diff --git a/DEPS b/DEPS
index 97f46fc..9eb1a52 100644
--- a/DEPS
+++ b/DEPS

@@ -43,7 +43,7 @@
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling V8
   # and whatever else without interference from each other.
-  'v8_revision': 'dce364cc603ac27c07ed4c0ef23f130852dd57f4',
+  'v8_revision': '71a9d8208741b6f34dda1196254af27d29c16908',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling swarming_client
   # and whatever else without interference from each other.

diff --git a/android_webview/BUILD.gn b/android_webview/BUILD.gn
index 0ea2bfb..de439a8 100644
--- a/android_webview/BUILD.gn
+++ b/android_webview/BUILD.gn

@@ -4,8 +4,17 @@
 
 import("//build/config/android/config.gni")
 import("//build/config/android/rules.gni")
+import("//build/config/locales.gni")
 import("//build_overrides/v8.gni")
+import("//third_party/icu/config.gni")
 import("//tools/grit/repack.gni")
+import("webview_repack_locales.gni")
+
+if (current_cpu == "arm" || current_cpu == "x86" || current_cpu == "mipsel") {
+  arch_suffix = 32
+} else {
+  arch_suffix = 64
+}
 
 # This is dummy target for adding WebView gn piece by piece, so we don't need
 # to modify the src/BUILD.gn everytime new targets added.
@@ -13,6 +22,154 @@
   deps = [
     ":android_webview_java",
     ":common",
+    ":assets",
+  ]
+}
+
+webview_repack_locales("repack_locales") {
+  input_locales = locales
+  output_locales = locales
+}
+
+locale_pak_resources("locale_paks") {
+  sources = [
+    "$root_out_dir/android_webview/locales/am.pak",
+    "$root_out_dir/android_webview/locales/ar.pak",
+    "$root_out_dir/android_webview/locales/bg.pak",
+    "$root_out_dir/android_webview/locales/bn.pak",
+    "$root_out_dir/android_webview/locales/ca.pak",
+    "$root_out_dir/android_webview/locales/cs.pak",
+    "$root_out_dir/android_webview/locales/da.pak",
+    "$root_out_dir/android_webview/locales/de.pak",
+    "$root_out_dir/android_webview/locales/el.pak",
+    "$root_out_dir/android_webview/locales/en-GB.pak",
+    "$root_out_dir/android_webview/locales/en-US.pak",
+    "$root_out_dir/android_webview/locales/es-419.pak",
+    "$root_out_dir/android_webview/locales/es.pak",
+    "$root_out_dir/android_webview/locales/et.pak",
+    "$root_out_dir/android_webview/locales/fa.pak",
+    "$root_out_dir/android_webview/locales/fi.pak",
+    "$root_out_dir/android_webview/locales/fil.pak",
+    "$root_out_dir/android_webview/locales/fr.pak",
+    "$root_out_dir/android_webview/locales/gu.pak",
+    "$root_out_dir/android_webview/locales/he.pak",
+    "$root_out_dir/android_webview/locales/hi.pak",
+    "$root_out_dir/android_webview/locales/hr.pak",
+    "$root_out_dir/android_webview/locales/hu.pak",
+    "$root_out_dir/android_webview/locales/id.pak",
+    "$root_out_dir/android_webview/locales/it.pak",
+    "$root_out_dir/android_webview/locales/ja.pak",
+    "$root_out_dir/android_webview/locales/kn.pak",
+    "$root_out_dir/android_webview/locales/ko.pak",
+    "$root_out_dir/android_webview/locales/lt.pak",
+    "$root_out_dir/android_webview/locales/lv.pak",
+    "$root_out_dir/android_webview/locales/ml.pak",
+    "$root_out_dir/android_webview/locales/mr.pak",
+    "$root_out_dir/android_webview/locales/ms.pak",
+    "$root_out_dir/android_webview/locales/nb.pak",
+    "$root_out_dir/android_webview/locales/nl.pak",
+    "$root_out_dir/android_webview/locales/pl.pak",
+    "$root_out_dir/android_webview/locales/pt-BR.pak",
+    "$root_out_dir/android_webview/locales/pt-PT.pak",
+    "$root_out_dir/android_webview/locales/ro.pak",
+    "$root_out_dir/android_webview/locales/ru.pak",
+    "$root_out_dir/android_webview/locales/sk.pak",
+    "$root_out_dir/android_webview/locales/sl.pak",
+    "$root_out_dir/android_webview/locales/sr.pak",
+    "$root_out_dir/android_webview/locales/sv.pak",
+    "$root_out_dir/android_webview/locales/sw.pak",
+    "$root_out_dir/android_webview/locales/ta.pak",
+    "$root_out_dir/android_webview/locales/te.pak",
+    "$root_out_dir/android_webview/locales/th.pak",
+    "$root_out_dir/android_webview/locales/tr.pak",
+    "$root_out_dir/android_webview/locales/uk.pak",
+    "$root_out_dir/android_webview/locales/vi.pak",
+    "$root_out_dir/android_webview/locales/zh-CN.pak",
+    "$root_out_dir/android_webview/locales/zh-TW.pak",
+  ]
+  deps = [
+    ":repack_locales",
+  ]
+}
+
+repack("repack_pack") {
+  sources = [
+    "$root_gen_dir/blink/public/resources/blink_image_resources_100_percent.pak",
+    "$root_gen_dir/blink/public/resources/blink_resources.pak",
+    "$root_gen_dir/content/app/resources/content_resources_100_percent.pak",
+    "$root_gen_dir/content/content_resources.pak",
+    "$root_gen_dir/net/net_resources.pak",
+    "$root_gen_dir/ui/resources/ui_resources_100_percent.pak",
+    "$target_gen_dir/aw_resources.pak",
+  ]
+  deps = [
+    ":generate_aw_resources",
+    "//third_party/WebKit/public:image_resources",
+    "//third_party/WebKit/public:resources",
+    "//content/app/resources",
+    "//content:resources",
+    "//net:net_resources",
+    "//ui/resources",
+  ]
+  output = "$target_gen_dir/webviewchromium.pak"
+}
+
+copy("rename_natives_blob") {
+  sources = [
+    "$root_out_dir/natives_blob.bin",
+  ]
+  outputs = [
+    "$target_gen_dir/natives_blob_$arch_suffix.bin",
+  ]
+  deps = [
+    "//v8",
+  ]
+}
+
+copy("rename_snapshot_blob") {
+  sources = [
+    "$root_out_dir/snapshot_blob.bin",
+  ]
+  outputs = [
+    "$target_gen_dir/snapshot_blob_$arch_suffix.bin",
+  ]
+  deps = [
+    "//v8",
+  ]
+}
+
+android_webview_assets_dir = "$root_build_dir/android_webview_assets"
+
+copy_ex("assets") {
+  clear_dir = true
+  dest = android_webview_assets_dir
+  sources = [
+    "$target_gen_dir/webviewchromium.pak",
+  ]
+  deps = [
+    ":repack_pack",
+  ]
+  if (icu_use_data_file) {
+    sources += [ "$root_build_dir/icudtl.dat" ]
+    deps += [ "//third_party/icu:icudata" ]
+  }
+  if (v8_use_external_startup_data) {
+    sources += [
+      "$target_gen_dir/natives_blob_$arch_suffix.bin",
+      "$target_gen_dir/snapshot_blob_$arch_suffix.bin",
+    ]
+    deps += [
+      ":rename_natives_blob",
+      ":rename_snapshot_blob",
+    ]
+  }
+}
+
+android_resources("resources") {
+  resource_dirs = [ "java/res" ]
+  custom_package = "org.chromium.android_webview"
+  deps = [
+    ":locale_paks",
     ":strings_grd",
   ]
 }
@@ -362,6 +519,7 @@
 
 android_library("android_webview_java") {
   deps = [
+    ":resources",
     ":strings_grd",
     "//base:base_java",
     "//components/external_video_surface:java",

diff --git a/android_webview/android_webview.gyp b/android_webview/android_webview.gyp
index 281c45f5..542b0e90 100644
--- a/android_webview/android_webview.gyp
+++ b/android_webview/android_webview.gyp

@@ -36,6 +36,7 @@
           },
           'includes': [ '../build/grit_action.gypi' ],
         },
+        # GN version: //android_webview:repack_pack
         {
           'action_name': 'repack_android_webview_pack',
           'variables': {
@@ -72,6 +73,7 @@
           },
           'includes': [ '../build/grit_action.gypi' ],
         },
+        # GN Version: //android_webview:repack_locales
         {
           'action_name': 'android_webview_repack_locales',
           'variables': {
@@ -92,6 +94,7 @@
             '<@(locales)',
           ],
         },
+        # GN version:  //android_webview/rename_snapshot_blob 
         {
           'action_name': 'rename_snapshot_blob',
           'inputs': [
@@ -107,6 +110,7 @@
             '<@(_outputs)',
           ],
         },
+        # GN version:  //android_webview/rename_natives_blob 
         {
           'action_name': 'rename_natives_blob',
           'inputs': [
@@ -124,6 +128,7 @@
         },
       ],
     },
+    # GN version:  //android_webview/locale_paks 
     {
       'target_name': 'android_webview_locale_paks',
       'type': 'none',

diff --git a/android_webview/webview_repack_locales.gni b/android_webview/webview_repack_locales.gni
new file mode 100644
index 0000000..c739c12
--- /dev/null
+++ b/android_webview/webview_repack_locales.gni

@@ -0,0 +1,102 @@
+# Copyright 2015 The Chromium Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+#
+# This is a copy of src/chrome/chrome_repack_locales.gni with the necessary
+# modifications to meet WebView's requirement.
+
+import("//build/config/chrome_build.gni")
+import("//build/config/features.gni")
+import("//build/config/ui.gni")
+import("//tools/grit/repack.gni")
+
+# Arguments:
+#
+#   locale
+#       Internal name of locale. e.g. "pt-BR"
+#
+#   output
+#       Output file name.
+#
+#   visibility
+#       Normal meaning.
+template("_repack_one_locale") {
+  locale = invoker.locale
+
+  repack(target_name) {
+    visibility = invoker.visibility
+
+    # Each input pak file should also have a deps line for completeness.
+    sources = [
+      "${root_gen_dir}/android_webview/aw_strings_${locale}.pak",
+      "${root_gen_dir}/android_webview/components_strings_${locale}.pak",
+      "${root_gen_dir}/content/app/strings/content_strings_${locale}.pak",
+    ]
+    deps = [
+      "//android_webview:generate_aw_strings",
+      "//android_webview:generate_components_strings",
+      "//content/app/strings",
+    ]
+    output = invoker.output
+  }
+}
+
+# Creates an action to call the repack_locales script.
+#
+# The GYP version generates the locales in the "gen" directory and then copies
+# it to the root build directory. This isn't easy to express in a GN copy
+# rule since the files on Mac have a complex structure. So we generate the
+# files into the final place and skip the "gen" directory.
+#
+# This template uses GN's looping constructs to avoid the complex call to
+# chrome/tools/build/repack_locales.py which wraps the repack commands in the
+# GYP build.
+#
+# Arguments
+#
+#   input_locales
+#       List of locale names to use as inputs.
+#
+#   output_locales
+#       A list containing the corresponding output names for each of the
+#       input names.
+#
+#   visibility
+template("webview_repack_locales") {
+  # This is the name of the group below that will collect all the invidual
+  # locale targets. External targets will depend on this.
+  group_target_name = target_name
+
+  # GN's subscript is too stupid to do invoker.output_locales[foo] so we need
+  # to make a copy and do output_locales[foo].
+  output_locales = invoker.output_locales
+
+  # Collects all targets the loop generates.
+  locale_targets = []
+
+  # This loop iterates over the input locales and also keeps a counter so it
+  # can simultaneously iterate over the output locales (using GN's very
+  # limited looping capabilities).
+  current_index = 0
+  foreach(input_locale, invoker.input_locales) {
+    output_locale = output_locales[current_index]
+
+    # Compute the name of the target for the current file. Save it for the deps.
+    current_name = "${target_name}_${input_locale}"
+    locale_targets += [ ":$current_name" ]
+
+    _repack_one_locale(current_name) {
+      visibility = [ ":$group_target_name" ]
+      locale = input_locale
+      output = "${root_out_dir}/android_webview/locales/${output_locale}.pak"
+    }
+
+    current_index = current_index + 1
+  }
+
+  # The group that external targets depend on which collects all deps.
+  group(group_target_name) {
+    forward_variables_from(invoker, [ "visibility" ])
+    public_deps = locale_targets
+  }
+}

diff --git a/base/BUILD.gn b/base/BUILD.gn
index efc37544..bb8bd55d 100644
--- a/base/BUILD.gn
+++ b/base/BUILD.gn

@@ -547,6 +547,8 @@
     "threading/platform_thread_win.cc",
     "threading/post_task_and_reply_impl.cc",
     "threading/post_task_and_reply_impl.h",
+    "threading/sequenced_task_runner_handle.cc",
+    "threading/sequenced_task_runner_handle.h",
     "threading/sequenced_worker_pool.cc",
     "threading/sequenced_worker_pool.h",
     "threading/simple_thread.cc",
@@ -1435,6 +1437,7 @@
     "test/user_action_tester_unittest.cc",
     "threading/non_thread_safe_unittest.cc",
     "threading/platform_thread_unittest.cc",
+    "threading/sequenced_task_runner_handle_unittest.cc",
     "threading/sequenced_worker_pool_unittest.cc",
     "threading/simple_thread_unittest.cc",
     "threading/thread_checker_unittest.cc",

diff --git a/base/base.gyp b/base/base.gyp
index 2b67d07d..41d5379 100644
--- a/base/base.gyp
+++ b/base/base.gyp

@@ -624,6 +624,7 @@
         'threading/non_thread_safe_unittest.cc',
         'threading/platform_thread_unittest.cc',
         'threading/sequenced_worker_pool_unittest.cc',
+        'threading/sequenced_task_runner_handle_unittest.cc',
         'threading/simple_thread_unittest.cc',
         'threading/thread_checker_unittest.cc',
         'threading/thread_collision_warner_unittest.cc',

diff --git a/base/base.gypi b/base/base.gypi
index 6ec36dd..7e09e306 100644
--- a/base/base.gypi
+++ b/base/base.gypi

@@ -645,6 +645,8 @@
           'threading/platform_thread_win.cc',
           'threading/post_task_and_reply_impl.cc',
           'threading/post_task_and_reply_impl.h',
+          'threading/sequenced_task_runner_handle.cc',
+          'threading/sequenced_task_runner_handle.h',
           'threading/sequenced_worker_pool.cc',
           'threading/sequenced_worker_pool.h',
           'threading/simple_thread.cc',

diff --git a/base/memory/shared_memory.h b/base/memory/shared_memory.h
index 18416c0..5cdcb0d 100644
--- a/base/memory/shared_memory.h
+++ b/base/memory/shared_memory.h

@@ -140,6 +140,10 @@
   // http://crbug.com/466437.
   bool CreateAndMapAnonymousPosix(size_t size);
   bool CreateAnonymousPosix(size_t size);
+
+  // This method is an analog of CreateAndMapAnonymous that forces the
+  // underlying OS primitive to be a Mach memory object.
+  bool CreateAndMapAnonymousMach(size_t size);
 #endif  // defined(OS_MACOSX) && !defined(OS_IOS)
 
   // Creates an anonymous shared memory segment of size size.

diff --git a/base/memory/shared_memory_handle.h b/base/memory/shared_memory_handle.h
index b3dfc8f..49398a4 100644
--- a/base/memory/shared_memory_handle.h
+++ b/base/memory/shared_memory_handle.h

@@ -75,12 +75,15 @@
 #else
 class BASE_EXPORT SharedMemoryHandle {
  public:
+  // The values of these enums must not change, as they are used by the
+  // histogram OSX.SharedMemory.Mechanism.
   enum Type {
     // The SharedMemoryHandle is backed by a POSIX fd.
     POSIX,
     // The SharedMemoryHandle is backed by the Mach primitive "memory object".
     MACH,
   };
+  static const int TypeMax = 2;
 
   // The format that should be used to transmit |Type| over the wire.
   typedef int TypeWireFormat;

diff --git a/base/memory/shared_memory_mac.cc b/base/memory/shared_memory_mac.cc
index 799b8e3..8f198dc 100644
--- a/base/memory/shared_memory_mac.cc
+++ b/base/memory/shared_memory_mac.cc

@@ -13,7 +13,10 @@
 #include "base/files/file_util.h"
 #include "base/files/scoped_file.h"
 #include "base/logging.h"
+#include "base/mac/mac_util.h"
 #include "base/mac/scoped_mach_vm.h"
+#include "base/metrics/field_trial.h"
+#include "base/metrics/histogram_macros.h"
 #include "base/posix/eintr_wrapper.h"
 #include "base/posix/safe_strerror.h"
 #include "base/process/process_metrics.h"
@@ -29,6 +32,38 @@
 
 namespace {
 
+const char kTrialName[] = "MacMemoryMechanism";
+const char kTrialMach[] = "Mach";
+const char kTrialPosix[] = "Posix";
+
+SharedMemoryHandle::Type GetABTestMechanism() {
+  static bool found_group = false;
+  static SharedMemoryHandle::Type group = SharedMemoryHandle::MACH;
+
+  if (found_group)
+    return group;
+
+  const std::string group_name =
+      base::FieldTrialList::FindFullName(kTrialName);
+  if (group_name == kTrialMach) {
+    group = SharedMemoryHandle::MACH;
+    found_group = true;
+  } else if (group_name == kTrialPosix) {
+    group = SharedMemoryHandle::POSIX;
+    found_group = true;
+  } else {
+    group = SharedMemoryHandle::MACH;
+  }
+
+  return group;
+}
+
+// Emits a histogram entry indicating which type of SharedMemory was created.
+void EmitMechanism(SharedMemoryHandle::Type type) {
+  UMA_HISTOGRAM_ENUMERATION("OSX.SharedMemory.Mechanism", type,
+                            SharedMemoryHandle::TypeMax);
+}
+
 // Returns whether the operation succeeded.
 // |new_handle| is an output variable, populated on success. The caller takes
 // ownership of the underlying memory object.
@@ -227,6 +262,22 @@
   return Create(options);
 }
 
+bool SharedMemory::CreateAndMapAnonymousMach(size_t size) {
+  SharedMemoryCreateOptions options;
+
+  if (mac::IsOSLionOrLater()) {
+    // A/B test the mechanism. Once the experiment is over, this will always be
+    // set to SharedMemoryHandle::MACH.
+    // http://crbug.com/547261
+    options.type = GetABTestMechanism();
+  } else {
+    // Mach shared memory isn't supported on OSX 10.6 or older.
+    options.type = SharedMemoryHandle::POSIX;
+  }
+  options.size = size;
+  return Create(options) && Map(size);
+}
+
 // static
 bool SharedMemory::GetSizeFromSharedMemoryHandle(
     const SharedMemoryHandle& handle,
@@ -248,6 +299,8 @@
   if (options.size > static_cast<size_t>(std::numeric_limits<int>::max()))
     return false;
 
+  EmitMechanism(options.type);
+
   if (options.type == SharedMemoryHandle::MACH) {
     shm_ = SharedMemoryHandle(options.size);
     requested_size_ = options.size;

diff --git a/base/thread_task_runner_handle.h b/base/thread_task_runner_handle.h
index 238435f..197669ed 100644
--- a/base/thread_task_runner_handle.h
+++ b/base/thread_task_runner_handle.h

@@ -16,6 +16,7 @@
 // in thread-local storage.  Callers can then retrieve the TaskRunner
 // for the current thread by calling ThreadTaskRunnerHandle::Get().
 // At most one TaskRunner may be bound to each thread at a time.
+// Prefer SequenceTaskRunnerHandle to this unless thread affinity is required.
 class BASE_EXPORT ThreadTaskRunnerHandle {
  public:
   // Gets the SingleThreadTaskRunner for the current thread.

diff --git a/base/threading/sequenced_task_runner_handle.cc b/base/threading/sequenced_task_runner_handle.cc
new file mode 100644
index 0000000..a03642d
--- /dev/null
+++ b/base/threading/sequenced_task_runner_handle.cc

@@ -0,0 +1,38 @@
+// Copyright 2015 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "base/threading/sequenced_task_runner_handle.h"
+
+#include "base/sequenced_task_runner.h"
+#include "base/thread_task_runner_handle.h"
+#include "base/threading/sequenced_worker_pool.h"
+
+namespace base {
+
+// static
+scoped_refptr<SequencedTaskRunner> SequencedTaskRunnerHandle::Get() {
+  // If we are on a worker thread for a SequencedBlockingPool that is running a
+  // sequenced task, return a SequencedTaskRunner for it.
+  scoped_refptr<base::SequencedWorkerPool> pool =
+      SequencedWorkerPool::GetWorkerPoolForCurrentThread();
+  if (pool) {
+    SequencedWorkerPool::SequenceToken sequence_token =
+        SequencedWorkerPool::GetSequenceTokenForCurrentThread();
+    DCHECK(sequence_token.IsValid());
+    DCHECK(pool->IsRunningSequenceOnCurrentThread(sequence_token));
+    return pool->GetSequencedTaskRunner(sequence_token);
+  }
+
+  // Otherwise, return a SingleThreadTaskRunner for the current thread.
+  return base::ThreadTaskRunnerHandle::Get();
+}
+
+// static
+bool SequencedTaskRunnerHandle::IsSet() {
+  return (SequencedWorkerPool::GetWorkerPoolForCurrentThread() &&
+          SequencedWorkerPool::GetSequenceTokenForCurrentThread().IsValid()) ||
+         base::ThreadTaskRunnerHandle::IsSet();
+}
+
+}  // namespace base

diff --git a/base/threading/sequenced_task_runner_handle.h b/base/threading/sequenced_task_runner_handle.h
new file mode 100644
index 0000000..c638d2fb
--- /dev/null
+++ b/base/threading/sequenced_task_runner_handle.h

@@ -0,0 +1,36 @@
+// Copyright 2015 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef BASE_THREADING_SEQUENCED_TASK_RUNNER_HANDLE_H_
+#define BASE_THREADING_SEQUENCED_TASK_RUNNER_HANDLE_H_
+
+#include "base/compiler_specific.h"
+#include "base/memory/ref_counted.h"
+
+namespace base {
+
+class SequencedTaskRunner;
+
+class BASE_EXPORT SequencedTaskRunnerHandle {
+ public:
+  // Returns a SequencedTaskRunner which guarantees that posted tasks will only
+  // run after the current task is finished and will satisfy a SequenceChecker.
+  // It should only be called if IsSet() returns true (see the comment there for
+  // the requirements).
+  static scoped_refptr<SequencedTaskRunner> Get();
+
+  // Returns true if one of the following conditions is fulfilled:
+  // a) The current thread has a ThreadTaskRunnerHandle (which includes any
+  //    thread that has a MessageLoop associated with it), or
+  // b) The current thread is a worker thread belonging to a SequencedWorkerPool
+  //    *and* is currently running a sequenced task.
+  static bool IsSet();
+
+ private:
+  DISALLOW_IMPLICIT_CONSTRUCTORS(SequencedTaskRunnerHandle);
+};
+
+}  // namespace base
+
+#endif  // BASE_THREADING_SEQUENCED_TASK_RUNNER_HANDLE_H_

diff --git a/base/threading/sequenced_task_runner_handle_unittest.cc b/base/threading/sequenced_task_runner_handle_unittest.cc
new file mode 100644
index 0000000..df7a1175
--- /dev/null
+++ b/base/threading/sequenced_task_runner_handle_unittest.cc

@@ -0,0 +1,81 @@
+// Copyright 2015 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "base/bind.h"
+#include "base/callback.h"
+#include "base/location.h"
+#include "base/memory/ref_counted.h"
+#include "base/memory/scoped_ptr.h"
+#include "base/message_loop/message_loop.h"
+#include "base/run_loop.h"
+#include "base/sequence_checker_impl.h"
+#include "base/sequenced_task_runner.h"
+#include "base/synchronization/waitable_event.h"
+#include "base/threading/sequenced_task_runner_handle.h"
+#include "base/threading/sequenced_worker_pool.h"
+#include "base/threading/simple_thread.h"
+#include "testing/gtest/include/gtest/gtest.h"
+
+namespace base {
+namespace {
+
+class SequencedTaskRunnerHandleTest : public ::testing::Test {
+ protected:
+  static void GetTaskRunner(const Closure& callback) {
+    // Use SequenceCheckerImpl to make sure it's not a no-op in Release builds.
+    scoped_ptr<SequenceCheckerImpl> sequence_checker(new SequenceCheckerImpl);
+    ASSERT_TRUE(SequencedTaskRunnerHandle::IsSet());
+    scoped_refptr<SequencedTaskRunner> task_runner =
+        SequencedTaskRunnerHandle::Get();
+    ASSERT_TRUE(task_runner);
+    task_runner->PostTask(
+        FROM_HERE, base::Bind(&SequencedTaskRunnerHandleTest::CheckValidThread,
+                              base::Passed(&sequence_checker), callback));
+  }
+
+ private:
+  static void CheckValidThread(scoped_ptr<SequenceCheckerImpl> sequence_checker,
+                               const Closure& callback) {
+    EXPECT_TRUE(sequence_checker->CalledOnValidSequencedThread());
+    callback.Run();
+  }
+
+  MessageLoop message_loop_;
+};
+
+TEST_F(SequencedTaskRunnerHandleTest, FromMessageLoop) {
+  RunLoop run_loop;
+  GetTaskRunner(run_loop.QuitClosure());
+  run_loop.Run();
+}
+
+TEST_F(SequencedTaskRunnerHandleTest, FromSequencedWorkerPool) {
+  scoped_refptr<SequencedWorkerPool> pool(new SequencedWorkerPool(3, "Test"));
+  WaitableEvent event(false, false);
+  pool->PostSequencedWorkerTask(
+      pool->GetSequenceToken(), FROM_HERE,
+      base::Bind(&SequencedTaskRunnerHandleTest::GetTaskRunner,
+                 base::Bind(&WaitableEvent::Signal, base::Unretained(&event))));
+  event.Wait();
+}
+
+class ThreadRunner : public DelegateSimpleThread::Delegate {
+ public:
+  void Run() override {
+    ASSERT_FALSE(SequencedTaskRunnerHandle::IsSet());
+  }
+
+ private:
+  Closure callback_;
+};
+
+TEST_F(SequencedTaskRunnerHandleTest, FromSimpleThread) {
+  ThreadRunner thread_runner;
+  DelegateSimpleThread thread(&thread_runner, "Background thread");
+  thread.Start();
+  thread.Join();
+}
+
+}  // namespace
+}  // namespace base

diff --git a/base/threading/sequenced_worker_pool.cc b/base/threading/sequenced_worker_pool.cc
index 54a6bc82..ed79897 100644
--- a/base/threading/sequenced_worker_pool.cc
+++ b/base/threading/sequenced_worker_pool.cc

@@ -219,10 +219,6 @@
          static_cast<uint64>(reinterpret_cast<intptr_t>(pool));
 }
 
-base::LazyInstance<base::ThreadLocalPointer<
-    SequencedWorkerPool::SequenceToken> >::Leaky g_lazy_tls_ptr =
-        LAZY_INSTANCE_INITIALIZER;
-
 }  // namespace
 
 // Worker ---------------------------------------------------------------------
@@ -239,6 +235,9 @@
   // SimpleThread implementation. This actually runs the background thread.
   void Run() override;
 
+  // Gets the worker for the current thread out of thread-local storage.
+  static Worker* GetForCurrentThread();
+
   // Indicates that a task is about to be run. The parameters provide
   // additional metainformation about the task being run.
   void set_running_task_info(SequenceToken token,
@@ -264,7 +263,14 @@
     return task_shutdown_behavior_;
   }
 
+  scoped_refptr<SequencedWorkerPool> worker_pool() const {
+    return worker_pool_;
+  }
+
  private:
+  static LazyInstance<ThreadLocalPointer<SequencedWorkerPool::Worker>>::Leaky
+      lazy_tls_ptr_;
+
   scoped_refptr<SequencedWorkerPool> worker_pool_;
   // The sequence token of the task being processed. Only valid when
   // is_processing_task_ is true.
@@ -508,9 +514,10 @@
   win::ScopedCOMInitializer com_initializer;
 #endif
 
-  // Store a pointer to the running sequence in thread local storage for
-  // static function access.
-  g_lazy_tls_ptr.Get().Set(&task_sequence_token_);
+  // Store a pointer to this worker in thread local storage for static function
+  // access.
+  DCHECK(!lazy_tls_ptr_.Get().Get());
+  lazy_tls_ptr_.Get().Set(this);
 
   // Just jump back to the Inner object to run the thread, since it has all the
   // tracking information and queues. It might be more natural to implement
@@ -519,9 +526,23 @@
   // send thread-specific information easily to the thread loop.
   worker_pool_->inner_->ThreadLoop(this);
   // Release our cyclic reference once we're done.
-  worker_pool_ = NULL;
+  worker_pool_ = nullptr;
 }
 
+// static
+SequencedWorkerPool::Worker*
+SequencedWorkerPool::Worker::GetForCurrentThread() {
+  // Don't construct lazy instance on check.
+  if (lazy_tls_ptr_ == nullptr)
+    return nullptr;
+
+  return lazy_tls_ptr_.Get().Get();
+}
+
+// static
+LazyInstance<ThreadLocalPointer<SequencedWorkerPool::Worker>>::Leaky
+    SequencedWorkerPool::Worker::lazy_tls_ptr_ = LAZY_INSTANCE_INITIALIZER;
+
 // Inner definitions ---------------------------------------------------------
 
 SequencedWorkerPool::Inner::Inner(
@@ -1145,17 +1166,28 @@
 
 // SequencedWorkerPool --------------------------------------------------------
 
+std::string SequencedWorkerPool::SequenceToken::ToString() const {
+  return base::StringPrintf("[%d]", id_);
+}
+
 // static
 SequencedWorkerPool::SequenceToken
 SequencedWorkerPool::GetSequenceTokenForCurrentThread() {
-  // Don't construct lazy instance on check.
-  if (g_lazy_tls_ptr == NULL)
+  Worker* worker = Worker::GetForCurrentThread();
+  if (!worker)
     return SequenceToken();
 
-  SequencedWorkerPool::SequenceToken* token = g_lazy_tls_ptr.Get().Get();
-  if (!token)
-    return SequenceToken();
-  return *token;
+  return worker->task_sequence_token();
+}
+
+// static
+scoped_refptr<SequencedWorkerPool>
+SequencedWorkerPool::GetWorkerPoolForCurrentThread() {
+  Worker* worker = Worker::GetForCurrentThread();
+  if (!worker)
+    return nullptr;
+
+  return worker->worker_pool();
 }
 
 SequencedWorkerPool::SequencedWorkerPool(size_t max_threads,

diff --git a/base/threading/sequenced_worker_pool.h b/base/threading/sequenced_worker_pool.h
index ee282bc2..9369fb7ad 100644
--- a/base/threading/sequenced_worker_pool.h
+++ b/base/threading/sequenced_worker_pool.h

@@ -121,7 +121,7 @@
 
   // Opaque identifier that defines sequencing of tasks posted to the worker
   // pool.
-  class SequenceToken {
+  class BASE_EXPORT SequenceToken {
    public:
     SequenceToken() : id_(0) {}
     ~SequenceToken() {}
@@ -135,6 +135,10 @@
       return id_ != 0;
     }
 
+    // Returns a string representation of this token. This method should only be
+    // used for debugging.
+    std::string ToString() const;
+
    private:
     friend class SequencedWorkerPool;
 
@@ -157,17 +161,21 @@
   // an unsequenced task, returns an invalid SequenceToken.
   static SequenceToken GetSequenceTokenForCurrentThread();
 
+  // Returns the SequencedWorkerPool that owns this thread, or null if the
+  // current thread is not a SequencedWorkerPool worker thread.
+  static scoped_refptr<SequencedWorkerPool> GetWorkerPoolForCurrentThread();
+
   // When constructing a SequencedWorkerPool, there must be a
-  // MessageLoop on the current thread unless you plan to deliberately
-  // leak it.
+  // ThreadTaskRunnerHandle on the current thread unless you plan to
+  // deliberately leak it.
 
   // Pass the maximum number of threads (they will be lazily created as needed)
   // and a prefix for the thread name to aid in debugging.
   SequencedWorkerPool(size_t max_threads,
                       const std::string& thread_name_prefix);
 
-  // Like above, but with |observer| for testing.  Does not take
-  // ownership of |observer|.
+  // Like above, but with |observer| for testing.  Does not take ownership of
+  // |observer|.
   SequencedWorkerPool(size_t max_threads,
                       const std::string& thread_name_prefix,
                       TestingObserver* observer);

diff --git a/base/threading/sequenced_worker_pool_unittest.cc b/base/threading/sequenced_worker_pool_unittest.cc
index bf82b11..5812ee7 100644
--- a/base/threading/sequenced_worker_pool_unittest.cc
+++ b/base/threading/sequenced_worker_pool_unittest.cc

@@ -904,6 +904,49 @@
   pool()->FlushForTesting();
 }
 
+namespace {
+
+void CheckWorkerPoolAndSequenceToken(
+    const scoped_refptr<SequencedWorkerPool>& expected_pool,
+    SequencedWorkerPool::SequenceToken expected_token) {
+  SequencedWorkerPool::SequenceToken token =
+      SequencedWorkerPool::GetSequenceTokenForCurrentThread();
+  EXPECT_EQ(expected_token.ToString(), token.ToString());
+
+  scoped_refptr<SequencedWorkerPool> pool =
+      SequencedWorkerPool::GetWorkerPoolForCurrentThread();
+  EXPECT_EQ(expected_pool, pool);
+}
+
+}  // namespace
+
+TEST_F(SequencedWorkerPoolTest, GetWorkerPoolAndSequenceTokenForCurrentThread) {
+  EnsureAllWorkersCreated();
+
+  // The current thread should have neither a worker pool nor a sequence token.
+  SequencedWorkerPool::SequenceToken local_token =
+      SequencedWorkerPool::GetSequenceTokenForCurrentThread();
+  scoped_refptr<SequencedWorkerPool> local_pool =
+      SequencedWorkerPool::GetWorkerPoolForCurrentThread();
+  EXPECT_FALSE(local_token.IsValid()) << local_token.ToString();
+  EXPECT_FALSE(local_pool);
+
+  SequencedWorkerPool::SequenceToken token1 = pool()->GetSequenceToken();
+  SequencedWorkerPool::SequenceToken token2 = pool()->GetSequenceToken();
+  pool()->PostSequencedWorkerTask(
+      token1, FROM_HERE,
+      base::Bind(&CheckWorkerPoolAndSequenceToken, pool(), token1));
+  pool()->PostSequencedWorkerTask(
+      token2, FROM_HERE,
+      base::Bind(&CheckWorkerPoolAndSequenceToken, pool(), token2));
+
+  pool()->PostWorkerTask(FROM_HERE,
+                         base::Bind(&CheckWorkerPoolAndSequenceToken, pool(),
+                                    SequencedWorkerPool::SequenceToken()));
+
+  pool()->FlushForTesting();
+}
+
 TEST(SequencedWorkerPoolRefPtrTest, ShutsDownCleanWithContinueOnShutdown) {
   MessageLoop loop;
   scoped_refptr<SequencedWorkerPool> pool(new SequencedWorkerPool(3, "Pool"));

diff --git a/chrome/BUILD.gn b/chrome/BUILD.gn
index 8816e81..4f3cd21 100644
--- a/chrome/BUILD.gn
+++ b/chrome/BUILD.gn

@@ -969,6 +969,7 @@
       "//chrome/browser",
       "//chrome/browser/ui",
       "//chrome/child",
+      "//chrome/common",
       "//chrome/plugin",
       "//chrome/renderer",
       "//chrome/utility",

diff --git a/chrome/VERSION b/chrome/VERSION
index 20735ba2..27a0a0d 100644
--- a/chrome/VERSION
+++ b/chrome/VERSION

@@ -1,4 +1,4 @@
 MAJOR=48
 MINOR=0
-BUILD=2550
+BUILD=2551
 PATCH=0

diff --git a/chrome/android/java/res/drawable-v21/web_notification_button_background.xml b/chrome/android/java/res/drawable-v21/web_notification_button_background.xml
new file mode 100644
index 0000000..4f2a406
--- /dev/null
+++ b/chrome/android/java/res/drawable-v21/web_notification_button_background.xml

@@ -0,0 +1,10 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Copyright 2015 The Chromium Authors. All rights reserved.
+     Use of this source code is governed by a BSD-style license that can be
+     found in the LICENSE file. -->
+
+<ripple xmlns:android="http://schemas.android.com/apk/res/android"
+    android:color="@color/ripple_material_light">
+    <item android:id="@android:id/mask"
+          android:drawable="@drawable/button_compat_shape" />
+</ripple>

diff --git a/chrome/android/java/res/layout/web_notification.xml b/chrome/android/java/res/layout/web_notification.xml
index ae14b37..4d88fd04 100644
--- a/chrome/android/java/res/layout/web_notification.xml
+++ b/chrome/android/java/res/layout/web_notification.xml

@@ -35,8 +35,12 @@
         android:id="@+id/time"
         android:layout_width="wrap_content"
         android:layout_height="wrap_content"
+        android:layout_alignBaseline="@id/title"
         android:layout_alignParentEnd="true"
         android:layout_alignParentTop="true"
+        android:layout_marginEnd="8dp"
+        android:layout_marginStart="8dp"
+        android:layout_marginTop="8dp"
         android:singleLine="true"
         style="@style/WebNotificationTime"/>
 

diff --git a/chrome/android/java/res/layout/web_notification_big.xml b/chrome/android/java/res/layout/web_notification_big.xml
index 2b925101..ebf07b28 100644
--- a/chrome/android/java/res/layout/web_notification_big.xml
+++ b/chrome/android/java/res/layout/web_notification_big.xml

@@ -57,12 +57,16 @@
 
             <TextView
                 android:id="@+id/time"
-                style="@style/WebNotificationTime"
                 android:layout_width="wrap_content"
                 android:layout_height="wrap_content"
+                android:layout_alignBaseline="@id/title"
                 android:layout_alignParentEnd="true"
                 android:layout_alignParentTop="true"
-                android:singleLine="true"/>
+                android:layout_marginEnd="8dp"
+                android:layout_marginStart="8dp"
+                android:layout_marginTop="8dp"
+                android:singleLine="true"
+                style="@style/WebNotificationTime"/>
 
         </RelativeLayout>
 
@@ -81,7 +85,7 @@
             style="@style/WebNotificationDivider"
             android:layout_width="match_parent"
             android:layout_height="1dp"
-            android:layout_marginBottom="8dp"
+            android:layout_marginTop="2dp"
             android:contentDescription="@null"
             android:visibility="gone"/>
 
@@ -89,8 +93,8 @@
             android:id="@+id/buttons"
             android:layout_width="match_parent"
             android:layout_height="wrap_content"
+            android:layout_marginStart="-8dp"
             android:orientation="horizontal"        
-            android:layout_marginBottom="8dp"
             android:visibility="gone"/>
 
         <ImageView

diff --git a/chrome/android/java/res/layout/web_notification_button.xml b/chrome/android/java/res/layout/web_notification_button.xml
index fe50ade..37cef2b9 100644
--- a/chrome/android/java/res/layout/web_notification_button.xml
+++ b/chrome/android/java/res/layout/web_notification_button.xml

@@ -9,9 +9,9 @@
     android:gravity="start|center_vertical"
     android:id="@+id/button"
     android:layout_height="48dp"
-    android:layout_marginEnd="8dp"
     android:layout_weight="1"
     android:layout_width="0dp"
+    android:paddingStart="8dp"
     android:singleLine="true"
     android:textSize="13sp"
     style="@style/WebNotificationButton"/>

diff --git a/chrome/android/java/res/values-v21/styles.xml b/chrome/android/java/res/values-v21/styles.xml
index 9ad08b6..dafaad9 100644
--- a/chrome/android/java/res/values-v21/styles.xml
+++ b/chrome/android/java/res/values-v21/styles.xml

@@ -78,8 +78,8 @@
     </style>
     <style name="WebNotificationButton"
         parent="@android:style/Widget.DeviceDefault.Light.Button.Borderless.Small">
-        <!-- From the non-public Color secondary_text_default_material_light -->
-        <item name="android:textColor">#8a000000</item>
+        <item name="android:textColor">@color/secondary_text_default_material_light</item>
+        <item name="android:background">@drawable/web_notification_button_background</item>
     </style>
 
     <style name="IncognitoTheme" parent="MainTheme">

diff --git a/chrome/browser/BUILD.gn b/chrome/browser/BUILD.gn
index a0c1bd3..653714d 100644
--- a/chrome/browser/BUILD.gn
+++ b/chrome/browser/BUILD.gn

@@ -6,6 +6,7 @@
 import("//build/config/crypto.gni")
 import("//build/config/features.gni")
 import("//build/config/ui.gni")
+import("//media/media_options.gni")
 import("//third_party/protobuf/proto_library.gni")
 
 # //build/config/android/rules.gni imports //tools/grit/grit_rule.gni, which
@@ -886,6 +887,14 @@
   if (enable_media_router) {
     deps += [ "//chrome/browser/media/router" ]
   }
+
+  if (enable_mojo_media != "none") {
+    configs += [ "//media/mojo/services:enable_mojo_media_config" ]
+  }
+
+  if (enable_mojo_media == "utility") {
+    deps += [ "//media/mojo/services:application" ]
+  }
 }
 
 if (is_android) {

diff --git a/chrome/browser/android/foreign_session_helper.cc b/chrome/browser/android/foreign_session_helper.cc
index 428aec4..0a2ffdfd 100644
--- a/chrome/browser/android/foreign_session_helper.cc
+++ b/chrome/browser/android/foreign_session_helper.cc

@@ -158,9 +158,6 @@
   // NOTE: The ProfileSyncService can be null in tests.
   if (service)
     scoped_observer_.Add(service);
-
-  registrar_.Add(this, chrome::NOTIFICATION_FOREIGN_SESSION_UPDATED,
-                 content::Source<Profile>(profile));
 }
 
 ForeignSessionHelper::~ForeignSessionHelper() {
@@ -200,19 +197,11 @@
   Java_ForeignSessionCallback_onUpdated(env, callback_.obj());
 }
 
-void ForeignSessionHelper::Observe(
-    int type, const content::NotificationSource& source,
-    const content::NotificationDetails& details) {
-  switch (type) {
-    case chrome::NOTIFICATION_FOREIGN_SESSION_UPDATED:
-      FireForeignSessionCallback();
-      break;
-    default:
-      NOTREACHED();
-  }
+void ForeignSessionHelper::OnSyncConfigurationCompleted() {
+  FireForeignSessionCallback();
 }
 
-void ForeignSessionHelper::OnSyncConfigurationCompleted() {
+void ForeignSessionHelper::OnForeignSessionUpdated() {
   FireForeignSessionCallback();
 }
 

diff --git a/chrome/browser/android/foreign_session_helper.h b/chrome/browser/android/foreign_session_helper.h
index 2eb47bc2..5c4a9bc 100644
--- a/chrome/browser/android/foreign_session_helper.h
+++ b/chrome/browser/android/foreign_session_helper.h

@@ -11,8 +11,6 @@
 #include "base/scoped_observer.h"
 #include "chrome/browser/profiles/profile.h"
 #include "components/sync_driver/sync_service_observer.h"
-#include "content/public/browser/notification_observer.h"
-#include "content/public/browser/notification_registrar.h"
 
 using base::android::ScopedJavaLocalRef;
 
@@ -26,8 +24,7 @@
 class SyncService;
 }  // namespace sync_driver
 
-class ForeignSessionHelper : public content::NotificationObserver,
-                             public sync_driver::SyncServiceObserver {
+class ForeignSessionHelper : public sync_driver::SyncServiceObserver {
  public:
   explicit ForeignSessionHelper(Profile* profile);
   void Destroy(JNIEnv* env, jobject obj);
@@ -43,14 +40,10 @@
                                  jint disposition);
   void DeleteForeignSession(JNIEnv* env, jobject obj, jstring session_tag);
 
-  // NotificationObserver implemenation
-  void Observe(int type,
-               const content::NotificationSource& source,
-               const content::NotificationDetails& details) override;
-
   // sync_driver::SyncServiceObserver implementation
   void OnStateChanged() override {}
   void OnSyncConfigurationCompleted() override;
+  void OnForeignSessionUpdated() override;
 
   static bool RegisterForeignSessionHelper(JNIEnv* env);
 
@@ -62,7 +55,6 @@
 
   Profile* profile_;  // weak
   base::android::ScopedJavaGlobalRef<jobject> callback_;
-  content::NotificationRegistrar registrar_;
   ScopedObserver<sync_driver::SyncService, sync_driver::SyncServiceObserver>
       scoped_observer_;
 

diff --git a/chrome/browser/autofill/autofill_server_browsertest.cc b/chrome/browser/autofill/autofill_server_browsertest.cc
index 39062f1..6ba735f 100644
--- a/chrome/browser/autofill/autofill_server_browsertest.cc
+++ b/chrome/browser/autofill/autofill_server_browsertest.cc

@@ -163,7 +163,7 @@
       " formsignature=\"15916856893790176210\""
       " autofillused=\"false\""
       " datapresent=\"1f7e0003780000080004\""
-      " actionsignature=\"15724779818122431245\">"
+      " actionsignature=\"15724779818122431245\" formname=\"test_form\">"
       "<field signature=\"2594484045\" name=\"one\" type=\"text\""
       " autofilltype=\"2\"/>"
       "<field signature=\"2750915947\" name=\"two\" type=\"text\""

diff --git a/chrome/browser/chrome_browser_main_win.cc b/chrome/browser/chrome_browser_main_win.cc
index 0e2e53a..5c90b54 100644
--- a/chrome/browser/chrome_browser_main_win.cc
+++ b/chrome/browser/chrome_browser_main_win.cc

@@ -252,11 +252,10 @@
     base::FilePath chrome_exe;
     if (PathService::Get(base::FILE_EXE, &chrome_exe)) {
       ShellUtil::ShortcutLocation user_shortcut_locations[] = {
-          ShellUtil::SHORTCUT_LOCATION_DESKTOP,
-          ShellUtil::SHORTCUT_LOCATION_QUICK_LAUNCH,
-          ShellUtil::SHORTCUT_LOCATION_START_MENU_ROOT,
-          ShellUtil::SHORTCUT_LOCATION_START_MENU_CHROME_DIR_DEPRECATED,
-          ShellUtil::SHORTCUT_LOCATION_START_MENU_CHROME_APPS_DIR,
+        ShellUtil::SHORTCUT_LOCATION_DESKTOP,
+        ShellUtil::SHORTCUT_LOCATION_QUICK_LAUNCH,
+        ShellUtil::SHORTCUT_LOCATION_START_MENU_CHROME_DIR,
+        ShellUtil::SHORTCUT_LOCATION_START_MENU_CHROME_APPS_DIR,
       };
       BrowserDistribution* dist = BrowserDistribution::GetDistribution();
       for (size_t i = 0; i < arraysize(user_shortcut_locations); ++i) {

diff --git a/chrome/browser/chrome_content_browser_client.cc b/chrome/browser/chrome_content_browser_client.cc
index 27a4cb35..c7b7972 100644
--- a/chrome/browser/chrome_content_browser_client.cc
+++ b/chrome/browser/chrome_content_browser_client.cc

@@ -2593,6 +2593,14 @@
   registry->AddService(base::Bind(&CreateUsbDeviceManager, render_frame_host));
 }
 
+void ChromeContentBrowserClient::RegisterOutOfProcessMojoApplications(
+      OutOfProcessMojoApplicationMap* apps) {
+#if defined(ENABLE_MOJO_MEDIA_IN_UTILITY_PROCESS)
+  apps->insert(std::make_pair(GURL("mojo:media"),
+                              base::ASCIIToUTF16("Media App")));
+#endif
+}
+
 void ChromeContentBrowserClient::OpenURL(
     content::BrowserContext* browser_context,
     const content::OpenURLParams& params,

diff --git a/chrome/browser/chrome_content_browser_client.h b/chrome/browser/chrome_content_browser_client.h
index 0b0debac..a1256530b 100644
--- a/chrome/browser/chrome_content_browser_client.h
+++ b/chrome/browser/chrome_content_browser_client.h

@@ -280,6 +280,8 @@
   void RegisterRenderFrameMojoServices(
       content::ServiceRegistry* registry,
       content::RenderFrameHost* render_frame_host) override;
+  void RegisterOutOfProcessMojoApplications(
+      OutOfProcessMojoApplicationMap* apps) override;
   void OpenURL(content::BrowserContext* browser_context,
                const content::OpenURLParams& params,
                const base::Callback<void(content::WebContents*)>& callback)

diff --git a/chrome/browser/extensions/crx_installer.cc b/chrome/browser/extensions/crx_installer.cc
index 898c814..0506b8f8 100644
--- a/chrome/browser/extensions/crx_installer.cc
+++ b/chrome/browser/extensions/crx_installer.cc

@@ -309,12 +309,15 @@
           l10n_util::GetStringUTF16(IDS_EXTENSION_MANIFEST_INVALID));
   }
 
-  // The checks below are skipped for themes and external installs.
+  // The checks below are skipped for themes, external installs, and bookmark
+  // apps.
   // TODO(pamg): After ManagementPolicy refactoring is complete, remove this
   // and other uses of install_source_ that are no longer needed now that the
   // SandboxedUnpacker sets extension->location.
-  if (extension->is_theme() || Manifest::IsExternalLocation(install_source_))
+  if (extension->is_theme() || extension->from_bookmark() ||
+      Manifest::IsExternalLocation(install_source_)) {
     return CrxInstallError();
+  }
 
   if (!extensions_enabled_) {
     return CrxInstallError(
@@ -509,11 +512,16 @@
     }
   }
 
-  // Run the policy, requirements and blacklist checks in parallel.
-  install_checker_.Start(
-      ExtensionInstallChecker::CHECK_ALL,
-      false /* fail fast */,
-      base::Bind(&CrxInstaller::OnInstallChecksComplete, this));
+  // Run the policy, requirements and blacklist checks in parallel. Skip the
+  // checks if the extension is a bookmark app.
+  if (extension()->from_bookmark()) {
+    CrxInstaller::OnInstallChecksComplete(0);
+  } else {
+    install_checker_.Start(
+        ExtensionInstallChecker::CHECK_ALL,
+        false /* fail fast */,
+        base::Bind(&CrxInstaller::OnInstallChecksComplete, this));
+  }
 }
 
 void CrxInstaller::OnInstallChecksComplete(int failed_checks) {

diff --git a/chrome/browser/extensions/crx_installer.h b/chrome/browser/extensions/crx_installer.h
index 9c109e6..c5e61d3 100644
--- a/chrome/browser/extensions/crx_installer.h
+++ b/chrome/browser/extensions/crx_installer.h

@@ -345,8 +345,8 @@
   bool fail_install_if_unexpected_version_;
 
   // Whether manual extension installation is enabled. We can't just check this
-  // before trying to install because themes are special-cased to always be
-  // allowed.
+  // before trying to install because themes and bookmark apps are special-cased
+  // to always be allowed.
   bool extensions_enabled_;
 
   // Whether we're supposed to delete the source file on destruction. Defaults

diff --git a/chrome/browser/media/router/media_router_mojo_impl.cc b/chrome/browser/media/router/media_router_mojo_impl.cc
index 3af7eb7..4e3f20a6 100644
--- a/chrome/browser/media/router/media_router_mojo_impl.cc
+++ b/chrome/browser/media/router/media_router_mojo_impl.cc

@@ -31,13 +31,6 @@
 
 namespace {
 
-// TODO(imcheng): We should handle failure in this case. One way is to invoke
-// all pending requests with failure. (crbug.com/490787)
-void EventPageWakeComplete(bool success) {
-  if (!success)
-    LOG(ERROR) << "An error encountered while waking the event page.";
-}
-
 scoped_ptr<content::PresentationSessionMessage>
 ConvertToPresentationSessionMessage(interfaces::RouteMessagePtr input) {
   DCHECK(!input.is_null());
@@ -104,7 +97,9 @@
     : event_page_tracker_(event_page_tracker),
       instance_id_(base::GenerateGUID()),
       has_local_route_(false),
-      availability_(interfaces::MediaRouter::SINK_AVAILABILITY_AVAILABLE) {
+      availability_(interfaces::MediaRouter::SINK_AVAILABILITY_AVAILABLE),
+      wakeup_attempt_count_(0),
+      weak_factory_(this) {
   DCHECK(event_page_tracker_);
 }
 
@@ -141,13 +136,21 @@
   media_route_provider_extension_id_ = extension_id;
 }
 
-// TODO(imcheng): If this occurs while there are pending requests, we should
-// probably invoke them with failure. (crbug.com/490787)
 void MediaRouterMojoImpl::OnConnectionError() {
   DCHECK(thread_checker_.CalledOnValidThread());
 
   media_route_provider_.reset();
   binding_.reset();
+
+  // If |OnConnectionError| is invoked while there are pending requests, then
+  // it means we tried to wake the extension, but weren't able to complete the
+  // connection to media route provider. Since we do not know whether the error
+  // is transient, reattempt the wakeup.
+  if (!pending_requests_.empty()) {
+    DLOG_WITH_INSTANCE(ERROR) << "A connection error while there are pending "
+                                 "requests.";
+    AttemptWakeEventPage();
+  }
 }
 
 void MediaRouterMojoImpl::RegisterMediaRouteProvider(
@@ -156,11 +159,21 @@
         callback) {
   DCHECK(thread_checker_.CalledOnValidThread());
 
+  if (event_page_tracker_->IsEventPageSuspended(
+          media_route_provider_extension_id_)) {
+    DVLOG_WITH_INSTANCE(1)
+        << "ExecutePendingRequests was called while extension is suspended.";
+    media_route_provider_.reset();
+    AttemptWakeEventPage();
+    return;
+  }
+
   media_route_provider_ = media_route_provider_ptr.Pass();
   media_route_provider_.set_connection_error_handler(base::Bind(
       &MediaRouterMojoImpl::OnConnectionError, base::Unretained(this)));
   callback.Run(instance_id_);
   ExecutePendingRequests();
+  wakeup_attempt_count_ = 0;
 }
 
 void MediaRouterMojoImpl::OnIssue(const interfaces::IssuePtr issue) {
@@ -685,6 +698,11 @@
 
 void MediaRouterMojoImpl::EnqueueTask(const base::Closure& closure) {
   pending_requests_.push_back(closure);
+  if (pending_requests_.size() > kMaxPendingRequests) {
+    DLOG_WITH_INSTANCE(ERROR) << "Reached max queue size. Dropping oldest "
+                              << "request.";
+    pending_requests_.pop_front();
+  }
   DVLOG_WITH_INSTANCE(2) << "EnqueueTask (queue-length="
                          << pending_requests_.size() << ")";
 }
@@ -699,11 +717,7 @@
                  media_route_provider_extension_id_)) {
     DVLOG_WITH_INSTANCE(1) << "Waking event page.";
     EnqueueTask(request);
-    if (!event_page_tracker_->WakeEventPage(
-            media_route_provider_extension_id_,
-            base::Bind(&EventPageWakeComplete))) {
-      LOG(ERROR) << "An error encountered while waking the event page.";
-    }
+    AttemptWakeEventPage();
     media_route_provider_.reset();
   } else if (!media_route_provider_) {
     DVLOG_WITH_INSTANCE(1) << "Extension is awake, awaiting ProvideMediaRouter "
@@ -714,23 +728,57 @@
   }
 }
 
+void MediaRouterMojoImpl::AttemptWakeEventPage() {
+  ++wakeup_attempt_count_;
+  if (wakeup_attempt_count_ > kMaxWakeupAttemptCount) {
+    DLOG_WITH_INSTANCE(ERROR) << "Attempted too many times to wake up event "
+                              << "page.";
+    DrainPendingRequests();
+    wakeup_attempt_count_ = 0;
+    return;
+  }
+
+  DVLOG_WITH_INSTANCE(1) << "Attempting to wake up event page: attempt "
+                         << wakeup_attempt_count_;
+
+  // This return false if the extension is already awake.
+  // Callback is bound using WeakPtr because |event_page_tracker_| outlives
+  // |this|.
+  if (!event_page_tracker_->WakeEventPage(
+          media_route_provider_extension_id_,
+          base::Bind(&MediaRouterMojoImpl::EventPageWakeComplete,
+                     weak_factory_.GetWeakPtr()))) {
+    DLOG_WITH_INSTANCE(ERROR) << "Failed to schedule a wakeup for event page.";
+  }
+}
+
 void MediaRouterMojoImpl::ExecutePendingRequests() {
   DCHECK(thread_checker_.CalledOnValidThread());
   DCHECK(media_route_provider_);
   DCHECK(event_page_tracker_);
   DCHECK(!media_route_provider_extension_id_.empty());
 
-  if (event_page_tracker_->IsEventPageSuspended(
-          media_route_provider_extension_id_)) {
-    DVLOG_WITH_INSTANCE(1)
-        << "ExecutePendingRequests was called while extension is suspended.";
-    return;
-  }
-
   for (const auto& next_request : pending_requests_)
     next_request.Run();
 
   pending_requests_.clear();
 }
 
+void MediaRouterMojoImpl::EventPageWakeComplete(bool success) {
+  if (success)
+    return;
+
+  // This is likely an non-retriable error. Drop the pending requests.
+  DLOG_WITH_INSTANCE(ERROR)
+      << "An error encountered while waking the event page.";
+  DrainPendingRequests();
+}
+
+void MediaRouterMojoImpl::DrainPendingRequests() {
+  DLOG_WITH_INSTANCE(ERROR)
+      << "Draining request queue. (queue-length=" << pending_requests_.size()
+      << ")";
+  pending_requests_.clear();
+}
+
 }  // namespace media_router

diff --git a/chrome/browser/media/router/media_router_mojo_impl.h b/chrome/browser/media/router/media_router_mojo_impl.h
index a2dacee..08ad41a 100644
--- a/chrome/browser/media/router/media_router_mojo_impl.h
+++ b/chrome/browser/media/router/media_router_mojo_impl.h

@@ -5,6 +5,7 @@
 #ifndef CHROME_BROWSER_MEDIA_ROUTER_MEDIA_ROUTER_MOJO_IMPL_H_
 #define CHROME_BROWSER_MEDIA_ROUTER_MEDIA_ROUTER_MOJO_IMPL_H_
 
+#include <deque>
 #include <map>
 #include <set>
 #include <string>
@@ -98,7 +99,6 @@
   friend class MediaRouterFactory;
   friend class MediaRouterMojoExtensionTest;
   friend class MediaRouterMojoTest;
-
   FRIEND_TEST_ALL_PREFIXES(MediaRouterMojoImplTest,
                            RegisterAndUnregisterMediaSinksObserver);
   FRIEND_TEST_ALL_PREFIXES(MediaRouterMojoImplTest,
@@ -111,6 +111,22 @@
   FRIEND_TEST_ALL_PREFIXES(MediaRouterMojoImplTest, HandleIssue);
   FRIEND_TEST_ALL_PREFIXES(MediaRouterMojoExtensionTest,
                            DeferredBindingAndSuspension);
+  FRIEND_TEST_ALL_PREFIXES(MediaRouterMojoExtensionTest,
+                           DrainPendingRequestQueue);
+  FRIEND_TEST_ALL_PREFIXES(MediaRouterMojoExtensionTest,
+                           DropOldestPendingRequest);
+  FRIEND_TEST_ALL_PREFIXES(MediaRouterMojoExtensionTest,
+                           AttemptedWakeupTooManyTimes);
+  FRIEND_TEST_ALL_PREFIXES(MediaRouterMojoExtensionTest,
+                           WakeupFailedDrainsQueue);
+
+  // The max number of pending requests allowed. When number of pending requests
+  // exceeds this number, the oldest request will be dropped.
+  static const int kMaxPendingRequests = 30;
+
+  // Max consecutive attempts to wake up the component extension before
+  // giving up and draining the pending request queue.
+  static const int kMaxWakeupAttemptCount = 3;
 
   class MediaRouterMediaRoutesObserver :
       public media_router::MediaRoutesObserver {
@@ -164,6 +180,10 @@
   // Dispatches the Mojo requests queued in |pending_requests_|.
   void ExecutePendingRequests();
 
+  // Drops all pending requests. Called when we have a connection error to
+  // component extension and further reattempts are unlikely to help.
+  void DrainPendingRequests();
+
   // MediaRouter implementation.
   bool RegisterMediaSinksObserver(MediaSinksObserver* observer) override;
   void UnregisterMediaSinksObserver(MediaSinksObserver* observer) override;
@@ -240,9 +260,25 @@
 
   void UpdateHasLocalRoute(bool has_local_route);
 
+  // Callback invoked by |event_page_tracker_| after an attempt to wake the
+  // component extension. If |success| is false, the pending request queue is
+  // drained.
+  void EventPageWakeComplete(bool success);
+
+  // Removes all requests from the pending requests queue. Called when there is
+  // a permanent error connecting to component extension.
+  void DrainRequestQueue();
+
+  // Calls to |event_page_tracker_| to wake the component extension.
+  // |media_route_provider_extension_id_| must not be empty and the extension
+  // should be currently suspended.
+  // If there have already been too many wakeup attempts, give up and drain
+  // the pending request queue.
+  void AttemptWakeEventPage();
+
   // Pending requests queued to be executed once component extension
   // becomes ready.
-  std::vector<base::Closure> pending_requests_;
+  std::deque<base::Closure> pending_requests_;
 
   base::ScopedPtrHashMap<MediaSource::Id, scoped_ptr<MediaSinksQuery>>
       sinks_queries_;
@@ -298,8 +334,12 @@
   // The last reported sink availability from the media route provider manager.
   interfaces::MediaRouter::SinkAvailability availability_;
 
+  int wakeup_attempt_count_;
+
   base::ThreadChecker thread_checker_;
 
+  base::WeakPtrFactory<MediaRouterMojoImpl> weak_factory_;
+
   DISALLOW_COPY_AND_ASSIGN(MediaRouterMojoImpl);
 };
 

diff --git a/chrome/browser/media/router/media_router_mojo_impl_unittest.cc b/chrome/browser/media/router/media_router_mojo_impl_unittest.cc
index 72edc6e..9951223 100644
--- a/chrome/browser/media/router/media_router_mojo_impl_unittest.cc
+++ b/chrome/browser/media/router/media_router_mojo_impl_unittest.cc

@@ -775,6 +775,7 @@
   }
 
   void TearDown() override {
+    media_router_.reset();
     profile_.reset();
     // Explicitly delete the TestingBrowserProcess before |message_loop_|.
     // This allows it to do cleanup before |message_loop_| goes away.
@@ -863,4 +864,92 @@
   ProcessEventLoop();
 }
 
+TEST_F(MediaRouterMojoExtensionTest, AttemptedWakeupTooManyTimes) {
+  BindMediaRouteProvider();
+
+  // CloseRoute is called while extension is suspended. It should be queued.
+  // Schedule a component extension wakeup.
+  EXPECT_CALL(*process_manager_, IsEventPageSuspended(kExtensionId))
+      .WillOnce(Return(true));
+  EXPECT_CALL(*process_manager_, WakeEventPage(kExtensionId, _))
+      .WillOnce(testing::DoAll(media::RunCallback<1>(true), Return(true)));
+  media_router_->CloseRoute(kRouteId);
+  EXPECT_EQ(1u, media_router_->pending_requests_.size());
+
+  // Media route provider fails to connect to media router before extension is
+  // suspended again, and |OnConnectionError| is invoked. Retry the wakeup.
+  EXPECT_CALL(*process_manager_, WakeEventPage(kExtensionId, _))
+      .Times(MediaRouterMojoImpl::kMaxWakeupAttemptCount - 1)
+      .WillRepeatedly(
+          testing::DoAll(media::RunCallback<1>(true), Return(true)));
+  for (int i = 0; i < MediaRouterMojoImpl::kMaxWakeupAttemptCount - 1; ++i)
+    media_router_->OnConnectionError();
+
+  // We have already tried |kMaxWakeupAttemptCount| times. If we get an error
+  // again, we will give up and the pending request queue will be drained.
+  media_router_->OnConnectionError();
+  EXPECT_TRUE(media_router_->pending_requests_.empty());
+
+  // Requests that comes in after queue is drained should be queued.
+  EXPECT_CALL(*process_manager_, IsEventPageSuspended(kExtensionId))
+      .WillOnce(Return(true));
+  EXPECT_CALL(*process_manager_, WakeEventPage(kExtensionId, _))
+      .WillOnce(testing::DoAll(media::RunCallback<1>(true), Return(true)));
+  media_router_->CloseRoute(kRouteId);
+  EXPECT_EQ(1u, media_router_->pending_requests_.size());
+}
+
+TEST_F(MediaRouterMojoExtensionTest, WakeupFailedDrainsQueue) {
+  BindMediaRouteProvider();
+
+  // CloseRoute is called while extension is suspended. It should be queued.
+  // Schedule a component extension wakeup.
+  EXPECT_CALL(*process_manager_, IsEventPageSuspended(kExtensionId))
+      .WillOnce(Return(true));
+  base::Callback<void(bool)> extension_wakeup_callback;
+  EXPECT_CALL(*process_manager_, WakeEventPage(kExtensionId, _))
+      .WillOnce(
+          testing::DoAll(SaveArg<1>(&extension_wakeup_callback), Return(true)));
+  media_router_->CloseRoute(kRouteId);
+  EXPECT_EQ(1u, media_router_->pending_requests_.size());
+
+  // Extension wakeup callback returning false is an non-retryable error.
+  // Queue should be drained.
+  extension_wakeup_callback.Run(false);
+  EXPECT_TRUE(media_router_->pending_requests_.empty());
+
+  // Requests that comes in after queue is drained should be queued.
+  EXPECT_CALL(*process_manager_, IsEventPageSuspended(kExtensionId))
+      .WillOnce(Return(true));
+  EXPECT_CALL(*process_manager_, WakeEventPage(kExtensionId, _))
+      .WillOnce(testing::DoAll(media::RunCallback<1>(true), Return(true)));
+  media_router_->CloseRoute(kRouteId);
+  EXPECT_EQ(1u, media_router_->pending_requests_.size());
+}
+
+TEST_F(MediaRouterMojoExtensionTest, DropOldestPendingRequest) {
+  const size_t kMaxPendingRequests = MediaRouterMojoImpl::kMaxPendingRequests;
+
+  // Request is queued.
+  media_router_->CloseRoute(kRouteId);
+  EXPECT_EQ(1u, media_router_->pending_requests_.size());
+
+  for (size_t i = 0; i < kMaxPendingRequests; ++i)
+    media_router_->CloseRoute(kRouteId2);
+
+  // The request queue size should not exceed |kMaxPendingRequests|.
+  EXPECT_EQ(kMaxPendingRequests, media_router_->pending_requests_.size());
+
+  // The oldest request should have been dropped, so we don't expect to see
+  // CloseRoute(kRouteId) here.
+  BindMediaRouteProvider();
+  EXPECT_CALL(provide_handler_, Invoke(testing::Not("")));
+  EXPECT_CALL(*process_manager_, IsEventPageSuspended(kExtensionId))
+      .WillOnce(Return(false));
+  EXPECT_CALL(mock_media_route_provider_, CloseRoute(mojo::String(kRouteId2)))
+      .Times(kMaxPendingRequests);
+  RegisterMediaRouteProvider();
+  ProcessEventLoop();
+}
+
 }  // namespace media_router

diff --git a/chrome/browser/sync/profile_sync_service.cc b/chrome/browser/sync/profile_sync_service.cc
index 58b84e9..f35dc9b 100644
--- a/chrome/browser/sync/profile_sync_service.cc
+++ b/chrome/browser/sync/profile_sync_service.cc

@@ -27,6 +27,7 @@
 #include "base/time/time.h"
 #include "build/build_config.h"
 #include "chrome/browser/browsing_data/browsing_data_helper.h"
+#include "chrome/browser/chrome_notification_types.h"
 #include "chrome/browser/invalidation/profile_invalidation_provider_factory.h"
 #include "chrome/browser/password_manager/password_store_factory.h"
 #include "chrome/browser/profiles/profile.h"
@@ -69,6 +70,9 @@
 #include "components/syncable_prefs/pref_service_syncable.h"
 #include "components/version_info/version_info_values.h"
 #include "content/public/browser/browser_thread.h"
+#include "content/public/browser/notification_details.h"
+#include "content/public/browser/notification_service.h"
+#include "content/public/browser/notification_source.h"
 #include "net/cookies/cookie_monster.h"
 #include "net/url_request/url_request_context_getter.h"
 #include "sync/api/sync_error.h"
@@ -263,6 +267,9 @@
               local_device_->GetSyncUserAgent(),
               profile_->GetRequestContext(),
               browser_sync::SyncStoppedReporter::ResultCallback()));
+
+  registrar_.Add(this, chrome::NOTIFICATION_FOREIGN_SESSION_UPDATED,
+                 content::Source<Profile>(profile));
   sessions_sync_manager_.reset(
       new SessionsSyncManager(sync_client_->GetSyncSessionsClient(), profile,
                               local_device_.get(), router.Pass()));
@@ -910,6 +917,14 @@
   sync_prefs_.SetCleanShutdown(true);
 }
 
+void ProfileSyncService::Observe(
+    int type, const content::NotificationSource& source,
+    const content::NotificationDetails& details) {
+  DCHECK_EQ(chrome::NOTIFICATION_FOREIGN_SESSION_UPDATED, type);
+  FOR_EACH_OBSERVER(sync_driver::SyncServiceObserver, observers_,
+                    OnForeignSessionUpdated());
+}
+
 void ProfileSyncService::StopImpl(SyncStopDataFate data_fate) {
   switch (data_fate) {
     case KEEP_DATA:

diff --git a/chrome/browser/sync/profile_sync_service.h b/chrome/browser/sync/profile_sync_service.h
index 3309efd..c82f4c05 100644
--- a/chrome/browser/sync/profile_sync_service.h
+++ b/chrome/browser/sync/profile_sync_service.h

@@ -39,6 +39,8 @@
 #include "components/sync_driver/sync_prefs.h"
 #include "components/sync_driver/sync_service.h"
 #include "components/sync_driver/sync_stopped_reporter.h"
+#include "content/public/browser/notification_observer.h"
+#include "content/public/browser/notification_registrar.h"
 #include "google_apis/gaia/google_service_auth_error.h"
 #include "google_apis/gaia/oauth2_token_service.h"
 #include "net/base/backoff_entry.h"
@@ -178,6 +180,7 @@
                            public sync_driver::DataTypeManagerObserver,
                            public syncer::UnrecoverableErrorHandler,
                            public KeyedService,
+                           public content::NotificationObserver,
                            public OAuth2TokenService::Consumer,
                            public OAuth2TokenService::Observer,
                            public SigninManagerBase::Observer {
@@ -641,6 +644,11 @@
   friend class TestProfileSyncService;
   FRIEND_TEST_ALL_PREFIXES(ProfileSyncServiceTest, InitialState);
 
+  // Observe notifications.
+  void Observe(int type,
+               const content::NotificationSource& source,
+               const content::NotificationDetails& details) override;
+
   // Stops the sync engine. Does NOT set IsSyncRequested to false. Use
   // RequestStop for that. |data_fate| controls whether the local sync data is
   // deleted or kept when the engine shuts down.
@@ -981,6 +989,8 @@
   // IsPassphrasePrompted sync preference.
   bool passphrase_prompt_triggered_by_version_;
 
+  content::NotificationRegistrar registrar_;
+
   base::WeakPtrFactory<ProfileSyncService> weak_factory_;
 
   // We don't use |weak_factory_| for the StartupController because the weak

diff --git a/chrome/browser/ui/cocoa/passwords/manage_password_item_view_controller.h b/chrome/browser/ui/cocoa/passwords/manage_password_item_view_controller.h
index 3e20375..438d00a 100644
--- a/chrome/browser/ui/cocoa/passwords/manage_password_item_view_controller.h
+++ b/chrome/browser/ui/cocoa/passwords/manage_password_item_view_controller.h

@@ -5,100 +5,46 @@
 #ifndef CHROME_BROWSER_UI_COCOA_PASSWORDS_MANAGE_PASSWORD_ITEM_VIEW_CONTROLLER_H_
 #define CHROME_BROWSER_UI_COCOA_PASSWORDS_MANAGE_PASSWORD_ITEM_VIEW_CONTROLLER_H_
 
+#include <vector>
+
 #import <Cocoa/Cocoa.h>
 
 #import "base/mac/scoped_nsobject.h"
-#include "components/autofill/core/common/password_form.h"
-#include "components/password_manager/core/common/password_manager_ui.h"
-#import "ui/base/cocoa/tracking_area.h"
 
 namespace autofill {
 struct PasswordForm;
 }  // namespace autofill
 
-@class HoverImageButton;
 class ManagePasswordsBubbleModel;
 
-// The state of the password item.
-enum ManagePasswordItemState {
-  MANAGE_PASSWORD_ITEM_STATE_PENDING,
-  MANAGE_PASSWORD_ITEM_STATE_MANAGE,
-  MANAGE_PASSWORD_ITEM_STATE_DELETED
-};
+typedef std::vector<const autofill::PasswordForm*> PasswordFormsVector;
 
-// Abstract superclass for items that are clickable. Highlights on hover.
-@interface ManagePasswordItemClickableView : NSView {
- @private
-  BOOL hovering_;
-  ui::ScopedCrTrackingArea trackingArea_;
-}
+// Handles callbacks from ManagePasswordItemViewController.
+@protocol PasswordItemDelegate<NSObject>
+// Retrieves the model
+@property(readonly, nonatomic) ManagePasswordsBubbleModel* model;
+
+@property(readonly, nonatomic) CGFloat firstColumnMaxWidth;
+@property(readonly, nonatomic) CGFloat secondColumnMaxWidth;
 @end
 
-// Shows the option to undelete a password.
-@interface ManagePasswordItemUndoView : ManagePasswordItemClickableView {
- @private
-  base::scoped_nsobject<NSButton> undoButton_;
-}
-- (id)initWithTarget:(id)target action:(SEL)action;
-@end
-
-@interface ManagePasswordItemUndoView (Testing)
-@property(readonly) NSButton* undoButton;
-@end
-
-// Shows a username, obscured password, and delete button in a single row.
-@interface ManagePasswordItemManageView : ManagePasswordItemClickableView {
- @private
-  base::scoped_nsobject<NSTextField> usernameField_;
-  base::scoped_nsobject<NSSecureTextField> passwordField_;
-  base::scoped_nsobject<HoverImageButton> deleteButton_;
-}
-- (id)initWithForm:(const autofill::PasswordForm&)form
-            target:(id)target
-            action:(SEL)action;
-@end
-
-@interface ManagePasswordItemManageView (Testing)
-@property(readonly) NSTextField* usernameField;
-@property(readonly) NSSecureTextField* passwordField;
-@property(readonly) NSButton* deleteButton;
-@end
-
-// Shows a username and obscured password in a single row.
-@interface ManagePasswordItemPendingView : NSView {
- @private
-  base::scoped_nsobject<NSTextField> usernameField_;
-  base::scoped_nsobject<NSSecureTextField> passwordField_;
-  base::scoped_nsobject<NSTextField> federationField_;
-}
-- (id)initWithForm:(const autofill::PasswordForm&)form;
-@end
-
-@interface ManagePasswordItemPendingView (Testing)
-@property(readonly) NSTextField* usernameField;
-@property(readonly) NSSecureTextField* passwordField;
-@property(readonly) NSTextField* federationField;
-@end
-
-// Shows a single item in a password management list. Transitions between
-// PENDING, MANAGE, and DELETED states according to user interaction.
-@interface ManagePasswordItemViewController : NSViewController {
+// Shows a list of usernames/passwords.
+@interface PasswordsListViewController
+    : NSViewController<PasswordItemDelegate> {
  @private
   ManagePasswordsBubbleModel* model_;  // weak
-  autofill::PasswordForm passwordForm_;
-  ManagePasswordItemState state_;
-  password_manager::ui::PasswordItemPosition position_;
-  base::scoped_nsobject<NSView> contentView_;
+  // Array of ManagePasswordItemViewController for each row.
+  base::scoped_nsobject<NSArray> itemViews_;
+  // Maximum widthes of columns across all the rows.
+  CGFloat firstColumnMaxWidth_;
+  CGFloat secondColumnMaxWidth_;
 }
 - (id)initWithModel:(ManagePasswordsBubbleModel*)model
-       passwordForm:(const autofill::PasswordForm&)passwordForm
-           position:(password_manager::ui::PasswordItemPosition)position;
+              forms:(const PasswordFormsVector&)password_forms;
 @end
 
-@interface ManagePasswordItemViewController (Testing)
-@property(readonly) ManagePasswordItemState state;
-@property(readonly) NSView* contentView;
-@property(readonly) autofill::PasswordForm passwordForm;
+@interface PasswordsListViewController (Testing)
+@property(readonly) NSArray* itemViews;
 @end
 
 #endif  // CHROME_BROWSER_UI_COCOA_PASSWORDS_MANAGE_PASSWORD_ITEM_VIEW_CONTROLLER_H_

diff --git a/chrome/browser/ui/cocoa/passwords/manage_password_item_view_controller.mm b/chrome/browser/ui/cocoa/passwords/manage_password_item_view_controller.mm
index e856750..b7d83a29 100644
--- a/chrome/browser/ui/cocoa/passwords/manage_password_item_view_controller.mm
+++ b/chrome/browser/ui/cocoa/passwords/manage_password_item_view_controller.mm

@@ -4,12 +4,16 @@
 
 #import "chrome/browser/ui/cocoa/passwords/manage_password_item_view_controller.h"
 
+#include <utility>
+
 #include "base/logging.h"
+#include "base/mac/foundation_util.h"
 #include "base/strings/string16.h"
 #include "base/strings/sys_string_conversions.h"
 #include "base/strings/utf_string_conversions.h"
 #include "chrome/browser/ui/chrome_style.h"
 #import "chrome/browser/ui/cocoa/passwords/manage_passwords_bubble_content_view_controller.h"
+#import "chrome/browser/ui/cocoa/passwords/password_item_views.h"
 #include "chrome/browser/ui/passwords/manage_passwords_bubble_model.h"
 #include "grit/components_strings.h"
 #include "grit/generated_resources.h"
@@ -24,15 +28,10 @@
 
 namespace {
 
-const SkColor kHoverColor = SkColorSetARGBInline(0xFF, 0xEB, 0xEB, 0xEB);
-
 // Constants shared with toolkit-views layout_constants.h.
 const CGFloat kItemLabelSpacing = 10;
 const CGFloat kRelatedControlVerticalSpacing = 8;
-
-NSColor* HoverColor() {
-  return gfx::SkColorToCalibratedNSColor(kHoverColor);
-}
+const CGFloat kDesiredRowWidth = kDesiredBubbleWidth - 2 * kFramePadding;
 
 NSFont* LabelFont() {
   return [NSFont systemFontOfSize:[NSFont smallSystemFontSize]];
@@ -43,32 +42,29 @@
       sizeWithAttributes:@{NSFontAttributeName : LabelFont()}];
 }
 
-CGFloat FirstFieldWidth() {
+std::pair<CGFloat, CGFloat> GetResizedColumns(
+    CGFloat maxWidth, std::pair<CGFloat, CGFloat> columnsWidth) {
+  // Free space can be negative.
+  CGFloat freeSpace =
+      maxWidth - (columnsWidth.first + columnsWidth.second + kItemLabelSpacing);
+  if (freeSpace >= 0) {
+    return std::make_pair(columnsWidth.first + freeSpace / 2,
+                          columnsWidth.second + freeSpace / 2);
+  }
+  // Make sure that the sizes are nonnegative.
+  CGFloat firstColumnPercent =
+      columnsWidth.first / (columnsWidth.first + columnsWidth.second);
+  return std::make_pair(
+      columnsWidth.first + freeSpace * firstColumnPercent,
+      columnsWidth.second + freeSpace * (1 - firstColumnPercent));
+}
+
+CGFloat ManagePasswordItemWidth() {
   const CGFloat undoExplanationWidth =
       LabelSize(IDS_MANAGE_PASSWORDS_DELETED).width;
-  const CGFloat kUsernameWidth =
-      ManagePasswordsBubbleModel::UsernameFieldWidth();
-  const CGFloat width = std::max(kUsernameWidth, undoExplanationWidth);
-  return width;
-}
-
-CGFloat SecondFieldWidth() {
-  const CGFloat undoLinkWidth =
-      LabelSize(IDS_MANAGE_PASSWORDS_UNDO).width;
-  const CGFloat kPasswordWidth =
-      ManagePasswordsBubbleModel::PasswordFieldWidth();
-  const CGFloat width = std::max(kPasswordWidth, undoLinkWidth);
-  return width;
-}
-
-CGFloat ItemWidth() {
-  const CGFloat width =
-      FirstFieldWidth() +
-      kItemLabelSpacing +
-      SecondFieldWidth() +
-      kItemLabelSpacing +
-      chrome_style::GetCloseButtonSize();
-  return width;
+  const CGFloat undoLinkWidth = LabelSize(IDS_MANAGE_PASSWORDS_UNDO).width;
+  return std::max(kDesiredRowWidth,
+                  undoExplanationWidth + kItemLabelSpacing + undoLinkWidth);
 }
 
 void InitLabel(NSTextField* textField, const base::string16& text) {
@@ -78,6 +74,7 @@
   [textField setDrawsBackground:NO];
   [textField setBezeled:NO];
   [textField setFont:LabelFont()];
+  [[textField cell] setLineBreakMode:NSLineBreakByTruncatingTail];
   [textField sizeToFit];
 }
 
@@ -89,37 +86,29 @@
 }
 
 NSTextField* UsernameLabel(const base::string16& text) {
-  NSTextField* textField = Label(text);
-  [textField
-      setFrameSize:NSMakeSize(FirstFieldWidth(), NSHeight([textField frame]))];
-  return textField;
+  return Label(text);
 }
 
 NSSecureTextField* PasswordLabel(const base::string16& text) {
   base::scoped_nsobject<NSSecureTextField> textField(
       [[NSSecureTextField alloc] initWithFrame:NSZeroRect]);
   InitLabel(textField, text);
-  [textField
-      setFrameSize:NSMakeSize(SecondFieldWidth(), NSHeight([textField frame]))];
   return textField.autorelease();
 }
 
 NSTextField* FederationLabel(const base::string16& text) {
-  NSTextField* textField = Label(text);
-  [textField
-      setFrameSize:NSMakeSize(SecondFieldWidth(), NSHeight([textField frame]))];
-  return textField;
+  return Label(text);
 }
 
 base::string16 GetDisplayUsername(const autofill::PasswordForm& form) {
-  return form.username_value.empty() ?
-      l10n_util::GetStringUTF16(IDS_PASSWORD_MANAGER_EMPTY_LOGIN) :
-      form.username_value;
+  return form.username_value.empty()
+             ? l10n_util::GetStringUTF16(IDS_PASSWORD_MANAGER_EMPTY_LOGIN)
+             : form.username_value;
 }
 
 }  // namespace
 
-@implementation ManagePasswordItemUndoView
+@implementation UndoPasswordItemView
 - (id)initWithTarget:(id)target action:(SEL)action {
   if ((self = [super init])) {
     // The button should look like a link.
@@ -130,46 +119,58 @@
     [cell setShouldUnderline:NO];
     [cell setUnderlineOnHover:NO];
     [cell setTextColor:gfx::SkColorToCalibratedNSColor(
-        chrome_style::GetLinkColor())];
+                           chrome_style::GetLinkColor())];
     [undoButton_ setCell:cell.get()];
     [undoButton_ sizeToFit];
     [undoButton_ setTarget:target];
     [undoButton_ setAction:action];
-
-    const CGFloat width = ItemWidth();
-    CGFloat curX = 0;
-    CGFloat curY = kRelatedControlVerticalSpacing;
+    [self addSubview:undoButton_];
 
     // Add the explanation text.
-    NSTextField* label =
-        Label(l10n_util::GetStringUTF16(IDS_MANAGE_PASSWORDS_DELETED));
-    [label setFrameOrigin:NSMakePoint(curX, curY)];
-    [self addSubview:label];
-
-    // The undo button should be right-aligned.
-    curX = width - NSWidth([undoButton_ frame]);
-    [undoButton_ setFrameOrigin:NSMakePoint(curX, curY)];
-    [self addSubview:undoButton_ ];
-
-    // Move to the top-right of the delete button.
-    curX = NSMaxX([undoButton_ frame]);
-    curY = NSMaxY([undoButton_ frame]) + kRelatedControlVerticalSpacing;
-
-    // Update the frame.
-    DCHECK_EQ(width, curX);
-    [self setFrameSize:NSMakeSize(curX, curY)];
+    label_.reset([Label(l10n_util::GetStringUTF16(IDS_MANAGE_PASSWORDS_DELETED))
+        retain]);
+    [self addSubview:label_];
   }
   return self;
 }
+
+#pragma mark PasswordItemTwoColumnView
+
+- (void)layoutWithFirstColumn:(CGFloat)firstWidth
+                 secondColumn:(CGFloat)secondWidth {
+  const CGFloat width = ManagePasswordItemWidth();
+  CGFloat curX = 0;
+  CGFloat curY = kRelatedControlVerticalSpacing;
+  [label_ setFrameOrigin:NSMakePoint(curX, curY)];
+  // The undo button should be right-aligned.
+  curX = width - NSWidth([undoButton_ frame]);
+  [undoButton_ setFrameOrigin:NSMakePoint(curX, curY)];
+  // Move to the top-right of the delete button.
+  curX = NSMaxX([undoButton_ frame]);
+  curY = NSMaxY([undoButton_ frame]) + kRelatedControlVerticalSpacing;
+
+  // Update the frame.
+  [self setFrameSize:NSMakeSize(curX, curY)];
+}
+
+- (CGFloat)firstColumnWidth {
+  // This view doesn't have columns aligned with username/password.
+  return 0;
+}
+
+- (CGFloat)secondColumnWidth {
+  // This view doesn't have columns aligned with username/password.
+  return 0;
+}
 @end
 
-@implementation ManagePasswordItemUndoView (Testing)
+@implementation UndoPasswordItemView (Testing)
 - (NSButton*)undoButton {
   return undoButton_.get();
 }
 @end
 
-@implementation ManagePasswordItemManageView
+@implementation ManagePasswordItemView
 - (id)initWithForm:(const autofill::PasswordForm&)form
             target:(id)target
             action:(SEL)action {
@@ -188,44 +189,68 @@
         setPressedImage:bundle.GetImageNamed(IDR_CLOSE_2_P).ToNSImage()];
     [deleteButton_ setTarget:target];
     [deleteButton_ setAction:action];
-
-    const CGFloat width = ItemWidth();
-    CGFloat curX = 0;
-    CGFloat curY = kRelatedControlVerticalSpacing;
+    [self addSubview:deleteButton_];
 
     // Add the username.
     usernameField_.reset([UsernameLabel(GetDisplayUsername(form)) retain]);
-    [usernameField_ setFrameOrigin:NSMakePoint(curX, curY)];
     [self addSubview:usernameField_];
 
-    // Move to the right of the username and add the password.
-    curX = NSMaxX([usernameField_ frame]) + kItemLabelSpacing;
-    passwordField_.reset([PasswordLabel(form.password_value) retain]);
-    [passwordField_ setFrameOrigin:NSMakePoint(curX, curY)];
+    if (form.federation_url.is_empty()) {
+      passwordField_.reset([PasswordLabel(form.password_value) retain]);
+    } else {
+      base::string16 text = l10n_util::GetStringFUTF16(
+          IDS_PASSWORDS_VIA_FEDERATION,
+          base::UTF8ToUTF16(form.federation_url.host()));
+      passwordField_.reset([FederationLabel(text) retain]);
+    }
     [self addSubview:passwordField_];
-
-    // The delete button should be right-aligned.
-    curX = width - NSWidth([deleteButton_ frame]);
-    [deleteButton_ setFrameOrigin:NSMakePoint(curX, curY)];
-    [self addSubview:deleteButton_];
-
-    // Move to the top-right of the delete button.
-    curX = NSMaxX([deleteButton_ frame]);
-    curY = NSMaxY([deleteButton_ frame]) + kRelatedControlVerticalSpacing;
-
-    // Update the frame.
-    DCHECK_EQ(width, curX);
-    [self setFrameSize:NSMakeSize(curX, curY)];
   }
   return self;
 }
+
+#pragma mark PasswordItemTwoColumnView
+
+- (void)layoutWithFirstColumn:(CGFloat)firstWidth
+                 secondColumn:(CGFloat)secondWidth {
+  const CGFloat width = ManagePasswordItemWidth();
+  std::pair<CGFloat, CGFloat> sizes = GetResizedColumns(
+      width - NSWidth([deleteButton_ frame]) - kRelatedControlVerticalSpacing,
+      std::make_pair(firstWidth, secondWidth));
+  [usernameField_
+      setFrameSize:NSMakeSize(sizes.first, NSHeight([usernameField_ frame]))];
+  [passwordField_
+      setFrameSize:NSMakeSize(sizes.second, NSHeight([passwordField_ frame]))];
+  CGFloat curX = 0;
+  CGFloat curY = kRelatedControlVerticalSpacing;
+  [usernameField_ setFrameOrigin:NSMakePoint(curX, curY)];
+  // Move to the right of the username and add the password.
+  curX = NSMaxX([usernameField_ frame]) + kItemLabelSpacing;
+  [passwordField_ setFrameOrigin:NSMakePoint(curX, curY)];
+  // The delete button should be right-aligned.
+  curX = width - NSWidth([deleteButton_ frame]);
+  [deleteButton_ setFrameOrigin:NSMakePoint(curX, curY)];
+  // Move to the top-right of the delete button.
+  curX = NSMaxX([deleteButton_ frame]);
+  curY = NSMaxY([deleteButton_ frame]) + kRelatedControlVerticalSpacing;
+
+  // Update the frame.
+  [self setFrameSize:NSMakeSize(curX, curY)];
+}
+
+- (CGFloat)firstColumnWidth {
+  return NSWidth([usernameField_ frame]);
+}
+
+- (CGFloat)secondColumnWidth {
+  return NSWidth([passwordField_ frame]);
+}
 @end
 
-@implementation ManagePasswordItemManageView (Testing)
+@implementation ManagePasswordItemView (Testing)
 - (NSTextField*)usernameField {
   return usernameField_.get();
 }
-- (NSSecureTextField*)passwordField {
+- (NSTextField*)passwordField {
   return passwordField_.get();
 }
 - (NSButton*)deleteButton {
@@ -233,59 +258,71 @@
 }
 @end
 
-@implementation ManagePasswordItemPendingView
+@implementation PendingPasswordItemView
 
 - (id)initWithForm:(const autofill::PasswordForm&)form {
   if ((self = [super initWithFrame:NSZeroRect])) {
-    CGFloat curX = 0;
-    CGFloat curY = kRelatedControlVerticalSpacing;
-
     // Add the username.
     usernameField_.reset([UsernameLabel(GetDisplayUsername(form)) retain]);
-    [usernameField_ setFrameOrigin:NSMakePoint(curX, curY)];
     [self addSubview:usernameField_];
 
-    // Move to the right of the username and add the password.
-    curX = NSMaxX([usernameField_ frame]) + kItemLabelSpacing;
     if (form.federation_url.is_empty()) {
       passwordField_.reset([PasswordLabel(form.password_value) retain]);
     } else {
       base::string16 text = l10n_util::GetStringFUTF16(
           IDS_PASSWORDS_VIA_FEDERATION,
           base::UTF8ToUTF16(form.federation_url.host()));
-      federationField_.reset([FederationLabel(text) retain]);
+      passwordField_.reset([FederationLabel(text) retain]);
     }
-
-    NSTextField* secondField =
-        passwordField_ ? passwordField_.get() : federationField_.get();
-    [secondField setFrameOrigin:NSMakePoint(curX, curY)];
-    [self addSubview:secondField];
-
-    // Move to the top-right of the password.
-    curY = NSMaxY([secondField frame]) + kRelatedControlVerticalSpacing;
-
-    // Update the frame.
-    [self setFrameSize:NSMakeSize(ItemWidth(), curY)];
+    [self addSubview:passwordField_];
   }
   return self;
 }
 
