diff --git a/DEPS b/DEPS
index 5908c64..c2f85f8 100644
--- a/DEPS
+++ b/DEPS

@@ -44,7 +44,7 @@
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling V8
   # and whatever else without interference from each other.
-  'v8_revision': 'dd4cb0498a4e379cb39df95eb27db97123d212da',
+  'v8_revision': '8ba45f77c14f019f1d61565371a89e635db15151',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling swarming_client
   # and whatever else without interference from each other.
@@ -88,7 +88,7 @@
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling NaCl
   # and whatever else without interference from each other.
-  'nacl_revision': '026b76327c0c443fcf98064e315ca398c4b544d1',
+  'nacl_revision': '94bbb858ca3830bcd56fb732cc6050608787f07e',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling freetype-android
   # and whatever else without interference from each other.

diff --git a/ash/common/system/chromeos/ime_menu/ime_menu_tray.cc b/ash/common/system/chromeos/ime_menu/ime_menu_tray.cc
index 9a89443..78479dee 100644
--- a/ash/common/system/chromeos/ime_menu/ime_menu_tray.cc
+++ b/ash/common/system/chromeos/ime_menu/ime_menu_tray.cc

@@ -154,6 +154,7 @@
         new views::Label(l10n_util::GetStringUTF16(IDS_ASH_STATUS_TRAY_IME));
     title_label_->SetBorder(views::CreateEmptyBorder(
         0, kMenuEdgeEffectivePadding, kTrayMenuBottomRowPadding, 0));
+    UpdateStyle();
     title_label_->SetHorizontalAlignment(gfx::ALIGN_LEFT);
     AddChildView(title_label_);
     box_layout->SetFlexForView(title_label_, 1);
@@ -167,10 +168,19 @@
     }
   }
 
+  void UpdateStyle() {
+    if (!GetNativeTheme() || !title_label_) {
+      return;
+    }
+
+    TrayPopupItemStyle style(GetNativeTheme(),
+                             TrayPopupItemStyle::FontStyle::TITLE);
+    style.SetupLabel(title_label_);
+  }
+
   // views::View:
   void OnNativeThemeChanged(const ui::NativeTheme* theme) override {
-    TrayPopupItemStyle style(theme, TrayPopupItemStyle::FontStyle::TITLE);
-    style.SetupLabel(title_label_);
+    UpdateStyle();
   }
 
   // views::ButtonListener:
@@ -280,8 +290,11 @@
                    bool show_voice_button,
                    bool show_settings_button) {
     if (MaterialDesignController::IsSystemTrayMenuMaterial()) {
-      SetLayoutManager(
-          new views::BoxLayout(views::BoxLayout::kHorizontal, 0, 0, 0));
+      auto* box_layout =
+          new views::BoxLayout(views::BoxLayout::kHorizontal, 0, 0, 0);
+      box_layout->set_minimum_cross_axis_size(
+          GetTrayConstant(TRAY_POPUP_ITEM_MIN_HEIGHT));
+      SetLayoutManager(box_layout);
       SetBorder(views::CreatePaddedBorder(
           views::CreateSolidSidedBorder(kSeparatorWidth, 0, 0, 0,
                                         kHorizontalSeparatorColor),

diff --git a/ash/common/system/tray/tray_constants.cc b/ash/common/system/tray/tray_constants.cc
index 22f4e6e5..67ec8cc0 100644
--- a/ash/common/system/tray/tray_constants.cc
+++ b/ash/common/system/tray/tray_constants.cc

@@ -36,7 +36,7 @@
 // Vertical padding between status tray items when the shelf is vertical.
 const int kTrayLabelItemVerticalPaddingVerticalAlignment = 4;
 
-const int kTrayMenuBottomRowPadding = 5;
+const int kTrayMenuBottomRowPadding = 3;
 const int kTrayMenuBottomRowPaddingBetweenItems = -1;
 const int kTrayMenuMinimumWidth = 300;
 const int kTrayMenuMinimumWidthMd = 352;

diff --git a/base/bind_helpers.h b/base/bind_helpers.h
index 1e652255..7b3d7d3 100644
--- a/base/bind_helpers.h
+++ b/base/bind_helpers.h

@@ -21,7 +21,7 @@
 // Owned() transfers ownership of an object to the Callback resulting from
 // bind; the object will be deleted when the Callback is deleted.
 //
-// Passed() is for transferring movable-but-not-copyable types (eg. scoped_ptr)
+// Passed() is for transferring movable-but-not-copyable types (eg. unique_ptr)
 // through a Callback. Logically, this signifies a destructive transfer of
 // the state of the argument into the target function.  Invoking
 // Callback::Run() twice on a Callback that was created with a Passed()

diff --git a/base/debug/activity_tracker.cc b/base/debug/activity_tracker.cc
index f12d105..c728fa05 100644
--- a/base/debug/activity_tracker.cc
+++ b/base/debug/activity_tracker.cc

@@ -1022,7 +1022,7 @@
   // TODO(bcwhite): Review this after major compiler releases.
   DCHECK(mem_reference);
   void* mem_base;
-#if !defined(OS_WIN) && !defined(OS_ANDROID)
+#if 0  // TODO(bcwhite): Update this for new GetAsObject functionality.
   mem_base = allocator_->GetAsObject<ThreadActivityTracker::Header>(
       mem_reference, kTypeIdActivityTracker);
 #else

diff --git a/base/debug/leak_tracker_unittest.cc b/base/debug/leak_tracker_unittest.cc
index 8b4c568..b9ecdcf3 100644
--- a/base/debug/leak_tracker_unittest.cc
+++ b/base/debug/leak_tracker_unittest.cc

@@ -30,7 +30,7 @@
   EXPECT_EQ(-1, LeakTracker<ClassA>::NumLiveInstances());
   EXPECT_EQ(-1, LeakTracker<ClassB>::NumLiveInstances());
 
-  // Use scoped_ptr so compiler doesn't complain about unused variables.
+  // Use unique_ptr so compiler doesn't complain about unused variables.
   std::unique_ptr<ClassA> a1(new ClassA);
   std::unique_ptr<ClassB> b1(new ClassB);
   std::unique_ptr<ClassB> b2(new ClassB);

diff --git a/base/feature_list.cc b/base/feature_list.cc
index c2f268b..234d5be 100644
--- a/base/feature_list.cc
+++ b/base/feature_list.cc

@@ -28,12 +28,12 @@
 // Tracks whether the FeatureList instance was initialized via an accessor.
 bool g_initialized_from_accessor = false;
 
-const uint32_t kFeatureType = 0x06567CA6 + 1;  // SHA1(FeatureEntry) v1
-
 // An allocator entry for a feature in shared memory. The FeatureEntry is
 // followed by a base::Pickle object that contains the feature and trial name.
-// Any changes to this structure requires a bump in kFeatureType defined above.
 struct FeatureEntry {
+  // SHA1(FeatureEntry): Increment this if structure changes!
+  static constexpr uint32_t kPersistentTypeId = 0x06567CA6 + 1;
+
   // Expected size for 32/64-bit check.
   static constexpr size_t kExpectedInstanceSize = 8;
 
@@ -98,13 +98,8 @@
   DCHECK(!initialized_);
 
   PersistentMemoryAllocator::Iterator iter(allocator);
-
-  PersistentMemoryAllocator::Reference ref;
-  while ((ref = iter.GetNextOfType(kFeatureType)) !=
-         PersistentMemoryAllocator::kReferenceNull) {
-    const FeatureEntry* entry =
-        allocator->GetAsObject<const FeatureEntry>(ref, kFeatureType);
-
+  const FeatureEntry* entry;
+  while ((entry = iter.GetNextOfObject<FeatureEntry>()) != nullptr) {
     OverrideState override_state =
         static_cast<OverrideState>(entry->override_state);
 
@@ -170,20 +165,17 @@
       pickle.WriteString(override.second.field_trial->trial_name());
 
     size_t total_size = sizeof(FeatureEntry) + pickle.size();
-    PersistentMemoryAllocator::Reference ref =
-        allocator->Allocate(total_size, kFeatureType);
-    if (!ref)
+    FeatureEntry* entry = allocator->AllocateObject<FeatureEntry>(total_size);
+    if (!entry)
       return;
 
-    FeatureEntry* entry =
-        allocator->GetAsObject<FeatureEntry>(ref, kFeatureType);
     entry->override_state = override.second.overridden_state;
     entry->pickle_size = pickle.size();
 
     char* dst = reinterpret_cast<char*>(entry) + sizeof(FeatureEntry);
     memcpy(dst, pickle.data(), pickle.size());
 
-    allocator->MakeIterable(ref);
+    allocator->MakeIterable(entry);
   }
 }
 

diff --git a/base/mac/scoped_authorizationref.h b/base/mac/scoped_authorizationref.h
index 03cde8614..b83f8dfb 100644
--- a/base/mac/scoped_authorizationref.h
+++ b/base/mac/scoped_authorizationref.h

@@ -11,7 +11,7 @@
 #include "base/macros.h"
 
 // ScopedAuthorizationRef maintains ownership of an AuthorizationRef.  It is
-// patterned after the scoped_ptr interface.
+// patterned after the unique_ptr interface.
 
 namespace base {
 namespace mac {

diff --git a/base/memory/linked_ptr.h b/base/memory/linked_ptr.h
index 649dc10..6851286 100644
--- a/base/memory/linked_ptr.h
+++ b/base/memory/linked_ptr.h

@@ -69,7 +69,7 @@
   mutable linked_ptr_internal const* next_;
 };
 
-// TODO(http://crbug.com/556939): DEPRECATED: Use scoped_ptr instead (now that
+// TODO(http://crbug.com/556939): DEPRECATED: Use unique_ptr instead (now that
 // we have support for moveable types inside STL containers).
 template <typename T>
 class linked_ptr {

diff --git a/base/memory/scoped_vector_unittest.cc b/base/memory/scoped_vector_unittest.cc
index ea3dcdc..916dab9 100644
--- a/base/memory/scoped_vector_unittest.cc
+++ b/base/memory/scoped_vector_unittest.cc

@@ -322,7 +322,7 @@
     EXPECT_EQ(LC_CONSTRUCTED, it->life_cycle_state());
 }
 
-// Assertions for push_back(scoped_ptr).
+// Assertions for push_back(unique_ptr).
 TEST(ScopedVectorTest, PushBackScopedPtr) {
   int delete_counter = 0;
   std::unique_ptr<DeleteCounter> elem(new DeleteCounter(&delete_counter));

diff --git a/base/message_loop/message_pump_glib.h b/base/message_loop/message_pump_glib.h
index a2b54d8..d79dba55 100644
--- a/base/message_loop/message_pump_glib.h
+++ b/base/message_loop/message_pump_glib.h

@@ -69,7 +69,7 @@
   // Dispatch() will be called.
   int wakeup_pipe_read_;
   int wakeup_pipe_write_;
-  // Use a scoped_ptr to avoid needing the definition of GPollFD in the header.
+  // Use a unique_ptr to avoid needing the definition of GPollFD in the header.
   std::unique_ptr<GPollFD> wakeup_gpollfd_;
 
   DISALLOW_COPY_AND_ASSIGN(MessagePumpGlib);

diff --git a/base/metrics/field_trial.cc b/base/metrics/field_trial.cc
index 106ca96..a4f40cd 100644
--- a/base/metrics/field_trial.cc
+++ b/base/metrics/field_trial.cc

@@ -55,7 +55,6 @@
 
 // Constants for the field trial allocator.
 const char kAllocatorName[] = "FieldTrialAllocator";
-const uint32_t kFieldTrialType = 0xABA17E13 + 2;  // SHA1(FieldTrialEntry) v2
 
 // We allocate 128 KiB to hold all the field trial data. This should be enough,
 // as most people use 3 - 25 KiB for field trials (as of 11/25/2016).
@@ -717,13 +716,9 @@
 
   FieldTrialAllocator* allocator = global_->field_trial_allocator_.get();
   FieldTrialAllocator::Iterator mem_iter(allocator);
-  FieldTrial::FieldTrialRef ref;
-  while ((ref = mem_iter.GetNextOfType(kFieldTrialType)) !=
-         SharedPersistentMemoryAllocator::kReferenceNull) {
-    const FieldTrial::FieldTrialEntry* entry =
-        allocator->GetAsObject<const FieldTrial::FieldTrialEntry>(
-            ref, kFieldTrialType);
-
+  const FieldTrial::FieldTrialEntry* entry;
+  while ((entry = mem_iter.GetNextOfObject<FieldTrial::FieldTrialEntry>()) !=
+         nullptr) {
     StringPiece trial_name;
     StringPiece group_name;
     if (subtle::NoBarrier_Load(&entry->activated) &&
@@ -1042,9 +1037,8 @@
     return false;
 
   const FieldTrial::FieldTrialEntry* entry =
-      global_->field_trial_allocator_
-          ->GetAsObject<const FieldTrial::FieldTrialEntry>(field_trial->ref_,
-                                                           kFieldTrialType);
+      global_->field_trial_allocator_->GetAsObject<FieldTrial::FieldTrialEntry>(
+          field_trial->ref_);
 
   size_t allocated_size =
       global_->field_trial_allocator_->GetAllocSize(field_trial->ref_);
@@ -1075,12 +1069,11 @@
   std::vector<FieldTrial::FieldTrialRef> new_refs;
 
   FieldTrial::FieldTrialRef prev_ref;
-  while ((prev_ref = mem_iter.GetNextOfType(kFieldTrialType)) !=
+  while ((prev_ref = mem_iter.GetNextOfType<FieldTrial::FieldTrialEntry>()) !=
          FieldTrialAllocator::kReferenceNull) {
     // Get the existing field trial entry in shared memory.
     const FieldTrial::FieldTrialEntry* prev_entry =
-        allocator->GetAsObject<const FieldTrial::FieldTrialEntry>(
-            prev_ref, kFieldTrialType);
+        allocator->GetAsObject<FieldTrial::FieldTrialEntry>(prev_ref);
     StringPiece trial_name;
     StringPiece group_name;
     if (!prev_entry->GetTrialAndGroupName(&trial_name, &group_name))
@@ -1091,11 +1084,8 @@
     pickle.WriteString(trial_name);
     pickle.WriteString(group_name);
     size_t total_size = sizeof(FieldTrial::FieldTrialEntry) + pickle.size();
-    FieldTrial::FieldTrialRef new_ref =
-        allocator->Allocate(total_size, kFieldTrialType);
     FieldTrial::FieldTrialEntry* new_entry =
-        allocator->GetAsObject<FieldTrial::FieldTrialEntry>(new_ref,
-                                                            kFieldTrialType);
+        allocator->AllocateObject<FieldTrial::FieldTrialEntry>(total_size);
     subtle::NoBarrier_Store(&new_entry->activated,
                             subtle::NoBarrier_Load(&prev_entry->activated));
     new_entry->pickle_size = pickle.size();
@@ -1108,12 +1098,14 @@
 
     // Update the ref on the field trial and add it to the list to be made
     // iterable.
+    FieldTrial::FieldTrialRef new_ref = allocator->GetAsReference(new_entry);
     FieldTrial* trial = global_->PreLockedFind(trial_name.as_string());
     trial->ref_ = new_ref;
     new_refs.push_back(new_ref);
 
     // Mark the existing entry as unused.
-    allocator->ChangeType(prev_ref, 0, kFieldTrialType);
+    allocator->ChangeType(prev_ref, 0,
+                          FieldTrial::FieldTrialEntry::kPersistentTypeId);
   }
 
   for (const auto& ref : new_refs) {
@@ -1137,13 +1129,10 @@
 FieldTrialList::GetAllFieldTrialsFromPersistentAllocator(
     PersistentMemoryAllocator const& allocator) {
   std::vector<const FieldTrial::FieldTrialEntry*> entries;
-  FieldTrial::FieldTrialRef ref;
   FieldTrialAllocator::Iterator iter(&allocator);
-  while ((ref = iter.GetNextOfType(kFieldTrialType)) !=
-         FieldTrialAllocator::kReferenceNull) {
-    const FieldTrial::FieldTrialEntry* entry =
-        allocator.GetAsObject<const FieldTrial::FieldTrialEntry>(
-            ref, kFieldTrialType);
+  const FieldTrial::FieldTrialEntry* entry;
+  while ((entry = iter.GetNextOfObject<FieldTrial::FieldTrialEntry>()) !=
+         nullptr) {
     entries.push_back(entry);
   }
   return entries;
@@ -1182,13 +1171,9 @@
   FieldTrialAllocator* shalloc = global_->field_trial_allocator_.get();
   FieldTrialAllocator::Iterator mem_iter(shalloc);
 
-  FieldTrial::FieldTrialRef ref;
-  while ((ref = mem_iter.GetNextOfType(kFieldTrialType)) !=
-         FieldTrialAllocator::kReferenceNull) {
-    const FieldTrial::FieldTrialEntry* entry =
-        shalloc->GetAsObject<const FieldTrial::FieldTrialEntry>(
-            ref, kFieldTrialType);
-
+  const FieldTrial::FieldTrialEntry* entry;
+  while ((entry = mem_iter.GetNextOfObject<FieldTrial::FieldTrialEntry>()) !=
+         nullptr) {
     StringPiece trial_name;
     StringPiece group_name;
     if (!entry->GetTrialAndGroupName(&trial_name, &group_name))
@@ -1199,7 +1184,7 @@
     FieldTrial* trial =
         CreateFieldTrial(trial_name.as_string(), group_name.as_string());
 
-    trial->ref_ = ref;
+    trial->ref_ = mem_iter.GetAsReference(entry);
     if (subtle::NoBarrier_Load(&entry->activated)) {
       // Call |group()| to mark the trial as "used" and notify observers, if
       // any. This is useful to ensure that field trials created in child
@@ -1286,15 +1271,15 @@
   }
 
   size_t total_size = sizeof(FieldTrial::FieldTrialEntry) + pickle.size();
-  FieldTrial::FieldTrialRef ref =
-      allocator->Allocate(total_size, kFieldTrialType);
+  FieldTrial::FieldTrialRef ref = allocator->Allocate(
+      total_size, FieldTrial::FieldTrialEntry::kPersistentTypeId);
   if (ref == FieldTrialAllocator::kReferenceNull) {
     NOTREACHED();
     return;
   }
 
   FieldTrial::FieldTrialEntry* entry =
-      allocator->GetAsObject<FieldTrial::FieldTrialEntry>(ref, kFieldTrialType);
+      allocator->GetAsObject<FieldTrial::FieldTrialEntry>(ref);
   subtle::NoBarrier_Store(&entry->activated, trial_state.activated);
   entry->pickle_size = pickle.size();
 
@@ -1328,8 +1313,7 @@
     // the only thing that happens on a stale read here is a slight performance
     // hit from the child re-synchronizing activation state.
     FieldTrial::FieldTrialEntry* entry =
-        allocator->GetAsObject<FieldTrial::FieldTrialEntry>(ref,
-                                                            kFieldTrialType);
+        allocator->GetAsObject<FieldTrial::FieldTrialEntry>(ref);
     subtle::NoBarrier_Store(&entry->activated, 1);
   }
 }

diff --git a/base/metrics/field_trial.h b/base/metrics/field_trial.h
index 5ea09484..5c5240c4 100644
--- a/base/metrics/field_trial.h
+++ b/base/metrics/field_trial.h

@@ -137,9 +137,11 @@
 
   // We create one FieldTrialEntry per field trial in shared memory, via
   // AddToAllocatorWhileLocked. The FieldTrialEntry is followed by a
-  // base::Pickle object that we unpickle and read from. Any changes to this
-  // structure requires a bump in kFieldTrialType id defined in the .cc file.
+  // base::Pickle object that we unpickle and read from.
   struct BASE_EXPORT FieldTrialEntry {
+    // SHA1(FieldTrialEntry): Increment this if structure changes!
+    static constexpr uint32_t kPersistentTypeId = 0xABA17E13 + 2;
+
     // Expected size for 32/64-bit check.
     static constexpr size_t kExpectedInstanceSize = 8;
 

diff --git a/base/metrics/persistent_histogram_allocator.cc b/base/metrics/persistent_histogram_allocator.cc
index 62d4e5a..6cf22de5 100644
--- a/base/metrics/persistent_histogram_allocator.cc
+++ b/base/metrics/persistent_histogram_allocator.cc

@@ -35,11 +35,8 @@
 // so that, if the structure of that object changes, stored older versions
 // will be safely ignored.
 enum : uint32_t {
-  kTypeIdHistogram = 0xF1645910 + 3,    // SHA1(Histogram)   v3
   kTypeIdRangesArray = 0xBCEA225A + 1,  // SHA1(RangesArray) v1
   kTypeIdCountsArray = 0x53215530 + 1,  // SHA1(CountsArray) v1
-
-  kTypeIdHistogramUnderConstruction = ~kTypeIdHistogram,
 };
 
 // The current globally-active persistent allocator for all new histograms.
@@ -226,6 +223,9 @@
 // This data will be held in persistent memory in order for processes to
 // locate and use histograms created elsewhere.
 struct PersistentHistogramAllocator::PersistentHistogramData {
+  // SHA1(Histogram): Increment this if structure changes!
+  static constexpr uint32_t kPersistentTypeId = 0xF1645910 + 3;
+
   // Expected size for 32/64-bit check.
   static constexpr size_t kExpectedInstanceSize =
       40 + 2 * HistogramSamples::Metadata::kExpectedInstanceSize;
@@ -254,7 +254,7 @@
 std::unique_ptr<HistogramBase>
 PersistentHistogramAllocator::Iterator::GetNextWithIgnore(Reference ignore) {
   PersistentMemoryAllocator::Reference ref;
-  while ((ref = memory_iter_.GetNextOfType(kTypeIdHistogram)) != 0) {
+  while ((ref = memory_iter_.GetNextOfType<PersistentHistogramData>()) != 0) {
     if (ref != ignore)
       return allocator_->GetHistogram(ref);
   }
@@ -277,8 +277,7 @@
   // add it to the local list of known histograms (while these may be simple
   // references to histograms in other processes).
   PersistentHistogramData* histogram_data =
-      memory_allocator_->GetAsObject<PersistentHistogramData>(
-          ref, kTypeIdHistogram);
+      memory_allocator_->GetAsObject<PersistentHistogramData>(ref);
   size_t length = memory_allocator_->GetAllocSize(ref);
 
   // Check that metadata is reasonable: name is NUL terminated and non-empty,
@@ -319,13 +318,9 @@
   // during the datafill doesn't leave a bad record around that could cause
   // confusion by another process trying to read it. It will be corrected
   // once histogram construction is complete.
-  PersistentMemoryAllocator::Reference histogram_ref =
-      memory_allocator_->Allocate(
-          offsetof(PersistentHistogramData, name) + name.length() + 1,
-          kTypeIdHistogramUnderConstruction);
   PersistentHistogramData* histogram_data =
-      memory_allocator_->GetAsObject<PersistentHistogramData>(
-          histogram_ref, kTypeIdHistogramUnderConstruction);
+      memory_allocator_->AllocateObject<PersistentHistogramData>(
+          offsetof(PersistentHistogramData, name) + name.length() + 1);
   if (histogram_data) {
     memcpy(histogram_data->name, name.c_str(), name.size() + 1);
     histogram_data->histogram_type = histogram_type;
@@ -384,9 +379,9 @@
     DCHECK(histogram);
     DCHECK_NE(0U, histogram_data->samples_metadata.id);
     DCHECK_NE(0U, histogram_data->logged_metadata.id);
-    memory_allocator_->ChangeType(histogram_ref, kTypeIdHistogram,
-                                  kTypeIdHistogramUnderConstruction);
 
+    PersistentMemoryAllocator::Reference histogram_ref =
+        memory_allocator_->GetAsReference(histogram_data);
     if (ref_ptr != nullptr)
       *ref_ptr = histogram_ref;
 
@@ -415,15 +410,19 @@
 
 void PersistentHistogramAllocator::FinalizeHistogram(Reference ref,
                                                      bool registered) {
-  // If the created persistent histogram was registered then it needs to
-  // be marked as "iterable" in order to be found by other processes.
-  if (registered)
+  if (registered) {
+    // If the created persistent histogram was registered then it needs to
+    // be marked as "iterable" in order to be found by other processes. This
+    // happens only after the histogram is fully formed so it's impossible for
+    // code iterating through the allocator to read a partially created record.
     memory_allocator_->MakeIterable(ref);
-  // If it wasn't registered then a race condition must have caused
-  // two to be created. The allocator does not support releasing the
-  // acquired memory so just change the type to be empty.
-  else
-    memory_allocator_->ChangeType(ref, 0, kTypeIdHistogram);
+  } else {
+    // If it wasn't registered then a race condition must have caused two to
+    // be created. The allocator does not support releasing the acquired memory
+    // so just change the type to be empty.
+    memory_allocator_->ChangeType(ref, 0,
+                                  PersistentHistogramData::kPersistentTypeId);
+  }
 }
 
 void PersistentHistogramAllocator::MergeHistogramDeltaToStatisticsRecorder(
@@ -842,13 +841,9 @@
   // Recorder forget about the histograms contained therein; otherwise,
   // some operations will try to access them and the released memory.
   PersistentMemoryAllocator::Iterator iter(memory_allocator);
-  PersistentMemoryAllocator::Reference ref;
-  while ((ref = iter.GetNextOfType(kTypeIdHistogram)) != 0) {
-    PersistentHistogramData* histogram_data =
-        memory_allocator->GetAsObject<PersistentHistogramData>(
-            ref, kTypeIdHistogram);
-    DCHECK(histogram_data);
-    StatisticsRecorder::ForgetHistogramForTesting(histogram_data->name);
+  const PersistentHistogramData* data;
+  while ((data = iter.GetNextOfObject<PersistentHistogramData>()) != nullptr) {
+    StatisticsRecorder::ForgetHistogramForTesting(data->name);
 
     // If a test breaks here then a memory region containing a histogram
     // actively used by this code is being released back to the test.
@@ -857,7 +852,7 @@
     // the method GetCreateHistogramResultHistogram() *before* setting
     // the (temporary) memory allocator via SetGlobalAllocator() so that
     // histogram is instead allocated from the process heap.
-    DCHECK_NE(kResultHistogram, histogram_data->name);
+    DCHECK_NE(kResultHistogram, data->name);
   }
 
   g_allocator = nullptr;

diff --git a/base/metrics/persistent_histogram_allocator.h b/base/metrics/persistent_histogram_allocator.h
index 4c36e35..2eb28dfa 100644
--- a/base/metrics/persistent_histogram_allocator.h
+++ b/base/metrics/persistent_histogram_allocator.h

@@ -56,8 +56,8 @@
   // Convenience method that gets the object for a given reference so callers
   // don't have to also keep their own pointer to the appropriate allocator.
   template <typename T>
-  T* GetAsObject(PersistentMemoryAllocator::Reference ref, uint32_t type_id) {
-    return allocator_->GetAsObject<T>(ref, type_id);
+  T* GetAsObject(PersistentMemoryAllocator::Reference ref) {
+    return allocator_->GetAsObject<T>(ref);
   }
 
  private:
@@ -131,8 +131,8 @@
   // cleanliness of the interface), a template is defined that will be
   // resolved when used inside that file.
   template <typename T>
-  T* GetAsObject(PersistentMemoryAllocator::Reference ref, uint32_t type_id) {
-    return data_manager_->GetAsObject<T>(ref, type_id);
+  T* GetAsObject(PersistentMemoryAllocator::Reference ref) {
+    return data_manager_->GetAsObject<T>(ref);
   }
 
  private:

diff --git a/base/metrics/persistent_memory_allocator.cc b/base/metrics/persistent_memory_allocator.cc
index 03c674c..eecd19a 100644
--- a/base/metrics/persistent_memory_allocator.cc
+++ b/base/metrics/persistent_memory_allocator.cc

@@ -750,10 +750,10 @@
                                     uint32_t size, bool queue_ok,
                                     bool free_ok) const {
   // Validation of parameters.
-  if (ref % kAllocAlignment != 0)
-    return nullptr;
   if (ref < (queue_ok ? kReferenceQueue : sizeof(SharedMetadata)))
     return nullptr;
+  if (ref % kAllocAlignment != 0)
+    return nullptr;
   size += sizeof(BlockHeader);
   if (ref + size > mem_size_)
     return nullptr;

diff --git a/base/metrics/persistent_memory_allocator.h b/base/metrics/persistent_memory_allocator.h
index ab9dd9d..fd66da235 100644
--- a/base/metrics/persistent_memory_allocator.h
+++ b/base/metrics/persistent_memory_allocator.h

@@ -49,14 +49,50 @@
 // use virtual memory, including memory-mapped files, as backing storage with
 // the OS "pinning" new (zeroed) physical RAM pages only as they are needed.
 //
-// All persistent memory segments can be freely accessed by builds of different
-// natural word widths (i.e. 32/64-bit) but users of this module must manually
-// ensure that the data recorded within are similarly safe. The GetAsObject<>()
-// methods use the kExpectedInstanceSize attribute of the structs to check this.
+// OBJECTS: Although the allocator can be used in a "malloc" sense, fetching
+// character arrays and manipulating that memory manually, the better way is
+// generally to use the "Object" methods to create and manage allocations. In
+// this way the sizing, type-checking, and construction are all automatic. For
+// this to work, however, every type of stored object must define two public
+// "constexpr" values, kPersistentTypeId and kExpectedInstanceSize, as such:
 //
-// Memory segments can NOT, however, be exchanged between CPUs of different
-// endianess. Attempts to do so will simply see the existing data as corrupt
-// and refuse to access any of it.
+// struct MyPersistentObjectType {
+//     // SHA1(MyPersistentObjectType): Increment this if structure changes!
+//     static constexpr uint32_t kPersistentTypeId = 0x3E15F6DE + 1;
+//
+//     // Expected size for 32/64-bit check. Update this if structure changes!
+//     static constexpr size_t kExpectedInstanceSize = 20;
+//
+//     ...
+// };
+//
+// kPersistentTypeId: This value is an arbitrary identifier that allows the
+//   identification of these objects in the allocator, including the ability
+//   to find them via iteration. The number is arbitrary but using the first
+//   four bytes of the SHA1 hash of the type name means that there shouldn't
+//   be any conflicts with other types that may also be stored in the memory.
+//   The fully qualified name (e.g. base::debug::MyPersistentObjectType) could
+//   be used to generate the hash if the type name seems common. Use a command
+//   like this to get the hash: echo -n "MyPersistentObjectType" | sha1sum
+//   If the structure layout changes, ALWAYS increment this number so that
+//   newer versions of the code don't try to interpret persistent data written
+//   by older versions with a different layout.
+//
+// kExpectedInstanceSize: This value is the hard-coded number that matches
+//   what sizeof(T) would return. By providing it explicitly, the allocator can
+//   verify that the structure is compatible between both 32-bit and 64-bit
+//   versions of the code.
+//
+// Using AllocateObject (and ChangeObject) will zero the memory and then call
+// the default constructor for the object. Given that objects are persistent,
+// no destructor is ever called automatically though a caller can explicitly
+// call DeleteObject to destruct it and change the type to something indicating
+// it is no longer in use.
+//
+// Though persistent memory segments are transferrable between programs built
+// for different natural word widths, they CANNOT be exchanged between CPUs
+// of different endianess. Attempts to do so will simply see the existing data
+// as corrupt and refuse to access any of it.
 class BASE_EXPORT PersistentMemoryAllocator {
  public:
   typedef uint32_t Reference;
@@ -114,6 +150,18 @@
     // calls to GetNext() meaning it's possible to completely miss entries.
     Reference GetNextOfType(uint32_t type_match);
 
+    // As above but works using object type.
+    template <typename T>
+    Reference GetNextOfType() {
+      return GetNextOfType(T::kPersistentTypeId);
+    }
+
+    // As above but works using objects and returns null if not found.
+    template <typename T>
+    const T* GetNextOfObject() {
+      return GetAsObject<T>(GetNextOfType<T>());
+    }
+
     // Converts references to objects. This is a convenience method so that
     // users of the iterator don't need to also have their own pointer to the
     // allocator over which the iterator runs in order to retrieve objects.
@@ -122,16 +170,29 @@
     // non-const (external) pointer to the same allocator (or use const_cast
     // to remove the qualifier).
     template <typename T>
-    const T* GetAsObject(Reference ref, uint32_t type_id) const {
-      return allocator_->GetAsObject<T>(ref, type_id);
+    const T* GetAsObject(Reference ref) const {
+      return allocator_->GetAsObject<T>(ref);
     }
 
-    // Similar to GetAsObject() but converts references to arrays of objects.
+    // Similar to GetAsObject() but converts references to arrays of things.
     template <typename T>
     const T* GetAsArray(Reference ref, uint32_t type_id, size_t count) const {
       return allocator_->GetAsArray<T>(ref, type_id, count);
     }
 
+    // Convert a generic pointer back into a reference. A null reference will
+    // be returned if |memory| is not inside the persistent segment or does not
+    // point to an object of the specified |type_id|.
+    Reference GetAsReference(const void* memory, uint32_t type_id) const {
+      return allocator_->GetAsReference(memory, type_id);
+    }
+
+    // As above but convert an object back into a reference.
+    template <typename T>
+    Reference GetAsReference(const T* obj) const {
+      return allocator_->GetAsReference(obj);
+    }
+
    private:
     // Weak-pointer to memory allocator being iterated over.
     const PersistentMemoryAllocator* allocator_;
@@ -152,11 +213,12 @@
   };
 
   enum : Reference {
-    kReferenceNull = 0  // A common "null" reference value.
-  };
+    // A common "null" reference value.
+    kReferenceNull = 0,
 
-  enum : uint32_t {
-    kTypeIdAny = 0  // Match any type-id inside GetAsObject().
+    // A value indicating that the type is in transition. Work is being done
+    // on the contents to prepare it for a new type to come.
+    kReferenceTransitioning = 0xFFFFFFFF,
   };
 
   enum : size_t {
@@ -277,19 +339,20 @@
   // nature of that keyword to the caller. It can add it back, if necessary,
   // based on knowledge of how the allocator is being used.
   template <typename T>
-  T* GetAsObject(Reference ref, uint32_t type_id) {
-    static_assert(std::is_pod<T>::value, "only simple objects");
+  T* GetAsObject(Reference ref) {
+    static_assert(std::is_standard_layout<T>::value, "only standard objects");
+    static_assert(!std::is_array<T>::value, "use GetAsArray<>()");
     static_assert(T::kExpectedInstanceSize == sizeof(T), "inconsistent size");
-    return const_cast<T*>(
-        reinterpret_cast<volatile T*>(GetBlockData(ref, type_id, sizeof(T))));
+    return const_cast<T*>(reinterpret_cast<volatile T*>(
+        GetBlockData(ref, T::kPersistentTypeId, sizeof(T))));
   }
   template <typename T>
-  const T* GetAsObject(Reference ref, uint32_t type_id) const {
-    static_assert(std::is_pod<T>::value, "only simple objects");
+  const T* GetAsObject(Reference ref) const {
+    static_assert(std::is_standard_layout<T>::value, "only standard objects");
+    static_assert(!std::is_array<T>::value, "use GetAsArray<>()");
     static_assert(T::kExpectedInstanceSize == sizeof(T), "inconsistent size");
-    return const_cast<const T*>(
-        reinterpret_cast<const volatile T*>(GetBlockData(
-            ref, type_id, sizeof(T))));
+    return const_cast<const T*>(reinterpret_cast<const volatile T*>(
+        GetBlockData(ref, T::kPersistentTypeId, sizeof(T))));
   }
 
   // Like GetAsObject but get an array of simple, fixed-size types.
@@ -321,6 +384,12 @@
   // result will be returned.
   Reference GetAsReference(const void* memory, uint32_t type_id) const;
 
+  // As above but works with objects allocated from persistent memory.
+  template <typename T>
+  Reference GetAsReference(const T* obj) const {
+    return GetAsReference(obj, T::kPersistentTypeId);
+  }
+
   // Get the number of bytes allocated to a block. This is useful when storing
   // arrays in order to validate the ending boundary. The returned value will
   // include any padding added to achieve the required alignment and so could
@@ -332,15 +401,105 @@
   // even though the memory stays valid and allocated. Changing the type is
   // an atomic compare/exchange and so requires knowing the existing value.
   // It will return false if the existing type is not what is expected.
+  // Changing the type doesn't mean the data is compatible with the new type.
+  // It will likely be necessary to clear or reconstruct the type before it
+  // can be used. Changing the type WILL NOT invalidate existing pointers to
+  // the data, either in this process or others, so changing the data structure
+  // could have unpredicatable results. USE WITH CARE!
   uint32_t GetType(Reference ref) const;
   bool ChangeType(Reference ref, uint32_t to_type_id, uint32_t from_type_id);
 
+  // Like ChangeType() but gets the "to" type from the object type, clears
+  // the memory, and constructs a new object of the desired type just as
+  // though it was fresh from AllocateObject<>(). The old type simply ceases
+  // to exist; no destructor is called for it. Calling this will not invalidate
+  // existing pointers to the object, either in this process or others, so
+  // changing the object could have unpredictable results. USE WITH CARE!
+  template <typename T>
+  T* ChangeObject(Reference ref, uint32_t from_type_id) {
+    DCHECK_LE(sizeof(T), GetAllocSize(ref)) << "alloc not big enough for obj";
+    // Make sure the memory is appropriate. This won't be used until after
+    // the type is changed but checking first avoids the possibility of having
+    // to change the type back.
+    void* mem = const_cast<void*>(GetBlockData(ref, 0, sizeof(T)));
+    if (!mem)
+      return nullptr;
+    // Ensure the allocator's internal alignment is sufficient for this object.
+    // This protects against coding errors in the allocator.
+    DCHECK_EQ(0U, reinterpret_cast<uintptr_t>(mem) & (ALIGNOF(T) - 1));
+    // First change the type to "transitioning" so that there is no race
+    // condition with the clearing and construction of the object should
+    // another thread be simultaneously iterating over data. This will
+    // "acquire" the memory so no changes get reordered before it.
+    if (!ChangeType(ref, kReferenceTransitioning, from_type_id))
+      return nullptr;
+    // Clear the memory so that the property of all memory being zero after an
+    // allocation also applies here.
+    memset(mem, 0, GetAllocSize(ref));
+    // Construct an object of the desired type on this memory, just as if
+    // AllocateObject had been called to create it.
+    T* obj = new (mem) T();
+    // Finally change the type to the desired one. This will "release" all of
+    // the changes above and so provide a consistent view to other threads.
+    bool success =
+        ChangeType(ref, T::kPersistentTypeId, kReferenceTransitioning);
+    DCHECK(success);
+    return obj;
+  }
+
   // Reserve space in the memory segment of the desired |size| and |type_id|.
   // A return value of zero indicates the allocation failed, otherwise the
   // returned reference can be used by any process to get a real pointer via
   // the GetAsObject() call.
   Reference Allocate(size_t size, uint32_t type_id);
 
+  // Allocate and construct an object in persistent memory. The type must have
+  // both (size_t) kExpectedInstanceSize and (uint32_t) kPersistentTypeId
+  // static constexpr fields that are used to ensure compatibility between
+  // software versions. An optional size parameter can be specified to force
+  // the allocation to be bigger than the size of the object; this is useful
+  // when the last field is actually variable length.
+  template <typename T>
+  T* AllocateObject(size_t size) {
+    if (size < sizeof(T))
+      size = sizeof(T);
+    Reference ref = Allocate(size, T::kPersistentTypeId);
+    void* mem =
+        const_cast<void*>(GetBlockData(ref, T::kPersistentTypeId, size));
+    if (!mem)
+      return nullptr;
+    DCHECK_EQ(0U, reinterpret_cast<uintptr_t>(mem) & (ALIGNOF(T) - 1));
+    return new (mem) T();
+  }
+  template <typename T>
+  T* AllocateObject() {
+    return AllocateObject<T>(sizeof(T));
+  }
+
+  // Deletes an object by destructing it and then changing the type to a
+  // different value (default 0).
+  template <typename T>
+  void DeleteObject(T* obj, uint32_t new_type) {
+    // Get the reference for the object.
+    Reference ref = GetAsReference<T>(obj);
+    // First change the type to "transitioning" so there is no race condition
+    // where another thread could find the object through iteration while it
+    // is been destructed. This will "acquire" the memory so no changes get
+    // reordered before it. It will fail if |ref| is invalid.
+    if (!ChangeType(ref, kReferenceTransitioning, T::kPersistentTypeId))
+      return;
+    // Destruct the object.
+    obj->~T();
+    // Finally change the type to the desired value. This will "release" all
+    // the changes above.
+    bool success = ChangeType(ref, new_type, kReferenceTransitioning);
+    DCHECK(success);
+  }
+  template <typename T>
+  void DeleteObject(T* obj) {
+    DeleteObject<T>(obj, 0);
+  }
+
   // Allocated objects can be added to an internal list that can then be
   // iterated over by other processes. If an allocated object can be found
   // another way, such as by having its reference within a different object
@@ -348,8 +507,15 @@
   // succeeds unless corruption is detected; check IsCorrupted() to find out.
   // Once an object is made iterable, its position in iteration can never
   // change; new iterable objects will always be added after it in the series.
+  // Changing the type does not alter its "iterable" status.
   void MakeIterable(Reference ref);
 
+  // As above but works with an object allocated from persistent memory.
+  template <typename T>
+  void MakeIterable(const T* obj) {
+    MakeIterable(GetAsReference<T>(obj));
+  }
+
   // Get the information about the amount of free space in the allocator. The
   // amount of free space should be treated as approximate due to extras from
   // alignment and metadata. Concurrent allocations from other threads will

diff --git a/base/metrics/persistent_memory_allocator_unittest.cc b/base/metrics/persistent_memory_allocator_unittest.cc
index 85a058f..57e8e31 100644
--- a/base/metrics/persistent_memory_allocator_unittest.cc
+++ b/base/metrics/persistent_memory_allocator_unittest.cc

@@ -40,12 +40,14 @@
   uint32_t kAllocAlignment;
 
   struct TestObject1 {
+    static constexpr uint32_t kPersistentTypeId = 1;
     static constexpr size_t kExpectedInstanceSize = 4 + 1 + 3;
     int32_t onething;
     char oranother;
   };
 
   struct TestObject2 {
+    static constexpr uint32_t kPersistentTypeId = 2;
     static constexpr size_t kExpectedInstanceSize = 8 + 4 + 4 + 8 + 8;
     int64_t thiis;
     int32_t that;
@@ -109,10 +111,12 @@
 
   // Validate allocation of test object and make sure it can be referenced
   // and all metadata looks correct.
-  Reference block1 = allocator_->Allocate(sizeof(TestObject1), 1);
-  EXPECT_NE(0U, block1);
-  EXPECT_NE(nullptr, allocator_->GetAsObject<TestObject1>(block1, 1));
-  EXPECT_EQ(nullptr, allocator_->GetAsObject<TestObject2>(block1, 1));
+  TestObject1* obj1 = allocator_->AllocateObject<TestObject1>();
+  ASSERT_TRUE(obj1);
+  Reference block1 = allocator_->GetAsReference(obj1);
+  ASSERT_NE(0U, block1);
+  EXPECT_NE(nullptr, allocator_->GetAsObject<TestObject1>(block1));
+  EXPECT_EQ(nullptr, allocator_->GetAsObject<TestObject2>(block1));
   EXPECT_LE(sizeof(TestObject1), allocator_->GetAllocSize(block1));
   EXPECT_GT(sizeof(TestObject1) + kAllocAlignment,
             allocator_->GetAllocSize(block1));
@@ -147,10 +151,12 @@
 
   // Create second test-object and ensure everything is good and it cannot
   // be confused with test-object of another type.
-  Reference block2 = allocator_->Allocate(sizeof(TestObject2), 2);
-  EXPECT_NE(0U, block2);
-  EXPECT_NE(nullptr, allocator_->GetAsObject<TestObject2>(block2, 2));
-  EXPECT_EQ(nullptr, allocator_->GetAsObject<TestObject2>(block2, 1));
+  TestObject2* obj2 = allocator_->AllocateObject<TestObject2>();
+  ASSERT_TRUE(obj2);
+  Reference block2 = allocator_->GetAsReference(obj2);
+  ASSERT_NE(0U, block2);
+  EXPECT_NE(nullptr, allocator_->GetAsObject<TestObject2>(block2));
+  EXPECT_EQ(nullptr, allocator_->GetAsObject<TestObject1>(block2));
   EXPECT_LE(sizeof(TestObject2), allocator_->GetAllocSize(block2));
   EXPECT_GT(sizeof(TestObject2) + kAllocAlignment,
             allocator_->GetAllocSize(block2));
@@ -160,7 +166,7 @@
   EXPECT_GT(meminfo1.free, meminfo2.free);
 
   // Ensure that second test-object can also be made iterable.
-  allocator_->MakeIterable(block2);
+  allocator_->MakeIterable(obj2);
   EXPECT_EQ(block2, iter1a.GetNext(&type));
   EXPECT_EQ(2U, type);
   EXPECT_EQ(block2, iter1a.GetLast());
@@ -214,11 +220,11 @@
   EXPECT_EQ(1, allocs_samples->GetCount(0));
 #endif
 
-  // Check that an objcet's type can be changed.
+  // Check that an object's type can be changed.
   EXPECT_EQ(2U, allocator_->GetType(block2));
   allocator_->ChangeType(block2, 3, 2);
   EXPECT_EQ(3U, allocator_->GetType(block2));
-  allocator_->ChangeType(block2, 2, 3);
+  allocator_->ChangeObject<TestObject2>(block2, 3);
   EXPECT_EQ(2U, allocator_->GetType(block2));
 
   // Create second allocator (read/write) using the same memory segment.
@@ -235,8 +241,8 @@
   EXPECT_EQ(block1, iter2.GetNext(&type));
   EXPECT_EQ(block2, iter2.GetNext(&type));
   EXPECT_EQ(0U, iter2.GetNext(&type));
-  EXPECT_NE(nullptr, allocator2->GetAsObject<TestObject1>(block1, 1));
-  EXPECT_NE(nullptr, allocator2->GetAsObject<TestObject2>(block2, 2));
+  EXPECT_NE(nullptr, allocator2->GetAsObject<TestObject1>(block1));
+  EXPECT_NE(nullptr, allocator2->GetAsObject<TestObject2>(block2));
 
   // Create a third allocator (read-only) using the same memory segment.
   std::unique_ptr<const PersistentMemoryAllocator> allocator3(
@@ -251,13 +257,23 @@
   EXPECT_EQ(block1, iter3.GetNext(&type));
   EXPECT_EQ(block2, iter3.GetNext(&type));
   EXPECT_EQ(0U, iter3.GetNext(&type));
-  EXPECT_NE(nullptr, allocator3->GetAsObject<TestObject1>(block1, 1));
-  EXPECT_NE(nullptr, allocator3->GetAsObject<TestObject2>(block2, 2));
+  EXPECT_NE(nullptr, allocator3->GetAsObject<TestObject1>(block1));
+  EXPECT_NE(nullptr, allocator3->GetAsObject<TestObject2>(block2));
 
   // Ensure that GetNextOfType works.
   PersistentMemoryAllocator::Iterator iter1c(allocator_.get());
-  EXPECT_EQ(block2, iter1c.GetNextOfType(2));
+  EXPECT_EQ(block2, iter1c.GetNextOfType<TestObject2>());
   EXPECT_EQ(0U, iter1c.GetNextOfType(2));
+
+  // Ensure that GetNextOfObject works.
+  PersistentMemoryAllocator::Iterator iter1d(allocator_.get());
+  EXPECT_EQ(obj2, iter1d.GetNextOfObject<TestObject2>());
+  EXPECT_EQ(nullptr, iter1d.GetNextOfObject<TestObject2>());
+
+  // Ensure that deleting an object works.
+  allocator_->DeleteObject(obj2);
+  PersistentMemoryAllocator::Iterator iter1z(allocator_.get());
+  EXPECT_EQ(nullptr, iter1z.GetNextOfObject<TestObject2>());
 }
 
 TEST_F(PersistentMemoryAllocatorTest, PageTest) {

diff --git a/base/metrics/persistent_sample_map.cc b/base/metrics/persistent_sample_map.cc
index e6a0879..1cc4254 100644
--- a/base/metrics/persistent_sample_map.cc
+++ b/base/metrics/persistent_sample_map.cc

@@ -82,6 +82,9 @@
 // memory allocator. The "id" must be unique across all maps held by an
 // allocator or they will get attached to the wrong sample map.
 struct SampleRecord {
+  // SHA1(SampleRecord): Increment this if structure changes!
+  static constexpr uint32_t kPersistentTypeId = 0x8FE6A69F + 1;
+
   // Expected size for 32/64-bit check.
   static constexpr size_t kExpectedInstanceSize = 16;
 
@@ -90,9 +93,6 @@
   Count count;   // The count associated with the above value.
 };
 
-// The type-id used to identify sample records inside an allocator.
-const uint32_t kTypeIdSampleRecord = 0x8FE6A69F + 1;  // SHA1(SampleRecord) v1
-
 }  // namespace
 
 PersistentSampleMap::PersistentSampleMap(
@@ -144,15 +144,12 @@
 PersistentSampleMap::GetNextPersistentRecord(
     PersistentMemoryAllocator::Iterator& iterator,
     uint64_t* sample_map_id) {
-  PersistentMemoryAllocator::Reference ref =
-      iterator.GetNextOfType(kTypeIdSampleRecord);
-  const SampleRecord* record =
-      iterator.GetAsObject<SampleRecord>(ref, kTypeIdSampleRecord);
+  const SampleRecord* record = iterator.GetNextOfObject<SampleRecord>();
   if (!record)
     return 0;
 
   *sample_map_id = record->id;
-  return ref;
+  return iterator.GetAsReference(record);
 }
 
 // static
@@ -161,11 +158,7 @@
     PersistentMemoryAllocator* allocator,
     uint64_t sample_map_id,
     Sample value) {
-  PersistentMemoryAllocator::Reference ref =
-      allocator->Allocate(sizeof(SampleRecord), kTypeIdSampleRecord);
-  SampleRecord* record =
-      allocator->GetAsObject<SampleRecord>(ref, kTypeIdSampleRecord);
-
+  SampleRecord* record = allocator->AllocateObject<SampleRecord>();
   if (!record) {
     NOTREACHED() << "full=" << allocator->IsFull()
                  << ", corrupt=" << allocator->IsCorrupt();
@@ -175,6 +168,8 @@
   record->id = sample_map_id;
   record->value = value;
   record->count = 0;
+
+  PersistentMemoryAllocator::Reference ref = allocator->GetAsReference(record);
   allocator->MakeIterable(ref);
   return ref;
 }
@@ -256,8 +251,7 @@
   PersistentMemoryAllocator::Reference ref;
   PersistentSampleMapRecords* records = GetRecords();
   while ((ref = records->GetNext()) != 0) {
-    SampleRecord* record =
-        records->GetAsObject<SampleRecord>(ref, kTypeIdSampleRecord);
+    SampleRecord* record = records->GetAsObject<SampleRecord>(ref);
     if (!record)
       continue;
 

diff --git a/base/scoped_generic.h b/base/scoped_generic.h
index 84de6b7d..c2d51cfd 100644
--- a/base/scoped_generic.h
+++ b/base/scoped_generic.h

@@ -14,7 +14,7 @@
 
 namespace base {
 
-// This class acts like ScopedPtr with a custom deleter (although is slightly
+// This class acts like unique_ptr with a custom deleter (although is slightly
 // less fancy in some of the more escoteric respects) except that it keeps a
 // copy of the object rather than a pointer, and we require that the contained
 // object has some kind of "invalid" value.
@@ -22,12 +22,12 @@
 // Defining a scoper based on this class allows you to get a scoper for
 // non-pointer types without having to write custom code for set, reset, and
 // move, etc. and get almost identical semantics that people are used to from
-// scoped_ptr.
+// unique_ptr.
 //
 // It is intended that you will typedef this class with an appropriate deleter
 // to implement clean up tasks for objects that act like pointers from a
 // resource management standpoint but aren't, such as file descriptors and
-// various types of operating system handles. Using scoped_ptr for these
+// various types of operating system handles. Using unique_ptr for these
 // things requires that you keep a pointer to the handle valid for the lifetime
 // of the scoper (which is easy to mess up).
 //
@@ -97,7 +97,7 @@
   }
 
   // Frees the currently owned object, if any. Then takes ownership of a new
-  // object, if given. Self-resets are not allowd as on scoped_ptr. See
+  // object, if given. Self-resets are not allowd as on unique_ptr. See
   // http://crbug.com/162971
   void reset(const element_type& value = traits_type::InvalidValue()) {
     if (data_.generic != traits_type::InvalidValue() && data_.generic == value)

diff --git a/base/task_scheduler/sequence_unittest.cc b/base/task_scheduler/sequence_unittest.cc
index ba020cb..c45d8a8 100644
--- a/base/task_scheduler/sequence_unittest.cc
+++ b/base/task_scheduler/sequence_unittest.cc

@@ -62,7 +62,7 @@
   std::unique_ptr<Task> task_e_owned_;
 
   // Raw pointers to those same tasks for verification. This is needed because
-  // the scoped_ptrs above no longer point to the tasks once they have been
+  // the unique_ptrs above no longer point to the tasks once they have been
   // moved into a Sequence.
   const Task* task_a_;
   const Task* task_b_;

diff --git a/base/win/scoped_bstr.h b/base/win/scoped_bstr.h
index 413fb286..2109c20 100644
--- a/base/win/scoped_bstr.h
+++ b/base/win/scoped_bstr.h

@@ -18,7 +18,7 @@
 namespace win {
 
 // Manages a BSTR string pointer.
-// The class interface is based on scoped_ptr.
+// The class interface is based on unique_ptr.
 class BASE_EXPORT ScopedBstr {
  public:
   ScopedBstr() : bstr_(NULL) {

diff --git a/base/win/scoped_comptr.h b/base/win/scoped_comptr.h
index 5ce60e2..9442672 100644
--- a/base/win/scoped_comptr.h
+++ b/base/win/scoped_comptr.h

@@ -51,7 +51,7 @@
   // Explicit Release() of the held object.  Useful for reuse of the
   // ScopedComPtr instance.
   // Note that this function equates to IUnknown::Release and should not
-  // be confused with e.g. scoped_ptr::release().
+  // be confused with e.g. unique_ptr::release().
   void Release() {
     if (this->ptr_ != NULL) {
       this->ptr_->Release();

diff --git a/chrome/android/java/src/org/chromium/chrome/browser/ntp/ContextMenuManager.java b/chrome/android/java/src/org/chromium/chrome/browser/ntp/ContextMenuManager.java
index 8a290a9..fa83ec0 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/ntp/ContextMenuManager.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/ntp/ContextMenuManager.java

@@ -55,11 +55,17 @@
         /** Remove the current item. */
         void removeItem();
 
-        /** @return whether the current item can be saved offline. */
+        /**
+         * @return the URL of the current item for saving offline, or null if the item can't be
+         *         saved offline.
+         */
         String getUrl();
 
         /** @return whether the given menu item is supported. */
         boolean isItemSupported(@ContextMenuItemId int menuItemId);
+
+        /** Called when a context menu has been created. */
+        void onContextMenuCreated();
     }
 
     /** Interface for a view that can be set to stop responding to touches. */
@@ -74,10 +80,11 @@
 
     /**
      * Populates the context menu.
+     *
      * @param menu The menu to populate.
      * @param associatedView The view that requested a context menu.
      * @param delegate Delegate that defines the configuration of the menu and what to do when items
-     *                 are tapped.
+     *            are tapped.
      */
     public void createContextMenu(ContextMenu menu, View associatedView, Delegate delegate) {
         OnMenuItemClickListener listener = new ItemClickListener(delegate);
@@ -95,6 +102,8 @@
         // No item added. We won't show the menu, so we can skip the rest.
         if (!hasItems) return;
 
+        delegate.onContextMenuCreated();
+
         associatedView.addOnAttachStateChangeListener(new View.OnAttachStateChangeListener() {
             @Override
             public void onViewAttachedToWindow(View view) {}

diff --git a/chrome/android/java/src/org/chromium/chrome/browser/ntp/MostVisitedItem.java b/chrome/android/java/src/org/chromium/chrome/browser/ntp/MostVisitedItem.java
index 301d0867..06824fb 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/ntp/MostVisitedItem.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/ntp/MostVisitedItem.java

@@ -171,6 +171,9 @@
                     public boolean isItemSupported(@ContextMenuItemId int menuItemId) {
                         return true;
                     }
+
+                    @Override
+                    public void onContextMenuCreated() {}
                 });
     }
 

diff --git a/chrome/android/java/src/org/chromium/chrome/browser/ntp/RecentTabsPage.java b/chrome/android/java/src/org/chromium/chrome/browser/ntp/RecentTabsPage.java
index 34cb521..30b2507d 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/ntp/RecentTabsPage.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/ntp/RecentTabsPage.java

@@ -165,7 +165,7 @@
 
     @Override
     public void destroy() {
-        assert getView().getParent() == null : "Destroy called before removed from window";
+        assert !mIsAttachedToWindow : "Destroy called before removed from window";
         mRecentTabsManager.destroy();
         mRecentTabsManager = null;
         mAdapter.notifyDataSetInvalidated();

diff --git a/chrome/android/java/src/org/chromium/chrome/browser/ntp/cards/ActionItem.java b/chrome/android/java/src/org/chromium/chrome/browser/ntp/cards/ActionItem.java
index b024736..a1a4e11 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/ntp/cards/ActionItem.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/ntp/cards/ActionItem.java

@@ -156,6 +156,9 @@
             return menuItemId == ContextMenuManager.ID_REMOVE && isDismissable();
         }
 
+        @Override
+        public void onContextMenuCreated() {}
+
         public void onBindViewHolder(ActionItem item) {
             super.onBindViewHolder();
             mActionListItem = item;

diff --git a/chrome/android/java/src/org/chromium/chrome/browser/ntp/cards/StatusCardViewHolder.java b/chrome/android/java/src/org/chromium/chrome/browser/ntp/cards/StatusCardViewHolder.java
index 59b9ad79..0c9dfdd 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/ntp/cards/StatusCardViewHolder.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/ntp/cards/StatusCardViewHolder.java

@@ -113,6 +113,9 @@
     }
 
     @Override
+    public void onContextMenuCreated() {}
+
+    @Override
     public boolean isDismissable() {
         return SnippetsConfig.isSectionDismissalEnabled();
     }

diff --git a/chrome/android/java/src/org/chromium/chrome/browser/ntp/snippets/SnippetArticleViewHolder.java b/chrome/android/java/src/org/chromium/chrome/browser/ntp/snippets/SnippetArticleViewHolder.java
index c57fefb..7b25f68 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/ntp/snippets/SnippetArticleViewHolder.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/ntp/snippets/SnippetArticleViewHolder.java

@@ -147,6 +147,11 @@
     }
 
     @Override
+    public void onContextMenuCreated() {
+        mNewTabPageManager.trackSnippetMenuOpened(mArticle);
+    }
+
+    @Override
     protected Delegate getContextMenuDelegate() {
         return this;
     }

diff --git a/chrome/app/chrome_crash_reporter_client.h b/chrome/app/chrome_crash_reporter_client.h
index b6f256f..2d42b87 100644
--- a/chrome/app/chrome_crash_reporter_client.h
+++ b/chrome/app/chrome_crash_reporter_client.h

@@ -35,6 +35,10 @@
 
   bool GetCrashDumpLocation(base::FilePath* crash_dir) override;
 
+#if defined(OS_MACOSX)
+  bool GetCrashMetricsLocation(base::FilePath* metrics_dir) override;
+#endif
+
   size_t RegisterCrashKeys() override;
 
   bool IsRunningUnattended() override;

diff --git a/chrome/app/chrome_crash_reporter_client_mac.mm b/chrome/app/chrome_crash_reporter_client_mac.mm
index 03cf48b..d3a227bc 100644
--- a/chrome/app/chrome_crash_reporter_client_mac.mm
+++ b/chrome/app/chrome_crash_reporter_client_mac.mm

@@ -7,7 +7,9 @@
 #include <CoreFoundation/CoreFoundation.h>
 
 #include "base/mac/scoped_cftyperef.h"
+#include "base/path_service.h"
 #include "base/strings/sys_string_conversions.h"
+#include "chrome/common/chrome_paths.h"
 #include "components/policy/policy_constants.h"
 
 #if !defined(DISABLE_NACL)
@@ -17,6 +19,11 @@
 #include "native_client/src/trusted/service_runtime/osx/crash_filter.h"
 #endif
 
+bool ChromeCrashReporterClient::GetCrashMetricsLocation(
+    base::FilePath* metrics_dir) {
+  return PathService::Get(chrome::DIR_USER_DATA, metrics_dir);
+}
+
 bool ChromeCrashReporterClient::ReportingIsEnforcedByPolicy(
     bool* breakpad_enabled) {
   base::ScopedCFTypeRef<CFStringRef> key(

diff --git a/chrome/app/chrome_crash_reporter_client_win.h b/chrome/app/chrome_crash_reporter_client_win.h
index 8dc8964..a683826 100644
--- a/chrome/app/chrome_crash_reporter_client_win.h
+++ b/chrome/app/chrome_crash_reporter_client_win.h

@@ -37,7 +37,7 @@
   int GetResultCodeRespawnFailed() override;
 
   bool GetCrashDumpLocation(base::string16* crash_dir) override;
-  bool GetCrashMetricsLocation(base::string16* crash_dir) override;
+  bool GetCrashMetricsLocation(base::string16* metrics_dir) override;
 
   size_t RegisterCrashKeys() override;
 

diff --git a/chrome/app/generated_resources.grd b/chrome/app/generated_resources.grd
index bf001b77..2b8dc61a 100644
--- a/chrome/app/generated_resources.grd
+++ b/chrome/app/generated_resources.grd

@@ -14698,12 +14698,6 @@
         Enable "Ok Google"
       </message>
 
-      <message name="IDS_FLAGS_TOUCH_HOVER_NAME" desc="Name of the 'Enable support for hover capable touchscreens' flag.">
-        Support for hover capable touchscreens
-      </message>
-      <message name="IDS_FLAGS_TOUCH_HOVER_DESCRIPTION" desc="Description of the 'Enable support for hover capable touchscreens' flag.">
-        Enables hover feature by holding your finger just over the screen to experience a mouseover event.
-      </message>
       <message name="IDS_ALLOW_INSECURE_LOCALHOST" desc="Name of the 'Allow insecure localhost' flag.">
         Allow invalid certificates for resources loaded from localhost.
       </message>

diff --git a/chrome/browser/BUILD.gn b/chrome/browser/BUILD.gn
index 8e77a11..3bca5a92 100644
--- a/chrome/browser/BUILD.gn
+++ b/chrome/browser/BUILD.gn

@@ -1004,6 +1004,8 @@
     "profiles/incognito_helpers.h",
     "profiles/incognito_mode_policy_handler.cc",
     "profiles/incognito_mode_policy_handler.h",
+    "profiles/net_http_session_params_observer.cc",
+    "profiles/net_http_session_params_observer.h",
     "profiles/off_the_record_profile_impl.cc",
     "profiles/off_the_record_profile_impl.h",
     "profiles/off_the_record_profile_io_data.cc",

diff --git a/chrome/browser/about_flags.cc b/chrome/browser/about_flags.cc
index b1a2b2c..f8001df 100644
--- a/chrome/browser/about_flags.cc
+++ b/chrome/browser/about_flags.cc

@@ -1502,9 +1502,6 @@
      IDS_FLAGS_SECCOMP_FILTER_SANDBOX_ANDROID_DESCRIPTION, kOsAndroid,
      FEATURE_VALUE_TYPE(features::kSeccompSandboxAndroid)},
 #endif  // OS_ANDROID
-    {"enable-touch-hover", IDS_FLAGS_TOUCH_HOVER_NAME,
-     IDS_FLAGS_TOUCH_HOVER_DESCRIPTION, kOsAndroid,
-     SINGLE_VALUE_TYPE("enable-touch-hover")},
 #if defined(OS_CHROMEOS)
     {"enable-wifi-credential-sync", IDS_FLAGS_WIFI_CREDENTIAL_SYNC_NAME,
      IDS_FLAGS_WIFI_CREDENTIAL_SYNC_DESCRIPTION, kOsCrOS,

diff --git a/chrome/browser/chromeos/login/saml/saml_browsertest.cc b/chrome/browser/chromeos/login/saml/saml_browsertest.cc
index 1ef4f45..9b182227 100644
--- a/chrome/browser/chromeos/login/saml/saml_browsertest.cc
+++ b/chrome/browser/chromeos/login/saml/saml_browsertest.cc

@@ -831,7 +831,6 @@
 void SAMLEnrollmentTest::SetUpCommandLine(base::CommandLine* command_line) {
   command_line->AppendSwitchASCII(policy::switches::kDeviceManagementUrl,
                                   test_server_->GetServiceURL().spec());
-  command_line->AppendSwitch(policy::switches::kDisablePolicyKeyVerification);
 
   SamlTest::SetUpCommandLine(command_line);
 }

diff --git a/chrome/browser/io_thread.cc b/chrome/browser/io_thread.cc
index 637564c..943d6cb 100644
--- a/chrome/browser/io_thread.cc
+++ b/chrome/browser/io_thread.cc

@@ -797,6 +797,16 @@
   return params_;
 }
 
+void IOThread::DisableQuic() {
+  params_.enable_quic = false;
+
+  if (globals_->system_http_network_session)
+    globals_->system_http_network_session->DisableQuic();
+
+  if (globals_->proxy_script_fetcher_http_network_session)
+    globals_->proxy_script_fetcher_http_network_session->DisableQuic();
+}
+
 base::TimeTicks IOThread::creation_time() const {
   return creation_time_;
 }

diff --git a/chrome/browser/io_thread.h b/chrome/browser/io_thread.h
index 257a127a..5bf834a 100644
--- a/chrome/browser/io_thread.h
+++ b/chrome/browser/io_thread.h

@@ -236,6 +236,12 @@
 
   const net::HttpNetworkSession::Params& NetworkSessionParams() const;
 
+  // Dynamically disables QUIC for HttpNetworkSessions owned by io_thread, and
+  // to HttpNetworkSession::Params which are used for the creation of new
+  // HttpNetworkSessions. Not that re-enabling Quic dynamically is not
+  // supported for simplicity and requires a browser restart.
+  void DisableQuic();
+
   base::TimeTicks creation_time() const;
 
   // Returns the callback for updating data use prefs.

diff --git a/chrome/browser/metrics/chrome_metrics_service_client.cc b/chrome/browser/metrics/chrome_metrics_service_client.cc
index 1c82b2bc..99754c9 100644
--- a/chrome/browser/metrics/chrome_metrics_service_client.cc
+++ b/chrome/browser/metrics/chrome_metrics_service_client.cc

@@ -222,7 +222,7 @@
       // Register data that will be populated for the current run.
       file_metrics_provider->RegisterSource(
           active_path,
-          metrics::FileMetricsProvider::SOURCE_HISTOGRAMS_ATOMIC_FILE,
+          metrics::FileMetricsProvider::SOURCE_HISTOGRAMS_ACTIVE_FILE,
           metrics::FileMetricsProvider::ASSOCIATE_CURRENT_RUN,
           kCrashpadHistogramAllocatorName);
     }

diff --git a/chrome/browser/policy/configuration_policy_handler_list_factory.cc b/chrome/browser/policy/configuration_policy_handler_list_factory.cc
index d912b92..76e1de1 100644
--- a/chrome/browser/policy/configuration_policy_handler_list_factory.cc
+++ b/chrome/browser/policy/configuration_policy_handler_list_factory.cc

@@ -116,6 +116,7 @@
      base::Value::Type::BOOLEAN},
     {key::kPacHttpsUrlStrippingEnabled, prefs::kPacHttpsUrlStrippingEnabled,
      base::Value::Type::BOOLEAN},
+    {key::kQuicAllowed, prefs::kQuicAllowed, base::Value::Type::BOOLEAN},
     {key::kSafeBrowsingEnabled, prefs::kSafeBrowsingEnabled,
      base::Value::Type::BOOLEAN},
     {key::kForceGoogleSafeSearch, prefs::kForceGoogleSafeSearch,

diff --git a/chrome/browser/policy/policy_network_browsertest.cc b/chrome/browser/policy/policy_network_browsertest.cc
index 7aed8c4..323b6b1 100644
--- a/chrome/browser/policy/policy_network_browsertest.cc
+++ b/chrome/browser/policy/policy_network_browsertest.cc

@@ -9,6 +9,12 @@
 #include "base/memory/ref_counted.h"
 #include "base/run_loop.h"
 #include "chrome/browser/browser_process.h"
+#include "chrome/browser/policy/profile_policy_connector_factory.h"
+#include "chrome/browser/profiles/profile.h"
+#include "chrome/browser/profiles/profile_manager.h"
+#include "chrome/browser/profiles/profiles_state.h"
+#include "chrome/browser/safe_browsing/safe_browsing_service.h"
+#include "chrome/browser/ui/browser.h"
 #include "chrome/common/chrome_switches.h"
 #include "chrome/test/base/in_process_browser_test.h"
 #include "components/policy/core/browser/browser_policy_connector.h"
@@ -22,28 +28,65 @@
 #include "net/url_request/url_request_context.h"
 #include "net/url_request/url_request_context_getter.h"
 
+#if defined(OS_CHROMEOS)
+#include "chromeos/chromeos_switches.h"
+#endif
+
 namespace {
 
-void VerifyQuicEnabledStatus(net::URLRequestContextGetter* getter,
-                             bool quic_enabled_expected,
-                             const base::Closure& done_callback) {
-  net::URLRequestContext* context = getter->GetURLRequestContext();
-  bool quic_enabled = context->http_transaction_factory()->GetSession()->
-        params().enable_quic;
-  EXPECT_EQ(quic_enabled_expected, quic_enabled);
+// Checks if QUIC is enabled for new streams in the passed
+// |request_context_getter|. Will set the bool pointed to by |quic_enabled|.
+void IsQuicEnabledOnIOThread(
+    scoped_refptr<net::URLRequestContextGetter> request_context_getter,
+    bool* quic_enabled) {
+  DCHECK_CURRENTLY_ON(content::BrowserThread::IO);
 
-  content::BrowserThread::PostTask(content::BrowserThread::UI, FROM_HERE,
-                                   done_callback);
+  *quic_enabled = request_context_getter->GetURLRequestContext()
+                      ->http_transaction_factory()
+                      ->GetSession()
+                      ->IsQuicEnabled();
 }
 
-void VerifyQuicEnabledStatusInIOThread(bool quic_enabled_expected) {
+// Can be called on the UI thread, returns if QUIC is enabled for new streams in
+// the passed |request_context_getter|.
+bool IsQuicEnabled(
+    scoped_refptr<net::URLRequestContextGetter> request_context_getter) {
+  DCHECK_CURRENTLY_ON(content::BrowserThread::UI);
+
   base::RunLoop run_loop;
-  content::BrowserThread::PostTask(
+  bool is_quic_enabled = false;
+  content::BrowserThread::PostTaskAndReply(
       content::BrowserThread::IO, FROM_HERE,
-      base::Bind(VerifyQuicEnabledStatus,
-                 base::RetainedRef(g_browser_process->system_request_context()),
-                 quic_enabled_expected, run_loop.QuitClosure()));
+      base::Bind(IsQuicEnabledOnIOThread, request_context_getter,
+                 &is_quic_enabled),
+      run_loop.QuitClosure());
   run_loop.Run();
+  return is_quic_enabled;
+}
+
+// Short-hand access to global SafeBrowsingService's URLRequestContextGetter for
+// better readability.
+scoped_refptr<net::URLRequestContextGetter>
+safe_browsing_service_request_context() {
+  return g_browser_process->safe_browsing_service()->url_request_context();
+}
+
+// Short-hand access to global system request context getter for better
+// readability.
+scoped_refptr<net::URLRequestContextGetter> system_request_context() {
+  return g_browser_process->system_request_context();
+}
+
+// Called when an additional profile has been created.
+// The created profile is stored in *|out_created_profile|.
+void OnProfileInitialized(Profile** out_created_profile,
+                          const base::Closure& closure,
+                          Profile* profile,
+                          Profile::CreateStatus status) {
+  if (status == Profile::CREATE_STATUS_INITIALIZED) {
+    *out_created_profile = profile;
+    closure.Run();
+  }
 }
 
 }  // namespace
@@ -55,7 +98,7 @@
 // when these are being written.
 class QuicAllowedPolicyTestBase: public InProcessBrowserTest {
  public:
-  QuicAllowedPolicyTestBase() : InProcessBrowserTest(){}
+  QuicAllowedPolicyTestBase() : InProcessBrowserTest() {}
 
  protected:
   void SetUpInProcessBrowserTestFixture() override {
@@ -79,7 +122,7 @@
 // Policy QuicAllowed set to false.
 class QuicAllowedPolicyIsFalse: public QuicAllowedPolicyTestBase {
  public:
-  QuicAllowedPolicyIsFalse() : QuicAllowedPolicyTestBase(){}
+  QuicAllowedPolicyIsFalse() : QuicAllowedPolicyTestBase() {}
 
  protected:
   void GetQuicAllowedPolicy(PolicyMap* values) override {
@@ -93,13 +136,15 @@
 };
 
 IN_PROC_BROWSER_TEST_F(QuicAllowedPolicyIsFalse, QuicDisallowed) {
-  VerifyQuicEnabledStatusInIOThread(false);
+  EXPECT_FALSE(IsQuicEnabled(system_request_context()));
+  EXPECT_FALSE(IsQuicEnabled(safe_browsing_service_request_context()));
+  EXPECT_FALSE(IsQuicEnabled(browser()->profile()->GetRequestContext()));
 }
 
