diff --git a/BUILD.gn b/BUILD.gn
index cd3feb8..f69b79c6 100644
--- a/BUILD.gn
+++ b/BUILD.gn

@@ -968,6 +968,10 @@
       "//tools/perf/chrome_telemetry_build:telemetry_chrome_test",
     ]
 
+    if (is_android) {
+      data += [ "//third_party/android_tools/sdk/platform-tools/adb" ]
+    }
+
     if (!is_chromeos) {
       data_deps += [ "//chrome/test:performance_browser_tests" ]
     }

diff --git a/DEPS b/DEPS
index 94a562b9..0d75b7d2 100644
--- a/DEPS
+++ b/DEPS

@@ -40,7 +40,7 @@
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling Skia
   # and whatever else without interference from each other.
-  'skia_revision': '05814de6ba5087ad71f189d6413246ef1d518e4b',
+  'skia_revision': '6410d29e1173b49b7319d7389db7c533e27bb3d2',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling V8
   # and whatever else without interference from each other.
@@ -60,11 +60,11 @@
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling SwiftShader
   # and whatever else without interference from each other.
-  'swiftshader_revision': '5f7269351ff27a3aa5488617b739c257b4e286a9',
+  'swiftshader_revision': 'f34d1ace76a7e384685ebc5395141295cf1c618f',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling PDFium
   # and whatever else without interference from each other.
-  'pdfium_revision': '3ba6010b63a97271f23ed921a58dc9298d2e74ef',
+  'pdfium_revision': 'f82efcc72fa16b145f101b38ea55d674278e32a1',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling openmax_dl
   # and whatever else without interference from each other.

diff --git a/base/android/java/src/org/chromium/base/ThreadUtils.java b/base/android/java/src/org/chromium/base/ThreadUtils.java
index 1c9e2401..771fab3 100644
--- a/base/android/java/src/org/chromium/base/ThreadUtils.java
+++ b/base/android/java/src/org/chromium/base/ThreadUtils.java

@@ -49,8 +49,7 @@
         }
     }
 
-    /** Returns the underlying UI thread handler. */
-    public static Handler getUiThreadHandler() {
+    private static Handler getUiThreadHandler() {
         synchronized (sLock) {
             if (sUiThreadHandler == null) {
                 if (sWillOverride) {

diff --git a/base/trace_event/memory_dump_manager.cc b/base/trace_event/memory_dump_manager.cc
index 7de028b..0868486 100644
--- a/base/trace_event/memory_dump_manager.cc
+++ b/base/trace_event/memory_dump_manager.cc

@@ -162,7 +162,6 @@
 
 MemoryDumpManager::MemoryDumpManager()
     : is_coordinator_(false),
-      is_enabled_(0),
       tracing_process_id_(kInvalidTracingProcessId),
       dumper_registrations_ignored_for_testing_(false),
       heap_profiling_enabled_(false) {
@@ -409,11 +408,10 @@
     MemoryDumpType dump_type,
     MemoryDumpLevelOfDetail level_of_detail,
     const GlobalMemoryDumpCallback& callback) {
-  // Bail out immediately if tracing is not enabled at all or if the dump mode
-  // is not allowed.
-  if (!UNLIKELY(subtle::NoBarrier_Load(&is_enabled_))) {
-    VLOG(1) << kLogPrefix << " failed because " << kTraceCategory
-            << " tracing category is not enabled.";
+  // If |request_dump_function_| is null MDM hasn't been initialized yet.
+  if (request_dump_function_.is_null()) {
+    VLOG(1) << kLogPrefix << " failed because"
+            << " memory dump manager is not enabled.";
     if (!callback.is_null())
       callback.Run(0u /* guid */, false /* success */);
     return;
@@ -501,6 +499,16 @@
   {
     AutoLock lock(lock_);
 
+    // MDM could have been disabled by this point destroying
+    // |heap_profiler_serialization_state|. If heap profiling is enabled we
+    // require session state so if heap profiling is on and session state is
+    // absent we fail the dump immediately.
+    if (args.dump_type != MemoryDumpType::SUMMARY_ONLY &&
+        heap_profiling_enabled_ && !heap_profiler_serialization_state_) {
+      callback.Run(args.dump_guid, false /* success */, base::nullopt);
+      return;
+    }
+
     pmd_async_state.reset(new ProcessMemoryDumpAsyncState(
         args, dump_providers_, heap_profiler_serialization_state_, callback,
         GetOrCreateBgTaskRunnerLocked()));
@@ -531,22 +539,6 @@
   // (for discounting trace memory overhead) while holding the |lock_|.
   TraceLog::GetInstance()->InitializeThreadLocalEventBufferIfSupported();
 
-  // MDM might have been disabled before getting to this point.
-  // Anyway either MDM is disabled or this was the last hop, create a trace
-  // event, add it to the trace and finalize process dump invoking the callback.
-  if (!subtle::NoBarrier_Load(&is_enabled_)) {
-    if (pmd_async_state->pending_dump_providers.empty()) {
-      VLOG(1) << kLogPrefix << " failed because MemoryDumpManager was disabled"
-              << " before finalizing the dump";
-    } else {
-      VLOG(1) << kLogPrefix << " failed because MemoryDumpManager was disabled"
-              << " before dumping "
-              << pmd_async_state->pending_dump_providers.back().get()->name;
-    }
-    pmd_async_state->dump_successful = false;
-    pmd_async_state->pending_dump_providers.clear();
-  }
-
   if (pmd_async_state->pending_dump_providers.empty())
     return FinalizeDumpAndAddToTrace(std::move(pmd_async_state));
 
@@ -807,8 +799,6 @@
   DCHECK(!request_dump_function_.is_null());
   heap_profiler_serialization_state_ = heap_profiler_serialization_state;
 
-  subtle::NoBarrier_Store(&is_enabled_, 1);
-
   MemoryDumpScheduler::Config periodic_config;
   bool peak_detector_configured = false;
   for (const auto& trigger : memory_dump_config.triggers) {
@@ -855,15 +845,11 @@
   // There might be a memory dump in progress while this happens. Therefore,
   // ensure that the MDM state which depends on the tracing enabled / disabled
   // state is always accessed by the dumping methods holding the |lock_|.
-  if (!subtle::NoBarrier_Load(&is_enabled_))
-    return;
-  subtle::NoBarrier_Store(&is_enabled_, 0);
-  {
-    AutoLock lock(lock_);
-    MemoryDumpScheduler::GetInstance()->Stop();
-    MemoryPeakDetector::GetInstance()->TearDown();
-    heap_profiler_serialization_state_ = nullptr;
-  }
+  AutoLock lock(lock_);
+
+  MemoryDumpScheduler::GetInstance()->Stop();
+  MemoryPeakDetector::GetInstance()->TearDown();
+  heap_profiler_serialization_state_ = nullptr;
 }
 
 MemoryDumpManager::ProcessMemoryDumpAsyncState::ProcessMemoryDumpAsyncState(

diff --git a/base/trace_event/memory_dump_manager.h b/base/trace_event/memory_dump_manager.h
index 6c71a24..f3580b9 100644
--- a/base/trace_event/memory_dump_manager.h
+++ b/base/trace_event/memory_dump_manager.h

@@ -114,6 +114,8 @@
 
   // Requests a memory dump. The dump might happen or not depending on the
   // filters and categories specified when enabling tracing.
+  // A SUMMARY_ONLY dump can be requested at any time after initialization and
+  // other type of dumps can be requested only when MDM is enabled.
   // The optional |callback| is executed asynchronously, on an arbitrary thread,
   // to notify about the completion of the global dump (i.e. after all the
   // processes have dumped) and its success (true iff all the dumps were
@@ -126,14 +128,13 @@
   void RequestGlobalDump(MemoryDumpType dump_type,
                          MemoryDumpLevelOfDetail level_of_detail);
 
-  // Prepare MemoryDumpManager for RequestGlobalMemoryDump calls.
-  // Starts the MemoryDumpManager thread.
-  // Also uses the given config to initialize the peak detector,
-  // scheduler and heap profiler.
+  // Prepare MemoryDumpManager for RequestGlobalMemoryDump calls for tracing
+  // related modes (non-SUMMARY_ONLY).
+  // Initializes the peak detector, scheduler and heap profiler with the given
+  // config.
   void Enable(const TraceConfig::MemoryDumpConfig&);
 
-  // Tearsdown the MemoryDumpManager thread and various other state set up by
-  // Enable.
+  // Tear-down tracing related state.
   void Disable();
 
   // NOTE: Use RequestGlobalDump() to create memory dumps. Creates a memory dump
@@ -306,10 +307,6 @@
   // disabling logging while dumping on another thread.
   Lock lock_;
 
-  // Optimization to avoid attempting any memory dump (i.e. to not walk an empty
-  // dump_providers_enabled_ list) when tracing is not enabled.
-  subtle::AtomicWord is_enabled_;
-
   // Thread used for MemoryDumpProviders which don't specify a task runner
   // affinity.
   std::unique_ptr<Thread> dump_thread_;

diff --git a/base/trace_event/memory_dump_manager_unittest.cc b/base/trace_event/memory_dump_manager_unittest.cc
index 6ca23f42..c1e9bef 100644
--- a/base/trace_event/memory_dump_manager_unittest.cc
+++ b/base/trace_event/memory_dump_manager_unittest.cc

@@ -159,11 +159,6 @@
     ON_CALL(*this, OnMemoryDump(_, _))
         .WillByDefault(
             Invoke([](const MemoryDumpArgs&, ProcessMemoryDump* pmd) -> bool {
-              // |heap_profiler_serialization_state| should not be null under
-              // any circumstances when invoking a memory dump. The problem
-              // might arise in race conditions like crbug.com/600570 .
-              EXPECT_TRUE(pmd->heap_profiler_serialization_state().get() !=
-                          nullptr);
               return true;
             }));
 
@@ -341,20 +336,12 @@
 };
 
 // Basic sanity checks. Registers a memory dump provider and checks that it is
-// called, but only when memory-infra is enabled.
+// called.
 TEST_F(MemoryDumpManagerTest, SingleDumper) {
   InitializeMemoryDumpManager(false /* is_coordinator */);
   MockMemoryDumpProvider mdp;
   RegisterDumpProvider(&mdp, ThreadTaskRunnerHandle::Get());
 
-  // Check that the dumper is not called if the memory category is not enabled.
-  EnableTracingWithLegacyCategories("foobar-but-not-memory");
-  EXPECT_CALL(global_dump_handler_, RequestGlobalMemoryDump(_, _)).Times(0);
-  EXPECT_CALL(mdp, OnMemoryDump(_, _)).Times(0);
-  RequestGlobalDumpAndWait(MemoryDumpType::EXPLICITLY_TRIGGERED,
-                           MemoryDumpLevelOfDetail::DETAILED);
-  DisableTracing();
-
   // Now repeat enabling the memory category and check that the dumper is
   // invoked this time.
   EnableTracingWithLegacyCategories(MemoryDumpManager::kTraceCategory);
@@ -918,9 +905,6 @@
   MockMemoryDumpProvider mdp1;
   RegisterDumpProvider(&mdp1, nullptr);
 
-  EXPECT_CALL(global_dump_handler_, RequestGlobalMemoryDump(_, _)).Times(0);
-  EXPECT_CALL(mdp1, OnMemoryDump(_, _)).Times(0);
-
   last_callback_success_ = true;
   RequestGlobalDumpAndWait(MemoryDumpType::EXPLICITLY_TRIGGERED,
                            MemoryDumpLevelOfDetail::DETAILED);
@@ -1053,44 +1037,6 @@
   DisableTracing();
 }
 
-// Tests against race conditions that can happen if tracing is disabled before
-// the CreateProcessDump() call. Real-world regression: crbug.com/580295 .
-TEST_F(MemoryDumpManagerTest, DisableTracingRightBeforeStartOfDump) {
-  base::WaitableEvent tracing_disabled_event(
-      WaitableEvent::ResetPolicy::AUTOMATIC,
-      WaitableEvent::InitialState::NOT_SIGNALED);
-  InitializeMemoryDumpManager(false /* is_coordinator */);
-
-  std::unique_ptr<Thread> mdp_thread(new Thread("test thread"));
-  mdp_thread->Start();
-
-  // Create both same-thread MDP and another MDP with dedicated thread
-  MockMemoryDumpProvider mdp1;
-  RegisterDumpProvider(&mdp1, nullptr);
-  MockMemoryDumpProvider mdp2;
-  RegisterDumpProvider(&mdp2, mdp_thread->task_runner(), kDefaultOptions);
-  EnableTracingWithLegacyCategories(MemoryDumpManager::kTraceCategory);
-
-  EXPECT_CALL(global_dump_handler_, RequestGlobalMemoryDump(_, _))
-      .WillOnce(Invoke([this](const MemoryDumpRequestArgs& args,
-                              const GlobalMemoryDumpCallback& callback) {
-        DisableTracing();
-        ProcessMemoryDumpCallback process_callback =
-            Bind(&ProcessDumpCallbackAdapter, callback);
-        mdm_->CreateProcessDump(args, process_callback);
-      }));
-
-  // If tracing is disabled for current session CreateProcessDump() should NOT
-  // request dumps from providers. Real-world regression: crbug.com/600570 .
-  EXPECT_CALL(mdp1, OnMemoryDump(_, _)).Times(0);
-  EXPECT_CALL(mdp2, OnMemoryDump(_, _)).Times(0);
-
-  last_callback_success_ = true;
-  RequestGlobalDumpAndWait(MemoryDumpType::EXPLICITLY_TRIGGERED,
-                           MemoryDumpLevelOfDetail::DETAILED);
-  EXPECT_FALSE(last_callback_success_);
-}
-
 TEST_F(MemoryDumpManagerTest, DumpOnBehalfOfOtherProcess) {
   using trace_analyzer::Query;
 
@@ -1330,6 +1276,29 @@
   mdm_->UnregisterDumpProvider(&mdp);
 }
 
+// Tests that we can do a dump without enabling/disabling.
+TEST_F(MemoryDumpManagerTest, DumpWithoutTracing) {
+  InitializeMemoryDumpManager(false /* is_coordinator */);
+  MockMemoryDumpProvider mdp;
+  RegisterDumpProvider(&mdp, ThreadTaskRunnerHandle::Get());
+
+  DisableTracing();
+
+  EXPECT_CALL(global_dump_handler_, RequestGlobalMemoryDump(_, _)).Times(3);
+  EXPECT_CALL(mdp, OnMemoryDump(_, _)).Times(3).WillRepeatedly(Return(true));
+  last_callback_success_ = true;
+  for (int i = 0; i < 3; ++i)
+    RequestGlobalDumpAndWait(MemoryDumpType::EXPLICITLY_TRIGGERED,
+                             MemoryDumpLevelOfDetail::DETAILED);
+  // The callback result should be false since (for the moment at
+  // least) a true result means that as well as the dump being
+  // successful we also managed to add the dump to the trace which shouldn't
+  // happen when tracing is not enabled.
+  EXPECT_FALSE(last_callback_success_);
+
+  mdm_->UnregisterDumpProvider(&mdp);
+}
+
 TEST_F(MemoryDumpManagerTest, TestSummaryComputation) {
   InitializeMemoryDumpManager(false /* is_coordinator */);
   MockMemoryDumpProvider mdp;

diff --git a/base/trace_event/process_memory_dump.cc b/base/trace_event/process_memory_dump.cc
index 0a2bf66..d8a51ef 100644
--- a/base/trace_event/process_memory_dump.cc
+++ b/base/trace_event/process_memory_dump.cc

@@ -253,6 +253,13 @@
     base::trace_event::TraceEventMemoryOverhead& overhead,
     const char* allocator_name) {
   if (!metrics_by_context.empty()) {
+    // We shouldn't end up here unless we're doing a detailed dump with
+    // heap profiling enabled and if that is the case tracing should be
+    // enabled which sets up the heap profiler serialization state.
+    if (!heap_profiler_serialization_state()) {
+      NOTREACHED();
+      return;
+    }
     DCHECK_EQ(0ul, heap_dumps_.count(allocator_name));
     std::unique_ptr<TracedValue> heap_dump = ExportHeapDump(
         metrics_by_context, *heap_profiler_serialization_state());

diff --git a/build/android/gradle/gn_to_cmake.py b/build/android/gradle/gn_to_cmake.py
index a790d634..dd6c132 100755
--- a/build/android/gradle/gn_to_cmake.py
+++ b/build/android/gradle/gn_to_cmake.py

@@ -189,6 +189,7 @@
     self.root_path = build_settings['root_path']
     self.build_path = posixpath.join(self.root_path,
                                      build_settings['build_dir'][2:])
+    self.object_source_deps = {}
 
   def GetAbsolutePath(self, path):
     if path.startswith("//"):
@@ -198,13 +199,19 @@
 
   def GetObjectSourceDependencies(self, gn_target_name, object_dependencies):
     """All OBJECT libraries whose sources have not been absorbed."""
+    if gn_target_name in self.object_source_deps:
+      object_dependencies.update(self.object_source_deps[gn_target_name])
+      return
+    target_deps = set()
     dependencies = self.targets[gn_target_name].get('deps', [])
     for dependency in dependencies:
       dependency_type = self.targets[dependency].get('type', None)
       if dependency_type == 'source_set':
-        object_dependencies.add(dependency)
+        target_deps.add(dependency)
       if dependency_type not in gn_target_types_that_absorb_objects:
-        self.GetObjectSourceDependencies(dependency, object_dependencies)
+        self.GetObjectSourceDependencies(dependency, target_deps)
+    self.object_source_deps[gn_target_name] = target_deps
+    object_dependencies.update(target_deps)
 
   def GetObjectLibraryDependencies(self, gn_target_name, object_dependencies):
     """All OBJECT libraries whose libraries have not been absorbed."""

diff --git a/build/sanitizers/tsan_suppressions.cc b/build/sanitizers/tsan_suppressions.cc
index 74b802ae..a20488b 100644
--- a/build/sanitizers/tsan_suppressions.cc
+++ b/build/sanitizers/tsan_suppressions.cc

@@ -249,6 +249,9 @@
 // http://crbug.com/691029
 "deadlock:libGLX.so*\n"
 
+// http://crbug.com/719633
+"race:crypto::EnsureNSSInit()\n"
+
 // End of suppressions.
 ;  // Please keep this semicolon.
 

diff --git a/cc/output/compositor_frame_metadata.h b/cc/output/compositor_frame_metadata.h
index ac4c79a42..9e73fc5 100644
--- a/cc/output/compositor_frame_metadata.h
+++ b/cc/output/compositor_frame_metadata.h

@@ -90,7 +90,7 @@
   // that if |can_activate_before_dependencies| then the display compositor
   // can choose to activate a CompositorFrame before all dependencies are
   // available.
-  // Note: |activation_dependencies| and |referenced_surfaces| are disjointed
+  // Note: |activation_dependencies| and |referenced_surfaces| are disjoint
   //       sets of surface IDs. If a surface ID is known to exist and can be
   //       used without additional synchronization, then it is placed in
   //       |referenced_surfaces|. |activation_dependencies| is the set of

diff --git a/cc/surfaces/compositor_frame_sink_support.cc b/cc/surfaces/compositor_frame_sink_support.cc
index 7770caff..8557895a 100644
--- a/cc/surfaces/compositor_frame_sink_support.cc
+++ b/cc/surfaces/compositor_frame_sink_support.cc

@@ -295,16 +295,11 @@
 
 void CompositorFrameSinkSupport::OnSurfaceActivated(Surface* surface) {
   DCHECK(surface->HasActiveFrame());
-  // TODO(staraz): Notify BeginFrameSource about the last activated sequence
-  // number.
   if (!seen_first_frame_activation_) {
     seen_first_frame_activation_ = true;
 
     const CompositorFrame& frame = surface->GetActiveFrame();
-    // CompositorFrames might not be populated with a RenderPass in unit tests.
-    gfx::Size frame_size;
-    if (!frame.render_pass_list.empty())
-      frame_size = frame.render_pass_list.back()->output_rect.size();
+    gfx::Size frame_size = frame.render_pass_list.back()->output_rect.size();
 
     // SurfaceCreated only applies for the first Surface activation. Thus,
     // SurfaceFactory stops observing new activations after the first one.

diff --git a/cc/surfaces/surface_aggregator.cc b/cc/surfaces/surface_aggregator.cc
index 93530ff6..f0e73f8 100644
--- a/cc/surfaces/surface_aggregator.cc
+++ b/cc/surfaces/surface_aggregator.cc

@@ -851,7 +851,6 @@
 
   CompositorFrame frame;
 
-  dest_resource_list_ = &frame.resource_list;
   dest_pass_list_ = &frame.render_pass_list;
 
   valid_surfaces_.clear();

diff --git a/cc/surfaces/surface_aggregator.h b/cc/surfaces/surface_aggregator.h
index 23c7b2f..28aeb493 100644
--- a/cc/surfaces/surface_aggregator.h
+++ b/cc/surfaces/surface_aggregator.h

@@ -200,9 +200,6 @@
   // This is valid during Aggregate after PrewalkTree is called.
   bool has_copy_requests_;
 
-  // Resource list for the aggregated frame.
-  TransferableResourceArray* dest_resource_list_;
-
   // Tracks UMA stats for SurfaceDrawQuads during a call to Aggregate().
   SurfaceDrawQuadUmaStats uma_stats_;
 

diff --git a/cc/trees/layer_tree_host_impl.cc b/cc/trees/layer_tree_host_impl.cc
index 89e72167..62e587c 100644
--- a/cc/trees/layer_tree_host_impl.cc
+++ b/cc/trees/layer_tree_host_impl.cc

@@ -1737,7 +1737,8 @@
   compositor_frame.render_pass_list = std::move(frame->render_passes);
   // TODO(fsamuel): Once all clients get their LocalSurfaceId from their parent,
   // the LocalSurfaceId should hang off CompositorFrameMetadata.
-  if (active_tree()->local_surface_id().is_valid()) {
+  if (settings_.enable_surface_synchronization &&
+      active_tree()->local_surface_id().is_valid()) {
     compositor_frame_sink_->SetLocalSurfaceId(
         active_tree()->local_surface_id());
   }

diff --git a/cc/trees/layer_tree_host_unittest.cc b/cc/trees/layer_tree_host_unittest.cc
index 5c16a709..f54030c 100644
--- a/cc/trees/layer_tree_host_unittest.cc
+++ b/cc/trees/layer_tree_host_unittest.cc

@@ -7250,6 +7250,10 @@
 // Makes sure that LocalSurfaceId is propagated to the CompositorFrameSink.
 class LayerTreeHostTestLocalSurfaceId : public LayerTreeHostTest {
  protected:
+  void InitializeSettings(LayerTreeSettings* settings) override {
+    settings->enable_surface_synchronization = true;
+  }
+
   void BeginTest() override {
     expected_local_surface_id_ = allocator_.GenerateId();
     PostSetLocalSurfaceIdToMainThread(expected_local_surface_id_);

diff --git a/chrome/android/java/src/org/chromium/chrome/browser/firstrun/AccountFirstRunFragment.java b/chrome/android/java/src/org/chromium/chrome/browser/firstrun/AccountFirstRunFragment.java
index d9af311..3f6d1a3 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/firstrun/AccountFirstRunFragment.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/firstrun/AccountFirstRunFragment.java

@@ -6,7 +6,6 @@
 
 import android.app.Fragment;
 import android.os.Bundle;
-import android.text.TextUtils;
 import android.view.LayoutInflater;
 import android.view.View;
 import android.view.ViewGroup;
@@ -40,42 +39,37 @@
     public void onViewCreated(View view, Bundle savedInstanceState) {
         super.onViewCreated(view, savedInstanceState);
 
-        mView.init(getPageDelegate().getProfileDataCache(), this, new AccountSigninView.Listener() {
-            @Override
-            public void onAccountSelectionCanceled() {
-                getPageDelegate().refuseSignIn();
-                advanceToNextPage();
-            }
+        mView.init(getPageDelegate().getProfileDataCache(),
+                getProperties().getBoolean(IS_CHILD_ACCOUNT),
+                getProperties().getString(FORCE_SIGNIN_ACCOUNT_TO), this,
+                new AccountSigninView.Listener() {
+                    @Override
+                    public void onAccountSelectionCanceled() {
+                        getPageDelegate().refuseSignIn();
+                        advanceToNextPage();
+                    }
 
-            @Override
-            public void onNewAccount() {
-                getPageDelegate().openAccountAdder(AccountFirstRunFragment.this);
-            }
+                    @Override
+                    public void onNewAccount() {
+                        getPageDelegate().openAccountAdder(AccountFirstRunFragment.this);
+                    }
 
-            @Override
-            public void onAccountSelected(String accountName, boolean settingsClicked) {
-                getPageDelegate().acceptSignIn(accountName);
-                if (settingsClicked) {
-                    getPageDelegate().askToOpenSignInSettings();
-                }
-                advanceToNextPage();
-            }
+                    @Override
+                    public void onAccountSelected(String accountName, boolean settingsClicked) {
+                        getPageDelegate().acceptSignIn(accountName);
+                        if (settingsClicked) {
+                            getPageDelegate().askToOpenSignInSettings();
+                        }
+                        advanceToNextPage();
+                    }
 
-            @Override
-            public void onFailedToSetForcedAccount(String forcedAccountName) {
-                // Somehow the forced account disappeared while we were in the FRE.
-                // The user would have to go through the FRE again.
-                getPageDelegate().abortFirstRunExperience();
-            }
-        });
-
-        mView.setIsChildAccount(getProperties().getBoolean(IS_CHILD_ACCOUNT));
-
-        String forcedAccountName =
-                getProperties().getString(FORCE_SIGNIN_ACCOUNT_TO);
-        if (!TextUtils.isEmpty(forcedAccountName)) {
-            mView.switchToForcedAccountMode(forcedAccountName);
-        }
+                    @Override
+                    public void onFailedToSetForcedAccount(String forcedAccountName) {
+                        // Somehow the forced account disappeared while we were in the FRE.
+                        // The user would have to go through the FRE again.
+                        getPageDelegate().abortFirstRunExperience();
+                    }
+                });
 
         RecordUserAction.record("MobileFre.SignInShown");
         RecordUserAction.record("Signin_Signin_FromStartPage");

diff --git a/chrome/android/java/src/org/chromium/chrome/browser/signin/AccountSigninActivity.java b/chrome/android/java/src/org/chromium/chrome/browser/signin/AccountSigninActivity.java
index e03695d..f6e4359 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/signin/AccountSigninActivity.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/signin/AccountSigninActivity.java

@@ -104,7 +104,7 @@
 
         mView = (AccountSigninView) LayoutInflater.from(this).inflate(
                 R.layout.account_signin_view, null);
-        mView.init(getProfileDataCache(), this, this);
+        mView.init(getProfileDataCache(), false, null, this, this);
 
         if (getAccessPoint() == SigninAccessPoint.BOOKMARK_MANAGER
                 || getAccessPoint() == SigninAccessPoint.RECENT_TABS) {

diff --git a/chrome/android/java/src/org/chromium/chrome/browser/signin/AccountSigninView.java b/chrome/android/java/src/org/chromium/chrome/browser/signin/AccountSigninView.java
index 789185b..105ddff6 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/signin/AccountSigninView.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/signin/AccountSigninView.java

@@ -134,12 +134,17 @@
     /**
      * Initializes this view with profile data cache, delegate and listener.
      * @param profileData ProfileDataCache that will be used to call to retrieve user account info.
+     * @param isChildAccount Whether this view is for a child account.
+     * @param forcedAccountName An account that should be force-selected.
      * @param delegate    The UI object creation delegate.
      * @param listener    The account selection event listener.
      */
-    public void init(ProfileDataCache profileData, Delegate delegate, Listener listener) {
+    public void init(ProfileDataCache profileData, boolean isChildAccount, String forcedAccountName,
+            Delegate delegate, Listener listener) {
         mProfileData = profileData;
         mProfileData.addObserver(this);
+        mIsChildAccount = isChildAccount;
+        mForcedAccountName = TextUtils.isEmpty(forcedAccountName) ? null : forcedAccountName;
         mDelegate = delegate;
         mListener = listener;
         showSigninPage();
@@ -223,31 +228,15 @@
     }
 
     /**
-     * Refresh the list of available system accounts asynchronously. This is a convenience method
-     * that will ignore whether the accounts updating was actually successful.
+     * Refresh the list of available system accounts asynchronously.
      */
     private void updateAccounts() {
-        updateAccounts(new Callback<Boolean>() {
-            @Override
-            public void onResult(Boolean result) {}
-        });
-    }
-
-    /**
-     * Refresh the list of available system accounts asynchronously.
-     *
-     * @param callback Called once the accounts have been refreshed. Boolean indicates whether the
-     *                 accounts haven been successfully updated.
-     */
-    private void updateAccounts(final Callback<Boolean> callback) {
         if (mSignedIn || mProfileData == null) {
-            callback.onResult(false);
             return;
         }
 
         if (!checkGooglePlayServicesAvailable()) {
             setUpSigninButton(false);
-            callback.onResult(false);
             return;
         }
 
@@ -287,10 +276,9 @@
                     accountToSelect = mAccountNames.indexOf(mForcedAccountName);
                     if (accountToSelect < 0) {
                         mListener.onFailedToSetForcedAccount(mForcedAccountName);
-                        callback.onResult(false);
                         return;
                     }
-                    shouldJumpToConfirmationScreen = false;
+                    shouldJumpToConfirmationScreen = true;
                 } else {
                     AccountSelectionResult selection = selectAccountAfterAccountsUpdate(
                             oldAccountNames, mAccountNames, oldSelectedAccount);
@@ -316,7 +304,6 @@
                 if (shouldJumpToConfirmationScreen) {
                     showConfirmSigninPageAccountTrackerServiceCheck();
                 }
-                callback.onResult(true);
             }
         });
     }
@@ -603,30 +590,6 @@
     }
 
     /**
-     * @param isChildAccount Whether this view is for a child account.
-     */
-    public void setIsChildAccount(boolean isChildAccount) {
-        mIsChildAccount = isChildAccount;
-    }
-
-    /**
-     * Switches the view to "no choice, just a confirmation" forced-account mode.
-     * @param forcedAccountName An account that should be force-selected.
-     */
-    public void switchToForcedAccountMode(String forcedAccountName) {
-        mForcedAccountName = forcedAccountName;
-        updateAccounts(new Callback<Boolean>() {
-            @Override
-            public void onResult(Boolean result) {
-                if (!result) return;
-                assert TextUtils.equals(getSelectedAccountName(), mForcedAccountName);
-                switchToSignedMode();
-                assert TextUtils.equals(getSelectedAccountName(), mForcedAccountName);
-            }
-        });
-    }
-
-    /**
      * @return Whether the view is in signed in mode.
      */
     public boolean isSignedIn() {

diff --git a/chrome/android/java/src/org/chromium/chrome/browser/toolbar/CustomTabToolbar.java b/chrome/android/java/src/org/chromium/chrome/browser/toolbar/CustomTabToolbar.java
index 5fac1150..ae37620 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/toolbar/CustomTabToolbar.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/toolbar/CustomTabToolbar.java

@@ -233,14 +233,6 @@
         return mCustomActionButton;
     }
 
-    /**
-     * @return The close button. For test purpose only.
-     */
-    @VisibleForTesting
-    public ImageButton getCloseButtonForTest() {
-        return mCloseButton;
-    }
-
     @Override
     public int getTabStripHeight() {
         return 0;

diff --git a/chrome/android/java/src/org/chromium/chrome/browser/toolbar/ToolbarManager.java b/chrome/android/java/src/org/chromium/chrome/browser/toolbar/ToolbarManager.java
index c63bd7d..411f44b 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/toolbar/ToolbarManager.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/toolbar/ToolbarManager.java

@@ -172,8 +172,6 @@
     private boolean mShouldUpdateTabCount = true;
     private boolean mShouldUpdateToolbarPrimaryColor = true;
 
-    private Runnable mDeferredStartupRunnable;
-
     /**
      * Creates a ToolbarManager object.
      *
@@ -824,12 +822,6 @@
         if (currentTab != null) currentTab.removeObserver(mTabObserver);
         mFindToolbarObservers.clear();
         mToolbar.destroy();
-        if (mDeferredStartupRunnable != null) {
-            // Run the runnable now, because there won't be any new data in the future.
-            ThreadUtils.getUiThreadHandler().removeCallbacks(mDeferredStartupRunnable);
-            mDeferredStartupRunnable.run();
-            mDeferredStartupRunnable = null;
-        }
     }
 
     /**
@@ -1128,17 +1120,13 @@
             final String activityName) {
         // Record startup performance statistics
         long elapsedTime = SystemClock.elapsedRealtime() - activityCreationTimeMs;
-        if (elapsedTime < RECORD_UMA_PERFORMANCE_METRICS_DELAY_MS
-                && mDeferredStartupRunnable == null) {
-            mDeferredStartupRunnable = new Runnable() {
+        if (elapsedTime < RECORD_UMA_PERFORMANCE_METRICS_DELAY_MS) {
+            ThreadUtils.postOnUiThreadDelayed(new Runnable() {
                 @Override
                 public void run() {
                     onDeferredStartup(activityCreationTimeMs, activityName);
-                    mDeferredStartupRunnable = null;
                 }
-            };
-            ThreadUtils.postOnUiThreadDelayed(mDeferredStartupRunnable,
-                    RECORD_UMA_PERFORMANCE_METRICS_DELAY_MS - elapsedTime);
+            }, RECORD_UMA_PERFORMANCE_METRICS_DELAY_MS - elapsedTime);
         }
         RecordHistogram.recordTimesHistogram("MobileStartup.ToolbarFirstDrawTime." + activityName,
                 mToolbar.getFirstDrawTime() - activityCreationTimeMs, TimeUnit.MILLISECONDS);

diff --git a/chrome/android/java/src/org/chromium/chrome/browser/vr_shell/OWNERS b/chrome/android/java/src/org/chromium/chrome/browser/vr_shell/OWNERS
index 5ad40509..05bc2345 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/vr_shell/OWNERS
+++ b/chrome/android/java/src/org/chromium/chrome/browser/vr_shell/OWNERS

@@ -1,5 +1,5 @@
 set noparent
 
-bshe@chromium.org
-girard@chromium.org
-mthiesse@chromium.org
+file://chrome/android/java/src/org/chromium/chrome/browser/vr_shell/VR_JAVA_OWNERS
+
+# COMPONENT: UI>Browser>VR

diff --git a/chrome/android/java/src/org/chromium/chrome/browser/vr_shell/VR_JAVA_OWNERS b/chrome/android/java/src/org/chromium/chrome/browser/vr_shell/VR_JAVA_OWNERS
new file mode 100644
index 0000000..5db0deb
--- /dev/null
+++ b/chrome/android/java/src/org/chromium/chrome/browser/vr_shell/VR_JAVA_OWNERS

@@ -0,0 +1,2 @@
+bshe@chromium.org
+mthiesse@chromium.org

diff --git a/chrome/android/javatests/src/org/chromium/chrome/browser/customtabs/CustomTabActivityTest.java b/chrome/android/javatests/src/org/chromium/chrome/browser/customtabs/CustomTabActivityTest.java
index 3ee9a356..83646723 100644
--- a/chrome/android/javatests/src/org/chromium/chrome/browser/customtabs/CustomTabActivityTest.java
+++ b/chrome/android/javatests/src/org/chromium/chrome/browser/customtabs/CustomTabActivityTest.java

@@ -32,7 +32,6 @@
 import android.support.customtabs.CustomTabsServiceConnection;
 import android.support.customtabs.CustomTabsSession;
 import android.support.customtabs.CustomTabsSessionToken;
-import android.support.test.filters.LargeTest;
 import android.support.test.filters.MediumTest;
 import android.support.test.filters.SmallTest;
 import android.text.TextUtils;
@@ -50,7 +49,6 @@
 import org.chromium.base.ObserverList.RewindableIterator;
 import org.chromium.base.PathUtils;
 import org.chromium.base.ThreadUtils;
-import org.chromium.base.annotations.SuppressFBWarnings;
 import org.chromium.base.library_loader.LibraryLoader;
 import org.chromium.base.library_loader.LibraryProcessType;
 import org.chromium.base.test.util.CallbackHelper;
@@ -70,7 +68,6 @@
 import org.chromium.chrome.browser.document.ChromeLauncherActivity;
 import org.chromium.chrome.browser.firstrun.FirstRunStatus;
 import org.chromium.chrome.browser.metrics.PageLoadMetrics;
-import org.chromium.chrome.browser.preferences.Preferences;
 import org.chromium.chrome.browser.prerender.ExternalPrerenderHandler;
 import org.chromium.chrome.browser.profiles.Profile;
 import org.chromium.chrome.browser.tab.EmptyTabObserver;
@@ -82,8 +79,6 @@
 import org.chromium.chrome.browser.tabmodel.TabModelSelector;
 import org.chromium.chrome.browser.toolbar.CustomTabToolbar;
 import org.chromium.chrome.browser.util.ColorUtils;
-import org.chromium.chrome.test.util.ApplicationTestUtils;
-import org.chromium.chrome.test.util.ApplicationTestUtils.ActivityCloser;
 import org.chromium.chrome.test.util.ChromeRestriction;
 import org.chromium.chrome.test.util.browser.LocationSettingsTestUtil;
 import org.chromium.chrome.test.util.browser.contextmenu.ContextMenuUtils;
@@ -99,10 +94,7 @@
 import org.chromium.net.test.util.TestWebServer;
 import org.chromium.ui.mojom.WindowOpenDisposition;
 
-import java.lang.ref.WeakReference;
 import java.util.ArrayList;
-import java.util.Collections;
-import java.util.List;
 import java.util.concurrent.Callable;
 import java.util.concurrent.TimeoutException;
 import java.util.concurrent.atomic.AtomicBoolean;
@@ -2358,144 +2350,6 @@
         assertEquals(testUrl, tab.getUrl());
     }
 
-    @LargeTest
-    public void testClosedActivitiesNotLeaked() throws Exception {
-        openCloseActivities(true /* closeFrontToBack */, new ActivityCloser<CustomTabActivity>() {
-            @Override
-            public void close(CustomTabActivity activity) {
-                CustomTabToolbar toolbar = (CustomTabToolbar) activity.findViewById(R.id.toolbar);
-                toolbar.getCloseButtonForTest().performClick();
-            }
-        });
-    }
-
-    @LargeTest
-    public void testClosedBackActivitiesNotLeaked() throws Exception {
-        openCloseActivities(true /* closeFrontToBack */, new ActivityCloser<CustomTabActivity>() {
-            @Override
-            public void close(CustomTabActivity activity) {
-                activity.onBackPressed();
-            }
-        });
-    }
-
-    @LargeTest
-    public void testFinishedActivitiesNotLeaked() throws Exception {
-        openCloseActivities(true /* closeFrontToBack */, new ActivityCloser<CustomTabActivity>() {
-            @Override
-            public void close(CustomTabActivity activity) {
-                activity.finish();
-            }
-        });
-    }
-
-    @LargeTest
-    public void testStoppedFinishedActivitiesNotLeaked() throws Exception {
-        openCloseActivities(false /* closeFrontToBack */, new ActivityCloser<CustomTabActivity>() {
-            @Override
-            public void close(CustomTabActivity activity) {
-                activity.finish();
-            }
-        });
-    }
-
-    /**
-     * Opens several activities, closes them, and checks that activities are GCed.
-     *
-     * @param closeFrontToBack Whether to close activities starting from the
-     *            last opened one (front), or from the first opened one (back).
-     *            Essentially this param controls whether activities are closed
-     *            in the active (true) or stopped (false) state.
-     * @param activityCloser Activity closing logic.
-     */
-    @SuppressFBWarnings("DM_GC")
-    private void openCloseActivities(boolean closeFrontToBack,
-            final ActivityCloser<CustomTabActivity> activityCloser) throws Exception {
-        final int activityCount = 5;
-
-        final List<WeakReference<Activity>> activityRefs = new ArrayList<>();
-
-        // Something in ApplicationTestUtils.closeActivity() call below retains last closed
-        // activity (in a local reference). I couldn't figure out what it is, so to avoid
-        // the problem we start one extra activity so that it's closed last. We don't care
-        // what that extra activity is, as long it's not CustomTabActivity. Note that we
-        // need to start extra activity before / after CCT activities according to
-        // closeFrontToBack flag.
-        Runnable extraActivityStarter = new Runnable() {
-            @Override
-            public void run() {
-                Intent intent = new Intent();
-                intent.setClass(getInstrumentation().getTargetContext(), Preferences.class);
-                intent.addFlags(Intent.FLAG_ACTIVITY_NEW_TASK);
-                activityRefs.add(
-                        new WeakReference<>(getInstrumentation().startActivitySync(intent)));
-            }
-        };
-        ActivityCloser<Activity> extraActivityCloser = new ActivityCloser<Activity>() {
-            @Override
-            public void close(Activity activity) {
-                activity.finish();
-            }
-        };
-
-        // We're closing front to back, so extra activity should be started first.
-        if (closeFrontToBack) extraActivityStarter.run();
-
-        for (int i = 0; i != activityCount; ++i) {
-            // Don't use startActivityCompletely() because it retains the started
-            // activity in several member variables.
-            CustomTabActivity activity =
-                    launchCustomTabActivityCompletely(createMinimalCustomTabIntent());
-            waitForCustomTab(activity);
-            activityRefs.add(new WeakReference<Activity>(activity));
-        }
-
-        // We're closing back to front, so extra activity should be started last.
-        if (!closeFrontToBack) extraActivityStarter.run();
-
-        // Make sure that the first activity we need to close is at the beginning.
-        if (closeFrontToBack) Collections.reverse(activityRefs);
-
-        for (WeakReference<Activity> ref : activityRefs) {
-            Activity activity = ref.get();
-            // Activity can be null here if "Don't keep activities" developer option
-            // is turned on.
-            if (activity != null) {
-                if (activity instanceof CustomTabActivity) {
-                    ApplicationTestUtils.closeActivity(
-                            (CustomTabActivity) activity, activityCloser);
-                } else {
-                    // Must be an extra activity started above.
-                    ApplicationTestUtils.closeActivity(activity, extraActivityCloser);
-                }
-            }
-        }
-
-        // GC the activities. Note that System.gc() is a no-op unless it is followed
-        // by or following a call to System.runFinalization().
-        System.gc();
-        System.runFinalization();
-        System.gc();
-
-        for (int i = 0; i != activityCount; ++i) {
-            WeakReference<Activity> ref = activityRefs.get(i);
-
-            // If this fails: something retains activities! It's probably a leak!
-            // In order to find the culprit:
-            //  * Repro locally
-            //  * Comment out the assert
-            //  * Add Thread.sleep() for a minute or so
-            //  * While it's sleeping, open DDMS and take an HPROF dump
-            //  * Use ahat tool (go/ahat) to open the dump
-            //  * Go to 'allocations' page
-            //  * Find 'SeparateTaskCustomTabActivity' row
-            //  * Click on the number, *not* on the class name
-            //  * You will see a list of live SeparateTaskCustomTabActivity objects -
-            //    click on entries and inspect their 'Sample Path from GC Root'.
-            assertNull("Activity is leaked", ref.get());
-        }
-    }
-
     /** Maybe prerenders a URL with a referrer, then launch it with another one. */
     private void maybeSpeculateAndLaunchWithReferrers(String url, int speculationMode,
             String speculationReferrer, String launchReferrer) throws Exception {

diff --git a/chrome/android/javatests/src/org/chromium/chrome/browser/customtabs/CustomTabActivityTestBase.java b/chrome/android/javatests/src/org/chromium/chrome/browser/customtabs/CustomTabActivityTestBase.java
index d21d4e3..92df683 100644
--- a/chrome/android/javatests/src/org/chromium/chrome/browser/customtabs/CustomTabActivityTestBase.java
+++ b/chrome/android/javatests/src/org/chromium/chrome/browser/customtabs/CustomTabActivityTestBase.java

@@ -19,13 +19,9 @@
 import org.chromium.content.browser.test.util.CriteriaHelper;
 
 import java.lang.ref.WeakReference;
-import java.util.Collections;
-import java.util.IdentityHashMap;
 import java.util.List;
-import java.util.Set;
 import java.util.concurrent.TimeUnit;
 import java.util.concurrent.TimeoutException;
-import java.util.concurrent.atomic.AtomicReference;
 
 /**
  * Base class for all instrumentation tests that require a {@link CustomTabActivity}.
@@ -46,26 +42,8 @@
 
     @Override
     protected void startActivityCompletely(Intent intent) {
-        setActivity(launchCustomTabActivityCompletely(intent));
-    }
-
-    /**
-     * Start a {@link CustomTabActivity} with given {@link Intent} and return the
-     * activity started. Note that this function doesn't wait for the activity's
-     * tab to initialize.
-     */
-    protected CustomTabActivity launchCustomTabActivityCompletely(Intent intent) {
-        final Set<Activity> currentActivities =
-                Collections.newSetFromMap(new IdentityHashMap<Activity, Boolean>());
-        for (WeakReference<Activity> ref : ApplicationStatus.getRunningActivities()) {
-            Activity currentActivity = ref.get();
-            if (currentActivity != null) {
-                currentActivities.add(currentActivity);
-            }
-        }
         Activity activity = getInstrumentation().startActivitySync(intent);
         assertNotNull("Main activity did not start", activity);
-        final AtomicReference<CustomTabActivity> launchedActivity = new AtomicReference<>();
         CriteriaHelper.pollUiThread(new Criteria() {
             @Override
             public boolean isSatisfied() {
@@ -73,16 +51,14 @@
                 for (WeakReference<Activity> ref : list) {
                     Activity activity = ref.get();
                     if (activity == null) continue;
-                    if (currentActivities.contains(activity)) continue;
                     if (activity instanceof CustomTabActivity) {
-                        launchedActivity.set((CustomTabActivity) activity);
+                        setActivity(activity);
                         return true;
                     }
                 }
                 return false;
             }
         });
-        return launchedActivity.get();
     }
 
     /**
@@ -91,19 +67,13 @@
      */
     protected void startCustomTabActivityWithIntent(Intent intent) throws InterruptedException {
         startActivityCompletely(intent);
-        waitForCustomTab(getActivity());
-    }
-
-    /** Wait till the activity's tab is initialized. */
-    protected static void waitForCustomTab(final CustomTabActivity activity)
-            throws InterruptedException {
         CriteriaHelper.pollUiThread(new Criteria("Tab never selected/initialized.") {
             @Override
             public boolean isSatisfied() {
-                return activity.getActivityTab() != null;
+                return getActivity().getActivityTab() != null;
             }
         });
-        final Tab tab = activity.getActivityTab();
+        final Tab tab = getActivity().getActivityTab();
         final CallbackHelper pageLoadFinishedHelper = new CallbackHelper();
         tab.addObserver(new EmptyTabObserver() {
             @Override
@@ -129,4 +99,4 @@
         assertNotNull(tab.getView());
         assertTrue(tab.isCurrentlyACustomTab());
     }
-}
\ No newline at end of file
+}

diff --git a/chrome/android/javatests/src/org/chromium/chrome/browser/vr_shell/OWNERS b/chrome/android/javatests/src/org/chromium/chrome/browser/vr_shell/OWNERS
new file mode 100644
index 0000000..7fb6ea3
--- /dev/null
+++ b/chrome/android/javatests/src/org/chromium/chrome/browser/vr_shell/OWNERS

@@ -0,0 +1,3 @@
+file://chrome/android/java/src/org/chromium/chrome/browser/vr_shell/VR_JAVA_OWNERS
+
+# COMPONENT: UI>Browser>VR

diff --git a/chrome/browser/about_flags.cc b/chrome/browser/about_flags.cc
index b3896559..09ce9a435 100644
--- a/chrome/browser/about_flags.cc
+++ b/chrome/browser/about_flags.cc

@@ -2454,6 +2454,10 @@
     {"android-payment-apps", flag_descriptions::kAndroidPaymentAppsName,
      flag_descriptions::kAndroidPaymentAppsDescription, kOsAndroid,
      FEATURE_VALUE_TYPE(chrome::android::kAndroidPaymentApps)},
+    {"service-worker-payment-apps",
+     flag_descriptions::kServiceWorkerPaymentAppsName,
+     flag_descriptions::kServiceWorkerPaymentAppsDescription, kOsAndroid,
+     FEATURE_VALUE_TYPE(features::kServiceWorkerPaymentApps)},
 #endif  // OS_ANDROID
 #if defined(OS_CHROMEOS)
     {"disable-eol-notification", flag_descriptions::kEolNotificationName,

diff --git a/chrome/browser/android/vr_shell/BUILD.gn b/chrome/browser/android/vr_shell/BUILD.gn
index fe518a7..bc017613 100644
--- a/chrome/browser/android/vr_shell/BUILD.gn
+++ b/chrome/browser/android/vr_shell/BUILD.gn

@@ -50,7 +50,6 @@
       "ui_elements/ui_element.h",
       "ui_elements/url_bar.cc",
       "ui_elements/url_bar.h",
-      "ui_interface.cc",
       "ui_interface.h",
       "ui_scene.cc",
       "ui_scene.h",

diff --git a/chrome/browser/android/vr_shell/ui_interface.cc b/chrome/browser/android/vr_shell/ui_interface.cc
deleted file mode 100644
index b1ecd36..0000000
--- a/chrome/browser/android/vr_shell/ui_interface.cc
+++ /dev/null

