GURL("http://boggle.com"), &same_origin);
   EXPECT_FALSE(same_origin);
@@ -657,16 +658,15 @@
 
 TEST(URLRequestJobComputeReferrer, AcceptsNullptrInput) {
   // Shouldn't segfault.
-  URLRequestJob::ComputeReferrerForPolicy(URLRequest::ReferrerPolicy(), GURL(),
-                                          GURL(), nullptr);
+  URLRequestJob::ComputeReferrerForPolicy(ReferrerPolicy(), GURL(), GURL(),
+                                          nullptr);
 }
 
 TEST(URLRequestJobComputeReferrer, FilesystemDestination) {
-  EXPECT_EQ(
-      URLRequestJob::ComputeReferrerForPolicy(
-          URLRequest::NEVER_CLEAR_REFERRER, GURL("https://referrer.example"),
-          GURL("filesystem:https://destination.example"), nullptr),
-      GURL("https://referrer.example"));
+  EXPECT_EQ(URLRequestJob::ComputeReferrerForPolicy(
+                ReferrerPolicy::NEVER_CLEAR, GURL("https://referrer.example"),
+                GURL("filesystem:https://destination.example"), nullptr),
+            GURL("https://referrer.example"));
 }
 
 TEST(URLRequestJobComputeReferrer, TruncatesLongReferrer) {
@@ -674,9 +674,9 @@
   original_spec.resize(4097, 'a');
   const GURL kOriginalReferrer(original_spec);
 
-  EXPECT_EQ(URLRequestJob::ComputeReferrerForPolicy(
-                URLRequest::NEVER_CLEAR_REFERRER, kOriginalReferrer,
-                GURL("https://google.com")),
+  EXPECT_EQ(URLRequestJob::ComputeReferrerForPolicy(ReferrerPolicy::NEVER_CLEAR,
+                                                    kOriginalReferrer,
+                                                    GURL("https://google.com")),
             GURL("https://referrer.example/"));
 }
 
@@ -685,9 +685,9 @@
   original_spec.resize(4096, 'a');
   const GURL kOriginalReferrer(original_spec);
 
-  EXPECT_EQ(URLRequestJob::ComputeReferrerForPolicy(
-                URLRequest::NEVER_CLEAR_REFERRER, kOriginalReferrer,
-                GURL("https://google.com")),
+  EXPECT_EQ(URLRequestJob::ComputeReferrerForPolicy(ReferrerPolicy::NEVER_CLEAR,
+                                                    kOriginalReferrer,
+                                                    GURL("https://google.com")),
             kOriginalReferrer);
 }
 
@@ -696,9 +696,9 @@
   original_spec.resize(4095, 'a');
   const GURL kOriginalReferrer(original_spec);
 
-  EXPECT_EQ(URLRequestJob::ComputeReferrerForPolicy(
-                URLRequest::NEVER_CLEAR_REFERRER, kOriginalReferrer,
-                GURL("https://google.com")),
+  EXPECT_EQ(URLRequestJob::ComputeReferrerForPolicy(ReferrerPolicy::NEVER_CLEAR,
+                                                    kOriginalReferrer,
+                                                    GURL("https://google.com")),
             kOriginalReferrer);
 }
 
@@ -708,7 +708,7 @@
   // for having a very long ref should not be stripped to an origin by the "if
   // the length is too long, strip to the origin" check.
   EXPECT_EQ(URLRequestJob::ComputeReferrerForPolicy(
-                URLRequest::NEVER_CLEAR_REFERRER,
+                ReferrerPolicy::NEVER_CLEAR,
                 GURL(std::string("https://referrer.example/path#") +
                      std::string(5000, 'a')),
                 GURL("https://google.com")),
@@ -721,15 +721,15 @@
       kOriginalReferrer.spec().data(),
       kOriginalReferrer.parsed_for_possibly_invalid_spec().scheme));
 
-  EXPECT_EQ(URLRequestJob::ComputeReferrerForPolicy(
-                URLRequest::NEVER_CLEAR_REFERRER, kOriginalReferrer,
-                GURL("https://google.com")),
+  EXPECT_EQ(URLRequestJob::ComputeReferrerForPolicy(ReferrerPolicy::NEVER_CLEAR,
+                                                    kOriginalReferrer,
+                                                    GURL("https://google.com")),
             GURL());
 
-  EXPECT_EQ(
-      URLRequestJob::ComputeReferrerForPolicy(
-          URLRequest::ORIGIN, kOriginalReferrer, GURL("https://google.com")),
-      GURL());
+  EXPECT_EQ(URLRequestJob::ComputeReferrerForPolicy(ReferrerPolicy::ORIGIN,
+                                                    kOriginalReferrer,
+                                                    GURL("https://google.com")),
+            GURL());
 }
 
 TEST(URLRequestJobComputeReferrer, CapReferrerOnCrossOrigin) {
@@ -739,9 +739,9 @@
 
   const GURL kOriginalReferrer("https://boggle.com/path");
 
-  EXPECT_EQ(URLRequestJob::ComputeReferrerForPolicy(
-                URLRequest::NEVER_CLEAR_REFERRER, kOriginalReferrer,
-                GURL("https://google.com")),
+  EXPECT_EQ(URLRequestJob::ComputeReferrerForPolicy(ReferrerPolicy::NEVER_CLEAR,
+                                                    kOriginalReferrer,
+                                                    GURL("https://google.com")),
             GURL("https://boggle.com/"));
 }
 
@@ -753,7 +753,7 @@
 
   const GURL kOriginalReferrer("https://boggle.com/path");
 
-  EXPECT_EQ(URLRequestJob::ComputeReferrerForPolicy(URLRequest::NO_REFERRER,
+  EXPECT_EQ(URLRequestJob::ComputeReferrerForPolicy(ReferrerPolicy::NO_REFERRER,
                                                     kOriginalReferrer,
                                                     GURL("https://google.com")),
             GURL());
@@ -767,9 +767,9 @@
 
   const GURL kOriginalReferrer("https://boggle.com/path");
 
-  EXPECT_EQ(URLRequestJob::ComputeReferrerForPolicy(
-                URLRequest::NEVER_CLEAR_REFERRER, kOriginalReferrer,
-                GURL("https://boggle.com")),
+  EXPECT_EQ(URLRequestJob::ComputeReferrerForPolicy(ReferrerPolicy::NEVER_CLEAR,
+                                                    kOriginalReferrer,
+                                                    GURL("https://boggle.com")),
             kOriginalReferrer);
 }
 
diff --git a/net/url_request/url_request_unittest.cc b/net/url_request/url_request_unittest.cc
index 2357f06..2c3b750a 100644
--- a/net/url_request/url_request_unittest.cc
+++ b/net/url_request/url_request_unittest.cc
@@ -128,6 +128,7 @@
 #include "net/test/url_request/url_request_failed_job.h"
 #include "net/test/url_request/url_request_mock_http_job.h"
 #include "net/traffic_annotation/network_traffic_annotation_test_helper.h"
+#include "net/url_request/referrer_policy.h"
 #include "net/url_request/static_http_user_agent_settings.h"
 #include "net/url_request/url_request.h"
 #include "net/url_request/url_request_filter.h"
@@ -818,7 +819,7 @@
       context.CreateRequest(GURL("http://google.com/"), DEFAULT_PRIORITY, &d,
                             TRAFFIC_ANNOTATION_FOR_TESTS));
   req->SetReferrer("http://google.com");
-  req->set_referrer_policy(URLRequest::NEVER_CLEAR_REFERRER);
+  req->set_referrer_policy(ReferrerPolicy::NEVER_CLEAR);
 
   base::HistogramTester histograms;
 
@@ -826,7 +827,7 @@
   d.RunUntilComplete();
   histograms.ExpectUniqueSample(
       "Net.URLRequest.ReferrerPolicyForRequest.SameOrigin",
-      static_cast<int>(URLRequest::NEVER_CLEAR_REFERRER), 1);
+      static_cast<int>(ReferrerPolicy::NEVER_CLEAR), 1);
 }
 
 TEST_F(URLRequestTest, RecordsCrossOriginReferrerHistogram) {
@@ -842,7 +843,7 @@
   // Set a different policy just to make sure we aren't always logging the same
   // policy.
   req->set_referrer_policy(
-      URLRequest::CLEAR_REFERRER_ON_TRANSITION_FROM_SECURE_TO_INSECURE);
+      ReferrerPolicy::CLEAR_ON_TRANSITION_FROM_SECURE_TO_INSECURE);
 
   base::HistogramTester histograms;
 
@@ -851,7 +852,7 @@
   histograms.ExpectUniqueSample(
       "Net.URLRequest.ReferrerPolicyForRequest.CrossOrigin",
       static_cast<int>(
-          URLRequest::CLEAR_REFERRER_ON_TRANSITION_FROM_SECURE_TO_INSECURE),
+          ReferrerPolicy::CLEAR_ON_TRANSITION_FROM_SECURE_TO_INSECURE),
       1);
 }
 
@@ -868,7 +869,7 @@
   req->SetReferrer("http://google.com");
 
   req->set_referrer_policy(
-      URLRequest::CLEAR_REFERRER_ON_TRANSITION_FROM_SECURE_TO_INSECURE);
+      ReferrerPolicy::CLEAR_ON_TRANSITION_FROM_SECURE_TO_INSECURE);
 
   base::HistogramTester histograms;
 
@@ -877,7 +878,7 @@
   histograms.ExpectUniqueSample(
       "Net.URLRequest.ReferrerPolicyForRequest.SameOrigin",
       static_cast<int>(
-          URLRequest::CLEAR_REFERRER_ON_TRANSITION_FROM_SECURE_TO_INSECURE),
+          ReferrerPolicy::CLEAR_ON_TRANSITION_FROM_SECURE_TO_INSECURE),
       1);
   req->FollowDeferredRedirect(/*removed_headers=*/base::nullopt,
                               /*modified_headers=*/base::nullopt);
@@ -885,7 +886,7 @@
   histograms.ExpectUniqueSample(
       "Net.URLRequest.ReferrerPolicyForRequest.CrossOrigin",
       static_cast<int>(
-          URLRequest::CLEAR_REFERRER_ON_TRANSITION_FROM_SECURE_TO_INSECURE),
+          ReferrerPolicy::CLEAR_ON_TRANSITION_FROM_SECURE_TO_INSECURE),
       1);
 }
 
@@ -8472,7 +8473,7 @@
     ASSERT_TRUE(destination_server_->Start());
   }
 
-  void VerifyReferrerAfterRedirect(URLRequest::ReferrerPolicy policy,
+  void VerifyReferrerAfterRedirect(ReferrerPolicy policy,
                                    const GURL& referrer,
                                    const GURL& expected) {
     // Create and execute the request: we'll only have a |destination_server_|
@@ -8517,39 +8518,38 @@
 
   GURL referrer = origin_server()->GetURL("/path/to/file.html");
   VerifyReferrerAfterRedirect(
-      URLRequest::CLEAR_REFERRER_ON_TRANSITION_FROM_SECURE_TO_INSECURE,
-      referrer, referrer);
-
-  VerifyReferrerAfterRedirect(
-      URLRequest::REDUCE_REFERRER_GRANULARITY_ON_TRANSITION_CROSS_ORIGIN,
-      referrer, referrer);
-
-  VerifyReferrerAfterRedirect(
-      URLRequest::ORIGIN_ONLY_ON_TRANSITION_CROSS_ORIGIN, referrer, referrer);
-
-  VerifyReferrerAfterRedirect(URLRequest::NEVER_CLEAR_REFERRER, referrer,
-                              referrer);
-
-  // The original referrer set on the request is expected to obey the referrer
-  // policy and already be stripped to the origin; thus this test case just
-  // checks that this policy doesn't cause the referrer to change when following
-  // a redirect.
-  VerifyReferrerAfterRedirect(URLRequest::ORIGIN, referrer.GetOrigin(),
-                              referrer.GetOrigin());
-
-  VerifyReferrerAfterRedirect(
-      URLRequest::CLEAR_REFERRER_ON_TRANSITION_CROSS_ORIGIN, referrer,
+      ReferrerPolicy::CLEAR_ON_TRANSITION_FROM_SECURE_TO_INSECURE, referrer,
       referrer);
 
+  VerifyReferrerAfterRedirect(
+      ReferrerPolicy::REDUCE_GRANULARITY_ON_TRANSITION_CROSS_ORIGIN, referrer,
+      referrer);
+
+  VerifyReferrerAfterRedirect(
+      ReferrerPolicy::ORIGIN_ONLY_ON_TRANSITION_CROSS_ORIGIN, referrer,
+      referrer);
+
+  VerifyReferrerAfterRedirect(ReferrerPolicy::NEVER_CLEAR, referrer, referrer);
+
+  // The original referrer set on the request is expected to obey the referrer
+  // policy and already be stripped to the origin; thus this test case just
+  // checks that this policy doesn't cause the referrer to change when following
+  // a redirect.
+  VerifyReferrerAfterRedirect(ReferrerPolicy::ORIGIN, referrer.GetOrigin(),
+                              referrer.GetOrigin());
+
+  VerifyReferrerAfterRedirect(ReferrerPolicy::CLEAR_ON_TRANSITION_CROSS_ORIGIN,
+                              referrer, referrer);
+
   // The original referrer set on the request is expected to obey the referrer
   // policy and already be stripped to the origin; thus this test case just
   // checks that this policy doesn't cause the referrer to change when following
   // a redirect.
   VerifyReferrerAfterRedirect(
-      URLRequest::ORIGIN_CLEAR_ON_TRANSITION_FROM_SECURE_TO_INSECURE,
+      ReferrerPolicy::ORIGIN_CLEAR_ON_TRANSITION_FROM_SECURE_TO_INSECURE,
       referrer.GetOrigin(), referrer.GetOrigin());
 
-  VerifyReferrerAfterRedirect(URLRequest::NO_REFERRER, GURL(), GURL());
+  VerifyReferrerAfterRedirect(ReferrerPolicy::NO_REFERRER, GURL(), GURL());
 }
 
 TEST_F(URLRequestTestReferrerPolicy, HTTPToCrossOriginHTTP) {
@@ -8558,39 +8558,38 @@
   GURL referrer = origin_server()->GetURL("/path/to/file.html");
 
   VerifyReferrerAfterRedirect(
-      URLRequest::CLEAR_REFERRER_ON_TRANSITION_FROM_SECURE_TO_INSECURE,
-      referrer, referrer);
+      ReferrerPolicy::CLEAR_ON_TRANSITION_FROM_SECURE_TO_INSECURE, referrer,
+      referrer);
 
   VerifyReferrerAfterRedirect(
-      URLRequest::REDUCE_REFERRER_GRANULARITY_ON_TRANSITION_CROSS_ORIGIN,
-      referrer, referrer.GetOrigin());
-
-  VerifyReferrerAfterRedirect(
-      URLRequest::ORIGIN_ONLY_ON_TRANSITION_CROSS_ORIGIN, referrer,
+      ReferrerPolicy::REDUCE_GRANULARITY_ON_TRANSITION_CROSS_ORIGIN, referrer,
       referrer.GetOrigin());
 
-  VerifyReferrerAfterRedirect(URLRequest::NEVER_CLEAR_REFERRER, referrer,
-                              referrer);
+  VerifyReferrerAfterRedirect(
+      ReferrerPolicy::ORIGIN_ONLY_ON_TRANSITION_CROSS_ORIGIN, referrer,
+      referrer.GetOrigin());
+
+  VerifyReferrerAfterRedirect(ReferrerPolicy::NEVER_CLEAR, referrer, referrer);
 
   // The original referrer set on the request is expected to obey the referrer
   // policy and already be stripped to the origin; thus this test case just
   // checks that this policy doesn't cause the referrer to change when following
   // a redirect.
-  VerifyReferrerAfterRedirect(URLRequest::ORIGIN, referrer.GetOrigin(),
+  VerifyReferrerAfterRedirect(ReferrerPolicy::ORIGIN, referrer.GetOrigin(),
                               referrer.GetOrigin());
 
-  VerifyReferrerAfterRedirect(
-      URLRequest::CLEAR_REFERRER_ON_TRANSITION_CROSS_ORIGIN, referrer, GURL());
+  VerifyReferrerAfterRedirect(ReferrerPolicy::CLEAR_ON_TRANSITION_CROSS_ORIGIN,
+                              referrer, GURL());
 
   // The original referrer set on the request is expected to obey the referrer
   // policy and already be stripped to the origin; thus this test case just
   // checks that this policy doesn't cause the referrer to change when following
   // a redirect.
   VerifyReferrerAfterRedirect(
-      URLRequest::ORIGIN_CLEAR_ON_TRANSITION_FROM_SECURE_TO_INSECURE,
+      ReferrerPolicy::ORIGIN_CLEAR_ON_TRANSITION_FROM_SECURE_TO_INSECURE,
       referrer.GetOrigin(), referrer.GetOrigin());
 
-  VerifyReferrerAfterRedirect(URLRequest::NO_REFERRER, GURL(), GURL());
+  VerifyReferrerAfterRedirect(ReferrerPolicy::NO_REFERRER, GURL(), GURL());
 }
 
 TEST_F(URLRequestTestReferrerPolicy, HTTPSToSameOriginHTTPS) {
@@ -8598,39 +8597,38 @@
   GURL referrer = origin_server()->GetURL("/path/to/file.html");
 
   VerifyReferrerAfterRedirect(
-      URLRequest::CLEAR_REFERRER_ON_TRANSITION_FROM_SECURE_TO_INSECURE,
-      referrer, referrer);
-
-  VerifyReferrerAfterRedirect(
-      URLRequest::REDUCE_REFERRER_GRANULARITY_ON_TRANSITION_CROSS_ORIGIN,
-      referrer, referrer);
-
-  VerifyReferrerAfterRedirect(
-      URLRequest::ORIGIN_ONLY_ON_TRANSITION_CROSS_ORIGIN, referrer, referrer);
-
-  VerifyReferrerAfterRedirect(URLRequest::NEVER_CLEAR_REFERRER, referrer,
-                              referrer);
-
-  // The original referrer set on the request is expected to obey the referrer
-  // policy and already be stripped to the origin; thus this test case just
-  // checks that this policy doesn't cause the referrer to change when following
-  // a redirect.
-  VerifyReferrerAfterRedirect(URLRequest::ORIGIN, referrer.GetOrigin(),
-                              referrer.GetOrigin());
-
-  VerifyReferrerAfterRedirect(
-      URLRequest::CLEAR_REFERRER_ON_TRANSITION_CROSS_ORIGIN, referrer,
+      ReferrerPolicy::CLEAR_ON_TRANSITION_FROM_SECURE_TO_INSECURE, referrer,
       referrer);
 
+  VerifyReferrerAfterRedirect(
+      ReferrerPolicy::REDUCE_GRANULARITY_ON_TRANSITION_CROSS_ORIGIN, referrer,
+      referrer);
+
+  VerifyReferrerAfterRedirect(
+      ReferrerPolicy::ORIGIN_ONLY_ON_TRANSITION_CROSS_ORIGIN, referrer,
+      referrer);
+
+  VerifyReferrerAfterRedirect(ReferrerPolicy::NEVER_CLEAR, referrer, referrer);
+
+  // The original referrer set on the request is expected to obey the referrer
+  // policy and already be stripped to the origin; thus this test case just
+  // checks that this policy doesn't cause the referrer to change when following
+  // a redirect.
+  VerifyReferrerAfterRedirect(ReferrerPolicy::ORIGIN, referrer.GetOrigin(),
+                              referrer.GetOrigin());
+
+  VerifyReferrerAfterRedirect(ReferrerPolicy::CLEAR_ON_TRANSITION_CROSS_ORIGIN,
+                              referrer, referrer);
+
   // The original referrer set on the request is expected to obey the referrer
   // policy and already be stripped to the origin; thus this test case just
   // checks that this policy doesn't cause the referrer to change when following
   // a redirect.
   VerifyReferrerAfterRedirect(
-      URLRequest::ORIGIN_CLEAR_ON_TRANSITION_FROM_SECURE_TO_INSECURE,
+      ReferrerPolicy::ORIGIN_CLEAR_ON_TRANSITION_FROM_SECURE_TO_INSECURE,
       referrer.GetOrigin(), referrer.GetOrigin());
 
-  VerifyReferrerAfterRedirect(URLRequest::NO_REFERRER, GURL(), GURL());
+  VerifyReferrerAfterRedirect(ReferrerPolicy::NO_REFERRER, GURL(), GURL());
 }
 
 TEST_F(URLRequestTestReferrerPolicy, HTTPSToCrossOriginHTTPS) {
@@ -8639,39 +8637,38 @@
   GURL referrer = origin_server()->GetURL("/path/to/file.html");
 
   VerifyReferrerAfterRedirect(
-      URLRequest::CLEAR_REFERRER_ON_TRANSITION_FROM_SECURE_TO_INSECURE,
-      referrer, referrer);
+      ReferrerPolicy::CLEAR_ON_TRANSITION_FROM_SECURE_TO_INSECURE, referrer,
+      referrer);
 
   VerifyReferrerAfterRedirect(
-      URLRequest::REDUCE_REFERRER_GRANULARITY_ON_TRANSITION_CROSS_ORIGIN,
-      referrer, origin_server()->GetURL("/"));
-
-  VerifyReferrerAfterRedirect(
-      URLRequest::ORIGIN_ONLY_ON_TRANSITION_CROSS_ORIGIN, referrer,
+      ReferrerPolicy::REDUCE_GRANULARITY_ON_TRANSITION_CROSS_ORIGIN, referrer,
       origin_server()->GetURL("/"));
 
-  VerifyReferrerAfterRedirect(URLRequest::NEVER_CLEAR_REFERRER, referrer,
-                              referrer);
+  VerifyReferrerAfterRedirect(
+      ReferrerPolicy::ORIGIN_ONLY_ON_TRANSITION_CROSS_ORIGIN, referrer,
+      origin_server()->GetURL("/"));
+
+  VerifyReferrerAfterRedirect(ReferrerPolicy::NEVER_CLEAR, referrer, referrer);
 
   // The original referrer set on the request is expected to obey the referrer
   // policy and already be stripped to the origin; thus this test case just
   // checks that this policy doesn't cause the referrer to change when following
   // a redirect.
-  VerifyReferrerAfterRedirect(URLRequest::ORIGIN, referrer.GetOrigin(),
+  VerifyReferrerAfterRedirect(ReferrerPolicy::ORIGIN, referrer.GetOrigin(),
                               referrer.GetOrigin());
 
-  VerifyReferrerAfterRedirect(
-      URLRequest::CLEAR_REFERRER_ON_TRANSITION_CROSS_ORIGIN, referrer, GURL());
+  VerifyReferrerAfterRedirect(ReferrerPolicy::CLEAR_ON_TRANSITION_CROSS_ORIGIN,
+                              referrer, GURL());
 
   // The original referrer set on the request is expected to obey the referrer
   // policy and already be stripped to the origin; thus this test case just
   // checks that this policy doesn't cause the referrer to change when following
   // a redirect.
   VerifyReferrerAfterRedirect(
-      URLRequest::ORIGIN_CLEAR_ON_TRANSITION_FROM_SECURE_TO_INSECURE,
+      ReferrerPolicy::ORIGIN_CLEAR_ON_TRANSITION_FROM_SECURE_TO_INSECURE,
       referrer.GetOrigin(), referrer.GetOrigin());
 
-  VerifyReferrerAfterRedirect(URLRequest::NO_REFERRER, GURL(), GURL());
+  VerifyReferrerAfterRedirect(ReferrerPolicy::NO_REFERRER, GURL(), GURL());
 }
 
 TEST_F(URLRequestTestReferrerPolicy, HTTPToHTTPS) {
@@ -8680,39 +8677,38 @@
   GURL referrer = origin_server()->GetURL("/path/to/file.html");
 
   VerifyReferrerAfterRedirect(
-      URLRequest::CLEAR_REFERRER_ON_TRANSITION_FROM_SECURE_TO_INSECURE,
-      referrer, referrer);
+      ReferrerPolicy::CLEAR_ON_TRANSITION_FROM_SECURE_TO_INSECURE, referrer,
+      referrer);
 
   VerifyReferrerAfterRedirect(
-      URLRequest::REDUCE_REFERRER_GRANULARITY_ON_TRANSITION_CROSS_ORIGIN,
-      referrer, origin_server()->GetURL("/"));
-
-  VerifyReferrerAfterRedirect(
-      URLRequest::ORIGIN_ONLY_ON_TRANSITION_CROSS_ORIGIN, referrer,
+      ReferrerPolicy::REDUCE_GRANULARITY_ON_TRANSITION_CROSS_ORIGIN, referrer,
       origin_server()->GetURL("/"));
 
-  VerifyReferrerAfterRedirect(URLRequest::NEVER_CLEAR_REFERRER, referrer,
-                              referrer);
+  VerifyReferrerAfterRedirect(
+      ReferrerPolicy::ORIGIN_ONLY_ON_TRANSITION_CROSS_ORIGIN, referrer,
+      origin_server()->GetURL("/"));
+
+  VerifyReferrerAfterRedirect(ReferrerPolicy::NEVER_CLEAR, referrer, referrer);
 
   // The original referrer set on the request is expected to obey the referrer
   // policy and already be stripped to the origin; thus this test case just
   // checks that this policy doesn't cause the referrer to change when following
   // a redirect.
-  VerifyReferrerAfterRedirect(URLRequest::ORIGIN, referrer.GetOrigin(),
+  VerifyReferrerAfterRedirect(ReferrerPolicy::ORIGIN, referrer.GetOrigin(),
                               referrer.GetOrigin());
 
-  VerifyReferrerAfterRedirect(
-      URLRequest::CLEAR_REFERRER_ON_TRANSITION_CROSS_ORIGIN, referrer, GURL());
+  VerifyReferrerAfterRedirect(ReferrerPolicy::CLEAR_ON_TRANSITION_CROSS_ORIGIN,
+                              referrer, GURL());
 
   // The original referrer set on the request is expected to obey the referrer
   // policy and already be stripped to the origin; thus this test case just
   // checks that this policy doesn't cause the referrer to change when following
   // a redirect.
   VerifyReferrerAfterRedirect(
-      URLRequest::ORIGIN_CLEAR_ON_TRANSITION_FROM_SECURE_TO_INSECURE,
+      ReferrerPolicy::ORIGIN_CLEAR_ON_TRANSITION_FROM_SECURE_TO_INSECURE,
       referrer.GetOrigin(), referrer.GetOrigin());
 
-  VerifyReferrerAfterRedirect(URLRequest::NO_REFERRER, GURL(), GURL());
+  VerifyReferrerAfterRedirect(ReferrerPolicy::NO_REFERRER, GURL(), GURL());
 }
 
 TEST_F(URLRequestTestReferrerPolicy, HTTPSToHTTP) {
@@ -8721,38 +8717,37 @@
   GURL referrer = origin_server()->GetURL("/path/to/file.html");
 
   VerifyReferrerAfterRedirect(
-      URLRequest::CLEAR_REFERRER_ON_TRANSITION_FROM_SECURE_TO_INSECURE,
-      referrer, GURL());
+      ReferrerPolicy::CLEAR_ON_TRANSITION_FROM_SECURE_TO_INSECURE, referrer,
+      GURL());
 
   VerifyReferrerAfterRedirect(
-      URLRequest::REDUCE_REFERRER_GRANULARITY_ON_TRANSITION_CROSS_ORIGIN,
-      referrer, GURL());
+      ReferrerPolicy::REDUCE_GRANULARITY_ON_TRANSITION_CROSS_ORIGIN, referrer,
+      GURL());
 
   VerifyReferrerAfterRedirect(
-      URLRequest::ORIGIN_ONLY_ON_TRANSITION_CROSS_ORIGIN, referrer,
+      ReferrerPolicy::ORIGIN_ONLY_ON_TRANSITION_CROSS_ORIGIN, referrer,
       origin_server()->GetURL("/"));
 
-  VerifyReferrerAfterRedirect(URLRequest::NEVER_CLEAR_REFERRER, referrer,
-                              referrer);
+  VerifyReferrerAfterRedirect(ReferrerPolicy::NEVER_CLEAR, referrer, referrer);
 
   // The original referrer set on the request is expected to obey the referrer
   // policy and already be stripped to the origin; thus this test case just
   // checks that this policy doesn't cause the referrer to change when following
   // a redirect.
-  VerifyReferrerAfterRedirect(URLRequest::ORIGIN, referrer.GetOrigin(),
+  VerifyReferrerAfterRedirect(ReferrerPolicy::ORIGIN, referrer.GetOrigin(),
                               referrer.GetOrigin());
 
-  VerifyReferrerAfterRedirect(
-      URLRequest::CLEAR_REFERRER_ON_TRANSITION_CROSS_ORIGIN, referrer, GURL());
+  VerifyReferrerAfterRedirect(ReferrerPolicy::CLEAR_ON_TRANSITION_CROSS_ORIGIN,
+                              referrer, GURL());
 
   // The original referrer set on the request is expected to obey the referrer
   // policy and already be stripped to the origin, though it should be
   // subsequently cleared during the downgrading redirect.
   VerifyReferrerAfterRedirect(
-      URLRequest::ORIGIN_CLEAR_ON_TRANSITION_FROM_SECURE_TO_INSECURE,
+      ReferrerPolicy::ORIGIN_CLEAR_ON_TRANSITION_FROM_SECURE_TO_INSECURE,
       referrer.GetOrigin(), GURL());
 
-  VerifyReferrerAfterRedirect(URLRequest::NO_REFERRER, GURL(), GURL());
+  VerifyReferrerAfterRedirect(ReferrerPolicy::NO_REFERRER, GURL(), GURL());
 }
 
 class HTTPSRequestTest : public TestWithTaskEnvironment {
diff --git a/remoting/test/cyclic_frame_generator.cc b/remoting/test/cyclic_frame_generator.cc
index 21dae07..61324f3 100644
--- a/remoting/test/cyclic_frame_generator.cc
+++ b/remoting/test/cyclic_frame_generator.cc
@@ -54,8 +54,7 @@
       ((now - started_time_) / frame_cycle_period_) % reference_frames_.size();
   bool cursor_state = frame_id % 2;
 
-  std::unique_ptr<webrtc::DesktopFrame> frame(
-      new webrtc::BasicDesktopFrame(screen_size_));
+  auto frame = std::make_unique<webrtc::BasicDesktopFrame>(screen_size_);
   frame->CopyPixelsFrom(*reference_frames_[reference_frame],
                         webrtc::DesktopVector(),
                         webrtc::DesktopRect::MakeSize(screen_size_));
@@ -93,13 +92,12 @@
   CHECK_GE(frame_id, last_identifier_frame_);
 
   ChangeInfoList result;
+  const int frames_in_cycle = frame_cycle_period_ / cursor_blink_period_;
   for (int i = last_identifier_frame_ + 1; i <= frame_id; ++i) {
-    ChangeType type = (i % (frame_cycle_period_ / cursor_blink_period_) == 0)
-                          ? ChangeType::FULL
-                          : ChangeType::CURSOR;
-    base::TimeTicks timestamp =
-        started_time_ + i * base::TimeDelta(cursor_blink_period_);
-    result.push_back(ChangeInfo(type, timestamp));
+    ChangeType type =
+        (i % frames_in_cycle == 0) ? ChangeType::FULL : ChangeType::CURSOR;
+    base::TimeTicks timestamp = started_time_ + i * cursor_blink_period_;
+    result.emplace_back(type, timestamp);
   }
   last_identifier_frame_ = frame_id;
 
diff --git a/services/network/cors/cors_url_loader_unittest.cc b/services/network/cors/cors_url_loader_unittest.cc
index 3d64f7e..766cb2c8 100644
--- a/services/network/cors/cors_url_loader_unittest.cc
+++ b/services/network/cors/cors_url_loader_unittest.cc
@@ -27,7 +27,7 @@
 #include "net/http/http_request_headers.h"
 #include "net/proxy_resolution/configured_proxy_resolution_service.h"
 #include "net/traffic_annotation/network_traffic_annotation_test_helper.h"
-#include "net/url_request/url_request.h"
+#include "net/url_request/referrer_policy.h"
 #include "net/url_request/url_request_context.h"
 #include "net/url_request/url_request_context_builder.h"
 #include "services/network/cors/cors_url_loader_factory.h"
@@ -146,7 +146,7 @@
 
 class CorsURLLoaderTest : public testing::Test {
  public:
-  using ReferrerPolicy = net::URLRequest::ReferrerPolicy;
+  using ReferrerPolicy = net::ReferrerPolicy;
 
   CorsURLLoaderTest()
       : task_environment_(base::test::TaskEnvironment::MainThreadType::IO) {
@@ -333,7 +333,7 @@
       base::StringPiece method,
       const GURL& url,
       base::StringPiece referrer = base::StringPiece(),
-      ReferrerPolicy referrer_policy = net::URLRequest::NO_REFERRER,
+      ReferrerPolicy referrer_policy = net::ReferrerPolicy::NO_REFERRER,
       net::SiteForCookies site_for_cookies = net::SiteForCookies()) {
     net::RedirectInfo redirect_info;
     redirect_info.status_code = status_code;
@@ -1158,7 +1158,7 @@
   request.request_initiator = url::Origin::Create(origin);
   request.referrer = url;
   request.referrer_policy =
-      net::URLRequest::ORIGIN_ONLY_ON_TRANSITION_CROSS_ORIGIN;
+      net::ReferrerPolicy::ORIGIN_ONLY_ON_TRANSITION_CROSS_ORIGIN;
   CreateLoaderAndStart(request);
   RunUntilCreateLoaderAndStartCalled();
 