 // Policy QuicAllowed set to true.
 class QuicAllowedPolicyIsTrue: public QuicAllowedPolicyTestBase {
  public:
-  QuicAllowedPolicyIsTrue() : QuicAllowedPolicyTestBase(){}
+  QuicAllowedPolicyIsTrue() : QuicAllowedPolicyTestBase() {}
 
  protected:
   void GetQuicAllowedPolicy(PolicyMap* values) override {
@@ -113,13 +158,15 @@
 };
 
 IN_PROC_BROWSER_TEST_F(QuicAllowedPolicyIsTrue, QuicAllowed) {
-  VerifyQuicEnabledStatusInIOThread(true);
+  EXPECT_TRUE(IsQuicEnabled(system_request_context()));
+  EXPECT_TRUE(IsQuicEnabled(safe_browsing_service_request_context()));
+  EXPECT_TRUE(IsQuicEnabled(browser()->profile()->GetRequestContext()));
 }
 
 // Policy QuicAllowed is not set.
 class QuicAllowedPolicyIsNotSet: public QuicAllowedPolicyTestBase {
  public:
-  QuicAllowedPolicyIsNotSet() : QuicAllowedPolicyTestBase(){}
+  QuicAllowedPolicyIsNotSet() : QuicAllowedPolicyTestBase() {}
 
  protected:
   void GetQuicAllowedPolicy(PolicyMap* values) override {
@@ -130,7 +177,237 @@
 };
 
 IN_PROC_BROWSER_TEST_F(QuicAllowedPolicyIsNotSet, NoQuicRegulations) {
-  VerifyQuicEnabledStatusInIOThread(true);
+  EXPECT_TRUE(IsQuicEnabled(system_request_context()));
+  EXPECT_TRUE(IsQuicEnabled(safe_browsing_service_request_context()));
+  EXPECT_TRUE(IsQuicEnabled(browser()->profile()->GetRequestContext()));
+}
+
+// Policy QuicAllowed is set dynamically after profile creation.
+// Supports creation of an additional profile.
+class QuicAllowedPolicyDynamicTest : public InProcessBrowserTest {
+ public:
+  QuicAllowedPolicyDynamicTest()
+      : InProcessBrowserTest(), profile_1_(nullptr), profile_2_(nullptr) {}
+
+ protected:
+  void SetUpCommandLine(base::CommandLine* command_line) override {
+#if defined(OS_CHROMEOS)
+    command_line->AppendSwitch(
+        chromeos::switches::kIgnoreUserProfileMappingForTests);
+#endif
+  }
+
+  void SetUpInProcessBrowserTestFixture() override {
+    // Set the overriden policy provider for the first Profile (profile_1_).
+    EXPECT_CALL(policy_for_profile_1_, IsInitializationComplete(testing::_))
+        .WillRepeatedly(testing::Return(true));
+    policy::ProfilePolicyConnectorFactory::GetInstance()
+        ->PushProviderForTesting(&policy_for_profile_1_);
+  }
+
+  void SetUpOnMainThread() override { profile_1_ = browser()->profile(); }
+
+  // Creates a second Profile for testing. The Profile can then be accessed by
+  // profile_2() and its policy by policy_for_profile_2().
+  void CreateSecondProfile() {
+    EXPECT_FALSE(profile_2_);
+
+    // Prepare policy provider for second profile.
+    EXPECT_CALL(policy_for_profile_2_, IsInitializationComplete(testing::_))
+        .WillRepeatedly(testing::Return(true));
+    policy::ProfilePolicyConnectorFactory::GetInstance()
+        ->PushProviderForTesting(&policy_for_profile_2_);
+
+    ProfileManager* profile_manager = g_browser_process->profile_manager();
+
+    // Create an additional profile.
+    base::FilePath path_profile =
+        profile_manager->GenerateNextProfileDirectoryPath();
+    base::RunLoop run_loop;
+    profile_manager->CreateProfileAsync(
+        path_profile,
+        base::Bind(&OnProfileInitialized, &profile_2_, run_loop.QuitClosure()),
+        base::string16(), std::string(), std::string());
+
+    // Run the message loop to allow profile creation to take place; the loop is
+    // terminated by OnProfileInitialized calling the loop's QuitClosure when
+    // the profile is created.
+    run_loop.Run();
+
+    // Make sure second profile creation does what we think it does.
+    EXPECT_TRUE(profile_1() != profile_2());
+  }
+
+  // Sets the QuicAllowed policy for a Profile.
+  // |provider| is supposed to be the MockConfigurationPolicyProvider for the
+  // Profile, as returned by policy_for_profile_1() / policy_for_profile_2().
+  void SetQuicAllowedPolicy(MockConfigurationPolicyProvider* provider,
+                            bool value) {
+    PolicyMap policy_map;
+    policy_map.Set(key::kQuicAllowed, POLICY_LEVEL_MANDATORY, POLICY_SCOPE_USER,
+                   POLICY_SOURCE_CLOUD,
+                   base::MakeUnique<base::FundamentalValue>(value), nullptr);
+    provider->UpdateChromePolicy(policy_map);
+    base::RunLoop().RunUntilIdle();
+  }
+
+  // Removes all policies for a Profile.
+  // |provider| is supposed to be the MockConfigurationPolicyProvider for the
+  // Profile, as returned by policy_for_profile_1() / policy_for_profile_2().
+  void RemoveAllPolicies(MockConfigurationPolicyProvider* provider) {
+    PolicyMap policy_map;
+    provider->UpdateChromePolicy(policy_map);
+    base::RunLoop().RunUntilIdle();
+  }
+
+  // Returns the first Profile.
+  Profile* profile_1() { return profile_1_; }
+
+  // Returns the second Profile. May only be called after CreateSecondProfile
+  // has been called.
+  Profile* profile_2() {
+    // Only valid after CreateSecondProfile() has been called.
+    EXPECT_TRUE(profile_2_);
+    return profile_2_;
+  }
+
+  // Returns the MockConfigurationPolicyProvider for profile_1.
+  MockConfigurationPolicyProvider* policy_for_profile_1() {
+    return &policy_for_profile_1_;
+  }
+
+  // Returns the MockConfigurationPolicyProvider for profile_2.
+  MockConfigurationPolicyProvider* policy_for_profile_2() {
+    return &policy_for_profile_2_;
+  }
+
+ private:
+  // The first profile.
+  Profile* profile_1_;
+  // The second profile. Only valid after CreateSecondProfile() has been called.
+  Profile* profile_2_;
+
+  // Mock Policy for profile_1_.
+  MockConfigurationPolicyProvider policy_for_profile_1_;
+  // Mock Policy for profile_2_.
+  MockConfigurationPolicyProvider policy_for_profile_2_;
+
+  DISALLOW_COPY_AND_ASSIGN(QuicAllowedPolicyDynamicTest);
+};
+
+// QUIC is disallowed by policy after the profile has been initialized.
+IN_PROC_BROWSER_TEST_F(QuicAllowedPolicyDynamicTest, QuicAllowedFalseThenTrue) {
+  // After browser start, QuicAllowed=false comes in dynamically
+  SetQuicAllowedPolicy(policy_for_profile_1(), false);
+  EXPECT_FALSE(IsQuicEnabled(system_request_context()));
+  EXPECT_FALSE(IsQuicEnabled(safe_browsing_service_request_context()));
+  EXPECT_FALSE(IsQuicEnabled(profile_1()->GetRequestContext()));
+
+  // Set the QuicAllowed policy to true again
+  SetQuicAllowedPolicy(policy_for_profile_1(), true);
+  // Effectively, QUIC is still disabled because QUIC re-enabling is not
+  // supported.
+  EXPECT_FALSE(IsQuicEnabled(system_request_context()));
+  EXPECT_FALSE(IsQuicEnabled(safe_browsing_service_request_context()));
+  EXPECT_FALSE(IsQuicEnabled(profile_1()->GetRequestContext()));
+
+  // Completely remove the QuicAllowed policy
+  RemoveAllPolicies(policy_for_profile_1());
+  // Effectively, QUIC is still disabled because QUIC re-enabling is not
+  // supported.
+  EXPECT_FALSE(IsQuicEnabled(system_request_context()));
+  EXPECT_FALSE(IsQuicEnabled(safe_browsing_service_request_context()));
+  EXPECT_FALSE(IsQuicEnabled(profile_1()->GetRequestContext()));
+
+  // QuicAllowed=false is set again
+  SetQuicAllowedPolicy(policy_for_profile_1(), false);
+  EXPECT_FALSE(IsQuicEnabled(system_request_context()));
+  EXPECT_FALSE(IsQuicEnabled(safe_browsing_service_request_context()));
+  EXPECT_FALSE(IsQuicEnabled(profile_1()->GetRequestContext()));
+}
+
+// QUIC is allowed, then disallowed by policy after the profile has been
+// initialized.
+IN_PROC_BROWSER_TEST_F(QuicAllowedPolicyDynamicTest, QuicAllowedTrueThenFalse) {
+  // After browser start, QuicAllowed=true comes in dynamically
+  SetQuicAllowedPolicy(policy_for_profile_1(), true);
+  EXPECT_TRUE(IsQuicEnabled(system_request_context()));
+  EXPECT_TRUE(IsQuicEnabled(safe_browsing_service_request_context()));
+  EXPECT_TRUE(IsQuicEnabled(profile_1()->GetRequestContext()));
+
+  // Completely remove the QuicAllowed policy
+  RemoveAllPolicies(policy_for_profile_1());
+  EXPECT_TRUE(IsQuicEnabled(system_request_context()));
+  EXPECT_TRUE(IsQuicEnabled(safe_browsing_service_request_context()));
+  EXPECT_TRUE(IsQuicEnabled(profile_1()->GetRequestContext()));
+
+  // Set the QuicAllowed policy to true again
+  SetQuicAllowedPolicy(policy_for_profile_1(), true);
+  // Effectively, QUIC is still disabled because QUIC re-enabling is not
+  // supported.
+  EXPECT_TRUE(IsQuicEnabled(system_request_context()));
+  EXPECT_TRUE(IsQuicEnabled(safe_browsing_service_request_context()));
+  EXPECT_TRUE(IsQuicEnabled(profile_1()->GetRequestContext()));
+
+  // Now set QuicAllowed=false
+  SetQuicAllowedPolicy(policy_for_profile_1(), false);
+  EXPECT_FALSE(IsQuicEnabled(system_request_context()));
+  EXPECT_FALSE(IsQuicEnabled(safe_browsing_service_request_context()));
+  EXPECT_FALSE(IsQuicEnabled(profile_1()->GetRequestContext()));
+}
+
+// A second Profile is created when QuicAllowed=false policy is in effect for
+// the first profile.
+IN_PROC_BROWSER_TEST_F(QuicAllowedPolicyDynamicTest,
+                       SecondProfileCreatedWhenQuicAllowedFalse) {
+  // If multiprofile mode is not enabled, you can't switch between profiles.
+  if (!profiles::IsMultipleProfilesEnabled())
+    return;
+
+  SetQuicAllowedPolicy(policy_for_profile_1(), false);
+  EXPECT_FALSE(IsQuicEnabled(system_request_context()));
+  EXPECT_FALSE(IsQuicEnabled(safe_browsing_service_request_context()));
+  EXPECT_FALSE(IsQuicEnabled(profile_1()->GetRequestContext()));
+
+  CreateSecondProfile();
+
+  // QUIC is disabled in both profiles
+  EXPECT_FALSE(IsQuicEnabled(system_request_context()));
+  EXPECT_FALSE(IsQuicEnabled(safe_browsing_service_request_context()));
+  EXPECT_FALSE(IsQuicEnabled(profile_1()->GetRequestContext()));
+  EXPECT_FALSE(IsQuicEnabled(profile_2()->GetRequestContext()));
+}
+
+// A second Profile is created when no QuicAllowed policy is in effect for the
+// first profile.
+// Then QuicAllowed=false policy is dynamically set for both profiles.
+IN_PROC_BROWSER_TEST_F(QuicAllowedPolicyDynamicTest,
+                       QuicAllowedFalseAfterTwoProfilesCreated) {
+  // If multiprofile mode is not enabled, you can't switch between profiles.
+  if (!profiles::IsMultipleProfilesEnabled())
+    return;
+
+  CreateSecondProfile();
+
+  // QUIC is enabled in both profiles
+  EXPECT_TRUE(IsQuicEnabled(system_request_context()));
+  EXPECT_TRUE(IsQuicEnabled(safe_browsing_service_request_context()));
+  EXPECT_TRUE(IsQuicEnabled(profile_1()->GetRequestContext()));
+  EXPECT_TRUE(IsQuicEnabled(profile_2()->GetRequestContext()));
+
+  // Disable QUIC in first profile
+  SetQuicAllowedPolicy(policy_for_profile_1(), false);
+  EXPECT_FALSE(IsQuicEnabled(system_request_context()));
+  EXPECT_FALSE(IsQuicEnabled(safe_browsing_service_request_context()));
+  EXPECT_FALSE(IsQuicEnabled(profile_1()->GetRequestContext()));
+  EXPECT_TRUE(IsQuicEnabled(profile_2()->GetRequestContext()));
+
+  // Disable QUIC in second profile
+  SetQuicAllowedPolicy(policy_for_profile_2(), false);
+  EXPECT_FALSE(IsQuicEnabled(system_request_context()));
+  EXPECT_FALSE(IsQuicEnabled(safe_browsing_service_request_context()));
+  EXPECT_FALSE(IsQuicEnabled(profile_1()->GetRequestContext()));
+  EXPECT_FALSE(IsQuicEnabled(profile_2()->GetRequestContext()));
 }
 
 }  // namespace policy

diff --git a/chrome/browser/prefs/browser_prefs.cc b/chrome/browser/prefs/browser_prefs.cc
index 9776ee1..13af080 100644
--- a/chrome/browser/prefs/browser_prefs.cc
+++ b/chrome/browser/prefs/browser_prefs.cc

@@ -44,6 +44,7 @@
 #include "chrome/browser/prefs/origin_trial_prefs.h"
 #include "chrome/browser/prefs/session_startup_pref.h"
 #include "chrome/browser/profiles/chrome_version_service.h"
+#include "chrome/browser/profiles/net_http_session_params_observer.h"
 #include "chrome/browser/profiles/profile.h"
 #include "chrome/browser/profiles/profile_impl.h"
 #include "chrome/browser/profiles/profile_info_cache.h"
@@ -492,6 +493,7 @@
   MediaCaptureDevicesDispatcher::RegisterProfilePrefs(registry);
   MediaDeviceIDSalt::RegisterProfilePrefs(registry);
   MediaStreamDevicesController::RegisterProfilePrefs(registry);
+  NetHttpSessionParamsObserver::RegisterProfilePrefs(registry);
   NotifierStateTracker::RegisterProfilePrefs(registry);
   ntp_snippets::BookmarkSuggestionsProvider::RegisterProfilePrefs(registry);
   ntp_snippets::ContentSuggestionsService::RegisterProfilePrefs(registry);

diff --git a/chrome/browser/prerender/prerender_manager.cc b/chrome/browser/prerender/prerender_manager.cc
index 6f2c512..fe53187d 100644
--- a/chrome/browser/prerender/prerender_manager.cc
+++ b/chrome/browser/prerender/prerender_manager.cc

@@ -941,6 +941,13 @@
     return nullptr;
   }
 
+  if (PrerenderData* preexisting_prerender_data =
+          FindPrerenderData(url, session_storage_namespace)) {
+    RecordFinalStatusWithoutCreatingPrerenderContents(url, origin,
+                                                      FINAL_STATUS_DUPLICATE);
+    return base::WrapUnique(new PrerenderHandle(preexisting_prerender_data));
+  }
+
   if (IsNoStatePrefetch(origin)) {
     base::TimeDelta prefetch_age;
     GetPrefetchInformation(url, &prefetch_age, nullptr);
@@ -951,11 +958,6 @@
                                                         FINAL_STATUS_DUPLICATE);
       return nullptr;
     }
-  } else if (PrerenderData* preexisting_prerender_data =
-                 FindPrerenderData(url, session_storage_namespace)) {
-    RecordFinalStatusWithoutCreatingPrerenderContents(
-        url, origin, FINAL_STATUS_DUPLICATE);
-    return base::WrapUnique(new PrerenderHandle(preexisting_prerender_data));
   }
 
   // Do not prerender if there are too many render processes, and we would

diff --git a/chrome/browser/prerender/prerender_unittest.cc b/chrome/browser/prerender/prerender_unittest.cc
index 82b9e966..b79a260 100644
--- a/chrome/browser/prerender/prerender_unittest.cc
+++ b/chrome/browser/prerender/prerender_unittest.cc

@@ -642,6 +642,36 @@
   ASSERT_EQ(prerender_contents, entry.get());
 }
 
+// Make sure that if queue a request, and a second prerender request for the
+// same URL comes in, that the second request attaches to the first prerender,
+// and we don't use the second prerender contents.
+// This test is the same as the "DuplicateTest" above, but for NoStatePrefetch.
+TEST_F(PrerenderTest, DuplicateTest_NoStatePrefetch) {
+  RestorePrerenderMode restore_prerender_mode;
+  prerender_manager()->SetMode(
+      PrerenderManager::PRERENDER_MODE_NOSTATE_PREFETCH);
+
+  SetConcurrency(2);
+  GURL url("http://www.google.com/");
+  DummyPrerenderContents* prerender_contents =
+      prerender_manager()->CreateNextPrerenderContents(url, FINAL_STATUS_USED);
+  EXPECT_TRUE(AddSimplePrerender(url));
+  EXPECT_FALSE(prerender_manager()->next_prerender_contents());
+  EXPECT_TRUE(prerender_contents->prerendering_has_started());
+
+  DummyPrerenderContents* prerender_contents1 =
+      prerender_manager()->CreateNextPrerenderContents(
+          url, FINAL_STATUS_MANAGER_SHUTDOWN);
+  EXPECT_TRUE(AddSimplePrerender(url));
+  EXPECT_EQ(prerender_contents1,
+            prerender_manager()->next_prerender_contents());
+  EXPECT_FALSE(prerender_contents1->prerendering_has_started());
+
+  std::unique_ptr<PrerenderContents> entry =
+      prerender_manager()->FindAndUseEntry(url);
+  ASSERT_EQ(prerender_contents, entry.get());
+}
+
 // Ensure that we expire a prerendered page after the max. permitted time.
 TEST_F(PrerenderTest, ExpireTest) {
   base::SimpleTestTickClock* tick_clock =
@@ -794,10 +824,12 @@
       OverridePrerenderManagerTimeTicks(prerender_manager());
 
   // Prefetch the url once.
-  prerender_manager()->CreateNextPrerenderContents(
-      kUrl, ORIGIN_OMNIBOX, FINAL_STATUS_MANAGER_SHUTDOWN);
+  prerender_manager()->CreateNextPrerenderContents(kUrl, ORIGIN_OMNIBOX,
+                                                   FINAL_STATUS_CANCELLED);
   EXPECT_TRUE(
       prerender_manager()->AddPrerenderFromOmnibox(kUrl, nullptr, gfx::Size()));
+  // Cancel the prerender so that it is not reused.
+  prerender_manager()->CancelAllPrerenders();
 
   prerender_manager()->CreateNextPrerenderContents(
       kUrl, ORIGIN_OMNIBOX, FINAL_STATUS_MANAGER_SHUTDOWN);

diff --git a/chrome/browser/profile_resetter/profile_resetter.cc b/chrome/browser/profile_resetter/profile_resetter.cc
index 7cefe584..d3e4360b 100644
--- a/chrome/browser/profile_resetter/profile_resetter.cc
+++ b/chrome/browser/profile_resetter/profile_resetter.cc

@@ -53,8 +53,7 @@
   base::FilePath chrome_exe;
   if (!PathService::Get(base::FILE_EXE, &chrome_exe))
     return;
-  BrowserDistribution* dist = BrowserDistribution::GetSpecificDistribution(
-      BrowserDistribution::CHROME_BROWSER);
+  BrowserDistribution* dist = BrowserDistribution::GetDistribution();
   for (int location = ShellUtil::SHORTCUT_LOCATION_FIRST;
        location < ShellUtil::NUM_SHORTCUT_LOCATIONS; ++location) {
     ShellUtil::ShortcutListMaybeRemoveUnknownArgs(
@@ -347,8 +346,7 @@
   base::FilePath chrome_exe;
   if (!PathService::Get(base::FILE_EXE, &chrome_exe))
     return std::vector<ShortcutCommand>();
-  BrowserDistribution* dist = BrowserDistribution::GetSpecificDistribution(
-      BrowserDistribution::CHROME_BROWSER);
+  BrowserDistribution* dist = BrowserDistribution::GetDistribution();
   std::vector<ShortcutCommand> shortcuts;
   for (int location = ShellUtil::SHORTCUT_LOCATION_FIRST;
        location < ShellUtil::NUM_SHORTCUT_LOCATIONS; ++location) {

diff --git a/chrome/browser/profiles/net_http_session_params_observer.cc b/chrome/browser/profiles/net_http_session_params_observer.cc
new file mode 100644
index 0000000..2ce3814
--- /dev/null
+++ b/chrome/browser/profiles/net_http_session_params_observer.cc

@@ -0,0 +1,96 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "chrome/browser/profiles/net_http_session_params_observer.h"
+
+#include "base/bind.h"
+#include "base/command_line.h"
+#include "base/logging.h"
+#include "chrome/browser/browser_process.h"
+#include "chrome/browser/io_thread.h"
+#include "chrome/browser/profiles/profile_manager.h"
+#include "chrome/browser/safe_browsing/safe_browsing_service.h"
+#include "chrome/common/chrome_switches.h"
+#include "chrome/common/pref_names.h"
+#include "components/pref_registry/pref_registry_syncable.h"
+#include "components/prefs/pref_service.h"
+#include "content/public/browser/browser_thread.h"
+
+using content::BrowserThread;
+
+namespace {
+
+// Called on IOThread to disable QUIC for globally-owned HttpNetworkSessions
+// and for the profile (thrpugh |disable_quic_callback|). Note that re-enabling
+// QUIC dynamically is not supported for simpliciy and requires a browser
+// restart.
+void DisableQuicOnIOThread(
+    NetHttpSessionParamsObserver::DisableQuicCallback disable_quic_callback,
+    IOThread* io_thread,
+    safe_browsing::SafeBrowsingService* safe_browsing_service) {
+  DCHECK_CURRENTLY_ON(BrowserThread::IO);
+
+  // Disable QUIC for globally-owned objects.
+  io_thread->DisableQuic();
+  safe_browsing_service->DisableQuicOnIOThread();
+
+  // Call profile's disable QUIC callback.
+  disable_quic_callback.Run();
+}
+
+}  // namespace
+
+NetHttpSessionParamsObserver::NetHttpSessionParamsObserver(
+    PrefService* prefs,
+    DisableQuicCallback disable_quic_callback)
+    : disable_quic_callback_(disable_quic_callback) {
+  DCHECK_CURRENTLY_ON(BrowserThread::UI);
+  DCHECK(prefs);
+
+  base::Closure prefs_callback = base::Bind(
+      &NetHttpSessionParamsObserver::ApplySettings, base::Unretained(this));
+  quic_allowed_.Init(prefs::kQuicAllowed, prefs, prefs_callback);
+
+  // Apply the initial settings, in case QUIC is disallowed by policy on profile
+  // initialization time. Note that even if this may not affect the profile
+  // which is being initialized directly (as its URLRequestContext will not be
+  // constructed yet), it still applies to globally-owned HttpNetworkSessions
+  // and to IOThread's HttpNetworkSession Params, which will in turn be used as
+  // a base for the new profile's URLRequestContext.
+  ApplySettings();
+}
+
+NetHttpSessionParamsObserver::~NetHttpSessionParamsObserver() {
+  DCHECK_CURRENTLY_ON(BrowserThread::UI);
+}
+
+void NetHttpSessionParamsObserver::ApplySettings() {
+  DCHECK_CURRENTLY_ON(BrowserThread::UI);
+
+  bool quic_allowed_for_profile = true;
+  if (quic_allowed_.IsManaged())
+    quic_allowed_for_profile = *quic_allowed_;
+
+  // We only support disabling QUIC.
+  if (quic_allowed_for_profile)
+    return;
+
+  // Disabling QUIC for a profile also disables QUIC for globally-owned
+  // HttpNetworkSessions. As a side effect, new Profiles will also have QUIC
+  // disabled (because they inherit IOThread's HttpNetworkSession Params).
+  IOThread* io_thread = g_browser_process->io_thread();
+  safe_browsing::SafeBrowsingService* safe_browsing_service =
+      g_browser_process->safe_browsing_service();
+
+  BrowserThread::PostTask(
+      BrowserThread::IO, FROM_HERE,
+      base::Bind(&DisableQuicOnIOThread, disable_quic_callback_, io_thread,
+                 base::Unretained(safe_browsing_service)));
+}
+
+// static
+void NetHttpSessionParamsObserver::RegisterProfilePrefs(
+    user_prefs::PrefRegistrySyncable* registry) {
+  registry->RegisterBooleanPref(prefs::kQuicAllowed, true);
+}

diff --git a/chrome/browser/profiles/net_http_session_params_observer.h b/chrome/browser/profiles/net_http_session_params_observer.h
new file mode 100644
index 0000000..4004c74
--- /dev/null
+++ b/chrome/browser/profiles/net_http_session_params_observer.h

@@ -0,0 +1,51 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CHROME_BROWSER_PROFILES_NET_HTTP_SESSION_PARAMS_OBSERVER_H_
+#define CHROME_BROWSER_PROFILES_NET_HTTP_SESSION_PARAMS_OBSERVER_H_
+
+#include "base/callback_forward.h"
+#include "base/macros.h"
+#include "components/prefs/pref_member.h"
+
+class PrefService;
+
+namespace user_prefs {
+class PrefRegistrySyncable;
+}
+
+// Monitors network-related preferences for changes and applies them to
+// globally owned HttpNetworkSessions.
+// Profile-owned HttpNetworkSessions are taken care of by a
+// UpdateNetParamsCallback passed to the constructor.
+// The supplied PrefService must outlive this NetHttpSessionParamsObserver.
+// Must be used only on the UI thread.
+class NetHttpSessionParamsObserver {
+ public:
+  // Type of callback which will be called when QUIC is disabled. This
+  // callback will be called on the IO thread.
+  typedef base::Callback<void()> DisableQuicCallback;
+
+  // |prefs| must be non-NULL and |*prefs| must outlive this.
+  // |update_net_params_callback| will be invoked on the IO thread when an
+  // observed network parmeter is changed.
+  NetHttpSessionParamsObserver(PrefService* prefs,
+                               DisableQuicCallback disable_quic_callback);
+  ~NetHttpSessionParamsObserver();
+
+  // Register user preferences which NetHttpSessionParamsObserver uses into
+  // |registry|.
+  static void RegisterProfilePrefs(user_prefs::PrefRegistrySyncable* registry);
+
+ private:
+  // Called on UI thread when an observed net pref changes
+  void ApplySettings();
+
+  BooleanPrefMember quic_allowed_;
+  DisableQuicCallback disable_quic_callback_;
+
+  DISALLOW_COPY_AND_ASSIGN(NetHttpSessionParamsObserver);
+};
+
+#endif  // CHROME_BROWSER_PROFILES_NET_HTTP_SESSION_PARAMS_OBSERVER_H_

diff --git a/chrome/browser/profiles/profile_io_data.cc b/chrome/browser/profiles/profile_io_data.cc
index 014b3bc..0e6c1cc 100644
--- a/chrome/browser/profiles/profile_io_data.cc
+++ b/chrome/browser/profiles/profile_io_data.cc

@@ -46,6 +46,7 @@
 #include "chrome/browser/policy/policy_helpers.h"
 #include "chrome/browser/predictors/resource_prefetch_predictor.h"
 #include "chrome/browser/predictors/resource_prefetch_predictor_factory.h"
+#include "chrome/browser/profiles/net_http_session_params_observer.h"
 #include "chrome/browser/profiles/profile.h"
 #include "chrome/browser/profiles/profile_manager.h"
 #include "chrome/browser/ssl/chrome_expect_ct_reporter.h"
@@ -469,6 +470,13 @@
       &allowed_domains_for_apps_,
       pref_service);
 
+  DCHECK(!net_http_session_params_observer_);
+  NetHttpSessionParamsObserver::DisableQuicCallback disable_quic_callback =
+      base::Bind(&ProfileIOData::DisableQuicOnIOThread, base::Unretained(this));
+  net_http_session_params_observer_ =
+      base::MakeUnique<NetHttpSessionParamsObserver>(pref_service,
+                                                     disable_quic_callback);
+
   scoped_refptr<base::SingleThreadTaskRunner> io_task_runner =
       BrowserThread::GetTaskRunnerForThread(BrowserThread::IO);
 
@@ -919,6 +927,18 @@
 #endif
 }
 
+void ProfileIOData::DisableQuicOnIOThread() {
+  // If the URLRequestContext has not been created yet, it will not be updated
+  // here. Instead, it will inherit its QUIC enablement from IOThread on
+  // construction, which is fine, as NetHttpSessionParamsObserver also disables
+  // QUIC there.
+  if (!main_request_context_storage_ ||
+      !main_request_context_storage_->http_network_session())
+    return;
+
+  main_request_context_storage_->http_network_session()->DisableQuic();
+}
+
 void ProfileIOData::set_data_reduction_proxy_io_data(
     std::unique_ptr<data_reduction_proxy::DataReductionProxyIOData>
         data_reduction_proxy_io_data) const {
@@ -1226,6 +1246,7 @@
   if (chrome_http_user_agent_settings_)
     chrome_http_user_agent_settings_->CleanupOnUIThread();
   incognito_availibility_pref_.Destroy();
+  net_http_session_params_observer_.reset();
 
   if (!context_getters->empty()) {
     if (BrowserThread::IsMessageLoopValid(BrowserThread::IO)) {

diff --git a/chrome/browser/profiles/profile_io_data.h b/chrome/browser/profiles/profile_io_data.h
index 28a85c91..4624915 100644
--- a/chrome/browser/profiles/profile_io_data.h
+++ b/chrome/browser/profiles/profile_io_data.h

@@ -44,6 +44,7 @@
 class ChromeExpectCTReporter;
 class HostContentSettingsMap;
 class MediaDeviceIDSalt;
+class NetHttpSessionParamsObserver;
 class ProtocolHandlerRegistry;
 class SupervisedUserURLFilter;
 
@@ -252,6 +253,9 @@
   // Get platform ClientCertStore. May return nullptr.
   std::unique_ptr<net::ClientCertStore> CreateClientCertStore();
 
+  // Called on IO thread thread to disable QUIC.
+  void DisableQuicOnIOThread();
+
  protected:
   // A URLRequestContext for media that owns its HTTP factory, to ensure
   // it is deleted.
@@ -535,6 +539,11 @@
 
   BooleanPrefMember enable_metrics_;
 
+  // Observes profile's preference for changes to prefs which affect
+  // HttpNetworkSession params.
+  std::unique_ptr<NetHttpSessionParamsObserver>
+      net_http_session_params_observer_;
+
   // Pointed to by NetworkDelegate.
   mutable std::unique_ptr<policy::URLBlacklistManager> url_blacklist_manager_;
   mutable std::unique_ptr<policy::PolicyHeaderIOHelper> policy_header_helper_;

diff --git a/chrome/browser/profiles/profile_manager.cc b/chrome/browser/profiles/profile_manager.cc
index 26c521b..ab19204 100644
--- a/chrome/browser/profiles/profile_manager.cc
+++ b/chrome/browser/profiles/profile_manager.cc

@@ -889,12 +889,19 @@
     // Although it should never happen, make sure this is a valid path in the
     // user_data_dir, so we don't accidentially delete something else.
     if (is_valid_profile_path) {
-      LOG(WARNING) << "Files of a deleted profile still exist after restart. "
-                      "Cleaning up now.";
-      BrowserThread::PostTaskAndReply(
-          BrowserThread::FILE, FROM_HERE,
-          base::Bind(&NukeProfileFromDisk, profile_path),
+      if (base::PathExists(profile_path)) {
+        LOG(WARNING) << "Files of a deleted profile still exist after restart. "
+                        "Cleaning up now.";
+        BrowserThread::PostTaskAndReply(
+            BrowserThread::FILE, FROM_HERE,
+            base::Bind(&NukeProfileFromDisk, profile_path),
+            base::Bind(&ProfileCleanedUp, value.get()));
+      } else {
+        // Everything is fine, the profile was removed on shutdown.
+        BrowserThread::PostTask(
+          BrowserThread::UI, FROM_HERE,
           base::Bind(&ProfileCleanedUp, value.get()));
+      }
     } else {
       LOG(ERROR) << "Found invalid profile path in deleted_profiles: "
                  << profile_path.AsUTF8Unsafe();

diff --git a/chrome/browser/safe_browsing/safe_browsing_service.cc b/chrome/browser/safe_browsing/safe_browsing_service.cc
index d124f5a5..3071414c2 100644
--- a/chrome/browser/safe_browsing/safe_browsing_service.cc
+++ b/chrome/browser/safe_browsing/safe_browsing_service.cc

@@ -139,6 +139,10 @@
   // true.
   void ServiceShuttingDown();
 
+  // Disables QUIC. This should not be necessary anymore when
+  // http://crbug.com/678653 is implemented.
+  void DisableQuicOnIOThread();
+
  protected:
   ~SafeBrowsingURLRequestContextGetter() override;
 
@@ -239,6 +243,13 @@
   safe_browsing_request_context_.reset();
 }
 
+void SafeBrowsingURLRequestContextGetter::DisableQuicOnIOThread() {
+  DCHECK_CURRENTLY_ON(BrowserThread::IO);
+
+  if (http_network_session_)
+    http_network_session_->DisableQuic();
+}
+
 SafeBrowsingURLRequestContextGetter::~SafeBrowsingURLRequestContextGetter() {}
 
 // static
@@ -393,6 +404,12 @@
   return url_request_context_getter_;
 }
 
+void SafeBrowsingService::DisableQuicOnIOThread() {
+  DCHECK_CURRENTLY_ON(BrowserThread::IO);
+
+  url_request_context_getter_->DisableQuicOnIOThread();
+}
+
 const scoped_refptr<SafeBrowsingUIManager>&
 SafeBrowsingService::ui_manager() const {
   return ui_manager_;

diff --git a/chrome/browser/safe_browsing/safe_browsing_service.h b/chrome/browser/safe_browsing/safe_browsing_service.h
index 666d7aa..07b97413 100644
--- a/chrome/browser/safe_browsing/safe_browsing_service.h
+++ b/chrome/browser/safe_browsing/safe_browsing_service.h

@@ -124,6 +124,11 @@
 
   scoped_refptr<net::URLRequestContextGetter> url_request_context();
 
+  // Called on IO thread thread when QUIC should be disabled (e.g. because of
+  // policy). This should not be necessary anymore when http://crbug.com/678653
+  // is implemented.
+  void DisableQuicOnIOThread();
+
   const scoped_refptr<SafeBrowsingUIManager>& ui_manager() const;
 
   // This returns either the v3 or the v4 database manager, depending on

diff --git a/chrome/browser/ui/signin_view_controller_delegate.h b/chrome/browser/ui/signin_view_controller_delegate.h
index 6f9de730..cad47aa8 100644
--- a/chrome/browser/ui/signin_view_controller_delegate.h
+++ b/chrome/browser/ui/signin_view_controller_delegate.h

@@ -46,6 +46,7 @@
       SigninViewController* signin_view_controller,
       Browser* browser);
 
+  // Closes the modal sign-in dialog.
   void CloseModalSignin();
 
   // Either navigates back in the signin flow if the history state allows it or

diff --git a/chrome/browser/ui/tabs/tab_strip_model_observer.cc b/chrome/browser/ui/tabs/tab_strip_model_observer.cc
index bea661e..acd327e0 100644
--- a/chrome/browser/ui/tabs/tab_strip_model_observer.cc
+++ b/chrome/browser/ui/tabs/tab_strip_model_observer.cc

@@ -6,6 +6,9 @@
 
 using content::WebContents;
 
+TabStripModelObserver::TabStripModelObserver() {
+}
+
 void TabStripModelObserver::TabInsertedAt(TabStripModel* tab_strip_model,
                                           WebContents* contents,
                                           int index,

diff --git a/chrome/browser/ui/tabs/tab_strip_model_observer.h b/chrome/browser/ui/tabs/tab_strip_model_observer.h
index 4c670943..fe73ec8 100644
--- a/chrome/browser/ui/tabs/tab_strip_model_observer.h
+++ b/chrome/browser/ui/tabs/tab_strip_model_observer.h

@@ -5,6 +5,8 @@
 #ifndef CHROME_BROWSER_UI_TABS_TAB_STRIP_MODEL_OBSERVER_H_
 #define CHROME_BROWSER_UI_TABS_TAB_STRIP_MODEL_OBSERVER_H_
 
+#include "base/macros.h"
+
 class TabStripModel;
 
 namespace content {
@@ -152,7 +154,11 @@
   virtual void CloseAllTabsCanceled();
 
  protected:
+  TabStripModelObserver();
   virtual ~TabStripModelObserver() {}
+
+ private:
+  DISALLOW_COPY_AND_ASSIGN(TabStripModelObserver);
 };
 
 #endif  // CHROME_BROWSER_UI_TABS_TAB_STRIP_MODEL_OBSERVER_H_

diff --git a/chrome/browser/ui/views/profiles/signin_view_controller_delegate_views.cc b/chrome/browser/ui/views/profiles/signin_view_controller_delegate_views.cc
index 9a650bf..83f947e 100644
--- a/chrome/browser/ui/views/profiles/signin_view_controller_delegate_views.cc
+++ b/chrome/browser/ui/views/profiles/signin_view_controller_delegate_views.cc

@@ -42,17 +42,21 @@
     SigninViewController* signin_view_controller,
     std::unique_ptr<views::WebView> content_view,
     Browser* browser,
+    ui::ModalType dialog_modal_type,
     bool wait_for_size)
     : SigninViewControllerDelegate(signin_view_controller,
                                    content_view->GetWebContents()),
       content_view_(content_view.release()),
       modal_signin_widget_(nullptr),
+      dialog_modal_type_(dialog_modal_type),
       wait_for_size_(wait_for_size),
       browser_(browser) {
   DCHECK(browser_);
   DCHECK(browser_->tab_strip_model()->GetActiveWebContents())
       << "A tab must be active to present the sign-in modal dialog.";
-
+  DCHECK(dialog_modal_type == ui::MODAL_TYPE_CHILD ||
+         dialog_modal_type == ui::MODAL_TYPE_WINDOW)
+      << "Unsupported dialog modal type " << dialog_modal_type;
   if (!wait_for_size_)
     DisplayModal();
 }
@@ -78,7 +82,7 @@
 }
 
 ui::ModalType SigninViewControllerDelegateViews::GetModalType() const {
-  return ui::MODAL_TYPE_WINDOW;
+  return dialog_modal_type_;
 }
 
 bool SigninViewControllerDelegateViews::ShouldShowCloseButton() const {
@@ -121,9 +125,20 @@
     return;
 
   gfx::NativeWindow window = host_web_contents->GetTopLevelNativeWindow();
-  modal_signin_widget_ =
-      constrained_window::CreateBrowserModalDialogViews(this, window);
-  modal_signin_widget_->Show();
+  switch (dialog_modal_type_) {
+    case ui::MODAL_TYPE_WINDOW:
+      modal_signin_widget_ =
+          constrained_window::CreateBrowserModalDialogViews(this, window);
+      modal_signin_widget_->Show();
+      break;
+    case ui::MODAL_TYPE_CHILD:
+      modal_signin_widget_ = constrained_window::ShowWebModalDialogViews(
+          this, browser_->tab_strip_model()->GetActiveWebContents());
+      break;
+    default:
+      NOTREACHED() << "Unsupported dialog modal type " << dialog_modal_type_;
+  }
+  content_view_->RequestFocus();
 }
 
 // static
@@ -206,7 +221,7 @@
       signin_view_controller,
       SigninViewControllerDelegateViews::CreateGaiaWebView(
           nullptr, mode, browser, access_point),
-      browser, false);
+      browser, ui::MODAL_TYPE_CHILD, false);
 }
 
 SigninViewControllerDelegate*
@@ -216,7 +231,7 @@
   return new SigninViewControllerDelegateViews(
       signin_view_controller,
       SigninViewControllerDelegateViews::CreateSyncConfirmationWebView(browser),
-      browser, true);
+      browser, ui::MODAL_TYPE_WINDOW, true);
 }
 
 SigninViewControllerDelegate*
@@ -226,5 +241,5 @@
   return new SigninViewControllerDelegateViews(
       signin_view_controller,
       SigninViewControllerDelegateViews::CreateSigninErrorWebView(browser),
-      browser, true);
+      browser, ui::MODAL_TYPE_WINDOW, true);
 }

diff --git a/chrome/browser/ui/views/profiles/signin_view_controller_delegate_views.h b/chrome/browser/ui/views/profiles/signin_view_controller_delegate_views.h
index 64c9e753..5cb52ce 100644
--- a/chrome/browser/ui/views/profiles/signin_view_controller_delegate_views.h
+++ b/chrome/browser/ui/views/profiles/signin_view_controller_delegate_views.h

@@ -31,15 +31,6 @@
 class SigninViewControllerDelegateViews : public views::DialogDelegateView,
                                           public SigninViewControllerDelegate {
  public:
-  // Creates and displays a constrained window containing |web_contents|. If
-  // |wait_for_size| is true, the delegate will wait for ResizeNativeView() to
-  // be called by the base class before displaying the constrained window.
-  SigninViewControllerDelegateViews(
-      SigninViewController* signin_view_controller,
-      std::unique_ptr<views::WebView> content_view,
-      Browser* browser,
-      bool wait_for_size);
-
   // Creates the web view that contains the signin flow in |mode| using
   // |profile| as the web content's profile, then sets |delegate| as the created
   // web content's delegate.
@@ -65,15 +56,27 @@
   int GetDialogButtons() const override;
 
  private:
+  friend SigninViewControllerDelegate;
+
+  // Creates and displays a constrained window containing |web_contents|. If
+  // |wait_for_size| is true, the delegate will wait for ResizeNativeView() to
+  // be called by the base class before displaying the constrained window.
+  SigninViewControllerDelegateViews(
+      SigninViewController* signin_view_controller,
+      std::unique_ptr<views::WebView> content_view,
+      Browser* browser,
+      ui::ModalType dialog_modal_type,
+      bool wait_for_size);
+  ~SigninViewControllerDelegateViews() override;
+
   void PerformClose() override;
   void ResizeNativeView(int height) override;
 
   void DisplayModal();
 
-  ~SigninViewControllerDelegateViews() override;
-
   views::WebView* content_view_;
   views::Widget* modal_signin_widget_;  // Not owned.
+  ui::ModalType dialog_modal_type_;
 
   // wait_for_size_ stores whether the dialog should only be shown after its
   // content's size has been laid out and measured so that the constrained

diff --git a/chrome/common/metrics_constants_util_win.cc b/chrome/common/metrics_constants_util_win.cc
index 165e0a4..d9d14c0 100644
--- a/chrome/common/metrics_constants_util_win.cc
+++ b/chrome/common/metrics_constants_util_win.cc

@@ -14,8 +14,6 @@
   BrowserDistribution* chrome_distribution =
       BrowserDistribution::GetDistribution();
   DCHECK(chrome_distribution);
-  DCHECK_EQ(BrowserDistribution::CHROME_BROWSER,
-            chrome_distribution->GetType());
 
   DCHECK_EQ(L'\\', *suffix);
   DCHECK_NE(L'\\', chrome_distribution->GetRegistryPath().back());

diff --git a/chrome/common/pref_names.cc b/chrome/common/pref_names.cc
index ce4011f..9d5e9a29 100644
--- a/chrome/common/pref_names.cc
+++ b/chrome/common/pref_names.cc

@@ -439,6 +439,9 @@
 const char kDnsPrefetchingHostReferralList[] =
     "dns_prefetching.host_referral_list";
 
+// Controls if the QUIC protocol is allowed.
+const char kQuicAllowed[] = "net.quic_allowed";
+
 // Prefs for persisting HttpServerProperties.
 const char kHttpServerProperties[] = "net.http_server_properties";
 

diff --git a/chrome/common/pref_names.h b/chrome/common/pref_names.h
index b44e6d3..2f4cf12 100644
--- a/chrome/common/pref_names.h
+++ b/chrome/common/pref_names.h

@@ -176,6 +176,7 @@
 extern const char kAlternateErrorPagesEnabled[];
 extern const char kDnsPrefetchingStartupList[];
 extern const char kDnsPrefetchingHostReferralList[];
+extern const char kQuicAllowed[];
 extern const char kHttpServerProperties[];
 extern const char kNetworkQualities[];
 #if defined(OS_ANDROID)

diff --git a/chrome/install_static/chromium_install_modes.cc b/chrome/install_static/chromium_install_modes.cc
index 3e58e0d..7bb5db3e 100644
--- a/chrome/install_static/chromium_install_modes.cc
+++ b/chrome/install_static/chromium_install_modes.cc

@@ -31,7 +31,7 @@
         L"",  // Empty default channel name as above.
         ChannelStrategy::UNSUPPORTED,
         true,  // Supports system-level installs.
-        true,  // Supports multi-install.
+        true,  // Supported multi-install.
     },
 };
 

diff --git a/chrome/install_static/google_chrome_install_modes.cc b/chrome/install_static/google_chrome_install_modes.cc
index 2ee3a261..ad900e7 100644
--- a/chrome/install_static/google_chrome_install_modes.cc
+++ b/chrome/install_static/google_chrome_install_modes.cc

@@ -31,7 +31,7 @@
         L"",  // The empty string means "stable".
         ChannelStrategy::ADDITIONAL_PARAMETERS,
         true,  // Supports system-level installs.
-        true,  // Supports multi-install.
+        true,  // Supported multi-install.
     },
     {
         sizeof(kInstallModes[0]),
@@ -41,7 +41,7 @@
         L"canary",
         ChannelStrategy::FIXED,
         false,  // Does not support system-level installs.
-        false,  // Does not support multi-install.
+        false,  // Did not support multi-install.
     },
 };
 

diff --git a/chrome/install_static/install_constants.h b/chrome/install_static/install_constants.h
index 1b79bceb..a9b07a4e 100644
--- a/chrome/install_static/install_constants.h
+++ b/chrome/install_static/install_constants.h

@@ -58,8 +58,8 @@
   // True if this mode supports system-level installs.
   bool supports_system_level;
 
-  // True if this mode supports multi-install.
-  bool supports_multi_install;
+  // True if this mode supported the now-deprecated multi-install.
+  bool supported_multi_install;
 };
 
 }  // namespace install_static

diff --git a/chrome/install_static/install_details.cc b/chrome/install_static/install_details.cc
index c4d96a2..b0fda62 100644
--- a/chrome/install_static/install_details.cc
+++ b/chrome/install_static/install_details.cc

@@ -26,16 +26,12 @@
 
 }  // namespace
 
-std::wstring InstallDetails::GetClientStateKeyPath(bool binaries) const {
-  return binaries && multi_install()
-             ? GetBinariesClientStateKeyPath()
-             : install_static::GetClientStateKeyPath(app_guid());
+std::wstring InstallDetails::GetClientStateKeyPath() const {
+  return install_static::GetClientStateKeyPath(app_guid());
 }
 
-std::wstring InstallDetails::GetClientStateMediumKeyPath(bool binaries) const {
-  return binaries && multi_install()
-             ? GetBinariesClientStateMediumKeyPath()
-             : install_static::GetClientStateMediumKeyPath(app_guid());
+std::wstring InstallDetails::GetClientStateMediumKeyPath() const {
+  return install_static::GetClientStateMediumKeyPath(app_guid());
 }
 
 bool InstallDetails::VersionMismatch() const {

diff --git a/chrome/install_static/install_details.h b/chrome/install_static/install_details.h
index eca1f4b..f9c0a13b 100644
--- a/chrome/install_static/install_details.h
+++ b/chrome/install_static/install_details.h

@@ -50,9 +50,6 @@
 
     // True if installed in C:\Program Files{, {x86)}; otherwise, false.
     bool system_level;
-
-    // True if multi-install.
-    bool multi_install;
   };
 
   InstallDetails(const InstallDetails&) = delete;
@@ -91,9 +88,9 @@
     return payload_->mode->supports_system_level;
   }
 
-  // True if the mode supports multi-install.
-  bool supports_multi_install() const {
-    return payload_->mode->supports_multi_install;
+  // True if the mode once supported multi-install.
+  bool supported_multi_install() const {
+    return payload_->mode->supported_multi_install;
   }
 
   // The install's update channel, or an empty string if the brand does not
@@ -102,21 +99,16 @@
     return std::wstring(payload_->channel, payload_->channel_length);
   }
   bool system_level() const { return payload_->system_level; }
-  bool multi_install() const { return payload_->multi_install; }
 
-  // Returns the path to the installation's ClientState registry key. Returns
-  // the path for the binaries if |binaries| and Chrome is
-  // multi-install. Otherwise, returns the path for Chrome itself. This registry
-  // key is used to hold various installation-related values, including an
-  // indication of consent for usage stats.
-  std::wstring GetClientStateKeyPath(bool binaries) const;
+  // Returns the path to the installation's ClientState registry key. This
+  // registry key is used to hold various installation-related values, including
+  // an indication of consent for usage stats.
+  std::wstring GetClientStateKeyPath() const;
 
-  // Returns the path to the installation's ClientStateMedium registry key.
-  // Returns the path for the binaries if |binaries| and Chrome is
-  // multi-install. Otherwise, returns the path for Chrome itself. This
+  // Returns the path to the installation's ClientStateMedium registry key. This
   // registry key is used to hold various installation-related values, including
   // an indication of consent for usage stats for a system-level install.
-  std::wstring GetClientStateMediumKeyPath(bool binaries) const;
+  std::wstring GetClientStateMediumKeyPath() const;
 
   // Returns true if there is an indication of a mismatch between the primary
   // module and this module.
@@ -168,9 +160,6 @@
   void set_system_level(bool system_level) {
     payload_.system_level = system_level;
   }
-  void set_multi_install(bool multi_install) {
-    payload_.multi_install = multi_install;
-  }
 
  private:
   std::wstring channel_;

diff --git a/chrome/install_static/install_details_unittest.cc b/chrome/install_static/install_details_unittest.cc
index 1627028..f921dfd 100644
--- a/chrome/install_static/install_details_unittest.cc
+++ b/chrome/install_static/install_details_unittest.cc

@@ -22,7 +22,7 @@
     constants.size = sizeof(constants);
     constants.install_suffix = L"";
     constants.default_channel_name = L"";
-    constants.supports_multi_install = true;
+    constants.supported_multi_install = true;
     if (kUseGoogleUpdateIntegration) {
       constants.app_guid = L"testguid";
       constants.channel_strategy = ChannelStrategy::FIXED;
@@ -57,68 +57,23 @@
 TEST(InstallDetailsTest, GetClientStateKeyPath) {
   FakeInstallDetails details;
   if (kUseGoogleUpdateIntegration) {
-    // Single-install.
-    EXPECT_THAT(details.GetClientStateKeyPath(false),
+    EXPECT_THAT(details.GetClientStateKeyPath(),
                 StrEq(L"Software\\Google\\Update\\ClientState\\testguid"));
-    EXPECT_THAT(details.GetClientStateKeyPath(true),
-                StrEq(L"Software\\Google\\Update\\ClientState\\testguid"));
-
-    // Multi-install.
-    details.payload.multi_install = true;
-    EXPECT_THAT(details.GetClientStateKeyPath(false),
-                StrEq(L"Software\\Google\\Update\\ClientState\\testguid"));
-    EXPECT_THAT(details.GetClientStateKeyPath(true),
-                StrEq(std::wstring(L"Software\\Google\\Update\\ClientState\\")
-                          .append(kBinariesAppGuid)));
   } else {
-    // Single-install.
-    EXPECT_THAT(details.GetClientStateKeyPath(false),
+    EXPECT_THAT(details.GetClientStateKeyPath(),
                 StrEq(std::wstring(L"Software\\").append(kProductPathName)));
-    EXPECT_THAT(details.GetClientStateKeyPath(true),
-                StrEq(std::wstring(L"Software\\").append(kProductPathName)));
-
-    // Multi-install.
-    details.payload.multi_install = true;
-    EXPECT_THAT(details.GetClientStateKeyPath(false),
-                StrEq(std::wstring(L"Software\\").append(kProductPathName)));
-    EXPECT_THAT(details.GetClientStateKeyPath(true),
-                StrEq(std::wstring(L"Software\\").append(kBinariesPathName)));
   }
 }
 
 TEST(InstallDetailsTest, GetClientStateMediumKeyPath) {
   FakeInstallDetails details;
   if (kUseGoogleUpdateIntegration) {
-    // Single-install.
     EXPECT_THAT(
-        details.GetClientStateMediumKeyPath(false),
+        details.GetClientStateMediumKeyPath(),
         StrEq(L"Software\\Google\\Update\\ClientStateMedium\\testguid"));
-    EXPECT_THAT(
-        details.GetClientStateMediumKeyPath(true),
-        StrEq(L"Software\\Google\\Update\\ClientStateMedium\\testguid"));
-
-    // Multi-install.
-    details.payload.multi_install = true;
-    EXPECT_THAT(
-        details.GetClientStateMediumKeyPath(false),
-        StrEq(L"Software\\Google\\Update\\ClientStateMedium\\testguid"));
-    EXPECT_THAT(
-        details.GetClientStateMediumKeyPath(true),
-        StrEq(std::wstring(L"Software\\Google\\Update\\ClientStateMedium\\")
-                  .append(kBinariesAppGuid)));
   } else {
-    // Single-install.
-    EXPECT_THAT(details.GetClientStateKeyPath(false),
+    EXPECT_THAT(details.GetClientStateKeyPath(),
                 StrEq(std::wstring(L"Software\\").append(kProductPathName)));
-    EXPECT_THAT(details.GetClientStateKeyPath(true),
-                StrEq(std::wstring(L"Software\\").append(kProductPathName)));
-
-    // Multi-install.
-    details.payload.multi_install = true;
-    EXPECT_THAT(details.GetClientStateKeyPath(false),
-                StrEq(std::wstring(L"Software\\").append(kProductPathName)));
-    EXPECT_THAT(details.GetClientStateKeyPath(true),
-                StrEq(std::wstring(L"Software\\").append(kBinariesPathName)));
   }
 }
 

diff --git a/chrome/install_static/install_modes.h b/chrome/install_static/install_modes.h
index 31b426ff..687686b 100644
--- a/chrome/install_static/install_modes.h
+++ b/chrome/install_static/install_modes.h

@@ -52,14 +52,14 @@
 // The length, in characters, of kProductPathName not including the terminator.
 extern const size_t kProductPathNameLength;
 
-// The GUID with which the brand's multi-install binaries are registered with
-// Google Update. Must be empty if the brand does not integrate with Google
-// Update.
+// The GUID with which the brand's multi-install binaries were registered with
+// Google Update for modes that once supported the now-deprecated multi-install.
+// Must be empty if the brand does not integrate with Google Update.
 extern const wchar_t kBinariesAppGuid[];
 
 // The name of the registry key in which data for the brand's multi-install
-// binaries are stored. Must be empty if the brand integrates with Google
-// Update.
+// binaries were stored for modes that once supported the now-deprecated
+// multi-install. Must be empty if the brand integrates with Google Update.
 extern const wchar_t kBinariesPathName[];
 
 // A brand's collection of install modes.

diff --git a/chrome/install_static/install_modes_unittest.cc b/chrome/install_static/install_modes_unittest.cc
index ec297f1a..ad8ef9e 100644
--- a/chrome/install_static/install_modes_unittest.cc
+++ b/chrome/install_static/install_modes_unittest.cc

@@ -45,11 +45,11 @@
 
 TEST(InstallModes, VerifyBrand) {
   if (kUseGoogleUpdateIntegration) {
-    // Binaries are registered under an app guid with Google Update integration.
+    // Binaries were registered via an app guid with Google Update integration.
     ASSERT_THAT(kBinariesAppGuid, StrNe(L""));
     ASSERT_THAT(kBinariesPathName, StrEq(L""));
   } else {
-    // Binaries are registered under a different path name without.
+    // Binaries were registered via a different path name without.
     ASSERT_THAT(kBinariesAppGuid, StrEq(L""));
     ASSERT_THAT(kBinariesPathName, StrNe(L""));
   }

diff --git a/chrome/install_static/install_util.cc b/chrome/install_static/install_util.cc
index 9c2f62d8..6098916 100644
--- a/chrome/install_static/install_util.cc
+++ b/chrome/install_static/install_util.cc

@@ -257,21 +257,17 @@
 }
 
 std::wstring ChannelFromAdditionalParameters(const InstallConstants& mode,
-                                             bool system_level,
-                                             bool binaries) {
+                                             bool system_level) {
   assert(kUseGoogleUpdateIntegration);
-  // InitChannelInfo in google_update_settings.cc only reports a failure in the
-  // case of multi-install Chrome where the binaries' ClientState key exists,
-  // but that the "ap" value therein cannot be read due to some reason *other*
-  // than it not being present. This should be exceedingly rare. For
-  // simplicity's sake, use an empty |value| in case of any error whatsoever
-  // here.
+  // InitChannelInfo in google_update_settings.cc only reports a failure when
+  // Chrome's ClientState key exists but that the "ap" value therein cannot be
+  // read due to some reason *other* than it not being present. This should be
+  // exceedingly rare. For simplicity's sake, use an empty |value| in case of
+  // any error whatsoever here.
   std::wstring value;
   nt::QueryRegValueSZ(system_level ? nt::HKLM : nt::HKCU, nt::WOW6432,
-                      (binaries ? GetBinariesClientStateKeyPath()
-                                : GetClientStateKeyPath(mode.app_guid))
-                          .c_str(),
-                      kRegValueAp, &value);
+                      GetClientStateKeyPath(mode.app_guid).c_str(), kRegValueAp,
+                      &value);
 
   static constexpr wchar_t kChromeChannelBetaPattern[] = L"1?1-*";
   static constexpr wchar_t kChromeChannelBetaX64Pattern[] = L"*x64-beta*";
@@ -294,7 +290,7 @@
   }
   // Else report values with garbage as stable since they will match the stable
   // rules in the update configs. ChannelInfo::GetChannelName painstakingly
-  // strips off known modifiers (e.g., "-multi-full") to see if the empty string
+  // strips off known modifiers (e.g., "-full") to see if the empty string
   // remains, returning channel "unknown" if not. This differs here in that some
   // clients will tag crashes as "stable" rather than "unknown" via this
   // codepath, but it is an accurate reflection of which update channel the
@@ -309,10 +305,6 @@
   return InstallDetails::Get().system_level();
 }
 
-bool IsMultiInstall() {
-  return InstallDetails::Get().multi_install();
-}
-
 bool GetCollectStatsConsent() {
   bool enabled = true;
 
@@ -327,7 +319,7 @@
   if (system_install &&
       nt::QueryRegValueDWORD(
           nt::HKLM, nt::WOW6432,
-          InstallDetails::Get().GetClientStateMediumKeyPath(true).c_str(),
+          InstallDetails::Get().GetClientStateMediumKeyPath().c_str(),
           kRegValueUsageStats, &out_value)) {
     return (out_value == 1);
   }
@@ -335,7 +327,7 @@
   // Second, try ClientState.
   return (nt::QueryRegValueDWORD(
               system_install ? nt::HKLM : nt::HKCU, nt::WOW6432,
-              InstallDetails::Get().GetClientStateKeyPath(true).c_str(),
+              InstallDetails::Get().GetClientStateKeyPath().c_str(),
               kRegValueUsageStats, &out_value) &&
           out_value == 1);
 }
@@ -513,16 +505,11 @@
       GetValueFromVersionResource(data.get(), L"SpecialBuild", special_build);
     }
   }
-  *channel_name = GetChromeChannelName(true /* add_modifier */);
+  *channel_name = GetChromeChannelName();
 }
 
-std::wstring GetChromeChannelName(bool add_modifier) {
-  const std::wstring& channel = InstallDetails::Get().channel();
-  if (!add_modifier || !IsMultiInstall())
-    return channel;
-  if (channel.empty())
-    return L"m";
-  return channel + L"-m";
+std::wstring GetChromeChannelName() {
+  return InstallDetails::Get().channel();
 }
 
 std::wstring GetBrowserCrashDumpAttemptsRegistryPath() {
@@ -748,9 +735,7 @@
 
 // This function takes these inputs rather than accessing the module's
 // InstallDetails instance since it is used to bootstrap InstallDetails.
-std::wstring DetermineChannel(const InstallConstants& mode,
-                              bool system_level,
-                              bool multi_install) {
+std::wstring DetermineChannel(const InstallConstants& mode, bool system_level) {
   if (!kUseGoogleUpdateIntegration)
     return std::wstring();
 
@@ -759,7 +744,7 @@
       assert(false);
       break;
     case ChannelStrategy::ADDITIONAL_PARAMETERS:
-      return ChannelFromAdditionalParameters(mode, system_level, multi_install);
+      return ChannelFromAdditionalParameters(mode, system_level);
     case ChannelStrategy::FIXED:
       return mode.default_channel_name;
   }

diff --git a/chrome/install_static/install_util.h b/chrome/install_static/install_util.h
index d411702..17c11b7f 100644
--- a/chrome/install_static/install_util.h
+++ b/chrome/install_static/install_util.h

@@ -53,9 +53,6 @@
 // Returns true if Chrome is running at system level.
 bool IsSystemInstall();
 
-// Returns true if current installation of Chrome is a multi-install.
-bool IsMultiInstall();
-
 // Returns true if usage stats collecting is enabled for this user for the
 // current executable.
 bool GetCollectStatsConsent();
@@ -125,13 +122,10 @@
                                  std::wstring* channel_name);
 
 // Gets the channel name for the current Chrome process.
-// If |add_modifier| is true the channel name is returned with the modifier
-// prepended to it. Currently this is only done for multi installs, i.e (-m)
-// is the only modifier supported.
 // TODO(ananta)
 // http://crbug.com/604923
 // Unify this with the Browser Distribution code.
-std::wstring GetChromeChannelName(bool add_modifier);
+std::wstring GetChromeChannelName();
 
 // Returns the registry path where the browser crash dumps metrics need to be
 // written to.
@@ -184,9 +178,7 @@
 
 // Returns the unadorned channel name based on the channel strategy for the
 // install mode.
-std::wstring DetermineChannel(const InstallConstants& mode,
-                              bool system_level,
-                              bool multi_install);
+std::wstring DetermineChannel(const InstallConstants& mode, bool system_level);
 
 // Caches the |ProcessType| of the current process.
 extern ProcessType g_process_type;

diff --git a/chrome/install_static/install_util_unittest.cc b/chrome/install_static/install_util_unittest.cc
index 40f53fd..b4ba97b7 100644
--- a/chrome/install_static/install_util_unittest.cc
+++ b/chrome/install_static/install_util_unittest.cc

@@ -267,20 +267,17 @@
 
 class InstallStaticUtilTest
     : public ::testing::TestWithParam<
-          std::tuple<InstallConstantIndex, const char*, const char*>> {
+          std::tuple<InstallConstantIndex, const char*>> {
  protected:
   InstallStaticUtilTest() {
     InstallConstantIndex mode_index;
     const char* level;
-    const char* mode;
 
-    std::tie(mode_index, level, mode) = GetParam();
+    std::tie(mode_index, level) = GetParam();
 
     mode_ = &kInstallModes[mode_index];
     system_level_ = std::string(level) != "user";
     EXPECT_TRUE(!system_level_ || mode_->supports_system_level);
-    multi_install_ = std::string(mode) != "single";
-    EXPECT_TRUE(!multi_install_ || mode_->supports_multi_install);
     root_key_ = system_level_ ? HKEY_LOCAL_MACHINE : HKEY_CURRENT_USER;
     nt_root_key_ = system_level_ ? nt::HKLM : nt::HKCU;
 
@@ -289,7 +286,6 @@
     details->set_mode(mode_);
     details->set_channel(mode_->default_channel_name);
     details->set_system_level(system_level_);
-    details->set_multi_install(multi_install_);
     InstallDetails::SetForProcess(std::move(details));
 
     base::string16 path;
@@ -304,8 +300,6 @@
 
   bool system_level() const { return system_level_; }
 
-  bool multi_install() const { return multi_install_; }
-
   const wchar_t* default_channel() const { return mode_->default_channel_name; }
 
   void SetUsageStat(DWORD value, bool medium) {
@@ -341,12 +335,7 @@
       if (medium)
         result.append(L"Medium");
       result.push_back(L'\\');
-      if (multi_install_)
-        result.append(kBinariesAppGuid);
-      else
-        result.append(mode_->app_guid);
-    } else if (multi_install_) {
-      result.append(kBinariesPathName);
+      result.append(mode_->app_guid);
     } else {
       result.append(kProductPathName);
     }
@@ -358,7 +347,6 @@
   nt::ROOT_KEY nt_root_key_ = nt::AUTO;
   const InstallConstants* mode_ = nullptr;
   bool system_level_ = false;
-  bool multi_install_ = false;
 
   DISALLOW_COPY_AND_ASSIGN(InstallStaticUtilTest);
 };
@@ -423,37 +411,26 @@
 }
 
 TEST_P(InstallStaticUtilTest, GetChromeChannelName) {
-  EXPECT_EQ(default_channel(), GetChromeChannelName(false));
-  std::wstring expected = default_channel();
-  if (multi_install()) {
-    if (expected.empty())
-      expected = L"m";
-    else
-      expected += L"-m";
-  }
-  EXPECT_EQ(expected, GetChromeChannelName(true));
+  EXPECT_EQ(default_channel(), GetChromeChannelName());
 }
 
 #if defined(GOOGLE_CHROME_BUILD)
-// Stable supports multi-install at user and system levels.
+// Stable supports user and system levels.
 INSTANTIATE_TEST_CASE_P(Stable,
                         InstallStaticUtilTest,
                         testing::Combine(testing::Values(STABLE_INDEX),
-                                         testing::Values("user", "system"),
-                                         testing::Values("single", "multi")));
-// Canary is single-only at user level.
+                                         testing::Values("user", "system")));
+// Canary is only at user level.
 INSTANTIATE_TEST_CASE_P(Canary,
                         InstallStaticUtilTest,
                         testing::Combine(testing::Values(CANARY_INDEX),
-                                         testing::Values("user"),
-                                         testing::Values("single")));
+                                         testing::Values("user")));
 #else   // GOOGLE_CHROME_BUILD
-// Chromium supports multi-install at user and system levels.
+// Chromium supports user and system levels.
 INSTANTIATE_TEST_CASE_P(Chromium,
                         InstallStaticUtilTest,
                         testing::Combine(testing::Values(CHROMIUM_INDEX),
-                                         testing::Values("user", "system"),
-                                         testing::Values("single", "multi")));
+                                         testing::Values("user", "system")));
 #endif  // !GOOGLE_CHROME_BUILD
 
 }  // namespace install_static

diff --git a/chrome/install_static/product_install_details.cc b/chrome/install_static/product_install_details.cc
index 9af5b2f..cef942b4 100644
--- a/chrome/install_static/product_install_details.cc
+++ b/chrome/install_static/product_install_details.cc

@@ -5,7 +5,6 @@
 #include "chrome/install_static/product_install_details.h"
 
 #include <windows.h>
-#include <assert.h>
 
 #include <algorithm>
 
@@ -119,15 +118,6 @@
                       (name - scan) - kProductPathNameLength);
 }
 
-bool IsMultiInstall(const InstallConstants& mode, bool system_level) {
-  assert(mode.supports_multi_install);
-  std::wstring args;
-  return nt::QueryRegValueSZ(system_level ? nt::HKLM : nt::HKCU, nt::WOW6432,
-                             GetClientStateKeyPath(mode.app_guid).c_str(),
-                             L"UninstallArguments", &args) &&
-         args.find(L"--multi-install") != std::wstring::npos;
-}
-
 std::unique_ptr<PrimaryInstallDetails> MakeProductDetails(
     const std::wstring& exe_path) {
   std::unique_ptr<PrimaryInstallDetails> details(new PrimaryInstallDetails());
@@ -135,13 +125,10 @@
   const InstallConstants* mode = FindInstallMode(GetInstallSuffix(exe_path));
   const bool system_level =
       mode->supports_system_level && PathIsInProgramFiles(exe_path);
-  const bool multi_install =
-      mode->supports_multi_install && IsMultiInstall(*mode, system_level);
 
   details->set_mode(mode);
   details->set_system_level(system_level);
-  details->set_multi_install(multi_install);
-  details->set_channel(DetermineChannel(*mode, system_level, multi_install));
+  details->set_channel(DetermineChannel(*mode, system_level));
 
   return details;
 }

diff --git a/chrome/install_static/product_install_details.h b/chrome/install_static/product_install_details.h
index 54843b6c..99e2784d 100644
--- a/chrome/install_static/product_install_details.h
+++ b/chrome/install_static/product_install_details.h

@@ -12,7 +12,6 @@
 
 namespace install_static {
 
-struct InstallConstants;
 class PrimaryInstallDetails;
 
 // Creates product details for the current process and sets them as the global
@@ -36,10 +35,6 @@
 // "...\[kProductName][suffix]\Application".
 std::wstring GetInstallSuffix(const std::wstring& exe_path);
 
-// Returns true if the browser of |mode| at |system_level| is registered as
-// being multi-install.
-bool IsMultiInstall(const InstallConstants& mode, bool system_level);
-
 // Creates product details for the process at |exe_path|.
 std::unique_ptr<PrimaryInstallDetails> MakeProductDetails(
     const std::wstring& exe_path);

diff --git a/chrome/install_static/product_install_details_unittest.cc b/chrome/install_static/product_install_details_unittest.cc
index 15bb5ec2..cdea80c 100644
--- a/chrome/install_static/product_install_details_unittest.cc
+++ b/chrome/install_static/product_install_details_unittest.cc

@@ -184,38 +184,20 @@
 
   const TestData& test_data() const { return test_data_; }
 
-  void SetUninstallArguments(const wchar_t* value) {
-    ASSERT_THAT(
-        base::win::RegKey(root_key_, GetClientStateKeyPath(false).c_str(),
-                          KEY_WOW64_32KEY | KEY_SET_VALUE)
-            .WriteValue(L"UninstallArguments", value),
-        Eq(ERROR_SUCCESS));
-  }
-
-  void SetAp(const wchar_t* value, bool binaries) {
-    ASSERT_TRUE(!binaries ||
-                kInstallModes[test_data().index].supports_multi_install);
-    ASSERT_THAT(
-        base::win::RegKey(root_key_, GetClientStateKeyPath(binaries).c_str(),
-                          KEY_WOW64_32KEY | KEY_SET_VALUE)
-            .WriteValue(L"ap", value),
-        Eq(ERROR_SUCCESS));
+  void SetAp(const wchar_t* value) {
+    ASSERT_THAT(base::win::RegKey(root_key_, GetClientStateKeyPath().c_str(),
+                                  KEY_WOW64_32KEY | KEY_SET_VALUE)
+                    .WriteValue(L"ap", value),
+                Eq(ERROR_SUCCESS));
   }
 
  private:
   // Returns the registry path for the product's ClientState key.
-  std::wstring GetClientStateKeyPath(bool binaries) {
-    EXPECT_TRUE(!binaries ||
-                kInstallModes[test_data().index].supports_multi_install);
+  std::wstring GetClientStateKeyPath() {
     std::wstring result(L"Software\\");
     if (kUseGoogleUpdateIntegration) {
       result.append(L"Google\\Update\\ClientState\\");
-      if (binaries)
-        result.append(kBinariesAppGuid);
-      else
-        result.append(kInstallModes[test_data().index].app_guid);
-    } else if (binaries) {
-      result.append(kBinariesPathName);
+      result.append(kInstallModes[test_data().index].app_guid);
     } else {
       result.append(kProductPathName);
     }
@@ -251,32 +233,6 @@
   EXPECT_THAT(details->channel(), StrEq(test_data().channel));
 }
 