@@ -1,48 +0,0 @@
-// Copyright 2016 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "chrome/browser/android/vr_shell/ui_interface.h"
-
-#include "url/gurl.h"
-
-namespace vr_shell {
-
-UiInterface::UiInterface(Mode initial_mode) : mode_(initial_mode) {}
-
-void UiInterface::SetMode(Mode mode) {
-  mode_ = mode;
-}
-
-void UiInterface::SetFullscreen(bool enabled) {
-  fullscreen_ = enabled;
-}
-
-void UiInterface::SetSecurityLevel(int level) {}
-
-void UiInterface::SetWebVRSecureOrigin(bool secure) {}
-
-void UiInterface::SetLoading(bool loading) {}
-
-void UiInterface::SetLoadProgress(double progress) {}
-
-void UiInterface::InitTabList() {}
-
-void UiInterface::AppendToTabList(bool incognito,
-                                  int id,
-                                  const base::string16& title) {}
-
-void UiInterface::UpdateTab(bool incognito, int id, const std::string& title) {}
-
-void UiInterface::FlushTabList() {}
-
-void UiInterface::RemoveTab(bool incognito, int id) {}
-
-void UiInterface::SetURL(const GURL& url) {}
-
-void UiInterface::HandleAppButtonGesturePerformed(Direction direction) {}
-
-void UiInterface::SetHistoryButtonsEnabled(bool can_go_back,
-                                           bool can_go_forward) {}
-
-}  // namespace vr_shell

diff --git a/chrome/browser/android/vr_shell/ui_interface.h b/chrome/browser/android/vr_shell/ui_interface.h
index 23bfdd11..fc77e961 100644
--- a/chrome/browser/android/vr_shell/ui_interface.h
+++ b/chrome/browser/android/vr_shell/ui_interface.h

@@ -5,12 +5,6 @@
 #ifndef CHROME_BROWSER_ANDROID_VR_SHELL_UI_INTERFACE_H_
 #define CHROME_BROWSER_ANDROID_VR_SHELL_UI_INTERFACE_H_
 
-#include <memory>
-#include <string>
-
-#include "base/macros.h"
-#include "base/values.h"
-
 class GURL;
 
 namespace vr_shell {
@@ -19,11 +13,6 @@
 // HTML UI. State information is asynchronous and unidirectional.
 class UiInterface {
  public:
-  enum Mode {
-    STANDARD = 0,
-    WEB_VR,
-  };
-
   enum Direction {
     NONE = 0,
     LEFT,
@@ -32,30 +21,26 @@
     DOWN,
   };
 
-  explicit UiInterface(Mode initial_mode);
-  virtual ~UiInterface() = default;
+  virtual ~UiInterface() {}
 
-  // Set HTML UI state or pass events.
-  void SetMode(Mode mode);
-  void SetFullscreen(bool enabled);
-  void SetSecurityLevel(int level);
-  void SetWebVRSecureOrigin(bool secure);
-  void SetLoading(bool loading);
-  void SetLoadProgress(double progress);
-  void InitTabList();
-  void AppendToTabList(bool incognito, int id, const base::string16& title);
-  void FlushTabList();
-  void UpdateTab(bool incognito, int id, const std::string& title);
-  void RemoveTab(bool incognito, int id);
-  void SetURL(const GURL& url);
-  void HandleAppButtonGesturePerformed(Direction direction);
-  void SetHistoryButtonsEnabled(bool can_go_back, bool can_go_forward);
+  virtual void SetWebVrMode(bool enabled) = 0;
+  virtual void SetURL(const GURL& url) = 0;
+  virtual void SetFullscreen(bool enabled) = 0;
+  virtual void SetSecurityLevel(int level) = 0;
+  virtual void SetWebVrSecureOrigin(bool secure) = 0;
+  virtual void SetLoading(bool loading) = 0;
+  virtual void SetLoadProgress(double progress) = 0;
+  virtual void SetHistoryButtonsEnabled(bool can_go_back,
+                                        bool can_go_forward) = 0;
 
- private:
-  Mode mode_;
-  bool fullscreen_ = false;
-
-  DISALLOW_COPY_AND_ASSIGN(UiInterface);
+  // Tab handling.
+  virtual void InitTabList() {}
+  virtual void AppendToTabList(bool incognito,
+                               int id,
+                               const base::string16& title) {}
+  virtual void FlushTabList() {}
+  virtual void UpdateTab(bool incognito, int id, const std::string& title) {}
+  virtual void RemoveTab(bool incognito, int id) {}
 };
 
 }  // namespace vr_shell

diff --git a/chrome/browser/android/vr_shell/ui_scene_manager.cc b/chrome/browser/android/vr_shell/ui_scene_manager.cc
index eea14738..e617824e 100644
--- a/chrome/browser/android/vr_shell/ui_scene_manager.cc
+++ b/chrome/browser/android/vr_shell/ui_scene_manager.cc

@@ -56,10 +56,12 @@
 
 UiSceneManager::UiSceneManager(VrBrowserInterface* browser,
                                UiScene* scene,
-                               bool in_cct)
+                               bool in_cct,
+                               bool in_web_vr)
     : browser_(browser),
       scene_(scene),
       in_cct_(in_cct),
+      web_vr_mode_(in_web_vr),
       weak_ptr_factory_(this) {
   CreateBackground();
   CreateContentQuad();
@@ -201,7 +203,7 @@
   return weak_ptr_factory_.GetWeakPtr();
 }
 
-void UiSceneManager::SetWebVRMode(bool web_vr) {
+void UiSceneManager::SetWebVrMode(bool web_vr) {
   web_vr_mode_ = web_vr;
 
   // Make all VR scene UI elements visible if not in WebVR.
@@ -212,7 +214,7 @@
   ConfigureSecurityWarnings();
 }
 
-void UiSceneManager::SetWebVRSecureOrigin(bool secure) {
+void UiSceneManager::SetWebVrSecureOrigin(bool secure) {
   secure_origin_ = secure;
   ConfigureSecurityWarnings();
 }
@@ -225,7 +227,10 @@
   browser_->OnContentPaused(!content_rendering_enabled_);
 }
 
-void UiSceneManager::OnFullscreenChanged(bool fullscreen) {
+void UiSceneManager::OnAppButtonGesturePerformed(
+    UiInterface::Direction direction) {}
+
+void UiSceneManager::SetFullscreen(bool fullscreen) {
   // Make all VR scene UI elements visible if not in WebVR or fullscreen.
   for (UiElement* element : browser_ui_elements_) {
     element->set_visible(!fullscreen);
@@ -269,10 +274,19 @@
   transient_security_warning_->set_visible(false);
 }
 
-void UiSceneManager::OnUrlChange(const GURL& gurl) {
+void UiSceneManager::SetURL(const GURL& gurl) {
   url_bar_->SetURL(gurl);
 }
 
+void UiSceneManager::SetSecurityLevel(int level) {}
+
+void UiSceneManager::SetLoading(bool loading) {}
+
+void UiSceneManager::SetLoadProgress(double progress) {}
+
+void UiSceneManager::SetHistoryButtonsEnabled(bool can_go_back,
+                                              bool can_go_forward) {}
+
 int UiSceneManager::AllocateId() {
   return next_available_id_++;
 }

diff --git a/chrome/browser/android/vr_shell/ui_scene_manager.h b/chrome/browser/android/vr_shell/ui_scene_manager.h
index eb782dd..4eae5b1a 100644
--- a/chrome/browser/android/vr_shell/ui_scene_manager.h
+++ b/chrome/browser/android/vr_shell/ui_scene_manager.h

@@ -9,7 +9,9 @@
 #include "base/memory/weak_ptr.h"
 #include "base/timer/timer.h"
 #include "base/values.h"
-#include "url/gurl.h"
+#include "chrome/browser/android/vr_shell/ui_interface.h"
+
+class GURL;
 
 namespace vr_shell {
 
@@ -20,17 +22,26 @@
 
 class UiSceneManager {
  public:
-  UiSceneManager(VrBrowserInterface* browser, UiScene* scene, bool in_cct);
+  UiSceneManager(VrBrowserInterface* browser,
+                 UiScene* scene,
+                 bool in_cct,
+                 bool in_web_vr);
   ~UiSceneManager();
 
   base::WeakPtr<UiSceneManager> GetWeakPtr();
 
-  void SetWebVRSecureOrigin(bool secure);
-  void SetWebVRMode(bool web_vr);
+  void SetFullscreen(bool fullscreen);
+  void SetURL(const GURL& gurl);
+  void SetWebVrSecureOrigin(bool secure);
+  void SetWebVrMode(bool web_vr);
+  // These methods are currently stubbed.
+  void SetSecurityLevel(int level);
+  void SetLoading(bool loading);
+  void SetLoadProgress(double progress);
+  void SetHistoryButtonsEnabled(bool can_go_back, bool can_go_forward);
 
   void OnAppButtonClicked();
-  void OnUrlChange(const GURL& gurl);
-  void OnFullscreenChanged(bool fullscreen);
+  void OnAppButtonGesturePerformed(UiInterface::Direction direction);
 
  private:
   void CreateSecurityWarnings();
@@ -51,10 +62,10 @@
   UiElement* main_content_ = nullptr;
   UrlBar* url_bar_ = nullptr;
 
-  bool web_vr_mode_ = false;
+  bool in_cct_;
+  bool web_vr_mode_;
   bool secure_origin_ = false;
   bool content_rendering_enabled_ = true;
-  bool in_cct_;
 
   int next_available_id_ = 1;
 

diff --git a/chrome/browser/android/vr_shell/ui_scene_manager_unittest.cc b/chrome/browser/android/vr_shell/ui_scene_manager_unittest.cc
index 09d0135..b7b840f6 100644
--- a/chrome/browser/android/vr_shell/ui_scene_manager_unittest.cc
+++ b/chrome/browser/android/vr_shell/ui_scene_manager_unittest.cc

@@ -21,8 +21,22 @@
   MockBrowserInterface() {}
   ~MockBrowserInterface() override {}
 
+  MOCK_METHOD1(ContentSurfaceChanged, void(jobject));
+  MOCK_METHOD0(GvrDelegateReady, void());
+  MOCK_METHOD1(UpdateGamepadData, void(device::GvrGamepadData));
+  MOCK_METHOD1(AppButtonGesturePerformed, void(UiInterface::Direction));
+
+  MOCK_METHOD0(AppButtonClicked, void());
+  MOCK_METHOD0(ForceExitVr, void());
+  MOCK_METHOD2(
+      RunVRDisplayInfoCallback,
+      void(const base::Callback<void(device::mojom::VRDisplayInfoPtr)>&,
+           device::mojom::VRDisplayInfoPtr*));
   MOCK_METHOD1(OnContentPaused, void(bool));
 
+  // Stub this as scoped pointers don't work as mock method parameters.
+  void ProcessContentGesture(std::unique_ptr<blink::WebInputEvent>) {}
+
  private:
   DISALLOW_COPY_AND_ASSIGN(MockBrowserInterface);
 };
@@ -37,8 +51,9 @@
     // TODO(mthiesse): When we have UI to test for CCT, we'll need to modify
     // setup to allow us to test CCT mode.
     bool in_cct = false;
-    manager_ =
-        base::MakeUnique<UiSceneManager>(browser_.get(), scene_.get(), in_cct);
+    bool in_web_vr = true;
+    manager_ = base::MakeUnique<UiSceneManager>(browser_.get(), scene_.get(),
+                                                in_cct, in_web_vr);
   }
 
  protected:

diff --git a/chrome/browser/android/vr_shell/vr_browser_interface.h b/chrome/browser/android/vr_shell/vr_browser_interface.h
index 170fe800..d852cf9 100644
--- a/chrome/browser/android/vr_shell/vr_browser_interface.h
+++ b/chrome/browser/android/vr_shell/vr_browser_interface.h

@@ -27,18 +27,18 @@
  public:
   virtual ~VrBrowserInterface() {}
 
-  virtual void ContentSurfaceChanged(jobject surface) {}
-  virtual void GvrDelegateReady() {}
-  virtual void UpdateGamepadData(device::GvrGamepadData) {}
-  virtual void AppButtonGesturePerformed(UiInterface::Direction direction) {}
-  virtual void OnAppButtonClicked() {}
+  virtual void ContentSurfaceChanged(jobject surface) = 0;
+  virtual void GvrDelegateReady() = 0;
+  virtual void UpdateGamepadData(device::GvrGamepadData) = 0;
+  virtual void AppButtonGesturePerformed(UiInterface::Direction direction) = 0;
+  virtual void AppButtonClicked() = 0;
   virtual void ProcessContentGesture(
-      std::unique_ptr<blink::WebInputEvent> event) {}
-  virtual void ForceExitVr() {}
+      std::unique_ptr<blink::WebInputEvent> event) = 0;
+  virtual void ForceExitVr() = 0;
   virtual void RunVRDisplayInfoCallback(
       const base::Callback<void(device::mojom::VRDisplayInfoPtr)>& callback,
-      device::mojom::VRDisplayInfoPtr* info) {}
-  virtual void OnContentPaused(bool enabled) {}
+      device::mojom::VRDisplayInfoPtr* info) = 0;
+  virtual void OnContentPaused(bool enabled) = 0;
 };
 
 }  // namespace vr_shell

diff --git a/chrome/browser/android/vr_shell/vr_gl_thread.cc b/chrome/browser/android/vr_shell/vr_gl_thread.cc
index e2a12fd..e7cafaa 100644
--- a/chrome/browser/android/vr_shell/vr_gl_thread.cc
+++ b/chrome/browser/android/vr_shell/vr_gl_thread.cc

@@ -38,8 +38,8 @@
   scene_ = base::MakeUnique<UiScene>();
   vr_shell_gl_ = base::MakeUnique<VrShellGl>(
       this, gvr_api_, initially_web_vr_, reprojected_rendering_, scene_.get());
-  scene_manager_ =
-      base::MakeUnique<UiSceneManager>(this, scene_.get(), in_cct_);
+  scene_manager_ = base::MakeUnique<UiSceneManager>(this, scene_.get(), in_cct_,
+                                                    initially_web_vr_);
 
   weak_vr_shell_gl_ = vr_shell_gl_->GetWeakPtr();
   weak_scene_manager_ = scene_manager_->GetWeakPtr();
@@ -62,18 +62,18 @@
       FROM_HERE, base::Bind(&VrShell::UpdateGamepadData, weak_vr_shell_, pad));
 }
 
-void VrGLThread::AppButtonGesturePerformed(UiInterface::Direction direction) {
-  main_thread_task_runner_->PostTask(
-      FROM_HERE, base::Bind(&VrShell::AppButtonGesturePerformed, weak_vr_shell_,
-                            direction));
-}
-
-void VrGLThread::OnAppButtonClicked() {
-  weak_vr_shell_gl_->GetTaskRunner()->PostTask(
+void VrGLThread::AppButtonClicked() {
+  task_runner()->PostTask(
       FROM_HERE,
       base::Bind(&UiSceneManager::OnAppButtonClicked, weak_scene_manager_));
 }
 
+void VrGLThread::AppButtonGesturePerformed(UiInterface::Direction direction) {
+  task_runner()->PostTask(
+      FROM_HERE, base::Bind(&UiSceneManager::OnAppButtonGesturePerformed,
+                            weak_scene_manager_, direction));
+}
+
 void VrGLThread::ProcessContentGesture(
     std::unique_ptr<blink::WebInputEvent> event) {
   main_thread_task_runner_->PostTask(
@@ -99,6 +99,59 @@
       base::Bind(&VrShell::OnContentPaused, weak_vr_shell_, enabled));
 }
 
+void VrGLThread::SetFullscreen(bool enabled) {
+  WaitUntilThreadStarted();
+  task_runner()->PostTask(FROM_HERE, base::Bind(&UiSceneManager::SetFullscreen,
+                                                weak_scene_manager_, enabled));
+}
+
+void VrGLThread::SetHistoryButtonsEnabled(bool can_go_back,
+                                          bool can_go_forward) {
+  WaitUntilThreadStarted();
+  task_runner()->PostTask(
+      FROM_HERE, base::Bind(&UiSceneManager::SetHistoryButtonsEnabled,
+                            weak_scene_manager_, can_go_forward, can_go_back));
+}
+
+void VrGLThread::SetLoadProgress(double progress) {
+  WaitUntilThreadStarted();
+  task_runner()->PostTask(FROM_HERE,
+                          base::Bind(&UiSceneManager::SetLoadProgress,
+                                     weak_scene_manager_, progress));
+}
+
+void VrGLThread::SetLoading(bool loading) {
+  WaitUntilThreadStarted();
+  task_runner()->PostTask(FROM_HERE, base::Bind(&UiSceneManager::SetLoading,
+                                                weak_scene_manager_, loading));
+}
+
+void VrGLThread::SetSecurityLevel(int level) {
+  WaitUntilThreadStarted();
+  task_runner()->PostTask(FROM_HERE,
+                          base::Bind(&UiSceneManager::SetSecurityLevel,
+                                     weak_scene_manager_, level));
+}
+
+void VrGLThread::SetURL(const GURL& gurl) {
+  WaitUntilThreadStarted();
+  task_runner()->PostTask(FROM_HERE, base::Bind(&UiSceneManager::SetURL,
+                                                weak_scene_manager_, gurl));
+}
+
+void VrGLThread::SetWebVrMode(bool enabled) {
+  WaitUntilThreadStarted();
+  task_runner()->PostTask(FROM_HERE, base::Bind(&UiSceneManager::SetWebVrMode,
+                                                weak_scene_manager_, enabled));
+}
+
+void VrGLThread::SetWebVrSecureOrigin(bool secure) {
+  WaitUntilThreadStarted();
+  task_runner()->PostTask(FROM_HERE,
+                          base::Bind(&UiSceneManager::SetWebVrSecureOrigin,
+                                     weak_scene_manager_, secure));
+}
+
 void VrGLThread::CleanUp() {
   scene_manager_.reset();
   vr_shell_gl_.reset();

diff --git a/chrome/browser/android/vr_shell/vr_gl_thread.h b/chrome/browser/android/vr_shell/vr_gl_thread.h
index 7349c9f..87bae4c 100644
--- a/chrome/browser/android/vr_shell/vr_gl_thread.h
+++ b/chrome/browser/android/vr_shell/vr_gl_thread.h

@@ -14,6 +14,8 @@
 #include "chrome/browser/android/vr_shell/vr_browser_interface.h"
 #include "third_party/gvr-android-sdk/src/libraries/headers/vr/gvr/capi/include/gvr_types.h"
 
+class GURL;
+
 namespace vr_shell {
 
 class UiScene;
@@ -21,7 +23,9 @@
 class VrShell;
 class VrShellGl;
 
-class VrGLThread : public VrBrowserInterface, public base::Thread {
+class VrGLThread : public base::Thread,
+                   public UiInterface,
+                   public VrBrowserInterface {
  public:
   VrGLThread(
       const base::WeakPtr<VrShell>& weak_vr_shell,
@@ -37,12 +41,12 @@
     return weak_scene_manager_;
   }
 
-  // VrBrowserInterface implementation.
+  // VrBrowserInterface implementation (VrShellGl calling to UI and VrShell).
   void ContentSurfaceChanged(jobject surface) override;
   void GvrDelegateReady() override;
   void UpdateGamepadData(device::GvrGamepadData) override;
+  void AppButtonClicked() override;
   void AppButtonGesturePerformed(UiInterface::Direction direction) override;
-  void OnAppButtonClicked() override;
   void ProcessContentGesture(
       std::unique_ptr<blink::WebInputEvent> event) override;
   void ForceExitVr() override;
@@ -51,6 +55,16 @@
       device::mojom::VRDisplayInfoPtr* info) override;
   void OnContentPaused(bool enabled) override;
 
+  // UiInterface implementation (VrShell calling to the UI).
+  void SetFullscreen(bool enabled) override;
+  void SetHistoryButtonsEnabled(bool can_go_back, bool can_go_forward) override;
+  void SetLoadProgress(double progress) override;
+  void SetLoading(bool loading) override;
+  void SetSecurityLevel(int level) override;
+  void SetURL(const GURL& gurl) override;
+  void SetWebVrMode(bool enabled) override;
+  void SetWebVrSecureOrigin(bool secure) override;
+
  protected:
   void Init() override;
   void CleanUp() override;

diff --git a/chrome/browser/android/vr_shell/vr_shell.cc b/chrome/browser/android/vr_shell/vr_shell.cc
index 17d2ea2..a726bc4 100644
--- a/chrome/browser/android/vr_shell/vr_shell.cc
+++ b/chrome/browser/android/vr_shell/vr_shell.cc

@@ -52,6 +52,7 @@
 #include "ui/gfx/codec/png_codec.h"
 #include "ui/gfx/geometry/size.h"
 #include "ui/gfx/native_widget_types.h"
+#include "url/gurl.h"
 
 using base::android::JavaParamRef;
 using base::android::JavaRef;
@@ -103,13 +104,12 @@
   gl_thread_ = base::MakeUnique<VrGLThread>(
       weak_ptr_factory_.GetWeakPtr(), main_thread_task_runner_, gvr_api,
       for_web_vr, in_cct, reprojected_rendering_);
+  ui_ = gl_thread_.get();
 
   base::Thread::Options options(base::MessageLoop::TYPE_DEFAULT, 0);
   options.priority = base::ThreadPriority::DISPLAY;
   gl_thread_->StartWithOptions(options);
 
-  ui_ = base::MakeUnique<UiInterface>(for_web_vr ? UiInterface::Mode::WEB_VR
-                                                 : UiInterface::Mode::STANDARD);
 
   content::BrowserThread::PostTask(
       content::BrowserThread::FILE, FROM_HERE,
@@ -151,7 +151,7 @@
   }
   input_manager_ = base::MakeUnique<VrInputManager>(web_contents_);
   vr_web_contents_observer_ =
-      base::MakeUnique<VrWebContentsObserver>(web_contents_, ui_.get(), this);
+      base::MakeUnique<VrWebContentsObserver>(web_contents_, ui_, this);
   // TODO(billorr): Make VrMetricsHelper tab-aware and able to track multiple
   // tabs. crbug.com/684661
   metrics_helper_ = base::MakeUnique<VrMetricsHelper>(web_contents_);
@@ -165,6 +165,7 @@
     ui_->SetURL(GURL());
     ui_->SetLoading(false);
     ui_->SetFullscreen(false);
+    ui_->SetURL(GURL());
   } else {
     ui_->SetURL(web_contents_->GetVisibleURL());
     ui_->SetLoading(web_contents_->IsLoading());
@@ -268,19 +269,13 @@
     metrics_helper_->SetWebVREnabled(enabled);
   PostToGlThreadWhenReady(base::Bind(&VrShellGl::SetWebVrMode,
                                      gl_thread_->GetVrShellGl(), enabled));
-
-  ui_->SetMode(enabled ? UiInterface::Mode::WEB_VR
-                       : UiInterface::Mode::STANDARD);
-  PostToGlThreadWhenReady(base::Bind(&UiSceneManager::SetWebVRMode,
-                                     gl_thread_->GetSceneManager(), enabled));
+  ui_->SetWebVrMode(enabled);
 }
 
 void VrShell::OnFullscreenChanged(bool enabled) {
   JNIEnv* env = base::android::AttachCurrentThread();
   Java_VrShellImpl_onFullscreenChanged(env, j_vr_shell_.obj(), enabled);
-
-  PostToGlThreadWhenReady(base::Bind(&UiSceneManager::OnFullscreenChanged,
-                                     gl_thread_->GetSceneManager(), enabled));
+  ui_->SetFullscreen(enabled);
 }
 
 bool VrShell::GetWebVrMode(JNIEnv* env, const JavaParamRef<jobject>& obj) {
@@ -297,7 +292,6 @@
                                const JavaParamRef<jobject>& obj,
                                jobjectArray tabs,
                                jobjectArray incognito_tabs) {
-  ui_->InitTabList();
   ProcessTabArray(env, tabs, false);
   ProcessTabArray(env, incognito_tabs, true);
   ui_->FlushTabList();
@@ -331,9 +325,7 @@
 }
 
 void VrShell::SetWebVRSecureOrigin(bool secure_origin) {
-  PostToGlThreadWhenReady(base::Bind(&UiSceneManager::SetWebVRSecureOrigin,
-                                     gl_thread_->GetSceneManager(),
-                                     secure_origin));
+  ui_->SetWebVrSecureOrigin(secure_origin);
 }
 
 void VrShell::SubmitWebVRFrame(int16_t frame_index,
@@ -408,11 +400,6 @@
   delegate_provider_->SetPresentingDelegate(this, gvr_api_);
 }
 
-void VrShell::AppButtonGesturePerformed(UiInterface::Direction direction) {
-  if (vr_shell_enabled_)
-    ui_->HandleAppButtonGesturePerformed(direction);
-}
-
 void VrShell::ContentPhysicalBoundsChanged(JNIEnv* env,
                                            const JavaParamRef<jobject>& object,
                                            jint width,

diff --git a/chrome/browser/android/vr_shell/vr_shell.h b/chrome/browser/android/vr_shell/vr_shell.h
index 41a771d..3838edf 100644
--- a/chrome/browser/android/vr_shell/vr_shell.h
+++ b/chrome/browser/android/vr_shell/vr_shell.h

@@ -130,7 +130,6 @@
 
   void ContentSurfaceChanged(jobject surface);
   void GvrDelegateReady();
-  void AppButtonGesturePerformed(UiInterface::Direction direction);
 
   void ContentPhysicalBoundsChanged(
       JNIEnv* env,
@@ -185,7 +184,6 @@
 
   bool vr_shell_enabled_;
 
-  std::unique_ptr<UiInterface> ui_;
   bool content_paused_ = false;
   bool webvr_mode_ = false;
 
@@ -205,6 +203,7 @@
 
   scoped_refptr<base::SingleThreadTaskRunner> main_thread_task_runner_;
   std::unique_ptr<VrGLThread> gl_thread_;
+  UiInterface* ui_;
   bool reprojected_rendering_;
 
   jobject content_surface_ = nullptr;

diff --git a/chrome/browser/android/vr_shell/vr_shell_gl.cc b/chrome/browser/android/vr_shell/vr_shell_gl.cc
index 9bdba4cc..8cc0844 100644
--- a/chrome/browser/android/vr_shell/vr_shell_gl.cc
+++ b/chrome/browser/android/vr_shell/vr_shell_gl.cc

@@ -644,7 +644,7 @@
       }
     }
     if (direction == UiInterface::NONE)
-      browser_->OnAppButtonClicked();
+      browser_->AppButtonClicked();
   }
 }
 

diff --git a/chrome/browser/chromeos/printing/printers_manager_factory.cc b/chrome/browser/chromeos/printing/printers_manager_factory.cc
index e3bcf4c..5f8de867 100644
--- a/chrome/browser/chromeos/printing/printers_manager_factory.cc
+++ b/chrome/browser/chromeos/printing/printers_manager_factory.cc

@@ -57,8 +57,7 @@
 
   const syncer::ModelTypeStoreFactory& store_factory =
       browser_sync::ProfileSyncService::GetModelTypeStoreFactory(
-          syncer::PRINTERS, profile->GetPath(),
-          content::BrowserThread::GetBlockingPool());
+          syncer::PRINTERS, profile->GetPath());
 
   std::unique_ptr<PrintersSyncBridge> sync_bridge =
       base::MakeUnique<PrintersSyncBridge>(

diff --git a/chrome/browser/extensions/webstore_data_fetcher.cc b/chrome/browser/extensions/webstore_data_fetcher.cc
index e8e8b69..b72fe60 100644
--- a/chrome/browser/extensions/webstore_data_fetcher.cc
+++ b/chrome/browser/extensions/webstore_data_fetcher.cc

@@ -12,6 +12,7 @@
 #include "components/safe_json/safe_json_parser.h"
 #include "extensions/common/extension_urls.h"
 #include "net/base/load_flags.h"
+#include "net/traffic_annotation/network_traffic_annotation.h"
 #include "net/url_request/url_fetcher.h"
 #include "net/url_request/url_request_status.h"
 
@@ -45,8 +46,38 @@
   GURL webstore_data_url(extension_urls::GetWebstoreItemJsonDataURL(id_));
   net::URLFetcher::RequestType request_type =
       json_post_data_.empty() ? net::URLFetcher::GET : net::URLFetcher::POST;
-  webstore_data_url_fetcher_ =
-      net::URLFetcher::Create(webstore_data_url, request_type, this);
+  net::NetworkTrafficAnnotationTag traffic_annotation =
+      net::DefineNetworkTrafficAnnotation("webstore_data_fetcher", R"(
+        semantics {
+          sender: "Webstore Data Fetcher"
+          description:
+            "Fetches metadata about an extension from the Chrome Web Store."
+          trigger:
+            "The user or another program triggers some action where Chrome "
+            "will show metadata about an extension. This includes extension "
+            "installation flows, triggering an install for a disabled "
+            "extension, and an extension being added to Chrome through "
+            "third-party sideloading. It also happens when a kiosk app account "
+            "whose metadata (app icon, name, required platform version) is not "
+            "cached locally is detected in device local accounts list. The "
+            "account can be set either by device policy or through extensions "
+            "web UI, by the device owner (user that was initially added to the "
+            "device; implies non managed device). The latter case is "
+            "deprecated and not supported on newer Chrome OS boards."
+          data:
+            "The extension id and referrer url. The referrer chain is also "
+            "included if the user has not opted out of SafeBrowsing."
+          destination: GOOGLE_OWNED_SERVICE
+        }
+        policy {
+          cookies_allowed: false
+          setting:
+            "This feature cannot be disabled in settings. It will only be "
+            "triggered if the user uses extensions."
+          policy_exception_justification: "Not implemented."
+        })");
+  webstore_data_url_fetcher_ = net::URLFetcher::Create(
+      webstore_data_url, request_type, this, traffic_annotation);
   webstore_data_url_fetcher_->SetRequestContext(request_context_);
   webstore_data_url_fetcher_->SetReferrer(referrer_url_.spec());
   webstore_data_url_fetcher_->SetLoadFlags(net::LOAD_DO_NOT_SAVE_COOKIES |

diff --git a/chrome/browser/flag_descriptions.cc b/chrome/browser/flag_descriptions.cc
index f7d8a7b5..2d865df 100644
--- a/chrome/browser/flag_descriptions.cc
+++ b/chrome/browser/flag_descriptions.cc

@@ -2584,6 +2584,11 @@
 const char kAndroidPaymentAppsDescription[] =
     "Enable third party Android apps to integrate as payment apps";
 
+const char kServiceWorkerPaymentAppsName[] = "Service Worker payment apps";
+
+const char kServiceWorkerPaymentAppsDescription[] =
+    "Enable Service Worker applications to integrate as payment apps";
+
 #endif  // defined(OS_ANDROID)
 
 const char kFeaturePolicyName[] = "Feature Policy";

diff --git a/chrome/browser/flag_descriptions.h b/chrome/browser/flag_descriptions.h
index b1f1d05..0e28065 100644
--- a/chrome/browser/flag_descriptions.h
+++ b/chrome/browser/flag_descriptions.h

@@ -2814,6 +2814,12 @@
 // Description for the flag to enable third party Android payment apps
 extern const char kAndroidPaymentAppsDescription[];
 
+// Name of the flag to enable Service Worker payment apps
+extern const char kServiceWorkerPaymentAppsName[];
+
+// Description for the flag to enable Service Worker payment apps
+extern const char kServiceWorkerPaymentAppsDescription[];
+
 #endif  // defined(OS_ANDROID)
 
 // Name for the flag to enable feature policy.

diff --git a/chrome/browser/io_thread.cc b/chrome/browser/io_thread.cc
index f6de3ee9..7876d7af 100644
--- a/chrome/browser/io_thread.cc
+++ b/chrome/browser/io_thread.cc

@@ -131,6 +131,7 @@
 
 #if defined(OS_CHROMEOS)
 #include "chrome/browser/chromeos/net/cert_verify_proc_chromeos.h"
+#include "chrome/browser/chromeos/policy/browser_policy_connector_chromeos.h"
 #include "chromeos/network/host_resolver_impl_chromeos.h"
 #endif
 
@@ -387,6 +388,11 @@
 #if defined(OS_POSIX) && !defined(OS_ANDROID)
   gssapi_library_name_ = local_state->GetString(prefs::kGSSAPILibraryName);
 #endif
+#if defined(OS_CHROMEOS)
+  policy::BrowserPolicyConnectorChromeOS* connector =
+      g_browser_process->platform_part()->browser_policy_connector_chromeos();
+  allow_gssapi_library_load_ = connector->IsActiveDirectoryManaged();
+#endif
   pref_proxy_config_tracker_.reset(
       ProxyServiceFactory::CreatePrefProxyConfigTrackerOfLocalState(
           local_state));
@@ -789,6 +795,10 @@
       ,
       gssapi_library_name_
 #endif
+#if defined(OS_CHROMEOS)
+      ,
+      allow_gssapi_library_load_
+#endif
       ));
   UpdateServerWhitelist();
   UpdateDelegateWhitelist();

diff --git a/chrome/browser/io_thread.h b/chrome/browser/io_thread.h
index 5bf834a..e1959620 100644
--- a/chrome/browser/io_thread.h
+++ b/chrome/browser/io_thread.h

@@ -383,6 +383,10 @@
   std::string gssapi_library_name_;
 #endif
 
+#if defined(OS_CHROMEOS)
+  bool allow_gssapi_library_load_;
+#endif
+
   // This is an instance of the default SSLConfigServiceManager for the current
   // platform and it gets SSL preferences from local_state object.
   std::unique_ptr<ssl_config::SSLConfigServiceManager>

diff --git a/chrome/browser/resources/settings/people_page/lock_screen.html b/chrome/browser/resources/settings/people_page/lock_screen.html
index c67e654..6d7baf4e 100644
--- a/chrome/browser/resources/settings/people_page/lock_screen.html
+++ b/chrome/browser/resources/settings/people_page/lock_screen.html

@@ -42,33 +42,35 @@
     </style>
 
     <div>
-      <div class="list-frame">
-        <paper-radio-group id="unlockType" selected="{{selectedUnlockType}}">
-          <paper-radio-button name="password">
-            <div class="start">
-              $i18n{lockScreenPasswordOnly}
-              <div class="secondary">
-                $i18n{lockScreenHighSecurity}
+      <template is="dom-if" if="[[quickUnlockEnabled_]]">
+        <div class="list-frame">
+          <paper-radio-group id="unlockType" selected="{{selectedUnlockType}}">
+            <paper-radio-button name="password">
+              <div class="start">
+                $i18n{lockScreenPasswordOnly}
+                <div class="secondary">
+                  $i18n{lockScreenHighSecurity}
+                </div>
               </div>
-            </div>
-          </paper-radio-button>
-          <paper-radio-button name="pin+password">
-            <div class="start">
-              $i18n{lockScreenPinOrPassword}
-              <div class="secondary">
-                $i18n{lockScreenMediumSecurity}
+            </paper-radio-button>
+            <paper-radio-button name="pin+password">
+              <div class="start">
+                $i18n{lockScreenPinOrPassword}
+                <div class="secondary">
+                  $i18n{lockScreenMediumSecurity}
+                </div>
               </div>
-            </div>
-            <template is="dom-if"
-                if="[[showConfigurePinButton_(selectedUnlockType)]]">
-              <paper-button id="setupPinButton" class="secondary-button"
-                  on-tap="onConfigurePin_">
-                [[getSetupPinText_(hasPin)]]
-              </paper-button>
-            </template>
-          </paper-radio-button>
-        </paper-radio-group>
-      </div>
+              <template is="dom-if"
+                  if="[[showConfigurePinButton_(selectedUnlockType)]]">
+                <paper-button id="setupPinButton" class="secondary-button"
+                    on-tap="onConfigurePin_">
+                  [[getSetupPinText_(hasPin)]]
+                </paper-button>
+              </template>
+            </paper-radio-button>
+          </paper-radio-group>
+        </div>
+      </template>
 
       <div id="screenLockDiv" class="settings-box">
         <settings-toggle-button class="start"

diff --git a/chrome/browser/resources/settings/people_page/lock_screen.js b/chrome/browser/resources/settings/people_page/lock_screen.js
index 230fa2d..fe5be02 100644
--- a/chrome/browser/resources/settings/people_page/lock_screen.js
+++ b/chrome/browser/resources/settings/people_page/lock_screen.js

@@ -56,13 +56,13 @@
     },
 
     /**
-     * True if pin unlock settings should be displayed on this machine.
+     * True if quick unlock settings should be displayed on this machine.
      * @private
      */
-    pinUnlockEnabled_: {
+    quickUnlockEnabled_: {
       type: Boolean,
       value: function() {
-        return loadTimeData.getBoolean('pinUnlockEnabled');
+        return loadTimeData.getBoolean('quickUnlockEnabled');
       },
       readOnly: true,
     },
@@ -231,9 +231,12 @@
     return selectedUnlockType === LockScreenUnlockType.PIN_PASSWORD;
   },
 
-  /** @private */
-  getSetupPinText_: function() {
-    if (this.hasPin)
+  /**
+   * @param {boolean} hasPin
+   * @private
+   */
+  getSetupPinText_: function(hasPin) {
+    if (hasPin)
       return this.i18n('lockScreenChangePinButton');
     return this.i18n('lockScreenSetupPinButton');
   },

diff --git a/chrome/browser/resources/settings/people_page/people_page.html b/chrome/browser/resources/settings/people_page/people_page.html
index 66997037..79367b2 100644
--- a/chrome/browser/resources/settings/people_page/people_page.html
+++ b/chrome/browser/resources/settings/people_page/people_page.html

@@ -189,30 +189,19 @@
         </template>
 
 <if expr="chromeos">
-        <template is="dom-if" if="[[!quickUnlockEnabled_]]">
-          <div class="settings-box">
-            <settings-toggle-button class="start"
-                pref="{{prefs.settings.enable_screen_lock}}"
-                label="$i18n{enableScreenlock}">
-            </settings-toggle-button>
-          </div>
-        </template>
-
-        <template is="dom-if" if="[[quickUnlockEnabled_]]">
-          <div class="settings-box two-line" actionable
-               on-tap="onConfigureLockTap_">
-            <div class="start">
-              $i18n{lockScreenTitle}
-              <div class="secondary" id="lockScreenSecondary">
-                [[getPasswordState_(hasPin,
-                                    prefs.settings.enable_screen_lock.value)]]
-              </div>
+        <div class="settings-box two-line" actionable
+             on-tap="onConfigureLockTap_">
+          <div class="start">
+            $i18n{lockScreenTitle}
+            <div class="secondary" id="lockScreenSecondary">
+              [[getPasswordState_(hasPin,
+                                  prefs.settings.enable_screen_lock.value)]]
             </div>
-            <button id="lockScreenSubpageTrigger" class="subpage-arrow"
-                is="paper-icon-button-light" aria-label="$i18n{lockScreenTitle}"
-                aria-describedby="lockScrenSecondary"></button>
           </div>
-        </template>
+          <button id="lockScreenSubpageTrigger" class="subpage-arrow"
+              is="paper-icon-button-light" aria-label="$i18n{lockScreenTitle}"
+              aria-describedby="lockScrenSecondary"></button>
+        </div>
 </if>
 
         <div id="manage-other-people-subpage-trigger"
@@ -252,14 +241,14 @@
         </settings-subpage>
       </template>
 <if expr="chromeos">
-      <template is="dom-if" if="[[quickUnlockEnabled_]]">
-        <template is="dom-if" route-path="/lockScreen" no-search>
-          <settings-subpage page-title="$i18n{lockScreenTitle}">
-            <settings-lock-screen
-              prefs="{{prefs}}">
-            </settings-lock-screen>
-          </settings-subpage>
-        </template>
+      <template is="dom-if" route-path="/lockScreen" no-search>
+        <settings-subpage page-title="$i18n{lockScreenTitle}">
+          <settings-lock-screen
+            prefs="{{prefs}}">
+          </settings-lock-screen>
+        </settings-subpage>
+      </template>
+      <template is="dom-if" if="[[fingerprintUnlockEnabled_]]">
         <template is="dom-if" route-path="/lockScreen/fingerprint" no-search>
           <settings-subpage page-title="$i18n{lockScreenFingerprintTitle}">
             <settings-fingerprint-list></settings-fingerprint-list>

diff --git a/chrome/browser/resources/settings/people_page/people_page.js b/chrome/browser/resources/settings/people_page/people_page.js
index 095572e..2086f6e 100644
--- a/chrome/browser/resources/settings/people_page/people_page.js
+++ b/chrome/browser/resources/settings/people_page/people_page.js

@@ -78,14 +78,13 @@
 
 // <if expr="chromeos">
     /**
-     * True if quick unlock settings should be displayed on this machine.
+     * True if fingerprint settings should be displayed on this machine.
      * @private
      */
-    quickUnlockEnabled_: {
+    fingerprintUnlockEnabled_: {
       type: Boolean,
       value: function() {
-        return loadTimeData.getBoolean('pinUnlockEnabled') ||
-            loadTimeData.getBoolean('fingerprintUnlockEnabled');
+        return loadTimeData.getBoolean('fingerprintUnlockEnabled');
       },
       readOnly: true,
     },

diff --git a/chrome/browser/safe_browsing/chrome_cleaner/srt_chrome_prompt_impl.cc b/chrome/browser/safe_browsing/chrome_cleaner/srt_chrome_prompt_impl.cc
index 002d24f..6d20cda 100644
--- a/chrome/browser/safe_browsing/chrome_cleaner/srt_chrome_prompt_impl.cc
+++ b/chrome/browser/safe_browsing/chrome_cleaner/srt_chrome_prompt_impl.cc

@@ -22,13 +22,12 @@
 
 ChromePromptImpl::~ChromePromptImpl() {}
 
-void ChromePromptImpl::PromptUser(
-    std::vector<UwSPtr> removable_uws_found,
-    ElevationStatus elevation_status,
-    const ChromePrompt::PromptUserCallback& callback) {
+void ChromePromptImpl::PromptUser(std::vector<UwSPtr> removable_uws_found,
+                                  ElevationStatus elevation_status,
+                                  ChromePrompt::PromptUserCallback callback) {
   // Placeholder. The actual implementation will show the prompt dialog to the
   // user and invoke this callback depending on the user's response.
-  callback.Run(PromptAcceptance::DENIED);
+  std::move(callback).Run(PromptAcceptance::DENIED);
 }
 
 }  // namespace safe_browsing

diff --git a/chrome/browser/safe_browsing/chrome_cleaner/srt_chrome_prompt_impl.h b/chrome/browser/safe_browsing/chrome_cleaner/srt_chrome_prompt_impl.h
index 2546a4c..fe92d7c 100644
--- a/chrome/browser/safe_browsing/chrome_cleaner/srt_chrome_prompt_impl.h
+++ b/chrome/browser/safe_browsing/chrome_cleaner/srt_chrome_prompt_impl.h

@@ -22,7 +22,7 @@
   void PromptUser(
       std::vector<chrome_cleaner::mojom::UwSPtr> removable_uws_found,
       chrome_cleaner::mojom::ElevationStatus elevation_status,
-      const chrome_cleaner::mojom::ChromePrompt::PromptUserCallback& callback)
+      chrome_cleaner::mojom::ChromePrompt::PromptUserCallback callback)
       override;
 
  private:

diff --git a/chrome/browser/safe_browsing/chrome_cleaner/srt_fetcher_browsertest_win.cc b/chrome/browser/safe_browsing/chrome_cleaner/srt_fetcher_browsertest_win.cc
index 80a8439..7787890 100644
--- a/chrome/browser/safe_browsing/chrome_cleaner/srt_fetcher_browsertest_win.cc
+++ b/chrome/browser/safe_browsing/chrome_cleaner/srt_fetcher_browsertest_win.cc

@@ -272,13 +272,13 @@
   void PromptUser(
       std::vector<chrome_cleaner::mojom::UwSPtr> removable_uws_found,
       chrome_cleaner::mojom::ElevationStatus elevation_status,
-      const chrome_cleaner::mojom::ChromePrompt::PromptUserCallback& callback)
+      chrome_cleaner::mojom::ChromePrompt::PromptUserCallback callback)
       override {
     if (bad_message_expected_)
       mojo::ReportBadMessage("bad message");
 
     ChromePromptImpl::PromptUser(std::move(removable_uws_found),
-                                 elevation_status, callback);
+                                 elevation_status, std::move(callback));
   }
 
  private:

diff --git a/chrome/browser/safe_browsing/client_side_detection_service.cc b/chrome/browser/safe_browsing/client_side_detection_service.cc
index 1cc9c276..f2b691b 100644
--- a/chrome/browser/safe_browsing/client_side_detection_service.cc
+++ b/chrome/browser/safe_browsing/client_side_detection_service.cc

@@ -37,6 +37,7 @@
 #include "net/base/load_flags.h"
 #include "net/http/http_response_headers.h"
 #include "net/http/http_status_code.h"
+#include "net/traffic_annotation/network_traffic_annotation.h"
 #include "net/url_request/url_fetcher.h"
 #include "net/url_request/url_request_context_getter.h"
 #include "net/url_request/url_request_status.h"
@@ -288,10 +289,44 @@
     return;
   }
 
-  std::unique_ptr<net::URLFetcher> fetcher(
-      net::URLFetcher::Create(0 /* ID used for testing */,
-                              GetClientReportUrl(kClientReportPhishingUrl),
-                              net::URLFetcher::POST, this));
+  net::NetworkTrafficAnnotationTag traffic_annotation =
+      net::DefineNetworkTrafficAnnotation(
+          "safe_browsing_client_side_phishing_detector", R"(
+          semantics {
+            sender: "Safe Browsing Client-Side Phishing Detector"
+            description:
+              "If the client-side phishing detector determines that the "
+              "current page contents are similar to phishing pages, it will "
+              "send a request to Safe Browsing to ask for a final verdict. If "
+              "Safe Browsing agrees the page is dangerous, Chrome will show a "
+              "full-page interstitial warning."
+            trigger:
+              "Whenever the clinet-side detector machine learning model "
+              "computes a phishy-ness score above a threshold, after page-load."
+            data:
+              "Top-level page URL without CGI parameters, boolean and double "
+              "features extracted from DOM, such as the number of resources "
+              "loaded in the page, if certain likely phishing and social "
+              "engineering terms found on the page, etc."
+            destination: GOOGLE_OWNED_SERVICE
+          }
+          policy {
+            cookies_allowed: true
+            cookies_store: "Safe browsing cookie store"
+            setting:
+              "Users can enable or disable this feature by toggling 'Protect "
+              "you and your device from dangerous sites' in Chrome settings "
+              "under Privacy. This feature is enabled by default."
+            chrome_policy {
+              SafeBrowsingEnabled {
+                policy_options {mode: MANDATORY}
+                SafeBrowsingEnabled: false
+              }
+            }
+          })");
+  std::unique_ptr<net::URLFetcher> fetcher(net::URLFetcher::Create(
+      0 /* ID used for testing */, GetClientReportUrl(kClientReportPhishingUrl),
+      net::URLFetcher::POST, this, traffic_annotation));
   net::URLFetcher* fetcher_ptr = fetcher.get();
   data_use_measurement::DataUseUserData::AttachToFetcher(
       fetcher_ptr, data_use_measurement::DataUseUserData::SAFE_BROWSING);
@@ -333,10 +368,41 @@
     return;
   }
 
-  std::unique_ptr<net::URLFetcher> fetcher(
-      net::URLFetcher::Create(0 /* ID used for testing */,
-                              GetClientReportUrl(kClientReportMalwareUrl),
-                              net::URLFetcher::POST, this));
+  net::NetworkTrafficAnnotationTag traffic_annotation =
+      net::DefineNetworkTrafficAnnotation(
+          "safe_browsing_client_side_malware_detector", R"(
+          semantics {
+            sender: "Safe Browsing Client-Side Malware Detector"
+            description:
+              "If the client-side malware detector determines that a requested "
+              "page's IP is in the blacklisted malware IPs, it will send a "
+              "request to Safe Browsing to ask for a final verdict. If Safe "
+              "Browsing agrees the page is dangerous, Chrome will show a "
+              "full-page interstitial warning."
+            trigger:
+              "Whenever the IP of the page is in malware blacklist."
+            data:
+              "Top-level page URL without CGI parameters, its non-https "
+              "referrer, URLs of resources that match IP blacklist."
+            destination: GOOGLE_OWNED_SERVICE
+          }
+          policy {
+            cookies_allowed: true
+            cookies_store: "Safe browsing cookie store"
+            setting:
+              "Users can enable or disable this feature by toggling 'Protect "
+              "you and your device from dangerous sites' in Chrome settings "
+              "under Privacy. This feature is enabled by default."
+            chrome_policy {
+              SafeBrowsingEnabled {
+                policy_options {mode: MANDATORY}
+                SafeBrowsingEnabled: false
+              }
+            }
+          })");
+  std::unique_ptr<net::URLFetcher> fetcher(net::URLFetcher::Create(
+      0 /* ID used for testing */, GetClientReportUrl(kClientReportMalwareUrl),
+      net::URLFetcher::POST, this, traffic_annotation));
   net::URLFetcher* fetcher_ptr = fetcher.get();
   data_use_measurement::DataUseUserData::AttachToFetcher(
       fetcher_ptr, data_use_measurement::DataUseUserData::SAFE_BROWSING);

diff --git a/chrome/browser/safe_browsing/client_side_model_loader.cc b/chrome/browser/safe_browsing/client_side_model_loader.cc
index 8e249d0..b07051b 100644
--- a/chrome/browser/safe_browsing/client_side_model_loader.cc
+++ b/chrome/browser/safe_browsing/client_side_model_loader.cc

