diff --git a/BUILD.gn b/BUILD.gn
index 379cc811c..eff816b 100644
--- a/BUILD.gn
+++ b/BUILD.gn
@@ -1064,6 +1064,10 @@
       ]
     }
 
+    if (is_mac) {
+      data += [ "//third_party/apache-mac/" ]
+    }
+
     if (is_android) {
       data += [
         "//third_party/catapult/",
diff --git a/DEPS b/DEPS
index 6db1327..dda6f6f1 100644
--- a/DEPS
+++ b/DEPS
@@ -129,11 +129,11 @@
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling Skia
   # and whatever else without interference from each other.
-  'skia_revision': '33211b2c7a0260d8a1c1a11ef4a11a31d01473a8',
+  'skia_revision': '3d00c2d82386c510f5516a2c31b339c1a693a5a0',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling V8
   # and whatever else without interference from each other.
-  'v8_revision': '8fea8cc7643ed2cf5b66862c692492e031915617',
+  'v8_revision': '7857648f71ae10d7175cd5225fc73ffe873bba66',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling swarming_client
   # and whatever else without interference from each other.
@@ -145,7 +145,7 @@
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling SwiftShader
   # and whatever else without interference from each other.
-  'swiftshader_revision': 'e1cf863e65c64d056a4d815c856ffbc7ed39bbb2',
+  'swiftshader_revision': '54ec759a7405b99eb31bc31fca65e14a4093f9fc',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling PDFium
   # and whatever else without interference from each other.
@@ -196,7 +196,7 @@
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling catapult
   # and whatever else without interference from each other.
-  'catapult_revision': '85ead579637dd4350fb30d9fd4cbf0d8357b4dff',
+  'catapult_revision': 'e7ea071aeed43170d8fa5c5d0911c555487fd76c',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling libFuzzer
   # and whatever else without interference from each other.
@@ -252,7 +252,7 @@
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling feed
   # and whatever else without interference from each other.
-  'spv_tools_revision': '2d52cbee49019da5d664bb7e243fa6339c983c27',
+  'spv_tools_revision': '7d1b176c1d04b8716af8d0a71ad1e4c88c353f2a',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling feed
   # and whatever else without interference from each other.
@@ -268,7 +268,7 @@
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling feed
   # and whatever else without interference from each other.
-  'dawn_revision': '041aca1620e8f905df3342882af33618803b8a41',
+  'dawn_revision': 'd3d3aa03e109bdf6d9b0d8c73fba9ec91d3cc99f',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling feed
   # and whatever else without interference from each other.
@@ -805,7 +805,7 @@
 
   # Build tools for Chrome OS. Note: This depends on third_party/pyelftools.
   'src/third_party/chromite': {
-      'url': Var('chromium_git') + '/chromiumos/chromite.git' + '@' + 'eea1b00dcc553072f7c0b20d177c7bacef308b09',
+      'url': Var('chromium_git') + '/chromiumos/chromite.git' + '@' + 'a9200900078099d3ad024125e4b021975b627bcf',
       'condition': 'checkout_linux',
   },
 
@@ -1172,7 +1172,7 @@
   },
 
   'src/third_party/perfetto':
-    Var('android_git') + '/platform/external/perfetto.git' + '@' +  '72171b6c32f6a7572c2a9c78a5e3f7f5db01a135',
+    Var('android_git') + '/platform/external/perfetto.git' + '@' +  'c7c267a33ae0e35d9c60afa0cc3fc6cfda35c139',
 
   'src/third_party/perl': {
       'url': Var('chromium_git') + '/chromium/deps/perl.git' + '@' + 'ac0d98b5cee6c024b0cffeb4f8f45b6fc5ccdb78',
@@ -1343,7 +1343,7 @@
     Var('chromium_git') + '/external/khronosgroup/webgl.git' + '@' + 'a0f51b2e123f39c9ff12e621b0b47dd28dd64424',
 
   'src/third_party/webrtc':
-    Var('webrtc_git') + '/src.git' + '@' + '6da14388cd3c5d1b5b79840ad14d8d037deedc58',
+    Var('webrtc_git') + '/src.git' + '@' + '76ba7dbc4f952c44a9e26bbc293d58997857ce18',
 
   'src/third_party/xdg-utils': {
       'url': Var('chromium_git') + '/chromium/deps/xdg-utils.git' + '@' + 'd80274d5869b17b8c9067a1022e4416ee7ed5e0d',
@@ -1384,7 +1384,7 @@
     Var('chromium_git') + '/v8/v8.git' + '@' +  Var('v8_revision'),
 
   'src-internal': {
-    'url': 'https://chrome-internal.googlesource.com/chrome/src-internal.git@63c7431fdffe90c18251074a4e614561f8205605',
+    'url': 'https://chrome-internal.googlesource.com/chrome/src-internal.git@1483e9f714b7c2bf86bb6b4ca03ab7ca4efb48f1',
     'condition': 'checkout_src_internal',
   },
 
@@ -2517,9 +2517,24 @@
     ],
   },
   {
+    'name': 'apache_mac',
+    'pattern': '\\.sha1',
+    'condition': 'checkout_mac',
+    'action': [ 'python',
+                'src/third_party/depot_tools/download_from_google_storage.py',
+                '--no_resume',
+                '--directory',
+                '--recursive',
+                '--no_auth',
+                '--num_threads=16',
+                '--bucket', 'chromium-apache-mac',
+                'src/third_party/apache-mac',
+    ],
+  },
+  {
     'name': 'apache_win32',
     'pattern': '\\.sha1',
-    'condition': 'host_os == "win"',
+    'condition': 'checkout_win',
     'action': [ 'python',
                 'src/third_party/depot_tools/download_from_google_storage.py',
                 '--no_resume',
diff --git a/PRESUBMIT.py b/PRESUBMIT.py
index b462725..6f664d09 100644
--- a/PRESUBMIT.py
+++ b/PRESUBMIT.py
@@ -448,6 +448,26 @@
       (),
     ),
     (
+      r'/\bstd::to_string\b',
+      (
+        'std::to_string is locale dependent and slower than alternatives.',
+        'For locale-independent strings, e.g. writing numbers to and from',
+        'disk profiles, use base::NumberToString().',
+        'For user-visible strings, use base::FormatNumber() and',
+        'the related functions in base/i18n/number_formatting.h.',
+      ),
+      False,  # Only a warning for now since it is already used,
+      (r'third_party/'),  # Don't warn in third_party folders.
+    ),
+    (
+      r'/\bstd::shared_ptr\b',
+      (
+        'std::shared_ptr should not be used. Use scoped_refptr instead.',
+      ),
+      True,
+      (r'third_party/'),  # Not an error in third_party folders.
+    ),
+    (
       (r'/base::ThreadRestrictions::(ScopedAllowIO|AssertIOAllowed|'
        r'DisallowWaiting|AssertWaitAllowed|SetWaitAllowed|ScopedAllowWait)'),
       (
diff --git a/android_webview/browser/net/android_stream_reader_url_request_job_unittest.cc b/android_webview/browser/net/android_stream_reader_url_request_job_unittest.cc
index c3de1ac..c90c179f 100644
--- a/android_webview/browser/net/android_stream_reader_url_request_job_unittest.cc
+++ b/android_webview/browser/net/android_stream_reader_url_request_job_unittest.cc
@@ -390,7 +390,6 @@
   base::RunLoop loop;
   std::unique_ptr<StrictMock<MockInputStreamReader>> stream_reader(
       new StrictMock<MockInputStreamReader>());
-  net::CompletionCallback read_completion_callback;
   EXPECT_CALL(*stream_reader, Seek(_))
       .WillOnce(Return(bytes_available));
   EXPECT_CALL(*stream_reader, ReadRawData(_, _))
diff --git a/android_webview/glue/java/src/com/android/webview/chromium/WebViewChromiumFactoryProvider.java b/android_webview/glue/java/src/com/android/webview/chromium/WebViewChromiumFactoryProvider.java
index 9ab5e43..9d019b2c 100644
--- a/android_webview/glue/java/src/com/android/webview/chromium/WebViewChromiumFactoryProvider.java
+++ b/android_webview/glue/java/src/com/android/webview/chromium/WebViewChromiumFactoryProvider.java
@@ -34,6 +34,7 @@
 import org.chromium.android_webview.AwBrowserContext;
 import org.chromium.android_webview.AwBrowserProcess;
 import org.chromium.android_webview.AwSettings;
+import org.chromium.android_webview.AwSwitches;
 import org.chromium.android_webview.ResourcesContextWrapperFactory;
 import org.chromium.android_webview.ScopedSysTraceEvent;
 import org.chromium.android_webview.WebViewChromiumRunQueue;
@@ -287,7 +288,7 @@
             }
             if (multiProcess) {
                 CommandLine cl = CommandLine.getInstance();
-                cl.appendSwitch("webview-sandboxed-renderer");
+                cl.appendSwitch(AwSwitches.WEBVIEW_SANDBOXED_RENDERER);
             }
 
             int applicationFlags = ContextUtils.getApplicationContext().getApplicationInfo().flags;
@@ -297,7 +298,7 @@
             // it's a debugable android build.
             if (isAppDebuggable || isOsDebuggable) {
                 CommandLine cl = CommandLine.getInstance();
-                cl.appendSwitch("webview-log-js-console-messages");
+                cl.appendSwitch(AwSwitches.WEBVIEW_LOG_JS_CONSOLE_MESSAGES);
             }
 
             ThreadUtils.setWillOverrideUiThread(true);
diff --git a/android_webview/java/src/org/chromium/android_webview/AwSwitches.java b/android_webview/java/src/org/chromium/android_webview/AwSwitches.java
index 4610a52..e3c9193 100644
--- a/android_webview/java/src/org/chromium/android_webview/AwSwitches.java
+++ b/android_webview/java/src/org/chromium/android_webview/AwSwitches.java
@@ -8,6 +8,10 @@
  * Contains command line switches that are specific to Android WebView.
  */
 public final class AwSwitches {
+    // Allow mirroring JS console messages to system logs.
+    // Native switch kWebViewLogJsConsoleMessages.
+    public static final String WEBVIEW_LOG_JS_CONSOLE_MESSAGES = "webview-log-js-console-messages";
+
     // Indicate that renderers are running in a sandbox. Enables
     // kInProcessGPU and sets kRendererProcessLimit to 1.
     // Native switch kWebViewSandboxedRenderer.
diff --git a/ash/system/power/power_prefs.cc b/ash/system/power/power_prefs.cc
index 92c0840..662484ac 100644
--- a/ash/system/power/power_prefs.cc
+++ b/ash/system/power/power_prefs.cc
@@ -5,6 +5,7 @@
 #include "ash/system/power/power_prefs.h"
 
 #include <string>
+#include <vector>
 
 #include "ash/public/cpp/ash_pref_names.h"
 #include "ash/session/session_controller.h"
@@ -24,6 +25,9 @@
 
 namespace {
 
+using PeakShiftDayConfiguration =
+    chromeos::PowerPolicyController::PeakShiftDayConfiguration;
+
 chromeos::PowerPolicyController::Action GetPowerPolicyAction(
     const PrefService* prefs,
     const std::string& pref_name) {
@@ -126,6 +130,85 @@
   }
 }
 
+// Saves appropriate value to |week_day| and returns true if there is mapping
+// between week day string and enum value.
+bool GetWeekDayFromString(const std::string& week_day_str,
+                          chromeos::PowerPolicyController::WeekDay* week_day) {
+  DCHECK(week_day);
+  if (week_day_str == "MONDAY") {
+    *week_day = chromeos::PowerPolicyController::WeekDay::WEEK_DAY_MONDAY;
+  } else if (week_day_str == "TUESDAY") {
+    *week_day = chromeos::PowerPolicyController::WeekDay::WEEK_DAY_TUESDAY;
+  } else if (week_day_str == "WEDNESDAY") {
+    *week_day = chromeos::PowerPolicyController::WeekDay::WEEK_DAY_WEDNESDAY;
+  } else if (week_day_str == "THURSDAY") {
+    *week_day = chromeos::PowerPolicyController::WeekDay::WEEK_DAY_THURSDAY;
+  } else if (week_day_str == "FRIDAY") {
+    *week_day = chromeos::PowerPolicyController::WeekDay::WEEK_DAY_FRIDAY;
+  } else if (week_day_str == "SATURDAY") {
+    *week_day = chromeos::PowerPolicyController::WeekDay::WEEK_DAY_SATURDAY;
+  } else if (week_day_str == "SUNDAY") {
+    *week_day = chromeos::PowerPolicyController::WeekDay::WEEK_DAY_SUNDAY;
+  } else {
+    return false;
+  }
+  return true;
+}
+
+// Converts |base::Value| to |std::vector<PeakShiftDayConfiguration>| and
+// returns true if there are no missing fields and errors.
+bool GetPeakShiftDayConfigurations(
+    const base::DictionaryValue& value,
+    std::vector<PeakShiftDayConfiguration>* configs_out) {
+  DCHECK(configs_out);
+  configs_out->clear();
+
+  const base::Value* entries =
+      value.FindKeyOfType({"entries"}, base::Value::Type::LIST);
+  if (!entries) {
+    return false;
+  }
+
+  for (const base::Value& item : entries->GetList()) {
+    const base::Value* week_day_value =
+        item.FindKeyOfType({"day"}, base::Value::Type::STRING);
+    const base::Value* start_time_hour =
+        item.FindPathOfType({"start_time", "hour"}, base::Value::Type::INTEGER);
+    const base::Value* start_time_minute = item.FindPathOfType(
+        {"start_time", "minute"}, base::Value::Type::INTEGER);
+    const base::Value* end_time_hour =
+        item.FindPathOfType({"end_time", "hour"}, base::Value::Type::INTEGER);
+    const base::Value* end_time_minute =
+        item.FindPathOfType({"end_time", "minute"}, base::Value::Type::INTEGER);
+    const base::Value* charge_start_time_hour = item.FindPathOfType(
+        {"charge_start_time", "hour"}, base::Value::Type::INTEGER);
+    const base::Value* charge_start_time_minute = item.FindPathOfType(
+        {"charge_start_time", "minute"}, base::Value::Type::INTEGER);
+
+    chromeos::PowerPolicyController::WeekDay week_day_enum;
+    if (!week_day_value ||
+        !GetWeekDayFromString(week_day_value->GetString(), &week_day_enum) ||
+        !start_time_hour || !start_time_minute || !end_time_hour ||
+        !end_time_minute || !charge_start_time_hour ||
+        !charge_start_time_minute) {
+      return false;
+    }
+
+    PeakShiftDayConfiguration config;
+    config.day = week_day_enum;
+    config.start_time.hour = start_time_hour->GetInt();
+    config.start_time.minute = start_time_minute->GetInt();
+    config.end_time.hour = end_time_hour->GetInt();
+    config.end_time.minute = end_time_minute->GetInt();
+    config.charge_start_time.hour = charge_start_time_hour->GetInt();
+    config.charge_start_time.minute = charge_start_time_minute->GetInt();
+
+    configs_out->push_back(std::move(config));
+  }
+
+  return true;
+}
+
 }  // namespace
 
 PowerPrefs::PowerPrefs(chromeos::PowerPolicyController* power_policy_controller,
@@ -137,11 +220,14 @@
   DCHECK(power_policy_controller_);
   DCHECK(tick_clock_);
 
+  Shell::Get()->AddShellObserver(this);
+
   power_manager_client_observer_.Add(power_manager_client);
   Shell::Get()->session_controller()->AddObserver(this);
 }
 
 PowerPrefs::~PowerPrefs() {
+  Shell::Get()->RemoveShellObserver(this);
   Shell::Get()->session_controller()->RemoveObserver(this);
 }
 
@@ -215,9 +301,20 @@
   ObservePrefs(prefs);
 }
 
+void PowerPrefs::OnLocalStatePrefServiceInitialized(PrefService* prefs) {
+  local_state_ = prefs;
+
+  // Pass |nullptr| in tests, because lifetime of local state prefs is shorter
+  // than lifetime of PowerPrefs.
+  if (local_state_) {
+    ObserveLocalStatePrefs(prefs);
+  }
+}
+
 void PowerPrefs::UpdatePowerPolicyFromPrefs() {
   PrefService* prefs = GetPrefService();
-  DCHECK(prefs);
+  if (!prefs || !local_state_)
+    return;
 
   // It's possible to end up in a situation where a shortened lock-screen idle
   // delay would cause the system to suspend immediately as soon as the screen
@@ -230,6 +327,7 @@
                           screen_idle_off_time_ > screen_lock_time_);
 
   chromeos::PowerPolicyController::PrefValues values;
+
   values.ac_brightness_percent =
       prefs->GetInteger(prefs::kPowerAcScreenBrightnessPercent);
   values.ac_screen_dim_delay_ms =
@@ -291,59 +389,92 @@
   values.force_nonzero_brightness_for_user_activity =
       prefs->GetBoolean(prefs::kPowerForceNonzeroBrightnessForUserActivity);
 
+  if (local_state_->GetBoolean(prefs::kDevicePowerPeakShiftEnabled) &&
+      local_state_->IsManagedPreference(prefs::kDevicePowerPeakShiftEnabled) &&
+      local_state_->IsManagedPreference(
+          prefs::kDevicePowerPeakShiftBatteryThreshold) &&
+      local_state_->IsManagedPreference(
+          prefs::kDevicePowerPeakShiftDayConfig)) {
+    const base::DictionaryValue* configs_value =
+        local_state_->GetDictionary(prefs::kDevicePowerPeakShiftDayConfig);
+    DCHECK(configs_value);
+    std::vector<PeakShiftDayConfiguration> configs;
+    if (GetPeakShiftDayConfigurations(*configs_value, &configs)) {
+      values.peak_shift_enabled = true;
+      values.peak_shift_battery_threshold = local_state_->GetInteger(
+          prefs::kDevicePowerPeakShiftBatteryThreshold);
+      values.peak_shift_day_configurations = std::move(configs);
+    } else {
+      LOG(WARNING) << "Invalid Peak Shift day configs format: "
+                   << *configs_value;
+    }
+  }
+
   power_policy_controller_->ApplyPrefs(values);
 }
 
 void PowerPrefs::ObservePrefs(PrefService* prefs) {
+  // Observe pref updates from policy.
+  base::RepeatingClosure update_callback(base::BindRepeating(
+      &PowerPrefs::UpdatePowerPolicyFromPrefs, base::Unretained(this)));
+
+  profile_registrar_ = std::make_unique<PrefChangeRegistrar>();
+  profile_registrar_->Init(prefs);
+  profile_registrar_->Add(prefs::kPowerAcScreenBrightnessPercent,
+                          update_callback);
+  profile_registrar_->Add(prefs::kPowerAcScreenDimDelayMs, update_callback);
+  profile_registrar_->Add(prefs::kPowerAcScreenOffDelayMs, update_callback);
+  profile_registrar_->Add(prefs::kPowerAcScreenLockDelayMs, update_callback);
+  profile_registrar_->Add(prefs::kPowerAcIdleWarningDelayMs, update_callback);
+  profile_registrar_->Add(prefs::kPowerAcIdleDelayMs, update_callback);
+  profile_registrar_->Add(prefs::kPowerBatteryScreenBrightnessPercent,
+                          update_callback);
+  profile_registrar_->Add(prefs::kPowerBatteryScreenDimDelayMs,
+                          update_callback);
+  profile_registrar_->Add(prefs::kPowerBatteryScreenOffDelayMs,
+                          update_callback);
+  profile_registrar_->Add(prefs::kPowerBatteryScreenLockDelayMs,
+                          update_callback);
+  profile_registrar_->Add(prefs::kPowerBatteryIdleWarningDelayMs,
+                          update_callback);
+  profile_registrar_->Add(prefs::kPowerBatteryIdleDelayMs, update_callback);
+  profile_registrar_->Add(prefs::kPowerLockScreenDimDelayMs, update_callback);
+  profile_registrar_->Add(prefs::kPowerLockScreenOffDelayMs, update_callback);
+  profile_registrar_->Add(prefs::kPowerAcIdleAction, update_callback);
+  profile_registrar_->Add(prefs::kPowerBatteryIdleAction, update_callback);
+  profile_registrar_->Add(prefs::kPowerLidClosedAction, update_callback);
+  profile_registrar_->Add(prefs::kPowerUseAudioActivity, update_callback);
+  profile_registrar_->Add(prefs::kPowerUseVideoActivity, update_callback);
+  profile_registrar_->Add(prefs::kPowerAllowWakeLocks, update_callback);
+  profile_registrar_->Add(prefs::kPowerAllowScreenWakeLocks, update_callback);
+  profile_registrar_->Add(prefs::kEnableAutoScreenLock, update_callback);
+  profile_registrar_->Add(prefs::kPowerPresentationScreenDimDelayFactor,
+                          update_callback);
+  profile_registrar_->Add(prefs::kPowerUserActivityScreenDimDelayFactor,
+                          update_callback);
+  profile_registrar_->Add(prefs::kPowerWaitForInitialUserActivity,
+                          update_callback);
+  profile_registrar_->Add(prefs::kPowerForceNonzeroBrightnessForUserActivity,
+                          update_callback);
+  profile_registrar_->Add(prefs::kAllowScreenLock, update_callback);
+  profile_registrar_->Add(prefs::kPowerSmartDimEnabled, update_callback);
+
+  UpdatePowerPolicyFromPrefs();
+}
+
+void PowerPrefs::ObserveLocalStatePrefs(PrefService* prefs) {
   // Observe pref updates from locked state change and policy.
   base::RepeatingClosure update_callback(base::BindRepeating(
       &PowerPrefs::UpdatePowerPolicyFromPrefs, base::Unretained(this)));
 
-  pref_change_registrar_ = std::make_unique<PrefChangeRegistrar>();
-  pref_change_registrar_->Init(prefs);
-  pref_change_registrar_->Add(prefs::kPowerAcScreenBrightnessPercent,
+  local_state_registrar_ = std::make_unique<PrefChangeRegistrar>();
+  local_state_registrar_->Init(prefs);
+  local_state_registrar_->Add(prefs::kDevicePowerPeakShiftEnabled,
                               update_callback);
-  pref_change_registrar_->Add(prefs::kPowerAcScreenDimDelayMs, update_callback);
-  pref_change_registrar_->Add(prefs::kPowerAcScreenOffDelayMs, update_callback);
-  pref_change_registrar_->Add(prefs::kPowerAcScreenLockDelayMs,
+  local_state_registrar_->Add(prefs::kDevicePowerPeakShiftBatteryThreshold,
                               update_callback);
-  pref_change_registrar_->Add(prefs::kPowerAcIdleWarningDelayMs,
+  local_state_registrar_->Add(prefs::kDevicePowerPeakShiftDayConfig,
                               update_callback);
-  pref_change_registrar_->Add(prefs::kPowerAcIdleDelayMs, update_callback);
-  pref_change_registrar_->Add(prefs::kPowerBatteryScreenBrightnessPercent,
-                              update_callback);
-  pref_change_registrar_->Add(prefs::kPowerBatteryScreenDimDelayMs,
-                              update_callback);
-  pref_change_registrar_->Add(prefs::kPowerBatteryScreenOffDelayMs,
-                              update_callback);
-  pref_change_registrar_->Add(prefs::kPowerBatteryScreenLockDelayMs,
-                              update_callback);
-  pref_change_registrar_->Add(prefs::kPowerBatteryIdleWarningDelayMs,
-                              update_callback);
-  pref_change_registrar_->Add(prefs::kPowerBatteryIdleDelayMs, update_callback);
-  pref_change_registrar_->Add(prefs::kPowerLockScreenDimDelayMs,
-                              update_callback);
-  pref_change_registrar_->Add(prefs::kPowerLockScreenOffDelayMs,
-                              update_callback);
-  pref_change_registrar_->Add(prefs::kPowerAcIdleAction, update_callback);
-  pref_change_registrar_->Add(prefs::kPowerBatteryIdleAction, update_callback);
-  pref_change_registrar_->Add(prefs::kPowerLidClosedAction, update_callback);
-  pref_change_registrar_->Add(prefs::kPowerUseAudioActivity, update_callback);
-  pref_change_registrar_->Add(prefs::kPowerUseVideoActivity, update_callback);
-  pref_change_registrar_->Add(prefs::kPowerAllowWakeLocks, update_callback);
-  pref_change_registrar_->Add(prefs::kPowerAllowScreenWakeLocks,
-                              update_callback);
-  pref_change_registrar_->Add(prefs::kEnableAutoScreenLock, update_callback);
-  pref_change_registrar_->Add(prefs::kPowerPresentationScreenDimDelayFactor,
-                              update_callback);
-  pref_change_registrar_->Add(prefs::kPowerUserActivityScreenDimDelayFactor,
-                              update_callback);
-  pref_change_registrar_->Add(prefs::kPowerWaitForInitialUserActivity,
-                              update_callback);
-  pref_change_registrar_->Add(
-      prefs::kPowerForceNonzeroBrightnessForUserActivity, update_callback);
-  pref_change_registrar_->Add(prefs::kAllowScreenLock, update_callback);
-  pref_change_registrar_->Add(prefs::kPowerSmartDimEnabled, update_callback);
 
   UpdatePowerPolicyFromPrefs();
 }
diff --git a/ash/system/power/power_prefs.h b/ash/system/power/power_prefs.h
index e66071a3..8e52e29 100644
--- a/ash/system/power/power_prefs.h
+++ b/ash/system/power/power_prefs.h
@@ -9,6 +9,7 @@
 
 #include "ash/ash_export.h"
 #include "ash/session/session_observer.h"
+#include "ash/shell_observer.h"
 #include "base/macros.h"
 #include "base/scoped_observer.h"
 #include "base/time/tick_clock.h"
@@ -31,7 +32,8 @@
 // Sends an updated power policy to the |power_policy_controller| whenever one
 // of the power-related prefs changes.
 class ASH_EXPORT PowerPrefs : public chromeos::PowerManagerClient::Observer,
-                              public SessionObserver {
+                              public SessionObserver,
+                              public ShellObserver {
  public:
   PowerPrefs(chromeos::PowerPolicyController* power_policy_controller,
              chromeos::PowerManagerClient* power_manager_client);
@@ -61,12 +63,17 @@
   void OnSigninScreenPrefServiceInitialized(PrefService* prefs) override;
   void OnActiveUserPrefServiceChanged(PrefService* prefs) override;
 
+  // ShellObserver:
+  void OnLocalStatePrefServiceInitialized(PrefService* pref_service) override;
+
   void UpdatePowerPolicyFromPrefs();
 
   // Observes either the signin screen prefs or active user prefs and loads
   // initial settings.
   void ObservePrefs(PrefService* prefs);
 
+  void ObserveLocalStatePrefs(PrefService* prefs);
+
   chromeos::PowerPolicyController* const
       power_policy_controller_;  // Not owned.
 
@@ -74,7 +81,8 @@
                  chromeos::PowerManagerClient::Observer>
       power_manager_client_observer_;
 
-  std::unique_ptr<PrefChangeRegistrar> pref_change_registrar_;
+  std::unique_ptr<PrefChangeRegistrar> profile_registrar_;
+  std::unique_ptr<PrefChangeRegistrar> local_state_registrar_;
 
   const base::TickClock* tick_clock_;  // Not owned.
 
@@ -85,6 +93,8 @@
   // Unset if the screen isn't currently turned off due to user inactivity.
   base::TimeTicks screen_idle_off_time_;
 
+  PrefService* local_state_ = nullptr;  // Not owned.
+
   DISALLOW_COPY_AND_ASSIGN(PowerPrefs);
 };
 
diff --git a/ash/system/power/power_prefs_unittest.cc b/ash/system/power/power_prefs_unittest.cc
index 0ba6010..5a210ad 100644
--- a/ash/system/power/power_prefs_unittest.cc
+++ b/ash/system/power/power_prefs_unittest.cc
@@ -15,12 +15,17 @@
 #include "ash/shell.h"
 #include "ash/shell_test_api.h"
 #include "ash/test/ash_test_base.h"
+#include "base/json/json_reader.h"
 #include "base/macros.h"
 #include "base/test/simple_test_tick_clock.h"
 #include "chromeos/dbus/power/fake_power_manager_client.h"
 #include "chromeos/dbus/power/power_policy_controller.h"
 #include "chromeos/dbus/power_manager/idle.pb.h"
+#include "components/prefs/pref_notifier_impl.h"
+#include "components/prefs/pref_registry_simple.h"
 #include "components/prefs/pref_service.h"
+#include "components/prefs/testing_pref_service.h"
+#include "components/prefs/testing_pref_store.h"
 
 using session_manager::SessionState;
 
@@ -116,6 +121,15 @@
   return prefs->GetBoolean(prefs::kPowerAllowScreenWakeLocks);
 }
 
+void DecodeJsonStringAndNormalize(const std::string& json_string,
+                                  base::Value* value) {
+  base::JSONReader reader(base::JSON_ALLOW_TRAILING_COMMAS);
+  base::Optional<base::Value> read_value = reader.ReadToValue(json_string);
+  ASSERT_EQ(reader.GetErrorMessage(), "");
+  ASSERT_TRUE(read_value.has_value());
+  *value = std::move(read_value.value());
+}
+
 }  // namespace
 
 class PowerPrefsTest : public NoSessionAshTestBase {
@@ -136,6 +150,33 @@
 
     // Get to Login screen.
     GetSessionControllerClient()->SetSessionState(SessionState::LOGIN_PRIMARY);
+
+    SetUpLocalState();
+  }
+
+  void TearDown() override {
+    static_cast<ShellObserver*>(power_prefs_)
+        ->OnLocalStatePrefServiceInitialized(nullptr);
+
+    NoSessionAshTestBase::TearDown();
+  }
+
+  void SetUpLocalState() {
+    auto pref_notifier = std::make_unique<PrefNotifierImpl>();
+    auto pref_value_store = std::make_unique<PrefValueStore>(
+        managed_pref_store_.get() /* managed_prefs */,
+        nullptr /* supervised_user_prefs */, nullptr /* extension_prefs */,
+        nullptr /* command_line_prefs */, user_pref_store_.get(),
+        nullptr /* recommended_prefs */, pref_registry_->defaults().get(),
+        pref_notifier.get());
+    local_state_ = std::make_unique<PrefService>(
+        std::move(pref_notifier), std::move(pref_value_store), user_pref_store_,
+        pref_registry_, base::DoNothing(), false);
+
+    PowerPrefs::RegisterLocalStatePrefs(pref_registry_.get());
+
+    static_cast<ShellObserver*>(power_prefs_)
+        ->OnLocalStatePrefServiceInitialized(local_state_.get());
   }
 
   std::string GetCurrentPowerPolicy() const {
@@ -143,6 +184,11 @@
         power_manager_client()->policy());
   }
 
+  std::string GetCurrentPowerPeakShiftPolicy() const {
+    return chromeos::PowerPolicyController::GetPeakShiftPolicyDebugString(
+        power_manager_client()->policy());
+  }
+
   bool GetCurrentAllowScreenWakeLocks() const {
     return power_policy_controller_->honor_screen_wake_locks_for_test();
   }
@@ -171,6 +217,15 @@
   PowerPrefs* power_prefs_ = nullptr;  // Not owned.
   base::SimpleTestTickClock tick_clock_;
 
+  scoped_refptr<TestingPrefStore> user_pref_store_ =
+      base::MakeRefCounted<TestingPrefStore>();
+  scoped_refptr<TestingPrefStore> managed_pref_store_ =
+      base::MakeRefCounted<TestingPrefStore>();
+  scoped_refptr<PrefRegistrySimple> pref_registry_ =
+      base::MakeRefCounted<PrefRegistrySimple>();
+
+  std::unique_ptr<PrefService> local_state_;
+
  private:
   DISALLOW_COPY_AND_ASSIGN(PowerPrefsTest);
 };
@@ -303,4 +358,58 @@
   EXPECT_TRUE(prefs->GetBoolean(prefs::kPowerSmartDimEnabled));
 }
 
+TEST_F(PowerPrefsTest, PeakShift) {
+  constexpr char kDayConfigsJson[] =
+      R"({
+        "entries": [
+          {
+            "charge_start_time": {
+               "hour": 20,
+               "minute": 0
+            },
+            "day": "MONDAY",
+            "end_time": {
+               "hour": 10,
+               "minute": 15
+            },
+            "start_time": {
+               "hour": 7,
+               "minute": 30
+            }
+          },
+          {
+            "charge_start_time": {
+               "hour": 22,
+               "minute": 30
+            },
+            "day": "FRIDAY",
+            "end_time": {
+               "hour": 9,
+               "minute": 45
+            },
+            "start_time": {
+               "hour": 4,
+               "minute": 0
+            }
+          }
+        ]
+      })";
+  base::Value day_configs;
+  DecodeJsonStringAndNormalize(kDayConfigsJson, &day_configs);
+
+  managed_pref_store_->SetBoolean(prefs::kDevicePowerPeakShiftEnabled, true);
+  managed_pref_store_->SetInteger(prefs::kDevicePowerPeakShiftBatteryThreshold,
+                                  50);
+  managed_pref_store_->SetValue(
+      prefs::kDevicePowerPeakShiftDayConfig,
+      std::make_unique<base::Value>(std::move(day_configs)), 0);
+
+  constexpr char kExpectedPeakShiftPolicy[] =
+      "peak_shift_battery_threshold=50 "
+      "peak_shift_day_configuration=["
+      "{day=0 start_time=7:30 end_time=10:15 charge_start_time=20:00} "
+      "{day=4 start_time=4:00 end_time=9:45 charge_start_time=22:30} ]";
+  EXPECT_EQ(GetCurrentPowerPeakShiftPolicy(), kExpectedPeakShiftPolicy);
+}
+
 }  // namespace ash
diff --git a/base/i18n/break_iterator.cc b/base/i18n/break_iterator.cc
index 251cd002..51ffc4a 100644
--- a/base/i18n/break_iterator.cc
+++ b/base/i18n/break_iterator.cc
@@ -47,6 +47,9 @@
     case BREAK_WORD:
       break_type = UBRK_WORD;
       break;
+    case BREAK_SENTENCE:
+      break_type = UBRK_SENTENCE;
+      break;
     case BREAK_LINE:
     case BREAK_NEWLINE:
     case RULE_BASED: // (Keep compiler happy, break_type not used in this case)
@@ -93,6 +96,7 @@
     case BREAK_CHARACTER:
     case BREAK_WORD:
     case BREAK_LINE:
+    case BREAK_SENTENCE:
     case RULE_BASED:
       pos = ubrk_next(static_cast<UBreakIterator*>(iter_));
       if (pos == UBRK_DONE) {
@@ -170,6 +174,14 @@
   return (!!boundary && next_status != UBRK_WORD_NONE);
 }
 
+bool BreakIterator::IsSentenceBoundary(size_t position) const {
+  if (break_type_ != BREAK_SENTENCE && break_type_ != RULE_BASED)
+    return false;
+
+  UBreakIterator* iter = static_cast<UBreakIterator*>(iter_);
+  return !!ubrk_isBoundary(iter, static_cast<int32_t>(position));
+}
+
 bool BreakIterator::IsGraphemeBoundary(size_t position) const {
   if (break_type_ != BREAK_CHARACTER)
     return false;
diff --git a/base/i18n/break_iterator.h b/base/i18n/break_iterator.h
index dc30b64..2933ba59 100644
--- a/base/i18n/break_iterator.h
+++ b/base/i18n/break_iterator.h
@@ -15,8 +15,9 @@
 // The BreakIterator class iterates through the words, word breaks, and
 // line breaks in a UTF-16 string.
 //
-// It provides several modes, BREAK_WORD, BREAK_LINE, and BREAK_NEWLINE,
-// which modify how characters are aggregated into the returned string.
+// It provides several modes, BREAK_WORD, BREAK_LINE, BREAK_NEWLINE, and
+// BREAK_SENTENCE which modify how characters are aggregated into the returned
+// string.
 //
 // Under BREAK_WORD mode, once a word is encountered any non-word
 // characters are not included in the returned string (e.g. in the
@@ -43,6 +44,12 @@
 // (eg. in the UTF-16 equivalent of the string "foo\nbar!\n\n", the line
 // breaks are at the periods in ".foo\n.bar\n.\n.").
 //
+// Under BREAK_SENTENCE mode, all characters are included in the returned
+// string, breaking only on sentence boundaries defined in "Unicode Standard
+// Annex #29: Text Segmentation." Whitespace immediately following the sentence
+// is also included. For example, in the UTF-16 equivalent of the string
+// "foo bar! baz qux?" the breaks are at the periods in ".foo bar! .baz quz?."
+//
 // To extract the words from a string, move a BREAK_WORD BreakIterator
 // through the string and test whether IsWord() is true. E.g.,
 //   BreakIterator iter(str, BreakIterator::BREAK_WORD);
@@ -71,6 +78,7 @@
     BREAK_CHARACTER,
     // But don't remove this one!
     RULE_BASED,
+    BREAK_SENTENCE,
   };
 
   enum WordBreakStatus {
@@ -131,11 +139,16 @@
   BreakIterator::WordBreakStatus GetWordBreakStatus() const;
 
   // Under BREAK_WORD mode, returns true if |position| is at the end of word or
-  // at the start of word. It always returns false under BREAK_LINE and
-  // BREAK_NEWLINE modes.
+  // at the start of word. It always returns false under modes that are not
+  // BREAK_WORD or RULE_BASED.
   bool IsEndOfWord(size_t position) const;
   bool IsStartOfWord(size_t position) const;
 
+  // Under BREAK_SENTENCE mode, returns true if |position| is at a sentence
+  // boundary. It always returns false under modes that are not BREAK_SENTENCE
+  // or RULE_BASED.
+  bool IsSentenceBoundary(size_t position) const;
+
   // Under BREAK_CHARACTER mode, returns whether |position| is a Unicode
   // grapheme boundary.
   bool IsGraphemeBoundary(size_t position) const;
diff --git a/base/i18n/break_iterator_unittest.cc b/base/i18n/break_iterator_unittest.cc
index defc927..12d7a60 100644
--- a/base/i18n/break_iterator_unittest.cc
+++ b/base/i18n/break_iterator_unittest.cc
@@ -5,6 +5,7 @@
 #include "base/i18n/break_iterator.h"
 
 #include <stddef.h>
+#include <vector>
 
 #include "base/stl_util.h"
 #include "base/strings/string_piece.h"
@@ -372,6 +373,56 @@
   EXPECT_FALSE(iter.IsWord());
 }
 
+TEST(BreakIteratorTest, BreakSentence) {
+  string16 nl(UTF8ToUTF16("\n"));
+  string16 str(UTF8ToUTF16(
+      "\nFoo bar!\nOne sentence.\n\n\tAnother sentence?One more thing"));
+  BreakIterator iter(str, BreakIterator::BREAK_SENTENCE);
+  ASSERT_TRUE(iter.Init());
+  EXPECT_TRUE(iter.Advance());
+  EXPECT_FALSE(iter.IsWord());
+  EXPECT_EQ(nl, iter.GetString());
+  EXPECT_TRUE(iter.Advance());
+  EXPECT_FALSE(iter.IsWord());
+  EXPECT_EQ(UTF8ToUTF16("Foo bar!\n"), iter.GetString());
+  EXPECT_TRUE(iter.Advance());
+  EXPECT_FALSE(iter.IsWord());
+  EXPECT_EQ(UTF8ToUTF16("One sentence.\n"), iter.GetString());
+  EXPECT_TRUE(iter.Advance());
+  EXPECT_FALSE(iter.IsWord());
+  EXPECT_EQ(nl, iter.GetString());
+  EXPECT_TRUE(iter.Advance());
+  EXPECT_FALSE(iter.IsWord());
+  EXPECT_EQ(UTF8ToUTF16("\tAnother sentence?"), iter.GetString());
+  EXPECT_TRUE(iter.Advance());
+  EXPECT_FALSE(iter.IsWord());
+  EXPECT_EQ(UTF8ToUTF16("One more thing"), iter.GetString());
+  EXPECT_FALSE(iter.Advance());  // Test unexpected advance after end.
+  EXPECT_FALSE(iter.IsWord());
+}
+
+TEST(BreakIteratorTest, IsSentenceBoundary) {
+  string16 str(UTF8ToUTF16(
+      "Foo bar!\nOne sentence.\n\n\tAnother sentence?One more thing"));
+  BreakIterator iter(str, BreakIterator::BREAK_SENTENCE);
+  ASSERT_TRUE(iter.Init());
+
+  std::vector<size_t> sentence_breaks;
+  sentence_breaks.push_back(0);
+  sentence_breaks.push_back(9);
+  sentence_breaks.push_back(23);
+  sentence_breaks.push_back(24);
+  sentence_breaks.push_back(42);
+  for (size_t i = 0; i < str.size(); i++) {
+    if (std::find(sentence_breaks.begin(), sentence_breaks.end(), i) !=
+        sentence_breaks.end()) {
+      EXPECT_TRUE(iter.IsSentenceBoundary(i)) << " at index=" << i;
+    } else {
+      EXPECT_FALSE(iter.IsSentenceBoundary(i)) << " at index=" << i;
+    }
+  }
+}
+
 TEST(BreakIteratorTest, BreakLineNL) {
   string16 nl(UTF8ToUTF16("\n"));
   string16 str(UTF8ToUTF16("\nfoo bar!\n\npouet boom\n"));
diff --git a/base/json/json_reader_unittest.cc b/base/json/json_reader_unittest.cc
index 5023f33..186a6f1 100644
--- a/base/json/json_reader_unittest.cc
+++ b/base/json/json_reader_unittest.cc
@@ -371,17 +371,15 @@
       "{\"inner\":{\"array\":[true]},\"false\":false,\"d\":{}}");
   ASSERT_TRUE(dict_val);
   ASSERT_TRUE(dict_val->is_dict());
-  const Value* inner_dict =
-      dict_val->FindKeyOfType("inner", base::Value::Type::DICTIONARY);
+  const Value* inner_dict = dict_val->FindDictKey("inner");
   ASSERT_TRUE(inner_dict);
-  const Value* inner_array =
-      inner_dict->FindKeyOfType("array", base::Value::Type::LIST);
+  const Value* inner_array = inner_dict->FindListKey("array");
   ASSERT_TRUE(inner_array);
   EXPECT_EQ(1U, inner_array->GetList().size());
   auto bool_value = dict_val->FindBoolKey("false");
   ASSERT_TRUE(bool_value);
   EXPECT_FALSE(*bool_value);
-  inner_dict = dict_val->FindKeyOfType("d", base::Value::Type::DICTIONARY);
+  inner_dict = dict_val->FindDictKey("d");
   EXPECT_TRUE(inner_dict);
 
   Optional<Value> root2 = JSONReader::Read(
@@ -403,8 +401,7 @@
   integer_value = dict_val->FindIntKey("c");
   ASSERT_TRUE(integer_value);
   EXPECT_EQ(2, *integer_value);
-  const Value* inner_dict =
-      dict_val->FindKeyOfType("d.e.f", base::Value::Type::DICTIONARY);
+  const Value* inner_dict = dict_val->FindDictKey("d.e.f");
   ASSERT_TRUE(inner_dict);
   EXPECT_EQ(1U, inner_dict->DictSize());
   integer_value = inner_dict->FindIntKey("g.h.i.j");
@@ -595,9 +592,9 @@
     ASSERT_TRUE(root);
     ASSERT_TRUE(root->is_dict());
 
-    Value* dict = root->FindKeyOfType("test", Value::Type::DICTIONARY);
+    Value* dict = root->FindDictKey("test");
     ASSERT_TRUE(dict);
-    Value* list = root->FindKeyOfType("list", Value::Type::LIST);
+    Value* list = root->FindListKey("list");
     ASSERT_TRUE(list);
 
     Value* to_move = dict->FindKey("foo");
diff --git a/base/metrics/statistics_recorder_unittest.cc b/base/metrics/statistics_recorder_unittest.cc
index f54f414..9392e17c 100644
--- a/base/metrics/statistics_recorder_unittest.cc
+++ b/base/metrics/statistics_recorder_unittest.cc
@@ -366,8 +366,7 @@
   // No query should be set.
   ASSERT_FALSE(root->FindKey("query"));
 
-  const Value* histogram_list =
-      root->FindKeyOfType("histograms", base::Value::Type::LIST);
+  const Value* histogram_list = root->FindListKey("histograms");
 
   ASSERT_TRUE(histogram_list);
   ASSERT_EQ(2u, histogram_list->GetList().size());
@@ -380,8 +379,7 @@
   ASSERT_TRUE(sample_count);
   EXPECT_EQ(2, *sample_count);
 
-  const Value* buckets_list =
-      histogram_dict.FindKeyOfType("buckets", base::Value::Type::LIST);
+  const Value* buckets_list = histogram_dict.FindListKey("buckets");
   ASSERT_TRUE(buckets_list);
   EXPECT_EQ(2u, buckets_list->GetList().size());
 
@@ -390,7 +388,7 @@
   root = JSONReader::Read(json);
   ASSERT_TRUE(root);
   ASSERT_TRUE(root->is_dict());
-  histogram_list = root->FindKeyOfType("histograms", base::Value::Type::LIST);
+  histogram_list = root->FindListKey("histograms");
   ASSERT_TRUE(histogram_list);
   ASSERT_EQ(2u, histogram_list->GetList().size());
   const Value& histogram_dict2 = histogram_list->GetList()[0];
@@ -398,8 +396,7 @@
   sample_count = histogram_dict2.FindIntKey("count");
   ASSERT_TRUE(sample_count);
   EXPECT_EQ(2, *sample_count);
-  buckets_list =
-      histogram_dict2.FindKeyOfType("buckets", base::Value::Type::LIST);
+  buckets_list = histogram_dict2.FindListKey("buckets");
   // Bucket information should be omitted.
   ASSERT_FALSE(buckets_list);
 }
diff --git a/base/task/sequence_manager/thread_controller_impl.cc b/base/task/sequence_manager/thread_controller_impl.cc
index 22119a00..1556577d 100644
--- a/base/task/sequence_manager/thread_controller_impl.cc
+++ b/base/task/sequence_manager/thread_controller_impl.cc
@@ -193,9 +193,9 @@
       break;
 
     {
-      TRACE_TASK_EXECUTION("ThreadControllerImpl::RunTask", *task);
       // Trace events should finish before we call DidRunTask to ensure that
       // SequenceManager trace events do not interfere with them.
+      TRACE_TASK_EXECUTION("ThreadControllerImpl::RunTask", *task);
       task_annotator_.RunTask("SequenceManager RunTask", &*task);
     }
 
diff --git a/base/task/sequence_manager/thread_controller_with_message_pump_impl.cc b/base/task/sequence_manager/thread_controller_with_message_pump_impl.cc
index d956e9e6..86886063 100644
--- a/base/task/sequence_manager/thread_controller_with_message_pump_impl.cc
+++ b/base/task/sequence_manager/thread_controller_with_message_pump_impl.cc
@@ -336,9 +336,6 @@
       // Trace events should finish before we call DidRunTask to ensure that
       // SequenceManager trace events do not interfere with them.
       TRACE_TASK_EXECUTION("ThreadController::Task", *task);
-      // Trace-parsing tools (DevTools, Lighthouse, etc) consume this event
-      // to determine long tasks.
-      // See https://crbug.com/681863 and https://crbug.com/874982
       task_annotator_.RunTask("ThreadController::Task", &*task);
     }
 
@@ -364,6 +361,7 @@
 }
 
 bool ThreadControllerWithMessagePumpImpl::DoIdleWork() {
+  TRACE_EVENT0("sequence_manager", "SequenceManager::DoIdleWork");
   work_id_provider_->IncrementWorkId();
 #if defined(OS_WIN)
   bool need_high_res_mode =
diff --git a/base/trace_event/trace_config.cc b/base/trace_event/trace_config.cc
index e28456bd..e5bc3a58 100644
--- a/base/trace_event/trace_config.cc
+++ b/base/trace_event/trace_config.cc
@@ -147,8 +147,7 @@
 void TraceConfig::ProcessFilterConfig::InitializeFromConfigDict(
     const base::DictionaryValue& dict) {
   included_process_ids_.clear();
-  const Value* value =
-      dict.FindKeyOfType(kIncludedProcessesParam, Value::Type::LIST);
+  const Value* value = dict.FindListKey(kIncludedProcessesParam);
   if (!value)
     return;
   for (auto& pid_value : value->GetList()) {
diff --git a/base/values.cc b/base/values.cc
index 69d66ff..6f3a9e2 100644
--- a/base/values.cc
+++ b/base/values.cc
@@ -354,6 +354,27 @@
   return result ? &result->string_value_ : nullptr;
 }
 
+const Value::BlobStorage* Value::FindBlobKey(StringPiece key) const {
+  const Value* value = FindKeyOfType(key, Type::BINARY);
+  return value ? &value->binary_value_ : nullptr;
+}
+
+const Value* Value::FindDictKey(StringPiece key) const {
+  return FindKeyOfType(key, Type::DICTIONARY);
+}
+
+Value* Value::FindDictKey(StringPiece key) {
+  return FindKeyOfType(key, Type::DICTIONARY);
+}
+
+const Value* Value::FindListKey(StringPiece key) const {
+  return FindKeyOfType(key, Type::LIST);
+}
+
+Value* Value::FindListKey(StringPiece key) {
+  return FindKeyOfType(key, Type::LIST);
+}
+
 bool Value::RemoveKey(StringPiece key) {
   CHECK(is_dict());
   // NOTE: Can't directly return dict_->erase(key) due to MSVC warning C4800.
diff --git a/base/values.h b/base/values.h
index 6f2cd3c..7bc355e 100644
--- a/base/values.h
+++ b/base/values.h
@@ -207,6 +207,17 @@
   // |FindStringKey| returns |nullptr| if value is not found or not a string.
   const std::string* FindStringKey(StringPiece key) const;
 
+  // Returns nullptr is value is not found or not a binary.
+  const BlobStorage* FindBlobKey(StringPiece key) const;
+
+  // Returns nullptr if value is not found or not a dictionary.
+  const Value* FindDictKey(StringPiece key) const;
+  Value* FindDictKey(StringPiece key);
+
+  // Returns nullptr if value is not found or not a list.
+  const Value* FindListKey(StringPiece key) const;
+  Value* FindListKey(StringPiece key);
+
   // |SetKey| looks up |key| in the underlying dictionary and sets the mapped
   // value to |value|. If |key| could not be found, a new element is inserted.
   // A pointer to the modified item is returned.
diff --git a/base/values_unittest.cc b/base/values_unittest.cc
index 7c545c0..2907dc0 100644
--- a/base/values_unittest.cc
+++ b/base/values_unittest.cc
@@ -635,7 +635,7 @@
   EXPECT_EQ(base::nullopt, dict.FindBoolKey("string"));
   EXPECT_EQ(base::nullopt, dict.FindBoolKey("blob"));
   EXPECT_EQ(base::nullopt, dict.FindBoolKey("list"));
-  EXPECT_EQ(base::nullopt, dict.FindBoolKey("dist"));
+  EXPECT_EQ(base::nullopt, dict.FindBoolKey("dict"));
 }
 
 TEST(ValuesTest, FindIntKey) {
@@ -657,7 +657,7 @@
   EXPECT_EQ(base::nullopt, dict.FindIntKey("string"));
   EXPECT_EQ(base::nullopt, dict.FindIntKey("blob"));
   EXPECT_EQ(base::nullopt, dict.FindIntKey("list"));
-  EXPECT_EQ(base::nullopt, dict.FindIntKey("dist"));
+  EXPECT_EQ(base::nullopt, dict.FindIntKey("dict"));
 }
 
 TEST(ValuesTest, FindDoubleKey) {
@@ -679,7 +679,7 @@
   EXPECT_EQ(base::nullopt, dict.FindDoubleKey("string"));
   EXPECT_EQ(base::nullopt, dict.FindDoubleKey("blob"));
   EXPECT_EQ(base::nullopt, dict.FindDoubleKey("list"));
-  EXPECT_EQ(base::nullopt, dict.FindDoubleKey("dist"));
+  EXPECT_EQ(base::nullopt, dict.FindDoubleKey("dict"));
 }
 
 TEST(ValuesTest, FindStringKey) {
@@ -701,7 +701,73 @@
   EXPECT_NE(nullptr, dict.FindStringKey("string"));
   EXPECT_EQ(nullptr, dict.FindStringKey("blob"));
   EXPECT_EQ(nullptr, dict.FindStringKey("list"));
-  EXPECT_EQ(nullptr, dict.FindStringKey("dist"));
+  EXPECT_EQ(nullptr, dict.FindStringKey("dict"));
+}
+
+TEST(ValuesTest, FindDictKey) {
+  Value::DictStorage storage;
+  storage.emplace("null", std::make_unique<Value>(Value::Type::NONE));
+  storage.emplace("bool", std::make_unique<Value>(Value::Type::BOOLEAN));
+  storage.emplace("int", std::make_unique<Value>(Value::Type::INTEGER));
+  storage.emplace("double", std::make_unique<Value>(Value::Type::DOUBLE));
+  storage.emplace("string", std::make_unique<Value>(Value::Type::STRING));
+  storage.emplace("blob", std::make_unique<Value>(Value::Type::BINARY));
+  storage.emplace("list", std::make_unique<Value>(Value::Type::LIST));
+  storage.emplace("dict", std::make_unique<Value>(Value::Type::DICTIONARY));
+
+  const Value dict(std::move(storage));
+  EXPECT_EQ(nullptr, dict.FindDictKey("null"));
+  EXPECT_EQ(nullptr, dict.FindDictKey("bool"));
+  EXPECT_EQ(nullptr, dict.FindDictKey("int"));
+  EXPECT_EQ(nullptr, dict.FindDictKey("double"));
+  EXPECT_EQ(nullptr, dict.FindDictKey("string"));
+  EXPECT_EQ(nullptr, dict.FindDictKey("blob"));
+  EXPECT_EQ(nullptr, dict.FindDictKey("list"));
+  EXPECT_NE(nullptr, dict.FindDictKey("dict"));
+}
+
+TEST(ValuesTest, FindListKey) {
+  Value::DictStorage storage;
+  storage.emplace("null", std::make_unique<Value>(Value::Type::NONE));
+  storage.emplace("bool", std::make_unique<Value>(Value::Type::BOOLEAN));
+  storage.emplace("int", std::make_unique<Value>(Value::Type::INTEGER));
+  storage.emplace("double", std::make_unique<Value>(Value::Type::DOUBLE));
+  storage.emplace("string", std::make_unique<Value>(Value::Type::STRING));
+  storage.emplace("blob", std::make_unique<Value>(Value::Type::BINARY));
+  storage.emplace("list", std::make_unique<Value>(Value::Type::LIST));
+  storage.emplace("dict", std::make_unique<Value>(Value::Type::DICTIONARY));
+
+  const Value dict(std::move(storage));
+  EXPECT_EQ(nullptr, dict.FindListKey("null"));
+  EXPECT_EQ(nullptr, dict.FindListKey("bool"));
+  EXPECT_EQ(nullptr, dict.FindListKey("int"));
+  EXPECT_EQ(nullptr, dict.FindListKey("double"));
+  EXPECT_EQ(nullptr, dict.FindListKey("string"));
+  EXPECT_EQ(nullptr, dict.FindListKey("blob"));
+  EXPECT_NE(nullptr, dict.FindListKey("list"));
+  EXPECT_EQ(nullptr, dict.FindListKey("dict"));
+}
+
+TEST(ValuesTest, FindBlobKey) {
+  Value::DictStorage storage;
+  storage.emplace("null", std::make_unique<Value>(Value::Type::NONE));
+  storage.emplace("bool", std::make_unique<Value>(Value::Type::BOOLEAN));
+  storage.emplace("int", std::make_unique<Value>(Value::Type::INTEGER));
+  storage.emplace("double", std::make_unique<Value>(Value::Type::DOUBLE));
+  storage.emplace("string", std::make_unique<Value>(Value::Type::STRING));
+  storage.emplace("blob", std::make_unique<Value>(Value::Type::BINARY));
+  storage.emplace("list", std::make_unique<Value>(Value::Type::LIST));
+  storage.emplace("dict", std::make_unique<Value>(Value::Type::DICTIONARY));
+
+  const Value dict(std::move(storage));
+  EXPECT_EQ(nullptr, dict.FindBlobKey("null"));
+  EXPECT_EQ(nullptr, dict.FindBlobKey("bool"));
+  EXPECT_EQ(nullptr, dict.FindBlobKey("int"));
+  EXPECT_EQ(nullptr, dict.FindBlobKey("double"));
+  EXPECT_EQ(nullptr, dict.FindBlobKey("string"));
+  EXPECT_NE(nullptr, dict.FindBlobKey("blob"));
+  EXPECT_EQ(nullptr, dict.FindBlobKey("list"));
+  EXPECT_EQ(nullptr, dict.FindBlobKey("dict"));
 }
 
 TEST(ValuesTest, SetKey) {
diff --git a/build/android/gyp/write_build_config.py b/build/android/gyp/write_build_config.py
index d2e58eb..7515673 100755
--- a/build/android/gyp/write_build_config.py
+++ b/build/android/gyp/write_build_config.py
@@ -537,8 +537,10 @@
 This type corresponds to an Android app bundle (`.aab` file).
 
 --------------- END_MARKDOWN ---------------------------------------------------
+TODO(estevenson): Add docs for static library synchronized proguarding.
 """
 
+import collections
 import itertools
 import json
 import optparse
@@ -903,6 +905,10 @@
   parser.add_option('--incremental-install-json-path',
                     help="Path to the target's generated incremental install "
                     "json.")
+  parser.add_option(
+      '--static-library-dependent-configs',
+      help='GN list of .build_configs of targets that use this target as a '
+      'static library.')
 
   parser.add_option('--tested-apk-config',
       help='Path to the build config of the tested apk (for an instrumentation '
@@ -1008,6 +1014,19 @@
       'java_library', 'android_apk', 'dist_aar', 'dist_jar',
       'system_java_library', 'android_app_bundle_module')
 
+  is_static_library_dex_provider_target = (
+      options.static_library_dependent_configs and options.proguard_enabled)
+  if is_static_library_dex_provider_target and options.type != 'android_apk':
+    raise Exception(
+        '--static-library-dependent-configs only supports --type=android_apk')
+
+  options.static_library_dependent_configs = build_utils.ParseGnList(
+      options.static_library_dependent_configs)
+  static_library_dependent_configs_by_path = {
+      p: GetDepConfig(p)
+      for p in options.static_library_dependent_configs
+  }
+
   deps = _DepsFromPaths(
       build_utils.ParseGnList(options.deps_configs), options.type)
   processor_deps = _DepsFromPaths(
@@ -1017,9 +1036,10 @@
       build_utils.ParseGnList(options.classpath_deps_configs or ''),
       options.type)
 
-  all_inputs = sorted(set(deps.AllConfigPaths() +
-                          processor_deps.AllConfigPaths() +
-                          classpath_deps.AllConfigPaths()))
+  all_inputs = sorted(
+      set(deps.AllConfigPaths() + processor_deps.AllConfigPaths() +
+          classpath_deps.AllConfigPaths() +
+          list(static_library_dependent_configs_by_path)))
 
   system_library_deps = deps.Direct('system_java_library')
   direct_library_deps = deps.Direct('java_library')
@@ -1085,12 +1105,11 @@
   # opposed to groups and libraries.
   if is_apk_or_module_target or options.type in (
       'group', 'java_library', 'junit_binary'):
-    config['jni'] = {}
+    deps_info['jni'] = {}
     all_java_sources = [c['java_sources_file'] for c in all_library_deps
                         if 'java_sources_file' in c]
     if options.java_sources_file:
       all_java_sources.append(options.java_sources_file)
-    config['jni']['all_source'] = all_java_sources
 
     if options.apk_proto_resources:
       deps_info['proto_resources_path'] = options.apk_proto_resources
@@ -1314,6 +1333,52 @@
             c for c in d.get('java_runtime_classpath', [])
             if c not in java_full_classpath)
 
+  all_configs = build_utils.ParseGnList(options.proguard_configs)
+  deps_info['proguard_configs'] = list(all_configs)
+  extra_jars = []
+
+  if is_static_library_dex_provider_target:
+    # Map classpath entries to configs that include them in their classpath.
+    configs_by_classpath_entry = collections.defaultdict(list)
+    for config_path, dep_config in (
+        static_library_dependent_configs_by_path.iteritems()):
+      all_configs.extend(dep_config['proguard_all_configs'])
+      extra_jars.extend(dep_config['proguard_classpath_jars'])
+      all_java_sources.extend(dep_config['jni']['all_source'])
+      for cp_entry in dep_config['java_runtime_classpath']:
+        # The APK Java targets for the static library dependent targets will
+        # have some of the same classes (R.java) due to shared resource
+        # dependencies. To avoid Proguard failures due to duplicate classes, we
+        # merge the APK jars into the static library's jar_path as a
+        # preprocessing build step.
+        if cp_entry != dep_config['jar_path']:
+          configs_by_classpath_entry[cp_entry].append(config_path)
+
+    for cp_entry in java_full_classpath:
+      configs_by_classpath_entry[cp_entry].append(options.build_config)
+
+    # Map configs to classpath entries that should be included in their final
+    # dex.
+    classpath_entries_by_owning_config = collections.defaultdict(list)
+    for cp_entry, candidate_configs in configs_by_classpath_entry.iteritems():
+      config_path = (candidate_configs[0]
+                     if len(candidate_configs) == 1 else options.build_config)
+      classpath_entries_by_owning_config[config_path].append(cp_entry)
+      java_full_classpath.append(cp_entry)
+
+    classpath_entries_by_owning_config[options.build_config].append(
+        deps_info['jar_path'])
+
+    java_full_classpath = sorted(set(java_full_classpath))
+    deps_info['static_library_dependent_classpath_configs'] = {
+        path: sorted(set(classpath))
+        for path, classpath in classpath_entries_by_owning_config.iteritems()
+    }
+
+  if is_apk_or_module_target or options.type in ('group', 'java_library',
+                                                 'junit_binary'):
+    deps_info['jni']['all_source'] = sorted(set(all_java_sources))
+
   system_jars = [c['jar_path'] for c in system_library_deps]
   system_interface_jars = [c['interface_jar_path'] for c in system_library_deps]
   if system_library_deps:
@@ -1321,14 +1386,8 @@
     config['android']['sdk_interface_jars'] = system_interface_jars
     config['android']['sdk_jars'] = system_jars
 
-  if options.proguard_configs:
-    deps_info['proguard_configs'] = (
-        build_utils.ParseGnList(options.proguard_configs))
-
   if options.type in ('android_apk', 'dist_aar',
       'dist_jar', 'android_app_bundle_module', 'android_app_bundle'):
-    all_configs = deps_info.get('proguard_configs', [])
-    extra_jars = list()
     for c in all_library_deps:
       all_configs.extend(
           p for p in c.get('proguard_configs', []) if p not in all_configs)
@@ -1341,13 +1400,13 @@
       for c in deps.Direct('android_app_bundle_module'):
         all_configs.extend(
             p for p in c.get('proguard_configs', []) if p not in all_configs)
-    deps_info['proguard_all_configs'] = all_configs
+    deps_info['proguard_all_configs'] = sorted(set(all_configs))
     if options.type == 'android_app_bundle':
       for d in deps.Direct('android_app_bundle_module'):
         extra_jars.extend(
             c for c in d.get('proguard_classpath_jars', [])
             if c not in extra_jars)
-    deps_info['proguard_classpath_jars'] = extra_jars
+    deps_info['proguard_classpath_jars'] = sorted(set(extra_jars))
 
     if options.type == 'android_app_bundle':
       deps_proguard_enabled = []
diff --git a/build/config/android/internal_rules.gni b/build/config/android/internal_rules.gni
index 45d0a11..f7a8e97 100644
--- a/build/config/android/internal_rules.gni
+++ b/build/config/android/internal_rules.gni
@@ -456,6 +456,18 @@
           rebase_path(invoker.proguard_configs, root_build_dir)
       args += [ "--proguard-configs=$_rebased_proguard_configs" ]
     }
+    if (defined(invoker.static_library_dependent_targets)) {
+      _dependent_configs = []
+      foreach(d, invoker.static_library_dependent_targets) {
+        _target_label = get_label_info(d, "label_no_toolchain")
+        deps += [ "$_target_label$build_config_target_suffix" ]
+        _dep_gen_dir = get_label_info(d, "target_gen_dir")
+        _dep_name = get_label_info(d, "name")
+        _dependent_configs += [ "$_dep_gen_dir/$_dep_name.build_config" ]
+      }
+      _rebased_depdent_configs = rebase_path(_dependent_configs, root_build_dir)
+      args += [ "--static-library-dependent-configs=$_rebased_depdent_configs" ]
+    }
     if (defined(invoker.gradle_treat_as_prebuilt) &&
         invoker.gradle_treat_as_prebuilt) {
       args += [ "--gradle-treat-as-prebuilt" ]
@@ -3318,6 +3330,7 @@
               "secondary_abi_shared_libraries_runtime_deps_file",
               "secondary_native_lib_placeholders",
               "shared_libraries_runtime_deps_file",
+              "static_library_dependent_targets",
               "uncompress_shared_libraries",
             ])
       }
diff --git a/build/config/android/rules.gni b/build/config/android/rules.gni
index 6ba9c4d..a4f2553 100644
--- a/build/config/android/rules.gni
+++ b/build/config/android/rules.gni
@@ -445,7 +445,7 @@
 
       args = [
         # This is a list of .sources files.
-        "--sources-files=@FileArg($_rebased_build_config:jni:all_source)",
+        "--sources-files=@FileArg($_rebased_build_config:deps_info:jni:all_source)",
         "--srcjar-path",
         rebase_path(_srcjar_output, root_build_dir),
         "--depfile",
@@ -2593,6 +2593,7 @@
                                "no_build_hooks",
                                "secondary_abi_loadable_modules",
                                "secondary_native_lib_placeholders",
+                               "static_library_dependent_targets",
                              ])
       if (_is_bundle_module) {
         type = "android_app_bundle_module"
@@ -3106,6 +3107,7 @@
                                "shared_resources_whitelist_locales",
                                "shared_resources_whitelist_target",
                                "srcjar_deps",
+                               "static_library_dependent_targets",
                                "support_zh_hk",
                                "testonly",
                                "uncompress_shared_libraries",
diff --git a/build/fuchsia/linux.sdk.sha1 b/build/fuchsia/linux.sdk.sha1
index f881c1a0..212faf59 100644
--- a/build/fuchsia/linux.sdk.sha1
+++ b/build/fuchsia/linux.sdk.sha1
@@ -1 +1 @@
-8917970824569638096
\ No newline at end of file
+8917944738235855008
\ No newline at end of file
diff --git a/build/fuchsia/mac.sdk.sha1 b/build/fuchsia/mac.sdk.sha1
index bf6f7594..13e8c1b7 100644
--- a/build/fuchsia/mac.sdk.sha1
+++ b/build/fuchsia/mac.sdk.sha1
@@ -1 +1 @@
-8917975149452313648
\ No newline at end of file
+8917946904948775232
\ No newline at end of file
diff --git a/build/sanitizers/lsan_suppressions.cc b/build/sanitizers/lsan_suppressions.cc
index 63838ac..ac5da9c 100644
--- a/build/sanitizers/lsan_suppressions.cc
+++ b/build/sanitizers/lsan_suppressions.cc
@@ -75,9 +75,6 @@
     "leak:ppapi::proxy::PPP_Instance_Private_ProxyTest_PPPInstancePrivate_"
     "Test\n"
 
-    // http://crbug.com/355641
-    "leak:TrayAccessibilityTest\n"
-
     // http://crbug.com/356306
     "leak:service_manager::SetProcessTitleFromCommandLine\n"
 
diff --git a/build/sanitizers/tsan_suppressions.cc b/build/sanitizers/tsan_suppressions.cc
index 3f61e1c6..3bfa2f5 100644
--- a/build/sanitizers/tsan_suppressions.cc
+++ b/build/sanitizers/tsan_suppressions.cc
@@ -55,23 +55,14 @@
     "race:third_party/ffmpeg/libavcodec/h264pred.c\n"
     "race:media::ReleaseData\n"
 
-    // http://crbug.com/158922
-    "race:third_party/libvpx/source/libvpx/vp8/encoder/*\n"
-    "race:third_party/libvpx/source/libvpx/vp9/encoder/*\n"
-
     // http://crbug.com/239359
     "race:media::TestInputCallback::OnData\n"
 
-    // http://crbug.com/244368
-    "race:skia::BeginPlatformPaint\n"
-
     // http://crbug.com/244385
     "race:unixTempFileDir\n"
 
     // http://crbug.com/244755
     "race:v8::internal::Zone::NewExpand\n"
-    "race:TooLateToEnableNow\n"
-    "race:adjust_segment_bytes_allocated\n"
 
     // http://crbug.com/244774
     "race:webrtc::RTPReceiver::ProcessBitrate\n"
@@ -83,7 +74,6 @@
     "race:webrtc::ViEEncoder::DeliverFrame\n"
     "race:webrtc::vcm::VideoReceiver::Decode\n"
     "race:webrtc::VCMReceiver::FrameForDecoding\n"
-    "race:*trace_event_unique_catstatic*\n"
 
     // http://crbug.com/244856
     "race:libpulsecommon*.so\n"
@@ -93,7 +83,6 @@
 
     // http://crbug.com/257396
     "race:base::trace_event::"
-    "TraceEventTestFixture_TraceSamplingScope_Test::TestBody\n"
 
     // http://crbug.com/258479
     "race:SamplingStateScope\n"
@@ -118,9 +107,6 @@
     // http://crbug.com/308590
     "race:CustomThreadWatcher::~CustomThreadWatcher\n"
 
-    // http://crbug.com/310851
-    "race:net::ProxyResolverV8Tracing::Job::~Job\n"
-
     // http://crbug.com/476529
     "deadlock:cc::VideoLayerImpl::WillDraw\n"
 
@@ -135,40 +121,17 @@
     "race:content::"
     "VideoCaptureImplTest::MockVideoCaptureImpl::~MockVideoCaptureImpl\n"
 
-    // http://crbug.com/333871
-    "race:v8::internal::Interface::NewValue()::value_interface\n"
-    "race:v8::internal::IsMinusZero(double)::minus_zero\n"
-    "race:v8::internal::FastCloneShallowObjectStub::"
-    "InitializeInterfaceDescriptor\n"
-    "race:v8::internal::KeyedLoadStubCompiler::registers\n"
-    "race:v8::internal::KeyedStoreStubCompiler::registers()::registers\n"
-    "race:v8::internal::KeyedLoadFastElementStub::"
-    "InitializeInterfaceDescriptor\n"
-    "race:v8::internal::KeyedStoreFastElementStub::"
-    "InitializeInterfaceDescriptor\n"
-    "race:v8::internal::LoadStubCompiler::registers\n"
-    "race:v8::internal::StoreStubCompiler::registers\n"
-    "race:v8::internal::HValue::LoopWeight\n"
-
     // http://crbug.com/334140
     "race:CommandLine::HasSwitch\n"
     "race:CommandLine::current_process_commandline_\n"
     "race:CommandLine::GetSwitchValueASCII\n"
 
-    // http://crbug.com/338675
-    "race:blink::s_platform\n"
-    "race:content::"
-    "RendererWebKitPlatformSupportImpl::~RendererWebKitPlatformSupportImpl\n"
-
     // http://crbug.com/347534
     "race:v8::internal::V8::TearDown\n"
 
     // http://crbug.com/347538
     "race:sctp_timer_start\n"
 
-    // http://crbug.com/347553
-    "race:blink::WebString::reset\n"
-
     // http://crbug.com/348511
     "race:webrtc::acm1::AudioCodingModuleImpl::PlayoutData10Ms\n"
 
@@ -195,9 +158,6 @@
     // http:://crbug.com/386385
     "race:content::AppCacheStorageImpl::DatabaseTask::CallRunCompleted\n"
 
-    // http://crbug.com/388730
-    "race:g_next_user_script_id\n"
-
     // http://crbug.com/397022
     "deadlock:"
     "base::trace_event::TraceEventTestFixture_ThreadOnceBlocking_Test::"
@@ -212,9 +172,6 @@
     // https://code.google.com/p/skia/issues/detail?id=3294
     "race:SkBaseMutex::acquire\n"
 
-    // https://crbug.com/430533
-    "race:TileTaskGraphRunner::Run\n"
-
     // Lock inversion in third party code, won't fix.
     // https://crbug.com/455638
     "deadlock:dbus::Bus::ShutdownAndBlock\n"
@@ -225,9 +182,6 @@
     // https://crbug.com/454655
     "race:content::BrowserTestBase::PostTaskToInProcessRendererAndWait\n"
 
-    // https://crbug.com/569682
-    "race:blink::ThreadState::visitStackRoots\n"
-
     // http://crbug.com/582274
     "race:usrsctp_close\n"
 
diff --git a/chrome/android/BUILD.gn b/chrome/android/BUILD.gn
index 3d4f93a..80dfb92 100644
--- a/chrome/android/BUILD.gn
+++ b/chrome/android/BUILD.gn
@@ -1785,6 +1785,12 @@
     apk_name = "TrichromeLibrary"
     android_manifest = trichrome_library_android_manifest
     android_manifest_dep = ":trichrome_library_android_manifest"
+    if (trichrome_synchronized_proguard) {
+      static_library_dependent_targets = [
+        ":trichrome_chrome_apk",
+        "//android_webview:trichrome_webview_apk",
+      ]
+    }
   }
 }
 
diff --git a/chrome/android/java/AndroidManifest.xml b/chrome/android/java/AndroidManifest.xml
index d15f8d5..1461597 100644
--- a/chrome/android/java/AndroidManifest.xml
+++ b/chrome/android/java/AndroidManifest.xml
@@ -48,6 +48,9 @@
     <uses-permission android:name="android.permission.INTERNET"/>
     <uses-permission android:name="android.permission.MANAGE_ACCOUNTS"/>
     <uses-permission android:name="android.permission.MODIFY_AUDIO_SETTINGS"/>
+    {% if target_sdk_version|int > 28 or target_sdk_version == "Q" %}
+        <uses-permission-sdk-23 android:name="android.permission.READ_MEDIA_IMAGES"/>
+    {% endif %}
     <uses-permission android:name="android.permission.NFC"/>
     <uses-permission android:name="android.permission.READ_EXTERNAL_STORAGE"/>
     <uses-permission android:name="android.permission.READ_SYNC_SETTINGS"/>
diff --git a/chrome/android/java/src/org/chromium/chrome/browser/photo_picker/FileEnumWorkerTask.java b/chrome/android/java/src/org/chromium/chrome/browser/photo_picker/FileEnumWorkerTask.java
index 789bbdd38..c9967fd 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/photo_picker/FileEnumWorkerTask.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/photo_picker/FileEnumWorkerTask.java
@@ -13,6 +13,7 @@
 import android.os.Environment;
 import android.provider.MediaStore;
 
+import org.chromium.base.BuildInfo;
 import org.chromium.base.ThreadUtils;
 import org.chromium.base.task.AsyncTask;
 import org.chromium.net.MimeTypeFilter;
@@ -90,20 +91,26 @@
         final String[] selectColumns = {MediaStore.Images.Media._ID,
                 MediaStore.Images.Media.DATE_TAKEN, MediaStore.Images.Media.DATA};
 
-        final String whereClause = "(" + MediaStore.Images.Media.DATA + " LIKE ? OR "
-                + MediaStore.Images.Media.DATA + " LIKE ? OR " + MediaStore.Images.Media.DATA
-                + " LIKE ?) AND " + MediaStore.Images.Media.DATA + " NOT LIKE ?";
+        String whereClause = null;
+        String[] whereArgs = null;
+        // Looks like we loose access to the filter, starting with the Q SDK.
+        if (!BuildInfo.isAtLeastQ()) {
+            whereClause = "(" + MediaStore.Images.Media.DATA + " LIKE ? OR "
+                    + MediaStore.Images.Media.DATA + " LIKE ? OR " + MediaStore.Images.Media.DATA
+                    + " LIKE ?) AND " + MediaStore.Images.Media.DATA + " NOT LIKE ?";
 
-        final String[] whereArgs = {// Include:
-                getCameraDirectory().toString() + "%",
-                Environment.getExternalStoragePublicDirectory(Environment.DIRECTORY_PICTURES) + "%",
-                Environment.getExternalStoragePublicDirectory(Environment.DIRECTORY_DOWNLOADS)
-                        + "%",
-                // Exclude low-quality sources, such as the screenshots directory:
-                // TODO(finnur): As of the Q SDK this can be converted to DIRECTORY_SCREENSHOTS.
-                Environment.getExternalStoragePublicDirectory(Environment.DIRECTORY_PICTURES)
-                        + "/Screenshots/"
-                        + "%"};
+            whereArgs = new String[] {
+                    // Include:
+                    getCameraDirectory().toString() + "%",
+                    Environment.getExternalStoragePublicDirectory(Environment.DIRECTORY_PICTURES)
+                            + "%",
+                    Environment.getExternalStoragePublicDirectory(Environment.DIRECTORY_DOWNLOADS)
+                            + "%",
+                    // Exclude low-quality sources, such as the screenshots directory:
+                    Environment.getExternalStoragePublicDirectory(Environment.DIRECTORY_PICTURES)
+                            + "/Screenshots/"
+                            + "%"};
+        }
 
         final String orderBy = MediaStore.Images.Media.DATE_TAKEN + " DESC";
 
diff --git a/chrome/android/java/src/org/chromium/chrome/browser/sync/ProfileSyncService.java b/chrome/android/java/src/org/chromium/chrome/browser/sync/ProfileSyncService.java
index 6aff916..8e5bce5 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/sync/ProfileSyncService.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/sync/ProfileSyncService.java
@@ -374,6 +374,10 @@
                 syncEverything ? ALL_SELECTABLE_TYPES : modelTypeSetToArray(enabledTypes));
     }
 
+    public void triggerSync() {
+        nativeTriggerRefresh(mNativeProfileSyncServiceAndroid);
+    }
+
     public void setFirstSetupComplete() {
         nativeSetFirstSetupComplete(mNativeProfileSyncServiceAndroid);
     }
@@ -638,6 +642,7 @@
     private native int[] nativeGetPreferredDataTypes(long nativeProfileSyncServiceAndroid);
     private native void nativeSetChosenDataTypes(
             long nativeProfileSyncServiceAndroid, boolean syncEverything, int[] modelTypeArray);
+    private native void nativeTriggerRefresh(long nativeProfileSyncServiceAndroid);
     private native void nativeSetSetupInProgress(
             long nativeProfileSyncServiceAndroid, boolean inProgress);
     private native void nativeSetFirstSetupComplete(long nativeProfileSyncServiceAndroid);
diff --git a/chrome/android/javatests/src/org/chromium/chrome/browser/ntp/NewTabPageTest.java b/chrome/android/javatests/src/org/chromium/chrome/browser/ntp/NewTabPageTest.java
index 7307900..0a7e21b 100644
--- a/chrome/android/javatests/src/org/chromium/chrome/browser/ntp/NewTabPageTest.java
+++ b/chrome/android/javatests/src/org/chromium/chrome/browser/ntp/NewTabPageTest.java
@@ -309,6 +309,9 @@
     @Feature({"NewTabPage", "FeedNewTabPage"})
     @ParameterAnnotations.UseMethodParameter(InterestFeedParams.class)
     public void testFocusFakebox(boolean interestFeedEnabled) {
+        // TODO(https://crbug.com/944061): Re-enable tablet test on interest feed enabled.
+        if (interestFeedEnabled && mActivityTestRule.getActivity().isTablet()) return;
+
         int initialFakeboxTop = getFakeboxTop(mNtp);
 
         TouchCommon.singleClickView(mFakebox);
@@ -437,6 +440,9 @@
     @ParameterAnnotations.UseMethodParameter(InterestFeedParams.class)
     public void testUrlFocusAnimationsDisabledOnLoad(boolean interestFeedEnabled)
             throws InterruptedException {
+        // TODO(https://crbug.com/944061): Re-enable tablet test on interest feed enabled.
+        if (interestFeedEnabled && mActivityTestRule.getActivity().isTablet()) return;
+
         Assert.assertFalse(getUrlFocusAnimationsDisabled());
         ChromeTabUtils.waitForTabPageLoaded(mTab, mTestServer.getURL(TEST_PAGE), new Runnable() {
             @Override
@@ -535,6 +541,9 @@
     @Feature({"NewTabPage", "FeedNewTabPage"})
     @ParameterAnnotations.UseMethodParameter(InterestFeedParams.class)
     public void testSetSearchProviderInfo(boolean interestFeedEnabled) throws Throwable {
+        // TODO(https://crbug.com/944061): Re-enable tablet test on interest feed enabled.
+        if (interestFeedEnabled && mActivityTestRule.getActivity().isTablet()) return;
+
         mActivityTestRule.runOnUiThread(new Runnable() {
             @Override
             public void run() {
diff --git a/chrome/android/trichrome.gni b/chrome/android/trichrome.gni
index df22efe..b7f224db 100644
--- a/chrome/android/trichrome.gni
+++ b/chrome/android/trichrome.gni
@@ -46,6 +46,7 @@
                              "apk_name",
                              "android_manifest",
                              "android_manifest_dep",
+                             "static_library_dependent_targets",
                            ])
 
     # TODO(torne): this contains the list of locales amongst other things.
diff --git a/chrome/browser/BUILD.gn b/chrome/browser/BUILD.gn
index 6563e87f..50977ea 100644
--- a/chrome/browser/BUILD.gn
+++ b/chrome/browser/BUILD.gn
@@ -1533,8 +1533,6 @@
     "signin/chrome_signin_proxying_url_loader_factory.h",
     "signin/chrome_signin_url_loader_throttle.cc",
     "signin/chrome_signin_url_loader_throttle.h",
-    "signin/gaia_cookie_manager_service_factory.cc",
-    "signin/gaia_cookie_manager_service_factory.h",
     "signin/header_modification_delegate.h",
     "signin/header_modification_delegate_impl.cc",
     "signin/header_modification_delegate_impl.h",
@@ -2442,10 +2440,6 @@
       "android/oom_intervention/oom_intervention_tab_helper.h",
       "android/partner_browser_customizations.cc",
       "android/partner_browser_customizations.h",
-      "android/password_manager/manual_filling_view_android.cc",
-      "android/password_manager/manual_filling_view_android.h",
-      "android/password_manager/password_generation_dialog_view_android.cc",
-      "android/password_manager/password_generation_dialog_view_android.h",
       "android/password_ui_view_android.cc",
       "android/password_ui_view_android.h",
       "android/payments/service_worker_payment_app_bridge.cc",
diff --git a/chrome/browser/browsing_data/browsing_data_appcache_helper.cc b/chrome/browser/browsing_data/browsing_data_appcache_helper.cc
index 9bc6a254..2b7869e8 100644
--- a/chrome/browser/browsing_data/browsing_data_appcache_helper.cc
+++ b/chrome/browser/browsing_data/browsing_data_appcache_helper.cc
@@ -18,7 +18,7 @@
 #include "content/public/browser/browser_thread.h"
 #include "content/public/browser/storage_partition.h"
 #include "content/public/browser/storage_usage_info.h"
-#include "net/base/completion_callback.h"
+#include "net/base/completion_once_callback.h"
 #include "third_party/blink/public/mojom/appcache/appcache_info.mojom.h"
 
 using content::AppCacheService;
@@ -100,7 +100,7 @@
     const url::Origin& origin) {
   DCHECK_CURRENTLY_ON(BrowserThread::IO);
   appcache_service_->DeleteAppCachesForOrigin(origin,
-                                              net::CompletionCallback());
+                                              net::CompletionOnceCallback());
 }
 
 CannedBrowsingDataAppCacheHelper::CannedBrowsingDataAppCacheHelper(
diff --git a/chrome/browser/browsing_data/browsing_data_database_helper.cc b/chrome/browser/browsing_data/browsing_data_database_helper.cc
index 8fe08c7b..7e4024f 100644
--- a/chrome/browser/browsing_data/browsing_data_database_helper.cc
+++ b/chrome/browser/browsing_data/browsing_data_database_helper.cc
@@ -22,7 +22,7 @@
 #include "content/public/browser/browser_thread.h"
 #include "content/public/browser/storage_partition.h"
 #include "content/public/browser/storage_usage_info.h"
-#include "net/base/completion_callback.h"
+#include "net/base/completion_once_callback.h"
 #include "net/base/net_errors.h"
 #include "storage/common/database/database_identifier.h"
 
@@ -70,7 +70,7 @@
       FROM_HERE,
       base::BindOnce(
           base::IgnoreResult(&storage::DatabaseTracker::DeleteDataForOrigin),
-          tracker_, origin, net::CompletionCallback()));
+          tracker_, origin, net::CompletionOnceCallback()));
 }
 
 CannedBrowsingDataDatabaseHelper::CannedBrowsingDataDatabaseHelper(
diff --git a/chrome/browser/browsing_data/browsing_data_remover_browsertest.cc b/chrome/browser/browsing_data/browsing_data_remover_browsertest.cc
index 4e41183..ddfda153 100644
--- a/chrome/browser/browsing_data/browsing_data_remover_browsertest.cc
+++ b/chrome/browser/browsing_data/browsing_data_remover_browsertest.cc
@@ -999,21 +999,12 @@
   TestSiteData("SessionCookie", GetParam());
 }
 
-// TODO(crbug.com/849238): This test is flaky on Mac (dbg) builds.
-#if defined(OS_MACOSX)
-#define MAYBE_LocalStorageDeletion DISABLED_LocalStorageDeletion
-#define MAYBE_LocalStorageIncognitoDeletion \
-  DISABLED_LocalStorageIncognitoDeletion
-#else
-#define MAYBE_LocalStorageDeletion LocalStorageDeletion
-#define MAYBE_LocalStorageIncognitoDeletion LocalStorageIncognitoDeletion
-#endif
-IN_PROC_BROWSER_TEST_P(BrowsingDataRemoverBrowserTestP,
-                       MAYBE_LocalStorageDeletion) {
+IN_PROC_BROWSER_TEST_P(BrowsingDataRemoverBrowserTestP, LocalStorageDeletion) {
   TestSiteData("LocalStorage", GetParam());
 }
+
 IN_PROC_BROWSER_TEST_P(BrowsingDataRemoverBrowserTestP,
-                       MAYBE_LocalStorageIncognitoDeletion) {
+                       LocalStorageIncognitoDeletion) {
   UseIncognitoBrowser();
   TestSiteData("LocalStorage", GetParam());
 }
diff --git a/chrome/browser/chrome_content_browser_client.cc b/chrome/browser/chrome_content_browser_client.cc
index 2f0c54b..7d4d5df 100644
--- a/chrome/browser/chrome_content_browser_client.cc
+++ b/chrome/browser/chrome_content_browser_client.cc
@@ -3755,6 +3755,12 @@
         autofill::mojom::AutofillDriverAssociatedRequest(std::move(*handle)),
         render_frame_host);
     return true;
+  } else if (interface_name == autofill::mojom::PasswordManagerDriver::Name_) {
+    password_manager::ContentPasswordManagerDriverFactory::BindAutofillDriver(
+        autofill::mojom::PasswordManagerDriverAssociatedRequest(
+            std::move(*handle)),
+        render_frame_host);
+    return true;
   } else if (interface_name ==
              content_capture::mojom::ContentCaptureReceiver::Name_) {
     content_capture::ContentCaptureReceiverManager::BindContentCaptureReceiver(
diff --git a/chrome/browser/chromeos/arc/auth/arc_auth_service_browsertest.cc b/chrome/browser/chromeos/arc/auth/arc_auth_service_browsertest.cc
index 512124f..8e12122 100644
--- a/chrome/browser/chromeos/arc/auth/arc_auth_service_browsertest.cc
+++ b/chrome/browser/chromeos/arc/auth/arc_auth_service_browsertest.cc
@@ -30,7 +30,6 @@
 #include "chrome/browser/chromeos/policy/browser_policy_connector_chromeos.h"
 #include "chrome/browser/chromeos/profiles/profile_helper.h"
 #include "chrome/browser/profiles/profile.h"
-#include "chrome/browser/signin/account_fetcher_service_factory.h"
 #include "chrome/browser/signin/chrome_device_id_helper.h"
 #include "chrome/browser/signin/identity_manager_factory.h"
 #include "chrome/browser/signin/identity_test_environment_profile_adaptor.h"
@@ -236,6 +235,11 @@
         user_manager::UserManager::Get());
   }
 
+  void EnableRemovalOfExtendedAccountInfo() {
+    identity_test_environment_adaptor_->identity_test_env()
+        ->EnableRemovalOfExtendedAccountInfo();
+  }
+
   void SetAccountAndProfile(const user_manager::UserType user_type) {
     const AccountId account_id(
         AccountId::FromUserEmailGaiaId(kFakeUserName, kFakeGaiaId));
@@ -598,11 +602,10 @@
           kSecondaryAccountEmail);
   ASSERT_TRUE(maybe_account_info.has_value());
 
-  AccountFetcherService* account_fetcher_service =
-      AccountFetcherServiceFactory::GetForProfile(profile());
   // Necessary to ensure that the OnExtendedAccountInfoRemoved() observer will
   // be sent.
-  account_fetcher_service->EnableAccountRemovalForTest();
+  EnableRemovalOfExtendedAccountInfo();
+
   identity_manager->GetAccountsMutator()->RemoveAccount(
       maybe_account_info.value().account_id,
       signin_metrics::SourceForRefreshTokenOperation::kUnknown);
diff --git a/chrome/browser/chromeos/login/configuration_based_enrollment_browsertest.cc b/chrome/browser/chromeos/login/configuration_based_enrollment_browsertest.cc
index 61929fd..ff14aca7 100644
--- a/chrome/browser/chromeos/login/configuration_based_enrollment_browsertest.cc
+++ b/chrome/browser/chromeos/login/configuration_based_enrollment_browsertest.cc
@@ -295,8 +295,9 @@
 
 // Check that configuration allows to skip Update screen and get to Enrollment
 // screen.
+// https://crbug.com/945834
 IN_PROC_BROWSER_TEST_F(EnterpriseEnrollmentConfigurationTest,
-                       TestEnrollUsingToken) {
+                       DISABLED_TestEnrollUsingToken) {
   enrollment_helper_.DisableAttributePromptUpdate();
   // Token from configuration file:
   enrollment_helper_.ExpectTokenEnrollmentSuccess(
diff --git a/chrome/browser/chromeos/login/signin/oauth2_login_manager.cc b/chrome/browser/chromeos/login/signin/oauth2_login_manager.cc
index 0f0b919..1e701e0 100644
--- a/chrome/browser/chromeos/login/signin/oauth2_login_manager.cc
+++ b/chrome/browser/chromeos/login/signin/oauth2_login_manager.cc
@@ -11,7 +11,6 @@
 #include "base/metrics/histogram_macros.h"
 #include "chrome/browser/profiles/profile.h"
 #include "chrome/browser/signin/chrome_device_id_helper.h"
-#include "chrome/browser/signin/gaia_cookie_manager_service_factory.h"
 #include "chrome/browser/signin/identity_manager_factory.h"
 #include "chromeos/constants/chromeos_switches.h"
 #include "components/account_id/account_id.h"
diff --git a/chrome/browser/chromeos/power/auto_screen_brightness/adapter.cc b/chrome/browser/chromeos/power/auto_screen_brightness/adapter.cc
index 97cd9e0a..69ef8c0 100644
--- a/chrome/browser/chromeos/power/auto_screen_brightness/adapter.cc
+++ b/chrome/browser/chromeos/power/auto_screen_brightness/adapter.cc
@@ -87,6 +87,7 @@
 Adapter::~Adapter() = default;
 
 void Adapter::OnAmbientLightUpdated(int lux) {
+  // Ambient light data is only used when adapter is initialized to success.
   if (adapter_status_ != Status::kSuccess)
     return;
 
@@ -115,22 +116,20 @@
 
 void Adapter::OnUserBrightnessChanged(double old_brightness_percent,
                                       double new_brightness_percent) {
-  current_brightness_ = new_brightness_percent;
-}
-
-void Adapter::OnUserBrightnessChangeRequested() {
-  if (params_.user_adjustment_effect != UserAdjustmentEffect::kContinueAuto) {
-    // Adapter will stop making brightness adjustment until suspend/resume or
-    // when browser restarts.
-    adapter_disabled_by_user_adjustment_ = true;
-  }
-
-  if (!als_init_status_)
+  // We skip this notification if adapter hasn't been initialised because its
+  // |params_| may change. We need to log even if adapter is initialized to
+  // disabled.
+  if (adapter_status_ == Status::kInitializing)
     return;
 
+  // TODO(jiameng): record current average als and update thresholds.
+  current_brightness_ = new_brightness_percent;
+
   if (!metrics_reporter_)
     return;
 
+  DCHECK(als_init_status_);
+
   switch (*als_init_status_) {
     case AlsReader::AlsInitStatus::kSuccess:
       DCHECK(!params_.metrics_key.empty());
@@ -161,7 +160,22 @@
   }
 }
 
+void Adapter::OnUserBrightnessChangeRequested() {
+  // We skip this notification if adapter hasn't been initialised because its
+  // |params_| may change.
+  if (adapter_status_ == Status::kInitializing)
+    return;
+
+  if (params_.user_adjustment_effect != UserAdjustmentEffect::kContinueAuto) {
+    // Adapter will stop making brightness adjustment until suspend/resume or
+    // when browser restarts.
+    adapter_disabled_by_user_adjustment_ = true;
+  }
+}
+
 void Adapter::OnModelTrained(const MonotoneCubicSpline& brightness_curve) {
+  // It's ok to record brightness curve even when adapter is not completely
+  // initialized. But we stop recording curves if we know adapter is disabled.
   if (adapter_status_ == Status::kDisabled)
     return;
 
@@ -196,6 +210,11 @@
 }
 
 void Adapter::SuspendDone(const base::TimeDelta& /* sleep_duration */) {
+  // We skip this notification if adapter hasn't been initialised because its
+  // |params_| may change.
+  if (adapter_status_ == Status::kInitializing)
+    return;
+
   if (params_.user_adjustment_effect == UserAdjustmentEffect::kPauseAuto)
     adapter_disabled_by_user_adjustment_ = false;
 }
@@ -385,6 +404,7 @@
 }
 
 void Adapter::MaybeAdjustBrightness(base::TimeTicks now) {
+  DCHECK_EQ(adapter_status_, Status::kSuccess);
   DCHECK(ambient_light_values_);
   const base::Optional<AlsAvgStdDev> als_avg_stddev =
       ambient_light_values_->AverageAmbientWithStdDev(now);
@@ -437,6 +457,7 @@
 }
 
 void Adapter::UpdateBrightnessChangeThresholds() {
+  DCHECK_NE(adapter_status_, Status::kInitializing);
   DCHECK(log_average_ambient_lux_);
 
   brightening_threshold_ =
@@ -447,6 +468,7 @@
 
 base::Optional<double> Adapter::GetBrightnessBasedOnAmbientLogLux(
     double ambient_log_lux) const {
+  DCHECK_EQ(adapter_status_, Status::kSuccess);
   switch (params_.model_curve) {
     case ModelCurve::kGlobal:
       return global_curve_->Interpolate(ambient_log_lux);
@@ -465,6 +487,7 @@
 void Adapter::WriteLogMessages(double new_log_als,
                                double new_brightness,
                                BrightnessChangeCause cause) const {
+  DCHECK_EQ(adapter_status_, Status::kSuccess);
   const std::string old_log_als =
       log_average_ambient_lux_
           ? base::StringPrintf("%.4f", log_average_ambient_lux_.value()) + "->"
diff --git a/chrome/browser/devtools/device/tcp_device_provider.cc b/chrome/browser/devtools/device/tcp_device_provider.cc
index c761a0bb..c949036f 100644
--- a/chrome/browser/devtools/device/tcp_device_provider.cc
+++ b/chrome/browser/devtools/device/tcp_device_provider.cc
@@ -7,6 +7,7 @@
 #include <utility>
 
 #include "base/bind.h"
+#include "base/callback_helpers.h"
 #include "base/location.h"
 #include "base/single_thread_task_runner.h"
 #include "base/stl_util.h"
@@ -18,6 +19,7 @@
 #include "chrome/browser/net/system_network_context_manager.h"
 #include "content/public/browser/browser_task_traits.h"
 #include "mojo/public/cpp/bindings/binding.h"
+#include "net/base/completion_repeating_callback.h"
 #include "net/base/net_errors.h"
 #include "net/log/net_log_source.h"
 #include "net/log/net_log_with_source.h"
@@ -65,8 +67,9 @@
     std::unique_ptr<net::StreamSocket> socket(new net::TCPClientSocket(
         resolved_addresses.value(), nullptr, nullptr, net::NetLogSource()));
     net::StreamSocket* socket_ptr = socket.get();
-    net::CompletionCallback on_connect =
-        base::Bind(&RunSocketCallback, callback_, base::Passed(&socket));
+    net::CompletionRepeatingCallback on_connect =
+        base::AdaptCallbackForRepeating(
+            base::BindOnce(&RunSocketCallback, callback_, std::move(socket)));
     result = socket_ptr->Connect(on_connect);
     if (result != net::ERR_IO_PENDING)
       on_connect.Run(result);
diff --git a/chrome/browser/password_manager/chrome_password_manager_client.cc b/chrome/browser/password_manager/chrome_password_manager_client.cc
index 15bce0cf..e1c2fd6 100644
--- a/chrome/browser/password_manager/chrome_password_manager_client.cc
+++ b/chrome/browser/password_manager/chrome_password_manager_client.cc
@@ -172,7 +172,6 @@
       driver_factory_(nullptr),
       content_credential_manager_(this),
       password_generation_driver_bindings_(web_contents, this),
-      password_manager_driver_bindings_(web_contents, this),
       observer_(nullptr),
       credentials_filter_(
           this,
@@ -440,20 +439,25 @@
   password_manager_.AutofillHttpAuth(best_matches, preferred_match);
 }
 
+bool ChromePasswordManagerClient::IsIsolationForPasswordSitesEnabled() const {
+  // TODO(crbug.com/862989): Move the following function (and the feature) to
+  // the password component. Then remove IsIsolationForPasswordsSitesEnabled()
+  // from the PasswordManagerClient interface.
+  return SiteIsolationPolicy::IsIsolationForPasswordSitesEnabled();
+}
+
+#if defined(FULL_SAFE_BROWSING)
 void ChromePasswordManagerClient::CheckSafeBrowsingReputation(
     const GURL& form_action,
     const GURL& frame_url) {
-#if defined(FULL_SAFE_BROWSING)
   safe_browsing::PasswordProtectionService* pps =
       GetPasswordProtectionService();
   if (pps) {
     pps->MaybeStartPasswordFieldOnFocusRequest(
         web_contents(), GetMainFrameURL(), form_action, frame_url);
   }
-#endif
 }
 
-#if defined(FULL_SAFE_BROWSING)
 safe_browsing::PasswordProtectionService*
 ChromePasswordManagerClient::GetPasswordProtectionService() const {
   return safe_browsing::ChromePasswordProtectionService::
@@ -482,7 +486,7 @@
     pps->MaybeLogPasswordReuseDetectedEvent(web_contents());
   }
 }
-#endif
+#endif  // defined(FULL_SAFE_BROWSING)
 
 ukm::SourceId ChromePasswordManagerClient::GetUkmSourceId() {
   return ukm::GetSourceIdForWebContentsDocument(web_contents());
@@ -709,7 +713,8 @@
   DCHECK(driver);
   gfx::RectF element_bounds_in_screen_space =
       GetBoundsInScreenSpace(TransformToRootCoordinates(
-          password_manager_driver_bindings_.GetCurrentTargetFrame(), bounds));
+          password_generation_driver_bindings_.GetCurrentTargetFrame(),
+          bounds));
   popup_controller_ = PasswordGenerationPopupControllerImpl::GetOrCreate(
       popup_controller_, element_bounds_in_screen_space, form,
       base::string16(),  // No generation_element needed for editing.
@@ -748,7 +753,7 @@
 
   password_manager::PasswordManagerDriver* driver =
       driver_factory_->GetDriverForFrame(
-          password_manager_driver_bindings_.GetCurrentTargetFrame());
+          password_generation_driver_bindings_.GetCurrentTargetFrame());
   password_manager_.OnPresaveGeneratedPassword(driver, password_form);
 }
 
@@ -762,7 +767,7 @@
 
   password_manager::PasswordManagerDriver* driver =
       driver_factory_->GetDriverForFrame(
-          password_manager_driver_bindings_.GetCurrentTargetFrame());
+          password_generation_driver_bindings_.GetCurrentTargetFrame());
   password_manager_.OnPasswordNoLongerGenerated(driver, password_form);
 
   PasswordGenerationPopupController* controller = popup_controller_.get();
@@ -892,103 +897,6 @@
 #endif
 }
 
-void ChromePasswordManagerClient::PasswordFormsParsed(
-    const std::vector<autofill::PasswordForm>& forms) {
-  if (!password_manager::bad_message::CheckChildProcessSecurityPolicy(
-          password_manager_driver_bindings_.GetCurrentTargetFrame(), forms,
-          BadMessageReason::CPMD_BAD_ORIGIN_FORMS_PARSED))
-    return;
-  password_manager::PasswordManagerDriver* driver =
-      driver_factory_->GetDriverForFrame(
-          password_manager_driver_bindings_.GetCurrentTargetFrame());
-  GetPasswordManager()->OnPasswordFormsParsed(driver, forms);
-}
-
-void ChromePasswordManagerClient::PasswordFormsRendered(
-    const std::vector<autofill::PasswordForm>& visible_forms,
-    bool did_stop_loading) {
-  if (!password_manager::bad_message::CheckChildProcessSecurityPolicy(
-          password_manager_driver_bindings_.GetCurrentTargetFrame(),
-          visible_forms, BadMessageReason::CPMD_BAD_ORIGIN_FORMS_RENDERED))
-    return;
-  password_manager::PasswordManagerDriver* driver =
-      driver_factory_->GetDriverForFrame(
-          password_manager_driver_bindings_.GetCurrentTargetFrame());
-  GetPasswordManager()->OnPasswordFormsRendered(driver, visible_forms,
-                                                did_stop_loading);
-}
-
-void ChromePasswordManagerClient::PasswordFormSubmitted(
-    const autofill::PasswordForm& password_form) {
-  if (!password_manager::bad_message::CheckChildProcessSecurityPolicy(
-          password_manager_driver_bindings_.GetCurrentTargetFrame(),
-          password_form, BadMessageReason::CPMD_BAD_ORIGIN_FORM_SUBMITTED))
-    return;
-  password_manager::PasswordManagerDriver* driver =
-      driver_factory_->GetDriverForFrame(
-          password_manager_driver_bindings_.GetCurrentTargetFrame());
-  GetPasswordManager()->OnPasswordFormSubmitted(driver, password_form);
-}
-
-void ChromePasswordManagerClient::ShowManualFallbackForSaving(
-    const autofill::PasswordForm& password_form) {
-  content::RenderFrameHost* frame =
-      password_manager_driver_bindings_.GetCurrentTargetFrame();
-  if (!password_manager::bad_message::CheckChildProcessSecurityPolicy(
-          frame, password_form,
-          BadMessageReason::CPMD_BAD_ORIGIN_SHOW_FALLBACK_FOR_SAVING))
-    return;
-  password_manager::PasswordManagerDriver* driver =
-      driver_factory_->GetDriverForFrame(frame);
-  GetPasswordManager()->ShowManualFallbackForSaving(driver, password_form);
-
-  if (SiteIsolationPolicy::IsIsolationForPasswordSitesEnabled()) {
-    // This function signals that the user is typing a password into
-    // |password_form|.  Use this as a heuristic to start site-isolating the
-    // form's site.  This is intended to be used primarily when full site
-    // isolation is not used, such as on Android.
-    content::SiteInstance::StartIsolatingSite(
-        frame->GetSiteInstance()->GetBrowserContext(), password_form.origin);
-  }
-}
-
-void ChromePasswordManagerClient::SameDocumentNavigation(
-    const autofill::PasswordForm& password_form) {
-  if (!password_manager::bad_message::CheckChildProcessSecurityPolicy(
-          password_manager_driver_bindings_.GetCurrentTargetFrame(),
-          password_form, BadMessageReason::CPMD_BAD_ORIGIN_IN_PAGE_NAVIGATION))
-    return;
-  password_manager::PasswordManagerDriver* driver =
-      driver_factory_->GetDriverForFrame(
-          password_manager_driver_bindings_.GetCurrentTargetFrame());
-  GetPasswordManager()->OnPasswordFormSubmittedNoChecks(driver, password_form);
-}
-
-void ChromePasswordManagerClient::ShowPasswordSuggestions(
-    base::i18n::TextDirection text_direction,
-    const base::string16& typed_username,
-    int options,
-    const gfx::RectF& bounds) {
-  password_manager::PasswordManagerDriver* driver =
-      driver_factory_->GetDriverForFrame(
-          password_manager_driver_bindings_.GetCurrentTargetFrame());
-  driver->GetPasswordAutofillManager()->OnShowPasswordSuggestions(
-      text_direction, typed_username, options,
-      TransformToRootCoordinates(
-          password_manager_driver_bindings_.GetCurrentTargetFrame(), bounds));
-}
-
-void ChromePasswordManagerClient::RecordSavePasswordProgress(
-    const std::string& log) {
-  GetLogManager()->LogSavePasswordProgress(log);
-}
-
-void ChromePasswordManagerClient::UserModifiedPasswordField() {
-  if (GetMetricsRecorder()) {
-    GetMetricsRecorder()->RecordUserModifiedPasswordField();
-  }
-}
-
 // static
 void ChromePasswordManagerClient::BindCredentialManager(
     blink::mojom::CredentialManagerRequest request,
@@ -1085,28 +993,20 @@
   popup_controller_->Show(PasswordGenerationPopupController::kOfferGeneration);
 }
 
-void ChromePasswordManagerClient::FocusedInputChanged(bool is_fillable,
-                                                      bool is_password_field) {
+void ChromePasswordManagerClient::FocusedInputChanged(
+    const url::Origin& last_committed_origin,
+    bool is_fillable,
+    bool is_password_field) {
 #if defined(OS_ANDROID)
   // Either #passwords-keyboards-accessory or #experimental-ui must be enabled.
   if (PasswordAccessoryController::AllowedForWebContents(web_contents())) {
     PasswordAccessoryController::GetOrCreate(web_contents())
-        ->RefreshSuggestionsForField(
-            password_manager_driver_bindings_.GetCurrentTargetFrame()
-                ->GetLastCommittedOrigin(),
-            is_fillable, is_password_field);
+        ->RefreshSuggestionsForField(last_committed_origin, is_fillable,
+                                     is_password_field);
   }
 #endif  // defined(OS_ANDROID)
 }
 
-void ChromePasswordManagerClient::LogFirstFillingResult(
-    uint32_t form_renderer_id,
-    int32_t result) {
-  auto* driver = driver_factory_->GetDriverForFrame(
-      password_manager_driver_bindings_.GetCurrentTargetFrame());
-  GetPasswordManager()->LogFirstFillingResult(driver, form_renderer_id, result);
-}
-
 password_manager::PasswordManager*
 ChromePasswordManagerClient::GetPasswordManager() {
   return &password_manager_;
diff --git a/chrome/browser/password_manager/chrome_password_manager_client.h b/chrome/browser/password_manager/chrome_password_manager_client.h
index b95dec1e..275220c 100644
--- a/chrome/browser/password_manager/chrome_password_manager_client.h
+++ b/chrome/browser/password_manager/chrome_password_manager_client.h
@@ -51,7 +51,6 @@
       public password_manager::PasswordManagerClientHelperDelegate,
       public content::WebContentsObserver,
       public content::WebContentsUserData<ChromePasswordManagerClient>,
-      public autofill::mojom::PasswordManagerDriver,
       public autofill::mojom::PasswordGenerationDriver,
       public content::RenderWidgetHost::InputEventObserver {
  public:
@@ -72,6 +71,10 @@
       std::unique_ptr<password_manager::PasswordFormManagerForUI> form_to_save,
       bool has_generated_password,
       bool is_update) override;
+  void HideManualFallbackForSaving() override;
+  void FocusedInputChanged(const url::Origin& last_committed_origin,
+                           bool is_fillable,
+                           bool is_password_field) override;
   bool PromptUserToChooseCredentials(
       std::vector<std::unique_ptr<autofill::PasswordForm>> local_forms,
       const GURL& origin,
@@ -98,6 +101,7 @@
       const std::map<base::string16, const autofill::PasswordForm*>&
           best_matches,
       const autofill::PasswordForm& preferred_match) const override;
+  bool IsIsolationForPasswordSitesEnabled() const override;
 
   PrefService* GetPrefs() const override;
   password_manager::PasswordStore* GetPasswordStore() const override;
@@ -140,6 +144,8 @@
   void FrameWasScrolled() override;
 
 #if defined(FULL_SAFE_BROWSING)
+  void CheckSafeBrowsingReputation(const GURL& form_action,
+                                   const GURL& frame_url) override;
   safe_browsing::PasswordProtectionService* GetPasswordProtectionService()
       const override;
 
@@ -185,33 +191,6 @@
  private:
   friend class content::WebContentsUserData<ChromePasswordManagerClient>;
 
-  // autofill::mojom::PasswordManagerDriver:
-  // Note that these messages received from a potentially compromised renderer.
-  // For that reason, any access to form data should be validated via
-  // bad_message::CheckChildProcessSecurityPolicy.
-  void PasswordFormsParsed(
-      const std::vector<autofill::PasswordForm>& forms) override;
-  void PasswordFormsRendered(
-      const std::vector<autofill::PasswordForm>& visible_forms,
-      bool did_stop_loading) override;
-  void PasswordFormSubmitted(
-      const autofill::PasswordForm& password_form) override;
-  void ShowManualFallbackForSaving(const autofill::PasswordForm& form) override;
-  void HideManualFallbackForSaving() override;
-  void SameDocumentNavigation(
-      const autofill::PasswordForm& password_form) override;
-  void ShowPasswordSuggestions(base::i18n::TextDirection text_direction,
-                               const base::string16& typed_username,
-                               int options,
-                               const gfx::RectF& bounds) override;
-  void RecordSavePasswordProgress(const std::string& log) override;
-  void UserModifiedPasswordField() override;
-  void CheckSafeBrowsingReputation(const GURL& form_action,
-                                   const GURL& frame_url) override;
-  void FocusedInputChanged(bool is_fillable, bool is_password_field) override;
-  void LogFirstFillingResult(uint32_t form_renderer_id,
-                             int32_t result) override;
-
   // content::WebContentsObserver overrides.
   void DidStartNavigation(
       content::NavigationHandle* navigation_handle) override;
@@ -276,8 +255,6 @@
 
   content::WebContentsFrameBindingSet<autofill::mojom::PasswordGenerationDriver>
       password_generation_driver_bindings_;
-  content::WebContentsFrameBindingSet<autofill::mojom::PasswordManagerDriver>
-      password_manager_driver_bindings_;
 
   // Observer for password generation popup.
   PasswordGenerationPopupObserver* observer_;
diff --git a/chrome/browser/password_manager/password_manager_browsertest.cc b/chrome/browser/password_manager/password_manager_browsertest.cc
index 480d404..40f339f 100644
--- a/chrome/browser/password_manager/password_manager_browsertest.cc
+++ b/chrome/browser/password_manager/password_manager_browsertest.cc
@@ -2468,8 +2468,11 @@
   std::vector<autofill::PasswordForm> password_forms;
   password_forms.push_back(autofill::PasswordForm());
   password_forms.back().origin = main_frame_url;
+  ContentPasswordManagerDriverFactory* factory =
+      ContentPasswordManagerDriverFactory::FromWebContents(WebContents());
+  EXPECT_TRUE(factory);
   autofill::mojom::PasswordManagerDriver* driver =
-      ChromePasswordManagerClient::FromWebContents(WebContents());
+      factory->GetDriverForFrame(iframe);
   EXPECT_TRUE(driver);
   driver->PasswordFormsParsed(password_forms);
 
@@ -3950,8 +3953,11 @@
 
   NavigateToFile("/password/password_form.html");
 
+  ContentPasswordManagerDriverFactory* factory =
+      ContentPasswordManagerDriverFactory::FromWebContents(WebContents());
   autofill::mojom::PasswordManagerDriver* driver =
-      ChromePasswordManagerClient::FromWebContents(WebContents());
+      factory->GetDriverForFrame(WebContents()->GetMainFrame());
+
   // Instruct Chrome to show the password dropdown.
   driver->ShowPasswordSuggestions(base::i18n::LEFT_TO_RIGHT, base::string16(),
                                   0, gfx::RectF());
diff --git a/chrome/browser/prefs/browser_prefs.cc b/chrome/browser/prefs/browser_prefs.cc
index dba030d..fa34255 100644
--- a/chrome/browser/prefs/browser_prefs.cc
+++ b/chrome/browser/prefs/browser_prefs.cc
@@ -452,7 +452,7 @@
   ExternalProtocolHandler::RegisterPrefs(registry);
   flags_ui::PrefServiceFlagsStorage::RegisterPrefs(registry);
   GpuModeManager::RegisterPrefs(registry);
-  identity::IdentityManager::RegisterPrefs(registry);
+  identity::IdentityManager::RegisterLocalStatePrefs(registry);
   IntranetRedirectDetector::RegisterPrefs(registry);
   IOThread::RegisterPrefs(registry);
   language::GeoLanguageProvider::RegisterLocalStatePrefs(registry);
diff --git a/chrome/browser/signin/gaia_cookie_manager_service_factory.cc b/chrome/browser/signin/gaia_cookie_manager_service_factory.cc
deleted file mode 100644
index b67e07a..0000000
--- a/chrome/browser/signin/gaia_cookie_manager_service_factory.cc
+++ /dev/null
@@ -1,48 +0,0 @@
-// Copyright 2013 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "chrome/browser/signin/gaia_cookie_manager_service_factory.h"
-
-#include "chrome/browser/profiles/profile.h"
-#include "chrome/browser/signin/chrome_signin_client_factory.h"
-#include "chrome/browser/signin/profile_oauth2_token_service_factory.h"
-#include "components/keyed_service/content/browser_context_dependency_manager.h"
-#include "components/signin/core/browser/gaia_cookie_manager_service.h"
-#include "components/signin/core/browser/profile_oauth2_token_service.h"
-
-GaiaCookieManagerServiceFactory::GaiaCookieManagerServiceFactory()
-    : BrowserContextKeyedServiceFactory(
-        "GaiaCookieManagerService",
-        BrowserContextDependencyManager::GetInstance()) {
-  DependsOn(ChromeSigninClientFactory::GetInstance());
-  DependsOn(ProfileOAuth2TokenServiceFactory::GetInstance());
-}
-
-GaiaCookieManagerServiceFactory::~GaiaCookieManagerServiceFactory() {}
-
-// static
-GaiaCookieManagerService* GaiaCookieManagerServiceFactory::GetForProfile(
-    Profile* profile) {
-  return static_cast<GaiaCookieManagerService*>(
-      GetInstance()->GetServiceForBrowserContext(profile, true));
-}
-
-// static
-GaiaCookieManagerServiceFactory*
-GaiaCookieManagerServiceFactory::GetInstance() {
-  return base::Singleton<GaiaCookieManagerServiceFactory>::get();
-}
-
-KeyedService* GaiaCookieManagerServiceFactory::BuildServiceInstanceFor(
-    content::BrowserContext* context) const {
-  Profile* profile = Profile::FromBrowserContext(context);
-  GaiaCookieManagerService* cookie_service = new GaiaCookieManagerService(
-      ProfileOAuth2TokenServiceFactory::GetForProfile(profile),
-      ChromeSigninClientFactory::GetForProfile(profile));
-  return cookie_service;
-}
-
-void GaiaCookieManagerServiceFactory::RegisterProfilePrefs(
-    user_prefs::PrefRegistrySyncable* registry) {
-}
diff --git a/chrome/browser/signin/gaia_cookie_manager_service_factory.h b/chrome/browser/signin/gaia_cookie_manager_service_factory.h
deleted file mode 100644
index e8b83db..0000000
--- a/chrome/browser/signin/gaia_cookie_manager_service_factory.h
+++ /dev/null
@@ -1,40 +0,0 @@
-// Copyright 2013 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef CHROME_BROWSER_SIGNIN_GAIA_COOKIE_MANAGER_SERVICE_FACTORY_H_
-#define CHROME_BROWSER_SIGNIN_GAIA_COOKIE_MANAGER_SERVICE_FACTORY_H_
-
-#include "base/memory/singleton.h"
-#include "components/keyed_service/content/browser_context_keyed_service_factory.h"
-
-class GaiaCookieManagerService;
-class Profile;
-
-// Singleton that owns the GaiaCookieManagerService(s) and associates them with
-// Profiles. Listens for the Profile's destruction notification and cleans up.
-class GaiaCookieManagerServiceFactory :
-    public BrowserContextKeyedServiceFactory {
- public:
-  // Returns the instance of GaiaCookieManagerService associated with this
-  // profile (creating one if none exists). Returns NULL if this profile cannot
-  // have an GaiaCookieManagerService (for example, if |profile| is incognito).
-  static GaiaCookieManagerService* GetForProfile(Profile* profile);
-
-  // Returns an instance of the factory singleton.
-  static GaiaCookieManagerServiceFactory* GetInstance();
-
- private:
-  friend struct base::DefaultSingletonTraits<GaiaCookieManagerServiceFactory>;
-
-  GaiaCookieManagerServiceFactory();
-  ~GaiaCookieManagerServiceFactory() override;
-
-  // BrowserContextKeyedServiceFactory:
-  KeyedService* BuildServiceInstanceFor(
-      content::BrowserContext* profile) const override;
-  void RegisterProfilePrefs(
-      user_prefs::PrefRegistrySyncable* registry) override;
-};
-
-#endif  // CHROME_BROWSER_SIGNIN_GAIA_COOKIE_MANAGER_SERVICE_FACTORY_H_
diff --git a/chrome/browser/signin/identity_manager_factory.cc b/chrome/browser/signin/identity_manager_factory.cc
index 271777e..ac6a583 100644
--- a/chrome/browser/signin/identity_manager_factory.cc
+++ b/chrome/browser/signin/identity_manager_factory.cc
@@ -13,7 +13,6 @@
 #include "chrome/browser/signin/account_fetcher_service_factory.h"
 #include "chrome/browser/signin/account_tracker_service_factory.h"
 #include "chrome/browser/signin/chrome_signin_client_factory.h"
-#include "chrome/browser/signin/gaia_cookie_manager_service_factory.h"
 #include "chrome/browser/signin/profile_oauth2_token_service_factory.h"
 #include "components/keyed_service/content/browser_context_dependency_manager.h"
 #include "components/keyed_service/core/keyed_service.h"
@@ -73,7 +72,9 @@
 #endif
 }
 
-std::unique_ptr<ConcreteSigninManager> BuildSigninManager(Profile* profile) {
+std::unique_ptr<ConcreteSigninManager> BuildSigninManager(
+    Profile* profile,
+    GaiaCookieManagerService* gaia_cookie_manager_service) {
   std::unique_ptr<ConcreteSigninManager> signin_manager;
   SigninClient* client =
       ChromeSigninClientFactory::GetInstance()->GetForProfile(profile);
@@ -85,7 +86,7 @@
   signin_manager = std::make_unique<ConcreteSigninManager>(
       client, ProfileOAuth2TokenServiceFactory::GetForProfile(profile),
       AccountTrackerServiceFactory::GetForProfile(profile),
-      GaiaCookieManagerServiceFactory::GetForProfile(profile),
+      gaia_cookie_manager_service,
       AccountConsistencyModeManager::GetMethodForProfile(profile));
 #endif
   signin_manager->Initialize(g_browser_process->local_state());
@@ -105,27 +106,31 @@
  public:
   explicit IdentityManagerWrapper(
       Profile* profile,
+      std::unique_ptr<GaiaCookieManagerService> gaia_cookie_manager_service,
       std::unique_ptr<SigninManagerBase> signin_manager,
       std::unique_ptr<identity::PrimaryAccountMutator> primary_account_mutator,
-      std::unique_ptr<identity::AccountsMutator> accounts_mutator)
+      std::unique_ptr<identity::AccountsMutator> accounts_mutator,
+      std::unique_ptr<identity::AccountsCookieMutatorImpl>
+          accounts_cookie_mutator,
+      std::unique_ptr<identity::DiagnosticsProviderImpl> diagnostics_provider)
       : identity::IdentityManager(
+            std::move(gaia_cookie_manager_service),
             std::move(signin_manager),
             ProfileOAuth2TokenServiceFactory::GetForProfile(profile),
             AccountFetcherServiceFactory::GetForProfile(profile),
             AccountTrackerServiceFactory::GetForProfile(profile),
-            GaiaCookieManagerServiceFactory::GetForProfile(profile),
             std::move(primary_account_mutator),
             std::move(accounts_mutator),
-            std::make_unique<identity::AccountsCookieMutatorImpl>(
-                GaiaCookieManagerServiceFactory::GetForProfile(profile)),
-            std::make_unique<identity::DiagnosticsProviderImpl>(
-                ProfileOAuth2TokenServiceFactory::GetForProfile(profile),
-                GaiaCookieManagerServiceFactory::GetForProfile(profile))) {}
+            std::move(accounts_cookie_mutator),
+            std::move(diagnostics_provider)) {}
+
+  // KeyedService overrides.
+  void Shutdown() override { IdentityManager::Shutdown(); }
 };
 
 void IdentityManagerFactory::RegisterProfilePrefs(
     user_prefs::PrefRegistrySyncable* registry) {
-  SigninManagerBase::RegisterProfilePrefs(registry);
+  identity::IdentityManager::RegisterProfilePrefs(registry);
 }
 
 IdentityManagerFactory::IdentityManagerFactory()
@@ -135,7 +140,6 @@
   DependsOn(AccountFetcherServiceFactory::GetInstance());
   DependsOn(AccountTrackerServiceFactory::GetInstance());
   DependsOn(ChromeSigninClientFactory::GetInstance());
-  DependsOn(GaiaCookieManagerServiceFactory::GetInstance());
   DependsOn(ProfileOAuth2TokenServiceFactory::GetInstance());
 }
 
@@ -166,7 +170,6 @@
   IdentityManagerFactory::GetInstance();
   AccountTrackerServiceFactory::GetInstance();
   ChromeSigninClientFactory::GetInstance();
-  GaiaCookieManagerServiceFactory::GetInstance();
   ProfileOAuth2TokenServiceFactory::GetInstance();
 }
 
@@ -183,16 +186,28 @@
   Profile* profile = Profile::FromBrowserContext(context);
 
   // Construct the dependencies that IdentityManager will own.
+  auto gaia_cookie_manager_service = std::make_unique<GaiaCookieManagerService>(
+      ProfileOAuth2TokenServiceFactory::GetForProfile(profile),
+      ChromeSigninClientFactory::GetForProfile(profile));
   std::unique_ptr<ConcreteSigninManager> signin_manager =
-      BuildSigninManager(profile);
+      BuildSigninManager(profile, gaia_cookie_manager_service.get());
   std::unique_ptr<identity::PrimaryAccountMutator> primary_account_mutator =
       BuildPrimaryAccountMutator(profile, signin_manager.get());
   std::unique_ptr<identity::AccountsMutator> accounts_mutator =
       BuildAccountsMutator(profile, signin_manager.get());
+  auto accounts_cookie_mutator =
+      std::make_unique<identity::AccountsCookieMutatorImpl>(
+          gaia_cookie_manager_service.get());
+  auto diagnostics_provider =
+      std::make_unique<identity::DiagnosticsProviderImpl>(
+          ProfileOAuth2TokenServiceFactory::GetForProfile(profile),
+          gaia_cookie_manager_service.get());
 
   auto identity_manager = std::make_unique<IdentityManagerWrapper>(
-      profile, std::move(signin_manager), std::move(primary_account_mutator),
-      std::move(accounts_mutator));
+      profile, std::move(gaia_cookie_manager_service),
+      std::move(signin_manager), std::move(primary_account_mutator),
+      std::move(accounts_mutator), std::move(accounts_cookie_mutator),
+      std::move(diagnostics_provider));
   for (Observer& observer : observer_list_)
     observer.IdentityManagerCreated(identity_manager.get());
   return identity_manager.release();
diff --git a/chrome/browser/signin/identity_test_environment_profile_adaptor.cc b/chrome/browser/signin/identity_test_environment_profile_adaptor.cc
index d21c246..568f4f0f 100644
--- a/chrome/browser/signin/identity_test_environment_profile_adaptor.cc
+++ b/chrome/browser/signin/identity_test_environment_profile_adaptor.cc
@@ -8,7 +8,6 @@
 #include "chrome/browser/signin/account_fetcher_service_factory.h"
 #include "chrome/browser/signin/account_tracker_service_factory.h"
 #include "chrome/browser/signin/chrome_signin_client_factory.h"
-#include "chrome/browser/signin/gaia_cookie_manager_service_factory.h"
 #include "chrome/browser/signin/identity_manager_factory.h"
 #include "chrome/browser/signin/profile_oauth2_token_service_factory.h"
 #include "components/signin/core/browser/fake_profile_oauth2_token_service.h"
@@ -91,5 +90,4 @@
           AccountFetcherServiceFactory::GetForProfile(profile),
           static_cast<FakeProfileOAuth2TokenService*>(
               ProfileOAuth2TokenServiceFactory::GetForProfile(profile)),
-          GaiaCookieManagerServiceFactory::GetForProfile(profile),
           IdentityManagerFactory::GetForProfile(profile)) {}
diff --git a/chrome/browser/sync/profile_sync_service_android.cc b/chrome/browser/sync/profile_sync_service_android.cc
index c4c2aee..65d95fa 100644
--- a/chrome/browser/sync/profile_sync_service_android.cc
+++ b/chrome/browser/sync/profile_sync_service_android.cc
@@ -483,6 +483,15 @@
           AttachCurrentThread()));
 }
 
+void ProfileSyncServiceAndroid::TriggerRefresh(
+    JNIEnv* env,
+    const base::android::JavaParamRef<jobject>& obj) {
+  // Only allowed to trigger refresh/schedule nudges for protocol types, things
+  // like PROXY_TABS are not allowed.
+  sync_service_->TriggerRefresh(syncer::Intersection(
+      sync_service_->GetActiveDataTypes(), syncer::ProtocolTypes()));
+}
+
 static jlong JNI_ProfileSyncService_Init(JNIEnv* env,
                                          const JavaParamRef<jobject>& obj) {
   ProfileSyncServiceAndroid* profile_sync_service_android =
diff --git a/chrome/browser/sync/profile_sync_service_android.h b/chrome/browser/sync/profile_sync_service_android.h
index 50a1fa1..847508b 100644
--- a/chrome/browser/sync/profile_sync_service_android.h
+++ b/chrome/browser/sync/profile_sync_service_android.h
@@ -179,6 +179,9 @@
 
   static ProfileSyncServiceAndroid* GetProfileSyncServiceAndroid();
 
+  void TriggerRefresh(JNIEnv* env,
+                      const base::android::JavaParamRef<jobject>& obj);
+
  private:
   // Returns whether sync is allowed by Android.
   bool IsSyncAllowedByAndroid() const;
diff --git a/chrome/browser/sync/test/integration/single_client_standalone_transport_sync_test.cc b/chrome/browser/sync/test/integration/single_client_standalone_transport_sync_test.cc
index 9ec8e18..7705b4f0 100644
--- a/chrome/browser/sync/test/integration/single_client_standalone_transport_sync_test.cc
+++ b/chrome/browser/sync/test/integration/single_client_standalone_transport_sync_test.cc
@@ -49,6 +49,34 @@
   DISALLOW_COPY_AND_ASSIGN(SingleClientStandaloneTransportSyncTest);
 };
 
+#if defined(OS_CHROMEOS) || defined(OS_ANDROID)
+IN_PROC_BROWSER_TEST_F(SingleClientStandaloneTransportSyncTest,
+                       StartsSyncFeatureOnSignin) {
+  // On platforms where Sync starts automatically (in practice, Android and
+  // ChromeOS), IsFirstSetupComplete gets set automatically, and so the full
+  // Sync feature will start upon sign-in to a primary account.
+  ASSERT_TRUE(browser_defaults::kSyncAutoStarts);
+
+  ASSERT_TRUE(SetupClients()) << "SetupClients() failed.";
+
+  // Signing in (without explicitly setting up Sync) should trigger starting the
+  // Sync machinery. Because IsFirstSetupComplete gets set automatically, this
+  // will actually start the full Sync feature, not just the transport.
+  ASSERT_TRUE(GetClient(0)->SignInPrimaryAccount());
+  EXPECT_EQ(syncer::SyncService::TransportState::INITIALIZING,
+            GetSyncService(0)->GetTransportState());
+
+  EXPECT_TRUE(GetClient(0)->AwaitSyncTransportActive());
+
+  EXPECT_EQ(syncer::SyncService::TransportState::ACTIVE,
+            GetSyncService(0)->GetTransportState());
+
+  ASSERT_TRUE(GetSyncService(0)->GetUserSettings()->IsFirstSetupComplete());
+
+  EXPECT_TRUE(GetSyncService(0)->IsSyncFeatureEnabled());
+  EXPECT_TRUE(GetSyncService(0)->IsSyncFeatureActive());
+}
+#else
 IN_PROC_BROWSER_TEST_F(SingleClientStandaloneTransportSyncTest,
                        StartsSyncTransportOnSignin) {
   ASSERT_TRUE(SetupClients()) << "SetupClients() failed.";
@@ -64,12 +92,12 @@
   EXPECT_EQ(syncer::SyncService::TransportState::ACTIVE,
             GetSyncService(0)->GetTransportState());
 
-  // IsFirstSetupComplete gets set automatically on some platforms, but
-  // IsSyncRequested remains false (it gets set by the Sync confirmation dialog,
-  // or by the settings page if going through the advanced settings flow).
-  ASSERT_EQ(browser_defaults::kSyncAutoStarts,
-            GetSyncService(0)->GetUserSettings()->IsFirstSetupComplete());
-  ASSERT_FALSE(GetSyncService(0)->GetUserSettings()->IsSyncRequested());
+  // Both IsSyncRequested and IsFirstSetupComplete should remain false (i.e.
+  // at their default values). They only get set during the Sync setup flow,
+  // either by the Sync confirmation dialog or by the settings page if going
+  // through the advanced settings flow.
+  EXPECT_FALSE(GetSyncService(0)->GetUserSettings()->IsFirstSetupComplete());
+  EXPECT_FALSE(GetSyncService(0)->GetUserSettings()->IsSyncRequested());
 
   EXPECT_FALSE(GetSyncService(0)->IsSyncFeatureEnabled());
   EXPECT_FALSE(GetSyncService(0)->IsSyncFeatureActive());
@@ -82,6 +110,7 @@
                          AllowedTypesInStandaloneTransportMode());
   EXPECT_TRUE(bad_types.Empty()) << syncer::ModelTypeSetToString(bad_types);
 }
+#endif  // defined(OS_CHROMEOS) || defined(OS_ANDROID)
 
 IN_PROC_BROWSER_TEST_F(SingleClientStandaloneTransportSyncTest,
                        SwitchesBetweenTransportAndFeature) {
diff --git a/chrome/browser/ui/BUILD.gn b/chrome/browser/ui/BUILD.gn
index c4480452..b0f1b81 100644
--- a/chrome/browser/ui/BUILD.gn
+++ b/chrome/browser/ui/BUILD.gn
@@ -688,6 +688,10 @@
       "android/page_info/connection_info_popup_android.h",
       "android/page_info/page_info_controller_android.cc",
       "android/page_info/page_info_controller_android.h",
+      "android/passwords/manual_filling_view_android.cc",
+      "android/passwords/manual_filling_view_android.h",
+      "android/passwords/password_generation_dialog_view_android.cc",
+      "android/passwords/password_generation_dialog_view_android.h",
       "android/simple_message_box_android.cc",
       "android/snackbars/auto_signin_prompt_controller.cc",
       "android/snackbars/auto_signin_prompt_controller.h",
diff --git a/chrome/browser/ui/android/autofill/autofill_keyboard_accessory_view.cc b/chrome/browser/ui/android/autofill/autofill_keyboard_accessory_view.cc
index 7348d87..becba6e 100644
--- a/chrome/browser/ui/android/autofill/autofill_keyboard_accessory_view.cc
+++ b/chrome/browser/ui/android/autofill/autofill_keyboard_accessory_view.cc
@@ -4,6 +4,8 @@
 
 #include "chrome/browser/ui/android/autofill/autofill_keyboard_accessory_view.h"
 
+#include <numeric>
+
 #include "base/android/jni_android.h"
 #include "base/android/jni_string.h"
 #include "chrome/browser/android/resource_mapper.h"
@@ -24,27 +26,6 @@
 
 namespace autofill {
 
-namespace {
-
-void AddToJavaArray(const Suggestion& suggestion,
-                    int icon_id,
-                    JNIEnv* env,
-                    const JavaRef<jobjectArray>& data_array,
-                    size_t position,
-                    bool deletable) {
-  int android_icon_id = 0;
-  if (!suggestion.icon.empty())
-    android_icon_id = ResourceMapper::MapFromChromiumId(icon_id);
-
-  Java_AutofillKeyboardAccessoryBridge_addToAutofillSuggestionArray(
-      env, data_array, position,
-      base::android::ConvertUTF16ToJavaString(env, suggestion.value),
-      base::android::ConvertUTF16ToJavaString(env, suggestion.label),
-      android_icon_id, suggestion.frontend_id, deletable);
-}
-
-}  // namespace
-
 AutofillKeyboardAccessoryView::AutofillKeyboardAccessoryView(
     AutofillPopupController* controller,
     unsigned int animation_duration_millis,
@@ -91,37 +72,43 @@
   ScopedJavaLocalRef<jobjectArray> data_array =
       Java_AutofillKeyboardAccessoryBridge_createAutofillSuggestionArray(env,
                                                                          count);
+  auto is_front_item = [controller = controller_](int i) {
+    const Suggestion& suggestion = controller->GetSuggestionAt(i);
+    return suggestion.frontend_id == POPUP_ITEM_ID_CLEAR_FORM ||
+           suggestion.frontend_id == POPUP_ITEM_ID_CREATE_HINT;
+  };
+
   positions_.resize(count);
-  size_t position = 0;
+  std::iota(positions_.begin(), positions_.end(), 0);
+  // Only one front item may exist!
+  DCHECK_LT(std::count_if(positions_.begin(), positions_.end(), is_front_item),
+            2);
 
-  // Place "CLEAR FORM" and "CREATE HINT" items first in the list.
-  // Both "CLEAR FORM" and "CREATE HINT" cannot be present in the list.
-  for (size_t i = 0; i < count; ++i) {
-    const Suggestion& suggestion = controller_->GetSuggestionAt(i);
-    if (suggestion.frontend_id == POPUP_ITEM_ID_CLEAR_FORM ||
-        suggestion.frontend_id == POPUP_ITEM_ID_CREATE_HINT) {
-      AddToJavaArray(
-          suggestion,
-          controller_->layout_model().GetIconResourceID(suggestion.icon), env,
-          data_array, position, false);
-      positions_[position++] = i;
+  // Place the "CLEAR FORM" or "CREATE HINT" item first in the list.
+  auto item = std::find_if(positions_.begin(), positions_.end(), is_front_item);
+  if (item != positions_.end())
+    std::rotate(positions_.begin(), item, item + 1);
+
+  for (size_t i = 0; i < positions_.size(); ++i) {
+    const Suggestion& suggestion = controller_->GetSuggestionAt(positions_[i]);
+
+    base::string16 label = controller_->GetElidedLabelAt(i);
+    if (label.empty())
+      label = suggestion.additional_label;
+
+    int android_icon_id = 0;
+    if (!suggestion.icon.empty()) {
+      android_icon_id = ResourceMapper::MapFromChromiumId(
+          controller_->layout_model().GetIconResourceID(suggestion.icon));
     }
-  }
 
-  DCHECK_LT(position, 2U);
-
-  for (size_t i = 0; i < count; ++i) {
-    const Suggestion& suggestion = controller_->GetSuggestionAt(i);
-    if (suggestion.frontend_id != POPUP_ITEM_ID_CLEAR_FORM &&
-        suggestion.frontend_id != POPUP_ITEM_ID_CREATE_HINT) {
-      bool deletable =
-          controller_->GetRemovalConfirmationText(i, nullptr, nullptr);
-      AddToJavaArray(
-          suggestion,
-          controller_->layout_model().GetIconResourceID(suggestion.icon), env,
-          data_array, position, deletable);
-      positions_[position++] = i;
-    }
+    Java_AutofillKeyboardAccessoryBridge_addToAutofillSuggestionArray(
+        env, data_array, i,
+        base::android::ConvertUTF16ToJavaString(env, suggestion.value),
+        base::android::ConvertUTF16ToJavaString(env, label), android_icon_id,
+        suggestion.frontend_id,
+        controller_->GetRemovalConfirmationText(positions_[i], nullptr,
+                                                nullptr));
   }
 
   Java_AutofillKeyboardAccessoryBridge_show(env, java_object_, data_array,
diff --git a/chrome/browser/android/password_manager/OWNERS b/chrome/browser/ui/android/passwords/OWNERS
similarity index 100%
rename from chrome/browser/android/password_manager/OWNERS
rename to chrome/browser/ui/android/passwords/OWNERS
diff --git a/chrome/browser/android/password_manager/manual_filling_view_android.cc b/chrome/browser/ui/android/passwords/manual_filling_view_android.cc
similarity index 98%
rename from chrome/browser/android/password_manager/manual_filling_view_android.cc
rename to chrome/browser/ui/android/passwords/manual_filling_view_android.cc
index f0906c5d..bff7a9c 100644
--- a/chrome/browser/android/password_manager/manual_filling_view_android.cc
+++ b/chrome/browser/ui/android/passwords/manual_filling_view_android.cc
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "chrome/browser/android/password_manager/manual_filling_view_android.h"
+#include "chrome/browser/ui/android/passwords/manual_filling_view_android.h"
 