-// Test that multi-install is properly parsed out of the registry.
-TEST_P(MakeProductDetailsTest, MultiInstall) {
-  {
-    std::unique_ptr<PrimaryInstallDetails> details(
-        MakeProductDetails(test_data().path));
-    EXPECT_FALSE(details->multi_install());
-  }
-
-  {
-    SetUninstallArguments(L"--uninstall");
-    std::unique_ptr<PrimaryInstallDetails> details(
-        MakeProductDetails(test_data().path));
-    EXPECT_FALSE(details->multi_install());
-  }
-
-  if (!kInstallModes[test_data().index].supports_multi_install)
-    return;
-
-  {
-    SetUninstallArguments(L"--uninstall --multi-install --chrome");
-    std::unique_ptr<PrimaryInstallDetails> details(
-        MakeProductDetails(test_data().path));
-    EXPECT_TRUE(details->multi_install());
-  }
-}
-
 // Test that the channel name is properly parsed out of additional parameters.
 TEST_P(MakeProductDetailsTest, AdditionalParametersChannels) {
   const std::pair<const wchar_t*, const wchar_t*> kApChannels[] = {
@@ -292,10 +248,10 @@
       {L"1.0-dev", L""},
       {L"fuzzy", L""},
       {L"foo", L""},
-      {L"-multi-chrome", L""},
-      {L"x64-stable-multi-chrome", L""},
-      {L"-stage:ensemble_patching-multi-chrome-full", L""},
-      {L"-multi-chrome-full", L""},
+      {L"-multi-chrome", L""},                               // Legacy.
+      {L"x64-stable-multi-chrome", L""},                     // Legacy.
+      {L"-stage:ensemble_patching-multi-chrome-full", L""},  // Legacy.
+      {L"-multi-chrome-full", L""},                          // Legacy.
       // beta
       {L"1.1-beta", L"beta"},
       {L"1.1-beta-full", L"beta"},
@@ -317,25 +273,7 @@
   };
 
   for (const auto& ap_and_channel : kApChannels) {
-    SetAp(ap_and_channel.first, false);
-    std::unique_ptr<PrimaryInstallDetails> details(
-        MakeProductDetails(test_data().path));
-    if (kInstallModes[test_data().index].channel_strategy ==
-        ChannelStrategy::ADDITIONAL_PARAMETERS) {
-      EXPECT_THAT(details->channel(), StrEq(ap_and_channel.second));
-    } else {
-      // "ap" is ignored for this mode.
-      EXPECT_THAT(details->channel(), StrEq(test_data().channel));
-    }
-  }
-
-  if (!kInstallModes[test_data().index].supports_multi_install)
-    return;
-
-  // For multi-install modes, "ap" is pulled from the binaries' key.
-  for (const auto& ap_and_channel : kApChannels) {
-    SetAp(ap_and_channel.first, true);
-    SetUninstallArguments(L"--uninstall --multi-install --chrome");
+    SetAp(ap_and_channel.first);
     std::unique_ptr<PrimaryInstallDetails> details(
         MakeProductDetails(test_data().path));
     if (kInstallModes[test_data().index].channel_strategy ==

diff --git a/chrome/installer/setup/install.cc b/chrome/installer/setup/install.cc
index 2ef556d..6363288 100644
--- a/chrome/installer/setup/install.cc
+++ b/chrome/installer/setup/install.cc

@@ -431,8 +431,6 @@
                              const installer::Product& product,
                              bool make_chrome_default,
                              const base::Version& version) {
-  DCHECK(product.is_chrome());
-
   // Try to add Chrome to Media Player shim inclusion list. We don't do any
   // error checking here because this operation will fail if user doesn't
   // have admin rights and we want to ignore the error.

diff --git a/chrome/installer/setup/installer_crash_reporting.cc b/chrome/installer/setup/installer_crash_reporting.cc
index 961979d7..137913a 100644
--- a/chrome/installer/setup/installer_crash_reporting.cc
+++ b/chrome/installer/setup/installer_crash_reporting.cc

@@ -32,7 +32,6 @@
 // Crash Keys
 
 const char kCurrentVersion[] = "current-version";
-const char kIsMultiInstall[] = "multi-install";
 const char kIsSystemLevel[] = "system-level";
 const char kOperation[] = "operation";
 const char kStateKey[] = "state-key";
@@ -105,7 +104,6 @@
   const base::debug::CrashKey kFixedKeys[] = {
     { crash_keys::kMetricsClientId, crash_keys::kSmallSize },
     { kCurrentVersion, crash_keys::kSmallSize },
-    { kIsMultiInstall, crash_keys::kSmallSize },
     { kIsSystemLevel, crash_keys::kSmallSize },
     { kOperation, crash_keys::kSmallSize },
 
@@ -126,7 +124,6 @@
   using base::debug::SetCrashKeyValue;
 
   SetCrashKeyValue(kOperation, OperationToString(state.operation()));
-  SetCrashKeyValue(kIsMultiInstall, "false");
   SetCrashKeyValue(kIsSystemLevel, state.system_install() ? "true" : "false");
 
   const base::string16 state_key = state.state_key();

diff --git a/chrome/installer/setup/installer_state.cc b/chrome/installer/setup/installer_state.cc
index 2bd2bd4..bcc1379 100644
--- a/chrome/installer/setup/installer_state.cc
+++ b/chrome/installer/setup/installer_state.cc

@@ -112,7 +112,7 @@
 // debug builds.  See the log messages for details.
 bool InstallerState::CanAddProduct(const base::FilePath* product_dir) const {
   if (product_) {
-    LOG(DFATAL) << "Cannot process more than one single-install product.";
+    LOG(DFATAL) << "Cannot process more than one product.";
     return false;
   }
   return true;
@@ -127,7 +127,6 @@
     std::unique_ptr<Product> product) {
   DCHECK(product);
   const Product& the_product = *product;
-  DCHECK(!the_product.HasOption(kOptionMultiInstall));
 
   if (!CanAddProduct(product_dir))
     return nullptr;
@@ -158,7 +157,6 @@
     const InstallationState& machine_state) {
   std::unique_ptr<Product> product_ptr(
       new Product(BrowserDistribution::GetDistribution()));
-  product_ptr->InitializeFromPreferences(prefs);
 
   Product* product = AddProductInDirectory(nullptr, std::move(product_ptr));
 
@@ -176,7 +174,6 @@
     const ProductState& state) {
   std::unique_ptr<Product> product_ptr(
       new Product(BrowserDistribution::GetDistribution()));
-  product_ptr->InitializeFromUninstallCommand(state.uninstall_command());
 
   // Strip off <version>/Installer/setup.exe; see GetInstallerDirectory().
   base::FilePath product_dir =

diff --git a/chrome/installer/setup/installer_state_unittest.cc b/chrome/installer/setup/installer_state_unittest.cc
index 3e9ad2c..8e60e258 100644
--- a/chrome/installer/setup/installer_state_unittest.cc
+++ b/chrome/installer/setup/installer_state_unittest.cc

@@ -27,7 +27,6 @@
 #include "chrome/installer/util/fake_installation_state.h"
 #include "chrome/installer/util/fake_product_state.h"
 #include "chrome/installer/util/google_update_constants.h"
-#include "chrome/installer/util/helper.h"
 #include "chrome/installer/util/installation_state.h"
 #include "chrome/installer/util/installer_util_strings.h"
 #include "chrome/installer/util/master_preferences.h"
@@ -151,30 +150,6 @@
   }
 }
 
-// Test GetCurrentVersion when migrating single Chrome to multi
-TEST_F(InstallerStateTest, GetCurrentVersionMigrateChrome) {
-  using installer::FakeInstallationState;
-
-  const bool system_install = false;
-  FakeInstallationState machine_state;
-
-  // Pretend that this version of single-install Chrome is already installed.
-  machine_state.AddChrome(system_install,
-                          new base::Version(chrome::kChromeVersion));
-
-  // Now we're invoked to install multi Chrome.
-  base::CommandLine cmd_line(
-      base::CommandLine::FromString(L"setup.exe --multi-install --chrome"));
-  MasterPreferences prefs(cmd_line);
-  InstallerState installer_state;
-  installer_state.Initialize(cmd_line, prefs, machine_state);
-
-  // Is the Chrome version picked up?
-  std::unique_ptr<base::Version> version(
-      installer_state.GetCurrentVersion(machine_state));
-  EXPECT_TRUE(version.get() != NULL);
-}
-
 TEST_F(InstallerStateTest, InitializeTwice) {
   // Override these paths so that they can be found after the registry override
   // manager is in place.
@@ -214,7 +189,7 @@
   EXPECT_EQ(installer_state.state_key(),
             BrowserDistribution::GetDistribution()->GetStateKey());
 
-  // Now initialize it to install system-level single Chrome.
+  // Now initialize it to install system-level Chrome.
   {
     base::CommandLine cmd_line(base::CommandLine::FromString(
         L"setup.exe --system-level --verbose-logging"));

diff --git a/chrome/installer/setup/setup_util.cc b/chrome/installer/setup/setup_util.cc
index f9a3c36..52f1a4b4 100644
--- a/chrome/installer/setup/setup_util.cc
+++ b/chrome/installer/setup/setup_util.cc

@@ -26,10 +26,8 @@
 #include "base/memory/ptr_util.h"
 #include "base/metrics/histogram.h"
 #include "base/numerics/safe_conversions.h"
-#include "base/strings/string_number_conversions.h"
 #include "base/strings/string_util.h"
 #include "base/strings/utf_string_conversions.h"
-#include "base/time/time.h"
 #include "base/version.h"
 #include "base/win/registry.h"
 #include "base/win/windows_version.h"
@@ -38,6 +36,7 @@
 #include "chrome/installer/setup/user_hive_visitor.h"
 #include "chrome/installer/util/app_registration_data.h"
 #include "chrome/installer/util/google_update_constants.h"
+#include "chrome/installer/util/google_update_settings.h"
 #include "chrome/installer/util/install_util.h"
 #include "chrome/installer/util/installation_state.h"
 #include "chrome/installer/util/master_preferences.h"
@@ -73,41 +72,14 @@
 // ClientState key for a user) indicates that Chrome has been used within the
 // last 28 days.
 bool IsActivelyUsedIn(HKEY root, const wchar_t* key_path) {
-  // This duplicates some logic in GoogleUpdateSettings::GetLastRunTime, which
-  // is suitable for use from the context of Chrome but not from the installer
-  // because it was implemented with the assumption that
-  // BrowserDistribution::GetDistribution() will always be the right thing.
-  // This is true in Chrome, but not in the installer in a multi-install world.
-  // Once multi-install goes away, this assumption will once again become true
-  // for the installer, and this new code here can then be deleted.
   VLOG(1) << "IsActivelyUsedIn probing " << root << "\\" << key_path;
-  base::win::RegKey key;
-  LONG result = key.Open(root, key_path, KEY_WOW64_32KEY | KEY_QUERY_VALUE);
-  if (result != ERROR_SUCCESS) {
-    ::SetLastError(result);
-    PLOG_IF(ERROR, result != ERROR_FILE_NOT_FOUND) << "Failed opening " << root
-                                                   << "\\" << key_path;
-    return false;
+  int days_ago_last_run = GoogleUpdateSettings::GetLastRunTime();
+  if (days_ago_last_run >= 0) {
+    VLOG(1) << "Found a user that last ran Chrome " << days_ago_last_run
+            << " days ago.";
+    return days_ago_last_run <= 28;
   }
-  base::string16 last_run_time_string;
-  result =
-      key.ReadValue(google_update::kRegLastRunTimeField, &last_run_time_string);
-  if (result != ERROR_SUCCESS) {
-    ::SetLastError(result);
-    PLOG_IF(ERROR, result != ERROR_FILE_NOT_FOUND)
-        << "Failed reading " << root << "\\" << key_path << "@"
-        << google_update::kRegLastRunTimeField;
-    return false;
-  }
-  int64_t last_run_time_value = 0;
-  if (!base::StringToInt64(last_run_time_string, &last_run_time_value))
-    return false;
-  base::Time last_run_time = base::Time::FromInternalValue(last_run_time_value);
-  int days_ago_last_run =
-      (base::Time::NowFromSystemTime() - last_run_time).InDays();
-  VLOG(1) << "Found a user that last ran Chrome " << days_ago_last_run
-          << " days ago.";
-  return days_ago_last_run <= 28;
+  return false;
 }
 
 // A visitor for user hives, run by VisitUserHives. |client_state_path| is the

diff --git a/chrome/installer/util/browser_distribution.cc b/chrome/installer/util/browser_distribution.cc
index 8e83dda2..41be776 100644
--- a/chrome/installer/util/browser_distribution.cc
+++ b/chrome/installer/util/browser_distribution.cc

@@ -41,21 +41,16 @@
 
 // The BrowserDistribution objects are never freed.
 BrowserDistribution* g_browser_distribution = NULL;
-BrowserDistribution::Type GetCurrentDistributionType() {
-  return BrowserDistribution::CHROME_BROWSER;
-}
 
 }  // namespace
 
 BrowserDistribution::BrowserDistribution()
-    : type_(CHROME_BROWSER),
-      app_reg_data_(base::MakeUnique<NonUpdatingAppRegistrationData>(
+    : app_reg_data_(base::MakeUnique<NonUpdatingAppRegistrationData>(
           L"Software\\Chromium")) {}
 
 BrowserDistribution::BrowserDistribution(
-    Type type,
     std::unique_ptr<AppRegistrationData> app_reg_data)
-    : type_(type), app_reg_data_(std::move(app_reg_data)) {}
+    : app_reg_data_(std::move(app_reg_data)) {}
 
 BrowserDistribution::~BrowserDistribution() {}
 
@@ -73,14 +68,8 @@
   return *dist;
 }
 
-BrowserDistribution* BrowserDistribution::GetDistribution() {
-  return GetSpecificDistribution(GetCurrentDistributionType());
-}
-
 // static
-BrowserDistribution* BrowserDistribution::GetSpecificDistribution(
-    BrowserDistribution::Type type) {
-  DCHECK_EQ(type, CHROME_BROWSER);
+BrowserDistribution* BrowserDistribution::GetDistribution() {
   BrowserDistribution* dist = NULL;
 
 #if defined(GOOGLE_CHROME_BUILD)

diff --git a/chrome/installer/util/browser_distribution.h b/chrome/installer/util/browser_distribution.h
index 8894824..0fe1cf2 100644
--- a/chrome/installer/util/browser_distribution.h
+++ b/chrome/installer/util/browser_distribution.h

@@ -25,12 +25,6 @@
 
 class BrowserDistribution {
  public:
-  // TODO(grt): Remove Type.
-  enum Type {
-    CHROME_BROWSER,
-    NUM_TYPES
-  };
-
   enum Subfolder {
     SUBFOLDER_CHROME,
     SUBFOLDER_APPS,
@@ -46,10 +40,6 @@
 
   static BrowserDistribution* GetDistribution();
 
-  static BrowserDistribution* GetSpecificDistribution(Type type);
-
-  Type GetType() const { return type_; }
-
   // Getter and adaptors for the underlying |app_reg_data_|.
   const AppRegistrationData& GetAppRegistrationData() const;
   base::string16 GetAppGuid() const;
@@ -155,15 +145,13 @@
   virtual bool HasUserExperiments();
 
  protected:
-  BrowserDistribution(Type type,
-                      std::unique_ptr<AppRegistrationData> app_reg_data);
+  explicit BrowserDistribution(
+      std::unique_ptr<AppRegistrationData> app_reg_data);
 
   template<class DistributionClass>
   static BrowserDistribution* GetOrCreateBrowserDistribution(
       BrowserDistribution** dist);
 
-  const Type type_;
-
   std::unique_ptr<AppRegistrationData> app_reg_data_;
 
  private:

diff --git a/chrome/installer/util/chrome_browser_operations.cc b/chrome/installer/util/chrome_browser_operations.cc
index 99397dd..a9ed6cb 100644
--- a/chrome/installer/util/chrome_browser_operations.cc
+++ b/chrome/installer/util/chrome_browser_operations.cc

@@ -6,91 +6,27 @@
 
 #include "base/command_line.h"
 #include "base/files/file_path.h"
-#include "base/files/file_util.h"
 #include "base/logging.h"
-#include "base/strings/string_util.h"
 #include "chrome/installer/util/browser_distribution.h"
-#include "chrome/installer/util/channel_info.h"
-#include "chrome/installer/util/helper.h"
 #include "chrome/installer/util/install_util.h"
-#include "chrome/installer/util/master_preferences.h"
-#include "chrome/installer/util/master_preferences_constants.h"
 #include "chrome/installer/util/shell_util.h"
 #include "chrome/installer/util/user_experiment.h"
 #include "chrome/installer/util/util_constants.h"
 
 namespace installer {
 
-void ChromeBrowserOperations::ReadOptions(const MasterPreferences& prefs,
-                                          std::set<base::string16>* options)
-    const {
-  DCHECK(options);
-
-  bool pref_value;
-
-  if (prefs.GetBool(master_preferences::kMultiInstall, &pref_value) &&
-      pref_value) {
-    options->insert(kOptionMultiInstall);
-  }
-}
-
-void ChromeBrowserOperations::ReadOptions(
-    const base::CommandLine& uninstall_command,
-    std::set<base::string16>* options) const {
-  DCHECK(options);
-
-  if (uninstall_command.HasSwitch(switches::kMultiInstall))
-    options->insert(kOptionMultiInstall);
-}
-
 void ChromeBrowserOperations::AddKeyFiles(
-    const std::set<base::string16>& options,
     std::vector<base::FilePath>* key_files) const {
   DCHECK(key_files);
   key_files->push_back(base::FilePath(installer::kChromeDll));
 }
 
 void ChromeBrowserOperations::AppendProductFlags(
-    const std::set<base::string16>& options,
     base::CommandLine* cmd_line) const {
-  DCHECK(cmd_line);
-
-  if (options.find(kOptionMultiInstall) != options.end()) {
-    // Add --multi-install if it isn't already there.
-    if (!cmd_line->HasSwitch(switches::kMultiInstall))
-      cmd_line->AppendSwitch(switches::kMultiInstall);
-
-    // --chrome is only needed in multi-install.
-    cmd_line->AppendSwitch(switches::kChrome);
-  }
 }
 
 void ChromeBrowserOperations::AppendRenameFlags(
-    const std::set<base::string16>& options,
     base::CommandLine* cmd_line) const {
-  DCHECK(cmd_line);
-
-  // Add --multi-install if it isn't already there.
-  if (options.find(kOptionMultiInstall) != options.end() &&
-      !cmd_line->HasSwitch(switches::kMultiInstall)) {
-    cmd_line->AppendSwitch(switches::kMultiInstall);
-  }
-}
-
-bool ChromeBrowserOperations::SetChannelFlags(
-    const std::set<base::string16>& options,
-    bool set,
-    ChannelInfo* channel_info) const {
-#if defined(GOOGLE_CHROME_BUILD)
-  DCHECK(channel_info);
-  bool chrome_changed = channel_info->SetChrome(set);
-  // Remove App Launcher's channel flags, since App Launcher does not exist as
-  // an independent product, and is a part of Chrome.
-  bool app_launcher_changed = channel_info->SetAppLauncher(false);
-  return chrome_changed || app_launcher_changed;
-#else
-  return false;
-#endif
 }
 
 // Modifies a ShortcutProperties object by adding default values to
@@ -121,11 +57,10 @@
 
 void ChromeBrowserOperations::LaunchUserExperiment(
     const base::FilePath& setup_path,
-    const std::set<base::string16>& options,
     InstallStatus status,
     bool system_level) const {
   base::CommandLine base_command(setup_path);
-  AppendProductFlags(options, &base_command);
+  AppendProductFlags(&base_command);
   installer::LaunchBrowserUserExperiment(base_command, status, system_level);
 }
 

diff --git a/chrome/installer/util/chrome_browser_operations.h b/chrome/installer/util/chrome_browser_operations.h
index d7e02dc..ecdb837 100644
--- a/chrome/installer/util/chrome_browser_operations.h
+++ b/chrome/installer/util/chrome_browser_operations.h

@@ -5,7 +5,6 @@
 #ifndef CHROME_INSTALLER_UTIL_CHROME_BROWSER_OPERATIONS_H_
 #define CHROME_INSTALLER_UTIL_CHROME_BROWSER_OPERATIONS_H_
 
-#include "base/compiler_specific.h"
 #include "base/macros.h"
 #include "chrome/installer/util/product_operations.h"
 
@@ -16,24 +15,11 @@
  public:
   ChromeBrowserOperations() {}
 
-  void ReadOptions(const MasterPreferences& prefs,
-                   std::set<base::string16>* options) const override;
+  void AddKeyFiles(std::vector<base::FilePath>* key_files) const override;
 
-  void ReadOptions(const base::CommandLine& uninstall_command,
-                   std::set<base::string16>* options) const override;
+  void AppendProductFlags(base::CommandLine* cmd_line) const override;
 
-  void AddKeyFiles(const std::set<base::string16>& options,
-                   std::vector<base::FilePath>* key_files) const override;
-
-  void AppendProductFlags(const std::set<base::string16>& options,
-                          base::CommandLine* cmd_line) const override;
-
-  void AppendRenameFlags(const std::set<base::string16>& options,
-                         base::CommandLine* cmd_line) const override;
-
-  bool SetChannelFlags(const std::set<base::string16>& options,
-                       bool set,
-                       ChannelInfo* channel_info) const override;
+  void AppendRenameFlags(base::CommandLine* cmd_line) const override;
 
   void AddDefaultShortcutProperties(
       BrowserDistribution* dist,
@@ -41,7 +27,6 @@
       ShellUtil::ShortcutProperties* properties) const override;
 
   void LaunchUserExperiment(const base::FilePath& setup_path,
-                            const std::set<base::string16>& options,
                             InstallStatus status,
                             bool system_level) const override;
 

diff --git a/chrome/installer/util/chrome_browser_sxs_operations.cc b/chrome/installer/util/chrome_browser_sxs_operations.cc
index 71798c3..d3a5250 100644
--- a/chrome/installer/util/chrome_browser_sxs_operations.cc
+++ b/chrome/installer/util/chrome_browser_sxs_operations.cc

@@ -11,21 +11,19 @@
 namespace installer {
 
 void ChromeBrowserSxSOperations::AppendProductFlags(
-    const std::set<base::string16>& options,
     base::CommandLine* cmd_line) const {
   DCHECK(cmd_line);
 
   cmd_line->AppendSwitch(switches::kChromeSxS);
-  ChromeBrowserOperations::AppendProductFlags(options, cmd_line);
+  ChromeBrowserOperations::AppendProductFlags(cmd_line);
 }
 
 void ChromeBrowserSxSOperations::AppendRenameFlags(
-    const std::set<base::string16>& options,
     base::CommandLine* cmd_line) const {
   DCHECK(cmd_line);
 
   cmd_line->AppendSwitch(switches::kChromeSxS);
-  ChromeBrowserOperations::AppendRenameFlags(options, cmd_line);
+  ChromeBrowserOperations::AppendRenameFlags(cmd_line);
 }
 
 }  // namespace installer

diff --git a/chrome/installer/util/chrome_browser_sxs_operations.h b/chrome/installer/util/chrome_browser_sxs_operations.h
index 2d975d1..3f9e43eb 100644
--- a/chrome/installer/util/chrome_browser_sxs_operations.h
+++ b/chrome/installer/util/chrome_browser_sxs_operations.h

@@ -5,7 +5,6 @@
 #ifndef CHROME_INSTALLER_UTIL_CHROME_BROWSER_SXS_OPERATIONS_H_
 #define CHROME_INSTALLER_UTIL_CHROME_BROWSER_SXS_OPERATIONS_H_
 
-#include "base/compiler_specific.h"
 #include "base/macros.h"
 #include "chrome/installer/util/chrome_browser_operations.h"
 
@@ -16,11 +15,9 @@
  public:
   ChromeBrowserSxSOperations() {}
 
-  void AppendProductFlags(const std::set<base::string16>& options,
-                          base::CommandLine* cmd_line) const override;
+  void AppendProductFlags(base::CommandLine* cmd_line) const override;
 
-  void AppendRenameFlags(const std::set<base::string16>& options,
-                         base::CommandLine* cmd_line) const override;
+  void AppendRenameFlags(base::CommandLine* cmd_line) const override;
 
  private:
   DISALLOW_COPY_AND_ASSIGN(ChromeBrowserSxSOperations);

diff --git a/chrome/installer/util/google_chrome_distribution.cc b/chrome/installer/util/google_chrome_distribution.cc
index 223f7d6..510ec78 100644
--- a/chrome/installer/util/google_chrome_distribution.cc
+++ b/chrome/installer/util/google_chrome_distribution.cc

@@ -14,6 +14,7 @@
 #include <utility>
 
 #include "base/files/file_path.h"
+#include "base/memory/ptr_util.h"
 #include "base/path_service.h"
 #include "base/strings/string_util.h"
 #include "base/strings/stringprintf.h"
@@ -26,7 +27,6 @@
 #include "chrome/installer/util/channel_info.h"
 #include "chrome/installer/util/google_update_constants.h"
 #include "chrome/installer/util/google_update_settings.h"
-#include "chrome/installer/util/helper.h"
 #include "chrome/installer/util/install_util.h"
 #include "chrome/installer/util/installer_util_strings.h"
 #include "chrome/installer/util/l10n_string_util.h"
@@ -96,13 +96,12 @@
 }  // namespace
 
 GoogleChromeDistribution::GoogleChromeDistribution()
-    : BrowserDistribution(CHROME_BROWSER,
-                          std::unique_ptr<AppRegistrationData>(
-                              new UpdatingAppRegistrationData(kChromeGuid))) {}
+    : BrowserDistribution(
+          base::MakeUnique<UpdatingAppRegistrationData>(kChromeGuid)) {}
 
 GoogleChromeDistribution::GoogleChromeDistribution(
     std::unique_ptr<AppRegistrationData> app_reg_data)
-    : BrowserDistribution(CHROME_BROWSER, std::move(app_reg_data)) {}
+    : BrowserDistribution(std::move(app_reg_data)) {}
 
 void GoogleChromeDistribution::DoPostUninstallOperations(
     const base::Version& version,

diff --git a/chrome/installer/util/google_chrome_distribution.h b/chrome/installer/util/google_chrome_distribution.h
index 937484c..415d570 100644
--- a/chrome/installer/util/google_chrome_distribution.h
+++ b/chrome/installer/util/google_chrome_distribution.h

@@ -8,6 +8,8 @@
 #ifndef CHROME_INSTALLER_UTIL_GOOGLE_CHROME_DISTRIBUTION_H_
 #define CHROME_INSTALLER_UTIL_GOOGLE_CHROME_DISTRIBUTION_H_
 
+#include <memory>
+
 #include "base/strings/string16.h"
 #include "chrome/installer/util/browser_distribution.h"
 

diff --git a/chrome/installer/util/google_update_settings_unittest.cc b/chrome/installer/util/google_update_settings_unittest.cc
index 6f2e37a..53cebb4 100644
--- a/chrome/installer/util/google_update_settings_unittest.cc
+++ b/chrome/installer/util/google_update_settings_unittest.cc

@@ -127,9 +127,7 @@
   // Test the writing and deleting functionality of the experiments label
   // helper.
   void TestExperimentsLabelHelper(SystemUserInstall install) {
-    BrowserDistribution* chrome =
-        BrowserDistribution::GetSpecificDistribution(
-            BrowserDistribution::CHROME_BROWSER);
+    BrowserDistribution* chrome = BrowserDistribution::GetDistribution();
     base::string16 value;
 #if defined(GOOGLE_CHROME_BUILD)
     EXPECT_TRUE(chrome->ShouldSetExperimentLabels());
@@ -1190,9 +1188,7 @@
 base::string16* CollectStatsConsent::chrome_state_medium_key_;
 
 void CollectStatsConsent::SetUpTestCase() {
-  BrowserDistribution* dist =
-      BrowserDistribution::GetSpecificDistribution(
-          BrowserDistribution::CHROME_BROWSER);
+  BrowserDistribution* dist = BrowserDistribution::GetDistribution();
   chrome_version_key_ = new base::string16(dist->GetVersionKey());
   chrome_state_key_ = new base::string16(dist->GetStateKey());
   chrome_state_medium_key_ = new base::string16(dist->GetStateMediumKey());

diff --git a/chrome/installer/util/google_update_util.cc b/chrome/installer/util/google_update_util.cc
index fd37819..328327d 100644
--- a/chrome/installer/util/google_update_util.cc
+++ b/chrome/installer/util/google_update_util.cc

@@ -164,7 +164,6 @@
   base::CommandLine cmd(exe_path);
   cmd.AppendSwitch(installer::switches::kReenableAutoupdates);
   installer::Product product(BrowserDistribution::GetDistribution());
-  product.InitializeFromUninstallCommand(product_state.uninstall_command());
   product.AppendProductFlags(&cmd);
   if (system_install)
     cmd.AppendSwitch(installer::switches::kSystemLevel);

diff --git a/chrome/installer/util/install_util.cc b/chrome/installer/util/install_util.cc
index 555a39d..17f7a10 100644
--- a/chrome/installer/util/install_util.cc
+++ b/chrome/installer/util/install_util.cc

@@ -34,7 +34,6 @@
 #include "chrome/common/chrome_paths.h"
 #include "chrome/installer/util/browser_distribution.h"
 #include "chrome/installer/util/google_update_constants.h"
-#include "chrome/installer/util/helper.h"
 #include "chrome/installer/util/installation_state.h"
 #include "chrome/installer/util/l10n_string_util.h"
 #include "chrome/installer/util/util_constants.h"
@@ -567,7 +566,6 @@
     WorkItemList* list) {
   DCHECK(list);
   DCHECK(dist);
-  DCHECK_EQ(BrowserDistribution::CHROME_BROWSER, dist->GetType());
   base::Version downgrade_version = GetDowngradeVersion(system_install, dist);
   HKEY root = system_install ? HKEY_LOCAL_MACHINE : HKEY_CURRENT_USER;
   if (!current_version ||

diff --git a/chrome/installer/util/install_util_unittest.cc b/chrome/installer/util/install_util_unittest.cc
index 4e137d9..eb962a4 100644
--- a/chrome/installer/util/install_util_unittest.cc
+++ b/chrome/installer/util/install_util_unittest.cc

@@ -4,6 +4,7 @@
 
 #include "chrome/installer/util/install_util.h"
 
+#include <memory>
 #include <string>
 #include <utility>
 
@@ -13,6 +14,7 @@
 #include "base/files/file_util.h"
 #include "base/files/scoped_temp_dir.h"
 #include "base/macros.h"
+#include "base/memory/ptr_util.h"
 #include "base/path_service.h"
 #include "base/strings/string_util.h"
 #include "base/test/scoped_path_override.h"
@@ -38,9 +40,7 @@
 class TestBrowserDistribution : public BrowserDistribution {
  public:
   TestBrowserDistribution()
-      : BrowserDistribution(CHROME_BROWSER,
-                            std::unique_ptr<AppRegistrationData>(
-                                new TestAppRegistrationData())) {}
+      : BrowserDistribution(base::MakeUnique<TestAppRegistrationData>()) {}
 };
 
 class InstallUtilTest : public testing::Test {

diff --git a/chrome/installer/util/product.cc b/chrome/installer/util/product.cc
index 32b70e4..6d6c55c 100644
--- a/chrome/installer/util/product.cc
+++ b/chrome/installer/util/product.cc

@@ -10,45 +10,26 @@
 #include "base/logging.h"
 #include "base/process/launch.h"
 #include "base/win/registry.h"
+#include "chrome/installer/util/browser_distribution.h"
 #include "chrome/installer/util/chrome_browser_operations.h"
 #include "chrome/installer/util/chrome_browser_sxs_operations.h"
 #include "chrome/installer/util/google_update_constants.h"
 #include "chrome/installer/util/install_util.h"
-#include "chrome/installer/util/master_preferences.h"
-#include "chrome/installer/util/master_preferences_constants.h"
 #include "chrome/installer/util/product_operations.h"
 
 using base::win::RegKey;
-using installer::MasterPreferences;
 
 namespace installer {
 
 Product::Product(BrowserDistribution* distribution)
-    : distribution_(distribution) {
-  switch (distribution->GetType()) {
-    case BrowserDistribution::CHROME_BROWSER:
-      operations_.reset(InstallUtil::IsChromeSxSProcess() ?
-          new ChromeBrowserSxSOperations() :
-          new ChromeBrowserOperations());
-      break;
-    default:
-      NOTREACHED() << "Unsupported BrowserDistribution::Type: "
-                   << distribution->GetType();
-  }
-}
+    : distribution_(distribution),
+      operations_(InstallUtil::IsChromeSxSProcess()
+                      ? new ChromeBrowserSxSOperations()
+                      : new ChromeBrowserOperations()) {}
 
 Product::~Product() {
 }
 
-void Product::InitializeFromPreferences(const MasterPreferences& prefs) {
-  operations_->ReadOptions(prefs, &options_);
-}
-
-void Product::InitializeFromUninstallCommand(
-    const base::CommandLine& uninstall_command) {
-  operations_->ReadOptions(uninstall_command, &options_);
-}
-
 bool Product::LaunchChrome(const base::FilePath& application_path) const {
   bool success = !application_path.empty();
   if (success) {
@@ -119,19 +100,15 @@
 }
 
 void Product::AddKeyFiles(std::vector<base::FilePath>* key_files) const {
-  operations_->AddKeyFiles(options_, key_files);
+  operations_->AddKeyFiles(key_files);
 }
 
 void Product::AppendProductFlags(base::CommandLine* command_line) const {
-  operations_->AppendProductFlags(options_, command_line);
+  operations_->AppendProductFlags(command_line);
 }
 
 void Product::AppendRenameFlags(base::CommandLine* command_line) const {
-  operations_->AppendRenameFlags(options_, command_line);
-}
-
-bool Product::SetChannelFlags(bool set, ChannelInfo* channel_info) const {
-  return operations_->SetChannelFlags(options_, set, channel_info);
+  operations_->AppendRenameFlags(command_line);
 }
 
 void Product::AddDefaultShortcutProperties(
@@ -148,8 +125,7 @@
     VLOG(1) << "LaunchUserExperiment status: " << status << " product: "
             << distribution_->GetDisplayName()
             << " system_level: " << system_level;
-    operations_->LaunchUserExperiment(
-        setup_path, options_, status, system_level);
+    operations_->LaunchUserExperiment(setup_path, status, system_level);
   }
 }
 

diff --git a/chrome/installer/util/product.h b/chrome/installer/util/product.h
index f3d29e8..231c0bbc 100644
--- a/chrome/installer/util/product.h
+++ b/chrome/installer/util/product.h

@@ -8,23 +8,20 @@
 #include <stdint.h>
 
 #include <memory>
-#include <set>
-#include <string>
 #include <vector>
 
 #include "base/macros.h"
-#include "chrome/installer/util/browser_distribution.h"
 #include "chrome/installer/util/shell_util.h"
 #include "chrome/installer/util/util_constants.h"
 
+class BrowserDistribution;
+
 namespace base {
 class CommandLine;
 }
 
 namespace installer {
 
-class ChannelInfo;
-class MasterPreferences;
 class Product;
 class ProductOperations;
 
@@ -43,35 +40,10 @@
 
   ~Product();
 
-  void InitializeFromPreferences(const MasterPreferences& prefs);
-
-  void InitializeFromUninstallCommand(
-      const base::CommandLine& uninstall_command);
-
   BrowserDistribution* distribution() const {
     return distribution_;
   }
 
-  bool is_type(BrowserDistribution::Type type) const {
-    return distribution_->GetType() == type;
-  }
-
-  bool is_chrome() const {
-    return distribution_->GetType() == BrowserDistribution::CHROME_BROWSER;
-  }
-
-  bool HasOption(const std::wstring& option) const {
-    return options_.find(option) != options_.end();
-  }
-
-  // Returns true if the set of options is mutated by this operation.
-  bool SetOption(const std::wstring& option, bool set) {
-    if (set)
-      return options_.insert(option).second;
-    else
-      return options_.erase(option) != 0;
-  }
-
   // Launches Chrome without waiting for it to exit.
   bool LaunchChrome(const base::FilePath& application_path) const;
 
@@ -99,9 +71,6 @@
   // See ProductOperations::AppendRenameFlags.
   void AppendRenameFlags(base::CommandLine* command_line) const;
 
-  // See Productoperations::SetChannelFlags.
-  bool SetChannelFlags(bool set, ChannelInfo* channel_info) const;
-
   // See ProductOperations::AddDefaultShortcutProperties.
   void AddDefaultShortcutProperties(
       const base::FilePath& target_exe,
@@ -116,9 +85,8 @@
     MSI_STATE = 0x01
   };
 
-  BrowserDistribution* distribution_;
-  std::unique_ptr<ProductOperations> operations_;
-  std::set<std::wstring> options_;
+  BrowserDistribution* const distribution_;
+  const std::unique_ptr<ProductOperations> operations_;
 
  private:
   DISALLOW_COPY_AND_ASSIGN(Product);

diff --git a/chrome/installer/util/product_operations.h b/chrome/installer/util/product_operations.h
index ae4abe4..bd9555f 100644
--- a/chrome/installer/util/product_operations.h
+++ b/chrome/installer/util/product_operations.h

@@ -5,12 +5,9 @@
 #ifndef CHROME_INSTALLER_UTIL_PRODUCT_OPERATIONS_H_
 #define CHROME_INSTALLER_UTIL_PRODUCT_OPERATIONS_H_
 
-#include <set>
-#include <string>
 #include <vector>
 
 #include "base/files/file_path.h"
-#include "base/strings/string16.h"
 #include "chrome/installer/util/shell_util.h"
 #include "chrome/installer/util/util_constants.h"
 
@@ -22,51 +19,30 @@
 
 namespace installer {
 
-class ChannelInfo;
-class MasterPreferences;
 
 // An interface to product-specific operations that depend on product
-// configuration.  Implementations are expected to be stateless.  Configuration
-// can be read from a MasterPreferences instance or from a product's uninstall
-// command.
+// configuration. Implementations are expected to be stateless.
 class ProductOperations {
  public:
   virtual ~ProductOperations() {}
 
-  // Reads product-specific options from |prefs|, adding them to |options|.
-  virtual void ReadOptions(const MasterPreferences& prefs,
-                           std::set<base::string16>* options) const = 0;
-
-  // Reads product-specific options from |command|, adding them to |options|.
-  virtual void ReadOptions(const base::CommandLine& command,
-                           std::set<base::string16>* options) const = 0;
-
   // A key-file is a file such as a DLL on Windows that is expected to be in use
-  // when the product is being used.  For example "chrome.dll" for Chrome.
+  // when the product is being used. For example "chrome.dll" for Chrome.
   // Before attempting to delete an installation directory during an
   // uninstallation, the uninstaller will check if any one of a potential set of
-  // key files is in use and if they are, abort the delete operation.  Only if
-  // none of the key files are in use, can the folder be deleted.  Note that
-  // this function does not return a full path to the key file(s), only (a) file
+  // key files is in use and if they are, abort the delete operation. Only if
+  // none of the key files are in use, can the folder be deleted. Note that this
+  // function does not return a full path to the key file(s), only (a) file
   // name(s).
-  virtual void AddKeyFiles(const std::set<base::string16>& options,
-                           std::vector<base::FilePath>* key_files) const = 0;
+  virtual void AddKeyFiles(std::vector<base::FilePath>* key_files) const = 0;
 
-  // Given a command line, appends the set of product-specific flags.  These are
+  // Given a command line, appends the set of product-specific flags. These are
   // required for product-specific uninstall commands, but are of use for any
   // invocation of setup.exe for the product.
-  virtual void AppendProductFlags(const std::set<base::string16>& options,
-                                  base::CommandLine* cmd_line) const = 0;
+  virtual void AppendProductFlags(base::CommandLine* cmd_line) const = 0;
 
   // Given a command line, appends the set of product-specific rename flags.
-  virtual void AppendRenameFlags(const std::set<base::string16>& options,
-                                 base::CommandLine* cmd_line) const = 0;
-
-  // Adds or removes product-specific flags in |channel_info|.  Returns true if
-  // |channel_info| is modified.
-  virtual bool SetChannelFlags(const std::set<base::string16>& options,
-                               bool set,
-                               ChannelInfo* channel_info) const = 0;
+  virtual void AppendRenameFlags(base::CommandLine* cmd_line) const = 0;
 
   // Modifies a ShellUtil::ShortcutProperties object by assigning default values
   // to unintialized members.
@@ -79,7 +55,6 @@
   // experiment. This function determines if the user qualifies and if so it
   // sets the wheels in motion or in simple cases does the experiment itself.
   virtual void LaunchUserExperiment(const base::FilePath& setup_path,
-                                    const std::set<base::string16>& options,
                                     InstallStatus status,
                                     bool system_level) const = 0;
 };

diff --git a/chrome/installer/util/product_unittest.cc b/chrome/installer/util/product_unittest.cc
index 4994a746..8302c47 100644
--- a/chrome/installer/util/product_unittest.cc
+++ b/chrome/installer/util/product_unittest.cc

@@ -13,34 +13,24 @@
 #include "base/strings/utf_string_conversions.h"
 #include "base/test/test_reg_util_win.h"
 #include "chrome/common/chrome_paths.h"
+#include "chrome/installer/util/browser_distribution.h"
 #include "chrome/installer/util/google_update_constants.h"
 #include "chrome/installer/util/installation_state.h"
-#include "chrome/installer/util/master_preferences.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
 using base::win::RegKey;
 using installer::Product;
-using installer::MasterPreferences;
 using registry_util::RegistryOverrideManager;
 
 TEST(ProductTest, ProductInstallBasic) {
   // TODO(tommi): We should mock this and use our mocked distribution.
-  const bool multi_install = false;
   const bool system_level = true;
-  base::CommandLine cmd_line = base::CommandLine::FromString(
-      std::wstring(L"setup.exe") +
-      (multi_install ? L" --multi-install --chrome" : L"") +
-      (system_level ? L" --system-level" : L""));
-  installer::MasterPreferences prefs(cmd_line);
   installer::InstallationState machine_state;
   machine_state.Initialize();
 
-  std::unique_ptr<Product> product = base::MakeUnique<Product>(
-      BrowserDistribution::GetSpecificDistribution(
-          BrowserDistribution::CHROME_BROWSER));
-  product->InitializeFromPreferences(prefs);
+  std::unique_ptr<Product> product =
+      base::MakeUnique<Product>(BrowserDistribution::GetDistribution());
   BrowserDistribution* distribution = product->distribution();
-  EXPECT_EQ(BrowserDistribution::CHROME_BROWSER, distribution->GetType());
 
   base::FilePath user_data_dir;
   ASSERT_TRUE(PathService::Get(chrome::DIR_USER_DATA, &user_data_dir));

diff --git a/chrome/installer/util/util_constants.cc b/chrome/installer/util/util_constants.cc
index 9cc798d..e768bf0d2 100644
--- a/chrome/installer/util/util_constants.cc
+++ b/chrome/installer/util/util_constants.cc

@@ -231,8 +231,6 @@
 const wchar_t kInstallerSuccessLaunchCmdLine[] =
     L"InstallerSuccessLaunchCmdLine";
 
-const wchar_t kOptionMultiInstall[] = L"multi-install";
-
 // Chrome channel display names.
 const wchar_t kChromeChannelUnknown[] = L"unknown";
 const wchar_t kChromeChannelCanary[] = L"canary";

diff --git a/chrome/installer/util/util_constants.h b/chrome/installer/util/util_constants.h
index 4b5f5f1..4e9e5da 100644
--- a/chrome/installer/util/util_constants.h
+++ b/chrome/installer/util/util_constants.h

@@ -229,9 +229,6 @@
 extern const wchar_t kInstallerResultUIString[];
 extern const wchar_t kInstallerSuccessLaunchCmdLine[];
 
-// Product options.
-extern const wchar_t kOptionMultiInstall[];
-
 // Chrome channel display names.
 // NOTE: Canary is not strictly a 'channel', but rather a separate product
 //     installed side-by-side. However, GoogleUpdateSettings::GetChromeChannel

diff --git a/chrome/test/base/test_launcher_utils.cc b/chrome/test/base/test_launcher_utils.cc
index 8892674..7dd5f92 100644
--- a/chrome/test/base/test_launcher_utils.cc
+++ b/chrome/test/base/test_launcher_utils.cc

@@ -106,6 +106,12 @@
   // value to the child process. This is the simplest way to do it.
   std::unique_ptr<base::Environment> env(base::Environment::Create());
   success = success && env->SetVar("XDG_CACHE_HOME", user_data_dir.value());
+
+  // Also make sure that the machine policy directory is inside the clear
+  // profile. Otherwise the machine's policies could affect tests.
+  base::FilePath policy_files = user_data_dir.AppendASCII("policies");
+  success =
+      success && PathService::Override(chrome::DIR_POLICY_FILES, policy_files);
 #endif
 
   return success;

diff --git a/chrome/test/base/testing_browser_process.cc b/chrome/test/base/testing_browser_process.cc
index bed25a5..758ce502 100644
--- a/chrome/test/base/testing_browser_process.cc
+++ b/chrome/test/base/testing_browser_process.cc

@@ -4,6 +4,7 @@
 
 #include "chrome/test/base/testing_browser_process.h"
 
+#include "base/path_service.h"
 #include "base/strings/string_util.h"
 #include "base/time/default_clock.h"
 #include "base/time/default_tick_clock.h"
@@ -17,6 +18,7 @@
 #include "chrome/browser/printing/print_job_manager.h"
 #include "chrome/browser/profiles/profile_manager.h"
 #include "chrome/browser/safe_browsing/safe_browsing_service.h"
+#include "chrome/common/chrome_paths.h"
 #include "chrome/common/features.h"
 #include "chrome/test/base/testing_browser_process_platform_part.h"
 #include "components/network_time/network_time_tracker.h"
@@ -151,6 +153,19 @@
   if (!browser_policy_connector_) {
     EXPECT_FALSE(created_browser_policy_connector_);
     created_browser_policy_connector_ = true;
+
+#if defined(OS_POSIX) && !defined(OS_MACOSX)
+    // Make sure that the machine policy directory does not exist so that
+    // machine-wide policies do not affect tests.
+    // Note that passing false as last argument to OverrideAndCreateIfNeeded
+    // means that the directory will not be created.
+    // If a test needs to place a file in this directory in the future, we could
+    // create a temporary directory and make its path available to tests.
+    base::FilePath local_policy_path("/tmp/non/existing/directory");
+    EXPECT_TRUE(PathService::OverrideAndCreateIfNeeded(
+        chrome::DIR_POLICY_FILES, local_policy_path, true, false));
+#endif
+
     browser_policy_connector_ = platform_part_->CreateBrowserPolicyConnector();
 
     // Note: creating the ChromeBrowserPolicyConnector invokes BrowserThread::

diff --git a/components/policy/core/common/cloud/cloud_policy_constants.cc b/components/policy/core/common/cloud/cloud_policy_constants.cc
index 4e2bc47..f272a72 100644
--- a/components/policy/core/common/cloud/cloud_policy_constants.cc
+++ b/components/policy/core/common/cloud/cloud_policy_constants.cc

@@ -99,13 +99,8 @@
 const char kPolicyVerificationKeyHash[] = "1:356l7w";
 
 std::string GetPolicyVerificationKey() {
-  base::CommandLine* command_line = base::CommandLine::ForCurrentProcess();
-  if (command_line->HasSwitch(switches::kDisablePolicyKeyVerification)) {
-    return std::string();
-  } else {
-    return std::string(reinterpret_cast<const char*>(kPolicyVerificationKey),
-                       sizeof(kPolicyVerificationKey));
-  }
+  return std::string(reinterpret_cast<const char*>(kPolicyVerificationKey),
+                     sizeof(kPolicyVerificationKey));
 }
 
 }  // namespace policy

diff --git a/components/policy/core/common/cloud/cloud_policy_constants.h b/components/policy/core/common/cloud/cloud_policy_constants.h
index d92d66a..7329fd2 100644
--- a/components/policy/core/common/cloud/cloud_policy_constants.h
+++ b/components/policy/core/common/cloud/cloud_policy_constants.h

@@ -63,8 +63,7 @@
 POLICY_EXPORT extern const char kChromePolicyHeader[];
 
 // Public half of the verification key that is used to verify that policy
-// signing keys are originating from DM server.  Returns empty string in case
-// policy key verification is disabled on the command line.
+// signing keys are originating from DM server.
 POLICY_EXPORT std::string GetPolicyVerificationKey();
 
 // Corresponding hash.

diff --git a/components/policy/core/common/cloud/cloud_policy_validator.cc b/components/policy/core/common/cloud/cloud_policy_validator.cc
index d824ba23..ff6008d 100644
--- a/components/policy/core/common/cloud/cloud_policy_validator.cc
+++ b/components/policy/core/common/cloud/cloud_policy_validator.cc

@@ -33,8 +33,9 @@
 const char kMetricPolicyKeyVerification[] = "Enterprise.PolicyKeyVerification";
 
 enum MetricPolicyKeyVerification {
+  // Obsolete. Kept to avoid reuse, as this is used in histograms.
   // UMA metric recorded when the client has no verification key.
-  METRIC_POLICY_KEY_VERIFICATION_KEY_MISSING,
+  METRIC_POLICY_KEY_VERIFICATION_KEY_MISSING_DEPRECATED,
   // Recorded when the policy being verified has no key signature (e.g. policy
   // fetched before the server supported the verification key).
   METRIC_POLICY_KEY_VERIFICATION_SIGNATURE_MISSING,
@@ -180,7 +181,9 @@
       canonicalize_user_(false),
       verification_key_(GetPolicyVerificationKey()),
       allow_key_rotation_(false),
-      background_task_runner_(background_task_runner) {}
+      background_task_runner_(background_task_runner) {
+  DCHECK(!verification_key_.empty());
+}
 
 void CloudPolicyValidatorBase::PostValidationTask(
     const base::Closure& completion_callback) {
@@ -269,14 +272,6 @@
 // Verifies the |new_public_key_verification_signature_deprecated| for the
 // |new_public_key| in the policy blob.
 bool CloudPolicyValidatorBase::CheckNewPublicKeyVerificationSignature() {
-  // Skip verification if the key is empty (disabled via command line).
-  if (verification_key_.empty()) {
-    UMA_HISTOGRAM_ENUMERATION(kMetricPolicyKeyVerification,
-                              METRIC_POLICY_KEY_VERIFICATION_KEY_MISSING,
-                              METRIC_POLICY_KEY_VERIFICATION_SIZE);
-    return true;
-  }
-
   if (!policy_->has_new_public_key_verification_signature_deprecated()) {
     // Policy does not contain a verification signature, so log an error.
     LOG(ERROR) << "Policy is missing public_key_verification_signature";
@@ -392,8 +387,7 @@
 }
 
 CloudPolicyValidatorBase::Status CloudPolicyValidatorBase::CheckCachedKey() {
-  if (!verification_key_.empty() &&
-      !CheckVerificationKeySignature(cached_key_, verification_key_,
+  if (!CheckVerificationKeySignature(cached_key_, verification_key_,
                                      cached_key_signature_)) {
     LOG(ERROR) << "Cached key signature verification failed";
     return VALIDATION_BAD_KEY_VERIFICATION_SIGNATURE;

diff --git a/components/policy/core/common/policy_switches.cc b/components/policy/core/common/policy_switches.cc
index be6a8569..7bea73e2 100644
--- a/components/policy/core/common/policy_switches.cc
+++ b/components/policy/core/common/policy_switches.cc

@@ -14,11 +14,6 @@
 // Disables fetching and storing cloud policy for components.
 const char kDisableComponentCloudPolicy[]   = "disable-component-cloud-policy";
 
-// Disables the verification of policy signing keys.
-// TODO(atwilson): Remove this once all test servers have been updated to
-// produce verification signatures.
-const char kDisablePolicyKeyVerification[]  = "disable-policy-key-verification";
-
 // Always treat user as affiliated.
 // TODO(antrim): Remove once test servers correctly produce affiliation ids.
 const char kUserAlwaysAffiliated[]  = "user-always-affiliated";

diff --git a/components/policy/core/common/policy_switches.h b/components/policy/core/common/policy_switches.h
index 34db62f..08d13cb5 100644
--- a/components/policy/core/common/policy_switches.h
+++ b/components/policy/core/common/policy_switches.h

@@ -14,7 +14,6 @@
 
 POLICY_EXPORT extern const char kDeviceManagementUrl[];
 POLICY_EXPORT extern const char kDisableComponentCloudPolicy[];
-POLICY_EXPORT extern const char kDisablePolicyKeyVerification[];
 POLICY_EXPORT extern const char kUserAlwaysAffiliated[];
 
 }  // namespace switches

diff --git a/content/public/android/java/src/org/chromium/content/browser/ContentViewCore.java b/content/public/android/java/src/org/chromium/content/browser/ContentViewCore.java
index 6f3295f7c..af892bf 100644
--- a/content/public/android/java/src/org/chromium/content/browser/ContentViewCore.java
+++ b/content/public/android/java/src/org/chromium/content/browser/ContentViewCore.java

@@ -40,7 +40,6 @@
 import android.view.inputmethod.InputConnection;
 import android.view.inputmethod.InputMethodManager;
 
-import org.chromium.base.CommandLine;
 import org.chromium.base.ObserverList;
 import org.chromium.base.ObserverList.RewindableIterator;
 import org.chromium.base.TraceEvent;
@@ -60,7 +59,6 @@
 import org.chromium.content.browser.input.SelectPopupDialog;
 import org.chromium.content.browser.input.SelectPopupDropdown;
 import org.chromium.content.browser.input.SelectPopupItem;
-import org.chromium.content.common.ContentSwitches;
 import org.chromium.content_public.browser.AccessibilitySnapshotCallback;
 import org.chromium.content_public.browser.AccessibilitySnapshotNode;
 import org.chromium.content_public.browser.ActionModeCallbackHelper;
@@ -385,9 +383,6 @@
     // A ViewAndroidDelegate that delegates to the current container view.
     private ViewAndroidDelegate mViewAndroidDelegate;
 
-    // A flag to determine if we enable hover feature or not.
-    private Boolean mEnableTouchHover;
-
     // NOTE: This object will not be released by Android framework until the matching
     // ResultReceiver in the InputMethodService (IME app) gets gc'ed.
     private ShowKeyboardResultReceiver mShowKeyboardResultReceiver;
@@ -1565,16 +1560,6 @@
                 return mBrowserAccessibilityManager.onHoverEvent(offset);
             }
 
-            // TODO(lanwei): Remove this switch once experimentation is complete -
-            // crbug.com/418188
-            if (event.getToolType(0) == MotionEvent.TOOL_TYPE_FINGER) {
-                if (mEnableTouchHover == null) {
-                    mEnableTouchHover =
-                            CommandLine.getInstance().hasSwitch(ContentSwitches.ENABLE_TOUCH_HOVER);
-                }
-                if (!mEnableTouchHover.booleanValue()) return false;
-            }
-
             if (mNativeContentViewCore != 0) {
                 nativeSendMouseEvent(mNativeContentViewCore, event.getEventTime(), eventAction,
                         offset.getX(), offset.getY(), event.getPointerId(0), event.getPressure(0),

diff --git a/content/public/android/java/src/org/chromium/content/common/ContentSwitches.java b/content/public/android/java/src/org/chromium/content/common/ContentSwitches.java
index ac3e135..fc5cc565e 100644
--- a/content/public/android/java/src/org/chromium/content/common/ContentSwitches.java
+++ b/content/public/android/java/src/org/chromium/content/common/ContentSwitches.java

@@ -42,9 +42,6 @@
     // Native switch - chrome_switches::kDisablePopupBlocking
     public static final String DISABLE_POPUP_BLOCKING = "disable-popup-blocking";
 
-    // Enable mouse hover emulation by holding your finger just over the screen.
-    public static final String ENABLE_TOUCH_HOVER = "enable-touch-hover";
-
     // Native switch kEnableCredentialManagerAPI
     public static final String ENABLE_CREDENTIAL_MANAGER_API = "enable-credential-manager-api";
 

diff --git a/content/renderer/manifest/manifest_parser.h b/content/renderer/manifest/manifest_parser.h
index 3487b81..610566b4 100644
--- a/content/renderer/manifest/manifest_parser.h
+++ b/content/renderer/manifest/manifest_parser.h

@@ -134,9 +134,8 @@
   // Parses the 'purpose' field of an icon, as defined in:
   // https://w3c.github.io/manifest/#dfn-steps-for-processing-a-purpose-member-of-an-image
   // Returns a vector of Manifest::Icon::IconPurpose with the successfully
-  // parsed icon purposes, an empty vector if the field was not present or not
-  // of type "string", and a vector containing Manifest::Icon::IconPurpose::Any
-  // for all other parsing exceptions.
+  // parsed icon purposes, and a vector with Manifest::Icon::IconPurpose::Any if
+  // the parsing failed.
   std::vector<Manifest::Icon::IconPurpose> ParseIconPurpose(
       const base::DictionaryValue& icon);
 

diff --git a/google_apis/gcm/engine/connection_factory_impl.cc b/google_apis/gcm/engine/connection_factory_impl.cc
index 20117b60d..153e5bc 100644
--- a/google_apis/gcm/engine/connection_factory_impl.cc
+++ b/google_apis/gcm/engine/connection_factory_impl.cc

@@ -319,7 +319,7 @@
   connecting_ = true;
   GURL current_endpoint = GetCurrentEndpoint();
   recorder_->RecordConnectionInitiated(current_endpoint.host());
-  RebuildNetworkSessionAuthCache();
+  UpdateFromHttpNetworkSession();
   int status = gcm_network_session_->proxy_service()->ResolveProxy(
       current_endpoint,
       std::string(),
@@ -590,12 +590,15 @@
   socket_handle_.Reset();
 }
 
-void ConnectionFactoryImpl::RebuildNetworkSessionAuthCache() {
+void ConnectionFactoryImpl::UpdateFromHttpNetworkSession() {
   if (!http_network_session_ || !http_network_session_->http_auth_cache())
     return;
 
   gcm_network_session_->http_auth_cache()->UpdateAllFrom(
       *http_network_session_->http_auth_cache());
+
+  if (!http_network_session_->IsQuicEnabled())
+    gcm_network_session_->DisableQuic();
 }
 
 }  // namespace gcm

diff --git a/google_apis/gcm/engine/connection_factory_impl.h b/google_apis/gcm/engine/connection_factory_impl.h
index ff7de143d..1af8aac0 100644
--- a/google_apis/gcm/engine/connection_factory_impl.h
+++ b/google_apis/gcm/engine/connection_factory_impl.h

@@ -132,9 +132,10 @@
   // Closes the local socket if one is present, and resets connection handler.
   void CloseSocket();
 
-  // Updates the GCM Network Session's HttpAuthCache with the HTTP Network
-  // Session's cache, if available.
-  void RebuildNetworkSessionAuthCache();
+  // Updates the GCM Network Session's with current data from HTTP Network
+  // Session's, if available.
+  // Specifically, HttpAuthCache and IsQuicEnabled are updated.
+  void UpdateFromHttpNetworkSession();
 
   // The tracker will maintain a list of all connection attempts with GCM,
   // whether they succeeded, and their duration.

diff --git a/ios/chrome/app/spotlight/BUILD.gn b/ios/chrome/app/spotlight/BUILD.gn
index 89c8853..b872afa 100644
--- a/ios/chrome/app/spotlight/BUILD.gn
+++ b/ios/chrome/app/spotlight/BUILD.gn

@@ -49,6 +49,7 @@
 }
 
 source_set("unit_tests") {
+  configs += [ "//build/config/compiler:enable_arc" ]
   testonly = true
   sources = [
     "spotlight_manager_unittest.mm",

diff --git a/ios/chrome/app/spotlight/spotlight_manager_unittest.mm b/ios/chrome/app/spotlight/spotlight_manager_unittest.mm
index 52e8569..dc5ffc8 100644
--- a/ios/chrome/app/spotlight/spotlight_manager_unittest.mm
+++ b/ios/chrome/app/spotlight/spotlight_manager_unittest.mm

@@ -8,7 +8,6 @@
 #import <Foundation/Foundation.h>
 
 #include "base/location.h"
-#include "base/mac/scoped_nsobject.h"
 #include "base/message_loop/message_loop.h"
 #include "base/single_thread_task_runner.h"
 #include "base/strings/sys_string_conversions.h"
@@ -31,6 +30,10 @@
 #include "testing/gtest/include/gtest/gtest.h"
 #include "testing/gtest_mac.h"
 
+#if !defined(__has_feature) || !__has_feature(objc_arc)
+#error "This file requires ARC support."
+#endif
+
 const char kDummyIconUrl[] = "http://www.example.com/touch_icon.png";
 
 favicon_base::FaviconRawBitmapResult CreateTestBitmap(int w, int h) {
@@ -101,9 +104,9 @@
     mock_favicon_service_.reset(new MockFaviconService());
     large_icon_service_.reset(
         new TestLargeIconService(mock_favicon_service_.get()));
-    bookmarksSpotlightManager_.reset([[BookmarksSpotlightManager alloc]
+    bookmarksSpotlightManager_ = [[BookmarksSpotlightManager alloc]
         initWithLargeIconService:large_icon_service_.get()
-                   bookmarkModel:model_.get()]);
+                   bookmarkModel:model_.get()];
   }
 
   base::MessageLoop loop_;
@@ -111,7 +114,7 @@
   std::unique_ptr<TestLargeIconService> large_icon_service_;
   base::CancelableTaskTracker cancelable_task_tracker_;
   std::unique_ptr<bookmarks::BookmarkModel> model_;
-  base::scoped_nsobject<BookmarksSpotlightManager> bookmarksSpotlightManager_;
+  BookmarksSpotlightManager* bookmarksSpotlightManager_;
 };
 
 TEST_F(SpotlightManagerTest, testSpotlightID) {
@@ -134,7 +137,7 @@
   bookmarks::test::AddNodesFromModelString(model_.get(), root, model_string);
   const bookmarks::BookmarkNode* eNode =
       root->GetChild(3)->GetChild(0)->GetChild(0);
-  base::scoped_nsobject<NSMutableArray> keywords([[NSMutableArray alloc] init]);
+  NSMutableArray* keywords = [[NSMutableArray alloc] init];
   [bookmarksSpotlightManager_ getParentKeywordsForNode:eNode inArray:keywords];
   EXPECT_EQ([keywords count], 2u);
   EXPECT_TRUE([[keywords objectAtIndex:0] isEqualToString:@"21"]);
@@ -155,7 +158,7 @@
   NSString* spotlightID = [bookmarksSpotlightManager_
       spotlightIDForURL:eNode->url()
                   title:base::SysUTF16ToNSString(eNode->GetTitle())];
-  base::scoped_nsobject<NSMutableArray> keywords([[NSMutableArray alloc] init]);
+  NSMutableArray* keywords = [[NSMutableArray alloc] init];
   [bookmarksSpotlightManager_ getParentKeywordsForNode:eNode inArray:keywords];
   NSArray* items = [bookmarksSpotlightManager_
       spotlightItemsWithURL:eNode->url()
@@ -166,7 +169,7 @@
   EXPECT_NSEQ([item uniqueIdentifier], spotlightID);
   EXPECT_NSEQ([[item attributeSet] title], @"e");
   EXPECT_NSEQ([[[item attributeSet] URL] absoluteString], @"http://e.com/");
-  [bookmarksSpotlightManager_ addKeywords:keywords.get() toSearchableItem:item];
+  [bookmarksSpotlightManager_ addKeywords:keywords toSearchableItem:item];
   // We use the set intersection to verify that the item from the Spotlight
   // manager
   // contains all the newly added Keywords.

diff --git a/ios/chrome/browser/device_sharing/BUILD.gn b/ios/chrome/browser/device_sharing/BUILD.gn
index 31451ba..a15e20b1 100644
--- a/ios/chrome/browser/device_sharing/BUILD.gn
+++ b/ios/chrome/browser/device_sharing/BUILD.gn

@@ -39,6 +39,7 @@
 }
 
 source_set("eg_tests") {
+  configs += [ "//build/config/compiler:enable_arc" ]
   testonly = true
   sources = [
     "handoff_manager_egtest.mm",

diff --git a/ios/chrome/browser/device_sharing/handoff_manager_egtest.mm b/ios/chrome/browser/device_sharing/handoff_manager_egtest.mm
index 749fef9..f4355cf 100644
--- a/ios/chrome/browser/device_sharing/handoff_manager_egtest.mm
+++ b/ios/chrome/browser/device_sharing/handoff_manager_egtest.mm

@@ -17,6 +17,10 @@
 #import "net/base/mac/url_conversions.h"
 #include "url/gurl.h"
 
+#if !defined(__has_feature) || !__has_feature(objc_arc)
+#error "This file requires ARC support."
+#endif
+
 namespace {
 
 // Checks that Handoff will report the specified |gurl|.

diff --git a/ios/chrome/browser/reading_list/reading_list_web_state_observer.mm b/ios/chrome/browser/reading_list/reading_list_web_state_observer.mm
index c58d76e..7de2fe25 100644
--- a/ios/chrome/browser/reading_list/reading_list_web_state_observer.mm
+++ b/ios/chrome/browser/reading_list/reading_list_web_state_observer.mm

@@ -271,7 +271,6 @@
   web::NavigationManager* manager = web_state()->GetNavigationManager();
   web::NavigationItem* item = manager->GetPendingItem();
   if (item) {
-    web_state()->Stop();
     web::WebState::OpenURLParams params(url, item->GetReferrer(),
                                         WindowOpenDisposition::CURRENT_TAB,
                                         item->GetTransitionType(), NO);

diff --git a/ios/chrome/browser/ui/collection_view/cells/collection_view_account_item.mm b/ios/chrome/browser/ui/collection_view/cells/collection_view_account_item.mm
index 6b3bb416..e13bbc5 100644
--- a/ios/chrome/browser/ui/collection_view/cells/collection_view_account_item.mm
+++ b/ios/chrome/browser/ui/collection_view/cells/collection_view_account_item.mm

@@ -242,6 +242,7 @@
   self.imageView.image = nil;
   self.textLabel.text = nil;
   self.detailTextLabel.text = nil;
+  self.textLabel.textColor = [[MDCPalette greyPalette] tint900];
   self.detailTextLabel.textColor = [[MDCPalette greyPalette] tint500];
   self.errorIcon.image = nil;
   self.accessoryType = MDCCollectionViewCellAccessoryNone;

diff --git a/ios/chrome/browser/ui/contextual_search/touch_to_search_permissions_mediator.h b/ios/chrome/browser/ui/contextual_search/touch_to_search_permissions_mediator.h
index 068f1ce..44ebdbac 100644
--- a/ios/chrome/browser/ui/contextual_search/touch_to_search_permissions_mediator.h
+++ b/ios/chrome/browser/ui/contextual_search/touch_to_search_permissions_mediator.h

@@ -42,9 +42,8 @@
 // Touch-to-Search feature.
 @interface TouchToSearchPermissionsMediator : NSObject
 
-// YES if the device supports Touch-to-Search (based on command line flags and
-// Finch experiments). The return value will be the same over the lifetime of
-// a Chrome process.
+// YES if the device supports Touch-to-Search (based on command line flags). The
+// return value will be the same over the lifetime of a Chrome process.
 + (BOOL)isTouchToSearchAvailableOnDevice;
 
 // Designated initializer.

diff --git a/ios/chrome/browser/ui/contextual_search/touch_to_search_permissions_mediator.mm b/ios/chrome/browser/ui/contextual_search/touch_to_search_permissions_mediator.mm
index 741970b..ce48928e 100644
--- a/ios/chrome/browser/ui/contextual_search/touch_to_search_permissions_mediator.mm
+++ b/ios/chrome/browser/ui/contextual_search/touch_to_search_permissions_mediator.mm

@@ -9,7 +9,6 @@
 #include "base/command_line.h"
 #import "base/ios/weak_nsobject.h"
 #include "base/logging.h"
-#include "base/metrics/field_trial.h"
 #include "components/prefs/pref_change_registrar.h"
 #include "components/prefs/pref_service.h"
 #include "components/search_engines/template_url_service.h"
@@ -24,9 +23,6 @@
 #include "net/base/network_change_notifier.h"
 
 namespace {
-// Field trial constants.
-const char kContextualSearchFieldTrialName[] = "ContextualSearchIOS";
-const char kContextualSearchFieldTrialEnabled[] = "Enabled";
 // Maps pref string values to state enum.
 const struct {
   const char* value;
@@ -68,22 +64,25 @@
 @synthesize observing = _observing;
 
 + (BOOL)isTouchToSearchAvailableOnDevice {
-  // If the disable flag is flipped, the feature isn't available.
-  // If the enable flag is flipped, it's available.
-  // If the browser is in the field trial, it's available.
-  BOOL available = NO;
+  // By default the feature is not available. If the enable flag
+  // (switches::kEnableContextualSearch) is flipped, then it is available.
+  // The disable switch (switches::kDisableContextualSearch) is also supported,
+  // although it is only useful when Finch experiments are also supported.
+
   if (base::CommandLine::ForCurrentProcess()->HasSwitch(
           switches::kDisableContextualSearch)) {
+    // If both enable and disable flags are present, disable wins.
     return NO;
-  } else if (base::CommandLine::ForCurrentProcess()->HasSwitch(
-                 switches::kEnableContextualSearch)) {
-    available = YES;
-  } else {
-    available =
-        base::FieldTrialList::FindFullName(kContextualSearchFieldTrialName) ==
-        kContextualSearchFieldTrialEnabled;
   }
-  return available && !tests_hook::DisableContextualSearch();
+
+  if (base::CommandLine::ForCurrentProcess()->HasSwitch(
+          switches::kEnableContextualSearch)) {
+    // Even if the command line flag is flipped, don't enable the feature if
+    // test hooks disable it.
+    return !tests_hook::DisableContextualSearch();
+  }
+
+  return NO;
 }
 
 - (instancetype)initWithBrowserState:(ios::ChromeBrowserState*)browserState {

diff --git a/ios/chrome/browser/ui/contextual_search/touch_to_search_permissions_mediator_unittest.mm b/ios/chrome/browser/ui/contextual_search/touch_to_search_permissions_mediator_unittest.mm
index 0459922..73bee7c 100644
--- a/ios/chrome/browser/ui/contextual_search/touch_to_search_permissions_mediator_unittest.mm
+++ b/ios/chrome/browser/ui/contextual_search/touch_to_search_permissions_mediator_unittest.mm

@@ -555,11 +555,14 @@
 }
 
 TEST(TouchToSearchPermissionsAvailabilityTest, FieldTrial) {
+  // Field trial support is not currently supported, so it is expected
+  // that under all field trial configs, the feature will remain disabled.
+  // If field trial support is added back in, this test should be updated.
   const struct {
     const std::string trial_group_name;
     bool expect_available;
   } tests[] = {
-      {"Enabled", true},
+      {"Enabled", false},
       {"Disabled", false},
       {"Control", false},
       {"Spadoinkle", false},

diff --git a/ios/chrome/browser/ui/reading_list/reading_list_view_controller.mm b/ios/chrome/browser/ui/reading_list/reading_list_view_controller.mm
index de07e31..07473ac 100644
--- a/ios/chrome/browser/ui/reading_list/reading_list_view_controller.mm
+++ b/ios/chrome/browser/ui/reading_list/reading_list_view_controller.mm

@@ -124,6 +124,8 @@
 // Returns whether there are elements in the section identified by
 // |sectionIdentifier|.
 - (BOOL)hasItemInSection:(SectionIdentifier)sectionIdentifier;
+// Adds an empty background if needed.
+- (void)collectionIsEmpty;
 // Updates the toolbar state according to the selected items.
 - (void)updateToolbarState;
 // Displays an action sheet to let the user choose to mark all the elements as
@@ -486,10 +488,9 @@
   [super loadModel];
 
   if (self.readingListModel->size() == 0) {
-    // The collection is empty, add background.
-    self.collectionView.backgroundView = _emptyCollectionBackground;
-    [self.audience setCollectionHasItems:NO];
+    [self collectionIsEmpty];
   } else {
+    self.collectionView.alwaysBounceVertical = YES;
     [self loadItems];
     self.collectionView.backgroundView = nil;
     [self.audience setCollectionHasItems:YES];
@@ -622,6 +623,16 @@
   return numberOfItems > 0;
 }
 
+- (void)collectionIsEmpty {
+  if (self.collectionView.backgroundView) {
+    return;
+  }
+  // The collection is empty, add background.
+  self.collectionView.alwaysBounceVertical = NO;
+  self.collectionView.backgroundView = _emptyCollectionBackground;
+  [self.audience setCollectionHasItems:NO];
+}
+
 #pragma mark - ReadingListToolbarDelegate
 
 - (void)markPressed {
@@ -1083,6 +1094,9 @@
     }
   }
                                 completion:nil];
+  if (_readingListModel->size() == 0) {
+    [self collectionIsEmpty];
+  }
 }
 
 - (void)exitEditingModeAnimated:(BOOL)animated {

diff --git a/ios/chrome/browser/ui/suggestions/BUILD.gn b/ios/chrome/browser/ui/suggestions/BUILD.gn
new file mode 100644
index 0000000..21ee0b6d
--- /dev/null
+++ b/ios/chrome/browser/ui/suggestions/BUILD.gn

@@ -0,0 +1,22 @@
+# Copyright 2016 The Chromium Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+source_set("suggestions") {
+  configs += [ "//build/config/compiler:enable_arc" ]
+  sources = [
+    "suggestions_commands.h",
+    "suggestions_item_actions.h",
+    "suggestions_view_controller.h",
+    "suggestions_view_controller.mm",
+  ]
+  deps = [
+    "//base",
+    "//ios/chrome/browser/ui",
+    "//ios/chrome/browser/ui/collection_view",
+    "//ios/third_party/material_roboto_font_loader_ios",
+  ]
+  public_deps = [
+    "//ios/third_party/material_components_ios",
+  ]
+}

diff --git a/ios/chrome/browser/ui/suggestions/OWNERS b/ios/chrome/browser/ui/suggestions/OWNERS
new file mode 100644
index 0000000..2d35f0a
--- /dev/null
+++ b/ios/chrome/browser/ui/suggestions/OWNERS

@@ -0,0 +1 @@
+gambard@chromium.org

diff --git a/ios/chrome/browser/ui/suggestions/suggestions_commands.h b/ios/chrome/browser/ui/suggestions/suggestions_commands.h
new file mode 100644
index 0000000..dff2596
--- /dev/null
+++ b/ios/chrome/browser/ui/suggestions/suggestions_commands.h