@@ -24,6 +24,7 @@
 #include "net/base/load_flags.h"
 #include "net/http/http_response_headers.h"
 #include "net/http/http_status_code.h"
+#include "net/traffic_annotation/network_traffic_annotation.h"
 #include "net/url_request/url_fetcher.h"
 #include "net/url_request/url_request_context_getter.h"
 #include "net/url_request/url_request_status.h"
@@ -120,8 +121,38 @@
   // Then only re-fetch when a profile setting changes to need it.
   // This will save on the order of ~50KB/week/client of bandwidth.
   DCHECK(fetch_sequence_checker_.CalledOnValidSequence());
-  fetcher_ = net::URLFetcher::Create(0 /* ID used for testing */, url_,
-                                     net::URLFetcher::GET, this);
+  net::NetworkTrafficAnnotationTag traffic_annotation =
+      net::DefineNetworkTrafficAnnotation("safe_browsing_module_loader", R"(
+        semantics {
+          sender: "Safe Browsing Service"
+          description:
+            "Safe Browsing downloads the latest client-side phishing detection "
+            "model at startup. It uses this data on future page loads to "
+            "determine if it looks like a phishing page."
+          trigger:
+            "At startup. Most of the time the data will be in cache, so the "
+            "response will be small."
+          data:
+            "No user-controlled data or PII is sent. Only a static URL of the "
+            "model which is provided by field study is passed."
+          destination: GOOGLE_OWNED_SERVICE
+        }
+        policy {
+          cookies_allowed: false
+          setting:
+            "Users can enable or disable this feature by toggling 'Protect "
+            "you and your device from dangerous sites' in Chromium settings "
+            "under Privacy. This feature is enabled by default."
+          chrome_policy {
+            SafeBrowsingEnabled {
+              policy_options {mode: MANDATORY}
+              SafeBrowsingEnabled: false
+            }
+          }
+        })");
+  fetcher_ =
+      net::URLFetcher::Create(0 /* ID used for testing */, url_,
+                              net::URLFetcher::GET, this, traffic_annotation);
   data_use_measurement::DataUseUserData::AttachToFetcher(
       fetcher_.get(), data_use_measurement::DataUseUserData::SAFE_BROWSING);
   fetcher_->SetRequestContext(request_context_getter_);

diff --git a/chrome/browser/ssl/captive_portal_blocking_page.cc b/chrome/browser/ssl/captive_portal_blocking_page.cc
index eff1f470..dab9355 100644
--- a/chrome/browser/ssl/captive_portal_blocking_page.cc
+++ b/chrome/browser/ssl/captive_portal_blocking_page.cc

@@ -147,6 +147,7 @@
   load_time_data->SetString("iconClass", "icon-offline");
   load_time_data->SetString("type", "CAPTIVE_PORTAL");
   load_time_data->SetBoolean("overridable", false);
+  load_time_data->SetBoolean("hide_primary_button", false);
 
   // |IsWifiConnection| isn't accurate on some platforms, so always try to get
   // the Wi-Fi SSID even if |IsWifiConnection| is false.

diff --git a/chrome/browser/translate/translate_manager_render_view_host_unittest.cc b/chrome/browser/translate/translate_manager_render_view_host_unittest.cc
index 88b1503..e95b752 100644
--- a/chrome/browser/translate/translate_manager_render_view_host_unittest.cc
+++ b/chrome/browser/translate/translate_manager_render_view_host_unittest.cc

@@ -137,19 +137,18 @@
   void Translate(const std::string& translate_script,
                  const std::string& source_lang,
                  const std::string& target_lang,
-                 const TranslateCallback& callback) override {
+                 TranslateCallback callback) override {
     // Ensure pending callback gets called.
     if (translate_callback_pending_) {
-      translate_callback_pending_.Run(true, "", "",
-                                      translate::TranslateErrors::NONE);
-      translate_callback_pending_.Reset();
+      std::move(translate_callback_pending_)
+          .Run(true, "", "", translate::TranslateErrors::NONE);
     }
 
     called_translate_ = true;
     source_lang_ = source_lang;
     target_lang_ = target_lang;
 
-    translate_callback_pending_ = callback;
+    translate_callback_pending_ = std::move(callback);
   }
 
   void RevertTranslation() override { called_revert_translation_ = true; }
@@ -158,8 +157,8 @@
                       const std::string& source_lang,
                       const std::string& target_lang,
                       translate::TranslateErrors::Type error) {
-    translate_callback_pending_.Run(cancelled, source_lang, target_lang, error);
-    translate_callback_pending_.Reset();
+    std::move(translate_callback_pending_)
+        .Run(cancelled, source_lang, target_lang, error);
   }
 
   bool called_translate_;

diff --git a/chrome/browser/ui/sync/one_click_signin_sync_starter.cc b/chrome/browser/ui/sync/one_click_signin_sync_starter.cc
index 194ce09..4531a48 100644
--- a/chrome/browser/ui/sync/one_click_signin_sync_starter.cc
+++ b/chrome/browser/ui/sync/one_click_signin_sync_starter.cc

@@ -526,66 +526,6 @@
   chrome::ShowSettingsSubPage(browser_, chrome::kSyncSetupSubPage);
 }
 
-void OneClickSigninSyncStarter::ShowSettingsPage(bool configure_sync) {
-  // Give the user a chance to configure things. We don't clear the
-  // ProfileSyncService::setup_in_progress flag because we don't want sync
-  // to start up until after the configure UI is displayed (the configure UI
-  // will clear the flag when the user is done setting up sync).
-  ProfileSyncService* profile_sync_service = GetProfileSyncService();
-  LoginUIService* login_ui = LoginUIServiceFactory::GetForProfile(profile_);
-  if (login_ui->current_login_ui()) {
-    login_ui->current_login_ui()->FocusUI();
-  } else {
-    browser_ = EnsureBrowser(browser_, profile_);
-
-    // If the sign in tab is showing the native signin page or the blank page
-    // for web-based flow, and is not about to be closed, use it to show the
-    // settings UI.
-    bool use_same_tab = false;
-    if (web_contents()) {
-      GURL current_url = web_contents()->GetLastCommittedURL();
-      std::string constrained_key;
-      net::GetValueForKeyInQuery(current_url, "constrained", &constrained_key);
-      bool is_constrained = (constrained_key == "1");
-      bool is_chrome_signin_url =
-          current_url.GetOrigin().spec() == chrome::kChromeUIChromeSigninURL;
-      bool is_same_profile =
-          Profile::FromBrowserContext(web_contents()->GetBrowserContext()) ==
-          profile_;
-      use_same_tab = !is_constrained && is_chrome_signin_url &&
-                     !signin::IsAutoCloseEnabledInURL(current_url) &&
-                     is_same_profile;
-    }
-    if (profile_sync_service) {
-      // Need to navigate to the settings page and display the sync UI.
-      if (use_same_tab) {
-        ShowSettingsPageInWebContents(web_contents(),
-                                      chrome::kSyncSetupSubPage);
-      } else {
-        // If the user is setting up sync for the first time, let them configure
-        // advanced sync settings. However, in the case of re-authentication,
-        // return the user to the settings page without showing any config UI.
-        if (configure_sync) {
-          chrome::ShowSettingsSubPage(browser_, chrome::kSyncSetupSubPage);
-        } else {
-          FinishProfileSyncServiceSetup();
-          chrome::ShowSettings(browser_);
-        }
-      }
-    } else {
-      // Sync is disabled - just display the settings page or redirect to the
-      // |continue_url_|.
-      FinishProfileSyncServiceSetup();
-      if (!use_same_tab)
-        chrome::ShowSettings(browser_);
-      else if (!continue_url_.is_empty())
-        LoadContinueUrl();
-      else
-        ShowSettingsPageInWebContents(web_contents(), std::string());
-    }
-  }
-}
-
 ProfileSyncService* OneClickSigninSyncStarter::GetProfileSyncService() {
   ProfileSyncService* service = nullptr;
   if (profile_->IsSyncAllowed())
@@ -597,33 +537,3 @@
   sync_blocker_.reset();
 }
 
-void OneClickSigninSyncStarter::ShowSettingsPageInWebContents(
-    content::WebContents* contents,
-    const std::string& sub_page) {
-  if (!continue_url_.is_empty()) {
-    // The observer deletes itself once it's done.
-    DCHECK(!sub_page.empty());
-    new OneClickSigninSyncObserver(contents, continue_url_);
-  }
-
-  GURL url = chrome::GetSettingsUrl(sub_page);
-  content::OpenURLParams params(url, content::Referrer(),
-                                WindowOpenDisposition::CURRENT_TAB,
-                                ui::PAGE_TRANSITION_AUTO_TOPLEVEL, false);
-  contents->OpenURL(params);
-
-  // Activate the tab.
-  Browser* browser = chrome::FindBrowserWithWebContents(contents);
-  int content_index =
-      browser->tab_strip_model()->GetIndexOfWebContents(contents);
-  browser->tab_strip_model()->ActivateTabAt(content_index,
-                                            false /* user_gesture */);
-}
-
-void OneClickSigninSyncStarter::LoadContinueUrl() {
-  web_contents()->GetController().LoadURL(
-      continue_url_,
-      content::Referrer(),
-      ui::PAGE_TRANSITION_AUTO_TOPLEVEL,
-      std::string());
-}

diff --git a/chrome/browser/ui/sync/one_click_signin_sync_starter.h b/chrome/browser/ui/sync/one_click_signin_sync_starter.h
index 7311d29..c388141 100644
--- a/chrome/browser/ui/sync/one_click_signin_sync_starter.h
+++ b/chrome/browser/ui/sync/one_click_signin_sync_starter.h

@@ -69,11 +69,6 @@
     // to configure which data types to sync before sync is enabled.
     CONFIGURE_SYNC_FIRST,
 
-    // Starts the process of re-authenticating the user via SigninManager,
-    // and once completed, redirects the user to the settings page, but doesn't
-    // display the configure sync UI.
-    SHOW_SETTINGS_WITHOUT_CONFIGURE,
-
     // The process should be aborted because the undo button has been pressed.
     UNDO_SYNC
   };
@@ -220,26 +215,12 @@
 
   void FinishProfileSyncServiceSetup();
 
-  // Displays the settings UI and brings up the advanced sync settings
-  // dialog if |configure_sync| is true. The web contents provided to the
-  // constructor is used if it's showing a blank page and not about to be
-  // closed. Otherwise, a new tab or an existing settings tab is used.
-  void ShowSettingsPage(bool configure_sync);
-
-  // Displays a settings page in the provided web contents. |sub_page| can be
-  // empty to show the main settings page.
-  void ShowSettingsPageInWebContents(content::WebContents* contents,
-                                     const std::string& sub_page);
-
   // Shows the post-signin confirmation bubble. If |custom_message| is empty,
   // the default "You are signed in" message is displayed.
   void DisplayFinalConfirmationBubble(const base::string16& custom_message);
 
   void DisplayModalSyncConfirmationWindow();
 
-  // Loads the |continue_url_| in the current tab.
-  void LoadContinueUrl();
-
   Profile* profile_;
   Browser* browser_;
   std::unique_ptr<SigninTracker> signin_tracker_;

diff --git a/chrome/browser/ui/views/payments/payment_request_sheet_controller.cc b/chrome/browser/ui/views/payments/payment_request_sheet_controller.cc
index ae11881..26994e2 100644
--- a/chrome/browser/ui/views/payments/payment_request_sheet_controller.cc
+++ b/chrome/browser/ui/views/payments/payment_request_sheet_controller.cc

@@ -212,11 +212,6 @@
                                                   const ui::Event& event) {
   switch (static_cast<PaymentRequestCommonTags>(sender->tag())) {
     case PaymentRequestCommonTags::CLOSE_BUTTON_TAG:
-      // Transfer the focus to the cancel button, so that any OnBlur actions
-      // can fully execute before CloseDialog is called.
-      dialog()
-          ->GetViewByID(static_cast<int>(DialogViewID::CANCEL_BUTTON))
-          ->RequestFocus();
       dialog()->CloseDialog();
       break;
     case PaymentRequestCommonTags::BACK_BUTTON_TAG:

diff --git a/chrome/browser/ui/views/payments/validating_combobox.cc b/chrome/browser/ui/views/payments/validating_combobox.cc
index 1871a1d..d9e26811 100644
--- a/chrome/browser/ui/views/payments/validating_combobox.cc
+++ b/chrome/browser/ui/views/payments/validating_combobox.cc

@@ -13,9 +13,7 @@
 ValidatingCombobox::ValidatingCombobox(
     std::unique_ptr<ui::ComboboxModel> model,
     std::unique_ptr<ValidationDelegate> delegate)
-    : Combobox(std::move(model)),
-      delegate_(std::move(delegate)),
-      was_blurred_(false) {
+    : Combobox(std::move(model)), delegate_(std::move(delegate)) {
   // No need to remove observer on owned model.
   this->model()->AddObserver(this);
 }
@@ -26,13 +24,20 @@
   Combobox::OnBlur();
 
   // The first validation should be on a blur. The subsequent validations will
-  // occur when the content changes.
-  if (!was_blurred_) {
+  // occur when the content changes. Do not validate if the view is being
+  // removed.
+  if (!was_blurred_ && !being_removed_) {
     was_blurred_ = true;
     Validate();
   }
 }
 
+void ValidatingCombobox::ViewHierarchyChanged(
+    const ViewHierarchyChangedDetails& details) {
+  if (details.child == this && !details.is_add)
+    being_removed_ = true;
+}
+
 void ValidatingCombobox::OnContentsChanged() {
   // Validation on every keystroke only happens if the field has been validated
   // before as part of a blur.

diff --git a/chrome/browser/ui/views/payments/validating_combobox.h b/chrome/browser/ui/views/payments/validating_combobox.h
index d001690..1ed212a 100644
--- a/chrome/browser/ui/views/payments/validating_combobox.h
+++ b/chrome/browser/ui/views/payments/validating_combobox.h

@@ -24,6 +24,9 @@
   // Combobox:
   // The first validation will happen on blur.
   void OnBlur() override;
+  // Used to keep track of our own destruction.
+  void ViewHierarchyChanged(
+      const ViewHierarchyChangedDetails& details) override;
 
   // Called when the combobox contents is changed. May do validation.
   void OnContentsChanged();
@@ -37,7 +40,8 @@
   void Validate();
 
   std::unique_ptr<ValidationDelegate> delegate_;
-  bool was_blurred_;
+  bool was_blurred_ = false;
+  bool being_removed_ = false;
 
   DISALLOW_COPY_AND_ASSIGN(ValidatingCombobox);
 };

diff --git a/chrome/browser/ui/views/payments/validating_textfield.cc b/chrome/browser/ui/views/payments/validating_textfield.cc
index 5b33619..0f5204c 100644
--- a/chrome/browser/ui/views/payments/validating_textfield.cc
+++ b/chrome/browser/ui/views/payments/validating_textfield.cc

@@ -10,7 +10,7 @@
 
 ValidatingTextfield::ValidatingTextfield(
     std::unique_ptr<ValidationDelegate> delegate)
-    : Textfield(), delegate_(std::move(delegate)), was_blurred_(false) {}
+    : Textfield(), delegate_(std::move(delegate)) {}
 
 ValidatingTextfield::~ValidatingTextfield() {}
 
@@ -18,13 +18,20 @@
   Textfield::OnBlur();
 
   // The first validation should be on a blur. The subsequent validations will
-  // occur when the content changes.
-  if (!was_blurred_) {
+  // occur when the content changes. Do not validate if the view is being
+  // removed.
+  if (!was_blurred_ && !being_removed_) {
     was_blurred_ = true;
     Validate();
   }
 }
 
+void ValidatingTextfield::ViewHierarchyChanged(
+    const ViewHierarchyChangedDetails& details) {
+  if (details.child == this && !details.is_add)
+    being_removed_ = true;
+}
+
 void ValidatingTextfield::OnContentsChanged() {
   // Validation on every keystroke only happens if the field has been validated
   // before as part of a blur.

diff --git a/chrome/browser/ui/views/payments/validating_textfield.h b/chrome/browser/ui/views/payments/validating_textfield.h
index c7d87de..ee0e1cf 100644
--- a/chrome/browser/ui/views/payments/validating_textfield.h
+++ b/chrome/browser/ui/views/payments/validating_textfield.h

@@ -19,6 +19,9 @@
   // Textfield:
   // The first validation will happen on blur.
   void OnBlur() override;
+  // Used to keep track of our own destruction.
+  void ViewHierarchyChanged(
+      const ViewHierarchyChangedDetails& details) override;
 
   // Called when the textfield contents is changed. May do validation.
   void OnContentsChanged();
@@ -29,7 +32,8 @@
   void Validate();
 
   std::unique_ptr<ValidationDelegate> delegate_;
-  bool was_blurred_;
+  bool was_blurred_ = false;
+  bool being_removed_ = false;
 
   DISALLOW_COPY_AND_ASSIGN(ValidatingTextfield);
 };

diff --git a/chrome/browser/ui/webui/options/browser_options_handler.cc b/chrome/browser/ui/webui/options/browser_options_handler.cc
index ca24358..4e362c2 100644
--- a/chrome/browser/ui/webui/options/browser_options_handler.cc
+++ b/chrome/browser/ui/webui/options/browser_options_handler.cc

@@ -803,7 +803,7 @@
                      chromeos::quick_unlock::IsPinEnabled(profile->GetPrefs()));
   values->SetBoolean("fingerprintUnlockEnabled",
                      chromeos::quick_unlock::IsFingerprintEnabled());
-  values->SetBoolean("pinUnlockEnabled",
+  values->SetBoolean("quickUnlockEnabled",
                      chromeos::quick_unlock::IsPinEnabled(profile->GetPrefs()));
   if (chromeos::quick_unlock::IsPinEnabled(profile->GetPrefs())) {
     values->SetString(

diff --git a/chrome/browser/ui/webui/settings/md_settings_ui.cc b/chrome/browser/ui/webui/settings/md_settings_ui.cc
index 1e778ae..d073d8df 100644
--- a/chrome/browser/ui/webui/settings/md_settings_ui.cc
+++ b/chrome/browser/ui/webui/settings/md_settings_ui.cc

@@ -181,7 +181,7 @@
   AddSettingsPageUIHandler(
       base::MakeUnique<chromeos::settings::StylusHandler>());
   html_source->AddBoolean(
-      "pinUnlockEnabled",
+      "quickUnlockEnabled",
       chromeos::quick_unlock::IsPinEnabled(profile->GetPrefs()));
   html_source->AddBoolean("fingerprintUnlockEnabled",
                           chromeos::quick_unlock::IsFingerprintEnabled());

diff --git a/chrome/browser/ui/webui/signin/inline_login_handler_impl.cc b/chrome/browser/ui/webui/signin/inline_login_handler_impl.cc
index 429d175..2dde2ab 100644
--- a/chrome/browser/ui/webui/signin/inline_login_handler_impl.cc
+++ b/chrome/browser/ui/webui/signin/inline_login_handler_impl.cc

@@ -273,9 +273,8 @@
       bool show_settings_without_configure =
           error_controller->HasError() && sync_service &&
           sync_service->IsFirstSetupComplete();
-      start_mode = show_settings_without_configure ?
-          OneClickSigninSyncStarter::SHOW_SETTINGS_WITHOUT_CONFIGURE :
-          OneClickSigninSyncStarter::CONFIGURE_SYNC_FIRST;
+      if (!show_settings_without_configure)
+        start_mode = OneClickSigninSyncStarter::CONFIGURE_SYNC_FIRST;
     }
 
     OneClickSigninSyncStarter::ConfirmationRequired confirmation_required =

diff --git a/chrome/test/android/javatests/src/org/chromium/chrome/test/util/ApplicationTestUtils.java b/chrome/test/android/javatests/src/org/chromium/chrome/test/util/ApplicationTestUtils.java
index 6f425ef..b7402e37 100644
--- a/chrome/test/android/javatests/src/org/chromium/chrome/test/util/ApplicationTestUtils.java
+++ b/chrome/test/android/javatests/src/org/chromium/chrome/test/util/ApplicationTestUtils.java

@@ -123,23 +123,6 @@
 
     /** Finishes the given activity and waits for its onDestroy() to be called. */
     public static void finishActivity(final Activity activity) throws Exception {
-        closeActivity(activity, new ActivityCloser<Activity>() {
-            @Override
-            public void close(Activity activity) {
-                activity.finish();
-            }
-        });
-    }
-
-    /**
-     * Encapsulates activity closing logic. Invoked on UI thread.
-     * @param <A> Activity type.
-     */
-    public interface ActivityCloser<A extends Activity> { void close(A activity); }
-
-    /** Closes the given activity and waits for its onDestroy() to be called. */
-    public static <A extends Activity> void closeActivity(
-            final A activity, final ActivityCloser<A> closer) throws Exception {
         final CallbackHelper callbackHelper = new CallbackHelper();
         final ApplicationStatus.ActivityStateListener activityStateListener =
                 new ApplicationStatus.ActivityStateListener() {
@@ -160,7 +143,7 @@
                     }
                     ApplicationStatus.registerStateListenerForActivity(
                             activityStateListener, activity);
-                    closer.close(activity);
+                    activity.finish();
                     return false;
                 }
             });

diff --git a/components/browser_sync/profile_sync_service.cc b/components/browser_sync/profile_sync_service.cc
index 1a4dae5b..df12c63 100644
--- a/components/browser_sync/profile_sync_service.cc
+++ b/components/browser_sync/profile_sync_service.cc

@@ -242,12 +242,8 @@
                  syncer::ModelTypeSet(syncer::SESSIONS)));
 
   if (base::FeatureList::IsEnabled(switches::kSyncUSSDeviceInfo)) {
-    // TODO(skym): Stop creating leveldb files when signed out.
-    // TODO(skym): Verify using AsUTF8Unsafe is okay here. Should work as long
-    // as the Local State file is guaranteed to be UTF-8.
     const syncer::ModelTypeStoreFactory& store_factory =
-        GetModelTypeStoreFactory(syncer::DEVICE_INFO, base_directory_,
-                                 sync_client_->GetBlockingPool());
+        GetModelTypeStoreFactory(syncer::DEVICE_INFO, base_directory_);
     device_info_sync_bridge_ = base::MakeUnique<DeviceInfoSyncBridge>(
         local_device_.get(), store_factory,
         base::BindRepeating(
@@ -1681,18 +1677,12 @@
 // static
 syncer::ModelTypeStoreFactory ProfileSyncService::GetModelTypeStoreFactory(
     ModelType type,
-    const base::FilePath& base_path,
-    base::SequencedWorkerPool* blocking_pool) {
+    const base::FilePath& base_path) {
   // TODO(skym): Verify using AsUTF8Unsafe is okay here. Should work as long
   // as the Local State file is guaranteed to be UTF-8.
-  std::string path = FormatSharedModelTypeStorePath(base_path).AsUTF8Unsafe();
-  base::SequencedWorkerPool::SequenceToken sequence_token =
-      blocking_pool->GetNamedSequenceToken(path);
-  scoped_refptr<base::SequencedTaskRunner> task_runner =
-      blocking_pool->GetSequencedTaskRunnerWithShutdownBehavior(
-          blocking_pool->GetNamedSequenceToken(path),
-          base::SequencedWorkerPool::SKIP_ON_SHUTDOWN);
-  return base::Bind(&ModelTypeStore::CreateStore, type, path, task_runner);
+  const std::string path =
+      FormatSharedModelTypeStorePath(base_path).AsUTF8Unsafe();
+  return base::Bind(&ModelTypeStore::CreateStore, type, path);
 }
 
 void ProfileSyncService::ConfigureDataTypeManager() {

diff --git a/components/browser_sync/profile_sync_service.h b/components/browser_sync/profile_sync_service.h
index 88837d3..b4e29d8 100644
--- a/components/browser_sync/profile_sync_service.h
+++ b/components/browser_sync/profile_sync_service.h

@@ -559,12 +559,9 @@
 
   // Returns a function for |type| that will create a ModelTypeStore that shares
   // the sync LevelDB backend. |base_path| should be set to profile path.
-  // |sequenced_worker_pool| is obtained from content::BrowserThread or
-  // web::WebThread depending on platform.
   static syncer::ModelTypeStoreFactory GetModelTypeStoreFactory(
       syncer::ModelType type,
-      const base::FilePath& base_path,
-      base::SequencedWorkerPool* sequenced_worker_pool);
+      const base::FilePath& base_path);
 
   // Needed to test whether the directory is deleted properly.
   base::FilePath GetDirectoryPathForTest() const;

diff --git a/components/certificate_transparency/BUILD.gn b/components/certificate_transparency/BUILD.gn
index bf687c9c7..ef07c14a 100644
--- a/components/certificate_transparency/BUILD.gn
+++ b/components/certificate_transparency/BUILD.gn

@@ -8,8 +8,6 @@
     "ct_policy_manager.h",
     "log_dns_client.cc",
     "log_dns_client.h",
-    "log_proof_fetcher.cc",
-    "log_proof_fetcher.h",
     "pref_names.cc",
     "pref_names.h",
     "single_tree_tracker.cc",
@@ -35,7 +33,6 @@
   sources = [
     "ct_policy_manager_unittest.cc",
     "log_dns_client_unittest.cc",
-    "log_proof_fetcher_unittest.cc",
     "mock_log_dns_traffic.cc",
     "mock_log_dns_traffic.h",
     "single_tree_tracker_unittest.cc",

diff --git a/components/certificate_transparency/log_proof_fetcher.cc b/components/certificate_transparency/log_proof_fetcher.cc
deleted file mode 100644
index 4a1a3902..0000000
--- a/components/certificate_transparency/log_proof_fetcher.cc
+++ /dev/null

@@ -1,441 +0,0 @@
-// Copyright 2015 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "components/certificate_transparency/log_proof_fetcher.h"
-
-#include <iterator>
-#include <memory>
-
-#include "base/callback_helpers.h"
-#include "base/format_macros.h"
-#include "base/logging.h"
-#include "base/memory/ptr_util.h"
-#include "base/memory/ref_counted.h"
-#include "base/numerics/safe_conversions.h"
-#include "base/strings/stringprintf.h"
-#include "base/values.h"
-#include "components/safe_json/safe_json_parser.h"
-#include "net/base/io_buffer.h"
-#include "net/base/load_flags.h"
-#include "net/base/net_errors.h"
-#include "net/base/request_priority.h"
-#include "net/cert/ct_log_response_parser.h"
-#include "net/cert/signed_tree_head.h"
-#include "net/http/http_status_code.h"
-#include "net/url_request/url_request.h"
-#include "net/url_request/url_request_context.h"
-#include "url/gurl.h"
-
-namespace certificate_transparency {
-
-namespace {
-
-// Class for issuing a particular request from a CT log and assembling the
-// response.
-// Creates the URLRequest instance for fetching the URL from the log
-// (supplied as |request_url| in the c'tor) and implements the
-// URLRequest::Delegate interface for assembling the response.
-class LogFetcher : public net::URLRequest::Delegate {
- public:
-  using FailureCallback = base::Callback<void(int, int)>;
-
-  LogFetcher(net::URLRequestContext* request_context,
-             const GURL& request_url,
-             const base::Closure& success_callback,
-             const FailureCallback& failure_callback);
-  ~LogFetcher() override {}
-
-  // net::URLRequest::Delegate
-  void OnResponseStarted(net::URLRequest* request, int net_error) override;
-  void OnReadCompleted(net::URLRequest* request, int bytes_read) override;
-
-  const std::string& assembled_response() const { return assembled_response_; }
-
- private:
-  // Handles the final result of a URLRequest::Read call on the request.
-  // Returns true if another read should be started, false if the read
-  // failed completely or we have to wait for OnResponseStarted to
-  // be called.
-  bool HandleReadResult(int result);
-
-  // Calls URLRequest::Read on |request| repeatedly, until HandleReadResult
-  // indicates it should no longer be called. Usually this would be when there
-  // is pending IO that requires waiting for OnResponseStarted to be called.
-  void StartNextReadLoop();
-
-  // Invokes the success callback. After this method is called, the LogFetcher
-  // is deleted and no longer safe to call.
-  void RequestComplete();
-
-  // Invokes the failure callback with the supplied error information.
-  // After this method the LogFetcher is deleted and no longer safe to call.
-  void InvokeFailureCallback(int net_error, int http_response_code);
-
-  std::unique_ptr<net::URLRequest> url_request_;
-  const GURL request_url_;
-  base::Closure success_callback_;
-  FailureCallback failure_callback_;
-  scoped_refptr<net::IOBufferWithSize> response_buffer_;
-  std::string assembled_response_;
-
-  DISALLOW_COPY_AND_ASSIGN(LogFetcher);
-};
-
-LogFetcher::LogFetcher(net::URLRequestContext* request_context,
-                       const GURL& request_url,
-                       const base::Closure& success_callback,
-                       const FailureCallback& failure_callback)
-    : request_url_(request_url),
-      success_callback_(success_callback),
-      failure_callback_(failure_callback) {
-  DCHECK(request_url_.SchemeIsHTTPOrHTTPS());
-  url_request_ =
-      request_context->CreateRequest(request_url_, net::DEFAULT_PRIORITY, this);
-  // This request should not send any cookies or otherwise identifying data,
-  // as CT logs are expected to be publicly-accessible and connections to them
-  // stateless.
-  url_request_->SetLoadFlags(net::LOAD_DO_NOT_SEND_COOKIES |
-                             net::LOAD_DO_NOT_SAVE_COOKIES |
-                             net::LOAD_DO_NOT_SEND_AUTH_DATA);
-
-  url_request_->Start();
-}
-
-void LogFetcher::OnResponseStarted(net::URLRequest* request, int net_error) {
-  DCHECK_NE(net::ERR_IO_PENDING, net_error);
-  DCHECK_EQ(url_request_.get(), request);
-  int http_response_code = request->GetResponseCode();
-
-  if (net_error != net::OK) {
-    InvokeFailureCallback(net_error, http_response_code);
-    return;
-  }
-
-  if (http_response_code != net::HTTP_OK) {
-    InvokeFailureCallback(net::OK, http_response_code);
-    return;
-  }
-
-  // Lazily initialize |response_buffer_| to avoid consuming memory until an
-  // actual response has been received.
-  if (!response_buffer_) {
-    response_buffer_ =
-        new net::IOBufferWithSize(LogProofFetcher::kMaxLogResponseSizeInBytes);
-  }
-
-  StartNextReadLoop();
-}
-
-void LogFetcher::OnReadCompleted(net::URLRequest* request, int bytes_read) {
-  DCHECK_EQ(url_request_.get(), request);
-
-  if (HandleReadResult(bytes_read))
-    StartNextReadLoop();
-}
-
-bool LogFetcher::HandleReadResult(int result) {
-  if (result == net::ERR_IO_PENDING)
-    return false;
-
-  if (result < 0) {
-    InvokeFailureCallback(result, net::HTTP_OK);
-    return false;
-  }
-
-  // Nothing more to read from the stream - finish handling the response.
-  if (result == 0) {
-    RequestComplete();
-    return false;
-  }
-
-  // Data is available, collect it and indicate another read is needed.
-  DCHECK_GE(result, 0);
-  // |result| is non-negative at this point, casting to size_t should be
-  // safe.
-  if (base::checked_cast<size_t>(result) >
-          LogProofFetcher::kMaxLogResponseSizeInBytes ||
-      LogProofFetcher::kMaxLogResponseSizeInBytes <
-          (assembled_response_.size() + result)) {
-    // Log response is too big, invoke the failure callback.
-    InvokeFailureCallback(net::ERR_FILE_TOO_BIG, net::HTTP_OK);
-    return false;
-  }
-
-  assembled_response_.append(response_buffer_->data(), result);
-  return true;
-}
-
-void LogFetcher::StartNextReadLoop() {
-  bool continue_reading = true;
-  while (continue_reading) {
-    int read_bytes =
-        url_request_->Read(response_buffer_.get(), response_buffer_->size());
-    continue_reading = HandleReadResult(read_bytes);
-  }
-}
-
-void LogFetcher::RequestComplete() {
-  // Get rid of the buffer as it really isn't necessary.
-  response_buffer_ = nullptr;
-  base::ResetAndReturn(&success_callback_).Run();
-  // NOTE: |this| is not valid after invoking the callback, as the LogFetcher
-  // instance will be deleted by the callback.
-}
-
-void LogFetcher::InvokeFailureCallback(int net_error, int http_response_code) {
-  base::ResetAndReturn(&failure_callback_).Run(net_error, http_response_code);
-  // NOTE: |this| is not valid after this callback, as the LogFetcher instance
-  // invoking the callback will be deleted by the callback.
-}
-
-}  // namespace
-
-// Interface for handling the response from a CT log for a particular
-// request.
-// All log responses are JSON and should be parsed; however the response
-// to each request should be parsed and validated differently.
-//
-// LogResponseHandler instances should be deleted by the |done_callback| when
-// it is invoked.
-class LogResponseHandler {
- public:
-  using DoneCallback = base::Callback<void(const base::Closure&)>;
-
-  // |log_id| will be passed to the |failure_callback| to indicate which log
-  // failures pretain to.
-  LogResponseHandler(
-      const std::string& log_id,
-      const LogProofFetcher::FetchFailedCallback& failure_callback);
-  virtual ~LogResponseHandler();
-
-  // Starts the actual fetching from the URL, storing |done_callback| for
-  // invocation when fetching and parsing of the request finished.
-  // It is safe, and expected, to delete this object in the |done_callback|.
-  void StartFetch(net::URLRequestContext* request_context,
-                  const GURL& request_url,
-                  const DoneCallback& done_callback);
-
-  // Handle successful fetch by the LogFetcher (by parsing the JSON and
-  // handing the parsed JSON to HandleParsedJson, which is request-specific).
-  void HandleFetchCompletion();
-
-  // Handle network failure to complete the request to the log, by invoking
-  // the |done_callback_|.
-  virtual void HandleNetFailure(int net_error, int http_response_code);
-
- protected:
-  // Handle successful parsing of JSON by invoking HandleParsedJson, then
-  // invoking the |done_callback_| with the returned Closure.
-  void OnJsonParseSuccess(std::unique_ptr<base::Value> parsed_json);
-
-  // Handle failure to parse the JSON by invoking HandleJsonParseFailure, then
-  // invoking the |done_callback_| with the returned Closure.
-  void OnJsonParseError(const std::string& error);
-
-  // Handle respones JSON that parsed successfully, usually by
-  // returning the success callback bound to parsed values as a Closure.
-  virtual base::Closure HandleParsedJson(const base::Value& parsed_json) = 0;
-
-  // Handle failure to parse response JSON, usually by returning the failure
-  // callback bound to a request-specific net error code.
-  virtual base::Closure HandleJsonParseFailure(
-      const std::string& json_error) = 0;
-
-  const std::string log_id_;
-  LogProofFetcher::FetchFailedCallback failure_callback_;
-  std::unique_ptr<LogFetcher> fetcher_;
-  DoneCallback done_callback_;
-
-  base::WeakPtrFactory<LogResponseHandler> weak_factory_;
-};
-
-LogResponseHandler::LogResponseHandler(
-    const std::string& log_id,
-    const LogProofFetcher::FetchFailedCallback& failure_callback)
-    : log_id_(log_id),
-      failure_callback_(failure_callback),
-      fetcher_(nullptr),
-      weak_factory_(this) {
-  DCHECK(!failure_callback_.is_null());
-}
-
-LogResponseHandler::~LogResponseHandler() {}
-
-void LogResponseHandler::StartFetch(net::URLRequestContext* request_context,
-                                    const GURL& request_url,
-                                    const DoneCallback& done_callback) {
-  done_callback_ = done_callback;
-  fetcher_.reset(
-      new LogFetcher(request_context, request_url,
-                     base::Bind(&LogResponseHandler::HandleFetchCompletion,
-                                weak_factory_.GetWeakPtr()),
-                     base::Bind(&LogResponseHandler::HandleNetFailure,
-                                weak_factory_.GetWeakPtr())));
-}
-
-void LogResponseHandler::HandleFetchCompletion() {
-  safe_json::SafeJsonParser::Parse(
-      fetcher_->assembled_response(),
-      base::Bind(&LogResponseHandler::OnJsonParseSuccess,
-                 weak_factory_.GetWeakPtr()),
-      base::Bind(&LogResponseHandler::OnJsonParseError,
-                 weak_factory_.GetWeakPtr()));
-
-  // The assembled_response string is copied into the SafeJsonParser so it
-  // is safe to get rid of the object that owns it.
-  fetcher_.reset();
-}
-
-void LogResponseHandler::HandleNetFailure(int net_error,
-                                          int http_response_code) {
-  fetcher_.reset();
-  LogProofFetcher::FetchFailedCallback failure_callback =
-      base::ResetAndReturn(&failure_callback_);
-
-  base::ResetAndReturn(&done_callback_)
-      .Run(
-          base::Bind(failure_callback, log_id_, net_error, http_response_code));
-  // NOTE: |this| is not valid after the |done_callback_| is invoked.
-}
-
-void LogResponseHandler::OnJsonParseSuccess(
-    std::unique_ptr<base::Value> parsed_json) {
-  base::ResetAndReturn(&done_callback_).Run(HandleParsedJson(*parsed_json));
-  // NOTE: |this| is not valid after the |done_callback_| is invoked.
-}
-
-void LogResponseHandler::OnJsonParseError(const std::string& error) {
-  base::ResetAndReturn(&done_callback_).Run(HandleJsonParseFailure(error));
-  // NOTE: |this| is not valid after the |done_callback_| is invoked.
-}
-
-class GetSTHLogResponseHandler : public LogResponseHandler {
- public:
-  GetSTHLogResponseHandler(
-      const std::string& log_id,
-      const LogProofFetcher::SignedTreeHeadFetchedCallback& sth_fetch_callback,
-      const LogProofFetcher::FetchFailedCallback& failure_callback)
-      : LogResponseHandler(log_id, failure_callback),
-        sth_fetched_(sth_fetch_callback) {}
-
-  // Parses the JSON into a net::ct::SignedTreeHead and, if successful,
-  // invokes the success callback with it. Otherwise, invokes the failure
-  // callback indicating the error that occurred.
-  base::Closure HandleParsedJson(const base::Value& parsed_json) override {
-    net::ct::SignedTreeHead signed_tree_head;
-    if (!net::ct::FillSignedTreeHead(parsed_json, &signed_tree_head)) {
-      return base::Bind(base::ResetAndReturn(&failure_callback_), log_id_,
-                        net::ERR_CT_STH_INCOMPLETE, net::HTTP_OK);
-    }
-    // The log id is not a part of the response, fill in manually.
-    signed_tree_head.log_id = log_id_;
-
-    return base::Bind(base::ResetAndReturn(&sth_fetched_), log_id_,
-                      signed_tree_head);
-  }
-
-  // Invoke the error callback indicating that STH parsing failed.
-  base::Closure HandleJsonParseFailure(const std::string& json_error) override {
-    return base::Bind(base::ResetAndReturn(&failure_callback_), log_id_,
-                      net::ERR_CT_STH_PARSING_FAILED, net::HTTP_OK);
-  }
-
- private:
-  LogProofFetcher::SignedTreeHeadFetchedCallback sth_fetched_;
-};
-
-class GetConsistencyProofLogResponseHandler : public LogResponseHandler {
- public:
-  GetConsistencyProofLogResponseHandler(
-      const std::string& log_id,
-      const LogProofFetcher::ConsistencyProofFetchedCallback&
-          proof_fetch_callback,
-      const LogProofFetcher::FetchFailedCallback& failure_callback)
-      : LogResponseHandler(log_id, failure_callback),
-        proof_fetched_(proof_fetch_callback) {}
-
-  // Fills a vector of strings with nodes from the received consistency proof
-  // in |parsed_json|, and, if successful, invokes the success callback with the
-  // vector. Otherwise, invokes the failure callback indicating proof parsing
-  // has failed.
-  base::Closure HandleParsedJson(const base::Value& parsed_json) override {
-    std::vector<std::string> consistency_proof;
-    if (!net::ct::FillConsistencyProof(parsed_json, &consistency_proof)) {
-      return base::Bind(base::ResetAndReturn(&failure_callback_), log_id_,
-                        net::ERR_CT_CONSISTENCY_PROOF_PARSING_FAILED,
-                        net::HTTP_OK);
-    }
-
-    return base::Bind(base::ResetAndReturn(&proof_fetched_), log_id_,
-                      consistency_proof);
-  }
-
-  // Invoke the error callback indicating proof fetching failed.
-  base::Closure HandleJsonParseFailure(const std::string& json_error) override {
-    return base::Bind(base::ResetAndReturn(&failure_callback_), log_id_,
-                      net::ERR_CT_CONSISTENCY_PROOF_PARSING_FAILED,
-                      net::HTTP_OK);
-  }
-
- private:
-  LogProofFetcher::ConsistencyProofFetchedCallback proof_fetched_;
-};
-
-LogProofFetcher::LogProofFetcher(net::URLRequestContext* request_context)
-    : request_context_(request_context), weak_factory_(this) {
-  DCHECK(request_context);
-}
-
-LogProofFetcher::~LogProofFetcher() {
-}
-
-void LogProofFetcher::FetchSignedTreeHead(
-    const GURL& base_log_url,
-    const std::string& log_id,
-    const SignedTreeHeadFetchedCallback& fetched_callback,
-    const FetchFailedCallback& failed_callback) {
-  GURL request_url = base_log_url.Resolve("ct/v1/get-sth");
-  StartFetch(request_url, base::MakeUnique<GetSTHLogResponseHandler>(
-                              log_id, fetched_callback, failed_callback));
-}
-
-void LogProofFetcher::FetchConsistencyProof(
-    const GURL& base_log_url,
-    const std::string& log_id,
-    uint64_t old_tree_size,
-    uint64_t new_tree_size,
-    const ConsistencyProofFetchedCallback& fetched_callback,
-    const FetchFailedCallback& failed_callback) {
-  GURL request_url = base_log_url.Resolve(base::StringPrintf(
-      "ct/v1/get-sth-consistency?first=%" PRIu64 "&second=%" PRIu64,
-      old_tree_size, new_tree_size));
-  StartFetch(request_url,
-             base::MakeUnique<GetConsistencyProofLogResponseHandler>(
-                 log_id, fetched_callback, failed_callback));
-}
-
-void LogProofFetcher::StartFetch(
-    const GURL& request_url,
-    std::unique_ptr<LogResponseHandler> log_request) {
-  log_request->StartFetch(
-      request_context_, request_url,
-      base::Bind(&LogProofFetcher::OnFetchDone, weak_factory_.GetWeakPtr(),
-                 log_request.get()));
-  inflight_fetches_.insert(std::move(log_request));
-}
-
-void LogProofFetcher::OnFetchDone(LogResponseHandler* log_handler,
-                                  const base::Closure& requestor_callback) {
-  auto it = std::find_if(
-      inflight_fetches_.begin(), inflight_fetches_.end(),
-      [log_handler](const std::unique_ptr<LogResponseHandler>& ptr) {
-        return ptr.get() == log_handler;
-      });
-  DCHECK(it != inflight_fetches_.end());
-
-  inflight_fetches_.erase(it);
-  requestor_callback.Run();
-}
-
-}  // namespace certificate_transparency

diff --git a/components/certificate_transparency/log_proof_fetcher.h b/components/certificate_transparency/log_proof_fetcher.h
deleted file mode 100644
index 53a52af6..0000000
--- a/components/certificate_transparency/log_proof_fetcher.h
+++ /dev/null

@@ -1,129 +0,0 @@
-// Copyright 2015 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef COMPONENTS_CERTIFICATE_TRANSPARENCY_LOG_PROOF_FETCHER_H_
-#define COMPONENTS_CERTIFICATE_TRANSPARENCY_LOG_PROOF_FETCHER_H_
-
-#include <stddef.h>
-#include <stdint.h>
-
-#include <set>
-#include <string>
-#include <vector>
-
-#include "base/callback.h"
-#include "base/macros.h"
-#include "base/memory/weak_ptr.h"
-
-namespace net {
-
-class URLRequestContext;
-
-namespace ct {
-struct SignedTreeHead;
-}  // namespace ct
-
-}  // namespace net
-
-class GURL;
-
-namespace certificate_transparency {
-
-class LogResponseHandler;
-
-// Fetches Signed Tree Heads (STHs) and consistency proofs from Certificate
-// Transparency logs using the URLRequestContext provided during the instance
-// construction.
-// Must outlive the provided URLRequestContext.
-class LogProofFetcher {
- public:
-  // Buffer size for log replies - currently the reply to
-  // get-consistency-proof is the biggest one this class handles. 1500 bytes
-  // should be enough to accommodate 31 proof nodes + JSON overhead, supporting
-  // trees with up to 100 million entries.
-  static const size_t kMaxLogResponseSizeInBytes = 1500;
-
-  // Callback for successful retrieval of Signed Tree Heads. Called
-  // with the log_id of the log the STH belogs to (as supplied by the caller
-  // to FetchSignedTreeHead) and the STH itself.
-  using SignedTreeHeadFetchedCallback =
-      base::Callback<void(const std::string& log_id,
-                          const net::ct::SignedTreeHead& signed_tree_head)>;
-
-  // Callback for failure of Signed Tree Head retrieval. Called with the log_id
-  // that the log fetching was requested for and a net error code of the
-  // failure.
-  // |http_response_code| is meaningful only if |net_error| is net::OK.
-  using FetchFailedCallback = base::Callback<
-      void(const std::string& log_id, int net_error, int http_response_code)>;
-
-  // Callback for successful retrieval of consistency proofs between two
-  // STHs. Called with the log_id of the log the consistency belongs to (as
-  // supplied by the caller to FetchConsistencyProof) and the vector of
-  // proof nodes.
-  using ConsistencyProofFetchedCallback =
-      base::Callback<void(const std::string& log_id,
-                          const std::vector<std::string>& consistency_proof)>;
-
-  explicit LogProofFetcher(net::URLRequestContext* request_context);
-  ~LogProofFetcher();
-
-  // Fetch the latest Signed Tree Head from the log identified by |log_id|
-  // from |base_log_url|. The |log_id| will be passed into the callbacks to
-  // identify the log the retrieved Signed Tree Head belongs to.
-  // The callbacks won't be invoked if the request is destroyed before
-  // fetching is completed.
-  // It is possible, but does not make a lot of sense, to have multiple
-  // Signed Tree Head fetching requests going out to the same log, since
-  // they are likely to return the same result.
-  // TODO(eranm): Think further about whether multiple requests to the same
-  // log imply cancellation of previous requests, should be coalesced or handled
-  // independently.
-  void FetchSignedTreeHead(
-      const GURL& base_log_url,
-      const std::string& log_id,
-      const SignedTreeHeadFetchedCallback& fetched_callback,
-      const FetchFailedCallback& failed_callback);
-
-  // Fetch a consistency proof between the Merkle trees identified by
-  // |old_tree_size| and |new_tree_size| of the log identified by |log_id|
-  // from |base_log_url|.
-  //
-  // See the documentation of FetchSignedTreeHead regarding request destruction
-  // and multiple requests to the same log.
-  void FetchConsistencyProof(
-      const GURL& base_log_url,
-      const std::string& log_id,
-      uint64_t old_tree_size,
-      uint64_t new_tree_size,
-      const ConsistencyProofFetchedCallback& fetched_callback,
-      const FetchFailedCallback& failed_callback);
-
- private:
-  // Starts the fetch (by delegating to the LogResponseHandler)
-  // and stores the |log_handler| in |inflight_fetches_| for later
-  // cleanup.
-  void StartFetch(const GURL& request_url,
-                  std::unique_ptr<LogResponseHandler> log_request);
-
-  // Callback for when the fetch was done (successfully or not).
-  // Deletes, and removes, the |log_handler| from the |inflight_fetches_|.
-  // Additionally, invokes |caller_callback| which is typically
-  // one of the callbacks provided to the Fetch... method, bound to
-  // success/failure parameters.
-  void OnFetchDone(LogResponseHandler* log_handler,
-                   const base::Closure& caller_callback);
-
-  net::URLRequestContext* const request_context_;
-
-  std::set<std::unique_ptr<LogResponseHandler>> inflight_fetches_;
-
-  base::WeakPtrFactory<LogProofFetcher> weak_factory_;
-
-  DISALLOW_COPY_AND_ASSIGN(LogProofFetcher);
-};
-
-}  // namespace certificate_transparency
-
-#endif  // COMPONENTS_CERTIFICATE_TRANSPARENCY_LOG_PROOF_FETCHER_H_

diff --git a/components/certificate_transparency/log_proof_fetcher_unittest.cc b/components/certificate_transparency/log_proof_fetcher_unittest.cc
deleted file mode 100644
index c46039e..0000000
--- a/components/certificate_transparency/log_proof_fetcher_unittest.cc
+++ /dev/null