+#pragma mark PasswordItemTwoColumnView
+
+- (void)layoutWithFirstColumn:(CGFloat)firstWidth
+                 secondColumn:(CGFloat)secondWidth {
+  std::pair<CGFloat, CGFloat> sizes = GetResizedColumns(
+      kDesiredRowWidth,
+      std::make_pair(firstWidth, secondWidth));
+  [usernameField_
+      setFrameSize:NSMakeSize(sizes.first, NSHeight([usernameField_ frame]))];
+  [passwordField_
+      setFrameSize:NSMakeSize(sizes.second, NSHeight([passwordField_ frame]))];
+  CGFloat curX = 0;
+  CGFloat curY = kRelatedControlVerticalSpacing;
+  [usernameField_ setFrameOrigin:NSMakePoint(curX, curY)];
+  // Move to the right of the username and add the password.
+  curX = NSMaxX([usernameField_ frame]) + kItemLabelSpacing;
+  [passwordField_ setFrameOrigin:NSMakePoint(curX, curY)];
+  // Move to the top-right of the password.
+  curX = NSMaxX([passwordField_ frame]);
+  curY = NSMaxY([passwordField_ frame]) + kRelatedControlVerticalSpacing;
+
+  // Update the frame.
+  [self setFrameSize:NSMakeSize(curX, curY)];
+}
+
+- (CGFloat)firstColumnWidth {
+  return NSWidth([usernameField_ frame]);
+}
+
+- (CGFloat)secondColumnWidth {
+  return NSWidth([passwordField_ frame]);
+}
 @end
 
-@implementation ManagePasswordItemPendingView (Testing)
+@implementation PendingPasswordItemView (Testing)
 
 - (NSTextField*)usernameField {
   return usernameField_.get();
 }
 
-- (NSSecureTextField*)passwordField {
+- (NSTextField*)passwordField {
   return passwordField_.get();
 }
 
-- (NSTextField*)federationField {
-  return federationField_.get();
-}
-
 @end
 
 @interface ManagePasswordItemViewController ()
@@ -297,23 +334,20 @@
 
 // Find the next content view.
 - (void)updateContent;
-
-// Repaint the content.
-- (void)layoutContent;
 @end
 
 @implementation ManagePasswordItemViewController
 
-- (id)initWithModel:(ManagePasswordsBubbleModel*)model
-       passwordForm:(const autofill::PasswordForm&)passwordForm
-           position:(password_manager::ui::PasswordItemPosition)position {
+- (id)initWithDelegate:(id<PasswordItemDelegate>)delegate
+          passwordForm:(const autofill::PasswordForm*)passwordForm {
   if ((self = [super initWithNibName:nil bundle:nil])) {
-    model_ = model;
-    position_ = position;
+    delegate_ = delegate;
     passwordForm_ = passwordForm;
-    state_ = model_->state() == password_manager::ui::PENDING_PASSWORD_STATE
-        ? MANAGE_PASSWORD_ITEM_STATE_PENDING
-        : MANAGE_PASSWORD_ITEM_STATE_MANAGE;
+    if ([delegate_ model]->state() ==
+        password_manager::ui::PENDING_PASSWORD_STATE)
+      state_ = MANAGE_PASSWORD_ITEM_STATE_PENDING;
+    else
+      state_ = MANAGE_PASSWORD_ITEM_STATE_MANAGE;
     [self updateContent];
   }
   return self;
@@ -323,46 +357,53 @@
   DCHECK_EQ(MANAGE_PASSWORD_ITEM_STATE_MANAGE, state_);
   state_ = MANAGE_PASSWORD_ITEM_STATE_DELETED;
   [self refresh];
-  model_->OnPasswordAction(passwordForm_,
-                           ManagePasswordsBubbleModel::REMOVE_PASSWORD);
+  [delegate_ model]->OnPasswordAction(
+      *passwordForm_, ManagePasswordsBubbleModel::REMOVE_PASSWORD);
 }
 
 - (void)onUndoClicked:(id)sender {
   DCHECK_EQ(MANAGE_PASSWORD_ITEM_STATE_DELETED, state_);
   state_ = MANAGE_PASSWORD_ITEM_STATE_MANAGE;
   [self refresh];
-  model_->OnPasswordAction(passwordForm_,
-                           ManagePasswordsBubbleModel::ADD_PASSWORD);
+  [delegate_ model]->OnPasswordAction(*passwordForm_,
+                                      ManagePasswordsBubbleModel::ADD_PASSWORD);
 }
 
 - (void)refresh {
   [self updateContent];
-  [self layoutContent];
+  [self layoutWithFirstColumn:[delegate_ firstColumnMaxWidth]
+                 secondColumn:[delegate_ secondColumnMaxWidth]];
 }
 
 - (void)updateContent {
   switch (state_) {
-    default:
-      NOTREACHED();
     case MANAGE_PASSWORD_ITEM_STATE_PENDING:
       contentView_.reset(
-          [[ManagePasswordItemPendingView alloc] initWithForm:passwordForm_]);
+          [[PendingPasswordItemView alloc] initWithForm:*passwordForm_]);
       return;
     case MANAGE_PASSWORD_ITEM_STATE_MANAGE:
-      contentView_.reset([[ManagePasswordItemManageView alloc]
-          initWithForm:passwordForm_
+      contentView_.reset([[ManagePasswordItemView alloc]
+          initWithForm:*passwordForm_
                 target:self
                 action:@selector(onDeleteClicked:)]);
       return;
     case MANAGE_PASSWORD_ITEM_STATE_DELETED:
-      contentView_.reset([[ManagePasswordItemUndoView alloc]
+      contentView_.reset([[UndoPasswordItemView alloc]
           initWithTarget:self
                   action:@selector(onUndoClicked:)]);
       return;
   };
 }
 
-- (void)layoutContent {
+- (void)loadView {
+  self.view = [[[NSView alloc] initWithFrame:NSZeroRect] autorelease];
+}
+
+#pragma mark PasswordItemTwoColumnView
+
+- (void)layoutWithFirstColumn:(CGFloat)firstWidth
+                 secondColumn:(CGFloat)secondWidth {
+  [contentView_ layoutWithFirstColumn:firstWidth secondColumn:secondWidth];
   // Update the view size according to the content view size.
   const NSSize contentSize = [contentView_ frame].size;
   [self.view setFrameSize:contentSize];
@@ -371,9 +412,12 @@
   [self.view setSubviews:@[ contentView_ ]];
 }
 
-- (void)loadView {
-  self.view = [[[NSView alloc] initWithFrame:NSZeroRect] autorelease];
-  [self layoutContent];
+- (CGFloat)firstColumnWidth {
+  return [contentView_ firstColumnWidth];
+}
+
+- (CGFloat)secondColumnWidth {
+  return [contentView_ secondColumnWidth];
 }
 
 @end
@@ -388,43 +432,73 @@
   return contentView_.get();
 }
 
-- (autofill::PasswordForm)passwordForm {
-  return passwordForm_;
+@end
+
+@implementation PasswordsListViewController
+
+@synthesize firstColumnMaxWidth = firstColumnMaxWidth_;
+@synthesize secondColumnMaxWidth = secondColumnMaxWidth_;
+
+- (id)initWithModel:(ManagePasswordsBubbleModel*)model
+              forms:(const PasswordFormsVector&)password_forms {
+  if ((self = [super initWithNibName:nil bundle:nil])) {
+    base::scoped_nsobject<NSMutableArray> items(
+        [[NSMutableArray arrayWithCapacity:password_forms.size()] retain]);
+    model_ = model;
+    // Create the controllers.
+    for (const autofill::PasswordForm* form : password_forms) {
+      base::scoped_nsobject<ManagePasswordItemViewController> item(
+          [[ManagePasswordItemViewController alloc] initWithDelegate:self
+                                                        passwordForm:form]);
+      [items addObject:item.get()];
+    }
+    itemViews_.reset(items.release());
+  }
+  return self;
+}
+
+- (void)loadView {
+  base::scoped_nsobject<NSView> view([[NSView alloc] initWithFrame:NSZeroRect]);
+
+  // Create the subviews.
+  for (id object in itemViews_.get()) {
+    ManagePasswordItemViewController* passwordController =
+        base::mac::ObjCCast<ManagePasswordItemViewController>(object);
+    NSView* itemView = [passwordController view];
+    [view addSubview:itemView];
+    firstColumnMaxWidth_ =
+        std::max(firstColumnMaxWidth_, [passwordController firstColumnWidth]);
+    secondColumnMaxWidth_ =
+        std::max(secondColumnMaxWidth_, [passwordController secondColumnWidth]);
+  }
+  // Lay out the items.
+  NSPoint curPos = {};
+  CGFloat maxX = 0;
+  for (id object in [itemViews_ reverseObjectEnumerator]) {
+    ManagePasswordItemViewController* passwordController =
+        base::mac::ObjCCast<ManagePasswordItemViewController>(object);
+    [passwordController layoutWithFirstColumn:firstColumnMaxWidth_
+                                 secondColumn:secondColumnMaxWidth_];
+    NSView* itemView = [passwordController view];
+    // The items stack up on each other.
+    [itemView setFrameOrigin:curPos];
+    maxX = NSMaxX([itemView frame]);
+    curPos.y = NSMaxY([itemView frame]);
+  }
+  [view setFrameSize:NSMakeSize(maxX, curPos.y)];
+  [self setView:view];
+}
+
+- (ManagePasswordsBubbleModel*)model {
+  return model_;
 }
 
 @end
 
-@implementation ManagePasswordItemClickableView
+@implementation PasswordsListViewController (Testing)
 
-- (void)drawRect:(NSRect)dirtyRect {
-  [super drawRect:dirtyRect];
-  if (hovering_) {
-    [HoverColor() setFill];
-    NSRectFill(dirtyRect);
-  }
-}
-
-- (void)mouseEntered:(NSEvent*)event {
-  hovering_ = YES;
-  [self setNeedsDisplay:YES];
-}
-
-- (void)mouseExited:(NSEvent*)event {
-  hovering_ = NO;
-  [self setNeedsDisplay:YES];
-}
-
-- (void)updateTrackingAreas {
-  [super updateTrackingAreas];
-  if (trackingArea_.get())
-    [self removeTrackingArea:trackingArea_.get()];
-  NSTrackingAreaOptions options =
-      NSTrackingMouseEnteredAndExited | NSTrackingActiveInKeyWindow;
-  trackingArea_.reset([[CrTrackingArea alloc] initWithRect:[self bounds]
-                                                   options:options
-                                                     owner:self
-                                                  userInfo:nil]);
-  [self addTrackingArea:trackingArea_.get()];
+- (NSArray*)itemViews {
+  return itemViews_.get();
 }
 
 @end

diff --git a/chrome/browser/ui/cocoa/passwords/manage_password_item_view_controller_unittest.mm b/chrome/browser/ui/cocoa/passwords/manage_password_item_view_controller_unittest.mm
index fb2bbd1..5ecd0806 100644
--- a/chrome/browser/ui/cocoa/passwords/manage_password_item_view_controller_unittest.mm
+++ b/chrome/browser/ui/cocoa/passwords/manage_password_item_view_controller_unittest.mm

@@ -12,6 +12,7 @@
 #include "chrome/browser/ui/cocoa/cocoa_test_helper.h"
 #import "chrome/browser/ui/cocoa/passwords/manage_password_item_view_controller.h"
 #include "chrome/browser/ui/cocoa/passwords/manage_passwords_controller_test.h"
+#import "chrome/browser/ui/cocoa/passwords/password_item_views.h"
 #include "chrome/browser/ui/passwords/manage_passwords_bubble_model.h"
 #include "chrome/browser/ui/passwords/manage_passwords_ui_controller_mock.h"
 #include "components/password_manager/core/browser/mock_password_store.h"
@@ -25,17 +26,12 @@
 namespace {
 NSString* const kItemTestUsername = @"foo";
 NSString* const kItemTestPassword = @"bar";
+NSString* const kFederation = @"https://google.com/idp";
 }  // namespace
 
-MATCHER_P(PasswordFormEq, form, "") {
-  return form.username_value == arg.username_value &&
-         form.password_value == arg.password_value;
-}
-
-class ManagePasswordItemViewControllerTest
-    : public ManagePasswordsControllerTest {
+class PasswordsListViewControllerTest : public ManagePasswordsControllerTest {
  public:
-  ManagePasswordItemViewControllerTest() {}
+  PasswordsListViewControllerTest() {}
 
   void SetUp() override {
     ManagePasswordsControllerTest::SetUp();
@@ -43,107 +39,144 @@
         profile(),
         password_manager::BuildPasswordStoreService<
             content::BrowserContext, password_manager::MockPasswordStore>);
-    ui_controller()->SetPendingPassword(credentials());
   }
 
-  ManagePasswordItemViewController* controller() {
-    if (!controller_) {
-      controller_.reset([[ManagePasswordItemViewController alloc]
-          initWithModel:model()
-           passwordForm:ui_controller()->PendingPassword()
-               position:password_manager::ui::FIRST_ITEM]);
-    }
-    return controller_.get();
+  void SetUpManageState(
+      const std::vector<const autofill::PasswordForm*>& forms) {
+    model()->set_state(password_manager::ui::MANAGE_STATE);
+    controller_.reset([[PasswordsListViewController alloc]
+        initWithModel:model()
+                forms:forms]);
   }
 
-  autofill::PasswordForm credentials() {
+  void SetUpManageState(const autofill::PasswordForm* form) {
+    model()->set_state(password_manager::ui::PENDING_PASSWORD_STATE);
+    controller_.reset([[PasswordsListViewController alloc]
+        initWithModel:model()
+                forms:std::vector<const autofill::PasswordForm*>(1, form)]);
+  }
+
+  ManagePasswordItemViewController* GetControllerAt(unsigned i) {
+    return base::mac::ObjCCast<ManagePasswordItemViewController>(
+        [[controller_ itemViews] objectAtIndex:i]);
+  }
+
+  autofill::PasswordForm local_credential() {
     autofill::PasswordForm form;
     form.username_value = base::SysNSStringToUTF16(kItemTestUsername);
     form.password_value = base::SysNSStringToUTF16(kItemTestPassword);
     return form;
   }
 
+  autofill::PasswordForm federated_credential() {
+    autofill::PasswordForm form;
+    form.username_value = base::SysNSStringToUTF16(kItemTestUsername);
+    form.federation_url = GURL(base::SysNSStringToUTF16(kFederation));
+    return form;
+  }
+
   password_manager::MockPasswordStore* mockStore() {
     password_manager::PasswordStore* store =
-        PasswordStoreFactory::GetForProfile(
-            profile(), ServiceAccessType::EXPLICIT_ACCESS).get();
-    password_manager::MockPasswordStore* mockStore =
-        static_cast<password_manager::MockPasswordStore*>(store);
-    return mockStore;
+        PasswordStoreFactory::GetForProfile(profile(),
+                                            ServiceAccessType::EXPLICIT_ACCESS)
+            .get();
+    return static_cast<password_manager::MockPasswordStore*>(store);
   }
 
  private:
-  base::scoped_nsobject<ManagePasswordItemViewController> controller_;
-  DISALLOW_COPY_AND_ASSIGN(ManagePasswordItemViewControllerTest);
+  base::scoped_nsobject<PasswordsListViewController> controller_;
+
+  DISALLOW_COPY_AND_ASSIGN(PasswordsListViewControllerTest);
 };
 
-TEST_F(ManagePasswordItemViewControllerTest, ManageStateShouldHaveManageView) {
-  model()->set_state(password_manager::ui::MANAGE_STATE);
-  EXPECT_EQ(MANAGE_PASSWORD_ITEM_STATE_MANAGE, [controller() state]);
-  EXPECT_NSEQ([ManagePasswordItemManageView class],
-              [[controller() contentView] class]);
+TEST_F(PasswordsListViewControllerTest, ManageStateShouldHaveManageView) {
+  ScopedVector<const autofill::PasswordForm> forms;
+  forms.push_back(new autofill::PasswordForm(local_credential()));
+  forms.push_back(new autofill::PasswordForm(federated_credential()));
+  SetUpManageState(forms.get());
+
+  EXPECT_EQ(MANAGE_PASSWORD_ITEM_STATE_MANAGE, [GetControllerAt(0) state]);
+  EXPECT_EQ(MANAGE_PASSWORD_ITEM_STATE_MANAGE, [GetControllerAt(1) state]);
+  EXPECT_NSEQ([ManagePasswordItemView class],
+              [[GetControllerAt(0) contentView] class]);
+  EXPECT_NSEQ([ManagePasswordItemView class],
+              [[GetControllerAt(1) contentView] class]);
 }
 
-TEST_F(ManagePasswordItemViewControllerTest,
+TEST_F(PasswordsListViewControllerTest,
        ClickingDeleteShouldShowUndoViewAndDeletePassword) {
-  EXPECT_CALL(*mockStore(), RemoveLogin(PasswordFormEq(credentials())));
-  model()->set_state(password_manager::ui::MANAGE_STATE);
+  ScopedVector<const autofill::PasswordForm> forms;
+  forms.push_back(new autofill::PasswordForm(local_credential()));
+  SetUpManageState(forms.get());
 
-  ManagePasswordItemManageView* manageView =
-      base::mac::ObjCCast<ManagePasswordItemManageView>(
-          controller().contentView);
+  ManagePasswordItemView* manageView =
+      base::mac::ObjCCast<ManagePasswordItemView>(
+          [GetControllerAt(0) contentView]);
+  EXPECT_CALL(*mockStore(), RemoveLogin(local_credential()));
   [manageView.deleteButton performClick:nil];
 
-  EXPECT_NSEQ([ManagePasswordItemUndoView class],
-              [controller().contentView class]);
+  EXPECT_NSEQ([UndoPasswordItemView class],
+              [[GetControllerAt(0) contentView] class]);
 }
 
-TEST_F(ManagePasswordItemViewControllerTest,
+TEST_F(PasswordsListViewControllerTest,
        ClickingUndoShouldShowManageViewAndAddPassword) {
-  EXPECT_CALL(*mockStore(), RemoveLogin(PasswordFormEq(credentials())));
-  model()->set_state(password_manager::ui::MANAGE_STATE);
+  ScopedVector<const autofill::PasswordForm> forms;
+  forms.push_back(new autofill::PasswordForm(local_credential()));
+  SetUpManageState(forms.get());
 
-  ManagePasswordItemManageView* manageView =
-      base::mac::ObjCCast<ManagePasswordItemManageView>(
-          controller().contentView);
+  ManagePasswordItemView* manageView =
+      base::mac::ObjCCast<ManagePasswordItemView>(
+          [GetControllerAt(0) contentView]);
+  EXPECT_CALL(*mockStore(), RemoveLogin(local_credential()));
   [manageView.deleteButton performClick:nil];
 
-  EXPECT_CALL(*mockStore(), AddLogin(PasswordFormEq(credentials())));
-  ManagePasswordItemUndoView* undoView =
-      base::mac::ObjCCast<ManagePasswordItemUndoView>(controller().contentView);
+  UndoPasswordItemView* undoView = base::mac::ObjCCast<UndoPasswordItemView>(
+      [GetControllerAt(0) contentView]);
+  EXPECT_CALL(*mockStore(), AddLogin(local_credential()));
   [undoView.undoButton performClick:nil];
 
-  EXPECT_NSEQ([ManagePasswordItemManageView class],
-              [controller().contentView class]);
+  EXPECT_NSEQ([ManagePasswordItemView class],
+              [[GetControllerAt(0) contentView] class]);
 }
 
-TEST_F(ManagePasswordItemViewControllerTest,
+TEST_F(PasswordsListViewControllerTest,
        ManageViewShouldHaveCorrectUsernameAndObscuredPassword) {
-  model()->set_state(password_manager::ui::MANAGE_STATE);
-  ManagePasswordItemManageView* manageView =
-      base::mac::ObjCCast<ManagePasswordItemManageView>(
-          [controller() contentView]);
+  ScopedVector<const autofill::PasswordForm> forms;
+  forms.push_back(new autofill::PasswordForm(local_credential()));
+  forms.push_back(new autofill::PasswordForm(federated_credential()));
+  SetUpManageState(forms.get());
+  ManagePasswordItemView* manageView =
+      base::mac::ObjCCast<ManagePasswordItemView>(
+          [GetControllerAt(0) contentView]);
 
   // Ensure the fields are populated properly and the password is obscured.
   EXPECT_NSEQ(kItemTestUsername, manageView.usernameField.stringValue);
   EXPECT_NSEQ(kItemTestPassword, manageView.passwordField.stringValue);
   EXPECT_TRUE([[manageView.passwordField cell] echosBullets]);
+
+  manageView = base::mac::ObjCCast<ManagePasswordItemView>(
+      [GetControllerAt(1) contentView]);
+  EXPECT_NSEQ(kItemTestUsername, manageView.usernameField.stringValue);
+  EXPECT_THAT(base::SysNSStringToUTF8(manageView.passwordField.stringValue),
+              HasSubstr(federated_credential().federation_url.host()));
 }
 
-TEST_F(ManagePasswordItemViewControllerTest,
-       PendingStateShouldHavePendingView) {
-  model()->set_state(password_manager::ui::PENDING_PASSWORD_STATE);
-  EXPECT_EQ(MANAGE_PASSWORD_ITEM_STATE_PENDING, [controller() state]);
-  EXPECT_NSEQ([ManagePasswordItemPendingView class],
-              [[controller() contentView] class]);
+TEST_F(PasswordsListViewControllerTest, PendingStateShouldHavePendingView) {
+  autofill::PasswordForm form = local_credential();
+  SetUpManageState(&form);
+  EXPECT_EQ(MANAGE_PASSWORD_ITEM_STATE_PENDING, [GetControllerAt(0) state]);
+  EXPECT_NSEQ([PendingPasswordItemView class],
+              [[GetControllerAt(0) contentView] class]);
 }
 
-TEST_F(ManagePasswordItemViewControllerTest,
+TEST_F(PasswordsListViewControllerTest,
        PendingViewShouldHaveCorrectUsernameAndObscuredPassword) {
-  model()->set_state(password_manager::ui::PENDING_PASSWORD_STATE);
-  ManagePasswordItemPendingView* pendingView =
-      base::mac::ObjCCast<ManagePasswordItemPendingView>(
-          [controller() contentView]);
+  autofill::PasswordForm form = local_credential();
+  SetUpManageState(&form);
+  PendingPasswordItemView* pendingView =
+      base::mac::ObjCCast<PendingPasswordItemView>(
+          [GetControllerAt(0) contentView]);
 
   // Ensure the fields are populated properly and the password is obscured.
   EXPECT_NSEQ(kItemTestUsername, pendingView.usernameField.stringValue);
@@ -151,20 +184,16 @@
   EXPECT_TRUE([[pendingView.passwordField cell] echosBullets]);
 }
 
-TEST_F(ManagePasswordItemViewControllerTest,
+TEST_F(PasswordsListViewControllerTest,
        PendingViewShouldHaveCorrectUsernameAndFederation) {
-  model()->set_state(password_manager::ui::PENDING_PASSWORD_STATE);
-  autofill::PasswordForm form = credentials();
-  GURL federation("https://google.com/idp");
-  form.federation_url = federation;
-  ui_controller()->SetPendingPassword(form);
-  ManagePasswordItemPendingView* pendingView =
-      base::mac::ObjCCast<ManagePasswordItemPendingView>(
-          [controller() contentView]);
+  autofill::PasswordForm form = federated_credential();
+  SetUpManageState(&form);
+  PendingPasswordItemView* pendingView =
+      base::mac::ObjCCast<PendingPasswordItemView>(
+          [GetControllerAt(0) contentView]);
 
   // Ensure the fields are populated properly and the password is obscured.
   EXPECT_NSEQ(kItemTestUsername, pendingView.usernameField.stringValue);
-  EXPECT_FALSE(pendingView.passwordField);
-  EXPECT_THAT(base::SysNSStringToUTF8(pendingView.federationField.stringValue),
-              HasSubstr(federation.host()));
+  EXPECT_THAT(base::SysNSStringToUTF8(pendingView.passwordField.stringValue),
+              HasSubstr(federated_credential().federation_url.host()));
 }

diff --git a/chrome/browser/ui/cocoa/passwords/manage_passwords_bubble_manage_view_controller.h b/chrome/browser/ui/cocoa/passwords/manage_passwords_bubble_manage_view_controller.h
index df91368..f3b9b0fd 100644
--- a/chrome/browser/ui/cocoa/passwords/manage_passwords_bubble_manage_view_controller.h
+++ b/chrome/browser/ui/cocoa/passwords/manage_passwords_bubble_manage_view_controller.h

@@ -11,17 +11,7 @@
 #import "chrome/browser/ui/cocoa/passwords/manage_passwords_bubble_content_view_controller.h"
 
 class ManagePasswordsBubbleModel;
-
-// Shows a list of passwords saved for the current site..
-@interface PasswordItemListView : NSView {
-  base::scoped_nsobject<NSArray> itemViews_;
-}
-- (id)initWithModel:(ManagePasswordsBubbleModel*)model;
-@end
-
-@interface PasswordItemListView (Testing)
-@property(readonly) NSArray* itemViews;
-@end
+@class PasswordsListViewController;
 
 // Informs the user that no passwords are stored for the current site.
 @interface NoPasswordsView : NSTextField
@@ -35,7 +25,8 @@
   ManagePasswordsBubbleModel* model_;  // weak
   base::scoped_nsobject<NSButton> doneButton_;
   base::scoped_nsobject<NSButton> manageButton_;
-  base::scoped_nsobject<NSView> contentView_;
+  base::scoped_nsobject<NoPasswordsView> noPasswordsView_;
+  base::scoped_nsobject<PasswordsListViewController> passwordsListController_;
 }
 - (id)initWithModel:(ManagePasswordsBubbleModel*)model
            delegate:(id<ManagePasswordsBubbleContentViewDelegate>)delegate;
@@ -44,7 +35,8 @@
 @interface ManagePasswordsBubbleManageViewController (Testing)
 @property(readonly) NSButton* doneButton;
 @property(readonly) NSButton* manageButton;
-@property(readonly) NSView* contentView;
+@property(readonly) NoPasswordsView* noPasswordsView;
+@property(readonly) PasswordsListViewController* passwordsListController;
 @end
 
 #endif  // CHROME_BROWSER_UI_COCOA_PASSWORDS_MANAGE_PASSWORDS_BUBBLE_MANAGE_VIEW_CONTROLLER_H_

diff --git a/chrome/browser/ui/cocoa/passwords/manage_passwords_bubble_manage_view_controller.mm b/chrome/browser/ui/cocoa/passwords/manage_passwords_bubble_manage_view_controller.mm
index d13b1797..7e872ef 100644
--- a/chrome/browser/ui/cocoa/passwords/manage_passwords_bubble_manage_view_controller.mm
+++ b/chrome/browser/ui/cocoa/passwords/manage_passwords_bubble_manage_view_controller.mm

@@ -18,49 +18,6 @@
 
 using namespace password_manager::mac::ui;
 
-@implementation PasswordItemListView
-- (id)initWithModel:(ManagePasswordsBubbleModel*)model {
-  if ((self = [super initWithFrame:NSZeroRect])) {
-    base::scoped_nsobject<NSMutableArray> items([[NSMutableArray alloc] init]);
-
-    // Create and lay out the items.
-    const CGFloat curX = 0;
-    CGFloat maxX = 0;
-    CGFloat curY = 0;
-    for (auto i = model->local_credentials().rbegin();
-         i != model->local_credentials().rend();
-         ++i) {
-      const autofill::PasswordForm& form = **i;
-      password_manager::ui::PasswordItemPosition position =
-          (&(*i) == &(*model->local_credentials().begin()))
-              ? password_manager::ui::FIRST_ITEM
-              : password_manager::ui::SUBSEQUENT_ITEM;
-      base::scoped_nsobject<ManagePasswordItemViewController> item(
-          [[ManagePasswordItemViewController alloc] initWithModel:model
-                                                     passwordForm:form
-                                                         position:position]);
-      [items addObject:item.get()];
-      NSView* itemView = [item view];
-      [self addSubview:itemView];
-
-      // The items stack up on each other.
-      [itemView setFrameOrigin:NSMakePoint(curX, curY)];
-      maxX = NSMaxX([itemView frame]);
-      curY = NSMaxY([itemView frame]);
-    }
-    [self setFrameSize:NSMakeSize(maxX, curY)];
-    itemViews_.reset(items.release());
-  }
-  return self;
-}
-@end
-
-@implementation PasswordItemListView (Testing)
-- (NSArray*)itemViews {
-  return itemViews_.get();
-}
-@end
-
 @implementation NoPasswordsView
 - (id)initWithWidth:(CGFloat)width {
   if ((self = [super initWithFrame:NSZeroRect])) {
@@ -103,13 +60,11 @@
 
   // -----------------------------------
   // |  Title                          |
-  // |  -----------------------------  | (1 px border)
+  // |                                 |
   // |    username   password      x   |
-  // |  -----------------------------  | (1 px border)
   // |    username   password      x   |
-  // |  -----------------------------  | (1 px border)
   // |    username   password      x   |
-  // |  -----------------------------  | (1 px border)
+  // |                                 |
   // |  Manage                 [Done]  |
   // -----------------------------------
 
@@ -125,20 +80,24 @@
   // Content. If we have a list of passwords to store for the current site, we
   // display them to the user for management. Otherwise, we show a "No passwords
   // for this site" message.
+  NSView* contentView = nil;
   if (model_->local_credentials().empty()) {
     const CGFloat noPasswordsWidth = std::max(
         kDesiredBubbleWidth - 2 * kFramePadding, NSWidth([titleLabel frame]));
-    contentView_.reset(
+    noPasswordsView_.reset(
         [[NoPasswordsView alloc] initWithWidth:noPasswordsWidth]);
+    contentView = noPasswordsView_.get();
   } else {
-    contentView_.reset(
-        [[PasswordItemListView alloc] initWithModel:model_]);
+    passwordsListController_.reset([[PasswordsListViewController alloc]
+        initWithModel:model_
+                forms:model_->local_credentials().get()]);
+    contentView = [passwordsListController_ view];
   }
-  [view addSubview:contentView_];
+  [view addSubview:contentView];
 
   // Wrap the title if necessary to match the width of the content view.
-  if (NSWidth([titleLabel frame]) > NSWidth([contentView_ frame])) {
-    [titleLabel setFrameSize:NSMakeSize(NSWidth([contentView_ frame]), 0)];
+  if (NSWidth([titleLabel frame]) > NSWidth([contentView frame])) {
+    [titleLabel setFrameSize:NSMakeSize(NSWidth([contentView frame]), 0)];
     [GTMUILocalizerAndLayoutTweaker sizeToFitFixedWidthTextField:titleLabel];
   }
 
@@ -166,7 +125,7 @@
   // Layout the elements, starting at the bottom and moving up.
 
   // The Done button goes in the bottom-right corner.
-  const CGFloat width = 2 * kFramePadding + NSWidth([contentView_ frame]);
+  const CGFloat width = 2 * kFramePadding + NSWidth([contentView frame]);
   CGFloat curX = width - kFramePadding - NSWidth([doneButton_ frame]);
   CGFloat curY = kFramePadding;
   [doneButton_ setFrameOrigin:NSMakePoint(curX, curY)];
@@ -181,13 +140,13 @@
   // The content goes above the button row.
   curX = kFramePadding;
   curY = NSMaxY([doneButton_ frame]) + kUnrelatedControlVerticalPadding;
-  [contentView_ setFrameOrigin:NSMakePoint(curX, curY)];
+  [contentView setFrameOrigin:NSMakePoint(curX, curY)];
 
   // The title goes above the content.
-  curY = NSMaxY([contentView_ frame]) + kUnrelatedControlVerticalPadding;
+  curY = NSMaxY([contentView frame]) + kUnrelatedControlVerticalPadding;
   [titleLabel setFrameOrigin:NSMakePoint(curX, curY)];
 
-  curX = NSMaxX([contentView_ frame]) + kFramePadding;
+  curX = NSMaxX([contentView frame]) + kFramePadding;
   curY = NSMaxY([titleLabel frame]) + kFramePadding;
   DCHECK_EQ(width, curX);
   [view setFrameSize:NSMakeSize(curX, curY)];
@@ -217,8 +176,12 @@
   return manageButton_.get();
 }
 
-- (NSView*)contentView {
-  return contentView_.get();
+- (NoPasswordsView*)noPasswordsView {
+  return noPasswordsView_.get();
+}
+
+- (PasswordsListViewController*)passwordsListController {
+  return passwordsListController_.get();
 }
 
 @end

diff --git a/chrome/browser/ui/cocoa/passwords/manage_passwords_bubble_manage_view_controller_unittest.mm b/chrome/browser/ui/cocoa/passwords/manage_passwords_bubble_manage_view_controller_unittest.mm
index 6cedc26..3859954 100644
--- a/chrome/browser/ui/cocoa/passwords/manage_passwords_bubble_manage_view_controller_unittest.mm
+++ b/chrome/browser/ui/cocoa/passwords/manage_passwords_bubble_manage_view_controller_unittest.mm

@@ -9,6 +9,7 @@
 #include "base/strings/utf_string_conversions.h"
 #import "chrome/browser/ui/cocoa/passwords/manage_password_item_view_controller.h"
 #include "chrome/browser/ui/cocoa/passwords/manage_passwords_controller_test.h"
+#import "chrome/browser/ui/cocoa/passwords/password_item_views.h"
 #include "chrome/browser/ui/passwords/manage_passwords_bubble_model.h"
 #include "chrome/browser/ui/passwords/manage_passwords_ui_controller_mock.h"
 #include "testing/gtest/include/gtest/gtest.h"
@@ -60,7 +61,8 @@
 TEST_F(ManagePasswordsBubbleManageViewControllerTest,
        ShouldShowNoPasswordsWhenNoPasswordsExistForSite) {
   EXPECT_TRUE(model()->local_credentials().empty());
-  EXPECT_EQ([NoPasswordsView class], [controller().contentView class]);
+  EXPECT_TRUE([controller() noPasswordsView]);
+  EXPECT_FALSE([controller() passwordsListController]);
 }
 
 TEST_F(ManagePasswordsBubbleManageViewControllerTest,
@@ -83,16 +85,15 @@
 
   // Check the view state.
   EXPECT_FALSE(model()->local_credentials().empty());
-  EXPECT_EQ([PasswordItemListView class], [controller().contentView class]);
-  NSArray* items = base::mac::ObjCCastStrict<PasswordItemListView>(
-      controller().contentView).itemViews;
+  ASSERT_TRUE([controller() passwordsListController]);
+  EXPECT_FALSE([controller() noPasswordsView]);
+  NSArray* items = [[controller() passwordsListController] itemViews];
   EXPECT_EQ(2U, [items count]);
 
   // Check the entry items.
   for (ManagePasswordItemViewController* item in items) {
-    ManagePasswordItemManageView* itemContent =
-        base::mac::ObjCCastStrict<ManagePasswordItemManageView>(
-            item.contentView);
+    ManagePasswordItemView* itemContent =
+        base::mac::ObjCCastStrict<ManagePasswordItemView>(item.contentView);
     NSString* username = [itemContent.usernameField stringValue];
     if ([username isEqualToString:@"username1"]) {
       EXPECT_NSEQ(@"password1", [itemContent.passwordField stringValue]);

diff --git a/chrome/browser/ui/cocoa/passwords/manage_passwords_bubble_pending_view_controller.h b/chrome/browser/ui/cocoa/passwords/manage_passwords_bubble_pending_view_controller.h
index 3bd1d2e..ea0023e 100644
--- a/chrome/browser/ui/cocoa/passwords/manage_passwords_bubble_pending_view_controller.h
+++ b/chrome/browser/ui/cocoa/passwords/manage_passwords_bubble_pending_view_controller.h

@@ -11,7 +11,7 @@
 #import "chrome/browser/ui/cocoa/passwords/manage_passwords_bubble_content_view_controller.h"
 
 class ManagePasswordsBubbleModel;
-@class ManagePasswordItemViewController;
+@class PasswordsListViewController;
 
 // Manages the view that offers to save the user's password.
 @interface ManagePasswordsBubblePendingViewController
@@ -21,7 +21,7 @@
   base::scoped_nsobject<NSButton> saveButton_;
   base::scoped_nsobject<NSButton> neverButton_;
   base::scoped_nsobject<NSButton> closeButton_;
-  base::scoped_nsobject<ManagePasswordItemViewController> passwordItem_;
+  base::scoped_nsobject<PasswordsListViewController> passwordItem_;
 }
 - (id)initWithModel:(ManagePasswordsBubbleModel*)model
            delegate:(id<ManagePasswordsBubbleContentViewDelegate>)delegate;

diff --git a/chrome/browser/ui/cocoa/passwords/manage_passwords_bubble_pending_view_controller.mm b/chrome/browser/ui/cocoa/passwords/manage_passwords_bubble_pending_view_controller.mm
index 5654ff5..5e65bde 100644
--- a/chrome/browser/ui/cocoa/passwords/manage_passwords_bubble_pending_view_controller.mm
+++ b/chrome/browser/ui/cocoa/passwords/manage_passwords_bubble_pending_view_controller.mm

@@ -137,10 +137,11 @@
 
   // Password item.
   // It should be at least as wide as the box without the padding.
-  passwordItem_.reset([[ManagePasswordItemViewController alloc]
+  std::vector<const autofill::PasswordForm*> password_forms;
+  password_forms.push_back(&model_->pending_password());
+  passwordItem_.reset([[PasswordsListViewController alloc]
       initWithModel:model_
-       passwordForm:model_->pending_password()
-           position:password_manager::ui::FIRST_ITEM]);
+              forms:password_forms]);
   NSView* password = [passwordItem_ view];
   [view addSubview:password];
 

diff --git a/chrome/browser/ui/cocoa/passwords/password_item_views.h b/chrome/browser/ui/cocoa/passwords/password_item_views.h
new file mode 100644
index 0000000..52817b8d
--- /dev/null
+++ b/chrome/browser/ui/cocoa/passwords/password_item_views.h

@@ -0,0 +1,102 @@
+// Copyright 2015 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CHROME_BROWSER_UI_COCOA_PASSWORDS_PASSWORD_ITEM_VIEWS_H_
+#define CHROME_BROWSER_UI_COCOA_PASSWORDS_PASSWORD_ITEM_VIEWS_H_
+
+#import <Cocoa/Cocoa.h>
+
+namespace autofill {
+struct PasswordForm;
+}  // namespace autofill
+
+@class HoverImageButton;
+class ManagePasswordsBubbleModel;
+@protocol PasswordItemDelegate;
+
+// The state of the password item.
+enum ManagePasswordItemState {
+  MANAGE_PASSWORD_ITEM_STATE_PENDING,
+  MANAGE_PASSWORD_ITEM_STATE_MANAGE,
+  MANAGE_PASSWORD_ITEM_STATE_DELETED
+};
+
+// Protocol for items that have two dynamic columns.
+@protocol PasswordItemTwoColumnView<NSObject>
+// Resize the subelements according to cummulative column's sizes across all the
+// rows.
+- (void)layoutWithFirstColumn:(CGFloat)firstWidth
+                 secondColumn:(CGFloat)secondWidth;
+
+@property(readonly, nonatomic) CGFloat firstColumnWidth;
+@property(readonly, nonatomic) CGFloat secondColumnWidth;
+@end
+
+// Shows the option to undelete a password.
+@interface UndoPasswordItemView : NSView<PasswordItemTwoColumnView> {
+ @private
+  base::scoped_nsobject<NSTextField> label_;
+  base::scoped_nsobject<NSButton> undoButton_;
+}
+- (id)initWithTarget:(id)target action:(SEL)action;
+@end
+
+@interface UndoPasswordItemView (Testing)
+@property(readonly) NSButton* undoButton;
+@end
+
+// Shows a username, obscured password, and delete button in a single row.
+@interface ManagePasswordItemView : NSView<PasswordItemTwoColumnView> {
+ @private
+  base::scoped_nsobject<NSTextField> usernameField_;
+  // The field contains the password or IDP origin for federated credentials.
+  base::scoped_nsobject<NSTextField> passwordField_;
+  base::scoped_nsobject<HoverImageButton> deleteButton_;
+}
+- (id)initWithForm:(const autofill::PasswordForm&)form
+            target:(id)target
+            action:(SEL)action;
+@end
+
+@interface ManagePasswordItemView (Testing)
+@property(readonly) NSTextField* usernameField;
+@property(readonly) NSTextField* passwordField;
+@property(readonly) NSButton* deleteButton;
+@end
+
+// Shows a username and obscured password in a single row.
+@interface PendingPasswordItemView : NSView<PasswordItemTwoColumnView> {
+ @private
+  base::scoped_nsobject<NSTextField> usernameField_;
+  // The field contains the password or IDP origin for federated credentials.
+  base::scoped_nsobject<NSTextField> passwordField_;
+}
+- (id)initWithForm:(const autofill::PasswordForm&)form;
+@end
+
+@interface PendingPasswordItemView (Testing)
+@property(readonly) NSTextField* usernameField;
+@property(readonly) NSSecureTextField* passwordField;
+@end
+
+// Shows a single item in a password management list. Transitions between
+// PENDING, MANAGE, and DELETED states according to user interaction.
+@interface ManagePasswordItemViewController
+    : NSViewController<PasswordItemTwoColumnView> {
+ @private
+  id<PasswordItemDelegate> delegate_;  // weak
+  const autofill::PasswordForm* passwordForm_;
+  ManagePasswordItemState state_;
+  base::scoped_nsobject<NSView<PasswordItemTwoColumnView>> contentView_;
+}
+- (id)initWithDelegate:(id<PasswordItemDelegate>)delegate
+          passwordForm:(const autofill::PasswordForm*)passwordForm;
+@end
+
+@interface ManagePasswordItemViewController (Testing)
+@property(readonly) ManagePasswordItemState state;
+@property(readonly) NSView* contentView;
+@end
+
+#endif  // CHROME_BROWSER_UI_COCOA_PASSWORDS_PASSWORD_ITEM_VIEWS_H_

diff --git a/chrome/browser/ui/passwords/manage_passwords_bubble_model.cc b/chrome/browser/ui/passwords/manage_passwords_bubble_model.cc
index 6afbd56a..58e863b2 100644
--- a/chrome/browser/ui/passwords/manage_passwords_bubble_model.cc
+++ b/chrome/browser/ui/passwords/manage_passwords_bubble_model.cc

@@ -25,25 +25,11 @@
 #include "components/password_manager/core/common/credential_manager_types.h"
 #include "components/password_manager/core/common/password_manager_ui.h"
 #include "ui/base/l10n/l10n_util.h"
-#include "ui/base/resource/resource_bundle.h"
 
 namespace metrics_util = password_manager::metrics_util;
 
 namespace {
 
-enum FieldType { USERNAME_FIELD, PASSWORD_FIELD };
-
-const int kUsernameFieldSize = 30;
-const int kPasswordFieldSize = 22;
-
-// Returns the width of |type| field.
-int GetFieldWidth(FieldType type) {
-  return ui::ResourceBundle::GetSharedInstance()
-      .GetFontList(ui::ResourceBundle::SmallFont)
-      .GetExpectedTextWidth(type == USERNAME_FIELD ? kUsernameFieldSize
-                                                   : kPasswordFieldSize);
-}
-
 Profile* GetProfileFromWebContents(content::WebContents* web_contents) {
   if (!web_contents)
     return nullptr;
@@ -376,16 +362,6 @@
       ShouldShowAutoSignInPromptFirstRunExperience(profile->GetPrefs());
 }
 
-// static
-int ManagePasswordsBubbleModel::UsernameFieldWidth() {
-  return GetFieldWidth(USERNAME_FIELD);
-}
-
-// static
-int ManagePasswordsBubbleModel::PasswordFieldWidth() {
-  return GetFieldWidth(PASSWORD_FIELD);
-}
-
 void ManagePasswordsBubbleModel::UpdatePendingStateTitle() {
   title_brand_link_range_ = gfx::Range();
   GetSavePasswordDialogTitleTextAndLinkRange(

diff --git a/chrome/browser/ui/passwords/manage_passwords_bubble_model.h b/chrome/browser/ui/passwords/manage_passwords_bubble_model.h
index 1c563e2..dcfca96 100644
--- a/chrome/browser/ui/passwords/manage_passwords_bubble_model.h
+++ b/chrome/browser/ui/passwords/manage_passwords_bubble_model.h

@@ -151,10 +151,6 @@
   void set_state(password_manager::ui::State state) { state_ = state; }
 #endif
 
-  // Upper limits on the size of the username and password fields.
-  static int UsernameFieldWidth();
-  static int PasswordFieldWidth();
-
  private:
   enum UserBehaviorOnUpdateBubble {
     UPDATE_CLICKED,

diff --git a/chrome/browser/ui/views/app_list/win/app_list_service_win.cc b/chrome/browser/ui/views/app_list/win/app_list_service_win.cc
index 6692e3f..dd9b7e59 100644
--- a/chrome/browser/ui/views/app_list/win/app_list_service_win.cc
+++ b/chrome/browser/ui/views/app_list/win/app_list_service_win.cc

@@ -306,7 +306,7 @@
   shortcut_locations.on_desktop = true;
   shortcut_locations.in_quick_launch_bar = true;
   shortcut_locations.applications_menu_location =
-      web_app::APP_MENU_LOCATION_SUBDIR_CHROME_DEPRECATED;
+      web_app::APP_MENU_LOCATION_SUBDIR_CHROME;
   base::FilePath user_data_dir(
       g_browser_process->profile_manager()->user_data_dir());
 

diff --git a/chrome/browser/ui/webui/foreign_session_handler.cc b/chrome/browser/ui/webui/foreign_session_handler.cc
index 1337af9..d64efe67 100644
--- a/chrome/browser/ui/webui/foreign_session_handler.cc
+++ b/chrome/browser/ui/webui/foreign_session_handler.cc

@@ -18,7 +18,6 @@
 #include "base/strings/utf_string_conversions.h"
 #include "base/time/time.h"
 #include "base/values.h"
-#include "chrome/browser/chrome_notification_types.h"
 #include "chrome/browser/profiles/profile.h"
 #include "chrome/browser/sessions/session_restore.h"
 #include "chrome/browser/sync/profile_sync_service.h"
@@ -29,8 +28,6 @@
 #include "chrome/common/url_constants.h"
 #include "chrome/grit/generated_resources.h"
 #include "components/pref_registry/pref_registry_syncable.h"
-#include "content/public/browser/notification_service.h"
-#include "content/public/browser/notification_source.h"
 #include "content/public/browser/url_data_source.h"
 #include "content/public/browser/web_contents.h"
 #include "content/public/browser/web_ui.h"
@@ -215,9 +212,6 @@
   if (service)
     scoped_observer_.Add(service);
 
-  registrar_.Add(this, chrome::NOTIFICATION_FOREIGN_SESSION_UPDATED,
-                 content::Source<Profile>(profile));
-
   web_ui()->RegisterMessageCallback("deleteForeignSession",
       base::Bind(&ForeignSessionHandler::HandleDeleteForeignSession,
                  base::Unretained(this)));
@@ -232,20 +226,11 @@
                  base::Unretained(this)));
 }
 
-void ForeignSessionHandler::Observe(
-    int type,
-    const content::NotificationSource& source,
-    const content::NotificationDetails& details) {
-  switch (type) {
-    case chrome::NOTIFICATION_FOREIGN_SESSION_UPDATED:
-      HandleGetForeignSessions(nullptr);
-      break;
-    default:
-      NOTREACHED();
-  }
+void ForeignSessionHandler::OnSyncConfigurationCompleted() {
+  HandleGetForeignSessions(nullptr);
 }
 
-void ForeignSessionHandler::OnSyncConfigurationCompleted() {
+void ForeignSessionHandler::OnForeignSessionUpdated() {
   HandleGetForeignSessions(nullptr);
 }
 

diff --git a/chrome/browser/ui/webui/foreign_session_handler.h b/chrome/browser/ui/webui/foreign_session_handler.h
index 28218ab..85d3a22 100644
--- a/chrome/browser/ui/webui/foreign_session_handler.h
+++ b/chrome/browser/ui/webui/foreign_session_handler.h

@@ -12,8 +12,6 @@
 #include "chrome/browser/sessions/session_service.h"
 #include "components/sync_driver/open_tabs_ui_delegate.h"
 #include "components/sync_driver/sync_service_observer.h"
-#include "content/public/browser/notification_observer.h"
-#include "content/public/browser/notification_registrar.h"
 #include "content/public/browser/web_ui.h"
 #include "content/public/browser/web_ui_message_handler.h"
 
@@ -33,7 +31,6 @@
 namespace browser_sync {
 
 class ForeignSessionHandler : public content::WebUIMessageHandler,
-                              public content::NotificationObserver,
                               public sync_driver::SyncServiceObserver {
  public:
   // Invalid value, used to note that we don't have a tab or window number.
@@ -62,14 +59,10 @@
       content::WebUI* web_ui);
 
  private:
-  // Determines how ForeignSessionHandler will interact with the new tab page.
-  void Observe(int type,
-               const content::NotificationSource& source,
-               const content::NotificationDetails& details) override;
-
   // sync_driver::SyncServiceObserver:
   void OnStateChanged() override {}
   void OnSyncConfigurationCompleted() override;
+  void OnForeignSessionUpdated() override;
 
   // Returns true if tab sync is enabled for this profile, otherwise false.
   bool IsTabSyncEnabled();
@@ -95,9 +88,6 @@
 
   void HandleSetForeignSessionCollapsed(const base::ListValue* args);
 
-  // The Registrar used to register ForeignSessionHandler for notifications.
-  content::NotificationRegistrar registrar_;
-
   // ScopedObserver used to observe the ProfileSyncService.
   ScopedObserver<sync_driver::SyncService, sync_driver::SyncServiceObserver>
       scoped_observer_;

diff --git a/chrome/browser/web_applications/web_app.h b/chrome/browser/web_applications/web_app.h
index 1bf4bbb..fee38de2 100644
--- a/chrome/browser/web_applications/web_app.h
+++ b/chrome/browser/web_applications/web_app.h

@@ -78,7 +78,7 @@
 enum ApplicationsMenuLocation {
   APP_MENU_LOCATION_NONE,
   APP_MENU_LOCATION_ROOT,
-  APP_MENU_LOCATION_SUBDIR_CHROME_DEPRECATED,  // TODO(bcwhite) remove this
+  APP_MENU_LOCATION_SUBDIR_CHROME,
   APP_MENU_LOCATION_SUBDIR_CHROMEAPPS,
   APP_MENU_LOCATION_HIDDEN,
 };

diff --git a/chrome/browser/web_applications/web_app_win.cc b/chrome/browser/web_applications/web_app_win.cc
index 18772be..a5078b0 100644
--- a/chrome/browser/web_applications/web_app_win.cc
+++ b/chrome/browser/web_applications/web_app_win.cc

@@ -573,8 +573,8 @@
       ShellUtil::SHORTCUT_LOCATION_START_MENU_ROOT
     }, {
       creation_locations.applications_menu_location ==
-          APP_MENU_LOCATION_SUBDIR_CHROME_DEPRECATED,
-      ShellUtil::SHORTCUT_LOCATION_START_MENU_CHROME_DIR_DEPRECATED
+          APP_MENU_LOCATION_SUBDIR_CHROME,
+      ShellUtil::SHORTCUT_LOCATION_START_MENU_CHROME_DIR
     }, {
       creation_locations.applications_menu_location ==
           APP_MENU_LOCATION_SUBDIR_CHROMEAPPS,

diff --git a/chrome/chrome_browser_ui.gypi b/chrome/chrome_browser_ui.gypi
index 41963c7..2e86dd7 100644
--- a/chrome/chrome_browser_ui.gypi
+++ b/chrome/chrome_browser_ui.gypi

@@ -1141,6 +1141,7 @@
       'browser/ui/cocoa/passwords/manage_passwords_bubble_manage_view_controller.mm',
       'browser/ui/cocoa/passwords/manage_passwords_bubble_pending_view_controller.h',
       'browser/ui/cocoa/passwords/manage_passwords_bubble_pending_view_controller.mm',
+      'browser/ui/cocoa/passwords/password_item_views.h',
       'browser/ui/cocoa/presentation_mode_controller.h',
       'browser/ui/cocoa/presentation_mode_controller.mm',
       'browser/ui/cocoa/profiles/avatar_base_controller.h',

diff --git a/chrome/installer/setup/install.cc b/chrome/installer/setup/install.cc
index b472cb7..978646fa 100644
--- a/chrome/installer/setup/install.cc
+++ b/chrome/installer/setup/install.cc

@@ -70,10 +70,7 @@
     case ShellUtil::SHORTCUT_LOCATION_QUICK_LAUNCH:
       message.append("Quick Launch ");
       break;
-    case ShellUtil::SHORTCUT_LOCATION_START_MENU_ROOT:
-      message.append("Start menu ");
-      break;
-    case ShellUtil::SHORTCUT_LOCATION_START_MENU_CHROME_DIR_DEPRECATED:
+    case ShellUtil::SHORTCUT_LOCATION_START_MENU_CHROME_DIR:
       message.append("Start menu/" +
                      base::UTF16ToUTF8(dist->GetStartMenuShortcutSubfolder(
                                      BrowserDistribution::SUBFOLDER_CHROME)) +
@@ -426,24 +423,8 @@
           ShellUtil::SHELL_SHORTCUT_CREATE_IF_NO_SYSTEM_LEVEL) {
     start_menu_properties.set_pin_to_taskbar(!do_not_create_taskbar_shortcut);
   }
-
-  // The attempt below to update the stortcut will fail if it does not already
-  // exist at the expected location on disk.  First check if it exists in the
-  // previous location (under a subdirectory) and, if so, move it to the new
-  // location.
-  base::FilePath old_shortcut_path;
-  ShellUtil::GetShortcutPath(
-      ShellUtil::SHORTCUT_LOCATION_START_MENU_CHROME_DIR_DEPRECATED, dist,
-      shortcut_level, &old_shortcut_path);
-  if (base::PathExists(old_shortcut_path)) {
-    ShellUtil::MoveExistingShortcut(
-        ShellUtil::SHORTCUT_LOCATION_START_MENU_CHROME_DIR_DEPRECATED,
-        ShellUtil::SHORTCUT_LOCATION_START_MENU_ROOT,
-        dist, start_menu_properties);
-  }
-
   ExecuteAndLogShortcutOperation(
-      ShellUtil::SHORTCUT_LOCATION_START_MENU_ROOT, dist,
+      ShellUtil::SHORTCUT_LOCATION_START_MENU_CHROME_DIR, dist,
       start_menu_properties, shortcut_operation);
 }
 

diff --git a/chrome/installer/setup/install_unittest.cc b/chrome/installer/setup/install_unittest.cc
index 0cb3e8f..6f8b9c0 100644
--- a/chrome/installer/setup/install_unittest.cc
+++ b/chrome/installer/setup/install_unittest.cc

@@ -125,21 +125,18 @@
         fake_user_desktop_.path().Append(shortcut_name);
     user_quick_launch_shortcut_ =
         fake_user_quick_launch_.path().Append(shortcut_name);
-    user_start_menu_shortcut_ = fake_start_menu_.path().Append(shortcut_name);
-    user_start_menu_subdir_shortcut_ =
-        fake_start_menu_.path()
-            .Append(dist_->GetStartMenuShortcutSubfolder(
+    user_start_menu_shortcut_ =
+        fake_start_menu_.path().Append(
+            dist_->GetStartMenuShortcutSubfolder(
                 BrowserDistribution::SUBFOLDER_CHROME))
-            .Append(shortcut_name);
+        .Append(shortcut_name);
     system_desktop_shortcut_ =
         fake_common_desktop_.path().Append(shortcut_name);
     system_start_menu_shortcut_ =
-        fake_common_start_menu_.path().Append(shortcut_name);
-    system_start_menu_subdir_shortcut_ =
-        fake_common_start_menu_.path()
-            .Append(dist_->GetStartMenuShortcutSubfolder(
+        fake_common_start_menu_.path().Append(
+            dist_->GetStartMenuShortcutSubfolder(
                 BrowserDistribution::SUBFOLDER_CHROME))
-            .Append(shortcut_name);
+        .Append(shortcut_name);
     user_alternate_desktop_shortcut_ =
         fake_user_desktop_.path().Append(alternate_shortcut_name);
   }
@@ -148,9 +145,7 @@
     // Try to unpin potentially pinned shortcuts (although pinning isn't tested,
     // the call itself might still have pinned the Start Menu shortcuts).
     base::win::UnpinShortcutFromTaskbar(user_start_menu_shortcut_);
-    base::win::UnpinShortcutFromTaskbar(user_start_menu_subdir_shortcut_);
     base::win::UnpinShortcutFromTaskbar(system_start_menu_shortcut_);
-    base::win::UnpinShortcutFromTaskbar(system_start_menu_subdir_shortcut_);
     CoUninitialize();
   }
 
@@ -205,10 +200,8 @@
   base::FilePath user_desktop_shortcut_;
   base::FilePath user_quick_launch_shortcut_;
   base::FilePath user_start_menu_shortcut_;
-  base::FilePath user_start_menu_subdir_shortcut_;
   base::FilePath system_desktop_shortcut_;
   base::FilePath system_start_menu_shortcut_;
-  base::FilePath system_start_menu_subdir_shortcut_;
   base::FilePath user_alternate_desktop_shortcut_;
 };
 
@@ -382,69 +375,6 @@
   ASSERT_FALSE(base::PathExists(user_start_menu_shortcut_));
 }
 
-class MigrateShortcutTest : public InstallShortcutTest,
-                            public testing::WithParamInterface<
-                                testing::tuple<
-                                    installer::InstallShortcutOperation,
-                                    installer::InstallShortcutLevel>> {
- public:
-  MigrateShortcutTest() : shortcut_operation_(testing::get<0>(GetParam())),
-                          shortcut_level_(testing::get<1>(GetParam())) {}
-
- protected:
-  const installer::InstallShortcutOperation shortcut_operation_;
-  const installer::InstallShortcutLevel shortcut_level_;
-
- private:
-  DISALLOW_COPY_AND_ASSIGN(MigrateShortcutTest);
-};
-
-TEST_P(MigrateShortcutTest, MigrateAwayFromDeprecatedStartMenuTest) {
-  base::win::ShortcutProperties dummy_properties;
-  base::FilePath dummy_target;
-  ASSERT_TRUE(base::CreateTemporaryFileInDir(temp_dir_.path(), &dummy_target));
-  dummy_properties.set_target(expected_properties_.target);
-  dummy_properties.set_working_dir(fake_user_desktop_.path());
-  dummy_properties.set_arguments(L"--dummy --args");
-  dummy_properties.set_app_id(L"El.Dummiest");
-
-  base::FilePath start_menu_shortcut;
-  base::FilePath start_menu_subdir_shortcut;
-  if (shortcut_level_ == installer::CURRENT_USER) {
-    start_menu_shortcut = user_start_menu_shortcut_;
-    start_menu_subdir_shortcut = user_start_menu_subdir_shortcut_;
-  } else {
-    start_menu_shortcut = system_start_menu_shortcut_;
-    start_menu_subdir_shortcut = system_start_menu_subdir_shortcut_;
-  }
-
-  ASSERT_TRUE(base::CreateDirectory(start_menu_subdir_shortcut.DirName()));
-  ASSERT_FALSE(base::PathExists(start_menu_subdir_shortcut));
-  ASSERT_TRUE(base::win::CreateOrUpdateShortcutLink(
-                  start_menu_subdir_shortcut, dummy_properties,
-                  base::win::SHORTCUT_CREATE_ALWAYS));
-  ASSERT_TRUE(base::PathExists(start_menu_subdir_shortcut));
-  ASSERT_FALSE(base::PathExists(start_menu_shortcut));
-
-  installer::CreateOrUpdateShortcuts(chrome_exe_, *product_, *prefs_,
-                                     shortcut_level_, shortcut_operation_);
-  ASSERT_FALSE(base::PathExists(start_menu_subdir_shortcut));
-  ASSERT_TRUE(base::PathExists(start_menu_shortcut));
-}
-
-// Verify that any installer operation for any installation level triggers
-// the migration from sub-folder to root of start-menu.
-INSTANTIATE_TEST_CASE_P(
-    MigrateShortcutTests, MigrateShortcutTest,
-    testing::Combine(
-        testing::Values(
-            installer::INSTALL_SHORTCUT_REPLACE_EXISTING,
-            installer::INSTALL_SHORTCUT_CREATE_EACH_IF_NO_SYSTEM_LEVEL,
-            installer::INSTALL_SHORTCUT_CREATE_ALL),
-        testing::Values(
-            installer::CURRENT_USER,
-            installer::ALL_USERS)));
-
 TEST_F(InstallShortcutTest, CreateIfNoSystemLevelAllSystemShortcutsExist) {
   base::win::ShortcutProperties dummy_properties;
   base::FilePath dummy_target;

diff --git a/chrome/installer/setup/setup_main.cc b/chrome/installer/setup/setup_main.cc
index 4808783..e5193d4 100644
--- a/chrome/installer/setup/setup_main.cc
+++ b/chrome/installer/setup/setup_main.cc

@@ -988,7 +988,7 @@
       shortcut_properties.set_dual_mode(true);
     shortcut_properties.set_pin_to_taskbar(true);
     ShellUtil::CreateOrUpdateShortcut(
-        ShellUtil::SHORTCUT_LOCATION_START_MENU_ROOT, chrome_dist,
+        ShellUtil::SHORTCUT_LOCATION_START_MENU_CHROME_DIR, chrome_dist,
         shortcut_properties, ShellUtil::SHELL_SHORTCUT_CREATE_ALWAYS);
 
     // Register Chrome at user-level and make it default.

diff --git a/chrome/installer/util/shell_util.cc b/chrome/installer/util/shell_util.cc
index f69c9d6..0c2de30 100644
--- a/chrome/installer/util/shell_util.cc
+++ b/chrome/installer/util/shell_util.cc

@@ -1544,8 +1544,7 @@
                                  BrowserDistribution* dist,
                                  ShellUtil::ShellChange level) {
   // Explicitly whitelist locations, since accidental calls can be very harmful.
-  if (location !=
-          ShellUtil::SHORTCUT_LOCATION_START_MENU_CHROME_DIR_DEPRECATED &&
+  if (location != ShellUtil::SHORTCUT_LOCATION_START_MENU_CHROME_DIR &&
       location != ShellUtil::SHORTCUT_LOCATION_START_MENU_CHROME_APPS_DIR &&
       location != ShellUtil::SHORTCUT_LOCATION_APP_SHORTCUTS) {
     NOTREACHED();
@@ -1624,12 +1623,13 @@
                                  CONFIRM_SHELL_REGISTRATION_IN_HKLM);
 }
 
-bool ShellUtil::ShortcutLocationIsSupported(ShortcutLocation location) {
+bool ShellUtil::ShortcutLocationIsSupported(
+    ShellUtil::ShortcutLocation location) {
   switch (location) {
     case SHORTCUT_LOCATION_DESKTOP:  // Falls through.
     case SHORTCUT_LOCATION_QUICK_LAUNCH:  // Falls through.
     case SHORTCUT_LOCATION_START_MENU_ROOT:  // Falls through.
-    case SHORTCUT_LOCATION_START_MENU_CHROME_DIR_DEPRECATED:  // Falls through.
+    case SHORTCUT_LOCATION_START_MENU_CHROME_DIR:  // Falls through.
     case SHORTCUT_LOCATION_START_MENU_CHROME_APPS_DIR:
       return true;
     case SHORTCUT_LOCATION_TASKBAR_PINS:
@@ -1642,7 +1642,7 @@
   }
 }
 
-bool ShellUtil::GetShortcutPath(ShortcutLocation location,
+bool ShellUtil::GetShortcutPath(ShellUtil::ShortcutLocation location,
                                 BrowserDistribution* dist,
                                 ShellChange level,
                                 base::FilePath* path) {
@@ -1663,7 +1663,7 @@
       dir_key = (level == CURRENT_USER) ? base::DIR_START_MENU :
                                           base::DIR_COMMON_START_MENU;
       break;
-    case SHORTCUT_LOCATION_START_MENU_CHROME_DIR_DEPRECATED:
+    case SHORTCUT_LOCATION_START_MENU_CHROME_DIR:
       dir_key = (level == CURRENT_USER) ? base::DIR_START_MENU :
                                           base::DIR_COMMON_START_MENU;
       folder_to_append = dist->GetStartMenuShortcutSubfolder(
@@ -1698,42 +1698,16 @@
   return true;
 }
 
-bool ShellUtil::MoveExistingShortcut(ShortcutLocation old_location,
-                                     ShortcutLocation new_location,
-                                     BrowserDistribution* dist,
-                                     const ShortcutProperties& properties) {
-  // Explicitly whitelist locations to which this is applicable.
-  if (old_location != SHORTCUT_LOCATION_START_MENU_CHROME_DIR_DEPRECATED ||
-      new_location != SHORTCUT_LOCATION_START_MENU_ROOT) {
-    NOTREACHED();
-    return false;
-  }
-
-  base::string16 shortcut_name(
-      ExtractShortcutNameFromProperties(dist, properties));
-
-  base::FilePath old_shortcut_path;
-  base::FilePath new_shortcut_path;
-  GetShortcutPath(old_location, dist, properties.level, &old_shortcut_path);
-  GetShortcutPath(new_location, dist, properties.level, &new_shortcut_path);
-  old_shortcut_path = old_shortcut_path.Append(shortcut_name);
-  new_shortcut_path = new_shortcut_path.Append(shortcut_name);
-
-  bool result = base::Move(old_shortcut_path, new_shortcut_path);
-  RemoveShortcutFolderIfEmpty(old_location, dist, properties.level);
-  return result;
-}
-
 bool ShellUtil::CreateOrUpdateShortcut(
-    ShortcutLocation location,
+    ShellUtil::ShortcutLocation location,
     BrowserDistribution* dist,
-    const ShortcutProperties& properties,
-    ShortcutOperation operation) {
+    const ShellUtil::ShortcutProperties& properties,
+    ShellUtil::ShortcutOperation operation) {
   // Explicitly whitelist locations to which this is applicable.
   if (location != SHORTCUT_LOCATION_DESKTOP &&
       location != SHORTCUT_LOCATION_QUICK_LAUNCH &&
       location != SHORTCUT_LOCATION_START_MENU_ROOT &&
-      location != SHORTCUT_LOCATION_START_MENU_CHROME_DIR_DEPRECATED &&
+      location != SHORTCUT_LOCATION_START_MENU_CHROME_DIR &&
       location != SHORTCUT_LOCATION_START_MENU_CHROME_APPS_DIR) {
     NOTREACHED();
     return false;
@@ -1842,7 +1816,7 @@
   DCHECK(dist);
   DCHECK(browsers);
 
-  const base::string16 base_key(kRegStartMenuInternet);
+  const base::string16 base_key(ShellUtil::kRegStartMenuInternet);
   base::string16 client_path;
   RegKey key;
   base::string16 name;
@@ -1982,7 +1956,7 @@
   base::FilePath app_path;
   if (!PathService::Get(base::FILE_EXE, &app_path)) {
     NOTREACHED();
-    return UNKNOWN_DEFAULT;
+    return ShellUtil::UNKNOWN_DEFAULT;
   }
 
   return GetChromeDefaultStateFromPath(app_path);
@@ -2025,7 +1999,7 @@
   base::FilePath chrome_exe;
   if (!PathService::Get(base::FILE_EXE, &chrome_exe)) {
     NOTREACHED();
-    return UNKNOWN_DEFAULT;
+    return ShellUtil::UNKNOWN_DEFAULT;
   }
 
   const wchar_t* const protocols[] = { protocol.c_str() };
@@ -2043,7 +2017,7 @@
                                   int shell_change,
                                   const base::FilePath& chrome_exe,
                                   bool elevate_if_not_admin) {
-  DCHECK(!(shell_change & SYSTEM_LEVEL) || IsUserAnAdmin());
+  DCHECK(!(shell_change & ShellUtil::SYSTEM_LEVEL) || IsUserAnAdmin());
 
   BrowserDistribution* distribution = BrowserDistribution::GetDistribution();
   if (distribution->GetDefaultBrowserControlPolicy() !=
@@ -2058,7 +2032,7 @@
     return false;
   }
 
-  if (!RegisterChromeBrowser(
+  if (!ShellUtil::RegisterChromeBrowser(
            dist, chrome_exe, base::string16(), elevate_if_not_admin)) {
     return false;
   }
@@ -2076,24 +2050,24 @@
     HRESULT hr = pAAR.CreateInstance(CLSID_ApplicationAssociationRegistration,
         NULL, CLSCTX_INPROC);
     if (SUCCEEDED(hr)) {
-      for (int i = 0; kBrowserProtocolAssociations[i] != NULL; i++) {
+      for (int i = 0; ShellUtil::kBrowserProtocolAssociations[i] != NULL; i++) {
         hr = pAAR->SetAppAsDefault(app_name.c_str(),
-            kBrowserProtocolAssociations[i], AT_URLPROTOCOL);
+            ShellUtil::kBrowserProtocolAssociations[i], AT_URLPROTOCOL);
         if (!SUCCEEDED(hr)) {
           ret = false;
           LOG(ERROR) << "Failed to register as default for protocol "
-                     << kBrowserProtocolAssociations[i]
+                     << ShellUtil::kBrowserProtocolAssociations[i]
                      << " (" << hr << ")";
         }
       }
 
-      for (int i = 0; kDefaultFileAssociations[i] != NULL; i++) {
+      for (int i = 0; ShellUtil::kDefaultFileAssociations[i] != NULL; i++) {
         hr = pAAR->SetAppAsDefault(app_name.c_str(),
-            kDefaultFileAssociations[i], AT_FILEEXTENSION);
+            ShellUtil::kDefaultFileAssociations[i], AT_FILEEXTENSION);
         if (!SUCCEEDED(hr)) {
           ret = false;
           LOG(ERROR) << "Failed to register as default for file extension "
-                     << kDefaultFileAssociations[i]
+                     << ShellUtil::kDefaultFileAssociations[i]
                      << " (" << hr << ")";
         }
       }
@@ -2376,11 +2350,11 @@
 }
 
 // static
-bool ShellUtil::RemoveShortcuts(ShortcutLocation location,
+bool ShellUtil::RemoveShortcuts(ShellUtil::ShortcutLocation location,
                                 BrowserDistribution* dist,
                                 ShellChange level,
                                 const base::FilePath& target_exe) {
-  if (!ShortcutLocationIsSupported(location))
+  if (!ShellUtil::ShortcutLocationIsSupported(location))
     return true;  // Vacuous success.
 
   FilterTargetEq shortcut_filter(target_exe, false);
@@ -2394,7 +2368,7 @@
                                      NULL);
   // Remove chrome-specific shortcut folders if they are now empty.
   if (success &&
-      (location == SHORTCUT_LOCATION_START_MENU_CHROME_DIR_DEPRECATED ||
+      (location == SHORTCUT_LOCATION_START_MENU_CHROME_DIR ||
        location == SHORTCUT_LOCATION_START_MENU_CHROME_APPS_DIR ||
        location == SHORTCUT_LOCATION_APP_SHORTCUTS)) {
     success = RemoveShortcutFolderIfEmpty(location, dist, level);
@@ -2404,12 +2378,12 @@
 
 // static
 bool ShellUtil::RetargetShortcutsWithArgs(
-    ShortcutLocation location,
+    ShellUtil::ShortcutLocation location,
     BrowserDistribution* dist,
     ShellChange level,
     const base::FilePath& old_target_exe,
     const base::FilePath& new_target_exe) {
-  if (!ShortcutLocationIsSupported(location))
+  if (!ShellUtil::ShortcutLocationIsSupported(location))
     return true;  // Vacuous success.
 
   FilterTargetEq shortcut_filter(old_target_exe, true);
@@ -2421,14 +2395,14 @@
 
 // static
 bool ShellUtil::ShortcutListMaybeRemoveUnknownArgs(
-    ShortcutLocation location,
+    ShellUtil::ShortcutLocation location,
     BrowserDistribution* dist,
     ShellChange level,
     const base::FilePath& chrome_exe,
     bool do_removal,
     const scoped_refptr<SharedCancellationFlag>& cancel,
     std::vector<std::pair<base::FilePath, base::string16> >* shortcuts) {
-  if (!ShortcutLocationIsSupported(location))
+  if (!ShellUtil::ShortcutLocationIsSupported(location))
     return false;
   DCHECK(dist);
   FilterTargetEq shortcut_filter(chrome_exe, true);
@@ -2550,7 +2524,7 @@
 // static
 bool ShellUtil::DeleteFileAssociations(const base::string16& prog_id) {
   // Delete the key HKEY_CURRENT_USER\Software\Classes\PROGID.
-  base::string16 key_path(kRegClasses);
+  base::string16 key_path(ShellUtil::kRegClasses);
   key_path.push_back(base::FilePath::kSeparators[0]);
   key_path.append(prog_id);
   return InstallUtil::DeleteRegistryKey(

diff --git a/chrome/installer/util/shell_util.h b/chrome/installer/util/shell_util.h
index 1c34c5d..f13e2bb 100644
--- a/chrome/installer/util/shell_util.h
+++ b/chrome/installer/util/shell_util.h

@@ -54,9 +54,9 @@
     SHORTCUT_LOCATION_DESKTOP = SHORTCUT_LOCATION_FIRST,
     SHORTCUT_LOCATION_QUICK_LAUNCH,
     SHORTCUT_LOCATION_START_MENU_ROOT,
-    SHORTCUT_LOCATION_START_MENU_CHROME_DIR_DEPRECATED,  // now placed in root
+    SHORTCUT_LOCATION_START_MENU_CHROME_DIR,
     SHORTCUT_LOCATION_START_MENU_CHROME_APPS_DIR,
-    SHORTCUT_LOCATION_TASKBAR_PINS,   // base::win::VERSION_WIN7 +
+    SHORTCUT_LOCATION_TASKBAR_PINS,  // base::win::VERSION_WIN7 +
     SHORTCUT_LOCATION_APP_SHORTCUTS,  // base::win::VERSION_WIN8 +
     NUM_SHORTCUT_LOCATIONS
   };
@@ -311,25 +311,17 @@
 
   // Returns true if the current Windows version supports the presence of
   // shortcuts at |location|.
-  static bool ShortcutLocationIsSupported(ShortcutLocation location);
+  static bool ShortcutLocationIsSupported(ShellUtil::ShortcutLocation location);
 
   // Sets |path| to the path for a shortcut at the |location| desired for the
   // given |level| (CURRENT_USER for per-user path and SYSTEM_LEVEL for
   // all-users path).
   // Returns false on failure.
-  static bool GetShortcutPath(ShortcutLocation location,
+  static bool GetShortcutPath(ShellUtil::ShortcutLocation location,
                               BrowserDistribution* dist,
                               ShellChange level,
                               base::FilePath* path);
 
-  // Move an existing shortcut from |old_location| to |new_location| for the
-  // set |shortcut_level|.  If the folder containing |old_location| is then
-  // empty, it will be removed.
-  static bool MoveExistingShortcut(ShortcutLocation old_location,
-                                   ShortcutLocation new_location,
-                                   BrowserDistribution* dist,
-                                   const ShortcutProperties& properties);
-
   // Updates shortcut in |location| (or creates it if |options| specify
   // SHELL_SHORTCUT_CREATE_ALWAYS).
   // |dist| gives the type of browser distribution currently in use.
@@ -340,10 +332,10 @@
   // SHORTCUT_LOCATION_START_MENU_CHROME_DIR, or
   // SHORTCUT_LOCATION_START_MENU_CHROME_APPS_DIR.
   static bool CreateOrUpdateShortcut(
-      ShortcutLocation location,
+      ShellUtil::ShortcutLocation location,
       BrowserDistribution* dist,
-      const ShortcutProperties& properties,
-      ShortcutOperation operation);
+      const ShellUtil::ShortcutProperties& properties,
+      ShellUtil::ShortcutOperation operation);
 
   // Returns the string "|icon_path|,|icon_index|" (see, for example,
   // http://msdn.microsoft.com/library/windows/desktop/dd391573.aspx).
@@ -551,7 +543,7 @@
   // If |location| is a Chrome-specific folder, it will be deleted as well.
   // Returns true if all shortcuts pointing to |target_exe| are successfully
   // deleted, including the case where no such shortcuts are found.
-  static bool RemoveShortcuts(ShortcutLocation location,
+  static bool RemoveShortcuts(ShellUtil::ShortcutLocation location,
                               BrowserDistribution* dist,
                               ShellChange level,
                               const base::FilePath& target_exe);
@@ -565,7 +557,7 @@
   // Returns true if all updates to matching shortcuts are successful, including
   // the vacuous case where no matching shortcuts are found.
   static bool RetargetShortcutsWithArgs(
-      ShortcutLocation location,
+      ShellUtil::ShortcutLocation location,
       BrowserDistribution* dist,
       ShellChange level,
       const base::FilePath& old_target_exe,
@@ -578,7 +570,7 @@
   // those shortcuts. This method will abort and return false if |cancel| is
   // non-NULL and gets set at any point during this call.
   static bool ShortcutListMaybeRemoveUnknownArgs(
-      ShortcutLocation location,
+      ShellUtil::ShortcutLocation location,
       BrowserDistribution* dist,
       ShellChange level,
       const base::FilePath& chrome_exe,

diff --git a/chrome/installer/util/shell_util_unittest.cc b/chrome/installer/util/shell_util_unittest.cc
index e581064..3b97dd0 100644
--- a/chrome/installer/util/shell_util_unittest.cc
+++ b/chrome/installer/util/shell_util_unittest.cc

@@ -117,11 +117,7 @@
       case ShellUtil::SHORTCUT_LOCATION_QUICK_LAUNCH:
         expected_path = fake_user_quick_launch_.path();
         break;
-      case ShellUtil::SHORTCUT_LOCATION_START_MENU_ROOT:
-        expected_path = (properties.level == ShellUtil::CURRENT_USER) ?
-            fake_start_menu_.path() : fake_common_start_menu_.path();
-        break;
-      case ShellUtil::SHORTCUT_LOCATION_START_MENU_CHROME_DIR_DEPRECATED:
+      case ShellUtil::SHORTCUT_LOCATION_START_MENU_CHROME_DIR:
         expected_path = (properties.level == ShellUtil::CURRENT_USER) ?
             fake_start_menu_.path() : fake_common_start_menu_.path();
         expected_path = expected_path.Append(
@@ -237,50 +233,17 @@
   base::string16 start_menu_subfolder =
       dist_->GetStartMenuShortcutSubfolder(
           BrowserDistribution::SUBFOLDER_CHROME);
-  ShellUtil::GetShortcutPath(
-      ShellUtil::SHORTCUT_LOCATION_START_MENU_CHROME_DIR_DEPRECATED,
-      dist_, ShellUtil::CURRENT_USER, &path);
+  ShellUtil::GetShortcutPath(ShellUtil::SHORTCUT_LOCATION_START_MENU_CHROME_DIR,
+                             dist_, ShellUtil::CURRENT_USER, &path);
   EXPECT_EQ(fake_start_menu_.path().Append(start_menu_subfolder),
             path);
 
-  ShellUtil::GetShortcutPath(
-      ShellUtil::SHORTCUT_LOCATION_START_MENU_CHROME_DIR_DEPRECATED,
-      dist_, ShellUtil::SYSTEM_LEVEL, &path);
+  ShellUtil::GetShortcutPath(ShellUtil::SHORTCUT_LOCATION_START_MENU_CHROME_DIR,
+                             dist_, ShellUtil::SYSTEM_LEVEL, &path);
   EXPECT_EQ(fake_common_start_menu_.path().Append(start_menu_subfolder),
             path);
 }
 
-TEST_F(ShellUtilShortcutTest, MoveExistingShortcut) {
-  test_properties_.set_shortcut_name(L"Bobo le shortcut");
-  test_properties_.level = ShellUtil::SYSTEM_LEVEL;
-  base::FilePath old_shortcut_path(GetExpectedShortcutPath(
-      ShellUtil::SHORTCUT_LOCATION_START_MENU_CHROME_DIR_DEPRECATED,
-      dist_, test_properties_));
-
-  ASSERT_TRUE(
-    ShellUtil::CreateOrUpdateShortcut(
-        ShellUtil::SHORTCUT_LOCATION_START_MENU_CHROME_DIR_DEPRECATED,
-        dist_, test_properties_,
-        ShellUtil::SHELL_SHORTCUT_CREATE_ALWAYS));
-  ValidateChromeShortcut(
-      ShellUtil::SHORTCUT_LOCATION_START_MENU_CHROME_DIR_DEPRECATED,
-      dist_, test_properties_);
-  ASSERT_TRUE(base::PathExists(old_shortcut_path.DirName()));
-  ASSERT_TRUE(base::PathExists(old_shortcut_path));
-
-  ASSERT_TRUE(
-    ShellUtil::MoveExistingShortcut(
-        ShellUtil::SHORTCUT_LOCATION_START_MENU_CHROME_DIR_DEPRECATED,
-        ShellUtil::SHORTCUT_LOCATION_START_MENU_ROOT,
-        dist_, test_properties_));
-
-  ValidateChromeShortcut(
-      ShellUtil::SHORTCUT_LOCATION_START_MENU_ROOT,
-      dist_, test_properties_);
-  ASSERT_FALSE(base::PathExists(old_shortcut_path));
-  ASSERT_FALSE(base::PathExists(old_shortcut_path.DirName()));
-}
-
 TEST_F(ShellUtilShortcutTest, CreateChromeExeShortcutWithDefaultProperties) {
   ShellUtil::ShortcutProperties properties(ShellUtil::CURRENT_USER);
   product_->AddDefaultShortcutProperties(chrome_exe_, &properties);
@@ -294,14 +257,12 @@
 TEST_F(ShellUtilShortcutTest, CreateStartMenuShortcutWithAllProperties) {
   test_properties_.set_shortcut_name(L"Bobo le shortcut");
   test_properties_.level = ShellUtil::SYSTEM_LEVEL;
-  ASSERT_TRUE(
-    ShellUtil::CreateOrUpdateShortcut(
-        ShellUtil::SHORTCUT_LOCATION_START_MENU_CHROME_DIR_DEPRECATED,
-        dist_, test_properties_,
-        ShellUtil::SHELL_SHORTCUT_CREATE_ALWAYS));
-  ValidateChromeShortcut(
-      ShellUtil::SHORTCUT_LOCATION_START_MENU_CHROME_DIR_DEPRECATED,
-      dist_, test_properties_);
+  ASSERT_TRUE(ShellUtil::CreateOrUpdateShortcut(
+                  ShellUtil::SHORTCUT_LOCATION_START_MENU_CHROME_DIR,
+                  dist_, test_properties_,
+                  ShellUtil::SHELL_SHORTCUT_CREATE_ALWAYS));
+  ValidateChromeShortcut(ShellUtil::SHORTCUT_LOCATION_START_MENU_CHROME_DIR,
+                         dist_, test_properties_);
 }
 
 TEST_F(ShellUtilShortcutTest, ReplaceSystemLevelDesktopShortcut) {
@@ -356,24 +317,21 @@
 TEST_F(ShellUtilShortcutTest, UpdateAddDualModeToStartMenuShortcut) {
   ShellUtil::ShortcutProperties properties(ShellUtil::CURRENT_USER);
   product_->AddDefaultShortcutProperties(chrome_exe_, &properties);
-  ASSERT_TRUE(
-      ShellUtil::CreateOrUpdateShortcut(
-          ShellUtil::SHORTCUT_LOCATION_START_MENU_CHROME_DIR_DEPRECATED, dist_,
-          properties, ShellUtil::SHELL_SHORTCUT_CREATE_ALWAYS));
+  ASSERT_TRUE(ShellUtil::CreateOrUpdateShortcut(
+                  ShellUtil::SHORTCUT_LOCATION_START_MENU_CHROME_DIR, dist_,
+                  properties, ShellUtil::SHELL_SHORTCUT_CREATE_ALWAYS));
 
   ShellUtil::ShortcutProperties added_properties(ShellUtil::CURRENT_USER);
   added_properties.set_dual_mode(true);
-  ASSERT_TRUE(
-      ShellUtil::CreateOrUpdateShortcut(
-          ShellUtil::SHORTCUT_LOCATION_START_MENU_CHROME_DIR_DEPRECATED, dist_,
-          added_properties, ShellUtil::SHELL_SHORTCUT_UPDATE_EXISTING));
+  ASSERT_TRUE(ShellUtil::CreateOrUpdateShortcut(
+                  ShellUtil::SHORTCUT_LOCATION_START_MENU_CHROME_DIR, dist_,
+                  added_properties, ShellUtil::SHELL_SHORTCUT_UPDATE_EXISTING));
 
   ShellUtil::ShortcutProperties expected_properties(properties);
   expected_properties.set_dual_mode(true);
 
-  ValidateChromeShortcut(
-      ShellUtil::SHORTCUT_LOCATION_START_MENU_CHROME_DIR_DEPRECATED,
-      dist_, expected_properties);
+  ValidateChromeShortcut(ShellUtil::SHORTCUT_LOCATION_START_MENU_CHROME_DIR,
+                         dist_, expected_properties);
 }
 
 TEST_F(ShellUtilShortcutTest, CreateIfNoSystemLevel) {
@@ -406,12 +364,11 @@
 
 TEST_F(ShellUtilShortcutTest, CreateIfNoSystemLevelStartMenu) {
   ASSERT_TRUE(ShellUtil::CreateOrUpdateShortcut(
-                  ShellUtil::SHORTCUT_LOCATION_START_MENU_CHROME_DIR_DEPRECATED,
+                  ShellUtil::SHORTCUT_LOCATION_START_MENU_CHROME_DIR,
                   dist_, test_properties_,
                   ShellUtil::SHELL_SHORTCUT_CREATE_IF_NO_SYSTEM_LEVEL));
-  ValidateChromeShortcut(
-      ShellUtil::SHORTCUT_LOCATION_START_MENU_CHROME_DIR_DEPRECATED,
-      dist_, test_properties_);
+  ValidateChromeShortcut(ShellUtil::SHORTCUT_LOCATION_START_MENU_CHROME_DIR,
+                         dist_, test_properties_);
 }
 
 TEST_F(ShellUtilShortcutTest, CreateAlwaysUserWithSystemLevelPresent) {
@@ -743,7 +700,7 @@
 
 TEST_F(ShellUtilShortcutTest, CreateMultipleStartMenuShortcutsAndRemoveFolder) {
   ASSERT_TRUE(ShellUtil::CreateOrUpdateShortcut(
-                  ShellUtil::SHORTCUT_LOCATION_START_MENU_CHROME_DIR_DEPRECATED,
+                  ShellUtil::SHORTCUT_LOCATION_START_MENU_CHROME_DIR,
                   dist_, test_properties_,
                   ShellUtil::SHELL_SHORTCUT_CREATE_ALWAYS));
   ASSERT_TRUE(ShellUtil::CreateOrUpdateShortcut(
@@ -752,7 +709,7 @@
                   ShellUtil::SHELL_SHORTCUT_CREATE_ALWAYS));
   test_properties_.set_shortcut_name(L"A second shortcut");
   ASSERT_TRUE(ShellUtil::CreateOrUpdateShortcut(
-                  ShellUtil::SHORTCUT_LOCATION_START_MENU_CHROME_DIR_DEPRECATED,
+                  ShellUtil::SHORTCUT_LOCATION_START_MENU_CHROME_DIR,
                   dist_, test_properties_,
                   ShellUtil::SHELL_SHORTCUT_CREATE_ALWAYS));
   ASSERT_TRUE(ShellUtil::CreateOrUpdateShortcut(
@@ -786,7 +743,7 @@
 
   ASSERT_TRUE(base::PathExists(chrome_shortcut_folder));
   ASSERT_TRUE(ShellUtil::RemoveShortcuts(
-      ShellUtil::SHORTCUT_LOCATION_START_MENU_CHROME_DIR_DEPRECATED, dist_,
+      ShellUtil::SHORTCUT_LOCATION_START_MENU_CHROME_DIR, dist_,
       ShellUtil::CURRENT_USER, chrome_exe_));
   ASSERT_FALSE(base::PathExists(chrome_shortcut_folder));
 

diff --git a/chromecast/base/device_capabilities.h b/chromecast/base/device_capabilities.h
index bffd37a0..d5552d1 100644
--- a/chromecast/base/device_capabilities.h
+++ b/chromecast/base/device_capabilities.h

@@ -7,6 +7,8 @@
 
 #include <string>
 
+#include "base/macros.h"
+#include "base/memory/ref_counted.h"
 #include "base/memory/scoped_ptr.h"
 
 namespace base {
@@ -28,14 +30,22 @@
 // system beforehand and are introduced by external parties. These capabilites
 // are stored and then forwarded to app servers that use them to determine how
 // to interact with the device.
+//
+// Thread Safety:
+// Observers can be added from any thread. Each Observer is guaranteed to be
+// notified on same thread that it was added on and must be removed on the same
+// thread that it was added on.
+//
+// Validators can be registered from any thread. Each Validator's Validate()
+// method is guaranteed to be called on same thread that the Validator was
+// registered on. The Validator must be unregistered on the same thread
+// that it was registered on.
+//
+// All other methods can be called safely from any thread.
 