@@ -0,0 +1,16 @@
+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef IOS_CHROME_BROWSER_UI_SUGGESTIONS_SUGGESTIONS_COMMANDS_H_
+#define IOS_CHROME_BROWSER_UI_SUGGESTIONS_SUGGESTIONS_COMMANDS_H_
+
+// Commands protocol for the SuggestionsViewController.
+@protocol SuggestionsCommands
+
+// Adds a new empty SuggestionItem.
+- (void)addEmptyItem;
+
+@end
+
+#endif  // IOS_CHROME_BROWSER_UI_SUGGESTIONS_SUGGESTIONS_COMMANDS_H_

diff --git a/ios/chrome/browser/ui/suggestions/suggestions_item_actions.h b/ios/chrome/browser/ui/suggestions/suggestions_item_actions.h
new file mode 100644
index 0000000..b3b0301
--- /dev/null
+++ b/ios/chrome/browser/ui/suggestions/suggestions_item_actions.h

@@ -0,0 +1,18 @@
+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef IOS_CHROME_BROWSER_UI_SUGGESTIONS_SUGGESTIONS_ITEM_ACTIONS_H_
+#define IOS_CHROME_BROWSER_UI_SUGGESTIONS_SUGGESTIONS_ITEM_ACTIONS_H_
+
+// Protocol handling the actions sent in the responder chain by the suggestions
+// items.
+@protocol SuggestionsItemActions
+
+// Sent through the responder chain when the button of a suggestion item is
+// pressed.
+- (void)addNewItem:(id)sender;
+
+@end
+
+#endif  // IOS_CHROME_BROWSER_UI_SUGGESTIONS_SUGGESTIONS_ITEM_ACTIONS_H_

diff --git a/ios/chrome/browser/ui/suggestions/suggestions_view_controller.h b/ios/chrome/browser/ui/suggestions/suggestions_view_controller.h
new file mode 100644
index 0000000..05c227f
--- /dev/null
+++ b/ios/chrome/browser/ui/suggestions/suggestions_view_controller.h

@@ -0,0 +1,22 @@
+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef IOS_CHROME_BROWSER_UI_SUGGESTIONS_SUGGESTIONS_VIEW_CONTROLLER_H_
+#define IOS_CHROME_BROWSER_UI_SUGGESTIONS_SUGGESTIONS_VIEW_CONTROLLER_H_
+
+#import <UIKit/UIKit.h>
+
+#import "ios/chrome/browser/ui/collection_view/collection_view_controller.h"
+
+@protocol SuggestionsCommands;
+
+// CollectionViewController to display the suggestions items.
+@interface SuggestionsViewController : CollectionViewController
+
+// Handler for the commands sent by the SuggestionsViewController.
+@property(nonatomic, weak) id<SuggestionsCommands> suggestionCommandHandler;
+
+@end
+
+#endif  // IOS_CHROME_BROWSER_UI_SUGGESTIONS_SUGGESTIONS_VIEW_CONTROLLER_H_

diff --git a/ios/chrome/browser/ui/suggestions/suggestions_view_controller.mm b/ios/chrome/browser/ui/suggestions/suggestions_view_controller.mm
new file mode 100644
index 0000000..42b56a6c
--- /dev/null
+++ b/ios/chrome/browser/ui/suggestions/suggestions_view_controller.mm

@@ -0,0 +1,56 @@
+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#import "ios/chrome/browser/ui/suggestions/suggestions_view_controller.h"
+
+#import "ios/chrome/browser/ui/collection_view/cells/MDCCollectionViewCell+Chrome.h"
+#import "ios/chrome/browser/ui/collection_view/cells/collection_view_item.h"
+#import "ios/chrome/browser/ui/collection_view/collection_view_model.h"
+#import "ios/chrome/browser/ui/suggestions/suggestions_commands.h"
+#import "ios/chrome/browser/ui/suggestions/suggestions_item_actions.h"
+
+#if !defined(__has_feature) || !__has_feature(objc_arc)
+#error "This file requires ARC support."
+#endif
+
+@interface SuggestionsViewController ()<SuggestionsItemActions>
+
+@end
+
+@implementation SuggestionsViewController
+
+@synthesize suggestionCommandHandler = _suggestionCommandHandler;
+
+#pragma mark - UIViewController
+
+- (void)viewDidLoad {
+  [super viewDidLoad];
+
+  self.collectionView.delegate = self;
+  self.styler.cellStyle = MDCCollectionViewCellStyleCard;
+}
+
+#pragma mark - MDCCollectionViewStylingDelegate
+
+- (CGFloat)collectionView:(UICollectionView*)collectionView
+    cellHeightAtIndexPath:(NSIndexPath*)indexPath {
+  CollectionViewItem* item =
+      [self.collectionViewModel itemAtIndexPath:indexPath];
+  UIEdgeInsets inset = [self collectionView:collectionView
+                                     layout:collectionView.collectionViewLayout
+                     insetForSectionAtIndex:indexPath.section];
+
+  return [MDCCollectionViewCell
+      cr_preferredHeightForWidth:CGRectGetWidth(collectionView.bounds) -
+                                 inset.left - inset.right
+                         forItem:item];
+}
+
+#pragma mark - SuggestionsItemActions
+
+- (void)addNewItem:(id)sender {
+  [self.suggestionCommandHandler addEmptyItem];
+}
+
+@end

diff --git a/ios/showcase/BUILD.gn b/ios/showcase/BUILD.gn
index ff70d5fd..2969252 100644
--- a/ios/showcase/BUILD.gn
+++ b/ios/showcase/BUILD.gn

@@ -28,6 +28,7 @@
     "//ios/chrome/browser/ui/tools:tools_ui",
     "//ios/showcase/settings",
     "//ios/showcase/strip",
+    "//ios/showcase/suggestions",
     "//ios/showcase/tab_grid",
     "//ios/showcase/uikit_table_view_cell",
   ]

diff --git a/ios/showcase/core/BUILD.gn b/ios/showcase/core/BUILD.gn
index 91485ef..4b0ed97 100644
--- a/ios/showcase/core/BUILD.gn
+++ b/ios/showcase/core/BUILD.gn

@@ -25,6 +25,13 @@
   ]
   deps = [
     ":core",
+
+    # Needed to disable the tests hooks.
+    "//ios/chrome/app:tests_fake_hook",
+
+    # Needed for including ios/chrome/browser/ui.
+    "//ios/chrome/browser/tabs:tabs_internal",
+    "//ios/chrome/browser/ui:ui_internal",
   ]
   libs = [ "UIKit.framework" ]
   configs += [ "//build/config/compiler:enable_arc" ]

diff --git a/ios/showcase/core/showcase_model.mm b/ios/showcase/core/showcase_model.mm
index 6185b51..f3b4c67 100644
--- a/ios/showcase/core/showcase_model.mm
+++ b/ios/showcase/core/showcase_model.mm

@@ -22,6 +22,11 @@
       showcase::kUseCaseKey : @"Main settings screen",
     },
     @{
+      showcase::kClassForDisplayKey : @"SuggestionsViewController",
+      showcase::kClassForInstantiationKey : @"SCSuggestionsCoordinator",
+      showcase::kUseCaseKey : @"New Suggestions UI",
+    },
+    @{
       showcase::kClassForDisplayKey : @"MenuViewController",
       showcase::kClassForInstantiationKey : @"MenuViewController",
       showcase::kUseCaseKey : @"Tools menu",

diff --git a/ios/showcase/suggestions/BUILD.gn b/ios/showcase/suggestions/BUILD.gn
new file mode 100644
index 0000000..3bf7c77
--- /dev/null
+++ b/ios/showcase/suggestions/BUILD.gn

@@ -0,0 +1,29 @@
+# Copyright 2016 The Chromium Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+source_set("suggestions") {
+  sources = [
+    "sc_suggestions_coordinator.h",
+    "sc_suggestions_coordinator.mm",
+  ]
+  deps = [
+    "//base",
+    "//ios/chrome/browser/ui/suggestions",
+    "//ios/showcase/common",
+  ]
+  libs = [ "UIKit.framework" ]
+  configs += [ "//build/config/compiler:enable_arc" ]
+}
+
+source_set("eg_tests") {
+  testonly = true
+  sources = [
+    "sc_suggestions_egtest.mm",
+  ]
+  deps = [
+    "//ios/showcase/test",
+    "//ios/third_party/earl_grey",
+  ]
+  configs += [ "//build/config/compiler:enable_arc" ]
+}

diff --git a/ios/showcase/suggestions/DEPS b/ios/showcase/suggestions/DEPS
new file mode 100644
index 0000000..59ed271
--- /dev/null
+++ b/ios/showcase/suggestions/DEPS

@@ -0,0 +1,3 @@
+include_rules = [
+  "+ios/third_party/material_components_ios",
+]

diff --git a/ios/showcase/suggestions/sc_suggestions_coordinator.h b/ios/showcase/suggestions/sc_suggestions_coordinator.h
new file mode 100644
index 0000000..695af48
--- /dev/null
+++ b/ios/showcase/suggestions/sc_suggestions_coordinator.h

@@ -0,0 +1,19 @@
+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef IOS_SHOWCASE_SUGGESTIONS_SC_SUGGESTIONS_COORDINATOR_H_
+#define IOS_SHOWCASE_SUGGESTIONS_SC_SUGGESTIONS_COORDINATOR_H_
+
+#import <UIKit/UIKit.h>
+
+#import "ios/showcase/common/coordinator.h"
+
+@interface SCSuggestionsCoordinator : NSObject<Coordinator>
+
+// Redefined to be a UINavigationController.
+@property(nonatomic, weak) UINavigationController* baseViewController;
+
+@end
+
+#endif  // IOS_SHOWCASE_SUGGESTIONS_SC_SUGGESTIONS_COORDINATOR_H_

diff --git a/ios/showcase/suggestions/sc_suggestions_coordinator.mm b/ios/showcase/suggestions/sc_suggestions_coordinator.mm
new file mode 100644
index 0000000..12f4deaa
--- /dev/null
+++ b/ios/showcase/suggestions/sc_suggestions_coordinator.mm

@@ -0,0 +1,38 @@
+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#import "ios/showcase/suggestions/sc_suggestions_coordinator.h"
+
+#import "ios/chrome/browser/ui/suggestions/suggestions_commands.h"
+#import "ios/chrome/browser/ui/suggestions/suggestions_view_controller.h"
+
+#if !defined(__has_feature) || !__has_feature(objc_arc)
+#error "This file requires ARC support."
+#endif
+
+@interface SCSuggestionsCoordinator ()<SuggestionsCommands>
+
+@end
+
+@implementation SCSuggestionsCoordinator
+
+@synthesize baseViewController;
+
+#pragma mark - Coordinator
+
+- (void)start {
+  SuggestionsViewController* suggestion = [[SuggestionsViewController alloc]
+      initWithStyle:CollectionViewControllerStyleDefault];
+
+  suggestion.suggestionCommandHandler = self;
+
+  [self.baseViewController pushViewController:suggestion animated:YES];
+}
+
+#pragma mark - SuggestionsCommands
+
+- (void)addEmptyItem {
+}
+
+@end

diff --git a/ios/showcase/suggestions/sc_suggestions_egtest.mm b/ios/showcase/suggestions/sc_suggestions_egtest.mm
new file mode 100644
index 0000000..5a8ec1f
--- /dev/null
+++ b/ios/showcase/suggestions/sc_suggestions_egtest.mm

@@ -0,0 +1,25 @@
+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#import <EarlGrey/EarlGrey.h>
+
+#import "ios/showcase/test/showcase_test_case.h"
+
+#if !defined(__has_feature) || !__has_feature(objc_arc)
+#error "This file requires ARC support."
+#endif
+
+// Tests for the suggestions view controller.
+@interface SCSuggestionsTestCase : ShowcaseTestCase
+@end
+
+@implementation SCSuggestionsTestCase
+
+// Tests launching TabGridViewController and tapping a cell.
+- (void)testLaunchAndTappingCell {
+  [[EarlGrey selectElementWithMatcher:grey_text(@"SuggestionsViewController")]
+      performAction:grey_tap()];
+}
+
+@end

diff --git a/ios/third_party/material_roboto_font_loader_ios/BUILD.gn b/ios/third_party/material_roboto_font_loader_ios/BUILD.gn
index 7f6d49d..6a3dd76 100644
--- a/ios/third_party/material_roboto_font_loader_ios/BUILD.gn
+++ b/ios/third_party/material_roboto_font_loader_ios/BUILD.gn

@@ -2,19 +2,9 @@
 # Use of this source code is governed by a BSD-style license that can be
 # found in the LICENSE file.
 
-# TODO(crbug.com/673904): Version v1.1.1 of material_components_ios uses a
-# CocoaPods path to access MaterialTypography.h which breaks Chromium build.
-# This variable protects the workaround so that it is clear what needs to be
-# updated once upstream code has been fixed.
-use_material_typography_workaround = true
-
 config("material_roboto_font_loader_ios_config") {
   include_dirs = [ "src/src" ]
   visibility = [ ":material_roboto_font_loader_ios" ]
-
-  if (use_material_typography_workaround) {
-    include_dirs += [ "local_src" ]
-  }
 }
 
 source_set("material_roboto_font_loader_ios") {

diff --git a/ios/third_party/material_roboto_font_loader_ios/local_src/MaterialComponents/MaterialTypography.h b/ios/third_party/material_roboto_font_loader_ios/local_src/MaterialComponents/MaterialTypography.h
deleted file mode 100644
index becdfe53..0000000
--- a/ios/third_party/material_roboto_font_loader_ios/local_src/MaterialComponents/MaterialTypography.h
+++ /dev/null

@@ -1,19 +0,0 @@
-// Copyright 2017 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef IOS_THIRD_PARTY_MATERIAL_ROBOTO_FONT_LOADER_IOS_LOCAL_SRC_MATERIALCOMPONENTS_MATERIALTYPOGRAPHY_H_
-#define IOS_THIRD_PARTY_MATERIAL_ROBOTO_FONT_LOADER_IOS_LOCAL_SRC_MATERIALCOMPONENTS_MATERIALTYPOGRAPHY_H_
-
-// Version v1.1.1 of material_components_ios uses a CocoaPods path to access
-// MaterialTypography.h which breaks Chromium build. This file should be
-// deleted once upstream code has been fixed.
-
-// Use #import <> to force lookup in the directories listed in include_dirs
-// thus allowing importing the file from material_components_ios instead of
-// the current file (as using #import "" will start the file lookup in the
-// current directory and will resolve to the current file, aka auto-import).
-
-#import <MaterialTypography.h>
-
-#endif  // IOS_THIRD_PARTY_MATERIAL_ROBOTO_FONT_LOADER_IOS_LOCAL_SRC_MATERIALCOMPONENTS_MATERIALTYPOGRAPHY_H_

diff --git a/media/base/media_switches.cc b/media/base/media_switches.cc
index eda4275..5299efe7 100644
--- a/media/base/media_switches.cc
+++ b/media/base/media_switches.cc

@@ -189,7 +189,7 @@
 
 // Lock the screen orientation when a video goes fullscreen.
 const base::Feature kVideoFullscreenOrientationLock{
-    "VideoFullscreenOrientationLock", base::FEATURE_DISABLED_BY_DEFAULT};
+    "VideoFullscreenOrientationLock", base::FEATURE_ENABLED_BY_DEFAULT};
 #endif
 
 }  // namespace media

diff --git a/media/gpu/video_decode_accelerator_unittest.cc b/media/gpu/video_decode_accelerator_unittest.cc
index 9611b14..96e5d0b0 100644
--- a/media/gpu/video_decode_accelerator_unittest.cc
+++ b/media/gpu/video_decode_accelerator_unittest.cc

@@ -217,15 +217,15 @@
     if (md5_string.at(0) == '#')
       continue;
 
-    LOG_ASSERT(static_cast<int>(md5_string.length()) == kMD5StringLength)
-        << md5_string;
+    LOG_IF(ERROR, static_cast<int>(md5_string.length()) != kMD5StringLength)
+        << "MD5 length error: " << md5_string;
     bool hex_only = std::count_if(md5_string.begin(), md5_string.end(),
                                   isxdigit) == kMD5StringLength;
-    LOG_ASSERT(hex_only) << md5_string;
+    LOG_IF(ERROR, !hex_only) << "MD5 includes non-hex char: " << md5_string;
   }
-  LOG_ASSERT(md5_strings->size() >= 1U) << "  MD5 checksum file ("
-                                        << filepath.MaybeAsASCII()
-                                        << ") missing or empty.";
+  LOG_IF(ERROR, md5_strings->empty()) << "  MD5 checksum file ("
+                                      << filepath.MaybeAsASCII()
+                                      << ") missing or empty.";
 }
 
 // State of the GLRenderingVDAClient below.  Order matters here as the test
@@ -808,6 +808,9 @@
 
 void GLRenderingVDAClient::NotifyEndOfBitstreamBuffer(
     int32_t bitstream_buffer_id) {
+  if (decoder_deleted())
+    return;
+
   // TODO(fischman): this test currently relies on this notification to make
   // forward progress during a Reset().  But the VDA::Reset() API doesn't
   // guarantee this, so stop relying on it (and remove the notifications from
@@ -925,9 +928,8 @@
   base::STLClearObject(&encoded_data_);
   active_textures_.clear();
 
-  // Cascade through the rest of the states to simplify test code below.
-  for (int i = state_ + 1; i < CS_MAX; ++i)
-    SetState(static_cast<ClientState>(i));
+  // Set state to CS_DESTROYED after decoder is deleted.
+  SetState(CS_DESTROYED);
 }
 
 std::string GLRenderingVDAClient::GetBytesForFirstFragment(size_t start_pos,
@@ -1129,7 +1131,7 @@
  protected:
   // Must be static because this method may run after the destructor.
   template <typename T>
-  static void Delete(std::unique_ptr<T> item) {
+  static void Delete(T item) {
     // |item| is cleared when the scope of this function is left.
   }
 
@@ -1147,12 +1149,9 @@
 }
 
 void VideoDecodeAcceleratorTest::TearDown() {
-  std::unique_ptr<TestFilesVector> test_video_files(new TestFilesVector);
-  test_video_files->swap(test_video_files_);
-
   g_env->GetRenderingTaskRunner()->PostTask(
       FROM_HERE,
-      base::Bind(&Delete<TestFilesVector>, base::Passed(&test_video_files)));
+      base::Bind(&Delete<TestFilesVector>, base::Passed(&test_video_files_)));
 
   base::WaitableEvent done(base::WaitableEvent::ResetPolicy::AUTOMATIC,
                            base::WaitableEvent::InitialState::NOT_SIGNALED);
@@ -1291,7 +1290,31 @@
 class VideoDecodeAcceleratorParamTest
     : public VideoDecodeAcceleratorTest,
       public ::testing::WithParamInterface<
-          std::tuple<int, int, int, ResetPoint, ClientState, bool, bool>> {};
+          std::tuple<int, int, int, ResetPoint, ClientState, bool, bool>> {
+ protected:
+  using NotesVector =
+      std::vector<std::unique_ptr<ClientStateNotification<ClientState>>>;
+  using ClientsVector = std::vector<std::unique_ptr<GLRenderingVDAClient>>;
+
+  void TearDown() override;
+
+  NotesVector notes_;
+  ClientsVector clients_;
+};
+
+void VideoDecodeAcceleratorParamTest::TearDown() {
+  // |clients_| must be deleted first because |clients_| use |notes_|.
+  g_env->GetRenderingTaskRunner()->PostTask(
+      FROM_HERE, base::Bind(&Delete<ClientsVector>, base::Passed(&clients_)));
+
+  g_env->GetRenderingTaskRunner()->PostTask(
+      FROM_HERE, base::Bind(&Delete<NotesVector>, base::Passed(&notes_)));
+
+  WaitUntilIdle();
+
+  // Do VideoDecodeAcceleratorTest clean-up after deleting clients and notes.
+  VideoDecodeAcceleratorTest::TearDown();
+}
 
 // Wait for |note| to report a state and if it's not |expected_state| then
 // assert |client| has deleted its decoder.
@@ -1299,6 +1322,9 @@
     ClientStateNotification<ClientState>* note,
     GLRenderingVDAClient* client,
     ClientState expected_state) {
+  // Skip waiting state if decoder of |client| is already deleted.
+  if (client->decoder_deleted())
+    return;
   ClientState state = note->Wait();
   if (state == expected_state)
     return;
@@ -1335,11 +1361,8 @@
   // Suppress GL rendering for all tests when the "--rendering_fps" is 0.
   const bool suppress_rendering = g_rendering_fps == 0;
 
-  using NotesVector =
-      std::vector<std::unique_ptr<ClientStateNotification<ClientState>>>;
-  using ClientsVector = std::vector<std::unique_ptr<GLRenderingVDAClient>>;
-  NotesVector notes(num_concurrent_decoders);
-  ClientsVector clients(num_concurrent_decoders);
+  notes_.resize(num_concurrent_decoders);
+  clients_.resize(num_concurrent_decoders);
 
   RenderingHelperParams helper_params;
   helper_params.rendering_fps = g_rendering_fps;
@@ -1358,7 +1381,7 @@
         test_video_files_[index % test_video_files_.size()].get();
     std::unique_ptr<ClientStateNotification<ClientState>> note =
         base::MakeUnique<ClientStateNotification<ClientState>>();
-    notes[index] = std::move(note);
+    notes_[index] = std::move(note);
 
     int delay_after_frame_num = std::numeric_limits<int>::max();
     if (test_reuse_delay &&
@@ -1368,14 +1391,14 @@
 
     std::unique_ptr<GLRenderingVDAClient> client =
         base::MakeUnique<GLRenderingVDAClient>(
-            index, &rendering_helper_, notes[index].get(), video_file->data_str,
-            num_in_flight_decodes, num_play_throughs,
+            index, &rendering_helper_, notes_[index].get(),
+            video_file->data_str, num_in_flight_decodes, num_play_throughs,
             video_file->reset_after_frame_num, delete_decoder_state,
             video_file->width, video_file->height, video_file->profile,
             g_fake_decoder, suppress_rendering, delay_after_frame_num, 0,
             render_as_thumbnails);
 
-    clients[index] = std::move(client);
+    clients_[index] = std::move(client);
     helper_params.window_sizes.push_back(
         render_as_thumbnails
             ? kThumbnailsPageSize
@@ -1385,14 +1408,14 @@
   InitializeRenderingHelper(helper_params);
 
   for (size_t index = 0; index < num_concurrent_decoders; ++index) {
-    CreateAndStartDecoder(clients[index].get(), notes[index].get());
+    CreateAndStartDecoder(clients_[index].get(), notes_[index].get());
   }
 
   // Then wait for all the decodes to finish.
   // Only check performance & correctness later if we play through only once.
   bool skip_performance_and_correctness_checks = num_play_throughs > 1;
   for (size_t i = 0; i < num_concurrent_decoders; ++i) {
-    ClientStateNotification<ClientState>* note = notes[i].get();
+    ClientStateNotification<ClientState>* note = notes_[i].get();
     ClientState state = note->Wait();
     if (state != CS_INITIALIZED) {
       skip_performance_and_correctness_checks = true;
@@ -1403,29 +1426,28 @@
                 static_cast<size_t>(kMinSupportedNumConcurrentDecoders));
       continue;
     }
-    ASSERT_EQ(state, CS_INITIALIZED);
     for (int n = 0; n < num_play_throughs; ++n) {
       // For play-throughs other than the first, we expect initialization to
       // succeed unconditionally.
       if (n > 0) {
         ASSERT_NO_FATAL_FAILURE(AssertWaitForStateOrDeleted(
-            note, clients[i].get(), CS_INITIALIZED));
+            note, clients_[i].get(), CS_INITIALIZED));
       }
       // InitializeDone kicks off decoding inside the client, so we just need to
       // wait for Flush.
       ASSERT_NO_FATAL_FAILURE(
-          AssertWaitForStateOrDeleted(note, clients[i].get(), CS_FLUSHING));
+          AssertWaitForStateOrDeleted(note, clients_[i].get(), CS_FLUSHING));
       ASSERT_NO_FATAL_FAILURE(
-          AssertWaitForStateOrDeleted(note, clients[i].get(), CS_FLUSHED));
+          AssertWaitForStateOrDeleted(note, clients_[i].get(), CS_FLUSHED));
       // FlushDone requests Reset().
       ASSERT_NO_FATAL_FAILURE(
-          AssertWaitForStateOrDeleted(note, clients[i].get(), CS_RESETTING));
+          AssertWaitForStateOrDeleted(note, clients_[i].get(), CS_RESETTING));
     }
     ASSERT_NO_FATAL_FAILURE(
-        AssertWaitForStateOrDeleted(note, clients[i].get(), CS_RESET));
+        AssertWaitForStateOrDeleted(note, clients_[i].get(), CS_RESET));
     // ResetDone requests Destroy().
     ASSERT_NO_FATAL_FAILURE(
-        AssertWaitForStateOrDeleted(note, clients[i].get(), CS_DESTROYED));
+        AssertWaitForStateOrDeleted(note, clients_[i].get(), CS_DESTROYED));
   }
   // Finally assert that decoding went as expected.
   for (size_t i = 0;
@@ -1435,7 +1457,7 @@
     // allowed to finish.
     if (delete_decoder_state < CS_FLUSHED)
       continue;
-    GLRenderingVDAClient* client = clients[i].get();
+    GLRenderingVDAClient* client = clients_[i].get();
     TestVideoFile* video_file =
         test_video_files_[i % test_video_files_.size()].get();
     if (video_file->num_frames > 0) {
@@ -1497,9 +1519,9 @@
       int num_bytes =
           base::WriteFile(GetTestDataFile(filepath),
                           reinterpret_cast<char*>(&png[0]), png.size());
-      ASSERT_EQ(num_bytes, static_cast<int>(png.size()));
+      EXPECT_EQ(num_bytes, static_cast<int>(png.size()));
     }
-    ASSERT_NE(match, golden_md5s.end());
+    EXPECT_NE(match, golden_md5s.end());
     EXPECT_EQ(alpha_solid, true) << "RGBA frame had incorrect alpha";
   }
 
@@ -1511,23 +1533,9 @@
         base::FilePath(g_output_log),
         base::File::FLAG_CREATE_ALWAYS | base::File::FLAG_WRITE);
     for (size_t i = 0; i < num_concurrent_decoders; ++i) {
-      clients[i]->OutputFrameDeliveryTimes(&output_file);
+      clients_[i]->OutputFrameDeliveryTimes(&output_file);
     }
   }
-
-  std::unique_ptr<ClientsVector> clients2(new ClientsVector);
-  clients2->swap(clients);
-  std::unique_ptr<NotesVector> notes2(new NotesVector);
-  notes2->swap(notes);
-
-  // |clients| must be deleted first because |clients| use |notes2|.
-  g_env->GetRenderingTaskRunner()->PostTask(
-      FROM_HERE, base::Bind(&Delete<ClientsVector>, base::Passed(&clients2)));
-
-  g_env->GetRenderingTaskRunner()->PostTask(
-      FROM_HERE, base::Bind(&Delete<NotesVector>, base::Passed(&notes2)));
-
-  WaitUntilIdle();
 };
 
 // Test that replay after EOS works fine.

diff --git a/net/http/http_network_session.cc b/net/http/http_network_session.cc
index feb747d..c64755a7 100644
--- a/net/http/http_network_session.cc
+++ b/net/http/http_network_session.cc

@@ -99,19 +99,19 @@
 }  // unnamed namespace
 
 HttpNetworkSession::Params::Params()
-    : client_socket_factory(NULL),
-      host_resolver(NULL),
-      cert_verifier(NULL),
-      channel_id_service(NULL),
-      transport_security_state(NULL),
-      cert_transparency_verifier(NULL),
-      ct_policy_enforcer(NULL),
-      proxy_service(NULL),
-      ssl_config_service(NULL),
-      http_auth_handler_factory(NULL),
-      net_log(NULL),
-      host_mapping_rules(NULL),
-      socket_performance_watcher_factory(NULL),
+    : client_socket_factory(nullptr),
+      host_resolver(nullptr),
+      cert_verifier(nullptr),
+      channel_id_service(nullptr),
+      transport_security_state(nullptr),
+      cert_transparency_verifier(nullptr),
+      ct_policy_enforcer(nullptr),
+      proxy_service(nullptr),
+      ssl_config_service(nullptr),
+      http_auth_handler_factory(nullptr),
+      net_log(nullptr),
+      host_mapping_rules(nullptr),
+      socket_performance_watcher_factory(nullptr),
       ignore_certificate_errors(false),
       testing_fixed_http_port(0),
       testing_fixed_https_port(0),
@@ -134,8 +134,8 @@
       quic_socket_receive_buffer_size(kQuicSocketReceiveBufferSize),
       quic_delay_tcp_race(true),
       quic_max_server_configs_stored_in_properties(0u),
-      quic_clock(NULL),
-      quic_random(NULL),
+      quic_clock(nullptr),
+      quic_random(nullptr),
       quic_max_packet_length(kDefaultMaxPacketSize),
       enable_user_alternate_protocol_ports(false),
       quic_crypto_client_stream_factory(
@@ -153,7 +153,7 @@
       quic_force_hol_blocking(false),
       quic_race_cert_verification(false),
       quic_do_not_fragment(false),
-      proxy_delegate(NULL),
+      proxy_delegate(nullptr),
       enable_token_binding(false),
       http_09_on_non_default_ports_enabled(false),
       restrict_to_one_preconnect_for_proxies(false) {
@@ -318,7 +318,7 @@
 std::unique_ptr<base::Value> HttpNetworkSession::QuicInfoToValue() const {
   std::unique_ptr<base::DictionaryValue> dict(new base::DictionaryValue());
   dict->Set("sessions", quic_stream_factory_.QuicStreamFactoryInfoToValue());
-  dict->SetBoolean("quic_enabled", params_.enable_quic);
+  dict->SetBoolean("quic_enabled", IsQuicEnabled());
   std::unique_ptr<base::ListValue> connection_options(new base::ListValue);
   for (QuicTagVector::const_iterator it =
            params_.quic_connection_options.begin();
@@ -384,7 +384,7 @@
     case kProtoHTTP2:
       return params_.enable_http2;
     case kProtoQUIC:
-      return params_.enable_quic;
+      return IsQuicEnabled();
   }
   NOTREACHED();
   return false;
@@ -438,6 +438,14 @@
                         http_network_session_dump->guid());
 }
 
+bool HttpNetworkSession::IsQuicEnabled() const {
+  return params_.enable_quic;
+}
+
+void HttpNetworkSession::DisableQuic() {
+  params_.enable_quic = false;
+}
+
 ClientSocketPoolManager* HttpNetworkSession::GetSocketPoolManager(
     SocketPoolType pool_type) {
   switch (pool_type) {

diff --git a/net/http/http_network_session.h b/net/http/http_network_session.h
index 0987d548..bf64368 100644
--- a/net/http/http_network_session.h
+++ b/net/http/http_network_session.h

@@ -298,6 +298,12 @@
   void DumpMemoryStats(base::trace_event::ProcessMemoryDump* pmd,
                        const std::string& parent_absolute_name) const;
 
+  // Evaluates if QUIC is enabled for new streams.
+  bool IsQuicEnabled() const;
+
+  // Disable QUIC for new streams.
+  void DisableQuic();
+
  private:
   friend class HttpNetworkSessionPeer;
 

diff --git a/net/http/http_stream_factory_impl_job.cc b/net/http/http_stream_factory_impl_job.cc
index 731d4d29..2cd3bcb 100644
--- a/net/http/http_stream_factory_impl_job.cc
+++ b/net/http/http_stream_factory_impl_job.cc

@@ -231,7 +231,7 @@
     DCHECK(origin_url_.SchemeIs(url::kHttpsScheme));
   }
   if (IsQuicAlternative()) {
-    DCHECK(session_->params().enable_quic);
+    DCHECK(session_->IsQuicEnabled());
     using_quic_ = true;
   }
 }
@@ -737,7 +737,7 @@
         ProxyServer::SCHEME_HTTPS | ProxyServer::SCHEME_SOCKS4 |
         ProxyServer::SCHEME_SOCKS5;
 
-    if (session_->params().enable_quic)
+    if (session_->IsQuicEnabled())
       supported_proxies |= ProxyServer::SCHEME_QUIC;
 
     proxy_info_.RemoveProxiesWithoutScheme(supported_proxies);
@@ -768,7 +768,7 @@
 }
 
 bool HttpStreamFactoryImpl::Job::ShouldForceQuic() const {
-  return session_->params().enable_quic &&
+  return session_->IsQuicEnabled() &&
          (base::ContainsKey(session_->params().origins_to_force_quic_on,
                             HostPortPair()) ||
           base::ContainsKey(session_->params().origins_to_force_quic_on,
@@ -819,11 +819,11 @@
   if (ShouldForceQuic())
     using_quic_ = true;
 
-  DCHECK(!using_quic_ || session_->params().enable_quic);
+  DCHECK(!using_quic_ || session_->IsQuicEnabled());
 
   if (proxy_info_.is_quic()) {
     using_quic_ = true;
-    DCHECK(session_->params().enable_quic);
+    DCHECK(session_->IsQuicEnabled());
   }
 
   if (proxy_info_.is_https() || proxy_info_.is_quic()) {

diff --git a/net/http/http_stream_factory_impl_job_controller.cc b/net/http/http_stream_factory_impl_job_controller.cc
index ac357011..c72fd3d 100644
--- a/net/http/http_stream_factory_impl_job_controller.cc
+++ b/net/http/http_stream_factory_impl_job_controller.cc

@@ -956,7 +956,7 @@
     }
 
     quic_all_broken = false;
-    if (!session_->params().enable_quic)
+    if (!session_->IsQuicEnabled())
       continue;
 
     if (!IsQuicWhitelistedForHost(origin.host()))
@@ -1056,7 +1056,7 @@
 
   if (alternative_proxy_server->is_quic()) {
     // Check that QUIC is enabled globally, and it is not disabled.
-    if (!session_->params().enable_quic ||
+    if (!session_->IsQuicEnabled() ||
         session_->quic_stream_factory()->IsQuicDisabled()) {
       return false;
     }

diff --git a/third_party/WebKit/LayoutTests/TestExpectations b/third_party/WebKit/LayoutTests/TestExpectations
index f4c71ca..0cd7d02 100644
--- a/third_party/WebKit/LayoutTests/TestExpectations
+++ b/third_party/WebKit/LayoutTests/TestExpectations

@@ -708,7 +708,6 @@
 crbug.com/636239 [ Win7 ] media/video-zoom-controls.html [ Failure ]
 
 crbug.com/432129 fast/html/marquee-scroll.html [ Failure Pass ]
-crbug.com/248938 [ Win Debug ] virtual/threaded/animations/transition-and-animation-2.html [ Timeout ]
 crbug.com/326139 crbug.com/390125 media/video-frame-accurate-seek.html [ Failure Pass ]
 crbug.com/248938 virtual/threaded/animations/animation-iteration-event-destroy-renderer.html [ Pass Timeout ]
 crbug.com/446385 [ Win7 Debug ] http/tests/xmlhttprequest/xmlhttprequest-json-response-overflow.html [ Crash Pass Timeout ]
@@ -717,7 +716,6 @@
 crbug.com/248938 virtual/threaded/transitions/change-duration-during-transition.html [ Pass Failure ]
 crbug.com/638693 virtual/threaded/animations/display-inline-style-adjust.html [ Pass Crash Failure ]
 crbug.com/421283 fast/html/marquee-scrollamount.html [ Pass Failure ]
-crbug.com/248938 [ Mac ] virtual/threaded/transitions/interrupted-all-transition.html [ Pass Failure ]
 
 crbug.com/659123 [ Mac ] fast/css/text-overflow-ellipsis-button.html [ Pass Failure ]
 
@@ -2356,31 +2354,6 @@
 crbug.com/678499 http/tests/security/contentSecurityPolicy/require-sri-for/require-sri-for-script-preload-allowed.php [ Failure Pass ]
 crbug.com/678499 virtual/mojo-loading/http/tests/security/contentSecurityPolicy/require-sri-for/require-sri-for-script-preload-allowed.php [ Failure Pass ]
 
-crbug.com/588060 editing/caret/caret-color-014.html [ NeedsRebaseline ]
-crbug.com/588060 editing/caret/caret-color-015.html [ NeedsRebaseline ]
-crbug.com/588060 editing/input/reveal-caret-of-multiline-contenteditable.html [ NeedsRebaseline ]
-crbug.com/588060 editing/inserting/4960120-2.html [ NeedsRebaseline ]
-crbug.com/588060 editing/inserting/5058163-1.html [ NeedsRebaseline ]
-crbug.com/588060 editing/inserting/5549929-2.html [ NeedsRebaseline ]
-crbug.com/588060 editing/inserting/5549929-3.html [ NeedsRebaseline ]
-crbug.com/588060 editing/inserting/editable-inline-element.html [ NeedsRebaseline ]
-crbug.com/588060 editing/inserting/insert-3800346-fix.html [ NeedsRebaseline ]
-crbug.com/588060 editing/inserting/line-break.html [ NeedsRebaseline ]
-crbug.com/588060 editing/inserting/paragraph-separator-in-table-1.html [ NeedsRebaseline ]
-crbug.com/588060 editing/inserting/paragraph-separator-in-table-2.html [ NeedsRebaseline ]
-crbug.com/588060 editing/pasteboard/5601583-1.html [ NeedsRebaseline ]
-crbug.com/588060 editing/pasteboard/paste-line-endings-001.html [ NeedsRebaseline ]
-crbug.com/588060 editing/selection/click-start-of-line.html [ NeedsRebaseline ]
-crbug.com/588060 editing/selection/move-3875618-fix.html [ NeedsRebaseline ]
-crbug.com/588060 editing/selection/move-backwords-by-word-001.html [ NeedsRebaseline ]
-crbug.com/588060 editing/selection/move-left-right.html [ NeedsRebaseline ]
-crbug.com/588060 editing/selection/move-past-trailing-space.html [ NeedsRebaseline ]
-crbug.com/588060 editing/selection/select-box.html [ NeedsRebaseline ]
-crbug.com/588060 editing/selection/selection-3748164-fix.html [ NeedsRebaseline ]
-crbug.com/588060 editing/unsupported-content/table-delete-001.html [ NeedsRebaseline ]
-crbug.com/588060 editing/unsupported-content/table-delete-003.html [ NeedsRebaseline ]
-crbug.com/588060 fast/text/delete-hard-break-character.html [ NeedsRebaseline ]
-crbug.com/588060 paint/invalidation/inline-outline-repaint.html [ NeedsRebaseline ]
-crbug.com/588060 virtual/stable/paint/invalidation/inline-outline-repaint.html [ NeedsRebaseline ]
-
 crbug.com/680043 sensor/ambient-light-sensor.html [ Pass Failure ]
+
+crbug.com/680050 inspector/sources/debugger-ui/watch-expressions-panel-switch.html [ Pass Timeout ]

diff --git a/third_party/WebKit/LayoutTests/W3CImportExpectations b/third_party/WebKit/LayoutTests/W3CImportExpectations
index c514e6d..6d513959 100644
--- a/third_party/WebKit/LayoutTests/W3CImportExpectations
+++ b/third_party/WebKit/LayoutTests/W3CImportExpectations

@@ -725,9 +725,10 @@
 imported/wpt/domxpath/001.html [ Skip ]
 imported/wpt/domxpath/002.html [ Skip ]
 
-# This test depends on a file (domxpath/xml_xpath_tests.xml) which is too large
+# This test depends on a file xml_xpath_tests.xml, which is too large
 # for Rietveld to handle now, so it's not currently imported.
 crbug.com/676491 imported/wpt/domxpath/xml_xpath_runner.html [ Skip ]
+crbug.com/676491 imported/wpt/domxpath/xml_xpath_tests.xml [ Skip ]
 
 # Manual tests that fail as TIMEOUT or NOTRUN. Consider adding wpt_automation.
 imported/wpt/FileAPI/BlobURL/test1-manual.html [ Skip ]

diff --git a/third_party/WebKit/LayoutTests/animations/transition-and-animation-2-expected.txt b/third_party/WebKit/LayoutTests/animations/transition-and-animation-2-expected.txt
deleted file mode 100644
index 837833cf..0000000
--- a/third_party/WebKit/LayoutTests/animations/transition-and-animation-2-expected.txt
+++ /dev/null

@@ -1,3 +0,0 @@
-Warning this test is running in real-time and may be flaky.
-PASS - "transform" property for "box" element at 0.4s saw something close to: none
-

diff --git a/third_party/WebKit/LayoutTests/animations/transition-and-animation-2.html b/third_party/WebKit/LayoutTests/animations/transition-and-animation-2.html
index 9709ef7..59ed7b30 100644
--- a/third_party/WebKit/LayoutTests/animations/transition-and-animation-2.html
+++ b/third_party/WebKit/LayoutTests/animations/transition-and-animation-2.html

@@ -1,11 +1,11 @@
-<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
-   "http://www.w3.org/TR/html4/loose.dtd">
-
-<html lang="en">
+<!DOCTYPE html>
+<html>
 <head>
-  <meta http-equiv="Content-Type" content="text/html; charset=utf-8">
+  <meta charset="utf-8">
+  <script src="../resources/testharness.js"></script>
+  <script src="../resources/testharnessreport.js"></script>
   <title>Transition/Animation Test #2</title>
-  <style type="text/css" media="screen">
+  <style>
     #box {
         position: absolute;
         left: 0;
@@ -13,44 +13,47 @@
         height: 100px;
         width: 100px;
         background-color: blue;
-        animation-duration: 0.3s;
-        animation-timing-function: linear;
-        animation-name: anim;
         transition-property: transform;
         transition-duration: 10s;
         transition-timing-function: linear;
     }
+    #box.running {
+        animation-duration: 0.3s;
+        animation-timing-function: linear;
+        animation-name: anim;
+    }
     @keyframes anim {
-        from { transform: translate(0,100px) }
-        to   { transform: translate(400px, 100px) }
+        from { transform: translate(0, 100px); }
+        to   { transform: translate(400px, 100px); }
     }
-    </style>
-    <script src="resources/animation-test-helpers.js" type="text/javascript" charset="utf-8"></script>
-    <script type="text/javascript" charset="utf-8">
-    
-    const expectedValues = [
-      // [time, element-id, property, expected-value, tolerance]
-      [0.4, "box", "transform", "none", 0],
-    ];
-
-    // FIXME: This doesn't get called so we don't trigger a transition...
-    function setup()
-    {
-        document.getElementById("box").style.transform = "translateX(400px)";
-    }
-    
-    runAnimationTest(expectedValues, undefined, undefined, 'do-not-use-pause-api');
-    
-  </script>
+  </style>
 </head>
 <body>
-This test has a transition and animation on the same property (transform).
-The animation starts and then the transition is triggered. The transition should start
-at the position before the animation started (the unanimated position), which is (0,0). If it
-starts from the start point of the animation (0,100) then there is an error
-<div id="box">
-</div>
-<div id="result">
-</div>
+  <div id="box"></div>
+  <script>
+    'use strict';
+    async_test(t => {
+
+      t.step(() => {
+        box.offsetTop; // force style recalc
+
+        // Start animation
+        box.classList.add('running');
+        // No transition - we jump to the animation's initial frame.
+        assert_equals(getComputedStyle(box).transform, 'matrix(1, 0, 0, 1, 0, 100)');
+
+        // This would trigger a transition if no animation was in progress.
+        box.style.transform = 'translate(400px, 0)';
+
+        // We remain at the animation's initial frame.
+        assert_equals(getComputedStyle(box).transform, 'matrix(1, 0, 0, 1, 0, 100)');
+      });
+
+      box.addEventListener('animationend', t.step_func_done(() => {
+        // No transition - the inline style takes immediate effect.
+        assert_equals(getComputedStyle(box).transform, 'matrix(1, 0, 0, 1, 400, 0)');
+      }));
+    }, 'Inline style applies when animation completes');
+  </script>
 </body>
 </html>

diff --git a/third_party/WebKit/LayoutTests/editing/pasteboard/copy-paste-underlined.html b/third_party/WebKit/LayoutTests/editing/pasteboard/copy-paste-underlined.html
index 38aea5bc..704b7aff 100644
--- a/third_party/WebKit/LayoutTests/editing/pasteboard/copy-paste-underlined.html
+++ b/third_party/WebKit/LayoutTests/editing/pasteboard/copy-paste-underlined.html

@@ -25,4 +25,27 @@
         '<div contenteditable id="paste"><u>foo bar baz.|</u></div>'
       ].join(''));
   }, 'Copy/paste underlined text.');
+
+test(() => {
+  assert_not_equals(
+      window.testRunner, undefined,
+     'This test requires testRunner.');
+
+  assert_selection(
+      [
+        '<div contenteditable spellcheck="false">^foo bar baz.|</div>',
+        '<div contenteditable id="paste"><br></div>'
+      ].join(''),
+      selection => {
+        const document = selection.document;
+        document.execCommand('underline');
+        document.execCommand('copy');
+        document.getElementById('paste').focus();
+        document.execCommand('paste');
+      },
+      [
+        '<div contenteditable spellcheck="false"><u>foo bar baz.</u></div>',
+        '<div contenteditable id="paste"><u>foo bar baz.|</u></div>'
+      ].join(''));
+  }, 'Copy/paste underlined text with spell checker off.');
 </script>

diff --git a/third_party/WebKit/LayoutTests/editing/selection/4947387.html b/third_party/WebKit/LayoutTests/editing/selection/4947387.html
deleted file mode 100644
index 4ecbe496..0000000
--- a/third_party/WebKit/LayoutTests/editing/selection/4947387.html
+++ /dev/null

@@ -1,26 +0,0 @@
-<p>This tests moveTo{Beginning, End}OfLineAndModifySelection.  It should operate on line boundaries and not paragraph boundaries.  To run it manually, click inside the first line of the editable region below and do Command+Shift+Left/Right Arrow, the selection should extend to the start/end of the line, not the start/end of the paragraph.  Also, moveTo{Beginning, End}OfParagraphAndModifySelection should work.</p>
-<div id="div" contenteditable="true" style="width: 200px;">The quick brown fox jumped over the lazy brown dog.</div>
-
-<script>
-
-if (window.testRunner) {
-
-    window.testRunner.dumpEditingCallbacks();
-    
-    var div = document.getElementById("div");
-    var text = div.firstChild;
-    var sel = window.getSelection();
-    
-    sel.collapse(text, text.length);
-    testRunner.execCommand("MoveToBeginningOfLineAndModifySelection");
-    
-    sel.collapse(text, 0);
-    testRunner.execCommand("MoveToEndOfLineAndModifySelection");
-
-    sel.collapse(text, text.length);
-    testRunner.execCommand("MoveToBeginningOfParagraphAndModifySelection");
-    
-    sel.collapse(text, 0);
-    testRunner.execCommand("MoveToEndOfParagraphAndModifySelection");
-}
-</script>

diff --git a/third_party/WebKit/LayoutTests/editing/selection/after-line-wrap.html b/third_party/WebKit/LayoutTests/editing/selection/after-line-wrap.html
deleted file mode 100644
index 104ca8e..0000000
--- a/third_party/WebKit/LayoutTests/editing/selection/after-line-wrap.html
+++ /dev/null

@@ -1,23 +0,0 @@
-<html>
-<head>
-<script>
-function editingTest() {
-    moveSelectionForwardByLineCommand();
-    extendSelectionForwardByCharacterCommand();
-    extendSelectionForwardByCharacterCommand();
-    extendSelectionForwardByCharacterCommand();
-}
-</script>
-<script src=../editing.js language="JavaScript" type="text/JavaScript"></script>
-</head>
-
-<body>
-<p><b>Make sure that your window is small enough</b> so that 'don't select this line' and 'try to select just this line' appear on two different lines.  The two phrases are actually in the same paragraph, there are just lots of spaces in between them.</p>
-<p>This is a test for <a href="https://bugs.webkit.org/show_bug.cgi?id=6632">REGRESSION: Selection includes spaces that it shouldn't</a>. The test makes sure that a word that is right after a line wrap can be selected successfully.</p>
-</p>
-<div id="test" contenteditable style="margin: 1em; border: 1px solid black; word-wrap: break-word; -khtml-nbsp-mode: space; -khtml-line-break: after-white-space;">
-don't select me &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<i>try to select just this text</i>
-</div>
-<script>runEditingTest()</script>
-</body>
-</html>

diff --git a/third_party/WebKit/LayoutTests/editing/selection/click-left-of-rtl-wrapping-text.html b/third_party/WebKit/LayoutTests/editing/selection/click-left-of-rtl-wrapping-text.html
deleted file mode 100644
index f9449b3..0000000
--- a/third_party/WebKit/LayoutTests/editing/selection/click-left-of-rtl-wrapping-text.html
+++ /dev/null

@@ -1,90 +0,0 @@
-<!DOCTYPE html>
-<html charset="utf-8">
-<body>
-<p>This tests clicking on the left of RTL text puts the caret at the end of the line.</p>
-<pre id="console"></pre>
-<script>
-
-if (window.testRunner)
-    testRunner.dumpAsText();
-
-var tests = [
-    {content: "&#1498; &#1500;&#1499;", expected: [2, 4]},
-    {content: "&#1499;&#1499; &#1499;&#1499;&#1499;&#1499; &#1499;&#1499;&#1499;", expected: [3, 8, 11]},
-    {content: "&#1490;&#1499; &#1497;&#1490;&#1499; &#1497;&#1490;&#1499; &#1497;&#1490;&#1499; &#1497;&#1490;&#1499;", width: "5ex",
-        expected: [3, 7, 11, 15, 18]},
-];
-
-function failed(message) {
-    console.innerHTML += 'FAIL: ' + message + '\n';
-}
-
-function passed(message) {
-    console.innerHTML += 'PASS: ' + message + '\n';
-}
-
-function runTest(container, test) {
-    container.style.width = '100%';
-    container.innerHTML = test.content;
-
-    // Starting from 5px, slowly increase the width until each word fits in one line.
-    var heightOfLine = container.offsetHeight;
-    var width = 5;
-    do {
-        container.style.width = width + 'px';
-        width++;
-    } while (container.offsetHeight > heightOfLine * test.expected.length);        
-    container.style.width = (width + 1) + 'px';
-
-    var x = 0;
-    var y = heightOfLine / 2;
-    var yIncrement = container.offsetHeight / test.expected.length;
-    var lines = ['st', 'nd', 'rd', 'th'];
-
-    if (!window.eventSender)
-        return;
-
-    for (var i = 0; i < test.expected.length; i++) {
-        eventSender.mouseMoveTo(container.offsetLeft + x, container.offsetTop + y);
-        eventSender.mouseDown();
-        eventSender.leapForward(100);
-        eventSender.mouseUp();
-        eventSender.leapForward(1000);
-
-        var line = (i + 1) + lines[Math.min(i, lines.length - 1)];
-        var action = 'clicking on the left of the ' + line + ' line of ' + test.content;
-
-        if (!window.getSelection().isCollapsed)
-            return failed(action + ' put selection instead of caret');
-
-        var range = window.getSelection().getRangeAt(0);
-        if (range.startContainer != container.firstChild)
-            return failed(action + ' put the caret at a wrong container');
-
-        action += ' put the caret at ' + range.startOffset;
-        if (range.startOffset != test.expected[i])
-            return failed(action + ' but expected at ' + test.expected[i]);
-        y += yIncrement;
-        passed(action);
-    }
-
-}
-
-var console = document.getElementById('console');
-
-var container = document.createElement('div');
-container.contentEditable = true;
-container.setAttribute('dir', 'rtl');
-document.body.appendChild(container);
-
-if (!window.eventSender)
-    failed('Clicking tests require eventSender');
-else {
-    for (var i = 0; i < tests.length; i++)
-        runTest(container, tests[i]);
-    container.innerHTML = '';
-}
-
-</script>
-</body>
-</html>

diff --git a/third_party/WebKit/LayoutTests/editing/selection/modify_move/move-by-paragraph.html b/third_party/WebKit/LayoutTests/editing/selection/modify_move/move-by-paragraph.html
new file mode 100644
index 0000000..abe5ed7c
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/editing/selection/modify_move/move-by-paragraph.html

@@ -0,0 +1,27 @@
+<!doctype html>
+<script src="../../../resources/testharness.js"></script>
+<script src="../../../resources/testharnessreport.js"></script>
+<script src="../../assert_selection.js"></script>
+<script>
+test(() => {
+  assert_selection(
+    '<div>foo<div>bar|</div>baz</div>',
+    selection => selection.modify('move', 'backward', 'paragraph'),
+    '<div>foo|<div>bar</div>baz</div>');
+  assert_selection(
+    '<div>foo<span>bar|</span>baz</div>',
+    selection => selection.modify('move', 'backward', 'paragraph'),
+    '<div>|foo<span>bar</span>baz</div>');
+    }, 'Selection.modify move backward by paragraph');
+
+test(() => {
+  assert_selection(
+    '<div>foo<div>|bar</div>baz</div>',
+    selection => selection.modify('move', 'forward', 'paragraph'),
+    '<div>foo<div>bar</div>|baz</div>');
+  assert_selection(
+    '<div>foo<span>|bar</span>baz</div>',
+    selection => selection.modify('move', 'forward', 'paragraph'),
+    '<div>foo<span>bar</span>baz|</div>');
+}, 'Selection.modify move forward by paragraph');
+</script>
\ No newline at end of file

diff --git a/third_party/WebKit/LayoutTests/editing/selection/modify_move/move-forward-after-line-break.html b/third_party/WebKit/LayoutTests/editing/selection/modify_move/move-forward-after-line-break.html
new file mode 100644
index 0000000..6adf95ac
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/editing/selection/modify_move/move-forward-after-line-break.html

@@ -0,0 +1,15 @@
+<!doctype html>
+<script src="../../../resources/testharness.js"></script>
+<script src="../../../resources/testharnessreport.js"></script>
+<script src="../../assert_selection.js"></script>
+<script>
+test(() => {
+  assert_selection(
+    '<div style="width:50px">|foo bar baz foo</div>',
+    selection => {
+      selection.modify('move', 'forward', 'line');
+      selection.modify('move', 'forward', 'character');
+    },
+    '<div style="width:50px">foo bar b|az foo</div>');
+}, 'Modify move forward after line break');
+</script>

diff --git a/third_party/WebKit/LayoutTests/editing/selection/mouse/click-left-of-rtl-wrapping-text.html b/third_party/WebKit/LayoutTests/editing/selection/mouse/click-left-of-rtl-wrapping-text.html
new file mode 100644
index 0000000..6fc5e24e
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/editing/selection/mouse/click-left-of-rtl-wrapping-text.html

@@ -0,0 +1,154 @@
+<!doctype html>
+<meta http-equiv="Content-type" content="text/html; charset=utf-8">
+<script src="../../../resources/testharness.js"></script>
+<script src="../../../resources/testharnessreport.js"></script>
+<script src="../../assert_selection.js"></script>
+<script>
+test(() => {
+  if (!window.eventSender) {
+    assert_no_reached('This test requires eventSender.');
+    return;
+  }
+
+  function testClickLeft(selection, lines, rowIndexToClick) {
+    const doc = selection.document;
+    const container = doc.querySelector('div');
+    // Adjust width to have |lines| of lines.
+    // Since the Ahem font doesn't cover characters used in test,
+    // we need to calc width depending on each platform.
+    const heightOfLine = container.offsetHeight;
+    let width = 5;
+    do {
+      container.style.width = `${width}px`;
+      width++;
+    } while (container.offsetHeight > heightOfLine * lines);
+    container.style.width = `${width + 1}px`;
+
+    // Click left of the |rowIndexToClick|th line.
+    eventSender.mouseMoveTo(
+      doc.offsetLeft + container.offsetLeft + 3,
+      doc.offsetTop + container.offsetTop + heightOfLine/2 + rowIndexToClick * heightOfLine);
+    eventSender.mouseDown();
+    eventSender.mouseUp();
+
+    // Remove width from style to clean result DOM.
+    container.style.removeProperty('width');
+    return heightOfLine;
+  }
+
+  assert_selection(
+    '<div contenteditable dir="rtl">&#1498; &#1500;&#1499;</div>',
+    selection => testClickLeft(selection, 2, 0),
+    '<div contenteditable dir="rtl">ך |לכ</div>');
+
+  assert_selection(
+    '<div contenteditable dir="rtl">&#1498; &#1500;&#1499;</div>',
+    selection => testClickLeft(selection, 2, 1),
+    '<div contenteditable dir="rtl">ך לכ|</div>');
+
+  assert_selection(
+    [
+      '<div contenteditable dir="rtl">',
+        '&#1499;&#1499; &#1499;&#1499;&#1499;&#1499; &#1499;&#1499;&#1499;',
+       '</div>'
+    ].join(''),
+    selection => testClickLeft(selection, 3, 0),
+    [
+      '<div contenteditable dir="rtl">',
+        'ככ |ככככ כככ',
+       '</div>'
+    ].join(''));
+
+  assert_selection(
+    [
+      '<div contenteditable dir="rtl">',
+        '&#1499;&#1499; &#1499;&#1499;&#1499;&#1499; &#1499;&#1499;&#1499;',
+       '</div>'
+    ].join(''),
+    selection => testClickLeft(selection, 3, 1),
+    [
+      '<div contenteditable dir="rtl">',
+        'ככ ככככ |כככ',
+       '</div>'
+    ].join(''));
+
+  assert_selection(
+    [
+      '<div contenteditable dir="rtl">',
+        '&#1499;&#1499; &#1499;&#1499;&#1499;&#1499; &#1499;&#1499;&#1499;',
+       '</div>'
+    ].join(''),
+    selection => testClickLeft(selection, 3, 2),
+    [
+      '<div contenteditable dir="rtl">',
+        'ככ ככככ כככ|',
+       '</div>'
+    ].join(''));
+
+  assert_selection(
+    [
+      '<div contenteditable dir="rtl">',
+        '&#1490;&#1499; &#1497;&#1490;&#1499; &#1497;&#1490;&#1499; &#1497;&#1490;&#1499; &#1497;&#1490;&#1499;',
+       '</div>'
+    ].join(''),
+    selection => testClickLeft(selection, 5, 0),
+    [
+      '<div contenteditable dir="rtl">',
+        'גכ |יגכ יגכ יגכ יגכ',
+       '</div>'
+    ].join(''));
+
+  assert_selection(
+    [
+      '<div contenteditable dir="rtl">',
+        '&#1490;&#1499; &#1497;&#1490;&#1499; &#1497;&#1490;&#1499; &#1497;&#1490;&#1499; &#1497;&#1490;&#1499;',
+       '</div>'
+    ].join(''),
+    selection => testClickLeft(selection, 5, 1),
+    [
+      '<div contenteditable dir="rtl">',
+        'גכ יגכ |יגכ יגכ יגכ',
+       '</div>'
+    ].join(''));
+
+  assert_selection(
+    [
+      '<div contenteditable dir="rtl">',
+        '&#1490;&#1499; &#1497;&#1490;&#1499; &#1497;&#1490;&#1499; &#1497;&#1490;&#1499; &#1497;&#1490;&#1499;',
+       '</div>'
+    ].join(''),
+    selection => testClickLeft(selection, 5, 2),
+    [
+      '<div contenteditable dir="rtl">',
+        'גכ יגכ יגכ |יגכ יגכ',
+       '</div>'
+    ].join(''));
+
+  assert_selection(
+    [
+      '<div contenteditable dir="rtl">',
+        '&#1490;&#1499; &#1497;&#1490;&#1499; &#1497;&#1490;&#1499; &#1497;&#1490;&#1499; &#1497;&#1490;&#1499;',
+       '</div>'
+    ].join(''),
+    selection => testClickLeft(selection, 5, 3),
+    [
+      '<div contenteditable dir="rtl">',
+        'גכ יגכ יגכ יגכ |יגכ',
+       '</div>'
+    ].join(''));
+
+  assert_selection(
+    [
+      '<div contenteditable dir="rtl">',
+        '&#1490;&#1499; &#1497;&#1490;&#1499; &#1497;&#1490;&#1499; &#1497;&#1490;&#1499; &#1497;&#1490;&#1499;',
+       '</div>'
+    ].join(''),
+    selection => testClickLeft(selection, 5, 4),
+    [
+      '<div contenteditable dir="rtl">',
+        'גכ יגכ יגכ יגכ יגכ|',
+       '</div>'
+    ].join(''));
+
+}, 'This tests clicking on the left of RTL text puts the caret at the end of the line');
+</script>
\ No newline at end of file

diff --git a/third_party/WebKit/LayoutTests/fast/dom/HTMLAnchorElement/remove-href-from-focused-anchor.html b/third_party/WebKit/LayoutTests/fast/dom/HTMLAnchorElement/remove-href-from-focused-anchor.html
deleted file mode 100644
index c2b2c98..0000000
--- a/third_party/WebKit/LayoutTests/fast/dom/HTMLAnchorElement/remove-href-from-focused-anchor.html
+++ /dev/null

@@ -1,18 +0,0 @@
-<!DOCTYPE html>
-<body>
-<a href="javascript:" id="target">link</a>
-<script src="../../../resources/js-test.js"></script>
-<script>
-jsTestIsAsync = true;
-var target = document.getElementById('target');
-target.focus();
-shouldBe('document.activeElement', 'target');
-debug('Remove href.');
-window.onload = function() {
-    target.removeAttribute('href');
-    shouldBe('document.activeElement', 'document.body');
-    target.remove();
-    finishJSTest();
-};
-</script>
-</body>

diff --git a/third_party/WebKit/LayoutTests/fast/dom/HTMLAnchorElement/remove-href-from-focused-anchor-expected.txt b/third_party/WebKit/LayoutTests/fast/dom/HTMLAnchorElement/update-href-of-focused-anchor-expected.txt
similarity index 73%
rename from third_party/WebKit/LayoutTests/fast/dom/HTMLAnchorElement/remove-href-from-focused-anchor-expected.txt
rename to third_party/WebKit/LayoutTests/fast/dom/HTMLAnchorElement/update-href-of-focused-anchor-expected.txt
index 0884caa..85eaf8d 100644
--- a/third_party/WebKit/LayoutTests/fast/dom/HTMLAnchorElement/remove-href-from-focused-anchor-expected.txt
+++ b/third_party/WebKit/LayoutTests/fast/dom/HTMLAnchorElement/update-href-of-focused-anchor-expected.txt

@@ -1,6 +1,8 @@
-PASS document.activeElement is target
 Remove href.
+PASS document.activeElement is target
 PASS document.activeElement is document.body
+Update href.
+PASS document.activeElement is target
 PASS successfullyParsed is true
 
 TEST COMPLETE

diff --git a/third_party/WebKit/LayoutTests/fast/dom/HTMLAnchorElement/update-href-of-focused-anchor.html b/third_party/WebKit/LayoutTests/fast/dom/HTMLAnchorElement/update-href-of-focused-anchor.html
new file mode 100644
index 0000000..142f494
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/fast/dom/HTMLAnchorElement/update-href-of-focused-anchor.html

@@ -0,0 +1,25 @@
+<!DOCTYPE html>
+<body>
+<a href="javascript:" id="target">link</a>
+<script src="../../../resources/js-test.js"></script>
+<script>
+jsTestIsAsync = true;
+var target = document.getElementById('target');
+window.onload = function() {
+    debug('Remove href.');
+    target.focus();
+    shouldBe('document.activeElement', 'target');
+    target.removeAttribute('href');
+    shouldBe('document.activeElement', 'document.body');
+
+    debug('Update href.');
+    target.href = 'javascript:';
+    target.focus();
+    target.href = 'javascript:undefined';
+    shouldBe('document.activeElement', 'target');
+
+    target.remove();
+    finishJSTest();
+};
+</script>
+</body>

diff --git a/third_party/WebKit/LayoutTests/http/tests/inspector-protocol/inspector-protocol-test.js b/third_party/WebKit/LayoutTests/http/tests/inspector-protocol/inspector-protocol-test.js
index aafade0..64501da1 100644
--- a/third_party/WebKit/LayoutTests/http/tests/inspector-protocol/inspector-protocol-test.js
+++ b/third_party/WebKit/LayoutTests/http/tests/inspector-protocol/inspector-protocol-test.js

@@ -31,6 +31,20 @@
     InspectorTest.sendCommand("Runtime.evaluate", { expression: expression }, callback);
 }
 
+InspectorTest.parseURL = function(url)
+{
+    var result = {};
+    var match = url.match(/^([^:]+):\/\/([^\/:]*)(?::([\d]+))?(?:(\/[^#]*)(?:#(.*))?)?$/i);
+    if (!match)
+        return result;
+    result.scheme = match[1].toLowerCase();
+    result.host = match[2];
+    result.port = match[3];
+    result.path = match[4] || "/";
+    result.fragment = match[5];
+    return result;
+}
+
 }
 
 var outputElement;

diff --git a/third_party/WebKit/LayoutTests/http/tests/inspector-protocol/ping-redirect-expected.txt b/third_party/WebKit/LayoutTests/http/tests/inspector-protocol/ping-redirect-expected.txt
new file mode 100644
index 0000000..6b0d71fb
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/http/tests/inspector-protocol/ping-redirect-expected.txt

@@ -0,0 +1,6 @@
+Tests that redirect from navigator.sendBeacon() is recorded.
+
+Request Sent: /inspector-protocol/resources/ping-redirect.php
+Request Sent: /inspector-protocol/resources/ping-redirected-page.html
+Redirect Source: /inspector-protocol/resources/ping-redirect.php
+

diff --git a/third_party/WebKit/LayoutTests/http/tests/inspector-protocol/ping-redirect.html b/third_party/WebKit/LayoutTests/http/tests/inspector-protocol/ping-redirect.html
new file mode 100644
index 0000000..ac1c4564
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/http/tests/inspector-protocol/ping-redirect.html

@@ -0,0 +1,46 @@
+<html>
+<head>
+<script src="inspector-protocol-test.js"></script>
+<script>
+function sendBeacon()
+{
+    navigator.sendBeacon("resources/ping-redirect.php", "foo");
+}
+
+function test()
+{
+    var requestSent = 0;
+    InspectorTest.eventHandler["Network.requestWillBeSent"] = onRequestWillBeSent;
+    enableNetwork();
+
+    function enableNetwork()
+    {
+        InspectorTest.sendCommandOrDie("Network.enable", {}, didEnableNetwork);
+    }
+
+    function didEnableNetwork()
+    {
+        InspectorTest.evaluateInPage("sendBeacon()");
+    }
+
+    function onRequestWillBeSent(event)
+    {
+        requestSent++;
+        var params = event.params;
+        InspectorTest.log("Request Sent: " + InspectorTest.parseURL(params.request.url).path);
+        if (requestSent == 2) {
+            var redirectSource = "";
+            if (params.redirectResponse)
+                redirectSource = InspectorTest.parseURL(params.redirectResponse.url).path;
+            InspectorTest.log("Redirect Source: " + redirectSource);
+            InspectorTest.completeTest();
+        }
+    }
+}
+</script>
+</head>
+<body onload="runTest()">
+<p>Tests that redirect from navigator.sendBeacon() is recorded.</p>
+</body>
+</html>
+

diff --git a/third_party/WebKit/LayoutTests/http/tests/inspector-protocol/resources/ping-redirect.php b/third_party/WebKit/LayoutTests/http/tests/inspector-protocol/resources/ping-redirect.php
new file mode 100644
index 0000000..5a917233
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/http/tests/inspector-protocol/resources/ping-redirect.php

@@ -0,0 +1,7 @@
+<?php
+header('HTTP/1.1 307 Temporary Redirect');
+header('Expires: Thu, 01 Dec 2003 16:00:00 GMT');
+header('Cache-Control: no-cache, must-revalidate');
+header('Pragma: no-cache');
+header('Location: ping-redirected-page.html');
+?>

diff --git a/third_party/WebKit/LayoutTests/platform/linux/editing/caret/caret-color-014-expected.png b/third_party/WebKit/LayoutTests/platform/linux/editing/caret/caret-color-014-expected.png
index 46ef8f20..2733c240 100644
--- a/third_party/WebKit/LayoutTests/platform/linux/editing/caret/caret-color-014-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/linux/editing/caret/caret-color-014-expected.png
Binary files differ

diff --git a/third_party/WebKit/LayoutTests/platform/linux/editing/caret/caret-color-015-expected.png b/third_party/WebKit/LayoutTests/platform/linux/editing/caret/caret-color-015-expected.png
index 0263676f..22ceae7 100644
--- a/third_party/WebKit/LayoutTests/platform/linux/editing/caret/caret-color-015-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/linux/editing/caret/caret-color-015-expected.png
Binary files differ

diff --git a/third_party/WebKit/LayoutTests/platform/linux/editing/input/reveal-caret-of-multiline-contenteditable-expected.png b/third_party/WebKit/LayoutTests/platform/linux/editing/input/reveal-caret-of-multiline-contenteditable-expected.png
index 3b0c803..9086317 100644
--- a/third_party/WebKit/LayoutTests/platform/linux/editing/input/reveal-caret-of-multiline-contenteditable-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/linux/editing/input/reveal-caret-of-multiline-contenteditable-expected.png
Binary files differ

diff --git a/third_party/WebKit/LayoutTests/platform/linux/editing/inserting/4960120-2-expected.png b/third_party/WebKit/LayoutTests/platform/linux/editing/inserting/4960120-2-expected.png
index afe1c834..798bd94 100644
--- a/third_party/WebKit/LayoutTests/platform/linux/editing/inserting/4960120-2-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/linux/editing/inserting/4960120-2-expected.png
Binary files differ

diff --git a/third_party/WebKit/LayoutTests/platform/linux/editing/inserting/5058163-1-expected.png b/third_party/WebKit/LayoutTests/platform/linux/editing/inserting/5058163-1-expected.png
index b26a427b..3b365cb 100644
--- a/third_party/WebKit/LayoutTests/platform/linux/editing/inserting/5058163-1-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/linux/editing/inserting/5058163-1-expected.png
Binary files differ

diff --git a/third_party/WebKit/LayoutTests/platform/linux/editing/inserting/5549929-2-expected.png b/third_party/WebKit/LayoutTests/platform/linux/editing/inserting/5549929-2-expected.png
index 026009a7..9711e058 100644
--- a/third_party/WebKit/LayoutTests/platform/linux/editing/inserting/5549929-2-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/linux/editing/inserting/5549929-2-expected.png
Binary files differ

diff --git a/third_party/WebKit/LayoutTests/platform/linux/editing/inserting/5549929-3-expected.png b/third_party/WebKit/LayoutTests/platform/linux/editing/inserting/5549929-3-expected.png
index 0fc5cbc..710f915 100644
--- a/third_party/WebKit/LayoutTests/platform/linux/editing/inserting/5549929-3-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/linux/editing/inserting/5549929-3-expected.png
Binary files differ

diff --git a/third_party/WebKit/LayoutTests/platform/linux/editing/inserting/editable-inline-element-expected.png b/third_party/WebKit/LayoutTests/platform/linux/editing/inserting/editable-inline-element-expected.png
index 2e90414..003cc0f 100644
--- a/third_party/WebKit/LayoutTests/platform/linux/editing/inserting/editable-inline-element-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/linux/editing/inserting/editable-inline-element-expected.png
Binary files differ

diff --git a/third_party/WebKit/LayoutTests/platform/linux/editing/inserting/insert-3800346-fix-expected.png b/third_party/WebKit/LayoutTests/platform/linux/editing/inserting/insert-3800346-fix-expected.png
index 6669730..4724905 100644
--- a/third_party/WebKit/LayoutTests/platform/linux/editing/inserting/insert-3800346-fix-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/linux/editing/inserting/insert-3800346-fix-expected.png
Binary files differ

diff --git a/third_party/WebKit/LayoutTests/platform/linux/editing/inserting/line-break-expected.png b/third_party/WebKit/LayoutTests/platform/linux/editing/inserting/line-break-expected.png
index 5c076e0..93716d2 100644
--- a/third_party/WebKit/LayoutTests/platform/linux/editing/inserting/line-break-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/linux/editing/inserting/line-break-expected.png
Binary files differ

diff --git a/third_party/WebKit/LayoutTests/platform/linux/editing/inserting/paragraph-separator-in-table-1-expected.png b/third_party/WebKit/LayoutTests/platform/linux/editing/inserting/paragraph-separator-in-table-1-expected.png
index aa72815..0a90c1a2 100644
--- a/third_party/WebKit/LayoutTests/platform/linux/editing/inserting/paragraph-separator-in-table-1-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/linux/editing/inserting/paragraph-separator-in-table-1-expected.png
Binary files differ

diff --git a/third_party/WebKit/LayoutTests/platform/linux/editing/inserting/paragraph-separator-in-table-2-expected.png b/third_party/WebKit/LayoutTests/platform/linux/editing/inserting/paragraph-separator-in-table-2-expected.png
index 1baad27a..20dfe5e 100644
--- a/third_party/WebKit/LayoutTests/platform/linux/editing/inserting/paragraph-separator-in-table-2-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/linux/editing/inserting/paragraph-separator-in-table-2-expected.png
Binary files differ

diff --git a/third_party/WebKit/LayoutTests/platform/linux/editing/pasteboard/5601583-1-expected.png b/third_party/WebKit/LayoutTests/platform/linux/editing/pasteboard/5601583-1-expected.png
index 3c7e9b02..ae5c9f8 100644
--- a/third_party/WebKit/LayoutTests/platform/linux/editing/pasteboard/5601583-1-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/linux/editing/pasteboard/5601583-1-expected.png
Binary files differ

diff --git a/third_party/WebKit/LayoutTests/platform/linux/editing/pasteboard/paste-line-endings-001-expected.png b/third_party/WebKit/LayoutTests/platform/linux/editing/pasteboard/paste-line-endings-001-expected.png
index 8e8439e..0c92ffa 100644
--- a/third_party/WebKit/LayoutTests/platform/linux/editing/pasteboard/paste-line-endings-001-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/linux/editing/pasteboard/paste-line-endings-001-expected.png
Binary files differ

diff --git a/third_party/WebKit/LayoutTests/platform/linux/editing/selection/4947387-expected.png b/third_party/WebKit/LayoutTests/platform/linux/editing/selection/4947387-expected.png
deleted file mode 100644
index 05e0022c..0000000
--- a/third_party/WebKit/LayoutTests/platform/linux/editing/selection/4947387-expected.png
+++ /dev/null
Binary files differ

diff --git a/third_party/WebKit/LayoutTests/platform/linux/editing/selection/4947387-expected.txt b/third_party/WebKit/LayoutTests/platform/linux/editing/selection/4947387-expected.txt
deleted file mode 100644
index cd07cb1..0000000
--- a/third_party/WebKit/LayoutTests/platform/linux/editing/selection/4947387-expected.txt
+++ /dev/null