@@ -1166,12 +1166,12 @@
   EXPECT_EQ(url, GetRequest().url);
   EXPECT_EQ("POST", GetRequest().method);
   EXPECT_EQ(url, GetRequest().referrer);
-  EXPECT_EQ(net::URLRequest::ORIGIN_ONLY_ON_TRANSITION_CROSS_ORIGIN,
+  EXPECT_EQ(net::ReferrerPolicy::ORIGIN_ONLY_ON_TRANSITION_CROSS_ORIGIN,
             GetRequest().referrer_policy);
 
   NotifyLoaderClientOnReceiveRedirect(CreateRedirectInfo(
       303, "GET", new_url, "https://other.example.com",
-      net::URLRequest::ORIGIN_ONLY_ON_TRANSITION_CROSS_ORIGIN));
+      net::ReferrerPolicy::ORIGIN_ONLY_ON_TRANSITION_CROSS_ORIGIN));
   RunUntilRedirectReceived();
 
   EXPECT_TRUE(IsNetworkLoaderStarted());
@@ -1187,7 +1187,7 @@
   EXPECT_EQ(new_url, GetRequest().url);
   EXPECT_EQ("GET", GetRequest().method);
   EXPECT_EQ(GURL("https://other.example.com"), GetRequest().referrer);
-  EXPECT_EQ(net::URLRequest::ORIGIN_ONLY_ON_TRANSITION_CROSS_ORIGIN,
+  EXPECT_EQ(net::ReferrerPolicy::ORIGIN_ONLY_ON_TRANSITION_CROSS_ORIGIN,
             GetRequest().referrer_policy);
 
   NotifyLoaderClientOnReceiveResponse(
@@ -1241,7 +1241,7 @@
   EXPECT_EQ(url, GetRequest().url);
 
   NotifyLoaderClientOnReceiveRedirect(CreateRedirectInfo(
-      303, "GET", new_url, "" /* referrer */, net::URLRequest::NO_REFERRER,
+      303, "GET", new_url, "" /* referrer */, net::ReferrerPolicy::NO_REFERRER,
       new_url_site_for_cookies));
   RunUntilRedirectReceived();
 
diff --git a/services/network/network_context_unittest.cc b/services/network/network_context_unittest.cc
index 8589cbb..ca1f1bd 100644
--- a/services/network/network_context_unittest.cc
+++ b/services/network/network_context_unittest.cc
@@ -103,6 +103,7 @@
 #include "net/test/spawned_test_server/spawned_test_server.h"
 #include "net/test/test_data_directory.h"
 #include "net/traffic_annotation/network_traffic_annotation_test_helper.h"
+#include "net/url_request/referrer_policy.h"
 #include "net/url_request/url_request_context.h"
 #include "net/url_request/url_request_context_builder.h"
 #include "net/url_request/url_request_job_factory.h"
@@ -1364,9 +1365,8 @@
   ASSERT_TRUE(test_server.Start());
 
   for (bool validate_referrer_policy_on_initial_request : {false, true}) {
-    for (net::URLRequest::ReferrerPolicy referrer_policy :
-         {net::URLRequest::NEVER_CLEAR_REFERRER,
-          net::URLRequest::NO_REFERRER}) {
+    for (net::ReferrerPolicy referrer_policy :
+         {net::ReferrerPolicy::NEVER_CLEAR, net::ReferrerPolicy::NO_REFERRER}) {
       mojom::NetworkContextParamsPtr context_params = CreateContextParams();
       context_params->validate_referrer_policy_on_initial_request =
           validate_referrer_policy_on_initial_request;
@@ -1399,7 +1399,7 @@
       // If validating referrers, and the referrer policy is not to send
       // referrers, the request should fail.
       if (validate_referrer_policy_on_initial_request &&
-          referrer_policy == net::URLRequest::NO_REFERRER) {
+          referrer_policy == net::ReferrerPolicy::NO_REFERRER) {
         EXPECT_EQ(net::ERR_BLOCKED_BY_CLIENT,
                   client.completion_status().error_code);
         EXPECT_FALSE(client.response_body().is_valid());
@@ -1412,7 +1412,7 @@
       ASSERT_TRUE(client.response_body().is_valid());
       EXPECT_TRUE(mojo::BlockingCopyToString(client.response_body_release(),
                                              &response_body));
-      if (referrer_policy == net::URLRequest::NO_REFERRER) {
+      if (referrer_policy == net::ReferrerPolicy::NO_REFERRER) {
         // If not validating referrers, and the referrer policy is not to send
         // referrers, the referrer should be cleared.
         EXPECT_EQ("None", response_body);
diff --git a/services/network/network_service_network_delegate.cc b/services/network/network_service_network_delegate.cc
index abf4451b..8199b69 100644
--- a/services/network/network_service_network_delegate.cc
+++ b/services/network/network_service_network_delegate.cc
@@ -15,6 +15,7 @@
 #include "net/base/isolation_info.h"
 #include "net/base/load_flags.h"
 #include "net/base/net_errors.h"
+#include "net/url_request/referrer_policy.h"
 #include "net/url_request/url_request.h"
 #include "services/network/cookie_manager.h"
 #include "services/network/network_context.h"
@@ -56,7 +57,7 @@
     const GURL& effective_url) {
   if (!enable_referrers_) {
     request->SetReferrer(std::string());
-    request->set_referrer_policy(net::URLRequest::NO_REFERRER);
+    request->set_referrer_policy(net::ReferrerPolicy::NO_REFERRER);
     return;
   }
 
diff --git a/services/network/public/cpp/net_ipc_param_traits.h b/services/network/public/cpp/net_ipc_param_traits.h
index 0ad0fe9..0c6ce9a6 100644
--- a/services/network/public/cpp/net_ipc_param_traits.h
+++ b/services/network/public/cpp/net_ipc_param_traits.h
@@ -29,6 +29,7 @@
 #include "net/ssl/ssl_cert_request_info.h"
 #include "net/ssl/ssl_info.h"
 #include "net/url_request/redirect_info.h"
+#include "net/url_request/referrer_policy.h"
 #include "url/ipc/url_param_traits.h"
 #include "url/origin.h"
 
@@ -272,8 +273,7 @@
 IPC_ENUM_TRAITS_MAX_VALUE(net::SSLInfo::HandshakeType,
                           net::SSLInfo::HANDSHAKE_FULL)
 
-IPC_ENUM_TRAITS_MAX_VALUE(net::URLRequest::ReferrerPolicy,
-                          net::URLRequest::MAX_REFERRER_POLICY)
+IPC_ENUM_TRAITS_MAX_VALUE(net::ReferrerPolicy, net::ReferrerPolicy::MAX)
 
 IPC_STRUCT_TRAITS_BEGIN(net::HttpRequestHeaders::HeaderKeyValuePair)
   IPC_STRUCT_TRAITS_MEMBER(key)
diff --git a/services/network/public/cpp/resource_request.cc b/services/network/public/cpp/resource_request.cc
index 7d322560..d2581663 100644
--- a/services/network/public/cpp/resource_request.cc
+++ b/services/network/public/cpp/resource_request.cc
@@ -128,34 +128,32 @@
          !(load_flags & net::LOAD_DO_NOT_SAVE_COOKIES);
 }
 
-net::URLRequest::ReferrerPolicy ReferrerPolicyForUrlRequest(
+net::ReferrerPolicy ReferrerPolicyForUrlRequest(
     mojom::ReferrerPolicy referrer_policy) {
   switch (referrer_policy) {
     case mojom::ReferrerPolicy::kAlways:
-      return net::URLRequest::NEVER_CLEAR_REFERRER;
+      return net::ReferrerPolicy::NEVER_CLEAR;
     case mojom::ReferrerPolicy::kNever:
-      return net::URLRequest::NO_REFERRER;
+      return net::ReferrerPolicy::NO_REFERRER;
     case mojom::ReferrerPolicy::kOrigin:
-      return net::URLRequest::ORIGIN;
+      return net::ReferrerPolicy::ORIGIN;
     case mojom::ReferrerPolicy::kNoReferrerWhenDowngrade:
-      return net::URLRequest::
-          CLEAR_REFERRER_ON_TRANSITION_FROM_SECURE_TO_INSECURE;
+      return net::ReferrerPolicy::CLEAR_ON_TRANSITION_FROM_SECURE_TO_INSECURE;
     case mojom::ReferrerPolicy::kOriginWhenCrossOrigin:
-      return net::URLRequest::ORIGIN_ONLY_ON_TRANSITION_CROSS_ORIGIN;
+      return net::ReferrerPolicy::ORIGIN_ONLY_ON_TRANSITION_CROSS_ORIGIN;
     case mojom::ReferrerPolicy::kSameOrigin:
-      return net::URLRequest::CLEAR_REFERRER_ON_TRANSITION_CROSS_ORIGIN;
+      return net::ReferrerPolicy::CLEAR_ON_TRANSITION_CROSS_ORIGIN;
     case mojom::ReferrerPolicy::kStrictOrigin:
-      return net::URLRequest::
+      return net::ReferrerPolicy::
           ORIGIN_CLEAR_ON_TRANSITION_FROM_SECURE_TO_INSECURE;
     case mojom::ReferrerPolicy::kDefault:
       CHECK(false);
-      return net::URLRequest::NO_REFERRER;
+      return net::ReferrerPolicy::NO_REFERRER;
     case mojom::ReferrerPolicy::kStrictOriginWhenCrossOrigin:
-      return net::URLRequest::
-          REDUCE_REFERRER_GRANULARITY_ON_TRANSITION_CROSS_ORIGIN;
+      return net::ReferrerPolicy::REDUCE_GRANULARITY_ON_TRANSITION_CROSS_ORIGIN;
   }
   NOTREACHED();
-  return net::URLRequest::CLEAR_REFERRER_ON_TRANSITION_FROM_SECURE_TO_INSECURE;
+  return net::ReferrerPolicy::CLEAR_ON_TRANSITION_FROM_SECURE_TO_INSECURE;
 }
 
 }  // namespace network
diff --git a/services/network/public/cpp/resource_request.h b/services/network/public/cpp/resource_request.h
index 44cb6c0..d911066 100644
--- a/services/network/public/cpp/resource_request.h
+++ b/services/network/public/cpp/resource_request.h
@@ -17,7 +17,7 @@
 #include "net/base/request_priority.h"
 #include "net/cookies/site_for_cookies.h"
 #include "net/http/http_request_headers.h"
-#include "net/url_request/url_request.h"
+#include "net/url_request/referrer_policy.h"
 #include "services/network/public/cpp/optional_trust_token_params.h"
 #include "services/network/public/cpp/resource_request_body.h"
 #include "services/network/public/mojom/cookie_access_observer.mojom.h"
@@ -73,8 +73,7 @@
   base::Optional<url::Origin> request_initiator;
   base::Optional<url::Origin> isolated_world_origin;
   GURL referrer;
-  net::URLRequest::ReferrerPolicy referrer_policy =
-      net::URLRequest::NEVER_CLEAR_REFERRER;
+  net::ReferrerPolicy referrer_policy = net::ReferrerPolicy::NEVER_CLEAR;
   net::HttpRequestHeaders headers;
   net::HttpRequestHeaders cors_exempt_headers;
   int load_flags = 0;
@@ -123,7 +122,7 @@
 
 // This does not accept |kDefault| referrer policy.
 COMPONENT_EXPORT(NETWORK_CPP_BASE)
-net::URLRequest::ReferrerPolicy ReferrerPolicyForUrlRequest(
+net::ReferrerPolicy ReferrerPolicyForUrlRequest(
     mojom::ReferrerPolicy referrer_policy);
 
 }  // namespace network
diff --git a/services/network/public/cpp/url_request_mojom_traits.cc b/services/network/public/cpp/url_request_mojom_traits.cc
index eff0f00..3b190c3 100644
--- a/services/network/public/cpp/url_request_mojom_traits.cc
+++ b/services/network/public/cpp/url_request_mojom_traits.cc
@@ -73,80 +73,70 @@
   return true;
 }
 
-network::mojom::URLRequestReferrerPolicy EnumTraits<
-    network::mojom::URLRequestReferrerPolicy,
-    net::URLRequest::ReferrerPolicy>::ToMojom(net::URLRequest::ReferrerPolicy
-                                                  policy) {
+network::mojom::URLRequestReferrerPolicy
+EnumTraits<network::mojom::URLRequestReferrerPolicy,
+           net::ReferrerPolicy>::ToMojom(net::ReferrerPolicy policy) {
   switch (policy) {
-    case net::URLRequest::ReferrerPolicy::
-        CLEAR_REFERRER_ON_TRANSITION_FROM_SECURE_TO_INSECURE:
+    case net::ReferrerPolicy::CLEAR_ON_TRANSITION_FROM_SECURE_TO_INSECURE:
       return network::mojom::URLRequestReferrerPolicy::
           kClearReferrerOnTransitionFromSecureToInsecure;
-    case net::URLRequest::ReferrerPolicy::
-        REDUCE_REFERRER_GRANULARITY_ON_TRANSITION_CROSS_ORIGIN:
+    case net::ReferrerPolicy::REDUCE_GRANULARITY_ON_TRANSITION_CROSS_ORIGIN:
       return network::mojom::URLRequestReferrerPolicy::
           kReduceReferrerGranularityOnTransitionCrossOrigin;
-    case net::URLRequest::ReferrerPolicy::
-        ORIGIN_ONLY_ON_TRANSITION_CROSS_ORIGIN:
+    case net::ReferrerPolicy::ORIGIN_ONLY_ON_TRANSITION_CROSS_ORIGIN:
       return network::mojom::URLRequestReferrerPolicy::
           kOriginOnlyOnTransitionCrossOrigin;
-    case net::URLRequest::ReferrerPolicy::NEVER_CLEAR_REFERRER:
+    case net::ReferrerPolicy::NEVER_CLEAR:
       return network::mojom::URLRequestReferrerPolicy::kNeverClearReferrer;
-    case net::URLRequest::ReferrerPolicy::ORIGIN:
+    case net::ReferrerPolicy::ORIGIN:
       return network::mojom::URLRequestReferrerPolicy::kOrigin;
-    case net::URLRequest::ReferrerPolicy::
-        CLEAR_REFERRER_ON_TRANSITION_CROSS_ORIGIN:
+    case net::ReferrerPolicy::CLEAR_ON_TRANSITION_CROSS_ORIGIN:
       return network::mojom::URLRequestReferrerPolicy::
           kClearReferrerOnTransitionCrossOrigin;
-    case net::URLRequest::ReferrerPolicy::
+    case net::ReferrerPolicy::
         ORIGIN_CLEAR_ON_TRANSITION_FROM_SECURE_TO_INSECURE:
       return network::mojom::URLRequestReferrerPolicy::
           kOriginClearOnTransitionFromSecureToInsecure;
-    case net::URLRequest::ReferrerPolicy::NO_REFERRER:
+    case net::ReferrerPolicy::NO_REFERRER:
       return network::mojom::URLRequestReferrerPolicy::kNoReferrer;
   }
   NOTREACHED();
   return static_cast<network::mojom::URLRequestReferrerPolicy>(policy);
 }
 
-bool EnumTraits<network::mojom::URLRequestReferrerPolicy,
-                net::URLRequest::ReferrerPolicy>::
+bool EnumTraits<network::mojom::URLRequestReferrerPolicy, net::ReferrerPolicy>::
     FromMojom(network::mojom::URLRequestReferrerPolicy in,
-              net::URLRequest::ReferrerPolicy* out) {
+              net::ReferrerPolicy* out) {
   switch (in) {
     case network::mojom::URLRequestReferrerPolicy::
         kClearReferrerOnTransitionFromSecureToInsecure:
-      *out = net::URLRequest::ReferrerPolicy::
-          CLEAR_REFERRER_ON_TRANSITION_FROM_SECURE_TO_INSECURE;
+      *out = net::ReferrerPolicy::CLEAR_ON_TRANSITION_FROM_SECURE_TO_INSECURE;
       return true;
     case network::mojom::URLRequestReferrerPolicy::
         kReduceReferrerGranularityOnTransitionCrossOrigin:
-      *out = net::URLRequest::ReferrerPolicy::
-          REDUCE_REFERRER_GRANULARITY_ON_TRANSITION_CROSS_ORIGIN;
+      *out = net::ReferrerPolicy::REDUCE_GRANULARITY_ON_TRANSITION_CROSS_ORIGIN;
       return true;
     case network::mojom::URLRequestReferrerPolicy::
         kOriginOnlyOnTransitionCrossOrigin:
-      *out = net::URLRequest::ReferrerPolicy::
-          ORIGIN_ONLY_ON_TRANSITION_CROSS_ORIGIN;
+      *out = net::ReferrerPolicy::ORIGIN_ONLY_ON_TRANSITION_CROSS_ORIGIN;
       return true;
     case network::mojom::URLRequestReferrerPolicy::kNeverClearReferrer:
-      *out = net::URLRequest::ReferrerPolicy::NEVER_CLEAR_REFERRER;
+      *out = net::ReferrerPolicy::NEVER_CLEAR;
       return true;
     case network::mojom::URLRequestReferrerPolicy::kOrigin:
-      *out = net::URLRequest::ReferrerPolicy::ORIGIN;
+      *out = net::ReferrerPolicy::ORIGIN;
       return true;
     case network::mojom::URLRequestReferrerPolicy::
         kClearReferrerOnTransitionCrossOrigin:
-      *out = net::URLRequest::ReferrerPolicy::
-          CLEAR_REFERRER_ON_TRANSITION_CROSS_ORIGIN;
+      *out = net::ReferrerPolicy::CLEAR_ON_TRANSITION_CROSS_ORIGIN;
       return true;
     case network::mojom::URLRequestReferrerPolicy::
         kOriginClearOnTransitionFromSecureToInsecure:
-      *out = net::URLRequest::ReferrerPolicy::
+      *out = net::ReferrerPolicy::
           ORIGIN_CLEAR_ON_TRANSITION_FROM_SECURE_TO_INSECURE;
       return true;
     case network::mojom::URLRequestReferrerPolicy::kNoReferrer:
-      *out = net::URLRequest::ReferrerPolicy::NO_REFERRER;
+      *out = net::ReferrerPolicy::NO_REFERRER;
       return true;
   }
 
diff --git a/services/network/public/cpp/url_request_mojom_traits.h b/services/network/public/cpp/url_request_mojom_traits.h
index 9e1dd06..4751e5e 100644
--- a/services/network/public/cpp/url_request_mojom_traits.h
+++ b/services/network/public/cpp/url_request_mojom_traits.h
@@ -17,7 +17,7 @@
 #include "mojo/public/cpp/bindings/pending_remote.h"
 #include "mojo/public/cpp/bindings/struct_traits.h"
 #include "net/base/request_priority.h"
-#include "net/url_request/url_request_job.h"
+#include "net/url_request/referrer_policy.h"
 #include "services/network/public/cpp/data_element.h"
 #include "services/network/public/cpp/network_isolation_key_mojom_traits.h"
 #include "services/network/public/cpp/resource_request.h"
@@ -42,12 +42,11 @@
 
 template <>
 struct COMPONENT_EXPORT(NETWORK_CPP_BASE)
-    EnumTraits<network::mojom::URLRequestReferrerPolicy,
-               net::URLRequest::ReferrerPolicy> {
+    EnumTraits<network::mojom::URLRequestReferrerPolicy, net::ReferrerPolicy> {
   static network::mojom::URLRequestReferrerPolicy ToMojom(
-      net::URLRequest::ReferrerPolicy policy);
+      net::ReferrerPolicy policy);
   static bool FromMojom(network::mojom::URLRequestReferrerPolicy in,
-                        net::URLRequest::ReferrerPolicy* out);
+                        net::ReferrerPolicy* out);
 };
 
 template <>
@@ -112,7 +111,7 @@
   static const GURL& referrer(const network::ResourceRequest& request) {
     return request.referrer;
   }
-  static net::URLRequest::ReferrerPolicy referrer_policy(
+  static net::ReferrerPolicy referrer_policy(
       const network::ResourceRequest& request) {
     return request.referrer_policy;
   }
diff --git a/services/network/public/cpp/url_request_mojom_traits_unittest.cc b/services/network/public/cpp/url_request_mojom_traits_unittest.cc
index 2f104d7..b47d8a2 100644
--- a/services/network/public/cpp/url_request_mojom_traits_unittest.cc
+++ b/services/network/public/cpp/url_request_mojom_traits_unittest.cc
@@ -8,6 +8,7 @@
 #include "mojo/public/cpp/base/unguessable_token_mojom_traits.h"
 #include "mojo/public/cpp/test_support/test_utils.h"
 #include "net/base/isolation_info.h"
+#include "net/url_request/referrer_policy.h"
 #include "services/network/public/cpp/http_request_headers_mojom_traits.h"
 #include "services/network/public/cpp/network_ipc_param_traits.h"
 #include "services/network/public/cpp/optional_trust_token_params.h"
@@ -21,27 +22,22 @@
 
 TEST(URLRequestMojomTraitsTest, Roundtrips_URLRequestReferrerPolicy) {
   for (auto referrer_policy :
-       {net::URLRequest::ReferrerPolicy::
-            CLEAR_REFERRER_ON_TRANSITION_FROM_SECURE_TO_INSECURE,
-        net::URLRequest::ReferrerPolicy::
-            REDUCE_REFERRER_GRANULARITY_ON_TRANSITION_CROSS_ORIGIN,
-        net::URLRequest::ReferrerPolicy::ORIGIN_ONLY_ON_TRANSITION_CROSS_ORIGIN,
-        net::URLRequest::ReferrerPolicy::NEVER_CLEAR_REFERRER,
-        net::URLRequest::ReferrerPolicy::ORIGIN,
-        net::URLRequest::ReferrerPolicy::
-            CLEAR_REFERRER_ON_TRANSITION_CROSS_ORIGIN,
-        net::URLRequest::ReferrerPolicy::
-            ORIGIN_CLEAR_ON_TRANSITION_FROM_SECURE_TO_INSECURE,
-        net::URLRequest::ReferrerPolicy::NO_REFERRER}) {
+       {net::ReferrerPolicy::CLEAR_ON_TRANSITION_FROM_SECURE_TO_INSECURE,
+        net::ReferrerPolicy::REDUCE_GRANULARITY_ON_TRANSITION_CROSS_ORIGIN,
+        net::ReferrerPolicy::ORIGIN_ONLY_ON_TRANSITION_CROSS_ORIGIN,
+        net::ReferrerPolicy::NEVER_CLEAR, net::ReferrerPolicy::ORIGIN,
+        net::ReferrerPolicy::CLEAR_ON_TRANSITION_CROSS_ORIGIN,
+        net::ReferrerPolicy::ORIGIN_CLEAR_ON_TRANSITION_FROM_SECURE_TO_INSECURE,
+        net::ReferrerPolicy::NO_REFERRER}) {
     int32_t serialized = -1;
     using URLRequestReferrerPolicySerializer =
         mojo::internal::Serializer<mojom::URLRequestReferrerPolicy,
-                                   net::URLRequest::ReferrerPolicy>;
+                                   net::ReferrerPolicy>;
     URLRequestReferrerPolicySerializer::Serialize(referrer_policy, &serialized);
-    EXPECT_EQ(referrer_policy, serialized);
-    net::URLRequest::ReferrerPolicy deserialized;
+    EXPECT_EQ(static_cast<int32_t>(referrer_policy), serialized);
+    net::ReferrerPolicy deserialized;
     URLRequestReferrerPolicySerializer::Deserialize(serialized, &deserialized);
-    EXPECT_EQ(serialized, deserialized);
+    EXPECT_EQ(referrer_policy, deserialized);
   }
 }
 
@@ -58,7 +54,7 @@
       url::Origin::Create(GURL("chrome-extension://blah"));
   original.referrer = GURL("https://referrer.com/");
   original.referrer_policy =
-      net::URLRequest::ORIGIN_ONLY_ON_TRANSITION_CROSS_ORIGIN;
+      net::ReferrerPolicy::ORIGIN_ONLY_ON_TRANSITION_CROSS_ORIGIN;
   original.headers.SetHeader("Accept", "text/xml");
   original.cors_exempt_headers.SetHeader("X-Requested-With", "ForTesting");
   original.load_flags = 3;
diff --git a/services/network/public/mojom/BUILD.gn b/services/network/public/mojom/BUILD.gn
index 355d7e1..d347063 100644
--- a/services/network/public/mojom/BUILD.gn
+++ b/services/network/public/mojom/BUILD.gn
@@ -562,7 +562,7 @@
         },
         {
           mojom = "network.mojom.URLRequestReferrerPolicy"
-          cpp = "::net::URLRequest::ReferrerPolicy"
+          cpp = "::net::ReferrerPolicy"
         },
         {
           mojom = "network.mojom.RequestPriority"
diff --git a/services/network/public/mojom/url_loader.mojom b/services/network/public/mojom/url_loader.mojom
index b3b921ae..9e48b6f 100644
--- a/services/network/public/mojom/url_loader.mojom
+++ b/services/network/public/mojom/url_loader.mojom
@@ -42,7 +42,7 @@
   kHighest
 };
 
-// This enum corresponds to net::URLRequest::ReferrerPolicy. See its comments.
+// This enum corresponds to net::ReferrerPolicy. See its comments.
 enum URLRequestReferrerPolicy {
   kClearReferrerOnTransitionFromSecureToInsecure,
   kReduceReferrerGranularityOnTransitionCrossOrigin,
diff --git a/services/network/throttling/throttling_network_interceptor.cc b/services/network/throttling/throttling_network_interceptor.cc
index 203d6d3..12247ff 100644
--- a/services/network/throttling/throttling_network_interceptor.cc
+++ b/services/network/throttling/throttling_network_interceptor.cc
@@ -18,16 +18,11 @@
 
 namespace {
 
-int64_t kPacketSize = 1500;
+constexpr int64_t kPacketSize = 1500;
 
 base::TimeDelta CalculateTickLength(double throughput) {
-  if (!throughput)
-    return base::TimeDelta::FromMicroseconds(1);
-  int64_t us_tick_length = (1000000L * kPacketSize) / throughput;
-  DCHECK(us_tick_length != 0);
-  if (us_tick_length == 0)
-    us_tick_length = 1;
-  return base::TimeDelta::FromMicroseconds(us_tick_length);
+  return throughput ? base::TimeDelta::FromSecondsD(kPacketSize / throughput)
+                    : base::TimeDelta::FromMicroseconds(1);
 }
 
 }  // namespace
diff --git a/services/tracing/public/cpp/perfetto/trace_event_data_source.cc b/services/tracing/public/cpp/perfetto/trace_event_data_source.cc
index 551ab48..5e137d4 100644
--- a/services/tracing/public/cpp/perfetto/trace_event_data_source.cc
+++ b/services/tracing/public/cpp/perfetto/trace_event_data_source.cc
@@ -462,11 +462,19 @@
       &TraceEventDataSource::OnAddTypedTraceEvent);
 }
 
-void TraceEventDataSource::RegisterWithTraceLog() {
+void TraceEventDataSource::RegisterWithTraceLog(
+    const base::trace_event::TraceConfig& trace_config) {
   TraceLog::GetInstance()->SetAddTraceEventOverrides(
       &TraceEventDataSource::OnAddLegacyTraceEvent,
       &TraceEventDataSource::FlushCurrentThread,
       &TraceEventDataSource::OnUpdateDuration);
+
+  if (trace_config.IsCategoryGroupEnabled(
+          TRACE_DISABLED_BY_DEFAULT("histogram_samples"))) {
+    base::StatisticsRecorder::SetGlobalSampleCallback(
+        &TraceEventDataSource::OnMetricsSampleCallback);
+  }
+
   base::AutoLock l(lock_);
   is_enabled_ = true;
 }
@@ -576,7 +584,6 @@
     trace_writer_ = CreateTraceWriterLocked();
   }
   EmitTrackDescriptor();
-  RegisterWithTraceLog();
 
   base::trace_event::TraceConfig config_for_trace_log(trace_config);
   // Perfetto backend configures buffer sizes when tracing is started in the
@@ -589,6 +596,9 @@
   if (!trace_config.event_filters().empty()) {
     modes |= base::trace_event::TraceLog::FILTERING_MODE;
   }
+
+  RegisterWithTraceLog(config_for_trace_log);
+
   base::trace_event::TraceLog::GetInstance()->SetEnabled(trace_config, modes);
 }
 
@@ -740,6 +750,9 @@
     }
   }
 
+  auto trace_config =
+      TraceConfig(data_source_config.chrome_config().trace_config());
+
   // SetupStartupTracing() will not setup a new startup session after we set
   // |producer_| above, so accessing |startup_tracing_active| outside the lock
   // is safe.
@@ -751,24 +764,17 @@
     producer->BindStartupTargetBuffer(session_id,
                                       data_source_config.target_buffer());
   } else {
-    RegisterWithTraceLog();
+    RegisterWithTraceLog(trace_config);
   }
 
   // We emit the track/process descriptor another time even if we were
   // previously startup tracing, because the process name may have changed.
   EmitTrackDescriptor();
 
-  auto trace_config =
-      TraceConfig(data_source_config.chrome_config().trace_config());
   TraceLog::GetInstance()->SetEnabled(trace_config, TraceLog::RECORDING_MODE);
   ResetHistograms(trace_config);
 
   if (trace_config.IsCategoryGroupEnabled(
-          TRACE_DISABLED_BY_DEFAULT("histogram_samples"))) {
-    base::StatisticsRecorder::SetGlobalSampleCallback(
-        &TraceEventDataSource::OnMetricsSampleCallback);
-  }
-  if (trace_config.IsCategoryGroupEnabled(
           TRACE_DISABLED_BY_DEFAULT("user_action_samples"))) {
     auto task_runner = base::GetRecordActionTaskRunner();
     if (task_runner) {
@@ -1016,8 +1022,8 @@
     const char* histogram_name,
     uint64_t name_hash,
     base::HistogramBase::Sample sample) {
-  // TODO(oysteine): Write an interned histogram name during local dev tracing
-  // when we're less space constrained.
+  bool privacy_filtering_enabled =
+      TraceEventDataSource::GetInstance()->IsPrivacyFilteringEnabled();
   TRACE_EVENT_INSTANT(
       TRACE_DISABLED_BY_DEFAULT("histogram_samples"), "HistogramSample",
       TRACE_EVENT_SCOPE_THREAD, [&](perfetto::EventContext ctx) {
@@ -1025,6 +1031,9 @@
             ctx.event()->set_chrome_histogram_sample();
         new_sample->set_name_hash(name_hash);
         new_sample->set_sample(sample);
+        if (!privacy_filtering_enabled) {
+          new_sample->set_name(histogram_name);
+        }
       });
 }
 
diff --git a/services/tracing/public/cpp/perfetto/trace_event_data_source.h b/services/tracing/public/cpp/perfetto/trace_event_data_source.h
index ad6943f..9de35c7 100644
--- a/services/tracing/public/cpp/perfetto/trace_event_data_source.h
+++ b/services/tracing/public/cpp/perfetto/trace_event_data_source.h
@@ -204,7 +204,7 @@
       PerfettoProducer* producer_client,
       const perfetto::DataSourceConfig& data_source_config);
 
-  void RegisterWithTraceLog();
+  void RegisterWithTraceLog(const base::trace_event::TraceConfig& trace_config);
   void OnStopTracingDone();
 
   std::unique_ptr<perfetto::TraceWriter> CreateTraceWriterLocked();
diff --git a/skia/config/SkUserConfig.h b/skia/config/SkUserConfig.h
index 356b8fe7..47e0688 100644
--- a/skia/config/SkUserConfig.h
+++ b/skia/config/SkUserConfig.h
@@ -217,9 +217,6 @@
 // Staging for lowp::bilerp_clamp_8888, and for planned misc. others.
 #define SK_DISABLE_LOWP_BILERP_CLAMP_CLAMP_STAGE
 