 #include <jni.h>
 
diff --git a/chrome/browser/android/password_manager/manual_filling_view_android.h b/chrome/browser/ui/android/passwords/manual_filling_view_android.h
similarity index 90%
rename from chrome/browser/android/password_manager/manual_filling_view_android.h
rename to chrome/browser/ui/android/passwords/manual_filling_view_android.h
index 65908b8..4decce8 100644
--- a/chrome/browser/android/password_manager/manual_filling_view_android.h
+++ b/chrome/browser/ui/android/passwords/manual_filling_view_android.h
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef CHROME_BROWSER_ANDROID_PASSWORD_MANAGER_MANUAL_FILLING_VIEW_ANDROID_H_
-#define CHROME_BROWSER_ANDROID_PASSWORD_MANAGER_MANUAL_FILLING_VIEW_ANDROID_H_
+#ifndef CHROME_BROWSER_UI_ANDROID_PASSWORDS_MANUAL_FILLING_VIEW_ANDROID_H_
+#define CHROME_BROWSER_UI_ANDROID_PASSWORDS_MANUAL_FILLING_VIEW_ANDROID_H_
 
 #include <vector>
 
@@ -70,4 +70,4 @@
   DISALLOW_COPY_AND_ASSIGN(ManualFillingViewAndroid);
 };
 
-#endif  // CHROME_BROWSER_ANDROID_PASSWORD_MANAGER_MANUAL_FILLING_VIEW_ANDROID_H_
+#endif  // CHROME_BROWSER_UI_ANDROID_PASSWORDS_MANUAL_FILLING_VIEW_ANDROID_H_
diff --git a/chrome/browser/android/password_manager/password_generation_dialog_view_android.cc b/chrome/browser/ui/android/passwords/password_generation_dialog_view_android.cc
similarity index 94%
rename from chrome/browser/android/password_manager/password_generation_dialog_view_android.cc
rename to chrome/browser/ui/android/passwords/password_generation_dialog_view_android.cc
index c83d2e66..4e1253b 100644
--- a/chrome/browser/android/password_manager/password_generation_dialog_view_android.cc
+++ b/chrome/browser/ui/android/passwords/password_generation_dialog_view_android.cc
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "chrome/browser/android/password_manager/password_generation_dialog_view_android.h"
+#include "chrome/browser/ui/android/passwords/password_generation_dialog_view_android.h"
 
 #include "base/android/jni_android.h"
 #include "base/android/jni_string.h"
@@ -35,7 +35,7 @@
 void PasswordGenerationDialogViewAndroid::Show(base::string16& password) {
   JNIEnv* env = base::android::AttachCurrentThread();
 
-   base::string16 explanation_text =
+  base::string16 explanation_text =
       l10n_util::GetStringUTF16(IDS_PASSWORD_GENERATION_PROMPT);
 
   Java_PasswordGenerationDialogBridge_showDialog(
diff --git a/chrome/browser/android/password_manager/password_generation_dialog_view_android.h b/chrome/browser/ui/android/passwords/password_generation_dialog_view_android.h
similarity index 85%
rename from chrome/browser/android/password_manager/password_generation_dialog_view_android.h
rename to chrome/browser/ui/android/passwords/password_generation_dialog_view_android.h
index 905854c..1335e7c 100644
--- a/chrome/browser/android/password_manager/password_generation_dialog_view_android.h
+++ b/chrome/browser/ui/android/passwords/password_generation_dialog_view_android.h
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef CHROME_BROWSER_ANDROID_PASSWORD_MANAGER_PASSWORD_GENERATION_DIALOG_VIEW_ANDROID_H_
-#define CHROME_BROWSER_ANDROID_PASSWORD_MANAGER_PASSWORD_GENERATION_DIALOG_VIEW_ANDROID_H_
+#ifndef CHROME_BROWSER_UI_ANDROID_PASSWORDS_PASSWORD_GENERATION_DIALOG_VIEW_ANDROID_H_
+#define CHROME_BROWSER_UI_ANDROID_PASSWORDS_PASSWORD_GENERATION_DIALOG_VIEW_ANDROID_H_
 
 #include <jni.h>
 
@@ -47,4 +47,4 @@
   DISALLOW_COPY_AND_ASSIGN(PasswordGenerationDialogViewAndroid);
 };
 
-#endif  // CHROME_BROWSER_ANDROID_PASSWORD_MANAGER_PASSWORD_GENERATION_DIALOG_VIEW_ANDROID_H_
+#endif  // CHROME_BROWSER_UI_ANDROID_PASSWORDS_PASSWORD_GENERATION_DIALOG_VIEW_ANDROID_H_
diff --git a/chrome/browser/ui/webui/print_preview/local_printer_handler_chromeos.cc b/chrome/browser/ui/webui/print_preview/local_printer_handler_chromeos.cc
index e6fa1a7..1a40890c8 100644
--- a/chrome/browser/ui/webui/print_preview/local_printer_handler_chromeos.cc
+++ b/chrome/browser/ui/webui/print_preview/local_printer_handler_chromeos.cc
@@ -42,6 +42,9 @@
 using chromeos::CupsPrintersManager;
 using chromeos::CupsPrintersManagerFactory;
 
+// We only support sending username for named users but just in case.
+const char kUsernamePlaceholder[] = "chronos";
+
 // Store the name used in CUPS, Printer#id in |printer_name|, the description
 // as the system_driverinfo option value, and the Printer#display_name in
 // the |printer_description| field.  This will match how Mac OS X presents
@@ -261,10 +264,12 @@
   UMA_HISTOGRAM_MEMORY_KB("Printing.CUPS.PrintDocumentSize", size_in_kb);
   if (profile_->GetPrefs()->GetBoolean(
           prefs::kPrintingSendUsernameAndFilenameEnabled)) {
-    settings.SetKey(kSettingUsername,
-                    base::Value(chromeos::ProfileHelper::Get()
-                                    ->GetUserByProfile(profile_)
-                                    ->display_email()));
+    std::string username = chromeos::ProfileHelper::Get()
+                               ->GetUserByProfile(profile_)
+                               ->display_email();
+    settings.SetKey(
+        kSettingUsername,
+        base::Value(username.empty() ? kUsernamePlaceholder : username));
     settings.SetKey(kSettingSendUserInfo, base::Value(true));
   }
   StartLocalPrint(std::move(settings), std::move(print_data),
diff --git a/chrome/browser/ui/webui/signin/user_manager_ui_browsertest.cc b/chrome/browser/ui/webui/signin/user_manager_ui_browsertest.cc
index d151d56..decbaaf0 100644
--- a/chrome/browser/ui/webui/signin/user_manager_ui_browsertest.cc
+++ b/chrome/browser/ui/webui/signin/user_manager_ui_browsertest.cc
@@ -86,7 +86,9 @@
   EXPECT_EQ(num_pods, static_cast<int>(profile_manager->GetNumberOfProfiles()));
 }
 
-IN_PROC_BROWSER_TEST_F(UserManagerUIBrowserTest, PageRedirectsToAboutChrome) {
+// https://crbug.com/945795
+IN_PROC_BROWSER_TEST_F(UserManagerUIBrowserTest,
+                       DISABLED_PageRedirectsToAboutChrome) {
   std::string user_manager_url = chrome::kChromeUIMdUserManagerUrl;
   user_manager_url += profiles::kUserManagerSelectProfileAboutChrome;
 
diff --git a/chrome/test/android/javatests/src/org/chromium/chrome/test/util/browser/sync/SyncTestUtil.java b/chrome/test/android/javatests/src/org/chromium/chrome/test/util/browser/sync/SyncTestUtil.java
index 84ec8961..07fca7b 100644
--- a/chrome/test/android/javatests/src/org/chromium/chrome/test/util/browser/sync/SyncTestUtil.java
+++ b/chrome/test/android/javatests/src/org/chromium/chrome/test/util/browser/sync/SyncTestUtil.java
@@ -15,8 +15,6 @@
 import org.junit.Assert;
 
 import org.chromium.base.ThreadUtils;
-import org.chromium.chrome.browser.invalidation.InvalidationServiceFactory;
-import org.chromium.chrome.browser.profiles.Profile;
 import org.chromium.chrome.browser.sync.ProfileSyncService;
 import org.chromium.content_public.browser.test.util.Criteria;
 import org.chromium.content_public.browser.test.util.CriteriaHelper;
@@ -108,8 +106,7 @@
         ThreadUtils.runOnUiThreadBlocking(new Runnable() {
             @Override
             public void run() {
-                InvalidationServiceFactory.getForProfile(Profile.getLastUsedProfile())
-                        .requestSyncFromNativeChromeForAllTypes();
+                ProfileSyncService.get().triggerSync();
             }
         });
     }
diff --git a/chrome/test/data/webui/media_router/media_router_elements_browsertest.js b/chrome/test/data/webui/media_router/media_router_elements_browsertest.js
index 7094b5f..9542f01 100644
--- a/chrome/test/data/webui/media_router/media_router_elements_browsertest.js
+++ b/chrome/test/data/webui/media_router/media_router_elements_browsertest.js
@@ -162,8 +162,18 @@
       mocha.run();
     });
 
+// Disabling on chromeos due to flaky test.
+// https://crbug.com/945198
+GEN('#if defined(OS_CHROMEOS)');
+GEN('#define MAYBE_MediaRouterContainerSearchPart2 \\');
+GEN('    DISABLED_MediaRouterContainerSearchPart2');
+GEN('#else');
+GEN('#define MAYBE_MediaRouterContainerSearchPart2 \\');
+GEN('    MediaRouterContainerSearchPart2');
+GEN('#endif');
+
 TEST_F(
-    'MediaRouterElementsBrowserTest', 'MediaRouterContainerSearchPart2',
+    'MediaRouterElementsBrowserTest', 'MAYBE_MediaRouterContainerSearchPart2',
     function() {
       media_router_container_search.registerTestsPart2();
       mocha.run();
diff --git a/chromeos/dbus/power/power_policy_controller.cc b/chromeos/dbus/power/power_policy_controller.cc
index 34a02d37..ae11e47 100644
--- a/chromeos/dbus/power/power_policy_controller.cc
+++ b/chromeos/dbus/power/power_policy_controller.cc
@@ -6,6 +6,7 @@
 
 #include <stdint.h>
 
+#include <memory>
 #include <utility>
 
 #include "base/format_macros.h"
@@ -79,6 +80,37 @@
   return true;
 }
 
+power_manager::PowerManagementPolicy::PeakShiftDayConfig::WeekDay
+GetProtoWeekDay(PowerPolicyController::WeekDay week_day) {
+  switch (week_day) {
+    case PowerPolicyController::WeekDay::WEEK_DAY_MONDAY:
+      return power_manager::PowerManagementPolicy::PeakShiftDayConfig::MONDAY;
+    case PowerPolicyController::WeekDay::WEEK_DAY_TUESDAY:
+      return power_manager::PowerManagementPolicy::PeakShiftDayConfig::TUESDAY;
+    case PowerPolicyController::WeekDay::WEEK_DAY_WEDNESDAY:
+      return power_manager::PowerManagementPolicy::PeakShiftDayConfig::
+          WEDNESDAY;
+    case PowerPolicyController::WeekDay::WEEK_DAY_THURSDAY:
+      return power_manager::PowerManagementPolicy::PeakShiftDayConfig::THURSDAY;
+    case PowerPolicyController::WeekDay::WEEK_DAY_FRIDAY:
+      return power_manager::PowerManagementPolicy::PeakShiftDayConfig::FRIDAY;
+    case PowerPolicyController::WeekDay::WEEK_DAY_SATURDAY:
+      return power_manager::PowerManagementPolicy::PeakShiftDayConfig::SATURDAY;
+    case PowerPolicyController::WeekDay::WEEK_DAY_SUNDAY:
+      return power_manager::PowerManagementPolicy::PeakShiftDayConfig::SUNDAY;
+  }
+}
+
+std::unique_ptr<
+    power_manager::PowerManagementPolicy::PeakShiftDayConfig::DayTime>
+GetProtoDayTime(const PowerPolicyController::DayTime& day_time) {
+  auto proto = std::make_unique<
+      power_manager::PowerManagementPolicy::PeakShiftDayConfig::DayTime>();
+  proto->set_hour(day_time.hour);
+  proto->set_minute(day_time.minute);
+  return proto;
+}
+
 }  // namespace
 
 const int PowerPolicyController::kScreenLockAfterOffDelayMs = 10000;  // 10 sec.
@@ -113,7 +145,11 @@
       presentation_screen_dim_delay_factor(1.0),
       user_activity_screen_dim_delay_factor(1.0),
       wait_for_initial_user_activity(false),
-      force_nonzero_brightness_for_user_activity(true) {}
+      force_nonzero_brightness_for_user_activity(true),
+      peak_shift_enabled(false),
+      peak_shift_battery_threshold(-1) {}
+
+PowerPolicyController::PrefValues::~PrefValues() = default;
 
 // static
 std::string PowerPolicyController::GetPolicyDebugString(
@@ -162,6 +198,9 @@
     StringAppendF(&str, "force_nonzero_brightness_for_user_activity=%d ",
                   policy.force_nonzero_brightness_for_user_activity());
   }
+
+  str += GetPeakShiftPolicyDebugString(policy);
+
   if (policy.has_reason())
     StringAppendF(&str, "reason=\"%s\" ", policy.reason().c_str());
   base::TrimWhitespaceASCII(str, base::TRIM_TRAILING, &str);
@@ -169,6 +208,31 @@
 }
 
 // static
+std::string PowerPolicyController::GetPeakShiftPolicyDebugString(
+    const power_manager::PowerManagementPolicy& policy) {
+  std::string str;
+  if (policy.has_peak_shift_battery_percent_threshold()) {
+    StringAppendF(&str, "peak_shift_battery_threshold=%d ",
+                  policy.peak_shift_battery_percent_threshold());
+  }
+  if (policy.peak_shift_day_configs_size()) {
+    StringAppendF(&str, "peak_shift_day_configuration=[");
+    for (auto config : policy.peak_shift_day_configs()) {
+      StringAppendF(&str,
+                    "{day=%d start_time=%d:%02d end_time=%d:%02d "
+                    "charge_start_time=%d:%02d} ",
+                    config.day(), config.start_time().hour(),
+                    config.start_time().minute(), config.end_time().hour(),
+                    config.end_time().minute(),
+                    config.charge_start_time().hour(),
+                    config.charge_start_time().minute());
+    }
+    StringAppendF(&str, "]");
+  }
+  return str;
+}
+
+// static
 void PowerPolicyController::Initialize(PowerManagerClient* client) {
   DCHECK(!IsInitialized());
   g_power_policy_controller = new PowerPolicyController(client);
@@ -257,6 +321,23 @@
   honor_screen_wake_locks_ =
       honor_wake_locks_ && values.allow_screen_wake_locks;
 
+  if (values.peak_shift_enabled) {
+    prefs_policy_.set_peak_shift_battery_percent_threshold(
+        values.peak_shift_battery_threshold);
+    for (const PeakShiftDayConfiguration& values_config :
+         values.peak_shift_day_configurations) {
+      power_manager::PowerManagementPolicy::PeakShiftDayConfig* proto_config =
+          prefs_policy_.add_peak_shift_day_configs();
+      proto_config->set_day(GetProtoWeekDay(values_config.day));
+      proto_config->set_allocated_start_time(
+          GetProtoDayTime(values_config.start_time).release());
+      proto_config->set_allocated_end_time(
+          GetProtoDayTime(values_config.end_time).release());
+      proto_config->set_allocated_charge_start_time(
+          GetProtoDayTime(values_config.charge_start_time).release());
+    }
+  }
+
   prefs_were_set_ = true;
   SendCurrentPolicy();
 }
diff --git a/chromeos/dbus/power/power_policy_controller.h b/chromeos/dbus/power/power_policy_controller.h
index d120420..c61e565 100644
--- a/chromeos/dbus/power/power_policy_controller.h
+++ b/chromeos/dbus/power/power_policy_controller.h
@@ -7,6 +7,7 @@
 
 #include <map>
 #include <string>
+#include <vector>
 
 #include "base/component_export.h"
 #include "base/macros.h"
@@ -50,9 +51,32 @@
     ACTION_DO_NOTHING = 3,
   };
 
+  enum WeekDay {
+    WEEK_DAY_MONDAY = 0,
+    WEEK_DAY_TUESDAY = 1,
+    WEEK_DAY_WEDNESDAY = 2,
+    WEEK_DAY_THURSDAY = 3,
+    WEEK_DAY_FRIDAY = 4,
+    WEEK_DAY_SATURDAY = 5,
+    WEEK_DAY_SUNDAY = 6,
+  };
+
+  struct DayTime {
+    int hour = 0;
+    int minute = 0;
+  };
+
+  struct PeakShiftDayConfiguration {
+    WeekDay day = WeekDay::WEEK_DAY_MONDAY;
+    DayTime start_time;
+    DayTime end_time;
+    DayTime charge_start_time;
+  };
+
   // Values of various power-management-related preferences.
   struct PrefValues {
     PrefValues();
+    ~PrefValues();
 
     int ac_screen_dim_delay_ms;
     int ac_screen_off_delay_ms;
@@ -78,12 +102,20 @@
     double user_activity_screen_dim_delay_factor;
     bool wait_for_initial_user_activity;
     bool force_nonzero_brightness_for_user_activity;
+    bool peak_shift_enabled;
+    int peak_shift_battery_threshold;
+    std::vector<PeakShiftDayConfiguration> peak_shift_day_configurations;
   };
 
   // Returns a string describing |policy|.  Useful for tests.
   static std::string GetPolicyDebugString(
       const power_manager::PowerManagementPolicy& policy);
 
+  // Returns a string describing |PeakShift| part of |policy|.  Useful for
+  // tests.
+  static std::string GetPeakShiftPolicyDebugString(
+      const power_manager::PowerManagementPolicy& policy);
+
   // Delay in milliseconds between the screen being turned off and the screen
   // being locked. Used if the |enable_auto_screen_lock| pref is set but
   // |*_screen_lock_delay_ms| are unset or set to higher values than what this
diff --git a/chromeos/dbus/power/power_policy_controller_unittest.cc b/chromeos/dbus/power/power_policy_controller_unittest.cc
index da537b5..35d3d03 100644
--- a/chromeos/dbus/power/power_policy_controller_unittest.cc
+++ b/chromeos/dbus/power/power_policy_controller_unittest.cc
@@ -180,6 +180,31 @@
   EXPECT_EQ(
       PowerPolicyController::GetPolicyDebugString(expected_policy),
       PowerPolicyController::GetPolicyDebugString(power_manager()->policy()));
+
+  // Set PeakShift prefs.
+  prefs.peak_shift_enabled = true;
+  prefs.peak_shift_battery_threshold = 20;
+
+  constexpr PowerPolicyController::PeakShiftDayConfiguration
+      kPeakShiftDayConfig = {
+          PowerPolicyController::WEEK_DAY_TUESDAY, {10, 0}, {20, 15}, {23, 45}};
+  prefs.peak_shift_day_configurations.push_back(kPeakShiftDayConfig);
+  policy_controller_->ApplyPrefs(prefs);
+
+  expected_policy.set_peak_shift_battery_percent_threshold(20);
+  auto* proto_config = expected_policy.add_peak_shift_day_configs();
+  proto_config->set_day(
+      power_manager::PowerManagementPolicy::PeakShiftDayConfig::TUESDAY);
+  proto_config->mutable_start_time()->set_hour(10);
+  proto_config->mutable_start_time()->set_minute(0);
+  proto_config->mutable_end_time()->set_hour(20);
+  proto_config->mutable_end_time()->set_minute(15);
+  proto_config->mutable_charge_start_time()->set_hour(23);
+  proto_config->mutable_charge_start_time()->set_minute(45);
+
+  EXPECT_EQ(
+      PowerPolicyController::GetPolicyDebugString(expected_policy),
+      PowerPolicyController::GetPolicyDebugString(power_manager()->policy()));
 }
 
 TEST_F(PowerPolicyControllerTest, SystemWakeLock) {
diff --git a/components/autofill/content/renderer/password_autofill_agent.cc b/components/autofill/content/renderer/password_autofill_agent.cc
index c7c3a5da..7f510b6 100644
--- a/components/autofill/content/renderer/password_autofill_agent.cc
+++ b/components/autofill/content/renderer/password_autofill_agent.cc
@@ -1234,10 +1234,6 @@
   SendPasswordForms(true);
 }
 
-void PasswordAutofillAgent::WillCommitProvisionalLoad() {
-  FrameClosing();
-}
-
 void PasswordAutofillAgent::DidCommitProvisionalLoad(
     bool is_same_document_navigation,
     ui::PageTransition transition) {
@@ -1259,7 +1255,7 @@
     GetPasswordManagerDriver()->SameDocumentNavigation(
         provisionally_saved_form_.password_form());
   }
-  FrameClosing();
+  CleanupOnDocumentShutdown();
 }
 
 void PasswordAutofillAgent::OnWillSubmitForm(const WebFormElement& form) {
@@ -1343,12 +1339,13 @@
   if (navigated_frame->Parent()) {
     if (logger)
       logger->LogMessage(Logger::STRING_FRAME_NOT_MAIN_FRAME);
-    return;
+  } else {
+    // This is a new navigation, so require a new user gesture before filling in
+    // passwords.
+    gatekeeper_.Reset();
   }
 
-  // This is a new navigation, so require a new user gesture before filling in
-  // passwords.
-  gatekeeper_.Reset();
+  CleanupOnDocumentShutdown();
 }
 
 void PasswordAutofillAgent::OnProbablyFormSubmitted() {
@@ -1637,7 +1634,7 @@
   return CanShowSuggestion(password_info.fill_data, username_string, show_all);
 }
 
-void PasswordAutofillAgent::FrameClosing() {
+void PasswordAutofillAgent::CleanupOnDocumentShutdown() {
   web_input_to_password_info_.clear();
   password_to_username_.clear();
   last_supplied_password_info_iter_ = web_input_to_password_info_.end();
diff --git a/components/autofill/content/renderer/password_autofill_agent.h b/components/autofill/content/renderer/password_autofill_agent.h
index cb35776..ae04ed37 100644
--- a/components/autofill/content/renderer/password_autofill_agent.h
+++ b/components/autofill/content/renderer/password_autofill_agent.h
@@ -230,7 +230,6 @@
   void DidFinishLoad() override;
   void ReadyToCommitNavigation(
       blink::WebDocumentLoader* document_loader) override;
-  void WillCommitProvisionalLoad() override;
   void DidCommitProvisionalLoad(bool is_same_document_navigation,
                                 ui::PageTransition transition) override;
   void OnDestruct() override;
@@ -352,8 +351,9 @@
                                   blink::WebInputElement* password_element,
                                   PasswordInfo** password_info);
 
-  // Invoked when the frame is closing.
-  void FrameClosing();
+  // Cleans up the state when document is shut down, e.g. when committing a new
+  // document or closing the frame.
+  void CleanupOnDocumentShutdown();
 
   // Clears the preview for the username and password fields, restoring both to
   // their previous filled state.
diff --git a/components/autofill/content/renderer/password_form_conversion_utils.cc b/components/autofill/content/renderer/password_form_conversion_utils.cc
index ad4e5dd..7db7b86 100644
--- a/components/autofill/content/renderer/password_form_conversion_utils.cc
+++ b/components/autofill/content/renderer/password_form_conversion_utils.cc
@@ -438,11 +438,8 @@
   }
 
   // Evaluate the context of the fields.
-  if (base::FeatureList::IsEnabled(
-          password_manager::features::kHtmlBasedUsernameDetector)) {
-    password_form->form_data.username_predictions = GetUsernamePredictions(
-        control_elements, form_data, username_detector_cache);
-  }
+  password_form->form_data.username_predictions = GetUsernamePredictions(
+      control_elements, form_data, username_detector_cache);
 
   // Narrow the scope to enabled text inputs.
   std::vector<const FormFieldData*> enabled_fields;
@@ -614,14 +611,11 @@
 
   // Evaluate the context of the fields.
   const FormFieldData* username_field_by_context = nullptr;
-  if (base::FeatureList::IsEnabled(
-          password_manager::features::kHtmlBasedUsernameDetector)) {
-    // Use HTML based username detector only if neither server predictions nor
-    // autocomplete attributes were useful to detect the username.
-    if (!predicted_username_field && !username_by_attribute) {
-      username_field_by_context = FindUsernameInPredictions(
-          form_data.username_predictions, plausible_usernames);
-    }
+  // Use HTML based username detector only if neither server predictions nor
+  // autocomplete attributes were useful to detect the username.
+  if (!predicted_username_field && !username_by_attribute) {
+    username_field_by_context = FindUsernameInPredictions(
+        form_data.username_predictions, plausible_usernames);
   }
 
   // Populate all_possible_passwords and form_has_autofilled_value in
diff --git a/components/autofill/content/renderer/password_form_conversion_utils_browsertest.cc b/components/autofill/content/renderer/password_form_conversion_utils_browsertest.cc
index 70e756a..a0e2c5c2 100644
--- a/components/autofill/content/renderer/password_form_conversion_utils_browsertest.cc
+++ b/components/autofill/content/renderer/password_form_conversion_utils_browsertest.cc
@@ -358,10 +358,6 @@
 }
 
 TEST_F(PasswordFormConversionUtilsTest, HTMLDetector_DeveloperGroupAttributes) {
-  base::test::ScopedFeatureList feature_list;
-  feature_list.InitAndEnableFeature(
-      password_manager::features::kHtmlBasedUsernameDetector);
-
   // Each test case consists of a set of parameters to be plugged into the
   // PasswordFormBuilder below, plus the corresponding expectations.
   // The test data contains cases that are identified by HTML detector, and not
@@ -480,10 +476,6 @@
 }
 
 TEST_F(PasswordFormConversionUtilsTest, HTMLDetector_SeveralDetections) {
-  base::test::ScopedFeatureList feature_list;
-  feature_list.InitAndEnableFeature(
-      password_manager::features::kHtmlBasedUsernameDetector);
-
   // If word matches in more than 2 fields, we don't match on it.
   // We search for match with another word.
   PasswordFormBuilder builder(kTestFormActionURL);
@@ -513,10 +505,6 @@
 }
 
 TEST_F(PasswordFormConversionUtilsTest, HTMLDetector_UserGroupAttributes) {
-  base::test::ScopedFeatureList feature_list;
-  feature_list.InitAndEnableFeature(
-      password_manager::features::kHtmlBasedUsernameDetector);
-
   // Each test case consists of a set of parameters to be plugged into the
   // PasswordFormBuilder below, plus the corresponding expectations.
   // The test data contains cases that are identified by HTML detector, and not
@@ -633,10 +621,6 @@
 }
 
 TEST_F(PasswordFormConversionUtilsTest, HTMLDetectorCache) {
-  base::test::ScopedFeatureList feature_list;
-  feature_list.InitAndEnableFeature(
-      password_manager::features::kHtmlBasedUsernameDetector);
-
   PasswordFormBuilder builder(kTestFormActionURL);
   builder.AddTextField("unknown", "12345", nullptr);
   builder.AddTextField("something", "smith", nullptr);
@@ -2285,9 +2269,6 @@
 TEST_F(PasswordFormConversionUtilsTest, ResetPasswordForm) {
   // GetPassword (including HTML classifier) should process correctly forms
   // without any text fields.
-  base::test::ScopedFeatureList feature_list;
-  feature_list.InitAndEnableFeature(
-      password_manager::features::kHtmlBasedUsernameDetector);
   PasswordFormBuilder builder(kTestFormActionURL);
   builder.AddPasswordField("password", "secret", nullptr);
   builder.AddSubmitButton("submit");
diff --git a/components/browser_sync/profile_sync_service.cc b/components/browser_sync/profile_sync_service.cc
index 3b16a74..45952fa 100644
--- a/components/browser_sync/profile_sync_service.cc
+++ b/components/browser_sync/profile_sync_service.cc
@@ -279,7 +279,14 @@
                          user_settings_->IsFirstSetupComplete());
 
   // Auto-start means the first time the profile starts up, sync should start up
-  // immediately.
+  // immediately. Since IsSyncRequested() is false by default and nobody else
+  // will set it, we need to set it here.
+  // Local Sync bypasses the IsSyncRequested() check, so no need to set it in
+  // that case.
+  // TODO(crbug.com/920158): Get rid of AUTO_START and remove this workaround.
+  if (start_behavior_ == AUTO_START && !IsLocalSyncEnabled()) {
+    user_settings_->SetSyncRequestedIfNotSetExplicitly();
+  }
   bool force_immediate = (start_behavior_ == AUTO_START &&
                           !HasDisableReason(DISABLE_REASON_USER_CHOICE) &&
                           !user_settings_->IsFirstSetupComplete());
diff --git a/components/browser_sync/profile_sync_service.h b/components/browser_sync/profile_sync_service.h
index c65654e..b153bc1 100644
--- a/components/browser_sync/profile_sync_service.h
+++ b/components/browser_sync/profile_sync_service.h
@@ -65,71 +65,8 @@
 
 namespace browser_sync {
 
-// ProfileSyncService is the layer between browser subsystems like bookmarks,
-// and the sync engine. Each subsystem is logically thought of as being a sync
-// datatype. Individual datatypes can, at any point, be in a variety of stages
-// of being "enabled". Here are some specific terms for concepts used in this
-// class:
-//
-//   'Registered' (feature suppression for a datatype)
-//
-//      When a datatype is registered, the user has the option of syncing it.
-//      The sync opt-in UI will show only registered types; a checkbox should
-//      never be shown for an unregistered type, nor can it ever be synced.
-//
-//   'Preferred' (user preferences and opt-out for a datatype)
-//
-//      This means the user's opt-in or opt-out preference on a per-datatype
-//      basis. The sync service will try to make active exactly these types.
-//      If a user has opted out of syncing a particular datatype, it will
-//      be registered, but not preferred. Also note that not all datatypes can
-//      be directly chosen by the user: e.g. AUTOFILL_PROFILE is implied by
-//      AUTOFILL but can't be selected separately. If AUTOFILL is chosen by the
-//      user, then AUTOFILL_PROFILE will also be considered preferred. See
-//      SyncPrefs::ResolvePrefGroups.
-//
-//      This state is controlled by SyncUserSettings::SetChosenDataTypes. They
-//      are stored in the preferences system and persist; though if a datatype
-//      is not registered, it cannot be a preferred datatype.
-//
-//   'Active' (run-time initialization of sync system for a datatype)
-//
-//      An active datatype is a preferred datatype that is actively being
-//      synchronized: the syncer has been instructed to querying the server
-//      for this datatype, first-time merges have finished, and there is an
-//      actively installed ChangeProcessor that listens for changes to this
-//      datatype, propagating such changes into and out of the sync engine
-//      as necessary.
-//
-//      When a datatype is in the process of becoming active, it may be
-//      in some intermediate state. Those finer-grained intermediate states
-//      are differentiated by the DataTypeController state, but not exposed.
-//
-// Sync Configuration:
-//
-//   Sync configuration is accomplished via SyncUserSettings, in particular:
-//    * SetChosenDataTypes(): Set the data types the user wants to sync.
-//    * SetDecryptionPassphrase(): Attempt to decrypt the user's encrypted data
-//        using the passed passphrase.
-//    * SetEncryptionPassphrase(): Re-encrypt the user's data using the passed
-//        passphrase.
-//
-// Initial sync setup:
-//
-//   For privacy reasons, it is usually desirable to avoid syncing any data
-//   types until the user has finished setting up sync. There are two APIs
-//   that control the initial sync download:
-//
-//    * SyncUserSettings::SetFirstSetupComplete()
-//    * GetSetupInProgressHandle()
-//
-//   SetFirstSetupComplete() should be called once the user has finished setting
-//   up sync at least once on their account. GetSetupInProgressHandle() should
-//   be called while the user is actively configuring their account. The handle
-//   should be deleted once configuration is complete.
-//
-//   Once first setup has completed and there are no outstanding
-//   setup-in-progress handles, datatype configuration will begin.
+// Look at the syncer::SyncService interface for information on how to use this
+// class. You should not need to know about ProfileSyncService directly.
 class ProfileSyncService : public syncer::SyncService,
                            public syncer::SyncEngineHost,
                            public syncer::SyncPrefObserver,
diff --git a/components/nacl/browser/nacl_process_host.cc b/components/nacl/browser/nacl_process_host.cc
index afe8b14..565dfc2 100644
--- a/components/nacl/browser/nacl_process_host.cc
+++ b/components/nacl/browser/nacl_process_host.cc
@@ -17,6 +17,7 @@
 #include "base/feature_list.h"
 #include "base/files/file_util.h"
 #include "base/location.h"
+#include "base/metrics/field_trial.h"
 #include "base/metrics/histogram_macros.h"
 #include "base/path_service.h"
 #include "base/process/launch.h"
@@ -550,6 +551,12 @@
   if (NaClBrowser::GetDelegate()->DialogsAreSuppressed())
     cmd_line->AppendSwitch(switches::kNoErrorDialogs);
 
+  // TODO(crbug.com/932175): Remove this after field trials no longer need to
+  // be consulted for the MojoChannelMac launch.
+  base::FieldTrialList::CopyFieldTrialStateToFlags(
+      switches::kFieldTrialHandle, switches::kEnableFeatures,
+      switches::kDisableFeatures, cmd_line.get());
+
 #if defined(OS_WIN)
   cmd_line->AppendArg(switches::kPrefetchArgumentOther);
 #endif  // defined(OS_WIN)
diff --git a/components/nacl/common/nacl_service.cc b/components/nacl/common/nacl_service.cc
index ca85640..74d8b64c 100644
--- a/components/nacl/common/nacl_service.cc
+++ b/components/nacl/common/nacl_service.cc
@@ -8,6 +8,7 @@
 #include <string>
 
 #include "base/command_line.h"
+#include "build/build_config.h"
 #include "content/public/common/service_names.mojom.h"
 #include "ipc/ipc.mojom.h"
 #include "mojo/core/embedder/scoped_ipc_support.h"
@@ -26,6 +27,11 @@
 #include "services/service_manager/embedder/descriptors.h"
 #endif
 
+#if defined(OS_MACOSX)
+#include "base/mac/mach_port_rendezvous.h"
+#include "mojo/public/cpp/platform/features.h"
+#endif
+
 namespace {
 
 mojo::IncomingInvitation EstablishMojoConnection() {
@@ -34,10 +40,22 @@
   endpoint = mojo::PlatformChannel::RecoverPassedEndpointFromCommandLine(
       *base::CommandLine::ForCurrentProcess());
 #else
-  endpoint = mojo::PlatformChannelEndpoint(mojo::PlatformHandle(
-      base::ScopedFD(base::GlobalDescriptors::GetInstance()->Get(
-          service_manager::kMojoIPCChannel))));
-#endif
+#if defined(OS_MACOSX)
+  if (base::FeatureList::IsEnabled(mojo::features::kMojoChannelMac)) {
+    auto* client = base::MachPortRendezvousClient::GetInstance();
+    if (client) {
+      endpoint = mojo::PlatformChannelEndpoint(
+          mojo::PlatformHandle(client->TakeReceiveRight('mojo')));
+    }
+  } else {
+#endif  // defined(OS_MACOSX)
+    endpoint = mojo::PlatformChannelEndpoint(mojo::PlatformHandle(
+        base::ScopedFD(base::GlobalDescriptors::GetInstance()->Get(
+            service_manager::kMojoIPCChannel))));
+#if defined(OS_MACOSX)
+  }
+#endif  // defined(OS_MACOSX)
+#endif  // !defined(OS_WIN)
   DCHECK(endpoint.is_valid());
   return mojo::IncomingInvitation::Accept(std::move(endpoint));
 }
diff --git a/components/password_manager/content/browser/content_password_manager_driver.cc b/components/password_manager/content/browser/content_password_manager_driver.cc
index 2df827d..05d65c2 100644
--- a/components/password_manager/content/browser/content_password_manager_driver.cc
+++ b/components/password_manager/content/browser/content_password_manager_driver.cc
@@ -20,12 +20,28 @@
 #include "content/public/browser/browser_context.h"
 #include "content/public/browser/navigation_entry.h"
 #include "content/public/browser/navigation_handle.h"
+#include "content/public/browser/render_widget_host_view.h"
 #include "content/public/browser/ssl_status.h"
 #include "content/public/browser/web_contents.h"
 #include "net/cert/cert_status_flags.h"
 #include "third_party/blink/public/common/associated_interfaces/associated_interface_provider.h"
 #include "ui/base/page_transition_types.h"
 
+namespace {
+
+gfx::RectF TransformToRootCoordinates(
+    content::RenderFrameHost* render_frame_host,
+    const gfx::RectF& bounds_in_frame_coordinates) {
+  content::RenderWidgetHostView* rwhv = render_frame_host->GetView();
+  if (!rwhv)
+    return bounds_in_frame_coordinates;
+  return gfx::RectF(rwhv->TransformPointToRootCoordSpaceF(
+                        bounds_in_frame_coordinates.origin()),
+                    bounds_in_frame_coordinates.size());
+}
+
+}  // namespace
+
 namespace password_manager {
 
 ContentPasswordManagerDriver::ContentPasswordManagerDriver(
@@ -37,6 +53,7 @@
       password_generation_helper_(client, this),
       password_autofill_manager_(this, autofill_client, client),
       is_main_frame_(render_frame_host->GetParent() == nullptr),
+      password_manager_binding_(this),
       weak_factory_(this) {
   // For some frames |this| may be instantiated before log manager creation, so
   // here we can not send logging state to renderer process for them. For such
@@ -65,6 +82,11 @@
   return factory ? factory->GetDriverForFrame(render_frame_host) : nullptr;
 }
 
+void ContentPasswordManagerDriver::BindRequest(
+    autofill::mojom::PasswordManagerDriverAssociatedRequest request) {
+  password_manager_binding_.Bind(std::move(request));
+}
+
 void ContentPasswordManagerDriver::FillPasswordForm(
     const autofill::PasswordFormFillData& form_data) {
   password_autofill_manager_.OnAddPasswordFillData(form_data);
@@ -187,6 +209,107 @@
       std::move(callback));
 }
 
+void ContentPasswordManagerDriver::PasswordFormsParsed(
+    const std::vector<autofill::PasswordForm>& forms) {
+  if (!password_manager::bad_message::CheckChildProcessSecurityPolicy(
+          render_frame_host_, forms,
+          BadMessageReason::CPMD_BAD_ORIGIN_FORMS_PARSED))
+    return;
+  GetPasswordManager()->OnPasswordFormsParsed(this, forms);
+}
+
+void ContentPasswordManagerDriver::PasswordFormsRendered(
+    const std::vector<autofill::PasswordForm>& visible_forms,
+    bool did_stop_loading) {
+  if (!password_manager::bad_message::CheckChildProcessSecurityPolicy(
+          render_frame_host_, visible_forms,
+          BadMessageReason::CPMD_BAD_ORIGIN_FORMS_RENDERED))
+    return;
+  GetPasswordManager()->OnPasswordFormsRendered(this, visible_forms,
+                                                did_stop_loading);
+}
+
+void ContentPasswordManagerDriver::PasswordFormSubmitted(
+    const autofill::PasswordForm& password_form) {
+  if (!password_manager::bad_message::CheckChildProcessSecurityPolicy(
+          render_frame_host_, password_form,
+          BadMessageReason::CPMD_BAD_ORIGIN_FORM_SUBMITTED))
+    return;
+  GetPasswordManager()->OnPasswordFormSubmitted(this, password_form);
+}
+
+void ContentPasswordManagerDriver::ShowManualFallbackForSaving(
+    const autofill::PasswordForm& password_form) {
+  if (!password_manager::bad_message::CheckChildProcessSecurityPolicy(
+          render_frame_host_, password_form,
+          BadMessageReason::CPMD_BAD_ORIGIN_SHOW_FALLBACK_FOR_SAVING))
+    return;
+  GetPasswordManager()->ShowManualFallbackForSaving(this, password_form);
+
+  if (client_->IsIsolationForPasswordSitesEnabled()) {
+    // This function signals that the user is typing a password into
+    // |password_form|.  Use this as a heuristic to start site-isolating the
+    // form's site.  This is intended to be used primarily when full site
+    // isolation is not used, such as on Android.
+    content::SiteInstance::StartIsolatingSite(
+        render_frame_host_->GetSiteInstance()->GetBrowserContext(),
+        password_form.origin);
+  }
+}
+
+void ContentPasswordManagerDriver::HideManualFallbackForSaving() {
+  GetPasswordManager()->HideManualFallbackForSaving();
+}
+
+void ContentPasswordManagerDriver::SameDocumentNavigation(
+    const autofill::PasswordForm& password_form) {
+  if (!password_manager::bad_message::CheckChildProcessSecurityPolicy(
+          render_frame_host_, password_form,
+          BadMessageReason::CPMD_BAD_ORIGIN_IN_PAGE_NAVIGATION))
+    return;
+  GetPasswordManager()->OnPasswordFormSubmittedNoChecks(this, password_form);
+}
+
+void ContentPasswordManagerDriver::ShowPasswordSuggestions(
+    base::i18n::TextDirection text_direction,
+    const base::string16& typed_username,
+    int options,
+    const gfx::RectF& bounds) {
+  GetPasswordAutofillManager()->OnShowPasswordSuggestions(
+      text_direction, typed_username, options,
+      TransformToRootCoordinates(render_frame_host_, bounds));
+}
+
+void ContentPasswordManagerDriver::RecordSavePasswordProgress(
+    const std::string& log) {
+  client_->GetLogManager()->LogSavePasswordProgress(log);
+}
+
+void ContentPasswordManagerDriver::UserModifiedPasswordField() {
+  if (client_->GetMetricsRecorder())
+    client_->GetMetricsRecorder()->RecordUserModifiedPasswordField();
+}
+
+void ContentPasswordManagerDriver::CheckSafeBrowsingReputation(
+    const GURL& form_action,
+    const GURL& frame_url) {
+#if defined(FULL_SAFE_BROWSING)
+  client_->CheckSafeBrowsingReputation(form_action, frame_url);
+#endif
+}
+
+void ContentPasswordManagerDriver::FocusedInputChanged(bool is_fillable,
+                                                       bool is_password_field) {
+  client_->FocusedInputChanged(render_frame_host_->GetLastCommittedOrigin(),
+                               is_fillable, is_password_field);
+}
+
+void ContentPasswordManagerDriver::LogFirstFillingResult(
+    uint32_t form_renderer_id,
+    int32_t result) {
+  GetPasswordManager()->LogFirstFillingResult(this, form_renderer_id, result);
+}
+
 const autofill::mojom::AutofillAgentAssociatedPtr&
 ContentPasswordManagerDriver::GetAutofillAgent() {
   autofill::ContentAutofillDriver* autofill_driver =
diff --git a/components/password_manager/content/browser/content_password_manager_driver.h b/components/password_manager/content/browser/content_password_manager_driver.h
index 54d0acf0..618dce78 100644
--- a/components/password_manager/content/browser/content_password_manager_driver.h
+++ b/components/password_manager/content/browser/content_password_manager_driver.h
@@ -12,6 +12,7 @@
 #include "base/compiler_specific.h"
 #include "base/macros.h"
 #include "components/autofill/content/common/autofill_agent.mojom.h"
+#include "components/autofill/content/common/autofill_driver.mojom.h"
 #include "components/autofill/core/common/password_form_field_prediction_map.h"
 #include "components/autofill/core/common/password_form_generation_data.h"
 #include "components/password_manager/core/browser/password_autofill_manager.h"
@@ -34,7 +35,9 @@
 
 // There is one ContentPasswordManagerDriver per RenderFrameHost.
 // The lifetime is managed by the ContentPasswordManagerDriverFactory.
-class ContentPasswordManagerDriver : public PasswordManagerDriver {
+class ContentPasswordManagerDriver
+    : public PasswordManagerDriver,
+      public autofill::mojom::PasswordManagerDriver {
  public:
   ContentPasswordManagerDriver(content::RenderFrameHost* render_frame_host,
                                PasswordManagerClient* client,
@@ -45,6 +48,9 @@
   static ContentPasswordManagerDriver* GetForRenderFrameHost(
       content::RenderFrameHost* render_frame_host);
 
+  void BindRequest(
+      autofill::mojom::PasswordManagerDriverAssociatedRequest request);
+
   // PasswordManagerDriver implementation.
   void FillPasswordForm(
       const autofill::PasswordFormFillData& form_data) override;
@@ -87,6 +93,34 @@
     return render_frame_host_;
   }
 
+ protected:
+  // autofill::mojom::PasswordManagerDriver:
+  // Note that these messages received from a potentially compromised renderer.
+  // For that reason, any access to form data should be validated via
+  // bad_message::CheckChildProcessSecurityPolicy.
+  void PasswordFormsParsed(
+      const std::vector<autofill::PasswordForm>& forms) override;
+  void PasswordFormsRendered(
+      const std::vector<autofill::PasswordForm>& visible_forms,
+      bool did_stop_loading) override;
+  void PasswordFormSubmitted(
+      const autofill::PasswordForm& password_form) override;
+  void ShowManualFallbackForSaving(const autofill::PasswordForm& form) override;
+  void HideManualFallbackForSaving() override;
+  void SameDocumentNavigation(
+      const autofill::PasswordForm& password_form) override;
+  void ShowPasswordSuggestions(base::i18n::TextDirection text_direction,
+                               const base::string16& typed_username,
+                               int options,
+                               const gfx::RectF& bounds) override;
+  void RecordSavePasswordProgress(const std::string& log) override;
+  void UserModifiedPasswordField() override;
+  void CheckSafeBrowsingReputation(const GURL& form_action,
+                                   const GURL& frame_url) override;
+  void FocusedInputChanged(bool is_fillable, bool is_password_field) override;
+  void LogFirstFillingResult(uint32_t form_renderer_id,
+                             int32_t result) override;
+
  private:
   const autofill::mojom::AutofillAgentAssociatedPtr& GetAutofillAgent();
 
@@ -110,6 +144,9 @@
 
   autofill::mojom::PasswordGenerationAgentAssociatedPtr password_gen_agent_;
 
+  mojo::AssociatedBinding<autofill::mojom::PasswordManagerDriver>
+      password_manager_binding_;
+
   base::WeakPtrFactory<ContentPasswordManagerDriver> weak_factory_;
 
   DISALLOW_COPY_AND_ASSIGN(ContentPasswordManagerDriver);
diff --git a/components/password_manager/content/browser/content_password_manager_driver_factory.cc b/components/password_manager/content/browser/content_password_manager_driver_factory.cc
index 58d5638..d17618c 100644
--- a/components/password_manager/content/browser/content_password_manager_driver_factory.cc
+++ b/components/password_manager/content/browser/content_password_manager_driver_factory.cc
@@ -75,6 +75,31 @@
           kContentPasswordManagerDriverFactoryWebContentsUserDataKey));
 }
 
+// static
+void ContentPasswordManagerDriverFactory::BindAutofillDriver(
+    autofill::mojom::PasswordManagerDriverAssociatedRequest request,
+    content::RenderFrameHost* render_frame_host) {
+  content::WebContents* web_contents =
+      content::WebContents::FromRenderFrameHost(render_frame_host);
+  // We try to bind to the driver of this render frame host,
+  // but if driver is not ready for this render frame host for now,
+  // the request will be just dropped, this would cause closing the message pipe
+  // which would raise connection error to peer side.
+  // Peer side could reconnect later when needed.
+  if (!web_contents)
+    return;
+
+  ContentPasswordManagerDriverFactory* factory =
+      ContentPasswordManagerDriverFactory::FromWebContents(web_contents);
+  if (!factory)
+    return;
+
+  ContentPasswordManagerDriver* driver =
+      factory->GetDriverForFrame(render_frame_host);
+  if (driver)
+    driver->BindRequest(std::move(request));
+}
+
 ContentPasswordManagerDriver*
 ContentPasswordManagerDriverFactory::GetDriverForFrame(
     content::RenderFrameHost* render_frame_host) {
diff --git a/components/password_manager/content/browser/content_password_manager_driver_factory.h b/components/password_manager/content/browser/content_password_manager_driver_factory.h
index 46d35215..724ae8a 100644
--- a/components/password_manager/content/browser/content_password_manager_driver_factory.h
+++ b/components/password_manager/content/browser/content_password_manager_driver_factory.h
@@ -41,6 +41,10 @@
   static ContentPasswordManagerDriverFactory* FromWebContents(
       content::WebContents* web_contents);
 
+  static void BindAutofillDriver(
+      autofill::mojom::PasswordManagerDriverAssociatedRequest request,
+      content::RenderFrameHost* render_frame_host);
+
   ContentPasswordManagerDriver* GetDriverForFrame(
       content::RenderFrameHost* render_frame_host);
 
diff --git a/components/password_manager/core/browser/form_parsing/form_parser.cc b/components/password_manager/core/browser/form_parsing/form_parser.cc
index 1b143730..82482677c 100644
--- a/components/password_manager/core/browser/form_parsing/form_parser.cc
+++ b/components/password_manager/core/browser/form_parsing/form_parser.cc
@@ -984,9 +984,7 @@
   // heuristics, try to improve the username based on the context of the
   // fields, unless the username already came from more reliable types of
   // analysis.
-  if (!username_found_before_heuristic &&
-      base::FeatureList::IsEnabled(
-          password_manager::features::kHtmlBasedUsernameDetector)) {
+  if (!username_found_before_heuristic) {
     const FormFieldData* username_field_by_context = FindUsernameInPredictions(
         form_data.username_predictions, processed_fields, username_max);
     if (username_field_by_context &&
diff --git a/components/password_manager/core/browser/password_manager_client.h b/components/password_manager/core/browser/password_manager_client.h
index 24419d3..86e0c62 100644
--- a/components/password_manager/core/browser/password_manager_client.h
+++ b/components/password_manager/core/browser/password_manager_client.h
@@ -124,6 +124,12 @@
   // fallback for password saving should be not available.
   virtual void HideManualFallbackForSaving() = 0;
 
+  // Informs the embedder that the focus changed to a different input in the
+  // same frame (e.g. tabbed from email to password field).
+  virtual void FocusedInputChanged(const url::Origin& last_committed_origin,
+                                   bool is_fillable,
+                                   bool is_password_field) = 0;
+
   // Informs the embedder of a password forms that the user should choose from.
   // Returns true if the prompt is indeed displayed. If the prompt is not
   // displayed, returns false and does not call |callback|.
@@ -289,6 +295,8 @@
   virtual void NavigateToManagePasswordsPage(ManagePasswordsReferrer referrer) {
   }
 
+  virtual bool IsIsolationForPasswordSitesEnabled() const = 0;
+
  private:
   DISALLOW_COPY_AND_ASSIGN(PasswordManagerClient);
 };
diff --git a/components/password_manager/core/browser/stub_password_manager_client.cc b/components/password_manager/core/browser/stub_password_manager_client.cc
index 71bd57c..63d4154 100644
--- a/components/password_manager/core/browser/stub_password_manager_client.cc
+++ b/components/password_manager/core/browser/stub_password_manager_client.cc
@@ -29,6 +29,11 @@
 
 void StubPasswordManagerClient::HideManualFallbackForSaving() {}
 
+void StubPasswordManagerClient::FocusedInputChanged(
+    const url::Origin& last_committed_origin,
+    bool is_fillable,
+    bool is_password_field) {}
+
 bool StubPasswordManagerClient::PromptUserToChooseCredentials(
     std::vector<std::unique_ptr<autofill::PasswordForm>> local_forms,
     const GURL& origin,
@@ -102,4 +107,8 @@
   return base::OptionalOrNullptr(metrics_recorder_);
 }
 
+bool StubPasswordManagerClient::IsIsolationForPasswordSitesEnabled() const {
+  return false;
+}
+
 }  // namespace password_manager
diff --git a/components/password_manager/core/browser/stub_password_manager_client.h b/components/password_manager/core/browser/stub_password_manager_client.h
index b2ec574..a6822e6 100644
--- a/components/password_manager/core/browser/stub_password_manager_client.h
+++ b/components/password_manager/core/browser/stub_password_manager_client.h
@@ -32,6 +32,9 @@
       bool has_generated_password,
       bool update_password) override;
   void HideManualFallbackForSaving() override;
+  void FocusedInputChanged(const url::Origin& last_committed_origin,
+                           bool is_fillable,
+                           bool is_password_field) override;
   bool PromptUserToChooseCredentials(
       std::vector<std::unique_ptr<autofill::PasswordForm>> local_forms,
       const GURL& origin,
@@ -64,6 +67,7 @@
 #endif
   ukm::SourceId GetUkmSourceId() override;
   PasswordManagerMetricsRecorder* GetMetricsRecorder() override;
+  bool IsIsolationForPasswordSitesEnabled() const override;
 
  private:
   const StubCredentialsFilter credentials_filter_;
diff --git a/components/password_manager/core/common/password_manager_features.cc b/components/password_manager/core/common/password_manager_features.cc
index 85e03c5..3bd8a35 100644
--- a/components/password_manager/core/common/password_manager_features.cc
+++ b/components/password_manager/core/common/password_manager_features.cc
@@ -26,11 +26,6 @@
 const base::Feature kDeleteCorruptedPasswords = {
     "DeleteCorruptedPasswords", base::FEATURE_DISABLED_BY_DEFAULT};
 
-// Use HTML based username detector.
-// TODO(https://crbug.com/931591): Remove this.
-const base::Feature kHtmlBasedUsernameDetector = {
-    "HtmlBaseUsernameDetector", base::FEATURE_ENABLED_BY_DEFAULT};
-
 // Controls whether password requirements can be overridden for domains
 // (as opposed to only relying on the autofill server).
 const base::Feature kPasswordGenerationRequirementsDomainOverrides = {
diff --git a/components/password_manager/core/common/password_manager_features.h b/components/password_manager/core/common/password_manager_features.h
index c0e0db5..5b0ecc6 100644
--- a/components/password_manager/core/common/password_manager_features.h
+++ b/components/password_manager/core/common/password_manager_features.h
@@ -20,7 +20,6 @@
 extern const base::Feature kAffiliationBasedMatching;
 extern const base::Feature kEditPasswordsInDesktopSettings;
 extern const base::Feature kDeleteCorruptedPasswords;
-extern const base::Feature kHtmlBasedUsernameDetector;
 extern const base::Feature kPasswordGenerationRequirementsDomainOverrides;
 extern const base::Feature kFillOnAccountSelect;
 extern const base::Feature kFillOnAccountSelectHttp;
diff --git a/components/policy/core/common/schema.cc b/components/policy/core/common/schema.cc
index a533e9e..a99813e 100644
--- a/components/policy/core/common/schema.cc
+++ b/components/policy/core/common/schema.cc
@@ -648,15 +648,7 @@
 scoped_refptr<const Schema::InternalStorage> Schema::InternalStorage::Wrap(
     const SchemaData* data) {
   InternalStorage* storage = new InternalStorage();
-  storage->schema_data_.schema_nodes = data->schema_nodes;
-  storage->schema_data_.property_nodes = data->property_nodes;
-  storage->schema_data_.properties_nodes = data->properties_nodes;
-  storage->schema_data_.restriction_nodes = data->restriction_nodes;
-  storage->schema_data_.required_properties = data->required_properties;
-  storage->schema_data_.int_enums = data->int_enums;
-  storage->schema_data_.string_enums = data->string_enums;
-  storage->schema_data_.validation_schema_root_index =
-      data->validation_schema_root_index;
+  storage->schema_data_ = *data;
   return storage;
 }
 
diff --git a/components/policy/resources/policy_templates.json b/components/policy/resources/policy_templates.json
index 4b0cb931..1ef2e73 100644
--- a/components/policy/resources/policy_templates.json
+++ b/components/policy/resources/policy_templates.json
@@ -3747,6 +3747,8 @@
 
           This policy maps an extension ID or an update URL to its configuration. With an extension ID, configuration will be applied to the specified extension only. A default configuration can be set for the special ID <ph name="DEFAULT_SCOPE">"*"</ph>, which will apply to all extensions that don't have a custom configuration set in this policy. With an update URL, configuration will be applied to all extensions with the exact update URL stated in manifest of this extension, as described at <ph name="LINK_TO_EXTENSION_DOC1">https://developer.chrome.com/extensions/autoupdate</ph>.
 
+          For Windows instances that are not joined to a <ph name="MS_AD_NAME">Microsoft® Active Directory®</ph> domain, forced installation is limited to apps and extensions listed in the Chrome Web Store.
+
           For a full description of possible settings and structure of this policy please visit https://www.chromium.org/administrators/policy-list-3/extension-settings-full
           ''',
     },
diff --git a/components/signin/core/browser/gaia_cookie_manager_service.h b/components/signin/core/browser/gaia_cookie_manager_service.h
index ee2a8c5..336606b9 100644
--- a/components/signin/core/browser/gaia_cookie_manager_service.h
+++ b/components/signin/core/browser/gaia_cookie_manager_service.h
@@ -69,8 +69,7 @@
 // Also checks the External CC result to ensure no services that consume the
 // GAIA cookie are blocked (such as youtube). This is executed once for the
 // lifetime of this object, when the first call is made to AddAccountToCookie.
-class GaiaCookieManagerService : public KeyedService,
-                                 public GaiaAuthConsumer,
+class GaiaCookieManagerService : public GaiaAuthConsumer,
                                  public network::mojom::CookieChangeListener,
                                  public OAuth2TokenService::Consumer {
  public:
@@ -245,7 +244,7 @@
   ~GaiaCookieManagerService() override;
 
   void InitCookieListener();
-  void Shutdown() override;
+  void Shutdown();
 
   void AddAccountToCookie(
       const std::string& account_id,
diff --git a/components/signin/core/browser/signin_manager_unittest.cc b/components/signin/core/browser/signin_manager_unittest.cc
index 16e61c1..b5f7b96 100644
--- a/components/signin/core/browser/signin_manager_unittest.cc
+++ b/components/signin/core/browser/signin_manager_unittest.cc
@@ -89,8 +89,8 @@
     }
     token_service_.Shutdown();
     test_signin_client_.Shutdown();
-    account_tracker_.Shutdown();
     cookie_manager_service_.Shutdown();
+    account_tracker_.Shutdown();
     account_fetcher_.Shutdown();
   }
 
diff --git a/components/spellcheck/browser/spelling_service_client.cc b/components/spellcheck/browser/spelling_service_client.cc
index b772a58c..b48dc3f 100644
--- a/components/spellcheck/browser/spelling_service_client.cc
+++ b/components/spellcheck/browser/spelling_service_client.cc
@@ -14,6 +14,8 @@
 #include "base/json/string_escape.h"
 #include "base/logging.h"
 #include "base/memory/ptr_util.h"
+#include "base/metrics/histogram_functions.h"
+#include "base/metrics/histogram_macros.h"
 #include "base/stl_util.h"
 #include "base/strings/string_util.h"
 #include "base/strings/stringprintf.h"
@@ -165,7 +167,8 @@
   loader->DownloadToStringOfUnboundedSizeUntilCrashAndDie(
       url_loader_factory.get(),
       base::BindOnce(&SpellingServiceClient::OnSimpleLoaderComplete,
-                     base::Unretained(this), std::move(it)));
+                     base::Unretained(this), std::move(it),
+                     base::TimeTicks::Now()));
   return true;
 }
 
@@ -306,13 +309,37 @@
 
 void SpellingServiceClient::OnSimpleLoaderComplete(
     SpellCheckLoaderList::iterator it,
+    base::TimeTicks request_start,
     std::unique_ptr<std::string> response_body) {
+  UMA_HISTOGRAM_TIMES("SpellCheck.SpellingService.RequestDuration",
+                      base::TimeTicks::Now() - request_start);
+
   TextCheckCompleteCallback callback = std::move(it->get()->callback);
   base::string16 text = it->get()->text;
   bool success = false;
   std::vector<SpellCheckResult> results;
   if (response_body)
     success = ParseResponse(*response_body, &results);
+
+  int response_code = net::ERR_FAILED;
+  auto* resp_info = it->get()->simple_url_loader->ResponseInfo();
+  if (resp_info && resp_info->headers) {
+    response_code = resp_info->headers->response_code();
+  }
+
+  ServiceRequestResultType result_type =
+      ServiceRequestResultType::kRequestFailure;
+  if (success) {
+    result_type = results.empty()
+                      ? ServiceRequestResultType::kSuccessEmpty
+                      : ServiceRequestResultType::kSuccessWithSuggestions;
+  }
+
+  base::UmaHistogramSparse("SpellCheck.SpellingService.RequestHttpResponseCode",
+                           response_code);
+  UMA_HISTOGRAM_ENUMERATION("SpellCheck.SpellingService.RequestResultType",
+                            result_type);
+
   spellcheck_loaders_.erase(it);
   std::move(callback).Run(success, text, results);
 }
diff --git a/components/spellcheck/browser/spelling_service_client.h b/components/spellcheck/browser/spelling_service_client.h
index effe7006..eb74de3 100644
--- a/components/spellcheck/browser/spelling_service_client.h
+++ b/components/spellcheck/browser/spelling_service_client.h
@@ -68,6 +68,18 @@
     SUGGEST = 1,
     SPELLCHECK = 2,
   };
+  // An enum to classify request responses. This is only used for metrics.
+  // * REQUEST_FAILURE: The server returned an error.
+  // * SUCCESS_EMPTY: The server returned an empty list of suggestions.
+  // * SUCCESS_WITH_SUGGESTIONS: The server returned some suggestions.
+  // These values are persisted to logs. Entries should not be renumbered and
+  // numeric values should never be reused.
+  enum class ServiceRequestResultType : int {
+    kRequestFailure = 0,
+    kSuccessEmpty = 1,
+    kSuccessWithSuggestions = 2,
+    kMaxValue = kSuccessWithSuggestions,
+  };
   typedef base::OnceCallback<void(
       bool /* success */,
       const base::string16& /* text */,
@@ -126,6 +138,7 @@
       std::list<std::unique_ptr<TextCheckCallbackData>>;
 
   void OnSimpleLoaderComplete(SpellCheckLoaderList::iterator it,
+                              base::TimeTicks request_start,
                               std::unique_ptr<std::string> response_body);
 
   // List of loaders in use.
diff --git a/components/sync/base/sync_prefs.cc b/components/sync/base/sync_prefs.cc
index 1af20ac..ed3feb4 100644
--- a/components/sync/base/sync_prefs.cc
+++ b/components/sync/base/sync_prefs.cc
@@ -253,6 +253,16 @@
   pref_service_->SetBoolean(prefs::kSyncSuppressStart, !is_requested);
 }
 
+void SyncPrefs::SetSyncRequestedIfNotSetExplicitly() {
+  DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
+  // GetUserPrefValue() returns nullptr if there is no user-set value for this
+  // pref (there might still be a non-default value, e.g. from a policy, but we
+  // explicitly don't care about that here).
+  if (!pref_service_->GetUserPrefValue(prefs::kSyncSuppressStart)) {
+    pref_service_->SetBoolean(prefs::kSyncSuppressStart, false);
+  }
+}
+
 base::Time SyncPrefs::GetLastSyncedTime() const {
   DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
   return base::Time::FromInternalValue(
diff --git a/components/sync/base/sync_prefs.h b/components/sync/base/sync_prefs.h
index 108af549..0207cee 100644
--- a/components/sync/base/sync_prefs.h
+++ b/components/sync/base/sync_prefs.h
@@ -91,6 +91,7 @@
 
   bool IsSyncRequested() const;
   void SetSyncRequested(bool is_requested);
+  void SetSyncRequestedIfNotSetExplicitly();
 
   base::Time GetLastSyncedTime() const;
   void SetLastSyncedTime(base::Time time);
diff --git a/components/sync/driver/sync_service.h b/components/sync/driver/sync_service.h
index 919180d..9c9ef76 100644
--- a/components/sync/driver/sync_service.h
+++ b/components/sync/driver/sync_service.h
@@ -48,10 +48,75 @@
   base::Closure on_destroy_;
 };
 
+// SyncService is the layer between browser subsystems like bookmarks and the
+// sync engine. Each subsystem is logically thought of as being a sync datatype.
+// Individual datatypes can, at any point, be in a variety of stages of being
+// "enabled". Here are some specific terms for concepts used in this class:
+//
+//   'Registered' (feature suppression for a datatype)
+//
+//      When a datatype is registered, the user has the option of syncing it.
+//      The sync opt-in UI will show only registered types; a checkbox should
+//      never be shown for an unregistered type, nor can it ever be synced.
+//
+//   'Preferred' (user preferences and opt-out for a datatype)
+//
+//      This means the user's opt-in or opt-out preference on a per-datatype
+//      basis. The sync service will try to make active exactly these types.
+//      If a user has opted out of syncing a particular datatype, it will
+//      be registered, but not preferred. Also note that not all datatypes can
+//      be directly chosen by the user: e.g. AUTOFILL_PROFILE is implied by
+//      AUTOFILL but can't be selected separately. If AUTOFILL is chosen by the
+//      user, then AUTOFILL_PROFILE will also be considered preferred. See
+//      SyncPrefs::ResolvePrefGroups.
+//
+//      This state is controlled by SyncUserSettings::SetChosenDataTypes. They
+//      are stored in the preferences system and persist; though if a datatype
+//      is not registered, it cannot be a preferred datatype.
+//
+//   'Active' (run-time initialization of sync system for a datatype)
+//
+//      An active datatype is a preferred datatype that is actively being
+//      synchronized: the syncer has been instructed to querying the server
+//      for this datatype, first-time merges have finished, and there is an
+//      actively installed ChangeProcessor that listens for changes to this
+//      datatype, propagating such changes into and out of the sync engine
+//      as necessary.
+//
+//      When a datatype is in the process of becoming active, it may be
+//      in some intermediate state. Those finer-grained intermediate states
+//      are differentiated by the DataTypeController state, but not exposed.
+//
+// Sync Configuration:
+//
+//   Sync configuration is accomplished via SyncUserSettings, in particular:
+//    * SetChosenDataTypes(): Set the data types the user wants to sync.
+//    * SetDecryptionPassphrase(): Attempt to decrypt the user's encrypted data
+//        using the passed passphrase.
+//    * SetEncryptionPassphrase(): Re-encrypt the user's data using the passed
+//        passphrase.
+//
+// Initial sync setup:
+//
+//   For privacy reasons, it is usually desirable to avoid syncing any data
+//   types until the user has finished setting up sync. There are two APIs
+//   that control the initial sync download:
+//
+//    * SyncUserSettings::SetFirstSetupComplete()
+//    * GetSetupInProgressHandle()
+//
+//   SetFirstSetupComplete() should be called once the user has finished setting
+//   up sync at least once on their account. GetSetupInProgressHandle() should
+//   be called while the user is actively configuring their account. The handle
+//   should be deleted once configuration is complete.
+//
+//   Once first setup has completed and there are no outstanding
+//   setup-in-progress handles, datatype configuration will begin.
 class SyncService : public KeyedService {
  public:
-  // The set of reasons due to which Sync can be disabled. Meant to be used as a
-  // bitmask.
+  // The set of reasons due to which Sync-the-feature can be disabled. Note that
+  // Sync-the-transport might still start up even in the presence of (some)
+  // disable reasons. Meant to be used as a bitmask.
   enum DisableReason {
     DISABLE_REASON_NONE = 0,
     // Sync is disabled via platform-level override (e.g. Android's "MasterSync"
@@ -80,7 +145,9 @@
     DISABLE_REASON_PAUSED = 1 << 5,
   };
 
-  // The overall state of the SyncService, in ascending order of "activeness".
+  // The overall state of Sync-the-transport, in ascending order of
+  // "activeness". Note that this refers to the transport layer, which may be
+  // active even if Sync-the-feature is turned off.
   enum class TransportState {
     // Sync is inactive, e.g. due to enterprise policy, or simply because there
     // is no authenticated user.
@@ -109,6 +176,12 @@
 
   ~SyncService() override {}
 
+  //////////////////////////////////////////////////////////////////////////////
+  // USER SETTINGS
+  //////////////////////////////////////////////////////////////////////////////
+
+  // Returns the SyncUserSettings, which encapsulate all the user-configurable
+  // bits for Sync.
   virtual SyncUserSettings* GetUserSettings() = 0;
   virtual const SyncUserSettings* GetUserSettings() const = 0;
 
@@ -200,9 +273,9 @@
   //////////////////////////////////////////////////////////////////////////////
 
   // Returns true if initial sync setup is in progress (does not return true
-  // if the user is customizing sync after already completing setup once).
-  // SyncService uses this to determine if it's OK to start syncing, or if the
-  // user is still setting up the initial sync configuration.
+  // if the user is customizing sync after already completing setup once). This
+  // is equivalent to
+  // IsSetupInProgress() && !GetUserSettings()->IsFirstSetupComplete().
   // Note: This refers to Sync-the-feature. Sync-the-transport may be active
   // independent of first-setup state.
   bool IsFirstSetupInProgress() const;
@@ -211,13 +284,12 @@
   // SETUP-IN-PROGRESS HANDLING
   //////////////////////////////////////////////////////////////////////////////
 
-  // Called by the UI to notify the SyncService that UI is visible so it will
-  // not start syncing. This tells sync whether it's safe to start downloading
-  // data types yet (we don't start syncing until after sync setup is complete).
+  // Called by the UI to notify the SyncService that UI is visible, so any
+  // changes to Sync settings should *not* take effect immediately (e.g. if the
+  // user accidentally enabled a data type, we should give them a chance to undo
+  // the change before local and remote data are irrevocably merged).
   // The UI calls this and holds onto the instance for as long as any part of
-  // the signin wizard is displayed (even just the login UI).
-  // When the last outstanding handle is deleted, this kicks off the sync engine
-  // to ensure that data download starts.
+  // the Sync setup/configuration UI is visible.
   virtual std::unique_ptr<SyncSetupInProgressHandle>
   GetSetupInProgressHandle() = 0;
 
@@ -242,11 +314,10 @@
   // any forced types.
   virtual ModelTypeSet GetPreferredDataTypes() const = 0;
 
-  // Get the set of current active data types (those chosen or configured by
-  // the user which have not also encountered a runtime error).
-  // Note that if the Sync engine is in the middle of a configuration, this
-  // will the the empty set. Once the configuration completes the set will
-  // be updated.
+  // Returns the set of currently active data types (those chosen or configured
+  // by the user which have not also encountered a runtime error).
+  // Note that if the Sync engine is in the middle of a configuration, this will
+  // be the empty set. Once the configuration completes the set will be updated.
   virtual ModelTypeSet GetActiveDataTypes() const = 0;
 
   //////////////////////////////////////////////////////////////////////////////
@@ -281,11 +352,11 @@
   virtual void ReadyForStartChanged(ModelType type) = 0;
 
   // Enables/disables invalidations for session sync related datatypes.
-  // The session sync generates a lot of changes, which results into many
-  // invalidations. This can negatively affect the
-  // battery life on Android. For that reason, on Android, the invalidations for
-  // the Sessions should be received only when user is interested in session
-  // sync data, e.g. the history sync page is opened.
+  // The session sync generates a lot of changes, which results in many
+  // invalidations. This can negatively affect the battery life on Android. For
+  // that reason, on Android, the invalidations for sessions should be received
+  // only when user is interested in session sync data, e.g. the history sync
+  // page is opened.
   virtual void SetInvalidationsForSessionsEnabled(bool enabled) = 0;
 
   //////////////////////////////////////////////////////////////////////////////
@@ -329,6 +400,8 @@
   // DETAILED STATE FOR DEBUG UI
   //////////////////////////////////////////////////////////////////////////////
 
+  // Returns the state of the access token and token request, for display in
+  // internals UI.
   virtual SyncTokenStatus GetSyncTokenStatus() const = 0;
 
   // Initializes a struct of status indicators with data from the engine.
@@ -339,6 +412,7 @@
 
   virtual base::Time GetLastSyncedTime() const = 0;
 
+  // Returns some statistics on the most-recently completed sync cycle.
   virtual SyncCycleSnapshot GetLastCycleSnapshot() const = 0;
 
   // Returns a ListValue indicating the status of all registered types.
@@ -365,7 +439,6 @@
   virtual void AddTypeDebugInfoObserver(TypeDebugInfoObserver* observer) = 0;
   virtual void RemoveTypeDebugInfoObserver(TypeDebugInfoObserver* observer) = 0;
 
-  // Returns a weak pointer to the service's JsController.
   virtual base::WeakPtr<JsController> GetJsController() = 0;
 
   // Asynchronously fetches base::Value representations of all sync nodes and
diff --git a/components/sync/driver/sync_user_settings_impl.cc b/components/sync/driver/sync_user_settings_impl.cc
index a202962..fea26d8 100644
--- a/components/sync/driver/sync_user_settings_impl.cc
+++ b/components/sync/driver/sync_user_settings_impl.cc
@@ -130,6 +130,10 @@
   return result;
 }
 
+void SyncUserSettingsImpl::SetSyncRequestedIfNotSetExplicitly() {
+  prefs_->SetSyncRequestedIfNotSetExplicitly();
+}
+
 ModelTypeSet SyncUserSettingsImpl::GetPreferredDataTypes() const {
   ModelTypeSet types =
       Union(prefs_->GetPreferredDataTypes(registered_types_), ControlTypes());
diff --git a/components/sync/driver/sync_user_settings_impl.h b/components/sync/driver/sync_user_settings_impl.h
index a962ade0..baf1850 100644
--- a/components/sync/driver/sync_user_settings_impl.h
+++ b/components/sync/driver/sync_user_settings_impl.h
@@ -54,6 +54,8 @@
   void SetEncryptionPassphrase(const std::string& passphrase) override;
   bool SetDecryptionPassphrase(const std::string& passphrase) override;
 
+  void SetSyncRequestedIfNotSetExplicitly();
+
   ModelTypeSet GetPreferredDataTypes() const;
   bool IsEncryptedDatatypeEnabled() const;
   bool IsEncryptionPending() const;
diff --git a/components/viz/service/display/skia_renderer.cc b/components/viz/service/display/skia_renderer.cc
index 374e009b..2736575e 100644
--- a/components/viz/service/display/skia_renderer.cc
+++ b/components/viz/service/display/skia_renderer.cc
@@ -56,6 +56,215 @@
 #include "ui/gfx/transform.h"
 
 namespace viz {
+
+namespace {
+
+// Smallest unit that impacts anti-aliasing output. We use this to determine
+// when an exterior edge (with AA) has been clipped (no AA). The specific value
+// was chosen to match that used by gl_renderer.
+static const float kAAEpsilon = 1.0f / 1024.0f;
+
+// The gfx::QuadF draw_region passed to DoDrawQuad, converted to Skia types
+struct SkDrawRegion {
+  SkDrawRegion() = default;
+  explicit SkDrawRegion(const gfx::QuadF& draw_region);
+
+  SkPoint points[4];
+};
+
+SkDrawRegion::SkDrawRegion(const gfx::QuadF& draw_region) {
+  points[0] = gfx::PointFToSkPoint(draw_region.p1());
+  points[1] = gfx::PointFToSkPoint(draw_region.p2());
+  points[2] = gfx::PointFToSkPoint(draw_region.p3());
+  points[3] = gfx::PointFToSkPoint(draw_region.p4());
+}
+
+bool IsTextureResource(DisplayResourceProvider* resource_provider,
+                       ResourceId resource_id) {
+  return !resource_provider->IsResourceSoftwareBacked(resource_id);
+}
+
+bool CanExplicitlyScissor(const DrawQuad* quad,
+                          const gfx::QuadF* draw_region,
+                          const gfx::Transform& contents_device_transform) {
+  // PICTURE_CONTENT is not like the others, since it is executing a list of
+  // draw calls into the canvas.
+  if (quad->material == DrawQuad::PICTURE_CONTENT)
+    return false;
+  // Intersection with scissor and a quadrilateral is not necessarily a quad,
+  // so don't complicate things
+  if (draw_region)
+    return false;
+
+  // This is slightly different than
+  // gfx::Transform::IsPositiveScaleAndTranslation in that it also allows zero
+  // scales. This is because in the common orthographic case the z scale is 0.
+  if (!contents_device_transform.IsScaleOrTranslation())
+    return false;
+
+  return contents_device_transform.matrix().get(0, 0) >= 0.0 &&
+         contents_device_transform.matrix().get(1, 1) >= 0.0 &&
+         contents_device_transform.matrix().get(2, 2) >= 0.0;
+}
+
+void ApplyExplicitScissor(const DrawQuad* quad,
+                          const gfx::Rect& scissor_rect,
+                          const gfx::Transform& device_transform,
+                          unsigned* aa_flags,
+                          gfx::RectF* vis_rect) {
+  // Inset rectangular edges and turn off the AA for clipped edges. Operates in
+  // the quad's space, so apply inverse of transform to get new scissor
+  gfx::RectF scissor(scissor_rect);
+  device_transform.TransformRectReverse(&scissor);
+
+  float left_inset = scissor.x() - vis_rect->x();
+  float top_inset = scissor.y() - vis_rect->y();
+  float right_inset = vis_rect->right() - scissor.right();
+  float bottom_inset = vis_rect->bottom() - scissor.bottom();
+
+  if (left_inset >= kAAEpsilon) {
+    *aa_flags &= ~SkCanvas::kLeft_QuadAAFlag;
+  } else {
+    left_inset = 0;
+  }
+  if (top_inset >= kAAEpsilon) {
+    *aa_flags &= ~SkCanvas::kTop_QuadAAFlag;
+  } else {
+    top_inset = 0;
+  }
+  if (right_inset >= kAAEpsilon) {
+    *aa_flags &= ~SkCanvas::kRight_QuadAAFlag;
+  } else {
+    right_inset = 0;
+  }
+  if (bottom_inset >= kAAEpsilon) {
+    *aa_flags &= ~SkCanvas::kBottom_QuadAAFlag;
+  } else {
+    bottom_inset = 0;
+  }
+
+  vis_rect->Inset(left_inset, top_inset, right_inset, bottom_inset);
+}
+
+unsigned GetCornerAAFlags(const DrawQuad* quad,
+                          const SkPoint& vertex,
+                          unsigned edge_mask) {
+  // Returns mask of SkCanvas::QuadAAFlags, with bits set for each edge of the
+  // shared quad state's quad_layer_rect that vertex is touching.
+
+  unsigned mask = SkCanvas::kNone_QuadAAFlags;
+  if (std::abs(vertex.x()) < kAAEpsilon)
+    mask |= SkCanvas::kLeft_QuadAAFlag;
+  if (std::abs(vertex.x() - quad->shared_quad_state->quad_layer_rect.width()) <
+      kAAEpsilon)
+    mask |= SkCanvas::kRight_QuadAAFlag;
+  if (std::abs(vertex.y()) < kAAEpsilon)
+    mask |= SkCanvas::kTop_QuadAAFlag;
+  if (std::abs(vertex.y() - quad->shared_quad_state->quad_layer_rect.height()) <
+      kAAEpsilon)
+    mask |= SkCanvas::kBottom_QuadAAFlag;
+  // & with the overall edge_mask to take into account edges that were clipped
+  // by the visible rect.
+  return mask & edge_mask;
+}
+
+bool IsExteriorEdge(unsigned corner_mask1, unsigned corner_mask2) {
+  return (corner_mask1 & corner_mask2) != 0;
+}
+
+unsigned GetRectilinearEdgeFlags(const DrawQuad* quad) {
+  // In the normal case, turn on AA for edges that represent the outside of
+  // the layer, and that aren't clipped by the visible rect.
+  unsigned mask = SkCanvas::kNone_QuadAAFlags;
+  if (quad->IsLeftEdge() &&
+      std::abs(quad->rect.x() - quad->visible_rect.x()) < kAAEpsilon)
+    mask |= SkCanvas::kLeft_QuadAAFlag;
+  if (quad->IsTopEdge() &&
+      std::abs(quad->rect.y() - quad->visible_rect.y()) < kAAEpsilon)
+    mask |= SkCanvas::kTop_QuadAAFlag;
+  if (quad->IsRightEdge() &&
+      std::abs(quad->rect.right() - quad->visible_rect.right()) < kAAEpsilon)
+    mask |= SkCanvas::kRight_QuadAAFlag;
+  if (quad->IsBottomEdge() &&
+      std::abs(quad->rect.bottom() - quad->visible_rect.bottom()) < kAAEpsilon)
+    mask |= SkCanvas::kBottom_QuadAAFlag;
+
+  return mask;
+}
+
+// This also modifies draw_region to clean up any degeneracies
+void GetClippedEdgeFlags(const DrawQuad* quad,
+                         unsigned* edge_mask,
+                         SkDrawRegion* draw_region) {
+  // Instead of trying to rotate vertices of draw_region to align with Skia's
+  // edge label conventions, turn on an edge's label if it is aligned to any
+  // exterior edge.
+  unsigned p0Mask = GetCornerAAFlags(quad, draw_region->points[0], *edge_mask);
+  unsigned p1Mask = GetCornerAAFlags(quad, draw_region->points[1], *edge_mask);
+  unsigned p2Mask = GetCornerAAFlags(quad, draw_region->points[2], *edge_mask);
+  unsigned p3Mask = GetCornerAAFlags(quad, draw_region->points[3], *edge_mask);
+
+  unsigned mask = SkCanvas::kNone_QuadAAFlags;
+  // The "top" is p0 to p1
+  if (IsExteriorEdge(p0Mask, p1Mask))
+    mask |= SkCanvas::kTop_QuadAAFlag;
+  // The "right" is p1 to p2
+  if (IsExteriorEdge(p1Mask, p2Mask))
+    mask |= SkCanvas::kRight_QuadAAFlag;
+  // The "bottom" is p2 to p3
+  if (IsExteriorEdge(p2Mask, p3Mask))
+    mask |= SkCanvas::kBottom_QuadAAFlag;
+  // The "left" is p3 to p0
+  if (IsExteriorEdge(p3Mask, p0Mask))
+    mask |= SkCanvas::kLeft_QuadAAFlag;
+
+  // If the clipped draw_region has adjacent non-AA edges that touch the
+  // exterior edge (which should be AA'ed), move the degenerate vertex to the
+  // appropriate index so that Skia knows to construct a coverage ramp at that
+  // corner. This is not an ideal solution, but is the best hint we can give,
+  // given our limited information post-BSP splitting.
+  if (draw_region->points[2] == draw_region->points[3]) {
+    // The BSP splitting always creates degenerate quads with the duplicate
+    // vertex in the last two indices.
+    if (p0Mask && !(mask & SkCanvas::kLeft_QuadAAFlag) &&
+        !(mask & SkCanvas::kTop_QuadAAFlag)) {
+      // Rewrite draw_region from p0,p1,p2,p2 to p0,p1,p2,p0; top edge stays off
+      // right edge is preserved, bottom edge turns off, left edge turns on
+      draw_region->points[3] = draw_region->points[0];
+      mask = SkCanvas::kLeft_QuadAAFlag | (mask & SkCanvas::kRight_QuadAAFlag);
+    } else if (p1Mask && !(mask & SkCanvas::kTop_QuadAAFlag) &&
+               !(mask & SkCanvas::kRight_QuadAAFlag)) {
+      // Rewrite draw_region to p0,p1,p1,p2; top edge stays off, right edge
+      // turns on, bottom edge turns off, left edge is preserved
+      draw_region->points[2] = draw_region->points[1];
+      mask = SkCanvas::kRight_QuadAAFlag | (mask & SkCanvas::kLeft_QuadAAFlag);
+    }
+    // p2 could follow the same process, but if its adjacent edges are AA
+    // (skipping the degenerate edge to p3), it's actually already in the
+    // desired vertex ordering; and since p3 is in the same location, it's
+    // equivalent to p2 so it doesn't need checking either.
+  }  // Else not degenerate, so can't to correct non-AA corners touching AA edge
+
+  *edge_mask = mask;
+}
+
+bool IsAAForcedOff(const DrawQuad* quad) {
+  switch (quad->material) {
+    case DrawQuad::PICTURE_CONTENT:
+      return PictureDrawQuad::MaterialCast(quad)->force_anti_aliasing_off;
+    case DrawQuad::RENDER_PASS:
+      return RenderPassDrawQuad::MaterialCast(quad)->force_anti_aliasing_off;
+    case DrawQuad::SOLID_COLOR:
+      return SolidColorDrawQuad::MaterialCast(quad)->force_anti_aliasing_off;
+    case DrawQuad::TILED_CONTENT:
+      return TileDrawQuad::MaterialCast(quad)->force_anti_aliasing_off;
+    default:
+      return false;
+  }
+}
+
+}  // namespace
+
 // Parameters needed to draw a RenderPassDrawQuad.
 struct SkiaRenderer::DrawRenderPassDrawQuadParams {
   // The "in" parameters that will be used when apply filters.
@@ -71,27 +280,56 @@
   sk_sp<SkColorFilter> color_filter;
 };
 
-namespace {
+// State calculated from a DrawQuad and current renderer state, that is common
+// to all DrawQuad rendering.
+struct SkiaRenderer::DrawQuadParams {
+  DrawQuadParams() = default;
+  DrawQuadParams(const gfx::Transform& cdt,
+                 const gfx::RectF visible_rect,
+                 unsigned aa_flags,
+                 SkBlendMode blend_mode,
+                 float opacity,
+                 const gfx::QuadF* draw_region,
+                 bool enable_scissor_rect);
 
-bool IsTextureResource(DisplayResourceProvider* resource_provider,
-                       ResourceId resource_id) {
-  return !resource_provider->IsResourceSoftwareBacked(resource_id);
+  // window_matrix * projection_matrix * quad_to_target_transform
+  gfx::Transform content_device_transform;
+  // The DrawQuad's visible_rect, possibly explicitly clipped by the scissor
+  gfx::RectF visible_rect;
+  // SkCanvas::QuadAAFlags, already taking into account settings
+  // (but not certain quad type's force_antialias_off bit)
+  unsigned aa_flags;
+  // Final blend mode to use, respecting quad settings + opacity optimizations
+  SkBlendMode blend_mode;
+  // Final opacity of quad
+  float opacity;
+  // Optional restricted draw geometry, will point to a length 4 SkPoint array
+  // with its points in CW order matching Skia's vertex/edge expectations.
+  base::Optional<SkDrawRegion> draw_region;
+  // True if renderer's scissor_rect_ should be used as a clipRect on the
+  // canvas. Is false if is_scissor_enabled_ is false or the scissor was
+  // explicitly applied to the visible geometry already.
+  bool has_scissor_rect;
+};
+
+SkiaRenderer::DrawQuadParams::DrawQuadParams(const gfx::Transform& cdt,
+                                             const gfx::RectF visible_rect,
+                                             unsigned aa_flags,
+                                             SkBlendMode blend_mode,
+                                             float opacity,
+                                             const gfx::QuadF* draw_region,
+                                             bool has_scissor_rect)
+    : content_device_transform(cdt),
+      visible_rect(visible_rect),
+      aa_flags(aa_flags),
+      blend_mode(blend_mode),
+      opacity(opacity),
+      has_scissor_rect(has_scissor_rect) {
+  if (draw_region) {
+    this->draw_region.emplace(*draw_region);
+  }
 }
 
-bool ApplyTransformAndScissorToTileRect(
-    const gfx::Transform& contents_device_transform) {
-  // This is slightly different than
-  // gfx::Transform::IsPositiveScaleAndTranslation in that it also allows zero
-  // scales. This is because in the common orthographic case the z scale is 0.
-  if (!contents_device_transform.IsScaleOrTranslation())
-    return false;
-  return contents_device_transform.matrix().get(0, 0) >= 0.0 &&
-         contents_device_transform.matrix().get(1, 1) >= 0.0 &&
-         contents_device_transform.matrix().get(2, 2) >= 0.0;
-}
-
-}  // namespace
-
 // Scoped helper class for building SkImage from resource id.
 class SkiaRenderer::ScopedSkImageBuilder {
  public:
@@ -464,15 +702,207 @@
   if (!current_canvas_)
     return;
   TRACE_EVENT0("viz", "SkiaRenderer::DoDrawQuad");
-  if (quad->material == DrawQuad::TILED_CONTENT) {
-    AddTileQuadToBatch(TileDrawQuad::MaterialCast(quad), draw_region);
-    return;
-  }
-  // If the current quad is not tiled content then we must flush any
-  // bufferred tiled content quads.
-  if (!batched_tiles_.empty())
-    DrawBatchedTileQuads();
 
+  DrawQuadParams params = CalculateDrawQuadParams(quad, draw_region);
+  if (MustFlushBatchedQuads(quad, params)) {
+    FlushBatchedQuads();
+  }
+
+  // TODO(michaelludwig): By the end of the Skia API update, this switch will
+  // hold all quad draw types and resemble the old DoDrawSingleQuad.
+  switch (quad->material) {
+    case DrawQuad::TILED_CONTENT:
+      DrawTileDrawQuad(TileDrawQuad::MaterialCast(quad), params);
+      break;
+    default:
+      // If we've reached here, the quad's type hasn't been updated to be
+      // batch aware yet.
+      DoSingleDrawQuad(quad, draw_region);
+      break;
+  }
+}
+
+SkiaRenderer::DrawQuadParams SkiaRenderer::CalculateDrawQuadParams(
+    const DrawQuad* quad,
+    const gfx::QuadF* draw_region) {
+  DrawQuadParams params(
+      current_frame()->window_matrix * current_frame()->projection_matrix *
+          quad->shared_quad_state->quad_to_target_transform,
+      gfx::RectF(quad->visible_rect), SkCanvas::kNone_QuadAAFlags,
+      quad->shared_quad_state->blend_mode, quad->shared_quad_state->opacity,
+      draw_region, is_scissor_enabled_);
+
+  params.content_device_transform.FlattenTo2d();
+
+  // Respect per-quad setting overrides as highest priority setting
+  if (!IsAAForcedOff(quad)) {
+    if (settings_->force_antialiasing) {
+      // This setting makes the entire draw AA, so don't bother checking edges
+      params.aa_flags = SkCanvas::kAll_QuadAAFlags;
+    } else if (settings_->allow_antialiasing) {
+      params.aa_flags = GetRectilinearEdgeFlags(quad);
+      if (draw_region && params.aa_flags != SkCanvas::kNone_QuadAAFlags) {
+        // Turn off interior edges' AA from the BSP splitting
+        GetClippedEdgeFlags(quad, &params.aa_flags, &*params.draw_region);
+      }
+    }
+  }
+
+  if (!quad->ShouldDrawWithBlending()) {
+    // The quad layer is src-over with 1.0 opacity and its needs_blending flag
+    // has been set to false. However, even if the layer's opacity is 1.0, the
+    // contents may not be (e.g. png or a color with alpha).
+    if (quad->shared_quad_state->are_contents_opaque) {
+      // Visually, this is the same as kSrc but Skia is faster with SrcOver
+      params.blend_mode = SkBlendMode::kSrcOver;
+    } else {
+      // Replaces dst contents with the new color (e.g. no blending); this is
+      // just as fast as srcover when there's no AA, but is slow when coverage
+      // must be taken into account.
+      params.blend_mode = SkBlendMode::kSrc;
+    }
+    params.opacity = 1.f;
+  }
+
+  // Applying the scissor explicitly means avoiding a clipRect() call and
+  // allows more quads to be batched together in a DrawEdgeAAImageSet call
+  if (is_scissor_enabled_ &&
+      CanExplicitlyScissor(quad, draw_region,
+                           params.content_device_transform)) {
+    ApplyExplicitScissor(quad, scissor_rect_, params.content_device_transform,
+                         &params.aa_flags, &params.visible_rect);
+    params.has_scissor_rect = false;
+  }
+
+  return params;
+}
+
+bool SkiaRenderer::MustFlushBatchedQuads(const DrawQuad* new_quad,
+                                         const DrawQuadParams& params) {
+  if (batched_quads_.empty())
+    return false;
+
+  // TODO(michaelludwig) - Once other quad types are migrated from
+  // DoDrawQuadLegacy, this check will be widened
+  if (new_quad->material != DrawQuad::TILED_CONTENT)
+    return true;
+
+  if (batched_quad_state_.blend_mode != params.blend_mode)
+    return true;
+
+  bool no_scissor =
+      !batched_quad_state_.has_scissor_rect && !params.has_scissor_rect;
+  bool same_scissor = batched_quad_state_.has_scissor_rect &&
+                      params.has_scissor_rect &&
+                      batched_quad_state_.scissor_rect == scissor_rect_;
+
+  if (!no_scissor && !same_scissor)
+    return true;
+
+  // TODO(michaelludwig) - Would be nice if the batchable tiles could expose
+  // filter quality in a shared parent class
+  if (TileDrawQuad::MaterialCast(new_quad)->nearest_neighbor !=
+      batched_quad_state_.is_nearest_neighbor)
+    return true;
+
+  return false;
+}
+
+void SkiaRenderer::AddQuadToBatch(const DrawQuad* quad,
+                                  const DrawQuadParams& params,
+                                  sk_sp<SkImage> image,
+                                  const gfx::RectF& tex_coords) {
+  // Configure batch state if it's the first
+  if (batched_quads_.empty()) {
+    if (params.has_scissor_rect) {
+      batched_quad_state_.scissor_rect = scissor_rect_;
+      batched_quad_state_.has_scissor_rect = true;
+    } else {
+      batched_quad_state_.has_scissor_rect = false;
+    }
+
+    batched_quad_state_.blend_mode = params.blend_mode;
+    if (quad->material == DrawQuad::TILED_CONTENT) {
+      batched_quad_state_.is_nearest_neighbor =
+          TileDrawQuad::MaterialCast(quad)->nearest_neighbor;
+    } else {
+      // TODO(michaelludwig) Implement this for the batchable quad types that
+      // have filter quality settings
+      batched_quad_state_.is_nearest_neighbor = false;
+    }
+  }
+
+  // Add entry, with optional clip quad and shared transform
+  if (params.draw_region.has_value()) {
+    for (int i = 0; i < 4; ++i) {
+      batched_draw_regions_.push_back(params.draw_region->points[i]);
+    }
+  }
+
+  SkMatrix m;
+  gfx::TransformToFlattenedSkMatrix(params.content_device_transform, &m);
+  std::vector<SkMatrix>& cdts = batched_cdt_matrices_;
+  if (cdts.empty() || cdts[cdts.size() - 1] != m) {
+    cdts.push_back(m);
+  }
+  int matrixIndex = cdts.size() - 1;
+
+  batched_quads_.push_back({std::move(image), gfx::RectFToSkRect(tex_coords),
+                            gfx::RectFToSkRect(params.visible_rect),
+                            matrixIndex, params.opacity, params.aa_flags,
+                            params.draw_region.has_value()});
+}
+
+void SkiaRenderer::FlushBatchedQuads() {
+  TRACE_EVENT0("viz", "SkiaRenderer::FlushBatchedQuads");
+
+  SkAutoCanvasRestore acr(current_canvas_, true /* do_save */);
+  // Every batch entry's transform represents the entire transform to device
+  // space, so make sure the canvas isn't doing anything else.
+  current_canvas_->setMatrix(SkMatrix::I());
+
+  if (batched_quad_state_.has_scissor_rect) {
+    current_canvas_->clipRect(
+        gfx::RectToSkRect(batched_quad_state_.scissor_rect));
+  }
+
+  SkFilterQuality filter_quality = batched_quad_state_.is_nearest_neighbor
+                                       ? kNone_SkFilterQuality
+                                       : kLow_SkFilterQuality;
+  SkPaint paint;
+  paint.setFilterQuality(filter_quality);
+  paint.setBlendMode(batched_quad_state_.blend_mode);
+  current_canvas_->experimental_DrawEdgeAAImageSet(
+      &batched_quads_.front(), batched_quads_.size(),
+      &batched_draw_regions_.front(), &batched_cdt_matrices_.front(), &paint,
+      SkCanvas::kFast_SrcRectConstraint);
+
+  batched_quads_.clear();
+  batched_draw_regions_.clear();
+  batched_cdt_matrices_.clear();
+}
+
+void SkiaRenderer::DrawTileDrawQuad(const TileDrawQuad* quad,
+                                    const DrawQuadParams& params) {
+  DCHECK(!MustFlushBatchedQuads(quad, params));
+
+  // |resource_provider_| can be NULL in resourceless software draws, which
+  // should never produce tile quads in the first place.
+  DCHECK(resource_provider_);
+  ScopedSkImageBuilder builder(
+      this, quad->resource_id(),
+      quad->is_premultiplied ? kPremul_SkAlphaType : kUnpremul_SkAlphaType);
+  const SkImage* image = builder.sk_image();
+  if (!image)
+    return;
+
+  gfx::RectF vis_tex_coords = cc::MathUtil::ScaleRectProportional(
+      quad->tex_coord_rect, gfx::RectF(quad->rect), params.visible_rect);
+  AddQuadToBatch(quad, params, sk_ref_sp(image), vis_tex_coords);
+}
+
+void SkiaRenderer::DoSingleDrawQuad(const DrawQuad* quad,
+                                    const gfx::QuadF* draw_region) {
   base::Optional<SkAutoCanvasRestore> auto_canvas_restore;
   const gfx::Rect* scissor_rect =
       is_scissor_enabled_ ? &scissor_rect_ : nullptr;
@@ -548,47 +978,6 @@
   current_canvas_->resetMatrix();
 }
 
-bool SkiaRenderer::MustDrawBatchedTileQuads(
-    const DrawQuad* new_quad,
-    const gfx::Transform& contents_device_transform,
-    bool apply_transform_and_scissor,
-    const gfx::QuadF* draw_region) {
-  DCHECK(new_quad->material == DrawQuad::TILED_CONTENT);
-  DCHECK(apply_transform_and_scissor ==
-         ApplyTransformAndScissorToTileRect(contents_device_transform));
-
-  if (batched_tiles_.empty())
-    return false;
-
-  bool has_draw_region = draw_region != nullptr;
-
-  if (apply_transform_and_scissor) {
-    if (!batched_tile_state_.contents_device_transform.IsIdentity())
-      return true;
-    DCHECK(!batched_tile_state_.has_scissor_rect);
-  } else {
-    if (batched_tile_state_.contents_device_transform !=
-            contents_device_transform ||
-        batched_tile_state_.has_scissor_rect != is_scissor_enabled_ ||
-        (is_scissor_enabled_ &&
-         batched_tile_state_.scissor_rect != scissor_rect_))
-      return true;
-  }
-
-  if (batched_tile_state_.blend_mode != new_quad->shared_quad_state->blend_mode)
-    return true;
-
-  if (batched_tile_state_.has_draw_region != has_draw_region ||
-      (has_draw_region && batched_tile_state_.draw_region != *draw_region))
-    return true;
-
-  if (TileDrawQuad::MaterialCast(new_quad)->nearest_neighbor !=
-      batched_tile_state_.is_nearest_neighbor)
-    return true;
-
-  return false;
-}
-
 void SkiaRenderer::PrepareCanvasForDrawQuads(
     gfx::Transform contents_device_transform,
     const gfx::QuadF* draw_region,
@@ -744,119 +1133,6 @@
   current_canvas_->drawImageRect(image, sk_uv_rect, quad_rect, paint);
 }
 
-void SkiaRenderer::AddTileQuadToBatch(const TileDrawQuad* quad,
-                                      const gfx::QuadF* draw_region) {
-  gfx::Transform contents_device_transform =
-      current_frame()->window_matrix * current_frame()->projection_matrix *
-      quad->shared_quad_state->quad_to_target_transform;
-  bool apply_transform_and_scissor =
-      ApplyTransformAndScissorToTileRect(contents_device_transform);
-  if (MustDrawBatchedTileQuads(quad, contents_device_transform,
-                               apply_transform_and_scissor, draw_region))
-    DrawBatchedTileQuads();
-
-  if (batched_tiles_.empty()) {
-    if (draw_region) {
-      batched_tile_state_.draw_region = *draw_region;
-    }
-    batched_tile_state_.blend_mode = quad->shared_quad_state->blend_mode;
-    batched_tile_state_.is_nearest_neighbor = quad->nearest_neighbor;
-    batched_tile_state_.has_draw_region = (draw_region != nullptr);
-    if (apply_transform_and_scissor) {
-      batched_tile_state_.contents_device_transform = gfx::Transform();
-      batched_tile_state_.has_scissor_rect = false;
-    } else {
-      batched_tile_state_.contents_device_transform = contents_device_transform;
-      batched_tile_state_.has_scissor_rect = is_scissor_enabled_;
-      batched_tile_state_.scissor_rect = scissor_rect_;
-    }
-  }
-
-  // |resource_provider_| can be NULL in resourceless software draws, which
-  // should never produce tile quads in the first place.
-  DCHECK(resource_provider_);
-  ScopedSkImageBuilder builder(
-      this, quad->resource_id(),
-      quad->is_premultiplied ? kPremul_SkAlphaType : kUnpremul_SkAlphaType);
-  const SkImage* image = builder.sk_image();
-  if (!image)
-    return;
-  gfx::RectF visible_tex_coord_rect = cc::MathUtil::ScaleRectProportional(
-      quad->tex_coord_rect, gfx::RectF(quad->rect),
-      gfx::RectF(quad->visible_rect));
-
-  unsigned aa_flags = SkCanvas::kNone_QuadAAFlags;
-  if (settings_->allow_antialiasing || settings_->force_antialiasing) {
-    if (quad->IsLeftEdge())
-      aa_flags |= SkCanvas::kLeft_QuadAAFlag;
-    if (quad->IsTopEdge())
-      aa_flags |= SkCanvas::kTop_QuadAAFlag;
-    if (quad->IsRightEdge())
-      aa_flags |= SkCanvas::kRight_QuadAAFlag;
-    if (quad->IsBottomEdge())
-      aa_flags |= SkCanvas::kBottom_QuadAAFlag;
-  }
-  gfx::RectF quad_rect = gfx::RectF(quad->visible_rect);
-  if (apply_transform_and_scissor) {
-    contents_device_transform.TransformRect(&quad_rect);
-    if (is_scissor_enabled_) {
-      float left_inset = scissor_rect_.x() - quad_rect.x();
-      float top_inset = scissor_rect_.y() - quad_rect.y();
-      float right_inset = quad_rect.right() - scissor_rect_.right();
-      float bottom_inset = quad_rect.bottom() - scissor_rect_.bottom();
-      if (left_inset > 0) {
-        aa_flags &= ~SkCanvas::kLeft_QuadAAFlag;
-      } else {
-        left_inset = 0;
-      }
-      if (top_inset > 0)
-        aa_flags &= ~SkCanvas::kTop_QuadAAFlag;
-      else
-        top_inset = 0;
-      if (right_inset > 0)
-        aa_flags &= ~SkCanvas::kRight_QuadAAFlag;
-      else
-        right_inset = 0;
-      if (bottom_inset > 0)
-        aa_flags &= ~SkCanvas::kBottom_QuadAAFlag;
-      else
-        bottom_inset = 0;
-      float scale_x = visible_tex_coord_rect.width() / quad_rect.width();
-      float scale_y = visible_tex_coord_rect.height() / quad_rect.height();
-      quad_rect.Inset(left_inset, top_inset, right_inset, bottom_inset);
-      visible_tex_coord_rect.Inset(left_inset * scale_x, top_inset * scale_y,
-                                   right_inset * scale_x,
-                                   bottom_inset * scale_y);
-    }
-  }
-  SkRect uv_rect = gfx::RectFToSkRect(visible_tex_coord_rect);
-  batched_tiles_.push_back(SkCanvas::ImageSetEntry{
-      sk_ref_sp(image), uv_rect, gfx::RectFToSkRect(quad_rect),
-      quad->shared_quad_state->opacity, aa_flags});
-}
-
-void SkiaRenderer::DrawBatchedTileQuads() {
-  TRACE_EVENT0("viz", "SkiaRenderer::DrawBatchedTileQuads");
-  const gfx::QuadF* draw_region = batched_tile_state_.has_draw_region
-                                      ? &batched_tile_state_.draw_region
-                                      : nullptr;
-  const gfx::Rect* scissor_rect = batched_tile_state_.has_scissor_rect
-                                      ? &batched_tile_state_.scissor_rect
-                                      : nullptr;
-  base::Optional<SkAutoCanvasRestore> auto_canvas_restore;
-  PrepareCanvasForDrawQuads(batched_tile_state_.contents_device_transform,
-                            draw_region, scissor_rect, &auto_canvas_restore);
-
-  SkFilterQuality filter_quality = batched_tile_state_.is_nearest_neighbor
-                                       ? kNone_SkFilterQuality
-                                       : kLow_SkFilterQuality;
-  current_canvas_->experimental_DrawImageSetV1(
-      &batched_tiles_.front(), batched_tiles_.size(), filter_quality,
-      batched_tile_state_.blend_mode);
-  current_canvas_->resetMatrix();
-  batched_tiles_.clear();
-}
-
 sk_sp<SkColorFilter> SkiaRenderer::GetColorFilter(const gfx::ColorSpace& src,
                                                   const gfx::ColorSpace& dst) {
   sk_sp<SkColorFilter>& color_filter = color_filter_cache_[dst][src];
@@ -1190,8 +1466,8 @@
 }
 
 void SkiaRenderer::FinishDrawingQuadList() {
-  if (!batched_tiles_.empty())
-    DrawBatchedTileQuads();
+  if (!batched_quads_.empty())
+    FlushBatchedQuads();
   switch (draw_mode_) {
     case DrawMode::DDL: {
       // Skia doesn't support releasing the last promise image ref on the DDL
diff --git a/components/viz/service/display/skia_renderer.h b/components/viz/service/display/skia_renderer.h
index dcbaeb4e..901bcac 100644
--- a/components/viz/service/display/skia_renderer.h
+++ b/components/viz/service/display/skia_renderer.h
@@ -89,6 +89,7 @@
   void GenerateMipmap() override;
 
  private:
+  struct DrawQuadParams;
   struct DrawRenderPassDrawQuadParams;
   class ScopedSkImageBuilder;
   class ScopedYUVSkImageBuilder;
@@ -96,11 +97,34 @@
   void ClearCanvas(SkColor color);
   void ClearFramebuffer();
 
+  // TODO(michaelludwig):
+  // The majority of quad types need to be updated to call the new experimental
+  // SkCanvas APIs, which changes what is needed for canvas prep. This is the
+  // old implementation of DoDrawQuad and types will be migrated individually
+  // to the new system and handled directly in the new DoDrawQuad definition,
+  // after which this function can be removed.
+  void DoSingleDrawQuad(const DrawQuad* quad, const gfx::QuadF* draw_region);
+
   void PrepareCanvasForDrawQuads(
       gfx::Transform contents_device_transform,
       const gfx::QuadF* draw_region,
       const gfx::Rect* scissor_rect,
       base::Optional<SkAutoCanvasRestore>* auto_canvas_restore);
+
+  DrawQuadParams CalculateDrawQuadParams(const DrawQuad* quad,
+                                         const gfx::QuadF* draw_region);
+
+  bool MustFlushBatchedQuads(const DrawQuad* new_quad,
+                             const DrawQuadParams& params);
+  void AddQuadToBatch(const DrawQuad* quad,
+                      const DrawQuadParams& params,
+                      sk_sp<SkImage> image,
+                      const gfx::RectF& tex_coords);
+  void FlushBatchedQuads();
+
+  // DebugBorder, Picture, RPDQ, and SolidColor quads cannot be batched. They
+  // either are not textures (debug, picture, solid color), or it's very likely
+  // the texture will have advanced paint effects (rpdq)
   void DrawDebugBorderQuad(const DebugBorderDrawQuad* quad, SkPaint* paint);
   void DrawPictureQuad(const PictureDrawQuad* quad, SkPaint* paint);
   void DrawRenderPassQuad(const RenderPassDrawQuad* quad, SkPaint* paint);
@@ -111,13 +135,7 @@
   void DrawSolidColorQuad(const SolidColorDrawQuad* quad, SkPaint* paint);
   void DrawTextureQuad(const TextureDrawQuad* quad, SkPaint* paint);
   void DrawStreamVideoQuad(const StreamVideoDrawQuad* quad, SkPaint* paint);
-  bool MustDrawBatchedTileQuads(const DrawQuad* new_quad,
-                                const gfx::Transform& content_device_transform,
-                                bool apply_transform_and_scissor,
-                                const gfx::QuadF* draw_region);
-  void AddTileQuadToBatch(const TileDrawQuad* quad,
-                          const gfx::QuadF* draw_region);
-  void DrawBatchedTileQuads();
+  void DrawTileDrawQuad(const TileDrawQuad* quad, const DrawQuadParams& params);
   void DrawYUVVideoQuad(const YUVVideoDrawQuad* quad, SkPaint* paint);
   void DrawUnsupportedQuad(const DrawQuad* quad, SkPaint* paint);
   bool CalculateRPDQParams(sk_sp<SkImage> src_image,
@@ -185,18 +203,22 @@
   gfx::Rect swap_buffer_rect_;
   std::vector<gfx::Rect> swap_content_bounds_;
 
-  // State common to all tile quads in a batch
-  struct BatchedTileState {
-    gfx::Transform contents_device_transform;
+  // State common to all quads in a batch. Draws that require an SkPaint not
+  // captured by this state cannot be batched.
+  struct BatchedQuadState {
     gfx::Rect scissor_rect;
-    gfx::QuadF draw_region;
     SkBlendMode blend_mode;
     bool is_nearest_neighbor;
     bool has_scissor_rect;
-    bool has_draw_region;
   };
-  BatchedTileState batched_tile_state_;
-  std::vector<SkCanvas::ImageSetEntry> batched_tiles_;
+  BatchedQuadState batched_quad_state_;
+  std::vector<SkCanvas::ImageSetEntry> batched_quads_;
+  // Same order as batched_quads_, but only includes draw regions for the
+  // entries that have fHasClip == true. Each draw region is 4 consecutive pts
+  std::vector<SkPoint> batched_draw_regions_;
+  // Each entry of batched_quads_ will have an index into this vector; multiple
+  // entries may point to the same matrix.
+  std::vector<SkMatrix> batched_cdt_matrices_;
 
   // Specific for SkDDL.
   SkiaOutputSurface* const skia_output_surface_ = nullptr;
diff --git a/content/browser/background_fetch/background_fetch_event_dispatcher.cc b/content/browser/background_fetch/background_fetch_event_dispatcher.cc
index 1b75c24..787da3be 100644
--- a/content/browser/background_fetch/background_fetch_event_dispatcher.cc
+++ b/content/browser/background_fetch/background_fetch_event_dispatcher.cc
@@ -324,17 +324,17 @@
     return;
 
   std::map<std::string, std::string> metadata = {
-      {"Event Type", EventTypeToString(event_type)}};
+      {"event type", EventTypeToString(event_type)}};
   if (failure_reason != blink::mojom::BackgroundFetchFailureReason::NONE) {
     std::stringstream stream;
     stream << failure_reason;
-    metadata["Failure Reason"] = stream.str();
+    metadata["failure reason"] = stream.str();
   }
 
   devtools_context_->LogBackgroundServiceEvent(
       registration_id.service_worker_registration_id(),
       registration_id.origin(), devtools::proto::BACKGROUND_FETCH,
-      /* event_name= */ "Background Fetch Completed",
+      /* event_name= */ "background fetch completed",
       /* instance_id= */ registration_id.developer_id(), metadata);
 }
 
diff --git a/content/browser/background_fetch/background_fetch_scheduler.cc b/content/browser/background_fetch/background_fetch_scheduler.cc
index a786b56..14db251d 100644
--- a/content/browser/background_fetch/background_fetch_scheduler.cc
+++ b/content/browser/background_fetch/background_fetch_scheduler.cc
@@ -345,8 +345,8 @@
   LogBackgroundFetchEventForDevTools(
       Event::kFetchRegistered, registration_id,
       /* request_info= */ nullptr,
-      {{"Total Requests", base::NumberToString(num_requests)},
-       {"Start Paused", start_paused ? "Yes" : "No"}});
+      {{"total requests", base::NumberToString(num_requests)},
+       {"start paused", start_paused ? "yes" : "no"}});
 
   registration_notifier_->NoteTotalRequests(registration_id.unique_id(),
                                             num_requests);
@@ -381,8 +381,8 @@
   LogBackgroundFetchEventForDevTools(
       Event::kFetchResumedOnStartup, registration_id,
       /* request_info= */ nullptr,
-      {{"Completed Requests", base::NumberToString(num_completed_requests)},
-       {"Active Requests",
+      {{"completed requests", base::NumberToString(num_completed_requests)},
+       {"active requests",
         base::NumberToString(active_fetch_requests.size())}});
 
   auto controller = CreateInitializedController(
@@ -515,24 +515,24 @@
   // any additional data to |metadata|.
   switch (event) {
     case Event::kFetchRegistered:
-      event_name = "Background Fetch registered";
+      event_name = "background fetch registered";
       break;
     case Event::kFetchResumedOnStartup:
-      event_name = "Background Fetch resuming after browser restart";
+      event_name = "background fetch resuming after browser restart";
       break;
     case Event::kFetchScheduled:
-      event_name = "Background Fetch started";
+      event_name = "background fetch started";
       break;
     case Event::kRequestStarted:
-      event_name = "Request processing started";
+      event_name = "request processing started";
       DCHECK(request_info);
       break;
     case Event::kRequestCompleted:
-      event_name = "Request processing completed";
+      event_name = "request processing completed";
       DCHECK(request_info);
-      metadata["Response Status"] =
+      metadata["response status"] =
           base::NumberToString(request_info->GetResponseCode());
-      metadata["Response Size (Bytes)"] =
+      metadata["response size (bytes)"] =
           base::NumberToString(request_info->GetResponseSize());
       break;
   }
@@ -541,10 +541,10 @@
 
   // Include common request metadata.
   if (request_info) {
-    metadata["URL"] = request_info->fetch_request()->url.spec();
-    metadata["Request Index"] = request_info->request_index();
+    metadata["url"] = request_info->fetch_request()->url.spec();
+    metadata["request index"] = request_info->request_index();
     if (request_info->request_body_size())
-      metadata["Upload Bytes"] = request_info->request_body_size();
+      metadata["upload size (bytes)"] = request_info->request_body_size();
   }
 
   devtools_context_->LogBackgroundServiceEvent(
diff --git a/content/browser/background_sync/background_sync_manager.cc b/content/browser/background_sync/background_sync_manager.cc
index 17e0aa198..eefacaf 100644
--- a/content/browser/background_sync/background_sync_manager.cc
+++ b/content/browser/background_sync/background_sync_manager.cc
@@ -811,7 +811,7 @@
       sync_type == blink::mojom::BackgroundSyncType::ONE_SHOT) {
     devtools_context_->LogBackgroundServiceEvent(
         sw_registration_id, origin, devtools::proto::BACKGROUND_SYNC,
-        /* event_name= */ "Registered Sync",
+        /* event_name= */ "registered sync",
         /* instance_id= */ sync_registration.options()->tag,
         /* event_metadata= */ {});
   }
@@ -875,10 +875,10 @@
     devtools_context_->LogBackgroundServiceEvent(
         active_version->registration_id(), active_version->script_origin(),
         devtools::proto::BACKGROUND_SYNC,
-        /* event_name= */ "Dispatched Sync Event",
+        /* event_name= */ "dispatched sync event",
         /* instance_id= */ tag,
         /* event_metadata= */
-        {{"Last Chance", last_chance ? "Yes" : "No"}});
+        {{"last chance", last_chance ? "yes" : "no"}});
   }
 }
 
@@ -1262,10 +1262,10 @@
             blink::mojom::BackgroundSyncType::ONE_SHOT) {
       devtools_context_->LogBackgroundServiceEvent(
           sw_registration->id(), origin, devtools::proto::BACKGROUND_SYNC,
-          /* event_name= */ "Sync Event Failed",
+          /* event_name= */ "sync event failed",
           /* instance_id= */ registration_info->tag,
           /* event_metadata= */
-          {{"Next Attempt Delay (ms)",
+          {{"next attempt delay (ms)",
             base::NumberToString(delay.InMilliseconds())}});
     }
   }
@@ -1279,10 +1279,10 @@
       bool succeded = status_code == blink::ServiceWorkerStatusCode::kOk;
       devtools_context_->LogBackgroundServiceEvent(
           sw_registration->id(), origin, devtools::proto::BACKGROUND_SYNC,
-          /* event_name= */ "Sync Complete",
+          /* event_name= */ "sync complete",
           /* instance_id= */ registration_info->tag,
           /* event_metadata= */
-          {{"Succeeded", succeded ? "Yes" : "No"}});
+          {{"succeeded", succeded ? "yes" : "no"}});
     }
   }
 
diff --git a/content/browser/browsing_data/storage_partition_code_cache_data_remover.cc b/content/browser/browsing_data/storage_partition_code_cache_data_remover.cc
index d2628191..973f8c1 100644
--- a/content/browser/browsing_data/storage_partition_code_cache_data_remover.cc
+++ b/content/browser/browsing_data/storage_partition_code_cache_data_remover.cc
@@ -107,7 +107,7 @@
 void StoragePartitionCodeCacheDataRemover::ClearJSCodeCache() {
   if (generated_code_cache_context_ &&
       generated_code_cache_context_->generated_js_code_cache()) {
-    net::CompletionCallback callback = base::BindRepeating(
+    net::CompletionOnceCallback callback = base::BindOnce(
         &StoragePartitionCodeCacheDataRemover::ClearWASMCodeCache,
         base::Unretained(this));
     generated_code_cache_context_->generated_js_code_cache()->GetBackend(
@@ -125,7 +125,7 @@
 void StoragePartitionCodeCacheDataRemover::ClearWASMCodeCache(int rv) {
   if (generated_code_cache_context_ &&
       generated_code_cache_context_->generated_wasm_code_cache()) {
-    net::CompletionCallback callback = base::BindRepeating(
+    net::CompletionOnceCallback callback = base::BindOnce(
         &StoragePartitionCodeCacheDataRemover::DoneClearCodeCache,
         base::Unretained(this));
     generated_code_cache_context_->generated_wasm_code_cache()->GetBackend(
diff --git a/content/browser/fileapi/file_system_url_loader_factory.cc b/content/browser/fileapi/file_system_url_loader_factory.cc
index 55e9a9ad..f7a7d52f 100644
--- a/content/browser/fileapi/file_system_url_loader_factory.cc
+++ b/content/browser/fileapi/file_system_url_loader_factory.cc
@@ -28,6 +28,7 @@
 #include "content/public/common/child_process_host.h"
 #include "mojo/public/cpp/bindings/binding_set.h"
 #include "mojo/public/cpp/system/string_data_pipe_producer.h"
+#include "net/base/completion_repeating_callback.h"
 #include "net/base/directory_listing.h"
 #include "net/base/io_buffer.h"
 #include "net/base/mime_sniffer.h"
@@ -510,7 +511,7 @@
       OnFileWritten(MOJO_RESULT_OK);
       return;
     }
-    net::CompletionCallback read_callback = base::BindRepeating(
+    net::CompletionRepeatingCallback read_callback = base::BindRepeating(
         &FileSystemFileURLLoader::DidReadMoreFileData, base::AsWeakPtr(this));
     const int rv =
         reader_->Read(file_data_.get(), bytes_to_read, read_callback);
diff --git a/content/browser/frame_host/navigation_handle_impl_unittest.cc b/content/browser/frame_host/navigation_handle_impl_unittest.cc
index 97954d8..b3ab8af 100644
--- a/content/browser/frame_host/navigation_handle_impl_unittest.cc
+++ b/content/browser/frame_host/navigation_handle_impl_unittest.cc
@@ -71,17 +71,17 @@
   }
 
   void TearDown() override {
-    // Release the |test_handle_| before destroying the WebContents, to match
+    // Release the |request_| before destroying the WebContents, to match
     // the WebContentsObserverSanityChecker expectations.
-    test_handle_.reset();
+    request_.reset();
     RenderViewHostImplTestHarness::TearDown();
   }
 
-  void Resume() { test_handle_->throttle_runner_.CallResumeForTesting(); }
+  void Resume() { test_handle()->throttle_runner_.CallResumeForTesting(); }
 
   void CancelDeferredNavigation(
       NavigationThrottle::ThrottleCheckResult result) {
-    test_handle_->CancelDeferredNavigationInternal(result);
+    test_handle()->CancelDeferredNavigationInternal(result);
   }
 
   // Helper function to call WillStartRequest on |handle|. If this function
@@ -93,7 +93,7 @@
 
     // It's safe to use base::Unretained since the NavigationHandle is owned by
     // the NavigationHandleImplTest.
-    test_handle_->WillStartRequest(
+    test_handle()->WillStartRequest(
         base::Bind(&NavigationHandleImplTest::UpdateThrottleCheckResult,
                    base::Unretained(this)));
   }
@@ -109,7 +109,7 @@
 
     // It's safe to use base::Unretained since the NavigationHandle is owned by
     // the NavigationHandleImplTest.
-    test_handle_->WillRedirectRequest(
+    test_handle()->WillRedirectRequest(
         GURL(), nullptr,
         base::Bind(&NavigationHandleImplTest::UpdateThrottleCheckResult,
                    base::Unretained(this)));
@@ -123,11 +123,11 @@
       const base::Optional<net::SSLInfo> ssl_info = base::nullopt) {
     was_callback_called_ = false;
     callback_result_ = NavigationThrottle::DEFER;
-    test_handle_->set_net_error_code(net_error_code);
+    test_handle()->set_net_error_code(net_error_code);
 
     // It's safe to use base::Unretained since the NavigationHandle is owned by
     // the NavigationHandleImplTest.
-    test_handle_->WillFailRequest(
+    test_handle()->WillFailRequest(
         base::Bind(&NavigationHandleImplTest::UpdateThrottleCheckResult,
                    base::Unretained(this)));
   }
@@ -145,13 +145,15 @@
     // by the NavigationHandleImplTest. The ConnectionInfo is different from
     // that sent to WillRedirectRequest to verify that it's correctly plumbed
     // in both cases.
-    test_handle_->WillProcessResponse(
+    test_handle()->WillProcessResponse(
         base::Bind(&NavigationHandleImplTest::UpdateThrottleCheckResult,
                    base::Unretained(this)));
   }
 
   // Returns the handle used in tests.
-  NavigationHandleImpl* test_handle() const { return test_handle_.get(); }
+  NavigationHandleImpl* test_handle() const {
+    return request_->navigation_handle();
+  }
 
   // Whether the callback was called.
   bool was_callback_called() const { return was_callback_called_; }
@@ -161,7 +163,7 @@
     return callback_result_;
   }
 
-  NavigationHandleImpl::State state() { return test_handle_->state(); }
+  NavigationHandleImpl::State state() { return test_handle()->state(); }
 
   bool is_deferring() {
     switch (state()) {
@@ -216,28 +218,13 @@
     return test_throttle;
   }
 
-  // Creates and register a NavigationThrottle that will delete the
-  // NavigationHandle in checks.
-  void AddDeletingNavigationThrottle() {
-    DCHECK(test_handle_);
-    test_handle()->RegisterThrottleForTesting(
-        std::make_unique<DeletingNavigationThrottle>(
-            test_handle(), base::BindRepeating(
-                               &NavigationHandleImplTest::ResetNavigationHandle,
-                               base::Unretained(this))));
-  }
-
   void CreateNavigationHandle() {
     scoped_refptr<FrameNavigationEntry> frame_entry(new FrameNavigationEntry());
     request_ = NavigationRequest::CreateBrowserInitiated(
         main_test_rfh()->frame_tree_node(), CommonNavigationParams(),
         CommitNavigationParams(), false /* browser-initiated */, std::string(),
         *frame_entry, nullptr, nullptr, nullptr);
-    test_handle_ = base::WrapUnique<NavigationHandleImpl>(
-        new NavigationHandleImpl(request_.get(), std::vector<GURL>(),
-                                 0,
-                                 nullptr,  // navigation_ui_data
-                                 net::HttpRequestHeaders(), Referrer()));
+    request_->CreateNavigationHandle(true);
   }
 
  private:
@@ -250,10 +237,7 @@
     was_callback_called_ = true;
   }
 
-  void ResetNavigationHandle() { test_handle_ = nullptr; }
-
   std::unique_ptr<NavigationRequest> request_;
-  std::unique_ptr<NavigationHandleImpl> test_handle_;
   bool was_callback_called_;
   NavigationThrottle::ThrottleCheckResult callback_result_;
 };
diff --git a/content/browser/site_per_process_browsertest.cc b/content/browser/site_per_process_browsertest.cc
index 50d5360..183e2de5 100644
--- a/content/browser/site_per_process_browsertest.cc
+++ b/content/browser/site_per_process_browsertest.cc
@@ -12567,8 +12567,10 @@
   const bool compositor_touch_action_enabled_;
 };
 
+// Flaky on every platform, failing most of the time on Android.
+// See https://crbug.com/945734
 IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTouchActionTest,
-                       EffectiveTouchActionPropagatesAcrossFrames) {
+                       DISABLED_EffectiveTouchActionPropagatesAcrossFrames) {
   GURL main_url(embedded_test_server()->GetURL(
       "a.com", "/cross_site_iframe_factory.html?a(b)"));
   EXPECT_TRUE(NavigateToURL(shell(), main_url));
diff --git a/content/child/runtime_features.cc b/content/child/runtime_features.cc
index 0693ea2..77d232a1 100644
--- a/content/child/runtime_features.cc
+++ b/content/child/runtime_features.cc
@@ -70,9 +70,6 @@
       base::FeatureList::IsEnabled(
           features::kBlinkHeapUnifiedGarbageCollection));
 
-  WebRuntimeFeatures::EnableBlinkHeapCollectLiveNonNodeWrappers(
-      base::FeatureList::IsEnabled(features::kCollectLiveNonNodeWrappers));
-
   if (base::FeatureList::IsEnabled(features::kBloatedRendererDetection))
     WebRuntimeFeatures::EnableBloatedRendererDetection(true);
 
diff --git a/content/public/browser/console_message.h b/content/public/browser/console_message.h
index 2bef8a1..4a14a5d 100644
--- a/content/public/browser/console_message.h
+++ b/content/public/browser/console_message.h
@@ -26,7 +26,7 @@
         source_url(source_url) {}
 
   // The type of source this came from. In practice, this maps to
-  // blink::MessageSource.
+  // blink::mojom::ConsoleMessageSource.
   const int source_identifier;
   // The severity of the console message.
   const blink::mojom::ConsoleMessageLevel message_level;
diff --git a/content/public/common/content_features.cc b/content/public/common/content_features.cc
index fda70f3..f6d81f5 100644
--- a/content/public/common/content_features.cc
+++ b/content/public/common/content_features.cc
@@ -108,11 +108,6 @@
 #endif
 };
 
-// When CollectLiveNonNodeWrappers is enabled, live non-Node wrappers that are
-// re-creatable will get collected by V8's minor garbage collector.
-const base::Feature kCollectLiveNonNodeWrappers{
-    "CollectLiveNonNodeWrappers", base::FEATURE_DISABLED_BY_DEFAULT};
-
 // Enables the compositing of fixed position content that is opaque and can
 // preserve LCD text.
 const base::Feature kCompositeOpaqueFixedPosition{
@@ -424,7 +419,7 @@
 // Keep processes with service workers controlling clients from other
 // processes at foreground priority. (crbug.com/928904)
 const base::Feature kServiceWorkerForegroundPriority{
-    "ServiceWorkerForegroundPriority", base::FEATURE_DISABLED_BY_DEFAULT};
+    "ServiceWorkerForegroundPriority", base::FEATURE_ENABLED_BY_DEFAULT};
 
 // Enables long running message dispatch for service workers.
 // This is a temporary addition only to be used for the Android Messages
diff --git a/content/public/common/content_features.h b/content/public/common/content_features.h
index 212ced4..21b92de 100644
--- a/content/public/common/content_features.h
+++ b/content/public/common/content_features.h
@@ -35,7 +35,6 @@
 CONTENT_EXPORT extern const base::Feature kBrotliEncoding;
 CONTENT_EXPORT extern const base::Feature kCacheInlineScriptCode;
 CONTENT_EXPORT extern const base::Feature kCanvas2DImageChromium;
-CONTENT_EXPORT extern const base::Feature kCollectLiveNonNodeWrappers;
 CONTENT_EXPORT extern const base::Feature kCompositeOpaqueFixedPosition;
 CONTENT_EXPORT extern const base::Feature kCompositeOpaqueScrollers;
 CONTENT_EXPORT extern const base::Feature kCrashReporting;
diff --git a/content/public/renderer/content_renderer_client.h b/content/public/renderer/content_renderer_client.h
index 001fa640..a7413c4 100644
--- a/content/public/renderer/content_renderer_client.h
+++ b/content/public/renderer/content_renderer_client.h
@@ -399,7 +399,7 @@
   // Returns true to suppress the warning for deprecated TLS versions.
   //
   // This is a workaround for an outdated test server used by Blink tests on
-  // macOS. See https://crbug.com/905831.
+  // macOS. See https://crbug.com/936515.
   virtual bool SuppressLegacyTLSVersionConsoleMessage();
 
   // Asks the embedder to bind |service_request| to its renderer-side service
diff --git a/content/public/renderer/render_frame_observer.h b/content/public/renderer/render_frame_observer.h
index c9ce48e..16728ff 100644
--- a/content/public/renderer/render_frame_observer.h
+++ b/content/public/renderer/render_frame_observer.h
@@ -102,9 +102,6 @@
   // These match the Blink API notifications
   virtual void DidCreateNewDocument() {}
   virtual void DidCreateDocumentElement() {}
-  // Called when a provisional load is about to commit in a frame. This is
-  // dispatched just before the Javascript unload event.
-  virtual void WillCommitProvisionalLoad() {}
   // TODO(dgozman): replace next two methods with DidFinishNavigation.
   virtual void DidCommitProvisionalLoad(bool is_same_document_navigation,
                                         ui::PageTransition transition) {}
diff --git a/content/public/test/browser_test_utils.cc b/content/public/test/browser_test_utils.cc
index c2ebfd7..01f9676 100644
--- a/content/public/test/browser_test_utils.cc
+++ b/content/public/test/browser_test_utils.cc
@@ -90,6 +90,7 @@
 #include "content/test/accessibility_browser_test_utils.h"
 #include "content/test/did_commit_navigation_interceptor.h"
 #include "ipc/ipc_security_test_util.h"
+#include "net/base/completion_once_callback.h"
 #include "net/base/filename_util.h"
 #include "net/base/io_buffer.h"
 #include "net/cookies/canonical_cookie.h"
@@ -504,9 +505,9 @@
       std::move(source_stream), net::SourceStream::TYPE_GZIP);
   scoped_refptr<net::IOBufferWithSize> dest_buffer =
       base::MakeRefCounted<net::IOBufferWithSize>(4096);
-  net::CompletionCallback callback;
   while (true) {
-    int rv = filter->Read(dest_buffer.get(), dest_buffer->size(), callback);
+    int rv = filter->Read(dest_buffer.get(), dest_buffer->size(),
+                          net::CompletionOnceCallback());
     ASSERT_LE(0, rv);
     if (rv <= 0)
       break;
diff --git a/content/renderer/loader/web_url_loader_impl.cc b/content/renderer/loader/web_url_loader_impl.cc
index 96f06d22..56e8a2da 100644
--- a/content/renderer/loader/web_url_loader_impl.cc
+++ b/content/renderer/loader/web_url_loader_impl.cc
@@ -1333,6 +1333,10 @@
   context_->DidChangePriority(new_priority, intra_priority_value);
 }
 
+scoped_refptr<base::SingleThreadTaskRunner> WebURLLoaderImpl::GetTaskRunner() {
+  return context_->task_runner();
+}
+
 // static
 // We have this function at the bottom of this file because it confuses
 // syntax highliting.
diff --git a/content/renderer/loader/web_url_loader_impl.h b/content/renderer/loader/web_url_loader_impl.h
index b8c1504..ad2cda7 100644
--- a/content/renderer/loader/web_url_loader_impl.h
+++ b/content/renderer/loader/web_url_loader_impl.h
@@ -90,6 +90,8 @@
   void SetDefersLoading(bool value) override;
   void DidChangePriority(blink::WebURLRequest::Priority new_priority,
                          int intra_priority_value) override;
+  scoped_refptr<base::SingleThreadTaskRunner> GetTaskRunner() override;
+
  private:
   class Context;
   class RequestPeerImpl;
diff --git a/content/renderer/media/stream/user_media_client_impl.cc b/content/renderer/media/stream/user_media_client_impl.cc
index c134178b..5f2a9af 100644
--- a/content/renderer/media/stream/user_media_client_impl.cc
+++ b/content/renderer/media/stream/user_media_client_impl.cc
@@ -136,7 +136,7 @@
   // Force-close all outstanding user media requests and local sources here,
   // before the outstanding WeakPtrs are invalidated, to ensure a clean
   // shutdown.
-  WillCommitProvisionalLoad();
+  DeleteAllUserMediaRequests();
 }
 
 void UserMediaClientImpl::RequestUserMedia(
@@ -292,7 +292,8 @@
   pending_request_infos_.clear();
 }
 
-void UserMediaClientImpl::WillCommitProvisionalLoad() {
+void UserMediaClientImpl::ReadyToCommitNavigation(
+    blink::WebDocumentLoader* document_loader) {
   DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
   // Cancel all outstanding UserMediaRequests.
   DeleteAllUserMediaRequests();
diff --git a/content/renderer/media/stream/user_media_client_impl.h b/content/renderer/media/stream/user_media_client_impl.h
index b325c56..7c170a2 100644
--- a/content/renderer/media/stream/user_media_client_impl.h
+++ b/content/renderer/media/stream/user_media_client_impl.h
@@ -62,7 +62,8 @@
   bool IsCapturing() override;
 
   // RenderFrameObserver override
-  void WillCommitProvisionalLoad() override;
+  void ReadyToCommitNavigation(
+      blink::WebDocumentLoader* document_loader) override;
 
   void SetMediaDevicesDispatcherForTesting(
       blink::mojom::MediaDevicesDispatcherHostPtr media_devices_dispatcher);
diff --git a/content/renderer/media/stream/user_media_client_impl_unittest.cc b/content/renderer/media/stream/user_media_client_impl_unittest.cc
index 864e154..ceb994f 100644
--- a/content/renderer/media/stream/user_media_client_impl_unittest.cc
+++ b/content/renderer/media/stream/user_media_client_impl_unittest.cc
@@ -497,7 +497,7 @@
   }
 
   void LoadNewDocumentInFrame() {
-    user_media_client_impl_->WillCommitProvisionalLoad();
+    user_media_client_impl_->ReadyToCommitNavigation(nullptr);
     base::RunLoop().RunUntilIdle();
   }
 
diff --git a/content/renderer/render_frame_impl.cc b/content/renderer/render_frame_impl.cc
index 367821a..e632c9e4 100644
--- a/content/renderer/render_frame_impl.cc
+++ b/content/renderer/render_frame_impl.cc
@@ -4355,11 +4355,6 @@
   Send(new FrameHostMsg_FrameFocused(routing_id_));
 }
 
-void RenderFrameImpl::WillCommitProvisionalLoad() {
-  for (auto& observer : observers_)
-    observer.WillCommitProvisionalLoad();
-}
-
 void RenderFrameImpl::DidChangeName(const blink::WebString& name) {
   if (current_history_item_.IsNull()) {
     // Once a navigation has committed, the unique name must no longer change to
@@ -5409,7 +5404,7 @@
 
   // Allow the embedded to suppress these warnings. This is a workaround for an
   // outdated test server used by Blink tests on macOS. See
-  // https://crbug.com/905831.
+  // https://crbug.com/936515.
   if (GetContentClient()
           ->renderer()
           ->SuppressLegacyTLSVersionConsoleMessage()) {
diff --git a/content/renderer/render_frame_impl.h b/content/renderer/render_frame_impl.h
index aa9a1a53..084a836 100644
--- a/content/renderer/render_frame_impl.h
+++ b/content/renderer/render_frame_impl.h
@@ -705,7 +705,6 @@
   void DidChangeOpener(blink::WebFrame* frame) override;
   void FrameDetached(DetachType type) override;
   void FrameFocused() override;
-  void WillCommitProvisionalLoad() override;
   void DidChangeName(const blink::WebString& name) override;
   void DidEnforceInsecureRequestPolicy(
       blink::WebInsecureRequestPolicy policy) override;
diff --git a/content/renderer/render_frame_impl_browsertest.cc b/content/renderer/render_frame_impl_browsertest.cc
index a4bb697..9798309 100644
--- a/content/renderer/render_frame_impl_browsertest.cc
+++ b/content/renderer/render_frame_impl_browsertest.cc
@@ -786,8 +786,8 @@
 constexpr char kFrameEventDidCreateNewDocument[] = "did-create-new-document";
 constexpr char kFrameEventDidCreateDocumentElement[] =
     "did-create-document-element";
-constexpr char kFrameEventWillCommitProvisionalLoad[] =
-    "will-commit-provisional-load";
+constexpr char kFrameEventReadyToCommitNavigation[] =
+    "ready-to-commit-navigation";
 constexpr char kFrameEventDidCommitProvisionalLoad[] =
     "did-commit-provisional-load";
 constexpr char kFrameEventDidCommitSameDocumentLoad[] =
@@ -929,8 +929,8 @@
     RequestTestInterfaceOnFrameEvent(kFrameEventDidCreateNewDocument);
   }
 