 // TODO(esum):
-// 1) A pure virtual interface with implementation files is no longer needed
-//    now that this file resides in chromecast/base. Change it such that there
-//    is just device_capabilities.h/cc.
-// 2) Make class thread-safe with locking.
-// 3) Add WifiSupported, HotspotSupported, and MultizoneSupported capabilities.
-// 4) It's not ideal to have the accessors (BluetoothSupported(), etc.) not
+// 1) Add WifiSupported, HotspotSupported, and MultizoneSupported capabilities.
+// 2) It's not ideal to have the accessors (BluetoothSupported(), etc.) not
 //    be valid initially until the capability gets registered. We might want
 //    to use some kind of builder class to solve this.
 class DeviceCapabilities {
@@ -86,10 +96,44 @@
     DISALLOW_COPY_AND_ASSIGN(Validator);
   };
 
+  // Class used to store/own capabilities-related data. It is immutable and
+  // RefCountedThreadSafe, so client code can freely query it throughout its
+  // lifetime without worrying about the data getting invalidated in any way.
+  class Data : public base::RefCountedThreadSafe<Data> {
+   public:
+    // Accessor for complete capabilities in dictionary format.
+    const base::DictionaryValue& dictionary() const {
+      return *dictionary_.get();
+    }
+
+    // Accessor for complete capabilities string in JSON format.
+    const std::string& json_string() const { return *json_string_.get(); }
+
+   private:
+    friend class base::RefCountedThreadSafe<Data>;
+    // DeviceCapabilities should be the only one responsible for Data
+    // construction. See CreateData() methods.
+    friend class DeviceCapabilities;
+
+    // Constructs empty dictionary with no capabilities.
+    Data();
+    // Uses |dictionary| as capabilities dictionary.
+    explicit Data(scoped_ptr<const base::DictionaryValue> dictionary);
+    ~Data();
+
+    const scoped_ptr<const base::DictionaryValue> dictionary_;
+    const scoped_ptr<const std::string> json_string_;
+
+    DISALLOW_COPY_AND_ASSIGN(Data);
+  };
+
   // Default Capability keys
   static const char kKeyBluetoothSupported[];
   static const char kKeyDisplaySupported[];
 
+  // This class should get destroyed after all Validators have been
+  // unregistered, all Observers have been removed, and the class is no longer
+  // being accessed.
   virtual ~DeviceCapabilities() {}
 
   // Create empty instance with no capabilities. Although the class is not
@@ -109,16 +153,17 @@
   // farther down. For example, "foo" is a valid value for |key|, but "foo.bar"
   // is not. Note that if "foo.bar" is updated in SetCapability(), the
   // Validate() method for "foo"'s Validator will be called, with a |path| of
-  // "foo.bar". Both Register() and Unregister() must be called on cast
-  // receiver main thread; the Validator provided will also be called on cast
-  // receiver main thread. Note that this method does not add or modify
-  // the capability. To do this, SetCapability() should be called, or
-  // Validators can call SetValidatedValue().
+  // "foo.bar". Note that this method does not add or modify the capability.
+  // To do this, SetCapability() should be called, or Validators can call
+  // SetValidatedValue(). This method is synchronous to ensure Validators know
+  // exactly when they may start receiving validation requests.
   virtual void Register(const std::string& key,
                         Validator* validator) = 0;
   // Unregisters Validator for |key|. |validator| argument must match
   // |validator| argument that was passed in to Register() for |key|. Note that
-  // the capability and its value remain untouched.
+  // the capability and its value remain untouched. This method is synchronous
+  // to ensure Validators know exactly when they will stop receiving validation
+  // requests.
   virtual void Unregister(const std::string& key,
                           const Validator* validator) = 0;
   // Gets the Validator currently registered for |key|. Returns nullptr if
@@ -131,18 +176,17 @@
   virtual bool BluetoothSupported() const = 0;
   virtual bool DisplaySupported() const = 0;
 
-  // Gets the value of |path|. If capability at |path| does not exist,
-  // |out_value| remains untouched. Returns true if the capability has been
-  // successfully retrieved. Note that this does NOT perform a deep copy, and
-  // DeviceCapabilities still owns the memory returned through |out_value|.
-  virtual bool GetCapability(const std::string& path,
-                             const base::Value** out_value) const = 0;
+  // Returns a deep copy of the value at |path|. If the capability at |path|
+  // does not exist, a null scoped_ptr is returned.
+  virtual scoped_ptr<base::Value> GetCapability(
+      const std::string& path) const = 0;
 
-  // Returns the complete capability string (JSON format).
-  virtual const std::string& GetCapabilitiesString() const = 0;
-
-  // Returns the capabilities dictionary.
-  virtual const base::DictionaryValue* GetCapabilities() const = 0;
+  // Use this method to access dictionary and JSON string. No deep copying is
+  // performed, so this method is inexpensive. Note that any capability updates
+  // that occur after GetData() has been called will not be reflected in the
+  // returned scoped_refptr. You can think of this method as taking a snapshot
+  // of the capabilities when it gets called.
+  virtual scoped_refptr<Data> GetData() const = 0;
 
   // Updates the value at |path| to |proposed_value| if |path| already exists
   // and adds new capability if |path| doesn't. Note that if a key has been
@@ -151,11 +195,11 @@
   // Ex: If "foo" has a Validator registered, a |path| of "foo.bar"
   // will cause |proposed_value| to go through the Validator's Validate()
   // method. Client code may use the Observer interface to determine the
-  // ultimate value used.
+  // ultimate value used. This method is asynchronous.
   virtual void SetCapability(const std::string& path,
                              scoped_ptr<base::Value> proposed_value) = 0;
   // Iterates through entries in |dict_value| and calls SetCapability() for
-  // each one.
+  // each one. This method is asynchronous.
   virtual void MergeDictionary(const base::DictionaryValue& dict_value) = 0;
 
   // Adds/removes an observer. It doesn't take the ownership of |observer|.
@@ -165,10 +209,18 @@
  protected:
   DeviceCapabilities() {}
 
+  // For derived implementation classes to create Data instances since they do
+  // not have access to Data constructors.
+  // Creates empty dictionary with no capabilities.
+  static scoped_refptr<Data> CreateData();
+  // Uses |dictionary| as capabilities dictionary.
+  static scoped_refptr<Data> CreateData(
+      scoped_ptr<const base::DictionaryValue> dictionary);
+
  private:
   // Does actual internal update of |path| to |new_value|.
-  virtual void SetValidatedValueInternal(const std::string& path,
-                                         scoped_ptr<base::Value> new_value) = 0;
+  virtual void SetValidatedValue(const std::string& path,
+                                 scoped_ptr<base::Value> new_value) = 0;
 
   DISALLOW_COPY_AND_ASSIGN(DeviceCapabilities);
 };

diff --git a/chromecast/base/device_capabilities_impl.cc b/chromecast/base/device_capabilities_impl.cc
index 7361390..5d35913 100644
--- a/chromecast/base/device_capabilities_impl.cc
+++ b/chromecast/base/device_capabilities_impl.cc

@@ -5,6 +5,8 @@
 #include "chromecast/base/device_capabilities_impl.h"
 
 #include "base/logging.h"
+#include "base/single_thread_task_runner.h"
+#include "base/thread_task_runner_handle.h"
 #include "base/values.h"
 #include "chromecast/base/serializers.h"
 
@@ -59,6 +61,16 @@
   return make_scoped_ptr(capabilities);
 }
 
+scoped_refptr<DeviceCapabilities::Data> DeviceCapabilities::CreateData() {
+  return make_scoped_refptr(new Data);
+}
+
+scoped_refptr<DeviceCapabilities::Data> DeviceCapabilities::CreateData(
+    scoped_ptr<const base::DictionaryValue> dictionary) {
+  DCHECK(dictionary.get());
+  return make_scoped_refptr(new Data(dictionary.Pass()));
+}
+
 DeviceCapabilities::Validator::Validator(DeviceCapabilities* capabilities)
     : capabilities_(capabilities) {
   DCHECK(capabilities);
@@ -67,108 +79,168 @@
 void DeviceCapabilities::Validator::SetValidatedValue(
     const std::string& path,
     scoped_ptr<base::Value> new_value) const {
-  capabilities_->SetValidatedValueInternal(path, new_value.Pass());
+  capabilities_->SetValidatedValue(path, new_value.Pass());
+}
+
+DeviceCapabilities::Data::Data()
+    : dictionary_(new base::DictionaryValue),
+      json_string_(SerializeToJson(*dictionary_)) {
+  DCHECK(json_string_.get());
+}
+
+DeviceCapabilities::Data::Data(
+    scoped_ptr<const base::DictionaryValue> dictionary)
+    : dictionary_(dictionary.Pass()),
+      json_string_(SerializeToJson(*dictionary_)) {
+  DCHECK(dictionary_.get());
+  DCHECK(json_string_.get());
+}
+
+DeviceCapabilitiesImpl::Data::~Data() {}
+
+DeviceCapabilitiesImpl::ValidatorInfo::ValidatorInfo(Validator* validator)
+    : validator_(validator), task_runner_(base::ThreadTaskRunnerHandle::Get()) {
+  DCHECK(validator_);
+  DCHECK(task_runner_.get());
+}
+
+DeviceCapabilitiesImpl::ValidatorInfo::~ValidatorInfo() {
+  // Check that ValidatorInfo is being destroyed on the same thread that it was
+  // constructed on.
+  DCHECK(task_runner_->BelongsToCurrentThread());
+}
+
+void DeviceCapabilitiesImpl::ValidatorInfo::Validate(
+    const std::string& path,
+    scoped_ptr<base::Value> proposed_value) const {
+  // Check that we are running Validate on the same thread that ValidatorInfo
+  // was constructed on.
+  DCHECK(task_runner_->BelongsToCurrentThread());
+  validator_->Validate(path, proposed_value.Pass());
 }
 
 DeviceCapabilitiesImpl::DeviceCapabilitiesImpl()
-    : capabilities_(new base::DictionaryValue),
-      capabilities_str_(SerializeToJson(*capabilities_)) {
-  DCHECK(capabilities_str_.get());
+    : data_(CreateData()),
+      task_runner_for_writes_(base::ThreadTaskRunnerHandle::Get()),
+      observer_list_(new base::ObserverListThreadSafe<Observer>) {
+  DCHECK(task_runner_for_writes_.get());
 }
 
 DeviceCapabilitiesImpl::~DeviceCapabilitiesImpl() {
-  DCHECK(thread_checker_.CalledOnValidThread());
   // Make sure that any registered Validators have unregistered at this point
   DCHECK(validator_map_.empty());
+  // Make sure that all observers have been removed at this point
+  observer_list_->AssertEmpty();
 }
 
 void DeviceCapabilitiesImpl::Register(const std::string& key,
                                       Validator* validator) {
-  DCHECK(thread_checker_.CalledOnValidThread());
   DCHECK(IsValidRegisterKey(key));
   DCHECK(validator);
 
-  bool added = validator_map_.insert(std::make_pair(key, validator)).second;
+  base::AutoLock auto_lock(validation_lock_);
+  bool added =
+      validator_map_.add(key, make_scoped_ptr(new ValidatorInfo(validator)))
+          .second;
   // Check that a validator has not already been registered for this key
   DCHECK(added);
 }
 
 void DeviceCapabilitiesImpl::Unregister(const std::string& key,
                                         const Validator* validator) {
-  DCHECK(thread_checker_.CalledOnValidThread());
+  base::AutoLock auto_lock(validation_lock_);
+  auto validator_it = validator_map_.find(key);
+  DCHECK(validator_it != validator_map_.end());
   // Check that validator being unregistered matches the original for |key|.
   // This prevents managers from accidentally unregistering incorrect
   // validators.
-  DCHECK_EQ(validator, GetValidator(key));
-  bool erased = validator_map_.erase(key);
-  DCHECK(erased);
+  DCHECK_EQ(validator, validator_it->second->validator());
+  // Check that validator is unregistering on same thread that it was
+  // registered on
+  DCHECK(validator_it->second->task_runner()->BelongsToCurrentThread());
+  validator_map_.erase(validator_it);
 }
 
 DeviceCapabilities::Validator* DeviceCapabilitiesImpl::GetValidator(
     const std::string& key) const {
+  base::AutoLock auto_lock(validation_lock_);
   auto validator_it = validator_map_.find(key);
-  return validator_it == validator_map_.end() ? nullptr : validator_it->second;
+  return validator_it == validator_map_.end()
+             ? nullptr
+             : validator_it->second->validator();
 }
 
 bool DeviceCapabilitiesImpl::BluetoothSupported() const {
-  DCHECK(thread_checker_.CalledOnValidThread());
+  scoped_refptr<Data> data_ref = GetData();
   bool bluetooth_supported = false;
-  bool found_key =
-      capabilities_->GetBoolean(kKeyBluetoothSupported, &bluetooth_supported);
+  bool found_key = data_ref->dictionary().GetBoolean(kKeyBluetoothSupported,
+                                                     &bluetooth_supported);
   DCHECK(found_key);
   return bluetooth_supported;
 }
 
 bool DeviceCapabilitiesImpl::DisplaySupported() const {
-  DCHECK(thread_checker_.CalledOnValidThread());
+  scoped_refptr<Data> data_ref = GetData();
   bool display_supported = false;
-  bool found_key =
-      capabilities_->GetBoolean(kKeyDisplaySupported, &display_supported);
+  bool found_key = data_ref->dictionary().GetBoolean(kKeyDisplaySupported,
+                                                     &display_supported);
   DCHECK(found_key);
   return display_supported;
 }
 
-bool DeviceCapabilitiesImpl::GetCapability(
-    const std::string& path,
-    const base::Value** out_value) const {
-  DCHECK(thread_checker_.CalledOnValidThread());
-  return capabilities_ && capabilities_->Get(path, out_value);
+scoped_ptr<base::Value> DeviceCapabilitiesImpl::GetCapability(
+    const std::string& path) const {
+  scoped_refptr<Data> data_ref = GetData();
+  const base::Value* value = nullptr;
+  bool found_path = data_ref->dictionary().Get(path, &value);
+  return found_path ? value->CreateDeepCopy() : scoped_ptr<base::Value>();
 }
 
-const std::string& DeviceCapabilitiesImpl::GetCapabilitiesString() const {
-  DCHECK(thread_checker_.CalledOnValidThread());
-  return *capabilities_str_;
-}
-
-const base::DictionaryValue* DeviceCapabilitiesImpl::GetCapabilities() const {
-  DCHECK(thread_checker_.CalledOnValidThread());
-  return capabilities_.get();
+scoped_refptr<DeviceCapabilities::Data>
+DeviceCapabilitiesImpl::GetData() const {
+  // Need to acquire lock here when copy constructing data_ otherwise we could
+  // be concurrently be writing to scoped_refptr in SetValidatedValue(), which
+  // could cause a bad scoped_refptr read.
+  base::AutoLock auto_lock(data_lock_);
+  return data_;
 }
 
 void DeviceCapabilitiesImpl::SetCapability(
     const std::string& path,
     scoped_ptr<base::Value> proposed_value) {
-  DCHECK(thread_checker_.CalledOnValidThread());
   DCHECK(proposed_value.get());
   if (!IsValidPath(path)) {
     LOG(DFATAL) << "Invalid capability path encountered for SetCapability()";
     return;
   }
 
-  // Check for Validator registered under first key per the Register()
-  // interface.
-  auto validator_it = validator_map_.find(GetFirstKey(path));
-  if (validator_it == validator_map_.end()) {
-    SetValidatedValueInternal(path, proposed_value.Pass());
-    return;
+  {
+    base::AutoLock auto_lock(validation_lock_);
+    // Check for Validator registered under first key per the Register()
+    // interface.
+    auto validator_it = validator_map_.find(GetFirstKey(path));
+    if (validator_it != validator_map_.end()) {
+      // We do not want to post a task directly for the Validator's Validate()
+      // method here because if another thread is in the middle of unregistering
+      // that Validator, there will be an outstanding call to Validate() that
+      // occurs after it has unregistered. Since ValidatorInfo gets destroyed
+      // in Unregister() on same thread that validation should run on, we can
+      // post a task to the Validator's thread with weak_ptr. This way, if the
+      // Validator gets unregistered, the call to Validate will get skipped.
+      validator_it->second->task_runner()->PostTask(
+          FROM_HERE, base::Bind(&ValidatorInfo::Validate,
+                                validator_it->second->AsWeakPtr(), path,
+                                base::Passed(&proposed_value)));
+      return;
+    }
   }
-
-  validator_it->second->Validate(path, proposed_value.Pass());
+  // Since we are done checking for a registered Validator at this point, we
+  // can release the lock. All further member access will be for capabilities.
+  SetValidatedValue(path, proposed_value.Pass());
 }
 
 void DeviceCapabilitiesImpl::MergeDictionary(
     const base::DictionaryValue& dict_value) {
-  DCHECK(thread_checker_.CalledOnValidThread());
   for (base::DictionaryValue::Iterator it(dict_value); !it.IsAtEnd();
        it.Advance()) {
     SetCapability(it.key(), it.value().CreateDeepCopy());
@@ -177,42 +249,62 @@
 
 void DeviceCapabilitiesImpl::AddCapabilitiesObserver(Observer* observer) {
   DCHECK(observer);
-  DCHECK(thread_checker_.CalledOnValidThread());
-  observer_list_.AddObserver(observer);
+  observer_list_->AddObserver(observer);
 }
 
 void DeviceCapabilitiesImpl::RemoveCapabilitiesObserver(Observer* observer) {
   DCHECK(observer);
-  DCHECK(thread_checker_.CalledOnValidThread());
-  observer_list_.RemoveObserver(observer);
+  observer_list_->RemoveObserver(observer);
 }
 
-void DeviceCapabilitiesImpl::SetValidatedValueInternal(
+void DeviceCapabilitiesImpl::SetValidatedValue(
     const std::string& path,
     scoped_ptr<base::Value> new_value) {
-  DCHECK(thread_checker_.CalledOnValidThread());
+  // All internal writes/modifications of capabilities must occur on same
+  // thread to avoid race conditions.
+  if (!task_runner_for_writes_->BelongsToCurrentThread()) {
+    task_runner_for_writes_->PostTask(
+        FROM_HERE,
+        base::Bind(&DeviceCapabilitiesImpl::SetValidatedValue,
+                   base::Unretained(this), path, base::Passed(&new_value)));
+    return;
+  }
+
   DCHECK(IsValidPath(path));
   DCHECK(new_value.get());
 
+  // We don't need to acquire lock here when reading data_ because we know that
+  // all writes to data_ must occur serially on thread that we're on.
   const base::Value* cur_value = nullptr;
-  bool capability_unchaged =
-      GetCapability(path, &cur_value) && cur_value->Equals(new_value.get());
-  if (capability_unchaged) {
+  bool capability_unchanged = data_->dictionary().Get(path, &cur_value) &&
+                              cur_value->Equals(new_value.get());
+  if (capability_unchanged) {
     VLOG(1) << "Ignoring unchanged capability: " << path;
     return;
   }
 
-  capabilities_->Set(path, new_value.Pass());
-  UpdateStrAndNotifyChanged(path);
-}
+  // In this sequence, we create a deep copy, modify the deep copy, and then
+  // do a pointer swap. We do this to have minimal time spent in the
+  // data_lock_. If we were to lock and modify the capabilities
+  // dictionary directly, there may be expensive writes that block other
+  // threads.
+  scoped_ptr<base::DictionaryValue> dictionary_deep_copy(
+      data_->dictionary().CreateDeepCopy());
+  dictionary_deep_copy->Set(path, new_value.Pass());
+  scoped_refptr<Data> new_data(CreateData(dictionary_deep_copy.Pass()));
 
-void DeviceCapabilitiesImpl::UpdateStrAndNotifyChanged(
-    const std::string& path) {
-  // Update capabilities string here since all updates to capabilities must
-  // ultimately call this method no matter where the update originated from.
-  capabilities_str_ = SerializeToJson(*capabilities_);
-  DCHECK(capabilities_str_.get());
-  FOR_EACH_OBSERVER(Observer, observer_list_, OnCapabilitiesChanged(path));
+  {
+    base::AutoLock auto_lock(data_lock_);
+    // Using swap instead of assignment operator here because it's a little
+    // faster. Avoids an extra call to AddRef()/Release().
+    data_.swap(new_data);
+  }
+
+  // Even though ObseverListThreadSafe notifications are always asynchronous
+  // (posts task even if to same thread), no locks should be held at this point
+  // in the code. This is just to be safe that no deadlocks occur if Observers
+  // call DeviceCapabilities methods in OnCapabilitiesChanged().
+  observer_list_->Notify(FROM_HERE, &Observer::OnCapabilitiesChanged, path);
 }
 
 }  // namespace chromecast

diff --git a/chromecast/base/device_capabilities_impl.h b/chromecast/base/device_capabilities_impl.h
index e58774c..4e61644 100644
--- a/chromecast/base/device_capabilities_impl.h
+++ b/chromecast/base/device_capabilities_impl.h

@@ -5,11 +5,17 @@
 #ifndef CHROMECAST_BASE_DEVICE_CAPABILITIES_IMPL_H_
 #define CHROMECAST_BASE_DEVICE_CAPABILITIES_IMPL_H_
 
-#include "base/containers/hash_tables.h"
-#include "base/observer_list.h"
-#include "base/threading/thread_checker.h"
+#include "base/containers/scoped_ptr_hash_map.h"
+#include "base/macros.h"
+#include "base/memory/weak_ptr.h"
+#include "base/observer_list_threadsafe.h"
+#include "base/synchronization/lock.h"
 #include "chromecast/base/device_capabilities.h"
 
+namespace base {
+class SingleThreadTaskRunner;
+}
+
 namespace chromecast {
 
 class DeviceCapabilitiesImpl : public DeviceCapabilities {
@@ -22,10 +28,8 @@
   Validator* GetValidator(const std::string& key) const override;
   bool BluetoothSupported() const override;
   bool DisplaySupported() const override;
-  bool GetCapability(const std::string& path,
-                     const base::Value** out_value) const override;
-  const std::string& GetCapabilitiesString() const override;
-  const base::DictionaryValue* GetCapabilities() const override;
+  scoped_ptr<base::Value> GetCapability(const std::string& path) const override;
+  scoped_refptr<Data> GetData() const override;
   void SetCapability(const std::string& path,
                      scoped_ptr<base::Value> proposed_value) override;
   void MergeDictionary(const base::DictionaryValue& dict_value) override;
@@ -33,28 +37,56 @@
   void RemoveCapabilitiesObserver(Observer* observer) override;
 
  private:
+  class ValidatorInfo : public base::SupportsWeakPtr<ValidatorInfo> {
+   public:
+    explicit ValidatorInfo(Validator* validator);
+    ~ValidatorInfo();
+
+    Validator* validator() const { return validator_; }
+
+    scoped_refptr<base::SingleThreadTaskRunner> task_runner() const {
+      return task_runner_;
+    }
+
+    void Validate(const std::string& path,
+                  scoped_ptr<base::Value> proposed_value) const;
+
+   private:
+    Validator* const validator_;
+    // TaskRunner of thread that validator_ was registered on
+    const scoped_refptr<base::SingleThreadTaskRunner> task_runner_;
+
+    DISALLOW_COPY_AND_ASSIGN(ValidatorInfo);
+  };
+
   // For DeviceCapabilitiesImpl()
   friend class DeviceCapabilities;
   // For SetValidatedValueInternal()
   friend class DeviceCapabilities::Validator;
 
-  // Map from capability key to corresponding Validator. Gets updated
+  // Map from capability key to corresponding ValidatorInfo. Gets updated
   // in Register()/Unregister().
-  typedef base::hash_map<std::string, Validator*> ValidatorMap;
+  typedef base::ScopedPtrHashMap<std::string, scoped_ptr<ValidatorInfo>>
+      ValidatorMap;
 
   // Internal constructor used by static DeviceCapabilities::Create*() methods.
   DeviceCapabilitiesImpl();
 
-  void SetValidatedValueInternal(const std::string& path,
-                                 scoped_ptr<base::Value> new_value) override;
-  void UpdateStrAndNotifyChanged(const std::string& path);
+  void SetValidatedValue(const std::string& path,
+                         scoped_ptr<base::Value> new_value) override;
 
-  scoped_ptr<base::DictionaryValue> capabilities_;
-  scoped_ptr<const std::string> capabilities_str_;
+  // Lock for reading/writing data_ pointer
+  mutable base::Lock data_lock_;
+  // Lock for reading/writing validator_map_
+  mutable base::Lock validation_lock_;
+
+  scoped_refptr<Data> data_;
+  // TaskRunner for capability writes. All internal writes to data_ must occur
+  // on task_runner_for_writes_'s thread.
+  const scoped_refptr<base::SingleThreadTaskRunner> task_runner_for_writes_;
 
   ValidatorMap validator_map_;
-  base::ObserverList<Observer> observer_list_;
-  base::ThreadChecker thread_checker_;
+  const scoped_refptr<base::ObserverListThreadSafe<Observer>> observer_list_;
 
   DISALLOW_COPY_AND_ASSIGN(DeviceCapabilitiesImpl);
 };

diff --git a/chromecast/base/device_capabilities_impl_unittest.cc b/chromecast/base/device_capabilities_impl_unittest.cc
index eab7a9e..065cf63 100644
--- a/chromecast/base/device_capabilities_impl_unittest.cc
+++ b/chromecast/base/device_capabilities_impl_unittest.cc

@@ -6,6 +6,8 @@
 
 #include <string>
 
+#include "base/message_loop/message_loop.h"
+#include "base/run_loop.h"
 #include "base/values.h"
 #include "chromecast/base/serializers.h"
 #include "testing/gmock/include/gmock/gmock.h"
@@ -21,6 +23,10 @@
     "  \"dummy_field_int\": 99"
     "}";
 
+void GetSampleDefaultCapability(std::string* key,
+                                scoped_ptr<base::Value>* init_value);
+void TestBasicOperations(DeviceCapabilities* capabilities);
+
 // Simple capability manager that implements the Validator interface. Either
 // accepts or rejects all proposed changes based on |accept_changes| constructor
 // argument.
@@ -58,6 +64,59 @@
   const bool accept_changes_;
 };
 
+// Used to test that capabilities/validator can be read and written in
+// Validate() without encountering deadlocks/unexpected behavior.
+class FakeCapabilityManagerComplex : public DeviceCapabilities::Validator {
+ public:
+  FakeCapabilityManagerComplex(DeviceCapabilities* capabilities,
+                               const std::string& key)
+      : DeviceCapabilities::Validator(capabilities), key_(key) {
+    capabilities->Register(key, this);
+  }
+
+  // Unregisters itself as Validator.
+  ~FakeCapabilityManagerComplex() override {
+    capabilities()->Unregister(key_, this);
+  }
+
+  // Runs TestBasicOperations().
+  void Validate(const std::string& path,
+                scoped_ptr<base::Value> proposed_value) override {
+    TestBasicOperations(capabilities());
+  }
+
+ private:
+  const std::string key_;
+};
+
+// Used to test that capabilities/validators can be read and written in
+// OnCapabilitiesChanged() without encountering deadlocks/unexpected behavior.
+class FakeCapabilitiesObserver : public DeviceCapabilities::Observer {
+ public:
+  FakeCapabilitiesObserver(DeviceCapabilities* capabilities)
+      : capabilities_(capabilities), removed_as_observer(false) {
+    capabilities_->AddCapabilitiesObserver(this);
+  }
+
+  ~FakeCapabilitiesObserver() override {
+    if (!removed_as_observer)
+      capabilities_->RemoveCapabilitiesObserver(this);
+  }
+
+  // Runs TestBasicOperations().
+  void OnCapabilitiesChanged(const std::string& path) override {
+    TestBasicOperations(capabilities_);
+    // To prevent infinite loop of SetCapability() -> OnCapabilitiesChanged()
+    // -> SetCapability() -> OnCapabilitiesChanged() etc.
+    capabilities_->RemoveCapabilitiesObserver(this);
+    removed_as_observer = true;
+  }
+
+ private:
+  DeviceCapabilities* const capabilities_;
+  bool removed_as_observer;
+};
+
 // Used to test that OnCapabilitiesChanged() is called when capabilities are
 // modified
 class MockCapabilitiesObserver : public DeviceCapabilities::Observer {
@@ -116,11 +175,55 @@
   return dict_json.get() && *dict_json == json;
 }
 
+// The function runs through the set of basic operations of DeviceCapabilities.
+// Register validator for sample default capability, reads capability, writes
+// capability, and unregister validator. After it has completed, use
+// AssertBasicOperationsSuccessful() to ensure that all operations completed
+// successfully. Sample default capability should not be added or registered in
+// class before this function is called.
+void TestBasicOperations(DeviceCapabilities* capabilities) {
+  std::string key;
+  scoped_ptr<base::Value> init_value;
+  GetSampleDefaultCapability(&key, &init_value);
+
+  ASSERT_FALSE(capabilities->GetCapability(key));
+  ASSERT_FALSE(capabilities->GetValidator(key));
+
+  // Register and write capability
+  FakeCapabilityManagerSimple* manager(new FakeCapabilityManagerSimple(
+      capabilities, key, init_value->CreateDeepCopy(), true));
+  // Read Validator
+  EXPECT_EQ(capabilities->GetValidator(key), manager);
+  // Read Capability
+  EXPECT_TRUE(base::Value::Equals(capabilities->GetCapability(key).get(),
+                                  init_value.get()));
+  // Unregister
+  delete manager;
+
+  // Write capability again. Provides way of checking that this function
+  // ran and was successful.
+  scoped_ptr<base::Value> new_value = GetSampleDefaultCapabilityNewValue();
+  capabilities->SetCapability(key, new_value.Pass());
+}
+
+// See TestBasicOperations() comment.
+void AssertBasicOperationsSuccessful(const DeviceCapabilities* capabilities) {
+  base::RunLoop().RunUntilIdle();
+  std::string key;
+  scoped_ptr<base::Value> init_value;
+  GetSampleDefaultCapability(&key, &init_value);
+  scoped_ptr<base::Value> value = capabilities->GetCapability(key);
+  ASSERT_TRUE(value);
+  scoped_ptr<base::Value> new_value = GetSampleDefaultCapabilityNewValue();
+  EXPECT_TRUE(base::Value::Equals(value.get(), new_value.get()));
+}
+
 }  // namespace
 
 class DeviceCapabilitiesImplTest : public ::testing::Test {
  protected:
   void SetUp() override {
+    message_loop_.reset(new base::MessageLoop(base::MessageLoop::TYPE_IO));
     capabilities_ = DeviceCapabilities::Create();
     mock_capabilities_observer_.reset(new MockCapabilitiesObserver());
     capabilities_->AddCapabilitiesObserver(mock_capabilities_observer_.get());
@@ -136,6 +239,9 @@
   void TearDown() override {
     capabilities_->RemoveCapabilitiesObserver(
         mock_capabilities_observer_.get());
+    mock_capabilities_observer_.reset();
+    capabilities_.reset();
+    message_loop_.reset();
   }
 
   DeviceCapabilities* capabilities() const { return capabilities_.get(); }
@@ -145,6 +251,7 @@
   }
 
  private:
+  scoped_ptr<base::MessageLoop> message_loop_;
   scoped_ptr<DeviceCapabilities> capabilities_;
   scoped_ptr<MockCapabilitiesObserver> mock_capabilities_observer_;
 };
@@ -153,8 +260,8 @@
 TEST_F(DeviceCapabilitiesImplTest, Create) {
   scoped_ptr<const std::string> empty_dict_string(
       SerializeToJson(base::DictionaryValue()));
-  EXPECT_EQ(capabilities()->GetCapabilitiesString(), *empty_dict_string);
-  EXPECT_TRUE(capabilities()->GetCapabilities()->empty());
+  EXPECT_EQ(capabilities()->GetData()->json_string(), *empty_dict_string);
+  EXPECT_TRUE(capabilities()->GetData()->dictionary().empty());
 }
 
 // Tests Register() of a default capability.
@@ -169,9 +276,8 @@
   EXPECT_EQ(capabilities()->GetValidator(key), &manager);
   scoped_ptr<const std::string> empty_dict_string(
       SerializeToJson(base::DictionaryValue()));
-  EXPECT_EQ(capabilities()->GetCapabilitiesString(), *empty_dict_string);
-  const base::Value* value = nullptr;
-  EXPECT_FALSE(capabilities()->GetCapability(key, &value));
+  EXPECT_EQ(capabilities()->GetData()->json_string(), *empty_dict_string);
+  EXPECT_FALSE(capabilities()->GetCapability(key));
 }
 
 // Tests Unregister() of a default capability.
@@ -186,12 +292,11 @@
 
   delete manager;
 
-  EXPECT_EQ(capabilities()->GetValidator(key), nullptr);
+  EXPECT_FALSE(capabilities()->GetValidator(key));
   scoped_ptr<const std::string> empty_dict_string(
       SerializeToJson(base::DictionaryValue()));
-  EXPECT_EQ(capabilities()->GetCapabilitiesString(), *empty_dict_string);
-  const base::Value* value = nullptr;
-  EXPECT_FALSE(capabilities()->GetCapability(key, &value));
+  EXPECT_EQ(capabilities()->GetData()->json_string(), *empty_dict_string);
+  EXPECT_FALSE(capabilities()->GetCapability(key));
 }
 
 // Tests GetCapability() and updating the value through SetCapability().
@@ -202,15 +307,14 @@
   FakeCapabilityManagerSimple manager(capabilities(), key,
                                       init_value->CreateDeepCopy(), true);
 
-  const base::Value* value = nullptr;
-  EXPECT_TRUE(capabilities()->GetCapability(key, &value));
-  EXPECT_TRUE(base::Value::Equals(value, init_value.get()));
+  EXPECT_TRUE(base::Value::Equals(capabilities()->GetCapability(key).get(),
+                                  init_value.get()));
 
   scoped_ptr<base::Value> new_value = GetSampleDefaultCapabilityNewValue();
   capabilities()->SetCapability(key, new_value->CreateDeepCopy());
-  value = nullptr;
-  EXPECT_TRUE(capabilities()->GetCapability(key, &value));
-  EXPECT_TRUE(base::Value::Equals(value, new_value.get()));
+  base::RunLoop().RunUntilIdle();
+  EXPECT_TRUE(base::Value::Equals(capabilities()->GetCapability(key).get(),
+                                  new_value.get()));
 }
 
 // Tests BluetoothSupported() and updating this value through SetCapability().
@@ -223,6 +327,7 @@
   capabilities()->SetCapability(
       DeviceCapabilities::kKeyBluetoothSupported,
       make_scoped_ptr(new base::FundamentalValue(false)));
+  base::RunLoop().RunUntilIdle();
   EXPECT_FALSE(capabilities()->BluetoothSupported());
 }
 
@@ -236,6 +341,7 @@
   capabilities()->SetCapability(
       DeviceCapabilities::kKeyDisplaySupported,
       make_scoped_ptr(new base::FundamentalValue(false)));
+  base::RunLoop().RunUntilIdle();
   EXPECT_FALSE(capabilities()->DisplaySupported());
 }
 
@@ -249,10 +355,10 @@
                                       init_value->CreateDeepCopy(), false);
 
   capabilities()->SetCapability(key, GetSampleDefaultCapabilityNewValue());
+  base::RunLoop().RunUntilIdle();
 
-  const base::Value* value = nullptr;
-  EXPECT_TRUE(capabilities()->GetCapability(key, &value));
-  EXPECT_TRUE(base::Value::Equals(init_value.get(), value));
+  EXPECT_TRUE(base::Value::Equals(capabilities()->GetCapability(key).get(),
+                                  init_value.get()));
 }
 
 // Test that SetCapability() updates the capabilities string correctly
@@ -263,12 +369,13 @@
   FakeCapabilityManagerSimple manager(capabilities(), key,
                                       init_value->CreateDeepCopy(), true);
 
-  EXPECT_TRUE(JsonStringEquals(capabilities()->GetCapabilitiesString(), key,
+  EXPECT_TRUE(JsonStringEquals(capabilities()->GetData()->json_string(), key,
                                *init_value));
 
   scoped_ptr<base::Value> new_value = GetSampleDefaultCapabilityNewValue();
   capabilities()->SetCapability(key, new_value->CreateDeepCopy());
-  EXPECT_TRUE(JsonStringEquals(capabilities()->GetCapabilitiesString(), key,
+  base::RunLoop().RunUntilIdle();
+  EXPECT_TRUE(JsonStringEquals(capabilities()->GetData()->json_string(), key,
                                *new_value));
 }
 
@@ -293,6 +400,7 @@
 
   // 3rd call
   capabilities()->SetCapability(key, init_value.Pass());
+  base::RunLoop().RunUntilIdle();
 }
 
 // Test adding dynamic capabilities
@@ -301,21 +409,21 @@
   scoped_ptr<base::Value> init_value;
   GetSampleDynamicCapability(&key, &init_value);
 
-  const base::Value* value = nullptr;
-  ASSERT_FALSE(capabilities()->GetCapability(key, &value));
+  ASSERT_FALSE(capabilities()->GetCapability(key));
   capabilities()->SetCapability(key, init_value->CreateDeepCopy());
+  base::RunLoop().RunUntilIdle();
 
-  EXPECT_TRUE(capabilities()->GetCapability(key, &value));
-  EXPECT_TRUE(base::Value::Equals(init_value.get(), value));
-  EXPECT_TRUE(JsonStringEquals(capabilities()->GetCapabilitiesString(), key,
+  EXPECT_TRUE(base::Value::Equals(capabilities()->GetCapability(key).get(),
+                                  init_value.get()));
+  EXPECT_TRUE(JsonStringEquals(capabilities()->GetData()->json_string(), key,
                                *init_value));
 
   scoped_ptr<base::Value> new_value = GetSampleDynamicCapabilityNewValue();
   capabilities()->SetCapability(key, new_value->CreateDeepCopy());
-  value = nullptr;
-  EXPECT_TRUE(capabilities()->GetCapability(key, &value));
-  EXPECT_TRUE(base::Value::Equals(new_value.get(), value));
-  EXPECT_TRUE(JsonStringEquals(capabilities()->GetCapabilitiesString(), key,
+  base::RunLoop().RunUntilIdle();
+  EXPECT_TRUE(base::Value::Equals(capabilities()->GetCapability(key).get(),
+                                  new_value.get()));
+  EXPECT_TRUE(JsonStringEquals(capabilities()->GetData()->json_string(), key,
                                *new_value));
 }
 
@@ -325,27 +433,28 @@
   std::string key("dummy_dictionary_key");
   scoped_ptr<base::Value> init_value =
       DeserializeFromJson(kSampleDictionaryCapability);
-  ASSERT_NE(init_value, nullptr);
+  ASSERT_TRUE(init_value);
   FakeCapabilityManagerSimple manager(capabilities(), key, init_value.Pass(),
                                       true);
 
   capabilities()->SetCapability(
       "dummy_dictionary_key.dummy_field_bool",
       make_scoped_ptr(new base::FundamentalValue(false)));
-  const base::Value* value = nullptr;
+  base::RunLoop().RunUntilIdle();
   bool value_bool = true;
-  EXPECT_TRUE(capabilities()->GetCapability(
-      "dummy_dictionary_key.dummy_field_bool", &value));
+  scoped_ptr<base::Value> value =
+      capabilities()->GetCapability("dummy_dictionary_key.dummy_field_bool");
+  ASSERT_TRUE(value);
   EXPECT_TRUE(value->GetAsBoolean(&value_bool));
   EXPECT_FALSE(value_bool);
 
   capabilities()->SetCapability(
       "dummy_dictionary_key.dummy_field_int",
       make_scoped_ptr(new base::FundamentalValue(100)));
-  value = nullptr;
+  base::RunLoop().RunUntilIdle();
   int value_int = 0;
-  EXPECT_TRUE(capabilities()->GetCapability(
-      "dummy_dictionary_key.dummy_field_int", &value));
+  value = capabilities()->GetCapability("dummy_dictionary_key.dummy_field_int");
+  ASSERT_TRUE(value);
   EXPECT_TRUE(value->GetAsInteger(&value_int));
   EXPECT_EQ(value_int, 100);
 }
@@ -356,27 +465,28 @@
   std::string key("dummy_dictionary_key");
   scoped_ptr<base::Value> init_value =
       DeserializeFromJson(kSampleDictionaryCapability);
-  ASSERT_NE(init_value, nullptr);
+  ASSERT_TRUE(init_value);
   FakeCapabilityManagerSimple manager(capabilities(), key, init_value.Pass(),
                                       false);
 
   capabilities()->SetCapability(
       "dummy_dictionary_key.dummy_field_bool",
       make_scoped_ptr(new base::FundamentalValue(false)));
-  const base::Value* value = nullptr;
+  base::RunLoop().RunUntilIdle();
   bool value_bool = false;
-  EXPECT_TRUE(capabilities()->GetCapability(
-      "dummy_dictionary_key.dummy_field_bool", &value));
+  scoped_ptr<base::Value> value =
+      capabilities()->GetCapability("dummy_dictionary_key.dummy_field_bool");
+  ASSERT_TRUE(value);
   EXPECT_TRUE(value->GetAsBoolean(&value_bool));
   EXPECT_TRUE(value_bool);
 
   capabilities()->SetCapability(
       "dummy_dictionary_key.dummy_field_int",
       make_scoped_ptr(new base::FundamentalValue(100)));
-  value = nullptr;
+  base::RunLoop().RunUntilIdle();
   int value_int = 0;
-  EXPECT_TRUE(capabilities()->GetCapability(
-      "dummy_dictionary_key.dummy_field_int", &value));
+  value = capabilities()->GetCapability("dummy_dictionary_key.dummy_field_int");
+  ASSERT_TRUE(value);
   EXPECT_TRUE(value->GetAsInteger(&value_int));
   EXPECT_EQ(value_int, 99);
 }
@@ -385,23 +495,25 @@
 TEST_F(DeviceCapabilitiesImplTest, MergeDictionary) {
   scoped_ptr<base::Value> deserialized_value =
       DeserializeFromJson(kSampleDictionaryCapability);
-  ASSERT_NE(deserialized_value, nullptr);
+  ASSERT_TRUE(deserialized_value);
   base::DictionaryValue* dict_value = nullptr;
   ASSERT_TRUE(deserialized_value->GetAsDictionary(&dict_value));
-  ASSERT_NE(dict_value, nullptr);
+  ASSERT_TRUE(dict_value);
 
   capabilities()->MergeDictionary(*dict_value);
+  base::RunLoop().RunUntilIdle();
 
   // First make sure that capabilities get created if they do not exist
-  const base::Value* value = nullptr;
   bool value_bool = false;
-  EXPECT_TRUE(capabilities()->GetCapability("dummy_field_bool", &value));
+  scoped_ptr<base::Value> value =
+      capabilities()->GetCapability("dummy_field_bool");
+  ASSERT_TRUE(value);
   EXPECT_TRUE(value->GetAsBoolean(&value_bool));
   EXPECT_TRUE(value_bool);
 
-  value = nullptr;
   int value_int = 0;
-  EXPECT_TRUE(capabilities()->GetCapability("dummy_field_int", &value));
+  value = capabilities()->GetCapability("dummy_field_int");
+  ASSERT_TRUE(value);
   EXPECT_TRUE(value->GetAsInteger(&value_int));
   EXPECT_EQ(value_int, 99);
 
@@ -411,17 +523,50 @@
   ASSERT_TRUE(dict_value->Remove("dummy_field_bool", nullptr));
 
   capabilities()->MergeDictionary(*dict_value);
+  base::RunLoop().RunUntilIdle();
 
-  value = nullptr;
   value_bool = false;
-  EXPECT_TRUE(capabilities()->GetCapability("dummy_field_bool", &value));
+  value = capabilities()->GetCapability("dummy_field_bool");
+  ASSERT_TRUE(value);
   EXPECT_TRUE(value->GetAsBoolean(&value_bool));
   EXPECT_TRUE(value_bool);
 
-  value = nullptr;
-  EXPECT_TRUE(capabilities()->GetCapability("dummy_field_int", &value));
+  value = capabilities()->GetCapability("dummy_field_int");
+  ASSERT_TRUE(value);
   EXPECT_TRUE(value->GetAsInteger(&value_int));
   EXPECT_EQ(value_int, 100);
 }
 
+// Tests that it is safe to call DeviceCapabilities methods in
+// an Observer's OnCapabilitiesChanged() implementation safely with correct
+// behavior and without deadlocking.
+TEST_F(DeviceCapabilitiesImplTest, OnCapabilitiesChangedSafe) {
+  FakeCapabilitiesObserver observer(capabilities());
+
+  // Trigger FakeCapabilitiesObserver::OnCapabilitiesChanged()
+  capabilities()->SetCapability(
+      "dummy_trigger_key", make_scoped_ptr(new base::FundamentalValue(true)));
+  base::RunLoop().RunUntilIdle();
+
+  // Check that FakeCapabilitiesObserver::OnCapabilitiesChanged() ran and that
+  // behavior was successful
+  AssertBasicOperationsSuccessful(capabilities());
+}
+
+// Tests that it is safe to call DeviceCapabilities methods in a Validator's
+// Validate() implementation safely with correct behavior and without
+// deadlocking.
+TEST_F(DeviceCapabilitiesImplTest, ValidateSafe) {
+  FakeCapabilityManagerComplex manager(capabilities(), "dummy_validate_key");
+
+  // Trigger FakeCapabilityManagerComplex::Validate()
+  capabilities()->SetCapability(
+      "dummy_validate_key", make_scoped_ptr(new base::FundamentalValue(true)));
+  base::RunLoop().RunUntilIdle();
+
+  // Check that FakeCapabilityManagerComplex::Validate() ran and that behavior
+  // was successful
+  AssertBasicOperationsSuccessful(capabilities());
+}
+
 }  // namespace chromecast

diff --git a/chromecast/browser/BUILD.gn b/chromecast/browser/BUILD.gn
index 358bff1..4453f8a6e 100644
--- a/chromecast/browser/BUILD.gn
+++ b/chromecast/browser/BUILD.gn

@@ -3,6 +3,7 @@
 # found in the LICENSE file.
 
 import("//chromecast/chromecast.gni")
+import("//media/media_options.gni")
 import("//testing/test.gni")
 
 source_set("browser") {
@@ -111,6 +112,14 @@
 
     deps += [ "//components/metrics:serialization" ]
   }
+
+  if (enable_mojo_media != "none") {
+    configs += [ "//media/mojo/services:enable_mojo_media_config" ]
+  }
+
+  if (enable_mojo_media == "utility") {
+    deps += [ "//media/mojo/services:application" ]
+  }
 }
 
 source_set("test_support") {

diff --git a/chromecast/browser/cast_content_browser_client.cc b/chromecast/browser/cast_content_browser_client.cc
index 20c4361..14ff5c2 100644
--- a/chromecast/browser/cast_content_browser_client.cc
+++ b/chromecast/browser/cast_content_browser_client.cc

@@ -359,7 +359,7 @@
     std::map<GURL, base::string16>* apps) {
 #if defined(ENABLE_MOJO_MEDIA_IN_UTILITY_PROCESS)
   apps->insert(std::make_pair(GURL("mojo:media"),
-                              base::UTF8ToUTF16("Media Renderer")));
+                              base::ASCIIToUTF16("Media App")));
 #endif
 }
 

diff --git a/components/autofill/core/browser/form_structure.cc b/components/autofill/core/browser/form_structure.cc
index c0e2507..8703ff97 100644
--- a/components/autofill/core/browser/form_structure.cc
+++ b/components/autofill/core/browser/form_structure.cc

@@ -47,6 +47,7 @@
 const char kAttributeFieldLabel[] = "label";
 const char kAttributeFormSignature[] = "formsignature";
 const char kAttributeFormActionHostSignature[] = "actionsignature";
+const char kAttributeFormName[] = "formname";
 const char kAttributeName[] = "name";
 const char kAttributeSignature[] = "signature";
 const char kAttributeControlType[] = "type";
@@ -484,6 +485,10 @@
   if (IsAutofillFieldMetadataEnabled()) {
     autofill_request_xml.SetAttr(buzz::QName(kAttributeFormActionHostSignature),
                                  Hash64Bit(target_url_.host()));
+    if(!form_name().empty()) {
+      autofill_request_xml.SetAttr(buzz::QName(kAttributeFormName),
+                                   base::UTF16ToUTF8(form_name()));
+    }
   }
 
   if (!login_form_signature.empty()) {

diff --git a/components/autofill/core/browser/form_structure_unittest.cc b/components/autofill/core/browser/form_structure_unittest.cc
index 2746a0e..5a0cb53 100644
--- a/components/autofill/core/browser/form_structure_unittest.cc
+++ b/components/autofill/core/browser/form_structure_unittest.cc

@@ -1960,6 +1960,56 @@
             encoded_xml);
 }
 
+// Test that the form name is sent in the upload request.
+TEST_F(FormStructureTest, EncodeUploadRequest_WithFormName) {
+  scoped_ptr<FormStructure> form_structure;
+  std::vector<ServerFieldTypeSet> possible_field_types;
+  FormData form;
+  // Setting the form name which we expect to see in the upload.
+  form.name = base::ASCIIToUTF16("myform");
+  form_structure.reset(new FormStructure(form));
+  form_structure->DetermineHeuristicTypes();
+
+  FormFieldData field;
+  field.form_control_type = "text";
+
+  form.fields.push_back(field);
+  possible_field_types.push_back(ServerFieldTypeSet());
+  possible_field_types.back().insert(NAME_FIRST);
+
+  form.fields.push_back(field);
+  possible_field_types.push_back(ServerFieldTypeSet());
+  possible_field_types.back().insert(NAME_LAST);
+
+  form.fields.push_back(field);
+  possible_field_types.push_back(ServerFieldTypeSet());
+  possible_field_types.back().insert(EMAIL_ADDRESS);
+
+  form_structure.reset(new FormStructure(form));
+
+  ASSERT_EQ(form_structure->field_count(), possible_field_types.size());
+  for (size_t i = 0; i < form_structure->field_count(); ++i)
+    form_structure->field(i)->set_possible_types(possible_field_types[i]);
+
+  ServerFieldTypeSet available_field_types;
+  available_field_types.insert(NAME_FIRST);
+  available_field_types.insert(NAME_LAST);
+  available_field_types.insert(EMAIL_ADDRESS);
+
+  std::string encoded_xml;
+  EXPECT_TRUE(form_structure->EncodeUploadRequest(available_field_types, true,
+                                                  std::string(), &encoded_xml));
+  EXPECT_EQ("<?xml version=\"1.0\" encoding=\"UTF-8\"?><autofillupload"
+            " clientversion=\"6.1.1715.1442/en (GGLL)\""
+            " formsignature=\"2345951786066580868\" autofillused=\"true\""
+            " datapresent=\"1440\" actionsignature=\"15724779818122431245\""
+            " formname=\"myform\"><field signature=\"1318412689\" type=\"text\""
+            " autofilltype=\"3\"/><field signature=\"1318412689\" type=\"text\""
+            " autofilltype=\"5\"/><field signature=\"1318412689\" type=\"text\""
+            " autofilltype=\"9\"/></autofillupload>",
+            encoded_xml);
+}
+
 TEST_F(FormStructureTest, EncodeUploadRequestPartialMetadata) {
   scoped_ptr<FormStructure> form_structure;
   std::vector<ServerFieldTypeSet> possible_field_types;

diff --git a/components/page_load_metrics/browser/metrics_web_contents_observer.cc b/components/page_load_metrics/browser/metrics_web_contents_observer.cc
index d3fe69e..f365782 100644
--- a/components/page_load_metrics/browser/metrics_web_contents_observer.cc
+++ b/components/page_load_metrics/browser/metrics_web_contents_observer.cc

@@ -84,6 +84,14 @@
       "PageLoad.Events.InternalError", event, ERR_LAST_ENTRY);
 }
 
+base::TimeDelta GetFirstContentfulPaint(const PageLoadTiming& timing) {
+  if (timing.first_text_paint.is_zero())
+    return timing.first_image_paint;
+  if (timing.first_image_paint.is_zero())
+    return timing.first_text_paint;
+  return std::min(timing.first_text_paint, timing.first_image_paint);
+}
+
 }  // namespace
 
 PageLoadTracker::PageLoadTracker(
@@ -241,6 +249,18 @@
           timing_.first_image_paint);
     }
   }
+  base::TimeDelta first_contentful_paint = GetFirstContentfulPaint(timing_);
+  if (!first_contentful_paint.is_zero()) {
+    if (first_contentful_paint < background_delta) {
+      PAGE_LOAD_HISTOGRAM("PageLoad.Timing2.NavigationToFirstContentfulPaint",
+                          first_contentful_paint);
+    } else {
+      PAGE_LOAD_HISTOGRAM(
+          "PageLoad.Timing2.NavigationToFirstContentfulPaint.Background",
+          first_contentful_paint);
+    }
+  }
+
   // Log time to first foreground / time to first background. Log counts that we
   // started a relevant page load in the foreground / background.
   if (!background_time_.is_null()) {

diff --git a/components/password_manager/core/common/password_manager_ui.h b/components/password_manager/core/common/password_manager_ui.h
index 4dc2d8c..8f828cd 100644
--- a/components/password_manager/core/common/password_manager_ui.h
+++ b/components/password_manager/core/common/password_manager_ui.h

@@ -39,15 +39,6 @@
   PENDING_PASSWORD_UPDATE_STATE,
 };
 
-// The position of a password item in a list of credentials.
-enum PasswordItemPosition {
-  // The password item is the first in the list.
-  FIRST_ITEM,
-
-  // The password item is not the first item in the list.
-  SUBSEQUENT_ITEM,
-};
-
 }  // namespace ui
 
 }  // namespace password_manager

diff --git a/components/sync_driver/sync_service_observer.h b/components/sync_driver/sync_service_observer.h
index f0e6d913..d168f417 100644
--- a/components/sync_driver/sync_service_observer.h
+++ b/components/sync_driver/sync_service_observer.h

@@ -30,6 +30,9 @@
   // process.
   virtual void OnSyncConfigurationCompleted() {}
 
+  // Called when a foreign session has been updated.
+  virtual void OnForeignSessionUpdated() {}
+
  protected:
   virtual ~SyncServiceObserver() {}
 };

diff --git a/components/webcrypto/algorithms/rsa.cc b/components/webcrypto/algorithms/rsa.cc
index 892a5a0..e789d292 100644
--- a/components/webcrypto/algorithms/rsa.cc
+++ b/components/webcrypto/algorithms/rsa.cc

@@ -19,6 +19,7 @@
 #include "crypto/scoped_openssl_types.h"
 #include "third_party/WebKit/public/platform/WebCryptoAlgorithmParams.h"
 #include "third_party/WebKit/public/platform/WebCryptoKeyAlgorithm.h"
+#include "third_party/WebKit/public/platform/WebCryptoUtil.h"
 
 namespace webcrypto {
 
@@ -104,26 +105,6 @@
   return Status::Success();
 }
 
-// Converts a (big-endian) WebCrypto BigInteger, with or without leading zeros,
-// to unsigned int.
-bool BigIntegerToUint(const uint8_t* data,
-                      size_t data_size,
-                      unsigned int* result) {
-  if (data_size == 0)
-    return false;
-
-  *result = 0;
-  for (size_t i = 0; i < data_size; ++i) {
-    size_t reverse_i = data_size - i - 1;
-
-    if (reverse_i >= sizeof(*result) && data[i])
-      return false;  // Too large for a uint.
-
-    *result |= data[i] << 8 * reverse_i;
-  }
-  return true;
-}
-
 // Creates a blink::WebCryptoAlgorithm having the modulus length and public
 // exponent  of |key|.
 Status CreateRsaHashedKeyAlgorithm(
@@ -298,10 +279,8 @@
   }
 
   unsigned int public_exponent = 0;
-  if (!BigIntegerToUint(params->publicExponent().data(),
-                        params->publicExponent().size(), &public_exponent)) {
+  if (!blink::bigIntegerToUint(params->publicExponent(), public_exponent))
     return Status::ErrorGenerateKeyPublicExponent();
-  }
 
   // OpenSSL hangs when given bad public exponents. Use a whitelist.
   if (public_exponent != 3 && public_exponent != 65537)

diff --git a/content/browser/appcache/appcache_service_impl.cc b/content/browser/appcache/appcache_service_impl.cc
index 01cbb46..37d6424 100644
--- a/content/browser/appcache/appcache_service_impl.cc
+++ b/content/browser/appcache/appcache_service_impl.cc

@@ -83,54 +83,6 @@
   service_ = NULL;
 }
 
-// CanHandleOfflineHelper -------
-
-class AppCacheServiceImpl::CanHandleOfflineHelper : AsyncHelper {
- public:
-  CanHandleOfflineHelper(
-      AppCacheServiceImpl* service, const GURL& url,
-      const GURL& first_party, const net::CompletionCallback& callback)
-      : AsyncHelper(service, callback),
-        url_(url),
-        first_party_(first_party) {
-  }
-
-  void Start() override {
-    AppCachePolicy* policy = service_->appcache_policy();
-    if (policy && !policy->CanLoadAppCache(url_, first_party_)) {
-      CallCallback(net::ERR_FAILED);
-      delete this;
-      return;
-    }
-
-    service_->storage()->FindResponseForMainRequest(url_, GURL(), this);
-  }
-
- private:
-  // AppCacheStorage::Delegate implementation.
-  void OnMainResponseFound(const GURL& url,
-                           const AppCacheEntry& entry,
-                           const GURL& fallback_url,
-                           const AppCacheEntry& fallback_entry,
-                           int64 cache_id,
-                           int64 group_id,
-                           const GURL& mainfest_url) override;
-
-  GURL url_;
-  GURL first_party_;
-
-  DISALLOW_COPY_AND_ASSIGN(CanHandleOfflineHelper);
-};
-
-void AppCacheServiceImpl::CanHandleOfflineHelper::OnMainResponseFound(
-      const GURL& url, const AppCacheEntry& entry,
-      const GURL& fallback_url, const AppCacheEntry& fallback_entry,
-      int64 cache_id, int64 group_id, const GURL& manifest_url) {
-  bool can = (entry.has_response_id() || fallback_entry.has_response_id());
-  CallCallback(can ? net::OK : net::ERR_FAILED);
-  delete this;
-}
-
 // DeleteHelper -------
 
 class AppCacheServiceImpl::DeleteHelper : public AsyncHelper {
@@ -524,15 +476,6 @@
   Initialize(cache_directory_, db_thread_, cache_thread_);
 }
 
-void AppCacheServiceImpl::CanHandleMainResourceOffline(
-    const GURL& url,
-    const GURL& first_party,
-    const net::CompletionCallback& callback) {
-  CanHandleOfflineHelper* helper =
-      new CanHandleOfflineHelper(this, url, first_party, callback);
-  helper->Start();
-}
-
 void AppCacheServiceImpl::GetAllAppCacheInfo(
     AppCacheInfoCollection* collection,
     const net::CompletionCallback& callback) {

diff --git a/content/browser/appcache/appcache_service_impl.h b/content/browser/appcache/appcache_service_impl.h
index 96866663..d4efb64 100644
--- a/content/browser/appcache/appcache_service_impl.h
+++ b/content/browser/appcache/appcache_service_impl.h

@@ -99,10 +99,6 @@
   void ScheduleReinitialize();
 
   // AppCacheService implementation:
-  void CanHandleMainResourceOffline(
-      const GURL& url,
-      const GURL& first_party,
-      const net::CompletionCallback& callback) override;
   void GetAllAppCacheInfo(AppCacheInfoCollection* collection,
                           const net::CompletionCallback& callback) override;
   void DeleteAppCacheGroup(const GURL& manifest_url,
@@ -187,7 +183,6 @@
       ScheduleReinitialize);
 
   class AsyncHelper;
-  class CanHandleOfflineHelper;
   class DeleteHelper;
   class DeleteOriginHelper;
   class GetInfoHelper;

diff --git a/content/browser/loader/resource_buffer.cc b/content/browser/loader/resource_buffer.cc
index 9dc63d6..58839db 100644
--- a/content/browser/loader/resource_buffer.cc
+++ b/content/browser/loader/resource_buffer.cc

@@ -54,7 +54,11 @@
   min_alloc_size_ = min_allocation_size;
   max_alloc_size_ = max_allocation_size;
 
+#if defined(OS_MACOSX) && !defined(OS_IOS)
+  return shared_mem_.CreateAndMapAnonymousMach(buf_size_);
+#else
   return shared_mem_.CreateAndMapAnonymous(buf_size_);
+#endif  // defined(OS_MACOSX) && !defined(OS_IOS)
 }
 
 bool ResourceBuffer::IsInitialized() const {

diff --git a/content/browser/service_worker/service_worker_context_core.h b/content/browser/service_worker/service_worker_context_core.h
index 53a354d..6f44c73 100644
--- a/content/browser/service_worker/service_worker_context_core.h
+++ b/content/browser/service_worker/service_worker_context_core.h

@@ -267,7 +267,6 @@
   }
 
  private:
-  friend class ServiceWorkerContext;
   typedef std::map<int64, ServiceWorkerRegistration*> RegistrationsMap;
   typedef std::map<int64, ServiceWorkerVersion*> VersionMap;
 

diff --git a/content/browser/service_worker/service_worker_context_wrapper.cc b/content/browser/service_worker/service_worker_context_wrapper.cc
index 264cb9a..f6785c92 100644
--- a/content/browser/service_worker/service_worker_context_wrapper.cc
+++ b/content/browser/service_worker/service_worker_context_wrapper.cc

@@ -23,14 +23,11 @@
 #include "content/browser/service_worker/service_worker_context_observer.h"
 #include "content/browser/service_worker/service_worker_process_manager.h"
 #include "content/browser/service_worker/service_worker_quota_client.h"
-#include "content/browser/service_worker/service_worker_request_handler.h"
 #include "content/browser/service_worker/service_worker_version.h"
 #include "content/browser/storage_partition_impl.h"
 #include "content/common/service_worker/service_worker_utils.h"
 #include "content/public/browser/browser_context.h"
 #include "content/public/browser/browser_thread.h"
-#include "content/public/browser/service_worker_context.h"
-#include "net/base/net_errors.h"
 #include "net/base/net_util.h"
 #include "storage/browser/quota/quota_manager_proxy.h"
 #include "storage/browser/quota/special_storage_policy.h"
@@ -91,16 +88,6 @@
          g_excluded_header_name_set.Get().end();
 }
 
-ServiceWorkerContext* ServiceWorkerContext::GetServiceWorkerContext(
-    net::URLRequest* request) {
-  DCHECK_CURRENTLY_ON(BrowserThread::IO);
-  ServiceWorkerRequestHandler* handler =
-      ServiceWorkerRequestHandler::GetHandler(request);
-  if (!handler || !handler->context())
-    return nullptr;
-  return handler->context()->wrapper_;
-}
-
 ServiceWorkerContextWrapper::ServiceWorkerContextWrapper(
     BrowserContext* browser_context)
     : observer_list_(
@@ -307,26 +294,6 @@
                                           force_update_on_page_load);
 }
 
-static void DidFindRegistrationForDocument(
-    const net::CompletionCallback& callback,
-    ServiceWorkerStatusCode status,
-    const scoped_refptr<ServiceWorkerRegistration>& registration) {
-  int rv = registration ? net::OK : net::ERR_CACHE_MISS;
-  // Use RunSoon here because FindRegistrationForDocument can complete
-  // immediately but CanHandleMainResourceOffline must be async.
-  RunSoon(base::Bind(callback, rv));
-}
-
-void ServiceWorkerContextWrapper::CanHandleMainResourceOffline(
-      const GURL& url,
-      const GURL& first_party,
-      const net::CompletionCallback& callback) {
-  DCHECK_CURRENTLY_ON(BrowserThread::IO);
-  context()->storage()->FindRegistrationForDocument(
-      net::SimplifyUrlForRequest(url),
-      base::Bind(&DidFindRegistrationForDocument, callback));
-}
-
 void ServiceWorkerContextWrapper::GetAllOriginsInfo(
     const GetUsageInfoCallback& callback) {
   DCHECK_CURRENTLY_ON(BrowserThread::IO);

diff --git a/content/browser/service_worker/service_worker_context_wrapper.h b/content/browser/service_worker/service_worker_context_wrapper.h
index ac33d79..a4d1e13b 100644
--- a/content/browser/service_worker/service_worker_context_wrapper.h
+++ b/content/browser/service_worker/service_worker_context_wrapper.h

@@ -88,10 +88,6 @@
                              const ResultCallback& continuation) override;
   void UnregisterServiceWorker(const GURL& pattern,
                                const ResultCallback& continuation) override;
-  void CanHandleMainResourceOffline(
-      const GURL& url,
-      const GURL& first_party,
-      const net::CompletionCallback& callback) override;
   void GetAllOriginsInfo(const GetUsageInfoCallback& callback) override;
   void DeleteForOrigin(const GURL& origin,
                        const ResultCallback& callback) override;

diff --git a/content/browser/service_worker/service_worker_request_handler.h b/content/browser/service_worker/service_worker_request_handler.h
index 3d170c0a..332c9a9 100644
--- a/content/browser/service_worker/service_worker_request_handler.h
+++ b/content/browser/service_worker/service_worker_request_handler.h

@@ -109,8 +109,6 @@
   void MaybeCompleteCrossSiteTransferInOldProcess(
       int old_process_id);
 
-  ServiceWorkerContextCore* context() const { return context_.get(); }
-
  protected:
   ServiceWorkerRequestHandler(
       base::WeakPtr<ServiceWorkerContextCore> context,

diff --git a/content/public/android/java/src/org/chromium/content/browser/ContentViewCore.java b/content/public/android/java/src/org/chromium/content/browser/ContentViewCore.java
index 276c7a8..6dc6d70a 100644
--- a/content/public/android/java/src/org/chromium/content/browser/ContentViewCore.java
+++ b/content/public/android/java/src/org/chromium/content/browser/ContentViewCore.java

@@ -2497,8 +2497,9 @@
             boolean focusedNodeIsPassword = (textInputType == TextInputType.PASSWORD);
             if (!focusedNodeEditable) hidePastePopup();
 
+            mImeAdapter.attach(nativeImeAdapterAndroid);
             mImeAdapter.updateKeyboardVisibility(
-                    nativeImeAdapterAndroid, textInputType, textInputFlags, showImeIfNeeded);
+                    textInputType, textInputFlags, showImeIfNeeded);
 
             if (mInputConnection != null) {
                 mInputConnection.updateState(text, selectionStart, selectionEnd, compositionStart,
@@ -2688,7 +2689,6 @@
     }
 
     private boolean canPaste() {
-        if (!mFocusedNodeEditable) return false;
         return ((ClipboardManager) mContext.getSystemService(
                 Context.CLIPBOARD_SERVICE)).hasPrimaryClip();
     }

diff --git a/content/public/android/java/src/org/chromium/content/browser/input/ImeAdapter.java b/content/public/android/java/src/org/chromium/content/browser/input/ImeAdapter.java
index 180f4be77..b0a56df3 100644
--- a/content/public/android/java/src/org/chromium/content/browser/input/ImeAdapter.java
+++ b/content/public/android/java/src/org/chromium/content/browser/input/ImeAdapter.java

@@ -5,7 +5,6 @@
 package org.chromium.content.browser.input;
 
 import android.content.res.Configuration;
-import android.os.Handler;
 import android.os.ResultReceiver;
 import android.os.SystemClock;
 import android.text.Editable;
@@ -25,7 +24,6 @@
 import org.chromium.base.annotations.JNINamespace;
 import org.chromium.blink_public.web.WebInputEventModifier;
 import org.chromium.blink_public.web.WebInputEventType;
-import org.chromium.blink_public.web.WebTextInputFlags;
 import org.chromium.ui.base.ime.TextInputType;
 import org.chromium.ui.picker.InputDialogContainer;
 
@@ -86,19 +84,6 @@
         ResultReceiver getNewShowKeyboardReceiver();
     }
 
-    // Delay introduced to avoid hiding the keyboard if new show requests are received.
-    // The time required by the unfocus-focus events triggered by tab has been measured in soju:
-    // Mean: 18.633 ms, Standard deviation: 7.9837 ms.
-    // The value here should be higher enough to cover these cases, but not too high to avoid
-    // letting the user perceiving important delays.
-    private static final int INPUT_DISMISS_DELAY = 150;
-    private final Runnable mDismissInputRunnable = new Runnable() {
-        @Override
-        public void run() {
-            hideSoftKeyboard();
-        }
-    };
-
     static char[] sSingleCharArray = new char[1];
     static KeyCharacterMap sKeyCharacterMap;
 
@@ -106,8 +91,7 @@
     private InputMethodManagerWrapper mInputMethodManagerWrapper;
     private AdapterInputConnection mInputConnection;
     private final ImeAdapterDelegate mViewEmbedder;
-    private final Handler mHandler;
-    private int mTextInputType;
+    private int mTextInputType = TextInputType.NONE;
     private int mTextInputFlags;
 
     @VisibleForTesting
@@ -121,7 +105,6 @@
     public ImeAdapter(InputMethodManagerWrapper wrapper, ImeAdapterDelegate embedder) {
         mInputMethodManagerWrapper = wrapper;
         mViewEmbedder = embedder;
-        mHandler = new Handler();
     }
 
     /**
@@ -199,63 +182,36 @@
 
     /**
      * Shows or hides the keyboard based on passed parameters.
-     * @param nativeImeAdapter Pointer to the ImeAdapterAndroid object that is sending the update.
      * @param textInputType Text input type for the currently focused field in renderer.
+     * @param textInputFlags Text input flags.
      * @param showIfNeeded Whether the keyboard should be shown if it is currently hidden.
      */
-    public void updateKeyboardVisibility(long nativeImeAdapter, int textInputType,
+    public void updateKeyboardVisibility(int textInputType,
             int textInputFlags, boolean showIfNeeded) {
-        Log.d(TAG, "updateKeyboardVisibility: type [%d], flags [%d], show [%b]", textInputType,
-                textInputFlags, showIfNeeded);
+        Log.d(TAG, "updateKeyboardVisibility: type [%d->%d], flags [%d], show [%b], ",
+                mTextInputType, textInputType, textInputFlags, showIfNeeded);
         // If current input type is none and showIfNeeded is false, IME should not be shown
         // and input type should remain as none.
         if (mTextInputType == TextInputType.NONE && !showIfNeeded) {
             return;
         }
 
-        if (mNativeImeAdapterAndroid != nativeImeAdapter || mTextInputType != textInputType) {
-            // We have to attach immediately, even if we're going to delay the dismissing of
-            // currently visible keyboard because otherwise we have a race condition: If the
-            // native IME adapter gets destructed before the delayed-dismiss fires, we'll access
-            // an object that has been already released.  http://crbug.com/447287
-            attach(nativeImeAdapter, textInputType, textInputFlags, true);
-
-            if (mTextInputType != TextInputType.NONE) {
-                mInputMethodManagerWrapper.restartInput(mViewEmbedder.getAttachedView());
-                if (showIfNeeded) {
-                    showSoftKeyboard();
-                }
-            }
-        } else if (hasInputType() && showIfNeeded) {
-            showSoftKeyboard();
-        }
-    }
-
-    private void attach(long nativeImeAdapter, int textInputType, int textInputFlags,
-            boolean delayDismissInput) {
-        Log.d(TAG, "attach");
-        if (mNativeImeAdapterAndroid != 0) {
-            nativeResetImeAdapter(mNativeImeAdapterAndroid);
-        }
-        if (nativeImeAdapter != 0) {
-            nativeAttachImeAdapter(nativeImeAdapter);
-        }
-        mNativeImeAdapterAndroid = nativeImeAdapter;
         mTextInputFlags = textInputFlags;
-        if (textInputType == mTextInputType) return;
-        mTextInputType = textInputType;
-        mHandler.removeCallbacks(mDismissInputRunnable);  // okay if not found
-        if (mTextInputType == TextInputType.NONE) {
-            if (delayDismissInput) {
-                // Set a delayed task to do unfocus. This avoids hiding the keyboard when tabbing
-                // through text inputs or when JS rapidly changes focus to another text element.
-                mHandler.postDelayed(mDismissInputRunnable, INPUT_DISMISS_DELAY);
-                mIsShowWithoutHideOutstanding = false;
-            } else {
-                // Some things (including tests) expect the keyboard to be dismissed immediately.
-                hideSoftKeyboard();
+        if (mTextInputType != textInputType) {
+            mTextInputType = textInputType;
+            // No need to restart if we are going to hide anyways.
+            if (textInputType != TextInputType.NONE) {
+                mInputMethodManagerWrapper.restartInput(mViewEmbedder.getAttachedView());
             }
         }
+
+        // There is no API for us to get notified of user's dismissal of keyboard.
+        // Therefore, we should try to show keyboard even when text input type hasn't changed.
+        if (textInputType != TextInputType.NONE) {
+            if (showIfNeeded) showSoftKeyboard();
+        } else {
+            hideSoftKeyboard();
+        }
     }
 
     /**
@@ -264,7 +220,14 @@
      * @param nativeImeAdapter The pointer to the native ImeAdapter object.
      */
     public void attach(long nativeImeAdapter) {
-        attach(nativeImeAdapter, TextInputType.NONE, WebTextInputFlags.None, false);
+        if (mNativeImeAdapterAndroid == nativeImeAdapter) return;
+        if (mNativeImeAdapterAndroid != 0) {
+            nativeResetImeAdapter(mNativeImeAdapterAndroid);
+        }
+        if (nativeImeAdapter != 0) {
+            nativeAttachImeAdapter(nativeImeAdapter);
+        }
+        mNativeImeAdapterAndroid = nativeImeAdapter;
     }
 
     /**
@@ -291,10 +254,6 @@
         }
     }
 
-    private boolean hasInputType() {
-        return mTextInputType != TextInputType.NONE;
-    }
-
     private static boolean isTextInputType(int type) {
         return type != TextInputType.NONE && !InputDialogContainer.isDialogInputType(type);
     }
@@ -442,7 +401,9 @@
     @CalledByNative
     private void focusedNodeChanged(boolean isEditable) {
         Log.d(TAG, "focusedNodeChanged");
-        if (mInputConnection != null && isEditable) mInputConnection.restartInput();
+        if (mTextInputType != TextInputType.NONE && mInputConnection != null && isEditable) {
+            mInputConnection.restartInput();
+        }
     }
 
     @CalledByNative
@@ -474,9 +435,7 @@
     @CalledByNative
     void detach() {
         Log.d(TAG, "detach");
-        mHandler.removeCallbacks(mDismissInputRunnable);
         mNativeImeAdapterAndroid = 0;
-        mTextInputType = 0;
     }
 
     private native boolean nativeSendSyntheticKeyEvent(long nativeImeAdapterAndroid,

diff --git a/content/public/android/javatests/src/org/chromium/content/browser/input/ImeTest.java b/content/public/android/javatests/src/org/chromium/content/browser/input/ImeTest.java
index bf4c10a..46b28024 100644
--- a/content/public/android/javatests/src/org/chromium/content/browser/input/ImeTest.java
+++ b/content/public/android/javatests/src/org/chromium/content/browser/input/ImeTest.java

@@ -29,8 +29,10 @@
 import org.chromium.content.browser.test.util.TestInputMethodManagerWrapper.Range;
 import org.chromium.content_public.browser.WebContents;
 import org.chromium.content_shell_apk.ContentShellTestBase;
+import org.chromium.ui.base.ime.TextInputType;
 
 import java.util.ArrayList;
+import java.util.Arrays;
 import java.util.List;
 import java.util.concurrent.TimeoutException;
 
@@ -38,16 +40,17 @@
  * Integration tests for text input using cases based on fixed regressions.
  */
 public class ImeTest extends ContentShellTestBase {
-
     private static final String DATA_URL = UrlUtils.encodeHtmlDataUri(
             "<html><head><meta name=\"viewport\""
             + "content=\"width=device-width, initial-scale=2.0, maximum-scale=2.0\" /></head>"
             + "<body><form action=\"about:blank\">"
-            + "<input id=\"input_text\" type=\"text\" /><br/>"
+            + "<input id=\"input_text\" type=\"text\" /><br/></form><form>"
             + "<input id=\"input_radio\" type=\"radio\" style=\"width:50px;height:50px\" />"
             + "<br/><textarea id=\"textarea\" rows=\"4\" cols=\"20\"></textarea>"
             + "<br/><textarea id=\"textarea2\" rows=\"4\" cols=\"20\" autocomplete=\"off\">"
             + "</textarea>"
+            + "<br/><input id=\"input_number1\" type=\"number\" /><br/>"
+            + "<br/><input id=\"input_number2\" type=\"number\" /><br/>"
             + "<br/><p><span id=\"plain_text\">This is Plain Text One</span></p>"
             + "</form></body></html>");
 
@@ -86,20 +89,17 @@
         mConnection = (TestAdapterInputConnection) getAdapterInputConnection();
         mImeAdapter = getImeAdapter();
 
-        // Two state updates from focus change and GestureTap.
         waitAndVerifyStatesAndCalls(0, "", 0, 0, -1, -1);
-        waitAndVerifyStatesAndCalls(1, "", 0, 0, -1, -1);
-
-        assertEquals(1, mInputMethodManagerWrapper.getShowSoftInputCounter());
+        waitForKeyboardStates(1, 0, 1, new Integer[] {TextInputType.TEXT});
         assertEquals(0, mInputMethodManagerWrapper.getEditorInfo().initialSelStart);
         assertEquals(0, mInputMethodManagerWrapper.getEditorInfo().initialSelEnd);
 
-        resetUpdateStateList();
+        resetAllStates();
     }
 
     private void assertNoFurtherStateUpdate(final int index) throws InterruptedException {
         final List<TestImeState> states = mConnectionFactory.getImeStateList();
-        assertFalse(CriteriaHelper.pollForCriteria(new Criteria() {
+        assertFalse(CriteriaHelper.pollForUIThreadCriteria(new Criteria() {
             @Override
             public boolean isSatisfied() {
                 return states.size() > index;
@@ -111,6 +111,7 @@
     @Feature({"TextInput", "Main"})
     public void testSetUpGeneratesNoFurtherStateUpdate() throws Throwable {
         assertNoFurtherStateUpdate(0);
+        waitForKeyboardStates(0, 0, 0, new Integer[] {});
     }
 
     @MediumTest
@@ -127,28 +128,22 @@
 
     @SmallTest
     @Feature({"TextInput", "Main"})
-    @RerunWithUpdatedContainerView
-    public void testGetTextUpdatesAfterEnteringText() throws Throwable {
+    public void testCommitWhileComposingText() throws Throwable {
         setComposingText("h", 1);
         waitAndVerifyStates(0, "h", 1, 1, 0, 1);
-        assertEquals(1, mInputMethodManagerWrapper.getShowSoftInputCounter());
 
         setComposingText("he", 1);
         waitAndVerifyStates(1, "he", 2, 2, 0, 2);
-        assertEquals(1, mInputMethodManagerWrapper.getShowSoftInputCounter());
 
         setComposingText("hel", 1);
         waitAndVerifyStates(2, "hel", 3, 3, 0, 3);
-        assertEquals(1, mInputMethodManagerWrapper.getShowSoftInputCounter());
 
         commitText("hel", 1);
         waitAndVerifyStates(3, "hel", 3, 3, -1, -1);
-        assertEquals(1, mInputMethodManagerWrapper.getShowSoftInputCounter());
     }
 
     @SmallTest
     @Feature({"TextInput"})
-    @RerunWithUpdatedContainerView
     public void testImeCopy() throws Exception {
         commitText("hello", 1);
         waitAndVerifyStates(0, "hello", 5, 5, -1, -1);
@@ -168,11 +163,80 @@
 
         DOMUtils.clickNode(this, mContentViewCore, "input_radio");
         assertWaitForKeyboardStatus(false);
+        waitAndVerifyStatesAndCalls(1, "", 0, 0, -1, -1);
 
         DOMUtils.clickNode(this, mContentViewCore, "input_text");
         assertWaitForKeyboardStatus(true);
-        assertEquals(5, mInputMethodManagerWrapper.getEditorInfo().initialSelStart);
-        assertEquals(5, mInputMethodManagerWrapper.getEditorInfo().initialSelEnd);
+
+        // The initial values will not be correct here because we call showSoftInput()
+        // before updating selection range.
+        assertEquals(0, mInputMethodManagerWrapper.getEditorInfo().initialSelStart);
+        assertEquals(0, mInputMethodManagerWrapper.getEditorInfo().initialSelEnd);
+
+        // The values will immediately be updated.
+        waitAndVerifyStatesAndCalls(2, "hello", 5, 5, -1, -1);
+    }
+
+    @SmallTest
+    @Feature({"TextInput"})
+    public void testShowAndHideSoftInput() throws Exception {
+        focusElement("input_radio", false);
+        waitAndVerifyStatesAndCalls(0, "", 0, 0, -1, -1);
+
+        // hideSoftKeyboard().
+        waitForKeyboardStates(0, 1, 0, new Integer[] {});
+
+        // showSoftInput(), restartInput()
+        focusElement("input_number1");
+        waitForKeyboardStates(1, 1, 1, new Integer[] {TextInputType.NUMBER});
+
+        focusElement("input_number2");
+        // Hide should never be called here. Otherwise we will see a flicker. Restarted to
+        // reset internal states to handle the new input form.
+        waitForKeyboardStates(2, 1, 2, new Integer[] {TextInputType.NUMBER, TextInputType.NUMBER});
+
+        focusElement("input_text");
+        // showSoftInput() on input_text. restartInput() on input_number1 due to focus change,
+        // and restartInput() on input_text later.
+        // TODO(changwan): reduce unnecessary restart input.
+        waitForKeyboardStates(3, 1, 4, new Integer[] {TextInputType.NUMBER, TextInputType.NUMBER,
+                TextInputType.NUMBER, TextInputType.TEXT});
+
+        focusElement("input_radio", false);
+        // hideSoftInput().
+        waitForKeyboardStates(3, 2, 4, new Integer[] {TextInputType.NUMBER, TextInputType.NUMBER,
+                TextInputType.NUMBER, TextInputType.TEXT});
+    }
+
+    private void waitForKeyboardStates(int show, int hide, int restart, Integer[] history)
+            throws InterruptedException {
+        final String expected = stringifyKeyboardStates(show, hide, restart, history);
+        assertTrue("Expected: {" + expected + "}, Actual: {" + getKeyboardStates() + "}",
+                CriteriaHelper.pollForUIThreadCriteria(new Criteria() {
+                    @Override
+                    public boolean isSatisfied() {
+                        return expected.equals(getKeyboardStates());
+                    }
+                }));
+    }
+
+    private void resetAllStates() {
+        mInputMethodManagerWrapper.resetCounters();
+        mConnectionFactory.clearTextInputTypeHistory();
+        resetUpdateStateList();
+    }
+
+    private String getKeyboardStates() {
+        int showCount = mInputMethodManagerWrapper.getShowSoftInputCounter();
+        int hideCount = mInputMethodManagerWrapper.getHideSoftInputCounter();
+        int restartCount = mInputMethodManagerWrapper.getRestartInputCounter();
+        Integer[] history = mConnectionFactory.getTextInputTypeHistory();
+        return stringifyKeyboardStates(showCount, hideCount, restartCount, history);
+    }
+
+    private String stringifyKeyboardStates(int show, int hide, int restart, Integer[] history) {
+        return "show count: " + show + ", hide count: " + hide + ", restart count: " + restart
+                + ", input type history: " + Arrays.deepToString(history);
     }
 
     @SmallTest
@@ -236,13 +300,12 @@
         // Long press will first change selection region, and then trigger IME app to show up.
         // See RenderFrameImpl::didChangeSelection() and RenderWidget::didHandleGestureEvent().
         waitAndVerifyStatesAndCalls(1, "Sample Text", 7, 11, 0, 11);
-        waitAndVerifyStatesAndCalls(2, "Sample Text", 7, 11, 0, 11);
 
         // Now IME app wants to finish composing text because an external selection
         // change has been detected. At least Google Latin IME and Samsung IME
         // behave this way.
         finishComposingText();
-        waitAndVerifyStatesAndCalls(3, "Sample Text", 7, 11, -1, -1);
+        waitAndVerifyStatesAndCalls(2, "Sample Text", 7, 11, -1, -1);
     }
 
     @SmallTest
@@ -839,7 +902,7 @@
         assertTrue(CriteriaHelper.pollForUIThreadCriteria(new Criteria() {
             @Override
             public boolean isSatisfied() {
-                return show == getImeAdapter().mIsShowWithoutHideOutstanding
+                return show == mInputMethodManagerWrapper.isShowWithoutHideOutstanding()
                         && (!show || getAdapterInputConnection() != null);
             }
         }));
@@ -859,7 +922,7 @@
             final int selectionEnd, final int compositionStart, final int compositionEnd)
             throws InterruptedException {
         final List<TestImeState> states = mConnectionFactory.getImeStateList();
-        assertTrue(CriteriaHelper.pollForCriteria(new Criteria() {
+        assertTrue(CriteriaHelper.pollForUIThreadCriteria(new Criteria() {
             @Override
             public boolean isSatisfied() {
                 return states.size() > index;
@@ -1059,8 +1122,13 @@
     }
 
     private void focusElement(final String id) throws InterruptedException, TimeoutException {
+        focusElement(id, true);
+    }
+
+    private void focusElement(final String id, boolean shouldShowKeyboard)
+            throws InterruptedException, TimeoutException {
         DOMUtils.focusNode(mWebContents, id);
-        assertWaitForKeyboardStatus(true);
+        assertWaitForKeyboardStatus(shouldShowKeyboard);
         assertTrue(CriteriaHelper.pollForCriteria(new Criteria() {
             @Override
             public boolean isSatisfied() {
@@ -1078,10 +1146,12 @@
     private static class TestAdapterInputConnectionFactory extends
             ImeAdapter.AdapterInputConnectionFactory {
         private final List<TestImeState> mImeStateList = new ArrayList<>();
+        private final List<Integer> mTextInputTypeList = new ArrayList<>();
 
         @Override
         public AdapterInputConnection get(View view, ImeAdapter imeAdapter,
                 Editable editable, EditorInfo outAttrs) {
+            mTextInputTypeList.add(imeAdapter.getTextInputType());
             return new TestAdapterInputConnection(
                     mImeStateList, view, imeAdapter, editable, outAttrs);
         }
@@ -1089,6 +1159,16 @@
         public List<TestImeState> getImeStateList() {
             return mImeStateList;
         }
+
+        public Integer[] getTextInputTypeHistory() {
+            Integer[] result = new Integer[mTextInputTypeList.size()];
+            mTextInputTypeList.toArray(result);
+            return result;
+        }
+
+        public void clearTextInputTypeHistory() {
+            mTextInputTypeList.clear();
+        }
     }
 
     private static class TestAdapterInputConnection extends AdapterInputConnection {

diff --git a/content/public/browser/appcache_service.h b/content/public/browser/appcache_service.h
index 67d1ca6..7d4da8e 100644
--- a/content/public/browser/appcache_service.h
+++ b/content/public/browser/appcache_service.h

@@ -34,13 +34,6 @@
 // Call these methods only on the IO thread.
 class CONTENT_EXPORT AppCacheService {
  public:
-  // Determines if a request for 'url' can be satisfied while offline.
-  // This method always completes asynchronously.
-  virtual void CanHandleMainResourceOffline(const GURL& url,
-                                            const GURL& first_party,
-                                            const net::CompletionCallback&
-                                            callback) = 0;
-
   // Populates 'collection' with info about all of the appcaches stored
   // within the service, 'callback' is invoked upon completion. The service
   // acquires a reference to the 'collection' until completion.

diff --git a/content/public/browser/service_worker_context.h b/content/public/browser/service_worker_context.h
index 9479ab4..843704d 100644
--- a/content/public/browser/service_worker_context.h
+++ b/content/public/browser/service_worker_context.h

@@ -11,13 +11,8 @@
 #include "base/basictypes.h"
 #include "base/callback_forward.h"
 #include "content/public/browser/service_worker_usage_info.h"
-#include "net/base/completion_callback.h"
 #include "url/gurl.h"
 
-namespace net {
-class URLRequest;
-}
-
 namespace content {
 
 // Represents the per-StoragePartition ServiceWorker data.
@@ -44,10 +39,6 @@
   // Must be called from the IO thread.
   static bool IsExcludedHeaderNameForFetchEvent(const std::string& header_name);
 
-  // Retrieves the ServiceWorkerContext, if any, associated with |request|.
-  CONTENT_EXPORT static ServiceWorkerContext* GetServiceWorkerContext(
-      net::URLRequest* request);
-
   // Equivalent to calling navigator.serviceWorker.register(script_url, {scope:
   // pattern}) from a renderer, except that |pattern| is an absolute URL instead
   // of relative to some current origin.  |callback| is passed true when the JS
@@ -74,15 +65,6 @@
   virtual void UnregisterServiceWorker(const Scope& pattern,
                                        const ResultCallback& callback) = 0;
 
-  // TODO(jyasskin): Provide a way to SendMessage to a Scope.
-
-  // Determines if a request for |url| can be satisfied while offline.
-  // This method always completes asynchronously.
-  virtual void CanHandleMainResourceOffline(const GURL& url,
-                                            const GURL& first_party,
-                                            const net::CompletionCallback&
-                                            callback) = 0;
-
   // Methods used in response to browsing data and quota manager requests.
   virtual void GetAllOriginsInfo(const GetUsageInfoCallback& callback) = 0;
   virtual void DeleteForOrigin(const GURL& origin_url,

diff --git a/content/public/test/android/javatests/src/org/chromium/content/browser/test/util/TestInputMethodManagerWrapper.java b/content/public/test/android/javatests/src/org/chromium/content/browser/test/util/TestInputMethodManagerWrapper.java
index 674bf58..20ad2219 100644
--- a/content/public/test/android/javatests/src/org/chromium/content/browser/test/util/TestInputMethodManagerWrapper.java
+++ b/content/public/test/android/javatests/src/org/chromium/content/browser/test/util/TestInputMethodManagerWrapper.java

@@ -64,11 +64,14 @@
 
     private final ContentViewCore mContentViewCore;
     private InputConnection mInputConnection;
-    private int mShowSoftInputCounter = 0;
-    private int mUpdateSelectionCounter = 0;
+    private int mRestartInputCounter;
+    private int mShowSoftInputCounter;
+    private int mHideSoftInputCounter;
+    private int mUpdateSelectionCounter;
     private EditorInfo mEditorInfo;
     private final Range mSelection = new Range(0, 0);
     private final Range mComposition = new Range(-1, -1);
+    private boolean mIsShowWithoutHideOutstanding;
 
     public TestInputMethodManagerWrapper(ContentViewCore contentViewCore) {
         super(null);
@@ -77,12 +80,14 @@
 
     @Override
     public void restartInput(View view) {
+        mRestartInputCounter++;
         mEditorInfo = new EditorInfo();
         mInputConnection = mContentViewCore.onCreateInputConnection(mEditorInfo);
     }
 
     @Override
     public void showSoftInput(View view, int flags, ResultReceiver resultReceiver) {
+        mIsShowWithoutHideOutstanding = true;
         mShowSoftInputCounter++;
         if (mInputConnection != null) return;
         mEditorInfo = new EditorInfo();
@@ -98,6 +103,8 @@
     @Override
     public boolean hideSoftInputFromWindow(IBinder windowToken, int flags,
             ResultReceiver resultReceiver) {
+        mIsShowWithoutHideOutstanding = false;
+        mHideSoftInputCounter++;
         boolean retVal = mInputConnection == null;
         mInputConnection = null;
         return retVal;
@@ -111,14 +118,29 @@
         mComposition.set(candidatesStart, candidatesEnd);
     }
 
+    public int getRestartInputCounter() {
+        return mRestartInputCounter;
+    }
+
     public int getShowSoftInputCounter() {
         return mShowSoftInputCounter;
     }
 
+    public int getHideSoftInputCounter() {
+        return mHideSoftInputCounter;
+    }
+
     public int getUpdateSelectionCounter() {
         return mUpdateSelectionCounter;
     }
 
+    public void resetCounters() {
+        mRestartInputCounter = 0;
+        mShowSoftInputCounter = 0;
+        mHideSoftInputCounter = 0;
+        mUpdateSelectionCounter = 0;
+    }
+
     public EditorInfo getEditorInfo() {
         return mEditorInfo;
     }
@@ -130,4 +152,8 @@
     public Range getComposition() {
         return mComposition;
     }
+
+    public boolean isShowWithoutHideOutstanding() {
+        return mIsShowWithoutHideOutstanding;
+    }
 }
\ No newline at end of file

diff --git a/content/renderer/ime_event_guard.cc b/content/renderer/ime_event_guard.cc
index 9e4789d..aaed1712 100644
--- a/content/renderer/ime_event_guard.cc
+++ b/content/renderer/ime_event_guard.cc

@@ -8,12 +8,19 @@
 
 namespace content {
 
-ImeEventGuard::ImeEventGuard(RenderWidget* widget) : widget_(widget) {
-  widget_->StartHandlingImeEvent();
+ImeEventGuard::ImeEventGuard(RenderWidget* widget)
+  : ImeEventGuard(widget, false, true) {
+}
+
+ImeEventGuard::ImeEventGuard(RenderWidget* widget, bool show_ime, bool from_ime)
+  : widget_(widget),
+    show_ime_(show_ime),
+    from_ime_(from_ime) {
+  widget_->OnImeEventGuardStart(this);
 }
 
 ImeEventGuard::~ImeEventGuard() {
-  widget_->FinishHandlingImeEvent();
+  widget_->OnImeEventGuardFinish(this);
 }
 
 } //  namespace content

diff --git a/content/renderer/ime_event_guard.h b/content/renderer/ime_event_guard.h
index 811540e98..c3854b1 100644
--- a/content/renderer/ime_event_guard.h
+++ b/content/renderer/ime_event_guard.h

@@ -8,14 +8,23 @@
 namespace content {
 class RenderWidget;
 
-// Simple RAII object for handling IME events. Calls StartHandlingImeEvent on
-// construction and FinishHandlingImeEvent on destruction.
+// Simple RAII object for guarding IME updates. Calls OnImeGuardStart on
+// construction and OnImeGuardFinish on destruction.
 class ImeEventGuard {
  public:
   explicit ImeEventGuard(RenderWidget* widget);
+  ImeEventGuard(RenderWidget* widget, bool show_ime, bool from_ime);
   ~ImeEventGuard();
+
+  bool show_ime() const { return show_ime_; }
+  bool from_ime() const { return from_ime_; }
+  void set_show_ime(bool show_ime) { show_ime_ = show_ime; }
+  void set_from_ime(bool from_ime) { from_ime_ = from_ime; }
+
  private:
   RenderWidget* widget_;
+  bool show_ime_;
+  bool from_ime_;
 };
 }
 

diff --git a/content/renderer/media/rtc_certificate_generator.cc b/content/renderer/media/rtc_certificate_generator.cc
index 945c646..757cad0 100644
--- a/content/renderer/media/rtc_certificate_generator.cc
+++ b/content/renderer/media/rtc_certificate_generator.cc

