diff --git a/DEPS b/DEPS
index 0a2d746..eb98fa5 100644
--- a/DEPS
+++ b/DEPS
@@ -40,7 +40,7 @@
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling Skia
   # and whatever else without interference from each other.
-  'skia_revision': 'd4e75e24a7f8722e0c1903cd39e418f82d18090a',
+  'skia_revision': 'ac1f09d53bfe8b99ae7ac82b54e3911258b07b6a',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling V8
   # and whatever else without interference from each other.
@@ -408,7 +408,7 @@
 
     # Build tools for Chrome OS. Note: This depends on third_party/pyelftools.
     'src/third_party/chromite':
-      Var('chromium_git') + '/chromiumos/chromite.git' + '@' + 'bcd6eaeaf3259e990aa9382e2d4e225a2ce0c5f1',
+      Var('chromium_git') + '/chromiumos/chromite.git' + '@' + 'de4d8e3236c7b705c4577f8162183990abb0b570',
 
     # Dependency of chromite.git and skia.
     'src/third_party/pyelftools':
diff --git a/android_webview/java/src/org/chromium/android_webview/AwCookieManager.java b/android_webview/java/src/org/chromium/android_webview/AwCookieManager.java
index a4350dbf..1b04604 100644
--- a/android_webview/java/src/org/chromium/android_webview/AwCookieManager.java
+++ b/android_webview/java/src/org/chromium/android_webview/AwCookieManager.java
@@ -10,6 +10,9 @@
 
 import org.chromium.base.annotations.CalledByNative;
 import org.chromium.base.annotations.JNINamespace;
+import org.chromium.base.library_loader.LibraryLoader;
+import org.chromium.base.library_loader.LibraryProcessType;
+import org.chromium.base.library_loader.ProcessInitException;
 
 /**
  * AwCookieManager manages cookies according to RFC2109 spec.
@@ -19,6 +22,14 @@
 @JNINamespace("android_webview")
 public final class AwCookieManager {
 
+    public AwCookieManager() {
+        try {
+            LibraryLoader.get(LibraryProcessType.PROCESS_WEBVIEW).ensureInitialized();
+        } catch (ProcessInitException e) {
+            throw new RuntimeException("Error initializing WebView library", e);
+        }
+    }
+
     /**
      * Control whether cookie is enabled or disabled
      * @param accept TRUE if accept cookie
diff --git a/android_webview/lib/main/webview_entry_point.cc b/android_webview/lib/main/webview_entry_point.cc
index 12d0fa9..dfda801 100644
--- a/android_webview/lib/main/webview_entry_point.cc
+++ b/android_webview/lib/main/webview_entry_point.cc
@@ -4,6 +4,7 @@
 
 #include "android_webview/lib/main/webview_jni_onload.h"
 #include "base/android/jni_android.h"
+#include "base/android/library_loader/library_loader_hooks.h"
 
 // This is called by the VM when the shared library is first loaded.
 // Most of the initialization is done in LibraryLoadedOnMainThread(), not here.
@@ -12,16 +13,7 @@
   // we don't have a good way to detect the JNI registrations which is called,
   // outside of OnJNIOnLoadRegisterJNI code path.
   base::android::DisableManualJniRegistration();
-
-  if (base::android::IsManualJniRegistrationDisabled()) {
-    base::android::InitVM(vm);
-  } else {
-    if (android_webview::OnJNIOnLoadRegisterJNI(vm))
-      return -1;
-  }
-
-  if (!android_webview::OnJNIOnLoadInit()) {
-    return -1;
-  }
+  base::android::InitVM(vm);
+  base::android::SetNativeInitializationHook(&android_webview::OnJNIOnLoadInit);
   return JNI_VERSION_1_4;
 }
diff --git a/ash/app_list/app_list_presenter_delegate.cc b/ash/app_list/app_list_presenter_delegate.cc
index 14e9b3d5..973875b9 100644
--- a/ash/app_list/app_list_presenter_delegate.cc
+++ b/ash/app_list/app_list_presenter_delegate.cc
@@ -35,12 +35,12 @@
 namespace ash {
 namespace {
 
-// Gets the point at the center of the display that a particular view is on.
+// Gets the point at the center of the display containing the given |window|.
 // This calculation excludes the virtual keyboard area. If the height of the
 // display area is less than |minimum_height|, its bottom will be extended to
 // that height (so that the app list never starts above the top of the screen).
-gfx::Point GetCenterOfDisplayForView(views::View* view, int minimum_height) {
-  WmWindow* window = WmLookup::Get()->GetWindowForWidget(view->GetWidget());
+gfx::Point GetCenterOfDisplayForWindow(WmWindow* window, int minimum_height) {
+  DCHECK(window);
   gfx::Rect bounds = wm::GetDisplayBoundsWithShelf(window);
   bounds = window->GetRootWindow()->ConvertRectToScreen(bounds);
 
@@ -109,10 +109,9 @@
   aura::Window* root_window = Shell::GetInstance()
                                   ->window_tree_host_manager()
                                   ->GetRootWindowForDisplayId(display_id);
+  WmWindow* wm_root_window = WmWindowAura::Get(root_window);
   aura::Window* container = GetRootWindowController(root_window)
                                 ->GetContainer(kShellWindowId_AppListContainer);
-  WmShelf* shelf = WmShelf::ForWindow(WmWindowAura::Get(container));
-  AppListButton* applist_button = shelf->shelf_widget()->GetAppListButton();
   bool is_fullscreen = IsFullscreenAppListEnabled() &&
                        WmShell::Get()
                            ->maximize_mode_controller()
@@ -123,11 +122,9 @@
         ScreenUtil::GetDisplayWorkAreaBoundsInParent(container));
   } else {
     view->InitAsBubble(container, current_apps_page);
-    // The app list is centered over the display of the app list button that was
-    // pressed (if triggered via keyboard, this is the display with the
-    // currently focused window).
-    view->SetAnchorPoint(GetCenterOfDisplayForView(
-        applist_button, GetMinimumBoundsHeightForAppList(view)));
+    // The app list is centered over the display.
+    view->SetAnchorPoint(GetCenterOfDisplayForWindow(
+        wm_root_window, GetMinimumBoundsHeightForAppList(view)));
   }
 
   keyboard::KeyboardController* keyboard_controller =
@@ -135,8 +132,8 @@
   if (keyboard_controller)
     keyboard_controller->AddObserver(this);
   Shell::GetInstance()->AddPreTargetHandler(this);
-  WmWindow* window = WmShell::Get()->GetRootWindowForDisplayId(display_id);
-  window->GetRootWindowController()->GetShelf()->AddObserver(this);
+  WmShelf* shelf = WmShelf::ForWindow(wm_root_window);
+  shelf->AddObserver(this);
 
   // By setting us as DnD recipient, the app list knows that we can
   // handle items.
@@ -148,10 +145,10 @@
   is_visible_ = true;
   // Update applist button status when app list visibility is changed.
   WmWindow* root_window = WmShell::Get()->GetRootWindowForDisplayId(display_id);
-  WmShelf::ForWindow(root_window)
-      ->shelf_widget()
-      ->GetAppListButton()
-      ->OnAppListShown();
+  AppListButton* app_list_button =
+      WmShelf::ForWindow(root_window)->shelf_widget()->GetAppListButton();
+  if (app_list_button)
+    app_list_button->OnAppListShown();
 }
 
 void AppListPresenterDelegate::OnDismissed() {
@@ -161,9 +158,11 @@
   is_visible_ = false;
 
   // Update applist button status when app list visibility is changed.
-  WmShelf* shelf = WmShelf::ForWindow(
-      WmLookup::Get()->GetWindowForWidget(view_->GetWidget()));
-  shelf->shelf_widget()->GetAppListButton()->OnAppListDismissed();
+  WmWindow* window = WmLookup::Get()->GetWindowForWidget(view_->GetWidget());
+  AppListButton* app_list_button =
+      WmShelf::ForWindow(window)->shelf_widget()->GetAppListButton();
+  if (app_list_button)
+    app_list_button->OnAppListDismissed();
 }
 
 void AppListPresenterDelegate::UpdateBounds() {
@@ -171,8 +170,9 @@
     return;
 
   view_->UpdateBounds();
-  view_->SetAnchorPoint(GetCenterOfDisplayForView(
-      view_, GetMinimumBoundsHeightForAppList(view_)));
+  view_->SetAnchorPoint(GetCenterOfDisplayForWindow(
+      WmLookup::Get()->GetWindowForWidget(view_->GetWidget()),
+      GetMinimumBoundsHeightForAppList(view_)));
 }
 
 gfx::Vector2d AppListPresenterDelegate::GetVisibilityAnimationOffset(
diff --git a/ash/aura/wm_window_aura.cc b/ash/aura/wm_window_aura.cc
index c52d0a9..187ce852 100644
--- a/ash/aura/wm_window_aura.cc
+++ b/ash/aura/wm_window_aura.cc
@@ -86,6 +86,9 @@
 
 }  // namespace
 
+// static
+bool WmWindowAura::default_use_empty_minimum_size_for_testing_ = false;
+
 WmWindowAura::~WmWindowAura() {
   if (added_transient_observer_)
     ::wm::TransientWindowManager::Get(window_)->RemoveObserver(this);
@@ -131,6 +134,13 @@
                    : nullptr;
 }
 
+bool WmWindowAura::ShouldUseExtendedHitRegion() const {
+  const WmWindow* parent = Get(window_->parent());
+  return parent &&
+         static_cast<const WmWindowAura*>(parent)
+             ->children_use_extended_hit_region_;
+}
+
 void WmWindowAura::Destroy() {
   delete window_;
   // WARNING: this has been deleted.
@@ -185,11 +195,6 @@
   window_->SetProperty(aura::client::kAppType, app_type);
 }
 
-bool WmWindowAura::IsBubble() {
-  views::Widget* widget = views::Widget::GetWidgetForNativeView(window_);
-  return widget->widget_delegate()->AsBubbleDialogDelegate() != nullptr;
-}
-
 ui::Layer* WmWindowAura::GetLayer() {
   return window_->layer();
 }
@@ -244,8 +249,9 @@
 }
 
 gfx::Size WmWindowAura::GetMinimumSize() const {
-  return window_->delegate() ? window_->delegate()->GetMinimumSize()
-                             : gfx::Size();
+  return window_->delegate() && !use_empty_minimum_size_for_testing_
+             ? window_->delegate()->GetMinimumSize()
+             : gfx::Size();
 }
 
 gfx::Size WmWindowAura::GetMaximumSize() const {
@@ -694,7 +700,10 @@
 }
 
 views::Widget* WmWindowAura::GetInternalWidget() {
-  return views::Widget::GetWidgetForNativeView(window_);
+  return window_->GetProperty(kWidgetCreationTypeKey) ==
+                 WidgetCreationType::INTERNAL
+             ? views::Widget::GetWidgetForNativeView(window_)
+             : nullptr;
 }
 
 void WmWindowAura::CloseWidget() {
@@ -785,6 +794,10 @@
 }
 
 void WmWindowAura::SetChildrenUseExtendedHitRegion() {
+  children_use_extended_hit_region_ = true;
+  if (aura::Env::GetInstance()->mode() == aura::Env::Mode::MUS)
+    return;
+
   gfx::Insets mouse_extend(-kResizeOutsideBoundsSize, -kResizeOutsideBoundsSize,
                            -kResizeOutsideBoundsSize,
                            -kResizeOutsideBoundsSize);
@@ -841,7 +854,9 @@
 WmWindowAura::WmWindowAura(aura::Window* window)
     : window_(window),
       // Mirrors that of aura::Window.
-      observers_(base::ObserverList<WmWindowObserver>::NOTIFY_EXISTING_ONLY) {
+      observers_(base::ObserverList<WmWindowObserver>::NOTIFY_EXISTING_ONLY),
+      use_empty_minimum_size_for_testing_(
+          default_use_empty_minimum_size_for_testing_) {
   window_->AddObserver(this);
   window_->SetProperty(kWmWindowKey, this);
 }
diff --git a/ash/aura/wm_window_aura.h b/ash/aura/wm_window_aura.h
index 9531709..62ab8fe 100644
--- a/ash/aura/wm_window_aura.h
+++ b/ash/aura/wm_window_aura.h
@@ -14,6 +14,8 @@
 
 namespace ash {
 
+class WmWindowAuraTestApi;
+
 // WmWindowAura is tied to the life of the underlying aura::Window. Use the
 // static Get() function to obtain a WmWindowAura from an aura::Window.
 class ASH_EXPORT WmWindowAura : public WmWindow,
@@ -45,6 +47,9 @@
   aura::Window* aura_window() { return window_; }
   const aura::Window* aura_window() const { return window_; }
 
+  // See description of |children_use_extended_hit_region_|.
+  bool ShouldUseExtendedHitRegion() const;
+
   // WmWindow:
   void Destroy() override;
   const WmWindow* GetRootWindow() const override;
@@ -60,7 +65,6 @@
   ui::wm::WindowType GetType() const override;
   int GetAppType() const override;
   void SetAppType(int app_type) const override;
-  bool IsBubble() override;
   ui::Layer* GetLayer() override;
   bool GetLayerTargetVisibility() override;
   bool GetLayerVisible() override;
@@ -219,6 +223,8 @@
                                aura::Window* transient) override;
 
  private:
+  friend class WmWindowAuraTestApi;
+
   aura::Window* window_;
 
   base::ObserverList<WmWindowObserver> observers_;
@@ -226,6 +232,16 @@
   bool added_transient_observer_ = false;
   base::ObserverList<WmTransientWindowObserver> transient_observers_;
 
+  // If true child windows should get a slightly larger hit region to make
+  // resizing easier.
+  bool children_use_extended_hit_region_ = false;
+
+  // Default value for |use_empty_minimum_size_for_testing_|.
+  static bool default_use_empty_minimum_size_for_testing_;
+
+  // If true the minimum size is 0x0, default is minimum size comes from widget.
+  bool use_empty_minimum_size_for_testing_;
+
   DISALLOW_COPY_AND_ASSIGN(WmWindowAura);
 };
 
diff --git a/ash/common/wm_window.h b/ash/common/wm_window.h
index 6dbe40b..927863b 100644
--- a/ash/common/wm_window.h
+++ b/ash/common/wm_window.h
@@ -93,8 +93,6 @@
   virtual int GetAppType() const = 0;
   virtual void SetAppType(int app_type) const = 0;
 
-  virtual bool IsBubble() = 0;
-
   virtual ui::Layer* GetLayer() = 0;
 
   // TODO(sky): these are temporary until GetLayer() always returns non-null.
diff --git a/ash/mus/BUILD.gn b/ash/mus/BUILD.gn
index 893c2ae..b921bc58 100644
--- a/ash/mus/BUILD.gn
+++ b/ash/mus/BUILD.gn
@@ -213,8 +213,6 @@
     "accelerators/accelerator_controller_unittest.cc",
     "app_launch_unittest.cc",
     "bridge/wm_shell_mus_test_api.h",
-    "bridge/wm_window_mus_test_api.cc",
-    "bridge/wm_window_mus_test_api.h",
     "root_window_controller_unittest.cc",
     "test/ash_test_impl_mus.cc",
     "test/ash_test_impl_mus.h",
@@ -231,6 +229,7 @@
     "//ash",
     "//ash/common/test:test_support",
     "//ash/public/interfaces",
+    "//ash/test:test_support_without_content",
     "//base",
     "//base/test:test_config",
     "//base/test:test_support",
diff --git a/ash/mus/bridge/wm_root_window_controller_mus.cc b/ash/mus/bridge/wm_root_window_controller_mus.cc
index e0497d8c..eedb2eb 100644
--- a/ash/mus/bridge/wm_root_window_controller_mus.cc
+++ b/ash/mus/bridge/wm_root_window_controller_mus.cc
@@ -14,7 +14,6 @@
 #include "ui/aura/window.h"
 #include "ui/aura/window_property.h"
 #include "ui/display/display.h"
-#include "ui/views/widget/native_widget_aura.h"
 #include "ui/views/widget/widget.h"
 
 DECLARE_WINDOW_PROPERTY_TYPE(ash::mus::WmRootWindowControllerMus*);
@@ -103,11 +102,6 @@
       WmWindowMus::Get(root_window_controller_->root())
           ->GetChildByShellWindowId(shell_container_id));
   DCHECK(init_params->parent);
-  views::NativeWidgetAura* native_widget_aura =
-      new views::NativeWidgetAura(widget);
-  init_params->native_widget = native_widget_aura;
-  WmWindowMus::Get(native_widget_aura->GetNativeView())
-      ->set_widget(widget, WmWindowMus::WidgetCreationType::INTERNAL);
 }
 
 WmWindow* WmRootWindowControllerMus::FindEventTarget(
diff --git a/ash/mus/bridge/wm_shell_mus.cc b/ash/mus/bridge/wm_shell_mus.cc
index a07baf09..8794f8554 100644
--- a/ash/mus/bridge/wm_shell_mus.cc
+++ b/ash/mus/bridge/wm_shell_mus.cc
@@ -29,7 +29,6 @@
 #include "ash/mus/keyboard_ui_mus.h"
 #include "ash/mus/root_window_controller.h"
 #include "ash/mus/window_manager.h"
-#include "ash/public/cpp/shell_window_ids.h"
 #include "ash/shared/immersive_fullscreen_controller.h"
 #include "base/memory/ptr_util.h"
 #include "components/user_manager/user_info_impl.h"
@@ -181,16 +180,6 @@
   root_window_controllers_.erase(iter);
 }
 
-// static
-WmWindowMus* WmShellMus::GetToplevelAncestor(aura::Window* window) {
-  while (window) {
-    if (IsActivationParent(window->parent()))
-      return WmWindowMus::Get(window);
-    window = window->parent();
-  }
-  return nullptr;
-}
-
 WmRootWindowControllerMus* WmShellMus::GetRootWindowControllerWithDisplayId(
     int64_t id) {
   for (WmRootWindowControllerMus* root_window_controller :
@@ -444,12 +433,6 @@
 }
 #endif  // defined(OS_CHROMEOS)
 
-// static
-bool WmShellMus::IsActivationParent(aura::Window* window) {
-  return window && IsActivatableShellWindowId(
-                       WmWindowMus::Get(window)->GetShellWindowId());
-}
-
 // TODO: support OnAttemptToReactivateWindow, http://crbug.com/615114.
 // TODO: Nuke and let client code use ActivationChangeObserver directly.
 void WmShellMus::OnWindowActivated(ActivationReason reason,
diff --git a/ash/mus/bridge/wm_shell_mus.h b/ash/mus/bridge/wm_shell_mus.h
index fc86876..43ec36f 100644
--- a/ash/mus/bridge/wm_shell_mus.h
+++ b/ash/mus/bridge/wm_shell_mus.h
@@ -32,7 +32,6 @@
 class WindowManager;
 class WmRootWindowControllerMus;
 class WmShellMusTestApi;
-class WmWindowMus;
 
 // WmShell implementation for mus.
 class WmShellMus : public WmShell,
@@ -48,10 +47,6 @@
   void AddRootWindowController(WmRootWindowControllerMus* controller);
   void RemoveRootWindowController(WmRootWindowControllerMus* controller);
 
-  // Returns the ancestor of |window| (including |window|) that is considered
-  // toplevel. |window| may be null.
-  static WmWindowMus* GetToplevelAncestor(aura::Window* window);
-
   WmRootWindowControllerMus* GetRootWindowControllerWithDisplayId(int64_t id);
 
   AcceleratorControllerDelegateMus* accelerator_controller_delegate() {
@@ -123,9 +118,6 @@
  private:
   friend class WmShellMusTestApi;
 
-  // Returns true if |window| is a window that can have active children.
-  static bool IsActivationParent(aura::Window* window);
-
   // aura::client::ActivationChangeObserver:
   void OnWindowActivated(ActivationReason reason,
                          aura::Window* gained_active,
diff --git a/ash/mus/bridge/wm_window_mus.cc b/ash/mus/bridge/wm_window_mus.cc
index a7cb952..ce4c457 100644
--- a/ash/mus/bridge/wm_window_mus.cc
+++ b/ash/mus/bridge/wm_window_mus.cc
@@ -35,13 +35,7 @@
 namespace ash {
 namespace mus {
 
-// static
-bool WmWindowMus::default_use_empty_minimum_size_for_testing_ = false;
-
-WmWindowMus::WmWindowMus(aura::Window* window)
-    : WmWindowAura(window),
-      use_empty_minimum_size_for_testing_(
-          default_use_empty_minimum_size_for_testing_) {}
+WmWindowMus::WmWindowMus(aura::Window* window) : WmWindowAura(window) {}
 
 WmWindowMus::~WmWindowMus() {}
 
@@ -68,19 +62,10 @@
   return WmRootWindowControllerMus::Get(aura_window()->GetRootWindow());
 }
 
-bool WmWindowMus::ShouldUseExtendedHitRegion() const {
-  const WmWindowMus* parent = Get(aura_window()->parent());
-  return parent && parent->children_use_extended_hit_region_;
-}
-
 bool WmWindowMus::IsContainer() const {
   return GetShellWindowId() != kShellWindowId_Invalid;
 }
 
-const WmWindow* WmWindowMus::GetRootWindow() const {
-  return Get(aura_window()->GetRootWindow());
-}
-
 WmRootWindowController* WmWindowMus::GetRootWindowController() {
   return GetRootWindowControllerMus();
 }
@@ -89,52 +74,6 @@
   return WmShellMus::Get();
 }
 
-bool WmWindowMus::IsBubble() {
-  return aura_window()->GetProperty(aura::client::kWindowTypeKey) ==
-         ui::mojom::WindowType::BUBBLE;
-}
-
-bool WmWindowMus::HasNonClientArea() {
-  return widget_ ? true : false;
-}
-
-int WmWindowMus::GetNonClientComponent(const gfx::Point& location) {
-  return widget_ ? widget_->GetNonClientComponent(location) : HTNOWHERE;
-}
-
-gfx::Size WmWindowMus::GetMinimumSize() const {
-  return widget_ && !use_empty_minimum_size_for_testing_
-             ? widget_->GetMinimumSize()
-             : gfx::Size();
-}
-
-gfx::Size WmWindowMus::GetMaximumSize() const {
-  return widget_ ? widget_->GetMaximumSize() : gfx::Size();
-}
-
-gfx::Rect WmWindowMus::GetMinimizeAnimationTargetBoundsInScreen() const {
-  // TODO: need animation support: http://crbug.com/615087.
-  NOTIMPLEMENTED();
-  return GetBoundsInScreen();
-}
-
-bool WmWindowMus::IsSystemModal() const {
-  NOTIMPLEMENTED();
-  return false;
-}
-
-bool WmWindowMus::GetBoolProperty(WmWindowProperty key) {
-  switch (key) {
-    case WmWindowProperty::SNAP_CHILDREN_TO_PIXEL_BOUNDARY:
-      return snap_children_to_pixel_boundary_;
-
-    default:
-      break;
-  }
-
-  return WmWindowAura::GetBoolProperty(key);
-}
-
 int WmWindowMus::GetIntProperty(WmWindowProperty key) {
   if (key == WmWindowProperty::SHELF_ITEM_TYPE) {
     if (aura_window()->GetProperty(kShelfItemTypeKey) != TYPE_UNDEFINED)
@@ -147,16 +86,6 @@
   return WmWindowAura::GetIntProperty(key);
 }
 
-WmWindow* WmWindowMus::GetToplevelWindow() {
-  return WmShellMus::GetToplevelAncestor(aura_window());
-}
-
-WmWindow* WmWindowMus::GetToplevelWindowForFocus() {
-  // TODO(sky): resolve if we really need two notions of top-level. In the mus
-  // world they are the same.
-  return WmShellMus::GetToplevelAncestor(aura_window());
-}
-
 // TODO(sky): investigate if needed.
 bool WmWindowMus::MoveToEventRoot(const ui::Event& event) {
   views::View* target = static_cast<views::View*>(event.target());
@@ -191,22 +120,16 @@
   NOTIMPLEMENTED();
 }
 
-views::Widget* WmWindowMus::GetInternalWidget() {
-  // Don't return the window frame widget for an embedded client window.
-  if (widget_creation_type_ == WidgetCreationType::FOR_CLIENT)
-    return nullptr;
-
-  return widget_;
-}
-
 void WmWindowMus::CloseWidget() {
-  DCHECK(widget_);
+  views::Widget* widget = views::Widget::GetWidgetForNativeView(aura_window());
+  DCHECK(widget);
   // Allow the client to service the close request for remote widgets.
-  if (widget_creation_type_ == WidgetCreationType::FOR_CLIENT) {
+  if (aura_window()->GetProperty(kWidgetCreationTypeKey) ==
+      WidgetCreationType::FOR_CLIENT) {
     WmShellMus::Get()->window_manager()->window_manager_client()->RequestClose(
         aura_window());
   } else {
-    widget_->Close();
+    widget->Close();
   }
 }
 
@@ -214,7 +137,10 @@
 bool WmWindowMus::CanActivate() const {
   // TODO(sky): this isn't quite right. Should key off CanFocus(), which is not
   // replicated.
-  return WmWindowAura::CanActivate() && widget_ != nullptr;
+  // TODO(sky): fix const cast (most likely remove this override entirely).
+  return WmWindowAura::CanActivate() &&
+         views::Widget::GetWidgetForNativeView(
+             const_cast<aura::Window*>(aura_window())) != nullptr;
 }
 
 void WmWindowMus::ShowResizeShadow(int component) {
@@ -240,29 +166,6 @@
   child_bounds_in_screen_behavior_ = behavior;
 }
 
-void WmWindowMus::SetSnapsChildrenToPhysicalPixelBoundary() {
-  if (snap_children_to_pixel_boundary_)
-    return;
-
-  snap_children_to_pixel_boundary_ = true;
-  for (auto& observer : observers()) {
-    observer.OnWindowPropertyChanged(
-        this, WmWindowProperty::SNAP_CHILDREN_TO_PIXEL_BOUNDARY);
-  }
-}
-
-void WmWindowMus::SnapToPixelBoundaryIfNecessary() {
-  WmWindowMus* parent = Get(aura_window()->parent());
-  if (parent && parent->snap_children_to_pixel_boundary_) {
-    // TODO: implement snap to pixel: http://crbug.com/615554.
-    NOTIMPLEMENTED();
-  }
-}
-
-void WmWindowMus::SetChildrenUseExtendedHitRegion() {
-  children_use_extended_hit_region_ = true;
-}
-
 void WmWindowMus::AddLimitedPreTargetHandler(ui::EventHandler* handler) {
   DCHECK(WmShellMus::Get()->window_tree_client()->WasCreatedByThisClient(
       aura::WindowMus::Get(aura_window())));
diff --git a/ash/mus/bridge/wm_window_mus.h b/ash/mus/bridge/wm_window_mus.h
index 4b88c5f..3a910d97 100644
--- a/ash/mus/bridge/wm_window_mus.h
+++ b/ash/mus/bridge/wm_window_mus.h
@@ -22,7 +22,6 @@
 namespace mus {
 
 class WmRootWindowControllerMus;
-class WmWindowMusTestApi;
 
 // WmWindow implementation for mus.
 //
@@ -30,22 +29,6 @@
 // as an owned property).
 class WmWindowMus : public WmWindowAura {
  public:
-  // Indicates the source of the widget creation.
-  enum class WidgetCreationType {
-    // The widget was created internally, and not at the request of a client.
-    // For example, overview mode creates a number of widgets. These widgets are
-    // created with a type of INTERNAL.
-    INTERNAL,
-
-    // The widget was created for a client. In other words there is a client
-    // embedded in the aura::Window. For example, when Chrome creates a new
-    // browser window the window manager is asked to create the aura::Window.
-    // The window manager creates an aura::Window and a views::Widget to show
-    // the non-client frame decorations. In this case the creation type is
-    // FOR_CLIENT.
-    FOR_CLIENT,
-  };
-
   explicit WmWindowMus(aura::Window* window);
   // NOTE: this class is owned by the corresponding window. You shouldn't delete
   // TODO(sky): friend deleter and make private.
@@ -60,13 +43,6 @@
 
   static WmWindowMus* Get(views::Widget* widget);
 