-  void WillCommitProvisionalLoad() override {
-    RequestTestInterfaceOnFrameEvent(kFrameEventWillCommitProvisionalLoad);
+  void ReadyToCommitNavigation(blink::WebDocumentLoader* loader) override {
+    RequestTestInterfaceOnFrameEvent(kFrameEventReadyToCommitNavigation);
   }
 
   void DidCommitProvisionalLoad(bool is_same_document_navigation,
@@ -1224,7 +1224,7 @@
         {{GURL(kNoDocumentMarkerURL), kFrameEventDidCreateNewFrame},
          {initial_empty_url, kFrameEventDidCreateNewDocument},
          {initial_empty_url, kFrameEventDidCreateDocumentElement},
-         {initial_empty_url, kFrameEventWillCommitProvisionalLoad},
+         {initial_empty_url, kFrameEventReadyToCommitNavigation},
          // TODO(https://crbug.com/555773): It seems strange that the new
          // document is created and DidCreateNewDocument is invoked *before* the
          // provisional load would have even committed.
@@ -1289,7 +1289,7 @@
         main_frame_exerciser
             .document_interface_broker_request_for_initial_empty_document(),
         {{initial_empty_url, kFrameEventDidCreateNewFrame},
-         {initial_empty_url, kFrameEventWillCommitProvisionalLoad},
+         {initial_empty_url, kFrameEventReadyToCommitNavigation},
          {new_window_url, kFrameEventDidCreateNewDocument}});
     ExpectPendingInterfaceRequestsFromSources(
         main_frame_exerciser.interface_request_for_first_document(),
@@ -1347,7 +1347,7 @@
       {{GURL(kNoDocumentMarkerURL), kFrameEventDidCreateNewFrame},
        {initial_empty_url, kFrameEventDidCreateNewDocument},
        {initial_empty_url, kFrameEventDidCreateDocumentElement},
-       {initial_empty_url, kFrameEventWillCommitProvisionalLoad},
+       {initial_empty_url, kFrameEventReadyToCommitNavigation},
        {child_frame_url, kFrameEventDidCreateNewDocument},
        {child_frame_url, kFrameEventDidCommitProvisionalLoad},
        {child_frame_url, kFrameEventDidCreateDocumentElement}});
@@ -1393,7 +1393,7 @@
       std::move(interface_provider_request_for_first_document),
       std::move(document_interface_broker_request_for_first_document),
       {{GURL(kTestFirstURL), kFrameEventAfterCommit},
-       {GURL(kTestFirstURL), kFrameEventWillCommitProvisionalLoad},
+       {GURL(kTestFirstURL), kFrameEventReadyToCommitNavigation},
        {GURL(kTestSecondURL), kFrameEventDidCreateNewDocument}});
 
   ASSERT_TRUE(interface_provider_request_for_second_document.is_pending());
diff --git a/content/shell/app/shell_main_delegate.cc b/content/shell/app/shell_main_delegate.cc
index 78827f5e..bacb75f 100644
--- a/content/shell/app/shell_main_delegate.cc
+++ b/content/shell/app/shell_main_delegate.cc
@@ -267,6 +267,7 @@
 
     command_line.AppendSwitchASCII(network::switches::kHostResolverRules,
                                    "MAP nonexistent.*.test ~NOTFOUND,"
+                                   "MAP *.test. 127.0.0.1,"
                                    "MAP *.test 127.0.0.1");
 
     command_line.AppendSwitch(switches::kEnablePartialRaster);
diff --git a/content/shell/browser/web_test/scoped_android_configuration.cc b/content/shell/browser/web_test/scoped_android_configuration.cc
index 499d9b7..ec1b9722 100644
--- a/content/shell/browser/web_test/scoped_android_configuration.cc
+++ b/content/shell/browser/web_test/scoped_android_configuration.cc
@@ -11,6 +11,7 @@
 #include "base/android/jni_android.h"
 #include "base/android/jni_string.h"
 #include "base/bind.h"
+#include "base/callback_helpers.h"
 #include "base/command_line.h"
 #include "base/files/file_path.h"
 #include "base/message_loop/message_loop.h"
@@ -25,6 +26,8 @@
 #include "content/shell/browser/web_test/blink_test_controller.h"
 #include "content/shell/common/shell_switches.h"
 #include "content/shell/common/web_test/web_test_switches.h"
+#include "net/base/completion_once_callback.h"
+#include "net/base/completion_repeating_callback.h"
 #include "net/base/ip_address.h"
 #include "net/base/ip_endpoint.h"
 #include "net/base/net_errors.h"
@@ -38,15 +41,15 @@
 
 namespace {
 
-void ConnectCompleted(const base::Closure& socket_connected, int rv) {
+void ConnectCompleted(base::OnceClosure socket_connected, int rv) {
   LOG_IF(FATAL, net::OK != rv)
       << " Failed to redirect to socket: " << net::ErrorToString(rv);
-  socket_connected.Run();
+  std::move(socket_connected).Run();
 }
 
 void CreateAndConnectSocket(
     uint16_t port,
-    const base::Callback<void(std::unique_ptr<net::SocketPosix>)>&
+    base::OnceCallback<void(std::unique_ptr<net::SocketPosix>)>
         socket_connected) {
   net::SockaddrStorage storage;
   net::IPAddress address;
@@ -72,9 +75,11 @@
   }
 
   net::SocketPosix* socket_ptr = socket.get();
-  net::CompletionCallback connect_completed =
-      base::Bind(&ConnectCompleted,
-                 base::Bind(socket_connected, base::Passed(std::move(socket))));
+  net::CompletionRepeatingCallback connect_completed =
+      base::AdaptCallbackForRepeating(base::BindOnce(
+          &ConnectCompleted,
+          base::BindOnce(std::move(socket_connected), std::move(socket))));
+
   result = socket_ptr->Connect(storage, connect_completed);
   if (result != net::ERR_IO_PENDING) {
     connect_completed.Run(result);
@@ -118,7 +123,7 @@
   base::PostTaskWithTraits(
       FROM_HERE, {BrowserThread::IO},
       base::BindOnce(&CreateAndConnectSocket, port,
-                     base::Bind(finish_redirection, &redirected)));
+                     base::BindOnce(finish_redirection, &redirected)));
   base::ScopedAllowBaseSyncPrimitivesForTesting allow_wait;
   while (!redirected.IsSignaled())
     redirected.Wait();
diff --git a/content/shell/browser/web_test/web_test_message_filter.cc b/content/shell/browser/web_test/web_test_message_filter.cc
index ffaf0764..954914d7 100644
--- a/content/shell/browser/web_test/web_test_message_filter.cc
+++ b/content/shell/browser/web_test/web_test_message_filter.cc
@@ -24,6 +24,7 @@
 #include "content/shell/common/web_test/web_test_messages.h"
 #include "content/shell/test_runner/web_test_delegate.h"
 #include "content/test/mock_platform_notification_service.h"
+#include "net/base/completion_once_callback.h"
 #include "net/base/net_errors.h"
 #include "storage/browser/database/database_tracker.h"
 #include "storage/browser/fileapi/isolated_context.h"
@@ -124,7 +125,7 @@
 void WebTestMessageFilter::OnClearAllDatabases() {
   DCHECK(database_tracker_->task_runner()->RunsTasksInCurrentSequence());
   database_tracker_->DeleteDataModifiedSince(base::Time(),
-                                             net::CompletionCallback());
+                                             net::CompletionOnceCallback());
 }
 
 void WebTestMessageFilter::OnSetDatabaseQuota(int quota) {
diff --git a/content/shell/renderer/web_test/web_test_content_renderer_client.cc b/content/shell/renderer/web_test/web_test_content_renderer_client.cc
index ee210da..a7a69757 100644
--- a/content/shell/renderer/web_test/web_test_content_renderer_client.cc
+++ b/content/shell/renderer/web_test/web_test_content_renderer_client.cc
@@ -129,7 +129,7 @@
 bool WebTestContentRendererClient::SuppressLegacyTLSVersionConsoleMessage() {
 #if defined(OS_MACOSX)
   // Blink uses an outdated test server on older versions of macOS. Until those
-  // are fixed, suppress the warning. See https://crbug.com/905831.
+  // are fixed, suppress the warning. See https://crbug.com/936515.
   return true;
 #else
   return false;
diff --git a/content/shell/test_runner/web_frame_test_client.cc b/content/shell/test_runner/web_frame_test_client.cc
index 1c4ab83..3adfc50 100644
--- a/content/shell/test_runner/web_frame_test_client.cc
+++ b/content/shell/test_runner/web_frame_test_client.cc
@@ -84,7 +84,8 @@
 }
 
 bool IsTestHost(const std::string& host) {
-  return base::EndsWith(host, ".test", base::CompareCase::INSENSITIVE_ASCII);
+  return base::EndsWith(host, ".test", base::CompareCase::INSENSITIVE_ASCII) ||
+         base::EndsWith(host, ".test.", base::CompareCase::INSENSITIVE_ASCII);
 }
 
 bool HostIsUsedBySomeTestsToGenerateError(const std::string& host) {
diff --git a/device/bluetooth/bluetooth_socket_net.cc b/device/bluetooth/bluetooth_socket_net.cc
index 8b01783e..3da7b0e 100644
--- a/device/bluetooth/bluetooth_socket_net.cc
+++ b/device/bluetooth/bluetooth_socket_net.cc
@@ -17,7 +17,7 @@
 #include "base/threading/scoped_blocking_call.h"
 #include "device/bluetooth/bluetooth_socket.h"
 #include "device/bluetooth/bluetooth_socket_thread.h"
-#include "net/base/completion_callback.h"
+#include "net/base/completion_repeating_callback.h"
 #include "net/base/io_buffer.h"
 #include "net/base/net_errors.h"
 #include "net/log/net_log_source.h"
@@ -240,11 +240,9 @@
     return;
 
   WriteRequest* request = write_queue_.front().get();
-  net::CompletionCallback callback =
-      base::Bind(&BluetoothSocketNet::OnSocketWriteComplete,
-                 this,
-                 request->success_callback,
-                 request->error_callback);
+  net::CompletionRepeatingCallback callback =
+      base::BindRepeating(&BluetoothSocketNet::OnSocketWriteComplete, this,
+                          request->success_callback, request->error_callback);
   net::NetworkTrafficAnnotationTag traffic_annotation =
       net::DefineNetworkTrafficAnnotation("bluetooth_socket", R"(
         semantics {
diff --git a/extensions/browser/api/web_request/web_request_proxying_url_loader_factory.cc b/extensions/browser/api/web_request/web_request_proxying_url_loader_factory.cc
index b5b01c7..cb617f9a 100644
--- a/extensions/browser/api/web_request/web_request_proxying_url_loader_factory.cc
+++ b/extensions/browser/api/web_request/web_request_proxying_url_loader_factory.cc
@@ -8,6 +8,7 @@
 #include <utility>
 
 #include "base/bind.h"
+#include "base/callback_helpers.h"
 #include "base/feature_list.h"
 #include "base/strings/stringprintf.h"
 #include "base/task/post_task.h"
@@ -17,6 +18,7 @@
 #include "content/public/common/url_utils.h"
 #include "extensions/browser/extension_navigation_ui_data.h"
 #include "extensions/common/manifest_handlers/web_accessible_resources_info.h"
+#include "net/base/completion_repeating_callback.h"
 #include "net/http/http_util.h"
 #include "services/network/public/cpp/features.h"
 #include "third_party/blink/public/platform/resource_request_blocked_reason.h"
@@ -204,8 +206,8 @@
   } else {
     current_response_ = head;
     HandleResponseOrRedirectHeaders(
-        base::BindRepeating(&InProgressRequest::ContinueToResponseStarted,
-                            weak_factory_.GetWeakPtr()));
+        base::BindOnce(&InProgressRequest::ContinueToResponseStarted,
+                       weak_factory_.GetWeakPtr()));
   }
 }
 
@@ -229,8 +231,8 @@
   } else {
     current_response_ = head;
     HandleResponseOrRedirectHeaders(
-        base::BindRepeating(&InProgressRequest::ContinueToBeforeRedirect,
-                            weak_factory_.GetWeakPtr(), redirect_info));
+        base::BindOnce(&InProgressRequest::ContinueToBeforeRedirect,
+                       weak_factory_.GetWeakPtr(), redirect_info));
   }
 }
 
@@ -290,9 +292,9 @@
   }
   // We first need to simulate |onHeadersReceived| for the response headers
   // which indicated a need to authenticate.
-  HandleResponseOrRedirectHeaders(base::BindRepeating(base::BindRepeating(
+  HandleResponseOrRedirectHeaders(base::BindOnce(
       &InProgressRequest::ContinueAuthRequest, weak_factory_.GetWeakPtr(),
-      base::RetainedRef(auth_info), base::Passed(&callback))));
+      base::RetainedRef(auth_info), std::move(callback)));
 }
 
 void WebRequestProxyingURLLoaderFactory::InProgressRequest::OnLoaderCreated(
@@ -325,8 +327,8 @@
   current_response_.headers =
       base::MakeRefCounted<net::HttpResponseHeaders>(headers);
   HandleResponseOrRedirectHeaders(
-      base::BindRepeating(&InProgressRequest::ContinueToHandleOverrideHeaders,
-                          weak_factory_.GetWeakPtr()));
+      base::BindOnce(&InProgressRequest::ContinueToHandleOverrideHeaders,
+                     weak_factory_.GetWeakPtr()));
 }
 
 void WebRequestProxyingURLLoaderFactory::InProgressRequest::
@@ -688,16 +690,18 @@
 }
 
 void WebRequestProxyingURLLoaderFactory::InProgressRequest::
-    HandleResponseOrRedirectHeaders(
-        const net::CompletionCallback& continuation) {
+    HandleResponseOrRedirectHeaders(net::CompletionOnceCallback continuation) {
   override_headers_ = nullptr;
   redirect_url_ = GURL();
+
+  net::CompletionRepeatingCallback copyable_callback =
+      base::AdaptCallbackForRepeating(std::move(continuation));
   if (request_.url.SchemeIsHTTPOrHTTPS()) {
     int result =
         ExtensionWebRequestEventRouter::GetInstance()->OnHeadersReceived(
             factory_->browser_context_, factory_->info_map_, &info_.value(),
-            continuation, current_response_.headers.get(), &override_headers_,
-            &redirect_url_);
+            copyable_callback, current_response_.headers.get(),
+            &override_headers_, &redirect_url_);
     if (result == net::ERR_BLOCKED_BY_CLIENT) {
       OnRequestError(network::URLLoaderCompletionStatus(result));
       return;
@@ -716,7 +720,7 @@
     DCHECK_EQ(net::OK, result);
   }
 
-  continuation.Run(net::OK);
+  copyable_callback.Run(net::OK);
 }
 void WebRequestProxyingURLLoaderFactory::InProgressRequest::OnRequestError(
     const network::URLLoaderCompletionStatus& status) {
diff --git a/extensions/browser/api/web_request/web_request_proxying_url_loader_factory.h b/extensions/browser/api/web_request/web_request_proxying_url_loader_factory.h
index 486c8bf..278921bc 100644
--- a/extensions/browser/api/web_request/web_request_proxying_url_loader_factory.h
+++ b/extensions/browser/api/web_request/web_request_proxying_url_loader_factory.h
@@ -18,7 +18,7 @@
 #include "extensions/browser/api/web_request/web_request_info.h"
 #include "mojo/public/cpp/bindings/binding.h"
 #include "mojo/public/cpp/bindings/binding_set.h"
-#include "net/base/completion_callback.h"
+#include "net/base/completion_once_callback.h"
 #include "net/traffic_annotation/network_traffic_annotation.h"
 #include "services/network/public/cpp/resource_request.h"
 #include "services/network/public/cpp/resource_response.h"
@@ -117,7 +117,7 @@
     void ContinueToBeforeRedirect(const net::RedirectInfo& redirect_info,
                                   int error_code);
     void HandleResponseOrRedirectHeaders(
-        const net::CompletionCallback& continuation);
+        net::CompletionOnceCallback continuation);
     void OnRequestError(const network::URLLoaderCompletionStatus& status);
     bool IsRedirectSafe(const GURL& from_url, const GURL& to_url);
     void HandleBeforeRequestRedirect();
diff --git a/google_apis/drive/base_requests.cc b/google_apis/drive/base_requests.cc
index 4f8d2dc..4c3de77 100644
--- a/google_apis/drive/base_requests.cc
+++ b/google_apis/drive/base_requests.cc
@@ -135,8 +135,8 @@
   const char kErrorReasonResponseTooLarge[] = "responseTooLarge";
 
   std::unique_ptr<const base::Value> value(google_apis::ParseJson(error_body));
-  const base::DictionaryValue* dictionary = NULL;
-  const base::DictionaryValue* error = NULL;
+  const base::DictionaryValue* dictionary = nullptr;
+  const base::DictionaryValue* error = nullptr;
   if (value &&
       value->GetAsDictionary(&dictionary) &&
       dictionary->GetDictionaryWithoutPathExpansion(kErrorKey, &error)) {
@@ -146,8 +146,8 @@
     DLOG(ERROR) << "code: " << code << ", message: " << message;
 
     // Override the error code based on the reason of the first error.
-    const base::ListValue* errors = NULL;
-    const base::DictionaryValue* first_error = NULL;
+    const base::ListValue* errors = nullptr;
+    const base::DictionaryValue* first_error = nullptr;
     if (error->GetListWithoutPathExpansion(kErrorErrorsKey, &errors) &&
         errors->GetDictionary(0, &first_error)) {
       std::string reason;
diff --git a/google_apis/drive/base_requests_unittest.cc b/google_apis/drive/base_requests_unittest.cc
index 36534ae..2ff0eb9e 100644
--- a/google_apis/drive/base_requests_unittest.cc
+++ b/google_apis/drive/base_requests_unittest.cc
@@ -190,7 +190,7 @@
 TEST_F(BaseRequestsTest, ParseValidJson) {
   std::unique_ptr<base::Value> json(ParseJson(kValidJsonString));
 
-  base::DictionaryValue* root_dict = NULL;
+  base::DictionaryValue* root_dict = nullptr;
   ASSERT_TRUE(json);
   ASSERT_TRUE(json->GetAsDictionary(&root_dict));
 
diff --git a/google_apis/drive/drive_api_parser.cc b/google_apis/drive/drive_api_parser.cc
index ea051097..ad74e40 100644
--- a/google_apis/drive/drive_api_parser.cc
+++ b/google_apis/drive/drive_api_parser.cc
@@ -49,14 +49,14 @@
   DCHECK(value);
   DCHECK(result);
 
-  const base::ListValue* list_value = NULL;
+  const base::ListValue* list_value = nullptr;
   if (!value->GetAsList(&list_value))
     return false;
 
   base::JSONValueConverter<ParentReference> converter;
   result->resize(list_value->GetSize());
   for (size_t i = 0; i < list_value->GetSize(); ++i) {
-    const base::Value* parent_value = NULL;
+    const base::Value* parent_value = nullptr;
     if (!list_value->Get(i, &parent_value) ||
         !converter.Convert(*parent_value, &(*result)[i]))
       return false;
@@ -218,7 +218,7 @@
 // |kind| property which denotes the type of the structure (e.g. "drive#file").
 bool IsResourceKindExpected(const base::Value& value,
                             const std::string& expected_kind) {
-  const base::DictionaryValue* as_dict = NULL;
+  const base::DictionaryValue* as_dict = nullptr;
   std::string kind;
   return value.GetAsDictionary(&as_dict) &&
       as_dict->HasKey(kKind) &&
diff --git a/google_apis/drive/request_sender_unittest.cc b/google_apis/drive/request_sender_unittest.cc
index 38400884..67032a3 100644
--- a/google_apis/drive/request_sender_unittest.cc
+++ b/google_apis/drive/request_sender_unittest.cc
@@ -62,8 +62,8 @@
   RequestSenderTest()
       : auth_service_(new TestAuthService),
         request_sender_(base::WrapUnique(auth_service_),
-                        NULL,
-                        NULL,
+                        nullptr,
+                        nullptr,
                         "dummy-user-agent",
                         TRAFFIC_ANNOTATION_FOR_TESTS) {
     auth_service_->set_refresh_token(kTestRefreshToken);
diff --git a/google_apis/drive/test_util.cc b/google_apis/drive/test_util.cc
index 3d95506..081b560 100644
--- a/google_apis/drive/test_util.cc
+++ b/google_apis/drive/test_util.cc
@@ -81,7 +81,8 @@
 
   std::string error;
   JSONFileValueDeserializer deserializer(path);
-  std::unique_ptr<base::Value> value = deserializer.Deserialize(NULL, &error);
+  std::unique_ptr<base::Value> value =
+      deserializer.Deserialize(nullptr, &error);
   LOG_IF(WARNING, !value.get()) << "Failed to parse " << path.value()
                                 << ": " << error;
   return value;
diff --git a/google_apis/gaia/fake_gaia.cc b/google_apis/gaia/fake_gaia.cc
index 34e3ffb..986605d 100644
--- a/google_apis/gaia/fake_gaia.cc
+++ b/google_apis/gaia/fake_gaia.cc
@@ -384,7 +384,7 @@
     const std::string& client_id,
     const std::string& scope_string) const {
   if (auth_token.empty() || client_id.empty())
-    return NULL;
+    return nullptr;
 
   std::vector<std::string> scope_list = base::SplitString(
       scope_string, " ", base::TRIM_WHITESPACE, base::SPLIT_WANT_ALL);
@@ -401,7 +401,7 @@
     }
   }
 
-  return NULL;
+  return nullptr;
 }
 
 const FakeGaia::AccessTokenInfo* FakeGaia::GetAccessTokenInfo(
@@ -414,7 +414,7 @@
       return &(entry->second);
   }
 
-  return NULL;
+  return nullptr;
 }
 
 void FakeGaia::HandleServiceLogin(const HttpRequest& request,
@@ -665,7 +665,7 @@
 
 void FakeGaia::HandleTokenInfo(const HttpRequest& request,
                                BasicHttpResponse* http_response) {
-  const AccessTokenInfo* token_info = NULL;
+  const AccessTokenInfo* token_info = nullptr;
   std::string access_token;
   if (GetQueryParameter(request.content, "access_token", &access_token))
     token_info = GetAccessTokenInfo(access_token);
@@ -730,7 +730,7 @@
 void FakeGaia::HandleOAuthUserInfo(
     const net::test_server::HttpRequest& request,
     net::test_server::BasicHttpResponse* http_response) {
-  const AccessTokenInfo* token_info = NULL;
+  const AccessTokenInfo* token_info = nullptr;
   std::string access_token;
   if (GetAccessToken(request, kAuthHeaderBearer, &access_token) ||
       GetAccessToken(request, kAuthHeaderOAuth, &access_token)) {
diff --git a/google_apis/gaia/gaia_auth_util.cc b/google_apis/gaia/gaia_auth_util.cc
index f4ef70e..b584dd3a 100644
--- a/google_apis/gaia/gaia_auth_util.cc
+++ b/google_apis/gaia/gaia_auth_util.cc
@@ -140,7 +140,7 @@
   // account in the list is the primary account.
   for (size_t i = 0; i < account_list->GetSize(); ++i) {
     base::ListValue* account;
-    if (account_list->GetList(i, &account) && account != NULL) {
+    if (account_list->GetList(i, &account) && account != nullptr) {
       std::string email;
       // Canonicalize the email since ListAccounts returns "display email".
       if (account->GetString(3, &email) && !email.empty()) {
diff --git a/google_apis/gaia/gaia_oauth_client.cc b/google_apis/gaia/gaia_oauth_client.cc
index 410580a..fb38b4d2 100644
--- a/google_apis/gaia/gaia_oauth_client.cc
+++ b/google_apis/gaia/gaia_oauth_client.cc
@@ -42,7 +42,7 @@
         num_retries_(0),
         max_retries_(0),
         url_loader_factory_(url_loader_factory),
-        delegate_(NULL),
+        delegate_(nullptr),
         request_type_(NO_PENDING_REQUEST),
         weak_ptr_factory_(this) {
     backoff_policy_.num_errors_to_ignore =
diff --git a/google_apis/gaia/oauth2_access_token_fetcher_immediate_error.cc b/google_apis/gaia/oauth2_access_token_fetcher_immediate_error.cc
index 65b8c674e..8a9ecb0 100644
--- a/google_apis/gaia/oauth2_access_token_fetcher_immediate_error.cc
+++ b/google_apis/gaia/oauth2_access_token_fetcher_immediate_error.cc
@@ -20,12 +20,12 @@
 void OAuth2AccessTokenFetcherImmediateError::FailCaller::run() {
   if (fetcher_) {
     fetcher_->Fail();
-    fetcher_ = NULL;
+    fetcher_ = nullptr;
   }
 }
 
 void OAuth2AccessTokenFetcherImmediateError::FailCaller::detach() {
-  fetcher_ = NULL;
+  fetcher_ = nullptr;
 }
 
 
@@ -45,7 +45,7 @@
 void OAuth2AccessTokenFetcherImmediateError::CancelRequest() {
   if (failer_) {
     failer_->detach();
-    failer_ = NULL;
+    failer_ = nullptr;
   }
 }
 
diff --git a/google_apis/gaia/oauth2_mint_token_flow.cc b/google_apis/gaia/oauth2_mint_token_flow.cc
index 1f689652..216afac 100644
--- a/google_apis/gaia/oauth2_mint_token_flow.cc
+++ b/google_apis/gaia/oauth2_mint_token_flow.cc
@@ -194,7 +194,7 @@
     response_body = std::move(*body);
   std::unique_ptr<base::Value> value =
       base::JSONReader::ReadDeprecated(response_body);
-  base::DictionaryValue* dict = NULL;
+  base::DictionaryValue* dict = nullptr;
   if (!value.get() || !value->GetAsDictionary(&dict)) {
     ReportFailure(GoogleServiceAuthError::FromUnexpectedServiceResponse(
         "Not able to parse a JSON object from a service response."));
@@ -255,17 +255,17 @@
   CHECK(dict);
   CHECK(issue_advice);
 
-  const base::DictionaryValue* consent_dict = NULL;
+  const base::DictionaryValue* consent_dict = nullptr;
   if (!dict->GetDictionary(kConsentKey, &consent_dict))
     return false;
 
-  const base::ListValue* scopes_list = NULL;
+  const base::ListValue* scopes_list = nullptr;
   if (!consent_dict->GetList(kScopesKey, &scopes_list))
     return false;
 
   bool success = true;
   for (size_t index = 0; index < scopes_list->GetSize(); ++index) {
-    const base::DictionaryValue* scopes_entry = NULL;
+    const base::DictionaryValue* scopes_entry = nullptr;
     IssueAdviceInfoEntry entry;
     base::string16 detail;
     if (!scopes_list->GetDictionary(index, &scopes_entry) ||
diff --git a/google_apis/gaia/oauth2_mint_token_flow_unittest.cc b/google_apis/gaia/oauth2_mint_token_flow_unittest.cc
index e004277..965237e 100644
--- a/google_apis/gaia/oauth2_mint_token_flow_unittest.cc
+++ b/google_apis/gaia/oauth2_mint_token_flow_unittest.cc
@@ -347,7 +347,7 @@
 TEST_F(OAuth2MintTokenFlowTest, ProcessApiCallFailure) {
   network::ResourceResponseHead head;
   {  // Null delegate should work fine.
-    CreateFlow(NULL, OAuth2MintTokenFlow::MODE_MINT_TOKEN_NO_FORCE, "");
+    CreateFlow(nullptr, OAuth2MintTokenFlow::MODE_MINT_TOKEN_NO_FORCE, "");
     flow_->ProcessApiCallFailure(net::ERR_FAILED, &head, nullptr);
   }
 
diff --git a/google_apis/gaia/oauth2_token_service.cc b/google_apis/gaia/oauth2_token_service.cc
index c714b814..1f449aa 100644
--- a/google_apis/gaia/oauth2_token_service.cc
+++ b/google_apis/gaia/oauth2_token_service.cc
@@ -711,10 +711,10 @@
   DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
   TokenCache::iterator token_iterator = token_cache_.find(request_parameters);
   if (token_iterator == token_cache_.end())
-    return NULL;
+    return nullptr;
   if (token_iterator->second.expiration_time <= base::Time::Now()) {
     token_cache_.erase(token_iterator);
-    return NULL;
+    return nullptr;
   }
   return &token_iterator->second;
 }
diff --git a/google_apis/gaia/oauth2_token_service_request.cc b/google_apis/gaia/oauth2_token_service_request.cc
index caae187..22ef1d68 100644
--- a/google_apis/gaia/oauth2_token_service_request.cc
+++ b/google_apis/gaia/oauth2_token_service_request.cc
@@ -121,7 +121,7 @@
 
   // Detaches |owner_| from this instance so |owner_| will be called back only
   // if |Stop()| has never been called.
-  owner_ = NULL;
+  owner_ = nullptr;
 
   // Stop on the token service thread.  RefCountedDeleteOnSequence ensures we
   // will be destroyed on the owner thread.
@@ -133,7 +133,7 @@
 
 bool OAuth2TokenServiceRequest::Core::IsStopped() const {
   DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
-  return owner_ == NULL;
+  return owner_ == nullptr;
 }
 
 OAuth2TokenService* OAuth2TokenServiceRequest::Core::token_service() {
diff --git a/google_apis/gaia/oauth2_token_service_unittest.cc b/google_apis/gaia/oauth2_token_service_unittest.cc
index ac3d758..9e0648b 100644
--- a/google_apis/gaia/oauth2_token_service_unittest.cc
+++ b/google_apis/gaia/oauth2_token_service_unittest.cc
@@ -508,7 +508,7 @@
   EXPECT_EQ(0, consumer_.number_of_errors_);
 
   // The destructor should cancel all in-flight fetchers.
-  oauth2_service_.reset(NULL);
+  oauth2_service_.reset(nullptr);
 
   EXPECT_EQ(0, consumer_.number_of_successful_tokens_);
   EXPECT_EQ(1, consumer_.number_of_errors_);
diff --git a/google_apis/gcm/base/mcs_message.cc b/google_apis/gcm/base/mcs_message.cc
index 1b0f0222..9d80d57 100644
--- a/google_apis/gcm/base/mcs_message.cc
+++ b/google_apis/gcm/base/mcs_message.cc
@@ -61,7 +61,7 @@
 }
 
 bool MCSMessage::IsValid() const {
-  return core_.get() != NULL;
+  return core_.get() != nullptr;
 }
 
 std::string MCSMessage::SerializeAsString() const {
diff --git a/google_apis/gcm/base/socket_stream.cc b/google_apis/gcm/base/socket_stream.cc
index e7af5c6..8038dc0 100644
--- a/google_apis/gcm/base/socket_stream.cc
+++ b/google_apis/gcm/base/socket_stream.cc
@@ -170,7 +170,7 @@
   DCHECK_NE(GetState(), CLOSED);
 
   int unread_data_size = 0;
-  const void* unread_data_ptr = NULL;
+  const void* unread_data_ptr = nullptr;
   Next(&unread_data_ptr, &unread_data_size);
   ResetInternal();
 
diff --git a/google_apis/gcm/base/socket_stream_unittest.cc b/google_apis/gcm/base/socket_stream_unittest.cc
index 949713b9..582613e 100644
--- a/google_apis/gcm/base/socket_stream_unittest.cc
+++ b/google_apis/gcm/base/socket_stream_unittest.cc
@@ -143,8 +143,8 @@
 
 base::StringPiece GCMSocketStreamTest::DoInputStreamRead(int bytes) {
   int total_bytes_read = 0;
-  const void* initial_buffer = NULL;
-  const void* buffer = NULL;
+  const void* initial_buffer = nullptr;
+  const void* buffer = nullptr;
   int size = 0;
 
   do {
diff --git a/google_apis/gcm/engine/connection_factory_impl.cc b/google_apis/gcm/engine/connection_factory_impl.cc
index 269a1df..a8f4080 100644
--- a/google_apis/gcm/engine/connection_factory_impl.cc
+++ b/google_apis/gcm/engine/connection_factory_impl.cc
@@ -67,7 +67,7 @@
       handshake_in_progress_(false),
       recorder_(recorder),
       network_connection_tracker_(network_connection_tracker),
-      listener_(NULL),
+      listener_(nullptr),
       weak_ptr_factory_(this) {
   DCHECK_GE(mcs_endpoints_.size(), 1U);
 }
diff --git a/google_apis/gcm/engine/connection_handler_impl.cc b/google_apis/gcm/engine/connection_handler_impl.cc
index 59cf796..ae4a0eaa 100644
--- a/google_apis/gcm/engine/connection_handler_impl.cc
+++ b/google_apis/gcm/engine/connection_handler_impl.cc
@@ -412,7 +412,7 @@
     }
   } else {
     // Copy any data in the input stream onto the end of the buffer.
-    const void* data_ptr = NULL;
+    const void* data_ptr = nullptr;
     int size = 0;
     input_stream_->Next(&data_ptr, &size);
     payload_input_buffer_.insert(payload_input_buffer_.end(),
diff --git a/google_apis/gcm/engine/mcs_client.cc b/google_apis/gcm/engine/mcs_client.cc
index b99eaa9..a7c470b 100644
--- a/google_apis/gcm/engine/mcs_client.cc
+++ b/google_apis/gcm/engine/mcs_client.cc
@@ -172,15 +172,14 @@
       android_id_(0),
       security_token_(0),
       connection_factory_(connection_factory),
-      connection_handler_(NULL),
+      connection_handler_(nullptr),
       last_device_to_server_stream_id_received_(0),
       last_server_to_device_stream_id_received_(0),
       stream_id_out_(0),
       stream_id_in_(0),
       gcm_store_(gcm_store),
       recorder_(recorder),
-      weak_ptr_factory_(this) {
-}
+      weak_ptr_factory_(this) {}
 
 MCSClient::~MCSClient() {
 }
diff --git a/google_apis/google_api_keys.cc b/google_apis/google_api_keys.cc
index 48aa4820..f6a7f4e 100644
--- a/google_apis/google_api_keys.cc
+++ b/google_apis/google_api_keys.cc
@@ -107,7 +107,7 @@
     base::CommandLine* command_line = base::CommandLine::ForCurrentProcess();
 
     api_key_ = CalculateKeyValue(
-        GOOGLE_API_KEY, STRINGIZE_NO_EXPANSION(GOOGLE_API_KEY), NULL,
+        GOOGLE_API_KEY, STRINGIZE_NO_EXPANSION(GOOGLE_API_KEY), nullptr,
         std::string(), environment.get(), command_line);
 
 // A special non-stable key is at the moment defined only for Android Chrome.
@@ -120,30 +120,24 @@
     api_key_non_stable_ = api_key_;
 #endif
 
-    api_key_remoting_ftl_ =
-        CalculateKeyValue(GOOGLE_API_KEY_REMOTING_FTL,
-                          STRINGIZE_NO_EXPANSION(GOOGLE_API_KEY_REMOTING_FTL),
-                          NULL, std::string(), environment.get(), command_line);
+    api_key_remoting_ftl_ = CalculateKeyValue(
+        GOOGLE_API_KEY_REMOTING_FTL,
+        STRINGIZE_NO_EXPANSION(GOOGLE_API_KEY_REMOTING_FTL), nullptr,
+        std::string(), environment.get(), command_line);
 
-    metrics_key_ =
-        CalculateKeyValue(GOOGLE_METRICS_SIGNING_KEY,
-                          STRINGIZE_NO_EXPANSION(GOOGLE_METRICS_SIGNING_KEY),
-                          NULL, std::string(), environment.get(), command_line);
+    metrics_key_ = CalculateKeyValue(
+        GOOGLE_METRICS_SIGNING_KEY,
+        STRINGIZE_NO_EXPANSION(GOOGLE_METRICS_SIGNING_KEY), nullptr,
+        std::string(), environment.get(), command_line);
 
-    std::string default_client_id =
-        CalculateKeyValue(GOOGLE_DEFAULT_CLIENT_ID,
-                          STRINGIZE_NO_EXPANSION(GOOGLE_DEFAULT_CLIENT_ID),
-                          NULL,
-                          std::string(),
-                          environment.get(),
-                          command_line);
-    std::string default_client_secret =
-        CalculateKeyValue(GOOGLE_DEFAULT_CLIENT_SECRET,
-                          STRINGIZE_NO_EXPANSION(GOOGLE_DEFAULT_CLIENT_SECRET),
-                          NULL,
-                          std::string(),
-                          environment.get(),
-                          command_line);
+    std::string default_client_id = CalculateKeyValue(
+        GOOGLE_DEFAULT_CLIENT_ID,
+        STRINGIZE_NO_EXPANSION(GOOGLE_DEFAULT_CLIENT_ID), nullptr,
+        std::string(), environment.get(), command_line);
+    std::string default_client_secret = CalculateKeyValue(
+        GOOGLE_DEFAULT_CLIENT_SECRET,
+        STRINGIZE_NO_EXPANSION(GOOGLE_DEFAULT_CLIENT_SECRET), nullptr,
+        std::string(), environment.get(), command_line);
 
     // We currently only allow overriding the baked-in values for the
     // default OAuth2 client ID and secret using a command-line
@@ -168,48 +162,30 @@
 
     client_ids_[CLIENT_CLOUD_PRINT] = CalculateKeyValue(
         GOOGLE_CLIENT_ID_CLOUD_PRINT,
-        STRINGIZE_NO_EXPANSION(GOOGLE_CLIENT_ID_CLOUD_PRINT),
-        NULL,
-        default_client_id,
-        environment.get(),
-        command_line);
+        STRINGIZE_NO_EXPANSION(GOOGLE_CLIENT_ID_CLOUD_PRINT), nullptr,
+        default_client_id, environment.get(), command_line);
     client_secrets_[CLIENT_CLOUD_PRINT] = CalculateKeyValue(
         GOOGLE_CLIENT_SECRET_CLOUD_PRINT,
-        STRINGIZE_NO_EXPANSION(GOOGLE_CLIENT_SECRET_CLOUD_PRINT),
-        NULL,
-        default_client_secret,
-        environment.get(),
-        command_line);
+        STRINGIZE_NO_EXPANSION(GOOGLE_CLIENT_SECRET_CLOUD_PRINT), nullptr,
+        default_client_secret, environment.get(), command_line);
 
     client_ids_[CLIENT_REMOTING] = CalculateKeyValue(
         GOOGLE_CLIENT_ID_REMOTING,
-        STRINGIZE_NO_EXPANSION(GOOGLE_CLIENT_ID_REMOTING),
-        NULL,
-        default_client_id,
-        environment.get(),
-        command_line);
+        STRINGIZE_NO_EXPANSION(GOOGLE_CLIENT_ID_REMOTING), nullptr,
+        default_client_id, environment.get(), command_line);
     client_secrets_[CLIENT_REMOTING] = CalculateKeyValue(
         GOOGLE_CLIENT_SECRET_REMOTING,
-        STRINGIZE_NO_EXPANSION(GOOGLE_CLIENT_SECRET_REMOTING),
-        NULL,
-        default_client_secret,
-        environment.get(),
-        command_line);
+        STRINGIZE_NO_EXPANSION(GOOGLE_CLIENT_SECRET_REMOTING), nullptr,
+        default_client_secret, environment.get(), command_line);
 
     client_ids_[CLIENT_REMOTING_HOST] = CalculateKeyValue(
         GOOGLE_CLIENT_ID_REMOTING_HOST,
-        STRINGIZE_NO_EXPANSION(GOOGLE_CLIENT_ID_REMOTING_HOST),
-        NULL,
-        default_client_id,
-        environment.get(),
-        command_line);
+        STRINGIZE_NO_EXPANSION(GOOGLE_CLIENT_ID_REMOTING_HOST), nullptr,
+        default_client_id, environment.get(), command_line);
     client_secrets_[CLIENT_REMOTING_HOST] = CalculateKeyValue(
         GOOGLE_CLIENT_SECRET_REMOTING_HOST,
-        STRINGIZE_NO_EXPANSION(GOOGLE_CLIENT_SECRET_REMOTING_HOST),
-        NULL,
-        default_client_secret,
-        environment.get(),
-        command_line);
+        STRINGIZE_NO_EXPANSION(GOOGLE_CLIENT_SECRET_REMOTING_HOST), nullptr,
+        default_client_secret, environment.get(), command_line);
   }
 
   std::string api_key() const { return api_key_; }
diff --git a/ios/chrome/browser/browsing_data/browsing_data_remover_impl.mm b/ios/chrome/browser/browsing_data/browsing_data_remover_impl.mm
index a4e98852..25786dc 100644
--- a/ios/chrome/browser/browsing_data/browsing_data_remover_impl.mm
+++ b/ios/chrome/browser/browsing_data/browsing_data_remover_impl.mm
@@ -474,9 +474,8 @@
     ClearHttpCache(context_getter_,
                    base::CreateSingleThreadTaskRunnerWithTraits(task_traits),
                    delete_begin, delete_end,
-                   AdaptCallbackForRepeating(
-                       base::BindOnce(&NetCompletionCallbackAdapter,
-                                      CreatePendingTaskCompletionClosure())));
+                   base::BindOnce(&NetCompletionCallbackAdapter,
+                                  CreatePendingTaskCompletionClosure()));
   }
 
   // Remove omnibox zero-suggest cache results.
diff --git a/ios/chrome/browser/passwords/ios_chrome_password_manager_client.h b/ios/chrome/browser/passwords/ios_chrome_password_manager_client.h
index 7464a2e4..ccb7bf0 100644
--- a/ios/chrome/browser/passwords/ios_chrome_password_manager_client.h
+++ b/ios/chrome/browser/passwords/ios_chrome_password_manager_client.h
@@ -66,6 +66,9 @@
       bool has_generated_password,
       bool is_update) override;
   void HideManualFallbackForSaving() override;
+  void FocusedInputChanged(const url::Origin& last_committed_origin,
+                           bool is_fillable,
+                           bool is_password_field) override;
   bool PromptUserToChooseCredentials(
       std::vector<std::unique_ptr<autofill::PasswordForm>> local_forms,
       const GURL& origin,
@@ -94,6 +97,7 @@
   ukm::SourceId GetUkmSourceId() override;
   password_manager::PasswordManagerMetricsRecorder* GetMetricsRecorder()
       override;
+  bool IsIsolationForPasswordSitesEnabled() const override;
 
  private:
   // password_manager::PasswordManagerClientHelperDelegate implementation.
diff --git a/ios/chrome/browser/passwords/ios_chrome_password_manager_client.mm b/ios/chrome/browser/passwords/ios_chrome_password_manager_client.mm
index 78b0fd9..ec8542b 100644
--- a/ios/chrome/browser/passwords/ios_chrome_password_manager_client.mm
+++ b/ios/chrome/browser/passwords/ios_chrome_password_manager_client.mm
@@ -116,6 +116,13 @@
   NOTIMPLEMENTED();
 }
 
+void IOSChromePasswordManagerClient::FocusedInputChanged(
+    const url::Origin& last_committed_origin,
+    bool is_fillable,
+    bool is_password_field) {
+  NOTIMPLEMENTED();
+}
+
 void IOSChromePasswordManagerClient::AutomaticPasswordSave(
     std::unique_ptr<PasswordFormManagerForUI> saved_form_manager) {
   NOTIMPLEMENTED();
@@ -209,3 +216,8 @@
 IOSChromePasswordManagerClient::GetPasswordManager() {
   return delegate_.passwordManager;
 }
+
+bool IOSChromePasswordManagerClient::IsIsolationForPasswordSitesEnabled()
+    const {
+  return false;
+}
diff --git a/ios/chrome/browser/prefs/browser_prefs.mm b/ios/chrome/browser/prefs/browser_prefs.mm
index 73a63204..859a0bff 100644
--- a/ios/chrome/browser/prefs/browser_prefs.mm
+++ b/ios/chrome/browser/prefs/browser_prefs.mm
@@ -73,7 +73,7 @@
   BrowserStateInfoCache::RegisterPrefs(registry);
   flags_ui::PrefServiceFlagsStorage::RegisterPrefs(registry);
   gcm::GCMChannelStatusSyncer::RegisterPrefs(registry);
-  identity::IdentityManager::RegisterPrefs(registry);
+  identity::IdentityManager::RegisterLocalStatePrefs(registry);
   IOSChromeMetricsServiceClient::RegisterPrefs(registry);
   network_time::NetworkTimeTracker::RegisterPrefs(registry);
   ios::NotificationPromo::RegisterPrefs(registry);
diff --git a/ios/chrome/browser/prerender/BUILD.gn b/ios/chrome/browser/prerender/BUILD.gn
index 1a3ceb92..4e0b9bf 100644
--- a/ios/chrome/browser/prerender/BUILD.gn
+++ b/ios/chrome/browser/prerender/BUILD.gn
@@ -70,7 +70,7 @@
     "//base",
     "//ios/chrome/browser/ui/content_suggestions:content_suggestions_constant",
     "//ios/chrome/browser/ui/omnibox:omnibox_internal",
-    "//ios/chrome/browser/ui/omnibox:omnibox_popup_shared",
+    "//ios/chrome/browser/ui/omnibox/popup:popup_ui",
     "//ios/chrome/browser/ui/util",
     "//ios/chrome/test/app:test_support",
     "//ios/chrome/test/earl_grey:test_support",
diff --git a/ios/chrome/browser/prerender/prerender_egtest.mm b/ios/chrome/browser/prerender/prerender_egtest.mm
index f29302e1..457d00ab 100644
--- a/ios/chrome/browser/prerender/prerender_egtest.mm
+++ b/ios/chrome/browser/prerender/prerender_egtest.mm
@@ -10,7 +10,7 @@
 #include "base/strings/sys_string_conversions.h"
 #import "ios/chrome/browser/ui/content_suggestions/ntp_home_constant.h"
 #import "ios/chrome/browser/ui/omnibox/omnibox_text_field_ios.h"
-#import "ios/chrome/browser/ui/omnibox/truncating_attributed_label.h"
+#import "ios/chrome/browser/ui/omnibox/popup/omnibox_popup_truncating_label.h"
 #include "ios/chrome/browser/ui/util/ui_util.h"
 #import "ios/chrome/test/app/history_test_util.h"
 #import "ios/chrome/test/app/tab_test_util.h"
diff --git a/ios/chrome/browser/signin/BUILD.gn b/ios/chrome/browser/signin/BUILD.gn
index e4e0eea9..920854f6e 100644
--- a/ios/chrome/browser/signin/BUILD.gn
+++ b/ios/chrome/browser/signin/BUILD.gn
@@ -32,8 +32,6 @@
     "gaia_auth_fetcher_ios_ns_url_session_bridge.mm",
     "gaia_auth_fetcher_ios_wk_webview_bridge.h",
     "gaia_auth_fetcher_ios_wk_webview_bridge.mm",
-    "gaia_cookie_manager_service_factory.cc",
-    "gaia_cookie_manager_service_factory.h",
     "identity_manager_factory.cc",
     "identity_manager_factory.h",
     "identity_manager_factory_observer.h",
diff --git a/ios/chrome/browser/signin/gaia_cookie_manager_service_factory.cc b/ios/chrome/browser/signin/gaia_cookie_manager_service_factory.cc
deleted file mode 100644
index 93e7c18..0000000
--- a/ios/chrome/browser/signin/gaia_cookie_manager_service_factory.cc
+++ /dev/null
@@ -1,53 +0,0 @@
-// Copyright 2015 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "ios/chrome/browser/signin/gaia_cookie_manager_service_factory.h"
-
-#include "base/no_destructor.h"
-#include "components/keyed_service/core/service_access_type.h"
-#include "components/keyed_service/ios/browser_state_dependency_manager.h"
-#include "components/signin/core/browser/gaia_cookie_manager_service.h"
-#include "components/signin/core/browser/profile_oauth2_token_service.h"
-#include "ios/chrome/browser/browser_state/chrome_browser_state.h"
-#include "ios/chrome/browser/signin/profile_oauth2_token_service_factory.h"
-#include "ios/chrome/browser/signin/signin_client_factory.h"
-
-namespace ios {
-
-GaiaCookieManagerServiceFactory::GaiaCookieManagerServiceFactory()
-    : BrowserStateKeyedServiceFactory(
-          "GaiaCookieManagerService",
-          BrowserStateDependencyManager::GetInstance()) {
-  DependsOn(SigninClientFactory::GetInstance());
-  DependsOn(ProfileOAuth2TokenServiceFactory::GetInstance());
-}
-
-GaiaCookieManagerServiceFactory::~GaiaCookieManagerServiceFactory() {}
-
-// static
-GaiaCookieManagerService* GaiaCookieManagerServiceFactory::GetForBrowserState(
-    ios::ChromeBrowserState* browser_state) {
-  return static_cast<GaiaCookieManagerService*>(
-      GetInstance()->GetServiceForBrowserState(browser_state, true));
-}
-
-// static
-GaiaCookieManagerServiceFactory*
-GaiaCookieManagerServiceFactory::GetInstance() {
-  static base::NoDestructor<GaiaCookieManagerServiceFactory> instance;
-  return instance.get();
-}
-
-std::unique_ptr<KeyedService>
-GaiaCookieManagerServiceFactory::BuildServiceInstanceFor(
-    web::BrowserState* context) const {
-  ios::ChromeBrowserState* chrome_browser_state =
-      ios::ChromeBrowserState::FromBrowserState(context);
-  return std::make_unique<GaiaCookieManagerService>(
-      ProfileOAuth2TokenServiceFactory::GetForBrowserState(
-          chrome_browser_state),
-      SigninClientFactory::GetForBrowserState(chrome_browser_state));
-}
-
-}  // namespace ios
diff --git a/ios/chrome/browser/signin/gaia_cookie_manager_service_factory.h b/ios/chrome/browser/signin/gaia_cookie_manager_service_factory.h
deleted file mode 100644
index e6795a9d..0000000
--- a/ios/chrome/browser/signin/gaia_cookie_manager_service_factory.h
+++ /dev/null
@@ -1,49 +0,0 @@
-// Copyright 2015 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef IOS_CHROME_BROWSER_SIGNIN_GAIA_COOKIE_MANAGER_SERVICE_FACTORY_H_
-#define IOS_CHROME_BROWSER_SIGNIN_GAIA_COOKIE_MANAGER_SERVICE_FACTORY_H_
-
-#include <memory>
-
-#include "base/macros.h"
-#include "base/no_destructor.h"
-#include "components/keyed_service/ios/browser_state_keyed_service_factory.h"
-
-class GaiaCookieManagerService;
-
-namespace ios {
-
-class ChromeBrowserState;
-
-// Singleton that creates the GaiaCookieManagerService(s) and associates those
-// services with browser states.
-class GaiaCookieManagerServiceFactory : public BrowserStateKeyedServiceFactory {
- public:
-  // Returns the instance of GaiaCookieManagerService associated with this
-  // browser state (creating one if none exists). Returns null if this browser
-  // state cannot have an GaiaCookieManagerService (for example, if it is
-  // incognito).
-  static GaiaCookieManagerService* GetForBrowserState(
-      ios::ChromeBrowserState* browser_state);
-
-  // Returns an instance of the factory singleton.
-  static GaiaCookieManagerServiceFactory* GetInstance();
-
- private:
-  friend class base::NoDestructor<GaiaCookieManagerServiceFactory>;
-
-  GaiaCookieManagerServiceFactory();
-  ~GaiaCookieManagerServiceFactory() override;
-
-  // BrowserStateKeyedServiceFactory:
-  std::unique_ptr<KeyedService> BuildServiceInstanceFor(
-      web::BrowserState* context) const override;
-
-  DISALLOW_COPY_AND_ASSIGN(GaiaCookieManagerServiceFactory);
-};
-
-}  // namespace ios
-
-#endif  // IOS_CHROME_BROWSER_SIGNIN_GAIA_COOKIE_MANAGER_SERVICE_FACTORY_H_
diff --git a/ios/chrome/browser/signin/identity_manager_factory.cc b/ios/chrome/browser/signin/identity_manager_factory.cc
index b1e1258..a2c1a63 100644
--- a/ios/chrome/browser/signin/identity_manager_factory.cc
+++ b/ios/chrome/browser/signin/identity_manager_factory.cc
@@ -16,7 +16,6 @@
 #include "ios/chrome/browser/browser_state/chrome_browser_state.h"
 #include "ios/chrome/browser/signin/account_fetcher_service_factory.h"
 #include "ios/chrome/browser/signin/account_tracker_service_factory.h"
-#include "ios/chrome/browser/signin/gaia_cookie_manager_service_factory.h"
 #include "ios/chrome/browser/signin/identity_manager_factory_observer.h"
 #include "ios/chrome/browser/signin/profile_oauth2_token_service_factory.h"
 #include "ios/chrome/browser/signin/signin_client_factory.h"
@@ -28,16 +27,15 @@
 
 namespace {
 std::unique_ptr<SigninManager> BuildSigninManager(
-    ios::ChromeBrowserState* chrome_browser_state) {
+    ios::ChromeBrowserState* chrome_browser_state,
+    GaiaCookieManagerService* gaia_cookie_manager_service) {
   std::unique_ptr<SigninManager> service = std::make_unique<SigninManager>(
       SigninClientFactory::GetForBrowserState(chrome_browser_state),
       ProfileOAuth2TokenServiceFactory::GetForBrowserState(
           chrome_browser_state),
       ios::AccountTrackerServiceFactory::GetForBrowserState(
           chrome_browser_state),
-      ios::GaiaCookieManagerServiceFactory::GetForBrowserState(
-          chrome_browser_state),
-      signin::AccountConsistencyMethod::kMirror);
+      gaia_cookie_manager_service, signin::AccountConsistencyMethod::kMirror);
   service->Initialize(GetApplicationContext()->GetLocalState());
   return service;
 }
@@ -54,33 +52,33 @@
                                public identity::IdentityManager {
  public:
   IdentityManagerWrapper(
+      std::unique_ptr<GaiaCookieManagerService> gaia_cookie_manager_service,
       std::unique_ptr<SigninManagerBase> signin_manager,
       std::unique_ptr<identity::PrimaryAccountMutator> primary_account_mutator,
+      std::unique_ptr<identity::AccountsCookieMutatorImpl>
+          accounts_cookie_mutator,
+      std::unique_ptr<identity::DiagnosticsProviderImpl> diagnostics_provider,
       ios::ChromeBrowserState* browser_state)
       : identity::IdentityManager(
+            std::move(gaia_cookie_manager_service),
             std::move(signin_manager),
             ProfileOAuth2TokenServiceFactory::GetForBrowserState(browser_state),
             ios::AccountFetcherServiceFactory::GetForBrowserState(
                 browser_state),
             ios::AccountTrackerServiceFactory::GetForBrowserState(
                 browser_state),
-            ios::GaiaCookieManagerServiceFactory::GetForBrowserState(
-                browser_state),
             std::move(primary_account_mutator),
             /*accounts_mutator=*/nullptr,
-            std::make_unique<identity::AccountsCookieMutatorImpl>(
-                ios::GaiaCookieManagerServiceFactory::GetForBrowserState(
-                    browser_state)),
-            std::make_unique<identity::DiagnosticsProviderImpl>(
-                ProfileOAuth2TokenServiceFactory::GetForBrowserState(
-                    browser_state),
-                ios::GaiaCookieManagerServiceFactory::GetForBrowserState(
-                    browser_state))) {}
+            std::move(accounts_cookie_mutator),
+            std::move(diagnostics_provider)) {}
+
+  // KeyedService overrides.
+  void Shutdown() override { IdentityManager::Shutdown(); }
 };
 
 void IdentityManagerFactory::RegisterBrowserStatePrefs(
     user_prefs::PrefRegistrySyncable* registry) {
-  SigninManagerBase::RegisterProfilePrefs(registry);
+  identity::IdentityManager::RegisterProfilePrefs(registry);
 }
 
 IdentityManagerFactory::IdentityManagerFactory()
@@ -89,7 +87,6 @@
           BrowserStateDependencyManager::GetInstance()) {
   DependsOn(ios::AccountFetcherServiceFactory::GetInstance());
   DependsOn(ios::AccountTrackerServiceFactory::GetInstance());
-  DependsOn(ios::GaiaCookieManagerServiceFactory::GetInstance());
   DependsOn(ProfileOAuth2TokenServiceFactory::GetInstance());
   DependsOn(SigninClientFactory::GetInstance());
 }
@@ -120,7 +117,6 @@
 void IdentityManagerFactory::EnsureFactoryAndDependeeFactoriesBuilt() {
   IdentityManagerFactory::GetInstance();
   ios::AccountTrackerServiceFactory::GetInstance();
-  ios::GaiaCookieManagerServiceFactory::GetInstance();
   ProfileOAuth2TokenServiceFactory::GetInstance();
   SigninClientFactory::GetInstance();
 }
@@ -136,21 +132,31 @@
 }
 
 std::unique_ptr<KeyedService> IdentityManagerFactory::BuildServiceInstanceFor(
-    web::BrowserState* browser_state) const {
-  ios::ChromeBrowserState* chrome_browser_state =
-      ios::ChromeBrowserState::FromBrowserState(browser_state);
+    web::BrowserState* context) const {
+  ios::ChromeBrowserState* browser_state =
+      ios::ChromeBrowserState::FromBrowserState(context);
 
   // Construct the dependencies that IdentityManager will own.
+  auto gaia_cookie_manager_service = std::make_unique<GaiaCookieManagerService>(
+      ProfileOAuth2TokenServiceFactory::GetForBrowserState(browser_state),
+      SigninClientFactory::GetForBrowserState(browser_state));
   std::unique_ptr<SigninManager> signin_manager =
-      BuildSigninManager(chrome_browser_state);
+      BuildSigninManager(browser_state, gaia_cookie_manager_service.get());
   auto primary_account_mutator =
       std::make_unique<identity::PrimaryAccountMutatorImpl>(
-          ios::AccountTrackerServiceFactory::GetForBrowserState(
-              chrome_browser_state),
+          ios::AccountTrackerServiceFactory::GetForBrowserState(browser_state),
           signin_manager.get());
+  auto accounts_cookie_mutator =
+      std::make_unique<identity::AccountsCookieMutatorImpl>(
+          gaia_cookie_manager_service.get());
+  auto diagnostics_provider =
+      std::make_unique<identity::DiagnosticsProviderImpl>(
+          ProfileOAuth2TokenServiceFactory::GetForBrowserState(browser_state),
+          gaia_cookie_manager_service.get());
   auto identity_manager = std::make_unique<IdentityManagerWrapper>(
-      std::move(signin_manager), std::move(primary_account_mutator),
-      chrome_browser_state);
+      std::move(gaia_cookie_manager_service), std::move(signin_manager),
+      std::move(primary_account_mutator), std::move(accounts_cookie_mutator),
+      std::move(diagnostics_provider), browser_state);
 
   for (auto& observer : observer_list_)
     observer.IdentityManagerCreated(identity_manager.get());
diff --git a/ios/chrome/browser/signin/identity_manager_factory.h b/ios/chrome/browser/signin/identity_manager_factory.h
index db948865..e5ee1d3 100644
--- a/ios/chrome/browser/signin/identity_manager_factory.h
+++ b/ios/chrome/browser/signin/identity_manager_factory.h
@@ -55,7 +55,7 @@
 
   // BrowserStateKeyedServiceFactory:
   std::unique_ptr<KeyedService> BuildServiceInstanceFor(
-      web::BrowserState* browser_state) const override;
+      web::BrowserState* context) const override;
   void BrowserStateShutdown(web::BrowserState* context) override;
   void RegisterBrowserStatePrefs(
       user_prefs::PrefRegistrySyncable* registry) override;
diff --git a/ios/chrome/browser/signin/identity_test_environment_chrome_browser_state_adaptor.cc b/ios/chrome/browser/signin/identity_test_environment_chrome_browser_state_adaptor.cc
index 49edd8e..ec64526 100644
--- a/ios/chrome/browser/signin/identity_test_environment_chrome_browser_state_adaptor.cc
+++ b/ios/chrome/browser/signin/identity_test_environment_chrome_browser_state_adaptor.cc
@@ -13,7 +13,6 @@
 #include "ios/chrome/browser/browser_state/chrome_browser_state.h"
 #include "ios/chrome/browser/signin/account_fetcher_service_factory.h"
 #include "ios/chrome/browser/signin/account_tracker_service_factory.h"
-#include "ios/chrome/browser/signin/gaia_cookie_manager_service_factory.h"
 #include "ios/chrome/browser/signin/identity_manager_factory.h"
 #include "ios/chrome/browser/signin/profile_oauth2_token_service_factory.h"
 #include "ios/chrome/browser/signin/profile_oauth2_token_service_ios_provider_impl.h"
@@ -127,6 +126,4 @@
           static_cast<FakeProfileOAuth2TokenService*>(
               ProfileOAuth2TokenServiceFactory::GetForBrowserState(
                   browser_state)),
-          ios::GaiaCookieManagerServiceFactory::GetForBrowserState(
-              browser_state),
           IdentityManagerFactory::GetForBrowserState(browser_state)) {}
diff --git a/ios/chrome/browser/ui/omnibox/BUILD.gn b/ios/chrome/browser/ui/omnibox/BUILD.gn
index 087c506..bb34a325 100644
--- a/ios/chrome/browser/ui/omnibox/BUILD.gn
+++ b/ios/chrome/browser/ui/omnibox/BUILD.gn
@@ -23,15 +23,6 @@
   sources = [
     "omnibox_constants.h",
     "omnibox_constants.mm",
-    "truncating_attributed_label.h",
-    "truncating_attributed_label.mm",
-  ]
-  deps = [
-    "//base",
-    "//components/omnibox/browser",
-  ]
-  public_deps = [
-    "//ui/base",
   ]
 }
 
@@ -43,6 +34,13 @@
     "omnibox_util.mm",
   ]
   deps = [
+    "resources:omnibox_background",
+    "resources:omnibox_clear_icon",
+    "resources:omnibox_completion_bookmark",
+    "resources:omnibox_completion_calculator",
+    "resources:omnibox_completion_default_favicon",
+    "resources:omnibox_completion_history",
+    "resources:omnibox_completion_search",
     "//base",
     "//components/omnibox/browser",
     "//components/security_state/core",
@@ -55,13 +53,8 @@
 source_set("omnibox_internal") {
   configs += [ "//build/config/compiler:enable_arc" ]
   sources = [
-    "autocomplete_match_formatter.h",
-    "autocomplete_match_formatter.mm",
-    "autocomplete_result_consumer.h",
-    "autocomplete_suggestion.h",
     "chrome_omnibox_client_ios.h",
     "chrome_omnibox_client_ios.mm",
-    "image_retriever.h",
     "omnibox_consumer.h",
     "omnibox_container_view.h",
     "omnibox_container_view.mm",
@@ -85,24 +78,15 @@
     ":omnibox",
     ":omnibox_popup_shared",
     ":omnibox_util",
-    "resources:omnibox_background",
-    "resources:omnibox_clear_icon",
-    "resources:omnibox_completion_bookmark",
-    "resources:omnibox_completion_calculator",
-    "resources:omnibox_completion_default_favicon",
-    "resources:omnibox_completion_history",
-    "resources:omnibox_completion_search",
     "resources:omnibox_transparent_background",
     "//base",
     "//components/favicon/ios",
-    "//components/image_fetcher/ios",
     "//components/open_from_clipboard:",
     "//components/resources",
     "//components/search_engines",
     "//components/security_state/core",
     "//components/strings",
     "//ios/chrome/app/strings",
-    "//ios/chrome/app/theme",
     "//ios/chrome/browser",
     "//ios/chrome/browser/autocomplete",
     "//ios/chrome/browser/bookmarks",
@@ -119,13 +103,11 @@
     "//ios/chrome/browser/ui/location_bar:constants",
     "//ios/chrome/browser/ui/omnibox/popup",
     "//ios/chrome/browser/ui/orchestrator:orchestrator",
-    "//ios/chrome/browser/ui/toolbar/buttons",
     "//ios/chrome/browser/ui/toolbar/public",
     "//ios/chrome/browser/ui/toolbar/public:feature_flags",
     "//ios/chrome/browser/ui/util",
     "//ios/chrome/common",
     "//ios/public/provider/chrome/browser",
-    "//ios/third_party/material_components_ios",
     "//ios/third_party/material_roboto_font_loader_ios",
     "//ios/web",
     "//net",
@@ -136,10 +118,6 @@
     "//ui/gfx/geometry",
     "//url",
   ]
-  allow_circular_includes_from = [
-    "//ios/chrome/browser/ui/omnibox/popup",
-    ":omnibox",
-  ]
   public_deps = [
     "//components/omnibox/browser",
   ]
diff --git a/ios/chrome/browser/ui/omnibox/image_retriever.h b/ios/chrome/browser/ui/omnibox/image_retriever.h
deleted file mode 100644
index 6180ae7e..0000000
--- a/ios/chrome/browser/ui/omnibox/image_retriever.h
+++ /dev/null
@@ -1,12 +0,0 @@
-// Copyright 2017 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef IOS_CHROME_BROWSER_UI_OMNIBOX_IMAGE_RETRIEVER_H_
-#define IOS_CHROME_BROWSER_UI_OMNIBOX_IMAGE_RETRIEVER_H_
-
-@protocol ImageRetriever<NSObject>
-- (void)fetchImage:(GURL)imageURL completion:(void (^)(UIImage*))completion;
-@end
-
-#endif  // IOS_CHROME_BROWSER_UI_OMNIBOX_IMAGE_RETRIEVER_H_
diff --git a/ios/chrome/browser/ui/omnibox/popup/BUILD.gn b/ios/chrome/browser/ui/omnibox/popup/BUILD.gn
index 788e280..a69ac85 100644
--- a/ios/chrome/browser/ui/omnibox/popup/BUILD.gn
+++ b/ios/chrome/browser/ui/omnibox/popup/BUILD.gn
@@ -4,13 +4,8 @@
 
 source_set("popup") {
   sources = [
-    "omnibox_popup_base_view_controller+internal.h",
-    "omnibox_popup_base_view_controller.h",
-    "omnibox_popup_base_view_controller.mm",
     "omnibox_popup_coordinator.h",
     "omnibox_popup_coordinator.mm",
-    "omnibox_popup_legacy_view_controller.h",
-    "omnibox_popup_legacy_view_controller.mm",
     "omnibox_popup_mediator.h",
     "omnibox_popup_mediator.mm",
     "omnibox_popup_presenter.h",
@@ -22,6 +17,7 @@
   ]
   deps = [
     ":popup_internal",
+    ":popup_ui",
     "//base",
     "//components/image_fetcher/ios",
     "//components/omnibox/browser",
@@ -29,43 +25,77 @@
     "//ios/chrome/app/strings",
     "//ios/chrome/browser",
     "//ios/chrome/browser/browser_state",
-    "//ios/chrome/browser/ui:ui",
+    "//ios/chrome/browser/ui",
     "//ios/chrome/browser/ui/commands",
     "//ios/chrome/browser/ui/ntp:util",
-    "//ios/chrome/browser/ui/omnibox:omnibox_popup_shared",
     "//ios/chrome/browser/ui/omnibox:omnibox_util",
     "//ios/chrome/browser/ui/omnibox/popup/shortcuts",
     "//ios/chrome/browser/ui/toolbar/buttons",
     "//ios/chrome/browser/ui/toolbar/public:feature_flags",
-    "//ios/chrome/browser/ui/toolbar/public:public",
-    "//ios/chrome/browser/ui/util",
-    "//ios/chrome/browser/ui/util:util",
     "//ios/chrome/browser/web_state_list:web_state_list",
     "//ios/web/public:public",
     "//net",
+    "//ui/base",
   ]
   configs += [ "//build/config/compiler:enable_arc" ]
 }
 
-source_set("popup_internal") {
+source_set("popup_ui") {
   sources = [
+    "autocomplete_result_consumer.h",
+    "autocomplete_suggestion.h",
+    "image_retriever.h",
+    "omnibox_popup_base_view_controller+internal.h",
+    "omnibox_popup_base_view_controller.h",
+    "omnibox_popup_base_view_controller.mm",
+    "omnibox_popup_legacy_view_controller.h",
+    "omnibox_popup_legacy_view_controller.mm",
     "omnibox_popup_row.h",
     "omnibox_popup_row.mm",
+    "omnibox_popup_row_cell.h",
+    "omnibox_popup_row_cell.mm",
+    "omnibox_popup_truncating_label.h",
+    "omnibox_popup_truncating_label.mm",
+    "omnibox_popup_view_controller.h",
+    "omnibox_popup_view_controller.mm",
     "self_sizing_table_view.h",
     "self_sizing_table_view.mm",
   ]
   deps = [
     "resources:omnibox_popup_tab_match",
     "//base",
-    "//components/image_fetcher/ios",
-    "//components/omnibox/browser",
-    "//ios/chrome/app/theme:theme",
-    "//ios/chrome/browser/browser_state",
+    "//components/omnibox/common",
+    "//ios/chrome/app/strings:ios_strings_grit",
+    "//ios/chrome/app/theme",
+    "//ios/chrome/browser/ui/commands",
     "//ios/chrome/browser/ui/omnibox:omnibox_popup_shared",
+    "//ios/chrome/browser/ui/toolbar/buttons",
     "//ios/chrome/browser/ui/toolbar/public",
     "//ios/chrome/browser/ui/util",
-    "//ios/chrome/browser/ui/util:util",
-    "//net",
+    "//ios/chrome/common/ui_util",
+    "//ui/base",
+    "//url",
+  ]
+  configs += [ "//build/config/compiler:enable_arc" ]
+}
+
+source_set("popup_internal") {
+  sources = [
+    "autocomplete_match_formatter.h",
+    "autocomplete_match_formatter.mm",
+  ]
+  deps = [
+    "//base",
+    "//components/omnibox/browser",
+    "//ios/chrome/browser/browser_state",
+    "//ios/chrome/browser/ui/omnibox:omnibox_util",
+    "//ios/chrome/browser/ui/util",
+    "//ios/third_party/material_components_ios",
+  ]
+
+  # Temporary until ios_internal CL is submitted
+  public_deps = [
+    ":popup_ui",
   ]
   configs += [ "//build/config/compiler:enable_arc" ]
 }
@@ -79,11 +109,11 @@
   deps = [
     ":popup",
     ":popup_internal",
+    ":popup_ui",
     "//base",
     "//components/omnibox/browser",
     "//ios/chrome/app/strings",
     "//ios/chrome/browser",
-    "//ios/chrome/browser/ui/omnibox:omnibox_internal",
     "//testing/gtest",
     "//ui/base",
   ]
@@ -96,6 +126,7 @@
   ]
   deps = [
     ":popup_internal",
+    ":popup_ui",
     "//base",
     "//base/test:test_support",
     "//components/omnibox/browser",
diff --git a/ios/chrome/browser/ui/omnibox/autocomplete_match_formatter.h b/ios/chrome/browser/ui/omnibox/popup/autocomplete_match_formatter.h
similarity index 61%
rename from ios/chrome/browser/ui/omnibox/autocomplete_match_formatter.h
rename to ios/chrome/browser/ui/omnibox/popup/autocomplete_match_formatter.h
index 02ae678..ec10cb8 100644
--- a/ios/chrome/browser/ui/omnibox/autocomplete_match_formatter.h
+++ b/ios/chrome/browser/ui/omnibox/popup/autocomplete_match_formatter.h
@@ -2,13 +2,13 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef IOS_CHROME_BROWSER_UI_OMNIBOX_AUTOCOMPLETE_MATCH_FORMATTER_H_
-#define IOS_CHROME_BROWSER_UI_OMNIBOX_AUTOCOMPLETE_MATCH_FORMATTER_H_
+#ifndef IOS_CHROME_BROWSER_UI_OMNIBOX_POPUP_AUTOCOMPLETE_MATCH_FORMATTER_H_
+#define IOS_CHROME_BROWSER_UI_OMNIBOX_POPUP_AUTOCOMPLETE_MATCH_FORMATTER_H_
 
-#import "ios/chrome/browser/ui/omnibox/autocomplete_suggestion.h"
+#import "ios/chrome/browser/ui/omnibox/popup/autocomplete_suggestion.h"
 
 struct AutocompleteMatch;
-@interface AutocompleteMatchFormatter : NSObject<AutocompleteSuggestion>
+@interface AutocompleteMatchFormatter : NSObject <AutocompleteSuggestion>
 
 // This is a temporary solution for coloring strings.
 @property(nonatomic, assign, getter=isIncognito) BOOL incognito;
@@ -23,4 +23,4 @@
 
 @end
 
-#endif  // IOS_CHROME_BROWSER_UI_OMNIBOX_AUTOCOMPLETE_MATCH_FORMATTER_H_
+#endif  // IOS_CHROME_BROWSER_UI_OMNIBOX_POPUP_AUTOCOMPLETE_MATCH_FORMATTER_H_
diff --git a/ios/chrome/browser/ui/omnibox/autocomplete_match_formatter.mm b/ios/chrome/browser/ui/omnibox/popup/autocomplete_match_formatter.mm
similarity index 95%
rename from ios/chrome/browser/ui/omnibox/autocomplete_match_formatter.mm
rename to ios/chrome/browser/ui/omnibox/popup/autocomplete_match_formatter.mm
index 533bd174..2f7e55d 100644
--- a/ios/chrome/browser/ui/omnibox/autocomplete_match_formatter.mm
+++ b/ios/chrome/browser/ui/omnibox/popup/autocomplete_match_formatter.mm
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#import "ios/chrome/browser/ui/omnibox/autocomplete_match_formatter.h"
+#import "ios/chrome/browser/ui/omnibox/popup/autocomplete_match_formatter.h"
 
 #import <UIKit/UIKit.h>
 
@@ -21,15 +21,15 @@
 namespace {
 // The color of the main text of a suggest cell.
 UIColor* SuggestionTextColor() {
-    return [UIColor blackColor];
+  return [UIColor blackColor];
 }
 // The color of the detail text of a suggest cell.
 UIColor* SuggestionDetailTextColor() {
-    return [UIColor colorWithWhite:0 alpha:0.41];
+  return [UIColor colorWithWhite:0 alpha:0.41];
 }
 // The color of the detail text of a suggest cell.
 UIColor* SuggestionDetailTextColorIncognito() {
-    return [UIColor colorWithWhite:1 alpha:0.5];
+  return [UIColor colorWithWhite:1 alpha:0.5];
 }
 // The color of the text in the portion of a search suggestion that matches the
 // omnibox input text.
@@ -331,11 +331,11 @@
 
 // Create a formatted string given text and classifications.
 - (NSMutableAttributedString*)
-attributedStringWithString:(NSString*)text
-           classifications:(const ACMatchClassifications*)classifications
-                 smallFont:(BOOL)smallFont
-                     color:(UIColor*)defaultColor
-                  dimColor:(UIColor*)dimColor {
+    attributedStringWithString:(NSString*)text
+               classifications:(const ACMatchClassifications*)classifications
+                     smallFont:(BOOL)smallFont
+                         color:(UIColor*)defaultColor
+                      dimColor:(UIColor*)dimColor {
   if (text == nil)
     return nil;
 
@@ -353,8 +353,8 @@
   [styledText addAttributes:dict range:NSMakeRange(0, [text length])];
 
   if (classifications != NULL) {
-    UIFont* boldFontRef =
-          [UIFont systemFontOfSize:fontRef.pointSize weight:UIFontWeightMedium];
+    UIFont* boldFontRef = [UIFont systemFontOfSize:fontRef.pointSize
+                                            weight:UIFontWeightMedium];
 
     for (ACMatchClassifications::const_iterator i = classifications->begin();
          i != classifications->end(); ++i) {
diff --git a/ios/chrome/browser/ui/omnibox/autocomplete_result_consumer.h b/ios/chrome/browser/ui/omnibox/popup/autocomplete_result_consumer.h
similarity index 79%
rename from ios/chrome/browser/ui/omnibox/autocomplete_result_consumer.h
rename to ios/chrome/browser/ui/omnibox/popup/autocomplete_result_consumer.h
index 9658e21..72af27c 100644
--- a/ios/chrome/browser/ui/omnibox/autocomplete_result_consumer.h
+++ b/ios/chrome/browser/ui/omnibox/popup/autocomplete_result_consumer.h
@@ -2,15 +2,15 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef IOS_CHROME_BROWSER_UI_OMNIBOX_AUTOCOMPLETE_RESULT_CONSUMER_H_
-#define IOS_CHROME_BROWSER_UI_OMNIBOX_AUTOCOMPLETE_RESULT_CONSUMER_H_
+#ifndef IOS_CHROME_BROWSER_UI_OMNIBOX_POPUP_AUTOCOMPLETE_RESULT_CONSUMER_H_
+#define IOS_CHROME_BROWSER_UI_OMNIBOX_POPUP_AUTOCOMPLETE_RESULT_CONSUMER_H_
 
-#import "ios/chrome/browser/ui/omnibox/autocomplete_suggestion.h"
+#import "ios/chrome/browser/ui/omnibox/popup/autocomplete_suggestion.h"
 
 @protocol AutocompleteResultConsumer;
 
 // Delegate for AutocompleteResultConsumer.
-@protocol AutocompleteResultConsumerDelegate<NSObject>
+@protocol AutocompleteResultConsumerDelegate <NSObject>
 
 // Tells the delegate when a row containing a suggestion is highlighted (i.e.
 // with arrow keys).
@@ -33,7 +33,7 @@
 @end
 
 // An abstract consumer of autocomplete results.
-@protocol AutocompleteResultConsumer<NSObject>
+@protocol AutocompleteResultConsumer <NSObject>
 // Updates the current data and forces a redraw. If animation is YES, adds
 // CALayer animations to fade the OmniboxPopupRows in.
 - (void)updateMatches:(NSArray<id<AutocompleteSuggestion>>*)result
@@ -42,4 +42,4 @@
 - (void)setTextAlignment:(NSTextAlignment)alignment;
 @end
 
-#endif  // IOS_CHROME_BROWSER_UI_OMNIBOX_AUTOCOMPLETE_RESULT_CONSUMER_H_
+#endif  // IOS_CHROME_BROWSER_UI_OMNIBOX_POPUP_AUTOCOMPLETE_RESULT_CONSUMER_H_
diff --git a/ios/chrome/browser/ui/omnibox/autocomplete_suggestion.h b/ios/chrome/browser/ui/omnibox/popup/autocomplete_suggestion.h
similarity index 82%
rename from ios/chrome/browser/ui/omnibox/autocomplete_suggestion.h
rename to ios/chrome/browser/ui/omnibox/popup/autocomplete_suggestion.h
index 5d25b91..b0abb11 100644
--- a/ios/chrome/browser/ui/omnibox/autocomplete_suggestion.h
+++ b/ios/chrome/browser/ui/omnibox/popup/autocomplete_suggestion.h
@@ -2,15 +2,15 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef IOS_CHROME_BROWSER_UI_OMNIBOX_AUTOCOMPLETE_SUGGESTION_H_
-#define IOS_CHROME_BROWSER_UI_OMNIBOX_AUTOCOMPLETE_SUGGESTION_H_
+#ifndef IOS_CHROME_BROWSER_UI_OMNIBOX_POPUP_AUTOCOMPLETE_SUGGESTION_H_
+#define IOS_CHROME_BROWSER_UI_OMNIBOX_POPUP_AUTOCOMPLETE_SUGGESTION_H_
 
 #import <UIKit/UIKit.h>
 
 class GURL;
 
 // Represents an autocomplete suggestion in UI.
-@protocol AutocompleteSuggestion<NSObject>
+@protocol AutocompleteSuggestion <NSObject>
 // Some suggestions can be deleted with a swipe-to-delete gesture.
 - (BOOL)supportsDeletion;
 // Some suggestions are answers that are displayed inline, such as for weather
@@ -42,4 +42,4 @@
 
 @end
 
-#endif  // IOS_CHROME_BROWSER_UI_OMNIBOX_AUTOCOMPLETE_SUGGESTION_H_
+#endif  // IOS_CHROME_BROWSER_UI_OMNIBOX_POPUP_AUTOCOMPLETE_SUGGESTION_H_
diff --git a/ios/chrome/browser/ui/omnibox/popup/image_retriever.h b/ios/chrome/browser/ui/omnibox/popup/image_retriever.h
new file mode 100644
index 0000000..0918c2f
--- /dev/null
+++ b/ios/chrome/browser/ui/omnibox/popup/image_retriever.h
@@ -0,0 +1,12 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef IOS_CHROME_BROWSER_UI_OMNIBOX_POPUP_IMAGE_RETRIEVER_H_
+#define IOS_CHROME_BROWSER_UI_OMNIBOX_POPUP_IMAGE_RETRIEVER_H_
+
+@protocol ImageRetriever <NSObject>
+- (void)fetchImage:(GURL)imageURL completion:(void (^)(UIImage*))completion;
+@end
+
+#endif  // IOS_CHROME_BROWSER_UI_OMNIBOX_POPUP_IMAGE_RETRIEVER_H_
diff --git a/ios/chrome/browser/ui/omnibox/popup/omnibox_popup_base_view_controller.h b/ios/chrome/browser/ui/omnibox/popup/omnibox_popup_base_view_controller.h
index 50e2621..d1398a3b 100644
--- a/ios/chrome/browser/ui/omnibox/popup/omnibox_popup_base_view_controller.h
+++ b/ios/chrome/browser/ui/omnibox/popup/omnibox_popup_base_view_controller.h
@@ -8,8 +8,8 @@
 #import <UIKit/UIKit.h>
 
 #import "ios/chrome/browser/ui/commands/omnibox_suggestion_commands.h"
-#import "ios/chrome/browser/ui/omnibox/autocomplete_result_consumer.h"
-#import "ios/chrome/browser/ui/omnibox/image_retriever.h"
+#import "ios/chrome/browser/ui/omnibox/popup/autocomplete_result_consumer.h"
+#import "ios/chrome/browser/ui/omnibox/popup/image_retriever.h"
 #import "ios/chrome/browser/ui/omnibox/popup/omnibox_popup_base_view_controller.h"
 #include "ios/chrome/browser/ui/omnibox/popup/omnibox_popup_row.h"
 
diff --git a/ios/chrome/browser/ui/omnibox/popup/omnibox_popup_legacy_view_controller.h b/ios/chrome/browser/ui/omnibox/popup/omnibox_popup_legacy_view_controller.h
index 89e54ea..280d7bc 100644
--- a/ios/chrome/browser/ui/omnibox/popup/omnibox_popup_legacy_view_controller.h
+++ b/ios/chrome/browser/ui/omnibox/popup/omnibox_popup_legacy_view_controller.h
@@ -6,8 +6,8 @@
 #define IOS_CHROME_BROWSER_UI_OMNIBOX_POPUP_OMNIBOX_POPUP_LEGACY_VIEW_CONTROLLER_H_
 
 #import "ios/chrome/browser/ui/commands/omnibox_suggestion_commands.h"
-#import "ios/chrome/browser/ui/omnibox/autocomplete_result_consumer.h"
-#import "ios/chrome/browser/ui/omnibox/image_retriever.h"
+#import "ios/chrome/browser/ui/omnibox/popup/autocomplete_result_consumer.h"
+#import "ios/chrome/browser/ui/omnibox/popup/image_retriever.h"
 #import "ios/chrome/browser/ui/omnibox/popup/omnibox_popup_base_view_controller.h"
 
 @interface OmniboxPopupLegacyViewController : OmniboxPopupBaseViewController
diff --git a/ios/chrome/browser/ui/omnibox/popup/omnibox_popup_legacy_view_controller.mm b/ios/chrome/browser/ui/omnibox/popup/omnibox_popup_legacy_view_controller.mm
index a9c8719..005217af 100644
--- a/ios/chrome/browser/ui/omnibox/popup/omnibox_popup_legacy_view_controller.mm
+++ b/ios/chrome/browser/ui/omnibox/popup/omnibox_popup_legacy_view_controller.mm
@@ -9,12 +9,11 @@
 
 #include "base/ios/ios_util.h"
 #include "base/metrics/histogram_macros.h"
-#import "ios/chrome/browser/ui/omnibox/image_retriever.h"
 #import "ios/chrome/browser/ui/omnibox/omnibox_constants.h"
-#import "ios/chrome/browser/ui/omnibox/omnibox_util.h"
+#import "ios/chrome/browser/ui/omnibox/popup/image_retriever.h"
 #import "ios/chrome/browser/ui/omnibox/popup/omnibox_popup_row.h"
+#import "ios/chrome/browser/ui/omnibox/popup/omnibox_popup_truncating_label.h"
 #import "ios/chrome/browser/ui/omnibox/popup/self_sizing_table_view.h"
-#import "ios/chrome/browser/ui/omnibox/truncating_attributed_label.h"
 #import "ios/chrome/browser/ui/toolbar/buttons/toolbar_configuration.h"
 #include "ios/chrome/browser/ui/util/animation_util.h"
 #include "ios/chrome/browser/ui/util/rtl_geometry.h"
@@ -24,6 +23,7 @@
 #include "ios/chrome/grit/ios_strings.h"
 #include "ios/chrome/grit/ios_theme_resources.h"
 #include "ui/base/l10n/l10n_util.h"
+#include "url/gurl.h"
 
 #if !defined(__has_feature) || !__has_feature(objc_arc)
 #error "This file requires ARC support."
diff --git a/ios/chrome/browser/ui/omnibox/popup/omnibox_popup_mediator.h b/ios/chrome/browser/ui/omnibox/popup/omnibox_popup_mediator.h
index 7c77323d..4e5499c 100644
--- a/ios/chrome/browser/ui/omnibox/popup/omnibox_popup_mediator.h
+++ b/ios/chrome/browser/ui/omnibox/popup/omnibox_popup_mediator.h
@@ -8,8 +8,8 @@
 #import <UIKit/UIKit.h>
 #include "components/omnibox/browser/autocomplete_result.h"
 
-#import "ios/chrome/browser/ui/omnibox/autocomplete_result_consumer.h"
-#import "ios/chrome/browser/ui/omnibox/image_retriever.h"
+#import "ios/chrome/browser/ui/omnibox/popup/autocomplete_result_consumer.h"
+#import "ios/chrome/browser/ui/omnibox/popup/image_retriever.h"
 #include "ui/base/window_open_disposition.h"
 
 @protocol BrowserCommands;
diff --git a/ios/chrome/browser/ui/omnibox/popup/omnibox_popup_mediator.mm b/ios/chrome/browser/ui/omnibox/popup/omnibox_popup_mediator.mm
index ae0ee243..9af79a2 100644
--- a/ios/chrome/browser/ui/omnibox/popup/omnibox_popup_mediator.mm
+++ b/ios/chrome/browser/ui/omnibox/popup/omnibox_popup_mediator.mm
@@ -14,7 +14,7 @@
 #include "components/omnibox/common/omnibox_features.h"
 #import "ios/chrome/browser/ui/commands/browser_commands.h"
 #import "ios/chrome/browser/ui/ntp/ntp_util.h"
-#import "ios/chrome/browser/ui/omnibox/autocomplete_match_formatter.h"
+#import "ios/chrome/browser/ui/omnibox/popup/autocomplete_match_formatter.h"
 #import "ios/chrome/browser/ui/omnibox/popup/omnibox_popup_presenter.h"
 #import "ios/chrome/browser/web_state_list/web_state_list.h"
 
diff --git a/ios/chrome/browser/ui/omnibox/popup/omnibox_popup_row.mm b/ios/chrome/browser/ui/omnibox/popup/omnibox_popup_row.mm
index 57dbf0ce..4572e20c 100644
--- a/ios/chrome/browser/ui/omnibox/popup/omnibox_popup_row.mm
+++ b/ios/chrome/browser/ui/omnibox/popup/omnibox_popup_row.mm
@@ -7,7 +7,7 @@
 #include "base/feature_list.h"
 #include "base/logging.h"
 #include "components/omnibox/common/omnibox_features.h"
-#import "ios/chrome/browser/ui/omnibox/truncating_attributed_label.h"
+#import "ios/chrome/browser/ui/omnibox/popup/omnibox_popup_truncating_label.h"
 #import "ios/chrome/browser/ui/toolbar/public/toolbar_constants.h"
 #include "ios/chrome/browser/ui/util/rtl_geometry.h"
 #include "ios/chrome/browser/ui/util/ui_util.h"
diff --git a/ios/chrome/browser/ui/omnibox/popup/omnibox_popup_row_cell.h b/ios/chrome/browser/ui/omnibox/popup/omnibox_popup_row_cell.h
new file mode 100644
index 0000000..69d9931
--- /dev/null
+++ b/ios/chrome/browser/ui/omnibox/popup/omnibox_popup_row_cell.h
@@ -0,0 +1,25 @@
+// Copyright 2019 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef IOS_CHROME_BROWSER_UI_OMNIBOX_POPUP_OMNIBOX_POPUP_ROW_CELL_H_
+#define IOS_CHROME_BROWSER_UI_OMNIBOX_POPUP_OMNIBOX_POPUP_ROW_CELL_H_
+
+#import <UIKit/UIKit.h>
+
+@protocol AutocompleteSuggestion;
+
+namespace {
+NSString* OmniboxPopupRowCellReuseIdentifier = @"OmniboxPopupRowCell";
+}  // namespace
+
+// Table view cell to display an autocomplete suggestion in the omnibox popup.
+// It handles all the layout logic internally.
+@interface OmniboxPopupRowCell : UITableViewCell
+
+- (void)setupWithAutocompleteSuggestion:(id<AutocompleteSuggestion>)suggestion
+                              incognito:(BOOL)incognito;
+
+@end
+
+#endif  // IOS_CHROME_BROWSER_UI_OMNIBOX_POPUP_OMNIBOX_POPUP_ROW_CELL_H_
diff --git a/ios/chrome/browser/ui/omnibox/popup/omnibox_popup_row_cell.mm b/ios/chrome/browser/ui/omnibox/popup/omnibox_popup_row_cell.mm
new file mode 100644
index 0000000..53ac8b46
--- /dev/null
+++ b/ios/chrome/browser/ui/omnibox/popup/omnibox_popup_row_cell.mm
@@ -0,0 +1,95 @@
+// Copyright 2019 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#import "ios/chrome/browser/ui/omnibox/popup/omnibox_popup_row_cell.h"
+
+#import "ios/chrome/browser/ui/omnibox/popup/autocomplete_suggestion.h"
+#import "ios/chrome/browser/ui/omnibox/popup/omnibox_popup_truncating_label.h"
+
+#if !defined(__has_feature) || !__has_feature(objc_arc)
+#error "This file requires ARC support."
+#endif
+
+namespace {
+const CGFloat kLeadingMargin = 24;
+const CGFloat kVerticalSpace = 6;
+}  // namespace
+
+@interface OmniboxPopupRowCell ()
+
+@property(nonatomic, strong) OmniboxPopupTruncatingLabel* textTruncatingLabel;
+@property(nonatomic, strong) OmniboxPopupTruncatingLabel* detailTruncatingLabel;
+
+@property(nonatomic, assign) BOOL incognito;
+
+@end
+
+@implementation OmniboxPopupRowCell
+
+- (instancetype)initWithStyle:(UITableViewCellStyle)style
+              reuseIdentifier:(NSString*)reuseIdentifier {
+  self = [super initWithStyle:style reuseIdentifier:reuseIdentifier];
+  if (self) {
+    _textTruncatingLabel =
+        [[OmniboxPopupTruncatingLabel alloc] initWithFrame:CGRectZero];
+    _detailTruncatingLabel =
+        [[OmniboxPopupTruncatingLabel alloc] initWithFrame:CGRectZero];
+
+    _incognito = NO;
+
+    self.backgroundColor = [UIColor clearColor];
+  }
+  return self;
+}
+
+- (void)setupLayout {
+  self.textTruncatingLabel.translatesAutoresizingMaskIntoConstraints = NO;
+  [self.contentView addSubview:self.textTruncatingLabel];
+  self.detailTruncatingLabel.translatesAutoresizingMaskIntoConstraints = NO;
+  [self.contentView addSubview:self.detailTruncatingLabel];
+
+  UILayoutGuide* safeAreaLayoutGuide = self.contentView.safeAreaLayoutGuide;
+
+  [NSLayoutConstraint activateConstraints:@[
+    [self.textTruncatingLabel.leadingAnchor
+        constraintEqualToAnchor:safeAreaLayoutGuide.leadingAnchor
+                       constant:kLeadingMargin],
+    [self.textTruncatingLabel.trailingAnchor
+        constraintEqualToAnchor:safeAreaLayoutGuide.trailingAnchor],
+    [self.textTruncatingLabel.topAnchor
+        constraintEqualToAnchor:safeAreaLayoutGuide.topAnchor
+                       constant:kVerticalSpace],
+
+    [self.detailTruncatingLabel.leadingAnchor
+        constraintEqualToAnchor:safeAreaLayoutGuide.leadingAnchor
+                       constant:kLeadingMargin],
+    [self.detailTruncatingLabel.trailingAnchor
+        constraintEqualToAnchor:safeAreaLayoutGuide.trailingAnchor],
+    [self.detailTruncatingLabel.topAnchor
+        constraintEqualToAnchor:self.textTruncatingLabel.bottomAnchor
+                       constant:kVerticalSpace],
+    [self.detailTruncatingLabel.bottomAnchor
+        constraintEqualToAnchor:safeAreaLayoutGuide.bottomAnchor],
+  ]];
+}
+
+- (void)prepareForReuse {
+  [super prepareForReuse];
+
+  self.incognito = NO;
+}
+
+- (void)setupWithAutocompleteSuggestion:(id<AutocompleteSuggestion>)suggestion
+                              incognito:(BOOL)incognito {
+  // Setup the view layout the first time the cell is setup.
+  if (self.contentView.subviews.count == 0) {
+    [self setupLayout];
+  }
+  self.incognito = incognito;
+
+  self.textTruncatingLabel.attributedText = suggestion.text;
+  self.detailTruncatingLabel.attributedText = suggestion.detailText;
+}
+
+@end
diff --git a/ios/chrome/browser/ui/omnibox/truncating_attributed_label.h b/ios/chrome/browser/ui/omnibox/popup/omnibox_popup_truncating_label.h
similarity index 79%
rename from ios/chrome/browser/ui/omnibox/truncating_attributed_label.h
rename to ios/chrome/browser/ui/omnibox/popup/omnibox_popup_truncating_label.h
index a1ad1b6..ed6cf88 100644
--- a/ios/chrome/browser/ui/omnibox/truncating_attributed_label.h
+++ b/ios/chrome/browser/ui/omnibox/popup/omnibox_popup_truncating_label.h
@@ -2,12 +2,11 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef IOS_CHROME_BROWSER_UI_OMNIBOX_TRUNCATING_ATTRIBUTED_LABEL_H_
-#define IOS_CHROME_BROWSER_UI_OMNIBOX_TRUNCATING_ATTRIBUTED_LABEL_H_
+#ifndef IOS_CHROME_BROWSER_UI_OMNIBOX_POPUP_OMNIBOX_POPUP_TRUNCATING_LABEL_H_
+#define IOS_CHROME_BROWSER_UI_OMNIBOX_POPUP_OMNIBOX_POPUP_TRUNCATING_LABEL_H_
 
 #import <UIKit/UIKit.h>
 
-
 typedef enum {
   OmniboxPopupTruncatingTail = 0x1,
   OmniboxPopupTruncatingHead = 0x2,
@@ -29,4 +28,4 @@
 
 @end
 
-#endif  // IOS_CHROME_BROWSER_UI_OMNIBOX_TRUNCATING_ATTRIBUTED_LABEL_H_
+#endif  // IOS_CHROME_BROWSER_UI_OMNIBOX_POPUP_OMNIBOX_POPUP_TRUNCATING_LABEL_H_
diff --git a/ios/chrome/browser/ui/omnibox/truncating_attributed_label.mm b/ios/chrome/browser/ui/omnibox/popup/omnibox_popup_truncating_label.mm
similarity index 97%
rename from ios/chrome/browser/ui/omnibox/truncating_attributed_label.mm
rename to ios/chrome/browser/ui/omnibox/popup/omnibox_popup_truncating_label.mm
index 328c55d..a30d2904 100644
--- a/ios/chrome/browser/ui/omnibox/truncating_attributed_label.mm
+++ b/ios/chrome/browser/ui/omnibox/popup/omnibox_popup_truncating_label.mm
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#import "ios/chrome/browser/ui/omnibox/truncating_attributed_label.h"
+#import "ios/chrome/browser/ui/omnibox/popup/omnibox_popup_truncating_label.h"
 
 #include <algorithm>
 
diff --git a/ios/chrome/browser/ui/omnibox/popup/omnibox_popup_view_controller.h b/ios/chrome/browser/ui/omnibox/popup/omnibox_popup_view_controller.h
new file mode 100644
index 0000000..5f37eaa
--- /dev/null
+++ b/ios/chrome/browser/ui/omnibox/popup/omnibox_popup_view_controller.h
@@ -0,0 +1,13 @@
+// Copyright 2019 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef IOS_CHROME_BROWSER_UI_OMNIBOX_POPUP_OMNIBOX_POPUP_VIEW_CONTROLLER_H_
+#define IOS_CHROME_BROWSER_UI_OMNIBOX_POPUP_OMNIBOX_POPUP_VIEW_CONTROLLER_H_
+
+#import "ios/chrome/browser/ui/omnibox/popup/omnibox_popup_base_view_controller.h"
+
+@interface OmniboxPopupViewController : OmniboxPopupBaseViewController
+@end
+
+#endif  // IOS_CHROME_BROWSER_UI_OMNIBOX_POPUP_OMNIBOX_POPUP_VIEW_CONTROLLER_H_
diff --git a/ios/chrome/browser/ui/omnibox/popup/omnibox_popup_view_controller.mm b/ios/chrome/browser/ui/omnibox/popup/omnibox_popup_view_controller.mm
new file mode 100644
index 0000000..9d8de219
--- /dev/null
+++ b/ios/chrome/browser/ui/omnibox/popup/omnibox_popup_view_controller.mm
@@ -0,0 +1,68 @@
+// Copyright 2019 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#import "ios/chrome/browser/ui/omnibox/popup/omnibox_popup_view_controller.h"
+#import "ios/chrome/browser/ui/omnibox/popup/omnibox_popup_base_view_controller+internal.h"
+
+#import "base/logging.h"
+#import "ios/chrome/browser/ui/omnibox/popup/omnibox_popup_row_cell.h"
+
+#if !defined(__has_feature) || !__has_feature(objc_arc)
+#error "This file requires ARC support."
+#endif
+
+@implementation OmniboxPopupViewController
+
+- (void)viewDidLoad {
+  [super viewDidLoad];
+
+  self.tableView.rowHeight = UITableViewAutomaticDimension;
+  self.tableView.estimatedRowHeight = 44;
+
+  [self.tableView registerClass:[OmniboxPopupRowCell class]
+         forCellReuseIdentifier:OmniboxPopupRowCellReuseIdentifier];
+}
+
+#pragma mark - UIScrollViewDelegate
+
+- (void)scrollViewDidScroll:(UIScrollView*)scrollView {
+  [super scrollViewDidScroll:scrollView];
+
+  // TODO(crbug.com/733650): Default to the dragging check once it's been tested
+  // on trunk.
+  if (!scrollView.dragging)
+    return;
+
+  [self.tableView deselectRowAtIndexPath:self.tableView.indexPathForSelectedRow
+                                animated:NO];
+}
+
+#pragma mark - Table view data source
+
+- (CGFloat)tableView:(UITableView*)tableView
+    heightForRowAtIndexPath:(NSIndexPath*)indexPath {
+  return UITableViewAutomaticDimension;
+}
+
+// Customize the appearance of table view cells.
+- (UITableViewCell*)tableView:(UITableView*)tableView
+        cellForRowAtIndexPath:(NSIndexPath*)indexPath {
+  DCHECK_EQ(0U, (NSUInteger)indexPath.section);
+
+  if (self.shortcutsEnabled && indexPath.row == 0 &&
+      self.currentResult.count == 0) {
+    return self.shortcutsCell;
+  }
+
+  DCHECK_LT((NSUInteger)indexPath.row, self.currentResult.count);
+  OmniboxPopupRowCell* cell = [self.tableView
+      dequeueReusableCellWithIdentifier:OmniboxPopupRowCellReuseIdentifier
+                           forIndexPath:indexPath];
+  [cell setupWithAutocompleteSuggestion:self.currentResult[indexPath.row]
+                              incognito:self.incognito];
+
+  return cell;
+}
+
+@end
diff --git a/ios/chrome/browser/ui/omnibox/popup/omnibox_popup_view_controller_unittest.mm b/ios/chrome/browser/ui/omnibox/popup/omnibox_popup_view_controller_unittest.mm
index 407e36f..96b2d6f7 100644
--- a/ios/chrome/browser/ui/omnibox/popup/omnibox_popup_view_controller_unittest.mm
+++ b/ios/chrome/browser/ui/omnibox/popup/omnibox_popup_view_controller_unittest.mm
@@ -5,7 +5,7 @@
 #import "ios/chrome/browser/ui/omnibox/popup/omnibox_popup_legacy_view_controller.h"
 
 #include "components/omnibox/browser/autocomplete_match.h"
-#import "ios/chrome/browser/ui/omnibox/autocomplete_match_formatter.h"
+#import "ios/chrome/browser/ui/omnibox/popup/autocomplete_match_formatter.h"
 #import "ios/chrome/browser/ui/omnibox/popup/omnibox_popup_row.h"
 #include "testing/gtest_mac.h"
 #include "testing/platform_test.h"
diff --git a/ios/chrome/browser/ui/omnibox/popup/omnibox_popup_view_ios.mm b/ios/chrome/browser/ui/omnibox/popup/omnibox_popup_view_ios.mm
index 89298d3..31934e8a 100644
--- a/ios/chrome/browser/ui/omnibox/popup/omnibox_popup_view_ios.mm
+++ b/ios/chrome/browser/ui/omnibox/popup/omnibox_popup_view_ios.mm
@@ -26,7 +26,6 @@
 #include "ios/chrome/grit/ios_theme_resources.h"
 #include "ios/web/public/web_thread.h"
 #include "net/url_request/url_request_context_getter.h"
-#include "ui/gfx/geometry/rect.h"
 
 #if !defined(__has_feature) || !__has_feature(objc_arc)
 #error "This file requires ARC support."
diff --git a/ios/chrome/browser/ui/settings/clear_browsing_data/clear_browsing_data_collection_view_controller.mm b/ios/chrome/browser/ui/settings/clear_browsing_data/clear_browsing_data_collection_view_controller.mm
index 1722652..c26a747 100644
--- a/ios/chrome/browser/ui/settings/clear_browsing_data/clear_browsing_data_collection_view_controller.mm
+++ b/ios/chrome/browser/ui/settings/clear_browsing_data/clear_browsing_data_collection_view_controller.mm
@@ -154,8 +154,6 @@
       scoped_observer_->Add(
           BrowsingDataRemoverFactory::GetForBrowserState(browserState));
     }
-
-    [self restartCounters:BrowsingDataRemoveMask::REMOVE_ALL];
   }
   return self;
 }
@@ -166,6 +164,11 @@
   [self loadModel];
 }
 
+- (void)viewWillAppear:(BOOL)animated {
+  [super viewWillAppear:animated];
+  [self restartCounters:BrowsingDataRemoveMask::REMOVE_ALL];
+}
+
 #pragma mark CollectionViewController
 
 - (void)loadModel {
@@ -306,17 +309,9 @@
       if (clearDataItem.accessoryType == MDCCollectionViewCellAccessoryNone) {
         clearDataItem.accessoryType = MDCCollectionViewCellAccessoryCheckmark;
         _browserState->GetPrefs()->SetBoolean(clearDataItem.prefName, true);
-        if (itemType == ItemTypeDataTypeCookiesSiteData &&
-            IsNewClearBrowsingDataUIEnabled()) {
-          [self updateCounter:itemType
-                   detailText:l10n_util::GetNSString(IDS_DEL_COOKIES_COUNTER)];
-        }
       } else {
         clearDataItem.accessoryType = MDCCollectionViewCellAccessoryNone;
         _browserState->GetPrefs()->SetBoolean(clearDataItem.prefName, false);
-        if (IsNewClearBrowsingDataUIEnabled()) {
-          [self updateCounter:itemType detailText:@""];
-        }
       }
       [self reconfigureCellsForItems:@[ clearDataItem ]];
       break;
@@ -378,6 +373,16 @@
     [historyItem restartCounter];
   }
 
+  if (IsRemoveDataMaskSet(mask, BrowsingDataRemoveMask::REMOVE_CACHE)) {
+    NSIndexPath* indexPath = [self.collectionViewModel
+        indexPathForItemType:ItemTypeDataTypeCache
+           sectionIdentifier:SectionIdentifierDataTypes];
+    ClearBrowsingDataItem* cacheItem =
+        base::mac::ObjCCastStrict<ClearBrowsingDataItem>(
+            [model itemAtIndexPath:indexPath]);
+    [cacheItem restartCounter];
+  }
+
   if (IsRemoveDataMaskSet(mask, BrowsingDataRemoveMask::REMOVE_PASSWORDS)) {
     NSIndexPath* indexPath = [self.collectionViewModel
         indexPathForItemType:ItemTypeDataTypeSavedPasswords
diff --git a/ios/chrome/browser/ui/settings/clear_browsing_data/clear_browsing_data_manager.mm b/ios/chrome/browser/ui/settings/clear_browsing_data/clear_browsing_data_manager.mm
index 96a0c0a..57bc0ee 100644
--- a/ios/chrome/browser/ui/settings/clear_browsing_data/clear_browsing_data_manager.mm
+++ b/ios/chrome/browser/ui/settings/clear_browsing_data/clear_browsing_data_manager.mm
@@ -385,8 +385,7 @@
     // Because there is no counter for cookies, an explanatory text is
     // displayed.
     if (itemType == ItemTypeDataTypeCookiesSiteData &&
-        IsNewClearBrowsingDataUIEnabled() &&
-        prefs->GetBoolean(browsing_data::prefs::kDeleteCookies)) {
+        IsNewClearBrowsingDataUIEnabled()) {
       collectionClearDataItem.detailText =
           l10n_util::GetNSString(IDS_DEL_COOKIES_COUNTER);
     }
diff --git a/ios/chrome/browser/ui/toolbar/BUILD.gn b/ios/chrome/browser/ui/toolbar/BUILD.gn
index a6420c2..c7071ad 100644
--- a/ios/chrome/browser/ui/toolbar/BUILD.gn
+++ b/ios/chrome/browser/ui/toolbar/BUILD.gn
@@ -169,7 +169,7 @@
     "//ios/chrome/browser/ui/omnibox:omnibox_internal",
     "//ios/chrome/browser/ui/omnibox/popup",
     "//ios/chrome/browser/ui/omnibox/popup:popup_internal",
-    "//ios/chrome/browser/ui/omnibox/popup:popup_internal",
+    "//ios/chrome/browser/ui/omnibox/popup:popup_ui",
     "//ios/chrome/browser/ui/popup_menu:constants",
     "//ios/chrome/browser/ui/tab_grid:egtest_support",
     "//ios/chrome/browser/ui/toolbar/buttons",
diff --git a/ios/net/http_cache_helper.cc b/ios/net/http_cache_helper.cc
index 371f826f..0c9c72aa 100644
--- a/ios/net/http_cache_helper.cc
+++ b/ios/net/http_cache_helper.cc
@@ -9,9 +9,11 @@
 #include "base/bind.h"
 #include "base/bind_helpers.h"
 #include "base/callback.h"
+#include "base/callback_helpers.h"
 #include "base/location.h"
 #include "base/task_runner.h"
 #include "base/threading/thread_task_runner_handle.h"
+#include "net/base/completion_repeating_callback.h"
 #include "net/disk_cache/disk_cache.h"
 #include "net/http/http_cache.h"
 #include "net/http/http_network_session.h"
@@ -25,9 +27,9 @@
 
 // Posts |callback| on |task_runner|.
 void PostCallback(const scoped_refptr<base::TaskRunner>& task_runner,
-                  const net::CompletionCallback& callback,
+                  net::CompletionOnceCallback callback,
                   int error) {
-  task_runner->PostTask(FROM_HERE, base::BindOnce(callback, error));
+  task_runner->PostTask(FROM_HERE, base::BindOnce(std::move(callback), error));
 }
 
 // Clears the disk_cache::Backend on the IO thread and deletes |backend|.
@@ -35,19 +37,23 @@
                    const scoped_refptr<base::TaskRunner>& client_task_runner,
                    const base::Time& delete_begin,
                    const base::Time& delete_end,
-                   const net::CompletionCallback& callback,
+                   net::CompletionOnceCallback callback,
                    int error) {
   // |*backend| may be null in case of error.
   if (*backend) {
+    net::CompletionRepeatingCallback copyable_callback =
+        base::AdaptCallbackForRepeating(std::move(callback));
     const int rv = (*backend)->DoomEntriesBetween(
         delete_begin, delete_end,
-        base::Bind(&PostCallback, client_task_runner, callback));
+        base::BindOnce(&PostCallback, client_task_runner, copyable_callback));
     // DoomEntriesBetween does not invoke callback unless rv is ERR_IO_PENDING.
     if (rv != net::ERR_IO_PENDING) {
-      client_task_runner->PostTask(FROM_HERE, base::BindOnce(callback, rv));
+      client_task_runner->PostTask(FROM_HERE,
+                                   base::BindOnce(copyable_callback, rv));
     }
   } else {
-    client_task_runner->PostTask(FROM_HERE, base::BindOnce(callback, error));
+    client_task_runner->PostTask(FROM_HERE,
+                                 base::BindOnce(std::move(callback), error));
   }
 }
 
@@ -58,7 +64,7 @@
     const scoped_refptr<base::TaskRunner>& client_task_runner,
     const base::Time& delete_begin,
     const base::Time& delete_end,
-    const net::CompletionCallback& callback) {
+    net::CompletionOnceCallback callback) {
   net::HttpCache* http_cache =
       getter->GetURLRequestContext()->http_transaction_factory()->GetCache();
 
@@ -70,9 +76,11 @@
   std::unique_ptr<disk_cache::Backend*> backend(
       new disk_cache::Backend*(nullptr));
   disk_cache::Backend** backend_ptr = backend.get();
-  net::CompletionCallback doom_callback =
-      base::Bind(&DoomHttpCache, base::Passed(std::move(backend)),
-                 client_task_runner, delete_begin, delete_end, callback);
+
+  net::CompletionRepeatingCallback doom_callback =
+      base::AdaptCallbackForRepeating(
+          base::BindOnce(&DoomHttpCache, std::move(backend), client_task_runner,
+                         delete_begin, delete_end, std::move(callback)));
 
   const int rv = http_cache->GetBackend(backend_ptr, doom_callback);
   if (rv != net::ERR_IO_PENDING) {
@@ -90,12 +98,12 @@
                     const scoped_refptr<base::TaskRunner>& network_task_runner,
                     const base::Time& delete_begin,
                     const base::Time& delete_end,
-                    const net::CompletionCallback& callback) {
+                    net::CompletionOnceCallback callback) {
   DCHECK(delete_end != base::Time());
   network_task_runner->PostTask(
       FROM_HERE, base::BindOnce(&ClearHttpCacheOnIOThread, getter,
                                 base::ThreadTaskRunnerHandle::Get(),
-                                delete_begin, delete_end, callback));
+                                delete_begin, delete_end, std::move(callback)));
 }
 
 }  // namespace net
diff --git a/ios/net/http_cache_helper.h b/ios/net/http_cache_helper.h
index f8b333d..c8a7c77 100644
--- a/ios/net/http_cache_helper.h
+++ b/ios/net/http_cache_helper.h
@@ -7,7 +7,7 @@
 
 #include "base/callback_forward.h"
 #include "base/memory/ref_counted.h"
-#include "net/base/completion_callback.h"
+#include "net/base/completion_once_callback.h"
 
 namespace base {
 class TaskRunner;
@@ -21,7 +21,7 @@
                     const scoped_refptr<base::TaskRunner>& network_task_runner,
                     const base::Time& delete_begin,
                     const base::Time& delete_end,
-                    const net::CompletionCallback& callback);
+                    net::CompletionOnceCallback callback);
 
 }  // namespace net
 
diff --git a/ios/showcase/omnibox_popup/BUILD.gn b/ios/showcase/omnibox_popup/BUILD.gn
index cab3a87..3837df8e 100644
--- a/ios/showcase/omnibox_popup/BUILD.gn
+++ b/ios/showcase/omnibox_popup/BUILD.gn
@@ -14,12 +14,11 @@
     "sc_omnibox_popup_mediator.mm",
   ]
   deps = [
-    "//ios/chrome/browser/ui/omnibox:omnibox_internal",
-    "//ios/chrome/browser/ui/omnibox:omnibox_util",
-    "//ios/chrome/browser/ui/omnibox/popup",
+    "//ios/chrome/browser/ui/omnibox/popup:popup_ui",
     "//ios/chrome/browser/ui/toolbar/buttons",
     "//ios/chrome/common/ui_util",
     "//ios/showcase/common",
+    "//url",
   ]
   libs = [ "UIKit.framework" ]
   configs += [ "//build/config/compiler:enable_arc" ]
diff --git a/ios/showcase/omnibox_popup/fake_autocomplete_suggestion.h b/ios/showcase/omnibox_popup/fake_autocomplete_suggestion.h
index 58ca099..bb8668d 100644
--- a/ios/showcase/omnibox_popup/fake_autocomplete_suggestion.h
+++ b/ios/showcase/omnibox_popup/fake_autocomplete_suggestion.h
@@ -7,8 +7,7 @@
 
 #import <UIKit/UIKit.h>
 
-#import "ios/chrome/browser/ui/omnibox/autocomplete_suggestion.h"
-#import "ios/chrome/browser/ui/omnibox/omnibox_util.h"
+#import "ios/chrome/browser/ui/omnibox/popup/autocomplete_suggestion.h"
 
 // Fake class implementing AutocompleteSuggestion for Showcase.
 @interface FakeAutocompleteSuggestion : NSObject <AutocompleteSuggestion>
@@ -21,7 +20,7 @@
 @property(nonatomic) NSAttributedString* text;
 @property(nonatomic) NSAttributedString* detailText;
 @property(nonatomic) NSInteger numberOfLines;
-@property(nonatomic) OmniboxSuggestionIconType iconType;
+@property(nonatomic) UIImage* suggestionTypeIcon;
 @property(nonatomic) GURL imageURL;
 
 @end
diff --git a/ios/showcase/omnibox_popup/fake_autocomplete_suggestion.mm b/ios/showcase/omnibox_popup/fake_autocomplete_suggestion.mm
index 2409c83..6fc3923a 100644
--- a/ios/showcase/omnibox_popup/fake_autocomplete_suggestion.mm
+++ b/ios/showcase/omnibox_popup/fake_autocomplete_suggestion.mm
@@ -19,16 +19,14 @@
     _text = [[NSAttributedString alloc] initWithString:@""];
     _detailText = [[NSAttributedString alloc] initWithString:@""];
     _numberOfLines = 1;
-    _iconType = DEFAULT_FAVICON;
+    _suggestionTypeIcon =
+        [[UIImage imageNamed:@"omnibox_completion_default_favicon"]
+            imageWithRenderingMode:UIImageRenderingModeAlwaysTemplate];
     _imageURL = GURL();
   }
   return self;
 }
 
-- (UIImage*)suggestionTypeIcon {
-  return GetOmniboxSuggestionIcon(self.iconType);
-}
-
 - (BOOL)hasImage {
   return self.imageURL.is_valid();
 }
diff --git a/ios/showcase/omnibox_popup/sc_omnibox_popup_mediator.mm b/ios/showcase/omnibox_popup/sc_omnibox_popup_mediator.mm
index 6c3f2e7..1d2a4f9 100644
--- a/ios/showcase/omnibox_popup/sc_omnibox_popup_mediator.mm
+++ b/ios/showcase/omnibox_popup/sc_omnibox_popup_mediator.mm
@@ -4,13 +4,129 @@
 
 #import "ios/showcase/omnibox_popup/sc_omnibox_popup_mediator.h"
 
-#import "ios/chrome/browser/ui/omnibox/autocomplete_result_consumer.h"
+#import "ios/chrome/browser/ui/omnibox/popup/autocomplete_result_consumer.h"
 #import "ios/showcase/omnibox_popup/fake_autocomplete_suggestion.h"
+#import "url/gurl.h"
 
 #if !defined(__has_feature) || !__has_feature(objc_arc)
 #error "This file requires ARC support."
 #endif
 
+namespace {
+// Spacer attributed string for dividing parts of an autocomplete suggestion's
+// text and detail text.
+NSAttributedString* spacer() {
+  return [[NSAttributedString alloc] initWithString:@"  "];
+}
+
+// Detail text for an autocomplete suggestion representing weather
+NSAttributedString* weatherDetailText() {
+  NSAttributedString* number = [[NSAttributedString alloc]
+      initWithString:@"18"
+          attributes:@{
+            NSFontAttributeName : [UIFont systemFontOfSize:24],
+            NSForegroundColorAttributeName : [UIColor grayColor],
+          }];
+  NSAttributedString* degreeSymbol = [[NSAttributedString alloc]
+      initWithString:@"°C"
+          attributes:@{
+            NSFontAttributeName : [UIFont systemFontOfSize:12],
+            NSBaselineOffsetAttributeName : @10.0f,
+            NSForegroundColorAttributeName : [UIColor grayColor],
+          }];
+  NSAttributedString* date = [[NSAttributedString alloc]
+      initWithString:@"ven."
+          attributes:@{
+            NSFontAttributeName : [UIFont systemFontOfSize:12],
+            NSForegroundColorAttributeName : [UIColor grayColor],
+          }];
+
+  NSMutableAttributedString* answer =
+      [[NSMutableAttributedString alloc] initWithAttributedString:number];
+  [answer appendAttributedString:degreeSymbol];
+  [answer appendAttributedString:spacer()];
+  [answer appendAttributedString:date];
+
+  return [answer copy];
+}
+
+// Main text for an autocomplete suggestion representing stock price
+NSAttributedString* stockText() {
+  NSAttributedString* search = [[NSAttributedString alloc]
+      initWithString:@"goog stock"
+          attributes:@{
+            NSFontAttributeName : [UIFont systemFontOfSize:16],
+          }];
+  NSAttributedString* priceSource = [[NSAttributedString alloc]
+      initWithString:@"GOOG (NASDAQ), 13:18 UTC−4"
+          attributes:@{
+            NSFontAttributeName : [UIFont systemFontOfSize:12],
+            NSForegroundColorAttributeName : [UIColor grayColor],
+          }];
+  NSMutableAttributedString* answer =
+      [[NSMutableAttributedString alloc] initWithAttributedString:search];
+  [answer appendAttributedString:spacer()];
+  [answer appendAttributedString:priceSource];
+  return [answer copy];
+}
+
+// Detail text for an autocomplete suggestion representing stock price
+NSAttributedString* stockDetailText() {
+  NSAttributedString* price = [[NSAttributedString alloc]
+      initWithString:@"1 209,29"
+          attributes:@{
+            NSFontAttributeName : [UIFont systemFontOfSize:24],
+            NSForegroundColorAttributeName : [UIColor grayColor],
+          }];
+  NSAttributedString* priceChange = [[NSAttributedString alloc]
+      initWithString:@"-22,25 (-1,81%)"
+          attributes:@{
+            NSFontAttributeName : [UIFont systemFontOfSize:16],
+            NSForegroundColorAttributeName : [UIColor colorWithRed:197 / 255.0
+                                                             green:57 / 255.0
+                                                              blue:41 / 255.0
+                                                             alpha:1.0],
+          }];
+  NSMutableAttributedString* answer =
+      [[NSMutableAttributedString alloc] initWithAttributedString:price];
+  [answer appendAttributedString:spacer()];
+  [answer appendAttributedString:priceChange];
+  return [answer copy];
+}
+
+// Main text for an autocomplete suggestion representing a word definition
+NSAttributedString* definitionText() {
+  NSAttributedString* searchText = [[NSAttributedString alloc]
+      initWithString:@"define government"
+          attributes:@{
+            NSFontAttributeName : [UIFont systemFontOfSize:16],
+          }];
+  NSAttributedString* pronunciation = [[NSAttributedString alloc]
+      initWithString:@"• /ˈɡʌv(É™)nËŒm(É™)nt/"
+          attributes:@{
+            NSFontAttributeName : [UIFont systemFontOfSize:14],
+            NSForegroundColorAttributeName : [UIColor grayColor],
+          }];
+  NSMutableAttributedString* answer =
+      [[NSMutableAttributedString alloc] initWithAttributedString:searchText];
+  [answer appendAttributedString:spacer()];
+  [answer appendAttributedString:pronunciation];
+  return [answer copy];
+}
+
+// Detail text for an autocomplete suggestion representing a word definition
+NSAttributedString* definitionDetailText() {
+  return [[NSAttributedString alloc]
+      initWithString:@"the group of people with the authority to govern a "
+                     @"country or state; a particular ministry in office. "
+                     @"Let's expand this definition to get to three lines also."
+          attributes:@{
+            NSFontAttributeName : [UIFont systemFontOfSize:14],
+            NSForegroundColorAttributeName : [UIColor grayColor],
+          }];
+}
+}  // namespace
+
 @interface SCOmniboxPopupMediator ()
 
 @property(nonatomic, readonly, weak) id<AutocompleteResultConsumer> consumer;
@@ -27,20 +143,86 @@
   return self;
 }
 
+// Creates many fake suggestions and passes them along to the
+// AutocompleteResultConsumer.
 - (void)updateMatches {
-  FakeAutocompleteSuggestion* suggestion1 =
+  FakeAutocompleteSuggestion* simpleSuggestion =
       [[FakeAutocompleteSuggestion alloc] init];
-  suggestion1.supportsDeletion = YES;
-  suggestion1.text = [[NSAttributedString alloc] initWithString:@"Match 1"];
+  simpleSuggestion.text =
+      [[NSAttributedString alloc] initWithString:@"Simple suggestion"];
 
-  FakeAutocompleteSuggestion* suggestion2 =
+  FakeAutocompleteSuggestion* suggestionWithDetail =
       [[FakeAutocompleteSuggestion alloc] init];
-  suggestion2.supportsDeletion = YES;
-  suggestion2.text = [[NSAttributedString alloc] initWithString:@"Match 2"];
-  suggestion2.detailText =
+  suggestionWithDetail.text =
+      [[NSAttributedString alloc] initWithString:@"Suggestion with detail"];
+  suggestionWithDetail.detailText =
       [[NSAttributedString alloc] initWithString:@"Detail"];
 
-  [self.consumer updateMatches:@[ suggestion1, suggestion2 ] withAnimation:YES];
+  FakeAutocompleteSuggestion* clippingSuggestion =
+      [[FakeAutocompleteSuggestion alloc] init];
+  clippingSuggestion.text = [[NSAttributedString alloc]
+      initWithString:@"Suggestion with text that clips because it is very long "
+                     @"and extends off the right end of the screen"];
+  clippingSuggestion.detailText = [[NSAttributedString alloc]
+      initWithString:
+          @"Detail about the suggestion that also clips because it is too long "
+          @"for the screen and extends off of the right edge."];
+
+  FakeAutocompleteSuggestion* appendableSuggestion =
+      [[FakeAutocompleteSuggestion alloc] init];
+  appendableSuggestion.text =
+      [[NSAttributedString alloc] initWithString:@"Appendable suggestion"];
+  appendableSuggestion.isAppendable = true;
+
+  FakeAutocompleteSuggestion* otherTabSuggestion =
+      [[FakeAutocompleteSuggestion alloc] init];
+  otherTabSuggestion.text =
+      [[NSAttributedString alloc] initWithString:@"Other tab suggestion"];
+  otherTabSuggestion.isTabMatch = true;
+
+  FakeAutocompleteSuggestion* deletableSuggestion =
+      [[FakeAutocompleteSuggestion alloc] init];
+  deletableSuggestion.text =
+      [[NSAttributedString alloc] initWithString:@"Deletable suggestion"];
+  deletableSuggestion.supportsDeletion = YES;
+
+  FakeAutocompleteSuggestion* weatherSuggestion =
+      [[FakeAutocompleteSuggestion alloc] init];
+  weatherSuggestion.text =
+      [[NSAttributedString alloc] initWithString:@"weather"];
+  weatherSuggestion.hasAnswer = YES;
+  weatherSuggestion.detailText = weatherDetailText();
+  // The image currently doesn't display because there is no fake
+  // Image Retriever, but leaving this here in case this is ever necessary.
+  weatherSuggestion.imageURL =
+      GURL("https://ssl.gstatic.com/onebox/weather/128/sunny.png");
+
+  FakeAutocompleteSuggestion* stockSuggestion =
+      [[FakeAutocompleteSuggestion alloc] init];
+  stockSuggestion.text = stockText();
+  stockSuggestion.hasAnswer = YES;
+  stockSuggestion.detailText = stockDetailText();
+
+  FakeAutocompleteSuggestion* definitionSuggestion =
+      [[FakeAutocompleteSuggestion alloc] init];
+  definitionSuggestion.text = definitionText();
+  definitionSuggestion.numberOfLines = 3;
+  definitionSuggestion.hasAnswer = YES;
+  definitionSuggestion.detailText = definitionDetailText();
+
+  NSArray<id<AutocompleteSuggestion>>* suggestions = @[
+    simpleSuggestion,
+    suggestionWithDetail,
+    clippingSuggestion,
+    appendableSuggestion,
+    otherTabSuggestion,
+    deletableSuggestion,
+    stockSuggestion,
+    weatherSuggestion,
+    definitionSuggestion,
+  ];
+
+  [self.consumer updateMatches:suggestions withAnimation:YES];
 }
 
 @end
diff --git a/ios/web/download/download_task_impl.mm b/ios/web/download/download_task_impl.mm
index c7f3e3ec..b8c033ac 100644
--- a/ios/web/download/download_task_impl.mm
+++ b/ios/web/download/download_task_impl.mm
@@ -17,6 +17,7 @@
 #include "ios/web/public/web_task_traits.h"
 #include "ios/web/public/web_thread.h"
 #import "ios/web/web_state/error_translation_util.h"
+#include "net/base/completion_once_callback.h"
 #include "net/base/data_url.h"
 #include "net/base/filename_util.h"
 #include "net/base/io_buffer.h"
@@ -375,20 +376,21 @@
         }
 
         // Download has finished, so finalize the writer and signal completion.
-        auto callback = base::Bind(&DownloadTaskImpl::OnDownloadFinished,
-                                   weak_factory_.GetWeakPtr());
-        if (writer_->Finish(error_code_, callback) != net::ERR_IO_PENDING) {
+        auto callback = base::BindOnce(&DownloadTaskImpl::OnDownloadFinished,
+                                       weak_factory_.GetWeakPtr());
+        if (writer_->Finish(error_code_, std::move(callback)) !=
+            net::ERR_IO_PENDING) {
           OnDownloadFinished(error_code_);
         }
       }
       dataBlock:^(scoped_refptr<net::IOBufferWithSize> buffer,
                   void (^completion_handler)()) {
         if (weak_this.get()) {
-          net::CompletionCallback callback = base::BindRepeating(^(int) {
+          net::CompletionOnceCallback callback = base::BindOnce(^(int) {
             completion_handler();
           });
-          if (writer_->Write(buffer.get(), buffer->size(), callback) ==
-              net::ERR_IO_PENDING) {
+          if (writer_->Write(buffer.get(), buffer->size(),
+                             std::move(callback)) == net::ERR_IO_PENDING) {
             return;
           }
         }
diff --git a/ios/web_view/BUILD.gn b/ios/web_view/BUILD.gn
index 2c708ce3..a4ae19d 100644
--- a/ios/web_view/BUILD.gn
+++ b/ios/web_view/BUILD.gn
@@ -166,8 +166,6 @@
   "internal/signin/web_view_account_fetcher_service_factory.mm",
   "internal/signin/web_view_account_tracker_service_factory.h",
   "internal/signin/web_view_account_tracker_service_factory.mm",
-  "internal/signin/web_view_gaia_cookie_manager_service_factory.h",
-  "internal/signin/web_view_gaia_cookie_manager_service_factory.mm",
   "internal/signin/web_view_identity_manager_factory.h",
   "internal/signin/web_view_identity_manager_factory.mm",
   "internal/signin/web_view_oauth2_token_service_factory.h",
diff --git a/ios/web_view/internal/app/application_context.mm b/ios/web_view/internal/app/application_context.mm
index ac16940..cdfa607 100644
--- a/ios/web_view/internal/app/application_context.mm
+++ b/ios/web_view/internal/app/application_context.mm
@@ -101,7 +101,7 @@
     flags_ui::PrefServiceFlagsStorage::RegisterPrefs(pref_registry.get());
     PrefProxyConfigTrackerImpl::RegisterPrefs(pref_registry.get());
 #if BUILDFLAG(IOS_WEB_VIEW_ENABLE_SYNC)
-    identity::IdentityManager::RegisterPrefs(pref_registry.get());
+    identity::IdentityManager::RegisterLocalStatePrefs(pref_registry.get());
 #endif  // BUILDFLAG(IOS_WEB_VIEW_ENABLE_SYNC)
 
     base::FilePath local_state_path;
diff --git a/ios/web_view/internal/passwords/web_view_password_manager_client.h b/ios/web_view/internal/passwords/web_view_password_manager_client.h
index db31c74..b6bcf30 100644
--- a/ios/web_view/internal/passwords/web_view_password_manager_client.h
+++ b/ios/web_view/internal/passwords/web_view_password_manager_client.h
@@ -64,6 +64,9 @@
       bool has_generated_password,
       bool is_update) override;
   void HideManualFallbackForSaving() override;
+  void FocusedInputChanged(const url::Origin& last_committed_origin,
+                           bool is_fillable,
+                           bool is_password_field) override;
   bool PromptUserToChooseCredentials(
       std::vector<std::unique_ptr<autofill::PasswordForm>> local_forms,
       const GURL& origin,
@@ -91,6 +94,7 @@
   ukm::SourceId GetUkmSourceId() override;
   password_manager::PasswordManagerMetricsRecorder* GetMetricsRecorder()
       override;
+  bool IsIsolationForPasswordSitesEnabled() const override;
 
  private:
   // password_manager::PasswordManagerClientHelperDelegate implementation.
diff --git a/ios/web_view/internal/passwords/web_view_password_manager_client.mm b/ios/web_view/internal/passwords/web_view_password_manager_client.mm
index 383b6a8..a6a8a96 100644
--- a/ios/web_view/internal/passwords/web_view_password_manager_client.mm
+++ b/ios/web_view/internal/passwords/web_view_password_manager_client.mm
@@ -91,6 +91,13 @@
   NOTIMPLEMENTED();
 }
 
+void WebViewPasswordManagerClient::FocusedInputChanged(
+    const url::Origin& last_committed_origin,
+    bool is_fillable,
+    bool is_password_field) {
+  NOTIMPLEMENTED();
+}
+
 void WebViewPasswordManagerClient::AutomaticPasswordSave(
     std::unique_ptr<PasswordFormManagerForUI> saved_form_manager) {
   NOTIMPLEMENTED();
@@ -177,4 +184,9 @@
 WebViewPasswordManagerClient::GetPasswordManager() {
   return delegate_.passwordManager;
 }
+
+bool WebViewPasswordManagerClient::IsIsolationForPasswordSitesEnabled() const {
+  return false;
+}
+
 }  // namespace ios_web_view
diff --git a/ios/web_view/internal/signin/web_view_gaia_cookie_manager_service_factory.h b/ios/web_view/internal/signin/web_view_gaia_cookie_manager_service_factory.h
deleted file mode 100644
index f94cd609..0000000
--- a/ios/web_view/internal/signin/web_view_gaia_cookie_manager_service_factory.h
+++ /dev/null
@@ -1,50 +0,0 @@
-// Copyright 2017 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef IOS_WEB_VIEW_INTERNAL_SIGNIN_WEB_VIEW_GAIA_MANAGER_SERVICE_FACTORY_H_
-#define IOS_WEB_VIEW_INTERNAL_SIGNIN_WEB_VIEW_GAIA_MANAGER_SERVICE_FACTORY_H_
-
-#include <memory>
-
-#include "base/macros.h"
-#include "base/no_destructor.h"
-#include "components/keyed_service/ios/browser_state_keyed_service_factory.h"
-
-class GaiaCookieManagerService;
-
-namespace ios_web_view {
-
-class WebViewBrowserState;
-
-// Singleton that owns the GaiaCookieManagerService(s) and associates those
-// services  with browser states.
-class WebViewGaiaCookieManagerServiceFactory
-    : public BrowserStateKeyedServiceFactory {
- public:
-  // Returns the instance of GaiaCookieManagerService associated with this
-  // browser state (creating one if none exists). Returns null if this browser
-  // state cannot have an GaiaCookieManagerService (for example, if it is
-  // incognito).
-  static GaiaCookieManagerService* GetForBrowserState(
-      ios_web_view::WebViewBrowserState* browser_state);
-
-  // Returns an instance of the factory singleton.
-  static WebViewGaiaCookieManagerServiceFactory* GetInstance();
-
- private:
-  friend class base::NoDestructor<WebViewGaiaCookieManagerServiceFactory>;
-
-  WebViewGaiaCookieManagerServiceFactory();
-  ~WebViewGaiaCookieManagerServiceFactory() override = default;
-
-  // BrowserStateKeyedServiceFactory:
-  std::unique_ptr<KeyedService> BuildServiceInstanceFor(
-      web::BrowserState* context) const override;
-
-  DISALLOW_COPY_AND_ASSIGN(WebViewGaiaCookieManagerServiceFactory);
-};
-
-}  // namespace ios_web_view
-
-#endif  // IOS_WEB_VIEW_INTERNAL_SIGNIN_WEB_VIEW_GAIA_MANAGER_SERVICE_FACTORY_H_
diff --git a/ios/web_view/internal/signin/web_view_gaia_cookie_manager_service_factory.mm b/ios/web_view/internal/signin/web_view_gaia_cookie_manager_service_factory.mm
deleted file mode 100644
index 01d2ed3..0000000
--- a/ios/web_view/internal/signin/web_view_gaia_cookie_manager_service_factory.mm
+++ /dev/null
@@ -1,56 +0,0 @@
-// Copyright 2017 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "ios/web_view/internal/signin/web_view_gaia_cookie_manager_service_factory.h"
-
-#include "base/no_destructor.h"
-#include "components/keyed_service/core/service_access_type.h"
-#include "components/keyed_service/ios/browser_state_dependency_manager.h"
-#include "components/signin/core/browser/gaia_cookie_manager_service.h"
-#include "components/signin/core/browser/profile_oauth2_token_service.h"
-#include "ios/web_view/internal/signin/ios_web_view_signin_client.h"
-#include "ios/web_view/internal/signin/web_view_oauth2_token_service_factory.h"
-#include "ios/web_view/internal/signin/web_view_signin_client_factory.h"
-#include "ios/web_view/internal/web_view_browser_state.h"
-
-#if !defined(__has_feature) || !__has_feature(objc_arc)
-#error "This file requires ARC support."
-#endif
-
-namespace ios_web_view {
-
-WebViewGaiaCookieManagerServiceFactory::WebViewGaiaCookieManagerServiceFactory()
-    : BrowserStateKeyedServiceFactory(
-          "GaiaCookieManagerService",
-          BrowserStateDependencyManager::GetInstance()) {
-  DependsOn(WebViewSigninClientFactory::GetInstance());
-  DependsOn(WebViewOAuth2TokenServiceFactory::GetInstance());
-}
-
-// static
-GaiaCookieManagerService*
-WebViewGaiaCookieManagerServiceFactory::GetForBrowserState(
-    ios_web_view::WebViewBrowserState* browser_state) {
-  return static_cast<GaiaCookieManagerService*>(
-      GetInstance()->GetServiceForBrowserState(browser_state, true));
-}
-
-// static
-WebViewGaiaCookieManagerServiceFactory*
-WebViewGaiaCookieManagerServiceFactory::GetInstance() {
-  static base::NoDestructor<WebViewGaiaCookieManagerServiceFactory> instance;
-  return instance.get();
-}
-
-std::unique_ptr<KeyedService>
-WebViewGaiaCookieManagerServiceFactory::BuildServiceInstanceFor(
-    web::BrowserState* context) const {
-  WebViewBrowserState* browser_state =
-      WebViewBrowserState::FromBrowserState(context);
-  return std::make_unique<GaiaCookieManagerService>(
-      WebViewOAuth2TokenServiceFactory::GetForBrowserState(browser_state),
-      WebViewSigninClientFactory::GetForBrowserState(browser_state));
-}
-
-}  // namespace ios_web_view
diff --git a/ios/web_view/internal/signin/web_view_identity_manager_factory.mm b/ios/web_view/internal/signin/web_view_identity_manager_factory.mm
index b4c352d0..b85e611 100644
--- a/ios/web_view/internal/signin/web_view_identity_manager_factory.mm
+++ b/ios/web_view/internal/signin/web_view_identity_manager_factory.mm
@@ -17,7 +17,6 @@
 #include "ios/web_view/internal/signin/ios_web_view_signin_client.h"
 #include "ios/web_view/internal/signin/web_view_account_fetcher_service_factory.h"
 #include "ios/web_view/internal/signin/web_view_account_tracker_service_factory.h"
-#include "ios/web_view/internal/signin/web_view_gaia_cookie_manager_service_factory.h"
 #include "ios/web_view/internal/signin/web_view_oauth2_token_service_factory.h"
 #include "ios/web_view/internal/signin/web_view_signin_client_factory.h"
 #include "ios/web_view/internal/web_view_browser_state.h"
@@ -35,7 +34,8 @@
 
 namespace {
 std::unique_ptr<SigninManager> BuildSigninManager(
-    WebViewBrowserState* browser_state) {
+    WebViewBrowserState* browser_state,
+    GaiaCookieManagerService* gaia_cookie_manager_service) {
   // Clearing the sign in state on start up greatly simplifies the management of
   // ChromeWebView's signin state.
   PrefService* pref_service = browser_state->GetPrefs();
@@ -47,8 +47,7 @@
       WebViewSigninClientFactory::GetForBrowserState(browser_state),
       WebViewOAuth2TokenServiceFactory::GetForBrowserState(browser_state),
       WebViewAccountTrackerServiceFactory::GetForBrowserState(browser_state),
-      WebViewGaiaCookieManagerServiceFactory::GetForBrowserState(browser_state),
-      signin::AccountConsistencyMethod::kDisabled);
+      gaia_cookie_manager_service, signin::AccountConsistencyMethod::kDisabled);
   service->Initialize(ApplicationContext::GetInstance()->GetLocalState());
   return service;
 }
@@ -65,33 +64,33 @@
                                public identity::IdentityManager {
  public:
   explicit IdentityManagerWrapper(
+      std::unique_ptr<GaiaCookieManagerService> gaia_cookie_manager_service,
       std::unique_ptr<SigninManagerBase> signin_manager,
       std::unique_ptr<identity::PrimaryAccountMutator> primary_account_mutator,
+      std::unique_ptr<identity::AccountsCookieMutatorImpl>
+          accounts_cookie_mutator,
+      std::unique_ptr<identity::DiagnosticsProviderImpl> diagnostics_provider,
       WebViewBrowserState* browser_state)
       : identity::IdentityManager(
+            std::move(gaia_cookie_manager_service),
             std::move(signin_manager),
             WebViewOAuth2TokenServiceFactory::GetForBrowserState(browser_state),
             WebViewAccountFetcherServiceFactory::GetForBrowserState(
                 browser_state),
             WebViewAccountTrackerServiceFactory::GetForBrowserState(
                 browser_state),
-            WebViewGaiaCookieManagerServiceFactory::GetForBrowserState(
-                browser_state),
             std::move(primary_account_mutator),
             /*accounts_mutator=*/nullptr,
-            std::make_unique<identity::AccountsCookieMutatorImpl>(
-                WebViewGaiaCookieManagerServiceFactory::GetForBrowserState(
-                    browser_state)),
-            std::make_unique<identity::DiagnosticsProviderImpl>(
-                WebViewOAuth2TokenServiceFactory::GetForBrowserState(
-                    browser_state),
-                WebViewGaiaCookieManagerServiceFactory::GetForBrowserState(
-                    browser_state))) {}
+            std::move(accounts_cookie_mutator),
+            std::move(diagnostics_provider)) {}
+
+  // KeyedService overrides.
+  void Shutdown() override { IdentityManager::Shutdown(); }
 };
 
 void WebViewIdentityManagerFactory::RegisterBrowserStatePrefs(
     user_prefs::PrefRegistrySyncable* registry) {
-  SigninManagerBase::RegisterProfilePrefs(registry);
+  identity::IdentityManager::RegisterProfilePrefs(registry);
 }
 