@@ -1,441 +0,0 @@
-// Copyright 2015 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "components/certificate_transparency/log_proof_fetcher.h"
-
-#include <memory>
-#include <string>
-#include <utility>
-
-#include "base/format_macros.h"
-#include "base/macros.h"
-#include "base/run_loop.h"
-#include "base/strings/stringprintf.h"
-#include "components/safe_json/testing_json_parser.h"
-#include "net/base/net_errors.h"
-#include "net/base/network_delegate.h"
-#include "net/cert/signed_tree_head.h"
-#include "net/http/http_status_code.h"
-#include "net/test/ct_test_util.h"
-#include "net/url_request/url_request_context.h"
-#include "net/url_request/url_request_filter.h"
-#include "net/url_request/url_request_interceptor.h"
-#include "net/url_request/url_request_job.h"
-#include "net/url_request/url_request_test_job.h"
-#include "net/url_request/url_request_test_util.h"
-#include "testing/gtest/include/gtest/gtest.h"
-
-namespace certificate_transparency {
-
-namespace {
-
-const char kGetResponseHeaders[] =
-    "HTTP/1.1 200 OK\n"
-    "Content-Type: application/json; charset=ISO-8859-1\n";
-
-const char kGetResponseNotFoundHeaders[] =
-    "HTTP/1.1 404 Not Found\n"
-    "Content-Type: text/html; charset=iso-8859-1\n";
-
-const char kLogSchema[] = "https";
-const char kLogHost[] = "ct.log.example.com";
-const char kLogPathPrefix[] = "somelog";
-const char kLogID[] = "some_id";
-
-// Gets a dummy consistency proof for the given |node_id|.
-std::string GetDummyConsistencyProofNode(uint64_t node_id) {
-  // Take the low 8 bits and repeat them as a string. This
-  // has no special meaning, other than making it easier to
-  // debug which consistency proof was used.
-  return std::string(32, static_cast<char>(node_id));
-}
-
-// Number of nodes in a dummy consistency proof.
-const size_t kDummyConsistencyProofNumNodes = 4;
-
-class LogFetchTestJob : public net::URLRequestTestJob {
- public:
-  LogFetchTestJob(const std::string& get_log_data,
-                  const std::string& get_log_headers,
-                  net::URLRequest* request,
-                  net::NetworkDelegate* network_delegate)
-      : URLRequestTestJob(request,
-                          network_delegate,
-                          get_log_headers,
-                          get_log_data,
-                          true),
-        async_io_(false) {}
-
-  void set_async_io(bool async_io) { async_io_ = async_io; }
-
- private:
-  ~LogFetchTestJob() override {}
-
-  bool NextReadAsync() override {
-    // Response with indication of async IO only once, otherwise the final
-    // Read would (incorrectly) be classified as async, causing the
-    // URLRequestJob to try reading another time and failing on a CHECK
-    // that the raw_read_buffer_ is not null.
-    // According to mmenke@, this is a bug in the URLRequestTestJob code.
-    // TODO(eranm): Once said bug is fixed, switch most tests to using async
-    // IO.
-    if (async_io_) {
-      async_io_ = false;
-      return true;
-    }
-    return false;
-  }
-
-  bool async_io_;
-
-  DISALLOW_COPY_AND_ASSIGN(LogFetchTestJob);
-};
-
-class LogGetResponseHandler : public net::URLRequestInterceptor {
- public:
-  LogGetResponseHandler()
-      : async_io_(false),
-        response_headers_(
-            std::string(kGetResponseHeaders, arraysize(kGetResponseHeaders))) {}
-  ~LogGetResponseHandler() override {}
-
-  // URLRequestInterceptor implementation:
-  net::URLRequestJob* MaybeInterceptRequest(
-      net::URLRequest* request,
-      net::NetworkDelegate* network_delegate) const override {
-    EXPECT_EQ(expected_url_, request->url());
-
-    LogFetchTestJob* job = new LogFetchTestJob(
-        response_body_, response_headers_, request, network_delegate);
-    job->set_async_io(async_io_);
-    return job;
-  }
-
-  void set_response_body(const std::string& response_body) {
-    response_body_ = response_body;
-  }
-
-  void set_response_headers(const std::string& response_headers) {
-    response_headers_ = response_headers;
-  }
-
-  void set_async_io(bool async_io) { async_io_ = async_io; }
-
-  void set_expected_url(const GURL& url) { expected_url_ = url; }
-
- private:
-  bool async_io_;
-  std::string response_body_;
-  std::string response_headers_;
-
-  // Stored for test body to assert on
-  GURL expected_url_;
-
-  DISALLOW_COPY_AND_ASSIGN(LogGetResponseHandler);
-};
-
-enum InterceptedResultType {
-  NOTHING,
-  FAILURE,
-  STH_FETCH,
-  CONSISTENCY_PROOF_FETCH
-};
-
-class RecordFetchCallbackInvocations {
- public:
-  RecordFetchCallbackInvocations(bool expect_success)
-      : expect_success_(expect_success),
-        net_error_(net::OK),
-        http_response_code_(-1),
-        request_type_(NOTHING) {}
-
-  void STHFetched(base::Closure quit_closure,
-                  const std::string& log_id,
-                  const net::ct::SignedTreeHead& sth) {
-    ASSERT_TRUE(expect_success_);
-    ASSERT_EQ(NOTHING, request_type_);
-    request_type_ = STH_FETCH;
-    sth_ = sth;
-    log_id_ = log_id;
-    quit_closure.Run();
-  }
-
-  void ConsistencyProofFetched(
-      base::Closure quit_closure,
-      const std::string& log_id,
-      const std::vector<std::string>& consistency_proof) {
-    ASSERT_TRUE(expect_success_);
-    ASSERT_EQ(NOTHING, request_type_);
-    request_type_ = CONSISTENCY_PROOF_FETCH;
-    consistency_proof_.assign(consistency_proof.begin(),
-                              consistency_proof.end());
-    log_id_ = log_id;
-    quit_closure.Run();
-  }
-
-  void FetchingFailed(base::Closure quit_closure,
-                      const std::string& log_id,
-                      int net_error,
-                      int http_response_code) {
-    ASSERT_FALSE(expect_success_);
-    ASSERT_EQ(NOTHING, request_type_);
-    request_type_ = FAILURE;
-    net_error_ = net_error;
-    http_response_code_ = http_response_code;
-    if (net_error_ == net::OK) {
-      EXPECT_NE(net::HTTP_OK, http_response_code_);
-    }
-
-    quit_closure.Run();
-  }
-
-  InterceptedResultType intercepted_result_type() const {
-    return request_type_;
-  }
-
-  int net_error() const { return net_error_; }
-
-  int http_response_code() const { return http_response_code_; }
-
-  const net::ct::SignedTreeHead& intercepted_sth() const { return sth_; }
-
-  const std::string& intercepted_log_id() const { return log_id_; }
-
-  const std::vector<std::string>& intercepted_proof() const {
-    return consistency_proof_;
-  }
-
- private:
-  const bool expect_success_;
-  int net_error_;
-  int http_response_code_;
-  InterceptedResultType request_type_;
-  net::ct::SignedTreeHead sth_;
-  std::string log_id_;
-  std::vector<std::string> consistency_proof_;
-};
-
-class LogProofFetcherTest : public ::testing::Test {
- public:
-  LogProofFetcherTest()
-      : log_url_(base::StringPrintf("%s://%s/%s/",
-                                    kLogSchema,
-                                    kLogHost,
-                                    kLogPathPrefix)) {
-    std::unique_ptr<LogGetResponseHandler> handler(new LogGetResponseHandler());
-    handler_ = handler.get();
-
-    net::URLRequestFilter::GetInstance()->AddHostnameInterceptor(
-        kLogSchema, kLogHost, std::move(handler));
-
-    fetcher_.reset(new LogProofFetcher(&context_));
-  }
-
-  ~LogProofFetcherTest() override {
-    net::URLRequestFilter::GetInstance()->RemoveHostnameHandler(kLogSchema,
-                                                                kLogHost);
-  }
-
- protected:
-  void SetValidSTHJSONResponse() {
-    std::string sth_json_reply_data = net::ct::GetSampleSTHAsJson();
-    handler_->set_response_body(sth_json_reply_data);
-    handler_->set_expected_url(log_url_.Resolve("ct/v1/get-sth"));
-  }
-
-  void RunFetcherWithCallback(RecordFetchCallbackInvocations* callback) {
-    fetcher_->FetchSignedTreeHead(
-        log_url_, kLogID,
-        base::Bind(&RecordFetchCallbackInvocations::STHFetched,
-                   base::Unretained(callback), run_loop_.QuitClosure()),
-        base::Bind(&RecordFetchCallbackInvocations::FetchingFailed,
-                   base::Unretained(callback), run_loop_.QuitClosure()));
-    run_loop_.Run();
-  }
-
-  void RunGetConsistencyFetcherWithCallback(
-      RecordFetchCallbackInvocations* callback) {
-    const uint64_t kOldTree = 5;
-    const uint64_t kNewTree = 8;
-    handler_->set_expected_url(log_url_.Resolve(base::StringPrintf(
-        "ct/v1/get-sth-consistency?first=%" PRIu64 "&second=%" PRIu64, kOldTree,
-        kNewTree)));
-    fetcher_->FetchConsistencyProof(
-        log_url_, kLogID, kOldTree, kNewTree,
-        base::Bind(&RecordFetchCallbackInvocations::ConsistencyProofFetched,
-                   base::Unretained(callback), run_loop_.QuitClosure()),
-        base::Bind(&RecordFetchCallbackInvocations::FetchingFailed,
-                   base::Unretained(callback), run_loop_.QuitClosure()));
-    run_loop_.Run();
-  }
-
-  void VerifyReceivedSTH(const std::string& log_id,
-                         const net::ct::SignedTreeHead& sth) {
-    net::ct::SignedTreeHead expected_sth;
-    net::ct::GetSampleSignedTreeHead(&expected_sth);
-
-    EXPECT_EQ(kLogID, log_id);
-    EXPECT_EQ(expected_sth.version, sth.version);
-    EXPECT_EQ(expected_sth.timestamp, sth.timestamp);
-    EXPECT_EQ(expected_sth.tree_size, sth.tree_size);
-    EXPECT_STREQ(expected_sth.sha256_root_hash, sth.sha256_root_hash);
-    EXPECT_EQ(expected_sth.signature.hash_algorithm,
-              sth.signature.hash_algorithm);
-    EXPECT_EQ(expected_sth.signature.signature_algorithm,
-              sth.signature.signature_algorithm);
-    EXPECT_EQ(expected_sth.signature.signature_data,
-              sth.signature.signature_data);
-    EXPECT_EQ(kLogID, sth.log_id);
-  }
-
-  void VerifyConsistencyProof(
-      const std::string& log_id,
-      const std::vector<std::string>& consistency_proof) {
-    EXPECT_EQ(kLogID, log_id);
-    EXPECT_EQ(kDummyConsistencyProofNumNodes, consistency_proof.size());
-    for (uint64_t i = 0; i < kDummyConsistencyProofNumNodes; ++i) {
-      EXPECT_EQ(GetDummyConsistencyProofNode(i), consistency_proof[i])
-          << " node: " << i;
-    }
-  }
-
-  // The |message_loop_|, while seemingly unused, is necessary
-  // for URL request interception. That is the message loop that
-  // will be used by the RunLoop.
-  base::MessageLoopForIO message_loop_;
-  base::RunLoop run_loop_;
-  net::TestURLRequestContext context_;
-  safe_json::TestingJsonParser::ScopedFactoryOverride factory_override_;
-  std::unique_ptr<LogProofFetcher> fetcher_;
-  const GURL log_url_;
-  LogGetResponseHandler* handler_;
-};
-
-TEST_F(LogProofFetcherTest, TestValidGetReply) {
-  SetValidSTHJSONResponse();
-
-  RecordFetchCallbackInvocations callback(true);
-
-  RunFetcherWithCallback(&callback);
-
-  ASSERT_EQ(STH_FETCH, callback.intercepted_result_type());
-  VerifyReceivedSTH(callback.intercepted_log_id(), callback.intercepted_sth());
-}
-
-TEST_F(LogProofFetcherTest, TestValidGetReplyAsyncIO) {
-  SetValidSTHJSONResponse();
-  handler_->set_async_io(true);
-
-  RecordFetchCallbackInvocations callback(true);
-  RunFetcherWithCallback(&callback);
-
-  ASSERT_EQ(STH_FETCH, callback.intercepted_result_type());
-  VerifyReceivedSTH(callback.intercepted_log_id(), callback.intercepted_sth());
-}
-
-TEST_F(LogProofFetcherTest, TestInvalidGetReplyIncompleteJSON) {
-  std::string sth_json_reply_data = net::ct::CreateSignedTreeHeadJsonString(
-      21 /* tree_size */, 123456u /* timestamp */, std::string(),
-      std::string());
-  handler_->set_response_body(sth_json_reply_data);
-  handler_->set_expected_url(log_url_.Resolve("ct/v1/get-sth"));
-
-  RecordFetchCallbackInvocations callback(false);
-  RunFetcherWithCallback(&callback);
-
-  ASSERT_EQ(FAILURE, callback.intercepted_result_type());
-  EXPECT_EQ(net::ERR_CT_STH_INCOMPLETE, callback.net_error());
-  EXPECT_EQ(net::HTTP_OK, callback.http_response_code());
-}
-
-TEST_F(LogProofFetcherTest, TestInvalidGetReplyInvalidJSON) {
-  std::string sth_json_reply_data = "{\"tree_size\":21,\"timestamp\":}";
-  handler_->set_response_body(sth_json_reply_data);
-  handler_->set_expected_url(log_url_.Resolve("ct/v1/get-sth"));
-
-  RecordFetchCallbackInvocations callback(false);
-  RunFetcherWithCallback(&callback);
-
-  ASSERT_EQ(FAILURE, callback.intercepted_result_type());
-  EXPECT_EQ(net::ERR_CT_STH_PARSING_FAILED, callback.net_error());
-  EXPECT_EQ(net::HTTP_OK, callback.http_response_code());
-}
-
-TEST_F(LogProofFetcherTest, TestLogReplyIsTooLong) {
-  std::string sth_json_reply_data = net::ct::GetSampleSTHAsJson();
-  // Add kMaxLogResponseSizeInBytes to make sure the response is too big.
-  sth_json_reply_data.append(
-      std::string(LogProofFetcher::kMaxLogResponseSizeInBytes, ' '));
-  handler_->set_response_body(sth_json_reply_data);
-  handler_->set_expected_url(log_url_.Resolve("ct/v1/get-sth"));
-
-  RecordFetchCallbackInvocations callback(false);
-  RunFetcherWithCallback(&callback);
-
-  ASSERT_EQ(FAILURE, callback.intercepted_result_type());
-  EXPECT_EQ(net::ERR_FILE_TOO_BIG, callback.net_error());
-  EXPECT_EQ(net::HTTP_OK, callback.http_response_code());
-}
-
-TEST_F(LogProofFetcherTest, TestLogReplyIsExactlyMaxSize) {
-  std::string sth_json_reply_data = net::ct::GetSampleSTHAsJson();
-  // Extend the reply to be exactly kMaxLogResponseSizeInBytes.
-  sth_json_reply_data.append(std::string(
-      LogProofFetcher::kMaxLogResponseSizeInBytes - sth_json_reply_data.size(),
-      ' '));
-  handler_->set_response_body(sth_json_reply_data);
-  handler_->set_expected_url(log_url_.Resolve("ct/v1/get-sth"));
-
-  RecordFetchCallbackInvocations callback(true);
-  RunFetcherWithCallback(&callback);
-
-  ASSERT_EQ(STH_FETCH, callback.intercepted_result_type());
-  VerifyReceivedSTH(callback.intercepted_log_id(), callback.intercepted_sth());
-}
-
-TEST_F(LogProofFetcherTest, TestLogRepliesWithHttpError) {
-  handler_->set_response_headers(std::string(
-      kGetResponseNotFoundHeaders, arraysize(kGetResponseNotFoundHeaders)));
-  handler_->set_expected_url(log_url_.Resolve("ct/v1/get-sth"));
-
-  RecordFetchCallbackInvocations callback(false);
-  RunFetcherWithCallback(&callback);
-
-  ASSERT_EQ(FAILURE, callback.intercepted_result_type());
-  EXPECT_EQ(net::OK, callback.net_error());
-  EXPECT_EQ(net::HTTP_NOT_FOUND, callback.http_response_code());
-}
-
-TEST_F(LogProofFetcherTest, TestValidGetConsistencyValidReply) {
-  std::vector<std::string> proof;
-  for (uint64_t i = 0; i < kDummyConsistencyProofNumNodes; ++i)
-    proof.push_back(GetDummyConsistencyProofNode(i));
-
-  std::string consistency_proof_reply_data =
-      net::ct::CreateConsistencyProofJsonString(proof);
-  handler_->set_response_body(consistency_proof_reply_data);
-
-  RecordFetchCallbackInvocations callback(true);
-  RunGetConsistencyFetcherWithCallback(&callback);
-
-  ASSERT_EQ(CONSISTENCY_PROOF_FETCH, callback.intercepted_result_type());
-  VerifyConsistencyProof(callback.intercepted_log_id(),
-                         callback.intercepted_proof());
-}
-
-TEST_F(LogProofFetcherTest, TestInvalidGetConsistencyReplyInvalidJSON) {
-  std::string consistency_proof_reply_data = "{\"consistency\": [1,2]}";
-  handler_->set_response_body(consistency_proof_reply_data);
-
-  RecordFetchCallbackInvocations callback(false);
-  RunGetConsistencyFetcherWithCallback(&callback);
-
-  ASSERT_EQ(FAILURE, callback.intercepted_result_type());
-  EXPECT_EQ(net::ERR_CT_CONSISTENCY_PROOF_PARSING_FAILED, callback.net_error());
-  EXPECT_EQ(net::HTTP_OK, callback.http_response_code());
-}
-
-}  // namespace
-
-}  // namespace certificate_transparency

diff --git a/components/chrome_cleaner/public/interfaces/BUILD.gn b/components/chrome_cleaner/public/interfaces/BUILD.gn
index 16089838..4a2fb48 100644
--- a/components/chrome_cleaner/public/interfaces/BUILD.gn
+++ b/components/chrome_cleaner/public/interfaces/BUILD.gn

@@ -11,4 +11,6 @@
   deps = [
     "//mojo/common:common_custom_types",
   ]
+
+  use_once_callback = true
 }

diff --git a/components/discardable_memory/public/interfaces/BUILD.gn b/components/discardable_memory/public/interfaces/BUILD.gn
index 0ce0a31..ad06073 100644
--- a/components/discardable_memory/public/interfaces/BUILD.gn
+++ b/components/discardable_memory/public/interfaces/BUILD.gn

@@ -14,4 +14,6 @@
     get_path_info("../../../..", "abspath"),
     "//mojo/services",
   ]
+
+  use_once_callback = true
 }

diff --git a/components/discardable_memory/service/discardable_shared_memory_manager.cc b/components/discardable_memory/service/discardable_shared_memory_manager.cc
index c2fd55b7..0913399d 100644
--- a/components/discardable_memory/service/discardable_shared_memory_manager.cc
+++ b/components/discardable_memory/service/discardable_shared_memory_manager.cc

@@ -80,13 +80,13 @@
   void AllocateLockedDiscardableSharedMemory(
       uint32_t size,
       int32_t id,
-      const AllocateLockedDiscardableSharedMemoryCallback& callback) override {
+      AllocateLockedDiscardableSharedMemoryCallback callback) override {
     base::SharedMemoryHandle handle;
     manager_->AllocateLockedDiscardableSharedMemoryForClient(client_id_, size,
                                                              id, &handle);
     mojo::ScopedSharedBufferHandle memory =
         mojo::WrapSharedMemoryHandle(handle, size, false /* read_only */);
-    return callback.Run(std::move(memory));
+    std::move(callback).Run(std::move(memory));
   }
 
   void DeletedDiscardableSharedMemory(int32_t id) override {

diff --git a/components/navigation_metrics/navigation_metrics.cc b/components/navigation_metrics/navigation_metrics.cc
index be41ff9..78df324 100644
--- a/components/navigation_metrics/navigation_metrics.cc
+++ b/components/navigation_metrics/navigation_metrics.cc

@@ -50,7 +50,7 @@
 namespace navigation_metrics {
 
 void RecordMainFrameNavigation(const GURL& url,
-                               bool is_in_page,
+                               bool is_same_document,
                                bool is_off_the_record) {
   Scheme scheme = SCHEME_UNKNOWN;
   for (int i = 1; i < SCHEME_MAX; ++i) {
@@ -61,7 +61,7 @@
   }
 
   UMA_HISTOGRAM_ENUMERATION("Navigation.MainFrameScheme", scheme, SCHEME_MAX);
-  if (!is_in_page) {
+  if (!is_same_document) {
     UMA_HISTOGRAM_ENUMERATION("Navigation.MainFrameSchemeDifferentPage", scheme,
                               SCHEME_MAX);
   }
@@ -69,7 +69,7 @@
   if (is_off_the_record) {
     UMA_HISTOGRAM_ENUMERATION("Navigation.MainFrameSchemeOTR", scheme,
                               SCHEME_MAX);
-    if (!is_in_page) {
+    if (!is_same_document) {
       UMA_HISTOGRAM_ENUMERATION("Navigation.MainFrameSchemeDifferentPageOTR",
                                 scheme, SCHEME_MAX);
     }

diff --git a/components/navigation_metrics/navigation_metrics.h b/components/navigation_metrics/navigation_metrics.h
index febc8b8..1475d6e18 100644
--- a/components/navigation_metrics/navigation_metrics.h
+++ b/components/navigation_metrics/navigation_metrics.h

@@ -10,7 +10,7 @@
 namespace navigation_metrics {
 
 void RecordMainFrameNavigation(const GURL& url,
-                               bool is_in_page,
+                               bool is_same_document,
                                bool is_off_the_record);
 
 }  // namespace navigation_metrics

diff --git a/components/password_manager/content/browser/credential_manager_impl.cc b/components/password_manager/content/browser/credential_manager_impl.cc
index 14261cc..2b93023 100644
--- a/components/password_manager/content/browser/credential_manager_impl.cc
+++ b/components/password_manager/content/browser/credential_manager_impl.cc

@@ -30,9 +30,9 @@
 
 namespace {
 
-void RunMojoGetCallback(const mojom::CredentialManager::GetCallback& callback,
+void RunMojoGetCallback(mojom::CredentialManager::GetCallback callback,
                         const CredentialInfo& info) {
-  callback.Run(mojom::CredentialManagerError::SUCCESS, info);
+  std::move(callback).Run(mojom::CredentialManagerError::SUCCESS, info);
 }
 
 }  // namespace
@@ -55,7 +55,7 @@
 }
 
 void CredentialManagerImpl::Store(const CredentialInfo& credential,
-                                  const StoreCallback& callback) {
+                                  StoreCallback callback) {
   DCHECK_NE(CredentialType::CREDENTIAL_TYPE_EMPTY, credential.type);
 
   if (password_manager_util::IsLoggingActive(client_)) {
@@ -65,7 +65,7 @@
   }
 
   // Send acknowledge response back.
-  callback.Run();
+  std::move(callback).Run();
 
   if (!client_->IsSavingAndFillingEnabledForCurrentPage() ||
       !client_->OnCredentialManagerUsed())
@@ -126,13 +126,13 @@
 }
 
 void CredentialManagerImpl::RequireUserMediation(
-    const RequireUserMediationCallback& callback) {
+    RequireUserMediationCallback callback) {
   if (password_manager_util::IsLoggingActive(client_)) {
     CredentialManagerLogger(client_->GetLogManager())
         .LogRequireUserMediation(web_contents()->GetLastCommittedURL());
   }
   // Send acknowledge response back.
-  callback.Run();
+  std::move(callback).Run();
 
   PasswordStore* store = GetPasswordStore();
   if (!store || !client_->IsSavingAndFillingEnabledForCurrentPage() ||
@@ -149,7 +149,7 @@
 void CredentialManagerImpl::Get(bool zero_click_only,
                                 bool include_passwords,
                                 const std::vector<GURL>& federations,
-                                const GetCallback& callback) {
+                                GetCallback callback) {
   using metrics_util::LogCredentialManagerGetResult;
   metrics_util::CredentialManagerGetMediation mediation_status =
       zero_click_only ? metrics_util::CREDENTIAL_MANAGER_GET_UNMEDIATED
@@ -162,10 +162,11 @@
   }
   if (pending_request_ || !store) {
     // Callback error.
-    callback.Run(pending_request_
-                     ? mojom::CredentialManagerError::PENDINGREQUEST
-                     : mojom::CredentialManagerError::PASSWORDSTOREUNAVAILABLE,
-                 base::nullopt);
+    std::move(callback).Run(
+        pending_request_
+            ? mojom::CredentialManagerError::PENDINGREQUEST
+            : mojom::CredentialManagerError::PASSWORDSTOREUNAVAILABLE,
+        base::nullopt);
     LogCredentialManagerGetResult(metrics_util::CREDENTIAL_MANAGER_GET_REJECTED,
                                   mediation_status);
     return;
@@ -175,7 +176,8 @@
   // page is being prerendered.
   if (!client_->IsFillingEnabledForCurrentPage() ||
       !client_->OnCredentialManagerUsed()) {
-    callback.Run(mojom::CredentialManagerError::SUCCESS, CredentialInfo());
+    std::move(callback).Run(mojom::CredentialManagerError::SUCCESS,
+                            CredentialInfo());
     LogCredentialManagerGetResult(metrics_util::CREDENTIAL_MANAGER_GET_NONE,
                                   mediation_status);
     return;
@@ -183,7 +185,8 @@
   // Return an empty credential if zero-click is required but disabled.
   if (zero_click_only && !IsZeroClickAllowed()) {
     // Callback with empty credential info.
-    callback.Run(mojom::CredentialManagerError::SUCCESS, CredentialInfo());
+    std::move(callback).Run(mojom::CredentialManagerError::SUCCESS,
+                            CredentialInfo());
     LogCredentialManagerGetResult(
         metrics_util::CREDENTIAL_MANAGER_GET_NONE_ZERO_CLICK_OFF,
         mediation_status);
@@ -191,8 +194,8 @@
   }
 
   pending_request_.reset(new CredentialManagerPendingRequestTask(
-      this, base::Bind(&RunMojoGetCallback, callback), zero_click_only,
-      include_passwords, federations));
+      this, base::Bind(&RunMojoGetCallback, base::Passed(&callback)),
+      zero_click_only, include_passwords, federations));
   // This will result in a callback to
   // PendingRequestTask::OnGetPasswordStoreResults().
   GetPasswordStore()->GetLogins(GetSynthesizedFormForOrigin(),

diff --git a/components/password_manager/content/browser/credential_manager_impl.h b/components/password_manager/content/browser/credential_manager_impl.h
index 3b3f5cd97..9694627d 100644
--- a/components/password_manager/content/browser/credential_manager_impl.h
+++ b/components/password_manager/content/browser/credential_manager_impl.h

@@ -50,14 +50,12 @@
   void BindRequest(mojom::CredentialManagerRequest request);
 
   // mojom::CredentialManager methods:
-  void Store(const CredentialInfo& credential,
-             const StoreCallback& callback) override;
-  void RequireUserMediation(
-      const RequireUserMediationCallback& callback) override;
+  void Store(const CredentialInfo& credential, StoreCallback callback) override;
+  void RequireUserMediation(RequireUserMediationCallback callback) override;
   void Get(bool zero_click_only,
            bool include_passwords,
            const std::vector<GURL>& federations,
-           const GetCallback& callback) override;
+           GetCallback callback) override;
 
   // CredentialManagerPendingRequestTaskDelegate:
   bool IsZeroClickAllowed() const override;

diff --git a/components/password_manager/content/browser/credential_manager_impl_unittest.cc b/components/password_manager/content/browser/credential_manager_impl_unittest.cc
index 9563fc2..e47c595 100644
--- a/components/password_manager/content/browser/credential_manager_impl_unittest.cc
+++ b/components/password_manager/content/browser/credential_manager_impl_unittest.cc

@@ -8,6 +8,7 @@
 
 #include <string>
 #include <tuple>
+#include <utility>
 #include <vector>
 
 #include "base/bind.h"
@@ -350,21 +351,21 @@
 
   // Helpers for testing CredentialManagerImpl methods.
   void CallStore(const CredentialInfo& info,
-                 const CredentialManagerImpl::StoreCallback& callback) {
-    cm_service_impl_->Store(info, callback);
+                 CredentialManagerImpl::StoreCallback callback) {
+    cm_service_impl_->Store(info, std::move(callback));
   }
 
   void CallRequireUserMediation(
-      const CredentialManagerImpl::RequireUserMediationCallback& callback) {
-    cm_service_impl_->RequireUserMediation(callback);
+      CredentialManagerImpl::RequireUserMediationCallback callback) {
+    cm_service_impl_->RequireUserMediation(std::move(callback));
   }
 
   void CallGet(bool zero_click_only,
                bool include_passwords,
                const std::vector<GURL>& federations,
-               const CredentialManagerImpl::GetCallback& callback) {
+               CredentialManagerImpl::GetCallback callback) {
     cm_service_impl_->Get(zero_click_only, include_passwords, federations,
-                          callback);
+                          std::move(callback));
   }
 
  protected:

diff --git a/components/password_manager/content/common/BUILD.gn b/components/password_manager/content/common/BUILD.gn
index 0fafcea..6b5ad0d8b 100644
--- a/components/password_manager/content/common/BUILD.gn
+++ b/components/password_manager/content/common/BUILD.gn

@@ -13,4 +13,6 @@
     "//url/mojo:url_mojom_gurl",
     "//url/mojo:url_mojom_origin",
   ]
+
+  use_once_callback = true
 }

diff --git a/components/password_manager/content/renderer/credential_manager_client_browsertest.cc b/components/password_manager/content/renderer/credential_manager_client_browsertest.cc
index 8b25db6..63ebc533 100644
--- a/components/password_manager/content/renderer/credential_manager_client_browsertest.cc
+++ b/components/password_manager/content/renderer/credential_manager_client_browsertest.cc

@@ -8,6 +8,7 @@
 
 #include <memory>
 #include <tuple>
+#include <utility>
 
 #include "base/location.h"
 #include "base/run_loop.h"
@@ -44,30 +45,31 @@
  private:
   // mojom::CredentialManager methods:
   void Store(const CredentialInfo& credential,
-             const StoreCallback& callback) override {
-    callback.Run();
+             StoreCallback callback) override {
+    std::move(callback).Run();
   }
 
-  void RequireUserMediation(
-      const RequireUserMediationCallback& callback) override {
-    callback.Run();
+  void RequireUserMediation(RequireUserMediationCallback callback) override {
+    std::move(callback).Run();
   }
 
   void Get(bool zero_click_only,
            bool include_passwords,
            const std::vector<GURL>& federations,
-           const GetCallback& callback) override {
+           GetCallback callback) override {
     const std::string& url = federations[0].spec();
 
     if (url == kTestCredentialPassword) {
       CredentialInfo info;
       info.type = CredentialType::CREDENTIAL_TYPE_PASSWORD;
-      callback.Run(mojom::CredentialManagerError::SUCCESS, info);
+      std::move(callback).Run(mojom::CredentialManagerError::SUCCESS, info);
     } else if (url == kTestCredentialEmpty) {
-      callback.Run(mojom::CredentialManagerError::SUCCESS, CredentialInfo());
+      std::move(callback).Run(mojom::CredentialManagerError::SUCCESS,
+                              CredentialInfo());
     } else if (url == kTestCredentialReject) {
-      callback.Run(mojom::CredentialManagerError::PASSWORDSTOREUNAVAILABLE,
-                   base::nullopt);
+      std::move(callback).Run(
+          mojom::CredentialManagerError::PASSWORDSTOREUNAVAILABLE,
+          base::nullopt);
     }
   }
 

diff --git a/components/security_interstitials/content/security_interstitial_controller_client.cc b/components/security_interstitials/content/security_interstitial_controller_client.cc
index 150505e5..a40f0d43 100644
--- a/components/security_interstitials/content/security_interstitial_controller_client.cc
+++ b/components/security_interstitials/content/security_interstitial_controller_client.cc

@@ -46,6 +46,10 @@
   interstitial_page_->DontProceed();
 }
 
+bool SecurityInterstitialControllerClient::CanGoBack() {
+  return web_contents_->GetController().CanGoBack();
+}
+
 void SecurityInterstitialControllerClient::GoBackAfterNavigationCommitted() {
   // If the offending entry has committed, go back or to a safe page without
   // closing the error page. This error page will be closed when the new page

diff --git a/components/security_interstitials/content/security_interstitial_controller_client.h b/components/security_interstitials/content/security_interstitial_controller_client.h
index 1d70720..f10d26b 100644
--- a/components/security_interstitials/content/security_interstitial_controller_client.h
+++ b/components/security_interstitials/content/security_interstitial_controller_client.h

@@ -40,6 +40,7 @@
 
   // security_interstitials::ControllerClient overrides.
   void GoBack() override;
+  bool CanGoBack() override;
   void GoBackAfterNavigationCommitted() override;
   void Proceed() override;
   void Reload() override;
@@ -49,7 +50,7 @@
   bool CanLaunchDateAndTimeSettings() override;
   void LaunchDateAndTimeSettings() override;
 
-protected:
+ protected:
   // security_interstitials::ControllerClient overrides.
   const std::string GetExtendedReportingPrefName() const override;
   content::WebContents* web_contents_;

diff --git a/components/security_interstitials/core/browser/resources/interstitial_v2.js b/components/security_interstitials/core/browser/resources/interstitial_v2.js
index 4fa48ea..88ad830e 100644
--- a/components/security_interstitials/core/browser/resources/interstitial_v2.js
+++ b/components/security_interstitials/core/browser/resources/interstitial_v2.js

@@ -102,8 +102,7 @@
   var ssl = interstitialType == 'SSL';
   var captivePortal = interstitialType == 'CAPTIVE_PORTAL';
   var badClock = ssl && loadTimeData.getBoolean('bad_clock');
-  var hidePrimaryButton = badClock && loadTimeData.getBoolean(
-      'hide_primary_button');
+  var hidePrimaryButton = loadTimeData.getBoolean('hide_primary_button');
 
   if (ssl) {
     $('body').classList.add(badClock ? 'bad-clock' : 'ssl');

diff --git a/components/security_interstitials/core/controller_client.h b/components/security_interstitials/core/controller_client.h
index 33d9cec..613c6bc9 100644
--- a/components/security_interstitials/core/controller_client.h
+++ b/components/security_interstitials/core/controller_client.h

@@ -71,6 +71,8 @@
   // Close the error and go back to the previous page. This applies to
   // situations where navigation is blocked before committing.
   virtual void GoBack() = 0;
+  // Whether it is possible to go 'Back to safety'.
+  virtual bool CanGoBack() = 0;
 
   // If the offending entry has committed, go back or to a safe page without
   // closing the error page. This error page will be closed when the new page

diff --git a/components/security_interstitials/core/safe_browsing_error_ui.cc b/components/security_interstitials/core/safe_browsing_error_ui.cc
index 38566d6..7b2ad57 100644
--- a/components/security_interstitials/core/safe_browsing_error_ui.cc
+++ b/components/security_interstitials/core/safe_browsing_error_ui.cc

@@ -95,6 +95,7 @@
       l10n_util::GetStringUTF16(IDS_SAFEBROWSING_OVERRIDABLE_SAFETY_BUTTON));
   load_time_data->SetBoolean("overridable",
                              !display_options_.is_proceed_anyway_disabled);
+  load_time_data->SetBoolean("hide_primary_button", !controller_->CanGoBack());
 
   switch (interstitial_reason_) {
     case SB_REASON_MALWARE:

diff --git a/components/security_interstitials/core/ssl_error_ui.cc b/components/security_interstitials/core/ssl_error_ui.cc
index e438bc6..1cde123 100644
--- a/components/security_interstitials/core/ssl_error_ui.cc
+++ b/components/security_interstitials/core/ssl_error_ui.cc

@@ -69,6 +69,7 @@
 
   // Shared values for both the overridable and non-overridable versions.
   load_time_data->SetBoolean("bad_clock", false);
+  load_time_data->SetBoolean("hide_primary_button", false);
   load_time_data->SetString("tabTitle",
                             l10n_util::GetStringUTF16(IDS_SSL_V2_TITLE));
   load_time_data->SetString("heading",
@@ -95,6 +96,7 @@
       ssl_info_.cert.get(), request_url_);
 
   load_time_data->SetBoolean("overridable", true);
+  load_time_data->SetBoolean("hide_primary_button", false);
   load_time_data->SetString("explanationParagraph", error_info.details());
   load_time_data->SetString(
       "primaryButtonText",
@@ -113,6 +115,7 @@
       ssl_errors::ErrorInfo::NetErrorToErrorType(cert_error_);
 
   load_time_data->SetBoolean("overridable", false);
+  load_time_data->SetBoolean("hide_primary_button", false);
   load_time_data->SetString(
       "explanationParagraph",
       l10n_util::GetStringFUTF16(IDS_SSL_NONOVERRIDABLE_MORE, url));

diff --git a/components/sync/model/model_type_store.cc b/components/sync/model/model_type_store.cc
index fc8cb80..6f14ade 100644
--- a/components/sync/model/model_type_store.cc
+++ b/components/sync/model/model_type_store.cc

@@ -21,9 +21,8 @@
 void ModelTypeStore::CreateStore(
     ModelType type,
     const std::string& path,
-    scoped_refptr<base::SequencedTaskRunner> blocking_task_runner,
     const InitCallback& callback) {
-  ModelTypeStoreImpl::CreateStore(type, path, blocking_task_runner, callback);
+  ModelTypeStoreImpl::CreateStore(type, path, callback);
 }
 
 ModelTypeStore::~ModelTypeStore() {}

diff --git a/components/sync/model/model_type_store.h b/components/sync/model/model_type_store.h
index d3ad346e..d52d2ef 100644
--- a/components/sync/model/model_type_store.h
+++ b/components/sync/model/model_type_store.h

@@ -17,10 +17,6 @@
 #include "components/sync/model/metadata_change_list.h"
 #include "components/sync/model/model_error.h"
 
-namespace base {
-class SequencedTaskRunner;
-}  // namespace base
-
 namespace syncer {
 
 // ModelTypeStore is leveldb backed store for model type's data, metadata and
@@ -124,24 +120,14 @@
       base::Callback<void(base::Optional<ModelError> error,
                           std::unique_ptr<MetadataBatch> metadata_batch)>;
 
-  // CreateStore takes |path| and |blocking_task_runner|. Here is how to get
-  // task runner in production code:
-  //
-  // base::SequencedWorkerPool* worker_pool =
-  //     content::BrowserThread::GetBlockingPool();
-  // scoped_refptr<base::SequencedTaskRunner> blocking_task_runner(
-  //     worker_pool->GetSequencedTaskRunnerWithShutdownBehavior(
-  //         worker_pool->GetNamedSequenceToken(path),
-  //         base::SequencedWorkerPool::SKIP_ON_SHUTDOWN));
-  //
-  // In test get task runner from MessageLoop::task_runner().
+  // CreateStore takes |path|, and will run blocking calls on a task runner
+  // scoped to the given path. Tests likely don't want to use this method.
   static void CreateStore(
       ModelType type,
       const std::string& path,
-      scoped_refptr<base::SequencedTaskRunner> blocking_task_runner,
       const InitCallback& callback);
-  // Creates store object backed by in-memory leveldb database. It is used in
-  // tests.
+  // Creates store object backed by in-memory leveldb database, gets its task
+  // runner from MessageLoop::task_runner(), and should only be used in tests.
   static void CreateInMemoryStoreForTest(ModelType type,
                                          const InitCallback& callback);
 

diff --git a/components/sync/model_impl/model_type_store_backend.cc b/components/sync/model_impl/model_type_store_backend.cc
index a277b82f..a1745312 100644
--- a/components/sync/model_impl/model_type_store_backend.cc
+++ b/components/sync/model_impl/model_type_store_backend.cc

@@ -76,8 +76,7 @@
   DISALLOW_COPY_AND_ASSIGN(BackendMap);
 };
 
-base::LazyInstance<BackendMap>::DestructorAtExit backend_map =
-    LAZY_INSTANCE_INITIALIZER;
+base::LazyInstance<BackendMap>::Leaky backend_map = LAZY_INSTANCE_INITIALIZER;
 
 scoped_refptr<ModelTypeStoreBackend> BackendMap::GetBackend(
     const std::string& path) const {

diff --git a/components/sync/model_impl/model_type_store_impl.cc b/components/sync/model_impl/model_type_store_impl.cc
index e4d7fcf..2e94006 100644
--- a/components/sync/model_impl/model_type_store_impl.cc
+++ b/components/sync/model_impl/model_type_store_impl.cc

@@ -4,14 +4,18 @@
 
 #include "components/sync/model_impl/model_type_store_impl.h"
 
+#include <map>
 #include <utility>
 
 #include "base/bind.h"
+#include "base/lazy_instance.h"
 #include "base/location.h"
 #include "base/logging.h"
 #include "base/memory/ptr_util.h"
 #include "base/optional.h"
 #include "base/task_runner_util.h"
+#include "base/task_scheduler/post_task.h"
+#include "base/task_scheduler/task_traits.h"
 #include "base/threading/thread_task_runner_handle.h"
 #include "components/sync/model/model_error.h"
 #include "components/sync/model_impl/model_type_store_backend.h"
@@ -50,6 +54,41 @@
   return std::string(GetModelTypeRootTag(type)) + kGlobalMetadataKey;
 }
 
+// Holds a one to one mapping between profile path and SequencedTaskRunner. This
+// class is expected to be accessed on any thread, and uses a lock to guarantee
+// thread safety. The task runners are held onto by scoped_refptrs, and since
+// this class is leaky, none of these task runners are ever destroyed.
+class TaskRunnerMap {
+ public:
+  TaskRunnerMap() = default;
+
+  scoped_refptr<base::SequencedTaskRunner> GetOrCreateTaskRunner(
+      const std::string& path) {
+    base::AutoLock scoped_lock(lock_);
+    auto iter = task_runner_map_.find(path);
+    if (iter == task_runner_map_.end()) {
+      scoped_refptr<base::SequencedTaskRunner> task_runner =
+          CreateSequencedTaskRunnerWithTraits(
+              base::TaskTraits().MayBlock().WithShutdownBehavior(
+                  base::TaskShutdownBehavior::SKIP_ON_SHUTDOWN));
+      task_runner_map_[path] = task_runner;
+      return task_runner;
+    } else {
+      return iter->second;
+    }
+  }
+
+ private:
+  mutable base::Lock lock_;
+  std::map<std::string, scoped_refptr<base::SequencedTaskRunner>>
+      task_runner_map_;
+
+  DISALLOW_COPY_AND_ASSIGN(TaskRunnerMap);
+};
+
+base::LazyInstance<TaskRunnerMap>::Leaky task_runner_map_singleton_ =
+    LAZY_INSTANCE_INITIALIZER;
+
 }  // namespace
 
 // static
@@ -90,19 +129,17 @@
 void ModelTypeStoreImpl::CreateStore(
     ModelType type,
     const std::string& path,
-    scoped_refptr<base::SequencedTaskRunner> blocking_task_runner,
     const InitCallback& callback) {
   DCHECK(!callback.is_null());
   std::unique_ptr<leveldb::Env> env;
+  scoped_refptr<base::SequencedTaskRunner> task_runner =
+      task_runner_map_singleton_.Get().GetOrCreateTaskRunner(path);
   std::unique_ptr<Result> result(new Result());
   auto task = base::Bind(&ModelTypeStoreBackend::GetOrCreateBackend, path,
                          base::Passed(&env), result.get());
-  auto reply =
-      base::Bind(&ModelTypeStoreImpl::BackendInitDone, type,
-                 base::Passed(&result), blocking_task_runner, callback);
-
-  base::PostTaskAndReplyWithResult(blocking_task_runner.get(), FROM_HERE, task,
-                                   reply);
+  auto reply = base::Bind(&ModelTypeStoreImpl::BackendInitDone, type,
+                          base::Passed(&result), task_runner, callback);
+  base::PostTaskAndReplyWithResult(task_runner.get(), FROM_HERE, task, reply);
 }
 
 // static

diff --git a/components/sync/model_impl/model_type_store_impl.h b/components/sync/model_impl/model_type_store_impl.h
index 343e4966..3870329 100644
--- a/components/sync/model_impl/model_type_store_impl.h
+++ b/components/sync/model_impl/model_type_store_impl.h

@@ -30,11 +30,9 @@
  public:
   ~ModelTypeStoreImpl() override;
 
-  static void CreateStore(
-      ModelType type,
-      const std::string& path,
-      scoped_refptr<base::SequencedTaskRunner> blocking_task_runner,
-      const InitCallback& callback);
+  static void CreateStore(ModelType type,
+                          const std::string& path,
+                          const InitCallback& callback);
   static void CreateInMemoryStoreForTest(ModelType type,
                                          const InitCallback& callback);
 

diff --git a/components/translate/content/common/BUILD.gn b/components/translate/content/common/BUILD.gn
index 7e782e1d..336914b5a 100644
--- a/components/translate/content/common/BUILD.gn
+++ b/components/translate/content/common/BUILD.gn

@@ -13,4 +13,6 @@
     "//mojo/common:common_custom_types",
     "//url/mojo:url_mojom_gurl",
   ]
+
+  use_once_callback = true
 }

diff --git a/components/translate/content/renderer/translate_helper.cc b/components/translate/content/renderer/translate_helper.cc
index 4e90bd2..4c8d98f 100644
--- a/components/translate/content/renderer/translate_helper.cc
+++ b/components/translate/content/renderer/translate_helper.cc

@@ -4,6 +4,8 @@
 
 #include "components/translate/content/renderer/translate_helper.h"
 
+#include <utility>
+
 #include "base/bind.h"
 #include "base/compiler_specific.h"
 #include "base/location.h"
@@ -136,9 +138,8 @@
   weak_method_factory_.InvalidateWeakPtrs();
   // Make sure to send the cancelled response back.
   if (translate_callback_pending_) {
-    translate_callback_pending_.Run(true, source_lang_, target_lang_,
-                                    TranslateErrors::NONE);
-    translate_callback_pending_.Reset();
+    std::move(translate_callback_pending_)
+        .Run(true, source_lang_, target_lang_, TranslateErrors::NONE);
   }
   source_lang_.clear();
   target_lang_.clear();
@@ -254,18 +255,20 @@
 void TranslateHelper::Translate(const std::string& translate_script,
                                 const std::string& source_lang,
                                 const std::string& target_lang,
-                                const TranslateCallback& callback) {
+                                TranslateCallback callback) {
   WebLocalFrame* main_frame = render_frame()->GetWebFrame();
   if (!main_frame) {
     // Cancelled.
-    callback.Run(true, source_lang, target_lang, TranslateErrors::NONE);
+    std::move(callback).Run(true, source_lang, target_lang,
+                            TranslateErrors::NONE);
     return;  // We navigated away, nothing to do.
   }
 
   // A similar translation is already under way, nothing to do.
   if (translate_callback_pending_ && target_lang_ == target_lang) {
     // This request is ignored.
-    callback.Run(true, source_lang, target_lang, TranslateErrors::NONE);
+    std::move(callback).Run(true, source_lang, target_lang,
+                            TranslateErrors::NONE);
     return;
   }
 
@@ -273,7 +276,7 @@
   CancelPendingTranslation();
 
   // Set our states.
-  translate_callback_pending_ = callback;
+  translate_callback_pending_ = std::move(callback);
 
   // If the source language is undetermined, we'll let the translate element
   // detect it.
@@ -353,9 +356,8 @@
         ExecuteScriptAndGetDoubleResult("cr.googleTranslate.translationTime"));
 
     // Notify the browser we are done.
-    translate_callback_pending_.Run(false, actual_source_lang, target_lang_,
-                                    TranslateErrors::NONE);
-    translate_callback_pending_.Reset();
+    std::move(translate_callback_pending_)
+        .Run(false, actual_source_lang, target_lang_, TranslateErrors::NONE);
     return;
   }
 
@@ -404,8 +406,8 @@
     TranslateErrors::Type error) {
   DCHECK(translate_callback_pending_);
   // Notify the browser there was an error.
-  translate_callback_pending_.Run(false, source_lang_, target_lang_, error);
-  translate_callback_pending_.Reset();
+  std::move(translate_callback_pending_)
+      .Run(false, source_lang_, target_lang_, error);
 }
 
 const mojom::ContentTranslateDriverPtr& TranslateHelper::GetTranslateDriver() {

diff --git a/components/translate/content/renderer/translate_helper.h b/components/translate/content/renderer/translate_helper.h
index 135d015b..622e718 100644
--- a/components/translate/content/renderer/translate_helper.h
+++ b/components/translate/content/renderer/translate_helper.h

@@ -46,7 +46,7 @@
   void Translate(const std::string& translate_script,
                  const std::string& source_lang,
                  const std::string& target_lang,
-                 const TranslateCallback& callback) override;
+                 TranslateCallback callback) override;
   void RevertTranslation() override;
 
  protected:

diff --git a/content/browser/browser_associated_interface_unittest.cc b/content/browser/browser_associated_interface_unittest.cc
index 0c73a71..d653010e 100644
--- a/content/browser/browser_associated_interface_unittest.cc
+++ b/content/browser/browser_associated_interface_unittest.cc

@@ -4,6 +4,7 @@
 
 #include <memory>
 #include <string>
+#include <utility>
 
 #include "base/memory/ref_counted.h"
 #include "base/message_loop/message_loop.h"
@@ -96,9 +97,9 @@
     next_expected_string_ = expected;
   }
 
-  void RequestQuit(const RequestQuitCallback& callback) override {
+  void RequestQuit(RequestQuitCallback callback) override {
     EXPECT_EQ(kNumTestMessages, message_count_);
-    callback.Run();
+    std::move(callback).Run();
     base::MessageLoop::current()->QuitWhenIdle();
   }
 

diff --git a/content/browser/indexed_db/indexed_db_backing_store.cc b/content/browser/indexed_db/indexed_db_backing_store.cc
index 86be4109..fe068ab0 100644
--- a/content/browser/indexed_db/indexed_db_backing_store.cc
+++ b/content/browser/indexed_db/indexed_db_backing_store.cc