-  // Sets the widget associated with the window. The widget is used to query
-  // state, such as min/max size. The widget is not owned by the WmWindowMus.
-  void set_widget(views::Widget* widget, WidgetCreationType type) {
-    widget_ = widget;
-    widget_creation_type_ = type;
-  }
-
   WmRootWindowControllerMus* GetRootWindowControllerMus() {
     return const_cast<WmRootWindowControllerMus*>(
         const_cast<const WmWindowMus*>(this)->GetRootWindowControllerMus());
@@ -80,32 +56,17 @@
     return static_cast<const WmWindowMus*>(window);
   }
 
-  // See description of |children_use_extended_hit_region_|.
-  bool ShouldUseExtendedHitRegion() const;
-
   // Returns true if this window is considered a shell window container.
   bool IsContainer() const;
 
   // WmWindow:
-  const WmWindow* GetRootWindow() const override;
   WmRootWindowController* GetRootWindowController() override;
   WmShell* GetShell() const override;
-  bool IsBubble() override;
-  bool HasNonClientArea() override;
-  int GetNonClientComponent(const gfx::Point& location) override;
-  gfx::Size GetMinimumSize() const override;
-  gfx::Size GetMaximumSize() const override;
-  gfx::Rect GetMinimizeAnimationTargetBoundsInScreen() const override;
-  bool IsSystemModal() const override;
-  bool GetBoolProperty(WmWindowProperty key) override;
   int GetIntProperty(WmWindowProperty key) override;
-  WmWindow* GetToplevelWindow() override;
-  WmWindow* GetToplevelWindowForFocus() override;
   bool MoveToEventRoot(const ui::Event& event) override;
   void SetBoundsInScreen(const gfx::Rect& bounds_in_screen,
                          const display::Display& dst_display) override;
   void SetPinned(bool trusted) override;
-  views::Widget* GetInternalWidget() override;
   void CloseWidget() override;
   bool CanActivate() const override;
   void ShowResizeShadow(int component) override;
@@ -114,30 +75,9 @@
       ImmersiveFullscreenController* immersive_fullscreen_controller) override;
   void SetBoundsInScreenBehaviorForChildren(
       BoundsInScreenBehavior behavior) override;
-  void SetSnapsChildrenToPhysicalPixelBoundary() override;
-  void SnapToPixelBoundaryIfNecessary() override;
-  void SetChildrenUseExtendedHitRegion() override;
   void AddLimitedPreTargetHandler(ui::EventHandler* handler) override;
 
  private:
-  friend class WmWindowMusTestApi;
-
-  views::Widget* widget_ = nullptr;
-
-  WidgetCreationType widget_creation_type_ = WidgetCreationType::INTERNAL;
-
-  bool snap_children_to_pixel_boundary_ = false;
-
-  // If true child windows should get a slightly larger hit region to make
-  // resizing easier.
-  bool children_use_extended_hit_region_ = false;
-
-  // Default value for |use_empty_minimum_size_for_testing_|.
-  static bool default_use_empty_minimum_size_for_testing_;
-
-  // If true the minimum size is 0x0, default is minimum size comes from widget.
-  bool use_empty_minimum_size_for_testing_ = false;
-
   BoundsInScreenBehavior child_bounds_in_screen_behavior_ =
       BoundsInScreenBehavior::USE_LOCAL_COORDINATES;
 
diff --git a/ash/mus/bridge/wm_window_mus_test_api.cc b/ash/mus/bridge/wm_window_mus_test_api.cc
deleted file mode 100644
index d6396b7a..0000000
--- a/ash/mus/bridge/wm_window_mus_test_api.cc
+++ /dev/null
@@ -1,32 +0,0 @@
-// Copyright 2016 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "ash/mus/bridge/wm_window_mus_test_api.h"
-
-namespace ash {
-namespace mus {
-
-// static
-int WmWindowMusTestApi::GlobalMinimumSizeLock::instance_count_ = 0;
-
-WmWindowMusTestApi::GlobalMinimumSizeLock::GlobalMinimumSizeLock() {
-  if (instance_count_ == 0)
-    WmWindowMusTestApi::SetDefaultUseEmptyMinimumSizeForTesting(true);
-  instance_count_++;
-}
-
-WmWindowMusTestApi::GlobalMinimumSizeLock::~GlobalMinimumSizeLock() {
-  DCHECK_GT(instance_count_, 0);
-  instance_count_--;
-  if (instance_count_ == 0)
-    WmWindowMusTestApi::SetDefaultUseEmptyMinimumSizeForTesting(false);
-}
-
-// static
-void WmWindowMusTestApi::SetDefaultUseEmptyMinimumSizeForTesting(bool value) {
-  WmWindowMus::default_use_empty_minimum_size_for_testing_ = value;
-}
-
-}  // namespace mus
-}  // namespace ash
diff --git a/ash/mus/non_client_frame_controller.cc b/ash/mus/non_client_frame_controller.cc
index af31cec6..58cdbf8 100644
--- a/ash/mus/non_client_frame_controller.cc
+++ b/ash/mus/non_client_frame_controller.cc
@@ -23,6 +23,7 @@
 #include "ash/mus/window_manager.h"
 #include "ash/mus/window_properties.h"
 #include "ash/shared/immersive_fullscreen_controller_delegate.h"
+#include "ash/wm/window_properties.h"
 #include "base/macros.h"
 #include "base/memory/ptr_util.h"
 #include "base/strings/utf_string_conversions.h"
@@ -307,8 +308,7 @@
       widget_, window_manager_client_, ShouldRemoveStandardFrame(*properties),
       ShouldEnableImmersive(*properties));
   window_ = native_widget->GetNativeView();
-  WmWindowMus* wm_window = WmWindowMus::Get(window_);
-  wm_window->set_widget(widget_, WmWindowMus::WidgetCreationType::FOR_CLIENT);
+  window_->SetProperty(kWidgetCreationTypeKey, WidgetCreationType::FOR_CLIENT);
   window_->AddObserver(this);
   params.native_widget = native_widget;
   aura::SetWindowType(window_, window_type);
@@ -329,6 +329,7 @@
 
   const int shadow_inset =
       Shadow::GetInteriorInsetForStyle(Shadow::STYLE_ACTIVE);
+  WmWindowMus* wm_window = WmWindowMus::Get(window_);
   const gfx::Insets extended_hit_region =
       wm_window->ShouldUseExtendedHitRegion() ? GetExtendedHitRegion()
                                               : gfx::Insets();
diff --git a/ash/mus/test/wm_test_base.cc b/ash/mus/test/wm_test_base.cc
index e247c88..7179552 100644
--- a/ash/mus/test/wm_test_base.cc
+++ b/ash/mus/test/wm_test_base.cc
@@ -7,11 +7,11 @@
 #include <algorithm>
 #include <vector>
 
-#include "ash/mus/bridge/wm_window_mus_test_api.h"
 #include "ash/mus/root_window_controller.h"
 #include "ash/mus/test/wm_test_helper.h"
 #include "ash/mus/window_manager.h"
 #include "ash/mus/window_manager_application.h"
+#include "ash/test/wm_window_aura_test_api.h"
 #include "base/memory/ptr_util.h"
 #include "services/ui/public/cpp/property_type_converters.h"
 #include "ui/aura/mus/property_converter.h"
@@ -162,7 +162,7 @@
       ui::ScopedAnimationDurationScaleMode::ZERO_DURATION);
   // Most tests expect a minimum size of 0x0.
   minimum_size_lock_ =
-      base::MakeUnique<WmWindowMusTestApi::GlobalMinimumSizeLock>();
+      base::MakeUnique<WmWindowAuraTestApi::GlobalMinimumSizeLock>();
   test_helper_.reset(new WmTestHelper);
   test_helper_->Init();
 }
diff --git a/ash/mus/test/wm_test_base.h b/ash/mus/test/wm_test_base.h
index 7f750502..24e2c620 100644
--- a/ash/mus/test/wm_test_base.h
+++ b/ash/mus/test/wm_test_base.h
@@ -8,7 +8,7 @@
 #include <memory>
 #include <string>
 
-#include "ash/mus/bridge/wm_window_mus_test_api.h"
+#include "ash/test/wm_window_aura_test_api.h"
 #include "base/macros.h"
 #include "testing/gtest/include/gtest/gtest.h"
 #include "ui/display/display.h"
@@ -85,7 +85,8 @@
   bool setup_called_ = false;
   bool teardown_called_ = false;
   std::unique_ptr<ui::ScopedAnimationDurationScaleMode> zero_duration_mode_;
-  std::unique_ptr<WmWindowMusTestApi::GlobalMinimumSizeLock> minimum_size_lock_;
+  std::unique_ptr<WmWindowAuraTestApi::GlobalMinimumSizeLock>
+      minimum_size_lock_;
   std::unique_ptr<WmTestHelper> test_helper_;
 
   DISALLOW_COPY_AND_ASSIGN(WmTestBase);
diff --git a/ash/test/BUILD.gn b/ash/test/BUILD.gn
index a7baad0..1d81b709 100644
--- a/ash/test/BUILD.gn
+++ b/ash/test/BUILD.gn
@@ -134,6 +134,8 @@
     "ui_controls_factory_ash.h",
     "user_metrics_recorder_test_api.cc",
     "user_metrics_recorder_test_api.h",
+    "wm_window_aura_test_api.cc",
+    "wm_window_aura_test_api.h",
   ]
   configs += [ "//build/config:precompiled_headers" ]
 
diff --git a/ash/test/wm_window_aura_test_api.cc b/ash/test/wm_window_aura_test_api.cc
new file mode 100644
index 0000000..835f1b16
--- /dev/null
+++ b/ash/test/wm_window_aura_test_api.cc
@@ -0,0 +1,30 @@
+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "ash/test/wm_window_aura_test_api.h"
+
+namespace ash {
+
+// static
+int WmWindowAuraTestApi::GlobalMinimumSizeLock::instance_count_ = 0;
+
+WmWindowAuraTestApi::GlobalMinimumSizeLock::GlobalMinimumSizeLock() {
+  if (instance_count_ == 0)
+    WmWindowAuraTestApi::SetDefaultUseEmptyMinimumSizeForTesting(true);
+  instance_count_++;
+}
+
+WmWindowAuraTestApi::GlobalMinimumSizeLock::~GlobalMinimumSizeLock() {
+  DCHECK_GT(instance_count_, 0);
+  instance_count_--;
+  if (instance_count_ == 0)
+    WmWindowAuraTestApi::SetDefaultUseEmptyMinimumSizeForTesting(false);
+}
+
+// static
+void WmWindowAuraTestApi::SetDefaultUseEmptyMinimumSizeForTesting(bool value) {
+  WmWindowAura::default_use_empty_minimum_size_for_testing_ = value;
+}
+
+}  // namespace ash
diff --git a/ash/mus/bridge/wm_window_mus_test_api.h b/ash/test/wm_window_aura_test_api.h
similarity index 63%
rename from ash/mus/bridge/wm_window_mus_test_api.h
rename to ash/test/wm_window_aura_test_api.h
index b346d84c..aeacd8b 100644
--- a/ash/mus/bridge/wm_window_mus_test_api.h
+++ b/ash/test/wm_window_aura_test_api.h
@@ -2,15 +2,14 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef ASH_MUS_BRIDGE_WM_WINDOW_MUS_TEST_API_H_
-#define ASH_MUS_BRIDGE_WM_WINDOW_MUS_TEST_API_H_
+#ifndef ASH_TEST_WM_WINDOW_AURA_TEST_API_H_
+#define ASH_TEST_WM_WINDOW_AURA_TEST_API_H_
 
-#include "ash/mus/bridge/wm_window_mus.h"
+#include "ash/aura/wm_window_aura.h"
 
 namespace ash {
-namespace mus {
 
-class WmWindowMusTestApi {
+class WmWindowAuraTestApi {
  public:
   // Used by tests to set the default value of
   // |WmWindowMus::default_use_empty_minimum_size_for_testing_|. This is needed
@@ -28,10 +27,10 @@
     DISALLOW_COPY_AND_ASSIGN(GlobalMinimumSizeLock);
   };
 
-  explicit WmWindowMusTestApi(WmWindow* window)
-      : WmWindowMusTestApi(WmWindowMus::AsWmWindowMus(window)) {}
-  explicit WmWindowMusTestApi(WmWindowMus* window) : window_(window) {}
-  ~WmWindowMusTestApi() {}
+  explicit WmWindowAuraTestApi(WmWindow* window)
+      : WmWindowAuraTestApi(static_cast<WmWindowAura*>(window)) {}
+  explicit WmWindowAuraTestApi(WmWindowAura* window) : window_(window) {}
+  ~WmWindowAuraTestApi() {}
 
   void set_use_empty_minimum_size(bool value) {
     window_->use_empty_minimum_size_for_testing_ = true;
@@ -40,12 +39,11 @@
  private:
   static void SetDefaultUseEmptyMinimumSizeForTesting(bool value);
 
-  WmWindowMus* window_;
+  WmWindowAura* window_;
 
-  DISALLOW_COPY_AND_ASSIGN(WmWindowMusTestApi);
+  DISALLOW_COPY_AND_ASSIGN(WmWindowAuraTestApi);
 };
 
-}  // namespace mus
 }  // namespace ash
 
-#endif  // ASH_MUS_BRIDGE_WM_WINDOW_MUS_TEST_API_H_
+#endif  // ASH_TEST_WM_WINDOW_AURA_TEST_API_H_
diff --git a/ash/wm/window_properties.cc b/ash/wm/window_properties.cc
index acc7202..e4d4c3e 100644
--- a/ash/wm/window_properties.cc
+++ b/ash/wm/window_properties.cc
@@ -8,6 +8,7 @@
 #include "ui/aura/window_property.h"
 
 DECLARE_WINDOW_PROPERTY_TYPE(ash::wm::WindowState*);
+DECLARE_EXPORTED_WINDOW_PROPERTY_TYPE(ASH_EXPORT, ash::WidgetCreationType);
 
 namespace ash {
 
@@ -29,6 +30,10 @@
 
 DEFINE_WINDOW_PROPERTY_KEY(bool, kUsesScreenCoordinatesKey, false);
 
+DEFINE_WINDOW_PROPERTY_KEY(WidgetCreationType,
+                           kWidgetCreationTypeKey,
+                           WidgetCreationType::INTERNAL);
+
 DEFINE_OWNED_WINDOW_PROPERTY_KEY(wm::WindowState, kWindowStateKey, NULL);
 
 }  // namespace ash
diff --git a/ash/wm/window_properties.h b/ash/wm/window_properties.h
index 3ec15c05..e4cf4dbf 100644
--- a/ash/wm/window_properties.h
+++ b/ash/wm/window_properties.h
@@ -22,6 +22,22 @@
 class WindowState;
 }  // namespace wm
 
+// Used with kWidgetCreationType to indicate source of the widget creation.
+enum class WidgetCreationType {
+  // The widget was created internally, and not at the request of a client.
+  // For example, overview mode creates a number of widgets. These widgets are
+  // created with a type of INTERNAL. This is the default.
+  INTERNAL,
+
+  // The widget was created for a client. In other words there is a client
+  // embedded in the aura::Window. For example, when Chrome creates a new
+  // browser window the window manager is asked to create the aura::Window.
+  // The window manager creates an aura::Window and a views::Widget to show
+  // the non-client frame decorations. In this case the creation type is
+  // FOR_CLIENT.
+  FOR_CLIENT,
+};
+
 // Shell-specific window property keys; some keys are exported for use in tests.
 
 // Alphabetical sort.
@@ -58,6 +74,9 @@
 // Property to tell if the container uses the screen coordinates.
 extern const aura::WindowProperty<bool>* const kUsesScreenCoordinatesKey;
 
+ASH_EXPORT extern const aura::WindowProperty<WidgetCreationType>* const
+    kWidgetCreationTypeKey;
+
 // A property key to store WindowState in the window. The window state
 // is owned by the window.
 extern const aura::WindowProperty<wm::WindowState*>* const kWindowStateKey;
diff --git a/base/BUILD.gn b/base/BUILD.gn
index 81023b8..d5ec807 100644
--- a/base/BUILD.gn
+++ b/base/BUILD.gn
@@ -267,7 +267,6 @@
     "containers/hash_tables.h",
     "containers/linked_list.h",
     "containers/mru_cache.h",
-    "containers/scoped_ptr_hash_map.h",
     "containers/small_map.h",
     "containers/stack_container.h",
     "cpu.cc",
@@ -1845,7 +1844,6 @@
     "containers/hash_tables_unittest.cc",
     "containers/linked_list_unittest.cc",
     "containers/mru_cache_unittest.cc",
-    "containers/scoped_ptr_hash_map_unittest.cc",
     "containers/small_map_unittest.cc",
     "containers/stack_container_unittest.cc",
     "cpu_unittest.cc",
diff --git a/base/android/java/src/org/chromium/base/library_loader/LibraryLoader.java b/base/android/java/src/org/chromium/base/library_loader/LibraryLoader.java
index 79dc8d6..f833abba 100644
--- a/base/android/java/src/org/chromium/base/library_loader/LibraryLoader.java
+++ b/base/android/java/src/org/chromium/base/library_loader/LibraryLoader.java
@@ -324,15 +324,6 @@
         } catch (UnsatisfiedLinkError e) {
             throw new ProcessInitException(LoaderErrors.LOADER_ERROR_NATIVE_LIBRARY_LOAD_FAILED, e);
         }
-        // Check that the version of the library we have loaded matches the version we expect
-        Log.i(TAG, String.format(
-                "Expected native library version number \"%s\", "
-                        + "actual native library version number \"%s\"",
-                NativeLibraries.sVersionNumber,
-                nativeGetVersionNumber()));
-        if (!NativeLibraries.sVersionNumber.equals(nativeGetVersionNumber())) {
-            throw new ProcessInitException(LoaderErrors.LOADER_ERROR_NATIVE_LIBRARY_WRONG_VERSION);
-        }
     }
 
     // The WebView requires the Command Line to be switched over before
@@ -374,6 +365,14 @@
             throw new ProcessInitException(LoaderErrors.LOADER_ERROR_FAILED_TO_REGISTER_JNI);
         }
 
+        // Check that the version of the library we have loaded matches the version we expect
+        Log.i(TAG, String.format("Expected native library version number \"%s\", "
+                                   + "actual native library version number \"%s\"",
+                           NativeLibraries.sVersionNumber, nativeGetVersionNumber()));
+        if (!NativeLibraries.sVersionNumber.equals(nativeGetVersionNumber())) {
+            throw new ProcessInitException(LoaderErrors.LOADER_ERROR_NATIVE_LIBRARY_WRONG_VERSION);
+        }
+
         // From now on, keep tracing in sync with native.
         TraceEvent.registerNativeEnabledObserver();
 
diff --git a/base/android/library_loader/library_loader_hooks.cc b/base/android/library_loader/library_loader_hooks.cc
index 473883c5..621575c3 100644
--- a/base/android/library_loader/library_loader_hooks.cc
+++ b/base/android/library_loader/library_loader_hooks.cc
@@ -21,6 +21,7 @@
 base::AtExitManager* g_at_exit_manager = NULL;
 const char* g_library_version_number = "";
 LibraryLoadedHook* g_registration_callback = NULL;
+NativeInitializationHook* g_native_initialization_hook = NULL;
 
 enum RendererHistogramCode {
   // Renderer load at fixed address success, fail, or not attempted.
@@ -149,6 +150,11 @@
   g_library_preloader_renderer_histogram_code_registered = true;
 }
 
+void SetNativeInitializationHook(
+    NativeInitializationHook native_initialization_hook) {
+  g_native_initialization_hook = native_initialization_hook;
+}
+
 void RecordLibraryLoaderRendererHistograms() {
   RecordChromiumAndroidLinkerRendererHistogram();
   RecordLibraryPreloaderRendereHistogram();
@@ -167,6 +173,9 @@
 
 static jboolean LibraryLoaded(JNIEnv* env,
                               const JavaParamRef<jobject>& jcaller) {
+  if (g_native_initialization_hook && !g_native_initialization_hook()) {
+    return false;
+  }
   if (g_registration_callback == NULL) {
     return true;
   }
diff --git a/base/android/library_loader/library_loader_hooks.h b/base/android/library_loader/library_loader_hooks.h
index 3e8969bc..5c37e6e8 100644
--- a/base/android/library_loader/library_loader_hooks.h
+++ b/base/android/library_loader/library_loader_hooks.h
@@ -8,6 +8,7 @@
 #include <jni.h>
 
 #include "base/base_export.h"
+#include "base/callback.h"
 
 namespace base {
 namespace android {
@@ -27,6 +28,11 @@
   PROCESS_WEBVIEW_CHILD = 4,
 };
 
+typedef bool NativeInitializationHook();
+
+BASE_EXPORT void SetNativeInitializationHook(
+    NativeInitializationHook native_initialization_hook);
+
 // Record any pending renderer histogram value as histograms.  Pending values
 // are set by RegisterChromiumAndroidLinkerRendererHistogram and
 // RegisterLibraryPreloaderRendererHistogram.
diff --git a/base/containers/scoped_ptr_hash_map.h b/base/containers/scoped_ptr_hash_map.h
deleted file mode 100644
index 72c6ff4..0000000
--- a/base/containers/scoped_ptr_hash_map.h
+++ /dev/null
@@ -1,175 +0,0 @@
-// Copyright 2013 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef BASE_CONTAINERS_SCOPED_PTR_HASH_MAP_H_
-#define BASE_CONTAINERS_SCOPED_PTR_HASH_MAP_H_
-
-#include <stddef.h>
-
-#include <algorithm>
-#include <memory>
-#include <utility>
-
-#include "base/containers/hash_tables.h"
-#include "base/logging.h"
-#include "base/macros.h"
-
-namespace base {
-
-// Deprecated. Use std::unordered_map instead. https://crbug.com/579229
-//
-// This type acts like a hash_map<K, std::unique_ptr<V, D> >, based on top of
-// base::hash_map. The ScopedPtrHashMap has ownership of all values in the data
-// structure.
-template <typename Key, typename ScopedPtr>
-class ScopedPtrHashMap {
-  typedef base::hash_map<Key, typename ScopedPtr::element_type*> Container;
-
- public:
-  typedef typename Container::key_type key_type;
-  typedef typename Container::mapped_type mapped_type;
-  typedef typename Container::value_type value_type;
-  typedef typename Container::iterator iterator;
-  typedef typename Container::const_iterator const_iterator;
-
-  ScopedPtrHashMap() {}
-
-  ~ScopedPtrHashMap() { clear(); }
-
-  void swap(ScopedPtrHashMap<Key, ScopedPtr>& other) {
-    data_.swap(other.data_);
-  }
-
-  // Replaces value but not key if key is already present.
-  iterator set(const Key& key, ScopedPtr data) {
-    iterator it = find(key);
-    if (it != end()) {
-      // Let ScopedPtr decide how to delete. For example, it may use custom
-      // deleter.
-      ScopedPtr(it->second).reset();
-      it->second = data.release();
-      return it;
-    }
-
-    return data_.insert(std::make_pair(key, data.release())).first;
-  }
-
-  // Does nothing if key is already present
-  std::pair<iterator, bool> add(const Key& key, ScopedPtr data) {
-    std::pair<iterator, bool> result =
-        data_.insert(std::make_pair(key, data.get()));
-    if (result.second)
-      ::ignore_result(data.release());
-    return result;
-  }
-
-  void erase(iterator it) {
-    // Let ScopedPtr decide how to delete.
-    ScopedPtr(it->second).reset();
-    data_.erase(it);
-  }
-
-  size_t erase(const Key& k) {
-    iterator it = data_.find(k);
-    if (it == data_.end())
-      return 0;
-    erase(it);
-    return 1;
-  }
-
-  ScopedPtr take(iterator it) {
-    DCHECK(it != data_.end());
-    if (it == data_.end())
-      return ScopedPtr();
-
-    ScopedPtr ret(it->second);
-    it->second = NULL;
-    return ret;
-  }
-
-  ScopedPtr take(const Key& k) {
-    iterator it = find(k);
-    if (it == data_.end())
-      return ScopedPtr();
-
-    return take(it);
-  }
-
-  ScopedPtr take_and_erase(iterator it) {
-    DCHECK(it != data_.end());
-    if (it == data_.end())
-      return ScopedPtr();
-
-    ScopedPtr ret(it->second);
-    data_.erase(it);
-    return ret;
-  }
-
-  ScopedPtr take_and_erase(const Key& k) {
-    iterator it = find(k);
-    if (it == data_.end())
-      return ScopedPtr();
-
-    return take_and_erase(it);
-  }
-
-  // Returns the element in the hash_map that matches the given key.
-  // If no such element exists it returns NULL.
-  typename ScopedPtr::element_type* get(const Key& k) const {
-    const_iterator it = find(k);
-    if (it == end())
-      return NULL;
-    return it->second;
-  }
-
-  inline bool contains(const Key& k) const { return data_.count(k) > 0; }
-
-  inline void clear() {
-    auto it = data_.begin();
-    while (it != data_.end()) {
-      // NOTE: Deleting behind the iterator. Deleting the value does not always
-      // invalidate the iterator, but it may do so if the key is a pointer into
-      // the value object.
-      auto temp = it;
-      ++it;
-      // Let ScopedPtr decide how to delete.
-      ScopedPtr(temp->second).reset();
-    }
-    data_.clear();
-  }
-
-  inline const_iterator find(const Key& k) const { return data_.find(k); }
-  inline iterator find(const Key& k) { return data_.find(k); }
-
-  inline size_t count(const Key& k) const { return data_.count(k); }
-  inline std::pair<const_iterator, const_iterator> equal_range(
-      const Key& k) const {
-    return data_.equal_range(k);
-  }
-  inline std::pair<iterator, iterator> equal_range(const Key& k) {
-    return data_.equal_range(k);
-  }
-
-  inline size_t size() const { return data_.size(); }
-  inline size_t max_size() const { return data_.max_size(); }
-
-  inline bool empty() const { return data_.empty(); }
-
-  inline size_t bucket_count() const { return data_.bucket_count(); }
-  inline void resize(size_t size) { return data_.resize(size); }
-
-  inline iterator begin() { return data_.begin(); }
-  inline const_iterator begin() const { return data_.begin(); }
-  inline iterator end() { return data_.end(); }
-  inline const_iterator end() const { return data_.end(); }
-
- private:
-  Container data_;
-
-  DISALLOW_COPY_AND_ASSIGN(ScopedPtrHashMap);
-};
-
-}  // namespace base
-
-#endif  // BASE_CONTAINERS_SCOPED_PTR_HASH_MAP_H_
diff --git a/base/containers/scoped_ptr_hash_map_unittest.cc b/base/containers/scoped_ptr_hash_map_unittest.cc
deleted file mode 100644
index eddabaf..0000000
--- a/base/containers/scoped_ptr_hash_map_unittest.cc
+++ /dev/null
@@ -1,108 +0,0 @@
-// Copyright 2015 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "base/containers/scoped_ptr_hash_map.h"
-
-#include <memory>
-
-#include "base/memory/ptr_util.h"
-#include "testing/gtest/include/gtest/gtest.h"
-
-namespace base {
-namespace {
-
-namespace namespace_with_ignore_result {
-
-class Value {};
-
-template <typename T>
-void ignore_result(const T&) {}
-
-}  // namespace namespace_with_ignore_result
-
-struct DeleteCounter {
- public:
-  DeleteCounter() {}
-  ~DeleteCounter() { g_delete_count++; }
-
-  static void ResetCounter() { g_delete_count = 0; }
-  static int delete_count() { return g_delete_count; }
-
- private:
-  static int g_delete_count;
-};
-
-int DeleteCounter::g_delete_count = 0;
-
-struct CountingDeleter {
- public:
-  inline void operator()(DeleteCounter* ptr) const {
-    g_deleter_call_count++;
-    delete ptr;
-  }
-
-  static int count() { return g_deleter_call_count; }
-  static void ResetCounter() { g_deleter_call_count = 0; }
-
- private:
-  static int g_deleter_call_count;
-};
-
-int CountingDeleter::g_deleter_call_count = 0;
-
-TEST(ScopedPtrHashMapTest, CustomDeleter) {
-  int key = 123;
-
-  // Test dtor.
-  DeleteCounter::ResetCounter();
-  CountingDeleter::ResetCounter();
-  {
-    ScopedPtrHashMap<int, std::unique_ptr<DeleteCounter, CountingDeleter>> map;
-    map.set(key,
-            std::unique_ptr<DeleteCounter, CountingDeleter>(new DeleteCounter));
-  }
-  EXPECT_EQ(1, DeleteCounter::delete_count());
-  EXPECT_EQ(1, CountingDeleter::count());
-
-  // Test set and erase.
-  DeleteCounter::ResetCounter();
-  CountingDeleter::ResetCounter();
-  {
-    ScopedPtrHashMap<int, std::unique_ptr<DeleteCounter, CountingDeleter>> map;
-    map.erase(map.set(key, std::unique_ptr<DeleteCounter, CountingDeleter>(
-                               new DeleteCounter)));
-    EXPECT_EQ(1, DeleteCounter::delete_count());
-    EXPECT_EQ(1, CountingDeleter::count());
-  }
-  EXPECT_EQ(1, DeleteCounter::delete_count());
-  EXPECT_EQ(1, CountingDeleter::count());
-
-  // Test set more than once.
-  DeleteCounter::ResetCounter();
-  CountingDeleter::ResetCounter();
-  {
-    ScopedPtrHashMap<int, std::unique_ptr<DeleteCounter, CountingDeleter>> map;
-    map.set(key,
-            std::unique_ptr<DeleteCounter, CountingDeleter>(new DeleteCounter));
-    map.set(key,
-            std::unique_ptr<DeleteCounter, CountingDeleter>(new DeleteCounter));
-    map.set(key,
-            std::unique_ptr<DeleteCounter, CountingDeleter>(new DeleteCounter));
-    EXPECT_EQ(2, DeleteCounter::delete_count());
-    EXPECT_EQ(2, CountingDeleter::count());
-  }
-  EXPECT_EQ(3, DeleteCounter::delete_count());
-  EXPECT_EQ(3, CountingDeleter::count());
-}
-
-// Test that using a value type from a namespace containing an ignore_result
-// function compiles correctly.
-TEST(ScopedPtrHashMapTest, IgnoreResultCompile) {
-  ScopedPtrHashMap<int, std::unique_ptr<namespace_with_ignore_result::Value>>
-      scoped_map;
-  scoped_map.add(1, WrapUnique(new namespace_with_ignore_result::Value));
-}
-
-}  // namespace
-}  // namespace base
diff --git a/base/task_scheduler/scheduler_worker.h b/base/task_scheduler/scheduler_worker.h
index a9b891ad..1b81b03 100644
--- a/base/task_scheduler/scheduler_worker.h
+++ b/base/task_scheduler/scheduler_worker.h
@@ -57,7 +57,7 @@
     // |task_latency| is the time elapsed between when the task was posted and
     // when it started to run.
     virtual void DidRunTaskWithPriority(TaskPriority task_priority,
-                                        const TimeDelta& task_latency) = 0;
+                                        TimeDelta task_latency) = 0;
 