@@ -136,7 +136,7 @@
     const blink::WebURL& url,
     const blink::WebURL& first_party_for_cookies,
     blink::WebCallbacks<blink::WebRTCCertificate*, void>* observer) {
-  DCHECK(isValidKeyParams(key_params));
+  DCHECK(isSupportedKeyParams(key_params));
 
 #if defined(ENABLE_WEBRTC)
   const scoped_refptr<base::SingleThreadTaskRunner> main_thread =
@@ -159,7 +159,7 @@
 #endif
 }
 
-bool RTCCertificateGenerator::isValidKeyParams(
+bool RTCCertificateGenerator::isSupportedKeyParams(
     const blink::WebRTCKeyParams& key_params) {
   return WebRTCKeyParamsToKeyParams(key_params).IsValid();
 }

diff --git a/content/renderer/media/rtc_certificate_generator.h b/content/renderer/media/rtc_certificate_generator.h
index e2c7103..46dfbb0 100644
--- a/content/renderer/media/rtc_certificate_generator.h
+++ b/content/renderer/media/rtc_certificate_generator.h

@@ -26,7 +26,7 @@
       const blink::WebURL& url,
       const blink::WebURL& first_party_for_cookies,
       blink::WebCallbacks<blink::WebRTCCertificate*, void>* observer) override;
-  bool isValidKeyParams(const blink::WebRTCKeyParams& key_params) override;
+  bool isSupportedKeyParams(const blink::WebRTCKeyParams& key_params) override;
 
  private:
   DISALLOW_COPY_AND_ASSIGN(RTCCertificateGenerator);

diff --git a/content/renderer/render_widget.cc b/content/renderer/render_widget.cc
index 44b971f..b835799b 100644
--- a/content/renderer/render_widget.cc
+++ b/content/renderer/render_widget.cc

@@ -499,7 +499,7 @@
       display_mode_(blink::WebDisplayModeUndefined),
       handling_input_event_(false),
       handling_event_overscroll_(nullptr),
-      handling_ime_event_(false),
+      ime_event_guard_(nullptr),
       handling_event_type_(WebInputEvent::Undefined),
       ignore_ack_for_mouse_move_from_debugger_(false),
       closing_(false),
@@ -1084,25 +1084,11 @@
                                          &event_overscroll);
 
 #if defined(OS_ANDROID)
-  // On Android, when a key is pressed or sent from the Keyboard using IME,
-  // |AdapterInputConnection| generates input key events to make sure all JS
-  // listeners that monitor KeyUp and KeyDown events receive the proper key
-  // code. Since this input key event comes from IME, we need to set the
-  // IME event guard here to make sure it does not interfere with other IME
-  // events.
-  scoped_ptr<ImeEventGuard> ime_event_guard_maybe;
-  if (WebInputEvent::isKeyboardEventType(input_event->type)) {
-    const WebKeyboardEvent& key_event =
-        *static_cast<const WebKeyboardEvent*>(input_event);
-    // Some keys are special and it's essential that no events get blocked.
-    if (key_event.nativeKeyCode != AKEYCODE_TAB &&
-        key_event.nativeKeyCode != AKEYCODE_DPAD_CENTER &&
-        key_event.nativeKeyCode != AKEYCODE_DPAD_LEFT &&
-        key_event.nativeKeyCode != AKEYCODE_DPAD_RIGHT &&
-        key_event.nativeKeyCode != AKEYCODE_DPAD_UP &&
-        key_event.nativeKeyCode != AKEYCODE_DPAD_DOWN)
-      ime_event_guard_maybe.reset(new ImeEventGuard(this));
-  }
+  const bool is_keyboard_event =
+      WebInputEvent::isKeyboardEventType(input_event->type);
+
+  // For non-keyboard events, we want the change source to be FROM_NON_IME.
+  ImeEventGuard guard(this, false, is_keyboard_event);
 #endif
 
   base::TimeTicks start_time;
@@ -1891,29 +1877,49 @@
       type == ui::TEXT_INPUT_TYPE_WEEK;
 }
 
-
-void RenderWidget::StartHandlingImeEvent() {
-  DCHECK(!handling_ime_event_);
-  handling_ime_event_ = true;
+void RenderWidget::OnImeEventGuardStart(ImeEventGuard* guard) {
+  if (!ime_event_guard_)
+    ime_event_guard_ = guard;
 }
 
-void RenderWidget::FinishHandlingImeEvent() {
-  DCHECK(handling_ime_event_);
-  handling_ime_event_ = false;
+void RenderWidget::OnImeEventGuardFinish(ImeEventGuard* guard) {
+  if (ime_event_guard_ != guard) {
+#if defined(OS_ANDROID)
+    // In case a from-IME event (e.g. touch) ends up in not-from-IME event
+    // (e.g. long press gesture), we want to treat it as not-from-IME event
+    // so that AdapterInputConnection can make changes to its Editable model.
+    // Therefore, we want to mark this text state update as 'from IME' only
+    // when all the nested events are all originating from IME.
+    ime_event_guard_->set_from_ime(
+        ime_event_guard_->from_ime() && guard->from_ime());
+#endif
+    return;
+  }
+  ime_event_guard_ = nullptr;
+
   // While handling an ime event, text input state and selection bounds updates
   // are ignored. These must explicitly be updated once finished handling the
   // ime event.
   UpdateSelectionBounds();
 #if defined(OS_ANDROID)
-  UpdateTextInputState(NO_SHOW_IME, FROM_IME);
+  UpdateTextInputState(
+      guard->show_ime() ? SHOW_IME_IF_NEEDED : NO_SHOW_IME,
+      guard->from_ime() ? FROM_IME : FROM_NON_IME);
 #endif
 }
 
 void RenderWidget::UpdateTextInputState(ShowIme show_ime,
                                         ChangeSource change_source) {
   TRACE_EVENT0("renderer", "RenderWidget::UpdateTextInputState");
-  if (handling_ime_event_)
+  if (ime_event_guard_) {
+    // show_ime should still be effective even if it was set inside the IME
+    // event guard.
+    if (show_ime == SHOW_IME_IF_NEEDED) {
+      ime_event_guard_->set_show_ime(true);
+    }
     return;
+  }
+
   ui::TextInputType new_type = GetTextInputType();
   if (IsDateTimeInput(new_type))
     return;  // Not considered as a text input field in WebKit/Chromium.
@@ -1979,7 +1985,7 @@
   TRACE_EVENT0("renderer", "RenderWidget::UpdateSelectionBounds");
   if (!webwidget_)
     return;
-  if (handling_ime_event_)
+  if (ime_event_guard_)
     return;
 
 #if defined(USE_AURA)

diff --git a/content/renderer/render_widget.h b/content/renderer/render_widget.h
index 804ec98..ce9113d 100644
--- a/content/renderer/render_widget.h
+++ b/content/renderer/render_widget.h

@@ -83,6 +83,7 @@
 class CompositorDependencies;
 class ExternalPopupMenu;
 class FrameSwapMessageQueue;
+class ImeEventGuard;
 class PepperPluginInstanceImpl;
 class RenderFrameImpl;
 class RenderFrameProxy;
@@ -246,9 +247,9 @@
   // |policy| see the comment on MessageDeliveryPolicy.
   void QueueMessage(IPC::Message* msg, MessageDeliveryPolicy policy);
 
-  // Handle common setup/teardown for handling IME events.
-  void StartHandlingImeEvent();
-  void FinishHandlingImeEvent();
+  // Handle start and finish of IME event guard.
+  void OnImeEventGuardStart(ImeEventGuard* guard);
+  void OnImeEventGuardFinish(ImeEventGuard* guard);
 
   // Returns whether we currently should handle an IME event.
   bool ShouldHandleImeEvent();
@@ -663,8 +664,9 @@
   // supporting overscroll IPC notifications due to fling animation updates.
   scoped_ptr<DidOverscrollParams>* handling_event_overscroll_;
 
-  // Are we currently handling an ime event?
-  bool handling_ime_event_;
+  // It is possible that one ImeEventGuard is nested inside another
+  // ImeEventGuard. We keep track of the outermost one, and update it as needed.
+  ImeEventGuard* ime_event_guard_;
 
   // Type of the input event we are currently handling.
   blink::WebInputEvent::Type handling_event_type_;

diff --git a/extensions/browser/service_worker_manager.cc b/extensions/browser/service_worker_manager.cc
index 6e77a72..16167d4 100644
--- a/extensions/browser/service_worker_manager.cc
+++ b/extensions/browser/service_worker_manager.cc

@@ -4,6 +4,7 @@
 
 #include "extensions/browser/service_worker_manager.h"
 
+#include "base/bind.h"
 #include "content/public/browser/browser_context.h"
 #include "content/public/browser/service_worker_context.h"
 #include "content/public/browser/storage_partition.h"

diff --git a/gpu/command_buffer/service/framebuffer_manager.cc b/gpu/command_buffer/service/framebuffer_manager.cc
index 2460a1e..b8fb0b28 100644
--- a/gpu/command_buffer/service/framebuffer_manager.cc
+++ b/gpu/command_buffer/service/framebuffer_manager.cc

@@ -105,11 +105,13 @@
     : public Framebuffer::Attachment {
  public:
   TextureAttachment(
-      TextureRef* texture_ref, GLenum target, GLint level, GLsizei samples)
+      TextureRef* texture_ref, GLenum target, GLint level,
+      GLsizei samples, GLint layer)
       : texture_ref_(texture_ref),
         target_(target),
         level_(level),
-        samples_(samples) {
+        samples_(samples),
+        layer_(layer) {
   }
 
   GLsizei width() const override {
@@ -146,6 +148,8 @@
 
   GLsizei samples() const override { return samples_; }
 
+  GLint layer() const { return layer_; }
+
   GLuint object_name() const override { return texture_ref_->client_id(); }
 
   bool cleared() const override {
@@ -223,6 +227,7 @@
   GLenum target_;
   GLint level_;
   GLsizei samples_;
+  GLint layer_;
 
   DISALLOW_COPY_AND_ASSIGN(TextureAttachment);
 };
@@ -674,7 +679,23 @@
     a->DetachFromFramebuffer(this);
   if (texture_ref) {
     attachments_[attachment] = scoped_refptr<Attachment>(
-        new TextureAttachment(texture_ref, target, level, samples));
+        new TextureAttachment(texture_ref, target, level, samples, 0));
+    texture_ref->texture()->AttachToFramebuffer();
+  } else {
+    attachments_.erase(attachment);
+  }
+  framebuffer_complete_state_count_id_ = 0;
+}
+
+void Framebuffer::AttachTextureLayer(
+    GLenum attachment, TextureRef* texture_ref, GLenum target,
+    GLint level, GLint layer) {
+  const Attachment* a = GetAttachment(attachment);
+  if (a)
+    a->DetachFromFramebuffer(this);
+  if (texture_ref) {
+    attachments_[attachment] = scoped_refptr<Attachment>(
+        new TextureAttachment(texture_ref, target, level, 0, layer));
     texture_ref->texture()->AttachToFramebuffer();
   } else {
     attachments_.erase(attachment);

diff --git a/gpu/command_buffer/service/framebuffer_manager.h b/gpu/command_buffer/service/framebuffer_manager.h
index db78ffe..dce23022 100644
--- a/gpu/command_buffer/service/framebuffer_manager.h
+++ b/gpu/command_buffer/service/framebuffer_manager.h

@@ -88,6 +88,9 @@
   void AttachTexture(
       GLenum attachment, TextureRef* texture_ref, GLenum target,
       GLint level, GLsizei samples);
+  void AttachTextureLayer(
+      GLenum attachment, TextureRef* texture_ref, GLenum target,
+      GLint level, GLint layer);
 
   // Unbinds the given renderbuffer if it is bound.
   void UnbindRenderbuffer(

diff --git a/gpu/command_buffer/service/gles2_cmd_decoder.cc b/gpu/command_buffer/service/gles2_cmd_decoder.cc
index 4b618c6..f90615a 100644
--- a/gpu/command_buffer/service/gles2_cmd_decoder.cc
+++ b/gpu/command_buffer/service/gles2_cmd_decoder.cc

@@ -6356,9 +6356,16 @@
 void GLES2DecoderImpl::DoFramebufferTextureLayer(
     GLenum target, GLenum attachment, GLuint client_texture_id,
     GLint level, GLint layer) {
-  // TODO(zmo): Unsafe ES3 API, missing states update.
+  // TODO(zmo): Add full validation.
   GLuint service_id = 0;
   TextureRef* texture_ref = NULL;
+  Framebuffer* framebuffer = GetFramebufferInfoForTarget(target);
+  if (!framebuffer) {
+    LOCAL_SET_GL_ERROR(
+        GL_INVALID_OPERATION,
+        "glFramebufferTextureLayer", "no framebuffer bound.");
+    return;
+  }
   if (client_texture_id) {
     texture_ref = GetTexture(client_texture_id);
     if (!texture_ref) {
@@ -6369,7 +6376,14 @@
     }
     service_id = texture_ref->service_id();
   }
+  LOCAL_COPY_REAL_GL_ERRORS_TO_WRAPPER("glFramebufferTextureLayer");
   glFramebufferTextureLayer(target, attachment, service_id, level, layer);
+  GLenum error = LOCAL_PEEK_GL_ERROR("glFramebufferTextureLayer");
+  if (error == GL_NO_ERROR) {
+    framebuffer->AttachTextureLayer(attachment, texture_ref,
+        texture_ref ? texture_ref->texture()->target() : 0,
+        level, layer);
+  }
 }
 
 void GLES2DecoderImpl::DoGetFramebufferAttachmentParameteriv(

diff --git a/gpu/command_buffer/service/gles2_cmd_decoder_unittest_1.cc b/gpu/command_buffer/service/gles2_cmd_decoder_unittest_1.cc
index 95ada5d..36b099ba4 100644
--- a/gpu/command_buffer/service/gles2_cmd_decoder_unittest_1.cc
+++ b/gpu/command_buffer/service/gles2_cmd_decoder_unittest_1.cc

@@ -143,6 +143,19 @@
 };
 
 template <>
+void GLES2DecoderTestBase::SpecializedSetup<cmds::FramebufferTextureLayer, 0>(
+    bool valid) {
+  DoBindFramebuffer(GL_FRAMEBUFFER, client_framebuffer_id_,
+                    kServiceFramebufferId);
+  if (valid) {
+    EXPECT_CALL(*gl_, GetError())
+        .WillOnce(Return(GL_NO_ERROR))
+        .WillOnce(Return(GL_NO_ERROR))
+        .RetiresOnSaturation();
+  }
+};
+
+template <>
 void GLES2DecoderTestBase::SpecializedSetup<
     cmds::GetBufferParameteri64v, 0>(bool /* valid */) {
   DoBindBuffer(GL_ARRAY_BUFFER, client_buffer_id_, kServiceBufferId);

diff --git a/media/audio/mac/audio_auhal_mac.cc b/media/audio/mac/audio_auhal_mac.cc
index 1960f14..bd3bd83 100644
--- a/media/audio/mac/audio_auhal_mac.cc
+++ b/media/audio/mac/audio_auhal_mac.cc

@@ -149,8 +149,6 @@
     return;
   }
 
-  ReportAndResetStats();
-
   stopped_ = false;
   audio_fifo_.reset();
   {
@@ -179,6 +177,8 @@
   if (result != noErr)
     source_->OnError(this);
 
+  ReportAndResetStats();
+
   base::AutoLock auto_lock(source_lock_);
   source_ = NULL;
   stopped_ = true;
@@ -371,12 +371,16 @@
 }
 
 void AUHALStream::ReportAndResetStats() {
+  if (!last_sample_time_)
+    return;  // No stats gathered to report.
+
   // A value of 0 indicates that we got the buffer size we asked for.
   UMA_HISTOGRAM_COUNTS("Media.Audio.Render.FramesRequested",
                        number_of_frames_requested_);
   // Even if there aren't any glitches, we want to record it to get a feel for
   // how often we get no glitches vs the alternative.
-  UMA_HISTOGRAM_COUNTS("Media.Audio.Render.Glitches", glitches_detected_);
+  UMA_HISTOGRAM_CUSTOM_COUNTS("Media.Audio.Render.Glitches", glitches_detected_,
+                              0, 999999, 100);
 
   if (glitches_detected_ != 0) {
     auto lost_frames_ms = (total_lost_frames_ * 1000) / params_.sample_rate();

diff --git a/media/base/android/java/src/org/chromium/media/VideoCaptureCamera2.java b/media/base/android/java/src/org/chromium/media/VideoCaptureCamera2.java
index 81db67a0..0c66ede 100644
--- a/media/base/android/java/src/org/chromium/media/VideoCaptureCamera2.java
+++ b/media/base/android/java/src/org/chromium/media/VideoCaptureCamera2.java

@@ -107,6 +107,12 @@
                     return;
                 }
 
+                if (reader.getWidth() != image.getWidth()
+                        || reader.getHeight() != image.getHeight()) {
+                    throw new IllegalStateException("ImageReader size " + reader.getWidth() + "x"
+                            + reader.getHeight() + " did not match Image size " + image.getWidth()
+                            + "x" + image.getHeight());
+                }
                 readImageIntoBuffer(image, mCapturedData);
                 nativeOnFrameAvailable(mNativeVideoCaptureDeviceAndroid,
                                        mCapturedData,
@@ -352,8 +358,7 @@
             }
         }
 
-        ArrayList<VideoCaptureFormat> formatList =
-                new ArrayList<VideoCaptureFormat>();
+        ArrayList<VideoCaptureFormat> formatList = new ArrayList<VideoCaptureFormat>();
         final StreamConfigurationMap streamMap =
                 cameraCharacteristics.get(CameraCharacteristics.SCALER_STREAM_CONFIGURATION_MAP);
         final int[] formats = streamMap.getOutputFormats();
@@ -363,19 +368,17 @@
             for (Size size : sizes) {
                 double minFrameRate = 0.0f;
                 if (minFrameDurationAvailable) {
-                    final long minFrameDuration =
-                            streamMap.getOutputMinFrameDuration(format, size);
-                    minFrameRate = (minFrameDuration == 0) ? 0.0f :
-                            (1.0 / kNanoSecondsToFps * minFrameDuration);
+                    final long minFrameDuration = streamMap.getOutputMinFrameDuration(format, size);
+                    minFrameRate = (minFrameDuration == 0)
+                            ? 0.0f
+                            : (1.0 / kNanoSecondsToFps * minFrameDuration);
                 } else {
                     // TODO(mcasas): find out where to get the info from in this case.
                     // Hint: perhaps using SCALER_AVAILABLE_PROCESSED_MIN_DURATIONS.
                     minFrameRate = 0.0;
                 }
-                formatList.add(new VideoCaptureFormat(size.getWidth(),
-                                                              size.getHeight(),
-                                                              (int) minFrameRate,
-                                                              0));
+                formatList.add(new VideoCaptureFormat(
+                        size.getWidth(), size.getHeight(), (int) minFrameRate, 0));
             }
         }
         return formatList.toArray(new VideoCaptureFormat[formatList.size()]);
@@ -396,13 +399,36 @@
                 return false;
             }
         }
+        final CameraCharacteristics cameraCharacteristics = getCameraCharacteristics(mContext, mId);
+        final StreamConfigurationMap streamMap =
+                cameraCharacteristics.get(CameraCharacteristics.SCALER_STREAM_CONFIGURATION_MAP);
+
+        // Find closest supported size.
+        final Size[] supportedSizes = streamMap.getOutputSizes(ImageFormat.YUV_420_888);
+        if (supportedSizes == null) return false;
+        Size closestSupportedSize = null;
+        int minDiff = Integer.MAX_VALUE;
+        for (Size size : supportedSizes) {
+            final int diff =
+                    Math.abs(size.getWidth() - width) + Math.abs(size.getHeight() - height);
+            if (diff < minDiff) {
+                minDiff = diff;
+                closestSupportedSize = size;
+            }
+        }
+        if (minDiff == Integer.MAX_VALUE) {
+            Log.e(TAG, "No supported resolutions.");
+            return false;
+        }
+        Log.d(TAG, "allocate: matched (%d x %d)", closestSupportedSize.getWidth(),
+                closestSupportedSize.getHeight());
+
         // |mCaptureFormat| is also used to configure the ImageReader.
-        mCaptureFormat = new VideoCaptureFormat(width, height, frameRate, ImageFormat.YUV_420_888);
+        mCaptureFormat = new VideoCaptureFormat(closestSupportedSize.getWidth(),
+                closestSupportedSize.getHeight(), frameRate, ImageFormat.YUV_420_888);
         int expectedFrameSize = mCaptureFormat.mWidth * mCaptureFormat.mHeight
                 * ImageFormat.getBitsPerPixel(mCaptureFormat.mPixelFormat) / 8;
         mCapturedData = new byte[expectedFrameSize];
-        final CameraCharacteristics cameraCharacteristics =
-                getCameraCharacteristics(mContext, mId);
         mCameraNativeOrientation =
                 cameraCharacteristics.get(CameraCharacteristics.SENSOR_ORIENTATION);
         // TODO(mcasas): The following line is correct for N5 with prerelease Build,

diff --git a/mojo/application/public/cpp/BUILD.gn b/mojo/application/public/cpp/BUILD.gn
index a30d143..12b0e51 100644
--- a/mojo/application/public/cpp/BUILD.gn
+++ b/mojo/application/public/cpp/BUILD.gn

@@ -102,7 +102,4 @@
   if (is_android) {
     data_deps += [ "//mojo/android" ]
   }
-  if (!is_component_build) {
-    data_deps += [ "//mojo/runner" ]
-  }
 }

diff --git a/mojo/fetcher/url_resolver.cc b/mojo/fetcher/url_resolver.cc
index 7028f89..4663f5e5 100644
--- a/mojo/fetcher/url_resolver.cc
+++ b/mojo/fetcher/url_resolver.cc

@@ -19,22 +19,32 @@
   DCHECK(mojo_base_url_.is_valid());
   // Needed to treat first component of mojo URLs as host, not path.
   url::AddStandardScheme("mojo", url::SCHEME_WITHOUT_AUTHORITY);
+  url::AddStandardScheme("exe", url::SCHEME_WITHOUT_AUTHORITY);
 }
 
 URLResolver::~URLResolver() {
 }
 
 GURL URLResolver::ResolveMojoURL(const GURL& mojo_url) const {
-  if (mojo_url.scheme() != "mojo") {
+  if (mojo_url.SchemeIs("mojo")) {
+    // It's still a mojo: URL, use the default mapping scheme.
+    std::string query;
+    GURL base_url = shell::GetBaseURLAndQuery(mojo_url, &query);
+    const std::string host = base_url.host();
+    return mojo_base_url_.Resolve(host + "/" + host + ".mojo" + query);
+  } else if (mojo_url.SchemeIs("exe")) {
+#if defined OS_WIN
+    std::string extension = ".exe";
+#else
+    std::string extension;
+#endif
+    std::string query;
+    GURL base_url = shell::GetBaseURLAndQuery(mojo_url, &query);
+    return mojo_base_url_.Resolve(base_url.host() + extension);
+  } else {
     // The mapping has produced some sort of non-mojo: URL - file:, http:, etc.
     return mojo_url;
   }
-
-  // It's still a mojo: URL, use the default mapping scheme.
-  std::string query;
-  GURL base_url = shell::GetBaseURLAndQuery(mojo_url, &query);
-  const std::string host = base_url.host();
-  return mojo_base_url_.Resolve(host + "/" + host + ".mojo" + query);
 }
 
 }  // namespace fetcher

diff --git a/mojo/runner/BUILD.gn b/mojo/runner/BUILD.gn
index 8e14fe3..2ef7910 100644
--- a/mojo/runner/BUILD.gn
+++ b/mojo/runner/BUILD.gn

@@ -16,6 +16,7 @@
 
   deps = [
     ":mojo_runner",
+    "//mojo/runner/child",
   ]
 }
 
@@ -94,18 +95,14 @@
   }
 }
 
-source_set("in_process_native_runner") {
+source_set("init") {
   sources = [
-    "in_process_native_runner.cc",
-    "in_process_native_runner.h",
-  ]
-
-  public_deps = [
-    ":native_application_support",
-    "//mojo/shell",
+    "init.cc",
+    "init.h",
   ]
 
   deps = [
+    ":switches",
     "//base",
   ]
 }
@@ -118,8 +115,8 @@
     "child_process_host.h",
     "context.cc",
     "context.h",
-    "init.cc",
-    "init.h",
+    "in_process_native_runner.cc",
+    "in_process_native_runner.h",
     "out_of_process_native_runner.cc",
     "out_of_process_native_runner.h",
     "scoped_user_data_dir.cc",
@@ -131,8 +128,7 @@
   ]
 
   deps = [
-    ":child_process_bindings",
-    ":in_process_native_runner",
+    ":init",
     ":native_application_support",
     "//base",
     "//base/third_party/dynamic_annotations",
@@ -142,6 +138,7 @@
     "//mojo/application/public/cpp",
     "//mojo/message_pump",
     "//mojo/package_manager",
+    "//mojo/runner/child:interfaces",
     "//mojo/services/network/public/interfaces",
     "//mojo/services/tracing/public/cpp",
     "//mojo/services/tracing/public/interfaces",
@@ -165,6 +162,7 @@
   }
 
   public_deps = [
+    ":init",
     ":switches",
   ]
 
@@ -419,18 +417,6 @@
   }
 }
 
-mojom("child_process_bindings") {
-  sources = [
-    "child_process.mojom",
-  ]
-
-  deps = [
-    "//mojo/application/public/interfaces",
-  ]
-
-  import_dirs = [ "//mojo/services" ]
-}
-
 test("mojo_runner_unittests") {
   sources = [
     "../fetcher/about_fetcher_unittest.cc",
@@ -451,7 +437,6 @@
   ]
 
   deps = [
-    ":in_process_native_runner",
     ":lib",
     "//base",
     "//base:i18n",

diff --git a/mojo/runner/child/BUILD.gn b/mojo/runner/child/BUILD.gn
new file mode 100644
index 0000000..224bc4d
--- /dev/null
+++ b/mojo/runner/child/BUILD.gn

@@ -0,0 +1,97 @@
+# Copyright 2015 The Chromium Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+import("//mojo/public/mojo_application.gni")
+import("//third_party/mojo/src/mojo/public/tools/bindings/mojom.gni")
+
+group("child") {
+  testonly = true
+  deps = [
+    ":lib",
+    ":apptests",
+  ]
+}
+
+source_set("lib") {
+  sources = [
+    "runner_connection.cc",
+    "runner_connection.h",
+  ]
+
+  deps = [
+    ":interfaces",
+    "//base",
+    "//mojo/application/public/interfaces",
+    "//mojo/message_pump",
+    "//third_party/mojo/src/mojo/edk/system",
+  ]
+}
+
+mojom("interfaces") {
+  sources = [
+    "child_controller.mojom",
+  ]
+
+  deps = [
+    "//mojo/application/public/interfaces",
+  ]
+
+  import_dirs = [ "//mojo/services" ]
+}
+
+mojom("apptest_interfaces") {
+  sources = [
+    "test_native_service.mojom",
+  ]
+
+  deps = [
+    "//mojo/application/public/interfaces",
+  ]
+
+  import_dirs = [ "//mojo/services" ]
+}
+
+mojo_native_application("apptests") {
+  output_name = "mojo_runner_child_apptest"
+  testonly = true
+
+  sources = [
+    "native_apptest.cc",
+  ]
+
+  deps = [
+    ":apptest_interfaces",
+    "//base",
+    "//base/test:test_config",
+    "//mojo/application/public/cpp:sources",
+    "//mojo/application/public/cpp:test_support",
+    "//mojo/common:common_base",
+    "//mojo/converters/network:network",
+  ]
+
+  data_deps = [
+    ":native_target",
+  ]
+}
+
+executable("native_target") {
+  output_name = "mojo_runner_child_apptest_native_target"
+  testonly = true
+
+  sources = [
+    "native_apptest_target.cc",
+  ]
+
+  deps = [
+    ":apptest_interfaces",
+    ":lib",
+    "//base",
+    "//mojo/application/public/cpp",
+    "//mojo/application/public/interfaces",
+    "//mojo/common:common_base",
+    "//mojo/message_pump",
+    "//mojo/runner:init",
+    "//third_party/mojo/src/mojo/edk/embedder:embedder",
+  ]
+}

diff --git a/mojo/runner/child_process.mojom b/mojo/runner/child/child_controller.mojom
similarity index 100%
rename from mojo/runner/child_process.mojom
rename to mojo/runner/child/child_controller.mojom


diff --git a/mojo/runner/child/native_apptest.cc b/mojo/runner/child/native_apptest.cc
new file mode 100644
index 0000000..7bb7780a
--- /dev/null
+++ b/mojo/runner/child/native_apptest.cc

@@ -0,0 +1,42 @@
+// Copyright 2015 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "base/bind.h"
+#include "base/macros.h"
+#include "mojo/application/public/cpp/application_impl.h"
+#include "mojo/application/public/cpp/application_test_base.h"
+#include "mojo/converters/network/network_type_converters.h"
+#include "mojo/runner/child/test_native_service.mojom.h"
+
+namespace mojo {
+namespace runner {
+namespace {
+void InvertCallback(bool* result, bool from_native) {
+  *result = from_native;
+}
+}  // namespace
+
+using NativeAppTest = mojo::test::ApplicationTestBase;
+
+TEST_F(NativeAppTest, Connect) {
+  test::TestNativeServicePtr native_service;
+  application_impl()->ConnectToService(
+      mojo::URLRequest::From(
+          std::string("exe:mojo_runner_child_apptest_native_target")),
+      &native_service);
+
+  bool result = false;
+  native_service->Invert(
+      true, base::Bind(&InvertCallback, base::Unretained(&result)));
+  native_service.WaitForIncomingResponse();
+  EXPECT_FALSE(result);
+
+  native_service->Invert(
+      false, base::Bind(&InvertCallback, base::Unretained(&result)));
+  native_service.WaitForIncomingResponse();
+  EXPECT_TRUE(result);
+}
+
+}  // namespace runner
+}  // namespace mojo

diff --git a/mojo/runner/child/native_apptest_target.cc b/mojo/runner/child/native_apptest_target.cc
new file mode 100644
index 0000000..a2d3532
--- /dev/null
+++ b/mojo/runner/child/native_apptest_target.cc

@@ -0,0 +1,126 @@
+// Copyright 2015 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include <windows.h>
+
+#include "base/at_exit.h"
+#include "base/command_line.h"
+#include "base/debug/stack_trace.h"
+#include "base/memory/scoped_ptr.h"
+#include "base/message_loop/message_loop.h"
+#include "base/process/launch.h"
+#include "base/threading/thread.h"
+#include "build/build_config.h"
+#include "mojo/application/public/cpp/application_connection.h"
+#include "mojo/application/public/cpp/application_delegate.h"
+#include "mojo/application/public/cpp/application_impl.h"
+#include "mojo/application/public/cpp/interface_factory.h"
+#include "mojo/application/public/interfaces/application.mojom.h"
+#include "mojo/common/weak_binding_set.h"
+#include "mojo/message_pump/message_pump_mojo.h"
+#include "mojo/runner/child/runner_connection.h"
+#include "mojo/runner/child/test_native_service.mojom.h"
+#include "mojo/runner/init.h"
+#include "third_party/mojo/src/mojo/edk/embedder/embedder.h"
+#include "third_party/mojo/src/mojo/edk/embedder/process_delegate.h"
+
+namespace {
+
+class EDKState : public mojo::embedder::ProcessDelegate {
+ public:
+  EDKState() : io_thread_("io_thread") {
+    mojo::embedder::Init();
+
+    // Create and start our I/O thread.
+    base::Thread::Options io_thread_options(base::MessageLoop::TYPE_IO, 0);
+    CHECK(io_thread_.StartWithOptions(io_thread_options));
+    io_runner_ = io_thread_.task_runner().get();
+    CHECK(io_runner_.get());
+
+    // TODO(vtl): This should be SLAVE, not NONE.
+    mojo::embedder::InitIPCSupport(mojo::embedder::ProcessType::NONE,
+                                   io_runner_, this, io_runner_,
+                                   mojo::embedder::ScopedPlatformHandle());
+  }
+  ~EDKState() override { mojo::embedder::ShutdownIPCSupport(); }
+
+ private:
+  // mojo::embedder::ProcessDelegate:
+  void OnShutdownComplete() override {}
+
+  base::Thread io_thread_;
+  scoped_refptr<base::SingleThreadTaskRunner> io_runner_;
+
+  DISALLOW_COPY_AND_ASSIGN(EDKState);
+};
+
+class TargetApplicationDelegate
+    : public mojo::ApplicationDelegate,
+      public mojo::runner::test::TestNativeService,
+      public mojo::InterfaceFactory<mojo::runner::test::TestNativeService> {
+ public:
+  TargetApplicationDelegate() {}
+  ~TargetApplicationDelegate() override {}
+
+ private:
+  // mojo::ApplicationDelegate:
+  void Initialize(mojo::ApplicationImpl* app) override {}
+  bool ConfigureIncomingConnection(
+      mojo::ApplicationConnection* connection) override {
+    connection->AddService<mojo::runner::test::TestNativeService>(this);
+    return true;
+  }
+
+  // mojo::runner::test::TestNativeService:
+  void Invert(bool from_driver, const InvertCallback& callback) override {
+    callback.Run(!from_driver);
+  }
+
+  // mojo::InterfaceFactory<mojo::runner::test::TestNativeService>:
+  void Create(mojo::ApplicationConnection* connection,
+              mojo::InterfaceRequest<mojo::runner::test::TestNativeService>
+                  request) override {
+    bindings_.AddBinding(this, request.Pass());
+  }
+
+  mojo::WeakBindingSet<mojo::runner::test::TestNativeService> bindings_;
+
+  DISALLOW_COPY_AND_ASSIGN(TargetApplicationDelegate);
+};
+
+}  // namespace
+
+int main(int argc, char** argv) {
+  base::AtExitManager at_exit;
+  base::CommandLine::Init(argc, argv);
+
+  mojo::runner::InitializeLogging();
+  mojo::runner::WaitForDebuggerIfNecessary();
+
+#if !defined(OFFICIAL_BUILD)
+  base::debug::EnableInProcessStackDumping();
+#if defined(OS_WIN)
+  base::RouteStdioToConsole(false);
+#endif
+#endif
+
+  {
+    EDKState edk;
+
+    mojo::InterfaceRequest<mojo::Application> application_request;
+    scoped_ptr<mojo::runner::RunnerConnection> connection(
+        mojo::runner::RunnerConnection::ConnectToRunner(&application_request));
+
+    TargetApplicationDelegate delegate;
+    {
+      base::MessageLoop loop(mojo::common::MessagePumpMojo::Create());
+      mojo::ApplicationImpl impl(&delegate, application_request.Pass());
+      loop.Run();
+    }
+
+    connection.reset();
+  }
+
+  return 0;
+}

diff --git a/mojo/runner/child/runner_connection.cc b/mojo/runner/child/runner_connection.cc
new file mode 100644
index 0000000..c7758c4
--- /dev/null
+++ b/mojo/runner/child/runner_connection.cc

@@ -0,0 +1,257 @@
+// Copyright 2015 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "mojo/runner/child/runner_connection.h"
+
+#include "base/bind.h"
+#include "base/callback.h"
+#include "base/command_line.h"
+#include "base/memory/ref_counted.h"
+#include "base/memory/scoped_ptr.h"
+#include "base/thread_task_runner_handle.h"
+#include "base/threading/thread.h"
+#include "base/threading/thread_checker.h"
+#include "mojo/message_pump/message_pump_mojo.h"
+#include "mojo/public/cpp/bindings/binding.h"
+#include "mojo/runner/child/child_controller.mojom.h"
+#include "third_party/mojo/src/mojo/edk/embedder/embedder.h"
+#include "third_party/mojo/src/mojo/edk/embedder/platform_channel_pair.h"
+#include "third_party/mojo/src/mojo/edk/embedder/scoped_platform_handle.h"
+
+namespace mojo {
+namespace runner {
+namespace {
+
+// Blocks a thread until another thread unblocks it, at which point it unblocks
+// and runs a closure provided by that thread.
+class Blocker {
+ public:
+  class Unblocker {
+   public:
+    explicit Unblocker(Blocker* blocker = nullptr) : blocker_(blocker) {}
+    ~Unblocker() {}
+
+    void Unblock(base::Closure run_after) {
+      DCHECK(blocker_);
+      DCHECK(blocker_->run_after_.is_null());
+      blocker_->run_after_ = run_after;
+      blocker_->event_.Signal();
+      blocker_ = nullptr;
+    }
+
+   private:
+    Blocker* blocker_;
+
+    // Copy and assign allowed.
+  };
+
+  Blocker() : event_(true, false) {}
+  ~Blocker() {}
+
+  void Block() {
+    DCHECK(run_after_.is_null());
+    event_.Wait();
+    if (!run_after_.is_null())
+      run_after_.Run();
+  }
+
+  Unblocker GetUnblocker() { return Unblocker(this); }
+
+ private:
+  base::WaitableEvent event_;
+  base::Closure run_after_;
+
+  DISALLOW_COPY_AND_ASSIGN(Blocker);
+};
+
+using GotApplicationRequestCallback =
+    base::Callback<void(InterfaceRequest<Application>)>;
+
+void OnGotApplicationRequest(InterfaceRequest<Application>* out_request,
+                             InterfaceRequest<Application> request) {
+  *out_request = request.Pass();
+}
+
+class ChildControllerImpl;
+
+class RunnerConnectionImpl : public RunnerConnection {
+ public:
+  RunnerConnectionImpl() : controller_thread_("controller_thread") {
+    StartControllerThread();
+  }
+  ~RunnerConnectionImpl() override {
+    controller_runner_->PostTask(
+        FROM_HERE, base::Bind(&RunnerConnectionImpl::ShutdownOnControllerThread,
+                              base::Unretained(this)));
+    controller_thread_.Stop();
+  }
+
+  // Returns true if a connection to the runner has been established and
+  // |request| has been modified, false if no connection was established.
+  bool WaitForApplicationRequest(InterfaceRequest<Application>* request);
+
+  ChildControllerImpl* controller() const { return controller_.get(); }
+
+  void set_controller(scoped_ptr<ChildControllerImpl> controller) {
+    controller_ = controller.Pass();
+  }
+
+ private:
+  void StartControllerThread() {
+    base::Thread::Options controller_thread_options;
+    controller_thread_options.message_loop_type =
+        base::MessageLoop::TYPE_CUSTOM;
+    controller_thread_options.message_pump_factory =
+        base::Bind(&common::MessagePumpMojo::Create);
+    CHECK(controller_thread_.StartWithOptions(controller_thread_options));
+    controller_runner_ = controller_thread_.task_runner().get();
+    CHECK(controller_runner_.get());
+  }
+
+  void ShutdownOnControllerThread() { controller_.reset(); }
+
+  base::Thread controller_thread_;
+  scoped_refptr<base::SingleThreadTaskRunner> controller_runner_;
+
+  // Accessed only on the controller thread.
+  scoped_ptr<ChildControllerImpl> controller_;
+
+  DISALLOW_COPY_AND_ASSIGN(RunnerConnectionImpl);
+};
+
+class ChildControllerImpl : public ChildController {
+ public:
+  ~ChildControllerImpl() override {
+    DCHECK(thread_checker_.CalledOnValidThread());
+
+    // TODO(vtl): Pass in the result from |MainMain()|.
+    on_app_complete_.Run(MOJO_RESULT_UNIMPLEMENTED);
+  }
+
+  // To be executed on the controller thread. Creates the |ChildController|,
+  // etc.
+  static void Create(RunnerConnectionImpl* connection,
+                     const GotApplicationRequestCallback& callback,
+                     embedder::ScopedPlatformHandle platform_channel,
+                     const Blocker::Unblocker& unblocker) {
+    DCHECK(connection);
+    DCHECK(platform_channel.is_valid());
+
+    DCHECK(!connection->controller());
+
+    scoped_ptr<ChildControllerImpl> impl(
+        new ChildControllerImpl(connection, callback, unblocker));
+
+    ScopedMessagePipeHandle host_message_pipe(embedder::CreateChannel(
+        platform_channel.Pass(),
+        base::Bind(&ChildControllerImpl::DidCreateChannel,
+                   base::Unretained(impl.get())),
+        base::ThreadTaskRunnerHandle::Get()));
+
+    impl->Bind(host_message_pipe.Pass());
+
+    connection->set_controller(impl.Pass());
+  }
+
+  void Bind(ScopedMessagePipeHandle handle) { binding_.Bind(handle.Pass()); }
+
+  void OnConnectionError() {
+    // A connection error means the connection to the shell is lost. This is not
+    // recoverable.
+    LOG(ERROR) << "Connection error to the shell.";
+    _exit(1);
+  }
+
+  // |ChildController| methods:
+  void StartApp(InterfaceRequest<Application> application_request,
+                const StartAppCallback& on_app_complete) override {
+    DCHECK(thread_checker_.CalledOnValidThread());
+
+    on_app_complete_ = on_app_complete;
+    unblocker_.Unblock(
+        base::Bind(&ChildControllerImpl::ReturnApplicationRequestOnMainThread,
+                   callback_, base::Passed(&application_request)));
+  }
+
+  void ExitNow(int32_t exit_code) override {
+    DVLOG(2) << "ChildControllerImpl::ExitNow(" << exit_code << ")";
+    _exit(exit_code);
+  }
+
+ private:
+  ChildControllerImpl(RunnerConnectionImpl* connection,
+                      const GotApplicationRequestCallback& callback,
+                      const Blocker::Unblocker& unblocker)
+      : connection_(connection),
+        callback_(callback),
+        unblocker_(unblocker),
+        channel_info_(nullptr),
+        binding_(this) {
+    binding_.set_connection_error_handler([this]() { OnConnectionError(); });
+  }
+
+  // Callback for |embedder::CreateChannel()|.
+  void DidCreateChannel(embedder::ChannelInfo* channel_info) {
+    DVLOG(2) << "ChildControllerImpl::DidCreateChannel()";
+    DCHECK(thread_checker_.CalledOnValidThread());
+    channel_info_ = channel_info;
+  }
+
+  static void ReturnApplicationRequestOnMainThread(
+      const GotApplicationRequestCallback& callback,
+      InterfaceRequest<Application> application_request) {
+    callback.Run(application_request.Pass());
+  }
+
+  base::ThreadChecker thread_checker_;
+  RunnerConnectionImpl* const connection_;
+  GotApplicationRequestCallback callback_;
+  Blocker::Unblocker unblocker_;
+  StartAppCallback on_app_complete_;
+
+  embedder::ChannelInfo* channel_info_;
+  Binding<ChildController> binding_;
+
+  DISALLOW_COPY_AND_ASSIGN(ChildControllerImpl);
+};
+
+bool RunnerConnectionImpl::WaitForApplicationRequest(
+    InterfaceRequest<Application>* request) {
+  embedder::ScopedPlatformHandle platform_channel =
+      embedder::PlatformChannelPair::PassClientHandleFromParentProcess(
+          *base::CommandLine::ForCurrentProcess());
+  if (!platform_channel.is_valid())
+    return false;
+
+  Blocker blocker;
+  controller_runner_->PostTask(
+      FROM_HERE,
+      base::Bind(
+          &ChildControllerImpl::Create, base::Unretained(this),
+          base::Bind(&OnGotApplicationRequest, base::Unretained(request)),
+          base::Passed(&platform_channel), blocker.GetUnblocker()));
+  blocker.Block();
+
+  return true;
+}
+
+}  // namespace
+
+RunnerConnection::~RunnerConnection() {}
+
+// static
+RunnerConnection* RunnerConnection::ConnectToRunner(
+    InterfaceRequest<Application>* request) {
+  RunnerConnectionImpl* connection = new RunnerConnectionImpl;
+  if (!connection->WaitForApplicationRequest(request)) {
+    delete connection;
+    return nullptr;
+  }
+  return connection;
+}
+
+RunnerConnection::RunnerConnection() {}
+
+}  // namespace runner
+}  // namespace mojo

diff --git a/mojo/runner/child/runner_connection.h b/mojo/runner/child/runner_connection.h
new file mode 100644
index 0000000..8ca8778
--- /dev/null
+++ b/mojo/runner/child/runner_connection.h

@@ -0,0 +1,39 @@
+// Copyright 2015 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef MOJO_RUNNER_CHILD_RUNNER_CONNECTION_H_
+#define MOJO_RUNNER_CHILD_RUNNER_CONNECTION_H_
+
+#include "base/macros.h"
+#include "mojo/application/public/interfaces/application.mojom.h"
+
+namespace mojo {
+namespace runner {
+
+// Encapsulates a connection to a runner process. The connection object starts a
+// background controller thread that is used to receive control messages from
+// the runner. When this object is destroyed the thread is joined.
+class RunnerConnection {
+ public:
+  virtual ~RunnerConnection();
+
+  // Establish a connection to the runner, blocking the calling thread until
+  // it is established. The Application request from the runner is returned via
+  // |request|.
+  // If a connection to the runner cannot be established, |request| will not be
+  // modified and this function will return null.
+  static RunnerConnection* ConnectToRunner(
+      InterfaceRequest<Application>* request);
+
+ protected:
+  RunnerConnection();
+
+ private:
+  DISALLOW_COPY_AND_ASSIGN(RunnerConnection);
+};
+
+}  // namespace runner
+}  // namespace mojo
+
+#endif  // MOJO_RUNNER_CHILD_RUNNER_CONNECTION_H_

diff --git a/mojo/runner/child/test_native_service.mojom b/mojo/runner/child/test_native_service.mojom
new file mode 100644
index 0000000..8fbc3c1
--- /dev/null
+++ b/mojo/runner/child/test_native_service.mojom

@@ -0,0 +1,9 @@
+// Copyright 2015 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+module mojo.runner.test;
+
+interface TestNativeService {
+  Invert(bool from_driver) => (bool from_target);
+};

diff --git a/mojo/runner/child_process.cc b/mojo/runner/child_process.cc
index 4fb6047..33ac3cd 100644
--- a/mojo/runner/child_process.cc
+++ b/mojo/runner/child_process.cc

@@ -23,7 +23,7 @@
 #include "mojo/message_pump/message_pump_mojo.h"
 #include "mojo/public/cpp/bindings/binding.h"
 #include "mojo/public/cpp/system/core.h"
-#include "mojo/runner/child_process.mojom.h"
+#include "mojo/runner/child/child_controller.mojom.h"
 #include "mojo/runner/native_application_support.h"
 #include "mojo/runner/switches.h"
 #include "third_party/mojo/src/mojo/edk/embedder/embedder.h"

diff --git a/mojo/runner/child_process_host.cc b/mojo/runner/child_process_host.cc
index d6f0c3d..b485671f 100644
--- a/mojo/runner/child_process_host.cc
+++ b/mojo/runner/child_process_host.cc

@@ -103,9 +103,18 @@
 void ChildProcessHost::DoLaunch() {
   const base::CommandLine* parent_command_line =
       base::CommandLine::ForCurrentProcess();
-  base::CommandLine child_command_line(parent_command_line->GetProgram());
+  base::FilePath target_path = parent_command_line->GetProgram();
+  // |app_path_| can be empty in tests.
+  if (!app_path_.MatchesExtension(FILE_PATH_LITERAL(".mojo")) &&
+      !app_path_.empty()) {
+    target_path = app_path_;
+  }
+
+  base::CommandLine child_command_line(target_path);
   child_command_line.AppendArguments(*parent_command_line, false);
-  child_command_line.AppendSwitchPath(switches::kChildProcess, app_path_);
+
+  if (target_path != app_path_)
+    child_command_line.AppendSwitchPath(switches::kChildProcess, app_path_);
 
   if (start_sandboxed_)
     child_command_line.AppendSwitch(switches::kEnableSandbox);

diff --git a/mojo/runner/child_process_host.h b/mojo/runner/child_process_host.h
index 63344730..346f0d5 100644
--- a/mojo/runner/child_process_host.h
+++ b/mojo/runner/child_process_host.h

@@ -10,7 +10,7 @@
 #include "base/memory/weak_ptr.h"
 #include "base/process/process.h"
 #include "base/synchronization/waitable_event.h"
-#include "mojo/runner/child_process.mojom.h"
+#include "mojo/runner/child/child_controller.mojom.h"
 #include "mojo/runner/child_process_host.h"
 #include "third_party/mojo/src/mojo/edk/embedder/channel_info_forward.h"
 #include "third_party/mojo/src/mojo/edk/embedder/platform_channel_pair.h"

diff --git a/mojo/runner/in_process_native_runner.cc b/mojo/runner/in_process_native_runner.cc
index ff4f0ba..b5a8b27c 100644
--- a/mojo/runner/in_process_native_runner.cc
+++ b/mojo/runner/in_process_native_runner.cc

@@ -10,6 +10,7 @@
 #include "base/thread_task_runner_handle.h"
 #include "base/threading/platform_thread.h"
 #include "mojo/runner/native_application_support.h"
+#include "mojo/runner/out_of_process_native_runner.h"
 
 namespace mojo {
 namespace runner {
@@ -61,7 +62,11 @@
   app_completed_callback_runner_.Reset();
 }
 
-scoped_ptr<shell::NativeRunner> InProcessNativeRunnerFactory::Create() {
+scoped_ptr<shell::NativeRunner> InProcessNativeRunnerFactory::Create(
+    const base::FilePath& app_path) {
+  // Non-Mojo apps are always run in a new process.
+  if (!app_path.MatchesExtension(FILE_PATH_LITERAL(".mojo")))
+    return make_scoped_ptr(new OutOfProcessNativeRunner(context_));
   return make_scoped_ptr(new InProcessNativeRunner(context_));
 }
 

diff --git a/mojo/runner/in_process_native_runner.h b/mojo/runner/in_process_native_runner.h
index c46a147..21674258 100644
--- a/mojo/runner/in_process_native_runner.h
+++ b/mojo/runner/in_process_native_runner.h

@@ -52,7 +52,8 @@
   explicit InProcessNativeRunnerFactory(Context* context) : context_(context) {}
   ~InProcessNativeRunnerFactory() override {}
 
-  scoped_ptr<shell::NativeRunner> Create() override;
+  scoped_ptr<shell::NativeRunner> Create(
+      const base::FilePath& app_path) override;
 
  private:
   Context* const context_;

diff --git a/mojo/runner/native_runner_unittest.cc b/mojo/runner/native_runner_unittest.cc
index b2516b0..cadf9df 100644
--- a/mojo/runner/native_runner_unittest.cc
+++ b/mojo/runner/native_runner_unittest.cc

@@ -50,7 +50,7 @@
  public:
   explicit TestNativeRunnerFactory(TestState* state) : state_(state) {}
   ~TestNativeRunnerFactory() override {}
-  scoped_ptr<shell::NativeRunner> Create() override {
+  scoped_ptr<shell::NativeRunner> Create(const base::FilePath& path) override {
     return scoped_ptr<shell::NativeRunner>(new TestNativeRunner(state_));
   }
 

diff --git a/mojo/runner/out_of_process_native_runner.cc b/mojo/runner/out_of_process_native_runner.cc
index 3026625b..a3a9bc5 100644
--- a/mojo/runner/out_of_process_native_runner.cc
+++ b/mojo/runner/out_of_process_native_runner.cc

@@ -8,7 +8,6 @@
 #include "base/callback_helpers.h"
 #include "base/files/file_util.h"
 #include "base/logging.h"
-#include "mojo/runner/child_process.mojom.h"
 #include "mojo/runner/child_process_host.h"
 #include "mojo/runner/in_process_native_runner.h"
 
@@ -56,7 +55,8 @@
   app_completed_callback.Run();
 }
 
-scoped_ptr<shell::NativeRunner> OutOfProcessNativeRunnerFactory::Create() {
+scoped_ptr<shell::NativeRunner> OutOfProcessNativeRunnerFactory::Create(
+    const base::FilePath& app_path) {
   return make_scoped_ptr(new OutOfProcessNativeRunner(context_));
 }
 

diff --git a/mojo/runner/out_of_process_native_runner.h b/mojo/runner/out_of_process_native_runner.h
index 5cd1b5e..4021c4f 100644
--- a/mojo/runner/out_of_process_native_runner.h
+++ b/mojo/runner/out_of_process_native_runner.h

@@ -50,7 +50,8 @@
       : context_(context) {}
   ~OutOfProcessNativeRunnerFactory() override {}
 
-  scoped_ptr<shell::NativeRunner> Create() override;
+  scoped_ptr<shell::NativeRunner> Create(
+      const base::FilePath& app_path) override;
 
  private:
   Context* const context_;

diff --git a/mojo/shell/application_manager.cc b/mojo/shell/application_manager.cc
index 8f685e7..6c6064d 100644
--- a/mojo/shell/application_manager.cc
+++ b/mojo/shell/application_manager.cc

@@ -220,7 +220,7 @@
 
   TRACE_EVENT1("mojo_shell", "ApplicationManager::RunNativeApplication", "path",
                path.AsUTF8Unsafe());
-  NativeRunner* runner = native_runner_factory_->Create().release();
+  NativeRunner* runner = native_runner_factory_->Create(path).release();
   native_runners_.push_back(runner);
   runner->Start(path, start_sandboxed, application_request.Pass(),
                 base::Bind(&ApplicationManager::CleanupRunner,

diff --git a/mojo/shell/native_runner.h b/mojo/shell/native_runner.h
index dd48cb3..d4d5b8b 100644
--- a/mojo/shell/native_runner.h
+++ b/mojo/shell/native_runner.h

@@ -43,7 +43,7 @@
 class NativeRunnerFactory {
  public:
   virtual ~NativeRunnerFactory() {}
-  virtual scoped_ptr<NativeRunner> Create() = 0;
+  virtual scoped_ptr<NativeRunner> Create(const base::FilePath& app_path) = 0;
 };
 
 }  // namespace shell

diff --git a/testing/buildbot/chromium.win.json b/testing/buildbot/chromium.win.json
index 7bb80b6..b44eaff6 100644
--- a/testing/buildbot/chromium.win.json
+++ b/testing/buildbot/chromium.win.json

@@ -478,6 +478,12 @@
         "swarming": {
           "can_use_on_swarming_builders": true
         },
+        "test": "gn_unittests"
+      },
+      {
+        "swarming": {
+          "can_use_on_swarming_builders": true
+        },
         "test": "google_apis_unittests"
       },
       {
@@ -916,6 +922,12 @@
         "swarming": {
           "can_use_on_swarming_builders": true
         },
+        "test": "gn_unittests"
+      },
+      {
+        "swarming": {
+          "can_use_on_swarming_builders": true
+        },
         "test": "google_apis_unittests"
       },
       {
@@ -1273,6 +1285,12 @@
         "swarming": {
           "can_use_on_swarming_builders": true
         },
+        "test": "gn_unittests"
+      },
+      {
+        "swarming": {
+          "can_use_on_swarming_builders": true
+        },
         "test": "gpu_unittests"
       },
       {

diff --git a/third_party/WebKit/LayoutTests/fast/dom/custom/svg-use-shadow-tree.html b/third_party/WebKit/LayoutTests/fast/dom/custom/svg-use-shadow-tree.html
new file mode 100644
index 0000000..9222cbd
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/fast/dom/custom/svg-use-shadow-tree.html

@@ -0,0 +1,101 @@
+<!DOCTYPE html>
+<script src="../../../resources/testharness.js"></script>
+<script src="../../../resources/testharnessreport.js"></script>
+
+<template id="template">
+<svg>
+    <defs>
+        <g id="used-group">
+          <rect
+            id="rect"
+            is="x-rect"
+            x="10" y="10"
+            width="100" height="100"
+            fill="red"/>
+        </g>
+    </defs>
+    <use xlink:href="#used-group"/>
+</svg>
+</template>
+
+<div id="container"></div>
+
+<script>
+"use strict";
+
+var instances = [];
+
+function createPrototype(superClass) {
+    class ElementType extends superClass {
+        get ownerScope() {
+            var scope = this.parentNode;
+            while (scope && scope.parentNode)
+                scope = scope.parentNode;
+            return scope;
+        }
+        createdCallback() {
+            this.instanceId = instances.length;
+            instances[this.instanceId] = this;
+            assert_false(this.ownerScope instanceof ShadowRoot,
+                "Should not call createdCallback in UA ShadowRoot.");
+        }
+        attachedCallback() {
+            assert_false(this.ownerScope instanceof ShadowRoot,
+                "Should not call attachedCallback in UA ShadowRoot.");
+            assert_equals(instances[this.instanceId], this);
+        }
+        detachedCallback() {
+            assert_false(this.ownerScope instanceof ShadowRoot,
+                "Should not call detachedCallback in UA ShadowRoot.");
+            assert_equals(instances[this.instanceId], this);
+        }
+        attributeChangedCallback() {
+            assert_unreached("attributeChangedCallback should never be called.");
+        }
+    };
+    return ElementType.prototype;
+}
+
+// <rect is=x-rect>
+var XRectElement = document.registerElement('x-rect', {
+    extends: 'rect',
+    prototype: createPrototype(SVGRectElement),
+});
+
+// <x-test>
+var XTestElement = document.registerElement('x-test', {
+    prototype: createPrototype(HTMLElement),
+});
+
+test(function () {
+    var template = document.getElementById("template");
+    var svg = document.importNode(template.content, true).firstElementChild;
+    var usedGroup = svg.getElementById("used-group");
+    document.body.appendChild(svg);
+
+    // Force a recreation of the use trees.
+    document.body.offsetTop;
+    assert_array_equals([usedGroup.firstElementChild], instances);
+
+    var elements = [
+        usedGroup.firstElementChild,
+        new XRectElement(),
+        new XTestElement(),
+        new XRectElement(),
+    ];
+
+    // Add another <rect is=x-rect>, and a child <x-test> that also contains one.
+    usedGroup.appendChild(elements[1]);
+    var test = usedGroup.appendChild(elements[2]);
+    test.appendChild(elements[3]);
+
+    // Force a recreation of the use trees.
+    document.body.offsetTop;
+    assert_array_equals(elements, instances);
+
+    for (var i = 0; i < instances.length; ++i) {
+        assert_true(instances[i].ownerScope instanceof Document,
+            "No instances should be inside a ShadowRoot.");
+    }
+}, "SVG <use> shadow trees should not be exposed through custom elements.");
+</script>

diff --git a/third_party/WebKit/LayoutTests/fast/mediastream/RTCPeerConnection-generateCertificate-expected.txt b/third_party/WebKit/LayoutTests/fast/mediastream/RTCPeerConnection-generateCertificate-expected.txt
index 753b947..62cf0de7 100644
--- a/third_party/WebKit/LayoutTests/fast/mediastream/RTCPeerConnection-generateCertificate-expected.txt
+++ b/third_party/WebKit/LayoutTests/fast/mediastream/RTCPeerConnection-generateCertificate-expected.txt

@@ -3,7 +3,7 @@
 On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
 
 
-PASS generateCertificate({ name: "RSASSA-PKCS1-v1_5", modulusLength: 2048, publicExponent: 65537 })
+PASS generateCertificate({ name: "RSASSA-PKCS1-v1_5", modulusLength: 2048, publicExponent: new Uint8Array([1, 0, 1]), hash: "SHA-256" })
 PASS certRSA is non-null.
 PASS generateCertificate({ name: "ECDSA", namedCurve: "P-256" })
 PASS certECDSA is non-null.

diff --git a/third_party/WebKit/LayoutTests/fast/mediastream/RTCPeerConnection-generateCertificate.html b/third_party/WebKit/LayoutTests/fast/mediastream/RTCPeerConnection-generateCertificate.html
index 108fc0a..dbef9c9a 100644
--- a/third_party/WebKit/LayoutTests/fast/mediastream/RTCPeerConnection-generateCertificate.html
+++ b/third_party/WebKit/LayoutTests/fast/mediastream/RTCPeerConnection-generateCertificate.html

@@ -16,8 +16,8 @@
 // 1: RSA-2048 using public exponent = 65537.
 function generate1RSA()
 {
-    generateCallString  =  'generateCertificate({ name: "RSASSA-PKCS1-v1_5", modulusLength: 2048, publicExponent: 65537 })';
-    webkitRTCPeerConnection.generateCertificate({ name: "RSASSA-PKCS1-v1_5", modulusLength: 2048, publicExponent: 65537 })
+    generateCallString  =  'generateCertificate({ name: "RSASSA-PKCS1-v1_5", modulusLength: 2048, publicExponent: new Uint8Array([1, 0, 1]), hash: "SHA-256" })';
+    webkitRTCPeerConnection.generateCertificate({ name: "RSASSA-PKCS1-v1_5", modulusLength: 2048, publicExponent: new Uint8Array([1, 0, 1]), hash: "SHA-256" })
         .then(generate1RSASuccessful, generate1RSAFailed);
 }
 function generate1RSASuccessful(certificate)

diff --git a/third_party/WebKit/LayoutTests/fast/mediastream/RTCPeerConnection.html b/third_party/WebKit/LayoutTests/fast/mediastream/RTCPeerConnection.html
index 46be96dd9..0026c14 100644
--- a/third_party/WebKit/LayoutTests/fast/mediastream/RTCPeerConnection.html
+++ b/third_party/WebKit/LayoutTests/fast/mediastream/RTCPeerConnection.html

@@ -67,9 +67,10 @@
 // Global certificate variables so that the "should..." methods can evaluate them.
 var certRSA = null;
 var certECDSA = null;
+
 function testCertificates1RSA()
 {
-    webkitRTCPeerConnection.generateCertificate({ name: "RSASSA-PKCS1-v1_5", modulusLength: 2048, publicExponent: 65537 })
+    webkitRTCPeerConnection.generateCertificate({ name: "RSASSA-PKCS1-v1_5", modulusLength: 2048, publicExponent: new Uint8Array([1, 0, 1]), hash: "SHA-256" })
         .then(function(certificate) {
                   certRSA = certificate;
                   shouldNotThrow('new webkitRTCPeerConnection({iceServers:[], certificates:[certRSA]}, null);');

diff --git a/third_party/WebKit/LayoutTests/http/tests/css/resources/cors-ahem.php b/third_party/WebKit/LayoutTests/http/tests/css/resources/cors-ahem.php
index a18850e..327fc321 100644
--- a/third_party/WebKit/LayoutTests/http/tests/css/resources/cors-ahem.php
+++ b/third_party/WebKit/LayoutTests/http/tests/css/resources/cors-ahem.php

@@ -3,7 +3,7 @@
 if (isset($_SERVER["HTTP_IF_MODIFIED_SINCE"])) {
     header("HTTP/1.1 304 Not Modified");
 } else {
-    $font = "../../../../resources/Ahem.ttf";
+    $font = "../../resources/Ahem.ttf";
 
     header("Cache-Control: public, max-age=86400");
     header('Last-Modified: ' . gmdate("D, d M Y H:i:s", filemtime($font)) . " GMT");

diff --git a/third_party/WebKit/LayoutTests/http/tests/css/resources/referrer-check.php b/third_party/WebKit/LayoutTests/http/tests/css/resources/referrer-check.php
index 2e8b00b..69483e0 100644
--- a/third_party/WebKit/LayoutTests/http/tests/css/resources/referrer-check.php
+++ b/third_party/WebKit/LayoutTests/http/tests/css/resources/referrer-check.php

@@ -18,7 +18,7 @@
 }
 
 function putFont() {
-    $font = "../../../../resources/Ahem.ttf";
+    $font = "../../resources/Ahem.ttf";
     header("Content-Type: font/truetype");
     header("Content-Length: " . filesize($font));
     header("Access-Control-Allow-Origin: *");
@@ -49,4 +49,4 @@
     header("HTTP/1.1 500 Internal Server Error");
 }
 
-?>
\ No newline at end of file
+?>

diff --git a/third_party/WebKit/LayoutTests/http/tests/fetch/script-tests/fetch.js b/third_party/WebKit/LayoutTests/http/tests/fetch/script-tests/fetch.js
index 9def05e..eb97820 100644
--- a/third_party/WebKit/LayoutTests/http/tests/fetch/script-tests/fetch.js
+++ b/third_party/WebKit/LayoutTests/http/tests/fetch/script-tests/fetch.js

@@ -58,6 +58,31 @@
         function() {});
   }, 'fetch invalid data: URL');
 
+// Tests for blob: scheme.
+promise_test(function(t) {
+    var url = URL.createObjectURL(new Blob(['fox'], {type: 'text/fox'}));
+    return fetch(url)
+      .then(function(response) {
+          assert_equals(response.status, 200);
+          assert_equals(response.statusText, 'OK');
+          assert_equals(response.headers.get('Content-Type'), 'text/fox');
+          assert_equals(response.headers.get('Content-Length'), '3');
+          assert_equals(size(response.headers), 2);
+          return response.text();
+        })
+      .then(function(text) {
+          assert_equals(text, 'fox');
+        });
+  }, 'fetch blob: URL');
+
+promise_test(function(t) {
+    var url = URL.createObjectURL(new Blob(['fox'], {type: 'text/fox'}));
+    return fetch(url + 'invalid')
+      .then(
+        t.unreached_func('fetching non-existent blob: URL must fail'),
+        function() {});
+  }, 'fetch non-existent blob: URL');
+
 // https://fetch.spec.whatwg.org/#concept-basic-fetch
 // The last statement:
 // Otherwise

diff --git a/third_party/WebKit/LayoutTests/http/tests/fetch/script-tests/thorough/scheme-blob.js b/third_party/WebKit/LayoutTests/http/tests/fetch/script-tests/thorough/scheme-blob.js
new file mode 100644
index 0000000..a7965145
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/http/tests/fetch/script-tests/thorough/scheme-blob.js

@@ -0,0 +1,32 @@
+if (self.importScripts) {
+  importScripts('/fetch/resources/fetch-test-helpers.js');
+  importScripts('/fetch/resources/thorough-util.js');
+}
+
+var url = URL.createObjectURL(new Blob(["report({jsonpResult: 'success'});"], {type: 'application/json'}));
+
+var TEST_TARGETS = [
+// Same-origin blob: requests.
+  [BASE_URL + 'url=' + encodeURIComponent(url) + '&mode=same-origin&method=GET',
+   [fetchResolved, hasContentLength, noServerHeader, hasBody, typeBasic],
+   [checkJsonpSuccess]],
+  [BASE_URL + 'url=' + encodeURIComponent(url) + '&mode=cors&method=GET',
+   [fetchResolved, hasContentLength, noServerHeader, hasBody, typeBasic],
+   [checkJsonpSuccess]],
+  [BASE_URL + 'url=' + encodeURIComponent(url) + '&mode=no-cors&method=GET',
+   [fetchResolved, hasContentLength, noServerHeader, hasBody, typeBasic],
+   [checkJsonpSuccess]],
+
+// blob: requests with non-GET methods.
+  [BASE_URL + 'url=' + encodeURIComponent(url) +
+   '&mode=same-origin&method=POST',
+   [fetchRejected]],
+  [BASE_URL + 'url=' + encodeURIComponent(url) +
+   '&mode=same-origin&method=HEAD',
+   [fetchRejected]],
+];
+
+if (self.importScripts) {
+  executeTests(TEST_TARGETS);
+  done();
+}

diff --git a/third_party/WebKit/LayoutTests/http/tests/fetch/serviceworker-proxied/thorough/scheme-blob-base-https-other-https.html b/third_party/WebKit/LayoutTests/http/tests/fetch/serviceworker-proxied/thorough/scheme-blob-base-https-other-https.html
new file mode 100644
index 0000000..395eb9f2
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/http/tests/fetch/serviceworker-proxied/thorough/scheme-blob-base-https-other-https.html

@@ -0,0 +1,35 @@
+<!doctype html>
+<head>
+<meta name="timeout" content="long"></meta>
+<script src = "/resources/testharness.js"></script>
+<script src = "/resources/testharnessreport.js"></script>
+<script src = "/resources/get-host-info.js?pipe=sub"></script>
+<script src = "/serviceworker/resources/test-helpers.js"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
+<script src = "/fetch/resources/fetch-test-helpers.js"></script>
+<script src = "/fetch/resources/thorough-util.js"></script>
+<script>
+function onlyOnServiceWorkerProxiedTest(checkFuncs) {
+  return checkFuncs;
+}
+</script>
+<script src = "/fetch/script-tests/thorough/scheme-blob.js?-base-https-other-https"></script>
+</head>
+<body>
+<script>
+var host_info = get_host_info();
+function start(t) {
+  executeServiceWorkerProxiedTests(TEST_TARGETS);
+  t.done();
+}
+function init(test) {
+  return login(test, host_info["HTTP_ORIGIN"], host_info["HTTP_REMOTE_ORIGIN"])
+    .then(function() {
+        return login(test, host_info["HTTPS_ORIGIN"],
+          host_info["HTTPS_REMOTE_ORIGIN"]);
+      });
+}
+
+</script>
+<script src = "/fetch/resources/init.js"></script>
+</body>

diff --git a/third_party/WebKit/LayoutTests/http/tests/fetch/serviceworker-proxied/thorough/scheme-blob-other-https.html b/third_party/WebKit/LayoutTests/http/tests/fetch/serviceworker-proxied/thorough/scheme-blob-other-https.html
new file mode 100644
index 0000000..cd51089
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/http/tests/fetch/serviceworker-proxied/thorough/scheme-blob-other-https.html

@@ -0,0 +1,35 @@
+<!doctype html>
+<head>
+<meta name="timeout" content="long"></meta>
+<script src = "/resources/testharness.js"></script>
+<script src = "/resources/testharnessreport.js"></script>
+<script src = "/resources/get-host-info.js?pipe=sub"></script>
+<script src = "/serviceworker/resources/test-helpers.js"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
+<script src = "/fetch/resources/fetch-test-helpers.js"></script>
+<script src = "/fetch/resources/thorough-util.js"></script>
+<script>
+function onlyOnServiceWorkerProxiedTest(checkFuncs) {
+  return checkFuncs;
+}
+</script>
+<script src = "/fetch/script-tests/thorough/scheme-blob.js?-other-https"></script>
+</head>
+<body>
+<script>
+var host_info = get_host_info();
+function start(t) {
+  executeServiceWorkerProxiedTests(TEST_TARGETS);
+  t.done();
+}
+function init(test) {
+  return login(test, host_info["HTTP_ORIGIN"], host_info["HTTP_REMOTE_ORIGIN"])
+    .then(function() {
+        return login(test, host_info["HTTPS_ORIGIN"],
+          host_info["HTTPS_REMOTE_ORIGIN"]);
+      });
+}
+
+</script>
+<script src = "/fetch/resources/init.js"></script>
+</body>

diff --git a/third_party/WebKit/LayoutTests/http/tests/fetch/serviceworker-proxied/thorough/scheme-blob.html b/third_party/WebKit/LayoutTests/http/tests/fetch/serviceworker-proxied/thorough/scheme-blob.html
new file mode 100644
index 0000000..e03899a
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/http/tests/fetch/serviceworker-proxied/thorough/scheme-blob.html

@@ -0,0 +1,35 @@
+<!doctype html>
+<head>
+<meta name="timeout" content="long"></meta>
+<script src = "/resources/testharness.js"></script>
+<script src = "/resources/testharnessreport.js"></script>
+<script src = "/resources/get-host-info.js?pipe=sub"></script>
+<script src = "/serviceworker/resources/test-helpers.js"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
+<script src = "/fetch/resources/fetch-test-helpers.js"></script>
+<script src = "/fetch/resources/thorough-util.js"></script>
+<script>
+function onlyOnServiceWorkerProxiedTest(checkFuncs) {
+  return checkFuncs;
+}
+</script>
+<script src = "/fetch/script-tests/thorough/scheme-blob.js?"></script>
+</head>
+<body>
+<script>
+var host_info = get_host_info();
+function start(t) {
+  executeServiceWorkerProxiedTests(TEST_TARGETS);
+  t.done();
+}
+function init(test) {
+  return login(test, host_info["HTTP_ORIGIN"], host_info["HTTP_REMOTE_ORIGIN"])
+    .then(function() {
+        return login(test, host_info["HTTPS_ORIGIN"],
+          host_info["HTTPS_REMOTE_ORIGIN"]);
+      });
+}
+
+</script>
+<script src = "/fetch/resources/init.js"></script>
+</body>

diff --git a/third_party/WebKit/LayoutTests/http/tests/fetch/serviceworker/thorough/scheme-blob-base-https-other-https.html b/third_party/WebKit/LayoutTests/http/tests/fetch/serviceworker/thorough/scheme-blob-base-https-other-https.html
new file mode 100644
index 0000000..780f61b
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/http/tests/fetch/serviceworker/thorough/scheme-blob-base-https-other-https.html

@@ -0,0 +1,26 @@
+<!doctype html>
+<head>
+<meta name="timeout" content="long"></meta>
+<script src = "/resources/testharness.js"></script>
+<script src = "/resources/testharnessreport.js"></script>
+<script src = "/resources/get-host-info.js?pipe=sub"></script>
+<script src = "/serviceworker/resources/test-helpers.js"></script>
+</head>
+<body>
+<script>
+var host_info = get_host_info();
+function start(t) {
+  service_worker_test(
+    '/fetch/script-tests/thorough/scheme-blob.js?-base-https-other-https',
+    'scheme-blob');
+  t.done();
+}
+function init(test) {
+  return login(test, host_info['HTTP_ORIGIN'], host_info['HTTP_REMOTE_ORIGIN'])
+    .then(function() {
+      return login(test, host_info['HTTPS_ORIGIN'],
+        host_info['HTTPS_REMOTE_ORIGIN']); });
+}
+</script>
+<script src = "/fetch/resources/init.js"></script>
+</body>

diff --git a/third_party/WebKit/LayoutTests/http/tests/fetch/serviceworker/thorough/scheme-blob-other-https.html b/third_party/WebKit/LayoutTests/http/tests/fetch/serviceworker/thorough/scheme-blob-other-https.html
new file mode 100644
index 0000000..c27d4e4
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/http/tests/fetch/serviceworker/thorough/scheme-blob-other-https.html

@@ -0,0 +1,26 @@
+<!doctype html>
+<head>
+<meta name="timeout" content="long"></meta>
+<script src = "/resources/testharness.js"></script>
+<script src = "/resources/testharnessreport.js"></script>
+<script src = "/resources/get-host-info.js?pipe=sub"></script>
+<script src = "/serviceworker/resources/test-helpers.js"></script>
+</head>
+<body>
+<script>
+var host_info = get_host_info();
+function start(t) {
+  service_worker_test(
+    '/fetch/script-tests/thorough/scheme-blob.js?-other-https',
+    'scheme-blob');
+  t.done();
+}
+function init(test) {
+  return login(test, host_info['HTTP_ORIGIN'], host_info['HTTP_REMOTE_ORIGIN'])
+    .then(function() {
+      return login(test, host_info['HTTPS_ORIGIN'],
+        host_info['HTTPS_REMOTE_ORIGIN']); });
+}
+</script>
+<script src = "/fetch/resources/init.js"></script>
+</body>

diff --git a/third_party/WebKit/LayoutTests/http/tests/fetch/serviceworker/thorough/scheme-blob.html b/third_party/WebKit/LayoutTests/http/tests/fetch/serviceworker/thorough/scheme-blob.html
new file mode 100644
index 0000000..7283d729c
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/http/tests/fetch/serviceworker/thorough/scheme-blob.html

@@ -0,0 +1,26 @@
+<!doctype html>
+<head>
+<meta name="timeout" content="long"></meta>
+<script src = "/resources/testharness.js"></script>
+<script src = "/resources/testharnessreport.js"></script>
+<script src = "/resources/get-host-info.js?pipe=sub"></script>
+<script src = "/serviceworker/resources/test-helpers.js"></script>
+</head>
+<body>
+<script>
+var host_info = get_host_info();
+function start(t) {
+  service_worker_test(
+    '/fetch/script-tests/thorough/scheme-blob.js?',
+    'scheme-blob');
+  t.done();
+}
+function init(test) {
+  return login(test, host_info['HTTP_ORIGIN'], host_info['HTTP_REMOTE_ORIGIN'])
+    .then(function() {
+      return login(test, host_info['HTTPS_ORIGIN'],
+        host_info['HTTPS_REMOTE_ORIGIN']); });
+}
+</script>
+<script src = "/fetch/resources/init.js"></script>
+</body>

diff --git a/third_party/WebKit/LayoutTests/http/tests/fetch/window/thorough/scheme-blob-base-https-other-https.html b/third_party/WebKit/LayoutTests/http/tests/fetch/window/thorough/scheme-blob-base-https-other-https.html
new file mode 100644
index 0000000..a42bd98
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/http/tests/fetch/window/thorough/scheme-blob-base-https-other-https.html

@@ -0,0 +1,30 @@
+<!doctype html>
+<head>
+<meta name="timeout" content="long"></meta>
+<script src = "/resources/testharness.js"></script>
+<script src = "/resources/testharness-helpers.js"></script>
+<script src = "/resources/testharnessreport.js"></script>
+<script src = "/resources/get-host-info.js?pipe=sub"></script>
+<script src = "/serviceworker/resources/test-helpers.js"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
+<script src = "/fetch/resources/fetch-test-helpers.js"></script>
+<script src = "/fetch/resources/thorough-util.js"></script>
+<script src = "/fetch/script-tests/thorough/scheme-blob.js?-base-https-other-https"></script>
+</head>
+<body>
+<script>
+var host_info = get_host_info();
+function start(t) {
+  executeTests(TEST_TARGETS);
+  t.done();
+}
+function init(test) {
+  return login(test, host_info['HTTP_ORIGIN'], host_info['HTTP_REMOTE_ORIGIN'])
+    .then(function() {
+        return login(test, host_info['HTTPS_ORIGIN'],
+                     host_info['HTTPS_REMOTE_ORIGIN']);
+      });
+}
+</script>
+<script src = "/fetch/resources/init.js"></script>
+</body>

diff --git a/third_party/WebKit/LayoutTests/http/tests/fetch/window/thorough/scheme-blob-other-https.html b/third_party/WebKit/LayoutTests/http/tests/fetch/window/thorough/scheme-blob-other-https.html
new file mode 100644
index 0000000..4eb3a0a
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/http/tests/fetch/window/thorough/scheme-blob-other-https.html

@@ -0,0 +1,30 @@
+<!doctype html>
+<head>
+<meta name="timeout" content="long"></meta>
+<script src = "/resources/testharness.js"></script>
+<script src = "/resources/testharness-helpers.js"></script>
+<script src = "/resources/testharnessreport.js"></script>
+<script src = "/resources/get-host-info.js?pipe=sub"></script>
+<script src = "/serviceworker/resources/test-helpers.js"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
+<script src = "/fetch/resources/fetch-test-helpers.js"></script>
+<script src = "/fetch/resources/thorough-util.js"></script>
+<script src = "/fetch/script-tests/thorough/scheme-blob.js?-other-https"></script>
+</head>
+<body>
+<script>
+var host_info = get_host_info();
+function start(t) {
+  executeTests(TEST_TARGETS);
+  t.done();
+}
+function init(test) {
+  return login(test, host_info['HTTP_ORIGIN'], host_info['HTTP_REMOTE_ORIGIN'])
+    .then(function() {
+        return login(test, host_info['HTTPS_ORIGIN'],
+                     host_info['HTTPS_REMOTE_ORIGIN']);
+      });
+}
+</script>
+<script src = "/fetch/resources/init.js"></script>
+</body>

diff --git a/third_party/WebKit/LayoutTests/http/tests/fetch/window/thorough/scheme-blob.html b/third_party/WebKit/LayoutTests/http/tests/fetch/window/thorough/scheme-blob.html
new file mode 100644
index 0000000..574e6d1
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/http/tests/fetch/window/thorough/scheme-blob.html

@@ -0,0 +1,30 @@
+<!doctype html>
+<head>
+<meta name="timeout" content="long"></meta>
+<script src = "/resources/testharness.js"></script>
+<script src = "/resources/testharness-helpers.js"></script>
+<script src = "/resources/testharnessreport.js"></script>
+<script src = "/resources/get-host-info.js?pipe=sub"></script>
+<script src = "/serviceworker/resources/test-helpers.js"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
+<script src = "/fetch/resources/fetch-test-helpers.js"></script>
+<script src = "/fetch/resources/thorough-util.js"></script>
+<script src = "/fetch/script-tests/thorough/scheme-blob.js?"></script>
+</head>
+<body>
+<script>
+var host_info = get_host_info();
+function start(t) {
+  executeTests(TEST_TARGETS);
+  t.done();
+}
+function init(test) {
+  return login(test, host_info['HTTP_ORIGIN'], host_info['HTTP_REMOTE_ORIGIN'])
+    .then(function() {
+        return login(test, host_info['HTTPS_ORIGIN'],
+                     host_info['HTTPS_REMOTE_ORIGIN']);
+      });
+}
+</script>
+<script src = "/fetch/resources/init.js"></script>
+</body>

diff --git a/third_party/WebKit/LayoutTests/http/tests/fetch/workers/thorough/scheme-blob-base-https-other-https.html b/third_party/WebKit/LayoutTests/http/tests/fetch/workers/thorough/scheme-blob-base-https-other-https.html
new file mode 100644
index 0000000..991412b
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/http/tests/fetch/workers/thorough/scheme-blob-base-https-other-https.html

@@ -0,0 +1,26 @@
+<!doctype html>
+<head>
+<meta name="timeout" content="long"></meta>
+<script src = "/resources/testharness.js"></script>
+<script src = "/resources/testharnessreport.js"></script>
+<script src = "/resources/get-host-info.js?pipe=sub"></script>
+<script src = "/serviceworker/resources/test-helpers.js"></script>
+</head>
+<body>
+<script>
+var host_info = get_host_info();
+function start(t) {
+  fetch_tests_from_worker(
+    new Worker('/fetch/script-tests/thorough/scheme-blob.js?-base-https-other-https'));
+  t.done();
+}
+function init(test) {
+  return login(test, host_info['HTTP_ORIGIN'], host_info['HTTP_REMOTE_ORIGIN'])
+    .then(function() {
+        return login(test, host_info['HTTPS_ORIGIN'],
+                     host_info['HTTPS_REMOTE_ORIGIN']);
+      });
+}
+</script>
+<script src = "/fetch/resources/init.js"></script>
+</body>

diff --git a/third_party/WebKit/LayoutTests/http/tests/fetch/workers/thorough/scheme-blob-other-https.html b/third_party/WebKit/LayoutTests/http/tests/fetch/workers/thorough/scheme-blob-other-https.html
new file mode 100644
index 0000000..ef0cee5
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/http/tests/fetch/workers/thorough/scheme-blob-other-https.html

@@ -0,0 +1,26 @@
+<!doctype html>
+<head>
+<meta name="timeout" content="long"></meta>
+<script src = "/resources/testharness.js"></script>
+<script src = "/resources/testharnessreport.js"></script>
+<script src = "/resources/get-host-info.js?pipe=sub"></script>
+<script src = "/serviceworker/resources/test-helpers.js"></script>
+</head>
+<body>
+<script>
+var host_info = get_host_info();
+function start(t) {
+  fetch_tests_from_worker(
+    new Worker('/fetch/script-tests/thorough/scheme-blob.js?-other-https'));
+  t.done();
+}
+function init(test) {
+  return login(test, host_info['HTTP_ORIGIN'], host_info['HTTP_REMOTE_ORIGIN'])
+    .then(function() {
+        return login(test, host_info['HTTPS_ORIGIN'],
+                     host_info['HTTPS_REMOTE_ORIGIN']);
+      });
+}
+</script>
+<script src = "/fetch/resources/init.js"></script>
+</body>

diff --git a/third_party/WebKit/LayoutTests/http/tests/fetch/workers/thorough/scheme-blob.html b/third_party/WebKit/LayoutTests/http/tests/fetch/workers/thorough/scheme-blob.html
new file mode 100644
index 0000000..b2aca56
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/http/tests/fetch/workers/thorough/scheme-blob.html

@@ -0,0 +1,26 @@
+<!doctype html>
+<head>
+<meta name="timeout" content="long"></meta>
+<script src = "/resources/testharness.js"></script>
+<script src = "/resources/testharnessreport.js"></script>
+<script src = "/resources/get-host-info.js?pipe=sub"></script>
+<script src = "/serviceworker/resources/test-helpers.js"></script>
+</head>
+<body>
+<script>
+var host_info = get_host_info();
+function start(t) {
+  fetch_tests_from_worker(
+    new Worker('/fetch/script-tests/thorough/scheme-blob.js?'));
+  t.done();
+}
+function init(test) {
+  return login(test, host_info['HTTP_ORIGIN'], host_info['HTTP_REMOTE_ORIGIN'])
+    .then(function() {
+        return login(test, host_info['HTTPS_ORIGIN'],
+                     host_info['HTTPS_REMOTE_ORIGIN']);
+      });
+}
+</script>
+<script src = "/fetch/resources/init.js"></script>
+</body>

diff --git a/third_party/WebKit/LayoutTests/http/tests/inspector-protocol/css-protocol-test.js b/third_party/WebKit/LayoutTests/http/tests/inspector-protocol/css-protocol-test.js
index 989710e..ab69ab9 100644
--- a/third_party/WebKit/LayoutTests/http/tests/inspector-protocol/css-protocol-test.js
+++ b/third_party/WebKit/LayoutTests/http/tests/inspector-protocol/css-protocol-test.js

@@ -145,6 +145,26 @@
     }
 }
 
+InspectorTest.loadAndDumpCSSAnimationsForNode = function(nodeId, callback)
+{
+    InspectorTest.sendCommandOrDie("CSS.getCSSAnimationsForNode", { "nodeId": nodeId }, cssAnimationsLoaded);
+
+    function cssAnimationsLoaded(result)
+    {
+        InspectorTest.log("Dumping CSS keyframed animations: ");
+        for (var keyframesRule of result.cssKeyframesRules) {
+            InspectorTest.log("@keyframes " + keyframesRule.animationName + " {");
+            for (var keyframe of keyframesRule.keyframes) {
+                indentLog(4, keyframe.keyText + " {");
+                InspectorTest.dumpStyle(keyframe.style, 4);
+                indentLog(4, "}");
+            }
+            InspectorTest.log("}");
+        }
+        callback();
+    }
+}
+
 InspectorTest.loadAndDumpMatchingRules = function(documentNodeId, selector, callback, omitLog)
 {
     InspectorTest.requestNodeId(documentNodeId, selector, nodeIdLoaded);

diff --git a/third_party/WebKit/LayoutTests/http/tests/resources/Ahem.ttf b/third_party/WebKit/LayoutTests/http/tests/resources/Ahem.ttf
index 09c019bc..ac81cb0 100644
--- a/third_party/WebKit/LayoutTests/http/tests/resources/Ahem.ttf
+++ b/third_party/WebKit/LayoutTests/http/tests/resources/Ahem.ttf
Binary files differ

diff --git a/third_party/WebKit/LayoutTests/http/tests/security/resources/cors-font.php b/third_party/WebKit/LayoutTests/http/tests/security/resources/cors-font.php
index d0663bf..21c7050 100644
--- a/third_party/WebKit/LayoutTests/http/tests/security/resources/cors-font.php
+++ b/third_party/WebKit/LayoutTests/http/tests/security/resources/cors-font.php

@@ -1,6 +1,6 @@
 <?php
 
-$font = "../../../../resources/Ahem.ttf";
+$font = "../../resources/Ahem.ttf";
 
 header("Cache-Control: public, max-age=86400");
 header('Last-Modified: ' . gmdate("D, d M Y H:i:s", filemtime($font)) . " GMT");

diff --git a/third_party/WebKit/LayoutTests/http/tests/webfont/resources/cookie-match.php b/third_party/WebKit/LayoutTests/http/tests/webfont/resources/cookie-match.php
index fb9b3153..025a70b9 100644
--- a/third_party/WebKit/LayoutTests/http/tests/webfont/resources/cookie-match.php
+++ b/third_party/WebKit/LayoutTests/http/tests/webfont/resources/cookie-match.php

@@ -6,7 +6,7 @@
 }
 
 if ($_GET["key"] == $_COOKIE["key"]) {
-    $fp = fopen("../../../../resources/Ahem.ttf", "rb");
+    $fp = fopen("../../resources/Ahem.ttf", "rb");
     header("Content-type: application/octet-stream");
     header("HTTP/1.0 200 OK");
     fpassthru($fp);

diff --git a/third_party/WebKit/LayoutTests/http/tests/webfont/slow-ahem-loading.cgi b/third_party/WebKit/LayoutTests/http/tests/webfont/slow-ahem-loading.cgi
index a6f35d1..f62e4c4 100755
--- a/third_party/WebKit/LayoutTests/http/tests/webfont/slow-ahem-loading.cgi
+++ b/third_party/WebKit/LayoutTests/http/tests/webfont/slow-ahem-loading.cgi

@@ -9,6 +9,6 @@
 print "Content-type: application/octet-stream\n";
 print "Cache-control: no-cache, no-store\n\n";
 Time::HiRes::sleep($delay / 1000);
-open FH, "<../../../resources/Ahem.ttf" or die;
+open FH, "<../resources/Ahem.ttf" or die;
 while (<FH>) { print; }
 close FH;

diff --git a/third_party/WebKit/LayoutTests/inspector-protocol/css/css-get-keyframes-expected.txt b/third_party/WebKit/LayoutTests/inspector-protocol/css/css-get-keyframes-expected.txt
new file mode 100644
index 0000000..0b4b280a2
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/inspector-protocol/css/css-get-keyframes-expected.txt

@@ -0,0 +1,29 @@
+Dumping CSS keyframed animations: 
+@keyframes animName {
+    0% {
+        width: 100px;
+    }
+    10% {
+        width: 150px;
+    }
+    100% {
+        width: 200px;
+    }
+}
+@keyframes mediaAnim {
+    0% {
+        opacity: 0;
+    }
+    100% {
+        opacity: 1;
+    }
+}
+@keyframes styleSheetAnim {
+    0% {
+        color: red;
+    }
+    100% {
+        color: blue;
+    }
+}
+

diff --git a/third_party/WebKit/LayoutTests/inspector-protocol/css/css-get-keyframes.html b/third_party/WebKit/LayoutTests/inspector-protocol/css/css-get-keyframes.html
new file mode 100644
index 0000000..c35c5164
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/inspector-protocol/css/css-get-keyframes.html

@@ -0,0 +1,63 @@
+<html>
+<head>
+<script type="text/javascript" src="../../http/tests/inspector-protocol/inspector-protocol-test.js"></script>
+<script type="text/javascript" src="../../http/tests/inspector-protocol/css-protocol-test.js"></script>
+<script type="text/javascript" src="../../http/tests/inspector-protocol/dom-protocol-test.js"></script>
+<link rel="stylesheet" type="text/css" href="resources/keyframes.css"></link>
+<script type="text/javascript">
+function test()
+{
+    InspectorTest.sendCommandOrDie("DOM.enable", {});
+    InspectorTest.sendCommandOrDie("CSS.enable", {}, onCSSEnabled);
+
+    function onCSSEnabled()
+    {
+        InspectorTest.sendCommandOrDie("DOM.getDocument", {}, onDocumentId);
+    }
+
+    function onDocumentId(result)
+    {
+        documentNodeId = result.root.nodeId;
+        InspectorTest.requestNodeId(documentNodeId, "#element", onNodeId);
+    }
+
+    function onNodeId(nodeId)
+    {
+        InspectorTest.loadAndDumpCSSAnimationsForNode(nodeId, InspectorTest.completeTest.bind(InspectorTest));
+    }
+}
+</script>
+<style>
+#element {
+    animation: animName 1s 2s, mediaAnim 2s, doesNotExist 3s, styleSheetAnim 0s;
+}
+
+@keyframes animName {
+    from {
+        width: 100px;
+    }
+    10% {
+        width: 150px;
+    }
+    100% {
+        width: 200px;
+    }
+}
+
+@media (min-width: 1px) {
+    @keyframes mediaAnim {
+        from {
+            opacity: 0;
+        }
+        to {
+            opacity: 1;
+        }
+    }
+}
+
+</style>
+</head>
+<body onload="runTest()">
+    <div id="element"></div>
+</body>
+</html>

diff --git a/third_party/WebKit/LayoutTests/inspector-protocol/css/resources/keyframes.css b/third_party/WebKit/LayoutTests/inspector-protocol/css/resources/keyframes.css
new file mode 100644
index 0000000..e3f5cc5c
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/inspector-protocol/css/resources/keyframes.css