 WebViewIdentityManagerFactory::WebViewIdentityManagerFactory()
@@ -100,7 +99,6 @@
           BrowserStateDependencyManager::GetInstance()) {
   DependsOn(WebViewAccountFetcherServiceFactory::GetInstance());
   DependsOn(WebViewAccountTrackerServiceFactory::GetInstance());
-  DependsOn(WebViewGaiaCookieManagerServiceFactory::GetInstance());
   DependsOn(WebViewOAuth2TokenServiceFactory::GetInstance());
   DependsOn(WebViewSigninClientFactory::GetInstance());
 }
@@ -124,7 +122,6 @@
 void WebViewIdentityManagerFactory::EnsureFactoryAndDependeeFactoriesBuilt() {
   WebViewIdentityManagerFactory::GetInstance();
   WebViewAccountTrackerServiceFactory::GetInstance();
-  WebViewGaiaCookieManagerServiceFactory::GetInstance();
   WebViewOAuth2TokenServiceFactory::GetInstance();
   WebViewSigninClientFactory::GetInstance();
 }
@@ -136,16 +133,27 @@
       WebViewBrowserState::FromBrowserState(context);
 
   // Construct the dependencies that IdentityManager will own.
+  auto gaia_cookie_manager_service = std::make_unique<GaiaCookieManagerService>(
+      WebViewOAuth2TokenServiceFactory::GetForBrowserState(browser_state),
+      WebViewSigninClientFactory::GetForBrowserState(browser_state));
   std::unique_ptr<SigninManager> signin_manager =
-      BuildSigninManager(browser_state);
+      BuildSigninManager(browser_state, gaia_cookie_manager_service.get());
   auto primary_account_mutator =
       std::make_unique<identity::PrimaryAccountMutatorImpl>(
           WebViewAccountTrackerServiceFactory::GetForBrowserState(
               browser_state),
           signin_manager.get());
+  auto accounts_cookie_mutator =
+      std::make_unique<identity::AccountsCookieMutatorImpl>(
+          gaia_cookie_manager_service.get());
+  auto diagnostics_provider =
+      std::make_unique<identity::DiagnosticsProviderImpl>(
+          WebViewOAuth2TokenServiceFactory::GetForBrowserState(browser_state),
+          gaia_cookie_manager_service.get());
   auto identity_manager = std::make_unique<IdentityManagerWrapper>(
-      std::move(signin_manager), std::move(primary_account_mutator),
-      browser_state);
+      std::move(gaia_cookie_manager_service), std::move(signin_manager),
+      std::move(primary_account_mutator), std::move(accounts_cookie_mutator),
+      std::move(diagnostics_provider), browser_state);
   return identity_manager;
 }
 
diff --git a/jingle/glue/fake_ssl_client_socket_unittest.cc b/jingle/glue/fake_ssl_client_socket_unittest.cc
index d86e760..dab30bf 100644
--- a/jingle/glue/fake_ssl_client_socket_unittest.cc
+++ b/jingle/glue/fake_ssl_client_socket_unittest.cc
@@ -12,10 +12,11 @@
 #include <utility>
 #include <vector>
 
-#include "base/callback_helpers.h"
 #include "base/memory/ref_counted.h"
 #include "base/message_loop/message_loop.h"
 #include "base/stl_util.h"
+#include "net/base/completion_once_callback.h"
+#include "net/base/completion_repeating_callback.h"
 #include "net/base/io_buffer.h"
 #include "net/base/ip_address.h"
 #include "net/base/test_completion_callback.h"
@@ -55,35 +56,15 @@
  public:
   ~MockClientSocket() override {}
 
-  int Read(net::IOBuffer* buffer,
-           int bytes,
-           net::CompletionOnceCallback callback) override {
-    return Read(buffer, bytes,
-                base::AdaptCallbackForRepeating(std::move(callback)));
-  }
-
-  int Write(net::IOBuffer* buffer,
-            int bytes,
-            net::CompletionOnceCallback callback,
-            const net::NetworkTrafficAnnotationTag& tag) override {
-    return Write(buffer, bytes,
-                 base::AdaptCallbackForRepeating(std::move(callback)), tag);
-  }
-
-  int Connect(net::CompletionOnceCallback callback) override {
-    return Connect(base::AdaptCallbackForRepeating(std::move(callback)));
-  }
-
-  MOCK_METHOD3(Read, int(net::IOBuffer*, int,
-                         const net::CompletionCallback&));
+  MOCK_METHOD3(Read, int(net::IOBuffer*, int, net::CompletionOnceCallback));
   MOCK_METHOD4(Write,
                int(net::IOBuffer*,
                    int,
-                   const net::CompletionCallback&,
+                   net::CompletionOnceCallback,
                    const net::NetworkTrafficAnnotationTag&));
   MOCK_METHOD1(SetReceiveBufferSize, int(int32_t));
   MOCK_METHOD1(SetSendBufferSize, int(int32_t));
-  MOCK_METHOD1(Connect, int(const net::CompletionCallback&));
+  MOCK_METHOD1(Connect, int(net::CompletionOnceCallback));
   MOCK_METHOD0(Disconnect, void());
   MOCK_CONST_METHOD0(IsConnected, bool());
   MOCK_CONST_METHOD0(IsConnectedAndIdle, bool());
diff --git a/media/capture/mojom/video_capture_types.typemap b/media/capture/mojom/video_capture_types.typemap
index d3363e5..d2425818 100644
--- a/media/capture/mojom/video_capture_types.typemap
+++ b/media/capture/mojom/video_capture_types.typemap
@@ -18,12 +18,15 @@
 
 deps = [
   "//media",
-  "//media/base/ipc",
   "//media/capture:capture_base",
   "//media/mojo/interfaces",
   "//ui/gfx/geometry/mojo:struct_traits",
 ]
 
+public_deps = [
+  "//media/base/ipc",
+]
+
 type_mappings = [
   "media.mojom.ResolutionChangePolicy=media::ResolutionChangePolicy",
   "media.mojom.PowerLineFrequency=media::PowerLineFrequency",
diff --git a/net/disk_cache/entry_unittest.cc b/net/disk_cache/entry_unittest.cc
index 41f9713..9b3a2095 100644
--- a/net/disk_cache/entry_unittest.cc
+++ b/net/disk_cache/entry_unittest.cc
@@ -223,22 +223,14 @@
   CacheTestFillBuffer(buffer2->data(), kSize2, false);
   CacheTestFillBuffer(buffer3->data(), kSize3, false);
 
-  EXPECT_EQ(0,
-            entry->ReadData(
-                0,
-                15 * 1024,
-                buffer1.get(),
-                kSize1,
-                base::Bind(&CallbackTest::Run, base::Unretained(&callback1))));
+  EXPECT_EQ(0, entry->ReadData(0, 15 * 1024, buffer1.get(), kSize1,
+                               base::BindOnce(&CallbackTest::Run,
+                                              base::Unretained(&callback1))));
   base::strlcpy(buffer1->data(), "the data", kSize1);
   int expected = 0;
   int ret = entry->WriteData(
-      0,
-      0,
-      buffer1.get(),
-      kSize1,
-      base::Bind(&CallbackTest::Run, base::Unretained(&callback2)),
-      false);
+      0, 0, buffer1.get(), kSize1,
+      base::BindOnce(&CallbackTest::Run, base::Unretained(&callback2)), false);
   EXPECT_TRUE(10 == ret || net::ERR_IO_PENDING == ret);
   if (net::ERR_IO_PENDING == ret)
     expected++;
@@ -246,11 +238,8 @@
   EXPECT_TRUE(helper.WaitUntilCacheIoFinished(expected));
   memset(buffer2->data(), 0, kSize2);
   ret = entry->ReadData(
-      0,
-      0,
-      buffer2.get(),
-      kSize1,
-      base::Bind(&CallbackTest::Run, base::Unretained(&callback3)));
+      0, 0, buffer2.get(), kSize1,
+      base::BindOnce(&CallbackTest::Run, base::Unretained(&callback3)));
   EXPECT_TRUE(10 == ret || net::ERR_IO_PENDING == ret);
   if (net::ERR_IO_PENDING == ret)
     expected++;
@@ -260,12 +249,8 @@
 
   base::strlcpy(buffer2->data(), "The really big data goes here", kSize2);
   ret = entry->WriteData(
-      1,
-      1500,
-      buffer2.get(),
-      kSize2,
-      base::Bind(&CallbackTest::Run, base::Unretained(&callback4)),
-      true);
+      1, 1500, buffer2.get(), kSize2,
+      base::BindOnce(&CallbackTest::Run, base::Unretained(&callback4)), true);
   EXPECT_TRUE(5000 == ret || net::ERR_IO_PENDING == ret);
   if (net::ERR_IO_PENDING == ret)
     expected++;
@@ -273,11 +258,8 @@
   EXPECT_TRUE(helper.WaitUntilCacheIoFinished(expected));
   memset(buffer3->data(), 0, kSize3);
   ret = entry->ReadData(
-      1,
-      1511,
-      buffer3.get(),
-      kSize2,
-      base::Bind(&CallbackTest::Run, base::Unretained(&callback5)));
+      1, 1511, buffer3.get(), kSize2,
+      base::BindOnce(&CallbackTest::Run, base::Unretained(&callback5)));
   EXPECT_TRUE(4989 == ret || net::ERR_IO_PENDING == ret);
   if (net::ERR_IO_PENDING == ret)
     expected++;
@@ -285,11 +267,8 @@
   EXPECT_TRUE(helper.WaitUntilCacheIoFinished(expected));
   EXPECT_STREQ("big data goes here", buffer3->data());
   ret = entry->ReadData(
-      1,
-      0,
-      buffer2.get(),
-      kSize2,
-      base::Bind(&CallbackTest::Run, base::Unretained(&callback6)));
+      1, 0, buffer2.get(), kSize2,
+      base::BindOnce(&CallbackTest::Run, base::Unretained(&callback6)));
   EXPECT_TRUE(5000 == ret || net::ERR_IO_PENDING == ret);
   if (net::ERR_IO_PENDING == ret)
     expected++;
@@ -299,43 +278,30 @@
   EXPECT_TRUE(helper.WaitUntilCacheIoFinished(expected));
   EXPECT_EQ(0, memcmp(buffer2->data(), buffer3->data(), 1500));
   ret = entry->ReadData(
-      1,
-      5000,
-      buffer2.get(),
-      kSize2,
-      base::Bind(&CallbackTest::Run, base::Unretained(&callback7)));
+      1, 5000, buffer2.get(), kSize2,
+      base::BindOnce(&CallbackTest::Run, base::Unretained(&callback7)));
   EXPECT_TRUE(1500 == ret || net::ERR_IO_PENDING == ret);
   if (net::ERR_IO_PENDING == ret)
     expected++;
 
   ret = entry->ReadData(
-      1,
-      0,
-      buffer3.get(),
-      kSize3,
-      base::Bind(&CallbackTest::Run, base::Unretained(&callback9)));
+      1, 0, buffer3.get(), kSize3,
+      base::BindOnce(&CallbackTest::Run, base::Unretained(&callback9)));
   EXPECT_TRUE(6500 == ret || net::ERR_IO_PENDING == ret);
   if (net::ERR_IO_PENDING == ret)
     expected++;
 
   ret = entry->WriteData(
-      1,
-      0,
-      buffer3.get(),
-      8192,
-      base::Bind(&CallbackTest::Run, base::Unretained(&callback10)),
-      true);
+      1, 0, buffer3.get(), 8192,
+      base::BindOnce(&CallbackTest::Run, base::Unretained(&callback10)), true);
   EXPECT_TRUE(8192 == ret || net::ERR_IO_PENDING == ret);
   if (net::ERR_IO_PENDING == ret)
     expected++;
 
   EXPECT_TRUE(helper.WaitUntilCacheIoFinished(expected));
   ret = entry->ReadData(
-      1,
-      0,
-      buffer3.get(),
-      kSize3,
-      base::Bind(&CallbackTest::Run, base::Unretained(&callback11)));
+      1, 0, buffer3.get(), kSize3,
+      base::BindOnce(&CallbackTest::Run, base::Unretained(&callback11)));
   EXPECT_TRUE(8192 == ret || net::ERR_IO_PENDING == ret);
   if (net::ERR_IO_PENDING == ret)
     expected++;
@@ -343,21 +309,15 @@
   EXPECT_EQ(8192, entry->GetDataSize(1));
 
   ret = entry->ReadData(
-      0,
-      0,
-      buffer1.get(),
-      kSize1,
-      base::Bind(&CallbackTest::Run, base::Unretained(&callback12)));
+      0, 0, buffer1.get(), kSize1,
+      base::BindOnce(&CallbackTest::Run, base::Unretained(&callback12)));
   EXPECT_TRUE(10 == ret || net::ERR_IO_PENDING == ret);
   if (net::ERR_IO_PENDING == ret)
     expected++;
 
   ret = entry->ReadData(
-      1,
-      0,
-      buffer2.get(),
-      kSize2,
-      base::Bind(&CallbackTest::Run, base::Unretained(&callback13)));
+      1, 0, buffer2.get(), kSize2,
+      base::BindOnce(&CallbackTest::Run, base::Unretained(&callback13)));
   EXPECT_TRUE(5000 == ret || net::ERR_IO_PENDING == ret);
   if (net::ERR_IO_PENDING == ret)
     expected++;
@@ -492,12 +452,8 @@
   CacheTestFillBuffer(buffer3->data(), kSize3, false);
   base::strlcpy(buffer1->data(), "the data", kSize1);
   int ret = entry->WriteData(
-      0,
-      0,
-      buffer1.get(),
-      kSize1,
-      base::Bind(&CallbackTest::Run, base::Unretained(&callback1)),
-      false);
+      0, 0, buffer1.get(), kSize1,
+      base::BindOnce(&CallbackTest::Run, base::Unretained(&callback1)), false);
   EXPECT_TRUE(17000 == ret || net::ERR_IO_PENDING == ret);
   if (net::ERR_IO_PENDING == ret)
     expected++;
@@ -506,11 +462,8 @@
 
   memset(buffer2->data(), 0, kSize1);
   ret = entry->ReadData(
-      0,
-      0,
-      buffer2.get(),
-      kSize1,
-      base::Bind(&CallbackTest::Run, base::Unretained(&callback2)));
+      0, 0, buffer2.get(), kSize1,
+      base::BindOnce(&CallbackTest::Run, base::Unretained(&callback2)));
   EXPECT_TRUE(17000 == ret || net::ERR_IO_PENDING == ret);
   if (net::ERR_IO_PENDING == ret)
     expected++;
@@ -520,12 +473,8 @@
 
   base::strlcpy(buffer2->data(), "The really big data goes here", kSize2);
   ret = entry->WriteData(
-      1,
-      10000,
-      buffer2.get(),
-      kSize2,
-      base::Bind(&CallbackTest::Run, base::Unretained(&callback3)),
-      false);
+      1, 10000, buffer2.get(), kSize2,
+      base::BindOnce(&CallbackTest::Run, base::Unretained(&callback3)), false);
   EXPECT_TRUE(25000 == ret || net::ERR_IO_PENDING == ret);
   if (net::ERR_IO_PENDING == ret)
     expected++;
@@ -534,11 +483,8 @@
 
   memset(buffer3->data(), 0, kSize3);
   ret = entry->ReadData(
-      1,
-      10011,
-      buffer3.get(),
-      kSize3,
-      base::Bind(&CallbackTest::Run, base::Unretained(&callback4)));
+      1, 10011, buffer3.get(), kSize3,
+      base::BindOnce(&CallbackTest::Run, base::Unretained(&callback4)));
   EXPECT_TRUE(24989 == ret || net::ERR_IO_PENDING == ret);
   if (net::ERR_IO_PENDING == ret)
     expected++;
@@ -546,11 +492,8 @@
   EXPECT_TRUE(helper.WaitUntilCacheIoFinished(expected));
   EXPECT_STREQ("big data goes here", buffer3->data());
   ret = entry->ReadData(
-      1,
-      0,
-      buffer2.get(),
-      kSize2,
-      base::Bind(&CallbackTest::Run, base::Unretained(&callback5)));
+      1, 0, buffer2.get(), kSize2,
+      base::BindOnce(&CallbackTest::Run, base::Unretained(&callback5)));
   EXPECT_TRUE(25000 == ret || net::ERR_IO_PENDING == ret);
   if (net::ERR_IO_PENDING == ret)
     expected++;
@@ -559,38 +502,28 @@
   memset(buffer3->data(), 0, kSize3);
   EXPECT_EQ(0, memcmp(buffer2->data(), buffer3->data(), 10000));
   ret = entry->ReadData(
-      1,
-      30000,
-      buffer2.get(),
-      kSize2,
-      base::Bind(&CallbackTest::Run, base::Unretained(&callback6)));
+      1, 30000, buffer2.get(), kSize2,
+      base::BindOnce(&CallbackTest::Run, base::Unretained(&callback6)));
   EXPECT_TRUE(5000 == ret || net::ERR_IO_PENDING == ret);
   if (net::ERR_IO_PENDING == ret)
     expected++;
 
   ret = entry->ReadData(
       1, 35000, buffer2.get(), kSize2,
-      base::Bind(&CallbackTest::Run, base::Unretained(&callback7)));
+      base::BindOnce(&CallbackTest::Run, base::Unretained(&callback7)));
   EXPECT_TRUE(0 == ret || net::ERR_IO_PENDING == ret);
   if (net::ERR_IO_PENDING == ret)
     expected++;
 
   ret = entry->ReadData(
-      1,
-      0,
-      buffer1.get(),
-      kSize1,
-      base::Bind(&CallbackTest::Run, base::Unretained(&callback8)));
+      1, 0, buffer1.get(), kSize1,
+      base::BindOnce(&CallbackTest::Run, base::Unretained(&callback8)));
   EXPECT_TRUE(17000 == ret || net::ERR_IO_PENDING == ret);
   if (net::ERR_IO_PENDING == ret)
     expected++;
   ret = entry->WriteData(
-      1,
-      20000,
-      buffer3.get(),
-      kSize1,
-      base::Bind(&CallbackTest::Run, base::Unretained(&callback9)),
-      false);
+      1, 20000, buffer3.get(), kSize1,
+      base::BindOnce(&CallbackTest::Run, base::Unretained(&callback9)), false);
   EXPECT_TRUE(17000 == ret || net::ERR_IO_PENDING == ret);
   if (net::ERR_IO_PENDING == ret)
     expected++;
@@ -3091,11 +3024,8 @@
   CacheTestFillBuffer(write_buffer->data(), write_buffer->size(), false);
   CallbackTest write_callback(&helper, false);
   int ret = entry->WriteData(
-      1,
-      0,
-      write_buffer.get(),
-      write_buffer->size(),
-      base::Bind(&CallbackTest::Run, base::Unretained(&write_callback)),
+      1, 0, write_buffer.get(), write_buffer->size(),
+      base::BindOnce(&CallbackTest::Run, base::Unretained(&write_callback)),
       false);
   ASSERT_THAT(ret, IsError(net::ERR_IO_PENDING));
   helper.WaitUntilCacheIoFinished(++expected_callback_runs);
@@ -3124,11 +3054,8 @@
   CacheTestFillBuffer(write_buffer->data(), write_buffer->size(), false);
   CallbackTest write_callback(&helper, false);
   int ret = entry->WriteData(
-      1,
-      0,
-      write_buffer.get(),
-      write_buffer->size(),
-      base::Bind(&CallbackTest::Run, base::Unretained(&write_callback)),
+      1, 0, write_buffer.get(), write_buffer->size(),
+      base::BindOnce(&CallbackTest::Run, base::Unretained(&write_callback)),
       false);
   EXPECT_THAT(ret, IsError(net::ERR_IO_PENDING));
   int expected_callback_runs = 1;
@@ -3137,11 +3064,8 @@
       base::MakeRefCounted<net::IOBufferWithSize>(kBufferSize);
   CallbackTest read_callback(&helper, false);
   ret = entry->ReadData(
-      1,
-      0,
-      read_buffer.get(),
-      read_buffer->size(),
-      base::Bind(&CallbackTest::Run, base::Unretained(&read_callback)));
+      1, 0, read_buffer.get(), read_buffer->size(),
+      base::BindOnce(&CallbackTest::Run, base::Unretained(&read_callback)));
   EXPECT_THAT(ret, IsError(net::ERR_IO_PENDING));
   ++expected_callback_runs;
 
@@ -3184,33 +3108,26 @@
   disk_cache::Entry* entry = nullptr;
   // Create is optimistic, must return OK.
   ASSERT_EQ(net::OK,
-            cache_->CreateEntry(
-                key, net::HIGHEST, &entry,
-                base::Bind(&CallbackTest::Run, base::Unretained(&callback1))));
+            cache_->CreateEntry(key, net::HIGHEST, &entry,
+                                base::BindOnce(&CallbackTest::Run,
+                                               base::Unretained(&callback1))));
   EXPECT_NE(null, entry);
   ScopedEntryPtr entry_closer(entry);
 
   // This write may or may not be optimistic (it depends if the previous
   // optimistic create already finished by the time we call the write here).
   int ret = entry->WriteData(
-      1,
-      0,
-      buffer1.get(),
-      kSize1,
-      base::Bind(&CallbackTest::Run, base::Unretained(&callback2)),
-      false);
+      1, 0, buffer1.get(), kSize1,
+      base::BindOnce(&CallbackTest::Run, base::Unretained(&callback2)), false);
   EXPECT_TRUE(kSize1 == ret || net::ERR_IO_PENDING == ret);
   if (net::ERR_IO_PENDING == ret)
     expected++;
 
   // This Read must not be optimistic, since we don't support that yet.
   EXPECT_EQ(net::ERR_IO_PENDING,
-            entry->ReadData(
-                1,
-                0,
-                buffer1_read.get(),
-                kSize1,
-                base::Bind(&CallbackTest::Run, base::Unretained(&callback3))));
+            entry->ReadData(1, 0, buffer1_read.get(), kSize1,
+                            base::BindOnce(&CallbackTest::Run,
+                                           base::Unretained(&callback3))));
   expected++;
   EXPECT_TRUE(helper.WaitUntilCacheIoFinished(expected));
   EXPECT_EQ(0, memcmp(buffer1->data(), buffer1_read->data(), kSize1));
@@ -3218,23 +3135,17 @@
   // At this point after waiting, the pending operations queue on the entry
   // should be empty, so the next Write operation must run as optimistic.
   EXPECT_EQ(kSize2,
-            entry->WriteData(
-                1,
-                0,
-                buffer2.get(),
-                kSize2,
-                base::Bind(&CallbackTest::Run, base::Unretained(&callback4)),
-                false));
+            entry->WriteData(1, 0, buffer2.get(), kSize2,
+                             base::BindOnce(&CallbackTest::Run,
+                                            base::Unretained(&callback4)),
+                             false));
 
   // Lets do another read so we block until both the write and the read
   // operation finishes and we can then test for HasOneRef() below.
   EXPECT_EQ(net::ERR_IO_PENDING,
-            entry->ReadData(
-                1,
-                0,
-                buffer2_read.get(),
-                kSize2,
-                base::Bind(&CallbackTest::Run, base::Unretained(&callback5))));
+            entry->ReadData(1, 0, buffer2_read.get(), kSize2,
+                            base::BindOnce(&CallbackTest::Run,
+                                           base::Unretained(&callback5))));
   expected++;
 
   EXPECT_TRUE(helper.WaitUntilCacheIoFinished(expected));
@@ -3260,17 +3171,17 @@
 
   disk_cache::Entry* entry = nullptr;
   ASSERT_EQ(net::OK,
-            cache_->CreateEntry(
-                key, net::HIGHEST, &entry,
-                base::Bind(&CallbackTest::Run, base::Unretained(&callback1))));
+            cache_->CreateEntry(key, net::HIGHEST, &entry,
+                                base::BindOnce(&CallbackTest::Run,
+                                               base::Unretained(&callback1))));
   EXPECT_NE(null, entry);
   ScopedEntryPtr entry_closer(entry);
 
   disk_cache::Entry* entry2 = nullptr;
   ASSERT_EQ(net::ERR_IO_PENDING,
-            cache_->OpenEntry(
-                key, net::HIGHEST, &entry2,
-                base::Bind(&CallbackTest::Run, base::Unretained(&callback2))));
+            cache_->OpenEntry(key, net::HIGHEST, &entry2,
+                              base::BindOnce(&CallbackTest::Run,
+                                             base::Unretained(&callback2))));
   ASSERT_TRUE(helper.WaitUntilCacheIoFinished(1));
 
   EXPECT_NE(null, entry2);
@@ -3872,12 +3783,9 @@
       base::MakeRefCounted<net::IOBuffer>(kReadBufferSize);
   CallbackTest read_callback(&helper, false);
   EXPECT_EQ(net::ERR_IO_PENDING,
-            entry->ReadData(1,
-                            0,
-                            read_buffer.get(),
-                            kReadBufferSize,
-                            base::Bind(&CallbackTest::Run,
-                                       base::Unretained(&read_callback))));
+            entry->ReadData(1, 0, read_buffer.get(), kReadBufferSize,
+                            base::BindOnce(&CallbackTest::Run,
+                                           base::Unretained(&read_callback))));
   ++expected;
 
   // Truncate the entry to the length of that read.
@@ -3885,14 +3793,12 @@
       base::MakeRefCounted<net::IOBuffer>(kReadBufferSize);
   CacheTestFillBuffer(truncate_buffer->data(), kReadBufferSize, false);
   CallbackTest truncate_callback(&helper, false);
-  EXPECT_EQ(net::ERR_IO_PENDING,
-            entry->WriteData(1,
-                             0,
-                             truncate_buffer.get(),
-                             kReadBufferSize,
-                             base::Bind(&CallbackTest::Run,
-                                        base::Unretained(&truncate_callback)),
-                             true));
+  EXPECT_EQ(
+      net::ERR_IO_PENDING,
+      entry->WriteData(1, 0, truncate_buffer.get(), kReadBufferSize,
+                       base::BindOnce(&CallbackTest::Run,
+                                      base::Unretained(&truncate_callback)),
+                       true));
   ++expected;
 
   // Wait for both the read and truncation to finish, and confirm that both
@@ -3927,12 +3833,9 @@
 
   CallbackTest write_callback(&helper, false);
   EXPECT_EQ(net::ERR_IO_PENDING,
-            entry->WriteData(1,
-                             0,
-                             write_buffer.get(),
-                             kBufferSize,
-                             base::Bind(&CallbackTest::Run,
-                                        base::Unretained(&write_callback)),
+            entry->WriteData(1, 0, write_buffer.get(), kBufferSize,
+                             base::BindOnce(&CallbackTest::Run,
+                                            base::Unretained(&write_callback)),
                              true));
   ++expected;
 
@@ -3940,12 +3843,9 @@
       base::MakeRefCounted<net::IOBuffer>(kBufferSize);
   CallbackTest read_callback(&helper, false);
   EXPECT_EQ(net::ERR_IO_PENDING,
-            entry->ReadData(1,
-                            0,
-                            read_buffer.get(),
-                            kBufferSize,
-                            base::Bind(&CallbackTest::Run,
-                                       base::Unretained(&read_callback))));
+            entry->ReadData(1, 0, read_buffer.get(), kBufferSize,
+                            base::BindOnce(&CallbackTest::Run,
+                                           base::Unretained(&read_callback))));
   ++expected;
 
   EXPECT_TRUE(helper.WaitUntilCacheIoFinished(expected));
@@ -5141,7 +5041,7 @@
   disk_cache::Entry* entry2 = nullptr;
   net::TestCompletionCallback cb_open;
   int rv = entry->WriteData(1, 0, buffer.get(), kSize,
-                            net::CompletionCallback(), false);
+                            net::CompletionOnceCallback(), false);
 
   // Write should be optimistic.
   ASSERT_EQ(kSize, rv);
diff --git a/services/identity/public/cpp/identity_manager.cc b/services/identity/public/cpp/identity_manager.cc
index 600073f..e1792a1d 100644
--- a/services/identity/public/cpp/identity_manager.cc
+++ b/services/identity/public/cpp/identity_manager.cc
@@ -40,20 +40,20 @@
 }  // namespace
 
 IdentityManager::IdentityManager(
+    std::unique_ptr<GaiaCookieManagerService> gaia_cookie_manager_service,
     std::unique_ptr<SigninManagerBase> signin_manager,
     ProfileOAuth2TokenService* token_service,
     AccountFetcherService* account_fetcher_service,
     AccountTrackerService* account_tracker_service,
-    GaiaCookieManagerService* gaia_cookie_manager_service,
     std::unique_ptr<PrimaryAccountMutator> primary_account_mutator,
     std::unique_ptr<AccountsMutator> accounts_mutator,
     std::unique_ptr<AccountsCookieMutator> accounts_cookie_mutator,
     std::unique_ptr<DiagnosticsProvider> diagnostics_provider)
-    : signin_manager_(std::move(signin_manager)),
+    : gaia_cookie_manager_service_(std::move(gaia_cookie_manager_service)),
+      signin_manager_(std::move(signin_manager)),
       token_service_(token_service),
       account_fetcher_service_(account_fetcher_service),
       account_tracker_service_(account_tracker_service),
-      gaia_cookie_manager_service_(gaia_cookie_manager_service),
       primary_account_mutator_(std::move(primary_account_mutator)),
       accounts_mutator_(std::move(accounts_mutator)),
       accounts_cookie_mutator_(std::move(accounts_cookie_mutator)),
@@ -271,10 +271,15 @@
 }
 
 // static
-void IdentityManager::RegisterPrefs(PrefRegistrySimple* registry) {
+void IdentityManager::RegisterLocalStatePrefs(PrefRegistrySimple* registry) {
   SigninManagerBase::RegisterPrefs(registry);
 }
 
+// static
+void IdentityManager::RegisterProfilePrefs(PrefRegistrySimple* registry) {
+  SigninManagerBase::RegisterProfilePrefs(registry);
+}
+
 std::string IdentityManager::PickAccountIdForAccount(
     const std::string& gaia,
     const std::string& email) const {
@@ -386,6 +391,10 @@
   diagnostics_observer_list_.RemoveObserver(observer);
 }
 
+void IdentityManager::Shutdown() {
+  gaia_cookie_manager_service_->Shutdown();
+}
+
 SigninManagerBase* IdentityManager::GetSigninManager() {
   return signin_manager_.get();
 }
@@ -403,7 +412,7 @@
 }
 
 GaiaCookieManagerService* IdentityManager::GetGaiaCookieManagerService() {
-  return gaia_cookie_manager_service_;
+  return gaia_cookie_manager_service_.get();
 }
 
 AccountInfo IdentityManager::GetAccountInfoForAccountWithRefreshToken(
diff --git a/services/identity/public/cpp/identity_manager.h b/services/identity/public/cpp/identity_manager.h
index 51873c3..aaa280c67 100644
--- a/services/identity/public/cpp/identity_manager.h
+++ b/services/identity/public/cpp/identity_manager.h
@@ -198,11 +198,11 @@
   };
 
   IdentityManager(
+      std::unique_ptr<GaiaCookieManagerService> gaia_cookie_manager_service,
       std::unique_ptr<SigninManagerBase> signin_manager,
       ProfileOAuth2TokenService* token_service,
       AccountFetcherService* account_fetcher_service,
       AccountTrackerService* account_tracker_service,
-      GaiaCookieManagerService* gaia_cookie_manager_service,
       std::unique_ptr<PrimaryAccountMutator> primary_account_mutator,
       std::unique_ptr<AccountsMutator> accounts_mutator,
       std::unique_ptr<AccountsCookieMutator> accounts_cookie_mutator,
@@ -357,8 +357,11 @@
   // supported for the current platform.
   static bool IsAccountIdMigrationSupported();
 
-  // Registers local state prefs used by this class.
-  static void RegisterPrefs(PrefRegistrySimple* registry);
+  // Registers per-install prefs used by this class.
+  static void RegisterLocalStatePrefs(PrefRegistrySimple* registry);
+
+  // Registers per-profile prefs used by this class.
+  static void RegisterProfilePrefs(PrefRegistrySimple* registry);
 
   // Picks the correct account_id for the specified account depending on the
   // migration state.
@@ -469,6 +472,9 @@
   void AddDiagnosticsObserver(DiagnosticsObserver* observer);
   void RemoveDiagnosticsObserver(DiagnosticsObserver* observer);
 
+ protected:
+  void Shutdown();
+
  private:
   // These test helpers need to use some of the private methods below.
   friend CoreAccountInfo SetPrimaryAccount(IdentityManager* identity_manager,
@@ -549,6 +555,31 @@
   FRIEND_TEST_ALL_PREFIXES(IdentityManagerTest, RemoveAccessTokenFromCache);
   FRIEND_TEST_ALL_PREFIXES(IdentityManagerTest,
                            CreateAccessTokenFetcherWithCustomURLLoaderFactory);
+  FRIEND_TEST_ALL_PREFIXES(
+      IdentityManagerTest,
+      CallbackSentOnUpdateToAccountsInCookieWithNoAccounts);
+  FRIEND_TEST_ALL_PREFIXES(
+      IdentityManagerTest,
+      CallbackSentOnUpdateToAccountsInCookieWithOneAccount);
+  FRIEND_TEST_ALL_PREFIXES(
+      IdentityManagerTest,
+      CallbackSentOnUpdateToAccountsInCookieWithTwoAccounts);
+  FRIEND_TEST_ALL_PREFIXES(IdentityManagerTest,
+                           CallbackSentOnUpdateToSignOutAccountsInCookie);
+  FRIEND_TEST_ALL_PREFIXES(
+      IdentityManagerTest,
+      CallbackSentOnUpdateToAccountsInCookieWithStaleAccounts);
+  FRIEND_TEST_ALL_PREFIXES(IdentityManagerTest,
+                           CallbackSentOnSuccessfulAdditionOfAccountToCookie);
+  FRIEND_TEST_ALL_PREFIXES(IdentityManagerTest,
+                           CallbackSentOnFailureAdditionOfAccountToCookie);
+  FRIEND_TEST_ALL_PREFIXES(IdentityManagerTest,
+                           CallbackSentOnSetAccountsInCookieCompleted_Success);
+  FRIEND_TEST_ALL_PREFIXES(IdentityManagerTest,
+                           CallbackSentOnSetAccountsInCookieCompleted_Failure);
+  FRIEND_TEST_ALL_PREFIXES(IdentityManagerTest,
+                           CallbackSentOnAccountsCookieDeletedByUserAction);
+  FRIEND_TEST_ALL_PREFIXES(IdentityManagerTest, OnNetworkInitialized);
 
   // Private getters used for testing only (i.e. see identity_test_utils.h).
   SigninManagerBase* GetSigninManager();
@@ -616,11 +647,11 @@
   // these classes in the IdentityManager implementation, as all such
   // synchronous access will become impossible when IdentityManager is
   // backed by the Identity Service.
+  std::unique_ptr<GaiaCookieManagerService> gaia_cookie_manager_service_;
   std::unique_ptr<SigninManagerBase> signin_manager_;
   ProfileOAuth2TokenService* token_service_;
   AccountFetcherService* account_fetcher_service_;
   AccountTrackerService* account_tracker_service_;
-  GaiaCookieManagerService* gaia_cookie_manager_service_;
 
   // PrimaryAccountMutator instance. May be null if mutation of the primary
   // account state is not supported on the current platform.
diff --git a/services/identity/public/cpp/identity_manager_unittest.cc b/services/identity/public/cpp/identity_manager_unittest.cc
index 7015c15..7c0032a 100644
--- a/services/identity/public/cpp/identity_manager_unittest.cc
+++ b/services/identity/public/cpp/identity_manager_unittest.cc
@@ -255,22 +255,12 @@
 class IdentityManagerTest : public testing::Test {
  protected:
   IdentityManagerTest()
-      : signin_client_(&pref_service_),
-        token_service_(&pref_service_),
-        gaia_cookie_manager_service_(
-            &token_service_,
-            &signin_client_,
-            base::BindRepeating(
-                [](network::TestURLLoaderFactory* test_url_loader_factory)
-                    -> scoped_refptr<network::SharedURLLoaderFactory> {
-                  return test_url_loader_factory->GetSafeWeakWrapper();
-                },
-                test_url_loader_factory())) {
+      : signin_client_(&pref_service_), token_service_(&pref_service_) {
     AccountTrackerService::RegisterPrefs(pref_service_.registry());
     AccountFetcherService::RegisterPrefs(pref_service_.registry());
     ProfileOAuth2TokenService::RegisterProfilePrefs(pref_service_.registry());
-    SigninManagerBase::RegisterProfilePrefs(pref_service_.registry());
-    SigninManagerBase::RegisterPrefs(pref_service_.registry());
+    IdentityManager::RegisterProfilePrefs(pref_service_.registry());
+    IdentityManager::RegisterLocalStatePrefs(pref_service_.registry());
 
     account_tracker_.Initialize(&pref_service_, base::FilePath());
     account_fetcher_.Initialize(
@@ -284,7 +274,6 @@
   ~IdentityManagerTest() override {
     signin_client_.Shutdown();
     token_service_.Shutdown();
-    gaia_cookie_manager_service_.Shutdown();
     account_tracker_.Shutdown();
     account_fetcher_.Shutdown();
   }
@@ -295,21 +284,22 @@
   }
 
   IdentityManager* identity_manager() { return identity_manager_.get(); }
+
   TestIdentityManagerObserver* identity_manager_observer() {
     return identity_manager_observer_.get();
   }
+
   TestIdentityManagerDiagnosticsObserver*
   identity_manager_diagnostics_observer() {
     return identity_manager_diagnostics_observer_.get();
   }
+
   AccountTrackerService* account_tracker() { return &account_tracker_; }
+
   AccountFetcherService* account_fetcher() { return &account_fetcher_; }
   CustomFakeProfileOAuth2TokenService* token_service() {
     return &token_service_;
   }
-  GaiaCookieManagerService* gaia_cookie_manager_service() {
-    return &gaia_cookie_manager_service_;
-  }
 
   // See RecreateIdentityManager.
   enum class SigninManagerSetup {
@@ -338,6 +328,16 @@
     identity_manager_diagnostics_observer_.reset();
     identity_manager_.reset();
 
+    auto gaia_cookie_manager_service =
+        std::make_unique<GaiaCookieManagerService>(
+            &token_service_, &signin_client_,
+            base::BindRepeating(
+                [](network::TestURLLoaderFactory* test_url_loader_factory)
+                    -> scoped_refptr<network::SharedURLLoaderFactory> {
+                  return test_url_loader_factory->GetSafeWeakWrapper();
+                },
+                test_url_loader_factory()));
+
 #if defined(OS_CHROMEOS)
     DCHECK_EQ(account_consistency, signin::AccountConsistencyMethod::kDisabled)
         << "AccountConsistency is not used by SigninManagerBase";
@@ -346,7 +346,7 @@
 #else
     auto signin_manager = std::make_unique<SigninManager>(
         &signin_client_, &token_service_, &account_tracker_,
-        &gaia_cookie_manager_service_, account_consistency);
+        gaia_cookie_manager_service.get(), account_consistency);
 #endif
 
     // Passing this switch ensures that the new SigninManager starts with a
@@ -361,13 +361,16 @@
       signin_manager->SetAuthenticatedAccountInfo(kTestGaiaId, kTestEmail);
     }
 
+    auto accounts_cookie_mutator = std::make_unique<AccountsCookieMutatorImpl>(
+        gaia_cookie_manager_service.get());
+
+    auto diagnostics_provider = std::make_unique<DiagnosticsProviderImpl>(
+        &token_service_, gaia_cookie_manager_service.get());
+
     identity_manager_.reset(new IdentityManager(
-        std::move(signin_manager), &token_service_, &account_fetcher_,
-        &account_tracker_, &gaia_cookie_manager_service_, nullptr, nullptr,
-        std::make_unique<AccountsCookieMutatorImpl>(
-            &gaia_cookie_manager_service_),
-        std::make_unique<DiagnosticsProviderImpl>(
-            &token_service_, &gaia_cookie_manager_service_)));
+        std::move(gaia_cookie_manager_service), std::move(signin_manager),
+        &token_service_, &account_fetcher_, &account_tracker_, nullptr, nullptr,
+        std::move(accounts_cookie_mutator), std::move(diagnostics_provider)));
     identity_manager_observer_.reset(
         new TestIdentityManagerObserver(identity_manager_.get()));
     identity_manager_diagnostics_observer_.reset(
@@ -413,7 +416,6 @@
   TestSigninClient signin_client_;
   CustomFakeProfileOAuth2TokenService token_service_;
   network::TestURLLoaderFactory test_url_loader_factory_;
-  GaiaCookieManagerService gaia_cookie_manager_service_;
   std::unique_ptr<IdentityManager> identity_manager_;
   std::unique_ptr<TestIdentityManagerObserver> identity_manager_observer_;
   std::unique_ptr<TestIdentityManagerDiagnosticsObserver>
@@ -1617,7 +1619,7 @@
       run_loop.QuitClosure());
 
   signin::SetListAccountsResponseNoAccounts(test_url_loader_factory());
-  gaia_cookie_manager_service()->TriggerListAccounts();
+  identity_manager()->GetGaiaCookieManagerService()->TriggerListAccounts();
   run_loop.Run();
 
   const AccountsInCookieJarInfo& accounts_in_cookie_jar_info =
@@ -1635,7 +1637,7 @@
 
   signin::SetListAccountsResponseOneAccount(kTestEmail, kTestGaiaId,
                                             test_url_loader_factory());
-  gaia_cookie_manager_service()->TriggerListAccounts();
+  identity_manager()->GetGaiaCookieManagerService()->TriggerListAccounts();
   run_loop.Run();
 
   const AccountsInCookieJarInfo& accounts_in_cookie_jar_info =
@@ -1663,7 +1665,7 @@
   signin::SetListAccountsResponseTwoAccounts(kTestEmail, kTestGaiaId,
                                              kTestEmail2, kTestGaiaId2,
                                              test_url_loader_factory());
-  gaia_cookie_manager_service()->TriggerListAccounts();
+  identity_manager()->GetGaiaCookieManagerService()->TriggerListAccounts();
   run_loop.Run();
 
   const AccountsInCookieJarInfo& accounts_in_cookie_jar_info =
@@ -1710,7 +1712,7 @@
           signed_out_status.account_2 /* signed_out */, true /* verified */}},
         test_url_loader_factory());
 
-    gaia_cookie_manager_service()->TriggerListAccounts();
+    identity_manager()->GetGaiaCookieManagerService()->TriggerListAccounts();
     run_loop.Run();
 
     unsigned int accounts_signed_out =
@@ -1762,7 +1764,7 @@
 
   // Configure list accounts to return a permanent Gaia auth error.
   signin::SetListAccountsResponseWebLoginRequired(test_url_loader_factory());
-  gaia_cookie_manager_service()->TriggerListAccounts();
+  identity_manager()->GetGaiaCookieManagerService()->TriggerListAccounts();
   run_loop.Run();
 
   const AccountsInCookieJarInfo& accounts_in_cookie_jar_info =
@@ -1897,11 +1899,11 @@
         error_from_add_account_to_cookie_completed_callback = error;
       });
 
-  gaia_cookie_manager_service()->AddAccountToCookie(
+  identity_manager()->GetGaiaCookieManagerService()->AddAccountToCookie(
       kTestAccountId, gaia::GaiaSource::kChrome,
       std::move(completion_callback));
-  SimulateAdditionOfAccountToCookieSuccess(gaia_cookie_manager_service(),
-                                           "token");
+  SimulateAdditionOfAccountToCookieSuccess(
+      identity_manager()->GetGaiaCookieManagerService(), "token");
   EXPECT_EQ(account_from_add_account_to_cookie_completed_callback,
             kTestAccountId);
   EXPECT_EQ(error_from_add_account_to_cookie_completed_callback,
@@ -1919,13 +1921,13 @@
         error_from_add_account_to_cookie_completed_callback = error;
       });
 
-  gaia_cookie_manager_service()->AddAccountToCookie(
+  identity_manager()->GetGaiaCookieManagerService()->AddAccountToCookie(
       kTestAccountId, gaia::GaiaSource::kChrome,
       std::move(completion_callback));
 
   GoogleServiceAuthError error(GoogleServiceAuthError::SERVICE_ERROR);
-  SimulateAdditionOfAccountToCookieSuccessFailure(gaia_cookie_manager_service(),
-                                                  error);
+  SimulateAdditionOfAccountToCookieSuccessFailure(
+      identity_manager()->GetGaiaCookieManagerService(), error);
 
   EXPECT_EQ(account_from_add_account_to_cookie_completed_callback,
             kTestAccountId);
@@ -1947,7 +1949,7 @@
       });
 
   // Needed to insert request in the queue.
-  gaia_cookie_manager_service()->SetAccountsInCookie(
+  identity_manager()->GetGaiaCookieManagerService()->SetAccountsInCookie(
       account_ids, gaia::GaiaSource::kChrome, std::move(completion_callback));
 
   // Sample success cookie response.
@@ -1971,7 +1973,8 @@
     )";
   OAuthMultiloginResult result(data);
 
-  SimulateOAuthMultiloginFinished(gaia_cookie_manager_service(), result);
+  SimulateOAuthMultiloginFinished(
+      identity_manager()->GetGaiaCookieManagerService(), result);
 
   EXPECT_EQ(error_from_set_accounts_in_cookie_completed_callback,
             GoogleServiceAuthError::AuthErrorNone());
@@ -1992,14 +1995,15 @@
       });
 
   // Needed to insert request in the queue.
-  gaia_cookie_manager_service()->SetAccountsInCookie(
+  identity_manager()->GetGaiaCookieManagerService()->SetAccountsInCookie(
       account_ids, gaia::GaiaSource::kChrome, std::move(completion_callback));
 
   // Sample an erroneous response.
   GoogleServiceAuthError error(GoogleServiceAuthError::SERVICE_ERROR);
   OAuthMultiloginResult result(error);
 
-  SimulateOAuthMultiloginFinished(gaia_cookie_manager_service(), result);
+  SimulateOAuthMultiloginFinished(
+      identity_manager()->GetGaiaCookieManagerService(), result);
 
   EXPECT_EQ(error_from_set_accounts_in_cookie_completed_callback, error);
 }
@@ -2011,7 +2015,7 @@
                                                 kTestAccountId2};
 
   // Needed to insert request in the queue.
-  gaia_cookie_manager_service()->SetAccountsInCookie(
+  identity_manager()->GetGaiaCookieManagerService()->SetAccountsInCookie(
       account_ids, gaia::GaiaSource::kChrome,
       GaiaCookieManagerService::SetAccountsInCookieCompletedCallback());
 
@@ -2036,7 +2040,8 @@
     )";
   OAuthMultiloginResult result(data);
 
-  SimulateOAuthMultiloginFinished(gaia_cookie_manager_service(), result);
+  SimulateOAuthMultiloginFinished(
+      identity_manager()->GetGaiaCookieManagerService(), result);
   base::RunLoop().RunUntilIdle();
 
   base::RunLoop run_loop;
@@ -2044,7 +2049,8 @@
       run_loop.QuitClosure());
 
   const std::vector<net::CanonicalCookie>& cookies = result.cookies();
-  SimulateCookieDeletedByUser(gaia_cookie_manager_service(), cookies[0]);
+  SimulateCookieDeletedByUser(identity_manager()->GetGaiaCookieManagerService(),
+                              cookies[0]);
   run_loop.Run();
 }
 
@@ -2062,7 +2068,7 @@
   identity_manager()->OnNetworkInitialized();
 
   // Needed to insert request in the queue.
-  gaia_cookie_manager_service()->SetAccountsInCookie(
+  identity_manager()->GetGaiaCookieManagerService()->SetAccountsInCookie(
       account_ids, gaia::GaiaSource::kChrome,
       GaiaCookieManagerService::SetAccountsInCookieCompletedCallback());
 
@@ -2087,7 +2093,8 @@
     )";
   OAuthMultiloginResult result(data);
 
-  SimulateOAuthMultiloginFinished(gaia_cookie_manager_service(), result);
+  SimulateOAuthMultiloginFinished(
+      identity_manager()->GetGaiaCookieManagerService(), result);
   base::RunLoop().RunUntilIdle();
 
   base::RunLoop run_loop;
diff --git a/services/identity/public/cpp/identity_test_environment.cc b/services/identity/public/cpp/identity_test_environment.cc
index 1247dd2..6c67c4b 100644
--- a/services/identity/public/cpp/identity_test_environment.cc
+++ b/services/identity/public/cpp/identity_test_environment.cc
@@ -106,7 +106,6 @@
           /*account_tracker_service=*/nullptr,
           /*account_fetcher_service=*/nullptr,
           /*token_service=*/nullptr,
-          /*gaia_cookie_manager_service=*/nullptr,
           test_url_loader_factory,
           account_consistency,
           std::make_unique<IdentityManagerDependenciesOwner>(
@@ -119,7 +118,6 @@
     AccountTrackerService* account_tracker_service,
     AccountFetcherService* account_fetcher_service,
     FakeProfileOAuth2TokenService* token_service,
-    GaiaCookieManagerService* gaia_cookie_manager_service,
     IdentityManager* identity_manager,
     network::TestURLLoaderFactory* test_url_loader_factory,
     signin::AccountConsistencyMethod account_consistency)
@@ -127,7 +125,6 @@
                               account_tracker_service,
                               account_fetcher_service,
                               token_service,
-                              gaia_cookie_manager_service,
                               test_url_loader_factory,
                               account_consistency,
                               /*dependency_owner=*/nullptr,
@@ -138,7 +135,6 @@
     AccountTrackerService* account_tracker_service,
     AccountFetcherService* account_fetcher_service,
     FakeProfileOAuth2TokenService* token_service,
-    GaiaCookieManagerService* gaia_cookie_manager_service,
     network::TestURLLoaderFactory* test_url_loader_factory,
     signin::AccountConsistencyMethod account_consistency,
     std::unique_ptr<IdentityManagerDependenciesOwner> dependencies_owner,
@@ -154,7 +150,7 @@
   TestSigninClient* test_signin_client = nullptr;
   if (dependencies_owner) {
     DCHECK(!(account_tracker_service || account_fetcher_service ||
-             token_service || gaia_cookie_manager_service || identity_manager));
+             token_service || identity_manager));
 
     dependencies_owner_ = std::move(dependencies_owner);
     test_signin_client = dependencies_owner_->signin_client();
@@ -184,22 +180,6 @@
         std::make_unique<image_fetcher::FakeImageDecoder>());
     account_fetcher_service = owned_account_fetcher_service_.get();
 
-    if (test_url_loader_factory != nullptr) {
-      owned_gaia_cookie_manager_service_ =
-          std::make_unique<GaiaCookieManagerService>(
-              token_service, test_signin_client,
-              base::BindRepeating(
-                  [](network::TestURLLoaderFactory* test_url_loader_factory)
-                      -> scoped_refptr<network::SharedURLLoaderFactory> {
-                    return test_url_loader_factory->GetSafeWeakWrapper();
-                  },
-                  test_url_loader_factory));
-    } else {
-      owned_gaia_cookie_manager_service_ =
-          std::make_unique<GaiaCookieManagerService>(token_service,
-                                                     test_signin_client);
-    }
-    gaia_cookie_manager_service = owned_gaia_cookie_manager_service_.get();
   } else {
     owned_signin_client_ = std::make_unique<TestSigninClient>(pref_service);
     test_signin_client = owned_signin_client_.get();
@@ -218,7 +198,7 @@
     raw_identity_manager_ = identity_manager;
   } else {
     DCHECK(pref_service && account_tracker_service && account_fetcher_service &&
-           token_service && gaia_cookie_manager_service);
+           token_service);
 #if defined(OS_CHROMEOS)
     std::unique_ptr<SigninManagerBase> signin_manager =
         std::make_unique<SigninManagerBase>(test_signin_client, token_service,
@@ -230,6 +210,22 @@
                                         account_consistency);
 #endif
     signin_manager->Initialize(pref_service);
+
+    std::unique_ptr<GaiaCookieManagerService> gaia_cookie_manager_service;
+    if (test_url_loader_factory != nullptr) {
+      gaia_cookie_manager_service = std::make_unique<GaiaCookieManagerService>(
+          token_service, test_signin_client,
+          base::BindRepeating(
+              [](network::TestURLLoaderFactory* test_url_loader_factory)
+                  -> scoped_refptr<network::SharedURLLoaderFactory> {
+                return test_url_loader_factory->GetSafeWeakWrapper();
+              },
+              test_url_loader_factory));
+    } else {
+      gaia_cookie_manager_service = std::make_unique<GaiaCookieManagerService>(
+          token_service, test_signin_client);
+    }
+
     std::unique_ptr<PrimaryAccountMutator> primary_account_mutator;
     std::unique_ptr<AccountsMutator> accounts_mutator;
 
@@ -246,16 +242,16 @@
 #endif
 
     std::unique_ptr<DiagnosticsProvider> diagnostics_provider =
-        std::make_unique<DiagnosticsProviderImpl>(token_service,
-                                                  gaia_cookie_manager_service);
+        std::make_unique<DiagnosticsProviderImpl>(
+            token_service, gaia_cookie_manager_service.get());
 
     std::unique_ptr<AccountsCookieMutator> accounts_cookie_mutator =
         std::make_unique<AccountsCookieMutatorImpl>(
-            gaia_cookie_manager_service);
+            gaia_cookie_manager_service.get());
 
     owned_identity_manager_ = std::make_unique<IdentityManager>(
-        std::move(signin_manager), token_service, account_fetcher_service,
-        account_tracker_service, gaia_cookie_manager_service,
+        std::move(gaia_cookie_manager_service), std::move(signin_manager),
+        token_service, account_fetcher_service, account_tracker_service,
         std::move(primary_account_mutator), std::move(accounts_mutator),
         std::move(accounts_cookie_mutator), std::move(diagnostics_provider));
   }
@@ -276,6 +272,7 @@
   }
 
   identity_manager()->RemoveDiagnosticsObserver(this);
+  identity_manager()->Shutdown();
 }
 
 IdentityManager* IdentityTestEnvironment::identity_manager() {
diff --git a/services/identity/public/cpp/identity_test_environment.h b/services/identity/public/cpp/identity_test_environment.h
index 90ef9f0..9f7c612 100644
--- a/services/identity/public/cpp/identity_test_environment.h
+++ b/services/identity/public/cpp/identity_test_environment.h
@@ -13,11 +13,9 @@
 class AccountFetcherService;
 class AccountTrackerService;
 class FakeProfileOAuth2TokenService;
-class GaiaCookieManagerService;
 class IdentityTestEnvironmentChromeBrowserStateAdaptor;
 class IdentityTestEnvironmentProfileAdaptor;
 class PrefService;
-class SigninManager;
 class TestSigninClient;
 
 namespace sync_preferences {
@@ -57,9 +55,8 @@
   //
   // This constructor also takes an optional PrefService instance as parameter,
   // which allows tests to move away from referencing IdentityManager's
-  // dependencies directly (namely AccountTrackerService, PO2TS, SigninManager
-  // and GaiaCookieManagerService), but still be able to tweak preferences on
-  // demand.
+  // dependencies directly (namely AccountTrackerService, PO2TS), but still be
+  // able to tweak preferences on demand.
   //
   // Last, this constructor can take an optional parameter |account_consistency|
   // as parameter, to specify the account consistency policy that will be used.
@@ -309,7 +306,6 @@
       AccountTrackerService* account_tracker_service,
       AccountFetcherService* account_fetcher_service,
       FakeProfileOAuth2TokenService* token_service,
-      GaiaCookieManagerService* gaia_cookie_manager_service,
       IdentityManager* identity_manager,
       network::TestURLLoaderFactory* test_url_loader_factory = nullptr,
       signin::AccountConsistencyMethod account_consistency =
@@ -331,7 +327,6 @@
       AccountTrackerService* account_tracker_service,
       AccountFetcherService* account_fetcher_service,
       FakeProfileOAuth2TokenService* token_service,
-      GaiaCookieManagerService* gaia_cookie_manager_service,
       network::TestURLLoaderFactory* test_url_loader_factory,
       signin::AccountConsistencyMethod account_consistency,
       std::unique_ptr<IdentityManagerDependenciesOwner> dependencies_owner,
@@ -378,10 +373,6 @@
   // IdentityTestEnvironment's constructor.
   std::unique_ptr<FakeProfileOAuth2TokenService> owned_token_service_;
 
-  // This will be null if a GaiaCookieManagerService was provided to
-  // IdentityTestEnvironment's constructor.
-  std::unique_ptr<GaiaCookieManagerService> owned_gaia_cookie_manager_service_;
-
   // Depending on which constructor is used, exactly one of these will be
   // non-null. See the documentation on the constructor wherein IdentityManager
   // is passed in for required lifetime invariants in that case.
diff --git a/services/tracing/public/cpp/tracing_features.cc b/services/tracing/public/cpp/tracing_features.cc
index f474a289..ee6a3979 100644
--- a/services/tracing/public/cpp/tracing_features.cc
+++ b/services/tracing/public/cpp/tracing_features.cc
@@ -37,12 +37,16 @@
   // This is checked early at startup, so feature list may not be initialized.
   // So, for startup tracing cases there is no way to control the backend using
   // feature list.
+  if (base::CommandLine::ForCurrentProcess()->HasSwitch(
+          switches::kDisablePerfetto)) {
+    return false;
+  }
+
   if (base::FeatureList::GetInstance()) {
     return base::FeatureList::IsEnabled(features::kTracingPerfettoBackend);
   }
 
-  return !base::CommandLine::ForCurrentProcess()->HasSwitch(
-      switches::kDisablePerfetto);
+  return true;
 }
 
 }  // namespace tracing
diff --git a/testing/variations/fieldtrial_testing_config.json b/testing/variations/fieldtrial_testing_config.json
index 112d0bf..4c66d7d 100644
--- a/testing/variations/fieldtrial_testing_config.json
+++ b/testing/variations/fieldtrial_testing_config.json
@@ -4892,6 +4892,25 @@
             ]
         }
     ],
+    "SyncUssPasswords'": [
+        {
+            "platforms": [
+                "android",
+                "chromeos",
+                "ios",
+                "mac",
+                "windows"
+            ],
+            "experiments": [
+                {
+                    "name": "Enabled",
+                    "enable_features": [
+                        "SyncUSSPasswords"
+                    ]
+                }
+            ]
+        }
+    ],
     "TabRanker": [
         {
             "platforms": [
diff --git a/third_party/.gitignore b/third_party/.gitignore
index 5de7fa31..ca1f53ee 100644
--- a/third_party/.gitignore
+++ b/third_party/.gitignore
@@ -30,6 +30,10 @@
 /apache-win32/bin/iconv/*.so
 /apache-win32/modules/*.so
 /apache-win32/modules/*.dll
+/apache-mac/bin/httpd
+/apache-mac/bin/openssl
+/apache-mac/lib/*.dylib
+/apache-mac/libexec/apache2/*.so
 /apk-patch-size-estimator/lib/
 /arcore-android-sdk/src/
 /arcore-android-sdk/test-apks/arcore/*.apk
diff --git a/third_party/apache-mac/LICENSE b/third_party/apache-mac/LICENSE
new file mode 100644
index 0000000..08f7a7ae
--- /dev/null
+++ b/third_party/apache-mac/LICENSE
@@ -0,0 +1,1743 @@
+This directory contains binaries for Apache httpd, PHP, and their dependencies.
+License and notices for each are listed below:
+
+=======================
+
+apr-1.6.5/LICENSE:
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+
+
+
+APACHE PORTABLE RUNTIME SUBCOMPONENTS: 
+
+The Apache Portable Runtime includes a number of subcomponents with
+separate copyright notices and license terms. Your use of the source
+code for these subcomponents is subject to the terms and conditions
+of the following licenses. 
+
+From strings/apr_fnmatch.c, include/apr_fnmatch.h, misc/unix/getopt.c,
+file_io/unix/mktemp.c, strings/apr_strings.c:
+
+/* 
+ * Copyright (c) 1987, 1993, 1994
+ *      The Regents of the University of California.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *      This product includes software developed by the University of
+ *      California, Berkeley and its contributors.
+ * 4. Neither the name of the University nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+
+From network_io/unix/inet_ntop.c, network_io/unix/inet_pton.c:
+
+/* Copyright (c) 1996 by Internet Software Consortium.
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND INTERNET SOFTWARE CONSORTIUM DISCLAIMS
+ * ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL INTERNET SOFTWARE
+ * CONSORTIUM BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL
+ * DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR
+ * PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS
+ * ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS
+ * SOFTWARE.
+
+From dso/aix/dso.c:
+
+ *  Based on libdl (dlfcn.c/dlfcn.h) which is
+ *  Copyright (c) 1992,1993,1995,1996,1997,1988
+ *  Jens-Uwe Mager, Helios Software GmbH, Hannover, Germany.
+ *
+ *  Not derived from licensed software.
+ *
+ *  Permission is granted to freely use, copy, modify, and redistribute
+ *  this software, provided that the author is not construed to be liable
+ *  for any results of using the software, alterations are clearly marked
+ *  as such, and this notice is not modified.
+
+From strings/apr_strnatcmp.c, include/apr_strings.h:
+
+  strnatcmp.c -- Perform 'natural order' comparisons of strings in C.
+  Copyright (C) 2000 by Martin Pool <mbp@humbug.org.au>
+
+  This software is provided 'as-is', without any express or implied
+  warranty.  In no event will the authors be held liable for any damages
+  arising from the use of this software.
+
+  Permission is granted to anyone to use this software for any purpose,
+  including commercial applications, and to alter it and redistribute it
+  freely, subject to the following restrictions:
+
+  1. The origin of this software must not be misrepresented; you must not
+     claim that you wrote the original software. If you use this software
+     in a product, an acknowledgment in the product documentation would be
+     appreciated but is not required.
+  2. Altered source versions must be plainly marked as such, and must not be
+     misrepresented as being the original software.
+  3. This notice may not be removed or altered from any source distribution.
+
+From strings/apr_snprintf.c:
+
+  *
+  * cvt - IEEE floating point formatting routines.
+  *       Derived from UNIX V7, Copyright(C) Caldera International Inc.
+  *
+
+  Copyright(C) Caldera International Inc.  2001-2002.  All rights reserved.
+  
+  Redistribution and use in source and binary forms, with or without
+  modification, are permitted provided that the following conditions are
+  met:
+
+  Redistributions of source code and documentation must retain the above
+  copyright notice, this list of conditions and the following disclaimer.
+
+  Redistributions in binary form must reproduce the above copyright
+  notice, this list of conditions and the following disclaimer in the
+  documentation and/or other materials provided with the distribution.
+
+  All advertising materials mentioning features or use of this software
+  must display the following acknowledgement:
+
+     This product includes software developed or owned by  Caldera
+     International, Inc.
+
+  Neither the name of Caldera International, Inc. nor the names of other
+  contributors may be used to endorse or promote products derived from
+  this software without specific prior written permission.
+
+  USE OF THE SOFTWARE PROVIDED FOR UNDER THIS LICENSE BY CALDERA
+  INTERNATIONAL, INC. AND CONTRIBUTORS ``AS IS'' AND ANY EXPRESS OR IMPLIED
+  WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
+  MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.  IN
+  NO EVENT SHALL CALDERA INTERNATIONAL, INC. BE LIABLE FOR ANY DIRECT,
+  INDIRECT INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+  (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+  SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+  HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+  STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
+  ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+  POSSIBILITY OF SUCH DAMAGE.
+
+
+
+=======================
+
+apr-1.6.5/NOTICE:
+Apache Portable Runtime
+Copyright (c) 2000-2018 The Apache Software Foundation.
+
+This product includes software developed at
+The Apache Software Foundation (http://www.apache.org/).
+
+Portions of this software were developed at the National Center
+for Supercomputing Applications (NCSA) at the University of
+Illinois at Urbana-Champaign.
+
+This software contains code derived from the RSA Data Security
+Inc. MD5 Message-Digest Algorithm.
+
+This software contains code derived from UNIX V7, Copyright(C)
+Caldera International Inc.
+
+=======================
+
+apr-util-1.6.1/LICENSE:
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+
+
+
+APACHE PORTABLE RUNTIME SUBCOMPONENTS: 
+
+The Apache Portable Runtime includes a number of subcomponents with
+separate copyright notices and license terms. Your use of the source
+code for the these subcomponents is subject to the terms and
+conditions of the following licenses. 
+
+For the include\apr_md5.h component: 
+/*
+ * This is work is derived from material Copyright RSA Data Security, Inc.
+ *
+ * The RSA copyright statement and Licence for that original material is
+ * included below. This is followed by the Apache copyright statement and
+ * licence for the modifications made to that material.
+ */
+
+/* Copyright (C) 1991-2, RSA Data Security, Inc. Created 1991. All
+   rights reserved.
+
+   License to copy and use this software is granted provided that it
+   is identified as the "RSA Data Security, Inc. MD5 Message-Digest
+   Algorithm" in all material mentioning or referencing this software
+   or this function.
+
+   License is also granted to make and use derivative works provided
+   that such works are identified as "derived from the RSA Data
+   Security, Inc. MD5 Message-Digest Algorithm" in all material
+   mentioning or referencing the derived work.
+
+   RSA Data Security, Inc. makes no representations concerning either
+   the merchantability of this software or the suitability of this
+   software for any particular purpose. It is provided "as is"
+   without express or implied warranty of any kind.
+
+   These notices must be retained in any copies of any part of this
+   documentation and/or software.
+ */
+
+For the passwd\apr_md5.c component:
+
+/*
+ * This is work is derived from material Copyright RSA Data Security, Inc.
+ *
+ * The RSA copyright statement and Licence for that original material is
+ * included below. This is followed by the Apache copyright statement and
+ * licence for the modifications made to that material.
+ */
+
+/* MD5C.C - RSA Data Security, Inc., MD5 message-digest algorithm
+ */
+
+/* Copyright (C) 1991-2, RSA Data Security, Inc. Created 1991. All
+   rights reserved.
+
+   License to copy and use this software is granted provided that it
+   is identified as the "RSA Data Security, Inc. MD5 Message-Digest
+   Algorithm" in all material mentioning or referencing this software
+   or this function.
+
+   License is also granted to make and use derivative works provided
+   that such works are identified as "derived from the RSA Data
+   Security, Inc. MD5 Message-Digest Algorithm" in all material
+   mentioning or referencing the derived work.
+
+   RSA Data Security, Inc. makes no representations concerning either
+   the merchantability of this software or the suitability of this
+   software for any particular purpose. It is provided "as is"
+   without express or implied warranty of any kind.
+
+   These notices must be retained in any copies of any part of this
+   documentation and/or software.
+ */
+/*
+ * The apr_md5_encode() routine uses much code obtained from the FreeBSD 3.0
+ * MD5 crypt() function, which is licenced as follows:
+ * ----------------------------------------------------------------------------
+ * "THE BEER-WARE LICENSE" (Revision 42):
+ * <phk@login.dknet.dk> wrote this file.  As long as you retain this notice you
+ * can do whatever you want with this stuff. If we meet some day, and you think
+ * this stuff is worth it, you can buy me a beer in return.  Poul-Henning Kamp
+ * ----------------------------------------------------------------------------
+ */
+
+For the crypto\apr_md4.c component:
+
+ * This is derived from material copyright RSA Data Security, Inc.
+ * Their notice is reproduced below in its entirety.
+ *
+ * Copyright (C) 1991-2, RSA Data Security, Inc. Created 1991. All
+ * rights reserved.
+ *
+ * License to copy and use this software is granted provided that it
+ * is identified as the "RSA Data Security, Inc. MD4 Message-Digest
+ * Algorithm" in all material mentioning or referencing this software
+ * or this function.
+ *
+ * License is also granted to make and use derivative works provided
+ * that such works are identified as "derived from the RSA Data
+ * Security, Inc. MD4 Message-Digest Algorithm" in all material
+ * mentioning or referencing the derived work.
+ *
+ * RSA Data Security, Inc. makes no representations concerning either
+ * the merchantability of this software or the suitability of this
+ * software for any particular purpose. It is provided "as is"
+ * without express or implied warranty of any kind.
+ *
+ * These notices must be retained in any copies of any part of this
+ * documentation and/or software.
+ */
+
+For the crypto\crypt_blowfish.c(.h) component:
+
+ * Written by Solar Designer <solar at openwall.com> in 1998-2011.
+ * No copyright is claimed, and the software is hereby placed in the public
+ * domain.  In case this attempt to disclaim copyright and place the software
+ * in the public domain is deemed null and void, then the software is
+ * Copyright (c) 1998-2011 Solar Designer and it is hereby released to the
+ * general public under the following terms:
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted.
+ *
+ * There's ABSOLUTELY NO WARRANTY, express or implied.
+
+ See crypto/crypt_blowfish.c for more information.
+
+For the include\apr_md4.h component:
+
+ *
+ * This is derived from material copyright RSA Data Security, Inc.
+ * Their notice is reproduced below in its entirety.
+ *
+ * Copyright (C) 1991-2, RSA Data Security, Inc. Created 1991. All
+ * rights reserved.
+ *
+ * License to copy and use this software is granted provided that it
+ * is identified as the "RSA Data Security, Inc. MD4 Message-Digest
+ * Algorithm" in all material mentioning or referencing this software
+ * or this function.
+ *
+ * License is also granted to make and use derivative works provided
+ * that such works are identified as "derived from the RSA Data
+ * Security, Inc. MD4 Message-Digest Algorithm" in all material
+ * mentioning or referencing the derived work.
+ *
+ * RSA Data Security, Inc. makes no representations concerning either
+ * the merchantability of this software or the suitability of this
+ * software for any particular purpose. It is provided "as is"
+ * without express or implied warranty of any kind.
+ *
+ * These notices must be retained in any copies of any part of this
+ * documentation and/or software.
+ */
+
+For the test\testmd4.c component:
+
+ *
+ * This is derived from material copyright RSA Data Security, Inc.
+ * Their notice is reproduced below in its entirety.
+ *
+ * Copyright (C) 1990-2, RSA Data Security, Inc. Created 1990. All
+ * rights reserved.
+ *
+ * RSA Data Security, Inc. makes no representations concerning either
+ * the merchantability of this software or the suitability of this
+ * software for any particular purpose. It is provided "as is"
+ * without express or implied warranty of any kind.
+ *
+ * These notices must be retained in any copies of any part of this
+ * documentation and/or software.
+ */
+
+For the xml\expat\conftools\install-sh component:
+
+#
+# install - install a program, script, or datafile
+# This comes from X11R5 (mit/util/scripts/install.sh).
+#
+# Copyright 1991 by the Massachusetts Institute of Technology
+#
+# Permission to use, copy, modify, distribute, and sell this software and its
+# documentation for any purpose is hereby granted without fee, provided that
+# the above copyright notice appear in all copies and that both that
+# copyright notice and this permission notice appear in supporting
+# documentation, and that the name of M.I.T. not be used in advertising or
+# publicity pertaining to distribution of the software without specific,
+# written prior permission.  M.I.T. makes no representations about the
+# suitability of this software for any purpose.  It is provided "as is"
+# without express or implied warranty.
+#
+
+For the expat xml parser component:
+
+Copyright (c) 1998, 1999, 2000 Thai Open Source Software Center Ltd
+                               and Clark Cooper
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+"Software"), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+	
+The above copyright notice and this permission notice shall be included
+in all copies or substantial portions of the Software.
+	
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+====================================================================
+
+For the ldap/apr_ldap_url.c component:
+
+/* Portions Copyright 1998-2002 The OpenLDAP Foundation
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted only as authorized by the OpenLDAP
+ * Public License.  A copy of this license is available at
+ * http://www.OpenLDAP.org/license.html or in file LICENSE in the
+ * top-level directory of the distribution.
+ *
+ * OpenLDAP is a registered trademark of the OpenLDAP Foundation.
+ *
+ * Individual files and/or contributed packages may be copyright by
+ * other parties and subject to additional restrictions.
+ *
+ * This work is derived from the University of Michigan LDAP v3.3
+ * distribution.  Information concerning this software is available
+ * at: http://www.umich.edu/~dirsvcs/ldap/
+ *
+ * This work also contains materials derived from public sources.
+ *
+ * Additional information about OpenLDAP can be obtained at:
+ *     http://www.openldap.org/
+ */
+
+/*
+ * Portions Copyright (c) 1992-1996 Regents of the University of Michigan.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms are permitted
+ * provided that this notice is preserved and that due credit is given
+ * to the University of Michigan at Ann Arbor. The name of the University
+ * may not be used to endorse or promote products derived from this
+ * software without specific prior written permission. This software
+ * is provided ``as is'' without express or implied warranty.
+ */
+
+
+=======================
+
+apr-util-1.6.1/NOTICE:
+Apache Portable Runtime Utility Library
+Copyright (c) 2000-2016 The Apache Software Foundation.
+
+This product includes software developed at
+The Apache Software Foundation (http://www.apache.org/).
+
+Portions of this software were developed at the National Center
+for Supercomputing Applications (NCSA) at the University of
+Illinois at Urbana-Champaign.
+
+This software contains code derived from the RSA Data Security
+Inc. MD5 Message-Digest Algorithm, including various
+modifications by Spyglass Inc., Carnegie Mellon University, and
+Bell Communications Research, Inc (Bellcore).
+
+=======================
+
+httpd-2.4.38/LICENSE:
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+
+
+
+APACHE HTTP SERVER SUBCOMPONENTS: 
+
+The Apache HTTP Server includes a number of subcomponents with
+separate copyright notices and license terms. Your use of the source
+code for the these subcomponents is subject to the terms and
+conditions of the following licenses. 
+
+For the mod_mime_magic component:
+
+/*
+ * mod_mime_magic: MIME type lookup via file magic numbers
+ * Copyright (c) 1996-1997 Cisco Systems, Inc.
+ *
+ * This software was submitted by Cisco Systems to the Apache Group in July
+ * 1997.  Future revisions and derivatives of this source code must
+ * acknowledge Cisco Systems as the original contributor of this module.
+ * All other licensing and usage conditions are those of the Apache Group.
+ *
+ * Some of this code is derived from the free version of the file command
+ * originally posted to comp.sources.unix.  Copyright info for that program
+ * is included below as required.
+ * ---------------------------------------------------------------------------
+ * - Copyright (c) Ian F. Darwin, 1987. Written by Ian F. Darwin.
+ *
+ * This software is not subject to any license of the American Telephone and
+ * Telegraph Company or of the Regents of the University of California.
+ *
+ * Permission is granted to anyone to use this software for any purpose on any
+ * computer system, and to alter it and redistribute it freely, subject to
+ * the following restrictions:
+ *
+ * 1. The author is not responsible for the consequences of use of this
+ * software, no matter how awful, even if they arise from flaws in it.
+ *
+ * 2. The origin of this software must not be misrepresented, either by
+ * explicit claim or by omission.  Since few users ever read sources, credits
+ * must appear in the documentation.
+ *
+ * 3. Altered versions must be plainly marked as such, and must not be
+ * misrepresented as being the original software.  Since few users ever read
+ * sources, credits must appear in the documentation.
+ *
+ * 4. This notice may not be removed or altered.
+ * -------------------------------------------------------------------------
+ *
+ */
+
+
+For the  modules\mappers\mod_imagemap.c component:
+
+  "macmartinized" polygon code copyright 1992 by Eric Haines, erich@eye.com
+
+For the  server\util_md5.c component:
+
+/************************************************************************
+ * NCSA HTTPd Server
+ * Software Development Group
+ * National Center for Supercomputing Applications
+ * University of Illinois at Urbana-Champaign
+ * 605 E. Springfield, Champaign, IL 61820
+ * httpd@ncsa.uiuc.edu
+ *
+ * Copyright  (C)  1995, Board of Trustees of the University of Illinois
+ *
+ ************************************************************************
+ *
+ * md5.c: NCSA HTTPd code which uses the md5c.c RSA Code
+ *
+ *  Original Code Copyright (C) 1994, Jeff Hostetler, Spyglass, Inc.
+ *  Portions of Content-MD5 code Copyright (C) 1993, 1994 by Carnegie Mellon
+ *     University (see Copyright below).
+ *  Portions of Content-MD5 code Copyright (C) 1991 Bell Communications 
+ *     Research, Inc. (Bellcore) (see Copyright below).
+ *  Portions extracted from mpack, John G. Myers - jgm+@cmu.edu
+ *  Content-MD5 Code contributed by Martin Hamilton (martin@net.lut.ac.uk)
+ *
+ */
+
+
+/* these portions extracted from mpack, John G. Myers - jgm+@cmu.edu */
+/* (C) Copyright 1993,1994 by Carnegie Mellon University
+ * All Rights Reserved.
+ *
+ * Permission to use, copy, modify, distribute, and sell this software
+ * and its documentation for any purpose is hereby granted without
+ * fee, provided that the above copyright notice appear in all copies
+ * and that both that copyright notice and this permission notice
+ * appear in supporting documentation, and that the name of Carnegie
+ * Mellon University not be used in advertising or publicity
+ * pertaining to distribution of the software without specific,
+ * written prior permission.  Carnegie Mellon University makes no
+ * representations about the suitability of this software for any
+ * purpose.  It is provided "as is" without express or implied
+ * warranty.
+ *
+ * CARNEGIE MELLON UNIVERSITY DISCLAIMS ALL WARRANTIES WITH REGARD TO
+ * THIS SOFTWARE, INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS, IN NO EVENT SHALL CARNEGIE MELLON UNIVERSITY BE LIABLE
+ * FOR ANY SPECIAL, INDIRECT OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN
+ * AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING
+ * OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS
+ * SOFTWARE.
+ */
+
+/*
+ * Copyright (c) 1991 Bell Communications Research, Inc. (Bellcore)
+ *
+ * Permission to use, copy, modify, and distribute this material
+ * for any purpose and without fee is hereby granted, provided
+ * that the above copyright notice and this permission notice
+ * appear in all copies, and that the name of Bellcore not be
+ * used in advertising or publicity pertaining to this
+ * material without the specific, prior written permission
+ * of an authorized representative of Bellcore.  BELLCORE
+ * MAKES NO REPRESENTATIONS ABOUT THE ACCURACY OR SUITABILITY
+ * OF THIS MATERIAL FOR ANY PURPOSE.  IT IS PROVIDED "AS IS",
+ * WITHOUT ANY EXPRESS OR IMPLIED WARRANTIES.  
+ */
+
+
+For the util_pcre.c and ap_regex.h components:
+
+           Copyright (c) 1997-2004 University of Cambridge
+
+-----------------------------------------------------------------------------
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are met:
+
+    * Redistributions of source code must retain the above copyright notice,
+      this list of conditions and the following disclaimer.
+
+    * Redistributions in binary form must reproduce the above copyright
+      notice, this list of conditions and the following disclaimer in the
+      documentation and/or other materials provided with the distribution.
+
+    * Neither the name of the University of Cambridge nor the names of its
+      contributors may be used to endorse or promote products derived from
+      this software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
+LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+POSSIBILITY OF SUCH DAMAGE.
+-----------------------------------------------------------------------------
+
+
+For the  srclib\apr\include\apr_md5.h component: 
+/*
+ * This is work is derived from material Copyright RSA Data Security, Inc.
+ *
+ * The RSA copyright statement and Licence for that original material is
+ * included below. This is followed by the Apache copyright statement and
+ * licence for the modifications made to that material.
+ */
+
+/* Copyright (C) 1991-2, RSA Data Security, Inc. Created 1991. All
+   rights reserved.
+
+   License to copy and use this software is granted provided that it
+   is identified as the "RSA Data Security, Inc. MD5 Message-Digest
+   Algorithm" in all material mentioning or referencing this software
+   or this function.
+
+   License is also granted to make and use derivative works provided
+   that such works are identified as "derived from the RSA Data
+   Security, Inc. MD5 Message-Digest Algorithm" in all material
+   mentioning or referencing the derived work.
+
+   RSA Data Security, Inc. makes no representations concerning either
+   the merchantability of this software or the suitability of this
+   software for any particular purpose. It is provided "as is"
+   without express or implied warranty of any kind.
+
+   These notices must be retained in any copies of any part of this
+   documentation and/or software.
+ */
+
+For the  srclib\apr\passwd\apr_md5.c component:
+
+/*
+ * This is work is derived from material Copyright RSA Data Security, Inc.
+ *
+ * The RSA copyright statement and Licence for that original material is
+ * included below. This is followed by the Apache copyright statement and
+ * licence for the modifications made to that material.
+ */
+
+/* MD5C.C - RSA Data Security, Inc., MD5 message-digest algorithm
+ */
+
+/* Copyright (C) 1991-2, RSA Data Security, Inc. Created 1991. All
+   rights reserved.
+
+   License to copy and use this software is granted provided that it
+   is identified as the "RSA Data Security, Inc. MD5 Message-Digest
+   Algorithm" in all material mentioning or referencing this software
+   or this function.
+
+   License is also granted to make and use derivative works provided
+   that such works are identified as "derived from the RSA Data
+   Security, Inc. MD5 Message-Digest Algorithm" in all material
+   mentioning or referencing the derived work.
+
+   RSA Data Security, Inc. makes no representations concerning either
+   the merchantability of this software or the suitability of this
+   software for any particular purpose. It is provided "as is"
+   without express or implied warranty of any kind.
+
+   These notices must be retained in any copies of any part of this
+   documentation and/or software.
+ */
+/*
+ * The apr_md5_encode() routine uses much code obtained from the FreeBSD 3.0
+ * MD5 crypt() function, which is licenced as follows:
+ * ----------------------------------------------------------------------------
+ * "THE BEER-WARE LICENSE" (Revision 42):
+ * <phk@login.dknet.dk> wrote this file.  As long as you retain this notice you
+ * can do whatever you want with this stuff. If we meet some day, and you think
+ * this stuff is worth it, you can buy me a beer in return.  Poul-Henning Kamp
+ * ----------------------------------------------------------------------------
+ */
+
+For the srclib\apr-util\crypto\apr_md4.c component:
+
+ * This is derived from material copyright RSA Data Security, Inc.
+ * Their notice is reproduced below in its entirety.
+ *
+ * Copyright (C) 1991-2, RSA Data Security, Inc. Created 1991. All
+ * rights reserved.
+ *
+ * License to copy and use this software is granted provided that it
+ * is identified as the "RSA Data Security, Inc. MD4 Message-Digest
+ * Algorithm" in all material mentioning or referencing this software
+ * or this function.
+ *
+ * License is also granted to make and use derivative works provided
+ * that such works are identified as "derived from the RSA Data
+ * Security, Inc. MD4 Message-Digest Algorithm" in all material
+ * mentioning or referencing the derived work.
+ *
+ * RSA Data Security, Inc. makes no representations concerning either
+ * the merchantability of this software or the suitability of this
+ * software for any particular purpose. It is provided "as is"
+ * without express or implied warranty of any kind.
+ *
+ * These notices must be retained in any copies of any part of this
+ * documentation and/or software.
+ */
+
+For the srclib\apr-util\include\apr_md4.h component:
+
+ *
+ * This is derived from material copyright RSA Data Security, Inc.
+ * Their notice is reproduced below in its entirety.
+ *
+ * Copyright (C) 1991-2, RSA Data Security, Inc. Created 1991. All
+ * rights reserved.
+ *
+ * License to copy and use this software is granted provided that it
+ * is identified as the "RSA Data Security, Inc. MD4 Message-Digest
+ * Algorithm" in all material mentioning or referencing this software
+ * or this function.
+ *
+ * License is also granted to make and use derivative works provided
+ * that such works are identified as "derived from the RSA Data
+ * Security, Inc. MD4 Message-Digest Algorithm" in all material
+ * mentioning or referencing the derived work.
+ *
+ * RSA Data Security, Inc. makes no representations concerning either
+ * the merchantability of this software or the suitability of this
+ * software for any particular purpose. It is provided "as is"
+ * without express or implied warranty of any kind.
+ *
+ * These notices must be retained in any copies of any part of this
+ * documentation and/or software.
+ */
+
+
+For the srclib\apr-util\test\testmd4.c component:
+
+ *
+ * This is derived from material copyright RSA Data Security, Inc.
+ * Their notice is reproduced below in its entirety.
+ *
+ * Copyright (C) 1990-2, RSA Data Security, Inc. Created 1990. All
+ * rights reserved.
+ *
+ * RSA Data Security, Inc. makes no representations concerning either
+ * the merchantability of this software or the suitability of this
+ * software for any particular purpose. It is provided "as is"
+ * without express or implied warranty of any kind.
+ *
+ * These notices must be retained in any copies of any part of this
+ * documentation and/or software.
+ */
+
+For the test\zb.c component:
+
+/*                          ZeusBench V1.01
+			    ===============
+
+This program is Copyright (C) Zeus Technology Limited 1996.
+
+This program may be used and copied freely providing this copyright notice
+is not removed.
+
+This software is provided "as is" and any express or implied waranties, 
+including but not limited to, the implied warranties of merchantability and
+fitness for a particular purpose are disclaimed.  In no event shall 
+Zeus Technology Ltd. be liable for any direct, indirect, incidental, special, 
+exemplary, or consequential damaged (including, but not limited to, 
+procurement of substitute good or services; loss of use, data, or profits;
+or business interruption) however caused and on theory of liability.  Whether
+in contract, strict liability or tort (including negligence or otherwise) 
+arising in any way out of the use of this software, even if advised of the
+possibility of such damage.
+
+     Written by Adam Twiss (adam@zeus.co.uk).  March 1996
+
+Thanks to the following people for their input:
+  Mike Belshe (mbelshe@netscape.com) 
+  Michael Campanella (campanella@stevms.enet.dec.com)
+
+*/
+
+
+=======================
+
+httpd-2.4.38/NOTICE:
+Apache HTTP Server
+Copyright 2019 The Apache Software Foundation.
+
+This product includes software developed at
+The Apache Software Foundation (http://www.apache.org/).
+
+Portions of this software were developed at the National Center
+for Supercomputing Applications (NCSA) at the University of
+Illinois at Urbana-Champaign.
+
+This software contains code derived from the RSA Data Security
+Inc. MD5 Message-Digest Algorithm, including various
+modifications by Spyglass Inc., Carnegie Mellon University, and
+Bell Communications Research, Inc (Bellcore).
+
+This software contains code derived from the PCRE library pcreposix.c
+source code, written by Philip Hazel, Copyright 1997-2004
+by the University of Cambridge, England.
+
+=======================
+
+openssl-1.1.1b/LICENSE:
+
+  LICENSE ISSUES
+  ==============
+
+  The OpenSSL toolkit stays under a double license, i.e. both the conditions of
+  the OpenSSL License and the original SSLeay license apply to the toolkit.
+  See below for the actual license texts.
+
+  OpenSSL License
+  ---------------
+
+/* ====================================================================
+ * Copyright (c) 1998-2019 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    openssl-core@openssl.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+ Original SSLeay License
+ -----------------------
+
+/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
+ * All rights reserved.
+ *
+ * This package is an SSL implementation written
+ * by Eric Young (eay@cryptsoft.com).
+ * The implementation was written so as to conform with Netscapes SSL.
+ *
+ * This library is free for commercial and non-commercial use as long as
+ * the following conditions are aheared to.  The following conditions
+ * apply to all code found in this distribution, be it the RC4, RSA,
+ * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
+ * included with this distribution is covered by the same copyright terms
+ * except that the holder is Tim Hudson (tjh@cryptsoft.com).
+ *
+ * Copyright remains Eric Young's, and as such any Copyright notices in
+ * the code are not to be removed.
+ * If this package is used in a product, Eric Young should be given attribution
+ * as the author of the parts of the library used.
+ * This can be in the form of a textual message at program startup or
+ * in documentation (online or textual) provided with the package.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *    "This product includes cryptographic software written by
+ *     Eric Young (eay@cryptsoft.com)"
+ *    The word 'cryptographic' can be left out if the rouines from the library
+ *    being used are not cryptographic related :-).
+ * 4. If you include any Windows specific code (or a derivative thereof) from
+ *    the apps directory (application code) you must include an acknowledgement:
+ *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * The licence and distribution terms for any publically available version or
+ * derivative of this code cannot be changed.  i.e. this code cannot simply be
+ * copied and put under another distribution licence
+ * [including the GNU Public Licence.]
+ */
+
+
+=======================
+
+pcre-8.42/LICENCE:
+PCRE LICENCE
+------------
+
+PCRE is a library of functions to support regular expressions whose syntax
+and semantics are as close as possible to those of the Perl 5 language.
+
+Release 8 of PCRE is distributed under the terms of the "BSD" licence, as
+specified below. The documentation for PCRE, supplied in the "doc"
+directory, is distributed under the same terms as the software itself. The data
+in the testdata directory is not copyrighted and is in the public domain.
+
+The basic library functions are written in C and are freestanding. Also
+included in the distribution is a set of C++ wrapper functions, and a
+just-in-time compiler that can be used to optimize pattern matching. These
+are both optional features that can be omitted when the library is built.
+
+
+THE BASIC LIBRARY FUNCTIONS
+---------------------------
+
+Written by:       Philip Hazel
+Email local part: ph10
+Email domain:     cam.ac.uk
+
+University of Cambridge Computing Service,
+Cambridge, England.
+
+Copyright (c) 1997-2018 University of Cambridge
+All rights reserved.
+
+
+PCRE JUST-IN-TIME COMPILATION SUPPORT
+-------------------------------------
+
+Written by:       Zoltan Herczeg
+Email local part: hzmester
+Emain domain:     freemail.hu
+
+Copyright(c) 2010-2018 Zoltan Herczeg
+All rights reserved.
+
+
+STACK-LESS JUST-IN-TIME COMPILER
+--------------------------------
+
+Written by:       Zoltan Herczeg
+Email local part: hzmester
+Emain domain:     freemail.hu
+
+Copyright(c) 2009-2018 Zoltan Herczeg
+All rights reserved.
+
+
+THE C++ WRAPPER FUNCTIONS
+-------------------------
+
+Contributed by:   Google Inc.
+
+Copyright (c) 2007-2012, Google Inc.
+All rights reserved.
+
+
+THE "BSD" LICENCE
+-----------------
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are met:
+
+    * Redistributions of source code must retain the above copyright notice,
+      this list of conditions and the following disclaimer.
+
+    * Redistributions in binary form must reproduce the above copyright
+      notice, this list of conditions and the following disclaimer in the
+      documentation and/or other materials provided with the distribution.
+
+    * Neither the name of the University of Cambridge nor the name of Google
+      Inc. nor the names of their contributors may be used to endorse or
+      promote products derived from this software without specific prior
+      written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
+LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+POSSIBILITY OF SUCH DAMAGE.
+
+End
+
+=======================
+
+php-7.3.3/LICENSE:
+--------------------------------------------------------------------
+                  The PHP License, version 3.01
+Copyright (c) 1999 - 2018 The PHP Group. All rights reserved.
+--------------------------------------------------------------------
+
+Redistribution and use in source and binary forms, with or without
+modification, is permitted provided that the following conditions
+are met:
+
+  1. Redistributions of source code must retain the above copyright
+     notice, this list of conditions and the following disclaimer.
+
+  2. Redistributions in binary form must reproduce the above copyright
+     notice, this list of conditions and the following disclaimer in
+     the documentation and/or other materials provided with the
+     distribution.
+
+  3. The name "PHP" must not be used to endorse or promote products
+     derived from this software without prior written permission. For
+     written permission, please contact group@php.net.
+
+  4. Products derived from this software may not be called "PHP", nor
+     may "PHP" appear in their name, without prior written permission
+     from group@php.net.  You may indicate that your software works in
+     conjunction with PHP by saying "Foo for PHP" instead of calling
+     it "PHP Foo" or "phpfoo"
+
+  5. The PHP Group may publish revised and/or new versions of the
+     license from time to time. Each version will be given a
+     distinguishing version number.
+     Once covered code has been published under a particular version
+     of the license, you may always continue to use it under the terms
+     of that version. You may also choose to use such covered code
+     under the terms of any subsequent version of the license
+     published by the PHP Group. No one other than the PHP Group has
+     the right to modify the terms applicable to covered code created
+     under this License.
+
+  6. Redistributions of any form whatsoever must retain the following
+     acknowledgment:
+     "This product includes PHP software, freely available from
+     <http://www.php.net/software/>".
+
+THIS SOFTWARE IS PROVIDED BY THE PHP DEVELOPMENT TEAM ``AS IS'' AND
+ANY EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
+PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE PHP
+DEVELOPMENT TEAM OR ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
+INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+OF THE POSSIBILITY OF SUCH DAMAGE.
+
+--------------------------------------------------------------------
+
+This software consists of voluntary contributions made by many
+individuals on behalf of the PHP Group.
+
+The PHP Group can be contacted via Email at group@php.net.
+
+For more information on the PHP Group and the PHP project,
+please see <http://www.php.net>.
+
+PHP includes the Zend Engine, freely available at
+<http://www.zend.com>.
+
+=======================
+
+From zlib-1.2.11/README:
+Copyright notice:
+
+ (C) 1995-2017 Jean-loup Gailly and Mark Adler
+
+  This software is provided 'as-is', without any express or implied
+  warranty.  In no event will the authors be held liable for any damages
+  arising from the use of this software.
+
+  Permission is granted to anyone to use this software for any purpose,
+  including commercial applications, and to alter it and redistribute it
+  freely, subject to the following restrictions:
+
+  1. The origin of this software must not be misrepresented; you must not
+     claim that you wrote the original software. If you use this software
+     in a product, an acknowledgment in the product documentation would be
+     appreciated but is not required.
+  2. Altered source versions must be plainly marked as such, and must not be
+     misrepresented as being the original software.
+  3. This notice may not be removed or altered from any source distribution.
+
+  Jean-loup Gailly        Mark Adler
+  jloup@gzip.org          madler@alumni.caltech.edu
+
+If you use the zlib library in a product, we would appreciate *not* receiving
+lengthy legal documents to sign.  The sources are provided for free but without
+warranty of any kind.  The library has been entirely written by Jean-loup
+Gailly and Mark Adler; it does not include third-party code.
+
+If you redistribute modified sources, we would appreciate that you include in
+the file ChangeLog history information documenting your changes.  Please read
+the FAQ for more information on the distribution of modified source versions.
diff --git a/third_party/apache-mac/OWNERS b/third_party/apache-mac/OWNERS
new file mode 100644
index 0000000..c498ce6
--- /dev/null
+++ b/third_party/apache-mac/OWNERS
@@ -0,0 +1,3 @@
+davidben@chromium.org
+dpranke@chromium.org
+robertma@chromium.org
diff --git a/third_party/apache-mac/README.chromium b/third_party/apache-mac/README.chromium
new file mode 100644
index 0000000..a05ea06
--- /dev/null
+++ b/third_party/apache-mac/README.chromium
@@ -0,0 +1,38 @@
+Name: Apache2 (+ PHP and dependencies)
+Short Name: httpd
+URL: http://www.apache.org
+Version: 2.4.38
+Security Critical: no
+License: Apache Version 2.0
+License File: NOT_SHIPPED
+
+Description:
+
+This is a checked-in copy of Apache2 with OpenSSL, PHP, and dependencies for
+Mac. It is used by the Blink layout tests. Binaries are built from:
+
+apr 1.6.5
+apr-util 1.6.1
+httpd 2.4.38
+openssl 1.1.1b
+pcre 8.42
+php 7.3.3
+zlib 1.2.11
+
+To update, use the build-apache-mac.sh script.
+
+   mkdir tmp
+   cd tmp
+   /path/to/build-apache-mac.sh
+
+The files will be placed in the out directory. Copy these over and upload the
+executables and DLLs to Google Storage, to the chromium-apache-mac bucket.
+See http://g.co/bugatrooper in order to get permission to upload. Upload all
+binaries with:
+
+  find bin lib libexec -type f -not -name '*.sha1' | upload_to_google_storage.py --bucket chromium-apache-mac -
+
+Optionally, prune the files that were uploaded and run gclient runhooks to
+verify that they are re-downloaded. Remember to clean up any temp files used in
+the above process before uploading a CL. The CL should contain sha1 files but
+not actual binaries.
diff --git a/third_party/apache-mac/bin/httpd.sha1 b/third_party/apache-mac/bin/httpd.sha1
new file mode 100644
index 0000000..b68bdf1d
--- /dev/null
+++ b/third_party/apache-mac/bin/httpd.sha1
@@ -0,0 +1 @@
+7d978b3cf5a1c1c23e26c1566e58fb796c9842eb
\ No newline at end of file
diff --git a/third_party/apache-mac/bin/openssl.sha1 b/third_party/apache-mac/bin/openssl.sha1
new file mode 100644
index 0000000..4a2672d
--- /dev/null
+++ b/third_party/apache-mac/bin/openssl.sha1
@@ -0,0 +1 @@
+97333a49db174d6a49b01895a899c7650cd4a297
\ No newline at end of file
diff --git a/third_party/apache-mac/build-apache-mac.sh b/third_party/apache-mac/build-apache-mac.sh
new file mode 100755
index 0000000..24f6407
--- /dev/null
+++ b/third_party/apache-mac/build-apache-mac.sh
@@ -0,0 +1,256 @@
+#!/bin/bash
+# Copyright 2019 The Chromium Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+set -e
+
+# Update from https://www.zlib.net/
+zlib_version="1.2.11"
+zlib_sha256="c3e5e9fdd5004dcb542feda5ee4f0ff0744628baf8ed2dd5d66f8ca1197cb1a1"
+# Update from https://apr.apache.org/
+apr_version="1.6.5"
+apr_sha256="70dcf9102066a2ff2ffc47e93c289c8e54c95d8dda23b503f9e61bb0cbd2d105"
+apr_util_version="1.6.1"
+apr_util_sha256="b65e40713da57d004123b6319828be7f1273fbc6490e145874ee1177e112c459"
+# Update from https://httpd.apache.org/download.cgi
+httpd_version="2.4.38"
+httpd_sha256="38d0b73aa313c28065bf58faf64cec12bf7c7d5196146107df2ad07541aa26a6"
+# Update from https://www.openssl.org/source/
+openssl_version="1.1.1b"
+openssl_sha256="5c557b023230413dfb0756f3137a13e6d726838ccd1430888ad15bfb2b43ea4b"
+# Update from https://www.pcre.org/
+pcre_version="8.42"
+pcre_sha256="69acbc2fbdefb955d42a4c606dfde800c2885711d2979e356c0636efde9ec3b5"
+# Update from https://secure.php.net/downloads.php
+php_version="7.3.3"
+php_sha256="9bde40cbf8608ae9c595a6643a02cf0c692c131e2b3619af3fd2af8425d8e677"
+
+build="$PWD/build"
+out="$PWD/out"
+src="$PWD/src"
+
+if [ -d "$build" ]; then
+  echo "$build already exists. Remove for a new build"
+  exit 1
+fi
+if [ -d "$out" ]; then
+  echo "$out already exists. Remove for a new build"
+  exit 1
+fi
+if [ -d "$src" ]; then
+  echo "$src already exists. Remove for a new build"
+  exit 1
+fi
+
+jobs=5
+
+echo "Downloading sources"
+curl_if_needed() {
+  if [ ! -f "$1" ]; then
+    curl -o "$1" "$2"
+  fi
+}
+curl_if_needed "apr-${apr_version}.tar.gz" "https://archive.apache.org/dist/apr/apr-${apr_version}.tar.gz"
+curl_if_needed "apr-util-${apr_util_version}.tar.gz" "https://archive.apache.org/dist/apr/apr-util-${apr_util_version}.tar.gz"
+curl_if_needed "httpd-${httpd_version}.tar.gz" "https://archive.apache.org/dist/httpd/httpd-${httpd_version}.tar.gz"
+curl_if_needed "openssl-${openssl_version}.tar.gz" "https://www.openssl.org/source/openssl-${openssl_version}.tar.gz"
+curl_if_needed "pcre-${pcre_version}.tar.gz" "https://ftp.pcre.org/pub/pcre/pcre-${pcre_version}.tar.gz"
+curl_if_needed "php-${php_version}.tar.gz" "https://secure.php.net/distributions/php-${php_version}.tar.gz"
+curl_if_needed "zlib-${zlib_version}.tar.gz" "https://www.zlib.net/zlib-${zlib_version}.tar.gz"
+
+# Check hashes.
+cat > SHA256SUMS <<EOT
+${apr_sha256}  apr-${apr_version}.tar.gz
+${apr_util_sha256}  apr-util-${apr_util_version}.tar.gz
+${httpd_sha256}  httpd-${httpd_version}.tar.gz
+${openssl_sha256}  openssl-${openssl_version}.tar.gz
+${pcre_sha256}  pcre-${pcre_version}.tar.gz
+${php_sha256}  php-${php_version}.tar.gz
+${zlib_sha256}  zlib-${zlib_version}.tar.gz
+EOT
+shasum -a 256 -c SHA256SUMS
+
+mkdir "${build}"
+mkdir "${src}"
+
+cd "${src}"
+
+export MACOSX_DEPLOYMENT_TARGET="10.10"
+
+echo "Building zlib"
+tar xf "../zlib-${zlib_version}.tar.gz"
+cd "zlib-${zlib_version}"
+./configure --prefix="${build}"
+make -j"${jobs}"
+make install
+cd ..
+
+echo "Building OpenSSL"
+tar xf "../openssl-${openssl_version}.tar.gz"
+cd "openssl-${openssl_version}"
+./config no-tests --prefix="${build}"
+make -j"${jobs}"
+make install_sw
+cd ..
+
+echo "Building PCRE"
+tar xf "../pcre-${pcre_version}.tar.gz"
+cd "pcre-${pcre_version}"
+./configure --prefix="${build}"
+make -j"${jobs}"
+make install
+cd ..
+
+echo "Building APR"
+tar xf "../apr-${apr_version}.tar.gz"
+cd "apr-${apr_version}"
+./configure --prefix="${build}"
+make -j"${jobs}"
+make install
+cd ..
+
+echo "Building APR-util"
+tar xf "../apr-util-${apr_util_version}.tar.gz"
+cd "apr-util-${apr_util_version}"
+./configure --prefix="${build}" --with-apr="${build}"
+make -j"${jobs}"
+make install
+cd ..
+
+echo "Building httpd"
+tar xf "../httpd-${httpd_version}.tar.gz"
+cd "httpd-${httpd_version}"
+# See third_party/blink/tools/apache_config/apache2-httpd-2.4-php7.conf for the
+# modules to enable. Build modules as shared libraries to match the LoadModule
+# lines (the ServerRoot option will let httpd discover them), but we statically
+# link dependencies to avoid runtime linker complications.
+./configure --prefix="${build}" \
+    --enable-access-compat=shared \
+    --enable-actions=shared \
+    --enable-alias=shared \
+    --enable-asis=shared \
+    --enable-authz-core=shared \
+    --enable-authz-host=shared \
+    --enable-autoindex=shared \
+    --enable-cgi=shared \
+    --enable-env=shared \
+    --enable-headers=shared \
+    --enable-imagemap=shared \
+    --enable-include=shared \
+    --enable-log-config=shared \
+    --enable-mime=shared \
+    --enable-modules=none \
+    --enable-negotiation=shared \
+    --enable-rewrite=shared \
+    --enable-ssl=shared \
+    --enable-unixd=shared \
+    --libexecdir="${build}/libexec/apache2" \
+    --with-apr-util="${build}" \
+    --with-apr="${build}" \
+    --with-mpm=prefork \
+    --with-pcre="${build}" \
+    --with-ssl="${build}"
+make -j"${jobs}"
+make install
+cd ..
+
+echo "Building PHP"
+tar xf "../php-${php_version}.tar.gz"
+cd "php-${php_version}"
+./configure --prefix="${build}" \
+    --disable-cgi \
+    --disable-cli \
+    --with-apxs2="${build}/bin/apxs" \
+    --with-zlib="${build}" \
+    --without-iconv
+make -j"${jobs}"
+make install
+cd ..
+
+bin_files="
+    bin/httpd
+    bin/openssl"
+lib_files="
+    lib/libapr-1.0.dylib
+    lib/libaprutil-1.0.dylib
+    lib/libcrypto.1.1.dylib
+    lib/libpcre.1.dylib
+    lib/libpcrecpp.0.dylib
+    lib/libpcreposix.0.dylib
+    lib/libssl.1.1.dylib
+    lib/libz.1.2.11.dylib"
+libexec_files="
+    libexec/apache2/libphp7.so
+    libexec/apache2/mod_access_compat.so
+    libexec/apache2/mod_actions.so
+    libexec/apache2/mod_alias.so
+    libexec/apache2/mod_asis.so
+    libexec/apache2/mod_authz_core.so
+    libexec/apache2/mod_authz_host.so
+    libexec/apache2/mod_autoindex.so
+    libexec/apache2/mod_cgi.so
+    libexec/apache2/mod_env.so
+    libexec/apache2/mod_headers.so
+    libexec/apache2/mod_imagemap.so
+    libexec/apache2/mod_include.so
+    libexec/apache2/mod_log_config.so
+    libexec/apache2/mod_mime.so
+    libexec/apache2/mod_negotiation.so
+    libexec/apache2/mod_rewrite.so
+    libexec/apache2/mod_ssl.so
+    libexec/apache2/mod_unixd.so"
+license_files="
+    apr-${apr_version}/LICENSE
+    apr-${apr_version}/NOTICE
+    apr-util-${apr_util_version}/LICENSE
+    apr-util-${apr_util_version}/NOTICE
+    httpd-${httpd_version}/LICENSE
+    httpd-${httpd_version}/NOTICE
+    openssl-${openssl_version}/LICENSE
+    pcre-${pcre_version}/LICENCE
+    php-${php_version}/LICENSE"
+
+echo "Copying files"
+mkdir "${out}"
+mkdir "${out}/bin"
+mkdir "${out}/lib"
+mkdir "${out}/libexec"
+mkdir "${out}/libexec/apache2"
+
+cat > "${out}/LICENSE" <<EOT
+This directory contains binaries for Apache httpd, PHP, and their dependencies.
+License and notices for each are listed below:
+EOT
+
+for f in ${license_files}; do
+  echo >> "${out}/LICENSE"
+  echo "=======================" >> "${out}/LICENSE"
+  echo >> "${out}/LICENSE"
+  echo "${f}:" >> "${out}/LICENSE"
+  cat "${src}/${f}" >> "${out}/LICENSE"
+done
+
+# zlib does not have a standalone LICENSE file. Extract it from the README
+# instead.
+echo >> "${out}/LICENSE"
+echo "=======================" >> "${out}/LICENSE"
+echo >> "${out}/LICENSE"
+echo "From zlib-${zlib_version}/README:" >> "${out}/LICENSE"
+sed -n -e '/^Copyright notice:/,//p' "${src}/zlib-${zlib_version}/README" >> "${out}/LICENSE"
+
+for f in ${bin_files} ${lib_files} ${libexec_files}; do
+  cp "${build}/${f}" "${out}/${f}"
+  for lib in ${lib_files}; do
+    install_name_tool -change "${build}/${lib}" "@rpath/$(basename "${lib}")" "${out}/${f}"
+  done
+done
+for f in ${bin_files}; do
+  install_name_tool -add_rpath "@executable_path/../lib" "${out}/${f}"
+done
+for f in ${lib_files}; do
+  install_name_tool -id "@rpath/$(basename "${f}")" "${out}/${f}"
+done
+for f in ${libexec_files}; do
+  install_name_tool -id "@rpath/../libexec/$(basename "${f}")" "${out}/${f}"
+done
diff --git a/third_party/apache-mac/lib/libapr-1.0.dylib.sha1 b/third_party/apache-mac/lib/libapr-1.0.dylib.sha1
new file mode 100644
index 0000000..a6dc19fd
--- /dev/null
+++ b/third_party/apache-mac/lib/libapr-1.0.dylib.sha1
@@ -0,0 +1 @@
+82485af4feb2f9f8f3f9ed2299eef177216967a5
\ No newline at end of file
diff --git a/third_party/apache-mac/lib/libaprutil-1.0.dylib.sha1 b/third_party/apache-mac/lib/libaprutil-1.0.dylib.sha1
new file mode 100644
index 0000000..6cdac35b
--- /dev/null
+++ b/third_party/apache-mac/lib/libaprutil-1.0.dylib.sha1
@@ -0,0 +1 @@
+a0a0d57e0522296cba8e5cd892aca6d9eecef930
\ No newline at end of file
diff --git a/third_party/apache-mac/lib/libcrypto.1.1.dylib.sha1 b/third_party/apache-mac/lib/libcrypto.1.1.dylib.sha1
new file mode 100644
index 0000000..be70176
--- /dev/null
+++ b/third_party/apache-mac/lib/libcrypto.1.1.dylib.sha1
@@ -0,0 +1 @@
+d14646244c07a7992308ff9b0834d23ba0be650d
\ No newline at end of file
diff --git a/third_party/apache-mac/lib/libpcre.1.dylib.sha1 b/third_party/apache-mac/lib/libpcre.1.dylib.sha1
new file mode 100644
index 0000000..b13faf9
--- /dev/null
+++ b/third_party/apache-mac/lib/libpcre.1.dylib.sha1
@@ -0,0 +1 @@
+0ae33eed29d0245ee9bd4cb9796dc5fa9b90b613
\ No newline at end of file
diff --git a/third_party/apache-mac/lib/libpcrecpp.0.dylib.sha1 b/third_party/apache-mac/lib/libpcrecpp.0.dylib.sha1
new file mode 100644
index 0000000..e887e29
--- /dev/null
+++ b/third_party/apache-mac/lib/libpcrecpp.0.dylib.sha1
@@ -0,0 +1 @@
+24d435d9f1c8dcbdaadcee4c428d38cb198ef16c
\ No newline at end of file
diff --git a/third_party/apache-mac/lib/libpcreposix.0.dylib.sha1 b/third_party/apache-mac/lib/libpcreposix.0.dylib.sha1
new file mode 100644
index 0000000..5117e78
--- /dev/null
+++ b/third_party/apache-mac/lib/libpcreposix.0.dylib.sha1
@@ -0,0 +1 @@
+e750e84acc3c812545775d26165936313a5b19fb
\ No newline at end of file
diff --git a/third_party/apache-mac/lib/libssl.1.1.dylib.sha1 b/third_party/apache-mac/lib/libssl.1.1.dylib.sha1
new file mode 100644
index 0000000..64814ae
--- /dev/null
+++ b/third_party/apache-mac/lib/libssl.1.1.dylib.sha1
@@ -0,0 +1 @@
+ceaaff3e2f711bff9fdebe42df07abf51a0dcbf1
\ No newline at end of file
diff --git a/third_party/apache-mac/lib/libz.1.2.11.dylib.sha1 b/third_party/apache-mac/lib/libz.1.2.11.dylib.sha1
new file mode 100644
index 0000000..7962cd1
--- /dev/null
+++ b/third_party/apache-mac/lib/libz.1.2.11.dylib.sha1
@@ -0,0 +1 @@
+ce07e5c399249609c3a245acc990ad2057d49ed4
\ No newline at end of file
diff --git a/third_party/apache-mac/libexec/apache2/libphp7.so.sha1 b/third_party/apache-mac/libexec/apache2/libphp7.so.sha1
new file mode 100644
index 0000000..04f278f
--- /dev/null
+++ b/third_party/apache-mac/libexec/apache2/libphp7.so.sha1
@@ -0,0 +1 @@
+1d0d045a799d92f56d0c4c7ab35f5e38ac804197
\ No newline at end of file
diff --git a/third_party/apache-mac/libexec/apache2/mod_access_compat.so.sha1 b/third_party/apache-mac/libexec/apache2/mod_access_compat.so.sha1
new file mode 100644
index 0000000..9784b51
--- /dev/null
+++ b/third_party/apache-mac/libexec/apache2/mod_access_compat.so.sha1
@@ -0,0 +1 @@
+521754107eb0685424396ae52a111053ec955a3b
\ No newline at end of file
diff --git a/third_party/apache-mac/libexec/apache2/mod_actions.so.sha1 b/third_party/apache-mac/libexec/apache2/mod_actions.so.sha1
new file mode 100644
index 0000000..94b6298
--- /dev/null
+++ b/third_party/apache-mac/libexec/apache2/mod_actions.so.sha1
@@ -0,0 +1 @@
+d7272800dd565ab3e582088a9db973f1e575a66f
\ No newline at end of file
diff --git a/third_party/apache-mac/libexec/apache2/mod_alias.so.sha1 b/third_party/apache-mac/libexec/apache2/mod_alias.so.sha1
new file mode 100644
index 0000000..fbedd0b7
--- /dev/null
+++ b/third_party/apache-mac/libexec/apache2/mod_alias.so.sha1
@@ -0,0 +1 @@
+9b0a034a678d2f45171063eea25ab1ee0beddb4d
\ No newline at end of file
diff --git a/third_party/apache-mac/libexec/apache2/mod_asis.so.sha1 b/third_party/apache-mac/libexec/apache2/mod_asis.so.sha1
new file mode 100644
index 0000000..88a33a9
--- /dev/null
+++ b/third_party/apache-mac/libexec/apache2/mod_asis.so.sha1
@@ -0,0 +1 @@
+a4ad67a59a7f0d20606466f2960096ace1b76bca
\ No newline at end of file
diff --git a/third_party/apache-mac/libexec/apache2/mod_authz_core.so.sha1 b/third_party/apache-mac/libexec/apache2/mod_authz_core.so.sha1
new file mode 100644
index 0000000..fcb0af6
--- /dev/null
+++ b/third_party/apache-mac/libexec/apache2/mod_authz_core.so.sha1
@@ -0,0 +1 @@
+ffa4b158d52635eefa0387fc2e94dc9300e642d5
\ No newline at end of file
diff --git a/third_party/apache-mac/libexec/apache2/mod_authz_host.so.sha1 b/third_party/apache-mac/libexec/apache2/mod_authz_host.so.sha1
new file mode 100644
index 0000000..c096dbbd
--- /dev/null
+++ b/third_party/apache-mac/libexec/apache2/mod_authz_host.so.sha1
@@ -0,0 +1 @@
+a8d9b5929acdd071f614ff189707e7ef4ec7f003
\ No newline at end of file
diff --git a/third_party/apache-mac/libexec/apache2/mod_autoindex.so.sha1 b/third_party/apache-mac/libexec/apache2/mod_autoindex.so.sha1
new file mode 100644
index 0000000..d7ec3cf
--- /dev/null
+++ b/third_party/apache-mac/libexec/apache2/mod_autoindex.so.sha1
@@ -0,0 +1 @@
+5ffae7f779e6acf95bde12b5f8a6619a0ce77378
\ No newline at end of file
diff --git a/third_party/apache-mac/libexec/apache2/mod_cgi.so.sha1 b/third_party/apache-mac/libexec/apache2/mod_cgi.so.sha1
new file mode 100644
index 0000000..68bbcff
--- /dev/null
+++ b/third_party/apache-mac/libexec/apache2/mod_cgi.so.sha1
@@ -0,0 +1 @@
+d217c0f046ab073d7ce68de442d94f18e9da82a7
\ No newline at end of file
diff --git a/third_party/apache-mac/libexec/apache2/mod_env.so.sha1 b/third_party/apache-mac/libexec/apache2/mod_env.so.sha1
new file mode 100644
index 0000000..fc935bd5
--- /dev/null
+++ b/third_party/apache-mac/libexec/apache2/mod_env.so.sha1
@@ -0,0 +1 @@
+b877ac91f077591dfb2719edd6841f095f59a07f
\ No newline at end of file
diff --git a/third_party/apache-mac/libexec/apache2/mod_headers.so.sha1 b/third_party/apache-mac/libexec/apache2/mod_headers.so.sha1
new file mode 100644
index 0000000..a9de15b
--- /dev/null
+++ b/third_party/apache-mac/libexec/apache2/mod_headers.so.sha1
@@ -0,0 +1 @@
+bb4d657f9e551726e5542e1520a05c294d9eeed7
\ No newline at end of file
diff --git a/third_party/apache-mac/libexec/apache2/mod_imagemap.so.sha1 b/third_party/apache-mac/libexec/apache2/mod_imagemap.so.sha1
new file mode 100644
index 0000000..b56d6da
--- /dev/null
+++ b/third_party/apache-mac/libexec/apache2/mod_imagemap.so.sha1
@@ -0,0 +1 @@
+4a47dce8e0b40626de33f68a1eb376d4730165f8
\ No newline at end of file
diff --git a/third_party/apache-mac/libexec/apache2/mod_include.so.sha1 b/third_party/apache-mac/libexec/apache2/mod_include.so.sha1
new file mode 100644
index 0000000..1fff7b6
--- /dev/null
+++ b/third_party/apache-mac/libexec/apache2/mod_include.so.sha1
@@ -0,0 +1 @@
+2c24c421e8e99644963c0ce4dbcda0f6d0f06615
\ No newline at end of file
diff --git a/third_party/apache-mac/libexec/apache2/mod_log_config.so.sha1 b/third_party/apache-mac/libexec/apache2/mod_log_config.so.sha1
new file mode 100644
index 0000000..58385b6
--- /dev/null
+++ b/third_party/apache-mac/libexec/apache2/mod_log_config.so.sha1
@@ -0,0 +1 @@
+b85143aa3578219cb3ed0f93073a2e19c29ba6c3
\ No newline at end of file
diff --git a/third_party/apache-mac/libexec/apache2/mod_mime.so.sha1 b/third_party/apache-mac/libexec/apache2/mod_mime.so.sha1
new file mode 100644
index 0000000..c178e49
--- /dev/null
+++ b/third_party/apache-mac/libexec/apache2/mod_mime.so.sha1
@@ -0,0 +1 @@
+8325494f9a2310abf35c1218e4be7a17e805634e
\ No newline at end of file
diff --git a/third_party/apache-mac/libexec/apache2/mod_negotiation.so.sha1 b/third_party/apache-mac/libexec/apache2/mod_negotiation.so.sha1
new file mode 100644
index 0000000..ee8cb47
--- /dev/null
+++ b/third_party/apache-mac/libexec/apache2/mod_negotiation.so.sha1
@@ -0,0 +1 @@
+9c20aac51ad40d9849badad125e1e266ca22576e
\ No newline at end of file
diff --git a/third_party/apache-mac/libexec/apache2/mod_rewrite.so.sha1 b/third_party/apache-mac/libexec/apache2/mod_rewrite.so.sha1
new file mode 100644
index 0000000..67b8941
--- /dev/null
+++ b/third_party/apache-mac/libexec/apache2/mod_rewrite.so.sha1
@@ -0,0 +1 @@
+df0f0915507419f98fc1fe44f3575d14707168e9
\ No newline at end of file
diff --git a/third_party/apache-mac/libexec/apache2/mod_ssl.so.sha1 b/third_party/apache-mac/libexec/apache2/mod_ssl.so.sha1
new file mode 100644
index 0000000..7b1f96f
--- /dev/null
+++ b/third_party/apache-mac/libexec/apache2/mod_ssl.so.sha1
@@ -0,0 +1 @@
+29b970bbc1d17c029986cadf9af564d403fcbb01
\ No newline at end of file
diff --git a/third_party/apache-mac/libexec/apache2/mod_unixd.so.sha1 b/third_party/apache-mac/libexec/apache2/mod_unixd.so.sha1
new file mode 100644
index 0000000..9589e40
--- /dev/null
+++ b/third_party/apache-mac/libexec/apache2/mod_unixd.so.sha1
@@ -0,0 +1 @@
+e503f4d92e5e5edb9a0cd91beed3f9f9c86de043
\ No newline at end of file
diff --git a/third_party/blink/public/mojom/devtools/console_message.mojom b/third_party/blink/public/mojom/devtools/console_message.mojom
index 93d018ee..ef936e3 100644
--- a/third_party/blink/public/mojom/devtools/console_message.mojom
+++ b/third_party/blink/public/mojom/devtools/console_message.mojom
@@ -10,3 +10,20 @@
   kWarning,
   kError
 };
+
+enum ConsoleMessageSource {
+  kXml,
+  kJavaScript,
+  kNetwork,
+  kConsoleApi,
+  kStorage,
+  kAppCache,
+  kRendering,
+  kSecurity,
+  kOther,
+  kDeprecation,
+  kWorker,
+  kViolation,
+  kIntervention,
+  kRecommendation
+};
diff --git a/third_party/blink/public/platform/web_runtime_features.h b/third_party/blink/public/platform/web_runtime_features.h
index 269bd4e9..a2c906a 100644
--- a/third_party/blink/public/platform/web_runtime_features.h
+++ b/third_party/blink/public/platform/web_runtime_features.h
@@ -85,8 +85,6 @@
   BLINK_PLATFORM_EXPORT static void EnableBlinkHeapIncrementalMarking(bool);
   BLINK_PLATFORM_EXPORT static void EnableBlinkHeapUnifiedGarbageCollection(
       bool);
-  BLINK_PLATFORM_EXPORT static void EnableBlinkHeapCollectLiveNonNodeWrappers(
-      bool);
   BLINK_PLATFORM_EXPORT static void EnableBloatedRendererDetection(bool);
   BLINK_PLATFORM_EXPORT static void EnableCacheInlineScriptCode(bool);
   BLINK_PLATFORM_EXPORT static void EnableIsolatedCodeCache(bool);
diff --git a/third_party/blink/public/platform/web_url_loader.h b/third_party/blink/public/platform/web_url_loader.h
index e8ccf8e..8c85985 100644
--- a/third_party/blink/public/platform/web_url_loader.h
+++ b/third_party/blink/public/platform/web_url_loader.h
@@ -83,6 +83,9 @@
   // priority, but may increase when the resource is needed for rendering.
   virtual void DidChangePriority(WebURLRequest::Priority new_priority,
                                  int intra_priority_value) = 0;
+
+  // Returns the task runner for this request.
+  virtual scoped_refptr<base::SingleThreadTaskRunner> GetTaskRunner() = 0;
 };
 
 }  // namespace blink
diff --git a/third_party/blink/renderer/bindings/core/v8/custom/v8_custom_xpath_ns_resolver.cc b/third_party/blink/renderer/bindings/core/v8/custom/v8_custom_xpath_ns_resolver.cc
index 44f59c3..886cc4ec 100644
--- a/third_party/blink/renderer/bindings/core/v8/custom/v8_custom_xpath_ns_resolver.cc
+++ b/third_party/blink/renderer/bindings/core/v8/custom/v8_custom_xpath_ns_resolver.cc
@@ -62,7 +62,8 @@
     LocalFrame* frame = ToLocalFrameIfNotDetached(script_state_->GetContext());
     if (frame)
       frame->Console().AddMessage(ConsoleMessage::Create(
-          kJSMessageSource, mojom::ConsoleMessageLevel::kError,
+          mojom::ConsoleMessageSource::kJavaScript,
+          mojom::ConsoleMessageLevel::kError,
           "XPathNSResolver does not have a lookupNamespaceURI method."));
     return g_null_atom;
   }
diff --git a/third_party/blink/renderer/bindings/core/v8/script_streamer_test.cc b/third_party/blink/renderer/bindings/core/v8/script_streamer_test.cc
index 14a24af..ce55ccc 100644
--- a/third_party/blink/renderer/bindings/core/v8/script_streamer_test.cc
+++ b/third_party/blink/renderer/bindings/core/v8/script_streamer_test.cc
@@ -98,6 +98,9 @@
     void DidChangePriority(WebURLRequest::Priority, int) override {
       NOTREACHED();
     }
+    scoped_refptr<base::SingleThreadTaskRunner> GetTaskRunner() override {
+      return base::MakeRefCounted<scheduler::FakeTaskRunner>();
+    }
   };
 };
 
diff --git a/third_party/blink/renderer/bindings/core/v8/v8_initializer.cc b/third_party/blink/renderer/bindings/core/v8/v8_initializer.cc
index aac30943..b0bfbcf 100644
--- a/third_party/blink/renderer/bindings/core/v8/v8_initializer.cc
+++ b/third_party/blink/renderer/bindings/core/v8/v8_initializer.cc
@@ -244,7 +244,7 @@
 
   if (message->ErrorLevel() != v8::Isolate::kMessageError) {
     context->AddConsoleMessage(ConsoleMessage::Create(
-        kJSMessageSource,
+        mojom::ConsoleMessageSource::kJavaScript,
         MessageLevelFromNonFatalErrorLevel(message->ErrorLevel()),
         ToCoreStringWithNullCheck(message->Get()), std::move(location)));
     return;
@@ -289,7 +289,7 @@
 
   if (message->ErrorLevel() != v8::Isolate::kMessageError) {
     context->AddConsoleMessage(ConsoleMessage::Create(
-        kJSMessageSource,
+        mojom::ConsoleMessageSource::kJavaScript,
         MessageLevelFromNonFatalErrorLevel(message->ErrorLevel()),
         ToCoreStringWithNullCheck(message->Get()), std::move(location)));
     return;
diff --git a/third_party/blink/renderer/bindings/templates/attributes.cc.tmpl b/third_party/blink/renderer/bindings/templates/attributes.cc.tmpl
index bbfe849..43b38e9 100644
--- a/third_party/blink/renderer/bindings/templates/attributes.cc.tmpl
+++ b/third_party/blink/renderer/bindings/templates/attributes.cc.tmpl
@@ -427,7 +427,8 @@
     if (!IsValidEnum(cpp_value, kValidValues, base::size(kValidValues),
                      "{{attribute.enum_type}}", dummy_exception_state)) {
       ExecutionContext::ForCurrentRealm(info)->AddConsoleMessage(
-          ConsoleMessage::Create(kJSMessageSource, mojom::ConsoleMessageLevel::kWarning,
+          ConsoleMessage::Create(mojom::ConsoleMessageSource::kJavaScript,
+                                 mojom::ConsoleMessageLevel::kWarning,
                                  dummy_exception_state.Message()));
       return;
     }
diff --git a/third_party/blink/renderer/bindings/tests/results/core/v8_test_interface.cc b/third_party/blink/renderer/bindings/tests/results/core/v8_test_interface.cc
index 3c26fc76..cfb35ab4 100644
--- a/third_party/blink/renderer/bindings/tests/results/core/v8_test_interface.cc
+++ b/third_party/blink/renderer/bindings/tests/results/core/v8_test_interface.cc
@@ -276,7 +276,8 @@
     if (!IsValidEnum(cpp_value, kValidValues, base::size(kValidValues),
                      "TestEnum", dummy_exception_state)) {
       ExecutionContext::ForCurrentRealm(info)->AddConsoleMessage(
-          ConsoleMessage::Create(kJSMessageSource, mojom::ConsoleMessageLevel::kWarning,
+          ConsoleMessage::Create(mojom::ConsoleMessageSource::kJavaScript,
+                                 mojom::ConsoleMessageLevel::kWarning,
                                  dummy_exception_state.Message()));
       return;
     }
@@ -324,7 +325,8 @@
     if (!IsValidEnum(cpp_value, kValidValues, base::size(kValidValues),
                      "TestEnum", dummy_exception_state)) {
       ExecutionContext::ForCurrentRealm(info)->AddConsoleMessage(
-          ConsoleMessage::Create(kJSMessageSource, mojom::ConsoleMessageLevel::kWarning,
+          ConsoleMessage::Create(mojom::ConsoleMessageSource::kJavaScript,
+                                 mojom::ConsoleMessageLevel::kWarning,
                                  dummy_exception_state.Message()));
       return;
     }
@@ -1272,7 +1274,8 @@
     if (!IsValidEnum(cpp_value, kValidValues, base::size(kValidValues),
                      "PartialEnumType", dummy_exception_state)) {
       ExecutionContext::ForCurrentRealm(info)->AddConsoleMessage(
-          ConsoleMessage::Create(kJSMessageSource, mojom::ConsoleMessageLevel::kWarning,
+          ConsoleMessage::Create(mojom::ConsoleMessageSource::kJavaScript,
+                                 mojom::ConsoleMessageLevel::kWarning,
                                  dummy_exception_state.Message()));
       return;
     }
diff --git a/third_party/blink/renderer/bindings/tests/results/core/v8_test_object.cc b/third_party/blink/renderer/bindings/tests/results/core/v8_test_object.cc
index 9ade14b..65a8c04d 100644
--- a/third_party/blink/renderer/bindings/tests/results/core/v8_test_object.cc
+++ b/third_party/blink/renderer/bindings/tests/results/core/v8_test_object.cc
@@ -1557,7 +1557,8 @@
     if (!IsValidEnum(cpp_value, kValidValues, base::size(kValidValues),
                      "TestEnum", dummy_exception_state)) {
       ExecutionContext::ForCurrentRealm(info)->AddConsoleMessage(
-          ConsoleMessage::Create(kJSMessageSource, mojom::ConsoleMessageLevel::kWarning,
+          ConsoleMessage::Create(mojom::ConsoleMessageSource::kJavaScript,
+                                 mojom::ConsoleMessageLevel::kWarning,
                                  dummy_exception_state.Message()));
       return;
     }
@@ -1605,7 +1606,8 @@
     if (!IsValidEnum(cpp_value, kValidValues, base::size(kValidValues),
                      "TestEnum", dummy_exception_state)) {
       ExecutionContext::ForCurrentRealm(info)->AddConsoleMessage(
-          ConsoleMessage::Create(kJSMessageSource, mojom::ConsoleMessageLevel::kWarning,
+          ConsoleMessage::Create(mojom::ConsoleMessageSource::kJavaScript,
+                                 mojom::ConsoleMessageLevel::kWarning,
                                  dummy_exception_state.Message()));
       return;
     }
diff --git a/third_party/blink/renderer/core/BUILD.gn b/third_party/blink/renderer/core/BUILD.gn
index 7fe3498..87d4c9a 100644
--- a/third_party/blink/renderer/core/BUILD.gn
+++ b/third_party/blink/renderer/core/BUILD.gn
@@ -1988,6 +1988,7 @@
     "layout/api/selection_state_test.cc",
     "layout/collapsed_border_value_test.cc",
     "layout/custom/layout_worklet_test.cc",
+    "layout/force_legacy_layout_test.cc",
     "layout/grid_test.cc",
     "layout/jank_region_test.cc",
     "layout/jank_tracker_test.cc",
diff --git a/third_party/blink/renderer/core/animation/effect_input.cc b/third_party/blink/renderer/core/animation/effect_input.cc
index d2b9afb..e9b1cab 100644
--- a/third_party/blink/renderer/core/animation/effect_input.cc
+++ b/third_party/blink/renderer/core/animation/effect_input.cc
@@ -102,7 +102,8 @@
     if (!set_result.did_parse && execution_context) {
       if (document.GetFrame()) {
         document.GetFrame()->Console().AddMessage(ConsoleMessage::Create(
-            kJSMessageSource, mojom::ConsoleMessageLevel::kWarning,
+            mojom::ConsoleMessageSource::kJavaScript,
+            mojom::ConsoleMessageLevel::kWarning,
             "Invalid keyframe value for property " + property + ": " + value));
       }
     }
diff --git a/third_party/blink/renderer/core/css/basic_shape_functions.cc b/third_party/blink/renderer/core/css/basic_shape_functions.cc
index 9267679c..d66a10b 100644
--- a/third_party/blink/renderer/core/css/basic_shape_functions.cc
+++ b/third_party/blink/renderer/core/css/basic_shape_functions.cc
@@ -121,7 +121,7 @@
   switch (basic_shape->GetType()) {
     case BasicShape::kStyleRayType: {
       const StyleRay& ray = To<StyleRay>(*basic_shape);
-      return cssvalue::CSSRayValue::Create(
+      return MakeGarbageCollected<cssvalue::CSSRayValue>(
           *CSSPrimitiveValue::Create(ray.Angle(),
                                      CSSPrimitiveValue::UnitType::kDegrees),
           *CSSIdentifierValue::Create(RaySizeToKeyword(ray.Size())),
diff --git a/third_party/blink/renderer/core/css/css_paint_value_test.cc b/third_party/blink/renderer/core/css/css_paint_value_test.cc
index af9b6479..17c6856 100644
--- a/third_party/blink/renderer/core/css/css_paint_value_test.cc
+++ b/third_party/blink/renderer/core/css/css_paint_value_test.cc
@@ -57,7 +57,7 @@
   EXPECT_NE(target_layout_object->Style()->InsideLink(),
             EInsideLink::kNotInsideLink);
 
-  auto* css_paint_value = CSSPaintValue::Create(
+  auto* css_paint_value = MakeGarbageCollected<CSSPaintValue>(
       MakeGarbageCollected<CSSCustomIdentValue>("linkpainter"));
   EXPECT_EQ(css_paint_value->GetImage(*target_layout_object, *document,
                                       target_layout_object->StyleRef(),
diff --git a/third_party/blink/renderer/core/css/css_quad_value.h b/third_party/blink/renderer/core/css/css_quad_value.h
index fee20cf..0f5c9c7e 100644
--- a/third_party/blink/renderer/core/css/css_quad_value.h
+++ b/third_party/blink/renderer/core/css/css_quad_value.h
@@ -32,14 +32,6 @@
  public:
   enum TypeForSerialization { kSerializeAsRect, kSerializeAsQuad };
 
-  static CSSQuadValue* Create(CSSValue* top,
-                              CSSValue* right,
-                              CSSValue* bottom,
-                              CSSValue* left,
-                              TypeForSerialization serialization_type) {
-    return MakeGarbageCollected<CSSQuadValue>(top, right, bottom, left,
-                                              serialization_type);
-  }
   static CSSQuadValue* Create(CSSValue* value,
                               TypeForSerialization serialization_type) {
     return MakeGarbageCollected<CSSQuadValue>(value, value, value, value,
diff --git a/third_party/blink/renderer/core/css/css_ray_value.cc b/third_party/blink/renderer/core/css/css_ray_value.cc
index 01f870cc..d54da15 100644
--- a/third_party/blink/renderer/core/css/css_ray_value.cc
+++ b/third_party/blink/renderer/core/css/css_ray_value.cc
@@ -11,12 +11,6 @@
 namespace blink {
 namespace cssvalue {
 