     // Called when |sequence| isn't empty after the SchedulerWorker pops a Task
     // from it. |sequence| is the last Sequence returned by GetWork().
diff --git a/base/task_scheduler/scheduler_worker_pool_impl.cc b/base/task_scheduler/scheduler_worker_pool_impl.cc
index 9334c13..28f473e 100644
--- a/base/task_scheduler/scheduler_worker_pool_impl.cc
+++ b/base/task_scheduler/scheduler_worker_pool_impl.cc
@@ -25,7 +25,6 @@
 #include "base/threading/platform_thread.h"
 #include "base/threading/thread_local.h"
 #include "base/threading/thread_restrictions.h"
-#include "base/time/time.h"
 
 namespace base {
 namespace internal {
@@ -240,7 +239,7 @@
   void OnMainEntry(SchedulerWorker* worker) override;
   scoped_refptr<Sequence> GetWork(SchedulerWorker* worker) override;
   void DidRunTaskWithPriority(TaskPriority task_priority,
-                              const TimeDelta& task_latency) override;
+                              TimeDelta task_latency) override;
   void ReEnqueueSequence(scoped_refptr<Sequence> sequence) override;
   TimeDelta GetSleepTimeout() override;
   bool CanDetach(SchedulerWorker* worker) override;
@@ -601,8 +600,7 @@
 }
 
 void SchedulerWorkerPoolImpl::SchedulerWorkerDelegateImpl::
-    DidRunTaskWithPriority(TaskPriority task_priority,
-                           const TimeDelta& task_latency) {
+    DidRunTaskWithPriority(TaskPriority task_priority, TimeDelta task_latency) {
   ++num_tasks_since_last_wait_;
   ++num_tasks_since_last_detach_;
 
@@ -670,7 +668,7 @@
 
 SchedulerWorkerPoolImpl::SchedulerWorkerPoolImpl(
     StringPiece name,
-    const TimeDelta& suggested_reclaim_time,
+    TimeDelta suggested_reclaim_time,
     TaskTracker* task_tracker,
     DelayedTaskManager* delayed_task_manager)
     : name_(name.as_string()),
diff --git a/base/task_scheduler/scheduler_worker_pool_impl.h b/base/task_scheduler/scheduler_worker_pool_impl.h
index b2dc68a4..3485995 100644
--- a/base/task_scheduler/scheduler_worker_pool_impl.h
+++ b/base/task_scheduler/scheduler_worker_pool_impl.h
@@ -30,11 +30,11 @@
 #include "base/task_scheduler/task.h"
 #include "base/task_scheduler/task_traits.h"
 #include "base/threading/platform_thread.h"
+#include "base/time/time.h"
 
 namespace base {
 
 class HistogramBase;
-class TimeDelta;
 
 namespace internal {
 
@@ -115,7 +115,7 @@
   class SchedulerWorkerDelegateImpl;
 
   SchedulerWorkerPoolImpl(StringPiece name,
-                          const TimeDelta& suggested_reclaim_time,
+                          TimeDelta suggested_reclaim_time,
                           TaskTracker* task_tracker,
                           DelayedTaskManager* delayed_task_manager);
 
diff --git a/base/task_scheduler/scheduler_worker_pool_impl_unittest.cc b/base/task_scheduler/scheduler_worker_pool_impl_unittest.cc
index b44135c..dfaa9c7f 100644
--- a/base/task_scheduler/scheduler_worker_pool_impl_unittest.cc
+++ b/base/task_scheduler/scheduler_worker_pool_impl_unittest.cc
@@ -76,7 +76,7 @@
     worker_pool_->JoinForTesting();
   }
 
-  void InitializeWorkerPool(const TimeDelta& suggested_reclaim_time,
+  void InitializeWorkerPool(TimeDelta suggested_reclaim_time,
                             size_t num_workers) {
     ASSERT_FALSE(worker_pool_);
     ASSERT_FALSE(delayed_task_manager_);
diff --git a/base/task_scheduler/scheduler_worker_pool_params.cc b/base/task_scheduler/scheduler_worker_pool_params.cc
index d08ebf6f..c4def6d 100644
--- a/base/task_scheduler/scheduler_worker_pool_params.cc
+++ b/base/task_scheduler/scheduler_worker_pool_params.cc
@@ -4,8 +4,6 @@
 
 #include "base/task_scheduler/scheduler_worker_pool_params.h"
 
-#include "base/time/time.h"
-
 namespace base {
 
 SchedulerWorkerPoolParams::SchedulerWorkerPoolParams(
@@ -13,7 +11,7 @@
     ThreadPriority priority_hint,
     StandbyThreadPolicy standby_thread_policy,
     int max_threads,
-    const TimeDelta& suggested_reclaim_time)
+    TimeDelta suggested_reclaim_time)
     : name_(name),
       priority_hint_(priority_hint),
       standby_thread_policy_(standby_thread_policy),
diff --git a/base/task_scheduler/scheduler_worker_pool_params.h b/base/task_scheduler/scheduler_worker_pool_params.h
index f3cd20f..1e5a6a316 100644
--- a/base/task_scheduler/scheduler_worker_pool_params.h
+++ b/base/task_scheduler/scheduler_worker_pool_params.h
@@ -9,11 +9,10 @@
 
 #include "base/macros.h"
 #include "base/threading/platform_thread.h"
+#include "base/time/time.h"
 
 namespace base {
 
-class TimeDelta;
-
 class BASE_EXPORT SchedulerWorkerPoolParams final {
  public:
   enum class StandbyThreadPolicy {
@@ -36,7 +35,7 @@
                             ThreadPriority priority_hint,
                             StandbyThreadPolicy standby_thread_policy,
                             int max_threads,
-                            const TimeDelta& suggested_reclaim_time);
+                            TimeDelta suggested_reclaim_time);
   SchedulerWorkerPoolParams(SchedulerWorkerPoolParams&& other);
   SchedulerWorkerPoolParams& operator=(SchedulerWorkerPoolParams&& other);
 
@@ -46,9 +45,7 @@
     return standby_thread_policy_;
   }
   size_t max_threads() const { return max_threads_; }
-  const TimeDelta& suggested_reclaim_time() const {
-    return suggested_reclaim_time_;
-  }
+  TimeDelta suggested_reclaim_time() const { return suggested_reclaim_time_; }
 
  private:
   std::string name_;
diff --git a/base/task_scheduler/scheduler_worker_stack_unittest.cc b/base/task_scheduler/scheduler_worker_stack_unittest.cc
index 5359dcd..ec49420 100644
--- a/base/task_scheduler/scheduler_worker_stack_unittest.cc
+++ b/base/task_scheduler/scheduler_worker_stack_unittest.cc
@@ -27,7 +27,7 @@
     return nullptr;
   }
   void DidRunTaskWithPriority(TaskPriority task_priority,
-                              const TimeDelta& task_latency) override {
+                              TimeDelta task_latency) override {
     ADD_FAILURE() << "Unexpected call to DidRunTaskWithPriority()";
   }
   void ReEnqueueSequence(scoped_refptr<Sequence> sequence) override {
diff --git a/base/task_scheduler/scheduler_worker_unittest.cc b/base/task_scheduler/scheduler_worker_unittest.cc
index 2284758..8e82edfb 100644
--- a/base/task_scheduler/scheduler_worker_unittest.cc
+++ b/base/task_scheduler/scheduler_worker_unittest.cc
@@ -46,7 +46,7 @@
     return nullptr;
   }
   void DidRunTaskWithPriority(TaskPriority task_priority,
-                              const TimeDelta& task_latency) override {
+                              TimeDelta task_latency) override {
     ADD_FAILURE() << "Unexpected call to DidRunTaskWithPriority()";
   }
   void ReEnqueueSequence(scoped_refptr<Sequence> sequence) override {
@@ -186,7 +186,7 @@
     }
 
     void DidRunTaskWithPriority(TaskPriority task_priority,
-                                const TimeDelta& task_latency) override {
+                                TimeDelta task_latency) override {
       AutoSchedulerLock auto_lock(expect_did_run_task_with_priority_lock_);
       EXPECT_TRUE(expect_did_run_task_with_priority_);
       EXPECT_EQ(expected_task_priority_, task_priority);
@@ -391,7 +391,7 @@
   }
 
   void DidRunTaskWithPriority(TaskPriority task,
-                              const TimeDelta& task_latency) override {}
+                              TimeDelta task_latency) override {}
 
   bool CanDetach(SchedulerWorker* worker) override {
     detach_requested_.Signal();
diff --git a/base/task_scheduler/task.cc b/base/task_scheduler/task.cc
index 7314099..3780c16 100644
--- a/base/task_scheduler/task.cc
+++ b/base/task_scheduler/task.cc
@@ -10,7 +10,7 @@
 Task::Task(const tracked_objects::Location& posted_from,
            const Closure& task,
            const TaskTraits& traits,
-           const TimeDelta& delay)
+           TimeDelta delay)
     : PendingTask(posted_from,
                   task,
                   delay.is_zero() ? TimeTicks() : TimeTicks::Now() + delay,
diff --git a/base/task_scheduler/task.h b/base/task_scheduler/task.h
index c014671..c5b9bdb 100644
--- a/base/task_scheduler/task.h
+++ b/base/task_scheduler/task.h
@@ -30,7 +30,7 @@
   Task(const tracked_objects::Location& posted_from,
        const Closure& task,
        const TaskTraits& traits,
-       const TimeDelta& delay);
+       TimeDelta delay);
   ~Task();
 
   // The TaskTraits of this task.
diff --git a/chrome/android/java/src/org/chromium/chrome/browser/ntp/snippets/SnippetsBridge.java b/chrome/android/java/src/org/chromium/chrome/browser/ntp/snippets/SnippetsBridge.java
index 4625b13..cf3612c 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/ntp/snippets/SnippetsBridge.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/ntp/snippets/SnippetsBridge.java
@@ -189,22 +189,16 @@
      * An observer needs to be set before the native code attempts to transmit snippets them to
      * java. Upon registration, the observer will be notified of already fetched snippets.
      *
-     * @param observer object to notify when snippets are received, or {@code null} if we want to
-     *                 stop observing.
+     * @param observer object to notify when snippets are received.
      */
     @Override
     public void setObserver(SuggestionsSource.Observer observer) {
-        assert mObserver == null || mObserver == observer;
-
+        assert observer != null;
         mObserver = observer;
-        nativeSetObserver(mNativeSnippetsBridge, observer == null ? null : this);
     }
 
     @Override
     public void fetchSuggestions(@CategoryInt int category, String[] displayedSuggestionIds) {
-        assert mNativeSnippetsBridge != 0;
-        assert mObserver != null;
-
         nativeFetch(mNativeSnippetsBridge, category, displayedSuggestionIds);
     }
 
@@ -251,16 +245,12 @@
 
     @CalledByNative
     private void onNewSuggestions(@CategoryInt int category) {
-        assert mNativeSnippetsBridge != 0;
-        assert mObserver != null;
-        mObserver.onNewSuggestions(category);
+        if (mObserver != null) mObserver.onNewSuggestions(category);
     }
 
     @CalledByNative
     private void onMoreSuggestions(@CategoryInt int category, List<SnippetArticle> suggestions) {
-        assert mNativeSnippetsBridge != 0;
-        assert mObserver != null;
-        mObserver.onMoreSuggestions(category, suggestions);
+        if (mObserver != null) mObserver.onMoreSuggestions(category, suggestions);
     }
 
     @CalledByNative
@@ -314,5 +304,4 @@
             long nativeNTPSnippetsBridge, int category, int position);
     private static native void nativeOnSuggestionTargetVisited(int category, long visitTimeMs);
     private static native void nativeOnNTPInitialized(long nativeNTPSnippetsBridge);
-    private native void nativeSetObserver(long nativeNTPSnippetsBridge, SnippetsBridge bridge);
 }
diff --git a/chrome/android/java/src/org/chromium/chrome/browser/vr_shell/VrShellImpl.java b/chrome/android/java/src/org/chromium/chrome/browser/vr_shell/VrShellImpl.java
index 3bdbb727..47d5965 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/vr_shell/VrShellImpl.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/vr_shell/VrShellImpl.java
@@ -188,7 +188,7 @@
         mUiVirtualDisplay.update(size, size, dpr, null, null, null);
         mUiCVC.onSizeChanged(surfaceWidth, surfaceHeight, 0, 0);
         getViewRoot(mUiCVC).onPhysicalBackingSizeChanged(surfaceWidth, surfaceHeight);
-        nativeUIBoundsChanged(mNativeVrShell, surfaceWidth, surfaceHeight, dpr);
+        nativeUIPhysicalBoundsChanged(mNativeVrShell, surfaceWidth, surfaceHeight, dpr);
     }
 
     @CalledByNative
@@ -201,7 +201,7 @@
         mContentVirtualDisplay.update(size, size, dpr, null, null, null);
         mContentCVC.onSizeChanged(surfaceWidth, surfaceHeight, 0, 0);
         getViewRoot(mContentCVC).onPhysicalBackingSizeChanged(surfaceWidth, surfaceHeight);
-        nativeContentBoundsChanged(mNativeVrShell, surfaceWidth, surfaceHeight, dpr);
+        nativeContentPhysicalBoundsChanged(mNativeVrShell, surfaceWidth, surfaceHeight, dpr);
     }
 
     private ViewRoot getViewRoot(ContentViewCore cvc) {
@@ -320,8 +320,9 @@
     private native void nativeOnTriggerEvent(long nativeVrShell);
     private native void nativeOnPause(long nativeVrShell);
     private native void nativeOnResume(long nativeVrShell);
-    private native void nativeContentBoundsChanged(long nativeVrShell, int width, int height,
+    private native void nativeContentPhysicalBoundsChanged(long nativeVrShell, int width,
+            int height, float dpr);
+    private native void nativeUIPhysicalBoundsChanged(long nativeVrShell, int width, int height,
             float dpr);
-    private native void nativeUIBoundsChanged(long nativeVrShell, int width, int height, float dpr);
     private native void nativeSetWebVrMode(long nativeVrShell, boolean enabled);
 }
diff --git a/chrome/browser/BUILD.gn b/chrome/browser/BUILD.gn
index 900035b..8953b327 100644
--- a/chrome/browser/BUILD.gn
+++ b/chrome/browser/BUILD.gn
@@ -487,8 +487,6 @@
     "interstitials/chrome_controller_client.h",
     "interstitials/chrome_metrics_helper.cc",
     "interstitials/chrome_metrics_helper.h",
-    "interstitials/security_interstitial_page.cc",
-    "interstitials/security_interstitial_page.h",
     "intranet_redirect_detector.cc",
     "intranet_redirect_detector.h",
     "invalidation/profile_invalidation_provider_factory.cc",
@@ -1461,6 +1459,7 @@
     "//components/search",
     "//components/search_engines",
     "//components/search_provider_logos",
+    "//components/security_interstitials/content:security_interstitial_page",
     "//components/security_interstitials/core",
     "//components/security_state/content",
     "//components/security_state/core",
@@ -2011,7 +2010,6 @@
       "//components/safe_browsing:safe_browsing",
       "//components/safe_browsing/common:common",
       "//components/safe_browsing_db:metadata_proto",
-      "//components/security_interstitials/content:unsafe_resource",
     ]
     if (safe_browsing_mode == 1) {
       # "Safe Browsing Full" files in addition to the "basic" ones to use for
diff --git a/chrome/browser/android/chrome_entry_point.cc b/chrome/browser/android/chrome_entry_point.cc
index 789b99b4..5bc9215 100644
--- a/chrome/browser/android/chrome_entry_point.cc
+++ b/chrome/browser/android/chrome_entry_point.cc
@@ -3,6 +3,7 @@
 // found in the LICENSE file.
 
 #include "base/android/jni_android.h"
+#include "base/android/library_loader/library_loader_hooks.h"
 #include "base/bind.h"
 #include "chrome/app/android/chrome_jni_onload.h"
 
@@ -16,13 +17,17 @@
   return true;
 }
 
+bool NativeInit() {
+  return android::OnJNIOnLoadInit(base::Bind(&Init));
+}
+
 }  // namespace
 
 // This is called by the VM when the shared library is first loaded.
 JNI_EXPORT jint JNI_OnLoad(JavaVM* vm, void* reserved) {
-  if (!android::OnJNIOnLoadRegisterJNI(vm, base::Bind(&RegisterJNI)) ||
-      !android::OnJNIOnLoadInit(base::Bind(&Init))) {
+  if (!android::OnJNIOnLoadRegisterJNI(vm, base::Bind(&RegisterJNI))) {
     return -1;
   }
+  base::android::SetNativeInitializationHook(NativeInit);
   return JNI_VERSION_1_4;
 }
diff --git a/chrome/browser/android/compositor/compositor_view.h b/chrome/browser/android/compositor/compositor_view.h
index cd0e9478..4d43ba7 100644
--- a/chrome/browser/android/compositor/compositor_view.h
+++ b/chrome/browser/android/compositor/compositor_view.h
@@ -9,7 +9,6 @@
 
 #include "base/android/jni_android.h"
 #include "base/android/scoped_java_ref.h"
-#include "base/containers/scoped_ptr_hash_map.h"
 #include "base/macros.h"
 #include "base/memory/weak_ptr.h"
 #include "cc/layers/layer_collections.h"
diff --git a/chrome/browser/android/monochrome_entry_point.cc b/chrome/browser/android/monochrome_entry_point.cc
index d6658be..a3c7f304 100644
--- a/chrome/browser/android/monochrome_entry_point.cc
+++ b/chrome/browser/android/monochrome_entry_point.cc
@@ -10,29 +10,34 @@
 
 namespace {
 
-bool RegisterJNI(JNIEnv* env) {
+bool Init() {
   return true;
 }
 
-bool Init() {
-  return true;
+bool NativeInit() {
+  JNIEnv* env = base::android::AttachCurrentThread();
+  int library_process_type = base::android::GetLibraryProcessType(env);
+  switch (library_process_type) {
+    case base::android::PROCESS_WEBVIEW:
+    case base::android::PROCESS_WEBVIEW_CHILD:
+      return android_webview::OnJNIOnLoadInit();
+      break;
+    case base::android::PROCESS_BROWSER:
+    case base::android::PROCESS_CHILD:
+      return android::OnJNIOnLoadInit(base::Bind(&Init));
+      break;
+    default:
+      NOTREACHED();
+      return false;
+  }
 }
 
 }  // namespace
 
 // This is called by the VM when the shared library is first loaded.
 JNI_EXPORT jint JNI_OnLoad(JavaVM* vm, void* reserved) {
+  base::android::DisableManualJniRegistration();
   base::android::InitVM(vm);
-  JNIEnv* env = base::android::AttachCurrentThread();
-  bool ret;
-  int library_process_type = base::android::GetLibraryProcessType(env);
-  if (library_process_type == base::android::PROCESS_WEBVIEW ||
-      library_process_type == base::android::PROCESS_WEBVIEW_CHILD) {
-    base::android::DisableManualJniRegistration();
-    ret = android_webview::OnJNIOnLoadInit();
-  } else {
-    ret = android::OnJNIOnLoadRegisterJNI(vm, base::Bind(&RegisterJNI)) &&
-          android::OnJNIOnLoadInit(base::Bind(&Init));
-  }
-  return ret ? JNI_VERSION_1_4 : -1;
+  base::android::SetNativeInitializationHook(NativeInit);
+  return JNI_VERSION_1_4;
 }
diff --git a/chrome/browser/android/ntp/ntp_snippets_bridge.cc b/chrome/browser/android/ntp/ntp_snippets_bridge.cc
index ee8c1fe8..479b9c49 100644
--- a/chrome/browser/android/ntp/ntp_snippets_bridge.cc
+++ b/chrome/browser/android/ntp/ntp_snippets_bridge.cc
@@ -110,9 +110,10 @@
 }  // namespace
 
 static jlong Init(JNIEnv* env,
-                  const JavaParamRef<jobject>& obj,
+                  const JavaParamRef<jobject>& j_bridge,
                   const JavaParamRef<jobject>& j_profile) {
-  NTPSnippetsBridge* snippets_bridge = new NTPSnippetsBridge(env, j_profile);
+  NTPSnippetsBridge* snippets_bridge =
+      new NTPSnippetsBridge(env, j_bridge, j_profile);
   return reinterpret_cast<intptr_t>(snippets_bridge);
 }
 
@@ -155,8 +156,11 @@
 }
 
 NTPSnippetsBridge::NTPSnippetsBridge(JNIEnv* env,
+                                     const JavaParamRef<jobject>& j_bridge,
                                      const JavaParamRef<jobject>& j_profile)
-    : content_suggestions_service_observer_(this), weak_ptr_factory_(this) {
+    : content_suggestions_service_observer_(this),
+      bridge_(env, j_bridge),
+      weak_ptr_factory_(this) {
   Profile* profile = ProfileAndroid::FromProfileAndroid(j_profile);
   content_suggestions_service_ =
       ContentSuggestionsServiceFactory::GetForProfile(profile);
@@ -170,12 +174,6 @@
   delete this;
 }
 
-void NTPSnippetsBridge::SetObserver(JNIEnv* env,
-                                    const JavaParamRef<jobject>& obj,
-                                    const JavaParamRef<jobject>& j_observer) {
-  observer_.Reset(env, j_observer);
-}
-
 ScopedJavaLocalRef<jintArray> NTPSnippetsBridge::GetCategories(
     JNIEnv* env,
     const base::android::JavaParamRef<jobject>& obj) {
@@ -413,50 +411,34 @@
 NTPSnippetsBridge::~NTPSnippetsBridge() {}
 
 void NTPSnippetsBridge::OnNewSuggestions(Category category) {
-  if (observer_.is_null()) {
-    return;
-  }
-
   JNIEnv* env = base::android::AttachCurrentThread();
-  Java_SnippetsBridge_onNewSuggestions(env, observer_,
+  Java_SnippetsBridge_onNewSuggestions(env, bridge_,
                                        static_cast<int>(category.id()));
 }
 
 void NTPSnippetsBridge::OnCategoryStatusChanged(Category category,
                                                 CategoryStatus new_status) {
-  if (observer_.is_null()) {
-    return;
-  }
-
   JNIEnv* env = base::android::AttachCurrentThread();
-  Java_SnippetsBridge_onCategoryStatusChanged(env, observer_,
+  Java_SnippetsBridge_onCategoryStatusChanged(env, bridge_,
                                               static_cast<int>(category.id()),
                                               static_cast<int>(new_status));
 }
 
 void NTPSnippetsBridge::OnSuggestionInvalidated(
     const ContentSuggestion::ID& suggestion_id) {
-  if (observer_.is_null()) {
-    return;
-  }
-
   JNIEnv* env = base::android::AttachCurrentThread();
   Java_SnippetsBridge_onSuggestionInvalidated(
-      env, observer_.obj(), static_cast<int>(suggestion_id.category().id()),
+      env, bridge_.obj(), static_cast<int>(suggestion_id.category().id()),
       ConvertUTF8ToJavaString(env, suggestion_id.id_within_category()).obj());
 }
 
 void NTPSnippetsBridge::OnFullRefreshRequired() {
-  if (observer_.is_null()) {
-    return;
-  }
-
   JNIEnv* env = base::android::AttachCurrentThread();
-  Java_SnippetsBridge_onFullRefreshRequired(env, observer_.obj());
+  Java_SnippetsBridge_onFullRefreshRequired(env, bridge_.obj());
 }
 
 void NTPSnippetsBridge::ContentSuggestionsServiceShutdown() {
-  observer_.Reset();
+  bridge_.Reset();
   content_suggestions_service_observer_.Remove(content_suggestions_service_);
 }
 
@@ -476,7 +458,7 @@
   // TODO(fhorschig, dgn): Allow refetch or show notification acc. to status.
   JNIEnv* env = AttachCurrentThread();
   Java_SnippetsBridge_onMoreSuggestions(
-      env, observer_, category.id(),
+      env, bridge_, category.id(),
       ToJavaSuggestionList(env, category, suggestions));
 }
 
diff --git a/chrome/browser/android/ntp/ntp_snippets_bridge.h b/chrome/browser/android/ntp/ntp_snippets_bridge.h
index 3b36cce0..6fadcb95 100644
--- a/chrome/browser/android/ntp/ntp_snippets_bridge.h
+++ b/chrome/browser/android/ntp/ntp_snippets_bridge.h
@@ -31,13 +31,10 @@
     : public ntp_snippets::ContentSuggestionsService::Observer {
  public:
   NTPSnippetsBridge(JNIEnv* env,
+                    const base::android::JavaParamRef<jobject>& j_bridge,
                     const base::android::JavaParamRef<jobject>& j_profile);
   void Destroy(JNIEnv* env, const base::android::JavaParamRef<jobject>& obj);
 
-  void SetObserver(JNIEnv* env,
-                   const base::android::JavaParamRef<jobject>& obj,
-                   const base::android::JavaParamRef<jobject>& j_observer);
-
   base::android::ScopedJavaLocalRef<jintArray> GetCategories(
       JNIEnv* env,
       const base::android::JavaParamRef<jobject>& obj);
@@ -164,8 +161,8 @@
                  ntp_snippets::ContentSuggestionsService::Observer>
       content_suggestions_service_observer_;
 