@@ -0,0 +1,8 @@
+@keyframes styleSheetAnim {
+    from {
+        color: red;
+    }
+    to {
+        color: blue;
+    }
+}
\ No newline at end of file

diff --git a/third_party/WebKit/Source/bindings/core/v8/Dictionary.h b/third_party/WebKit/Source/bindings/core/v8/Dictionary.h
index f4253c4..ef3bd0d 100644
--- a/third_party/WebKit/Source/bindings/core/v8/Dictionary.h
+++ b/third_party/WebKit/Source/bindings/core/v8/Dictionary.h

@@ -46,7 +46,7 @@
 // from a V8 object. Instances of this class must not outlive V8's handle scope
 // because they hold a V8 value without putting it on persistent handles.
 class CORE_EXPORT Dictionary final {
-    ALLOW_ONLY_INLINE_ALLOCATION();
+    DISALLOW_NEW_EXCEPT_PLACEMENT_NEW();
 public:
     Dictionary();
     Dictionary(const v8::Local<v8::Value>& options, v8::Isolate*, ExceptionState&);

diff --git a/third_party/WebKit/Source/bindings/core/v8/Nullable.h b/third_party/WebKit/Source/bindings/core/v8/Nullable.h
index 436e26d4..ac4b499 100644
--- a/third_party/WebKit/Source/bindings/core/v8/Nullable.h
+++ b/third_party/WebKit/Source/bindings/core/v8/Nullable.h

@@ -12,7 +12,7 @@
 
 template <typename T>
 class Nullable {
-    DISALLOW_ALLOCATION();
+    DISALLOW_NEW();
 public:
     Nullable()
         : m_value()

diff --git a/third_party/WebKit/Source/bindings/core/v8/ScriptPromise.h b/third_party/WebKit/Source/bindings/core/v8/ScriptPromise.h
index 4349ac2..acb8121 100644
--- a/third_party/WebKit/Source/bindings/core/v8/ScriptPromise.h
+++ b/third_party/WebKit/Source/bindings/core/v8/ScriptPromise.h

@@ -50,7 +50,7 @@
 // memory leaks since it has a reference from C++ to V8.
 //
 class CORE_EXPORT ScriptPromise final {
-    ALLOW_ONLY_INLINE_ALLOCATION();
+    DISALLOW_NEW_EXCEPT_PLACEMENT_NEW();
 public:
     // Constructs an empty promise.
     ScriptPromise();
@@ -142,7 +142,7 @@
     // This is a utility class intended to be used internally.
     // ScriptPromiseResolver is for general purpose.
     class CORE_EXPORT InternalResolver final {
-        DISALLOW_ALLOCATION();
+        DISALLOW_NEW();
     public:
         explicit InternalResolver(ScriptState*);
         v8::Local<v8::Promise> v8Promise() const;

diff --git a/third_party/WebKit/Source/bindings/core/v8/ScriptSourceCode.h b/third_party/WebKit/Source/bindings/core/v8/ScriptSourceCode.h
index e7ae62d..44efea1f 100644
--- a/third_party/WebKit/Source/bindings/core/v8/ScriptSourceCode.h
+++ b/third_party/WebKit/Source/bindings/core/v8/ScriptSourceCode.h

@@ -46,7 +46,7 @@
 class ScriptResource;
 
 class CORE_EXPORT ScriptSourceCode final {
-    ALLOW_ONLY_INLINE_ALLOCATION();
+    DISALLOW_NEW_EXCEPT_PLACEMENT_NEW();
 public:
     ScriptSourceCode();
     // We lose the encoding information from ScriptResource.

diff --git a/third_party/WebKit/Source/bindings/core/v8/ScriptString.h b/third_party/WebKit/Source/bindings/core/v8/ScriptString.h
index 43d2e0d..25d57bb 100644
--- a/third_party/WebKit/Source/bindings/core/v8/ScriptString.h
+++ b/third_party/WebKit/Source/bindings/core/v8/ScriptString.h

@@ -40,7 +40,7 @@
 namespace blink {
 
 class ScriptString final {
-    DISALLOW_ALLOCATION();
+    DISALLOW_NEW();
 public:
     ScriptString();
     ScriptString(v8::Isolate*, v8::Local<v8::String>);

diff --git a/third_party/WebKit/Source/bindings/core/v8/ScriptValue.h b/third_party/WebKit/Source/bindings/core/v8/ScriptValue.h
index bb139370..539bf11 100644
--- a/third_party/WebKit/Source/bindings/core/v8/ScriptValue.h
+++ b/third_party/WebKit/Source/bindings/core/v8/ScriptValue.h

@@ -43,7 +43,7 @@
 namespace blink {
 
 class CORE_EXPORT ScriptValue final {
-    ALLOW_ONLY_INLINE_ALLOCATION();
+    DISALLOW_NEW_EXCEPT_PLACEMENT_NEW();
 public:
     template<typename T>
     static ScriptValue from(ScriptState* scriptState, T value)

diff --git a/third_party/WebKit/Source/bindings/core/v8/ToV8.h b/third_party/WebKit/Source/bindings/core/v8/ToV8.h
index 2778de4..7dcf58d 100644
--- a/third_party/WebKit/Source/bindings/core/v8/ToV8.h
+++ b/third_party/WebKit/Source/bindings/core/v8/ToV8.h

@@ -174,7 +174,7 @@
 // Undefined
 
 struct ToV8UndefinedGenerator {
-    DISALLOW_ALLOCATION();
+    DISALLOW_NEW();
 }; // Used only for having toV8 return v8::Undefined.
 
 inline v8::Local<v8::Value> toV8(const ToV8UndefinedGenerator&  value, v8::Local<v8::Object> creationContext, v8::Isolate* isolate)

diff --git a/third_party/WebKit/Source/bindings/core/v8/V8BindingForTesting.h b/third_party/WebKit/Source/bindings/core/v8/V8BindingForTesting.h
index fe0d33b..bd80192 100644
--- a/third_party/WebKit/Source/bindings/core/v8/V8BindingForTesting.h
+++ b/third_party/WebKit/Source/bindings/core/v8/V8BindingForTesting.h

@@ -25,7 +25,7 @@
 };
 
 class V8TestingScope {
-    DISALLOW_ALLOCATION();
+    DISALLOW_NEW();
 public:
     explicit V8TestingScope(v8::Isolate*);
     ScriptState* scriptState() const;

diff --git a/third_party/WebKit/Source/bindings/core/v8/V8DOMConfiguration.h b/third_party/WebKit/Source/bindings/core/v8/V8DOMConfiguration.h
index e4c44e6..33c97d7 100644
--- a/third_party/WebKit/Source/bindings/core/v8/V8DOMConfiguration.h
+++ b/third_party/WebKit/Source/bindings/core/v8/V8DOMConfiguration.h

@@ -37,7 +37,7 @@
 namespace blink {
 
 class CORE_EXPORT V8DOMConfiguration final {
-    DISALLOW_ALLOCATION();
+    DISALLOW_NEW();
     WTF_MAKE_NONCOPYABLE(V8DOMConfiguration);
 public:
     // The following Configuration structs and install methods are used for
@@ -67,7 +67,7 @@
     // the instance or the prototype ObjectTemplate, based on |instanceOrPrototypeConfiguration|.
     struct AttributeConfiguration {
         AttributeConfiguration& operator=(const AttributeConfiguration&) = delete;
-        DISALLOW_ALLOCATION();
+        DISALLOW_NEW();
         const char* const name;
         v8::AccessorNameGetterCallback getter;
         v8::AccessorNameSetterCallback setter;
@@ -89,7 +89,7 @@
     // on prototype ObjectTemplate.
     struct AccessorConfiguration {
         AccessorConfiguration& operator=(const AccessorConfiguration&) = delete;
-        DISALLOW_ALLOCATION();
+        DISALLOW_NEW();
         const char* const name;
         v8::FunctionCallback getter;
         v8::FunctionCallback setter;
@@ -123,7 +123,7 @@
     // the ObjectTemplate. PropertyAttributes is always ReadOnly.
     struct ConstantConfiguration {
         ConstantConfiguration& operator=(const ConstantConfiguration&) = delete;
-        DISALLOW_ALLOCATION();
+        DISALLOW_NEW();
         const char* const name;
         int ivalue;
         double dvalue;
@@ -149,7 +149,7 @@
     // the ObjectTemplate.
     struct MethodConfiguration {
         MethodConfiguration& operator=(const MethodConfiguration&) = delete;
-        DISALLOW_ALLOCATION();
+        DISALLOW_NEW();
         v8::Local<v8::Name> methodName(v8::Isolate* isolate) const { return v8AtomicString(isolate, name); }
         v8::FunctionCallback callbackForWorld(const DOMWrapperWorld& world) const
         {
@@ -167,7 +167,7 @@
 
     struct SymbolKeyedMethodConfiguration {
         SymbolKeyedMethodConfiguration& operator=(const SymbolKeyedMethodConfiguration&) = delete;
-        DISALLOW_ALLOCATION();
+        DISALLOW_NEW();
         v8::Local<v8::Name> methodName(v8::Isolate* isolate) const { return getSymbol(isolate); }
         v8::FunctionCallback callbackForWorld(const DOMWrapperWorld&) const
         {

diff --git a/third_party/WebKit/Source/bindings/core/v8/V8GlobalValueMap.h b/third_party/WebKit/Source/bindings/core/v8/V8GlobalValueMap.h
index 83401d5..7569465 100644
--- a/third_party/WebKit/Source/bindings/core/v8/V8GlobalValueMap.h
+++ b/third_party/WebKit/Source/bindings/core/v8/V8GlobalValueMap.h

@@ -95,7 +95,7 @@
  */
 template <class KeyType, class ValueType, v8::PersistentContainerCallbackType type>
 class V8GlobalValueMap : public v8::GlobalValueMap<KeyType, ValueType, V8GlobalValueMapTraits<KeyType, ValueType, type>> {
-    DISALLOW_ALLOCATION();
+    DISALLOW_NEW();
 public:
     typedef V8GlobalValueMapTraits<KeyType, ValueType, type> Traits;
     explicit V8GlobalValueMap(v8::Isolate* isolate)

diff --git a/third_party/WebKit/Source/bindings/core/v8/V8PersistentValueVector.h b/third_party/WebKit/Source/bindings/core/v8/V8PersistentValueVector.h
index be71875..b54abe54 100644
--- a/third_party/WebKit/Source/bindings/core/v8/V8PersistentValueVector.h
+++ b/third_party/WebKit/Source/bindings/core/v8/V8PersistentValueVector.h

@@ -70,7 +70,7 @@
 
 template<class ValueType>
 class V8PersistentValueVector : public v8::PersistentValueVector<ValueType, WTFVectorPersistentValueVectorTraits> {
-    DISALLOW_ALLOCATION();
+    DISALLOW_NEW();
 public:
     explicit V8PersistentValueVector(v8::Isolate* isolate) : v8::PersistentValueVector<ValueType, WTFVectorPersistentValueVectorTraits>(isolate) { }
 };

diff --git a/third_party/WebKit/Source/bindings/core/v8/WrapperTypeInfo.h b/third_party/WebKit/Source/bindings/core/v8/WrapperTypeInfo.h
index dfdd028..108bf98 100644
--- a/third_party/WebKit/Source/bindings/core/v8/WrapperTypeInfo.h
+++ b/third_party/WebKit/Source/bindings/core/v8/WrapperTypeInfo.h

@@ -69,7 +69,7 @@
 // v8 objects. Each v8 bindings class has exactly one static WrapperTypeInfo member, so
 // comparing pointers is a safe way to determine if types match.
 struct WrapperTypeInfo {
-    DISALLOW_ALLOCATION();
+    DISALLOW_NEW();
     enum WrapperTypePrototype {
         WrapperTypeObjectPrototype,
         WrapperTypeExceptionPrototype,

diff --git a/third_party/WebKit/Source/bindings/templates/dictionary_impl.h b/third_party/WebKit/Source/bindings/templates/dictionary_impl.h
index 8544f26..a3ca518 100644
--- a/third_party/WebKit/Source/bindings/templates/dictionary_impl.h
+++ b/third_party/WebKit/Source/bindings/templates/dictionary_impl.h

@@ -10,7 +10,7 @@
 
 {# FIXME: Add "final" if this class doesn't have subclasses #}
 class {{exported}}{{cpp_class}}{% if parent_cpp_class %} : public {{parent_cpp_class}}{% endif %} {
-    ALLOW_ONLY_INLINE_ALLOCATION();
+    DISALLOW_NEW_EXCEPT_PLACEMENT_NEW();
 public:
     {{cpp_class}}();
 

diff --git a/third_party/WebKit/Source/bindings/templates/union.h b/third_party/WebKit/Source/bindings/templates/union.h
index b41b8fc..e2bf897 100644
--- a/third_party/WebKit/Source/bindings/templates/union.h
+++ b/third_party/WebKit/Source/bindings/templates/union.h

@@ -14,7 +14,7 @@
 
 {% for container in containers %}
 class {{exported}}{{container.cpp_class}} final {
-    ALLOW_ONLY_INLINE_ALLOCATION();
+    DISALLOW_NEW_EXCEPT_PLACEMENT_NEW();
 public:
     {{container.cpp_class}}();
     bool isNull() const { return m_type == SpecificTypeNone; }

diff --git a/third_party/WebKit/Source/bindings/tests/results/core/TestDictionary.h b/third_party/WebKit/Source/bindings/tests/results/core/TestDictionary.h
index 72bd7b22..c578867 100644
--- a/third_party/WebKit/Source/bindings/tests/results/core/TestDictionary.h
+++ b/third_party/WebKit/Source/bindings/tests/results/core/TestDictionary.h

@@ -27,7 +27,7 @@
 namespace blink {
 
 class CORE_EXPORT TestDictionary {
-    ALLOW_ONLY_INLINE_ALLOCATION();
+    DISALLOW_NEW_EXCEPT_PLACEMENT_NEW();
 public:
     TestDictionary();
 

diff --git a/third_party/WebKit/Source/bindings/tests/results/core/TestDictionaryDerivedImplementedAs.h b/third_party/WebKit/Source/bindings/tests/results/core/TestDictionaryDerivedImplementedAs.h
index c87e4d1..9e26f347 100644
--- a/third_party/WebKit/Source/bindings/tests/results/core/TestDictionaryDerivedImplementedAs.h
+++ b/third_party/WebKit/Source/bindings/tests/results/core/TestDictionaryDerivedImplementedAs.h

@@ -18,7 +18,7 @@
 namespace blink {
 
 class CORE_EXPORT TestDictionaryDerivedImplementedAs : public TestDictionary {
-    ALLOW_ONLY_INLINE_ALLOCATION();
+    DISALLOW_NEW_EXCEPT_PLACEMENT_NEW();
 public:
     TestDictionaryDerivedImplementedAs();
 

diff --git a/third_party/WebKit/Source/bindings/tests/results/core/TestInterfaceEventInit.h b/third_party/WebKit/Source/bindings/tests/results/core/TestInterfaceEventInit.h
index 997642b..574a5ceb 100644
--- a/third_party/WebKit/Source/bindings/tests/results/core/TestInterfaceEventInit.h
+++ b/third_party/WebKit/Source/bindings/tests/results/core/TestInterfaceEventInit.h

@@ -15,7 +15,7 @@
 namespace blink {
 
 class CORE_EXPORT TestInterfaceEventInit : public EventInit {
-    ALLOW_ONLY_INLINE_ALLOCATION();
+    DISALLOW_NEW_EXCEPT_PLACEMENT_NEW();
 public:
     TestInterfaceEventInit();
 

diff --git a/third_party/WebKit/Source/bindings/tests/results/core/TestPermissiveDictionary.h b/third_party/WebKit/Source/bindings/tests/results/core/TestPermissiveDictionary.h
index 6f20dd2..e9c2eff 100644
--- a/third_party/WebKit/Source/bindings/tests/results/core/TestPermissiveDictionary.h
+++ b/third_party/WebKit/Source/bindings/tests/results/core/TestPermissiveDictionary.h

@@ -14,7 +14,7 @@
 namespace blink {
 
 class CORE_EXPORT TestPermissiveDictionary {
-    ALLOW_ONLY_INLINE_ALLOCATION();
+    DISALLOW_NEW_EXCEPT_PLACEMENT_NEW();
 public:
     TestPermissiveDictionary();
 

diff --git a/third_party/WebKit/Source/bindings/tests/results/core/UnionTypesCore.h b/third_party/WebKit/Source/bindings/tests/results/core/UnionTypesCore.h
index c293dad..bd4d095 100644
--- a/third_party/WebKit/Source/bindings/tests/results/core/UnionTypesCore.h
+++ b/third_party/WebKit/Source/bindings/tests/results/core/UnionTypesCore.h

@@ -28,7 +28,7 @@
 class TestInterfaceWillBeGarbageCollected;
 
 class CORE_EXPORT ArrayBufferOrArrayBufferViewOrDictionary final {
-    ALLOW_ONLY_INLINE_ALLOCATION();
+    DISALLOW_NEW_EXCEPT_PLACEMENT_NEW();
 public:
     ArrayBufferOrArrayBufferViewOrDictionary();
     bool isNull() const { return m_type == SpecificTypeNone; }
@@ -88,7 +88,7 @@
 };
 
 class CORE_EXPORT BooleanOrStringOrUnrestrictedDouble final {
-    ALLOW_ONLY_INLINE_ALLOCATION();
+    DISALLOW_NEW_EXCEPT_PLACEMENT_NEW();
 public:
     BooleanOrStringOrUnrestrictedDouble();
     bool isNull() const { return m_type == SpecificTypeNone; }
@@ -148,7 +148,7 @@
 };
 
 class CORE_EXPORT DoubleOrString final {
-    ALLOW_ONLY_INLINE_ALLOCATION();
+    DISALLOW_NEW_EXCEPT_PLACEMENT_NEW();
 public:
     DoubleOrString();
     bool isNull() const { return m_type == SpecificTypeNone; }
@@ -201,7 +201,7 @@
 };
 
 class CORE_EXPORT LongOrTestDictionary final {
-    ALLOW_ONLY_INLINE_ALLOCATION();
+    DISALLOW_NEW_EXCEPT_PLACEMENT_NEW();
 public:
     LongOrTestDictionary();
     bool isNull() const { return m_type == SpecificTypeNone; }
@@ -254,7 +254,7 @@
 };
 
 class CORE_EXPORT NodeOrNodeList final {
-    ALLOW_ONLY_INLINE_ALLOCATION();
+    DISALLOW_NEW_EXCEPT_PLACEMENT_NEW();
 public:
     NodeOrNodeList();
     bool isNull() const { return m_type == SpecificTypeNone; }
@@ -307,7 +307,7 @@
 };
 
 class CORE_EXPORT StringOrArrayBufferOrArrayBufferView final {
-    ALLOW_ONLY_INLINE_ALLOCATION();
+    DISALLOW_NEW_EXCEPT_PLACEMENT_NEW();
 public:
     StringOrArrayBufferOrArrayBufferView();
     bool isNull() const { return m_type == SpecificTypeNone; }
@@ -367,7 +367,7 @@
 };
 
 class CORE_EXPORT StringOrDouble final {
-    ALLOW_ONLY_INLINE_ALLOCATION();
+    DISALLOW_NEW_EXCEPT_PLACEMENT_NEW();
 public:
     StringOrDouble();
     bool isNull() const { return m_type == SpecificTypeNone; }
@@ -420,7 +420,7 @@
 };
 
 class CORE_EXPORT StringOrStringSequence final {
-    ALLOW_ONLY_INLINE_ALLOCATION();
+    DISALLOW_NEW_EXCEPT_PLACEMENT_NEW();
 public:
     StringOrStringSequence();
     bool isNull() const { return m_type == SpecificTypeNone; }
@@ -473,7 +473,7 @@
 };
 
 class CORE_EXPORT TestEnumOrDouble final {
-    ALLOW_ONLY_INLINE_ALLOCATION();
+    DISALLOW_NEW_EXCEPT_PLACEMENT_NEW();
 public:
     TestEnumOrDouble();
     bool isNull() const { return m_type == SpecificTypeNone; }
@@ -526,7 +526,7 @@
 };
 
 class CORE_EXPORT TestInterface2OrUint8Array final {
-    ALLOW_ONLY_INLINE_ALLOCATION();
+    DISALLOW_NEW_EXCEPT_PLACEMENT_NEW();
 public:
     TestInterface2OrUint8Array();
     bool isNull() const { return m_type == SpecificTypeNone; }
@@ -579,7 +579,7 @@
 };
 
 class CORE_EXPORT TestInterfaceGarbageCollectedOrString final {
-    ALLOW_ONLY_INLINE_ALLOCATION();
+    DISALLOW_NEW_EXCEPT_PLACEMENT_NEW();
 public:
     TestInterfaceGarbageCollectedOrString();
     bool isNull() const { return m_type == SpecificTypeNone; }
@@ -632,7 +632,7 @@
 };
 
 class CORE_EXPORT TestInterfaceOrLong final {
-    ALLOW_ONLY_INLINE_ALLOCATION();
+    DISALLOW_NEW_EXCEPT_PLACEMENT_NEW();
 public:
     TestInterfaceOrLong();
     bool isNull() const { return m_type == SpecificTypeNone; }
@@ -685,7 +685,7 @@
 };
 
 class CORE_EXPORT TestInterfaceOrTestInterfaceEmpty final {
-    ALLOW_ONLY_INLINE_ALLOCATION();
+    DISALLOW_NEW_EXCEPT_PLACEMENT_NEW();
 public:
     TestInterfaceOrTestInterfaceEmpty();
     bool isNull() const { return m_type == SpecificTypeNone; }
@@ -738,7 +738,7 @@
 };
 
 class CORE_EXPORT TestInterfaceWillBeGarbageCollectedOrTestDictionary final {
-    ALLOW_ONLY_INLINE_ALLOCATION();
+    DISALLOW_NEW_EXCEPT_PLACEMENT_NEW();
 public:
     TestInterfaceWillBeGarbageCollectedOrTestDictionary();
     bool isNull() const { return m_type == SpecificTypeNone; }
@@ -791,7 +791,7 @@
 };
 
 class CORE_EXPORT UnrestrictedDoubleOrString final {
-    ALLOW_ONLY_INLINE_ALLOCATION();
+    DISALLOW_NEW_EXCEPT_PLACEMENT_NEW();
 public:
     UnrestrictedDoubleOrString();
     bool isNull() const { return m_type == SpecificTypeNone; }

diff --git a/third_party/WebKit/Source/bindings/tests/results/modules/UnionTypesModules.h b/third_party/WebKit/Source/bindings/tests/results/modules/UnionTypesModules.h
index 485bf63..15e9408 100644
--- a/third_party/WebKit/Source/bindings/tests/results/modules/UnionTypesModules.h
+++ b/third_party/WebKit/Source/bindings/tests/results/modules/UnionTypesModules.h

@@ -18,7 +18,7 @@
 
 
 class MODULES_EXPORT BooleanOrString final {
-    ALLOW_ONLY_INLINE_ALLOCATION();
+    DISALLOW_NEW_EXCEPT_PLACEMENT_NEW();
 public:
     BooleanOrString();
     bool isNull() const { return m_type == SpecificTypeNone; }

diff --git a/third_party/WebKit/Source/core/animation/AnimationClock.h b/third_party/WebKit/Source/core/animation/AnimationClock.h
index b99b7bdf..0b05963 100644
--- a/third_party/WebKit/Source/core/animation/AnimationClock.h
+++ b/third_party/WebKit/Source/core/animation/AnimationClock.h

@@ -41,7 +41,7 @@
 namespace blink {
 
 class CORE_EXPORT AnimationClock {
-    DISALLOW_ALLOCATION();
+    DISALLOW_NEW();
     WTF_MAKE_NONCOPYABLE(AnimationClock);
 public:
     explicit AnimationClock(WTF::TimeFunction monotonicallyIncreasingTime = WTF::monotonicallyIncreasingTime)

diff --git a/third_party/WebKit/Source/core/animation/AnimationEffect.h b/third_party/WebKit/Source/core/animation/AnimationEffect.h
index 10c839c..dbf91c9d 100644
--- a/third_party/WebKit/Source/core/animation/AnimationEffect.h
+++ b/third_party/WebKit/Source/core/animation/AnimationEffect.h

@@ -150,7 +150,7 @@
     Member<EventDelegate> m_eventDelegate;
 
     mutable struct CalculatedTiming {
-        DISALLOW_ALLOCATION();
+        DISALLOW_NEW();
         Phase phase;
         double currentIteration;
         double timeFraction;

diff --git a/third_party/WebKit/Source/core/animation/AnimationStack.cpp b/third_party/WebKit/Source/core/animation/AnimationStack.cpp
index 8220f48..581f3da5 100644
--- a/third_party/WebKit/Source/core/animation/AnimationStack.cpp
+++ b/third_party/WebKit/Source/core/animation/AnimationStack.cpp

@@ -43,9 +43,11 @@
 
 namespace {
 
-void copyToActiveInterpolationsMap(const Vector<RefPtr<Interpolation>>& source, ActiveInterpolationsMap& target)
+void copyToActiveInterpolationsMap(const Vector<RefPtr<Interpolation>>& source, AnimationStack::PropertyHandleFilter propertyHandleFilter, ActiveInterpolationsMap& target)
 {
     for (const auto& interpolation : source) {
+        if (propertyHandleFilter && !propertyHandleFilter(interpolation->property()))
+            continue;
         ActiveInterpolationsMap::AddResult entry = target.add(interpolation->property(), ActiveInterpolations(1));
         ActiveInterpolations& activeInterpolations = entry.storedValue->value;
         if (!entry.isNewEntry
@@ -65,13 +67,13 @@
     return effect1->sequenceNumber() < effect2->sequenceNumber();
 }
 
-void copyNewAnimationsToActiveInterpolationsMap(const HeapVector<Member<InertEffect>>& newAnimations, ActiveInterpolationsMap& result)
+void copyNewAnimationsToActiveInterpolationsMap(const HeapVector<Member<InertEffect>>& newAnimations, AnimationStack::PropertyHandleFilter propertyHandleFilter, ActiveInterpolationsMap& result)
 {
     for (const auto& newAnimation : newAnimations) {
         Vector<RefPtr<Interpolation>> sample;
         newAnimation->sample(sample);
         if (!sample.isEmpty())
-            copyToActiveInterpolationsMap(sample, result);
+            copyToActiveInterpolationsMap(sample, propertyHandleFilter, result);
     }
 }
 
@@ -91,7 +93,7 @@
     return false;
 }
 
-ActiveInterpolationsMap AnimationStack::activeInterpolations(AnimationStack* animationStack, const HeapVector<Member<InertEffect>>* newAnimations, const HeapHashSet<Member<const Animation>>* suppressedAnimations, KeyframeEffect::Priority priority)
+ActiveInterpolationsMap AnimationStack::activeInterpolations(AnimationStack* animationStack, const HeapVector<Member<InertEffect>>* newAnimations, const HeapHashSet<Member<const Animation>>* suppressedAnimations, KeyframeEffect::Priority priority, PropertyHandleFilter propertyHandleFilter)
 {
     ActiveInterpolationsMap result;
 
@@ -103,12 +105,12 @@
         for (const auto& effect : effects) {
             if (effect->priority() != priority || (suppressedAnimations && effect->effect() && suppressedAnimations->contains(effect->effect()->animation())))
                 continue;
-            copyToActiveInterpolationsMap(effect->interpolations(), result);
+            copyToActiveInterpolationsMap(effect->interpolations(), propertyHandleFilter, result);
         }
     }
 
     if (newAnimations)
-        copyNewAnimationsToActiveInterpolationsMap(*newAnimations, result);
+        copyNewAnimationsToActiveInterpolationsMap(*newAnimations, propertyHandleFilter, result);
 
     return result;
 }

diff --git a/third_party/WebKit/Source/core/animation/AnimationStack.h b/third_party/WebKit/Source/core/animation/AnimationStack.h
index c52a951..7ce0f0f 100644
--- a/third_party/WebKit/Source/core/animation/AnimationStack.h
+++ b/third_party/WebKit/Source/core/animation/AnimationStack.h

@@ -48,7 +48,7 @@
 class InertEffect;
 
 class CORE_EXPORT AnimationStack {
-    DISALLOW_ALLOCATION();
+    DISALLOW_NEW();
     WTF_MAKE_NONCOPYABLE(AnimationStack);
 public:
     AnimationStack();
@@ -56,7 +56,9 @@
     void add(SampledEffect* effect) { m_effects.append(effect); }
     bool isEmpty() const { return m_effects.isEmpty(); }
     bool hasActiveAnimationsOnCompositor(CSSPropertyID) const;
-    static ActiveInterpolationsMap activeInterpolations(AnimationStack*, const HeapVector<Member<InertEffect>>* newAnimations, const HeapHashSet<Member<const Animation>>* suppressedAnimations, KeyframeEffect::Priority);
+
+    using PropertyHandleFilter = bool (*)(const PropertyHandle&);
+    static ActiveInterpolationsMap activeInterpolations(AnimationStack*, const HeapVector<Member<InertEffect>>* newAnimations, const HeapHashSet<Member<const Animation>>* suppressedAnimations, KeyframeEffect::Priority, PropertyHandleFilter = nullptr);
 
     bool getAnimatedBoundingBox(FloatBox&, CSSPropertyID) const;
     DECLARE_TRACE();

diff --git a/third_party/WebKit/Source/core/animation/CompositorAnimationsImpl.h b/third_party/WebKit/Source/core/animation/CompositorAnimationsImpl.h
index cd85c7d1..7320bb91 100644
--- a/third_party/WebKit/Source/core/animation/CompositorAnimationsImpl.h
+++ b/third_party/WebKit/Source/core/animation/CompositorAnimationsImpl.h

@@ -47,7 +47,7 @@
     STATIC_ONLY(CompositorAnimationsImpl);
 private:
     struct CompositorTiming {
-        DISALLOW_ALLOCATION();
+        DISALLOW_NEW();
         void assertValid() const
         {
             ASSERT(scaledDuration > 0);

diff --git a/third_party/WebKit/Source/core/animation/CompositorPendingAnimations.h b/third_party/WebKit/Source/core/animation/CompositorPendingAnimations.h
index ffa0242..65520c2 100644
--- a/third_party/WebKit/Source/core/animation/CompositorPendingAnimations.h
+++ b/third_party/WebKit/Source/core/animation/CompositorPendingAnimations.h

@@ -45,7 +45,7 @@
 // with compositor animations when both classes of CSS Animations are triggered
 // by the same recalc
 class CORE_EXPORT CompositorPendingAnimations final {
-    DISALLOW_ALLOCATION();
+    DISALLOW_NEW();
 public:
 
     CompositorPendingAnimations()

diff --git a/third_party/WebKit/Source/core/animation/InterpolationComponent.h b/third_party/WebKit/Source/core/animation/InterpolationComponent.h
index 6c8903f..9933c61f 100644
--- a/third_party/WebKit/Source/core/animation/InterpolationComponent.h
+++ b/third_party/WebKit/Source/core/animation/InterpolationComponent.h

@@ -12,7 +12,7 @@
 namespace blink {
 
 struct InterpolationComponent {
-    ALLOW_ONLY_INLINE_ALLOCATION();
+    DISALLOW_NEW_EXCEPT_PLACEMENT_NEW();
 
     explicit InterpolationComponent(PassOwnPtr<InterpolableValue> interpolableValue, PassRefPtr<NonInterpolableValue> nonInterpolableValue = nullptr)
         : interpolableValue(interpolableValue)
@@ -33,7 +33,7 @@
 };
 
 struct PairwiseInterpolationComponent {
-    ALLOW_ONLY_INLINE_ALLOCATION();
+    DISALLOW_NEW_EXCEPT_PLACEMENT_NEW();
 
     PairwiseInterpolationComponent(PassOwnPtr<InterpolableValue> startInterpolableValue, PassOwnPtr<InterpolableValue> endInterpolableValue, PassRefPtr<NonInterpolableValue> nonInterpolableValue = nullptr)
         : startInterpolableValue(startInterpolableValue)

diff --git a/third_party/WebKit/Source/core/animation/KeyframeEffect.cpp b/third_party/WebKit/Source/core/animation/KeyframeEffect.cpp
index 1864e12..e2a7467 100644
--- a/third_party/WebKit/Source/core/animation/KeyframeEffect.cpp
+++ b/third_party/WebKit/Source/core/animation/KeyframeEffect.cpp

@@ -193,11 +193,11 @@
         }
     }
 
-    if (changed)
+    if (changed) {
         m_target->setNeedsAnimationStyleRecalc();
-
-    if (m_target->isSVGElement())
-        m_sampledEffect->applySVGUpdate(toSVGElement(*m_target));
+        if (RuntimeEnabledFeatures::webAnimationsSVGEnabled() && m_target->isSVGElement())
+            toSVGElement(*m_target).setWebAnimationsPending();
+    }
 }
 
 void KeyframeEffect::clearEffects()

diff --git a/third_party/WebKit/Source/core/animation/LengthSVGInterpolation.h b/third_party/WebKit/Source/core/animation/LengthSVGInterpolation.h
index 1db8982..acbfa64 100644
--- a/third_party/WebKit/Source/core/animation/LengthSVGInterpolation.h
+++ b/third_party/WebKit/Source/core/animation/LengthSVGInterpolation.h

@@ -15,7 +15,7 @@
 public:
     typedef SVGLengthList ListType;
     struct NonInterpolableType {
-        DISALLOW_ALLOCATION();
+        DISALLOW_NEW();
         SVGLengthMode unitMode;
         SVGLengthNegativeValuesMode negativeValuesMode;
     };

diff --git a/third_party/WebKit/Source/core/animation/PropertyHandle.h b/third_party/WebKit/Source/core/animation/PropertyHandle.h
index e8a784e4..ebadbe6 100644
--- a/third_party/WebKit/Source/core/animation/PropertyHandle.h
+++ b/third_party/WebKit/Source/core/animation/PropertyHandle.h

@@ -13,7 +13,7 @@
 namespace blink {
 
 class CORE_EXPORT PropertyHandle {
-    ALLOW_ONLY_INLINE_ALLOCATION();
+    DISALLOW_NEW_EXCEPT_PLACEMENT_NEW();
 public:
     explicit PropertyHandle(CSSPropertyID property)
         : handleType(HandleCSSProperty)

diff --git a/third_party/WebKit/Source/core/animation/SampledEffect.cpp b/third_party/WebKit/Source/core/animation/SampledEffect.cpp
index b65726ac..06a29fd 100644
--- a/third_party/WebKit/Source/core/animation/SampledEffect.cpp
+++ b/third_party/WebKit/Source/core/animation/SampledEffect.cpp

@@ -33,22 +33,4 @@
     visitor->trace(m_animation);
 }
 
-void SampledEffect::applySVGUpdate(SVGElement& targetElement)
-{
-    for (const auto& interpolation : m_interpolations) {
-        if (interpolation->isSVGInterpolation()) {
-            toSVGInterpolation(interpolation.get())->apply(targetElement);
-        } else if (interpolation->isInvalidatableInterpolation()) {
-            const InvalidatableInterpolation& invalidatableInterpolation = toInvalidatableInterpolation(*interpolation);
-            if (invalidatableInterpolation.property().isSVGAttribute()) {
-                const SVGPropertyBase& baseValue = targetElement.propertyFromAttribute(invalidatableInterpolation.property().svgAttribute())->baseValueBase();
-                InterpolationEnvironment environment(targetElement, baseValue);
-                ActiveInterpolations activeInterpolations(1);
-                activeInterpolations[0] = interpolation.get();
-                InvalidatableInterpolation::applyStack(activeInterpolations, environment);
-            }
-        }
-    }
-}
-
 } // namespace blink

diff --git a/third_party/WebKit/Source/core/animation/SampledEffect.h b/third_party/WebKit/Source/core/animation/SampledEffect.h
index 7478a31..040bfe88 100644
--- a/third_party/WebKit/Source/core/animation/SampledEffect.h
+++ b/third_party/WebKit/Source/core/animation/SampledEffect.h

@@ -37,8 +37,6 @@
 
     DECLARE_TRACE();
 
-    void applySVGUpdate(SVGElement&);
-
 private:
     SampledEffect(KeyframeEffect*);
 

diff --git a/third_party/WebKit/Source/core/animation/animatable/AnimatableColor.h b/third_party/WebKit/Source/core/animation/animatable/AnimatableColor.h
index 90875fe3..e634005 100644
--- a/third_party/WebKit/Source/core/animation/animatable/AnimatableColor.h
+++ b/third_party/WebKit/Source/core/animation/animatable/AnimatableColor.h

@@ -39,7 +39,7 @@
 namespace blink {
 
 class CORE_EXPORT AnimatableColorImpl {
-    DISALLOW_ALLOCATION();
+    DISALLOW_NEW();
 public:
     AnimatableColorImpl(float red, float green, float blue, float alpha);
     AnimatableColorImpl(Color);

diff --git a/third_party/WebKit/Source/core/animation/css/CSSAnimationUpdate.h b/third_party/WebKit/Source/core/animation/css/CSSAnimationUpdate.h
index 5131ac4f..00c2b9c 100644
--- a/third_party/WebKit/Source/core/animation/css/CSSAnimationUpdate.h
+++ b/third_party/WebKit/Source/core/animation/css/CSSAnimationUpdate.h

@@ -25,11 +25,11 @@
 // This class stores the CSS Animations/Transitions information we use during a style recalc.
 // This includes updates to animations/transitions as well as the Interpolations to be applied.
 class CSSAnimationUpdate final {
-    DISALLOW_ALLOCATION();
+    DISALLOW_NEW();
     WTF_MAKE_NONCOPYABLE(CSSAnimationUpdate);
 public:
     class NewAnimation {
-        ALLOW_ONLY_INLINE_ALLOCATION();
+        DISALLOW_NEW_EXCEPT_PLACEMENT_NEW();
     public:
         NewAnimation()
             : styleRuleVersion(0)
@@ -61,7 +61,7 @@
     };
 
     class UpdatedAnimation {
-        ALLOW_ONLY_INLINE_ALLOCATION();
+        DISALLOW_NEW_EXCEPT_PLACEMENT_NEW();
     public:
         UpdatedAnimation()
             : styleRuleVersion(0)
@@ -182,7 +182,7 @@
     const HeapVector<Member<Animation>>& updatedCompositorKeyframes() const { return m_updatedCompositorKeyframes; }
 
     struct NewTransition {
-        ALLOW_ONLY_INLINE_ALLOCATION();
+        DISALLOW_NEW_EXCEPT_PLACEMENT_NEW();
     public:
         DEFINE_INLINE_TRACE()
         {

diff --git a/third_party/WebKit/Source/core/animation/css/CSSAnimations.cpp b/third_party/WebKit/Source/core/animation/css/CSSAnimations.cpp
index f62c198..9e9aa09 100644
--- a/third_party/WebKit/Source/core/animation/css/CSSAnimations.cpp
+++ b/third_party/WebKit/Source/core/animation/css/CSSAnimations.cpp

@@ -646,13 +646,18 @@
     clearPendingUpdate();
 }
 
+static bool isCSSPropertyHandle(const PropertyHandle& propertyHandle)
+{
+    return propertyHandle.isCSSProperty();
+}
+
 void CSSAnimations::calculateAnimationActiveInterpolations(CSSAnimationUpdate& update, const Element* animatingElement)
 {
     ElementAnimations* elementAnimations = animatingElement ? animatingElement->elementAnimations() : nullptr;
     AnimationStack* animationStack = elementAnimations ? &elementAnimations->animationStack() : nullptr;
 
     if (update.newAnimations().isEmpty() && update.suppressedAnimations().isEmpty()) {
-        ActiveInterpolationsMap activeInterpolationsForAnimations(AnimationStack::activeInterpolations(animationStack, 0, 0, KeyframeEffect::DefaultPriority));
+        ActiveInterpolationsMap activeInterpolationsForAnimations(AnimationStack::activeInterpolations(animationStack, nullptr, nullptr, KeyframeEffect::DefaultPriority, isCSSPropertyHandle));
         update.adoptActiveInterpolationsForAnimations(activeInterpolationsForAnimations);
         return;
     }
@@ -663,7 +668,7 @@
     for (const auto& updatedAnimation : update.animationsWithUpdates())
         newEffects.append(updatedAnimation.effect.get()); // Animations with updates use a temporary InertEffect for the current frame.
 
-    ActiveInterpolationsMap activeInterpolationsForAnimations(AnimationStack::activeInterpolations(animationStack, &newEffects, &update.suppressedAnimations(), KeyframeEffect::DefaultPriority));
+    ActiveInterpolationsMap activeInterpolationsForAnimations(AnimationStack::activeInterpolations(animationStack, &newEffects, &update.suppressedAnimations(), KeyframeEffect::DefaultPriority, isCSSPropertyHandle));
     update.adoptActiveInterpolationsForAnimations(activeInterpolationsForAnimations);
 }
 
@@ -674,7 +679,7 @@
 
     ActiveInterpolationsMap activeInterpolationsForTransitions;
     if (update.newTransitions().isEmpty() && update.cancelledTransitions().isEmpty()) {
-        activeInterpolationsForTransitions = AnimationStack::activeInterpolations(animationStack, 0, 0, KeyframeEffect::TransitionPriority);
+        activeInterpolationsForTransitions = AnimationStack::activeInterpolations(animationStack, nullptr, nullptr, KeyframeEffect::TransitionPriority, isCSSPropertyHandle);
     } else {
         HeapVector<Member<InertEffect>> newTransitions;
         for (const auto& entry : update.newTransitions())
@@ -690,7 +695,7 @@
             }
         }
 
-        activeInterpolationsForTransitions = AnimationStack::activeInterpolations(animationStack, &newTransitions, &cancelledAnimations, KeyframeEffect::TransitionPriority);
+        activeInterpolationsForTransitions = AnimationStack::activeInterpolations(animationStack, &newTransitions, &cancelledAnimations, KeyframeEffect::TransitionPriority, isCSSPropertyHandle);
     }
 
     // Properties being animated by animations don't get values from transitions applied.

diff --git a/third_party/WebKit/Source/core/animation/css/CSSAnimations.h b/third_party/WebKit/Source/core/animation/css/CSSAnimations.h
index 1cb8e6b..7529699 100644
--- a/third_party/WebKit/Source/core/animation/css/CSSAnimations.h
+++ b/third_party/WebKit/Source/core/animation/css/CSSAnimations.h

@@ -52,7 +52,7 @@
 
 class CSSAnimations final {
     WTF_MAKE_NONCOPYABLE(CSSAnimations);
-    DISALLOW_ALLOCATION();
+    DISALLOW_NEW();
 public:
     CSSAnimations();
 
@@ -114,7 +114,7 @@
     };
 
     struct RunningTransition {
-        ALLOW_ONLY_INLINE_ALLOCATION();
+        DISALLOW_NEW_EXCEPT_PLACEMENT_NEW();
     public:
         DEFINE_INLINE_TRACE()
         {

diff --git a/third_party/WebKit/Source/core/animation/css/CSSTransitionData.h b/third_party/WebKit/Source/core/animation/css/CSSTransitionData.h
index 56e66b0..0e00f35 100644
--- a/third_party/WebKit/Source/core/animation/css/CSSTransitionData.h
+++ b/third_party/WebKit/Source/core/animation/css/CSSTransitionData.h

@@ -21,7 +21,7 @@
 
     // FIXME: We shouldn't allow 'none' to be used alongside other properties.
     struct TransitionProperty {
-        ALLOW_ONLY_INLINE_ALLOCATION();
+        DISALLOW_NEW_EXCEPT_PLACEMENT_NEW();
         TransitionProperty(CSSPropertyID id)
             : propertyType(TransitionKnownProperty)
             , unresolvedProperty(id)

diff --git a/third_party/WebKit/Source/core/css/CSSCrossfadeValue.h b/third_party/WebKit/Source/core/css/CSSCrossfadeValue.h
index b3efca1..f68f7a72 100644
--- a/third_party/WebKit/Source/core/css/CSSCrossfadeValue.h
+++ b/third_party/WebKit/Source/core/css/CSSCrossfadeValue.h

@@ -84,7 +84,7 @@
         , m_crossfadeSubimageObserver(this) { }
 
     class CrossfadeSubimageObserverProxy final : public ImageResourceClient {
-        DISALLOW_ALLOCATION();
+        DISALLOW_NEW();
     public:
         explicit CrossfadeSubimageObserverProxy(CSSCrossfadeValue* ownerValue)
             : m_ownerValue(ownerValue)

diff --git a/third_party/WebKit/Source/core/css/CSSFontFace.h b/third_party/WebKit/Source/core/css/CSSFontFace.h
index b7ce7cb4..0a87261 100644
--- a/third_party/WebKit/Source/core/css/CSSFontFace.h
+++ b/third_party/WebKit/Source/core/css/CSSFontFace.h

@@ -75,7 +75,7 @@
     PassRefPtr<SimpleFontData> getFontData(const FontDescription&);
 
     struct UnicodeRange {
-        ALLOW_ONLY_INLINE_ALLOCATION();
+        DISALLOW_NEW_EXCEPT_PLACEMENT_NEW();
         UnicodeRange(UChar32 from, UChar32 to)
             : m_from(from)
             , m_to(to)
@@ -95,7 +95,7 @@
     };
 
     class CORE_EXPORT UnicodeRangeSet {
-        ALLOW_ONLY_INLINE_ALLOCATION();
+        DISALLOW_NEW_EXCEPT_PLACEMENT_NEW();
     public:
         explicit UnicodeRangeSet(const Vector<UnicodeRange>&);
         bool contains(UChar32) const;

diff --git a/third_party/WebKit/Source/core/css/CSSGradientValue.h b/third_party/WebKit/Source/core/css/CSSGradientValue.h
index 3add5eae..c425efa 100644
--- a/third_party/WebKit/Source/core/css/CSSGradientValue.h
+++ b/third_party/WebKit/Source/core/css/CSSGradientValue.h

@@ -52,7 +52,7 @@
 // objects its members are visited via the containing object's
 // (CSSGradientValue) traceAfterDispatch method.
 struct CSSGradientColorStop {
-    ALLOW_ONLY_INLINE_ALLOCATION();
+    DISALLOW_NEW_EXCEPT_PLACEMENT_NEW();
 public:
     CSSGradientColorStop() : m_colorIsDerivedFromElement(false) { }
     RefPtrWillBeMember<CSSPrimitiveValue> m_position; // percentage or length

diff --git a/third_party/WebKit/Source/core/css/CSSImageGeneratorValue.h b/third_party/WebKit/Source/core/css/CSSImageGeneratorValue.h
index 093d5f3b..f286127 100644
--- a/third_party/WebKit/Source/core/css/CSSImageGeneratorValue.h
+++ b/third_party/WebKit/Source/core/css/CSSImageGeneratorValue.h

@@ -39,7 +39,7 @@
 class LayoutObject;
 
 struct SizeAndCount {
-    DISALLOW_ALLOCATION();
+    DISALLOW_NEW();
     SizeAndCount(IntSize newSize = IntSize(), int newCount = 0)
         : size(newSize)
         , count(newCount)

diff --git a/third_party/WebKit/Source/core/css/CSSImageSetValue.h b/third_party/WebKit/Source/core/css/CSSImageSetValue.h
index 5ae2c40..9095c3c 100644
--- a/third_party/WebKit/Source/core/css/CSSImageSetValue.h
+++ b/third_party/WebKit/Source/core/css/CSSImageSetValue.h

@@ -53,7 +53,7 @@
     String customCSSText() const;
 
     struct ImageWithScale {
-        ALLOW_ONLY_INLINE_ALLOCATION();
+        DISALLOW_NEW_EXCEPT_PLACEMENT_NEW();
         String imageURL;
         Referrer referrer;
         float scaleFactor;

diff --git a/third_party/WebKit/Source/core/css/CSSProperty.h b/third_party/WebKit/Source/core/css/CSSProperty.h
index 6baf1863..45e3694 100644
--- a/third_party/WebKit/Source/core/css/CSSProperty.h
+++ b/third_party/WebKit/Source/core/css/CSSProperty.h

@@ -34,7 +34,7 @@
 namespace blink {
 
 struct StylePropertyMetadata {
-    DISALLOW_ALLOCATION();
+    DISALLOW_NEW();
     StylePropertyMetadata(CSSPropertyID propertyID, bool isSetFromShorthand, int indexInShorthandsVector, bool important, bool implicit, bool inherited)
         : m_propertyID(propertyID)
         , m_isSetFromShorthand(isSetFromShorthand)
@@ -56,7 +56,7 @@
 };
 
 class CSSProperty {
-    ALLOW_ONLY_INLINE_ALLOCATION();
+    DISALLOW_NEW_EXCEPT_PLACEMENT_NEW();
 public:
     CSSProperty(CSSPropertyID propertyID, PassRefPtrWillBeRawPtr<CSSValue> value, bool important = false, bool isSetFromShorthand = false, int indexInShorthandsVector = 0, bool implicit = false)
         : m_metadata(propertyID, isSetFromShorthand, indexInShorthandsVector, important, implicit, CSSPropertyMetadata::isInheritedProperty(propertyID))

diff --git a/third_party/WebKit/Source/core/css/CSSPropertySourceData.h b/third_party/WebKit/Source/core/css/CSSPropertySourceData.h
index 19c9cc82..aab9f69 100644
--- a/third_party/WebKit/Source/core/css/CSSPropertySourceData.h
+++ b/third_party/WebKit/Source/core/css/CSSPropertySourceData.h

@@ -41,7 +41,7 @@
 namespace blink {
 
 struct SourceRange {
-    ALLOW_ONLY_INLINE_ALLOCATION();
+    DISALLOW_NEW_EXCEPT_PLACEMENT_NEW();
 public:
     SourceRange();
     SourceRange(unsigned start, unsigned end);
@@ -54,7 +54,7 @@
 };
 
 struct CSSPropertySourceData {
-    ALLOW_ONLY_INLINE_ALLOCATION();
+    DISALLOW_NEW_EXCEPT_PLACEMENT_NEW();
 public:
     CSSPropertySourceData(const String& name, const String& value, bool important, bool disabled, bool parsedOk, const SourceRange& range);
     CSSPropertySourceData(const CSSPropertySourceData& other);
@@ -86,7 +86,7 @@
 };
 
 struct CSSMediaQueryExpSourceData {
-    ALLOW_ONLY_INLINE_ALLOCATION();
+    DISALLOW_NEW_EXCEPT_PLACEMENT_NEW();
 public:
     CSSMediaQueryExpSourceData(const SourceRange& valueRange)
         : valueRange(valueRange) { }

diff --git a/third_party/WebKit/Source/core/css/CSSToLengthConversionData.h b/third_party/WebKit/Source/core/css/CSSToLengthConversionData.h
index aa5b74e..8aa7002 100644
--- a/third_party/WebKit/Source/core/css/CSSToLengthConversionData.h
+++ b/third_party/WebKit/Source/core/css/CSSToLengthConversionData.h

@@ -45,11 +45,11 @@
 class Font;
 
 class CORE_EXPORT CSSToLengthConversionData {
-    DISALLOW_ALLOCATION();
+    DISALLOW_NEW();
 public:
 
     class FontSizes {
-        DISALLOW_ALLOCATION();
+        DISALLOW_NEW();
     public:
         FontSizes() : m_em(0), m_rem(0), m_font(nullptr) { }
         FontSizes(float em, float rem, const Font*);
@@ -66,7 +66,7 @@
     };
 
     class ViewportSize {
-        DISALLOW_ALLOCATION();
+        DISALLOW_NEW();
     public:
         ViewportSize() : m_width(0), m_height(0) { }
         ViewportSize(double width, double height) : m_width(width), m_height(height) { }

diff --git a/third_party/WebKit/Source/core/css/ElementRuleCollector.h b/third_party/WebKit/Source/core/css/ElementRuleCollector.h
index 069bb4e..97ae7f4 100644
--- a/third_party/WebKit/Source/core/css/ElementRuleCollector.h
+++ b/third_party/WebKit/Source/core/css/ElementRuleCollector.h

@@ -44,7 +44,7 @@
 const CascadeOrder ignoreCascadeOrder = 0;
 
 class MatchedRule {
-    ALLOW_ONLY_INLINE_ALLOCATION();
+    DISALLOW_NEW_EXCEPT_PLACEMENT_NEW();
 public:
     MatchedRule(const RuleData* ruleData, unsigned specificity, CascadeOrder cascadeOrder, unsigned styleSheetIndex, const CSSStyleSheet* parentStyleSheet)
         : m_ruleData(ruleData)

diff --git a/third_party/WebKit/Source/core/css/FontFaceCache.h b/third_party/WebKit/Source/core/css/FontFaceCache.h
index 44f79182..cbc55e5 100644
--- a/third_party/WebKit/Source/core/css/FontFaceCache.h
+++ b/third_party/WebKit/Source/core/css/FontFaceCache.h

@@ -42,7 +42,7 @@
 class StyleRuleFontFace;
 
 class FontFaceCache final {
-    DISALLOW_ALLOCATION();
+    DISALLOW_NEW();
 public:
     FontFaceCache();
 

diff --git a/third_party/WebKit/Source/core/css/FontFaceSet.h b/third_party/WebKit/Source/core/css/FontFaceSet.h
index 434c6750..61b0ebc6 100644
--- a/third_party/WebKit/Source/core/css/FontFaceSet.h
+++ b/third_party/WebKit/Source/core/css/FontFaceSet.h

@@ -138,7 +138,7 @@
     };
 
     class FontLoadHistogram {
-        DISALLOW_ALLOCATION();
+        DISALLOW_NEW();
     public:
         enum Status { NoWebFonts, HadBlankText, DidNotHaveBlankText, Reported };
         FontLoadHistogram() : m_status(NoWebFonts), m_count(0), m_recorded(false) { }

diff --git a/third_party/WebKit/Source/core/css/HashTools.h b/third_party/WebKit/Source/core/css/HashTools.h
index 79fb726..d89079ec 100644
--- a/third_party/WebKit/Source/core/css/HashTools.h
+++ b/third_party/WebKit/Source/core/css/HashTools.h

@@ -25,13 +25,13 @@
 namespace blink {
 
 struct Property {
-    DISALLOW_ALLOCATION();
+    DISALLOW_NEW();
     int nameOffset;
     int id;
 };
 
 struct Value {
-    DISALLOW_ALLOCATION();
+    DISALLOW_NEW();
     int nameOffset;
     int id;
 };

diff --git a/third_party/WebKit/Source/core/css/LocalFontFaceSource.h b/third_party/WebKit/Source/core/css/LocalFontFaceSource.h
index f63346c..c172f30 100644
--- a/third_party/WebKit/Source/core/css/LocalFontFaceSource.h
+++ b/third_party/WebKit/Source/core/css/LocalFontFaceSource.h

@@ -21,7 +21,7 @@
     PassRefPtr<SimpleFontData> createFontData(const FontDescription&) override;
 
     class LocalFontHistograms {
-        DISALLOW_ALLOCATION();
+        DISALLOW_NEW();
     public:
         LocalFontHistograms() : m_reported(false) { }
         void record(bool loadSuccess);

diff --git a/third_party/WebKit/Source/core/css/MediaQueryExp.h b/third_party/WebKit/Source/core/css/MediaQueryExp.h
index 5ce69204..98d8333 100644
--- a/third_party/WebKit/Source/core/css/MediaQueryExp.h
+++ b/third_party/WebKit/Source/core/css/MediaQueryExp.h

@@ -43,7 +43,7 @@
 class CSSParserToken;
 
 struct MediaQueryExpValue {
-    DISALLOW_ALLOCATION();
+    DISALLOW_NEW();
     CSSValueID id;
     double value;
     CSSPrimitiveValue::UnitType unit;

diff --git a/third_party/WebKit/Source/core/css/MediaValuesCached.h b/third_party/WebKit/Source/core/css/MediaValuesCached.h
index 9fd4338..5f5331e 100644
--- a/third_party/WebKit/Source/core/css/MediaValuesCached.h
+++ b/third_party/WebKit/Source/core/css/MediaValuesCached.h

@@ -13,7 +13,7 @@
 class CORE_EXPORT MediaValuesCached final : public MediaValues {
 public:
     struct MediaValuesCachedData {
-        DISALLOW_ALLOCATION();
+        DISALLOW_NEW();
         // Members variables must be thread safe, since they're copied to the parser thread
         int viewportWidth;
         int viewportHeight;

diff --git a/third_party/WebKit/Source/core/css/PseudoStyleRequest.h b/third_party/WebKit/Source/core/css/PseudoStyleRequest.h
index 8ffed80..c88eb26 100644
--- a/third_party/WebKit/Source/core/css/PseudoStyleRequest.h
+++ b/third_party/WebKit/Source/core/css/PseudoStyleRequest.h

@@ -31,7 +31,7 @@
 class ComputedStyle;
 
 class PseudoStyleRequest {
-    ALLOW_ONLY_INLINE_ALLOCATION();
+    DISALLOW_NEW_EXCEPT_PLACEMENT_NEW();
 public:
 
     enum RequestType { ForRenderer, ForComputedStyle };

diff --git a/third_party/WebKit/Source/core/css/RemoteFontFaceSource.h b/third_party/WebKit/Source/core/css/RemoteFontFaceSource.h
index d10c737..c93f1ca 100644
--- a/third_party/WebKit/Source/core/css/RemoteFontFaceSource.h
+++ b/third_party/WebKit/Source/core/css/RemoteFontFaceSource.h

@@ -43,7 +43,7 @@
 
 private:
     class FontLoadHistograms {
-        DISALLOW_ALLOCATION();
+        DISALLOW_NEW();
     public:
         FontLoadHistograms() : m_loadStartTime(0), m_fallbackPaintTime(0) { }
         void loadStarted();

diff --git a/third_party/WebKit/Source/core/css/RuleFeature.h b/third_party/WebKit/Source/core/css/RuleFeature.h
index 1fc6849e..6ec0fab 100644
--- a/third_party/WebKit/Source/core/css/RuleFeature.h
+++ b/third_party/WebKit/Source/core/css/RuleFeature.h

@@ -39,7 +39,7 @@
 class StyleRule;
 
 struct RuleFeature {
-    ALLOW_ONLY_INLINE_ALLOCATION();
+    DISALLOW_NEW_EXCEPT_PLACEMENT_NEW();
 public:
     RuleFeature(StyleRule*, unsigned selectorIndex, bool hasDocumentSecurityOrigin);
 
@@ -51,7 +51,7 @@
 };
 
 class CORE_EXPORT RuleFeatureSet {
-    DISALLOW_ALLOCATION();
+    DISALLOW_NEW();
 public:
     RuleFeatureSet();
     ~RuleFeatureSet();
@@ -105,7 +105,7 @@
     using PseudoTypeInvalidationSetMap = HashMap<CSSSelector::PseudoType, RefPtr<InvalidationData>, WTF::IntHash<unsigned>, WTF::UnsignedWithZeroKeyHashTraits<unsigned>>;
 
     struct FeatureMetadata {
-        DISALLOW_ALLOCATION();
+        DISALLOW_NEW();
         FeatureMetadata()
             : usesFirstLineRules(false)
             , usesWindowInactiveSelector(false)
@@ -137,7 +137,7 @@
     void updateInvalidationSetsForContentAttribute(const RuleData&);
 
     struct InvalidationSetFeatures {
-        DISALLOW_ALLOCATION();
+        DISALLOW_NEW();
         InvalidationSetFeatures()
             : maxDirectAdjacentSelectors(UINT_MAX)
             , customPseudoElement(false)

diff --git a/third_party/WebKit/Source/core/css/RuleSet.h b/third_party/WebKit/Source/core/css/RuleSet.h
index 03fad05..cea6fde7 100644
--- a/third_party/WebKit/Source/core/css/RuleSet.h
+++ b/third_party/WebKit/Source/core/css/RuleSet.h

@@ -53,7 +53,7 @@
 class StyleSheetContents;
 
 class MinimalRuleData {
-    ALLOW_ONLY_INLINE_ALLOCATION();
+    DISALLOW_NEW_EXCEPT_PLACEMENT_NEW();
 public:
     MinimalRuleData(StyleRule* rule, unsigned selectorIndex, AddRuleFlags flags)
     : m_rule(rule)
@@ -70,7 +70,7 @@
 };
 
 class CORE_EXPORT RuleData {
-    ALLOW_ONLY_INLINE_ALLOCATION();
+    DISALLOW_NEW_EXCEPT_PLACEMENT_NEW();
 public:
     RuleData(StyleRule*, unsigned selectorIndex, unsigned position, AddRuleFlags);
 
@@ -110,7 +110,7 @@
 };
 
 struct SameSizeAsRuleData {
-    DISALLOW_ALLOCATION();
+    DISALLOW_NEW();
     void* a;
     unsigned b;
     unsigned c;

diff --git a/third_party/WebKit/Source/core/css/SelectorFilter.h b/third_party/WebKit/Source/core/css/SelectorFilter.h
index dab2b5b1..d99b8a0 100644
--- a/third_party/WebKit/Source/core/css/SelectorFilter.h
+++ b/third_party/WebKit/Source/core/css/SelectorFilter.h

@@ -38,10 +38,10 @@
 class CSSSelector;
 
 class SelectorFilter {
-    DISALLOW_ALLOCATION();
+    DISALLOW_NEW();
 public:
     class ParentStackFrame {
-        ALLOW_ONLY_INLINE_ALLOCATION();
+        DISALLOW_NEW_EXCEPT_PLACEMENT_NEW();
     public:
         ParentStackFrame() : element(nullptr) { }
         explicit ParentStackFrame(Element& element) : element(&element) { }

diff --git a/third_party/WebKit/Source/core/css/StyleColor.h b/third_party/WebKit/Source/core/css/StyleColor.h
index 30e6662..c3cb0bc 100644
--- a/third_party/WebKit/Source/core/css/StyleColor.h
+++ b/third_party/WebKit/Source/core/css/StyleColor.h

@@ -38,7 +38,7 @@
 namespace blink {
 
 class StyleColor {
-    DISALLOW_ALLOCATION();
+    DISALLOW_NEW();
 public:
     StyleColor() : m_currentColor(true) { }
     StyleColor(Color color) : m_color(color), m_currentColor(false) { }

diff --git a/third_party/WebKit/Source/core/css/StylePropertySerializer.h b/third_party/WebKit/Source/core/css/StylePropertySerializer.h
index 3d209d42..d032176 100644
--- a/third_party/WebKit/Source/core/css/StylePropertySerializer.h
+++ b/third_party/WebKit/Source/core/css/StylePropertySerializer.h

@@ -90,7 +90,7 @@
     };
 
     class StylePropertySetForSerializer final {
-        DISALLOW_ALLOCATION();
+        DISALLOW_NEW();
     public:
         explicit StylePropertySetForSerializer(const StylePropertySet&);
 

diff --git a/third_party/WebKit/Source/core/css/StyleRuleImport.h b/third_party/WebKit/Source/core/css/StyleRuleImport.h
index ebf0055e..1e22f0d 100644
--- a/third_party/WebKit/Source/core/css/StyleRuleImport.h
+++ b/third_party/WebKit/Source/core/css/StyleRuleImport.h

@@ -59,7 +59,7 @@
     // NOTE: We put the StyleSheetResourceClient in a member instead of inheriting from it
     // to avoid adding a vptr to StyleRuleImport.
     class ImportedStyleSheetClient final : public StyleSheetResourceClient {
-        DISALLOW_ALLOCATION();
+        DISALLOW_NEW();
     public:
         ImportedStyleSheetClient(StyleRuleImport* ownerRule) : m_ownerRule(ownerRule) { }
         ~ImportedStyleSheetClient() override { }

diff --git a/third_party/WebKit/Source/core/css/TreeBoundaryCrossingRules.h b/third_party/WebKit/Source/core/css/TreeBoundaryCrossingRules.h
index 8c041d8..8e932785 100644
--- a/third_party/WebKit/Source/core/css/TreeBoundaryCrossingRules.h
+++ b/third_party/WebKit/Source/core/css/TreeBoundaryCrossingRules.h

@@ -36,7 +36,7 @@
 class ElementRuleCollector;
 
 class TreeBoundaryCrossingRules final {
-    DISALLOW_ALLOCATION();
+    DISALLOW_NEW();
 public:
     void addScope(ContainerNode&);
     void removeScope(const ContainerNode&);

diff --git a/third_party/WebKit/Source/core/css/invalidation/StyleInvalidator.h b/third_party/WebKit/Source/core/css/invalidation/StyleInvalidator.h
index 3edd1f32..f99f005 100644
--- a/third_party/WebKit/Source/core/css/invalidation/StyleInvalidator.h
+++ b/third_party/WebKit/Source/core/css/invalidation/StyleInvalidator.h

@@ -17,7 +17,7 @@
 
 
 class StyleInvalidator {
-    DISALLOW_ALLOCATION();
+    DISALLOW_NEW();
     WTF_MAKE_NONCOPYABLE(StyleInvalidator);
 public:
     StyleInvalidator();
@@ -69,7 +69,7 @@
 
     private:
         struct Entry {
-            ALLOW_ONLY_INLINE_ALLOCATION();
+            DISALLOW_NEW_EXCEPT_PLACEMENT_NEW();
             Entry(const SiblingInvalidationSet* invalidationSet, unsigned invalidationLimit)
                 : m_invalidationSet(invalidationSet)
                 , m_invalidationLimit(invalidationLimit)

diff --git a/third_party/WebKit/Source/core/css/parser/CSSParserObserverWrapper.h b/third_party/WebKit/Source/core/css/parser/CSSParserObserverWrapper.h
index 510f4fd..320f823 100644
--- a/third_party/WebKit/Source/core/css/parser/CSSParserObserverWrapper.h
+++ b/third_party/WebKit/Source/core/css/parser/CSSParserObserverWrapper.h

@@ -43,7 +43,7 @@
     CSSParserToken* m_firstParserToken;
 
     struct CommentPosition {
-        ALLOW_ONLY_INLINE_ALLOCATION();
+        DISALLOW_NEW_EXCEPT_PLACEMENT_NEW();
         unsigned startOffset;
         unsigned endOffset;
         unsigned tokensBefore;

diff --git a/third_party/WebKit/Source/core/css/parser/CSSParserTokenRange.h b/third_party/WebKit/Source/core/css/parser/CSSParserTokenRange.h
index 34b0e0618..c8cf20b3 100644
--- a/third_party/WebKit/Source/core/css/parser/CSSParserTokenRange.h
+++ b/third_party/WebKit/Source/core/css/parser/CSSParserTokenRange.h

@@ -18,7 +18,7 @@
 // Accessing outside of the range will return an endless stream of EOF tokens.
 // This class refers to half-open intervals [first, last).
 class CORE_EXPORT CSSParserTokenRange {
-    DISALLOW_ALLOCATION();
+    DISALLOW_NEW();
 public:
     CSSParserTokenRange(const Vector<CSSParserToken>& vector)
     : m_first(vector.begin())

diff --git a/third_party/WebKit/Source/core/css/parser/CSSParserValues.h b/third_party/WebKit/Source/core/css/parser/CSSParserValues.h
index 86253227..2b95061 100644
--- a/third_party/WebKit/Source/core/css/parser/CSSParserValues.h
+++ b/third_party/WebKit/Source/core/css/parser/CSSParserValues.h

@@ -37,7 +37,7 @@
 class CSSParserValueList;
 
 struct CSSParserValue {
-    ALLOW_ONLY_INLINE_ALLOCATION();
+    DISALLOW_NEW_EXCEPT_PLACEMENT_NEW();
     CSSValueID id;
     bool isInt;
     union {

diff --git a/third_party/WebKit/Source/core/css/parser/CSSTokenizer.h b/third_party/WebKit/Source/core/css/parser/CSSTokenizer.h
index c3c3e773..41fa90e 100644
--- a/third_party/WebKit/Source/core/css/parser/CSSTokenizer.h
+++ b/third_party/WebKit/Source/core/css/parser/CSSTokenizer.h

@@ -25,7 +25,7 @@
     USING_FAST_MALLOC(CSSTokenizer);
 public:
     class CORE_EXPORT Scope {
-        DISALLOW_ALLOCATION();
+        DISALLOW_NEW();
     public:
         Scope(const String&);
         Scope(const String&, CSSParserObserverWrapper&); // For the inspector

diff --git a/third_party/WebKit/Source/core/css/parser/SizesCalcParser.h b/third_party/WebKit/Source/core/css/parser/SizesCalcParser.h
index e240015d..011479f 100644
--- a/third_party/WebKit/Source/core/css/parser/SizesCalcParser.h
+++ b/third_party/WebKit/Source/core/css/parser/SizesCalcParser.h

@@ -14,7 +14,7 @@
 namespace blink {
 
 struct SizesCalcValue {
-    ALLOW_ONLY_INLINE_ALLOCATION();
+    DISALLOW_NEW_EXCEPT_PLACEMENT_NEW();
     double value;
     bool isLength;
     UChar operation;

diff --git a/third_party/WebKit/Source/core/css/resolver/MatchResult.h b/third_party/WebKit/Source/core/css/resolver/MatchResult.h
index eee39dbf..f8300eb3 100644
--- a/third_party/WebKit/Source/core/css/resolver/MatchResult.h
+++ b/third_party/WebKit/Source/core/css/resolver/MatchResult.h

@@ -34,7 +34,7 @@
 class StylePropertySet;
 
 struct CORE_EXPORT MatchedProperties {
-    ALLOW_ONLY_INLINE_ALLOCATION();
+    DISALLOW_NEW_EXCEPT_PLACEMENT_NEW();
 public:
     MatchedProperties();
     ~MatchedProperties();

diff --git a/third_party/WebKit/Source/core/css/resolver/MatchedPropertiesCache.h b/third_party/WebKit/Source/core/css/resolver/MatchedPropertiesCache.h
index 43aed30..ebfc882 100644
--- a/third_party/WebKit/Source/core/css/resolver/MatchedPropertiesCache.h
+++ b/third_party/WebKit/Source/core/css/resolver/MatchedPropertiesCache.h

@@ -90,7 +90,7 @@
 #endif
 
 class MatchedPropertiesCache {
-    DISALLOW_ALLOCATION();
+    DISALLOW_NEW();
     WTF_MAKE_NONCOPYABLE(MatchedPropertiesCache);
 public:
     MatchedPropertiesCache();

diff --git a/third_party/WebKit/Source/core/css/resolver/StyleResolver.cpp b/third_party/WebKit/Source/core/css/resolver/StyleResolver.cpp
index d9ea145..28e9fd4 100644
--- a/third_party/WebKit/Source/core/css/resolver/StyleResolver.cpp
+++ b/third_party/WebKit/Source/core/css/resolver/StyleResolver.cpp

@@ -960,16 +960,14 @@
 template <CSSPropertyPriority priority>
 void StyleResolver::applyAnimatedProperties(StyleResolverState& state, const ActiveInterpolationsMap& activeInterpolationsMap)
 {
-    for (const auto& interpolationsVectorEntry : activeInterpolationsMap) {
-        if (!interpolationsVectorEntry.key.isCSSProperty())
-            continue;
-        CSSPropertyID property = interpolationsVectorEntry.key.cssProperty();
+    for (const auto& entry : activeInterpolationsMap) {
+        CSSPropertyID property = entry.key.cssProperty();
         if (!CSSPropertyPriorityData<priority>::propertyHasPriority(property))
             continue;
-        const Interpolation& interpolation = *interpolationsVectorEntry.value.first();
+        const Interpolation& interpolation = *entry.value.first();
         if (interpolation.isInvalidatableInterpolation()) {
             InterpolationEnvironment environment(state);
-            InvalidatableInterpolation::applyStack(interpolationsVectorEntry.value, environment);
+            InvalidatableInterpolation::applyStack(entry.value, environment);
         } else {
             // TODO(alancutter): Remove this old code path once animations have completely migrated to InterpolationTypes.
             toStyleInterpolation(interpolation).apply(state);

diff --git a/third_party/WebKit/Source/core/css/resolver/StyleResourceLoader.h b/third_party/WebKit/Source/core/css/resolver/StyleResourceLoader.h
index f274d0f..97bf1ac 100644
--- a/third_party/WebKit/Source/core/css/resolver/StyleResourceLoader.h
+++ b/third_party/WebKit/Source/core/css/resolver/StyleResourceLoader.h

@@ -41,7 +41,7 @@
 // it expects Document to never change.
 class StyleResourceLoader final {
     WTF_MAKE_NONCOPYABLE(StyleResourceLoader);
-    DISALLOW_ALLOCATION();
+    DISALLOW_NEW();
 public:
     explicit StyleResourceLoader(Document*);
 

diff --git a/third_party/WebKit/Source/core/dom/Attribute.h b/third_party/WebKit/Source/core/dom/Attribute.h
index ced213e..4cb9c08 100644
--- a/third_party/WebKit/Source/core/dom/Attribute.h
+++ b/third_party/WebKit/Source/core/dom/Attribute.h

@@ -34,7 +34,7 @@
 // value. It is distinct from the web-exposed Attr, which also knows of the
 // element to which it attached, if any.
 class Attribute {
-    ALLOW_ONLY_INLINE_ALLOCATION();
+    DISALLOW_NEW_EXCEPT_PLACEMENT_NEW();
 public:
     Attribute(const QualifiedName& name, const AtomicString& value)
         : m_name(name)

diff --git a/third_party/WebKit/Source/core/dom/AttributeCollection.h b/third_party/WebKit/Source/core/dom/AttributeCollection.h
index 467661ee..aa750bf 100644
--- a/third_party/WebKit/Source/core/dom/AttributeCollection.h
+++ b/third_party/WebKit/Source/core/dom/AttributeCollection.h

@@ -77,7 +77,7 @@
 };
 
 class AttributeArray {
-    DISALLOW_ALLOCATION();
+    DISALLOW_NEW();
 public:
     using ValueType = const Attribute;
 

diff --git a/third_party/WebKit/Source/core/dom/DOMArrayPiece.h b/third_party/WebKit/Source/core/dom/DOMArrayPiece.h
index afa2cb6c..a51fe42 100644
--- a/third_party/WebKit/Source/core/dom/DOMArrayPiece.h
+++ b/third_party/WebKit/Source/core/dom/DOMArrayPiece.h

@@ -23,7 +23,7 @@
 // IMPORTANT: The data contained by ArrayPiece is NOT OWNED, so caution must be
 //            taken to ensure it is kept alive.
 class CORE_EXPORT DOMArrayPiece : public WTF::ArrayPiece {
-    DISALLOW_ALLOCATION();
+    DISALLOW_NEW();
 public:
     enum InitWithUnionOption {
         // Initialize this object as "null" when initialized with an union which

diff --git a/third_party/WebKit/Source/core/dom/DocumentEncodingData.h b/third_party/WebKit/Source/core/dom/DocumentEncodingData.h
index da2342bb..6682cc8 100644
--- a/third_party/WebKit/Source/core/dom/DocumentEncodingData.h
+++ b/third_party/WebKit/Source/core/dom/DocumentEncodingData.h

@@ -39,7 +39,7 @@
 class TextResourceDecoder;
 
 class DocumentEncodingData {
-    DISALLOW_ALLOCATION();
+    DISALLOW_NEW();
 public:
     DocumentEncodingData();
     explicit DocumentEncodingData(const TextResourceDecoder&);

diff --git a/third_party/WebKit/Source/core/dom/DocumentLifecycle.h b/third_party/WebKit/Source/core/dom/DocumentLifecycle.h
index 8fec25d..130572e 100644
--- a/third_party/WebKit/Source/core/dom/DocumentLifecycle.h
+++ b/third_party/WebKit/Source/core/dom/DocumentLifecycle.h

@@ -39,7 +39,7 @@
 namespace blink {
 
 class CORE_EXPORT DocumentLifecycle {
-    DISALLOW_ALLOCATION();
+    DISALLOW_NEW();
     WTF_MAKE_NONCOPYABLE(DocumentLifecycle);
 public:
     enum State {
@@ -100,7 +100,7 @@
     };
 
     class DeprecatedTransition {
-        DISALLOW_ALLOCATION();
+        DISALLOW_NEW();
         WTF_MAKE_NONCOPYABLE(DeprecatedTransition);
     public:
         DeprecatedTransition(State from, State to);

diff --git a/third_party/WebKit/Source/core/dom/DocumentOrderedList.h b/third_party/WebKit/Source/core/dom/DocumentOrderedList.h
index a56577f..56fb519 100644
--- a/third_party/WebKit/Source/core/dom/DocumentOrderedList.h
+++ b/third_party/WebKit/Source/core/dom/DocumentOrderedList.h

@@ -37,7 +37,7 @@
 
 class DocumentOrderedList final {
     WTF_MAKE_NONCOPYABLE(DocumentOrderedList);
-    DISALLOW_ALLOCATION();
+    DISALLOW_NEW();
 public:
     DocumentOrderedList() { }
 

diff --git a/third_party/WebKit/Source/core/dom/DocumentTiming.h b/third_party/WebKit/Source/core/dom/DocumentTiming.h
index 9f04851d..68746cd 100644
--- a/third_party/WebKit/Source/core/dom/DocumentTiming.h
+++ b/third_party/WebKit/Source/core/dom/DocumentTiming.h

@@ -33,7 +33,7 @@
 class Document;
 
 class DocumentTiming final {
-    DISALLOW_ALLOCATION();
+    DISALLOW_NEW();
 public:
     explicit DocumentTiming(Document&);
 

diff --git a/third_party/WebKit/Source/core/dom/FrameRequestCallbackCollection.h b/third_party/WebKit/Source/core/dom/FrameRequestCallbackCollection.h
index ed2bc1e..48306f3 100644
--- a/third_party/WebKit/Source/core/dom/FrameRequestCallbackCollection.h
+++ b/third_party/WebKit/Source/core/dom/FrameRequestCallbackCollection.h

@@ -14,7 +14,7 @@
 class FrameRequestCallback;
 
 class CORE_EXPORT FrameRequestCallbackCollection final {
-    DISALLOW_ALLOCATION();
+    DISALLOW_NEW();
 public:
     explicit FrameRequestCallbackCollection(ExecutionContext*);
 

diff --git a/third_party/WebKit/Source/core/dom/IconURL.h b/third_party/WebKit/Source/core/dom/IconURL.h
index 30c159be..661c7bf 100644
--- a/third_party/WebKit/Source/core/dom/IconURL.h
+++ b/third_party/WebKit/Source/core/dom/IconURL.h

@@ -45,7 +45,7 @@
 };
 
 struct IconURL {
-    ALLOW_ONLY_INLINE_ALLOCATION();
+    DISALLOW_NEW_EXCEPT_PLACEMENT_NEW();
     IconType m_iconType;
     Vector<IntSize> m_sizes;
     String m_mimeType;

diff --git a/third_party/WebKit/Source/core/dom/NodeIterator.h b/third_party/WebKit/Source/core/dom/NodeIterator.h
index cf321bc..4a0b5be 100644
--- a/third_party/WebKit/Source/core/dom/NodeIterator.h
+++ b/third_party/WebKit/Source/core/dom/NodeIterator.h

@@ -65,7 +65,7 @@
     NodeIterator(PassRefPtrWillBeRawPtr<Node>, unsigned whatToShow, PassRefPtrWillBeRawPtr<NodeFilter>);
 
     class NodePointer {
-        DISALLOW_ALLOCATION();
+        DISALLOW_NEW();
     public:
         NodePointer();
         NodePointer(PassRefPtrWillBeRawPtr<Node>, bool);

diff --git a/third_party/WebKit/Source/core/dom/PendingScript.h b/third_party/WebKit/Source/core/dom/PendingScript.h
index cfe3630..90be100c 100644
--- a/third_party/WebKit/Source/core/dom/PendingScript.h
+++ b/third_party/WebKit/Source/core/dom/PendingScript.h

@@ -46,7 +46,7 @@
 // from purging its data buffer. This class holds a dummy client open for its
 // lifetime in order to guarantee that the data buffer will not be purged.
 class CORE_EXPORT PendingScript final : public ResourceOwner<ScriptResource> {
-    ALLOW_ONLY_INLINE_ALLOCATION();
+    DISALLOW_NEW_EXCEPT_PLACEMENT_NEW();
 public:
     enum Type {
         ParsingBlocking,

diff --git a/third_party/WebKit/Source/core/dom/QualifiedName.h b/third_party/WebKit/Source/core/dom/QualifiedName.h
index 6902d38..9fe14ab 100644
--- a/third_party/WebKit/Source/core/dom/QualifiedName.h
+++ b/third_party/WebKit/Source/core/dom/QualifiedName.h

@@ -31,7 +31,7 @@
 namespace blink {
 
 struct QualifiedNameComponents {
-    DISALLOW_ALLOCATION();
+    DISALLOW_NEW();
     StringImpl* m_prefix;
     StringImpl* m_localName;
     StringImpl* m_namespace;
@@ -40,7 +40,7 @@
 // This struct is used to pass data between QualifiedName and the QNameTranslator.
 // For hashing and equality only the QualifiedNameComponents fields are used.
 struct QualifiedNameData {
-    DISALLOW_ALLOCATION();
+    DISALLOW_NEW();
     QualifiedNameComponents m_components;
     bool m_isStatic;
 };

diff --git a/third_party/WebKit/Source/core/dom/RangeBoundaryPoint.h b/third_party/WebKit/Source/core/dom/RangeBoundaryPoint.h
index 221de31..ca04c8b 100644
--- a/third_party/WebKit/Source/core/dom/RangeBoundaryPoint.h
+++ b/third_party/WebKit/Source/core/dom/RangeBoundaryPoint.h

@@ -33,7 +33,7 @@
 namespace blink {
 
 class RangeBoundaryPoint {
-    DISALLOW_ALLOCATION();
+    DISALLOW_NEW();
 public:
     explicit RangeBoundaryPoint(PassRefPtrWillBeRawPtr<Node> container);
 

diff --git a/third_party/WebKit/Source/core/dom/SelectorQuery.h b/third_party/WebKit/Source/core/dom/SelectorQuery.h
index e311ac1..08e8639 100644
--- a/third_party/WebKit/Source/core/dom/SelectorQuery.h
+++ b/third_party/WebKit/Source/core/dom/SelectorQuery.h

@@ -44,7 +44,7 @@
 typedef StaticNodeTypeList<Element> StaticElementList;
 
 class SelectorDataList {
-    DISALLOW_ALLOCATION();
+    DISALLOW_NEW();
 public:
     void initialize(const CSSSelectorList&);
     bool matches(Element&) const;

diff --git a/third_party/WebKit/Source/core/dom/StyleChangeReason.h b/third_party/WebKit/Source/core/dom/StyleChangeReason.h
index 8ae0a42..0909210 100644
--- a/third_party/WebKit/Source/core/dom/StyleChangeReason.h
+++ b/third_party/WebKit/Source/core/dom/StyleChangeReason.h

@@ -68,7 +68,7 @@
 // |StyleChangeReasonForTracing| is strictly only for the tracing purpose as
 // described above. Blink logic must not depend on this value.
 class StyleChangeReasonForTracing {
-    DISALLOW_ALLOCATION();
+    DISALLOW_NEW();
 public:
     static StyleChangeReasonForTracing create(StyleChangeReasonString reasonString)
     {

diff --git a/third_party/WebKit/Source/core/dom/StyleEngine.h b/third_party/WebKit/Source/core/dom/StyleEngine.h
index 3bbb861..d801886 100644
--- a/third_party/WebKit/Source/core/dom/StyleEngine.h
+++ b/third_party/WebKit/Source/core/dom/StyleEngine.h

@@ -60,7 +60,7 @@
 public:
 
     class IgnoringPendingStylesheet : public TemporaryChange<bool> {
-        DISALLOW_ALLOCATION();
+        DISALLOW_NEW();
     public:
         IgnoringPendingStylesheet(StyleEngine& engine)
             : TemporaryChange<bool>(engine.m_ignorePendingStylesheets, true)

diff --git a/third_party/WebKit/Source/core/dom/TextLinkColors.h b/third_party/WebKit/Source/core/dom/TextLinkColors.h
index 6615038..4dc1ad1 100644
--- a/third_party/WebKit/Source/core/dom/TextLinkColors.h
+++ b/third_party/WebKit/Source/core/dom/TextLinkColors.h

@@ -37,7 +37,7 @@
 class CSSValue;
 
 class TextLinkColors {
-    DISALLOW_ALLOCATION();
+    DISALLOW_NEW();
     WTF_MAKE_NONCOPYABLE(TextLinkColors);
 public:
     TextLinkColors();

diff --git a/third_party/WebKit/Source/core/dom/UserActionElementSet.h b/third_party/WebKit/Source/core/dom/UserActionElementSet.h
index faa075a9..815ec65 100644
--- a/third_party/WebKit/Source/core/dom/UserActionElementSet.h
+++ b/third_party/WebKit/Source/core/dom/UserActionElementSet.h

@@ -38,7 +38,7 @@
 class Element;
 
 class UserActionElementSet final {
-    DISALLOW_ALLOCATION();
+    DISALLOW_NEW();
 public:
     bool isFocused(const Node* node) { return hasFlags(node, IsFocusedFlag); }
     bool isActive(const Node* node) { return hasFlags(node, IsActiveFlag); }

diff --git a/third_party/WebKit/Source/core/dom/ViewportDescription.h b/third_party/WebKit/Source/core/dom/ViewportDescription.h
index 3d17655..67009e3 100644
--- a/third_party/WebKit/Source/core/dom/ViewportDescription.h
+++ b/third_party/WebKit/Source/core/dom/ViewportDescription.h

@@ -39,7 +39,7 @@
 class LocalFrame;
 
 struct CORE_EXPORT ViewportDescription {
-    DISALLOW_ALLOCATION();
+    DISALLOW_NEW();
 
     enum Type {
         // These are ordered in increasing importance.

diff --git a/third_party/WebKit/Source/core/dom/custom/CustomElementCallbackQueue.cpp b/third_party/WebKit/Source/core/dom/custom/CustomElementCallbackQueue.cpp
index 150909c25..09c270c 100644
--- a/third_party/WebKit/Source/core/dom/custom/CustomElementCallbackQueue.cpp
+++ b/third_party/WebKit/Source/core/dom/custom/CustomElementCallbackQueue.cpp

@@ -31,6 +31,8 @@
 #include "config.h"
 #include "core/dom/custom/CustomElementCallbackQueue.h"
 
+#include "core/dom/shadow/ShadowRoot.h"
+
 namespace blink {
 
 PassOwnPtrWillBeRawPtr<CustomElementCallbackQueue> CustomElementCallbackQueue::create(PassRefPtrWillBeRawPtr<Element> element)
@@ -51,15 +53,20 @@
     ASSERT(!m_inCreatedCallback);
     bool didWork = false;
 
-    while (m_index < m_queue.size() && owner() == caller) {
-        m_inCreatedCallback = m_queue[m_index]->isCreatedCallback();
+    // Never run custom element callbacks in UA shadow roots since that would
+    // leak the UA root and it's elements into the page.
+    ShadowRoot* shadowRoot = m_element->containingShadowRoot();
+    if (!shadowRoot || shadowRoot->type() != ShadowRootType::UserAgent) {
+        while (m_index < m_queue.size() && owner() == caller) {
+            m_inCreatedCallback = m_queue[m_index]->isCreatedCallback();
 
-        // dispatch() may cause recursion which steals this callback
-        // queue and reenters processInQueue. owner() == caller
-        // detects this recursion and cedes processing.
-        m_queue[m_index++]->dispatch(m_element.get());
-        m_inCreatedCallback = false;
-        didWork = true;
+            // dispatch() may cause recursion which steals this callback
+            // queue and reenters processInQueue. owner() == caller
+            // detects this recursion and cedes processing.
+            m_queue[m_index++]->dispatch(m_element.get());
+            m_inCreatedCallback = false;
+            didWork = true;
+        }
     }
 
     if (owner() == caller && m_index == m_queue.size()) {

diff --git a/third_party/WebKit/Source/core/dom/custom/CustomElementDescriptor.h b/third_party/WebKit/Source/core/dom/custom/CustomElementDescriptor.h
index a3573d1..4b8845b9 100644
--- a/third_party/WebKit/Source/core/dom/custom/CustomElementDescriptor.h
+++ b/third_party/WebKit/Source/core/dom/custom/CustomElementDescriptor.h

@@ -42,7 +42,7 @@
 // A Custom Element descriptor is everything necessary to match a
 // Custom Element instance to a definition.
 class CustomElementDescriptor {
-    ALLOW_ONLY_INLINE_ALLOCATION();
+    DISALLOW_NEW_EXCEPT_PLACEMENT_NEW();
 public:
     CustomElementDescriptor(const AtomicString& type, const AtomicString& namespaceURI, const AtomicString& localName)
         : m_type(type)

diff --git a/third_party/WebKit/Source/core/dom/custom/CustomElementRegistry.h b/third_party/WebKit/Source/core/dom/custom/CustomElementRegistry.h
index fd64e68..a5234b4d 100644
--- a/third_party/WebKit/Source/core/dom/custom/CustomElementRegistry.h
+++ b/third_party/WebKit/Source/core/dom/custom/CustomElementRegistry.h

@@ -48,7 +48,7 @@
 
 class CustomElementRegistry final {
     WTF_MAKE_NONCOPYABLE(CustomElementRegistry);
-    DISALLOW_ALLOCATION();
+    DISALLOW_NEW();
 public:
     DECLARE_TRACE();
     void documentWasDetached() { m_documentWasDetached = true; }

diff --git a/third_party/WebKit/Source/core/dom/shadow/DistributedNodes.h b/third_party/WebKit/Source/core/dom/shadow/DistributedNodes.h
index cdd65e8..5a1a881 100644
--- a/third_party/WebKit/Source/core/dom/shadow/DistributedNodes.h
+++ b/third_party/WebKit/Source/core/dom/shadow/DistributedNodes.h

@@ -38,7 +38,7 @@
 namespace blink {
 
 class DistributedNodes final {
-    DISALLOW_ALLOCATION();
+    DISALLOW_NEW();
 public:
     DistributedNodes() { }
 

diff --git a/third_party/WebKit/Source/core/dom/shadow/SelectRuleFeatureSet.h b/third_party/WebKit/Source/core/dom/shadow/SelectRuleFeatureSet.h
index bd5dd31..db322dd 100644
--- a/third_party/WebKit/Source/core/dom/shadow/SelectRuleFeatureSet.h
+++ b/third_party/WebKit/Source/core/dom/shadow/SelectRuleFeatureSet.h

@@ -39,7 +39,7 @@
 class SpaceSplitString;
 
 class SelectRuleFeatureSet : public RuleFeatureSet {
-    DISALLOW_ALLOCATION();
+    DISALLOW_NEW();
 public:
     void collectFeaturesFromSelectorList(const CSSSelectorList&);
     bool checkSelectorsForClassChange(const SpaceSplitString& changedClasses) const;

diff --git a/third_party/WebKit/Source/core/editing/CompositionUnderline.h b/third_party/WebKit/Source/core/editing/CompositionUnderline.h
index b84be49..46ff553 100644
--- a/third_party/WebKit/Source/core/editing/CompositionUnderline.h
+++ b/third_party/WebKit/Source/core/editing/CompositionUnderline.h