@@ -40,6 +40,7 @@
 #include "content/common/indexed_db/indexed_db_key_range.h"
 #include "content/public/browser/browser_thread.h"
 #include "net/base/load_flags.h"
+#include "net/traffic_annotation/network_traffic_annotation.h"
 #include "net/url_request/url_request_context.h"
 #include "storage/browser/blob/blob_data_handle.h"
 #include "storage/browser/fileapi/file_stream_writer.h"
@@ -2557,12 +2558,36 @@
     DCHECK(blob_url.is_valid());
     net::URLRequestContext* request_context =
         request_context_getter->GetURLRequestContext();
+    net::NetworkTrafficAnnotationTag traffic_annotation =
+        net::DefineNetworkTrafficAnnotation("persist_blob_to_indexed_db", R"(
+        semantics {
+          sender: "Indexed DB"
+          description:
+            "A web page's script has created a Blob (or File) object (either "
+            "directly via constructors, or by using file upload to a form, or "
+            "via a fetch()). The script has then made a request to store data "
+            "including the Blob via the Indexed DB API. As part of committing "
+            "the database transaction, the content of the Blob is being copied "
+            "into a file in the database's directory."
+          trigger:
+            "The script has made a request to store data including a Blob via "
+            "the Indexed DB API."
+          data:
+            "A Blob or File object referenced by script, either created "
+            "directly via constructors, or by using file upload to a form, or "
+            "drag/drop, or via a fetch() or other APIs that produce Blobs."
+          destination: LOCAL
+        }
+        policy {
+          cookies_allowed: false
+          setting: "This feature cannot be disabled by settings."
+          policy_exception_justification: "Not implemented."
+        })");
     std::unique_ptr<net::URLRequest> blob_request(
         request_context->CreateRequest(blob_url, net::DEFAULT_PRIORITY,
-                                       delegate.get()));
+                                       delegate.get(), traffic_annotation));
     blob_request->SetLoadFlags(net::LOAD_DO_NOT_SAVE_COOKIES |
                                net::LOAD_DO_NOT_SEND_COOKIES);
-
     this->file_path_ = file_path;
     this->last_modified_ = last_modified;
 

diff --git a/content/browser/renderer_host/render_widget_host_impl.cc b/content/browser/renderer_host/render_widget_host_impl.cc
index 49e1634..a79dc45 100644
--- a/content/browser/renderer_host/render_widget_host_impl.cc
+++ b/content/browser/renderer_host/render_widget_host_impl.cc

@@ -708,6 +708,9 @@
         view_->DoBrowserControlsShrinkBlinkSize();
     resize_params->bottom_controls_height = view_->GetBottomControlsHeight();
     resize_params->visible_viewport_size = view_->GetVisibleViewportSize();
+    cc::LocalSurfaceId local_surface_id = view_->GetLocalSurfaceId();
+    if (local_surface_id.is_valid())
+      resize_params->local_surface_id = local_surface_id;
   }
 
   const bool size_changed =
@@ -881,7 +884,7 @@
   // How long to (synchronously) wait for the renderer to respond with a
   // new frame when our current frame doesn't exist or is the wrong size.
   // This timeout impacts the "choppiness" of our window resize.
-  const int kPaintMsgTimeoutMS = 50;
+  const int kPaintMsgTimeoutMS = 167;
 
   if (!view_)
     return;

diff --git a/content/browser/renderer_host/render_widget_host_view_aura.cc b/content/browser/renderer_host/render_widget_host_view_aura.cc
index 64e3883..417056c1 100644
--- a/content/browser/renderer_host/render_widget_host_view_aura.cc
+++ b/content/browser/renderer_host/render_widget_host_view_aura.cc

@@ -2129,6 +2129,8 @@
   // a Window::SetBoundsInternal call.
   if (!in_bounds_changed_)
     window_->SetBounds(rect);
+  if (IsMus())
+    local_surface_id_ = aura::WindowMus::Get(window_)->GetLocalSurfaceId();
   host_->WasResized();
   if (delegated_frame_host_)
     delegated_frame_host_->WasResized();
@@ -2283,6 +2285,10 @@
   return frame_sink_id_;
 }
 
+cc::LocalSurfaceId RenderWidgetHostViewAura::GetLocalSurfaceId() const {
+  return local_surface_id_;
+}
+
 cc::SurfaceId RenderWidgetHostViewAura::SurfaceIdForTesting() const {
   return delegated_frame_host_ ? delegated_frame_host_->SurfaceIdForTesting()
                                : cc::SurfaceId();

diff --git a/content/browser/renderer_host/render_widget_host_view_aura.h b/content/browser/renderer_host/render_widget_host_view_aura.h
index 489ebc43..1e3d1099 100644
--- a/content/browser/renderer_host/render_widget_host_view_aura.h
+++ b/content/browser/renderer_host/render_widget_host_view_aura.h

@@ -174,6 +174,7 @@
   void DidStopFlinging() override;
   void OnDidNavigateMainFrameToNewPage() override;
   cc::FrameSinkId GetFrameSinkId() override;
+  cc::LocalSurfaceId GetLocalSurfaceId() const override;
   cc::FrameSinkId FrameSinkIdAtPoint(cc::SurfaceHittestDelegate* delegate,
                                      const gfx::Point& point,
                                      gfx::Point* transformed_point) override;
@@ -591,6 +592,7 @@
   std::unique_ptr<RenderWidgetHostViewEventHandler> event_handler_;
 
   cc::FrameSinkId frame_sink_id_;
+  cc::LocalSurfaceId local_surface_id_;
 
   base::WeakPtrFactory<RenderWidgetHostViewAura> weak_ptr_factory_;
 

diff --git a/content/browser/renderer_host/render_widget_host_view_base.cc b/content/browser/renderer_host/render_widget_host_view_base.cc
index 8c862b6..66e549f 100644
--- a/content/browser/renderer_host/render_widget_host_view_base.cc
+++ b/content/browser/renderer_host/render_widget_host_view_base.cc

@@ -406,6 +406,10 @@
   return cc::FrameSinkId();
 }
 
+cc::LocalSurfaceId RenderWidgetHostViewBase::GetLocalSurfaceId() const {
+  return cc::LocalSurfaceId();
+}
+
 cc::FrameSinkId RenderWidgetHostViewBase::FrameSinkIdAtPoint(
     cc::SurfaceHittestDelegate* delegate,
     const gfx::Point& point,

diff --git a/content/browser/renderer_host/render_widget_host_view_base.h b/content/browser/renderer_host/render_widget_host_view_base.h
index 3f0cdab..6bb3159 100644
--- a/content/browser/renderer_host/render_widget_host_view_base.h
+++ b/content/browser/renderer_host/render_widget_host_view_base.h

@@ -250,10 +250,11 @@
 
   virtual void DidStopFlinging() {}
 
-  // Returns the compositing surface ID namespace, or 0 if Surfaces are not
-  // enabled.
+  // Returns the ID associated with the CompositorFrameSink of this view.
   virtual cc::FrameSinkId GetFrameSinkId();
 
+  virtual cc::LocalSurfaceId GetLocalSurfaceId() const;
+
   // When there are multiple RenderWidgetHostViews for a single page, input
   // events need to be targeted to the correct one for handling. The following
   // methods are invoked on the RenderWidgetHostView that should be able to

diff --git a/content/browser/service_worker/service_worker_version_unittest.cc b/content/browser/service_worker/service_worker_version_unittest.cc
index a47228ea..4531d0e 100644
--- a/content/browser/service_worker/service_worker_version_unittest.cc
+++ b/content/browser/service_worker/service_worker_version_unittest.cc

@@ -6,6 +6,7 @@
 
 #include <stdint.h>
 #include <tuple>
+#include <utility>
 
 #include "base/macros.h"
 #include "base/memory/ptr_util.h"
@@ -131,24 +132,22 @@
                             std::move(request));
   }
 
-  void DoSomething(const DoSomethingCallback& callback) override {
-    callback.Run();
+  void DoSomething(DoSomethingCallback callback) override {
+    std::move(callback).Run();
   }
 
-  void DoTerminateProcess(const DoTerminateProcessCallback& callback) override {
+  void DoTerminateProcess(DoTerminateProcessCallback callback) override {
     NOTREACHED();
   }
 
-  void CreateFolder(const CreateFolderCallback& callback) override {
-    NOTREACHED();
-  }
+  void CreateFolder(CreateFolderCallback callback) override { NOTREACHED(); }
 
-  void GetRequestorName(const GetRequestorNameCallback& callback) override {
-    callback.Run("");
+  void GetRequestorName(GetRequestorNameCallback callback) override {
+    std::move(callback).Run("");
   }
 
   void CreateSharedBuffer(const std::string& message,
-                          const CreateSharedBufferCallback& callback) override {
+                          CreateSharedBufferCallback callback) override {
     NOTREACHED();
   }
 

diff --git a/content/browser/webui/web_ui_mojo_browsertest.cc b/content/browser/webui/web_ui_mojo_browsertest.cc
index 457d831..87405d6 100644
--- a/content/browser/webui/web_ui_mojo_browsertest.cc
+++ b/content/browser/webui/web_ui_mojo_browsertest.cc

@@ -85,9 +85,7 @@
   ~BrowserTargetImpl() override {}
 
   // mojom::BrowserTarget overrides:
-  void Start(const StartCallback& closure) override {
-    closure.Run();
-  }
+  void Start(StartCallback closure) override { std::move(closure).Run(); }
   void Stop() override {
     g_got_message = true;
     run_loop_->Quit();

diff --git a/content/common/resize_params.h b/content/common/resize_params.h
index 547dd35..ac0810dc 100644
--- a/content/common/resize_params.h
+++ b/content/common/resize_params.h

@@ -5,6 +5,8 @@
 #ifndef CONTENT_COMMON_RESIZE_PARAMS_H_
 #define CONTENT_COMMON_RESIZE_PARAMS_H_
 
+#include "base/optional.h"
+#include "cc/surfaces/local_surface_id.h"
 #include "content/common/content_export.h"
 #include "content/public/common/screen_info.h"
 #include "third_party/WebKit/public/platform/WebDisplayMode.h"
@@ -37,6 +39,9 @@
   // The height of the bottom controls.
   float bottom_controls_height;
 
+  // The local surface ID to use (if valid).
+  base::Optional<cc::LocalSurfaceId> local_surface_id;
+
   // The size of the visible viewport, which may be smaller than the view if the
   // view is partially occluded (e.g. by a virtual keyboard).  The size is in
   // DPI-adjusted pixels.

diff --git a/content/common/view_messages.h b/content/common/view_messages.h
index 82ffcc94..cf32fe69 100644
--- a/content/common/view_messages.h
+++ b/content/common/view_messages.h

@@ -184,6 +184,7 @@
   IPC_STRUCT_TRAITS_MEMBER(browser_controls_shrink_blink_size)
   IPC_STRUCT_TRAITS_MEMBER(top_controls_height)
   IPC_STRUCT_TRAITS_MEMBER(bottom_controls_height)
+  IPC_STRUCT_TRAITS_MEMBER(local_surface_id)
   IPC_STRUCT_TRAITS_MEMBER(visible_viewport_size)
   IPC_STRUCT_TRAITS_MEMBER(is_fullscreen_granted)
   IPC_STRUCT_TRAITS_MEMBER(display_mode)

diff --git a/content/public/android/BUILD.gn b/content/public/android/BUILD.gn
index bd793cb..d146aa8c 100644
--- a/content/public/android/BUILD.gn
+++ b/content/public/android/BUILD.gn

@@ -440,6 +440,7 @@
     "javatests/src/org/chromium/content/browser/TestsJavaScriptEvalTest.java",
     "javatests/src/org/chromium/content/browser/TracingControllerAndroidTest.java",
     "javatests/src/org/chromium/content/browser/VideoFullscreenOrientationLockTest.java",
+    "javatests/src/org/chromium/content/browser/VideoRotateToFullscreenTest.java",
     "javatests/src/org/chromium/content/browser/VSyncMonitorTest.java",
     "javatests/src/org/chromium/content/browser/VSyncPausedTest.java",
     "javatests/src/org/chromium/content/browser/ViewportTest.java",

diff --git a/content/public/android/javatests/src/org/chromium/content/browser/VideoFullscreenOrientationLockTest.java b/content/public/android/javatests/src/org/chromium/content/browser/VideoFullscreenOrientationLockTest.java
index 446bfb7..489c2b3 100644
--- a/content/public/android/javatests/src/org/chromium/content/browser/VideoFullscreenOrientationLockTest.java
+++ b/content/public/android/javatests/src/org/chromium/content/browser/VideoFullscreenOrientationLockTest.java

@@ -23,7 +23,6 @@
 import org.chromium.content.browser.test.util.DOMUtils;
 import org.chromium.content.browser.test.util.JavaScriptUtils;
 import org.chromium.content.browser.test.util.UiUtils;
-import org.chromium.content.common.ContentSwitches;
 import org.chromium.content_shell_apk.ContentShellActivityTestRule;
 import org.chromium.media.MediaSwitches;
 import org.chromium.ui.base.DeviceFormFactor;
@@ -34,10 +33,10 @@
 /**
  * Integration tests for the feature that auto locks the orientation when a video goes fullscreen.
  * See also chrome layer org.chromium.chrome.browser.VideoFullscreenOrientationLockChromeTest
-ContentSwitches.ENABLE_TEST_INTENTS */
+ */
 @RunWith(ContentJUnit4ClassRunner.class)
 @CommandLineFlags.Add({"enable-features=VideoFullscreenOrientationLock",
-        MediaSwitches.IGNORE_AUTOPLAY_RESTRICTIONS_FOR_TESTS, ContentSwitches.ENABLE_TEST_INTENTS})
+        MediaSwitches.IGNORE_AUTOPLAY_RESTRICTIONS_FOR_TESTS})
 public class VideoFullscreenOrientationLockTest {
     @Rule
     public ContentShellActivityTestRule mActivityTestRule = new ContentShellActivityTestRule();
@@ -135,7 +134,8 @@
     @MediumTest
     @Feature({"VideoFullscreenOrientationLock"})
     public void testEnterExitFullscreenWithControlsButton() throws Exception {
-        if (DeviceFormFactor.isTablet(InstrumentationRegistry.getInstrumentation().getContext())) {
+        // TODO(johnme): Use RESTRICTION_TYPE_PHONE once crbug.com/673917 moves it out of chrome/.
+        if (DeviceFormFactor.isTablet(mActivityTestRule.getActivity())) {
             return;
         }
 
@@ -165,7 +165,8 @@
     @MediumTest
     @Feature({"VideoFullscreenOrientationLock"})
     public void testEnterExitFullscreenWithAPI() throws Exception {
-        if (DeviceFormFactor.isTablet(InstrumentationRegistry.getInstrumentation().getContext())) {
+        // TODO(johnme): Use RESTRICTION_TYPE_PHONE once crbug.com/673917 moves it out of chrome/.
+        if (DeviceFormFactor.isTablet(mActivityTestRule.getActivity())) {
             return;
         }
 
@@ -191,7 +192,8 @@
     @MediumTest
     @Feature({"VideoFullscreenOrientationLock"})
     public void testExitFullscreenByRemovingVideo() throws Exception {
-        if (DeviceFormFactor.isTablet(InstrumentationRegistry.getInstrumentation().getContext())) {
+        // TODO(johnme): Use RESTRICTION_TYPE_PHONE once crbug.com/673917 moves it out of chrome/.
+        if (DeviceFormFactor.isTablet(mActivityTestRule.getActivity())) {
             return;
         }
 
@@ -218,7 +220,8 @@
     @MediumTest
     @Feature({"VideoFullscreenOrientationLock"})
     public void testExitFullscreenWithNavigation() throws Exception {
-        if (DeviceFormFactor.isTablet(InstrumentationRegistry.getInstrumentation().getContext())) {
+        // TODO(johnme): Use RESTRICTION_TYPE_PHONE once crbug.com/673917 moves it out of chrome/.
+        if (DeviceFormFactor.isTablet(mActivityTestRule.getActivity())) {
             return;
         }
 

diff --git a/content/public/android/javatests/src/org/chromium/content/browser/VideoRotateToFullscreenTest.java b/content/public/android/javatests/src/org/chromium/content/browser/VideoRotateToFullscreenTest.java
new file mode 100644
index 0000000..23b0ce2
--- /dev/null
+++ b/content/public/android/javatests/src/org/chromium/content/browser/VideoRotateToFullscreenTest.java

@@ -0,0 +1,123 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+package org.chromium.content.browser;
+
+import android.content.pm.ActivityInfo;
+import android.support.test.filters.MediumTest;
+
+import org.junit.After;
+import org.junit.Assert;
+import org.junit.Before;
+import org.junit.Rule;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+
+import org.chromium.base.ThreadUtils;
+import org.chromium.base.test.util.CommandLineFlags;
+import org.chromium.base.test.util.Feature;
+import org.chromium.content.browser.test.ContentJUnit4ClassRunner;
+import org.chromium.content.browser.test.util.Criteria;
+import org.chromium.content.browser.test.util.CriteriaHelper;
+import org.chromium.content.browser.test.util.DOMUtils;
+import org.chromium.content.browser.test.util.JavaScriptUtils;
+import org.chromium.content_shell_apk.ContentShellActivityTestRule;
+import org.chromium.media.MediaSwitches;
+import org.chromium.ui.base.DeviceFormFactor;
+
+import java.util.concurrent.Callable;
+import java.util.concurrent.TimeoutException;
+
+/**
+ * Integration tests for the feature that automatically enters and exits fullscreen when the device
+ * is rotated whilst watching a video.
+ */
+@RunWith(ContentJUnit4ClassRunner.class)
+@CommandLineFlags.Add({"enable-features=VideoRotateToFullscreen",
+        MediaSwitches.IGNORE_AUTOPLAY_RESTRICTIONS_FOR_TESTS})
+public class VideoRotateToFullscreenTest {
+    @Rule
+    public ContentShellActivityTestRule mRule = new ContentShellActivityTestRule();
+
+    private static final String TEST_URL = "content/test/data/media/video-player.html";
+    private static final String VIDEO_ID = "video";
+
+    private void waitForContentsFullscreenState(boolean fullscreenValue) {
+        CriteriaHelper.pollInstrumentationThread(
+                Criteria.equals(fullscreenValue, new Callable<Boolean>() {
+                    @Override
+                    public Boolean call() throws InterruptedException, TimeoutException {
+                        return DOMUtils.isFullscreen(mRule.getWebContents());
+                    }
+                }));
+    }
+
+    private void waitForScreenOrientation(String orientationValue) {
+        CriteriaHelper.pollInstrumentationThread(
+                Criteria.equals(orientationValue, new Callable<String>() {
+                    @Override
+                    public String call() throws InterruptedException, TimeoutException {
+                        return screenOrientation();
+                    }
+                }));
+    }
+
+    private String screenOrientation() throws InterruptedException, TimeoutException {
+        // Returns "\"portrait\"" or "\"landscape\"" (strips the "-primary" or "-secondary" suffix).
+        return JavaScriptUtils.executeJavaScriptAndWaitForResult(
+                mRule.getWebContents(), "screen.orientation.type.split('-')[0]");
+    }
+
+    @Before
+    public void setUp() throws Exception {
+        mRule.launchContentShellWithUrlSync(TEST_URL);
+
+        JavaScriptUtils.executeJavaScriptAndWaitForResult(mRule.getWebContents(),
+                "document.getElementById('video').src = 'bear-320x240.webm';");
+    }
+
+    @After
+    public void tearDown() throws Exception {
+        ThreadUtils.runOnUiThreadBlocking(new Runnable() {
+            @Override
+            public void run() {
+                mRule.getActivity().setRequestedOrientation(
+                        ActivityInfo.SCREEN_ORIENTATION_UNSPECIFIED);
+            }
+        });
+    }
+
+    @Test
+    @MediumTest
+    @Feature({"VideoRotateToFullscreen"})
+    public void testPortraitToLandscapeAndBack() throws Exception {
+        // TODO(johnme): Use RESTRICTION_TYPE_PHONE once crbug.com/673917 moves it out of chrome/.
+        if (DeviceFormFactor.isTablet(mRule.getActivity())) {
+            return;
+        }
+
+        // Start off in portrait screen orientation.
+        mRule.getActivity().setRequestedOrientation(ActivityInfo.SCREEN_ORIENTATION_PORTRAIT);
+        waitForScreenOrientation("\"portrait\"");
+
+        // Start playback.
+        Assert.assertTrue(DOMUtils.isMediaPaused(mRule.getWebContents(), VIDEO_ID));
+        DOMUtils.playMedia(mRule.getWebContents(), VIDEO_ID);
+        DOMUtils.waitForMediaPlay(mRule.getWebContents(), VIDEO_ID);
+
+        // Rotate screen from portrait to landscape.
+        mRule.getActivity().setRequestedOrientation(ActivityInfo.SCREEN_ORIENTATION_LANDSCAPE);
+        waitForScreenOrientation("\"landscape\"");
+
+        // Should enter fullscreen.
+        waitForContentsFullscreenState(true);
+
+        // Rotate screen from landscape to portrait(?).
+        mRule.getActivity().setRequestedOrientation(ActivityInfo.SCREEN_ORIENTATION_PORTRAIT);
+        waitForScreenOrientation("\"portrait\"");
+
+        // Should exit fullscreen.
+        waitForContentsFullscreenState(false);
+    }
+}

diff --git a/content/public/test/test_service.cc b/content/public/test/test_service.cc
index b2790bc..1d1b1c7bb 100644
--- a/content/public/test/test_service.cc
+++ b/content/public/test/test_service.cc

@@ -37,27 +37,25 @@
   service_binding_.Bind(std::move(request));
 }
 
-void TestService::DoSomething(const DoSomethingCallback& callback) {
-  callback.Run();
+void TestService::DoSomething(DoSomethingCallback callback) {
+  std::move(callback).Run();
   base::MessageLoop::current()->QuitWhenIdle();
 }
 
-void TestService::DoTerminateProcess(
-    const DoTerminateProcessCallback& callback) {
+void TestService::DoTerminateProcess(DoTerminateProcessCallback callback) {
   NOTREACHED();
 }
 
-void TestService::CreateFolder(const CreateFolderCallback& callback) {
+void TestService::CreateFolder(CreateFolderCallback callback) {
   NOTREACHED();
 }
 
-void TestService::GetRequestorName(const GetRequestorNameCallback& callback) {
-  callback.Run(requestor_name_);
+void TestService::GetRequestorName(GetRequestorNameCallback callback) {
+  std::move(callback).Run(requestor_name_);
 }
 
-void TestService::CreateSharedBuffer(
-    const std::string& message,
-    const CreateSharedBufferCallback& callback) {
+void TestService::CreateSharedBuffer(const std::string& message,
+                                     CreateSharedBufferCallback callback) {
   NOTREACHED();
 }
 

diff --git a/content/public/test/test_service.h b/content/public/test/test_service.h
index fbd3cbf..f3df7651 100644
--- a/content/public/test/test_service.h
+++ b/content/public/test/test_service.h

@@ -34,12 +34,12 @@
               mojom::TestServiceRequest request);
 
   // TestService:
-  void DoSomething(const DoSomethingCallback& callback) override;
-  void DoTerminateProcess(const DoTerminateProcessCallback& callback) override;
-  void CreateFolder(const CreateFolderCallback& callback) override;
-  void GetRequestorName(const GetRequestorNameCallback& callback) override;
+  void DoSomething(DoSomethingCallback callback) override;
+  void DoTerminateProcess(DoTerminateProcessCallback callback) override;
+  void CreateFolder(CreateFolderCallback callback) override;
+  void GetRequestorName(GetRequestorNameCallback callback) override;
   void CreateSharedBuffer(const std::string& message,
-                          const CreateSharedBufferCallback& callback) override;
+                          CreateSharedBufferCallback callback) override;
 
   service_manager::BinderRegistry registry_;
   mojo::Binding<mojom::TestService> service_binding_;

diff --git a/content/renderer/mus/renderer_window_tree_client.cc b/content/renderer/mus/renderer_window_tree_client.cc
index 328673da..d78e3f2 100644
--- a/content/renderer/mus/renderer_window_tree_client.cc
+++ b/content/renderer/mus/renderer_window_tree_client.cc

@@ -9,10 +9,6 @@
 #include "base/command_line.h"
 #include "base/lazy_instance.h"
 #include "cc/base/switches.h"
-#include "content/renderer/gpu/render_widget_compositor.h"
-#include "content/renderer/render_frame_impl.h"
-#include "content/renderer/render_view_impl.h"
-#include "content/renderer/render_widget.h"
 #include "services/ui/public/cpp/client_compositor_frame_sink.h"
 
 namespace content {
@@ -70,9 +66,6 @@
 
 RendererWindowTreeClient::RendererWindowTreeClient(int routing_id)
     : routing_id_(routing_id), binding_(this) {
-  enable_surface_synchronization_ =
-      base::CommandLine::ForCurrentProcess()->HasSwitch(
-          cc::switches::kEnableSurfaceSynchronization);
 }
 
 RendererWindowTreeClient::~RendererWindowTreeClient() {
@@ -93,16 +86,6 @@
   callback.Run(std::move(frame_sink));
 }
 
-RenderWidget* RendererWindowTreeClient::GetRenderWidgetFromRoutingId(
-    int routing_id) {
-  RenderFrameImpl* render_frame = RenderFrameImpl::FromRoutingID(routing_id);
-  RenderViewImpl* render_view = RenderViewImpl::FromRoutingID(routing_id);
-  if (!render_frame && !render_view)
-    return nullptr;
-  return render_frame ? render_frame->GetRenderWidget()
-                      : render_view->GetWidget();
-}
-
 void RendererWindowTreeClient::DestroySelf() {
   delete this;
 }
@@ -127,10 +110,6 @@
     pending_gpu_memory_buffer_manager_ = nullptr;
     pending_compositor_frame_sink_callback_.Reset();
   }
-  if (local_surface_id) {
-    // TODO(fsamuel): Update the RenderWidgetCompositor's LocalSurfaceId.
-    current_local_surface_id_ = *local_surface_id;
-  }
 }
 
 void RendererWindowTreeClient::OnEmbeddedAppDisconnected(ui::Id window_id) {
@@ -167,15 +146,6 @@
     const gfx::Rect& old_bounds,
     const gfx::Rect& new_bounds,
     const base::Optional<cc::LocalSurfaceId>& local_surface_id) {
-  if (!enable_surface_synchronization_ || !local_surface_id)
-    return;
-  current_local_surface_id_ = *local_surface_id;
-  RenderWidget* widget = GetRenderWidgetFromRoutingId(routing_id_);
-  if (!widget)
-    return;
-  // TODO(fsamuel): This isn't quite correct. The resize arrives from the
-  // browser and so it might not synchronize with the LocalSurfaceId.
-  widget->compositor()->SetLocalSurfaceId(*local_surface_id);
 }
 
 void RendererWindowTreeClient::OnClientAreaChanged(

diff --git a/content/renderer/mus/renderer_window_tree_client.h b/content/renderer/mus/renderer_window_tree_client.h
index cefe8797..e4514fb 100644
--- a/content/renderer/mus/renderer_window_tree_client.h
+++ b/content/renderer/mus/renderer_window_tree_client.h

@@ -22,8 +22,6 @@
 
 namespace content {
 
-class RenderWidget;
-
 // ui.mojom.WindowTreeClient implementation for RenderWidget. This lives and
 // operates on the renderer's main thread.
 class RendererWindowTreeClient : public ui::mojom::WindowTreeClient {
@@ -41,10 +39,6 @@
   // nullptr if none exists.
   static RendererWindowTreeClient* Get(int routing_id);
 
-  const cc::LocalSurfaceId& local_surface_id() const {
-    return current_local_surface_id_;
-  }
-
   void Bind(ui::mojom::WindowTreeClientRequest request);
 
   using CompositorFrameSinkCallback =
@@ -63,8 +57,6 @@
       gpu::GpuMemoryBufferManager* gpu_memory_buffer_manager,
       const CompositorFrameSinkCallback& callback);
 
-  RenderWidget* GetRenderWidgetFromRoutingId(int routing_id);
-
   void DestroySelf();
 
   // ui::mojom::WindowTreeClient:
@@ -169,12 +161,10 @@
   const int routing_id_;
   ui::Id root_window_id_;
   cc::FrameSinkId frame_sink_id_;
-  bool enable_surface_synchronization_ = false;
   scoped_refptr<cc::ContextProvider> pending_context_provider_;
   gpu::GpuMemoryBufferManager* pending_gpu_memory_buffer_manager_ = nullptr;
   CompositorFrameSinkCallback pending_compositor_frame_sink_callback_;
   ui::mojom::WindowTreePtr tree_;
-  cc::LocalSurfaceId current_local_surface_id_;
   mojo::Binding<ui::mojom::WindowTreeClient> binding_;
 
   DISALLOW_COPY_AND_ASSIGN(RendererWindowTreeClient);

diff --git a/content/renderer/render_widget.cc b/content/renderer/render_widget.cc
index 1f4539dc..7706d46 100644
--- a/content/renderer/render_widget.cc
+++ b/content/renderer/render_widget.cc

@@ -1207,11 +1207,20 @@
   if (!GetWebWidget())
     return;
 
+  if (params.local_surface_id)
+    local_surface_id_ = *params.local_surface_id;
+
   if (compositor_) {
     compositor_->SetViewportSize(params.physical_backing_size);
     compositor_->setBottomControlsHeight(params.bottom_controls_height);
     compositor_->SetRasterColorSpace(
         screen_info_.icc_profile.GetParametricColorSpace());
+    // If surface synchronization is enable, then this will use the provided
+    // |local_surface_id_| to submit the next generated CompositorFrame.
+    // If the ID is not valid, then the compositor will defer commits until
+    // it receives a valid surface ID. This is a no-op if surface
+    // synchronization is disabled.
+    compositor_->SetLocalSurfaceId(local_surface_id_);
   }
 
   visible_viewport_size_ = params.visible_viewport_size;
@@ -1304,12 +1313,7 @@
   OnDeviceScaleFactorChanged();
   compositor_->SetRasterColorSpace(screen_info_.icc_profile.GetColorSpace());
   compositor_->SetContentSourceId(current_content_source_id_);
-#if defined(USE_AURA)
-  RendererWindowTreeClient* window_tree_client =
-      RendererWindowTreeClient::Get(routing_id_);
-  if (window_tree_client)
-    compositor_->SetLocalSurfaceId(window_tree_client->local_surface_id());
-#endif
+  compositor_->SetLocalSurfaceId(local_surface_id_);
   // For background pages and certain tests, we don't want to trigger
   // CompositorFrameSink creation.
   bool should_generate_frame_sink =

diff --git a/content/renderer/render_widget.h b/content/renderer/render_widget.h
index 0aa91b2..309083cf 100644
--- a/content/renderer/render_widget.h
+++ b/content/renderer/render_widget.h

@@ -23,6 +23,7 @@
 #include "base/observer_list.h"
 #include "base/time/time.h"
 #include "build/build_config.h"
+#include "cc/surfaces/local_surface_id.h"
 #include "content/common/content_export.h"
 #include "content/common/cursors/webcursor.h"
 #include "content/common/drag_event_source_info.h"
@@ -879,6 +880,8 @@
   // to replace it. See https://crbug.com/695579.
   uint32_t current_content_source_id_;
 
+  cc::LocalSurfaceId local_surface_id_;
+
   scoped_refptr<MainThreadEventQueue> input_event_queue_;
 
   base::WeakPtrFactory<RenderWidget> weak_ptr_factory_;

diff --git a/content/shell/BUILD.gn b/content/shell/BUILD.gn
index ccf2491..6329a1c0 100644
--- a/content/shell/BUILD.gn
+++ b/content/shell/BUILD.gn

@@ -773,6 +773,8 @@
     "//ui/gfx/geometry/mojo",
     "//url/mojo:url_mojom_gurl",
   ]
+
+  use_once_callback = true
 }
 
 group("content_shell_crash_test") {

diff --git a/content/shell/browser/layout_test/layout_test_bluetooth_fake_adapter_setter_impl.cc b/content/shell/browser/layout_test/layout_test_bluetooth_fake_adapter_setter_impl.cc
index fa83b6a..7595cd1 100644
--- a/content/shell/browser/layout_test/layout_test_bluetooth_fake_adapter_setter_impl.cc
+++ b/content/shell/browser/layout_test/layout_test_bluetooth_fake_adapter_setter_impl.cc

@@ -5,6 +5,7 @@
 #include "content/shell/browser/layout_test/layout_test_bluetooth_fake_adapter_setter_impl.h"
 
 #include <string>
+#include <utility>
 
 #include "base/memory/ptr_util.h"
 #include "content/public/test/layouttest_support.h"
@@ -31,13 +32,13 @@
 
 void LayoutTestBluetoothFakeAdapterSetterImpl::Set(
     const std::string& adapter_name,
-    const SetCallback& callback) {
+    SetCallback callback) {
   SetTestBluetoothScanDuration();
 
   device::BluetoothAdapterFactoryWrapper::Get().SetBluetoothAdapterForTesting(
       LayoutTestBluetoothAdapterProvider::GetBluetoothAdapter(adapter_name));
 
-  callback.Run();
+  std::move(callback).Run();
 }
 
 }  // namespace content

diff --git a/content/shell/browser/layout_test/layout_test_bluetooth_fake_adapter_setter_impl.h b/content/shell/browser/layout_test/layout_test_bluetooth_fake_adapter_setter_impl.h
index ead71d14..2187030 100644
--- a/content/shell/browser/layout_test/layout_test_bluetooth_fake_adapter_setter_impl.h
+++ b/content/shell/browser/layout_test/layout_test_bluetooth_fake_adapter_setter_impl.h

@@ -25,8 +25,7 @@
       mojom::LayoutTestBluetoothFakeAdapterSetterRequest request);
 
  private:
-  void Set(const std::string& adapter_name,
-           const SetCallback& callback) override;
+  void Set(const std::string& adapter_name, SetCallback callback) override;
 
   DISALLOW_COPY_AND_ASSIGN(LayoutTestBluetoothFakeAdapterSetterImpl);
 };

diff --git a/content/shell/renderer/shell_content_renderer_client.cc b/content/shell/renderer/shell_content_renderer_client.cc
index 89545ff..271da8b 100644
--- a/content/shell/renderer/shell_content_renderer_client.cc
+++ b/content/shell/renderer/shell_content_renderer_client.cc

@@ -55,7 +55,7 @@
   void OnConnectionError() { delete this; }
 
   // mojom::TestService:
-  void DoSomething(const DoSomethingCallback& callback) override {
+  void DoSomething(DoSomethingCallback callback) override {
     // Instead of responding normally, unbind the pipe, write some garbage,
     // and go away.
     const std::string kBadMessage = "This is definitely not a valid response!";
@@ -69,20 +69,18 @@
     OnConnectionError();
   }
 
-  void DoTerminateProcess(const DoTerminateProcessCallback& callback) override {
+  void DoTerminateProcess(DoTerminateProcessCallback callback) override {
     NOTREACHED();
   }
 
-  void CreateFolder(const CreateFolderCallback& callback) override {
-    NOTREACHED();
-  }
+  void CreateFolder(CreateFolderCallback callback) override { NOTREACHED(); }
 
-  void GetRequestorName(const GetRequestorNameCallback& callback) override {
-    callback.Run("Not implemented.");
+  void GetRequestorName(GetRequestorNameCallback callback) override {
+    std::move(callback).Run("Not implemented.");
   }
 
   void CreateSharedBuffer(const std::string& message,
-                          const CreateSharedBufferCallback& callback) override {
+                          CreateSharedBufferCallback callback) override {
     NOTREACHED();
   }
 

diff --git a/content/shell/utility/shell_content_utility_client.cc b/content/shell/utility/shell_content_utility_client.cc
index 429a152..69d156b 100644
--- a/content/shell/utility/shell_content_utility_client.cc
+++ b/content/shell/utility/shell_content_utility_client.cc

@@ -37,26 +37,26 @@
   }
 
   // mojom::TestService implementation:
-  void DoSomething(const DoSomethingCallback& callback) override {
-    callback.Run();
+  void DoSomething(DoSomethingCallback callback) override {
+    std::move(callback).Run();
   }
 
-  void DoTerminateProcess(const DoTerminateProcessCallback& callback) override {
+  void DoTerminateProcess(DoTerminateProcessCallback callback) override {
     base::Process::Current().Terminate(0, false);
   }
 
-  void CreateFolder(const CreateFolderCallback& callback) override {
+  void CreateFolder(CreateFolderCallback callback) override {
     // Note: This is used to check if the sandbox is disabled or not since
     //       creating a folder is forbidden when it is enabled.
-    callback.Run(base::ScopedTempDir().CreateUniqueTempDir());
+    std::move(callback).Run(base::ScopedTempDir().CreateUniqueTempDir());
   }
 
-  void GetRequestorName(const GetRequestorNameCallback& callback) override {
+  void GetRequestorName(GetRequestorNameCallback callback) override {
     NOTREACHED();
   }
 
   void CreateSharedBuffer(const std::string& message,
-                          const CreateSharedBufferCallback& callback) override {
+                          CreateSharedBufferCallback callback) override {
     mojo::ScopedSharedBufferHandle buffer =
         mojo::SharedBufferHandle::Create(message.size());
     CHECK(buffer.is_valid());
@@ -66,7 +66,7 @@
     std::copy(message.begin(), message.end(),
               reinterpret_cast<char*>(mapping.get()));
 
-    callback.Run(std::move(buffer));
+    std::move(callback).Run(std::move(buffer));
   }
 
  private:

diff --git a/content/test/BUILD.gn b/content/test/BUILD.gn
index b70bc24..c72402f 100644
--- a/content/test/BUILD.gn
+++ b/content/test/BUILD.gn

@@ -463,12 +463,16 @@
     "../public/test/test_service.mojom",
     "test_browser_associated_interfaces.mojom",
   ]
+
+  use_once_callback = true
 }
 
 mojom("web_ui_test_mojo_bindings") {
   sources = [
     "data/web_ui_test_mojo_bindings.mojom",
   ]
+
+  use_once_callback = true
 }
 
 static_library("layouttest_support") {

diff --git a/ios/chrome/app/BUILD.gn b/ios/chrome/app/BUILD.gn
index 4e36ae06..b22e2f7 100644
--- a/ios/chrome/app/BUILD.gn
+++ b/ios/chrome/app/BUILD.gn

@@ -159,6 +159,7 @@
     "//ios/chrome/app/safe_mode",
     "//ios/chrome/app/spotlight",
     "//ios/chrome/app/startup",
+    "//ios/chrome/app/startup:startup_basic",
     "//ios/chrome/app/strings",
     "//ios/chrome/browser",
     "//ios/chrome/browser:browser_internal",
@@ -249,7 +250,7 @@
     ":app_internal",
     "//base",
     "//components/crash/core/common",
-    "//ios/chrome/app/startup",
+    "//ios/chrome/app/startup:startup_basic",
     "//ios/chrome/browser:browser_internal",
     "//ios/chrome/browser/crash_report",
     "//ios/chrome/common",

diff --git a/ios/chrome/app/startup/BUILD.gn b/ios/chrome/app/startup/BUILD.gn
index 27c868d..6a6c485 100644
--- a/ios/chrome/app/startup/BUILD.gn
+++ b/ios/chrome/app/startup/BUILD.gn

@@ -4,32 +4,51 @@
 
 import("//ios/public/provider/chrome/browser/build_config.gni")
 
-source_set("startup") {
-  configs += [ "//build/config/compiler:enable_arc" ]
+# Target for sources that don't depend on //ios/chrome/browser:browser
+source_set("startup_basic") {
   sources = [
-    "background_upload_alert.h",
-    "background_upload_alert.mm",
     "chrome_main_starter.h",
     "chrome_main_starter.mm",
-    "client_registration.h",
-    "client_registration.mm",
     "ios_chrome_main.h",
     "ios_chrome_main.mm",
     "ios_chrome_main_delegate.h",
     "ios_chrome_main_delegate.mm",
-    "network_stack_setup.h",
-    "network_stack_setup.mm",
-    "provider_registration.h",
-    "provider_registration.mm",
     "register_experimental_settings.h",
     "register_experimental_settings.mm",
     "setup_debugging.h",
     "setup_debugging.mm",
   ]
 
+  configs += [ "//build/config/compiler:enable_arc" ]
+
   deps = [
     "//base",
     "//components/crash/core/common",
+    "//ios/chrome/browser:chrome_paths",
+    "//ios/web/public/app",
+    "//skia",
+  ]
+
+  assert_no_deps = [ "//ios/chrome/browser" ]
+}
+
+source_set("startup") {
+  sources = [
+    "background_upload_alert.h",
+    "background_upload_alert.mm",
+    "client_registration.h",
+    "client_registration.mm",
+    "network_stack_setup.h",
+    "network_stack_setup.mm",
+    "provider_registration.h",
+    "provider_registration.mm",
+  ]
+
+  configs += [ "//build/config/compiler:enable_arc" ]
+
+  deps = [
+    ":startup_basic",
+    "//base",
     "//ios/chrome/browser",
     "//ios/chrome/browser:browser_internal",
     "//ios/chrome/browser/web",
@@ -38,7 +57,6 @@
     "//ios/public/provider/chrome/browser",
     "//ios/web",
     "//ios/web/public/app",
-    "//skia",
     ios_provider_target,
   ]
 }

diff --git a/ios/chrome/browser/BUILD.gn b/ios/chrome/browser/BUILD.gn
index de6beb48..7779b47 100644
--- a/ios/chrome/browser/BUILD.gn
+++ b/ios/chrome/browser/BUILD.gn

@@ -8,6 +8,20 @@
 import("//rlz/features/features.gni")
 import("//third_party/protobuf/proto_library.gni")
 
+source_set("chrome_paths") {
+  configs += [ "//build/config/compiler:enable_arc" ]
+  sources = [
+    "chrome_paths.h",
+    "chrome_paths.mm",
+    "chrome_paths_internal.h",
+  ]
+
+  deps = [
+    "//base",
+    "//components/gcm_driver",
+  ]
+}
+
 source_set("browser") {
   configs += [ "//build/config/compiler:enable_arc" ]
   sources = [
@@ -25,9 +39,6 @@
     "chrome_constants.h",
     "chrome_coordinator.h",
     "chrome_coordinator.mm",
-    "chrome_paths.h",
-    "chrome_paths.mm",
-    "chrome_paths_internal.h",
     "chrome_root_coordinator.h",
     "chrome_root_coordinator.mm",
     "chrome_switches.cc",
@@ -66,6 +77,7 @@
     "xcallback_parameters.h",
     "xcallback_parameters.mm",
   ]
+
   deps = [
     ":settings_resources",
     "//base",
@@ -74,7 +86,6 @@
     "//components/dom_distiller/core",
     "//components/flags_ui",
     "//components/flags_ui:switches",
-    "//components/gcm_driver",
     "//components/handoff",
     "//components/keyed_service/core",
     "//components/keyed_service/ios",
@@ -112,6 +123,9 @@
     "//rlz/features",
     "//url",
   ]
+  public_deps = [
+    ":chrome_paths",
+  ]
   allow_circular_includes_from = [
     "//ios/chrome/browser/sync/glue",
     "//ios/chrome/browser/browser_state",

diff --git a/ios/chrome/browser/interstitials/ios_chrome_controller_client.h b/ios/chrome/browser/interstitials/ios_chrome_controller_client.h
index 111d9eee..d508f06 100644
--- a/ios/chrome/browser/interstitials/ios_chrome_controller_client.h
+++ b/ios/chrome/browser/interstitials/ios_chrome_controller_client.h

@@ -37,6 +37,7 @@
   bool CanLaunchDateAndTimeSettings() override;
   void LaunchDateAndTimeSettings() override;
   void GoBack() override;
+  bool CanGoBack() override;
   void GoBackAfterNavigationCommitted() override;
   void Proceed() override;
   void Reload() override;

diff --git a/ios/chrome/browser/interstitials/ios_chrome_controller_client.mm b/ios/chrome/browser/interstitials/ios_chrome_controller_client.mm
index fa640ea..1df9dc0 100644
--- a/ios/chrome/browser/interstitials/ios_chrome_controller_client.mm
+++ b/ios/chrome/browser/interstitials/ios_chrome_controller_client.mm

@@ -45,6 +45,10 @@
   web_interstitial_->DontProceed();
 }
 
+bool IOSChromeControllerClient::CanGoBack() {
+  return web_state_->GetNavigationManager()->CanGoBack();
+}
+
 void IOSChromeControllerClient::GoBackAfterNavigationCommitted() {
   NOTREACHED();
 }

diff --git a/ios/chrome/browser/reading_list/reading_list_model_factory.cc b/ios/chrome/browser/reading_list/reading_list_model_factory.cc
index 98e3eb8..1bfd81a 100644
--- a/ios/chrome/browser/reading_list/reading_list_model_factory.cc
+++ b/ios/chrome/browser/reading_list/reading_list_model_factory.cc

@@ -63,8 +63,7 @@
 
   const syncer::ModelTypeStoreFactory& store_factory =
       browser_sync::ProfileSyncService::GetModelTypeStoreFactory(
-          syncer::READING_LIST, chrome_browser_state->GetStatePath(),
-          web::WebThread::GetBlockingPool());
+          syncer::READING_LIST, chrome_browser_state->GetStatePath());
   std::unique_ptr<ReadingListStore> store = base::MakeUnique<ReadingListStore>(
       store_factory,
       base::Bind(&syncer::ModelTypeChangeProcessor::Create,

diff --git a/ios/chrome/browser/ui/omnibox_perftest.mm b/ios/chrome/browser/ui/omnibox_perftest.mm
index 69e0b80..11400fd8 100644
--- a/ios/chrome/browser/ui/omnibox_perftest.mm
+++ b/ios/chrome/browser/ui/omnibox_perftest.mm

@@ -20,6 +20,7 @@
 #include "ios/chrome/browser/web_state_list/fake_web_state_list_delegate.h"
 #include "ios/chrome/browser/web_state_list/web_state_list.h"
 #include "ios/chrome/test/base/perf_test_ios.h"
+#include "ios/web/public/test/fakes/test_navigation_manager.h"
 #include "ios/web/public/test/fakes/test_web_state.h"
 #include "testing/platform_test.h"
 #import "third_party/ocmock/OCMock/OCMock.h"
@@ -80,6 +81,9 @@
     web_state_list_ = base::MakeUnique<WebStateList>(&web_state_list_delegate_);
     std::unique_ptr<web::TestWebState> web_state =
         base::MakeUnique<web::TestWebState>();
+    std::unique_ptr<web::TestNavigationManager> navigation_manager =
+        base::MakeUnique<web::TestNavigationManager>();
+    web_state->SetNavigationManager(std::move(navigation_manager));
     web_state_list_->InsertWebState(0, std::move(web_state));
 
     // Creates the Toolbar for testing and sizes it to the width of the screen.
@@ -91,10 +95,13 @@
     // The OCMOCK_VALUE macro doesn't like std::unique_ptr, but it works just
     // fine if a temporary variable is used.
     ToolbarModelIOS* model_for_mock = toolbar_model_ios_.get();
+    web::WebState* web_state_for_mock = web_state_list_->GetWebStateAt(0);
     id webToolbarDelegate =
         [OCMockObject niceMockForProtocol:@protocol(WebToolbarDelegate)];
     [[[webToolbarDelegate stub] andReturnValue:OCMOCK_VALUE(model_for_mock)]
         toolbarModelIOS];
+    [[[webToolbarDelegate stub] andReturnValue:OCMOCK_VALUE(web_state_for_mock)]
+        currentWebState];
     id urlLoader = [OCMockObject niceMockForProtocol:@protocol(UrlLoader)];
     toolbar_ = [[WebToolbarController alloc]
         initWithDelegate:webToolbarDelegate
@@ -233,8 +240,7 @@
 
 // Measures the amount of time it takes to type in the first character
 // into the Omnibox.
-// TODO(crbug.com/717309): Test disabled because of nullptr dereferencing.
-TEST_F(OmniboxPerfTest, DISABLED_TestTypeOneCharInTextField) {
+TEST_F(OmniboxPerfTest, TestTypeOneCharInTextField) {
   OmniboxTextFieldIOS* textField = (OmniboxTextFieldIOS*)FindViewByClass(
       [toolbar_ view], [OmniboxTextFieldIOS class]);
   RepeatTimedRuns("Type first character",
@@ -250,8 +256,7 @@
 
 // Measures the amount of time it takes to type in the word "google" one
 // letter at a time.
-// TODO(crbug.com/717309): Test disabled because of nullptr dereferencing.
-TEST_F(OmniboxPerfTest, DISABLED_TestTypingInTextField) {
+TEST_F(OmniboxPerfTest, TestTypingInTextField) {
   OmniboxTextFieldIOS* textField = (OmniboxTextFieldIOS*)FindViewByClass(
       [toolbar_ view], [OmniboxTextFieldIOS class]);
   // The characters to type into the omnibox text field.

diff --git a/ios/chrome/browser/ui/payments/cells/payments_text_item.mm b/ios/chrome/browser/ui/payments/cells/payments_text_item.mm
index 907e97f4..cf937bb 100644
--- a/ios/chrome/browser/ui/payments/cells/payments_text_item.mm
+++ b/ios/chrome/browser/ui/payments/cells/payments_text_item.mm

@@ -120,11 +120,9 @@
   UIView* contentView = self.contentView;
 
   _labelsLeadingAnchorConstraint = [_stackView.leadingAnchor
-      constraintEqualToAnchor:_imageView.trailingAnchor
-                     constant:kHorizontalSpacingBetweenImageAndLabels];
+      constraintEqualToAnchor:_imageView.trailingAnchor];
   _imageLeadingAnchorConstraint = [_imageView.leadingAnchor
-      constraintEqualToAnchor:contentView.leadingAnchor
-                     constant:kHorizontalPadding];
+      constraintEqualToAnchor:contentView.leadingAnchor];
 
   [NSLayoutConstraint activateConstraints:@[
     [_stackView.topAnchor constraintEqualToAnchor:self.contentView.topAnchor],
@@ -152,7 +150,10 @@
   CGFloat preferredMaxLayoutWidth = parentWidth - (2 * kHorizontalPadding);
   if (_imageView.image) {
     preferredMaxLayoutWidth -=
-        kHorizontalSpacingBetweenImageAndLabels - _imageView.image.size.width;
+        kHorizontalSpacingBetweenImageAndLabels + _imageView.image.size.width;
+    _imageLeadingAnchorConstraint.constant = kHorizontalPadding;
+    _labelsLeadingAnchorConstraint.constant =
+        kHorizontalSpacingBetweenImageAndLabels;
   } else {
     _imageLeadingAnchorConstraint.constant = 0;
     _labelsLeadingAnchorConstraint.constant = kHorizontalPadding;

diff --git a/ios/chrome/browser/ui/payments/payment_request_selector_view_controller.mm b/ios/chrome/browser/ui/payments/payment_request_selector_view_controller.mm
index e47d89f..5c9f931 100644
--- a/ios/chrome/browser/ui/payments/payment_request_selector_view_controller.mm
+++ b/ios/chrome/browser/ui/payments/payment_request_selector_view_controller.mm