-  // Used to notify the Java side when new snippets have been fetched.
-  base::android::ScopedJavaGlobalRef<jobject> observer_;
+  // The Java SnippetsBridge.
+  base::android::ScopedJavaGlobalRef<jobject> bridge_;
 
   base::WeakPtrFactory<NTPSnippetsBridge> weak_ptr_factory_;
 
diff --git a/chrome/browser/android/vr_shell/vr_shell.cc b/chrome/browser/android/vr_shell/vr_shell.cc
index ee4aa984..e944dd2 100644
--- a/chrome/browser/android/vr_shell/vr_shell.cc
+++ b/chrome/browser/android/vr_shell/vr_shell.cc
@@ -340,19 +340,20 @@
 #endif
 }
 
-void VrShell::ContentBoundsChanged(JNIEnv* env,
-                                   const JavaParamRef<jobject>& object,
-                                   jint width, jint height, jfloat dpr) {
-  TRACE_EVENT0("gpu", "VrShell::ContentBoundsChanged");
+void VrShell::ContentPhysicalBoundsChanged(JNIEnv* env,
+                                           const JavaParamRef<jobject>& object,
+                                           jint width, jint height,
+                                           jfloat dpr) {
+  TRACE_EVENT0("gpu", "VrShell::ContentPhysicalBoundsChanged");
   GLThread* thread = static_cast<GLThread*>(gl_thread_.get());
   PostToGlThreadWhenReady(base::Bind(&VrShellGl::ContentPhysicalBoundsChanged,
                                      thread->GetVrShellGl(), width, height));
   content_compositor_->SetWindowBounds(gfx::Size(width, height));
 }
 
-void VrShell::UIBoundsChanged(JNIEnv* env,
-                              const JavaParamRef<jobject>& object,
-                              jint width, jint height, jfloat dpr) {
+void VrShell::UIPhysicalBoundsChanged(JNIEnv* env,
+                                      const JavaParamRef<jobject>& object,
+                                      jint width, jint height, jfloat dpr) {
   GLThread* thread = static_cast<GLThread*>(gl_thread_.get());
   PostToGlThreadWhenReady(base::Bind(&VrShellGl::UIPhysicalBoundsChanged,
                                      thread->GetVrShellGl(), width, height));
diff --git a/chrome/browser/android/vr_shell/vr_shell.h b/chrome/browser/android/vr_shell/vr_shell.h
index a95676e..435ef381 100644
--- a/chrome/browser/android/vr_shell/vr_shell.h
+++ b/chrome/browser/android/vr_shell/vr_shell.h
@@ -111,12 +111,12 @@
   void GvrDelegateReady();
   void AppButtonPressed();
 
-  void ContentBoundsChanged(
+  void ContentPhysicalBoundsChanged(
       JNIEnv* env,
       const base::android::JavaParamRef<jobject>& object,
       jint width, jint height, jfloat dpr);
 
-  void UIBoundsChanged(
+  void UIPhysicalBoundsChanged(
       JNIEnv* env,
       const base::android::JavaParamRef<jobject>& object,
       jint width, jint height, jfloat dpr);
diff --git a/chrome/browser/bitmap_fetcher/bitmap_fetcher_service.h b/chrome/browser/bitmap_fetcher/bitmap_fetcher_service.h
index 4df69f2..b3bdcf2 100644
--- a/chrome/browser/bitmap_fetcher/bitmap_fetcher_service.h
+++ b/chrome/browser/bitmap_fetcher/bitmap_fetcher_service.h
@@ -8,7 +8,6 @@
 
 #include "base/compiler_specific.h"
 #include "base/containers/mru_cache.h"
-#include "base/containers/scoped_ptr_hash_map.h"
 #include "base/macros.h"
 #include "base/memory/scoped_vector.h"
 #include "chrome/browser/bitmap_fetcher/bitmap_fetcher_delegate.h"
diff --git a/chrome/browser/browser_resources.grd b/chrome/browser/browser_resources.grd
index 142a0316..2b46f65 100644
--- a/chrome/browser/browser_resources.grd
+++ b/chrome/browser/browser_resources.grd
@@ -215,11 +215,11 @@
         <include name="IDR_SNIPPETS_INTERNALS_CSS" file="resources\snippets_internals.css" compress="gzip" type="BINDATA" />
         <include name="IDR_SNIPPETS_INTERNALS_JS" file="resources\snippets_internals.js" compress="gzip" type="BINDATA" />
         <if expr="enable_vr_shell or enable_webvr">
-          <include name="IDR_VR_SHELL_UI_HTML" file="resources\vr_shell\vr_shell_ui.html" allowexternalscript="true" flattenhtml="true" type="BINDATA" />
-          <include name="IDR_VR_SHELL_UI_CSS" file="resources\vr_shell\vr_shell_ui.css" type="BINDATA" />
-          <include name="IDR_VR_SHELL_UI_JS" file="resources\vr_shell\vr_shell_ui.js" type="BINDATA" />
-          <include name="IDR_VR_SHELL_UI_API_JS" file="resources\vr_shell\vr_shell_ui_api.js" type="BINDATA" />
-          <include name="IDR_VR_SHELL_UI_SCENE_JS" file="resources\vr_shell\vr_shell_ui_scene.js" type="BINDATA" />
+          <include name="IDR_VR_SHELL_UI_HTML" file="resources\vr_shell\vr_shell_ui.html" allowexternalscript="true" flattenhtml="true" compress="gzip" type="BINDATA" />
+          <include name="IDR_VR_SHELL_UI_CSS" file="resources\vr_shell\vr_shell_ui.css" compress="gzip" type="BINDATA" />
+          <include name="IDR_VR_SHELL_UI_JS" file="resources\vr_shell\vr_shell_ui.js" compress="gzip" type="BINDATA" />
+          <include name="IDR_VR_SHELL_UI_API_JS" file="resources\vr_shell\vr_shell_ui_api.js" compress="gzip" type="BINDATA" />
+          <include name="IDR_VR_SHELL_UI_SCENE_JS" file="resources\vr_shell\vr_shell_ui_scene.js" compress="gzip" type="BINDATA" />
         </if>
       </if>
       <include name="IDR_SUPERVISED_USER_INTERNALS_HTML" file="resources\supervised_user_internals.html" allowexternalscript="true" compress="gzip" type="BINDATA" />
diff --git a/chrome/browser/captive_portal/captive_portal_browsertest.cc b/chrome/browser/captive_portal/captive_portal_browsertest.cc
index 209141e..e18ed105 100644
--- a/chrome/browser/captive_portal/captive_portal_browsertest.cc
+++ b/chrome/browser/captive_portal/captive_portal_browsertest.cc
@@ -25,7 +25,6 @@
 #include "chrome/browser/captive_portal/captive_portal_tab_helper.h"
 #include "chrome/browser/captive_portal/captive_portal_tab_reloader.h"
 #include "chrome/browser/chrome_notification_types.h"
-#include "chrome/browser/interstitials/security_interstitial_page.h"
 #include "chrome/browser/net/url_request_mock_util.h"
 #include "chrome/browser/profiles/profile.h"
 #include "chrome/browser/ssl/captive_portal_blocking_page.h"
@@ -42,6 +41,7 @@
 #include "chrome/test/base/in_process_browser_test.h"
 #include "chrome/test/base/ui_test_utils.h"
 #include "components/prefs/pref_service.h"
+#include "components/security_interstitials/content/security_interstitial_page.h"
 #include "content/public/browser/browser_thread.h"
 #include "content/public/browser/interstitial_page.h"
 #include "content/public/browser/interstitial_page_delegate.h"
diff --git a/chrome/browser/chrome_browser_field_trials.cc b/chrome/browser/chrome_browser_field_trials.cc
index 7139e9e..2079328 100644
--- a/chrome/browser/chrome_browser_field_trials.cc
+++ b/chrome/browser/chrome_browser_field_trials.cc
@@ -68,9 +68,9 @@
 
   // Create persistent/shared memory and allow histograms to be stored in
   // it. Memory that is not actualy used won't be physically mapped by the
-  // system. BrowserMetrics usage, as reported in UMA, peaked around 1.9MiB
-  // as of 2016-02-20.
-  const size_t kAllocSize = 3 << 20;     // 3 MiB
+  // system. BrowserMetrics usage, as reported in UMA, peaked around 3.0MiB
+  // as of 2016-12-20.
+  const size_t kAllocSize = 5 << 20;     // 5 MiB
   const uint32_t kAllocId = 0x935DDD43;  // SHA1(BrowserMetrics)
   std::string storage = variations::GetVariationParamValueByFeature(
       base::kPersistentHistogramsFeature, "storage");
diff --git a/chrome/browser/chromeos/login/signin/token_handle_fetcher.h b/chrome/browser/chromeos/login/signin/token_handle_fetcher.h
index 09538ed..42d285d 100644
--- a/chrome/browser/chromeos/login/signin/token_handle_fetcher.h
+++ b/chrome/browser/chromeos/login/signin/token_handle_fetcher.h
@@ -8,7 +8,6 @@
 #include <string>
 
 #include "base/callback.h"
-#include "base/containers/scoped_ptr_hash_map.h"
 #include "base/macros.h"
 #include "base/memory/weak_ptr.h"
 #include "base/time/time.h"
diff --git a/chrome/browser/extensions/api/tabs/app_window_controller.h b/chrome/browser/extensions/api/tabs/app_window_controller.h
index 7f82974..8b8511a7 100644
--- a/chrome/browser/extensions/api/tabs/app_window_controller.h
+++ b/chrome/browser/extensions/api/tabs/app_window_controller.h
@@ -7,7 +7,6 @@
 
 #include <string>
 
-#include "base/containers/scoped_ptr_hash_map.h"
 #include "base/macros.h"
 #include "chrome/browser/extensions/window_controller.h"
 
diff --git a/chrome/browser/feedback/system_logs/log_sources/chrome_internal_log_source.cc b/chrome/browser/feedback/system_logs/log_sources/chrome_internal_log_source.cc
index b90fba3..98b9d286 100644
--- a/chrome/browser/feedback/system_logs/log_sources/chrome_internal_log_source.cc
+++ b/chrome/browser/feedback/system_logs/log_sources/chrome_internal_log_source.cc
@@ -8,6 +8,7 @@
 #include "base/sys_info.h"
 #include "build/build_config.h"
 #include "chrome/browser/browser_process.h"
+#include "chrome/browser/google/google_brand.h"
 #include "chrome/browser/profiles/profile_manager.h"
 #include "chrome/browser/sync/profile_sync_service_factory.h"
 #include "chrome/common/channel_info.h"
@@ -48,6 +49,7 @@
 #if defined(OS_WIN)
 constexpr char kUsbKeyboardDetected[] = "usb_keyboard_detected";
 constexpr char kIsEnrolledToDomain[] = "enrolled_to_domain";
+constexpr char kInstallerBrandCode[] = "installer_brand_code";
 #endif
 
 #if defined(OS_CHROMEOS)
@@ -116,6 +118,7 @@
 #if defined(OS_WIN)
   PopulateUsbKeyboardDetected(response.get());
   PopulateEnrolledToDomain(response.get());
+  PopulateInstallerBrandCode(response.get());
 #endif
 
   if (ProfileManager::GetLastUsedProfile()->IsChild())
@@ -246,6 +249,14 @@
                                          ? "Enrolled to domain"
                                          : "Not enrolled to domain";
 }
+
+void ChromeInternalLogSource::PopulateInstallerBrandCode(
+    SystemLogsResponse* response) {
+  std::string brand;
+  google_brand::GetBrand(&brand);
+  (*response)[kInstallerBrandCode] =
+      brand.empty() ? "Unknown brand code" : brand;
+}
 #endif
 
 }  // namespace system_logs
diff --git a/chrome/browser/feedback/system_logs/log_sources/chrome_internal_log_source.h b/chrome/browser/feedback/system_logs/log_sources/chrome_internal_log_source.h
index e41bd23..6a1128b1 100644
--- a/chrome/browser/feedback/system_logs/log_sources/chrome_internal_log_source.h
+++ b/chrome/browser/feedback/system_logs/log_sources/chrome_internal_log_source.h
@@ -32,6 +32,7 @@
 #if defined(OS_WIN)
   void PopulateUsbKeyboardDetected(SystemLogsResponse* response);
   void PopulateEnrolledToDomain(SystemLogsResponse* response);
+  void PopulateInstallerBrandCode(SystemLogsResponse* response);
 #endif
 
   DISALLOW_COPY_AND_ASSIGN(ChromeInternalLogSource);
diff --git a/chrome/browser/interstitials/chrome_controller_client.cc b/chrome/browser/interstitials/chrome_controller_client.cc
index a268d65..034c7f6 100644
--- a/chrome/browser/interstitials/chrome_controller_client.cc
+++ b/chrome/browser/interstitials/chrome_controller_client.cc
@@ -14,12 +14,9 @@
 #include "chrome/browser/profiles/profile.h"
 #include "chrome/common/pref_names.h"
 #include "chrome/common/url_constants.h"
-#include "components/prefs/pref_service.h"
 #include "components/safe_browsing_db/safe_browsing_prefs.h"
 #include "content/public/browser/browser_thread.h"
-#include "content/public/browser/interstitial_page.h"
 #include "content/public/browser/web_contents.h"
-#include "content/public/common/referrer.h"
 
 #if defined(OS_ANDROID)
 #include "chrome/browser/android/intent_helper.h"
@@ -123,17 +120,15 @@
 ChromeControllerClient::ChromeControllerClient(
     content::WebContents* web_contents,
     std::unique_ptr<security_interstitials::MetricsHelper> metrics_helper)
-    : ControllerClient(std::move(metrics_helper)),
-      web_contents_(web_contents),
-      interstitial_page_(nullptr) {}
+    : SecurityInterstitialControllerClient(
+        web_contents, std::move(metrics_helper),
+        Profile::FromBrowserContext(
+            web_contents->GetBrowserContext())->GetPrefs(),
+        g_browser_process->GetApplicationLocale(),
+        GURL(chrome::kChromeUINewTabURL)) {}
 
 ChromeControllerClient::~ChromeControllerClient() {}
 
-void ChromeControllerClient::set_interstitial_page(
-    content::InterstitialPage* interstitial_page) {
-  interstitial_page_ = interstitial_page;
-}
-
 bool ChromeControllerClient::CanLaunchDateAndTimeSettings() {
 #if defined(OS_ANDROID) || defined(OS_CHROMEOS) || defined(OS_LINUX) || \
     defined(OS_MACOSX) || defined(OS_WIN)
@@ -155,49 +150,3 @@
       base::Bind(&LaunchDateAndTimeSettingsOnFileThread));
 #endif
 }
-
-void ChromeControllerClient::GoBack() {
-  interstitial_page_->DontProceed();
-}
-
-// If the offending entry has committed, go back or to a safe page without
-// closing the error page. This error page will be closed when the new page
-// commits.
-void ChromeControllerClient::GoBackAfterNavigationCommitted() {
-  if (web_contents_->GetController().CanGoBack()) {
-    web_contents_->GetController().GoBack();
-  } else {
-    web_contents_->GetController().LoadURL(
-        GURL(chrome::kChromeUINewTabURL), content::Referrer(),
-        ui::PAGE_TRANSITION_AUTO_TOPLEVEL, std::string());
-  }
-}
-
-void ChromeControllerClient::Proceed() {
-  interstitial_page_->Proceed();
-}
-
-void ChromeControllerClient::Reload() {
-  web_contents_->GetController().Reload(content::ReloadType::NORMAL, true);
-}
-
-void ChromeControllerClient::OpenUrlInCurrentTab(const GURL& url) {
-  content::OpenURLParams params(url, Referrer(),
-                                WindowOpenDisposition::CURRENT_TAB,
-                                ui::PAGE_TRANSITION_LINK, false);
-  web_contents_->OpenURL(params);
-}
-
-const std::string& ChromeControllerClient::GetApplicationLocale() {
-  return g_browser_process->GetApplicationLocale();
-}
-
-PrefService* ChromeControllerClient::GetPrefService() {
-  Profile* profile =
-      Profile::FromBrowserContext(web_contents_->GetBrowserContext());
-  return profile->GetPrefs();
-}
-
-const std::string ChromeControllerClient::GetExtendedReportingPrefName() {
-  return safe_browsing::GetExtendedReportingPrefName(*GetPrefService());
-}
diff --git a/chrome/browser/interstitials/chrome_controller_client.h b/chrome/browser/interstitials/chrome_controller_client.h
index 5f7c7fb..6e2ff28 100644
--- a/chrome/browser/interstitials/chrome_controller_client.h
+++ b/chrome/browser/interstitials/chrome_controller_client.h
@@ -6,42 +6,24 @@
 #define CHROME_BROWSER_INTERSTITIALS_CHROME_CONTROLLER_CLIENT_H_
 
 #include "base/macros.h"
-#include "components/security_interstitials/core/controller_client.h"
+#include "components/security_interstitials/content/security_interstitial_controller_client.h"
 
 namespace content {
-class InterstitialPage;
 class WebContents;
 }
 
 // Provides embedder-specific logic for the security error page controller.
-class ChromeControllerClient : public security_interstitials::ControllerClient {
+class ChromeControllerClient
+    : public security_interstitials::SecurityInterstitialControllerClient {
  public:
   ChromeControllerClient(
       content::WebContents* web_contents,
       std::unique_ptr<security_interstitials::MetricsHelper> metrics_helper);
   ~ChromeControllerClient() override;
 
-  void set_interstitial_page(content::InterstitialPage* interstitial_page);
-
   // security_interstitials::ControllerClient overrides
   bool CanLaunchDateAndTimeSettings() override;
   void LaunchDateAndTimeSettings() override;
-  void GoBack() override;
-  void GoBackAfterNavigationCommitted() override;
-  void Proceed() override;
-  void Reload() override;
-  void OpenUrlInCurrentTab(const GURL& url) override;
-
-  PrefService* GetPrefService() override;
-
- protected:
-  // security_interstitials::ControllerClient overrides
-  const std::string& GetApplicationLocale() override;
-  const std::string GetExtendedReportingPrefName() override;
-
- private:
-  content::WebContents* web_contents_;
-  content::InterstitialPage* interstitial_page_;
 
   DISALLOW_COPY_AND_ASSIGN(ChromeControllerClient);
 };
diff --git a/chrome/browser/interstitials/security_interstitial_page_test_utils.cc b/chrome/browser/interstitials/security_interstitial_page_test_utils.cc
index 889d7cf..4cbc4c2 100644
--- a/chrome/browser/interstitials/security_interstitial_page_test_utils.cc
+++ b/chrome/browser/interstitials/security_interstitial_page_test_utils.cc
@@ -7,12 +7,12 @@
 #include <string>
 
 #include "base/strings/stringprintf.h"
-#include "chrome/browser/interstitials/security_interstitial_page.h"
 #include "chrome/browser/profiles/profile.h"
 #include "chrome/browser/ui/browser.h"
 #include "chrome/browser/ui/tabs/tab_strip_model.h"
 #include "chrome/common/pref_names.h"
 #include "components/prefs/pref_service.h"
+#include "components/security_interstitials/content/security_interstitial_page.h"
 #include "components/security_interstitials/core/controller_client.h"
 #include "content/public/browser/interstitial_page.h"
 #include "content/public/browser/web_contents.h"
@@ -57,7 +57,7 @@
   content::WebContents* contents =
       browser()->tab_strip_model()->GetActiveWebContents();
   DCHECK(contents);
-  SecurityInterstitialPage* blocking_page =
+  security_interstitials::SecurityInterstitialPage* blocking_page =
       CreateInterstitial(contents, request_url);
   blocking_page->Show();
 
diff --git a/chrome/browser/interstitials/security_interstitial_page_test_utils.h b/chrome/browser/interstitials/security_interstitial_page_test_utils.h
index 65a82f3..95c3eaf 100644
--- a/chrome/browser/interstitials/security_interstitial_page_test_utils.h
+++ b/chrome/browser/interstitials/security_interstitial_page_test_utils.h
@@ -16,7 +16,10 @@
 }
 
 class GURL;
+
+namespace security_interstitials {
 class SecurityInterstitialPage;
+}
 
 namespace chrome_browser_interstitials {
 
@@ -36,7 +39,7 @@
   testing::AssertionResult VerifyIDNDecoded() const;
 
  protected:
-  virtual SecurityInterstitialPage* CreateInterstitial(
+  virtual security_interstitials::SecurityInterstitialPage* CreateInterstitial(
       content::WebContents* contents,
       const GURL& request_url) const = 0;
 };
diff --git a/chrome/browser/media_galleries/chromeos/mtp_device_delegate_impl_chromeos.h b/chrome/browser/media_galleries/chromeos/mtp_device_delegate_impl_chromeos.h
index 50d325d..5218e87d 100644
--- a/chrome/browser/media_galleries/chromeos/mtp_device_delegate_impl_chromeos.h
+++ b/chrome/browser/media_galleries/chromeos/mtp_device_delegate_impl_chromeos.h
@@ -14,7 +14,6 @@
 #include <string>
 
 #include "base/callback.h"
-#include "base/containers/scoped_ptr_hash_map.h"
 #include "base/files/file_path.h"
 #include "base/location.h"
 #include "base/macros.h"
diff --git a/chrome/browser/page_load_metrics/user_input_tracker.cc b/chrome/browser/page_load_metrics/user_input_tracker.cc
index c72b94e9..c21ff1c1 100644
--- a/chrome/browser/page_load_metrics/user_input_tracker.cc
+++ b/chrome/browser/page_load_metrics/user_input_tracker.cc
@@ -99,7 +99,12 @@
     return;
 
   if (time > now) {
-    DCHECK(!base::TimeTicks::IsHighResolution());
+    // We should never receive a UserInputEvent with a timestamp in the future
+    // if we're on a platform with a high-res clock, where the monotonic clock
+    // is system-wide monotonic. Unfortunately, this DCHECK seems to fire in
+    // some linux unit tests, so it is disabled for the time being. See
+    // crbug.com/678093 for more details.
+    // DCHECK(!base::TimeTicks::IsHighResolution());
     return;
   }
 
diff --git a/chrome/browser/policy/policy_browsertest.cc b/chrome/browser/policy/policy_browsertest.cc
index 72e3877..ad7e48a2 100644
--- a/chrome/browser/policy/policy_browsertest.cc
+++ b/chrome/browser/policy/policy_browsertest.cc
@@ -53,7 +53,6 @@
 #include "chrome/browser/extensions/updater/extension_cache_fake.h"
 #include "chrome/browser/extensions/updater/extension_updater.h"
 #include "chrome/browser/infobars/infobar_service.h"
-#include "chrome/browser/interstitials/security_interstitial_page.h"
 #include "chrome/browser/interstitials/security_interstitial_page_test_utils.h"
 #include "chrome/browser/io_thread.h"
 #include "chrome/browser/media/router/media_router_feature.h"
@@ -114,6 +113,7 @@
 #include "components/search/search.h"
 #include "components/search_engines/template_url.h"
 #include "components/search_engines/template_url_service.h"
+#include "components/security_interstitials/content/security_interstitial_page.h"
 #include "components/security_interstitials/core/controller_client.h"
 #include "components/strings/grit/components_strings.h"
 #include "components/translate/core/browser/language_state.h"
diff --git a/chrome/browser/resources/bluetooth_internals/snackbar.js b/chrome/browser/resources/bluetooth_internals/snackbar.js
index 9cca49e..a13859b 100644
--- a/chrome/browser/resources/bluetooth_internals/snackbar.js
+++ b/chrome/browser/resources/bluetooth_internals/snackbar.js
@@ -17,6 +17,7 @@
   var SnackbarOptions;
 
   /** @const {number} */ var SHOW_DURATION = 5000;
+  /** @const {number} */ var TRANSITION_DURATION = 225;
 
   /**
    * Enum of Snackbar types. Used by Snackbar to determine the styling for the
@@ -77,7 +78,7 @@
     },
 
     /**
-     * Shows the Snackbar.
+     * Shows the Snackbar and dispatches the 'showed' event.
      */
     show: function() {
       this.classList.add('open');
@@ -86,23 +87,33 @@
 
       document.addEventListener('contentfocus', this.boundStartTimeout_);
       document.addEventListener('contentblur', this.boundStopTimeout_);
+      this.dispatchEvent(new CustomEvent('showed'));
     },
 
     /**
      * Dismisses the Snackbar. Once the Snackbar is completely hidden, the
-     * 'dismissed' event is fired.
+     * 'dismissed' event is fired and the returned Promise is resolved. If the
+     * snackbar is already hidden, a resolved Promise is returned.
+     * @return {!Promise}
      */
     dismiss: function() {
-      this.addEventListener('webkitTransitionEnd', function(event) {
-        if (event.propertyName === 'transform')
+      this.stopTimeout_();
+
+      if (!this.classList.contains('open'))
+        return Promise.resolve();
+
+      return new Promise(function(resolve) {
+        listenOnce(this, 'webkitTransitionEnd', function() {
           this.dispatchEvent(new CustomEvent('dismissed'));
+          resolve();
+        }.bind(this));
+
+        ensureTransitionEndEvent(this, TRANSITION_DURATION);
+        this.classList.remove('open');
+
+        document.removeEventListener('contentfocus', this.boundStartTimeout_);
+        document.removeEventListener('contentblur', this.boundStopTimeout_);
       }.bind(this));
-
-      ensureTransitionEndEvent(this, SHOW_DURATION);
-      this.classList.remove('open');
-
-      document.removeEventListener('contentfocus', this.boundStartTimeout_);
-      document.removeEventListener('contentblur', this.boundStopTimeout_);
     },
 
     /**
@@ -214,7 +225,8 @@
    */
   Snackbar.dismiss = function(clearQueue) {
     if (clearQueue) Snackbar.queue_ = [];
-    if (Snackbar.current_) Snackbar.current_.dismiss();
+    if (Snackbar.current_) return Snackbar.current_.dismiss();
+    return Promise.resolve();
   };
 
 
diff --git a/chrome/browser/safe_browsing/safe_browsing_blocking_page.cc b/chrome/browser/safe_browsing/safe_browsing_blocking_page.cc
index 201c61fa..5a1090b 100644
--- a/chrome/browser/safe_browsing/safe_browsing_blocking_page.cc
+++ b/chrome/browser/safe_browsing/safe_browsing_blocking_page.cc
@@ -23,8 +23,10 @@
 #include "chrome/browser/safe_browsing/threat_details.h"
 #include "chrome/browser/safe_browsing/ui_manager.h"
 #include "chrome/common/pref_names.h"
+#include "chrome/common/url_constants.h"
 #include "components/prefs/pref_service.h"
 #include "components/safe_browsing_db/safe_browsing_prefs.h"
+#include "components/security_interstitials/content/security_interstitial_controller_client.h"
 #include "content/public/browser/browser_thread.h"
 #include "content/public/browser/interstitial_page.h"
 #include "content/public/browser/navigation_entry.h"
@@ -36,6 +38,7 @@
 using content::InterstitialPage;
 using content::WebContents;
 using security_interstitials::SafeBrowsingErrorUI;
+using security_interstitials::SecurityInterstitialControllerClient;
 
 namespace safe_browsing {
 
@@ -101,7 +104,7 @@
     : SecurityInterstitialPage(
           web_contents,
           unsafe_resources[0].url,
-          CreateMetricsHelper(web_contents, unsafe_resources)),
+          CreateControllerClient(web_contents, unsafe_resources)),
       threat_details_proceed_delay_ms_(kThreatDetailsProceedDelayMilliSeconds),
       ui_manager_(ui_manager),
       main_frame_url_(main_frame_url),
@@ -109,11 +112,12 @@
       proceeded_(false) {
   // Computes display options based on user profile and blocked resource.
   bool is_main_frame_load_blocked = IsMainPageLoadBlocked(unsafe_resources);
-  bool can_show_extended_reporting_option = CanShowExtendedReportingOption();
   SafeBrowsingErrorUI::SBErrorDisplayOptions display_options(
-      is_main_frame_load_blocked, can_show_extended_reporting_option,
-      IsExtendedReportingEnabled(*profile()->GetPrefs()),
-      IsScout(*profile()->GetPrefs()),
+      is_main_frame_load_blocked,
+      IsPrefEnabled(prefs::kSafeBrowsingExtendedReportingOptInAllowed),
+      web_contents->GetBrowserContext()->IsOffTheRecord(),
+      IsExtendedReportingEnabled(*controller()->GetPrefService()),
+      IsScout(*controller()->GetPrefService()),
       IsPrefEnabled(prefs::kSafeBrowsingProceedAnywayDisabled));
   sb_error_ui_ = base::MakeUnique<SafeBrowsingErrorUI>(
       unsafe_resources[0].url, main_frame_url_,
@@ -135,7 +139,8 @@
   // reports.
   if (unsafe_resources.size() == 1 &&
       ShouldReportThreatDetails(unsafe_resources[0].threat_type) &&
-      threat_details_.get() == NULL && can_show_extended_reporting_option) {
+      threat_details_.get() == NULL &&
+      sb_error_ui_->CanShowExtendedReportingOption()) {
     threat_details_ = ThreatDetails::NewThreatDetails(ui_manager_, web_contents,
                                                       unsafe_resources[0]);
   }
@@ -150,11 +155,6 @@
          threat_type == SB_THREAT_TYPE_CLIENT_SIDE_MALWARE_URL;
 }
 