@@ -1,29 +0,0 @@
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-layer at (0,0) size 800x600
-  LayoutView at (0,0) size 800x600
-layer at (0,0) size 800x600
-  LayoutBlockFlow {HTML} at (0,0) size 800x600
-    LayoutBlockFlow {BODY} at (8,8) size 784x584
-      LayoutBlockFlow {P} at (0,0) size 784x80
-        LayoutText {#text} at (0,0) size 782x79
-          text run at (0,0) width 389: "This tests moveTo{Beginning, End}OfLineAndModifySelection. "
-          text run at (388,0) width 330: "It should operate on line boundaries and not paragraph"
-          text run at (0,20) width 74: "boundaries. "
-          text run at (74,20) width 708: "To run it manually, click inside the first line of the editable region below and do Command+Shift+Left/Right Arrow, the"
-          text run at (0,40) width 511: "selection should extend to the start/end of the line, not the start/end of the paragraph. "
-          text run at (511,40) width 154: "Also, moveTo{Beginning,"
-          text run at (0,60) width 318: "End}OfParagraphAndModifySelection should work."
-      LayoutBlockFlow {DIV} at (0,96) size 200x40
-        LayoutText {#text} at (0,0) size 179x39
-          text run at (0,0) width 175: "The quick brown fox jumped"
-          text run at (175,0) width 4: " "
-          text run at (0,20) width 150: "over the lazy brown dog."
-selection start: position 0 of child 0 {#text} of child 2 {DIV} of body
-selection end:   position 51 of child 0 {#text} of child 2 {DIV} of body

diff --git a/third_party/WebKit/LayoutTests/platform/linux/editing/selection/after-line-wrap-expected.png b/third_party/WebKit/LayoutTests/platform/linux/editing/selection/after-line-wrap-expected.png
deleted file mode 100644
index bcf26ef..0000000
--- a/third_party/WebKit/LayoutTests/platform/linux/editing/selection/after-line-wrap-expected.png
+++ /dev/null
Binary files differ

diff --git a/third_party/WebKit/LayoutTests/platform/linux/editing/selection/after-line-wrap-expected.txt b/third_party/WebKit/LayoutTests/platform/linux/editing/selection/after-line-wrap-expected.txt
deleted file mode 100644
index 647af05..0000000
--- a/third_party/WebKit/LayoutTests/platform/linux/editing/selection/after-line-wrap-expected.txt
+++ /dev/null

@@ -1,42 +0,0 @@
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-layer at (0,0) size 800x600
-  LayoutView at (0,0) size 800x600
-layer at (0,0) size 800x600
-  LayoutBlockFlow {HTML} at (0,0) size 800x600
-    LayoutBlockFlow {BODY} at (8,8) size 784x576
-      LayoutBlockFlow {P} at (0,0) size 784x40
-        LayoutInline {B} at (0,0) size 296x19
-          LayoutText {#text} at (0,0) size 296x19
-            text run at (0,0) width 296: "Make sure that your window is small enough"
-        LayoutText {#text} at (295,0) size 737x39
-          text run at (295,0) width 442: " so that 'don't select this line' and 'try to select just this line' appear on two"
-          text run at (0,20) width 87: "different lines. "
-          text run at (86,20) width 587: "The two phrases are actually in the same paragraph, there are just lots of spaces in between them."
-      LayoutBlockFlow {P} at (0,56) size 784x40
-        LayoutText {#text} at (0,0) size 99x19
-          text run at (0,0) width 99: "This is a test for "
-        LayoutInline {A} at (0,0) size 349x19 [color=#0000EE]
-          LayoutText {#text} at (99,0) size 349x19
-            text run at (99,0) width 349: "REGRESSION: Selection includes spaces that it shouldn't"
-        LayoutText {#text} at (448,0) size 784x39
-          text run at (448,0) width 336: ". The test makes sure that a word that is right after a line"
-          text run at (0,20) width 205: "wrap can be selected successfully."
-      LayoutBlockFlow {P} at (0,112) size 784x0
-      LayoutBlockFlow {DIV} at (16,112) size 752x82 [border: (1px solid #000000)]
-        LayoutText {#text} at (1,1) size 748x59
-          text run at (1,1) width 90: "don't select me"
-          text run at (91,1) width 4: " "
-          text run at (1,21) width 748: "                                                                                                                                                                                           "
-          text run at (1,41) width 644: "                                                                                                                                                                 "
-        LayoutInline {I} at (0,0) size 750x39
-          LayoutText {#text} at (645,41) size 750x39
-            text run at (645,41) width 103: "try to select just"
-            text run at (748,41) width 3: " "
-            text run at (1,61) width 52: "this text"
-        LayoutText {#text} at (0,0) size 0x0
-selection start: position 17 of child 0 {#text} of child 7 {DIV} of body
-selection end:   position 20 of child 0 {#text} of child 7 {DIV} of body

diff --git a/third_party/WebKit/LayoutTests/platform/linux/editing/selection/click-start-of-line-expected.png b/third_party/WebKit/LayoutTests/platform/linux/editing/selection/click-start-of-line-expected.png
index 60cde09..22fccec 100644
--- a/third_party/WebKit/LayoutTests/platform/linux/editing/selection/click-start-of-line-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/linux/editing/selection/click-start-of-line-expected.png
Binary files differ

diff --git a/third_party/WebKit/LayoutTests/platform/linux/editing/selection/move-3875618-fix-expected.png b/third_party/WebKit/LayoutTests/platform/linux/editing/selection/move-3875618-fix-expected.png
index 0e8f4794..17a5bf9 100644
--- a/third_party/WebKit/LayoutTests/platform/linux/editing/selection/move-3875618-fix-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/linux/editing/selection/move-3875618-fix-expected.png
Binary files differ

diff --git a/third_party/WebKit/LayoutTests/platform/linux/editing/selection/move-backwords-by-word-001-expected.png b/third_party/WebKit/LayoutTests/platform/linux/editing/selection/move-backwords-by-word-001-expected.png
index 20d1e8a..08d5edd 100644
--- a/third_party/WebKit/LayoutTests/platform/linux/editing/selection/move-backwords-by-word-001-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/linux/editing/selection/move-backwords-by-word-001-expected.png
Binary files differ

diff --git a/third_party/WebKit/LayoutTests/platform/linux/editing/selection/move-left-right-expected.txt b/third_party/WebKit/LayoutTests/platform/linux/editing/selection/move-left-right-expected.txt
index 55f0a44..fec0fc8 100644
--- a/third_party/WebKit/LayoutTests/platform/linux/editing/selection/move-left-right-expected.txt
+++ b/third_party/WebKit/LayoutTests/platform/linux/editing/selection/move-left-right-expected.txt

@@ -12,28 +12,28 @@
   Moving right:  "\n        ABC\n    "[12, 11, 10, 9]
 Test 3, LTR:
   Moving right: <DIV>[0], "abc\n    "[0, 1, 2, 3]
-WARNING: Moved in the wrong direction in step 1: from (37, 81) to (37, 100).
+WARNING: Moved in the wrong direction in step 1: from (37, 81) to (37, 101).
   Moving left:  "abc\n    "[3, 2, 1, 0], <DIV>[0]
-WARNING: Moved in the wrong direction in step 4: from (37, 100) to (37, 81).
+WARNING: Moved in the wrong direction in step 4: from (37, 101) to (37, 81).
 Test 3, RTL:
   Moving left: <DIV>[0], "abc\n    "[0, 2, 1, 3]
-WARNING: Moved in the wrong direction in step 1: from (767, 81) to (767, 100).
-WARNING: Moved in the wrong direction in step 3: from (753, 100) to (767, 100).
+WARNING: Moved in the wrong direction in step 1: from (767, 81) to (767, 101).
+WARNING: Moved in the wrong direction in step 3: from (753, 101) to (767, 101).
   Moving right:  "abc\n    "[3, 1, 2, 0], <DIV>[0]
-WARNING: Moved in the wrong direction in step 2: from (767, 100) to (753, 100).
-WARNING: Moved in the wrong direction in step 4: from (767, 100) to (767, 81).
+WARNING: Moved in the wrong direction in step 2: from (767, 101) to (753, 101).
+WARNING: Moved in the wrong direction in step 4: from (767, 101) to (767, 81).
 Test 4, LTR:
   Moving right: <DIV>[0], "ABC\n    "[0, 2, 1, 3]
-WARNING: Moved in the wrong direction in step 1: from (37, 135) to (37, 154).
-WARNING: Moved in the wrong direction in step 3: from (49, 154) to (37, 154).
+WARNING: Moved in the wrong direction in step 1: from (37, 135) to (37, 155).
+WARNING: Moved in the wrong direction in step 3: from (49, 155) to (37, 155).
   Moving left:  "ABC\n    "[3, 1, 2, 0], <DIV>[0]
-WARNING: Moved in the wrong direction in step 2: from (37, 154) to (49, 154).
-WARNING: Moved in the wrong direction in step 4: from (37, 154) to (37, 135).
+WARNING: Moved in the wrong direction in step 2: from (37, 155) to (49, 155).
+WARNING: Moved in the wrong direction in step 4: from (37, 155) to (37, 135).
 Test 4, RTL:
   Moving left: <DIV>[0], "ABC\n    "[0, 1, 2, 3]
-WARNING: Moved in the wrong direction in step 1: from (767, 135) to (767, 154).
+WARNING: Moved in the wrong direction in step 1: from (767, 135) to (767, 155).
   Moving right:  "ABC\n    "[3, 2, 1, 0], <DIV>[0]
-WARNING: Moved in the wrong direction in step 4: from (767, 154) to (767, 135).
+WARNING: Moved in the wrong direction in step 4: from (767, 155) to (767, 135).
 Test 5, LTR:
   Moving right: "\n        abcABCdef\n    "[9, 10, 11, 12, 14, 13, 15, 16, 17, 18]
   Moving left:  "\n        abcABCdef\n    "[18, 17, 16, 15, 13, 14, 12, 11, 10, 9]
@@ -133,121 +133,121 @@
   Moving right:  "ABC123DEFabcGHI456JLM\n    "[21, 20, 19, 18, 16, 17, 15, 14, 13, 12, 10, 11, 9, 8, 7, 6, 4, 5, 3, 2, 1, 0]
 Test 17, LTR:
   Moving right: "\n        before    AHYJ AQWJXMFUDJE\n    "[9, 10, 11, 12, 13, 14, 15, 16, 22, 21, 20, 23, 24, 34, 33, 32, 31, 30, 29, 28, 27, 26, 25, 35]
-WARNING: Moved in the wrong direction in step 3: from (108, 597) to (37, 616).
-WARNING: Moved in the wrong direction in step 5: from (98, 616) to (93, 616).
-WARNING: Moved in the wrong direction in step 6: from (93, 616) to (86, 616).
-WARNING: Moved in the wrong direction in step 7: from (86, 616) to (82, 616).
-WARNING: Moved in the wrong direction in step 8: from (82, 616) to (45, 616).
+WARNING: Moved in the wrong direction in step 3: from (108, 597) to (37, 617).
+WARNING: Moved in the wrong direction in step 5: from (98, 617) to (93, 617).
+WARNING: Moved in the wrong direction in step 6: from (93, 617) to (86, 617).
+WARNING: Moved in the wrong direction in step 7: from (86, 617) to (82, 617).
+WARNING: Moved in the wrong direction in step 8: from (82, 617) to (45, 617).
   Moving left:  "\n        before    AHYJ AQWJXMFUDJE\n    "[35, 25, 26, 27, 28, 29, 30, 31, 32, 33, 34, 24, 23, 20, 21, 22, 16, 15, 14, 13, 12, 11, 10, 9]
-WARNING: Moved in the wrong direction in step 16: from (45, 616) to (82, 616).
-WARNING: Moved in the wrong direction in step 17: from (82, 616) to (86, 616).
-WARNING: Moved in the wrong direction in step 18: from (86, 616) to (93, 616).
-WARNING: Moved in the wrong direction in step 19: from (93, 616) to (98, 616).
-WARNING: Moved in the wrong direction in step 21: from (37, 616) to (108, 597).
+WARNING: Moved in the wrong direction in step 16: from (45, 617) to (82, 617).
+WARNING: Moved in the wrong direction in step 17: from (82, 617) to (86, 617).
+WARNING: Moved in the wrong direction in step 18: from (86, 617) to (93, 617).
+WARNING: Moved in the wrong direction in step 19: from (93, 617) to (98, 617).
+WARNING: Moved in the wrong direction in step 21: from (37, 617) to (108, 597).
 Test 17, RTL:
   Moving left: "\n        before    AHYJ AQWJXMFUDJE\n    "[9, 14, 13, 12, 11, 10, 15, 16, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35]
-WARNING: Moved in the wrong direction in step 1: from (156, 597) to (144, 616).
-WARNING: Moved in the wrong direction in step 2: from (144, 616) to (149, 616).
-WARNING: Moved in the wrong direction in step 3: from (149, 616) to (156, 616).
+WARNING: Moved in the wrong direction in step 1: from (156, 597) to (144, 617).
+WARNING: Moved in the wrong direction in step 2: from (144, 617) to (149, 617).
+WARNING: Moved in the wrong direction in step 3: from (149, 617) to (156, 617).
 WARNING: Moved in the wrong direction in step 5: from (86, 597) to (90, 597).
-WARNING: Moved in the wrong direction in step 6: from (90, 597) to (137, 616).
+WARNING: Moved in the wrong direction in step 6: from (90, 597) to (137, 617).
   Moving right:  "\n        before    AHYJ AQWJXMFUDJE\n    "[35, 34, 33, 32, 31, 30, 29, 28, 27, 26, 25, 24, 23, 22, 21, 20, 16, 15, 10, 11, 12, 13, 14, 9]
-WARNING: Moved in the wrong direction in step 18: from (137, 616) to (90, 597).
+WARNING: Moved in the wrong direction in step 18: from (137, 617) to (90, 597).
 WARNING: Moved in the wrong direction in step 19: from (90, 597) to (86, 597).
-WARNING: Moved in the wrong direction in step 21: from (156, 616) to (149, 616).
-WARNING: Moved in the wrong direction in step 22: from (149, 616) to (144, 616).
-WARNING: Moved in the wrong direction in step 23: from (144, 616) to (156, 597).
+WARNING: Moved in the wrong direction in step 21: from (156, 617) to (149, 617).
+WARNING: Moved in the wrong direction in step 22: from (149, 617) to (144, 617).
+WARNING: Moved in the wrong direction in step 23: from (144, 617) to (156, 597).
 Test 18, LTR:
   Moving right: "\n        MUQJ    after encyclopedia\n    "[9, 12, 11, 10, 13, 14, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35]
-WARNING: Moved in the wrong direction in step 1: from (37, 651) to (44, 670).
-WARNING: Moved in the wrong direction in step 2: from (44, 670) to (37, 670).
-WARNING: Moved in the wrong direction in step 4: from (91, 651) to (51, 670).
+WARNING: Moved in the wrong direction in step 1: from (37, 651) to (44, 671).
+WARNING: Moved in the wrong direction in step 2: from (44, 671) to (37, 671).
+WARNING: Moved in the wrong direction in step 4: from (91, 651) to (51, 671).
   Moving left:  "\n        MUQJ    after encyclopedia\n    "[35, 34, 33, 32, 31, 30, 29, 28, 27, 26, 25, 24, 23, 22, 21, 20, 19, 18, 14, 13, 10, 11, 12, 9]
-WARNING: Moved in the wrong direction in step 20: from (51, 670) to (91, 651).
-WARNING: Moved in the wrong direction in step 22: from (37, 670) to (44, 670).
-WARNING: Moved in the wrong direction in step 23: from (44, 670) to (37, 651).
+WARNING: Moved in the wrong direction in step 20: from (51, 671) to (91, 651).
+WARNING: Moved in the wrong direction in step 22: from (37, 671) to (44, 671).
+WARNING: Moved in the wrong direction in step 23: from (44, 671) to (37, 651).
 Test 18, RTL:
   Moving left: "\n        MUQJ    after encyclopedia\n    "[9, 10, 11, 12, 13, 14, 21, 20, 19, 18, 22, 23, 34, 33, 32, 31, 30, 29, 28, 27, 26, 25, 24, 35]
-WARNING: Moved in the wrong direction in step 2: from (103, 651) to (156, 670).
-WARNING: Moved in the wrong direction in step 4: from (85, 670) to (92, 670).
-WARNING: Moved in the wrong direction in step 5: from (92, 670) to (99, 670).
-WARNING: Moved in the wrong direction in step 6: from (99, 670) to (147, 670).
-WARNING: Moved in the wrong direction in step 10: from (124, 670) to (150, 670).
+WARNING: Moved in the wrong direction in step 2: from (103, 651) to (156, 671).
+WARNING: Moved in the wrong direction in step 4: from (85, 671) to (92, 671).
+WARNING: Moved in the wrong direction in step 5: from (92, 671) to (99, 671).
+WARNING: Moved in the wrong direction in step 6: from (99, 671) to (147, 671).
+WARNING: Moved in the wrong direction in step 10: from (124, 671) to (150, 671).
   Moving right:  "\n        MUQJ    after encyclopedia\n    "[35, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33, 34, 23, 22, 18, 19, 20, 21, 14, 13, 12, 11, 10, 9]
-WARNING: Moved in the wrong direction in step 14: from (150, 670) to (124, 670).
-WARNING: Moved in the wrong direction in step 18: from (147, 670) to (99, 670).
-WARNING: Moved in the wrong direction in step 19: from (99, 670) to (92, 670).
-WARNING: Moved in the wrong direction in step 20: from (92, 670) to (85, 670).
-WARNING: Moved in the wrong direction in step 22: from (156, 670) to (103, 651).
+WARNING: Moved in the wrong direction in step 14: from (150, 671) to (124, 671).
+WARNING: Moved in the wrong direction in step 18: from (147, 671) to (99, 671).
+WARNING: Moved in the wrong direction in step 19: from (99, 671) to (92, 671).
+WARNING: Moved in the wrong direction in step 20: from (92, 671) to (85, 671).
+WARNING: Moved in the wrong direction in step 22: from (156, 671) to (103, 651).
 Test 19, LTR:
   Moving right: "\n        before    AHYJ AQWJXMFUDJE\n    "[9, 10, 11, 12, 13, 14, 15, 16, 22, 21, 20, 23, 24, 34, 33, 32, 31, 30, 29, 28, 27, 26, 25, 35]
-WARNING: Moved in the wrong direction in step 3: from (108, 705) to (37, 724).
-WARNING: Moved in the wrong direction in step 5: from (98, 724) to (93, 724).
-WARNING: Moved in the wrong direction in step 6: from (93, 724) to (86, 724).
-WARNING: Moved in the wrong direction in step 7: from (86, 724) to (82, 724).
-WARNING: Moved in the wrong direction in step 8: from (82, 724) to (45, 724).
+WARNING: Moved in the wrong direction in step 3: from (108, 705) to (37, 725).
+WARNING: Moved in the wrong direction in step 5: from (98, 725) to (93, 725).
+WARNING: Moved in the wrong direction in step 6: from (93, 725) to (86, 725).
+WARNING: Moved in the wrong direction in step 7: from (86, 725) to (82, 725).
+WARNING: Moved in the wrong direction in step 8: from (82, 725) to (45, 725).
   Moving left:  "\n        before    AHYJ AQWJXMFUDJE\n    "[35, 25, 26, 27, 28, 29, 30, 31, 32, 33, 34, 24, 23, 20, 21, 22, 16, 15, 14, 13, 12, 11, 10, 9]
-WARNING: Moved in the wrong direction in step 16: from (45, 724) to (82, 724).
-WARNING: Moved in the wrong direction in step 17: from (82, 724) to (86, 724).
-WARNING: Moved in the wrong direction in step 18: from (86, 724) to (93, 724).
-WARNING: Moved in the wrong direction in step 19: from (93, 724) to (98, 724).
-WARNING: Moved in the wrong direction in step 21: from (37, 724) to (108, 705).
+WARNING: Moved in the wrong direction in step 16: from (45, 725) to (82, 725).
+WARNING: Moved in the wrong direction in step 17: from (82, 725) to (86, 725).
+WARNING: Moved in the wrong direction in step 18: from (86, 725) to (93, 725).
+WARNING: Moved in the wrong direction in step 19: from (93, 725) to (98, 725).
+WARNING: Moved in the wrong direction in step 21: from (37, 725) to (108, 705).
 Test 19, RTL:
   Moving left: "\n        before    AHYJ AQWJXMFUDJE\n    "[9, 14, 13, 12, 11, 10, 15, 16, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35]
-WARNING: Moved in the wrong direction in step 1: from (156, 705) to (144, 724).
-WARNING: Moved in the wrong direction in step 2: from (144, 724) to (149, 724).
-WARNING: Moved in the wrong direction in step 3: from (149, 724) to (156, 724).
+WARNING: Moved in the wrong direction in step 1: from (156, 705) to (144, 725).
+WARNING: Moved in the wrong direction in step 2: from (144, 725) to (149, 725).
+WARNING: Moved in the wrong direction in step 3: from (149, 725) to (156, 725).
 WARNING: Moved in the wrong direction in step 5: from (86, 705) to (90, 705).
-WARNING: Moved in the wrong direction in step 6: from (90, 705) to (137, 724).
+WARNING: Moved in the wrong direction in step 6: from (90, 705) to (137, 725).
   Moving right:  "\n        before    AHYJ AQWJXMFUDJE\n    "[35, 34, 33, 32, 31, 30, 29, 28, 27, 26, 25, 24, 23, 22, 21, 20, 16, 15, 10, 11, 12, 13, 14, 9]
-WARNING: Moved in the wrong direction in step 18: from (137, 724) to (90, 705).
+WARNING: Moved in the wrong direction in step 18: from (137, 725) to (90, 705).
 WARNING: Moved in the wrong direction in step 19: from (90, 705) to (86, 705).
-WARNING: Moved in the wrong direction in step 21: from (156, 724) to (149, 724).
-WARNING: Moved in the wrong direction in step 22: from (149, 724) to (144, 724).
-WARNING: Moved in the wrong direction in step 23: from (144, 724) to (156, 705).
+WARNING: Moved in the wrong direction in step 21: from (156, 725) to (149, 725).
+WARNING: Moved in the wrong direction in step 22: from (149, 725) to (144, 725).
+WARNING: Moved in the wrong direction in step 23: from (144, 725) to (156, 705).
 Test 20, LTR:
   Moving right: "\n        MUQJ    after encyclopedia\n    "[9, 12, 11, 10, 13, 14, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35]
-WARNING: Moved in the wrong direction in step 1: from (37, 759) to (44, 778).
-WARNING: Moved in the wrong direction in step 2: from (44, 778) to (37, 778).
-WARNING: Moved in the wrong direction in step 4: from (91, 759) to (51, 778).
+WARNING: Moved in the wrong direction in step 1: from (37, 759) to (44, 779).
+WARNING: Moved in the wrong direction in step 2: from (44, 779) to (37, 779).
+WARNING: Moved in the wrong direction in step 4: from (91, 759) to (51, 779).
   Moving left:  "\n        MUQJ    after encyclopedia\n    "[35, 34, 33, 32, 31, 30, 29, 28, 27, 26, 25, 24, 23, 22, 21, 20, 19, 18, 14, 13, 10, 11, 12, 9]
-WARNING: Moved in the wrong direction in step 20: from (51, 778) to (91, 759).
-WARNING: Moved in the wrong direction in step 22: from (37, 778) to (44, 778).
-WARNING: Moved in the wrong direction in step 23: from (44, 778) to (37, 759).
+WARNING: Moved in the wrong direction in step 20: from (51, 779) to (91, 759).
+WARNING: Moved in the wrong direction in step 22: from (37, 779) to (44, 779).
+WARNING: Moved in the wrong direction in step 23: from (44, 779) to (37, 759).
 Test 20, RTL:
   Moving left: "\n        MUQJ    after encyclopedia\n    "[9, 10, 11, 12, 13, 14, 21, 20, 19, 18, 22, 23, 34, 33, 32, 31, 30, 29, 28, 27, 26, 25, 24, 35]
-WARNING: Moved in the wrong direction in step 2: from (103, 759) to (156, 778).
-WARNING: Moved in the wrong direction in step 4: from (85, 778) to (92, 778).
-WARNING: Moved in the wrong direction in step 5: from (92, 778) to (99, 778).
-WARNING: Moved in the wrong direction in step 6: from (99, 778) to (147, 778).
-WARNING: Moved in the wrong direction in step 10: from (124, 778) to (150, 778).
+WARNING: Moved in the wrong direction in step 2: from (103, 759) to (156, 779).
+WARNING: Moved in the wrong direction in step 4: from (85, 779) to (92, 779).
+WARNING: Moved in the wrong direction in step 5: from (92, 779) to (99, 779).
+WARNING: Moved in the wrong direction in step 6: from (99, 779) to (147, 779).
+WARNING: Moved in the wrong direction in step 10: from (124, 779) to (150, 779).
   Moving right:  "\n        MUQJ    after encyclopedia\n    "[35, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33, 34, 23, 22, 18, 19, 20, 21, 14, 13, 12, 11, 10, 9]
-WARNING: Moved in the wrong direction in step 14: from (150, 778) to (124, 778).
-WARNING: Moved in the wrong direction in step 18: from (147, 778) to (99, 778).
-WARNING: Moved in the wrong direction in step 19: from (99, 778) to (92, 778).
-WARNING: Moved in the wrong direction in step 20: from (92, 778) to (85, 778).
-WARNING: Moved in the wrong direction in step 22: from (156, 778) to (103, 759).
+WARNING: Moved in the wrong direction in step 14: from (150, 779) to (124, 779).
+WARNING: Moved in the wrong direction in step 18: from (147, 779) to (99, 779).
+WARNING: Moved in the wrong direction in step 19: from (99, 779) to (92, 779).
+WARNING: Moved in the wrong direction in step 20: from (92, 779) to (85, 779).
+WARNING: Moved in the wrong direction in step 22: from (156, 779) to (103, 759).
 Test 21, LTR:
   Moving right: "\n        This is JF[Y WY OJ[Y the boxes. \n    "[9, 10, 11, 12, 13, 14, 15, 16, 17, 23, 22, 21, 20, 19, 18, 24, 25, 28, 27, 26, 29, 30, 31, 32, 33, 34, 35, 36, 37, 38, 39, 40]
 WARNING: Moved in the wrong direction in step 2: from (114, 813) to (106, 813).
 WARNING: Moved in the wrong direction in step 3: from (106, 813) to (98, 813).
 WARNING: Moved in the wrong direction in step 4: from (98, 813) to (94, 813).
 WARNING: Moved in the wrong direction in step 5: from (94, 813) to (87, 813).
-WARNING: Moved in the wrong direction in step 7: from (122, 813) to (37, 832).
-WARNING: Moved in the wrong direction in step 10: from (80, 832) to (73, 832).
-WARNING: Moved in the wrong direction in step 11: from (73, 832) to (69, 832).
-WARNING: Moved in the wrong direction in step 12: from (69, 832) to (65, 832).
-WARNING: Moved in the wrong direction in step 13: from (65, 832) to (45, 832).
-WARNING: Moved in the wrong direction in step 18: from (114, 832) to (107, 832).
-WARNING: Moved in the wrong direction in step 19: from (107, 832) to (99, 832).
+WARNING: Moved in the wrong direction in step 7: from (122, 813) to (37, 833).
+WARNING: Moved in the wrong direction in step 10: from (80, 833) to (73, 833).
+WARNING: Moved in the wrong direction in step 11: from (73, 833) to (69, 833).
+WARNING: Moved in the wrong direction in step 12: from (69, 833) to (65, 833).
+WARNING: Moved in the wrong direction in step 13: from (65, 833) to (45, 833).
+WARNING: Moved in the wrong direction in step 18: from (114, 833) to (107, 833).
+WARNING: Moved in the wrong direction in step 19: from (107, 833) to (99, 833).
   Moving left:  "\n        This is JF[Y WY OJ[Y the boxes. \n    "[40, 39, 38, 37, 36, 35, 34, 33, 32, 31, 30, 29, 26, 27, 28, 25, 24, 18, 19, 20, 21, 22, 23, 17, 16, 15, 14, 13, 12, 11, 10, 9]
-WARNING: Moved in the wrong direction in step 13: from (99, 832) to (107, 832).
-WARNING: Moved in the wrong direction in step 14: from (107, 832) to (114, 832).
-WARNING: Moved in the wrong direction in step 19: from (45, 832) to (65, 832).
-WARNING: Moved in the wrong direction in step 20: from (65, 832) to (69, 832).
-WARNING: Moved in the wrong direction in step 21: from (69, 832) to (73, 832).
-WARNING: Moved in the wrong direction in step 22: from (73, 832) to (80, 832).
-WARNING: Moved in the wrong direction in step 25: from (37, 832) to (122, 813).
+WARNING: Moved in the wrong direction in step 13: from (99, 833) to (107, 833).
+WARNING: Moved in the wrong direction in step 14: from (107, 833) to (114, 833).
+WARNING: Moved in the wrong direction in step 19: from (45, 833) to (65, 833).
+WARNING: Moved in the wrong direction in step 20: from (65, 833) to (69, 833).
+WARNING: Moved in the wrong direction in step 21: from (69, 833) to (73, 833).
+WARNING: Moved in the wrong direction in step 22: from (73, 833) to (80, 833).
+WARNING: Moved in the wrong direction in step 25: from (37, 833) to (122, 813).
 WARNING: Moved in the wrong direction in step 27: from (87, 813) to (94, 813).
 WARNING: Moved in the wrong direction in step 28: from (94, 813) to (98, 813).
 WARNING: Moved in the wrong direction in step 29: from (98, 813) to (106, 813).
@@ -259,23 +259,23 @@
 WARNING: Moved in the wrong direction in step 4: from (67, 813) to (71, 813).
 WARNING: Moved in the wrong direction in step 5: from (71, 813) to (79, 813).
 WARNING: Moved in the wrong direction in step 6: from (79, 813) to (87, 813).
-WARNING: Moved in the wrong direction in step 7: from (87, 813) to (136, 832).
-WARNING: Moved in the wrong direction in step 14: from (51, 832) to (58, 832).
-WARNING: Moved in the wrong direction in step 15: from (58, 832) to (65, 832).
-WARNING: Moved in the wrong direction in step 16: from (65, 832) to (69, 832).
-WARNING: Moved in the wrong direction in step 17: from (69, 832) to (77, 832).
-WARNING: Moved in the wrong direction in step 18: from (77, 832) to (85, 832).
-WARNING: Moved in the wrong direction in step 19: from (85, 832) to (92, 832).
-WARNING: Moved in the wrong direction in step 20: from (92, 832) to (99, 832).
+WARNING: Moved in the wrong direction in step 7: from (87, 813) to (136, 833).
+WARNING: Moved in the wrong direction in step 14: from (51, 833) to (58, 833).
+WARNING: Moved in the wrong direction in step 15: from (58, 833) to (65, 833).
+WARNING: Moved in the wrong direction in step 16: from (65, 833) to (69, 833).
+WARNING: Moved in the wrong direction in step 17: from (69, 833) to (77, 833).
+WARNING: Moved in the wrong direction in step 18: from (77, 833) to (85, 833).
+WARNING: Moved in the wrong direction in step 19: from (85, 833) to (92, 833).
+WARNING: Moved in the wrong direction in step 20: from (92, 833) to (99, 833).
   Moving right:  "\n        This is JF[Y WY OJ[Y the boxes. \n    "[40, 39, 31, 32, 33, 34, 35, 36, 37, 38, 30, 29, 28, 27, 26, 25, 24, 23, 22, 21, 20, 19, 18, 17, 16, 10, 11, 12, 13, 14, 15, 9]
-WARNING: Moved in the wrong direction in step 12: from (99, 832) to (92, 832).
-WARNING: Moved in the wrong direction in step 13: from (92, 832) to (85, 832).
-WARNING: Moved in the wrong direction in step 14: from (85, 832) to (77, 832).
-WARNING: Moved in the wrong direction in step 15: from (77, 832) to (69, 832).
-WARNING: Moved in the wrong direction in step 16: from (69, 832) to (65, 832).
-WARNING: Moved in the wrong direction in step 17: from (65, 832) to (58, 832).
-WARNING: Moved in the wrong direction in step 18: from (58, 832) to (51, 832).
-WARNING: Moved in the wrong direction in step 25: from (136, 832) to (87, 813).
+WARNING: Moved in the wrong direction in step 12: from (99, 833) to (92, 833).
+WARNING: Moved in the wrong direction in step 13: from (92, 833) to (85, 833).
+WARNING: Moved in the wrong direction in step 14: from (85, 833) to (77, 833).
+WARNING: Moved in the wrong direction in step 15: from (77, 833) to (69, 833).
+WARNING: Moved in the wrong direction in step 16: from (69, 833) to (65, 833).
+WARNING: Moved in the wrong direction in step 17: from (65, 833) to (58, 833).
+WARNING: Moved in the wrong direction in step 18: from (58, 833) to (51, 833).
+WARNING: Moved in the wrong direction in step 25: from (136, 833) to (87, 813).
 WARNING: Moved in the wrong direction in step 26: from (87, 813) to (79, 813).
 WARNING: Moved in the wrong direction in step 27: from (79, 813) to (71, 813).
 WARNING: Moved in the wrong direction in step 28: from (71, 813) to (67, 813).
@@ -287,21 +287,21 @@
 WARNING: Moved in the wrong direction in step 3: from (106, 867) to (98, 867).
 WARNING: Moved in the wrong direction in step 4: from (98, 867) to (94, 867).
 WARNING: Moved in the wrong direction in step 5: from (94, 867) to (87, 867).
-WARNING: Moved in the wrong direction in step 7: from (122, 867) to (37, 886).
-WARNING: Moved in the wrong direction in step 10: from (80, 886) to (73, 886).
-WARNING: Moved in the wrong direction in step 11: from (73, 886) to (69, 886).
-WARNING: Moved in the wrong direction in step 12: from (69, 886) to (65, 886).
-WARNING: Moved in the wrong direction in step 13: from (65, 886) to (45, 886).
-WARNING: Moved in the wrong direction in step 18: from (114, 886) to (107, 886).
-WARNING: Moved in the wrong direction in step 19: from (107, 886) to (99, 886).
+WARNING: Moved in the wrong direction in step 7: from (122, 867) to (37, 887).
+WARNING: Moved in the wrong direction in step 10: from (80, 887) to (73, 887).
+WARNING: Moved in the wrong direction in step 11: from (73, 887) to (69, 887).
+WARNING: Moved in the wrong direction in step 12: from (69, 887) to (65, 887).
+WARNING: Moved in the wrong direction in step 13: from (65, 887) to (45, 887).
+WARNING: Moved in the wrong direction in step 18: from (114, 887) to (107, 887).
+WARNING: Moved in the wrong direction in step 19: from (107, 887) to (99, 887).
   Moving left:  "\n        This is JF[Y WY OJ[Y the boxes. \n    "[40, 39, 38, 37, 36, 35, 34, 33, 32, 31, 30, 29, 26, 27, 28, 25, 24, 18, 19, 20, 21, 22, 23, 17, 16, 15, 14, 13, 12, 11, 10, 9]
-WARNING: Moved in the wrong direction in step 13: from (99, 886) to (107, 886).
-WARNING: Moved in the wrong direction in step 14: from (107, 886) to (114, 886).
-WARNING: Moved in the wrong direction in step 19: from (45, 886) to (65, 886).
-WARNING: Moved in the wrong direction in step 20: from (65, 886) to (69, 886).
-WARNING: Moved in the wrong direction in step 21: from (69, 886) to (73, 886).
-WARNING: Moved in the wrong direction in step 22: from (73, 886) to (80, 886).
-WARNING: Moved in the wrong direction in step 25: from (37, 886) to (122, 867).
+WARNING: Moved in the wrong direction in step 13: from (99, 887) to (107, 887).
+WARNING: Moved in the wrong direction in step 14: from (107, 887) to (114, 887).
+WARNING: Moved in the wrong direction in step 19: from (45, 887) to (65, 887).
+WARNING: Moved in the wrong direction in step 20: from (65, 887) to (69, 887).
+WARNING: Moved in the wrong direction in step 21: from (69, 887) to (73, 887).
+WARNING: Moved in the wrong direction in step 22: from (73, 887) to (80, 887).
+WARNING: Moved in the wrong direction in step 25: from (37, 887) to (122, 867).
 WARNING: Moved in the wrong direction in step 27: from (87, 867) to (94, 867).
 WARNING: Moved in the wrong direction in step 28: from (94, 867) to (98, 867).
 WARNING: Moved in the wrong direction in step 29: from (98, 867) to (106, 867).
@@ -313,23 +313,23 @@
 WARNING: Moved in the wrong direction in step 4: from (67, 867) to (71, 867).
 WARNING: Moved in the wrong direction in step 5: from (71, 867) to (79, 867).
 WARNING: Moved in the wrong direction in step 6: from (79, 867) to (87, 867).
-WARNING: Moved in the wrong direction in step 7: from (87, 867) to (136, 886).
-WARNING: Moved in the wrong direction in step 14: from (51, 886) to (58, 886).
-WARNING: Moved in the wrong direction in step 15: from (58, 886) to (65, 886).
-WARNING: Moved in the wrong direction in step 16: from (65, 886) to (69, 886).
-WARNING: Moved in the wrong direction in step 17: from (69, 886) to (77, 886).
-WARNING: Moved in the wrong direction in step 18: from (77, 886) to (85, 886).
-WARNING: Moved in the wrong direction in step 19: from (85, 886) to (92, 886).
-WARNING: Moved in the wrong direction in step 20: from (92, 886) to (99, 886).
+WARNING: Moved in the wrong direction in step 7: from (87, 867) to (136, 887).
+WARNING: Moved in the wrong direction in step 14: from (51, 887) to (58, 887).
+WARNING: Moved in the wrong direction in step 15: from (58, 887) to (65, 887).
+WARNING: Moved in the wrong direction in step 16: from (65, 887) to (69, 887).
+WARNING: Moved in the wrong direction in step 17: from (69, 887) to (77, 887).
+WARNING: Moved in the wrong direction in step 18: from (77, 887) to (85, 887).
+WARNING: Moved in the wrong direction in step 19: from (85, 887) to (92, 887).
+WARNING: Moved in the wrong direction in step 20: from (92, 887) to (99, 887).
   Moving right:  "\n        This is JF[Y WY OJ[Y the boxes. \n    "[40, 39, 31, 32, 33, 34, 35, 36, 37, 38, 30, 29, 28, 27, 26, 25, 24, 23, 22, 21, 20, 19, 18, 17, 16, 10, 11, 12, 13, 14, 15, 9]
-WARNING: Moved in the wrong direction in step 12: from (99, 886) to (92, 886).
-WARNING: Moved in the wrong direction in step 13: from (92, 886) to (85, 886).
-WARNING: Moved in the wrong direction in step 14: from (85, 886) to (77, 886).
-WARNING: Moved in the wrong direction in step 15: from (77, 886) to (69, 886).
-WARNING: Moved in the wrong direction in step 16: from (69, 886) to (65, 886).
-WARNING: Moved in the wrong direction in step 17: from (65, 886) to (58, 886).
-WARNING: Moved in the wrong direction in step 18: from (58, 886) to (51, 886).
-WARNING: Moved in the wrong direction in step 25: from (136, 886) to (87, 867).
+WARNING: Moved in the wrong direction in step 12: from (99, 887) to (92, 887).
+WARNING: Moved in the wrong direction in step 13: from (92, 887) to (85, 887).
+WARNING: Moved in the wrong direction in step 14: from (85, 887) to (77, 887).
+WARNING: Moved in the wrong direction in step 15: from (77, 887) to (69, 887).
+WARNING: Moved in the wrong direction in step 16: from (69, 887) to (65, 887).
+WARNING: Moved in the wrong direction in step 17: from (65, 887) to (58, 887).
+WARNING: Moved in the wrong direction in step 18: from (58, 887) to (51, 887).
+WARNING: Moved in the wrong direction in step 25: from (136, 887) to (87, 867).
 WARNING: Moved in the wrong direction in step 26: from (87, 867) to (79, 867).
 WARNING: Moved in the wrong direction in step 27: from (79, 867) to (71, 867).
 WARNING: Moved in the wrong direction in step 28: from (71, 867) to (67, 867).
@@ -361,116 +361,116 @@
 WARNING: Moved in the wrong direction in step 11: from (733, 1075) to (767, 1015).
 Test 25, LTR:
   Moving right: "\n        abcdefABC"[9, 10, 11, 12, 13, 14, 15], "DEF\n    "[2, 1], <DIV>[2], "\n        abcdefABC"[18, 17, 16], "DEF\n    "[3]
-WARNING: Moved in the wrong direction in step 2: from (97, 1109) to (90, 1109).
-WARNING: Moved in the wrong direction in step 3: from (90, 1109) to (82, 1109).
-WARNING: Moved in the wrong direction in step 8: from (52, 1109) to (44, 1109).
+WARNING: Moved in the wrong direction in step 2: from (97, 1109) to (90, 1110).
+WARNING: Moved in the wrong direction in step 3: from (90, 1110) to (82, 1110).
+WARNING: Moved in the wrong direction in step 8: from (52, 1110) to (44, 1110).
   Moving left:  "DEF\n    "[3], "\n        abcdefABC"[16, 17, 18], <DIV>[2], "DEF\n    "[1, 2], "\n        abcdefABC"[15, 14, 13, 12, 11, 10, 9]
-WARNING: Moved in the wrong direction in step 6: from (44, 1109) to (52, 1109).
-WARNING: Moved in the wrong direction in step 11: from (82, 1109) to (90, 1109).
-WARNING: Moved in the wrong direction in step 12: from (90, 1109) to (97, 1109).
+WARNING: Moved in the wrong direction in step 6: from (44, 1110) to (52, 1110).
+WARNING: Moved in the wrong direction in step 11: from (82, 1110) to (90, 1110).
+WARNING: Moved in the wrong direction in step 12: from (90, 1110) to (97, 1109).
 Test 25, RTL:
   Moving left: "\n        abcdefABC"[9, 14, 13, 12, 11, 10, 15, 16, 17, 18], <DIV>[2], "DEF\n    "[1, 2, 3]
-WARNING: Moved in the wrong direction in step 3: from (672, 1109) to (676, 1109).
-WARNING: Moved in the wrong direction in step 4: from (676, 1109) to (684, 1109).
-WARNING: Moved in the wrong direction in step 5: from (684, 1109) to (691, 1109).
-WARNING: Moved in the wrong direction in step 12: from (734, 1109) to (742, 1109).
-WARNING: Moved in the wrong direction in step 13: from (742, 1109) to (749, 1109).
+WARNING: Moved in the wrong direction in step 3: from (672, 1110) to (676, 1110).
+WARNING: Moved in the wrong direction in step 4: from (676, 1110) to (684, 1110).
+WARNING: Moved in the wrong direction in step 12: from (734, 1110) to (742, 1110).
+WARNING: Moved in the wrong direction in step 13: from (742, 1110) to (749, 1110).
   Moving right:  "DEF\n    "[3, 2, 1], <DIV>[2], "\n        abcdefABC"[18, 17, 16, 15, 10, 11, 12, 13, 14, 9]
-WARNING: Moved in the wrong direction in step 1: from (749, 1109) to (742, 1109).
-WARNING: Moved in the wrong direction in step 2: from (742, 1109) to (734, 1109).
-WARNING: Moved in the wrong direction in step 9: from (691, 1109) to (684, 1109).
-WARNING: Moved in the wrong direction in step 10: from (684, 1109) to (676, 1109).
-WARNING: Moved in the wrong direction in step 11: from (676, 1109) to (672, 1109).
+WARNING: Moved in the wrong direction in step 1: from (749, 1110) to (742, 1110).
+WARNING: Moved in the wrong direction in step 2: from (742, 1110) to (734, 1110).
+WARNING: Moved in the wrong direction in step 10: from (684, 1110) to (676, 1110).
+WARNING: Moved in the wrong direction in step 11: from (676, 1110) to (672, 1110).
 Test 26, LTR:
   Moving right: "\n        ABCDEFabc"[9, 14, 13, 12, 11, 10, 15, 16, 17, 18], <DIV>[2], "def\n    "[1, 2, 3]
-WARNING: Moved in the wrong direction in step 3: from (133, 1144) to (129, 1144).
-WARNING: Moved in the wrong direction in step 4: from (129, 1144) to (122, 1144).
-WARNING: Moved in the wrong direction in step 5: from (122, 1144) to (113, 1144).
-WARNING: Moved in the wrong direction in step 12: from (68, 1144) to (61, 1144).
-WARNING: Moved in the wrong direction in step 13: from (61, 1144) to (56, 1144).
+WARNING: Moved in the wrong direction in step 3: from (133, 1145) to (129, 1145).
+WARNING: Moved in the wrong direction in step 4: from (129, 1145) to (122, 1145).
+WARNING: Moved in the wrong direction in step 12: from (68, 1145) to (61, 1145).
+WARNING: Moved in the wrong direction in step 13: from (61, 1145) to (56, 1145).
   Moving left:  "def\n    "[3, 2, 1], <DIV>[2], "\n        ABCDEFabc"[18, 17, 16, 15, 10, 11, 12, 13, 14, 9]
-WARNING: Moved in the wrong direction in step 1: from (56, 1144) to (61, 1144).
-WARNING: Moved in the wrong direction in step 2: from (61, 1144) to (68, 1144).
-WARNING: Moved in the wrong direction in step 9: from (113, 1144) to (122, 1144).
-WARNING: Moved in the wrong direction in step 10: from (122, 1144) to (129, 1144).
-WARNING: Moved in the wrong direction in step 11: from (129, 1144) to (133, 1144).
+WARNING: Moved in the wrong direction in step 1: from (56, 1145) to (61, 1145).
+WARNING: Moved in the wrong direction in step 2: from (61, 1145) to (68, 1145).
+WARNING: Moved in the wrong direction in step 10: from (122, 1145) to (129, 1145).
+WARNING: Moved in the wrong direction in step 11: from (129, 1145) to (133, 1145).
 Test 26, RTL:
   Moving left: "\n        ABCDEFabc"[9, 10, 11, 12, 13, 14, 15], "def\n    "[2, 1], <DIV>[2], "\n        ABCDEFabc"[18, 17, 16], "def\n    "[3]
-WARNING: Moved in the wrong direction in step 2: from (709, 1144) to (718, 1144).
-WARNING: Moved in the wrong direction in step 3: from (718, 1144) to (725, 1144).
-WARNING: Moved in the wrong direction in step 8: from (753, 1144) to (760, 1144).
+WARNING: Moved in the wrong direction in step 2: from (709, 1144) to (718, 1145).
+WARNING: Moved in the wrong direction in step 3: from (718, 1145) to (725, 1145).
+WARNING: Moved in the wrong direction in step 8: from (753, 1145) to (760, 1145).
   Moving right:  "def\n    "[3], "\n        ABCDEFabc"[16, 17, 18], <DIV>[2], "def\n    "[1, 2], "\n        ABCDEFabc"[15, 14, 13, 12, 11, 10, 9]
-WARNING: Moved in the wrong direction in step 6: from (760, 1144) to (753, 1144).
-WARNING: Moved in the wrong direction in step 11: from (725, 1144) to (718, 1144).
-WARNING: Moved in the wrong direction in step 12: from (718, 1144) to (709, 1144).
+WARNING: Moved in the wrong direction in step 6: from (760, 1145) to (753, 1145).
+WARNING: Moved in the wrong direction in step 11: from (725, 1145) to (718, 1145).
+WARNING: Moved in the wrong direction in step 12: from (718, 1145) to (709, 1144).
 Test 27, LTR:
   Moving right: "\n        abc"[9, 10, 11, 12], <DIV>[2], "DEFghi\n    "[2, 1], <DIV>[5, 4], "ABC"[3, 2, 1], "DEFghi\n    "[3, 4, 5, 6]
-WARNING: Moved in the wrong direction in step 2: from (225, 1179) to (217, 1179).
-WARNING: Moved in the wrong direction in step 4: from (284, 1179) to (52, 1179).
-WARNING: Moved in the wrong direction in step 6: from (52, 1179) to (44, 1179).
-WARNING: Moved in the wrong direction in step 8: from (276, 1179) to (212, 1179).
-WARNING: Moved in the wrong direction in step 9: from (212, 1179) to (59, 1179).
-WARNING: Moved in the wrong direction in step 10: from (59, 1179) to (52, 1179).
-WARNING: Moved in the wrong direction in step 11: from (52, 1179) to (44, 1179).
-WARNING: Moved in the wrong direction in step 15: from (276, 1179) to (269, 1179).
+WARNING: Moved in the wrong direction in step 2: from (225, 1180) to (217, 1180).
+WARNING: Moved in the wrong direction in step 4: from (284, 1180) to (52, 1180).
+WARNING: Moved in the wrong direction in step 6: from (52, 1180) to (44, 1180).
+WARNING: Moved in the wrong direction in step 9: from (212, 1179) to (59, 1180).
+WARNING: Moved in the wrong direction in step 10: from (59, 1180) to (52, 1180).
+WARNING: Moved in the wrong direction in step 11: from (52, 1180) to (44, 1180).
+WARNING: Moved in the wrong direction in step 14: from (212, 1179) to (276, 1180).
+WARNING: Moved in the wrong direction in step 15: from (276, 1180) to (269, 1180).
   Moving left:  "DEFghi\n    "[6, 5, 4, 3], "ABC"[1, 2, 3], <DIV>[4, 5], "DEFghi\n    "[1, 2], <DIV>[2], "\n        abc"[12, 11, 10, 9]
-WARNING: Moved in the wrong direction in step 1: from (269, 1179) to (276, 1179).
-WARNING: Moved in the wrong direction in step 5: from (44, 1179) to (52, 1179).
-WARNING: Moved in the wrong direction in step 6: from (52, 1179) to (59, 1179).
-WARNING: Moved in the wrong direction in step 7: from (59, 1179) to (212, 1179).
-WARNING: Moved in the wrong direction in step 8: from (212, 1179) to (276, 1179).
-WARNING: Moved in the wrong direction in step 10: from (44, 1179) to (52, 1179).
-WARNING: Moved in the wrong direction in step 12: from (52, 1179) to (284, 1179).
-WARNING: Moved in the wrong direction in step 14: from (217, 1179) to (225, 1179).
+WARNING: Moved in the wrong direction in step 1: from (269, 1180) to (276, 1180).
+WARNING: Moved in the wrong direction in step 2: from (276, 1180) to (212, 1179).
+WARNING: Moved in the wrong direction in step 5: from (44, 1180) to (52, 1180).
+WARNING: Moved in the wrong direction in step 6: from (52, 1180) to (59, 1180).
+WARNING: Moved in the wrong direction in step 7: from (59, 1180) to (212, 1179).
+WARNING: Moved in the wrong direction in step 10: from (44, 1180) to (52, 1180).
+WARNING: Moved in the wrong direction in step 12: from (52, 1180) to (284, 1180).
+WARNING: Moved in the wrong direction in step 14: from (217, 1180) to (225, 1180).
 Test 27, RTL:
   Moving left: "\n        abc"[9, 11, 10, 12], <DIV>[2], "ABC"[1, 2, 3], <DIV>[4, 5], "DEFghi\n    "[1, 2, 3, 5, 4, 6]
-WARNING: Moved in the wrong direction in step 2: from (525, 1179) to (533, 1179).
-WARNING: Moved in the wrong direction in step 4: from (521, 1179) to (761, 1179).
-WARNING: Moved in the wrong direction in step 6: from (753, 1179) to (761, 1179).
-WARNING: Moved in the wrong direction in step 10: from (584, 1179) to (753, 1179).
-WARNING: Moved in the wrong direction in step 11: from (753, 1179) to (761, 1179).
-WARNING: Moved in the wrong direction in step 14: from (584, 1179) to (592, 1179).
+WARNING: Moved in the wrong direction in step 2: from (525, 1180) to (533, 1180).
+WARNING: Moved in the wrong direction in step 4: from (521, 1180) to (761, 1180).
+WARNING: Moved in the wrong direction in step 6: from (753, 1180) to (761, 1180).
+WARNING: Moved in the wrong direction in step 9: from (592, 1179) to (584, 1180).
+WARNING: Moved in the wrong direction in step 10: from (584, 1180) to (753, 1180).
+WARNING: Moved in the wrong direction in step 11: from (753, 1180) to (761, 1180).
+WARNING: Moved in the wrong direction in step 15: from (592, 1179) to (577, 1180).
   Moving right:  "DEFghi\n    "[6, 4, 5, 3, 2, 1], <DIV>[5, 4], "ABC"[3, 2, 1], <DIV>[2], "\n        abc"[12, 10, 11, 9]
-WARNING: Moved in the wrong direction in step 2: from (592, 1179) to (584, 1179).
-WARNING: Moved in the wrong direction in step 5: from (761, 1179) to (753, 1179).
-WARNING: Moved in the wrong direction in step 6: from (753, 1179) to (584, 1179).
-WARNING: Moved in the wrong direction in step 10: from (761, 1179) to (753, 1179).
-WARNING: Moved in the wrong direction in step 12: from (761, 1179) to (521, 1179).
-WARNING: Moved in the wrong direction in step 14: from (533, 1179) to (525, 1179).
+WARNING: Moved in the wrong direction in step 1: from (577, 1180) to (592, 1179).
+WARNING: Moved in the wrong direction in step 5: from (761, 1180) to (753, 1180).
+WARNING: Moved in the wrong direction in step 6: from (753, 1180) to (584, 1180).
+WARNING: Moved in the wrong direction in step 7: from (584, 1180) to (592, 1179).
+WARNING: Moved in the wrong direction in step 10: from (761, 1180) to (753, 1180).
+WARNING: Moved in the wrong direction in step 12: from (761, 1180) to (521, 1180).
+WARNING: Moved in the wrong direction in step 14: from (533, 1180) to (525, 1180).
 Test 28, LTR:
   Moving right: "\n        ABC"[9, 11, 10, 12], <DIV>[2], "abc"[1, 2, 3], <DIV>[4, 5], "defDEF\n    "[1, 2, 3, 5, 4, 6]
-WARNING: Moved in the wrong direction in step 2: from (280, 1215) to (273, 1215).
-WARNING: Moved in the wrong direction in step 4: from (284, 1215) to (42, 1215).
-WARNING: Moved in the wrong direction in step 6: from (49, 1215) to (42, 1215).
-WARNING: Moved in the wrong direction in step 10: from (218, 1215) to (49, 1215).
-WARNING: Moved in the wrong direction in step 11: from (49, 1215) to (42, 1215).
-WARNING: Moved in the wrong direction in step 14: from (218, 1215) to (210, 1215).
+WARNING: Moved in the wrong direction in step 2: from (280, 1216) to (273, 1216).
+WARNING: Moved in the wrong direction in step 4: from (284, 1216) to (42, 1216).
+WARNING: Moved in the wrong direction in step 6: from (49, 1216) to (42, 1216).
+WARNING: Moved in the wrong direction in step 9: from (210, 1215) to (218, 1216).
+WARNING: Moved in the wrong direction in step 10: from (218, 1216) to (49, 1216).
+WARNING: Moved in the wrong direction in step 11: from (49, 1216) to (42, 1216).
+WARNING: Moved in the wrong direction in step 15: from (210, 1215) to (226, 1216).
   Moving left:  "defDEF\n    "[6, 4, 5, 3, 2, 1], <DIV>[5, 4], "abc"[3, 2, 1], <DIV>[2], "\n        ABC"[12, 10, 11, 9]
-WARNING: Moved in the wrong direction in step 2: from (210, 1215) to (218, 1215).
-WARNING: Moved in the wrong direction in step 5: from (42, 1215) to (49, 1215).
-WARNING: Moved in the wrong direction in step 6: from (49, 1215) to (218, 1215).
-WARNING: Moved in the wrong direction in step 10: from (42, 1215) to (49, 1215).
-WARNING: Moved in the wrong direction in step 12: from (42, 1215) to (284, 1215).
-WARNING: Moved in the wrong direction in step 14: from (273, 1215) to (280, 1215).
+WARNING: Moved in the wrong direction in step 1: from (226, 1216) to (210, 1215).
+WARNING: Moved in the wrong direction in step 5: from (42, 1216) to (49, 1216).
+WARNING: Moved in the wrong direction in step 6: from (49, 1216) to (218, 1216).
+WARNING: Moved in the wrong direction in step 7: from (218, 1216) to (210, 1215).
+WARNING: Moved in the wrong direction in step 10: from (42, 1216) to (49, 1216).
+WARNING: Moved in the wrong direction in step 12: from (42, 1216) to (284, 1216).
+WARNING: Moved in the wrong direction in step 14: from (273, 1216) to (280, 1216).
 Test 28, RTL:
   Moving left: "\n        ABC"[9, 10, 11, 12], <DIV>[2], "defDEF\n    "[2, 1], <DIV>[5, 4], "abc"[3, 2, 1], "defDEF\n    "[3, 4, 5, 6]
-WARNING: Moved in the wrong direction in step 2: from (583, 1215) to (590, 1215).
-WARNING: Moved in the wrong direction in step 4: from (521, 1215) to (753, 1215).
-WARNING: Moved in the wrong direction in step 6: from (753, 1215) to (760, 1215).
-WARNING: Moved in the wrong direction in step 8: from (528, 1215) to (594, 1215).
-WARNING: Moved in the wrong direction in step 9: from (594, 1215) to (748, 1215).
-WARNING: Moved in the wrong direction in step 10: from (748, 1215) to (753, 1215).
-WARNING: Moved in the wrong direction in step 11: from (753, 1215) to (760, 1215).
-WARNING: Moved in the wrong direction in step 15: from (528, 1215) to (536, 1215).
+WARNING: Moved in the wrong direction in step 2: from (583, 1216) to (590, 1216).
+WARNING: Moved in the wrong direction in step 4: from (521, 1216) to (753, 1216).
+WARNING: Moved in the wrong direction in step 6: from (753, 1216) to (760, 1216).
+WARNING: Moved in the wrong direction in step 9: from (594, 1215) to (748, 1216).
+WARNING: Moved in the wrong direction in step 10: from (748, 1216) to (753, 1216).
+WARNING: Moved in the wrong direction in step 11: from (753, 1216) to (760, 1216).
+WARNING: Moved in the wrong direction in step 14: from (594, 1215) to (528, 1216).
+WARNING: Moved in the wrong direction in step 15: from (528, 1216) to (536, 1216).
   Moving right:  "defDEF\n    "[6, 5, 4, 3], "abc"[1, 2, 3], <DIV>[4, 5], "defDEF\n    "[1, 2], <DIV>[2], "\n        ABC"[12, 11, 10, 9]
-WARNING: Moved in the wrong direction in step 1: from (536, 1215) to (528, 1215).
-WARNING: Moved in the wrong direction in step 5: from (760, 1215) to (753, 1215).
-WARNING: Moved in the wrong direction in step 6: from (753, 1215) to (748, 1215).
-WARNING: Moved in the wrong direction in step 7: from (748, 1215) to (594, 1215).
-WARNING: Moved in the wrong direction in step 8: from (594, 1215) to (528, 1215).
-WARNING: Moved in the wrong direction in step 10: from (760, 1215) to (753, 1215).
-WARNING: Moved in the wrong direction in step 12: from (753, 1215) to (521, 1215).
-WARNING: Moved in the wrong direction in step 14: from (590, 1215) to (583, 1215).
+WARNING: Moved in the wrong direction in step 1: from (536, 1216) to (528, 1216).
+WARNING: Moved in the wrong direction in step 2: from (528, 1216) to (594, 1215).
+WARNING: Moved in the wrong direction in step 5: from (760, 1216) to (753, 1216).
+WARNING: Moved in the wrong direction in step 6: from (753, 1216) to (748, 1216).
+WARNING: Moved in the wrong direction in step 7: from (748, 1216) to (594, 1215).
+WARNING: Moved in the wrong direction in step 10: from (760, 1216) to (753, 1216).
+WARNING: Moved in the wrong direction in step 12: from (753, 1216) to (521, 1216).
+WARNING: Moved in the wrong direction in step 14: from (590, 1216) to (583, 1216).
 Test 29, LTR:
   Moving right: "\n        abcABC"[9, 10, 11, 12], "DEF"[2, 1], "\n        abcABC"[15, 14, 13], "DEF"[3]
 WARNING: Moved in the wrong direction in step 5: from (52, 1251) to (44, 1251).

diff --git a/third_party/WebKit/LayoutTests/platform/linux/editing/selection/move-past-trailing-space-expected.png b/third_party/WebKit/LayoutTests/platform/linux/editing/selection/move-past-trailing-space-expected.png
index ff0225e..ae3b35d 100644
--- a/third_party/WebKit/LayoutTests/platform/linux/editing/selection/move-past-trailing-space-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/linux/editing/selection/move-past-trailing-space-expected.png
Binary files differ

diff --git a/third_party/WebKit/LayoutTests/platform/linux/editing/selection/select-box-expected.png b/third_party/WebKit/LayoutTests/platform/linux/editing/selection/select-box-expected.png
index 9e59fbc..79d82bd 100644
--- a/third_party/WebKit/LayoutTests/platform/linux/editing/selection/select-box-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/linux/editing/selection/select-box-expected.png
Binary files differ

diff --git a/third_party/WebKit/LayoutTests/platform/linux/editing/selection/selection-3748164-fix-expected.png b/third_party/WebKit/LayoutTests/platform/linux/editing/selection/selection-3748164-fix-expected.png
index 01989c5..3b9fa440 100644
--- a/third_party/WebKit/LayoutTests/platform/linux/editing/selection/selection-3748164-fix-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/linux/editing/selection/selection-3748164-fix-expected.png
Binary files differ

diff --git a/third_party/WebKit/LayoutTests/platform/linux/editing/unsupported-content/table-delete-001-expected.png b/third_party/WebKit/LayoutTests/platform/linux/editing/unsupported-content/table-delete-001-expected.png
index b9d373b..58b18d95 100644
--- a/third_party/WebKit/LayoutTests/platform/linux/editing/unsupported-content/table-delete-001-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/linux/editing/unsupported-content/table-delete-001-expected.png
Binary files differ

diff --git a/third_party/WebKit/LayoutTests/platform/linux/editing/unsupported-content/table-delete-003-expected.png b/third_party/WebKit/LayoutTests/platform/linux/editing/unsupported-content/table-delete-003-expected.png
index 9d5fb79..b27a699 100644
--- a/third_party/WebKit/LayoutTests/platform/linux/editing/unsupported-content/table-delete-003-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/linux/editing/unsupported-content/table-delete-003-expected.png
Binary files differ

diff --git a/third_party/WebKit/LayoutTests/platform/linux/fast/text/delete-hard-break-character-expected.png b/third_party/WebKit/LayoutTests/platform/linux/fast/text/delete-hard-break-character-expected.png
index 2424a0a..819c472 100644
--- a/third_party/WebKit/LayoutTests/platform/linux/fast/text/delete-hard-break-character-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/linux/fast/text/delete-hard-break-character-expected.png
Binary files differ

diff --git a/third_party/WebKit/LayoutTests/platform/linux/paint/invalidation/inline-outline-repaint-expected.txt b/third_party/WebKit/LayoutTests/platform/linux/paint/invalidation/inline-outline-repaint-expected.txt
index e5e69ab..019a400d 100644
--- a/third_party/WebKit/LayoutTests/platform/linux/paint/invalidation/inline-outline-repaint-expected.txt
+++ b/third_party/WebKit/LayoutTests/platform/linux/paint/invalidation/inline-outline-repaint-expected.txt

@@ -23,17 +23,17 @@
         },
         {
           "object": "LayoutText #text",
-          "rect": [43, 174, 3, 22],
+          "rect": [43, 175, 3, 21],
           "reason": "invalidate paint rectangle"
         },
         {
           "object": "LayoutText #text",
-          "rect": [43, 174, 3, 22],
+          "rect": [43, 175, 3, 21],
           "reason": "invalidate paint rectangle"
         },
         {
           "object": "LayoutText #text",
-          "rect": [43, 174, 3, 22],
+          "rect": [43, 175, 3, 21],
           "reason": "invalidate paint rectangle"
         }
       ]

diff --git a/third_party/WebKit/LayoutTests/platform/linux/virtual/stable/paint/invalidation/inline-outline-repaint-expected.txt b/third_party/WebKit/LayoutTests/platform/linux/virtual/stable/paint/invalidation/inline-outline-repaint-expected.txt
new file mode 100644
index 0000000..019a400d
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/platform/linux/virtual/stable/paint/invalidation/inline-outline-repaint-expected.txt

@@ -0,0 +1,97 @@
+{
+  "layers": [
+    {
+      "name": "LayoutView #document",
+      "bounds": [800, 600],
+      "contentsOpaque": true,
+      "drawsContent": true,
+      "paintInvalidations": [
+        {
+          "object": "LayoutBlockFlow DIV",
+          "rect": [8, 156, 100, 40],
+          "reason": "forced by layout"
+        },
+        {
+          "object": "LayoutInline SPAN id='test'",
+          "rect": [5, 153, 92, 45],
+          "reason": "forced by layout"
+        },
+        {
+          "object": "LayoutText #text",
+          "rect": [8, 156, 86, 39],
+          "reason": "full"
+        },
+        {
+          "object": "LayoutText #text",
+          "rect": [43, 175, 3, 21],
+          "reason": "invalidate paint rectangle"
+        },
+        {
+          "object": "LayoutText #text",
+          "rect": [43, 175, 3, 21],
+          "reason": "invalidate paint rectangle"
+        },
+        {
+          "object": "LayoutText #text",
+          "rect": [43, 175, 3, 21],
+          "reason": "invalidate paint rectangle"
+        }
+      ]
+    }
+  ],
+  "objectPaintInvalidations": [
+    {
+      "object": "LayoutText #text",
+      "reason": "layoutObject removal"
+    },
+    {
+      "object": "Caret",
+      "reason": "invalidate paint rectangle"
+    },
+    {
+      "object": "LayoutBlockFlow DIV",
+      "reason": "forced by layout"
+    },
+    {
+      "object": "RootInlineBox",
+      "reason": "forced by layout"
+    },
+    {
+      "object": "Caret",
+      "reason": "invalidate paint rectangle"
+    },
+    {
+      "object": "Caret",
+      "reason": "invalidate paint rectangle"
+    },
+    {
+      "object": "LayoutInline SPAN id='test'",
+      "reason": "forced by layout"
+    },
+    {
+      "object": "InlineFlowBox",
+      "reason": "forced by layout"
+    },
+    {
+      "object": "InlineFlowBox",
+      "reason": "forced by layout"
+    },
+    {
+      "object": "LayoutText #text",
+      "reason": "full"
+    },
+    {
+      "object": "InlineTextBox 'Lorem ipsum'",
+      "reason": "full"
+    },
+    {
+      "object": "InlineTextBox ' '",
+      "reason": "full"
+    },
+    {
+      "object": "InlineTextBox 'dolor\u00A0'",
+      "reason": "full"
+    }
+  ]
+}
+

diff --git a/third_party/WebKit/LayoutTests/platform/mac-mac10.10/editing/selection/select-box-expected.png b/third_party/WebKit/LayoutTests/platform/mac-mac10.10/editing/selection/select-box-expected.png
index a804eb10..7afcc205 100644
--- a/third_party/WebKit/LayoutTests/platform/mac-mac10.10/editing/selection/select-box-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/mac-mac10.10/editing/selection/select-box-expected.png
Binary files differ

diff --git a/third_party/WebKit/LayoutTests/platform/mac-mac10.9/editing/selection/move-left-right-expected.txt b/third_party/WebKit/LayoutTests/platform/mac-mac10.9/editing/selection/move-left-right-expected.txt
index d8cd092..021f174 100644
--- a/third_party/WebKit/LayoutTests/platform/mac-mac10.9/editing/selection/move-left-right-expected.txt
+++ b/third_party/WebKit/LayoutTests/platform/mac-mac10.9/editing/selection/move-left-right-expected.txt