-// Staging for https://review.skia.org/300707
-#define SK_IMAGE_SUBSET_USE_SOURCE_CONTEXT
-
 // Staging for https://review.skia.org/302290
 #define SK_IMAGE_MAKE_COLOR_TYPE_AND_SPACE_USE_SOURCE_CONTEXT
 
diff --git a/testing/variations/fieldtrial_testing_config.json b/testing/variations/fieldtrial_testing_config.json
index e22507c..31c741d 100644
--- a/testing/variations/fieldtrial_testing_config.json
+++ b/testing/variations/fieldtrial_testing_config.json
@@ -3239,6 +3239,25 @@
             ]
         }
     ],
+    "HeavyAdIntervention": [
+        {
+            "platforms": [
+                "android",
+                "chromeos",
+                "linux",
+                "mac",
+                "windows"
+            ],
+            "experiments": [
+                {
+                    "name": "Enabled",
+                    "enable_features": [
+                        "HeavyAdIntervention"
+                    ]
+                }
+            ]
+        }
+    ],
     "HideAutofillSuggestions": [
         {
             "platforms": [
diff --git a/third_party/.gitignore b/third_party/.gitignore
index efc2c5dc..8cd46575 100644
--- a/third_party/.gitignore
+++ b/third_party/.gitignore
@@ -218,6 +218,7 @@
 /swiftshader/
 /syzygy
 /syzygy/binaries
+/tint/src
 /tsan/
 /turbine/src
 /turbine/*.jar
diff --git a/third_party/blink/common/privacy_budget/aggregating_sample_collector.cc b/third_party/blink/common/privacy_budget/aggregating_sample_collector.cc
index 365a2fa2..dfea6e1 100644
--- a/third_party/blink/common/privacy_budget/aggregating_sample_collector.cc
+++ b/third_party/blink/common/privacy_budget/aggregating_sample_collector.cc
@@ -19,6 +19,7 @@
 #include "services/metrics/public/cpp/ukm_source_id.h"
 #include "services/metrics/public/mojom/ukm_interface.mojom.h"
 #include "third_party/blink/public/common/privacy_budget/identifiability_sample_collector.h"
+#include "third_party/blink/public/common/privacy_budget/identifiability_study_settings.h"
 #include "third_party/blink/public/common/privacy_budget/identifiable_sample.h"
 
 namespace blink {
@@ -30,6 +31,12 @@
 }
 }  // namespace internal
 
+namespace {
+bool IsStudyActive() {
+  return IdentifiabilityStudySettings::Get()->IsActive();
+}
+}  // namespace
+
 const unsigned AggregatingSampleCollector::kMaxTrackedSurfaces;
 const unsigned AggregatingSampleCollector::kMaxTrackedSamplesPerSurface;
 const unsigned AggregatingSampleCollector::kMaxUnsentSamples;
@@ -43,11 +50,20 @@
     ukm::UkmRecorder* recorder,
     ukm::SourceId source,
     std::vector<IdentifiableSample> samples) {
+  // recorder == nullptr or source == kInvalidSourceId can happen, for example,
+  // if metrics are being reported against an unsupported ExecutionContext type
+  // or for some reason the UkmRecorder or a valid source is unavailable.
+  if (!IsStudyActive() || !recorder || source == ukm::kInvalidSourceId)
+    return;
+
   if (TryAcceptSamples(source, std::move(samples)))
     Flush(recorder);
 }
 
 void AggregatingSampleCollector::Flush(ukm::UkmRecorder* recorder) {
+  if (!recorder)
+    return;
+
   std::unordered_multimap<ukm::SourceId, UkmMetricsContainerType> unsent;
   // Gratuitous block for releasing `lock_` after doing the minimal possible
   // work.
@@ -70,6 +86,9 @@
 
 void AggregatingSampleCollector::FlushSource(ukm::UkmRecorder* recorder,
                                              ukm::SourceId source) {
+  if (!IsStudyActive() || !recorder)
+    return;
+
   std::vector<UkmMetricsContainerType> metric_sets;
 
   {
diff --git a/third_party/blink/common/privacy_budget/aggregating_sample_collector_unittest.cc b/third_party/blink/common/privacy_budget/aggregating_sample_collector_unittest.cc
index 6776439..ebce0d8 100644
--- a/third_party/blink/common/privacy_budget/aggregating_sample_collector_unittest.cc
+++ b/third_party/blink/common/privacy_budget/aggregating_sample_collector_unittest.cc
@@ -4,6 +4,7 @@
 
 #include "third_party/blink/common/privacy_budget/aggregating_sample_collector.h"
 
+#include <memory>
 #include <type_traits>
 #include <vector>
 
@@ -16,6 +17,8 @@
 #include "third_party/blink/common/privacy_budget/identifiability_sample_collector_test_utils.h"
 #include "third_party/blink/common/privacy_budget/test_ukm_recorder.h"
 #include "third_party/blink/public/common/privacy_budget/identifiability_sample_collector.h"
+#include "third_party/blink/public/common/privacy_budget/identifiability_study_settings.h"
+#include "third_party/blink/public/common/privacy_budget/identifiability_study_settings_provider.h"
 #include "third_party/blink/public/common/privacy_budget/identifiable_sample.h"
 #include "third_party/blink/public/common/privacy_budget/identifiable_surface.h"
 
@@ -29,11 +32,29 @@
 constexpr IdentifiableSurface kTestSurface2 =
     IdentifiableSurface::FromMetricHash(2 << 8);
 constexpr IdentifiableToken kTestValue1 = 1;
+
+// A settings provider that activates the study and allows all surfaces and
+// types.
+class TestSettingsProvider : public IdentifiabilityStudySettingsProvider {
+ public:
+  bool IsActive() const override { return true; }
+  bool IsAnyTypeOrSurfaceBlocked() const override { return false; }
+  bool IsSurfaceAllowed(IdentifiableSurface) const override { return true; }
+  bool IsTypeAllowed(IdentifiableSurface::Type) const override { return true; }
+};
+
 }  // namespace
 
 class AggregatingSampleCollectorTest : public ::testing::Test {
  public:
-  AggregatingSampleCollectorTest() = default;
+  AggregatingSampleCollectorTest() {
+    IdentifiabilityStudySettings::SetGlobalProvider(
+        std::make_unique<TestSettingsProvider>());
+  }
+
+  ~AggregatingSampleCollectorTest() override {
+    IdentifiabilityStudySettings::ResetStateForTesting();
+  }
 
   test::TestUkmRecorder* recorder() { return &recorder_; }
   AggregatingSampleCollector* collector() { return &collector_; }
@@ -196,13 +217,13 @@
   // Stop one short of the limit.
   unsigned i = 0;
   for (; i < AggregatingSampleCollector::kMaxUnsentSources; ++i) {
-    collector()->Record(recorder(), i,
+    collector()->Record(recorder(), ukm::AssignNewSourceId(),
                         {{IdentifiableSurface::FromMetricHash(i << 8), 1}});
   }
   EXPECT_EQ(0u, recorder()->entries_count());
 
   // Adding one should automatically flush.
-  collector()->Record(recorder(), i,
+  collector()->Record(recorder(), ukm::AssignNewSourceId(),
                       {{IdentifiableSurface::FromMetricHash(i << 8), 1}});
   EXPECT_NE(0u, recorder()->entries_count());
 }
@@ -245,4 +266,23 @@
   EXPECT_NE(0u, recorder()->entries_count());
 }
 
+TEST_F(AggregatingSampleCollectorTest, NullRecorder) {
+  collector()->Record(recorder(), kTestSource2, {{kTestSurface2, 1}});
+
+  // Shouldn't crash nor affect state.
+  collector()->Record(nullptr, kTestSource1, {{kTestSurface1, 1}});
+  collector()->FlushSource(nullptr, kTestSource1);
+  collector()->FlushSource(nullptr, kTestSource2);
+  collector()->Flush(nullptr);
+
+  collector()->Flush(recorder());
+  EXPECT_EQ(1u, recorder()->entries_count());
+  EXPECT_EQ(kTestSource2, recorder()->entries().front()->source_id);
+}
+
+TEST_F(AggregatingSampleCollectorTest, InvalidSourceId) {
+  collector()->Record(recorder(), ukm::kInvalidSourceId, {{kTestSurface2, 2}});
+  collector()->Flush(recorder());
+  EXPECT_EQ(0u, recorder()->entries_count());
+}
 }  // namespace blink
diff --git a/third_party/blink/public/BUILD.gn b/third_party/blink/public/BUILD.gn
index c91bdf2..17da03a 100644
--- a/third_party/blink/public/BUILD.gn
+++ b/third_party/blink/public/BUILD.gn
@@ -241,7 +241,6 @@
     "platform/web_rect.h",
     "platform/web_runtime_features.h",
     "platform/web_scoped_page_pauser.h",
-    "platform/web_screen_info.h",
     "platform/web_scroll_anchor_data.h",
     "platform/web_scrollbar_overlay_color_theme.h",
     "platform/web_security_origin.h",
diff --git a/third_party/blink/public/common/BUILD.gn b/third_party/blink/public/common/BUILD.gn
index 9dc6ed9..fcc0d24 100644
--- a/third_party/blink/public/common/BUILD.gn
+++ b/third_party/blink/public/common/BUILD.gn
@@ -171,6 +171,8 @@
     "web_cache/web_cache_resource_type_stats.h",
     "web_package/signed_exchange_consts.h",
     "web_package/web_package_request_matcher.h",
+    "widget/screen_info.h",
+    "widget/visual_properties.h",
   ]
 
   public_deps = [
@@ -192,6 +194,8 @@
     ":buildflags",
     ":common_export",
     "//base",
+    "//cc",
+    "//components/viz/common",
     "//mojo/public/cpp/bindings",
     "//mojo/public/cpp/system",
     "//mojo/public/mojom/base",
diff --git a/third_party/blink/public/common/DEPS b/third_party/blink/public/common/DEPS
index 1fd161e..43bc1d3 100644
--- a/third_party/blink/public/common/DEPS
+++ b/third_party/blink/public/common/DEPS
@@ -9,6 +9,8 @@
     "+base",
     "+build",
     "+cc/paint/element_id.h",
+    "+cc/trees/browser_controls_params.h",
+    "+components/viz/common/surfaces/local_surface_id_allocation.h",
     "+net",
     "+media",
     "+mojo",
@@ -21,6 +23,7 @@
     "+third_party/blink/public/mojom",
     "+ui/events/event_constants.h",
     "+ui/events/types",
+    "+ui/gfx/color_space.h",
     "+ui/gfx/geometry",
     "+ui/latency/latency_info.h",
     "+url",
diff --git a/third_party/blink/public/platform/web_screen_info.h b/third_party/blink/public/common/widget/screen_info.h
similarity index 89%
rename from third_party/blink/public/platform/web_screen_info.h
rename to third_party/blink/public/common/widget/screen_info.h
index 4ae4d18..3285da4 100644
--- a/third_party/blink/public/platform/web_screen_info.h
+++ b/third_party/blink/public/common/widget/screen_info.h
@@ -28,8 +28,8 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef THIRD_PARTY_BLINK_PUBLIC_PLATFORM_WEB_SCREEN_INFO_H_
-#define THIRD_PARTY_BLINK_PUBLIC_PLATFORM_WEB_SCREEN_INFO_H_
+#ifndef THIRD_PARTY_BLINK_PUBLIC_COMMON_WIDGET_SCREEN_INFO_H_
+#define THIRD_PARTY_BLINK_PUBLIC_COMMON_WIDGET_SCREEN_INFO_H_
 
 #include "third_party/blink/public/mojom/widget/screen_orientation.mojom-shared.h"
 #include "ui/gfx/color_space.h"
@@ -37,7 +37,7 @@
 
 namespace blink {
 
-struct WebScreenInfo {
+struct ScreenInfo {
   // Device scale factor. Specifies the ratio between physical and logical
   // pixels.
   float device_scale_factor = 1.f;
@@ -55,6 +55,10 @@
   // This can be true for black and white printers
   bool is_monochrome = false;
 
+  // The display frequency in Hz of the monitor. Set to 0 if it fails in the
+  // monitor frequency query.
+  int display_frequency = 0;
+
   // This is set from the rcMonitor member of MONITORINFOEX, to whit:
   //   "A RECT structure that specifies the display monitor rectangle,
   //   expressed in virtual-screen coordinates. Note that if the monitor
@@ -83,21 +87,22 @@
   // TODO(crbug.com/840189): we should use an enum rather than a number here.
   uint16_t orientation_angle = 0;
 
-  WebScreenInfo() = default;
+  ScreenInfo() = default;
 
-  bool operator==(const WebScreenInfo& other) const {
+  bool operator==(const ScreenInfo& other) const {
     return this->device_scale_factor == other.device_scale_factor &&
            this->color_space == other.color_space &&
            this->depth == other.depth &&
            this->depth_per_component == other.depth_per_component &&
            this->is_monochrome == other.is_monochrome &&
+           this->display_frequency == other.display_frequency &&
            this->rect == other.rect &&
            this->available_rect == other.available_rect &&
            this->orientation_type == other.orientation_type &&
            this->orientation_angle == other.orientation_angle;
   }
 
-  bool operator!=(const WebScreenInfo& other) const {
+  bool operator!=(const ScreenInfo& other) const {
     return !this->operator==(other);
   }
 };
diff --git a/content/common/visual_properties.h b/third_party/blink/public/common/widget/visual_properties.h
similarity index 90%
rename from content/common/visual_properties.h
rename to third_party/blink/public/common/widget/visual_properties.h
index 058fbee..95f4dbf 100644
--- a/content/common/visual_properties.h
+++ b/third_party/blink/public/common/widget/visual_properties.h
@@ -2,19 +2,18 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef CONTENT_COMMON_VISUAL_PROPERTIES_H_
-#define CONTENT_COMMON_VISUAL_PROPERTIES_H_
+#ifndef THIRD_PARTY_BLINK_PUBLIC_COMMON_WIDGET_VISUAL_PROPERTIES_H_
+#define THIRD_PARTY_BLINK_PUBLIC_COMMON_WIDGET_VISUAL_PROPERTIES_H_
 
 #include "base/optional.h"
 #include "base/time/time.h"
 #include "cc/trees/browser_controls_params.h"
 #include "components/viz/common/surfaces/local_surface_id_allocation.h"
-#include "content/common/content_export.h"
-#include "content/public/common/screen_info.h"
+#include "third_party/blink/public/common/widget/screen_info.h"
 #include "third_party/blink/public/mojom/manifest/display_mode.mojom.h"
 #include "ui/gfx/geometry/size.h"
 
-namespace content {
+namespace blink {
 
 // Visual properties contain context required to render a frame tree.
 // For legacy reasons, both Page visual properties [shared by all Renderers] and
@@ -50,13 +49,7 @@
 // In between (1) and (3), frames associated with RenderWidget A' will see
 // updated page properties from (1) but are still seeing old widget properties.
 
-struct CONTENT_EXPORT VisualProperties {
-  VisualProperties();
-  VisualProperties(const VisualProperties& other);
-  ~VisualProperties();
-
-  VisualProperties& operator=(const VisualProperties& other);
-
+struct VisualProperties {
   // Information about the screen (dpi, depth, etc..).
   ScreenInfo screen_info;
 
@@ -106,8 +99,7 @@
   bool is_fullscreen_granted = false;
 
   // The display mode.
-  blink::mojom::DisplayMode display_mode =
-      blink::mojom::DisplayMode::kUndefined;
+  mojom::DisplayMode display_mode = mojom::DisplayMode::kUndefined;
 
   // This represents the latest capture sequence number requested. When this is
   // incremented, that means the caller wants to synchronize surfaces which
@@ -133,6 +125,6 @@
   bool is_pinch_gesture_active = false;
 };
 
-}  // namespace content
+}  // namespace blink
 
-#endif  // CONTENT_COMMON_VISUAL_PROPERTIES_H_
+#endif  // THIRD_PARTY_BLINK_PUBLIC_COMMON_WIDGET_VISUAL_PROPERTIES_H_
diff --git a/third_party/blink/public/web/web_widget_client.h b/third_party/blink/public/web/web_widget_client.h
index 7d90596..89f86a0 100644
--- a/third_party/blink/public/web/web_widget_client.h
+++ b/third_party/blink/public/web/web_widget_client.h
@@ -44,12 +44,12 @@
 #include "third_party/blink/public/common/input/web_coalesced_input_event.h"
 #include "third_party/blink/public/common/input/web_gesture_event.h"
 #include "third_party/blink/public/common/page/web_drag_operation.h"
+#include "third_party/blink/public/common/widget/screen_info.h"
 #include "third_party/blink/public/mojom/input/input_handler.mojom-shared.h"
 #include "third_party/blink/public/mojom/input/pointer_lock_result.mojom-forward.h"
 #include "third_party/blink/public/platform/cross_variant_mojo_util.h"
 #include "third_party/blink/public/platform/web_common.h"
 #include "third_party/blink/public/platform/web_rect.h"
-#include "third_party/blink/public/platform/web_screen_info.h"
 #include "third_party/blink/public/platform/web_text_input_type.h"
 #include "third_party/blink/public/platform/web_touch_action.h"
 #include "third_party/blink/public/web/web_meaningful_layout.h"
@@ -108,7 +108,7 @@
 
   // Returns information about the screen where this view's widgets are being
   // displayed.
-  virtual WebScreenInfo GetScreenInfo() { return {}; }
+  virtual ScreenInfo GetScreenInfo() { return {}; }
 
   // Called to get/set the position of the widget's window in screen
   // coordinates. Note, the window includes any decorations such as borders,
diff --git a/third_party/blink/renderer/core/clipboard/data_transfer.cc b/third_party/blink/renderer/core/clipboard/data_transfer.cc
index 4c6a705..c95d50e 100644
--- a/third_party/blink/renderer/core/clipboard/data_transfer.cc
+++ b/third_party/blink/renderer/core/clipboard/data_transfer.cc
@@ -29,7 +29,7 @@
 
 #include "base/optional.h"
 #include "build/build_config.h"
-#include "third_party/blink/public/platform/web_screen_info.h"
+#include "third_party/blink/public/common/widget/screen_info.h"
 #include "third_party/blink/renderer/core/clipboard/clipboard_mime_types.h"
 #include "third_party/blink/renderer/core/clipboard/clipboard_utilities.h"
 #include "third_party/blink/renderer/core/clipboard/data_object.h"
diff --git a/third_party/blink/renderer/core/css/media_values.cc b/third_party/blink/renderer/core/css/media_values.cc
index f73cf86..220ef898 100644
--- a/third_party/blink/renderer/core/css/media_values.cc
+++ b/third_party/blink/renderer/core/css/media_values.cc
@@ -5,8 +5,8 @@
 #include "third_party/blink/renderer/core/css/media_values.h"
 
 #include "third_party/blink/public/common/css/screen_spanning.h"
+#include "third_party/blink/public/common/widget/screen_info.h"
 #include "third_party/blink/public/platform/platform.h"
-#include "third_party/blink/public/platform/web_screen_info.h"
 #include "third_party/blink/public/platform/web_theme_engine.h"
 #include "third_party/blink/renderer/core/css/css_resolution_units.h"
 #include "third_party/blink/renderer/core/css/media_feature_overrides.h"
@@ -61,7 +61,7 @@
 
 int MediaValues::CalculateDeviceWidth(LocalFrame* frame) {
   DCHECK(frame && frame->View() && frame->GetSettings() && frame->GetPage());
-  blink::WebScreenInfo screen_info =
+  blink::ScreenInfo screen_info =
       frame->GetPage()->GetChromeClient().GetScreenInfo(*frame);
   int device_width = screen_info.rect.width();
   if (frame->GetSettings()->GetReportScreenSizeInPhysicalPixelsQuirk()) {
@@ -73,7 +73,7 @@
 
 int MediaValues::CalculateDeviceHeight(LocalFrame* frame) {
   DCHECK(frame && frame->View() && frame->GetSettings() && frame->GetPage());
-  blink::WebScreenInfo screen_info =
+  blink::ScreenInfo screen_info =
       frame->GetPage()->GetChromeClient().GetScreenInfo(*frame);
   int device_height = screen_info.rect.height();
   if (frame->GetSettings()->GetReportScreenSizeInPhysicalPixelsQuirk()) {
@@ -96,7 +96,7 @@
 int MediaValues::CalculateColorBitsPerComponent(LocalFrame* frame) {
   DCHECK(frame);
   DCHECK(frame->GetPage());
-  WebScreenInfo screen_info =
+  ScreenInfo screen_info =
       frame->GetPage()->GetChromeClient().GetScreenInfo(*frame);
   if (screen_info.is_monochrome)
     return 0;
@@ -106,7 +106,7 @@
 int MediaValues::CalculateMonochromeBitsPerComponent(LocalFrame* frame) {
   DCHECK(frame);
   DCHECK(frame->GetPage());
-  WebScreenInfo screen_info =
+  ScreenInfo screen_info =
       frame->GetPage()->GetChromeClient().GetScreenInfo(*frame);
   if (!screen_info.is_monochrome)
     return 0;
diff --git a/third_party/blink/renderer/core/events/pointer_event_factory.cc b/third_party/blink/renderer/core/events/pointer_event_factory.cc
index f078247..781726f 100644
--- a/third_party/blink/renderer/core/events/pointer_event_factory.cc
+++ b/third_party/blink/renderer/core/events/pointer_event_factory.cc
@@ -4,7 +4,7 @@
 
 #include "third_party/blink/renderer/core/events/pointer_event_factory.h"
 
-#include "third_party/blink/public/platform/web_screen_info.h"
+#include "third_party/blink/public/common/widget/screen_info.h"
 #include "third_party/blink/renderer/bindings/core/v8/v8_pointer_event_init.h"
 #include "third_party/blink/renderer/core/frame/local_dom_window.h"
 #include "third_party/blink/renderer/core/frame/local_frame_view.h"
diff --git a/third_party/blink/renderer/core/execution_context/execution_context.cc b/third_party/blink/renderer/core/execution_context/execution_context.cc
index cbc2941..9d7c0ef 100644
--- a/third_party/blink/renderer/core/execution_context/execution_context.cc
+++ b/third_party/blink/renderer/core/execution_context/execution_context.cc
@@ -67,18 +67,13 @@
       csp_delegate_(MakeGarbageCollected<ExecutionContextCSPDelegate>(*this)),
       window_interaction_tokens_(0),
       referrer_policy_(network::mojom::ReferrerPolicy::kDefault),
-      address_space_(network::mojom::blink::IPAddressSpace::kUnknown) {
+      address_space_(network::mojom::blink::IPAddressSpace::kUnknown),
+      origin_trial_context_(MakeGarbageCollected<OriginTrialContext>(this)) {
   DCHECK(agent_);
 }
 
 ExecutionContext::~ExecutionContext() = default;
 
-void ExecutionContext::Initialize(const SecurityContextInit& init) {
-  security_context_.Initialize(init);
-  if (GetOriginTrialContext())
-    GetOriginTrialContext()->BindExecutionContext(this);
-}
-
 // static
 ExecutionContext* ExecutionContext::From(const ScriptState* script_state) {
   v8::HandleScope scope(script_state->GetIsolate());
@@ -379,6 +374,7 @@
   visitor->Trace(csp_delegate_);
   visitor->Trace(timers_);
   visitor->Trace(context_lifecycle_observer_list_);
+  visitor->Trace(origin_trial_context_);
   ContextLifecycleNotifier::Trace(visitor);
   ConsoleLogger::Trace(visitor);
   Supplementable<ExecutionContext>::Trace(visitor);
@@ -401,25 +397,7 @@
 }
 
 bool ExecutionContext::FeatureEnabled(OriginTrialFeature feature) const {
-  return GetOriginTrialContext() &&
-         GetOriginTrialContext()->IsFeatureEnabled(feature);
-}
-
-void ExecutionContext::CountFeaturePolicyUsage(mojom::WebFeature feature) {
-  UseCounter::Count(*this, feature);
-}
-
-bool ExecutionContext::FeaturePolicyFeatureObserved(
-    mojom::blink::FeaturePolicyFeature feature) {
-  size_t feature_index = static_cast<size_t>(feature);
-  if (parsed_feature_policies_.size() == 0) {
-    parsed_feature_policies_.resize(
-        static_cast<size_t>(mojom::blink::FeaturePolicyFeature::kMaxValue) + 1);
-  } else if (parsed_feature_policies_[feature_index]) {
-    return true;
-  }
-  parsed_feature_policies_[feature_index] = true;
-  return false;
+  return origin_trial_context_->IsFeatureEnabled(feature);
 }
 
 void ExecutionContext::FeaturePolicyPotentialBehaviourChangeObserved(
diff --git a/third_party/blink/renderer/core/execution_context/execution_context.h b/third_party/blink/renderer/core/execution_context/execution_context.h
index 553263b..d8ec0d9 100644
--- a/third_party/blink/renderer/core/execution_context/execution_context.h
+++ b/third_party/blink/renderer/core/execution_context/execution_context.h
@@ -44,7 +44,6 @@
 #include "third_party/blink/renderer/core/core_export.h"
 #include "third_party/blink/renderer/core/execution_context/execution_context_lifecycle_observer.h"
 #include "third_party/blink/renderer/core/execution_context/security_context.h"
-#include "third_party/blink/renderer/core/feature_policy/feature_policy_parser_delegate.h"
 #include "third_party/blink/renderer/core/frame/dom_timer_coordinator.h"
 #include "third_party/blink/renderer/platform/context_lifecycle_notifier.h"
 #include "third_party/blink/renderer/platform/heap/handle.h"
@@ -121,8 +120,7 @@
                                      public ContextLifecycleNotifier,
                                      public ConsoleLogger,
                                      public UseCounter,
-                                     public FeaturePolicyParserDelegate {
-
+                                     public FeatureContext {
  public:
   void Trace(Visitor*) const override;
 
@@ -136,8 +134,6 @@
   static ExecutionContext* ForRelevantRealm(
       const v8::FunctionCallbackInfo<v8::Value>&);
 
-  void Initialize(const SecurityContextInit&);
-
   virtual bool IsWindow() const { return false; }
   virtual bool IsWorkerOrWorkletGlobalScope() const { return false; }
   virtual bool IsWorkerGlobalScope() const { return false; }
@@ -312,17 +308,14 @@
   v8::MicrotaskQueue* GetMicrotaskQueue() const;
 
   OriginTrialContext* GetOriginTrialContext() const {
-    return security_context_.GetOriginTrialContext();
+    return origin_trial_context_;
   }
 
   virtual TrustedTypePolicyFactory* GetTrustedTypes() const { return nullptr; }
   virtual bool RequireTrustedTypes() const;
 
-  // FeaturePolicyParserDelegate override
+  // FeatureContext override
   bool FeatureEnabled(OriginTrialFeature) const override;
-  void CountFeaturePolicyUsage(mojom::WebFeature feature) override;
-  bool FeaturePolicyFeatureObserved(
-      mojom::blink::FeaturePolicyFeature feature) override;
 
   // Tests whether the policy-controlled feature is enabled in this frame.
   // Optionally sends a report to any registered reporting observers or
@@ -440,10 +433,7 @@
 
   network::mojom::blink::IPAddressSpace address_space_;
 
-  // Tracks which feature policies have already been parsed, so as not to count
-  // them multiple times.
-  // The size of this vector is 0 until FeaturePolicyFeatureObserved is called.
-  Vector<bool> parsed_feature_policies_;
+  Member<OriginTrialContext> origin_trial_context_;
 
   // Tracks which feature policy features have been logged in this execution
   // context as to the FeaturePolicyProposalWouldChangeBehaviour
diff --git a/third_party/blink/renderer/core/execution_context/security_context.cc b/third_party/blink/renderer/core/execution_context/security_context.cc
index 6e38ed8..d4e05ed 100644
--- a/third_party/blink/renderer/core/execution_context/security_context.cc
+++ b/third_party/blink/renderer/core/execution_context/security_context.cc
@@ -35,9 +35,8 @@
 #include "third_party/blink/public/mojom/feature_policy/policy_value.mojom-blink.h"
 #include "third_party/blink/public/mojom/security_context/insecure_request_policy.mojom-blink.h"
 #include "third_party/blink/public/platform/platform.h"
-#include "third_party/blink/renderer/core/execution_context/security_context_init.h"
+#include "third_party/blink/renderer/core/execution_context/execution_context.h"
 #include "third_party/blink/renderer/core/frame/csp/content_security_policy.h"
-#include "third_party/blink/renderer/core/origin_trials/origin_trial_context.h"
 #include "third_party/blink/renderer/platform/runtime_enabled_features.h"
 #include "third_party/blink/renderer/platform/weborigin/security_origin.h"
 
@@ -64,14 +63,9 @@
 
 SecurityContext::~SecurityContext() = default;
 
-void SecurityContext::Initialize(const SecurityContextInit& init) {
-  origin_trial_context_ = init.GetOriginTrialContext();
-}
-
 void SecurityContext::Trace(Visitor* visitor) const {
   visitor->Trace(execution_context_);
   visitor->Trace(content_security_policy_);
-  visitor->Trace(origin_trial_context_);
 }
 
 void SecurityContext::SetSecurityOrigin(
diff --git a/third_party/blink/renderer/core/execution_context/security_context.h b/third_party/blink/renderer/core/execution_context/security_context.h
index 29c3feb..a0b8e19 100644
--- a/third_party/blink/renderer/core/execution_context/security_context.h
+++ b/third_party/blink/renderer/core/execution_context/security_context.h
@@ -50,8 +50,6 @@
 class ExecutionContext;
 class FeaturePolicy;
 class PolicyValue;
-class OriginTrialContext;
-class SecurityContextInit;
 class SecurityOrigin;
 struct ParsedFeaturePolicyDeclaration;
 
@@ -78,8 +76,6 @@
   explicit SecurityContext(ExecutionContext*);
   virtual ~SecurityContext();
 
-  void Initialize(const SecurityContextInit&);
-
   void Trace(Visitor*) const;
 
   using InsecureNavigationsSet = HashSet<unsigned, WTF::AlreadyHashed>;
@@ -168,10 +164,6 @@
   FeatureStatus IsFeatureEnabled(mojom::blink::DocumentPolicyFeature,
                                  PolicyValue threshold_value) const;
 
-  OriginTrialContext* GetOriginTrialContext() const {
-    return origin_trial_context_;
-  }
-
   SecureContextMode GetSecureContextMode() const {
     return secure_context_mode_;
   }
@@ -192,7 +184,6 @@
   InsecureNavigationsSet insecure_navigations_to_upgrade_;
   bool require_safe_types_ = false;
   SecureContextMode secure_context_mode_ = SecureContextMode::kInsecureContext;
-  Member<OriginTrialContext> origin_trial_context_;
   DISALLOW_COPY_AND_ASSIGN(SecurityContext);
 };
 
diff --git a/third_party/blink/renderer/core/execution_context/security_context_init.cc b/third_party/blink/renderer/core/execution_context/security_context_init.cc
index 3dbdca5..59a592b 100644
--- a/third_party/blink/renderer/core/execution_context/security_context_init.cc
+++ b/third_party/blink/renderer/core/execution_context/security_context_init.cc
@@ -32,19 +32,19 @@
 // ParsedDocumentPolicy.
 DocumentPolicy::ParsedDocumentPolicy FilterByOriginTrial(
     const DocumentPolicy::ParsedDocumentPolicy& parsed_policy,
-    SecurityContextInit* init) {
+    ExecutionContext* context) {
   DocumentPolicy::ParsedDocumentPolicy filtered_policy;
   for (auto i = parsed_policy.feature_state.begin(),
             last = parsed_policy.feature_state.end();
        i != last;) {
-    if (!DisabledByOriginTrial(i->first, init))
+    if (!DisabledByOriginTrial(i->first, context))
       filtered_policy.feature_state.insert(*i);
     ++i;
   }
   for (auto i = parsed_policy.endpoint_map.begin(),
             last = parsed_policy.endpoint_map.end();
        i != last;) {
-    if (!DisabledByOriginTrial(i->first, init))
+    if (!DisabledByOriginTrial(i->first, context))
       filtered_policy.endpoint_map.insert(*i);
     ++i;
   }
@@ -71,42 +71,22 @@
 
 }  // namespace
 
-SecurityContextInit::SecurityContextInit(OriginTrialContext* origin_trials)
-    : origin_trials_(origin_trials) {}
-
 // A helper class that allows the security context be initialized in the
 // process of constructing the document.
 SecurityContextInit::SecurityContextInit(ExecutionContext* context)
     : execution_context_(context) {}
 
-void SecurityContextInit::CountFeaturePolicyUsage(
-    mojom::blink::WebFeature feature) {
-  if (execution_context_)
-    execution_context_->CountFeaturePolicyUsage(feature);
-}
-
-bool SecurityContextInit::FeaturePolicyFeatureObserved(
-    mojom::blink::FeaturePolicyFeature feature) {
-  return execution_context_ &&
-         execution_context_->FeaturePolicyFeatureObserved(feature);
-}
-
-bool SecurityContextInit::FeatureEnabled(OriginTrialFeature feature) const {
-  return origin_trials_->IsFeatureEnabled(feature);
-}
-
 void SecurityContextInit::ApplyDocumentPolicy(
     DocumentPolicy::ParsedDocumentPolicy& document_policy,
     const String& report_only_document_policy_header) {
-  DCHECK(origin_trials_);
-  if (!RuntimeEnabledFeatures::DocumentPolicyEnabled(this))
+  if (!RuntimeEnabledFeatures::DocumentPolicyEnabled(execution_context_))
     return;
 
   // Because Document-Policy http header is parsed in DocumentLoader,
   // when origin trial context is not initialized yet.
   // Needs to filter out features that are not in origin trial after
   // we have origin trial information available.
-  document_policy = FilterByOriginTrial(document_policy, this);
+  document_policy = FilterByOriginTrial(document_policy, execution_context_);
   if (!document_policy.feature_state.empty()) {
     UseCounter::Count(execution_context_, WebFeature::kDocumentPolicyHeader);
     for (const auto& policy_entry : document_policy.feature_state) {
@@ -131,7 +111,7 @@
           report_only_document_policy_header, logger);
   if (report_only_parsed_policy) {
     report_only_document_policy =
-        FilterByOriginTrial(*report_only_parsed_policy, this);
+        FilterByOriginTrial(*report_only_parsed_policy, execution_context_);
     if (!report_only_document_policy.feature_state.empty()) {
       UseCounter::Count(execution_context_,
                         WebFeature::kDocumentPolicyReportOnlyHeader);
@@ -146,8 +126,6 @@
     const ResourceResponse& response,
     const base::Optional<WebOriginPolicy>& origin_policy,
     const FramePolicy& frame_policy) {
-  DCHECK(origin_trials_);
-
   // If we are a HTMLViewSourceDocument we use container, header or
   // inherited policies. https://crbug.com/898688.
   if (frame->InViewSourceMode()) {
@@ -182,14 +160,15 @@
 
   feature_policy_header_ = FeaturePolicyParser::ParseHeader(
       feature_policy_header, permissions_policy_header,
-      execution_context_->GetSecurityOrigin(), feature_policy_logger, this);
+      execution_context_->GetSecurityOrigin(), feature_policy_logger,
+      execution_context_);
 