-bool SafeBrowsingBlockingPage::CanShowExtendedReportingOption() {
-  return (!web_contents()->GetBrowserContext()->IsOffTheRecord() &&
-          IsPrefEnabled(prefs::kSafeBrowsingExtendedReportingOptInAllowed));
-}
-
 SafeBrowsingBlockingPage::~SafeBrowsingBlockingPage() {
 }
 
@@ -229,7 +229,7 @@
   if (proceeded_)
     return;
 
-  if (!IsPrefEnabled(prefs::kSafeBrowsingProceedAnywayDisabled)) {
+  if (!sb_error_ui_->is_proceed_anyway_disabled()) {
     controller()->metrics_helper()->RecordUserDecision(
         security_interstitials::MetricsHelper::DONT_PROCEED);
   }
@@ -274,8 +274,8 @@
     return;  // Not all interstitials have threat details (eg., incognito mode).
 
   const bool enabled =
-      IsExtendedReportingEnabled(*profile()->GetPrefs()) &&
-      IsPrefEnabled(prefs::kSafeBrowsingExtendedReportingOptInAllowed);
+      sb_error_ui_->is_extended_reporting_enabled() &&
+      sb_error_ui_->is_extended_reporting_opt_in_allowed();
   if (!enabled)
     return;
 
@@ -443,8 +443,8 @@
 }
 
 // static
-std::unique_ptr<ChromeMetricsHelper>
-SafeBrowsingBlockingPage::CreateMetricsHelper(
+std::unique_ptr<security_interstitials::SecurityInterstitialControllerClient>
+SafeBrowsingBlockingPage::CreateControllerClient(
     WebContents* web_contents,
     const UnsafeResourceList& unsafe_resources) {
   SafeBrowsingErrorUI::SBInterstitialReason interstitial_reason =
@@ -454,9 +454,23 @@
   reporting_info.metric_prefix =
       GetMetricPrefix(unsafe_resources, interstitial_reason);
   reporting_info.extra_suffix = GetExtraMetricsSuffix(unsafe_resources);
-  return std::unique_ptr<ChromeMetricsHelper>(
-      new ChromeMetricsHelper(web_contents, request_url, reporting_info,
-                              GetSamplingEventName(interstitial_reason)));
+
+  std::unique_ptr<ChromeMetricsHelper> metrics_helper =
+      base::MakeUnique<ChromeMetricsHelper>(
+          web_contents, request_url, reporting_info,
+          GetSamplingEventName(interstitial_reason));
+
+  Profile* profile = Profile::FromBrowserContext(
+      web_contents->GetBrowserContext());
+  DCHECK(profile);
+
+  return base::MakeUnique<
+      security_interstitials::SecurityInterstitialControllerClient>(
+          web_contents,
+          std::move(metrics_helper),
+          profile->GetPrefs(),
+          g_browser_process->GetApplicationLocale(),
+          GURL(chrome::kChromeUINewTabURL));
 }
 
 void SafeBrowsingBlockingPage::PopulateInterstitialStrings(
diff --git a/chrome/browser/safe_browsing/safe_browsing_blocking_page.h b/chrome/browser/safe_browsing/safe_browsing_blocking_page.h
index a302b93..93ce111 100644
--- a/chrome/browser/safe_browsing/safe_browsing_blocking_page.h
+++ b/chrome/browser/safe_browsing/safe_browsing_blocking_page.h
@@ -38,8 +38,8 @@
 #include "base/macros.h"
 #include "base/task/cancelable_task_tracker.h"
 #include "chrome/browser/interstitials/chrome_metrics_helper.h"
-#include "chrome/browser/interstitials/security_interstitial_page.h"
 #include "chrome/browser/safe_browsing/ui_manager.h"
+#include "components/security_interstitials/content/security_interstitial_page.h"
 #include "components/security_interstitials/core/safe_browsing_error_ui.h"
 #include "content/public/browser/interstitial_page_delegate.h"
 #include "url/gurl.h"
@@ -49,7 +49,8 @@
 class SafeBrowsingBlockingPageFactory;
 class ThreatDetails;
 
-class SafeBrowsingBlockingPage : public SecurityInterstitialPage {
+class SafeBrowsingBlockingPage
+    : public security_interstitials::SecurityInterstitialPage {
  public:
   typedef security_interstitials::UnsafeResource UnsafeResource;
   typedef security_interstitials::SafeBrowsingErrorUI SafeBrowsingErrorUI;
@@ -130,12 +131,7 @@
   // milliseconds), in order to get data from the blocked resource itself.
   int64_t threat_details_proceed_delay_ms_;
 
-  // Checks if we should even show the extended reporting option. We don't show
-  // it in incognito mode or if kSafeBrowsingExtendedReportingOptInAllowed
-  // preference is disabled.
-  bool CanShowExtendedReportingOption();
-
-  // Called when the insterstitial is going away. If there is a
+  // Called when the interstitial is going away. If there is a
   // pending threat details object, we look at the user's
   // preferences, and if the option to send threat details is
   // enabled, the report is scheduled to be sent on the |ui_manager_|.
@@ -194,7 +190,8 @@
   static SafeBrowsingErrorUI::SBInterstitialReason GetInterstitialReason(
       const UnsafeResourceList& unsafe_resources);
 
-  static std::unique_ptr<ChromeMetricsHelper> CreateMetricsHelper(
+  std::unique_ptr<security_interstitials::SecurityInterstitialControllerClient>
+  CreateControllerClient(
       content::WebContents* web_contents,
       const UnsafeResourceList& unsafe_resources);
 
diff --git a/chrome/browser/safe_browsing/safe_browsing_blocking_page_test.cc b/chrome/browser/safe_browsing/safe_browsing_blocking_page_test.cc
index 5100146..ba998a6c 100644
--- a/chrome/browser/safe_browsing/safe_browsing_blocking_page_test.cc
+++ b/chrome/browser/safe_browsing/safe_browsing_blocking_page_test.cc
@@ -1328,7 +1328,7 @@
       public testing::WithParamInterface<testing::tuple<bool, SBThreatType>> {
  protected:
   // SecurityInterstitialIDNTest implementation
-  SecurityInterstitialPage* CreateInterstitial(
+  security_interstitials::SecurityInterstitialPage* CreateInterstitial(
       content::WebContents* contents,
       const GURL& request_url) const override {
     SafeBrowsingUIManager::CreateWhitelistForTesting(contents);
diff --git a/chrome/browser/safe_browsing/safe_browsing_blocking_page_unittest.cc b/chrome/browser/safe_browsing/safe_browsing_blocking_page_unittest.cc
index 0376620..ee4ae78 100644
--- a/chrome/browser/safe_browsing/safe_browsing_blocking_page_unittest.cc
+++ b/chrome/browser/safe_browsing/safe_browsing_blocking_page_unittest.cc
@@ -637,7 +637,7 @@
   ShowInterstitial(false, kBadURL);
   SafeBrowsingBlockingPage* sb_interstitial = GetSafeBrowsingBlockingPage();
   ASSERT_TRUE(sb_interstitial);
-  EXPECT_TRUE(sb_interstitial->CanShowExtendedReportingOption());
+  EXPECT_TRUE(sb_interstitial->sb_error_ui_->CanShowExtendedReportingOption());
 
   base::RunLoop().RunUntilIdle();
 
@@ -671,7 +671,7 @@
   ShowInterstitial(false, kBadURL);
   SafeBrowsingBlockingPage* sb_interstitial = GetSafeBrowsingBlockingPage();
   ASSERT_TRUE(sb_interstitial);
-  EXPECT_TRUE(sb_interstitial->CanShowExtendedReportingOption());
+  EXPECT_TRUE(sb_interstitial->sb_error_ui_->CanShowExtendedReportingOption());
 
   base::RunLoop().RunUntilIdle();
 
@@ -707,7 +707,7 @@
   ShowInterstitial(false, kBadURL);
   SafeBrowsingBlockingPage* sb_interstitial = GetSafeBrowsingBlockingPage();
   ASSERT_TRUE(sb_interstitial);
-  EXPECT_FALSE(sb_interstitial->CanShowExtendedReportingOption());
+  EXPECT_FALSE(sb_interstitial->sb_error_ui_->CanShowExtendedReportingOption());
 
   base::RunLoop().RunUntilIdle();
 
@@ -741,7 +741,7 @@
   ShowInterstitial(false, kBadURL);
   SafeBrowsingBlockingPage* sb_interstitial = GetSafeBrowsingBlockingPage();
   ASSERT_TRUE(sb_interstitial);
-  EXPECT_FALSE(sb_interstitial->CanShowExtendedReportingOption());
+  EXPECT_FALSE(sb_interstitial->sb_error_ui_->CanShowExtendedReportingOption());
 
   base::RunLoop().RunUntilIdle();
 
diff --git a/chrome/browser/ssl/bad_clock_blocking_page.cc b/chrome/browser/ssl/bad_clock_blocking_page.cc
index 69080dea..9ccc147 100644
--- a/chrome/browser/ssl/bad_clock_blocking_page.cc
+++ b/chrome/browser/ssl/bad_clock_blocking_page.cc
@@ -69,9 +69,12 @@
     ssl_errors::ClockState clock_state,
     std::unique_ptr<SSLCertReporter> ssl_cert_reporter,
     const base::Callback<void(content::CertificateRequestResultType)>& callback)
-    : SecurityInterstitialPage(web_contents,
-                               request_url,
-                               CreateMetricsHelper(web_contents, request_url)),
+    : SecurityInterstitialPage(
+          web_contents,
+          request_url,
+          base::MakeUnique<ChromeControllerClient>(
+              web_contents,
+              CreateMetricsHelper(web_contents, request_url))),
       callback_(callback),
       ssl_info_(ssl_info),
       cert_report_helper_(new CertReportHelper(
diff --git a/chrome/browser/ssl/bad_clock_blocking_page.h b/chrome/browser/ssl/bad_clock_blocking_page.h
index 28f8e7f..83b3f5f 100644
--- a/chrome/browser/ssl/bad_clock_blocking_page.h
+++ b/chrome/browser/ssl/bad_clock_blocking_page.h
@@ -11,8 +11,8 @@
 #include "base/callback.h"
 #include "base/macros.h"
 #include "base/time/time.h"
-#include "chrome/browser/interstitials/security_interstitial_page.h"
 #include "chrome/browser/ssl/ssl_cert_reporter.h"
+#include "components/security_interstitials/content/security_interstitial_page.h"
 #include "components/ssl_errors/error_classification.h"
 #include "content/public/browser/certificate_request_result_type.h"
 #include "net/ssl/ssl_info.h"
@@ -28,7 +28,8 @@
 // occurs when an SSL error is triggered by a clock misconfiguration. It
 // creates the UI using security_interstitials::BadClockUI and then
 // displays it. It deletes itself when the interstitial page is closed.
-class BadClockBlockingPage : public SecurityInterstitialPage {
+class BadClockBlockingPage
+    : public security_interstitials::SecurityInterstitialPage {
  public:
   // Interstitial type, used in tests.
   static InterstitialPageDelegate::TypeID kTypeForTesting;
diff --git a/chrome/browser/ssl/captive_portal_blocking_page.cc b/chrome/browser/ssl/captive_portal_blocking_page.cc
index 072bb89..06e7529 100644
--- a/chrome/browser/ssl/captive_portal_blocking_page.cc
+++ b/chrome/browser/ssl/captive_portal_blocking_page.cc
@@ -77,9 +77,12 @@
     std::unique_ptr<SSLCertReporter> ssl_cert_reporter,
     const net::SSLInfo& ssl_info,
     const base::Callback<void(content::CertificateRequestResultType)>& callback)
-    : SecurityInterstitialPage(web_contents,
-                               request_url,
-                               CreateMetricsHelper(web_contents, request_url)),
+    : SecurityInterstitialPage(
+          web_contents,
+          request_url,
+          base::MakeUnique<ChromeControllerClient>(
+              web_contents,
+              CreateMetricsHelper(web_contents, request_url))),
       login_url_(login_url),
       ssl_info_(ssl_info),
       callback_(callback) {
diff --git a/chrome/browser/ssl/captive_portal_blocking_page.h b/chrome/browser/ssl/captive_portal_blocking_page.h
index 669bf46..c4c234a 100644
--- a/chrome/browser/ssl/captive_portal_blocking_page.h
+++ b/chrome/browser/ssl/captive_portal_blocking_page.h
@@ -10,8 +10,8 @@
 
 #include "base/callback.h"
 #include "base/macros.h"
-#include "chrome/browser/interstitials/security_interstitial_page.h"
 #include "chrome/common/features.h"
+#include "components/security_interstitials/content/security_interstitial_page.h"
 #include "content/public/browser/certificate_request_result_type.h"
 #include "net/ssl/ssl_info.h"
 #include "url/gurl.h"
@@ -39,7 +39,8 @@
 // This class should only be used on the UI thread because its implementation
 // uses captive_portal::CaptivePortalService, which can only be accessed on the
 // UI thread. Only used when ENABLE_CAPTIVE_PORTAL_DETECTION is true.
-class CaptivePortalBlockingPage : public SecurityInterstitialPage {
+class CaptivePortalBlockingPage
+    : public security_interstitials::SecurityInterstitialPage {
  public:
   // Interstitial type, for testing.
   static const void* const kTypeForTesting;
diff --git a/chrome/browser/ssl/captive_portal_blocking_page_browsertest.cc b/chrome/browser/ssl/captive_portal_blocking_page_browsertest.cc
index fe6d2cd0..4d0a9d1 100644
--- a/chrome/browser/ssl/captive_portal_blocking_page_browsertest.cc
+++ b/chrome/browser/ssl/captive_portal_blocking_page_browsertest.cc
@@ -332,7 +332,7 @@
 class CaptivePortalBlockingPageIDNTest : public SecurityInterstitialIDNTest {
  protected:
   // SecurityInterstitialIDNTest implementation
-  SecurityInterstitialPage* CreateInterstitial(
+  security_interstitials::SecurityInterstitialPage* CreateInterstitial(
       content::WebContents* contents,
       const GURL& request_url) const override {
     net::SSLInfo empty_ssl_info;
diff --git a/chrome/browser/ssl/cert_report_helper.h b/chrome/browser/ssl/cert_report_helper.h
index ce37f4a..8982bcea 100644
--- a/chrome/browser/ssl/cert_report_helper.h
+++ b/chrome/browser/ssl/cert_report_helper.h
@@ -8,7 +8,6 @@
 #include <string>
 
 #include "base/macros.h"
-#include "chrome/browser/interstitials/security_interstitial_page.h"
 #include "components/certificate_reporting/error_report.h"
 #include "net/ssl/ssl_info.h"
 #include "url/gurl.h"
diff --git a/chrome/browser/ssl/ssl_blocking_page.cc b/chrome/browser/ssl/ssl_blocking_page.cc
index e94a43b..b92ab33 100644
--- a/chrome/browser/ssl/ssl_blocking_page.cc
+++ b/chrome/browser/ssl/ssl_blocking_page.cc
@@ -187,9 +187,11 @@
     bool overridable,
     std::unique_ptr<ChromeMetricsHelper> metrics_helper,
     const base::Callback<void(content::CertificateRequestResultType)>& callback)
-    : SecurityInterstitialPage(web_contents,
-                               request_url,
-                               std::move(metrics_helper)),
+    : SecurityInterstitialPage(
+          web_contents,
+          request_url,
+          base::MakeUnique<ChromeControllerClient>(
+              web_contents, std::move(metrics_helper))),
       callback_(callback),
       ssl_info_(ssl_info),
       overridable_(overridable),
diff --git a/chrome/browser/ssl/ssl_blocking_page.h b/chrome/browser/ssl/ssl_blocking_page.h
index f59bbd91..4a5da75b 100644
--- a/chrome/browser/ssl/ssl_blocking_page.h
+++ b/chrome/browser/ssl/ssl_blocking_page.h
@@ -13,10 +13,10 @@
 #include "base/strings/string16.h"
 #include "base/task/cancelable_task_tracker.h"
 #include "base/time/time.h"
-#include "chrome/browser/interstitials/security_interstitial_page.h"
 #include "chrome/browser/profiles/profile.h"
 #include "chrome/browser/ssl/ssl_cert_reporter.h"
 #include "components/certificate_reporting/error_report.h"
+#include "components/security_interstitials/content/security_interstitial_page.h"
 #include "content/public/browser/certificate_request_result_type.h"
 #include "extensions/features/features.h"
 #include "net/ssl/ssl_info.h"
@@ -37,7 +37,8 @@
 // This class is responsible for showing/hiding the interstitial page that is
 // shown when a certificate error happens.
 // It deletes itself when the interstitial page is closed.
-class SSLBlockingPage : public SecurityInterstitialPage {
+class SSLBlockingPage
+    : public security_interstitials::SecurityInterstitialPage {
  public:
   // Interstitial type, used in tests.
   static InterstitialPageDelegate::TypeID kTypeForTesting;
diff --git a/chrome/browser/ssl/ssl_browser_tests.cc b/chrome/browser/ssl/ssl_browser_tests.cc
index 68c9e2a..8be475d 100644
--- a/chrome/browser/ssl/ssl_browser_tests.cc
+++ b/chrome/browser/ssl/ssl_browser_tests.cc
@@ -3670,7 +3670,7 @@
 class SSLBlockingPageIDNTest : public SecurityInterstitialIDNTest {
  protected:
   // SecurityInterstitialIDNTest implementation
-  SecurityInterstitialPage* CreateInterstitial(
+  security_interstitials::SecurityInterstitialPage* CreateInterstitial(
       content::WebContents* contents,
       const GURL& request_url) const override {
     net::SSLInfo ssl_info;
diff --git a/chrome/browser/sync_file_system/drive_backend/metadata_database.h b/chrome/browser/sync_file_system/drive_backend/metadata_database.h
index 9e1cfaf..dc89685 100644
--- a/chrome/browser/sync_file_system/drive_backend/metadata_database.h
+++ b/chrome/browser/sync_file_system/drive_backend/metadata_database.h
@@ -15,7 +15,6 @@
 #include <vector>
 
 #include "base/containers/hash_tables.h"
-#include "base/containers/scoped_ptr_hash_map.h"
 #include "base/files/file_path.h"
 #include "base/macros.h"
 #include "base/memory/scoped_vector.h"
diff --git a/chrome/browser/sync_file_system/drive_backend/metadata_database_index.h b/chrome/browser/sync_file_system/drive_backend/metadata_database_index.h
index 16eab073..5c7aa62 100644
--- a/chrome/browser/sync_file_system/drive_backend/metadata_database_index.h
+++ b/chrome/browser/sync_file_system/drive_backend/metadata_database_index.h
@@ -15,7 +15,6 @@
 #include <vector>
 
 #include "base/containers/hash_tables.h"
-#include "base/containers/scoped_ptr_hash_map.h"
 #include "base/hash.h"
 #include "base/macros.h"
 #include "base/memory/scoped_vector.h"
diff --git a/chrome/browser/ui/ash/launcher/chrome_launcher_controller_impl_browsertest.cc b/chrome/browser/ui/ash/launcher/chrome_launcher_controller_impl_browsertest.cc
index 2842126..5e1d861 100644
--- a/chrome/browser/ui/ash/launcher/chrome_launcher_controller_impl_browsertest.cc
+++ b/chrome/browser/ui/ash/launcher/chrome_launcher_controller_impl_browsertest.cc
@@ -1911,8 +1911,9 @@
 
 // Do basic drag and drop interaction tests between the application list and
 // the launcher in the secondary monitor.
+// TODO(msw): fix, http://crbug.com/678622.
 IN_PROC_BROWSER_TEST_F(ShelfAppBrowserTestWithMultiMonitor,
-    BasicDragAndDrop) {
+                       DISABLED_BasicDragAndDrop) {
   // Get a number of interfaces we need.
   DCHECK_EQ(ash::Shell::GetAllRootWindows().size(), 2U);
   aura::Window* secondary_root_window = ash::Shell::GetAllRootWindows()[1];
diff --git a/chrome/browser/ui/webui/vr_shell/vr_shell_ui_ui.cc b/chrome/browser/ui/webui/vr_shell/vr_shell_ui_ui.cc
index 5e615ea..fd6a0a9 100644
--- a/chrome/browser/ui/webui/vr_shell/vr_shell_ui_ui.cc
+++ b/chrome/browser/ui/webui/vr_shell/vr_shell_ui_ui.cc
@@ -183,15 +183,12 @@
 content::WebUIDataSource* CreateVrShellUIHTMLSource() {
   content::WebUIDataSource* source =
       content::WebUIDataSource::Create(chrome::kChromeUIVrShellUIHost);
+  source->UseGzip(std::unordered_set<std::string>() /* excluded_paths */);
   source->AddResourcePath("vr_shell_ui.css", IDR_VR_SHELL_UI_CSS);
   source->AddResourcePath("vr_shell_ui.js", IDR_VR_SHELL_UI_JS);
   source->AddResourcePath("vr_shell_ui_api.js", IDR_VR_SHELL_UI_API_JS);
   source->AddResourcePath("vr_shell_ui_scene.js", IDR_VR_SHELL_UI_SCENE_JS);
   source->SetDefaultResource(IDR_VR_SHELL_UI_HTML);
-  // We're localizing strings, so we can't currently use gzip since it's
-  // incompatible with i18n. TODO(klausw): re-enable gzip once an i18n
-  // compatible variant of WebUIDataSource's UseGzip gets added, and add
-  // compress=gzip to browser_resources.grd as appropriate.
   source->AddLocalizedString(
       "insecureWebVrContentPermanent",
       IDS_WEBSITE_SETTINGS_INSECURE_WEBVR_CONTENT_PERMANENT);
diff --git a/chrome/installer/util/shell_util.cc b/chrome/installer/util/shell_util.cc
index 948805a..57784fb8 100644
--- a/chrome/installer/util/shell_util.cc
+++ b/chrome/installer/util/shell_util.cc
@@ -1375,7 +1375,7 @@
 const wchar_t* ShellUtil::kDefaultFileAssociations[] = {L".htm", L".html",
     L".shtml", L".xht", L".xhtml", NULL};
 const wchar_t* ShellUtil::kPotentialFileAssociations[] = {L".htm", L".html",
-    L".pdf", L".shtml", L".xht", L".xhtml", L".webp", NULL};
+    L".pdf", L".shtml", L".svg", L".xht", L".xhtml", L".webp", NULL};
 const wchar_t* ShellUtil::kBrowserProtocolAssociations[] = {L"ftp", L"http",
     L"https", NULL};
 const wchar_t* ShellUtil::kPotentialProtocolAssociations[] = {L"ftp", L"http",
diff --git a/chrome/test/data/webui/bluetooth_internals_browsertest.js b/chrome/test/data/webui/bluetooth_internals_browsertest.js
index 2bfa1804b..998eeaf 100644
--- a/chrome/test/data/webui/bluetooth_internals_browsertest.js
+++ b/chrome/test/data/webui/bluetooth_internals_browsertest.js
@@ -218,16 +218,7 @@
   },
 };
 
-// Fails on Win/Mac. https://crbug.com/676227
-GEN('#if defined(OS_MACOSX) || defined(OS_WIN)');
-GEN('#define MAYBE_Startup_BluetoothInternals \\');
-GEN('    DISABLED_Startup_BluetoothInternals');
-GEN('#else');
-GEN('#define MAYBE_Startup_BluetoothInternals Startup_BluetoothInternals');
-GEN('#endif');
-
-TEST_F('BluetoothInternalsTest',
-       'MAYBE_Startup_BluetoothInternals', function() {
+TEST_F('BluetoothInternalsTest', 'Startup_BluetoothInternals', function() {
   var adapterFactory = null;
   var deviceTable = null;
   var sidebarNode = null;
@@ -470,13 +461,36 @@
     });
 
     /* Snackbar Tests */
-    function finishSnackbarTest(done) {
-      // Let event queue finish.
-      setTimeout(function() {
-        expectEquals(0, $('snackbar-container').children.length);
-        expectFalse(!!snackbar.Snackbar.current_);
-        done();
-      }, 10);
+
+    /**
+     * Checks snackbar showing status and returns a Promise that resolves when
+     * |pendingSnackbar| is shown. If the snackbar is already showing, the
+     * Promise resolves immediately.
+     * @param {!snackbar.Snackbar} pendingSnackbar
+     * @return {!Promise}
+     */
+    function whenSnackbarShows(pendingSnackbar) {
+      return new Promise(function(resolve) {
+        if (pendingSnackbar.classList.contains('open'))
+          resolve();
+        else
+          pendingSnackbar.addEventListener('showed', resolve);
+      });
+    }
+
+    /**
+     * Performs final checks for snackbar tests.
+     * @return {!Promise} Promise is fulfilled when the checks finish.
+     */
+    function finishSnackbarTest() {
+      return new Promise(function(resolve) {
+        // Let event queue finish.
+        setTimeout(function() {
+          expectEquals(0, $('snackbar-container').children.length);
+          expectFalse(!!snackbar.Snackbar.current_);
+          resolve();
+        }, 50);
+      });
     }
 
     test('Snackbar_ShowTimeout', function(done) {
@@ -484,21 +498,20 @@
       assertEquals(1, $('snackbar-container').children.length);
 
       snackbar1.addEventListener('dismissed', function() {
-        finishSnackbarTest(done);
+        finishSnackbarTest().then(done);
       });
     });
 
-    test('Snackbar_ShowDismiss', function(done) {
+    test('Snackbar_ShowDismiss', function() {
       var snackbar1 = snackbar.Snackbar.show('Message 1');
       assertEquals(1, $('snackbar-container').children.length);
-      snackbar1.addEventListener('dismissed', function() {
-        finishSnackbarTest(done);
-      });
 
-      snackbar.Snackbar.dismiss();
+      return whenSnackbarShows(snackbar1).then(function() {
+        return snackbar.Snackbar.dismiss();
+      }).then(finishSnackbarTest);
     });
 
-    test('Snackbar_QueueThreeDismiss', function(done) {
+    test('Snackbar_QueueThreeDismiss', function() {
       var expectedCalls = 3;
       var actualCalls = 0;
 
@@ -511,21 +524,17 @@
 
       function next() {
         actualCalls++;
-        snackbar.Snackbar.dismiss();
+        return snackbar.Snackbar.dismiss();
       }
 
-      snackbar1.addEventListener('dismissed', next);
-      snackbar2.addEventListener('dismissed', next);
-      snackbar3.addEventListener('dismissed', function() {
-        next();
+      whenSnackbarShows(snackbar1).then(next);
+      whenSnackbarShows(snackbar2).then(next);
+      return whenSnackbarShows(snackbar3).then(next).then(function() {
         expectEquals(expectedCalls, actualCalls);
-        finishSnackbarTest(done);
-      });
-
-      snackbar.Snackbar.dismiss();
+      }).then(finishSnackbarTest);
     });
 
-    test('Snackbar_QueueThreeDismissAll', function(done) {
+    test('Snackbar_QueueThreeDismissAll', function() {
       var expectedCalls = 1;
       var actualCalls = 0;
 
@@ -540,17 +549,17 @@
         assertTrue(false);
       }
 
-      snackbar1.addEventListener('dismissed', function() {
-        expectEquals(0, snackbar.Snackbar.queue_.length);
-        expectFalse(!!snackbar.Snackbar.current_);
-        snackbar.Snackbar.dismiss();
-
-        finishSnackbarTest(done);
-      });
+      whenSnackbarShows(snackbar2).then(next);
       snackbar2.addEventListener('dismissed', next);
+      whenSnackbarShows(snackbar3).then(next);
       snackbar3.addEventListener('dismissed', next);
 