-CSSRayValue* CSSRayValue::Create(const CSSPrimitiveValue& angle,
-                                 const CSSIdentifierValue& size,
-                                 const CSSIdentifierValue* contain) {
-  return MakeGarbageCollected<CSSRayValue>(angle, size, contain);
-}
-
 CSSRayValue::CSSRayValue(const CSSPrimitiveValue& angle,
                          const CSSIdentifierValue& size,
                          const CSSIdentifierValue* contain)
diff --git a/third_party/blink/renderer/core/css/css_ray_value.h b/third_party/blink/renderer/core/css/css_ray_value.h
index f1773208..dd642cd77 100644
--- a/third_party/blink/renderer/core/css/css_ray_value.h
+++ b/third_party/blink/renderer/core/css/css_ray_value.h
@@ -17,10 +17,6 @@
 
 class CSSRayValue : public CSSValue {
  public:
-  static CSSRayValue* Create(const CSSPrimitiveValue& angle,
-                             const CSSIdentifierValue& size,
-                             const CSSIdentifierValue* contain);
-
   CSSRayValue(const CSSPrimitiveValue& angle,
               const CSSIdentifierValue& size,
               const CSSIdentifierValue* contain);
diff --git a/third_party/blink/renderer/core/css/css_reflect_value.h b/third_party/blink/renderer/core/css/css_reflect_value.h
index 855c19a..50e206b 100644
--- a/third_party/blink/renderer/core/css/css_reflect_value.h
+++ b/third_party/blink/renderer/core/css/css_reflect_value.h
@@ -39,12 +39,6 @@
 
 class CSSReflectValue : public CSSValue {
  public:
-  static CSSReflectValue* Create(CSSIdentifierValue* direction,
-                                 CSSPrimitiveValue* offset,
-                                 CSSValue* mask) {
-    return MakeGarbageCollected<CSSReflectValue>(direction, offset, mask);
-  }
-
   CSSReflectValue(CSSIdentifierValue* direction,
                   CSSPrimitiveValue* offset,
                   CSSValue* mask)
diff --git a/third_party/blink/renderer/core/css/css_shadow_value.h b/third_party/blink/renderer/core/css/css_shadow_value.h
index 93ef94d6..34223f84 100644
--- a/third_party/blink/renderer/core/css/css_shadow_value.h
+++ b/third_party/blink/renderer/core/css/css_shadow_value.h
@@ -34,16 +34,6 @@
 // Used for text-shadow and box-shadow
 class CORE_EXPORT CSSShadowValue : public CSSValue {
  public:
-  static CSSShadowValue* Create(CSSPrimitiveValue* x,
-                                CSSPrimitiveValue* y,
-                                CSSPrimitiveValue* blur,
-                                CSSPrimitiveValue* spread,
-                                CSSIdentifierValue* style,
-                                CSSValue* color) {
-    return MakeGarbageCollected<CSSShadowValue>(x, y, blur, spread, style,
-                                                color);
-  }
-
   CSSShadowValue(CSSPrimitiveValue* x,
                  CSSPrimitiveValue* y,
                  CSSPrimitiveValue* blur,
diff --git a/third_party/blink/renderer/core/css/css_style_sheet.cc b/third_party/blink/renderer/core/css/css_style_sheet.cc
index 363913dd..47869d3 100644
--- a/third_party/blink/renderer/core/css/css_style_sheet.cc
+++ b/third_party/blink/renderer/core/css/css_style_sheet.cc
@@ -54,10 +54,6 @@
 
 class StyleSheetCSSRuleList final : public CSSRuleList {
  public:
-  static StyleSheetCSSRuleList* Create(CSSStyleSheet* sheet) {
-    return MakeGarbageCollected<StyleSheetCSSRuleList>(sheet);
-  }
-
   StyleSheetCSSRuleList(CSSStyleSheet* sheet) : style_sheet_(sheet) {}
 
   void Trace(blink::Visitor* visitor) override {
@@ -507,8 +503,10 @@
     exception_state.ThrowSecurityError("Cannot access rules");
     return nullptr;
   }
-  if (!rule_list_cssom_wrapper_)
-    rule_list_cssom_wrapper_ = StyleSheetCSSRuleList::Create(this);
+  if (!rule_list_cssom_wrapper_) {
+    rule_list_cssom_wrapper_ =
+        MakeGarbageCollected<StyleSheetCSSRuleList>(this);
+  }
   return rule_list_cssom_wrapper_.Get();
 }
 
diff --git a/third_party/blink/renderer/core/css/cssom/computed_style_property_map.cc b/third_party/blink/renderer/core/css/cssom/computed_style_property_map.cc
index afe2d6e4..f48127de 100644
--- a/third_party/blink/renderer/core/css/cssom/computed_style_property_map.cc
+++ b/third_party/blink/renderer/core/css/cssom/computed_style_property_map.cc
@@ -33,7 +33,7 @@
     case TransformOperation::kScale:
     case TransformOperation::kScale3D: {
       const auto& scale = ToScaleTransformOperation(operation);
-      auto* result = MakeGarbageCollected<CSSFunctionValue>(
+      CSSFunctionValue* result = MakeGarbageCollected<CSSFunctionValue>(
           operation.Is3DOperation() ? CSSValueID::kScale3d
                                     : CSSValueID::kScale);
       result->Append(*CSSPrimitiveValue::Create(
@@ -52,7 +52,7 @@
     case TransformOperation::kTranslate:
     case TransformOperation::kTranslate3D: {
       const auto& translate = ToTranslateTransformOperation(operation);
-      auto* result = MakeGarbageCollected<CSSFunctionValue>(
+      CSSFunctionValue* result = MakeGarbageCollected<CSSFunctionValue>(
           operation.Is3DOperation() ? CSSValueID::kTranslate3d
                                     : CSSValueID::kTranslate);
       result->Append(*CSSPrimitiveValue::Create(translate.X(), zoom));
@@ -67,7 +67,7 @@
     case TransformOperation::kRotateY:
     case TransformOperation::kRotate3D: {
       const auto& rotate = ToRotateTransformOperation(operation);
-      auto* result =
+      CSSFunctionValue* result =
           MakeGarbageCollected<CSSFunctionValue>(CSSValueID::kRotate3d);
       result->Append(*CSSPrimitiveValue::Create(
           rotate.X(), CSSPrimitiveValue::UnitType::kNumber));
@@ -132,7 +132,7 @@
     }
     case TransformOperation::kMatrix3D: {
       const auto& matrix = ToMatrix3DTransformOperation(operation).Matrix();
-      auto* result =
+      CSSFunctionValue* result =
           MakeGarbageCollected<CSSFunctionValue>(CSSValueID::kMatrix3d);
       double values[16] = {
           matrix.M11(), matrix.M12(), matrix.M13(), matrix.M14(),
diff --git a/third_party/blink/renderer/core/css/cssom/css_matrix_component.cc b/third_party/blink/renderer/core/css/cssom/css_matrix_component.cc
index cdefa510..1137dafa 100644
--- a/third_party/blink/renderer/core/css/cssom/css_matrix_component.cc
+++ b/third_party/blink/renderer/core/css/cssom/css_matrix_component.cc
@@ -51,7 +51,7 @@
 }
 
 const CSSFunctionValue* CSSMatrixComponent::ToCSSValue() const {
-  auto* result = MakeGarbageCollected<CSSFunctionValue>(
+  CSSFunctionValue* result = MakeGarbageCollected<CSSFunctionValue>(
       is2D() ? CSSValueID::kMatrix : CSSValueID::kMatrix3d);
 
   if (is2D()) {
diff --git a/third_party/blink/renderer/core/css/cssom/css_rotate.cc b/third_party/blink/renderer/core/css/cssom/css_rotate.cc
index 1dc793a..d7f6a5f8 100644
--- a/third_party/blink/renderer/core/css/cssom/css_rotate.cc
+++ b/third_party/blink/renderer/core/css/cssom/css_rotate.cc
@@ -167,7 +167,7 @@
   DCHECK(z_->to(CSSPrimitiveValue::UnitType::kNumber));
   DCHECK(angle_->to(CSSPrimitiveValue::UnitType::kRadians));
 
-  auto* result = MakeGarbageCollected<CSSFunctionValue>(
+  CSSFunctionValue* result = MakeGarbageCollected<CSSFunctionValue>(
       is2D() ? CSSValueID::kRotate : CSSValueID::kRotate3d);
   if (!is2D()) {
     const CSSValue* x = x_->ToCSSValue();
diff --git a/third_party/blink/renderer/core/css/cssom/css_scale.cc b/third_party/blink/renderer/core/css/cssom/css_scale.cc
index 00b1e44..08167edd 100644
--- a/third_party/blink/renderer/core/css/cssom/css_scale.cc
+++ b/third_party/blink/renderer/core/css/cssom/css_scale.cc
@@ -168,7 +168,7 @@
   if (!x || !y)
     return nullptr;
 
-  auto* result = MakeGarbageCollected<CSSFunctionValue>(
+  CSSFunctionValue* result = MakeGarbageCollected<CSSFunctionValue>(
       is2D() ? CSSValueID::kScale : CSSValueID::kScale3d);
   result->Append(*x);
   result->Append(*y);
diff --git a/third_party/blink/renderer/core/css/cssom/css_skew.cc b/third_party/blink/renderer/core/css/cssom/css_skew.cc
index e836e42..b6b0d6f 100644
--- a/third_party/blink/renderer/core/css/cssom/css_skew.cc
+++ b/third_party/blink/renderer/core/css/cssom/css_skew.cc
@@ -83,7 +83,8 @@
   if (!ax || !ay)
     return nullptr;
 
-  auto* result = MakeGarbageCollected<CSSFunctionValue>(CSSValueID::kSkew);
+  CSSFunctionValue* result =
+      MakeGarbageCollected<CSSFunctionValue>(CSSValueID::kSkew);
   result->Append(*ax);
   if (!ay_->IsUnitValue() || To<CSSUnitValue>(ay_.Get())->value() != 0)
     result->Append(*ay);
diff --git a/third_party/blink/renderer/core/css/cssom/css_skew_x.cc b/third_party/blink/renderer/core/css/cssom/css_skew_x.cc
index d324ee0..01c46d7 100644
--- a/third_party/blink/renderer/core/css/cssom/css_skew_x.cc
+++ b/third_party/blink/renderer/core/css/cssom/css_skew_x.cc
@@ -64,7 +64,8 @@
   if (!ax)
     return nullptr;
 
-  auto* result = MakeGarbageCollected<CSSFunctionValue>(CSSValueID::kSkewX);
+  CSSFunctionValue* result =
+      MakeGarbageCollected<CSSFunctionValue>(CSSValueID::kSkewX);
   result->Append(*ax);
   return result;
 }
diff --git a/third_party/blink/renderer/core/css/cssom/css_skew_y.cc b/third_party/blink/renderer/core/css/cssom/css_skew_y.cc
index fe44b630..cac14cb 100644
--- a/third_party/blink/renderer/core/css/cssom/css_skew_y.cc
+++ b/third_party/blink/renderer/core/css/cssom/css_skew_y.cc
@@ -64,7 +64,8 @@
   if (!ay)
     return nullptr;
 
-  auto* result = MakeGarbageCollected<CSSFunctionValue>(CSSValueID::kSkewY);
+  CSSFunctionValue* result =
+      MakeGarbageCollected<CSSFunctionValue>(CSSValueID::kSkewY);
   result->Append(*ay);
   return result;
 }
diff --git a/third_party/blink/renderer/core/css/cssom/css_translate.cc b/third_party/blink/renderer/core/css/cssom/css_translate.cc
index 01d2808..59ea969d 100644
--- a/third_party/blink/renderer/core/css/cssom/css_translate.cc
+++ b/third_party/blink/renderer/core/css/cssom/css_translate.cc
@@ -188,7 +188,7 @@
   const CSSValue* x = x_->ToCSSValue();
   const CSSValue* y = y_->ToCSSValue();
 
-  auto* result = MakeGarbageCollected<CSSFunctionValue>(
+  CSSFunctionValue* result = MakeGarbageCollected<CSSFunctionValue>(
       is2D() ? CSSValueID::kTranslate : CSSValueID::kTranslate3d);
   result->Append(*x);
   result->Append(*y);
diff --git a/third_party/blink/renderer/core/css/element_rule_collector.cc b/third_party/blink/renderer/core/css/element_rule_collector.cc
index 93cfa432..efe45f8 100644
--- a/third_party/blink/renderer/core/css/element_rule_collector.cc
+++ b/third_party/blink/renderer/core/css/element_rule_collector.cc
@@ -90,7 +90,7 @@
 
 inline StaticCSSRuleList* ElementRuleCollector::EnsureRuleList() {
   if (!css_rule_list_)
-    css_rule_list_ = StaticCSSRuleList::Create();
+    css_rule_list_ = MakeGarbageCollected<StaticCSSRuleList>();
   return css_rule_list_.Get();
 }
 
diff --git a/third_party/blink/renderer/core/css/font_face_cache.cc b/third_party/blink/renderer/core/css/font_face_cache.cc
index 0e434aba8..93d56d23 100644
--- a/third_party/blink/renderer/core/css/font_face_cache.cc
+++ b/third_party/blink/renderer/core/css/font_face_cache.cc
@@ -64,7 +64,8 @@
           font_face->GetFontSelectionCapabilities(), nullptr);
   if (segmented_font_face_result.is_new_entry) {
     segmented_font_face_result.stored_value->value =
-        CSSSegmentedFontFace::Create(font_face->GetFontSelectionCapabilities());
+        MakeGarbageCollected<CSSSegmentedFontFace>(
+            font_face->GetFontSelectionCapabilities());
   }
 
   segmented_font_face_result.stored_value->value->AddFontFace(font_face,
diff --git a/third_party/blink/renderer/core/css/parser/css_parser_fast_paths.cc b/third_party/blink/renderer/core/css/parser/css_parser_fast_paths.cc
index 739c184..cc1c832 100644
--- a/third_party/blink/renderer/core/css/parser/css_parser_fast_paths.cc
+++ b/third_party/blink/renderer/core/css/parser/css_parser_fast_paths.cc
@@ -1226,7 +1226,7 @@
       return nullptr;
     }
     pos += argument_start;
-    auto* transform_value =
+    CSSFunctionValue* transform_value =
         MakeGarbageCollected<CSSFunctionValue>(transform_type);
     if (!ParseTransformTranslateArguments(pos, end, expected_argument_count,
                                           transform_value))
@@ -1242,7 +1242,7 @@
 
   if (is_matrix3d) {
     pos += 9;
-    auto* transform_value =
+    CSSFunctionValue* transform_value =
         MakeGarbageCollected<CSSFunctionValue>(CSSValueID::kMatrix3d);
     if (!ParseTransformNumberArguments(pos, end, 16, transform_value))
       return nullptr;
@@ -1257,7 +1257,7 @@
 
   if (is_scale3d) {
     pos += 8;
-    auto* transform_value =
+    CSSFunctionValue* transform_value =
         MakeGarbageCollected<CSSFunctionValue>(CSSValueID::kScale3d);
     if (!ParseTransformNumberArguments(pos, end, 3, transform_value))
       return nullptr;
diff --git a/third_party/blink/renderer/core/css/parser/css_property_parser_helpers.cc b/third_party/blink/renderer/core/css/parser/css_property_parser_helpers.cc
index 61d72ae5..9226b6ba 100644
--- a/third_party/blink/renderer/core/css/parser/css_property_parser_helpers.cc
+++ b/third_party/blink/renderer/core/css/parser/css_property_parser_helpers.cc
@@ -89,7 +89,8 @@
     return nullptr;
   CSSParserTokenRange args =
       css_property_parser_helpers::ConsumeFunction(range);
-  auto* filter_value = MakeGarbageCollected<CSSFunctionValue>(filter_type);
+  CSSFunctionValue* filter_value =
+      MakeGarbageCollected<CSSFunctionValue>(filter_type);
   CSSValue* parsed_value = nullptr;
 
   if (filter_type == CSSValueID::kDropShadow) {
@@ -605,7 +606,7 @@
 CSSStringValue* ConsumeString(CSSParserTokenRange& range) {
   if (range.Peek().GetType() != kStringToken)
     return nullptr;
-  return CSSStringValue::Create(
+  return MakeGarbageCollected<CSSStringValue>(
       range.ConsumeIncludingWhitespace().Value().ToString());
 }
 
@@ -1568,7 +1569,7 @@
     return nullptr;
 
   if (args.AtEnd())
-    return CSSPaintValue::Create(name);
+    return MakeGarbageCollected<CSSPaintValue>(name);
 
   if (!RuntimeEnabledFeatures::CSSPaintAPIArgumentsEnabled()) {
     // Arguments not enabled, but exists. Invalid.
@@ -1598,7 +1599,7 @@
   if (!AddCSSPaintArgument(argument_tokens, &variable_data, context))
     return nullptr;
 
-  return CSSPaintValue::Create(name, variable_data);
+  return MakeGarbageCollected<CSSPaintValue>(name, variable_data);
 }
 
 static CSSValue* ConsumeGeneratedImage(CSSParserTokenRange& range,
diff --git a/third_party/blink/renderer/core/css/properties/computed_style_utils.cc b/third_party/blink/renderer/core/css/properties/computed_style_utils.cc
index e3608ee..d9494c9 100644
--- a/third_party/blink/renderer/core/css/properties/computed_style_utils.cc
+++ b/third_party/blink/renderer/core/css/properties/computed_style_utils.cc
@@ -355,8 +355,8 @@
   }
 
   return MakeGarbageCollected<CSSBorderImageSliceValue>(
-      CSSQuadValue::Create(top, right, bottom, left,
-                           CSSQuadValue::kSerializeAsQuad),
+      MakeGarbageCollected<CSSQuadValue>(top, right, bottom, left,
+                                         CSSQuadValue::kSerializeAsQuad),
       image.Fill());
 }
 
@@ -401,8 +401,8 @@
         left = ValueForBorderImageLength(box.Left(), style);
     }
   }
-  return CSSQuadValue::Create(top, right, bottom, left,
-                              CSSQuadValue::kSerializeAsQuad);
+  return MakeGarbageCollected<CSSQuadValue>(top, right, bottom, left,
+                                            CSSQuadValue::kSerializeAsQuad);
 }
 
 CSSValueID ValueForRepeatRule(int rule) {
@@ -495,7 +495,7 @@
       break;
   }
 
-  return CSSReflectValue::Create(
+  return MakeGarbageCollected<CSSReflectValue>(
       direction, offset, ValueForNinePieceImage(reflection->Mask(), style));
 }
 
@@ -1740,7 +1740,8 @@
       DCHECK(counter);
       auto* identifier =
           MakeGarbageCollected<CSSCustomIdentValue>(counter->Identifier());
-      CSSStringValue* separator = CSSStringValue::Create(counter->Separator());
+      auto* separator =
+          MakeGarbageCollected<CSSStringValue>(counter->Separator());
       CSSValueID list_style_ident = CSSValueID::kNone;
       if (counter->ListStyle() != EListStyleType::kNone) {
         // TODO(sashab): Change this to use a converter instead of
@@ -1757,7 +1758,7 @@
       DCHECK(image);
       list->Append(*image->ComputedCSSValue());
     } else if (content_data->IsText()) {
-      list->Append(*CSSStringValue::Create(
+      list->Append(*MakeGarbageCollected<CSSStringValue>(
           To<TextContentData>(content_data)->GetText()));
     } else if (content_data->IsQuote()) {
       const QuoteType quote_type = To<QuoteContentData>(content_data)->Quote();
@@ -1936,7 +1937,8 @@
           ? nullptr
           : CSSIdentifierValue::Create(CSSValueID::kInset);
   CSSValue* color = CurrentColorOrValidColor(style, shadow.GetColor());
-  return CSSShadowValue::Create(x, y, blur, spread, shadow_style, color);
+  return MakeGarbageCollected<CSSShadowValue>(x, y, blur, spread, shadow_style,
+                                              color);
 }
 
 CSSValue* ComputedStyleUtils::ValueForShadowList(const ShadowList* shadow_list,
@@ -1969,7 +1971,7 @@
     switch (filter_operation->GetType()) {
       case FilterOperation::REFERENCE:
         filter_value = MakeGarbageCollected<CSSFunctionValue>(CSSValueID::kUrl);
-        filter_value->Append(*CSSStringValue::Create(
+        filter_value->Append(*MakeGarbageCollected<CSSStringValue>(
             ToReferenceFilterOperation(filter_operation)->Url()));
         break;
       case FilterOperation::GRAYSCALE:
diff --git a/third_party/blink/renderer/core/css/properties/css_parsing_utils.cc b/third_party/blink/renderer/core/css/properties/css_parsing_utils.cc
index db79d9ef..e0e380a 100644
--- a/third_party/blink/renderer/core/css/properties/css_parsing_utils.cc
+++ b/third_party/blink/renderer/core/css/properties/css_parsing_utils.cc
@@ -1075,8 +1075,9 @@
   if (default_fill == DefaultFill::kFill)
     fill = true;
   return MakeGarbageCollected<CSSBorderImageSliceValue>(
-      CSSQuadValue::Create(slices[0], slices[1], slices[2], slices[3],
-                           CSSQuadValue::kSerializeAsQuad),
+      MakeGarbageCollected<CSSQuadValue>(slices[0], slices[1], slices[2],
+                                         slices[3],
+                                         CSSQuadValue::kSerializeAsQuad),
       fill);
 }
 
@@ -1103,8 +1104,9 @@
   if (!widths[0])
     return nullptr;
   css_property_parser_helpers::Complete4Sides(widths);
-  return CSSQuadValue::Create(widths[0], widths[1], widths[2], widths[3],
-                              CSSQuadValue::kSerializeAsQuad);
+  return MakeGarbageCollected<CSSQuadValue>(widths[0], widths[1], widths[2],
+                                            widths[3],
+                                            CSSQuadValue::kSerializeAsQuad);
 }
 
 CSSValue* ConsumeBorderImageOutset(CSSParserTokenRange& range) {
@@ -1125,8 +1127,9 @@
   if (!outsets[0])
     return nullptr;
   css_property_parser_helpers::Complete4Sides(outsets);
-  return CSSQuadValue::Create(outsets[0], outsets[1], outsets[2], outsets[3],
-                              CSSQuadValue::kSerializeAsQuad);
+  return MakeGarbageCollected<CSSQuadValue>(outsets[0], outsets[1], outsets[2],
+                                            outsets[3],
+                                            CSSQuadValue::kSerializeAsQuad);
 }
 
 CSSValue* ParseBorderRadiusCorner(CSSParserTokenRange& range,
@@ -1222,8 +1225,9 @@
       }
     }
   }
-  return CSSShadowValue::Create(horizontal_offset, vertical_offset, blur_radius,
-                                spread_distance, style, color);
+  return MakeGarbageCollected<CSSShadowValue>(horizontal_offset,
+                                              vertical_offset, blur_radius,
+                                              spread_distance, style, color);
 }
 
 CSSValue* ConsumeColumnCount(CSSParserTokenRange& range) {
@@ -2233,7 +2237,7 @@
   if (!angle || !size)
     return nullptr;
   range = function_range;
-  return CSSRayValue::Create(*angle, *size, contain);
+  return MakeGarbageCollected<CSSRayValue>(*angle, *size, contain);
 }
 
 CSSValue* ConsumeMaxWidthOrHeight(
diff --git a/third_party/blink/renderer/core/css/properties/longhands/clip_custom.cc b/third_party/blink/renderer/core/css/properties/longhands/clip_custom.cc
index badb1a1..1e452dd 100644
--- a/third_party/blink/renderer/core/css/properties/longhands/clip_custom.cc
+++ b/third_party/blink/renderer/core/css/properties/longhands/clip_custom.cc
@@ -55,8 +55,8 @@
   CSSValue* left = ConsumeClipComponent(args, context.Mode());
   if (!left || !args.AtEnd())
     return nullptr;
-  return CSSQuadValue::Create(top, right, bottom, left,
-                              CSSQuadValue::kSerializeAsRect);
+  return MakeGarbageCollected<CSSQuadValue>(top, right, bottom, left,
+                                            CSSQuadValue::kSerializeAsRect);
 }
 
 const CSSValue* Clip::CSSValueFromComputedStyleInternal(
@@ -75,8 +75,8 @@
       style.Clip().Bottom(), style);
   CSSValue* left = ComputedStyleUtils::ZoomAdjustedPixelValueOrAuto(
       style.Clip().Left(), style);
-  return CSSQuadValue::Create(top, right, bottom, left,
-                              CSSQuadValue::kSerializeAsRect);
+  return MakeGarbageCollected<CSSQuadValue>(top, right, bottom, left,
+                                            CSSQuadValue::kSerializeAsRect);
 }
 
 }  // namespace css_longhand
diff --git a/third_party/blink/renderer/core/css/properties/longhands/content_custom.cc b/third_party/blink/renderer/core/css/properties/longhands/content_custom.cc
index a5cfee9..04aa395 100644
--- a/third_party/blink/renderer/core/css/properties/longhands/content_custom.cc
+++ b/third_party/blink/renderer/core/css/properties/longhands/content_custom.cc
@@ -30,7 +30,8 @@
   if (context.IsHTMLDocument())
     attr_name = attr_name.LowerASCII();
 
-  auto* attr_value = MakeGarbageCollected<CSSFunctionValue>(CSSValueID::kAttr);
+  CSSFunctionValue* attr_value =
+      MakeGarbageCollected<CSSFunctionValue>(CSSValueID::kAttr);
   attr_value->Append(*MakeGarbageCollected<CSSCustomIdentValue>(attr_name));
   return attr_value;
 }
@@ -45,12 +46,12 @@
 
   CSSStringValue* separator = nullptr;
   if (!counters) {
-    separator = CSSStringValue::Create(String());
+    separator = MakeGarbageCollected<CSSStringValue>(String());
   } else {
     if (!css_property_parser_helpers::ConsumeCommaIncludingWhitespace(args) ||
         args.Peek().GetType() != kStringToken)
       return nullptr;
-    separator = CSSStringValue::Create(
+    separator = MakeGarbageCollected<CSSStringValue>(
         args.ConsumeIncludingWhitespace().Value().ToString());
   }
 
diff --git a/third_party/blink/renderer/core/css/properties/longhands/quotes_custom.cc b/third_party/blink/renderer/core/css/properties/longhands/quotes_custom.cc
index 1bde966..de9a3119 100644
--- a/third_party/blink/renderer/core/css/properties/longhands/quotes_custom.cc
+++ b/third_party/blink/renderer/core/css/properties/longhands/quotes_custom.cc
@@ -45,8 +45,10 @@
   if (style.Quotes()->size()) {
     CSSValueList* list = CSSValueList::CreateSpaceSeparated();
     for (int i = 0; i < style.Quotes()->size(); i++) {
-      list->Append(*CSSStringValue::Create(style.Quotes()->GetOpenQuote(i)));
-      list->Append(*CSSStringValue::Create(style.Quotes()->GetCloseQuote(i)));
+      list->Append(*MakeGarbageCollected<CSSStringValue>(
+          style.Quotes()->GetOpenQuote(i)));
+      list->Append(*MakeGarbageCollected<CSSStringValue>(
+          style.Quotes()->GetCloseQuote(i)));
     }
     return list;
   }
diff --git a/third_party/blink/renderer/core/css/properties/longhands/webkit_box_reflect_custom.cc b/third_party/blink/renderer/core/css/properties/longhands/webkit_box_reflect_custom.cc
index 554e0a7..6325873 100644
--- a/third_party/blink/renderer/core/css/properties/longhands/webkit_box_reflect_custom.cc
+++ b/third_party/blink/renderer/core/css/properties/longhands/webkit_box_reflect_custom.cc
@@ -40,7 +40,8 @@
     if (!mask)
       return nullptr;
   }
-  return cssvalue::CSSReflectValue::Create(direction, offset, mask);
+  return MakeGarbageCollected<cssvalue::CSSReflectValue>(direction, offset,
+                                                         mask);
 }
 
 }  // namespace
diff --git a/third_party/blink/renderer/core/css/properties/longhands/webkit_highlight_custom.cc b/third_party/blink/renderer/core/css/properties/longhands/webkit_highlight_custom.cc
index 8f22d06..f4eeaae 100644
--- a/third_party/blink/renderer/core/css/properties/longhands/webkit_highlight_custom.cc
+++ b/third_party/blink/renderer/core/css/properties/longhands/webkit_highlight_custom.cc
@@ -28,7 +28,7 @@
     bool allow_visited_style) const {
   if (style.Highlight() == g_null_atom)
     return CSSIdentifierValue::Create(CSSValueID::kNone);
-  return CSSStringValue::Create(style.Highlight());
+  return MakeGarbageCollected<CSSStringValue>(style.Highlight());
 }
 
 }  // namespace css_longhand
diff --git a/third_party/blink/renderer/core/css/properties/longhands/webkit_hyphenate_character_custom.cc b/third_party/blink/renderer/core/css/properties/longhands/webkit_hyphenate_character_custom.cc
index 2150a16..62c70260 100644
--- a/third_party/blink/renderer/core/css/properties/longhands/webkit_hyphenate_character_custom.cc
+++ b/third_party/blink/renderer/core/css/properties/longhands/webkit_hyphenate_character_custom.cc
@@ -28,7 +28,7 @@
     bool allow_visited_style) const {
   if (style.HyphenationString().IsNull())
     return CSSIdentifierValue::Create(CSSValueID::kAuto);
-  return CSSStringValue::Create(style.HyphenationString());
+  return MakeGarbageCollected<CSSStringValue>(style.HyphenationString());
 }
 
 }  // namespace css_longhand
diff --git a/third_party/blink/renderer/core/css/properties/longhands/webkit_locale_custom.cc b/third_party/blink/renderer/core/css/properties/longhands/webkit_locale_custom.cc
index 7b99a28..f66dc868 100644
--- a/third_party/blink/renderer/core/css/properties/longhands/webkit_locale_custom.cc
+++ b/third_party/blink/renderer/core/css/properties/longhands/webkit_locale_custom.cc
@@ -28,7 +28,7 @@
     bool allow_visited_style) const {
   if (style.Locale().IsNull())
     return CSSIdentifierValue::Create(CSSValueID::kAuto);
-  return CSSStringValue::Create(style.Locale());
+  return MakeGarbageCollected<CSSStringValue>(style.Locale());
 }
 
 void WebkitLocale::ApplyValue(StyleResolverState& state,
diff --git a/third_party/blink/renderer/core/css/properties/longhands/webkit_text_emphasis_style_custom.cc b/third_party/blink/renderer/core/css/properties/longhands/webkit_text_emphasis_style_custom.cc
index 0922a4f..3befa47 100644
--- a/third_party/blink/renderer/core/css/properties/longhands/webkit_text_emphasis_style_custom.cc
+++ b/third_party/blink/renderer/core/css/properties/longhands/webkit_text_emphasis_style_custom.cc
@@ -58,7 +58,8 @@
     case TextEmphasisMark::kNone:
       return CSSIdentifierValue::Create(CSSValueID::kNone);
     case TextEmphasisMark::kCustom:
-      return CSSStringValue::Create(style.TextEmphasisCustomMark());
+      return MakeGarbageCollected<CSSStringValue>(
+          style.TextEmphasisCustomMark());
     case TextEmphasisMark::kAuto:
       NOTREACHED();
       FALLTHROUGH;
diff --git a/third_party/blink/renderer/core/css/remote_font_face_source.cc b/third_party/blink/renderer/core/css/remote_font_face_source.cc
index ff93779..f0248fb 100644
--- a/third_party/blink/renderer/core/css/remote_font_face_source.cc
+++ b/third_party/blink/renderer/core/css/remote_font_face_source.cc
@@ -124,12 +124,14 @@
   if (font->GetStatus() == ResourceStatus::kDecodeError) {
     font_selector_->GetExecutionContext()->AddConsoleMessage(
         ConsoleMessage::Create(
-            kOtherMessageSource, mojom::ConsoleMessageLevel::kWarning,
+            mojom::ConsoleMessageSource::kOther,
+            mojom::ConsoleMessageLevel::kWarning,
             "Failed to decode downloaded font: " + font->Url().ElidedString()));
     if (font->OtsParsingMessage().length() > 1) {
       font_selector_->GetExecutionContext()->AddConsoleMessage(
           ConsoleMessage::Create(
-              kOtherMessageSource, mojom::ConsoleMessageLevel::kWarning,
+              mojom::ConsoleMessageSource::kOther,
+              mojom::ConsoleMessageLevel::kWarning,
               "OTS parsing error: " + font->OtsParsingMessage()));
     }
   }
@@ -279,7 +281,8 @@
     if (font->IsLowPriorityLoadingAllowedForRemoteFont()) {
       font_selector_->GetExecutionContext()->AddConsoleMessage(
           ConsoleMessage::Create(
-              kInterventionMessageSource, mojom::ConsoleMessageLevel::kInfo,
+              mojom::ConsoleMessageSource::kIntervention,
+              mojom::ConsoleMessageLevel::kInfo,
               "Slow network is detected. See "
               "https://www.chromestatus.com/feature/5636954674692096 for more "
               "details. Fallback font will be used while loading: " +
diff --git a/third_party/blink/renderer/core/css/resolver/style_adjuster.cc b/third_party/blink/renderer/core/css/resolver/style_adjuster.cc
index a87e347c..76b9c5f 100644
--- a/third_party/blink/renderer/core/css/resolver/style_adjuster.cc
+++ b/third_party/blink/renderer/core/css/resolver/style_adjuster.cc
@@ -77,60 +77,6 @@
   return touch_action;
 }
 
-bool ShouldForceLegacyLayout(const ComputedStyle& style,
-                             const ComputedStyle& layout_parent_style,
-                             const Element& element) {
-  // Form controls are not supported yet.
-  if (element.ShouldForceLegacyLayout())
-    return true;
-
-  // When the actual parent (to inherit style from) doesn't have a layout box
-  // (display:contents), it may not have been switched over to forcing legacy
-  // layout, even if it's inside a subtree that should use legacy. Check with
-  // the layout parent as well, so that we don't risk switching back to LayoutNG
-  // when we shouldn't.
-  if (layout_parent_style.ForceLegacyLayout())
-    return true;
-
-  const Document& document = element.GetDocument();
-
-  // TODO(layout-dev): Once LayoutNG handles inline content editable, we
-  // should get rid of following code fragment.
-  if (!RuntimeEnabledFeatures::EditingNGEnabled()) {
-    if (style.UserModify() != EUserModify::kReadOnly || document.InDesignMode())
-      return true;
-  }
-
-  if (style.Display() == EDisplay::kWebkitBox ||
-      style.Display() == EDisplay::kWebkitInlineBox)
-    return true;
-
-  if (!RuntimeEnabledFeatures::LayoutNGBlockFragmentationEnabled()) {
-    // Disable NG for the entire subtree if we're establishing a block
-    // fragmentation context.
-    if (style.SpecifiesColumns() || style.IsOverflowPaged())
-      return true;
-    if (document.Printing()) {
-      // This needs to be discovered on the root element.
-      DCHECK_EQ(element, document.documentElement());
-      return true;
-    }
-  }
-
-  // The custom container is laid out by the legacy engine. Its children may
-  // not establish new formatting contexts, so we need to protect against
-  // re-entering LayoutNG there.
-  if (style.Display() == EDisplay::kLayoutCustom ||
-      style.Display() == EDisplay::kInlineLayoutCustom)
-    return true;
-
-  // 'text-combine-upright' property is not supported yet.
-  if (style.HasTextCombine() && !style.IsHorizontalWritingMode())
-    return true;
-
-  return false;
-}
-
 }  // namespace
 
 static EDisplay EquivalentBlockDisplay(EDisplay display) {
@@ -725,11 +671,5 @@
       style.SetTextOverflow(text_control->ValueForTextOverflow());
     }
   }
-
-  if (RuntimeEnabledFeatures::LayoutNGEnabled() && !style.ForceLegacyLayout() &&
-      element &&
-      ShouldForceLegacyLayout(style, layout_parent_style, *element)) {
-    style.SetForceLegacyLayout(true);
-  }
 }
 }  // namespace blink
diff --git a/third_party/blink/renderer/core/css/resolver/style_builder_converter.cc b/third_party/blink/renderer/core/css/resolver/style_builder_converter.cc
index 9d1651c..a0d3ca2 100644
--- a/third_party/blink/renderer/core/css/resolver/style_builder_converter.cc
+++ b/third_party/blink/renderer/core/css/resolver/style_builder_converter.cc
@@ -1652,7 +1652,7 @@
     const CSSValue& value) {
   // TODO(timloh): Images values can also contain lengths.
   if (const auto* function_value = DynamicTo<CSSFunctionValue>(value)) {
-    auto* new_function =
+    CSSFunctionValue* new_function =
         MakeGarbageCollected<CSSFunctionValue>(function_value->FunctionType());
     for (const CSSValue* inner_value : To<CSSValueList>(value)) {
       new_function->Append(ComputeRegisteredPropertyValue(
diff --git a/third_party/blink/renderer/core/css/style_rule.cc b/third_party/blink/renderer/core/css/style_rule.cc
index ddf4873f..85da695 100644
--- a/third_party/blink/renderer/core/css/style_rule.cc
+++ b/third_party/blink/renderer/core/css/style_rule.cc
@@ -178,7 +178,8 @@
   StyleRuleBase* self = const_cast<StyleRuleBase*>(this);
   switch (GetType()) {
     case kStyle:
-      rule = CSSStyleRule::Create(To<StyleRule>(self), parent_sheet);
+      rule =
+          MakeGarbageCollected<CSSStyleRule>(To<StyleRule>(self), parent_sheet);
       break;
     case kPage:
       rule = MakeGarbageCollected<CSSPageRule>(To<StyleRulePage>(self),
diff --git a/third_party/blink/renderer/core/dom/document.cc b/third_party/blink/renderer/core/dom/document.cc
index 81e0843..6bb5984 100644
--- a/third_party/blink/renderer/core/dom/document.cc
+++ b/third_party/blink/renderer/core/dom/document.cc
@@ -108,7 +108,6 @@
 #include "third_party/blink/renderer/core/dom/events/event_listener.h"
 #include "third_party/blink/renderer/core/dom/events/scoped_event_queue.h"
 #include "third_party/blink/renderer/core/dom/flat_tree_traversal.h"
-#include "third_party/blink/renderer/core/dom/layout_tree_builder.h"
 #include "third_party/blink/renderer/core/dom/layout_tree_builder_traversal.h"
 #include "third_party/blink/renderer/core/dom/live_node_list.h"
 #include "third_party/blink/renderer/core/dom/mutation_observer.h"
@@ -1381,7 +1380,8 @@
         // The above removeChild() can execute arbitrary JavaScript code.
         if (source->parentNode()) {
           AddConsoleMessage(ConsoleMessage::Create(
-              kJSMessageSource, mojom::ConsoleMessageLevel::kWarning,
+              mojom::ConsoleMessageSource::kJavaScript,
+              mojom::ConsoleMessageLevel::kWarning,
               ExceptionMessages::FailedToExecute("adoptNode", "Document",
                                                  "Unable to remove the "
                                                  "specified node from the "
@@ -2333,9 +2333,7 @@
         document_element->ChildNeedsReattachLayoutTree()) {
       TRACE_EVENT0("blink,blink_style", "Document::rebuildLayoutTree");
       SCOPED_BLINK_UMA_HISTOGRAM_TIMER_HIGHRES("Style.RebuildLayoutTreeTime");
-      ReattachLegacyLayoutObjectList legacy_layout_objects(*this);
       GetStyleEngine().RebuildLayoutTree();
-      legacy_layout_objects.ForceLegacyLayoutIfNeeded();
     }
   }
   GetStyleEngine().ClearWhitespaceReattachSet();
@@ -2659,12 +2657,8 @@
   layout_view_->Compositor()->SetNeedsCompositingUpdate(
       kCompositingUpdateAfterCompositingInputChange);
 
-  {
-    ReattachLegacyLayoutObjectList legacy_layout_objects(*this);
-    AttachContext context;
-    ContainerNode::AttachLayoutTree(context);
-    legacy_layout_objects.ForceLegacyLayoutIfNeeded();
-  }
+  AttachContext context;
+  ContainerNode::AttachLayoutTree(context);
 
   // The TextAutosizer can't update layout view info while the Document is
   // detached, so update now in case anything changed.
@@ -3806,7 +3800,8 @@
   if (!has_insertion_point) {
     if (ignore_destructive_write_count_) {
       AddConsoleMessage(ConsoleMessage::Create(
-          kJSMessageSource, mojom::ConsoleMessageLevel::kWarning,
+          mojom::ConsoleMessageSource::kJavaScript,
+          mojom::ConsoleMessageLevel::kWarning,
           ExceptionMessages::FailedToExecute(
               "write", "Document",
               "It isn't possible to write into a document "
@@ -4046,7 +4041,8 @@
         base_element_url.ProtocolIsJavaScript()) {
       UseCounter::Count(*this, WebFeature::kBaseWithDataHref);
       AddConsoleMessage(ConsoleMessage::Create(
-          kSecurityMessageSource, mojom::ConsoleMessageLevel::kError,
+          mojom::ConsoleMessageSource::kSecurity,
+          mojom::ConsoleMessageLevel::kError,
           "'" + base_element_url.Protocol() +
               "' URLs may not be used as base URLs for a document."));
     }
@@ -4159,8 +4155,9 @@
   if (refresh_url.ProtocolIsJavaScript()) {
     String message =
         "Refused to refresh " + url_.ElidedString() + " to a javascript: URL";
-    AddConsoleMessage(ConsoleMessage::Create(
-        kSecurityMessageSource, mojom::ConsoleMessageLevel::kError, message));
+    AddConsoleMessage(
+        ConsoleMessage::Create(mojom::ConsoleMessageSource::kSecurity,
+                               mojom::ConsoleMessageLevel::kError, message));
     return;
   }
 
@@ -4170,8 +4167,9 @@
         "Refused to execute the redirect specified via '<meta "
         "http-equiv='refresh' content='...'>'. The document is sandboxed, and "
         "the 'allow-scripts' keyword is not set.";
-    AddConsoleMessage(ConsoleMessage::Create(
-        kSecurityMessageSource, mojom::ConsoleMessageLevel::kError, message));
+    AddConsoleMessage(
+        ConsoleMessage::Create(mojom::ConsoleMessageSource::kSecurity,
+                               mojom::ConsoleMessageLevel::kError, message));
     return;
   }
   if (http_refresh_type == kHttpRefreshFromHeader) {
@@ -6192,9 +6190,10 @@
   auto declared_policy = ParseFeaturePolicyHeader(
       feature_policy_header, GetSecurityOrigin(), &messages, this);
   for (auto& message : messages) {
-    AddConsoleMessage(ConsoleMessage::Create(
-        kSecurityMessageSource, mojom::ConsoleMessageLevel::kError,
-        "Error with Feature-Policy header: " + message));
+    AddConsoleMessage(
+        ConsoleMessage::Create(mojom::ConsoleMessageSource::kSecurity,
+                               mojom::ConsoleMessageLevel::kError,
+                               "Error with Feature-Policy header: " + message));
   }
   if (GetSandboxFlags() != kSandboxNone &&
       RuntimeEnabledFeatures::FeaturePolicyForSandboxEnabled()) {
@@ -6260,7 +6259,8 @@
   // later. In that case, any subsequent violations will be correctly reported.
   if (!origin_trials::FeaturePolicyReportingEnabled(this)) {
     AddConsoleMessage(ConsoleMessage::Create(
-        kSecurityMessageSource, mojom::ConsoleMessageLevel::kWarning,
+        mojom::ConsoleMessageSource::kSecurity,
+        mojom::ConsoleMessageLevel::kWarning,
         "Feature-Policy-Report-Only header will have no effect unless Feature "
         "Policy reporting is enabled with an Origin Trial. Sign up at "
         "https://developers.chrome.com/origintrials/"));
@@ -6272,7 +6272,8 @@
       feature_policy_report_only_header, GetSecurityOrigin(), &messages, this);
   for (auto& message : messages) {
     AddConsoleMessage(ConsoleMessage::Create(
-        kSecurityMessageSource, mojom::ConsoleMessageLevel::kError,
+        mojom::ConsoleMessageSource::kSecurity,
+        mojom::ConsoleMessageLevel::kError,
         "Error with Feature-Policy-Report-Only header: " + message));
   }
 
@@ -6562,7 +6563,8 @@
     // https://bugs.webkit.org/show_bug.cgi?id=103274 exists.
     if (reason == kAboutToExecuteScript) {
       AddConsoleMessage(ConsoleMessage::Create(
-          kSecurityMessageSource, mojom::ConsoleMessageLevel::kError,
+          mojom::ConsoleMessageSource::kSecurity,
+          mojom::ConsoleMessageLevel::kError,
           "Blocked script execution in '" + Url().ElidedString() +
               "' because the document's frame is sandboxed and the "
               "'allow-scripts' permission is not set."));
@@ -6719,7 +6721,7 @@
   return *resize_observer_controller_;
 }
 
-static void RunAddConsoleMessageTask(MessageSource source,
+static void RunAddConsoleMessageTask(mojom::ConsoleMessageSource source,
                                      mojom::ConsoleMessageLevel level,
                                      const String& message,
                                      ExecutionContext* context) {
@@ -7750,7 +7752,8 @@
   // TODO(iclelland): Report something different in report-only mode
   if (disposition == mojom::FeaturePolicyDisposition::kEnforce) {
     frame->Console().AddMessage(ConsoleMessage::Create(
-        kViolationMessageSource, mojom::ConsoleMessageLevel::kError,
+        mojom::ConsoleMessageSource::kViolation,
+        mojom::ConsoleMessageLevel::kError,
         (message.IsEmpty() ? ("Feature policy violation: " + feature_name +
                               " is not allowed in this document.")
                            : message)));
@@ -7851,9 +7854,9 @@
   for (const WebString& end_point : violation_params->report_endpoints)
     report_endpoints.push_back(end_point);
 
-  AddConsoleMessage(ConsoleMessage::Create(kSecurityMessageSource,
-                                           mojom::ConsoleMessageLevel::kError,
-                                           violation_params->console_message));
+  AddConsoleMessage(ConsoleMessage::Create(
+      mojom::ConsoleMessageSource::kSecurity,
+      mojom::ConsoleMessageLevel::kError, violation_params->console_message));
   GetContentSecurityPolicy()->ReportViolation(
       violation_params->directive,
       ContentSecurityPolicy::GetDirectiveType(
diff --git a/third_party/blink/renderer/core/dom/document.h b/third_party/blink/renderer/core/dom/document.h
index 00ac59d..589ca4e 100644
--- a/third_party/blink/renderer/core/dom/document.h
+++ b/third_party/blink/renderer/core/dom/document.h
@@ -139,7 +139,6 @@
 class IdleRequestOptions;
 class IntersectionObserverController;
 class LayoutPoint;
-class ReattachLegacyLayoutObjectList;
 class LayoutView;
 class LazyLoadImageObserver;
 class LiveNodeListBase;
@@ -1413,9 +1412,6 @@
 
   const AtomicString& RequiredCSP();
 
-  // TODO(layout-dev): Once everything are LayoutNG, we can get rid of this.
-  ReattachLegacyLayoutObjectList& GetReattachLegacyLayoutObjectList();
-
   StylePropertyMapReadOnly* ComputedStyleMap(Element*);
   void AddComputedStyleMapItem(Element*, StylePropertyMapReadOnly*);
   StylePropertyMapReadOnly* RemoveComputedStyleMapItem(Element*);
@@ -1936,11 +1932,6 @@
 
   Member<SlotAssignmentEngine> slot_assignment_engine_;
 
-  friend class ReattachLegacyLayoutObjectList;
-  // TODO(layout-dev): Once everything are LayoutNG, we can get rid of this.
-  // Used for legacy layout tree fallback
-  ReattachLegacyLayoutObjectList* reattach_legacy_object_list_;
-
   // TODO(tkent): Should it be moved to LocalFrame or LocalFrameView?
   Member<ViewportData> viewport_data_;
 
diff --git a/third_party/blink/renderer/core/dom/element.cc b/third_party/blink/renderer/core/dom/element.cc
index f972193..6a40c2b 100644
--- a/third_party/blink/renderer/core/dom/element.cc
+++ b/third_party/blink/renderer/core/dom/element.cc
@@ -214,6 +214,76 @@
   return is_editable;
 }
 
+// Return true if we're absolutely sure that this node is going to establish a
+// new formatting context. Whether or not it establishes a new formatting
+// context cannot be accurately determined until we have actually created the
+// object (see LayoutBlockFlow::CreatesNewFormattingContext()), so this function
+// may (and is allowed to) return false negatives, but NEVER false positives.
+bool DefinitelyNewFormattingContext(const Node& node,
+                                    const ComputedStyle& style) {
+  auto display = style.Display();
+  if (display == EDisplay::kInline || display == EDisplay::kContents)
+    return false;
+  // The only block-container display types that potentially don't establish a
+  // new formatting context, are 'block' and 'list-item'.
+  if (display != EDisplay::kBlock && display != EDisplay::kListItem)
+    return true;
+  if (!style.IsOverflowVisible())
+    return node.GetDocument().ViewportDefiningElement() != &node;
+  if (style.HasOutOfFlowPosition() || style.IsFloating() ||
+      style.ContainsPaint() || style.ContainsLayout() ||
+      style.SpecifiesColumns())
+    return true;
+  if (node.GetDocument().documentElement() == &node)
+    return true;
+  if (const Element* element = ToElementOrNull(&node)) {
+    if (IsHTMLImageElement(element) || element->IsFormControlElement() ||
+        element->IsMediaElement() || element->IsFrameOwnerElement())
+      return true;
+  }
+  if (const Node* parent = LayoutTreeBuilderTraversal::LayoutParent(node))
+    return parent->ComputedStyleRef().IsDisplayFlexibleOrGridBox();
+  return false;
+}
+
+bool CalculateStyleShouldForceLegacyLayout(const Element& element,
+                                           const ComputedStyle& style) {
+  const Document& document = element.GetDocument();
+
+  // TODO(layout-dev): Once LayoutNG handles inline content editable, we
+  // should get rid of following code fragment.
+  if (!RuntimeEnabledFeatures::EditingNGEnabled()) {
+    if (style.UserModify() != EUserModify::kReadOnly || document.InDesignMode())
+      return true;
+  }
+
+  if (style.Display() == EDisplay::kWebkitBox ||
+      style.Display() == EDisplay::kWebkitInlineBox)
+    return true;
+
+  if (!RuntimeEnabledFeatures::LayoutNGBlockFragmentationEnabled()) {
+    // Disable NG for the entire subtree if we're establishing a block
+    // fragmentation context.
+    if (style.SpecifiesColumns() || style.IsOverflowPaged())
+      return true;
+    if (document.Printing() && element == document.documentElement())
+      return true;
+  }
+
+  // The custom container is laid out by the legacy engine. Its children may
+  // not establish new formatting contexts, so we need to protect against
+  // re-entering LayoutNG there.
+  if (style.Display() == EDisplay::kLayoutCustom ||
+      style.Display() == EDisplay::kInlineLayoutCustom)
+    return true;
+
+  // 'text-combine-upright' property is not supported yet.
+  if (style.HasTextCombine() && !style.IsHorizontalWritingMode())
+    return true;
+
+  return false;
+}
+
 }  // namespace
 
 Element* Element::Create(const QualifiedName& tag_name, Document* document) {
@@ -1939,8 +2009,9 @@
          style.Display() != EDisplay::kContents;
 }
 
-LayoutObject* Element::CreateLayoutObject(const ComputedStyle& style) {
-  return LayoutObject::CreateObject(this, style);
+LayoutObject* Element::CreateLayoutObject(const ComputedStyle& style,
+                                          LegacyLayout legacy) {
+  return LayoutObject::CreateObject(this, style, legacy);
 }
 
 Node::InsertionNotificationRequest Element::InsertedInto(
@@ -2083,15 +2154,19 @@
     return;
   }
 
-  if (style) {
-    if (CanParticipateInFlatTree()) {
-      LayoutTreeBuilderForElement builder(*this, style);
-      builder.CreateLayoutObjectIfNeeded();
-    }
-  }
-
   AttachContext children_context(context);
 
+  if (style && CanParticipateInFlatTree()) {
+    // If an element requires forced legacy layout, all descendants need it too.
+    if (ShouldForceLegacyLayout())
+      children_context.force_legacy_layout = true;
+    LegacyLayout legacy = children_context.force_legacy_layout
+                              ? LegacyLayout::kForce
+                              : LegacyLayout::kAuto;
+    LayoutTreeBuilderForElement builder(*this, style);
+    builder.CreateLayoutObjectIfNeeded(legacy);
+  }
+
   LayoutObject* layout_object = GetLayoutObject();
   if (layout_object)
     children_context.previous_in_flow = nullptr;
@@ -2432,9 +2507,12 @@
     UpdateCallbackSelectors(old_style.get(), new_style.get());
   }
 
-  if (old_style && new_style && !change.RecalcChildren() &&
-      old_style->HasChildDependentFlags()) {
-    new_style->CopyChildDependentFlagsFrom(*old_style);
+  if (new_style) {
+    if (old_style && !change.RecalcChildren() &&
+        old_style->HasChildDependentFlags())
+      new_style->CopyChildDependentFlagsFrom(*old_style);
+    if (RuntimeEnabledFeatures::LayoutNGEnabled())
+      UpdateForceLegacyLayout(*new_style, old_style.get());
   }
 
   if (child_change.ReattachLayoutTree()) {
@@ -2470,6 +2548,11 @@
 
   if (NeedsReattachLayoutTree()) {
     AttachContext reattach_context;
+    if (const Node* parent = LayoutTreeBuilderTraversal::LayoutParent(*this)) {
+      const LayoutObject* parent_object = parent->GetLayoutObject();
+      if (parent_object && parent_object->ForceLegacyLayout())
+        reattach_context.force_legacy_layout = true;
+    }
     ReattachLayoutTree(reattach_context);
     whitespace_attacher.DidReattachElement(this,
                                            reattach_context.previous_in_flow);
@@ -3440,6 +3523,69 @@
   return false;
 }
 
+bool Element::StyleShouldForceLegacyLayoutInternal() const {
+  return GetElementRareData()->StyleShouldForceLegacyLayout();
+}
+
+void Element::SetStyleShouldForceLegacyLayoutInternal(bool force) {
+  EnsureElementRareData().SetStyleShouldForceLegacyLayout(force);
+}
+
+bool Element::ShouldForceLegacyLayoutForChildInternal() const {
+  return GetElementRareData()->ShouldForceLegacyLayoutForChild();
+}
+
+void Element::SetShouldForceLegacyLayoutForChildInternal(bool force) {
+  EnsureElementRareData().SetShouldForceLegacyLayoutForChild(force);
+}
+
+void Element::UpdateForceLegacyLayout(const ComputedStyle& new_style,
+                                      const ComputedStyle* old_style) {
+  bool old_force = old_style && ShouldForceLegacyLayout();
+  SetStyleShouldForceLegacyLayout(
+      CalculateStyleShouldForceLegacyLayout(*this, new_style));
+  if (ShouldForceLegacyLayout()) {
+    if (!old_force) {
+      if (const LayoutObject* layout_object = GetLayoutObject()) {
+        // Forced legacy layout is inherited down the layout tree, so even if we
+        // just decided here on the DOM side that we need forced legacy layout,
+        // check with the LayoutObject whether this is news and that it really
+        // needs to be reattached.
+        if (!layout_object->ForceLegacyLayout())
+          SetNeedsReattachLayoutTree();
+      }
+    }
+    // Even if we also previously forced legacy layout, we may need to introduce
+    // forced legacy layout in the ancestry, e.g. if this element no longer
+    // establishes a new formatting context.
+    ForceLegacyLayoutInFormattingContext(new_style);
+  } else if (old_force) {
+    // TODO(mstensho): If we have ancestors that got legacy layout just because
+    // of this child, we should clean it up, and switch the subtree back to NG,
+    // rather than being stuck with legacy forever.
+    SetNeedsReattachLayoutTree();
+  }
+}
+
+void Element::ForceLegacyLayoutInFormattingContext(
+    const ComputedStyle& new_style) {
+  if (DefinitelyNewFormattingContext(*this, new_style))
+    return;
+
+  bool found_bfc = false;
+  for (Element* ancestor = this; !found_bfc;) {
+    ancestor = ToElementOrNull(LayoutTreeBuilderTraversal::Parent(*ancestor));
+    if (!ancestor || ancestor->ShouldForceLegacyLayout())
+      break;
+    const ComputedStyle* style = ancestor->GetComputedStyle();
+    if (style->Display() == EDisplay::kNone)
+      break;
+    found_bfc = DefinitelyNewFormattingContext(*ancestor, *style);
+    ancestor->SetShouldForceLegacyLayoutForChild(true);
+    ancestor->SetNeedsReattachLayoutTree();
+  }
+}
+
 bool Element::IsFocusedElementInDocument() const {
   return this == GetDocument().FocusedElement();
 }
diff --git a/third_party/blink/renderer/core/dom/element.h b/third_party/blink/renderer/core/dom/element.h
index 1e41a38..bd113b09 100644
--- a/third_party/blink/renderer/core/dom/element.h
+++ b/third_party/blink/renderer/core/dom/element.h
@@ -513,7 +513,7 @@
   void AttachLayoutTree(AttachContext&) override;
   void DetachLayoutTree(const AttachContext& = AttachContext()) override;
 
-  virtual LayoutObject* CreateLayoutObject(const ComputedStyle&);
+  virtual LayoutObject* CreateLayoutObject(const ComputedStyle&, LegacyLayout);
   virtual bool LayoutObjectIsNeeded(const ComputedStyle&) const;
   void RecalcStyle(const StyleRecalcChange);
   void RecalcStyleForTraversalRootAncestor();
@@ -793,7 +793,18 @@
   // sent at all.
   virtual bool IsDisabledFormControl() const { return false; }
 
-  virtual bool ShouldForceLegacyLayout() const { return false; }
+  // Return true if we should force legacy layout on this element and all
+  // descendants. Note that even if this element returns true, it's not implied
+  // that all descendants will return the same. Once an element needs to force
+  // legacy layout, though, the layout engine knows that it will have to perform
+  // legacy layout on the entire subtree.
+  bool ShouldForceLegacyLayout() const {
+    if (TypeShouldForceLegacyLayout())
+      return true;
+    if (!HasRareData())
+      return false;
+    return StyleShouldForceLegacyLayout() || ShouldForceLegacyLayoutForChild();
+  }
 
   virtual void BuildPendingResource() {}
 
@@ -1111,6 +1122,51 @@
   FRIEND_TEST_ALL_PREFIXES(DisplayLockContextTest,
                            DisplayLockPreventsActivation);
 
+  // Return whether this element type requires legacy layout.
+  virtual bool TypeShouldForceLegacyLayout() const { return false; }
+
+  // Return whether the computed style of this element causes need for legacy
+  // layout.
+  bool StyleShouldForceLegacyLayout() const {
+    if (!HasRareData())
+      return false;
+    return StyleShouldForceLegacyLayoutInternal();
+  }
+  bool StyleShouldForceLegacyLayoutInternal() const;
+  void SetStyleShouldForceLegacyLayout(bool force) {
+    if (!force && !HasRareData())
+      return;
+    SetStyleShouldForceLegacyLayoutInternal(force);
+  }
+  void SetStyleShouldForceLegacyLayoutInternal(bool);
+
+  // Return whether this element needs legacy layout because of a child.
+  bool ShouldForceLegacyLayoutForChild() const {
+    if (!HasRareData())
+      return false;
+    return ShouldForceLegacyLayoutForChildInternal();
+  }
+  bool ShouldForceLegacyLayoutForChildInternal() const;
+  void SetShouldForceLegacyLayoutForChild(bool force) {
+    if (!force && !HasRareData())
+      return;
+    SetShouldForceLegacyLayoutForChildInternal(force);
+  }
+  void SetShouldForceLegacyLayoutForChildInternal(bool);
+
+  // Update ForceLegacyLayout flags for this element, and for ancestors, if
+  // necessary. We cannot establish a ForceLegacyLayout subtree at an arbitrary
+  // element; it needs to be a block formatting context root.
+  void UpdateForceLegacyLayout(const ComputedStyle& new_style,
+                               const ComputedStyle* old_style);
+
+  // If this element requires legacy layout, and we can't tell for sure that it
+  // is going to establish a new formatting context, we need to force legacy
+  // layout on ancestors until we reach one that we're sure that will establish
+  // a new formatting context. LayoutNG and legacy layout cannot cooperate
+  // within a formatting context.
+  void ForceLegacyLayoutInFormattingContext(const ComputedStyle& new_style);
+
   Member<ElementData> element_data_;
 };
 
diff --git a/third_party/blink/renderer/core/dom/element_rare_data.h b/third_party/blink/renderer/core/dom/element_rare_data.h
index c770ee9..1df129a 100644
--- a/third_party/blink/renderer/core/dom/element_rare_data.h
+++ b/third_party/blink/renderer/core/dom/element_rare_data.h
@@ -154,6 +154,19 @@
   bool DidAttachInternals() const { return did_attach_internals_; }
   ElementInternals& EnsureElementInternals(HTMLElement& target);
 
+  void SetStyleShouldForceLegacyLayout(bool force) {
+    style_should_force_legacy_layout_ = force;
+  }
+  bool StyleShouldForceLegacyLayout() const {
+    return style_should_force_legacy_layout_;
+  }
+  void SetShouldForceLegacyLayoutForChild(bool force) {
+    should_force_legacy_layout_for_child_ = force;
+  }
+  bool ShouldForceLegacyLayoutForChild() const {
+    return should_force_legacy_layout_for_child_;
+  }
+
   AccessibleNode* GetAccessibleNode() const { return accessible_node_.Get(); }
   AccessibleNode* EnsureAccessibleNode(Element* owner_element) {
     if (!accessible_node_) {
@@ -236,6 +249,8 @@
 
   WeakMember<DisplayLockContext> display_lock_context_;
   bool did_attach_internals_ = false;
+  bool should_force_legacy_layout_for_child_ = false;
+  bool style_should_force_legacy_layout_ = false;
 };
 
 inline LayoutSize DefaultMinimumSizeForResizing() {
diff --git a/third_party/blink/renderer/core/dom/events/event_target.cc b/third_party/blink/renderer/core/dom/events/event_target.cc
index e26fe242..54c1dae3 100644
--- a/third_party/blink/renderer/core/dom/events/event_target.cc
+++ b/third_party/blink/renderer/core/dom/events/event_target.cc
@@ -309,7 +309,7 @@
 
         executing_window->GetFrame()->Console().AddMessage(
             ConsoleMessage::Create(
-                kInterventionMessageSource,
+                mojom::ConsoleMessageSource::kIntervention,
                 mojom::ConsoleMessageLevel::kWarning,
                 "Registering mousewheel event as passive due to "
                 "smoothscroll.js usage. The smoothscroll.js library is "
diff --git a/third_party/blink/renderer/core/dom/first_letter_pseudo_element.cc b/third_party/blink/renderer/core/dom/first_letter_pseudo_element.cc
index 4176191f..6edb7703 100644
--- a/third_party/blink/renderer/core/dom/first_letter_pseudo_element.cc
+++ b/third_party/blink/renderer/core/dom/first_letter_pseudo_element.cc
@@ -310,14 +310,17 @@
   // This text fragment might be empty.
   LayoutTextFragment* remaining_text;
 
+  LegacyLayout legacy_layout = first_letter_text->ForceLegacyLayout()
+                                   ? LegacyLayout::kForce
+                                   : LegacyLayout::kAuto;
+
   if (first_letter_text->GetNode()) {
     remaining_text = LayoutTextFragment::Create(
-        *first_letter_text->Style(), first_letter_text->GetNode(),
-        old_text.Impl(), length, remaining_length);
+        first_letter_text->GetNode(), old_text.Impl(), length, remaining_length,
+        legacy_layout);
   } else {
     remaining_text = LayoutTextFragment::CreateAnonymous(
-        *first_letter_text->Style(), *this, old_text.Impl(), length,
-        remaining_length);
+        *this, old_text.Impl(), length, remaining_length, legacy_layout);
   }
 
   remaining_text->SetFirstLetterPseudoElement(this);
@@ -335,7 +338,7 @@
   // Construct text fragment for the first letter.
   ComputedStyle* const letter_style = MutableComputedStyle();
   LayoutTextFragment* letter = LayoutTextFragment::CreateAnonymous(
-      *letter_style, *this, old_text.Impl(), 0, length);
+      *this, old_text.Impl(), 0, length, legacy_layout);
   letter->SetFirstLetterPseudoElement(this);
   letter->SetStyle(letter_style);
   GetLayoutObject()->AddChild(letter);
diff --git a/third_party/blink/renderer/core/dom/layout_tree_builder.cc b/third_party/blink/renderer/core/dom/layout_tree_builder.cc
index c6cc46b8..2f7c788d 100644
--- a/third_party/blink/renderer/core/dom/layout_tree_builder.cc
+++ b/third_party/blink/renderer/core/dom/layout_tree_builder.cc
@@ -27,16 +27,13 @@
 
 #include "third_party/blink/renderer/core/dom/layout_tree_builder.h"
 
-#include <algorithm>
 #include "third_party/blink/renderer/core/css/resolver/style_resolver.h"
-#include "third_party/blink/renderer/core/css/style_change_reason.h"
 #include "third_party/blink/renderer/core/dom/first_letter_pseudo_element.h"
 #include "third_party/blink/renderer/core/dom/node.h"
 #include "third_party/blink/renderer/core/dom/node_computed_style.h"
 #include "third_party/blink/renderer/core/dom/pseudo_element.h"
 #include "third_party/blink/renderer/core/dom/text.h"
 #include "third_party/blink/renderer/core/dom/v0_insertion_point.h"
-#include "third_party/blink/renderer/core/dom/whitespace_attacher.h"
 #include "third_party/blink/renderer/core/html_names.h"
 #include "third_party/blink/renderer/core/layout/generated_children.h"
 #include "third_party/blink/renderer/core/layout/layout_inline.h"
@@ -48,31 +45,6 @@
 
 namespace blink {
 
-namespace {
-
-// Returns a layout object containing |start| establishes block formatting
-// context or a layout object associated to document element, or null if
-// no such layout object.
-const LayoutObject* FindBlockFormattingContext(const LayoutObject& start) {
-  const LayoutObject* candidate = nullptr;
-  for (const LayoutObject* runner = &start; runner; runner = runner->Parent()) {
-    if (!runner->GetNode() || !runner->GetNode()->IsElementNode())
-      continue;
-    candidate = runner;
-    if (!runner->IsLayoutBlock())
-      continue;
-    const LayoutBlock& block = ToLayoutBlock(*runner);
-    if (block.CreatesNewFormattingContext())
-      return &block;
-  }
-  // Note: Returns the highest layout object associated to element.
-  // For "append-node-under-document.html", |candidate| is |LayoutIFrame| and
-  // document element is IFRAME.
-  return candidate;
-}
-
-}  // namespace
-
 LayoutTreeBuilderForElement::LayoutTreeBuilderForElement(Element& element,
                                                          ComputedStyle* style)
     : LayoutTreeBuilder(element, nullptr), style_(style) {
@@ -134,14 +106,8 @@
 }
 
 DISABLE_CFI_PERF
-void LayoutTreeBuilderForElement::CreateLayoutObject() {
-  ReattachLegacyLayoutObjectList& legacy_layout_objects =
-      node_->GetDocument().GetReattachLegacyLayoutObjectList();
-  if (legacy_layout_objects.IsForcingLegacyLayout()) {
-    DCHECK(!node_->GetLayoutObject());
-    style_->SetForceLegacyLayout(true);
-  }
-  LayoutObject* new_layout_object = node_->CreateLayoutObject(*style_);
+void LayoutTreeBuilderForElement::CreateLayoutObject(LegacyLayout legacy) {
+  LayoutObject* new_layout_object = node_->CreateLayoutObject(*style_, legacy);
   if (!new_layout_object)
     return;
 
@@ -167,9 +133,6 @@
   // Note: Adding new_layout_object instead of LayoutObject(). LayoutObject()
   // may be a child of new_layout_object.
   parent_layout_object->AddChild(new_layout_object, next_layout_object);
-  if (!legacy_layout_objects.IsCollecting())
-    return;
-  legacy_layout_objects.AddForceLegacyAtBFCAncestor(*new_layout_object);
 }
 
 LayoutObject*
@@ -210,7 +173,11 @@
     next_layout_object = NextLayoutObject();
   }
 
-  LayoutText* new_layout_object = node_->CreateTextLayoutObject(style);
+  LegacyLayout legacy_layout = layout_object_parent_->ForceLegacyLayout()
+                                   ? LegacyLayout::kForce
+                                   : LegacyLayout::kAuto;
+  LayoutText* new_layout_object =
+      node_->CreateTextLayoutObject(style, legacy_layout);
   if (!layout_object_parent_->IsChildAllowed(new_layout_object, style)) {
     new_layout_object->Destroy();
     return;
@@ -228,72 +195,4 @@
   layout_object_parent_->AddChild(new_layout_object, next_layout_object);
 }
 
-// ----
-ReattachLegacyLayoutObjectList::ReattachLegacyLayoutObjectList(
-    Document& document)
-    : document_(document),
-      state_(RuntimeEnabledFeatures::LayoutNGEnabled()
-                 ? State::kCollecting
-                 : State::kBuildingLegacyLayoutTree) {
-  DCHECK(!document_->reattach_legacy_object_list_);
-  document_->reattach_legacy_object_list_ = this;
-}
-
-ReattachLegacyLayoutObjectList::~ReattachLegacyLayoutObjectList() {
-  DCHECK_EQ(document_->reattach_legacy_object_list_, this);
-  DCHECK_EQ(state_, State::kClosed);
-  document_->reattach_legacy_object_list_ = nullptr;
-}
-
-void ReattachLegacyLayoutObjectList::AddForceLegacyAtBFCAncestor(
-    const LayoutObject& start) {
-  DCHECK(IsCollecting()) << static_cast<int>(state_);
-  if (!start.Style()->ForceLegacyLayout())
-    return;
-  if (start.Parent()->Style()->ForceLegacyLayout()) {
-    // BFC root of |start| is already in the list.
-    return;
-  }
-  const LayoutObject* const bfc = FindBlockFormattingContext(start);
-  if (start == bfc)
-    return;
-  DCHECK(bfc) << start;
-  Element* bfc_element = ToElement(bfc->GetNode());
-  DCHECK(bfc_element);
-  // Mark BFC root is added into the list.
-  // TODO(futhark): We should not mutate the ComputedStyle here.
-  bfc_element->MutableComputedStyle()->SetForceLegacyLayout(true);
-  reattach_elements_.push_back(bfc_element);
-}
-
-bool ReattachLegacyLayoutObjectList::IsCollecting() const {
-  return state_ == State::kCollecting;
-}
-
-void ReattachLegacyLayoutObjectList::ForceLegacyLayoutIfNeeded() {
-  const State state = state_;
-  state_ = State::kClosed;
-  if (state == State::kBuildingLegacyLayoutTree)
-    return;
-  DCHECK_EQ(state, State::kCollecting);
-  if (reattach_elements_.IsEmpty())
-    return;
-  for (Element* element : reattach_elements_)
-    element->SetForceReattachLayoutTree();
-  state_ = State::kForcingLegacyLayout;
-  document_->GetStyleEngine().RecalcStyle({});
-  document_->GetStyleEngine().RebuildLayoutTree();
-  state_ = State::kClosed;
-}
-
-void ReattachLegacyLayoutObjectList::Trace(Visitor* visitor) {
-  visitor->Trace(document_);
-  visitor->Trace(reattach_elements_);
-}
-
-ReattachLegacyLayoutObjectList& Document::GetReattachLegacyLayoutObjectList() {
-  DCHECK(reattach_legacy_object_list_);
-  return *reattach_legacy_object_list_;
-}
-
 }  // namespace blink
diff --git a/third_party/blink/renderer/core/dom/layout_tree_builder.h b/third_party/blink/renderer/core/dom/layout_tree_builder.h
index 9345cd5..135ecf94 100644
--- a/third_party/blink/renderer/core/dom/layout_tree_builder.h
+++ b/third_party/blink/renderer/core/dom/layout_tree_builder.h
@@ -29,14 +29,12 @@
 #define THIRD_PARTY_BLINK_RENDERER_CORE_DOM_LAYOUT_TREE_BUILDER_H_
 
 #include "base/memory/scoped_refptr.h"
-#include "third_party/blink/renderer/core/core_export.h"
 #include "third_party/blink/renderer/core/dom/document.h"
 #include "third_party/blink/renderer/core/dom/layout_tree_builder_traversal.h"
 #include "third_party/blink/renderer/core/dom/node.h"
 #include "third_party/blink/renderer/core/dom/text.h"
 #include "third_party/blink/renderer/core/layout/layout_inline.h"
 #include "third_party/blink/renderer/core/layout/layout_object.h"
-#include "third_party/blink/renderer/platform/wtf/vector.h"
 
 namespace blink {
 
@@ -101,16 +99,16 @@
  public:
   LayoutTreeBuilderForElement(Element&, ComputedStyle*);
 
-  void CreateLayoutObjectIfNeeded() {
+  void CreateLayoutObjectIfNeeded(LegacyLayout legacy) {
     if (ShouldCreateLayoutObject())
-      CreateLayoutObject();
+      CreateLayoutObject(legacy);
   }
 
  private:
   LayoutObject* ParentLayoutObject() const;
   LayoutObject* NextLayoutObject() const;
   bool ShouldCreateLayoutObject() const;
-  void CreateLayoutObject();
+  void CreateLayoutObject(LegacyLayout);
 
   scoped_refptr<ComputedStyle> style_;
 };
@@ -130,56 +128,6 @@
   scoped_refptr<ComputedStyle> style_;
 };
 
-// Replaces LayoutNG objects to legacy layout objects when corresponding element
-// returns true for |ShouldForceLegacyLayout()|.
-//
-// This replacement is done by three phases:
-//  1. Collects layout objects establish block formatting context(BFC) and
-//     contain at least one layout object should be legacy layout.
-//  2. Marks descendant LayoutNG objects of collected layout objects to
-//     |NeedsReattachLayoutTree|.
-//  3. Invokes |RebuildLayoutTree()| to replaces to legacy layout objects.
-//
-// See https://goo.gl/8s5h96 for more details.
-class CORE_EXPORT ReattachLegacyLayoutObjectList final {
-  // Note: Make GC-plugin happy, this object doesn't have |STACK_ALLOCATED()|.
-  DISALLOW_NEW();
-
- public:
-  ReattachLegacyLayoutObjectList(Document&);
-  ~ReattachLegacyLayoutObjectList();
-
-  void AddForceLegacyAtBFCAncestor(const LayoutObject&);
-  bool IsCollecting() const;
-  bool IsForcingLegacyLayout() const {
-    return state_ == State::kForcingLegacyLayout;
-  }
-  void ForceLegacyLayoutIfNeeded();
-
-  void Trace(Visitor*);
-
- private:
-  Member<Document> document_;
-
-  // A list of elements establishing a block formatting context which need to
-  // be re-attached to use legacy fallback.
-  HeapVector<Member<Element>> reattach_elements_;
-
-  enum class State {
-    kInvalid,
-    // Building legacy layout tree
-    kBuildingLegacyLayoutTree,
-    // Usage of this list is finished.
-    kClosed,
-    // Collecting block formatting context should be legacy layout.
-    kCollecting,
-    // Replaces LayoutNG objects to legacy layout objects.
-    kForcingLegacyLayout,
-  } state_ = State::kInvalid;
-
-  DISALLOW_COPY_AND_ASSIGN(ReattachLegacyLayoutObjectList);
-};
-
 }  // namespace blink
 
 #endif
diff --git a/third_party/blink/renderer/core/dom/node.h b/third_party/blink/renderer/core/dom/node.h
index cf4bd2c..fbf3b372 100644
--- a/third_party/blink/renderer/core/dom/node.h
+++ b/third_party/blink/renderer/core/dom/node.h
@@ -111,6 +111,17 @@
 
 enum class CloneChildrenFlag { kClone, kSkip };
 
+// Whether or not to force creation of a legacy layout object (i.e. disallow
+// LayoutNG).
+enum class LegacyLayout {
+  // Allow LayoutNG, if nothing else is preventing it (runtime feature disabled,
+  // specific object type not yet implemented, Element says no, etc.)
+  kAuto,
+
+  // Force legacy layout object creation.
+  kForce
+};
+
 // A Node is a base class for all objects in the DOM tree.
 // The spec governing this interface can be found here:
 // https://dom.spec.whatwg.org/#interface-node
@@ -667,6 +678,8 @@
     bool performing_reattach = false;
     // True if the previous_in_flow member is up-to-date, even if it is nullptr.
     bool use_previous_in_flow = false;
+    // True if we need to force legacy layout objects for the entire subtree.
+    bool force_legacy_layout = false;
 
     AttachContext() {}
   };
diff --git a/third_party/blink/renderer/core/dom/node_test.cc b/third_party/blink/renderer/core/dom/node_test.cc
index 06005a3f..5968a872 100644
--- a/third_party/blink/renderer/core/dom/node_test.cc
+++ b/third_party/blink/renderer/core/dom/node_test.cc
@@ -10,7 +10,6 @@
 #include "third_party/blink/renderer/core/dom/comment.h"
 #include "third_party/blink/renderer/core/dom/element.h"
 #include "third_party/blink/renderer/core/dom/flat_tree_traversal.h"
-#include "third_party/blink/renderer/core/dom/layout_tree_builder.h"
 #include "third_party/blink/renderer/core/dom/processing_instruction.h"
 #include "third_party/blink/renderer/core/dom/shadow_root.h"
 #include "third_party/blink/renderer/core/dom/shadow_root_init.h"
@@ -39,10 +38,8 @@
     node.LazyReattachIfAttached();
     GetDocument().Lifecycle().AdvanceTo(DocumentLifecycle::kInStyleRecalc);
     GetDocument().GetStyleEngine().RecalcStyle({});
-    ReattachLegacyLayoutObjectList legacy_objects(GetDocument());
     Node::AttachContext context;
     node.ReattachLayoutTree(context);
-    legacy_objects.ForceLegacyLayoutIfNeeded();
     return context.previous_in_flow;
   }
 
diff --git a/third_party/blink/renderer/core/dom/pseudo_element.cc b/third_party/blink/renderer/core/dom/pseudo_element.cc
index a13d691c..2e5672e 100644
--- a/third_party/blink/renderer/core/dom/pseudo_element.cc
+++ b/third_party/blink/renderer/core/dom/pseudo_element.cc
@@ -180,7 +180,9 @@
 
   for (const ContentData* content = style.GetContentData(); content;
        content = content->Next()) {
-    LayoutObject* child = content->CreateLayoutObject(*this, style);
+    LegacyLayout legacy = context.force_legacy_layout ? LegacyLayout::kForce
+                                                      : LegacyLayout::kAuto;
+    LayoutObject* child = content->CreateLayoutObject(*this, style, legacy);
     if (layout_object->IsChildAllowed(child, style)) {
       layout_object->AddChild(child);
       if (child->IsQuote())
diff --git a/third_party/blink/renderer/core/dom/text.cc b/third_party/blink/renderer/core/dom/text.cc
index d0bec0f..8f5a7531 100644
--- a/third_party/blink/renderer/core/dom/text.cc
+++ b/third_party/blink/renderer/core/dom/text.cc
@@ -33,10 +33,10 @@
 #include "third_party/blink/renderer/core/dom/node_traversal.h"
 #include "third_party/blink/renderer/core/dom/shadow_root.h"
 #include "third_party/blink/renderer/core/dom/whitespace_attacher.h"
+#include "third_party/blink/renderer/core/layout/layout_object_factory.h"
 #include "third_party/blink/renderer/core/layout/layout_text.h"
 #include "third_party/blink/renderer/core/layout/layout_text_combine.h"
 #include "third_party/blink/renderer/core/layout/layout_text_fragment.h"
-#include "third_party/blink/renderer/core/layout/ng/inline/layout_ng_text.h"
 #include "third_party/blink/renderer/core/layout/svg/layout_svg_inline_text.h"
 #include "third_party/blink/renderer/core/svg/svg_foreign_object_element.h"
 #include "third_party/blink/renderer/core/svg_names.h"
@@ -327,17 +327,15 @@
          !IsSVGForeignObjectElement(*parent_or_shadow_host_node);
 }
 
-LayoutText* Text::CreateTextLayoutObject(const ComputedStyle& style) {
+LayoutText* Text::CreateTextLayoutObject(const ComputedStyle& style,
+                                         LegacyLayout legacy) {
   if (IsSVGText(this))
     return new LayoutSVGInlineText(this, DataImpl());
 
   if (style.HasTextCombine())
     return new LayoutTextCombine(this, DataImpl());
 
-  if (RuntimeEnabledFeatures::LayoutNGEnabled() && !style.ForceLegacyLayout())
-    return new LayoutNGText(this, DataImpl());
-
-  return new LayoutText(this, DataImpl());
+  return LayoutObjectFactory::CreateText(this, DataImpl(), legacy);
 }
 
 void Text::AttachLayoutTree(AttachContext& context) {
diff --git a/third_party/blink/renderer/core/dom/text.h b/third_party/blink/renderer/core/dom/text.h
index 261ec21..fcc3500 100644
--- a/third_party/blink/renderer/core/dom/text.h
+++ b/third_party/blink/renderer/core/dom/text.h
@@ -63,7 +63,7 @@
   bool TextLayoutObjectIsNeeded(const AttachContext&,
                                 const ComputedStyle&,
                                 const LayoutObject& parent) const;
-  LayoutText* CreateTextLayoutObject(const ComputedStyle&);
+  LayoutText* CreateTextLayoutObject(const ComputedStyle&, LegacyLayout);
   void UpdateTextLayoutObject(unsigned offset_of_replaced_data,
                               unsigned length_of_replaced_data);
 
diff --git a/third_party/blink/renderer/core/dom/whitespace_attacher_test.cc b/third_party/blink/renderer/core/dom/whitespace_attacher_test.cc
index b1bc4f5..d6e4dec 100644
--- a/third_party/blink/renderer/core/dom/whitespace_attacher_test.cc
+++ b/third_party/blink/renderer/core/dom/whitespace_attacher_test.cc
@@ -27,8 +27,8 @@
   GetDocument().Lifecycle().AdvanceTo(DocumentLifecycle::kInStyleRecalc);
 
   // Force LayoutText to see that the reattach works.
-  text->SetLayoutObject(
-      text->CreateTextLayoutObject(GetDocument().body()->ComputedStyleRef()));
+  text->SetLayoutObject(text->CreateTextLayoutObject(
+      GetDocument().body()->ComputedStyleRef(), LegacyLayout::kAuto));
 
   WhitespaceAttacher attacher;
   attacher.DidVisitText(text);
@@ -71,7 +71,7 @@
 
   // Force LayoutText on the second whitespace to see that the reattach works.
   second_whitespace->SetLayoutObject(second_whitespace->CreateTextLayoutObject(
-      GetDocument().body()->ComputedStyleRef()));
+      GetDocument().body()->ComputedStyleRef(), LegacyLayout::kAuto));
 
   WhitespaceAttacher attacher;
   attacher.DidVisitText(second_whitespace);
@@ -160,8 +160,8 @@
     EXPECT_FALSE(text->GetLayoutObject());
 
     // Force LayoutText to see that the reattach works.
-    text->SetLayoutObject(
-        text->CreateTextLayoutObject(div->ComputedStyleRef()));
+    text->SetLayoutObject(text->CreateTextLayoutObject(div->ComputedStyleRef(),
+                                                       LegacyLayout::kAuto));
   }
   EXPECT_FALSE(text->GetLayoutObject());
 }
@@ -204,7 +204,8 @@
   GetDocument().Lifecycle().AdvanceTo(DocumentLifecycle::kInStyleRecalc);
 
   // Force LayoutText to see that the reattach works.
-  text->SetLayoutObject(text->CreateTextLayoutObject(host->ComputedStyleRef()));
+  text->SetLayoutObject(text->CreateTextLayoutObject(host->ComputedStyleRef(),
+                                                     LegacyLayout::kAuto));
 
   WhitespaceAttacher attacher;
   attacher.DidVisitText(text);
@@ -256,8 +257,8 @@
   GetDocument().Lifecycle().AdvanceTo(DocumentLifecycle::kInStyleRecalc);
 
   // Force LayoutText to see that the reattach works.
-  text->SetLayoutObject(
-      text->CreateTextLayoutObject(contents->ComputedStyleRef()));
+  text->SetLayoutObject(text->CreateTextLayoutObject(
+      contents->ComputedStyleRef(), LegacyLayout::kAuto));
 
   WhitespaceAttacher attacher;
   attacher.DidVisitElement(contents);
@@ -307,8 +308,8 @@
   GetDocument().Lifecycle().AdvanceTo(DocumentLifecycle::kInStyleRecalc);
 
   // Force LayoutText to see that the reattach works.
-  text->SetLayoutObject(
-      text->CreateTextLayoutObject(contents->ComputedStyleRef()));
+  text->SetLayoutObject(text->CreateTextLayoutObject(
+      contents->ComputedStyleRef(), LegacyLayout::kAuto));
 
   WhitespaceAttacher attacher;
   attacher.DidVisitText(text);
@@ -335,8 +336,8 @@
   GetDocument().Lifecycle().AdvanceTo(DocumentLifecycle::kInStyleRecalc);
 
   // Force LayoutText to see that the reattach works.
-  text->SetLayoutObject(
-      text->CreateTextLayoutObject(contents->ComputedStyleRef()));
+  text->SetLayoutObject(text->CreateTextLayoutObject(
+      contents->ComputedStyleRef(), LegacyLayout::kAuto));
 
   WhitespaceAttacher attacher;
   attacher.DidVisitText(text);
diff --git a/third_party/blink/renderer/core/editing/commands/composite_edit_command.cc b/third_party/blink/renderer/core/editing/commands/composite_edit_command.cc
index 1561665..a107b51 100644
--- a/third_party/blink/renderer/core/editing/commands/composite_edit_command.cc
+++ b/third_party/blink/renderer/core/editing/commands/composite_edit_command.cc
@@ -210,9 +210,9 @@
     command->SetParent(nullptr);
     return;
   }
-  if (command->IsSimpleEditCommand()) {
+  if (auto* simple_edit_command = DynamicTo<SimpleEditCommand>(command)) {
     command->SetParent(nullptr);
-    EnsureUndoStep()->Append(ToSimpleEditCommand(command));
+    EnsureUndoStep()->Append(simple_edit_command);
   }
   commands_.push_back(command);
 }
diff --git a/third_party/blink/renderer/core/editing/commands/document_exec_command.cc b/third_party/blink/renderer/core/editing/commands/document_exec_command.cc
index 64cfbf6..abf10cdf 100644
--- a/third_party/blink/renderer/core/editing/commands/document_exec_command.cc
+++ b/third_party/blink/renderer/core/editing/commands/document_exec_command.cc
@@ -80,8 +80,9 @@
     String message =
         "We don't execute document.execCommand() this time, because it is "
         "called recursively.";
-    AddConsoleMessage(ConsoleMessage::Create(
-        kJSMessageSource, mojom::ConsoleMessageLevel::kWarning, message));
+    AddConsoleMessage(
+        ConsoleMessage::Create(mojom::ConsoleMessageSource::kJavaScript,
+                               mojom::ConsoleMessageLevel::kWarning, message));
     return false;
   }
   base::AutoReset<bool> execute_scope(&is_running_exec_command_, true);
diff --git a/third_party/blink/renderer/core/editing/commands/edit_command.h b/third_party/blink/renderer/core/editing/commands/edit_command.h
index 00d412cf..aec819e 100644
--- a/third_party/blink/renderer/core/editing/commands/edit_command.h
+++ b/third_party/blink/renderer/core/editing/commands/edit_command.h
@@ -29,6 +29,7 @@
 #include "third_party/blink/renderer/core/core_export.h"
 #include "third_party/blink/renderer/core/events/input_event.h"
 #include "third_party/blink/renderer/platform/heap/handle.h"
+#include "third_party/blink/renderer/platform/wtf/casting.h"
 
 namespace blink {
 
@@ -91,11 +92,12 @@
   bool IsSimpleEditCommand() const final { return true; }
 };
 
-DEFINE_TYPE_CASTS(SimpleEditCommand,
-                  EditCommand,
-                  command,
-                  command->IsSimpleEditCommand(),
-                  command.IsSimpleEditCommand());
+template <>
+struct DowncastTraits<SimpleEditCommand> {
+  static bool AllowFrom(const EditCommand& command) {
+    return command.IsSimpleEditCommand();
+  }
+};
 
 }  // namespace blink
 
diff --git a/third_party/blink/renderer/core/editing/commands/editing_commands_utilities.cc b/third_party/blink/renderer/core/editing/commands/editing_commands_utilities.cc
index 899b1c8..0a59ae23 100644
--- a/third_party/blink/renderer/core/editing/commands/editing_commands_utilities.cc
+++ b/third_party/blink/renderer/core/editing/commands/editing_commands_utilities.cc
@@ -532,7 +532,8 @@
   // non-<html> root elements under <body>, and the <body> works as
   // rootEditableElement.
   document.AddConsoleMessage(ConsoleMessage::Create(
-      kJSMessageSource, mojom::ConsoleMessageLevel::kWarning,
+      mojom::ConsoleMessageSource::kJavaScript,
+      mojom::ConsoleMessageLevel::kWarning,
       "document.execCommand() doesn't work with an invalid HTML structure. It "
       "is corrected automatically."));
   UseCounter::Count(document, WebFeature::kExecCommandAltersHTMLStructure);
diff --git a/third_party/blink/renderer/core/editing/dom_selection.cc b/third_party/blink/renderer/core/editing/dom_selection.cc
index e57a6a83..098c788 100644
--- a/third_party/blink/renderer/core/editing/dom_selection.cc
+++ b/third_party/blink/renderer/core/editing/dom_selection.cc
@@ -841,8 +841,9 @@
 
 void DOMSelection::AddConsoleWarning(const String& message) {
   if (tree_scope_) {
-    tree_scope_->GetDocument().AddConsoleMessage(ConsoleMessage::Create(
-        kJSMessageSource, mojom::ConsoleMessageLevel::kWarning, message));
+    tree_scope_->GetDocument().AddConsoleMessage(
+        ConsoleMessage::Create(mojom::ConsoleMessageSource::kJavaScript,
+                               mojom::ConsoleMessageLevel::kWarning, message));
   }
 }
 
diff --git a/third_party/blink/renderer/core/events/touch_event_test.cc b/third_party/blink/renderer/core/events/touch_event_test.cc
index cab98c7..e94aded 100644
--- a/third_party/blink/renderer/core/events/touch_event_test.cc
+++ b/third_party/blink/renderer/core/events/touch_event_test.cc
@@ -23,7 +23,7 @@
 
   // ChromeClient methods:
   void AddMessageToConsole(LocalFrame*,
-                           MessageSource message_source,
+                           mojom::ConsoleMessageSource message_source,
                            mojom::ConsoleMessageLevel,
                            const String& message,
                            unsigned line_number,
@@ -35,13 +35,13 @@
 
   // Expose console output.
   const std::vector<String>& Messages() { return messages_; }
-  const std::vector<MessageSource>& MessageSources() {
+  const std::vector<mojom::ConsoleMessageSource>& MessageSources() {
     return message_sources_;
   }
 
  private:
   std::vector<String> messages_;
-  std::vector<MessageSource> message_sources_;
+  std::vector<mojom::ConsoleMessageSource> message_sources_;
 };
 
 class TouchEventTest : public PageTestBase {
@@ -56,7 +56,7 @@
   }
 
   const std::vector<String>& Messages() { return chrome_client_->Messages(); }
-  const std::vector<MessageSource>& MessageSources() {
+  const std::vector<mojom::ConsoleMessageSource>& MessageSources() {
     return chrome_client_->MessageSources();
   }
 
@@ -89,7 +89,8 @@
       ElementsAre("Unable to preventDefault inside passive event listener due "
                   "to target being treated as passive. See "
                   "https://www.chromestatus.com/features/5093566007214080"));
-  EXPECT_THAT(MessageSources(), ElementsAre(kInterventionMessageSource));
+  EXPECT_THAT(MessageSources(),
+              ElementsAre(mojom::ConsoleMessageSource::kIntervention));
 }
 
 class TouchEventTestNoFrame : public testing::Test {};
diff --git a/third_party/blink/renderer/core/execution_context/execution_context.cc b/third_party/blink/renderer/core/execution_context/execution_context.cc
index 0db6349..24fe9bb 100644
--- a/third_party/blink/renderer/core/execution_context/execution_context.cc
+++ b/third_party/blink/renderer/core/execution_context/execution_context.cc
@@ -212,7 +212,8 @@
                                   : kDoNotSupportReferrerPolicyLegacyKeywords,
           &referrer_policy)) {
     AddConsoleMessage(ConsoleMessage::Create(
-        kRenderingMessageSource, mojom::ConsoleMessageLevel::kError,
+        mojom::ConsoleMessageSource::kRendering,
+        mojom::ConsoleMessageLevel::kError,
         "Failed to set referrer policy: The value '" + policies +
             "' is not one of " +
             (support_legacy_keywords
diff --git a/third_party/blink/renderer/core/exported/local_frame_client_impl.cc b/third_party/blink/renderer/core/exported/local_frame_client_impl.cc
index a3d3241..a6ab5afe 100644
--- a/third_party/blink/renderer/core/exported/local_frame_client_impl.cc
+++ b/third_party/blink/renderer/core/exported/local_frame_client_impl.cc
@@ -427,11 +427,6 @@
   }
 }
 
-void LocalFrameClientImpl::DispatchWillCommitProvisionalLoad() {
-  if (web_frame_->Client())
-    web_frame_->Client()->WillCommitProvisionalLoad();
-}
-
 void LocalFrameClientImpl::DispatchDidStartProvisionalLoad(
     DocumentLoader* loader) {
   if (web_frame_->Client()) {
diff --git a/third_party/blink/renderer/core/exported/local_frame_client_impl.h b/third_party/blink/renderer/core/exported/local_frame_client_impl.h
index d68def7f..c12ce62 100644
--- a/third_party/blink/renderer/core/exported/local_frame_client_impl.h
+++ b/third_party/blink/renderer/core/exported/local_frame_client_impl.h
@@ -98,7 +98,6 @@
   void DidFinishSameDocumentNavigation(HistoryItem*,
                                        WebHistoryCommitType,
                                        bool content_initiated) override;
-  void DispatchWillCommitProvisionalLoad() override;
   void DispatchDidStartProvisionalLoad(DocumentLoader*) override;
   void DispatchDidReceiveTitle(const String&) override;
   void DispatchDidChangeIcons(IconType) override;
diff --git a/third_party/blink/renderer/core/exported/web_page_popup_impl.cc b/third_party/blink/renderer/core/exported/web_page_popup_impl.cc
index b716b5bb..3148b54 100644
--- a/third_party/blink/renderer/core/exported/web_page_popup_impl.cc
+++ b/third_party/blink/renderer/core/exported/web_page_popup_impl.cc
@@ -113,7 +113,7 @@
   }
 
   void AddMessageToConsole(LocalFrame*,
-                           MessageSource,
+                           mojom::ConsoleMessageSource,
                            mojom::ConsoleMessageLevel,
                            const String& message,
                            unsigned line_number,
diff --git a/third_party/blink/renderer/core/feature_policy/dom_feature_policy.cc b/third_party/blink/renderer/core/feature_policy/dom_feature_policy.cc
index 6aefc32..d5af2531d 100644
--- a/third_party/blink/renderer/core/feature_policy/dom_feature_policy.cc
+++ b/third_party/blink/renderer/core/feature_policy/dom_feature_policy.cc
@@ -38,7 +38,8 @@
       SecurityOrigin::CreateFromString(url);
   if (!origin || origin->IsOpaque()) {
     GetDocument()->AddConsoleMessage(ConsoleMessage::Create(
-        kOtherMessageSource, mojom::ConsoleMessageLevel::kWarning,
+        mojom::ConsoleMessageSource::kOther,
+        mojom::ConsoleMessageLevel::kWarning,
         "Invalid origin url for feature '" + feature + "': " + url + "."));
     return false;
   }
@@ -111,7 +112,7 @@
 void DOMFeaturePolicy::AddWarningForUnrecognizedFeature(
     const String& feature) const {
   GetDocument()->AddConsoleMessage(ConsoleMessage::Create(
-      kOtherMessageSource, mojom::ConsoleMessageLevel::kWarning,
+      mojom::ConsoleMessageSource::kOther, mojom::ConsoleMessageLevel::kWarning,
       "Unrecognized feature: '" + feature + "'."));
 }
 
diff --git a/third_party/blink/renderer/core/fetch/fetch_manager.cc b/third_party/blink/renderer/core/fetch/fetch_manager.cc
index 8f749927..ce5876e 100644
--- a/third_party/blink/renderer/core/fetch/fetch_manager.cc
+++ b/third_party/blink/renderer/core/fetch/fetch_manager.cc
@@ -818,8 +818,9 @@
   if (execution_context_->IsContextDestroyed())
     return;
   if (!message.IsEmpty()) {
-    execution_context_->AddConsoleMessage(ConsoleMessage::Create(
-        kJSMessageSource, mojom::ConsoleMessageLevel::kError, message));
+    execution_context_->AddConsoleMessage(
+        ConsoleMessage::Create(mojom::ConsoleMessageSource::kJavaScript,
+                               mojom::ConsoleMessageLevel::kError, message));
   }
   if (resolver_) {
     ScriptState* state = resolver_->GetScriptState();
diff --git a/third_party/blink/renderer/core/frame/csp/content_security_policy.cc b/third_party/blink/renderer/core/frame/csp/content_security_policy.cc
index 6c7bb82..fc31b52f 100644
--- a/third_party/blink/renderer/core/frame/csp/content_security_policy.cc
+++ b/third_party/blink/renderer/core/frame/csp/content_security_policy.cc
@@ -1323,7 +1323,8 @@
 
 void ContentSecurityPolicy::LogToConsole(const String& message,
                                          mojom::ConsoleMessageLevel level) {
-  LogToConsole(ConsoleMessage::Create(kSecurityMessageSource, level, message));
+  LogToConsole(ConsoleMessage::Create(mojom::ConsoleMessageSource::kSecurity,
+                                      level, message));
 }
 
 void ContentSecurityPolicy::LogToConsole(ConsoleMessage* console_message,
diff --git a/third_party/blink/renderer/core/frame/csp/csp_directive_list.cc b/third_party/blink/renderer/core/frame/csp/csp_directive_list.cc
index 51a077d..d8da1c0 100644
--- a/third_party/blink/renderer/core/frame/csp/csp_directive_list.cc
+++ b/third_party/blink/renderer/core/frame/csp/csp_directive_list.cc
@@ -183,8 +183,9 @@
     ContentSecurityPolicy::ViolationType violation_type) const {
   String message =
       IsReportOnly() ? "[Report Only] " + console_message : console_message;
-  policy_->LogToConsole(ConsoleMessage::Create(
-      kSecurityMessageSource, mojom::ConsoleMessageLevel::kError, message));
+  policy_->LogToConsole(
+      ConsoleMessage::Create(mojom::ConsoleMessageSource::kSecurity,
+                             mojom::ConsoleMessageLevel::kError, message));
   policy_->ReportViolation(directive_text, effective_type, message, blocked_url,
                            report_endpoints_, use_reporting_api_, header_,
                            header_type_, violation_type,
@@ -202,7 +203,7 @@
   String message =
       IsReportOnly() ? "[Report Only] " + console_message : console_message;
   policy_->LogToConsole(
-      ConsoleMessage::Create(kSecurityMessageSource,
+      ConsoleMessage::Create(mojom::ConsoleMessageSource::kSecurity,
                              mojom::ConsoleMessageLevel::kError, message),
       frame);
   policy_->ReportViolation(directive_text, effective_type, message, blocked_url,
@@ -225,8 +226,8 @@
   std::unique_ptr<SourceLocation> source_location =
       SourceLocation::Capture(context_url, context_line.OneBasedInt(), 0);
   policy_->LogToConsole(ConsoleMessage::Create(
-      kSecurityMessageSource, mojom::ConsoleMessageLevel::kError, message,
-      source_location->Clone()));
+      mojom::ConsoleMessageSource::kSecurity,
+      mojom::ConsoleMessageLevel::kError, message, source_location->Clone()));
   policy_->ReportViolation(directive_text, effective_type, message, blocked_url,
                            report_endpoints_, use_reporting_api_, header_,
                            header_type_,
@@ -251,8 +252,8 @@
   if (IsReportOnly() ||
       exception_status == ContentSecurityPolicy::kWillNotThrowException) {
     ConsoleMessage* console_message = ConsoleMessage::Create(
-        kSecurityMessageSource, mojom::ConsoleMessageLevel::kError,
-        report_message);
+        mojom::ConsoleMessageSource::kSecurity,
+        mojom::ConsoleMessageLevel::kError, report_message);
     policy_->LogToConsole(console_message);
   }
   policy_->ReportViolation(directive_text, effective_type, message, blocked_url,
diff --git a/third_party/blink/renderer/core/frame/deprecation.cc b/third_party/blink/renderer/core/frame/deprecation.cc
index de01fed3..6c849d0 100644
--- a/third_party/blink/renderer/core/frame/deprecation.cc
+++ b/third_party/blink/renderer/core/frame/deprecation.cc
@@ -679,7 +679,7 @@
   if (!message.IsEmpty()) {
     page->GetDeprecation().Suppress(unresolved_property);
     ConsoleMessage* console_message =
-        ConsoleMessage::Create(kDeprecationMessageSource,
+        ConsoleMessage::Create(mojom::ConsoleMessageSource::kDeprecation,
                                mojom::ConsoleMessageLevel::kWarning, message);
     frame->Console().AddMessage(console_message);
   }
@@ -747,8 +747,8 @@
   // Send the deprecation message to the console as a warning.
   DCHECK(!info.message.IsEmpty());
   ConsoleMessage* console_message = ConsoleMessage::Create(
-      kDeprecationMessageSource, mojom::ConsoleMessageLevel::kWarning,
-      info.message);
+      mojom::ConsoleMessageSource::kDeprecation,
+      mojom::ConsoleMessageLevel::kWarning, info.message);
   frame->Console().AddMessage(console_message);
 
   if (!frame || !frame->Client())
diff --git a/third_party/blink/renderer/core/frame/dom_window.cc b/third_party/blink/renderer/core/frame/dom_window.cc
index fccc801c..bd2a9a1 100644
--- a/third_party/blink/renderer/core/frame/dom_window.cc
+++ b/third_party/blink/renderer/core/frame/dom_window.cc
@@ -333,7 +333,8 @@
       !allow_scripts_to_close_windows) {
     active_document->domWindow()->GetFrameConsole()->AddMessage(
         ConsoleMessage::Create(
-            kJSMessageSource, mojom::ConsoleMessageLevel::kWarning,
+            mojom::ConsoleMessageSource::kJavaScript,
+            mojom::ConsoleMessageLevel::kWarning,
             "Scripts may close only the windows that were opened by it."));
     return;
   }
diff --git a/third_party/blink/renderer/core/frame/frame_console.cc b/third_party/blink/renderer/core/frame/frame_console.cc
index 6b76fe22..d94403f1 100644
--- a/third_party/blink/renderer/core/frame/frame_console.cc
+++ b/third_party/blink/renderer/core/frame/frame_console.cc
@@ -60,16 +60,16 @@
   return true;
 }
 
-void FrameConsole::ReportMessageToClient(MessageSource source,
+void FrameConsole::ReportMessageToClient(mojom::ConsoleMessageSource source,
                                          mojom::ConsoleMessageLevel level,
                                          const String& message,
                                          SourceLocation* location) {
-  if (source == kNetworkMessageSource)
+  if (source == mojom::ConsoleMessageSource::kNetwork)
     return;
 
   String url = location->Url();
   String stack_trace;
-  if (source == kConsoleAPIMessageSource) {
+  if (source == mojom::ConsoleMessageSource::kConsoleApi) {
     if (!frame_->GetPage())
       return;
     if (frame_->GetChromeClient().ShouldReportDetailedMessageForSource(*frame_,
@@ -105,8 +105,9 @@
       String::Number(response.HttpStatusCode()) + " (" +
       response.HttpStatusText() + ')';
   ConsoleMessage* console_message = ConsoleMessage::CreateForRequest(
-      kNetworkMessageSource, mojom::ConsoleMessageLevel::kError, message,
-      response.CurrentRequestUrl().GetString(), loader, request_identifier);
+      mojom::ConsoleMessageSource::kNetwork, mojom::ConsoleMessageLevel::kError,
+      message, response.CurrentRequestUrl().GetString(), loader,
+      request_identifier);
   AddMessage(console_message);
 }
 
@@ -122,7 +123,7 @@
     message.Append(error.LocalizedDescription());
   }
   AddMessageToStorage(ConsoleMessage::CreateForRequest(
-      kNetworkMessageSource, mojom::ConsoleMessageLevel::kError,
+      mojom::ConsoleMessageSource::kNetwork, mojom::ConsoleMessageLevel::kError,
       message.ToString(), error.FailingURL(), loader, request_identifier));
 }
 
diff --git a/third_party/blink/renderer/core/frame/frame_console.h b/third_party/blink/renderer/core/frame/frame_console.h
index 419f3018..e6615719 100644
--- a/third_party/blink/renderer/core/frame/frame_console.h
+++ b/third_party/blink/renderer/core/frame/frame_console.h
@@ -31,7 +31,6 @@
 
 #include "third_party/blink/public/mojom/devtools/console_message.mojom-shared.h"
 #include "third_party/blink/renderer/core/core_export.h"
-#include "third_party/blink/renderer/core/inspector/console_types.h"
 #include "third_party/blink/renderer/platform/heap/handle.h"
 #include "third_party/blink/renderer/platform/wtf/forward.h"
 #include "third_party/blink/renderer/platform/wtf/text/wtf_string.h"
@@ -61,7 +60,7 @@
   void AddMessage(ConsoleMessage*);
 
   bool AddMessageToStorage(ConsoleMessage*);
-  void ReportMessageToClient(MessageSource,
+  void ReportMessageToClient(mojom::ConsoleMessageSource,
                              mojom::ConsoleMessageLevel,
                              const String& message,
                              SourceLocation*);
diff --git a/third_party/blink/renderer/core/frame/intervention.cc b/third_party/blink/renderer/core/frame/intervention.cc
index 7946b61e..25e2f05 100644
--- a/third_party/blink/renderer/core/frame/intervention.cc
+++ b/third_party/blink/renderer/core/frame/intervention.cc
@@ -26,8 +26,9 @@
 
   // Send the message to the console.
   Document* document = frame->GetDocument();
-  document->AddConsoleMessage(ConsoleMessage::Create(
-      kInterventionMessageSource, mojom::ConsoleMessageLevel::kError, message));
+  document->AddConsoleMessage(
+      ConsoleMessage::Create(mojom::ConsoleMessageSource::kIntervention,
+                             mojom::ConsoleMessageLevel::kError, message));
 
   if (!frame->Client())
     return;
diff --git a/third_party/blink/renderer/core/frame/local_dom_window.cc b/third_party/blink/renderer/core/frame/local_dom_window.cc
index d1a4ba83..ba634142 100644
--- a/third_party/blink/renderer/core/frame/local_dom_window.cc
+++ b/third_party/blink/renderer/core/frame/local_dom_window.cc
@@ -588,8 +588,8 @@
               "') does not match the recipient window's origin ('" +
               document()->GetSecurityOrigin()->ToString() + "').");
       ConsoleMessage* console_message = ConsoleMessage::Create(
-          kSecurityMessageSource, mojom::ConsoleMessageLevel::kError, message,
-          std::move(location));
+          mojom::ConsoleMessageSource::kSecurity,
+          mojom::ConsoleMessageLevel::kError, message, std::move(location));
       GetFrameConsole()->AddMessage(console_message);
       return;
     }
@@ -660,7 +660,8 @@
   if (document()->IsSandboxed(kSandboxModals)) {
     UseCounter::Count(document(), WebFeature::kDialogInSandboxedContext);
     GetFrameConsole()->AddMessage(ConsoleMessage::Create(
-        kSecurityMessageSource, mojom::ConsoleMessageLevel::kError,
+        mojom::ConsoleMessageSource::kSecurity,
+        mojom::ConsoleMessageLevel::kError,
         "Ignored call to 'alert()'. The document is sandboxed, and the "
         "'allow-modals' keyword is not set."));
     return;
@@ -689,7 +690,8 @@
   if (document()->IsSandboxed(kSandboxModals)) {
     UseCounter::Count(document(), WebFeature::kDialogInSandboxedContext);
     GetFrameConsole()->AddMessage(ConsoleMessage::Create(
-        kSecurityMessageSource, mojom::ConsoleMessageLevel::kError,
+        mojom::ConsoleMessageSource::kSecurity,
+        mojom::ConsoleMessageLevel::kError,
         "Ignored call to 'confirm()'. The document is sandboxed, and the "
         "'allow-modals' keyword is not set."));
     return false;
@@ -720,7 +722,8 @@
   if (document()->IsSandboxed(kSandboxModals)) {
     UseCounter::Count(document(), WebFeature::kDialogInSandboxedContext);
     GetFrameConsole()->AddMessage(ConsoleMessage::Create(
-        kSecurityMessageSource, mojom::ConsoleMessageLevel::kError,
+        mojom::ConsoleMessageSource::kSecurity,
+        mojom::ConsoleMessageLevel::kError,
         "Ignored call to 'prompt()'. The document is sandboxed, and the "
         "'allow-modals' keyword is not set."));
     return String();
@@ -1312,8 +1315,9 @@
         "preload but not used within a few seconds from the window's load " +
         "event. Please make sure it has an appropriate `as` value and it is " +
         "preloaded intentionally.";
-    GetFrameConsole()->AddMessage(ConsoleMessage::Create(
-        kJSMessageSource, mojom::ConsoleMessageLevel::kWarning, message));
+    GetFrameConsole()->AddMessage(
+        ConsoleMessage::Create(mojom::ConsoleMessageSource::kJavaScript,
+                               mojom::ConsoleMessageLevel::kWarning, message));
   }
 }
 
@@ -1401,8 +1405,9 @@
   if (message.IsEmpty())
     return;
 
-  GetFrameConsole()->AddMessage(ConsoleMessage::Create(
-      kJSMessageSource, mojom::ConsoleMessageLevel::kError, message));
+  GetFrameConsole()->AddMessage(
+      ConsoleMessage::Create(mojom::ConsoleMessageSource::kJavaScript,
+                             mojom::ConsoleMessageLevel::kError, message));
 }
 
 DOMWindow* LocalDOMWindow::open(v8::Isolate* isolate,
diff --git a/third_party/blink/renderer/core/frame/local_frame.cc b/third_party/blink/renderer/core/frame/local_frame.cc
index 6ffb72d8..c5a082d 100644
--- a/third_party/blink/renderer/core/frame/local_frame.cc
+++ b/third_party/blink/renderer/core/frame/local_frame.cc
@@ -480,8 +480,9 @@
 }
 
 void LocalFrame::PrintNavigationWarning(const String& message) {
-  console_->AddMessage(ConsoleMessage::Create(
-      kJSMessageSource, mojom::ConsoleMessageLevel::kWarning, message));
+  console_->AddMessage(
+      ConsoleMessage::Create(mojom::ConsoleMessageSource::kJavaScript,
+                             mojom::ConsoleMessageLevel::kWarning, message));
 }
 
 bool LocalFrame::ShouldClose() {
diff --git a/third_party/blink/renderer/core/frame/local_frame_client.h b/third_party/blink/renderer/core/frame/local_frame_client.h
index b77493e..f73641c 100644
--- a/third_party/blink/renderer/core/frame/local_frame_client.h
+++ b/third_party/blink/renderer/core/frame/local_frame_client.h
@@ -144,7 +144,6 @@
   virtual void DidFinishSameDocumentNavigation(HistoryItem*,
                                                WebHistoryCommitType,
                                                bool content_initiated) {}
-  virtual void DispatchWillCommitProvisionalLoad() = 0;
   virtual void DispatchDidStartProvisionalLoad(DocumentLoader*) = 0;
   virtual void DispatchDidReceiveTitle(const String&) = 0;
   virtual void DispatchDidChangeIcons(IconType) = 0;
diff --git a/third_party/blink/renderer/core/frame/navigation_rate_limiter.cc b/third_party/blink/renderer/core/frame/navigation_rate_limiter.cc
index 84b2de1..df956906 100644
--- a/third_party/blink/renderer/core/frame/navigation_rate_limiter.cc
+++ b/third_party/blink/renderer/core/frame/navigation_rate_limiter.cc
@@ -49,7 +49,8 @@
     error_message_sent_ = true;
     if (auto* local_frame = DynamicTo<LocalFrame>(frame_.Get())) {
       local_frame->Console().AddMessage(ConsoleMessage::Create(
-          kJSMessageSource, mojom::ConsoleMessageLevel::kWarning,
+          mojom::ConsoleMessageSource::kJavaScript,
+          mojom::ConsoleMessageLevel::kWarning,
           "Throttling navigation to prevent the browser from hanging. See "
           "https://crbug.com/882238. Command line switch "
           "--disable-ipc-flooding-protection can be used to bypass the "
diff --git a/third_party/blink/renderer/core/frame/remote_frame.cc b/third_party/blink/renderer/core/frame/remote_frame.cc
index 60d03a8..6e42e48 100644
--- a/third_party/blink/renderer/core/frame/remote_frame.cc
+++ b/third_party/blink/renderer/core/frame/remote_frame.cc
@@ -66,7 +66,8 @@
                                      UserGestureStatus user_gesture_status) {
   if (!origin_document.GetSecurityOrigin()->CanDisplay(url)) {
     origin_document.AddConsoleMessage(ConsoleMessage::Create(
-        kSecurityMessageSource, mojom::ConsoleMessageLevel::kError,
+        mojom::ConsoleMessageSource::kSecurity,
+        mojom::ConsoleMessageLevel::kError,
         "Not allowed to load local resource: " + url.ElidedString()));
     return;
   }
diff --git a/third_party/blink/renderer/core/frame/scheduling.cc b/third_party/blink/renderer/core/frame/scheduling.cc
index bd915e17..f915dbdd 100644
--- a/third_party/blink/renderer/core/frame/scheduling.cc
+++ b/third_party/blink/renderer/core/frame/scheduling.cc
@@ -26,7 +26,8 @@
     // a process are part of the same site to avoid leaking cross-site inputs.
     ExecutionContext::From(script_state)
         ->AddConsoleMessage(ConsoleMessage::Create(
-            kJSMessageSource, mojom::ConsoleMessageLevel::kWarning,
+            mojom::ConsoleMessageSource::kJavaScript,
+            mojom::ConsoleMessageLevel::kWarning,
             "isInputPending requires site-per-process (crbug.com/910421)."));
     return false;
   }
@@ -50,8 +51,8 @@
       message.Append("\". Skipping.");
       ExecutionContext::From(script_state)
           ->AddConsoleMessage(ConsoleMessage::Create(
-              kJSMessageSource, mojom::ConsoleMessageLevel::kWarning,
-              message.ToString()));
+              mojom::ConsoleMessageSource::kJavaScript,
+              mojom::ConsoleMessageLevel::kWarning, message.ToString()));
     }
 
     if (!has_pending_input)
diff --git a/third_party/blink/renderer/core/fullscreen/fullscreen.cc b/third_party/blink/renderer/core/fullscreen/fullscreen.cc
index 2529cfbb..b63fa37 100644
--- a/third_party/blink/renderer/core/fullscreen/fullscreen.cc
+++ b/third_party/blink/renderer/core/fullscreen/fullscreen.cc
@@ -239,8 +239,9 @@
   String message = ExceptionMessages::FailedToExecute(
       "requestFullscreen", "Element",
       "API can only be initiated by a user gesture.");
-  document.AddConsoleMessage(ConsoleMessage::Create(
-      kJSMessageSource, mojom::ConsoleMessageLevel::kWarning, message));
+  document.AddConsoleMessage(
+      ConsoleMessage::Create(mojom::ConsoleMessageSource::kJavaScript,
+                             mojom::ConsoleMessageLevel::kWarning, message));
 
   return false;
 }
diff --git a/third_party/blink/renderer/core/html/canvas/html_canvas_element.cc b/third_party/blink/renderer/core/html/canvas/html_canvas_element.cc
index 8c20234..5ed3a9a2 100644
--- a/third_party/blink/renderer/core/html/canvas/html_canvas_element.cc
+++ b/third_party/blink/renderer/core/html/canvas/html_canvas_element.cc
@@ -185,12 +185,12 @@
   HTMLElement::ParseAttribute(params);
 }
 
-LayoutObject* HTMLCanvasElement::CreateLayoutObject(
-    const ComputedStyle& style) {
+LayoutObject* HTMLCanvasElement::CreateLayoutObject(const ComputedStyle& style,
+                                                    LegacyLayout legacy) {
   LocalFrame* frame = GetDocument().GetFrame();
   if (frame && GetDocument().CanExecuteScripts(kNotAboutToExecuteScript))
     return new LayoutHTMLCanvas(this);
-  return HTMLElement::CreateLayoutObject(style);
+  return HTMLElement::CreateLayoutObject(style, legacy);
 }
 
 Node::InsertionNotificationRequest HTMLCanvasElement::InsertedInto(
diff --git a/third_party/blink/renderer/core/html/canvas/html_canvas_element.h b/third_party/blink/renderer/core/html/canvas/html_canvas_element.h
index 80c8a81..e976ae2 100644
--- a/third_party/blink/renderer/core/html/canvas/html_canvas_element.h
+++ b/third_party/blink/renderer/core/html/canvas/html_canvas_element.h
@@ -334,7 +334,7 @@
   bool ShouldAccelerate(AccelerationCriteria) const;
 
   void ParseAttribute(const AttributeModificationParams&) override;
-  LayoutObject* CreateLayoutObject(const ComputedStyle&) override;
+  LayoutObject* CreateLayoutObject(const ComputedStyle&, LegacyLayout) override;
   bool AreAuthorShadowsAllowed() const override { return false; }
 
   void Reset();
diff --git a/third_party/blink/renderer/core/html/forms/base_button_input_type.cc b/third_party/blink/renderer/core/html/forms/base_button_input_type.cc
index 63476d1..b206e0d 100644
--- a/third_party/blink/renderer/core/html/forms/base_button_input_type.cc
+++ b/third_party/blink/renderer/core/html/forms/base_button_input_type.cc
@@ -76,8 +76,8 @@
 
 void BaseButtonInputType::AppendToFormData(FormData&) const {}
 
-LayoutObject* BaseButtonInputType::CreateLayoutObject(
-    const ComputedStyle&) const {
+LayoutObject* BaseButtonInputType::CreateLayoutObject(const ComputedStyle&,
+                                                      LegacyLayout) const {
   return new LayoutButton(&GetElement());
 }
 
diff --git a/third_party/blink/renderer/core/html/forms/base_button_input_type.h b/third_party/blink/renderer/core/html/forms/base_button_input_type.h
index 5762feb7a..e0310279 100644
--- a/third_party/blink/renderer/core/html/forms/base_button_input_type.h
+++ b/third_party/blink/renderer/core/html/forms/base_button_input_type.h
@@ -54,7 +54,8 @@
   InputTypeView* CreateView() override;
   bool ShouldSaveAndRestoreFormControlState() const override;
   void AppendToFormData(FormData&) const override;
-  LayoutObject* CreateLayoutObject(const ComputedStyle&) const override;
+  LayoutObject* CreateLayoutObject(const ComputedStyle&,
+                                   LegacyLayout) const override;
   ValueMode GetValueMode() const override;
   void SetValue(const String&,
                 bool,
diff --git a/third_party/blink/renderer/core/html/forms/base_text_input_type.cc b/third_party/blink/renderer/core/html/forms/base_text_input_type.cc
index fcde627..d8fef7f 100644
--- a/third_party/blink/renderer/core/html/forms/base_text_input_type.cc
+++ b/third_party/blink/renderer/core/html/forms/base_text_input_type.cc
@@ -88,11 +88,12 @@
         new ScriptRegexp(raw_pattern, kTextCaseSensitive, kMultilineDisabled,
                          ScriptRegexp::UTF16));
     if (!raw_regexp->IsValid()) {
-      GetElement().GetDocument().AddConsoleMessage(ConsoleMessage::Create(
-          kRenderingMessageSource, mojom::ConsoleMessageLevel::kError,
-          "Pattern attribute value " + raw_pattern +
-              " is not a valid regular expression: " +
-              raw_regexp->ExceptionMessage()));
+      GetElement().GetDocument().AddConsoleMessage(
+          ConsoleMessage::Create(mojom::ConsoleMessageSource::kRendering,
+                                 mojom::ConsoleMessageLevel::kError,
+                                 "Pattern attribute value " + raw_pattern +
+                                     " is not a valid regular expression: " +
+                                     raw_regexp->ExceptionMessage()));
       regexp_.reset(raw_regexp.release());
       pattern_for_regexp_ = raw_pattern;
       return false;
diff --git a/third_party/blink/renderer/core/html/forms/file_input_type.cc b/third_party/blink/renderer/core/html/forms/file_input_type.cc
index 47054c0..9e2cc4f 100644
--- a/third_party/blink/renderer/core/html/forms/file_input_type.cc
+++ b/third_party/blink/renderer/core/html/forms/file_input_type.cc
@@ -164,8 +164,9 @@
   if (!LocalFrame::HasTransientUserActivation(document.GetFrame())) {
     String message =
         "File chooser dialog can only be shown with a user activation.";
-    document.AddConsoleMessage(ConsoleMessage::Create(
-        kJSMessageSource, mojom::ConsoleMessageLevel::kWarning, message));
+    document.AddConsoleMessage(
+        ConsoleMessage::Create(mojom::ConsoleMessageSource::kJavaScript,
+                               mojom::ConsoleMessageLevel::kWarning, message));
     return;
   }
 
@@ -196,7 +197,8 @@
   event.SetDefaultHandled();
 }
 
-LayoutObject* FileInputType::CreateLayoutObject(const ComputedStyle&) const {
+LayoutObject* FileInputType::CreateLayoutObject(const ComputedStyle&,
+                                                LegacyLayout) const {
   return new LayoutFileUploadControl(&GetElement());
 }
 
diff --git a/third_party/blink/renderer/core/html/forms/file_input_type.h b/third_party/blink/renderer/core/html/forms/file_input_type.h
index 51568f3f..4af28a5 100644
--- a/third_party/blink/renderer/core/html/forms/file_input_type.h
+++ b/third_party/blink/renderer/core/html/forms/file_input_type.h
@@ -74,7 +74,8 @@
   bool ValueMissing(const String&) const override;
   String ValueMissingText() const override;
   void HandleDOMActivateEvent(Event&) override;
-  LayoutObject* CreateLayoutObject(const ComputedStyle&) const override;
+  LayoutObject* CreateLayoutObject(const ComputedStyle&,
+                                   LegacyLayout) const override;
   bool CanSetStringValue() const override;
   FileList* Files() override;
   bool SetFiles(FileList*) override;
diff --git a/third_party/blink/renderer/core/html/forms/hidden_input_type.cc b/third_party/blink/renderer/core/html/forms/hidden_input_type.cc
index 16df667..2f34fa1d 100644
--- a/third_party/blink/renderer/core/html/forms/hidden_input_type.cc
+++ b/third_party/blink/renderer/core/html/forms/hidden_input_type.cc
@@ -66,7 +66,8 @@
   return false;
 }
 
-LayoutObject* HiddenInputType::CreateLayoutObject(const ComputedStyle&) const {
+LayoutObject* HiddenInputType::CreateLayoutObject(const ComputedStyle&,
+                                                  LegacyLayout) const {
   NOTREACHED();
   return nullptr;
 }
diff --git a/third_party/blink/renderer/core/html/forms/hidden_input_type.h b/third_party/blink/renderer/core/html/forms/hidden_input_type.h
index dfaa025..6c846f1 100644
--- a/third_party/blink/renderer/core/html/forms/hidden_input_type.h
+++ b/third_party/blink/renderer/core/html/forms/hidden_input_type.h
@@ -53,7 +53,8 @@
   const AtomicString& FormControlType() const override;
   bool ShouldSaveAndRestoreFormControlState() const override;
   bool SupportsValidation() const override;
-  LayoutObject* CreateLayoutObject(const ComputedStyle&) const override;
+  LayoutObject* CreateLayoutObject(const ComputedStyle&,
+                                   LegacyLayout) const override;
   void AccessKeyAction(bool send_mouse_events) override;
   bool LayoutObjectIsNeeded() override;
   ValueMode GetValueMode() const override;
diff --git a/third_party/blink/renderer/core/html/forms/html_button_element.cc b/third_party/blink/renderer/core/html/forms/html_button_element.cc
index 97a2520..f779e24 100644
--- a/third_party/blink/renderer/core/html/forms/html_button_element.cc
+++ b/third_party/blink/renderer/core/html/forms/html_button_element.cc
@@ -57,7 +57,8 @@
   setAttribute(kTypeAttr, type);
 }
 
-LayoutObject* HTMLButtonElement::CreateLayoutObject(const ComputedStyle&) {
+LayoutObject* HTMLButtonElement::CreateLayoutObject(const ComputedStyle&,
+                                                    LegacyLayout) {
   return new LayoutButton(this);
 }
 
diff --git a/third_party/blink/renderer/core/html/forms/html_button_element.h b/third_party/blink/renderer/core/html/forms/html_button_element.h
index ba1b2492..e4c99dc3 100644
--- a/third_party/blink/renderer/core/html/forms/html_button_element.h
+++ b/third_party/blink/renderer/core/html/forms/html_button_element.h
@@ -49,7 +49,7 @@
 
   const AtomicString& FormControlType() const override;
 
-  LayoutObject* CreateLayoutObject(const ComputedStyle&) override;
+  LayoutObject* CreateLayoutObject(const ComputedStyle&, LegacyLayout) override;
 
   // HTMLFormControlElement always creates one, but buttons don't need it.
   bool AlwaysCreateUserAgentShadowRoot() const override { return false; }
@@ -64,7 +64,7 @@
 
   bool IsEnumeratable() const override { return true; }
   bool IsLabelable() const override { return true; }
-  bool ShouldForceLegacyLayout() const final { return true; }
+  bool TypeShouldForceLegacyLayout() const final { return true; }
   bool IsInteractiveContent() const override;
   bool SupportsAutofocus() const override;
   bool MatchesDefaultPseudoClass() const override;
diff --git a/third_party/blink/renderer/core/html/forms/html_field_set_element.cc b/third_party/blink/renderer/core/html/forms/html_field_set_element.cc
index e8225573..aef54f6 100644
--- a/third_party/blink/renderer/core/html/forms/html_field_set_element.cc
+++ b/third_party/blink/renderer/core/html/forms/html_field_set_element.cc
@@ -126,11 +126,12 @@
 }
 
 LayoutObject* HTMLFieldSetElement::CreateLayoutObject(
-    const ComputedStyle& style) {
-  return LayoutObjectFactory::CreateFieldset(*this, style);
+    const ComputedStyle& style,
+    LegacyLayout legacy) {
+  return LayoutObjectFactory::CreateFieldset(*this, style, legacy);
 }
 
-bool HTMLFieldSetElement::ShouldForceLegacyLayout() const {
+bool HTMLFieldSetElement::TypeShouldForceLegacyLayout() const {
   return !RuntimeEnabledFeatures::LayoutNGFieldsetEnabled();
 }
 
diff --git a/third_party/blink/renderer/core/html/forms/html_field_set_element.h b/third_party/blink/renderer/core/html/forms/html_field_set_element.h
index 60ff21f..e77374d1 100644
--- a/third_party/blink/renderer/core/html/forms/html_field_set_element.h
+++ b/third_party/blink/renderer/core/html/forms/html_field_set_element.h
@@ -48,8 +48,8 @@
  private:
   bool IsEnumeratable() const override { return true; }
   bool SupportsFocus() const override;
-  LayoutObject* CreateLayoutObject(const ComputedStyle&) override;
-  bool ShouldForceLegacyLayout() const final;
+  LayoutObject* CreateLayoutObject(const ComputedStyle&, LegacyLayout) override;
+  bool TypeShouldForceLegacyLayout() const final;
   const AtomicString& FormControlType() const override;
   bool RecalcWillValidate() const override { return false; }
   int tabIndex() const final;
diff --git a/third_party/blink/renderer/core/html/forms/html_form_control_element.cc b/third_party/blink/renderer/core/html/forms/html_form_control_element.cc
index 90b16f9..217c7dc 100644
--- a/third_party/blink/renderer/core/html/forms/html_form_control_element.cc
+++ b/third_party/blink/renderer/core/html/forms/html_form_control_element.cc
@@ -220,7 +220,8 @@
     // FIXME: This message should be moved off the console once a solution to
     // https://bugs.webkit.org/show_bug.cgi?id=103274 exists.
     element->GetDocument().AddConsoleMessage(ConsoleMessage::Create(
-        kSecurityMessageSource, mojom::ConsoleMessageLevel::kError,
+        mojom::ConsoleMessageSource::kSecurity,
+        mojom::ConsoleMessageLevel::kError,
         "Blocked autofocusing on a form control because the form's frame is "
         "sandboxed and the 'allow-scripts' permission is not set."));
     return false;
diff --git a/third_party/blink/renderer/core/html/forms/html_form_control_element_with_state.h b/third_party/blink/renderer/core/html/forms/html_form_control_element_with_state.h
index ccaaa70f..9686385a 100644
--- a/third_party/blink/renderer/core/html/forms/html_form_control_element_with_state.h
+++ b/third_party/blink/renderer/core/html/forms/html_form_control_element_with_state.h
@@ -58,7 +58,7 @@
   bool IsFormControlElementWithState() const final;
 
  private:
-  bool ShouldForceLegacyLayout() const final { return true; }
+  bool TypeShouldForceLegacyLayout() const final { return true; }
 
   // https://html.spec.whatwg.org/C/#autofill-anchor-mantle
   bool IsWearingAutofillAnchorMantle() const;
diff --git a/third_party/blink/renderer/core/html/forms/html_form_element.cc b/third_party/blink/renderer/core/html/forms/html_form_element.cc
index 1d0d6ea..0c29564 100644
--- a/third_party/blink/renderer/core/html/forms/html_form_element.cc
+++ b/third_party/blink/renderer/core/html/forms/html_form_element.cc
@@ -252,7 +252,7 @@
           "An invalid form control with name='%name' is not focusable.");
       message.Replace("%name", unhandled->GetName());
       GetDocument().AddConsoleMessage(
-          ConsoleMessage::Create(kRenderingMessageSource,
+          ConsoleMessage::Create(mojom::ConsoleMessageSource::kRendering,
                                  mojom::ConsoleMessageLevel::kError, message));
     }
   }
@@ -268,14 +268,16 @@
 
   if (!isConnected()) {
     GetDocument().AddConsoleMessage(ConsoleMessage::Create(
-        kJSMessageSource, mojom::ConsoleMessageLevel::kWarning,
+        mojom::ConsoleMessageSource::kJavaScript,
+        mojom::ConsoleMessageLevel::kWarning,
         "Form submission canceled because the form is not connected"));
     return;
   }
 
   if (GetDocument().IsSandboxed(kSandboxForms)) {
     GetDocument().AddConsoleMessage(ConsoleMessage::Create(
-        kSecurityMessageSource, mojom::ConsoleMessageLevel::kError,
+        mojom::ConsoleMessageSource::kSecurity,
+        mojom::ConsoleMessageLevel::kError,
         "Blocked form submission to '" + attributes_.Action() +
             "' because the form's frame is sandboxed and the 'allow-forms' "
             "permission is not set."));
@@ -291,7 +293,8 @@
       if (RuntimeEnabledFeatures::UnclosedFormControlIsInvalidEnabled()) {
         String tag_name = ToHTMLFormControlElement(element)->tagName();
         GetDocument().AddConsoleMessage(ConsoleMessage::Create(
-            kSecurityMessageSource, mojom::ConsoleMessageLevel::kError,
+            mojom::ConsoleMessageSource::kSecurity,
+            mojom::ConsoleMessageLevel::kError,
             "Form submission failed, as the <" + tag_name +
                 "> element named "
                 "'" +
@@ -361,17 +364,19 @@
   // context flag set, then abort these steps without doing anything.
   if (!isConnected()) {
     GetDocument().AddConsoleMessage(ConsoleMessage::Create(
-        kJSMessageSource, mojom::ConsoleMessageLevel::kWarning,
+        mojom::ConsoleMessageSource::kJavaScript,
+        mojom::ConsoleMessageLevel::kWarning,
         "Form submission canceled because the form is not connected"));
     return;
   }
 
   if (is_constructing_entry_list_) {
     DCHECK(RuntimeEnabledFeatures::FormDataEventEnabled());
-    GetDocument().AddConsoleMessage(ConsoleMessage::Create(
-        kJSMessageSource, mojom::ConsoleMessageLevel::kWarning,
-        "Form submission canceled because the form is "
-        "constructing entry list"));
+    GetDocument().AddConsoleMessage(
+        ConsoleMessage::Create(mojom::ConsoleMessageSource::kJavaScript,
+                               mojom::ConsoleMessageLevel::kWarning,
+                               "Form submission canceled because the form is "
+                               "constructing entry list"));
     return;
   }
 
@@ -405,7 +410,8 @@
   // 'formdata' event handlers might disconnect the form.
   if (RuntimeEnabledFeatures::FormDataEventEnabled() && !isConnected()) {
     GetDocument().AddConsoleMessage(ConsoleMessage::Create(
-        kJSMessageSource, mojom::ConsoleMessageLevel::kWarning,
+        mojom::ConsoleMessageSource::kJavaScript,
+        mojom::ConsoleMessageLevel::kWarning,
         "Form submission canceled because the form is not connected"));
     return;
   }
@@ -462,7 +468,8 @@
     // FIXME: This message should be moved off the console once a solution to
     // https://bugs.webkit.org/show_bug.cgi?id=103274 exists.
     GetDocument().AddConsoleMessage(ConsoleMessage::Create(
-        kSecurityMessageSource, mojom::ConsoleMessageLevel::kError,
+        mojom::ConsoleMessageSource::kSecurity,
+        mojom::ConsoleMessageLevel::kError,
         "Blocked form submission to '" + submission->Action().ElidedString() +
             "' because the form's frame is sandboxed and the 'allow-forms' "
             "permission is not set."));
diff --git a/third_party/blink/renderer/core/html/forms/html_input_element.cc b/third_party/blink/renderer/core/html/forms/html_input_element.cc
index a235146..e01aa5de 100644
--- a/third_party/blink/renderer/core/html/forms/html_input_element.cc
+++ b/third_party/blink/renderer/core/html/forms/html_input_element.cc
@@ -877,8 +877,9 @@
          TextControlElement::LayoutObjectIsNeeded(style);
 }
 
-LayoutObject* HTMLInputElement::CreateLayoutObject(const ComputedStyle& style) {
-  return input_type_view_->CreateLayoutObject(style);
+LayoutObject* HTMLInputElement::CreateLayoutObject(const ComputedStyle& style,
+                                                   LegacyLayout legacy) {
+  return input_type_view_->CreateLayoutObject(style, legacy);
 }
 
 void HTMLInputElement::AttachLayoutTree(AttachContext& context) {
diff --git a/third_party/blink/renderer/core/html/forms/html_input_element.h b/third_party/blink/renderer/core/html/forms/html_input_element.h
index c0e9b82e..22fa385 100644
--- a/third_party/blink/renderer/core/html/forms/html_input_element.h
+++ b/third_party/blink/renderer/core/html/forms/html_input_element.h
@@ -194,7 +194,7 @@
                                    ExceptionState&);
 
   bool LayoutObjectIsNeeded(const ComputedStyle&) const final;
-  LayoutObject* CreateLayoutObject(const ComputedStyle&) override;
+  LayoutObject* CreateLayoutObject(const ComputedStyle&, LegacyLayout) override;
   void DetachLayoutTree(const AttachContext& = AttachContext()) final;
   void UpdateFocusAppearanceWithOptions(SelectionBehaviorOnFocus,
                                         const FocusOptions*) final;
diff --git a/third_party/blink/renderer/core/html/forms/html_select_element.cc b/third_party/blink/renderer/core/html/forms/html_select_element.cc
index 244e066..cab2e89 100644
--- a/third_party/blink/renderer/core/html/forms/html_select_element.cc
+++ b/third_party/blink/renderer/core/html/forms/html_select_element.cc
@@ -331,7 +331,8 @@
   return !UsesMenuList();
 }
 
-LayoutObject* HTMLSelectElement::CreateLayoutObject(const ComputedStyle&) {
+LayoutObject* HTMLSelectElement::CreateLayoutObject(const ComputedStyle&,
+                                                    LegacyLayout) {
   if (UsesMenuList())
     return new LayoutMenuList(this);
   return new LayoutListBox(this);
@@ -380,7 +381,8 @@
   if (index >= kMaxListItems ||
       GetListItems().size() + diff + 1 > kMaxListItems) {
     GetDocument().AddConsoleMessage(ConsoleMessage::Create(
-        kJSMessageSource, mojom::ConsoleMessageLevel::kWarning,
+        mojom::ConsoleMessageSource::kJavaScript,
+        mojom::ConsoleMessageLevel::kWarning,
         String::Format("Blocked to expand the option list and set an option at "
                        "index=%u.  The maximum list length is %u.",
                        index, kMaxListItems)));
@@ -412,7 +414,8 @@
   if (new_len > kMaxListItems ||
       GetListItems().size() + new_len - length() > kMaxListItems) {
     GetDocument().AddConsoleMessage(ConsoleMessage::Create(
-        kJSMessageSource, mojom::ConsoleMessageLevel::kWarning,
+        mojom::ConsoleMessageSource::kJavaScript,
+        mojom::ConsoleMessageLevel::kWarning,
         String::Format("Blocked to expand the option list to %u items.  The "
                        "maximum list length is %u.",
                        new_len, kMaxListItems)));
diff --git a/third_party/blink/renderer/core/html/forms/html_select_element.h b/third_party/blink/renderer/core/html/forms/html_select_element.h
index 90573d0..28938fe 100644
--- a/third_party/blink/renderer/core/html/forms/html_select_element.h
+++ b/third_party/blink/renderer/core/html/forms/html_select_element.h
@@ -204,7 +204,7 @@
   void ParseAttribute(const AttributeModificationParams&) override;
   bool IsPresentationAttribute(const QualifiedName&) const override;
 
-  LayoutObject* CreateLayoutObject(const ComputedStyle&) override;
+  LayoutObject* CreateLayoutObject(const ComputedStyle&, LegacyLayout) override;
   void DidRecalcStyle(const StyleRecalcChange) override;
   void DetachLayoutTree(const AttachContext& = AttachContext()) override;
   void AppendToFormData(FormData&) override;
diff --git a/third_party/blink/renderer/core/html/forms/html_text_area_element.cc b/third_party/blink/renderer/core/html/forms/html_text_area_element.cc
index a198a64f..203fe20 100644
--- a/third_party/blink/renderer/core/html/forms/html_text_area_element.cc
+++ b/third_party/blink/renderer/core/html/forms/html_text_area_element.cc
@@ -210,7 +210,8 @@
   }
 }
 