@@ -357,116 +357,116 @@
 WARNING: Moved in the wrong direction in step 11: from (720, 1051) to (767, 993).
 Test 25, LTR:
   Moving right: "\n        abcdefABC"[9, 10, 11, 12, 13, 14, 15], "DEF\n    "[2, 1], <DIV>[2], "\n        abcdefABC"[18, 17, 16], "DEF\n    "[3]
-WARNING: Moved in the wrong direction in step 2: from (113, 1083) to (105, 1083).
-WARNING: Moved in the wrong direction in step 3: from (105, 1083) to (93, 1083).
-WARNING: Moved in the wrong direction in step 8: from (56, 1083) to (46, 1083).
+WARNING: Moved in the wrong direction in step 2: from (113, 1083) to (105, 1084).
+WARNING: Moved in the wrong direction in step 3: from (105, 1084) to (93, 1084).
+WARNING: Moved in the wrong direction in step 8: from (56, 1084) to (46, 1084).
   Moving left:  "DEF\n    "[3], "\n        abcdefABC"[16, 17, 18], <DIV>[2], "DEF\n    "[1, 2], "\n        abcdefABC"[15, 14, 13, 12, 11, 10, 9]
-WARNING: Moved in the wrong direction in step 6: from (46, 1083) to (56, 1083).
-WARNING: Moved in the wrong direction in step 11: from (93, 1083) to (105, 1083).
-WARNING: Moved in the wrong direction in step 12: from (105, 1083) to (113, 1083).
+WARNING: Moved in the wrong direction in step 6: from (46, 1084) to (56, 1084).
+WARNING: Moved in the wrong direction in step 11: from (93, 1084) to (105, 1084).
+WARNING: Moved in the wrong direction in step 12: from (105, 1084) to (113, 1083).
 Test 25, RTL:
   Moving left: "\n        abcdefABC"[9, 14, 13, 12, 11, 10, 15, 16, 17, 18], <DIV>[2], "DEF\n    "[1, 2, 3]
-WARNING: Moved in the wrong direction in step 3: from (649, 1083) to (654, 1083).
-WARNING: Moved in the wrong direction in step 4: from (654, 1083) to (666, 1083).
-WARNING: Moved in the wrong direction in step 5: from (666, 1083) to (673, 1083).
-WARNING: Moved in the wrong direction in step 12: from (725, 1083) to (735, 1083).
-WARNING: Moved in the wrong direction in step 13: from (735, 1083) to (743, 1083).
+WARNING: Moved in the wrong direction in step 3: from (649, 1084) to (654, 1084).
+WARNING: Moved in the wrong direction in step 4: from (654, 1084) to (666, 1084).
+WARNING: Moved in the wrong direction in step 12: from (725, 1084) to (735, 1084).
+WARNING: Moved in the wrong direction in step 13: from (735, 1084) to (743, 1084).
   Moving right:  "DEF\n    "[3, 2, 1], <DIV>[2], "\n        abcdefABC"[18, 17, 16, 15, 10, 11, 12, 13, 14, 9]
-WARNING: Moved in the wrong direction in step 1: from (743, 1083) to (735, 1083).
-WARNING: Moved in the wrong direction in step 2: from (735, 1083) to (725, 1083).
-WARNING: Moved in the wrong direction in step 9: from (673, 1083) to (666, 1083).
-WARNING: Moved in the wrong direction in step 10: from (666, 1083) to (654, 1083).
-WARNING: Moved in the wrong direction in step 11: from (654, 1083) to (649, 1083).
+WARNING: Moved in the wrong direction in step 1: from (743, 1084) to (735, 1084).
+WARNING: Moved in the wrong direction in step 2: from (735, 1084) to (725, 1084).
+WARNING: Moved in the wrong direction in step 10: from (666, 1084) to (654, 1084).
+WARNING: Moved in the wrong direction in step 11: from (654, 1084) to (649, 1084).
 Test 26, LTR:
   Moving right: "\n        ABCDEFabc"[9, 14, 13, 12, 11, 10, 15, 16, 17, 18], <DIV>[2], "def\n    "[1, 2, 3]
-WARNING: Moved in the wrong direction in step 3: from (155, 1116) to (149, 1116).
-WARNING: Moved in the wrong direction in step 4: from (149, 1116) to (140, 1116).
-WARNING: Moved in the wrong direction in step 5: from (140, 1116) to (129, 1116).
-WARNING: Moved in the wrong direction in step 12: from (77, 1116) to (68, 1116).
-WARNING: Moved in the wrong direction in step 13: from (68, 1116) to (62, 1116).
+WARNING: Moved in the wrong direction in step 3: from (155, 1117) to (149, 1117).
+WARNING: Moved in the wrong direction in step 4: from (149, 1117) to (140, 1117).
+WARNING: Moved in the wrong direction in step 12: from (77, 1117) to (68, 1117).
+WARNING: Moved in the wrong direction in step 13: from (68, 1117) to (62, 1117).
   Moving left:  "def\n    "[3, 2, 1], <DIV>[2], "\n        ABCDEFabc"[18, 17, 16, 15, 10, 11, 12, 13, 14, 9]
-WARNING: Moved in the wrong direction in step 1: from (62, 1116) to (68, 1116).
-WARNING: Moved in the wrong direction in step 2: from (68, 1116) to (77, 1116).
-WARNING: Moved in the wrong direction in step 9: from (129, 1116) to (140, 1116).
-WARNING: Moved in the wrong direction in step 10: from (140, 1116) to (149, 1116).
-WARNING: Moved in the wrong direction in step 11: from (149, 1116) to (155, 1116).
+WARNING: Moved in the wrong direction in step 1: from (62, 1117) to (68, 1117).
+WARNING: Moved in the wrong direction in step 2: from (68, 1117) to (77, 1117).
+WARNING: Moved in the wrong direction in step 10: from (140, 1117) to (149, 1117).
+WARNING: Moved in the wrong direction in step 11: from (149, 1117) to (155, 1117).
 Test 26, RTL:
   Moving left: "\n        ABCDEFabc"[9, 10, 11, 12, 13, 14, 15], "def\n    "[2, 1], <DIV>[2], "\n        ABCDEFabc"[18, 17, 16], "def\n    "[3]
-WARNING: Moved in the wrong direction in step 2: from (691, 1116) to (702, 1116).
-WARNING: Moved in the wrong direction in step 3: from (702, 1116) to (711, 1116).
-WARNING: Moved in the wrong direction in step 8: from (748, 1116) to (757, 1116).
+WARNING: Moved in the wrong direction in step 2: from (691, 1116) to (702, 1117).
+WARNING: Moved in the wrong direction in step 3: from (702, 1117) to (711, 1117).
+WARNING: Moved in the wrong direction in step 8: from (748, 1117) to (757, 1117).
   Moving right:  "def\n    "[3], "\n        ABCDEFabc"[16, 17, 18], <DIV>[2], "def\n    "[1, 2], "\n        ABCDEFabc"[15, 14, 13, 12, 11, 10, 9]
-WARNING: Moved in the wrong direction in step 6: from (757, 1116) to (748, 1116).
-WARNING: Moved in the wrong direction in step 11: from (711, 1116) to (702, 1116).
-WARNING: Moved in the wrong direction in step 12: from (702, 1116) to (691, 1116).
+WARNING: Moved in the wrong direction in step 6: from (757, 1117) to (748, 1117).
+WARNING: Moved in the wrong direction in step 11: from (711, 1117) to (702, 1117).
+WARNING: Moved in the wrong direction in step 12: from (702, 1117) to (691, 1116).
 Test 27, LTR:
   Moving right: "\n        abc"[9, 10, 11, 12], <DIV>[2], "DEFghi\n    "[2, 1], <DIV>[5, 4], "ABC"[3, 2, 1], "DEFghi\n    "[3, 4, 5, 6]
-WARNING: Moved in the wrong direction in step 2: from (204, 1149) to (192, 1149).
-WARNING: Moved in the wrong direction in step 4: from (269, 1149) to (56, 1149).
-WARNING: Moved in the wrong direction in step 6: from (56, 1149) to (46, 1149).
-WARNING: Moved in the wrong direction in step 8: from (259, 1149) to (186, 1149).
-WARNING: Moved in the wrong direction in step 9: from (186, 1149) to (64, 1149).
-WARNING: Moved in the wrong direction in step 10: from (64, 1149) to (56, 1149).
-WARNING: Moved in the wrong direction in step 11: from (56, 1149) to (46, 1149).
-WARNING: Moved in the wrong direction in step 15: from (259, 1149) to (250, 1149).
+WARNING: Moved in the wrong direction in step 2: from (204, 1150) to (192, 1150).
+WARNING: Moved in the wrong direction in step 4: from (269, 1150) to (56, 1150).
+WARNING: Moved in the wrong direction in step 6: from (56, 1150) to (46, 1150).
+WARNING: Moved in the wrong direction in step 9: from (186, 1149) to (64, 1150).
+WARNING: Moved in the wrong direction in step 10: from (64, 1150) to (56, 1150).
+WARNING: Moved in the wrong direction in step 11: from (56, 1150) to (46, 1150).
+WARNING: Moved in the wrong direction in step 14: from (186, 1149) to (259, 1150).
+WARNING: Moved in the wrong direction in step 15: from (259, 1150) to (250, 1150).
   Moving left:  "DEFghi\n    "[6, 5, 4, 3], "ABC"[1, 2, 3], <DIV>[4, 5], "DEFghi\n    "[1, 2], <DIV>[2], "\n        abc"[12, 11, 10, 9]
-WARNING: Moved in the wrong direction in step 1: from (250, 1149) to (259, 1149).
-WARNING: Moved in the wrong direction in step 5: from (46, 1149) to (56, 1149).
-WARNING: Moved in the wrong direction in step 6: from (56, 1149) to (64, 1149).
-WARNING: Moved in the wrong direction in step 7: from (64, 1149) to (186, 1149).
-WARNING: Moved in the wrong direction in step 8: from (186, 1149) to (259, 1149).
-WARNING: Moved in the wrong direction in step 10: from (46, 1149) to (56, 1149).
-WARNING: Moved in the wrong direction in step 12: from (56, 1149) to (269, 1149).
-WARNING: Moved in the wrong direction in step 14: from (192, 1149) to (204, 1149).
+WARNING: Moved in the wrong direction in step 1: from (250, 1150) to (259, 1150).
+WARNING: Moved in the wrong direction in step 2: from (259, 1150) to (186, 1149).
+WARNING: Moved in the wrong direction in step 5: from (46, 1150) to (56, 1150).
+WARNING: Moved in the wrong direction in step 6: from (56, 1150) to (64, 1150).
+WARNING: Moved in the wrong direction in step 7: from (64, 1150) to (186, 1149).
+WARNING: Moved in the wrong direction in step 10: from (46, 1150) to (56, 1150).
+WARNING: Moved in the wrong direction in step 12: from (56, 1150) to (269, 1150).
+WARNING: Moved in the wrong direction in step 14: from (192, 1150) to (204, 1150).
 Test 27, RTL:
   Moving left: "\n        abc"[9, 11, 10, 12], <DIV>[2], "ABC"[1, 2, 3], <DIV>[4, 5], "DEFghi\n    "[1, 2, 3, 5, 4, 6]
-WARNING: Moved in the wrong direction in step 2: from (540, 1149) to (552, 1149).
-WARNING: Moved in the wrong direction in step 4: from (535, 1149) to (759, 1149).
-WARNING: Moved in the wrong direction in step 6: from (749, 1149) to (759, 1149).
-WARNING: Moved in the wrong direction in step 10: from (607, 1149) to (749, 1149).
-WARNING: Moved in the wrong direction in step 11: from (749, 1149) to (759, 1149).
-WARNING: Moved in the wrong direction in step 14: from (607, 1149) to (617, 1149).
+WARNING: Moved in the wrong direction in step 2: from (540, 1150) to (552, 1150).
+WARNING: Moved in the wrong direction in step 4: from (535, 1150) to (759, 1150).
+WARNING: Moved in the wrong direction in step 6: from (749, 1150) to (759, 1150).
+WARNING: Moved in the wrong direction in step 9: from (617, 1149) to (607, 1150).
+WARNING: Moved in the wrong direction in step 10: from (607, 1150) to (749, 1150).
+WARNING: Moved in the wrong direction in step 11: from (749, 1150) to (759, 1150).
+WARNING: Moved in the wrong direction in step 15: from (617, 1149) to (598, 1150).
   Moving right:  "DEFghi\n    "[6, 4, 5, 3, 2, 1], <DIV>[5, 4], "ABC"[3, 2, 1], <DIV>[2], "\n        abc"[12, 10, 11, 9]
-WARNING: Moved in the wrong direction in step 2: from (617, 1149) to (607, 1149).
-WARNING: Moved in the wrong direction in step 5: from (759, 1149) to (749, 1149).
-WARNING: Moved in the wrong direction in step 6: from (749, 1149) to (607, 1149).
-WARNING: Moved in the wrong direction in step 10: from (759, 1149) to (749, 1149).
-WARNING: Moved in the wrong direction in step 12: from (759, 1149) to (535, 1149).
-WARNING: Moved in the wrong direction in step 14: from (552, 1149) to (540, 1149).
+WARNING: Moved in the wrong direction in step 1: from (598, 1150) to (617, 1149).
+WARNING: Moved in the wrong direction in step 5: from (759, 1150) to (749, 1150).
+WARNING: Moved in the wrong direction in step 6: from (749, 1150) to (607, 1150).
+WARNING: Moved in the wrong direction in step 7: from (607, 1150) to (617, 1149).
+WARNING: Moved in the wrong direction in step 10: from (759, 1150) to (749, 1150).
+WARNING: Moved in the wrong direction in step 12: from (759, 1150) to (535, 1150).
+WARNING: Moved in the wrong direction in step 14: from (552, 1150) to (540, 1150).
 Test 28, LTR:
   Moving right: "\n        ABC"[9, 11, 10, 12], <DIV>[2], "abc"[1, 2, 3], <DIV>[4, 5], "defDEF\n    "[1, 2, 3, 5, 4, 6]
-WARNING: Moved in the wrong direction in step 2: from (264, 1184) to (255, 1184).
-WARNING: Moved in the wrong direction in step 4: from (270, 1184) to (44, 1184).
-WARNING: Moved in the wrong direction in step 6: from (53, 1184) to (44, 1184).
-WARNING: Moved in the wrong direction in step 10: from (195, 1184) to (53, 1184).
-WARNING: Moved in the wrong direction in step 11: from (53, 1184) to (44, 1184).
-WARNING: Moved in the wrong direction in step 14: from (195, 1184) to (185, 1184).
+WARNING: Moved in the wrong direction in step 2: from (264, 1185) to (255, 1185).
+WARNING: Moved in the wrong direction in step 4: from (270, 1185) to (44, 1185).
+WARNING: Moved in the wrong direction in step 6: from (53, 1185) to (44, 1185).
+WARNING: Moved in the wrong direction in step 9: from (185, 1184) to (195, 1185).
+WARNING: Moved in the wrong direction in step 10: from (195, 1185) to (53, 1185).
+WARNING: Moved in the wrong direction in step 11: from (53, 1185) to (44, 1185).
+WARNING: Moved in the wrong direction in step 15: from (185, 1184) to (205, 1185).
   Moving left:  "defDEF\n    "[6, 4, 5, 3, 2, 1], <DIV>[5, 4], "abc"[3, 2, 1], <DIV>[2], "\n        ABC"[12, 10, 11, 9]
-WARNING: Moved in the wrong direction in step 2: from (185, 1184) to (195, 1184).
-WARNING: Moved in the wrong direction in step 5: from (44, 1184) to (53, 1184).
-WARNING: Moved in the wrong direction in step 6: from (53, 1184) to (195, 1184).
-WARNING: Moved in the wrong direction in step 10: from (44, 1184) to (53, 1184).
-WARNING: Moved in the wrong direction in step 12: from (44, 1184) to (270, 1184).
-WARNING: Moved in the wrong direction in step 14: from (255, 1184) to (264, 1184).
+WARNING: Moved in the wrong direction in step 1: from (205, 1185) to (185, 1184).
+WARNING: Moved in the wrong direction in step 5: from (44, 1185) to (53, 1185).
+WARNING: Moved in the wrong direction in step 6: from (53, 1185) to (195, 1185).
+WARNING: Moved in the wrong direction in step 7: from (195, 1185) to (185, 1184).
+WARNING: Moved in the wrong direction in step 10: from (44, 1185) to (53, 1185).
+WARNING: Moved in the wrong direction in step 12: from (44, 1185) to (270, 1185).
+WARNING: Moved in the wrong direction in step 14: from (255, 1185) to (264, 1185).
 Test 28, RTL:
   Moving left: "\n        ABC"[9, 10, 11, 12], <DIV>[2], "defDEF\n    "[2, 1], <DIV>[5, 4], "abc"[3, 2, 1], "defDEF\n    "[3, 4, 5, 6]
-WARNING: Moved in the wrong direction in step 2: from (603, 1184) to (612, 1184).
-WARNING: Moved in the wrong direction in step 4: from (534, 1184) to (748, 1184).
-WARNING: Moved in the wrong direction in step 6: from (748, 1184) to (757, 1184).
-WARNING: Moved in the wrong direction in step 8: from (543, 1184) to (618, 1184).
-WARNING: Moved in the wrong direction in step 9: from (618, 1184) to (741, 1184).
-WARNING: Moved in the wrong direction in step 10: from (741, 1184) to (748, 1184).
-WARNING: Moved in the wrong direction in step 11: from (748, 1184) to (757, 1184).
-WARNING: Moved in the wrong direction in step 15: from (543, 1184) to (553, 1184).
+WARNING: Moved in the wrong direction in step 2: from (603, 1185) to (612, 1185).
+WARNING: Moved in the wrong direction in step 4: from (535, 1185) to (748, 1185).
+WARNING: Moved in the wrong direction in step 6: from (748, 1185) to (757, 1185).
+WARNING: Moved in the wrong direction in step 9: from (618, 1184) to (741, 1185).
+WARNING: Moved in the wrong direction in step 10: from (741, 1185) to (748, 1185).
+WARNING: Moved in the wrong direction in step 11: from (748, 1185) to (757, 1185).
+WARNING: Moved in the wrong direction in step 14: from (618, 1184) to (543, 1185).
+WARNING: Moved in the wrong direction in step 15: from (543, 1185) to (553, 1185).
   Moving right:  "defDEF\n    "[6, 5, 4, 3], "abc"[1, 2, 3], <DIV>[4, 5], "defDEF\n    "[1, 2], <DIV>[2], "\n        ABC"[12, 11, 10, 9]
-WARNING: Moved in the wrong direction in step 1: from (553, 1184) to (543, 1184).
-WARNING: Moved in the wrong direction in step 5: from (757, 1184) to (748, 1184).
-WARNING: Moved in the wrong direction in step 6: from (748, 1184) to (741, 1184).
-WARNING: Moved in the wrong direction in step 7: from (741, 1184) to (618, 1184).
-WARNING: Moved in the wrong direction in step 8: from (618, 1184) to (543, 1184).
-WARNING: Moved in the wrong direction in step 10: from (757, 1184) to (748, 1184).
-WARNING: Moved in the wrong direction in step 12: from (748, 1184) to (534, 1184).
-WARNING: Moved in the wrong direction in step 14: from (612, 1184) to (603, 1184).
+WARNING: Moved in the wrong direction in step 1: from (553, 1185) to (543, 1185).
+WARNING: Moved in the wrong direction in step 2: from (543, 1185) to (618, 1184).
+WARNING: Moved in the wrong direction in step 5: from (757, 1185) to (748, 1185).
+WARNING: Moved in the wrong direction in step 6: from (748, 1185) to (741, 1185).
+WARNING: Moved in the wrong direction in step 7: from (741, 1185) to (618, 1184).
+WARNING: Moved in the wrong direction in step 10: from (757, 1185) to (748, 1185).
+WARNING: Moved in the wrong direction in step 12: from (748, 1185) to (535, 1185).
+WARNING: Moved in the wrong direction in step 14: from (612, 1185) to (603, 1185).
 Test 29, LTR:
   Moving right: "\n        abcABC"[9, 10, 11, 12], "DEF"[2, 1], "\n        abcABC"[15, 14, 13], "DEF"[3]
 WARNING: Moved in the wrong direction in step 5: from (56, 1219) to (46, 1219).

diff --git a/third_party/WebKit/LayoutTests/platform/mac-mac10.9/editing/selection/select-box-expected.png b/third_party/WebKit/LayoutTests/platform/mac-mac10.9/editing/selection/select-box-expected.png
index 608090d..e6f0658 100644
--- a/third_party/WebKit/LayoutTests/platform/mac-mac10.9/editing/selection/select-box-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/mac-mac10.9/editing/selection/select-box-expected.png
Binary files differ

diff --git a/third_party/WebKit/LayoutTests/platform/mac/editing/caret/caret-color-014-expected.png b/third_party/WebKit/LayoutTests/platform/mac/editing/caret/caret-color-014-expected.png
index 05c1659..658bf5aa 100644
--- a/third_party/WebKit/LayoutTests/platform/mac/editing/caret/caret-color-014-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/mac/editing/caret/caret-color-014-expected.png
Binary files differ

diff --git a/third_party/WebKit/LayoutTests/platform/mac/editing/caret/caret-color-015-expected.png b/third_party/WebKit/LayoutTests/platform/mac/editing/caret/caret-color-015-expected.png
index 4b66ebb4..6bd42795 100644
--- a/third_party/WebKit/LayoutTests/platform/mac/editing/caret/caret-color-015-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/mac/editing/caret/caret-color-015-expected.png
Binary files differ

diff --git a/third_party/WebKit/LayoutTests/platform/mac/editing/selection/4947387-expected.png b/third_party/WebKit/LayoutTests/platform/mac/editing/selection/4947387-expected.png
deleted file mode 100644
index d5bbf7b9..0000000
--- a/third_party/WebKit/LayoutTests/platform/mac/editing/selection/4947387-expected.png
+++ /dev/null
Binary files differ

diff --git a/third_party/WebKit/LayoutTests/platform/mac/editing/selection/4947387-expected.txt b/third_party/WebKit/LayoutTests/platform/mac/editing/selection/4947387-expected.txt
deleted file mode 100644
index 1045a0077..0000000
--- a/third_party/WebKit/LayoutTests/platform/mac/editing/selection/4947387-expected.txt
+++ /dev/null

@@ -1,29 +0,0 @@
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-layer at (0,0) size 800x600
-  LayoutView at (0,0) size 800x600
-layer at (0,0) size 800x600
-  LayoutBlockFlow {HTML} at (0,0) size 800x600
-    LayoutBlockFlow {BODY} at (8,8) size 784x584
-      LayoutBlockFlow {P} at (0,0) size 784x72
-        LayoutText {#text} at (0,0) size 775x72
-          text run at (0,0) width 423: "This tests moveTo{Beginning, End}OfLineAndModifySelection. "
-          text run at (422,0) width 350: "It should operate on line boundaries and not paragraph"
-          text run at (0,18) width 79: "boundaries. "
-          text run at (78,18) width 697: "To run it manually, click inside the first line of the editable region below and do Command+Shift+Left/Right"
-          text run at (0,36) width 619: "Arrow, the selection should extend to the start/end of the line, not the start/end of the paragraph. "
-          text run at (618,36) width 35: "Also,"
-          text run at (0,54) width 473: "moveTo{Beginning, End}OfParagraphAndModifySelection should work."
-      LayoutBlockFlow {DIV} at (0,88) size 200x36
-        LayoutText {#text} at (0,0) size 191x36
-          text run at (0,0) width 187: "The quick brown fox jumped"
-          text run at (186,0) width 5: " "
-          text run at (0,18) width 160: "over the lazy brown dog."
-selection start: position 0 of child 0 {#text} of child 2 {DIV} of body
-selection end:   position 51 of child 0 {#text} of child 2 {DIV} of body

diff --git a/third_party/WebKit/LayoutTests/platform/mac/editing/selection/after-line-wrap-expected.png b/third_party/WebKit/LayoutTests/platform/mac/editing/selection/after-line-wrap-expected.png
deleted file mode 100644
index 169d4a3..0000000
--- a/third_party/WebKit/LayoutTests/platform/mac/editing/selection/after-line-wrap-expected.png
+++ /dev/null
Binary files differ

diff --git a/third_party/WebKit/LayoutTests/platform/mac/editing/selection/after-line-wrap-expected.txt b/third_party/WebKit/LayoutTests/platform/mac/editing/selection/after-line-wrap-expected.txt
deleted file mode 100644
index f7845db..0000000
--- a/third_party/WebKit/LayoutTests/platform/mac/editing/selection/after-line-wrap-expected.txt
+++ /dev/null

@@ -1,42 +0,0 @@
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-layer at (0,0) size 800x600
-  LayoutView at (0,0) size 800x600
-layer at (0,0) size 800x600
-  LayoutBlockFlow {HTML} at (0,0) size 800x600
-    LayoutBlockFlow {BODY} at (8,8) size 784x576
-      LayoutBlockFlow {P} at (0,0) size 784x36
-        LayoutInline {B} at (0,0) size 306x18
-          LayoutText {#text} at (0,0) size 306x18
-            text run at (0,0) width 306: "Make sure that your window is small enough"
-        LayoutText {#text} at (305,0) size 778x36
-          text run at (305,0) width 473: " so that 'don't select this line' and 'try to select just this line' appear on two"
-          text run at (0,18) width 98: "different lines. "
-          text run at (97,18) width 623: "The two phrases are actually in the same paragraph, there are just lots of spaces in between them."
-      LayoutBlockFlow {P} at (0,52) size 784x36
-        LayoutText {#text} at (0,0) size 108x18
-          text run at (0,0) width 108: "This is a test for "
-        LayoutInline {A} at (0,0) size 373x18 [color=#0000EE]
-          LayoutText {#text} at (107,0) size 373x18
-            text run at (107,0) width 373: "REGRESSION: Selection includes spaces that it shouldn't"
-        LayoutText {#text} at (479,0) size 768x36
-          text run at (479,0) width 289: ". The test makes sure that a word that is right"
-          text run at (0,18) width 291: "after a line wrap can be selected successfully."
-      LayoutBlockFlow {P} at (0,104) size 784x0
-      LayoutBlockFlow {DIV} at (16,104) size 752x74 [border: (1px solid #000000)]
-        LayoutText {#text} at (1,1) size 748x54
-          text run at (1,1) width 96: "don't select me"
-          text run at (96,1) width 5: " "
-          text run at (1,19) width 748: "                                                                                                                                                                                           "
-          text run at (1,37) width 644: "                                                                                                                                                                 "
-        LayoutInline {I} at (0,0) size 750x36
-          LayoutText {#text} at (645,37) size 750x36
-            text run at (645,37) width 102: "try to select just"
-            text run at (746,37) width 5: " "
-            text run at (1,55) width 51: "this text"
-        LayoutText {#text} at (0,0) size 0x0
-selection start: position 17 of child 0 {#text} of child 7 {DIV} of body
-selection end:   position 20 of child 0 {#text} of child 7 {DIV} of body

diff --git a/third_party/WebKit/LayoutTests/platform/mac/editing/selection/move-left-right-expected.txt b/third_party/WebKit/LayoutTests/platform/mac/editing/selection/move-left-right-expected.txt
index a903678..561ad3cf 100644
--- a/third_party/WebKit/LayoutTests/platform/mac/editing/selection/move-left-right-expected.txt
+++ b/third_party/WebKit/LayoutTests/platform/mac/editing/selection/move-left-right-expected.txt

@@ -357,116 +357,116 @@
 WARNING: Moved in the wrong direction in step 11: from (720, 1051) to (767, 993).
 Test 25, LTR:
   Moving right: "\n        abcdefABC"[9, 10, 11, 12, 13, 14, 15], "DEF\n    "[2, 1], <DIV>[2], "\n        abcdefABC"[18, 17, 16], "DEF\n    "[3]
-WARNING: Moved in the wrong direction in step 2: from (113, 1083) to (105, 1083).
-WARNING: Moved in the wrong direction in step 3: from (105, 1083) to (93, 1083).
-WARNING: Moved in the wrong direction in step 8: from (56, 1083) to (46, 1083).
+WARNING: Moved in the wrong direction in step 2: from (113, 1083) to (105, 1084).
+WARNING: Moved in the wrong direction in step 3: from (105, 1084) to (93, 1084).
+WARNING: Moved in the wrong direction in step 8: from (56, 1084) to (46, 1084).
   Moving left:  "DEF\n    "[3], "\n        abcdefABC"[16, 17, 18], <DIV>[2], "DEF\n    "[1, 2], "\n        abcdefABC"[15, 14, 13, 12, 11, 10, 9]
-WARNING: Moved in the wrong direction in step 6: from (46, 1083) to (56, 1083).
-WARNING: Moved in the wrong direction in step 11: from (93, 1083) to (105, 1083).
-WARNING: Moved in the wrong direction in step 12: from (105, 1083) to (113, 1083).
+WARNING: Moved in the wrong direction in step 6: from (46, 1084) to (56, 1084).
+WARNING: Moved in the wrong direction in step 11: from (93, 1084) to (105, 1084).
+WARNING: Moved in the wrong direction in step 12: from (105, 1084) to (113, 1083).
 Test 25, RTL:
   Moving left: "\n        abcdefABC"[9, 14, 13, 12, 11, 10, 15, 16, 17, 18], <DIV>[2], "DEF\n    "[1, 2, 3]
-WARNING: Moved in the wrong direction in step 3: from (649, 1083) to (654, 1083).
-WARNING: Moved in the wrong direction in step 4: from (654, 1083) to (666, 1083).
-WARNING: Moved in the wrong direction in step 5: from (666, 1083) to (673, 1083).
-WARNING: Moved in the wrong direction in step 12: from (725, 1083) to (735, 1083).
-WARNING: Moved in the wrong direction in step 13: from (735, 1083) to (743, 1083).
+WARNING: Moved in the wrong direction in step 3: from (649, 1084) to (654, 1084).
+WARNING: Moved in the wrong direction in step 4: from (654, 1084) to (666, 1084).
+WARNING: Moved in the wrong direction in step 12: from (725, 1084) to (735, 1084).
+WARNING: Moved in the wrong direction in step 13: from (735, 1084) to (743, 1084).
   Moving right:  "DEF\n    "[3, 2, 1], <DIV>[2], "\n        abcdefABC"[18, 17, 16, 15, 10, 11, 12, 13, 14, 9]
-WARNING: Moved in the wrong direction in step 1: from (743, 1083) to (735, 1083).
-WARNING: Moved in the wrong direction in step 2: from (735, 1083) to (725, 1083).
-WARNING: Moved in the wrong direction in step 9: from (673, 1083) to (666, 1083).
-WARNING: Moved in the wrong direction in step 10: from (666, 1083) to (654, 1083).
-WARNING: Moved in the wrong direction in step 11: from (654, 1083) to (649, 1083).
+WARNING: Moved in the wrong direction in step 1: from (743, 1084) to (735, 1084).
+WARNING: Moved in the wrong direction in step 2: from (735, 1084) to (725, 1084).
+WARNING: Moved in the wrong direction in step 10: from (666, 1084) to (654, 1084).
+WARNING: Moved in the wrong direction in step 11: from (654, 1084) to (649, 1084).
 Test 26, LTR:
   Moving right: "\n        ABCDEFabc"[9, 14, 13, 12, 11, 10, 15, 16, 17, 18], <DIV>[2], "def\n    "[1, 2, 3]
-WARNING: Moved in the wrong direction in step 3: from (155, 1116) to (149, 1116).
-WARNING: Moved in the wrong direction in step 4: from (149, 1116) to (140, 1116).
-WARNING: Moved in the wrong direction in step 5: from (140, 1116) to (129, 1116).
-WARNING: Moved in the wrong direction in step 12: from (77, 1116) to (68, 1116).
-WARNING: Moved in the wrong direction in step 13: from (68, 1116) to (62, 1116).
+WARNING: Moved in the wrong direction in step 3: from (155, 1117) to (149, 1117).
+WARNING: Moved in the wrong direction in step 4: from (149, 1117) to (140, 1117).
+WARNING: Moved in the wrong direction in step 12: from (77, 1117) to (68, 1117).
+WARNING: Moved in the wrong direction in step 13: from (68, 1117) to (62, 1117).
   Moving left:  "def\n    "[3, 2, 1], <DIV>[2], "\n        ABCDEFabc"[18, 17, 16, 15, 10, 11, 12, 13, 14, 9]
-WARNING: Moved in the wrong direction in step 1: from (62, 1116) to (68, 1116).
-WARNING: Moved in the wrong direction in step 2: from (68, 1116) to (77, 1116).
-WARNING: Moved in the wrong direction in step 9: from (129, 1116) to (140, 1116).
-WARNING: Moved in the wrong direction in step 10: from (140, 1116) to (149, 1116).
-WARNING: Moved in the wrong direction in step 11: from (149, 1116) to (155, 1116).
+WARNING: Moved in the wrong direction in step 1: from (62, 1117) to (68, 1117).
+WARNING: Moved in the wrong direction in step 2: from (68, 1117) to (77, 1117).
+WARNING: Moved in the wrong direction in step 10: from (140, 1117) to (149, 1117).
+WARNING: Moved in the wrong direction in step 11: from (149, 1117) to (155, 1117).
 Test 26, RTL:
   Moving left: "\n        ABCDEFabc"[9, 10, 11, 12, 13, 14, 15], "def\n    "[2, 1], <DIV>[2], "\n        ABCDEFabc"[18, 17, 16], "def\n    "[3]
-WARNING: Moved in the wrong direction in step 2: from (691, 1116) to (702, 1116).
-WARNING: Moved in the wrong direction in step 3: from (702, 1116) to (711, 1116).
-WARNING: Moved in the wrong direction in step 8: from (748, 1116) to (757, 1116).
+WARNING: Moved in the wrong direction in step 2: from (691, 1116) to (702, 1117).
+WARNING: Moved in the wrong direction in step 3: from (702, 1117) to (711, 1117).
+WARNING: Moved in the wrong direction in step 8: from (748, 1117) to (757, 1117).
   Moving right:  "def\n    "[3], "\n        ABCDEFabc"[16, 17, 18], <DIV>[2], "def\n    "[1, 2], "\n        ABCDEFabc"[15, 14, 13, 12, 11, 10, 9]
-WARNING: Moved in the wrong direction in step 6: from (757, 1116) to (748, 1116).
-WARNING: Moved in the wrong direction in step 11: from (711, 1116) to (702, 1116).
-WARNING: Moved in the wrong direction in step 12: from (702, 1116) to (691, 1116).
+WARNING: Moved in the wrong direction in step 6: from (757, 1117) to (748, 1117).
+WARNING: Moved in the wrong direction in step 11: from (711, 1117) to (702, 1117).
+WARNING: Moved in the wrong direction in step 12: from (702, 1117) to (691, 1116).
 Test 27, LTR:
   Moving right: "\n        abc"[9, 10, 11, 12], <DIV>[2], "DEFghi\n    "[2, 1], <DIV>[5, 4], "ABC"[3, 2, 1], "DEFghi\n    "[3, 4, 5, 6]
-WARNING: Moved in the wrong direction in step 2: from (212, 1149) to (200, 1149).
-WARNING: Moved in the wrong direction in step 4: from (277, 1149) to (56, 1149).
-WARNING: Moved in the wrong direction in step 6: from (56, 1149) to (46, 1149).
-WARNING: Moved in the wrong direction in step 8: from (267, 1149) to (194, 1149).
-WARNING: Moved in the wrong direction in step 9: from (194, 1149) to (64, 1149).
-WARNING: Moved in the wrong direction in step 10: from (64, 1149) to (56, 1149).
-WARNING: Moved in the wrong direction in step 11: from (56, 1149) to (46, 1149).
-WARNING: Moved in the wrong direction in step 15: from (267, 1149) to (258, 1149).
+WARNING: Moved in the wrong direction in step 2: from (212, 1150) to (200, 1150).
+WARNING: Moved in the wrong direction in step 4: from (277, 1150) to (56, 1150).
+WARNING: Moved in the wrong direction in step 6: from (56, 1150) to (46, 1150).
+WARNING: Moved in the wrong direction in step 9: from (194, 1149) to (64, 1150).
+WARNING: Moved in the wrong direction in step 10: from (64, 1150) to (56, 1150).
+WARNING: Moved in the wrong direction in step 11: from (56, 1150) to (46, 1150).
+WARNING: Moved in the wrong direction in step 14: from (194, 1149) to (267, 1150).
+WARNING: Moved in the wrong direction in step 15: from (267, 1150) to (258, 1150).
   Moving left:  "DEFghi\n    "[6, 5, 4, 3], "ABC"[1, 2, 3], <DIV>[4, 5], "DEFghi\n    "[1, 2], <DIV>[2], "\n        abc"[12, 11, 10, 9]
-WARNING: Moved in the wrong direction in step 1: from (258, 1149) to (267, 1149).
-WARNING: Moved in the wrong direction in step 5: from (46, 1149) to (56, 1149).
-WARNING: Moved in the wrong direction in step 6: from (56, 1149) to (64, 1149).
-WARNING: Moved in the wrong direction in step 7: from (64, 1149) to (194, 1149).
-WARNING: Moved in the wrong direction in step 8: from (194, 1149) to (267, 1149).
-WARNING: Moved in the wrong direction in step 10: from (46, 1149) to (56, 1149).
-WARNING: Moved in the wrong direction in step 12: from (56, 1149) to (277, 1149).
-WARNING: Moved in the wrong direction in step 14: from (200, 1149) to (212, 1149).
+WARNING: Moved in the wrong direction in step 1: from (258, 1150) to (267, 1150).
+WARNING: Moved in the wrong direction in step 2: from (267, 1150) to (194, 1149).
+WARNING: Moved in the wrong direction in step 5: from (46, 1150) to (56, 1150).
+WARNING: Moved in the wrong direction in step 6: from (56, 1150) to (64, 1150).
+WARNING: Moved in the wrong direction in step 7: from (64, 1150) to (194, 1149).
+WARNING: Moved in the wrong direction in step 10: from (46, 1150) to (56, 1150).
+WARNING: Moved in the wrong direction in step 12: from (56, 1150) to (277, 1150).
+WARNING: Moved in the wrong direction in step 14: from (200, 1150) to (212, 1150).
 Test 27, RTL:
   Moving left: "\n        abc"[9, 11, 10, 12], <DIV>[2], "ABC"[1, 2, 3], <DIV>[4, 5], "DEFghi\n    "[1, 2, 3, 5, 4, 6]
-WARNING: Moved in the wrong direction in step 2: from (532, 1149) to (544, 1149).
-WARNING: Moved in the wrong direction in step 4: from (527, 1149) to (759, 1149).
-WARNING: Moved in the wrong direction in step 6: from (749, 1149) to (759, 1149).
-WARNING: Moved in the wrong direction in step 10: from (599, 1149) to (749, 1149).
-WARNING: Moved in the wrong direction in step 11: from (749, 1149) to (759, 1149).
-WARNING: Moved in the wrong direction in step 14: from (599, 1149) to (609, 1149).
+WARNING: Moved in the wrong direction in step 2: from (532, 1150) to (544, 1150).
+WARNING: Moved in the wrong direction in step 4: from (527, 1150) to (759, 1150).
+WARNING: Moved in the wrong direction in step 6: from (749, 1150) to (759, 1150).
+WARNING: Moved in the wrong direction in step 9: from (609, 1149) to (599, 1150).
+WARNING: Moved in the wrong direction in step 10: from (599, 1150) to (749, 1150).
+WARNING: Moved in the wrong direction in step 11: from (749, 1150) to (759, 1150).
+WARNING: Moved in the wrong direction in step 15: from (609, 1149) to (590, 1150).
   Moving right:  "DEFghi\n    "[6, 4, 5, 3, 2, 1], <DIV>[5, 4], "ABC"[3, 2, 1], <DIV>[2], "\n        abc"[12, 10, 11, 9]
-WARNING: Moved in the wrong direction in step 2: from (609, 1149) to (599, 1149).
-WARNING: Moved in the wrong direction in step 5: from (759, 1149) to (749, 1149).
-WARNING: Moved in the wrong direction in step 6: from (749, 1149) to (599, 1149).
-WARNING: Moved in the wrong direction in step 10: from (759, 1149) to (749, 1149).
-WARNING: Moved in the wrong direction in step 12: from (759, 1149) to (527, 1149).
-WARNING: Moved in the wrong direction in step 14: from (544, 1149) to (532, 1149).
+WARNING: Moved in the wrong direction in step 1: from (590, 1150) to (609, 1149).
+WARNING: Moved in the wrong direction in step 5: from (759, 1150) to (749, 1150).
+WARNING: Moved in the wrong direction in step 6: from (749, 1150) to (599, 1150).
+WARNING: Moved in the wrong direction in step 7: from (599, 1150) to (609, 1149).
+WARNING: Moved in the wrong direction in step 10: from (759, 1150) to (749, 1150).
+WARNING: Moved in the wrong direction in step 12: from (759, 1150) to (527, 1150).
+WARNING: Moved in the wrong direction in step 14: from (544, 1150) to (532, 1150).
 Test 28, LTR:
   Moving right: "\n        ABC"[9, 11, 10, 12], <DIV>[2], "abc"[1, 2, 3], <DIV>[4, 5], "defDEF\n    "[1, 2, 3, 5, 4, 6]
-WARNING: Moved in the wrong direction in step 2: from (272, 1184) to (263, 1184).
-WARNING: Moved in the wrong direction in step 4: from (278, 1184) to (44, 1184).
-WARNING: Moved in the wrong direction in step 6: from (53, 1184) to (44, 1184).
-WARNING: Moved in the wrong direction in step 10: from (203, 1184) to (53, 1184).
-WARNING: Moved in the wrong direction in step 11: from (53, 1184) to (44, 1184).
-WARNING: Moved in the wrong direction in step 14: from (203, 1184) to (193, 1184).
+WARNING: Moved in the wrong direction in step 2: from (272, 1185) to (263, 1185).
+WARNING: Moved in the wrong direction in step 4: from (278, 1185) to (44, 1185).
+WARNING: Moved in the wrong direction in step 6: from (53, 1185) to (44, 1185).
+WARNING: Moved in the wrong direction in step 9: from (193, 1184) to (203, 1185).
+WARNING: Moved in the wrong direction in step 10: from (203, 1185) to (53, 1185).
+WARNING: Moved in the wrong direction in step 11: from (53, 1185) to (44, 1185).
+WARNING: Moved in the wrong direction in step 15: from (193, 1184) to (213, 1185).
   Moving left:  "defDEF\n    "[6, 4, 5, 3, 2, 1], <DIV>[5, 4], "abc"[3, 2, 1], <DIV>[2], "\n        ABC"[12, 10, 11, 9]
-WARNING: Moved in the wrong direction in step 2: from (193, 1184) to (203, 1184).
-WARNING: Moved in the wrong direction in step 5: from (44, 1184) to (53, 1184).
-WARNING: Moved in the wrong direction in step 6: from (53, 1184) to (203, 1184).
-WARNING: Moved in the wrong direction in step 10: from (44, 1184) to (53, 1184).
-WARNING: Moved in the wrong direction in step 12: from (44, 1184) to (278, 1184).
-WARNING: Moved in the wrong direction in step 14: from (263, 1184) to (272, 1184).
+WARNING: Moved in the wrong direction in step 1: from (213, 1185) to (193, 1184).
+WARNING: Moved in the wrong direction in step 5: from (44, 1185) to (53, 1185).
+WARNING: Moved in the wrong direction in step 6: from (53, 1185) to (203, 1185).
+WARNING: Moved in the wrong direction in step 7: from (203, 1185) to (193, 1184).
+WARNING: Moved in the wrong direction in step 10: from (44, 1185) to (53, 1185).
+WARNING: Moved in the wrong direction in step 12: from (44, 1185) to (278, 1185).
+WARNING: Moved in the wrong direction in step 14: from (263, 1185) to (272, 1185).
 Test 28, RTL:
   Moving left: "\n        ABC"[9, 10, 11, 12], <DIV>[2], "defDEF\n    "[2, 1], <DIV>[5, 4], "abc"[3, 2, 1], "defDEF\n    "[3, 4, 5, 6]
-WARNING: Moved in the wrong direction in step 2: from (595, 1184) to (604, 1184).
-WARNING: Moved in the wrong direction in step 4: from (526, 1184) to (748, 1184).
-WARNING: Moved in the wrong direction in step 6: from (748, 1184) to (757, 1184).
-WARNING: Moved in the wrong direction in step 8: from (535, 1184) to (610, 1184).
-WARNING: Moved in the wrong direction in step 9: from (610, 1184) to (741, 1184).
-WARNING: Moved in the wrong direction in step 10: from (741, 1184) to (748, 1184).
-WARNING: Moved in the wrong direction in step 11: from (748, 1184) to (757, 1184).
-WARNING: Moved in the wrong direction in step 15: from (535, 1184) to (545, 1184).
+WARNING: Moved in the wrong direction in step 2: from (595, 1185) to (604, 1185).
+WARNING: Moved in the wrong direction in step 4: from (527, 1185) to (748, 1185).
+WARNING: Moved in the wrong direction in step 6: from (748, 1185) to (757, 1185).
+WARNING: Moved in the wrong direction in step 9: from (610, 1184) to (741, 1185).
+WARNING: Moved in the wrong direction in step 10: from (741, 1185) to (748, 1185).
+WARNING: Moved in the wrong direction in step 11: from (748, 1185) to (757, 1185).
+WARNING: Moved in the wrong direction in step 14: from (610, 1184) to (535, 1185).
+WARNING: Moved in the wrong direction in step 15: from (535, 1185) to (545, 1185).
   Moving right:  "defDEF\n    "[6, 5, 4, 3], "abc"[1, 2, 3], <DIV>[4, 5], "defDEF\n    "[1, 2], <DIV>[2], "\n        ABC"[12, 11, 10, 9]
-WARNING: Moved in the wrong direction in step 1: from (545, 1184) to (535, 1184).
-WARNING: Moved in the wrong direction in step 5: from (757, 1184) to (748, 1184).
-WARNING: Moved in the wrong direction in step 6: from (748, 1184) to (741, 1184).
-WARNING: Moved in the wrong direction in step 7: from (741, 1184) to (610, 1184).
-WARNING: Moved in the wrong direction in step 8: from (610, 1184) to (535, 1184).
-WARNING: Moved in the wrong direction in step 10: from (757, 1184) to (748, 1184).
-WARNING: Moved in the wrong direction in step 12: from (748, 1184) to (526, 1184).
-WARNING: Moved in the wrong direction in step 14: from (604, 1184) to (595, 1184).
+WARNING: Moved in the wrong direction in step 1: from (545, 1185) to (535, 1185).
+WARNING: Moved in the wrong direction in step 2: from (535, 1185) to (610, 1184).
+WARNING: Moved in the wrong direction in step 5: from (757, 1185) to (748, 1185).
+WARNING: Moved in the wrong direction in step 6: from (748, 1185) to (741, 1185).
+WARNING: Moved in the wrong direction in step 7: from (741, 1185) to (610, 1184).
+WARNING: Moved in the wrong direction in step 10: from (757, 1185) to (748, 1185).
+WARNING: Moved in the wrong direction in step 12: from (748, 1185) to (527, 1185).
+WARNING: Moved in the wrong direction in step 14: from (604, 1185) to (595, 1185).
 Test 29, LTR:
   Moving right: "\n        abcABC"[9, 10, 11, 12], "DEF"[2, 1], "\n        abcABC"[15, 14, 13], "DEF"[3]
 WARNING: Moved in the wrong direction in step 5: from (56, 1219) to (46, 1219).

diff --git a/third_party/WebKit/LayoutTests/platform/mac/editing/selection/select-box-expected.png b/third_party/WebKit/LayoutTests/platform/mac/editing/selection/select-box-expected.png
index a187e7b..f5a8dd8a 100644
--- a/third_party/WebKit/LayoutTests/platform/mac/editing/selection/select-box-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/mac/editing/selection/select-box-expected.png
Binary files differ

diff --git a/third_party/WebKit/LayoutTests/platform/win/editing/caret/caret-color-014-expected.png b/third_party/WebKit/LayoutTests/platform/win/editing/caret/caret-color-014-expected.png
index 213f512..bc8de01a 100644
--- a/third_party/WebKit/LayoutTests/platform/win/editing/caret/caret-color-014-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/win/editing/caret/caret-color-014-expected.png
Binary files differ

diff --git a/third_party/WebKit/LayoutTests/platform/win/editing/caret/caret-color-015-expected.png b/third_party/WebKit/LayoutTests/platform/win/editing/caret/caret-color-015-expected.png
index a94fe3b0..e23e11c 100644
--- a/third_party/WebKit/LayoutTests/platform/win/editing/caret/caret-color-015-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/win/editing/caret/caret-color-015-expected.png
Binary files differ

diff --git a/third_party/WebKit/LayoutTests/platform/win/editing/input/reveal-caret-of-multiline-contenteditable-expected.png b/third_party/WebKit/LayoutTests/platform/win/editing/input/reveal-caret-of-multiline-contenteditable-expected.png
index d97b646..bd4f1fd 100644
--- a/third_party/WebKit/LayoutTests/platform/win/editing/input/reveal-caret-of-multiline-contenteditable-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/win/editing/input/reveal-caret-of-multiline-contenteditable-expected.png
Binary files differ

diff --git a/third_party/WebKit/LayoutTests/platform/win/editing/inserting/4960120-2-expected.png b/third_party/WebKit/LayoutTests/platform/win/editing/inserting/4960120-2-expected.png
index 1d9fed6..fbafebd 100644
--- a/third_party/WebKit/LayoutTests/platform/win/editing/inserting/4960120-2-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/win/editing/inserting/4960120-2-expected.png
Binary files differ

diff --git a/third_party/WebKit/LayoutTests/platform/win/editing/inserting/5058163-1-expected.png b/third_party/WebKit/LayoutTests/platform/win/editing/inserting/5058163-1-expected.png
index bc44bf92..5ff12b4a 100644
--- a/third_party/WebKit/LayoutTests/platform/win/editing/inserting/5058163-1-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/win/editing/inserting/5058163-1-expected.png
Binary files differ

diff --git a/third_party/WebKit/LayoutTests/platform/win/editing/inserting/5549929-2-expected.png b/third_party/WebKit/LayoutTests/platform/win/editing/inserting/5549929-2-expected.png
index bb96366..bf5b626 100644
--- a/third_party/WebKit/LayoutTests/platform/win/editing/inserting/5549929-2-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/win/editing/inserting/5549929-2-expected.png
Binary files differ

diff --git a/third_party/WebKit/LayoutTests/platform/win/editing/inserting/5549929-3-expected.png b/third_party/WebKit/LayoutTests/platform/win/editing/inserting/5549929-3-expected.png
index 6ab82ef..3a5a68c3 100644
--- a/third_party/WebKit/LayoutTests/platform/win/editing/inserting/5549929-3-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/win/editing/inserting/5549929-3-expected.png
Binary files differ

diff --git a/third_party/WebKit/LayoutTests/platform/win/editing/inserting/editable-inline-element-expected.png b/third_party/WebKit/LayoutTests/platform/win/editing/inserting/editable-inline-element-expected.png
index 4a50098..f4d5986 100644
--- a/third_party/WebKit/LayoutTests/platform/win/editing/inserting/editable-inline-element-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/win/editing/inserting/editable-inline-element-expected.png
Binary files differ

diff --git a/third_party/WebKit/LayoutTests/platform/win/editing/inserting/insert-3800346-fix-expected.png b/third_party/WebKit/LayoutTests/platform/win/editing/inserting/insert-3800346-fix-expected.png
index a72a1cc..54e2505e8 100644
--- a/third_party/WebKit/LayoutTests/platform/win/editing/inserting/insert-3800346-fix-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/win/editing/inserting/insert-3800346-fix-expected.png
Binary files differ

diff --git a/third_party/WebKit/LayoutTests/platform/win/editing/inserting/line-break-expected.png b/third_party/WebKit/LayoutTests/platform/win/editing/inserting/line-break-expected.png
index 96ac3f8..8c133fd 100644
--- a/third_party/WebKit/LayoutTests/platform/win/editing/inserting/line-break-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/win/editing/inserting/line-break-expected.png
Binary files differ

diff --git a/third_party/WebKit/LayoutTests/platform/win/editing/inserting/paragraph-separator-in-table-1-expected.png b/third_party/WebKit/LayoutTests/platform/win/editing/inserting/paragraph-separator-in-table-1-expected.png
index a6869400..ca71c85 100644
--- a/third_party/WebKit/LayoutTests/platform/win/editing/inserting/paragraph-separator-in-table-1-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/win/editing/inserting/paragraph-separator-in-table-1-expected.png
Binary files differ

diff --git a/third_party/WebKit/LayoutTests/platform/win/editing/inserting/paragraph-separator-in-table-2-expected.png b/third_party/WebKit/LayoutTests/platform/win/editing/inserting/paragraph-separator-in-table-2-expected.png
index c58da94..a6e0de1e 100644
--- a/third_party/WebKit/LayoutTests/platform/win/editing/inserting/paragraph-separator-in-table-2-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/win/editing/inserting/paragraph-separator-in-table-2-expected.png
Binary files differ

diff --git a/third_party/WebKit/LayoutTests/platform/win/editing/pasteboard/5601583-1-expected.png b/third_party/WebKit/LayoutTests/platform/win/editing/pasteboard/5601583-1-expected.png
index 852e31c..0e62b07 100644
--- a/third_party/WebKit/LayoutTests/platform/win/editing/pasteboard/5601583-1-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/win/editing/pasteboard/5601583-1-expected.png
Binary files differ

diff --git a/third_party/WebKit/LayoutTests/platform/win/editing/pasteboard/paste-line-endings-001-expected.png b/third_party/WebKit/LayoutTests/platform/win/editing/pasteboard/paste-line-endings-001-expected.png
index 57dd77a3..08b267d3f 100644
--- a/third_party/WebKit/LayoutTests/platform/win/editing/pasteboard/paste-line-endings-001-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/win/editing/pasteboard/paste-line-endings-001-expected.png
Binary files differ

diff --git a/third_party/WebKit/LayoutTests/platform/win/editing/selection/4947387-expected.png b/third_party/WebKit/LayoutTests/platform/win/editing/selection/4947387-expected.png
deleted file mode 100644
index 1423e444..0000000
--- a/third_party/WebKit/LayoutTests/platform/win/editing/selection/4947387-expected.png
+++ /dev/null
Binary files differ

diff --git a/third_party/WebKit/LayoutTests/platform/win/editing/selection/4947387-expected.txt b/third_party/WebKit/LayoutTests/platform/win/editing/selection/4947387-expected.txt
deleted file mode 100644
index 343a4a8..0000000
--- a/third_party/WebKit/LayoutTests/platform/win/editing/selection/4947387-expected.txt
+++ /dev/null

@@ -1,29 +0,0 @@
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-layer at (0,0) size 800x600
-  LayoutView at (0,0) size 800x600
-layer at (0,0) size 800x600
-  LayoutBlockFlow {HTML} at (0,0) size 800x600
-    LayoutBlockFlow {BODY} at (8,8) size 784x584
-      LayoutBlockFlow {P} at (0,0) size 784x72
-        LayoutText {#text} at (0,0) size 776x71
-          text run at (0,0) width 423: "This tests moveTo{Beginning, End}OfLineAndModifySelection. "
-          text run at (422,0) width 350: "It should operate on line boundaries and not paragraph"
-          text run at (0,18) width 79: "boundaries. "
-          text run at (78,18) width 698: "To run it manually, click inside the first line of the editable region below and do Command+Shift+Left/Right"
-          text run at (0,36) width 619: "Arrow, the selection should extend to the start/end of the line, not the start/end of the paragraph. "
-          text run at (618,36) width 35: "Also,"
-          text run at (0,54) width 473: "moveTo{Beginning, End}OfParagraphAndModifySelection should work."
-      LayoutBlockFlow {DIV} at (0,88) size 200x36
-        LayoutText {#text} at (0,0) size 191x35
-          text run at (0,0) width 187: "The quick brown fox jumped"
-          text run at (186,0) width 5: " "
-          text run at (0,18) width 160: "over the lazy brown dog."
-selection start: position 0 of child 0 {#text} of child 2 {DIV} of body
-selection end:   position 51 of child 0 {#text} of child 2 {DIV} of body

diff --git a/third_party/WebKit/LayoutTests/platform/win/editing/selection/after-line-wrap-expected.png b/third_party/WebKit/LayoutTests/platform/win/editing/selection/after-line-wrap-expected.png
deleted file mode 100644
index 39a5492f..0000000
--- a/third_party/WebKit/LayoutTests/platform/win/editing/selection/after-line-wrap-expected.png
+++ /dev/null
Binary files differ

diff --git a/third_party/WebKit/LayoutTests/platform/win/editing/selection/after-line-wrap-expected.txt b/third_party/WebKit/LayoutTests/platform/win/editing/selection/after-line-wrap-expected.txt
deleted file mode 100644
index e8b46b04..0000000
--- a/third_party/WebKit/LayoutTests/platform/win/editing/selection/after-line-wrap-expected.txt
+++ /dev/null

@@ -1,42 +0,0 @@
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-layer at (0,0) size 800x600
-  LayoutView at (0,0) size 800x600
-layer at (0,0) size 800x600
-  LayoutBlockFlow {HTML} at (0,0) size 800x600
-    LayoutBlockFlow {BODY} at (8,8) size 784x576
-      LayoutBlockFlow {P} at (0,0) size 784x36
-        LayoutInline {B} at (0,0) size 306x17
-          LayoutText {#text} at (0,0) size 306x17
-            text run at (0,0) width 306: "Make sure that your window is small enough"
-        LayoutText {#text} at (305,0) size 778x35
-          text run at (305,0) width 473: " so that 'don't select this line' and 'try to select just this line' appear on two"
-          text run at (0,18) width 97: "different lines. "
-          text run at (97,18) width 623: "The two phrases are actually in the same paragraph, there are just lots of spaces in between them."
-      LayoutBlockFlow {P} at (0,52) size 784x36
-        LayoutText {#text} at (0,0) size 108x17
-          text run at (0,0) width 108: "This is a test for "
-        LayoutInline {A} at (0,0) size 373x17 [color=#0000EE]
-          LayoutText {#text} at (107,0) size 373x17
-            text run at (107,0) width 373: "REGRESSION: Selection includes spaces that it shouldn't"
-        LayoutText {#text} at (479,0) size 768x35
-          text run at (479,0) width 289: ". The test makes sure that a word that is right"
-          text run at (0,18) width 291: "after a line wrap can be selected successfully."
-      LayoutBlockFlow {P} at (0,104) size 784x0
-      LayoutBlockFlow {DIV} at (16,104) size 752x74 [border: (1px solid #000000)]
-        LayoutText {#text} at (1,1) size 748x53
-          text run at (1,1) width 96: "don't select me"
-          text run at (96,1) width 5: " "
-          text run at (1,19) width 748: "                                                                                                                                                                                           "
-          text run at (1,37) width 644: "                                                                                                                                                                 "
-        LayoutInline {I} at (0,0) size 750x35
-          LayoutText {#text} at (645,37) size 750x35
-            text run at (645,37) width 102: "try to select just"
-            text run at (746,37) width 5: " "
-            text run at (1,55) width 51: "this text"
-        LayoutText {#text} at (0,0) size 0x0
-selection start: position 17 of child 0 {#text} of child 7 {DIV} of body
-selection end:   position 20 of child 0 {#text} of child 7 {DIV} of body

diff --git a/third_party/WebKit/LayoutTests/platform/win/editing/selection/click-start-of-line-expected.png b/third_party/WebKit/LayoutTests/platform/win/editing/selection/click-start-of-line-expected.png
index 6c45e3c3..cbb987d 100644
--- a/third_party/WebKit/LayoutTests/platform/win/editing/selection/click-start-of-line-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/win/editing/selection/click-start-of-line-expected.png
Binary files differ

diff --git a/third_party/WebKit/LayoutTests/platform/win/editing/selection/move-3875618-fix-expected.png b/third_party/WebKit/LayoutTests/platform/win/editing/selection/move-3875618-fix-expected.png
index 7d6e71a..a878251 100644
--- a/third_party/WebKit/LayoutTests/platform/win/editing/selection/move-3875618-fix-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/win/editing/selection/move-3875618-fix-expected.png
Binary files differ

diff --git a/third_party/WebKit/LayoutTests/platform/win/editing/selection/move-backwords-by-word-001-expected.png b/third_party/WebKit/LayoutTests/platform/win/editing/selection/move-backwords-by-word-001-expected.png
index acdb7c1..0b9e17d 100644
--- a/third_party/WebKit/LayoutTests/platform/win/editing/selection/move-backwords-by-word-001-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/win/editing/selection/move-backwords-by-word-001-expected.png
Binary files differ

diff --git a/third_party/WebKit/LayoutTests/platform/win/editing/selection/move-left-right-expected.txt b/third_party/WebKit/LayoutTests/platform/win/editing/selection/move-left-right-expected.txt
index a0d68030..b09ebdf 100644
--- a/third_party/WebKit/LayoutTests/platform/win/editing/selection/move-left-right-expected.txt
+++ b/third_party/WebKit/LayoutTests/platform/win/editing/selection/move-left-right-expected.txt