@@ -148,6 +148,7 @@
       if ([cell isKindOfClass:[PaymentsTextCell class]]) {
         PaymentsTextCell* textCell =
             base::mac::ObjCCastStrict<PaymentsTextCell>(cell);
+        textCell.textLabel.font = [MDCTypography body2Font];
         textCell.textLabel.textColor =
             self.dataSource.state == PaymentRequestSelectorStateError
                 ? [[MDCPalette cr_redPalette] tint600]
@@ -159,10 +160,21 @@
       if ([cell isKindOfClass:[PaymentsTextCell class]]) {
         PaymentsTextCell* textCell =
             base::mac::ObjCCastStrict<PaymentsTextCell>(cell);
+        textCell.textLabel.font = [MDCTypography body2Font];
+        textCell.textLabel.textColor = [[MDCPalette greyPalette] tint900];
+        textCell.detailTextLabel.font = [MDCTypography body1Font];
         textCell.detailTextLabel.textColor = [[MDCPalette greyPalette] tint500];
       }
       break;
     }
+    case ItemTypeAddItem:
+      if ([cell isKindOfClass:[PaymentsTextCell class]]) {
+        PaymentsTextCell* textCell =
+            base::mac::ObjCCastStrict<PaymentsTextCell>(cell);
+        textCell.textLabel.font = [MDCTypography body2Font];
+        textCell.textLabel.textColor = [[MDCPalette greyPalette] tint900];
+      }
+      break;
     default:
       break;
   }

diff --git a/ios/clean/chrome/app/BUILD.gn b/ios/clean/chrome/app/BUILD.gn
index d094a4e8..2966dd8 100644
--- a/ios/clean/chrome/app/BUILD.gn
+++ b/ios/clean/chrome/app/BUILD.gn

@@ -78,6 +78,7 @@
     "//components/crash/core/common",
     "//ios/chrome/app:app_internal",
     "//ios/chrome/app/startup",
+    "//ios/chrome/app/startup:startup_basic",
     "//ios/chrome/browser",
     "//ios/chrome/browser:browser_internal",
     "//ios/chrome/browser/crash_report",

diff --git a/ios/clean/chrome/app/steps/BUILD.gn b/ios/clean/chrome/app/steps/BUILD.gn
index d5cc421..f78ecdc 100644
--- a/ios/clean/chrome/app/steps/BUILD.gn
+++ b/ios/clean/chrome/app/steps/BUILD.gn

@@ -21,6 +21,7 @@
     "//components/content_settings/core/browser",
     "//ios/chrome/app:app_internal",
     "//ios/chrome/app/startup",
+    "//ios/chrome/app/startup:startup_basic",
     "//ios/chrome/browser",
     "//ios/chrome/browser:browser_internal",
     "//ios/chrome/browser/browser_state",

diff --git a/ios/showcase/core/BUILD.gn b/ios/showcase/core/BUILD.gn
index 87344118..cb5c9ca 100644
--- a/ios/showcase/core/BUILD.gn
+++ b/ios/showcase/core/BUILD.gn

@@ -13,7 +13,7 @@
   ]
   deps = [
     "//base",
-    "//ios/chrome/app/startup",
+    "//ios/chrome/app/startup:startup_basic",
     "//ios/showcase/common",
     "//ios/third_party/material_components_ios",
     "//ios/third_party/material_roboto_font_loader_ios",

diff --git a/ios/web/web_state/web_state_impl.h b/ios/web/web_state/web_state_impl.h
index 5d722b4..3ec75465 100644
--- a/ios/web/web_state/web_state_impl.h
+++ b/ios/web/web_state/web_state_impl.h

@@ -41,6 +41,7 @@
 struct ContextMenuParams;
 struct FaviconURL;
 struct LoadCommittedDetails;
+class NavigationContext;
 class NavigationManager;
 class SessionCertificatePolicyCacheImpl;
 class WebInterstitialImpl;
@@ -75,6 +76,9 @@
   // Notifies the observers that a provisional navigation has started.
   void OnProvisionalNavigationStarted(const GURL& url);
 
+  // Called when a navigation is finished.
+  void OnNavigationFinished(web::NavigationContext* context);
+
   // Called when a navigation is committed.
   void OnNavigationCommitted(const GURL& url);
 

diff --git a/ios/web/web_state/web_state_impl.mm b/ios/web/web_state/web_state_impl.mm
index b5a047dc..acd420c1 100644
--- a/ios/web/web_state/web_state_impl.mm
+++ b/ios/web/web_state/web_state_impl.mm

@@ -698,6 +698,11 @@
     observer.ProvisionalNavigationStarted(url);
 }
 
+void WebStateImpl::OnNavigationFinished(web::NavigationContext* context) {
+  for (auto& observer : observers_)
+    observer.DidFinishNavigation(context);
+}
+
 #pragma mark - NavigationManagerDelegate implementation
 
 void WebStateImpl::GoToIndex(int index) {

diff --git a/ios/web/web_state/web_state_impl_unittest.mm b/ios/web/web_state/web_state_impl_unittest.mm
index 9b42537..78627b7 100644
--- a/ios/web/web_state/web_state_impl_unittest.mm
+++ b/ios/web/web_state/web_state_impl_unittest.mm

@@ -27,6 +27,7 @@
 #include "ios/web/public/web_state/web_state_observer.h"
 #import "ios/web/public/web_state/web_state_policy_decider.h"
 #include "ios/web/web_state/global_web_state_event_tracker.h"
+#include "ios/web/web_state/navigation_context_impl.h"
 #import "ios/web/web_state/ui/crw_web_controller.h"
 #include "net/http/http_response_headers.h"
 #include "net/http/http_util.h"
@@ -347,8 +348,24 @@
   EXPECT_EQ(web_state_.get(), observer->render_process_gone_info()->web_state);
 
   // Test that ProvisionalNavigationStarted() is called.
-  ASSERT_FALSE(observer->start_provisional_navigation_info());
+  ASSERT_FALSE(observer->did_finish_navigation_info());
   const GURL url("http://test");
+  std::unique_ptr<web::NavigationContext> context =
+      NavigationContextImpl::CreateNavigationContext(
+          web_state_.get(), url, nullptr /* response_headers */);
+  web_state_->OnNavigationFinished(context.get());
+  ASSERT_TRUE(observer->did_finish_navigation_info());
+  EXPECT_EQ(web_state_.get(),
+            observer->did_finish_navigation_info()->web_state);
+  NavigationContext* actual_context =
+      observer->did_finish_navigation_info()->context.get();
+  EXPECT_EQ(context->GetUrl(), actual_context->GetUrl());
+  EXPECT_FALSE(actual_context->IsSameDocument());
+  EXPECT_FALSE(actual_context->IsErrorPage());
+  EXPECT_FALSE(actual_context->GetResponseHeaders());
+
+  // Test that OnNavigationFinished() is called.
+  ASSERT_FALSE(observer->start_provisional_navigation_info());
   web_state_->OnProvisionalNavigationStarted(url);
   ASSERT_TRUE(observer->start_provisional_navigation_info());
   EXPECT_EQ(web_state_.get(),
@@ -393,19 +410,20 @@
   EXPECT_EQ(web_state_.get(), observer->load_page_info()->web_state);
   EXPECT_TRUE(observer->load_page_info()->success);
 
-  // Test that DidFinishNavigation() is called for same document navigations.
+  // Reset the observer and test that DidFinishNavigation() is called
+  // for same document navigations.
+  observer = base::MakeUnique<TestWebStateObserver>(web_state_.get());
   ASSERT_FALSE(observer->did_finish_navigation_info());
   web_state_->OnSameDocumentNavigation(url);
   ASSERT_TRUE(observer->did_finish_navigation_info());
   EXPECT_EQ(web_state_.get(),
             observer->did_finish_navigation_info()->web_state);
-  NavigationContext* context =
-      observer->did_finish_navigation_info()->context.get();
-  ASSERT_TRUE(context);
-  EXPECT_EQ(url, context->GetUrl());
-  EXPECT_TRUE(context->IsSameDocument());
-  EXPECT_FALSE(context->IsErrorPage());
-  EXPECT_FALSE(context->GetResponseHeaders());
+  actual_context = observer->did_finish_navigation_info()->context.get();
+  ASSERT_TRUE(actual_context);
+  EXPECT_EQ(url, actual_context->GetUrl());
+  EXPECT_TRUE(actual_context->IsSameDocument());
+  EXPECT_FALSE(actual_context->IsErrorPage());
+  EXPECT_FALSE(actual_context->GetResponseHeaders());
 
   // Reset the observer and test that DidFinishNavigation() is called
   // for error navigations.
@@ -415,12 +433,12 @@
   ASSERT_TRUE(observer->did_finish_navigation_info());
   EXPECT_EQ(web_state_.get(),
             observer->did_finish_navigation_info()->web_state);
-  context = observer->did_finish_navigation_info()->context.get();
-  ASSERT_TRUE(context);
-  EXPECT_EQ(url, context->GetUrl());
-  EXPECT_FALSE(context->IsSameDocument());
-  EXPECT_TRUE(context->IsErrorPage());
-  EXPECT_FALSE(context->GetResponseHeaders());
+  actual_context = observer->did_finish_navigation_info()->context.get();
+  ASSERT_TRUE(actual_context);
+  EXPECT_EQ(url, actual_context->GetUrl());
+  EXPECT_FALSE(actual_context->IsSameDocument());
+  EXPECT_TRUE(actual_context->IsErrorPage());
+  EXPECT_FALSE(actual_context->GetResponseHeaders());
 
   // Test that OnTitleChanged() is called.
   ASSERT_FALSE(observer->title_was_set_info());

diff --git a/net/features.gni b/net/features.gni
index 5d71a03..12ba0e01 100644
--- a/net/features.gni
+++ b/net/features.gni

@@ -16,10 +16,11 @@
   enable_websockets = !is_ios
   disable_ftp_support = is_ios || is_chromecast
 
-  # Enable Kerberos authentication. It is disabled by default on ChromeOS, iOS,
+  # Enable Kerberos authentication. It is disabled by default on iOS,
   # Chromecast, at least for now. This feature needs configuration (krb5.conf
-  # and so on).
-  use_kerberos = !is_chromeos && !is_ios && !is_chromecast
+  # and so on). On Chrome OS it is only supported on Active Directory
+  # managed devices.
+  use_kerberos = !is_ios && !is_chromecast
 
   # Do not disable brotli filter by default.
   disable_brotli_filter = false

diff --git a/net/http/http_auth_handler_factory.cc b/net/http/http_auth_handler_factory.cc
index 5a48aa22..0dd89c9 100644
--- a/net/http/http_auth_handler_factory.cc
+++ b/net/http/http_auth_handler_factory.cc

@@ -146,7 +146,11 @@
                             ,
                             std::string()
 #endif
-                                );
+#if defined(OS_CHROMEOS)
+                                ,
+                            true
+#endif
+                            );
   return CreateAuthHandlerRegistryFactory(prefs, host_resolver);
 }
 

diff --git a/net/http/http_auth_handler_negotiate.cc b/net/http/http_auth_handler_negotiate.cc
index e957676f..afe8c00 100644
--- a/net/http/http_auth_handler_negotiate.cc
+++ b/net/http/http_auth_handler_negotiate.cc

@@ -92,7 +92,12 @@
   std::unique_ptr<HttpAuthHandler> tmp_handler(
       new HttpAuthHandlerNegotiate(http_auth_preferences(), resolver_));
 #elif defined(OS_POSIX)
-  if (is_unsupported_)
+  bool allow_gssapi_library_load = true;
+#if defined(OS_CHROMEOS)
+  allow_gssapi_library_load = http_auth_preferences() &&
+                              http_auth_preferences()->AllowGssapiLibraryLoad();
+#endif
+  if (is_unsupported_ || !allow_gssapi_library_load)
     return ERR_UNSUPPORTED_AUTH_SCHEME;
   if (!auth_library_->Init()) {
     is_unsupported_ = true;

diff --git a/net/http/http_auth_preferences.cc b/net/http/http_auth_preferences.cc
index 01df88c2..c9b2d32 100644
--- a/net/http/http_auth_preferences.cc
+++ b/net/http/http_auth_preferences.cc

@@ -15,6 +15,10 @@
     ,
     const std::string& gssapi_library_name
 #endif
+#if defined(OS_CHROMEOS)
+    ,
+    bool allow_gssapi_library_load
+#endif
     )
     : auth_schemes_(auth_schemes.begin(), auth_schemes.end()),
       negotiate_disable_cname_lookup_(false),
@@ -22,6 +26,9 @@
 #if defined(OS_POSIX) && !defined(OS_ANDROID)
       gssapi_library_name_(gssapi_library_name),
 #endif
+#if defined(OS_CHROMEOS)
+      allow_gssapi_library_load_(allow_gssapi_library_load),
+#endif
       security_manager_(URLSecurityManager::Create()) {
 }
 
@@ -49,6 +56,11 @@
   return gssapi_library_name_;
 }
 #endif
+#if defined(OS_CHROMEOS)
+bool HttpAuthPreferences::AllowGssapiLibraryLoad() const {
+  return allow_gssapi_library_load_;
+}
+#endif
 
 bool HttpAuthPreferences::CanUseDefaultCredentials(
     const GURL& auth_origin) const {

diff --git a/net/http/http_auth_preferences.h b/net/http/http_auth_preferences.h
index 4f3a68be..a77b193 100644
--- a/net/http/http_auth_preferences.h
+++ b/net/http/http_auth_preferences.h

@@ -27,6 +27,10 @@
                       ,
                       const std::string& gssapi_library_name
 #endif
+#if defined(OS_CHROMEOS)
+                      ,
+                      bool allow_gssapi_library_load
+#endif
                       );
   virtual ~HttpAuthPreferences();
 
@@ -39,6 +43,9 @@
 #if defined(OS_POSIX) && !defined(OS_ANDROID)
   virtual std::string GssapiLibraryName() const;
 #endif
+#if defined(OS_CHROMEOS)
+  virtual bool AllowGssapiLibraryLoad() const;
+#endif
   virtual bool CanUseDefaultCredentials(const GURL& auth_origin) const;
   virtual bool CanDelegate(const GURL& auth_origin) const;
 
@@ -77,6 +84,9 @@
   // sorts of problems for, for example, active Negotiate transactions.
   const std::string gssapi_library_name_;
 #endif
+#if defined(OS_CHROMEOS)
+  bool allow_gssapi_library_load_;
+#endif
   std::unique_ptr<URLSecurityManager> security_manager_;
   DISALLOW_COPY_AND_ASSIGN(HttpAuthPreferences);
 };

diff --git a/net/http/http_auth_preferences_unittest.cc b/net/http/http_auth_preferences_unittest.cc
index e975b0c..f59f00f 100644
--- a/net/http/http_auth_preferences_unittest.cc
+++ b/net/http/http_auth_preferences_unittest.cc

@@ -24,6 +24,10 @@
                                             ,
                                             ""
 #endif
+#if defined(OS_CHROMEOS)
+                                            ,
+                                            true
+#endif
                                             );
   EXPECT_TRUE(http_auth_preferences.IsSupportedScheme("scheme1"));
   EXPECT_TRUE(http_auth_preferences.IsSupportedScheme("scheme2"));
@@ -37,6 +41,10 @@
                                             ,
                                             ""
 #endif
+#if defined(OS_CHROMEOS)
+                                            ,
+                                            true
+#endif
                                             );
   EXPECT_FALSE(http_auth_preferences.NegotiateDisableCnameLookup());
   http_auth_preferences.set_negotiate_disable_cname_lookup(true);
@@ -50,6 +58,10 @@
                                             ,
                                             ""
 #endif
+#if defined(OS_CHROMEOS)
+                                            ,
+                                            true
+#endif
                                             );
   EXPECT_FALSE(http_auth_preferences.NegotiateEnablePort());
   http_auth_preferences.set_negotiate_enable_port(true);
@@ -64,6 +76,10 @@
                                             ,
                                             ""
 #endif
+#if defined(OS_CHROMEOS)
+                                            ,
+                                            true
+#endif
                                             );
   EXPECT_EQ(std::string(),
             http_auth_preferences.AuthAndroidNegotiateAccountType());
@@ -76,11 +92,32 @@
 #if defined(OS_POSIX) && !defined(OS_ANDROID)
 TEST(HttpAuthPreferencesTest, GssApiLibraryName) {
   std::vector<std::string> AuthSchemes;
-  HttpAuthPreferences http_auth_preferences(AuthSchemes, "bar");
+  HttpAuthPreferences http_auth_preferences(AuthSchemes, "bar"
+#if defined(OS_CHROMEOS)
+                                            ,
+                                            true
+#endif
+                                            );
   EXPECT_EQ(std::string("bar"), http_auth_preferences.GssapiLibraryName());
 }
 #endif
 
+#if defined(OS_CHROMEOS)
+TEST(HttpAuthPreferencesTest, AllowGssapiLibraryLoadTrue) {
+  std::vector<std::string> AuthSchemes;
+  HttpAuthPreferences http_auth_preferences(AuthSchemes, "foo", true);
+  EXPECT_TRUE(http_auth_preferences.AllowGssapiLibraryLoad());
+}
+#endif
+
+#if defined(OS_CHROMEOS)
+TEST(HttpAuthPreferencesTest, AllowGssapiLibraryLoadFalse) {
+  std::vector<std::string> AuthSchemes;
+  HttpAuthPreferences http_auth_preferences(AuthSchemes, "foo", false);
+  EXPECT_FALSE(http_auth_preferences.AllowGssapiLibraryLoad());
+}
+#endif
+
 TEST(HttpAuthPreferencesTest, AuthServerWhitelist) {
   std::vector<std::string> auth_schemes;
   HttpAuthPreferences http_auth_preferences(auth_schemes
@@ -88,6 +125,10 @@
                                             ,
                                             ""
 #endif
+#if defined(OS_CHROMEOS)
+                                            ,
+                                            true
+#endif
                                             );
   // Check initial value
   EXPECT_FALSE(http_auth_preferences.CanUseDefaultCredentials(GURL("abc")));
@@ -102,6 +143,10 @@
                                             ,
                                             ""
 #endif
+#if defined(OS_CHROMEOS)
+                                            ,
+                                            true
+#endif
                                             );
   // Check initial value
   EXPECT_FALSE(http_auth_preferences.CanDelegate(GURL("abc")));

diff --git a/net/http/mock_allow_http_auth_preferences.cc b/net/http/mock_allow_http_auth_preferences.cc
index 8951139..37539e5 100644
--- a/net/http/mock_allow_http_auth_preferences.cc
+++ b/net/http/mock_allow_http_auth_preferences.cc

@@ -12,7 +12,11 @@
                               ,
                           std::string()
 #endif
-                              ) {
+#if defined(OS_CHROMEOS)
+                              ,
+                          true
+#endif
+                          ) {
 }
 
 MockAllowHttpAuthPreferences::~MockAllowHttpAuthPreferences() {}

diff --git a/net/quic/chromium/bidirectional_stream_quic_impl.cc b/net/quic/chromium/bidirectional_stream_quic_impl.cc
index ca231ba..6309e84 100644
--- a/net/quic/chromium/bidirectional_stream_quic_impl.cc
+++ b/net/quic/chromium/bidirectional_stream_quic_impl.cc

@@ -35,7 +35,6 @@
       closed_stream_sent_bytes_(0),
       closed_is_first_stream_(false),
       has_sent_headers_(false),
-      has_received_headers_(false),
       send_request_headers_automatically_(true),
       weak_factory_(this) {}
 
@@ -228,21 +227,23 @@
   return true;
 }
 
-void BidirectionalStreamQuicImpl::OnHeadersAvailable(
+void BidirectionalStreamQuicImpl::OnInitialHeadersAvailable(
     const SpdyHeaderBlock& headers,
     size_t frame_len) {
   headers_bytes_received_ += frame_len;
   negotiated_protocol_ = kProtoQUIC;
-  if (!has_received_headers_) {
-    has_received_headers_ = true;
-    connect_timing_ = session_->GetConnectTiming();
-    if (delegate_)
-      delegate_->OnHeadersReceived(headers);
-  } else {
-    if (delegate_)
-      delegate_->OnTrailersReceived(headers);
-    // |this| can be destroyed after this point.
-  }
+  connect_timing_ = session_->GetConnectTiming();
+  if (delegate_)
+    delegate_->OnHeadersReceived(headers);
+}
+
+void BidirectionalStreamQuicImpl::OnTrailingHeadersAvailable(
+    const SpdyHeaderBlock& headers,
+    size_t frame_len) {
+  headers_bytes_received_ += frame_len;
+  if (delegate_)
+    delegate_->OnTrailersReceived(headers);
+  // |this| can be destroyed after this point.
 }
 
 void BidirectionalStreamQuicImpl::OnDataAvailable() {
@@ -292,8 +293,7 @@
   DCHECK_NE(ERR_IO_PENDING, rv);
   DCHECK(rv == OK || !stream_);
   if (rv == OK) {
-    stream_ = session_->ReleaseStream();
-    stream_->SetDelegate(this);
+    stream_ = session_->ReleaseStream(this);
     NotifyStreamReady();
   } else {
     NotifyError(rv);

diff --git a/net/quic/chromium/bidirectional_stream_quic_impl.h b/net/quic/chromium/bidirectional_stream_quic_impl.h
index 4729d7f..e9f58509 100644
--- a/net/quic/chromium/bidirectional_stream_quic_impl.h
+++ b/net/quic/chromium/bidirectional_stream_quic_impl.h

@@ -58,9 +58,11 @@
 
  private:
   // QuicChromiumClientStream::Delegate implementation:
-  void OnHeadersAvailable(const SpdyHeaderBlock& headers,
-                          size_t frame_len) override;
+  void OnInitialHeadersAvailable(const SpdyHeaderBlock& headers,
+                                 size_t frame_len) override;
   void OnDataAvailable() override;
+  void OnTrailingHeadersAvailable(const SpdyHeaderBlock& headers,
+                                  size_t frame_len) override;
   void OnClose() override;
   void OnError(int error) override;
 
@@ -111,8 +113,6 @@
   bool closed_is_first_stream_;
   // Indicates whether initial headers have been sent.
   bool has_sent_headers_;
-  // Indicates whether initial headers have been received.
-  bool has_received_headers_;
 
   // Whether to automatically send request headers when stream is negotiated.
   // If false, headers will not be sent until SendRequestHeaders() is called or

diff --git a/net/quic/chromium/quic_chromium_client_session.cc b/net/quic/chromium/quic_chromium_client_session.cc
index 042fb5a..6d46a32 100644
--- a/net/quic/chromium/quic_chromium_client_session.cc
+++ b/net/quic/chromium/quic_chromium_client_session.cc

@@ -301,10 +301,11 @@
   return stream_request_->StartRequest(callback);
 }
 
-QuicChromiumClientStream* QuicChromiumClientSession::Handle::ReleaseStream() {
+QuicChromiumClientStream* QuicChromiumClientSession::Handle::ReleaseStream(
+    QuicChromiumClientStream::Delegate* delegate) {
   DCHECK(stream_request_);
 
-  auto* stream = stream_request_->ReleaseStream();
+  auto* stream = stream_request_->ReleaseStream(delegate);
   stream_request_.reset();
   return stream;
 }
@@ -376,10 +377,12 @@
 }
 
 QuicChromiumClientStream*
-QuicChromiumClientSession::StreamRequest::ReleaseStream() {
+QuicChromiumClientSession::StreamRequest::ReleaseStream(
+    QuicChromiumClientStream::Delegate* delegate) {
   DCHECK(stream_);
   QuicChromiumClientStream* stream = stream_;
   stream_ = nullptr;
+  stream->SetDelegate(delegate);
   return stream;
 }
 

diff --git a/net/quic/chromium/quic_chromium_client_session.h b/net/quic/chromium/quic_chromium_client_session.h
index a7e191214..35a05fa 100644
--- a/net/quic/chromium/quic_chromium_client_session.h
+++ b/net/quic/chromium/quic_chromium_client_session.h

@@ -90,8 +90,9 @@
     int RequestStream(bool requires_confirmation,
                       const CompletionCallback& callback);
 
-    // Releases |stream_| to the caller.
-    QuicChromiumClientStream* ReleaseStream();
+    // Releases |stream_| to the caller and sets |delegate| on it.
+    QuicChromiumClientStream* ReleaseStream(
+        QuicChromiumClientStream::Delegate* delegate);
 
     // Sends Rst for the stream, and makes sure that future calls to
     // IsClosedStream(id) return true, which ensures that any subsequent
@@ -192,8 +193,9 @@
     // complete |callback| will be called.
     int StartRequest(const CompletionCallback& callback);
 
-    // Releases |stream_| to the caller
-    QuicChromiumClientStream* ReleaseStream();
+    // Releases |stream_| to the caller and sets |delegate| on it.
+    QuicChromiumClientStream* ReleaseStream(
+        QuicChromiumClientStream::Delegate* delegate);
 
    private:
     friend class QuicChromiumClientSession;

diff --git a/net/quic/chromium/quic_chromium_client_session_test.cc b/net/quic/chromium/quic_chromium_client_session_test.cc
index f1a3e30..1420732b 100644
--- a/net/quic/chromium/quic_chromium_client_session_test.cc
+++ b/net/quic/chromium/quic_chromium_client_session_test.cc

@@ -64,9 +64,9 @@
 
   MOCK_METHOD0(OnSendData, int());
   MOCK_METHOD2(OnSendDataComplete, int(int, bool*));
-  MOCK_METHOD2(OnHeadersAvailable,
+  MOCK_METHOD2(OnInitialHeadersAvailable,
                void(const SpdyHeaderBlock& headers, size_t frame_len));
-  MOCK_METHOD2(OnHeadersAvailableMock,
+  MOCK_METHOD2(OnTrailingHeadersAvailable,
                void(const SpdyHeaderBlock& headers, size_t frame_len));
   MOCK_METHOD2(OnDataReceived, int(const char*, int));
   MOCK_METHOD0(OnDataAvailable, void());
@@ -178,6 +178,7 @@
   MockCryptoClientStreamFactory crypto_client_stream_factory_;
   QuicClientPushPromiseIndex push_promise_index_;
   QuicServerId server_id_;
+  MockStreamDelegate delegate_;
   std::unique_ptr<QuicChromiumClientSession> session_;
   TestServerPushDelegate test_push_delegate_;
   QuicConnectionVisitorInterface* visitor_;
@@ -239,7 +240,7 @@
   TestCompletionCallback callback;
   ASSERT_EQ(OK, handle->RequestStream(/*requires_confirmation=*/false,
                                       callback.callback()));
-  EXPECT_TRUE(handle->ReleaseStream() != nullptr);
+  EXPECT_TRUE(handle->ReleaseStream(&delegate_) != nullptr);
 
   quic_data.Resume();
   EXPECT_TRUE(quic_data.AllReadDataConsumed());
@@ -301,7 +302,7 @@
   TestCompletionCallback callback;
   ASSERT_EQ(OK, handle->RequestStream(/*requires_confirmation=*/false,
                                       callback.callback()));
-  EXPECT_TRUE(handle->ReleaseStream() != nullptr);
+  EXPECT_TRUE(handle->ReleaseStream(&delegate_) != nullptr);
 
   quic_data.Resume();
   EXPECT_TRUE(quic_data.AllReadDataConsumed());
@@ -324,7 +325,7 @@
   TestCompletionCallback callback;
   ASSERT_EQ(OK, handle->RequestStream(/*requires_confirmation=*/true,
                                       callback.callback()));
-  EXPECT_TRUE(handle->ReleaseStream() != nullptr);
+  EXPECT_TRUE(handle->ReleaseStream(&delegate_) != nullptr);
 
   quic_data.Resume();
   EXPECT_TRUE(quic_data.AllReadDataConsumed());
@@ -352,7 +353,7 @@
 
   EXPECT_THAT(callback.WaitForResult(), IsOk());
 
-  EXPECT_TRUE(handle->ReleaseStream() != nullptr);
+  EXPECT_TRUE(handle->ReleaseStream(&delegate_) != nullptr);
 
   quic_data.Resume();
   EXPECT_TRUE(quic_data.AllReadDataConsumed());
@@ -418,7 +419,7 @@
   session_->OnRstStream(rst);
   ASSERT_TRUE(callback.have_result());
   EXPECT_THAT(callback.WaitForResult(), IsOk());
-  EXPECT_TRUE(handle->ReleaseStream() != nullptr);
+  EXPECT_TRUE(handle->ReleaseStream(&delegate_) != nullptr);
 
   quic_data.Resume();
   EXPECT_TRUE(quic_data.AllReadDataConsumed());
@@ -923,7 +924,7 @@
   session_->OnRstStream(rst1);
   ASSERT_TRUE(callback.have_result());
   EXPECT_THAT(callback.WaitForResult(), IsOk());
-  EXPECT_TRUE(handle->ReleaseStream() != nullptr);
+  EXPECT_TRUE(handle->ReleaseStream(&delegate_) != nullptr);
 }
 
 TEST_P(QuicChromiumClientSessionTest, GoAwayReceived) {

diff --git a/net/quic/chromium/quic_chromium_client_stream.cc b/net/quic/chromium/quic_chromium_client_stream.cc
index 8782b9a..15f46431 100644
--- a/net/quic/chromium/quic_chromium_client_stream.cc
+++ b/net/quic/chromium/quic_chromium_client_stream.cc

@@ -60,7 +60,8 @@
 
   if (delegate_) {
     // The delegate will receive the headers via a posted task.
-    NotifyDelegateOfHeadersCompleteLater(std::move(header_block), frame_len);
+    NotifyDelegateOfInitialHeadersAvailableLater(std::move(header_block),
+                                                 frame_len);
     return;
   }
 
@@ -74,7 +75,8 @@
     size_t frame_len,
     const QuicHeaderList& header_list) {
   QuicSpdyStream::OnTrailingHeadersComplete(fin, frame_len, header_list);
-  NotifyDelegateOfHeadersCompleteLater(received_trailers().Clone(), frame_len);
+  NotifyDelegateOfTrailingHeadersAvailableLater(received_trailers().Clone(),
+                                                frame_len);
 }
 
 void QuicChromiumClientStream::OnPromiseHeaderList(
@@ -199,8 +201,8 @@
 
   // Should this perhaps be via PostTask to make reasoning simpler?
   if (!initial_headers_.empty()) {
-    delegate_->OnHeadersAvailable(std::move(initial_headers_),
-                                  initial_headers_frame_len_);
+    delegate_->OnInitialHeadersAvailable(std::move(initial_headers_),
+                                         initial_headers_frame_len_);
   }
 }
 
@@ -228,38 +230,61 @@
   return bytes_read;
 }
 
-void QuicChromiumClientStream::NotifyDelegateOfHeadersCompleteLater(
+void QuicChromiumClientStream::NotifyDelegateOfInitialHeadersAvailableLater(
     SpdyHeaderBlock headers,
     size_t frame_len) {
   DCHECK(delegate_);
   base::ThreadTaskRunnerHandle::Get()->PostTask(
       FROM_HERE,
-      base::Bind(&QuicChromiumClientStream::NotifyDelegateOfHeadersComplete,
-                 weak_factory_.GetWeakPtr(), base::Passed(std::move(headers)),
-                 frame_len));
+      base::Bind(
+          &QuicChromiumClientStream::NotifyDelegateOfInitialHeadersAvailable,
+          weak_factory_.GetWeakPtr(), base::Passed(std::move(headers)),
+          frame_len));
 }
 
-void QuicChromiumClientStream::NotifyDelegateOfHeadersComplete(
+void QuicChromiumClientStream::NotifyDelegateOfInitialHeadersAvailable(
     SpdyHeaderBlock headers,
     size_t frame_len) {
   if (!delegate_)
     return;
-  // Only mark trailers consumed when we are about to notify delegate.
-  if (headers_delivered_) {
-    MarkTrailersConsumed();
-    // Post an async task to notify delegate of the FIN flag.
-    NotifyDelegateOfDataAvailableLater();
-    net_log_.AddEvent(
-        NetLogEventType::QUIC_CHROMIUM_CLIENT_STREAM_READ_RESPONSE_TRAILERS,
-        base::Bind(&SpdyHeaderBlockNetLogCallback, &headers));
-  } else {
-    headers_delivered_ = true;
-    net_log_.AddEvent(
-        NetLogEventType::QUIC_CHROMIUM_CLIENT_STREAM_READ_RESPONSE_HEADERS,
-        base::Bind(&SpdyHeaderBlockNetLogCallback, &headers));
-  }
 
-  delegate_->OnHeadersAvailable(headers, frame_len);
+  DCHECK(!headers_delivered_);
+  headers_delivered_ = true;
+  net_log_.AddEvent(
+      NetLogEventType::QUIC_CHROMIUM_CLIENT_STREAM_READ_RESPONSE_HEADERS,
+      base::Bind(&SpdyHeaderBlockNetLogCallback, &headers));
+
+  delegate_->OnInitialHeadersAvailable(headers, frame_len);
+}
+
+void QuicChromiumClientStream::NotifyDelegateOfTrailingHeadersAvailableLater(
+    SpdyHeaderBlock headers,
+    size_t frame_len) {
+  DCHECK(delegate_);
+  base::ThreadTaskRunnerHandle::Get()->PostTask(
+      FROM_HERE,
+      base::Bind(
+          &QuicChromiumClientStream::NotifyDelegateOfTrailingHeadersAvailable,
+          weak_factory_.GetWeakPtr(), base::Passed(std::move(headers)),
+          frame_len));
+}
+
+void QuicChromiumClientStream::NotifyDelegateOfTrailingHeadersAvailable(
+    SpdyHeaderBlock headers,
+    size_t frame_len) {
+  if (!delegate_)
+    return;
+
+  DCHECK(headers_delivered_);
+  // Only mark trailers consumed when we are about to notify delegate.
+  MarkTrailersConsumed();
+  // Post an async task to notify delegate of the FIN flag.
+  NotifyDelegateOfDataAvailableLater();
+  net_log_.AddEvent(
+      NetLogEventType::QUIC_CHROMIUM_CLIENT_STREAM_READ_RESPONSE_TRAILERS,
+      base::Bind(&SpdyHeaderBlockNetLogCallback, &headers));
+
+  delegate_->OnTrailingHeadersAvailable(headers, frame_len);
 }
 
 void QuicChromiumClientStream::NotifyDelegateOfDataAvailableLater() {

diff --git a/net/quic/chromium/quic_chromium_client_stream.h b/net/quic/chromium/quic_chromium_client_stream.h
index ce47b64..d65f2e5 100644
--- a/net/quic/chromium/quic_chromium_client_stream.h
+++ b/net/quic/chromium/quic_chromium_client_stream.h

@@ -37,9 +37,13 @@
    public:
     Delegate() {}
 
-    // Called when headers are available.
-    virtual void OnHeadersAvailable(const SpdyHeaderBlock& headers,
-                                    size_t frame_len) = 0;
+    // Called when initial headers are available.
+    virtual void OnInitialHeadersAvailable(const SpdyHeaderBlock& headers,
+                                           size_t frame_len) = 0;
+
+    // Called when trailing headers are available.
+    virtual void OnTrailingHeadersAvailable(const SpdyHeaderBlock& headers,
+                                            size_t frame_len) = 0;
 
     // Called when data is available to be read.
     virtual void OnDataAvailable() = 0;
@@ -120,10 +124,14 @@
   using QuicStream::sequencer;
 
  private:
-  void NotifyDelegateOfHeadersCompleteLater(SpdyHeaderBlock headers,
-                                            size_t frame_len);
-  void NotifyDelegateOfHeadersComplete(SpdyHeaderBlock headers,
-                                       size_t frame_len);
+  void NotifyDelegateOfInitialHeadersAvailableLater(SpdyHeaderBlock headers,
+                                                    size_t frame_len);
+  void NotifyDelegateOfInitialHeadersAvailable(SpdyHeaderBlock headers,
+                                               size_t frame_len);
+  void NotifyDelegateOfTrailingHeadersAvailableLater(SpdyHeaderBlock headers,
+                                                     size_t frame_len);
+  void NotifyDelegateOfTrailingHeadersAvailable(SpdyHeaderBlock headers,
+                                                size_t frame_len);
   void NotifyDelegateOfDataAvailableLater();
   void NotifyDelegateOfDataAvailable();
 

diff --git a/net/quic/chromium/quic_chromium_client_stream_test.cc b/net/quic/chromium/quic_chromium_client_stream_test.cc
index 1b397b1..4efac81 100644
--- a/net/quic/chromium/quic_chromium_client_stream_test.cc
+++ b/net/quic/chromium/quic_chromium_client_stream_test.cc

@@ -44,12 +44,19 @@
 
   MOCK_METHOD0(OnSendData, int());
   MOCK_METHOD2(OnSendDataComplete, int(int, bool*));
-  void OnHeadersAvailable(const SpdyHeaderBlock& headers,
-                          size_t frame_len) override {
+  void OnInitialHeadersAvailable(const SpdyHeaderBlock& headers,
+                                 size_t frame_len) override {
     headers_ = headers.Clone();
-    OnHeadersAvailableMock(headers, frame_len);
+    OnInitialHeadersAvailableMock(headers, frame_len);
   }
-  MOCK_METHOD2(OnHeadersAvailableMock,
+  MOCK_METHOD2(OnInitialHeadersAvailableMock,
+               void(const SpdyHeaderBlock& headers, size_t frame_len));
+  void OnTrailingHeadersAvailable(const SpdyHeaderBlock& headers,
+                                  size_t frame_len) override {
+    trailers_ = headers.Clone();
+    OnTrailingHeadersAvailableMock(headers, frame_len);
+  }
+  MOCK_METHOD2(OnTrailingHeadersAvailableMock,
                void(const SpdyHeaderBlock& headers, size_t frame_len));
   MOCK_METHOD2(OnDataReceived, int(const char*, int));
   MOCK_METHOD0(OnDataAvailable, void());
@@ -58,6 +65,7 @@
   MOCK_METHOD0(HasSendHeadersComplete, bool());
 
   SpdyHeaderBlock headers_;
+  SpdyHeaderBlock trailers_;
 
  private:
   DISALLOW_COPY_AND_ASSIGN(MockDelegate);
@@ -253,8 +261,8 @@
 
   QuicHeaderList ProcessHeadersFull(const SpdyHeaderBlock& headers) {
     QuicHeaderList h = ProcessHeaders(headers);
-    EXPECT_CALL(delegate_,
-                OnHeadersAvailableMock(_, h.uncompressed_header_bytes()));
+    EXPECT_CALL(delegate_, OnInitialHeadersAvailableMock(
+                               _, h.uncompressed_header_bytes()));
     base::RunLoop().RunUntilIdle();
     EXPECT_EQ(headers, delegate_.headers_);
     EXPECT_TRUE(stream_->header_list().empty());
@@ -377,7 +385,7 @@
   auto t = ProcessTrailers(trailers);
   base::RunLoop run_loop;
   EXPECT_CALL(delegate_,
-              OnHeadersAvailableMock(_, t.uncompressed_header_bytes()))
+              OnTrailingHeadersAvailableMock(_, t.uncompressed_header_bytes()))
       .WillOnce(testing::InvokeWithoutArgs([&run_loop]() { run_loop.Quit(); }));
 
   run_loop.Run();
@@ -395,7 +403,7 @@
 
   // Make sure kFinalOffsetHeaderKey is gone from the delivered actual trailers.
   trailers.erase(kFinalOffsetHeaderKey);
-  EXPECT_EQ(trailers, delegate_.headers_);
+  EXPECT_EQ(trailers, delegate_.trailers_);
   base::RunLoop().RunUntilIdle();
   EXPECT_CALL(delegate_, OnClose());
 }
@@ -434,7 +442,7 @@
 
   base::RunLoop run_loop2;
   EXPECT_CALL(delegate_,
-              OnHeadersAvailableMock(_, t.uncompressed_header_bytes()))
+              OnTrailingHeadersAvailableMock(_, t.uncompressed_header_bytes()))
       .WillOnce(
           testing::InvokeWithoutArgs([&run_loop2]() { run_loop2.Quit(); }));
 
@@ -456,7 +464,7 @@
   EXPECT_TRUE(stream_->IsDoneReading());
   // Make sure kFinalOffsetHeaderKey is gone from the delivered actual trailers.
   trailers.erase(kFinalOffsetHeaderKey);
-  EXPECT_EQ(trailers, delegate_.headers_);
+  EXPECT_EQ(trailers, delegate_.trailers_);
 
   base::RunLoop().RunUntilIdle();
   EXPECT_CALL(delegate_, OnClose());
@@ -501,7 +509,7 @@
 
   base::RunLoop run_loop2;
   EXPECT_CALL(delegate_,
-              OnHeadersAvailableMock(_, t.uncompressed_header_bytes()))
+              OnTrailingHeadersAvailableMock(_, t.uncompressed_header_bytes()))
       .WillOnce(
           testing::InvokeWithoutArgs([&run_loop2]() { run_loop2.Quit(); }));
 
@@ -523,7 +531,7 @@
 
   // Make sure kFinalOffsetHeaderKey is gone from the delivered actual trailers.
   trailers.erase(kFinalOffsetHeaderKey);
-  EXPECT_EQ(trailers, delegate_.headers_);
+  EXPECT_EQ(trailers, delegate_.trailers_);
 
   base::RunLoop().RunUntilIdle();
   EXPECT_CALL(delegate_, OnClose());
@@ -630,7 +638,7 @@
   EXPECT_TRUE(delegate2_.headers_.empty());
 
   // Now set the delegate and verify that the headers are delivered.
-  EXPECT_CALL(delegate2_, OnHeadersAvailableMock(
+  EXPECT_CALL(delegate2_, OnInitialHeadersAvailableMock(
                               _, header_list.uncompressed_header_bytes()));
   stream2->SetDelegate(&delegate2_);
   base::RunLoop().RunUntilIdle();
@@ -662,7 +670,7 @@
 
   // Now set the delegate and verify that the headers are delivered, but
   // not the data, which needs to be read explicitly.
-  EXPECT_CALL(delegate2_, OnHeadersAvailableMock(
+  EXPECT_CALL(delegate2_, OnInitialHeadersAvailableMock(
                               _, header_list.uncompressed_header_bytes()));
   stream2->SetDelegate(&delegate2_);
   base::RunLoop().RunUntilIdle();

diff --git a/net/quic/chromium/quic_http_stream.cc b/net/quic/chromium/quic_http_stream.cc
index 36e9118..e28f01f 100644
--- a/net/quic/chromium/quic_http_stream.cc
+++ b/net/quic/chromium/quic_http_stream.cc

@@ -433,27 +433,31 @@
   priority_ = priority;
 }
 
-void QuicHttpStream::OnHeadersAvailable(const SpdyHeaderBlock& headers,
-                                        size_t frame_len) {
+void QuicHttpStream::OnInitialHeadersAvailable(const SpdyHeaderBlock& headers,
+                                               size_t frame_len) {
+  DCHECK(!response_headers_received_);
   headers_bytes_received_ += frame_len;
 
-  // QuicHttpStream ignores trailers.
-  if (response_headers_received_) {
-    if (stream_->IsDoneReading()) {
-      // Close the read side. If the write side has been closed, this will
-      // invoke QuicHttpStream::OnClose to reset the stream.
-      stream_->OnFinRead();
-      SetResponseStatus(OK);
-    }
-    return;
-  }
-
   int rv = ProcessResponseHeaders(headers);
   if (rv != ERR_IO_PENDING && !callback_.is_null()) {
     DoCallback(rv);
   }
 }
 
+void QuicHttpStream::OnTrailingHeadersAvailable(const SpdyHeaderBlock& headers,
+                                                size_t frame_len) {
+  DCHECK(response_headers_received_);
+  headers_bytes_received_ += frame_len;
+
+  // QuicHttpStream ignores trailers.
+  if (stream_->IsDoneReading()) {
+    // Close the read side. If the write side has been closed, this will
+    // invoke QuicHttpStream::OnClose to reset the stream.
+    stream_->OnFinRead();
+    SetResponseStatus(OK);
+  }
+}
+
 void QuicHttpStream::OnDataAvailable() {
   if (callback_.is_null()) {
     // Data is available, but can't be delivered
@@ -593,8 +597,7 @@
     return GetResponseStatus();
   }
 
-  stream_ = quic_session()->ReleaseStream();
-  stream_->SetDelegate(this);
+  stream_ = quic_session()->ReleaseStream(this);
   if (request_info_->load_flags & LOAD_DISABLE_CONNECTION_MIGRATION) {
     stream_->DisableConnectionMigration();
   }

diff --git a/net/quic/chromium/quic_http_stream.h b/net/quic/chromium/quic_http_stream.h
index 83d07763..fe240f8 100644
--- a/net/quic/chromium/quic_http_stream.h
+++ b/net/quic/chromium/quic_http_stream.h

@@ -69,9 +69,11 @@
   void SetPriority(RequestPriority priority) override;
 
   // QuicChromiumClientStream::Delegate implementation
-  void OnHeadersAvailable(const SpdyHeaderBlock& headers,
-                          size_t frame_len) override;
+  void OnInitialHeadersAvailable(const SpdyHeaderBlock& headers,
+                                 size_t frame_len) override;
   void OnDataAvailable() override;
+  void OnTrailingHeadersAvailable(const SpdyHeaderBlock& headers,
+                                  size_t frame_len) override;
   void OnClose() override;
   void OnError(int error) override;
 

diff --git a/net/quic/chromium/quic_http_stream_test.cc b/net/quic/chromium/quic_http_stream_test.cc
index 8ee621c..1b8af58 100644
--- a/net/quic/chromium/quic_http_stream_test.cc
+++ b/net/quic/chromium/quic_http_stream_test.cc

@@ -107,8 +107,13 @@
       HttpServerProperties* http_server_properties)
       : QuicHttpStream(std::move(session), http_server_properties) {}
 
-  void OnHeadersAvailable(const SpdyHeaderBlock& headers,
-                          size_t frame_len) override {
+  void OnInitialHeadersAvailable(const SpdyHeaderBlock& headers,
+                                 size_t frame_len) override {
+    Close(false);
+  }
+
+  void OnTrailingHeadersAvailable(const SpdyHeaderBlock& headers,
+                                  size_t frame_len) override {
     Close(false);
   }
 

diff --git a/net/reporting/reporting_browsing_data_remover.h b/net/reporting/reporting_browsing_data_remover.h
index 77eda2b..0c89885c 100644
--- a/net/reporting/reporting_browsing_data_remover.h
+++ b/net/reporting/reporting_browsing_data_remover.h

@@ -35,6 +35,10 @@
   // which types of data to remove: reports queued by browser features and/or
   // clients (endpoints configured by origins). |origin_filter|, if not null,
   // specifies which origins' data to remove.
+  //
+  // Note: Currently this does not clear the endpoint backoff data in
+  // ReportingEndpointManager because that's not persisted to disk. If it's ever
+  // persisted, it will need to be cleared as well.
   virtual void RemoveBrowsingData(
       int data_type_mask,
       base::Callback<bool(const GURL&)> origin_filter) = 0;

diff --git a/net/reporting/reporting_endpoint_manager.h b/net/reporting/reporting_endpoint_manager.h
index e3cc827..d8c9be0 100644
--- a/net/reporting/reporting_endpoint_manager.h
+++ b/net/reporting/reporting_endpoint_manager.h

@@ -72,6 +72,10 @@
   ReportingContext* context_;
 
   std::set<GURL> pending_endpoints_;
+
+  // Note: Currently the ReportingBrowsingDataRemover does not clear this data
+  // because it's not persisted to disk. If it's ever persisted, it will need
+  // to be cleared as well.
   std::map<GURL, std::unique_ptr<net::BackoffEntry>> endpoint_backoff_;
 
   DISALLOW_COPY_AND_ASSIGN(ReportingEndpointManager);

diff --git a/services/service_manager/embedder/main.cc b/services/service_manager/embedder/main.cc
index f976be1..d20bb676 100644
--- a/services/service_manager/embedder/main.cc
+++ b/services/service_manager/embedder/main.cc

@@ -339,6 +339,19 @@
 #endif
   base::EnableTerminationOnOutOfMemory();
 
+#if defined(OS_LINUX)
+  // The various desktop environments set this environment variable that allows
+  // the dbus client library to connect directly to the bus. When this variable
+  // is not set (test environments like xvfb-run), the dbus client library will
+  // fall back to auto-launch mode. Auto-launch is dangerous as it can cause
+  // hangs (crbug.com/715658) . This one line disables the dbus auto-launch,
+  // by clobbering the DBUS_SESSION_BUS_ADDRESS env variable if not already set.
+  // The old auto-launch behavior, if needed, can be restored by setting
+  // DBUS_SESSION_BUS_ADDRESS="autolaunch:" before launching chrome.
+  const int kNoOverrideIfAlreadySet = 0;
+  setenv("DBUS_SESSION_BUS_ADDRESS", "disabled:", kNoOverrideIfAlreadySet);
+#endif
+
 #if defined(OS_WIN)
   base::win::RegisterInvalidParamHandler();
   ui::win::CreateATLModuleIfNeeded();

diff --git a/testing/buildbot/chromium.perf.json b/testing/buildbot/chromium.perf.json
index d573d97f..c66990f 100644
--- a/testing/buildbot/chromium.perf.json
+++ b/testing/buildbot/chromium.perf.json