@@ -32,7 +32,7 @@
 namespace blink {
 
 struct CompositionUnderline {
-    ALLOW_ONLY_INLINE_ALLOCATION();
+    DISALLOW_NEW_EXCEPT_PLACEMENT_NEW();
     CompositionUnderline()
         : startOffset(0)
         , endOffset(0)

diff --git a/third_party/WebKit/Source/core/editing/EditingStyle.h b/third_party/WebKit/Source/core/editing/EditingStyle.h
index a2ae3c74..0ddcd752 100644
--- a/third_party/WebKit/Source/core/editing/EditingStyle.h
+++ b/third_party/WebKit/Source/core/editing/EditingStyle.h

@@ -169,7 +169,7 @@
 };
 
 class StyleChange {
-    DISALLOW_ALLOCATION();
+    DISALLOW_NEW();
 public:
     StyleChange()
         : m_applyBold(false)

diff --git a/third_party/WebKit/Source/core/editing/Position.h b/third_party/WebKit/Source/core/editing/Position.h
index 22ed4be7..7a166380 100644
--- a/third_party/WebKit/Source/core/editing/Position.h
+++ b/third_party/WebKit/Source/core/editing/Position.h

@@ -56,7 +56,7 @@
 // Instances of |PositionTemplate<Strategy>| are immutable.
 template <typename Strategy>
 class CORE_TEMPLATE_CLASS_EXPORT PositionTemplate {
-    DISALLOW_ALLOCATION();
+    DISALLOW_NEW();
 public:
 
     PositionTemplate()

diff --git a/third_party/WebKit/Source/core/editing/PositionWithAffinity.h b/third_party/WebKit/Source/core/editing/PositionWithAffinity.h
index be44211..e8b34aa 100644
--- a/third_party/WebKit/Source/core/editing/PositionWithAffinity.h
+++ b/third_party/WebKit/Source/core/editing/PositionWithAffinity.h

@@ -13,7 +13,7 @@
 
 template <typename Strategy>
 class CORE_TEMPLATE_CLASS_EXPORT PositionWithAffinityTemplate {
-    DISALLOW_ALLOCATION();
+    DISALLOW_NEW();
 public:
     // TODO(yosin) We should have single parameter constructor not to use
     // default parameter for avoiding include "TextAffinity.h"

diff --git a/third_party/WebKit/Source/core/editing/VisiblePosition.h b/third_party/WebKit/Source/core/editing/VisiblePosition.h
index c84fb8db..313f7df 100644
--- a/third_party/WebKit/Source/core/editing/VisiblePosition.h
+++ b/third_party/WebKit/Source/core/editing/VisiblePosition.h

@@ -69,7 +69,7 @@
 // otherwise it will be converted to DOWNSTREAM.
 template <typename Strategy>
 class CORE_TEMPLATE_CLASS_EXPORT VisiblePositionTemplate final {
-    DISALLOW_ALLOCATION();
+    DISALLOW_NEW();
 public:
     VisiblePositionTemplate();
 

diff --git a/third_party/WebKit/Source/core/editing/VisibleSelection.h b/third_party/WebKit/Source/core/editing/VisibleSelection.h
index b48f176..8552b19 100644
--- a/third_party/WebKit/Source/core/editing/VisibleSelection.h
+++ b/third_party/WebKit/Source/core/editing/VisibleSelection.h

@@ -61,7 +61,7 @@
 
 template <typename Strategy>
 class CORE_TEMPLATE_CLASS_EXPORT VisibleSelectionTemplate {
-    DISALLOW_ALLOCATION();
+    DISALLOW_NEW();
     DECLARE_EMPTY_DESTRUCTOR_WILL_BE_REMOVED(VisibleSelectionTemplate);
 public:
     VisibleSelectionTemplate();

diff --git a/third_party/WebKit/Source/core/editing/commands/ApplyStyleCommand.cpp b/third_party/WebKit/Source/core/editing/commands/ApplyStyleCommand.cpp
index d7f3c83..4b46d35d 100644
--- a/third_party/WebKit/Source/core/editing/commands/ApplyStyleCommand.cpp
+++ b/third_party/WebKit/Source/core/editing/commands/ApplyStyleCommand.cpp

@@ -742,7 +742,7 @@
 }
 
 class InlineRunToApplyStyle {
-    ALLOW_ONLY_INLINE_ALLOCATION();
+    DISALLOW_NEW_EXCEPT_PLACEMENT_NEW();
 public:
     InlineRunToApplyStyle(Node* start, Node* end, Node* pastEndNode)
         : start(start)

diff --git a/third_party/WebKit/Source/core/editing/serializers/Serialization.cpp b/third_party/WebKit/Source/core/editing/serializers/Serialization.cpp
index 68ff853..e57f06c8 100644
--- a/third_party/WebKit/Source/core/editing/serializers/Serialization.cpp
+++ b/third_party/WebKit/Source/core/editing/serializers/Serialization.cpp

@@ -73,7 +73,7 @@
 using namespace HTMLNames;
 
 class AttributeChange {
-    ALLOW_ONLY_INLINE_ALLOCATION();
+    DISALLOW_NEW_EXCEPT_PLACEMENT_NEW();
 public:
     AttributeChange()
         : m_name(nullAtom, nullAtom, nullAtom)

diff --git a/third_party/WebKit/Source/core/events/EventListenerMap.h b/third_party/WebKit/Source/core/events/EventListenerMap.h
index 027efb9..808b10a 100644
--- a/third_party/WebKit/Source/core/events/EventListenerMap.h
+++ b/third_party/WebKit/Source/core/events/EventListenerMap.h

@@ -48,7 +48,7 @@
 
 class CORE_EXPORT EventListenerMap {
     WTF_MAKE_NONCOPYABLE(EventListenerMap);
-    DISALLOW_ALLOCATION();
+    DISALLOW_NEW();
 public:
     EventListenerMap();
 

diff --git a/third_party/WebKit/Source/core/events/EventTarget.h b/third_party/WebKit/Source/core/events/EventTarget.h
index c8466cc..acd8940 100644
--- a/third_party/WebKit/Source/core/events/EventTarget.h
+++ b/third_party/WebKit/Source/core/events/EventTarget.h

@@ -52,7 +52,7 @@
 class Node;
 
 struct FiringEventIterator {
-    ALLOW_ONLY_INLINE_ALLOCATION();
+    DISALLOW_NEW_EXCEPT_PLACEMENT_NEW();
     FiringEventIterator(const AtomicString& eventType, size_t& iterator, size_t& end)
         : eventType(eventType)
         , iterator(iterator)

diff --git a/third_party/WebKit/Source/core/events/NodeEventContext.h b/third_party/WebKit/Source/core/events/NodeEventContext.h
index 0f0b795..b3588cc 100644
--- a/third_party/WebKit/Source/core/events/NodeEventContext.h
+++ b/third_party/WebKit/Source/core/events/NodeEventContext.h

@@ -39,7 +39,7 @@
 class TouchEventContext;
 
 class CORE_EXPORT NodeEventContext {
-    ALLOW_ONLY_INLINE_ALLOCATION();
+    DISALLOW_NEW_EXCEPT_PLACEMENT_NEW();
     DECLARE_EMPTY_DESTRUCTOR_WILL_BE_REMOVED(NodeEventContext);
 public:
     // FIXME: Use ContainerNode instead of Node.

diff --git a/third_party/WebKit/Source/core/events/PointerIdManager.h b/third_party/WebKit/Source/core/events/PointerIdManager.h
index 0eba3f48b..b3e0134 100644
--- a/third_party/WebKit/Source/core/events/PointerIdManager.h
+++ b/third_party/WebKit/Source/core/events/PointerIdManager.h

@@ -15,7 +15,7 @@
   Helper class for tracking the primary pointer id for each type of PointerEvents.
 */
 class PointerIdManager {
-    DISALLOW_ALLOCATION();
+    DISALLOW_NEW();
 public:
     PointerIdManager();
     ~PointerIdManager();

diff --git a/third_party/WebKit/Source/core/events/RegisteredEventListener.h b/third_party/WebKit/Source/core/events/RegisteredEventListener.h
index 98c5bc0..6549bb2d 100644
--- a/third_party/WebKit/Source/core/events/RegisteredEventListener.h
+++ b/third_party/WebKit/Source/core/events/RegisteredEventListener.h

@@ -30,7 +30,7 @@
 namespace blink {
 
 class RegisteredEventListener {
-    ALLOW_ONLY_INLINE_ALLOCATION();
+    DISALLOW_NEW_EXCEPT_PLACEMENT_NEW();
 public:
     RegisteredEventListener(PassRefPtrWillBeRawPtr<EventListener> listener, const EventListenerOptions& options)
         : listener(listener)

diff --git a/third_party/WebKit/Source/core/fetch/ClientHintsPreferences.h b/third_party/WebKit/Source/core/fetch/ClientHintsPreferences.h
index b5cd2d7f1..81c4cf81 100644
--- a/third_party/WebKit/Source/core/fetch/ClientHintsPreferences.h
+++ b/third_party/WebKit/Source/core/fetch/ClientHintsPreferences.h

@@ -14,7 +14,7 @@
 class ResourceFetcher;
 
 class CORE_EXPORT ClientHintsPreferences {
-    DISALLOW_ALLOCATION();
+    DISALLOW_NEW();
 public:
     ClientHintsPreferences();
 

diff --git a/third_party/WebKit/Source/core/fetch/FetchInitiatorInfo.h b/third_party/WebKit/Source/core/fetch/FetchInitiatorInfo.h
index 25a7b29..a9490a48 100644
--- a/third_party/WebKit/Source/core/fetch/FetchInitiatorInfo.h
+++ b/third_party/WebKit/Source/core/fetch/FetchInitiatorInfo.h

@@ -33,7 +33,7 @@
 namespace blink {
 
 struct FetchInitiatorInfo {
-    DISALLOW_ALLOCATION();
+    DISALLOW_NEW();
     FetchInitiatorInfo()
         : name()
         , position(TextPosition::belowRangePosition())
@@ -50,7 +50,7 @@
 
 // Encode AtomicString as String to cross threads.
 struct CrossThreadFetchInitiatorInfoData {
-    DISALLOW_ALLOCATION();
+    DISALLOW_NEW();
     explicit CrossThreadFetchInitiatorInfoData(const FetchInitiatorInfo& info)
         : name(info.name.string().isolatedCopy())
         , position(info.position)

diff --git a/third_party/WebKit/Source/core/fetch/FetchRequest.h b/third_party/WebKit/Source/core/fetch/FetchRequest.h
index 93311e9..b476fbf 100644
--- a/third_party/WebKit/Source/core/fetch/FetchRequest.h
+++ b/third_party/WebKit/Source/core/fetch/FetchRequest.h

@@ -46,7 +46,7 @@
     enum OriginRestriction { UseDefaultOriginRestrictionForType, RestrictToSameOrigin, NoOriginRestriction };
 
     struct ResourceWidth {
-        DISALLOW_ALLOCATION();
+        DISALLOW_NEW();
         float width;
         bool isSet;
 

diff --git a/third_party/WebKit/Source/core/fetch/MemoryCache.h b/third_party/WebKit/Source/core/fetch/MemoryCache.h
index 72cfa060..b0085ca 100644
--- a/third_party/WebKit/Source/core/fetch/MemoryCache.h
+++ b/third_party/WebKit/Source/core/fetch/MemoryCache.h

@@ -116,7 +116,7 @@
 // MemoryCacheLRUList an inner struct of MemoryCache because we can't define
 // VectorTraits for inner structs.
 struct MemoryCacheLRUList final {
-    ALLOW_ONLY_INLINE_ALLOCATION();
+    DISALLOW_NEW_EXCEPT_PLACEMENT_NEW();
 public:
     Member<MemoryCacheEntry> m_head;
     Member<MemoryCacheEntry> m_tail;

diff --git a/third_party/WebKit/Source/core/fetch/Resource.h b/third_party/WebKit/Source/core/fetch/Resource.h
index dbd56ba..89a88ea 100644
--- a/third_party/WebKit/Source/core/fetch/Resource.h
+++ b/third_party/WebKit/Source/core/fetch/Resource.h

@@ -332,7 +332,7 @@
     bool hasClient(ResourceClient* client) { return m_clients.contains(client) || m_clientsAwaitingCallback.contains(client) || m_finishedClients.contains(client); }
 
     struct RedirectPair {
-        ALLOW_ONLY_INLINE_ALLOCATION();
+        DISALLOW_NEW_EXCEPT_PLACEMENT_NEW();
     public:
         explicit RedirectPair(const ResourceRequest& request, const ResourceResponse& redirectResponse)
             : m_request(request)

diff --git a/third_party/WebKit/Source/core/fetch/ResourceFetcher.h b/third_party/WebKit/Source/core/fetch/ResourceFetcher.h
index 6eb6a28..56c8488 100644
--- a/third_party/WebKit/Source/core/fetch/ResourceFetcher.h
+++ b/third_party/WebKit/Source/core/fetch/ResourceFetcher.h

@@ -206,7 +206,7 @@
 
     // Used in hit rate histograms.
     class DeadResourceStatsRecorder {
-        DISALLOW_ALLOCATION();
+        DISALLOW_NEW();
     public:
         DeadResourceStatsRecorder();
         ~DeadResourceStatsRecorder();

diff --git a/third_party/WebKit/Source/core/fetch/ResourceLoaderOptions.h b/third_party/WebKit/Source/core/fetch/ResourceLoaderOptions.h
index 0e0e0e9..f1b765d 100644
--- a/third_party/WebKit/Source/core/fetch/ResourceLoaderOptions.h
+++ b/third_party/WebKit/Source/core/fetch/ResourceLoaderOptions.h

@@ -140,7 +140,7 @@
 
 // Encode AtomicString (in FetchInitiatorInfo) as String to cross threads.
 struct CrossThreadResourceLoaderOptionsData {
-    DISALLOW_ALLOCATION();
+    DISALLOW_NEW();
     explicit CrossThreadResourceLoaderOptionsData(const ResourceLoaderOptions& options)
         : dataBufferingPolicy(options.dataBufferingPolicy)
         , allowCredentials(options.allowCredentials)

diff --git a/third_party/WebKit/Source/core/fetch/ResourcePtr.h b/third_party/WebKit/Source/core/fetch/ResourcePtr.h
index 2f21fb6a..52554da 100644
--- a/third_party/WebKit/Source/core/fetch/ResourcePtr.h
+++ b/third_party/WebKit/Source/core/fetch/ResourcePtr.h

@@ -33,7 +33,7 @@
 namespace blink {
 
 class CORE_EXPORT ResourcePtrBase {
-    ALLOW_ONLY_INLINE_ALLOCATION();
+    DISALLOW_NEW_EXCEPT_PLACEMENT_NEW();
 public:
     Resource* get() const { return m_resource; }
     bool operator!() const { return !m_resource; }

diff --git a/third_party/WebKit/Source/core/fetch/SubstituteData.h b/third_party/WebKit/Source/core/fetch/SubstituteData.h
index 43f98ae..65fdeff 100644
--- a/third_party/WebKit/Source/core/fetch/SubstituteData.h
+++ b/third_party/WebKit/Source/core/fetch/SubstituteData.h

@@ -40,7 +40,7 @@
 };
 
 class SubstituteData {
-    DISALLOW_ALLOCATION();
+    DISALLOW_NEW();
 public:
     SubstituteData()
         : m_substituteDataLoadPolicy(LoadNormally)

diff --git a/third_party/WebKit/Source/core/frame/DOMTimerCoordinator.h b/third_party/WebKit/Source/core/frame/DOMTimerCoordinator.h
index 3e565d3..69c8d222 100644
--- a/third_party/WebKit/Source/core/frame/DOMTimerCoordinator.h
+++ b/third_party/WebKit/Source/core/frame/DOMTimerCoordinator.h

@@ -22,7 +22,7 @@
 // also tracks recursive creation or iterative scheduling of timers,
 // which is used as a signal for throttling repetitive timers.
 class DOMTimerCoordinator {
-    DISALLOW_ALLOCATION();
+    DISALLOW_NEW();
     WTF_MAKE_NONCOPYABLE(DOMTimerCoordinator);
 public:
     explicit DOMTimerCoordinator(PassOwnPtr<WebTaskRunner>);

diff --git a/third_party/WebKit/Source/core/frame/LayoutSubtreeRootList.h b/third_party/WebKit/Source/core/frame/LayoutSubtreeRootList.h
index e7f79c9..08f01ebe 100644
--- a/third_party/WebKit/Source/core/frame/LayoutSubtreeRootList.h
+++ b/third_party/WebKit/Source/core/frame/LayoutSubtreeRootList.h

@@ -28,7 +28,7 @@
 // TODO(leviw): This should really be something akin to a LayoutController
 // that FrameView delegates layout work to.
 class LayoutSubtreeRootList {
-    DISALLOW_ALLOCATION();
+    DISALLOW_NEW();
 public:
     LayoutSubtreeRootList()
     { }

diff --git a/third_party/WebKit/Source/core/frame/OriginsUsingFeatures.h b/third_party/WebKit/Source/core/frame/OriginsUsingFeatures.h
index e289738..4e8e449 100644
--- a/third_party/WebKit/Source/core/frame/OriginsUsingFeatures.h
+++ b/third_party/WebKit/Source/core/frame/OriginsUsingFeatures.h

@@ -19,7 +19,7 @@
 class ScriptState;
 
 class CORE_EXPORT OriginsUsingFeatures {
-    DISALLOW_ALLOCATION();
+    DISALLOW_NEW();
 public:
     ~OriginsUsingFeatures();
 
@@ -47,7 +47,7 @@
     void updateMeasurementsAndClear();
 
     class CORE_EXPORT Value {
-        ALLOW_ONLY_INLINE_ALLOCATION();
+        DISALLOW_NEW_EXCEPT_PLACEMENT_NEW();
     public:
         Value();
 

diff --git a/third_party/WebKit/Source/core/frame/PageScaleConstraints.h b/third_party/WebKit/Source/core/frame/PageScaleConstraints.h
index 1e8dd963..8b0d90f 100644
--- a/third_party/WebKit/Source/core/frame/PageScaleConstraints.h
+++ b/third_party/WebKit/Source/core/frame/PageScaleConstraints.h

@@ -38,7 +38,7 @@
 namespace blink {
 
 struct CORE_EXPORT PageScaleConstraints {
-    DISALLOW_ALLOCATION();
+    DISALLOW_NEW();
     FloatSize layoutSize;
 
     float initialScale;

diff --git a/third_party/WebKit/Source/core/frame/SettingsDelegate.h b/third_party/WebKit/Source/core/frame/SettingsDelegate.h
index f597853..624bb6c 100644
--- a/third_party/WebKit/Source/core/frame/SettingsDelegate.h
+++ b/third_party/WebKit/Source/core/frame/SettingsDelegate.h

@@ -41,7 +41,7 @@
 class Settings;
 
 class CORE_EXPORT SettingsDelegate {
-    DISALLOW_ALLOCATION();
+    DISALLOW_NEW();
 public:
     explicit SettingsDelegate(PassOwnPtr<Settings>);
     virtual ~SettingsDelegate();

diff --git a/third_party/WebKit/Source/core/frame/UseCounter.h b/third_party/WebKit/Source/core/frame/UseCounter.h
index bfe35ee9..8d912a45 100644
--- a/third_party/WebKit/Source/core/frame/UseCounter.h
+++ b/third_party/WebKit/Source/core/frame/UseCounter.h

@@ -56,7 +56,7 @@
 // http://www.google.com/chrome/intl/en/privacy.html
 
 class CORE_EXPORT UseCounter {
-    DISALLOW_ALLOCATION();
+    DISALLOW_NEW();
     WTF_MAKE_NONCOPYABLE(UseCounter);
 public:
     UseCounter();
@@ -916,7 +916,7 @@
     static void unmuteForInspector();
 
     class CountBits {
-        DISALLOW_ALLOCATION();
+        DISALLOW_NEW();
     public:
         CountBits() : m_bits(NumberOfFeatures) { }
 

diff --git a/third_party/WebKit/Source/core/frame/csp/CSPSourceList.h b/third_party/WebKit/Source/core/frame/csp/CSPSourceList.h
index fceb815..2d926321 100644
--- a/third_party/WebKit/Source/core/frame/csp/CSPSourceList.h
+++ b/third_party/WebKit/Source/core/frame/csp/CSPSourceList.h

@@ -18,7 +18,7 @@
 class KURL;
 
 class CORE_EXPORT CSPSourceList {
-    DISALLOW_ALLOCATION();
+    DISALLOW_NEW();
     WTF_MAKE_NONCOPYABLE(CSPSourceList);
 public:
     CSPSourceList(ContentSecurityPolicy*, const String& directiveName);

diff --git a/third_party/WebKit/Source/core/html/CollectionIndexCache.h b/third_party/WebKit/Source/core/html/CollectionIndexCache.h
index fd70e98..104cbde 100644
--- a/third_party/WebKit/Source/core/html/CollectionIndexCache.h
+++ b/third_party/WebKit/Source/core/html/CollectionIndexCache.h

@@ -36,7 +36,7 @@
 
 template <typename Collection, typename NodeType>
 class CollectionIndexCache {
-    DISALLOW_ALLOCATION();
+    DISALLOW_NEW();
 public:
     CollectionIndexCache();
 

diff --git a/third_party/WebKit/Source/core/html/CollectionItemsCache.h b/third_party/WebKit/Source/core/html/CollectionItemsCache.h
index a86598a5..f288ce7 100644
--- a/third_party/WebKit/Source/core/html/CollectionItemsCache.h
+++ b/third_party/WebKit/Source/core/html/CollectionItemsCache.h

@@ -40,7 +40,7 @@
 
 template <typename Collection, typename NodeType>
 class CollectionItemsCache : public CollectionIndexCache<Collection, NodeType> {
-    DISALLOW_ALLOCATION();
+    DISALLOW_NEW();
 
     typedef CollectionIndexCache<Collection, NodeType> Base;
 

diff --git a/third_party/WebKit/Source/core/html/HTMLDimension.h b/third_party/WebKit/Source/core/html/HTMLDimension.h
index 33c0e3c..6b3bc2f 100644
--- a/third_party/WebKit/Source/core/html/HTMLDimension.h
+++ b/third_party/WebKit/Source/core/html/HTMLDimension.h

@@ -41,7 +41,7 @@
 // This class corresponds to a dimension as described in HTML5 by the
 // "rules for parsing a list of dimensions" (section 2.4.4.6).
 class HTMLDimension {
-    ALLOW_ONLY_INLINE_ALLOCATION();
+    DISALLOW_NEW_EXCEPT_PLACEMENT_NEW();
 public:
     enum HTMLDimensionType {
         Relative, Percentage, Absolute

diff --git a/third_party/WebKit/Source/core/html/HTMLMediaElement.h b/third_party/WebKit/Source/core/html/HTMLMediaElement.h
index cc59b2c..bd89bc1 100644
--- a/third_party/WebKit/Source/core/html/HTMLMediaElement.h
+++ b/third_party/WebKit/Source/core/html/HTMLMediaElement.h

@@ -584,7 +584,7 @@
     // AudioSourceProviderImpl wraps a WebAudioSourceProvider.
     // provideInput() calls into Chromium to get a rendered audio stream.
     class AudioSourceProviderImpl final : public AudioSourceProvider {
-        DISALLOW_ALLOCATION();
+        DISALLOW_NEW();
     public:
         AudioSourceProviderImpl()
             : m_webAudioSourceProvider(nullptr)

diff --git a/third_party/WebKit/Source/core/html/LinkRelAttribute.h b/third_party/WebKit/Source/core/html/LinkRelAttribute.h
index bcbad35f..94f7f49 100644
--- a/third_party/WebKit/Source/core/html/LinkRelAttribute.h
+++ b/third_party/WebKit/Source/core/html/LinkRelAttribute.h

@@ -40,7 +40,7 @@
 namespace blink {
 
 class CORE_EXPORT LinkRelAttribute {
-    DISALLOW_ALLOCATION();
+    DISALLOW_NEW();
 public:
     explicit LinkRelAttribute(const String& = "");
 

diff --git a/third_party/WebKit/Source/core/html/TimeRanges.h b/third_party/WebKit/Source/core/html/TimeRanges.h
index 1ae926e..3eb3f04 100644
--- a/third_party/WebKit/Source/core/html/TimeRanges.h
+++ b/third_party/WebKit/Source/core/html/TimeRanges.h

@@ -44,7 +44,7 @@
 public:
     // We consider all the Ranges to be semi-bounded as follow: [start, end[
     struct Range {
-        ALLOW_ONLY_INLINE_ALLOCATION();
+        DISALLOW_NEW_EXCEPT_PLACEMENT_NEW();
     public:
         Range() { }
         Range(double start, double end)

diff --git a/third_party/WebKit/Source/core/html/forms/DateTimeChooser.h b/third_party/WebKit/Source/core/html/forms/DateTimeChooser.h
index 0a88a6d..7f46aa62 100644
--- a/third_party/WebKit/Source/core/html/forms/DateTimeChooser.h
+++ b/third_party/WebKit/Source/core/html/forms/DateTimeChooser.h

@@ -42,14 +42,14 @@
 class AXObject;
 
 struct DateTimeSuggestion {
-    ALLOW_ONLY_INLINE_ALLOCATION();
+    DISALLOW_NEW_EXCEPT_PLACEMENT_NEW();
     double value;
     String localizedValue;
     String label;
 };
 
 struct DateTimeChooserParameters {
-    DISALLOW_ALLOCATION();
+    DISALLOW_NEW();
     AtomicString type;
     IntRect anchorRectInRootFrame;
     IntRect anchorRectInScreen;

diff --git a/third_party/WebKit/Source/core/html/forms/FormController.h b/third_party/WebKit/Source/core/html/forms/FormController.h
index feb6aec..d09781c 100644
--- a/third_party/WebKit/Source/core/html/forms/FormController.h
+++ b/third_party/WebKit/Source/core/html/forms/FormController.h

@@ -38,7 +38,7 @@
 class SavedFormState;
 
 class FormControlState {
-    ALLOW_ONLY_INLINE_ALLOCATION();
+    DISALLOW_NEW_EXCEPT_PLACEMENT_NEW();
 public:
     FormControlState() : m_type(TypeSkip) { }
     explicit FormControlState(const String& value) : m_type(TypeRestore) { m_values.append(value); }

diff --git a/third_party/WebKit/Source/core/html/forms/RadioButtonGroupScope.h b/third_party/WebKit/Source/core/html/forms/RadioButtonGroupScope.h
index af99f54..48c6e2f 100644
--- a/third_party/WebKit/Source/core/html/forms/RadioButtonGroupScope.h
+++ b/third_party/WebKit/Source/core/html/forms/RadioButtonGroupScope.h

@@ -33,7 +33,7 @@
 class RadioButtonGroup;
 
 class RadioButtonGroupScope {
-    DISALLOW_ALLOCATION();
+    DISALLOW_NEW();
 public:
     RadioButtonGroupScope();
     ~RadioButtonGroupScope();

diff --git a/third_party/WebKit/Source/core/html/forms/StepRange.h b/third_party/WebKit/Source/core/html/forms/StepRange.h
index fad8cf7..bde8f1c 100644
--- a/third_party/WebKit/Source/core/html/forms/StepRange.h
+++ b/third_party/WebKit/Source/core/html/forms/StepRange.h

@@ -31,7 +31,7 @@
 enum AnyStepHandling { RejectAny, AnyIsDefaultStep };
 
 class CORE_EXPORT StepRange {
-    DISALLOW_ALLOCATION();
+    DISALLOW_NEW();
 public:
     enum StepValueShouldBe {
         StepValueShouldBeReal,

diff --git a/third_party/WebKit/Source/core/html/forms/TypeAhead.h b/third_party/WebKit/Source/core/html/forms/TypeAhead.h
index 67cebdc9..ca6d206 100644
--- a/third_party/WebKit/Source/core/html/forms/TypeAhead.h
+++ b/third_party/WebKit/Source/core/html/forms/TypeAhead.h

@@ -45,7 +45,7 @@
 };
 
 class TypeAhead {
-    DISALLOW_ALLOCATION();
+    DISALLOW_NEW();
 public:
     TypeAhead(TypeAheadDataSource*);
 

diff --git a/third_party/WebKit/Source/core/html/imports/HTMLImportState.h b/third_party/WebKit/Source/core/html/imports/HTMLImportState.h
index d8423acc..2b8171d 100644
--- a/third_party/WebKit/Source/core/html/imports/HTMLImportState.h
+++ b/third_party/WebKit/Source/core/html/imports/HTMLImportState.h

@@ -37,7 +37,7 @@
 namespace blink {
 
 class HTMLImportState {
-    DISALLOW_ALLOCATION();
+    DISALLOW_NEW();
 public:
     enum Value {
         BlockingScriptExecution = 0,

diff --git a/third_party/WebKit/Source/core/html/parser/BackgroundHTMLInputStream.h b/third_party/WebKit/Source/core/html/parser/BackgroundHTMLInputStream.h
index 7044f993..8a70ab1b 100644
--- a/third_party/WebKit/Source/core/html/parser/BackgroundHTMLInputStream.h
+++ b/third_party/WebKit/Source/core/html/parser/BackgroundHTMLInputStream.h

@@ -36,7 +36,7 @@
 typedef size_t HTMLInputCheckpoint;
 
 class BackgroundHTMLInputStream {
-    DISALLOW_ALLOCATION();
+    DISALLOW_NEW();
     WTF_MAKE_NONCOPYABLE(BackgroundHTMLInputStream);
 public:
     BackgroundHTMLInputStream();

diff --git a/third_party/WebKit/Source/core/html/parser/CSSPreloadScanner.h b/third_party/WebKit/Source/core/html/parser/CSSPreloadScanner.h
index e88fec8..c75e4c7 100644
--- a/third_party/WebKit/Source/core/html/parser/CSSPreloadScanner.h
+++ b/third_party/WebKit/Source/core/html/parser/CSSPreloadScanner.h

@@ -36,7 +36,7 @@
 class SegmentedString;
 
 class CSSPreloadScanner {
-    DISALLOW_ALLOCATION();
+    DISALLOW_NEW();
     WTF_MAKE_NONCOPYABLE(CSSPreloadScanner);
 public:
     CSSPreloadScanner();

diff --git a/third_party/WebKit/Source/core/html/parser/CompactHTMLToken.h b/third_party/WebKit/Source/core/html/parser/CompactHTMLToken.h
index 34e37c1..9947986 100644
--- a/third_party/WebKit/Source/core/html/parser/CompactHTMLToken.h
+++ b/third_party/WebKit/Source/core/html/parser/CompactHTMLToken.h

@@ -37,10 +37,10 @@
 class QualifiedName;
 
 class CORE_EXPORT CompactHTMLToken {
-    ALLOW_ONLY_INLINE_ALLOCATION();
+    DISALLOW_NEW_EXCEPT_PLACEMENT_NEW();
 public:
     struct Attribute {
-        ALLOW_ONLY_INLINE_ALLOCATION();
+        DISALLOW_NEW_EXCEPT_PLACEMENT_NEW();
         Attribute(const String& name, const String& value)
             : name(name)
             , value(value)

diff --git a/third_party/WebKit/Source/core/html/parser/HTMLConstructionSite.h b/third_party/WebKit/Source/core/html/parser/HTMLConstructionSite.h
index 6aeb1524..812b072 100644
--- a/third_party/WebKit/Source/core/html/parser/HTMLConstructionSite.h
+++ b/third_party/WebKit/Source/core/html/parser/HTMLConstructionSite.h

@@ -40,7 +40,7 @@
 namespace blink {
 
 struct HTMLConstructionSiteTask {
-    ALLOW_ONLY_INLINE_ALLOCATION();
+    DISALLOW_NEW_EXCEPT_PLACEMENT_NEW();
 public:
     enum Operation {
         Insert,
@@ -107,7 +107,7 @@
 
 class HTMLConstructionSite final {
     WTF_MAKE_NONCOPYABLE(HTMLConstructionSite);
-    DISALLOW_ALLOCATION();
+    DISALLOW_NEW();
 public:
     HTMLConstructionSite(Document*, ParserContentPolicy);
     HTMLConstructionSite(DocumentFragment*, ParserContentPolicy);
@@ -258,7 +258,7 @@
     TaskQueue m_taskQueue;
 
     class PendingText final {
-        DISALLOW_ALLOCATION();
+        DISALLOW_NEW();
     public:
         PendingText()
             : whitespaceMode(WhitespaceUnknown)

diff --git a/third_party/WebKit/Source/core/html/parser/HTMLElementStack.h b/third_party/WebKit/Source/core/html/parser/HTMLElementStack.h
index 3452b6558..692e02a 100644
--- a/third_party/WebKit/Source/core/html/parser/HTMLElementStack.h
+++ b/third_party/WebKit/Source/core/html/parser/HTMLElementStack.h

@@ -44,7 +44,7 @@
 // more standard (grows upwards) stack terminology here.
 class HTMLElementStack {
     WTF_MAKE_NONCOPYABLE(HTMLElementStack);
-    DISALLOW_ALLOCATION();
+    DISALLOW_NEW();
 public:
     HTMLElementStack();
     ~HTMLElementStack();

diff --git a/third_party/WebKit/Source/core/html/parser/HTMLEntityTable.h b/third_party/WebKit/Source/core/html/parser/HTMLEntityTable.h
index 142e73e2..379c557 100644
--- a/third_party/WebKit/Source/core/html/parser/HTMLEntityTable.h
+++ b/third_party/WebKit/Source/core/html/parser/HTMLEntityTable.h

@@ -33,7 +33,7 @@
 
 // Member order to optimize packing. There will be thousands of these objects.
 struct HTMLEntityTableEntry {
-    DISALLOW_ALLOCATION();
+    DISALLOW_NEW();
     LChar lastCharacter() const;
 
     UChar32 firstValue;

diff --git a/third_party/WebKit/Source/core/html/parser/HTMLFormattingElementList.h b/third_party/WebKit/Source/core/html/parser/HTMLFormattingElementList.h
index 1d0bb41..118a21f 100644
--- a/third_party/WebKit/Source/core/html/parser/HTMLFormattingElementList.h
+++ b/third_party/WebKit/Source/core/html/parser/HTMLFormattingElementList.h

@@ -38,7 +38,7 @@
 // This may end up merged into HTMLElementStack.
 class HTMLFormattingElementList {
     WTF_MAKE_NONCOPYABLE(HTMLFormattingElementList);
-    DISALLOW_ALLOCATION();
+    DISALLOW_NEW();
 public:
     HTMLFormattingElementList();
     ~HTMLFormattingElementList();
@@ -47,7 +47,7 @@
     // between the HTMLFormattingElementList and HTMLElementStack and needs
     // access to Entry::isMarker() and Entry::replaceElement() to do so.
     class Entry {
-        ALLOW_ONLY_INLINE_ALLOCATION();
+        DISALLOW_NEW_EXCEPT_PLACEMENT_NEW();
     public:
         // Inline because they're hot and Vector<T> uses them.
         explicit Entry(PassRefPtrWillBeRawPtr<HTMLStackItem> item)

diff --git a/third_party/WebKit/Source/core/html/parser/HTMLInputStream.h b/third_party/WebKit/Source/core/html/parser/HTMLInputStream.h
index 89de9f8..25ceac14 100644
--- a/third_party/WebKit/Source/core/html/parser/HTMLInputStream.h
+++ b/third_party/WebKit/Source/core/html/parser/HTMLInputStream.h

@@ -50,7 +50,7 @@
 // The network adds data at the end of the InputStream, which appends
 // them to the "last" string.
 class HTMLInputStream {
-    DISALLOW_ALLOCATION();
+    DISALLOW_NEW();
     WTF_MAKE_NONCOPYABLE(HTMLInputStream);
 public:
     HTMLInputStream()

diff --git a/third_party/WebKit/Source/core/html/parser/HTMLParserOptions.h b/third_party/WebKit/Source/core/html/parser/HTMLParserOptions.h
index 2619b088..adaa4f3 100644
--- a/third_party/WebKit/Source/core/html/parser/HTMLParserOptions.h
+++ b/third_party/WebKit/Source/core/html/parser/HTMLParserOptions.h

@@ -34,7 +34,7 @@
 class Document;
 
 class CORE_EXPORT HTMLParserOptions {
-    DISALLOW_ALLOCATION();
+    DISALLOW_NEW();
 public:
     bool scriptEnabled;
     bool pluginsEnabled;

diff --git a/third_party/WebKit/Source/core/html/parser/HTMLSourceTracker.h b/third_party/WebKit/Source/core/html/parser/HTMLSourceTracker.h
index 5f4d369..2141165 100644
--- a/third_party/WebKit/Source/core/html/parser/HTMLSourceTracker.h
+++ b/third_party/WebKit/Source/core/html/parser/HTMLSourceTracker.h

@@ -35,7 +35,7 @@
 class HTMLTokenizer;
 
 class HTMLSourceTracker {
-    DISALLOW_ALLOCATION();
+    DISALLOW_NEW();
     WTF_MAKE_NONCOPYABLE(HTMLSourceTracker);
 public:
     HTMLSourceTracker();

diff --git a/third_party/WebKit/Source/core/html/parser/HTMLSrcsetParser.h b/third_party/WebKit/Source/core/html/parser/HTMLSrcsetParser.h
index ddcd907..bb55d5c1 100644
--- a/third_party/WebKit/Source/core/html/parser/HTMLSrcsetParser.h
+++ b/third_party/WebKit/Source/core/html/parser/HTMLSrcsetParser.h

@@ -71,7 +71,7 @@
 };
 
 class ImageCandidate {
-    ALLOW_ONLY_INLINE_ALLOCATION();
+    DISALLOW_NEW_EXCEPT_PLACEMENT_NEW();
 public:
     enum OriginAttribute {
         SrcsetOrigin,

diff --git a/third_party/WebKit/Source/core/html/parser/HTMLToken.h b/third_party/WebKit/Source/core/html/parser/HTMLToken.h
index ed8ec20..401c9ae 100644
--- a/third_party/WebKit/Source/core/html/parser/HTMLToken.h
+++ b/third_party/WebKit/Source/core/html/parser/HTMLToken.h

@@ -75,10 +75,10 @@
     };
 
     class Attribute {
-        ALLOW_ONLY_INLINE_ALLOCATION();
+        DISALLOW_NEW_EXCEPT_PLACEMENT_NEW();
     public:
         class Range {
-            DISALLOW_ALLOCATION();
+            DISALLOW_NEW();
         public:
             int start;
             int end;

diff --git a/third_party/WebKit/Source/core/html/parser/HTMLTreeBuilder.h b/third_party/WebKit/Source/core/html/parser/HTMLTreeBuilder.h
index 601c471..b42c0f3d 100644
--- a/third_party/WebKit/Source/core/html/parser/HTMLTreeBuilder.h
+++ b/third_party/WebKit/Source/core/html/parser/HTMLTreeBuilder.h

@@ -190,7 +190,7 @@
 
     class FragmentParsingContext {
         WTF_MAKE_NONCOPYABLE(FragmentParsingContext);
-        DISALLOW_ALLOCATION();
+        DISALLOW_NEW();
     public:
         FragmentParsingContext();
         FragmentParsingContext(DocumentFragment*, Element* contextElement);

diff --git a/third_party/WebKit/Source/core/html/parser/InputStreamPreprocessor.h b/third_party/WebKit/Source/core/html/parser/InputStreamPreprocessor.h
index 704f87b..f21b9af52 100644
--- a/third_party/WebKit/Source/core/html/parser/InputStreamPreprocessor.h
+++ b/third_party/WebKit/Source/core/html/parser/InputStreamPreprocessor.h

@@ -39,7 +39,7 @@
 // http://www.whatwg.org/specs/web-apps/current-work/#preprocessing-the-input-stream
 template <typename Tokenizer>
 class InputStreamPreprocessor {
-    DISALLOW_ALLOCATION();
+    DISALLOW_NEW();
     WTF_MAKE_NONCOPYABLE(InputStreamPreprocessor);
 public:
     InputStreamPreprocessor(Tokenizer* tokenizer)

diff --git a/third_party/WebKit/Source/core/html/parser/XSSAuditorDelegate.h b/third_party/WebKit/Source/core/html/parser/XSSAuditorDelegate.h
index 150a42a..01644a52 100644
--- a/third_party/WebKit/Source/core/html/parser/XSSAuditorDelegate.h
+++ b/third_party/WebKit/Source/core/html/parser/XSSAuditorDelegate.h

@@ -67,7 +67,7 @@
 };
 
 class XSSAuditorDelegate final {
-    DISALLOW_ALLOCATION();
+    DISALLOW_NEW();
     WTF_MAKE_NONCOPYABLE(XSSAuditorDelegate);
 public:
     explicit XSSAuditorDelegate(Document*);

diff --git a/third_party/WebKit/Source/core/html/shadow/DateTimeNumericFieldElement.h b/third_party/WebKit/Source/core/html/shadow/DateTimeNumericFieldElement.h
index 88c0d09..ee57798 100644
--- a/third_party/WebKit/Source/core/html/shadow/DateTimeNumericFieldElement.h
+++ b/third_party/WebKit/Source/core/html/shadow/DateTimeNumericFieldElement.h

@@ -47,14 +47,14 @@
 
 public:
     struct Step {
-        DISALLOW_ALLOCATION();
+        DISALLOW_NEW();
         Step(int step = 1, int stepBase = 0) : step(step), stepBase(stepBase) { }
         int step;
         int stepBase;
     };
 
     struct Range {
-        DISALLOW_ALLOCATION();
+        DISALLOW_NEW();
         Range(int minimum, int maximum) : minimum(minimum), maximum(maximum) { }
         int clampValue(int) const;
         bool isInRange(int) const;

diff --git a/third_party/WebKit/Source/core/html/track/AutomaticTrackSelection.h b/third_party/WebKit/Source/core/html/track/AutomaticTrackSelection.h
index 0734ccf..e65f50f 100644
--- a/third_party/WebKit/Source/core/html/track/AutomaticTrackSelection.h
+++ b/third_party/WebKit/Source/core/html/track/AutomaticTrackSelection.h

@@ -18,7 +18,7 @@
     STACK_ALLOCATED();
 public:
     struct Configuration {
-        DISALLOW_ALLOCATION();
+        DISALLOW_NEW();
         Configuration()
             : disableCurrentlyEnabledTracks(false)
             , forceEnableSubtitleOrCaptionTrack(false)

diff --git a/third_party/WebKit/Source/core/html/track/vtt/BufferedLineReader.h b/third_party/WebKit/Source/core/html/track/vtt/BufferedLineReader.h
index 21c81e4..c5928375 100644
--- a/third_party/WebKit/Source/core/html/track/vtt/BufferedLineReader.h
+++ b/third_party/WebKit/Source/core/html/track/vtt/BufferedLineReader.h

@@ -45,7 +45,7 @@
 // to 'REPLACEMENT CHARACTER' (U+FFFD) and does not return the linebreaks as
 // part of the result.
 class CORE_EXPORT BufferedLineReader {
-    DISALLOW_ALLOCATION();
+    DISALLOW_NEW();
     WTF_MAKE_NONCOPYABLE(BufferedLineReader);
 public:
     BufferedLineReader()

diff --git a/third_party/WebKit/Source/core/html/track/vtt/VTTTokenizer.h b/third_party/WebKit/Source/core/html/track/vtt/VTTTokenizer.h
index 7db96fc..6f999e2 100644
--- a/third_party/WebKit/Source/core/html/track/vtt/VTTTokenizer.h
+++ b/third_party/WebKit/Source/core/html/track/vtt/VTTTokenizer.h

@@ -38,7 +38,7 @@
 namespace blink {
 
 class VTTTokenizer {
-    DISALLOW_ALLOCATION();
+    DISALLOW_NEW();
     WTF_MAKE_NONCOPYABLE(VTTTokenizer);
 public:
     explicit VTTTokenizer(const String& input);

diff --git a/third_party/WebKit/Source/core/input/EventHandler.h b/third_party/WebKit/Source/core/input/EventHandler.h
index d6489f3..4a059969 100644
--- a/third_party/WebKit/Source/core/input/EventHandler.h
+++ b/third_party/WebKit/Source/core/input/EventHandler.h

@@ -203,7 +203,7 @@
     SelectionController& selectionController() const { return *m_selectionController; }
 
     class TouchInfo {
-        ALLOW_ONLY_INLINE_ALLOCATION();
+        DISALLOW_NEW_EXCEPT_PLACEMENT_NEW();
     public:
         DEFINE_INLINE_TRACE()
         {

diff --git a/third_party/WebKit/Source/core/inspector/AsyncOperationMap.h b/third_party/WebKit/Source/core/inspector/AsyncOperationMap.h
index 64c18aa..0ccc5e6 100644
--- a/third_party/WebKit/Source/core/inspector/AsyncOperationMap.h
+++ b/third_party/WebKit/Source/core/inspector/AsyncOperationMap.h

@@ -15,7 +15,7 @@
 
 template <class K>
 class AsyncOperationMap final {
-    ALLOW_ONLY_INLINE_ALLOCATION();
+    DISALLOW_NEW_EXCEPT_PLACEMENT_NEW();
 public:
     using MapType = WillBeHeapHashMap<K, int>;
     explicit AsyncOperationMap(V8DebuggerAgent* debuggerAgent)

diff --git a/third_party/WebKit/Source/core/inspector/EventListenerInfo.h b/third_party/WebKit/Source/core/inspector/EventListenerInfo.h
index ca00c5c..21e05ff 100644
--- a/third_party/WebKit/Source/core/inspector/EventListenerInfo.h
+++ b/third_party/WebKit/Source/core/inspector/EventListenerInfo.h

@@ -18,7 +18,7 @@
 class InjectedScriptManager;
 
 class EventListenerInfo {
-    ALLOW_ONLY_INLINE_ALLOCATION();
+    DISALLOW_NEW_EXCEPT_PLACEMENT_NEW();
 public:
     EventListenerInfo(EventTarget* eventTarget, const AtomicString& eventType, const EventListenerVector& eventListenerVector)
         : eventTarget(eventTarget)

diff --git a/third_party/WebKit/Source/core/inspector/InjectedScript.h b/third_party/WebKit/Source/core/inspector/InjectedScript.h
index 3a43a153..f441396 100644
--- a/third_party/WebKit/Source/core/inspector/InjectedScript.h
+++ b/third_party/WebKit/Source/core/inspector/InjectedScript.h

@@ -50,7 +50,7 @@
 
 
 class InjectedScript final {
-    DISALLOW_ALLOCATION();
+    DISALLOW_NEW();
 public:
     InjectedScript();
     ~InjectedScript();

diff --git a/third_party/WebKit/Source/core/inspector/InspectorBaseAgent.h b/third_party/WebKit/Source/core/inspector/InspectorBaseAgent.h
index 74abf59..49972d1 100644
--- a/third_party/WebKit/Source/core/inspector/InspectorBaseAgent.h
+++ b/third_party/WebKit/Source/core/inspector/InspectorBaseAgent.h

@@ -76,7 +76,7 @@
 };
 
 class CORE_EXPORT InspectorAgentRegistry final {
-    DISALLOW_ALLOCATION();
+    DISALLOW_NEW();
     WTF_MAKE_NONCOPYABLE(InspectorAgentRegistry);
 public:
     InspectorAgentRegistry(InstrumentingAgents*, InspectorCompositeState*);

diff --git a/third_party/WebKit/Source/core/inspector/InspectorCSSAgent.cpp b/third_party/WebKit/Source/core/inspector/InspectorCSSAgent.cpp
index 208ca5f41..a79de16 100644
--- a/third_party/WebKit/Source/core/inspector/InspectorCSSAgent.cpp
+++ b/third_party/WebKit/Source/core/inspector/InspectorCSSAgent.cpp

@@ -33,6 +33,7 @@
 #include "core/css/CSSComputedStyleDeclaration.h"
 #include "core/css/CSSDefaultStyleSheets.h"
 #include "core/css/CSSImportRule.h"
+#include "core/css/CSSKeyframeRule.h"
 #include "core/css/CSSMediaRule.h"
 #include "core/css/CSSRule.h"
 #include "core/css/CSSRuleList.h"
@@ -787,6 +788,53 @@
     inheritedEntries = entries.release();
 }
 
+void InspectorCSSAgent::getCSSAnimationsForNode(ErrorString* errorString, int nodeId, RefPtr<TypeBuilder::Array<TypeBuilder::CSS::CSSKeyframesRule>>& cssKeyframesRules)
+{
+    Element* element = elementForId(errorString, nodeId);
+    if (!element) {
+        *errorString = "Node not found";
+        return;
+    }
+
+    PseudoId elementPseudoId = element->pseudoId();
+    if (elementPseudoId) {
+        element = element->parentOrShadowHostElement();
+        if (!element) {
+            *errorString = "Pseudo element has no parent";
+            return;
+        }
+    }
+
+    Document* ownerDocument = element->ownerDocument();
+    // A non-active document has no styles.
+    if (!ownerDocument->isActive())
+        return;
+
+    cssKeyframesRules = TypeBuilder::Array<TypeBuilder::CSS::CSSKeyframesRule>::create();
+    StyleResolver& styleResolver = ownerDocument->ensureStyleResolver();
+    RefPtr<ComputedStyle> style = styleResolver.styleForElement(element);
+    if (!style)
+        return;
+    const CSSAnimationData* animationData = style->animations();
+    for (size_t i = 0; animationData && i < animationData->nameList().size(); ++i) {
+        AtomicString animationName(animationData->nameList()[i]);
+        if (animationName == CSSAnimationData::initialName())
+            continue;
+        StyleRuleKeyframes* keyframesRule = styleResolver.findKeyframesRule(element, animationName);
+        if (!keyframesRule)
+            continue;
+        RefPtrWillBeRawPtr<CSSKeyframesRule> cssKeyframesRule = CSSKeyframesRule::create(keyframesRule, nullptr);
+
+        RefPtr<TypeBuilder::Array<TypeBuilder::CSS::CSSKeyframeRule>> keyframes = TypeBuilder::Array<TypeBuilder::CSS::CSSKeyframeRule>::create();
+        for (unsigned j = 0; j < cssKeyframesRule->length(); ++j)
+            keyframes->addItem(buildObjectForKeyframeRule(cssKeyframesRule->item(j)));
+        RefPtr<TypeBuilder::CSS::CSSKeyframesRule> keyframesRuleObject = TypeBuilder::CSS::CSSKeyframesRule::create()
+            .setAnimationName(cssKeyframesRule->name())
+            .setKeyframes(keyframes);
+        cssKeyframesRules->addItem(keyframesRuleObject);
+    }
+}
+
 void InspectorCSSAgent::getInlineStylesForNode(ErrorString* errorString, int nodeId, RefPtr<TypeBuilder::CSS::CSSStyle>& inlineStyle, RefPtr<TypeBuilder::CSS::CSSStyle>& attributesStyle)
 {
     Element* element = elementForId(errorString, nodeId);
@@ -1489,6 +1537,15 @@
     return result;
 }
 
+PassRefPtr<TypeBuilder::CSS::CSSKeyframeRule> InspectorCSSAgent::buildObjectForKeyframeRule(CSSKeyframeRule* keyframeRule)
+{
+    RefPtrWillBeRawPtr<InspectorStyle> inspectorStyle = InspectorStyle::create(keyframeRule->style(), nullptr, nullptr);
+    RefPtr<TypeBuilder::CSS::CSSKeyframeRule> object = TypeBuilder::CSS::CSSKeyframeRule::create()
+        .setKeyText(keyframeRule->keyText())
+        .setStyle(inspectorStyle->buildObjectForStyle());
+    return object;
+}
+
 PassRefPtr<TypeBuilder::CSS::CSSStyle> InspectorCSSAgent::buildObjectForAttributesStyle(Element* element)
 {
     if (!element->isStyledElement())

diff --git a/third_party/WebKit/Source/core/inspector/InspectorCSSAgent.h b/third_party/WebKit/Source/core/inspector/InspectorCSSAgent.h
index cce3853c..517bede 100644
--- a/third_party/WebKit/Source/core/inspector/InspectorCSSAgent.h
+++ b/third_party/WebKit/Source/core/inspector/InspectorCSSAgent.h

@@ -43,6 +43,7 @@
 
 namespace blink {
 
+class CSSKeyframeRule;
 class CSSRule;
 class CSSRuleList;
 class CSSStyleRule;
@@ -131,6 +132,7 @@
     void getPlatformFontsForNode(ErrorString*, int nodeId, RefPtr<TypeBuilder::Array<TypeBuilder::CSS::PlatformFontUsage>>&) override;
     void getInlineStylesForNode(ErrorString*, int nodeId, RefPtr<TypeBuilder::CSS::CSSStyle>& inlineStyle, RefPtr<TypeBuilder::CSS::CSSStyle>& attributes) override;
     void getMatchedStylesForNode(ErrorString*, int nodeId, RefPtr<TypeBuilder::CSS::CSSStyle>& inlineStyle, RefPtr<TypeBuilder::CSS::CSSStyle>& attributesStyle, RefPtr<TypeBuilder::Array<TypeBuilder::CSS::RuleMatch>>& matchedCSSRules, RefPtr<TypeBuilder::Array<TypeBuilder::CSS::PseudoElementMatches>>&, RefPtr<TypeBuilder::Array<TypeBuilder::CSS::InheritedStyleEntry>>& inheritedEntries) override;
+    void getCSSAnimationsForNode(ErrorString*, int nodeId, RefPtr<TypeBuilder::Array<TypeBuilder::CSS::CSSKeyframesRule>>& cssKeyframesRules) override;
     void getStyleSheetText(ErrorString*, const String& styleSheetId, String* result) override;
     void setStyleSheetText(ErrorString*, const String& styleSheetId, const String& text) override;
     void setRuleSelector(ErrorString*, const String& styleSheetId, const RefPtr<JSONObject>& range, const String& selector, RefPtr<TypeBuilder::CSS::SelectorList>& result) override;
@@ -190,6 +192,7 @@
 
     PassRefPtr<TypeBuilder::CSS::CSSRule> buildObjectForRule(CSSStyleRule*);
     PassRefPtr<TypeBuilder::Array<TypeBuilder::CSS::RuleMatch> > buildArrayForMatchedRuleList(CSSRuleList*, Element*, PseudoId);
+    PassRefPtr<TypeBuilder::CSS::CSSKeyframeRule> buildObjectForKeyframeRule(CSSKeyframeRule*);
     PassRefPtr<TypeBuilder::CSS::CSSStyle> buildObjectForAttributesStyle(Element*);
 
     // InspectorDOMAgent::DOMListener implementation

diff --git a/third_party/WebKit/Source/core/inspector/ScriptCallFrame.h b/third_party/WebKit/Source/core/inspector/ScriptCallFrame.h
index d063082..69d424f3 100644
--- a/third_party/WebKit/Source/core/inspector/ScriptCallFrame.h
+++ b/third_party/WebKit/Source/core/inspector/ScriptCallFrame.h

@@ -41,7 +41,7 @@
 class TracedValue;
 
 class ScriptCallFrame  {
-    ALLOW_ONLY_INLINE_ALLOCATION();
+    DISALLOW_NEW_EXCEPT_PLACEMENT_NEW();
 public:
     ScriptCallFrame();
     ScriptCallFrame(const String& functionName, const String& scriptId, const String& scriptName, unsigned lineNumber, unsigned column = 0);

diff --git a/third_party/WebKit/Source/core/inspector/v8/V8DebuggerListener.h b/third_party/WebKit/Source/core/inspector/v8/V8DebuggerListener.h
index 9751ad0..d4dd99ac 100644
--- a/third_party/WebKit/Source/core/inspector/v8/V8DebuggerListener.h
+++ b/third_party/WebKit/Source/core/inspector/v8/V8DebuggerListener.h

@@ -44,7 +44,7 @@
 class CORE_EXPORT V8DebuggerListener {
 public:
     class Script {
-        DISALLOW_ALLOCATION();
+        DISALLOW_NEW();
     public:
         Script();
 
@@ -99,7 +99,7 @@
     };
 
     struct ParsedScript {
-        ALLOW_ONLY_INLINE_ALLOCATION();
+        DISALLOW_NEW_EXCEPT_PLACEMENT_NEW();
         String scriptId;
         Script script;
         CompileResult compileResult;

diff --git a/third_party/WebKit/Source/core/layout/HitTestLocation.h b/third_party/WebKit/Source/core/layout/HitTestLocation.h
index 1ae69abd..a89241b 100644
--- a/third_party/WebKit/Source/core/layout/HitTestLocation.h
+++ b/third_party/WebKit/Source/core/layout/HitTestLocation.h

@@ -37,7 +37,7 @@
 class FloatRoundedRect;
 
 class CORE_EXPORT HitTestLocation {
-    DISALLOW_ALLOCATION();
+    DISALLOW_NEW();
 public:
 
     // Note that all points are in contents (aka "page") coordinate space for the

diff --git a/third_party/WebKit/Source/core/layout/HitTestRequest.h b/third_party/WebKit/Source/core/layout/HitTestRequest.h
index cdd0978..03624103 100644
--- a/third_party/WebKit/Source/core/layout/HitTestRequest.h
+++ b/third_party/WebKit/Source/core/layout/HitTestRequest.h

@@ -29,7 +29,7 @@
 namespace blink {
 
 class HitTestRequest {
-    DISALLOW_ALLOCATION();
+    DISALLOW_NEW();
 public:
     enum RequestType {
         ReadOnly = 1 << 1,

diff --git a/third_party/WebKit/Source/core/layout/HitTestResult.h b/third_party/WebKit/Source/core/layout/HitTestResult.h
index f1ff36d..156f2fd 100644
--- a/third_party/WebKit/Source/core/layout/HitTestResult.h
+++ b/third_party/WebKit/Source/core/layout/HitTestResult.h

@@ -50,7 +50,7 @@
 class Scrollbar;
 
 class CORE_EXPORT HitTestResult {
-    ALLOW_ONLY_INLINE_ALLOCATION();
+    DISALLOW_NEW_EXCEPT_PLACEMENT_NEW();
 
 public:
     typedef WillBeHeapListHashSet<RefPtrWillBeMember<Node>> NodeSet;

diff --git a/third_party/WebKit/Source/core/layout/LayoutBlockFlow.h b/third_party/WebKit/Source/core/layout/LayoutBlockFlow.h
index e4cb2a0..d9950520 100644
--- a/third_party/WebKit/Source/core/layout/LayoutBlockFlow.h
+++ b/third_party/WebKit/Source/core/layout/LayoutBlockFlow.h

@@ -392,7 +392,7 @@
 
 public:
     struct FloatWithRect {
-        ALLOW_ONLY_INLINE_ALLOCATION();
+        DISALLOW_NEW_EXCEPT_PLACEMENT_NEW();
         FloatWithRect(LayoutBox* f)
             : object(f)
             , rect(f->frameRect())
@@ -407,7 +407,7 @@
     };
 
     class MarginValues {
-        DISALLOW_ALLOCATION();
+        DISALLOW_NEW();
     public:
         MarginValues(LayoutUnit beforePos, LayoutUnit beforeNeg, LayoutUnit afterPos, LayoutUnit afterNeg)
             : m_positiveMarginBefore(beforePos)

diff --git a/third_party/WebKit/Source/core/layout/LayoutBox.h b/third_party/WebKit/Source/core/layout/LayoutBox.h
index 61509f8..eb9ea46 100644
--- a/third_party/WebKit/Source/core/layout/LayoutBox.h
+++ b/third_party/WebKit/Source/core/layout/LayoutBox.h

@@ -527,7 +527,7 @@
     LayoutUnit adjustContentBoxLogicalHeightForBoxSizing(LayoutUnit height) const;
 
     struct ComputedMarginValues {
-        DISALLOW_ALLOCATION();
+        DISALLOW_NEW();
         ComputedMarginValues() { }
 
         LayoutUnit m_before;

diff --git a/third_party/WebKit/Source/core/layout/LayoutFrameSet.h b/third_party/WebKit/Source/core/layout/LayoutFrameSet.h
index f172a97..0d11c0d 100644
--- a/third_party/WebKit/Source/core/layout/LayoutFrameSet.h
+++ b/third_party/WebKit/Source/core/layout/LayoutFrameSet.h

@@ -80,7 +80,7 @@
     HTMLFrameSetElement* frameSet() const;
 
     class GridAxis {
-        DISALLOW_ALLOCATION();
+        DISALLOW_NEW();
         WTF_MAKE_NONCOPYABLE(GridAxis);
     public:
         GridAxis();

diff --git a/third_party/WebKit/Source/core/layout/LayoutGeometryMap.h b/third_party/WebKit/Source/core/layout/LayoutGeometryMap.h
index ddb41dfa..7c35202 100644
--- a/third_party/WebKit/Source/core/layout/LayoutGeometryMap.h
+++ b/third_party/WebKit/Source/core/layout/LayoutGeometryMap.h

@@ -45,7 +45,7 @@
 
 // Can be used while walking the layout tree to cache data about offsets and transforms.
 class CORE_EXPORT LayoutGeometryMap {
-    DISALLOW_ALLOCATION();
+    DISALLOW_NEW();
     WTF_MAKE_NONCOPYABLE(LayoutGeometryMap);
 public:
     LayoutGeometryMap(MapCoordinatesFlags = UseTransforms);

diff --git a/third_party/WebKit/Source/core/layout/LayoutGeometryMapStep.h b/third_party/WebKit/Source/core/layout/LayoutGeometryMapStep.h
index 4613d374..ad70e68 100644
--- a/third_party/WebKit/Source/core/layout/LayoutGeometryMapStep.h
+++ b/third_party/WebKit/Source/core/layout/LayoutGeometryMapStep.h

@@ -38,7 +38,7 @@
 
 // Stores data about how to map from one layoutObject to its container.
 struct LayoutGeometryMapStep {
-    ALLOW_ONLY_INLINE_ALLOCATION();
+    DISALLOW_NEW_EXCEPT_PLACEMENT_NEW();
     LayoutGeometryMapStep(const LayoutGeometryMapStep& o)
         : m_layoutObject(o.m_layoutObject)
         , m_offset(o.m_offset)

diff --git a/third_party/WebKit/Source/core/layout/LayoutObject.h b/third_party/WebKit/Source/core/layout/LayoutObject.h
index 8e95488..c6697f7 100644
--- a/third_party/WebKit/Source/core/layout/LayoutObject.h
+++ b/third_party/WebKit/Source/core/layout/LayoutObject.h

@@ -101,7 +101,7 @@
 const LayoutUnit& caretWidth();
 
 struct AnnotatedRegionValue {
-    ALLOW_ONLY_INLINE_ALLOCATION();
+    DISALLOW_NEW_EXCEPT_PLACEMENT_NEW();
     bool operator==(const AnnotatedRegionValue& o) const
     {
         return draggable == o.draggable && bounds == o.bounds;

diff --git a/third_party/WebKit/Source/core/layout/LayoutObjectChildList.h b/third_party/WebKit/Source/core/layout/LayoutObjectChildList.h
index 0f61534..4745639a 100644
--- a/third_party/WebKit/Source/core/layout/LayoutObjectChildList.h
+++ b/third_party/WebKit/Source/core/layout/LayoutObjectChildList.h

@@ -34,7 +34,7 @@
 class LayoutObject;
 
 class LayoutObjectChildList {
-    DISALLOW_ALLOCATION();
+    DISALLOW_NEW();
 public:
     LayoutObjectChildList()
         : m_firstChild(nullptr)

diff --git a/third_party/WebKit/Source/core/layout/LayoutState.h b/third_party/WebKit/Source/core/layout/LayoutState.h
index 178463d..959e7947 100644
--- a/third_party/WebKit/Source/core/layout/LayoutState.h
+++ b/third_party/WebKit/Source/core/layout/LayoutState.h

@@ -63,7 +63,7 @@
     // LayoutState is always allocated on the stack.
     // The reason is that it is scoped to layout, thus we can avoid expensive
     // mallocs.
-    DISALLOW_ALLOCATION();
+    DISALLOW_NEW();
     WTF_MAKE_NONCOPYABLE(LayoutState);
 public:
     // Constructor for root LayoutState created by LayoutView

diff --git a/third_party/WebKit/Source/core/layout/LayoutTable.h b/third_party/WebKit/Source/core/layout/LayoutTable.h
index e9a0e063..463d8f3 100644
--- a/third_party/WebKit/Source/core/layout/LayoutTable.h
+++ b/third_party/WebKit/Source/core/layout/LayoutTable.h

@@ -189,7 +189,7 @@
     void addChildIgnoringContinuation(LayoutObject* newChild, LayoutObject* beforeChild = nullptr) override;
 
     struct ColumnStruct {
-        ALLOW_ONLY_INLINE_ALLOCATION();
+        DISALLOW_NEW_EXCEPT_PLACEMENT_NEW();
         explicit ColumnStruct(unsigned initialSpan = 1)
             : span(initialSpan)
         {

diff --git a/third_party/WebKit/Source/core/layout/LayoutTableSection.h b/third_party/WebKit/Source/core/layout/LayoutTableSection.h
index f3bbd6a0..7dacf87 100644
--- a/third_party/WebKit/Source/core/layout/LayoutTableSection.h
+++ b/third_party/WebKit/Source/core/layout/LayoutTableSection.h

@@ -131,7 +131,7 @@
     // CellStruct represents the cells that occupy an (N, M) position in the
     // table grid.
     struct CellStruct {
-        ALLOW_ONLY_INLINE_ALLOCATION();
+        DISALLOW_NEW_EXCEPT_PLACEMENT_NEW();
     public:
         // All the cells that fills this grid "slot".
         // Due to colspan / rowpsan, it is possible to have overlapping cells
@@ -172,7 +172,7 @@
     typedef Vector<CellStruct> Row;
 
     struct RowStruct {
-        ALLOW_ONLY_INLINE_ALLOCATION();
+        DISALLOW_NEW_EXCEPT_PLACEMENT_NEW();
     public:
         RowStruct()
             : rowLayoutObject(nullptr)

diff --git a/third_party/WebKit/Source/core/layout/MultiColumnFragmentainerGroup.h b/third_party/WebKit/Source/core/layout/MultiColumnFragmentainerGroup.h
index e7bb437d4..f5182c4 100644
--- a/third_party/WebKit/Source/core/layout/MultiColumnFragmentainerGroup.h
+++ b/third_party/WebKit/Source/core/layout/MultiColumnFragmentainerGroup.h

@@ -27,7 +27,7 @@
 // need more columns than what a group has room for, we'll create another group and put them there
 // (and make them appear in the next outer fragmentainer).
 class MultiColumnFragmentainerGroup {
-    ALLOW_ONLY_INLINE_ALLOCATION();
+    DISALLOW_NEW_EXCEPT_PLACEMENT_NEW();
 public:
     MultiColumnFragmentainerGroup(LayoutMultiColumnSet&);
 
@@ -122,7 +122,7 @@
 // group. Deleting the one group is not allowed (or possible). There will be more than one group if
 // the owning column set lives in multiple outer fragmentainers (e.g. multicol inside paged media).
 class CORE_EXPORT MultiColumnFragmentainerGroupList {
-    DISALLOW_ALLOCATION();
+    DISALLOW_NEW();
 public:
     MultiColumnFragmentainerGroupList(LayoutMultiColumnSet&);
     ~MultiColumnFragmentainerGroupList();

diff --git a/third_party/WebKit/Source/core/layout/OrderIterator.h b/third_party/WebKit/Source/core/layout/OrderIterator.h
index 262f981b..8a0062d 100644
--- a/third_party/WebKit/Source/core/layout/OrderIterator.h
+++ b/third_party/WebKit/Source/core/layout/OrderIterator.h

@@ -41,7 +41,7 @@
 class LayoutBox;
 
 class OrderIterator {
-    DISALLOW_ALLOCATION();
+    DISALLOW_NEW();
     WTF_MAKE_NONCOPYABLE(OrderIterator);
 public:
     friend class OrderIteratorPopulator;

diff --git a/third_party/WebKit/Source/core/layout/PaintInvalidationState.h b/third_party/WebKit/Source/core/layout/PaintInvalidationState.h
index 781d03d..53c2d7f 100644
--- a/third_party/WebKit/Source/core/layout/PaintInvalidationState.h
+++ b/third_party/WebKit/Source/core/layout/PaintInvalidationState.h

@@ -18,7 +18,7 @@
 class LayoutView;
 
 class PaintInvalidationState {
-    ALLOW_ONLY_INLINE_ALLOCATION();
+    DISALLOW_NEW_EXCEPT_PLACEMENT_NEW();
     WTF_MAKE_NONCOPYABLE(PaintInvalidationState);
 public:
     PaintInvalidationState(PaintInvalidationState& next, LayoutBoxModelObject& layoutObject, const LayoutBoxModelObject& paintInvalidationContainer);

diff --git a/third_party/WebKit/Source/core/layout/TextAutosizer.h b/third_party/WebKit/Source/core/layout/TextAutosizer.h
index 7799f150..773909c 100644
--- a/third_party/WebKit/Source/core/layout/TextAutosizer.h
+++ b/third_party/WebKit/Source/core/layout/TextAutosizer.h

@@ -220,7 +220,7 @@
     // Fingerprints are computed during style recalc, for (some subset of)
     // blocks that will become cluster roots.
     class FingerprintMapper {
-        DISALLOW_ALLOCATION();
+        DISALLOW_NEW();
     public:
         void add(const LayoutObject*, Fingerprint);
         void addTentativeClusterRoot(const LayoutBlock*, Fingerprint);
@@ -241,7 +241,7 @@
     };
 
     struct PageInfo {
-        DISALLOW_ALLOCATION();
+        DISALLOW_NEW();
         PageInfo()
             : m_frameWidth(0)
             , m_layoutWidth(0)

diff --git a/third_party/WebKit/Source/core/layout/api/LineLayoutItem.h b/third_party/WebKit/Source/core/layout/api/LineLayoutItem.h
index 861f7b7..befda59d 100644
--- a/third_party/WebKit/Source/core/layout/api/LineLayoutItem.h
+++ b/third_party/WebKit/Source/core/layout/api/LineLayoutItem.h

@@ -25,7 +25,7 @@
 enum HitTestFilter;
 
 class LineLayoutItem {
-    ALLOW_ONLY_INLINE_ALLOCATION();
+    DISALLOW_NEW_EXCEPT_PLACEMENT_NEW();
 public:
     explicit LineLayoutItem(LayoutObject* layoutObject)
         : m_layoutObject(layoutObject)

diff --git a/third_party/WebKit/Source/core/layout/compositing/CompositedLayerMapping.h b/third_party/WebKit/Source/core/layout/compositing/CompositedLayerMapping.h
index 14ef046a4..e296052e 100644
--- a/third_party/WebKit/Source/core/layout/compositing/CompositedLayerMapping.h
+++ b/third_party/WebKit/Source/core/layout/compositing/CompositedLayerMapping.h

@@ -40,7 +40,7 @@
 
 // A GraphicsLayerPaintInfo contains all the info needed to paint a partial subtree of Layers into a GraphicsLayer.
 struct GraphicsLayerPaintInfo {
-    ALLOW_ONLY_INLINE_ALLOCATION();
+    DISALLOW_NEW_EXCEPT_PLACEMENT_NEW();
     PaintLayer* paintLayer;
 
     LayoutRect compositedBounds;

diff --git a/third_party/WebKit/Source/core/layout/compositing/CompositingReasonFinder.h b/third_party/WebKit/Source/core/layout/compositing/CompositingReasonFinder.h
index d898b23d7..566859f2 100644
--- a/third_party/WebKit/Source/core/layout/compositing/CompositingReasonFinder.h
+++ b/third_party/WebKit/Source/core/layout/compositing/CompositingReasonFinder.h

@@ -18,7 +18,7 @@
 class LayoutView;
 
 class CompositingReasonFinder {
-    DISALLOW_ALLOCATION();
+    DISALLOW_NEW();
     WTF_MAKE_NONCOPYABLE(CompositingReasonFinder);
 public:
     explicit CompositingReasonFinder(LayoutView&);

diff --git a/third_party/WebKit/Source/core/layout/line/AbstractInlineTextBox.h b/third_party/WebKit/Source/core/layout/line/AbstractInlineTextBox.h
index d9e1b84..2fca2f9 100644
--- a/third_party/WebKit/Source/core/layout/line/AbstractInlineTextBox.h
+++ b/third_party/WebKit/Source/core/layout/line/AbstractInlineTextBox.h

@@ -60,7 +60,7 @@
 
 public:
     struct WordBoundaries {
-        ALLOW_ONLY_INLINE_ALLOCATION();
+        DISALLOW_NEW_EXCEPT_PLACEMENT_NEW();
         WordBoundaries(int startIndex, int endIndex) : startIndex(startIndex), endIndex(endIndex) { }
         int startIndex;
         int endIndex;

diff --git a/third_party/WebKit/Source/core/layout/line/InlineBox.h b/third_party/WebKit/Source/core/layout/line/InlineBox.h
index c318698..dedadf4 100644
--- a/third_party/WebKit/Source/core/layout/line/InlineBox.h
+++ b/third_party/WebKit/Source/core/layout/line/InlineBox.h

@@ -309,7 +309,7 @@
     void set##Name(bool name) { m_##name = name; }\
 
     class InlineBoxBitfields {
-        DISALLOW_ALLOCATION();
+        DISALLOW_NEW();
     public:
         InlineBoxBitfields(bool firstLine = false, bool constructed = false, bool dirty = false, bool extracted = false, bool isHorizontal = true)
             : m_firstLine(firstLine)

diff --git a/third_party/WebKit/Source/core/layout/line/InlineIterator.h b/third_party/WebKit/Source/core/layout/line/InlineIterator.h
index 9c74146..73c2554 100644
--- a/third_party/WebKit/Source/core/layout/line/InlineIterator.h
+++ b/third_party/WebKit/Source/core/layout/line/InlineIterator.h

@@ -37,7 +37,7 @@
 // text children. InlineIterator will use bidiNext to find the next LayoutText
 // optionally notifying a BidiResolver every time it steps into/out of a LayoutInline.
 class InlineIterator {
-    ALLOW_ONLY_INLINE_ALLOCATION();
+    DISALLOW_NEW_EXCEPT_PLACEMENT_NEW();
 public:
     enum IncrementRule {
         FastIncrementInIsolatedLayout,

diff --git a/third_party/WebKit/Source/core/layout/line/LineBoxList.h b/third_party/WebKit/Source/core/layout/line/LineBoxList.h
index 1b7a41c..5ece4aa 100644
--- a/third_party/WebKit/Source/core/layout/line/LineBoxList.h
+++ b/third_party/WebKit/Source/core/layout/line/LineBoxList.h

@@ -49,7 +49,7 @@
 struct PaintInfo;
 
 class LineBoxList {
-    DISALLOW_ALLOCATION();
+    DISALLOW_NEW();
 public:
     LineBoxList()
         : m_firstLineBox(nullptr)

diff --git a/third_party/WebKit/Source/core/layout/line/WordMeasurement.h b/third_party/WebKit/Source/core/layout/line/WordMeasurement.h
index 1206726..ac95dcc7 100644
--- a/third_party/WebKit/Source/core/layout/line/WordMeasurement.h
+++ b/third_party/WebKit/Source/core/layout/line/WordMeasurement.h

@@ -31,7 +31,7 @@
 namespace blink {
 
 class WordMeasurement {
-    ALLOW_ONLY_INLINE_ALLOCATION();
+    DISALLOW_NEW_EXCEPT_PLACEMENT_NEW();
 public:
     WordMeasurement()
         : layoutText(nullptr)

diff --git a/third_party/WebKit/Source/core/layout/shapes/PolygonShape.h b/third_party/WebKit/Source/core/layout/shapes/PolygonShape.h
index 8573bb5..31c90904 100644
--- a/third_party/WebKit/Source/core/layout/shapes/PolygonShape.h
+++ b/third_party/WebKit/Source/core/layout/shapes/PolygonShape.h

@@ -37,7 +37,7 @@
 namespace blink {
 
 class OffsetPolygonEdge final : public VertexPair {
-    DISALLOW_ALLOCATION();
+    DISALLOW_NEW();
 public:
     OffsetPolygonEdge(const FloatPolygonEdge& edge, const FloatSize& offset)
         : m_vertex1(edge.vertex1() + offset)

diff --git a/third_party/WebKit/Source/core/layout/shapes/ShapeOutsideInfo.h b/third_party/WebKit/Source/core/layout/shapes/ShapeOutsideInfo.h
index 9b2aa9e..bfdad9b 100644
--- a/third_party/WebKit/Source/core/layout/shapes/ShapeOutsideInfo.h
+++ b/third_party/WebKit/Source/core/layout/shapes/ShapeOutsideInfo.h

@@ -45,7 +45,7 @@
 class FloatingObject;
 
 class ShapeOutsideDeltas final {
-    DISALLOW_ALLOCATION();
+    DISALLOW_NEW();
 public:
     ShapeOutsideDeltas()
         : m_lineOverlapsShape(false)

diff --git a/third_party/WebKit/Source/core/layout/svg/LayoutSVGInlineText.h b/third_party/WebKit/Source/core/layout/svg/LayoutSVGInlineText.h
index 84610b8..5bdb876d 100644
--- a/third_party/WebKit/Source/core/layout/svg/LayoutSVGInlineText.h
+++ b/third_party/WebKit/Source/core/layout/svg/LayoutSVGInlineText.h

@@ -70,7 +70,7 @@
 DEFINE_LAYOUT_OBJECT_TYPE_CASTS(LayoutSVGInlineText, isSVGInlineText());
 
 class SVGInlineTextMetricsIterator {
-    DISALLOW_ALLOCATION();
+    DISALLOW_NEW();
 public:
     SVGInlineTextMetricsIterator() { reset(nullptr); }
 

diff --git a/third_party/WebKit/Source/core/layout/svg/SVGMarkerData.h b/third_party/WebKit/Source/core/layout/svg/SVGMarkerData.h
index 1929b6c9..3c646e4 100644
--- a/third_party/WebKit/Source/core/layout/svg/SVGMarkerData.h
+++ b/third_party/WebKit/Source/core/layout/svg/SVGMarkerData.h

@@ -34,7 +34,7 @@
 };
 
 struct MarkerPosition {
-    ALLOW_ONLY_INLINE_ALLOCATION();
+    DISALLOW_NEW_EXCEPT_PLACEMENT_NEW();
     MarkerPosition(SVGMarkerType useType, const FloatPoint& useOrigin, float useAngle)
         : type(useType)
         , origin(useOrigin)

diff --git a/third_party/WebKit/Source/core/layout/svg/SVGTextFragment.h b/third_party/WebKit/Source/core/layout/svg/SVGTextFragment.h
index 6e700d7..f215fd6 100644
--- a/third_party/WebKit/Source/core/layout/svg/SVGTextFragment.h
+++ b/third_party/WebKit/Source/core/layout/svg/SVGTextFragment.h

@@ -27,7 +27,7 @@
 
 // A SVGTextFragment describes a text fragment of a LayoutSVGInlineText which can be laid out at once.
 struct SVGTextFragment {
-    ALLOW_ONLY_INLINE_ALLOCATION();
+    DISALLOW_NEW_EXCEPT_PLACEMENT_NEW();
     SVGTextFragment()
         : characterOffset(0)
         , metricsListOffset(0)

diff --git a/third_party/WebKit/Source/core/layout/svg/SVGTextLayoutAttributes.h b/third_party/WebKit/Source/core/layout/svg/SVGTextLayoutAttributes.h
index 7ec7c99..b792bb8 100644
--- a/third_party/WebKit/Source/core/layout/svg/SVGTextLayoutAttributes.h
+++ b/third_party/WebKit/Source/core/layout/svg/SVGTextLayoutAttributes.h

@@ -32,7 +32,7 @@
 class LayoutSVGInlineText;
 
 struct SVGCharacterData {
-    ALLOW_ONLY_INLINE_ALLOCATION();
+    DISALLOW_NEW_EXCEPT_PLACEMENT_NEW();
     SVGCharacterData();
 
     float x;
@@ -45,7 +45,7 @@
 typedef HashMap<unsigned, SVGCharacterData> SVGCharacterDataMap;
 
 class SVGTextLayoutAttributes {
-    DISALLOW_ALLOCATION();
+    DISALLOW_NEW();
     WTF_MAKE_NONCOPYABLE(SVGTextLayoutAttributes);
 public:
     SVGTextLayoutAttributes(LayoutSVGInlineText*);

diff --git a/third_party/WebKit/Source/core/layout/svg/SVGTextLayoutAttributesBuilder.h b/third_party/WebKit/Source/core/layout/svg/SVGTextLayoutAttributesBuilder.h
index a468d36..f05c55f 100644
--- a/third_party/WebKit/Source/core/layout/svg/SVGTextLayoutAttributesBuilder.h
+++ b/third_party/WebKit/Source/core/layout/svg/SVGTextLayoutAttributesBuilder.h

@@ -42,7 +42,7 @@
 // The second layout phase is carried out by SVGTextLayoutEngine.
 
 class SVGTextLayoutAttributesBuilder {
-    DISALLOW_ALLOCATION();
+    DISALLOW_NEW();
     WTF_MAKE_NONCOPYABLE(SVGTextLayoutAttributesBuilder);
 public:
     SVGTextLayoutAttributesBuilder();
@@ -56,7 +56,7 @@
     unsigned numberOfTextPositioningElements() const { return m_textPositions.size(); }
 
     struct TextPosition {
-        ALLOW_ONLY_INLINE_ALLOCATION();
+        DISALLOW_NEW_EXCEPT_PLACEMENT_NEW();
     public:
         TextPosition(SVGTextPositioningElement* newElement = nullptr, unsigned newStart = 0, unsigned newLength = 0)
             : element(newElement)

diff --git a/third_party/WebKit/Source/core/layout/svg/SVGTextMetrics.h b/third_party/WebKit/Source/core/layout/svg/SVGTextMetrics.h
index f172756..66d1290 100644
--- a/third_party/WebKit/Source/core/layout/svg/SVGTextMetrics.h
+++ b/third_party/WebKit/Source/core/layout/svg/SVGTextMetrics.h

@@ -30,7 +30,7 @@
 class TextRun;
 
 class SVGTextMetrics {
-    ALLOW_ONLY_INLINE_ALLOCATION();
+    DISALLOW_NEW_EXCEPT_PLACEMENT_NEW();
 public:
     enum MetricsType {
         SkippedSpaceMetrics

diff --git a/third_party/WebKit/Source/core/loader/DocumentLoadTiming.h b/third_party/WebKit/Source/core/loader/DocumentLoadTiming.h
index 6bd081e..8c47eb21c 100644
--- a/third_party/WebKit/Source/core/loader/DocumentLoadTiming.h
+++ b/third_party/WebKit/Source/core/loader/DocumentLoadTiming.h

@@ -36,7 +36,7 @@
 class KURL;
 
 class CORE_EXPORT DocumentLoadTiming final {
-    DISALLOW_ALLOCATION();
+    DISALLOW_NEW();
 public:
     explicit DocumentLoadTiming(DocumentLoader&);
 

diff --git a/third_party/WebKit/Source/core/loader/DocumentLoader.h b/third_party/WebKit/Source/core/loader/DocumentLoader.h
index a84f80d..c5c1755 100644
--- a/third_party/WebKit/Source/core/loader/DocumentLoader.h
+++ b/third_party/WebKit/Source/core/loader/DocumentLoader.h

@@ -129,7 +129,7 @@
     ClientHintsPreferences& clientHintsPreferences() { return m_clientHintsPreferences; }
 
     struct InitialScrollState {
-        DISALLOW_ALLOCATION();
+        DISALLOW_NEW();
         InitialScrollState()
             : wasScrolledByUser(false)
             , didRestoreFromHistory(false)

diff --git a/third_party/WebKit/Source/core/loader/EmptyClients.h b/third_party/WebKit/Source/core/loader/EmptyClients.h
index 80eb483..fc2a48c0 100644
--- a/third_party/WebKit/Source/core/loader/EmptyClients.h
+++ b/third_party/WebKit/Source/core/loader/EmptyClients.h

@@ -264,7 +264,7 @@
 };
 
 class CORE_EXPORT EmptyTextCheckerClient : public TextCheckerClient {
-    DISALLOW_ALLOCATION();
+    DISALLOW_NEW();
 public:
     ~EmptyTextCheckerClient() { }
 

diff --git a/third_party/WebKit/Source/core/loader/FormSubmission.h b/third_party/WebKit/Source/core/loader/FormSubmission.h
index 9d2cfbc..0c612ec 100644
--- a/third_party/WebKit/Source/core/loader/FormSubmission.h
+++ b/third_party/WebKit/Source/core/loader/FormSubmission.h

@@ -48,7 +48,7 @@
     enum Method { GetMethod, PostMethod, DialogMethod };
 
     class Attributes {
-        DISALLOW_ALLOCATION();
+        DISALLOW_NEW();
         WTF_MAKE_NONCOPYABLE(Attributes);
     public:
         Attributes()

diff --git a/third_party/WebKit/Source/core/loader/FrameLoader.h b/third_party/WebKit/Source/core/loader/FrameLoader.h
index 962b920..b12caa89 100644
--- a/third_party/WebKit/Source/core/loader/FrameLoader.h
+++ b/third_party/WebKit/Source/core/loader/FrameLoader.h

@@ -64,7 +64,7 @@
 
 class CORE_EXPORT FrameLoader final {
     WTF_MAKE_NONCOPYABLE(FrameLoader);
-    DISALLOW_ALLOCATION();
+    DISALLOW_NEW();
 public:
     static ResourceRequest resourceRequestFromHistoryItem(HistoryItem*, ResourceRequestCachePolicy);
 

diff --git a/third_party/WebKit/Source/core/loader/FrameLoaderStateMachine.h b/third_party/WebKit/Source/core/loader/FrameLoaderStateMachine.h
index b127ccd..23bdb8e 100644
--- a/third_party/WebKit/Source/core/loader/FrameLoaderStateMachine.h
+++ b/third_party/WebKit/Source/core/loader/FrameLoaderStateMachine.h

@@ -38,7 +38,7 @@
 // Encapsulates a state machine for FrameLoader. Note that this is different from FrameState,
 // which stores the state of the current load that FrameLoader is executing.
 class CORE_EXPORT FrameLoaderStateMachine {
-    DISALLOW_ALLOCATION();
+    DISALLOW_NEW();
     WTF_MAKE_NONCOPYABLE(FrameLoaderStateMachine);
 public:
     FrameLoaderStateMachine();

diff --git a/third_party/WebKit/Source/core/loader/LinkHeader.h b/third_party/WebKit/Source/core/loader/LinkHeader.h
index 0e73a02..66d410336 100644
--- a/third_party/WebKit/Source/core/loader/LinkHeader.h
+++ b/third_party/WebKit/Source/core/loader/LinkHeader.h

@@ -13,7 +13,7 @@
 namespace blink {
 
 class LinkHeader {
-    ALLOW_ONLY_INLINE_ALLOCATION();
+    DISALLOW_NEW_EXCEPT_PLACEMENT_NEW();
 public:
     template <typename CharType>
     LinkHeader(CharType*& position, CharType* end);

diff --git a/third_party/WebKit/Source/core/loader/LinkLoader.h b/third_party/WebKit/Source/core/loader/LinkLoader.h
index 7824d43..65b3794 100644
--- a/third_party/WebKit/Source/core/loader/LinkLoader.h
+++ b/third_party/WebKit/Source/core/loader/LinkLoader.h

@@ -50,7 +50,7 @@
 
 // The LinkLoader can load link rel types icon, dns-prefetch, subresource, prefetch and prerender.
 class CORE_EXPORT LinkLoader final : public ResourceOwner<Resource, ResourceClient>, public PrerenderClient {
-    DISALLOW_ALLOCATION();
+    DISALLOW_NEW();
 public:
     explicit LinkLoader(LinkLoaderClient*);
     ~LinkLoader() override;

diff --git a/third_party/WebKit/Source/core/loader/MixedContentChecker.h b/third_party/WebKit/Source/core/loader/MixedContentChecker.h
index 89d7978..d88780bd 100644
--- a/third_party/WebKit/Source/core/loader/MixedContentChecker.h
+++ b/third_party/WebKit/Source/core/loader/MixedContentChecker.h

@@ -46,7 +46,7 @@
 
 class CORE_EXPORT MixedContentChecker final {
     WTF_MAKE_NONCOPYABLE(MixedContentChecker);
-    DISALLOW_ALLOCATION();
+    DISALLOW_NEW();
 public:
     enum ContextType {
         ContextTypeNotMixedContent,

diff --git a/third_party/WebKit/Source/core/loader/TextResourceDecoderBuilder.h b/third_party/WebKit/Source/core/loader/TextResourceDecoderBuilder.h
index 47dae34..622cda5 100644
--- a/third_party/WebKit/Source/core/loader/TextResourceDecoderBuilder.h
+++ b/third_party/WebKit/Source/core/loader/TextResourceDecoderBuilder.h

@@ -42,7 +42,7 @@
 class TextResourceDecoder;
 
 class TextResourceDecoderBuilder {
-    DISALLOW_ALLOCATION();
+    DISALLOW_NEW();
 public:
     TextResourceDecoderBuilder(const AtomicString& mimeType, const AtomicString& encoding);
     ~TextResourceDecoderBuilder();

diff --git a/third_party/WebKit/Source/core/loader/ThreadableLoader.h b/third_party/WebKit/Source/core/loader/ThreadableLoader.h
index b22def4..5a88392 100644
--- a/third_party/WebKit/Source/core/loader/ThreadableLoader.h
+++ b/third_party/WebKit/Source/core/loader/ThreadableLoader.h

@@ -64,7 +64,7 @@
 };
 
 struct ThreadableLoaderOptions {
-    DISALLOW_ALLOCATION();
+    DISALLOW_NEW();
     ThreadableLoaderOptions()
         : preflightPolicy(ConsiderPreflight)
         , crossOriginRequestPolicy(DenyCrossOriginRequests)

diff --git a/third_party/WebKit/Source/core/loader/appcache/ApplicationCacheHost.h b/third_party/WebKit/Source/core/loader/appcache/ApplicationCacheHost.h
index 09aaa71..0d419bc 100644
--- a/third_party/WebKit/Source/core/loader/appcache/ApplicationCacheHost.h
+++ b/third_party/WebKit/Source/core/loader/appcache/ApplicationCacheHost.h

@@ -90,7 +90,7 @@
         };
 
         struct ResourceInfo {
-            ALLOW_ONLY_INLINE_ALLOCATION();
+            DISALLOW_NEW_EXCEPT_PLACEMENT_NEW();
             ResourceInfo(const KURL& resource, bool isMaster, bool isManifest, bool isFallback, bool isForeign, bool isExplicit, long long size)
                 : m_resource(resource)
                 , m_isMaster(isMaster)

diff --git a/third_party/WebKit/Source/core/page/FrameTree.h b/third_party/WebKit/Source/core/page/FrameTree.h
index 152b1bcf..0833397b 100644
--- a/third_party/WebKit/Source/core/page/FrameTree.h
+++ b/third_party/WebKit/Source/core/page/FrameTree.h

@@ -31,7 +31,7 @@
 
 class CORE_EXPORT FrameTree final {
     WTF_MAKE_NONCOPYABLE(FrameTree);
-    DISALLOW_ALLOCATION();
+    DISALLOW_NEW();
 public:
     explicit FrameTree(Frame* thisFrame);
     ~FrameTree();

diff --git a/third_party/WebKit/Source/core/page/TouchAdjustment.cpp b/third_party/WebKit/Source/core/page/TouchAdjustment.cpp
index a4b022c1..87fb89c 100644
--- a/third_party/WebKit/Source/core/page/TouchAdjustment.cpp
+++ b/third_party/WebKit/Source/core/page/TouchAdjustment.cpp

@@ -47,7 +47,7 @@
 
 // Class for remembering absolute quads of a target node and what node they represent.
 class SubtargetGeometry {
-    ALLOW_ONLY_INLINE_ALLOCATION();
+    DISALLOW_NEW_EXCEPT_PLACEMENT_NEW();
 public:
     SubtargetGeometry(Node* node, const FloatQuad& quad)
         : m_node(node)

diff --git a/third_party/WebKit/Source/core/page/WindowFeatures.h b/third_party/WebKit/Source/core/page/WindowFeatures.h
index e644f017..e2845cc4 100644
--- a/third_party/WebKit/Source/core/page/WindowFeatures.h
+++ b/third_party/WebKit/Source/core/page/WindowFeatures.h