-      snackbar.Snackbar.dismiss(true);
+      whenSnackbarShows(snackbar1).then(function() {
+        return snackbar.Snackbar.dismiss(true);
+      }).then(function() {
+        expectEquals(0, snackbar.Snackbar.queue_.length);
+        expectFalse(!!snackbar.Snackbar.current_);
+      }).then(finishSnackbarTest);
     });
   });
 
diff --git a/chromecast/renderer/cast_content_renderer_client.cc b/chromecast/renderer/cast_content_renderer_client.cc
index 125c4bd..69e3e87c 100644
--- a/chromecast/renderer/cast_content_renderer_client.cc
+++ b/chromecast/renderer/cast_content_renderer_client.cc
@@ -176,7 +176,6 @@
       IDR_MOJO_VALIDATOR_JS,
       IDR_MOJO_ROUTER_JS,
       IDR_MOJO_BINDINGS_JS,
-      IDR_MOJO_CONNECTION_JS,
   };
   for (size_t i = 0; i < arraysize(mojo_resource_ids); i++) {
     ExecuteJavaScript(render_frame, mojo_resource_ids[i]);
diff --git a/chromeos/dbus/fake_auth_policy_client.cc b/chromeos/dbus/fake_auth_policy_client.cc
index b822db46..f37f1ea5 100644
--- a/chromeos/dbus/fake_auth_policy_client.cc
+++ b/chromeos/dbus/fake_auth_policy_client.cc
@@ -10,8 +10,7 @@
 #include "base/location.h"
 #include "base/md5.h"
 #include "base/path_service.h"
-#include "base/task_runner_util.h"
-#include "base/threading/worker_pool.h"
+#include "base/task_scheduler/post_task.h"
 #include "chrome/browser/chromeos/policy/proto/chrome_device_policy.pb.h"
 #include "chromeos/chromeos_paths.h"
 #include "chromeos/cryptohome/cryptohome_parameters.h"
@@ -90,13 +89,14 @@
   CHECK(policy.SerializeToString(&payload));
 
   // Drop file for SessionManagerClientStubImpl to read.
-  if (!base::PostTaskAndReplyWithResult(
-          base::WorkerPool::GetTaskRunner(false /* task_is_slow */).get(),
-          FROM_HERE, base::Bind(&WritePolicyFile, policy_path, payload,
-                                "google/chromeos/device"),
-          callback)) {
-    callback.Run(false);
-  }
+  base::PostTaskWithTraitsAndReplyWithResult(
+      FROM_HERE, base::TaskTraits()
+                     .WithShutdownBehavior(
+                         base::TaskShutdownBehavior::CONTINUE_ON_SHUTDOWN)
+                     .WithPriority(base::TaskPriority::BACKGROUND)
+                     .MayBlock(),
+      Bind(&WritePolicyFile, policy_path, payload, "google/chromeos/device"),
+      callback);
 }
 
 void FakeAuthPolicyClient::RefreshUserPolicy(
@@ -119,13 +119,15 @@
   CHECK(policy.SerializeToString(&payload));
 
   // Drop file for SessionManagerClientStubImpl to read.
-  if (!base::PostTaskAndReplyWithResult(
-          base::WorkerPool::GetTaskRunner(false /* task_is_slow */).get(),
-          FROM_HERE, base::Bind(&WritePolicyFile, policy_path, payload,
-                                "google/chromeos/user"),
-          callback)) {
-    callback.Run(false);
-  }
+  base::PostTaskWithTraitsAndReplyWithResult(
+      FROM_HERE, base::TaskTraits()
+                     .WithShutdownBehavior(
+                         base::TaskShutdownBehavior::CONTINUE_ON_SHUTDOWN)
+                     .WithPriority(base::TaskPriority::BACKGROUND)
+                     .MayBlock(),
+      base::Bind(&WritePolicyFile, policy_path, payload,
+                 "google/chromeos/user"),
+      callback);
 }
 
 }  // namespace chromeos
diff --git a/chromeos/dbus/fake_permission_broker_client.cc b/chromeos/dbus/fake_permission_broker_client.cc
index f3b1e4b..98b242d 100644
--- a/chromeos/dbus/fake_permission_broker_client.cc
+++ b/chromeos/dbus/fake_permission_broker_client.cc
@@ -13,8 +13,8 @@
 #include "base/logging.h"
 #include "base/posix/eintr_wrapper.h"
 #include "base/strings/stringprintf.h"
+#include "base/task_scheduler/post_task.h"
 #include "base/threading/thread_task_runner_handle.h"
-#include "base/threading/worker_pool.h"
 
 namespace chromeos {
 
@@ -62,10 +62,13 @@
 void FakePermissionBrokerClient::OpenPath(const std::string& path,
                                           const OpenPathCallback& callback,
                                           const ErrorCallback& error_callback) {
-  base::WorkerPool::PostTask(
-      FROM_HERE, base::Bind(&chromeos::OpenPath, path, callback, error_callback,
-                            base::ThreadTaskRunnerHandle::Get()),
-      false);
+  base::PostTaskWithTraits(
+      FROM_HERE, base::TaskTraits()
+                     .WithShutdownBehavior(
+                         base::TaskShutdownBehavior::CONTINUE_ON_SHUTDOWN)
+                     .MayBlock(),
+      base::Bind(&chromeos::OpenPath, path, callback, error_callback,
+                 base::ThreadTaskRunnerHandle::Get()));
 }
 
 void FakePermissionBrokerClient::RequestTcpPortAccess(
diff --git a/chromeos/dbus/session_manager_client.cc b/chromeos/dbus/session_manager_client.cc
index aee0135..ddf09d00 100644
--- a/chromeos/dbus/session_manager_client.cc
+++ b/chromeos/dbus/session_manager_client.cc
@@ -18,8 +18,7 @@
 #include "base/path_service.h"
 #include "base/strings/string_number_conversions.h"
 #include "base/strings/string_util.h"
-#include "base/task_runner_util.h"
-#include "base/threading/worker_pool.h"
+#include "base/task_scheduler/post_task.h"
 #include "chromeos/chromeos_paths.h"
 #include "chromeos/cryptohome/cryptohome_parameters.h"
 #include "chromeos/dbus/blocking_method_caller.h"
@@ -822,16 +821,20 @@
     }
     base::FilePath device_policy_path =
         owner_key_path.DirName().AppendASCII("stub_device_policy");
-    base::PostTaskAndReplyWithResult(
-        base::WorkerPool::GetTaskRunner(false).get(),
-        FROM_HERE,
-        base::Bind(&GetFileContent, device_policy_path),
-        callback);
+    base::PostTaskWithTraitsAndReplyWithResult(
+        FROM_HERE, base::TaskTraits()
+                       .WithShutdownBehavior(
+                           base::TaskShutdownBehavior::CONTINUE_ON_SHUTDOWN)
+                       .MayBlock(),
+        base::Bind(&GetFileContent, device_policy_path), callback);
   }
   void RetrievePolicyForUser(const cryptohome::Identification& cryptohome_id,
                              const RetrievePolicyCallback& callback) override {
-    base::PostTaskAndReplyWithResult(
-        base::WorkerPool::GetTaskRunner(false).get(), FROM_HERE,
+    base::PostTaskWithTraitsAndReplyWithResult(
+        FROM_HERE, base::TaskTraits()
+                       .WithShutdownBehavior(
+                           base::TaskShutdownBehavior::CONTINUE_ON_SHUTDOWN)
+                       .MayBlock(),
         base::Bind(&GetFileContent,
                    GetUserFilePath(cryptohome_id, "stub_policy")),
         callback);
@@ -857,10 +860,12 @@
     }
 
     if (response.has_new_public_key()) {
-      base::WorkerPool::PostTask(
-          FROM_HERE,
-          base::Bind(&StoreFile, owner_key_path, response.new_public_key()),
-          false);
+      base::PostTaskWithTraits(
+          FROM_HERE, base::TaskTraits()
+                         .WithShutdownBehavior(
+                             base::TaskShutdownBehavior::CONTINUE_ON_SHUTDOWN)
+                         .MayBlock(),
+          base::Bind(&StoreFile, owner_key_path, response.new_public_key()));
     }
 
     // Chrome will attempt to retrieve the device policy right after storing
@@ -870,11 +875,13 @@
     // if it was present in the blob.
     base::FilePath device_policy_path =
         owner_key_path.DirName().AppendASCII("stub_device_policy");
-    base::WorkerPool::PostTaskAndReply(
-        FROM_HERE,
+    base::PostTaskWithTraitsAndReply(
+        FROM_HERE, base::TaskTraits()
+                       .WithShutdownBehavior(
+                           base::TaskShutdownBehavior::CONTINUE_ON_SHUTDOWN)
+                       .MayBlock(),
         base::Bind(&StoreFile, device_policy_path, policy_blob),
-        base::Bind(callback, true),
-        false);
+        base::Bind(callback, true));
   }
   void StorePolicyForUser(const cryptohome::Identification& cryptohome_id,
                           const std::string& policy_blob,
@@ -890,21 +897,25 @@
 
     if (response.has_new_public_key()) {
       base::FilePath key_path = GetUserFilePath(cryptohome_id, "policy.pub");
-      base::WorkerPool::PostTask(
-          FROM_HERE,
-          base::Bind(&StoreFile, key_path, response.new_public_key()),
-          false);
+      base::PostTaskWithTraits(
+          FROM_HERE, base::TaskTraits()
+                         .WithShutdownBehavior(
+                             base::TaskShutdownBehavior::CONTINUE_ON_SHUTDOWN)
+                         .MayBlock(),
+          base::Bind(&StoreFile, key_path, response.new_public_key()));
     }
 
     // This file isn't read directly by Chrome, but is used by this class to
     // reload the user policy across restarts.
     base::FilePath stub_policy_path =
         GetUserFilePath(cryptohome_id, "stub_policy");
-    base::WorkerPool::PostTaskAndReply(
-        FROM_HERE,
+    base::PostTaskWithTraitsAndReply(
+        FROM_HERE, base::TaskTraits()
+                       .WithShutdownBehavior(
+                           base::TaskShutdownBehavior::CONTINUE_ON_SHUTDOWN)
+                       .MayBlock(),
         base::Bind(&StoreFile, stub_policy_path, policy_blob),
-        base::Bind(callback, true),
-        false);
+        base::Bind(callback, true));
   }
   void StoreDeviceLocalAccountPolicy(
       const std::string& account_id,
diff --git a/components/autofill/core/browser/autofill_manager.cc b/components/autofill/core/browser/autofill_manager.cc
index 7cda51d..23005083 100644
--- a/components/autofill/core/browser/autofill_manager.cc
+++ b/components/autofill/core/browser/autofill_manager.cc
@@ -50,6 +50,7 @@
 #include "components/autofill/core/browser/phone_number.h"
 #include "components/autofill/core/browser/phone_number_i18n.h"
 #include "components/autofill/core/browser/popup_item_ids.h"
+#include "components/autofill/core/browser/validation.h"
 #include "components/autofill/core/common/autofill_constants.h"
 #include "components/autofill/core/common/autofill_data_validation.h"
 #include "components/autofill/core/common/autofill_pref_names.h"
@@ -1163,10 +1164,10 @@
     // their card. If no CVC is present, do nothing. We could fall back to a
     // local save but we believe that sometimes offering upload and sometimes
     // offering local save is a confusing user experience.
-    int cvc;
     for (const auto& field : submitted_form) {
       if (field->Type().GetStorableType() == CREDIT_CARD_VERIFICATION_CODE &&
-          base::StringToInt(field->value, &cvc)) {
+          IsValidCreditCardSecurityCode(field->value,
+                                        upload_request_.card.type())) {
         upload_request_.cvc = field->value;
         break;
       }
diff --git a/components/autofill/core/browser/autofill_manager_unittest.cc b/components/autofill/core/browser/autofill_manager_unittest.cc
index 7274dd6..72d6f43 100644
--- a/components/autofill/core/browser/autofill_manager_unittest.cc
+++ b/components/autofill/core/browser/autofill_manager_unittest.cc
@@ -4601,6 +4601,59 @@
 
 // TODO(crbug.com/666704): Flaky on android_n5x_swarming_rel bot.
 #if defined(OS_ANDROID)
+#define MAYBE_UploadCreditCard_CvcInvalidLength DISABLED_UploadCreditCard_CvcInvalidLength
+#else
+#define MAYBE_UploadCreditCard_CvcInvalidLength UploadCreditCard_CvcInvalidLength
+#endif
+TEST_F(AutofillManagerTest, MAYBE_UploadCreditCard_CvcInvalidLength) {
+  personal_data_.ClearAutofillProfiles();
+  autofill_manager_->set_credit_card_upload_enabled(true);
+
+  // Create, fill and submit an address form in order to establish a recent
+  // profile which can be selected for the upload request.
+  FormData address_form;
+  test::CreateTestAddressFormData(&address_form);
+  FormsSeen(std::vector<FormData>(1, address_form));
+  ManuallyFillAddressForm("Flo", "Master", "77401", "US", &address_form);
+  FormSubmitted(address_form);
+
+  // Set up our credit card form data.
+  FormData credit_card_form;
+  CreateTestCreditCardFormData(&credit_card_form, true, false);
+  FormsSeen(std::vector<FormData>(1, credit_card_form));
+
+  // Edit the data, and submit.
+  credit_card_form.fields[0].value = ASCIIToUTF16("Flo Master");
+  credit_card_form.fields[1].value = ASCIIToUTF16("4111111111111111");
+  credit_card_form.fields[2].value = ASCIIToUTF16("11");
+  credit_card_form.fields[3].value = ASCIIToUTF16("2017");
+  credit_card_form.fields[4].value = ASCIIToUTF16("1234");
+
+  base::HistogramTester histogram_tester;
+
+  // Neither a local save nor an upload should happen in this case.
+  EXPECT_CALL(autofill_client_, ConfirmSaveCreditCardLocally(_, _)).Times(0);
+  FormSubmitted(credit_card_form);
+  EXPECT_FALSE(autofill_manager_->credit_card_was_uploaded());
+
+  // Verify that the correct histogram entry (and only that) was logged.
+  histogram_tester.ExpectUniqueSample(
+      "Autofill.CardUploadDecisionExpanded",
+      AutofillMetrics::UPLOAD_NOT_OFFERED_NO_CVC, 1);
+
+  rappor::TestRapporServiceImpl* rappor_service =
+      autofill_client_.test_rappor_service();
+  EXPECT_EQ(1, rappor_service->GetReportsCount());
+  std::string sample;
+  rappor::RapporType type;
+  EXPECT_TRUE(rappor_service->GetRecordedSampleForMetric(
+      "Autofill.CardUploadNotOfferedNoCvc", &sample, &type));
+  EXPECT_EQ("myform.com", sample);
+  EXPECT_EQ(rappor::ETLD_PLUS_ONE_RAPPOR_TYPE, type);
+}
+
+// TODO(crbug.com/666704): Flaky on android_n5x_swarming_rel bot.
+#if defined(OS_ANDROID)
 #define MAYBE_UploadCreditCard_MultipleCvcFields DISABLED_UploadCreditCard_MultipleCvcFields
 #else
 #define MAYBE_UploadCreditCard_MultipleCvcFields UploadCreditCard_MultipleCvcFields
diff --git a/components/autofill/core/browser/ui/card_unmask_prompt_controller_impl.cc b/components/autofill/core/browser/ui/card_unmask_prompt_controller_impl.cc
index d8e664c..435e00ca 100644
--- a/components/autofill/core/browser/ui/card_unmask_prompt_controller_impl.cc
+++ b/components/autofill/core/browser/ui/card_unmask_prompt_controller_impl.cc
@@ -15,6 +15,7 @@
 #include "components/autofill/core/browser/autofill_experiments.h"
 #include "components/autofill/core/browser/autofill_metrics.h"
 #include "components/autofill/core/browser/ui/card_unmask_prompt_view.h"
+#include "components/autofill/core/browser/validation.h"
 #include "components/autofill/core/common/autofill_pref_names.h"
 #include "components/prefs/pref_service.h"
 #include "grit/components_scaled_resources.h"
@@ -279,10 +280,7 @@
     const base::string16& input_text) const {
   base::string16 trimmed_text;
   base::TrimWhitespace(input_text, base::TRIM_ALL, &trimmed_text);
-  size_t input_size = card_.type() == kAmericanExpressCard ? 4 : 3;
-  return trimmed_text.size() == input_size &&
-         base::ContainsOnlyChars(trimmed_text,
-                                 base::ASCIIToUTF16("0123456789"));
+  return IsValidCreditCardSecurityCode(trimmed_text, card_.type());
 }
 
 bool CardUnmaskPromptControllerImpl::InputExpirationIsValid(
@@ -299,23 +297,15 @@
     return false;
   }
 
-  if (month_value < 1 || month_value > 12)
-    return false;
-
-  base::Time::Exploded now;
-  base::Time::Now().LocalExplode(&now);
-
   // Convert 2 digit year to 4 digit year.
-  if (year_value < 100)
+  if (year_value < 100) {
+    base::Time::Exploded now;
+    base::Time::Now().LocalExplode(&now);
     year_value += (now.year / 100) * 100;
+  }
 
-  if (year_value < now.year)
-    return false;
-
-  if (year_value > now.year)
-    return true;
-
-  return month_value >= now.month;
+  return IsValidCreditCardExpirationDate(year_value, month_value,
+                                         base::Time::Now());
 }
 
 base::TimeDelta CardUnmaskPromptControllerImpl::GetSuccessMessageDuration()
diff --git a/components/autofill/core/browser/validation.cc b/components/autofill/core/browser/validation.cc
index b784a26..15a96e6a 100644
--- a/components/autofill/core/browser/validation.cc
+++ b/components/autofill/core/browser/validation.cc
@@ -87,25 +87,11 @@
   return (sum % 10) == 0;
 }
 
-bool IsValidCreditCardSecurityCode(const base::string16& text) {
-  if (text.size() < 3U || text.size() > 4U)
-    return false;
-
-  for (const base::char16& it : text) {
-    if (!base::IsAsciiDigit(it))
-      return false;
-  }
-  return true;
-}
-
 bool IsValidCreditCardSecurityCode(const base::string16& code,
-                                   const base::string16& number) {
-  const char* const type = CreditCard::GetCreditCardType(number);
-  size_t required_length = 3;
-  if (type == kAmericanExpressCard)
-    required_length = 4;
-
-  return code.length() == required_length;
+                                   const base::StringPiece card_type) {
+  size_t required_length = card_type == kAmericanExpressCard ? 4 : 3;
+  return code.length() == required_length &&
+         base::ContainsOnlyChars(code, base::ASCIIToUTF16("0123456789"));
 }
 
 bool IsValidEmailAddress(const base::string16& text) {
diff --git a/components/autofill/core/browser/validation.h b/components/autofill/core/browser/validation.h
index aaaedcd2..a09ae75c 100644
--- a/components/autofill/core/browser/validation.h
+++ b/components/autofill/core/browser/validation.h
@@ -6,6 +6,7 @@
 #define COMPONENTS_AUTOFILL_CORE_BROWSER_VALIDATION_H_
 
 #include "base/strings/string16.h"
+#include "base/strings/string_piece.h"
 
 namespace base {
 class Time;
@@ -23,13 +24,10 @@
 // Uses the Luhn formula to validate the number.
 bool IsValidCreditCardNumber(const base::string16& text);
 
-// Returns true if |text| looks like a valid credit card security code.
-bool IsValidCreditCardSecurityCode(const base::string16& text);
-
 // Returns true if |code| looks like a valid credit card security code
-// for the type of credit card designated by |number|.
+// for the given credit card type.
 bool IsValidCreditCardSecurityCode(const base::string16& code,
-                                   const base::string16& number);
+                                   const base::StringPiece card_type);
 
 // Returns true if |text| looks like a valid e-mail address.
 bool IsValidEmailAddress(const base::string16& text);
diff --git a/components/autofill/core/browser/validation_unittest.cc b/components/autofill/core/browser/validation_unittest.cc
index c7b880b..798f5346 100644
--- a/components/autofill/core/browser/validation_unittest.cc
+++ b/components/autofill/core/browser/validation_unittest.cc
@@ -7,6 +7,7 @@
 #include "base/macros.h"
 #include "base/strings/utf_string_conversions.h"
 #include "base/time/time.h"
+#include "components/autofill/core/browser/credit_card.h"
 #include "components/autofill/core/browser/validation.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
@@ -25,6 +26,11 @@
   const int month;
 };
 
+struct SecurityCodeCardTypePair {
+  const char* security_code;
+  const char* card_type;
+};
+
 // From https://www.paypalobjects.com/en_US/vhelp/paypalmanager_help/credit_card_numbers.htm
 const char* const kValidNumbers[] = {
   "378282246310005",
@@ -64,14 +70,16 @@
   { 2015, 13 },  // Not a real month.
   { 2015, 0 },  // Zero is legal in the CC class but is not a valid date.
 };
-const char* const kValidCreditCardSecurityCode[] = {
-  "323",  // 3-digit CSC.
-  "3234",  // 4-digit CSC.
+const SecurityCodeCardTypePair kValidSecurityCodeCardTypePairs[] = {
+  { "323",  kGenericCard }, // 3-digit CSC.
+  { "3234", kAmericanExpressCard }, // 4-digit CSC.
 };
-const char* const kInvalidCreditCardSecurityCode[] = {
-  "32",  // CSC too short.
-  "12345",  // CSC too long.
-  "asd",  // non-numeric CSC.
+const SecurityCodeCardTypePair kInvalidSecurityCodeCardTypePairs[] = {
+  { "32", kGenericCard }, // CSC too short.
+  { "323", kAmericanExpressCard }, // CSC too short.
+  { "3234", kGenericCard }, // CSC too long.
+  { "12345", kAmericanExpressCard }, // CSC too long.
+  { "asd", kGenericCard }, // non-numeric CSC.
 };
 const char* const kValidEmailAddress[] = {
   "user@example",
@@ -85,10 +93,6 @@
   "user@",
   "user@=example.com"
 };
-const char kAmericanExpressCard[] = "341111111111111";
-const char kVisaCard[] = "4111111111111111";
-const char kAmericanExpressCVC[] = "1234";
-const char kVisaCVC[] = "123";
 }  // namespace
 
 TEST(AutofillValidation, IsValidCreditCardNumber) {
@@ -117,14 +121,19 @@
     EXPECT_TRUE(!IsValidCreditCardExpirationDate(data.year, data.month, now));
   }
 }
+
 TEST(AutofillValidation, IsValidCreditCardSecurityCode) {
-  for (const char* valid_code : kValidCreditCardSecurityCode) {
-    SCOPED_TRACE(valid_code);
-    EXPECT_TRUE(IsValidCreditCardSecurityCode(ASCIIToUTF16(valid_code)));
+  for (const auto data : kValidSecurityCodeCardTypePairs) {
+    SCOPED_TRACE(data.security_code);
+    SCOPED_TRACE(data.card_type);
+    EXPECT_TRUE(IsValidCreditCardSecurityCode(ASCIIToUTF16(data.security_code),
+                                              data.card_type));
   }
-  for (const char* invalid_code : kInvalidCreditCardSecurityCode) {
-    SCOPED_TRACE(invalid_code);
-    EXPECT_FALSE(IsValidCreditCardSecurityCode(ASCIIToUTF16(invalid_code)));
+  for (const auto data : kInvalidSecurityCodeCardTypePairs) {
+    SCOPED_TRACE(data.security_code);
+    SCOPED_TRACE(data.card_type);
+    EXPECT_FALSE(IsValidCreditCardSecurityCode(ASCIIToUTF16(data.security_code),
+                                               data.card_type));
   }
 }
 
@@ -139,19 +148,4 @@
   }
 }
 
-TEST(AutofillValidation, IsValidCreditCardSecurityCodeWithNumber) {
-  EXPECT_TRUE(IsValidCreditCardSecurityCode(
-      ASCIIToUTF16(kAmericanExpressCVC), ASCIIToUTF16(kAmericanExpressCard)));
-  EXPECT_TRUE(IsValidCreditCardSecurityCode(
-      ASCIIToUTF16(kVisaCVC), ASCIIToUTF16(kVisaCard)));
-  EXPECT_FALSE(IsValidCreditCardSecurityCode(
-      ASCIIToUTF16(kVisaCVC), ASCIIToUTF16(kAmericanExpressCard)));
-  EXPECT_FALSE(IsValidCreditCardSecurityCode(
-      ASCIIToUTF16(kAmericanExpressCVC), ASCIIToUTF16(kVisaCard)));
-  EXPECT_TRUE(IsValidCreditCardSecurityCode(
-      ASCIIToUTF16(kVisaCVC), ASCIIToUTF16(kInvalidNumbers[0])));
-  EXPECT_FALSE(IsValidCreditCardSecurityCode(
-      ASCIIToUTF16(kAmericanExpressCVC), ASCIIToUTF16(kInvalidNumbers[0])));
-}
-
 }  // namespace autofill
diff --git a/components/dom_distiller/content/renderer/distillability_agent.cc b/components/dom_distiller/content/renderer/distillability_agent.cc
index 41cbf92f8..e032b67 100644
--- a/components/dom_distiller/content/renderer/distillability_agent.cc
+++ b/components/dom_distiller/content/renderer/distillability_agent.cc
@@ -203,6 +203,7 @@
   render_frame()->GetRemoteInterfaces()->GetInterface(
       &distillability_service);
   DCHECK(distillability_service);
+  if (!distillability_service.is_bound()) return;
   distillability_service->NotifyIsDistillable(
       IsDistillablePage(doc, is_last), is_last);
 }
diff --git a/components/ntp_snippets/features.cc b/components/ntp_snippets/features.cc
index c18dc3e..f8a2c216 100644
--- a/components/ntp_snippets/features.cc
+++ b/components/ntp_snippets/features.cc
@@ -61,7 +61,7 @@
 
   if (category_ranker_value.empty()) {
     // Default, Enabled or Disabled.
-    return CategoryRankerChoice::CONSTANT;
+    return CategoryRankerChoice::CLICK_BASED;
   }
   if (category_ranker_value == kCategoryRankerConstantRanker) {
     return CategoryRankerChoice::CONSTANT;
diff --git a/components/ntp_snippets/remote/ntp_snippets_fetcher.cc b/components/ntp_snippets/remote/ntp_snippets_fetcher.cc
index c18c551..4969440 100644
--- a/components/ntp_snippets/remote/ntp_snippets_fetcher.cc
+++ b/components/ntp_snippets/remote/ntp_snippets_fetcher.cc
@@ -121,7 +121,7 @@
 std::string GetFetchEndpoint() {
   std::string endpoint = variations::GetVariationParamValue(
       ntp_snippets::kStudyName, kContentSuggestionsBackend);
-  return endpoint.empty() ? kChromeReaderServer : endpoint;
+  return endpoint.empty() ? kContentSuggestionsServer : endpoint;
 }
 
 bool UsesChromeContentSuggestionsAPI(const GURL& endpoint) {
diff --git a/components/ntp_snippets/remote/ntp_snippets_fetcher_unittest.cc b/components/ntp_snippets/remote/ntp_snippets_fetcher_unittest.cc
index 443a9e9a..c989ea81 100644
--- a/components/ntp_snippets/remote/ntp_snippets_fetcher_unittest.cc
+++ b/components/ntp_snippets/remote/ntp_snippets_fetcher_unittest.cc
@@ -382,19 +382,19 @@
 class ChromeReaderSnippetsFetcherTest : public NTPSnippetsFetcherTestBase {
  public:
   ChromeReaderSnippetsFetcherTest()
-      : NTPSnippetsFetcherTestBase(GURL(kTestChromeReaderUrl)) {}
+      : NTPSnippetsFetcherTestBase(GURL(kTestChromeReaderUrl)) {
+    default_variation_params_["content_suggestions_backend"] =
+        kChromeReaderServer;
+    SetVariationParam("content_suggestions_backend", kChromeReaderServer);
+    ResetSnippetsFetcher();
+  }
 };
 
 class NTPSnippetsContentSuggestionsFetcherTest
     : public NTPSnippetsFetcherTestBase {
  public:
   NTPSnippetsContentSuggestionsFetcherTest()
-      : NTPSnippetsFetcherTestBase(GURL(kTestChromeContentSuggestionsUrl)) {
-    default_variation_params_["content_suggestions_backend"] =
-        kContentSuggestionsServer;
-    SetVariationParam("content_suggestions_backend", kContentSuggestionsServer);
-    ResetSnippetsFetcher();
-  }
+      : NTPSnippetsFetcherTestBase(GURL(kTestChromeContentSuggestionsUrl)) {}
 };
 
 TEST_F(ChromeReaderSnippetsFetcherTest, ShouldNotFetchOnCreation) {
diff --git a/components/safe_browsing/BUILD.gn b/components/safe_browsing/BUILD.gn
index efd199d8..2559fb0 100644
--- a/components/safe_browsing/BUILD.gn
+++ b/components/safe_browsing/BUILD.gn
@@ -16,7 +16,7 @@
     "//components/safe_browsing_db:database_manager",
     "//components/safe_browsing_db:remote_database_manager",
     "//components/safe_browsing_db:safe_browsing_prefs",
-    "//components/security_interstitials/content:unsafe_resource",
+    "//components/security_interstitials/content:security_interstitial_page",
     "//content/public/browser:browser",
     "//net:net",
   ]
diff --git a/components/security_interstitials/content/BUILD.gn b/components/security_interstitials/content/BUILD.gn
index d044aaa..d2252c27 100644
--- a/components/security_interstitials/content/BUILD.gn
+++ b/components/security_interstitials/content/BUILD.gn
@@ -2,8 +2,12 @@
 # Use of this source code is governed by a BSD-style license that can be
 # found in the LICENSE file.
 