   ParsedFeaturePolicy report_only_feature_policy_header =
       FeaturePolicyParser::ParseHeader(
           response.HttpHeaderField(http_names::kFeaturePolicyReportOnly),
           report_only_permissions_policy_header,
           execution_context_->GetSecurityOrigin(),
-          report_only_feature_policy_logger, this);
+          report_only_feature_policy_logger, execution_context_);
 
   if (!report_only_feature_policy_header.empty()) {
     UseCounter::Count(execution_context_,
@@ -280,18 +259,4 @@
   }
 }
 
-void SecurityContextInit::InitializeOriginTrials(
-    const String& origin_trials_header) {
-  origin_trials_ = MakeGarbageCollected<OriginTrialContext>();
-  if (origin_trials_header.IsEmpty())
-    return;
-  std::unique_ptr<Vector<String>> tokens(
-      OriginTrialContext::ParseHeaderValue(origin_trials_header));
-  if (!tokens)
-    return;
-  origin_trials_->AddTokens(*tokens, execution_context_->GetSecurityOrigin(),
-                            execution_context_->GetSecureContextMode() ==
-                                SecureContextMode::kSecureContext);
-}
-
 }  // namespace blink
diff --git a/third_party/blink/renderer/core/execution_context/security_context_init.h b/third_party/blink/renderer/core/execution_context/security_context_init.h
index 4e1b3ee..8b49055 100644
--- a/third_party/blink/renderer/core/execution_context/security_context_init.h
+++ b/third_party/blink/renderer/core/execution_context/security_context_init.h
@@ -20,19 +20,14 @@
 
 namespace blink {
 class LocalFrame;
-class OriginTrialContext;
 class ResourceResponse;
 
-class CORE_EXPORT SecurityContextInit : public FeaturePolicyParserDelegate {
+class CORE_EXPORT SecurityContextInit {
   STACK_ALLOCATED();
 
  public:
-  // The first constructor is for workers and tests. The second is for windows.
-  // TODO(japhet): Merge these.
-  explicit SecurityContextInit(OriginTrialContext*);
   explicit SecurityContextInit(ExecutionContext*);
 
-  void InitializeOriginTrials(const String& origin_trials_header);
   void ApplyFeaturePolicy(LocalFrame* frame,
                           const ResourceResponse& response,
                           const base::Optional<WebOriginPolicy>& origin_policy,
@@ -45,17 +40,9 @@
     return feature_policy_header_;
   }
 
-  OriginTrialContext* GetOriginTrialContext() const { return origin_trials_; }
-
-  void CountFeaturePolicyUsage(mojom::blink::WebFeature feature) override;
-  bool FeaturePolicyFeatureObserved(
-      mojom::blink::FeaturePolicyFeature) override;
-  bool FeatureEnabled(OriginTrialFeature feature) const override;
-
  private:
   ExecutionContext* execution_context_ = nullptr;
   ParsedFeaturePolicy feature_policy_header_;
-  OriginTrialContext* origin_trials_ = nullptr;
 };
 
 }  // namespace blink
diff --git a/third_party/blink/renderer/core/exported/web_frame_test.cc b/third_party/blink/renderer/core/exported/web_frame_test.cc
index c826c81..ad243c57 100644
--- a/third_party/blink/renderer/core/exported/web_frame_test.cc
+++ b/third_party/blink/renderer/core/exported/web_frame_test.cc
@@ -1227,9 +1227,9 @@
   ~FixedLayoutTestWebWidgetClient() override = default;
 
   // frame_test_helpers::TestWebWidgetClient:
-  WebScreenInfo GetScreenInfo() override { return screen_info_; }
+  ScreenInfo GetScreenInfo() override { return screen_info_; }
 
-  WebScreenInfo screen_info_;
+  ScreenInfo screen_info_;
 };
 
 // Helper function to set autosizing multipliers on a document.
diff --git a/third_party/blink/renderer/core/exported/web_page_popup_impl.cc b/third_party/blink/renderer/core/exported/web_page_popup_impl.cc
index 30477695..295a9fe5 100644
--- a/third_party/blink/renderer/core/exported/web_page_popup_impl.cc
+++ b/third_party/blink/renderer/core/exported/web_page_popup_impl.cc
@@ -173,7 +173,7 @@
         timeline->GetAnimationTimeline());
   }
 
-  WebScreenInfo GetScreenInfo(LocalFrame&) const override {
+  ScreenInfo GetScreenInfo(LocalFrame&) const override {
     // LocalFrame is ignored since there is only 1 frame in a popup.
     return popup_->WidgetClient()->GetScreenInfo();
   }
diff --git a/third_party/blink/renderer/core/feature_policy/BUILD.gn b/third_party/blink/renderer/core/feature_policy/BUILD.gn
index 999430c..752c9e9 100644
--- a/third_party/blink/renderer/core/feature_policy/BUILD.gn
+++ b/third_party/blink/renderer/core/feature_policy/BUILD.gn
@@ -12,7 +12,6 @@
     "dom_feature_policy.h",
     "feature_policy_parser.cc",
     "feature_policy_parser.h",
-    "feature_policy_parser_delegate.h",
     "iframe_policy.h",
     "layout_animations_policy.cc",
     "layout_animations_policy.h",
diff --git a/third_party/blink/renderer/core/feature_policy/feature_policy_parser.cc b/third_party/blink/renderer/core/feature_policy/feature_policy_parser.cc
index a709d04..6542f68 100644
--- a/third_party/blink/renderer/core/feature_policy/feature_policy_parser.cc
+++ b/third_party/blink/renderer/core/feature_policy/feature_policy_parser.cc
@@ -36,18 +36,60 @@
 using FeaturePolicyNode = Vector<FeaturePolicyDeclarationNode>;
 }  // namespace internal
 
+class ParsedFeaturePolicies final
+    : public GarbageCollected<ParsedFeaturePolicies>,
+      public Supplement<ExecutionContext> {
+  USING_GARBAGE_COLLECTED_MIXIN(ParsedFeaturePolicies);
+
+ public:
+  static const char kSupplementName[];
+
+  static ParsedFeaturePolicies& From(ExecutionContext& context) {
+    ParsedFeaturePolicies* policies =
+        Supplement<ExecutionContext>::From<ParsedFeaturePolicies>(context);
+    if (!policies) {
+      policies = MakeGarbageCollected<ParsedFeaturePolicies>(context);
+      Supplement<ExecutionContext>::ProvideTo(context, policies);
+    }
+    return *policies;
+  }
+
+  explicit ParsedFeaturePolicies(ExecutionContext& context)
+      : Supplement<ExecutionContext>(context),
+        policies_(
+            static_cast<size_t>(mojom::blink::FeaturePolicyFeature::kMaxValue) +
+            1) {}
+
+  bool Observed(mojom::blink::FeaturePolicyFeature feature) {
+    size_t feature_index = static_cast<size_t>(feature);
+    if (policies_[feature_index])
+      return true;
+    policies_[feature_index] = true;
+    return false;
+  }
+
+ private:
+  // Tracks which feature policies have already been parsed, so as not to count
+  // them multiple times.
+  Vector<bool> policies_;
+};
+
+const char ParsedFeaturePolicies::kSupplementName[] = "ParsedFeaturePolicies";
+
 class ParsingContext {
+  STACK_ALLOCATED();
+
  public:
   ParsingContext(PolicyParserMessageBuffer& logger,
                  scoped_refptr<const SecurityOrigin> self_origin,
                  scoped_refptr<const SecurityOrigin> src_origin,
                  const FeatureNameMap& feature_names,
-                 FeaturePolicyParserDelegate* delegate)
+                 ExecutionContext* execution_context)
       : logger_(logger),
         self_origin_(self_origin),
         src_origin_(src_origin),
         feature_names_(feature_names),
-        delegate_(delegate) {}
+        execution_context_(execution_context) {}
 
   ~ParsingContext() = default;
 
@@ -79,8 +121,6 @@
 
   bool FeatureObserved(mojom::blink::FeaturePolicyFeature feature);
 
-  void ReportFeaturePolicyWebFeatureUsage(mojom::blink::WebFeature feature);
-
   void ReportFeatureUsage(mojom::blink::FeaturePolicyFeature feature);
 
   // This function should be called after Allowlist Histograms related flags
@@ -98,7 +138,7 @@
   scoped_refptr<const SecurityOrigin> self_origin_;
   scoped_refptr<const SecurityOrigin> src_origin_;
   const FeatureNameMap& feature_names_;
-  FeaturePolicyParserDelegate* delegate_;
+  ExecutionContext* execution_context_;
 
   // Flags for the types of items which can be used in allowlists.
   bool allowlist_includes_star_ = false;
@@ -123,16 +163,11 @@
   }
 }
 
-void ParsingContext::ReportFeaturePolicyWebFeatureUsage(
-    mojom::blink::WebFeature feature) {
-  if (delegate_)
-    delegate_->CountFeaturePolicyUsage(feature);
-}
-
 void ParsingContext::ReportFeatureUsage(
     mojom::blink::FeaturePolicyFeature feature) {
   if (src_origin_) {
-    if (!delegate_ || !delegate_->FeaturePolicyFeatureObserved(feature)) {
+    if (!execution_context_ ||
+        !ParsedFeaturePolicies::From(*execution_context_).Observed(feature)) {
       UMA_HISTOGRAM_ENUMERATION("Blink.UseCounter.FeaturePolicy.Allow",
                                 feature);
     }
@@ -196,7 +231,7 @@
     logger_.Warn("Unrecognized feature: '" + feature_name + "'.");
     return base::nullopt;
   }
-  if (DisabledByOriginTrial(feature_name, delegate_)) {
+  if (DisabledByOriginTrial(feature_name, execution_context_)) {
     logger_.Warn("Origin trial controlled feature not enabled: '" +
                  feature_name + "'.");
     return base::nullopt;
@@ -362,7 +397,8 @@
   policy.Split(',', policy_items);
 
   if (policy_items.size() > 1) {
-    ReportFeaturePolicyWebFeatureUsage(
+    UseCounter::Count(
+        execution_context_,
         mojom::blink::WebFeature::kFeaturePolicyCommaSeparatedDeclarations);
   }
 
@@ -372,9 +408,9 @@
     item.Split(';', feature_entries);
 
     if (feature_entries.size() > 1) {
-      ReportFeaturePolicyWebFeatureUsage(
-          mojom::blink::WebFeature::
-              kFeaturePolicySemicolonSeparatedDeclarations);
+      UseCounter::Count(execution_context_,
+                        mojom::blink::WebFeature::
+                            kFeaturePolicySemicolonSeparatedDeclarations);
     }
 
     for (const String& feature_entry : feature_entries) {
@@ -475,9 +511,9 @@
     const String& permissions_policy_header,
     scoped_refptr<const SecurityOrigin> origin,
     PolicyParserMessageBuffer& logger,
-    FeaturePolicyParserDelegate* delegate) {
+    ExecutionContext* execution_context) {
   ParsingContext context(logger, origin, nullptr, GetDefaultFeatureNameMap(),
-                         delegate);
+                         execution_context);
   auto policy_ir =
       context.ParsePermissionsPolicyToIR(permissions_policy_header);
   policy_ir.AppendVector(context.ParseFeaturePolicyToIR(feature_policy_header));
@@ -489,9 +525,9 @@
     scoped_refptr<const SecurityOrigin> self_origin,
     scoped_refptr<const SecurityOrigin> src_origin,
     PolicyParserMessageBuffer& logger,
-    FeaturePolicyParserDelegate* delegate) {
+    ExecutionContext* execution_context) {
   ParsingContext context(logger, self_origin, src_origin,
-                         GetDefaultFeatureNameMap(), delegate);
+                         GetDefaultFeatureNameMap(), execution_context);
   return context.ParseIR(context.ParseFeaturePolicyToIR(policy));
 }
 
@@ -501,9 +537,9 @@
     scoped_refptr<const SecurityOrigin> src_origin,
     PolicyParserMessageBuffer& logger,
     const FeatureNameMap& feature_names,
-    FeaturePolicyParserDelegate* delegate) {
+    ExecutionContext* execution_context) {
   ParsingContext context(logger, self_origin, src_origin, feature_names,
-                         delegate);
+                         execution_context);
   return context.ParseIR(context.ParseFeaturePolicyToIR(policy));
 }
 
@@ -513,9 +549,9 @@
     scoped_refptr<const SecurityOrigin> src_origin,
     PolicyParserMessageBuffer& logger,
     const FeatureNameMap& feature_names,
-    FeaturePolicyParserDelegate* delegate) {
+    ExecutionContext* execution_context) {
   ParsingContext context(logger, self_origin, src_origin, feature_names,
-                         delegate);
+                         execution_context);
   return context.ParseIR(context.ParsePermissionsPolicyToIR(policy));
 }
 
diff --git a/third_party/blink/renderer/core/feature_policy/feature_policy_parser.h b/third_party/blink/renderer/core/feature_policy/feature_policy_parser.h
index 96200b1..06c0f56 100644
--- a/third_party/blink/renderer/core/feature_policy/feature_policy_parser.h
+++ b/third_party/blink/renderer/core/feature_policy/feature_policy_parser.h
@@ -19,7 +19,6 @@
 namespace blink {
 
 class ExecutionContext;
-class FeaturePolicyParserDelegate;
 
 // These values match the "FeaturePolicyAllowlistType" enum in
 // tools/metrics/histograms/enums.xml. Entries should not be renumbered and
@@ -57,12 +56,11 @@
   // ExecutionContext is used to determine if any origin trials affect the
   // parsing. Example of a feature policy string:
   //     "vibrate a.com b.com; fullscreen 'none'; payment 'self', payment *".
-  static ParsedFeaturePolicy ParseHeader(
-      const String& feature_policy_header,
-      const String& permission_policy_header,
-      scoped_refptr<const SecurityOrigin>,
-      PolicyParserMessageBuffer& logger,
-      FeaturePolicyParserDelegate* delegate = nullptr);
+  static ParsedFeaturePolicy ParseHeader(const String& feature_policy_header,
+                                         const String& permission_policy_header,
+                                         scoped_refptr<const SecurityOrigin>,
+                                         PolicyParserMessageBuffer& logger,
+                                         ExecutionContext* = nullptr);
 
   // Converts a container policy string into a vector of allowlists, given self
   // and src origins provided, one for each feature specified. Unrecognized
@@ -74,7 +72,7 @@
       scoped_refptr<const SecurityOrigin> self_origin,
       scoped_refptr<const SecurityOrigin> src_origin,
       PolicyParserMessageBuffer& logger,
-      FeaturePolicyParserDelegate* delegate = nullptr);
+      ExecutionContext* = nullptr);
 
   static ParsedFeaturePolicy ParseFeaturePolicyForTest(
       const String& policy,
@@ -82,7 +80,7 @@
       scoped_refptr<const SecurityOrigin> src_origin,
       PolicyParserMessageBuffer& logger,
       const FeatureNameMap& feature_names,
-      FeaturePolicyParserDelegate* delegate = nullptr);
+      ExecutionContext* = nullptr);
 
   static ParsedFeaturePolicy ParsePermissionsPolicyForTest(
       const String& policy,
@@ -90,7 +88,7 @@
       scoped_refptr<const SecurityOrigin> src_origin,
       PolicyParserMessageBuffer& logger,
       const FeatureNameMap& feature_names,
-      FeaturePolicyParserDelegate* delegate = nullptr);
+      ExecutionContext* = nullptr);
 };
 
 // Returns true iff any declaration in the policy is for the given feature.
diff --git a/third_party/blink/renderer/core/feature_policy/feature_policy_parser_delegate.h b/third_party/blink/renderer/core/feature_policy/feature_policy_parser_delegate.h
deleted file mode 100644
index fdef900..0000000
--- a/third_party/blink/renderer/core/feature_policy/feature_policy_parser_delegate.h
+++ /dev/null
@@ -1,23 +0,0 @@
-// Copyright 2019 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef THIRD_PARTY_BLINK_RENDERER_CORE_FEATURE_POLICY_FEATURE_POLICY_PARSER_DELEGATE_H_
-#define THIRD_PARTY_BLINK_RENDERER_CORE_FEATURE_POLICY_FEATURE_POLICY_PARSER_DELEGATE_H_
-
-#include "third_party/blink/public/mojom/feature_policy/feature_policy_feature.mojom-blink-forward.h"
-#include "third_party/blink/renderer/core/frame/web_feature_forward.h"
-#include "third_party/blink/renderer/platform/runtime_enabled_features.h"
-
-namespace blink {
-
-class FeaturePolicyParserDelegate : public FeatureContext {
- public:
-  virtual void CountFeaturePolicyUsage(mojom::WebFeature feature) = 0;
-  virtual bool FeaturePolicyFeatureObserved(
-      mojom::blink::FeaturePolicyFeature feature) = 0;
-};
-
-}  // namespace blink
-
-#endif  // THIRD_PARTY_BLINK_RENDERER_CORE_FEATURE_POLICY_FEATURE_POLICY_PARSER_DELEGATE_H_
diff --git a/third_party/blink/renderer/core/feature_policy/feature_policy_test.cc b/third_party/blink/renderer/core/feature_policy/feature_policy_test.cc
index e097d10..9d97418 100644
--- a/third_party/blink/renderer/core/feature_policy/feature_policy_test.cc
+++ b/third_party/blink/renderer/core/feature_policy/feature_policy_test.cc
@@ -104,9 +104,9 @@
       const String& feature_policy_header,
       scoped_refptr<const SecurityOrigin> origin,
       PolicyParserMessageBuffer& logger,
-      FeaturePolicyParserDelegate* delegate = nullptr) {
+      ExecutionContext* context = nullptr) {
     return FeaturePolicyParser::ParseHeader(
-        feature_policy_header, g_empty_string, origin, logger, delegate);
+        feature_policy_header, g_empty_string, origin, logger, context);
   }
 };
 
@@ -148,16 +148,15 @@
   }
 
  protected:
-  ParsedFeaturePolicy ParseFeaturePolicy(
-      const char* policy_string,
-      const char* self_origin_string,
-      const char* src_origin_string,
-      PolicyParserMessageBuffer& logger,
-      const FeatureNameMap& feature_names,
-      FeaturePolicyParserDelegate* delegate = nullptr) {
+  ParsedFeaturePolicy ParseFeaturePolicy(const char* policy_string,
+                                         const char* self_origin_string,
+                                         const char* src_origin_string,
+                                         PolicyParserMessageBuffer& logger,
+                                         const FeatureNameMap& feature_names,
+                                         ExecutionContext* context = nullptr) {
     return FeaturePolicyParser::ParseFeaturePolicyForTest(
         policy_string, SecurityOrigin::CreateFromString(self_origin_string),
-        GetSrcOrigin(src_origin_string), logger, feature_names, delegate);
+        GetSrcOrigin(src_origin_string), logger, feature_names, context);
   }
 
   ParsedFeaturePolicy ParsePermissionsPolicy(
@@ -166,10 +165,10 @@
       const char* src_origin_string,
       PolicyParserMessageBuffer& logger,
       const FeatureNameMap& feature_names,
-      FeaturePolicyParserDelegate* delegate = nullptr) {
+      ExecutionContext* context = nullptr) {
     return FeaturePolicyParser::ParsePermissionsPolicyForTest(
         policy_string, SecurityOrigin::CreateFromString(self_origin_string),
-        GetSrcOrigin(src_origin_string), logger, feature_names, delegate);
+        GetSrcOrigin(src_origin_string), logger, feature_names, context);
   }
 
   void CheckParsedPolicy(const ParsedFeaturePolicy& actual,
@@ -558,7 +557,7 @@
   CheckParsedPolicy(FeaturePolicyParser::ParseHeader(
                         "geolocation 'none', fullscreen 'self'",
                         "geolocation=self, payment=*", origin_a_.get(), logger,
-                        nullptr /* delegate */),
+                        nullptr /* context */),
                     {
                         {
                             mojom::blink::FeaturePolicyFeature::kGeolocation,
diff --git a/third_party/blink/renderer/core/frame/local_dom_window.cc b/third_party/blink/renderer/core/frame/local_dom_window.cc
index f14fba2..ea9c45d 100644
--- a/third_party/blink/renderer/core/frame/local_dom_window.cc
+++ b/third_party/blink/renderer/core/frame/local_dom_window.cc
@@ -32,10 +32,10 @@
 #include "cc/input/snap_selection_strategy.h"
 #include "net/base/registry_controlled_domains/registry_controlled_domain.h"
 #include "third_party/blink/public/common/browser_interface_broker_proxy.h"
+#include "third_party/blink/public/common/widget/screen_info.h"
 #include "third_party/blink/public/mojom/feature_policy/policy_disposition.mojom-blink.h"
 #include "third_party/blink/public/platform/platform.h"
 #include "third_party/blink/public/platform/task_type.h"
-#include "third_party/blink/public/platform/web_screen_info.h"
 #include "third_party/blink/renderer/bindings/core/v8/binding_security.h"
 #include "third_party/blink/renderer/bindings/core/v8/isolated_world_csp.h"
 #include "third_party/blink/renderer/bindings/core/v8/script_controller.h"
diff --git a/third_party/blink/renderer/core/frame/screen.cc b/third_party/blink/renderer/core/frame/screen.cc
index 4508bd28..1c461e7 100644
--- a/third_party/blink/renderer/core/frame/screen.cc
+++ b/third_party/blink/renderer/core/frame/screen.cc
@@ -28,9 +28,9 @@
 
 #include "third_party/blink/renderer/core/frame/screen.h"
 
-#include "third_party/blink/public/common/privacy_budget/identifiability_metrics.h"
 #include "third_party/blink/public/common/privacy_budget/identifiability_metric_builder.h"
-#include "third_party/blink/public/platform/web_screen_info.h"
+#include "third_party/blink/public/common/privacy_budget/identifiability_metrics.h"
+#include "third_party/blink/public/common/widget/screen_info.h"
 #include "third_party/blink/renderer/core/frame/local_dom_window.h"
 #include "third_party/blink/renderer/core/frame/local_frame.h"
 #include "third_party/blink/renderer/core/frame/local_frame_view.h"
@@ -43,7 +43,7 @@
 
 namespace {
 
-WebScreenInfo GetScreenInfo(LocalFrame& frame) {
+ScreenInfo GetScreenInfo(LocalFrame& frame) {
   return frame.GetChromeClient().GetScreenInfo(frame);
 }
 
@@ -61,7 +61,7 @@
     return 0;
   Page* page = frame->GetPage();
   if (page->GetSettings().GetReportScreenSizeInPhysicalPixelsQuirk()) {
-    WebScreenInfo screen_info = GetScreenInfo(*frame);
+    ScreenInfo screen_info = GetScreenInfo(*frame);
     return static_cast<int>(
         lroundf(screen_info.rect.height() * screen_info.device_scale_factor));
   }
@@ -78,7 +78,7 @@
     return 0;
   Page* page = frame->GetPage();
   if (page->GetSettings().GetReportScreenSizeInPhysicalPixelsQuirk()) {
-    WebScreenInfo screen_info = GetScreenInfo(*frame);
+    ScreenInfo screen_info = GetScreenInfo(*frame);
     return static_cast<int>(
         lroundf(screen_info.rect.width() * screen_info.device_scale_factor));
   }
@@ -110,7 +110,7 @@
     return 0;
   Page* page = frame->GetPage();
   if (page->GetSettings().GetReportScreenSizeInPhysicalPixelsQuirk()) {
-    WebScreenInfo screen_info = GetScreenInfo(*frame);
+    ScreenInfo screen_info = GetScreenInfo(*frame);
     return static_cast<int>(lroundf(screen_info.available_rect.x() *
                                     screen_info.device_scale_factor));
   }
@@ -127,7 +127,7 @@
     return 0;
   Page* page = frame->GetPage();
   if (page->GetSettings().GetReportScreenSizeInPhysicalPixelsQuirk()) {
-    WebScreenInfo screen_info = GetScreenInfo(*frame);
+    ScreenInfo screen_info = GetScreenInfo(*frame);
     return static_cast<int>(lroundf(screen_info.available_rect.y() *
                                     screen_info.device_scale_factor));
   }
@@ -144,7 +144,7 @@
     return 0;
   Page* page = frame->GetPage();
   if (page->GetSettings().GetReportScreenSizeInPhysicalPixelsQuirk()) {
-    WebScreenInfo screen_info = GetScreenInfo(*frame);
+    ScreenInfo screen_info = GetScreenInfo(*frame);
     return static_cast<int>(lroundf(screen_info.available_rect.height() *
                                     screen_info.device_scale_factor));
   }
@@ -161,7 +161,7 @@
     return 0;
   Page* page = frame->GetPage();
   if (page->GetSettings().GetReportScreenSizeInPhysicalPixelsQuirk()) {
-    WebScreenInfo screen_info = GetScreenInfo(*frame);
+    ScreenInfo screen_info = GetScreenInfo(*frame);
     return static_cast<int>(lroundf(screen_info.available_rect.width() *
                                     screen_info.device_scale_factor));
   }
@@ -194,7 +194,7 @@
     return 0;
   Page* page = frame->GetPage();
   if (page->GetSettings().GetReportScreenSizeInPhysicalPixelsQuirk()) {
-    WebScreenInfo screen_info = GetScreenInfo(*frame);
+    ScreenInfo screen_info = GetScreenInfo(*frame);
     return static_cast<int>(
         lroundf(screen_info.rect.x() * screen_info.device_scale_factor));
   }
@@ -211,7 +211,7 @@
     return 0;
   Page* page = frame->GetPage();
   if (page->GetSettings().GetReportScreenSizeInPhysicalPixelsQuirk()) {
-    WebScreenInfo screen_info = GetScreenInfo(*frame);
+    ScreenInfo screen_info = GetScreenInfo(*frame);
     return static_cast<int>(
         lroundf(screen_info.rect.y() * screen_info.device_scale_factor));
   }
diff --git a/third_party/blink/renderer/core/html/media/html_media_element.cc b/third_party/blink/renderer/core/html/media/html_media_element.cc
index 7a767d8..082c52f 100644
--- a/third_party/blink/renderer/core/html/media/html_media_element.cc
+++ b/third_party/blink/renderer/core/html/media/html_media_element.cc
@@ -37,6 +37,7 @@
 #include "base/time/time.h"
 #include "media/base/logging_override_if_enabled.h"
 #include "media/base/media_switches.h"
+#include "third_party/blink/public/common/widget/screen_info.h"
 #include "third_party/blink/public/platform/modules/mediastream/web_media_stream.h"
 #include "third_party/blink/public/platform/modules/remoteplayback/web_remote_playback_client.h"
 #include "third_party/blink/public/platform/platform.h"
@@ -46,7 +47,6 @@
 #include "third_party/blink/public/platform/web_inband_text_track.h"
 #include "third_party/blink/public/platform/web_media_player.h"
 #include "third_party/blink/public/platform/web_media_player_source.h"
-#include "third_party/blink/public/platform/web_screen_info.h"
 #include "third_party/blink/renderer/bindings/core/v8/script_controller.h"
 #include "third_party/blink/renderer/bindings/core/v8/script_event_listener.h"
 #include "third_party/blink/renderer/bindings/core/v8/script_promise_resolver.h"
diff --git a/third_party/blink/renderer/core/imagebitmap/image_bitmap.cc b/third_party/blink/renderer/core/imagebitmap/image_bitmap.cc
index da3904bf..93566ba 100644
--- a/third_party/blink/renderer/core/imagebitmap/image_bitmap.cc
+++ b/third_party/blink/renderer/core/imagebitmap/image_bitmap.cc
@@ -6,12 +6,12 @@
 
 #include <memory>
 #include <utility>
+
 #include "base/memory/scoped_refptr.h"
 #include "base/numerics/checked_math.h"
 #include "base/numerics/clamped_math.h"
 #include "base/single_thread_task_runner.h"
 #include "gpu/command_buffer/client/shared_image_interface.h"
-#include "third_party/blink/public/common/features.h"
 #include "third_party/blink/renderer/core/dom/dom_exception.h"
 #include "third_party/blink/renderer/core/html/canvas/html_canvas_element.h"
 #include "third_party/blink/renderer/core/html/canvas/image_data.h"
@@ -20,7 +20,6 @@
 #include "third_party/blink/renderer/platform/graphics/accelerated_static_bitmap_image.h"
 #include "third_party/blink/renderer/platform/graphics/canvas_color_params.h"
 #include "third_party/blink/renderer/platform/graphics/canvas_resource_provider.h"
-#include "third_party/blink/renderer/platform/graphics/gpu/shared_gpu_context.h"
 #include "third_party/blink/renderer/platform/graphics/skia/skia_utils.h"
 #include "third_party/blink/renderer/platform/graphics/unaccelerated_static_bitmap_image.h"
 #include "third_party/blink/renderer/platform/heap/heap.h"
@@ -248,31 +247,6 @@
       size, kLow_SkFilterQuality, color_params);
 }
 
-std::unique_ptr<CanvasResourceProvider> CreateProviderForVideoElement(
-    HTMLVideoElement* video,
-    const ImageBitmapOptions* options) {
-  // TODO(crbug.com/1098445): ImageBitmap resize test case failed when
-  // quality equals to "low" and "medium". Need further investigate to
-  // enable gpu backed imageBitmap with resize options.
-  if (!SharedGpuContext::ContextProviderWrapper() ||
-      options->hasResizeWidth() || options->hasResizeHeight()) {
-    return CanvasResourceProvider::CreateBitmapProvider(
-        IntSize(video->videoWidth(), video->videoHeight()),
-        kLow_SkFilterQuality, CanvasColorParams());
-  }
-
-  uint32_t shared_image_usage_flags = gpu::SHARED_IMAGE_USAGE_DISPLAY;
-
-  return CanvasResourceProvider::CreateSharedImageProvider(
-      IntSize(video->videoWidth(), video->videoHeight()),
-      SharedGpuContext::ContextProviderWrapper(), kLow_SkFilterQuality,
-      CanvasColorParams(CanvasColorSpace::kSRGB,
-                        CanvasColorParams::GetNativeCanvasPixelFormat(),
-                        kNonOpaque),  // Default canvas settings
-      false,  // Origin of GL texture is bottom left on screen
-      RasterMode::kGPU, shared_image_usage_flags);
-}
-
 scoped_refptr<StaticBitmapImage> FlipImageVertically(
     scoped_refptr<StaticBitmapImage> input,
     const ImageBitmap::ParsedOptions& parsed_options) {
@@ -671,8 +645,12 @@
   if (DstBufferSizeHasOverflow(parsed_options))
     return;
 
+  // TODO(fserb): this shouldn't be software?
   std::unique_ptr<CanvasResourceProvider> resource_provider =
-      CreateProviderForVideoElement(video, options);
+      CanvasResourceProvider::CreateBitmapProvider(
+          IntSize(video->videoWidth(), video->videoHeight()),
+          kLow_SkFilterQuality,
+          CanvasColorParams());  // TODO: set color space here to avoid clamping
 
   if (!resource_provider)
     return;
diff --git a/third_party/blink/renderer/core/input/mouse_event_manager.cc b/third_party/blink/renderer/core/input/mouse_event_manager.cc
index db5d6de..0d730f390 100644
--- a/third_party/blink/renderer/core/input/mouse_event_manager.cc
+++ b/third_party/blink/renderer/core/input/mouse_event_manager.cc
@@ -5,9 +5,9 @@
 #include "third_party/blink/renderer/core/input/mouse_event_manager.h"
 
 #include "build/build_config.h"
+#include "third_party/blink/public/common/widget/screen_info.h"
 #include "third_party/blink/public/mojom/input/focus_type.mojom-blink.h"
 #include "third_party/blink/public/platform/task_type.h"
-#include "third_party/blink/public/platform/web_screen_info.h"
 #include "third_party/blink/renderer/bindings/core/v8/v8_drag_event_init.h"
 #include "third_party/blink/renderer/bindings/core/v8/v8_pointer_event_init.h"
 #include "third_party/blink/renderer/core/clipboard/data_object.h"
diff --git a/third_party/blink/renderer/core/inspector/inspector_page_agent.cc b/third_party/blink/renderer/core/inspector/inspector_page_agent.cc
index 19bd9561..42b8631 100644
--- a/third_party/blink/renderer/core/inspector/inspector_page_agent.cc
+++ b/third_party/blink/renderer/core/inspector/inspector_page_agent.cc
@@ -34,7 +34,7 @@
 
 #include "base/containers/span.h"
 #include "build/build_config.h"
-#include "third_party/blink/public/platform/web_screen_info.h"
+#include "third_party/blink/public/common/widget/screen_info.h"
 #include "third_party/blink/renderer/bindings/core/v8/script_controller.h"
 #include "third_party/blink/renderer/bindings/core/v8/script_regexp.h"
 #include "third_party/blink/renderer/bindings/core/v8/script_source_code.h"
diff --git a/third_party/blink/renderer/core/layout/layout_view.cc b/third_party/blink/renderer/core/layout/layout_view.cc
index fe87dd1..7b7ed93 100644
--- a/third_party/blink/renderer/core/layout/layout_view.cc
+++ b/third_party/blink/renderer/core/layout/layout_view.cc
@@ -25,9 +25,9 @@
 