-LayoutObject* HTMLTextAreaElement::CreateLayoutObject(const ComputedStyle&) {
+LayoutObject* HTMLTextAreaElement::CreateLayoutObject(const ComputedStyle&,
+                                                      LegacyLayout) {
   return new LayoutTextControlMultiLine(this);
 }
 
diff --git a/third_party/blink/renderer/core/html/forms/html_text_area_element.h b/third_party/blink/renderer/core/html/forms/html_text_area_element.h
index ac577e8..0fcf7d0 100644
--- a/third_party/blink/renderer/core/html/forms/html_text_area_element.h
+++ b/third_party/blink/renderer/core/html/forms/html_text_area_element.h
@@ -120,7 +120,7 @@
       const QualifiedName&,
       const AtomicString&,
       MutableCSSPropertyValueSet*) override;
-  LayoutObject* CreateLayoutObject(const ComputedStyle&) override;
+  LayoutObject* CreateLayoutObject(const ComputedStyle&, LegacyLayout) override;
   void AppendToFormData(FormData&) override;
   void ResetImpl() override;
   bool HasCustomFocusLogic() const override;
diff --git a/third_party/blink/renderer/core/html/forms/image_input_type.cc b/third_party/blink/renderer/core/html/forms/image_input_type.cc
index cbdad34e..2db0bf0 100644
--- a/third_party/blink/renderer/core/html/forms/image_input_type.cc
+++ b/third_party/blink/renderer/core/html/forms/image_input_type.cc
@@ -104,10 +104,10 @@
   event.SetDefaultHandled();
 }
 
-LayoutObject* ImageInputType::CreateLayoutObject(
-    const ComputedStyle& style) const {
+LayoutObject* ImageInputType::CreateLayoutObject(const ComputedStyle& style,
+                                                 LegacyLayout legacy) const {
   if (use_fallback_content_)
-    return LayoutObjectFactory::CreateBlockFlow(GetElement(), style);
+    return LayoutObjectFactory::CreateBlockFlow(GetElement(), style, legacy);
   LayoutImage* image = new LayoutImage(&GetElement());
   image->SetImageResource(LayoutImageResource::Create());
   return image;
diff --git a/third_party/blink/renderer/core/html/forms/image_input_type.h b/third_party/blink/renderer/core/html/forms/image_input_type.h
index 0fc4ea613..1f82f16 100644
--- a/third_party/blink/renderer/core/html/forms/image_input_type.h
+++ b/third_party/blink/renderer/core/html/forms/image_input_type.h
@@ -51,7 +51,8 @@
   void AppendToFormData(FormData&) const override;
   String ResultForDialogSubmit() const override;
   bool SupportsValidation() const override;
-  LayoutObject* CreateLayoutObject(const ComputedStyle&) const override;
+  LayoutObject* CreateLayoutObject(const ComputedStyle&,
+                                   LegacyLayout) const override;
   void HandleDOMActivateEvent(Event&) override;
   void AltAttributeChanged() override;
   void SrcAttributeChanged() override;
diff --git a/third_party/blink/renderer/core/html/forms/input_type.cc b/third_party/blink/renderer/core/html/forms/input_type.cc
index 33c440ab..9b06bd484 100644
--- a/third_party/blink/renderer/core/html/forms/input_type.cc
+++ b/third_party/blink/renderer/core/html/forms/input_type.cc
@@ -909,7 +909,8 @@
 void InputType::AddWarningToConsole(const char* message_format,
                                     const String& value) const {
   GetElement().GetDocument().AddConsoleMessage(ConsoleMessage::Create(
-      kRenderingMessageSource, mojom::ConsoleMessageLevel::kWarning,
+      mojom::ConsoleMessageSource::kRendering,
+      mojom::ConsoleMessageLevel::kWarning,
       String::Format(message_format,
                      JSONValue::QuoteString(value).Utf8().data())));
 }
diff --git a/third_party/blink/renderer/core/html/forms/input_type_view.cc b/third_party/blink/renderer/core/html/forms/input_type_view.cc
index 44911d94..4cb696c2 100644
--- a/third_party/blink/renderer/core/html/forms/input_type_view.cc
+++ b/third_party/blink/renderer/core/html/forms/input_type_view.cc
@@ -87,9 +87,9 @@
   return GetElement().Form();
 }
 
-LayoutObject* InputTypeView::CreateLayoutObject(
-    const ComputedStyle& style) const {
-  return LayoutObject::CreateObject(&GetElement(), style);
+LayoutObject* InputTypeView::CreateLayoutObject(const ComputedStyle& style,
+                                                LegacyLayout legacy) const {
+  return LayoutObject::CreateObject(&GetElement(), style, legacy);
 }
 
 scoped_refptr<ComputedStyle> InputTypeView::CustomStyleForLayoutObject(
diff --git a/third_party/blink/renderer/core/html/forms/input_type_view.h b/third_party/blink/renderer/core/html/forms/input_type_view.h
index 9e2d8787..0c13fd7a 100644
--- a/third_party/blink/renderer/core/html/forms/input_type_view.h
+++ b/third_party/blink/renderer/core/html/forms/input_type_view.h
@@ -46,15 +46,16 @@
 
 class AXObject;
 class BeforeTextInsertedEvent;
+class ComputedStyle;
 class Element;
 class Event;
 class FormControlState;
 class HTMLFormElement;
 class HTMLInputElement;
 class KeyboardEvent;
-class MouseEvent;
 class LayoutObject;
-class ComputedStyle;
+enum class LegacyLayout;
+class MouseEvent;
 
 class ClickHandlingState final : public EventDispatchHandlingState {
  public:
@@ -98,7 +99,8 @@
   void DispatchSimulatedClickIfActive(KeyboardEvent&) const;
 
   virtual void SubtreeHasChanged();
-  virtual LayoutObject* CreateLayoutObject(const ComputedStyle&) const;
+  virtual LayoutObject* CreateLayoutObject(const ComputedStyle&,
+                                           LegacyLayout) const;
   virtual scoped_refptr<ComputedStyle> CustomStyleForLayoutObject(
       scoped_refptr<ComputedStyle>);
   virtual TextDirection ComputedTextDirection();
diff --git a/third_party/blink/renderer/core/html/forms/listed_element.cc b/third_party/blink/renderer/core/html/forms/listed_element.cc
index 00728ae..f182a0e 100644
--- a/third_party/blink/renderer/core/html/forms/listed_element.cc
+++ b/third_party/blink/renderer/core/html/forms/listed_element.cc
@@ -489,8 +489,9 @@
     String message(
         "An invalid form control with name='%name' is not focusable.");
     message.Replace("%name", GetName());
-    element.GetDocument().AddConsoleMessage(ConsoleMessage::Create(
-        kRenderingMessageSource, mojom::ConsoleMessageLevel::kError, message));
+    element.GetDocument().AddConsoleMessage(
+        ConsoleMessage::Create(mojom::ConsoleMessageSource::kRendering,
+                               mojom::ConsoleMessageLevel::kError, message));
   }
   return false;
 }
diff --git a/third_party/blink/renderer/core/html/forms/picker_indicator_element.cc b/third_party/blink/renderer/core/html/forms/picker_indicator_element.cc
index f308755..3aca0a7 100644
--- a/third_party/blink/renderer/core/html/forms/picker_indicator_element.cc
+++ b/third_party/blink/renderer/core/html/forms/picker_indicator_element.cc
@@ -65,7 +65,8 @@
   DCHECK(!chooser_);
 }
 
-LayoutObject* PickerIndicatorElement::CreateLayoutObject(const ComputedStyle&) {
+LayoutObject* PickerIndicatorElement::CreateLayoutObject(const ComputedStyle&,
+                                                         LegacyLayout) {
   return new LayoutDetailsMarker(this);
 }
 
diff --git a/third_party/blink/renderer/core/html/forms/picker_indicator_element.h b/third_party/blink/renderer/core/html/forms/picker_indicator_element.h
index 64b6256f..5bb24997 100644
--- a/third_party/blink/renderer/core/html/forms/picker_indicator_element.h
+++ b/third_party/blink/renderer/core/html/forms/picker_indicator_element.h
@@ -76,7 +76,7 @@
   void DidEndChooser() override;
 
  private:
-  LayoutObject* CreateLayoutObject(const ComputedStyle&) override;
+  LayoutObject* CreateLayoutObject(const ComputedStyle&, LegacyLayout) override;
   void DefaultEventHandler(Event&) override;
   void DetachLayoutTree(const AttachContext& = AttachContext()) override;
   bool IsPickerIndicatorElement() const override;
diff --git a/third_party/blink/renderer/core/html/forms/range_input_type.cc b/third_party/blink/renderer/core/html/forms/range_input_type.cc
index 98d9b54..5137c3e 100644
--- a/third_party/blink/renderer/core/html/forms/range_input_type.cc
+++ b/third_party/blink/renderer/core/html/forms/range_input_type.cc
@@ -253,7 +253,8 @@
   GetElement().UserAgentShadowRoot()->AppendChild(container);
 }
 
-LayoutObject* RangeInputType::CreateLayoutObject(const ComputedStyle&) const {
+LayoutObject* RangeInputType::CreateLayoutObject(const ComputedStyle&,
+                                                 LegacyLayout) const {
   return new LayoutSlider(&GetElement());
 }
 
diff --git a/third_party/blink/renderer/core/html/forms/range_input_type.h b/third_party/blink/renderer/core/html/forms/range_input_type.h
index ca8e69e..ebee693 100644
--- a/third_party/blink/renderer/core/html/forms/range_input_type.h
+++ b/third_party/blink/renderer/core/html/forms/range_input_type.h
@@ -65,7 +65,8 @@
   bool IsSteppable() const override;
   void HandleMouseDownEvent(MouseEvent&) override;
   void HandleKeydownEvent(KeyboardEvent&) override;
-  LayoutObject* CreateLayoutObject(const ComputedStyle&) const override;
+  LayoutObject* CreateLayoutObject(const ComputedStyle&,
+                                   LegacyLayout) const override;
   void CreateShadowSubtree() override;
   Decimal ParseToNumber(const String&, const Decimal&) const override;
   String Serialize(const Decimal&) const override;
diff --git a/third_party/blink/renderer/core/html/forms/search_input_type.cc b/third_party/blink/renderer/core/html/forms/search_input_type.cc
index d80baadb6..97c93f2 100644
--- a/third_party/blink/renderer/core/html/forms/search_input_type.cc
+++ b/third_party/blink/renderer/core/html/forms/search_input_type.cc
@@ -61,7 +61,8 @@
   CountUsageIfVisible(WebFeature::kInputTypeSearch);
 }
 
-LayoutObject* SearchInputType::CreateLayoutObject(const ComputedStyle&) const {
+LayoutObject* SearchInputType::CreateLayoutObject(const ComputedStyle&,
+                                                  LegacyLayout) const {
   return new LayoutSearchField(&GetElement());
 }
 
diff --git a/third_party/blink/renderer/core/html/forms/search_input_type.h b/third_party/blink/renderer/core/html/forms/search_input_type.h
index d8760af..b27f3f0 100644
--- a/third_party/blink/renderer/core/html/forms/search_input_type.h
+++ b/third_party/blink/renderer/core/html/forms/search_input_type.h
@@ -44,7 +44,8 @@
 
  private:
   void CountUsage() override;
-  LayoutObject* CreateLayoutObject(const ComputedStyle&) const override;
+  LayoutObject* CreateLayoutObject(const ComputedStyle&,
+                                   LegacyLayout) const override;
   const AtomicString& FormControlType() const override;
   bool NeedsContainer() const override;
   void CreateShadowSubtree() override;
diff --git a/third_party/blink/renderer/core/html/forms/slider_thumb_element.cc b/third_party/blink/renderer/core/html/forms/slider_thumb_element.cc
index 997347b4..c5c79e3 100644
--- a/third_party/blink/renderer/core/html/forms/slider_thumb_element.cc
+++ b/third_party/blink/renderer/core/html/forms/slider_thumb_element.cc
@@ -78,9 +78,9 @@
   }
 }
 
-LayoutObject* SliderThumbElement::CreateLayoutObject(
-    const ComputedStyle& style) {
-  return LayoutObjectFactory::CreateBlockFlow(*this, style);
+LayoutObject* SliderThumbElement::CreateLayoutObject(const ComputedStyle& style,
+                                                     LegacyLayout legacy) {
+  return LayoutObjectFactory::CreateBlockFlow(*this, style, legacy);
 }
 
 bool SliderThumbElement::IsDisabledFormControl() const {
@@ -361,7 +361,8 @@
   return ToHTMLInputElement(OwnerShadowHost());
 }
 
-LayoutObject* SliderContainerElement::CreateLayoutObject(const ComputedStyle&) {
+LayoutObject* SliderContainerElement::CreateLayoutObject(const ComputedStyle&,
+                                                         LegacyLayout) {
   return new LayoutSliderContainer(this);
 }
 
diff --git a/third_party/blink/renderer/core/html/forms/slider_thumb_element.h b/third_party/blink/renderer/core/html/forms/slider_thumb_element.h
index 52adf04..0a95cbc 100644
--- a/third_party/blink/renderer/core/html/forms/slider_thumb_element.h
+++ b/third_party/blink/renderer/core/html/forms/slider_thumb_element.h
@@ -60,7 +60,7 @@
   void StopDragging();
 
  private:
-  LayoutObject* CreateLayoutObject(const ComputedStyle&) override;
+  LayoutObject* CreateLayoutObject(const ComputedStyle&, LegacyLayout) override;
   scoped_refptr<ComputedStyle> CustomStyleForLayoutObject() final;
   Element& CloneWithoutAttributesAndChildren(Document&) const override;
   bool IsDisabledFormControl() const override;
@@ -100,7 +100,7 @@
   void RemoveAllEventListeners() override;
 
  private:
-  LayoutObject* CreateLayoutObject(const ComputedStyle&) override;
+  LayoutObject* CreateLayoutObject(const ComputedStyle&, LegacyLayout) override;
   scoped_refptr<ComputedStyle> CustomStyleForLayoutObject() final;
   const AtomicString& ShadowPseudoId() const override;
   Direction GetDirection(LayoutPoint&, LayoutPoint&);
diff --git a/third_party/blink/renderer/core/html/forms/text_control_inner_elements.cc b/third_party/blink/renderer/core/html/forms/text_control_inner_elements.cc
index 794ae99f..2021379f 100644
--- a/third_party/blink/renderer/core/html/forms/text_control_inner_elements.cc
+++ b/third_party/blink/renderer/core/html/forms/text_control_inner_elements.cc
@@ -52,7 +52,8 @@
 }
 
 LayoutObject* TextControlInnerContainer::CreateLayoutObject(
-    const ComputedStyle&) {
+    const ComputedStyle&,
+    LegacyLayout) {
   return new LayoutTextControlInnerContainer(this);
 }
 
@@ -132,7 +133,8 @@
 }
 
 LayoutObject* TextControlInnerEditorElement::CreateLayoutObject(
-    const ComputedStyle&) {
+    const ComputedStyle&,
+    LegacyLayout) {
   return new LayoutTextControlInnerEditor(this);
 }
 
diff --git a/third_party/blink/renderer/core/html/forms/text_control_inner_elements.h b/third_party/blink/renderer/core/html/forms/text_control_inner_elements.h
index b2c75e3..0d2696b 100644
--- a/third_party/blink/renderer/core/html/forms/text_control_inner_elements.h
+++ b/third_party/blink/renderer/core/html/forms/text_control_inner_elements.h
@@ -39,7 +39,7 @@
   explicit TextControlInnerContainer(Document&);
 
  protected:
-  LayoutObject* CreateLayoutObject(const ComputedStyle&) override;
+  LayoutObject* CreateLayoutObject(const ComputedStyle&, LegacyLayout) override;
 };
 
 class EditingViewPortElement final : public HTMLDivElement {
@@ -67,7 +67,7 @@
   scoped_refptr<ComputedStyle> CreateInnerEditorStyle() const;
 
  private:
-  LayoutObject* CreateLayoutObject(const ComputedStyle&) override;
+  LayoutObject* CreateLayoutObject(const ComputedStyle&, LegacyLayout) override;
   scoped_refptr<ComputedStyle> CustomStyleForLayoutObject() override;
   bool SupportsFocus() const override { return false; }
   bool is_visible_ = true;
diff --git a/third_party/blink/renderer/core/html/forms/text_field_input_type.cc b/third_party/blink/renderer/core/html/forms/text_field_input_type.cc
index ad8cbeb..1cd3248 100644
--- a/third_party/blink/renderer/core/html/forms/text_field_input_type.cc
+++ b/third_party/blink/renderer/core/html/forms/text_field_input_type.cc
@@ -63,7 +63,8 @@
     return ToHTMLInputElement(OwnerShadowHost());
   }
 
-  LayoutObject* CreateLayoutObject(const ComputedStyle&) override {
+  LayoutObject* CreateLayoutObject(const ComputedStyle&,
+                                   LegacyLayout) override {
     return new LayoutDetailsMarker(this);
   }
 
@@ -268,8 +269,8 @@
          InputTypeView::ShouldSubmitImplicitly(event);
 }
 
-LayoutObject* TextFieldInputType::CreateLayoutObject(
-    const ComputedStyle&) const {
+LayoutObject* TextFieldInputType::CreateLayoutObject(const ComputedStyle&,
+                                                     LegacyLayout) const {
   return new LayoutTextControlSingleLine(&GetElement());
 }
 
diff --git a/third_party/blink/renderer/core/html/forms/text_field_input_type.h b/third_party/blink/renderer/core/html/forms/text_field_input_type.h
index 2ae1443..8d81c70 100644
--- a/third_party/blink/renderer/core/html/forms/text_field_input_type.h
+++ b/third_party/blink/renderer/core/html/forms/text_field_input_type.h
@@ -67,7 +67,8 @@
                 TextFieldEventBehavior,
                 TextControlSetValueSelection) override;
   void UpdateView() override;
-  LayoutObject* CreateLayoutObject(const ComputedStyle&) const override;
+  LayoutObject* CreateLayoutObject(const ComputedStyle&,
+                                   LegacyLayout) const override;
 
   virtual bool NeedsContainer() const { return false; }
   virtual String ConvertFromVisibleValue(const String&) const;
diff --git a/third_party/blink/renderer/core/html/html_br_element.cc b/third_party/blink/renderer/core/html/html_br_element.cc
index 2690873..b15b96e1 100644
--- a/third_party/blink/renderer/core/html/html_br_element.cc
+++ b/third_party/blink/renderer/core/html/html_br_element.cc
@@ -63,9 +63,10 @@
   }
 }
 
-LayoutObject* HTMLBRElement::CreateLayoutObject(const ComputedStyle& style) {
+LayoutObject* HTMLBRElement::CreateLayoutObject(const ComputedStyle& style,
+                                                LegacyLayout legacy) {
   if (style.HasContent())
-    return LayoutObject::CreateObject(this, style);
+    return LayoutObject::CreateObject(this, style, legacy);
   return new LayoutBR(this);
 }
 
diff --git a/third_party/blink/renderer/core/html/html_br_element.h b/third_party/blink/renderer/core/html/html_br_element.h
index 3cff06a..bd6cd19a 100644
--- a/third_party/blink/renderer/core/html/html_br_element.h
+++ b/third_party/blink/renderer/core/html/html_br_element.h
@@ -46,7 +46,7 @@
       const AtomicString&,
       MutableCSSPropertyValueSet*) override;
 
-  LayoutObject* CreateLayoutObject(const ComputedStyle&) override;
+  LayoutObject* CreateLayoutObject(const ComputedStyle&, LegacyLayout) override;
 };
 
 }  // namespace blink
diff --git a/third_party/blink/renderer/core/html/html_details_element.cc b/third_party/blink/renderer/core/html/html_details_element.cc
index 30096b3..b169973c 100644
--- a/third_party/blink/renderer/core/html/html_details_element.cc
+++ b/third_party/blink/renderer/core/html/html_details_element.cc
@@ -71,9 +71,9 @@
   DispatchEvent(*Event::Create(event_type_names::kToggle));
 }
 
-LayoutObject* HTMLDetailsElement::CreateLayoutObject(
-    const ComputedStyle& style) {
-  return LayoutObjectFactory::CreateBlockFlow(*this, style);
+LayoutObject* HTMLDetailsElement::CreateLayoutObject(const ComputedStyle& style,
+                                                     LegacyLayout legacy) {
+  return LayoutObjectFactory::CreateBlockFlow(*this, style, legacy);
 }
 
 void HTMLDetailsElement::DidAddUserAgentShadowRoot(ShadowRoot& root) {
diff --git a/third_party/blink/renderer/core/html/html_details_element.h b/third_party/blink/renderer/core/html/html_details_element.h
index a3854bd2..13e5401 100644
--- a/third_party/blink/renderer/core/html/html_details_element.h
+++ b/third_party/blink/renderer/core/html/html_details_element.h
@@ -44,7 +44,7 @@
  private:
   void DispatchPendingEvent();
 
-  LayoutObject* CreateLayoutObject(const ComputedStyle&) override;
+  LayoutObject* CreateLayoutObject(const ComputedStyle&, LegacyLayout) override;
   void ParseAttribute(const AttributeModificationParams&) override;
   void DidAddUserAgentShadowRoot(ShadowRoot&) override;
   bool IsInteractiveContent() const override;
diff --git a/third_party/blink/renderer/core/html/html_frame_element.cc b/third_party/blink/renderer/core/html/html_frame_element.cc
index b1357b6..eddbc7d2 100644
--- a/third_party/blink/renderer/core/html/html_frame_element.cc
+++ b/third_party/blink/renderer/core/html/html_frame_element.cc
@@ -51,7 +51,8 @@
   return ContentFrame();
 }
 
-LayoutObject* HTMLFrameElement::CreateLayoutObject(const ComputedStyle&) {
+LayoutObject* HTMLFrameElement::CreateLayoutObject(const ComputedStyle&,
+                                                   LegacyLayout) {
   return new LayoutFrame(this);
 }
 
diff --git a/third_party/blink/renderer/core/html/html_frame_element.h b/third_party/blink/renderer/core/html/html_frame_element.h
index e57302d..cccfa4ad 100644
--- a/third_party/blink/renderer/core/html/html_frame_element.h
+++ b/third_party/blink/renderer/core/html/html_frame_element.h
@@ -57,7 +57,7 @@
   void AttachLayoutTree(AttachContext&) override;
 
   bool LayoutObjectIsNeeded(const ComputedStyle&) const override;
-  LayoutObject* CreateLayoutObject(const ComputedStyle&) override;
+  LayoutObject* CreateLayoutObject(const ComputedStyle&, LegacyLayout) override;
 
   void ParseAttribute(const AttributeModificationParams&) override;
 
diff --git a/third_party/blink/renderer/core/html/html_frame_set_element.cc b/third_party/blink/renderer/core/html/html_frame_set_element.cc
index 0d506b9..4facd6d 100644
--- a/third_party/blink/renderer/core/html/html_frame_set_element.cc
+++ b/third_party/blink/renderer/core/html/html_frame_set_element.cc
@@ -222,9 +222,10 @@
 }
 
 LayoutObject* HTMLFrameSetElement::CreateLayoutObject(
-    const ComputedStyle& style) {
+    const ComputedStyle& style,
+    LegacyLayout legacy) {
   if (style.HasContent())
-    return LayoutObject::CreateObject(this, style);
+    return LayoutObject::CreateObject(this, style, legacy);
   return new LayoutFrameSet(this);
 }
 
diff --git a/third_party/blink/renderer/core/html/html_frame_set_element.h b/third_party/blink/renderer/core/html/html_frame_set_element.h
index c07a009..ccc048b 100644
--- a/third_party/blink/renderer/core/html/html_frame_set_element.h
+++ b/third_party/blink/renderer/core/html/html_frame_set_element.h
@@ -75,7 +75,7 @@
 
   void AttachLayoutTree(AttachContext&) override;
   bool LayoutObjectIsNeeded(const ComputedStyle&) const override;
-  LayoutObject* CreateLayoutObject(const ComputedStyle&) override;
+  LayoutObject* CreateLayoutObject(const ComputedStyle&, LegacyLayout) override;
 
   void DefaultEventHandler(Event&) override;
 
diff --git a/third_party/blink/renderer/core/html/html_iframe_element.cc b/third_party/blink/renderer/core/html/html_iframe_element.cc
index 9f67616..9b31b07 100644
--- a/third_party/blink/renderer/core/html/html_iframe_element.cc
+++ b/third_party/blink/renderer/core/html/html_iframe_element.cc
@@ -148,7 +148,8 @@
                                                         invalid_tokens));
     if (!invalid_tokens.IsNull()) {
       GetDocument().AddConsoleMessage(ConsoleMessage::Create(
-          kOtherMessageSource, mojom::ConsoleMessageLevel::kError,
+          mojom::ConsoleMessageSource::kOther,
+          mojom::ConsoleMessageLevel::kError,
           "Error while parsing the 'sandbox' attribute: " + invalid_tokens));
     }
     if (RuntimeEnabledFeatures::FeaturePolicyForSandboxEnabled()) {
@@ -157,8 +158,8 @@
       if (!messages.IsEmpty()) {
         for (const String& message : messages) {
           GetDocument().AddConsoleMessage(ConsoleMessage::Create(
-              kOtherMessageSource, mojom::ConsoleMessageLevel::kWarning,
-              message));
+              mojom::ConsoleMessageSource::kOther,
+              mojom::ConsoleMessageLevel::kWarning, message));
         }
       }
     }
@@ -198,7 +199,8 @@
             value.GetString(), GetDocument().RequiredCSP().GetString())) {
       required_csp_ = g_null_atom;
       GetDocument().AddConsoleMessage(ConsoleMessage::Create(
-          kOtherMessageSource, mojom::ConsoleMessageLevel::kError,
+          mojom::ConsoleMessageSource::kOther,
+          mojom::ConsoleMessageLevel::kError,
           "'csp' attribute is not a valid policy: " + value));
       return;
     }
@@ -214,8 +216,8 @@
       if (!messages.IsEmpty()) {
         for (const String& message : messages) {
           GetDocument().AddConsoleMessage(ConsoleMessage::Create(
-              kOtherMessageSource, mojom::ConsoleMessageLevel::kWarning,
-              message));
+              mojom::ConsoleMessageSource::kOther,
+              mojom::ConsoleMessageLevel::kWarning, message));
         }
       }
       if (!value.IsEmpty()) {
@@ -235,11 +237,12 @@
             WebFeature::kHTMLIFrameElementGestureMedia)) {
       UseCounter::Count(GetDocument(),
                         WebFeature::kHTMLIFrameElementGestureMedia);
-      GetDocument().AddConsoleMessage(ConsoleMessage::Create(
-          kOtherMessageSource, mojom::ConsoleMessageLevel::kWarning,
-          "<iframe gesture=\"media\"> is not supported. "
-          "Use <iframe allow=\"autoplay\">, "
-          "https://goo.gl/ximf56"));
+      GetDocument().AddConsoleMessage(
+          ConsoleMessage::Create(mojom::ConsoleMessageSource::kOther,
+                                 mojom::ConsoleMessageLevel::kWarning,
+                                 "<iframe gesture=\"media\"> is not supported. "
+                                 "Use <iframe allow=\"autoplay\">, "
+                                 "https://goo.gl/ximf56"));
     }
 
     if (name == kSrcAttr)
@@ -315,7 +318,8 @@
          HTMLElement::LayoutObjectIsNeeded(style);
 }
 
-LayoutObject* HTMLIFrameElement::CreateLayoutObject(const ComputedStyle&) {
+LayoutObject* HTMLIFrameElement::CreateLayoutObject(const ComputedStyle&,
+                                                    LegacyLayout) {
   return new LayoutIFrame(this);
 }
 
@@ -331,7 +335,8 @@
             required_csp_, GetDocument().RequiredCSP().GetString())) {
       if (!required_csp_.IsEmpty()) {
         GetDocument().AddConsoleMessage(ConsoleMessage::Create(
-            kOtherMessageSource, mojom::ConsoleMessageLevel::kError,
+            mojom::ConsoleMessageSource::kOther,
+            mojom::ConsoleMessageLevel::kError,
             "'csp' attribute is not a valid policy: " + required_csp_));
       }
       if (required_csp_ != GetDocument().RequiredCSP()) {
diff --git a/third_party/blink/renderer/core/html/html_iframe_element.h b/third_party/blink/renderer/core/html/html_iframe_element.h
index 1246097..b924291 100644
--- a/third_party/blink/renderer/core/html/html_iframe_element.h
+++ b/third_party/blink/renderer/core/html/html_iframe_element.h
@@ -75,7 +75,7 @@
   void RemovedFrom(ContainerNode&) override;
 
   bool LayoutObjectIsNeeded(const ComputedStyle&) const override;
-  LayoutObject* CreateLayoutObject(const ComputedStyle&) override;
+  LayoutObject* CreateLayoutObject(const ComputedStyle&, LegacyLayout) override;
 
   bool IsInteractiveContent() const override;
 
diff --git a/third_party/blink/renderer/core/html/html_image_element.cc b/third_party/blink/renderer/core/html/html_image_element.cc
index 401ab7e9..14b4f4e 100644
--- a/third_party/blink/renderer/core/html/html_image_element.cc
+++ b/third_party/blink/renderer/core/html/html_image_element.cc
@@ -311,7 +311,8 @@
             &is_default_overridden_intrinsic_size_, &message);
     if (!message.IsEmpty()) {
       GetDocument().AddConsoleMessage(ConsoleMessage::Create(
-          kOtherMessageSource, mojom::ConsoleMessageLevel::kWarning, message));
+          mojom::ConsoleMessageSource::kOther,
+          mojom::ConsoleMessageLevel::kWarning, message));
     }
 
     if (intrinsic_size_changed && GetLayoutObject() &&
@@ -392,7 +393,8 @@
   return ImageCandidate();
 }
 
-LayoutObject* HTMLImageElement::CreateLayoutObject(const ComputedStyle& style) {
+LayoutObject* HTMLImageElement::CreateLayoutObject(const ComputedStyle& style,
+                                                   LegacyLayout legacy) {
   const ContentData* content_data = style.GetContentData();
   if (content_data && content_data->IsImage()) {
     const StyleImage* content_image =
@@ -400,12 +402,12 @@
     bool error_occurred = content_image && content_image->CachedImage() &&
                           content_image->CachedImage()->ErrorOccurred();
     if (!error_occurred)
-      return LayoutObject::CreateObject(this, style);
+      return LayoutObject::CreateObject(this, style, legacy);
   }
 
   switch (layout_disposition_) {
     case LayoutDisposition::kFallbackContent:
-      return LayoutObjectFactory::CreateBlockFlow(*this, style);
+      return LayoutObjectFactory::CreateBlockFlow(*this, style, legacy);
     case LayoutDisposition::kPrimaryContent: {
       LayoutImage* image = new LayoutImage(this);
       image->SetImageResource(LayoutImageResource::Create());
diff --git a/third_party/blink/renderer/core/html/html_image_element.h b/third_party/blink/renderer/core/html/html_image_element.h
index 9cf024e..d1badfef 100644
--- a/third_party/blink/renderer/core/html/html_image_element.h
+++ b/third_party/blink/renderer/core/html/html_image_element.h
@@ -213,7 +213,7 @@
   void SetLayoutDisposition(LayoutDisposition, bool force_reattach = false);
 
   void AttachLayoutTree(AttachContext&) override;
-  LayoutObject* CreateLayoutObject(const ComputedStyle&) override;
+  LayoutObject* CreateLayoutObject(const ComputedStyle&, LegacyLayout) override;
 
   bool CanStartSelection() const override { return false; }
 
diff --git a/third_party/blink/renderer/core/html/html_link_element.cc b/third_party/blink/renderer/core/html/html_link_element.cc
index aae9f43b..e879460c 100644
--- a/third_party/blink/renderer/core/html/html_link_element.cc
+++ b/third_party/blink/renderer/core/html/html_link_element.cc
@@ -243,8 +243,9 @@
 
   if (!ShouldLoadLink() && IsInShadowTree()) {
     String message = "HTML element <link> is ignored in shadow tree.";
-    GetDocument().AddConsoleMessage(ConsoleMessage::Create(
-        kJSMessageSource, mojom::ConsoleMessageLevel::kWarning, message));
+    GetDocument().AddConsoleMessage(
+        ConsoleMessage::Create(mojom::ConsoleMessageSource::kJavaScript,
+                               mojom::ConsoleMessageLevel::kWarning, message));
     return kInsertionDone;
   }
 
diff --git a/third_party/blink/renderer/core/html/html_meta_element.cc b/third_party/blink/renderer/core/html/html_meta_element.cc
index b7f430e1..90bd176 100644
--- a/third_party/blink/renderer/core/html/html_meta_element.cc
+++ b/third_party/blink/renderer/core/html/html_meta_element.cc
@@ -130,7 +130,7 @@
         "Error parsing a meta element's content: ';' is not a valid key-value "
         "pair separator. Please use ',' instead.";
     document->AddConsoleMessage(
-        ConsoleMessage::Create(kRenderingMessageSource,
+        ConsoleMessage::Create(mojom::ConsoleMessageSource::kRendering,
                                mojom::ConsoleMessageLevel::kWarning, message));
   }
 }
@@ -434,8 +434,9 @@
 
   // FIXME: This message should be moved off the console once a solution to
   // https://bugs.webkit.org/show_bug.cgi?id=103274 exists.
-  document->AddConsoleMessage(ConsoleMessage::Create(
-      kRenderingMessageSource, ViewportErrorMessageLevel(error_code), message));
+  document->AddConsoleMessage(
+      ConsoleMessage::Create(mojom::ConsoleMessageSource::kRendering,
+                             ViewportErrorMessageLevel(error_code), message));
 }
 
 void HTMLMetaElement::GetViewportDescriptionFromContentAttribute(
diff --git a/third_party/blink/renderer/core/html/html_meter_element.cc b/third_party/blink/renderer/core/html/html_meter_element.cc
index 68274b33..6556eff 100644
--- a/third_party/blink/renderer/core/html/html_meter_element.cc
+++ b/third_party/blink/renderer/core/html/html_meter_element.cc
@@ -47,7 +47,8 @@
   return meter;
 }
 
-LayoutObject* HTMLMeterElement::CreateLayoutObject(const ComputedStyle& style) {
+LayoutObject* HTMLMeterElement::CreateLayoutObject(const ComputedStyle& style,
+                                                   LegacyLayout legacy) {
   switch (style.Appearance()) {
     case kMeterPart:
       UseCounter::Count(GetDocument(),
@@ -60,7 +61,7 @@
     default:
       break;
   }
-  return HTMLElement::CreateLayoutObject(style);
+  return HTMLElement::CreateLayoutObject(style, legacy);
 }
 
 void HTMLMeterElement::ParseAttribute(
diff --git a/third_party/blink/renderer/core/html/html_meter_element.h b/third_party/blink/renderer/core/html/html_meter_element.h
index fa329c1f..eab8d9dc 100644
--- a/third_party/blink/renderer/core/html/html_meter_element.h
+++ b/third_party/blink/renderer/core/html/html_meter_element.h
@@ -73,9 +73,9 @@
   bool AreAuthorShadowsAllowed() const override { return false; }
 
   bool IsLabelable() const override { return true; }
-  bool ShouldForceLegacyLayout() const final { return true; }
+  bool TypeShouldForceLegacyLayout() const final { return true; }
 
-  LayoutObject* CreateLayoutObject(const ComputedStyle&) override;
+  LayoutObject* CreateLayoutObject(const ComputedStyle&, LegacyLayout) override;
   void ParseAttribute(const AttributeModificationParams&) override;
 
   void DidElementStateChange();
diff --git a/third_party/blink/renderer/core/html/html_plugin_element.cc b/third_party/blink/renderer/core/html/html_plugin_element.cc
index 6801e1c..af02bda 100644
--- a/third_party/blink/renderer/core/html/html_plugin_element.cc
+++ b/third_party/blink/renderer/core/html/html_plugin_element.cc
@@ -355,13 +355,13 @@
   HTMLFrameOwnerElement::DetachLayoutTree(context);
 }
 
-LayoutObject* HTMLPlugInElement::CreateLayoutObject(
-    const ComputedStyle& style) {
+LayoutObject* HTMLPlugInElement::CreateLayoutObject(const ComputedStyle& style,
+                                                    LegacyLayout legacy) {
   // Fallback content breaks the DOM->layoutObject class relationship of this
   // class and all superclasses because createObject won't necessarily return
   // a LayoutEmbeddedObject or LayoutEmbeddedContent.
   if (UseFallbackContent())
-    return LayoutObject::CreateObject(this, style);
+    return LayoutObject::CreateObject(this, style, legacy);
 
   if (IsImageType()) {
     LayoutImage* image = new LayoutImage(this);
@@ -706,12 +706,13 @@
 bool HTMLPlugInElement::AllowedToLoadPlugin(const KURL& url,
                                             const String& mime_type) {
   if (GetDocument().IsSandboxed(kSandboxPlugins)) {
-    GetDocument().AddConsoleMessage(ConsoleMessage::Create(
-        kSecurityMessageSource, mojom::ConsoleMessageLevel::kError,
-        "Failed to load '" + url.ElidedString() +
-            "' as a plugin, because the "
-            "frame into which the plugin "
-            "is loading is sandboxed."));
+    GetDocument().AddConsoleMessage(
+        ConsoleMessage::Create(mojom::ConsoleMessageSource::kSecurity,
+                               mojom::ConsoleMessageLevel::kError,
+                               "Failed to load '" + url.ElidedString() +
+                                   "' as a plugin, because the "
+                                   "frame into which the plugin "
+                                   "is loading is sandboxed."));
     return false;
   }
   return true;
diff --git a/third_party/blink/renderer/core/html/html_plugin_element.h b/third_party/blink/renderer/core/html/html_plugin_element.h
index a465a8d..4412e749 100644
--- a/third_party/blink/renderer/core/html/html_plugin_element.h
+++ b/third_party/blink/renderer/core/html/html_plugin_element.h
@@ -165,7 +165,7 @@
   void FinishParsingChildren() final;
 
   // Element overrides:
-  LayoutObject* CreateLayoutObject(const ComputedStyle&) override;
+  LayoutObject* CreateLayoutObject(const ComputedStyle&, LegacyLayout) override;
   bool SupportsFocus() const final { return true; }
   bool IsFocusableStyle() const final;
   bool IsKeyboardFocusable() const final;
diff --git a/third_party/blink/renderer/core/html/html_progress_element.cc b/third_party/blink/renderer/core/html/html_progress_element.cc
index e1eb637e..552ec47 100644
--- a/third_party/blink/renderer/core/html/html_progress_element.cc
+++ b/third_party/blink/renderer/core/html/html_progress_element.cc
@@ -50,11 +50,12 @@
 }
 
 LayoutObject* HTMLProgressElement::CreateLayoutObject(
-    const ComputedStyle& style) {
+    const ComputedStyle& style,
+    LegacyLayout legacy) {
   if (!style.HasAppearance()) {
     UseCounter::Count(GetDocument(),
                       WebFeature::kProgressElementWithNoneAppearance);
-    return LayoutObject::CreateObject(this, style);
+    return LayoutObject::CreateObject(this, style, legacy);
   }
   UseCounter::Count(GetDocument(),
                     WebFeature::kProgressElementWithProgressBarAppearance);
diff --git a/third_party/blink/renderer/core/html/html_progress_element.h b/third_party/blink/renderer/core/html/html_progress_element.h
index 5deaca0..510236b8 100644
--- a/third_party/blink/renderer/core/html/html_progress_element.h
+++ b/third_party/blink/renderer/core/html/html_progress_element.h
@@ -57,9 +57,9 @@
   bool AreAuthorShadowsAllowed() const override { return false; }
   bool ShouldAppearIndeterminate() const override;
   bool IsLabelable() const override { return true; }
-  bool ShouldForceLegacyLayout() const final { return true; }
+  bool TypeShouldForceLegacyLayout() const final { return true; }
 
-  LayoutObject* CreateLayoutObject(const ComputedStyle&) override;
+  LayoutObject* CreateLayoutObject(const ComputedStyle&, LegacyLayout) override;
   LayoutProgress* GetLayoutProgress() const;
 
   void ParseAttribute(const AttributeModificationParams&) override;
diff --git a/third_party/blink/renderer/core/html/html_rt_element.cc b/third_party/blink/renderer/core/html/html_rt_element.cc
index a115a3d..c6695257 100644
--- a/third_party/blink/renderer/core/html/html_rt_element.cc
+++ b/third_party/blink/renderer/core/html/html_rt_element.cc
@@ -16,10 +16,11 @@
 
 DEFINE_NODE_FACTORY(HTMLRTElement)
 
-LayoutObject* HTMLRTElement::CreateLayoutObject(const ComputedStyle& style) {
+LayoutObject* HTMLRTElement::CreateLayoutObject(const ComputedStyle& style,
+                                                LegacyLayout legacy) {
   if (style.Display() == EDisplay::kBlock)
     return new LayoutRubyText(this);
-  return LayoutObject::CreateObject(this, style);
+  return LayoutObject::CreateObject(this, style, legacy);
 }
 
 }  // namespace blink
diff --git a/third_party/blink/renderer/core/html/html_rt_element.h b/third_party/blink/renderer/core/html/html_rt_element.h
index 900b5314..eba4c3e8 100644
--- a/third_party/blink/renderer/core/html/html_rt_element.h
+++ b/third_party/blink/renderer/core/html/html_rt_element.h
@@ -18,7 +18,7 @@
   explicit HTMLRTElement(Document&);
 
  private:
-  LayoutObject* CreateLayoutObject(const ComputedStyle&) override;
+  LayoutObject* CreateLayoutObject(const ComputedStyle&, LegacyLayout) override;
 };
 
 }  // namespace blink
diff --git a/third_party/blink/renderer/core/html/html_ruby_element.cc b/third_party/blink/renderer/core/html/html_ruby_element.cc
index 3856164..3ec7bd5 100644
--- a/third_party/blink/renderer/core/html/html_ruby_element.cc
+++ b/third_party/blink/renderer/core/html/html_ruby_element.cc
@@ -16,12 +16,13 @@
 
 DEFINE_NODE_FACTORY(HTMLRubyElement)
 
-LayoutObject* HTMLRubyElement::CreateLayoutObject(const ComputedStyle& style) {
+LayoutObject* HTMLRubyElement::CreateLayoutObject(const ComputedStyle& style,
+                                                  LegacyLayout legacy) {
   if (style.Display() == EDisplay::kInline)
     return new LayoutRubyAsInline(this);
   if (style.Display() == EDisplay::kBlock)
     return new LayoutRubyAsBlock(this);
-  return LayoutObject::CreateObject(this, style);
+  return LayoutObject::CreateObject(this, style, legacy);
 }
 
 }  // namespace blink
diff --git a/third_party/blink/renderer/core/html/html_ruby_element.h b/third_party/blink/renderer/core/html/html_ruby_element.h
index 8962572..ec479ba 100644
--- a/third_party/blink/renderer/core/html/html_ruby_element.h
+++ b/third_party/blink/renderer/core/html/html_ruby_element.h
@@ -18,8 +18,8 @@
   explicit HTMLRubyElement(Document&);
 
  private:
-  LayoutObject* CreateLayoutObject(const ComputedStyle&) override;
-  bool ShouldForceLegacyLayout() const final { return true; }
+  LayoutObject* CreateLayoutObject(const ComputedStyle&, LegacyLayout) override;
+  bool TypeShouldForceLegacyLayout() const final { return true; }
 };
 
 }  // namespace blink
diff --git a/third_party/blink/renderer/core/html/html_summary_element.cc b/third_party/blink/renderer/core/html/html_summary_element.cc
index d900ae6..92545e80 100644
--- a/third_party/blink/renderer/core/html/html_summary_element.cc
+++ b/third_party/blink/renderer/core/html/html_summary_element.cc
@@ -49,8 +49,8 @@
   SetHasCustomStyleCallbacks();
 }
 
-LayoutObject* HTMLSummaryElement::CreateLayoutObject(
-    const ComputedStyle& style) {
+LayoutObject* HTMLSummaryElement::CreateLayoutObject(const ComputedStyle& style,
+                                                     LegacyLayout legacy) {
   // See: crbug.com/603928 - We manually check for other dislay types, then
   // fallback to a regular LayoutBlockFlow as "display: inline;" should behave
   // as an "inline-block".
@@ -59,8 +59,8 @@
       display == EDisplay::kGrid || display == EDisplay::kInlineGrid ||
       display == EDisplay::kLayoutCustom ||
       display == EDisplay::kInlineLayoutCustom)
-    return LayoutObject::CreateObject(this, style);
-  return LayoutObjectFactory::CreateBlockFlow(*this, style);
+    return LayoutObject::CreateObject(this, style, legacy);
+  return LayoutObjectFactory::CreateBlockFlow(*this, style, legacy);
 }
 
 void HTMLSummaryElement::DidAddUserAgentShadowRoot(ShadowRoot& root) {
diff --git a/third_party/blink/renderer/core/html/html_summary_element.h b/third_party/blink/renderer/core/html/html_summary_element.h
index 4d8974a..af7461c 100644
--- a/third_party/blink/renderer/core/html/html_summary_element.h
+++ b/third_party/blink/renderer/core/html/html_summary_element.h
@@ -39,7 +39,7 @@
   Element* MarkerControl();
 
  private:
-  LayoutObject* CreateLayoutObject(const ComputedStyle&) override;
+  LayoutObject* CreateLayoutObject(const ComputedStyle&, LegacyLayout) override;
   void DefaultEventHandler(Event&) override;
   bool HasActivationBehavior() const override;
   void DidAddUserAgentShadowRoot(ShadowRoot&) override;
diff --git a/third_party/blink/renderer/core/html/html_wbr_element.cc b/third_party/blink/renderer/core/html/html_wbr_element.cc
index 053085b..788ee11 100644
--- a/third_party/blink/renderer/core/html/html_wbr_element.cc
+++ b/third_party/blink/renderer/core/html/html_wbr_element.cc
@@ -42,7 +42,8 @@
 
 DEFINE_NODE_FACTORY(HTMLWBRElement)
 
-LayoutObject* HTMLWBRElement::CreateLayoutObject(const ComputedStyle& style) {
+LayoutObject* HTMLWBRElement::CreateLayoutObject(const ComputedStyle& style,
+                                                 LegacyLayout) {
   return new LayoutWordBreak(this);
 }
 
diff --git a/third_party/blink/renderer/core/html/html_wbr_element.h b/third_party/blink/renderer/core/html/html_wbr_element.h
index a9a7726..f3447b84 100644
--- a/third_party/blink/renderer/core/html/html_wbr_element.h
+++ b/third_party/blink/renderer/core/html/html_wbr_element.h
@@ -44,7 +44,7 @@
   explicit HTMLWBRElement(Document&);
 
  private:
-  LayoutObject* CreateLayoutObject(const ComputedStyle&) override;
+  LayoutObject* CreateLayoutObject(const ComputedStyle&, LegacyLayout) override;
 };
 
 }  // namespace blink
diff --git a/third_party/blink/renderer/core/html/lazy_load_image_observer.cc b/third_party/blink/renderer/core/html/lazy_load_image_observer.cc
index f07caec..34f0c28 100644
--- a/third_party/blink/renderer/core/html/lazy_load_image_observer.cc
+++ b/third_party/blink/renderer/core/html/lazy_load_image_observer.cc
@@ -99,7 +99,8 @@
 
   if (!lazy_load_intersection_observer_) {
     root_document->AddConsoleMessage(ConsoleMessage::Create(
-        kInterventionMessageSource, mojom::ConsoleMessageLevel::kInfo,
+        mojom::ConsoleMessageSource::kIntervention,
+        mojom::ConsoleMessageLevel::kInfo,
         "Images loaded lazily and replaced with placeholders. Load events are "
         "deferred. See https://crbug.com/846170"));
     lazy_load_intersection_observer_ = IntersectionObserver::Create(
diff --git a/third_party/blink/renderer/core/html/media/autoplay_policy.cc b/third_party/blink/renderer/core/html/media/autoplay_policy.cc
index 38713aa..1fa97b8 100644
--- a/third_party/blink/renderer/core/html/media/autoplay_policy.cc
+++ b/third_party/blink/renderer/core/html/media/autoplay_policy.cc
@@ -224,8 +224,8 @@
     if (IsGestureNeededForPlayback()) {
       if (IsUsingDocumentUserActivationRequiredPolicy()) {
         element_->GetDocument().AddConsoleMessage(ConsoleMessage::Create(
-            kJSMessageSource, mojom::ConsoleMessageLevel::kWarning,
-            kWarningUnmuteFailed));
+            mojom::ConsoleMessageSource::kJavaScript,
+            mojom::ConsoleMessageLevel::kWarning, kWarningUnmuteFailed));
       }
 
       autoplay_uma_helper_->RecordAutoplayUnmuteStatus(
diff --git a/third_party/blink/renderer/core/html/media/html_media_element.cc b/third_party/blink/renderer/core/html/media/html_media_element.cc
index 1530715..c780a528 100644
--- a/third_party/blink/renderer/core/html/media/html_media_element.cc
+++ b/third_party/blink/renderer/core/html/media/html_media_element.cc
@@ -684,7 +684,8 @@
   return ShouldShowControls() && HTMLElement::LayoutObjectIsNeeded(style);
 }
 
-LayoutObject* HTMLMediaElement::CreateLayoutObject(const ComputedStyle&) {
+LayoutObject* HTMLMediaElement::CreateLayoutObject(const ComputedStyle&,
+                                                   LegacyLayout) {
   return new LayoutMedia(this);
 }
 
@@ -1463,7 +1464,8 @@
   if (!frame || !GetDocument().GetSecurityOrigin()->CanDisplay(url)) {
     if (action_if_invalid == kComplain) {
       GetDocument().AddConsoleMessage(ConsoleMessage::Create(
-          kSecurityMessageSource, mojom::ConsoleMessageLevel::kError,
+          mojom::ConsoleMessageSource::kSecurity,
+          mojom::ConsoleMessageLevel::kError,
           "Not allowed to load local resource: " + url.ElidedString()));
     }
     DVLOG(3) << "isSafeToLoadURL(" << (void*)this << ", "
diff --git a/third_party/blink/renderer/core/html/media/html_media_element.h b/third_party/blink/renderer/core/html/media/html_media_element.h
index 7d3c74fa..6d34dd0 100644
--- a/third_party/blink/renderer/core/html/media/html_media_element.h
+++ b/third_party/blink/renderer/core/html/media/html_media_element.h
@@ -379,7 +379,7 @@
   bool SupportsFocus() const final;
   bool IsMouseFocusable() const final;
   bool LayoutObjectIsNeeded(const ComputedStyle&) const override;
-  LayoutObject* CreateLayoutObject(const ComputedStyle&) override;
+  LayoutObject* CreateLayoutObject(const ComputedStyle&, LegacyLayout) override;
   void DidNotifySubtreeInsertionsToDocument() override;
   void DidRecalcStyle(const StyleRecalcChange) final;
 
diff --git a/third_party/blink/renderer/core/html/media/html_video_element.cc b/third_party/blink/renderer/core/html/media/html_video_element.cc
index 659be8b..a2a7406 100644
--- a/third_party/blink/renderer/core/html/media/html_video_element.cc
+++ b/third_party/blink/renderer/core/html/media/html_video_element.cc
@@ -151,7 +151,8 @@
   return HTMLElement::LayoutObjectIsNeeded(style);
 }
 
-LayoutObject* HTMLVideoElement::CreateLayoutObject(const ComputedStyle&) {
+LayoutObject* HTMLVideoElement::CreateLayoutObject(const ComputedStyle&,
+                                                   LegacyLayout) {
   return new LayoutVideo(this);
 }
 
@@ -232,7 +233,8 @@
             &is_default_overridden_intrinsic_size_, &message);
     if (!message.IsEmpty()) {
       GetDocument().AddConsoleMessage(ConsoleMessage::Create(
-          kOtherMessageSource, mojom::ConsoleMessageLevel::kWarning, message));
+          mojom::ConsoleMessageSource::kOther,
+          mojom::ConsoleMessageLevel::kWarning, message));
     }
 
     if (intrinsic_size_changed && GetLayoutObject() &&
diff --git a/third_party/blink/renderer/core/html/media/html_video_element.h b/third_party/blink/renderer/core/html/media/html_video_element.h
index 41daa2f7d..9754b86 100644
--- a/third_party/blink/renderer/core/html/media/html_video_element.h
+++ b/third_party/blink/renderer/core/html/media/html_video_element.h
@@ -208,7 +208,7 @@
   void ContextDestroyed(ExecutionContext*) final;
 
   bool LayoutObjectIsNeeded(const ComputedStyle&) const override;
-  LayoutObject* CreateLayoutObject(const ComputedStyle&) override;
+  LayoutObject* CreateLayoutObject(const ComputedStyle&, LegacyLayout) override;
   void AttachLayoutTree(AttachContext&) override;
   void ParseAttribute(const AttributeModificationParams&) override;
   bool IsPresentationAttribute(const QualifiedName&) const override;
diff --git a/third_party/blink/renderer/core/html/parser/html_srcset_parser.cc b/third_party/blink/renderer/core/html/parser/html_srcset_parser.cc
index 8a754cba..7c15d10 100644
--- a/third_party/blink/renderer/core/html/parser/html_srcset_parser.cc
+++ b/third_party/blink/renderer/core/html/parser/html_srcset_parser.cc
@@ -197,7 +197,7 @@
     error_message.Append("Failed parsing 'srcset' attribute value since ");
     error_message.Append(message);
     document->GetFrame()->Console().AddMessage(ConsoleMessage::Create(
-        kOtherMessageSource, mojom::ConsoleMessageLevel::kError,
+        mojom::ConsoleMessageSource::kOther, mojom::ConsoleMessageLevel::kError,
         error_message.ToString()));
   }
 }
@@ -328,7 +328,8 @@
           UseCounter::Count(document, WebFeature::kSrcsetDroppedCandidate);
           if (document->GetFrame()) {
             document->GetFrame()->Console().AddMessage(ConsoleMessage::Create(
-                kOtherMessageSource, mojom::ConsoleMessageLevel::kError,
+                mojom::ConsoleMessageSource::kOther,
+                mojom::ConsoleMessageLevel::kError,
                 String("Dropped srcset candidate ") +
                     JSONValue::QuoteString(
                         String(image_url_start,
diff --git a/third_party/blink/renderer/core/html/parser/xss_auditor.cc b/third_party/blink/renderer/core/html/parser/xss_auditor.cc
index 521a192..5bb43e5 100644
--- a/third_party/blink/renderer/core/html/parser/xss_auditor.cc
+++ b/third_party/blink/renderer/core/html/parser/xss_auditor.cc
@@ -438,7 +438,8 @@
     }
     if (xss_protection_header == kReflectedXSSInvalid) {
       document->AddConsoleMessage(ConsoleMessage::Create(
-          kSecurityMessageSource, mojom::ConsoleMessageLevel::kError,
+          mojom::ConsoleMessageSource::kSecurity,
+          mojom::ConsoleMessageLevel::kError,
           "Error parsing header X-XSS-Protection: " + header_value + ": " +
               error_details + " at character position " +
               String::Format("%u", error_position) +
diff --git a/third_party/blink/renderer/core/html/parser/xss_auditor_delegate.cc b/third_party/blink/renderer/core/html/parser/xss_auditor_delegate.cc
index 17b2484..cf2e8cd9 100644
--- a/third_party/blink/renderer/core/html/parser/xss_auditor_delegate.cc
+++ b/third_party/blink/renderer/core/html/parser/xss_auditor_delegate.cc
@@ -106,8 +106,8 @@
                                    : WebFeature::kXSSAuditorBlockedScript);
 
   document_->AddConsoleMessage(ConsoleMessage::Create(
-      kJSMessageSource, mojom::ConsoleMessageLevel::kError,
-      xss_info.BuildConsoleError()));
+      mojom::ConsoleMessageSource::kJavaScript,
+      mojom::ConsoleMessageLevel::kError, xss_info.BuildConsoleError()));
 
   LocalFrame* local_frame = document_->GetFrame();
   FrameLoader& frame_loader = local_frame->Loader();
diff --git a/third_party/blink/renderer/core/html/portal/html_portal_element.cc b/third_party/blink/renderer/core/html/portal/html_portal_element.cc
index 772c175..b0d5b837 100644
--- a/third_party/blink/renderer/core/html/portal/html_portal_element.cc
+++ b/third_party/blink/renderer/core/html/portal/html_portal_element.cc
@@ -232,7 +232,8 @@
   // We don't support embedding portals in nested browsing contexts.
   if (!GetDocument().GetFrame()->IsMainFrame()) {
     GetDocument().AddConsoleMessage(ConsoleMessage::Create(
-        kRenderingMessageSource, mojom::ConsoleMessageLevel::kWarning,
+        mojom::ConsoleMessageSource::kRendering,
+        mojom::ConsoleMessageLevel::kWarning,
         "Cannot use <portal> in a nested browsing context."));
     return result;
   }
@@ -280,8 +281,8 @@
     Navigate();
 }
 
-LayoutObject* HTMLPortalElement::CreateLayoutObject(
-    const ComputedStyle& style) {
+LayoutObject* HTMLPortalElement::CreateLayoutObject(const ComputedStyle& style,
+                                                    LegacyLayout) {
   return new LayoutIFrame(this);
 }
 
diff --git a/third_party/blink/renderer/core/html/portal/html_portal_element.h b/third_party/blink/renderer/core/html/portal/html_portal_element.h
index 8c60c61c..cec413c 100644
--- a/third_party/blink/renderer/core/html/portal/html_portal_element.h
+++ b/third_party/blink/renderer/core/html/portal/html_portal_element.h
@@ -73,7 +73,7 @@
   // Element overrides
   bool IsURLAttribute(const Attribute&) const override;
   void ParseAttribute(const AttributeModificationParams&) override;
-  LayoutObject* CreateLayoutObject(const ComputedStyle&) override;
+  LayoutObject* CreateLayoutObject(const ComputedStyle&, LegacyLayout) override;
 
   // HTMLFrameOwnerElement overrides
   ParsedFeaturePolicy ConstructContainerPolicy(Vector<String>*) const override {
diff --git a/third_party/blink/renderer/core/html/shadow/details_marker_control.cc b/third_party/blink/renderer/core/html/shadow/details_marker_control.cc
index a57b5ce..5c46dc4 100644
--- a/third_party/blink/renderer/core/html/shadow/details_marker_control.cc
+++ b/third_party/blink/renderer/core/html/shadow/details_marker_control.cc
@@ -38,7 +38,8 @@
 DetailsMarkerControl::DetailsMarkerControl(Document& document)
     : HTMLDivElement(document) {}
 
-LayoutObject* DetailsMarkerControl::CreateLayoutObject(const ComputedStyle&) {
+LayoutObject* DetailsMarkerControl::CreateLayoutObject(const ComputedStyle&,
+                                                       LegacyLayout) {
   return new LayoutDetailsMarker(this);
 }
 
diff --git a/third_party/blink/renderer/core/html/shadow/details_marker_control.h b/third_party/blink/renderer/core/html/shadow/details_marker_control.h
index 95f42761..03de26a 100644
--- a/third_party/blink/renderer/core/html/shadow/details_marker_control.h
+++ b/third_party/blink/renderer/core/html/shadow/details_marker_control.h
@@ -44,7 +44,7 @@
   static DetailsMarkerControl* Create(Document&);
 
  private:
-  LayoutObject* CreateLayoutObject(const ComputedStyle&) override;
+  LayoutObject* CreateLayoutObject(const ComputedStyle&, LegacyLayout) override;
   bool LayoutObjectIsNeeded(const ComputedStyle&) const override;
 
   HTMLSummaryElement* SummaryElement() const;
diff --git a/third_party/blink/renderer/core/html/track/text_track_container.cc b/third_party/blink/renderer/core/html/track/text_track_container.cc
index 9c58cb28..85f8ab9d 100644
--- a/third_party/blink/renderer/core/html/track/text_track_container.cc
+++ b/third_party/blink/renderer/core/html/track/text_track_container.cc
@@ -85,7 +85,8 @@
   return element;
 }
 
-LayoutObject* TextTrackContainer::CreateLayoutObject(const ComputedStyle&) {
+LayoutObject* TextTrackContainer::CreateLayoutObject(const ComputedStyle&,
+                                                     LegacyLayout) {
   // TODO(mstensho): Should use LayoutObjectFactory to create the right type of
   // object here, to enable LayoutNG, but currently we can't, because this will
   // typically be a child of LayoutVideo (a legacy type), and we'll typically
diff --git a/third_party/blink/renderer/core/html/track/text_track_container.h b/third_party/blink/renderer/core/html/track/text_track_container.h
index 0f369a3..f381cb6 100644
--- a/third_party/blink/renderer/core/html/track/text_track_container.h
+++ b/third_party/blink/renderer/core/html/track/text_track_container.h
@@ -58,7 +58,7 @@
   bool IsTextTrackContainer() const override { return true; }
   void ObserveSizeChanges(Element&);
 
-  LayoutObject* CreateLayoutObject(const ComputedStyle&) override;
+  LayoutObject* CreateLayoutObject(const ComputedStyle&, LegacyLayout) override;
 
   Member<ResizeObserver> video_size_observer_;
   float default_font_size_;
diff --git a/third_party/blink/renderer/core/html/track/vtt/vtt_cue.cc b/third_party/blink/renderer/core/html/track/vtt/vtt_cue.cc
index b0c08f3..8358b98 100644
--- a/third_party/blink/renderer/core/html/track/vtt/vtt_cue.cc
+++ b/third_party/blink/renderer/core/html/track/vtt/vtt_cue.cc
@@ -218,13 +218,14 @@
   snap_to_lines_position_ = display_parameters.snap_to_lines_position;
 }
 
-LayoutObject* VTTCueBox::CreateLayoutObject(const ComputedStyle& style) {
+LayoutObject* VTTCueBox::CreateLayoutObject(const ComputedStyle& style,
+                                            LegacyLayout legacy) {
   // If WebVTT Regions are used, the regular WebVTT layout algorithm is no
   // longer necessary, since cues having the region parameter set do not have
   // any positioning parameters. Also, in this case, the regions themselves
   // have positioning information.
   if (style.GetPosition() == EPosition::kRelative)
-    return HTMLDivElement::CreateLayoutObject(style);
+    return HTMLDivElement::CreateLayoutObject(style, legacy);
 
   return new LayoutVTTCue(this, snap_to_lines_position_);
 }
diff --git a/third_party/blink/renderer/core/html/track/vtt/vtt_cue.h b/third_party/blink/renderer/core/html/track/vtt/vtt_cue.h
index d5265a6..9194c39 100644
--- a/third_party/blink/renderer/core/html/track/vtt/vtt_cue.h
+++ b/third_party/blink/renderer/core/html/track/vtt/vtt_cue.h
@@ -70,7 +70,7 @@
   void ApplyCSSProperties(const VTTDisplayParameters&);
 
  private:
-  LayoutObject* CreateLayoutObject(const ComputedStyle&) override;
+  LayoutObject* CreateLayoutObject(const ComputedStyle&, LegacyLayout) override;
 
   // The computed line position for snap-to-lines layout, and NaN for
   // non-snap-to-lines layout where no adjustment should take place.
diff --git a/third_party/blink/renderer/core/inspector/BUILD.gn b/third_party/blink/renderer/core/inspector/BUILD.gn
index e7964cd..72b1d65e 100644
--- a/third_party/blink/renderer/core/inspector/BUILD.gn
+++ b/third_party/blink/renderer/core/inspector/BUILD.gn
@@ -18,7 +18,6 @@
     "console_message.h",
     "console_message_storage.cc",
     "console_message_storage.h",
-    "console_types.h",
     "dev_tools_emulator.cc",
     "dev_tools_emulator.h",
     "dev_tools_host.cc",
diff --git a/third_party/blink/renderer/core/inspector/console_message.cc b/third_party/blink/renderer/core/inspector/console_message.cc
index 3214262..029a7d1 100644
--- a/third_party/blink/renderer/core/inspector/console_message.cc
+++ b/third_party/blink/renderer/core/inspector/console_message.cc
@@ -18,7 +18,7 @@
 
 // static
 ConsoleMessage* ConsoleMessage::CreateForRequest(
-    MessageSource source,
+    mojom::ConsoleMessageSource source,
     mojom::ConsoleMessageLevel level,
     const String& message,
     const String& url,
@@ -33,7 +33,7 @@
 
 // static
 ConsoleMessage* ConsoleMessage::Create(
-    MessageSource source,
+    mojom::ConsoleMessageSource source,
     mojom::ConsoleMessageLevel level,
     const String& message,
     std::unique_ptr<SourceLocation> location) {
@@ -42,7 +42,7 @@
 }
 
 // static
-ConsoleMessage* ConsoleMessage::Create(MessageSource source,
+ConsoleMessage* ConsoleMessage::Create(mojom::ConsoleMessageSource source,
                                        mojom::ConsoleMessageLevel level,
                                        const String& message) {
   return ConsoleMessage::Create(source, level, message,
@@ -55,8 +55,9 @@
     const String& message,
     std::unique_ptr<SourceLocation> location,
     WorkerThread* worker_thread) {
-  ConsoleMessage* console_message = ConsoleMessage::Create(
-      kWorkerMessageSource, level, message, std::move(location));
+  ConsoleMessage* console_message =
+      ConsoleMessage::Create(mojom::ConsoleMessageSource::kWorker, level,
+                             message, std::move(location));
   console_message->worker_id_ =
       IdentifiersFactory::IdFromToken(worker_thread->GetDevToolsWorkerToken());
   return console_message;
@@ -65,9 +66,9 @@
 ConsoleMessage* ConsoleMessage::CreateFromWebConsoleMessage(
     const WebConsoleMessage& message,
     LocalFrame* local_frame) {
-  MessageSource message_source = message.nodes.empty()
-                                     ? kOtherMessageSource
-                                     : kRecommendationMessageSource;
+  mojom::ConsoleMessageSource message_source =
+      message.nodes.empty() ? mojom::ConsoleMessageSource::kOther
+                            : mojom::ConsoleMessageSource::kRecommendation;
 
   ConsoleMessage* console_message = ConsoleMessage::Create(
       message_source, message.level, message.text,
@@ -84,7 +85,7 @@
   return console_message;
 }
 
-ConsoleMessage::ConsoleMessage(MessageSource source,
+ConsoleMessage::ConsoleMessage(mojom::ConsoleMessageSource source,
                                mojom::ConsoleMessageLevel level,
                                const String& message,
                                std::unique_ptr<SourceLocation> location)
@@ -109,7 +110,7 @@
   return timestamp_;
 }
 
-MessageSource ConsoleMessage::Source() const {
+mojom::ConsoleMessageSource ConsoleMessage::Source() const {
   return source_;
 }
 
diff --git a/third_party/blink/renderer/core/inspector/console_message.h b/third_party/blink/renderer/core/inspector/console_message.h
index 90d6533..2d9eaf6 100644
--- a/third_party/blink/renderer/core/inspector/console_message.h
+++ b/third_party/blink/renderer/core/inspector/console_message.h
@@ -8,7 +8,6 @@
 #include "third_party/blink/public/mojom/devtools/console_message.mojom-shared.h"
 #include "third_party/blink/renderer/core/core_export.h"
 #include "third_party/blink/renderer/core/dom/dom_node_ids.h"
-#include "third_party/blink/renderer/core/inspector/console_types.h"
 #include "third_party/blink/renderer/platform/heap/handle.h"
 #include "third_party/blink/renderer/platform/wtf/forward.h"
 #include "third_party/blink/renderer/platform/wtf/text/wtf_string.h"
@@ -25,18 +24,18 @@
     : public GarbageCollectedFinalized<ConsoleMessage> {
  public:
   // Location must be non-null.
-  static ConsoleMessage* Create(MessageSource,
+  static ConsoleMessage* Create(mojom::ConsoleMessageSource,
                                 mojom::ConsoleMessageLevel,
                                 const String& message,
                                 std::unique_ptr<SourceLocation>);
 
   // Shortcut when location is unknown. Captures current location.
-  static ConsoleMessage* Create(MessageSource,
+  static ConsoleMessage* Create(mojom::ConsoleMessageSource,
                                 mojom::ConsoleMessageLevel,
                                 const String& message);
 
   // This method captures current location if available.
-  static ConsoleMessage* CreateForRequest(MessageSource,
+  static ConsoleMessage* CreateForRequest(mojom::ConsoleMessageSource,
                                           mojom::ConsoleMessageLevel,
                                           const String& message,
                                           const String& url,
@@ -53,7 +52,7 @@
   static ConsoleMessage* CreateFromWebConsoleMessage(const WebConsoleMessage&,
                                                      LocalFrame*);
 
-  ConsoleMessage(MessageSource,
+  ConsoleMessage(mojom::ConsoleMessageSource,
                  mojom::ConsoleMessageLevel,
                  const String& message,
                  std::unique_ptr<SourceLocation>);
@@ -62,7 +61,7 @@
   SourceLocation* Location() const;
   const String& RequestIdentifier() const;
   double Timestamp() const;
-  MessageSource Source() const;
+  mojom::ConsoleMessageSource Source() const;
   mojom::ConsoleMessageLevel Level() const;
   const String& Message() const;
   const String& WorkerId() const;
@@ -73,7 +72,7 @@
   void Trace(blink::Visitor*);
 
  private:
-  MessageSource source_;
+  mojom::ConsoleMessageSource source_;
   mojom::ConsoleMessageLevel level_;
   String message_;
   std::unique_ptr<SourceLocation> location_;
diff --git a/third_party/blink/renderer/core/inspector/console_message_storage.cc b/third_party/blink/renderer/core/inspector/console_message_storage.cc
index 75f14aa..0a26ad2 100644
--- a/third_party/blink/renderer/core/inspector/console_message_storage.cc
+++ b/third_party/blink/renderer/core/inspector/console_message_storage.cc
@@ -13,35 +13,35 @@
 
 namespace {
 
-const char* MessageSourceToString(MessageSource source) {
+const char* MessageSourceToString(mojom::ConsoleMessageSource source) {
   switch (source) {
-    case kXMLMessageSource:
+    case mojom::ConsoleMessageSource::kXml:
       return "XML";
-    case kJSMessageSource:
+    case mojom::ConsoleMessageSource::kJavaScript:
       return "JS";
-    case kNetworkMessageSource:
+    case mojom::ConsoleMessageSource::kNetwork:
       return "Network";
-    case kConsoleAPIMessageSource:
+    case mojom::ConsoleMessageSource::kConsoleApi:
       return "ConsoleAPI";
-    case kStorageMessageSource:
+    case mojom::ConsoleMessageSource::kStorage:
       return "Storage";
-    case kAppCacheMessageSource:
+    case mojom::ConsoleMessageSource::kAppCache:
       return "AppCache";
-    case kRenderingMessageSource:
+    case mojom::ConsoleMessageSource::kRendering:
       return "Rendering";
-    case kSecurityMessageSource:
+    case mojom::ConsoleMessageSource::kSecurity:
       return "Security";
-    case kOtherMessageSource:
+    case mojom::ConsoleMessageSource::kOther:
       return "Other";
-    case kDeprecationMessageSource:
+    case mojom::ConsoleMessageSource::kDeprecation:
       return "Deprecation";
-    case kWorkerMessageSource:
+    case mojom::ConsoleMessageSource::kWorker:
       return "Worker";
-    case kViolationMessageSource:
+    case mojom::ConsoleMessageSource::kViolation:
       return "Violation";
-    case kInterventionMessageSource:
+    case mojom::ConsoleMessageSource::kIntervention:
       return "Intervention";
-    case kRecommendationMessageSource:
+    case mojom::ConsoleMessageSource::kRecommendation:
       return "Recommendation";
   }
   LOG(FATAL) << "Unreachable code.";
diff --git a/third_party/blink/renderer/core/inspector/console_types.h b/third_party/blink/renderer/core/inspector/console_types.h
deleted file mode 100644
index 0598949..0000000
--- a/third_party/blink/renderer/core/inspector/console_types.h
+++ /dev/null
@@ -1,28 +0,0 @@
-// Copyright 2016 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef THIRD_PARTY_BLINK_RENDERER_CORE_INSPECTOR_CONSOLE_TYPES_H_
-#define THIRD_PARTY_BLINK_RENDERER_CORE_INSPECTOR_CONSOLE_TYPES_H_
-
-namespace blink {
-
-enum MessageSource {
-  kXMLMessageSource,
-  kJSMessageSource,
-  kNetworkMessageSource,
-  kConsoleAPIMessageSource,
-  kStorageMessageSource,
-  kAppCacheMessageSource,
-  kRenderingMessageSource,
-  kSecurityMessageSource,
-  kOtherMessageSource,
-  kDeprecationMessageSource,
-  kWorkerMessageSource,
-  kViolationMessageSource,
-  kInterventionMessageSource,
-  kRecommendationMessageSource
-};
-}
-
-#endif  // !defined(ConsoleTypes_h)
diff --git a/third_party/blink/renderer/core/inspector/inspector_log_agent.cc b/third_party/blink/renderer/core/inspector/inspector_log_agent.cc
index 59b5969..0c76178 100644
--- a/third_party/blink/renderer/core/inspector/inspector_log_agent.cc
+++ b/third_party/blink/renderer/core/inspector/inspector_log_agent.cc
@@ -18,34 +18,34 @@
 
 namespace {
 
-String MessageSourceValue(MessageSource source) {
-  DCHECK(source != kConsoleAPIMessageSource);
+String MessageSourceValue(mojom::ConsoleMessageSource source) {
+  DCHECK(source != mojom::ConsoleMessageSource::kConsoleApi);
   switch (source) {
-    case kXMLMessageSource:
+    case mojom::ConsoleMessageSource::kXml:
       return protocol::Log::LogEntry::SourceEnum::Xml;
-    case kJSMessageSource:
+    case mojom::ConsoleMessageSource::kJavaScript:
       return protocol::Log::LogEntry::SourceEnum::Javascript;
-    case kNetworkMessageSource:
+    case mojom::ConsoleMessageSource::kNetwork:
       return protocol::Log::LogEntry::SourceEnum::Network;
-    case kStorageMessageSource:
+    case mojom::ConsoleMessageSource::kStorage:
       return protocol::Log::LogEntry::SourceEnum::Storage;
-    case kAppCacheMessageSource:
+    case mojom::ConsoleMessageSource::kAppCache:
       return protocol::Log::LogEntry::SourceEnum::Appcache;
-    case kRenderingMessageSource:
+    case mojom::ConsoleMessageSource::kRendering:
       return protocol::Log::LogEntry::SourceEnum::Rendering;
-    case kSecurityMessageSource:
+    case mojom::ConsoleMessageSource::kSecurity:
       return protocol::Log::LogEntry::SourceEnum::Security;
-    case kOtherMessageSource:
+    case mojom::ConsoleMessageSource::kOther:
       return protocol::Log::LogEntry::SourceEnum::Other;
-    case kDeprecationMessageSource:
+    case mojom::ConsoleMessageSource::kDeprecation:
       return protocol::Log::LogEntry::SourceEnum::Deprecation;
-    case kWorkerMessageSource:
+    case mojom::ConsoleMessageSource::kWorker:
       return protocol::Log::LogEntry::SourceEnum::Worker;
-    case kViolationMessageSource:
+    case mojom::ConsoleMessageSource::kViolation:
       return protocol::Log::LogEntry::SourceEnum::Violation;
-    case kInterventionMessageSource:
+    case mojom::ConsoleMessageSource::kIntervention:
       return protocol::Log::LogEntry::SourceEnum::Intervention;
-    case kRecommendationMessageSource:
+    case mojom::ConsoleMessageSource::kRecommendation:
       return protocol::Log::LogEntry::SourceEnum::Recommendation;
     default:
       return protocol::Log::LogEntry::SourceEnum::Other;
@@ -123,10 +123,10 @@
     entry->setStackTrace(std::move(stack_trace));
   if (message->Location()->LineNumber())
     entry->setLineNumber(message->Location()->LineNumber() - 1);
-  if (message->Source() == kWorkerMessageSource &&
+  if (message->Source() == mojom::ConsoleMessageSource::kWorker &&
       !message->WorkerId().IsEmpty())
     entry->setWorkerId(message->WorkerId());
-  if (message->Source() == kNetworkMessageSource &&
+  if (message->Source() == mojom::ConsoleMessageSource::kNetwork &&
       !message->RequestIdentifier().IsNull()) {
     entry->setNetworkRequestId(message->RequestIdentifier());
   }
@@ -256,8 +256,8 @@
       "Forced reflow while executing JavaScript took %" PRId64 "ms",
       duration.InMilliseconds());
   ConsoleMessage* message = ConsoleMessage::Create(
-      kViolationMessageSource, mojom::ConsoleMessageLevel::kVerbose,
-      message_text);
+      mojom::ConsoleMessageSource::kViolation,
+      mojom::ConsoleMessageLevel::kVerbose, message_text);
   ConsoleMessageAdded(message);
 }
 
@@ -266,8 +266,8 @@
                                                base::TimeDelta time,
                                                SourceLocation* location) {
   ConsoleMessage* message = ConsoleMessage::Create(
-      kViolationMessageSource, mojom::ConsoleMessageLevel::kVerbose, text,
-      location->Clone());
+      mojom::ConsoleMessageSource::kViolation,
+      mojom::ConsoleMessageLevel::kVerbose, text, location->Clone());
   ConsoleMessageAdded(message);
 }
 
diff --git a/third_party/blink/renderer/core/inspector/main_thread_debugger.cc b/third_party/blink/renderer/core/inspector/main_thread_debugger.cc
index 54da09f..8eb3c101 100644
--- a/third_party/blink/renderer/core/inspector/main_thread_debugger.cc
+++ b/third_party/blink/renderer/core/inspector/main_thread_debugger.cc
@@ -103,11 +103,12 @@
   instance_ = nullptr;
 }
 
-void MainThreadDebugger::ReportConsoleMessage(ExecutionContext* context,
-                                              MessageSource source,
-                                              mojom::ConsoleMessageLevel level,
-                                              const String& message,
-                                              SourceLocation* location) {
+void MainThreadDebugger::ReportConsoleMessage(
+    ExecutionContext* context,
+    mojom::ConsoleMessageSource source,
+    mojom::ConsoleMessageLevel level,
+    const String& message,
+    SourceLocation* location) {
   if (LocalFrame* frame = ToFrame(context))
     frame->Console().ReportMessageToClient(source, level, message, location);
 }
@@ -189,8 +190,9 @@
   }
 
   frame->Console().ReportMessageToClient(
-      kJSMessageSource, mojom::ConsoleMessageLevel::kError,
-      event->MessageForConsole(), event->Location());
+      mojom::ConsoleMessageSource::kJavaScript,
+      mojom::ConsoleMessageLevel::kError, event->MessageForConsole(),
+      event->Location());
 
   const String default_message = "Uncaught";
   if (script_state && script_state->ContextIsValid()) {
@@ -336,9 +338,10 @@
   std::unique_ptr<SourceLocation> location = std::make_unique<SourceLocation>(
       ToCoreString(url), line_number, column_number,
       stack_trace ? stack_trace->clone() : nullptr, 0);
-  frame->Console().ReportMessageToClient(kConsoleAPIMessageSource,
-                                         V8MessageLevelToMessageLevel(level),
-                                         ToCoreString(message), location.get());
+  frame->Console().ReportMessageToClient(
+      mojom::ConsoleMessageSource::kConsoleApi,
+      V8MessageLevelToMessageLevel(level), ToCoreString(message),
+      location.get());
 }
 
 void MainThreadDebugger::consoleClear(int context_group_id) {
diff --git a/third_party/blink/renderer/core/inspector/main_thread_debugger.h b/third_party/blink/renderer/core/inspector/main_thread_debugger.h
index 4f6ecca..747c186 100644
--- a/third_party/blink/renderer/core/inspector/main_thread_debugger.h
+++ b/third_party/blink/renderer/core/inspector/main_thread_debugger.h
@@ -80,7 +80,7 @@
 
  private:
   void ReportConsoleMessage(ExecutionContext*,
-                            MessageSource,
+                            mojom::ConsoleMessageSource,
                             mojom::ConsoleMessageLevel,
                             const String& message,
                             SourceLocation*) override;
diff --git a/third_party/blink/renderer/core/inspector/thread_debugger.cc b/third_party/blink/renderer/core/inspector/thread_debugger.cc
index bab91993..e247b37 100644
--- a/third_party/blink/renderer/core/inspector/thread_debugger.cc
+++ b/third_party/blink/renderer/core/inspector/thread_debugger.cc
@@ -135,9 +135,9 @@
   else if (message.StartsWith("Uncaught "))
     message = message.Substring(0, 8) + " (in promise)" + message.Substring(8);
 
-  ReportConsoleMessage(ToExecutionContext(context), kJSMessageSource,
-                       mojom::ConsoleMessageLevel::kError, message,
-                       location.get());
+  ReportConsoleMessage(
+      ToExecutionContext(context), mojom::ConsoleMessageSource::kJavaScript,
+      mojom::ConsoleMessageLevel::kError, message, location.get());
   String url = location->Url();
   return GetV8Inspector()->exceptionThrown(
       context, ToV8InspectorStringView(default_message), exception,
diff --git a/third_party/blink/renderer/core/inspector/thread_debugger.h b/third_party/blink/renderer/core/inspector/thread_debugger.h
index 685a84c3..8d0345d 100644
--- a/third_party/blink/renderer/core/inspector/thread_debugger.h
+++ b/third_party/blink/renderer/core/inspector/thread_debugger.h
@@ -10,7 +10,6 @@
 #include "third_party/blink/public/mojom/devtools/console_message.mojom-shared.h"
 #include "third_party/blink/renderer/core/core_export.h"
 #include "third_party/blink/renderer/core/dom/user_gesture_indicator.h"
-#include "third_party/blink/renderer/core/inspector/console_types.h"
 #include "third_party/blink/renderer/platform/bindings/v8_per_isolate_data.h"
 #include "third_party/blink/renderer/platform/cross_thread_copier.h"
 #include "third_party/blink/renderer/platform/timer.h"
@@ -61,7 +60,7 @@
  protected:
   virtual int ContextGroupId(ExecutionContext*) = 0;
   virtual void ReportConsoleMessage(ExecutionContext*,
-                                    MessageSource,
+                                    mojom::ConsoleMessageSource,
                                     mojom::ConsoleMessageLevel,
                                     const String& message,
                                     SourceLocation*) = 0;
diff --git a/third_party/blink/renderer/core/inspector/worker_thread_debugger.cc b/third_party/blink/renderer/core/inspector/worker_thread_debugger.cc
index 48d8489..7489904a 100644
--- a/third_party/blink/renderer/core/inspector/worker_thread_debugger.cc
+++ b/third_party/blink/renderer/core/inspector/worker_thread_debugger.cc
@@ -73,7 +73,7 @@
 
 void WorkerThreadDebugger::ReportConsoleMessage(
     ExecutionContext* context,
-    MessageSource source,
+    mojom::ConsoleMessageSource source,
     mojom::ConsoleMessageLevel level,
     const String& message,
     SourceLocation* location) {
@@ -133,8 +133,9 @@
 void WorkerThreadDebugger::ExceptionThrown(WorkerThread* worker_thread,
                                            ErrorEvent* event) {
   worker_thread->GetWorkerReportingProxy().ReportConsoleMessage(
-      kJSMessageSource, mojom::ConsoleMessageLevel::kError,
-      event->MessageForConsole(), event->Location());
+      mojom::ConsoleMessageSource::kJavaScript,
+      mojom::ConsoleMessageLevel::kError, event->MessageForConsole(),
+      event->Location());
 
   const String default_message = "Uncaught";
   ScriptState* script_state =
@@ -245,8 +246,9 @@
       ToCoreString(url), line_number, column_number,
       stack_trace ? stack_trace->clone() : nullptr, 0);
   worker_thread->GetWorkerReportingProxy().ReportConsoleMessage(
-      kConsoleAPIMessageSource, V8MessageLevelToMessageLevel(level),
-      ToCoreString(message), location.get());
+      mojom::ConsoleMessageSource::kConsoleApi,
+      V8MessageLevelToMessageLevel(level), ToCoreString(message),
+      location.get());
 }
 
 void WorkerThreadDebugger::consoleClear(int context_group_id) {
diff --git a/third_party/blink/renderer/core/inspector/worker_thread_debugger.h b/third_party/blink/renderer/core/inspector/worker_thread_debugger.h
index dce0ddd..53d12b4 100644
--- a/third_party/blink/renderer/core/inspector/worker_thread_debugger.h
+++ b/third_party/blink/renderer/core/inspector/worker_thread_debugger.h
@@ -63,7 +63,7 @@
  private:
   int ContextGroupId(ExecutionContext*) override;
   void ReportConsoleMessage(ExecutionContext*,
-                            MessageSource,
+                            mojom::ConsoleMessageSource,
                             mojom::ConsoleMessageLevel,
                             const String& message,
                             SourceLocation*) override;
diff --git a/third_party/blink/renderer/core/layout/custom/css_layout_definition.cc b/third_party/blink/renderer/core/layout/custom/css_layout_definition.cc
index dd21a6c..fc4f4f10 100644
--- a/third_party/blink/renderer/core/layout/custom/css_layout_definition.cc
+++ b/third_party/blink/renderer/core/layout/custom/css_layout_definition.cc
@@ -159,7 +159,8 @@
       CustomLayoutFragment* fragment = fragment_request->PerformLayout(isolate);
       if (!fragment) {
         execution_context->AddConsoleMessage(ConsoleMessage::Create(
-            kJSMessageSource, mojom::ConsoleMessageLevel::kInfo,
+            mojom::ConsoleMessageSource::kJavaScript,
+            mojom::ConsoleMessageLevel::kInfo,
             "Unable to perform layout request due to an invalid child, "
             "falling back to block layout."));
         return false;
@@ -186,7 +187,8 @@
 
         if (!fragment) {
           execution_context->AddConsoleMessage(ConsoleMessage::Create(
-              kJSMessageSource, mojom::ConsoleMessageLevel::kInfo,
+              mojom::ConsoleMessageSource::kJavaScript,
+              mojom::ConsoleMessageLevel::kInfo,
               "Unable to perform layout request due to an invalid child, "
               "falling back to block layout."));
           return false;
@@ -208,10 +210,11 @@
 
     // We recieved something that wasn't either a CustomLayoutFragmentRequest,
     // or a sequence of CustomLayoutFragmentRequests. Fallback to block layout.
-    execution_context->AddConsoleMessage(ConsoleMessage::Create(
-        kJSMessageSource, mojom::ConsoleMessageLevel::kInfo,
-        "Unable to parse the layout request, "
-        "falling back to block layout."));
+    execution_context->AddConsoleMessage(
+        ConsoleMessage::Create(mojom::ConsoleMessageSource::kJavaScript,
+                               mojom::ConsoleMessageLevel::kInfo,
+                               "Unable to parse the layout request, "
+                               "falling back to block layout."));
     return false;
   }
 
@@ -231,10 +234,11 @@
   if (exception_state.HadException()) {
     V8ScriptRunner::ReportException(isolate, exception_state.GetException());
     exception_state.ClearException();
-    execution_context->AddConsoleMessage(ConsoleMessage::Create(
-        kJSMessageSource, mojom::ConsoleMessageLevel::kInfo,
-        "Unable to parse the layout function "
-        "result, falling back to block layout."));
+    execution_context->AddConsoleMessage(
+        ConsoleMessage::Create(mojom::ConsoleMessageSource::kJavaScript,
+                               mojom::ConsoleMessageLevel::kInfo,
+                               "Unable to parse the layout function "
+                               "result, falling back to block layout."));
     return false;
   }
 
@@ -253,10 +257,11 @@
   if (exception_state.HadException()) {
     V8ScriptRunner::ReportException(isolate, exception_state.GetException());
     exception_state.ClearException();
-    execution_context->AddConsoleMessage(ConsoleMessage::Create(
-        kJSMessageSource, mojom::ConsoleMessageLevel::kInfo,
-        "Unable to serialize the data provided in the "
-        "result, falling back to block layout."));
+    execution_context->AddConsoleMessage(
+        ConsoleMessage::Create(mojom::ConsoleMessageSource::kJavaScript,
+                               mojom::ConsoleMessageLevel::kInfo,
+                               "Unable to serialize the data provided in the "
+                               "result, falling back to block layout."));
     return false;
   }
 
@@ -274,7 +279,8 @@
   V8ScriptRunner::ReportException(isolate, exception_state->GetException());
   exception_state->ClearException();
   execution_context->AddConsoleMessage(ConsoleMessage::Create(
-      kJSMessageSource, mojom::ConsoleMessageLevel::kInfo,
+      mojom::ConsoleMessageSource::kJavaScript,
+      mojom::ConsoleMessageLevel::kInfo,
       "The layout function failed, falling back to block layout."));
 }
 
diff --git a/third_party/blink/renderer/core/layout/custom/layout_custom.cc b/third_party/blink/renderer/core/layout/custom/layout_custom.cc
index bdb310d..5663836 100644
--- a/third_party/blink/renderer/core/layout/custom/layout_custom.cc
+++ b/third_party/blink/renderer/core/layout/custom/layout_custom.cc
@@ -165,7 +165,8 @@
 
     if (!instance_) {
       GetDocument().AddConsoleMessage(ConsoleMessage::Create(
-          kJSMessageSource, mojom::ConsoleMessageLevel::kInfo,
+          mojom::ConsoleMessageSource::kJavaScript,
+          mojom::ConsoleMessageLevel::kInfo,
           "Unable to create an instance of layout class '" + name +
               "', falling back to block layout."));
       return false;
@@ -194,18 +195,20 @@
       }
 
       if (index >= child_fragments.size()) {
-        GetDocument().AddConsoleMessage(ConsoleMessage::Create(
-            kJSMessageSource, mojom::ConsoleMessageLevel::kInfo,
-            "Chrome currently requires exactly one "
-            "LayoutFragment per LayoutChild, "
-            "falling back to block layout."));
+        GetDocument().AddConsoleMessage(
+            ConsoleMessage::Create(mojom::ConsoleMessageSource::kJavaScript,
+                                   mojom::ConsoleMessageLevel::kInfo,
+                                   "Chrome currently requires exactly one "
+                                   "LayoutFragment per LayoutChild, "
+                                   "falling back to block layout."));
         return false;
       }
 
       CustomLayoutFragment* fragment = child_fragments[index++];
       if (!fragment->IsValid()) {
         GetDocument().AddConsoleMessage(ConsoleMessage::Create(
-            kJSMessageSource, mojom::ConsoleMessageLevel::kInfo,
+            mojom::ConsoleMessageSource::kJavaScript,
+            mojom::ConsoleMessageLevel::kInfo,
             "An invalid LayoutFragment was returned from the "
             "layout, falling back to block layout."));
         return false;
@@ -244,11 +247,12 @@
 
     // Currently we only support exactly one LayoutFragment per LayoutChild.
     if (index != child_fragments.size()) {
-      GetDocument().AddConsoleMessage(ConsoleMessage::Create(
-          kJSMessageSource, mojom::ConsoleMessageLevel::kInfo,
-          "Chrome currently requires exactly one "
-          "LayoutFragment per LayoutChild, "
-          "falling back to block layout."));
+      GetDocument().AddConsoleMessage(
+          ConsoleMessage::Create(mojom::ConsoleMessageSource::kJavaScript,
+                                 mojom::ConsoleMessageLevel::kInfo,
+                                 "Chrome currently requires exactly one "
+                                 "LayoutFragment per LayoutChild, "
+                                 "falling back to block layout."));
       return false;
     }
 
diff --git a/third_party/blink/renderer/core/layout/force_legacy_layout_test.cc b/third_party/blink/renderer/core/layout/force_legacy_layout_test.cc
new file mode 100644
index 0000000..3725224
--- /dev/null
+++ b/third_party/blink/renderer/core/layout/force_legacy_layout_test.cc
@@ -0,0 +1,115 @@
+// Copyright 2019 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "testing/gtest/include/gtest/gtest.h"
+#include "third_party/blink/renderer/core/layout/layout_object.h"
+#include "third_party/blink/renderer/core/testing/core_unit_test_helper.h"
+#include "third_party/blink/renderer/platform/runtime_enabled_features.h"
+
+namespace blink {
+namespace {
+
+bool ForcesLegacyLayout(const Element& element) {
+  return element.ShouldForceLegacyLayout() &&
+         !element.GetLayoutObject()->IsLayoutNGMixin();
+}
+
+bool UsesNGLayout(const Element& element) {
+  return !element.ShouldForceLegacyLayout() &&
+         element.GetLayoutObject()->IsLayoutNGMixin();
+}
+
+}  // anonymous namespace
+
+class ForceLegacyLayoutTest : public RenderingTest {
+ public:
+  ForceLegacyLayoutTest()
+      : RenderingTest(SingleChildLocalFrameClient::Create()) {}
+};
+
+TEST_F(ForceLegacyLayoutTest, ForceLegacyBfcRecalcAncestorStyle) {
+  if (!RuntimeEnabledFeatures::LayoutNGEnabled())
+    return;
+
+  // This test assumes that contenteditable forces the entire block formatting
+  // context to use legacy layout. This will eventually change (when
+  // contenteditable is natively supported in LayoutNG), and when that happens,
+  // we'll need to come up with a different test here (provided that we're going
+  // to keep the legacy-forcing machinery for other reasons than
+  // contenteditable).
+  GetDocument().SetBaseURLOverride(KURL("http://test.com"));
+  SetBodyInnerHTML(R"HTML(
+    <div id="bfc" style="overflow:hidden;">
+      <div id="container" style="display:list-item;">
+        <div id="middle">
+          <div id="inner" style="overflow:hidden;">
+            <div id="child"></div>
+          </div>
+        </div>
+      </div>
+    </div>
+  )HTML");
+  UpdateAllLifecyclePhasesForTest();
+
+  Element* body = GetDocument().body();
+  Element* bfc = GetDocument().getElementById("bfc");
+  Element* container = GetDocument().getElementById("container");
+  Element* middle = GetDocument().getElementById("middle");
+  Element* inner = GetDocument().getElementById("inner");
+  Element* child = GetDocument().getElementById("child");
+
+  // Initially, everything should be laid out by NG.
+  EXPECT_TRUE(UsesNGLayout(*body));
+  EXPECT_TRUE(UsesNGLayout(*bfc));
+  EXPECT_TRUE(UsesNGLayout(*container));
+  EXPECT_TRUE(UsesNGLayout(*middle));
+  EXPECT_TRUE(UsesNGLayout(*inner));
+  EXPECT_TRUE(UsesNGLayout(*child));
+
+  // Enable contenteditable on an element that establishes a formatting context.
+  inner->setAttribute(html_names::kContenteditableAttr, "true");
+  UpdateAllLifecyclePhasesForTest();
+  EXPECT_TRUE(UsesNGLayout(*body));
+  EXPECT_TRUE(UsesNGLayout(*bfc));
+  EXPECT_TRUE(UsesNGLayout(*container));
+  EXPECT_TRUE(UsesNGLayout(*middle));
+  EXPECT_TRUE(ForcesLegacyLayout(*inner));
+  EXPECT_TRUE(ForcesLegacyLayout(*child));
+
+  // Remove overflow:hidden, so that the contenteditable element no longer
+  // establishes a formatting context.
+  inner->removeAttribute(html_names::kStyleAttr);
+  UpdateAllLifecyclePhasesForTest();
+  EXPECT_TRUE(UsesNGLayout(*body));
+  EXPECT_TRUE(ForcesLegacyLayout(*bfc));
+  EXPECT_TRUE(ForcesLegacyLayout(*container));
+  EXPECT_TRUE(ForcesLegacyLayout(*middle));
+  EXPECT_TRUE(ForcesLegacyLayout(*inner));
+  EXPECT_TRUE(ForcesLegacyLayout(*child));
+
+  // Change a non-inherited property. Legacy layout is triggered by #inner, but
+  // should be propagated all the way up to #container (which is the node that
+  // establishes the formatting context (due to overflow:hidden)). We'll now
+  // test that this persists through style recalculation.
+  middle->setAttribute(html_names::kStyleAttr, "background-color:blue;");
+  UpdateAllLifecyclePhasesForTest();
+  EXPECT_TRUE(UsesNGLayout(*body));
+  EXPECT_TRUE(ForcesLegacyLayout(*bfc));
+  EXPECT_TRUE(ForcesLegacyLayout(*container));
+  EXPECT_TRUE(ForcesLegacyLayout(*middle));
+  EXPECT_TRUE(ForcesLegacyLayout(*inner));
+  EXPECT_TRUE(ForcesLegacyLayout(*child));
+
+  // Change a property that requires re-attachment.
+  container->setAttribute(html_names::kStyleAttr, "display:block;");
+  UpdateAllLifecyclePhasesForTest();
+  EXPECT_TRUE(UsesNGLayout(*body));
+  EXPECT_TRUE(ForcesLegacyLayout(*bfc));
+  EXPECT_TRUE(ForcesLegacyLayout(*container));
+  EXPECT_TRUE(ForcesLegacyLayout(*middle));
+  EXPECT_TRUE(ForcesLegacyLayout(*inner));
+  EXPECT_TRUE(ForcesLegacyLayout(*child));
+}
+
+}  // namespace blink
diff --git a/third_party/blink/renderer/core/layout/layout_block.cc b/third_party/blink/renderer/core/layout/layout_block.cc
index 4a882ee..4935335 100644
--- a/third_party/blink/renderer/core/layout/layout_block.cc
+++ b/third_party/blink/renderer/core/layout/layout_block.cc
@@ -2102,15 +2102,19 @@
   scoped_refptr<ComputedStyle> new_style =
       ComputedStyle::CreateAnonymousStyleWithDisplay(parent->StyleRef(),
                                                      new_display);
+
+  LegacyLayout legacy =
+      parent->ForceLegacyLayout() ? LegacyLayout::kForce : LegacyLayout::kAuto;
+
   parent->UpdateAnonymousChildStyle(nullptr, *new_style);
   LayoutBlock* layout_block;
   if (new_display == EDisplay::kFlex) {
     layout_block = LayoutObjectFactory::CreateFlexibleBox(parent->GetDocument(),
-                                                          *new_style);
+                                                          *new_style, legacy);
   } else {
     DCHECK_EQ(new_display, EDisplay::kBlock);
-    layout_block =
-        LayoutObjectFactory::CreateBlockFlow(parent->GetDocument(), *new_style);
+    layout_block = LayoutObjectFactory::CreateBlockFlow(parent->GetDocument(),
+                                                        *new_style, legacy);
   }
   layout_block->SetDocumentForAnonymous(&parent->GetDocument());
   layout_block->SetStyle(std::move(new_style));
diff --git a/third_party/blink/renderer/core/layout/layout_block_flow.cc b/third_party/blink/renderer/core/layout/layout_block_flow.cc
index 9bb8bed..516ae93c 100644
--- a/third_party/blink/renderer/core/layout/layout_block_flow.cc
+++ b/third_party/blink/renderer/core/layout/layout_block_flow.cc
@@ -286,9 +286,10 @@
 
 LayoutBlockFlow* LayoutBlockFlow::CreateAnonymous(
     Document* document,
-    scoped_refptr<ComputedStyle> style) {
+    scoped_refptr<ComputedStyle> style,
+    LegacyLayout legacy) {
   LayoutBlockFlow* layout_block_flow =
-      LayoutObjectFactory::CreateBlockFlow(*document, *style);
+      LayoutObjectFactory::CreateBlockFlow(*document, *style, legacy);
   layout_block_flow->SetDocumentForAnonymous(document);
   layout_block_flow->SetStyle(style);
   return layout_block_flow;
diff --git a/third_party/blink/renderer/core/layout/layout_block_flow.h b/third_party/blink/renderer/core/layout/layout_block_flow.h
index fa4db1e..c097a4e 100644
--- a/third_party/blink/renderer/core/layout/layout_block_flow.h
+++ b/third_party/blink/renderer/core/layout/layout_block_flow.h
@@ -102,7 +102,8 @@
   ~LayoutBlockFlow() override;
 
   static LayoutBlockFlow* CreateAnonymous(Document*,
-                                          scoped_refptr<ComputedStyle>);
+                                          scoped_refptr<ComputedStyle>,
+                                          LegacyLayout);
   bool BeingDestroyed() const { return being_destroyed_; }
 
   bool IsLayoutBlockFlow() const final { return true; }
diff --git a/third_party/blink/renderer/core/layout/layout_block_test.cc b/third_party/blink/renderer/core/layout/layout_block_test.cc
index 86e6e8d..51124e2 100644
--- a/third_party/blink/renderer/core/layout/layout_block_test.cc
+++ b/third_party/blink/renderer/core/layout/layout_block_test.cc
@@ -19,7 +19,8 @@
 
 TEST_F(LayoutBlockTest, LayoutNameCalledWithNullStyle) {
   scoped_refptr<ComputedStyle> style = ComputedStyle::Create();
-  LayoutObject* obj = LayoutBlockFlow::CreateAnonymous(&GetDocument(), style);
+  LayoutObject* obj = LayoutBlockFlow::CreateAnonymous(&GetDocument(), style,
+                                                       LegacyLayout::kAuto);
   obj->SetModifiedStyleOutsideStyleRecalc(nullptr,
                                           LayoutObject::ApplyStyleChanges::kNo);
   EXPECT_FALSE(obj->Style());
diff --git a/third_party/blink/renderer/core/layout/layout_inline.cc b/third_party/blink/renderer/core/layout/layout_inline.cc
index 1e72c0a..5ab78594 100644
--- a/third_party/blink/renderer/core/layout/layout_inline.cc
+++ b/third_party/blink/renderer/core/layout/layout_inline.cc
@@ -532,6 +532,7 @@
     scoped_refptr<ComputedStyle> new_style =
         ComputedStyle::CreateAnonymousStyleWithDisplay(StyleRef(),
                                                        EDisplay::kBlock);
+    const LayoutBlock* containing_block = ContainingBlock();
     // The anon block we create here doesn't exist in the CSS spec, so
     // we need to ensure that any blocks it contains inherit properly
     // from its true parent. This means they must use the direction set by the
@@ -541,7 +542,7 @@
     // but only affect the layout of children we will want to special-case
     // them here too. Writing-mode would be one if it didn't create a
     // formatting context of its own, removing the need for continuations.
-    new_style->SetDirection(ContainingBlock()->StyleRef().Direction());
+    new_style->SetDirection(containing_block->StyleRef().Direction());
 
     // If inside an inline affected by in-flow positioning the block needs to be
     // affected by it too. Giving the block a layer like this allows it to
@@ -550,8 +551,12 @@
             InFlowPositionedInlineAncestor(this))
       new_style->SetPosition(positioned_ancestor->StyleRef().GetPosition());
 
-    LayoutBlockFlow* new_box =
-        LayoutBlockFlow::CreateAnonymous(&GetDocument(), std::move(new_style));
+    LegacyLayout legacy = containing_block->ForceLegacyLayout()
+                              ? LegacyLayout::kForce
+                              : LegacyLayout::kAuto;
+
+    LayoutBlockFlow* new_box = LayoutBlockFlow::CreateAnonymous(
+        &GetDocument(), std::move(new_style), legacy);
     LayoutBoxModelObject* old_continuation = Continuation();
     SetContinuation(new_box);
 
diff --git a/third_party/blink/renderer/core/layout/layout_menu_list.cc b/third_party/blink/renderer/core/layout/layout_menu_list.cc
index 2ee46c4..e27d09f 100644
--- a/third_party/blink/renderer/core/layout/layout_menu_list.cc
+++ b/third_party/blink/renderer/core/layout/layout_menu_list.cc
@@ -91,12 +91,14 @@
   }
 
   // Create an anonymous block.
+  LegacyLayout legacy =
+      ForceLegacyLayout() ? LegacyLayout::kForce : LegacyLayout::kAuto;
   DCHECK(!FirstChild());
-  inner_block_ =
-      LayoutBlockFlow::CreateAnonymous(&GetDocument(), CreateInnerStyle());
+  inner_block_ = LayoutBlockFlow::CreateAnonymous(&GetDocument(),
+                                                  CreateInnerStyle(), legacy);
 
   button_text_ =
-      LayoutText::CreateEmptyAnonymous(GetDocument(), MutableStyle());
+      LayoutText::CreateEmptyAnonymous(GetDocument(), MutableStyle(), legacy);
   // We need to set the text explicitly though it was specified in the
   // constructor because LayoutText doesn't refer to the text
   // specified in the constructor in a case of re-transforming.
diff --git a/third_party/blink/renderer/core/layout/layout_object.cc b/third_party/blink/renderer/core/layout/layout_object.cc
index c35e82a..0ce83093 100644
--- a/third_party/blink/renderer/core/layout/layout_object.cc
+++ b/third_party/blink/renderer/core/layout/layout_object.cc
@@ -209,7 +209,8 @@
 }
 
 LayoutObject* LayoutObject::CreateObject(Element* element,
-                                         const ComputedStyle& style) {
+                                         const ComputedStyle& style,
+                                         LegacyLayout legacy) {
   DCHECK(IsAllowedToModifyLayoutTreeStructure(element->GetDocument()));
 
   // Minimal support for content properties replacing an entire element.
@@ -245,9 +246,9 @@
     case EDisplay::kBlock:
     case EDisplay::kFlowRoot:
     case EDisplay::kInlineBlock:
-      return LayoutObjectFactory::CreateBlockFlow(*element, style);
+      return LayoutObjectFactory::CreateBlockFlow(*element, style, legacy);
     case EDisplay::kListItem:
-      return LayoutObjectFactory::CreateListItem(*element, style);
+      return LayoutObjectFactory::CreateListItem(*element, style, legacy);
     case EDisplay::kTable:
     case EDisplay::kInlineTable:
       return new LayoutTable(element);
@@ -261,16 +262,16 @@
     case EDisplay::kTableColumn:
       return new LayoutTableCol(element);
     case EDisplay::kTableCell:
-      return LayoutObjectFactory::CreateTableCell(*element, style);
+      return LayoutObjectFactory::CreateTableCell(*element, style, legacy);
     case EDisplay::kTableCaption:
-      return LayoutObjectFactory::CreateTableCaption(*element, style);
+      return LayoutObjectFactory::CreateTableCaption(*element, style, legacy);
     case EDisplay::kWebkitBox:
     case EDisplay::kWebkitInlineBox:
       return new LayoutDeprecatedFlexibleBox(*element);
     case EDisplay::kFlex:
     case EDisplay::kInlineFlex:
       UseCounter::Count(element->GetDocument(), WebFeature::kCSSFlexibleBox);
-      return LayoutObjectFactory::CreateFlexibleBox(*element, style);
+      return LayoutObjectFactory::CreateFlexibleBox(*element, style, legacy);
     case EDisplay::kGrid:
     case EDisplay::kInlineGrid:
       UseCounter::Count(element->GetDocument(), WebFeature::kCSSGridLayout);
@@ -300,6 +301,13 @@
   InstanceCounters::IncrementCounter(InstanceCounters::kLayoutObjectCounter);
   if (node_)
     GetFrameView()->IncrementLayoutObjectCount();
+
+  if (const Node* node = GetNode()) {
+    if (const Element* element = ToElementOrNull(node)) {
+      if (element->ShouldForceLegacyLayout())
+        SetForceLegacyLayout();
+    }
+  }
 }
 
 LayoutObject::~LayoutObject() {
diff --git a/third_party/blink/renderer/core/layout/layout_object.h b/third_party/blink/renderer/core/layout/layout_object.h
index 56e0e3c2..9312d5f 100644
--- a/third_party/blink/renderer/core/layout/layout_object.h
+++ b/third_party/blink/renderer/core/layout/layout_object.h
@@ -584,7 +584,9 @@
   // function also doesn't handle the default association between a tag
   // and its renderer (e.g. <iframe> creates a LayoutIFrame even if the
   // initial 'display' value is inline).
-  static LayoutObject* CreateObject(Element*, const ComputedStyle&);
+  static LayoutObject* CreateObject(Element*,
+                                    const ComputedStyle&,
+                                    LegacyLayout);
 
   // LayoutObjects are allocated out of the rendering partition.
   void* operator new(size_t);
@@ -901,6 +903,7 @@
   bool IsInLayoutNGInlineFormattingContext() const {
     return bitfields_.IsInLayoutNGInlineFormattingContext();
   }
+  bool ForceLegacyLayout() const { return bitfields_.ForceLegacyLayout(); }
   bool IsAtomicInlineLevel() const { return bitfields_.IsAtomicInlineLevel(); }
   bool IsHorizontalWritingMode() const {
     return bitfields_.HorizontalWritingMode();
@@ -1249,6 +1252,7 @@
   void SetIsInLayoutNGInlineFormattingContext(bool);
   virtual NGPaintFragment* FirstInlineFragment() const { return nullptr; }
   virtual void SetFirstInlineFragment(NGPaintFragment*) {}
+  void SetForceLegacyLayout() { bitfields_.SetForceLegacyLayout(true); }
 
   void SetHasBoxDecorationBackground(bool);
 
@@ -2607,6 +2611,7 @@
           is_box_(false),
           is_inline_(true),
           is_in_layout_ng_inline_formatting_context_(false),
+          force_legacy_layout_(false),
           is_atomic_inline_level_(false),
           horizontal_writing_mode_(true),
           has_layer_(false),
@@ -2759,6 +2764,10 @@
     ADD_BOOLEAN_BITFIELD(is_in_layout_ng_inline_formatting_context_,
                          IsInLayoutNGInlineFormattingContext);
 
+    // Set if we're to force legacy layout (i.e. disable LayoutNG) on this
+    // object, and all descendants.
+    ADD_BOOLEAN_BITFIELD(force_legacy_layout_, ForceLegacyLayout);
+
     // This boolean is set if the element is an atomic inline-level box.
     //
     // In CSS, atomic inline-level boxes are laid out on a line but they
diff --git a/third_party/blink/renderer/core/layout/layout_object_child_list.cc b/third_party/blink/renderer/core/layout/layout_object_child_list.cc
index 1373be0..379ee303 100644
--- a/third_party/blink/renderer/core/layout/layout_object_child_list.cc
+++ b/third_party/blink/renderer/core/layout/layout_object_child_list.cc
@@ -210,6 +210,13 @@
   if (new_child->WasNotifiedOfSubtreeChange())
     owner->NotifyAncestorsOfSubtreeChange();
 
+  if (owner->ForceLegacyLayout()) {
+    new_child->SetForceLegacyLayout();
+    // TODO(crbug.com/943574): This would be a great place to DCHECK that the
+    // child isn't an NG object, but there are unfortunately cases where this
+    // actually happens.
+  }
+
   // Clear NeedsCollectInlines to ensure the marking doesn't stop on
   // |new_child|.
   new_child->ClearNeedsCollectInlines();
diff --git a/third_party/blink/renderer/core/layout/layout_object_factory.cc b/third_party/blink/renderer/core/layout/layout_object_factory.cc
index 064ed12..22b83178e 100644
--- a/third_party/blink/renderer/core/layout/layout_object_factory.cc
+++ b/third_party/blink/renderer/core/layout/layout_object_factory.cc
@@ -11,7 +11,11 @@
 #include "third_party/blink/renderer/core/layout/layout_list_item.h"
 #include "third_party/blink/renderer/core/layout/layout_table_caption.h"
 #include "third_party/blink/renderer/core/layout/layout_table_cell.h"
+#include "third_party/blink/renderer/core/layout/layout_text.h"
+#include "third_party/blink/renderer/core/layout/layout_text_fragment.h"
 #include "third_party/blink/renderer/core/layout/layout_view.h"
+#include "third_party/blink/renderer/core/layout/ng/inline/layout_ng_text.h"
+#include "third_party/blink/renderer/core/layout/ng/inline/layout_ng_text_fragment.h"
 #include "third_party/blink/renderer/core/layout/ng/layout_ng_block_flow.h"
 #include "third_party/blink/renderer/core/layout/ng/layout_ng_fieldset.h"
 #include "third_party/blink/renderer/core/layout/ng/layout_ng_flexible_box.h"
@@ -25,19 +29,6 @@
 
 namespace {
 
-inline bool ShouldUseNewLayout(Document& document, const ComputedStyle& style) {
-  if (!RuntimeEnabledFeatures::LayoutNGEnabled())
-    return false;
-  bool requires_ng_block_fragmentation =
-      document.Printing() ||
-      (document.GetLayoutView() &&
-       document.GetLayoutView()->StyleRef().IsOverflowPaged());
-  if (requires_ng_block_fragmentation &&
-      !RuntimeEnabledFeatures::LayoutNGBlockFragmentationEnabled())
-    return false;
-  return !style.ForceLegacyLayout();
-}
-
 inline Element* GetElementForLayoutObject(Node& node) {
   if (node.IsElementNode())
     return &ToElement(node);
@@ -46,62 +37,113 @@
   return nullptr;
 }
 
+template <typename BaseType, typename NGType, typename LegacyType = BaseType>
+inline BaseType* CreateObject(Node& node,
+                              const ComputedStyle& style,
+                              LegacyLayout legacy,
+                              bool disable_ng_for_type = false) {
+  Element* element = GetElementForLayoutObject(node);
+  bool force_legacy = false;
+
+  // If no reason has been found for disabling NG for this particular type,
+  // check if the NG feature is enabled at all, before considering creating an
+  // NG object.
+  if (!disable_ng_for_type && RuntimeEnabledFeatures::LayoutNGEnabled()) {
+    // The last thing to check is whether we should force legacy layout. This
+    // happens when the NG feature is enabled for the object in question, but
+    // we're dealing with something that isn't implemented in NG yet (such as
+    // editing or multicol). We then need to force legacy layout for the entire
+    // subtree.
+    force_legacy = legacy == LegacyLayout::kForce;
+
+    if (!force_legacy)
+      return new NGType(element);
+  }
+  BaseType* new_object = new LegacyType(element);
+  if (force_legacy)
+    new_object->SetForceLegacyLayout();
+  return new_object;
+}
+
 }  // anonymous namespace
 
 LayoutBlockFlow* LayoutObjectFactory::CreateBlockFlow(
     Node& node,
-    const ComputedStyle& style) {
-  Element* element = GetElementForLayoutObject(node);
-  if (ShouldUseNewLayout(node.GetDocument(), style))
-    return new LayoutNGBlockFlow(element);
-  return new LayoutBlockFlow(element);
+    const ComputedStyle& style,
+    LegacyLayout legacy) {
+  return CreateObject<LayoutBlockFlow, LayoutNGBlockFlow>(node, style, legacy);
 }
 
-LayoutBlock* LayoutObjectFactory::CreateFlexibleBox(
-    Node& node,
-    const ComputedStyle& style) {
-  Element* element = GetElementForLayoutObject(node);
-  if (RuntimeEnabledFeatures::LayoutNGFlexBoxEnabled() &&
-      ShouldUseNewLayout(node.GetDocument(), style))
-    return new LayoutNGFlexibleBox(element);
-  return new LayoutFlexibleBox(element);
+LayoutBlock* LayoutObjectFactory::CreateFlexibleBox(Node& node,
+                                                    const ComputedStyle& style,
+                                                    LegacyLayout legacy) {
+  bool disable_ng_for_type = !RuntimeEnabledFeatures::LayoutNGFlexBoxEnabled();
+  return CreateObject<LayoutBlock, LayoutNGFlexibleBox, LayoutFlexibleBox>(
+      node, style, legacy, disable_ng_for_type);
 }
 
-LayoutBlockFlow* LayoutObjectFactory::CreateListItem(
-    Node& node,
-    const ComputedStyle& style) {
-  Element* element = GetElementForLayoutObject(node);
-  if (ShouldUseNewLayout(node.GetDocument(), style))
-    return new LayoutNGListItem(element);
-  return new LayoutListItem(element);
+LayoutBlockFlow* LayoutObjectFactory::CreateListItem(Node& node,
+                                                     const ComputedStyle& style,
+                                                     LegacyLayout legacy) {
+  return CreateObject<LayoutBlockFlow, LayoutNGListItem, LayoutListItem>(
+      node, style, legacy);
 }
 
 LayoutTableCaption* LayoutObjectFactory::CreateTableCaption(
     Node& node,
-    const ComputedStyle& style) {
-  Element* element = GetElementForLayoutObject(node);
-  if (ShouldUseNewLayout(node.GetDocument(), style))
-    return new LayoutNGTableCaption(element);
-  return new LayoutTableCaption(element);
+    const ComputedStyle& style,
+    LegacyLayout legacy) {
+  return CreateObject<LayoutTableCaption, LayoutNGTableCaption>(node, style,
+                                                                legacy);
 }
 
 LayoutTableCell* LayoutObjectFactory::CreateTableCell(
     Node& node,
-    const ComputedStyle& style) {
-  Element* element = GetElementForLayoutObject(node);
-  if (ShouldUseNewLayout(node.GetDocument(), style))
-    return new LayoutNGTableCell(element);
-  return new LayoutTableCell(element);
+    const ComputedStyle& style,
+    LegacyLayout legacy) {
+  return CreateObject<LayoutTableCell, LayoutNGTableCell>(node, style, legacy);
 }
 
 LayoutBlock* LayoutObjectFactory::CreateFieldset(Node& node,
-                                                 const ComputedStyle& style) {
-  Element* element = GetElementForLayoutObject(node);
-  if (RuntimeEnabledFeatures::LayoutNGFieldsetEnabled() &&
-      ShouldUseNewLayout(node.GetDocument(), style)) {
-    return new LayoutNGFieldset(element);
+                                                 const ComputedStyle& style,
+                                                 LegacyLayout legacy) {
+  bool disable_ng_for_type = !RuntimeEnabledFeatures::LayoutNGFieldsetEnabled();
+  return CreateObject<LayoutBlock, LayoutNGFieldset, LayoutFieldset>(
+      node, style, legacy, disable_ng_for_type);
+}
+
+LayoutText* LayoutObjectFactory::CreateText(Node* node,
+                                            scoped_refptr<StringImpl> str,
+                                            LegacyLayout legacy) {
+  bool force_legacy = false;
+  if (RuntimeEnabledFeatures::LayoutNGEnabled()) {
+    force_legacy = legacy == LegacyLayout::kForce;
+    if (!force_legacy)
+      return new LayoutNGText(node, str);
   }
-  return new LayoutFieldset(element);
+  LayoutText* layout_text = new LayoutText(node, str);
+  if (force_legacy)
+    layout_text->SetForceLegacyLayout();
+  return layout_text;
+}
+
+LayoutTextFragment* LayoutObjectFactory::CreateTextFragment(
+    Node* node,
+    StringImpl* str,
+    int start_offset,
+    int length,
+    LegacyLayout legacy) {
+  bool force_legacy = false;
+  if (RuntimeEnabledFeatures::LayoutNGEnabled()) {
+    force_legacy = legacy == LegacyLayout::kForce;
+    if (!force_legacy)
+      return new LayoutNGTextFragment(node, str, start_offset, length);
+  }
+  LayoutTextFragment* layout_text_fragment =
+      new LayoutTextFragment(node, str, start_offset, length);
+  if (force_legacy)
+    layout_text_fragment->SetForceLegacyLayout();
+  return layout_text_fragment;
 }
 
 }  // namespace blink
diff --git a/third_party/blink/renderer/core/layout/layout_object_factory.h b/third_party/blink/renderer/core/layout/layout_object_factory.h
index 0a22e84..79ca3dd 100644
--- a/third_party/blink/renderer/core/layout/layout_object_factory.h
+++ b/third_party/blink/renderer/core/layout/layout_object_factory.h
@@ -5,15 +5,20 @@
 #ifndef THIRD_PARTY_BLINK_RENDERER_CORE_LAYOUT_LAYOUT_OBJECT_FACTORY_H_
 #define THIRD_PARTY_BLINK_RENDERER_CORE_LAYOUT_LAYOUT_OBJECT_FACTORY_H_
 
+#include "base/memory/scoped_refptr.h"
 #include "third_party/blink/renderer/platform/wtf/allocator.h"
+#include "third_party/blink/renderer/platform/wtf/forward.h"
 
 namespace blink {
 
 class ComputedStyle;
 class LayoutBlock;
 class LayoutBlockFlow;
+enum class LegacyLayout;
 class LayoutTableCaption;
 class LayoutTableCell;
+class LayoutText;
+class LayoutTextFragment;
 class Node;
 
 // Helper class for creation of certain LayoutObject-derived objects that may
@@ -28,12 +33,28 @@
   // LayoutObject. Otherwise it will be assumed to be a Document node, in which
   // case the LayoutObject created will be anonymous. The |style| reference
   // passed will only be used to determine which object type to create.
-  static LayoutBlockFlow* CreateBlockFlow(Node&, const ComputedStyle&);
-  static LayoutBlock* CreateFlexibleBox(Node&, const ComputedStyle&);
-  static LayoutBlockFlow* CreateListItem(Node&, const ComputedStyle&);
-  static LayoutTableCaption* CreateTableCaption(Node&, const ComputedStyle&);
-  static LayoutTableCell* CreateTableCell(Node&, const ComputedStyle&);
-  static LayoutBlock* CreateFieldset(Node&, const ComputedStyle&);
+  static LayoutBlockFlow* CreateBlockFlow(Node&,
+                                          const ComputedStyle&,
+                                          LegacyLayout);
+  static LayoutBlock* CreateFlexibleBox(Node&,
+                                        const ComputedStyle&,
+                                        LegacyLayout);
+  static LayoutBlockFlow* CreateListItem(Node&,
+                                         const ComputedStyle&,
+                                         LegacyLayout);
+  static LayoutTableCaption* CreateTableCaption(Node&,
+                                                const ComputedStyle&,
+                                                LegacyLayout);
+  static LayoutTableCell* CreateTableCell(Node&,
+                                          const ComputedStyle&,
+                                          LegacyLayout);
+  static LayoutBlock* CreateFieldset(Node&, const ComputedStyle&, LegacyLayout);
+  static LayoutText* CreateText(Node*, scoped_refptr<StringImpl>, LegacyLayout);
+  static LayoutTextFragment* CreateTextFragment(Node*,
+                                                StringImpl*,
+                                                int start_offset,
+                                                int length,
+                                                LegacyLayout);
 };
 
 }  // namespace blink
diff --git a/third_party/blink/renderer/core/layout/layout_quote.cc b/third_party/blink/renderer/core/layout/layout_quote.cc
index 9b12aa15..a458d0d 100644
--- a/third_party/blink/renderer/core/layout/layout_quote.cc
+++ b/third_party/blink/renderer/core/layout/layout_quote.cc
@@ -270,8 +270,10 @@
     fragment->SetStyle(MutableStyle());
     fragment->SetContentString(text_.Impl());
   } else {
-    fragment = LayoutTextFragment::CreateAnonymous(*Style(), *owning_pseudo_,
-                                                   text_.Impl());
+    LegacyLayout legacy =
+        ForceLegacyLayout() ? LegacyLayout::kForce : LegacyLayout::kAuto;
+    fragment = LayoutTextFragment::CreateAnonymous(*owning_pseudo_,
+                                                   text_.Impl(), legacy);
     fragment->SetStyle(MutableStyle());
     AddChild(fragment);
   }
diff --git a/third_party/blink/renderer/core/layout/layout_table_cell.cc b/third_party/blink/renderer/core/layout/layout_table_cell.cc
index dcc12f7..2ed337f 100644
--- a/third_party/blink/renderer/core/layout/layout_table_cell.cc
+++ b/third_party/blink/renderer/core/layout/layout_table_cell.cc
@@ -1146,9 +1146,10 @@
 
 LayoutTableCell* LayoutTableCell::CreateAnonymous(
     Document* document,
-    scoped_refptr<ComputedStyle> style) {
+    scoped_refptr<ComputedStyle> style,
+    LegacyLayout legacy) {
   LayoutTableCell* layout_object =
-      LayoutObjectFactory::CreateTableCell(*document, *style);
+      LayoutObjectFactory::CreateTableCell(*document, *style, legacy);
   layout_object->SetDocumentForAnonymous(document);
   layout_object->SetStyle(std::move(style));
   return layout_object;
@@ -1159,8 +1160,10 @@
   scoped_refptr<ComputedStyle> new_style =
       ComputedStyle::CreateAnonymousStyleWithDisplay(parent->StyleRef(),
                                                      EDisplay::kTableCell);
+  LegacyLayout legacy =
+      parent->ForceLegacyLayout() ? LegacyLayout::kForce : LegacyLayout::kAuto;
   LayoutTableCell* new_cell = LayoutTableCell::CreateAnonymous(
-      &parent->GetDocument(), std::move(new_style));
+      &parent->GetDocument(), std::move(new_style), legacy);
   return new_cell;
 }
 
diff --git a/third_party/blink/renderer/core/layout/layout_table_cell.h b/third_party/blink/renderer/core/layout/layout_table_cell.h
index 4e56ea1..506919a 100644
--- a/third_party/blink/renderer/core/layout/layout_table_cell.h
+++ b/third_party/blink/renderer/core/layout/layout_table_cell.h
@@ -236,7 +236,8 @@
   }
 
   static LayoutTableCell* CreateAnonymous(Document*,
-                                          scoped_refptr<ComputedStyle>);
+                                          scoped_refptr<ComputedStyle>,
+                                          LegacyLayout);
   static LayoutTableCell* CreateAnonymousWithParent(const LayoutObject*);
   LayoutBox* CreateAnonymousBoxWithSameTypeAs(
       const LayoutObject* parent) const override {
diff --git a/third_party/blink/renderer/core/layout/layout_table_cell_test.cc b/third_party/blink/renderer/core/layout/layout_table_cell_test.cc
index 9d0691c..cc6f7c7 100644
--- a/third_party/blink/renderer/core/layout/layout_table_cell_test.cc
+++ b/third_party/blink/renderer/core/layout/layout_table_cell_test.cc
@@ -36,7 +36,8 @@
     RenderingTest::SetUp();
     auto style = ComputedStyle::Create();
     style->SetDisplay(EDisplay::kTableCell);
-    cell_ = LayoutTableCell::CreateAnonymous(&GetDocument(), std::move(style));
+    cell_ = LayoutTableCell::CreateAnonymous(&GetDocument(), std::move(style),
+                                             LegacyLayout::kAuto);
   }
 
   void TearDown() override {
diff --git a/third_party/blink/renderer/core/layout/layout_text.cc b/third_party/blink/renderer/core/layout/layout_text.cc
index f06ef4f0..d3d8795 100644
--- a/third_party/blink/renderer/core/layout/layout_text.cc
+++ b/third_party/blink/renderer/core/layout/layout_text.cc
@@ -42,6 +42,7 @@
 #include "third_party/blink/renderer/core/layout/api/line_layout_api_shim.h"
 #include "third_party/blink/renderer/core/layout/api/line_layout_box.h"
 #include "third_party/blink/renderer/core/layout/layout_block.h"
+#include "third_party/blink/renderer/core/layout/layout_object_factory.h"
 #include "third_party/blink/renderer/core/layout/layout_table_cell.h"
 #include "third_party/blink/renderer/core/layout/layout_text_combine.h"
 #include "third_party/blink/renderer/core/layout/layout_view.h"
@@ -157,13 +158,11 @@
 #endif
 }
 
-LayoutText* LayoutText::CreateEmptyAnonymous(
-    Document& doc,
-    scoped_refptr<ComputedStyle> style) {
+LayoutText* LayoutText::CreateEmptyAnonymous(Document& doc,
+                                             scoped_refptr<ComputedStyle> style,
+                                             LegacyLayout legacy) {
   LayoutText* text =
-      RuntimeEnabledFeatures::LayoutNGEnabled() && !style->ForceLegacyLayout()
-          ? new LayoutNGText(nullptr, StringImpl::empty_)
-          : new LayoutText(nullptr, StringImpl::empty_);
+      LayoutObjectFactory::CreateText(nullptr, StringImpl::empty_, legacy);
   text->SetDocumentForAnonymous(&doc);
   text->SetStyle(std::move(style));
   return text;
diff --git a/third_party/blink/renderer/core/layout/layout_text.h b/third_party/blink/renderer/core/layout/layout_text.h
index 6fb2d7f..f88a856b 100644
--- a/third_party/blink/renderer/core/layout/layout_text.h
+++ b/third_party/blink/renderer/core/layout/layout_text.h
@@ -84,7 +84,8 @@
   ~LayoutText() override;
 
   static LayoutText* CreateEmptyAnonymous(Document&,
-                                          scoped_refptr<ComputedStyle>);
+                                          scoped_refptr<ComputedStyle>,
+                                          LegacyLayout);
 
   const char* GetName() const override { return "LayoutText"; }
 
diff --git a/third_party/blink/renderer/core/layout/layout_text_fragment.cc b/third_party/blink/renderer/core/layout/layout_text_fragment.cc
index 3c629a7..d507061 100644
--- a/third_party/blink/renderer/core/layout/layout_text_fragment.cc
+++ b/third_party/blink/renderer/core/layout/layout_text_fragment.cc
@@ -28,6 +28,7 @@
 #include "third_party/blink/renderer/core/dom/text.h"
 #include "third_party/blink/renderer/core/frame/local_frame_view.h"
 #include "third_party/blink/renderer/core/layout/hit_test_result.h"
+#include "third_party/blink/renderer/core/layout/layout_object_factory.h"
 #include "third_party/blink/renderer/core/layout/ng/inline/layout_ng_text_fragment.h"
 #include "third_party/blink/renderer/core/layout/ng/inline/ng_offset_mapping.h"
 
@@ -50,24 +51,22 @@
   DCHECK(!first_letter_pseudo_element_);
 }
 
-LayoutTextFragment* LayoutTextFragment::Create(const ComputedStyle& style,
-                                               Node* node,
+LayoutTextFragment* LayoutTextFragment::Create(Node* node,
                                                StringImpl* str,
                                                int start_offset,
-                                               int length) {
-  if (RuntimeEnabledFeatures::LayoutNGEnabled() && !style.ForceLegacyLayout())
-    return new LayoutNGTextFragment(node, str, start_offset, length);
-  return new LayoutTextFragment(node, str, start_offset, length);
+                                               int length,
+                                               LegacyLayout legacy) {
+  return LayoutObjectFactory::CreateTextFragment(node, str, start_offset,
+                                                 length, legacy);
 }
 
-LayoutTextFragment* LayoutTextFragment::CreateAnonymous(
-    const ComputedStyle& style,
-    PseudoElement& pseudo,
-    StringImpl* text,
-    unsigned start,
-    unsigned length) {
+LayoutTextFragment* LayoutTextFragment::CreateAnonymous(PseudoElement& pseudo,
+                                                        StringImpl* text,
+                                                        unsigned start,
+                                                        unsigned length,
+                                                        LegacyLayout legacy) {
   LayoutTextFragment* fragment =
-      LayoutTextFragment::Create(style, nullptr, text, start, length);
+      LayoutTextFragment::Create(nullptr, text, start, length, legacy);
   fragment->SetDocumentForAnonymous(&pseudo.GetDocument());
   if (length)
     pseudo.GetDocument().View()->IncrementVisuallyNonEmptyCharacterCount(
@@ -75,11 +74,10 @@
   return fragment;
 }
 
-LayoutTextFragment* LayoutTextFragment::CreateAnonymous(
-    const ComputedStyle& style,
-    PseudoElement& pseudo,
-    StringImpl* text) {
-  return CreateAnonymous(style, pseudo, text, 0, text ? text->length() : 0);
+LayoutTextFragment* LayoutTextFragment::CreateAnonymous(PseudoElement& pseudo,
+                                                        StringImpl* text,
+                                                        LegacyLayout legacy) {
+  return CreateAnonymous(pseudo, text, 0, text ? text->length() : 0, legacy);
 }
 
 void LayoutTextFragment::WillBeDestroyed() {
diff --git a/third_party/blink/renderer/core/layout/layout_text_fragment.h b/third_party/blink/renderer/core/layout/layout_text_fragment.h
index 70d46ca..c401e00 100644
--- a/third_party/blink/renderer/core/layout/layout_text_fragment.h
+++ b/third_party/blink/renderer/core/layout/layout_text_fragment.h
@@ -41,20 +41,19 @@
  public:
   ~LayoutTextFragment() override;
 
-  // |style| is used for checking |ForceLegacyLayout()|.
-  static LayoutTextFragment* Create(const ComputedStyle& style,
-                                    Node*,
+  static LayoutTextFragment* Create(Node*,
                                     StringImpl*,
                                     int start_offset,
-                                    int length);
-  static LayoutTextFragment* CreateAnonymous(const ComputedStyle& style,
-                                             PseudoElement&,
-                                             StringImpl*);
-  static LayoutTextFragment* CreateAnonymous(const ComputedStyle& style,
-                                             PseudoElement&,
+                                    int length,
+                                    LegacyLayout);
+  static LayoutTextFragment* CreateAnonymous(PseudoElement&,
+                                             StringImpl*,
+                                             LegacyLayout);
+  static LayoutTextFragment* CreateAnonymous(PseudoElement&,
                                              StringImpl*,
                                              unsigned start,
-                                             unsigned length);
+                                             unsigned length,
+                                             LegacyLayout);
 
   Position PositionForCaretOffset(unsigned) const override;
   base::Optional<unsigned> CaretOffsetForPosition(
@@ -104,6 +103,7 @@
   LayoutText* GetFirstLetterPart() const override;
 
  protected:
+  friend class LayoutObjectFactory;
   LayoutTextFragment(Node*, StringImpl*, int start_offset, int length);
   void WillBeDestroyed() override;
 
diff --git a/third_party/blink/renderer/core/layout/ng/inline/ng_inline_items_builder_test.cc b/third_party/blink/renderer/core/layout/ng/inline/ng_inline_items_builder_test.cc
index ff5d9c5..cba4513 100644
--- a/third_party/blink/renderer/core/layout/ng/inline/ng_inline_items_builder_test.cc
+++ b/third_party/blink/renderer/core/layout/ng/inline/ng_inline_items_builder_test.cc
@@ -57,7 +57,7 @@
     for (Input& input : inputs) {
       if (!input.layout_text) {
         input.layout_text = LayoutText::CreateEmptyAnonymous(
-            GetDocument(), GetStyle(input.whitespace));
+            GetDocument(), GetStyle(input.whitespace), LegacyLayout::kAuto);
         anonymous_objects.push_back(input.layout_text);
       }
       builder.Append(input.text, input.layout_text->Style(), input.layout_text);
diff --git a/third_party/blink/renderer/core/layout/ng/layout_ng_mixin.cc b/third_party/blink/renderer/core/layout/ng/layout_ng_mixin.cc
index f7220366..05fd8c2 100644
--- a/third_party/blink/renderer/core/layout/ng/layout_ng_mixin.cc
+++ b/third_party/blink/renderer/core/layout/ng/layout_ng_mixin.cc
@@ -30,6 +30,7 @@
   static_assert(
       std::is_base_of<LayoutBlockFlow, Base>::value,
       "Base class of LayoutNGMixin must be LayoutBlockFlow or derived class.");
+  DCHECK(!element || !element->ShouldForceLegacyLayout());
 }
 
 template <typename Base>
diff --git a/third_party/blink/renderer/core/layout/ng/list/layout_ng_list_item.cc b/third_party/blink/renderer/core/layout/ng/list/layout_ng_list_item.cc
index 05c93c1..036a7cf 100644
--- a/third_party/blink/renderer/core/layout/ng/list/layout_ng_list_item.cc
+++ b/third_party/blink/renderer/core/layout/ng/list/layout_ng_list_item.cc
@@ -299,8 +299,8 @@
       }
     }
     if (!child) {
-      text = LayoutText::CreateEmptyAnonymous(GetDocument(),
-                                              marker_->MutableStyle());
+      text = LayoutText::CreateEmptyAnonymous(
+          GetDocument(), marker_->MutableStyle(), LegacyLayout::kAuto);
       marker_->AddChild(text);
       is_marker_text_updated_ = false;
     }
diff --git a/third_party/blink/renderer/core/layout/ng/ng_block_node.cc b/third_party/blink/renderer/core/layout/ng/ng_block_node.cc
index 4c5fb210..891baec 100644
--- a/third_party/blink/renderer/core/layout/ng/ng_block_node.cc
+++ b/third_party/blink/renderer/core/layout/ng/ng_block_node.cc
@@ -233,24 +233,6 @@
     return layout_result;
   }
 
-  // This follows the code from LayoutBox::UpdateLogicalWidth
-  if (box_->NeedsPreferredWidthsRecalculation() &&
-      !box_->PreferredLogicalWidthsDirty()) {
-    // Laying out this object means that its containing block is also being
-    // laid out. This object is special, in that its min/max widths depend on
-    // the ancestry (min/max width calculation should ideally be strictly
-    // bottom-up, but that's not always the case), so since the containing
-    // block size may have changed, we need to recalculate the min/max widths
-    // of this object, and every child that has the same issue, recursively.
-    box_->SetPreferredLogicalWidthsDirty(kMarkOnlyThis);
-    // Since all this takes place during actual layout, instead of being part
-    // of min/max the width calculation machinery, we need to enter said
-    // machinery here, to make sure that what was dirtied is actualy
-    // recalculated. Leaving things dirty would mean that any subsequent
-    // dirtying of descendants would fail.
-    box_->ComputePreferredLogicalWidths();
-  }
-
   PrepareForLayout();
 