@@ -916,6 +916,26 @@
         }
       },
       {
+        "args": [],
+        "isolate_name": "cc_perftests",
+        "name": "cc_perftests",
+        "swarming": {
+          "can_use_on_swarming_builders": true,
+          "dimension_sets": [
+            {
+              "android_devices": "1",
+              "id": "build73-b1--device2",
+              "os": "Android",
+              "pool": "Chrome-perf"
+            }
+          ],
+          "expiration": 36000,
+          "hard_timeout": 7200,
+          "ignore_task_failure": false,
+          "io_timeout": 3600
+        }
+      },
+      {
         "args": [
           "dromaeo.domcoreattr",
           "-v",
@@ -1270,6 +1290,26 @@
         }
       },
       {
+        "args": [],
+        "isolate_name": "gpu_perftests",
+        "name": "gpu_perftests",
+        "swarming": {
+          "can_use_on_swarming_builders": true,
+          "dimension_sets": [
+            {
+              "android_devices": "1",
+              "id": "build73-b1--device2",
+              "os": "Android",
+              "pool": "Chrome-perf"
+            }
+          ],
+          "expiration": 36000,
+          "hard_timeout": 7200,
+          "ignore_task_failure": false,
+          "io_timeout": 3600
+        }
+      },
+      {
         "args": [
           "image_decoding.image_decoding_measurement",
           "-v",
@@ -5547,6 +5587,26 @@
         }
       },
       {
+        "args": [],
+        "isolate_name": "tracing_perftests",
+        "name": "tracing_perftests",
+        "swarming": {
+          "can_use_on_swarming_builders": true,
+          "dimension_sets": [
+            {
+              "android_devices": "1",
+              "id": "build73-b1--device2",
+              "os": "Android",
+              "pool": "Chrome-perf"
+            }
+          ],
+          "expiration": 36000,
+          "hard_timeout": 7200,
+          "ignore_task_failure": false,
+          "io_timeout": 3600
+        }
+      },
+      {
         "args": [
           "v8.browsing_mobile",
           "-v",

diff --git a/testing/buildbot/gn_isolate_map.pyl b/testing/buildbot/gn_isolate_map.pyl
index fa8dff84..059a0ed0 100644
--- a/testing/buildbot/gn_isolate_map.pyl
+++ b/testing/buildbot/gn_isolate_map.pyl

@@ -941,6 +941,8 @@
     "script": "//testing/scripts/run_gtest_perf_test.py",
     "args": [
       "cc_perftests",
+      "--adb-path",
+      "src/third_party/android_tools/sdk/platform-tools/adb"
     ],
   },
   "media_perftests": {
@@ -966,7 +968,9 @@
     "script": "//testing/scripts/run_gtest_perf_test.py",
     "args": [
       "tracing_perftests",
-      "--test-launcher-print-test-stdio=always"
+      "--test-launcher-print-test-stdio=always",
+      "--adb-path",
+      "src/third_party/android_tools/sdk/platform-tools/adb",
     ],
   },
   "gpu_perftests": {
@@ -976,7 +980,7 @@
     "args": [
       "gpu_perftests",
       "--adb-path",
-      "src/third_party/catapult/devil/bin/deps/linux2/x86_64/bin/adb"
+      "src/third_party/android_tools/sdk/platform-tools/adb",
     ],
   },
   "angle_perftests": {

diff --git a/third_party/WebKit/LayoutTests/TestExpectations b/third_party/WebKit/LayoutTests/TestExpectations
index 0620269..e34473f 100644
--- a/third_party/WebKit/LayoutTests/TestExpectations
+++ b/third_party/WebKit/LayoutTests/TestExpectations

@@ -107,6 +107,8 @@
 
 crbug.com/671048 virtual/color_space/fast/canvas/color-space/display_linear-rgb.html [ Pass Failure Crash ]
 
+crbug.com/693568 virtual/gpu/fast/canvas/canvas-imageSmoothingQuality.html [ Failure ]
+
 # Can be broken into smaller tests, probably.
 crbug.com/709009 virtual/gpu/fast/canvas/getPutImageDataPairTest.html [ Timeout Pass ]
 
@@ -119,6 +121,11 @@
 # depending on test order.
 crbug.com/713419 virtual/gpu/fast/canvas/painting-on-bad-canvas.html [ Crash Pass ]
 
+crbug.com/717389 [ Linux Debug ] virtual/gpu/fast/canvas/canvas-clip-rule.html [ Crash ]
+crbug.com/717389 [ Linux Debug ] virtual/gpu/fast/canvas/canvas-path-context-clip.html [ Crash ]
+crbug.com/717389 [ Win7 Debug ] virtual/gpu/fast/canvas/canvas-clip-rule.html [ Timeout ]
+crbug.com/717389 [ Win7 Debug ] virtual/gpu/fast/canvas/canvas-path-context-clip.html [ Timeout ]
+
 # ====== Paint team owned tests to here ======
 
 # ====== Layout team owned tests from here ======
@@ -1241,8 +1248,6 @@
 crbug.com/538697 [ Win7 Debug ] virtual/threaded/printing/webgl-oversized-printing.html [ Failure Crash ]
 crbug.com/538697 [ Win7 Debug ] printing/webgl-oversized-printing.html [ Failure Crash ]
 
-crbug.com/630695 virtual/gpu/fast/canvas/canvas-toDataURL-webp-alpha.html [ NeedsManualRebaseline ]
-
 #crbug.com/492664 [ Linux ] external/wpt/css/css-writing-modes-3/box-offsets-rel-pos-vlr-005.xht [ Failure ]
 #crbug.com/492664 [ Linux ] external/wpt/css/css-writing-modes-3/box-offsets-rel-pos-vrl-004.xht [ Failure ]
 #crbug.com/492664 [ Mac ] external/wpt/css/css-writing-modes-3/bidi-embed-002.html [ Failure ]
@@ -1855,8 +1860,6 @@
 
 crbug.com/662010 [ Win7 ] csspaint/invalidation-background-image.html [ Skip ]
 
-crbug.com/693568 virtual/gpu/fast/canvas/canvas-imageSmoothingQuality.html [ Failure ]
-
 # This is temporary until we revert the speculative change
 crbug.com/704935 fast/events/pointerevents/pointer-event-consumed-touchstart-in-slop-region.html [ Skip ]
 
@@ -3373,12 +3376,6 @@
 crbug.com/716569 [ Android ] tables/mozilla_expected_failures/bugs/bug1055-2.html [ Failure ]
 crbug.com/716569 [ Android ] tables/mozilla_expected_failures/bugs/bug2479-5.html [ Failure ]
 
-# Sheriff failures 2017-05-02
-crbug.com/717389 [ Linux Debug ] virtual/gpu/fast/canvas/canvas-clip-rule.html [ Crash ]
-crbug.com/717389 [ Linux Debug ] virtual/gpu/fast/canvas/canvas-path-context-clip.html [ Crash ]
-crbug.com/717389 [ Win7 Debug ] virtual/gpu/fast/canvas/canvas-clip-rule.html [ Timeout ]
-crbug.com/717389 [ Win7 Debug ] virtual/gpu/fast/canvas/canvas-path-context-clip.html [ Timeout ]
-
 # Layout Tests on Swarming (Windows) - https://crbug.com/717347
 crbug.com/718717 [ Win ] fast/css-grid-layout/grid-self-baseline-two-dimensional.html [ Failure Pass Timeout ]
 crbug.com/718717 [ Win ] fast/css-grid-layout/grid-align-justify-stretch-with-orthogonal-flows.html [ Failure Pass Timeout ]

diff --git a/third_party/WebKit/LayoutTests/W3CImportExpectations b/third_party/WebKit/LayoutTests/W3CImportExpectations
index 5c34fb17..8a9f527 100644
--- a/third_party/WebKit/LayoutTests/W3CImportExpectations
+++ b/third_party/WebKit/LayoutTests/W3CImportExpectations

@@ -49,7 +49,8 @@
 # external/wpt/console [ Pass ]
 ## Owners: mkwst@chromium.org
 # external/wpt/content-security-policy [ Pass ]
-external/wpt/cookies [ Skip ]
+## Owners: mkwst@chromium.org
+# external/wpt/cookies [ Pass ]
 ## Owners: blink-network-dev@chromium.org
 # external/wpt/cors [ Pass ]
 ## Owners: kojii@chromium.org,ksakamoto@chromium.org

diff --git a/third_party/WebKit/LayoutTests/virtual/gpu/fast/canvas/canvas-toDataURL-webp-alpha-expected.png b/third_party/WebKit/LayoutTests/virtual/gpu/fast/canvas/canvas-toDataURL-webp-alpha-expected.png
deleted file mode 100644
index 03217726..0000000
--- a/third_party/WebKit/LayoutTests/virtual/gpu/fast/canvas/canvas-toDataURL-webp-alpha-expected.png
+++ /dev/null
Binary files differ

diff --git a/third_party/WebKit/Source/core/dom/Range.cpp b/third_party/WebKit/Source/core/dom/Range.cpp
index 61ef7b0..7f598f34 100644
--- a/third_party/WebKit/Source/core/dom/Range.cpp
+++ b/third_party/WebKit/Source/core/dom/Range.cpp

@@ -1447,6 +1447,13 @@
   layout_text.AbsoluteRectsForRange(rects, start, end);
 }
 
+static void CollectAbsoluteBoundsForRange(unsigned start,
+                                          unsigned end,
+                                          const LayoutText& layout_text,
+                                          Vector<FloatQuad>& quads) {
+  layout_text.AbsoluteQuadsForRange(quads, start, end);
+}
+
 template <typename RectType>
 static Vector<RectType> ComputeTextBounds(const EphemeralRange& range) {
   const Position& start_position = range.StartPosition();
@@ -1473,37 +1480,26 @@
   return result;
 }
 
-static Vector<IntRect> computeTextRects(const EphemeralRange& range) {
+static Vector<IntRect> ComputeTextRects(const EphemeralRange& range) {
   return ComputeTextBounds<IntRect>(range);
 }
 
+// TODO(tanvir.rizvi): We will replace Range::TextQuads with ComputeTextQuads
+// and get rid of Range::TextQuads.
+static Vector<FloatQuad> ComputeTextQuads(const EphemeralRange& range) {
+  return ComputeTextBounds<FloatQuad>(range);
+}
+
 IntRect Range::BoundingBox() const {
   IntRect result;
-  const Vector<IntRect>& rects = computeTextRects(EphemeralRange(this));
+  const Vector<IntRect>& rects = ComputeTextRects(EphemeralRange(this));
   for (const IntRect& rect : rects)
     result.Unite(rect);
   return result;
 }
 
 void Range::TextQuads(Vector<FloatQuad>& quads) const {
-  Node* start_container = &start_.Container();
-  DCHECK(start_container);
-  Node* end_container = &end_.Container();
-  DCHECK(end_container);
-
-  Node* stop_node = PastLastNode();
-  for (Node* node = FirstNode(); node != stop_node;
-       node = NodeTraversal::Next(*node)) {
-    LayoutObject* r = node->GetLayoutObject();
-    if (!r || !r->IsText())
-      continue;
-    LayoutText* layout_text = ToLayoutText(r);
-    unsigned start_offset = node == start_container ? start_.Offset() : 0;
-    unsigned end_offset = node == end_container
-                              ? end_.Offset()
-                              : std::numeric_limits<unsigned>::max();
-    layout_text->AbsoluteQuadsForRange(quads, start_offset, end_offset);
-  }
+  quads.AppendVector(ComputeTextQuads(EphemeralRange(this)));
 }
 
 bool AreRangesEqual(const Range* a, const Range* b) {

diff --git a/third_party/WebKit/Source/core/frame/csp/CSPDirectiveList.cpp b/third_party/WebKit/Source/core/frame/csp/CSPDirectiveList.cpp
index 50570f2..272dd17 100644
--- a/third_party/WebKit/Source/core/frame/csp/CSPDirectiveList.cpp
+++ b/third_party/WebKit/Source/core/frame/csp/CSPDirectiveList.cpp

@@ -1049,9 +1049,9 @@
 
     if (token_begin < position) {
       String token = String(token_begin, position - token_begin);
-      if (DeprecatedEqualIgnoringCase(token, "script")) {
+      if (EqualIgnoringASCIICase(token, "script")) {
         require_sri_for_ |= RequireSRIForToken::kScript;
-      } else if (DeprecatedEqualIgnoringCase(token, "style")) {
+      } else if (EqualIgnoringASCIICase(token, "style")) {
         require_sri_for_ |= RequireSRIForToken::kStyle;
       } else {
         if (number_of_token_errors)

diff --git a/third_party/WebKit/Source/core/frame/csp/CSPSource.cpp b/third_party/WebKit/Source/core/frame/csp/CSPSource.cpp
index 00311d6e..d23e194 100644
--- a/third_party/WebKit/Source/core/frame/csp/CSPSource.cpp
+++ b/third_party/WebKit/Source/core/frame/csp/CSPSource.cpp

@@ -129,9 +129,8 @@
   }
 
   bool is_scheme_http;  // needed for detecting an upgrade when the port is 0
-  is_scheme_http = scheme_.IsEmpty()
-                       ? policy_->ProtocolEqualsSelf("http")
-                       : DeprecatedEqualIgnoringCase("http", scheme_);
+  is_scheme_http = scheme_.IsEmpty() ? policy_->ProtocolEqualsSelf("http")
+                                     : EqualIgnoringASCIICase("http", scheme_);
 
   if ((port_ == 80 || (port_ == 0 && is_scheme_http)) &&
       (port == 443 || (port == 0 && DefaultPortForProtocol(protocol) == 443)))

diff --git a/third_party/WebKit/Source/core/frame/csp/ContentSecurityPolicy.cpp b/third_party/WebKit/Source/core/frame/csp/ContentSecurityPolicy.cpp
index 8d9d4d8b..6ebc277 100644
--- a/third_party/WebKit/Source/core/frame/csp/ContentSecurityPolicy.cpp
+++ b/third_party/WebKit/Source/core/frame/csp/ContentSecurityPolicy.cpp

@@ -1388,11 +1388,11 @@
   String message =
       "Unrecognized Content-Security-Policy directive '" + name + "'.\n";
   MessageLevel level = kErrorMessageLevel;
-  if (DeprecatedEqualIgnoringCase(name, kAllow)) {
+  if (EqualIgnoringASCIICase(name, kAllow)) {
     message = kAllowMessage;
-  } else if (DeprecatedEqualIgnoringCase(name, kOptions)) {
+  } else if (EqualIgnoringASCIICase(name, kOptions)) {
     message = kOptionsMessage;
-  } else if (DeprecatedEqualIgnoringCase(name, kPolicyURI)) {
+  } else if (EqualIgnoringASCIICase(name, kPolicyURI)) {
     message = kPolicyURIMessage;
   } else if (GetDirectiveType(name) != DirectiveType::kUndefined) {
     message = "The Content-Security-Policy directive '" + name +
@@ -1490,7 +1490,7 @@
   String message = "The source list for Content Security Policy directive '" +
                    directive_name + "' contains an invalid source: '" + source +
                    "'. It will be ignored.";
-  if (DeprecatedEqualIgnoringCase(source, "'none'"))
+  if (EqualIgnoringASCIICase(source, "'none'"))
     message = message +
               " Note that 'none' has no effect unless it is the only "
               "expression in the source list.";
@@ -1543,7 +1543,7 @@
 }
 
 bool ContentSecurityPolicy::ProtocolEqualsSelf(const String& protocol) const {
-  return DeprecatedEqualIgnoringCase(protocol, self_protocol_);
+  return EqualIgnoringASCIICase(protocol, self_protocol_);
 }
 
 const String& ContentSecurityPolicy::GetSelfProtocol() const {

diff --git a/third_party/WebKit/Source/core/frame/csp/SourceListDirective.cpp b/third_party/WebKit/Source/core/frame/csp/SourceListDirective.cpp
index f83e86f3..348a4d77 100644
--- a/third_party/WebKit/Source/core/frame/csp/SourceListDirective.cpp
+++ b/third_party/WebKit/Source/core/frame/csp/SourceListDirective.cpp

@@ -41,8 +41,7 @@
 
   const UChar* position = begin;
   skipWhile<UChar, IsSourceCharacter>(position, end);
-  if (!DeprecatedEqualIgnoringCase("'none'",
-                                   StringView(begin, position - begin)))
+  if (!EqualIgnoringASCIICase("'none'", StringView(begin, position - begin)))
     return false;
 
   skipWhile<UChar, IsASCIISpace>(position, end);
@@ -179,7 +178,7 @@
 
   StringView token(begin, end - begin);
 
-  if (DeprecatedEqualIgnoringCase("'none'", token))
+  if (EqualIgnoringASCIICase("'none'", token))
     return false;
 
   if (end - begin == 1 && *begin == '*') {
@@ -187,32 +186,32 @@
     return true;
   }
 
-  if (DeprecatedEqualIgnoringCase("'self'", token)) {
+  if (EqualIgnoringASCIICase("'self'", token)) {
     AddSourceSelf();
     return true;
   }
 
-  if (DeprecatedEqualIgnoringCase("'unsafe-inline'", token)) {
+  if (EqualIgnoringASCIICase("'unsafe-inline'", token)) {
     AddSourceUnsafeInline();
     return true;
   }
 
-  if (DeprecatedEqualIgnoringCase("'unsafe-eval'", token)) {
+  if (EqualIgnoringASCIICase("'unsafe-eval'", token)) {
     AddSourceUnsafeEval();
     return true;
   }
 
-  if (DeprecatedEqualIgnoringCase("'strict-dynamic'", token)) {
+  if (EqualIgnoringASCIICase("'strict-dynamic'", token)) {
     AddSourceStrictDynamic();
     return true;
   }
 
-  if (DeprecatedEqualIgnoringCase("'unsafe-hashed-attributes'", token)) {
+  if (EqualIgnoringASCIICase("'unsafe-hashed-attributes'", token)) {
     AddSourceUnsafeHashedAttributes();
     return true;
   }
 
-  if (DeprecatedEqualIgnoringCase("'report-sample'", token)) {
+  if (EqualIgnoringASCIICase("'report-sample'", token)) {
     AddReportSample();
     return true;
   }
@@ -324,7 +323,7 @@
 
   // TODO(esprehn): Should be StringView(begin, nonceLength).startsWith(prefix).
   if (nonce_length <= prefix.length() ||
-      !DeprecatedEqualIgnoringCase(prefix, StringView(begin, prefix.length())))
+      !EqualIgnoringASCIICase(prefix, StringView(begin, prefix.length())))
     return true;
 
   const UChar* position = begin + prefix.length();
@@ -374,8 +373,7 @@
     // TODO(esprehn): Should be StringView(begin, end -
     // begin).startsWith(prefix).
     if (hash_length > prefix.length() &&
-        DeprecatedEqualIgnoringCase(prefix,
-                                    StringView(begin, prefix.length()))) {
+        EqualIgnoringASCIICase(prefix, StringView(begin, prefix.length()))) {
       hash_algorithm = algorithm.type;
       break;
     }

diff --git a/third_party/WebKit/Source/core/html/HTMLMediaElement.cpp b/third_party/WebKit/Source/core/html/HTMLMediaElement.cpp
index 1ac4e2e..ae052f1 100644
--- a/third_party/WebKit/Source/core/html/HTMLMediaElement.cpp
+++ b/third_party/WebKit/Source/core/html/HTMLMediaElement.cpp

@@ -525,9 +525,9 @@
 HTMLMediaElement::~HTMLMediaElement() {
   BLINK_MEDIA_LOG << "~HTMLMediaElement(" << (void*)this << ")";
 
-  // m_audioSourceNode is explicitly cleared by AudioNode::dispose().
+  // audio_source_node_ is explicitly cleared by AudioNode::dispose().
   // Since AudioNode::dispose() is guaranteed to be always called before
-  // the AudioNode is destructed, m_audioSourceNode is explicitly cleared
+  // the AudioNode is destructed, audio_source_node_ is explicitly cleared
   // even if the AudioNode and the HTMLMediaElement die together.
   DCHECK(!audio_source_node_);
 }
@@ -568,11 +568,11 @@
   if (should_delay_load_event_) {
     GetDocument().IncrementLoadEventDelayCount();
     // Note: Keeping the load event delay count increment on oldDocument that
-    // was added when m_shouldDelayLoadEvent was set so that destruction of
-    // m_webMediaPlayer can not cause load event dispatching in oldDocument.
+    // was added when should_delay_load_event_ was set so that destruction of
+    // web_media_player_ can not cause load event dispatching in oldDocument.
   } else {
     // Incrementing the load event delay count so that destruction of
-    // m_webMediaPlayer can not cause load event dispatching in oldDocument.
+    // web_media_player_ can not cause load event dispatching in oldDocument.
     old_document.IncrementLoadEventDelayCount();
   }
 
@@ -589,7 +589,7 @@
   InvokeLoadAlgorithm();
 
   // Decrement the load event delay count on oldDocument now that
-  // m_webMediaPlayer has been destroyed and there is no risk of dispatching a
+  // web_media_player_ has been destroyed and there is no risk of dispatching a
   // load event from within the destructor.
   old_document.DecrementLoadEventDelayCount();
 
@@ -735,7 +735,7 @@
 
 void HTMLMediaElement::ScheduleEvent(Event* event) {
 #if LOG_MEDIA_EVENTS
-  BLINK_MEDIA_LOG << "scheduleEvent(" << (void*)this << ")"
+  BLINK_MEDIA_LOG << "ScheduleEvent(" << (void*)this << ")"
                   << " - scheduling '" << event->type() << "'";
 #endif
   async_event_queue_->EnqueueEvent(event);
@@ -806,7 +806,7 @@
   InvokeLoadAlgorithm();
 }
 
-// TODO(srirama.m): Currently m_ignorePreloadNone is reset before calling
+// TODO(srirama.m): Currently ignore_preload_none_ is reset before calling
 // invokeLoadAlgorithm() in all places except load(). Move it inside here
 // once microtask is implemented for "Await a stable state" step
 // in resource selection algorithm.
@@ -818,7 +818,7 @@
   load_timer_.Stop();
   CancelDeferredLoad();
   // FIXME: Figure out appropriate place to reset LoadTextTrackResource if
-  // necessary and set m_pendingActionFlags to 0 here.
+  // necessary and set pending_action_flags_ to 0 here.
   pending_action_flags_ &= ~kLoadMediaResource;
   sent_stalled_event_ = false;
   have_fired_loaded_data_ = false;
@@ -949,7 +949,7 @@
 
   played_time_ranges_ = TimeRanges::Create();
 
-  // FIXME: Investigate whether these can be moved into m_networkState !=
+  // FIXME: Investigate whether these can be moved into network_state_ !=
   // kNetworkEmpty block above
   // so they are closer to the relevant spec steps.
   last_seek_time_ = 0;
@@ -1124,7 +1124,7 @@
   // The resource fetch algorithm
   SetNetworkState(kNetworkLoading);
 
-  // Set m_currentSrc *before* changing to the cache url, the fact that we are
+  // Set current_src_ *before* changing to the cache url, the fact that we are
   // loading from the app cache is an internal detail not exposed through the
   // media element API.
   current_src_ = url;
@@ -1132,7 +1132,7 @@
   if (audio_source_node_)
     audio_source_node_->OnCurrentSrcChanged(current_src_);
 
-  BLINK_MEDIA_LOG << "loadResource(" << (void*)this << ") - m_currentSrc -> "
+  BLINK_MEDIA_LOG << "loadResource(" << (void*)this << ") - current_src_ -> "
                   << UrlForLoggingMedia(current_src_);
 
   StartProgressEventTimer();
@@ -1684,7 +1684,7 @@
                   << static_cast<int>(state) << ") - current state is "
                   << static_cast<int>(ready_state_);
 
-  // Set "wasPotentiallyPlaying" BEFORE updating m_readyState,
+  // Set "wasPotentiallyPlaying" BEFORE updating ready_state_,
   // potentiallyPlaying() uses it
   bool was_potentially_playing = PotentiallyPlaying();
 
@@ -1730,7 +1730,7 @@
   } else {
     if (was_potentially_playing && ready_state_ < kHaveFutureData) {
       // Force an update to official playback position. Automatic updates from
-      // currentPlaybackPosition() will be blocked while m_readyState remains
+      // currentPlaybackPosition() will be blocked while ready_state_ remains
       // < kHaveFutureData. This blocking is desired after 'waiting' has been
       // fired, but its good to update it one final time to accurately reflect
       // media time at the moment we ran out of data to play.
@@ -1878,16 +1878,16 @@
   BLINK_MEDIA_LOG << "seek(" << (void*)this << ", " << time << ")";
 
   // 2 - If the media element's readyState is HAVE_NOTHING, abort these steps.
-  // FIXME: remove m_webMediaPlayer check once we figure out how
-  // m_webMediaPlayer is going out of sync with readystate.
-  // m_webMediaPlayer is cleared but readystate is not set to HAVE_NOTHING.
+  // FIXME: remove web_media_player_ check once we figure out how
+  // web_media_player_ is going out of sync with readystate.
+  // web_media_player_ is cleared but readystate is not set to HAVE_NOTHING.
   if (!web_media_player_ || ready_state_ == kHaveNothing)
     return;
 
   // Ignore preload none and start load if necessary.
   SetIgnorePreloadNone();
 
-  // Get the current time before setting m_seeking, m_lastSeekTime is returned
+  // Get the current time before setting seeking_, last_seek_time_ is returned
   // once it is set.
   double now = currentTime();
 
@@ -1913,7 +1913,7 @@
   // comparing with current time. This is necessary because if the seek time is
   // not equal to currentTime but the delta is less than the movie's time scale,
   // we will ask the media engine to "seek" to the current movie time, which may
-  // be a noop and not generate a timechanged callback. This means m_seeking
+  // be a noop and not generate a timechanged callback. This means seeking_
   // will never be cleared and we will never fire a 'seeked' event.
   double media_time = GetWebMediaPlayer()->MediaTimeForTimeValue(time);
   if (time != media_time) {
@@ -2000,7 +2000,7 @@
 
 double HTMLMediaElement::CurrentPlaybackPosition() const {
   // "Official" playback position won't take updates from "current" playback
-  // position until m_readyState > kHaveMetadata, but other callers (e.g.
+  // position until ready_state_ > kHaveMetadata, but other callers (e.g.
   // pauseInternal) may still request currentPlaybackPosition at any time.
   // From spec: "Media elements have a current playback position, which must
   // initially (i.e., in the absence of media data) be zero seconds."
@@ -2032,11 +2032,11 @@
   }
 
 #if LOG_OFFICIAL_TIME_STATUS
-  static const double minCachedDeltaForWarning = 0.01;
+  static const double kMinCachedDeltaForWarning = 0.01;
   double delta =
-      std::abs(m_officialPlaybackPosition - currentPlaybackPosition());
-  if (delta > minCachedDeltaForWarning) {
-    BLINK_MEDIA_LOG << "currentTime(" << (void*)this
+      std::abs(official_playback_position_ - CurrentPlaybackPosition());
+  if (delta > kMinCachedDeltaForWarning) {
+    BLINK_MEDIA_LOG << "CurrentTime(" << (void*)this
                     << ") - WARNING, cached time is " << delta
                     << "seconds off of media time when paused/waiting";
   }
@@ -2047,8 +2047,8 @@
 
 void HTMLMediaElement::SetOfficialPlaybackPosition(double position) const {
 #if LOG_OFFICIAL_TIME_STATUS
-  BLINK_MEDIA_LOG << "setOfficialPlaybackPosition(" << (void*)this
-                  << ") was:" << m_officialPlaybackPosition
+  BLINK_MEDIA_LOG << "SetOfficialPlaybackPosition(" << (void*)this
+                  << ") was:" << official_playback_position_
                   << " now:" << position;
 #endif
 
@@ -2144,9 +2144,9 @@
 }
 
 void HTMLMediaElement::UpdatePlaybackRate() {
-  // FIXME: remove m_webMediaPlayer check once we figure out how
-  // m_webMediaPlayer is going out of sync with readystate.
-  // m_webMediaPlayer is cleared but readystate is not set to kHaveNothing.
+  // FIXME: remove web_media_player_ check once we figure out how
+  // web_media_player_ is going out of sync with readystate.
+  // web_media_player_ is cleared but readystate is not set to kHaveNothing.
   if (web_media_player_ && PotentiallyPlaying())
     GetWebMediaPlayer()->SetRate(playbackRate());
 }
@@ -2239,8 +2239,8 @@
 ScriptPromise HTMLMediaElement::playForBindings(ScriptState* script_state) {
   // We have to share the same logic for internal and external callers. The
   // internal callers do not want to receive a Promise back but when ::play()
-  // is called, |m_playPromiseResolvers| needs to be populated. What this code
-  // does is to populate |m_playPromiseResolvers| before calling ::play() and
+  // is called, |play_promise_resolvers_| needs to be populated. What this code
+  // does is to populate |play_promise_resolvers_| before calling ::play() and
   // remove the Promise if ::play() failed.
   ScriptPromiseResolver* resolver = ScriptPromiseResolver::Create(script_state);
   ScriptPromise promise = resolver->Promise();
@@ -2353,7 +2353,7 @@
     ScheduleEvent(EventTypeNames::pause);
 
     // Force an update to official playback position. Automatic updates from
-    // currentPlaybackPosition() will be blocked while m_paused = true. This
+    // currentPlaybackPosition() will be blocked while paused_ = true. This
     // blocking is desired while paused, but its good to update it one final
     // time to accurately reflect movie time at the moment we paused.
     SetOfficialPlaybackPosition(CurrentPlaybackPosition());
@@ -2987,7 +2987,7 @@
   // algorithm.
   if (getNetworkState() == HTMLMediaElement::kNetworkEmpty) {
     InvokeResourceSelectionAlgorithm();
-    // Ignore current |m_nextChildNodeToConsider| and consider |source|.
+    // Ignore current |next_child_node_to_consider_| and consider |source|.
     next_child_node_to_consider_ = source;
     return;
   }
@@ -2995,13 +2995,13 @@
   if (current_source_node_ && source == current_source_node_->nextSibling()) {
     BLINK_MEDIA_LOG << "sourceWasAdded(" << (void*)this
                     << ") - <source> inserted immediately after current source";
-    // Ignore current |m_nextChildNodeToConsider| and consider |source|.
+    // Ignore current |next_child_node_to_consider_| and consider |source|.
     next_child_node_to_consider_ = source;
     return;
   }
 
-  // Consider current |m_nextChildNodeToConsider| as it is already in the middle
-  // of processing.
+  // Consider current |next_child_node_to_consider_| as it is already in the
+  // middle of processing.
   if (next_child_node_to_consider_)
     return;
 
@@ -3039,7 +3039,7 @@
     if (current_source_node_)
       next_child_node_to_consider_ = current_source_node_->nextSibling();
     BLINK_MEDIA_LOG << "sourceWasRemoved(" << (void*)this
-                    << ") - m_nextChildNodeToConsider set to "
+                    << ") - next_child_node_to_consider_ set to "
                     << next_child_node_to_consider_.Get();
   } else if (source == current_source_node_) {
     // Clear the current source node pointer, but don't change the movie as the
@@ -3048,8 +3048,8 @@
     // element is already inserted in a video or audio element will have no
     // effect.
     current_source_node_ = nullptr;
-    BLINK_MEDIA_LOG << "sourceWasRemoved(" << (void*)this
-                    << ") - m_currentSourceNode set to 0";
+    BLINK_MEDIA_LOG << "SourceWasRemoved(" << (void*)this
+                    << ") - current_source_node_ set to 0";
   }
 }
 

diff --git a/third_party/WebKit/Source/core/html/HTMLMediaElement.h b/third_party/WebKit/Source/core/html/HTMLMediaElement.h
index 6abf1be..b91d70e 100644
--- a/third_party/WebKit/Source/core/html/HTMLMediaElement.h
+++ b/third_party/WebKit/Source/core/html/HTMLMediaElement.h

@@ -661,7 +661,7 @@
   HeapVector<Member<ScriptPromiseResolver>> play_promise_reject_list_;
   ExceptionCode play_promise_error_code_;
 
-  // This is a weak reference, since m_audioSourceNode holds a reference to us.
+  // This is a weak reference, since audio_source_node_ holds a reference to us.
   // TODO(Oilpan): Consider making this a strongly traced pointer with oilpan
   // where strong cycles are not a problem.
   GC_PLUGIN_IGNORE("http://crbug.com/404577")

diff --git a/third_party/WebKit/Source/core/layout/LayoutTableSection.cpp b/third_party/WebKit/Source/core/layout/LayoutTableSection.cpp
index df573ab..f8a2a04 100644
--- a/third_party/WebKit/Source/core/layout/LayoutTableSection.cpp
+++ b/third_party/WebKit/Source/core/layout/LayoutTableSection.cpp

@@ -85,9 +85,9 @@
 
 void CellSpan::EnsureConsistency(const unsigned maximum_span_size) {
   static_assert(std::is_same<decltype(start_), unsigned>::value,
-                "Asserts below assume m_start is unsigned");
+                "Asserts below assume start_ is unsigned");
   static_assert(std::is_same<decltype(end_), unsigned>::value,
-                "Asserts below assume m_end is unsigned");
+                "Asserts below assume end_ is unsigned");
   CHECK_LE(start_, maximum_span_size);
   CHECK_LE(end_, maximum_span_size);
   CHECK_LE(start_, end_);
@@ -956,7 +956,7 @@
   CHECK(!NeedsCellRecalc());
   DCHECK(!Table()->NeedsSectionRecalc());
 
-  // addChild may over-grow m_grid but we don't want to throw away the memory
+  // addChild may over-grow grid_ but we don't want to throw away the memory
   // too early as addChild can be called in a loop (e.g during parsing). Doing
   // it now ensures we have a stable-enough structure.
   grid_.ShrinkToFit();
@@ -1069,7 +1069,7 @@
   if (extra_logical_height <= 0 || !row_pos_[total_rows])
     return;
 
-  // FIXME: m_rowPos[totalRows] - m_rowPos[0] is the total rows' size.
+  // FIXME: row_pos_[total_rows] - row_pos_[0] is the total rows' size.
   int total_row_size = row_pos_[total_rows];
   int total_logical_height_added = 0;
   int previous_row_position = row_pos_[0];

diff --git a/third_party/WebKit/Source/core/loader/ImageLoader.cpp b/third_party/WebKit/Source/core/loader/ImageLoader.cpp
index e79b16b..9e5ab6a 100644
--- a/third_party/WebKit/Source/core/loader/ImageLoader.cpp
+++ b/third_party/WebKit/Source/core/loader/ImageLoader.cpp

@@ -171,8 +171,8 @@
 void ImageLoader::Dispose() {
   RESOURCE_LOADING_DVLOG(1)
       << "~ImageLoader " << this
-      << "; m_hasPendingLoadEvent=" << has_pending_load_event_
-      << ", m_hasPendingErrorEvent=" << has_pending_error_event_;
+      << "; has_pending_load_event_=" << has_pending_load_event_
+      << ", has_pending_error_event_=" << has_pending_error_event_;
 
   if (image_) {
     image_->RemoveObserver(this);
@@ -279,7 +279,7 @@
   //
   // We don't need to call clearLoader here: Either we were called from the
   // task, or our caller updateFromElement cleared the task's loader (and set
-  // m_pendingTask to null).
+  // pending_task_ to null).
   pending_task_.reset();
   // Make sure to only decrement the count when we exit this function
   std::unique_ptr<IncrementLoadEventDelayCount> load_delay_counter;
@@ -347,7 +347,7 @@
 
     // Cancel error events that belong to the previous load, which is now
     // cancelled by changing the src attribute. If newImage is null and
-    // m_hasPendingErrorEvent is true, we know the error event has been just
+    // has_pending_error_event_ is true, we know the error event has been just
     // posted by this load and we should not cancel the event.
     // FIXME: If both previous load and this one got blocked with an error, we
     // can receive one error event instead of two.
@@ -395,7 +395,7 @@
   // Prevent the creation of a ResourceLoader (and therefore a network request)
   // for ImageDocument loads. In this case, the image contents have already been
   // requested as a main resource and ImageDocumentParser will take care of
-  // funneling the main resource bytes into m_image, so just create an
+  // funneling the main resource bytes into image_, so just create an
   // ImageResource to be populated later.
   if (loading_image_document_ && update_behavior != kUpdateForcedReload) {
     ImageResource* image_resource = ImageResource::Create(
@@ -473,14 +473,14 @@
 void ImageLoader::ImageNotifyFinished(ImageResourceContent* resource) {
   RESOURCE_LOADING_DVLOG(1)
       << "ImageLoader::imageNotifyFinished " << this
-      << "; m_hasPendingLoadEvent=" << has_pending_load_event_;
+      << "; has_pending_load_event_=" << has_pending_load_event_;
 
   DCHECK(failed_load_url_.IsEmpty());
   DCHECK_EQ(resource, image_.Get());
 
   image_complete_ = true;
 
-  // Update ImageAnimationPolicy for m_image.
+  // Update ImageAnimationPolicy for image_.
   if (image_)
     image_->UpdateImageAnimationPolicy();
 

diff --git a/third_party/WebKit/Source/core/paint/PaintLayer.h b/third_party/WebKit/Source/core/paint/PaintLayer.h
index aaa4f77..1328a53 100644
--- a/third_party/WebKit/Source/core/paint/PaintLayer.h
+++ b/third_party/WebKit/Source/core/paint/PaintLayer.h

@@ -163,7 +163,7 @@
 // - some performance optimizations.
 //
 // The compositing code is also based on PaintLayer. The entry to it is the
-// PaintLayerCompositor, which fills |m_compositedLayerMapping| for hardware
+// PaintLayerCompositor, which fills |composited_layer_mapping| for hardware
 // accelerated layers.
 //
 // TODO(jchaffraix): Expand the documentation about hardware acceleration.
@@ -171,7 +171,7 @@
 //
 // ***** SELF-PAINTING LAYER *****
 // One important concept about PaintLayer is "self-painting"
-// (m_isSelfPaintingLayer).
+// (is_self_painting_layer_).
 // PaintLayer started as the implementation of a stacking context. This meant
 // that we had to use PaintLayer's painting order (the code is now in
 // PaintLayerPainter and PaintLayerStackingNode) instead of the LayoutObject's
@@ -271,8 +271,8 @@
 #endif
     return location_;
   }
-  // FIXME: size() should DCHECK(!m_needsPositionUpdate) as well, but that fails
-  // in some tests, for example, fast/repaint/clipped-relative.html.
+  // FIXME: size() should DCHECK(!needs_position_update_) as well, but that
+  // fails in some tests, for example, fast/repaint/clipped-relative.html.
   const IntSize& size() const { return size_; }
   void SetSizeHackForLayoutTreeAsText(const IntSize& size) { size_ = size; }
 
@@ -1196,7 +1196,7 @@
   // the tree of z-order lists.
   unsigned has_compositing_descendant_ : 1;
 
-  // True iff we have scrollable overflow and all children of m_layoutObject are
+  // True iff we have scrollable overflow and all children of layout_object_ are
   // known to paint exclusively into their own composited layers.  Set by
   // updateScrollingStateAfterCompositingChange().
   unsigned is_all_scrolling_content_composited_ : 1;
@@ -1212,7 +1212,7 @@
   unsigned needs_repaint_ : 1;
   unsigned previous_paint_result_ : 1;  // PaintResult
   static_assert(kMaxPaintResult <= 2,
-                "Should update number of bits of m_previousPaintResult");
+                "Should update number of bits of previous_paint_result_");
 
   unsigned needs_paint_phase_descendant_outlines_ : 1;
   unsigned previous_paint_phase_descendant_outlines_was_empty_ : 1;

diff --git a/third_party/WebKit/Source/core/svg/properties/SVGAnimatedProperty.h b/third_party/WebKit/Source/core/svg/properties/SVGAnimatedProperty.h
index 2a20f8b..41138df 100644
--- a/third_party/WebKit/Source/core/svg/properties/SVGAnimatedProperty.h
+++ b/third_party/WebKit/Source/core/svg/properties/SVGAnimatedProperty.h

@@ -89,7 +89,7 @@
 
  private:
   static_assert(kNumberOfAnimatedPropertyTypes <= (1u << 5),
-                "enough bits for AnimatedPropertyType (m_type)");
+                "enough bits for AnimatedPropertyType (type_)");
   static constexpr int kCssPropertyBits = 9;
   static_assert((1u << kCssPropertyBits) - 1 >= lastCSSProperty,
                 "enough bits for CSS property ids");

diff --git a/third_party/WebKit/Source/modules/encryptedmedia/MediaKeySession.cpp b/third_party/WebKit/Source/modules/encryptedmedia/MediaKeySession.cpp
index 9f768b6..c9c7c9b2 100644
--- a/third_party/WebKit/Source/modules/encryptedmedia/MediaKeySession.cpp
+++ b/third_party/WebKit/Source/modules/encryptedmedia/MediaKeySession.cpp

@@ -1019,11 +1019,11 @@
   // and we're not closed.
   DVLOG(MEDIA_KEY_SESSION_LOG_LEVEL)
       << __func__ << "(" << this << ")"
-      << (!pending_actions_.IsEmpty() ? " !m_pendingActions.isEmpty()" : "")
+      << (!pending_actions_.IsEmpty() ? " !pending_actions_.IsEmpty()" : "")
       << (async_event_queue_->HasPendingEvents()
-              ? " m_asyncEventQueue->hasPendingEvents()"
+              ? " async_event_queue_->HasPendingEvents()"
               : "")
-      << ((media_keys_ && !is_closed_) ? " m_mediaKeys && !m_isClosed" : "");
+      << ((media_keys_ && !is_closed_) ? " media_keys_ && !is_closed_" : "");
 
   return !pending_actions_.IsEmpty() ||
          async_event_queue_->HasPendingEvents() || (media_keys_ && !is_closed_);

diff --git a/third_party/WebKit/Source/modules/encryptedmedia/MediaKeys.cpp b/third_party/WebKit/Source/modules/encryptedmedia/MediaKeys.cpp
index 8ebe870f..f2c5a649 100644
--- a/third_party/WebKit/Source/modules/encryptedmedia/MediaKeys.cpp
+++ b/third_party/WebKit/Source/modules/encryptedmedia/MediaKeys.cpp

@@ -313,8 +313,8 @@
   // Remain around if there are pending events.
   DVLOG(MEDIA_KEYS_LOG_LEVEL)
       << __func__ << "(" << this << ")"
-      << (!pending_actions_.IsEmpty() ? " !m_pendingActions.isEmpty()" : "")
-      << (reserved_for_media_element_ ? " m_reservedForMediaElement" : "");
+      << (!pending_actions_.IsEmpty() ? " !pending_actions_.isEmpty()" : "")
+      << (reserved_for_media_element_ ? " reserved_for_media_element_" : "");
 
   return !pending_actions_.IsEmpty() || reserved_for_media_element_;
 }

diff --git a/third_party/WebKit/Source/platform/audio/PushPullFIFO.cpp b/third_party/WebKit/Source/platform/audio/PushPullFIFO.cpp
index 7d18c6e..e23368f 100644
--- a/third_party/WebKit/Source/platform/audio/PushPullFIFO.cpp
+++ b/third_party/WebKit/Source/platform/audio/PushPullFIFO.cpp

@@ -100,12 +100,12 @@
   }
   if (frames_requested > fifo_length_) {
     LOG(WARNING) << "[WebAudio/PushPullFIFO::pull <" << static_cast<void*>(this)
-                 << ">] framesRequested > m_fifoLength (" << frames_requested
+                 << ">] framesRequested > fifo_length_ (" << frames_requested
                  << " > " << fifo_length_ << ")";
   }
   if (index_read_ >= fifo_length_) {
     LOG(WARNING) << "[WebAudio/PushPullFIFO::pull <" << static_cast<void*>(this)
-                 << ">] m_indexRead >= m_fifoLength (" << index_read_
+                 << ">] index_read_ >= fifo_length_ (" << index_read_
                  << " >= " << fifo_length_ << ")";
   }
 #endif

diff --git a/third_party/WebKit/Source/platform/bindings/TraceWrapperReference.md b/third_party/WebKit/Source/platform/bindings/TraceWrapperReference.md
index 9b99506..5e0bfc6 100644
--- a/third_party/WebKit/Source/platform/bindings/TraceWrapperReference.md
+++ b/third_party/WebKit/Source/platform/bindings/TraceWrapperReference.md

@@ -21,7 +21,7 @@
 ``DECLARE_VIRTUAL_TRACE_WRAPPERS()``.
 5. Define the method using ``DEFINE_TRACE_WRAPPERS(ClassName)``.
 6. Trace all fields that received a wrapper tracing type in (1) and (2) using
-``visitor->traceWrapers(<m_field>)`` in the body of ``DEFINE_TRACE_WRAPPERS``.
+``visitor->TraceWrappers(<field_>)`` in the body of ``DEFINE_TRACE_WRAPPERS``.
 
 The following example illustrates these steps:
 
@@ -35,15 +35,15 @@
   DECLARE_VIRTUAL_TRACE_WRAPPERS();                     // (4)
 
  private:
-  TraceWrapperMember<OtherWrappable> m_otherWrappable;  // (2)
-  Member<NonWrappable> m_nonWrappable;
-  TraceWrapperV8Reference<v8::Value> m_v8object;        // (3)
+  TraceWrapperMember<OtherWrappable> other_wrappable_;  // (2)
+  Member<NonWrappable> non_wrappable_;
+  TraceWrapperV8Reference<v8::Value> v8object_;         // (3)
   // ...
 };
 
 DEFINE_TRACE_WRAPPERS(SomeDOMObject) {                  // (5)
-  visitor->traceWrappers(m_otherWrappable);             // (6)
-  visitor->traceWrappers(m_v8object);                   // (6)
+  visitor->TraceWrappers(other_wrappable_);             // (6)
+  visitor->TraceWrappers(v8object_);                    // (6)
 }
 ```
 
@@ -82,7 +82,6 @@
 
 ```c++
 #include "platform/bindings/ScriptWrappable.h"
-#include "platform/bindings/TraceWrapperMember.h"
 #include "platform/bindings/TraceWrapperV8Reference.h"
 ```
 
@@ -93,14 +92,14 @@
 class SomeDOMObject : public ScriptWrappable {
   // ...
  private:
-  Member<OtherWrappable /* extending ScriptWrappable */> m_otherWrappable;
-  Member<NonWrappable> m_nonWrappable;
+  Member<OtherWrappable /* extending ScriptWrappable */> other_wrappable_;
+  Member<NonWrappable> non_wrappable_;
 };
 ```
 
 In this scenario ``SomeDOMObject`` is the object that is wrapped by an object on
 the JavaScript side. The next step is to identify the paths that lead to other
-wrappables. In this case, only ``m_otherWrappable`` needs to be traced to find
+wrappables. In this case, only ``other_wrappable_`` needs to be traced to find
 other *wrappers* in V8.
 
 As wrapper tracing only traces a subset of members residing on the Oilpan heap,
@@ -120,12 +119,12 @@
   DECLARE_VIRTUAL_TRACE_WRAPPERS();
 
  private:
-  Member<OtherWrappable> m_otherWrappable;
-  Member<NonWrappable> m_nonWrappable;
+  Member<OtherWrappable> other_wrappable_;
+  Member<NonWrappable> non_wrappable_;
 };
 
 DEFINE_TRACE_WRAPPERS(SomeDOMObject) {
-  visitor->traceWrappers(m_otherWrappable);
+  visitor->TraceWrappers(other_wrappable_);
 }
 ```
 
@@ -141,28 +140,28 @@
 collector will not find ``Y`` and reclaim it.
 
 To overcome this problem we require all writes of interesting objects, i.e.,
-writes to traced fields, to go through a write barrier.  Repeat for simpler
-readers: The write barrier will check for the problem case above and make sure
+writes to traced fields, to go through a write barrier.
+The write barrier will check for the problem case above and make sure
 ``Y`` will be marked. In order to automatically issue a write barrier
-``m_otherWrappable`` needs ``TraceWrapperMember`` type.
+``other_wrappable_`` needs ``TraceWrapperMember`` type.
 