-static_library("unsafe_resource") {
+static_library("security_interstitial_page") {
   sources = [
+    "security_interstitial_controller_client.cc",
+    "security_interstitial_controller_client.h",
+    "security_interstitial_page.cc",
+    "security_interstitial_page.h",
     "unsafe_resource.cc",
     "unsafe_resource.h",
   ]
@@ -14,7 +18,13 @@
 
   deps = [
     "//base",
+    "//components/prefs:prefs",
+    "//components/resources",
+    "//components/safe_browsing_db:hit_report",
+    "//components/safe_browsing_db:safe_browsing_prefs",
     "//components/safe_browsing_db:util",
+    "//components/security_interstitials/core:core",
     "//content/public/browser",
+    "//content/public/common",
   ]
 }
diff --git a/components/security_interstitials/content/DEPS b/components/security_interstitials/content/DEPS
index 26eb8e5..a35d2339 100644
--- a/components/security_interstitials/content/DEPS
+++ b/components/security_interstitials/content/DEPS
@@ -1,4 +1,8 @@
 include_rules = [
+  "+components/prefs",
   "+components/safe_browsing_db",
+  "+components/security_interstitials/core",
   "+content/public/browser",
+  "+content/public/common",
+  "+grit/components_resources.h",
 ]
diff --git a/components/security_interstitials/content/security_interstitial_controller_client.cc b/components/security_interstitials/content/security_interstitial_controller_client.cc
new file mode 100644
index 0000000..150505e5
--- /dev/null
+++ b/components/security_interstitials/content/security_interstitial_controller_client.cc
@@ -0,0 +1,102 @@
+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "components/security_interstitials/content/security_interstitial_controller_client.h"
+
+#include <utility>
+
+#include "components/prefs/pref_service.h"
+#include "components/safe_browsing_db/safe_browsing_prefs.h"
+#include "components/security_interstitials/core/metrics_helper.h"
+#include "content/public/browser/interstitial_page.h"
+#include "content/public/browser/web_contents.h"
+#include "content/public/common/referrer.h"
+
+using content::Referrer;
+
+namespace security_interstitials {
+
+SecurityInterstitialControllerClient::SecurityInterstitialControllerClient(
+    content::WebContents* web_contents,
+    std::unique_ptr<MetricsHelper> metrics_helper,
+    PrefService* prefs,
+    const std::string& app_locale,
+    const GURL& default_safe_page)
+    : ControllerClient(std::move(metrics_helper)),
+      web_contents_(web_contents),
+      interstitial_page_(nullptr),
+      prefs_(prefs),
+      app_locale_(app_locale),
+      default_safe_page_(default_safe_page) {}
+
+SecurityInterstitialControllerClient::~SecurityInterstitialControllerClient() {}
+
+void SecurityInterstitialControllerClient::set_interstitial_page(
+    content::InterstitialPage* interstitial_page) {
+  interstitial_page_ = interstitial_page;
+}
+
+content::InterstitialPage*
+SecurityInterstitialControllerClient::interstitial_page() {
+  return interstitial_page_;
+}
+
+void SecurityInterstitialControllerClient::GoBack() {
+  interstitial_page_->DontProceed();
+}
+
+void SecurityInterstitialControllerClient::GoBackAfterNavigationCommitted() {
+  // If the offending entry has committed, go back or to a safe page without
+  // closing the error page. This error page will be closed when the new page
+  // commits.
+  if (web_contents_->GetController().CanGoBack()) {
+    web_contents_->GetController().GoBack();
+  } else {
+    web_contents_->GetController().LoadURL(
+        default_safe_page_, content::Referrer(),
+        ui::PAGE_TRANSITION_AUTO_TOPLEVEL, std::string());
+  }
+}
+
+void SecurityInterstitialControllerClient::Proceed() {
+  interstitial_page_->Proceed();
+}
+
+void SecurityInterstitialControllerClient::Reload() {
+  web_contents_->GetController().Reload(content::ReloadType::NORMAL, true);
+}
+
+void SecurityInterstitialControllerClient::OpenUrlInCurrentTab(
+    const GURL& url) {
+  content::OpenURLParams params(url, Referrer(),
+                                WindowOpenDisposition::CURRENT_TAB,
+                                ui::PAGE_TRANSITION_LINK, false);
+  web_contents_->OpenURL(params);
+}
+
+const std::string&
+SecurityInterstitialControllerClient::GetApplicationLocale() const {
+  return app_locale_;
+}
+
+PrefService*
+SecurityInterstitialControllerClient::GetPrefService() {
+  return prefs_;
+}
+
+const std::string
+SecurityInterstitialControllerClient::GetExtendedReportingPrefName() const {
+  return safe_browsing::GetExtendedReportingPrefName(*prefs_);
+}
+
+bool SecurityInterstitialControllerClient::CanLaunchDateAndTimeSettings() {
+  NOTREACHED();
+  return false;
+}
+
+void SecurityInterstitialControllerClient::LaunchDateAndTimeSettings() {
+  NOTREACHED();
+}
+
+}  // namespace security_interstitials
diff --git a/components/security_interstitials/content/security_interstitial_controller_client.h b/components/security_interstitials/content/security_interstitial_controller_client.h
new file mode 100644
index 0000000..1d70720
--- /dev/null
+++ b/components/security_interstitials/content/security_interstitial_controller_client.h
@@ -0,0 +1,70 @@
+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef COMPONENTS_SECURITY_INTERSTITIALS_CONTENT_SECURITY_INTERSTITIAL_CONTROLLER_CLIENT_H_
+#define COMPONENTS_SECURITY_INTERSTITIALS_CONTENT_SECURITY_INTERSTITIAL_CONTROLLER_CLIENT_H_
+
+#include "base/macros.h"
+#include "components/security_interstitials/core/controller_client.h"
+#include "url/gurl.h"
+
+namespace content {
+  class InterstitialPage;
+  class WebContents;
+}
+
+namespace security_interstitials {
+
+class MetricsHelper;
+
+// Handle commands from security interstitial pages. This class should only be
+// instantiated by SafeBrowsingBlockingPage for the time being.
+// TODO(jialiul): After we've done componentizing SafeBrowsingBlockingPage, we
+// should revisit this class to decide if other interstitials can use
+// SecurityInterstitialControllerClient.
+class SecurityInterstitialControllerClient
+    : public security_interstitials::ControllerClient {
+ public:
+  SecurityInterstitialControllerClient(
+      content::WebContents* web_contents,
+      std::unique_ptr<MetricsHelper> metrics_helper,
+      PrefService* prefs,
+      const std::string& app_locale,
+      const GURL& default_safe_page);
+
+  ~SecurityInterstitialControllerClient() override;
+
+  void set_interstitial_page(content::InterstitialPage* interstitial_page);
+  content::InterstitialPage* interstitial_page();
+
+  // security_interstitials::ControllerClient overrides.
+  void GoBack() override;
+  void GoBackAfterNavigationCommitted() override;
+  void Proceed() override;
+  void Reload() override;
+  void OpenUrlInCurrentTab(const GURL& url) override;
+  PrefService* GetPrefService() override;
+  const std::string& GetApplicationLocale() const override;
+  bool CanLaunchDateAndTimeSettings() override;
+  void LaunchDateAndTimeSettings() override;
+
+protected:
+  // security_interstitials::ControllerClient overrides.
+  const std::string GetExtendedReportingPrefName() const override;
+  content::WebContents* web_contents_;
+
+ private:
+  content::InterstitialPage* interstitial_page_;
+  PrefService* prefs_;
+  const std::string app_locale_;
+  // The default safe page we should go to if there is no previous page to go
+  // back to, e.g. chrome:kChromeUINewTabURL.
+  const GURL default_safe_page_;
+
+  DISALLOW_COPY_AND_ASSIGN(SecurityInterstitialControllerClient);
+};
+
+}  // namespace security_interstitials
+
+#endif  // COMPONENTS_SECURITY_INTERSTITIALS_CONTENT_SECURITY_INTERSTITIAL_CONTROLLER_CLIENT_H_
diff --git a/chrome/browser/interstitials/security_interstitial_page.cc b/components/security_interstitials/content/security_interstitial_page.cc
similarity index 74%
rename from chrome/browser/interstitials/security_interstitial_page.cc
rename to components/security_interstitials/content/security_interstitial_page.cc
index fc25be8..90c54a9e 100644
--- a/chrome/browser/interstitials/security_interstitial_page.cc
+++ b/components/security_interstitials/content/security_interstitial_page.cc
@@ -2,40 +2,37 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "chrome/browser/interstitials/security_interstitial_page.h"
+#include "components/security_interstitials/content/security_interstitial_page.h"
 
 #include <utility>
 
 #include "base/i18n/rtl.h"
 #include "base/metrics/histogram_macros.h"
-#include "base/strings/utf_string_conversions.h"
 #include "base/values.h"
-#include "chrome/browser/browser_process.h"
-#include "chrome/browser/interstitials/chrome_controller_client.h"
-#include "chrome/browser/profiles/profile.h"
-#include "chrome/common/pref_names.h"
-#include "components/grit/components_resources.h"
 #include "components/prefs/pref_service.h"
 #include "components/safe_browsing_db/safe_browsing_prefs.h"
+#include "components/security_interstitials/content/security_interstitial_controller_client.h"
 #include "components/security_interstitials/core/common_string_util.h"
 #include "components/security_interstitials/core/metrics_helper.h"
 #include "content/public/browser/interstitial_page.h"
 #include "content/public/browser/page_navigator.h"
 #include "content/public/browser/web_contents.h"
+#include "grit/components_resources.h"
 #include "ui/base/resource/resource_bundle.h"
 #include "ui/base/webui/jstemplate_builder.h"
 #include "ui/base/webui/web_ui_util.h"
 
+namespace security_interstitials {
+
 SecurityInterstitialPage::SecurityInterstitialPage(
     content::WebContents* web_contents,
     const GURL& request_url,
-    std::unique_ptr<security_interstitials::MetricsHelper> metrics_helper)
+    std::unique_ptr<SecurityInterstitialControllerClient> controller)
     : web_contents_(web_contents),
       request_url_(request_url),
       interstitial_page_(NULL),
       create_view_(true),
-      controller_(
-          new ChromeControllerClient(web_contents, std::move(metrics_helper))) {
+      controller_(std::move(controller)) {
   // Creating interstitial_page_ without showing it leaks memory, so don't
   // create it here.
 }
@@ -68,22 +65,20 @@
 
   // Determine if any prefs need to be updated prior to showing the security
   // interstitial.
-  safe_browsing::UpdatePrefsBeforeSecurityInterstitial(profile()->GetPrefs());
+  safe_browsing::UpdatePrefsBeforeSecurityInterstitial(
+      controller_->GetPrefService());
+
   interstitial_page_->Show();
 
   controller_->set_interstitial_page(interstitial_page_);
   AfterShow();
 }
 
-Profile* SecurityInterstitialPage::profile() {
-  return Profile::FromBrowserContext(web_contents()->GetBrowserContext());
-}
-
 bool SecurityInterstitialPage::IsPrefEnabled(const char* pref) {
-  return profile()->GetPrefs()->GetBoolean(pref);
+  return controller_->GetPrefService()->GetBoolean(pref);
 }
 
-ChromeControllerClient* SecurityInterstitialPage::controller() {
+SecurityInterstitialControllerClient* SecurityInterstitialPage::controller() {
   return controller_.get();
 }
 
@@ -100,11 +95,13 @@
 std::string SecurityInterstitialPage::GetHTMLContents() {
   base::DictionaryValue load_time_data;
   PopulateInterstitialStrings(&load_time_data);
-  const std::string& app_locale = g_browser_process->GetApplicationLocale();
-  webui::SetLoadTimeDataDefaults(app_locale, &load_time_data);
+  webui::SetLoadTimeDataDefaults(
+      controller()->GetApplicationLocale(), &load_time_data);
   std::string html = ResourceBundle::GetSharedInstance()
                          .GetRawDataResource(IDR_SECURITY_INTERSTITIAL_HTML)
                          .as_string();
   webui::AppendWebUiCssTextDefaults(&html);
   return webui::GetI18nTemplateHtml(html, &load_time_data);
 }
+
+}  // security_interstitials
diff --git a/chrome/browser/interstitials/security_interstitial_page.h b/components/security_interstitials/content/security_interstitial_page.h
similarity index 72%
rename from chrome/browser/interstitials/security_interstitial_page.h
rename to components/security_interstitials/content/security_interstitial_page.h
index 5b561096..4554e5e 100644
--- a/chrome/browser/interstitials/security_interstitial_page.h
+++ b/components/security_interstitials/content/security_interstitial_page.h
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef CHROME_BROWSER_INTERSTITIALS_SECURITY_INTERSTITIAL_PAGE_H_
-#define CHROME_BROWSER_INTERSTITIALS_SECURITY_INTERSTITIAL_PAGE_H_
+#ifndef COMPONENTS_SECURITY_INTERSTITIALS_CONTENT_SECURITY_INTERSTITIAL_PAGE_H_
+#define COMPONENTS_SECURITY_INTERSTITIALS_CONTENT_SECURITY_INTERSTITIAL_PAGE_H_
 
 #include <memory>
 
@@ -23,17 +23,14 @@
 
 namespace security_interstitials {
 class MetricsHelper;
-}
-
-class ChromeControllerClient;
-class Profile;
+class SecurityInterstitialControllerClient;
 
 class SecurityInterstitialPage : public content::InterstitialPageDelegate {
  public:
   SecurityInterstitialPage(
       content::WebContents* web_contents,
       const GURL& url,
-      std::unique_ptr<security_interstitials::MetricsHelper> metrics_helper);
+      std::unique_ptr<SecurityInterstitialControllerClient> controller);
   ~SecurityInterstitialPage() override;
 
   // Creates an interstitial and shows it.
@@ -64,16 +61,12 @@
   content::WebContents* web_contents() const;
   GURL request_url() const;
 
-  // Returns a pointer to the Profile associated with |web_contents_|.
-  Profile* profile();
-
-  // Returns the boolean value of the given |pref| from the PrefService of the
-  // Profile associated with |web_contents_|.
+  // Returns the boolean value of the given |pref|.
   bool IsPrefEnabled(const char* pref);
 
-  ChromeControllerClient* controller();
+  SecurityInterstitialControllerClient* controller();
 
-  security_interstitials::MetricsHelper* metrics_helper();
+  MetricsHelper* metrics_helper();
 
  private:
   // The WebContents with which this interstitial page is
@@ -86,12 +79,14 @@
   content::InterstitialPage* interstitial_page_;
   // Whether the interstitial should create a view.
   bool create_view_;
-  // For subclasses that don't have their own ChromeControllerClients yet.
-  std::unique_ptr<ChromeControllerClient> controller_;
+  // For subclasses that don't have their own ControllerClients yet.
+  std::unique_ptr<SecurityInterstitialControllerClient> controller_;
 
-  std::unique_ptr<security_interstitials::MetricsHelper> metrics_helper_;
+  std::unique_ptr<MetricsHelper> metrics_helper_;
 
   DISALLOW_COPY_AND_ASSIGN(SecurityInterstitialPage);
 };
 
-#endif  // CHROME_BROWSER_INTERSTITIALS_SECURITY_INTERSTITIAL_PAGE_H_
+}  // security_interstitials
+
+#endif  // COMPONENTS_SECURITY_INTERSTITIALS_CONTENT_SECURITY_INTERSTITIAL_PAGE_H_
diff --git a/components/security_interstitials/core/controller_client.h b/components/security_interstitials/core/controller_client.h
index 8acbf354..33d9cec 100644
--- a/components/security_interstitials/core/controller_client.h
+++ b/components/security_interstitials/core/controller_client.h
@@ -89,9 +89,10 @@
 
   virtual PrefService* GetPrefService() = 0;
 
+  virtual const std::string& GetApplicationLocale() const = 0;
+
  protected:
-  virtual const std::string& GetApplicationLocale() = 0;
-  virtual const std::string GetExtendedReportingPrefName() = 0;
+  virtual const std::string GetExtendedReportingPrefName() const = 0;
 
  private:
   std::unique_ptr<MetricsHelper> metrics_helper_;
diff --git a/components/security_interstitials/core/safe_browsing_error_ui.cc b/components/security_interstitials/core/safe_browsing_error_ui.cc
index 44bd274e..986892c4 100644
--- a/components/security_interstitials/core/safe_browsing_error_ui.cc
+++ b/components/security_interstitials/core/safe_browsing_error_ui.cc
@@ -217,6 +217,10 @@
   }
 }
 
+bool SafeBrowsingErrorUI::CanShowExtendedReportingOption() {
+  return !is_off_the_record() && is_extended_reporting_opt_in_allowed();
+}
+
 void SafeBrowsingErrorUI::PopulateMalwareLoadTimeData(
     base::DictionaryValue* load_time_data) {
   load_time_data->SetBoolean("phishing", false);
@@ -284,10 +288,10 @@
 
 void SafeBrowsingErrorUI::PopulateExtendedReportingOption(
     base::DictionaryValue* load_time_data) {
-  load_time_data->SetBoolean(
-      security_interstitials::kDisplayCheckBox,
-      display_options_.can_show_extended_reporting_option);
-  if (!display_options_.can_show_extended_reporting_option)
+  bool can_show_extended_reporting_option = CanShowExtendedReportingOption();
+  load_time_data->SetBoolean(security_interstitials::kDisplayCheckBox,
+                             can_show_extended_reporting_option);
+  if (!can_show_extended_reporting_option)
     return;
 
   const std::string privacy_link = base::StringPrintf(
diff --git a/components/security_interstitials/core/safe_browsing_error_ui.h b/components/security_interstitials/core/safe_browsing_error_ui.h
index 322edb0..3124ee3b 100644
--- a/components/security_interstitials/core/safe_browsing_error_ui.h
+++ b/components/security_interstitials/core/safe_browsing_error_ui.h
@@ -26,13 +26,15 @@
 
   struct SBErrorDisplayOptions {
     SBErrorDisplayOptions(bool is_main_frame_load_blocked,
-                          bool can_show_extended_reporting_option,
+                          bool is_extended_reporting_opt_in_allowed,
+                          bool is_off_the_record,
                           bool is_extended_reporting_enabled,
                           bool is_scout_reporting_enabled,
                           bool is_proceed_anyway_disabled)
         : is_main_frame_load_blocked(is_main_frame_load_blocked),
-          can_show_extended_reporting_option(
-              can_show_extended_reporting_option),
+          is_extended_reporting_opt_in_allowed(
+              is_extended_reporting_opt_in_allowed),
+          is_off_the_record(is_off_the_record),
           is_extended_reporting_enabled(is_extended_reporting_enabled),
           is_scout_reporting_enabled(is_scout_reporting_enabled),
           is_proceed_anyway_disabled(is_proceed_anyway_disabled) {}
@@ -40,8 +42,11 @@
     // Indicates if this SB interstitial is blocking main frame load.
     bool is_main_frame_load_blocked;
 
-    // Indicates if we can show extended reporting checkbox,
-    bool can_show_extended_reporting_option;
+    // Indicates if user is allowed to opt-in extended reporting preference.
+    bool is_extended_reporting_opt_in_allowed;
+
+    // Indicates if user is in incognito mode.
+    bool is_off_the_record;
 
     // Indicates if user opted in for SB extended reporting.
     bool is_extended_reporting_enabled;
@@ -64,10 +69,36 @@
 
   void PopulateStringsForHTML(base::DictionaryValue* load_time_data);
   void HandleCommand(SecurityInterstitialCommands command);
-  bool is_main_frame_load_blocked() {
+
+  // Checks if we should even show the extended reporting option. We don't show
+  // it in incognito mode or if kSafeBrowsingExtendedReportingOptInAllowed
+  // preference is disabled.
+  bool CanShowExtendedReportingOption();
+
+  bool is_main_frame_load_blocked() const {
     return display_options_.is_main_frame_load_blocked;
   }
 
+  bool is_extended_reporting_opt_in_allowed() const {
+    return display_options_.is_extended_reporting_opt_in_allowed;
+  }
+
+  bool is_off_the_record() const {
+    return display_options_.is_off_the_record;
+  }
+
+  bool is_extended_reporting_enabled() const {
+    return display_options_.is_extended_reporting_enabled;
+  }
+
+  bool is_proceed_anyway_disabled() const {
+    return display_options_.is_proceed_anyway_disabled;
+  }
+
+  const std::string app_locale() const {
+    return app_locale_;
+  }
+
  private:
   // Fills the passed dictionary with the values to be passed to the template
   // when creating the HTML.
diff --git a/components/signin/ios/browser/account_consistency_service_unittest.mm b/components/signin/ios/browser/account_consistency_service_unittest.mm
index de01db8..ba160b6b 100644
--- a/components/signin/ios/browser/account_consistency_service_unittest.mm
+++ b/components/signin/ios/browser/account_consistency_service_unittest.mm
@@ -17,8 +17,8 @@
 #include "components/signin/core/common/signin_pref_names.h"
 #include "components/sync_preferences/testing_pref_service_syncable.h"
 #include "google_apis/gaia/gaia_constants.h"
-#include "ios/web/public/test/test_browser_state.h"
-#include "ios/web/public/test/test_web_state.h"
+#include "ios/web/public/test/fakes/test_browser_state.h"
+#import "ios/web/public/test/fakes/test_web_state.h"
 #include "ios/web/public/test/test_web_thread_bundle.h"
 #include "ios/web/public/web_state/web_state_policy_decider.h"
 #include "testing/gmock/include/gmock/gmock.h"
diff --git a/components/translate/ios/browser/js_translate_manager_unittest.mm b/components/translate/ios/browser/js_translate_manager_unittest.mm
index 0afb96b..838a9f9 100644
--- a/components/translate/ios/browser/js_translate_manager_unittest.mm
+++ b/components/translate/ios/browser/js_translate_manager_unittest.mm
@@ -7,7 +7,7 @@
 #import "base/mac/scoped_nsobject.h"
 #include "base/strings/sys_string_conversions.h"
 #include "grit/components_resources.h"
-#import "ios/web/public/test/crw_test_js_injection_receiver.h"
+#import "ios/web/public/test/fakes/crw_test_js_injection_receiver.h"
 #import "ios/web/public/test/js_test_util.h"
 #import "testing/gtest_mac.h"
 #include "testing/platform_test.h"
diff --git a/components/translate/ios/browser/language_detection_controller_unittest.mm b/components/translate/ios/browser/language_detection_controller_unittest.mm
index 0558225..d40361b 100644
--- a/components/translate/ios/browser/language_detection_controller_unittest.mm
+++ b/components/translate/ios/browser/language_detection_controller_unittest.mm
@@ -10,7 +10,7 @@
 #include "components/prefs/testing_pref_service.h"
 #include "components/translate/core/common/translate_pref_names.h"
 #import "components/translate/ios/browser/js_language_detection_manager.h"
-#include "ios/web/public/test/test_web_state.h"
+#import "ios/web/public/test/fakes/test_web_state.h"
 #include "testing/gtest/include/gtest/gtest.h"
 #include "testing/platform_test.h"
 
diff --git a/components/translate/ios/browser/translate_controller_unittest.mm b/components/translate/ios/browser/translate_controller_unittest.mm
index 6fbbb5f..44e55a3 100644
--- a/components/translate/ios/browser/translate_controller_unittest.mm
+++ b/components/translate/ios/browser/translate_controller_unittest.mm
@@ -8,7 +8,7 @@
 
 #include "base/values.h"
 #import "components/translate/ios/browser/js_translate_manager.h"
-#include "ios/web/public/test/test_web_state.h"
+#import "ios/web/public/test/fakes/test_web_state.h"
 #include "testing/platform_test.h"
 #import "third_party/ocmock/OCMock/OCMock.h"
 #include "url/gurl.h"
diff --git a/content/browser/browser_child_process_host_impl.cc b/content/browser/browser_child_process_host_impl.cc
index 8fbeff6..a0f90e1f 100644
--- a/content/browser/browser_child_process_host_impl.cc
+++ b/content/browser/browser_child_process_host_impl.cc
@@ -477,32 +477,32 @@
   base::StringPiece metrics_name;
   switch (data_.process_type) {
     case PROCESS_TYPE_UTILITY:
-      memory_size = 100 << 10;  // 100 KiB
+      memory_size = 64 << 10;  // 64 KiB
       metrics_name = "UtilityMetrics";
       break;
 
     case PROCESS_TYPE_ZYGOTE:
-      memory_size = 100 << 10;  // 100 KiB
+      memory_size = 64 << 10;  // 64 KiB
       metrics_name = "ZygoteMetrics";
       break;
 
     case PROCESS_TYPE_SANDBOX_HELPER:
-      memory_size = 100 << 10;  // 100 KiB
+      memory_size = 64 << 10;  // 64 KiB
       metrics_name = "SandboxHelperMetrics";
       break;
 
     case PROCESS_TYPE_GPU:
-      memory_size = 100 << 10;  // 100 KiB
+      memory_size = 64 << 10;  // 64 KiB
       metrics_name = "GpuMetrics";
       break;
 
     case PROCESS_TYPE_PPAPI_PLUGIN:
-      memory_size = 100 << 10;  // 100 KiB
+      memory_size = 64 << 10;  // 64 KiB
       metrics_name = "PpapiPluginMetrics";
       break;
 
     case PROCESS_TYPE_PPAPI_BROKER:
-      memory_size = 100 << 10;  // 100 KiB
+      memory_size = 64 << 10;  // 64 KiB
       metrics_name = "PpapiBrokerMetrics";
       break;
 
diff --git a/content/browser/devtools/protocol/service_worker_handler.cc b/content/browser/devtools/protocol/service_worker_handler.cc
index 2c059a6..242d33e 100644
--- a/content/browser/devtools/protocol/service_worker_handler.cc
+++ b/content/browser/devtools/protocol/service_worker_handler.cc
@@ -5,7 +5,6 @@
 #include "content/browser/devtools/protocol/service_worker_handler.h"
 
 #include "base/bind.h"
-#include "base/containers/scoped_ptr_hash_map.h"
 #include "base/strings/string_number_conversions.h"
 #include "base/strings/utf_string_conversions.h"
 #include "content/browser/background_sync/background_sync_context.h"
diff --git a/content/browser/frame_host/navigator_impl.h b/content/browser/frame_host/navigator_impl.h
index a8dd11b..9cf6fc6 100644
--- a/content/browser/frame_host/navigator_impl.h
+++ b/content/browser/frame_host/navigator_impl.h
@@ -7,7 +7,6 @@
 