   NGBoxStrut old_scrollbars = GetScrollbarSizes();
@@ -521,11 +503,8 @@
 
 bool NGBlockNode::CanUseNewLayout(const LayoutBox& box) {
   DCHECK(RuntimeEnabledFeatures::LayoutNGEnabled());
-  if (box.StyleRef().ForceLegacyLayout())
+  if (box.ForceLegacyLayout())
     return false;
-
-  // When the style has |ForceLegacyLayout|, it's usually not LayoutNGMixin,
-  // but anonymous block can be.
   return box.IsLayoutNGMixin() || box.IsLayoutNGFlexibleBox();
 }
 
diff --git a/third_party/blink/renderer/core/layout/ng/ng_length_utils.cc b/third_party/blink/renderer/core/layout/ng/ng_length_utils.cc
index 1cd84fd..d8e07b9 100644
--- a/third_party/blink/renderer/core/layout/ng/ng_length_utils.cc
+++ b/third_party/blink/renderer/core/layout/ng/ng_length_utils.cc
@@ -426,10 +426,13 @@
   // If we have usable cached min/max intrinsic sizes, use those if we can. They
   // will normally also be constrained to {min,max}-inline-size, but not if
   // percentages are involved. In such cases we'll have to calculate and apply
-  // the constraints on our own.
+  // the constraints on our own. We also need to discard the cached values if
+  // the box has certain properties (e.g. percentage padding) that cause the
+  // cached values to be affected by extrinsic sizing.
   if (!box->PreferredLogicalWidthsDirty() && !override_minmax_for_test &&
       !style.LogicalMinWidth().IsPercentOrCalc() &&
-      !style.LogicalMaxWidth().IsPercentOrCalc()) {
+      !style.LogicalMaxWidth().IsPercentOrCalc() &&
+      !box->NeedsPreferredWidthsRecalculation()) {
     if (logical_width.IsFitContent()) {
       // This is not as easy as {min, max}.ShrinkToFit() because we also need
       // to subtract inline margins from the available size. The code in
diff --git a/third_party/blink/renderer/core/layout/ng/ng_physical_box_fragment.cc b/third_party/blink/renderer/core/layout/ng/ng_physical_box_fragment.cc
index 461266a..08a62f3 100644
--- a/third_party/blink/renderer/core/layout/ng/ng_physical_box_fragment.cc
+++ b/third_party/blink/renderer/core/layout/ng/ng_physical_box_fragment.cc
@@ -75,19 +75,6 @@
   return GetLayoutBoxModelObject().HasSelfPaintingLayer();
 }
 
-bool NGPhysicalBoxFragment::HasOverflowClip() const {
-  const LayoutObject* layout_object = GetLayoutObject();
-  DCHECK(layout_object);
-  return layout_object->HasOverflowClip();
-}
-
-bool NGPhysicalBoxFragment::ShouldClipOverflow() const {
-  const LayoutObject* layout_object = GetLayoutObject();
-  DCHECK(layout_object);
-  return layout_object->IsBox() &&
-         ToLayoutBox(layout_object)->ShouldClipOverflow();
-}
-
 bool NGPhysicalBoxFragment::HasControlClip() const {
   const LayoutObject* layout_object = GetLayoutObject();
   DCHECK(layout_object);
diff --git a/third_party/blink/renderer/core/layout/ng/ng_physical_box_fragment.h b/third_party/blink/renderer/core/layout/ng/ng_physical_box_fragment.h
index 25679e6..ce95f2b 100644
--- a/third_party/blink/renderer/core/layout/ng/ng_physical_box_fragment.h
+++ b/third_party/blink/renderer/core/layout/ng/ng_physical_box_fragment.h
@@ -48,10 +48,6 @@
   bool HasSelfPaintingLayer() const;
   bool ChildrenInline() const { return children_inline_; }
 
-  // True if overflow != 'visible', except for certain boxes that do not allow
-  // overflow clip; i.e., AllowOverflowClip() returns false.
-  bool HasOverflowClip() const;
-  bool ShouldClipOverflow() const;
   bool HasControlClip() const;
 
   NGPhysicalOffsetRect ScrollableOverflow() const;
diff --git a/third_party/blink/renderer/core/layout/ng/ng_physical_fragment.cc b/third_party/blink/renderer/core/layout/ng/ng_physical_fragment.cc
index 59e8613a..2b8f1c3 100644
--- a/third_party/blink/renderer/core/layout/ng/ng_physical_fragment.cc
+++ b/third_party/blink/renderer/core/layout/ng/ng_physical_fragment.cc
@@ -318,6 +318,14 @@
       ->HasSelfPaintingLayer();
 }
 
+bool NGPhysicalFragment::HasOverflowClip() const {
+  return layout_object_ && layout_object_->HasOverflowClip();
+}
+
+bool NGPhysicalFragment::ShouldClipOverflow() const {
+  return layout_object_ && layout_object_->ShouldClipOverflow();
+}
+
 bool NGPhysicalFragment::IsBlockFlow() const {
   return layout_object_ && layout_object_->IsLayoutBlockFlow();
 }
diff --git a/third_party/blink/renderer/core/layout/ng/ng_physical_fragment.h b/third_party/blink/renderer/core/layout/ng/ng_physical_fragment.h
index 01718aca..d5ed99b7 100644
--- a/third_party/blink/renderer/core/layout/ng/ng_physical_fragment.h
+++ b/third_party/blink/renderer/core/layout/ng/ng_physical_fragment.h
@@ -180,6 +180,11 @@
   // Whether this object has a self-painting |Layer()|.
   bool HasSelfPaintingLayer() const;
 
+  // True if overflow != 'visible', except for certain boxes that do not allow
+  // overflow clip; i.e., AllowOverflowClip() returns false.
+  bool HasOverflowClip() const;
+  bool ShouldClipOverflow() const;
+
   // GetLayoutObject should only be used when necessary for compatibility
   // with LegacyLayout.
   LayoutObject* GetLayoutObject() const { return layout_object_; }
diff --git a/third_party/blink/renderer/core/layout/shapes/shape_outside_info.cc b/third_party/blink/renderer/core/layout/shapes/shape_outside_info.cc
index 47e6c34..b2c7dbc 100644
--- a/third_party/blink/renderer/core/layout/shapes/shape_outside_info.cc
+++ b/third_party/blink/renderer/core/layout/shapes/shape_outside_info.cc
@@ -151,9 +151,10 @@
 
   const KURL& url = image_resource.Url();
   String url_string = url.IsNull() ? "''" : url.ElidedString();
-  document.AddConsoleMessage(ConsoleMessage::Create(
-      kSecurityMessageSource, mojom::ConsoleMessageLevel::kError,
-      "Unsafe attempt to load URL " + url_string + "."));
+  document.AddConsoleMessage(
+      ConsoleMessage::Create(mojom::ConsoleMessageSource::kSecurity,
+                             mojom::ConsoleMessageLevel::kError,
+                             "Unsafe attempt to load URL " + url_string + "."));
 
   return false;
 }
diff --git a/third_party/blink/renderer/core/loader/base_fetch_context.cc b/third_party/blink/renderer/core/loader/base_fetch_context.cc
index 6568c0a..dac2dc4 100644
--- a/third_party/blink/renderer/core/loader/base_fetch_context.cc
+++ b/third_party/blink/renderer/core/loader/base_fetch_context.cc
@@ -229,8 +229,9 @@
               ". Domains, protocols and ports must match.\n";
   }
 
-  AddConsoleMessage(ConsoleMessage::Create(
-      kSecurityMessageSource, mojom::ConsoleMessageLevel::kError, message));
+  AddConsoleMessage(
+      ConsoleMessage::Create(mojom::ConsoleMessageSource::kSecurity,
+                             mojom::ConsoleMessageLevel::kError, message));
 }
 
 base::Optional<ResourceRequestBlockedReason>
@@ -298,7 +299,8 @@
       !origin->CanDisplay(url)) {
     if (reporting_policy == SecurityViolationReportingPolicy::kReport) {
       AddConsoleMessage(ConsoleMessage::Create(
-          kJSMessageSource, mojom::ConsoleMessageLevel::kError,
+          mojom::ConsoleMessageSource::kJavaScript,
+          mojom::ConsoleMessageLevel::kError,
           "Not allowed to load local resource: " + url.GetString()));
     }
     RESOURCE_LOADING_DVLOG(1) << "ResourceFetcher::requestResource URL was not "
diff --git a/third_party/blink/renderer/core/loader/console_logger_impl_base.cc b/third_party/blink/renderer/core/loader/console_logger_impl_base.cc
index 723be39..2695b221 100644
--- a/third_party/blink/renderer/core/loader/console_logger_impl_base.cc
+++ b/third_party/blink/renderer/core/loader/console_logger_impl_base.cc
@@ -33,17 +33,18 @@
                                            message));
 }
 
-MessageSource ConsoleLoggerImplBase::GetMessageSourceFromSource(Source source) {
+mojom::ConsoleMessageSource ConsoleLoggerImplBase::GetMessageSourceFromSource(
+    Source source) {
   switch (source) {
     case Source::kScript:
-      return kJSMessageSource;
+      return mojom::ConsoleMessageSource::kJavaScript;
     case Source::kSecurity:
-      return kSecurityMessageSource;
+      return mojom::ConsoleMessageSource::kSecurity;
     case Source::kOther:
-      return kOtherMessageSource;
+      return mojom::ConsoleMessageSource::kOther;
   }
   NOTREACHED();
-  return kOtherMessageSource;
+  return mojom::ConsoleMessageSource::kOther;
 }
 
 }  // namespace blink
diff --git a/third_party/blink/renderer/core/loader/console_logger_impl_base.h b/third_party/blink/renderer/core/loader/console_logger_impl_base.h
index ea67327b..6e5fae90 100644
--- a/third_party/blink/renderer/core/loader/console_logger_impl_base.h
+++ b/third_party/blink/renderer/core/loader/console_logger_impl_base.h
@@ -5,8 +5,8 @@
 #ifndef THIRD_PARTY_BLINK_RENDERER_CORE_LOADER_CONSOLE_LOGGER_IMPL_BASE_H_
 #define THIRD_PARTY_BLINK_RENDERER_CORE_LOADER_CONSOLE_LOGGER_IMPL_BASE_H_
 
+#include "third_party/blink/public/mojom/devtools/console_message.mojom-shared.h"
 #include "third_party/blink/renderer/core/core_export.h"
-#include "third_party/blink/renderer/core/inspector/console_types.h"
 #include "third_party/blink/renderer/platform/loader/fetch/console_logger.h"
 
 namespace blink {
@@ -28,7 +28,7 @@
   virtual void AddConsoleMessage(ConsoleMessage*) = 0;
 
  private:
-  static MessageSource GetMessageSourceFromSource(Source);
+  static mojom::ConsoleMessageSource GetMessageSourceFromSource(Source);
 };
 
 }  // namespace blink
diff --git a/third_party/blink/renderer/core/loader/document_loader.cc b/third_party/blink/renderer/core/loader/document_loader.cc
index 1f08d8e..e2c2d82 100644
--- a/third_party/blink/renderer/core/loader/document_loader.cc
+++ b/third_party/blink/renderer/core/loader/document_loader.cc
@@ -629,7 +629,8 @@
     if (!frame_->IsMainFrame()) {
       // Only the top-frame can load MHTML.
       frame_->Console().AddMessage(ConsoleMessage::Create(
-          kJSMessageSource, mojom::ConsoleMessageLevel::kError,
+          mojom::ConsoleMessageSource::kJavaScript,
+          mojom::ConsoleMessageLevel::kError,
           "Attempted to load a multipart archive into an subframe: " +
               url_.GetString()));
     } else {
@@ -639,7 +640,8 @@
         archive_.Clear();
         // Log if attempting to load an invalid archive resource.
         frame_->Console().AddMessage(ConsoleMessage::Create(
-            kJSMessageSource, mojom::ConsoleMessageLevel::kError,
+            mojom::ConsoleMessageSource::kJavaScript,
+            mojom::ConsoleMessageLevel::kError,
             "Malformed multipart archive: " + url_.GetString()));
       } else {
         main_resource = archive_->MainResource();
@@ -785,7 +787,8 @@
                          "required by its embedder: '" +
                          GetFrameLoader().RequiredCSP() + "'.";
         ConsoleMessage* console_message = ConsoleMessage::CreateForRequest(
-            kSecurityMessageSource, mojom::ConsoleMessageLevel::kError, message,
+            mojom::ConsoleMessageSource::kSecurity,
+            mojom::ConsoleMessageLevel::kError, message,
             response.CurrentRequestUrl(), this, MainResourceIdentifier());
         frame_->GetDocument()->AddConsoleMessage(console_message);
         return nullptr;
diff --git a/third_party/blink/renderer/core/loader/empty_clients.h b/third_party/blink/renderer/core/loader/empty_clients.h
index 280e07a..f13880cf3 100644
--- a/third_party/blink/renderer/core/loader/empty_clients.h
+++ b/third_party/blink/renderer/core/loader/empty_clients.h
@@ -119,7 +119,7 @@
     return false;
   }
   void AddMessageToConsole(LocalFrame*,
-                           MessageSource,
+                           mojom::ConsoleMessageSource,
                            mojom::ConsoleMessageLevel,
                            const String&,
                            unsigned,
@@ -266,7 +266,6 @@
       const ResourceResponse&) override {}
 
   void DispatchDidHandleOnloadEvents() override {}
-  void DispatchWillCommitProvisionalLoad() override {}
   void DispatchDidStartProvisionalLoad(DocumentLoader*) override {}
   void DispatchDidReceiveTitle(const String&) override {}
   void DispatchDidChangeIcons(IconType) override {}
diff --git a/third_party/blink/renderer/core/loader/frame_fetch_context.cc b/third_party/blink/renderer/core/loader/frame_fetch_context.cc
index 7cc8260..4f59b58 100644
--- a/third_party/blink/renderer/core/loader/frame_fetch_context.cc
+++ b/third_party/blink/renderer/core/loader/frame_fetch_context.cc
@@ -1195,7 +1195,8 @@
       frame_or_imported_document_->GetDocument().IsFreezingInProgress() &&
       !resource_request.GetKeepalive()) {
     AddConsoleMessage(ConsoleMessage::Create(
-        kJSMessageSource, mojom::ConsoleMessageLevel::kError,
+        mojom::ConsoleMessageSource::kJavaScript,
+        mojom::ConsoleMessageLevel::kError,
         "Only fetch keepalive is allowed during onfreeze: " + url.GetString()));
     return ResourceRequestBlockedReason::kOther;
   }
diff --git a/third_party/blink/renderer/core/loader/frame_loader.cc b/third_party/blink/renderer/core/loader/frame_loader.cc
index 4b89e61..a39d242 100644
--- a/third_party/blink/renderer/core/loader/frame_loader.cc
+++ b/third_party/blink/renderer/core/loader/frame_loader.cc
@@ -723,7 +723,8 @@
 
   if (!request.OriginDocument()->GetSecurityOrigin()->CanDisplay(url)) {
     request.OriginDocument()->AddConsoleMessage(ConsoleMessage::Create(
-        kSecurityMessageSource, mojom::ConsoleMessageLevel::kError,
+        mojom::ConsoleMessageSource::kSecurity,
+        mojom::ConsoleMessageLevel::kError,
         "Not allowed to load local resource: " + url.ElidedString()));
     return false;
   }
@@ -743,7 +744,8 @@
        (url.ProtocolIsData() &&
         network_utils::IsDataURLMimeTypeSupported(url)))) {
     frame_->GetDocument()->AddConsoleMessage(ConsoleMessage::Create(
-        kSecurityMessageSource, mojom::ConsoleMessageLevel::kError,
+        mojom::ConsoleMessageSource::kSecurity,
+        mojom::ConsoleMessageLevel::kError,
         "Not allowed to navigate top frame to " + url.Protocol() +
             " URL: " + url.ElidedString()));
     return false;
@@ -1167,10 +1169,8 @@
   // both when unloading itself and when unloading its descendants.
   IgnoreOpensDuringUnloadCountIncrementer ignore_opens_during_unload(
       frame_->GetDocument());
-  if (document_loader_) {
-    Client()->DispatchWillCommitProvisionalLoad();
+  if (document_loader_)
     DispatchUnloadEvent();
-  }
   frame_->DetachChildren();
   // The previous calls to dispatchUnloadEvent() and detachChildren() can
   // execute arbitrary script via things like unload events. If the executed
diff --git a/third_party/blink/renderer/core/loader/http_equiv.cc b/third_party/blink/renderer/core/loader/http_equiv.cc
index e9d7bf75..4a0a62f 100644
--- a/third_party/blink/renderer/core/loader/http_equiv.cc
+++ b/third_party/blink/renderer/core/loader/http_equiv.cc
@@ -105,7 +105,8 @@
     document.ParseDNSPrefetchControlHeader(content);
   } else if (EqualIgnoringASCIICase(equiv, "x-frame-options")) {
     document.AddConsoleMessage(ConsoleMessage::Create(
-        kSecurityMessageSource, mojom::ConsoleMessageLevel::kError,
+        mojom::ConsoleMessageSource::kSecurity,
+        mojom::ConsoleMessageLevel::kError,
         "X-Frame-Options may only be set via an HTTP header sent along with a "
         "document. It may not be set inside <meta>."));
   } else if (EqualIgnoringASCIICase(equiv, http_names::kAcceptCH)) {
@@ -207,7 +208,8 @@
   }
 
   document.AddConsoleMessage(ConsoleMessage::Create(
-      kSecurityMessageSource, mojom::ConsoleMessageLevel::kError,
+      mojom::ConsoleMessageSource::kSecurity,
+      mojom::ConsoleMessageLevel::kError,
       String::Format("Blocked setting the `%s` cookie from a `<meta>` tag.",
                      content.Utf8().data())));
 }
diff --git a/third_party/blink/renderer/core/loader/mixed_content_checker.cc b/third_party/blink/renderer/core/loader/mixed_content_checker.cc
index e9dd7c4e..1ff7b33 100644
--- a/third_party/blink/renderer/core/loader/mixed_content_checker.cc
+++ b/third_party/blink/renderer/core/loader/mixed_content_checker.cc
@@ -280,10 +280,12 @@
       allowed ? mojom::ConsoleMessageLevel::kWarning
               : mojom::ConsoleMessageLevel::kError;
   if (source_location) {
-    return ConsoleMessage::Create(kSecurityMessageSource, message_level,
-                                  message, std::move(source_location));
+    return ConsoleMessage::Create(mojom::ConsoleMessageSource::kSecurity,
+                                  message_level, message,
+                                  std::move(source_location));
   }
-  return ConsoleMessage::Create(kSecurityMessageSource, message_level, message);
+  return ConsoleMessage::Create(mojom::ConsoleMessageSource::kSecurity,
+                                message_level, message);
 }
 
 // static
@@ -527,7 +529,8 @@
   mojom::ConsoleMessageLevel message_level =
       allowed ? mojom::ConsoleMessageLevel::kWarning
               : mojom::ConsoleMessageLevel::kError;
-  return ConsoleMessage::Create(kSecurityMessageSource, message_level, message);
+  return ConsoleMessage::Create(mojom::ConsoleMessageSource::kSecurity,
+                                message_level, message);
 }
 
 // static
@@ -628,8 +631,9 @@
         "endpoint should be made available over a secure connection.",
         MainResourceUrlForFrame(mixed_frame).ElidedString().Utf8().data(),
         url.ElidedString().Utf8().data());
-    frame->GetDocument()->AddConsoleMessage(ConsoleMessage::Create(
-        kSecurityMessageSource, mojom::ConsoleMessageLevel::kWarning, message));
+    frame->GetDocument()->AddConsoleMessage(
+        ConsoleMessage::Create(mojom::ConsoleMessageSource::kSecurity,
+                               mojom::ConsoleMessageLevel::kWarning, message));
   }
 
   return true;
@@ -745,7 +749,7 @@
       "autoupgrade-mixed.md",
       main_resource_url.ElidedString().Utf8().data(),
       mixed_content_url.ElidedString().Utf8().data());
-  return ConsoleMessage::Create(kSecurityMessageSource,
+  return ConsoleMessage::Create(mojom::ConsoleMessageSource::kSecurity,
                                 mojom::ConsoleMessageLevel::kWarning, message);
 }
 
@@ -763,7 +767,7 @@
       "autoupgrade-mixed.md",
       main_resource_url.ElidedString().Utf8().data(),
       mixed_content_url.ElidedString().Utf8().data());
-  return ConsoleMessage::Create(kSecurityMessageSource,
+  return ConsoleMessage::Create(mojom::ConsoleMessageSource::kSecurity,
                                 mojom::ConsoleMessageLevel::kWarning, message);
 }
 
diff --git a/third_party/blink/renderer/core/loader/modulescript/document_module_script_fetcher.cc b/third_party/blink/renderer/core/loader/modulescript/document_module_script_fetcher.cc
index a1eb63b..708df92 100644
--- a/third_party/blink/renderer/core/loader/modulescript/document_module_script_fetcher.cc
+++ b/third_party/blink/renderer/core/loader/modulescript/document_module_script_fetcher.cc
@@ -69,8 +69,9 @@
   if (source_text.IsNull()) {
     HeapVector<Member<ConsoleMessage>> error_messages;
     error_messages.push_back(ConsoleMessage::CreateForRequest(
-        kJSMessageSource, mojom::ConsoleMessageLevel::kError,
-        "Unexpected data error", fetch_params.Url().GetString(), nullptr, 0));
+        mojom::ConsoleMessageSource::kJavaScript,
+        mojom::ConsoleMessageLevel::kError, "Unexpected data error",
+        fetch_params.Url().GetString(), nullptr, 0));
     client_->NotifyFetchFinished(base::nullopt, error_messages);
     return true;
   }
diff --git a/third_party/blink/renderer/core/loader/modulescript/installed_service_worker_module_script_fetcher.cc b/third_party/blink/renderer/core/loader/modulescript/installed_service_worker_module_script_fetcher.cc
index 29e16a8..0f79baf 100644
--- a/third_party/blink/renderer/core/loader/modulescript/installed_service_worker_module_script_fetcher.cc
+++ b/third_party/blink/renderer/core/loader/modulescript/installed_service_worker_module_script_fetcher.cc
@@ -33,7 +33,8 @@
   if (!script) {
     HeapVector<Member<ConsoleMessage>> error_messages;
     error_messages.push_back(ConsoleMessage::CreateForRequest(
-        kJSMessageSource, mojom::ConsoleMessageLevel::kError,
+        mojom::ConsoleMessageSource::kJavaScript,
+        mojom::ConsoleMessageLevel::kError,
         "Failed to load the script unexpectedly",
         fetch_params.Url().GetString(), nullptr, 0));
     client->NotifyFetchFinished(base::nullopt, error_messages);
diff --git a/third_party/blink/renderer/core/loader/modulescript/module_script_fetcher.cc b/third_party/blink/renderer/core/loader/modulescript/module_script_fetcher.cc
index dcec0d8..6b6f2b8 100644
--- a/third_party/blink/renderer/core/loader/modulescript/module_script_fetcher.cc
+++ b/third_party/blink/renderer/core/loader/modulescript/module_script_fetcher.cc
@@ -63,7 +63,8 @@
         "\". Strict MIME type checking is enforced for module scripts per "
         "HTML spec.";
     error_messages->push_back(ConsoleMessage::CreateForRequest(
-        kJSMessageSource, mojom::ConsoleMessageLevel::kError, message,
+        mojom::ConsoleMessageSource::kJavaScript,
+        mojom::ConsoleMessageLevel::kError, message,
         response.CurrentRequestUrl().GetString(), nullptr,
         resource->Identifier()));
     return false;
diff --git a/third_party/blink/renderer/core/loader/modulescript/worker_module_script_fetcher.cc b/third_party/blink/renderer/core/loader/modulescript/worker_module_script_fetcher.cc
index c334a25..8b0cdb4f 100644
--- a/third_party/blink/renderer/core/loader/modulescript/worker_module_script_fetcher.cc
+++ b/third_party/blink/renderer/core/loader/modulescript/worker_module_script_fetcher.cc
@@ -73,7 +73,8 @@
         !global_scope_->GetSecurityOrigin()->IsSameSchemeHostPort(
             SecurityOrigin::Create(response_url).get())) {
       error_messages.push_back(ConsoleMessage::Create(
-          kSecurityMessageSource, mojom::ConsoleMessageLevel::kError,
+          mojom::ConsoleMessageSource::kSecurity,
+          mojom::ConsoleMessageLevel::kError,
           "Refused to cross-origin redirects of the top-level worker script."));
       client_->NotifyFetchFinished(base::nullopt, error_messages);
       return;
diff --git a/third_party/blink/renderer/core/loader/preload_helper.cc b/third_party/blink/renderer/core/loader/preload_helper.cc
index 18f43fa..a4e53f9 100644
--- a/third_party/blink/renderer/core/loader/preload_helper.cc
+++ b/third_party/blink/renderer/core/loader/preload_helper.cc
@@ -117,7 +117,8 @@
       if (settings->GetLogDnsPrefetchAndPreconnect()) {
         SendMessageToConsoleForPossiblyNullDocument(
             ConsoleMessage::Create(
-                kOtherMessageSource, mojom::ConsoleMessageLevel::kVerbose,
+                mojom::ConsoleMessageSource::kOther,
+                mojom::ConsoleMessageLevel::kVerbose,
                 String("DNS prefetch triggered for " + params.href.Host())),
             document, frame);
       }
@@ -144,12 +145,13 @@
     if (settings && settings->GetLogDnsPrefetchAndPreconnect()) {
       SendMessageToConsoleForPossiblyNullDocument(
           ConsoleMessage::Create(
-              kOtherMessageSource, mojom::ConsoleMessageLevel::kVerbose,
+              mojom::ConsoleMessageSource::kOther,
+              mojom::ConsoleMessageLevel::kVerbose,
               String("Preconnect triggered for ") + params.href.GetString()),
           document, frame);
       if (params.cross_origin != kCrossOriginAttributeNotSet) {
         SendMessageToConsoleForPossiblyNullDocument(
-            ConsoleMessage::Create(kOtherMessageSource,
+            ConsoleMessage::Create(mojom::ConsoleMessageSource::kOther,
                                    mojom::ConsoleMessageLevel::kVerbose,
                                    String("Preconnect CORS setting is ") +
                                        String((params.cross_origin ==
@@ -233,7 +235,8 @@
   UseCounter::Count(document, WebFeature::kLinkRelPreload);
   if (!url.IsValid() || url.IsEmpty()) {
     document.AddConsoleMessage(ConsoleMessage::Create(
-        kOtherMessageSource, mojom::ConsoleMessageLevel::kWarning,
+        mojom::ConsoleMessageSource::kOther,
+        mojom::ConsoleMessageLevel::kWarning,
         String("<link rel=preload> has an invalid `href` value")));
     return nullptr;
   }
@@ -250,14 +253,16 @@
     UseCounter::Count(document, WebFeature::kLinkHeaderPreload);
   if (resource_type == base::nullopt) {
     document.AddConsoleMessage(ConsoleMessage::Create(
-        kOtherMessageSource, mojom::ConsoleMessageLevel::kWarning,
+        mojom::ConsoleMessageSource::kOther,
+        mojom::ConsoleMessageLevel::kWarning,
         String("<link rel=preload> must have a valid `as` value")));
     return nullptr;
   }
 
   if (!IsSupportedType(resource_type.value(), params.type)) {
     document.AddConsoleMessage(ConsoleMessage::Create(
-        kOtherMessageSource, mojom::ConsoleMessageLevel::kWarning,
+        mojom::ConsoleMessageSource::kOther,
+        mojom::ConsoleMessageLevel::kWarning,
         String("<link rel=preload> has an unsupported `type` value")));
     return nullptr;
   }
@@ -284,7 +289,8 @@
   Settings* settings = document.GetSettings();
   if (settings && settings->GetLogPreload()) {
     document.AddConsoleMessage(ConsoleMessage::Create(
-        kOtherMessageSource, mojom::ConsoleMessageLevel::kVerbose,
+        mojom::ConsoleMessageSource::kOther,
+        mojom::ConsoleMessageLevel::kVerbose,
         String("Preload triggered for " + url.Host() + url.GetPath())));
   }
   link_fetch_params.SetLinkPreload(true);
@@ -306,9 +312,10 @@
   // Step 1. "If the href attribute's value is the empty string, then return."
   // [spec text]
   if (params.href.IsEmpty()) {
-    document.AddConsoleMessage(ConsoleMessage::Create(
-        kOtherMessageSource, mojom::ConsoleMessageLevel::kWarning,
-        "<link rel=modulepreload> has no `href` value"));
+    document.AddConsoleMessage(
+        ConsoleMessage::Create(mojom::ConsoleMessageSource::kOther,
+                               mojom::ConsoleMessageLevel::kWarning,
+                               "<link rel=modulepreload> has no `href` value"));
     return;
   }
 
@@ -331,7 +338,8 @@
   // Currently we only support as="script".
   if (!params.as.IsEmpty() && params.as != "script") {
     document.AddConsoleMessage(ConsoleMessage::Create(
-        kOtherMessageSource, mojom::ConsoleMessageLevel::kWarning,
+        mojom::ConsoleMessageSource::kOther,
+        mojom::ConsoleMessageLevel::kWarning,
         String("<link rel=modulepreload> has an invalid `as` value " +
                params.as)));
     // This triggers the same logic as Step 11 asynchronously, which will fire
@@ -351,7 +359,8 @@
   // |href| is already resolved in caller side.
   if (!params.href.IsValid()) {
     document.AddConsoleMessage(ConsoleMessage::Create(
-        kOtherMessageSource, mojom::ConsoleMessageLevel::kWarning,
+        mojom::ConsoleMessageSource::kOther,
+        mojom::ConsoleMessageLevel::kWarning,
         "<link rel=modulepreload> has an invalid `href` value " +
             params.href.GetString()));
     return;
@@ -413,10 +422,11 @@
 
   Settings* settings = document.GetSettings();
   if (settings && settings->GetLogPreload()) {
-    document.AddConsoleMessage(ConsoleMessage::Create(
-        kOtherMessageSource, mojom::ConsoleMessageLevel::kVerbose,
-        "Module preload triggered for " + params.href.Host() +
-            params.href.GetPath()));
+    document.AddConsoleMessage(
+        ConsoleMessage::Create(mojom::ConsoleMessageSource::kOther,
+                               mojom::ConsoleMessageLevel::kVerbose,
+                               "Module preload triggered for " +
+                                   params.href.Host() + params.href.GetPath()));
   }
 
   // Asynchronously continue processing after
diff --git a/third_party/blink/renderer/core/loader/previews_resource_loading_hints.cc b/third_party/blink/renderer/core/loader/previews_resource_loading_hints.cc
index f228a5b..5d6b963 100644
--- a/third_party/blink/renderer/core/loader/previews_resource_loading_hints.cc
+++ b/third_party/blink/renderer/core/loader/previews_resource_loading_hints.cc
@@ -9,10 +9,10 @@
 #include "services/metrics/public/cpp/ukm_builders.h"
 #include "services/metrics/public/cpp/ukm_recorder.h"
 #include "third_party/blink/public/common/features.h"
+#include "third_party/blink/public/mojom/devtools/console_message.mojom-shared.h"
 #include "third_party/blink/renderer/core/dom/document.h"
 #include "third_party/blink/renderer/core/frame/local_frame.h"
 #include "third_party/blink/renderer/core/inspector/console_message.h"
-#include "third_party/blink/renderer/core/inspector/console_types.h"
 #include "third_party/blink/renderer/core/loader/document_loader.h"
 #include "third_party/blink/renderer/platform/weborigin/kurl.h"
 #include "third_party/blink/renderer/platform/wtf/text/string_builder.h"
@@ -130,7 +130,7 @@
 void PreviewsResourceLoadingHints::ReportBlockedLoading(
     const KURL& resource_url) const {
   execution_context_->AddConsoleMessage(ConsoleMessage::Create(
-      kOtherMessageSource, mojom::ConsoleMessageLevel::kWarning,
+      mojom::ConsoleMessageSource::kOther, mojom::ConsoleMessageLevel::kWarning,
       GetConsoleLogStringForBlockedLoad(resource_url)));
 }
 
diff --git a/third_party/blink/renderer/core/loader/subresource_filter.cc b/third_party/blink/renderer/core/loader/subresource_filter.cc
index fe9566a..7e793d8 100644
--- a/third_party/blink/renderer/core/loader/subresource_filter.cc
+++ b/third_party/blink/renderer/core/loader/subresource_filter.cc
@@ -126,11 +126,12 @@
       // Display console message for actually blocked resource. For a
       // resource with |load_policy| as kWouldDisallow, we will be logging a
       // document wide console message, so no need to log it here.
-      // TODO: Consider logging this as a kInterventionMessageSource for showing
+      // TODO: Consider logging this as a kIntervention for showing
       // warning in Lighthouse.
       if (subresource_filter_->ShouldLogToConsole()) {
         execution_context_->AddConsoleMessage(ConsoleMessage::Create(
-            kOtherMessageSource, mojom::ConsoleMessageLevel::kError,
+            mojom::ConsoleMessageSource::kOther,
+            mojom::ConsoleMessageLevel::kError,
             GetErrorStringForDisallowedLoad(resource_url)));
       }
       FALLTHROUGH;
diff --git a/third_party/blink/renderer/core/loader/subresource_integrity_helper.cc b/third_party/blink/renderer/core/loader/subresource_integrity_helper.cc
index 292b52c8d..1bc58a32 100644
--- a/third_party/blink/renderer/core/loader/subresource_integrity_helper.cc
+++ b/third_party/blink/renderer/core/loader/subresource_integrity_helper.cc
@@ -4,9 +4,9 @@
 
 #include "third_party/blink/renderer/core/loader/subresource_integrity_helper.h"
 
+#include "third_party/blink/public/mojom/devtools/console_message.mojom-shared.h"
 #include "third_party/blink/renderer/core/execution_context/execution_context.h"
 #include "third_party/blink/renderer/core/frame/use_counter.h"
-#include "third_party/blink/renderer/core/inspector/console_types.h"
 #include "third_party/blink/renderer/core/origin_trials/origin_trials.h"
 #include "third_party/blink/renderer/platform/runtime_enabled_features.h"
 
@@ -56,8 +56,9 @@
     HeapVector<Member<ConsoleMessage>>* messages) {
   DCHECK(messages);
   for (const auto& message : report_info.ConsoleErrorMessages()) {
-    messages->push_back(ConsoleMessage::Create(
-        kSecurityMessageSource, mojom::ConsoleMessageLevel::kError, message));
+    messages->push_back(
+        ConsoleMessage::Create(mojom::ConsoleMessageSource::kSecurity,
+                               mojom::ConsoleMessageLevel::kError, message));
   }
 }
 
diff --git a/third_party/blink/renderer/core/loader/threadable_loader.cc b/third_party/blink/renderer/core/loader/threadable_loader.cc
index f83eab0..e2c2a6c26 100644
--- a/third_party/blink/renderer/core/loader/threadable_loader.cc
+++ b/third_party/blink/renderer/core/loader/threadable_loader.cc
@@ -622,7 +622,8 @@
       ThreadableLoaderClient* client = client_;
       Clear();
       ConsoleMessage* message = ConsoleMessage::Create(
-          kNetworkMessageSource, mojom::ConsoleMessageLevel::kError,
+          mojom::ConsoleMessageSource::kNetwork,
+          mojom::ConsoleMessageLevel::kError,
           "Failed to load resource: net::ERR_TOO_MANY_REDIRECTS",
           SourceLocation::Capture(original_url, 0, 0));
       execution_context_->AddConsoleMessage(message);
@@ -1024,8 +1025,8 @@
         *GetSecurityOrigin(), ResourceType::kRaw,
         resource_loader_options_.initiator_info.name);
     execution_context_->AddConsoleMessage(ConsoleMessage::Create(
-        kJSMessageSource, mojom::ConsoleMessageLevel::kError,
-        std::move(message)));
+        mojom::ConsoleMessageSource::kJavaScript,
+        mojom::ConsoleMessageLevel::kError, std::move(message)));
   }
   Resource* resource = GetResource();
   if (resource)
diff --git a/third_party/blink/renderer/core/page/chrome_client.cc b/third_party/blink/renderer/core/page/chrome_client.cc
index 6c81bdb..b5dc2e2 100644
--- a/third_party/blink/renderer/core/page/chrome_client.cc
+++ b/third_party/blink/renderer/core/page/chrome_client.cc
@@ -261,7 +261,8 @@
     UseCounter::Count(frame->GetDocument(),
                       WebFeature::kDialogInSandboxedContext);
     frame->Console().AddMessage(ConsoleMessage::Create(
-        kSecurityMessageSource, mojom::ConsoleMessageLevel::kError,
+        mojom::ConsoleMessageSource::kSecurity,
+        mojom::ConsoleMessageLevel::kError,
         "Ignored call to 'print()'. The document is sandboxed, and the "
         "'allow-modals' keyword is not set."));
     return false;
diff --git a/third_party/blink/renderer/core/page/chrome_client.h b/third_party/blink/renderer/core/page/chrome_client.h
index 2b8dbac..afec0ec 100644
--- a/third_party/blink/renderer/core/page/chrome_client.h
+++ b/third_party/blink/renderer/core/page/chrome_client.h
@@ -178,7 +178,7 @@
   virtual bool ShouldReportDetailedMessageForSource(LocalFrame&,
                                                     const String& source) = 0;
   virtual void AddMessageToConsole(LocalFrame*,
-                                   MessageSource,
+                                   mojom::ConsoleMessageSource,
                                    mojom::ConsoleMessageLevel,
                                    const String& message,
                                    unsigned line_number,
diff --git a/third_party/blink/renderer/core/page/chrome_client_impl.cc b/third_party/blink/renderer/core/page/chrome_client_impl.cc
index 6982a52..c9e90726 100644
--- a/third_party/blink/renderer/core/page/chrome_client_impl.cc
+++ b/third_party/blink/renderer/core/page/chrome_client_impl.cc
@@ -309,7 +309,7 @@
 }
 
 void ChromeClientImpl::AddMessageToConsole(LocalFrame* local_frame,
-                                           MessageSource source,
+                                           mojom::ConsoleMessageSource source,
                                            mojom::ConsoleMessageLevel level,
                                            const String& message,
                                            unsigned line_number,
diff --git a/third_party/blink/renderer/core/page/chrome_client_impl.h b/third_party/blink/renderer/core/page/chrome_client_impl.h
index f6b8fc9..38089c5 100644
--- a/third_party/blink/renderer/core/page/chrome_client_impl.h
+++ b/third_party/blink/renderer/core/page/chrome_client_impl.h
@@ -93,7 +93,7 @@
   bool ShouldReportDetailedMessageForSource(LocalFrame&,
                                             const String&) override;
   void AddMessageToConsole(LocalFrame*,
-                           MessageSource,
+                           mojom::ConsoleMessageSource,
                            mojom::ConsoleMessageLevel,
                            const String& message,
                            unsigned line_number,
diff --git a/third_party/blink/renderer/core/page/create_window.cc b/third_party/blink/renderer/core/page/create_window.cc
index 9805042..e323f12 100644
--- a/third_party/blink/renderer/core/page/create_window.cc
+++ b/third_party/blink/renderer/core/page/create_window.cc
@@ -335,7 +335,8 @@
       // FIXME: This message should be moved off the console once a solution to
       // https://bugs.webkit.org/show_bug.cgi?id=103274 exists.
       opener_frame.GetDocument()->AddConsoleMessage(ConsoleMessage::Create(
-          kSecurityMessageSource, mojom::ConsoleMessageLevel::kError,
+          mojom::ConsoleMessageSource::kSecurity,
+          mojom::ConsoleMessageLevel::kError,
           "Blocked opening '" +
               request.GetResourceRequest().Url().ElidedString() +
               "' in a new window because the request was made in a sandboxed "
diff --git a/third_party/blink/renderer/core/page/page.cc b/third_party/blink/renderer/core/page/page.cc
index ca943ff..d10a5881 100644
--- a/third_party/blink/renderer/core/page/page.cc
+++ b/third_party/blink/renderer/core/page/page.cc
@@ -866,7 +866,8 @@
 void Page::ReportIntervention(const String& text) {
   if (LocalFrame* local_frame = DeprecatedLocalMainFrame()) {
     ConsoleMessage* message = ConsoleMessage::Create(
-        kOtherMessageSource, mojom::ConsoleMessageLevel::kWarning, text,
+        mojom::ConsoleMessageSource::kOther,
+        mojom::ConsoleMessageLevel::kWarning, text,
         std::make_unique<SourceLocation>(String(), 0, 0, nullptr));
     local_frame->GetDocument()->AddConsoleMessage(message);
   }
diff --git a/third_party/blink/renderer/core/page/pointer_lock_controller.cc b/third_party/blink/renderer/core/page/pointer_lock_controller.cc
index 2ee21d9..f751ae22 100644
--- a/third_party/blink/renderer/core/page/pointer_lock_controller.cc
+++ b/third_party/blink/renderer/core/page/pointer_lock_controller.cc
@@ -61,7 +61,8 @@
     // FIXME: This message should be moved off the console once a solution to
     // https://bugs.webkit.org/show_bug.cgi?id=103274 exists.
     target->GetDocument().AddConsoleMessage(ConsoleMessage::Create(
-        kSecurityMessageSource, mojom::ConsoleMessageLevel::kError,
+        mojom::ConsoleMessageSource::kSecurity,
+        mojom::ConsoleMessageLevel::kError,
         "Blocked pointer lock on an element because the element's frame is "
         "sandboxed and the 'allow-pointer-lock' permission is not set."));
     EnqueueEvent(event_type_names::kPointerlockerror, target);
diff --git a/third_party/blink/renderer/core/paint/ng/ng_paint_fragment.cc b/third_party/blink/renderer/core/paint/ng/ng_paint_fragment.cc
index b713e36..ef178b9 100644
--- a/third_party/blink/renderer/core/paint/ng/ng_paint_fragment.cc
+++ b/third_party/blink/renderer/core/paint/ng/ng_paint_fragment.cc
@@ -352,12 +352,6 @@
   return physical_fragment_->HasSelfPaintingLayer();
 }
 
-bool NGPaintFragment::HasOverflowClip() const {
-  auto* box_physical_fragment =
-      DynamicTo<NGPhysicalBoxFragment>(physical_fragment_.get());
-  return box_physical_fragment && box_physical_fragment->HasOverflowClip();
-}
-
 bool NGPaintFragment::ShouldClipOverflow() const {
   auto* box_physical_fragment =
       DynamicTo<NGPhysicalBoxFragment>(physical_fragment_.get());
@@ -543,9 +537,6 @@
 }
 
 NGPhysicalOffsetRect NGPaintFragment::InkOverflow() const {
-  if (HasOverflowClip() || Style().HasMask())
-    return SelfInkOverflow();
-
   // Get the cached value in |LayoutBox| if there is one.
   if (const LayoutBox* box = InkOverflowOwnerBox())
     return NGPhysicalOffsetRect(box->VisualOverflowRect());
@@ -557,6 +548,12 @@
 
   if (!ink_overflow_)
     return fragment.LocalRect();
+
+  // |Style()| is one of the most expensive operations in this function. Do this
+  // after other checks.
+  if (HasOverflowClip() || fragment.Style().HasMask())
+    return ink_overflow_->self_ink_overflow;
+
   NGPhysicalOffsetRect rect = ink_overflow_->self_ink_overflow;
   rect.Unite(ink_overflow_->contents_ink_overflow);
   return rect;
diff --git a/third_party/blink/renderer/core/paint/ng/ng_paint_fragment.h b/third_party/blink/renderer/core/paint/ng/ng_paint_fragment.h
index 04ef80a..35f9638 100644
--- a/third_party/blink/renderer/core/paint/ng/ng_paint_fragment.h
+++ b/third_party/blink/renderer/core/paint/ng/ng_paint_fragment.h
@@ -165,7 +165,7 @@
 
   // TODO(layout-dev): Implement when we have oveflow support.
   // TODO(eae): Switch to using NG geometry types.
-  bool HasOverflowClip() const;
+  bool HasOverflowClip() const { return PhysicalFragment().HasOverflowClip(); }
   bool ShouldClipOverflow() const;
   bool HasSelfPaintingLayer() const;
   // This is equivalent to LayoutObject::VisualRect
diff --git a/third_party/blink/renderer/core/paint/svg_image_painter.cc b/third_party/blink/renderer/core/paint/svg_image_painter.cc
index c93fe058..85ae755 100644
--- a/third_party/blink/renderer/core/paint/svg_image_painter.cc
+++ b/third_party/blink/renderer/core/paint/svg_image_painter.cc
@@ -64,7 +64,8 @@
   if (image_viewport_size.IsEmpty())
     return;
 
-  scoped_refptr<Image> image = image_resource->GetImage(image_viewport_size);
+  scoped_refptr<Image> image =
+      image_resource->GetImage(ExpandedIntSize(image_viewport_size));
   FloatRect dest_rect = layout_svg_image_.ObjectBoundingBox();
   FloatRect src_rect(0, 0, image->width(), image->height());
 
diff --git a/third_party/blink/renderer/core/script/document_write_intervention.cc b/third_party/blink/renderer/core/script/document_write_intervention.cc
index cac96513..fbe4bfc3 100644
--- a/third_party/blink/renderer/core/script/document_write_intervention.cc
+++ b/third_party/blink/renderer/core/script/document_write_intervention.cc
@@ -31,8 +31,9 @@
       "confirmed in a subsequent console message. "
       "See https://www.chromestatus.com/feature/5718547946799104 "
       "for more details.";
-  document.AddConsoleMessage(ConsoleMessage::Create(
-      kJSMessageSource, mojom::ConsoleMessageLevel::kWarning, message));
+  document.AddConsoleMessage(
+      ConsoleMessage::Create(mojom::ConsoleMessageSource::kJavaScript,
+                             mojom::ConsoleMessageLevel::kWarning, message));
   DVLOG(1) << message.Utf8().data();
 }
 
@@ -42,8 +43,9 @@
       ", invoked via document.write was NOT BLOCKED on this page load, but MAY "
       "be blocked by the browser in future page loads with poor network "
       "connectivity.";
-  document.AddConsoleMessage(ConsoleMessage::Create(
-      kJSMessageSource, mojom::ConsoleMessageLevel::kWarning, message));
+  document.AddConsoleMessage(
+      ConsoleMessage::Create(mojom::ConsoleMessageSource::kJavaScript,
+                             mojom::ConsoleMessageLevel::kWarning, message));
 }
 
 void EmitErrorBlocked(const String& url, Document& document) {
@@ -53,8 +55,9 @@
       url +
       ", invoked via document.write was BLOCKED by the browser due to poor "
       "network connectivity. ";
-  document.AddConsoleMessage(ConsoleMessage::Create(
-      kInterventionMessageSource, mojom::ConsoleMessageLevel::kError, message));
+  document.AddConsoleMessage(
+      ConsoleMessage::Create(mojom::ConsoleMessageSource::kIntervention,
+                             mojom::ConsoleMessageLevel::kError, message));
 }
 
 void AddWarningHeader(FetchParameters* params) {
diff --git a/third_party/blink/renderer/core/script/script_loader.cc b/third_party/blink/renderer/core/script/script_loader.cc
index a52c8bf..ee13fecc 100644
--- a/third_party/blink/renderer/core/script/script_loader.cc
+++ b/third_party/blink/renderer/core/script/script_loader.cc
@@ -186,16 +186,18 @@
 
   if (!modulator->IsAcquiringImportMaps()) {
     element_document.AddConsoleMessage(ConsoleMessage::Create(
-        kJSMessageSource, mojom::ConsoleMessageLevel::kError,
+        mojom::ConsoleMessageSource::kJavaScript,
+        mojom::ConsoleMessageLevel::kError,
         "An import map is added after module script load was triggered."));
     return ShouldFireErrorEvent::kShouldFire;
   }
 
   // TODO(crbug.com/922212): Implemenet external import maps.
   if (element.HasSourceAttribute()) {
-    element_document.AddConsoleMessage(ConsoleMessage::Create(
-        kJSMessageSource, mojom::ConsoleMessageLevel::kError,
-        "External import maps are not yet supported."));
+    element_document.AddConsoleMessage(
+        ConsoleMessage::Create(mojom::ConsoleMessageSource::kJavaScript,
+                               mojom::ConsoleMessageLevel::kError,
+                               "External import maps are not yet supported."));
     return ShouldFireErrorEvent::kShouldFire;
   }
 
@@ -432,7 +434,8 @@
   if (ShouldBlockSyncScriptForFeaturePolicy(element_.Get(), GetScriptType(),
                                             parser_inserted_)) {
     element_document.AddConsoleMessage(ConsoleMessage::Create(
-        kJSMessageSource, mojom::ConsoleMessageLevel::kError,
+        mojom::ConsoleMessageSource::kJavaScript,
+        mojom::ConsoleMessageLevel::kError,
         "Synchronous script execution is disabled by Feature Policy"));
     return false;
   }
diff --git a/third_party/blink/renderer/core/script/xml_parser_script_runner.cc b/third_party/blink/renderer/core/script/xml_parser_script_runner.cc
index f7b2ed8..e4fa433e 100644
--- a/third_party/blink/renderer/core/script/xml_parser_script_runner.cc
+++ b/third_party/blink/renderer/core/script/xml_parser_script_runner.cc
@@ -79,10 +79,11 @@
   if (script_loader->GetScriptType() != mojom::ScriptType::kClassic) {
     // XMLDocumentParser does not support a module script, and thus ignores it.
     success = false;
-    document.AddConsoleMessage(ConsoleMessage::Create(
-        kJSMessageSource, mojom::ConsoleMessageLevel::kError,
-        "Module scripts in XML documents are currently "
-        "not supported. See crbug.com/717643"));
+    document.AddConsoleMessage(
+        ConsoleMessage::Create(mojom::ConsoleMessageSource::kJavaScript,
+                               mojom::ConsoleMessageLevel::kError,
+                               "Module scripts in XML documents are currently "
+                               "not supported. See crbug.com/717643"));
   }
 
   if (!success)
diff --git a/third_party/blink/renderer/core/style/computed_style.cc b/third_party/blink/renderer/core/style/computed_style.cc
index c76c7311..c10b31c 100644
--- a/third_party/blink/renderer/core/style/computed_style.cc
+++ b/third_party/blink/renderer/core/style/computed_style.cc
@@ -227,7 +227,7 @@
       !old_style->HasPseudoStyle(kPseudoIdFirstLine))
     return true;
 
-  return old_style->ForceLegacyLayout() != new_style->ForceLegacyLayout();
+  return false;
 }
 
 ComputedStyle::Difference ComputedStyle::ComputeDifference(
diff --git a/third_party/blink/renderer/core/style/computed_style_extra_fields.json5 b/third_party/blink/renderer/core/style/computed_style_extra_fields.json5
index c958e8fd..c21e078 100644
--- a/third_party/blink/renderer/core/style/computed_style_extra_fields.json5
+++ b/third_party/blink/renderer/core/style/computed_style_extra_fields.json5
@@ -1045,14 +1045,6 @@
       keywords: ["no-auto-repeat", "auto-fill", "auto-fit"],
       default_value: "no-auto-repeat",
     },
-    {
-      name: "ForceLegacyLayout",
-      inherited: true,
-      field_template: "primitive",
-      type_name: "bool",
-      default_value: "false",
-      field_group: "*",
-    },
     // We only create and store ComputedStyle objects for elements in
     // display:none subtrees if we need it for e.g. getComputedStyle. This flag
     // is true for such ComputedStyle objects.
diff --git a/third_party/blink/renderer/core/style/content_data.cc b/third_party/blink/renderer/core/style/content_data.cc
index c9b3362..ef2b5f5 100644
--- a/third_party/blink/renderer/core/style/content_data.cc
+++ b/third_party/blink/renderer/core/style/content_data.cc
@@ -68,9 +68,9 @@
   visitor->Trace(next_);
 }
 
-LayoutObject* ImageContentData::CreateLayoutObject(
-    PseudoElement& pseudo,
-    ComputedStyle& pseudo_style) const {
+LayoutObject* ImageContentData::CreateLayoutObject(PseudoElement& pseudo,
+                                                   ComputedStyle& pseudo_style,
+                                                   LegacyLayout) const {
   LayoutImage* image = LayoutImage::CreateAnonymous(pseudo);
   image->SetPseudoStyle(&pseudo_style);
   if (image_)
@@ -86,26 +86,27 @@
   ContentData::Trace(visitor);
 }
 
-LayoutObject* TextContentData::CreateLayoutObject(
-    PseudoElement& pseudo,
-    ComputedStyle& pseudo_style) const {
+LayoutObject* TextContentData::CreateLayoutObject(PseudoElement& pseudo,
+                                                  ComputedStyle& pseudo_style,
+                                                  LegacyLayout legacy) const {
   LayoutObject* layout_object =
-      LayoutTextFragment::CreateAnonymous(pseudo_style, pseudo, text_.Impl());
+      LayoutTextFragment::CreateAnonymous(pseudo, text_.Impl(), legacy);
   layout_object->SetPseudoStyle(&pseudo_style);
   return layout_object;
 }
 
 LayoutObject* CounterContentData::CreateLayoutObject(
     PseudoElement& pseudo,
-    ComputedStyle& pseudo_style) const {
+    ComputedStyle& pseudo_style,
+    LegacyLayout) const {
   LayoutObject* layout_object = new LayoutCounter(pseudo, *counter_);
   layout_object->SetPseudoStyle(&pseudo_style);
   return layout_object;
 }
 
-LayoutObject* QuoteContentData::CreateLayoutObject(
-    PseudoElement& pseudo,
-    ComputedStyle& pseudo_style) const {
+LayoutObject* QuoteContentData::CreateLayoutObject(PseudoElement& pseudo,
+                                                   ComputedStyle& pseudo_style,
+                                                   LegacyLayout) const {
   LayoutObject* layout_object = new LayoutQuote(pseudo, quote_);
   layout_object->SetPseudoStyle(&pseudo_style);
   return layout_object;
diff --git a/third_party/blink/renderer/core/style/content_data.h b/third_party/blink/renderer/core/style/content_data.h
index 1d113d2..e1c47f6 100644
--- a/third_party/blink/renderer/core/style/content_data.h
+++ b/third_party/blink/renderer/core/style/content_data.h
@@ -37,6 +37,7 @@
 
 class ComputedStyle;
 class LayoutObject;
+enum class LegacyLayout;
 class PseudoElement;
 
 class ContentData : public GarbageCollectedFinalized<ContentData> {
@@ -54,7 +55,8 @@
   virtual bool IsText() const { return false; }
 
   virtual LayoutObject* CreateLayoutObject(PseudoElement&,
-                                           ComputedStyle&) const = 0;
+                                           ComputedStyle&,
+                                           LegacyLayout) const = 0;
 
   virtual ContentData* Clone() const;
 
@@ -86,7 +88,8 @@
 
   bool IsImage() const override { return true; }
   LayoutObject* CreateLayoutObject(PseudoElement&,
-                                   ComputedStyle&) const override;
+                                   ComputedStyle&,
+                                   LegacyLayout) const override;
 
   bool Equals(const ContentData& data) const override {
     if (!data.IsImage())
@@ -124,7 +127,8 @@
 
   bool IsText() const override { return true; }
   LayoutObject* CreateLayoutObject(PseudoElement&,
-                                   ComputedStyle&) const override;
+                                   ComputedStyle&,
+                                   LegacyLayout) const override;
 
   bool Equals(const ContentData& data) const override {
     if (!data.IsText())
@@ -157,7 +161,8 @@
 
   bool IsCounter() const override { return true; }
   LayoutObject* CreateLayoutObject(PseudoElement&,
-                                   ComputedStyle&) const override;
+                                   ComputedStyle&,
+                                   LegacyLayout) const override;
 
  private:
   ContentData* CloneInternal() const override {
@@ -194,7 +199,8 @@
 
   bool IsQuote() const override { return true; }
   LayoutObject* CreateLayoutObject(PseudoElement&,
-                                   ComputedStyle&) const override;
+                                   ComputedStyle&,
+                                   LegacyLayout) const override;
 
   bool Equals(const ContentData& data) const override {
     if (!data.IsQuote())
diff --git a/third_party/blink/renderer/core/svg/svg_a_element.cc b/third_party/blink/renderer/core/svg/svg_a_element.cc
index a673592c..a59e7e1c 100644
--- a/third_party/blink/renderer/core/svg/svg_a_element.cc
+++ b/third_party/blink/renderer/core/svg/svg_a_element.cc
@@ -96,7 +96,8 @@
   SVGGraphicsElement::SvgAttributeChanged(attr_name);
 }
 
-LayoutObject* SVGAElement::CreateLayoutObject(const ComputedStyle&) {
+LayoutObject* SVGAElement::CreateLayoutObject(const ComputedStyle&,
+                                              LegacyLayout) {
   if (parentNode() && parentNode()->IsSVGElement() &&
       ToSVGElement(parentNode())->IsTextContent())
     return new LayoutSVGInline(this);
diff --git a/third_party/blink/renderer/core/svg/svg_a_element.h b/third_party/blink/renderer/core/svg/svg_a_element.h
index b213ac5..80bcaebbd58 100644
--- a/third_party/blink/renderer/core/svg/svg_a_element.h
+++ b/third_party/blink/renderer/core/svg/svg_a_element.h
@@ -46,7 +46,7 @@
 
   void SvgAttributeChanged(const QualifiedName&) override;
 
-  LayoutObject* CreateLayoutObject(const ComputedStyle&) override;
+  LayoutObject* CreateLayoutObject(const ComputedStyle&, LegacyLayout) override;
 
   void DefaultEventHandler(Event&) override;
   bool HasActivationBehavior() const override;
diff --git a/third_party/blink/renderer/core/svg/svg_circle_element.cc b/third_party/blink/renderer/core/svg/svg_circle_element.cc
index de23c75..1073d18 100644
--- a/third_party/blink/renderer/core/svg/svg_circle_element.cc
+++ b/third_party/blink/renderer/core/svg/svg_circle_element.cc
@@ -111,7 +111,8 @@
          cy_->CurrentValue()->IsRelative() || r_->CurrentValue()->IsRelative();
 }
 
-LayoutObject* SVGCircleElement::CreateLayoutObject(const ComputedStyle&) {
+LayoutObject* SVGCircleElement::CreateLayoutObject(const ComputedStyle&,
+                                                   LegacyLayout) {
   return new LayoutSVGEllipse(this);
 }
 
diff --git a/third_party/blink/renderer/core/svg/svg_circle_element.h b/third_party/blink/renderer/core/svg/svg_circle_element.h
index 18fe18a..977fecf7 100644
--- a/third_party/blink/renderer/core/svg/svg_circle_element.h
+++ b/third_party/blink/renderer/core/svg/svg_circle_element.h
@@ -53,7 +53,7 @@
 
   bool SelfHasRelativeLengths() const override;
 
-  LayoutObject* CreateLayoutObject(const ComputedStyle&) override;
+  LayoutObject* CreateLayoutObject(const ComputedStyle&, LegacyLayout) override;
 
   Member<SVGAnimatedLength> cx_;
   Member<SVGAnimatedLength> cy_;
diff --git a/third_party/blink/renderer/core/svg/svg_clip_path_element.cc b/third_party/blink/renderer/core/svg/svg_clip_path_element.cc
index eb5fe77..06258c1 100644
--- a/third_party/blink/renderer/core/svg/svg_clip_path_element.cc
+++ b/third_party/blink/renderer/core/svg/svg_clip_path_element.cc
@@ -68,7 +68,8 @@
   }
 }
 
-LayoutObject* SVGClipPathElement::CreateLayoutObject(const ComputedStyle&) {
+LayoutObject* SVGClipPathElement::CreateLayoutObject(const ComputedStyle&,
+                                                     LegacyLayout) {
   return new LayoutSVGResourceClipper(this);
 }
 
diff --git a/third_party/blink/renderer/core/svg/svg_clip_path_element.h b/third_party/blink/renderer/core/svg/svg_clip_path_element.h
index 81b4dbaa..7c12cd2a 100644
--- a/third_party/blink/renderer/core/svg/svg_clip_path_element.h
+++ b/third_party/blink/renderer/core/svg/svg_clip_path_element.h
@@ -50,7 +50,7 @@
   void SvgAttributeChanged(const QualifiedName&) override;
   void ChildrenChanged(const ChildrenChange&) override;
 
-  LayoutObject* CreateLayoutObject(const ComputedStyle&) override;
+  LayoutObject* CreateLayoutObject(const ComputedStyle&, LegacyLayout) override;
 
   Member<SVGAnimatedEnumeration<SVGUnitTypes::SVGUnitType>> clip_path_units_;
 };
diff --git a/third_party/blink/renderer/core/svg/svg_defs_element.cc b/third_party/blink/renderer/core/svg/svg_defs_element.cc
index 7e8fbcf..eca0a78 100644
--- a/third_party/blink/renderer/core/svg/svg_defs_element.cc
+++ b/third_party/blink/renderer/core/svg/svg_defs_element.cc
@@ -30,7 +30,8 @@
 
 DEFINE_NODE_FACTORY(SVGDefsElement)
 
-LayoutObject* SVGDefsElement::CreateLayoutObject(const ComputedStyle&) {
+LayoutObject* SVGDefsElement::CreateLayoutObject(const ComputedStyle&,
+                                                 LegacyLayout) {
   return new LayoutSVGHiddenContainer(this);
 }
 
diff --git a/third_party/blink/renderer/core/svg/svg_defs_element.h b/third_party/blink/renderer/core/svg/svg_defs_element.h
index 8121ce1b..7e94d32 100644
--- a/third_party/blink/renderer/core/svg/svg_defs_element.h
+++ b/third_party/blink/renderer/core/svg/svg_defs_element.h
@@ -36,7 +36,7 @@
   bool SupportsFocus() const override { return false; }
 
  private:
-  LayoutObject* CreateLayoutObject(const ComputedStyle&) override;
+  LayoutObject* CreateLayoutObject(const ComputedStyle&, LegacyLayout) override;
 };
 
 }  // namespace blink
diff --git a/third_party/blink/renderer/core/svg/svg_element.cc b/third_party/blink/renderer/core/svg/svg_element.cc
index 3f07fa3..b58723a 100644
--- a/third_party/blink/renderer/core/svg/svg_element.cc
+++ b/third_party/blink/renderer/core/svg/svg_element.cc
@@ -159,9 +159,10 @@
   // Don't report any errors on attribute removal.
   if (value.IsNull())
     return;
-  GetDocument().AddConsoleMessage(ConsoleMessage::Create(
-      kRenderingMessageSource, mojom::ConsoleMessageLevel::kError,
-      "Error: " + error.Format(tagName(), name, value)));
+  GetDocument().AddConsoleMessage(
+      ConsoleMessage::Create(mojom::ConsoleMessageSource::kRendering,
+                             mojom::ConsoleMessageLevel::kError,
+                             "Error: " + error.Format(tagName(), name, value)));
 }
 
 String SVGElement::title() const {
diff --git a/third_party/blink/renderer/core/svg/svg_ellipse_element.cc b/third_party/blink/renderer/core/svg/svg_ellipse_element.cc
index b9b79dd..de794ac 100644
--- a/third_party/blink/renderer/core/svg/svg_ellipse_element.cc
+++ b/third_party/blink/renderer/core/svg/svg_ellipse_element.cc
@@ -127,7 +127,8 @@
          rx_->CurrentValue()->IsRelative() || ry_->CurrentValue()->IsRelative();
 }
 
-LayoutObject* SVGEllipseElement::CreateLayoutObject(const ComputedStyle&) {
+LayoutObject* SVGEllipseElement::CreateLayoutObject(const ComputedStyle&,
+                                                    LegacyLayout) {
   return new LayoutSVGEllipse(this);
 }
 
diff --git a/third_party/blink/renderer/core/svg/svg_ellipse_element.h b/third_party/blink/renderer/core/svg/svg_ellipse_element.h
index 7de52bb..ce132b9 100644
--- a/third_party/blink/renderer/core/svg/svg_ellipse_element.h
+++ b/third_party/blink/renderer/core/svg/svg_ellipse_element.h
@@ -54,7 +54,7 @@
 
   bool SelfHasRelativeLengths() const override;
 
-  LayoutObject* CreateLayoutObject(const ComputedStyle&) override;
+  LayoutObject* CreateLayoutObject(const ComputedStyle&, LegacyLayout) override;
 
   Member<SVGAnimatedLength> cx_;
   Member<SVGAnimatedLength> cy_;
diff --git a/third_party/blink/renderer/core/svg/svg_filter_element.cc b/third_party/blink/renderer/core/svg/svg_filter_element.cc
index 8cc60f8..638c939c 100644
--- a/third_party/blink/renderer/core/svg/svg_filter_element.cc
+++ b/third_party/blink/renderer/core/svg/svg_filter_element.cc
@@ -139,7 +139,8 @@
   InvalidateFilterChain();
 }
 
-LayoutObject* SVGFilterElement::CreateLayoutObject(const ComputedStyle&) {
+LayoutObject* SVGFilterElement::CreateLayoutObject(const ComputedStyle&,
+                                                   LegacyLayout) {
   return new LayoutSVGResourceFilter(this);
 }
 
diff --git a/third_party/blink/renderer/core/svg/svg_filter_element.h b/third_party/blink/renderer/core/svg/svg_filter_element.h
index f78e53b..07e76b2ac 100644
--- a/third_party/blink/renderer/core/svg/svg_filter_element.h
+++ b/third_party/blink/renderer/core/svg/svg_filter_element.h
@@ -73,7 +73,7 @@
   void SvgAttributeChanged(const QualifiedName&) override;
   void ChildrenChanged(const ChildrenChange&) override;
 
-  LayoutObject* CreateLayoutObject(const ComputedStyle&) override;
+  LayoutObject* CreateLayoutObject(const ComputedStyle&, LegacyLayout) override;
 
   bool SelfHasRelativeLengths() const override;
 
diff --git a/third_party/blink/renderer/core/svg/svg_filter_primitive_standard_attributes.cc b/third_party/blink/renderer/core/svg/svg_filter_primitive_standard_attributes.cc
index 20ee460..925a76d 100644
--- a/third_party/blink/renderer/core/svg/svg_filter_primitive_standard_attributes.cc
+++ b/third_party/blink/renderer/core/svg/svg_filter_primitive_standard_attributes.cc
@@ -159,7 +159,8 @@
 }
 
 LayoutObject* SVGFilterPrimitiveStandardAttributes::CreateLayoutObject(
-    const ComputedStyle&) {
+    const ComputedStyle&,
+    LegacyLayout) {
   return new LayoutSVGResourceFilterPrimitive(this);
 }
 
diff --git a/third_party/blink/renderer/core/svg/svg_filter_primitive_standard_attributes.h b/third_party/blink/renderer/core/svg/svg_filter_primitive_standard_attributes.h
index 90f533a..2aed48ff 100644
--- a/third_party/blink/renderer/core/svg/svg_filter_primitive_standard_attributes.h
+++ b/third_party/blink/renderer/core/svg/svg_filter_primitive_standard_attributes.h
@@ -69,7 +69,7 @@
  private:
   bool IsFilterEffect() const final { return true; }
 
-  LayoutObject* CreateLayoutObject(const ComputedStyle&) override;
+  LayoutObject* CreateLayoutObject(const ComputedStyle&, LegacyLayout) override;
   bool LayoutObjectIsNeeded(const ComputedStyle&) const final;
 
   Member<SVGAnimatedLength> x_;
diff --git a/third_party/blink/renderer/core/svg/svg_foreign_object_element.cc b/third_party/blink/renderer/core/svg/svg_foreign_object_element.cc
index e191e17..6343633 100644
--- a/third_party/blink/renderer/core/svg/svg_foreign_object_element.cc
+++ b/third_party/blink/renderer/core/svg/svg_foreign_object_element.cc
@@ -119,8 +119,8 @@
   SVGGraphicsElement::SvgAttributeChanged(attr_name);
 }
 
-LayoutObject* SVGForeignObjectElement::CreateLayoutObject(
-    const ComputedStyle&) {
+LayoutObject* SVGForeignObjectElement::CreateLayoutObject(const ComputedStyle&,
+                                                          LegacyLayout) {
   return new LayoutSVGForeignObject(this);
 }
 
diff --git a/third_party/blink/renderer/core/svg/svg_foreign_object_element.h b/third_party/blink/renderer/core/svg/svg_foreign_object_element.h
index 4717db6..a4d3786 100644
--- a/third_party/blink/renderer/core/svg/svg_foreign_object_element.h
+++ b/third_party/blink/renderer/core/svg/svg_foreign_object_element.h
@@ -48,13 +48,13 @@
       MutableCSSPropertyValueSet*) override;
   void SvgAttributeChanged(const QualifiedName&) override;
 
-  LayoutObject* CreateLayoutObject(const ComputedStyle&) override;
+  LayoutObject* CreateLayoutObject(const ComputedStyle&, LegacyLayout) override;
 
   // As long as the foreignObject element itself creates a legacy layout object,
   // we need to use legacy layout for the entire block formatting context
   // established by the foreignObject. For simplicity, just force legacy for the
   // entire subtree.
-  bool ShouldForceLegacyLayout() const override { return true; }
+  bool TypeShouldForceLegacyLayout() const override { return true; }
 
   bool SelfHasRelativeLengths() const override;
 
diff --git a/third_party/blink/renderer/core/svg/svg_g_element.cc b/third_party/blink/renderer/core/svg/svg_g_element.cc
index 3ecd675..cbfaae7 100644
--- a/third_party/blink/renderer/core/svg/svg_g_element.cc
+++ b/third_party/blink/renderer/core/svg/svg_g_element.cc
@@ -32,7 +32,8 @@
 
 DEFINE_NODE_FACTORY(SVGGElement)
 
-LayoutObject* SVGGElement::CreateLayoutObject(const ComputedStyle& style) {
+LayoutObject* SVGGElement::CreateLayoutObject(const ComputedStyle& style,
+                                              LegacyLayout) {
   // SVG 1.1 testsuite explicitly uses constructs like
   // <g display="none"><linearGradient>
   // We still have to create layoutObjects for the <g> & <linearGradient>
diff --git a/third_party/blink/renderer/core/svg/svg_g_element.h b/third_party/blink/renderer/core/svg/svg_g_element.h
index 01b2609..c01149a 100644
--- a/third_party/blink/renderer/core/svg/svg_g_element.h
+++ b/third_party/blink/renderer/core/svg/svg_g_element.h
@@ -34,7 +34,7 @@
   explicit SVGGElement(Document&, ConstructionType = kCreateSVGElement);
 
  protected:
-  LayoutObject* CreateLayoutObject(const ComputedStyle&) override;
+  LayoutObject* CreateLayoutObject(const ComputedStyle&, LegacyLayout) override;
 
  private:
   bool LayoutObjectIsNeeded(const ComputedStyle&) const override;
diff --git a/third_party/blink/renderer/core/svg/svg_geometry_element.cc b/third_party/blink/renderer/core/svg/svg_geometry_element.cc
index 6893a4c..262a2795 100644
--- a/third_party/blink/renderer/core/svg/svg_geometry_element.cc
+++ b/third_party/blink/renderer/core/svg/svg_geometry_element.cc
@@ -217,7 +217,8 @@
   }
 }
 
-LayoutObject* SVGGeometryElement::CreateLayoutObject(const ComputedStyle&) {
+LayoutObject* SVGGeometryElement::CreateLayoutObject(const ComputedStyle&,
+                                                     LegacyLayout) {
   // By default, any subclass is expected to do path-based drawing.
   return new LayoutSVGPath(this);
 }
diff --git a/third_party/blink/renderer/core/svg/svg_geometry_element.h b/third_party/blink/renderer/core/svg/svg_geometry_element.h
index f60d074d..cff2850 100644
--- a/third_party/blink/renderer/core/svg/svg_geometry_element.h
+++ b/third_party/blink/renderer/core/svg/svg_geometry_element.h
@@ -74,7 +74,7 @@
  private:
   bool IsSVGGeometryElement() const final { return true; }
   virtual float ComputePathLength() const;
-  LayoutObject* CreateLayoutObject(const ComputedStyle&) override;
+  LayoutObject* CreateLayoutObject(const ComputedStyle&, LegacyLayout) override;
 
   Member<SVGAnimatedNumber> path_length_;
 };
diff --git a/third_party/blink/renderer/core/svg/svg_image_element.cc b/third_party/blink/renderer/core/svg/svg_image_element.cc
index 18353d38..4ddd3fb 100644
--- a/third_party/blink/renderer/core/svg/svg_image_element.cc
+++ b/third_party/blink/renderer/core/svg/svg_image_element.cc
@@ -182,7 +182,8 @@
             &is_default_overridden_intrinsic_size_, &message);
     if (!message.IsEmpty()) {
       GetDocument().AddConsoleMessage(ConsoleMessage::Create(
-          kOtherMessageSource, mojom::ConsoleMessageLevel::kWarning, message));
+          mojom::ConsoleMessageSource::kOther,
+          mojom::ConsoleMessageLevel::kWarning, message));
     }
 
     if (intrinsic_size_changed) {
@@ -200,7 +201,8 @@
          height_->CurrentValue()->IsRelative();
 }
 
-LayoutObject* SVGImageElement::CreateLayoutObject(const ComputedStyle&) {
+LayoutObject* SVGImageElement::CreateLayoutObject(const ComputedStyle&,
+                                                  LegacyLayout) {
   return new LayoutSVGImage(this);
 }
 
diff --git a/third_party/blink/renderer/core/svg/svg_image_element.h b/third_party/blink/renderer/core/svg/svg_image_element.h
index 1f69ea6..19b5b80 100644
--- a/third_party/blink/renderer/core/svg/svg_image_element.h
+++ b/third_party/blink/renderer/core/svg/svg_image_element.h
@@ -96,7 +96,7 @@
   void AttachLayoutTree(AttachContext&) override;
   InsertionNotificationRequest InsertedInto(ContainerNode&) override;
 
-  LayoutObject* CreateLayoutObject(const ComputedStyle&) override;
+  LayoutObject* CreateLayoutObject(const ComputedStyle&, LegacyLayout) override;
 
   const AtomicString ImageSourceURL() const override;
 
diff --git a/third_party/blink/renderer/core/svg/svg_linear_gradient_element.cc b/third_party/blink/renderer/core/svg/svg_linear_gradient_element.cc
index 2345cb1..57c8964 100644
--- a/third_party/blink/renderer/core/svg/svg_linear_gradient_element.cc
+++ b/third_party/blink/renderer/core/svg/svg_linear_gradient_element.cc
@@ -80,8 +80,8 @@
   SVGGradientElement::SvgAttributeChanged(attr_name);
 }
 
-LayoutObject* SVGLinearGradientElement::CreateLayoutObject(
-    const ComputedStyle&) {
+LayoutObject* SVGLinearGradientElement::CreateLayoutObject(const ComputedStyle&,
+                                                           LegacyLayout) {
   return new LayoutSVGResourceLinearGradient(this);
 }
 
diff --git a/third_party/blink/renderer/core/svg/svg_linear_gradient_element.h b/third_party/blink/renderer/core/svg/svg_linear_gradient_element.h
index d96aa75e..99aa090 100644
--- a/third_party/blink/renderer/core/svg/svg_linear_gradient_element.h
+++ b/third_party/blink/renderer/core/svg/svg_linear_gradient_element.h
@@ -49,7 +49,7 @@
  private:
   void SvgAttributeChanged(const QualifiedName&) override;
 
-  LayoutObject* CreateLayoutObject(const ComputedStyle&) override;
+  LayoutObject* CreateLayoutObject(const ComputedStyle&, LegacyLayout) override;
 
   bool SelfHasRelativeLengths() const override;
 
diff --git a/third_party/blink/renderer/core/svg/svg_marker_element.cc b/third_party/blink/renderer/core/svg/svg_marker_element.cc
index e4675e2..3aa2a89 100644
--- a/third_party/blink/renderer/core/svg/svg_marker_element.cc
+++ b/third_party/blink/renderer/core/svg/svg_marker_element.cc
@@ -144,7 +144,8 @@
   setAttribute(svg_names::kOrientAttr, AtomicString(target->ValueAsString()));
 }
 
-LayoutObject* SVGMarkerElement::CreateLayoutObject(const ComputedStyle&) {
+LayoutObject* SVGMarkerElement::CreateLayoutObject(const ComputedStyle&,
+                                                   LegacyLayout) {
   return new LayoutSVGResourceMarker(this);
 }
 
diff --git a/third_party/blink/renderer/core/svg/svg_marker_element.h b/third_party/blink/renderer/core/svg/svg_marker_element.h
index 3cdf489..819bf3d 100644
--- a/third_party/blink/renderer/core/svg/svg_marker_element.h
+++ b/third_party/blink/renderer/core/svg/svg_marker_element.h
@@ -84,7 +84,7 @@
   void SvgAttributeChanged(const QualifiedName&) override;
   void ChildrenChanged(const ChildrenChange&) override;
 
-  LayoutObject* CreateLayoutObject(const ComputedStyle&) override;
+  LayoutObject* CreateLayoutObject(const ComputedStyle&, LegacyLayout) override;
   bool LayoutObjectIsNeeded(const ComputedStyle&) const override;
 
   bool SelfHasRelativeLengths() const override;
diff --git a/third_party/blink/renderer/core/svg/svg_mask_element.cc b/third_party/blink/renderer/core/svg/svg_mask_element.cc
index 707d049..d65c213f 100644
--- a/third_party/blink/renderer/core/svg/svg_mask_element.cc
+++ b/third_party/blink/renderer/core/svg/svg_mask_element.cc
@@ -148,7 +148,8 @@
   }
 }
 
-LayoutObject* SVGMaskElement::CreateLayoutObject(const ComputedStyle&) {
+LayoutObject* SVGMaskElement::CreateLayoutObject(const ComputedStyle&,
+                                                 LegacyLayout) {
   return new LayoutSVGResourceMasker(this);
 }
 
diff --git a/third_party/blink/renderer/core/svg/svg_mask_element.h b/third_party/blink/renderer/core/svg/svg_mask_element.h
index 2db7d96..1e40afc 100644
--- a/third_party/blink/renderer/core/svg/svg_mask_element.h
+++ b/third_party/blink/renderer/core/svg/svg_mask_element.h
@@ -61,7 +61,7 @@
   void SvgAttributeChanged(const QualifiedName&) override;
   void ChildrenChanged(const ChildrenChange&) override;
 
-  LayoutObject* CreateLayoutObject(const ComputedStyle&) override;
+  LayoutObject* CreateLayoutObject(const ComputedStyle&, LegacyLayout) override;
 
   bool SelfHasRelativeLengths() const override;
 
diff --git a/third_party/blink/renderer/core/svg/svg_pattern_element.cc b/third_party/blink/renderer/core/svg/svg_pattern_element.cc
index 34f15c2..96f3536 100644
--- a/third_party/blink/renderer/core/svg/svg_pattern_element.cc
+++ b/third_party/blink/renderer/core/svg/svg_pattern_element.cc
@@ -193,7 +193,8 @@
     layout_object->InvalidateCacheAndMarkForLayout(reason);
 }
 
-LayoutObject* SVGPatternElement::CreateLayoutObject(const ComputedStyle&) {
+LayoutObject* SVGPatternElement::CreateLayoutObject(const ComputedStyle&,
+                                                    LegacyLayout) {
   return new LayoutSVGResourcePattern(this);
 }
 
diff --git a/third_party/blink/renderer/core/svg/svg_pattern_element.h b/third_party/blink/renderer/core/svg/svg_pattern_element.h
index 9374c2ce..aeaa7e3 100644
--- a/third_party/blink/renderer/core/svg/svg_pattern_element.h
+++ b/third_party/blink/renderer/core/svg/svg_pattern_element.h
@@ -100,7 +100,7 @@
   void BuildPendingResource() override;
   void ClearResourceReferences();
 
-  LayoutObject* CreateLayoutObject(const ComputedStyle&) override;
+  LayoutObject* CreateLayoutObject(const ComputedStyle&, LegacyLayout) override;
 
   bool SelfHasRelativeLengths() const override;
 
diff --git a/third_party/blink/renderer/core/svg/svg_radial_gradient_element.cc b/third_party/blink/renderer/core/svg/svg_radial_gradient_element.cc
index e5800f6b..a2ddfed 100644
--- a/third_party/blink/renderer/core/svg/svg_radial_gradient_element.cc
+++ b/third_party/blink/renderer/core/svg/svg_radial_gradient_element.cc
@@ -92,8 +92,8 @@
   SVGGradientElement::SvgAttributeChanged(attr_name);
 }
 
-LayoutObject* SVGRadialGradientElement::CreateLayoutObject(
-    const ComputedStyle&) {
+LayoutObject* SVGRadialGradientElement::CreateLayoutObject(const ComputedStyle&,
+                                                           LegacyLayout) {
   return new LayoutSVGResourceRadialGradient(this);
 }
 
diff --git a/third_party/blink/renderer/core/svg/svg_radial_gradient_element.h b/third_party/blink/renderer/core/svg/svg_radial_gradient_element.h
index 52dadb7..d5d7a83bb 100644
--- a/third_party/blink/renderer/core/svg/svg_radial_gradient_element.h
+++ b/third_party/blink/renderer/core/svg/svg_radial_gradient_element.h
@@ -51,7 +51,7 @@
  private:
   void SvgAttributeChanged(const QualifiedName&) override;
 
-  LayoutObject* CreateLayoutObject(const ComputedStyle&) override;
+  LayoutObject* CreateLayoutObject(const ComputedStyle&, LegacyLayout) override;
 
   bool SelfHasRelativeLengths() const override;
 
diff --git a/third_party/blink/renderer/core/svg/svg_rect_element.cc b/third_party/blink/renderer/core/svg/svg_rect_element.cc
index 69f7458..84865a3 100644
--- a/third_party/blink/renderer/core/svg/svg_rect_element.cc
+++ b/third_party/blink/renderer/core/svg/svg_rect_element.cc
@@ -158,7 +158,8 @@
          rx_->CurrentValue()->IsRelative() || ry_->CurrentValue()->IsRelative();
 }
 
-LayoutObject* SVGRectElement::CreateLayoutObject(const ComputedStyle&) {
+LayoutObject* SVGRectElement::CreateLayoutObject(const ComputedStyle&,
+                                                 LegacyLayout) {
   return new LayoutSVGRect(this);
 }
 
diff --git a/third_party/blink/renderer/core/svg/svg_rect_element.h b/third_party/blink/renderer/core/svg/svg_rect_element.h
index 92d93e9..54919be 100644
--- a/third_party/blink/renderer/core/svg/svg_rect_element.h
+++ b/third_party/blink/renderer/core/svg/svg_rect_element.h
@@ -55,7 +55,7 @@
 
   bool SelfHasRelativeLengths() const override;
 
-  LayoutObject* CreateLayoutObject(const ComputedStyle&) override;
+  LayoutObject* CreateLayoutObject(const ComputedStyle&, LegacyLayout) override;
 
   Member<SVGAnimatedLength> x_;
   Member<SVGAnimatedLength> y_;
diff --git a/third_party/blink/renderer/core/svg/svg_svg_element.cc b/third_party/blink/renderer/core/svg/svg_svg_element.cc
index f2ce82cb..e0677bbe 100644
--- a/third_party/blink/renderer/core/svg/svg_svg_element.cc
+++ b/third_party/blink/renderer/core/svg/svg_svg_element.cc
@@ -500,7 +500,8 @@
     ToLayoutSVGRoot(GetLayoutObject())->IntrinsicSizingInfoChanged();
 }
 
-LayoutObject* SVGSVGElement::CreateLayoutObject(const ComputedStyle&) {
+LayoutObject* SVGSVGElement::CreateLayoutObject(const ComputedStyle&,
+                                                LegacyLayout) {
   if (IsOutermostSVGSVGElement())
     return new LayoutSVGRoot(this);
 
diff --git a/third_party/blink/renderer/core/svg/svg_svg_element.h b/third_party/blink/renderer/core/svg/svg_svg_element.h
index d145053..fb913e7 100644
--- a/third_party/blink/renderer/core/svg/svg_svg_element.h
+++ b/third_party/blink/renderer/core/svg/svg_svg_element.h
@@ -128,7 +128,7 @@
 
   void AttachLayoutTree(AttachContext&) override;
   bool LayoutObjectIsNeeded(const ComputedStyle&) const override;
-  LayoutObject* CreateLayoutObject(const ComputedStyle&) override;
+  LayoutObject* CreateLayoutObject(const ComputedStyle&, LegacyLayout) override;
 
   InsertionNotificationRequest InsertedInto(ContainerNode&) override;
   void RemovedFrom(ContainerNode&) override;
diff --git a/third_party/blink/renderer/core/svg/svg_switch_element.cc b/third_party/blink/renderer/core/svg/svg_switch_element.cc
index 7b516fc..c7904f36 100644
--- a/third_party/blink/renderer/core/svg/svg_switch_element.cc
+++ b/third_party/blink/renderer/core/svg/svg_switch_element.cc
@@ -33,7 +33,8 @@
 
 DEFINE_NODE_FACTORY(SVGSwitchElement)
 
-LayoutObject* SVGSwitchElement::CreateLayoutObject(const ComputedStyle&) {
+LayoutObject* SVGSwitchElement::CreateLayoutObject(const ComputedStyle&,
+                                                   LegacyLayout) {
   return new LayoutSVGTransformableContainer(this);
 }
 
diff --git a/third_party/blink/renderer/core/svg/svg_switch_element.h b/third_party/blink/renderer/core/svg/svg_switch_element.h
index b930f45..b837381 100644
--- a/third_party/blink/renderer/core/svg/svg_switch_element.h
+++ b/third_party/blink/renderer/core/svg/svg_switch_element.h
@@ -34,7 +34,7 @@
   explicit SVGSwitchElement(Document&);
 
  private:
-  LayoutObject* CreateLayoutObject(const ComputedStyle&) override;
+  LayoutObject* CreateLayoutObject(const ComputedStyle&, LegacyLayout) override;
 };
 
 }  // namespace blink
diff --git a/third_party/blink/renderer/core/svg/svg_symbol_element.cc b/third_party/blink/renderer/core/svg/svg_symbol_element.cc
index d13c35e..c5d6a27 100644
--- a/third_party/blink/renderer/core/svg/svg_symbol_element.cc
+++ b/third_party/blink/renderer/core/svg/svg_symbol_element.cc
@@ -40,7 +40,8 @@
     InvalidateInstances();
 }
 
-LayoutObject* SVGSymbolElement::CreateLayoutObject(const ComputedStyle&) {
+LayoutObject* SVGSymbolElement::CreateLayoutObject(const ComputedStyle&,
+                                                   LegacyLayout) {
   return new LayoutSVGHiddenContainer(this);
 }
 
diff --git a/third_party/blink/renderer/core/svg/svg_symbol_element.h b/third_party/blink/renderer/core/svg/svg_symbol_element.h
index bc4e9b6..836588f 100644
--- a/third_party/blink/renderer/core/svg/svg_symbol_element.h
+++ b/third_party/blink/renderer/core/svg/svg_symbol_element.h
@@ -40,7 +40,7 @@
  private:
   void SvgAttributeChanged(const QualifiedName&) override;
 
-  LayoutObject* CreateLayoutObject(const ComputedStyle&) override;
+  LayoutObject* CreateLayoutObject(const ComputedStyle&, LegacyLayout) override;
 };
 
 }  // namespace blink
diff --git a/third_party/blink/renderer/core/svg/svg_text_element.cc b/third_party/blink/renderer/core/svg/svg_text_element.cc
index 2a034fd29..11a07c8 100644
--- a/third_party/blink/renderer/core/svg/svg_text_element.cc
+++ b/third_party/blink/renderer/core/svg/svg_text_element.cc
@@ -29,7 +29,8 @@
 
 DEFINE_NODE_FACTORY(SVGTextElement)
 
-LayoutObject* SVGTextElement::CreateLayoutObject(const ComputedStyle&) {
+LayoutObject* SVGTextElement::CreateLayoutObject(const ComputedStyle&,
+                                                 LegacyLayout) {
   return new LayoutSVGText(this);
 }
 
diff --git a/third_party/blink/renderer/core/svg/svg_text_element.h b/third_party/blink/renderer/core/svg/svg_text_element.h
index 6bcf729..90961df 100644
--- a/third_party/blink/renderer/core/svg/svg_text_element.h
+++ b/third_party/blink/renderer/core/svg/svg_text_element.h
@@ -34,7 +34,7 @@
   explicit SVGTextElement(Document&);
 
  private:
-  LayoutObject* CreateLayoutObject(const ComputedStyle&) override;
+  LayoutObject* CreateLayoutObject(const ComputedStyle&, LegacyLayout) override;
 };
 
 }  // namespace blink
diff --git a/third_party/blink/renderer/core/svg/svg_text_path_element.cc b/third_party/blink/renderer/core/svg/svg_text_path_element.cc
index 63f9cb62..72b332b 100644
--- a/third_party/blink/renderer/core/svg/svg_text_path_element.cc
+++ b/third_party/blink/renderer/core/svg/svg_text_path_element.cc
@@ -107,7 +107,8 @@
   SVGTextContentElement::SvgAttributeChanged(attr_name);
 }
 
-LayoutObject* SVGTextPathElement::CreateLayoutObject(const ComputedStyle&) {
+LayoutObject* SVGTextPathElement::CreateLayoutObject(const ComputedStyle&,
+                                                     LegacyLayout) {
   return new LayoutSVGTextPath(this);
 }
 
diff --git a/third_party/blink/renderer/core/svg/svg_text_path_element.h b/third_party/blink/renderer/core/svg/svg_text_path_element.h
index 1b27113..978ac4b 100644
--- a/third_party/blink/renderer/core/svg/svg_text_path_element.h
+++ b/third_party/blink/renderer/core/svg/svg_text_path_element.h
@@ -81,7 +81,7 @@
 
   void SvgAttributeChanged(const QualifiedName&) override;
 
-  LayoutObject* CreateLayoutObject(const ComputedStyle&) override;
+  LayoutObject* CreateLayoutObject(const ComputedStyle&, LegacyLayout) override;
   bool LayoutObjectIsNeeded(const ComputedStyle&) const override;
 
   bool SelfHasRelativeLengths() const override;
diff --git a/third_party/blink/renderer/core/svg/svg_transform_list.cc b/third_party/blink/renderer/core/svg/svg_transform_list.cc
index a5d1422..38556cbec 100644
--- a/third_party/blink/renderer/core/svg/svg_transform_list.cc
+++ b/third_party/blink/renderer/core/svg/svg_transform_list.cc
@@ -86,7 +86,8 @@
 
 CSSValue* CreateTransformCSSValue(const SVGTransform& transform) {
   CSSValueID function_id = MapTransformFunction(transform);
-  auto* transform_value = MakeGarbageCollected<CSSFunctionValue>(function_id);
+  CSSFunctionValue* transform_value =
+      MakeGarbageCollected<CSSFunctionValue>(function_id);
   switch (function_id) {
     case CSSValueRotate: {
       transform_value->Append(*CSSPrimitiveValue::Create(
diff --git a/third_party/blink/renderer/core/svg/svg_tspan_element.cc b/third_party/blink/renderer/core/svg/svg_tspan_element.cc
index 7b6047f..af93d45 100644
--- a/third_party/blink/renderer/core/svg/svg_tspan_element.cc
+++ b/third_party/blink/renderer/core/svg/svg_tspan_element.cc
@@ -30,7 +30,8 @@
 
 DEFINE_NODE_FACTORY(SVGTSpanElement)
 
-LayoutObject* SVGTSpanElement::CreateLayoutObject(const ComputedStyle&) {
+LayoutObject* SVGTSpanElement::CreateLayoutObject(const ComputedStyle&,
+                                                  LegacyLayout) {
   return new LayoutSVGTSpan(this);
 }
 
diff --git a/third_party/blink/renderer/core/svg/svg_tspan_element.h b/third_party/blink/renderer/core/svg/svg_tspan_element.h
index 6ffdf83b..725e409 100644
--- a/third_party/blink/renderer/core/svg/svg_tspan_element.h
+++ b/third_party/blink/renderer/core/svg/svg_tspan_element.h
@@ -34,7 +34,7 @@
   explicit SVGTSpanElement(Document&);
 
  private:
-  LayoutObject* CreateLayoutObject(const ComputedStyle&) override;
+  LayoutObject* CreateLayoutObject(const ComputedStyle&, LegacyLayout) override;
   bool LayoutObjectIsNeeded(const ComputedStyle&) const override;
 };
 
diff --git a/third_party/blink/renderer/core/svg/svg_use_element.cc b/third_party/blink/renderer/core/svg/svg_use_element.cc
index b80620c..20fcc2f1 100644
--- a/third_party/blink/renderer/core/svg/svg_use_element.cc
+++ b/third_party/blink/renderer/core/svg/svg_use_element.cc
@@ -470,7 +470,8 @@
   UpdateRelativeLengthsInformation();
 }
 
-LayoutObject* SVGUseElement::CreateLayoutObject(const ComputedStyle& style) {
+LayoutObject* SVGUseElement::CreateLayoutObject(const ComputedStyle& style,
+                                                LegacyLayout) {
   if (style.Display() == EDisplay::kContents)
     return nullptr;
   return new LayoutSVGTransformableContainer(this);
diff --git a/third_party/blink/renderer/core/svg/svg_use_element.h b/third_party/blink/renderer/core/svg/svg_use_element.h
index d7dc58a..bb58c25 100644
--- a/third_party/blink/renderer/core/svg/svg_use_element.h
+++ b/third_party/blink/renderer/core/svg/svg_use_element.h
@@ -80,7 +80,7 @@
 
   void SvgAttributeChanged(const QualifiedName&) override;
 
-  LayoutObject* CreateLayoutObject(const ComputedStyle&) override;
+  LayoutObject* CreateLayoutObject(const ComputedStyle&, LegacyLayout) override;
 
   void ScheduleShadowTreeRecreation();
   void CancelShadowTreeRecreation();
diff --git a/third_party/blink/renderer/core/timing/performance.cc b/third_party/blink/renderer/core/timing/performance.cc
index 03aaa0ae..ca3a5713 100644
--- a/third_party/blink/renderer/core/timing/performance.cc
+++ b/third_party/blink/renderer/core/timing/performance.cc
@@ -251,8 +251,9 @@
   if (!PerformanceEntry::IsValidTimelineEntryType(type)) {
     PerformanceEntryVector empty_entries;
     String message = "Deprecated API for given entry type.";
-    GetExecutionContext()->AddConsoleMessage(ConsoleMessage::Create(
-        kJSMessageSource, mojom::ConsoleMessageLevel::kWarning, message));
+    GetExecutionContext()->AddConsoleMessage(
+        ConsoleMessage::Create(mojom::ConsoleMessageSource::kJavaScript,
+                               mojom::ConsoleMessageLevel::kWarning, message));
     return empty_entries;
   }
   return getEntriesByTypeInternal(type);
diff --git a/third_party/blink/renderer/core/timing/performance_observer.cc b/third_party/blink/renderer/core/timing/performance_observer.cc
index 1c400b6..447142235 100644
--- a/third_party/blink/renderer/core/timing/performance_observer.cc
+++ b/third_party/blink/renderer/core/timing/performance_observer.cc
@@ -128,7 +128,8 @@
           "its "
           "entryTypes attribute.";
       GetExecutionContext()->AddConsoleMessage(ConsoleMessage::Create(
-          kJSMessageSource, mojom::ConsoleMessageLevel::kWarning, message));
+          mojom::ConsoleMessageSource::kJavaScript,
+          mojom::ConsoleMessageLevel::kWarning, message));
       return;
     }
     if (RuntimeEnabledFeatures::PerformanceObserverBufferedFlagEnabled() &&
@@ -137,7 +138,8 @@
           "The Performance Observer does not support buffered flag with "
           "entryTypes. ";
       GetExecutionContext()->AddConsoleMessage(ConsoleMessage::Create(
-          kJSMessageSource, mojom::ConsoleMessageLevel::kWarning, message));
+          mojom::ConsoleMessageSource::kJavaScript,
+          mojom::ConsoleMessageLevel::kWarning, message));
     }
     filter_options_ = entry_types;
   } else {
@@ -162,7 +164,8 @@
           "The Performance Observer MUST have a valid entryType in its "
           "type attribute.";
       GetExecutionContext()->AddConsoleMessage(ConsoleMessage::Create(
-          kJSMessageSource, mojom::ConsoleMessageLevel::kWarning, message));
+          mojom::ConsoleMessageSource::kJavaScript,
+          mojom::ConsoleMessageLevel::kWarning, message));
       return;
     }
     if (filter_options_ & entry_type) {
@@ -170,7 +173,8 @@
           "The Performance Observer has already been called with this "
           "entryType";
       GetExecutionContext()->AddConsoleMessage(ConsoleMessage::Create(
-          kJSMessageSource, mojom::ConsoleMessageLevel::kWarning, message));
+          mojom::ConsoleMessageSource::kJavaScript,
+          mojom::ConsoleMessageLevel::kWarning, message));
       return;
     }
     if (RuntimeEnabledFeatures::PerformanceObserverBufferedFlagEnabled() &&
@@ -179,7 +183,8 @@
         String message =
             "Buffered flag does not support the long task entry type ";
         GetExecutionContext()->AddConsoleMessage(ConsoleMessage::Create(
-            kJSMessageSource, mojom::ConsoleMessageLevel::kWarning, message));
+            mojom::ConsoleMessageSource::kJavaScript,
+            mojom::ConsoleMessageLevel::kWarning, message));
       } else {
         // Append all entries of this type to the current performance_entries_
         // to be returned on the next callback.
diff --git a/third_party/blink/renderer/core/workers/shared_worker_reporting_proxy.cc b/third_party/blink/renderer/core/workers/shared_worker_reporting_proxy.cc
index f35eb17..2e0974b 100644
--- a/third_party/blink/renderer/core/workers/shared_worker_reporting_proxy.cc
+++ b/third_party/blink/renderer/core/workers/shared_worker_reporting_proxy.cc
@@ -55,7 +55,7 @@
 }
 
 void SharedWorkerReportingProxy::ReportConsoleMessage(
-    MessageSource,
+    mojom::ConsoleMessageSource,
     mojom::ConsoleMessageLevel,
     const String& message,
     SourceLocation*) {
diff --git a/third_party/blink/renderer/core/workers/shared_worker_reporting_proxy.h b/third_party/blink/renderer/core/workers/shared_worker_reporting_proxy.h
index 0b0faaa..0cc7a30 100644
--- a/third_party/blink/renderer/core/workers/shared_worker_reporting_proxy.h
+++ b/third_party/blink/renderer/core/workers/shared_worker_reporting_proxy.h
@@ -31,7 +31,7 @@
   void ReportException(const WTF::String&,
                        std::unique_ptr<SourceLocation>,
                        int exception_id) override;
-  void ReportConsoleMessage(MessageSource,
+  void ReportConsoleMessage(mojom::ConsoleMessageSource,
                             mojom::ConsoleMessageLevel,
                             const String& message,
                             SourceLocation*) override;
diff --git a/third_party/blink/renderer/core/workers/threaded_messaging_proxy_base.cc b/third_party/blink/renderer/core/workers/threaded_messaging_proxy_base.cc
index 65b8816..360f6e2f 100644
--- a/third_party/blink/renderer/core/workers/threaded_messaging_proxy_base.cc
+++ b/third_party/blink/renderer/core/workers/threaded_messaging_proxy_base.cc
@@ -91,7 +91,7 @@
 }
 
 void ThreadedMessagingProxyBase::ReportConsoleMessage(
-    MessageSource source,
+    mojom::ConsoleMessageSource source,
     mojom::ConsoleMessageLevel level,
     const String& message,
     std::unique_ptr<SourceLocation> location) {
diff --git a/third_party/blink/renderer/core/workers/threaded_messaging_proxy_base.h b/third_party/blink/renderer/core/workers/threaded_messaging_proxy_base.h
index 2415fc8..b18fe645f 100644
--- a/third_party/blink/renderer/core/workers/threaded_messaging_proxy_base.h
+++ b/third_party/blink/renderer/core/workers/threaded_messaging_proxy_base.h
@@ -55,7 +55,7 @@
   void CountFeature(WebFeature);
   void CountDeprecation(WebFeature);
 
-  void ReportConsoleMessage(MessageSource,
+  void ReportConsoleMessage(mojom::ConsoleMessageSource,
                             mojom::ConsoleMessageLevel,
                             const String& message,
                             std::unique_ptr<SourceLocation>);
diff --git a/third_party/blink/renderer/core/workers/threaded_object_proxy_base.cc b/third_party/blink/renderer/core/workers/threaded_object_proxy_base.cc
index 79d2b67..bb727e3 100644
--- a/third_party/blink/renderer/core/workers/threaded_object_proxy_base.cc
+++ b/third_party/blink/renderer/core/workers/threaded_object_proxy_base.cc
@@ -32,7 +32,7 @@
 }
 
 void ThreadedObjectProxyBase::ReportConsoleMessage(
-    MessageSource source,
+    mojom::ConsoleMessageSource source,
     mojom::ConsoleMessageLevel level,
     const String& message,
     SourceLocation* location) {
diff --git a/third_party/blink/renderer/core/workers/threaded_object_proxy_base.h b/third_party/blink/renderer/core/workers/threaded_object_proxy_base.h
index 3de08bc2a..a66796d 100644
--- a/third_party/blink/renderer/core/workers/threaded_object_proxy_base.h
+++ b/third_party/blink/renderer/core/workers/threaded_object_proxy_base.h
@@ -31,7 +31,7 @@
   // WorkerReportingProxy overrides.
   void CountFeature(WebFeature) override;
   void CountDeprecation(WebFeature) override;
-  void ReportConsoleMessage(MessageSource,
+  void ReportConsoleMessage(mojom::ConsoleMessageSource,
                             mojom::ConsoleMessageLevel,
                             const String& message,
                             SourceLocation*) override;
diff --git a/third_party/blink/renderer/core/workers/worker_or_worklet_global_scope.cc b/third_party/blink/renderer/core/workers/worker_or_worklet_global_scope.cc
index 2189877..7c6bdde7 100644
--- a/third_party/blink/renderer/core/workers/worker_or_worklet_global_scope.cc
+++ b/third_party/blink/renderer/core/workers/worker_or_worklet_global_scope.cc
@@ -234,9 +234,10 @@
 
   // Adds a deprecation message to the console.
   DCHECK(!Deprecation::DeprecationMessage(feature).IsEmpty());
-  AddConsoleMessage(ConsoleMessage::Create(
-      kDeprecationMessageSource, mojom::ConsoleMessageLevel::kWarning,
-      Deprecation::DeprecationMessage(feature)));
+  AddConsoleMessage(
+      ConsoleMessage::Create(mojom::ConsoleMessageSource::kDeprecation,
+                             mojom::ConsoleMessageLevel::kWarning,
+                             Deprecation::DeprecationMessage(feature)));
   ReportingProxy().CountDeprecation(feature);
 }
 
diff --git a/third_party/blink/renderer/core/workers/worker_reporting_proxy.h b/third_party/blink/renderer/core/workers/worker_reporting_proxy.h
index 2f48598..dffa510 100644
--- a/third_party/blink/renderer/core/workers/worker_reporting_proxy.h
+++ b/third_party/blink/renderer/core/workers/worker_reporting_proxy.h
@@ -36,7 +36,6 @@
 #include "third_party/blink/renderer/bindings/core/v8/source_location.h"
 #include "third_party/blink/renderer/core/core_export.h"
 #include "third_party/blink/renderer/core/frame/web_feature_forward.h"
-#include "third_party/blink/renderer/core/inspector/console_types.h"
 #include "third_party/blink/renderer/platform/heap/handle.h"
 #include "third_party/blink/renderer/platform/wtf/forward.h"
 
@@ -57,7 +56,7 @@
   virtual void ReportException(const String& error_message,
                                std::unique_ptr<SourceLocation>,
                                int exception_id) {}
-  virtual void ReportConsoleMessage(MessageSource,
+  virtual void ReportConsoleMessage(mojom::ConsoleMessageSource,
                                     mojom::ConsoleMessageLevel,
                                     const String& message,
                                     SourceLocation*) {}
diff --git a/third_party/blink/renderer/core/xml/parser/xml_document_parser.cc b/third_party/blink/renderer/core/xml/parser/xml_document_parser.cc
index 3bf51fea..6074adac 100644
--- a/third_party/blink/renderer/core/xml/parser/xml_document_parser.cc
+++ b/third_party/blink/renderer/core/xml/parser/xml_document_parser.cc
@@ -577,7 +577,7 @@
           XMLDocumentParserScope::current_document_->Url().ElidedString() +
           ". Domains, protocols and ports must match.\n";
       XMLDocumentParserScope::current_document_->AddConsoleMessage(
-          ConsoleMessage::Create(kSecurityMessageSource,
+          ConsoleMessage::Create(mojom::ConsoleMessageSource::kSecurity,
                                  mojom::ConsoleMessageLevel::kError, message));
     }
     return false;
diff --git a/third_party/blink/renderer/core/xml/xslt_processor_libxslt.cc b/third_party/blink/renderer/core/xml/xslt_processor_libxslt.cc
index 0a9ab42..eb1bdd3 100644
--- a/third_party/blink/renderer/core/xml/xslt_processor_libxslt.cc
+++ b/third_party/blink/renderer/core/xml/xslt_processor_libxslt.cc
@@ -81,7 +81,7 @@
   }
 
   console->AddMessage(ConsoleMessage::Create(
-      kXMLMessageSource, level, error->message,
+      mojom::ConsoleMessageSource::kXml, level, error->message,
       std::make_unique<SourceLocation>(error->file, error->line, 0, nullptr)));
 }
 
diff --git a/third_party/blink/renderer/core/xmlhttprequest/xml_http_request.cc b/third_party/blink/renderer/core/xmlhttprequest/xml_http_request.cc
index 98ffcbb..72b2df5 100644
--- a/third_party/blink/renderer/core/xmlhttprequest/xml_http_request.cc
+++ b/third_party/blink/renderer/core/xmlhttprequest/xml_http_request.cc
@@ -193,8 +193,9 @@
   // FIXME: It's not good to report the bad usage without indicating what source
   // line it came from.  We should pass additional parameters so we can tell the
   // console where the mistake occurred.
-  ConsoleMessage* console_message = ConsoleMessage::Create(
-      kJSMessageSource, mojom::ConsoleMessageLevel::kError, message);
+  ConsoleMessage* console_message =
+      ConsoleMessage::Create(mojom::ConsoleMessageSource::kJavaScript,
+                             mojom::ConsoleMessageLevel::kError, message);
   context->AddConsoleMessage(console_message);
 }
 
diff --git a/third_party/blink/renderer/modules/animationworklet/worklet_animation.cc b/third_party/blink/renderer/modules/animationworklet/worklet_animation.cc
index 6aade0fd..bd8985ca 100644
--- a/third_party/blink/renderer/modules/animationworklet/worklet_animation.cc
+++ b/third_party/blink/renderer/modules/animationworklet/worklet_animation.cc
@@ -416,10 +416,11 @@
   // support is in.
   if (!playback_rate) {
     if (document_->GetFrame() && ExecutionContext::From(script_state)) {
-      document_->GetFrame()->Console().AddMessage(ConsoleMessage::Create(
-          kJSMessageSource, mojom::ConsoleMessageLevel::kWarning,
-          "WorkletAnimation currently does not support "
-          "playback rate of Zero."));
+      document_->GetFrame()->Console().AddMessage(
+          ConsoleMessage::Create(mojom::ConsoleMessageSource::kJavaScript,
+                                 mojom::ConsoleMessageLevel::kWarning,
+                                 "WorkletAnimation currently does not support "
+                                 "playback rate of Zero."));
     }
     return;
   }
diff --git a/third_party/blink/renderer/modules/bluetooth/bluetooth.cc b/third_party/blink/renderer/modules/bluetooth/bluetooth.cc
index c03994d..6856bd2 100644
--- a/third_party/blink/renderer/modules/bluetooth/bluetooth.cc
+++ b/third_party/blink/renderer/modules/bluetooth/bluetooth.cc
@@ -166,7 +166,8 @@
 #if !defined(OS_CHROMEOS) && !defined(OS_ANDROID) && !defined(OS_MACOSX) && \
     !defined(OS_WIN)
   context->AddConsoleMessage(ConsoleMessage::Create(
-      kJSMessageSource, mojom::ConsoleMessageLevel::kInfo,
+      mojom::ConsoleMessageSource::kJavaScript,
+      mojom::ConsoleMessageLevel::kInfo,
       "Web Bluetooth is experimental on this platform. See "
       "https://github.com/WebBluetoothCG/web-bluetooth/blob/gh-pages/"
       "implementation-status.md"));
@@ -286,7 +287,8 @@
   // Remind developers when they are using Web Bluetooth on unsupported
   // platforms.
   context->AddConsoleMessage(ConsoleMessage::Create(
-      kJSMessageSource, mojom::ConsoleMessageLevel::kInfo,
+      mojom::ConsoleMessageSource::kJavaScript,
+      mojom::ConsoleMessageLevel::kInfo,
       "Web Bluetooth Scanning is experimental on this platform. See "
       "https://github.com/WebBluetoothCG/web-bluetooth/blob/gh-pages/"
       "implementation-status.md"));
diff --git a/third_party/blink/renderer/modules/device_orientation/device_orientation_controller.cc b/third_party/blink/renderer/modules/device_orientation/device_orientation_controller.cc
index 4f769b1..5d0494a 100644
--- a/third_party/blink/renderer/modules/device_orientation/device_orientation_controller.cc
+++ b/third_party/blink/renderer/modules/device_orientation/device_orientation_controller.cc
@@ -180,8 +180,8 @@
       "features.md#sensor-features",
       event_name.Ascii().data());
   ConsoleMessage* console_message = ConsoleMessage::Create(
-      kJSMessageSource, mojom::ConsoleMessageLevel::kWarning,
-      std::move(message));
+      mojom::ConsoleMessageSource::kJavaScript,
+      mojom::ConsoleMessageLevel::kWarning, std::move(message));
   frame->Console().AddMessage(console_message);
 }
 
diff --git a/third_party/blink/renderer/modules/encryptedmedia/html_media_element_encrypted_media.cc b/third_party/blink/renderer/modules/encryptedmedia/html_media_element_encrypted_media.cc
index 3ec04b9c..129e1f1 100644
--- a/third_party/blink/renderer/modules/encryptedmedia/html_media_element_encrypted_media.cc
+++ b/third_party/blink/renderer/modules/encryptedmedia/html_media_element_encrypted_media.cc
@@ -418,7 +418,7 @@
     event = CreateEncryptedEvent(WebEncryptedMediaInitDataType::kUnknown,
                                  nullptr, 0);
     media_element_->GetExecutionContext()->AddConsoleMessage(
-        ConsoleMessage::Create(kJSMessageSource,
+        ConsoleMessage::Create(mojom::ConsoleMessageSource::kJavaScript,
                                mojom::ConsoleMessageLevel::kWarning,
                                "Media element must be CORS-same-origin with "
                                "the embedding page. If cross-origin, you "
diff --git a/third_party/blink/renderer/modules/encryptedmedia/navigator_request_media_key_system_access.cc b/third_party/blink/renderer/modules/encryptedmedia/navigator_request_media_key_system_access.cc
index b9dedaf..cf8b72a 100644
--- a/third_party/blink/renderer/modules/encryptedmedia/navigator_request_media_key_system_access.cc
+++ b/third_party/blink/renderer/modules/encryptedmedia/navigator_request_media_key_system_access.cc
@@ -295,7 +295,8 @@
     // using an empty robustness here, and provide the link to the doc in this
     // message. See http://crbug.com/720013
     resolver_->GetExecutionContext()->AddConsoleMessage(ConsoleMessage::Create(
-        kJSMessageSource, mojom::ConsoleMessageLevel::kWarning,
+        mojom::ConsoleMessageSource::kJavaScript,
+        mojom::ConsoleMessageLevel::kWarning,
         "It is recommended that a robustness level be specified. Not "
         "specifying the robustness level could result in unexpected "
         "behavior."));
@@ -333,9 +334,10 @@
                                   ReportOptions::kReportOnFailure)) {
     UseCounter::Count(document,
                       WebFeature::kEncryptedMediaDisabledByFeaturePolicy);
-    document->AddConsoleMessage(ConsoleMessage::Create(
-        kJSMessageSource, mojom::ConsoleMessageLevel::kWarning,
-        kEncryptedMediaFeaturePolicyConsoleWarning));
+    document->AddConsoleMessage(
+        ConsoleMessage::Create(mojom::ConsoleMessageSource::kJavaScript,
+                               mojom::ConsoleMessageLevel::kWarning,
+                               kEncryptedMediaFeaturePolicyConsoleWarning));
     return ScriptPromise::RejectWithDOMException(
         script_state,
         DOMException::Create(
diff --git a/third_party/blink/renderer/modules/eventsource/event_source.cc b/third_party/blink/renderer/modules/eventsource/event_source.cc
index 16fe3b9..7e9305f 100644
--- a/third_party/blink/renderer/modules/eventsource/event_source.cc
+++ b/third_party/blink/renderer/modules/eventsource/event_source.cc
@@ -243,8 +243,8 @@
       message.Append("\") that is not UTF-8. Aborting the connection.");
       // FIXME: We are missing the source line.
       GetExecutionContext()->AddConsoleMessage(ConsoleMessage::Create(
-          kJSMessageSource, mojom::ConsoleMessageLevel::kError,
-          message.ToString()));
+          mojom::ConsoleMessageSource::kJavaScript,
+          mojom::ConsoleMessageLevel::kError, message.ToString()));
     }
   } else {
     // To keep the signal-to-noise ratio low, we only log 200-response with an
@@ -257,8 +257,8 @@
           "\") that is not \"text/event-stream\". Aborting the connection.");
       // FIXME: We are missing the source line.
       GetExecutionContext()->AddConsoleMessage(ConsoleMessage::Create(
-          kJSMessageSource, mojom::ConsoleMessageLevel::kError,
-          message.ToString()));
+          mojom::ConsoleMessageSource::kJavaScript,
+          mojom::ConsoleMessageLevel::kError, message.ToString()));
     }
   }
 
diff --git a/third_party/blink/renderer/modules/exported/web_embedded_worker_impl.cc b/third_party/blink/renderer/modules/exported/web_embedded_worker_impl.cc
index fc6d1c1b..2fe29e2 100644
--- a/third_party/blink/renderer/modules/exported/web_embedded_worker_impl.cc
+++ b/third_party/blink/renderer/modules/exported/web_embedded_worker_impl.cc
@@ -262,7 +262,7 @@
 void WebEmbeddedWorkerImpl::AddMessageToConsole(
     const WebConsoleMessage& message) {
   shadow_page_->GetDocument()->AddConsoleMessage(ConsoleMessage::Create(
-      kOtherMessageSource, message.level, message.text,
+      mojom::ConsoleMessageSource::kOther, message.level, message.text,
       std::make_unique<SourceLocation>(message.url, message.line_number,
                                        message.column_number, nullptr)));
 }
diff --git a/third_party/blink/renderer/modules/mediarecorder/media_recorder.cc b/third_party/blink/renderer/modules/mediarecorder/media_recorder.cc
index 1e6d9d4..98bdee2 100644
--- a/third_party/blink/renderer/modules/mediarecorder/media_recorder.cc
+++ b/third_party/blink/renderer/modules/mediarecorder/media_recorder.cc
@@ -90,7 +90,8 @@
     if (options->hasAudioBitsPerSecond() || options->hasBitsPerSecond()) {
       if (audio_bps > kLargestAutoAllocatedOpusBitRate) {
         context->AddConsoleMessage(ConsoleMessage::Create(
-            kJSMessageSource, mojom::ConsoleMessageLevel::kWarning,
+            mojom::ConsoleMessageSource::kJavaScript,
+            mojom::ConsoleMessageLevel::kWarning,
             "Clamping calculated audio bitrate (" + String::Number(audio_bps) +
                 "bps) to the maximum (" +
                 String::Number(kLargestAutoAllocatedOpusBitRate) + "bps)"));
@@ -99,7 +100,8 @@
 
       if (audio_bps < kSmallestPossibleOpusBitRate) {
         context->AddConsoleMessage(ConsoleMessage::Create(
-            kJSMessageSource, mojom::ConsoleMessageLevel::kWarning,
+            mojom::ConsoleMessageSource::kJavaScript,
+            mojom::ConsoleMessageLevel::kWarning,
             "Clamping calculated audio bitrate (" + String::Number(audio_bps) +
                 "bps) to the minimum (" +
                 String::Number(kSmallestPossibleOpusBitRate) + "bps)"));
@@ -119,7 +121,8 @@
     if (options->hasVideoBitsPerSecond() || options->hasBitsPerSecond()) {
       if (video_bps < kSmallestPossibleVpxBitRate) {
         context->AddConsoleMessage(ConsoleMessage::Create(
-            kJSMessageSource, mojom::ConsoleMessageLevel::kWarning,
+            mojom::ConsoleMessageSource::kJavaScript,
+            mojom::ConsoleMessageLevel::kWarning,
             "Clamping calculated video bitrate (" + String::Number(video_bps) +
                 "bps) to the minimum (" +
                 String::Number(kSmallestPossibleVpxBitRate) + "bps)"));
diff --git a/third_party/blink/renderer/modules/mediasession/media_metadata_sanitizer.cc b/third_party/blink/renderer/modules/mediasession/media_metadata_sanitizer.cc
index 3cf3b0f..44637c4 100644
--- a/third_party/blink/renderer/modules/mediasession/media_metadata_sanitizer.cc
+++ b/third_party/blink/renderer/modules/mediasession/media_metadata_sanitizer.cc
@@ -41,7 +41,8 @@
   if (!src.ProtocolIs(url::kHttpScheme) && !src.ProtocolIs(url::kHttpsScheme) &&
       !src.ProtocolIs(url::kDataScheme) && !src.ProtocolIs(url::kBlobScheme)) {
     context->AddConsoleMessage(ConsoleMessage::Create(
-        kJSMessageSource, mojom::ConsoleMessageLevel::kWarning,
+        mojom::ConsoleMessageSource::kJavaScript,
+        mojom::ConsoleMessageLevel::kWarning,
         "MediaImage src can only be of http/https/data/blob scheme: " +
             src.GetString()));
     return false;
@@ -50,7 +51,8 @@
   DCHECK(src.GetString().Is8Bit());
   if (src.GetString().length() > url::kMaxURLChars) {
     context->AddConsoleMessage(ConsoleMessage::Create(
-        kJSMessageSource, mojom::ConsoleMessageLevel::kWarning,
+        mojom::ConsoleMessageSource::kJavaScript,
+        mojom::ConsoleMessageLevel::kWarning,
         "MediaImage src exceeds maximum URL length: " + src.GetString()));
     return false;
   }
@@ -76,7 +78,8 @@
     mojo_image->sizes.push_back(web_size);
     if (mojo_image->sizes.size() == kMaxNumberOfImageSizes) {
       context->AddConsoleMessage(ConsoleMessage::Create(
-          kJSMessageSource, mojom::ConsoleMessageLevel::kWarning,
+          mojom::ConsoleMessageSource::kJavaScript,
+          mojom::ConsoleMessageLevel::kWarning,
           "The number of MediaImage sizes exceeds the upper limit. "
           "All remaining MediaImage will be ignored"));
       break;
@@ -107,7 +110,8 @@
       mojo_metadata->artwork.push_back(std::move(mojo_image));
     if (mojo_metadata->artwork.size() == kMaxNumberOfMediaImages) {
       context->AddConsoleMessage(ConsoleMessage::Create(
-          kJSMessageSource, mojom::ConsoleMessageLevel::kWarning,
+          mojom::ConsoleMessageSource::kJavaScript,
+          mojom::ConsoleMessageLevel::kWarning,
           "The number of MediaImage sizes exceeds the upper limit. "
           "All remaining MediaImage will be ignored"));
       break;
diff --git a/third_party/blink/renderer/modules/mediastream/media_constraints_impl.cc b/third_party/blink/renderer/modules/mediastream/media_constraints_impl.cc
index 22bf16e..f79b511 100644
--- a/third_party/blink/renderer/modules/mediastream/media_constraints_impl.cc
+++ b/third_party/blink/renderer/modules/mediastream/media_constraints_impl.cc
@@ -418,7 +418,8 @@
       // TODO(crbug.com/856176): Remove the kGoogBeamforming and
       // kGoogArrayGeometry special cases.
       context->AddConsoleMessage(ConsoleMessage::Create(
-          kDeprecationMessageSource, mojom::ConsoleMessageLevel::kWarning,
+          mojom::ConsoleMessageSource::kDeprecation,
+          mojom::ConsoleMessageLevel::kWarning,
           "Obsolete constraint named " + String(constraint.name_) +
               " is ignored. Please stop using it."));
     } else if (constraint.name_.Equals(kVideoKind)) {
@@ -441,10 +442,11 @@
       if (report_unknown_names) {
         // TODO(hta): UMA stats for unknown constraints passed.
         // https://crbug.com/576613
-        context->AddConsoleMessage(ConsoleMessage::Create(
-            kDeprecationMessageSource, mojom::ConsoleMessageLevel::kWarning,
-            "Unknown constraint named " + String(constraint.name_) +
-                " rejected"));
+        context->AddConsoleMessage(
+            ConsoleMessage::Create(mojom::ConsoleMessageSource::kDeprecation,
+                                   mojom::ConsoleMessageLevel::kWarning,
+                                   "Unknown constraint named " +
+                                       String(constraint.name_) + " rejected"));
         // TODO(crbug.com/856176): Don't throw an error.
         error_state.ThrowConstraintError("Unknown name of constraint detected",
                                          constraint.name_);
diff --git a/third_party/blink/renderer/modules/netinfo/network_information.cc b/third_party/blink/renderer/modules/netinfo/network_information.cc
index fe7ed24..4d82f39 100644
--- a/third_party/blink/renderer/modules/netinfo/network_information.cc
+++ b/third_party/blink/renderer/modules/netinfo/network_information.cc
@@ -6,13 +6,13 @@
 
 #include <algorithm>
 
+#include "third_party/blink/public/mojom/devtools/console_message.mojom-shared.h"
 #include "third_party/blink/public/platform/task_type.h"
 #include "third_party/blink/renderer/core/dom/document.h"
 #include "third_party/blink/renderer/core/dom/events/event.h"
 #include "third_party/blink/renderer/core/execution_context/execution_context.h"
 #include "third_party/blink/renderer/core/frame/settings.h"
 #include "third_party/blink/renderer/core/inspector/console_message.h"
-#include "third_party/blink/renderer/core/inspector/console_types.h"
 #include "third_party/blink/renderer/modules/event_target_modules.h"
 #include "third_party/blink/renderer/platform/runtime_enabled_features.h"
 #include "third_party/blink/renderer/platform/wtf/text/wtf_string.h"
@@ -317,7 +317,7 @@
   if (!GetNetworkStateNotifier().GetWebHoldbackEffectiveType())
     return;
   GetExecutionContext()->AddConsoleMessage(ConsoleMessage::Create(
-      kOtherMessageSource, mojom::ConsoleMessageLevel::kWarning,
+      mojom::ConsoleMessageSource::kOther, mojom::ConsoleMessageLevel::kWarning,
       GetConsoleLogStringForWebHoldback()));
 }
 
diff --git a/third_party/blink/renderer/modules/payments/payment_handler_utils.cc b/third_party/blink/renderer/modules/payments/payment_handler_utils.cc
index ef536d1..96f625bc 100644
--- a/third_party/blink/renderer/modules/payments/payment_handler_utils.cc
+++ b/third_party/blink/renderer/modules/payments/payment_handler_utils.cc
@@ -52,7 +52,8 @@
 
   DCHECK(execution_context);
   execution_context->AddConsoleMessage(ConsoleMessage::Create(
-      kJSMessageSource, mojom::ConsoleMessageLevel::kWarning, error_message));
+      mojom::ConsoleMessageSource::kJavaScript,
+      mojom::ConsoleMessageLevel::kWarning, error_message));
 }
 
 }  // namespace blink
diff --git a/third_party/blink/renderer/modules/payments/payment_request.cc b/third_party/blink/renderer/modules/payments/payment_request.cc
index de7daa6c..b0f6a61c 100644
--- a/third_party/blink/renderer/modules/payments/payment_request.cc
+++ b/third_party/blink/renderer/modules/payments/payment_request.cc
@@ -11,6 +11,7 @@
 #include "base/stl_util.h"
 #include "mojo/public/cpp/bindings/interface_request.h"
 #include "services/service_manager/public/cpp/interface_provider.h"
+#include "third_party/blink/public/mojom/devtools/console_message.mojom-shared.h"
 #include "third_party/blink/public/mojom/feature_policy/feature_policy.mojom-blink.h"
 #include "third_party/blink/public/mojom/web_feature/web_feature.mojom-blink.h"
 #include "third_party/blink/public/platform/platform.h"
@@ -34,7 +35,6 @@
 #include "third_party/blink/renderer/core/frame/web_feature.h"
 #include "third_party/blink/renderer/core/html/html_iframe_element.h"
 #include "third_party/blink/renderer/core/inspector/console_message.h"
-#include "third_party/blink/renderer/core/inspector/console_types.h"
 #include "third_party/blink/renderer/core/origin_trials/origin_trials.h"
 #include "third_party/blink/renderer/modules/event_target_modules_names.h"
 #include "third_party/blink/renderer/modules/payments/address_errors.h"
@@ -259,7 +259,8 @@
 
   if (item->label().IsEmpty()) {
     execution_context.AddConsoleMessage(ConsoleMessage::Create(
-        kJSMessageSource, mojom::ConsoleMessageLevel::kError,
+        mojom::ConsoleMessageSource::kJavaScript,
+        mojom::ConsoleMessageLevel::kError,
         "Empty " + item_name + " label may be confusing the user"));
     return;
   }
@@ -317,7 +318,8 @@
 
     if (option->id().IsEmpty()) {
       execution_context.AddConsoleMessage(ConsoleMessage::Create(
-          kJSMessageSource, mojom::ConsoleMessageLevel::kWarning,
+          mojom::ConsoleMessageSource::kJavaScript,
+          mojom::ConsoleMessageLevel::kWarning,
           "Empty shipping option ID may be hard to debug"));
       return;
     }
@@ -759,8 +761,9 @@
       "reject the promise, but allowing continued usage on localhost and "
       "file:// scheme origins.",
       method_name);
-  execution_context.AddConsoleMessage(ConsoleMessage::Create(
-      kJSMessageSource, mojom::ConsoleMessageLevel::kWarning, error));
+  execution_context.AddConsoleMessage(
+      ConsoleMessage::Create(mojom::ConsoleMessageSource::kJavaScript,
+                             mojom::ConsoleMessageLevel::kWarning, error));
 }
 
 }  // namespace
@@ -942,33 +945,37 @@
 
   if (!options_->requestPayerName() && errors->hasPayer() &&
       errors->payer()->hasName()) {
-    GetExecutionContext()->AddConsoleMessage(ConsoleMessage::Create(
-        kJSMessageSource, mojom::ConsoleMessageLevel::kWarning,
-        "The payer.name passed to retry() may not be "
-        "shown because requestPayerName is false"));
+    GetExecutionContext()->AddConsoleMessage(
+        ConsoleMessage::Create(mojom::ConsoleMessageSource::kJavaScript,
+                               mojom::ConsoleMessageLevel::kWarning,
+                               "The payer.name passed to retry() may not be "
+                               "shown because requestPayerName is false"));
   }
 
   if (!options_->requestPayerEmail() && errors->hasPayer() &&
       errors->payer()->hasEmail()) {
-    GetExecutionContext()->AddConsoleMessage(ConsoleMessage::Create(
-        kJSMessageSource, mojom::ConsoleMessageLevel::kWarning,
-        "The payer.email passed to retry() may not be "
-        "shown because requestPayerEmail is false"));
+    GetExecutionContext()->AddConsoleMessage(
+        ConsoleMessage::Create(mojom::ConsoleMessageSource::kJavaScript,
+                               mojom::ConsoleMessageLevel::kWarning,
+                               "The payer.email passed to retry() may not be "
+                               "shown because requestPayerEmail is false"));
   }
 
   if (!options_->requestPayerPhone() && errors->hasPayer() &&
       errors->payer()->hasPhone()) {
-    GetExecutionContext()->AddConsoleMessage(ConsoleMessage::Create(
-        kJSMessageSource, mojom::ConsoleMessageLevel::kWarning,
-        "The payer.phone passed to retry() may not be "
-        "shown because requestPayerPhone is false"));
+    GetExecutionContext()->AddConsoleMessage(
+        ConsoleMessage::Create(mojom::ConsoleMessageSource::kJavaScript,
+                               mojom::ConsoleMessageLevel::kWarning,
+                               "The payer.phone passed to retry() may not be "
+                               "shown because requestPayerPhone is false"));
   }
 
   if (!options_->requestShipping() && errors->hasShippingAddress()) {
-    GetExecutionContext()->AddConsoleMessage(ConsoleMessage::Create(
-        kJSMessageSource, mojom::ConsoleMessageLevel::kWarning,
-        "The shippingAddress passed to retry() may not "
-        "be shown because requestShipping is false"));
+    GetExecutionContext()->AddConsoleMessage(
+        ConsoleMessage::Create(mojom::ConsoleMessageSource::kJavaScript,
+                               mojom::ConsoleMessageLevel::kWarning,
+                               "The shippingAddress passed to retry() may not "
+                               "be shown because requestShipping is false"));
   }
 
   complete_timer_.Stop();
@@ -1216,7 +1223,8 @@
     // handler. Calling this method is optional. If the method is not called,
     // the renderer sends a message to the browser to re-enable UI interactions.
     GetExecutionContext()->AddConsoleMessage(ConsoleMessage::Create(
-        kJSMessageSource, mojom::ConsoleMessageLevel::kWarning,
+        mojom::ConsoleMessageSource::kJavaScript,
+        mojom::ConsoleMessageLevel::kWarning,
         "No updateWith() call in 'paymentmethodchange' event handler. User "
         "may see outdated line items and total."));
     payment_provider_->NoUpdatedPaymentDetails();
@@ -1248,7 +1256,8 @@
     // handler. Calling this method is optional. If the method is not called,
     // the renderer sends a message to the browser to re-enable UI interactions.
     GetExecutionContext()->AddConsoleMessage(ConsoleMessage::Create(
-        kJSMessageSource, mojom::ConsoleMessageLevel::kWarning,
+        mojom::ConsoleMessageSource::kJavaScript,
+        mojom::ConsoleMessageLevel::kWarning,
         "No updateWith() call in 'shippingaddresschange' event handler. User "
         "may see outdated line items and total."));
     payment_provider_->NoUpdatedPaymentDetails();
@@ -1271,7 +1280,8 @@
     // handler. Calling this method is optional. If the method is not called,
     // the renderer sends a message to the browser to re-enable UI interactions.
     GetExecutionContext()->AddConsoleMessage(ConsoleMessage::Create(
-        kJSMessageSource, mojom::ConsoleMessageLevel::kWarning,
+        mojom::ConsoleMessageSource::kJavaScript,
+        mojom::ConsoleMessageLevel::kWarning,
         "No updateWith() call in 'shippingoptionchange' event handler. User "
         "may see outdated line items and total."));
     payment_provider_->NoUpdatedPaymentDetails();
@@ -1536,15 +1546,17 @@
 }
 
 void PaymentRequest::WarnNoFavicon() {
-  GetExecutionContext()->AddConsoleMessage(ConsoleMessage::Create(
-      kJSMessageSource, mojom::ConsoleMessageLevel::kWarning,
-      "Favicon not found for PaymentRequest UI. User "
-      "may not recognize the website."));
+  GetExecutionContext()->AddConsoleMessage(
+      ConsoleMessage::Create(mojom::ConsoleMessageSource::kJavaScript,
+                             mojom::ConsoleMessageLevel::kWarning,
+                             "Favicon not found for PaymentRequest UI. User "
+                             "may not recognize the website."));
 }
 
 void PaymentRequest::OnCompleteTimeout(TimerBase*) {
   GetExecutionContext()->AddConsoleMessage(ConsoleMessage::Create(
-      kJSMessageSource, mojom::ConsoleMessageLevel::kError,
+      mojom::ConsoleMessageSource::kJavaScript,
+      mojom::ConsoleMessageLevel::kError,
       "Timed out waiting for a PaymentResponse.complete() call."));
   payment_provider_->Complete(payments::mojom::blink::PaymentComplete(kFail));
   ClearResolversAndCloseMojoConnection();
diff --git a/third_party/blink/renderer/modules/payments/payment_request_respond_with_observer.cc b/third_party/blink/renderer/modules/payments/payment_request_respond_with_observer.cc
index 9837c74..496c4b1 100644
--- a/third_party/blink/renderer/modules/payments/payment_request_respond_with_observer.cc
+++ b/third_party/blink/renderer/modules/payments/payment_request_respond_with_observer.cc
@@ -56,11 +56,12 @@
 
   // Check payment response validity.
   if (!response->hasMethodName() || !response->hasDetails()) {
-    GetExecutionContext()->AddConsoleMessage(ConsoleMessage::Create(
-        kJSMessageSource, mojom::ConsoleMessageLevel::kError,
-        "'PaymentHandlerResponse.methodName' and "
-        "'PaymentHandlerResponse.details' must not "
-        "be empty in payment response."));
+    GetExecutionContext()->AddConsoleMessage(
+        ConsoleMessage::Create(mojom::ConsoleMessageSource::kJavaScript,
+                               mojom::ConsoleMessageLevel::kError,
+                               "'PaymentHandlerResponse.methodName' and "
+                               "'PaymentHandlerResponse.details' must not "
+                               "be empty in payment response."));
     OnResponseRejected(mojom::ServiceWorkerResponseError::kUnknown);
     return;
   }
@@ -73,7 +74,8 @@
                            response->details().V8Value().As<v8::Object>())
            .ToLocal(&details_value)) {
     GetExecutionContext()->AddConsoleMessage(ConsoleMessage::Create(
-        kJSMessageSource, mojom::ConsoleMessageLevel::kError,
+        mojom::ConsoleMessageSource::kJavaScript,
+        mojom::ConsoleMessageLevel::kError,
         "Failed to stringify PaymentHandlerResponse.details in payment "
         "response."));
     OnResponseRejected(mojom::ServiceWorkerResponseError::kUnknown);
diff --git a/third_party/blink/renderer/modules/sensor/sensor.cc b/third_party/blink/renderer/modules/sensor/sensor.cc
index 8d017828..67c009ae 100644
--- a/third_party/blink/renderer/modules/sensor/sensor.cc
+++ b/third_party/blink/renderer/modules/sensor/sensor.cc
@@ -65,8 +65,8 @@
           "Maximum allowed frequency value for this sensor type is %.0f Hz.",
           max_allowed_frequency);
       ConsoleMessage* console_message = ConsoleMessage::Create(
-          kJSMessageSource, mojom::ConsoleMessageLevel::kInfo,
-          std::move(message));
+          mojom::ConsoleMessageSource::kJavaScript,
+          mojom::ConsoleMessageLevel::kInfo, std::move(message));
       execution_context->AddConsoleMessage(console_message);
     }
   }
diff --git a/third_party/blink/renderer/modules/sensor/sensor_inspector_agent.cc b/third_party/blink/renderer/modules/sensor/sensor_inspector_agent.cc
index 70d1b3f..4860784 100644
--- a/third_party/blink/renderer/modules/sensor/sensor_inspector_agent.cc
+++ b/third_party/blink/renderer/modules/sensor/sensor_inspector_agent.cc
@@ -79,8 +79,8 @@
     Document* document = provider_->GetSupplementable();
     if (document) {
       ConsoleMessage* console_message = ConsoleMessage::Create(
-          kJSMessageSource, mojom::ConsoleMessageLevel::kInfo,
-          kInspectorConsoleMessage);
+          mojom::ConsoleMessageSource::kJavaScript,
+          mojom::ConsoleMessageLevel::kInfo, kInspectorConsoleMessage);
       document->AddConsoleMessage(console_message);
     }
     provider_->set_inspector_mode(true);
diff --git a/third_party/blink/renderer/modules/service_worker/fetch_respond_with_observer.cc b/third_party/blink/renderer/modules/service_worker/fetch_respond_with_observer.cc
index 8153990..9dc8a3a 100644
--- a/third_party/blink/renderer/modules/service_worker/fetch_respond_with_observer.cc
+++ b/third_party/blink/renderer/modules/service_worker/fetch_respond_with_observer.cc
@@ -12,6 +12,7 @@
 #include "base/metrics/histogram_macros.h"
 #include "services/network/public/mojom/fetch_api.mojom-blink.h"
 #include "services/network/public/mojom/request_context_frame_type.mojom-blink.h"
+#include "third_party/blink/public/mojom/devtools/console_message.mojom-shared.h"
 #include "third_party/blink/public/platform/modules/service_worker/web_service_worker_response.h"
 #include "third_party/blink/public/platform/task_type.h"
 #include "third_party/blink/renderer/bindings/core/v8/script_value.h"
@@ -20,7 +21,6 @@
 #include "third_party/blink/renderer/core/execution_context/execution_context.h"
 #include "third_party/blink/renderer/core/fetch/body_stream_buffer.h"
 #include "third_party/blink/renderer/core/inspector/console_message.h"
-#include "third_party/blink/renderer/core/inspector/console_types.h"
 #include "third_party/blink/renderer/modules/service_worker/service_worker_global_scope_client.h"
 #include "third_party/blink/renderer/modules/service_worker/wait_until_observer.h"
 #include "third_party/blink/renderer/platform/bindings/exception_state.h"
@@ -217,9 +217,10 @@
     ServiceWorkerResponseError error) {
   // TODO(crbug.com/934622): Temporary CHECK for the crash bug.
   CHECK(GetExecutionContext());
-  GetExecutionContext()->AddConsoleMessage(ConsoleMessage::Create(
-      kJSMessageSource, mojom::ConsoleMessageLevel::kWarning,
-      GetMessageForResponseError(error, request_url_)));
+  GetExecutionContext()->AddConsoleMessage(
+      ConsoleMessage::Create(mojom::ConsoleMessageSource::kJavaScript,
+                             mojom::ConsoleMessageLevel::kWarning,
+                             GetMessageForResponseError(error, request_url_)));
 