@@ -12,28 +12,28 @@
   Moving right:  "\n        ABC\n    "[12, 11, 10, 9]
 Test 3, LTR:
   Moving right: <DIV>[0], "abc\n    "[0, 1, 2, 3]
-WARNING: Moved in the wrong direction in step 1: from (37, 77) to (37, 94).
+WARNING: Moved in the wrong direction in step 1: from (37, 77) to (37, 95).
   Moving left:  "abc\n    "[3, 2, 1, 0], <DIV>[0]
-WARNING: Moved in the wrong direction in step 4: from (37, 94) to (37, 77).
+WARNING: Moved in the wrong direction in step 4: from (37, 95) to (37, 77).
 Test 3, RTL:
   Moving left: <DIV>[0], "abc\n    "[0, 2, 1, 3]
-WARNING: Moved in the wrong direction in step 1: from (767, 77) to (767, 94).
-WARNING: Moved in the wrong direction in step 3: from (752, 94) to (767, 94).
+WARNING: Moved in the wrong direction in step 1: from (767, 77) to (767, 95).
+WARNING: Moved in the wrong direction in step 3: from (752, 95) to (767, 95).
   Moving right:  "abc\n    "[3, 1, 2, 0], <DIV>[0]
-WARNING: Moved in the wrong direction in step 2: from (767, 94) to (752, 94).
-WARNING: Moved in the wrong direction in step 4: from (767, 94) to (767, 77).
+WARNING: Moved in the wrong direction in step 2: from (767, 95) to (752, 95).
+WARNING: Moved in the wrong direction in step 4: from (767, 95) to (767, 77).
 Test 4, LTR:
   Moving right: <DIV>[0], "ABC\n    "[0, 2, 1, 3]
-WARNING: Moved in the wrong direction in step 1: from (37, 127) to (37, 144).
-WARNING: Moved in the wrong direction in step 3: from (50, 144) to (37, 144).
+WARNING: Moved in the wrong direction in step 1: from (37, 127) to (37, 145).
+WARNING: Moved in the wrong direction in step 3: from (50, 145) to (37, 145).
   Moving left:  "ABC\n    "[3, 1, 2, 0], <DIV>[0]
-WARNING: Moved in the wrong direction in step 2: from (37, 144) to (50, 144).
-WARNING: Moved in the wrong direction in step 4: from (37, 144) to (37, 127).
+WARNING: Moved in the wrong direction in step 2: from (37, 145) to (50, 145).
+WARNING: Moved in the wrong direction in step 4: from (37, 145) to (37, 127).
 Test 4, RTL:
   Moving left: <DIV>[0], "ABC\n    "[0, 1, 2, 3]
-WARNING: Moved in the wrong direction in step 1: from (767, 127) to (767, 144).
+WARNING: Moved in the wrong direction in step 1: from (767, 127) to (767, 145).
   Moving right:  "ABC\n    "[3, 2, 1, 0], <DIV>[0]
-WARNING: Moved in the wrong direction in step 4: from (767, 144) to (767, 127).
+WARNING: Moved in the wrong direction in step 4: from (767, 145) to (767, 127).
 Test 5, LTR:
   Moving right: "\n        abcABCdef\n    "[9, 10, 11, 12, 14, 13, 15, 16, 17, 18]
   Moving left:  "\n        abcABCdef\n    "[18, 17, 16, 15, 13, 14, 12, 11, 10, 9]
@@ -133,121 +133,121 @@
   Moving right:  "ABC123DEFabcGHI456JLM\n    "[21, 20, 19, 18, 16, 17, 15, 14, 13, 12, 10, 11, 9, 8, 7, 6, 4, 5, 3, 2, 1, 0]
 Test 17, LTR:
   Moving right: "\n        before    AHYJ AQWJXMFUDJE\n    "[9, 10, 11, 12, 13, 14, 15, 16, 22, 21, 20, 23, 24, 34, 33, 32, 31, 30, 29, 28, 27, 26, 25, 35]
-WARNING: Moved in the wrong direction in step 3: from (108, 561) to (37, 578).
-WARNING: Moved in the wrong direction in step 5: from (98, 578) to (93, 578).
-WARNING: Moved in the wrong direction in step 6: from (93, 578) to (86, 578).
-WARNING: Moved in the wrong direction in step 7: from (86, 578) to (82, 578).
-WARNING: Moved in the wrong direction in step 8: from (82, 578) to (45, 578).
+WARNING: Moved in the wrong direction in step 3: from (108, 561) to (37, 579).
+WARNING: Moved in the wrong direction in step 5: from (98, 579) to (93, 579).
+WARNING: Moved in the wrong direction in step 6: from (93, 579) to (86, 579).
+WARNING: Moved in the wrong direction in step 7: from (86, 579) to (82, 579).
+WARNING: Moved in the wrong direction in step 8: from (82, 579) to (45, 579).
   Moving left:  "\n        before    AHYJ AQWJXMFUDJE\n    "[35, 25, 26, 27, 28, 29, 30, 31, 32, 33, 34, 24, 23, 20, 21, 22, 16, 15, 14, 13, 12, 11, 10, 9]
-WARNING: Moved in the wrong direction in step 16: from (45, 578) to (82, 578).
-WARNING: Moved in the wrong direction in step 17: from (82, 578) to (86, 578).
-WARNING: Moved in the wrong direction in step 18: from (86, 578) to (93, 578).
-WARNING: Moved in the wrong direction in step 19: from (93, 578) to (98, 578).
-WARNING: Moved in the wrong direction in step 21: from (37, 578) to (108, 561).
+WARNING: Moved in the wrong direction in step 16: from (45, 579) to (82, 579).
+WARNING: Moved in the wrong direction in step 17: from (82, 579) to (86, 579).
+WARNING: Moved in the wrong direction in step 18: from (86, 579) to (93, 579).
+WARNING: Moved in the wrong direction in step 19: from (93, 579) to (98, 579).
+WARNING: Moved in the wrong direction in step 21: from (37, 579) to (108, 561).
 Test 17, RTL:
   Moving left: "\n        before    AHYJ AQWJXMFUDJE\n    "[9, 14, 13, 12, 11, 10, 15, 16, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35]
-WARNING: Moved in the wrong direction in step 1: from (156, 561) to (144, 578).
-WARNING: Moved in the wrong direction in step 2: from (144, 578) to (149, 578).
-WARNING: Moved in the wrong direction in step 3: from (149, 578) to (156, 578).
+WARNING: Moved in the wrong direction in step 1: from (156, 561) to (144, 579).
+WARNING: Moved in the wrong direction in step 2: from (144, 579) to (149, 579).
+WARNING: Moved in the wrong direction in step 3: from (149, 579) to (156, 579).
 WARNING: Moved in the wrong direction in step 5: from (85, 561) to (89, 561).
-WARNING: Moved in the wrong direction in step 6: from (89, 561) to (137, 578).
+WARNING: Moved in the wrong direction in step 6: from (89, 561) to (137, 579).
   Moving right:  "\n        before    AHYJ AQWJXMFUDJE\n    "[35, 34, 33, 32, 31, 30, 29, 28, 27, 26, 25, 24, 23, 22, 21, 20, 16, 15, 10, 11, 12, 13, 14, 9]
-WARNING: Moved in the wrong direction in step 18: from (137, 578) to (89, 561).
+WARNING: Moved in the wrong direction in step 18: from (137, 579) to (89, 561).
 WARNING: Moved in the wrong direction in step 19: from (89, 561) to (85, 561).
-WARNING: Moved in the wrong direction in step 21: from (156, 578) to (149, 578).
-WARNING: Moved in the wrong direction in step 22: from (149, 578) to (144, 578).
-WARNING: Moved in the wrong direction in step 23: from (144, 578) to (156, 561).
+WARNING: Moved in the wrong direction in step 21: from (156, 579) to (149, 579).
+WARNING: Moved in the wrong direction in step 22: from (149, 579) to (144, 579).
+WARNING: Moved in the wrong direction in step 23: from (144, 579) to (156, 561).
 Test 18, LTR:
   Moving right: "\n        MUQJ    after encyclopedia\n    "[9, 12, 11, 10, 13, 14, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35]
-WARNING: Moved in the wrong direction in step 1: from (37, 611) to (44, 628).
-WARNING: Moved in the wrong direction in step 2: from (44, 628) to (37, 628).
-WARNING: Moved in the wrong direction in step 4: from (93, 611) to (52, 628).
+WARNING: Moved in the wrong direction in step 1: from (37, 611) to (44, 629).
+WARNING: Moved in the wrong direction in step 2: from (44, 629) to (37, 629).
+WARNING: Moved in the wrong direction in step 4: from (93, 611) to (52, 629).
   Moving left:  "\n        MUQJ    after encyclopedia\n    "[35, 34, 33, 32, 31, 30, 29, 28, 27, 26, 25, 24, 23, 22, 21, 20, 19, 18, 14, 13, 10, 11, 12, 9]
-WARNING: Moved in the wrong direction in step 20: from (52, 628) to (93, 611).
-WARNING: Moved in the wrong direction in step 22: from (37, 628) to (44, 628).
-WARNING: Moved in the wrong direction in step 23: from (44, 628) to (37, 611).
+WARNING: Moved in the wrong direction in step 20: from (52, 629) to (93, 611).
+WARNING: Moved in the wrong direction in step 22: from (37, 629) to (44, 629).
+WARNING: Moved in the wrong direction in step 23: from (44, 629) to (37, 611).
 Test 18, RTL:
   Moving left: "\n        MUQJ    after encyclopedia\n    "[9, 10, 11, 12, 13, 14, 21, 20, 19, 18, 22, 23, 34, 33, 32, 31, 30, 29, 28, 27, 26, 25, 24, 35]
-WARNING: Moved in the wrong direction in step 2: from (100, 611) to (156, 628).
-WARNING: Moved in the wrong direction in step 4: from (79, 628) to (87, 628).
-WARNING: Moved in the wrong direction in step 5: from (87, 628) to (94, 628).
-WARNING: Moved in the wrong direction in step 6: from (94, 628) to (145, 628).
-WARNING: Moved in the wrong direction in step 10: from (122, 628) to (149, 628).
+WARNING: Moved in the wrong direction in step 2: from (100, 611) to (156, 629).
+WARNING: Moved in the wrong direction in step 4: from (79, 629) to (87, 629).
+WARNING: Moved in the wrong direction in step 5: from (87, 629) to (94, 629).
+WARNING: Moved in the wrong direction in step 6: from (94, 629) to (145, 629).
+WARNING: Moved in the wrong direction in step 10: from (122, 629) to (149, 629).
   Moving right:  "\n        MUQJ    after encyclopedia\n    "[35, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33, 34, 23, 22, 18, 19, 20, 21, 14, 13, 12, 11, 10, 9]
-WARNING: Moved in the wrong direction in step 14: from (149, 628) to (122, 628).
-WARNING: Moved in the wrong direction in step 18: from (145, 628) to (94, 628).
-WARNING: Moved in the wrong direction in step 19: from (94, 628) to (87, 628).
-WARNING: Moved in the wrong direction in step 20: from (87, 628) to (79, 628).
-WARNING: Moved in the wrong direction in step 22: from (156, 628) to (100, 611).
+WARNING: Moved in the wrong direction in step 14: from (149, 629) to (122, 629).
+WARNING: Moved in the wrong direction in step 18: from (145, 629) to (94, 629).
+WARNING: Moved in the wrong direction in step 19: from (94, 629) to (87, 629).
+WARNING: Moved in the wrong direction in step 20: from (87, 629) to (79, 629).
+WARNING: Moved in the wrong direction in step 22: from (156, 629) to (100, 611).
 Test 19, LTR:
   Moving right: "\n        before    AHYJ AQWJXMFUDJE\n    "[9, 10, 11, 12, 13, 14, 15, 16, 22, 21, 20, 23, 24, 34, 33, 32, 31, 30, 29, 28, 27, 26, 25, 35]
-WARNING: Moved in the wrong direction in step 3: from (108, 661) to (37, 678).
-WARNING: Moved in the wrong direction in step 5: from (98, 678) to (93, 678).
-WARNING: Moved in the wrong direction in step 6: from (93, 678) to (86, 678).
-WARNING: Moved in the wrong direction in step 7: from (86, 678) to (82, 678).
-WARNING: Moved in the wrong direction in step 8: from (82, 678) to (45, 678).
+WARNING: Moved in the wrong direction in step 3: from (108, 661) to (37, 679).
+WARNING: Moved in the wrong direction in step 5: from (98, 679) to (93, 679).
+WARNING: Moved in the wrong direction in step 6: from (93, 679) to (86, 679).
+WARNING: Moved in the wrong direction in step 7: from (86, 679) to (82, 679).
+WARNING: Moved in the wrong direction in step 8: from (82, 679) to (45, 679).
   Moving left:  "\n        before    AHYJ AQWJXMFUDJE\n    "[35, 25, 26, 27, 28, 29, 30, 31, 32, 33, 34, 24, 23, 20, 21, 22, 16, 15, 14, 13, 12, 11, 10, 9]
-WARNING: Moved in the wrong direction in step 16: from (45, 678) to (82, 678).
-WARNING: Moved in the wrong direction in step 17: from (82, 678) to (86, 678).
-WARNING: Moved in the wrong direction in step 18: from (86, 678) to (93, 678).
-WARNING: Moved in the wrong direction in step 19: from (93, 678) to (98, 678).
-WARNING: Moved in the wrong direction in step 21: from (37, 678) to (108, 661).
+WARNING: Moved in the wrong direction in step 16: from (45, 679) to (82, 679).
+WARNING: Moved in the wrong direction in step 17: from (82, 679) to (86, 679).
+WARNING: Moved in the wrong direction in step 18: from (86, 679) to (93, 679).
+WARNING: Moved in the wrong direction in step 19: from (93, 679) to (98, 679).
+WARNING: Moved in the wrong direction in step 21: from (37, 679) to (108, 661).
 Test 19, RTL:
   Moving left: "\n        before    AHYJ AQWJXMFUDJE\n    "[9, 14, 13, 12, 11, 10, 15, 16, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35]
-WARNING: Moved in the wrong direction in step 1: from (156, 661) to (144, 678).
-WARNING: Moved in the wrong direction in step 2: from (144, 678) to (149, 678).
-WARNING: Moved in the wrong direction in step 3: from (149, 678) to (156, 678).
+WARNING: Moved in the wrong direction in step 1: from (156, 661) to (144, 679).
+WARNING: Moved in the wrong direction in step 2: from (144, 679) to (149, 679).
+WARNING: Moved in the wrong direction in step 3: from (149, 679) to (156, 679).
 WARNING: Moved in the wrong direction in step 5: from (85, 661) to (89, 661).
-WARNING: Moved in the wrong direction in step 6: from (89, 661) to (137, 678).
+WARNING: Moved in the wrong direction in step 6: from (89, 661) to (137, 679).
   Moving right:  "\n        before    AHYJ AQWJXMFUDJE\n    "[35, 34, 33, 32, 31, 30, 29, 28, 27, 26, 25, 24, 23, 22, 21, 20, 16, 15, 10, 11, 12, 13, 14, 9]
-WARNING: Moved in the wrong direction in step 18: from (137, 678) to (89, 661).
+WARNING: Moved in the wrong direction in step 18: from (137, 679) to (89, 661).
 WARNING: Moved in the wrong direction in step 19: from (89, 661) to (85, 661).
-WARNING: Moved in the wrong direction in step 21: from (156, 678) to (149, 678).
-WARNING: Moved in the wrong direction in step 22: from (149, 678) to (144, 678).
-WARNING: Moved in the wrong direction in step 23: from (144, 678) to (156, 661).
+WARNING: Moved in the wrong direction in step 21: from (156, 679) to (149, 679).
+WARNING: Moved in the wrong direction in step 22: from (149, 679) to (144, 679).
+WARNING: Moved in the wrong direction in step 23: from (144, 679) to (156, 661).
 Test 20, LTR:
   Moving right: "\n        MUQJ    after encyclopedia\n    "[9, 12, 11, 10, 13, 14, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35]
-WARNING: Moved in the wrong direction in step 1: from (37, 711) to (44, 728).
-WARNING: Moved in the wrong direction in step 2: from (44, 728) to (37, 728).
-WARNING: Moved in the wrong direction in step 4: from (93, 711) to (52, 728).
+WARNING: Moved in the wrong direction in step 1: from (37, 711) to (44, 729).
+WARNING: Moved in the wrong direction in step 2: from (44, 729) to (37, 729).
+WARNING: Moved in the wrong direction in step 4: from (93, 711) to (52, 729).
   Moving left:  "\n        MUQJ    after encyclopedia\n    "[35, 34, 33, 32, 31, 30, 29, 28, 27, 26, 25, 24, 23, 22, 21, 20, 19, 18, 14, 13, 10, 11, 12, 9]
-WARNING: Moved in the wrong direction in step 20: from (52, 728) to (93, 711).
-WARNING: Moved in the wrong direction in step 22: from (37, 728) to (44, 728).
-WARNING: Moved in the wrong direction in step 23: from (44, 728) to (37, 711).
+WARNING: Moved in the wrong direction in step 20: from (52, 729) to (93, 711).
+WARNING: Moved in the wrong direction in step 22: from (37, 729) to (44, 729).
+WARNING: Moved in the wrong direction in step 23: from (44, 729) to (37, 711).
 Test 20, RTL:
   Moving left: "\n        MUQJ    after encyclopedia\n    "[9, 10, 11, 12, 13, 14, 21, 20, 19, 18, 22, 23, 34, 33, 32, 31, 30, 29, 28, 27, 26, 25, 24, 35]
-WARNING: Moved in the wrong direction in step 2: from (100, 711) to (156, 728).
-WARNING: Moved in the wrong direction in step 4: from (79, 728) to (87, 728).
-WARNING: Moved in the wrong direction in step 5: from (87, 728) to (94, 728).
-WARNING: Moved in the wrong direction in step 6: from (94, 728) to (145, 728).
-WARNING: Moved in the wrong direction in step 10: from (122, 728) to (149, 728).
+WARNING: Moved in the wrong direction in step 2: from (100, 711) to (156, 729).
+WARNING: Moved in the wrong direction in step 4: from (79, 729) to (87, 729).
+WARNING: Moved in the wrong direction in step 5: from (87, 729) to (94, 729).
+WARNING: Moved in the wrong direction in step 6: from (94, 729) to (145, 729).
+WARNING: Moved in the wrong direction in step 10: from (122, 729) to (149, 729).
   Moving right:  "\n        MUQJ    after encyclopedia\n    "[35, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33, 34, 23, 22, 18, 19, 20, 21, 14, 13, 12, 11, 10, 9]
-WARNING: Moved in the wrong direction in step 14: from (149, 728) to (122, 728).
-WARNING: Moved in the wrong direction in step 18: from (145, 728) to (94, 728).
-WARNING: Moved in the wrong direction in step 19: from (94, 728) to (87, 728).
-WARNING: Moved in the wrong direction in step 20: from (87, 728) to (79, 728).
-WARNING: Moved in the wrong direction in step 22: from (156, 728) to (100, 711).
+WARNING: Moved in the wrong direction in step 14: from (149, 729) to (122, 729).
+WARNING: Moved in the wrong direction in step 18: from (145, 729) to (94, 729).
+WARNING: Moved in the wrong direction in step 19: from (94, 729) to (87, 729).
+WARNING: Moved in the wrong direction in step 20: from (87, 729) to (79, 729).
+WARNING: Moved in the wrong direction in step 22: from (156, 729) to (100, 711).
 Test 21, LTR:
   Moving right: "\n        This is JF[Y WY OJ[Y the boxes. \n    "[9, 10, 11, 12, 13, 14, 15, 16, 17, 23, 22, 21, 20, 19, 18, 24, 25, 28, 27, 26, 29, 30, 31, 32, 33, 34, 35, 36, 37, 38, 39, 40]
 WARNING: Moved in the wrong direction in step 2: from (118, 761) to (110, 761).
 WARNING: Moved in the wrong direction in step 3: from (110, 761) to (103, 761).
 WARNING: Moved in the wrong direction in step 4: from (103, 761) to (99, 761).
 WARNING: Moved in the wrong direction in step 5: from (99, 761) to (92, 761).
-WARNING: Moved in the wrong direction in step 7: from (127, 761) to (37, 778).
-WARNING: Moved in the wrong direction in step 10: from (80, 778) to (72, 778).
-WARNING: Moved in the wrong direction in step 11: from (72, 778) to (68, 778).
-WARNING: Moved in the wrong direction in step 12: from (68, 778) to (64, 778).
-WARNING: Moved in the wrong direction in step 13: from (64, 778) to (45, 778).
-WARNING: Moved in the wrong direction in step 18: from (116, 778) to (108, 778).
-WARNING: Moved in the wrong direction in step 19: from (108, 778) to (100, 778).
+WARNING: Moved in the wrong direction in step 7: from (127, 761) to (37, 779).
+WARNING: Moved in the wrong direction in step 10: from (80, 779) to (72, 779).
+WARNING: Moved in the wrong direction in step 11: from (72, 779) to (68, 779).
+WARNING: Moved in the wrong direction in step 12: from (68, 779) to (64, 779).
+WARNING: Moved in the wrong direction in step 13: from (64, 779) to (45, 779).
+WARNING: Moved in the wrong direction in step 18: from (116, 779) to (108, 779).
+WARNING: Moved in the wrong direction in step 19: from (108, 779) to (100, 779).
   Moving left:  "\n        This is JF[Y WY OJ[Y the boxes. \n    "[40, 39, 38, 37, 36, 35, 34, 33, 32, 31, 30, 29, 26, 27, 28, 25, 24, 18, 19, 20, 21, 22, 23, 17, 16, 15, 14, 13, 12, 11, 10, 9]
-WARNING: Moved in the wrong direction in step 13: from (100, 778) to (108, 778).
-WARNING: Moved in the wrong direction in step 14: from (108, 778) to (116, 778).
-WARNING: Moved in the wrong direction in step 19: from (45, 778) to (64, 778).
-WARNING: Moved in the wrong direction in step 20: from (64, 778) to (68, 778).
-WARNING: Moved in the wrong direction in step 21: from (68, 778) to (72, 778).
-WARNING: Moved in the wrong direction in step 22: from (72, 778) to (80, 778).
-WARNING: Moved in the wrong direction in step 25: from (37, 778) to (127, 761).
+WARNING: Moved in the wrong direction in step 13: from (100, 779) to (108, 779).
+WARNING: Moved in the wrong direction in step 14: from (108, 779) to (116, 779).
+WARNING: Moved in the wrong direction in step 19: from (45, 779) to (64, 779).
+WARNING: Moved in the wrong direction in step 20: from (64, 779) to (68, 779).
+WARNING: Moved in the wrong direction in step 21: from (68, 779) to (72, 779).
+WARNING: Moved in the wrong direction in step 22: from (72, 779) to (80, 779).
+WARNING: Moved in the wrong direction in step 25: from (37, 779) to (127, 761).
 WARNING: Moved in the wrong direction in step 27: from (92, 761) to (99, 761).
 WARNING: Moved in the wrong direction in step 28: from (99, 761) to (103, 761).
 WARNING: Moved in the wrong direction in step 29: from (103, 761) to (110, 761).
@@ -259,23 +259,23 @@
 WARNING: Moved in the wrong direction in step 4: from (61, 761) to (65, 761).
 WARNING: Moved in the wrong direction in step 5: from (65, 761) to (72, 761).
 WARNING: Moved in the wrong direction in step 6: from (72, 761) to (80, 761).
-WARNING: Moved in the wrong direction in step 7: from (80, 761) to (136, 778).
-WARNING: Moved in the wrong direction in step 14: from (48, 778) to (56, 778).
-WARNING: Moved in the wrong direction in step 15: from (56, 778) to (64, 778).
-WARNING: Moved in the wrong direction in step 16: from (64, 778) to (68, 778).
-WARNING: Moved in the wrong direction in step 17: from (68, 778) to (76, 778).
-WARNING: Moved in the wrong direction in step 18: from (76, 778) to (84, 778).
-WARNING: Moved in the wrong direction in step 19: from (84, 778) to (92, 778).
-WARNING: Moved in the wrong direction in step 20: from (92, 778) to (99, 778).
+WARNING: Moved in the wrong direction in step 7: from (80, 761) to (136, 779).
+WARNING: Moved in the wrong direction in step 14: from (48, 779) to (56, 779).
+WARNING: Moved in the wrong direction in step 15: from (56, 779) to (64, 779).
+WARNING: Moved in the wrong direction in step 16: from (64, 779) to (68, 779).
+WARNING: Moved in the wrong direction in step 17: from (68, 779) to (76, 779).
+WARNING: Moved in the wrong direction in step 18: from (76, 779) to (84, 779).
+WARNING: Moved in the wrong direction in step 19: from (84, 779) to (92, 779).
+WARNING: Moved in the wrong direction in step 20: from (92, 779) to (99, 779).
   Moving right:  "\n        This is JF[Y WY OJ[Y the boxes. \n    "[40, 39, 31, 32, 33, 34, 35, 36, 37, 38, 30, 29, 28, 27, 26, 25, 24, 23, 22, 21, 20, 19, 18, 17, 16, 10, 11, 12, 13, 14, 15, 9]
-WARNING: Moved in the wrong direction in step 12: from (99, 778) to (92, 778).
-WARNING: Moved in the wrong direction in step 13: from (92, 778) to (84, 778).
-WARNING: Moved in the wrong direction in step 14: from (84, 778) to (76, 778).
-WARNING: Moved in the wrong direction in step 15: from (76, 778) to (68, 778).
-WARNING: Moved in the wrong direction in step 16: from (68, 778) to (64, 778).
-WARNING: Moved in the wrong direction in step 17: from (64, 778) to (56, 778).
-WARNING: Moved in the wrong direction in step 18: from (56, 778) to (48, 778).
-WARNING: Moved in the wrong direction in step 25: from (136, 778) to (80, 761).
+WARNING: Moved in the wrong direction in step 12: from (99, 779) to (92, 779).
+WARNING: Moved in the wrong direction in step 13: from (92, 779) to (84, 779).
+WARNING: Moved in the wrong direction in step 14: from (84, 779) to (76, 779).
+WARNING: Moved in the wrong direction in step 15: from (76, 779) to (68, 779).
+WARNING: Moved in the wrong direction in step 16: from (68, 779) to (64, 779).
+WARNING: Moved in the wrong direction in step 17: from (64, 779) to (56, 779).
+WARNING: Moved in the wrong direction in step 18: from (56, 779) to (48, 779).
+WARNING: Moved in the wrong direction in step 25: from (136, 779) to (80, 761).
 WARNING: Moved in the wrong direction in step 26: from (80, 761) to (72, 761).
 WARNING: Moved in the wrong direction in step 27: from (72, 761) to (65, 761).
 WARNING: Moved in the wrong direction in step 28: from (65, 761) to (61, 761).
@@ -287,21 +287,21 @@
 WARNING: Moved in the wrong direction in step 3: from (110, 811) to (103, 811).
 WARNING: Moved in the wrong direction in step 4: from (103, 811) to (99, 811).
 WARNING: Moved in the wrong direction in step 5: from (99, 811) to (92, 811).
-WARNING: Moved in the wrong direction in step 7: from (127, 811) to (37, 828).
-WARNING: Moved in the wrong direction in step 10: from (80, 828) to (72, 828).
-WARNING: Moved in the wrong direction in step 11: from (72, 828) to (68, 828).
-WARNING: Moved in the wrong direction in step 12: from (68, 828) to (64, 828).
-WARNING: Moved in the wrong direction in step 13: from (64, 828) to (45, 828).
-WARNING: Moved in the wrong direction in step 18: from (116, 828) to (108, 828).
-WARNING: Moved in the wrong direction in step 19: from (108, 828) to (100, 828).
+WARNING: Moved in the wrong direction in step 7: from (127, 811) to (37, 829).
+WARNING: Moved in the wrong direction in step 10: from (80, 829) to (72, 829).
+WARNING: Moved in the wrong direction in step 11: from (72, 829) to (68, 829).
+WARNING: Moved in the wrong direction in step 12: from (68, 829) to (64, 829).
+WARNING: Moved in the wrong direction in step 13: from (64, 829) to (45, 829).
+WARNING: Moved in the wrong direction in step 18: from (116, 829) to (108, 829).
+WARNING: Moved in the wrong direction in step 19: from (108, 829) to (100, 829).
   Moving left:  "\n        This is JF[Y WY OJ[Y the boxes. \n    "[46, 45, 44, 43, 42, 41, 40, 39, 38, 37, 36, 35, 34, 33, 32, 31, 30, 29, 26, 27, 28, 25, 24, 18, 19, 20, 21, 22, 23, 17, 16, 15, 14, 13, 12, 11, 10, 9]
-WARNING: Moved in the wrong direction in step 19: from (100, 828) to (108, 828).
-WARNING: Moved in the wrong direction in step 20: from (108, 828) to (116, 828).
-WARNING: Moved in the wrong direction in step 25: from (45, 828) to (64, 828).
-WARNING: Moved in the wrong direction in step 26: from (64, 828) to (68, 828).
-WARNING: Moved in the wrong direction in step 27: from (68, 828) to (72, 828).
-WARNING: Moved in the wrong direction in step 28: from (72, 828) to (80, 828).
-WARNING: Moved in the wrong direction in step 31: from (37, 828) to (127, 811).
+WARNING: Moved in the wrong direction in step 19: from (100, 829) to (108, 829).
+WARNING: Moved in the wrong direction in step 20: from (108, 829) to (116, 829).
+WARNING: Moved in the wrong direction in step 25: from (45, 829) to (64, 829).
+WARNING: Moved in the wrong direction in step 26: from (64, 829) to (68, 829).
+WARNING: Moved in the wrong direction in step 27: from (68, 829) to (72, 829).
+WARNING: Moved in the wrong direction in step 28: from (72, 829) to (80, 829).
+WARNING: Moved in the wrong direction in step 31: from (37, 829) to (127, 811).
 WARNING: Moved in the wrong direction in step 33: from (92, 811) to (99, 811).
 WARNING: Moved in the wrong direction in step 34: from (99, 811) to (103, 811).
 WARNING: Moved in the wrong direction in step 35: from (103, 811) to (110, 811).
@@ -313,33 +313,33 @@
 WARNING: Moved in the wrong direction in step 4: from (61, 811) to (65, 811).
 WARNING: Moved in the wrong direction in step 5: from (65, 811) to (72, 811).
 WARNING: Moved in the wrong direction in step 6: from (72, 811) to (80, 811).
-WARNING: Moved in the wrong direction in step 7: from (80, 811) to (136, 828).
-WARNING: Moved in the wrong direction in step 14: from (48, 828) to (56, 828).
-WARNING: Moved in the wrong direction in step 15: from (56, 828) to (64, 828).
-WARNING: Moved in the wrong direction in step 16: from (64, 828) to (68, 828).
-WARNING: Moved in the wrong direction in step 17: from (68, 828) to (76, 828).
-WARNING: Moved in the wrong direction in step 18: from (76, 828) to (84, 828).
-WARNING: Moved in the wrong direction in step 19: from (84, 828) to (92, 828).
-WARNING: Moved in the wrong direction in step 20: from (92, 828) to (99, 828).
-WARNING: Moved in the wrong direction in step 24: from (37, 828) to (41, 828).
-WARNING: Moved in the wrong direction in step 25: from (41, 828) to (45, 828).
-WARNING: Moved in the wrong direction in step 26: from (45, 828) to (49, 828).
-WARNING: Moved in the wrong direction in step 27: from (49, 828) to (53, 828).
-WARNING: Moved in the wrong direction in step 28: from (53, 828) to (57, 828).
+WARNING: Moved in the wrong direction in step 7: from (80, 811) to (136, 829).
+WARNING: Moved in the wrong direction in step 14: from (48, 829) to (56, 829).
+WARNING: Moved in the wrong direction in step 15: from (56, 829) to (64, 829).
+WARNING: Moved in the wrong direction in step 16: from (64, 829) to (68, 829).
+WARNING: Moved in the wrong direction in step 17: from (68, 829) to (76, 829).
+WARNING: Moved in the wrong direction in step 18: from (76, 829) to (84, 829).
+WARNING: Moved in the wrong direction in step 19: from (84, 829) to (92, 829).
+WARNING: Moved in the wrong direction in step 20: from (92, 829) to (99, 829).
+WARNING: Moved in the wrong direction in step 24: from (37, 829) to (41, 829).
+WARNING: Moved in the wrong direction in step 25: from (41, 829) to (45, 829).
+WARNING: Moved in the wrong direction in step 26: from (45, 829) to (49, 829).
+WARNING: Moved in the wrong direction in step 27: from (49, 829) to (53, 829).
+WARNING: Moved in the wrong direction in step 28: from (53, 829) to (57, 829).
   Moving right:  "\n        This is JF[Y WY OJ[Y the boxes. \n    "[46, 45, 44, 43, 42, 41, 40, 39, 31, 32, 33, 34, 35, 36, 37, 38, 30, 29, 28, 27, 26, 25, 24, 23, 22, 21, 20, 19, 18, 17, 16, 10, 11, 12, 13, 14, 15, 9]
-WARNING: Moved in the wrong direction in step 10: from (57, 828) to (53, 828).
-WARNING: Moved in the wrong direction in step 11: from (53, 828) to (49, 828).
-WARNING: Moved in the wrong direction in step 12: from (49, 828) to (45, 828).
-WARNING: Moved in the wrong direction in step 13: from (45, 828) to (41, 828).
-WARNING: Moved in the wrong direction in step 14: from (41, 828) to (37, 828).
-WARNING: Moved in the wrong direction in step 18: from (99, 828) to (92, 828).
-WARNING: Moved in the wrong direction in step 19: from (92, 828) to (84, 828).
-WARNING: Moved in the wrong direction in step 20: from (84, 828) to (76, 828).
-WARNING: Moved in the wrong direction in step 21: from (76, 828) to (68, 828).
-WARNING: Moved in the wrong direction in step 22: from (68, 828) to (64, 828).
-WARNING: Moved in the wrong direction in step 23: from (64, 828) to (56, 828).
-WARNING: Moved in the wrong direction in step 24: from (56, 828) to (48, 828).
-WARNING: Moved in the wrong direction in step 31: from (136, 828) to (80, 811).
+WARNING: Moved in the wrong direction in step 10: from (57, 829) to (53, 829).
+WARNING: Moved in the wrong direction in step 11: from (53, 829) to (49, 829).
+WARNING: Moved in the wrong direction in step 12: from (49, 829) to (45, 829).
+WARNING: Moved in the wrong direction in step 13: from (45, 829) to (41, 829).
+WARNING: Moved in the wrong direction in step 14: from (41, 829) to (37, 829).
+WARNING: Moved in the wrong direction in step 18: from (99, 829) to (92, 829).
+WARNING: Moved in the wrong direction in step 19: from (92, 829) to (84, 829).
+WARNING: Moved in the wrong direction in step 20: from (84, 829) to (76, 829).
+WARNING: Moved in the wrong direction in step 21: from (76, 829) to (68, 829).
+WARNING: Moved in the wrong direction in step 22: from (68, 829) to (64, 829).
+WARNING: Moved in the wrong direction in step 23: from (64, 829) to (56, 829).
+WARNING: Moved in the wrong direction in step 24: from (56, 829) to (48, 829).
+WARNING: Moved in the wrong direction in step 31: from (136, 829) to (80, 811).
 WARNING: Moved in the wrong direction in step 32: from (80, 811) to (72, 811).
 WARNING: Moved in the wrong direction in step 33: from (72, 811) to (65, 811).
 WARNING: Moved in the wrong direction in step 34: from (65, 811) to (61, 811).
@@ -371,116 +371,116 @@
 WARNING: Moved in the wrong direction in step 11: from (732, 1009) to (767, 951).
 Test 25, LTR:
   Moving right: "\n        abcdefABC"[9, 10, 11, 12, 13, 14, 15], "DEF\n    "[2, 1], <DIV>[2], "\n        abcdefABC"[18, 17, 16], "DEF\n    "[3]
-WARNING: Moved in the wrong direction in step 2: from (98, 1041) to (91, 1041).
-WARNING: Moved in the wrong direction in step 3: from (91, 1041) to (83, 1041).
-WARNING: Moved in the wrong direction in step 8: from (52, 1041) to (44, 1041).
+WARNING: Moved in the wrong direction in step 2: from (98, 1041) to (91, 1043).
+WARNING: Moved in the wrong direction in step 3: from (91, 1043) to (83, 1043).
+WARNING: Moved in the wrong direction in step 8: from (52, 1043) to (44, 1043).
   Moving left:  "DEF\n    "[3], "\n        abcdefABC"[16, 17, 18], <DIV>[2], "DEF\n    "[1, 2], "\n        abcdefABC"[15, 14, 13, 12, 11, 10, 9]
-WARNING: Moved in the wrong direction in step 6: from (44, 1041) to (52, 1041).
-WARNING: Moved in the wrong direction in step 11: from (83, 1041) to (91, 1041).
-WARNING: Moved in the wrong direction in step 12: from (91, 1041) to (98, 1041).
+WARNING: Moved in the wrong direction in step 6: from (44, 1043) to (52, 1043).
+WARNING: Moved in the wrong direction in step 11: from (83, 1043) to (91, 1043).
+WARNING: Moved in the wrong direction in step 12: from (91, 1043) to (98, 1041).
 Test 25, RTL:
   Moving left: "\n        abcdefABC"[9, 14, 13, 12, 11, 10, 15, 16, 17, 18], <DIV>[2], "DEF\n    "[1, 2, 3]
-WARNING: Moved in the wrong direction in step 3: from (670, 1041) to (674, 1041).
-WARNING: Moved in the wrong direction in step 4: from (674, 1041) to (682, 1041).
-WARNING: Moved in the wrong direction in step 5: from (682, 1041) to (689, 1041).
-WARNING: Moved in the wrong direction in step 12: from (732, 1041) to (740, 1041).
-WARNING: Moved in the wrong direction in step 13: from (740, 1041) to (747, 1041).
+WARNING: Moved in the wrong direction in step 3: from (670, 1043) to (674, 1043).
+WARNING: Moved in the wrong direction in step 4: from (674, 1043) to (682, 1043).
+WARNING: Moved in the wrong direction in step 12: from (732, 1043) to (740, 1043).
+WARNING: Moved in the wrong direction in step 13: from (740, 1043) to (747, 1043).
   Moving right:  "DEF\n    "[3, 2, 1], <DIV>[2], "\n        abcdefABC"[18, 17, 16, 15, 10, 11, 12, 13, 14, 9]
-WARNING: Moved in the wrong direction in step 1: from (747, 1041) to (740, 1041).
-WARNING: Moved in the wrong direction in step 2: from (740, 1041) to (732, 1041).
-WARNING: Moved in the wrong direction in step 9: from (689, 1041) to (682, 1041).
-WARNING: Moved in the wrong direction in step 10: from (682, 1041) to (674, 1041).
-WARNING: Moved in the wrong direction in step 11: from (674, 1041) to (670, 1041).
+WARNING: Moved in the wrong direction in step 1: from (747, 1043) to (740, 1043).
+WARNING: Moved in the wrong direction in step 2: from (740, 1043) to (732, 1043).
+WARNING: Moved in the wrong direction in step 10: from (682, 1043) to (674, 1043).
+WARNING: Moved in the wrong direction in step 11: from (674, 1043) to (670, 1043).
 Test 26, LTR:
   Moving right: "\n        ABCDEFabc"[9, 14, 13, 12, 11, 10, 15, 16, 17, 18], <DIV>[2], "def\n    "[1, 2, 3]
-WARNING: Moved in the wrong direction in step 3: from (134, 1075) to (129, 1075).
-WARNING: Moved in the wrong direction in step 4: from (129, 1075) to (122, 1075).
-WARNING: Moved in the wrong direction in step 5: from (122, 1075) to (113, 1075).
-WARNING: Moved in the wrong direction in step 12: from (68, 1075) to (61, 1075).
-WARNING: Moved in the wrong direction in step 13: from (61, 1075) to (56, 1075).
+WARNING: Moved in the wrong direction in step 3: from (134, 1077) to (129, 1077).
+WARNING: Moved in the wrong direction in step 4: from (129, 1077) to (122, 1077).
+WARNING: Moved in the wrong direction in step 12: from (68, 1077) to (61, 1077).
+WARNING: Moved in the wrong direction in step 13: from (61, 1077) to (56, 1077).
   Moving left:  "def\n    "[3, 2, 1], <DIV>[2], "\n        ABCDEFabc"[18, 17, 16, 15, 10, 11, 12, 13, 14, 9]
-WARNING: Moved in the wrong direction in step 1: from (56, 1075) to (61, 1075).
-WARNING: Moved in the wrong direction in step 2: from (61, 1075) to (68, 1075).
-WARNING: Moved in the wrong direction in step 9: from (113, 1075) to (122, 1075).
-WARNING: Moved in the wrong direction in step 10: from (122, 1075) to (129, 1075).
-WARNING: Moved in the wrong direction in step 11: from (129, 1075) to (134, 1075).
+WARNING: Moved in the wrong direction in step 1: from (56, 1077) to (61, 1077).
+WARNING: Moved in the wrong direction in step 2: from (61, 1077) to (68, 1077).
+WARNING: Moved in the wrong direction in step 10: from (122, 1077) to (129, 1077).
+WARNING: Moved in the wrong direction in step 11: from (129, 1077) to (134, 1077).
 Test 26, RTL:
   Moving left: "\n        ABCDEFabc"[9, 10, 11, 12, 13, 14, 15], "def\n    "[2, 1], <DIV>[2], "\n        ABCDEFabc"[18, 17, 16], "def\n    "[3]
-WARNING: Moved in the wrong direction in step 2: from (707, 1075) to (716, 1075).
-WARNING: Moved in the wrong direction in step 3: from (716, 1075) to (723, 1075).
-WARNING: Moved in the wrong direction in step 8: from (752, 1075) to (759, 1075).
+WARNING: Moved in the wrong direction in step 2: from (707, 1075) to (716, 1077).
+WARNING: Moved in the wrong direction in step 3: from (716, 1077) to (723, 1077).
+WARNING: Moved in the wrong direction in step 8: from (752, 1077) to (759, 1077).
   Moving right:  "def\n    "[3], "\n        ABCDEFabc"[16, 17, 18], <DIV>[2], "def\n    "[1, 2], "\n        ABCDEFabc"[15, 14, 13, 12, 11, 10, 9]
-WARNING: Moved in the wrong direction in step 6: from (759, 1075) to (752, 1075).
-WARNING: Moved in the wrong direction in step 11: from (723, 1075) to (716, 1075).
-WARNING: Moved in the wrong direction in step 12: from (716, 1075) to (707, 1075).
+WARNING: Moved in the wrong direction in step 6: from (759, 1077) to (752, 1077).
+WARNING: Moved in the wrong direction in step 11: from (723, 1077) to (716, 1077).
+WARNING: Moved in the wrong direction in step 12: from (716, 1077) to (707, 1075).
 Test 27, LTR:
   Moving right: "\n        abc"[9, 10, 11, 12], <DIV>[2], "DEFghi\n    "[2, 1], <DIV>[5, 4], "ABC"[3, 2, 1], "DEFghi\n    "[3, 4, 5, 6]
-WARNING: Moved in the wrong direction in step 2: from (244, 1109) to (236, 1109).
-WARNING: Moved in the wrong direction in step 4: from (302, 1109) to (52, 1109).
-WARNING: Moved in the wrong direction in step 6: from (52, 1109) to (44, 1109).
-WARNING: Moved in the wrong direction in step 8: from (295, 1109) to (231, 1109).
-WARNING: Moved in the wrong direction in step 9: from (231, 1109) to (59, 1109).
-WARNING: Moved in the wrong direction in step 10: from (59, 1109) to (52, 1109).
-WARNING: Moved in the wrong direction in step 11: from (52, 1109) to (44, 1109).
-WARNING: Moved in the wrong direction in step 15: from (295, 1109) to (287, 1109).
+WARNING: Moved in the wrong direction in step 2: from (244, 1111) to (236, 1111).
+WARNING: Moved in the wrong direction in step 4: from (303, 1111) to (52, 1111).
+WARNING: Moved in the wrong direction in step 6: from (52, 1111) to (44, 1111).
+WARNING: Moved in the wrong direction in step 9: from (231, 1109) to (59, 1111).
+WARNING: Moved in the wrong direction in step 10: from (59, 1111) to (52, 1111).
+WARNING: Moved in the wrong direction in step 11: from (52, 1111) to (44, 1111).
+WARNING: Moved in the wrong direction in step 14: from (231, 1109) to (295, 1111).
+WARNING: Moved in the wrong direction in step 15: from (295, 1111) to (287, 1111).
   Moving left:  "DEFghi\n    "[6, 5, 4, 3], "ABC"[1, 2, 3], <DIV>[4, 5], "DEFghi\n    "[1, 2], <DIV>[2], "\n        abc"[12, 11, 10, 9]
-WARNING: Moved in the wrong direction in step 1: from (287, 1109) to (295, 1109).
-WARNING: Moved in the wrong direction in step 5: from (44, 1109) to (52, 1109).
-WARNING: Moved in the wrong direction in step 6: from (52, 1109) to (59, 1109).
-WARNING: Moved in the wrong direction in step 7: from (59, 1109) to (231, 1109).
-WARNING: Moved in the wrong direction in step 8: from (231, 1109) to (295, 1109).
-WARNING: Moved in the wrong direction in step 10: from (44, 1109) to (52, 1109).
-WARNING: Moved in the wrong direction in step 12: from (52, 1109) to (302, 1109).
-WARNING: Moved in the wrong direction in step 14: from (236, 1109) to (244, 1109).
+WARNING: Moved in the wrong direction in step 1: from (287, 1111) to (295, 1111).
+WARNING: Moved in the wrong direction in step 2: from (295, 1111) to (231, 1109).
+WARNING: Moved in the wrong direction in step 5: from (44, 1111) to (52, 1111).
+WARNING: Moved in the wrong direction in step 6: from (52, 1111) to (59, 1111).
+WARNING: Moved in the wrong direction in step 7: from (59, 1111) to (231, 1109).
+WARNING: Moved in the wrong direction in step 10: from (44, 1111) to (52, 1111).
+WARNING: Moved in the wrong direction in step 12: from (52, 1111) to (303, 1111).
+WARNING: Moved in the wrong direction in step 14: from (236, 1111) to (244, 1111).
 Test 27, RTL:
   Moving left: "\n        abc"[9, 11, 10, 12], <DIV>[2], "ABC"[1, 2, 3], <DIV>[4, 5], "DEFghi\n    "[1, 2, 3, 5, 4, 6]
-WARNING: Moved in the wrong direction in step 2: from (505, 1109) to (513, 1109).
-WARNING: Moved in the wrong direction in step 4: from (501, 1109) to (760, 1109).
-WARNING: Moved in the wrong direction in step 6: from (752, 1109) to (760, 1109).
-WARNING: Moved in the wrong direction in step 10: from (565, 1109) to (752, 1109).
-WARNING: Moved in the wrong direction in step 11: from (752, 1109) to (760, 1109).
-WARNING: Moved in the wrong direction in step 14: from (565, 1109) to (572, 1109).
+WARNING: Moved in the wrong direction in step 2: from (505, 1111) to (513, 1111).
+WARNING: Moved in the wrong direction in step 4: from (501, 1111) to (760, 1111).
+WARNING: Moved in the wrong direction in step 6: from (752, 1111) to (760, 1111).
+WARNING: Moved in the wrong direction in step 9: from (572, 1109) to (565, 1111).
+WARNING: Moved in the wrong direction in step 10: from (565, 1111) to (752, 1111).
+WARNING: Moved in the wrong direction in step 11: from (752, 1111) to (760, 1111).
+WARNING: Moved in the wrong direction in step 15: from (572, 1109) to (557, 1111).
   Moving right:  "DEFghi\n    "[6, 4, 5, 3, 2, 1], <DIV>[5, 4], "ABC"[3, 2, 1], <DIV>[2], "\n        abc"[12, 10, 11, 9]
-WARNING: Moved in the wrong direction in step 2: from (572, 1109) to (565, 1109).
-WARNING: Moved in the wrong direction in step 5: from (760, 1109) to (752, 1109).
-WARNING: Moved in the wrong direction in step 6: from (752, 1109) to (565, 1109).
-WARNING: Moved in the wrong direction in step 10: from (760, 1109) to (752, 1109).
-WARNING: Moved in the wrong direction in step 12: from (760, 1109) to (501, 1109).
-WARNING: Moved in the wrong direction in step 14: from (513, 1109) to (505, 1109).
+WARNING: Moved in the wrong direction in step 1: from (557, 1111) to (572, 1109).
+WARNING: Moved in the wrong direction in step 5: from (760, 1111) to (752, 1111).
+WARNING: Moved in the wrong direction in step 6: from (752, 1111) to (565, 1111).
+WARNING: Moved in the wrong direction in step 7: from (565, 1111) to (572, 1109).
+WARNING: Moved in the wrong direction in step 10: from (760, 1111) to (752, 1111).
+WARNING: Moved in the wrong direction in step 12: from (760, 1111) to (501, 1111).
+WARNING: Moved in the wrong direction in step 14: from (513, 1111) to (505, 1111).
 Test 28, LTR:
   Moving right: "\n        ABC"[9, 11, 10, 12], <DIV>[2], "abc"[1, 2, 3], <DIV>[4, 5], "defDEF\n    "[1, 2, 3, 5, 4, 6]
-WARNING: Moved in the wrong direction in step 2: from (299, 1145) to (292, 1145).
-WARNING: Moved in the wrong direction in step 4: from (304, 1145) to (42, 1145).
-WARNING: Moved in the wrong direction in step 6: from (50, 1145) to (42, 1145).
-WARNING: Moved in the wrong direction in step 10: from (237, 1145) to (50, 1145).
-WARNING: Moved in the wrong direction in step 11: from (50, 1145) to (42, 1145).
-WARNING: Moved in the wrong direction in step 14: from (237, 1145) to (229, 1145).
+WARNING: Moved in the wrong direction in step 2: from (299, 1147) to (292, 1147).
+WARNING: Moved in the wrong direction in step 4: from (304, 1147) to (42, 1147).
+WARNING: Moved in the wrong direction in step 6: from (50, 1147) to (42, 1147).
+WARNING: Moved in the wrong direction in step 9: from (229, 1145) to (237, 1147).
+WARNING: Moved in the wrong direction in step 10: from (237, 1147) to (50, 1147).
+WARNING: Moved in the wrong direction in step 11: from (50, 1147) to (42, 1147).
+WARNING: Moved in the wrong direction in step 15: from (229, 1145) to (245, 1147).
   Moving left:  "defDEF\n    "[6, 4, 5, 3, 2, 1], <DIV>[5, 4], "abc"[3, 2, 1], <DIV>[2], "\n        ABC"[12, 10, 11, 9]
-WARNING: Moved in the wrong direction in step 2: from (229, 1145) to (237, 1145).
-WARNING: Moved in the wrong direction in step 5: from (42, 1145) to (50, 1145).
-WARNING: Moved in the wrong direction in step 6: from (50, 1145) to (237, 1145).
-WARNING: Moved in the wrong direction in step 10: from (42, 1145) to (50, 1145).
-WARNING: Moved in the wrong direction in step 12: from (42, 1145) to (304, 1145).
-WARNING: Moved in the wrong direction in step 14: from (292, 1145) to (299, 1145).
+WARNING: Moved in the wrong direction in step 1: from (245, 1147) to (229, 1145).
+WARNING: Moved in the wrong direction in step 5: from (42, 1147) to (50, 1147).
+WARNING: Moved in the wrong direction in step 6: from (50, 1147) to (237, 1147).
+WARNING: Moved in the wrong direction in step 7: from (237, 1147) to (229, 1145).
+WARNING: Moved in the wrong direction in step 10: from (42, 1147) to (50, 1147).
+WARNING: Moved in the wrong direction in step 12: from (42, 1147) to (304, 1147).
+WARNING: Moved in the wrong direction in step 14: from (292, 1147) to (299, 1147).
 Test 28, RTL:
   Moving left: "\n        ABC"[9, 10, 11, 12], <DIV>[2], "defDEF\n    "[2, 1], <DIV>[5, 4], "abc"[3, 2, 1], "defDEF\n    "[3, 4, 5, 6]
-WARNING: Moved in the wrong direction in step 2: from (562, 1145) to (569, 1145).
-WARNING: Moved in the wrong direction in step 4: from (500, 1145) to (752, 1145).
-WARNING: Moved in the wrong direction in step 6: from (752, 1145) to (760, 1145).
-WARNING: Moved in the wrong direction in step 8: from (507, 1145) to (574, 1145).
-WARNING: Moved in the wrong direction in step 9: from (574, 1145) to (747, 1145).
-WARNING: Moved in the wrong direction in step 10: from (747, 1145) to (752, 1145).
-WARNING: Moved in the wrong direction in step 11: from (752, 1145) to (760, 1145).
-WARNING: Moved in the wrong direction in step 15: from (507, 1145) to (515, 1145).
+WARNING: Moved in the wrong direction in step 2: from (562, 1147) to (569, 1147).
+WARNING: Moved in the wrong direction in step 4: from (500, 1147) to (752, 1147).
+WARNING: Moved in the wrong direction in step 6: from (752, 1147) to (760, 1147).
+WARNING: Moved in the wrong direction in step 9: from (574, 1145) to (747, 1147).
+WARNING: Moved in the wrong direction in step 10: from (747, 1147) to (752, 1147).
+WARNING: Moved in the wrong direction in step 11: from (752, 1147) to (760, 1147).
+WARNING: Moved in the wrong direction in step 14: from (574, 1145) to (507, 1147).
+WARNING: Moved in the wrong direction in step 15: from (507, 1147) to (515, 1147).
   Moving right:  "defDEF\n    "[6, 5, 4, 3], "abc"[1, 2, 3], <DIV>[4, 5], "defDEF\n    "[1, 2], <DIV>[2], "\n        ABC"[12, 11, 10, 9]
-WARNING: Moved in the wrong direction in step 1: from (515, 1145) to (507, 1145).
-WARNING: Moved in the wrong direction in step 5: from (760, 1145) to (752, 1145).
-WARNING: Moved in the wrong direction in step 6: from (752, 1145) to (747, 1145).
-WARNING: Moved in the wrong direction in step 7: from (747, 1145) to (574, 1145).
-WARNING: Moved in the wrong direction in step 8: from (574, 1145) to (507, 1145).
-WARNING: Moved in the wrong direction in step 10: from (760, 1145) to (752, 1145).
-WARNING: Moved in the wrong direction in step 12: from (752, 1145) to (500, 1145).
-WARNING: Moved in the wrong direction in step 14: from (569, 1145) to (562, 1145).
+WARNING: Moved in the wrong direction in step 1: from (515, 1147) to (507, 1147).
+WARNING: Moved in the wrong direction in step 2: from (507, 1147) to (574, 1145).
+WARNING: Moved in the wrong direction in step 5: from (760, 1147) to (752, 1147).
+WARNING: Moved in the wrong direction in step 6: from (752, 1147) to (747, 1147).
+WARNING: Moved in the wrong direction in step 7: from (747, 1147) to (574, 1145).
+WARNING: Moved in the wrong direction in step 10: from (760, 1147) to (752, 1147).
+WARNING: Moved in the wrong direction in step 12: from (752, 1147) to (500, 1147).
+WARNING: Moved in the wrong direction in step 14: from (569, 1147) to (562, 1147).
 Test 29, LTR:
   Moving right: "\n        abcABC"[9, 10, 11, 12], "DEF"[2, 1], "\n        abcABC"[15, 14, 13], "DEF"[3]
 WARNING: Moved in the wrong direction in step 5: from (52, 1181) to (44, 1181).

diff --git a/third_party/WebKit/LayoutTests/platform/win/editing/selection/move-past-trailing-space-expected.png b/third_party/WebKit/LayoutTests/platform/win/editing/selection/move-past-trailing-space-expected.png
index 10082d5..a2b5529 100644
--- a/third_party/WebKit/LayoutTests/platform/win/editing/selection/move-past-trailing-space-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/win/editing/selection/move-past-trailing-space-expected.png
Binary files differ

diff --git a/third_party/WebKit/LayoutTests/platform/win/editing/selection/select-box-expected.png b/third_party/WebKit/LayoutTests/platform/win/editing/selection/select-box-expected.png
index 6d99d4a5..24dac5a 100644
--- a/third_party/WebKit/LayoutTests/platform/win/editing/selection/select-box-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/win/editing/selection/select-box-expected.png
Binary files differ

diff --git a/third_party/WebKit/LayoutTests/platform/win/editing/selection/selection-3748164-fix-expected.png b/third_party/WebKit/LayoutTests/platform/win/editing/selection/selection-3748164-fix-expected.png
index da1ef11..5694fb42 100644
--- a/third_party/WebKit/LayoutTests/platform/win/editing/selection/selection-3748164-fix-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/win/editing/selection/selection-3748164-fix-expected.png
Binary files differ

diff --git a/third_party/WebKit/LayoutTests/platform/win/editing/unsupported-content/table-delete-001-expected.png b/third_party/WebKit/LayoutTests/platform/win/editing/unsupported-content/table-delete-001-expected.png
index c580b58..2e55cfb 100644
--- a/third_party/WebKit/LayoutTests/platform/win/editing/unsupported-content/table-delete-001-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/win/editing/unsupported-content/table-delete-001-expected.png
Binary files differ

diff --git a/third_party/WebKit/LayoutTests/platform/win/editing/unsupported-content/table-delete-003-expected.png b/third_party/WebKit/LayoutTests/platform/win/editing/unsupported-content/table-delete-003-expected.png
index 27f4c712..6f0268c8 100644
--- a/third_party/WebKit/LayoutTests/platform/win/editing/unsupported-content/table-delete-003-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/win/editing/unsupported-content/table-delete-003-expected.png
Binary files differ

diff --git a/third_party/WebKit/LayoutTests/platform/win/fast/text/delete-hard-break-character-expected.png b/third_party/WebKit/LayoutTests/platform/win/fast/text/delete-hard-break-character-expected.png
index d12a855..ac87b77 100644
--- a/third_party/WebKit/LayoutTests/platform/win/fast/text/delete-hard-break-character-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/win/fast/text/delete-hard-break-character-expected.png
Binary files differ

diff --git a/third_party/WebKit/LayoutTests/platform/win/paint/invalidation/inline-outline-repaint-expected.txt b/third_party/WebKit/LayoutTests/platform/win/paint/invalidation/inline-outline-repaint-expected.txt
index 8aef5b8d..c53a139 100644
--- a/third_party/WebKit/LayoutTests/platform/win/paint/invalidation/inline-outline-repaint-expected.txt
+++ b/third_party/WebKit/LayoutTests/platform/win/paint/invalidation/inline-outline-repaint-expected.txt

@@ -23,17 +23,17 @@
         },
         {
           "object": "LayoutText #text",
-          "rect": [45, 182, 3, 20],
+          "rect": [45, 183, 3, 19],
           "reason": "invalidate paint rectangle"
         },
         {
           "object": "LayoutText #text",
-          "rect": [45, 182, 3, 20],
+          "rect": [45, 183, 3, 19],
           "reason": "invalidate paint rectangle"
         },
         {
           "object": "LayoutText #text",
-          "rect": [45, 182, 3, 20],
+          "rect": [45, 183, 3, 19],
           "reason": "invalidate paint rectangle"
         }
       ]

diff --git a/third_party/WebKit/LayoutTests/platform/win/virtual/stable/paint/invalidation/inline-outline-repaint-expected.txt b/third_party/WebKit/LayoutTests/platform/win/virtual/stable/paint/invalidation/inline-outline-repaint-expected.txt
new file mode 100644
index 0000000..c53a139
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/platform/win/virtual/stable/paint/invalidation/inline-outline-repaint-expected.txt

@@ -0,0 +1,97 @@
+{
+  "layers": [
+    {
+      "name": "LayoutView #document",
+      "bounds": [800, 600],
+      "contentsOpaque": true,
+      "drawsContent": true,
+      "paintInvalidations": [
+        {
+          "object": "LayoutBlockFlow DIV",
+          "rect": [8, 166, 100, 36],
+          "reason": "forced by layout"
+        },
+        {
+          "object": "LayoutInline SPAN id='test'",
+          "rect": [5, 163, 98, 41],
+          "reason": "forced by layout"
+        },
+        {
+          "object": "LayoutText #text",
+          "rect": [8, 166, 92, 35],
+          "reason": "full"
+        },
+        {
+          "object": "LayoutText #text",
+          "rect": [45, 183, 3, 19],
+          "reason": "invalidate paint rectangle"
+        },
+        {
+          "object": "LayoutText #text",
+          "rect": [45, 183, 3, 19],
+          "reason": "invalidate paint rectangle"
+        },
+        {
+          "object": "LayoutText #text",
+          "rect": [45, 183, 3, 19],
+          "reason": "invalidate paint rectangle"
+        }
+      ]
+    }
+  ],
+  "objectPaintInvalidations": [
+    {
+      "object": "LayoutText #text",
+      "reason": "layoutObject removal"
+    },
+    {
+      "object": "Caret",
+      "reason": "invalidate paint rectangle"
+    },
+    {
+      "object": "LayoutBlockFlow DIV",
+      "reason": "forced by layout"
+    },
+    {
+      "object": "RootInlineBox",
+      "reason": "forced by layout"
+    },
+    {
+      "object": "Caret",
+      "reason": "invalidate paint rectangle"
+    },
+    {
+      "object": "Caret",
+      "reason": "invalidate paint rectangle"
+    },
+    {
+      "object": "LayoutInline SPAN id='test'",
+      "reason": "forced by layout"
+    },
+    {
+      "object": "InlineFlowBox",
+      "reason": "forced by layout"
+    },
+    {
+      "object": "InlineFlowBox",
+      "reason": "forced by layout"
+    },
+    {
+      "object": "LayoutText #text",
+      "reason": "full"
+    },
+    {
+      "object": "InlineTextBox 'Lorem ipsum'",
+      "reason": "full"
+    },
+    {
+      "object": "InlineTextBox ' '",
+      "reason": "full"
+    },
+    {
+      "object": "InlineTextBox 'dolor\u00A0'",
+      "reason": "full"
+    }
+  ]
+}
+

diff --git a/third_party/WebKit/LayoutTests/transitions/interrupted-all-transition-expected.txt b/third_party/WebKit/LayoutTests/transitions/interrupted-all-transition-expected.txt
deleted file mode 100644
index 586e8a2..0000000
--- a/third_party/WebKit/LayoutTests/transitions/interrupted-all-transition-expected.txt
+++ /dev/null

@@ -1,3 +0,0 @@
-Box should start moving left after left style is reset after 500ms
-
-PASS

diff --git a/third_party/WebKit/LayoutTests/transitions/interrupted-all-transition.html b/third_party/WebKit/LayoutTests/transitions/interrupted-all-transition.html
index ba9961aa..5eae7732 100644
--- a/third_party/WebKit/LayoutTests/transitions/interrupted-all-transition.html
+++ b/third_party/WebKit/LayoutTests/transitions/interrupted-all-transition.html

@@ -2,6 +2,9 @@
 
 <html>
 <head>
+  <meta charset="utf-8">
+  <script src="../resources/testharness.js"></script>
+  <script src="../resources/testharnessreport.js"></script>
   <style>
     #container {
       position: relative;
@@ -19,39 +22,46 @@
       transition-timing-function: linear;
     }
   </style>
-  <script>
-    if (window.testRunner) {
-      testRunner.dumpAsText();
-      testRunner.waitUntilDone();
-    }
-
-    function startTransition()
-    {
-      var box = document.getElementById('box');
-      box.style.left = '300px';
-      box.style.opacity = 0.5;
-      window.setTimeout(function() {
-        box.style.left = '0px';
-        
-        window.setTimeout(function() {
-          var boxPos = parseInt(window.getComputedStyle(box).left);
-          document.getElementById('result').innerHTML = (boxPos < 200) ? "PASS" : "FAIL";
-          if (window.testRunner)
-              testRunner.notifyDone();
-        }, 250);
-      }, 500);
-    }
-    window.addEventListener('load', startTransition, false)
-  </script>
 </head>
 <body>
 
-<p>Box should start moving left after left style is reset after 500ms</p>
 <div id="container">
   <div id="box">
   </div>
 </div>
-<div id="result">
-</div>
+  <script>
+    'use strict';
+
+    // It may take a number of frames before the property updates.
+    // https://bugs.chromium.org/p/chromium/issues/detail?id=679981
+    function waitForProgress() {
+      var initialLeft = getComputedStyle(box).left;
+      return new Promise(resolve => {
+        function poll() {
+          var currentLeft = getComputedStyle(box).left;
+          if (currentLeft === initialLeft) {
+            requestAnimationFrame(poll);
+          } else {
+            resolve();
+          }
+        }
+        requestAnimationFrame(poll);
+      });
+    }
+
+    async_test(t => {
+      box.offsetTop; // Force style recalc
+      box.style.left = '300px';
+      box.style.opacity = 0.5;
+      var previousLeft;
+      waitForProgress().then(() => {
+        previousLeft = getComputedStyle(box).left;
+        box.style.left = '0px';
+      }).then(waitForProgress).then(t.step_func_done(() => {
+        var currentLeft = getComputedStyle(box).left;
+        assert_less_than(parseFloat(currentLeft), parseFloat(previousLeft));
+      }));
+    }, 'Box should start moving left after left style is reset');
+  </script>
 </body>
 </html>

diff --git a/third_party/WebKit/Source/bindings/templates/interface.h.tmpl b/third_party/WebKit/Source/bindings/templates/interface.h.tmpl
index e727476..5fd5568 100644
--- a/third_party/WebKit/Source/bindings/templates/interface.h.tmpl
+++ b/third_party/WebKit/Source/bindings/templates/interface.h.tmpl

@@ -139,6 +139,8 @@
   {% if unscopables or has_conditional_attributes_on_prototype or
         methods | conditionally_exposed(is_partial) %}
   {{exported}}static void preparePrototypeAndInterfaceObject(v8::Local<v8::Context>, const DOMWrapperWorld&, v8::Local<v8::Object> prototypeObject, v8::Local<v8::Function> interfaceObject, v8::Local<v8::FunctionTemplate> interfaceTemplate);
+  {% elif has_partial_interface %}
+  {{exported}}static void preparePrototypeAndInterfaceObject(v8::Local<v8::Context>, const DOMWrapperWorld&, v8::Local<v8::Object> prototypeObject, v8::Local<v8::Function> interfaceObject, v8::Local<v8::FunctionTemplate> interfaceTemplate) {}
   {% endif %}
   {% if has_partial_interface %}
   {{exported}}static void updateWrapperTypeInfo(InstallTemplateFunction, PreparePrototypeAndInterfaceObjectFunction);

diff --git a/third_party/WebKit/Source/bindings/templates/partial_interface.cpp.tmpl b/third_party/WebKit/Source/bindings/templates/partial_interface.cpp.tmpl
index d337c72..c627064a 100644
--- a/third_party/WebKit/Source/bindings/templates/partial_interface.cpp.tmpl
+++ b/third_party/WebKit/Source/bindings/templates/partial_interface.cpp.tmpl

@@ -16,7 +16,6 @@
 {% from 'methods.cpp.tmpl' import install_conditionally_enabled_methods with context %}
 {% if has_prepare_prototype_and_interface_object %}
 void {{v8_class_or_partial}}::preparePrototypeAndInterfaceObject(v8::Local<v8::Context> context, const DOMWrapperWorld& world, v8::Local<v8::Object> prototypeObject, v8::Local<v8::Function> interfaceObject, v8::Local<v8::FunctionTemplate> interfaceTemplate) {
-#error No one is currently using a partial interface with context-dependent properties.  If you\'re planning to use it, please consult with the binding team: <blink-reviews-bindings@chromium.org>
   {{v8_class}}::preparePrototypeAndInterfaceObject(context, world, prototypeObject, interfaceObject, interfaceTemplate);
   v8::Isolate* isolate = context->GetIsolate();
 {% if unscopables %}

diff --git a/third_party/WebKit/Source/bindings/tests/results/core/V8TestInterface2.h b/third_party/WebKit/Source/bindings/tests/results/core/V8TestInterface2.h
index 951f741af..502ac52 100644
--- a/third_party/WebKit/Source/bindings/tests/results/core/V8TestInterface2.h
+++ b/third_party/WebKit/Source/bindings/tests/results/core/V8TestInterface2.h

@@ -44,6 +44,7 @@
   static void visitDOMWrapper(v8::Isolate*, ScriptWrappable*, const v8::Persistent<v8::Object>&);
   static void constructorCallback(const v8::FunctionCallbackInfo<v8::Value>&);
   static const int internalFieldCount = v8DefaultWrapperInternalFieldCount + 0;
+  CORE_EXPORT static void preparePrototypeAndInterfaceObject(v8::Local<v8::Context>, const DOMWrapperWorld&, v8::Local<v8::Object> prototypeObject, v8::Local<v8::Function> interfaceObject, v8::Local<v8::FunctionTemplate> interfaceTemplate) {}
   CORE_EXPORT static void updateWrapperTypeInfo(InstallTemplateFunction, PreparePrototypeAndInterfaceObjectFunction);
   CORE_EXPORT static void installV8TestInterface2Template(v8::Isolate*, const DOMWrapperWorld&, v8::Local<v8::FunctionTemplate> interfaceTemplate);
 

diff --git a/third_party/WebKit/Source/bindings/tests/results/modules/V8TestInterfacePartial.cpp b/third_party/WebKit/Source/bindings/tests/results/modules/V8TestInterfacePartial.cpp
index 2a8e674..539b8e5 100644
--- a/third_party/WebKit/Source/bindings/tests/results/modules/V8TestInterfacePartial.cpp
+++ b/third_party/WebKit/Source/bindings/tests/results/modules/V8TestInterfacePartial.cpp

@@ -429,7 +429,6 @@
 }
 
 void V8TestInterfacePartial::preparePrototypeAndInterfaceObject(v8::Local<v8::Context> context, const DOMWrapperWorld& world, v8::Local<v8::Object> prototypeObject, v8::Local<v8::Function> interfaceObject, v8::Local<v8::FunctionTemplate> interfaceTemplate) {
-#error No one is currently using a partial interface with context-dependent properties.  If you\'re planning to use it, please consult with the binding team: <blink-reviews-bindings@chromium.org>
   V8TestInterface::preparePrototypeAndInterfaceObject(context, world, prototypeObject, interfaceObject, interfaceTemplate);
   v8::Isolate* isolate = context->GetIsolate();
   v8::Local<v8::Name> unscopablesSymbol(v8::Symbol::GetUnscopables(isolate));

diff --git a/third_party/WebKit/Source/core/css/BUILD.gn b/third_party/WebKit/Source/core/css/BUILD.gn
index 4572592..1b0fde1 100644
--- a/third_party/WebKit/Source/core/css/BUILD.gn
+++ b/third_party/WebKit/Source/core/css/BUILD.gn

@@ -349,6 +349,11 @@
     "properties/CSSPropertyAPIColumnGap.cpp",
     "properties/CSSPropertyAPIFlexBasis.cpp",
     "properties/CSSPropertyAPIFontSizeAdjust.cpp",
+    "properties/CSSPropertyAPIFontVariationSettings.cpp",
+    "properties/CSSPropertyAPIOffsetPosition.cpp",
+    "properties/CSSPropertyAPIOutlineOffset.cpp",
+    "properties/CSSPropertyAPIPage.cpp",
+    "properties/CSSPropertyAPIPaintOrder.cpp",
     "properties/CSSPropertyAPISize.cpp",
     "properties/CSSPropertyAPITextDecorationColor.cpp",
     "properties/CSSPropertyAPITextDecorationSkip.cpp",

diff --git a/third_party/WebKit/Source/core/css/CSSProperties.in b/third_party/WebKit/Source/core/css/CSSProperties.in
index 5422ee3..35d82d4 100644
--- a/third_party/WebKit/Source/core/css/CSSProperties.in
+++ b/third_party/WebKit/Source/core/css/CSSProperties.in

@@ -174,7 +174,7 @@
 font-variant-numeric inherited, font, name_for_methods=VariantNumeric, converter=convertFontVariantNumeric
 font-weight interpolable, inherited, font, type_name=FontWeight, name_for_methods=Weight, converter=convertFontWeight
 font-feature-settings inherited, font, name_for_methods=FeatureSettings, converter=convertFontFeatureSettings
-font-variation-settings runtime_flag=CSSVariableFonts, inherited, font, name_for_methods=VariationSettings, converter=convertFontVariationSettings
+font-variation-settings runtime_flag=CSSVariableFonts, inherited, font, name_for_methods=VariationSettings, converter=convertFontVariationSettings, api_class
 -webkit-font-smoothing inherited, font, type_name=FontSmoothingMode
 -webkit-locale inherited, font, custom_value
 text-orientation inherited, custom_value, type_name=TextOrientation
@@ -314,14 +314,14 @@
 offset-anchor runtime_flag=CSSOffsetPositionAnchor, interpolable, converter=convertPositionOrAuto
 offset-distance interpolable, converter=convertLength
 offset-path converter=convertPathOrNone
-offset-position runtime_flag=CSSOffsetPositionAnchor, interpolable, converter=convertPositionOrAuto
+offset-position runtime_flag=CSSOffsetPositionAnchor, interpolable, converter=convertPositionOrAuto, api_class
 offset-rotate runtime_flag=CSSOffsetRotate, interpolable, converter=convertOffsetRotate
 offset-rotation runtime_flag=CSSOffsetRotation, interpolable, converter=convertOffsetRotate
 opacity interpolable, type_name=float
 order type_name=int
 orphans interpolable, inherited, type_name=short
 outline-color interpolable, custom_all
-outline-offset interpolable, converter=convertComputedLength<int>
+outline-offset interpolable, converter=convertComputedLength<int>, api_class
 outline-style custom_all
 outline-width interpolable, converter=convertLineWidth<unsigned short>
 overflow-anchor runtime_flag=ScrollAnchoring, type_name=EOverflowAnchor
@@ -332,7 +332,7 @@
 padding-left interpolable, initial=initialPadding, converter=convertLength
 padding-right interpolable, initial=initialPadding, converter=convertLength
 padding-top interpolable, initial=initialPadding, converter=convertLength
-paint-order inherited, svg, converter=convertPaintOrder
+paint-order inherited, svg, converter=convertPaintOrder, api_class
 perspective interpolable, converter=convertPerspective
 perspective-origin interpolable, converter=convertPosition
 pointer-events inherited, independent, keyword_only, keywords=[none|auto|stroke|fill|painted|visible|visibleStroke|visibleFill|visiblePainted|bounding-box|all], initial_keyword=auto
@@ -516,7 +516,7 @@
 // TODO(timloh): This seems wrong, most of these shouldn't reach the StyleBuilder
 
 all builder_skip
-page builder_skip
+page builder_skip, api_class
 -webkit-font-size-delta builder_skip
 -webkit-text-decorations-in-effect inherited, builder_skip
 

diff --git a/third_party/WebKit/Source/core/css/parser/CSSPropertyParser.cpp b/third_party/WebKit/Source/core/css/parser/CSSPropertyParser.cpp
index 1627bc5..6072468 100644
--- a/third_party/WebKit/Source/core/css/parser/CSSPropertyParser.cpp
+++ b/third_party/WebKit/Source/core/css/parser/CSSPropertyParser.cpp

@@ -329,51 +329,6 @@
   return settings;
 }
 
-static CSSFontVariationValue* consumeFontVariationTag(
-    CSSParserTokenRange& range) {
-  // Feature tag name consists of 4-letter characters.
-  static const unsigned tagNameLength = 4;
-
-  const CSSParserToken& token = range.consumeIncludingWhitespace();
-  // Feature tag name comes first
-  if (token.type() != StringToken)
-    return nullptr;
-  if (token.value().length() != tagNameLength)
-    return nullptr;
-  AtomicString tag = token.value().toAtomicString();
-  for (unsigned i = 0; i < tagNameLength; ++i) {
-    // Limits the range of characters to 0x20-0x7E, following the tag name rules
-    // defined in the OpenType specification.
-    UChar character = tag[i];
-    if (character < 0x20 || character > 0x7E)
-      return nullptr;
-  }
-
-  double tagValue = 0;
-  if (!consumeNumberRaw(range, tagValue))
-    return nullptr;
-  return CSSFontVariationValue::create(tag, clampTo<float>(tagValue));
-}
-
-static CSSValue* consumeFontVariationSettings(CSSParserTokenRange& range) {
-  if (range.peek().id() == CSSValueNormal)
-    return consumeIdent(range);
-  CSSValueList* variationSettings = CSSValueList::createCommaSeparated();
-  do {
-    CSSFontVariationValue* fontVariationValue = consumeFontVariationTag(range);
-    if (!fontVariationValue)
-      return nullptr;
-    variationSettings->append(*fontVariationValue);
-  } while (consumeCommaIncludingWhitespace(range));
-  return variationSettings;
-}
-
-static CSSValue* consumePage(CSSParserTokenRange& range) {
-  if (range.peek().id() == CSSValueAuto)
-    return consumeIdent(range);
-  return consumeCustomIdent(range);
-}
-
 static CSSValue* consumeQuotes(CSSParserTokenRange& range) {
   if (range.peek().id() == CSSValueNone)
     return consumeIdent(range);
@@ -1479,21 +1434,6 @@
   return consumePosition(range, cssParserMode, UnitlessQuirk::Forbid);
 }
 
-static CSSValue* consumeOffsetPosition(CSSParserTokenRange& range,
-                                       CSSParserMode cssParserMode,
-                                       UseCounter* useCounter) {
-  CSSValueID id = range.peek().id();
-  if (id == CSSValueAuto)
-    return consumeIdent(range);
-  CSSValue* value =
-      consumePosition(range, cssParserMode, UnitlessQuirk::Forbid);
-
-  // Count when we receive a valid position other than 'auto'.
-  if (useCounter && value && value->isValuePair())
-    useCounter->count(UseCounter::CSSOffsetInEffect);
-  return value;
-}
-
 static CSSValue* consumeOffsetPath(CSSParserTokenRange& range,
                                    UseCounter* useCounter,
                                    bool isMotionPath) {
@@ -1816,56 +1756,6 @@
   return consumeColor(range, cssParserMode);
 }
 
-static CSSValue* consumePaintOrder(CSSParserTokenRange& range) {
-  if (range.peek().id() == CSSValueNormal)
-    return consumeIdent(range);
-
-  Vector<CSSValueID, 3> paintTypeList;
-  CSSIdentifierValue* fill = nullptr;
-  CSSIdentifierValue* stroke = nullptr;
-  CSSIdentifierValue* markers = nullptr;
-  do {
-    CSSValueID id = range.peek().id();
-    if (id == CSSValueFill && !fill)
-      fill = consumeIdent(range);
-    else if (id == CSSValueStroke && !stroke)
-      stroke = consumeIdent(range);
-    else if (id == CSSValueMarkers && !markers)
-      markers = consumeIdent(range);
-    else
-      return nullptr;
-    paintTypeList.push_back(id);
-  } while (!range.atEnd());
-
-  // After parsing we serialize the paint-order list. Since it is not possible
-  // to pop a last list items from CSSValueList without bigger cost, we create
-  // the list after parsing.
-  CSSValueID firstPaintOrderType = paintTypeList.at(0);
-  CSSValueList* paintOrderList = CSSValueList::createSpaceSeparated();
-  switch (firstPaintOrderType) {
-    case CSSValueFill:
-    case CSSValueStroke:
-      paintOrderList->append(firstPaintOrderType == CSSValueFill ? *fill
-                                                                 : *stroke);
-      if (paintTypeList.size() > 1) {
-        if (paintTypeList.at(1) == CSSValueMarkers)
-          paintOrderList->append(*markers);
-      }
-      break;
-    case CSSValueMarkers:
-      paintOrderList->append(*markers);
-      if (paintTypeList.size() > 1) {
-        if (paintTypeList.at(1) == CSSValueStroke)
-          paintOrderList->append(*stroke);
-      }
-      break;
-    default:
-      ASSERT_NOT_REACHED();
-  }
-
-  return paintOrderList;
-}
-
 static CSSValue* consumeNoneOrURI(CSSParserTokenRange& range) {
   if (range.peek().id() == CSSValueNone)
     return consumeIdent(range);
@@ -3282,8 +3172,6 @@
     return cssPropertyDesc.parseSingleValue(m_range, m_context);
 
   switch (property) {
-    case CSSPropertyPage:
-      return consumePage(m_range);
     case CSSPropertyQuotes:
       return consumeQuotes(m_range);
     case CSSPropertyWebkitHighlight:
@@ -3298,9 +3186,6 @@
       return consumeFontFeatureSettings(m_range);
     case CSSPropertyFontFamily:
       return consumeFontFamily(m_range);
-    case CSSPropertyFontVariationSettings:
-      DCHECK(RuntimeEnabledFeatures::cssVariableFontsEnabled());
-      return consumeFontVariationSettings(m_range);
     case CSSPropertyFontWeight:
       return consumeFontWeight(m_range);
     case CSSPropertyLetterSpacing:
@@ -3483,9 +3368,6 @@
       return consumeTextDecorationLine(m_range);
     case CSSPropertyOffsetAnchor:
       return consumeOffsetAnchor(m_range, m_context.mode());
-    case CSSPropertyOffsetPosition:
-      return consumeOffsetPosition(m_range, m_context.mode(),
-                                   m_context.useCounter());
     case CSSPropertyD:
       return consumePathOrNone(m_range);
     case CSSPropertyOffsetPath:
@@ -3502,8 +3384,6 @@
       return consumeTextEmphasisStyle(m_range);
     case CSSPropertyOutlineColor:
       return consumeOutlineColor(m_range, m_context.mode());
-    case CSSPropertyOutlineOffset:
-      return consumeLength(m_range, m_context.mode(), ValueRangeAll);
     case CSSPropertyOutlineWidth:
       return consumeLineWidth(m_range, m_context.mode(), UnitlessQuirk::Forbid);
     case CSSPropertyTransform:
@@ -3519,8 +3399,6 @@
     case CSSPropertyFill:
     case CSSPropertyStroke:
       return consumePaintStroke(m_range, m_context.mode());
-    case CSSPropertyPaintOrder:
-      return consumePaintOrder(m_range);
     case CSSPropertyMarkerStart:
     case CSSPropertyMarkerMid:
     case CSSPropertyMarkerEnd:

diff --git a/third_party/WebKit/Source/core/css/properties/CSSPropertyAPIFontVariationSettings.cpp b/third_party/WebKit/Source/core/css/properties/CSSPropertyAPIFontVariationSettings.cpp
new file mode 100644
index 0000000..90974388
--- /dev/null
+++ b/third_party/WebKit/Source/core/css/properties/CSSPropertyAPIFontVariationSettings.cpp

@@ -0,0 +1,60 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "core/css/properties/CSSPropertyAPIFontVariationSettings.h"
+
+#include "core/css/CSSFontVariationValue.h"
+#include "core/css/CSSValueList.h"
+#include "core/css/parser/CSSParserContext.h"
+#include "core/css/parser/CSSPropertyParserHelpers.h"
+#include "platform/RuntimeEnabledFeatures.h"
+
+namespace blink {
+
+namespace {
+
+CSSFontVariationValue* consumeFontVariationTag(CSSParserTokenRange& range) {
+  // Feature tag name consists of 4-letter characters.
+  static const unsigned tagNameLength = 4;
+
+  const CSSParserToken& token = range.consumeIncludingWhitespace();
+  // Feature tag name comes first
+  if (token.type() != StringToken)
+    return nullptr;
+  if (token.value().length() != tagNameLength)
+    return nullptr;
+  AtomicString tag = token.value().toAtomicString();
+  for (unsigned i = 0; i < tagNameLength; ++i) {
+    // Limits the range of characters to 0x20-0x7E, following the tag name rules
+    // defined in the OpenType specification.
+    UChar character = tag[i];
+    if (character < 0x20 || character > 0x7E)
+      return nullptr;
+  }
+
+  double tagValue = 0;
+  if (!CSSPropertyParserHelpers::consumeNumberRaw(range, tagValue))
+    return nullptr;
+  return CSSFontVariationValue::create(tag, clampTo<float>(tagValue));
+}
+
+}  // namespace
+
+const CSSValue* CSSPropertyAPIFontVariationSettings::parseSingleValue(
+    CSSParserTokenRange& range,
+    const CSSParserContext& context) {
+  DCHECK(RuntimeEnabledFeatures::cssVariableFontsEnabled());
+  if (range.peek().id() == CSSValueNormal)
+    return CSSPropertyParserHelpers::consumeIdent(range);
+  CSSValueList* variationSettings = CSSValueList::createCommaSeparated();
+  do {
+    CSSFontVariationValue* fontVariationValue = consumeFontVariationTag(range);
+    if (!fontVariationValue)
+      return nullptr;
+    variationSettings->append(*fontVariationValue);
+  } while (CSSPropertyParserHelpers::consumeCommaIncludingWhitespace(range));
+  return variationSettings;
+}
+
+}  // namespace blink

diff --git a/third_party/WebKit/Source/core/css/properties/CSSPropertyAPIOffsetPosition.cpp b/third_party/WebKit/Source/core/css/properties/CSSPropertyAPIOffsetPosition.cpp
new file mode 100644
index 0000000..74f2eb7
--- /dev/null
+++ b/third_party/WebKit/Source/core/css/properties/CSSPropertyAPIOffsetPosition.cpp

@@ -0,0 +1,29 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "core/css/properties/CSSPropertyAPIOffsetPosition.h"
+
+#include "core/css/CSSValuePair.h"
+#include "core/css/parser/CSSParserContext.h"
+#include "core/css/parser/CSSPropertyParserHelpers.h"
+#include "core/frame/UseCounter.h"
+
+namespace blink {
+
+const CSSValue* CSSPropertyAPIOffsetPosition::parseSingleValue(
+    CSSParserTokenRange& range,
+    const CSSParserContext& context) {
+  CSSValueID id = range.peek().id();
+  if (id == CSSValueAuto)
+    return CSSPropertyParserHelpers::consumeIdent(range);
+  CSSValue* value = CSSPropertyParserHelpers::consumePosition(
+      range, context.mode(), CSSPropertyParserHelpers::UnitlessQuirk::Forbid);
+
+  // Count when we receive a valid position other than 'auto'.
+  if (context.useCounter() && value && value->isValuePair())
+    context.useCounter()->count(UseCounter::CSSOffsetInEffect);
+  return value;
+}
+
+}  // namespace blink

diff --git a/third_party/WebKit/Source/core/css/properties/CSSPropertyAPIOutlineOffset.cpp b/third_party/WebKit/Source/core/css/properties/CSSPropertyAPIOutlineOffset.cpp
new file mode 100644
index 0000000..21d7f16
--- /dev/null
+++ b/third_party/WebKit/Source/core/css/properties/CSSPropertyAPIOutlineOffset.cpp

@@ -0,0 +1,19 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "core/css/properties/CSSPropertyAPIOutlineOffset.h"
+
+#include "core/css/parser/CSSParserContext.h"
+#include "core/css/parser/CSSPropertyParserHelpers.h"
+
+namespace blink {
+
+const CSSValue* CSSPropertyAPIOutlineOffset::parseSingleValue(
+    CSSParserTokenRange& range,
+    const CSSParserContext& context) {
+  return CSSPropertyParserHelpers::consumeLength(range, context.mode(),
+                                                 ValueRangeAll);
+}
+
+}  // namespace blink

diff --git a/third_party/WebKit/Source/core/css/properties/CSSPropertyAPIPage.cpp b/third_party/WebKit/Source/core/css/properties/CSSPropertyAPIPage.cpp
new file mode 100644
index 0000000..ada74f5
--- /dev/null
+++ b/third_party/WebKit/Source/core/css/properties/CSSPropertyAPIPage.cpp

@@ -0,0 +1,19 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "core/css/properties/CSSPropertyAPIPage.h"
+
+#include "core/css/parser/CSSPropertyParserHelpers.h"
+
+namespace blink {
+
+const CSSValue* CSSPropertyAPIPage::parseSingleValue(
+    CSSParserTokenRange& range,
+    const CSSParserContext& context) {
+  if (range.peek().id() == CSSValueAuto)
+    return CSSPropertyParserHelpers::consumeIdent(range);
+  return CSSPropertyParserHelpers::consumeCustomIdent(range);
+}
+
+}  // namespace blink

diff --git a/third_party/WebKit/Source/core/css/properties/CSSPropertyAPIPaintOrder.cpp b/third_party/WebKit/Source/core/css/properties/CSSPropertyAPIPaintOrder.cpp
new file mode 100644
index 0000000..2b3e708
--- /dev/null
+++ b/third_party/WebKit/Source/core/css/properties/CSSPropertyAPIPaintOrder.cpp

@@ -0,0 +1,64 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "core/css/properties/CSSPropertyAPIPaintOrder.h"
+
+#include "core/css/CSSValueList.h"
+#include "core/css/parser/CSSPropertyParserHelpers.h"
+
+namespace blink {
+
+const CSSValue* CSSPropertyAPIPaintOrder::parseSingleValue(
+    CSSParserTokenRange& range,
+    const CSSParserContext& context) {
+  if (range.peek().id() == CSSValueNormal)
+    return CSSPropertyParserHelpers::consumeIdent(range);
+
+  Vector<CSSValueID, 3> paintTypeList;
+  CSSIdentifierValue* fill = nullptr;
+  CSSIdentifierValue* stroke = nullptr;
+  CSSIdentifierValue* markers = nullptr;
+  do {
+    CSSValueID id = range.peek().id();
+    if (id == CSSValueFill && !fill)
+      fill = CSSPropertyParserHelpers::consumeIdent(range);
+    else if (id == CSSValueStroke && !stroke)
+      stroke = CSSPropertyParserHelpers::consumeIdent(range);
+    else if (id == CSSValueMarkers && !markers)
+      markers = CSSPropertyParserHelpers::consumeIdent(range);
+    else
+      return nullptr;
+    paintTypeList.push_back(id);
+  } while (!range.atEnd());
+
+  // After parsing we serialize the paint-order list. Since it is not possible
+  // to pop a last list items from CSSValueList without bigger cost, we create
+  // the list after parsing.
+  CSSValueID firstPaintOrderType = paintTypeList.at(0);
+  CSSValueList* paintOrderList = CSSValueList::createSpaceSeparated();
+  switch (firstPaintOrderType) {
+    case CSSValueFill:
+    case CSSValueStroke:
+      paintOrderList->append(firstPaintOrderType == CSSValueFill ? *fill
+                                                                 : *stroke);
+      if (paintTypeList.size() > 1) {
+        if (paintTypeList.at(1) == CSSValueMarkers)
+          paintOrderList->append(*markers);
+      }
+      break;
+    case CSSValueMarkers:
+      paintOrderList->append(*markers);
+      if (paintTypeList.size() > 1) {
+        if (paintTypeList.at(1) == CSSValueStroke)
+          paintOrderList->append(*stroke);
+      }
+      break;
+    default:
+      NOTREACHED();
+  }
+
+  return paintOrderList;
+}
+
+}  // namespace blink

diff --git a/third_party/WebKit/Source/core/dom/DOMException.h b/third_party/WebKit/Source/core/dom/DOMException.h
index 28aa709a..a9d274b 100644
--- a/third_party/WebKit/Source/core/dom/DOMException.h
+++ b/third_party/WebKit/Source/core/dom/DOMException.h