 #include "build/build_config.h"
 #include "third_party/blink/public/common/features.h"
+#include "third_party/blink/public/common/widget/screen_info.h"
 #include "third_party/blink/public/mojom/scroll/scrollbar_mode.mojom-blink.h"
 #include "third_party/blink/public/platform/platform.h"
-#include "third_party/blink/public/platform/web_screen_info.h"
 #include "third_party/blink/renderer/core/dom/document.h"
 #include "third_party/blink/renderer/core/dom/element.h"
 #include "third_party/blink/renderer/core/editing/frame_selection.h"
diff --git a/third_party/blink/renderer/core/loader/document_loader.cc b/third_party/blink/renderer/core/loader/document_loader.cc
index 6f01332d..50c01cb6 100644
--- a/third_party/blink/renderer/core/loader/document_loader.cc
+++ b/third_party/blink/renderer/core/loader/document_loader.cc
@@ -1698,15 +1698,18 @@
   frame_->DomWindow()->GetSecurityContext().SetContentSecurityPolicy(
       content_security_policy_.Get());
   frame_->DomWindow()->GetSecurityContext().ApplySandboxFlags(sandbox_flags);
+  // Conceptually, SecurityOrigin doesn't have to be initialized after sandbox
+  // flags are applied, but there's a UseCounter in SetSecurityOrigin() that
+  // wants to inspect sandbox flags.
   frame_->DomWindow()->GetSecurityContext().SetSecurityOrigin(
       std::move(security_origin));
+  // Requires SecurityOrigin to be initialized.
+  OriginTrialContext::AddTokensFromHeader(
+      frame_->DomWindow(), response_.HttpHeaderField(http_names::kOriginTrial));
 
   SecurityContextInit security_init(frame_->DomWindow());
-  security_init.InitializeOriginTrials(
-      response_.HttpHeaderField(http_names::kOriginTrial));
-
-  frame_->DomWindow()->Initialize(security_init);
-
+  // FeaturePolicy and DocumentPolicy require SecurityOrigin and origin trials
+  // to be initialized.
   // TODO(iclelland): Add Feature-Policy-Report-Only to Origin Policy.
   security_init.ApplyFeaturePolicy(frame_.Get(), response_, origin_policy_,
                                    frame_policy_);
diff --git a/third_party/blink/renderer/core/loader/empty_clients.h b/third_party/blink/renderer/core/loader/empty_clients.h
index 36a26e3..b8f6b81 100644
--- a/third_party/blink/renderer/core/loader/empty_clients.h
+++ b/third_party/blink/renderer/core/loader/empty_clients.h
@@ -39,9 +39,9 @@
 #include "third_party/blink/public/common/browser_interface_broker_proxy.h"
 #include "third_party/blink/public/common/input/web_menu_source_type.h"
 #include "third_party/blink/public/common/user_agent/user_agent_metadata.h"
+#include "third_party/blink/public/common/widget/screen_info.h"
 #include "third_party/blink/public/mojom/input/focus_type.mojom-blink-forward.h"
 #include "third_party/blink/public/platform/platform.h"
-#include "third_party/blink/public/platform/web_screen_info.h"
 #include "third_party/blink/public/platform/web_spell_check_panel_host_client.h"
 #include "third_party/blink/public/platform/web_url_loader.h"
 #include "third_party/blink/renderer/core/core_export.h"
@@ -171,9 +171,7 @@
   float WindowToViewportScalar(LocalFrame*, const float s) const override {
     return s;
   }
-  WebScreenInfo GetScreenInfo(LocalFrame&) const override {
-    return WebScreenInfo();
-  }
+  ScreenInfo GetScreenInfo(LocalFrame&) const override { return ScreenInfo(); }
   void ContentsSizeChanged(LocalFrame*, const IntSize&) const override {}
   void ShowMouseOverURL(const HitTestResult&) override {}
   void SetToolTip(LocalFrame&, const String&, TextDirection) override {}
diff --git a/third_party/blink/renderer/core/origin_trials/origin_trial_context.cc b/third_party/blink/renderer/core/origin_trials/origin_trial_context.cc
index dad79f31..ff9ae0c 100644
--- a/third_party/blink/renderer/core/origin_trials/origin_trial_context.cc
+++ b/third_party/blink/renderer/core/origin_trials/origin_trial_context.cc
@@ -131,17 +131,13 @@
 
 }  // namespace
 
-OriginTrialContext::OriginTrialContext()
-    : OriginTrialContext(TrialTokenValidator::Policy()
-                             ? std::make_unique<TrialTokenValidator>()
-                             : nullptr) {}
+OriginTrialContext::OriginTrialContext(ExecutionContext* context)
+    : trial_token_validator_(std::make_unique<TrialTokenValidator>()),
+      context_(context) {}
 
-OriginTrialContext::OriginTrialContext(
-    std::unique_ptr<TrialTokenValidator> validator)
-    : trial_token_validator_(std::move(validator)) {}
-
-void OriginTrialContext::BindExecutionContext(ExecutionContext* context) {
-  context_ = context;
+void OriginTrialContext::SetTrialTokenValidatorForTesting(
+    std::unique_ptr<TrialTokenValidator> validator) {
+  trial_token_validator_ = std::move(validator);
 }
 
 // static
@@ -267,19 +263,13 @@
 }
 
 void OriginTrialContext::AddTokens(const Vector<String>& tokens) {
-  AddTokens(tokens, GetSecurityOrigin(), IsSecureContext());
-}
-
-void OriginTrialContext::AddTokens(const Vector<String>& tokens,
-                                   const SecurityOrigin* origin,
-                                   bool is_secure) {
   if (tokens.IsEmpty())
     return;
   bool found_valid = false;
   for (const String& token : tokens) {
     if (!token.IsEmpty()) {
       tokens_.push_back(token);
-      if (EnableTrialFromToken(origin, is_secure, token))
+      if (EnableTrialFromToken(GetSecurityOrigin(), IsSecureContext(), token))
         found_valid = true;
     }
   }
@@ -304,7 +294,11 @@
   if (!enabled_features_.size() && !navigation_activated_features_.size())
     return;
   auto* window = DynamicTo<LocalDOMWindow>(context_.Get());
-  if (!window)
+  // Normally, LocalDOMWindow::document() doesn't need to be null-checked.
+  // However, this is a rare function that can get called between when the
+  // LocalDOMWindow is constructed and the Document is installed. We are not
+  // ready for script in that case, so bail out.
+  if (!window || !window->document())
     return;
   LocalFrame* frame = window->GetFrame();
   if (!frame)
diff --git a/third_party/blink/renderer/core/origin_trials/origin_trial_context.h b/third_party/blink/renderer/core/origin_trials/origin_trial_context.h
index 9db5536..564cc96 100644
--- a/third_party/blink/renderer/core/origin_trials/origin_trial_context.h
+++ b/third_party/blink/renderer/core/origin_trials/origin_trial_context.h
@@ -36,10 +36,9 @@
 class CORE_EXPORT OriginTrialContext final
     : public GarbageCollected<OriginTrialContext> {
  public:
-  OriginTrialContext();
-  explicit OriginTrialContext(std::unique_ptr<TrialTokenValidator> validator);
+  explicit OriginTrialContext(ExecutionContext*);
 
-  void BindExecutionContext(ExecutionContext*);
+  void SetTrialTokenValidatorForTesting(std::unique_ptr<TrialTokenValidator>);
 
   // Parses an Origin-Trial header as specified in
   // https://jpchase.github.io/OriginTrials/#header into individual tokens.
@@ -79,9 +78,6 @@
   void AddTokenFromExternalScript(const String& token,
                                   const SecurityOrigin* origin);
   void AddTokens(const Vector<String>& tokens);
-  void AddTokens(const Vector<String>& tokens,
-                 const SecurityOrigin* origin,
-                 bool is_secure);
 
   void ActivateNavigationFeaturesFromInitiator(
       const Vector<OriginTrialFeature>& features);
diff --git a/third_party/blink/renderer/core/origin_trials/origin_trial_context_test.cc b/third_party/blink/renderer/core/origin_trials/origin_trial_context_test.cc
index 37494a2..4a30016 100644
--- a/third_party/blink/renderer/core/origin_trials/origin_trial_context_test.cc
+++ b/third_party/blink/renderer/core/origin_trials/origin_trial_context_test.cc
@@ -87,10 +87,12 @@
  protected:
   OriginTrialContextTest()
       : token_validator_(new MockTokenValidator),
-        execution_context_(MakeGarbageCollected<NullExecutionContext>(
-            MakeGarbageCollected<OriginTrialContext>(
-                std::unique_ptr<MockTokenValidator>(token_validator_)))),
-        histogram_tester_(new HistogramTester()) {}
+        execution_context_(MakeGarbageCollected<NullExecutionContext>()),
+        histogram_tester_(new HistogramTester()) {
+    execution_context_->GetOriginTrialContext()
+        ->SetTrialTokenValidatorForTesting(
+            std::unique_ptr<MockTokenValidator>(token_validator_));
+  }
 
   MockTokenValidator* TokenValidator() { return token_validator_; }
 
diff --git a/third_party/blink/renderer/core/page/chrome_client.cc b/third_party/blink/renderer/core/page/chrome_client.cc
index a7f609c..0255ff5 100644
--- a/third_party/blink/renderer/core/page/chrome_client.cc
+++ b/third_party/blink/renderer/core/page/chrome_client.cc
@@ -23,9 +23,9 @@
 
 #include <algorithm>
 
+#include "third_party/blink/public/common/widget/screen_info.h"
 #include "third_party/blink/public/platform/platform.h"
 #include "third_party/blink/public/platform/web_prescient_networking.h"
-#include "third_party/blink/public/platform/web_screen_info.h"
 #include "third_party/blink/renderer/core/core_initializer.h"
 #include "third_party/blink/renderer/core/dom/document.h"
 #include "third_party/blink/renderer/core/dom/element.h"
diff --git a/third_party/blink/renderer/core/page/chrome_client.h b/third_party/blink/renderer/core/page/chrome_client.h
index 7079dcd..36bd39a 100644
--- a/third_party/blink/renderer/core/page/chrome_client.h
+++ b/third_party/blink/renderer/core/page/chrome_client.h
@@ -103,7 +103,7 @@
 struct FrameLoadRequest;
 struct WebTextAutosizerPageInfo;
 struct ViewportDescription;
-struct WebScreenInfo;
+struct ScreenInfo;
 struct WebWindowFeatures;
 struct WebRect;
 
@@ -265,7 +265,7 @@
                             String& result);
   virtual bool TabsToLinks() = 0;
 
-  virtual WebScreenInfo GetScreenInfo(LocalFrame& frame) const = 0;
+  virtual ScreenInfo GetScreenInfo(LocalFrame& frame) const = 0;
   virtual void SetCursor(const ui::Cursor&, LocalFrame* local_root) = 0;
 
   virtual void SetCursorOverridden(bool) = 0;
diff --git a/third_party/blink/renderer/core/page/chrome_client_impl.cc b/third_party/blink/renderer/core/page/chrome_client_impl.cc
index 6e27ed1..f2f0220 100644
--- a/third_party/blink/renderer/core/page/chrome_client_impl.cc
+++ b/third_party/blink/renderer/core/page/chrome_client_impl.cc
@@ -486,7 +486,7 @@
       viewport_rect);
 }
 
-WebScreenInfo ChromeClientImpl::GetScreenInfo(LocalFrame& frame) const {
+ScreenInfo ChromeClientImpl::GetScreenInfo(LocalFrame& frame) const {
   WebWidgetClient* client = frame.GetWidgetForLocalRoot()->Client();
   DCHECK(client);
   return client->GetScreenInfo();
diff --git a/third_party/blink/renderer/core/page/chrome_client_impl.h b/third_party/blink/renderer/core/page/chrome_client_impl.h
index fce5a33..a41b037 100644
--- a/third_party/blink/renderer/core/page/chrome_client_impl.h
+++ b/third_party/blink/renderer/core/page/chrome_client_impl.h
@@ -136,7 +136,7 @@
   float WindowToViewportScalar(LocalFrame*, const float) const override;
   void WindowToViewportRect(LocalFrame& frame,
                             WebFloatRect* viewport_rect) const override;
-  WebScreenInfo GetScreenInfo(LocalFrame&) const override;
+  ScreenInfo GetScreenInfo(LocalFrame&) const override;
   void OverrideVisibleRectForMainFrame(LocalFrame& frame,
                                        IntRect* paint_rect) const override;
   float InputEventsScaleForEmulation() const override;
diff --git a/third_party/blink/renderer/core/page/drag_controller.cc b/third_party/blink/renderer/core/page/drag_controller.cc
index 204fc7cb..30a8e9f 100644
--- a/third_party/blink/renderer/core/page/drag_controller.cc
+++ b/third_party/blink/renderer/core/page/drag_controller.cc
@@ -31,9 +31,9 @@
 #include "base/memory/scoped_refptr.h"
 #include "build/build_config.h"
 #include "third_party/blink/public/common/page/web_drag_operation.h"
+#include "third_party/blink/public/common/widget/screen_info.h"
 #include "third_party/blink/public/platform/web_common.h"
 #include "third_party/blink/public/platform/web_drag_data.h"
-#include "third_party/blink/public/platform/web_screen_info.h"
 #include "third_party/blink/renderer/core/clipboard/data_object.h"
 #include "third_party/blink/renderer/core/clipboard/data_transfer.h"
 #include "third_party/blink/renderer/core/clipboard/data_transfer_access_policy.h"
diff --git a/third_party/blink/renderer/core/page/touch_adjustment.cc b/third_party/blink/renderer/core/page/touch_adjustment.cc
index e5d95d4..81de43b 100644
--- a/third_party/blink/renderer/core/page/touch_adjustment.cc
+++ b/third_party/blink/renderer/core/page/touch_adjustment.cc
@@ -19,7 +19,7 @@
 
 #include "third_party/blink/renderer/core/page/touch_adjustment.h"
 
-#include "third_party/blink/public/platform/web_screen_info.h"
+#include "third_party/blink/public/common/widget/screen_info.h"
 #include "third_party/blink/renderer/core/dom/container_node.h"
 #include "third_party/blink/renderer/core/dom/node.h"
 #include "third_party/blink/renderer/core/dom/node_computed_style.h"
diff --git a/third_party/blink/renderer/core/page/touch_adjustment_test.cc b/third_party/blink/renderer/core/page/touch_adjustment_test.cc
index ff53ce8..5ec652f 100644
--- a/third_party/blink/renderer/core/page/touch_adjustment_test.cc
+++ b/third_party/blink/renderer/core/page/touch_adjustment_test.cc
@@ -5,7 +5,7 @@
 #include "third_party/blink/renderer/core/page/touch_adjustment.h"
 
 #include "testing/gtest/include/gtest/gtest.h"
-#include "third_party/blink/public/platform/web_screen_info.h"
+#include "third_party/blink/public/common/widget/screen_info.h"
 #include "third_party/blink/renderer/core/testing/core_unit_test_helper.h"
 
 namespace blink {
@@ -20,12 +20,10 @@
     screen_info_.device_scale_factor = device_scale_factor;
   }
 
-  WebScreenInfo GetScreenInfo(LocalFrame&) const override {
-    return screen_info_;
-  }
+  ScreenInfo GetScreenInfo(LocalFrame&) const override { return screen_info_; }
 
  private:
-  WebScreenInfo screen_info_;
+  ScreenInfo screen_info_;
 };
 
 }  // namespace
diff --git a/third_party/blink/renderer/core/scheduler_integration_tests/throttling_test.cc b/third_party/blink/renderer/core/scheduler_integration_tests/throttling_test.cc
index a3778fa..3bff32d 100644
--- a/third_party/blink/renderer/core/scheduler_integration_tests/throttling_test.cc
+++ b/third_party/blink/renderer/core/scheduler_integration_tests/throttling_test.cc
@@ -125,7 +125,7 @@
     constexpr auto kTimeUntilNextCheck = base::TimeDelta::FromSeconds(30);
     platform_->RunForPeriod(kTimeUntilNextCheck);
 
-    // Tasks are not throttled beyond the default backgroynd throttling behavior
+    // Tasks are not throttled beyond the default background throttling behavior
     // nor do they get to run more often.
     Vector<String> expected_ouput(
         kTimeUntilNextCheck / kDefaultThrottledWakeUpInterval,
diff --git a/third_party/blink/renderer/core/svg/animation/svg_smil_element.cc b/third_party/blink/renderer/core/svg/animation/svg_smil_element.cc
index 2d308d7c..4d39e27 100644
--- a/third_party/blink/renderer/core/svg/animation/svg_smil_element.cc
+++ b/third_party/blink/renderer/core/svg/animation/svg_smil_element.cc
@@ -345,7 +345,7 @@
 SMILTime SVGSMILElement::ParseOffsetValue(const String& data) {
   bool ok;
   double result = 0;
-  String parse = data.StripWhiteSpace();
+  const String parse = data.StripWhiteSpace();
   if (parse.EndsWith('h')) {
     result = parse.Left(parse.length() - 1).ToDouble(&ok) *
              base::Time::kSecondsPerHour;
@@ -360,9 +360,7 @@
   } else {
     result = parse.ToDouble(&ok);
   }
-  if (!ok)
-    return SMILTime::Unresolved();
-  return SMILTime::FromSecondsD(result);
+  return ok ? SMILTime::FromSecondsD(result) : SMILTime::Unresolved();
 }
 
 SMILTime SVGSMILElement::ParseClockValue(const String& data) {
@@ -1042,7 +1040,7 @@
       simple_time = simple_time - SMILTime::Epsilon();
     } else {
       simple_time = simple_duration;
-      repeat--;
+      --repeat;
     }
   } else {
     repeat = active_time / simple_duration;
diff --git a/third_party/blink/renderer/core/testing/null_execution_context.cc b/third_party/blink/renderer/core/testing/null_execution_context.cc
index 28c97fd..5545bde8 100644
--- a/third_party/blink/renderer/core/testing/null_execution_context.cc
+++ b/third_party/blink/renderer/core/testing/null_execution_context.cc
@@ -11,22 +11,18 @@
 #include "third_party/blink/renderer/core/execution_context/security_context_init.h"
 #include "third_party/blink/renderer/core/frame/csp/content_security_policy.h"
 #include "third_party/blink/renderer/core/frame/dom_timer.h"
-#include "third_party/blink/renderer/core/origin_trials/origin_trial_context.h"
 #include "third_party/blink/renderer/platform/scheduler/public/dummy_schedulers.h"
 #include "third_party/blink/renderer/platform/scheduler/public/frame_scheduler.h"
 #include "third_party/blink/renderer/platform/scheduler/public/thread.h"
 
 namespace blink {
 
-NullExecutionContext::NullExecutionContext(
-    OriginTrialContext* origin_trial_context)
+NullExecutionContext::NullExecutionContext()
     : ExecutionContext(
           v8::Isolate::GetCurrent(),
           MakeGarbageCollected<Agent>(v8::Isolate::GetCurrent(),
                                       base::UnguessableToken::Null())),
-      scheduler_(scheduler::CreateDummyFrameScheduler()) {
-  Initialize(SecurityContextInit(origin_trial_context));
-}
+      scheduler_(scheduler::CreateDummyFrameScheduler()) {}
 
 NullExecutionContext::~NullExecutionContext() {}
 
diff --git a/third_party/blink/renderer/core/testing/null_execution_context.h b/third_party/blink/renderer/core/testing/null_execution_context.h
index 79d5c9f..01753b1c 100644
--- a/third_party/blink/renderer/core/testing/null_execution_context.h
+++ b/third_party/blink/renderer/core/testing/null_execution_context.h
@@ -21,7 +21,7 @@
   USING_GARBAGE_COLLECTED_MIXIN(NullExecutionContext);
 
  public:
-  NullExecutionContext(OriginTrialContext* origin_trial_context = nullptr);
+  NullExecutionContext();
   ~NullExecutionContext() override;
 
   void SetURL(const KURL& url) { url_ = url; }
diff --git a/third_party/blink/renderer/core/workers/worker_or_worklet_global_scope.cc b/third_party/blink/renderer/core/workers/worker_or_worklet_global_scope.cc
index f749c79..ec1ce29b 100644
--- a/third_party/blink/renderer/core/workers/worker_or_worklet_global_scope.cc
+++ b/third_party/blink/renderer/core/workers/worker_or_worklet_global_scope.cc
@@ -14,7 +14,6 @@
 #include "third_party/blink/renderer/bindings/core/v8/worker_or_worklet_script_controller.h"
 #include "third_party/blink/renderer/core/dom/events/event_queue.h"
 #include "third_party/blink/renderer/core/execution_context/agent.h"
-#include "third_party/blink/renderer/core/execution_context/security_context_init.h"
 #include "third_party/blink/renderer/core/frame/deprecation.h"
 #include "third_party/blink/renderer/core/inspector/console_message.h"
 #include "third_party/blink/renderer/core/loader/loader_factory_for_worker.h"
@@ -200,7 +199,6 @@
       v8_cache_options_(v8_cache_options),
       reporting_proxy_(reporting_proxy) {
   GetSecurityContext().SetSecurityOrigin(std::move(origin));
-  Initialize(SecurityContextInit(MakeGarbageCollected<OriginTrialContext>()));
   if (worker_clients_)
     worker_clients_->ReattachThread();
 }
diff --git a/third_party/blink/renderer/modules/media_controls/elements/media_control_timeline_element.cc b/third_party/blink/renderer/modules/media_controls/elements/media_control_timeline_element.cc
index b9a431f..51e5a29 100644
--- a/third_party/blink/renderer/modules/media_controls/elements/media_control_timeline_element.cc
+++ b/third_party/blink/renderer/modules/media_controls/elements/media_control_timeline_element.cc
@@ -4,8 +4,8 @@
 
 #include "third_party/blink/renderer/modules/media_controls/elements/media_control_timeline_element.h"
 
+#include "third_party/blink/public/common/widget/screen_info.h"
 #include "third_party/blink/public/platform/platform.h"
-#include "third_party/blink/public/platform/web_screen_info.h"
 #include "third_party/blink/public/strings/grit/blink_strings.h"
 #include "third_party/blink/renderer/core/dom/events/event.h"
 #include "third_party/blink/renderer/core/dom/shadow_root.h"
diff --git a/third_party/blink/renderer/modules/media_controls/media_controls_impl_test.cc b/third_party/blink/renderer/modules/media_controls/media_controls_impl_test.cc
index a8236e1..a7180dc4 100644
--- a/third_party/blink/renderer/modules/media_controls/media_controls_impl_test.cc
+++ b/third_party/blink/renderer/modules/media_controls/media_controls_impl_test.cc
@@ -10,10 +10,10 @@
 #include "build/build_config.h"
 #include "testing/gtest/include/gtest/gtest.h"
 #include "third_party/blink/public/common/input/web_mouse_event.h"
+#include "third_party/blink/public/common/widget/screen_info.h"
 #include "third_party/blink/public/mojom/input/focus_type.mojom-blink.h"
 #include "third_party/blink/public/mojom/widget/screen_orientation.mojom-blink.h"
 #include "third_party/blink/public/platform/modules/remoteplayback/web_remote_playback_client.h"
-#include "third_party/blink/public/platform/web_screen_info.h"
 #include "third_party/blink/public/platform/web_size.h"
 #include "third_party/blink/renderer/bindings/core/v8/v8_gc_controller.h"
 #include "third_party/blink/renderer/core/css/css_property_value_set.h"
@@ -67,8 +67,8 @@
 class FakeChromeClient : public EmptyChromeClient {
  public:
   // ChromeClient overrides.
-  WebScreenInfo GetScreenInfo(LocalFrame&) const override {
-    WebScreenInfo screen_info;
+  ScreenInfo GetScreenInfo(LocalFrame&) const override {
+    ScreenInfo screen_info;
     screen_info.orientation_type =
         mojom::blink::ScreenOrientation::kLandscapePrimary;
     return screen_info;
diff --git a/third_party/blink/renderer/modules/media_controls/media_controls_orientation_lock_delegate.cc b/third_party/blink/renderer/modules/media_controls/media_controls_orientation_lock_delegate.cc
index df0524e..eb35d37 100644
--- a/third_party/blink/renderer/modules/media_controls/media_controls_orientation_lock_delegate.cc
+++ b/third_party/blink/renderer/modules/media_controls/media_controls_orientation_lock_delegate.cc
@@ -8,8 +8,8 @@
 
 #include "build/build_config.h"
 #include "third_party/blink/public/common/thread_safe_browser_interface_broker_proxy.h"
+#include "third_party/blink/public/common/widget/screen_info.h"
 #include "third_party/blink/public/platform/task_type.h"
-#include "third_party/blink/public/platform/web_screen_info.h"
 #include "third_party/blink/renderer/core/dom/events/event.h"
 #include "third_party/blink/renderer/core/frame/local_dom_window.h"
 #include "third_party/blink/renderer/core/frame/screen.h"
diff --git a/third_party/blink/renderer/modules/media_controls/media_controls_orientation_lock_delegate_test.cc b/third_party/blink/renderer/modules/media_controls/media_controls_orientation_lock_delegate_test.cc
index 581701b..2c0f92b 100644
--- a/third_party/blink/renderer/modules/media_controls/media_controls_orientation_lock_delegate_test.cc
+++ b/third_party/blink/renderer/modules/media_controls/media_controls_orientation_lock_delegate_test.cc
@@ -133,7 +133,7 @@
         WTF::Bind(DidExitFullscreen, WrapPersistent(frame.GetDocument())));
   }
 
-  MOCK_CONST_METHOD1(GetScreenInfo, WebScreenInfo(LocalFrame&));
+  MOCK_CONST_METHOD1(GetScreenInfo, ScreenInfo(LocalFrame&));
 
   MockScreenOrientation& ScreenOrientationClient() {
     return mock_screen_orientation_;
@@ -365,7 +365,7 @@
   // Calls must be wrapped in ASSERT_NO_FATAL_FAILURE.
   void RotateScreenTo(mojom::blink::ScreenOrientation screen_orientation_type,
                       uint16_t screen_orientation_angle) {
-    WebScreenInfo screen_info;
+    ScreenInfo screen_info;
     screen_info.orientation_type = screen_orientation_type;
     screen_info.orientation_angle = screen_orientation_angle;
     screen_info.rect = ScreenRectFromAngle(screen_orientation_angle);
@@ -587,7 +587,7 @@
             ComputeOrientationLock());
 
   // 100x100 has more subtilities, it depends on the current screen orientation.
-  WebScreenInfo screen_info;
+  ScreenInfo screen_info;
   screen_info.orientation_type = mojom::blink::ScreenOrientation::kUndefined;
   EXPECT_CALL(ChromeClient(), GetScreenInfo(_))
       .Times(1)
diff --git a/third_party/blink/renderer/modules/media_controls/media_controls_rotate_to_fullscreen_delegate.cc b/third_party/blink/renderer/modules/media_controls/media_controls_rotate_to_fullscreen_delegate.cc
index 3732ecc..9db7cf7f 100644
--- a/third_party/blink/renderer/modules/media_controls/media_controls_rotate_to_fullscreen_delegate.cc
+++ b/third_party/blink/renderer/modules/media_controls/media_controls_rotate_to_fullscreen_delegate.cc
@@ -4,9 +4,9 @@
 
 #include "third_party/blink/renderer/modules/media_controls/media_controls_rotate_to_fullscreen_delegate.h"
 
+#include "third_party/blink/public/common/widget/screen_info.h"
 #include "third_party/blink/public/mojom/widget/screen_orientation.mojom-blink.h"
 #include "third_party/blink/public/platform/platform.h"
-#include "third_party/blink/public/platform/web_screen_info.h"
 #include "third_party/blink/renderer/bindings/core/v8/v8_binding_for_core.h"
 #include "third_party/blink/renderer/core/dom/events/event.h"
 #include "third_party/blink/renderer/core/frame/local_dom_window.h"
diff --git a/third_party/blink/renderer/modules/media_controls/media_controls_rotate_to_fullscreen_delegate_test.cc b/third_party/blink/renderer/modules/media_controls/media_controls_rotate_to_fullscreen_delegate_test.cc
index bfbb9bb..f856ce4 100644
--- a/third_party/blink/renderer/modules/media_controls/media_controls_rotate_to_fullscreen_delegate_test.cc
+++ b/third_party/blink/renderer/modules/media_controls/media_controls_rotate_to_fullscreen_delegate_test.cc
@@ -72,7 +72,7 @@
     Fullscreen::DidExitFullscreen(*frame.GetDocument());
   }
 
-  MOCK_CONST_METHOD1(GetScreenInfo, WebScreenInfo(LocalFrame&));
+  MOCK_CONST_METHOD1(GetScreenInfo, ScreenInfo(LocalFrame&));
 };
 
 class StubLocalFrameClient : public EmptyLocalFrameClient {
@@ -190,7 +190,7 @@
     gfx::Size video_size,
     bool with_device_orientation /* = true */) {
   // Set initial screen orientation (called by `Attach` during `AppendChild`).
-  WebScreenInfo screen_info;
+  ScreenInfo screen_info;
   screen_info.orientation_type = initial_screen_orientation;
   EXPECT_CALL(GetChromeClient(), GetScreenInfo(_))
       .Times(AtLeast(1))
@@ -227,7 +227,7 @@
 
 void MediaControlsRotateToFullscreenDelegateTest::RotateTo(
     mojom::blink::ScreenOrientation new_screen_orientation) {
-  WebScreenInfo screen_info;
+  ScreenInfo screen_info;
   screen_info.orientation_type = new_screen_orientation;
   testing::Mock::VerifyAndClearExpectations(&GetChromeClient());
   EXPECT_CALL(GetChromeClient(), GetScreenInfo(_))
diff --git a/third_party/blink/renderer/modules/mediastream/user_media_client_test.cc b/third_party/blink/renderer/modules/mediastream/user_media_client_test.cc
index 3c84e73c..f53db188 100644
--- a/third_party/blink/renderer/modules/mediastream/user_media_client_test.cc
+++ b/third_party/blink/renderer/modules/mediastream/user_media_client_test.cc
@@ -19,12 +19,12 @@
 #include "mojo/public/cpp/bindings/receiver.h"
 #include "testing/gtest/include/gtest/gtest.h"
 #include "third_party/blink/public/common/mediastream/media_devices.h"
+#include "third_party/blink/public/common/widget/screen_info.h"
 #include "third_party/blink/public/mojom/mediastream/media_devices.mojom-blink.h"
 #include "third_party/blink/public/mojom/mediastream/media_stream.mojom-blink.h"
 #include "third_party/blink/public/platform/modules/mediastream/web_media_stream_source.h"
 #include "third_party/blink/public/platform/modules/mediastream/web_media_stream_track.h"
 #include "third_party/blink/public/platform/scheduler/test/renderer_scheduler_test_support.h"
-#include "third_party/blink/public/platform/web_screen_info.h"
 #include "third_party/blink/public/platform/web_string.h"
 #include "third_party/blink/public/platform/web_vector.h"
 #include "third_party/blink/public/web/modules/mediastream/web_media_stream_device_observer.h"
@@ -476,8 +476,8 @@
 
 class UserMediaChromeClient : public EmptyChromeClient {
  public:
-  WebScreenInfo GetScreenInfo(LocalFrame&) const override {
-    WebScreenInfo info;
+  ScreenInfo GetScreenInfo(LocalFrame&) const override {
+    ScreenInfo info;
     info.rect = gfx::Rect(blink::kDefaultScreenCastWidth,
                           blink::kDefaultScreenCastHeight);
     return info;
diff --git a/third_party/blink/renderer/modules/mediastream/user_media_processor.cc b/third_party/blink/renderer/modules/mediastream/user_media_processor.cc
index 3247d38..ea08baa 100644
--- a/third_party/blink/renderer/modules/mediastream/user_media_processor.cc
+++ b/third_party/blink/renderer/modules/mediastream/user_media_processor.cc
@@ -20,10 +20,10 @@
 #include "third_party/blink/public/common/browser_interface_broker_proxy.h"
 #include "third_party/blink/public/common/mediastream/media_stream_controls.h"
 #include "third_party/blink/public/common/mediastream/media_stream_request.h"
+#include "third_party/blink/public/common/widget/screen_info.h"
 #include "third_party/blink/public/platform/modules/mediastream/web_media_stream_source.h"
 #include "third_party/blink/public/platform/modules/mediastream/web_media_stream_track.h"
 #include "third_party/blink/public/platform/modules/webrtc/webrtc_logging.h"
-#include "third_party/blink/public/platform/web_screen_info.h"
 #include "third_party/blink/public/platform/web_string.h"
 #include "third_party/blink/public/platform/web_vector.h"
 #include "third_party/blink/public/web/modules/mediastream/web_media_stream_device_observer.h"
@@ -1046,8 +1046,7 @@
   gfx::Size screen_size(blink::kDefaultScreenCastWidth,
                         blink::kDefaultScreenCastHeight);
   if (frame_) {  // Can be null in tests.
-    blink::WebScreenInfo info =
-        frame_->GetChromeClient().GetScreenInfo(*frame_);
+    blink::ScreenInfo info = frame_->GetChromeClient().GetScreenInfo(*frame_);
     screen_size = info.rect.size();
   }
   return screen_size;
diff --git a/third_party/blink/renderer/modules/screen_orientation/screen_orientation_controller.cc b/third_party/blink/renderer/modules/screen_orientation/screen_orientation_controller.cc
index fe6df08..7a929ea 100644
--- a/third_party/blink/renderer/modules/screen_orientation/screen_orientation_controller.cc
+++ b/third_party/blink/renderer/modules/screen_orientation/screen_orientation_controller.cc
@@ -7,8 +7,8 @@
 #include <memory>
 #include <utility>
 #include "third_party/blink/public/common/associated_interfaces/associated_interface_provider.h"
+#include "third_party/blink/public/common/widget/screen_info.h"
 #include "third_party/blink/public/platform/task_type.h"
-#include "third_party/blink/public/platform/web_screen_info.h"
 #include "third_party/blink/renderer/core/dom/events/event.h"
 #include "third_party/blink/renderer/core/frame/local_dom_window.h"
 #include "third_party/blink/renderer/core/frame/local_frame.h"
@@ -101,7 +101,7 @@
   DCHECK(orientation_);
   DCHECK(GetPage());
   ChromeClient& chrome_client = GetPage()->GetChromeClient();
-  WebScreenInfo screen_info = chrome_client.GetScreenInfo(*GetFrame());
+  ScreenInfo screen_info = chrome_client.GetScreenInfo(*GetFrame());
   mojom::blink::ScreenOrientation orientation_type =
       screen_info.orientation_type;
   if (orientation_type == mojom::blink::ScreenOrientation::kUndefined) {
diff --git a/third_party/blink/renderer/modules/screen_orientation/screen_orientation_controller_test.cc b/third_party/blink/renderer/modules/screen_orientation/screen_orientation_controller_test.cc
index b79489d..58170bf 100644
--- a/third_party/blink/renderer/modules/screen_orientation/screen_orientation_controller_test.cc
+++ b/third_party/blink/renderer/modules/screen_orientation/screen_orientation_controller_test.cc
@@ -209,12 +209,12 @@
   ~ScreenInfoWebWidgetClient() override = default;
 