 ```c++
 class SomeDOMObject : public ScriptWrappable {
  public:
-  SomeDOMObject() : m_otherWrappable(this, nullptr) {}
+  SomeDOMObject() : other_wrappable_(this, nullptr) {}
   DECLARE_VIRTUAL_TRACE_WRAPPERS();
 
  private:
-  TraceWrapperMember<OtherWrappable> m_otherWrappable;
-  Member<NonWrappable> m_nonWrappable;
+  TraceWrapperMember<OtherWrappable> other_wrappable_;
+  Member<NonWrappable> non_wrappable_;
 };
 
 DEFINE_TRACE_WRAPPERS(SomeDOMObject) {
-  visitor->traceWrappers(m_otherWrappable);
+  visitor->TraceWrappers(other_wrappable_);
 }
 ```
 
-``TraceWrapperMember`` makes sure that any write to ``m_otherWrappable`` will
+``TraceWrapperMember`` makes sure that any write to ``other_wrappable_`` will
 consider doing a write barrier. Using the proper type, the write barrier is
 correct by construction, i.e., it will never be missed.
 
@@ -179,12 +178,12 @@
   DECLARE_VIRTUAL_TRACE_WRAPPERS();
 
  private:
-  HeapVector<TraceWrapperMember<OtherWrappable>> m_otherWrappables;
+  HeapVector<TraceWrapperMember<OtherWrappable>> other_wrappables_;
 };
 
 DEFINE_TRACE_WRAPPERS(SomeDOMObject) {
-  for (auto other : m_otherWrappables)
-    visitor->traceWrappers(other);
+  for (auto other : other_wrappables_)
+    visitor->TraceWrappers(other);
 }
 ```
 
@@ -194,7 +193,7 @@
 
 ```c++
 void SomeDOMObject::AppendNewValue(OtherWrappable* newValue) {
-  m_otherWrappables.append(TraceWrapperMember(this, newValue));
+  other_wrappables_.append(TraceWrapperMember(this, newValue));
 }
 ```
 
@@ -211,32 +210,32 @@
 class SomeDOMObject : public ScriptWrappable {
  public:
   SomeDOMObject() {
-    m_otherWrappables.resize(5);
+    other_wrappables_.resize(5);
   }
 
   void writeAt(int i, OtherWrappable* other) {
-    m_otherWrappables[i] = other;
+    other_wrappables_[i] = other;
   }
 
   DECLARE_VIRTUAL_TRACE_WRAPPERS();
  private:
-  HeapVector<TraceWrapperMember<OtherWrappable>> m_otherWrappables;
+  HeapVector<TraceWrapperMember<OtherWrappable>> other_wrappables_;
 };
 
 DEFINE_TRACE_WRAPPERS(SomeDOMObject) {
-  for (auto other : m_otherWrappables)
-    visitor->traceWrappers(other);
+  for (auto other : other_wrappables_)
+    visitor->TraceWrappers(other);
 }
 ```
 
 In this example, the compiler will not warn you on
-``m_otherWrappables[i] = other``, but an assertion will throw at runtime as long
+``other_wrappables_[i] = other``, but an assertion will throw at runtime as long
 as there exists a test covering that branch.
 
 The correct assignment looks like
 
 ```c++
-m_otherWrappables[i] = TraceWrapperMember<OtherWrappable>(this, other);
+other_wrappables_[i] = TraceWrapperMember<OtherWrappable>(this, other);
 ```
 
 Note that the assertion that triggers when the annotation is not present does
@@ -271,17 +270,16 @@
 class ManualWrappable : public ScriptWrappable {
  public:
   void setNew(OtherWrappable* newValue) {
-    m_otherWrappable = newValue;
-    SriptWrappableVisitor::writeBarrier(this, m_otherWrappable);
+    other_wrappable_ = newValue;
+    SriptWrappableVisitor::WriteBarrier(this, other_wrappable_);
   }
 
   DECLARE_VIRTUAL_TRACE_WRAPPERS();
  private:
-  Member<OtherWrappable>> m_otherWrappable;
+  Member<OtherWrappable>> other_wrappable_;
 };
 
 DEFINE_TRACE_WRAPPERS(ManualWrappable) {
-  for (auto other : m_otherWrappables)
-    visitor->traceWrappersWithManualWriteBarrier(other);
+  visitor->TraceWrappersWithManualWriteBarrier(other_wrappable_);
 }
 ```

diff --git a/third_party/WebKit/Source/platform/loader/fetch/Resource.cpp b/third_party/WebKit/Source/platform/loader/fetch/Resource.cpp
index a234bd4..8d71536 100644
--- a/third_party/WebKit/Source/platform/loader/fetch/Resource.cpp
+++ b/third_party/WebKit/Source/platform/loader/fetch/Resource.cpp

@@ -274,7 +274,7 @@
 void Resource::ResourceCallback::Schedule(Resource* resource) {
   if (!task_handle_.IsActive()) {
     // WTF::unretained(this) is safe because a posted task is canceled when
-    // |m_taskHandle| is destroyed on the dtor of this ResourceCallback.
+    // |task_handle_| is destroyed on the dtor of this ResourceCallback.
     task_handle_ =
         Platform::Current()
             ->CurrentThread()
@@ -638,12 +638,12 @@
   if (loader_) {
     if (!builder.IsEmpty())
       builder.Append(' ');
-    builder.Append("m_loader");
+    builder.Append("loader_");
   }
   if (preload_count_) {
     if (!builder.IsEmpty())
       builder.Append(' ');
-    builder.Append("m_preloadCount(");
+    builder.Append("preload_count_(");
     builder.AppendNumber(preload_count_);
     builder.Append(')');
   }
@@ -808,7 +808,7 @@
   //    back.
   //
   // Handle case (1) by saving a list of clients to notify. A separate list also
-  // ensure a client is either in m_clients or m_clientsAwaitingCallback.
+  // ensure a client is either in cliens_ or clients_awaiting_callback_.
   HeapVector<Member<ResourceClient>> clients_to_notify;
   CopyToVector(clients_awaiting_callback_, clients_to_notify);
 
@@ -820,7 +820,7 @@
 
     // When revalidation starts after waiting clients are scheduled and
     // before they are added here. In such cases, we just add the clients
-    // to |m_clients| without didAddClient(), as in Resource::addClient().
+    // to |clients_| without DidAddClient(), as in Resource::AddClient().
     if (!is_revalidating_)
       DidAddClient(client);
   }

diff --git a/third_party/WebKit/Source/platform/loader/fetch/ResourceFetcher.cpp b/third_party/WebKit/Source/platform/loader/fetch/ResourceFetcher.cpp
index 43a8c39..5b3016e 100644
--- a/third_party/WebKit/Source/platform/loader/fetch/ResourceFetcher.cpp
+++ b/third_party/WebKit/Source/platform/loader/fetch/ResourceFetcher.cpp

@@ -544,7 +544,7 @@
       params.GetSpeculativePreloadType(), params.IsLinkPreload()));
   InitializeResourceRequest(resource_request, factory.GetType(),
                             params.Defer());
-  network_instrumentation::resourcePrioritySet(identifier,
+  network_instrumentation::ResourcePrioritySet(identifier,
                                                resource_request.Priority());
 
   blocked_reason = Context().CanRequest(
@@ -706,7 +706,7 @@
 
   if (policy != kUse)
     InsertAsPreloadIfNecessary(resource, params, factory.GetType());
-  scoped_resource_load_tracker.resourceLoadContinuesBeyondScope();
+  scoped_resource_load_tracker.ResourceLoadContinuesBeyondScope();
 
   DCHECK(!resource->ErrorOccurred() ||
          params.Options().synchronous_policy == kRequestSynchronously);
@@ -1453,7 +1453,7 @@
 
     resource->DidChangePriority(resource_load_priority,
                                 resource_priority.intra_priority_value);
-    network_instrumentation::resourcePrioritySet(resource->Identifier(),
+    network_instrumentation::ResourcePrioritySet(resource->Identifier(),
                                                  resource_load_priority);
     Context().DispatchDidChangeResourcePriority(
         resource->Identifier(), resource_load_priority,

diff --git a/third_party/WebKit/Source/platform/loader/fetch/ResourceLoader.cpp b/third_party/WebKit/Source/platform/loader/fetch/ResourceLoader.cpp
index 93c6c69..f6b7668 100644
--- a/third_party/WebKit/Source/platform/loader/fetch/ResourceLoader.cpp
+++ b/third_party/WebKit/Source/platform/loader/fetch/ResourceLoader.cpp

@@ -410,9 +410,9 @@
 }
 
 void ResourceLoader::DidFinishLoadingFirstPartInMultipart() {
-  network_instrumentation::endResourceLoad(
+  network_instrumentation::EndResourceLoad(
       resource_->Identifier(),
-      network_instrumentation::RequestOutcome::Success);
+      network_instrumentation::RequestOutcome::kSuccess);
 
   fetcher_->HandleLoaderFinish(resource_.Get(), 0,
                                ResourceFetcher::kDidFinishFirstPartInMultipart);
@@ -428,9 +428,9 @@
 
   loader_.reset();
 
-  network_instrumentation::endResourceLoad(
+  network_instrumentation::EndResourceLoad(
       resource_->Identifier(),
-      network_instrumentation::RequestOutcome::Success);
+      network_instrumentation::RequestOutcome::kSuccess);
 
   fetcher_->HandleLoaderFinish(resource_.Get(), finish_time,
                                ResourceFetcher::kDidFinishLoading);
@@ -457,8 +457,8 @@
 
   loader_.reset();
 
-  network_instrumentation::endResourceLoad(
-      resource_->Identifier(), network_instrumentation::RequestOutcome::Fail);
+  network_instrumentation::EndResourceLoad(
+      resource_->Identifier(), network_instrumentation::RequestOutcome::kFail);
 
   fetcher_->HandleLoaderError(resource_.Get(), error);
 }

diff --git a/third_party/WebKit/Source/platform/network/NetworkInstrumentation.cpp b/third_party/WebKit/Source/platform/network/NetworkInstrumentation.cpp
index b1a19ed..789c0f40 100644
--- a/third_party/WebKit/Source/platform/network/NetworkInstrumentation.cpp
+++ b/third_party/WebKit/Source/platform/network/NetworkInstrumentation.cpp

@@ -9,6 +9,7 @@
 #include "platform/loader/fetch/ResourceLoadPriority.h"
 #include "platform/loader/fetch/ResourceRequest.h"
 
+namespace blink {
 namespace network_instrumentation {
 
 using network_instrumentation::RequestOutcome;
@@ -21,9 +22,9 @@
 
 const char* RequestOutcomeToString(RequestOutcome outcome) {
   switch (outcome) {
-    case RequestOutcome::Success:
+    case RequestOutcome::kSuccess:
       return "Success";
-    case RequestOutcome::Fail:
+    case RequestOutcome::kFail:
       return "Fail";
     default:
       NOTREACHED();
@@ -38,21 +39,21 @@
 
 namespace {
 
-std::unique_ptr<TracedValue> scopedResourceTrackerBeginData(
+std::unique_ptr<TracedValue> ScopedResourceTrackerBeginData(
     const blink::ResourceRequest& request) {
   std::unique_ptr<TracedValue> data = TracedValue::Create();
   data->SetString("url", request.Url().GetString());
   return data;
 }
 
-std::unique_ptr<TracedValue> resourcePrioritySetData(
+std::unique_ptr<TracedValue> ResourcePrioritySetData(
     blink::ResourceLoadPriority priority) {
   std::unique_ptr<TracedValue> data = TracedValue::Create();
   data->SetInteger("priority", priority);
   return data;
 }
 
-std::unique_ptr<TracedValue> endResourceLoadData(RequestOutcome outcome) {
+std::unique_ptr<TracedValue> EndResourceLoadData(RequestOutcome outcome) {
   std::unique_ptr<TracedValue> data = TracedValue::Create();
   data->SetString("outcome", RequestOutcomeToString(outcome));
   return data;
@@ -61,37 +62,38 @@
 }  // namespace
 
 ScopedResourceLoadTracker::ScopedResourceLoadTracker(
-    unsigned long resourceID,
+    unsigned long resource_id,
     const blink::ResourceRequest& request)
-    : m_resourceLoadContinuesBeyondScope(false), m_resourceID(resourceID) {
+    : resource_load_continues_beyond_scope_(false), resource_id_(resource_id) {
   TRACE_EVENT_NESTABLE_ASYNC_BEGIN1(
       kNetInstrumentationCategory, kResourceLoadTitle,
-      TRACE_ID_WITH_SCOPE(kBlinkResourceID, TRACE_ID_LOCAL(resourceID)),
-      "beginData", scopedResourceTrackerBeginData(request));
+      TRACE_ID_WITH_SCOPE(kBlinkResourceID, TRACE_ID_LOCAL(resource_id)),
+      "beginData", ScopedResourceTrackerBeginData(request));
 }
 
 ScopedResourceLoadTracker::~ScopedResourceLoadTracker() {
-  if (!m_resourceLoadContinuesBeyondScope)
-    endResourceLoad(m_resourceID, RequestOutcome::Fail);
+  if (!resource_load_continues_beyond_scope_)
+    EndResourceLoad(resource_id_, RequestOutcome::kFail);
 }
 
-void ScopedResourceLoadTracker::resourceLoadContinuesBeyondScope() {
-  m_resourceLoadContinuesBeyondScope = true;
+void ScopedResourceLoadTracker::ResourceLoadContinuesBeyondScope() {
+  resource_load_continues_beyond_scope_ = true;
 }
 
-void resourcePrioritySet(unsigned long resourceID,
+void ResourcePrioritySet(unsigned long resource_id,
                          blink::ResourceLoadPriority priority) {
   TRACE_EVENT_NESTABLE_ASYNC_INSTANT1(
       kNetInstrumentationCategory, kResourcePrioritySetTitle,
-      TRACE_ID_WITH_SCOPE(kBlinkResourceID, TRACE_ID_LOCAL(resourceID)), "data",
-      resourcePrioritySetData(priority));
+      TRACE_ID_WITH_SCOPE(kBlinkResourceID, TRACE_ID_LOCAL(resource_id)),
+      "data", ResourcePrioritySetData(priority));
 }
 
-void endResourceLoad(unsigned long resourceID, RequestOutcome outcome) {
+void EndResourceLoad(unsigned long resource_id, RequestOutcome outcome) {
   TRACE_EVENT_NESTABLE_ASYNC_END1(
       kNetInstrumentationCategory, kResourceLoadTitle,
-      TRACE_ID_WITH_SCOPE(kBlinkResourceID, TRACE_ID_LOCAL(resourceID)),
-      "endData", endResourceLoadData(outcome));
+      TRACE_ID_WITH_SCOPE(kBlinkResourceID, TRACE_ID_LOCAL(resource_id)),
+      "endData", EndResourceLoadData(outcome));
 }
 
 }  // namespace network_instrumentation
+}  // namespace blink

diff --git a/third_party/WebKit/Source/platform/network/NetworkInstrumentation.h b/third_party/WebKit/Source/platform/network/NetworkInstrumentation.h
index 39ccb39..8bcbd73 100644
--- a/third_party/WebKit/Source/platform/network/NetworkInstrumentation.h
+++ b/third_party/WebKit/Source/platform/network/NetworkInstrumentation.h

@@ -9,34 +9,35 @@
 #include "platform/loader/fetch/ResourceLoadPriority.h"
 
 namespace blink {
+
 class ResourceRequest;
-}  // namespace blink
 
 namespace network_instrumentation {
 
-enum RequestOutcome { Success, Fail };
+enum RequestOutcome { kSuccess, kFail };
 
 class PLATFORM_EXPORT ScopedResourceLoadTracker {
  public:
-  ScopedResourceLoadTracker(unsigned long resourceID,
+  ScopedResourceLoadTracker(unsigned long resource_id,
                             const blink::ResourceRequest&);
   ~ScopedResourceLoadTracker();
-  void resourceLoadContinuesBeyondScope();
+  void ResourceLoadContinuesBeyondScope();
 
  private:
   // If this variable is false, close resource load slice at end of scope.
-  bool m_resourceLoadContinuesBeyondScope;
+  bool resource_load_continues_beyond_scope_;
 
-  const unsigned long m_resourceID;
+  const unsigned long resource_id_;
 
   DISALLOW_COPY_AND_ASSIGN(ScopedResourceLoadTracker);
 };
 
-void PLATFORM_EXPORT resourcePrioritySet(unsigned long resourceID,
+void PLATFORM_EXPORT ResourcePrioritySet(unsigned long resource_id,
                                          blink::ResourceLoadPriority);
 
-void PLATFORM_EXPORT endResourceLoad(unsigned long resourceID, RequestOutcome);
+void PLATFORM_EXPORT EndResourceLoad(unsigned long resource_id, RequestOutcome);
 
 }  // namespace network_instrumentation
+}  // namespace blink
 
 #endif  // NetworkInstrumentation_h

diff --git a/tools/binary_size/libsupersize/archive.py b/tools/binary_size/libsupersize/archive.py
index 8fa685b..0559adc 100644
--- a/tools/binary_size/libsupersize/archive.py
+++ b/tools/binary_size/libsupersize/archive.py

@@ -323,6 +323,11 @@
       replacements.append((i, name_list))
       num_new_symbols += len(name_list) - 1
 
+  if float(num_new_symbols) / len(raw_symbols) < .1:
+    logging.warning('Number of aliases is oddly low (%.0f%%). It should '
+                    'usually be around 25%%. Ensure --tool-prefix is correct.',
+                    float(num_new_symbols) / len(raw_symbols) * 100)
+
   # Step 2: Create new symbols as siblings to each existing one.
   logging.debug('Creating %d aliases', num_new_symbols)
   src_cursor_end = len(raw_symbols)
@@ -601,8 +606,8 @@
   parser.add_argument('--no-source-paths', action='store_true',
                       help='Do not use .ninja files to map '
                            'object_path -> source_path')
-  parser.add_argument('--tool-prefix', default='',
-                      help='Path prefix for c++filt.')
+  parser.add_argument('--tool-prefix',
+                      help='Path prefix for c++filt, nm, readelf.')
   parser.add_argument('--output-directory',
                       help='Path to the root build directory.')
 

diff --git a/tools/binary_size/libsupersize/console.py b/tools/binary_size/libsupersize/console.py
index a25839a..a87d7e8 100644
--- a/tools/binary_size/libsupersize/console.py
+++ b/tools/binary_size/libsupersize/console.py

@@ -84,18 +84,24 @@
       for i, size_info in enumerate(size_infos):
         self._variables['size_info%d' % (i + 1)] = size_info
 
-  def _DiffFunc(self, before=None, after=None, cluster=True):
+  def _DiffFunc(self, before=None, after=None, cluster=True, sort=True):
     """Diffs two SizeInfo objects. Returns a SizeInfoDiff.
 
     Args:
       before: Defaults to first size_infos[0].
       after: Defaults to second size_infos[1].
-      cluster: When True, calls SymbolGroup.Cluster() after diffing. This
-          generally reduces noise.
+      cluster: When True (default), calls SymbolGroup.Cluster() after diffing.
+          Generally reduces noise.
+      sort: When True (default), calls SymbolGroup.Sorted() after diffing.
     """
     before = before if before is not None else self._size_infos[0]
     after = after if after is not None else self._size_infos[1]
-    return diff.Diff(before, after, cluster=cluster)
+    ret = diff.Diff(before, after)
+    if cluster:
+      ret.symbols = ret.symbols.Cluster()
+    if sort:
+      ret.symbols = ret.symbols.Sorted()
+    return ret
 
   def _PrintFunc(self, obj=None, verbose=False, recursive=False, use_pager=None,
                  to_file=None):
@@ -253,7 +259,7 @@
   parser.add_argument('--query',
                       help='Execute the given snippet. '
                            'Example: Print(size_info)')
-  parser.add_argument('--tool-prefix', default='',
+  parser.add_argument('--tool-prefix',
                       help='Path prefix for objdump. Required only for '
                            'Disassemble().')
   parser.add_argument('--output-directory',

diff --git a/tools/binary_size/libsupersize/diff.py b/tools/binary_size/libsupersize/diff.py
index c79207d..aa77054 100644
--- a/tools/binary_size/libsupersize/diff.py
+++ b/tools/binary_size/libsupersize/diff.py

@@ -180,19 +180,12 @@
       section_name=after.section_name)
 
 
-def Diff(before, after, cluster=True):
-  """Diffs two SizeInfo objects. Returns a SizeInfoDiff.
-
-  Args:
-    cluster: When True, calls SymbolGroup.Cluster() after diffing. This
-        generally reduces noise.
-  """
+def Diff(before, after):
+  """Diffs two SizeInfo objects. Returns a SizeInfoDiff."""
   assert isinstance(before, models.SizeInfo)
   assert isinstance(after, models.SizeInfo)
   section_sizes = {k: after.section_sizes[k] - v
                    for k, v in before.section_sizes.iteritems()}
   symbol_diff = _DiffSymbolGroups(before.symbols, after.symbols)
-  if cluster:
-    symbol_diff = symbol_diff.Cluster()
   return models.SizeInfoDiff(section_sizes, symbol_diff, before.metadata,
                              after.metadata)

diff --git a/tools/binary_size/libsupersize/integration_test.py b/tools/binary_size/libsupersize/integration_test.py
index 1c7deef..d6a3ffe 100755
--- a/tools/binary_size/libsupersize/integration_test.py
+++ b/tools/binary_size/libsupersize/integration_test.py

@@ -182,6 +182,7 @@
     size_info2.symbols -= size_info2.symbols[-3:]
     size_info1.symbols[1].size -= 10
     d = diff.Diff(size_info1, size_info2)
+    d.symbols = d.symbols.Cluster().Sorted()
     return describe.GenerateLines(d, verbose=True)
 
   def test_Diff_Aliases1(self):
@@ -257,6 +258,7 @@
         models.Symbol(S, 55, name='.L__bar_295', object_path='b'), # 5
     ]
     d = diff.Diff(size_info1, size_info2)
+    d.symbols = d.symbols.Cluster().Sorted()
     self.assertEquals(d.symbols.added_count, 0)
     self.assertEquals(d.symbols.size, 0)
 

diff --git a/tools/binary_size/libsupersize/testdata/Diff_Basic.golden b/tools/binary_size/libsupersize/testdata/Diff_Basic.golden
index 5f52d2d..98f284b 100644
--- a/tools/binary_size/libsupersize/testdata/Diff_Basic.golden
+++ b/tools/binary_size/libsupersize/testdata/Diff_Basic.golden

@@ -47,128 +47,128 @@
 
 Index, Running Total, Section@Address, PSS
 ------------------------------------------------------------
-+ 0)         16 (34.8%) t@0x28d900   pss=16  padding=0  size_without_padding=16
-               source_path=base/page_allocator.cc 	object_path=base/base/page_allocator.o
-               flags={startup}  name=_GLOBAL__sub_I_page_allocator.cc
-+ 1)         72 (156.5%) t@0x28d910   pss=56  padding=0  size_without_padding=56
++ 0)         56 (121.7%) t@0x28d910   pss=56  padding=0  size_without_padding=56
                source_path=base/page_allocator.cc 	object_path=base/base/page_allocator.o
                flags={startup}  name=_GLOBAL__sub_I_bbr_sender.cc
-- 2)         72 (156.5%) b@0x2dffda0  pss=-28  padding=0  size_without_padding=-28
-               source_path=third_party/icu/ucnv_ext.c 	object_path=third_party/icu/icuuc/ucnv_ext.o
-               flags={gen}  name=g_chrome_content_browser_client
-- 3)         72 (156.5%) b@0x2dffe84  pss=-4  padding=0  size_without_padding=-4
-               source_path=third_party/icu/ucnv_ext.c 	object_path=third_party/icu/icuuc/ucnv_ext.o
-               flags={anon,gen}  name=g_AnimationFrameTimeHistogram_clazz
-- 4)         72 (156.5%) b@0x2dffe80  pss=-4  padding=-196  size_without_padding=192
-               source_path=third_party/icu/ucnv_ext.c 	object_path=third_party/icu/icuuc/ucnv_ext.o
-               flags={gen}  name=SaveHistogram::atomic_histogram_pointer
-                    full_name=SaveHistogram(_JNIEnv*, base::android::JavaParamRef<_jobject*> const&, base::android::JavaParamRef<_jstring*> const&, base::android::JavaParamRef<_jlongArray*> const&, int)::atomic_histogram_pointer
-= 5)         72 (156.5%) t@0x28d948   pss=0  padding=0  size_without_padding=0
++ 1)         72 (156.5%) t@0x28d900   pss=16  padding=0  size_without_padding=16
                source_path=base/page_allocator.cc 	object_path=base/base/page_allocator.o
-               flags={startup}  name=_GLOBAL__sub_I_pacing_sender.cc
-~ 6)         82 (178.3%) t@0x28d964   pss=10  padding=0  size_without_padding=10
+               flags={startup}  name=_GLOBAL__sub_I_page_allocator.cc
+~ 2)         82 (178.3%) t@0x28d964   pss=10  padding=0  size_without_padding=10
                source_path=base/page_allocator.cc 	object_path=base/base/page_allocator.o
                flags={}  name=extFromUUseMapping
                     full_name=extFromUUseMapping(signed char, unsigned int, int)
-= 7)         82 (178.3%) t@0x28d98a   pss=0  padding=0  size_without_padding=0
+= 3)         82 (178.3%) r@0x284e364  pss=0  padding=0  size_without_padding=0
                source_path=base/page_allocator.cc 	object_path=base/base/page_allocator.o
-               flags={}  name=extFromUUseMapping
-                    full_name=extFromUUseMapping(aj, int)
-= 8)         82 (178.3%) t@Group      pss=0  padding=0  size_without_padding=0  count=3
-               source_path= 	object_path=
-               flags={}  name=** symbol gaps
-= 9)         82 (178.3%) t@0x28f000   pss=0  padding=0  size_without_padding=0
-               source_path=third_party/icu/ucnv_ext.c 	object_path=third_party/icu/icuuc/ucnv_ext.o
-               flags={gen}  name=ucnv_extMatchFromU
-                    full_name=ucnv_extMatchFromU(int const*, int, unsigned short const*, int, unsigned short const*, int, unsigned int*, signed char, signed char)
-= 10)        82 (178.3%) t@0x28f1c8   pss=0  padding=0  size_without_padding=0
-               source_path=third_party/icu/ucnv_ext.c 	object_path=third_party/icu/icuuc/ucnv_ext.o
-               flags={startup,gen}  name=_GLOBAL__sub_I_SkDeviceProfile.cpp
-= 11)        82 (178.3%) t@0x28f1e0   pss=0  padding=0  size_without_padding=0
-               source_path=third_party/icu/ucnv_ext.c 	object_path=third_party/icu/icuuc/ucnv_ext.o
-               flags={unlikely,gen}  name=foo_bar
-= 12)        82 (178.3%) t@0x2a0000   pss=0  padding=0  size_without_padding=0
-               source_path=third_party/paint.cc 	object_path=third_party/WebKit.a/PaintChunker.o
-               flags={}  name=blink::ContiguousContainerBase::shrinkToFit
-                    full_name=blink::ContiguousContainerBase::shrinkToFit()
-= 13)        82 (178.3%) t@0x2a0010   pss=0  padding=0  size_without_padding=0
-               source_path=third_party/paint.cc 	object_path=third_party/WebKit.a/PaintChunker.o
-               flags={}  name=blink::ContiguousContainerBase::shrinkToFit [clone .part.1234] [clone .isra.2]
-                    full_name=blink::ContiguousContainerBase::shrinkToFit() [clone .part.1234] [clone .isra.2]
-= 14)        82 (178.3%) t@0x2a0020   pss=0  padding=0  size_without_padding=0
-               source_path=third_party/container.c 	object_path=third_party/WebKit.a/ContiguousContainer.o
-               flags={}  name=blink::ContiguousContainerBase::ContiguousContainerBase
-                    full_name=blink::ContiguousContainerBase::ContiguousContainerBase(blink::ContiguousContainerBase&&)
-= 15)        82 (178.3%) t@0x2a1000   pss=0  padding=0  size_without_padding=0
-               source_path=third_party/container.c 	object_path=third_party/WebKit.a/ContiguousContainer.o
-               flags={anon}  name=blink::PaintChunker::releasePaintChunks [clone .part.1]
-                    full_name=blink::PaintChunker::releasePaintChunks() [clone .part.1]
-= 16)        82 (178.3%) r@Group      pss=0  padding=0  size_without_padding=0  count=2
+= 4)         82 (178.3%) r@Group      pss=0  padding=0  size_without_padding=0  count=2
                source_path= 	object_path=
                flags={}  name=** merge strings
-= 17)        82 (178.3%) r@Group      pss=0  padding=0  size_without_padding=0  count=2
+= 5)         82 (178.3%) d@0x2ddc608  pss=0  padding=0  size_without_padding=0
+               source_path= 	object_path=
+               flags={}  name=** symbol gap 3 (end of section)
+= 6)         82 (178.3%) d@0x2dffd88  pss=0  padding=0  size_without_padding=0
+               source_path= 	object_path=
+               flags={}  name=** symbol gap 3 (end of section)
+= 7)         82 (178.3%) t@Group      pss=0  padding=0  size_without_padding=0  count=3
                source_path= 	object_path=
                flags={}  name=** symbol gaps
-= 18)        82 (178.3%) r@0x284e364  pss=0  padding=0  size_without_padding=0
-               source_path=base/page_allocator.cc 	object_path=base/base/page_allocator.o
-= 19)        82 (178.3%) r@0x284e370  pss=0  padding=0  size_without_padding=0
+= 8)         82 (178.3%) r@Group      pss=0  padding=0  size_without_padding=0  count=2
+               source_path= 	object_path=
+               flags={}  name=** symbol gaps
+= 9)         82 (178.3%) d@0x2cd84e0  pss=0  padding=0  size_without_padding=0
+               source_path= 	object_path=third_party/gvr-android-sdk/libgvr_shim_static_arm.a/libcontroller_api_impl.a_controller_api_impl.o
+               flags={}  name=.Lswitch.table.45
+= 10)        82 (178.3%) d@0x2c176f0  pss=0  padding=0  size_without_padding=0
+               source_path=third_party/icu/ucnv_ext.c 	object_path=third_party/icu/icuuc/ucnv_ext.o
+               flags={gen}  name=ChromeMainDelegate [vtable]
+= 11)        82 (178.3%) d@0x2cd8500  pss=0  padding=0  size_without_padding=0
+               source_path=third_party/paint.cc 	object_path=third_party/WebKit.a/PaintChunker.o
+               flags={}  name=ChromeMainDelegateAndroid [vtable]
+= 12)        82 (178.3%) r@0x284e370  pss=0  padding=0  size_without_padding=0
                source_path=base/page_allocator.cc 	object_path=base/base/page_allocator.o
                flags={}  name=Name
-= 20)        82 (178.3%) r@0x284e398  pss=0  padding=0  size_without_padding=0
+= 13)        82 (178.3%) t@0x28f1c8   pss=0  padding=0  size_without_padding=0
+               source_path=third_party/icu/ucnv_ext.c 	object_path=third_party/icu/icuuc/ucnv_ext.o
+               flags={startup,gen}  name=_GLOBAL__sub_I_SkDeviceProfile.cpp
+= 14)        82 (178.3%) t@0x28d948   pss=0  padding=0  size_without_padding=0
+               source_path=base/page_allocator.cc 	object_path=base/base/page_allocator.o
+               flags={startup}  name=_GLOBAL__sub_I_pacing_sender.cc
+= 15)        82 (178.3%) d@0x2de70a4  pss=0  padding=0  size_without_padding=0
                source_path=third_party/container.c 	object_path=third_party/WebKit.a/ContiguousContainer.o
-               flags={}  name=chrome::mojom::FilePatcher::Name_
-= 21)        82 (178.3%) r@0x28f3450  pss=0  padding=0  size_without_padding=0
-               source_path=third_party/paint.cc 	object_path=third_party/WebKit.a/PaintChunker.o
-               flags={anon}  name=kAnimationFrameTimeHistogramClassPath
-= 22)        82 (178.3%) r@0x28f3480  pss=0  padding=0  size_without_padding=0
+               flags={anon,rel.loc}  name=base::android::g_library_version_number
+= 16)        82 (178.3%) d@0x2de70a0  pss=0  padding=0  size_without_padding=0
+               source_path=third_party/container.c 	object_path=third_party/WebKit.a/ContiguousContainer.o
+               flags={anon}  name=base::android::g_renderer_histogram_code
+= 17)        82 (178.3%) d@0x2de7008  pss=0  padding=0  size_without_padding=0
+               source_path=third_party/container.c 	object_path=third_party/WebKit.a/ContiguousContainer.o
+               flags={rel}  name=base::android::kBaseRegisteredMethods
+= 18)        82 (178.3%) r@0x28f3480  pss=0  padding=0  size_without_padding=0
                source_path=third_party/paint.cc 	object_path=third_party/WebKit.a/PaintChunker.o
                flags={anon}  name=blink::CSSValueKeywordsHash::findValueImpl::value_word_list
                     full_name=blink::CSSValueKeywordsHash::findValueImpl(char const*, unsigned int)::value_word_list
-= 23)        82 (178.3%) d@0x2c176f0  pss=0  padding=0  size_without_padding=0
-               source_path=third_party/icu/ucnv_ext.c 	object_path=third_party/icu/icuuc/ucnv_ext.o
-               flags={gen}  name=ChromeMainDelegate [vtable]
-= 24)        82 (178.3%) d@0x2c17728  pss=0  padding=0  size_without_padding=0
+= 19)        82 (178.3%) t@0x2a0020   pss=0  padding=0  size_without_padding=0
+               source_path=third_party/container.c 	object_path=third_party/WebKit.a/ContiguousContainer.o
+               flags={}  name=blink::ContiguousContainerBase::ContiguousContainerBase
+                    full_name=blink::ContiguousContainerBase::ContiguousContainerBase(blink::ContiguousContainerBase&&)
+= 20)        82 (178.3%) t@0x2a0000   pss=0  padding=0  size_without_padding=0
+               source_path=third_party/paint.cc 	object_path=third_party/WebKit.a/PaintChunker.o
+               flags={}  name=blink::ContiguousContainerBase::shrinkToFit
+                    full_name=blink::ContiguousContainerBase::shrinkToFit()
+= 21)        82 (178.3%) t@0x2a0010   pss=0  padding=0  size_without_padding=0
+               source_path=third_party/paint.cc 	object_path=third_party/WebKit.a/PaintChunker.o
+               flags={}  name=blink::ContiguousContainerBase::shrinkToFit [clone .part.1234] [clone .isra.2]
+                    full_name=blink::ContiguousContainerBase::shrinkToFit() [clone .part.1234] [clone .isra.2]
+= 22)        82 (178.3%) t@0x2a1000   pss=0  padding=0  size_without_padding=0
+               source_path=third_party/container.c 	object_path=third_party/WebKit.a/ContiguousContainer.o
+               flags={anon}  name=blink::PaintChunker::releasePaintChunks [clone .part.1]
+                    full_name=blink::PaintChunker::releasePaintChunks() [clone .part.1]
+= 23)        82 (178.3%) d@0x2c17728  pss=0  padding=0  size_without_padding=0
                source_path=third_party/icu/ucnv_ext.c 	object_path=third_party/icu/icuuc/ucnv_ext.o
                flags={gen}  name=chrome::mojom::FieldTrialRecorder [vtable]
-= 25)        82 (178.3%) d@0x2c17740  pss=0  padding=0  size_without_padding=0
+= 24)        82 (178.3%) d@0x2c17740  pss=0  padding=0  size_without_padding=0
                source_path=third_party/container.c 	object_path=third_party/WebKit.a/ContiguousContainer.o
                flags={}  name=chrome::mojom::FieldTrialRecorderProxy [vtable]
-= 26)        82 (178.3%) d@0x2cd84e0  pss=0  padding=0  size_without_padding=0
-               source_path= 	object_path=third_party/gvr-android-sdk/libgvr_shim_static_arm.a/libcontroller_api_impl.a_controller_api_impl.o
-               flags={}  name=.Lswitch.table.45
-= 27)        82 (178.3%) d@0x2cd84f0  pss=0  padding=0  size_without_padding=0
-               source_path= 	object_path=third_party/gvr-android-sdk/libgvr_shim_static_arm.a/libport_android_jni.a_jni_utils.o
-               flags={anon}  name=kSystemClassPrefixes
-= 28)        82 (178.3%) d@0x2cd8500  pss=0  padding=0  size_without_padding=0
-               source_path=third_party/paint.cc 	object_path=third_party/WebKit.a/PaintChunker.o
-               flags={}  name=ChromeMainDelegateAndroid [vtable]
-= 29)        82 (178.3%) d@0x2cd8538  pss=0  padding=0  size_without_padding=0
+= 25)        82 (178.3%) r@0x284e398  pss=0  padding=0  size_without_padding=0
+               source_path=third_party/container.c 	object_path=third_party/WebKit.a/ContiguousContainer.o
+               flags={}  name=chrome::mojom::FilePatcher::Name_
+= 26)        82 (178.3%) t@0x28d98a   pss=0  padding=0  size_without_padding=0
                source_path=base/page_allocator.cc 	object_path=base/base/page_allocator.o
-               flags={}  name=mojo::MessageReceiver [vtable]
-= 30)        82 (178.3%) d@0x2cd8550  pss=0  padding=0  size_without_padding=0
-               source_path=base/page_allocator.cc 	object_path=base/base/page_allocator.o
-               flags={}  name=kMethodsAnimationFrameTimeHistogram
-= 31)        82 (178.3%) d@0x2ddc608  pss=0  padding=0  size_without_padding=0
-               source_path= 	object_path=
-               flags={}  name=** symbol gap 3 (end of section)
-= 32)        82 (178.3%) d@0x2de7000  pss=0  padding=0  size_without_padding=0
+               flags={}  name=extFromUUseMapping
+                    full_name=extFromUUseMapping(aj, int)
+= 27)        82 (178.3%) t@0x28f1e0   pss=0  padding=0  size_without_padding=0
+               source_path=third_party/icu/ucnv_ext.c 	object_path=third_party/icu/icuuc/ucnv_ext.o
+               flags={unlikely,gen}  name=foo_bar
+= 28)        82 (178.3%) d@0x2de7000  pss=0  padding=0  size_without_padding=0
                source_path=base/page_allocator.cc 	object_path=base/base/page_allocator.o
                flags={}  name=google::protobuf::internal::pLinuxKernelCmpxchg
-= 33)        82 (178.3%) d@0x2de7004  pss=0  padding=0  size_without_padding=0
+= 29)        82 (178.3%) d@0x2de7004  pss=0  padding=0  size_without_padding=0
                source_path=third_party/container.c 	object_path=third_party/WebKit.a/ContiguousContainer.o
                flags={}  name=google::protobuf::internal::pLinuxKernelMemoryBarrier
-= 34)        82 (178.3%) d@0x2de7008  pss=0  padding=0  size_without_padding=0
-               source_path=third_party/container.c 	object_path=third_party/WebKit.a/ContiguousContainer.o
-               flags={rel}  name=base::android::kBaseRegisteredMethods
-= 35)        82 (178.3%) d@0x2de70a0  pss=0  padding=0  size_without_padding=0
-               source_path=third_party/container.c 	object_path=third_party/WebKit.a/ContiguousContainer.o
-               flags={anon}  name=base::android::g_renderer_histogram_code
-= 36)        82 (178.3%) d@0x2de70a4  pss=0  padding=0  size_without_padding=0
-               source_path=third_party/container.c 	object_path=third_party/WebKit.a/ContiguousContainer.o
-               flags={anon,rel.loc}  name=base::android::g_library_version_number
-= 37)        82 (178.3%) d@0x2dffd88  pss=0  padding=0  size_without_padding=0
-               source_path= 	object_path=
-               flags={}  name=** symbol gap 3 (end of section)
+= 30)        82 (178.3%) r@0x28f3450  pss=0  padding=0  size_without_padding=0
+               source_path=third_party/paint.cc 	object_path=third_party/WebKit.a/PaintChunker.o
+               flags={anon}  name=kAnimationFrameTimeHistogramClassPath
+= 31)        82 (178.3%) d@0x2cd8550  pss=0  padding=0  size_without_padding=0
+               source_path=base/page_allocator.cc 	object_path=base/base/page_allocator.o
+               flags={}  name=kMethodsAnimationFrameTimeHistogram
+= 32)        82 (178.3%) d@0x2cd84f0  pss=0  padding=0  size_without_padding=0
+               source_path= 	object_path=third_party/gvr-android-sdk/libgvr_shim_static_arm.a/libport_android_jni.a_jni_utils.o
+               flags={anon}  name=kSystemClassPrefixes
+= 33)        82 (178.3%) d@0x2cd8538  pss=0  padding=0  size_without_padding=0
+               source_path=base/page_allocator.cc 	object_path=base/base/page_allocator.o
+               flags={}  name=mojo::MessageReceiver [vtable]
+= 34)        82 (178.3%) t@0x28f000   pss=0  padding=0  size_without_padding=0
+               source_path=third_party/icu/ucnv_ext.c 	object_path=third_party/icu/icuuc/ucnv_ext.o
+               flags={gen}  name=ucnv_extMatchFromU
+                    full_name=ucnv_extMatchFromU(int const*, int, unsigned short const*, int, unsigned short const*, int, unsigned int*, signed char, signed char)
+- 35)        82 (178.3%) b@0x2dffda0  pss=-28  padding=0  size_without_padding=-28
+               source_path=third_party/icu/ucnv_ext.c 	object_path=third_party/icu/icuuc/ucnv_ext.o
+               flags={gen}  name=g_chrome_content_browser_client
+- 36)        82 (178.3%) b@0x2dffe80  pss=-4  padding=-196  size_without_padding=192
+               source_path=third_party/icu/ucnv_ext.c 	object_path=third_party/icu/icuuc/ucnv_ext.o
+               flags={gen}  name=SaveHistogram::atomic_histogram_pointer
+                    full_name=SaveHistogram(_JNIEnv*, base::android::JavaParamRef<_jobject*> const&, base::android::JavaParamRef<_jstring*> const&, base::android::JavaParamRef<_jlongArray*> const&, int)::atomic_histogram_pointer
+- 37)        82 (178.3%) b@0x2dffe84  pss=-4  padding=0  size_without_padding=-4
+               source_path=third_party/icu/ucnv_ext.c 	object_path=third_party/icu/icuuc/ucnv_ext.o
+               flags={anon,gen}  name=g_AnimationFrameTimeHistogram_clazz
 = 38)        82 (178.3%) b@0x0        pss=0  padding=0  size_without_padding=0
                source_path=third_party/fft_float.cc 	object_path=third_party/ffmpeg/libffmpeg_internal.a/fft_float.o
                flags={}  name=ff_cos_131072

diff --git a/tools/metrics/histograms/enums.xml b/tools/metrics/histograms/enums.xml
index 47a14ff1..4de19ab 100644
--- a/tools/metrics/histograms/enums.xml
+++ b/tools/metrics/histograms/enums.xml

@@ -21277,6 +21277,7 @@
       label="disallow-autofill-sync-credential-for-reauth"/>
   <int value="-1349532167" label="enable-wifi-credential-sync"/>
   <int value="-1346722635" label="gesture-selection"/>
+  <int value="-1344375439" label="ServiceWorkerPaymentApps:disabled"/>
   <int value="-1341092934" label="enable-accelerated-overflow-scroll"/>
   <int value="-1340055960" label="enable-streamlined-hosted-apps"/>
   <int value="-1337185440" label="enable-webvr"/>
@@ -21773,6 +21774,7 @@
   <int value="625273056" label="disable-boot-animation"/>
   <int value="628302973" label="NTPSnippets:enabled"/>
   <int value="628570445" label="AndroidAutofillAccessibility:enabled"/>
+  <int value="630244477" label="ServiceWorkerPaymentApps:enabled"/>
   <int value="630947363" label="touch-events"/>
   <int value="635971109" label="PrintPdfAsImage:disabled"/>
   <int value="636425179" label="mhtml-generator-option"/>

diff --git a/tools/metrics/histograms/histograms.xml b/tools/metrics/histograms/histograms.xml
index 9d3aff3a..ba76f7b 100644
--- a/tools/metrics/histograms/histograms.xml
+++ b/tools/metrics/histograms/histograms.xml

@@ -31956,9 +31956,9 @@
   <owner>elawrence@chromium.org</owner>
   <owner>estark@chromium.org</owner>
   <summary>
-    The scheme of the URL for each main-frame navigation that goes to a
-    different page. Transitions like fragment change or history.pushState are
-    excluded.
+    The scheme of the URL for each main-frame navigation that replaces a
+    document object. This is not reported for reference fragment navigations,
+    pushState/replaceState or same page history navigation.
   </summary>
 </histogram>
 
@@ -31967,9 +31967,10 @@
   <owner>elawrence@chromium.org</owner>
   <owner>estark@chromium.org</owner>
   <summary>
-    The scheme of the URL for each main-frame navigation that goes to a
-    different page while in incognito. Transitions like fragment change or
-    history.pushState are excluded.
+    The scheme of the URL for each main-frame navigation that replaces a
+    document object while in incognito. This is not reported for reference
+    fragment navigations, pushState/replaceState or same page history
+    navigation.
   </summary>
 </histogram>
 

diff --git a/tools/perf/benchmark.csv b/tools/perf/benchmark.csv
index b6047c3c..3acd28c3 100644
--- a/tools/perf/benchmark.csv
+++ b/tools/perf/benchmark.csv

@@ -24,8 +24,8 @@
 dromaeo.domcoremodify,"yukishiino@chromium.org, bashi@chromium.org, haraken@chromium.org",
 dromaeo.domcorequery,"yukishiino@chromium.org, bashi@chromium.org, haraken@chromium.org",
 dromaeo.domcoretraverse,"yukishiino@chromium.org, bashi@chromium.org, haraken@chromium.org",
-dummy_benchmark.noisy_benchmark_1,,
-dummy_benchmark.stable_benchmark_1,,
+dummy_benchmark.noisy_benchmark_1,nednguyen@google.com,
+dummy_benchmark.stable_benchmark_1,nednguyen@google.com,
 gpu_perftests,reveman@chromium.org,
 gpu_times.gpu_rasterization.key_mobile_sites_smooth,,
 gpu_times.gpu_rasterization.top_25_smooth,,
@@ -56,8 +56,8 @@
 memory.top_10_mobile,perezju@chromium.org,
 memory.top_10_mobile_stress,perezju@chromium.org,
 octane,"bmeurer@chromium.org, mvstanton@chromium.org",
-oortonline,,
-oortonline_tbmv2,,
+oortonline,ulan@chromium.org,
+oortonline_tbmv2,ulan@chromium.org,
 page_cycler_v2.basic_oopif,nasko@chromium.org,
 page_cycler_v2.intl_ar_fa_he,"kouhei@chromium.org, ksakamoto@chromium.org",
 page_cycler_v2.intl_es_fr_pt-BR,"kouhei@chromium.org, ksakamoto@chromium.org",
@@ -162,7 +162,7 @@
 v8.browsing_mobile,ulan@chromium.org,
 v8.browsing_mobile_classic,hablich@chromium.org,
 v8.browsing_mobile_turbo,mvstaton@chromium.org,
-v8.detached_context_age_in_gc,,
+v8.detached_context_age_in_gc,ulan@chromium.org,
 v8.google,hablich@chromium.org,
 v8.infinite_scroll-classic_tbmv2,hablich@chromium.org,
 v8.infinite_scroll-turbo_tbmv2,mvstaton@chromium.org,

diff --git a/tools/perf/benchmarks/dummy_benchmark.py b/tools/perf/benchmarks/dummy_benchmark.py
index e477241a..2d1e972 100644
--- a/tools/perf/benchmarks/dummy_benchmark.py
+++ b/tools/perf/benchmarks/dummy_benchmark.py

@@ -12,6 +12,7 @@
 
 from core import perf_benchmark
 
+from telemetry import benchmark
 from telemetry.value import scalar
 from telemetry.page import legacy_page_test
 
@@ -39,6 +40,7 @@
   page_set = dummy_story_set.DummyStorySet
 
 
+@benchmark.Owner(emails=['nednguyen@google.com'])
 class DummyBenchmarkOne(_DummyBenchmark):
   """A low noise benchmark with mean=100 & std=1."""
 
@@ -50,6 +52,7 @@
     return 'dummy_benchmark.stable_benchmark_1'
 
 
+@benchmark.Owner(emails=['nednguyen@google.com'])
 class DummyBenchmarkTwo(_DummyBenchmark):
   """A noisy benchmark with mean=50 & std=20."""
 

diff --git a/tools/perf/benchmarks/oortonline.py b/tools/perf/benchmarks/oortonline.py
index 2453b80..488d9f9 100644
--- a/tools/perf/benchmarks/oortonline.py
+++ b/tools/perf/benchmarks/oortonline.py

@@ -34,6 +34,7 @@
 
 
 @benchmark.Disabled('android')
+@benchmark.Owner(emails=['ulan@chromium.org'])
 class OortOnline(perf_benchmark.PerfBenchmark):
   """OortOnline benchmark that measures WebGL and V8 performance.
   URL: http://oortonline.gl/#run
@@ -50,6 +51,7 @@
 
 
 @benchmark.Disabled('win')
+@benchmark.Owner(emails=['ulan@chromium.org'])
 class OortOnlineTBMv2(perf_benchmark.PerfBenchmark):
   """OortOnline benchmark that measures WebGL and V8 performance.
   URL: http://oortonline.gl/#run

diff --git a/tools/perf/benchmarks/v8.py b/tools/perf/benchmarks/v8.py
index c431b0c..bccdd689 100644
--- a/tools/perf/benchmarks/v8.py
+++ b/tools/perf/benchmarks/v8.py

@@ -57,6 +57,7 @@
     return 'v8.key_mobile_sites_smooth'
 
 
+@benchmark.Owner(emails=['ulan@chromium.org'])
 class V8DetachedContextAgeInGC(perf_benchmark.PerfBenchmark):
   """Measures the number of GCs needed to collect a detached context.
 

diff --git a/tools/perf/core/perf_data_generator.py b/tools/perf/core/perf_data_generator.py
index fdd4738..edcffaa 100755
--- a/tools/perf/core/perf_data_generator.py
+++ b/tools/perf/core/perf_data_generator.py

@@ -259,7 +259,12 @@
            'build75-b1--device1', 'build75-b1--device2', 'build75-b1--device3',
            'build75-b1--device4', 'build75-b1--device5', 'build75-b1--device6',
            'build75-b1--device7',
-          ]
+          ],
+       'perf_tests': [
+         ('tracing_perftests', 'build73-b1--device2'),
+         ('gpu_perftests', 'build73-b1--device2'),
+         ('cc_perftests', 'build73-b1--device2'),
+         ]
       }
     ])
 

diff --git a/tools/perf/unowned_benchmarks.txt b/tools/perf/unowned_benchmarks.txt
index 323fdfa..bebe0ba 100644
--- a/tools/perf/unowned_benchmarks.txt
+++ b/tools/perf/unowned_benchmarks.txt

@@ -3,16 +3,12 @@
 blink_style.polymer
 blink_style.top_25
 blob_storage.blob_storage
-dummy_benchmark.noisy_benchmark_1
-dummy_benchmark.stable_benchmark_1
 gpu_times.gpu_rasterization.key_mobile_sites_smooth
 gpu_times.gpu_rasterization.top_25_smooth
 gpu_times.key_mobile_sites_smooth
 gpu_times.top_25_smooth
 loading.cluster_telemetry
 load_library_perf_tests
-oortonline
-oortonline_tbmv2
 power.idle_platform
 power.steady_state
 power.top_10
@@ -34,6 +30,5 @@
 thread_times.key_hit_test_cases
 thread_times.key_mobile_sites_smooth
 thread_times.key_noop_cases
-v8.detached_context_age_in_gc
 webrtc.getusermedia
-webrtc.peerconnection
\ No newline at end of file
+webrtc.peerconnection