   // The default value of WebServiceWorkerResponse's status is 0, which maps
   // to a network error.
diff --git a/third_party/blink/renderer/modules/service_worker/service_worker_global_scope.cc b/third_party/blink/renderer/modules/service_worker/service_worker_global_scope.cc
index 9901fb2..52a2c24 100644
--- a/third_party/blink/renderer/modules/service_worker/service_worker_global_scope.cc
+++ b/third_party/blink/renderer/modules/service_worker/service_worker_global_scope.cc
@@ -498,8 +498,9 @@
         "Event handler of '%s' event must be added on the initial evaluation "
         "of worker script.",
         event_type.Utf8().data());
-    AddConsoleMessage(ConsoleMessage::Create(
-        kJSMessageSource, mojom::ConsoleMessageLevel::kWarning, message));
+    AddConsoleMessage(
+        ConsoleMessage::Create(mojom::ConsoleMessageSource::kJavaScript,
+                               mojom::ConsoleMessageLevel::kWarning, message));
   }
   return WorkerGlobalScope::AddEventListenerInternal(event_type, listener,
                                                      options);
diff --git a/third_party/blink/renderer/modules/service_worker/service_worker_global_scope_proxy.cc b/third_party/blink/renderer/modules/service_worker/service_worker_global_scope_proxy.cc
index 69f8f1e..1977fb7c 100644
--- a/third_party/blink/renderer/modules/service_worker/service_worker_global_scope_proxy.cc
+++ b/third_party/blink/renderer/modules/service_worker/service_worker_global_scope_proxy.cc
@@ -434,8 +434,8 @@
                                        : error->unsanitized_message;
   if (!error_message.IsEmpty()) {
     WorkerGlobalScope()->AddConsoleMessage(ConsoleMessage::Create(
-        kWorkerMessageSource, mojom::ConsoleMessageLevel::kError,
-        error_message));
+        mojom::ConsoleMessageSource::kWorker,
+        mojom::ConsoleMessageLevel::kError, error_message));
   }
   // Reject the preloadResponse promise.
   fetch_event->OnNavigationPreloadError(
@@ -613,13 +613,14 @@
 }
 
 void ServiceWorkerGlobalScopeProxy::ReportConsoleMessage(
-    MessageSource source,
+    mojom::ConsoleMessageSource source,
     mojom::ConsoleMessageLevel level,
     const String& message,
     SourceLocation* location) {
   DCHECK_CALLED_ON_VALID_THREAD(worker_thread_checker_);
-  Client().ReportConsoleMessage(source, level, message, location->LineNumber(),
-                                location->Url());
+  // TODO(crbug.com/941871): Remove static_cast and use ConsoleMessageSource.
+  Client().ReportConsoleMessage(static_cast<int>(source), level, message,
+                                location->LineNumber(), location->Url());
 }
 
 void ServiceWorkerGlobalScopeProxy::WillInitializeWorkerContext() {
diff --git a/third_party/blink/renderer/modules/service_worker/service_worker_global_scope_proxy.h b/third_party/blink/renderer/modules/service_worker/service_worker_global_scope_proxy.h
index f841f00..a57a8dd8 100644
--- a/third_party/blink/renderer/modules/service_worker/service_worker_global_scope_proxy.h
+++ b/third_party/blink/renderer/modules/service_worker/service_worker_global_scope_proxy.h
@@ -151,7 +151,7 @@
   void ReportException(const String& error_message,
                        std::unique_ptr<SourceLocation>,
                        int exception_id) override;
-  void ReportConsoleMessage(MessageSource,
+  void ReportConsoleMessage(mojom::ConsoleMessageSource,
                             mojom::ConsoleMessageLevel,
                             const String& message,
                             SourceLocation*) override;
diff --git a/third_party/blink/renderer/modules/service_worker/web_embedded_worker_impl_test.cc b/third_party/blink/renderer/modules/service_worker/web_embedded_worker_impl_test.cc
index c8cb1197..b6d18cb7 100644
--- a/third_party/blink/renderer/modules/service_worker/web_embedded_worker_impl_test.cc
+++ b/third_party/blink/renderer/modules/service_worker/web_embedded_worker_impl_test.cc
@@ -29,6 +29,7 @@
 #include "third_party/blink/renderer/modules/service_worker/thread_safe_script_container.h"
 #include "third_party/blink/renderer/platform/loader/fetch/resource_error.h"
 #include "third_party/blink/renderer/platform/runtime_enabled_features.h"
+#include "third_party/blink/renderer/platform/scheduler/test/fake_task_runner.h"
 #include "third_party/blink/renderer/platform/testing/unit_test_helpers.h"
 #include "third_party/blink/renderer/platform/testing/url_test_helpers.h"
 
@@ -101,6 +102,9 @@
   void Cancel() override {}
   void SetDefersLoading(bool defers) override {}
   void DidChangePriority(WebURLRequest::Priority, int) override {}
+  scoped_refptr<base::SingleThreadTaskRunner> GetTaskRunner() override {
+    return base::MakeRefCounted<scheduler::FakeTaskRunner>();
+  }
 };
 
 // A fake WebURLLoaderFactory which is used for off-main-thread script fetch
diff --git a/third_party/blink/renderer/modules/vr/navigator_vr.cc b/third_party/blink/renderer/modules/vr/navigator_vr.cc
index 26c7130..59b6ec6 100644
--- a/third_party/blink/renderer/modules/vr/navigator_vr.cc
+++ b/third_party/blink/renderer/modules/vr/navigator_vr.cc
@@ -85,7 +85,8 @@
     if (controller_) {
       if (frame->GetDocument()) {
         frame->GetDocument()->AddConsoleMessage(ConsoleMessage::Create(
-            kOtherMessageSource, mojom::ConsoleMessageLevel::kError,
+            mojom::ConsoleMessageSource::kOther,
+            mojom::ConsoleMessageLevel::kError,
             "Cannot use navigator.xr if the legacy VR API is already in use."));
       }
       return nullptr;
diff --git a/third_party/blink/renderer/modules/vr/vr_display.cc b/third_party/blink/renderer/modules/vr/vr_display.cc
index 2268016..23aed90 100644
--- a/third_party/blink/renderer/modules/vr/vr_display.cc
+++ b/third_party/blink/renderer/modules/vr/vr_display.cc
@@ -230,10 +230,11 @@
   if (!in_animation_frame_) {
     Document* doc = navigator_vr_->GetDocument();
     if (doc) {
-      doc->AddConsoleMessage(ConsoleMessage::Create(
-          kRenderingMessageSource, mojom::ConsoleMessageLevel::kWarning,
-          "getFrameData must be called within a "
-          "VRDisplay.requestAnimationFrame callback."));
+      doc->AddConsoleMessage(
+          ConsoleMessage::Create(mojom::ConsoleMessageSource::kRendering,
+                                 mojom::ConsoleMessageLevel::kWarning,
+                                 "getFrameData must be called within a "
+                                 "VRDisplay.requestAnimationFrame callback."));
     }
     return false;
   }
@@ -798,16 +799,18 @@
 
   if (!is_presenting_) {
     doc->AddConsoleMessage(ConsoleMessage::Create(
-        kRenderingMessageSource, mojom::ConsoleMessageLevel::kWarning,
+        mojom::ConsoleMessageSource::kRendering,
+        mojom::ConsoleMessageLevel::kWarning,
         "submitFrame has no effect when the VRDisplay is not presenting."));
     return;
   }
 
   if (!in_animation_frame_) {
-    doc->AddConsoleMessage(ConsoleMessage::Create(
-        kRenderingMessageSource, mojom::ConsoleMessageLevel::kWarning,
-        "submitFrame must be called within a "
-        "VRDisplay.requestAnimationFrame callback."));
+    doc->AddConsoleMessage(
+        ConsoleMessage::Create(mojom::ConsoleMessageSource::kRendering,
+                               mojom::ConsoleMessageLevel::kWarning,
+                               "submitFrame must be called within a "
+                               "VRDisplay.requestAnimationFrame callback."));
     return;
   }
 
diff --git a/third_party/blink/renderer/modules/webaudio/audio_context.cc b/third_party/blink/renderer/modules/webaudio/audio_context.cc
index 9f5b78b..e5879f4 100644
--- a/third_party/blink/renderer/modules/webaudio/audio_context.cc
+++ b/third_party/blink/renderer/modules/webaudio/audio_context.cc
@@ -454,13 +454,15 @@
       DCHECK(document->GetFrame() &&
              document->GetFrame()->IsCrossOriginSubframe());
       document->AddConsoleMessage(ConsoleMessage::Create(
-          kOtherMessageSource, mojom::ConsoleMessageLevel::kWarning,
+          mojom::ConsoleMessageSource::kOther,
+          mojom::ConsoleMessageLevel::kWarning,
           "The AudioContext was not allowed to start. It must be resumed (or "
           "created) from a user gesture event handler. https://goo.gl/7K7WLu"));
       break;
     case AutoplayPolicy::Type::kDocumentUserActivationRequired:
       document->AddConsoleMessage(ConsoleMessage::Create(
-          kOtherMessageSource, mojom::ConsoleMessageLevel::kWarning,
+          mojom::ConsoleMessageSource::kOther,
+          mojom::ConsoleMessageLevel::kWarning,
           "The AudioContext was not allowed to start. It must be resumed (or "
           "created) after a user gesture on the page. https://goo.gl/7K7WLu"));
       break;
diff --git a/third_party/blink/renderer/modules/webaudio/audio_param.cc b/third_party/blink/renderer/modules/webaudio/audio_param.cc
index 42e36775..a212d01 100644
--- a/third_party/blink/renderer/modules/webaudio/audio_param.cc
+++ b/third_party/blink/renderer/modules/webaudio/audio_param.cc
@@ -375,7 +375,8 @@
 void AudioParam::WarnIfOutsideRange(const String& param_method, float value) {
   if (value < minValue() || value > maxValue()) {
     Context()->GetExecutionContext()->AddConsoleMessage(ConsoleMessage::Create(
-        kJSMessageSource, mojom::ConsoleMessageLevel::kWarning,
+        mojom::ConsoleMessageSource::kJavaScript,
+        mojom::ConsoleMessageLevel::kWarning,
         Handler().GetParamName() + "." + param_method + " " +
             String::Number(value) + " outside nominal range [" +
             String::Number(minValue()) + ", " + String::Number(maxValue()) +
diff --git a/third_party/blink/renderer/modules/webaudio/base_audio_context.cc b/third_party/blink/renderer/modules/webaudio/base_audio_context.cc
index de98097..8c608b3 100644
--- a/third_party/blink/renderer/modules/webaudio/base_audio_context.cc
+++ b/third_party/blink/renderer/modules/webaudio/base_audio_context.cc
@@ -26,6 +26,7 @@
 #include "third_party/blink/renderer/modules/webaudio/base_audio_context.h"
 
 #include "build/build_config.h"
+#include "third_party/blink/public/mojom/devtools/console_message.mojom-shared.h"
 #include "third_party/blink/public/platform/platform.h"
 #include "third_party/blink/public/platform/task_type.h"
 #include "third_party/blink/renderer/bindings/core/v8/dictionary.h"
@@ -35,7 +36,6 @@
 #include "third_party/blink/renderer/core/frame/settings.h"
 #include "third_party/blink/renderer/core/html/media/html_media_element.h"
 #include "third_party/blink/renderer/core/inspector/console_message.h"
-#include "third_party/blink/renderer/core/inspector/console_types.h"
 #include "third_party/blink/renderer/modules/webaudio/analyser_node.h"
 #include "third_party/blink/renderer/modules/webaudio/audio_buffer.h"
 #include "third_party/blink/renderer/modules/webaudio/audio_buffer_source_node.h"
@@ -210,17 +210,19 @@
   DCHECK(handler);
 
   if (IsContextClosed() && GetDocument()) {
-    GetDocument()->AddConsoleMessage(ConsoleMessage::Create(
-        kOtherMessageSource, mojom::ConsoleMessageLevel::kWarning,
-        "Construction of " + handler->NodeTypeName() +
-            " is not useful when context is closed."));
+    GetDocument()->AddConsoleMessage(
+        ConsoleMessage::Create(mojom::ConsoleMessageSource::kOther,
+                               mojom::ConsoleMessageLevel::kWarning,
+                               "Construction of " + handler->NodeTypeName() +
+                                   " is not useful when context is closed."));
   }
 }
 
 void BaseAudioContext::WarnForConnectionIfContextClosed() const {
   if (IsContextClosed() && GetDocument()) {
     GetDocument()->AddConsoleMessage(ConsoleMessage::Create(
-        kOtherMessageSource, mojom::ConsoleMessageLevel::kWarning,
+        mojom::ConsoleMessageSource::kOther,
+        mojom::ConsoleMessageLevel::kWarning,
         "Connecting nodes after the context has been closed is not useful."));
   }
 }
diff --git a/third_party/blink/renderer/modules/webaudio/iir_filter_node.cc b/third_party/blink/renderer/modules/webaudio/iir_filter_node.cc
index 6a9a8dd..bb50d3a 100644
--- a/third_party/blink/renderer/modules/webaudio/iir_filter_node.cc
+++ b/third_party/blink/renderer/modules/webaudio/iir_filter_node.cc
@@ -166,8 +166,8 @@
     message.Append(']');
 
     context.GetExecutionContext()->AddConsoleMessage(ConsoleMessage::Create(
-        kJSMessageSource, mojom::ConsoleMessageLevel::kWarning,
-        message.ToString()));
+        mojom::ConsoleMessageSource::kJavaScript,
+        mojom::ConsoleMessageLevel::kWarning, message.ToString()));
   }
 
   return MakeGarbageCollected<IIRFilterNode>(context, feedforward_coef,
diff --git a/third_party/blink/renderer/modules/webaudio/media_element_audio_source_node.cc b/third_party/blink/renderer/modules/webaudio/media_element_audio_source_node.cc
index 8438502..6966c7a6 100644
--- a/third_party/blink/renderer/modules/webaudio/media_element_audio_source_node.cc
+++ b/third_party/blink/renderer/modules/webaudio/media_element_audio_source_node.cc
@@ -142,11 +142,12 @@
 
 void MediaElementAudioSourceHandler::PrintCorsMessage(const String& message) {
   if (Context()->GetExecutionContext()) {
-    Context()->GetExecutionContext()->AddConsoleMessage(ConsoleMessage::Create(
-        kSecurityMessageSource, mojom::ConsoleMessageLevel::kInfo,
-        "MediaElementAudioSource outputs zeroes due to "
-        "CORS access restrictions for " +
-            message));
+    Context()->GetExecutionContext()->AddConsoleMessage(
+        ConsoleMessage::Create(mojom::ConsoleMessageSource::kSecurity,
+                               mojom::ConsoleMessageLevel::kInfo,
+                               "MediaElementAudioSource outputs zeroes due to "
+                               "CORS access restrictions for " +
+                                   message));
   }
 }
 
diff --git a/third_party/blink/renderer/modules/webdatabase/database.cc b/third_party/blink/renderer/modules/webdatabase/database.cc
index f57a499..00d05f7 100644
--- a/third_party/blink/renderer/modules/webdatabase/database.cc
+++ b/third_party/blink/renderer/modules/webdatabase/database.cc
@@ -761,8 +761,9 @@
 }
 
 void Database::LogErrorMessage(const String& message) {
-  GetExecutionContext()->AddConsoleMessage(ConsoleMessage::Create(
-      kStorageMessageSource, mojom::ConsoleMessageLevel::kError, message));
+  GetExecutionContext()->AddConsoleMessage(
+      ConsoleMessage::Create(mojom::ConsoleMessageSource::kStorage,
+                             mojom::ConsoleMessageLevel::kError, message));
 }
 
 ExecutionContext* Database::GetExecutionContext() const {
diff --git a/third_party/blink/renderer/modules/webdatabase/database_manager.cc b/third_party/blink/renderer/modules/webdatabase/database_manager.cc
index ba8b939b..7c9b9ad 100644
--- a/third_party/blink/renderer/modules/webdatabase/database_manager.cc
+++ b/third_party/blink/renderer/modules/webdatabase/database_manager.cc
@@ -199,8 +199,9 @@
 
 void DatabaseManager::LogErrorMessage(ExecutionContext* context,
                                       const String& message) {
-  context->AddConsoleMessage(ConsoleMessage::Create(
-      kStorageMessageSource, mojom::ConsoleMessageLevel::kError, message));
+  context->AddConsoleMessage(
+      ConsoleMessage::Create(mojom::ConsoleMessageSource::kStorage,
+                             mojom::ConsoleMessageLevel::kError, message));
 }
 
 }  // namespace blink
diff --git a/third_party/blink/renderer/modules/webgl/webgl_rendering_context_base.cc b/third_party/blink/renderer/modules/webgl/webgl_rendering_context_base.cc
index bc1fb4e6..aeb9f00 100644
--- a/third_party/blink/renderer/modules/webgl/webgl_rendering_context_base.cc
+++ b/third_party/blink/renderer/modules/webgl/webgl_rendering_context_base.cc
@@ -7383,8 +7383,9 @@
 void WebGLRenderingContextBase::PrintWarningToConsole(const String& message) {
   if (!canvas())
     return;
-  canvas()->GetDocument().AddConsoleMessage(ConsoleMessage::Create(
-      kRenderingMessageSource, mojom::ConsoleMessageLevel::kWarning, message));
+  canvas()->GetDocument().AddConsoleMessage(
+      ConsoleMessage::Create(mojom::ConsoleMessageSource::kRendering,
+                             mojom::ConsoleMessageLevel::kWarning, message));
 }
 
 bool WebGLRenderingContextBase::ValidateFramebufferFuncParameters(
diff --git a/third_party/blink/renderer/modules/webgpu/BUILD.gn b/third_party/blink/renderer/modules/webgpu/BUILD.gn
index bc0d50b..10bb51da 100644
--- a/third_party/blink/renderer/modules/webgpu/BUILD.gn
+++ b/third_party/blink/renderer/modules/webgpu/BUILD.gn
@@ -6,6 +6,7 @@
 
 blink_modules_sources("webgpu") {
   sources = [
+    "dawn_callback.h",
     "dawn_control_client_holder.cc",
     "dawn_control_client_holder.h",
     "dawn_object.cc",
diff --git a/third_party/blink/renderer/modules/webgpu/dawn_callback.h b/third_party/blink/renderer/modules/webgpu/dawn_callback.h
new file mode 100644
index 0000000..d605965
--- /dev/null
+++ b/third_party/blink/renderer/modules/webgpu/dawn_callback.h
@@ -0,0 +1,111 @@
+// Copyright 2019 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef THIRD_PARTY_BLINK_RENDERER_MODULES_WEBGPU_DAWN_CALLBACK_H_
+#define THIRD_PARTY_BLINK_RENDERER_MODULES_WEBGPU_DAWN_CALLBACK_H_
+
+#include <memory>
+
+#include "third_party/blink/renderer/platform/wtf/functional.h"
+
+using DawnCallbackUserdata = uint64_t;
+
+namespace blink {
+
+// DawnCallback<Callback> is a heap-allocated version of
+// base::OnceCallback or base::RepeatingCallback.
+// It is allocated on the heap so that it can be reinterpret_cast to/from
+// DawnCallbackUserdata and passed to Dawn C callbacks.
+//
+// Example:
+//   DawnCallback<F>* callback =
+//     CreateDawnCallback(WTF::Bind(func, arg1));
+//
+//   // |someDawnFunction| expects callback function with arguments:
+//   //    Args... args, DawnCallbackUserdata userdata.
+//   // When it is called, it will forward to func(arg1, args...).
+//   GetProcs().someDawnFunction(
+//     callback->UnboundCallback(), callback->AsUserdata());
+template <typename Callback>
+class DawnCallback;
+
+template <template <typename> class BaseCallbackTemplate,
+          typename R,
+          typename... Args>
+class DawnCallback<BaseCallbackTemplate<R(Args...)>> {
+  using BaseCallback = BaseCallbackTemplate<R(Args...)>;
+  using UnboundCallbackFunction = R (*)(Args..., DawnCallbackUserdata);
+
+  static_assert(
+      std::is_same<BaseCallback, base::OnceCallback<R(Args...)>>::value ||
+          std::is_same<BaseCallback,
+                       base::RepeatingCallback<R(Args...)>>::value,
+      "Callback must be base::OnceCallback or base::RepeatingCallback");
+
+ public:
+  explicit DawnCallback(BaseCallback callback)
+      : callback_(std::move(callback)) {}
+
+  R Run(Args... args) && {
+    return std::move(callback_).Run(std::forward<Args>(args)...);
+  }
+
+  R Run(Args... args) const& {
+    return callback_.Run(std::forward<Args>(args)...);
+  }
+
+  void Reset() { callback_.Reset(); }
+
+  UnboundCallbackFunction UnboundCallback() {
+    return [](Args... args, DawnCallbackUserdata handle) {
+      // After this non-repeating callback is run, it should delete itself.
+      auto callback =
+          std::unique_ptr<DawnCallback>(DawnCallback::FromUserdata(handle));
+      return std::move(*callback).Run(std::forward<Args>(args)...);
+    };
+  }
+
+  UnboundCallbackFunction UnboundRepeatingCallback() {
+    return [](Args... args, DawnCallbackUserdata handle) {
+      return DawnCallback::FromUserdata(handle)->Run(
+          std::forward<Args>(args)...);
+    };
+  }
+
+  DawnCallbackUserdata AsUserdata() {
+    return static_cast<DawnCallbackUserdata>(reinterpret_cast<uintptr_t>(this));
+  }
+
+  static DawnCallback* FromUserdata(DawnCallbackUserdata userdata) {
+    return reinterpret_cast<DawnCallback*>(static_cast<uintptr_t>(userdata));
+  }
+
+ private:
+  BaseCallback callback_;
+};
+
+template <typename CallbackType>
+DawnCallback<CallbackType>* CreateDawnCallback(CallbackType cb) {
+  return new DawnCallback<CallbackType>(std::move(cb));
+}
+
+template <typename FunctionType, typename... BoundParameters>
+auto BindDawnCallback(FunctionType&& function,
+                      BoundParameters&&... bound_parameters) {
+  return CreateDawnCallback(
+      WTF::Bind(std::forward<FunctionType>(function),
+                std::forward<BoundParameters>(bound_parameters)...));
+}
+
+template <typename FunctionType, typename... BoundParameters>
+auto BindRepeatingDawnCallback(FunctionType&& function,
+                               BoundParameters&&... bound_parameters) {
+  return CreateDawnCallback(
+      WTF::BindRepeating(std::forward<FunctionType>(function),
+                         std::forward<BoundParameters>(bound_parameters)...));
+}
+
+}  // namespace blink
+
+#endif  // THIRD_PARTY_BLINK_RENDERER_MODULES_WEBGPU_DAWN_CALLBACK_H_
diff --git a/third_party/blink/renderer/modules/websockets/dom_websocket.cc b/third_party/blink/renderer/modules/websockets/dom_websocket.cc
index 3fcdd14..b37cd33 100644
--- a/third_party/blink/renderer/modules/websockets/dom_websocket.cc
+++ b/third_party/blink/renderer/modules/websockets/dom_websocket.cc
@@ -254,8 +254,9 @@
 
 void DOMWebSocket::LogError(const String& message) {
   if (GetExecutionContext()) {
-    GetExecutionContext()->AddConsoleMessage(ConsoleMessage::Create(
-        kJSMessageSource, mojom::ConsoleMessageLevel::kError, message));
+    GetExecutionContext()->AddConsoleMessage(
+        ConsoleMessage::Create(mojom::ConsoleMessageSource::kJavaScript,
+                               mojom::ConsoleMessageLevel::kError, message));
   }
 }
 
diff --git a/third_party/blink/renderer/modules/websockets/dom_websocket_test.cc b/third_party/blink/renderer/modules/websockets/dom_websocket_test.cc
index 1771832..9e751db 100644
--- a/third_party/blink/renderer/modules/websockets/dom_websocket_test.cc
+++ b/third_party/blink/renderer/modules/websockets/dom_websocket_test.cc
@@ -10,13 +10,13 @@
 #include "testing/gmock/include/gmock/gmock.h"
 #include "testing/gtest/include/gtest/gtest.h"
 #include "third_party/blink/public/common/features.h"
+#include "third_party/blink/public/mojom/devtools/console_message.mojom-shared.h"
 #include "third_party/blink/public/platform/web_insecure_request_policy.h"
 #include "third_party/blink/renderer/bindings/core/v8/v8_binding_for_core.h"
 #include "third_party/blink/renderer/bindings/core/v8/v8_binding_for_testing.h"
 #include "third_party/blink/renderer/core/dom/document.h"
 #include "third_party/blink/renderer/core/execution_context/security_context.h"
 #include "third_party/blink/renderer/core/fileapi/blob.h"
-#include "third_party/blink/renderer/core/inspector/console_types.h"
 #include "third_party/blink/renderer/core/testing/dummy_page_holder.h"
 #include "third_party/blink/renderer/core/typed_arrays/dom_typed_array.h"
 #include "third_party/blink/renderer/platform/bindings/exception_state.h"
diff --git a/third_party/blink/renderer/modules/websockets/web_pepper_socket_impl.cc b/third_party/blink/renderer/modules/websockets/web_pepper_socket_impl.cc
index 4431a6c..745ada6e 100644
--- a/third_party/blink/renderer/modules/websockets/web_pepper_socket_impl.cc
+++ b/third_party/blink/renderer/modules/websockets/web_pepper_socket_impl.cc
@@ -32,11 +32,11 @@
 
 #include <stddef.h>
 #include <memory>
+#include "third_party/blink/public/mojom/devtools/console_message.mojom-shared.h"
 #include "third_party/blink/public/platform/web_url.h"
 #include "third_party/blink/public/web/web_array_buffer.h"
 #include "third_party/blink/public/web/web_document.h"
 #include "third_party/blink/renderer/core/dom/document.h"
-#include "third_party/blink/renderer/core/inspector/console_types.h"
 #include "third_party/blink/renderer/core/typed_arrays/dom_array_buffer.h"
 #include "third_party/blink/renderer/modules/websockets/web_pepper_socket_channel_client_proxy.h"
 #include "third_party/blink/renderer/modules/websockets/websocket_channel.h"
diff --git a/third_party/blink/renderer/modules/websockets/websocket_channel_impl.cc b/third_party/blink/renderer/modules/websockets/websocket_channel_impl.cc
index 062d17e..80aaae7 100644
--- a/third_party/blink/renderer/modules/websockets/websocket_channel_impl.cc
+++ b/third_party/blink/renderer/modules/websockets/websocket_channel_impl.cc
@@ -231,8 +231,9 @@
     String message =
         "Connecting to a non-secure WebSocket server from a secure origin is "
         "deprecated.";
-    execution_context_->AddConsoleMessage(ConsoleMessage::Create(
-        kJSMessageSource, mojom::ConsoleMessageLevel::kWarning, message));
+    execution_context_->AddConsoleMessage(
+        ConsoleMessage::Create(mojom::ConsoleMessageSource::kJavaScript,
+                               mojom::ConsoleMessageLevel::kWarning, message));
   }
 
   url_ = url;
@@ -385,8 +386,9 @@
     location = location_at_construction_->Clone();
   }
 
-  execution_context_->AddConsoleMessage(ConsoleMessage::Create(
-      kJSMessageSource, level, message, std::move(location)));
+  execution_context_->AddConsoleMessage(
+      ConsoleMessage::Create(mojom::ConsoleMessageSource::kJavaScript, level,
+                             message, std::move(location)));
   // |reason| is only for logging and should not be provided for scripts,
   // hence close reason must be empty in tearDownFailedConnection.
   TearDownFailedConnection();
diff --git a/third_party/blink/renderer/modules/webusb/usb_device.cc b/third_party/blink/renderer/modules/webusb/usb_device.cc
index 79d3ad2c..cccf38c4 100644
--- a/third_party/blink/renderer/modules/webusb/usb_device.cc
+++ b/third_party/blink/renderer/modules/webusb/usb_device.cc
@@ -239,11 +239,12 @@
     } else if (claimed_interfaces_.Get(interface_index)) {
       resolver->Resolve();
     } else if (IsProtectedInterfaceClass(interface_index)) {
-      GetExecutionContext()->AddConsoleMessage(ConsoleMessage::Create(
-          kJSMessageSource, mojom::ConsoleMessageLevel::kWarning,
-          "An attempt to claim a USB device interface "
-          "has been blocked because it "
-          "implements a protected interface class."));
+      GetExecutionContext()->AddConsoleMessage(
+          ConsoleMessage::Create(mojom::ConsoleMessageSource::kJavaScript,
+                                 mojom::ConsoleMessageLevel::kWarning,
+                                 "An attempt to claim a USB device interface "
+                                 "has been blocked because it "
+                                 "implements a protected interface class."));
       resolver->Reject(DOMException::Create(
           DOMExceptionCode::kSecurityError,
           "The requested interface implements a protected class."));
diff --git a/third_party/blink/renderer/modules/xr/xr.cc b/third_party/blink/renderer/modules/xr/xr.cc
index 40db9d9..ab2d015b 100644
--- a/third_party/blink/renderer/modules/xr/xr.cc
+++ b/third_party/blink/renderer/modules/xr/xr.cc
@@ -271,7 +271,8 @@
 
   if (mode == XRSession::kModeInlineAR) {
     doc->AddConsoleMessage(ConsoleMessage::Create(
-        kOtherMessageSource, mojom::ConsoleMessageLevel::kWarning,
+        mojom::ConsoleMessageSource::kOther,
+        mojom::ConsoleMessageLevel::kWarning,
         "Inline AR is deprecated and will be removed soon."));
   }
 
diff --git a/third_party/blink/renderer/platform/exported/web_runtime_features.cc b/third_party/blink/renderer/platform/exported/web_runtime_features.cc
index 3c6db11..e5ec7e8f 100644
--- a/third_party/blink/renderer/platform/exported/web_runtime_features.cc
+++ b/third_party/blink/renderer/platform/exported/web_runtime_features.cc
@@ -43,11 +43,6 @@
   RuntimeEnabledFeatures::SetHeapUnifiedGarbageCollectionEnabled(enable);
 }
 
-void WebRuntimeFeatures::EnableBlinkHeapCollectLiveNonNodeWrappers(
-    bool enable) {
-  RuntimeEnabledFeatures::SetHeapCollectLiveNonNodeWrappersEnabled(enable);
-}
-
 void WebRuntimeFeatures::EnableBloatedRendererDetection(bool enable) {
   RuntimeEnabledFeatures::SetBloatedRendererDetectionEnabled(enable);
 }
diff --git a/third_party/blink/renderer/platform/fonts/mac/core_text_font_format_support.cc b/third_party/blink/renderer/platform/fonts/mac/core_text_font_format_support.cc
index 37d15ae..df03c35 100644
--- a/third_party/blink/renderer/platform/fonts/mac/core_text_font_format_support.cc
+++ b/third_party/blink/renderer/platform/fonts/mac/core_text_font_format_support.cc
@@ -11,8 +11,8 @@
 // Compare CoreText.h in an up to date SDK, redefining here since we don't seem
 // to have access to this value when building against the 10.10 SDK in our
 // standard Chrome build configuration.
-static const long kBlinkLocalCTVersionNumber10_12 = 0x00090000;
-static const long kBlinkLocalCTVersionNumber10_13 = 0x000A0000;
+static const uint32_t kBlinkLocalCTVersionNumber10_12 = 0x00090000;
+static const uint32_t kBlinkLocalCTVersionNumber10_13 = 0x000A0000;
 
 bool CoreTextVersionSupportsVariations() {
   return &CTGetCoreTextVersion &&
diff --git a/third_party/blink/renderer/platform/fonts/orientation_iterator_test.cc b/third_party/blink/renderer/platform/fonts/orientation_iterator_test.cc
index b2c9dc8..7e9ff0a 100644
--- a/third_party/blink/renderer/platform/fonts/orientation_iterator_test.cc
+++ b/third_party/blink/renderer/platform/fonts/orientation_iterator_test.cc
@@ -41,7 +41,7 @@
                   const Vector<OrientationExpectedRun>& expect) {
     unsigned limit;
     OrientationIterator::RenderOrientation render_orientation;
-    unsigned long run_count = 0;
+    size_t run_count = 0;
     while (orientation_iterator->Consume(&limit, &render_orientation)) {
       ASSERT_LT(run_count, expect.size());
       ASSERT_EQ(expect[run_count].limit, limit);
diff --git a/third_party/blink/renderer/platform/heap/heap_compact.cc b/third_party/blink/renderer/platform/heap/heap_compact.cc
index cd16fd7..3b18dd177 100644
--- a/third_party/blink/renderer/platform/heap/heap_compact.cc
+++ b/third_party/blink/renderer/platform/heap/heap_compact.cc
@@ -381,13 +381,11 @@
 
   if (reason != BlinkGC::GCReason::kIdleGC &&
       reason != BlinkGC::GCReason::kPreciseGC &&
-      reason != BlinkGC::GCReason::kForcedGC)
+      reason != BlinkGC::GCReason::kForcedGC &&
+      reason != BlinkGC::GCReason::kIncrementalIdleGC &&
+      reason != BlinkGC::GCReason::kUnifiedHeapGC)
     return false;
 
-  // TODO(keishi): crbug.com/918064 Heap compaction for incremental marking
-  // needs to be disabled until this crash is fixed.
-  CHECK_NE(marking_type, BlinkGC::kIncrementalMarking);
-
   // Compaction enable rules:
   //  - It's been a while since the last time.
   //  - "Considerable" amount of heap memory is bound up in freelist
diff --git a/third_party/blink/renderer/platform/heap/unified_heap_controller.cc b/third_party/blink/renderer/platform/heap/unified_heap_controller.cc
index 158d3f8..36dc0a5a 100644
--- a/third_party/blink/renderer/platform/heap/unified_heap_controller.cc
+++ b/third_party/blink/renderer/platform/heap/unified_heap_controller.cc
@@ -136,14 +136,6 @@
       class_id != WrapperTypeInfo::kObjectClassId)
     return true;
 
-  const bool collect_non_node_wrappers =
-      RuntimeEnabledFeatures::HeapCollectLiveNonNodeWrappersEnabled();
-
-  if (!collect_non_node_wrappers &&
-      class_id == WrapperTypeInfo::kObjectClassId) {
-    return true;
-  }
-
   const v8::TracedGlobal<v8::Object>& traced = handle.As<v8::Object>();
   if (ToWrapperTypeInfo(traced)->IsActiveScriptWrappable() &&
       ToScriptWrappable(traced)->HasPendingActivity()) {
diff --git a/third_party/blink/renderer/platform/loader/fetch/console_logger.h b/third_party/blink/renderer/platform/loader/fetch/console_logger.h
index 680acc9..3352c47 100644
--- a/third_party/blink/renderer/platform/loader/fetch/console_logger.h
+++ b/third_party/blink/renderer/platform/loader/fetch/console_logger.h
@@ -14,8 +14,8 @@
 // A pure virtual interface for console logging.
 class PLATFORM_EXPORT ConsoleLogger : public GarbageCollectedMixin {
  public:
-  // This enum corresponds to blink::MessageSource. Expand this enum when
-  // needed.
+  // This enum corresponds to blink::mojom::ConsoleMessageSource. Expand this
+  // enum when needed.
   enum class Source {
     kScript,
     kSecurity,
diff --git a/third_party/blink/renderer/platform/loader/fetch/resource_loader.cc b/third_party/blink/renderer/platform/loader/fetch/resource_loader.cc
index 1f5d8ce..72ff76c 100644
--- a/third_party/blink/renderer/platform/loader/fetch/resource_loader.cc
+++ b/third_party/blink/renderer/platform/loader/fetch/resource_loader.cc
@@ -415,6 +415,7 @@
   const ResourceRequest& request = resource_->GetResourceRequest();
   ActivateCacheAwareLoadingIfNeeded(request);
   loader_ = fetcher_->CreateURLLoader(request, resource_->Options());
+  task_runner_for_body_loader_ = loader_->GetTaskRunner();
   DCHECK_EQ(ResourceLoadScheduler::kInvalidClientId, scheduler_client_id_);
   auto throttle_option = ResourceLoadScheduler::ThrottleOption::kThrottleable;
 
@@ -462,7 +463,8 @@
   DCHECK(!response_body_loader_);
   ResponseBodyLoaderClient& response_body_loader_client = *this;
   response_body_loader_ = MakeGarbageCollected<ResponseBodyLoader>(
-      bytes_consumer, response_body_loader_client, GetLoadingTaskRunner());
+      bytes_consumer, response_body_loader_client,
+      task_runner_for_body_loader_);
   resource_->ResponseBodyReceived(*response_body_loader_);
   if (response_body_loader_->IsDrained()) {
     // When streaming, unpause virtual time early to prevent deadlocking
@@ -555,6 +557,7 @@
 void ResourceLoader::Restart(const ResourceRequest& request) {
   CHECK_EQ(resource_->Options().synchronous_policy, kRequestAsynchronously);
   loader_ = fetcher_->CreateURLLoader(request, resource_->Options());
+  task_runner_for_body_loader_ = loader_->GetTaskRunner();
   StartWith(request);
 }
 
diff --git a/third_party/blink/renderer/platform/loader/fetch/resource_loader.h b/third_party/blink/renderer/platform/loader/fetch/resource_loader.h
index d13de58..f1dc3265 100644
--- a/third_party/blink/renderer/platform/loader/fetch/resource_loader.h
+++ b/third_party/blink/renderer/platform/loader/fetch/resource_loader.h
@@ -249,6 +249,7 @@
     std::vector<network::cors::PreflightTimingInfo> cors_preflight_timing_info;
   };
   base::Optional<DeferredFinishLoadingInfo> deferred_finish_loading_info_;
+  scoped_refptr<base::SingleThreadTaskRunner> task_runner_for_body_loader_;
 
   // True if loading is deferred.
   bool defers_ = false;
diff --git a/third_party/blink/renderer/platform/loader/fetch/resource_loader_defer_loading_test.cc b/third_party/blink/renderer/platform/loader/fetch/resource_loader_defer_loading_test.cc
index 453cd99..8394102 100644
--- a/third_party/blink/renderer/platform/loader/fetch/resource_loader_defer_loading_test.cc
+++ b/third_party/blink/renderer/platform/loader/fetch/resource_loader_defer_loading_test.cc
@@ -106,6 +106,9 @@
   void DidChangePriority(WebURLRequest::Priority, int) override {
     NOTREACHED();
   }
+  scoped_refptr<base::SingleThreadTaskRunner> GetTaskRunner() override {
+    return base::MakeRefCounted<scheduler::FakeTaskRunner>();
+  }
 
  private:
   // Points to |ResourceLoaderDefersLoadingTest::web_url_loader_defers_|.
diff --git a/third_party/blink/renderer/platform/loader/fetch/resource_loader_test.cc b/third_party/blink/renderer/platform/loader/fetch/resource_loader_test.cc
index fa8a630..88cb7d9 100644
--- a/third_party/blink/renderer/platform/loader/fetch/resource_loader_test.cc
+++ b/third_party/blink/renderer/platform/loader/fetch/resource_loader_test.cc
@@ -60,8 +60,8 @@
     std::unique_ptr<WebURLLoader> CreateURLLoader(
         const ResourceRequest& request,
         const ResourceLoaderOptions& options,
-        scoped_refptr<base::SingleThreadTaskRunner>) override {
-      return std::make_unique<NoopWebURLLoader>();
+        scoped_refptr<base::SingleThreadTaskRunner> task_runner) override {
+      return std::make_unique<NoopWebURLLoader>(std::move(task_runner));
     }
     std::unique_ptr<CodeCacheLoader> CreateCodeCacheLoader() override {
       return Platform::Current()->CreateCodeCacheLoader();
@@ -75,6 +75,8 @@
  private:
   class NoopWebURLLoader final : public WebURLLoader {
    public:
+    NoopWebURLLoader(scoped_refptr<base::SingleThreadTaskRunner> task_runner)
+        : task_runner_(task_runner) {}
     ~NoopWebURLLoader() override = default;
     void LoadSynchronously(const WebURLRequest&,
                            WebURLLoaderClient*,
@@ -94,6 +96,12 @@
     void DidChangePriority(WebURLRequest::Priority, int) override {
       NOTREACHED();
     }
+    scoped_refptr<base::SingleThreadTaskRunner> GetTaskRunner() override {
+      return task_runner_;
+    }
+
+   private:
+    scoped_refptr<base::SingleThreadTaskRunner> task_runner_;
   };
 };
 
diff --git a/third_party/blink/renderer/platform/mojo/geometry.typemap b/third_party/blink/renderer/platform/mojo/geometry.typemap
index 5a7f96c..5675e71e 100644
--- a/third_party/blink/renderer/platform/mojo/geometry.typemap
+++ b/third_party/blink/renderer/platform/mojo/geometry.typemap
@@ -18,6 +18,9 @@
 # Note: consumers of this typemap must themselves depend on platform.
 deps = [
   "//mojo/public/cpp/bindings",
+]
+
+public_deps = [
   "//third_party/blink/renderer/platform/mojo:geometry_struct_traits",
 ]
 
diff --git a/third_party/blink/renderer/platform/runtime_enabled_features.json5 b/third_party/blink/renderer/platform/runtime_enabled_features.json5
index 6c2b734c..5dde6fe 100644
--- a/third_party/blink/renderer/platform/runtime_enabled_features.json5
+++ b/third_party/blink/renderer/platform/runtime_enabled_features.json5
@@ -603,13 +603,13 @@
       status: "stable",
     },
     {
-      name: "HeapCollectLiveNonNodeWrappers",
-    },
-    {
       name: "HeapCompaction",
       status: "stable",
     },
     {
+      name: "HeapConcurrentMarking",
+    },
+    {
       name: "HeapIncrementalMarking",
       status: "stable",
     },
diff --git a/third_party/blink/renderer/platform/testing/weburl_loader_mock.cc b/third_party/blink/renderer/platform/testing/weburl_loader_mock.cc
index b61d4c9..867d8dc5 100644
--- a/third_party/blink/renderer/platform/testing/weburl_loader_mock.cc
+++ b/third_party/blink/renderer/platform/testing/weburl_loader_mock.cc
@@ -11,6 +11,7 @@
 #include "third_party/blink/public/platform/web_security_origin.h"
 #include "third_party/blink/public/platform/web_url_error.h"
 #include "third_party/blink/public/platform/web_url_loader_client.h"
+#include "third_party/blink/renderer/platform/scheduler/test/fake_task_runner.h"
 #include "third_party/blink/renderer/platform/shared_buffer.h"
 #include "third_party/blink/renderer/platform/testing/weburl_loader_mock_factory_impl.h"
 #include "third_party/blink/renderer/platform/wtf/time.h"
@@ -169,6 +170,10 @@
 void WebURLLoaderMock::DidChangePriority(WebURLRequest::Priority new_priority,
                                          int intra_priority_value) {}
 
+scoped_refptr<base::SingleThreadTaskRunner> WebURLLoaderMock::GetTaskRunner() {
+  return base::MakeRefCounted<scheduler::FakeTaskRunner>();
+}
+
 base::WeakPtr<WebURLLoaderMock> WebURLLoaderMock::GetWeakPtr() {
   return weak_factory_.GetWeakPtr();
 }
diff --git a/third_party/blink/renderer/platform/testing/weburl_loader_mock.h b/third_party/blink/renderer/platform/testing/weburl_loader_mock.h
index 8b031ca..43b22d6 100644
--- a/third_party/blink/renderer/platform/testing/weburl_loader_mock.h
+++ b/third_party/blink/renderer/platform/testing/weburl_loader_mock.h
@@ -59,6 +59,7 @@
   void SetDefersLoading(bool defer) override;
   void DidChangePriority(WebURLRequest::Priority new_priority,
                          int intra_priority_value) override;
+  scoped_refptr<base::SingleThreadTaskRunner> GetTaskRunner() override;
 
   bool is_deferred() { return is_deferred_; }
   bool is_cancelled() { return !client_; }
diff --git a/third_party/blink/tools/blinkpy/web_tests/port/base.py b/third_party/blink/tools/blinkpy/web_tests/port/base.py
index d890cefe..0ca6336 100644
--- a/third_party/blink/tools/blinkpy/web_tests/port/base.py
+++ b/third_party/blink/tools/blinkpy/web_tests/port/base.py
@@ -399,7 +399,8 @@
                     _log.error('httpd seems broken. Cannot run http tests.')
                     return False
                 return True
-            except OSError:
+            except OSError as e:
+                _log.error('httpd launch error: ' + repr(e))
                 pass
         _log.error('No httpd found. Cannot run http tests.')
         return False
@@ -1209,6 +1210,7 @@
         cmd = [httpd_path,
                '-t',
                '-f', self.path_to_apache_config_file(),
+               '-C', 'ServerRoot "%s"' % self.apache_server_root(),
                '-C', 'HttpProtocolOptions Unsafe',
                '-C', intentional_syntax_error]
         env = self.setup_environ_for_server()
@@ -1419,6 +1421,14 @@
         """
         raise NotImplementedError('Port.path_to_apache')
 
+    def apache_server_root(self):
+        """Returns the root that the apache binary is installed to.
+
+        This is used for the ServerRoot directive.
+        """
+        executable = self.path_to_apache()
+        return self._filesystem.dirname(self._filesystem.dirname(executable))
+
     def path_to_apache_config_file(self):
         """Returns the full path to the apache configuration file.
 
diff --git a/third_party/blink/tools/blinkpy/web_tests/port/mac.py b/third_party/blink/tools/blinkpy/web_tests/port/mac.py
index 149bbca..3817fba 100644
--- a/third_party/blink/tools/blinkpy/web_tests/port/mac.py
+++ b/third_party/blink/tools/blinkpy/web_tests/port/mac.py
@@ -91,13 +91,12 @@
     #
 
     def path_to_apache(self):
-        return '/usr/sbin/httpd'
+        return self._path_from_chromium_base(
+            'third_party', 'apache-mac', 'bin', 'httpd')
 
     def path_to_apache_config_file(self):
-        config_file_basename = 'apache2-httpd-' + self._apache_version()
-        if self.host.platform.os_version in ['mac10.13', 'mac10.14']:
-            config_file_basename += '-php7'
-        return self._filesystem.join(self.apache_config_directory(), config_file_basename + '.conf')
+        config_file_basename = 'apache2-httpd-%s-php7.conf' % (self._apache_version(),)
+        return self._filesystem.join(self.apache_config_directory(), config_file_basename)
 
     def _path_to_driver(self, target=None):
         return self._build_path_with_target(target, self.driver_name() + '.app', 'Contents', 'MacOS', self.driver_name())
diff --git a/third_party/blink/tools/blinkpy/web_tests/port/mac_unittest.py b/third_party/blink/tools/blinkpy/web_tests/port/mac_unittest.py
index 7cf62d3b..670dbfe 100644
--- a/third_party/blink/tools/blinkpy/web_tests/port/mac_unittest.py
+++ b/third_party/blink/tools/blinkpy/web_tests/port/mac_unittest.py
@@ -56,13 +56,6 @@
 
     def test_path_to_apache_config_file(self):
         port = self.make_port()
-        port._apache_version = lambda: '2.2'  # pylint: disable=protected-access
-        self.assertEqual(
-            port.path_to_apache_config_file(),
-            '/mock-checkout/third_party/blink/tools/apache_config/apache2-httpd-2.2.conf')
-
-    def test_path_to_apache_config_file_on_10_13(self):
-        port = self.make_port(os_version='mac10.13', port_name='mac')
         port._apache_version = lambda: '2.4'  # pylint: disable=protected-access
         self.assertEqual(
             port.path_to_apache_config_file(),
diff --git a/third_party/blink/tools/blinkpy/web_tests/servers/apache_http.py b/third_party/blink/tools/blinkpy/web_tests/servers/apache_http.py
index eb3e93c..0a53250 100644
--- a/third_party/blink/tools/blinkpy/web_tests/servers/apache_http.py
+++ b/third_party/blink/tools/blinkpy/web_tests/servers/apache_http.py
@@ -53,7 +53,6 @@
         self._pid_file = self._filesystem.join(self._runtime_path, '%s.pid' % self._name)
 
         executable = self._port_obj.path_to_apache()
-        server_root = self._filesystem.dirname(self._filesystem.dirname(executable))
 
         test_dir = self._port_obj.web_tests_dir()
         document_root = self._filesystem.join(test_dir, 'http', 'tests')
@@ -75,7 +74,7 @@
         start_cmd = [
             executable,
             '-f', '%s' % self._port_obj.path_to_apache_config_file(),
-            '-C', 'ServerRoot "%s"' % server_root,
+            '-C', 'ServerRoot "%s"' % self._port_obj.apache_server_root(),
             '-C', 'DocumentRoot "%s"' % document_root,
             '-c', 'Alias /js-test-resources "%s/resources"' % test_dir,
             '-c', 'Alias /geolocation-api/js-test-resources "%s/geolocation-api/resources"' % test_dir,
@@ -180,6 +179,7 @@
 
         proc = self._executive.popen([self._port_obj.path_to_apache(),
                                       '-f', self._port_obj.path_to_apache_config_file(),
+                                      '-C', 'ServerRoot "%s"' % self._port_obj.apache_server_root(),
                                       '-c', 'PidFile "%s"' % self._pid_file,
                                       '-k', 'stop'])
         _, err = proc.communicate()
diff --git a/third_party/blink/web_tests/FlagExpectations/enable-blink-features=LayoutNG b/third_party/blink/web_tests/FlagExpectations/enable-blink-features=LayoutNG
index de8c811..fdf12cb9 100644
--- a/third_party/blink/web_tests/FlagExpectations/enable-blink-features=LayoutNG
+++ b/third_party/blink/web_tests/FlagExpectations/enable-blink-features=LayoutNG
@@ -88,7 +88,7 @@
 crbug.com/922437 external/wpt/css/css-text/word-break/word-break-break-all-013.html [ Skip ]
 
 # New failures are appended below by the script.
-crbug.com/591099 bluetooth/characteristic/notifications/notification-after-disconnection.html [ Pass ]
+crbug.com/591099 accessibility/spelling-markers.html [ Failure Pass ]
 crbug.com/591099 bluetooth/server/getPrimaryService/gen-reconnect-during-error.html [ Pass ]
 crbug.com/591099 compositing/animation/busy-indicator.html [ Pass ]
 crbug.com/591099 compositing/scrollbars/nested-overlay-scrollbars.html [ Failure ]
@@ -99,27 +99,8 @@
 crbug.com/591099 css3/filters/filter-repaint-composited-fallback-crash.html [ Pass ]
 crbug.com/591099 css3/filters/filter-repaint-composited-fallback.html [ Pass ]
 crbug.com/591099 editing/selection/paint-hyphen.html [ Pass ]
-crbug.com/591099 external/wpt/WebCryptoAPI/derive_bits_keys/pbkdf2.https.any.html?1001-2000 [ Pass ]
-crbug.com/591099 external/wpt/WebCryptoAPI/derive_bits_keys/pbkdf2.https.any.html?2001-3000 [ Pass ]
-crbug.com/591099 external/wpt/WebCryptoAPI/derive_bits_keys/pbkdf2.https.any.html?3001-4000 [ Pass ]
-crbug.com/591099 external/wpt/WebCryptoAPI/derive_bits_keys/pbkdf2.https.any.html?6001-7000 [ Pass ]
-crbug.com/591099 external/wpt/WebCryptoAPI/derive_bits_keys/pbkdf2.https.any.html?7001-8000 [ Pass ]
-crbug.com/591099 external/wpt/WebCryptoAPI/generateKey/successes_RSA-OAEP.https.any.worker.html?121-130 [ Pass ]
 crbug.com/591099 external/wpt/acid/acid2/reftest.html [ Failure Pass ]
-crbug.com/591099 external/wpt/bluetooth/requestDevice/request-from-iframe.https.html [ Pass ]
-crbug.com/591099 external/wpt/bluetooth/server/disconnect/detach-gc.https.html [ Pass ]
-crbug.com/591099 external/wpt/bluetooth/server/disconnect/gc-detach.https.html [ Pass ]
-crbug.com/591099 external/wpt/bluetooth/server/getPrimaryService/gen-discovery-complete-no-permission-absent-service.https.html [ Pass ]
-crbug.com/591099 external/wpt/bluetooth/server/getPrimaryService/gen-discovery-complete-service-not-found.https.html [ Pass ]
-crbug.com/591099 external/wpt/bluetooth/server/getPrimaryService/two-iframes-from-same-origin.https.html [ Pass ]
-crbug.com/591099 external/wpt/bluetooth/server/getPrimaryServices/gen-discovery-complete-no-permission-absent-service-with-uuid.https.html [ Pass ]
-crbug.com/591099 external/wpt/bluetooth/server/getPrimaryServices/gen-discovery-complete-service-not-found-with-uuid.https.html [ Pass ]
-crbug.com/591099 external/wpt/bluetooth/service/getCharacteristic/gen-reconnect-during.https.html [ Pass ]
-crbug.com/591099 external/wpt/bluetooth/service/getCharacteristics/gen-reconnect-during-with-uuid.https.html [ Pass ]
-crbug.com/591099 external/wpt/bluetooth/service/getCharacteristics/gen-reconnect-during.https.html [ Pass ]
 crbug.com/591099 external/wpt/content-security-policy/securitypolicyviolation/img-src-redirect-upgrade-reporting.https.html [ Timeout ]
-crbug.com/591099 external/wpt/content-security-policy/securitypolicyviolation/upgrade-insecure-requests-reporting.https.html [ Pass ]
-crbug.com/591099 external/wpt/cookies/http-state/domain-tests.html [ Pass ]
 crbug.com/591099 external/wpt/cookies/samesite/window-open-reload.html [ Failure ]
 crbug.com/591099 external/wpt/css/CSS2/floats/float-nowrap-3.html [ Pass ]
 crbug.com/591099 external/wpt/css/CSS2/floats/floats-line-wrap-shifted-001.html [ Pass ]
@@ -131,7 +112,10 @@
 crbug.com/591099 external/wpt/css/CSS2/normal-flow/block-in-inline-insert-002e.xht [ Pass ]
 crbug.com/591099 external/wpt/css/CSS2/normal-flow/block-in-inline-nested-002.xht [ Pass ]
 crbug.com/591099 external/wpt/css/CSS2/normal-flow/block-in-inline-remove-006.xht [ Pass ]
+crbug.com/591099 external/wpt/css/CSS2/text/white-space-003.xht [ Pass ]
 crbug.com/591099 external/wpt/css/CSS2/text/white-space-mixed-003.xht [ Pass ]
+crbug.com/591099 external/wpt/css/CSS2/text/white-space-pre-element-001.xht [ Pass ]
+crbug.com/591099 external/wpt/css/CSS2/text/white-space-processing-040.xht [ Pass ]
 crbug.com/591099 external/wpt/css/css-animations/Element-getAnimations-dynamic-changes.tentative.html [ Failure ]
 crbug.com/591099 external/wpt/css/css-animations/Element-getAnimations.tentative.html [ Pass ]
 crbug.com/591099 external/wpt/css/css-contain/contain-size-grid-002.html [ Failure ]
@@ -222,7 +206,7 @@
 crbug.com/40634 external/wpt/css/css-text/white-space/trailing-space-before-br-001.html [ Pass ]
 crbug.com/591099 external/wpt/css/css-text/word-break/word-break-break-all-004.html [ Pass ]
 crbug.com/591099 external/wpt/css/css-transforms/transform-box/view-box-mutation.html [ Failure ]
-crbug.com/591099 external/wpt/css/css-transitions/properties-value-003.html [ Pass ]
+crbug.com/591099 external/wpt/css/css-transitions/properties-value-003.html [ Failure Pass ]
 crbug.com/591099 external/wpt/css/css-ui/text-overflow-010.html [ Pass ]
 crbug.com/591099 external/wpt/css/css-ui/text-overflow-026.html [ Failure ]
 crbug.com/591099 external/wpt/css/css-values/attr-invalid-type-008.html [ Failure ]
@@ -318,9 +302,6 @@
 crbug.com/591099 external/wpt/css/css-writing-modes/sizing-orthog-prct-vrl-in-htb-001.xht [ Pass ]
 crbug.com/591099 external/wpt/css/css-writing-modes/sizing-orthog-vrl-in-htb-001.xht [ Pass ]
 crbug.com/591099 external/wpt/css/css-writing-modes/sizing-orthog-vrl-in-htb-004.xht [ Pass ]
-crbug.com/591099 external/wpt/css/css-writing-modes/text-orientation-script-001f.html [ Pass ]
-crbug.com/591099 external/wpt/css/css-writing-modes/text-orientation-script-001j.html [ Pass ]
-crbug.com/591099 external/wpt/css/css-writing-modes/text-orientation-script-001n.html [ Pass ]
 crbug.com/591099 external/wpt/css/css-writing-modes/vertical-alignment-003.xht [ Pass ]
 crbug.com/591099 external/wpt/css/css-writing-modes/vertical-alignment-009.xht [ Pass ]
 crbug.com/591099 external/wpt/css/cssom-view/elementsFromPoint-inline-vrl-ltr.html [ Pass ]
@@ -338,6 +319,8 @@
 crbug.com/591099 external/wpt/css/vendor-imports/mozilla/mozilla-central-reftests/counter-styles-3/redefine-builtin.html [ Failure ]
 crbug.com/591099 external/wpt/css/vendor-imports/mozilla/mozilla-central-reftests/flexbox/flexbox-align-self-horiz-002.xhtml [ Pass ]
 crbug.com/591099 external/wpt/css/vendor-imports/mozilla/mozilla-central-reftests/flexbox/flexbox-align-self-vert-002.xhtml [ Failure ]
+crbug.com/591099 external/wpt/css/vendor-imports/mozilla/mozilla-central-reftests/flexbox/flexbox-baseline-empty-001a.html [ Pass ]
+crbug.com/591099 external/wpt/css/vendor-imports/mozilla/mozilla-central-reftests/flexbox/flexbox-baseline-empty-001b.html [ Pass ]
 crbug.com/591099 external/wpt/css/vendor-imports/mozilla/mozilla-central-reftests/flexbox/flexbox-collapsed-item-horiz-002.html [ Failure ]
 crbug.com/591099 external/wpt/css/vendor-imports/mozilla/mozilla-central-reftests/flexbox/flexbox-justify-content-horiz-003.xhtml [ Failure ]
 crbug.com/591099 external/wpt/css/vendor-imports/mozilla/mozilla-central-reftests/flexbox/flexbox-writing-mode-011.html [ Pass ]
@@ -361,43 +344,22 @@
 crbug.com/591099 external/wpt/css/vendor-imports/mozilla/mozilla-central-reftests/shapes1/shape-outside-margin-box-border-radius-008.html [ Pass ]
 crbug.com/591099 external/wpt/css/vendor-imports/mozilla/mozilla-central-reftests/shapes1/shape-outside-padding-box-border-radius-002.html [ Pass ]
 crbug.com/591099 external/wpt/css/vendor-imports/mozilla/mozilla-central-reftests/writing-modes-3/text-combine-upright-compression-002.html [ Failure ]
-crbug.com/591099 external/wpt/dom/ranges/Range-insertNode.html [ Pass ]
-crbug.com/591099 external/wpt/encoding/legacy-mb-korean/euc-kr/euckr-decode-ksc_5601.html [ Pass ]
-crbug.com/591099 external/wpt/event-timing/event-timing-bufferbeforeonload.html [ Pass ]
-crbug.com/591099 external/wpt/feature-policy/feature-policy-for-sandbox/feature-propagation-to-auxiliary-context.html [ Pass ]
-crbug.com/591099 external/wpt/fetch/api/abort/general.any.html [ Pass ]
-crbug.com/591099 external/wpt/fetch/api/cors/cors-redirect-preflight.any.html [ Pass ]
 crbug.com/591099 external/wpt/fetch/api/redirect/redirect-count.any.html [ Pass ]
 crbug.com/591099 external/wpt/fetch/api/redirect/redirect-count.any.worker.html [ Pass ]
-crbug.com/591099 external/wpt/fetch/api/request/request-keepalive-quota.html?include=slow-1 [ Pass ]
 crbug.com/591099 external/wpt/fetch/api/request/request-keepalive-quota.html?include=slow-2 [ Pass ]
-crbug.com/591099 external/wpt/fetch/api/response/response-clone.html [ Pass ]
-crbug.com/591099 external/wpt/fetch/http-cache/cc-request.html [ Pass ]
 crbug.com/591099 external/wpt/fullscreen/api/element-ready-check-containing-iframe-manual.html [ Pass ]
 crbug.com/591099 external/wpt/fullscreen/api/element-request-fullscreen-and-remove-manual.html [ Failure Pass ]
 crbug.com/591099 external/wpt/geolocation-API/PositionOptions.https.html [ Failure ]
 crbug.com/591099 external/wpt/html/browsers/origin/cross-origin-objects/cross-origin-objects.html [ Crash ]
 crbug.com/591099 external/wpt/html/browsers/the-window-object/window-open-noopener.html?_parent [ Pass ]
 crbug.com/591099 external/wpt/html/browsers/the-window-object/window-open-noopener.html?_top [ Pass ]
-crbug.com/591099 external/wpt/html/browsers/windows/embedded-opener-remove-frame.html [ Pass ]
 crbug.com/591099 external/wpt/html/rendering/non-replaced-elements/the-hr-element-0/width.html [ Failure ]
 crbug.com/591099 external/wpt/html/rendering/non-replaced-elements/the-page/body-margin-1i.html [ Failure ]
-crbug.com/591099 external/wpt/html/semantics/embedded-content/media-elements/track/track-element/track-cues-cuechange.html [ Pass ]
-crbug.com/591099 external/wpt/html/semantics/embedded-content/the-embed-element/embed-represent-nothing-02.html [ Pass ]
 crbug.com/591099 external/wpt/html/semantics/links/links-created-by-a-and-area-elements/target_blank_implicit_noopener.tentative.html [ Pass Timeout ]
-crbug.com/591099 external/wpt/html/semantics/scripting-1/the-script-element/execution-timing/111.html [ Pass ]
 crbug.com/591099 external/wpt/html/semantics/scripting-1/the-script-element/module/dynamic-import/no-active-script-manual-module.html [ Timeout ]
 crbug.com/591099 external/wpt/html/user-activation/activation-transfer-with-click.tentative.html [ Failure ]
 crbug.com/591099 external/wpt/html/user-activation/activation-transfer-without-click.tentative.html [ Pass ]
-crbug.com/591099 external/wpt/mediacapture-fromelement/ended.html [ Pass ]
-crbug.com/591099 external/wpt/offscreen-canvas/drawing-images-to-the-canvas/2d.drawImage.9arg.destsize.worker.html [ Pass ]
-crbug.com/591099 external/wpt/offscreen-canvas/drawing-images-to-the-canvas/2d.drawImage.self.1.worker.html [ Pass ]
-crbug.com/591099 external/wpt/offscreen-canvas/drawing-images-to-the-canvas/2d.drawImage.transform.worker.html [ Pass ]
-crbug.com/591099 external/wpt/offscreen-canvas/drawing-images-to-the-canvas/2d.drawImage.zerosource.worker.html [ Pass ]
 crbug.com/591099 external/wpt/offscreen-canvas/pixel-manipulation/2d.imageData.get.nonfinite.worker.html [ Failure ]
-crbug.com/591099 external/wpt/preload/delaying-onload-link-preload-after-discovery.html [ Pass ]
-crbug.com/591099 external/wpt/preload/onload-event.html [ Pass ]
-crbug.com/591099 external/wpt/preload/single-download-preload.html [ Pass ]
 crbug.com/591099 external/wpt/presentation-api/controlling-ua/getAvailability.https.html [ Timeout ]
 crbug.com/845902 external/wpt/quirks/line-height-trailing-collapsable-whitespace.html [ Pass ]
 crbug.com/591099 external/wpt/referrer-policy/no-referrer-when-downgrade/http-rp/same-origin/http-http/shared-worker/no-redirect/insecure-protocol.http.html [ Failure ]
@@ -406,18 +368,12 @@
 crbug.com/591099 external/wpt/referrer-policy/no-referrer/meta-referrer/same-origin/http-http/shared-worker/keep-origin-redirect/generic.http.html [ Pass ]
 crbug.com/591099 external/wpt/referrer-policy/no-referrer/meta-referrer/same-origin/http-http/shared-worker/no-redirect/generic.http.html [ Pass ]
 crbug.com/591099 external/wpt/referrer-policy/same-origin/http-rp/same-origin/http-http/shared-worker/keep-origin-redirect/same-origin-insecure.http.html [ Failure ]
-crbug.com/591099 external/wpt/screen-orientation/onchange-event.html [ Timeout ]
-crbug.com/591099 external/wpt/service-workers/service-worker/fetch-frame-resource.https.html [ Pass ]
+crbug.com/591099 external/wpt/screen-orientation/onchange-event.html [ Failure Timeout ]
 crbug.com/591099 external/wpt/svg/text/reftests/text-inline-size-101.svg [ Failure ]
-crbug.com/591099 external/wpt/wasm/webapi/rejected-arg.any.serviceworker.html [ Timeout ]
+crbug.com/591099 external/wpt/wasm/webapi/rejected-arg.any.serviceworker.html [ Pass Timeout ]
 crbug.com/591099 external/wpt/webauthn/createcredential-extensions.https.html [ Pass ]
-crbug.com/591099 external/wpt/webmessaging/with-ports/018.html [ Pass ]
 crbug.com/591099 external/wpt/webmessaging/without-ports/001.html [ Failure ]
-crbug.com/591099 external/wpt/webmessaging/without-ports/018.html [ Pass ]
-crbug.com/591099 external/wpt/webrtc/RTCIceConnectionState-candidate-pair.https.html [ Pass Timeout ]
-crbug.com/591099 external/wpt/websockets/constructor/013.html [ Pass ]
-crbug.com/591099 external/wpt/websockets/constructor/013.html?wss [ Pass ]
-crbug.com/591099 external/wpt/websockets/interfaces/WebSocket/send/010.html [ Pass ]
+crbug.com/591099 external/wpt/webrtc/RTCIceConnectionState-candidate-pair.https.html [ Pass ]
 crbug.com/591099 external/wpt/webvtt/rendering/cues-with-video/processing-model/2_cues_overlapping_partially_move_up.html [ Failure ]
 crbug.com/591099 external/wpt/webvtt/rendering/cues-with-video/processing-model/bidi/u002E_u2028_u05D0.html [ Failure ]
 crbug.com/591099 external/wpt/webvtt/rendering/cues-with-video/processing-model/bidi/u06E9_no_strong_dir.html [ Failure ]
@@ -439,16 +395,15 @@
 crbug.com/591099 external/wpt/webvtt/rendering/cues-with-video/processing-model/selectors/cue_function/voice_object/voice_transition_with_timestamp.html [ Failure ]
 crbug.com/591099 external/wpt/webvtt/rendering/cues-with-video/processing-model/selectors/cue_function/voice_object/voice_voice_attribute.html [ Failure ]
 crbug.com/591099 external/wpt/webvtt/rendering/cues-with-video/processing-model/selectors/cue_function/white-space_pre.html [ Failure ]
-crbug.com/591099 external/wpt/xhr/event-progress.htm [ Pass ]
 crbug.com/591099 external/wpt/xhr/setrequestheader-header-allowed.htm [ Failure ]
 crbug.com/591099 fast/backgrounds/quirks-mode-line-box-backgrounds.html [ Failure ]
 crbug.com/591099 fast/block/float/4145535Crash.html [ Pass ]
 crbug.com/591099 fast/borders/inline-mask-overlay-image-outset-vertical-rl.html [ Failure ]
-crbug.com/591099 fast/canvas/OffscreenCanvas-copyImage.html [ Pass ]
-crbug.com/591099 fast/css-grid-layout/grid-baseline.html [ Failure ]
+crbug.com/591099 fast/canvas/OffscreenCanvas-copyImage.html [ Failure Pass ]
+crbug.com/591099 fast/css-grid-layout/grid-baseline.html [ Failure Pass ]
 crbug.com/591099 fast/css-intrinsic-dimensions/height-css-tables-collapsed.html [ Failure Pass ]
 crbug.com/591099 fast/css-intrinsic-dimensions/height-positioned.html [ Pass ]
-crbug.com/591099 fast/css-intrinsic-dimensions/height-tables.html [ Pass ]
+crbug.com/591099 fast/css-intrinsic-dimensions/height-tables.html [ Failure Pass ]
 crbug.com/591099 fast/css/absolute-inline-alignment-2.html [ Pass ]
 crbug.com/835484 fast/css/outline-narrowLine.html [ Failure ]
 crbug.com/855279 fast/css/text-overflow-ellipsis-vertical-hittest.html [ Pass ]
@@ -456,7 +411,7 @@
 crbug.com/591099 fast/dom/SelectorAPI/resig-SelectorsAPI-test.xhtml [ Pass ]
 crbug.com/591099 fast/dom/shadow/focus-controller-recursion-crash.html [ Pass ]
 crbug.com/591099 fast/dom/shadow/svg-style-in-shadow-tree-crash.html [ Pass ]
-crbug.com/591099 fast/events/before-unload-return-value-from-listener.html [ Pass ]
+crbug.com/591099 fast/events/before-unload-return-value-from-listener.html [ Pass Timeout ]
 crbug.com/591099 fast/events/touch/compositor-touch-hit-rects-continuation.html [ Failure ]
 crbug.com/591099 fast/events/touch/compositor-touch-hit-rects-list-translate.html [ Failure ]
 crbug.com/591099 fast/events/touch/compositor-touch-hit-rects.html [ Failure ]
@@ -464,7 +419,7 @@
 crbug.com/889721 fast/inline/outline-continuations.html [ Failure ]
 crbug.com/591099 fast/multicol/border-radius-clipped-layer.html [ Pass ]
 crbug.com/591099 fast/peerconnection/RTCPeerConnection-many.html [ Pass ]
-crbug.com/591099 fast/replaced/replaced-breaking.html [ Failure ]
+crbug.com/591099 fast/replaced/replaced-breaking.html [ Failure Pass ]
 crbug.com/899902 fast/text/ellipsis-with-self-painting-layer.html [ Pass ]
 crbug.com/591099 fast/text/emoji-vertical-origin-visual.html [ Failure ]
 crbug.com/591099 fast/text/font-format-support-color-cff2-vertical.html [ Failure ]
@@ -481,7 +436,7 @@
 crbug.com/591099 http/tests/devtools/elements/shadow/shadow-distribution.js [ Failure ]
 crbug.com/591099 http/tests/devtools/elements/styles-1/edit-value-url-with-color.js [ Pass ]
 crbug.com/591099 http/tests/devtools/elements/user-properties.js [ Pass ]
-crbug.com/591099 http/tests/devtools/service-workers/service-worker-v8-cache.js [ Pass Timeout ]
+crbug.com/591099 http/tests/devtools/service-workers/service-worker-v8-cache.js [ Timeout ]
 crbug.com/591099 http/tests/devtools/sources/debugger-frameworks/frameworks-jquery.js [ Crash Pass ]
 crbug.com/591099 http/tests/devtools/sources/debugger/debugger-proto-property.js [ Pass ]
 crbug.com/591099 http/tests/devtools/tracing-session-id.js [ Pass ]
@@ -497,9 +452,8 @@
 crbug.com/591099 http/tests/fetch/workers/thorough/cookie-nocors-base-https-other-https.html [ Pass ]
 crbug.com/591099 http/tests/html/validation-bubble-oopif-clip.html [ Pass ]
 crbug.com/591099 http/tests/images/feature-policy-unoptimized-images-cached-image.html [ Failure Pass ]
-crbug.com/591099 http/tests/images/image-decode-in-frame.html [ Pass ]
 crbug.com/591099 http/tests/inspector-protocol/network/navigation-blocking-xorigin-iframe.js [ Failure Pass ]
-crbug.com/591099 http/tests/media/autoplay/document-user-activation-cross-origin-feature-policy-disabled.html [ Failure ]
+crbug.com/591099 http/tests/media/autoplay/document-user-activation-cross-origin-feature-policy-disabled.html [ Failure Pass ]
 crbug.com/591099 http/tests/media/video-load-metadata-decode-error.html [ Pass ]
 crbug.com/591099 http/tests/multipart/multipart-main-resource.html [ Pass ]
 crbug.com/591099 http/tests/security/isolatedWorld/media-query-wrapper-leaks.html [ Failure ]
@@ -570,19 +524,13 @@
 crbug.com/591099 virtual/mouseevent_fractional/fast/events/touch/compositor-touch-hit-rects-list-translate.html [ Failure ]
 crbug.com/591099 virtual/mouseevent_fractional/fast/events/touch/compositor-touch-hit-rects.html [ Failure ]
 crbug.com/591099 virtual/new-remote-playback-pipeline/ [ Skip ]
-crbug.com/591099 virtual/omt-worker-fetch/external/wpt/referrer-policy/no-referrer/http-rp/same-origin/http-http/shared-worker/keep-origin-redirect/generic.http.html [ Pass ]
-crbug.com/591099 virtual/omt-worker-fetch/external/wpt/referrer-policy/no-referrer/http-rp/same-origin/http-http/shared-worker/no-redirect/generic.http.html [ Pass ]
-crbug.com/591099 virtual/omt-worker-fetch/external/wpt/referrer-policy/no-referrer/meta-referrer/same-origin/http-http/shared-worker/keep-origin-redirect/generic.http.html [ Pass ]
-crbug.com/591099 virtual/omt-worker-fetch/external/wpt/referrer-policy/no-referrer/meta-referrer/same-origin/http-http/shared-worker/no-redirect/generic.http.html [ Pass ]
 crbug.com/591099 virtual/omt-worker-fetch/external/wpt/referrer-policy/origin/http-rp/same-origin/http-http/shared-worker/keep-origin-redirect/generic.http.html [ Failure ]
 crbug.com/591099 virtual/omt-worker-fetch/external/wpt/referrer-policy/origin/http-rp/same-origin/http-http/shared-worker/no-redirect/generic.http.html [ Failure ]
 crbug.com/591099 virtual/omt-worker-fetch/external/wpt/referrer-policy/origin/meta-referrer/same-origin/http-http/shared-worker/no-redirect/generic.http.html [ Failure ]
 crbug.com/591099 virtual/omt-worker-fetch/external/wpt/referrer-policy/strict-origin-when-cross-origin/http-rp/same-origin/http-http/shared-worker/keep-origin-redirect/same-insecure.http.html [ Failure ]
 crbug.com/591099 virtual/omt-worker-fetch/external/wpt/resource-timing/nested-context-navigations.html [ Failure Pass ]
 crbug.com/591099 virtual/omt-worker-fetch/external/wpt/workers/semantics/multiple-workers/003.html [ Timeout ]
-crbug.com/591099 virtual/omt-worker-fetch/external/wpt/xhr/send-redirect-bogus-sync.htm [ Pass ]
 crbug.com/591099 virtual/outofblink-cors/ [ Skip ]
-crbug.com/591099 virtual/paint-timing/external/wpt/paint-timing/idlharness.window.html [ Pass ]
 crbug.com/591099 virtual/paint-timing/external/wpt/paint-timing/sibling-painting-first-image.html [ Failure ]
 crbug.com/591099 virtual/prefer_compositing_to_lcd_text/ [ Skip ]
 crbug.com/591099 virtual/scroll_customization/ [ Skip ]
@@ -593,7 +541,6 @@
 crbug.com/591099 virtual/streaming-preload/http/tests/fetch/serviceworker/thorough/cors-base-https-other-https.html [ Pass ]
 crbug.com/591099 virtual/streaming-preload/http/tests/fetch/workers/thorough/cors-preflight-base-https-other-https.html [ Pass ]
 crbug.com/591099 virtual/threaded/ [ Skip ]
-crbug.com/591099 virtual/unified-autoplay/external/wpt/feature-policy/feature-policy-for-sandbox/feature-propagation-to-auxiliary-context.html [ Pass ]
 crbug.com/591099 virtual/user-activation-v2/fast/events/touch/compositor-touch-hit-rects-continuation.html [ Failure ]
 crbug.com/591099 virtual/user-activation-v2/fast/events/touch/compositor-touch-hit-rects-list-translate.html [ Failure ]
 crbug.com/591099 virtual/user-activation-v2/fast/events/touch/compositor-touch-hit-rects.html [ Failure ]
@@ -604,7 +551,6 @@
 crbug.com/591099 virtual/video-surface-layer/media/media-ended.html [ Pass ]
 crbug.com/591099 virtual/video-surface-layer/media/video-canvas-draw.html [ Failure ]
 crbug.com/591099 virtual/video-surface-layer/media/video-controls-hide-on-move-outside-controls.html [ Pass ]
-crbug.com/591099 virtual/video-surface-layer/media/video-played-ranges-1.html [ Pass ]
 crbug.com/591099 virtual/webrtc-wpt-plan-b/external/wpt/webrtc/RTCIceTransport-extension.https.html [ Failure Pass ]
 crbug.com/591099 vr/getFrameData_oneframeupdate.html [ Pass ]
 crbug.com/591099 webexposed/global-interface-listing-shared-worker.html [ Pass ]
diff --git a/third_party/blink/web_tests/TestExpectations b/third_party/blink/web_tests/TestExpectations
index 830d46c2..e3b906f 100644
--- a/third_party/blink/web_tests/TestExpectations
+++ b/third_party/blink/web_tests/TestExpectations
@@ -3022,8 +3022,8 @@
 crbug.com/626703 [ Mac10.10 ] external/wpt/content-security-policy/frame-ancestors/frame-ancestors-nested-cross-in-same-star-allow.html [ Timeout ]
 crbug.com/626703 [ Mac10.11 ] external/wpt/content-security-policy/frame-ancestors/frame-ancestors-nested-cross-in-same-star-allow.html [ Timeout ]
 crbug.com/626703 [ Retina ] external/wpt/content-security-policy/frame-ancestors/frame-ancestors-nested-cross-in-same-star-allow.html [ Timeout ]
-crbug.com/626703 external/wpt/media-source/mediasource-correct-frames-after-reappend.html [ Timeout ]
-crbug.com/626703 external/wpt/media-source/mediasource-correct-frames.html [ Timeout ]
+crbug.com/626703 external/wpt/media-source/mediasource-correct-frames-after-reappend.html [ Pass Timeout ]
+crbug.com/626703 external/wpt/media-source/mediasource-correct-frames.html [ Pass Timeout ]
 crbug.com/626703 external/wpt/payment-method-basic-card/steps_for_selecting_the_payment_handler.html [ Timeout ]
 crbug.com/626703 external/wpt/payment-method-basic-card/apply_the_modifiers.html [ Timeout ]
 crbug.com/626703 external/wpt/html/rendering/non-replaced-elements/tables/table-border-3s.html [ Failure ]
@@ -6126,3 +6126,6 @@
 crbug.com/945629 virtual/binary-for-devtools/http/tests/devtools/network/network-filters.js [ Pass Failure Timeout ]
 
 crbug.com/945470 [ Mac ] fast/forms/validation-bubble-appearance-escape.html [ Pass Failure ]
+
+# Failing on: https://ci.chromium.org/buildbot/chromium.mac/Mac10.13%20Tests/11291
+crbug.com/945832 http/tests/devtools/tracing/timeline-js/timeline-js-line-level-profile-end-to-end.js [ Pass Failure Timeout Crash ]
diff --git a/third_party/blink/web_tests/external/WPT_BASE_MANIFEST_5.json b/third_party/blink/web_tests/external/WPT_BASE_MANIFEST_5.json
index c0eaf2a..e49b95f6 100644
--- a/third_party/blink/web_tests/external/WPT_BASE_MANIFEST_5.json
+++ b/third_party/blink/web_tests/external/WPT_BASE_MANIFEST_5.json
@@ -109055,6 +109055,18 @@
      {}
     ]
    ],
+   "lifecycle/set-composited-layer-position.html": [
+    [
+     "/lifecycle/set-composited-layer-position.html",
+     [
+      [
+       "/lifecycle/set-composited-layer-position-ref.html",
+       "=="
+      ]
+     ],
+     {}
+    ]
+   ],
    "mathml/presentation-markup/fractions/frac-bar-001.html": [
     [
      "/mathml/presentation-markup/fractions/frac-bar-001.html",
@@ -115219,6 +115231,11 @@
    ]
   },
   "support": {
+   ".github/main.workflow": [
+    [
+     {}
+    ]
+   ],
    ".gitignore": [
     [
      {}
@@ -173599,6 +173616,26 @@
      {}
     ]
    ],
+   "html/semantics/forms/form-submission-target/rel-base-target-expected.txt": [
+    [
+     {}
+    ]
+   ],
+   "html/semantics/forms/form-submission-target/rel-button-target-expected.txt": [
+    [
+     {}
+    ]
+   ],
+   "html/semantics/forms/form-submission-target/rel-form-target-expected.txt": [
+    [
+     {}
+    ]
+   ],
+   "html/semantics/forms/form-submission-target/rel-input-target-expected.txt": [
+    [
+     {}
+    ]
+   ],
    "html/semantics/forms/form-submission-target/resources/endpoint.html": [
     [
      {}
@@ -177774,6 +177811,11 @@
      {}
     ]
    ],
+   "lifecycle/set-composited-layer-position-ref.html": [
+    [
+     {}
+    ]
+   ],
    "lint.whitelist": [
     [
      {}
@@ -190369,6 +190411,11 @@
      {}
     ]
    ],
+   "tools/ci/action_manifest_build.sh": [
+    [
+     {}
+    ]
+   ],
    "tools/ci/azure/README.md": [
     [
      {}
@@ -190549,6 +190596,11 @@
      {}
     ]
    ],
+   "tools/docker/github/Dockerfile": [
+    [
+     {}
+    ]
+   ],
    "tools/docker/retry.py": [
     [
      {}
@@ -209068,11 +209120,15 @@
    "FileAPI/url/url-format.any.js": [
     [
      "/FileAPI/url/url-format.any.html",
-     {}
+     {
+      "timeout": "long"
+     }
     ],
     [
      "/FileAPI/url/url-format.any.worker.html",
-     {}
+     {
+      "timeout": "long"
+     }
     ]
    ],
    "FileAPI/url/url-in-tags-revoke.window.js": [
@@ -313072,6 +313128,10 @@
   }
  },
  "paths": {
+  ".github/main.workflow": [
+   "b1b61554f91aa0256fbd4a58e0cbbe16ecdb1c6e",
+   "support"
+  ],
   ".gitignore": [
    "23df18a95551f2c6e1fbc2417b9be1b84e0b1b14",
    "support"
@@ -317761,7 +317821,7 @@
    "testharness"
   ],
   "FileAPI/url/url-format.any.js": [
-   "d485bfaac61a3b995a22a61521268590610da3e7",
+   "33732fa61fc3ddd0f52b23fe83ea824cc6abae06",
    "testharness"
   ],
   "FileAPI/url/url-in-tags-revoke.window.js": [
@@ -408097,7 +408157,7 @@
    "support"
   ],
   "editing/data/outdent.js": [
-   "271824bee51e951a19d24cf83762423b2c4e11aa",
+   "ad613122ef395faaaa76fbc650a31061783fe193",
    "support"
   ],
   "editing/data/removeformat.js": [
@@ -408645,11 +408705,11 @@
    "support"
   ],
   "editing/run/outdent_1001-2000-expected.txt": [
-   "721444291b4db61a8caaf3e9682ab22a09969c0d",
+   "e9cce26d26d3cb3796054105cda03d5a1f0b4a0e",
    "support"
   ],
   "editing/run/outdent_2001-last-expected.txt": [
-   "60be4cce703645c88b1ec20a263b0c7cc936619f",
+   "bc71d649ed58c1e1bd5dfeb0a46ff6ff871d985c",
    "support"
   ],
   "editing/run/removeformat-expected.txt": [
@@ -428476,18 +428536,34 @@
    "f37bc33f6f93ca94940ffeb0066945eb9aa020ee",
    "testharness"
   ],
+  "html/semantics/forms/form-submission-target/rel-base-target-expected.txt": [
+   "6d848622efe8cf1ac7a49ac1f458517e51147db8",
+   "support"
+  ],
   "html/semantics/forms/form-submission-target/rel-base-target.html": [
    "222be95d2e8a9da39525fbf6d8048e6cdfd7a982",
    "testharness"
   ],
+  "html/semantics/forms/form-submission-target/rel-button-target-expected.txt": [
+   "c2ff926d578885e946f148903c330ac2a878e380",
+   "support"
+  ],
   "html/semantics/forms/form-submission-target/rel-button-target.html": [
    "76fa8685905ad233f9312be3f6bf09503158a666",
    "testharness"
   ],
+  "html/semantics/forms/form-submission-target/rel-form-target-expected.txt": [
+   "88e33b90d9131401e3e53638d311198e3ff3ae2c",
+   "support"
+  ],
   "html/semantics/forms/form-submission-target/rel-form-target.html": [
    "58611f41a9fdaea1611513e02dad87e017728f9a",
    "testharness"
   ],
+  "html/semantics/forms/form-submission-target/rel-input-target-expected.txt": [
+   "b67908139dc6327eabc12a1a5da4b6f4c61de6eb",
+   "support"
+  ],
   "html/semantics/forms/form-submission-target/rel-input-target.html": [
    "b80e0240bae3802b04118249ec2b94e16a91e9e6",
    "testharness"
@@ -436600,6 +436676,14 @@
    "69fdbc0986633793d501a4bddfee9e88f76e1348",
    "support"
   ],
+  "lifecycle/set-composited-layer-position-ref.html": [
+   "217edfaf5d928109b09ccd8ed162cc13e704e6dd",
+   "support"
+  ],
+  "lifecycle/set-composited-layer-position.html": [
+   "543677a5006a63affc0141466794c7853b7981fa",
+   "reftest"
+  ],
   "lint.whitelist": [
    "96fd7ed0c2939411333b4b204687e68f61001fc8",
    "support"
@@ -468376,6 +468460,10 @@
    "e69de29bb2d1d6434b8b29ae775ad8c2e48c5391",
    "support"
   ],
+  "tools/ci/action_manifest_build.sh": [
+   "f3bacc7b7a129d1ed594605d56db920ef83d6b49",
+   "support"
+  ],
   "tools/ci/azure/README.md": [
    "afe5021efcad78a13d1767fb423d846557b92ee0",
    "support"
@@ -468501,7 +468589,7 @@
    "support"
   ],
   "tools/ci/tag_master.py": [
-   "0ae2801dfe70b2e3409800f210410a107ea53d81",
+   "622d7f4ca06acc12d4da675408e8b784182912b7",
    "support"
   ],
   "tools/ci/taskcluster-run.py": [
@@ -468520,6 +468608,10 @@
    "e60b4ea6a3a1c909c715fb7248a6f1b0cc6e9d4e",
    "support"
   ],
+  "tools/docker/github/Dockerfile": [
+   "5a6dc866cd60053c464631d0813c187bc6453916",
+   "support"
+  ],
   "tools/docker/retry.py": [
    "6126b781bfadd15e82b8a3a3b9494050939eab6c",
    "support"
diff --git a/third_party/blink/web_tests/external/wpt/.github/main.workflow b/third_party/blink/web_tests/external/wpt/.github/main.workflow
new file mode 100644
index 0000000..b1b61554
--- /dev/null
+++ b/third_party/blink/web_tests/external/wpt/.github/main.workflow
@@ -0,0 +1,16 @@
+workflow "Build & Release Manifest" {
+  on = "push"
+  resolves = ["tag-master"]
+}
+
+action "build-manifest" {
+  uses = "./tools/docker/github"
+  runs = ["bash", "-c", "tools/ci/action_manifest_build.sh"]
+}
+
+action "tag-master" {
+  needs = "build-manifest"
+  uses = "./tools/docker/github"
+  runs = ["python", "tools/ci/tag_master.py"]
+  secrets = ["GITHUB_TOKEN"]
+}
diff --git a/third_party/blink/web_tests/external/wpt/css/css-sizing/fit-content-percentage-padding.html b/third_party/blink/web_tests/external/wpt/css/css-sizing/fit-content-percentage-padding.html
new file mode 100644
index 0000000..4ff3f78
--- /dev/null
+++ b/third_party/blink/web_tests/external/wpt/css/css-sizing/fit-content-percentage-padding.html
@@ -0,0 +1,30 @@
+<!DOCTYPE html>
+<link rel="author" title="Morten Stenshorne" href="mailto:mstensho@chromium.org">
+<link rel="help" href="https://www.w3.org/TR/CSS22/box.html#propdef-padding-left">
+<link rel="help" href="https://www.w3.org/TR/css-sizing-3/#valdef-width-fit-content-length-percentage">
+<meta name="assert" content="The shrink-to-fit container (#stf) should be just wide enough to fit both floats beside each other. The percentage padding shouldn't be affected by intrinsic sizing; it's simply resolved from its containing block (#container), which doesn't participate in the intrinsic size calculation at all.">
+<div id="container" style="width:400px; height:200px;">
+  <div id="stf" style="width:fit-content; padding-left:20%;">
+    <div style="float:left; width:50px; height:100px; background:cyan;"></div>
+    <div style="float:left; width:50px; height:100px; background:hotpink;"></div>
+  </div>
+</div>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+  var container = document.getElementById("container");
+  var stf = document.getElementById("stf");
+  test(()=> {
+      assert_equals(stf.offsetWidth, 180);
+  }, "Initial layout");
+
+  test(()=> {
+      container.style.width = "300px";
+      assert_equals(stf.offsetWidth, 160);
+  }, "Shrink width");
+
+  test(()=> {
+      container.style.width = "500px";
+      assert_equals(stf.offsetWidth, 200);
+  }, "Grow width");
+</script>
diff --git a/third_party/blink/web_tests/external/wpt/event-timing/event-timing-onloadthenobserve.html b/third_party/blink/web_tests/external/wpt/event-timing/event-timing-onloadthenobserve.html
index e83c290..6556324 100644
--- a/third_party/blink/web_tests/external/wpt/event-timing/event-timing-onloadthenobserve.html
+++ b/third_party/blink/web_tests/external/wpt/event-timing/event-timing-onloadthenobserve.html
@@ -66,8 +66,10 @@
     // Use a dummy observer to know when the first click has been dispatched.
     const observerPromise = new Promise((resolve, reject) => {
       new PerformanceObserver((entryList, observer) => {
-        resolve();
-        observer.disconnect();
+        if (entryList.getEntries().find(entry => entry.name === 'click')) {
+          resolve();
+          observer.disconnect();
+        }
       }).observe({ entryTypes: ['event'] });
     });
     on_event(window, 'load', () => {
diff --git a/third_party/blink/web_tests/external/wpt/fetch/sec-metadata/trailing-dot.tentative.https.sub.html b/third_party/blink/web_tests/external/wpt/fetch/sec-metadata/trailing-dot.tentative.https.sub.html
new file mode 100644
index 0000000..85f9c73
--- /dev/null
+++ b/third_party/blink/web_tests/external/wpt/fetch/sec-metadata/trailing-dot.tentative.https.sub.html
@@ -0,0 +1,45 @@
+<!DOCTYPE html>
+<script src=/resources/testharness.js></script>
+<script src=/resources/testharnessreport.js></script>
+<script src=/fetch/sec-metadata/resources/helper.js></script>
+<script>
+  // Site
+  promise_test(t => {
+    return fetch("https://{{host}}.:{{ports[https][0]}}/fetch/sec-metadata/resources/echo-as-json.py")
+        .then(r => r.json())
+        .then(j => {
+          assert_header_equals(j, {
+            "dest": "empty",
+            "site": "cross-site",
+            "user": "?F",
+            "mode": "cors",
+          });
+        });
+  }, "Fetching a resource from the same origin, but spelled with a trailing dot.");
+
+  promise_test(t => {
+    return fetch("https://{{hosts[][www]}}.:{{ports[https][0]}}/fetch/sec-metadata/resources/echo-as-json.py")
+        .then(r => r.json())
+        .then(j => {
+          assert_header_equals(j, {
+            "dest": "empty",
+            "site": "cross-site",
+            "user": "?F",
+            "mode": "cors",
+          });
+        });
+  }, "Fetching a resource from the same site, but spelled with a trailing dot.");
+
+  promise_test(t => {
+    return fetch("https://{{hosts[alt][www]}}.:{{ports[https][0]}}/fetch/sec-metadata/resources/echo-as-json.py")
+        .then(r => r.json())
+        .then(j => {
+          assert_header_equals(j, {
+            "dest": "empty",
+            "site": "cross-site",
+            "user": "?F",
+            "mode": "cors",
+          });
+        });
+  }, "Fetching a resource from a cross-site host, spelled with a trailing dot.");
+</script>
diff --git a/third_party/blink/web_tests/external/wpt/svg/embedded/image-embedding-svg-viewref-with-viewbox.svg b/third_party/blink/web_tests/external/wpt/svg/embedded/image-embedding-svg-viewref-with-viewbox.svg
new file mode 100644
index 0000000..6340c19d2
--- /dev/null
+++ b/third_party/blink/web_tests/external/wpt/svg/embedded/image-embedding-svg-viewref-with-viewbox.svg
@@ -0,0 +1,14 @@
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"
+     xmlns:h="http://www.w3.org/1999/xhtml">
+  <title>&#x3c;image&#x3e; referencing SVG image with &#x3c;view&#x3e; with 'viewBox'</title>
+  <h:link rel="help" href="https://svgwg.org/svg2-draft/embedded.html#ImageElement"/>
+  <h:link rel="help" href="https://svgwg.org/svg2-draft/linking.html#LinksIntoSVG"/>
+  <h:link rel="match" href="reference/green-rect-100x100.svg"/>
+  <rect x="-355" y="-1110" width="455" height="1210" fill="red"/>
+  <image preserveAspectRatio="none" x="-355" y="-1110" width="455" height="1210"
+         xlink:href="data:image/svg+xml,
+                       %3csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 2317 2320'%3e
+                         %3cview id='view' preserveAspectRatio='none' viewBox='0 0 455 1210'/%3e
+                         %3crect width='455' height='1210' fill='green'/%3e
+                       %3c/svg%3e#view"/>
+</svg>
diff --git a/third_party/blink/web_tests/external/wpt/tools/ci/action_manifest_build.sh b/third_party/blink/web_tests/external/wpt/tools/ci/action_manifest_build.sh
new file mode 100755
index 0000000..f3bacc7
--- /dev/null
+++ b/third_party/blink/web_tests/external/wpt/tools/ci/action_manifest_build.sh
@@ -0,0 +1,9 @@
+#!/bin/bash
+set -ex
+
+mkdir -p ~/meta
+
+WPT_MANIFEST_FILE=~/meta/MANIFEST.json
+
+./wpt manifest -p $WPT_MANIFEST_FILE
+gzip -f --best $WPT_MANIFEST_FILE
diff --git a/third_party/blink/web_tests/external/wpt/tools/ci/tag_master.py b/third_party/blink/web_tests/external/wpt/tools/ci/tag_master.py
index 0ae2801..622d7f4 100644
--- a/third_party/blink/web_tests/external/wpt/tools/ci/tag_master.py
+++ b/third_party/blink/web_tests/external/wpt/tools/ci/tag_master.py
@@ -1,9 +1,9 @@
-import base64
 import json
 import logging
 import os
 import sys
-import urllib2
+
+import requests
 
 here = os.path.abspath(os.path.dirname(__file__))
 wpt_root = os.path.abspath(os.path.join(here, os.pardir, os.pardir))
@@ -17,26 +17,54 @@
 logger = logging.getLogger(__name__)
 
 
-def get_pr(owner, repo, sha):
-    url = ("https://api.github.com/search/issues?q=type:pr+is:merged+repo:%s/%s+sha:%s" %
-           (owner, repo, sha))
+def request(url, desc, data=None, json_data=None, params=None, headers=None):
+    github_token = os.environ.get("GITHUB_TOKEN")
+    default_headers = {
+        "Authorization": "token %s" % github_token,
+        "Accept": "application/vnd.github.machine-man-preview+json"
+    }
+
+    _headers = default_headers
+    if headers is not None:
+        _headers.update(headers)
+
+    kwargs = {"params": params,
+              "headers": _headers}
     try:
-        resp = urllib2.urlopen(url)
-        body = resp.read()
+        logger.info("Loading URL %s" % url)
+        if json_data is not None or data is not None:
+            method = requests.post
+            kwargs["json"] = json_data
+            kwargs["data"] = data
+        else:
+            method = requests.get
+
+        resp = method(url, **kwargs)
+
     except Exception as e:
-        logger.error(e)
-        return None
-
-    if resp.code != 200:
-        logger.error("Got HTTP status %s. Response:" % resp.code)
-        logger.error(body)
+        logger.error("%s failed:\n%s" % (desc, e))
         return None
 
     try:
-        data = json.loads(body)
+        resp.raise_for_status()
+    except requests.HTTPError:
+        logger.error("%s failed: Got HTTP status %s. Response:" %
+                     (desc, resp.status_code))
+        logger.error(resp.text)
+        return None
+
+    try:
+        return resp.json()
     except ValueError:
-        logger.error("Failed to read response as JSON:")
-        logger.error(body)
+        logger.error("%s failed: Returned data was not JSON Response:" %
+                     (desc, resp.status_code))
+        logger.error(resp.text)
+
+
+def get_pr(owner, repo, sha):
+    data = request("https://api.github.com/search/issues?q=type:pr+is:merged+repo:%s/%s+sha:%s" %
+                   (owner, repo, sha), "Getting PR")
+    if data is None:
         return None
 
     items = data["items"]
@@ -52,50 +80,95 @@
 
 
 def tag(owner, repo, sha, tag):
-    data = json.dumps({"ref": "refs/tags/%s" % tag,
-                       "sha": sha})
-    try:
-        url = "https://api.github.com/repos/%s/%s/git/refs" % (owner, repo)
-        req = urllib2.Request(url, data=data)
+    data = {"ref": "refs/tags/%s" % tag,
+            "sha": sha}
+    url = "https://api.github.com/repos/%s/%s/git/refs" % (owner, repo)
 
-        base64string = base64.b64encode(os.environ["GH_TOKEN"])
-        req.add_header("Authorization", "Basic %s" % base64string)
-
-        opener = urllib2.build_opener(urllib2.HTTPSHandler())
-
-        resp = opener.open(req)
-    except Exception as e:
-        logger.error("Tag creation failed:\n%s" % e)
-        return False
-
-    if resp.code != 201:
-        logger.error("Got HTTP status %s. Response:" % resp.code)
-        logger.error(resp.read())
+    resp_data = request(url, "Tag creation", json_data=data)
+    if not resp_data:
         return False
 
     logger.info("Tagged %s as %s" % (sha, tag))
     return True
 
 
-def main():
-    owner, repo = os.environ["TRAVIS_REPO_SLUG"].split("/", 1)
-    if os.environ["TRAVIS_PULL_REQUEST"] != "false":
+def create_release(owner, repo, sha, tag, summary, body):
+    if body:
+        body = "%s\n%s" % (summary, body)
+    else:
+        body = summary
+
+    create_url = "https://api.github.com/repos/%s/%s/releases" % (owner, repo)
+    create_data = {"tag_name": tag,
+                   "name": tag,
+                   "body": body}
+    create_data = request(create_url, "Release creation", json_data=create_data)
+    if not create_data:
+        return False
+
+    # Upload URL contains '{?name,label}' at the end which we want to remove
+    upload_url = create_data["upload_url"].split("{", 1)[0]
+
+    upload_filename = "MANIFEST-%s.json.gz" % sha
+    params = {"name": upload_filename,
+              "label": "MANIFEST.json.gz"}
+
+    with open(os.path.expanduser("~/meta/MANIFEST.json.gz"), "rb") as f:
+        upload_data = f.read()
+
+    logger.info("Uploading %s bytes" % len(upload_data))
+
+    upload_resp = request(upload_url, "Manifest upload", data=upload_data, params=params,
+                          headers={'Content-Type': 'application/octet-stream'})
+    if not upload_resp:
+        return False
+
+    return True
+
+
+def should_run_action():
+    with open(os.environ["GITHUB_EVENT_PATH"]) as f:
+        event = json.load(f)
+
+    if "pull_request" in event:
         logger.info("Not tagging for PR")
-        return
-    if os.environ["TRAVIS_BRANCH"] != "master":
+        return False
+    if event.get("ref") != "refs/heads/master":
         logger.info("Not tagging for non-master branch")
+        return False
+    return True
+
+
+def main():
+    repo_key = "GITHUB_REPOSITORY"
+    should_run = should_run_action()
+
+    if not should_run:
+        logger.info("Not tagging master for this push")
         return
 
+    owner, repo = os.environ[repo_key].split("/", 1)
+
     git = get_git_cmd(wpt_root)
     head_rev = git("rev-parse", "HEAD")
 
     pr = get_pr(owner, repo, head_rev)
     if pr is None:
-        sys.exit(1)
-    tagged = tag(owner, repo, head_rev, "merge_pr_%s" % pr)
+        # This should only really happen during testing
+        tag_name = "merge_commit_%s" % head_rev
+    else:
+        tag_name = "merge_pr_%s" % pr
+
+    tagged = tag(owner, repo, head_rev, tag_name)
     if not tagged:
         sys.exit(1)
 
+    summary = git("show", "--no-patch", '--format="%s"', "HEAD")
+    body = git("show", "--no-patch", '--format="%b"', "HEAD")
+
+    if not create_release(owner, repo, head_rev, tag_name, summary, body):
+        sys.exit(1)
+
 
 if __name__ == "__main__":
     main()
diff --git a/third_party/blink/web_tests/external/wpt/tools/docker/github/Dockerfile b/third_party/blink/web_tests/external/wpt/tools/docker/github/Dockerfile
new file mode 100644
index 0000000..5a6dc866c
--- /dev/null
+++ b/third_party/blink/web_tests/external/wpt/tools/docker/github/Dockerfile
@@ -0,0 +1,27 @@
+FROM ubuntu:18.04
+
+# No interactive frontend during docker build
+ENV DEBIAN_FRONTEND=noninteractive \
+    DEBCONF_NONINTERACTIVE_SEEN=true
+
+RUN apt-get -qqy update \
+  && apt-get -qqy install \
+    git \
+    locales \
+    python \
+    python-pip \
+    tzdata
+
+RUN pip install --upgrade pip
+RUN pip install virtualenv
+RUN pip install requests
+
+ENV TZ "UTC"
+RUN echo "${TZ}" > /etc/timezone \
+  && dpkg-reconfigure --frontend noninteractive tzdata
+
+# Set the locale
+RUN locale-gen en_US.UTF-8
+ENV LANG en_US.UTF-8
+ENV LANGUAGE en_US:en
+ENV LC_ALL en_US.UTF-8
diff --git a/third_party/blink/web_tests/external/wpt/webrtc/RTCPeerConnection-connectionState-expected.txt b/third_party/blink/web_tests/external/wpt/webrtc/RTCPeerConnection-connectionState.https-expected.txt
similarity index 77%
rename from third_party/blink/web_tests/external/wpt/webrtc/RTCPeerConnection-connectionState-expected.txt
rename to third_party/blink/web_tests/external/wpt/webrtc/RTCPeerConnection-connectionState.https-expected.txt
index 1aca75f..5613cd8b 100644
--- a/third_party/blink/web_tests/external/wpt/webrtc/RTCPeerConnection-connectionState-expected.txt
+++ b/third_party/blink/web_tests/external/wpt/webrtc/RTCPeerConnection-connectionState.https-expected.txt
@@ -3,5 +3,7 @@
 PASS Closing the connection should set connectionState to closed
 PASS connection with one data channel should eventually have connected connection state
 FAIL connection with one data channel should eventually have transports in connected state assert_true: Expect ICE transport to be in connected or completed state expected true got false
+PASS connectionState remains new when not adding remote ice candidates
+PASS connectionState transitions to connected via connecting
 Harness: the test ran to completion.
 
diff --git a/third_party/blink/web_tests/external/wpt/webrtc/RTCPeerConnection-connectionState.html b/third_party/blink/web_tests/external/wpt/webrtc/RTCPeerConnection-connectionState.https.html
similarity index 84%
rename from third_party/blink/web_tests/external/wpt/webrtc/RTCPeerConnection-connectionState.html
rename to third_party/blink/web_tests/external/wpt/webrtc/RTCPeerConnection-connectionState.https.html
index a461bf1..9ed5808 100644
--- a/third_party/blink/web_tests/external/wpt/webrtc/RTCPeerConnection-connectionState.html
+++ b/third_party/blink/web_tests/external/wpt/webrtc/RTCPeerConnection-connectionState.https.html
@@ -234,4 +234,40 @@
       closed
         The RTCIceTransport has shut down and is no longer responding to STUN requests.
    */
+  promise_test(async t => {
+    const caller = new RTCPeerConnection();
+    t.add_cleanup(() => caller.close());
+    const callee = new RTCPeerConnection();
+    t.add_cleanup(() => callee.close());
+    const stream = await navigator.mediaDevices.getUserMedia({audio: true});
+    t.add_cleanup(() => stream.getTracks().forEach(track => track.stop()));
+    const [track] = stream.getTracks();
+    caller.addTrack(track, stream);
+
+    await doSignalingHandshake(caller, callee);
+
+    assert_equals(caller.iceConnectionState, 'new');
+    assert_equals(callee.iceConnectionState, 'new');
+  }, 'connectionState remains new when not adding remote ice candidates');
+
+  promise_test(async t => {
+
+    const caller = new RTCPeerConnection();
+    t.add_cleanup(() => caller.close());
+    const callee = new RTCPeerConnection();
+    t.add_cleanup(() => callee.close());
+    const stream = await navigator.mediaDevices.getUserMedia({audio: true});
+    t.add_cleanup(() => stream.getTracks().forEach(track => track.stop()));
+    const [track] = stream.getTracks();
+    caller.addTrack(track, stream);
+
+    const states = [];
+    caller.addEventListener('connectionstatechange', () => states.push(caller.connectionState));
+    exchangeIceCandidates(caller, callee);
+    await doSignalingHandshake(caller, callee);
+
+    await listenToConnected(caller);
+
+    assert_array_equals(states, ['connecting', 'connected']);
+  }, 'connectionState transitions to connected via connecting');
 </script>
diff --git a/third_party/blink/web_tests/external/wpt/webrtc/RTCPeerConnection-helper.js b/third_party/blink/web_tests/external/wpt/webrtc/RTCPeerConnection-helper.js
index 310f028..90867b2 100644
--- a/third_party/blink/web_tests/external/wpt/webrtc/RTCPeerConnection-helper.js
+++ b/third_party/blink/web_tests/external/wpt/webrtc/RTCPeerConnection-helper.js
@@ -217,10 +217,10 @@
       resolve();
       return;
     }
-    pc.oniceconnectionstatechange = () => {
+    pc.addEventListener('iceconnectionstatechange', () => {
       if (isConnected(pc))
         resolve();
-    };
+    });
   });
 }
 
diff --git a/third_party/blink/web_tests/flag-specific/enable-blink-features=LayoutNG/fast/forms/image/image-alt-text-expected.png b/third_party/blink/web_tests/flag-specific/enable-blink-features=LayoutNG/fast/forms/image/image-alt-text-expected.png
new file mode 100644
index 0000000..55e4aa7
--- /dev/null
+++ b/third_party/blink/web_tests/flag-specific/enable-blink-features=LayoutNG/fast/forms/image/image-alt-text-expected.png
Binary files differ
diff --git a/third_party/blink/web_tests/flag-specific/enable-blink-features=LayoutNG/fast/replaced/border-radius-clip-expected.png b/third_party/blink/web_tests/flag-specific/enable-blink-features=LayoutNG/fast/replaced/border-radius-clip-expected.png
new file mode 100644
index 0000000..2419ac8
--- /dev/null
+++ b/third_party/blink/web_tests/flag-specific/enable-blink-features=LayoutNG/fast/replaced/border-radius-clip-expected.png
Binary files differ
diff --git a/third_party/blink/web_tests/virtual/webrtc-wpt-plan-b/external/wpt/webrtc/RTCPeerConnection-connectionState-expected.txt b/third_party/blink/web_tests/virtual/webrtc-wpt-plan-b/external/wpt/webrtc/RTCPeerConnection-connectionState.https-expected.txt
similarity index 75%
rename from third_party/blink/web_tests/virtual/webrtc-wpt-plan-b/external/wpt/webrtc/RTCPeerConnection-connectionState-expected.txt
rename to third_party/blink/web_tests/virtual/webrtc-wpt-plan-b/external/wpt/webrtc/RTCPeerConnection-connectionState.https-expected.txt
index 22eabf6c..9595466 100644
--- a/third_party/blink/web_tests/virtual/webrtc-wpt-plan-b/external/wpt/webrtc/RTCPeerConnection-connectionState-expected.txt
+++ b/third_party/blink/web_tests/virtual/webrtc-wpt-plan-b/external/wpt/webrtc/RTCPeerConnection-connectionState.https-expected.txt
@@ -3,5 +3,7 @@
 PASS Closing the connection should set connectionState to closed
 PASS connection with one data channel should eventually have connected connection state
 FAIL connection with one data channel should eventually have transports in connected state Cannot read property 'transport' of null
+PASS connectionState remains new when not adding remote ice candidates
+PASS connectionState transitions to connected via connecting
 Harness: the test ran to completion.
 
diff --git a/tools/metrics/histograms/enums.xml b/tools/metrics/histograms/enums.xml
index f37c5f0..6c1ddc35 100644
--- a/tools/metrics/histograms/enums.xml
+++ b/tools/metrics/histograms/enums.xml
@@ -49222,6 +49222,12 @@
   <int value="15" label="SERVICE_PRINTERS_REPLY"/>
 </enum>
 
+<enum name="ServiceRequestResultType">
+  <int value="0" label="Failure or response error"/>
+  <int value="1" label="Success with empty suggestions"/>
+  <int value="2" label="Success with suggestions"/>
+</enum>
+
 <enum name="ServicesCustomizationLoadResult">
   <int value="0" label="Manifest loaded successfully"/>
   <int value="1" label="Manifest not found on server"/>
diff --git a/tools/metrics/histograms/histograms.xml b/tools/metrics/histograms/histograms.xml
index f367045..0a552795 100644
--- a/tools/metrics/histograms/histograms.xml
+++ b/tools/metrics/histograms/histograms.xml
@@ -10310,7 +10310,7 @@
 </histogram>
 
 <histogram name="BackgroundSync.Wakeup.DelayTime" units="ms"
-    expires_after="M75">
+    expires_after="M77">
   <owner>nator@chromium.org</owner>
   <owner>peter@chromium.org</owner>
   <owner>rayankans@chromium.org</owner>
@@ -113748,6 +113748,35 @@
   </summary>
 </histogram>
 
+<histogram name="SpellCheck.SpellingService.RequestDuration" units="ms"
+    expires_after="2020-04-01">
+  <owner>yyushkina@google.com</owner>
+  <owner>gujen@google.com</owner>
+  <summary>
+    The elapsed time, in ms, between the moment the SimpleURLLoader starts
+    downloading the request and the moment the SimpleURLLoader callback is
+    invoked after the request finishes, whether an error or a success.
+  </summary>
+</histogram>
+
+<histogram name="SpellCheck.SpellingService.RequestHttpResponseCode"
+    enum="HttpResponseCode" expires_after="2020-04-01">
+  <owner>yyushkina@google.com</owner>
+  <owner>gujen@google.com</owner>
+  <summary>The HTTP code of Spelling service responses.</summary>
+</histogram>
+
+<histogram name="SpellCheck.SpellingService.RequestResultType"
+    enum="ServiceRequestResultType" expires_after="2020-04-01">
+  <owner>yyushkina@google.com</owner>
+  <owner>gujen@google.com</owner>
+  <summary>
+    Describes the results returned by the Spelling service by assigning them to
+    one of three high-level buckets: request/service error, success with no
+    suggestions, and success with spelling suggestions.
+  </summary>
+</histogram>
+
 <histogram name="Sqlite.AppCache.Error" enum="SqliteErrorCode">
   <obsolete>
     Moved to Sqlite.Error.AppCache in M-27.
diff --git a/ui/accessibility/ax_text_utils.cc b/ui/accessibility/ax_text_utils.cc
index 063247fe..695ae0e 100644
--- a/ui/accessibility/ax_text_utils.cc
+++ b/ui/accessibility/ax_text_utils.cc
@@ -16,22 +16,22 @@
 
 namespace {
 
-// TODO(accessibility): Extend this or switch to using ICU in order to handle
-// languages other than English.
-bool IsSentenceEndingPunctuation(base::char16 character) {
-  return character == '.' || character == '!' || character == '?';
-}
-
-bool IsInterSentenceWordCharacter(base::char16 character) {
-  return !base::IsUnicodeWhitespace(character) &&
-         !IsSentenceEndingPunctuation(character);
-}
-
-bool AlreadyPastSentenceEndingPunctuation(const base::string16& text,
-                                          size_t start_offset) {
-  auto i = text.rbegin() + (text.size() - start_offset);
-  auto found = std::find_if_not(i, text.rend(), base::IsUnicodeWhitespace);
-  return found != text.rend() && IsSentenceEndingPunctuation(*found);
+base::i18n::BreakIterator::BreakType ICUBreakTypeForBoundaryType(
+    TextBoundaryType boundary) {
+  switch (boundary) {
+    case CHAR_BOUNDARY:
+      return base::i18n::BreakIterator::BREAK_CHARACTER;
+    case SENTENCE_BOUNDARY:
+      return base::i18n::BreakIterator::BREAK_SENTENCE;
+    case WORD_BOUNDARY:
+      return base::i18n::BreakIterator::BREAK_WORD;
+    // These are currently unused since line breaking is done via an array of
+    // line break offsets.
+    case LINE_BOUNDARY:
+    case PARAGRAPH_BOUNDARY:
+    case ALL_BOUNDARY:
+      return base::i18n::BreakIterator::BREAK_NEWLINE;
+  }
 }
 
 }  // namespace
@@ -48,17 +48,12 @@
   size_t text_size = text.size();
   DCHECK_LE(start_offset, text_size);
 
-  if (boundary == CHAR_BOUNDARY) {
-    if (direction == FORWARDS_DIRECTION && start_offset < text_size)
-      return start_offset + 1;
-    else
-      return start_offset;
-  }
-
-  base::i18n::BreakIterator word_iter(text,
-                                      base::i18n::BreakIterator::BREAK_WORD);
-  if (boundary == WORD_BOUNDARY) {
-    if (!word_iter.Init())
+  base::i18n::BreakIterator::BreakType break_type =
+      ICUBreakTypeForBoundaryType(boundary);
+  base::i18n::BreakIterator break_iter(text, break_type);
+  if (boundary == WORD_BOUNDARY || boundary == SENTENCE_BOUNDARY ||
+      boundary == CHAR_BOUNDARY) {
+    if (!break_iter.Init())
       return start_offset;
   }
 
@@ -88,35 +83,6 @@
     }
   }
 
-  // Given the string "One sentence. Two sentences.   Three sentences.", the
-  // boundaries of the middle sentence should give a string like "Two
-  // sentences.   " This means there are two different starting situations when
-  // searching forwards for the sentence boundary:
-  //
-  // The first situation is when the starting index is somewhere in the
-  // whitespace between the last sentence-ending punctuation of a sentence and
-  // before the start of the next sentence. Since this part of the string is
-  // considered part of the previous sentence, we need to scan forward for the
-  // first non-whitespace and non-punctuation character.
-  //
-  // The second situation is when the starting index is somewhere on or before
-  // the first sentence-ending punctuation that ends the sentence, but still
-  // after the first non-whitespace character. In this case, we need to find
-  // the first sentence-ending punctuation and then to follow the procedure for
-  // the first situation.
-  //
-  // In order to know what situation we are in, we first need to scan backward
-  // to see if we are already past the first sentence-ending punctuation.
-  bool already_past_sentence_ending_punctuation = false;
-  if (boundary == SENTENCE_BOUNDARY && direction == FORWARDS_DIRECTION)
-    already_past_sentence_ending_punctuation =
-        AlreadyPastSentenceEndingPunctuation(text, start_offset);
-
-  // When searching backward for the start of a sentence we need to look for
-  // the punctuation that ended the previous sentence and then return the first
-  // non-whitespace character that follows.
-  base::Optional<size_t> offset_of_last_seen_word_character = base::nullopt;
-
   size_t result = start_offset;
   for (;;) {
     size_t pos;
@@ -131,37 +97,47 @@
     }
 
     switch (boundary) {
-      case CHAR_BOUNDARY:
       case LINE_BOUNDARY:
         NOTREACHED();  // These are handled above.
         break;
+      case CHAR_BOUNDARY:
+        if (break_iter.IsGraphemeBoundary(result)) {
+          // If we are searching forward and we are still at the start offset,
+          // we need to find the next character.
+          if (direction == BACKWARDS_DIRECTION || result != start_offset)
+            return result;
+        }
+        break;
+
       case WORD_BOUNDARY:
-        if (word_iter.IsStartOfWord(result)) {
+        if (break_iter.IsStartOfWord(result)) {
           // If we are searching forward and we are still at the start offset,
           // we need to find the next word.
           if (direction == BACKWARDS_DIRECTION || result != start_offset)
             return result;
         }
         break;
+      case SENTENCE_BOUNDARY:
+        if (break_iter.IsSentenceBoundary(result)) {
+          // If we are searching forward and we are still at the start offset,
+          // we need to find the next sentence.
+          if (direction == BACKWARDS_DIRECTION || result != start_offset) {
+            // ICU sometimes returns sentence boundaries in the whitespace
+            // between sentences. For the purposes of accessibility, we want to
+            // include all whitespace at the end of a sentence. We move the
+            // boundary past the last whitespace offset. This works the same for
+            // backwards and forwards searches.
+            while (result < text_size &&
+                   base::IsUnicodeWhitespace(text[result]))
+              result++;
+            return result;
+          }
+        }
+        break;
       case PARAGRAPH_BOUNDARY:
         if (text[pos] == '\n')
           return result;
         break;
-      case SENTENCE_BOUNDARY:
-        if (direction == FORWARDS_DIRECTION) {
-          if (already_past_sentence_ending_punctuation &&
-              IsInterSentenceWordCharacter(text[pos]))
-            return result;
-          if (IsSentenceEndingPunctuation(text[pos]))
-            already_past_sentence_ending_punctuation = true;
-        } else if (direction == BACKWARDS_DIRECTION) {
-          if (IsInterSentenceWordCharacter(text[pos]))
-            offset_of_last_seen_word_character = pos;
-          if (offset_of_last_seen_word_character.has_value() &&
-              IsSentenceEndingPunctuation(text[pos]))
-            return *offset_of_last_seen_word_character;
-        }
-        break;
       case ALL_BOUNDARY:
       default:
         break;
diff --git a/ui/accessibility/ax_text_utils_unittest.cc b/ui/accessibility/ax_text_utils_unittest.cc
index 2d05f8f..d1f3dbf8 100644
--- a/ui/accessibility/ax_text_utils_unittest.cc
+++ b/ui/accessibility/ax_text_utils_unittest.cc
@@ -182,4 +182,71 @@
   EXPECT_EQ(18UL, boundaries.second);
 }
 
+TEST(AXTextUtils, FindAccessibleTextBoundaryCharacter) {
+  static const wchar_t* kCharacters[] = {
+      // An English word consisting of four ASCII characters.
+      L"w",
+      L"o",
+      L"r",
+      L"d",
+      L" ",
+      // A Hindi word (which means "Hindi") consisting of three Devanagari
+      // characters.
+      L"\x0939\x093F",
+      L"\x0928\x094D",
+      L"\x0926\x0940",
+      L" ",
+      // A Thai word (which means "feel") consisting of three Thai characters.
+      L"\x0E23\x0E39\x0E49",
+      L"\x0E2A\x0E36",
+      L"\x0E01",
+      L" ",
+  };
+
+  std::vector<base::string16> characters;
+  base::string16 text;
+  for (auto*& i : kCharacters) {
+    characters.push_back(base::WideToUTF16(i));
+    text.append(characters.back());
+  }
+
+  auto verify_boundaries_at_offset = [&text](int offset, size_t start,
+                                             size_t end) {
+    testing::Message message;
+    message << "Testing character bounds at index " << offset;
+    SCOPED_TRACE(message);
+
+    std::vector<int> line_start_offsets;
+    size_t backwards = FindAccessibleTextBoundary(
+        text, line_start_offsets, CHAR_BOUNDARY, offset, BACKWARDS_DIRECTION,
+        ax::mojom::TextAffinity::kDownstream);
+    EXPECT_EQ(backwards, start);
+
+    size_t forwards = FindAccessibleTextBoundary(
+        text, line_start_offsets, CHAR_BOUNDARY, offset, FORWARDS_DIRECTION,
+        ax::mojom::TextAffinity::kDownstream);
+    EXPECT_EQ(forwards, end);
+  };
+
+  verify_boundaries_at_offset(0, 0UL, 1UL);
+  verify_boundaries_at_offset(1, 1UL, 2UL);
+  verify_boundaries_at_offset(2, 2UL, 3UL);
+  verify_boundaries_at_offset(3, 3UL, 4UL);
+  verify_boundaries_at_offset(4, 4UL, 5UL);
+  verify_boundaries_at_offset(5, 5UL, 7UL);
+  verify_boundaries_at_offset(6, 5UL, 7UL);
+  verify_boundaries_at_offset(7, 7UL, 9UL);
+  verify_boundaries_at_offset(8, 7UL, 9UL);
+  verify_boundaries_at_offset(9, 9UL, 11UL);
+  verify_boundaries_at_offset(10, 9UL, 11UL);
+  verify_boundaries_at_offset(11, 11L, 12UL);
+  verify_boundaries_at_offset(12, 12L, 15UL);
+  verify_boundaries_at_offset(13, 12L, 15UL);
+  verify_boundaries_at_offset(14, 12L, 15UL);
+  verify_boundaries_at_offset(15, 15L, 17UL);
+  verify_boundaries_at_offset(16, 15L, 17UL);
+  verify_boundaries_at_offset(17, 17L, 18UL);
+  verify_boundaries_at_offset(18, 18L, 19UL);
+}
+
 }  // namespace ui
diff --git a/ui/accessibility/platform/ax_platform_node_auralinux.cc b/ui/accessibility/platform/ax_platform_node_auralinux.cc
index afccd82..0169d10 100644
--- a/ui/accessibility/platform/ax_platform_node_auralinux.cc
+++ b/ui/accessibility/platform/ax_platform_node_auralinux.cc
@@ -1232,6 +1232,62 @@
   return true;
 }
 
+bool AXPlatformNodeAuraLinux::HasSelection() {
+  int selection_start, selection_end;
+  GetSelectionOffsets(&selection_start, &selection_end);
+  return selection_start >= 0 && selection_end >= 0 &&
+         selection_start != selection_end;
+}
+
+gchar* AXPlatformNodeAuraLinux::GetSelection(int* start_offset,
+                                             int* end_offset) {
+  if (start_offset)
+    *start_offset = 0;
+  if (end_offset)
+    *end_offset = 0;
+
+  int selection_start, selection_end;
+  GetSelectionOffsets(&selection_start, &selection_end);
+  if (selection_start < 0 || selection_end < 0 ||
+      selection_start == selection_end)
+    return nullptr;
+
+  // We should ignore the direction of the selection when exposing start and
+  // end offsets. According to the ATK documentation the end offset is always
+  // the offset immediately past the end of the selection. This wouldn't make
+  // sense if end < start.
+  if (selection_end < selection_start)
+    std::swap(selection_start, selection_end);
+
+  selection_start = UTF16ToUnicodeOffsetInText(selection_start);
+  selection_end = UTF16ToUnicodeOffsetInText(selection_end);
+
+  if (start_offset)
+    *start_offset = selection_start;
+  if (end_offset)
+    *end_offset = selection_end;
+
+  return AXPlatformNodeAuraLinuxGetText(ATK_TEXT(atk_object_), selection_start,
+                                        selection_end);
+}
+
+bool AXPlatformNodeAuraLinux::SetTextSelectionForAtkText(int start_offset,
+                                                         int end_offset) {
+  start_offset = UnicodeToUTF16OffsetInText(start_offset);
+  end_offset = UnicodeToUTF16OffsetInText(end_offset);
+
+  base::string16 text = GetText();
+  if (start_offset < 0 || start_offset > static_cast<int>(text.length()))
+    return false;
+  if (end_offset < 0 || end_offset > static_cast<int>(text.length()))
+    return false;
+
+  bool result = SetTextSelection(start_offset, end_offset);
+  if (result)
+    OnTextSelectionChanged();
+  return result;
+}
+
 static gint AXPlatformNodeAuraLinuxGetCaretOffset(AtkText* atk_text) {
   AXPlatformNodeAuraLinux* obj =
       AtkObjectToAXPlatformNodeAuraLinux(ATK_OBJECT(atk_text));
@@ -1249,6 +1305,72 @@
   return obj->SetCaretOffset(offset);
 }
 
+int AXPlatformNodeAuraLinuxGetNSelections(AtkText* atk_text) {
+  AXPlatformNodeAuraLinux* obj =
+      AtkObjectToAXPlatformNodeAuraLinux(ATK_OBJECT(atk_text));
+  if (!obj)
+    return 0;
+
+  // We only support a single selection.
+  return obj->HasSelection() ? 1 : 0;
+}
+
+// Since this method doesn't return a static gchar*, we expect the caller of
+// atk_text_get_selection to free the return value.
+gchar* AXPlatformNodeAuraLinuxGetSelection(AtkText* atk_text,
+                                           int selection_num,
+                                           int* start_offset,
+                                           int* end_offset) {
+  AXPlatformNodeAuraLinux* obj =
+      AtkObjectToAXPlatformNodeAuraLinux(ATK_OBJECT(atk_text));
+  if (!obj)
+    return nullptr;
+  if (selection_num != 0)
+    return nullptr;
+
+  return obj->GetSelection(start_offset, end_offset);
+}
+
+gboolean AXPlatformNodeAuraLinuxRemoveTextSelection(AtkText* atk_text,
+                                                    int selection_num) {
+  if (selection_num != 0)
+    return FALSE;
+
+  AXPlatformNodeAuraLinux* obj =
+      AtkObjectToAXPlatformNodeAuraLinux(ATK_OBJECT(atk_text));
+  if (!obj)
+    return FALSE;
+
+  // Simply collapse the selection to the position of the caret if a caret is
+  // visible, otherwise set the selection to 0.
+  int selection_end = obj->UTF16ToUnicodeOffsetInText(
+      obj->GetIntAttribute(ax::mojom::IntAttribute::kTextSelEnd));
+  return AXPlatformNodeAuraLinuxSetCaretOffset(atk_text, selection_end);
+}
+
+gboolean AXPlatformNodeAuraLinuxSetSelection(AtkText* atk_text,
+                                             int selection_num,
+                                             int start_offset,
+                                             int end_offset) {
+  if (selection_num != 0)
+    return FALSE;
+
+  AXPlatformNodeAuraLinux* obj =
+      AtkObjectToAXPlatformNodeAuraLinux(ATK_OBJECT(atk_text));
+  if (!obj)
+    return FALSE;
+
+  return obj->SetTextSelectionForAtkText(start_offset, end_offset);
+}
+
+gboolean AXPlatformNodeAuraLinuxAddTextSelection(AtkText* atk_text,
+                                                 int start_offset,
+                                                 int end_offset) {
+  // We only support one selection.
+  return AXPlatformNodeAuraLinuxSetSelection(atk_text, 0, start_offset,
+                                             end_offset);
+}
+
 #if ATK_CHECK_VERSION(2, 10, 0)
 static char* AXPlatformNodeAuraLinuxGetStringAtOffset(
     AtkText* atk_text,
@@ -1340,6 +1462,11 @@
   iface->set_caret_offset = AXPlatformNodeAuraLinuxSetCaretOffset;
   iface->get_character_extents = AXPlatformNodeAuraLinuxGetCharacterExtents;
   iface->get_range_extents = AXPlatformNodeAuraLinuxGetRangeExtents;
+  iface->get_n_selections = AXPlatformNodeAuraLinuxGetNSelections;
+  iface->get_selection = AXPlatformNodeAuraLinuxGetSelection;
+  iface->add_selection = AXPlatformNodeAuraLinuxAddTextSelection;
+  iface->remove_selection = AXPlatformNodeAuraLinuxRemoveTextSelection;
+  iface->set_selection = AXPlatformNodeAuraLinuxSetSelection;
 
 #if ATK_CHECK_VERSION(2, 10, 0)
   iface->get_string_at_offset = AXPlatformNodeAuraLinuxGetStringAtOffset;
@@ -3111,6 +3238,7 @@
     g_signal_emit_by_name(atk_object_, "text-caret-moved",
                           atk_text_get_caret_offset(ATK_TEXT(atk_object_)));
   }
+  g_signal_emit_by_name(atk_object_, "text-selection-changed");
 }
 
 bool AXPlatformNodeAuraLinux::SupportsSelectionWithAtkSelection() {
diff --git a/ui/accessibility/platform/ax_platform_node_auralinux.h b/ui/accessibility/platform/ax_platform_node_auralinux.h
index 81bef19b..89232f3 100644
--- a/ui/accessibility/platform/ax_platform_node_auralinux.h
+++ b/ui/accessibility/platform/ax_platform_node_auralinux.h
@@ -117,6 +117,9 @@
 
   int GetCaretOffset();
   bool SetCaretOffset(int offset);
+  bool SetTextSelectionForAtkText(int start_offset, int end_offset);
+  bool HasSelection();
+  gchar* GetSelection(int* start_offset, int* end_offset);
 
  protected:
   // Offsets for the AtkText API are calculated in UTF-16 code point offsets,
diff --git a/ui/accessibility/platform/ax_platform_node_auralinux_unittest.cc b/ui/accessibility/platform/ax_platform_node_auralinux_unittest.cc
index e2bd0212..3fe7e95 100644
--- a/ui/accessibility/platform/ax_platform_node_auralinux_unittest.cc
+++ b/ui/accessibility/platform/ax_platform_node_auralinux_unittest.cc
@@ -1800,4 +1800,135 @@
                          ATK_RELATION_LABELLED_BY, ATK_RELATION_LABEL_FOR);
 }
 
+TEST_F(AXPlatformNodeAuraLinuxTest, TestAtkTextTextFieldGetNSelectionsZero) {
+  Init(BuildTextField());
+  AtkObject* root_atk_object(GetRootAtkObject());
+  g_object_ref(root_atk_object);
+
+  AtkText* atk_text = ATK_TEXT(root_atk_object);
+  ASSERT_NE(nullptr, atk_text);
+  EXPECT_EQ(0, atk_text_get_n_selections(atk_text));
+
+  g_object_unref(root_atk_object);
+}
+
+TEST_F(AXPlatformNodeAuraLinuxTest,
+       TestAtkTextContentEditableGetNSelectionsZero) {
+  Init(BuildContentEditable());
+  AtkObject* root_atk_object(GetRootAtkObject());
+  g_object_ref(root_atk_object);
+
+  AtkText* atk_text = ATK_TEXT(root_atk_object);
+  ASSERT_NE(nullptr, atk_text);
+  EXPECT_EQ(0, atk_text_get_n_selections(atk_text));
+
+  g_object_unref(root_atk_object);
+}
+
+TEST_F(AXPlatformNodeAuraLinuxTest, TestAtkTextContentEditableGetNSelections) {
+  Init(BuildContentEditableWithSelectionRange(1, 2));
+  AtkObject* root_atk_object(GetRootAtkObject());
+  g_object_ref(root_atk_object);
+
+  AtkText* atk_text = ATK_TEXT(root_atk_object);
+  ASSERT_NE(nullptr, atk_text);
+  EXPECT_EQ(1, atk_text_get_n_selections(atk_text));
+
+  g_object_unref(root_atk_object);
+}
+
+TEST_F(AXPlatformNodeAuraLinuxTest, TestAtkTextTextFieldSetSelection) {
+  Init(BuildTextField());
+  AtkObject* root_atk_object(GetRootAtkObject());
+  g_object_ref(root_atk_object);
+
+  AtkText* atk_text = ATK_TEXT(root_atk_object);
+  ASSERT_NE(nullptr, atk_text);
+
+  bool saw_selection_change = false;
+  g_signal_connect(
+      atk_text, "text-selection-changed",
+      G_CALLBACK(+[](AtkObject* atkobject, bool* flag) { *flag = true; }),
+      &saw_selection_change);
+
+  EXPECT_TRUE(atk_text_set_selection(atk_text, 0, 0, 1));
+  EXPECT_TRUE(saw_selection_change);
+
+  saw_selection_change = false;
+  EXPECT_TRUE(atk_text_set_selection(atk_text, 0, 1, 0));
+  EXPECT_TRUE(saw_selection_change);
+
+  saw_selection_change = false;
+  EXPECT_TRUE(atk_text_set_selection(atk_text, 0, 2, 2));
+  EXPECT_TRUE(saw_selection_change);
+
+  saw_selection_change = false;
+  EXPECT_FALSE(atk_text_set_selection(atk_text, 1, 0, 0));
+  EXPECT_FALSE(saw_selection_change);
+
+  saw_selection_change = false;
+  EXPECT_FALSE(atk_text_set_selection(atk_text, 0, 0, 50));
+  EXPECT_FALSE(saw_selection_change);
+
+  saw_selection_change = false;
+  EXPECT_TRUE(atk_text_set_selection(atk_text, 0, 0, 1));
+  EXPECT_EQ(1, atk_text_get_n_selections(atk_text));
+  EXPECT_TRUE(atk_text_remove_selection(atk_text, 0));
+  EXPECT_TRUE(saw_selection_change);
+  EXPECT_EQ(0, atk_text_get_n_selections(atk_text));
+
+  saw_selection_change = false;
+  EXPECT_TRUE(atk_text_set_selection(atk_text, 0, 0, 1));
+  EXPECT_EQ(1, atk_text_get_n_selections(atk_text));
+  EXPECT_FALSE(atk_text_remove_selection(atk_text, 1));
+  EXPECT_TRUE(saw_selection_change);
+  EXPECT_EQ(1, atk_text_get_n_selections(atk_text));
+
+  g_object_unref(root_atk_object);
+}
+
+TEST_F(AXPlatformNodeAuraLinuxTest, TestAtkTextTextFieldGetSelection) {
+  Init(BuildTextField());
+  AtkObject* root_atk_object(GetRootAtkObject());
+  g_object_ref(root_atk_object);
+
+  AtkText* atk_text = ATK_TEXT(root_atk_object);
+  ASSERT_NE(nullptr, atk_text);
+
+  int selection_start = 0, selection_end = 0;
+  EXPECT_TRUE(atk_text_set_selection(atk_text, 0, 0, 3));
+  gchar* selected_text =
+      atk_text_get_selection(atk_text, 0, &selection_start, &selection_end);
+  EXPECT_STREQ("How", selected_text);
+  EXPECT_EQ(selection_start, 0);
+  EXPECT_EQ(selection_end, 3);
+  g_free(selected_text);
+
+  selection_start = 0;
+  selection_end = 0;
+
+  EXPECT_TRUE(atk_text_remove_selection(atk_text, 0));
+  selected_text =
+      atk_text_get_selection(atk_text, 0, &selection_start, &selection_end);
+  EXPECT_EQ(nullptr, selected_text);
+  EXPECT_EQ(selection_start, 0);
+  EXPECT_EQ(selection_end, 0);
+
+  EXPECT_TRUE(atk_text_set_selection(atk_text, 0, 0, 3));
+
+  selected_text =
+      atk_text_get_selection(atk_text, 1, &selection_start, &selection_end);
+  EXPECT_EQ(nullptr, selected_text);
+  EXPECT_EQ(selection_start, 0);
+  EXPECT_EQ(selection_end, 0);
+
+  selected_text =
+      atk_text_get_selection(atk_text, -1, &selection_start, &selection_end);
+  EXPECT_EQ(nullptr, selected_text);
+  EXPECT_EQ(selection_start, 0);
+  EXPECT_EQ(selection_end, 0);
+
+  g_object_unref(root_atk_object);
+}
+
 }  // namespace ui
diff --git a/ui/android/java/src/org/chromium/ui/base/SelectFileDialog.java b/ui/android/java/src/org/chromium/ui/base/SelectFileDialog.java
index 1928314..0779d0a6 100644
--- a/ui/android/java/src/org/chromium/ui/base/SelectFileDialog.java
+++ b/ui/android/java/src/org/chromium/ui/base/SelectFileDialog.java
@@ -19,6 +19,7 @@
 import android.text.TextUtils;
 import android.webkit.MimeTypeMap;
 
+import org.chromium.base.BuildInfo;
 import org.chromium.base.ContentUriUtils;
 import org.chromium.base.ContextUtils;
 import org.chromium.base.Log;
@@ -155,7 +156,12 @@
 
         List<String> missingPermissions = new ArrayList<>();
         if (shouldUsePhotoPicker()) {
-            if (!window.hasPermission(Manifest.permission.READ_EXTERNAL_STORAGE)) {
+            if (BuildInfo.isAtLeastQ()) {
+                String newImagePermission = "android.permission.READ_MEDIA_IMAGES";
+                if (!window.hasPermission(newImagePermission)) {
+                    missingPermissions.add(newImagePermission);
+                }
+            } else if (!window.hasPermission(Manifest.permission.READ_EXTERNAL_STORAGE)) {
                 missingPermissions.add(Manifest.permission.READ_EXTERNAL_STORAGE);
             }
         } else {
diff --git a/ui/views/examples/tree_view_example.cc b/ui/views/examples/tree_view_example.cc
index 1ec82dac..4df1b91d 100644
--- a/ui/views/examples/tree_view_example.cc
+++ b/ui/views/examples/tree_view_example.cc
@@ -49,7 +49,8 @@
 
 TreeViewExample::~TreeViewExample() {
   // Remove the model from the view.
-  tree_view_->SetModel(nullptr);
+  if (tree_view_)
+    tree_view_->SetModel(nullptr);
 }
 
 void TreeViewExample::CreateExampleView(View* container) {