@@ -31,14 +31,13 @@
 
 #include "bindings/core/v8/ScriptWrappable.h"
 #include "core/CoreExport.h"
+#include "core/dom/ExceptionCode.h"
 #include "platform/heap/Handle.h"
 #include "wtf/Forward.h"
 #include "wtf/text/WTFString.h"
 
 namespace blink {
 
-typedef int ExceptionCode;
-
 class CORE_EXPORT DOMException final
     : public GarbageCollectedFinalized<DOMException>,
       public ScriptWrappable {

diff --git a/third_party/WebKit/Source/core/dom/Document.cpp b/third_party/WebKit/Source/core/dom/Document.cpp
index d9c8b0f81..c4e9e77 100644
--- a/third_party/WebKit/Source/core/dom/Document.cpp
+++ b/third_party/WebKit/Source/core/dom/Document.cpp

@@ -121,7 +121,6 @@
 #include "core/dom/shadow/FlatTreeTraversal.h"
 #include "core/dom/shadow/ShadowRoot.h"
 #include "core/editing/EditingUtilities.h"
-#include "core/editing/Editor.h"
 #include "core/editing/FrameSelection.h"
 #include "core/editing/markers/DocumentMarkerController.h"
 #include "core/editing/serializers/Serialization.h"
@@ -4956,116 +4955,6 @@
   return baseURLFromParent ? *baseURLFromParent : baseURLOverride;
 }
 
-// Support for Javascript execCommand, and related methods
-
-static Editor::Command command(Document* document, const String& commandName) {
-  LocalFrame* frame = document->frame();
-  if (!frame || frame->document() != document)
-    return Editor::Command();
-
-  document->updateStyleAndLayoutTree();
-  return frame->editor().createCommandFromDOM(commandName);
-}
-
-bool Document::execCommand(const String& commandName,
-                           bool,
-                           const String& value,
-                           ExceptionState& exceptionState) {
-  if (!isHTMLDocument() && !isXHTMLDocument()) {
-    exceptionState.throwDOMException(
-        InvalidStateError, "execCommand is only supported on HTML documents.");
-    return false;
-  }
-  if (focusedElement() && isTextControlElement(*focusedElement()))
-    UseCounter::count(*this, UseCounter::ExecCommandOnInputOrTextarea);
-
-  // We don't allow recursive |execCommand()| to protect against attack code.
-  // Recursive call of |execCommand()| could be happened by moving iframe
-  // with script triggered by insertion, e.g. <iframe src="javascript:...">
-  // <iframe onload="...">. This usage is valid as of the specification
-  // although, it isn't common use case, rather it is used as attack code.
-  if (m_isRunningExecCommand) {
-    String message =
-        "We don't execute document.execCommand() this time, because it is "
-        "called recursively.";
-    addConsoleMessage(
-        ConsoleMessage::create(JSMessageSource, WarningMessageLevel, message));
-    return false;
-  }
-  AutoReset<bool> executeScope(&m_isRunningExecCommand, true);
-
-  // Postpone DOM mutation events, which can execute scripts and change
-  // DOM tree against implementation assumption.
-  EventQueueScope eventQueueScope;
-  Editor::tidyUpHTMLStructure(*this);
-  Editor::Command editorCommand = command(this, commandName);
-
-  DEFINE_STATIC_LOCAL(SparseHistogram, editorCommandHistogram,
-                      ("WebCore.Document.execCommand"));
-  editorCommandHistogram.sample(editorCommand.idForHistogram());
-  return editorCommand.execute(value);
-}
-
-bool Document::queryCommandEnabled(const String& commandName,
-                                   ExceptionState& exceptionState) {
-  if (!isHTMLDocument() && !isXHTMLDocument()) {
-    exceptionState.throwDOMException(
-        InvalidStateError,
-        "queryCommandEnabled is only supported on HTML documents.");
-    return false;
-  }
-
-  return command(this, commandName).isEnabled();
-}
-
-bool Document::queryCommandIndeterm(const String& commandName,
-                                    ExceptionState& exceptionState) {
-  if (!isHTMLDocument() && !isXHTMLDocument()) {
-    exceptionState.throwDOMException(
-        InvalidStateError,
-        "queryCommandIndeterm is only supported on HTML documents.");
-    return false;
-  }
-
-  return command(this, commandName).state() == MixedTriState;
-}
-
-bool Document::queryCommandState(const String& commandName,
-                                 ExceptionState& exceptionState) {
-  if (!isHTMLDocument() && !isXHTMLDocument()) {
-    exceptionState.throwDOMException(
-        InvalidStateError,
-        "queryCommandState is only supported on HTML documents.");
-    return false;
-  }
-
-  return command(this, commandName).state() == TrueTriState;
-}
-
-bool Document::queryCommandSupported(const String& commandName,
-                                     ExceptionState& exceptionState) {
-  if (!isHTMLDocument() && !isXHTMLDocument()) {
-    exceptionState.throwDOMException(
-        InvalidStateError,
-        "queryCommandSupported is only supported on HTML documents.");
-    return false;
-  }
-
-  return command(this, commandName).isSupported();
-}
-
-String Document::queryCommandValue(const String& commandName,
-                                   ExceptionState& exceptionState) {
-  if (!isHTMLDocument() && !isXHTMLDocument()) {
-    exceptionState.throwDOMException(
-        InvalidStateError,
-        "queryCommandValue is only supported on HTML documents.");
-    return "";
-  }
-
-  return command(this, commandName).value();
-}
-
 KURL Document::openSearchDescriptionURL() {
   static const char openSearchMIMEType[] =
       "application/opensearchdescription+xml";

diff --git a/third_party/WebKit/Source/core/dom/Document.h b/third_party/WebKit/Source/core/dom/Document.h
index 47df5cc4..ba840580 100644
--- a/third_party/WebKit/Source/core/dom/Document.h
+++ b/third_party/WebKit/Source/core/dom/Document.h

@@ -903,6 +903,8 @@
 
   DocumentMarkerController& markers() const { return *m_markers; }
 
+  // Support for Javascript execCommand, and related methods
+  // See "core/editing/commands/DocumentExecCommand.cpp" for implementations.
   bool execCommand(const String& command,
                    bool showUI,
                    const String& value,

diff --git a/third_party/WebKit/Source/core/editing/BUILD.gn b/third_party/WebKit/Source/core/editing/BUILD.gn
index 157594e..f3906a5 100644
--- a/third_party/WebKit/Source/core/editing/BUILD.gn
+++ b/third_party/WebKit/Source/core/editing/BUILD.gn

@@ -80,6 +80,7 @@
     "commands/DeleteFromTextNodeCommand.h",
     "commands/DeleteSelectionCommand.cpp",
     "commands/DeleteSelectionCommand.h",
+    "commands/DocumentExecCommand.cpp",
     "commands/DragAndDropCommand.cpp",
     "commands/DragAndDropCommand.h",
     "commands/EditCommand.cpp",

diff --git a/third_party/WebKit/Source/core/editing/Editor.cpp b/third_party/WebKit/Source/core/editing/Editor.cpp
index 84b695c..df9b6b2 100644
--- a/third_party/WebKit/Source/core/editing/Editor.cpp
+++ b/third_party/WebKit/Source/core/editing/Editor.cpp

@@ -858,6 +858,14 @@
       composition->startingRootEditableElement(),
       composition->endingRootEditableElement(), cmd->inputType(),
       cmd->textDataForInputEvent(), isComposingFromCommand(cmd));
+
+  // TODO(editing-dev): The use of updateStyleAndLayoutIgnorePendingStylesheets
+  // needs to be audited.  See http://crbug.com/590369 for more details.
+  // The clean layout is consumed by |mostBackwardCaretPosition|, called through
+  // |changeSelectionAfterCommand|. In the long term, we should postpone visible
+  // selection canonicalization so that selection update does not need layout.
+  frame().document()->updateStyleAndLayoutIgnorePendingStylesheets();
+
   VisibleSelection newSelection(cmd->endingSelection());
 
   // Don't clear the typing style with this selection change. We do those things

diff --git a/third_party/WebKit/Source/core/editing/SelectionTemplate.cpp b/third_party/WebKit/Source/core/editing/SelectionTemplate.cpp
index c901ce7..d3652e7 100644
--- a/third_party/WebKit/Source/core/editing/SelectionTemplate.cpp
+++ b/third_party/WebKit/Source/core/editing/SelectionTemplate.cpp

@@ -103,6 +103,27 @@
 }
 #endif
 
+#ifndef NDEBUG
+template <typename Strategy>
+void SelectionTemplate<Strategy>::showTreeForThis() const {
+  if (m_base.isNull()) {
+    LOG(INFO) << "\nbase is null";
+    return;
+  }
+
+  LOG(INFO) << "\n"
+            << m_base.anchorNode()
+                   ->toMarkedTreeString(m_base.anchorNode(), "B",
+                                        m_extent.anchorNode(), "E")
+                   .utf8()
+                   .data()
+            << "base: " << m_base.toAnchorTypeAndOffsetString().utf8().data()
+            << "\n"
+            << "extent: "
+            << m_extent.toAnchorTypeAndOffsetString().utf8().data();
+}
+#endif
+
 template <typename Strategy>
 void SelectionTemplate<Strategy>::printTo(std::ostream* ostream,
                                           const char* type) const {

diff --git a/third_party/WebKit/Source/core/editing/SelectionTemplate.h b/third_party/WebKit/Source/core/editing/SelectionTemplate.h
index 0fb5cc5..1d48c2d 100644
--- a/third_party/WebKit/Source/core/editing/SelectionTemplate.h
+++ b/third_party/WebKit/Source/core/editing/SelectionTemplate.h

@@ -100,6 +100,9 @@
   }
 
   void printTo(std::ostream*, const char* type) const;
+#ifndef NDEBUG
+  void showTreeForThis() const;
+#endif
 
  private:
   friend class SelectionEditor;

diff --git a/third_party/WebKit/Source/core/editing/commands/DocumentExecCommand.cpp b/third_party/WebKit/Source/core/editing/commands/DocumentExecCommand.cpp
new file mode 100644
index 0000000..ad57d2c5
--- /dev/null
+++ b/third_party/WebKit/Source/core/editing/commands/DocumentExecCommand.cpp

@@ -0,0 +1,154 @@
+/*
+ * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
+ *           (C) 1999 Antti Koivisto (koivisto@kde.org)
+ *           (C) 2001 Dirk Mueller (mueller@kde.org)
+ *           (C) 2006 Alexey Proskuryakov (ap@webkit.org)
+ * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009, 2011, 2012 Apple Inc. All
+ * rights reserved.
+ * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved.
+ * (http://www.torchmobile.com/)
+ * Copyright (C) 2008, 2009, 2011, 2012 Google Inc. All rights reserved.
+ * Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies)
+ * Copyright (C) Research In Motion Limited 2010-2011. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#include "core/dom/Document.h"
+
+#include "core/editing/Editor.h"
+#include "core/events/ScopedEventQueue.h"
+#include "core/html/TextControlElement.h"
+#include "core/inspector/ConsoleMessage.h"
+#include "platform/Histogram.h"
+#include "wtf/AutoReset.h"
+#include "wtf/StdLibExtras.h"
+
+namespace blink {
+
+namespace {
+
+Editor::Command command(Document* document, const String& commandName) {
+  LocalFrame* frame = document->frame();
+  if (!frame || frame->document() != document)
+    return Editor::Command();
+
+  document->updateStyleAndLayoutTree();
+  return frame->editor().createCommandFromDOM(commandName);
+}
+
+}  // namespace
+
+bool Document::execCommand(const String& commandName,
+                           bool,
+                           const String& value,
+                           ExceptionState& exceptionState) {
+  if (!isHTMLDocument() && !isXHTMLDocument()) {
+    exceptionState.throwDOMException(
+        InvalidStateError, "execCommand is only supported on HTML documents.");
+    return false;
+  }
+  if (focusedElement() && isTextControlElement(*focusedElement()))
+    UseCounter::count(*this, UseCounter::ExecCommandOnInputOrTextarea);
+
+  // We don't allow recursive |execCommand()| to protect against attack code.
+  // Recursive call of |execCommand()| could be happened by moving iframe
+  // with script triggered by insertion, e.g. <iframe src="javascript:...">
+  // <iframe onload="...">. This usage is valid as of the specification
+  // although, it isn't common use case, rather it is used as attack code.
+  if (m_isRunningExecCommand) {
+    String message =
+        "We don't execute document.execCommand() this time, because it is "
+        "called recursively.";
+    addConsoleMessage(
+        ConsoleMessage::create(JSMessageSource, WarningMessageLevel, message));
+    return false;
+  }
+  AutoReset<bool> executeScope(&m_isRunningExecCommand, true);
+
+  // Postpone DOM mutation events, which can execute scripts and change
+  // DOM tree against implementation assumption.
+  EventQueueScope eventQueueScope;
+  Editor::tidyUpHTMLStructure(*this);
+  Editor::Command editorCommand = command(this, commandName);
+
+  DEFINE_STATIC_LOCAL(SparseHistogram, editorCommandHistogram,
+                      ("WebCore.Document.execCommand"));
+  editorCommandHistogram.sample(editorCommand.idForHistogram());
+  return editorCommand.execute(value);
+}
+
+bool Document::queryCommandEnabled(const String& commandName,
+                                   ExceptionState& exceptionState) {
+  if (!isHTMLDocument() && !isXHTMLDocument()) {
+    exceptionState.throwDOMException(
+        InvalidStateError,
+        "queryCommandEnabled is only supported on HTML documents.");
+    return false;
+  }
+
+  return command(this, commandName).isEnabled();
+}
+
+bool Document::queryCommandIndeterm(const String& commandName,
+                                    ExceptionState& exceptionState) {
+  if (!isHTMLDocument() && !isXHTMLDocument()) {
+    exceptionState.throwDOMException(
+        InvalidStateError,
+        "queryCommandIndeterm is only supported on HTML documents.");
+    return false;
+  }
+
+  return command(this, commandName).state() == MixedTriState;
+}
+
+bool Document::queryCommandState(const String& commandName,
+                                 ExceptionState& exceptionState) {
+  if (!isHTMLDocument() && !isXHTMLDocument()) {
+    exceptionState.throwDOMException(
+        InvalidStateError,
+        "queryCommandState is only supported on HTML documents.");
+    return false;
+  }
+
+  return command(this, commandName).state() == TrueTriState;
+}
+
+bool Document::queryCommandSupported(const String& commandName,
+                                     ExceptionState& exceptionState) {
+  if (!isHTMLDocument() && !isXHTMLDocument()) {
+    exceptionState.throwDOMException(
+        InvalidStateError,
+        "queryCommandSupported is only supported on HTML documents.");
+    return false;
+  }
+
+  return command(this, commandName).isSupported();
+}
+
+String Document::queryCommandValue(const String& commandName,
+                                   ExceptionState& exceptionState) {
+  if (!isHTMLDocument() && !isXHTMLDocument()) {
+    exceptionState.throwDOMException(
+        InvalidStateError,
+        "queryCommandValue is only supported on HTML documents.");
+    return "";
+  }
+
+  return command(this, commandName).value();
+}
+
+}  // namespace blink

diff --git a/third_party/WebKit/Source/core/fetch/FetchContext.cpp b/third_party/WebKit/Source/core/fetch/FetchContext.cpp
index 08d3cfb..910b02b 100644
--- a/third_party/WebKit/Source/core/fetch/FetchContext.cpp
+++ b/third_party/WebKit/Source/core/fetch/FetchContext.cpp

@@ -105,12 +105,11 @@
 void FetchContext::addConsoleMessage(const String&,
                                      FetchContext::LogMessageType) const {}
 
-void FetchContext::modifyRequestForCSP(ResourceRequest&) {}
+void FetchContext::populateResourceRequest(Resource::Type,
+                                           const ClientHintsPreferences&,
+                                           const FetchRequest::ResourceWidth&,
+                                           ResourceRequest&) {}
 
-void FetchContext::addClientHintsIfNecessary(FetchRequest&) {}
-
-void FetchContext::addCSPHeaderIfNecessary(Resource::Type, FetchRequest&) {}
-
-void FetchContext::populateRequestData(ResourceRequest&) {}
+void FetchContext::setFirstPartyCookieAndRequestorOrigin(ResourceRequest&) {}
 
 }  // namespace blink

diff --git a/third_party/WebKit/Source/core/fetch/FetchContext.h b/third_party/WebKit/Source/core/fetch/FetchContext.h
index 4de8883..fbc9092 100644
--- a/third_party/WebKit/Source/core/fetch/FetchContext.h
+++ b/third_party/WebKit/Source/core/fetch/FetchContext.h

@@ -44,6 +44,7 @@
 
 namespace blink {
 
+class ClientHintsPreferences;
 class KURL;
 class MHTMLArchive;
 class ResourceError;
@@ -165,10 +166,17 @@
   virtual void addConsoleMessage(const String&,
                                  LogMessageType = LogErrorMessage) const;
   virtual SecurityOrigin* getSecurityOrigin() const { return nullptr; }
-  virtual void modifyRequestForCSP(ResourceRequest&);
-  virtual void addClientHintsIfNecessary(FetchRequest&);
-  virtual void addCSPHeaderIfNecessary(Resource::Type, FetchRequest&);
-  virtual void populateRequestData(ResourceRequest&);
+
+  // Populates the ResourceRequest using the given values and information
+  // stored in the FetchContext implementation. Used by ResourceFetcher to
+  // prepare a ResourceRequest instance at the start of resource loading.
+  virtual void populateResourceRequest(Resource::Type,
+                                       const ClientHintsPreferences&,
+                                       const FetchRequest::ResourceWidth&,
+                                       ResourceRequest&);
+  // Sets the first party for cookies and requestor origin using information
+  // stored in the FetchContext implementation.
+  virtual void setFirstPartyCookieAndRequestorOrigin(ResourceRequest&);
 
   virtual MHTMLArchive* archive() const { return nullptr; }
 

diff --git a/third_party/WebKit/Source/core/fetch/ResourceFetcher.cpp b/third_party/WebKit/Source/core/fetch/ResourceFetcher.cpp
index 449a09b..75d695ce 100644
--- a/third_party/WebKit/Source/core/fetch/ResourceFetcher.cpp
+++ b/third_party/WebKit/Source/core/fetch/ResourceFetcher.cpp

@@ -453,18 +453,19 @@
     FetchRequest& request,
     const ResourceFactory& factory,
     const SubstituteData& substituteData) {
+  ResourceRequest& resourceRequest = request.mutableResourceRequest();
+
   unsigned long identifier = createUniqueIdentifier();
   network_instrumentation::ScopedResourceLoadTracker scopedResourceLoadTracker(
-      identifier, request.resourceRequest());
+      identifier, resourceRequest);
   SCOPED_BLINK_UMA_HISTOGRAM_TIMER("Blink.Fetch.RequestResourceTime");
   DCHECK(request.options().synchronousPolicy == RequestAsynchronously ||
          factory.type() == Resource::Raw ||
          factory.type() == Resource::XSLStyleSheet);
 
-  context().populateRequestData(request.mutableResourceRequest());
-  context().modifyRequestForCSP(request.mutableResourceRequest());
-  context().addClientHintsIfNecessary(request);
-  context().addCSPHeaderIfNecessary(factory.type(), request);
+  context().populateResourceRequest(
+      factory.type(), request.clientHintsPreferences(),
+      request.getResourceWidth(), resourceRequest);
 
   // TODO(dproy): Remove this. http://crbug.com/659666
   TRACE_EVENT1("blink", "ResourceFetcher::requestResource", "url",
@@ -473,15 +474,14 @@
   if (!request.url().isValid())
     return nullptr;
 
-  request.mutableResourceRequest().setPriority(computeLoadPriority(
+  resourceRequest.setPriority(computeLoadPriority(
       factory.type(), request, ResourcePriority::NotVisible));
-  initializeResourceRequest(request.mutableResourceRequest(), factory.type(),
-                            request.defer());
-  network_instrumentation::resourcePrioritySet(
-      identifier, request.resourceRequest().priority());
+  initializeResourceRequest(resourceRequest, factory.type(), request.defer());
+  network_instrumentation::resourcePrioritySet(identifier,
+                                               resourceRequest.priority());
 
   ResourceRequestBlockedReason blockedReason = context().canRequest(
-      factory.type(), request.resourceRequest(),
+      factory.type(), resourceRequest,
       MemoryCache::removeFragmentIdentifierIfNeeded(request.url()),
       request.options(), request.forPreload(), request.getOriginRestriction());
   if (blockedReason != ResourceRequestBlockedReason::None) {
@@ -490,12 +490,12 @@
   }
 
   context().willStartLoadingResource(
-      identifier, request.mutableResourceRequest(), factory.type(),
+      identifier, resourceRequest, factory.type(),
       request.options().initiatorInfo.name, request.forPreload());
   if (!request.url().isValid())
     return nullptr;
 
-  bool isDataUrl = request.resourceRequest().url().protocolIsData();
+  bool isDataUrl = resourceRequest.url().protocolIsData();
   bool isStaticData = isDataUrl || substituteData.isValid() || m_archive;
   Resource* resource(nullptr);
   if (isStaticData) {
@@ -523,7 +523,7 @@
 
   updateMemoryCacheStats(resource, policy, request, factory, isStaticData);
 
-  request.mutableResourceRequest().setAllowStoredCredentials(
+  resourceRequest.setAllowStoredCredentials(
       request.options().allowCredentials == AllowStoredCredentials);
 
   switch (policy) {
@@ -534,7 +534,7 @@
       resource = createResourceForLoading(request, request.charset(), factory);
       break;
     case Revalidate:
-      initializeRevalidation(request.mutableResourceRequest(), resource);
+      initializeRevalidation(resourceRequest, resource);
       break;
     case Use:
       if (resource->isLinkPreload() && !request.isLinkPreload())
@@ -561,9 +561,8 @@
     // promotions. This can happen when a visible image's priority is increased
     // and then another reference to the image is parsed (which would be at a
     // lower priority).
-    if (request.resourceRequest().priority() >
-        resource->resourceRequest().priority())
-      resource->didChangePriority(request.resourceRequest().priority(), 0);
+    if (resourceRequest.priority() > resource->resourceRequest().priority())
+      resource->didChangePriority(resourceRequest.priority(), 0);
   }
 
   // If only the fragment identifiers differ, it is the same resource.

diff --git a/third_party/WebKit/Source/core/frame/Navigator.h b/third_party/WebKit/Source/core/frame/Navigator.h
index db93d09..2792491 100644
--- a/third_party/WebKit/Source/core/frame/Navigator.h
+++ b/third_party/WebKit/Source/core/frame/Navigator.h

@@ -35,8 +35,6 @@
 
 class LocalFrame;
 
-typedef int ExceptionCode;
-
 class CORE_EXPORT Navigator final : public GarbageCollected<Navigator>,
                                     public NavigatorCPU,
                                     public NavigatorID,

diff --git a/third_party/WebKit/Source/core/html/ClassList.h b/third_party/WebKit/Source/core/html/ClassList.h
index 366d289..364162b5 100644
--- a/third_party/WebKit/Source/core/html/ClassList.h
+++ b/third_party/WebKit/Source/core/html/ClassList.h

@@ -36,8 +36,6 @@
 
 class Element;
 
-typedef int ExceptionCode;
-
 class ClassList final : public DOMTokenList {
  public:
   static ClassList* create(Element* element) { return new ClassList(element); }

diff --git a/third_party/WebKit/Source/core/html/HTMLAnchorElement.cpp b/third_party/WebKit/Source/core/html/HTMLAnchorElement.cpp
index 790628c..f8cd9b3 100644
--- a/third_party/WebKit/Source/core/html/HTMLAnchorElement.cpp
+++ b/third_party/WebKit/Source/core/html/HTMLAnchorElement.cpp

@@ -256,11 +256,10 @@
   HTMLElement::attributeChanged(params);
   if (params.reason != AttributeModificationReason::kDirectly)
     return;
-  if (params.name != hrefAttr && isLink())
+  if (params.name != hrefAttr)
     return;
-  if (adjustedFocusedElementInTreeScope() != this)
-    return;
-  blur();
+  if (!isLink() && adjustedFocusedElementInTreeScope() == this)
+    blur();
 }
 
 void HTMLAnchorElement::parseAttribute(

diff --git a/third_party/WebKit/Source/core/html/parser/HTMLPreloadScanner.cpp b/third_party/WebKit/Source/core/html/parser/HTMLPreloadScanner.cpp
index e224331a..c92c9f48 100644
--- a/third_party/WebKit/Source/core/html/parser/HTMLPreloadScanner.cpp
+++ b/third_party/WebKit/Source/core/html/parser/HTMLPreloadScanner.cpp

@@ -51,6 +51,7 @@
 #include "platform/instrumentation/tracing/TraceEvent.h"
 #include "platform/network/mime/ContentType.h"
 #include "platform/network/mime/MIMETypeRegistry.h"
+#include "wtf/Optional.h"
 #include <memory>
 
 namespace blink {
@@ -120,7 +121,7 @@
     return scriptTag.localName();
   if (match(tagImpl, videoTag))
     return videoTag.localName();
-  ASSERT_NOT_REACHED();
+  NOTREACHED();
   return emptyString();
 }
 
@@ -205,13 +206,17 @@
       const ReferrerPolicy documentReferrerPolicy) {
     PreloadRequest::RequestType requestType =
         PreloadRequest::RequestTypePreload;
+    WTF::Optional<Resource::Type> type;
     if (shouldPreconnect()) {
       requestType = PreloadRequest::RequestTypePreconnect;
     } else {
       if (isLinkRelPreload()) {
         requestType = PreloadRequest::RequestTypeLinkRelPreload;
+        type = resourceTypeForLinkPreload();
+        if (type == WTF::nullopt)
+          return nullptr;
       }
-      if (!shouldPreload()) {
+      if (!shouldPreload(type)) {
         return nullptr;
       }
     }
@@ -230,9 +235,8 @@
       resourceWidth.isSet = true;
     }
 
-    Resource::Type type;
-    if (!resourceType(type))
-      return nullptr;
+    if (type == WTF::nullopt)
+      type = resourceType();
 
     // The element's 'referrerpolicy' attribute (if present) takes precedence
     // over the document's referrer policy.
@@ -240,8 +244,9 @@
                                         ? m_referrerPolicy
                                         : documentReferrerPolicy;
     auto request = PreloadRequest::createIfNeeded(
-        initiatorFor(m_tagImpl), position, m_urlToLoad, predictedBaseURL, type,
-        referrerPolicy, resourceWidth, clientHintsPreferences, requestType);
+        initiatorFor(m_tagImpl), position, m_urlToLoad, predictedBaseURL,
+        type.value(), referrerPolicy, resourceWidth, clientHintsPreferences,
+        requestType);
     if (!request)
       return nullptr;
 
@@ -349,8 +354,7 @@
     } else if (match(attributeName, asAttr)) {
       m_asAttributeValue = attributeValue.lower();
     } else if (match(attributeName, typeAttr)) {
-      m_matched &= MIMETypeRegistry::isSupportedStyleSheetMIMEType(
-          ContentType(attributeValue).type());
+      m_typeAttributeValue = attributeValue;
     } else if (!m_referrerPolicySet &&
                match(attributeName, referrerpolicyAttr) &&
                !attributeValue.isNull()) {
@@ -443,25 +447,26 @@
     return m_charset;
   }
 
-  bool resourceType(Resource::Type& type) const {
+  WTF::Optional<Resource::Type> resourceTypeForLinkPreload() const {
+    DCHECK(m_linkIsPreload);
+    return LinkLoader::getResourceTypeFromAsAttribute(m_asAttributeValue);
+  }
+
+  Resource::Type resourceType() const {
     if (match(m_tagImpl, scriptTag)) {
-      type = Resource::Script;
+      return Resource::Script;
     } else if (match(m_tagImpl, imgTag) || match(m_tagImpl, videoTag) ||
                (match(m_tagImpl, inputTag) && m_inputIsImage)) {
-      type = Resource::Image;
+      return Resource::Image;
     } else if (match(m_tagImpl, linkTag) && m_linkIsStyleSheet) {
-      type = Resource::CSSStyleSheet;
+      return Resource::CSSStyleSheet;
     } else if (m_linkIsPreconnect) {
-      type = Resource::Raw;
-    } else if (m_linkIsPreload) {
-      if (!LinkLoader::getResourceTypeFromAsAttribute(m_asAttributeValue, type))
-        return false;
+      return Resource::Raw;
     } else if (match(m_tagImpl, linkTag) && m_linkIsImport) {
-      type = Resource::ImportResource;
-    } else {
-      ASSERT_NOT_REACHED();
+      return Resource::ImportResource;
     }
-    return true;
+    NOTREACHED();
+    return Resource::Raw;
   }
 
   bool shouldPreconnect() const {
@@ -474,14 +479,39 @@
            !m_urlToLoad.isEmpty();
   }
 
-  bool shouldPreload() const {
+  bool shouldPreloadLink(WTF::Optional<Resource::Type>& type) const {
+    if (m_linkIsStyleSheet) {
+      return m_typeAttributeValue.isEmpty() ||
+             MIMETypeRegistry::isSupportedStyleSheetMIMEType(
+                 ContentType(m_typeAttributeValue).type());
+    } else if (m_linkIsPreload) {
+      if (m_typeAttributeValue.isEmpty())
+        return true;
+      String typeFromAttribute = ContentType(m_typeAttributeValue).type();
+      if ((type == Resource::Font &&
+           !MIMETypeRegistry::isSupportedFontMIMEType(typeFromAttribute)) ||
+          (type == Resource::Image &&
+           !MIMETypeRegistry::isSupportedImagePrefixedMIMEType(
+               typeFromAttribute)) ||
+          (type == Resource::CSSStyleSheet &&
+           !MIMETypeRegistry::isSupportedStyleSheetMIMEType(
+               typeFromAttribute))) {
+        return false;
+      }
+    } else if (!m_linkIsImport) {
+      return false;
+    }
+
+    return true;
+  }
+
+  bool shouldPreload(WTF::Optional<Resource::Type>& type) const {
     if (m_urlToLoad.isEmpty())
       return false;
     if (!m_matched)
       return false;
-    if (match(m_tagImpl, linkTag) && !m_linkIsStyleSheet && !m_linkIsImport &&
-        !m_linkIsPreload)
-      return false;
+    if (match(m_tagImpl, linkTag))
+      return shouldPreloadLink(type);
     if (match(m_tagImpl, inputTag) && !m_inputIsImage)
       return false;
     if (match(m_tagImpl, scriptTag) &&

diff --git a/third_party/WebKit/Source/core/html/parser/HTMLPreloadScannerTest.cpp b/third_party/WebKit/Source/core/html/parser/HTMLPreloadScannerTest.cpp
index 3788041..f5e3fe6 100644
--- a/third_party/WebKit/Source/core/html/parser/HTMLPreloadScannerTest.cpp
+++ b/third_party/WebKit/Source/core/html/parser/HTMLPreloadScannerTest.cpp

@@ -723,12 +723,33 @@
        "http://example.test/", Resource::Raw, 0},
       {"http://example.test", "<link rel=preload href=bla as=script>", "bla",
        "http://example.test/", Resource::Script, 0},
+      {"http://example.test",
+       "<link rel=preload href=bla as=script type='script/foo'>", "bla",
+       "http://example.test/", Resource::Script, 0},
       {"http://example.test", "<link rel=preload href=bla as=style>", "bla",
        "http://example.test/", Resource::CSSStyleSheet, 0},
+      {"http://example.test",
+       "<link rel=preload href=bla as=style type='text/css'>", "bla",
+       "http://example.test/", Resource::CSSStyleSheet, 0},
+      {"http://example.test",
+       "<link rel=preload href=bla as=style type='text/bla'>", nullptr,
+       "http://example.test/", Resource::CSSStyleSheet, 0},
       {"http://example.test", "<link rel=preload href=bla as=image>", "bla",
        "http://example.test/", Resource::Image, 0},
+      {"http://example.test",
+       "<link rel=preload href=bla as=image type='image/webp'>", "bla",
+       "http://example.test/", Resource::Image, 0},
+      {"http://example.test",
+       "<link rel=preload href=bla as=image type='image/bla'>", nullptr,
+       "http://example.test/", Resource::Image, 0},
       {"http://example.test", "<link rel=preload href=bla as=font>", "bla",
        "http://example.test/", Resource::Font, 0},
+      {"http://example.test",
+       "<link rel=preload href=bla as=font type='font/woff2'>", "bla",
+       "http://example.test/", Resource::Font, 0},
+      {"http://example.test",
+       "<link rel=preload href=bla as=font type='font/bla'>", nullptr,
+       "http://example.test/", Resource::Font, 0},
       {"http://example.test", "<link rel=preload href=bla as=media>", "bla",
        "http://example.test/", Resource::Media, 0},
       {"http://example.test", "<link rel=preload href=bla as=track>", "bla",

diff --git a/third_party/WebKit/Source/core/html/shadow/MediaControlElements.cpp b/third_party/WebKit/Source/core/html/shadow/MediaControlElements.cpp
index 9cfad29..b5a95e3 100644
--- a/third_party/WebKit/Source/core/html/shadow/MediaControlElements.cpp
+++ b/third_party/WebKit/Source/core/html/shadow/MediaControlElements.cpp

@@ -856,8 +856,12 @@
 }
 
 void MediaControlVolumeSliderElement::setVolume(double volume) {
-  if (value().toDouble() != volume)
-    setValue(String::number(volume));
+  if (value().toDouble() == volume)
+    return;
+
+  setValue(String::number(volume));
+  if (LayoutObject* layoutObject = this->layoutObject())
+    layoutObject->setShouldDoFullPaintInvalidation();
 }
 
 bool MediaControlVolumeSliderElement::keepEventInNode(Event* event) {

diff --git a/third_party/WebKit/Source/core/layout/LayoutThemeDefault.cpp b/third_party/WebKit/Source/core/layout/LayoutThemeDefault.cpp
index 728b3e3..bd9f1cd7 100644
--- a/third_party/WebKit/Source/core/layout/LayoutThemeDefault.cpp
+++ b/third_party/WebKit/Source/core/layout/LayoutThemeDefault.cpp

@@ -336,35 +336,41 @@
 }
 
 int LayoutThemeDefault::menuListArrowWidthInDIP() const {
-  if (m_menuListArrowWidthInDIP > 0)
-    return m_menuListArrowWidthInDIP;
   int width = Platform::current()
                   ->themeEngine()
                   ->getSize(WebThemeEngine::PartScrollbarUpArrow)
                   .width;
-  const_cast<LayoutThemeDefault*>(this)->m_menuListArrowWidthInDIP =
-      width > 0 ? width : 15;
-  return m_menuListArrowWidthInDIP;
+  return width > 0 ? width : 15;
 }
 
 float LayoutThemeDefault::clampedMenuListArrowPaddingSize(
     const HostWindow* host,
     const ComputedStyle& style) const {
+  if (m_cachedMenuListArrowPaddingSize > 0 &&
+      style.effectiveZoom() == m_cachedMenuListArrowZoomLevel)
+    return m_cachedMenuListArrowPaddingSize;
+  m_cachedMenuListArrowZoomLevel = style.effectiveZoom();
   int originalSize = menuListArrowWidthInDIP();
   int scaledSize =
       host ? host->windowToViewportScalar(originalSize) : originalSize;
   // The result should not be samller than the scrollbar thickness in order to
   // secure space for scrollbar in popup.
   float deviceScale = 1.0f * scaledSize / originalSize;
-  if (style.effectiveZoom() < deviceScale)
-    return scaledSize;
-  // The value should be zoomed though scrollbars aren't scaled by zoom.
-  // crbug.com/432795.
-  return originalSize * style.effectiveZoom();
+  float size;
+  if (m_cachedMenuListArrowZoomLevel < deviceScale) {
+    size = scaledSize;
+  } else {
+    // The value should be zoomed though scrollbars aren't scaled by zoom.
+    // crbug.com/432795.
+    size = originalSize * m_cachedMenuListArrowZoomLevel;
+  }
+  m_cachedMenuListArrowPaddingSize = size;
+  return size;
 }
 
 void LayoutThemeDefault::didChangeThemeEngine() {
-  m_menuListArrowWidthInDIP = 0;
+  m_cachedMenuListArrowZoomLevel = 0;
+  m_cachedMenuListArrowPaddingSize = 0;
 }
 
 // static

diff --git a/third_party/WebKit/Source/core/layout/LayoutThemeDefault.h b/third_party/WebKit/Source/core/layout/LayoutThemeDefault.h
index c577078..fe11675 100644
--- a/third_party/WebKit/Source/core/layout/LayoutThemeDefault.h
+++ b/third_party/WebKit/Source/core/layout/LayoutThemeDefault.h

@@ -160,7 +160,9 @@
   static unsigned m_inactiveSelectionForegroundColor;
 
   ThemePainterDefault m_painter;
-  int m_menuListArrowWidthInDIP = 0;
+  // Cached values for crbug.com/673754.
+  mutable float m_cachedMenuListArrowZoomLevel = 0;
+  mutable float m_cachedMenuListArrowPaddingSize = 0;
 };
 
 }  // namespace blink

diff --git a/third_party/WebKit/Source/core/loader/FrameFetchContext.cpp b/third_party/WebKit/Source/core/loader/FrameFetchContext.cpp
index 809ae74e..3098477a 100644
--- a/third_party/WebKit/Source/core/loader/FrameFetchContext.cpp
+++ b/third_party/WebKit/Source/core/loader/FrameFetchContext.cpp

@@ -896,52 +896,66 @@
   frame()->loader().modifyRequestForCSP(resourceRequest, m_document);
 }
 
-void FrameFetchContext::addClientHintsIfNecessary(FetchRequest& fetchRequest) {
+void FrameFetchContext::addClientHintsIfNecessary(
+    const ClientHintsPreferences& hintsPreferences,
+    const FetchRequest::ResourceWidth& resourceWidth,
+    ResourceRequest& request) {
   if (!RuntimeEnabledFeatures::clientHintsEnabled() || !m_document)
     return;
 
   bool shouldSendDPR = m_document->clientHintsPreferences().shouldSendDPR() ||
-                       fetchRequest.clientHintsPreferences().shouldSendDPR();
+                       hintsPreferences.shouldSendDPR();
   bool shouldSendResourceWidth =
       m_document->clientHintsPreferences().shouldSendResourceWidth() ||
-      fetchRequest.clientHintsPreferences().shouldSendResourceWidth();
+      hintsPreferences.shouldSendResourceWidth();
   bool shouldSendViewportWidth =
       m_document->clientHintsPreferences().shouldSendViewportWidth() ||
-      fetchRequest.clientHintsPreferences().shouldSendViewportWidth();
+      hintsPreferences.shouldSendViewportWidth();
 
   if (shouldSendDPR) {
-    fetchRequest.mutableResourceRequest().addHTTPHeaderField(
+    request.addHTTPHeaderField(
         "DPR", AtomicString(String::number(m_document->devicePixelRatio())));
   }
 
   if (shouldSendResourceWidth) {
-    FetchRequest::ResourceWidth resourceWidth = fetchRequest.getResourceWidth();
     if (resourceWidth.isSet) {
       float physicalWidth =
           resourceWidth.width * m_document->devicePixelRatio();
-      fetchRequest.mutableResourceRequest().addHTTPHeaderField(
+      request.addHTTPHeaderField(
           "Width", AtomicString(String::number(ceil(physicalWidth))));
     }
   }
 
   if (shouldSendViewportWidth && frame()->view()) {
-    fetchRequest.mutableResourceRequest().addHTTPHeaderField(
+    request.addHTTPHeaderField(
         "Viewport-Width",
         AtomicString(String::number(frame()->view()->viewportWidth())));
   }
 }
 
 void FrameFetchContext::addCSPHeaderIfNecessary(Resource::Type type,
-                                                FetchRequest& fetchRequest) {
+                                                ResourceRequest& request) {
   if (!m_document)
     return;
 
   const ContentSecurityPolicy* csp = m_document->contentSecurityPolicy();
   if (csp->shouldSendCSPHeader(type))
-    fetchRequest.mutableResourceRequest().addHTTPHeaderField("CSP", "active");
+    request.addHTTPHeaderField("CSP", "active");
 }
 
-void FrameFetchContext::populateRequestData(ResourceRequest& request) {
+void FrameFetchContext::populateResourceRequest(
+    Resource::Type type,
+    const ClientHintsPreferences& hintsPreferences,
+    const FetchRequest::ResourceWidth& resourceWidth,
+    ResourceRequest& request) {
+  setFirstPartyCookieAndRequestorOrigin(request);
+  modifyRequestForCSP(request);
+  addClientHintsIfNecessary(hintsPreferences, resourceWidth, request);
+  addCSPHeaderIfNecessary(type, request);
+}
+
+void FrameFetchContext::setFirstPartyCookieAndRequestorOrigin(
+    ResourceRequest& request) {
   if (!m_document)
     return;
 

diff --git a/third_party/WebKit/Source/core/loader/FrameFetchContext.h b/third_party/WebKit/Source/core/loader/FrameFetchContext.h
index 57a534c..7d54e3b 100644
--- a/third_party/WebKit/Source/core/loader/FrameFetchContext.h
+++ b/third_party/WebKit/Source/core/loader/FrameFetchContext.h

@@ -33,6 +33,7 @@
 
 #include "core/CoreExport.h"
 #include "core/fetch/FetchContext.h"
+#include "core/fetch/FetchRequest.h"
 #include "core/fetch/ResourceFetcher.h"
 #include "core/frame/csp/ContentSecurityPolicy.h"
 #include "core/loader/LinkLoader.h"
@@ -42,6 +43,7 @@
 
 namespace blink {
 
+class ClientHintsPreferences;
 class Document;
 class DocumentLoader;
 class LocalFrame;
@@ -145,10 +147,18 @@
   void addConsoleMessage(const String&,
                          LogMessageType = LogErrorMessage) const override;
   SecurityOrigin* getSecurityOrigin() const override;
-  void modifyRequestForCSP(ResourceRequest&) override;
-  void addClientHintsIfNecessary(FetchRequest&) override;
-  void addCSPHeaderIfNecessary(Resource::Type, FetchRequest&) override;
-  void populateRequestData(ResourceRequest&) override;
+
+  void populateResourceRequest(Resource::Type,
+                               const ClientHintsPreferences&,
+                               const FetchRequest::ResourceWidth&,
+                               ResourceRequest&) override;
+  void setFirstPartyCookieAndRequestorOrigin(ResourceRequest&) override;
+
+  // Exposed for testing.
+  void modifyRequestForCSP(ResourceRequest&);
+  void addClientHintsIfNecessary(const ClientHintsPreferences&,
+                                 const FetchRequest::ResourceWidth&,
+                                 ResourceRequest&);
 
   MHTMLArchive* archive() const override;
 
@@ -184,6 +194,8 @@
                                           Resource*,
                                           LinkLoader::CanLoadResources);
 
+  void addCSPHeaderIfNecessary(Resource::Type, ResourceRequest&);
+
   // FIXME: Oilpan: Ideally this should just be a traced Member but that will
   // currently leak because ComputedStyle and its data are not on the heap.
   // See crbug.com/383860 for details.

diff --git a/third_party/WebKit/Source/core/loader/FrameFetchContextTest.cpp b/third_party/WebKit/Source/core/loader/FrameFetchContextTest.cpp
index dd6319fd..1299926 100644
--- a/third_party/WebKit/Source/core/loader/FrameFetchContextTest.cpp
+++ b/third_party/WebKit/Source/core/loader/FrameFetchContextTest.cpp

@@ -172,22 +172,18 @@
     KURL inputURL(ParsedURLString, input);
     KURL expectedURL(ParsedURLString, expected);
 
-    FetchRequest fetchRequest =
-        FetchRequest(ResourceRequest(inputURL), FetchInitiatorInfo());
-    fetchRequest.mutableResourceRequest().setRequestContext(requestContext);
-    fetchRequest.mutableResourceRequest().setFrameType(frameType);
+    ResourceRequest resourceRequest(inputURL);
+    resourceRequest.setRequestContext(requestContext);
+    resourceRequest.setFrameType(frameType);
 
-    fetchContext->modifyRequestForCSP(fetchRequest.mutableResourceRequest());
+    fetchContext->modifyRequestForCSP(resourceRequest);
 
-    EXPECT_EQ(expectedURL.getString(),
-              fetchRequest.resourceRequest().url().getString());
-    EXPECT_EQ(expectedURL.protocol(),
-              fetchRequest.resourceRequest().url().protocol());
-    EXPECT_EQ(expectedURL.host(), fetchRequest.resourceRequest().url().host());
-    EXPECT_EQ(expectedURL.port(), fetchRequest.resourceRequest().url().port());
-    EXPECT_EQ(expectedURL.hasPort(),
-              fetchRequest.resourceRequest().url().hasPort());
-    EXPECT_EQ(expectedURL.path(), fetchRequest.resourceRequest().url().path());
+    EXPECT_EQ(expectedURL.getString(), resourceRequest.url().getString());
+    EXPECT_EQ(expectedURL.protocol(), resourceRequest.url().protocol());
+    EXPECT_EQ(expectedURL.host(), resourceRequest.url().host());
+    EXPECT_EQ(expectedURL.port(), resourceRequest.url().port());
+    EXPECT_EQ(expectedURL.hasPort(), resourceRequest.url().hasPort());
+    EXPECT_EQ(expectedURL.path(), resourceRequest.url().path());
   }
 
   void expectUpgradeInsecureRequestHeader(const char* input,
@@ -195,23 +191,21 @@
                                           bool shouldPrefer) {
     KURL inputURL(ParsedURLString, input);
 
-    FetchRequest fetchRequest =
-        FetchRequest(ResourceRequest(inputURL), FetchInitiatorInfo());
-    fetchRequest.mutableResourceRequest().setRequestContext(
-        WebURLRequest::RequestContextScript);
-    fetchRequest.mutableResourceRequest().setFrameType(frameType);
+    ResourceRequest resourceRequest(inputURL);
+    resourceRequest.setRequestContext(WebURLRequest::RequestContextScript);
+    resourceRequest.setFrameType(frameType);
 
-    fetchContext->modifyRequestForCSP(fetchRequest.mutableResourceRequest());
+    fetchContext->modifyRequestForCSP(resourceRequest);
 
-    EXPECT_EQ(shouldPrefer ? String("1") : String(),
-              fetchRequest.resourceRequest().httpHeaderField(
-                  HTTPNames::Upgrade_Insecure_Requests));
+    EXPECT_EQ(
+        shouldPrefer ? String("1") : String(),
+        resourceRequest.httpHeaderField(HTTPNames::Upgrade_Insecure_Requests));
 
     // Calling modifyRequestForCSP more than once shouldn't affect the
     // header.
     if (shouldPrefer) {
-      fetchContext->modifyRequestForCSP(fetchRequest.mutableResourceRequest());
-      EXPECT_EQ("1", fetchRequest.resourceRequest().httpHeaderField(
+      fetchContext->modifyRequestForCSP(resourceRequest);
+      EXPECT_EQ("1", resourceRequest.httpHeaderField(
                          HTTPNames::Upgrade_Insecure_Requests));
     }
   }
@@ -221,18 +215,14 @@
       WebURLRequest::FrameType frameType,
       const AtomicString& expectedEmbeddingCSP) {
     KURL inputURL(ParsedURLString, input);
+    ResourceRequest resourceRequest(inputURL);
+    resourceRequest.setRequestContext(WebURLRequest::RequestContextScript);
+    resourceRequest.setFrameType(frameType);
 
-    FetchRequest fetchRequest =
-        FetchRequest(ResourceRequest(inputURL), FetchInitiatorInfo());
-    fetchRequest.mutableResourceRequest().setRequestContext(
-        WebURLRequest::RequestContextScript);
-    fetchRequest.mutableResourceRequest().setFrameType(frameType);
-
-    fetchContext->modifyRequestForCSP(fetchRequest.mutableResourceRequest());
+    fetchContext->modifyRequestForCSP(resourceRequest);
 
     EXPECT_EQ(expectedEmbeddingCSP,
-              fetchRequest.resourceRequest().httpHeaderField(
-                  HTTPNames::Embedding_CSP));
+              resourceRequest.httpHeaderField(HTTPNames::Embedding_CSP));
   }
 
   void setFrameOwnerBasedOnFrameType(WebURLRequest::FrameType frameType,
@@ -419,19 +409,22 @@
                     bool isPresent,
                     const char* headerValue,
                     float width = 0) {
-    KURL inputURL(ParsedURLString, input);
-    FetchRequest fetchRequest =
-        FetchRequest(ResourceRequest(inputURL), FetchInitiatorInfo());
+    ClientHintsPreferences hintsPreferences;
+
+    FetchRequest::ResourceWidth resourceWidth;
     if (width > 0) {
-      FetchRequest::ResourceWidth resourceWidth;
       resourceWidth.width = width;
       resourceWidth.isSet = true;
-      fetchRequest.setResourceWidth(resourceWidth);
     }
-    fetchContext->addClientHintsIfNecessary(fetchRequest);
+
+    KURL inputURL(ParsedURLString, input);
+    ResourceRequest resourceRequest(inputURL);
+
+    fetchContext->addClientHintsIfNecessary(hintsPreferences, resourceWidth,
+                                            resourceRequest);
 
     EXPECT_EQ(isPresent ? String(headerValue) : String(),
-              fetchRequest.resourceRequest().httpHeaderField(headerName));
+              resourceRequest.httpHeaderField(headerName));
   }
 };
 
@@ -545,7 +538,7 @@
                 request, Resource::MainResource, FetchRequest::NoDefer));
 }
 
-TEST_F(FrameFetchContextTest, PopulateRequestData) {
+TEST_F(FrameFetchContextTest, SetFirstPartyCookieAndRequestorOrigin) {
   struct TestCase {
     const char* documentURL;
     bool documentSandboxed;
@@ -564,13 +557,14 @@
        "http://example.test"},
 
       // If the request already has a requestor origin, then
-      // 'populateRequestData' leaves it alone:
+      // 'setFirstPartyCookieAndRequestorOrigin' leaves it alone:
       {"http://example.test", false, "http://not-example.test",
        WebURLRequest::FrameTypeNone, "http://not-example.test"},
       {"http://example.test", true, "http://not-example.test",
        WebURLRequest::FrameTypeNone, "http://not-example.test"},
 
-      // If the request's frame type is not 'none', then 'populateRequestData'
+      // If the request's frame type is not 'none', then
+      // 'setFirstPartyCookieAndRequestorOrigin'
       // leaves it alone:
       {"http://example.test", false, "", WebURLRequest::FrameTypeTopLevel, ""},
       {"http://example.test", false, "", WebURLRequest::FrameTypeAuxiliary, ""},
@@ -601,7 +595,7 @@
     }
 
     // Compare the populated |requestorOrigin| against |test.serializedOrigin|
-    fetchContext->populateRequestData(request);
+    fetchContext->setFirstPartyCookieAndRequestorOrigin(request);
     if (strlen(test.serializedOrigin) == 0) {
       EXPECT_TRUE(request.requestorOrigin()->isUnique());
     } else {
@@ -616,8 +610,6 @@
 TEST_F(FrameFetchContextTest, ModifyPriorityForLowPriorityIframes) {
   Settings* settings = document->frame()->settings();
   settings->setLowPriorityIframes(false);
-  FetchRequest request(ResourceRequest("http://www.example.com"),
-                       FetchInitiatorInfo());
   FrameFetchContext* childFetchContext = createChildFrame();
 
   // No low priority iframes, expect default values.

diff --git a/third_party/WebKit/Source/core/loader/LinkLoader.cpp b/third_party/WebKit/Source/core/loader/LinkLoader.cpp
index 40707b9a..9ac9dc5 100644
--- a/third_party/WebKit/Source/core/loader/LinkLoader.cpp
+++ b/third_party/WebKit/Source/core/loader/LinkLoader.cpp

@@ -182,27 +182,25 @@
   }
 }
 
-bool LinkLoader::getResourceTypeFromAsAttribute(const String& as,
-                                                Resource::Type& type) {
+WTF::Optional<Resource::Type> LinkLoader::getResourceTypeFromAsAttribute(
+    const String& as) {
   DCHECK_EQ(as.lower(), as);
   if (as == "image") {
-    type = Resource::Image;
+    return Resource::Image;
   } else if (as == "script") {
-    type = Resource::Script;
+    return Resource::Script;
   } else if (as == "style") {
-    type = Resource::CSSStyleSheet;
+    return Resource::CSSStyleSheet;
   } else if (as == "media") {
-    type = Resource::Media;
+    return Resource::Media;
   } else if (as == "font") {
-    type = Resource::Font;
+    return Resource::Font;
   } else if (as == "track") {
-    type = Resource::TextTrack;
-  } else {
-    type = Resource::Raw;
-    if (!as.isEmpty())
-      return false;
+    return Resource::TextTrack;
+  } else if (as.isEmpty()) {
+    return Resource::Raw;
   }
-  return true;
+  return WTF::nullopt;
 }
 
 void LinkLoader::createLinkPreloadResourceClient(Resource* resource) {
@@ -300,8 +298,9 @@
   }
   if (caller == LinkCalledFromHeader)
     UseCounter::count(document, UseCounter::LinkHeaderPreload);
-  Resource::Type resourceType;
-  if (!LinkLoader::getResourceTypeFromAsAttribute(as, resourceType)) {
+  Optional<Resource::Type> resourceType =
+      LinkLoader::getResourceTypeFromAsAttribute(as);
+  if (resourceType == WTF::nullopt) {
     document.addConsoleMessage(ConsoleMessage::create(
         OtherMessageSource, WarningMessageLevel,
         String("<link rel=preload> must have a valid `as` value")));
@@ -309,15 +308,15 @@
     return nullptr;
   }
 
-  if (!isSupportedType(resourceType, mimeType)) {
+  if (!isSupportedType(resourceType.value(), mimeType)) {
     document.addConsoleMessage(ConsoleMessage::create(
         OtherMessageSource, WarningMessageLevel,
         String("<link rel=preload> has an unsupported `type` value")));
     return nullptr;
   }
   ResourceRequest resourceRequest(document.completeURL(href));
-  ResourceFetcher::determineRequestContext(resourceRequest, resourceType,
-                                           false);
+  ResourceFetcher::determineRequestContext(resourceRequest,
+                                           resourceType.value(), false);
 
   if (referrerPolicy != ReferrerPolicyDefault) {
     resourceRequest.setHTTPReferrer(SecurityPolicy::generateReferrer(
@@ -339,7 +338,7 @@
   }
   linkRequest.setForPreload(true, monotonicallyIncreasingTime());
   linkRequest.setLinkPreload(true);
-  return document.loader()->startPreload(resourceType, linkRequest);
+  return document.loader()->startPreload(resourceType.value(), linkRequest);
 }
 
 static Resource* prefetchIfNeeded(Document& document,

diff --git a/third_party/WebKit/Source/core/loader/LinkLoader.h b/third_party/WebKit/Source/core/loader/LinkLoader.h
index f67b446..1572fda 100644
--- a/third_party/WebKit/Source/core/loader/LinkLoader.h
+++ b/third_party/WebKit/Source/core/loader/LinkLoader.h

@@ -41,6 +41,7 @@
 #include "platform/PrerenderClient.h"
 #include "platform/Timer.h"
 #include "platform/heap/Handle.h"
+#include "wtf/Optional.h"
 
 namespace blink {
 
@@ -101,7 +102,8 @@
                                   CanLoadResources,
                                   MediaPreloadPolicy,
                                   ViewportDescriptionWrapper*);
-  static bool getResourceTypeFromAsAttribute(const String& as, Resource::Type&);
+  static WTF::Optional<Resource::Type> getResourceTypeFromAsAttribute(
+      const String& as);
 
   DECLARE_TRACE();
 

diff --git a/third_party/WebKit/Source/core/loader/PingLoader.cpp b/third_party/WebKit/Source/core/loader/PingLoader.cpp
index 5e597c1..2a42b0e5 100644
--- a/third_party/WebKit/Source/core/loader/PingLoader.cpp
+++ b/third_party/WebKit/Source/core/loader/PingLoader.cpp

@@ -222,6 +222,7 @@
   String m_url;
   unsigned long m_identifier;
   SelfKeepAlive<PingLoaderImpl> m_keepAlive;
+  AtomicString m_initiator;
 
   bool m_isBeacon;
 
@@ -239,6 +240,7 @@
       m_url(request.url()),
       m_identifier(createUniqueIdentifier()),
       m_keepAlive(this),
+      m_initiator(initiator),
       m_isBeacon(isBeacon),
       m_origin(frame->document()->getSecurityOrigin()),
       m_corsMode(IsCORSEnabled) {
@@ -293,42 +295,47 @@
 bool PingLoaderImpl::willFollowRedirect(
     WebURLRequest& passedNewRequest,
     const WebURLResponse& passedRedirectResponse) {
-  if (!m_isBeacon)
-    return true;
+  if (m_isBeacon && m_corsMode == IsCORSEnabled) {
+    DCHECK(passedNewRequest.allowStoredCredentials());
 
-  if (m_corsMode == NotCORSEnabled)
-    return true;
+    ResourceRequest& newRequest(passedNewRequest.toMutableResourceRequest());
+    const ResourceResponse& redirectResponse(
+        passedRedirectResponse.toResourceResponse());
 
-  DCHECK(passedNewRequest.allowStoredCredentials());
+    DCHECK(!newRequest.isNull());
+    DCHECK(!redirectResponse.isNull());
 
-  ResourceRequest& newRequest(passedNewRequest.toMutableResourceRequest());
-  const ResourceResponse& redirectResponse(
-      passedRedirectResponse.toResourceResponse());
-
-  DCHECK(!newRequest.isNull());
-  DCHECK(!redirectResponse.isNull());
-
-  String errorDescription;
-  ResourceLoaderOptions options;
-  // TODO(tyoshino): Save updated data in options.securityOrigin and pass it
-  // on the next time.
-  if (!CrossOriginAccessControl::handleRedirect(
-          m_origin, newRequest, redirectResponse, AllowStoredCredentials,
-          options, errorDescription)) {
-    if (frame()) {
-      if (frame()->document()) {
-        frame()->document()->addConsoleMessage(ConsoleMessage::create(
-            JSMessageSource, ErrorMessageLevel, errorDescription));
+    String errorDescription;
+    ResourceLoaderOptions options;
+    // TODO(tyoshino): Save updated data in options.securityOrigin and pass it
+    // on the next time.
+    if (!CrossOriginAccessControl::handleRedirect(
+            m_origin, newRequest, redirectResponse, AllowStoredCredentials,
+            options, errorDescription)) {
+      if (frame()) {
+        if (frame()->document()) {
+          frame()->document()->addConsoleMessage(ConsoleMessage::create(
+              JSMessageSource, ErrorMessageLevel, errorDescription));
+        }
       }
-    }
-    // Cancel the load and self destruct.
-    dispose();
+      // Cancel the load and self destruct.
+      dispose();
 
-    return false;
+      return false;
+    }
   }
   // FIXME: http://crbug.com/427429 is needed to correctly propagate updates of
   // Origin: following this successful redirect.
 
+  if (frame() && frame()->document()) {
+    FetchInitiatorInfo initiatorInfo;
+    initiatorInfo.name = m_initiator;
+    FetchContext& fetchContext = frame()->document()->fetcher()->context();
+    fetchContext.dispatchWillSendRequest(
+        m_identifier, passedNewRequest.toMutableResourceRequest(),
+        passedRedirectResponse.toResourceResponse(), initiatorInfo);
+  }
+
   return true;
 }
 
@@ -405,7 +412,8 @@
   request.setRequestContext(requestContext);
   FetchContext& fetchContext = frame->document()->fetcher()->context();
   fetchContext.addAdditionalRequestHeaders(request, FetchSubresource);
-  fetchContext.populateRequestData(request);
+  // TODO(tyoshino): Call populateResourceRequest() if appropriate.
+  fetchContext.setFirstPartyCookieAndRequestorOrigin(request);
 }
 
 bool sendPingCommon(LocalFrame* frame,

diff --git a/third_party/WebKit/Source/core/loader/WorkerThreadableLoader.h b/third_party/WebKit/Source/core/loader/WorkerThreadableLoader.h
index a9992dfc..768e0aa 100644
--- a/third_party/WebKit/Source/core/loader/WorkerThreadableLoader.h
+++ b/third_party/WebKit/Source/core/loader/WorkerThreadableLoader.h

@@ -137,6 +137,7 @@
         public ThreadableLoaderClient,
         public WorkerThreadLifecycleObserver {
     USING_GARBAGE_COLLECTED_MIXIN(MainThreadLoaderHolder);
+    USING_PRE_FINALIZER(MainThreadLoaderHolder, cancel);
 
    public:
     static void createAndStart(WorkerThreadableLoader*,

diff --git a/third_party/WebKit/Source/core/xmlhttprequest/XMLHttpRequest.h b/third_party/WebKit/Source/core/xmlhttprequest/XMLHttpRequest.h
index ea5b40ec..9d6c695 100644
--- a/third_party/WebKit/Source/core/xmlhttprequest/XMLHttpRequest.h
+++ b/third_party/WebKit/Source/core/xmlhttprequest/XMLHttpRequest.h

@@ -28,6 +28,7 @@
 #include "bindings/core/v8/ScriptWrappable.h"
 #include "bindings/core/v8/TraceWrapperMember.h"
 #include "core/dom/DocumentParserClient.h"
+#include "core/dom/ExceptionCode.h"
 #include "core/dom/SuspendableObject.h"
 #include "core/loader/ThreadableLoaderClient.h"
 #include "core/xmlhttprequest/XMLHttpRequestEventTarget.h"
@@ -42,7 +43,6 @@
 #include "wtf/PassRefPtr.h"
 #include "wtf/RefPtr.h"
 #include "wtf/text/AtomicString.h"
-#include "wtf/text/StringBuilder.h"
 #include "wtf/text/WTFString.h"
 #include <memory>
 
@@ -65,8 +65,6 @@
 class WebDataConsumerHandle;
 class XMLHttpRequestUpload;
 
-typedef int ExceptionCode;
-
 class XMLHttpRequest final : public XMLHttpRequestEventTarget,
                              private ThreadableLoaderClient,
                              public DocumentParserClient,

diff --git a/third_party/WebKit/Source/modules/beacon/NavigatorBeacon.cpp b/third_party/WebKit/Source/modules/beacon/NavigatorBeacon.cpp
index 8cf4e8b..5d84c6a 100644
--- a/third_party/WebKit/Source/modules/beacon/NavigatorBeacon.cpp
+++ b/third_party/WebKit/Source/modules/beacon/NavigatorBeacon.cpp

@@ -22,12 +22,11 @@
 namespace blink {
 
 NavigatorBeacon::NavigatorBeacon(Navigator& navigator)
-    : ContextClient(navigator.frame()), m_transmittedBytes(0) {}
+    : Supplement<Navigator>(navigator), m_transmittedBytes(0) {}
 
 NavigatorBeacon::~NavigatorBeacon() {}
 
 DEFINE_TRACE(NavigatorBeacon) {
-  ContextClient::trace(visitor);
   Supplement<Navigator>::trace(visitor);
 }
 
@@ -71,15 +70,15 @@
   }
 
   // If detached from frame, do not allow sending a Beacon.
-  if (!frame() || !frame()->client())
+  if (!host()->frame())
     return false;
 
   return true;
 }
 
 int NavigatorBeacon::maxAllowance() const {
-  DCHECK(frame());
-  const Settings* settings = frame()->settings();
+  DCHECK(host()->frame());
+  const Settings* settings = host()->frame()->settings();
   if (settings) {
     int maxAllowed = settings->getMaxBeaconTransmission();
     if (maxAllowed < m_transmittedBytes)
@@ -100,19 +99,26 @@
     const String& urlstring,
     const ArrayBufferViewOrBlobOrStringOrFormData& data,
     ExceptionState& exceptionState) {
-  NavigatorBeacon& impl = NavigatorBeacon::from(navigator);
+  return NavigatorBeacon::from(navigator).sendBeaconImpl(scriptState, urlstring,
+                                                         data, exceptionState);
+}
 
+bool NavigatorBeacon::sendBeaconImpl(
+    ScriptState* scriptState,
+    const String& urlstring,
+    const ArrayBufferViewOrBlobOrStringOrFormData& data,
+    ExceptionState& exceptionState) {
   ExecutionContext* context = scriptState->getExecutionContext();
   KURL url = context->completeURL(urlstring);
-  if (!impl.canSendBeacon(context, url, exceptionState))
+  if (!canSendBeacon(context, url, exceptionState))
     return false;
 
-  int allowance = impl.maxAllowance();
+  int allowance = maxAllowance();
   int bytes = 0;
   bool allowed;
 
   if (data.isArrayBufferView()) {
-    allowed = PingLoader::sendBeacon(impl.frame(), allowance, url,
+    allowed = PingLoader::sendBeacon(host()->frame(), allowance, url,
                                      data.getAsArrayBufferView(), bytes);
   } else if (data.isBlob()) {
     Blob* blob = data.getAsBlob();
@@ -128,20 +134,21 @@
         return false;
       }
     }
-    allowed = PingLoader::sendBeacon(impl.frame(), allowance, url, blob, bytes);
+    allowed =
+        PingLoader::sendBeacon(host()->frame(), allowance, url, blob, bytes);
   } else if (data.isString()) {
-    allowed = PingLoader::sendBeacon(impl.frame(), allowance, url,
+    allowed = PingLoader::sendBeacon(host()->frame(), allowance, url,
                                      data.getAsString(), bytes);
   } else if (data.isFormData()) {
-    allowed = PingLoader::sendBeacon(impl.frame(), allowance, url,
+    allowed = PingLoader::sendBeacon(host()->frame(), allowance, url,
                                      data.getAsFormData(), bytes);
   } else {
-    allowed =
-        PingLoader::sendBeacon(impl.frame(), allowance, url, String(), bytes);
+    allowed = PingLoader::sendBeacon(host()->frame(), allowance, url, String(),
+                                     bytes);
   }
 
   if (allowed) {
-    impl.addTransmittedBytes(bytes);
+    addTransmittedBytes(bytes);
     return true;
   }
 

diff --git a/third_party/WebKit/Source/modules/beacon/NavigatorBeacon.h b/third_party/WebKit/Source/modules/beacon/NavigatorBeacon.h
index c03d8e7..423b894c 100644
--- a/third_party/WebKit/Source/modules/beacon/NavigatorBeacon.h
+++ b/third_party/WebKit/Source/modules/beacon/NavigatorBeacon.h

@@ -5,7 +5,6 @@
 #ifndef NavigatorBeacon_h
 #define NavigatorBeacon_h
 
-#include "core/dom/ContextLifecycleObserver.h"
 #include "core/frame/Navigator.h"
 #include "platform/Supplementable.h"
 #include "platform/heap/Handle.h"
@@ -18,7 +17,6 @@
 class ArrayBufferViewOrBlobOrStringOrFormData;
 
 class NavigatorBeacon final : public GarbageCollectedFinalized<NavigatorBeacon>,
-                              public ContextClient,
                               public Supplement<Navigator> {
   USING_GARBAGE_COLLECTED_MIXIN(NavigatorBeacon);
 
@@ -39,6 +37,10 @@
 
   static const char* supplementName();
 
+  bool sendBeaconImpl(ScriptState*,
+                      const String&,
+                      const ArrayBufferViewOrBlobOrStringOrFormData&,
+                      ExceptionState&);
   bool canSendBeacon(ExecutionContext*, const KURL&, ExceptionState&);
   int maxAllowance() const;
   void addTransmittedBytes(int sentBytes);

diff --git a/third_party/WebKit/Source/modules/fetch/FetchManager.h b/third_party/WebKit/Source/modules/fetch/FetchManager.h
index ac06ecb4..8e48bab 100644
--- a/third_party/WebKit/Source/modules/fetch/FetchManager.h
+++ b/third_party/WebKit/Source/modules/fetch/FetchManager.h

@@ -21,13 +21,14 @@
 
  public:
   static FetchManager* create(ExecutionContext*);
-  explicit FetchManager(ExecutionContext*);
   ScriptPromise fetch(ScriptState*, FetchRequestData*);
   void contextDestroyed() override;
 
   DECLARE_TRACE();
 
  private:
+  explicit FetchManager(ExecutionContext*);
+
   class Loader;
 
   // Removes loader from |m_loaders|.

diff --git a/third_party/WebKit/Source/modules/quota/StorageErrorCallback.h b/third_party/WebKit/Source/modules/quota/StorageErrorCallback.h
index c54daec..194f5489 100644
--- a/third_party/WebKit/Source/modules/quota/StorageErrorCallback.h
+++ b/third_party/WebKit/Source/modules/quota/StorageErrorCallback.h

@@ -31,6 +31,7 @@
 #ifndef StorageErrorCallback_h
 #define StorageErrorCallback_h
 
+#include "core/dom/ExceptionCode.h"
 #include "core/dom/ExecutionContext.h"
 #include "core/dom/ExecutionContextTask.h"
 #include "modules/ModulesExport.h"
@@ -41,8 +42,6 @@
 
 class DOMError;
 
-typedef int ExceptionCode;
-
 class StorageErrorCallback
     : public GarbageCollectedFinalized<StorageErrorCallback> {
  public:

diff --git a/third_party/WebKit/Source/modules/webgl/WebGLContextGroup.h b/third_party/WebKit/Source/modules/webgl/WebGLContextGroup.h
index 8884a063..408c954 100644
--- a/third_party/WebKit/Source/modules/webgl/WebGLContextGroup.h
+++ b/third_party/WebKit/Source/modules/webgl/WebGLContextGroup.h

@@ -34,8 +34,6 @@
 
 namespace blink {
 
-typedef int ExceptionCode;
-
 class WebGLContextGroup final : public GarbageCollected<WebGLContextGroup>,
                                 public TraceWrapperBase {
   WTF_MAKE_NONCOPYABLE(WebGLContextGroup);

diff --git a/third_party/WebKit/Source/platform/Supplementable.h b/third_party/WebKit/Source/platform/Supplementable.h
index c2b90df0..6ec435c8 100644
--- a/third_party/WebKit/Source/platform/Supplementable.h
+++ b/third_party/WebKit/Source/platform/Supplementable.h

@@ -98,7 +98,12 @@
   // TODO(haraken): Remove the default constructor.
   // All Supplement objects should be instantiated with m_host.
   Supplement() {}
+
   explicit Supplement(T& host) : m_host(&host) {}
+
+  // Supplementable and its supplements live and die together.
+  // Thus host() should never return null (if the default constructor
+  // is completely removed).
   T* host() const { return m_host; }
 
   static void provideTo(Supplementable<T>& host,

diff --git a/ui/file_manager/file_manager/foreground/js/file_tasks.js b/ui/file_manager/file_manager/foreground/js/file_tasks.js
index 6ba5710b..1eda2d85 100644
--- a/ui/file_manager/file_manager/foreground/js/file_tasks.js
+++ b/ui/file_manager/file_manager/foreground/js/file_tasks.js

@@ -206,7 +206,7 @@
   var extension = splitted[1];
 
   // Returns with failure if the file has neither extension nor MIME type.
-  if (!extension || !mimeType) {
+  if (!extension && !mimeType) {
     onFailure();
     return;
   }

diff --git a/ui/file_manager/file_manager/foreground/js/ui/suggest_apps_dialog.js b/ui/file_manager/file_manager/foreground/js/ui/suggest_apps_dialog.js
index b2fc020..ad3c6b5 100644
--- a/ui/file_manager/file_manager/foreground/js/ui/suggest_apps_dialog.js
+++ b/ui/file_manager/file_manager/foreground/js/ui/suggest_apps_dialog.js

@@ -88,7 +88,7 @@
  * Shows suggest-apps dialog by file extension and mime.
  *
  * @param {string} extension Extension of the file with a trailing dot.
- * @param {string} mime Mime of the file.
+ * @param {?string} mime Mime of the file.
  * @param {function(SuggestAppsDialog.Result, ?string)} onDialogClosed Called
  *     when the dialog is closed, with a result code and an optionally an
  *     extension id, if an extension was installed.
@@ -96,11 +96,11 @@
 SuggestAppsDialog.prototype.showByExtensionAndMime =
     function(extension, mime, onDialogClosed) {
   assert(extension && extension[0] === '.');
+  var options = {file_extension: extension.substr(1)};
+  if (mime)
+    options.mime_type = mime;
   this.showInternal_(
-      {
-        file_extension: extension.substr(1),
-        mime_type: mime
-      },
+      options,
       str('SUGGEST_DIALOG_TITLE'),
       FileTasks.createWebStoreLink(extension, mime),
       onDialogClosed);