   // frame_test_helpers::TestWebWidgetClient:
-  WebScreenInfo GetScreenInfo() override { return screen_info_; }
+  ScreenInfo GetScreenInfo() override { return screen_info_; }
 
   void SetAngle(uint16_t angle) { screen_info_.orientation_angle = angle; }
 
  private:
-  WebScreenInfo screen_info_;
+  ScreenInfo screen_info_;
 };
 
 TEST_F(ScreenOrientationControllerTest, PageVisibilityCrash) {
diff --git a/third_party/blink/renderer/modules/sensor/sensor_proxy.cc b/third_party/blink/renderer/modules/sensor/sensor_proxy.cc
index 24b47d6..2de9bc06 100644
--- a/third_party/blink/renderer/modules/sensor/sensor_proxy.cc
+++ b/third_party/blink/renderer/modules/sensor/sensor_proxy.cc
@@ -4,9 +4,9 @@
 
 #include "third_party/blink/renderer/modules/sensor/sensor_proxy.h"
 
+#include "third_party/blink/public/common/widget/screen_info.h"
 #include "third_party/blink/public/platform/platform.h"
 #include "third_party/blink/public/platform/task_type.h"
-#include "third_party/blink/public/platform/web_screen_info.h"
 #include "third_party/blink/renderer/core/frame/local_frame.h"
 #include "third_party/blink/renderer/core/page/chrome_client.h"
 #include "third_party/blink/renderer/core/page/focus_controller.h"
diff --git a/third_party/blink/renderer/platform/exported/web_screen_info_test.cc b/third_party/blink/renderer/platform/exported/web_screen_info_test.cc
index 8ba3c25..5c565ad 100644
--- a/third_party/blink/renderer/platform/exported/web_screen_info_test.cc
+++ b/third_party/blink/renderer/platform/exported/web_screen_info_test.cc
@@ -2,15 +2,15 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "third_party/blink/public/platform/web_screen_info.h"
+#include "third_party/blink/public/common/widget/screen_info.h"
 
 #include "testing/gtest/include/gtest/gtest.h"
 
 namespace blink {
 
-TEST(WebScreenInfoTest, Equality) {
-  WebScreenInfo screen_info1;
-  WebScreenInfo screen_info2;
+TEST(ScreenInfoTest, Equality) {
+  ScreenInfo screen_info1;
+  ScreenInfo screen_info2;
 
   EXPECT_EQ(screen_info1, screen_info2);
 
diff --git a/third_party/blink/renderer/platform/fonts/font_custom_platform_data.cc b/third_party/blink/renderer/platform/fonts/font_custom_platform_data.cc
index 4069b17..212ae08c 100644
--- a/third_party/blink/renderer/platform/fonts/font_custom_platform_data.cc
+++ b/third_party/blink/renderer/platform/fonts/font_custom_platform_data.cc
@@ -77,13 +77,13 @@
   if (font_sub_type ==
           FontFormatCheck::VariableFontSubType::kVariableTrueType ||
       font_sub_type == FontFormatCheck::VariableFontSubType::kVariableCFF2) {
-    Vector<SkFontArguments::Axis, 0> axes;
+    Vector<SkFontArguments::VariationPosition::Coordinate, 0> variation;
 
-    SkFontArguments::Axis weight_axis = {
+    SkFontArguments::VariationPosition::Coordinate weight_coordinate = {
         SkSetFourByteTag('w', 'g', 'h', 't'),
         SkFloatToScalar(selection_capabilities.weight.clampToRange(
             selection_request.weight))};
-    SkFontArguments::Axis width_axis = {
+    SkFontArguments::VariationPosition::Coordinate width_coordinate = {
         SkSetFourByteTag('w', 'd', 't', 'h'),
         SkFloatToScalar(selection_capabilities.width.clampToRange(
             selection_request.width))};
@@ -92,35 +92,36 @@
     // values clockwise - in CSS positive values are clockwise rotations /
     // skew. See note in https://drafts.csswg.org/css-fonts/#font-style-prop -
     // map value from CSS to OpenType here.
-    SkFontArguments::Axis slant_axis = {
+    SkFontArguments::VariationPosition::Coordinate slant_coordinate = {
         SkSetFourByteTag('s', 'l', 'n', 't'),
         SkFloatToScalar(-selection_capabilities.slope.clampToRange(
             selection_request.slope))};
 
-    axes.push_back(weight_axis);
-    axes.push_back(width_axis);
-    axes.push_back(slant_axis);
+    variation.push_back(weight_coordinate);
+    variation.push_back(width_coordinate);
+    variation.push_back(slant_coordinate);
 
     bool explicit_opsz_configured = false;
     if (variation_settings && variation_settings->size() < UINT16_MAX) {
-      axes.ReserveCapacity(variation_settings->size() + axes.size());
+      variation.ReserveCapacity(variation_settings->size() + variation.size());
       for (const auto& setting : *variation_settings) {
         if (setting.Tag() == SkSetFourByteTag('o', 'p', 's', 'z'))
           explicit_opsz_configured = true;
-        SkFontArguments::Axis axis = {setting.Tag(),
-                                      SkFloatToScalar(setting.Value())};
-        axes.push_back(axis);
+        SkFontArguments::VariationPosition::Coordinate setting_coordinate =
+            {setting.Tag(), SkFloatToScalar(setting.Value())};
+        variation.push_back(setting_coordinate);
       }
     }
 
     if (optical_sizing == kAutoOpticalSizing && !explicit_opsz_configured) {
-      SkFontArguments::Axis opsz_axis = {SkSetFourByteTag('o', 'p', 's', 'z'),
-                                         SkFloatToScalar(size)};
-      axes.push_back(opsz_axis);
+      SkFontArguments::VariationPosition::Coordinate opsz_coordinate =
+          {SkSetFourByteTag('o', 'p', 's', 'z'), SkFloatToScalar(size)};
+      variation.push_back(opsz_coordinate);
     }
 
-    sk_sp<SkTypeface> sk_variation_font(base_typeface_->makeClone(
-        SkFontArguments().setAxes(axes.data(), axes.size())));
+    SkFontArguments font_args;
+    font_args.setVariationDesignPosition({variation.data(), variation.size()});
+    sk_sp<SkTypeface> sk_variation_font(base_typeface_->makeClone(font_args));
 
     if (sk_variation_font) {
       return_typeface = sk_variation_font;
diff --git a/third_party/blink/renderer/platform/graphics/color_space_gamut.cc b/third_party/blink/renderer/platform/graphics/color_space_gamut.cc
index 95a0b35..4208d607 100644
--- a/third_party/blink/renderer/platform/graphics/color_space_gamut.cc
+++ b/third_party/blink/renderer/platform/graphics/color_space_gamut.cc
@@ -4,14 +4,14 @@
 
 #include "third_party/blink/renderer/platform/graphics/color_space_gamut.h"
 
-#include "third_party/blink/public/platform/web_screen_info.h"
+#include "third_party/blink/public/common/widget/screen_info.h"
 #include "third_party/skia/include/third_party/skcms/skcms.h"
 
 namespace blink {
 
 namespace color_space_utilities {
 
-ColorSpaceGamut GetColorSpaceGamut(const WebScreenInfo& screen_info) {
+ColorSpaceGamut GetColorSpaceGamut(const ScreenInfo& screen_info) {
   const gfx::ColorSpace& color_space = screen_info.color_space;
   if (!color_space.IsValid())
     return ColorSpaceGamut::kUnknown;
diff --git a/third_party/blink/renderer/platform/graphics/color_space_gamut.h b/third_party/blink/renderer/platform/graphics/color_space_gamut.h
index fccb1e1..fd05280 100644
--- a/third_party/blink/renderer/platform/graphics/color_space_gamut.h
+++ b/third_party/blink/renderer/platform/graphics/color_space_gamut.h
@@ -11,7 +11,7 @@
 
 namespace blink {
 
-struct WebScreenInfo;
+struct ScreenInfo;
 
 enum class ColorSpaceGamut {
   // Values synced with 'Gamut' in src/tools/metrics/histograms/histograms.xml
@@ -31,7 +31,7 @@
 
 namespace color_space_utilities {
 
-PLATFORM_EXPORT ColorSpaceGamut GetColorSpaceGamut(const WebScreenInfo&);
+PLATFORM_EXPORT ColorSpaceGamut GetColorSpaceGamut(const ScreenInfo&);
 ColorSpaceGamut GetColorSpaceGamut(const skcms_ICCProfile*);
 
 }  // namespace color_space_utilities
diff --git a/third_party/blink/renderer/platform/widget/input/input_handler_proxy_unittest.cc b/third_party/blink/renderer/platform/widget/input/input_handler_proxy_unittest.cc
index 41d3f7d..1e4a1d2f 100644
--- a/third_party/blink/renderer/platform/widget/input/input_handler_proxy_unittest.cc
+++ b/third_party/blink/renderer/platform/widget/input/input_handler_proxy_unittest.cc
@@ -3207,6 +3207,52 @@
   testing::Mock::VerifyAndClearExpectations(&mock_input_handler_);
 }
 
+TEST_F(InputHandlerProxyEventQueueTest, KeyEventAttribution) {
+  WebKeyboardEvent key(WebInputEvent::Type::kKeyDown,
+                       WebInputEvent::kNoModifiers,
+                       WebInputEvent::GetStaticTimeStampForTests());
+
+  EXPECT_CALL(mock_input_handler_, FindFrameElementIdAtPoint(_)).Times(0);
+
+  WebInputEventAttribution attribution =
+      input_handler_proxy_.PerformEventAttribution(key);
+  EXPECT_EQ(attribution.type(), WebInputEventAttribution::kFocusedFrame);
+  EXPECT_EQ(attribution.target_frame_id(), cc::ElementId());
+  testing::Mock::VerifyAndClearExpectations(&mock_input_handler_);
+}
+
+TEST_F(InputHandlerProxyEventQueueTest, MouseEventAttribution) {
+  WebMouseEvent mouse_down(WebInputEvent::Type::kMouseDown,
+                           WebInputEvent::kNoModifiers,
+                           WebInputEvent::GetStaticTimeStampForTests());
+
+  EXPECT_CALL(mock_input_handler_, FindFrameElementIdAtPoint(gfx::PointF(0, 0)))
+      .Times(1)
+      .WillOnce(testing::Return(cc::ElementId(0xDEADBEEF)));
+
+  WebInputEventAttribution attribution =
+      input_handler_proxy_.PerformEventAttribution(mouse_down);
+  EXPECT_EQ(attribution.type(), WebInputEventAttribution::kTargetedFrame);
+  EXPECT_EQ(attribution.target_frame_id(), cc::ElementId(0xDEADBEEF));
+  testing::Mock::VerifyAndClearExpectations(&mock_input_handler_);
+}
+
+TEST_F(InputHandlerProxyEventQueueTest, MouseWheelEventAttribution) {
+  WebMouseWheelEvent wheel(WebInputEvent::Type::kMouseWheel,
+                           WebInputEvent::kNoModifiers,
+                           WebInputEvent::GetStaticTimeStampForTests());
+
+  EXPECT_CALL(mock_input_handler_, FindFrameElementIdAtPoint(gfx::PointF(0, 0)))
+      .Times(1)
+      .WillOnce(testing::Return(cc::ElementId(0xDEADBEEF)));
+
+  WebInputEventAttribution attribution =
+      input_handler_proxy_.PerformEventAttribution(wheel);
+  EXPECT_EQ(attribution.type(), WebInputEventAttribution::kTargetedFrame);
+  EXPECT_EQ(attribution.target_frame_id(), cc::ElementId(0xDEADBEEF));
+  testing::Mock::VerifyAndClearExpectations(&mock_input_handler_);
+}
+
 // Verify that the first point in a touch event is used for performing event
 // attribution.
 TEST_F(InputHandlerProxyEventQueueTest, TouchEventAttribution) {
diff --git a/third_party/blink/renderer/platform/widget/widget_base.cc b/third_party/blink/renderer/platform/widget/widget_base.cc
index cd8ac4e3..781619f4 100644
--- a/third_party/blink/renderer/platform/widget/widget_base.cc
+++ b/third_party/blink/renderer/platform/widget/widget_base.cc
@@ -13,12 +13,12 @@
 #include "mojo/public/cpp/bindings/pending_associated_remote.h"
 #include "third_party/blink/public/common/input/web_input_event_attribution.h"
 #include "third_party/blink/public/common/switches.h"
+#include "third_party/blink/public/common/widget/screen_info.h"
 #include "third_party/blink/public/mojom/input/pointer_lock_context.mojom-blink.h"
 #include "third_party/blink/public/platform/platform.h"
 #include "third_party/blink/public/platform/scheduler/web_render_widget_scheduling_state.h"
 #include "third_party/blink/public/platform/scheduler/web_thread_scheduler.h"
 #include "third_party/blink/public/platform/scheduler/web_widget_scheduler.h"
-#include "third_party/blink/public/platform/web_screen_info.h"
 #include "third_party/blink/renderer/platform/runtime_enabled_features.h"
 #include "third_party/blink/renderer/platform/scheduler/public/thread.h"
 #include "third_party/blink/renderer/platform/widget/compositing/layer_tree_settings.h"
diff --git a/third_party/blink/tools/blinkpy/w3c/import_notifier.py b/third_party/blink/tools/blinkpy/w3c/import_notifier.py
index 2496eb8..9a543e80 100644
--- a/third_party/blink/tools/blinkpy/w3c/import_notifier.py
+++ b/third_party/blink/tools/blinkpy/w3c/import_notifier.py
@@ -129,14 +129,30 @@
                             gerrit_url_with_ps=gerrit_url_with_ps))
 
     def more_failures_in_baseline(self, baseline):
+        """Determines if a testharness.js baseline file has new failures.
+
+        The file is assumed to have been modified in the current git checkout,
+        and so has a diff we can parse.
+
+        We recognize two types of failures: FAIL lines, which are output for a
+        specific subtest failing, and harness errors, which indicate an uncaught
+        error in the test. Increasing numbers of either are considered new
+        failures - this includes going from FAIL to error or vice-versa.
+        """
+
         diff = self.git.run(['diff', '-U0', 'origin/master', '--', baseline])
         delta_failures = 0
+        delta_harness_errors = 0
         for line in diff.splitlines():
             if line.startswith('+FAIL'):
                 delta_failures += 1
             if line.startswith('-FAIL'):
                 delta_failures -= 1
-        return delta_failures > 0
+            if line.startswith('+Harness Error.'):
+                delta_harness_errors += 1
+            if line.startswith('-Harness Error.'):
+                delta_harness_errors -= 1
+        return delta_failures > 0 or delta_harness_errors > 0
 
     def examine_new_test_expectations(self, test_expectations):
         """Examines new test expectations to find new failures.
diff --git a/third_party/blink/tools/blinkpy/w3c/import_notifier_unittest.py b/third_party/blink/tools/blinkpy/w3c/import_notifier_unittest.py
index 4612f67..1eb5324 100644
--- a/third_party/blink/tools/blinkpy/w3c/import_notifier_unittest.py
+++ b/third_party/blink/tools/blinkpy/w3c/import_notifier_unittest.py
@@ -98,6 +98,66 @@
         self.assertFalse(
             self.notifier.more_failures_in_baseline('foo-expected.txt'))
 
+    def test_more_failures_in_baseline_new_error(self):
+        executive = mock_git_commands({
+            'diff': ('diff --git a/foo-expected.txt b/foo-expected.txt\n'
+                     '--- a/foo-expected.txt\n'
+                     '+++ b/foo-expected.txt\n'
+                     '-PASS an existing pass\n'
+                     '+Harness Error. harness_status.status = 1 , harness_status.message = bad\n')
+        })
+        self.notifier.git = MockGit(executive=executive)
+        self.assertTrue(
+            self.notifier.more_failures_in_baseline('foo-expected.txt'))
+
+    def test_more_failures_in_baseline_remove_error(self):
+        executive = mock_git_commands({
+            'diff': ('diff --git a/foo-expected.txt b/foo-expected.txt\n'
+                     '--- a/foo-expected.txt\n'
+                     '+++ b/foo-expected.txt\n'
+                     '-Harness Error. harness_status.status = 1 , harness_status.message = bad\n'
+                     '+PASS a new pass\n')
+        })
+        self.notifier.git = MockGit(executive=executive)
+        self.assertFalse(
+            self.notifier.more_failures_in_baseline('foo-expected.txt'))
+
+    def test_more_failures_in_baseline_changing_error(self):
+        executive = mock_git_commands({
+            'diff': ('diff --git a/foo-expected.txt b/foo-expected.txt\n'
+                     '--- a/foo-expected.txt\n'
+                     '+++ b/foo-expected.txt\n'
+                     '-Harness Error. harness_status.status = 1 , harness_status.message = bad\n'
+                     '+Harness Error. new text, still an error\n')
+        })
+        self.notifier.git = MockGit(executive=executive)
+        self.assertFalse(
+            self.notifier.more_failures_in_baseline('foo-expected.txt'))
+
+    def test_more_failures_in_baseline_fail_to_error(self):
+        executive = mock_git_commands({
+            'diff': ('diff --git a/foo-expected.txt b/foo-expected.txt\n'
+                     '--- a/foo-expected.txt\n'
+                     '+++ b/foo-expected.txt\n'
+                     '-FAIL a previous failure\n'
+                     '+Harness Error. harness_status.status = 1 , harness_status.message = bad\n')
+        })
+        self.notifier.git = MockGit(executive=executive)
+        self.assertTrue(
+            self.notifier.more_failures_in_baseline('foo-expected.txt'))
+
+    def test_more_failures_in_baseline_error_to_fail(self):
+        executive = mock_git_commands({
+            'diff': ('diff --git a/foo-expected.txt b/foo-expected.txt\n'
+                     '--- a/foo-expected.txt\n'
+                     '+++ b/foo-expected.txt\n'
+                     '-Harness Error. harness_status.status = 1 , harness_status.message = bad\n'
+                     '+FAIL a new failure\n')
+        })
+        self.notifier.git = MockGit(executive=executive)
+        self.assertTrue(
+            self.notifier.more_failures_in_baseline('foo-expected.txt'))
+
     def test_examine_baseline_changes(self):
         self.host.filesystem.write_text_file(
             MOCK_WEB_TESTS + 'external/wpt/foo/OWNERS', 'test@chromium.org')
diff --git a/third_party/blink/web_tests/LeakExpectations b/third_party/blink/web_tests/LeakExpectations
index 78154a9..0540df4 100644
--- a/third_party/blink/web_tests/LeakExpectations
+++ b/third_party/blink/web_tests/LeakExpectations
@@ -167,6 +167,18 @@
 crbug.com/1068175 [ Linux ] external/wpt/referrer-policy/gen/worker-classic.http-rp/same-origin/worker-module.http.html [ Pass Timeout ]
 crbug.com/1068175 [ Linux ] external/wpt/referrer-policy/gen/worker-classic.http-rp/origin-when-cross-origin/worker-classic.http.html [ Pass Timeout ]
 
+# Sheriff 2020-07-15
+crbug.com/1068175 [ Linux ] external/wpt/referrer-policy/gen/worker-classic.http-rp/origin-when-cross-origin/worker-module.http.html [ Pass Timeout ]
+crbug.com/1068175 [ Linux ] external/wpt/referrer-policy/gen/worker-classic.http-rp/no-referrer/worker-classic.http.html [ Pass Timeout ]
+crbug.com/1068175 [ Linux ] external/wpt/referrer-policy/gen/worker-classic.http-rp/no-referrer-when-downgrade/worker-classic.http.html [ Pass Timeout ]
+crbug.com/1068175 [ Linux ] external/wpt/referrer-policy/gen/worker-classic.http-rp/unsafe-url/worker-classic.http.html [ Pass Timeout ]
+crbug.com/1068175 [ Linux ] external/wpt/referrer-policy/gen/worker-module.http-rp/unset/worker-classic.http.html [ Pass Timeout ]
+crbug.com/1068175 [ Linux ] virtual/cors/external/wpt/referrer-policy/gen/worker-classic.http-rp/no-referrer-when-downgrade/worker-classic.http.html [ Pass Timeout ]
+crbug.com/1068175 [ Linux ] virtual/cors/external/wpt/referrer-policy/gen/worker-classic.http-rp/same-origin/worker-classic.http.html [ Pass Timeout ]
+crbug.com/1068175 [ Linux ] virtual/cors/external/wpt/referrer-policy/gen/worker-classic.http-rp/strict-origin-when-cross-origin/worker-classic.http.html [ Pass Timeout ]
+crbug.com/1068175 [ Linux ] virtual/cors/external/wpt/referrer-policy/gen/worker-classic.http-rp/unsafe-url/worker-classic.http.html [ Pass Timeout ]
+crbug.com/1068175 [ Linux ] virtual/cors/external/wpt/referrer-policy/gen/worker-classic.http-rp/unset/worker-classic.http.html [ Pass Timeout ]
+
 # This test triggers existing leaky behavior, but this test also catches
 # a prior crash.
 crbug.com/1103082 [ Linux ] fast/forms/select/select-change-layout-object-crash.html [ Failure ]
diff --git a/third_party/blink/web_tests/android/ClankWPTOverrideExpectations b/third_party/blink/web_tests/android/ClankWPTOverrideExpectations
index 15d7efe..0068630 100644
--- a/third_party/blink/web_tests/android/ClankWPTOverrideExpectations
+++ b/third_party/blink/web_tests/android/ClankWPTOverrideExpectations
@@ -2568,7 +2568,6 @@
 crbug.com/1050754 external/wpt/html/semantics/embedded-content/the-embed-element/embed-in-object-fallback-2.html [ Failure ]
 crbug.com/1050754 external/wpt/html/semantics/embedded-content/the-iframe-element/cross-origin-to-whom-part-2.window.html [ Failure ]
 crbug.com/1050754 external/wpt/html/semantics/embedded-content/the-iframe-element/cross-origin-to-whom.window.html [ Failure ]
-crbug.com/1050754 external/wpt/html/semantics/embedded-content/the-iframe-element/iframe-loading-lazy-to-eager.tentative.html [ Timeout ]
 crbug.com/1050754 external/wpt/html/semantics/embedded-content/the-iframe-element/iframe_sandbox_allow_top_navigation-1.html [ Failure Timeout ]
 crbug.com/1050754 external/wpt/html/semantics/embedded-content/the-iframe-element/iframe_sandbox_allow_top_navigation-3.html [ Failure Timeout ]
 crbug.com/1050754 external/wpt/html/semantics/embedded-content/the-iframe-element/iframe_sandbox_anchor_download_allow_downloads.sub.tentative.html [ Timeout ]
diff --git a/third_party/blink/web_tests/android/WebviewWPTOverrideExpectations b/third_party/blink/web_tests/android/WebviewWPTOverrideExpectations
index f01d43d..1fa568e 100644
--- a/third_party/blink/web_tests/android/WebviewWPTOverrideExpectations
+++ b/third_party/blink/web_tests/android/WebviewWPTOverrideExpectations
@@ -2671,7 +2671,6 @@
 crbug.com/1050754 external/wpt/html/semantics/embedded-content/the-iframe-element/cross-origin-to-whom.window.html [ Failure ]
 crbug.com/1050754 external/wpt/html/semantics/embedded-content/the-iframe-element/iframe-allow.html [ Failure ]
 crbug.com/1050754 external/wpt/html/semantics/embedded-content/the-iframe-element/iframe-allowfullscreen.html [ Failure ]
-crbug.com/1050754 external/wpt/html/semantics/embedded-content/the-iframe-element/iframe-loading-lazy-to-eager.tentative.html [ Timeout ]
 crbug.com/1050754 external/wpt/html/semantics/embedded-content/the-iframe-element/iframe_sandbox_allow_top_navigation-1.html [ Failure Timeout ]
 crbug.com/1050754 external/wpt/html/semantics/embedded-content/the-iframe-element/iframe_sandbox_allow_top_navigation-3.html [ Failure Timeout ]
 crbug.com/1050754 external/wpt/html/semantics/embedded-content/the-iframe-element/iframe_sandbox_navigation_download_block_downloads.sub.tentative.html [ Failure ]
diff --git a/third_party/blink/web_tests/external/wpt/html/semantics/embedded-content/the-iframe-element/iframe-loading-eager.tentative.html b/third_party/blink/web_tests/external/wpt/html/semantics/embedded-content/the-iframe-element/iframe-loading-eager.html
similarity index 100%
rename from third_party/blink/web_tests/external/wpt/html/semantics/embedded-content/the-iframe-element/iframe-loading-eager.tentative.html
rename to third_party/blink/web_tests/external/wpt/html/semantics/embedded-content/the-iframe-element/iframe-loading-eager.html
diff --git a/third_party/blink/web_tests/external/wpt/html/semantics/embedded-content/the-iframe-element/iframe-loading-lazy-base-url-2.tentative.html b/third_party/blink/web_tests/external/wpt/html/semantics/embedded-content/the-iframe-element/iframe-loading-lazy-base-url-2.html
similarity index 100%
rename from third_party/blink/web_tests/external/wpt/html/semantics/embedded-content/the-iframe-element/iframe-loading-lazy-base-url-2.tentative.html
rename to third_party/blink/web_tests/external/wpt/html/semantics/embedded-content/the-iframe-element/iframe-loading-lazy-base-url-2.html
diff --git a/third_party/blink/web_tests/external/wpt/html/semantics/embedded-content/the-iframe-element/iframe-loading-lazy-base-url.tentative.html b/third_party/blink/web_tests/external/wpt/html/semantics/embedded-content/the-iframe-element/iframe-loading-lazy-base-url.html
similarity index 100%
rename from third_party/blink/web_tests/external/wpt/html/semantics/embedded-content/the-iframe-element/iframe-loading-lazy-base-url.tentative.html
rename to third_party/blink/web_tests/external/wpt/html/semantics/embedded-content/the-iframe-element/iframe-loading-lazy-base-url.html
diff --git a/third_party/blink/web_tests/external/wpt/html/semantics/embedded-content/the-iframe-element/iframe-loading-lazy.tentative-expected.txt b/third_party/blink/web_tests/external/wpt/html/semantics/embedded-content/the-iframe-element/iframe-loading-lazy-expected.txt
similarity index 100%
rename from third_party/blink/web_tests/external/wpt/html/semantics/embedded-content/the-iframe-element/iframe-loading-lazy.tentative-expected.txt
rename to third_party/blink/web_tests/external/wpt/html/semantics/embedded-content/the-iframe-element/iframe-loading-lazy-expected.txt
diff --git a/third_party/blink/web_tests/external/wpt/html/semantics/embedded-content/the-iframe-element/iframe-loading-lazy-load-event.tentative-expected.txt b/third_party/blink/web_tests/external/wpt/html/semantics/embedded-content/the-iframe-element/iframe-loading-lazy-load-event-expected.txt
similarity index 100%
rename from third_party/blink/web_tests/external/wpt/html/semantics/embedded-content/the-iframe-element/iframe-loading-lazy-load-event.tentative-expected.txt
rename to third_party/blink/web_tests/external/wpt/html/semantics/embedded-content/the-iframe-element/iframe-loading-lazy-load-event-expected.txt
diff --git a/third_party/blink/web_tests/external/wpt/html/semantics/embedded-content/the-iframe-element/iframe-loading-lazy-load-event.tentative.html b/third_party/blink/web_tests/external/wpt/html/semantics/embedded-content/the-iframe-element/iframe-loading-lazy-load-event.html
similarity index 100%
rename from third_party/blink/web_tests/external/wpt/html/semantics/embedded-content/the-iframe-element/iframe-loading-lazy-load-event.tentative.html
rename to third_party/blink/web_tests/external/wpt/html/semantics/embedded-content/the-iframe-element/iframe-loading-lazy-load-event.html
diff --git a/third_party/blink/web_tests/external/wpt/html/semantics/embedded-content/the-iframe-element/iframe-loading-lazy-multiple-times.tentative.html b/third_party/blink/web_tests/external/wpt/html/semantics/embedded-content/the-iframe-element/iframe-loading-lazy-multiple-times.html
similarity index 100%
rename from third_party/blink/web_tests/external/wpt/html/semantics/embedded-content/the-iframe-element/iframe-loading-lazy-multiple-times.tentative.html
rename to third_party/blink/web_tests/external/wpt/html/semantics/embedded-content/the-iframe-element/iframe-loading-lazy-multiple-times.html
diff --git a/third_party/blink/web_tests/external/wpt/html/semantics/embedded-content/the-iframe-element/iframe-loading-lazy-referrerpolicy-change.sub.tentative.html b/third_party/blink/web_tests/external/wpt/html/semantics/embedded-content/the-iframe-element/iframe-loading-lazy-referrerpolicy-change.sub.html
similarity index 100%
rename from third_party/blink/web_tests/external/wpt/html/semantics/embedded-content/the-iframe-element/iframe-loading-lazy-referrerpolicy-change.sub.tentative.html
rename to third_party/blink/web_tests/external/wpt/html/semantics/embedded-content/the-iframe-element/iframe-loading-lazy-referrerpolicy-change.sub.html
diff --git a/third_party/blink/web_tests/external/wpt/html/semantics/embedded-content/the-iframe-element/iframe-loading-lazy-to-eager.tentative.html b/third_party/blink/web_tests/external/wpt/html/semantics/embedded-content/the-iframe-element/iframe-loading-lazy-to-eager.html
similarity index 100%
rename from third_party/blink/web_tests/external/wpt/html/semantics/embedded-content/the-iframe-element/iframe-loading-lazy-to-eager.tentative.html
rename to third_party/blink/web_tests/external/wpt/html/semantics/embedded-content/the-iframe-element/iframe-loading-lazy-to-eager.html
diff --git a/third_party/blink/web_tests/external/wpt/html/semantics/embedded-content/the-iframe-element/iframe-loading-lazy.tentative.html b/third_party/blink/web_tests/external/wpt/html/semantics/embedded-content/the-iframe-element/iframe-loading-lazy.html
similarity index 100%
rename from third_party/blink/web_tests/external/wpt/html/semantics/embedded-content/the-iframe-element/iframe-loading-lazy.tentative.html
rename to third_party/blink/web_tests/external/wpt/html/semantics/embedded-content/the-iframe-element/iframe-loading-lazy.html
diff --git a/third_party/blink/web_tests/flag-specific/force-device-scale-factor=1.5/paint/invalidation/scroll/overflow-scroll-in-overflow-scroll-scrolled-expected.png b/third_party/blink/web_tests/flag-specific/force-device-scale-factor=1.5/paint/invalidation/scroll/overflow-scroll-in-overflow-scroll-scrolled-expected.png
deleted file mode 100644
index 735bbbdd..0000000
--- a/third_party/blink/web_tests/flag-specific/force-device-scale-factor=1.5/paint/invalidation/scroll/overflow-scroll-in-overflow-scroll-scrolled-expected.png
+++ /dev/null
Binary files differ
diff --git a/third_party/blink/web_tests/paint/invalidation/scroll/overflow-scroll-in-overflow-scroll-scrolled-expected.html b/third_party/blink/web_tests/paint/invalidation/scroll/overflow-scroll-in-overflow-scroll-scrolled-expected.html
new file mode 100644
index 0000000..afba406
--- /dev/null
+++ b/third_party/blink/web_tests/paint/invalidation/scroll/overflow-scroll-in-overflow-scroll-scrolled-expected.html
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<script>
+onload = () => {
+    outerDiv.scrollTop = 300;
+    innerDiv.scrollTop = 400;
+}
+</script>
+<div style="height: 300px; overflow-y: scroll;" id="outerDiv">
+    <div style="height: 300px;"></div>
+    <div style="height: 400px; overflow-y: scroll;" id="innerDiv">
+        <div style="height: 800px; width: 300px; background: green"></div>
+    </div>
+</div>
diff --git a/third_party/blink/web_tests/paint/invalidation/scroll/overflow-scroll-in-overflow-scroll-scrolled.html b/third_party/blink/web_tests/paint/invalidation/scroll/overflow-scroll-in-overflow-scroll-scrolled.html
index 2ea5371..1ff3b9b 100644
--- a/third_party/blink/web_tests/paint/invalidation/scroll/overflow-scroll-in-overflow-scroll-scrolled.html
+++ b/third_party/blink/web_tests/paint/invalidation/scroll/overflow-scroll-in-overflow-scroll-scrolled.html
@@ -1,18 +1,18 @@
 <!DOCTYPE html>
-<html>
-<head>
-    <script src="../resources/text-based-repaint.js" type="text/javascript"></script>
-    <script>
-    function repaintTest() {
-        // Now scroll once in the #innerDiv to the green area.
-        if (window.eventSender)
-            eventSender.mouseScrollBy(0, -10);
-    }
-    window.addEventListener("load", runRepaintAndPixelTest, false);
-    </script>
-</head>
-<body>
-<!-- Bug 71550 - REGRESSION (r93614): Content remains despite parent element being scrolled off page using javascript. -->
+<script src="../resources/text-based-repaint.js"></script>
+<script>
+onload = () => {
+  // Scroll the outerDiv until we reach innerDiv.
+  outerDiv.scrollTop = 300;
+  runRepaintAndPixelTest();
+};
+
+function repaintTest() {
+    // Now scroll the innerDiv once to the green area.
+    innerDiv.scrollTop = 400;
+}
+</script>
+<!-- https://bugs.webkit.org/show_bug.cgi?id=71550 -->
 <!-- For the test to pass you should not see any RED or PURPLE, only green -->
 <div style="height: 300px; overflow-y: scroll;" id="outerDiv">
     <div style="height: 300px; background: purple;"></div>
@@ -21,17 +21,3 @@
         <div style="height: 400px; width: 300px; background: green"></div>
     </div>
 </div>
-<script>
-if (window.eventSender) {
-    if (window.internals)
-        internals.settings.setScrollAnimatorEnabled(false);
-
-    // Scroll the #outerDiv until we reach the #innerDiv.
-    eventSender.mouseMoveTo(50, 50);
-    eventSender.mouseScrollBy(0, -8);
-} else {
-    document.write("This test is better run under DumpRenderTree. To manually test it, continuously scroll down on the top-most element. There should be no repaint issue.");
-}
-</script>
-</body>
-</html>
diff --git a/third_party/blink/web_tests/platform/mac/paint/invalidation/scroll/overflow-scroll-in-overflow-scroll-scrolled-expected.png b/third_party/blink/web_tests/platform/mac/paint/invalidation/scroll/overflow-scroll-in-overflow-scroll-scrolled-expected.png
deleted file mode 100644
index a16ab6fd..0000000
--- a/third_party/blink/web_tests/platform/mac/paint/invalidation/scroll/overflow-scroll-in-overflow-scroll-scrolled-expected.png
+++ /dev/null
Binary files differ
diff --git a/third_party/blink/web_tests/platform/mac/paint/invalidation/scroll/overflow-scroll-in-overflow-scroll-scrolled-expected.txt b/third_party/blink/web_tests/platform/mac/paint/invalidation/scroll/overflow-scroll-in-overflow-scroll-scrolled-expected.txt
index cb445fe..a872fb7 100644
--- a/third_party/blink/web_tests/platform/mac/paint/invalidation/scroll/overflow-scroll-in-overflow-scroll-scrolled-expected.txt
+++ b/third_party/blink/web_tests/platform/mac/paint/invalidation/scroll/overflow-scroll-in-overflow-scroll-scrolled-expected.txt
@@ -56,7 +56,7 @@
         [1, 0, 0, 0],
         [0, 1, 0, 0],
         [0, 0, 1, 0],
-        [0, -320, 0, 1]
+        [0, -300, 0, 1]
       ]
     },
     {
diff --git a/third_party/blink/web_tests/platform/win/paint/invalidation/scroll/overflow-scroll-in-overflow-scroll-scrolled-expected.png b/third_party/blink/web_tests/platform/win/paint/invalidation/scroll/overflow-scroll-in-overflow-scroll-scrolled-expected.png
deleted file mode 100644
index decc654..0000000
--- a/third_party/blink/web_tests/platform/win/paint/invalidation/scroll/overflow-scroll-in-overflow-scroll-scrolled-expected.png
+++ /dev/null
Binary files differ
diff --git a/third_party/tint/LICENSE b/third_party/tint/LICENSE
new file mode 100644
index 0000000..d645695
--- /dev/null
+++ b/third_party/tint/LICENSE
@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
diff --git a/third_party/tint/OWNERS b/third_party/tint/OWNERS
new file mode 100644
index 0000000..9e4daee
--- /dev/null
+++ b/third_party/tint/OWNERS
@@ -0,0 +1,3 @@
+cwallez@chromium.org
+dsinclair@chromium.org
+kainino@chromium.org
diff --git a/third_party/tint/README.chromium b/third_party/tint/README.chromium
new file mode 100644
index 0000000..82ec055d
--- /dev/null
+++ b/third_party/tint/README.chromium
@@ -0,0 +1,13 @@
+Name: Tint
+Short Name: tint
+URL: https://dawn.googlesource.com/tint
+Version: 0
+Revision: 919011af0a2ae1b663aae0aaa4083a3f9f13e66d
+License: Apache 2.0
+License File: LICENSE
+Security Critical: yes
+
+Description:
+Tint is an implementation of WGSL, the WebGPU shading language. It is used by
+Dawn, an implementation for WebGPU, in Chromium. Specifically it provides
+facilities for conversion to/from WGSL from other shading languages like SPIR-V.
diff --git a/tools/android/build_speed/benchmark.py b/tools/android/build_speed/benchmark.py
index 3ad7b3a..39c7193 100755
--- a/tools/android/build_speed/benchmark.py
+++ b/tools/android/build_speed/benchmark.py
@@ -60,6 +60,12 @@
             'base_java_sig',
         ],
     },
+    'extra_incremental': {
+        'suite': [
+            'turbine_headers',
+            'compile_java',
+        ],
+    },
     'chrome_java_nosig': {
         'kind': 'incremental',
         'target': 'chrome_public_apk',
@@ -95,6 +101,20 @@
         'to_string': 'SysUtils";public void NewInterfaceMethod(){}',
         'change_file': 'base/android/java/src/org/chromium/base/SysUtils.java',
     },
+    'turbine_headers': {
+        'kind': 'incremental',
+        'target': 'chrome_public_apk',
+        'from_string': '# found in the LICENSE file.',
+        'to_string': '#temporary_edit_for_benchmark.py',
+        'change_file': 'build/android/gyp/turbine.py',
+    },
+    'compile_java': {
+        'kind': 'incremental',
+        'target': 'chrome_public_apk',
+        'from_string': '# found in the LICENSE file.',
+        'to_string': '#temporary_edit_for_benchmark.py',
+        'change_file': 'build/android/gyp/compile_java.py',
+    },
 }
 