@@ -38,7 +38,7 @@
 class IntRect;
 
 struct WindowFeatures {
-    DISALLOW_ALLOCATION();
+    DISALLOW_NEW();
     WindowFeatures()
         : x(0)
         , xSet(false)

diff --git a/third_party/WebKit/Source/core/paint/ClipScope.h b/third_party/WebKit/Source/core/paint/ClipScope.h
index 71df086..052b174 100644
--- a/third_party/WebKit/Source/core/paint/ClipScope.h
+++ b/third_party/WebKit/Source/core/paint/ClipScope.h

@@ -11,7 +11,7 @@
 namespace blink {
 
 class ClipScope {
-    ALLOW_ONLY_INLINE_ALLOCATION();
+    DISALLOW_NEW_EXCEPT_PLACEMENT_NEW();
     WTF_MAKE_NONCOPYABLE(ClipScope);
 public:
     ClipScope(GraphicsContext* context)

diff --git a/third_party/WebKit/Source/core/paint/LayoutObjectDrawingRecorder.h b/third_party/WebKit/Source/core/paint/LayoutObjectDrawingRecorder.h
index b5b0ac83..cadb9b8 100644
--- a/third_party/WebKit/Source/core/paint/LayoutObjectDrawingRecorder.h
+++ b/third_party/WebKit/Source/core/paint/LayoutObjectDrawingRecorder.h

@@ -20,7 +20,7 @@
 
 // Convenience wrapper of DrawingRecorder for LayoutObject painters.
 class LayoutObjectDrawingRecorder final {
-    ALLOW_ONLY_INLINE_ALLOCATION();
+    DISALLOW_NEW_EXCEPT_PLACEMENT_NEW();
 public:
     static bool useCachedDrawingIfPossible(GraphicsContext& context, const LayoutObject& layoutObject, DisplayItem::Type displayItemType, const LayoutPoint& paintOffset)
     {

diff --git a/third_party/WebKit/Source/core/paint/NinePieceImageGrid.h b/third_party/WebKit/Source/core/paint/NinePieceImageGrid.h
index 7635484..b23a07b 100644
--- a/third_party/WebKit/Source/core/paint/NinePieceImageGrid.h
+++ b/third_party/WebKit/Source/core/paint/NinePieceImageGrid.h

@@ -82,7 +82,7 @@
     NinePieceDrawInfo getNinePieceDrawInfo(NinePiece) const;
 
     struct Edge {
-        DISALLOW_ALLOCATION();
+        DISALLOW_NEW();
         bool isDrawable() const { return slice > 0 && width > 0; }
         float scale() const { return isDrawable() ? (float)width / slice : 1; }
         int slice;

diff --git a/third_party/WebKit/Source/core/paint/PaintInfo.h b/third_party/WebKit/Source/core/paint/PaintInfo.h
index a5113dc..6e22688 100644
--- a/third_party/WebKit/Source/core/paint/PaintInfo.h
+++ b/third_party/WebKit/Source/core/paint/PaintInfo.h

@@ -51,7 +51,7 @@
 class PaintInvalidationState;
 
 struct CORE_EXPORT PaintInfo {
-    ALLOW_ONLY_INLINE_ALLOCATION();
+    DISALLOW_NEW_EXCEPT_PLACEMENT_NEW();
     PaintInfo(GraphicsContext* newContext, const IntRect& cullRect, PaintPhase newPhase, GlobalPaintFlags globalPaintFlags, PaintLayerFlags paintFlags,
         LayoutObject* newPaintingRoot = nullptr, const LayoutBoxModelObject* newPaintContainer = nullptr)
         : context(newContext)

diff --git a/third_party/WebKit/Source/core/paint/PaintLayer.h b/third_party/WebKit/Source/core/paint/PaintLayer.h
index d57f442..ce09fe0 100644
--- a/third_party/WebKit/Source/core/paint/PaintLayer.h
+++ b/third_party/WebKit/Source/core/paint/PaintLayer.h

@@ -475,7 +475,7 @@
     bool hasStyleDeterminedDirectCompositingReasons() const { return m_potentialCompositingReasonsFromStyle & CompositingReasonComboAllDirectStyleDeterminedReasons; }
 
     class AncestorDependentCompositingInputs {
-        DISALLOW_ALLOCATION();
+        DISALLOW_NEW();
     public:
         AncestorDependentCompositingInputs()
             : opacityAncestor(0)
@@ -516,7 +516,7 @@
     };
 
     class DescendantDependentCompositingInputs {
-        DISALLOW_ALLOCATION();
+        DISALLOW_NEW();
     public:
         DescendantDependentCompositingInputs()
             : hasDescendantWithClipPath(false)

diff --git a/third_party/WebKit/Source/core/paint/PaintLayerClipper.h b/third_party/WebKit/Source/core/paint/PaintLayerClipper.h
index 44d2eef6..e7ef075 100644
--- a/third_party/WebKit/Source/core/paint/PaintLayerClipper.h
+++ b/third_party/WebKit/Source/core/paint/PaintLayerClipper.h

@@ -153,7 +153,7 @@
 // clip #fixed. This is the reason why we compute the painting clip rects during
 // a layout tree walk and cache them for painting.
 class PaintLayerClipper {
-    DISALLOW_ALLOCATION();
+    DISALLOW_NEW();
     WTF_MAKE_NONCOPYABLE(PaintLayerClipper);
 public:
     explicit PaintLayerClipper(const LayoutBoxModelObject&);

diff --git a/third_party/WebKit/Source/core/paint/PaintLayerFragment.h b/third_party/WebKit/Source/core/paint/PaintLayerFragment.h
index 34509a1..50155a87 100644
--- a/third_party/WebKit/Source/core/paint/PaintLayerFragment.h
+++ b/third_party/WebKit/Source/core/paint/PaintLayerFragment.h

@@ -44,7 +44,7 @@
 // The fragments are collected by calling PaintLayer::collectFragments
 // on every box once per paint/hit-testing operation.
 struct PaintLayerFragment {
-    ALLOW_ONLY_INLINE_ALLOCATION();
+    DISALLOW_NEW_EXCEPT_PLACEMENT_NEW();
 public:
     void setRects(const LayoutRect& bounds, const ClipRect& background, const ClipRect& foreground)
     {

diff --git a/third_party/WebKit/Source/core/paint/PaintLayerScrollableArea.h b/third_party/WebKit/Source/core/paint/PaintLayerScrollableArea.h
index a4029cb1..c09f35f3 100644
--- a/third_party/WebKit/Source/core/paint/PaintLayerScrollableArea.h
+++ b/third_party/WebKit/Source/core/paint/PaintLayerScrollableArea.h

@@ -104,7 +104,7 @@
 
 private:
     class ScrollbarManager {
-        DISALLOW_ALLOCATION();
+        DISALLOW_NEW();
 
         // Helper class to manage the life cycle of Scrollbar objects.  Some layout containers
         // (e.g., flexbox, table) run multi-pass layout on their children, applying different

diff --git a/third_party/WebKit/Source/core/paint/RoundedInnerRectClipper.h b/third_party/WebKit/Source/core/paint/RoundedInnerRectClipper.h
index 7541851..eaaca6b 100644
--- a/third_party/WebKit/Source/core/paint/RoundedInnerRectClipper.h
+++ b/third_party/WebKit/Source/core/paint/RoundedInnerRectClipper.h

@@ -21,7 +21,7 @@
 };
 
 class RoundedInnerRectClipper {
-    ALLOW_ONLY_INLINE_ALLOCATION();
+    DISALLOW_NEW_EXCEPT_PLACEMENT_NEW();
 public:
     RoundedInnerRectClipper(const LayoutObject&, const PaintInfo&, const LayoutRect&, const FloatRoundedRect& clipRect, RoundedInnerRectClipperBehavior);
     ~RoundedInnerRectClipper();

diff --git a/third_party/WebKit/Source/core/paint/ScopeRecorder.h b/third_party/WebKit/Source/core/paint/ScopeRecorder.h
index 216ec19..f45682a 100644
--- a/third_party/WebKit/Source/core/paint/ScopeRecorder.h
+++ b/third_party/WebKit/Source/core/paint/ScopeRecorder.h

@@ -16,7 +16,7 @@
 class PaintController;
 
 class CORE_EXPORT ScopeRecorder {
-    ALLOW_ONLY_INLINE_ALLOCATION();
+    DISALLOW_NEW_EXCEPT_PLACEMENT_NEW();
 public:
     ScopeRecorder(GraphicsContext&);
 

diff --git a/third_party/WebKit/Source/core/paint/ThemePainter.h b/third_party/WebKit/Source/core/paint/ThemePainter.h
index 80ec3bd..456392d 100644
--- a/third_party/WebKit/Source/core/paint/ThemePainter.h
+++ b/third_party/WebKit/Source/core/paint/ThemePainter.h

@@ -34,7 +34,7 @@
 struct PaintInfo;
 
 class ThemePainter {
-    DISALLOW_ALLOCATION();
+    DISALLOW_NEW();
 public:
     // This method is called to paint the widget as a background of the LayoutObject.  A widget's foreground, e.g., the
     // text of a button, is always rendered by the engine itself.  The boolean return value indicates

diff --git a/third_party/WebKit/Source/core/style/AppliedTextDecoration.h b/third_party/WebKit/Source/core/style/AppliedTextDecoration.h
index b8eb30c..5fe4d01 100644
--- a/third_party/WebKit/Source/core/style/AppliedTextDecoration.h
+++ b/third_party/WebKit/Source/core/style/AppliedTextDecoration.h

@@ -12,7 +12,7 @@
 namespace blink {
 
 class AppliedTextDecoration {
-    ALLOW_ONLY_INLINE_ALLOCATION();
+    DISALLOW_NEW_EXCEPT_PLACEMENT_NEW();
 public:
     AppliedTextDecoration(TextDecoration, TextDecorationStyle, StyleColor);
     explicit AppliedTextDecoration(TextDecoration);

diff --git a/third_party/WebKit/Source/core/style/BasicShapes.h b/third_party/WebKit/Source/core/style/BasicShapes.h
index e21249b1..26043257 100644
--- a/third_party/WebKit/Source/core/style/BasicShapes.h
+++ b/third_party/WebKit/Source/core/style/BasicShapes.h

@@ -78,7 +78,7 @@
     DEFINE_TYPE_CASTS(thisType, BasicShape, value, value->type() == BasicShape::thisType##Type, value.type() == BasicShape::thisType##Type)
 
 class BasicShapeCenterCoordinate {
-    DISALLOW_ALLOCATION();
+    DISALLOW_NEW();
 public:
     enum Direction {
         TopLeft,
@@ -117,7 +117,7 @@
 };
 
 class BasicShapeRadius {
-    DISALLOW_ALLOCATION();
+    DISALLOW_NEW();
 public:
     enum Type {
         Value,

diff --git a/third_party/WebKit/Source/core/style/BorderData.h b/third_party/WebKit/Source/core/style/BorderData.h
index e96b5a26..2e1dc4a 100644
--- a/third_party/WebKit/Source/core/style/BorderData.h
+++ b/third_party/WebKit/Source/core/style/BorderData.h

@@ -34,7 +34,7 @@
 namespace blink {
 
 class BorderData {
-    DISALLOW_ALLOCATION();
+    DISALLOW_NEW();
 friend class ComputedStyle;
 public:
     BorderData() : m_topLeft(Length(0, Fixed), Length(0, Fixed))

diff --git a/third_party/WebKit/Source/core/style/BorderImageLength.h b/third_party/WebKit/Source/core/style/BorderImageLength.h
index 0dd8df7..8219fd3c 100644
--- a/third_party/WebKit/Source/core/style/BorderImageLength.h
+++ b/third_party/WebKit/Source/core/style/BorderImageLength.h

@@ -41,7 +41,7 @@
 // http://www.w3.org/TR/css3-background/#border-image-width
 // http://www.w3.org/TR/css3-background/#border-image-outset
 class BorderImageLength {
-    DISALLOW_ALLOCATION();
+    DISALLOW_NEW();
 public:
     BorderImageLength(double number)
         : m_number(number)

diff --git a/third_party/WebKit/Source/core/style/BorderImageLengthBox.h b/third_party/WebKit/Source/core/style/BorderImageLengthBox.h
index bff13ded..e5fe1d5 100644
--- a/third_party/WebKit/Source/core/style/BorderImageLengthBox.h
+++ b/third_party/WebKit/Source/core/style/BorderImageLengthBox.h

@@ -41,7 +41,7 @@
 // http://www.w3.org/TR/css3-background/#border-image-width
 // http://www.w3.org/TR/css3-background/#border-image-outset
 class BorderImageLengthBox {
-    DISALLOW_ALLOCATION();
+    DISALLOW_NEW();
 public:
     BorderImageLengthBox(Length length)
         : m_left(length)

diff --git a/third_party/WebKit/Source/core/style/BorderValue.h b/third_party/WebKit/Source/core/style/BorderValue.h
index df184ea..1713110 100644
--- a/third_party/WebKit/Source/core/style/BorderValue.h
+++ b/third_party/WebKit/Source/core/style/BorderValue.h

@@ -33,7 +33,7 @@
 namespace blink {
 
 class BorderValue {
-    DISALLOW_ALLOCATION();
+    DISALLOW_NEW();
 friend class ComputedStyle;
 public:
     BorderValue()

diff --git a/third_party/WebKit/Source/core/style/CollapsedBorderValue.h b/third_party/WebKit/Source/core/style/CollapsedBorderValue.h
index 7e68396..f780d7d07 100644
--- a/third_party/WebKit/Source/core/style/CollapsedBorderValue.h
+++ b/third_party/WebKit/Source/core/style/CollapsedBorderValue.h

@@ -31,7 +31,7 @@
 namespace blink {
 
 class CollapsedBorderValue {
-    ALLOW_ONLY_INLINE_ALLOCATION();
+    DISALLOW_NEW_EXCEPT_PLACEMENT_NEW();
 public:
     CollapsedBorderValue()
         : m_color(0)

diff --git a/third_party/WebKit/Source/core/style/CounterDirectives.h b/third_party/WebKit/Source/core/style/CounterDirectives.h
index ca52e26..6e6de38 100644
--- a/third_party/WebKit/Source/core/style/CounterDirectives.h
+++ b/third_party/WebKit/Source/core/style/CounterDirectives.h

@@ -35,7 +35,7 @@
 namespace blink {
 
 class CounterDirectives {
-    ALLOW_ONLY_INLINE_ALLOCATION();
+    DISALLOW_NEW_EXCEPT_PLACEMENT_NEW();
 public:
     CounterDirectives()
         : m_isResetSet(false)

diff --git a/third_party/WebKit/Source/core/style/CursorData.h b/third_party/WebKit/Source/core/style/CursorData.h
index 792c5f6..d72fa6d 100644
--- a/third_party/WebKit/Source/core/style/CursorData.h
+++ b/third_party/WebKit/Source/core/style/CursorData.h

@@ -31,7 +31,7 @@
 namespace blink {
 
 class CursorData {
-    ALLOW_ONLY_INLINE_ALLOCATION();
+    DISALLOW_NEW_EXCEPT_PLACEMENT_NEW();
 public:
     CursorData(PassRefPtrWillBeRawPtr<StyleImage> image, bool hotSpotSpecified, const IntPoint& hotSpot)
         : m_image(image)

diff --git a/third_party/WebKit/Source/core/style/GridLength.h b/third_party/WebKit/Source/core/style/GridLength.h
index 8f50f379..2e1adfc 100644
--- a/third_party/WebKit/Source/core/style/GridLength.h
+++ b/third_party/WebKit/Source/core/style/GridLength.h

@@ -40,7 +40,7 @@
 // or <flex>. This class avoids spreading the knowledge of <flex> throughout the layout directory by adding
 // an new unit to Length.h.
 class GridLength {
-    DISALLOW_ALLOCATION();
+    DISALLOW_NEW();
 public:
     GridLength(const Length& length)
         : m_length(length)

diff --git a/third_party/WebKit/Source/core/style/GridPosition.h b/third_party/WebKit/Source/core/style/GridPosition.h
index 255c6b9..2ec1653 100644
--- a/third_party/WebKit/Source/core/style/GridPosition.h
+++ b/third_party/WebKit/Source/core/style/GridPosition.h

@@ -44,7 +44,7 @@
 };
 
 class GridPosition {
-    DISALLOW_ALLOCATION();
+    DISALLOW_NEW();
 public:
     GridPosition()
         : m_type(AutoPosition)

diff --git a/third_party/WebKit/Source/core/style/GridResolvedPosition.h b/third_party/WebKit/Source/core/style/GridResolvedPosition.h
index 70527ec7..184d312 100644
--- a/third_party/WebKit/Source/core/style/GridResolvedPosition.h
+++ b/third_party/WebKit/Source/core/style/GridResolvedPosition.h

@@ -29,7 +29,7 @@
 // This class represents an index into one of the dimensions of the grid array.
 // Wraps a size_t integer just for the purpose of knowing what we manipulate in the grid code.
 class GridResolvedPosition {
-    DISALLOW_ALLOCATION();
+    DISALLOW_NEW();
 public:
     static GridResolvedPosition adjustGridPositionForAfterEndSide(size_t resolvedPosition)
     {

diff --git a/third_party/WebKit/Source/core/style/GridTrackSize.h b/third_party/WebKit/Source/core/style/GridTrackSize.h
index 47b4e6a..9cd61495 100644
--- a/third_party/WebKit/Source/core/style/GridTrackSize.h
+++ b/third_party/WebKit/Source/core/style/GridTrackSize.h

@@ -42,7 +42,7 @@
 };
 
 class GridTrackSize {
-    ALLOW_ONLY_INLINE_ALLOCATION();
+    DISALLOW_NEW_EXCEPT_PLACEMENT_NEW();
 public:
     GridTrackSize(const GridLength& length)
         : m_type(LengthTrackSizing)

diff --git a/third_party/WebKit/Source/core/style/LineClampValue.h b/third_party/WebKit/Source/core/style/LineClampValue.h
index a22af27b..04af6e5 100644
--- a/third_party/WebKit/Source/core/style/LineClampValue.h
+++ b/third_party/WebKit/Source/core/style/LineClampValue.h

@@ -31,7 +31,7 @@
 namespace blink {
 
 class LineClampValue {
-    DISALLOW_ALLOCATION();
+    DISALLOW_NEW();
 public:
     LineClampValue()
         : m_type(LineClampLineCount)

diff --git a/third_party/WebKit/Source/core/style/NinePieceImage.h b/third_party/WebKit/Source/core/style/NinePieceImage.h
index 0db030f3..8c1a50e2 100644
--- a/third_party/WebKit/Source/core/style/NinePieceImage.h
+++ b/third_party/WebKit/Source/core/style/NinePieceImage.h

@@ -60,7 +60,7 @@
 };
 
 class CORE_EXPORT NinePieceImage {
-    DISALLOW_ALLOCATION();
+    DISALLOW_NEW();
 public:
     NinePieceImage();
     NinePieceImage(PassRefPtrWillBeRawPtr<StyleImage>, LengthBox imageSlices, bool fill, const BorderImageLengthBox& borderSlices,

diff --git a/third_party/WebKit/Source/core/style/OutlineValue.h b/third_party/WebKit/Source/core/style/OutlineValue.h
index 61cce2b..6018048 100644
--- a/third_party/WebKit/Source/core/style/OutlineValue.h
+++ b/third_party/WebKit/Source/core/style/OutlineValue.h

@@ -31,7 +31,7 @@
 namespace blink {
 
 class OutlineValue final : public BorderValue {
-    DISALLOW_ALLOCATION();
+    DISALLOW_NEW();
 friend class ComputedStyle;
 public:
     OutlineValue()

diff --git a/third_party/WebKit/Source/core/style/SVGComputedStyleDefs.h b/third_party/WebKit/Source/core/style/SVGComputedStyleDefs.h
index 1c0fdec..ae3e3a9a 100644
--- a/third_party/WebKit/Source/core/style/SVGComputedStyleDefs.h
+++ b/third_party/WebKit/Source/core/style/SVGComputedStyleDefs.h

@@ -143,7 +143,7 @@
 };
 
 class UnzoomedLength {
-    DISALLOW_ALLOCATION();
+    DISALLOW_NEW();
 public:
     explicit UnzoomedLength(const Length& length) : m_length(length) { }
 

diff --git a/third_party/WebKit/Source/core/style/StyleContentAlignmentData.h b/third_party/WebKit/Source/core/style/StyleContentAlignmentData.h
index e55596c..495b8aad120 100644
--- a/third_party/WebKit/Source/core/style/StyleContentAlignmentData.h
+++ b/third_party/WebKit/Source/core/style/StyleContentAlignmentData.h

@@ -11,7 +11,7 @@
 namespace blink {
 
 class StyleContentAlignmentData {
-    DISALLOW_ALLOCATION();
+    DISALLOW_NEW();
 public:
     // Style data for Content-Distribution properties: align-content, justify-content.
     // <content-distribution> || [ <overflow-position>? && <content-position> ]

diff --git a/third_party/WebKit/Source/core/style/StyleMotionData.h b/third_party/WebKit/Source/core/style/StyleMotionData.h
index cac7bd4..3a635cdc 100644
--- a/third_party/WebKit/Source/core/style/StyleMotionData.h
+++ b/third_party/WebKit/Source/core/style/StyleMotionData.h

@@ -13,7 +13,7 @@
 namespace blink {
 
 class StyleMotionData {
-    DISALLOW_ALLOCATION();
+    DISALLOW_NEW();
 public:
     StyleMotionData(StyleMotionPath* path, const Length& offset, float rotation, MotionRotationType rotationType)
         : m_path(path)

diff --git a/third_party/WebKit/Source/core/style/StyleScrollSnapData.h b/third_party/WebKit/Source/core/style/StyleScrollSnapData.h
index 52fd4ad..0490caf 100644
--- a/third_party/WebKit/Source/core/style/StyleScrollSnapData.h
+++ b/third_party/WebKit/Source/core/style/StyleScrollSnapData.h

@@ -34,7 +34,7 @@
 namespace blink {
 
 struct ScrollSnapPoints {
-    DISALLOW_ALLOCATION();
+    DISALLOW_NEW();
     Length repeatOffset;
     bool hasRepeat;
     bool usesElements;

diff --git a/third_party/WebKit/Source/core/style/StyleSelfAlignmentData.h b/third_party/WebKit/Source/core/style/StyleSelfAlignmentData.h
index 23030a8..eb0288a 100644
--- a/third_party/WebKit/Source/core/style/StyleSelfAlignmentData.h
+++ b/third_party/WebKit/Source/core/style/StyleSelfAlignmentData.h

@@ -11,7 +11,7 @@
 namespace blink {
 
 class StyleSelfAlignmentData {
-    DISALLOW_ALLOCATION();
+    DISALLOW_NEW();
 public:
     // Style data for Self-Aligment and Default-Alignment properties: align-{self, items}, justify-{self, items}.
     // [ <self-position> && <overflow-position>? ] | [ legacy && [ left | right | center ] ]

diff --git a/third_party/WebKit/Source/core/style/TransformOrigin.h b/third_party/WebKit/Source/core/style/TransformOrigin.h
index f4a32ee..9fb7be7 100644
--- a/third_party/WebKit/Source/core/style/TransformOrigin.h
+++ b/third_party/WebKit/Source/core/style/TransformOrigin.h

@@ -11,7 +11,7 @@
 namespace blink {
 
 class TransformOrigin {
-    DISALLOW_ALLOCATION();
+    DISALLOW_NEW();
 public:
     TransformOrigin(const Length& x, const Length& y, float z) : m_x(x), m_y(y), m_z(z) { }
     bool operator==(const TransformOrigin& o) const { return m_x == o.m_x && m_y == o.m_y && m_z == o.m_z; }

diff --git a/third_party/WebKit/Source/core/svg/GradientAttributes.h b/third_party/WebKit/Source/core/svg/GradientAttributes.h
index 58dde97..251194c 100644
--- a/third_party/WebKit/Source/core/svg/GradientAttributes.h
+++ b/third_party/WebKit/Source/core/svg/GradientAttributes.h

@@ -26,7 +26,7 @@
 namespace blink {
 
 struct GradientAttributes {
-    DISALLOW_ALLOCATION();
+    DISALLOW_NEW();
     GradientAttributes()
         : m_spreadMethod(SVGSpreadMethodPad)
         , m_gradientUnits(SVGUnitTypes::SVG_UNIT_TYPE_OBJECTBOUNDINGBOX)
@@ -87,7 +87,7 @@
 };
 
 struct SameSizeAsGradientAttributes {
-    DISALLOW_ALLOCATION();
+    DISALLOW_NEW();
     AffineTransform a;
     Vector<Gradient::ColorStop> b;
     unsigned c : 8;

diff --git a/third_party/WebKit/Source/core/svg/LinearGradientAttributes.h b/third_party/WebKit/Source/core/svg/LinearGradientAttributes.h
index e1f3567..809d8b1 100644
--- a/third_party/WebKit/Source/core/svg/LinearGradientAttributes.h
+++ b/third_party/WebKit/Source/core/svg/LinearGradientAttributes.h

@@ -27,7 +27,7 @@
 namespace blink {
 
 struct LinearGradientAttributes : GradientAttributes {
-    DISALLOW_ALLOCATION();
+    DISALLOW_NEW();
 public:
     LinearGradientAttributes()
         : m_x1(SVGLength::create(SVGLengthMode::Width))

diff --git a/third_party/WebKit/Source/core/svg/PatternAttributes.h b/third_party/WebKit/Source/core/svg/PatternAttributes.h
index 757ce96..fc91564 100644
--- a/third_party/WebKit/Source/core/svg/PatternAttributes.h
+++ b/third_party/WebKit/Source/core/svg/PatternAttributes.h

@@ -30,7 +30,7 @@
 class SVGPatternElement;
 
 class PatternAttributes final {
-    DISALLOW_ALLOCATION();
+    DISALLOW_NEW();
 public:
     PatternAttributes()
         : m_x(SVGLength::create(SVGLengthMode::Width))

diff --git a/third_party/WebKit/Source/core/svg/RadialGradientAttributes.h b/third_party/WebKit/Source/core/svg/RadialGradientAttributes.h
index 83a3856..7a752b7 100644
--- a/third_party/WebKit/Source/core/svg/RadialGradientAttributes.h
+++ b/third_party/WebKit/Source/core/svg/RadialGradientAttributes.h

@@ -25,7 +25,7 @@
 
 namespace blink {
 struct RadialGradientAttributes final : GradientAttributes {
-    DISALLOW_ALLOCATION();
+    DISALLOW_NEW();
 public:
     RadialGradientAttributes()
         : m_cx(SVGLength::create(SVGLengthMode::Width))

diff --git a/third_party/WebKit/Source/core/svg/SVGAnimatedTypeAnimator.h b/third_party/WebKit/Source/core/svg/SVGAnimatedTypeAnimator.h
index 7d76711..5bdba04e 100644
--- a/third_party/WebKit/Source/core/svg/SVGAnimatedTypeAnimator.h
+++ b/third_party/WebKit/Source/core/svg/SVGAnimatedTypeAnimator.h

@@ -39,7 +39,7 @@
 using SVGElementInstances = WillBeHeapVector<RawPtrWillBeMember<SVGElement>, 1u>;
 
 class SVGAnimatedTypeAnimator final {
-    DISALLOW_ALLOCATION();
+    DISALLOW_NEW();
 public:
     SVGAnimatedTypeAnimator(SVGAnimationElement*);
 

diff --git a/third_party/WebKit/Source/core/svg/SVGDocumentExtensions.cpp b/third_party/WebKit/Source/core/svg/SVGDocumentExtensions.cpp
index e3a6fb55..b5dd1e5 100644
--- a/third_party/WebKit/Source/core/svg/SVGDocumentExtensions.cpp
+++ b/third_party/WebKit/Source/core/svg/SVGDocumentExtensions.cpp

@@ -22,6 +22,11 @@
 #include "config.h"
 #include "core/svg/SVGDocumentExtensions.h"
 
+#include "core/animation/AnimationStack.h"
+#include "core/animation/ElementAnimations.h"
+#include "core/animation/InterpolationEnvironment.h"
+#include "core/animation/InvalidatableInterpolation.h"
+#include "core/animation/SVGInterpolation.h"
 #include "core/dom/Document.h"
 #include "core/inspector/ConsoleMessage.h"
 #include "core/layout/svg/SVGResourcesCache.h"
@@ -54,6 +59,12 @@
     m_timeContainers.remove(element);
 }
 
+void SVGDocumentExtensions::addWebAnimationsPendingSVGElement(SVGElement& element)
+{
+    ASSERT(RuntimeEnabledFeatures::webAnimationsSVGEnabled());
+    m_webAnimationsPendingSVGElements.add(&element);
+}
+
 void SVGDocumentExtensions::addResource(const AtomicString& id, LayoutSVGResourceContainer* resource)
 {
     ASSERT(resource);
@@ -83,17 +94,46 @@
 
 void SVGDocumentExtensions::serviceOnAnimationFrame(Document& document, double monotonicAnimationStartTime)
 {
-    if (!document.svgExtensions() || !RuntimeEnabledFeatures::smilEnabled())
+    if (!document.svgExtensions())
         return;
     document.accessSVGExtensions().serviceAnimations(monotonicAnimationStartTime);
 }
 
+static bool isSVGAttributeHandle(const PropertyHandle& propertyHandle)
+{
+    return propertyHandle.isSVGAttribute();
+}
+
 void SVGDocumentExtensions::serviceAnimations(double monotonicAnimationStartTime)
 {
-    WillBeHeapVector<RefPtrWillBeMember<SVGSVGElement>> timeContainers;
-    copyToVector(m_timeContainers, timeContainers);
-    for (const auto& container : timeContainers)
-        container->timeContainer()->serviceAnimations(monotonicAnimationStartTime);
+    if (RuntimeEnabledFeatures::smilEnabled()) {
+        WillBeHeapVector<RefPtrWillBeMember<SVGSVGElement>> timeContainers;
+        copyToVector(m_timeContainers, timeContainers);
+        for (const auto& container : timeContainers)
+            container->timeContainer()->serviceAnimations(monotonicAnimationStartTime);
+    }
+
+    SVGElementSet webAnimationsPendingSVGElements;
+    webAnimationsPendingSVGElements.swap(m_webAnimationsPendingSVGElements);
+
+    // TODO(alancutter): Make SVG animation effect application a separate document lifecycle phase from servicing animations to be responsive to Javascript manipulation of exposed animation objects.
+    for (auto& svgElement : webAnimationsPendingSVGElements) {
+        ActiveInterpolationsMap activeInterpolationsMap = AnimationStack::activeInterpolations(
+            &svgElement->elementAnimations()->animationStack(), nullptr, nullptr, KeyframeEffect::DefaultPriority, isSVGAttributeHandle);
+        for (auto& entry : activeInterpolationsMap) {
+            const QualifiedName& attribute = entry.key.svgAttribute();
+            const Interpolation& interpolation = *entry.value.first();
+            if (interpolation.isInvalidatableInterpolation()) {
+                InterpolationEnvironment environment(*svgElement, svgElement->propertyFromAttribute(attribute)->baseValueBase());
+                InvalidatableInterpolation::applyStack(entry.value, environment);
+            } else {
+                // TODO(alancutter): Remove this old code path once animations have completely migrated to InterpolationTypes.
+                toSVGInterpolation(interpolation).apply(*svgElement);
+            }
+        }
+    }
+
+    ASSERT(m_webAnimationsPendingSVGElements.isEmpty());
 }
 
 void SVGDocumentExtensions::startAnimations()
@@ -356,6 +396,7 @@
 #if ENABLE(OILPAN)
     visitor->trace(m_document);
     visitor->trace(m_timeContainers);
+    visitor->trace(m_webAnimationsPendingSVGElements);
     visitor->trace(m_relativeLengthSVGRoots);
     visitor->trace(m_pendingResources);
     visitor->trace(m_pendingResourcesForRemoval);

diff --git a/third_party/WebKit/Source/core/svg/SVGDocumentExtensions.h b/third_party/WebKit/Source/core/svg/SVGDocumentExtensions.h
index 31e82e9..5ea0e97 100644
--- a/third_party/WebKit/Source/core/svg/SVGDocumentExtensions.h
+++ b/third_party/WebKit/Source/core/svg/SVGDocumentExtensions.h

@@ -35,6 +35,7 @@
 class LayoutSVGResourceContainer;
 class SubtreeLayoutScope;
 class SVGSVGElement;
+class SVGElement;
 class Element;
 
 class SVGDocumentExtensions : public NoBaseWillBeGarbageCollectedFinalized<SVGDocumentExtensions> {
@@ -47,6 +48,9 @@
     void addTimeContainer(SVGSVGElement*);
     void removeTimeContainer(SVGSVGElement*);
 
+    // Records the SVG element as having a Web Animation on an SVG attribute that needs applying.
+    void addWebAnimationsPendingSVGElement(SVGElement&);
+
     void addResource(const AtomicString& id, LayoutSVGResourceContainer*);
     void removeResource(const AtomicString& id);
     LayoutSVGResourceContainer* resourceById(const AtomicString& id) const;
@@ -80,6 +84,8 @@
 private:
     RawPtrWillBeMember<Document> m_document;
     WillBeHeapHashSet<RawPtrWillBeMember<SVGSVGElement>> m_timeContainers; // For SVG 1.2 support this will need to be made more general.
+    using SVGElementSet = WillBeHeapHashSet<RefPtrWillBeMember<SVGElement>>;
+    SVGElementSet m_webAnimationsPendingSVGElements;
     HashMap<AtomicString, LayoutSVGResourceContainer*> m_resources;
     WillBeHeapHashMap<AtomicString, OwnPtrWillBeMember<SVGPendingElements>> m_pendingResources; // Resources that are pending.
     WillBeHeapHashMap<AtomicString, OwnPtrWillBeMember<SVGPendingElements>> m_pendingResourcesForRemoval; // Resources that are pending and scheduled for removal.

diff --git a/third_party/WebKit/Source/core/svg/SVGElement.cpp b/third_party/WebKit/Source/core/svg/SVGElement.cpp
index 1eb68406..42d8e37 100644
--- a/third_party/WebKit/Source/core/svg/SVGElement.cpp
+++ b/third_party/WebKit/Source/core/svg/SVGElement.cpp

@@ -235,6 +235,11 @@
         svgRareData()->setInstanceUpdatesBlocked(value);
 }
 
+void SVGElement::setWebAnimationsPending()
+{
+    document().accessSVGExtensions().addWebAnimationsPendingSVGElement(*this);
+}
+
 AffineTransform SVGElement::localCoordinateSpaceTransform(CTMScope) const
 {
     // To be overriden by SVGGraphicsElement (or as special case SVGTextElement and SVGPatternElement)

diff --git a/third_party/WebKit/Source/core/svg/SVGElement.h b/third_party/WebKit/Source/core/svg/SVGElement.h
index b98b5f4..04ce2a3 100644
--- a/third_party/WebKit/Source/core/svg/SVGElement.h
+++ b/third_party/WebKit/Source/core/svg/SVGElement.h

@@ -80,6 +80,9 @@
     bool instanceUpdatesBlocked() const;
     void setInstanceUpdatesBlocked(bool);
 
+    // Records the SVG element as having a Web Animation on an SVG attribute that needs applying.
+    void setWebAnimationsPending();
+
     SVGSVGElement* ownerSVGElement() const;
     SVGElement* viewportElement() const;
 

diff --git a/third_party/WebKit/Source/core/svg/animation/SMILTime.h b/third_party/WebKit/Source/core/svg/animation/SMILTime.h
index 6119d18..78f8c2dc 100644
--- a/third_party/WebKit/Source/core/svg/animation/SMILTime.h
+++ b/third_party/WebKit/Source/core/svg/animation/SMILTime.h

@@ -34,7 +34,7 @@
 namespace blink {
 
 class SMILTime {
-    ALLOW_ONLY_INLINE_ALLOCATION();
+    DISALLOW_NEW_EXCEPT_PLACEMENT_NEW();
 public:
     SMILTime() : m_time(0) { }
     SMILTime(double time) : m_time(time) { }
@@ -53,7 +53,7 @@
 };
 
 class SMILTimeWithOrigin {
-    ALLOW_ONLY_INLINE_ALLOCATION();
+    DISALLOW_NEW_EXCEPT_PLACEMENT_NEW();
 public:
     enum Origin {
         ParserOrigin,
@@ -80,7 +80,7 @@
 };
 
 struct SMILInterval {
-    DISALLOW_ALLOCATION();
+    DISALLOW_NEW();
     SMILInterval() { }
     SMILInterval(const SMILTime& begin, const SMILTime& end) : begin(begin), end(end) { }
 

diff --git a/third_party/WebKit/Source/core/testing/InternalSettings.h b/third_party/WebKit/Source/core/testing/InternalSettings.h
index 46b68d1f..23b52a0 100644
--- a/third_party/WebKit/Source/core/testing/InternalSettings.h
+++ b/third_party/WebKit/Source/core/testing/InternalSettings.h

@@ -56,7 +56,7 @@
     DEFINE_WRAPPERTYPEINFO();
 public:
     class Backup {
-        DISALLOW_ALLOCATION();
+        DISALLOW_NEW();
     public:
         explicit Backup(Settings*);
         void restoreTo(Settings*);

diff --git a/third_party/WebKit/Source/core/timing/MemoryInfo.h b/third_party/WebKit/Source/core/timing/MemoryInfo.h
index 43e4c06..ae45dea 100644
--- a/third_party/WebKit/Source/core/timing/MemoryInfo.h
+++ b/third_party/WebKit/Source/core/timing/MemoryInfo.h

@@ -39,7 +39,7 @@
 namespace blink {
 
 struct HeapInfo {
-    DISALLOW_ALLOCATION();
+    DISALLOW_NEW();
     HeapInfo()
         : usedJSHeapSize(0)
         , totalJSHeapSize(0)

diff --git a/third_party/WebKit/Source/core/workers/SharedWorkerRepositoryClient.h b/third_party/WebKit/Source/core/workers/SharedWorkerRepositoryClient.h
index e965e05..b447a28 100644
--- a/third_party/WebKit/Source/core/workers/SharedWorkerRepositoryClient.h
+++ b/third_party/WebKit/Source/core/workers/SharedWorkerRepositoryClient.h

@@ -48,7 +48,7 @@
 
 class SharedWorkerRepositoryClient {
     WTF_MAKE_NONCOPYABLE(SharedWorkerRepositoryClient);
-    DISALLOW_ALLOCATION();
+    DISALLOW_NEW();
 public:
     SharedWorkerRepositoryClient() { }
     virtual ~SharedWorkerRepositoryClient() { }

diff --git a/third_party/WebKit/Source/core/xml/XPathValue.h b/third_party/WebKit/Source/core/xml/XPathValue.h
index 50a84323..78ac0c08 100644
--- a/third_party/WebKit/Source/core/xml/XPathValue.h
+++ b/third_party/WebKit/Source/core/xml/XPathValue.h

@@ -58,7 +58,7 @@
 
 // Copying Value objects makes their data partially shared, so care has to be taken when dealing with copies.
 class Value {
-    DISALLOW_ALLOCATION();
+    DISALLOW_NEW();
 public:
     enum Type { NodeSetValue, BooleanValue, NumberValue, StringValue };
 

diff --git a/third_party/WebKit/Source/core/xml/XSLTProcessorLibxslt.cpp b/third_party/WebKit/Source/core/xml/XSLTProcessorLibxslt.cpp
index cad57f3..4507fb1 100644
--- a/third_party/WebKit/Source/core/xml/XSLTProcessorLibxslt.cpp
+++ b/third_party/WebKit/Source/core/xml/XSLTProcessorLibxslt.cpp

@@ -189,6 +189,14 @@
     return true;
 }
 
+static char* allocateParameterArray(const char* data)
+{
+    size_t length = strlen(data) + 1;
+    char* parameterArray = static_cast<char*>(WTF::Partitions::fastMalloc(length));
+    memcpy(parameterArray, data, length);
+    return parameterArray;
+}
+
 static const char** xsltParamArrayFromParameterMap(XSLTProcessor::ParameterMap& parameters)
 {
     if (parameters.isEmpty())
@@ -198,8 +206,8 @@
 
     unsigned index = 0;
     for (auto& parameter : parameters) {
-        parameterArray[index++] = WTF::Partitions::fastStrDup(parameter.key.utf8().data());
-        parameterArray[index++] = WTF::Partitions::fastStrDup(parameter.value.utf8().data());
+        parameterArray[index++] = allocateParameterArray(parameter.key.utf8().data());
+        parameterArray[index++] = allocateParameterArray(parameter.value.utf8().data());
     }
     parameterArray[index] = 0;
 

diff --git a/third_party/WebKit/Source/core/xml/parser/XMLErrors.h b/third_party/WebKit/Source/core/xml/parser/XMLErrors.h
index d47ecb8..89f7154 100644
--- a/third_party/WebKit/Source/core/xml/parser/XMLErrors.h
+++ b/third_party/WebKit/Source/core/xml/parser/XMLErrors.h

@@ -38,7 +38,7 @@
 class Document;
 
 class XMLErrors {
-    DISALLOW_ALLOCATION();
+    DISALLOW_NEW();
 public:
     explicit XMLErrors(Document*);
     DECLARE_TRACE();

diff --git a/third_party/WebKit/Source/devtools/protocol.json b/third_party/WebKit/Source/devtools/protocol.json
index dff962f7..c41debf 100644
--- a/third_party/WebKit/Source/devtools/protocol.json
+++ b/third_party/WebKit/Source/devtools/protocol.json

@@ -3121,6 +3121,24 @@
                 ],
                 "description": "Information about amount of glyphs that were rendered with given font.",
                 "hidden": true
+            },
+            {
+                "id": "CSSKeyframesRule",
+                "type": "object",
+                "properties": [
+                    { "name": "animationName", "type": "string", "description": "Animation name." },
+                    { "name": "keyframes", "type": "array", "items": { "$ref": "CSSKeyframeRule" }, "description": "List of keyframes." }
+                ],
+                "description": "CSS keyframes rule representation."
+            },
+            {
+                "id": "CSSKeyframeRule",
+                "type": "object",
+                "properties": [
+                    { "name": "keyText", "type": "string", "description": "Associated key text." },
+                    { "name": "style", "$ref": "CSSStyle", "description": "Associated style declaration." }
+                ],
+                "description": "CSS keyframe rule representation."
             }
         ],
         "commands": [
@@ -3180,6 +3198,16 @@
                 "hidden": true
             },
             {
+                "name": "getCSSAnimationsForNode",
+                "parameters": [
+                    { "name": "nodeId", "$ref": "DOM.NodeId" }
+                ],
+                "returns": [
+                    { "name": "cssKeyframesRules", "type": "array", "items": { "$ref": "CSSKeyframesRule" }, "optional": true, "description": "A list of CSS keyframed animations matching this node." }
+                ],
+                "description": "Returns all CSS keyframed animations mtaching this node."
+            },
+            {
                 "name": "getStyleSheetText",
                 "parameters": [
                     { "name": "styleSheetId", "$ref": "StyleSheetId" }

diff --git a/third_party/WebKit/Source/modules/accessibility/AXObject.h b/third_party/WebKit/Source/modules/accessibility/AXObject.h
index 3111ccd..644ceee 100644
--- a/third_party/WebKit/Source/modules/accessibility/AXObject.h
+++ b/third_party/WebKit/Source/modules/accessibility/AXObject.h

@@ -364,7 +364,7 @@
 };
 
 class IgnoredReason {
-    ALLOW_ONLY_INLINE_ALLOCATION();
+    DISALLOW_NEW_EXCEPT_PLACEMENT_NEW();
 public:
     AXIgnoredReason reason;
     Member<const AXObject> relatedObject;
@@ -404,7 +404,7 @@
 
 typedef HeapVector<Member<NameSourceRelatedObject>> AXRelatedObjectVector;
 class NameSource {
-    ALLOW_ONLY_INLINE_ALLOCATION();
+    DISALLOW_NEW_EXCEPT_PLACEMENT_NEW();
 public:
     String text;
     bool superseded = false;
@@ -438,7 +438,7 @@
     typedef HeapVector<Member<AXObject>> AXObjectVector;
 
     struct AXRange {
-        ALLOW_ONLY_INLINE_ALLOCATION();
+        DISALLOW_NEW_EXCEPT_PLACEMENT_NEW();
         // The deepest descendant in which the range starts.
         // (nullptr means the current object.)
         Persistent<AXObject> anchorObject;

diff --git a/third_party/WebKit/Source/modules/canvas2d/ClipList.h b/third_party/WebKit/Source/modules/canvas2d/ClipList.h
index 9301b97..4fca1c0 100644
--- a/third_party/WebKit/Source/modules/canvas2d/ClipList.h
+++ b/third_party/WebKit/Source/modules/canvas2d/ClipList.h

@@ -17,7 +17,7 @@
 class AffineTransform;
 
 class ClipList {
-    DISALLOW_ALLOCATION();
+    DISALLOW_NEW();
 public:
     ClipList() { }
     ClipList(const ClipList&);

diff --git a/third_party/WebKit/Source/modules/fetch/DataConsumerHandleTestUtil.h b/third_party/WebKit/Source/modules/fetch/DataConsumerHandleTestUtil.h
index 315e4655..9ec29d5 100644
--- a/third_party/WebKit/Source/modules/fetch/DataConsumerHandleTestUtil.h
+++ b/third_party/WebKit/Source/modules/fetch/DataConsumerHandleTestUtil.h

@@ -37,7 +37,7 @@
     STATIC_ONLY(DataConsumerHandleTestUtil);
 public:
     class NoopClient final : public WebDataConsumerHandle::Client {
-        DISALLOW_ALLOCATION();
+        DISALLOW_NEW();
     public:
         void didGetReadable() override { }
     };
@@ -157,7 +157,7 @@
 
         // The reading/updating threads are alive while ThreadHolder is alive.
         class ThreadHolder {
-            DISALLOW_ALLOCATION();
+            DISALLOW_NEW();
         public:
             ThreadHolder(ThreadingTestBase* test)
                 : m_context(test->m_context)
@@ -362,7 +362,7 @@
     };
 
     class Command final {
-        ALLOW_ONLY_INLINE_ALLOCATION();
+        DISALLOW_NEW_EXCEPT_PLACEMENT_NEW();
     public:
         enum Name {
             Data,

diff --git a/third_party/WebKit/Source/modules/fetch/DataConsumerHandleUtil.h b/third_party/WebKit/Source/modules/fetch/DataConsumerHandleUtil.h
index 229aa5b..bbd5585 100644
--- a/third_party/WebKit/Source/modules/fetch/DataConsumerHandleUtil.h
+++ b/third_party/WebKit/Source/modules/fetch/DataConsumerHandleUtil.h

@@ -34,7 +34,7 @@
 // NotifyOnReaderCreationHelper must be owned by a reader and
 // |client| must be the client of the reader.
 class NotifyOnReaderCreationHelper final {
-    DISALLOW_ALLOCATION();
+    DISALLOW_NEW();
 public:
     NotifyOnReaderCreationHelper(WebDataConsumerHandle::Client* /* client */);
 

diff --git a/third_party/WebKit/Source/modules/fetch/FetchManager.cpp b/third_party/WebKit/Source/modules/fetch/FetchManager.cpp
index de11d01..e7425597 100644
--- a/third_party/WebKit/Source/modules/fetch/FetchManager.cpp
+++ b/third_party/WebKit/Source/modules/fetch/FetchManager.cpp

@@ -204,6 +204,18 @@
 {
     ASSERT(handle);
 
+    if (response.url().protocolIs("blob") && response.httpStatusCode() == 404) {
+        // "If |blob| is null, return a network error."
+        // https://fetch.spec.whatwg.org/#concept-basic-fetch
+        performNetworkError("Blob not found.");
+        return;
+    }
+
+    if (response.url().protocolIs("blob") && response.httpStatusCode() == 405) {
+        performNetworkError("Only 'GET' method is allowed for blob URLs.");
+        return;
+    }
+
     m_responseHttpStatusCode = response.httpStatusCode();
 
     if (response.url().protocolIsData()) {
@@ -481,6 +493,8 @@
         performHTTPFetch(false, false);
     } else if (m_request->url().protocolIsData()) {
         performDataFetch();
+    } else if (m_request->url().protocolIs("blob")) {
+        performHTTPFetch(false, false);
     } else {
         // FIXME: implement other protocols.
         performNetworkError("Fetch API cannot load " + m_request->url().string() + ". URL scheme \"" + m_request->url().protocol() + "\" is not supported.");
@@ -494,7 +508,7 @@
 
 void FetchManager::Loader::performHTTPFetch(bool corsFlag, bool corsPreflightFlag)
 {
-    ASSERT(SchemeRegistry::shouldTreatURLSchemeAsSupportingFetchAPI(m_request->url().protocol()));
+    ASSERT(SchemeRegistry::shouldTreatURLSchemeAsSupportingFetchAPI(m_request->url().protocol()) || (m_request->url().protocolIs("blob") && !corsFlag && !corsPreflightFlag));
     // CORS preflight fetch procedure is implemented inside DocumentThreadableLoader.
 
     // "1. Let |HTTPRequest| be a copy of |request|, except that |HTTPRequest|'s

diff --git a/third_party/WebKit/Source/modules/filesystem/SyncCallbackHelper.h b/third_party/WebKit/Source/modules/filesystem/SyncCallbackHelper.h
index f8e992fd..a954d2a 100644
--- a/third_party/WebKit/Source/modules/filesystem/SyncCallbackHelper.h
+++ b/third_party/WebKit/Source/modules/filesystem/SyncCallbackHelper.h

@@ -49,7 +49,7 @@
 
 template <typename ResultType, typename CallbackArg>
 struct HelperResultType {
-    DISALLOW_ALLOCATION();
+    DISALLOW_NEW();
 public:
     typedef ResultType* ReturnType;
     typedef Member<ResultType> StorageType;

diff --git a/third_party/WebKit/Source/modules/gamepad/GamepadDispatcher.h b/third_party/WebKit/Source/modules/gamepad/GamepadDispatcher.h
index bf516062..2f43bf8 100644
--- a/third_party/WebKit/Source/modules/gamepad/GamepadDispatcher.h
+++ b/third_party/WebKit/Source/modules/gamepad/GamepadDispatcher.h

@@ -23,7 +23,7 @@
     void sampleGamepads(WebGamepads&);
 
     struct ConnectionChange {
-        DISALLOW_ALLOCATION();
+        DISALLOW_NEW();
         WebGamepad pad;
         unsigned index;
     };

diff --git a/third_party/WebKit/Source/modules/geolocation/GeolocationWatchers.h b/third_party/WebKit/Source/modules/geolocation/GeolocationWatchers.h
index f7ea885..149456f 100644
--- a/third_party/WebKit/Source/modules/geolocation/GeolocationWatchers.h
+++ b/third_party/WebKit/Source/modules/geolocation/GeolocationWatchers.h

@@ -12,7 +12,7 @@
 class GeoNotifier;
 
 class GeolocationWatchers {
-    DISALLOW_ALLOCATION();
+    DISALLOW_NEW();
 
 public:
     GeolocationWatchers() { }

diff --git a/third_party/WebKit/Source/modules/indexeddb/IDBKeyPath.h b/third_party/WebKit/Source/modules/indexeddb/IDBKeyPath.h
index 7f1cabc..abac447 100644
--- a/third_party/WebKit/Source/modules/indexeddb/IDBKeyPath.h
+++ b/third_party/WebKit/Source/modules/indexeddb/IDBKeyPath.h

@@ -43,7 +43,7 @@
 MODULES_EXPORT void IDBParseKeyPath(const String&, Vector<String>&, IDBKeyPathParseError&);
 
 class MODULES_EXPORT IDBKeyPath {
-    DISALLOW_ALLOCATION();
+    DISALLOW_NEW();
 public:
     IDBKeyPath() : m_type(NullType) { }
     explicit IDBKeyPath(const String&);

diff --git a/third_party/WebKit/Source/modules/indexeddb/IDBMetadata.h b/third_party/WebKit/Source/modules/indexeddb/IDBMetadata.h
index f08079f0..9f7e5e8 100644
--- a/third_party/WebKit/Source/modules/indexeddb/IDBMetadata.h
+++ b/third_party/WebKit/Source/modules/indexeddb/IDBMetadata.h

@@ -39,7 +39,7 @@
 namespace blink {
 
 struct IDBIndexMetadata {
-    ALLOW_ONLY_INLINE_ALLOCATION();
+    DISALLOW_NEW_EXCEPT_PLACEMENT_NEW();
     IDBIndexMetadata() { }
     IDBIndexMetadata(const String& name, int64_t id, const IDBKeyPath& keyPath, bool unique, bool multiEntry)
         : name(name)
@@ -57,7 +57,7 @@
 };
 
 struct IDBObjectStoreMetadata {
-    ALLOW_ONLY_INLINE_ALLOCATION();
+    DISALLOW_NEW_EXCEPT_PLACEMENT_NEW();
     IDBObjectStoreMetadata() { }
     IDBObjectStoreMetadata(const String& name, int64_t id, const IDBKeyPath& keyPath, bool autoIncrement, int64_t maxIndexId)
         : name(name)
@@ -80,7 +80,7 @@
 };
 
 struct IDBDatabaseMetadata {
-    DISALLOW_ALLOCATION();
+    DISALLOW_NEW();
     // FIXME: These can probably be collapsed into 0.
     enum {
         NoIntVersion = -1,

diff --git a/third_party/WebKit/Source/modules/mediastream/DEPS b/third_party/WebKit/Source/modules/mediastream/DEPS
index cf71aae..0bcd7b7 100644
--- a/third_party/WebKit/Source/modules/mediastream/DEPS
+++ b/third_party/WebKit/Source/modules/mediastream/DEPS

@@ -6,6 +6,7 @@
     "+modules/EventModules.h",
     "+modules/EventTargetModules.h",
     "+modules/ModulesExport.h",
+    "+modules/crypto",
     "+modules/mediastream",
     "+platform",
     "+public/platform",

diff --git a/third_party/WebKit/Source/modules/mediastream/RTCPeerConnection.cpp b/third_party/WebKit/Source/modules/mediastream/RTCPeerConnection.cpp
index 636342b..45d8b1a 100644
--- a/third_party/WebKit/Source/modules/mediastream/RTCPeerConnection.cpp
+++ b/third_party/WebKit/Source/modules/mediastream/RTCPeerConnection.cpp

@@ -44,6 +44,7 @@
 #include "core/html/VoidCallback.h"
 #include "core/loader/FrameLoader.h"
 #include "core/loader/FrameLoaderClient.h"
+#include "modules/crypto/CryptoResultImpl.h"
 #include "modules/mediastream/MediaConstraintsImpl.h"
 #include "modules/mediastream/MediaStreamEvent.h"
 #include "modules/mediastream/RTCDTMFSender.h"
@@ -60,6 +61,8 @@
 #include "platform/mediastream/RTCConfiguration.h"
 #include "platform/mediastream/RTCOfferOptions.h"
 #include "public/platform/Platform.h"
+#include "public/platform/WebCryptoAlgorithmParams.h"
+#include "public/platform/WebCryptoUtil.h"
 #include "public/platform/WebMediaStream.h"
 #include "public/platform/WebRTCCertificate.h"
 #include "public/platform/WebRTCCertificateGenerator.h"
@@ -461,48 +464,57 @@
         exceptionState.throwDOMException(SyntaxError, "Could not update the ICE Agent with the given configuration.");
 }
 
-ScriptPromise RTCPeerConnection::generateCertificate(ScriptState* scriptState, const Dictionary& keygenAlgorithm, ExceptionState& exceptionState)
+ScriptPromise RTCPeerConnection::generateCertificate(ScriptState* scriptState, const AlgorithmIdentifier& keygenAlgorithm, ExceptionState& exceptionState)
 {
-    // Validate and interpret input |keygenAlgorithm|.
-    // TODO(hbos): Use WebCrypto normalization process to validate and interpret |keygenAlgorithm|.
-    // This may create a dependency between the Blink and WebCrypto modules? crbug.com/544917
+    // Normalize |keygenAlgorithm| with WebCrypto, making sure it is a recognized AlgorithmIdentifier.
+    WebCryptoAlgorithm cryptoAlgorithm;
+    AlgorithmError error;
+    if (!normalizeAlgorithm(keygenAlgorithm, WebCryptoOperationGenerateKey, cryptoAlgorithm, &error)) {
+        // Reject generateCertificate with the same error as was produced by WebCrypto.
+        // |result| is garbage collected, no need to delete.
+        CryptoResultImpl* result = CryptoResultImpl::create(scriptState);
+        ScriptPromise promise = result->promise();
+        result->completeWithError(error.errorType, error.errorDetails);
+        return promise;
+    }
+
+    // Convert from WebCrypto representation to recognized WebRTCKeyParams. WebRTC supports a small subset of what are valid AlgorithmIdentifiers.
+    const char* unsupportedParamsString = "The 1st argument provided is an AlgorithmIdentifier with a supported algorithm name, but the parameters are not supported.";
     Nullable<WebRTCKeyParams> keyParams;
-    String name;
-    if (DictionaryHelper::get(keygenAlgorithm, "name", name)) {
-        if (name == "RSASSA-PKCS1-v1_5") {
-            // RSA - Supported |keygenAlgorithm|:
-            // { name: "RSASSA-PKCS1-v1_5", modulusLength: <int>, publicExponent: 65537 }
-            int modulusLength = -1;
-            int publicExponent = -1;
-            if (DictionaryHelper::get(keygenAlgorithm, "modulusLength", modulusLength)
-                && modulusLength >= 0
-                && DictionaryHelper::get(keygenAlgorithm, "publicExponent", publicExponent)
-                && publicExponent >= 0) {
-                keyParams.set(blink::WebRTCKeyParams::createRSA(modulusLength, publicExponent));
-            }
-        } else if (name == "ECDSA") {
-            // ECDSA - Supported |keygenAlgorithm|:
-            // { name: "ECDSA", namedCurve: "P-256" }
-            String namedCurve;
-            DictionaryHelper::get(keygenAlgorithm, "namedCurve", namedCurve);
-            if (namedCurve == "P-256") {
-                keyParams.set(blink::WebRTCKeyParams::createECDSA(WebRTCECCurveNistP256));
-            }
+    switch (cryptoAlgorithm.id()) {
+    case WebCryptoAlgorithmIdRsaSsaPkcs1v1_5:
+        // name: "RSASSA-PKCS1-v1_5"
+        unsigned publicExponent;
+        // "publicExponent" must fit in an unsigned int. The only recognized "hash" is "SHA-256".
+        if (bigIntegerToUint(cryptoAlgorithm.rsaHashedKeyGenParams()->publicExponent(), publicExponent)
+            && cryptoAlgorithm.rsaHashedKeyGenParams()->hash().id() == WebCryptoAlgorithmIdSha256) {
+            unsigned modulusLength = cryptoAlgorithm.rsaHashedKeyGenParams()->modulusLengthBits();
+            keyParams.set(blink::WebRTCKeyParams::createRSA(modulusLength, publicExponent));
+        } else {
+            return ScriptPromise::rejectWithDOMException(scriptState, DOMException::create(NotSupportedError, unsupportedParamsString));
         }
+        break;
+    case WebCryptoAlgorithmIdEcdsa:
+        // name: "ECDSA"
+        // The only recognized "namedCurve" is "P-256".
+        if (cryptoAlgorithm.ecKeyGenParams()->namedCurve() == WebCryptoNamedCurveP256) {
+            keyParams.set(blink::WebRTCKeyParams::createECDSA(blink::WebRTCECCurveNistP256));
+        } else {
+            return ScriptPromise::rejectWithDOMException(scriptState, DOMException::create(NotSupportedError, unsupportedParamsString));
+        }
+        break;
+    default:
+        return ScriptPromise::rejectWithDOMException(scriptState, DOMException::create(NotSupportedError, "The 1st argument provided is an AlgorithmIdentifier, but the algorithm is not supported."));
+        break;
     }
-    if (keyParams.isNull()) {
-        // Invalid argument.
-        return ScriptPromise::rejectWithDOMException(
-            scriptState, DOMException::create(InvalidAccessError, ExceptionMessages::argumentNullOrIncorrectType(1, "AlgorithmIdentifier")));
-    }
+    ASSERT(!keyParams.isNull());
 
     OwnPtr<WebRTCCertificateGenerator> certificateGenerator = adoptPtr(
         Platform::current()->createRTCCertificateGenerator());
 
-    // Check validity of |keyParams|.
-    if (!certificateGenerator->isValidKeyParams(keyParams.get())) {
-        return ScriptPromise::rejectWithDOMException(
-            scriptState, DOMException::create(NotSupportedError, "The 1st argument provided is an AlgorithmIdentifier, but it has unsupported parameter values."));
+    // |keyParams| was successfully constructed, but does the certificate generator support these parameters?
+    if (!certificateGenerator->isSupportedKeyParams(keyParams.get())) {
+        return ScriptPromise::rejectWithDOMException(scriptState, DOMException::create(NotSupportedError, unsupportedParamsString));
     }
 
     ScriptPromiseResolver* resolver = ScriptPromiseResolver::create(scriptState);

diff --git a/third_party/WebKit/Source/modules/mediastream/RTCPeerConnection.h b/third_party/WebKit/Source/modules/mediastream/RTCPeerConnection.h
index 5680f17..f6eefc7 100644
--- a/third_party/WebKit/Source/modules/mediastream/RTCPeerConnection.h
+++ b/third_party/WebKit/Source/modules/mediastream/RTCPeerConnection.h

@@ -35,6 +35,7 @@
 #include "bindings/core/v8/ScriptPromise.h"
 #include "core/dom/ActiveDOMObject.h"
 #include "modules/EventTargetModules.h"
+#include "modules/crypto/NormalizeAlgorithm.h"
 #include "modules/mediastream/MediaStream.h"
 #include "modules/mediastream/RTCIceCandidate.h"
 #include "platform/AsyncMethodRunner.h"
@@ -81,7 +82,9 @@
 
     void updateIce(const Dictionary& rtcConfiguration, const Dictionary& mediaConstraints, ExceptionState&);
 
-    static ScriptPromise generateCertificate(ScriptState*, const Dictionary& keygenAlgorithm, ExceptionState&);
+    // Certificate management
+    // http://w3c.github.io/webrtc-pc/#sec.cert-mgmt
+    static ScriptPromise generateCertificate(ScriptState*, const AlgorithmIdentifier& keygenAlgorithm, ExceptionState&);
 
     // DEPRECATED
     void addIceCandidate(RTCIceCandidate*, ExceptionState&);

diff --git a/third_party/WebKit/Source/modules/mediastream/RTCPeerConnection.idl b/third_party/WebKit/Source/modules/mediastream/RTCPeerConnection.idl
index b8737810..658e8b8 100644
--- a/third_party/WebKit/Source/modules/mediastream/RTCPeerConnection.idl
+++ b/third_party/WebKit/Source/modules/mediastream/RTCPeerConnection.idl

@@ -131,8 +131,7 @@
     attribute EventHandler onaddstream;
     attribute EventHandler onremovestream;
 
-    // Certificate Management
+    // Certificate management
     // http://w3c.github.io/webrtc-pc/#sec.cert-mgmt
-    // TODO(hbos): Use AlgorithmIdentifier and the WebCryptoAPI normalization process. crbug.com/544917
-    [RuntimeEnabled=RTCCertificate, RaisesException, CallWith=ScriptState] static Promise<RTCCertificate> generateCertificate(Dictionary keygenAlgorithm);
+    [RuntimeEnabled=RTCCertificate, RaisesException, CallWith=ScriptState] static Promise<RTCCertificate> generateCertificate(AlgorithmIdentifier keygenAlgorithm);
 };

diff --git a/third_party/WebKit/Source/modules/modules.gypi b/third_party/WebKit/Source/modules/modules.gypi
index 6f80237..bc84c23c 100644
--- a/third_party/WebKit/Source/modules/modules.gypi
+++ b/third_party/WebKit/Source/modules/modules.gypi

@@ -531,7 +531,9 @@
       '<(blink_modules_output_dir)/background_sync/SyncRegistrationOptions.cpp',
       '<(blink_modules_output_dir)/background_sync/SyncRegistrationOptions.h',
       '<(blink_modules_output_dir)/bluetooth/BluetoothScanFilter.cpp',
+      '<(blink_modules_output_dir)/bluetooth/BluetoothScanFilter.h',
       '<(blink_modules_output_dir)/bluetooth/RequestDeviceOptions.cpp',
+      '<(blink_modules_output_dir)/bluetooth/RequestDeviceOptions.h',
       '<(blink_modules_output_dir)/cachestorage/CacheQueryOptions.cpp',
       '<(blink_modules_output_dir)/cachestorage/CacheQueryOptions.h',
       '<(blink_modules_output_dir)/canvas2d/Canvas2DContextAttributes.cpp',

diff --git a/third_party/WebKit/Source/modules/serviceworkers/ServiceWorkerGlobalScopeClient.h b/third_party/WebKit/Source/modules/serviceworkers/ServiceWorkerGlobalScopeClient.h
index 53b7ab5..5611231 100644
--- a/third_party/WebKit/Source/modules/serviceworkers/ServiceWorkerGlobalScopeClient.h
+++ b/third_party/WebKit/Source/modules/serviceworkers/ServiceWorkerGlobalScopeClient.h

@@ -55,7 +55,7 @@
 // See WebServiceWorkerContextClient for documentation for the methods in this class.
 class MODULES_EXPORT ServiceWorkerGlobalScopeClient : public WillBeHeapSupplement<WorkerClients> {
     WTF_MAKE_NONCOPYABLE(ServiceWorkerGlobalScopeClient);
-    DISALLOW_ALLOCATION();
+    DISALLOW_NEW();
 public:
     virtual ~ServiceWorkerGlobalScopeClient() { }
 

diff --git a/third_party/WebKit/Source/modules/webaudio/AsyncAudioDecoder.h b/third_party/WebKit/Source/modules/webaudio/AsyncAudioDecoder.h
index 67c9966f..f81e08a 100644
--- a/third_party/WebKit/Source/modules/webaudio/AsyncAudioDecoder.h
+++ b/third_party/WebKit/Source/modules/webaudio/AsyncAudioDecoder.h

@@ -40,7 +40,7 @@
 // Upon successful decoding, a completion callback will be invoked with the decoded PCM data in an AudioBuffer.
 
 class AsyncAudioDecoder {
-    DISALLOW_ALLOCATION();
+    DISALLOW_NEW();
     WTF_MAKE_NONCOPYABLE(AsyncAudioDecoder);
 public:
     AsyncAudioDecoder();

diff --git a/third_party/WebKit/Source/modules/webaudio/AudioParamTimeline.h b/third_party/WebKit/Source/modules/webaudio/AudioParamTimeline.h
index 40879d2..06c2fa22 100644
--- a/third_party/WebKit/Source/modules/webaudio/AudioParamTimeline.h
+++ b/third_party/WebKit/Source/modules/webaudio/AudioParamTimeline.h

@@ -38,7 +38,7 @@
 namespace blink {
 
 class AudioParamTimeline {
-    DISALLOW_ALLOCATION();
+    DISALLOW_NEW();
 public:
     AudioParamTimeline()
     {

diff --git a/third_party/WebKit/Source/modules/webaudio/RealtimeAnalyser.h b/third_party/WebKit/Source/modules/webaudio/RealtimeAnalyser.h
index 32e6620..98ec2eee 100644
--- a/third_party/WebKit/Source/modules/webaudio/RealtimeAnalyser.h
+++ b/third_party/WebKit/Source/modules/webaudio/RealtimeAnalyser.h

@@ -37,7 +37,7 @@
 
 class RealtimeAnalyser final {
     WTF_MAKE_NONCOPYABLE(RealtimeAnalyser);
-    DISALLOW_ALLOCATION();
+    DISALLOW_NEW();
 public:
     RealtimeAnalyser();
 

diff --git a/third_party/WebKit/Source/modules/webdatabase/SQLTransactionCoordinator.h b/third_party/WebKit/Source/modules/webdatabase/SQLTransactionCoordinator.h
index f4e68f4..0d886469 100644
--- a/third_party/WebKit/Source/modules/webdatabase/SQLTransactionCoordinator.h
+++ b/third_party/WebKit/Source/modules/webdatabase/SQLTransactionCoordinator.h

@@ -54,7 +54,7 @@
 private:
     typedef HeapDeque<Member<SQLTransactionBackend>> TransactionsQueue;
     struct CoordinationInfo {
-        ALLOW_ONLY_INLINE_ALLOCATION();
+        DISALLOW_NEW_EXCEPT_PLACEMENT_NEW();
     public:
         TransactionsQueue pendingTransactions;
         HeapHashSet<Member<SQLTransactionBackend>> activeReadTransactions;

diff --git a/third_party/WebKit/Source/modules/webdatabase/sqlite/SQLValue.h b/third_party/WebKit/Source/modules/webdatabase/sqlite/SQLValue.h
index 72b0718c..6777a7e 100644
--- a/third_party/WebKit/Source/modules/webdatabase/sqlite/SQLValue.h
+++ b/third_party/WebKit/Source/modules/webdatabase/sqlite/SQLValue.h

@@ -35,7 +35,7 @@
 namespace blink {
 
 class SQLValue {
-    ALLOW_ONLY_INLINE_ALLOCATION();
+    DISALLOW_NEW_EXCEPT_PLACEMENT_NEW();
 public:
     enum Type { NullValue, NumberValue, StringValue };
 

diff --git a/third_party/WebKit/Source/modules/webdatabase/sqlite/SQLiteDatabase.h b/third_party/WebKit/Source/modules/webdatabase/sqlite/SQLiteDatabase.h
index 1efa750..e823970 100644
--- a/third_party/WebKit/Source/modules/webdatabase/sqlite/SQLiteDatabase.h
+++ b/third_party/WebKit/Source/modules/webdatabase/sqlite/SQLiteDatabase.h

@@ -52,7 +52,7 @@
 extern const int SQLResultConstraint;
 
 class SQLiteDatabase {
-    DISALLOW_ALLOCATION();
+    DISALLOW_NEW();
     WTF_MAKE_NONCOPYABLE(SQLiteDatabase);
     friend class SQLiteTransaction;
 public:

diff --git a/third_party/WebKit/Source/modules/webdatabase/sqlite/SQLiteFileSystem.h b/third_party/WebKit/Source/modules/webdatabase/sqlite/SQLiteFileSystem.h
index f5dcf4f..830580d 100644
--- a/third_party/WebKit/Source/modules/webdatabase/sqlite/SQLiteFileSystem.h
+++ b/third_party/WebKit/Source/modules/webdatabase/sqlite/SQLiteFileSystem.h

@@ -42,7 +42,7 @@
 // A class that abstracts the file system related operations required
 // by the WebKit database code.
 class SQLiteFileSystem {
-    DISALLOW_ALLOCATION();
+    DISALLOW_NEW();
 public:
     // Registers a user-defined SQLite VFS.
     static void registerSQLiteVFS();

diff --git a/third_party/WebKit/Source/modules/webgl/WebGL2RenderingContextBase.cpp b/third_party/WebKit/Source/modules/webgl/WebGL2RenderingContextBase.cpp
index 1e24916..121203c 100644
--- a/third_party/WebKit/Source/modules/webgl/WebGL2RenderingContextBase.cpp
+++ b/third_party/WebKit/Source/modules/webgl/WebGL2RenderingContextBase.cpp

@@ -148,6 +148,9 @@
     webContext()->getIntegerv(GL_MAX_3D_TEXTURE_SIZE, &m_max3DTextureSize);
     m_max3DTextureLevel = WebGLTexture::computeLevelCount(m_max3DTextureSize, m_max3DTextureSize, m_max3DTextureSize);
 
+    m_maxArrayTextureLayers = 0;
+    webContext()->getIntegerv(GL_MAX_ARRAY_TEXTURE_LAYERS, &m_maxArrayTextureLayers);
+
     GLint numCombinedTextureImageUnits = 0;
     webContext()->getIntegerv(GL_MAX_COMBINED_TEXTURE_IMAGE_UNITS, &numCombinedTextureImageUnits);
     m_samplerUnits.clear();
@@ -243,17 +246,61 @@
     webContext()->blitFramebufferCHROMIUM(srcX0, srcY0, srcX1, srcY1, dstX0, dstY0, dstX1, dstY1, mask, filter);
 }
 
-void WebGL2RenderingContextBase::framebufferTextureLayer(GLenum target, GLenum attachment, const WebGLTexture* texture, GLint level, GLint layer)
+bool WebGL2RenderingContextBase::validateTexFuncLayer(const char* functionName, GLenum texTarget, GLint layer)
 {
-    if (isContextLost())
-        return;
+    if (layer < 0) {
+        synthesizeGLError(GL_INVALID_VALUE, functionName, "layer out of range");
+        return false;
+    }
+    switch (texTarget) {
+    case GL_TEXTURE_3D:
+        if (layer > m_max3DTextureSize - 1) {
+            synthesizeGLError(GL_INVALID_VALUE, functionName, "layer out of range");
+            return false;
+        }
+        break;
+    case GL_TEXTURE_2D_ARRAY:
+        if (layer > m_maxArrayTextureLayers - 1) {
+            synthesizeGLError(GL_INVALID_VALUE, functionName, "layer out of range");
+            return false;
+        }
+        break;
+    default:
+        ASSERT_NOT_REACHED();
+        return false;
+    }
+    return true;
+}
 
+void WebGL2RenderingContextBase::framebufferTextureLayer(ScriptState* scriptState, GLenum target, GLenum attachment, WebGLTexture* texture, GLint level, GLint layer)
+{
+    if (isContextLost() || !validateFramebufferFuncParameters("framebufferTextureLayer", target, attachment))
+        return;
     if (texture && !texture->validate(contextGroup(), this)) {
         synthesizeGLError(GL_INVALID_VALUE, "framebufferTextureLayer", "no texture or texture not from this context");
         return;
     }
+    GLenum textarget = texture ? texture->getTarget() : 0;
+    if (texture) {
+        if (textarget != GL_TEXTURE_3D && textarget != GL_TEXTURE_2D_ARRAY) {
+            synthesizeGLError(GL_INVALID_OPERATION, "framebufferTextureLayer", "invalid texture type");
+            return;
+        }
+        if (!validateTexFuncLayer("framebufferTextureLayer", textarget, layer))
+            return;
+        if (!validateTexFuncLevel("framebufferTextureLayer", textarget, level))
+            return;
+    }
 
+    WebGLFramebuffer* framebufferBinding = getFramebufferBinding(target);
+    if (!framebufferBinding || !framebufferBinding->object()) {
+        synthesizeGLError(GL_INVALID_OPERATION, "framebufferTextureLayer", "no framebuffer bound");
+        return;
+    }
     webContext()->framebufferTextureLayer(target, attachment, objectOrZero(texture), level, layer);
+    framebufferBinding->setAttachmentForBoundFramebuffer(target, attachment, textarget, texture, level, layer);
+    applyStencilTest();
+    preserveObjectWrapper(scriptState, framebufferBinding, "attachment", attachment, texture);
 }
 
 ScriptValue WebGL2RenderingContextBase::getInternalformatParameter(ScriptState* scriptState, GLenum target, GLenum internalformat, GLenum pname)

diff --git a/third_party/WebKit/Source/modules/webgl/WebGL2RenderingContextBase.h b/third_party/WebKit/Source/modules/webgl/WebGL2RenderingContextBase.h
index a2427378..2db7de0 100644
--- a/third_party/WebKit/Source/modules/webgl/WebGL2RenderingContextBase.h
+++ b/third_party/WebKit/Source/modules/webgl/WebGL2RenderingContextBase.h

@@ -32,8 +32,9 @@
     void getBufferSubData(GLenum target, long long offset, DOMArrayBuffer* returnedData);
 
     /* Framebuffer objects */
+    bool validateTexFuncLayer(const char*, GLenum texTarget, GLint layer);
     void blitFramebuffer(GLint, GLint, GLint, GLint, GLint, GLint, GLint, GLint, GLbitfield, GLenum);
-    void framebufferTextureLayer(GLenum, GLenum, const WebGLTexture*, GLint, GLint);
+    void framebufferTextureLayer(ScriptState*, GLenum, GLenum, WebGLTexture*, GLint, GLint);
     ScriptValue getInternalformatParameter(ScriptState*, GLenum, GLenum, GLenum);
     void invalidateFramebuffer(GLenum, Vector<GLenum>&);
     void invalidateSubFramebuffer(GLenum, Vector<GLenum>&, GLint, GLint, GLsizei, GLsizei);
@@ -235,6 +236,7 @@
     PersistentWillBeMember<WebGLTransformFeedback> m_transformFeedbackBinding;
     GLint m_max3DTextureSize;
     GLint m_max3DTextureLevel;
+    GLint m_maxArrayTextureLayers;
 
     std::set<GLenum> m_supportedInternalFormatsStorage;
 

diff --git a/third_party/WebKit/Source/modules/webgl/WebGL2RenderingContextBase.idl b/third_party/WebKit/Source/modules/webgl/WebGL2RenderingContextBase.idl
index 10ed0f5..5e6c50e 100644
--- a/third_party/WebKit/Source/modules/webgl/WebGL2RenderingContextBase.idl
+++ b/third_party/WebKit/Source/modules/webgl/WebGL2RenderingContextBase.idl

@@ -308,7 +308,7 @@
 
     /* Framebuffer objects */
     void blitFramebuffer(GLint srcX0, GLint srcY0, GLint srcX1, GLint srcY1, GLint dstX0, GLint dstY0, GLint dstX1, GLint dstY1, GLbitfield mask, GLenum filter);
-    void framebufferTextureLayer(GLenum target, GLenum attachment, WebGLTexture texture, GLint level, GLint layer);
+    [CallWith=ScriptState] void framebufferTextureLayer(GLenum target, GLenum attachment, WebGLTexture? texture, GLint level, GLint layer);
     [CallWith=ScriptState] any getInternalformatParameter(GLenum target, GLenum internalformat, GLenum pname);
     void invalidateFramebuffer(GLenum target, sequence<GLenum> attachments);
     void invalidateSubFramebuffer (GLenum target, sequence<GLenum> attachments, GLint x, GLint y, GLsizei width, GLsizei height);

diff --git a/third_party/WebKit/Source/modules/webgl/WebGLFramebuffer.cpp b/third_party/WebKit/Source/modules/webgl/WebGLFramebuffer.cpp
index 0bc636e..ca735d36 100644
--- a/third_party/WebKit/Source/modules/webgl/WebGLFramebuffer.cpp
+++ b/third_party/WebKit/Source/modules/webgl/WebGLFramebuffer.cpp

@@ -146,12 +146,12 @@
 
 class WebGLTextureAttachment final : public WebGLFramebuffer::WebGLAttachment {
 public:
-    static WebGLFramebuffer::WebGLAttachment* create(WebGLTexture*, GLenum target, GLint level);
+    static WebGLFramebuffer::WebGLAttachment* create(WebGLTexture*, GLenum target, GLint level, GLint layer);
 
     DECLARE_VIRTUAL_TRACE();
 
 private:
-    WebGLTextureAttachment(WebGLTexture*, GLenum target, GLint level);
+    WebGLTextureAttachment(WebGLTexture*, GLenum target, GLint level, GLint layer);
     WebGLTextureAttachment() { }
 
     GLsizei width() const override;
@@ -168,11 +168,12 @@
     Member<WebGLTexture> m_texture;
     GLenum m_target;
     GLint m_level;
+    GLint m_layer;
 };
 
-WebGLFramebuffer::WebGLAttachment* WebGLTextureAttachment::create(WebGLTexture* texture, GLenum target, GLint level)
+WebGLFramebuffer::WebGLAttachment* WebGLTextureAttachment::create(WebGLTexture* texture, GLenum target, GLint level, GLint layer)
 {
-    return new WebGLTextureAttachment(texture, target, level);
+    return new WebGLTextureAttachment(texture, target, level, layer);
 }
 
 DEFINE_TRACE(WebGLTextureAttachment)
@@ -181,10 +182,11 @@
     WebGLFramebuffer::WebGLAttachment::trace(visitor);
 }
 
-WebGLTextureAttachment::WebGLTextureAttachment(WebGLTexture* texture, GLenum target, GLint level)
+WebGLTextureAttachment::WebGLTextureAttachment(WebGLTexture* texture, GLenum target, GLint level, GLint layer)
     : m_texture(texture)
     , m_target(target)
     , m_level(level)
+    , m_layer(layer)
 {
 }
 
@@ -226,16 +228,25 @@
 void WebGLTextureAttachment::attach(WebGraphicsContext3D* context, GLenum target, GLenum attachment)
 {
     Platform3DObject object = objectOrZero(m_texture.get());
-    context->framebufferTexture2D(target, attachment, m_target, object, m_level);
+    if (m_target == GL_TEXTURE_3D || m_target == GL_TEXTURE_2D_ARRAY) {
+        context->framebufferTextureLayer(target, attachment, object, m_level, m_layer);
+    } else {
+        context->framebufferTexture2D(target, attachment, m_target, object, m_level);
+    }
 }
 
 void WebGLTextureAttachment::unattach(WebGraphicsContext3D* context, GLenum target, GLenum attachment)
 {
-    if (attachment == GL_DEPTH_STENCIL_ATTACHMENT) {
-        context->framebufferTexture2D(target, GL_DEPTH_ATTACHMENT, m_target, 0, m_level);
-        context->framebufferTexture2D(target, GL_STENCIL_ATTACHMENT, m_target, 0, m_level);
+    // GL_DEPTH_STENCIL_ATTACHMENT attachment is valid in ES3.
+    if (m_target == GL_TEXTURE_3D || m_target == GL_TEXTURE_2D_ARRAY) {
+        context->framebufferTextureLayer(target, attachment, 0, m_level, m_layer);
     } else {
-        context->framebufferTexture2D(target, attachment, m_target, 0, m_level);
+        if (attachment == GL_DEPTH_STENCIL_ATTACHMENT) {
+            context->framebufferTexture2D(target, GL_DEPTH_ATTACHMENT, m_target, 0, m_level);
+            context->framebufferTexture2D(target, GL_STENCIL_ATTACHMENT, m_target, 0, m_level);
+        } else {
+            context->framebufferTexture2D(target, attachment, m_target, 0, m_level);
+        }
     }
 }
 
@@ -350,14 +361,14 @@
     detachAndDeleteObject();
 }
 
-void WebGLFramebuffer::setAttachmentForBoundFramebuffer(GLenum target, GLenum attachment, GLenum texTarget, WebGLTexture* texture, GLint level)
+void WebGLFramebuffer::setAttachmentForBoundFramebuffer(GLenum target, GLenum attachment, GLenum texTarget, WebGLTexture* texture, GLint level, GLint layer)
 {
     ASSERT(isBound(target));
     removeAttachmentFromBoundFramebuffer(target, attachment);
     if (!m_object)
         return;
     if (texture && texture->object()) {
-        m_attachments.add(attachment, WebGLTextureAttachment::create(texture, texTarget, level));
+        m_attachments.add(attachment, WebGLTextureAttachment::create(texture, texTarget, level, 0));
         drawBuffersIfNecessary(false);
         texture->onAttached();
     }

diff --git a/third_party/WebKit/Source/modules/webgl/WebGLFramebuffer.h b/third_party/WebKit/Source/modules/webgl/WebGLFramebuffer.h
index 3df918e..6522650 100644
--- a/third_party/WebKit/Source/modules/webgl/WebGLFramebuffer.h
+++ b/third_party/WebKit/Source/modules/webgl/WebGLFramebuffer.h

@@ -68,7 +68,7 @@
 
     Platform3DObject object() const { return m_object; }
 
-    void setAttachmentForBoundFramebuffer(GLenum target, GLenum attachment, GLenum texTarget, WebGLTexture*, GLint level);
+    void setAttachmentForBoundFramebuffer(GLenum target, GLenum attachment, GLenum texTarget, WebGLTexture*, GLint level, GLint layer);
     void setAttachmentForBoundFramebuffer(GLenum target, GLenum attachment, WebGLRenderbuffer*);
     // If an object is attached to the currently bound framebuffer, remove it.
     void removeAttachmentFromBoundFramebuffer(GLenum target, WebGLSharedObject*);

diff --git a/third_party/WebKit/Source/modules/webgl/WebGLRenderingContextBase.cpp b/third_party/WebKit/Source/modules/webgl/WebGLRenderingContextBase.cpp
index 83b8af4..bd0e611 100644
--- a/third_party/WebKit/Source/modules/webgl/WebGLRenderingContextBase.cpp
+++ b/third_party/WebKit/Source/modules/webgl/WebGLRenderingContextBase.cpp

@@ -2466,7 +2466,7 @@
     default:
         webContext()->framebufferTexture2D(target, attachment, textarget, textureObject, level);
     }
-    framebufferBinding->setAttachmentForBoundFramebuffer(target, attachment, textarget, texture, level);
+    framebufferBinding->setAttachmentForBoundFramebuffer(target, attachment, textarget, texture, level, 0);
     applyStencilTest();
     preserveObjectWrapper(scriptState, framebufferBinding, "attachment", attachment, texture);
 }

diff --git a/third_party/WebKit/Source/modules/webgl/WebGLRenderingContextBase.h b/third_party/WebKit/Source/modules/webgl/WebGLRenderingContextBase.h
index 06e9ee0..a5fb75a 100644
--- a/third_party/WebKit/Source/modules/webgl/WebGLRenderingContextBase.h
+++ b/third_party/WebKit/Source/modules/webgl/WebGLRenderingContextBase.h

@@ -419,7 +419,7 @@
     int externallyAllocatedBytesPerPixel() override;
 
     class TextureUnitState {
-        ALLOW_ONLY_INLINE_ALLOCATION();
+        DISALLOW_NEW_EXCEPT_PLACEMENT_NEW();
     public:
         Member<WebGLTexture> m_texture2DBinding;
         Member<WebGLTexture> m_textureCubeMapBinding;

diff --git a/third_party/WebKit/Source/modules/webmidi/MIDIAccessInitializer.h b/third_party/WebKit/Source/modules/webmidi/MIDIAccessInitializer.h
index e1fb8bd9..668d994 100644
--- a/third_party/WebKit/Source/modules/webmidi/MIDIAccessInitializer.h
+++ b/third_party/WebKit/Source/modules/webmidi/MIDIAccessInitializer.h

@@ -22,7 +22,7 @@
 class MODULES_EXPORT MIDIAccessInitializer : public ScriptPromiseResolver, public MIDIAccessorClient {
 public:
     struct PortDescriptor {
-        ALLOW_ONLY_INLINE_ALLOCATION();
+        DISALLOW_NEW_EXCEPT_PLACEMENT_NEW();
         String id;
         String manufacturer;
         String name;

diff --git a/third_party/WebKit/Source/platform/WebThreadSupportingGC.cpp b/third_party/WebKit/Source/platform/WebThreadSupportingGC.cpp
index 0902c7a..bf50fd6 100644
--- a/third_party/WebKit/Source/platform/WebThreadSupportingGC.cpp
+++ b/third_party/WebKit/Source/platform/WebThreadSupportingGC.cpp

@@ -48,17 +48,14 @@
 
 void WebThreadSupportingGC::initialize()
 {
-    m_pendingGCRunner = adoptPtr(new PendingGCRunner);
-    m_thread->addTaskObserver(m_pendingGCRunner.get());
     ThreadState::attach();
-    OwnPtr<MessageLoopInterruptor> interruptor = adoptPtr(new MessageLoopInterruptor(m_thread->taskRunner()));
-    ThreadState::current()->addInterruptor(interruptor.release());
+    m_gcTaskRunner = adoptPtr(new GCTaskRunner(m_thread));
 }
 
 void WebThreadSupportingGC::shutdown()
 {
     // Ensure no posted tasks will run from this point on.
-    m_thread->removeTaskObserver(m_pendingGCRunner.get());
+    m_gcTaskRunner.clear();
 
     // Shutdown the thread (via its scheduler) only when the thread is created
     // and is owned by this instance.
@@ -66,7 +63,6 @@
         m_owningThread->scheduler()->shutdown();
 
     ThreadState::detach();
-    m_pendingGCRunner = nullptr;
 }
 
 } // namespace blink

diff --git a/third_party/WebKit/Source/platform/WebThreadSupportingGC.h b/third_party/WebKit/Source/platform/WebThreadSupportingGC.h
index c2afaf0..405401eb 100644
--- a/third_party/WebKit/Source/platform/WebThreadSupportingGC.h
+++ b/third_party/WebKit/Source/platform/WebThreadSupportingGC.h

@@ -5,8 +5,7 @@
 #ifndef WebThreadSupportingGC_h
 #define WebThreadSupportingGC_h
 
-#include "platform/heap/MessageLoopInterruptor.h"
-#include "platform/heap/PendingGCRunner.h"
+#include "platform/heap/GCTaskRunner.h"
 #include "public/platform/Platform.h"
 #include "public/platform/WebTaskRunner.h"
 #include "public/platform/WebThread.h"
@@ -69,7 +68,7 @@
 private:
     WebThreadSupportingGC(const char* name, WebThread*);
 
-    OwnPtr<PendingGCRunner> m_pendingGCRunner;
+    OwnPtr<GCTaskRunner> m_gcTaskRunner;
 
     // m_thread is guaranteed to be non-null after this instance is constructed.
     // m_owningThread is non-null unless this instance is constructed for an

diff --git a/third_party/WebKit/Source/platform/blink_platform.gypi b/third_party/WebKit/Source/platform/blink_platform.gypi
index 7d5e3d7f..037557c 100644
--- a/third_party/WebKit/Source/platform/blink_platform.gypi
+++ b/third_party/WebKit/Source/platform/blink_platform.gypi

@@ -275,6 +275,7 @@
       'exported/WebCryptoKey.cpp',
       'exported/WebCryptoKeyAlgorithm.cpp',
       'exported/WebCryptoResult.cpp',
+      'exported/WebCryptoUtil.cpp',
       'exported/WebCursorInfo.cpp',
       'exported/WebData.cpp',
       'exported/WebDataConsumerHandle.cpp',

diff --git a/third_party/WebKit/Source/platform/exported/WebCryptoUtil.cpp b/third_party/WebKit/Source/platform/exported/WebCryptoUtil.cpp
new file mode 100644
index 0000000..3db9a11
--- /dev/null
+++ b/third_party/WebKit/Source/platform/exported/WebCryptoUtil.cpp

@@ -0,0 +1,24 @@
+// Copyright 2015 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "config.h"
+#include "public/platform/WebCryptoUtil.h"
+
+namespace blink {
+
+bool bigIntegerToUint(const WebVector<unsigned char>& bigInteger, unsigned& result)
+{
+    result = 0;
+    for (size_t i = 0; i < bigInteger.size(); ++i) {
+        size_t iReversed = bigInteger.size() - i - 1;
+
+        if (iReversed >= sizeof(result) && bigInteger[i])
+            return false; // Too large for unsigned int.
+
+        result |= bigInteger[i] << 8 * iReversed;
+    }
+    return true;
+}
+
+} // namespace blink

diff --git a/third_party/WebKit/Source/platform/graphics/filters/FilterOperations.h b/third_party/WebKit/Source/platform/graphics/filters/FilterOperations.h
index e7e55f2..dc3f53f9 100644
--- a/third_party/WebKit/Source/platform/graphics/filters/FilterOperations.h
+++ b/third_party/WebKit/Source/platform/graphics/filters/FilterOperations.h

@@ -38,7 +38,7 @@
 
 class PLATFORM_EXPORT FilterOperations {
 #if ENABLE(OILPAN)
-    DISALLOW_ALLOCATION();
+    DISALLOW_NEW();
 #else
     USING_FAST_MALLOC(FilterOperations);
 #endif

diff --git a/third_party/WebKit/Source/platform/graphics/paint/DisplayItemClient.h b/third_party/WebKit/Source/platform/graphics/paint/DisplayItemClient.h
index 88f0f649..3ac0892 100644
--- a/third_party/WebKit/Source/platform/graphics/paint/DisplayItemClient.h
+++ b/third_party/WebKit/Source/platform/graphics/paint/DisplayItemClient.h