 
diff --git a/tools/binary_size/libsupersize/archive.py b/tools/binary_size/libsupersize/archive.py
index 0931ae93..a35554f 100644
--- a/tools/binary_size/libsupersize/archive.py
+++ b/tools/binary_size/libsupersize/archive.py
@@ -42,7 +42,7 @@
 sys.path.insert(1, os.path.join(path_util.TOOLS_SRC_ROOT, 'tools', 'grit'))
 from grit.format import data_pack
 
-_METADATA_FILENAME = 'METADATA.chromium'
+_METADATA_FILENAME = 'DIR_METADATA'
 _METADATA_COMPONENT_REGEX = re.compile(r'^\s*component:\s*"(.*?)"',
                                        re.MULTILINE)
 _OWNERS_FILENAME = 'OWNERS'
@@ -542,7 +542,7 @@
 
 
 def _ParseComponentFromMetadata(path):
-  """Extracts Component from METADATA.chromium."""
+  """Extracts Component from DIR_METADATA."""
   try:
     with open(path) as f:
       data = f.read()
diff --git a/tools/binary_size/libsupersize/testdata/mock_source_directory/base/METADATA.chromium b/tools/binary_size/libsupersize/testdata/mock_source_directory/base/DIR_METADATA
similarity index 100%
rename from tools/binary_size/libsupersize/testdata/mock_source_directory/base/METADATA.chromium
rename to tools/binary_size/libsupersize/testdata/mock_source_directory/base/DIR_METADATA
diff --git a/tools/clang/scripts/build.py b/tools/clang/scripts/build.py
index 48f116e1..34dead0 100755
--- a/tools/clang/scripts/build.py
+++ b/tools/clang/scripts/build.py
@@ -544,8 +544,10 @@
   if sys.platform == 'darwin':
     # For libc++, we only want the headers.
     base_cmake_args.extend([
-        '-DLIBCXX_ENABLE_SHARED=OFF', '-DLIBCXX_ENABLE_STATIC=OFF',
-        '-DLIBCXX_INCLUDE_TESTS=OFF'
+        '-DLIBCXX_ENABLE_SHARED=OFF',
+        '-DLIBCXX_ENABLE_STATIC=OFF',
+        '-DLIBCXX_INCLUDE_TESTS=OFF',
+        '-DLIBCXX_ENABLE_EXPERIMENTAL_LIBRARY=OFF',
     ])
     # Prefer Python 2. TODO(crbug.com/1076834): Remove this.
     base_cmake_args.append('-DPython3_EXECUTABLE=/nonexistent')
diff --git a/tools/json_schema_compiler/test/crossref_unittest.cc b/tools/json_schema_compiler/test/crossref_unittest.cc
index 4d97f1f9..c36920789 100644
--- a/tools/json_schema_compiler/test/crossref_unittest.cc
+++ b/tools/json_schema_compiler/test/crossref_unittest.cc
@@ -66,7 +66,7 @@
   auto params_value = std::make_unique<base::ListValue>();
   std::unique_ptr<base::DictionaryValue> test_type_value =
       CreateTestTypeValue();
-  test_type_value->RemoveWithoutPathExpansion("number", NULL);
+  test_type_value->RemoveKey("number");
   params_value->Append(std::move(test_type_value));
   std::unique_ptr<crossref::TestTypeOptionalParam::Params> params(
       crossref::TestTypeOptionalParam::Params::Create(*params_value));
diff --git a/tools/metrics/histograms/enums.xml b/tools/metrics/histograms/enums.xml
index 345e367..f380e4f20 100644
--- a/tools/metrics/histograms/enums.xml
+++ b/tools/metrics/histograms/enums.xml
@@ -41702,6 +41702,7 @@
   <int value="189777537" label="DisableInitialMostVisitedFadeIn:enabled"/>
   <int value="191737931" label="enable-mark-http-as"/>
   <int value="192167036" label="LogJsConsoleMessages:disabled"/>
+  <int value="192320180" label="ignore-gpu-blocklist"/>
   <int value="194573877" label="MacViewsNativeDialogs:disabled"/>
   <int value="194895489" label="passive-listeners-default"/>
   <int value="195335115" label="AudioWorkletRealtimeThread:disabled"/>
diff --git a/tools/metrics/histograms/histograms.xml b/tools/metrics/histograms/histograms.xml
index f3e012d..9101fd24 100644
--- a/tools/metrics/histograms/histograms.xml
+++ b/tools/metrics/histograms/histograms.xml
@@ -10162,7 +10162,7 @@
 </histogram>
 
 <histogram name="Ash.Login.Login.MigrationBanner" enum="BooleanShown"
-    expires_after="M86">
+    expires_after="2021-01-01">
   <owner>rsorokin@chromium.org</owner>
   <owner>cros-oac@google.com</owner>
   <summary>
@@ -114998,6 +114998,9 @@
 
 <histogram name="Omnibox.HardwareKeyboardModeEnabled" enum="BooleanEnabled"
     expires_after="M85">
+  <obsolete>
+    Removed 2020-07-15
+  </obsolete>
   <owner>mpearson@chromium.org</owner>
   <owner>jdonnelly@chromium.org</owner>
   <owner>pkl@chromium.org</owner>
@@ -118548,6 +118551,42 @@
   </summary>
 </histogram>
 
+<histogram name="PageLoad.Clients.Ads.AdDensity.MaxPercentByArea" units="%"
+    expires_after="2020-10-08">
+  <owner>justinmron@chromium.org</owner>
+  <owner>johnidel@chromium.org</owner>
+  <summary>
+    The page's maximum ad density by area over its lifecycle as a percent from
+    0-100. The density measurement is throttled in page load metrics propagation
+    from renderer to browser and in the ads page load metrics observer, this may
+    lead to inaccurate maximum density. Recorded at the time a page is
+    destroyed.
+  </summary>
+</histogram>
+
+<histogram name="PageLoad.Clients.Ads.AdDensity.MaxPercentByHeight" units="%"
+    expires_after="2020-10-08">
+  <owner>justinmron@chromium.org</owner>
+  <owner>johnidel@chromium.org</owner>
+  <summary>
+    The page's maximum ad density by height over its lifecycle as a percent from
+    0-100. The density measurement is throttled in page load metrics propagation
+    from renderer to browser and in the ads page load metrics observer, this may
+    lead to inaccurate maximum density. Recorded at the time a page is
+    destroyed.
+  </summary>
+</histogram>
+
+<histogram name="PageLoad.Clients.Ads.AdDensity.Recorded" units="Boolean"
+    expires_after="2020-10-08">
+  <owner>justinmron@chromium.org</owner>
+  <owner>johnidel@chromium.org</owner>
+  <summary>
+    Whether the ad density was recorded on the page for both density by area and
+    density by height. Recorded at the time a page is destroyed.
+  </summary>
+</histogram>
+
 <histogram name="PageLoad.Clients.Ads.All.Navigations.AdFrameRenavigatedToAd"
     enum="DidNavigateToAd" expires_after="2018-07-13">
   <obsolete>
@@ -178866,7 +178905,7 @@
   </summary>
 </histogram>
 
-<histogram name="Thumbnails.CopyFromSurfaceTime" units="ms" expires_after="M86">
+<histogram name="Thumbnails.CopyFromSurfaceTime" units="ms" expires_after="M90">
   <owner>dfried@chromium.org</owner>
   <owner>pbos@chromium.org</owner>
   <summary>
@@ -178897,7 +178936,7 @@
   </summary>
 </histogram>
 
-<histogram name="Thumbnails.ProcessBitmapTime" units="ms" expires_after="M86">
+<histogram name="Thumbnails.ProcessBitmapTime" units="ms" expires_after="M90">
   <owner>dfried@chromium.org</owner>
   <owner>pbos@chromium.org</owner>
   <summary>
diff --git a/tools/metrics/ukm/ukm.xml b/tools/metrics/ukm/ukm.xml
index 7b78668..ac51054 100644
--- a/tools/metrics/ukm/ukm.xml
+++ b/tools/metrics/ukm/ukm.xml
@@ -345,6 +345,22 @@
       bucket (with a bucket ratio of 1.3).
     </summary>
   </metric>
+  <metric name="MaxAdDensityByArea">
+    <summary>
+      The estimated maximum density of ads on a page by area. Calculated as the
+      area of ads on the page * 100 / page area. This counts each overlapping
+      area once, it may be inaccurate due to updates and calculations being
+      throttled.
+    </summary>
+  </metric>
+  <metric name="MaxAdDensityByHeight">
+    <summary>
+      The estimated maximum density of ads on a page by height. Calculated as
+      the combined height of ads on the page * 100 / page height. This counts
+      each overlapping area once, it may be inaccurate due to updates and
+      calculations being throttled.
+    </summary>
+  </metric>
   <metric name="TotalBytes">
     <summary>
       Amount of network bytes used to load resources on the page. Includes
diff --git a/tools/perf/core/perfetto_binary_roller/binary_deps.json b/tools/perf/core/perfetto_binary_roller/binary_deps.json
index dcca10e..c4101fa 100644
--- a/tools/perf/core/perfetto_binary_roller/binary_deps.json
+++ b/tools/perf/core/perfetto_binary_roller/binary_deps.json
@@ -1,16 +1,16 @@
 {
     "trace_processor_shell": {
         "win": {
-            "hash": "940dc509a546e0680eb22717a7a054e0dd880cc9",
-            "remote_path": "perfetto_binaries/trace_processor_shell/win/55ef680dab933301b0a9aec7d3021714dcde26cd/trace_processor_shell.exe"
+            "hash": "07195a7988c14dc3ab60300f36d26e553c8f40b6",
+            "remote_path": "perfetto_binaries/trace_processor_shell/win/73b607f9e3b436b7fc32f45263375b3de5a62dba/trace_processor_shell.exe"
         },
         "mac": {
-            "hash": "a2b0896e1d305a1b1fed14f2e745fe6d0398092d",
-            "remote_path": "perfetto_binaries/trace_processor_shell/mac/a0a8e1d6457f8013d96e3508f0800cae5b4d769c/trace_processor_shell"
+            "hash": "f3c8f07d93a759d5bc3ea7c54dbaa11c8a387955",
+            "remote_path": "perfetto_binaries/trace_processor_shell/mac/73b607f9e3b436b7fc32f45263375b3de5a62dba/trace_processor_shell"
         },
         "linux": {
-            "hash": "4a91142dbaa04283f5443eda976d03572ed5f859",
-            "remote_path": "perfetto_binaries/trace_processor_shell/linux/a0a8e1d6457f8013d96e3508f0800cae5b4d769c/trace_processor_shell"
+            "hash": "066f8c275b0c6b23b36eb933b42a1e2070176a30",
+            "remote_path": "perfetto_binaries/trace_processor_shell/linux/73b607f9e3b436b7fc32f45263375b3de5a62dba/trace_processor_shell"
         }
     },
     "power_profile.sql": {
diff --git a/tools/perf/experimental/representative_perf_test_limit_adjuster/adjust_upper_limits.py b/tools/perf/experimental/representative_perf_test_limit_adjuster/adjust_upper_limits.py
index 64a3f14..1cbddcd 100644
--- a/tools/perf/experimental/representative_perf_test_limit_adjuster/adjust_upper_limits.py
+++ b/tools/perf/experimental/representative_perf_test_limit_adjuster/adjust_upper_limits.py
@@ -17,7 +17,7 @@
 
 from core.external_modules import pandas
 
-RUNS_USED_FOR_LIMIT_UPDATE = 30
+RUNS_USED_FOR_LIMIT_UPDATE = 50
 CHANGE_PERCENTAGE_LIMIT = 0.01
 
 SWARMING_PATH = os.path.join(CHROMIUM_PATH, 'tools', 'luci-go', 'swarming')
@@ -72,8 +72,14 @@
 
   try:
     df = pandas.read_csv(result_file_path)
-    df = df.loc[df['name'] == 'frame_times']
-    df = df[['stories', 'avg', 'ci_095']]
+    df_frame_times = df.loc[df['name'] == 'frame_times']
+    df_frame_times = df_frame_times[['stories', 'avg', 'ci_095']]
+
+    df_cpu_wall = df.loc[df['name'] == 'cpu_wall_time_ratio']
+    df_cpu_wall = df_cpu_wall[['stories', 'avg']]
+    df_cpu_wall = df_cpu_wall.rename(columns={'avg': 'cpu_wall_time_ratio'})
+
+    df = pandas.merge(df_frame_times, df_cpu_wall, on='stories')
     df['index'] = index
     return df
   except:
@@ -115,21 +121,22 @@
     upper_limit = avg_df.quantile(percentile, axis = 1)
     ci_df = data_frame.pivot(index='stories', columns='index', values='ci_095')
     upper_limit_ci = ci_df.quantile(percentile, axis = 1)
+    cpu_wall_df = data_frame.pivot(index='stories',
+                                   columns='index',
+                                   values='cpu_wall_time_ratio')
+    upper_limit_cpu_wall = cpu_wall_df.quantile(1 - percentile, axis=1)
+
     results = {}
     for index in avg_df.index:
       results[index] = {
-        'avg': round(upper_limit[index], 3),
-        'ci_095': round(upper_limit_ci[index], 3)
+          'avg': round(upper_limit[index], 3),
+          'ci_095': round(upper_limit_ci[index], 3),
+          'cpu_wall_time_ratio': round(upper_limit_cpu_wall[index], 3)
       }
     return results
 
 
 def MeasureNewUpperLimit(old_value, new_value, att_name, max_change):
-  # There has been an improvement.
-  if new_value < old_value:
-    # Decrease the limit gradually in case of improvements.
-    new_value = (old_value + new_value) / 2.0
-
   change_pct = 0.0
   if old_value > 0:
     change_pct = (new_value - old_value) / old_value
@@ -188,8 +195,19 @@
           results[platform][story]['ci_095'], 'CI', max_change)
         results[platform][story]['ci_095'] = new_ci
 
+        new_cpu_ratio, max_change = MeasureNewUpperLimit(
+            current_upper_limits[platform][story]['cpu_wall_time_ratio'],
+            results[platform][story]['cpu_wall_time_ratio'],
+            'CPU_wall_time_ratio', max_change)
+        results[platform][story]['cpu_wall_time_ratio'] = new_cpu_ratio
+
         if current_upper_limits[platform][story].get('control', False):
           results[platform][story]['control'] = True
+        if current_upper_limits[platform][story].get('experimental', False):
+          results[platform][story]['experimental'] = True
+        comment = current_upper_limits[platform][story].get('_comment', False)
+        if not comment == False:
+          results[platform][story]['_comment'] = comment
 
   if max_change > CHANGE_PERCENTAGE_LIMIT:
     with open(
diff --git a/ui/base/l10n/time_format.cc b/ui/base/l10n/time_format.cc
index 84c4188..0c0f319 100644
--- a/ui/base/l10n/time_format.cc
+++ b/ui/base/l10n/time_format.cc
@@ -10,6 +10,7 @@
 #include "base/component_export.h"
 #include "base/lazy_instance.h"
 #include "base/notreached.h"
+#include "base/numerics/safe_conversions.h"
 #include "base/strings/string_util.h"
 #include "base/time/time.h"
 #include "third_party/icu/source/common/unicode/unistr.h"
@@ -55,92 +56,87 @@
     int cutoff,
     const base::TimeDelta& delta,
     bool with_month_and_year) {
-  if (delta < TimeDelta::FromSeconds(0)) {
-    NOTREACHED() << "Negative duration";
-    return base::string16();
-  }
+  DCHECK_GE(delta, TimeDelta());
 
   // Negative cutoff: always use two-value format.
   if (cutoff < 0)
     cutoff = std::numeric_limits<int>::max();
 
-  const TimeDelta one_minute(TimeDelta::FromMinutes(1));
-  const TimeDelta one_hour(TimeDelta::FromHours(1));
-  const TimeDelta one_day(TimeDelta::FromDays(1));
+  constexpr TimeDelta kMinute = TimeDelta::FromMinutes(1);
+  constexpr TimeDelta kHour = TimeDelta::FromHours(1);
+  constexpr TimeDelta kDay = TimeDelta::FromDays(1);
 
   // Simplify one year to be 365 days.
-  const TimeDelta one_year(365 * one_day);
+  constexpr TimeDelta kYear = 365 * kDay;
 
   // An average month is a twelfth of a year.
-  const TimeDelta one_month(one_year / 12);
+  constexpr TimeDelta kMonth = kYear / 12;
 
-  const TimeDelta half_second(TimeDelta::FromSeconds(1) / 2);
-  const TimeDelta half_minute(one_minute / 2);
-  const TimeDelta half_hour(one_hour / 2);
-  const TimeDelta half_day(one_day / 2);
+  constexpr TimeDelta kHalfSecond = TimeDelta::FromSeconds(1) / 2;
+  constexpr TimeDelta kHalfMinute = kMinute / 2;
+  constexpr TimeDelta kHalfHour = kHour / 2;
+  constexpr TimeDelta kHalfDay = kDay / 2;
 
   // Rationale: Start by determining major (first) unit, then add minor (second)
   // unit if mandated by |cutoff|.
   icu::UnicodeString time_string;
   const Formatter* formatter = g_container.Get().Get(format, length);
-  if (delta < one_minute - half_second) {
+  if (delta < kMinute - kHalfSecond) {
     // Anything up to 59.500 seconds is formatted as seconds.
-    const int seconds = static_cast<int>((delta + half_second).InSeconds());
+    const int seconds = base::Round(delta.InSecondsF());
     formatter->Format(Formatter::UNIT_SEC, seconds, &time_string);
-
-  } else if (delta < one_hour - (cutoff < base::Time::kMinutesPerHour
-                                     ? half_minute
-                                     : half_second)) {
+  } else if (delta < kHour - (cutoff < base::Time::kMinutesPerHour
+                                  ? kHalfMinute
+                                  : kHalfSecond)) {
     // Anything up to 59.5 minutes (respectively 59:59.500 when |cutoff| permits
     // two-value output) is formatted as minutes (respectively minutes and
     // seconds).
-    if (delta >= cutoff * one_minute - half_second) {
-      const int minutes = (delta + half_minute).InMinutes();
+    if (delta >= cutoff * kMinute - kHalfSecond) {
+      const int minutes = (delta + kHalfMinute).InMinutes();
       formatter->Format(Formatter::UNIT_MIN, minutes, &time_string);
     } else {
-      const int minutes = (delta + half_second).InMinutes();
-      const int seconds = static_cast<int>((delta + half_second).InSeconds() %
-                                           base::Time::kSecondsPerMinute);
+      const int minutes = (delta + kHalfSecond).InMinutes();
+      const int seconds =
+          base::Round(delta.InSecondsF()) % base::Time::kSecondsPerMinute;
       formatter->Format(Formatter::TWO_UNITS_MIN_SEC,
                         minutes, seconds, &time_string);
     }
-
-  } else if (delta < one_day - (cutoff < base::Time::kHoursPerDay
-                                    ? half_hour
-                                    : half_minute)) {
+  } else if (delta < kDay - (cutoff < base::Time::kHoursPerDay ? kHalfHour
+                                                               : kHalfMinute)) {
     // Anything up to 23.5 hours (respectively 23:59:30.000 when |cutoff|
     // permits two-value output) is formatted as hours (respectively hours and
     // minutes).
-    if (delta >= cutoff * one_hour - half_minute) {
-      const int hours = (delta + half_hour).InHours();
+    if (delta >= cutoff * kHour - kHalfMinute) {
+      const int hours = (delta + kHalfHour).InHours();
       formatter->Format(Formatter::UNIT_HOUR, hours, &time_string);
     } else {
-      const int hours = (delta + half_minute).InHours();
+      const int hours = (delta + kHalfMinute).InHours();
       const int minutes =
-          (delta + half_minute).InMinutes() % base::Time::kMinutesPerHour;
+          (delta + kHalfMinute).InMinutes() % base::Time::kMinutesPerHour;
       formatter->Format(Formatter::TWO_UNITS_HOUR_MIN,
                         hours, minutes, &time_string);
     }
-  } else if (!with_month_and_year || delta < one_month) {
+  } else if (!with_month_and_year || delta < kMonth) {
     // Anything bigger is formatted as days (respectively days and hours).
-    if (delta >= cutoff * one_day - half_hour) {
-      const int days = (delta + half_day).InDays();
+    if (delta >= cutoff * kDay - kHalfHour) {
+      const int days = (delta + kHalfDay).InDays();
       formatter->Format(Formatter::UNIT_DAY, days, &time_string);
     } else {
-      const int days = (delta + half_hour).InDays();
+      const int days = (delta + kHalfHour).InDays();
       const int hours =
-          (delta + half_hour).InHours() % base::Time::kHoursPerDay;
-      formatter->Format(Formatter::TWO_UNITS_DAY_HOUR,
-                        days, hours, &time_string);
+          (delta + kHalfHour).InHours() % base::Time::kHoursPerDay;
+      formatter->Format(Formatter::TWO_UNITS_DAY_HOUR, days, hours,
+                        &time_string);
     }
-  } else if (delta < one_year) {
+  } else if (delta < kYear) {
     DCHECK(with_month_and_year);
-    int month = delta / one_month;
-    DCHECK(month >= 1 && month <= 12);
+    const int month = delta / kMonth;
+    DCHECK_GE(month, 1);
+    DCHECK_LE(month, 12);
     formatter->Format(Formatter::UNIT_MONTH, month, &time_string);
   } else {
     DCHECK(with_month_and_year);
-    int year = delta / one_year;
+    const int year = delta / kYear;
     formatter->Format(Formatter::UNIT_YEAR, year, &time_string);
   }
 
@@ -158,19 +154,19 @@
 base::string16 TimeFormat::RelativeDate(
     const base::Time& time,
     const base::Time* optional_midnight_today) {
-  base::Time midnight_today = optional_midnight_today
-                                  ? *optional_midnight_today
-                                  : base::Time::Now().LocalMidnight();
-  TimeDelta day = TimeDelta::FromDays(1);
-  base::Time tomorrow = midnight_today + day;
-  base::Time yesterday = midnight_today - day;
+  const base::Time midnight_today = optional_midnight_today
+                                        ? *optional_midnight_today
+                                        : base::Time::Now().LocalMidnight();
+  constexpr TimeDelta kDay = TimeDelta::FromDays(1);
+  const base::Time tomorrow = midnight_today + kDay;
+  const base::Time yesterday = midnight_today - kDay;
   if (time >= tomorrow)
     return base::string16();
-  else if (time >= midnight_today)
+  if (time >= midnight_today)
     return l10n_util::GetStringUTF16(IDS_PAST_TIME_TODAY);
-  else if (time >= yesterday)
-    return l10n_util::GetStringUTF16(IDS_PAST_TIME_YESTERDAY);
-  return base::string16();
+  return (time >= yesterday)
+             ? l10n_util::GetStringUTF16(IDS_PAST_TIME_YESTERDAY)
+             : base::string16();
 }
 
 }  // namespace ui
diff --git a/ui/events/gesture_detection/motion_event_buffer_unittest.cc b/ui/events/gesture_detection/motion_event_buffer_unittest.cc
index a7c18aa..35a1bdc 100644
--- a/ui/events/gesture_detection/motion_event_buffer_unittest.cc
+++ b/ui/events/gesture_detection/motion_event_buffer_unittest.cc
@@ -832,38 +832,33 @@
 }
 
 TEST_F(MotionEventBufferTest, Resampling30to60) {
-  base::TimeDelta flush_time_delta = base::TimeDelta::FromSeconds(1) / 60;
-  base::TimeDelta event_time_delta = base::TimeDelta::FromSeconds(1) / 30;
-
-  RunResample(flush_time_delta, event_time_delta);
+  constexpr auto kFlushTimeDelta = base::TimeDelta::FromSeconds(1) / 60;
+  constexpr auto kEventTimeDelta = base::TimeDelta::FromSeconds(1) / 30;
+  RunResample(kFlushTimeDelta, kEventTimeDelta);
 }
 
 TEST_F(MotionEventBufferTest, Resampling60to60) {
-  base::TimeDelta flush_time_delta = base::TimeDelta::FromSeconds(1) / 60;
-  base::TimeDelta event_time_delta = base::TimeDelta::FromSeconds(1) / 60;
-
-  RunResample(flush_time_delta, event_time_delta);
+  constexpr auto kFlushTimeDelta = base::TimeDelta::FromSeconds(1) / 60;
+  constexpr auto kEventTimeDelta = base::TimeDelta::FromSeconds(1) / 60;
+  RunResample(kFlushTimeDelta, kEventTimeDelta);
 }
 
 TEST_F(MotionEventBufferTest, Resampling100to60) {
-  base::TimeDelta flush_time_delta = base::TimeDelta::FromSeconds(1) / 60;
-  base::TimeDelta event_time_delta = base::TimeDelta::FromSeconds(1) / 100;
-
-  RunResample(flush_time_delta, event_time_delta);
+  constexpr auto kFlushTimeDelta = base::TimeDelta::FromSeconds(1) / 60;
+  constexpr auto kEventTimeDelta = base::TimeDelta::FromSeconds(1) / 100;
+  RunResample(kFlushTimeDelta, kEventTimeDelta);
 }
 
 TEST_F(MotionEventBufferTest, Resampling120to60) {
-  base::TimeDelta flush_time_delta = base::TimeDelta::FromSeconds(1) / 60;
-  base::TimeDelta event_time_delta = base::TimeDelta::FromSeconds(1) / 120;
-
-  RunResample(flush_time_delta, event_time_delta);
+  constexpr auto kFlushTimeDelta = base::TimeDelta::FromSeconds(1) / 60;
+  constexpr auto kEventTimeDelta = base::TimeDelta::FromSeconds(1) / 120;
+  RunResample(kFlushTimeDelta, kEventTimeDelta);
 }
 
 TEST_F(MotionEventBufferTest, Resampling150to60) {
-  base::TimeDelta flush_time_delta = base::TimeDelta::FromSeconds(1) / 60;
-  base::TimeDelta event_time_delta = base::TimeDelta::FromSeconds(1) / 150;
-
-  RunResample(flush_time_delta, event_time_delta);
+  constexpr auto kFlushTimeDelta = base::TimeDelta::FromSeconds(1) / 60;
+  constexpr auto kEventTimeDelta = base::TimeDelta::FromSeconds(1) / 150;
+  RunResample(kFlushTimeDelta, kEventTimeDelta);
 }
 
 }  // namespace ui
diff --git a/ui/gfx/paint_throbber.cc b/ui/gfx/paint_throbber.cc
index e59b25b..034ac5c3 100644
--- a/ui/gfx/paint_throbber.cc
+++ b/ui/gfx/paint_throbber.cc
@@ -98,8 +98,8 @@
   // This tween is equivalent to cubic-bezier(0.4, 0.0, 0.2, 1).
   double sweep = kMaxArcSize *
                  Tween::CalculateValue(Tween::FAST_OUT_SLOW_IN, arc_progress);
-  const int64_t sweep_keyframe = (elapsed_time / kArcTime) % 2;
-  if (sweep_keyframe == 0)
+  const int64_t sweep_frame = elapsed_time / kArcTime;
+  if (sweep_frame % 2 == 0)
     sweep -= kMaxArcSize;
 
   // This part makes sure the sweep is at least 5 degrees long. Roughly
@@ -115,7 +115,7 @@
 
   // To keep the sweep smooth, we have an additional rotation after each
   // arc period has elapsed. See SVG's 'rot' animation.
-  const int64_t rot_keyframe = (elapsed_time / (kArcTime * 2)) % 4;
+  const int64_t rot_keyframe = (sweep_frame / 2) % 4;
   PaintArc(canvas, bounds, color, start_angle + rot_keyframe * kMaxArcSize,
            sweep, stroke_width);
 }
@@ -171,12 +171,10 @@
 
   // Blend the color between "waiting" and "spinning" states.
   constexpr auto kColorFadeTime = base::TimeDelta::FromMilliseconds(900);
-  float color_progress = 1.0f;
-  if (elapsed_time < kColorFadeTime) {
-    color_progress = float{Tween::CalculateValue(
-        Tween::LINEAR_OUT_SLOW_IN,
-        elapsed_time.InMicrosecondsF() / kColorFadeTime.InMicrosecondsF())};
-  }
+  const float color_progress = float{Tween::CalculateValue(
+      Tween::LINEAR_OUT_SLOW_IN, std::min(elapsed_time.InMicrosecondsF() /
+                                              kColorFadeTime.InMicrosecondsF(),
+                                          1.0))};
   const SkColor blend_color =
       color_utils::AlphaBlend(color, waiting_state->color, color_progress);
 
diff --git a/ui/gfx/text_utils.cc b/ui/gfx/text_utils.cc
index fa062ea..dba839e 100644
--- a/ui/gfx/text_utils.cc
+++ b/ui/gfx/text_utils.cc
@@ -11,6 +11,10 @@
 #include "base/numerics/safe_conversions.h"
 #include "third_party/icu/source/common/unicode/uchar.h"
 #include "third_party/icu/source/common/unicode/utf16.h"
+#include "ui/gfx/font_list.h"
+#include "ui/gfx/geometry/insets.h"
+#include "ui/gfx/geometry/rect.h"
+#include "ui/gfx/geometry/size.h"
 
 namespace gfx {
 
@@ -126,4 +130,36 @@
   return alignment;
 }
 
+Size GetStringSize(const base::string16& text, const FontList& font_list) {
+  return Size(GetStringWidth(text, font_list), font_list.GetHeight());
+}
+
+Insets AdjustVisualBorderForFont(const FontList& font_list,
+                                 const Insets& desired_visual_padding) {
+  Insets result = desired_visual_padding;
+  const int baseline = font_list.GetBaseline();
+  const int leading_space = baseline - font_list.GetCapHeight();
+  const int descender = font_list.GetHeight() - baseline;
+  result.set_top(std::max(0, result.top() - leading_space));
+  result.set_bottom(std::max(0, result.bottom() - descender));
+  return result;
+}
+
+int GetFontCapHeightCenterOffset(const gfx::FontList& original_font,
+                                 const gfx::FontList& to_center) {
+  const int original_cap_height = original_font.GetCapHeight();
+  const int original_cap_leading =
+      original_font.GetBaseline() - original_cap_height;
+  const int to_center_cap_height = to_center.GetCapHeight();
+  const int to_center_leading = to_center.GetBaseline() - to_center_cap_height;
+
+  const int cap_height_diff = original_cap_height - to_center_cap_height;
+  const int new_cap_top =
+      original_cap_leading + std::lround(cap_height_diff / 2.0f);
+  const int new_top = new_cap_top - to_center_leading;
+
+  // Since we assume the old font starts at zero, the new top is the adjustment.
+  return new_top;
+}
+
 }  // namespace gfx
diff --git a/ui/gfx/text_utils.h b/ui/gfx/text_utils.h
index 4b6b5ca..ea342ee5 100644
--- a/ui/gfx/text_utils.h
+++ b/ui/gfx/text_utils.h
@@ -14,6 +14,8 @@
 namespace gfx {
 
 class FontList;
+class Insets;
+class Size;
 
 // Strip the accelerator char (typically '&') from a menu string.  A double
 // accelerator char ('&&') will be converted to a single char.  The out params
@@ -31,6 +33,12 @@
 GFX_EXPORT int GetStringWidth(const base::string16& text,
                               const FontList& font_list);
 
+// Returns the size required to render |text| in |font_list|. This includes all
+// leading space, descender area, etc. even if the text to render does not
+// contain characters with ascenders or descenders.
+GFX_EXPORT Size GetStringSize(const base::string16& text,
+                              const FontList& font_list);
+
 // This is same as GetStringWidth except that fractional width is returned.
 GFX_EXPORT float GetStringWidthF(const base::string16& text,
                                  const FontList& font_list);
@@ -50,6 +58,72 @@
 // If the UI layout is right-to-left, flip the alignment direction.
 GFX_EXPORT HorizontalAlignment MaybeFlipForRTL(HorizontalAlignment alignment);
 
+// Returns insets that can be used to draw a highlight or border that appears to
+// be distance |desired_visual_padding| from the body of a string of text
+// rendered using |font_list|. The insets are adjusted based on the box used to
+// render capital letters (or the bodies of most letters in non-capital fonts
+// like Hebrew and Devanagari), in order to give the best visual appearance.
+//
+// That is, any portion of |desired_visual_padding| overlapping the font's
+// leading space or descender area are truncated, to a minimum of zero.
+//
+// In this example, the text is rendered in a highlight that stretches above and
+// below the height of the H as well as to the left and right of the text
+// (|desired_visual_padding| = {2, 2, 2, 2}). Note that the descender of the 'y'
+// overlaps with the padding, as it is outside the capital letter box.
+//
+// The resulting padding is {1, 2, 1, 2}.
+//
+//  . . . . . . . . . .                               | actual top
+//  .                 .  |              | leading space
+//  .  |  |  _        .  | font    | capital
+//  .  |--| /_\ \  /  .  | height  | height
+//  .  |  | \_   \/   .  |         |
+//  .            /    .  |              | descender
+//  . . . . . . . . . .                               | actual bottom
+//  ___             ___
+//  actual        actual
+//  left           right
+//
+GFX_EXPORT Insets
+AdjustVisualBorderForFont(const FontList& font_list,
+                          const Insets& desired_visual_padding);
+
+// Returns the y adjustment necessary to align the center of the "cap size" box
+// - the space between a capital letter's top and bottom - between two fonts.
+// For non-capital scripts (e.g. Hebrew, Devanagari) the box containing the body
+// of most letters is used.
+//
+// A positive return value means the font |to_center| needs to be moved down
+// relative to the font |original_font|, while a negative value means it needs
+// to be moved up.
+//
+// Illustration:
+//
+//  original_font    to_center
+//  ----------                    ] - return value (+1)
+//  leading          ----------
+//  ----------       leading
+//                   ----------
+//
+//  cap-height       cap-height
+//
+//                   ----------
+//  ----------       descent
+//  descent          ----------
+//  ----------
+//
+// Visual result:           Non-Latin example (Devanagari ऐ "ai"):
+//                               \
+//  |\   |                    ------     \
+//  | \  |   |\ |              |  |    ----
+//  |  \ |   | \|               \ /     \|
+//  |   \|                       \       /
+//                                /
+//
+GFX_EXPORT int GetFontCapHeightCenterOffset(const gfx::FontList& original_font,
+                                            const gfx::FontList& to_center);
+
 }  // namespace gfx
 
 #endif  // UI_GFX_TEXT_UTILS_H_
diff --git a/ui/gfx/text_utils_unittest.cc b/ui/gfx/text_utils_unittest.cc
index 564ec40..ed1eb98 100644
--- a/ui/gfx/text_utils_unittest.cc
+++ b/ui/gfx/text_utils_unittest.cc
@@ -6,12 +6,17 @@
 
 #include <stddef.h>
 
+#include <vector>
+
 #include "base/logging.h"
 #include "base/stl_util.h"
 #include "base/strings/utf_string_conversions.h"
 #include "build/build_config.h"
 #include "testing/gtest/include/gtest/gtest.h"
 #include "ui/gfx/font_list.h"
+#include "ui/gfx/geometry/insets.h"
+#include "ui/gfx/geometry/point.h"
+#include "ui/gfx/geometry/rect.h"
 
 namespace gfx {
 namespace {
@@ -37,6 +42,81 @@
             GetStringWidth(base::ASCIIToUTF16("ab"), font_list));
 }
 
+TEST(TextUtilsTest, GetStringSize) {
+  std::vector<base::string16> strings{
+      base::string16(),
+      base::ASCIIToUTF16("a"),
+      base::ASCIIToUTF16("abc"),
+  };
+
+  FontList font_list;
+  for (base::string16 string : strings) {
+    gfx::Size size = GetStringSize(string, font_list);
+    EXPECT_EQ(GetStringWidth(string, font_list), size.width())
+        << " input string is \"" << string << "\"";
+    EXPECT_EQ(font_list.GetHeight(), size.height())
+        << " input string is \"" << string << "\"";
+  }
+}
+
+TEST(TextUtilsTest, AdjustVisualBorderForFont_BorderLargerThanFont) {
+  FontList font_list;
+
+  // We will make some assumptions about the default font - specifically that it
+  // has leading space and space for the descender.
+  DCHECK_GT(font_list.GetBaseline(), font_list.GetCapHeight());
+  DCHECK_LT(font_list.GetBaseline(), font_list.GetHeight());
+
+  // Adjust a large border for the default font. Using a large number means that
+  // the border will extend outside the leading and descender area of the font.
+  constexpr gfx::Insets kOriginalBorder(20);
+  const gfx::Insets result =
+      AdjustVisualBorderForFont(font_list, kOriginalBorder);
+  EXPECT_EQ(result.left(), kOriginalBorder.left());
+  EXPECT_EQ(result.right(), kOriginalBorder.right());
+  EXPECT_LT(result.top(), kOriginalBorder.top());
+  EXPECT_LT(result.bottom(), kOriginalBorder.bottom());
+}
+
+TEST(TextUtilsTest, AdjustVisualBorderForFont_BorderSmallerThanFont) {
+  FontList font_list;
+
+  // We will make some assumptions about the default font - specifically that it
+  // has leading space and space for the descender.
+  DCHECK_GT(font_list.GetBaseline(), font_list.GetCapHeight());
+  DCHECK_LT(font_list.GetBaseline(), font_list.GetHeight());
+
+  // Adjust a border with a small vertical component. The vertical component
+  // should go to zero because it overlaps the leading and descender areas of
+  // the font.
+  constexpr gfx::Insets kSmallVerticalInsets(1, 20);
+  const gfx::Insets result =
+      AdjustVisualBorderForFont(font_list, kSmallVerticalInsets);
+  EXPECT_EQ(result.left(), kSmallVerticalInsets.left());
+  EXPECT_EQ(result.right(), kSmallVerticalInsets.right());
+  EXPECT_EQ(result.top(), 0);
+  EXPECT_EQ(result.bottom(), 0);
+}
+
+TEST(TextUtilsTest, GetFontCapHeightCenterOffset_SecondFontIsSmaller) {
+  FontList original_font;
+  FontList smaller_font = original_font.DeriveWithSizeDelta(-3);
+  DCHECK_LT(smaller_font.GetCapHeight(), original_font.GetCapHeight());
+  EXPECT_GT(GetFontCapHeightCenterOffset(original_font, smaller_font), 0);
+}
+
+TEST(TextUtilsTest, GetFontCapHeightCenterOffset_SecondFontIsLarger) {
+  FontList original_font;
+  FontList larger_font = original_font.DeriveWithSizeDelta(3);
+  DCHECK_GT(larger_font.GetCapHeight(), original_font.GetCapHeight());
+  EXPECT_LT(GetFontCapHeightCenterOffset(original_font, larger_font), 0);
+}
+
+TEST(TextUtilsTest, GetFontCapHeightCenterOffset_SameSize) {
+  FontList original_font;
+  EXPECT_EQ(0, GetFontCapHeightCenterOffset(original_font, original_font));
+}
+
 class RemoveAcceleratorCharTest
     : public testing::TestWithParam<RemoveAcceleratorCharData> {
  public:
diff --git a/ui/views/controls/menu/menu_item_view.cc b/ui/views/controls/menu/menu_item_view.cc
index 6d06d6f..262ea70 100644
--- a/ui/views/controls/menu/menu_item_view.cc
+++ b/ui/views/controls/menu/menu_item_view.cc
@@ -55,9 +55,38 @@
 
 // Difference in the font size (in pixels) between menu label font and "new"
 // badge font size.
-constexpr int kNewBadgeFontSizeAdjustment = -2;
-constexpr int kNewBadgeHorizontalMargin = 6;
-constexpr int kNewBadgeInternalPadding = 2;
+constexpr int kNewBadgeFontSizeAdjustment = -1;
+
+// Space between primary text and "new" badge.
+constexpr int kNewBadgeHorizontalMargin = 8;
+
+// Highlight size around "new" badge.
+constexpr gfx::Insets kNewBadgeInternalPadding{4};
+
+// The corner radius of the rounded rect for the "new" badge.
+constexpr int kNewBadgeCornerRadius = 3;
+static_assert(kNewBadgeCornerRadius <= kNewBadgeInternalPadding.left(),
+              "New badge corner radius should not exceed padding.");
+
+// Returns the horizontal space required for the "new" badge.
+int GetNewBadgeRequiredWidth(const gfx::FontList& primary_font) {
+  const base::string16 new_text =
+      l10n_util::GetStringUTF16(IDS_MENU_ITEM_NEW_BADGE);
+  gfx::FontList badge_font =
+      primary_font.DeriveWithSizeDelta(kNewBadgeFontSizeAdjustment);
+  return gfx::GetStringWidth(new_text, badge_font) +
+         kNewBadgeInternalPadding.width() + 2 * kNewBadgeHorizontalMargin;
+}
+
+// Returns the highlight rect for the "new" badge given the font and text rect
+// for the badge text.
+gfx::Rect GetNewBadgeRectOutsetAroundText(const gfx::FontList& badge_font,
+                                          const gfx::Rect& badge_text_rect) {
+  gfx::Rect badge_rect = badge_text_rect;
+  badge_rect.Inset(
+      -gfx::AdjustVisualBorderForFont(badge_font, kNewBadgeInternalPadding));
+  return badge_rect;
+}
 
 // EmptyMenuMenuItem ---------------------------------------------------------
 
@@ -969,24 +998,20 @@
   // The rest should be drawn with the minor foreground color.
   style.foreground = GetTextColor(/*minor=*/true, render_selection);
   if (!secondary_title().empty()) {
-    gfx::Rect secondary_bounds = text_bounds;
-    secondary_bounds.set_y(secondary_bounds.y() + text_height);
+    text_bounds.set_y(text_bounds.y() + text_height);
     canvas->DrawStringRectWithFlags(secondary_title(), style.font_list,
-                                    style.foreground, secondary_bounds, flags);
+                                    style.foreground, text_bounds, flags);
   }
 
   PaintMinorIconAndText(canvas, style);
 
   if (ShouldShowNewBadge()) {
-    const int title_width = gfx::GetStringWidth(title(), style.font_list);
-    gfx::Rect new_bounds = text_bounds;
-    if (base::i18n::IsRTL())
-      new_bounds.Inset(kNewBadgeHorizontalMargin, 0,
-                       title_width + kNewBadgeHorizontalMargin, 0);
-    else
-      new_bounds.Inset(title_width + kNewBadgeHorizontalMargin, 0,
-                       kNewBadgeHorizontalMargin, 0);
-    DrawNewBadge(canvas, new_bounds, flags, style.font_list);
+    DrawNewBadge(
+        canvas,
+        gfx::Point(label_start + gfx::GetStringWidth(title(), style.font_list) +
+                       kNewBadgeHorizontalMargin,
+                   top_margin),
+        style.font_list, flags);
   }
 
   // Set the submenu indicator (arrow) image and color.
@@ -1304,6 +1329,40 @@
   return label_start;
 }
 
+void MenuItemView::DrawNewBadge(gfx::Canvas* canvas,
+                                const gfx::Point& unmirrored_badge_start,
+                                const gfx::FontList& primary_font,
+                                int text_render_flags) {
+  gfx::FontList badge_font =
+      primary_font.DeriveWithSizeDelta(kNewBadgeFontSizeAdjustment);
+  const base::string16 new_text =
+      l10n_util::GetStringUTF16(IDS_MENU_ITEM_NEW_BADGE);
+
+  // Calculate bounding box for badge text.
+  gfx::Rect badge_text_bounds(unmirrored_badge_start,
+                              gfx::GetStringSize(new_text, badge_font));
+  badge_text_bounds.Offset(
+      kNewBadgeInternalPadding.left(),
+      gfx::GetFontCapHeightCenterOffset(primary_font, badge_font));
+  if (base::i18n::IsRTL())
+    badge_text_bounds.set_x(GetMirroredXForRect(badge_text_bounds));
+
+  // Render the badge itself.
+  cc::PaintFlags new_flags;
+  const SkColor background_color = GetNativeTheme()->GetSystemColor(
+      ui::NativeTheme::kColorId_ProminentButtonColor);
+  new_flags.setColor(background_color);
+  canvas->DrawRoundRect(
+      GetNewBadgeRectOutsetAroundText(badge_font, badge_text_bounds),
+      kNewBadgeCornerRadius, new_flags);
+
+  // Render the badge text.
+  const SkColor foreground_color = GetNativeTheme()->GetSystemColor(
+      ui::NativeTheme::kColorId_TextOnProminentButtonColor);
+  canvas->DrawStringRectWithFlags(new_text, badge_font, foreground_color,
+                                  badge_text_bounds, text_render_flags);
+}
+
 base::string16 MenuItemView::GetMinorText() const {
   if (GetID() == kEmptyMenuItemViewID) {
     // Don't query the delegate for menus that represent no children.
@@ -1387,52 +1446,6 @@
   return feature_enabled && is_new_;
 }
 
-void MenuItemView::DrawNewBadge(gfx::Canvas* canvas,
-                                gfx::Rect badge_bounds,
-                                int render_flags,
-                                const gfx::FontList& font_list) {
-  const base::string16 new_text =
-      l10n_util::GetStringUTF16(IDS_MENU_ITEM_NEW_BADGE);
-  gfx::FontList badge_font =
-      font_list.DeriveWithSizeDelta(kNewBadgeFontSizeAdjustment);
-
-  const int text_width = gfx::GetStringWidth(new_text, badge_font);
-  const int badge_width = text_width + 2 * kNewBadgeInternalPadding;
-  const int width_diff = badge_bounds.width() - badge_width;
-  if (base::i18n::IsRTL())
-    badge_bounds.Inset(width_diff, 0, 0, 0);
-  else
-    badge_bounds.Inset(0, 0, width_diff, 0);
-
-  cc::PaintFlags new_flags;
-  const SkColor background_color = GetNativeTheme()->GetSystemColor(
-      ui::NativeTheme::kColorId_ProminentButtonColor);
-  new_flags.setColor(background_color);
-  constexpr int kBadgeRadius = 4;
-  canvas->DrawRoundRect(badge_bounds, kBadgeRadius, new_flags);
-
-  const int height_diff = badge_bounds.height() - badge_font.GetHeight();
-  badge_bounds.Inset(kNewBadgeInternalPadding, height_diff / 2,
-                     kNewBadgeInternalPadding, (height_diff + 1) / 2);
-  const SkColor foreground_color = GetNativeTheme()->GetSystemColor(
-      ui::NativeTheme::kColorId_TextOnProminentButtonColor);
-  canvas->DrawStringRectWithFlags(new_text, badge_font, foreground_color,
-                                  badge_bounds, render_flags);
-}
-
-int MenuItemView::GetNewBadgeRequiredWidth(
-    const gfx::FontList& font_list) const {
-  const base::string16 new_text =
-      l10n_util::GetStringUTF16(IDS_MENU_ITEM_NEW_BADGE);
-  gfx::FontList badge_font =
-      font_list.DeriveWithSizeDelta(kNewBadgeFontSizeAdjustment);
-
-  // Reserve space on either side of the label text for the badge's internal
-  // padding and margin between it and other elements.
-  return gfx::GetStringWidth(new_text, badge_font) +
-         2 * (kNewBadgeInternalPadding + kNewBadgeHorizontalMargin);
-}
-
 BEGIN_METADATA(MenuItemView)
 METADATA_PARENT_CLASS(View)
 END_METADATA()
diff --git a/ui/views/controls/menu/menu_item_view.h b/ui/views/controls/menu/menu_item_view.h
index 8319fe6..01b7975 100644
--- a/ui/views/controls/menu/menu_item_view.h
+++ b/ui/views/controls/menu/menu_item_view.h
@@ -453,6 +453,13 @@
   // Get the horizontal position at which to draw the menu item's label.
   int GetLabelStartForThisItem() const;
 
+  // Draws the "new" badge on |canvas|. |unmirrored_badge_start| is the
+  // upper-left corner of the badge, not mirrored for RTL.
+  void DrawNewBadge(gfx::Canvas* canvas,
+                    const gfx::Point& unmirrored_badge_start,
+                    const gfx::FontList& primary_font,
+                    int text_render_flags);
+
   // Used by MenuController to cache the menu position in use by the
   // active menu.
   MenuPosition actual_menu_position() const { return actual_menu_position_; }
@@ -488,16 +495,6 @@
   // Takes into account whether the badging feature is enabled.
   bool ShouldShowNewBadge() const;
 
-  // Renders a "New" badge on |canvas| in the given |badge_bounds|, which should
-  // be roughly adjacent to the menu item label.
-  void DrawNewBadge(gfx::Canvas* canvas,
-                    gfx::Rect badge_bounds,
-                    int render_flags,
-                    const gfx::FontList& font_list);
-
-  // Returns the additional width required for a "New" badge.
-  int GetNewBadgeRequiredWidth(const gfx::FontList& font_list) const;
-
   void invalidate_dimensions() { dimensions_.height = 0; }
   bool is_dimensions_valid() const { return dimensions_.height > 0; }
 
diff --git a/ui/views/examples/login_bubble_dialog.cc b/ui/views/examples/login_bubble_dialog.cc
index a83e00b9..587a6da 100644
--- a/ui/views/examples/login_bubble_dialog.cc
+++ b/ui/views/examples/login_bubble_dialog.cc
@@ -4,6 +4,9 @@
 
 #include "ui/views/examples/login_bubble_dialog.h"
 
+#include <memory>
+#include <utility>
+
 #include "base/bind.h"
 #include "base/callback_forward.h"
 #include "base/strings/strcat.h"
@@ -128,7 +131,7 @@
                         GridLayout::kFixedSize,
                         GridLayout::ColumnSize::kUsePreferred, 0, 0);
   column_set->AddPaddingColumn(0, label_padding);
-  column_set->AddColumn(GridLayout::FILL, GridLayout::FILL, 1.0,
+  column_set->AddColumn(GridLayout::LEADING, GridLayout::FILL, 1.0,
                         GridLayout::ColumnSize::kUsePreferred, 0, 0);
 
   layout->StartRowWithPadding(0, 0, 0, related_control_padding);
@@ -136,14 +139,16 @@
       MdTextButton::Create(this, GetStringUTF16(IDS_LOGIN_SHOW_BUTTON_LABEL)));
 
   layout->StartRowWithPadding(0, 0, 0, related_control_padding);
-  layout->AddView(std::make_unique<Label>(
+  username_label_ = layout->AddView(std::make_unique<Label>(
       l10n_util::GetStringUTF16(IDS_LOGIN_USERNAME_LABEL)));
-  username_label_ = layout->AddView(std::make_unique<Label>());
+  username_label_->SetVisible(false);
+  username_input_ = layout->AddView(std::make_unique<Label>());
 
   layout->StartRowWithPadding(0, 0, 0, related_control_padding);
-  layout->AddView(std::make_unique<Label>(
+  password_label_ = layout->AddView(std::make_unique<Label>(
       l10n_util::GetStringUTF16(IDS_LOGIN_PASSWORD_LABEL)));
-  password_label_ = layout->AddView(std::make_unique<Label>());
+  password_label_->SetVisible(false);
+  password_input_ = layout->AddView(std::make_unique<Label>());
 }
 
 void LoginBubbleDialogExample::ButtonPressed(Button* sender,
@@ -156,8 +161,10 @@
 
 void LoginBubbleDialogExample::OnSubmit(base::string16 username,
                                         base::string16 password) {
-  username_label_->SetText(username);
-  password_label_->SetText(password);
+  username_label_->SetVisible(true);
+  username_input_->SetText(username);
+  password_label_->SetVisible(true);
+  password_input_->SetText(password);
 }
 
 }  // namespace examples
diff --git a/ui/views/examples/login_bubble_dialog.h b/ui/views/examples/login_bubble_dialog.h
index d62ad3e..c338f09 100644
--- a/ui/views/examples/login_bubble_dialog.h
+++ b/ui/views/examples/login_bubble_dialog.h
@@ -62,7 +62,9 @@
  private:
   LabelButton* button_ = nullptr;
   Label* username_label_ = nullptr;
+  Label* username_input_ = nullptr;
   Label* password_label_ = nullptr;
+  Label* password_input_ = nullptr;
 };
 
 }  // namespace examples
diff --git a/weblayer/browser/java/org/chromium/weblayer_private/NavigationImpl.java b/weblayer/browser/java/org/chromium/weblayer_private/NavigationImpl.java
index 4afac6c..7815edb 100644
--- a/weblayer/browser/java/org/chromium/weblayer_private/NavigationImpl.java
+++ b/weblayer/browser/java/org/chromium/weblayer_private/NavigationImpl.java
@@ -154,6 +154,13 @@
         return NavigationImplJni.get().isPageInitiated(mNativeNavigationImpl);
     }
 
+    @Override
+    public boolean isReload() {
+        StrictModeWorkaround.apply();
+        throwIfNativeDestroyed();
+        return NavigationImplJni.get().isReload(mNativeNavigationImpl);
+    }
+
     private void throwIfNativeDestroyed() {
         if (mNativeNavigationImpl == 0) {
             throw new IllegalStateException("Using Navigation after native destroyed");
@@ -203,5 +210,6 @@
         boolean isValidRequestHeaderValue(String value);
         boolean setUserAgentString(long nativeNavigationImpl, String value);
         boolean isPageInitiated(long nativeNavigationImpl);
+        boolean isReload(long nativeNavigationImpl);
     }
 }
diff --git a/weblayer/browser/java/org/chromium/weblayer_private/interfaces/INavigation.aidl b/weblayer/browser/java/org/chromium/weblayer_private/interfaces/INavigation.aidl
index 9c63f20..5c94e34 100644
--- a/weblayer/browser/java/org/chromium/weblayer_private/interfaces/INavigation.aidl
+++ b/weblayer/browser/java/org/chromium/weblayer_private/interfaces/INavigation.aidl
@@ -32,4 +32,5 @@
 
   // @since 86
   boolean isPageInitiated() = 11;
+  boolean isReload() = 12;
 }
diff --git a/weblayer/browser/navigation_browsertest.cc b/weblayer/browser/navigation_browsertest.cc
index 73773c8..4d3c4ae 100644
--- a/weblayer/browser/navigation_browsertest.cc
+++ b/weblayer/browser/navigation_browsertest.cc
@@ -95,6 +95,7 @@
   bool completed() { return completed_; }
   bool is_error_page() { return is_error_page_; }
   bool is_download() { return is_download_; }
+  bool is_reload() { return is_reload_; }
   bool was_stop_called() { return was_stop_called_; }
   Navigation::LoadError load_error() { return load_error_; }
   int http_status_code() { return http_status_code_; }
@@ -112,6 +113,7 @@
   void Finish(Navigation* navigation) {
     is_error_page_ = navigation->IsErrorPage();
     is_download_ = navigation->IsDownload();
+    is_reload_ = navigation->IsReload();
     was_stop_called_ = navigation->WasStopCalled();
     load_error_ = navigation->GetLoadError();
     http_status_code_ = navigation->GetHttpStatusCode();
@@ -124,6 +126,7 @@
   bool completed_ = false;
   bool is_error_page_ = false;
   bool is_download_ = false;
+  bool is_reload_ = false;
   bool was_stop_called_ = false;
   Navigation::LoadError load_error_ = Navigation::kNoError;
   int http_status_code_ = 0;
@@ -150,6 +153,7 @@
   EXPECT_TRUE(observer.completed());
   EXPECT_FALSE(observer.is_error_page());
   EXPECT_FALSE(observer.is_download());
+  EXPECT_FALSE(observer.is_reload());
   EXPECT_FALSE(observer.was_stop_called());
   EXPECT_EQ(observer.load_error(), Navigation::kNoError);
   EXPECT_EQ(observer.http_status_code(), 200);
@@ -416,6 +420,22 @@
   run_loop.Run();
 }
 
+IN_PROC_BROWSER_TEST_F(NavigationBrowserTest, Reload) {
+  ASSERT_TRUE(embedded_test_server()->Start());
+
+  OneShotNavigationObserver observer(shell());
+  GetNavigationController()->Navigate(
+      embedded_test_server()->GetURL("/simple_page.html"));
+  observer.WaitForNavigation();
+
+  OneShotNavigationObserver observer2(shell());
+  shell()->tab()->ExecuteScript(base::ASCIIToUTF16("location.reload();"), false,
+                                base::DoNothing());
+  observer2.WaitForNavigation();
+  EXPECT_TRUE(observer2.completed());
+  EXPECT_TRUE(observer2.is_reload());
+}
+
 IN_PROC_BROWSER_TEST_F(NavigationBrowserTest, SetUserAgentString) {
   net::test_server::ControllableHttpResponse response_1(embedded_test_server(),
                                                         "", true);
diff --git a/weblayer/browser/navigation_impl.cc b/weblayer/browser/navigation_impl.cc
index b0d1304a..6c46ba9 100644
--- a/weblayer/browser/navigation_impl.cc
+++ b/weblayer/browser/navigation_impl.cc
@@ -91,6 +91,10 @@
   return navigation_handle_->IsRendererInitiated();
 }
 
+bool NavigationImpl::IsReload() {
+  return navigation_handle_->GetReloadType() != content::ReloadType::NONE;
+}
+
 GURL NavigationImpl::GetURL() {
   return navigation_handle_->GetURL();
 }
diff --git a/weblayer/browser/navigation_impl.h b/weblayer/browser/navigation_impl.h
index 20eae74..e351345 100644
--- a/weblayer/browser/navigation_impl.h
+++ b/weblayer/browser/navigation_impl.h
@@ -70,6 +70,7 @@
       JNIEnv* env,
       const base::android::JavaParamRef<jstring>& value);
   jboolean IsPageInitiated(JNIEnv* env) { return IsPageInitiated(); }
+  jboolean IsReload(JNIEnv* env) { return IsReload(); }
 
   base::android::ScopedJavaGlobalRef<jobject> java_navigation() {
     return java_navigation_;
@@ -91,6 +92,7 @@
                         const std::string& value) override;
   void SetUserAgentString(const std::string& value) override;
   bool IsPageInitiated() override;
+  bool IsReload() override;
 
   content::NavigationHandle* navigation_handle_;
 
diff --git a/weblayer/public/java/org/chromium/weblayer/Navigation.java b/weblayer/public/java/org/chromium/weblayer/Navigation.java
index c9548f1..ea54355 100644
--- a/weblayer/public/java/org/chromium/weblayer/Navigation.java
+++ b/weblayer/public/java/org/chromium/weblayer/Navigation.java
@@ -243,4 +243,24 @@
             throw new APICallException(e);
         }
     }
+
+    /**
+     * Whether the navigation is a reload. Examples of reloads include:
+     * * embedder-specified through NavigationController::Reload
+     * * page-initiated reloads, e.g. location.reload()
+     * * reloads when the network interface is reconnected
+     *
+     * @since 86
+     */
+    public boolean isReload() {
+        ThreadCheck.ensureOnUiThread();
+        if (WebLayer.getSupportedMajorVersionInternal() < 86) {
+            throw new UnsupportedOperationException();
+        }
+        try {
+            return mNavigationImpl.isReload();
+        } catch (RemoteException e) {
+            throw new APICallException(e);
+        }
+    }
 }
diff --git a/weblayer/public/navigation.h b/weblayer/public/navigation.h
index 147ad85..f895db8 100644
--- a/weblayer/public/navigation.h
+++ b/weblayer/public/navigation.h
@@ -115,6 +115,12 @@
   // This method returns false for navigations initiated by the WebLayer
   // API, including using window.history.forward() or window.history.back().
   virtual bool IsPageInitiated() = 0;
+
+  // Whether the navigation is a reload. Examples of reloads include:
+  // * embedder-specified through NavigationController::Reload
+  // * page-initiated reloads, e.g. location.reload()
+  // * reloads when the network interface is reconnected
+  virtual bool IsReload() = 0;
 };
 
 }  // namespace weblayer