@@ -21,7 +21,7 @@
 // The instance must not out-live the object. Long-time reference to a client must
 // use DisplayItemClient.
 class PLATFORM_EXPORT DisplayItemClientWrapper {
-    DISALLOW_ALLOCATION(); // Allow allocated in stack or in another object only.
+    DISALLOW_NEW(); // Allow allocated in stack or in another object only.
 public:
     template <typename T>
     DisplayItemClientWrapper(const T& object)

diff --git a/third_party/WebKit/Source/platform/heap/BUILD.gn b/third_party/WebKit/Source/platform/heap/BUILD.gn
index 084e00c5b..b931f0c2 100644
--- a/third_party/WebKit/Source/platform/heap/BUILD.gn
+++ b/third_party/WebKit/Source/platform/heap/BUILD.gn

@@ -16,6 +16,7 @@
     "CallbackStack.h",
     "GCInfo.cpp",
     "GCInfo.h",
+    "GCTaskRunner.h",
     "GarbageCollected.h",
     "Handle.h",
     "Heap.cpp",

diff --git a/third_party/WebKit/Source/platform/heap/BlinkGCAPIReference.md b/third_party/WebKit/Source/platform/heap/BlinkGCAPIReference.md
index 7e2f526..c8febf22 100644
--- a/third_party/WebKit/Source/platform/heap/BlinkGCAPIReference.md
+++ b/third_party/WebKit/Source/platform/heap/BlinkGCAPIReference.md

@@ -124,7 +124,7 @@
 
 ### USING_GARBAGE_COLLECTED_MIXIN
 
-### ALLOW_ONLY_INLINE_ALLOCATION
+### DISALLOW_NEW_EXCEPT_PLACEMENT_NEW
 
 ### STACK_ALLOCATED
 

diff --git a/third_party/WebKit/Source/platform/heap/MessageLoopInterruptor.h b/third_party/WebKit/Source/platform/heap/GCTaskRunner.h
similarity index 60%
rename from third_party/WebKit/Source/platform/heap/MessageLoopInterruptor.h
rename to third_party/WebKit/Source/platform/heap/GCTaskRunner.h
index 67d6d20..1e7b904b 100644
--- a/third_party/WebKit/Source/platform/heap/MessageLoopInterruptor.h
+++ b/third_party/WebKit/Source/platform/heap/GCTaskRunner.h

@@ -28,16 +28,17 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef MessageLoopInterruptor_h
-#define MessageLoopInterruptor_h
+#ifndef GCTaskRunner_h
+#define GCTaskRunner_h
 
-#include "platform/heap/BlinkGCInterruptor.h"
+#include "platform/heap/ThreadState.h"
 #include "public/platform/WebTaskRunner.h"
+#include "public/platform/WebThread.h"
 #include "public/platform/WebTraceLocation.h"
 
 namespace blink {
 
-class MessageLoopInterruptor : public BlinkGCInterruptor {
+class MessageLoopInterruptor final : public BlinkGCInterruptor {
 public:
     explicit MessageLoopInterruptor(WebTaskRunner* taskRunner) : m_taskRunner(taskRunner) { }
 
@@ -45,7 +46,7 @@
     {
         // GCTask has an empty run() method. Its only purpose is to guarantee
         // that MessageLoop will have a task to process which will result
-        // in PendingGCRunner::didProcessTask being executed.
+        // in GCTaskRunner::didProcessTask being executed.
         m_taskRunner->postTask(BLINK_FROM_HERE, new GCTask);
     }
 
@@ -57,7 +58,7 @@
         void run() override
         {
             // Don't do anything here because we don't know if this is
-            // a nested event loop or not. PendingGCRunner::didProcessTask
+            // a nested event loop or not. GCTaskRunner::didProcessTask
             // will enter correct safepoint for us.
             // We are not calling onInterrupted() because that always
             // conservatively enters safepoint with pointers on stack.
@@ -67,6 +68,57 @@
     WebTaskRunner* m_taskRunner;
 };
 
+class GCTaskObserver final : public WebThread::TaskObserver {
+public:
+    GCTaskObserver() : m_nesting(0) { }
+
+    ~GCTaskObserver()
+    {
+        // m_nesting can be 1 if this was unregistered in a task and
+        // didProcessTask was not called.
+        ASSERT(!m_nesting || m_nesting == 1);
+    }
+
+    virtual void willProcessTask()
+    {
+        m_nesting++;
+    }
+
+    virtual void didProcessTask()
+    {
+        // In the production code WebKit::initialize is called from inside the
+        // message loop so we can get didProcessTask() without corresponding
+        // willProcessTask once. This is benign.
+        if (m_nesting)
+            m_nesting--;
+
+        ThreadState::current()->safePoint(m_nesting ? BlinkGC::HeapPointersOnStack : BlinkGC::NoHeapPointersOnStack);
+    }
+
+private:
+    int m_nesting;
+};
+
+class GCTaskRunner final {
+public:
+    explicit GCTaskRunner(WebThread* thread)
+        : m_gcTaskObserver(adoptPtr(new GCTaskObserver))
+        , m_thread(thread)
+    {
+        m_thread->addTaskObserver(m_gcTaskObserver.get());
+        ThreadState::current()->addInterruptor(adoptPtr(new MessageLoopInterruptor(thread->taskRunner())));
+    }
+
+    ~GCTaskRunner()
+    {
+        m_thread->removeTaskObserver(m_gcTaskObserver.get());
+    }
+
+private:
+    OwnPtr<GCTaskObserver> m_gcTaskObserver;
+    WebThread* m_thread;
+};
+
 } // namespace blink
 
 #endif

diff --git a/third_party/WebKit/Source/platform/heap/Handle.h b/third_party/WebKit/Source/platform/heap/Handle.h
index 47b61c7..b5e0eb39 100644
--- a/third_party/WebKit/Source/platform/heap/Handle.h
+++ b/third_party/WebKit/Source/platform/heap/Handle.h

@@ -512,10 +512,10 @@
 
 template<typename Collection>
 class PersistentHeapCollectionBase : public Collection {
-    // We overload the various new and delete operators with using the WTF DefaultAllocator to ensure persistent
+    // We overload the various new and delete operators with using the WTF PartitionAllocator to ensure persistent
     // heap collections are always allocated off-heap. This allows persistent collections to be used in
     // DEFINE_STATIC_LOCAL et. al.
-    WTF_USE_ALLOCATOR(PersistentHeapCollectionBase, WTF::DefaultAllocator);
+    WTF_USE_ALLOCATOR(PersistentHeapCollectionBase, WTF::PartitionAllocator);
 public:
     PersistentHeapCollectionBase()
     {

diff --git a/third_party/WebKit/Source/platform/heap/HeapTerminatedArray.h b/third_party/WebKit/Source/platform/heap/HeapTerminatedArray.h
index 11fc6e85..be0bd91 100644
--- a/third_party/WebKit/Source/platform/heap/HeapTerminatedArray.h
+++ b/third_party/WebKit/Source/platform/heap/HeapTerminatedArray.h

@@ -13,7 +13,7 @@
 
 template<typename T>
 class HeapTerminatedArray : public TerminatedArray<T> {
-    DISALLOW_ALLOCATION();
+    DISALLOW_NEW();
 public:
     using TerminatedArray<T>::begin;
     using TerminatedArray<T>::end;

diff --git a/third_party/WebKit/Source/platform/heap/HeapTest.cpp b/third_party/WebKit/Source/platform/heap/HeapTest.cpp
index 2e8e73c..1bec0e5 100644
--- a/third_party/WebKit/Source/platform/heap/HeapTest.cpp
+++ b/third_party/WebKit/Source/platform/heap/HeapTest.cpp

@@ -127,7 +127,7 @@
 typedef std::pair<Member<IntWrapper>, WeakMember<IntWrapper>> StrongWeakPair;
 
 struct PairWithWeakHandling : public StrongWeakPair {
-    ALLOW_ONLY_INLINE_ALLOCATION();
+    DISALLOW_NEW_EXCEPT_PLACEMENT_NEW();
 
 public:
     // Regular constructor.
@@ -1546,7 +1546,7 @@
 int UseMixin::s_traceCount = 0;
 
 class VectorObject {
-    ALLOW_ONLY_INLINE_ALLOCATION();
+    DISALLOW_NEW_EXCEPT_PLACEMENT_NEW();
 public:
     VectorObject()
     {
@@ -1565,7 +1565,7 @@
 class VectorObjectInheritedTrace : public VectorObject { };
 
 class VectorObjectNoTrace {
-    ALLOW_ONLY_INLINE_ALLOCATION();
+    DISALLOW_NEW_EXCEPT_PLACEMENT_NEW();
 public:
     VectorObjectNoTrace()
     {
@@ -1577,7 +1577,7 @@
 };
 
 class TerminatedArrayItem {
-    ALLOW_ONLY_INLINE_ALLOCATION();
+    DISALLOW_NEW_EXCEPT_PLACEMENT_NEW();
 public:
     TerminatedArrayItem(IntWrapper* payload) : m_payload(payload), m_isLast(false) { }
 
@@ -2858,7 +2858,7 @@
 }
 
 class NonTrivialObject final {
-    ALLOW_ONLY_INLINE_ALLOCATION();
+    DISALLOW_NEW_EXCEPT_PLACEMENT_NEW();
 public:
     NonTrivialObject()
     {
@@ -4123,7 +4123,7 @@
 }
 
 class InlinedVectorObject {
-    ALLOW_ONLY_INLINE_ALLOCATION();
+    DISALLOW_NEW_EXCEPT_PLACEMENT_NEW();
 public:
     InlinedVectorObject()
     {
@@ -4142,7 +4142,7 @@
 int InlinedVectorObject::s_destructorCalls = 0;
 
 class InlinedVectorObjectWithVtable {
-    ALLOW_ONLY_INLINE_ALLOCATION();
+    DISALLOW_NEW_EXCEPT_PLACEMENT_NEW();
 public:
     InlinedVectorObjectWithVtable()
     {
@@ -5734,7 +5734,7 @@
 };
 
 class PartObject {
-    DISALLOW_ALLOCATION();
+    DISALLOW_NEW();
 public:
     PartObject() : m_obj(SimpleObject::create()) { }
     DEFINE_INLINE_TRACE() { visitor->trace(m_obj); }
@@ -6084,7 +6084,7 @@
 };
 
 class PartObjectWithRef {
-    ALLOW_ONLY_INLINE_ALLOCATION();
+    DISALLOW_NEW_EXCEPT_PLACEMENT_NEW();
 public:
     PartObjectWithRef(int i)
         : m_value(SimpleRefValue::create(i))

diff --git a/third_party/WebKit/Source/platform/heap/PendingGCRunner.h b/third_party/WebKit/Source/platform/heap/PendingGCRunner.h
deleted file mode 100644
index d983be6..0000000
--- a/third_party/WebKit/Source/platform/heap/PendingGCRunner.h
+++ /dev/null

@@ -1,75 +0,0 @@
-/*
- * Copyright (C) 2014 Google Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions are
- * met:
- *
- *     * Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- *     * Redistributions in binary form must reproduce the above
- * copyright notice, this list of conditions and the following disclaimer
- * in the documentation and/or other materials provided with the
- * distribution.
- *     * Neither the name of Google Inc. nor the names of its
- * contributors may be used to endorse or promote products derived from
- * this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
- * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#ifndef PendingGCRunner_h
-#define PendingGCRunner_h
-
-#include "platform/heap/ThreadState.h"
-#include "public/platform/WebTaskRunner.h"
-#include "public/platform/WebThread.h"
-#include "public/platform/WebTraceLocation.h"
-
-namespace blink {
-
-class PendingGCRunner : public WebThread::TaskObserver {
-public:
-    PendingGCRunner() : m_nesting(0) { }
-
-    ~PendingGCRunner()
-    {
-        // m_nesting can be 1 if this was unregistered in a task and
-        // didProcessTask was not called.
-        ASSERT(!m_nesting || m_nesting == 1);
-    }
-
-    virtual void willProcessTask()
-    {
-        m_nesting++;
-    }
-
-    virtual void didProcessTask()
-    {
-        // In the production code WebKit::initialize is called from inside the
-        // message loop so we can get didProcessTask() without corresponding
-        // willProcessTask once. This is benign.
-        if (m_nesting)
-            m_nesting--;
-
-        ThreadState* state = ThreadState::current();
-        state->safePoint(m_nesting ? BlinkGC::HeapPointersOnStack : BlinkGC::NoHeapPointersOnStack);
-    }
-
-private:
-    int m_nesting;
-};
-
-} // namespace blink
-
-#endif

diff --git a/third_party/WebKit/Source/platform/heap/ThreadState.cpp b/third_party/WebKit/Source/platform/heap/ThreadState.cpp
index bf3347a0..75bbf58 100644
--- a/third_party/WebKit/Source/platform/heap/ThreadState.cpp
+++ b/third_party/WebKit/Source/platform/heap/ThreadState.cpp

@@ -1114,11 +1114,12 @@
             m_heaps[i]->completeSweep();
 
         double timeForCompleteSweep = WTF::currentTimeMS() - startTime;
-        Platform::current()->histogramCustomCounts("BlinkGC.CompleteSweep", timeForCompleteSweep, 0, 10 * 1000, 50);
         accumulateSweepingTime(timeForCompleteSweep);
 
-        if (isMainThread())
+        if (isMainThread()) {
             ScriptForbiddenScope::exit();
+            Platform::current()->histogramCustomCounts("BlinkGC.CompleteSweep", timeForCompleteSweep, 1, 10 * 1000, 50);
+        }
     }
 
     postSweep();

diff --git a/third_party/WebKit/Source/platform/heap/blink_heap.gypi b/third_party/WebKit/Source/platform/heap/blink_heap.gypi
index 61b29bf..34cf42d 100644
--- a/third_party/WebKit/Source/platform/heap/blink_heap.gypi
+++ b/third_party/WebKit/Source/platform/heap/blink_heap.gypi

@@ -40,6 +40,7 @@
       'CallbackStack.h',
       'GCInfo.cpp',
       'GCInfo.h',
+      'GCTaskRunner.h',
       'GarbageCollected.h',
       'Handle.h',
       'Heap.cpp',
@@ -51,11 +52,9 @@
       'InlinedGlobalMarkingVisitor.h',
       'MarkingVisitor.h',
       'MarkingVisitorImpl.h',
-      'MessageLoopInterruptor.h',
       'PageMemory.h',
       'PagePool.cpp',
       'PagePool.h',
-      'PendingGCRunner.h',
       'PersistentNode.cpp',
       'PersistentNode.h',
       'SafePoint.cpp',

diff --git a/third_party/WebKit/Source/web/TextFinder.h b/third_party/WebKit/Source/web/TextFinder.h
index eab87e70..1f48460 100644
--- a/third_party/WebKit/Source/web/TextFinder.h
+++ b/third_party/WebKit/Source/web/TextFinder.h

@@ -89,7 +89,7 @@
     ~TextFinder();
 
     class FindMatch {
-        ALLOW_ONLY_INLINE_ALLOCATION();
+        DISALLOW_NEW_EXCEPT_PLACEMENT_NEW();
     public:
         FindMatch(PassRefPtrWillBeRawPtr<Range>, int ordinal);
 

diff --git a/third_party/WebKit/Source/web/WebKit.cpp b/third_party/WebKit/Source/web/WebKit.cpp
index c9d49d40..0a908070 100644
--- a/third_party/WebKit/Source/web/WebKit.cpp
+++ b/third_party/WebKit/Source/web/WebKit.cpp

@@ -48,9 +48,8 @@
 #include "platform/Logging.h"
 #include "platform/RuntimeEnabledFeatures.h"
 #include "platform/graphics/ImageDecodingStore.h"
+#include "platform/heap/GCTaskRunner.h"
 #include "platform/heap/Heap.h"
-#include "platform/heap/MessageLoopInterruptor.h"
-#include "platform/heap/PendingGCRunner.h"
 #include "public/platform/Platform.h"
 #include "public/platform/WebPrerenderingSupport.h"
 #include "public/platform/WebThread.h"
@@ -100,8 +99,8 @@
 
 } // namespace
 
-static WebThread::TaskObserver* s_endOfTaskRunner = 0;
-static WebThread::TaskObserver* s_pendingGCRunner = 0;
+static WebThread::TaskObserver* s_endOfTaskRunner = nullptr;
+static GCTaskRunner* s_gcTaskRunner = nullptr;
 
 // Make sure we are not re-initialized in the same address space.
 // Doing so may cause hard to reproduce crashes.
@@ -184,12 +183,8 @@
     ThreadState::attachMainThread();
     // currentThread() is null if we are running on a thread without a message loop.
     if (WebThread* currentThread = platform->currentThread()) {
-        ASSERT(!s_pendingGCRunner);
-        s_pendingGCRunner = new PendingGCRunner;
-        currentThread->addTaskObserver(s_pendingGCRunner);
-
-        OwnPtr<MessageLoopInterruptor> interruptor = adoptPtr(new MessageLoopInterruptor(currentThread->taskRunner()));
-        ThreadState::current()->addInterruptor(interruptor.release());
+        ASSERT(!s_gcTaskRunner);
+        s_gcTaskRunner = new GCTaskRunner(currentThread);
     }
 
     DEFINE_STATIC_LOCAL(ModulesInitializer, initializer, ());
@@ -208,11 +203,11 @@
         // message loop, because the message loop is already destructed before
         // the shutdown() is called.
         delete s_endOfTaskRunner;
-        s_endOfTaskRunner = 0;
+        s_endOfTaskRunner = nullptr;
 
-        ASSERT(s_pendingGCRunner);
-        delete s_pendingGCRunner;
-        s_pendingGCRunner = 0;
+        ASSERT(s_gcTaskRunner);
+        delete s_gcTaskRunner;
+        s_gcTaskRunner = nullptr;
     }
 
     // Shutdown V8-related background threads before V8 is ramped down. Note

diff --git a/third_party/WebKit/Source/wtf/Allocator.h b/third_party/WebKit/Source/wtf/Allocator.h
index 1f41d19..0f06175 100644
--- a/third_party/WebKit/Source/wtf/Allocator.h
+++ b/third_party/WebKit/Source/wtf/Allocator.h

@@ -23,24 +23,24 @@
 // in to raw pointers, but for now Members indicate that we have thought
 // about them and explicitly taken care of them.)
 //
-// DISALLOW_ALLOCATION(): Cannot be allocated with new operators but can be a
+// DISALLOW_NEW(): Cannot be allocated with new operators but can be a
 // part of object.  If it has Members you need a trace method and the containing
 // object needs to call that trace method.
 //
-// ALLOW_ONLY_INLINE_ALLOCATION(): Allows only placement new operator.  This
+// DISALLOW_NEW_EXCEPT_PLACEMENT_NEW(): Allows only placement new operator.  This
 // disallows general allocation of this object but allows to put the object as a
 // value object in collections.  If these have Members you need to have a trace
 // method. That trace method will be called automatically by the on-heap
 // collections.
 //
-#define DISALLOW_ALLOCATION()                                   \
+#define DISALLOW_NEW()                                   \
     private:                                                    \
         void* operator new(size_t) = delete;                    \
         void* operator new(size_t, NotNullTag, void*) = delete; \
         void* operator new(size_t, void*) = delete;             \
     public:
 
-#define ALLOW_ONLY_INLINE_ALLOCATION()                                              \
+#define DISALLOW_NEW_EXCEPT_PLACEMENT_NEW()                                              \
     public:                                                                         \
         using IsAllowOnlyInlineAllocation = int;                                    \
         void* operator new(size_t, NotNullTag, void* location) { return location; } \
@@ -68,7 +68,7 @@
         void* operator new(size_t, void*) = delete;             \
     public:
 #else
-#define STACK_ALLOCATED() DISALLOW_ALLOCATION()
+#define STACK_ALLOCATED() DISALLOW_NEW()
 #endif
 
 // Provides customizable overrides of fastMalloc/fastFree and operator new/delete

diff --git a/third_party/WebKit/Source/wtf/Deque.h b/third_party/WebKit/Source/wtf/Deque.h
index 37f5c9e..0c33f939 100644
--- a/third_party/WebKit/Source/wtf/Deque.h
+++ b/third_party/WebKit/Source/wtf/Deque.h

@@ -43,7 +43,7 @@
 template <typename T, size_t inlineCapacity, typename Allocator> class DequeIterator;
 template <typename T, size_t inlineCapacity, typename Allocator> class DequeConstIterator;
 
-template <typename T, size_t inlineCapacity = 0, typename Allocator = DefaultAllocator>
+template <typename T, size_t inlineCapacity = 0, typename Allocator = PartitionAllocator>
 class Deque : public ConditionalDestructor<Deque<T, INLINE_CAPACITY, Allocator>, (INLINE_CAPACITY == 0) && Allocator::isGarbageCollected> {
     WTF_USE_ALLOCATOR(Deque, Allocator);
 public:
@@ -158,7 +158,7 @@
     friend class Deque<T, inlineCapacity, Allocator>;
 };
 
-template <typename T, size_t inlineCapacity = 0, typename Allocator = DefaultAllocator>
+template <typename T, size_t inlineCapacity = 0, typename Allocator = PartitionAllocator>
 class DequeIterator : public DequeIteratorBase<T, inlineCapacity, Allocator> {
 private:
     typedef DequeIteratorBase<T, inlineCapacity, Allocator> Base;
@@ -188,7 +188,7 @@
     // postfix -- intentionally omitted
 };
 
-template <typename T, size_t inlineCapacity = 0, typename Allocator = DefaultAllocator>
+template <typename T, size_t inlineCapacity = 0, typename Allocator = PartitionAllocator>
 class DequeConstIterator : public DequeIteratorBase<T, inlineCapacity, Allocator> {
 private:
     typedef DequeIteratorBase<T, inlineCapacity, Allocator> Base;
@@ -228,7 +228,7 @@
 {
     static_assert(!IsPolymorphic<T>::value || !VectorTraits<T>::canInitializeWithMemset, "Cannot initialize with memset if there is a vtable");
 #if ENABLE(OILPAN)
-    static_assert(Allocator::isGarbageCollected || !IsAllowOnlyInlineAllocation<T>::value || !NeedsTracing<T>::value, "Cannot put ALLOW_ONLY_INLINE_ALLOCATION objects that have trace methods into an off-heap Deque");
+    static_assert(Allocator::isGarbageCollected || !IsAllowOnlyInlineAllocation<T>::value || !NeedsTracing<T>::value, "Cannot put DISALLOW_NEW_EXCEPT_PLACEMENT_NEW objects that have trace methods into an off-heap Deque");
 #endif
 }
 

diff --git a/third_party/WebKit/Source/wtf/HashCountedSet.h b/third_party/WebKit/Source/wtf/HashCountedSet.h
index 11b27772..97340589 100644
--- a/third_party/WebKit/Source/wtf/HashCountedSet.h
+++ b/third_party/WebKit/Source/wtf/HashCountedSet.h

@@ -34,7 +34,7 @@
     typename Value,
     typename HashFunctions = typename DefaultHash<Value>::Hash,
     typename Traits = HashTraits<Value>,
-    typename Allocator = DefaultAllocator>
+    typename Allocator = PartitionAllocator>
 class HashCountedSet {
     WTF_USE_ALLOCATOR(HashCountedSet, Allocator);
 private:

diff --git a/third_party/WebKit/Source/wtf/HashMap.h b/third_party/WebKit/Source/wtf/HashMap.h
index ac75e27..8cb46d4 100644
--- a/third_party/WebKit/Source/wtf/HashMap.h
+++ b/third_party/WebKit/Source/wtf/HashMap.h

@@ -21,8 +21,8 @@
 #ifndef WTF_HashMap_h
 #define WTF_HashMap_h
 
-#include "wtf/DefaultAllocator.h"
 #include "wtf/HashTable.h"
+#include "wtf/PartitionAllocator.h"
 
 namespace WTF {
 
@@ -49,7 +49,7 @@
     typename HashArg = typename DefaultHash<KeyArg>::Hash,
     typename KeyTraitsArg = HashTraits<KeyArg>,
     typename MappedTraitsArg = HashTraits<MappedArg>,
-    typename Allocator = DefaultAllocator>
+    typename Allocator = PartitionAllocator>
 class HashMap {
     WTF_USE_ALLOCATOR(HashMap, Allocator);
 private:

diff --git a/third_party/WebKit/Source/wtf/HashSet.h b/third_party/WebKit/Source/wtf/HashSet.h
index 5724968..cf37e1ac 100644
--- a/third_party/WebKit/Source/wtf/HashSet.h
+++ b/third_party/WebKit/Source/wtf/HashSet.h

@@ -21,8 +21,8 @@
 #ifndef WTF_HashSet_h
 #define WTF_HashSet_h
 
-#include "wtf/DefaultAllocator.h"
 #include "wtf/HashTable.h"
+#include "wtf/PartitionAllocator.h"
 
 namespace WTF {
 
@@ -35,7 +35,7 @@
     typename ValueArg,
     typename HashArg = typename DefaultHash<ValueArg>::Hash,
     typename TraitsArg = HashTraits<ValueArg>,
-    typename Allocator = DefaultAllocator>
+    typename Allocator = PartitionAllocator>
 class HashSet {
     WTF_USE_ALLOCATOR(HashSet, Allocator);
 private:

diff --git a/third_party/WebKit/Source/wtf/HashTable.h b/third_party/WebKit/Source/wtf/HashTable.h
index 14ceab4..1764b64 100644
--- a/third_party/WebKit/Source/wtf/HashTable.h
+++ b/third_party/WebKit/Source/wtf/HashTable.h

@@ -23,8 +23,8 @@
 #include "wtf/Alignment.h"
 #include "wtf/Assertions.h"
 #include "wtf/ConditionalDestructor.h"
-#include "wtf/DefaultAllocator.h"
 #include "wtf/HashTraits.h"
+#include "wtf/PartitionAllocator.h"
 
 #define DUMP_HASHTABLE_STATS 0
 #define DUMP_HASHTABLE_STATS_PER_TABLE 0
@@ -1003,7 +1003,7 @@
     static_assert(Allocator::isGarbageCollected
         || ((!IsAllowOnlyInlineAllocation<KeyType>::value || !NeedsTracing<KeyType>::value)
         && (!IsAllowOnlyInlineAllocation<ValueType>::value || !NeedsTracing<ValueType>::value))
-        , "Cannot put ALLOW_ONLY_INLINE_ALLOCATION objects that have trace methods into an off-heap HashTable");
+        , "Cannot put DISALLOW_NEW_EXCEPT_PLACEMENT_NEW objects that have trace methods into an off-heap HashTable");
 #endif
     if (Traits::emptyValueIsZero) {
         result = Allocator::template allocateZeroedHashTableBacking<ValueType, HashTable>(allocSize);
@@ -1162,7 +1162,7 @@
 
     // The Allocator::isGarbageCollected check is not needed.  The check is just
     // a static hint for a compiler to indicate that Base::expandBuffer returns
-    // false if Allocator is a DefaultAllocator.
+    // false if Allocator is a PartitionAllocator.
     if (Allocator::isGarbageCollected && newTableSize > oldTableSize) {
         bool success;
         Value* newEntry = expandBuffer(newTableSize, entry, success);

diff --git a/third_party/WebKit/Source/wtf/LinkedHashSet.h b/third_party/WebKit/Source/wtf/LinkedHashSet.h
index bdb1f1b2..58d97fb 100644
--- a/third_party/WebKit/Source/wtf/LinkedHashSet.h
+++ b/third_party/WebKit/Source/wtf/LinkedHashSet.h

@@ -23,9 +23,9 @@
 #define WTF_LinkedHashSet_h
 
 #include "wtf/AddressSanitizer.h"
-#include "wtf/DefaultAllocator.h"
 #include "wtf/HashSet.h"
 #include "wtf/OwnPtr.h"
+#include "wtf/PartitionAllocator.h"
 #include "wtf/PassOwnPtr.h"
 
 namespace WTF {
@@ -138,7 +138,7 @@
     typename ValueArg,
     typename HashFunctions = typename DefaultHash<ValueArg>::Hash,
     typename TraitsArg = HashTraits<ValueArg>,
-    typename Allocator = DefaultAllocator>
+    typename Allocator = PartitionAllocator>
 class LinkedHashSet {
     WTF_USE_ALLOCATOR(LinkedHashSet, Allocator);
 private:

diff --git a/third_party/WebKit/Source/wtf/ListHashSet.h b/third_party/WebKit/Source/wtf/ListHashSet.h
index c2154d2..a2128b6 100644
--- a/third_party/WebKit/Source/wtf/ListHashSet.h
+++ b/third_party/WebKit/Source/wtf/ListHashSet.h

@@ -22,9 +22,9 @@
 #ifndef WTF_ListHashSet_h
 #define WTF_ListHashSet_h
 
-#include "wtf/DefaultAllocator.h"
 #include "wtf/HashSet.h"
 #include "wtf/OwnPtr.h"
+#include "wtf/PartitionAllocator.h"
 #include "wtf/PassOwnPtr.h"
 
 namespace WTF {
@@ -226,8 +226,8 @@
 
 // This allocator is only used for non-Heap ListHashSets.
 template <typename ValueArg, size_t inlineCapacity>
-struct ListHashSetAllocator : public DefaultAllocator {
-    typedef DefaultAllocator TableAllocator;
+struct ListHashSetAllocator : public PartitionAllocator {
+    typedef PartitionAllocator TableAllocator;
     typedef ListHashSetNode<ValueArg, ListHashSetAllocator> Node;
     typedef ListHashSetNodeBase<ValueArg> NodeBase;
 
@@ -321,7 +321,7 @@
         return node >= pool() && node < pastPool();
     }
 
-    static void traceValue(typename DefaultAllocator::Visitor* visitor, Node* node) {}
+    static void traceValue(typename PartitionAllocator::Visitor* visitor, Node* node) {}
 
 private:
     Node* pool() { return reinterpret_cast_ptr<Node*>(m_pool.buffer); }

diff --git a/third_party/WebKit/Source/wtf/DefaultAllocator.cpp b/third_party/WebKit/Source/wtf/PartitionAllocator.cpp
similarity index 89%
rename from third_party/WebKit/Source/wtf/DefaultAllocator.cpp
rename to third_party/WebKit/Source/wtf/PartitionAllocator.cpp
index e0f5324..2befd34 100644
--- a/third_party/WebKit/Source/wtf/DefaultAllocator.cpp
+++ b/third_party/WebKit/Source/wtf/PartitionAllocator.cpp

@@ -29,24 +29,24 @@
  */
 
 #include "config.h"
-#include "wtf/DefaultAllocator.h"
+#include "wtf/PartitionAllocator.h"
 
 #include "wtf/PartitionAlloc.h"
 #include "wtf/Partitions.h"
 
 namespace WTF {
 
-void* DefaultAllocator::allocateBacking(size_t size)
+void* PartitionAllocator::allocateBacking(size_t size)
 {
     return Partitions::bufferMalloc(size);
 }
 
-void DefaultAllocator::freeVectorBacking(void* address)
+void PartitionAllocator::freeVectorBacking(void* address)
 {
     Partitions::bufferFree(address);
 }
 
-void DefaultAllocator::freeHashTableBacking(void* address)
+void PartitionAllocator::freeHashTableBacking(void* address)
 {
     Partitions::bufferFree(address);
 }

diff --git a/third_party/WebKit/Source/wtf/DefaultAllocator.h b/third_party/WebKit/Source/wtf/PartitionAllocator.h
similarity index 95%
rename from third_party/WebKit/Source/wtf/DefaultAllocator.h
rename to third_party/WebKit/Source/wtf/PartitionAllocator.h
index 099014d..de84fb7 100644
--- a/third_party/WebKit/Source/wtf/DefaultAllocator.h
+++ b/third_party/WebKit/Source/wtf/PartitionAllocator.h

@@ -28,8 +28,8 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef WTF_DefaultAllocator_h
-#define WTF_DefaultAllocator_h
+#ifndef WTF_PartitionAllocator_h
+#define WTF_PartitionAllocator_h
 
 // This is the allocator that is used for allocations that are not on the
 // traced, garbage collected heap. It uses FastMalloc for collections,
@@ -44,11 +44,11 @@
 
 namespace WTF {
 
-class DefaultAllocatorDummyVisitor;
+class PartitionAllocatorDummyVisitor;
 
-class WTF_EXPORT DefaultAllocator {
+class WTF_EXPORT PartitionAllocator {
 public:
-    typedef DefaultAllocatorDummyVisitor Visitor;
+    typedef PartitionAllocatorDummyVisitor Visitor;
     static const bool isGarbageCollected = false;
 
     template<typename T>
@@ -185,7 +185,7 @@
 
 // The Windows compiler seems to be very eager to instantiate things it won't
 // need, so unless we have this class we get compile errors.
-class DefaultAllocatorDummyVisitor {
+class PartitionAllocatorDummyVisitor {
 public:
     template<typename T> inline bool isHeapObjectAlive(T obj)
     {
@@ -213,6 +213,6 @@
 private: \
 typedef int __thisIsHereToForceASemicolonAfterThisMacro
 
-using WTF::DefaultAllocator;
+using WTF::PartitionAllocator;
 
-#endif // WTF_DefaultAllocator_h
+#endif // WTF_PartitionAllocator_h

diff --git a/third_party/WebKit/Source/wtf/Partitions.cpp b/third_party/WebKit/Source/wtf/Partitions.cpp
index be93b6d1..ced2e54 100644
--- a/third_party/WebKit/Source/wtf/Partitions.cpp
+++ b/third_party/WebKit/Source/wtf/Partitions.cpp

@@ -32,8 +32,8 @@
 #include "wtf/Partitions.h"
 
 #include "wtf/Alias.h"
-#include "wtf/DefaultAllocator.h"
 #include "wtf/MainThread.h"
+#include "wtf/PartitionAllocator.h"
 
 namespace WTF {
 

diff --git a/third_party/WebKit/Source/wtf/Partitions.h b/third_party/WebKit/Source/wtf/Partitions.h
index 3e4eeed..a36c826b 100644
--- a/third_party/WebKit/Source/wtf/Partitions.h
+++ b/third_party/WebKit/Source/wtf/Partitions.h

@@ -117,13 +117,6 @@
     {
         return partitionReallocGeneric(Partitions::fastMallocPartition(), p, n);
     }
-    static char* fastStrDup(const char* src)
-    {
-        size_t len = strlen(src) + 1;
-        char* dup = static_cast<char*>(fastMalloc(len));
-        memcpy(dup, src, len);
-        return dup;
-    }
     static void fastFree(void* p)
     {
         partitionFreeGeneric(Partitions::fastMallocPartition(), p);

diff --git a/third_party/WebKit/Source/wtf/TerminatedArrayBuilder.h b/third_party/WebKit/Source/wtf/TerminatedArrayBuilder.h
index e15c56c..b768a74 100644
--- a/third_party/WebKit/Source/wtf/TerminatedArrayBuilder.h
+++ b/third_party/WebKit/Source/wtf/TerminatedArrayBuilder.h

@@ -10,7 +10,7 @@
 
 template<typename T, template <typename> class ArrayType = TerminatedArray>
 class TerminatedArrayBuilder {
-    DISALLOW_ALLOCATION();
+    DISALLOW_NEW();
     WTF_MAKE_NONCOPYABLE(TerminatedArrayBuilder);
 public:
     explicit TerminatedArrayBuilder(typename ArrayType<T>::Allocator::PassPtr array)

diff --git a/third_party/WebKit/Source/wtf/TypeTraits.h b/third_party/WebKit/Source/wtf/TypeTraits.h
index a724d73..290e8f02 100644
--- a/third_party/WebKit/Source/wtf/TypeTraits.h
+++ b/third_party/WebKit/Source/wtf/TypeTraits.h

@@ -348,7 +348,7 @@
     static const bool value = NeedsTracing<T>::value || NeedsTracing<U>::value || IsWeak<T>::value || IsWeak<U>::value;
 };
 
-// This is used to check that ALLOW_ONLY_INLINE_ALLOCATION objects are not
+// This is used to check that DISALLOW_NEW_EXCEPT_PLACEMENT_NEW objects are not
 // stored in off-heap Vectors, HashTables etc.
 template <typename T>
 struct IsAllowOnlyInlineAllocation {

diff --git a/third_party/WebKit/Source/wtf/Vector.h b/third_party/WebKit/Source/wtf/Vector.h
index 1d9da90..3a0d28f8 100644
--- a/third_party/WebKit/Source/wtf/Vector.h
+++ b/third_party/WebKit/Source/wtf/Vector.h

@@ -24,9 +24,9 @@
 #include "wtf/Alignment.h"
 #include "wtf/ConditionalDestructor.h"
 #include "wtf/ContainerAnnotations.h"
-#include "wtf/DefaultAllocator.h"
 #include "wtf/Noncopyable.h"
 #include "wtf/NotFound.h"
+#include "wtf/PartitionAllocator.h"
 #include "wtf/StdLibExtras.h"
 #include "wtf/VectorTraits.h"
 #include <algorithm>
@@ -366,7 +366,7 @@
     unsigned m_size;
 };
 
-template <typename T, size_t inlineCapacity, typename Allocator = DefaultAllocator>
+template <typename T, size_t inlineCapacity, typename Allocator = PartitionAllocator>
 class VectorBuffer;
 
 template <typename T, typename Allocator>
@@ -614,7 +614,7 @@
     friend class Deque;
 };
 
-template <typename T, size_t inlineCapacity = 0, typename Allocator = DefaultAllocator> // Heap-allocated vectors with no inlineCapacity never need a destructor.
+template <typename T, size_t inlineCapacity = 0, typename Allocator = PartitionAllocator> // Heap-allocated vectors with no inlineCapacity never need a destructor.
 class Vector : private VectorBuffer<T, INLINE_CAPACITY, Allocator>, public ConditionalDestructor<Vector<T, INLINE_CAPACITY, Allocator>, (INLINE_CAPACITY == 0) && Allocator::isGarbageCollected> {
     WTF_USE_ALLOCATOR(Vector, Allocator);
     typedef VectorBuffer<T, INLINE_CAPACITY, Allocator> Base;
@@ -633,7 +633,7 @@
     {
         static_assert(!IsPolymorphic<T>::value || !VectorTraits<T>::canInitializeWithMemset, "Cannot initialize with memset if there is a vtable");
 #if ENABLE(OILPAN)
-        static_assert(Allocator::isGarbageCollected || !IsAllowOnlyInlineAllocation<T>::value || !NeedsTracing<T>::value, "Cannot put ALLOW_ONLY_INLINE_ALLOCATION objects that have trace methods into an off-heap Vector");
+        static_assert(Allocator::isGarbageCollected || !IsAllowOnlyInlineAllocation<T>::value || !NeedsTracing<T>::value, "Cannot put DISALLOW_NEW_EXCEPT_PLACEMENT_NEW objects that have trace methods into an off-heap Vector");
 #endif
         ANNOTATE_NEW_BUFFER(begin(), capacity(), 0);
         m_size = 0;
@@ -644,7 +644,7 @@
     {
         static_assert(!IsPolymorphic<T>::value || !VectorTraits<T>::canInitializeWithMemset, "Cannot initialize with memset if there is a vtable");
 #if ENABLE(OILPAN)
-        static_assert(Allocator::isGarbageCollected || !IsAllowOnlyInlineAllocation<T>::value || !NeedsTracing<T>::value, "Cannot put ALLOW_ONLY_INLINE_ALLOCATION objects that have trace methods into an off-heap Vector");
+        static_assert(Allocator::isGarbageCollected || !IsAllowOnlyInlineAllocation<T>::value || !NeedsTracing<T>::value, "Cannot put DISALLOW_NEW_EXCEPT_PLACEMENT_NEW objects that have trace methods into an off-heap Vector");
 #endif
         ANNOTATE_NEW_BUFFER(begin(), capacity(), size);
         m_size = size;
@@ -1046,7 +1046,7 @@
 #endif
     // The Allocator::isGarbageCollected check is not needed.  The check is just
     // a static hint for a compiler to indicate that Base::expandBuffer returns
-    // false if Allocator is a DefaultAllocator.
+    // false if Allocator is a PartitionAllocator.
     if (Allocator::isGarbageCollected && Base::expandBuffer(newCapacity)) {
         ANNOTATE_CHANGE_CAPACITY(begin(), oldCapacity, m_size, capacity());
         return;

diff --git a/third_party/WebKit/Source/wtf/wtf.gypi b/third_party/WebKit/Source/wtf/wtf.gypi
index db5d1a2a..48ab13b 100644
--- a/third_party/WebKit/Source/wtf/wtf.gypi
+++ b/third_party/WebKit/Source/wtf/wtf.gypi

@@ -44,8 +44,6 @@
             'DataLog.h',
             'DateMath.cpp',
             'DateMath.h',
-            'DefaultAllocator.cpp',
-            'DefaultAllocator.h',
             'Deque.h',
             'DoublyLinkedList.h',
             'DynamicAnnotations.cpp',
@@ -91,6 +89,8 @@
             'PageAllocator.h',
             'PartitionAlloc.cpp',
             'PartitionAlloc.h',
+            'PartitionAllocator.cpp',
+            'PartitionAllocator.h',
             'Partitions.cpp',
             'Partitions.h',
             'PassOwnPtr.h',

diff --git a/third_party/WebKit/public/blink_headers.gypi b/third_party/WebKit/public/blink_headers.gypi
index 1288779..c5f7e281 100644
--- a/third_party/WebKit/public/blink_headers.gypi
+++ b/third_party/WebKit/public/blink_headers.gypi

@@ -56,6 +56,7 @@
       "platform/WebCryptoKey.h",
       "platform/WebCryptoKeyAlgorithm.h",
       "platform/WebCryptoKeyAlgorithmParams.h",
+      "platform/WebCryptoUtil.h",
       "platform/WebCursorInfo.h",
       "platform/WebData.h",
       "platform/WebDataConsumerHandle.h",

diff --git a/third_party/WebKit/public/platform/WebCryptoUtil.h b/third_party/WebKit/public/platform/WebCryptoUtil.h
new file mode 100644
index 0000000..b95d51a
--- /dev/null
+++ b/third_party/WebKit/public/platform/WebCryptoUtil.h

@@ -0,0 +1,18 @@
+// Copyright 2015 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef WebCryptoUtil_h
+#define WebCryptoUtil_h
+
+#include "WebCommon.h"
+#include "WebVector.h"
+
+namespace blink {
+
+// Converts the (big-endian) BigInteger to unsigned int. Returns true on success (if its value is not too large).
+BLINK_PLATFORM_EXPORT bool bigIntegerToUint(const WebVector<unsigned char>& bigInteger, unsigned& result);
+
+} // namespace blink
+
+#endif // WebCryptoUtil_h

diff --git a/third_party/WebKit/public/platform/WebRTCCertificateGenerator.h b/third_party/WebKit/public/platform/WebRTCCertificateGenerator.h
index e5aff7b..aa10f88 100644
--- a/third_party/WebKit/public/platform/WebRTCCertificateGenerator.h
+++ b/third_party/WebKit/public/platform/WebRTCCertificateGenerator.h

@@ -51,10 +51,10 @@
         const WebURL& firstPartyForCookies,
         WebCallbacks<WebRTCCertificate*, void>* observer) = 0;
 
-    // Determines if the parameters should be considered valid for certificate generation.
+    // Determines if the parameters are supported by generateCertificate.
     // For example, if the number of bits of some parameter is too small or too large we
     // may want to reject it for security or performance reasons.
-    virtual bool isValidKeyParams(const WebRTCKeyParams&) = 0;
+    virtual bool isSupportedKeyParams(const WebRTCKeyParams&) = 0;
 };
 
 } // namespace blink

diff --git a/tools/metrics/histograms/histograms.xml b/tools/metrics/histograms/histograms.xml
index 8c281df6..a9bcacab 100644
--- a/tools/metrics/histograms/histograms.xml
+++ b/tools/metrics/histograms/histograms.xml

@@ -30093,6 +30093,15 @@
   </summary>
 </histogram>
 
+<histogram name="OSX.SharedMemory.Mechanism" enum="OSXSharedMemoryMechanism">
+  <owner>erikchen@chromium.org</owner>
+  <summary>
+    A histogram entry is emitted each time a base::SharedMemory object is
+    constructed. The value of the entry indicates the mechanism used to back the
+    shared memory region.
+  </summary>
+</histogram>
+
 <histogram name="OSX.SystemHotkeyMap.LoadSuccess" enum="BooleanSuccess">
   <owner>erikchen@chromium.org</owner>
   <summary>
@@ -30476,6 +30485,16 @@
   </summary>
 </histogram>
 
+<histogram name="PageLoad.Timing2.NavigationToFirstContentfulPaint"
+    units="milliseconds">
+  <owner>ksakamoto@chromium.org</owner>
+  <summary>
+    The time from navigation start to first &quot;contentful&quot; paint. For
+    now, this is the minimum of PageLoad.Timing2.NavigationToFirstTextPaint and
+    PageLoad.Timing2.NavigationToFirstImagePaint.
+  </summary>
+</histogram>
+
 <histogram name="PageLoad.Timing2.NavigationToFirstForeground"
     units="milliseconds">
   <owner>bmcquade@chromium.org</owner>
@@ -68107,6 +68126,15 @@
   </int>
 </enum>
 
+<enum name="OSXSharedMemoryMechanism" type="int">
+  <int value="0" label="POSIX">
+    The shared memory region is backed by a POSIX fd.
+  </int>
+  <int value="1" label="MACH">
+    The shared memory region is backed by a Mach memory object.
+  </int>
+</enum>
+
 <enum name="OtherPossibleUsernamesUsage" type="int">
   <int value="0" label="Nothing to Autofill"/>
   <int value="1" label="No other possible usernames"/>
@@ -79304,6 +79332,7 @@
   <affected-histogram name="PageLoad.Events.Provisional"/>
   <affected-histogram
       name="PageLoad.Timing2.NavigationToDOMContentLoadedEventFired"/>
+  <affected-histogram name="PageLoad.Timing2.NavigationToFirstContentfulPaint"/>
   <affected-histogram name="PageLoad.Timing2.NavigationToFirstImagePaint"/>
   <affected-histogram name="PageLoad.Timing2.NavigationToFirstLayout"/>
   <affected-histogram name="PageLoad.Timing2.NavigationToFirstPaint"/>

diff --git a/tools/perf/benchmarks/power.py b/tools/perf/benchmarks/power.py
index 85c5bf9a..1a4a3bc 100644
--- a/tools/perf/benchmarks/power.py
+++ b/tools/perf/benchmarks/power.py

@@ -98,6 +98,7 @@
 
 
 @benchmark.Enabled('mac')
+@benchmark.Disabled('reference') # crbug.com/547833
 class PowerTop25(perf_benchmark.PerfBenchmark):
   """Top 25 quiescent power test."""
   test = power.QuiescentPower

diff --git a/tools/perf/benchmarks/scheduler.py b/tools/perf/benchmarks/scheduler.py
index 294ff8d..4d10529c 100644
--- a/tools/perf/benchmarks/scheduler.py
+++ b/tools/perf/benchmarks/scheduler.py

@@ -1,13 +1,15 @@
 # Copyright 2014 The Chromium Authors. All rights reserved.
 # Use of this source code is governed by a BSD-style license that can be
 # found in the LICENSE file.
+from telemetry import benchmark
 
 from core import perf_benchmark
-
 from measurements import smoothness
+
 import page_sets
 
 
+@benchmark.Disabled('reference')  # crbug.com/549428
 class SchedulerToughSchedulingCases(perf_benchmark.PerfBenchmark):
   """Measures rendering statistics while interacting with pages that have
   challenging scheduling properties.

diff --git a/tools/perf/benchmarks/smoothness.py b/tools/perf/benchmarks/smoothness.py
index 3386369..2a639284 100644
--- a/tools/perf/benchmarks/smoothness.py
+++ b/tools/perf/benchmarks/smoothness.py

@@ -36,6 +36,7 @@
     return True
 
 
+@benchmark.Disabled('reference') # crbug.com/547833
 class SmoothnessTop25(_Smoothness):
   """Measures rendering statistics while scrolling down the top 25 web pages.
 
@@ -155,6 +156,7 @@
 
 
 @benchmark.Enabled('android', 'mac')
+@benchmark.Disabled('reference') # crbug.com/547833
 class SmoothnessGpuRasterizationTop25(_Smoothness):
   """Measures rendering statistics for the top 25 with GPU rasterization.
   """

diff --git a/tools/perf/benchmarks/v8.py b/tools/perf/benchmarks/v8.py
index c59ad191..1249dba5 100644
--- a/tools/perf/benchmarks/v8.py
+++ b/tools/perf/benchmarks/v8.py

@@ -16,6 +16,7 @@
 
 # Disabled on Win due to crbug.com/416502.
 @benchmark.Disabled('win')
+@benchmark.Disabled('reference') # crbug.com/547833
 class V8Top25(perf_benchmark.PerfBenchmark):
   """Measures V8 GC metrics on the while scrolling down the top 25 web pages.
 

diff --git a/ui/file_manager/audio_player/assets/100/player_timeline_base_center.png b/ui/file_manager/audio_player/assets/100/player_timeline_base_center.png
deleted file mode 100644
index f5dd2ac..0000000
--- a/ui/file_manager/audio_player/assets/100/player_timeline_base_center.png
+++ /dev/null
Binary files differ

diff --git a/ui/file_manager/audio_player/assets/100/player_timeline_base_left.png b/ui/file_manager/audio_player/assets/100/player_timeline_base_left.png
deleted file mode 100644
index 35ab5a4c..0000000
--- a/ui/file_manager/audio_player/assets/100/player_timeline_base_left.png
+++ /dev/null
Binary files differ

diff --git a/ui/file_manager/audio_player/assets/100/player_timeline_base_right.png b/ui/file_manager/audio_player/assets/100/player_timeline_base_right.png
deleted file mode 100644
index 35ab5a4c..0000000
--- a/ui/file_manager/audio_player/assets/100/player_timeline_base_right.png
+++ /dev/null
Binary files differ

diff --git a/ui/file_manager/audio_player/assets/100/player_timeline_handler_pressed.png b/ui/file_manager/audio_player/assets/100/player_timeline_handler_pressed.png
deleted file mode 100644
index fa8526a0..0000000
--- a/ui/file_manager/audio_player/assets/100/player_timeline_handler_pressed.png
+++ /dev/null
Binary files differ

diff --git a/ui/file_manager/audio_player/assets/100/player_timeline_played_center.png b/ui/file_manager/audio_player/assets/100/player_timeline_played_center.png
deleted file mode 100644
index b7ab78c5..0000000
--- a/ui/file_manager/audio_player/assets/100/player_timeline_played_center.png
+++ /dev/null
Binary files differ

diff --git a/ui/file_manager/audio_player/assets/100/player_timeline_played_left.png b/ui/file_manager/audio_player/assets/100/player_timeline_played_left.png
deleted file mode 100644
index 9116014a..0000000
--- a/ui/file_manager/audio_player/assets/100/player_timeline_played_left.png
+++ /dev/null
Binary files differ

diff --git a/ui/file_manager/audio_player/assets/100/player_timeline_played_right.png b/ui/file_manager/audio_player/assets/100/player_timeline_played_right.png
deleted file mode 100644
index 9116014a..0000000
--- a/ui/file_manager/audio_player/assets/100/player_timeline_played_right.png
+++ /dev/null
Binary files differ

diff --git a/ui/file_manager/audio_player/assets/200/player_timeline_base_center.png b/ui/file_manager/audio_player/assets/200/player_timeline_base_center.png
deleted file mode 100644
index 2154855f..0000000
--- a/ui/file_manager/audio_player/assets/200/player_timeline_base_center.png
+++ /dev/null
Binary files differ

diff --git a/ui/file_manager/audio_player/assets/200/player_timeline_base_left.png b/ui/file_manager/audio_player/assets/200/player_timeline_base_left.png
deleted file mode 100644
index 4a11dd2..0000000
--- a/ui/file_manager/audio_player/assets/200/player_timeline_base_left.png
+++ /dev/null
Binary files differ

diff --git a/ui/file_manager/audio_player/assets/200/player_timeline_base_right.png b/ui/file_manager/audio_player/assets/200/player_timeline_base_right.png
deleted file mode 100644
index 76279c4..0000000
--- a/ui/file_manager/audio_player/assets/200/player_timeline_base_right.png
+++ /dev/null
Binary files differ

diff --git a/ui/file_manager/audio_player/assets/200/player_timeline_handler_pressed.png b/ui/file_manager/audio_player/assets/200/player_timeline_handler_pressed.png
deleted file mode 100644
index c27d9481..0000000
--- a/ui/file_manager/audio_player/assets/200/player_timeline_handler_pressed.png
+++ /dev/null
Binary files differ

diff --git a/ui/file_manager/audio_player/assets/200/player_timeline_played_center.png b/ui/file_manager/audio_player/assets/200/player_timeline_played_center.png
deleted file mode 100644
index f113bbd..0000000
--- a/ui/file_manager/audio_player/assets/200/player_timeline_played_center.png
+++ /dev/null
Binary files differ

diff --git a/ui/file_manager/audio_player/assets/200/player_timeline_played_left.png b/ui/file_manager/audio_player/assets/200/player_timeline_played_left.png
deleted file mode 100644
index 9c63b735..0000000
--- a/ui/file_manager/audio_player/assets/200/player_timeline_played_left.png
+++ /dev/null
Binary files differ

diff --git a/ui/file_manager/audio_player/assets/200/player_timeline_played_right.png b/ui/file_manager/audio_player/assets/200/player_timeline_played_right.png
deleted file mode 100644
index abcc959..0000000
--- a/ui/file_manager/audio_player/assets/200/player_timeline_played_right.png
+++ /dev/null
Binary files differ

diff --git a/ui/file_manager/audio_player/elements/audio_player.css b/ui/file_manager/audio_player/elements/audio_player.css
index c804963a..bc6d7aa 100644
--- a/ui/file_manager/audio_player/elements/audio_player.css
+++ b/ui/file_manager/audio_player/elements/audio_player.css

@@ -5,7 +5,6 @@
 control-panel {
   bottom: 0;
   left: 0;
-  margin-bottom: 8px;
   position: fixed;
   right: 0;
 }

diff --git a/ui/file_manager/audio_player/elements/audio_player.html b/ui/file_manager/audio_player/elements/audio_player.html
index 133b260..9caf15a2 100644
--- a/ui/file_manager/audio_player/elements/audio_player.html
+++ b/ui/file_manager/audio_player/elements/audio_player.html

@@ -15,7 +15,8 @@
         expanded$="[[expanded]]"
         shuffle="[[shuffle]]"
         current-track-index="{{currentTrackIndex}}"
-        on-replay="onReplayCurrentTrack"></track-list>
+        on-replay="onReplayCurrentTrack"
+        on-play="onPlayCurrentTrack"></track-list>
     <control-panel id="audioController"
         playing="{{playing}}"
         time="{{time}}"
@@ -24,6 +25,7 @@
         repeat="{{repeat}}"
         volume="{{volume}}"
         expanded="{{expanded}}"
+        volume-slider-shown="{{volumeSliderShown}}"
         on-next-clicked="onControllerNextClicked"
         on-previous-clicked="onControllerPreviousClicked"></control-panel>
     <audio id="audio"

diff --git a/ui/file_manager/audio_player/elements/audio_player.js b/ui/file_manager/audio_player/elements/audio_player.js
index 3d5fc01..a6b51e9 100644
--- a/ui/file_manager/audio_player/elements/audio_player.js
+++ b/ui/file_manager/audio_player/elements/audio_player.js

@@ -57,6 +57,14 @@
     },
 
     /**
+     * Whether the volume slider is shown.
+     */
+    volumeSliderShown: {
+      type: Boolean,
+      observer: 'volumeSliderShownChanged'
+    },
+
+    /**
      * Track index of the current track.
      */
     currentTrackIndex: {
@@ -94,6 +102,12 @@
   },
 
   /**
+   * The last playing state when user starts dragging the seek bar.
+   * @private {boolean}
+   */
+  wasPlayingOnDragStart_: false,
+
+  /**
    * Handles change event for shuffle mode.
    * @param {boolean} shuffle
    */
@@ -129,12 +143,23 @@
   },
 
   /**
+   * Handles change event for volumeSliderShown state.
+   */
+  volumeSliderShownChanged: function(volumeSliderShown) {
+    if (this.model)
+      this.model.volumeSliderShown = volumeSliderShown;
+  },
+
+  /**
    * Initializes an element. This method is called automatically when the
    * element is ready.
    */
   ready: function() {
     this.addEventListener('keydown', this.onKeyDown_.bind(this));
 
+    this.$.audioController.addEventListener('dragging-changed',
+        this.onDraggingChanged_.bind(this));
+
     this.$.audio.volume = 0;  // Temporary initial volume.
     this.$.audio.addEventListener('ended', this.onAudioEnded.bind(this));
     this.$.audio.addEventListener('error', this.onAudioError.bind(this));
@@ -213,6 +238,7 @@
       this.repeat = newModel.repeat;
       this.volume = newModel.volume;
       this.expanded = newModel.expanded;
+      this.volumeSliderShown = newModel.volumeSliderShown;
     }
   },
 
@@ -275,6 +301,13 @@
   },
 
   /**
+   * Invoked when receivig a request to start playing the current music.
+   */
+  onPlayCurrentTrack: function() {
+    this.$.audio.play();
+  },
+
+  /**
    * Invoked when receiving a request to replay the current music from the track
    * list element.
    */
@@ -396,6 +429,24 @@
   },
 
   /**
+   * Invoked when dragging state of seek bar on control panel is changed.
+   * During the user is dragging it, audio playback is paused temporalily.
+   */
+  onDraggingChanged_: function() {
+    if (this.$.audioController.dragging) {
+      if (this.playing) {
+        this.wasPlayingOnDragStart_ = true;
+        this.$.audio.pause();
+      }
+    } else {
+      if (this.wasPlayingOnDragStart_) {
+        this.$.audio.play();
+        this.wasPlayingOnDragStart_ = false;
+      }
+    }
+  },
+
+  /**
    * Invoked when the 'keydown' event is fired.
    * @param {Event} event The event object.
    */

diff --git a/ui/file_manager/audio_player/elements/compiled_resources.gyp b/ui/file_manager/audio_player/elements/compiled_resources.gyp
index 7e420190..8ff70cd 100644
--- a/ui/file_manager/audio_player/elements/compiled_resources.gyp
+++ b/ui/file_manager/audio_player/elements/compiled_resources.gyp

@@ -4,16 +4,6 @@
 {
   'targets': [
     {
-      'target_name': 'volume_controller',
-      'variables': {
-        'depends': [],
-        'externs': []
-      },
-      'includes': [
-        '../../compile_js.gypi'
-      ]
-    },
-    {
       'target_name': 'track_list',
       'variables': {
         'depends': [],

diff --git a/ui/file_manager/audio_player/elements/control_panel.css b/ui/file_manager/audio_player/elements/control_panel.css
index 4e5b533..9a2b198 100644
--- a/ui/file_manager/audio_player/elements/control_panel.css
+++ b/ui/file_manager/audio_player/elements/control_panel.css

@@ -8,19 +8,20 @@
   background-color: white;
   display: flex;
   flex-direction: column;
-  height: 64px;
+  height: 96px;
   justify-content: center;
   padding: 0;
 }
 
-.controls .upper-controls {
-  height: 32px;
-  width: 100%
+:host([volume-slider-shown]) .controls {
+  height: 144px;
 }
 
-.controls .lower-controls {
-  height: 32px;
-  width: 100%
+.controls .control-row {
+  box-sizing: border-box;
+  height: 48px;
+  padding: 8px;
+  width: 100%;
 }
 
 .audio-controls {
@@ -82,173 +83,40 @@
   justify-content: center;
 }
 
-.custom-slider.progress {
-  display: flex;
-  flex: 1 1 auto;
-  height: 100%;
-  position: relative;
-  z-index: 0;  /* Make a layer which includes the thumb on slider. */
-}
-
-.custom-slider.progress > input[type='range']::-webkit-slider-thumb {
-  background-image: -webkit-image-set(
-      url(../assets/100/player_timeline_handler.png) 1x,
-      url(../assets/200/player_timeline_handler.png) 2x);
-  width: 28px;
-}
-
-.custom-slider.progress > input[type='range']::-webkit-slider-thumb:hover {
-  background-image: -webkit-image-set(
-      url(../assets/100/player_timeline_handler.png) 1x,
-      url(../assets/200/player_timeline_handler.png) 2x);
-}
-
-.custom-slider.progress > input[type='range']::-webkit-slider-thumb:active {
-  background-image: -webkit-image-set(
-      url(../assets/100/player_timeline_handler_pressed.png) 1x,
-      url(../assets/200/player_timeline_handler_pressed.png) 2x);
-}
-
-.custom-slider.progress.disabled > input[type='range']::-webkit-slider-thumb {
-  background-image: none;
-}
-
-.time-controls > .time {
+.time-controls > .time-container {
+  color: rgb(51, 51, 51);
   cursor: default;
-  height: 100%;
+  flex: none;
+  font-size: 12px;
+  padding: 8px;
   position: relative;
-  width: 53px;
 }
 
-.time-controls > .time.disabled {
+.time-container > .time {
+  position: absolute;
+  right: 8px; /* Should be same as time-container's right padding. */
+  top: 8px; /* Should be same as time-container's top padding. */
+}
+
+.time-container > .time.disabled {
   opacity: 0;
 }
 
-.custom-slider > input[type='range'] {
-  -webkit-appearance: none !important;  /* Hide the default thumb icon. */
-  background: transparent;  /* Hide the standard slider bar */
-  height: 100%;
-  left: -2px;  /* Required to align the input element with the parent. */
-  outline: none;
-  position: absolute;
-  top: -2px;
-  width: 100%;
+.time-container > .time-spacer {
+  opacity: 0; /* This class is intended to be used as invisible spacer. */
 }
 
-/* Custom thumb icon. */
-.custom-slider > input[type='range']::-webkit-slider-thumb {
-  -webkit-appearance: none;
-  background-position: center center;
-  background-repeat: no-repeat;
-  height: 24px;
-  position: relative;
-  z-index: 2;
-}
-
-/* Custom slider bar (we hide the standard one). */
-.custom-slider > .bar {
-  background-image: -webkit-image-set(
-      url(../assets/100/player_timeline_base_center.png) 1x,
-      url(../assets/200/player_timeline_base_center.png) 2x);
-  /* In order to match the horizontal position of the standard slider bar
-     left and right must be equal to 1/2 of the thumb icon width. */
-  bottom: 15px;
-  left: 14px;  /* Exactly 1/2 of the thumb width */
-  pointer-events: none;  /* Mouse events pass through to the standard input. */
-  position: absolute;
-  right: 14px;
-  top: 15px;
-}
-
-.custom-slider > .bar > .filled,
-.custom-slider > .bar > .cap {
-  bottom: 0;
-  position: absolute;
-  top: 0;
-}
-
-/* The filled portion of the slider bar to the left of the thumb. */
-.custom-slider > .bar > .filled {
-  background-image: -webkit-image-set(
-      url(../assets/100/player_timeline_played_center.png) 1x,
-      url(../assets/200/player_timeline_played_center.png) 2x);
-  border-left-style: none;
-  border-right-style: none;
-  left: 0;
-  width: 0; /* The element style.width is manipulated from the code. */
-}
-
-/* Rounded caps to the left and right of the slider bar. */
-.custom-slider > .bar > .cap {
-  width: 1px;
-}
-
-/* Left cap is always filled, should be the same color as .filled. */
-.custom-slider > .bar > .cap.left {
-  background-image: -webkit-image-set(
-      url(../assets/100/player_timeline_played_left.png) 1x,
-      url(../assets/200/player_timeline_played_left.png) 2x);
-  right: 100%;
-}
-
-/* Right cap is always not filled. */
-.custom-slider > .bar > .cap.right {
-  background-image: -webkit-image-set(
-      url(../assets/100/player_timeline_base_right.png) 1x,
-      url(../assets/200/player_timeline_base_right.png) 2x);
-  left: 100%;
+paper-slider {
+  --paper-slider-active-color: rgb(66, 133, 244);
+  --paper-slider-knob-color: rgb(64, 138, 241);
+  flex: auto;
 }
 
 .media-button.disabled,
-.custom-slider.disabled,
-.custom-slider.readonly {
+paper-slider.disabled {
   pointer-events: none;
 }
 
-/* Progress seek marker (precise time shown on mouse hover. */
-
-/* Thin vertical line across the slider bar */
-.custom-slider > .bar > .seek-mark {
-  background-color: #202020;
-  bottom: -1px;
-  left: 0;
-  position: absolute;
-  top: -1px;
-  width: 0;
-}
-
-.custom-slider > .bar > .seek-mark.visible {
-  width: 1px;
-}
-
-.custom-slider > .bar > .seek-mark.inverted {
-  background-color: #808080;
-}
-
-/* Text label giving the precise time corresponding to the hover position. */
-.custom-slider > .bar > .seek-mark > .seek-label {
-  align-items: center;
-  background: #202020;
-  border-top-left-radius: 2px;
-  border-top-right-radius: 2px;
-  bottom: 19px;
-  color: white;
-  display: flex;
-  flex-direction: row;
-  font-size: 12px;
-  height: 15px;
-  justify-content: center;
-  left: 0;
-  opacity: 0;
-  overflow: hidden;
-  position: absolute;
-  transition: opacity 150ms ease;
-}
-
-.custom-slider > .bar > .seek-mark.visible > .seek-label {
-  opacity: 1;
-}
-
 /* Media controls in order of appearance. */
 
 .audio-controls {
@@ -363,38 +231,23 @@
 }
 
 /* Invisible div used to compute the width required for the elapsed time. */
-.time-controls > .time > .duration,
 .time-controls > .time > .current {
   align-items: center;
-  color: rgb(51, 51, 51);
   display: flex;
   flex-direction: row;
-  font-size: 12px;
   height: 100%;
   justify-content: flex-end;
   position: absolute;
   top: -1px;
 }
 
-.time-controls > .time > .duration {
-  left: 0;
+.volume-controls {
+  align-items: center;
+  background-color: rgb(235, 235, 235);
+  display: flex;
+  flex-direction: row;
 }
 
-.time-controls > .time > .current {
-  right: 0;
-}
-
-/* Volume controls: sound button and volume slider */
-
-#volumeContainer {
-  border: 1px solid #ddd;
-  border-radius: 2px;
-  box-shadow: 0 2px 4px #777;
-  height: 110px;
-  position: fixed;
-  width: 32px;
-}
-
-#volumeContainer.default-hidden {
-  visibility: hidden;
+.volume-controls paper-slider {
+  width: 100%;
 }

diff --git a/ui/file_manager/audio_player/elements/control_panel.html b/ui/file_manager/audio_player/elements/control_panel.html
index 8cc7ee25..e8fdb283 100644
--- a/ui/file_manager/audio_player/elements/control_panel.html
+++ b/ui/file_manager/audio_player/elements/control_panel.html

@@ -6,7 +6,7 @@
 
 <link rel="import" href="chrome://resources/polymer/v1_0/polymer/polymer.html">
 <link rel="import" href="chrome://resources/polymer/v1_0/font-roboto/roboto.html">
-<link rel="import" href="volume_controller.html">
+<link rel="import" href="chrome://resources/polymer/v1_0/paper-slider/paper-slider.html">
 <link rel="import" href="chrome-extension://hhaomjibdihmijegdhdafkllkbggdgoj/foreground/elements/files_ripple.html">
 <link rel="import" href="chrome-extension://hhaomjibdihmijegdhdafkllkbggdgoj/foreground/elements/files_toggle_ripple.html">
 
@@ -14,24 +14,10 @@
   <link rel="import" type="css" href="control_panel.css">
   <template>
     <div class="controls">
-      <div class="upper-controls time-controls">
-        <div class="time media-control">
-          <div class="current">[[time2string_(time)]]</div>
-        </div>
-        <div class="progress media-control custom-slider">
-          <input id="timeInput" name="timeInput" type="range" touch-action="manipulation"
-                 min="0" max="[[duration]]" value="{{time::input}}">
-          <div class="bar">
-            <div class="filled" style$="[[computeProgressBarStyle_(time, duration)]]"></div>
-            <div class="cap left"></div>
-            <div class="cap right"></div>
-          </div>
-        </div>
-        <div class="time media-control">
-          <div class="duration">[[time2string_(duration)]]</div>
-        </div>
+      <div class="control-row volume-controls" hidden="[[!volumeSliderShown]]">
+        <paper-slider id="volumeSlider" value="{{volume::change}}"></paper-slider>
       </div>
-      <div class="lower-controls audio-controls">
+      <div class="control-row audio-controls">
         <!-- Shuffle toggle button in the bottom line. -->
         <button class="shuffle-mode media-button toggle" state="default">
           <label>
@@ -64,7 +50,7 @@
         </button>
 
         <!-- Play button in the bottom line. -->
-        <button class="play media-control media-button"
+        <button class="play media-button"
                 state$="[[computePlayState_(playing)]]"
                 on-click="playClick">
           <div class="normal playing"></div>
@@ -82,16 +68,6 @@
           <files-ripple></files-ripple>
         </button>
 
-        <div id="volumeContainer"
-             class="default-hidden"
-             anchor-point="bottom center">
-          <volume-controller id="volumeSlider" value="{{volume}}"
-                             width="32" height="85" value="50">
-          </volume-controller>
-
-          <polymer-anchor-point id="anchorHelper"></polymer-anchor-point>
-        </div>
-
         <!-- Volume button in the bottom line. -->
         <button id="volumeButton"
                 class="volume media-button toggle"
@@ -115,6 +91,13 @@
           <files-toggle-ripple activated="[[expanded]]"></files-toggle-ripple>
         </button>
       </div>
+      <div class="control-row time-controls">
+        <div class="time-container">
+          <div class="time-spacer">[[computeTimeString_(duration, duration)]]</div>
+          <div class="time">[[computeTimeString_(time, duration)]]</div>
+        </div>
+        <paper-slider id="timeSlider" max="[[duration]]" value="{{time::change}}"></paper-slider>
+      </div>
     </div>
   </template>
 </dom-module>

diff --git a/ui/file_manager/audio_player/elements/control_panel.js b/ui/file_manager/audio_player/elements/control_panel.js
index ca7ea240..8956287 100644
--- a/ui/file_manager/audio_player/elements/control_panel.js
+++ b/ui/file_manager/audio_player/elements/control_panel.js

@@ -5,26 +5,6 @@
 (function() {
   'use strict';
 
-  /**
-   * Moves |target| element above |anchor| element, in order to match the
-   * bottom lines.
-   * @param {HTMLElement} target Target element.
-   * @param {HTMLElement} anchor Anchor element.
-   */
-  function matchBottomLine(target, anchor) {
-    var targetRect = target.getBoundingClientRect();
-    var anchorRect = anchor.getBoundingClientRect();
-
-    var pos = {
-      left: anchorRect.left + anchorRect.width / 2 - targetRect.width / 2,
-      bottom: window.innerHeight - anchorRect.bottom,
-    };
-
-    target.style.position = 'fixed';
-    target.style.left = pos.left + 'px';
-    target.style.bottom = pos.bottom + 'px';
-  }
-
   Polymer({
     is: 'control-panel',
 
@@ -97,7 +77,16 @@
       volumeSliderShown: {
         type: Boolean,
         value: false,
-        observer: 'volumeSliderShownChanged',
+        notify: true,
+        reflectToAttribute: true
+      },
+
+      /**
+       * Whether the knob of time slider is being dragged.
+       */
+      dragging: {
+        type: Boolean,
+        value: false,
         notify: true
       }
     },
@@ -107,22 +96,14 @@
      * element is ready.
      */
     ready: function() {
-      var onFocusoutBound = this.onVolumeControllerFocusout_.bind(this);
-
-      this.$.volumeSlider.addEventListener('focusout', onFocusoutBound);
-      this.$.volumeButton.addEventListener('focusout', onFocusoutBound);
-
-      // Prevent the time slider from being moved by arrow keys.
-      this.$.timeInput.addEventListener('keydown', function(event) {
-        switch (event.keyCode) {
-          case 37:  // Left arrow
-          case 38:  // Up arrow
-          case 39:  // Right arrow
-          case 40:  // Down arrow
-            event.preventDefault();
-            break;
-        };
-      });
+      this.$.timeSlider.addEventListener('value-change', function() {
+        if (this.dragging)
+          this.dragging = false;
+      }.bind(this));
+      this.$.timeSlider.addEventListener('immediate-value-change', function() {
+        if (!this.dragging)
+          this.dragging = true;
+      }.bind(this));
     },
 
     /**
@@ -147,44 +128,6 @@
     },
 
     /**
-     * Invoked when the property 'volumeSliderShown' changes.
-     * @param {boolean} shown
-     */
-    volumeSliderShownChanged: function(shown) {
-      this.showVolumeController_(shown);
-    },
-
-    /**
-     * Invoked when the focus goes out of the volume elements.
-     * @param {!UIEvent} event The focusout event.
-     * @private
-     */
-    onVolumeControllerFocusout_: function(event) {
-      if (this.volumeSliderShown) {
-        // If the focus goes out of the volume, hide the volume control.
-        if (!event.relatedTarget ||
-            (!this.$.volumeButton.contains(event.relatedTarget) &&
-             !this.$.volumeSlider.contains(event.relatedTarget))) {
-          this.volumeSliderShown = false;
-        }
-      }
-    },
-
-    /**
-     * Shows/hides the volume controller.
-     * @param {boolean} show True to show the controller, false to hide.
-     * @private
-     */
-    showVolumeController_: function(show) {
-      if (show) {
-        matchBottomLine(this.$.volumeContainer, this.$.volumeButton);
-        this.$.volumeContainer.style.visibility = 'visible';
-      } else {
-        this.$.volumeContainer.style.visibility = 'hidden';
-      }
-    },
-
-    /**
      * Converts the time into human friendly string.
      * @param {number} time Time to be converted.
      * @return {string} String representation of the given time
@@ -194,6 +137,16 @@
     },
 
     /**
+     * Converts the time and duration into human friendly string.
+     * @param {number} time Time to be converted.
+     * @param {number} duration Duration to be converted.
+     * @return {string} String representation of the given time
+     */
+    computeTimeString_: function(time, duration) {
+      return this.time2string_(time) + ' / ' + this.time2string_(duration);
+    },
+
+    /**
      * Computes state for play button based on 'playing' property.
      * @return {string}
      */

diff --git a/ui/file_manager/audio_player/elements/track_list.css b/ui/file_manager/audio_player/elements/track_list.css
index 9e00870..a2f31a29 100644
--- a/ui/file_manager/audio_player/elements/track_list.css
+++ b/ui/file_manager/audio_player/elements/track_list.css

@@ -43,8 +43,10 @@
 .track .icon {
   background-position: center;
   background-repeat: no-repeat;
+  flex: none;
   height: 32px;
   margin: 8px;
+  pointer-events: none;
   width: 32px;
 }
 
@@ -52,6 +54,7 @@
   background-image: -webkit-image-set(
       url(../assets/100/playlist_play.png) 1x,
       url(../assets/200/playlist_play.png) 2x);
+  pointer-events: auto;
 }
 
 .track[active] .icon {

diff --git a/ui/file_manager/audio_player/elements/track_list.js b/ui/file_manager/audio_player/elements/track_list.js
index 95894ed..c611ce64 100644
--- a/ui/file_manager/audio_player/elements/track_list.js
+++ b/ui/file_manager/audio_player/elements/track_list.js

@@ -166,8 +166,15 @@
     trackClicked: function(event) {
       var index = ~~event.currentTarget.getAttribute('index');
       var track = this.tracks[index];
-      if (track)
-        this.selectTrack(track);
+      if (track) {
+        if (event.target.classList.contains('icon')) {
+          // If the play icon on the track is clicked, change the current track
+          // and start playing it regardless of current play state.
+          this.selectTrack(track, true /* force to play */);
+        } else {
+          this.selectTrack(track, false /* force to play */);
+        }
+      }
     },
 
     /**
@@ -250,8 +257,10 @@
      * Sets the current track.
      * @param {!TrackInfo} track TrackInfo to be set as the current
      *     track.
+     * @param {boolean} forcePlay True if the track should be played regardless
+     *     of the current play state (paused/played).
      */
-    selectTrack: function(track) {
+    selectTrack: function(track, forcePlay) {
       var index = -1;
       for (var i = 0; i < this.tracks.length; i++) {
         if (this.tracks[i].url === track.url) {
@@ -261,10 +270,13 @@
       }
       if (index >= 0) {
         // TODO(yoshiki): Clean up the flow and the code around here.
-        if (this.currentTrackIndex == index)
+        if (this.currentTrackIndex === index) {
           this.replayCurrentTrack();
-        else
+        } else {
           this.currentTrackIndex = index;
+          if (forcePlay)
+            this.fire('play');
+        }
       }
     },
 

diff --git a/ui/file_manager/audio_player/elements/volume_controller.css b/ui/file_manager/audio_player/elements/volume_controller.css
deleted file mode 100644
index 4e6880e..0000000
--- a/ui/file_manager/audio_player/elements/volume_controller.css
+++ /dev/null

@@ -1,52 +0,0 @@
-/* Copyright 2014 The Chromium Authors. All rights reserved.
- * Use of this source code is governed by a BSD-style license that can be
- * found in the LICENSE file. */
-
-:host {
-  background: white;
-  display: block;
-  height: 100px;
-  position: relative;
-  width: 32px;
-}
-
-#background {
-  height: 100%;  /* will be overridden by javascript */
-  left: 0;
-  position: absolute;
-  top: 0;
-  width: 100%;
-}
-
-input[type='range'] {
-  -webkit-appearance: none !important;
-  -webkit-transform: rotate(90deg);
-  background: transparent;
-  outline: none;
-  position: absolute;
-  z-index: 1;
-}
-
-input[type='range']::-webkit-slider-thumb {
-  -webkit-appearance: none;
-  -webkit-transform: rotate(-90deg);
-  background-image: -webkit-image-set(
-      url(../assets/100/player_timeline_handler.png) 1x,
-      url(../assets/200/player_timeline_handler.png) 2x);
-  background-position: 50% 50%;
-  background-repeat: no-repeat no-repeat;
-  height: 24px;
-  position: relative;
-  width: 24px;
-}
-
-#bar {
-  background: #000;
-  bottom: 14px;
-  position: absolute;
-  top: 14px;
-}
-
-#bar .filled {
-  background: #aaa;
-}

diff --git a/ui/file_manager/audio_player/elements/volume_controller.html b/ui/file_manager/audio_player/elements/volume_controller.html
deleted file mode 100644
index 1431716..0000000
--- a/ui/file_manager/audio_player/elements/volume_controller.html
+++ /dev/null

@@ -1,23 +0,0 @@
-<!--
-  -- Copyright 2015 The Chromium Authors. All rights reserved.
-  -- Use of this source code is governed by a BSD-style license that can be
-  -- found in the LICENSE file.
-  -->
-
-<link rel="import" href="chrome://resources/polymer/v1_0/polymer/polymer.html">
-
-<dom-module id="volume-controller">
-  <link rel="import" type="css" href="volume_controller.css">
-  <template>
-    <div id="background"></div>
-    <input name="rawValueInput" id="rawValueInput" touch-action="manipulation"
-           type="range" min="0" max="100" value="{{rawValue::input}}">
-    <div id="bar">
-      <div class="filled" style$="[[computeFilledStyle_(rawValue)]]"></div>
-      <div class="cap left"></div>
-      <div class="cap right"></div>
-    </div>
-  </template>
-</dom-module>
-
-<script src="volume_controller.js"></script>

diff --git a/ui/file_manager/audio_player/elements/volume_controller.js b/ui/file_manager/audio_player/elements/volume_controller.js
deleted file mode 100644
index ed00080..0000000
--- a/ui/file_manager/audio_player/elements/volume_controller.js
+++ /dev/null

@@ -1,124 +0,0 @@
-// Copyright 2014 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-(function() {
-  'use strict';
-
-  Polymer({
-    is: 'volume-controller',
-
-    properties: {
-      /**
-       * Width of the element in pixels. Must be specified before ready() is
-       * called. Dynamic change is not supported.
-       * @type {number}
-       */
-      width: {
-        type: Number,
-        value: 32
-      },
-
-      /**
-       * Height of the element in pixels. Must be specified before ready() is
-       * called. Dynamic change is not supported.
-       * @type {number}
-       */
-      height: {
-        type: Number,
-        value: 100
-      },
-
-      /**
-       * Volume. 0 is silent, and 100 is maximum.
-       * @type {number}
-       */
-      value: {
-        type: Number,
-        value: 50,
-        observer: 'valueChanged',
-        notify: true
-      },
-
-      /**
-       * Volume. 100 is silent, and 0 is maximum.
-       * @type {number}
-       */
-      rawValue: {
-        type: Number,
-        value: 0,
-        observer: 'rawValueChanged',
-        notify: true
-      }
-    },
-
-    /**
-     * Initializes an element. This method is called automatically when the
-     * element is ready.
-     */
-    ready: function() {
-      this.style.width = this.width + 'px';
-      this.style.height = this.height + 'px';
-
-      this.rawValueInput = this.$.rawValueInput;
-      this.bar = this.$.bar;
-
-      this.rawValueInput.style.width = this.height + 'px';
-      this.rawValueInput.style.height = this.width + 'px';
-      this.rawValueInput.style.webkitTransformOrigin =
-          (this.width / 2) + 'px ' +
-          (this.width / 2 - 2) + 'px';
-
-      var barLeft = (this.width / 2 - 1);
-      this.bar.style.left = barLeft + 'px';
-      this.bar.style.right = barLeft + 'px';
-
-      this.addEventListener('keydown', this.onKeyDown_.bind(this));
-    },
-
-    /**
-     * Invoked when the 'volume' value is changed.
-     * @param {number} newValue New value.
-     * @param {number} oldValue Old value.
-     */
-    valueChanged: function(newValue, oldValue) {
-      if (oldValue != newValue)
-        this.rawValue = 100 - newValue;
-    },
-
-    /**
-     * Invoked when the 'rawValue' property is changed.
-     * @param {number} newValue New value.
-     * @param {number} oldValue Old value.
-     */
-    rawValueChanged: function(newValue, oldValue) {
-      if (oldValue !== newValue)
-        this.value = 100 - newValue;
-    },
-
-    /**
-     * Invoked when the 'keydown' event is fired.
-     * @param {Event} event The event object.
-     */
-    onKeyDown_: function(event) {
-      switch (event.keyIdentifier) {
-        // Prevents the default behavior. These key should be handled in
-        // <audio-player> element.
-        case 'Up':
-        case 'Down':
-        case 'PageUp':
-        case 'PageDown':
-          event.preventDefault();
-          break;
-      }
-    },
-
-    /**
-     * Computes style for '.filled' element based on raw value.
-     * @return {string}
-     */
-    computeFilledStyle_: function(rawValue) {
-      return 'height: ' + rawValue + '%;';
-    }
-  });
-})();  // Anonymous closure

diff --git a/ui/file_manager/audio_player/js/audio_player.js b/ui/file_manager/audio_player/js/audio_player.js
index 216bb44..fea6cd4 100644
--- a/ui/file_manager/audio_player/js/audio_player.js
+++ b/ui/file_manager/audio_player/js/audio_player.js

@@ -24,10 +24,14 @@
   Object.observe(this.model_, function(changes) {
     for (var i = 0; i < changes.length; i++) {
       var change = changes[i];
-      if (change.name == 'expanded' &&
-          (change.type == 'add' || change.type == 'update')) {
+      if (change.name === 'expanded' &&
+          (change.type === 'add' || change.type === 'update')) {
         this.onModelExpandedChanged(change.oldValue, change.object.expanded);
         break;
+      } else if (change.name === 'volumeSliderShown' &&
+          (change.type === 'add' || change.type === 'update')) {
+        this.onModelVolumeSliderShownChanged();
+        break;
       }
     }
   }.bind(this));
@@ -284,11 +288,11 @@
  */
 AudioPlayer.prototype.onResize_ = function(event) {
   if (!this.isExpanded_ &&
-      window.innerHeight >= AudioPlayer.EXPANDED_MODE_MIN_HEIGHT) {
+      window.innerHeight >= this.getExpandedModeMinHeight_()) {
     this.isExpanded_ = true;
     this.player_.expanded = true;
   } else if (this.isExpanded_ &&
-             window.innerHeight < AudioPlayer.EXPANDED_MODE_MIN_HEIGHT) {
+      window.innerHeight < this.getExpandedModeMinHeight_()) {
     this.isExpanded_ = false;
     this.player_.expanded = false;
   }
@@ -332,14 +336,28 @@
  * @type {number}
  * @const
  */
-AudioPlayer.TRACK_HEIGHT = 44;
+AudioPlayer.TRACK_HEIGHT = 48;
 
 /**
- * Controls bar height in pixels.
+ * Volume slider's height in pixels.
  * @type {number}
  * @const
  */
-AudioPlayer.CONTROLS_HEIGHT = 73;  // 72px + border 1px
+AudioPlayer.VOLUME_SLIDER_HEIGHT = 48;
+
+/**
+ * Height of the control which has buttons such as play, next, shffule, etc...
+ * @type {number}
+ * @const
+ */
+AudioPlayer.BUTTONS_CONTROL_HEIGHT = 48;
+
+/**
+ * Height of the control which has progress slider, time, and duration.
+ * @type {number}
+ * @const
+ */
+AudioPlayer.TIME_CONTROL_HEIGHT = 48;
 
 /**
  * Default number of items in the expanded mode.
@@ -349,14 +367,6 @@
 AudioPlayer.DEFAULT_EXPANDED_ITEMS = 5;
 
 /**
- * Minimum size of the window in the expanded mode in pixels.
- * @type {number}
- * @const
- */
-AudioPlayer.EXPANDED_MODE_MIN_HEIGHT = AudioPlayer.CONTROLS_HEIGHT +
-                                       AudioPlayer.TRACK_HEIGHT * 2;
-
-/**
  * Invoked when the 'expanded' property in the model is changed.
  * @param {boolean} oldValue Old value.
  * @param {boolean} newValue New value.
@@ -380,6 +390,13 @@
 };
 
 /**
+ * Invoked when the 'volumeSliderShown' property in the model is changed.
+ */
+AudioPlayer.prototype.onModelVolumeSliderShownChanged = function() {
+  this.syncHeight_();
+};
+
+/**
  * @private
  */
 AudioPlayer.prototype.syncHeight_ = function() {
@@ -388,24 +405,49 @@
   if (this.player_.expanded) {
     // Expanded.
     if (!this.lastExpandedHeight_ ||
-        this.lastExpandedHeight_ < AudioPlayer.EXPANDED_MODE_MIN_HEIGHT) {
+        this.lastExpandedHeight_ < this.getExpandedModeMinHeight_()) {
       var expandedListHeight =
           Math.min(this.entries_.length, AudioPlayer.DEFAULT_EXPANDED_ITEMS) *
               AudioPlayer.TRACK_HEIGHT;
-      targetHeight = AudioPlayer.CONTROLS_HEIGHT + expandedListHeight;
+      targetHeight = this.getControlsHeight_() + expandedListHeight;
       this.lastExpandedHeight_ = targetHeight;
     } else {
       targetHeight = this.lastExpandedHeight_;
     }
   } else {
     // Not expanded.
-    targetHeight = AudioPlayer.CONTROLS_HEIGHT + AudioPlayer.TRACK_HEIGHT;
+    targetHeight = this.getControlsHeight_() + AudioPlayer.TRACK_HEIGHT;
   }
 
   window.resizeTo(window.innerWidth, targetHeight + AudioPlayer.HEADER_HEIGHT);
 };
 
 /**
+ * Calculates the height of control panel.
+ * @return {number} Current height of control panel in pixels.
+ * @private
+ */
+AudioPlayer.prototype.getControlsHeight_ = function() {
+  var height = AudioPlayer.BUTTONS_CONTROL_HEIGHT +
+               AudioPlayer.TIME_CONTROL_HEIGHT;
+  if (this.player_.volumeSliderShown)
+    height += AudioPlayer.VOLUME_SLIDER_HEIGHT;
+
+  return height;
+};
+
+/**
+ * Calculates the minium height of the app to show the playlist in expanded
+ * mode.
+ * @return {number} The minimum height of audio app window in which we can show
+ *     the playlist in expanded mode.
+ * @private
+ */
+AudioPlayer.prototype.getExpandedModeMinHeight_ = function() {
+  return this.getControlsHeight_() + AudioPlayer.TRACK_HEIGHT * 2;
+};
+
+/**
  * Create a TrackInfo object encapsulating the information about one track.
  *
  * @param {FileEntry} entry FileEntry to be retrieved the track info from.

diff --git a/ui/file_manager/audio_player/js/audio_player_model.js b/ui/file_manager/audio_player/js/audio_player_model.js
index 7bbef274..42c7e844 100644
--- a/ui/file_manager/audio_player/js/audio_player_model.js
+++ b/ui/file_manager/audio_player/js/audio_player_model.js

@@ -26,6 +26,7 @@
       repeat: false,
       volume: 100,
       expanded: false,
+      volumeSliderShown: false
     };
 
   /**

diff --git a/ui/file_manager/audio_player/js/background.js b/ui/file_manager/audio_player/js/background.js
index c65fd155..6177c7a 100644
--- a/ui/file_manager/audio_player/js/background.js
+++ b/ui/file_manager/audio_player/js/background.js

@@ -21,10 +21,10 @@
 var audioPlayerCreateOptions = {
   id: 'audio-player',
   type: 'panel',
-  minHeight: 48 + 73,  // 48px: track, 73px: controller
-  minWidth: 292,
-  height: 48 + 73,  // collapsed
-  width: 292
+  minHeight: 48 + 96,  // 48px: track, 96px: controller
+  minWidth: 280,
+  height: 48 + 96,  // collapsed
+  width: 280
 };
 
 /**

diff --git a/ui/file_manager/file_manager_resources.grd b/ui/file_manager/file_manager_resources.grd
index a5449d6..ba8cc28025 100644
--- a/ui/file_manager/file_manager_resources.grd
+++ b/ui/file_manager/file_manager_resources.grd

@@ -168,9 +168,6 @@
       <include name="IDR_AUDIO_PLAYER_ELEMENTS_TRACK_LIST_CSS" file="audio_player/elements/track_list.css" flattenhtml="true" type="BINDATA" />
       <include name="IDR_AUDIO_PLAYER_ELEMENTS_TRACK_LIST_HTML" file="audio_player/elements/track_list.html" type="BINDATA" />
       <include name="IDR_AUDIO_PLAYER_ELEMENTS_TRACK_LIST_JS" file="audio_player/elements/track_list.js" type="BINDATA" />
-      <include name="IDR_AUDIO_PLAYER_ELEMENTS_VOLUME_CONTROLLER_CSS" file="audio_player/elements/volume_controller.css" flattenhtml="true" type="BINDATA" />
-      <include name="IDR_AUDIO_PLAYER_ELEMENTS_VOLUME_CONTROLLER_HTML" file="audio_player/elements/volume_controller.html" type="BINDATA" />
-      <include name="IDR_AUDIO_PLAYER_ELEMENTS_VOLUME_CONTROLLER_JS" file="audio_player/elements/volume_controller.js" type="BINDATA" />
       <include name="IDR_AUDIO_PLAYER_METADATA_WORKER_JS" file="audio_player/js/metadata_worker.js" flattenhtml="true" type="BINDATA" />
       <include name="IDR_AUDIO_PLAYER_ERROR_UTIL_JS" file="audio_player/js/error_util.js" flattenhtml="false" type="BINDATA" />
       <include name="IDR_AUDIO_PLAYER_TEST_UTIL_JS" file="audio_player/js/test_util.js" flattenhtml="false" type="BINDATA" />