 #include <memory>
 
-#include "base/containers/scoped_ptr_hash_map.h"
 #include "base/macros.h"
 #include "base/memory/ref_counted.h"
 #include "base/time/time.h"
diff --git a/content/browser/media/media_web_contents_observer.h b/content/browser/media/media_web_contents_observer.h
index 6b845a31..5d6d8d2f 100644
--- a/content/browser/media/media_web_contents_observer.h
+++ b/content/browser/media/media_web_contents_observer.h
@@ -11,7 +11,6 @@
 #include <memory>
 #include <set>
 
-#include "base/containers/scoped_ptr_hash_map.h"
 #include "base/macros.h"
 #include "content/browser/media/session/media_session_controllers_manager.h"
 #include "content/common/content_export.h"
diff --git a/content/browser/renderer_host/offscreen_canvas_compositor_frame_sink.cc b/content/browser/renderer_host/offscreen_canvas_compositor_frame_sink.cc
index 682aecd..5717d03 100644
--- a/content/browser/renderer_host/offscreen_canvas_compositor_frame_sink.cc
+++ b/content/browser/renderer_host/offscreen_canvas_compositor_frame_sink.cc
@@ -7,30 +7,28 @@
 #include "base/memory/ptr_util.h"
 #include "cc/surfaces/surface.h"
 #include "cc/surfaces/surface_manager.h"
+#include "content/browser/renderer_host/offscreen_canvas_compositor_frame_sink_provider_impl.h"
 #include "mojo/public/cpp/bindings/strong_binding.h"
 
 namespace content {
 
-// static
-void OffscreenCanvasCompositorFrameSink::Create(
-    const cc::FrameSinkId& frame_sink_id,
-    cc::SurfaceManager* surface_manager,
-    cc::mojom::MojoCompositorFrameSinkClientPtr client,
-    cc::mojom::MojoCompositorFrameSinkRequest request) {
-  std::unique_ptr<OffscreenCanvasCompositorFrameSink> impl =
-      base::MakeUnique<OffscreenCanvasCompositorFrameSink>(
-          frame_sink_id, surface_manager, std::move(client));
-  OffscreenCanvasCompositorFrameSink* compositor_frame_sink = impl.get();
-  compositor_frame_sink->binding_ =
-      mojo::MakeStrongBinding(std::move(impl), std::move(request));
-}
-
 OffscreenCanvasCompositorFrameSink::OffscreenCanvasCompositorFrameSink(
+    OffscreenCanvasCompositorFrameSinkProviderImpl* provider,
     const cc::FrameSinkId& frame_sink_id,
-    cc::SurfaceManager* surface_manager,
+    cc::mojom::MojoCompositorFrameSinkRequest request,
     cc::mojom::MojoCompositorFrameSinkClientPtr client)
-    : support_(this, surface_manager, frame_sink_id, nullptr, nullptr),
-      client_(std::move(client)) {}
+    : provider_(provider),
+      support_(this,
+               provider->GetSurfaceManager(),
+               frame_sink_id,
+               nullptr,
+               nullptr),
+      client_(std::move(client)),
+      binding_(this, std::move(request)) {
+  binding_.set_connection_error_handler(
+      base::Bind(&OffscreenCanvasCompositorFrameSink::OnClientConnectionLost,
+                 base::Unretained(this)));
+}
 
 OffscreenCanvasCompositorFrameSink::~OffscreenCanvasCompositorFrameSink() {}
 
@@ -94,4 +92,9 @@
     client_->WillDrawSurface();
 }
 
+void OffscreenCanvasCompositorFrameSink::OnClientConnectionLost() {
+  provider_->OnCompositorFrameSinkClientConnectionLost(
+      support_.frame_sink_id());
+}
+
 }  // namespace content
diff --git a/content/browser/renderer_host/offscreen_canvas_compositor_frame_sink.h b/content/browser/renderer_host/offscreen_canvas_compositor_frame_sink.h
index c526e0b63..db19679 100644
--- a/content/browser/renderer_host/offscreen_canvas_compositor_frame_sink.h
+++ b/content/browser/renderer_host/offscreen_canvas_compositor_frame_sink.h
@@ -14,18 +14,16 @@
 
 namespace content {
 
+class OffscreenCanvasCompositorFrameSinkProviderImpl;
+
 class OffscreenCanvasCompositorFrameSink
     : public cc::CompositorFrameSinkSupportClient,
       public cc::mojom::MojoCompositorFrameSink {
  public:
-  static void Create(const cc::FrameSinkId& frame_sink_id,
-                     cc::SurfaceManager* surface_manager,
-                     cc::mojom::MojoCompositorFrameSinkClientPtr client,
-                     cc::mojom::MojoCompositorFrameSinkRequest request);
-
   OffscreenCanvasCompositorFrameSink(
+      OffscreenCanvasCompositorFrameSinkProviderImpl* provider,
       const cc::FrameSinkId& frame_sink_id,
-      cc::SurfaceManager* surface_manager,
+      cc::mojom::MojoCompositorFrameSinkRequest request,
       cc::mojom::MojoCompositorFrameSinkClientPtr client);
 
   ~OffscreenCanvasCompositorFrameSink() override;
@@ -50,10 +48,14 @@
   void WillDrawSurface() override;
 
  private:
+  void OnClientConnectionLost();
+
+  OffscreenCanvasCompositorFrameSinkProviderImpl* const provider_;
+
   cc::CompositorFrameSinkSupport support_;
   cc::mojom::MojoCompositorFrameSinkClientPtr client_;
   cc::ReturnedResourceArray surface_returned_resources_;
-  mojo::StrongBindingPtr<cc::mojom::MojoCompositorFrameSink> binding_;
+  mojo::Binding<cc::mojom::MojoCompositorFrameSink> binding_;
 
   DISALLOW_COPY_AND_ASSIGN(OffscreenCanvasCompositorFrameSink);
 };
diff --git a/content/browser/renderer_host/offscreen_canvas_compositor_frame_sink_provider_impl.cc b/content/browser/renderer_host/offscreen_canvas_compositor_frame_sink_provider_impl.cc
index 5a83aa44..abd15c63 100644
--- a/content/browser/renderer_host/offscreen_canvas_compositor_frame_sink_provider_impl.cc
+++ b/content/browser/renderer_host/offscreen_canvas_compositor_frame_sink_provider_impl.cc
@@ -17,21 +17,29 @@
 OffscreenCanvasCompositorFrameSinkProviderImpl::
     ~OffscreenCanvasCompositorFrameSinkProviderImpl() {}
 
-// static
-void OffscreenCanvasCompositorFrameSinkProviderImpl::Create(
+void OffscreenCanvasCompositorFrameSinkProviderImpl::Add(
     blink::mojom::OffscreenCanvasCompositorFrameSinkProviderRequest request) {
-  mojo::MakeStrongBinding(
-      base::MakeUnique<OffscreenCanvasCompositorFrameSinkProviderImpl>(),
-      std::move(request));
+  bindings_.AddBinding(this, std::move(request));
 }
 
 void OffscreenCanvasCompositorFrameSinkProviderImpl::CreateCompositorFrameSink(
     const cc::FrameSinkId& frame_sink_id,
     cc::mojom::MojoCompositorFrameSinkClientPtr client,
     cc::mojom::MojoCompositorFrameSinkRequest request) {
-  OffscreenCanvasCompositorFrameSink::Create(frame_sink_id, GetSurfaceManager(),
-                                             std::move(client),
-                                             std::move(request));
+  compositor_frame_sinks_[frame_sink_id] =
+      base::MakeUnique<OffscreenCanvasCompositorFrameSink>(
+          this, frame_sink_id, std::move(request), std::move(client));
+}
+
+cc::SurfaceManager*
+OffscreenCanvasCompositorFrameSinkProviderImpl::GetSurfaceManager() {
+  return content::GetSurfaceManager();
+}
+
+void OffscreenCanvasCompositorFrameSinkProviderImpl::
+    OnCompositorFrameSinkClientConnectionLost(
+        const cc::FrameSinkId& frame_sink_id) {
+  compositor_frame_sinks_.erase(frame_sink_id);
 }
 
 }  // namespace content
diff --git a/content/browser/renderer_host/offscreen_canvas_compositor_frame_sink_provider_impl.h b/content/browser/renderer_host/offscreen_canvas_compositor_frame_sink_provider_impl.h
index 2a6bceb3..d36c1ae 100644
--- a/content/browser/renderer_host/offscreen_canvas_compositor_frame_sink_provider_impl.h
+++ b/content/browser/renderer_host/offscreen_canvas_compositor_frame_sink_provider_impl.h
@@ -5,17 +5,22 @@
 #ifndef CONTENT_BROWSER_RENDERER_HOST_OFFSCREEN_CANVAS_COMPOSITOR_FRAME_SINK_PROVIDER_IMPL_H_
 #define CONTENT_BROWSER_RENDERER_HOST_OFFSCREEN_CANVAS_COMPOSITOR_FRAME_SINK_PROVIDER_IMPL_H_
 
+#include <unordered_map>
+
+#include "content/browser/renderer_host/offscreen_canvas_compositor_frame_sink.h"
+#include "mojo/public/cpp/bindings/binding_set.h"
 #include "third_party/WebKit/public/platform/modules/offscreencanvas/offscreen_canvas_surface.mojom.h"
 
 namespace content {
 
+// TODO(fsamuel): This should be replaced with the DisplayCompositor interface.
 class OffscreenCanvasCompositorFrameSinkProviderImpl
     : public blink::mojom::OffscreenCanvasCompositorFrameSinkProvider {
  public:
   OffscreenCanvasCompositorFrameSinkProviderImpl();
   ~OffscreenCanvasCompositorFrameSinkProviderImpl() override;
 
-  static void Create(
+  void Add(
       blink::mojom::OffscreenCanvasCompositorFrameSinkProviderRequest request);
 
   // blink::mojom::OffscreenCanvasCompositorFrameSinkProvider implementation.
@@ -24,7 +29,20 @@
       cc::mojom::MojoCompositorFrameSinkClientPtr client,
       cc::mojom::MojoCompositorFrameSinkRequest request) override;
 
+  cc::SurfaceManager* GetSurfaceManager();
+
+  void OnCompositorFrameSinkClientConnectionLost(
+      const cc::FrameSinkId& frame_sink_id);
+
  private:
+  std::unordered_map<cc::FrameSinkId,
+                     std::unique_ptr<OffscreenCanvasCompositorFrameSink>,
+                     cc::FrameSinkIdHash>
+      compositor_frame_sinks_;
+
+  mojo::BindingSet<blink::mojom::OffscreenCanvasCompositorFrameSinkProvider>
+      bindings_;
+
   DISALLOW_COPY_AND_ASSIGN(OffscreenCanvasCompositorFrameSinkProviderImpl);
 };
 
diff --git a/content/browser/renderer_host/render_process_host_impl.cc b/content/browser/renderer_host/render_process_host_impl.cc
index 3ffe3267..a46af2a 100644
--- a/content/browser/renderer_host/render_process_host_impl.cc
+++ b/content/browser/renderer_host/render_process_host_impl.cc
@@ -1218,7 +1218,10 @@
 
   AddUIThreadInterface(
       registry.get(),
-      base::Bind(&OffscreenCanvasCompositorFrameSinkProviderImpl::Create));
+      base::Bind(&RenderProcessHostImpl::
+                     CreateOffscreenCanvasCompositorFrameSinkProvider,
+                 base::Unretained(this)));
+
   AddUIThreadInterface(registry.get(),
                        base::Bind(&OffscreenCanvasSurfaceFactoryImpl::Create));
   AddUIThreadInterface(
@@ -1341,6 +1344,16 @@
   gpu_client_->Add(std::move(request));
 }
 
+void RenderProcessHostImpl::CreateOffscreenCanvasCompositorFrameSinkProvider(
+    blink::mojom::OffscreenCanvasCompositorFrameSinkProviderRequest request) {
+  DCHECK_CURRENTLY_ON(BrowserThread::UI);
+  if (!offscreen_canvas_provider_) {
+    offscreen_canvas_provider_.reset(
+        new OffscreenCanvasCompositorFrameSinkProviderImpl());
+  }
+  offscreen_canvas_provider_->Add(std::move(request));
+}
+
 void RenderProcessHostImpl::CreateStoragePartitionService(
     mojo::InterfaceRequest<mojom::StoragePartitionService> request) {
   // DO NOT REMOVE THIS COMMAND LINE CHECK WITHOUT SECURITY REVIEW!
@@ -2603,7 +2616,10 @@
   // method will get called a second time meaning that a metrics-allocator
   // already exists. Don't recreate it.
   if (!metrics_allocator_) {
-    // TODO(bcwhite): Update this with the correct memory size.
+    // Create persistent/shared memory and allow histograms to be stored in
+    // it. Memory that is not actualy used won't be physically mapped by the
+    // system. RendererMetrics usage, as reported in UMA, peaked around 0.7MiB
+    // as of 2016-12-20.
     std::unique_ptr<base::SharedMemory> shm(new base::SharedMemory());
     if (!shm->CreateAndMapAnonymous(2 << 20))  // 2 MiB
       return;
diff --git a/content/browser/renderer_host/render_process_host_impl.h b/content/browser/renderer_host/render_process_host_impl.h
index 46e67e1..0452363 100644
--- a/content/browser/renderer_host/render_process_host_impl.h
+++ b/content/browser/renderer_host/render_process_host_impl.h
@@ -22,6 +22,7 @@
 #include "build/build_config.h"
 #include "content/browser/child_process_launcher.h"
 #include "content/browser/dom_storage/session_storage_namespace_impl.h"
+#include "content/browser/renderer_host/offscreen_canvas_compositor_frame_sink_provider_impl.h"
 #include "content/browser/webrtc/webrtc_eventlog_host.h"
 #include "content/common/associated_interfaces.mojom.h"
 #include "content/common/content_export.h"
@@ -330,6 +331,8 @@
       mojom::AssociatedInterfaceAssociatedRequest request) override;
 
   void CreateMusGpuRequest(ui::mojom::GpuRequest request);
+  void CreateOffscreenCanvasCompositorFrameSinkProvider(
+      blink::mojom::OffscreenCanvasCompositorFrameSinkProviderRequest request);
   void CreateStoragePartitionService(
       mojo::InterfaceRequest<mojom::StoragePartitionService> request);
 
@@ -579,6 +582,9 @@
   scoped_refptr<ResourceMessageFilter> resource_message_filter_;
   std::unique_ptr<GpuClient, BrowserThread::DeleteOnIOThread> gpu_client_;
 
+  std::unique_ptr<OffscreenCanvasCompositorFrameSinkProviderImpl>
+      offscreen_canvas_provider_;
+
   mojom::RouteProviderAssociatedPtr remote_route_provider_;
   mojom::RendererAssociatedPtr renderer_interface_;
 
diff --git a/content/browser/renderer_host/render_view_host_impl.cc b/content/browser/renderer_host/render_view_host_impl.cc
index 243ad26..c71f07aa 100644
--- a/content/browser/renderer_host/render_view_host_impl.cc
+++ b/content/browser/renderer_host/render_view_host_impl.cc
@@ -773,7 +773,6 @@
                         OnRouteCloseEvent)
     IPC_MESSAGE_HANDLER(ViewHostMsg_TakeFocus, OnTakeFocus)
     IPC_MESSAGE_HANDLER(ViewHostMsg_ClosePage_ACK, OnClosePageACK)
-    IPC_MESSAGE_HANDLER(ViewHostMsg_DidZoomURL, OnDidZoomURL)
     IPC_MESSAGE_HANDLER(ViewHostMsg_Focus, OnFocus)
     IPC_MESSAGE_UNHANDLED(handled = false)
   IPC_END_MESSAGE_MAP()
@@ -981,10 +980,6 @@
   return delegate_ && delegate_->IsFocusedElementEditable();
 }
 
-void RenderViewHostImpl::Zoom(PageZoom zoom) {
-  Send(new ViewMsg_Zoom(GetRoutingID(), zoom));
-}
-
 void RenderViewHostImpl::DisableScrollbarsForThreshold(const gfx::Size& size) {
   Send(new ViewMsg_DisableScrollbarsForSmallWindows(GetRoutingID(), size));
 }
@@ -1020,17 +1015,6 @@
   Send(new ViewMsg_MoveOrResizeStarted(GetRoutingID()));
 }
 
-void RenderViewHostImpl::OnDidZoomURL(double zoom_level,
-                                      const GURL& url) {
-  HostZoomMapImpl* host_zoom_map =
-      static_cast<HostZoomMapImpl*>(HostZoomMap::Get(GetSiteInstance()));
-
-  host_zoom_map->SetZoomLevelForView(GetProcess()->GetID(),
-                                     GetRoutingID(),
-                                     zoom_level,
-                                     net::GetHostOrSpecFromURL(url));
-}
-
 void RenderViewHostImpl::SelectWordAroundCaret() {
   Send(new ViewMsg_SelectWordAroundCaret(GetRoutingID()));
 }
diff --git a/content/browser/renderer_host/render_view_host_impl.h b/content/browser/renderer_host/render_view_host_impl.h
index f56e1742..0f9a0c8d 100644
--- a/content/browser/renderer_host/render_view_host_impl.h
+++ b/content/browser/renderer_host/render_view_host_impl.h
@@ -116,7 +116,6 @@
   void NotifyMoveOrResizeStarted() override;
   void SetWebUIProperty(const std::string& name,
                         const std::string& value) override;
-  void Zoom(PageZoom zoom) override;
   void SyncRendererPrefs() override;
   WebPreferences GetWebkitPreferences() override;
   void UpdateWebkitPreferences(const WebPreferences& prefs) override;
diff --git a/content/browser/service_worker/service_worker_version.h b/content/browser/service_worker/service_worker_version.h
index 2532135..1c72ae8 100644
--- a/content/browser/service_worker/service_worker_version.h
+++ b/content/browser/service_worker/service_worker_version.h
@@ -17,7 +17,6 @@
 #include <vector>
 
 #include "base/callback.h"
-#include "base/containers/scoped_ptr_hash_map.h"
 #include "base/gtest_prod_util.h"
 #include "base/id_map.h"
 #include "base/macros.h"
diff --git a/content/browser/web_contents/web_contents_impl.h b/content/browser/web_contents/web_contents_impl.h
index e333f7c9..62b3ca6 100644
--- a/content/browser/web_contents/web_contents_impl.h
+++ b/content/browser/web_contents/web_contents_impl.h
@@ -14,7 +14,6 @@
 #include <string>
 
 #include "base/compiler_specific.h"
-#include "base/containers/scoped_ptr_hash_map.h"
 #include "base/gtest_prod_util.h"
 #include "base/macros.h"
 #include "base/observer_list.h"
diff --git a/content/browser/websockets/websocket_manager.cc b/content/browser/websockets/websocket_manager.cc
index 6984564f..4d0e743c 100644
--- a/content/browser/websockets/websocket_manager.cc
+++ b/content/browser/websockets/websocket_manager.cc
@@ -15,6 +15,7 @@
 #include "content/public/browser/browser_thread.h"
 #include "content/public/browser/render_process_host.h"
 #include "content/public/browser/render_process_host_observer.h"
+#include "content/public/browser/storage_partition.h"
 #include "services/service_manager/public/cpp/interface_registry.h"
 
 namespace content {
@@ -43,6 +44,7 @@
   // The network stack could be shutdown after this notification, so be sure to
   // stop using it before then.
   void RenderProcessHostDestroyed(RenderProcessHost* host) override {
+    DCHECK(BrowserThread::CurrentlyOn(BrowserThread::UI));
     BrowserThread::DeleteSoon(BrowserThread::IO, FROM_HERE, manager_);
     manager_ = nullptr;
   }
@@ -91,11 +93,28 @@
       num_current_succeeded_connections_(0),
       num_previous_succeeded_connections_(0),
       num_current_failed_connections_(0),
-      num_previous_failed_connections_(0) {}
+      num_previous_failed_connections_(0),
+      context_destroyed_(false) {
+  if (storage_partition_) {
+    url_request_context_getter_ = storage_partition_->GetURLRequestContext();
+    // This unretained pointer is safe because we destruct a WebSocketManager
+    // only via WebSocketManager::Handle::RenderProcessHostDestroyed which
+    // posts a deletion task to the IO thread.
+    BrowserThread::PostTask(
+        BrowserThread::IO,
+        FROM_HERE,
+        base::Bind(
+            &WebSocketManager::ObserveURLRequestContextGetter,
+            base::Unretained(this)));
+  }
+}
 
 WebSocketManager::~WebSocketManager() {
   DCHECK(BrowserThread::CurrentlyOn(BrowserThread::IO));
 
+  if (!context_destroyed_ && url_request_context_getter_)
+    url_request_context_getter_->RemoveObserver(this);
+
   for (auto impl : impls_) {
     impl->GoAway();
     delete impl;
@@ -114,6 +133,12 @@
         "Error in connection establishment: net::ERR_INSUFFICIENT_RESOURCES");
     return;
   }
+  if (context_destroyed_) {
+    request.ResetWithReason(
+        blink::mojom::WebSocket::kInsufficientResources,
+        "Error in connection establishment: net::ERR_UNEXPECTED");
+    return;
+  }
 
   // Keep all WebSocketImpls alive until either the client drops its
   // connection (see OnLostConnectionToClient) or we need to shutdown.
@@ -197,4 +222,24 @@
   delete impl;
 }
 
+void WebSocketManager::OnContextShuttingDown() {
+  context_destroyed_ = true;
+  url_request_context_getter_ = nullptr;
+  for (const auto& impl : impls_) {
+    impl->GoAway();
+    delete impl;
+  }
+  impls_.clear();
+}
+
+void WebSocketManager::ObserveURLRequestContextGetter() {
+  DCHECK(BrowserThread::CurrentlyOn(BrowserThread::IO));
+  if (!url_request_context_getter_->GetURLRequestContext()) {
+    context_destroyed_ = true;
+    url_request_context_getter_ = nullptr;
+    return;
+  }
+  url_request_context_getter_->AddObserver(this);
+}
+
 }  // namespace content
diff --git a/content/browser/websockets/websocket_manager.h b/content/browser/websockets/websocket_manager.h
index 20132ded..8f1b9c9 100644
--- a/content/browser/websockets/websocket_manager.h
+++ b/content/browser/websockets/websocket_manager.h
@@ -9,9 +9,12 @@
 
 #include "base/compiler_specific.h"
 #include "base/macros.h"
+#include "base/memory/ref_counted.h"
 #include "base/timer/timer.h"
 #include "content/browser/websockets/websocket_impl.h"
 #include "content/common/content_export.h"
+#include "net/url_request/url_request_context_getter.h"
+#include "net/url_request/url_request_context_getter_observer.h"
 
 namespace content {
 class StoragePartition;
@@ -21,12 +24,16 @@
 // WebSocketImpl objects for each WebSocketRequest and throttling the number of
 // WebSocketImpl objects in use.
 class CONTENT_EXPORT WebSocketManager
-    : NON_EXPORTED_BASE(public WebSocketImpl::Delegate) {
+    : NON_EXPORTED_BASE(public WebSocketImpl::Delegate),
+      NON_EXPORTED_BASE(public net::URLRequestContextGetterObserver) {
  public:
   // Called on the UI thread:
   static void CreateWebSocket(int process_id, int frame_id,
                               blink::mojom::WebSocketRequest request);
 
+  // net::URLRequestContextGetterObserver implementation.
+  void OnContextShuttingDown() override;
+
  protected:
   class Handle;
   friend class base::DeleteHelper<WebSocketManager>;
@@ -55,8 +62,11 @@
   void OnReceivedResponseFromServer(WebSocketImpl* impl) override;
   void OnLostConnectionToClient(WebSocketImpl* impl) override;
 
+  void ObserveURLRequestContextGetter();
+
   int process_id_;
   StoragePartition* storage_partition_;
+  scoped_refptr<net::URLRequestContextGetter> url_request_context_getter_;
 
   std::set<WebSocketImpl*> impls_;
 
@@ -76,6 +86,8 @@
   int64_t num_current_failed_connections_;
   int64_t num_previous_failed_connections_;
 
+  bool context_destroyed_;
+
   DISALLOW_COPY_AND_ASSIGN(WebSocketManager);
 };
 
diff --git a/content/child/blink_platform_impl.h b/content/child/blink_platform_impl.h
index a4553fb..1716e22 100644
--- a/content/child/blink_platform_impl.h
+++ b/content/child/blink_platform_impl.h
@@ -9,7 +9,6 @@
 #include <stdint.h>
 
 #include "base/compiler_specific.h"
-#include "base/containers/scoped_ptr_hash_map.h"
 #include "base/threading/thread_local_storage.h"
 #include "base/timer/timer.h"
 #include "base/trace_event/trace_event.h"
diff --git a/content/common/view_messages.h b/content/common/view_messages.h
index 9c7c90ab..49250fbd 100644
--- a/content/common/view_messages.h
+++ b/content/common/view_messages.h
@@ -449,12 +449,6 @@
 // Sets the page scale for the current main frame to the given page scale.
 IPC_MESSAGE_ROUTED1(ViewMsg_SetPageScale, float /* page_scale_factor */)
 
-// Change the zoom level for the current main frame.  If the level actually
-// changes, a ViewHostMsg_DidZoomURL message will be sent back to the browser
-// telling it what url got zoomed and what its current zoom level is.
-IPC_MESSAGE_ROUTED1(ViewMsg_Zoom,
-                    content::PageZoom /* function */)
-
 // Used to tell a render view whether it should expose various bindings
 // that allow JS content extended privileges.  See BindingsPolicy for valid
 // flag values.
@@ -791,14 +785,6 @@
 IPC_MESSAGE_ROUTED1(ViewHostMsg_TextInputStateChanged,
                     content::TextInputState /* text_input_state */)
 
-// Sent when the renderer changes the zoom level for a particular url, so the
-// browser can update its records.  If the view is a plugin doc, then url is
-// used to update the zoom level for all pages in that site.  Otherwise, the
-// render view's id is used so that only the menu is updated.
-IPC_MESSAGE_ROUTED2(ViewHostMsg_DidZoomURL,
-                    double /* zoom_level */,
-                    GURL /* url */)
-
 // Sent when the renderer changes its page scale factor.
 IPC_MESSAGE_ROUTED1(ViewHostMsg_PageScaleFactorChanged,
                     float /* page_scale_factor */)
diff --git a/content/content_resources.grd b/content/content_resources.grd
index 39cbab2..728953d 100644
--- a/content/content_resources.grd
+++ b/content/content_resources.grd
@@ -53,7 +53,6 @@
         <include name="IDR_MOJO_BINDINGS_JS" file="../mojo/public/js/bindings.js" flattenhtml="true" type="BINDATA" />
         <include name="IDR_MOJO_BUFFER_JS" file="../mojo/public/js/buffer.js" flattenhtml="true" type="BINDATA" />
         <include name="IDR_MOJO_CODEC_JS" file="../mojo/public/js/codec.js" flattenhtml="true" type="BINDATA" />
-        <include name="IDR_MOJO_CONNECTION_JS" file="../mojo/public/js/connection.js" flattenhtml="true" type="BINDATA" />
         <include name="IDR_MOJO_CONNECTOR_JS" file="../mojo/public/js/connector.js" flattenhtml="true" type="BINDATA" />
         <include name="IDR_MOJO_INTERFACE_TYPES_JS" file="../mojo/public/js/interface_types.js" flattenhtml="true" type="BINDATA" />
         <include name="IDR_MOJO_ROUTER_JS" file="../mojo/public/js/router.js" flattenhtml="true" type="BINDATA" />
diff --git a/content/public/browser/render_view_host.h b/content/public/browser/render_view_host.h
index 5976eec..faa7ad0 100644
--- a/content/public/browser/render_view_host.h
+++ b/content/public/browser/render_view_host.h
@@ -147,9 +147,6 @@
   virtual void SetWebUIProperty(const std::string& name,
                                 const std::string& value) = 0;
 
-  // Changes the zoom level for the current main frame.
-  virtual void Zoom(PageZoom zoom) = 0;
-
   // Send the renderer process the current preferences supplied by the
   // RenderViewHostDelegate.
   virtual void SyncRendererPrefs() = 0;
diff --git a/content/renderer/mojo_context_state.cc b/content/renderer/mojo_context_state.cc
index 1a7f1b26..d9fa8d6b 100644
--- a/content/renderer/mojo_context_state.cc
+++ b/content/renderer/mojo_context_state.cc
@@ -64,7 +64,6 @@
     { mojo::kBindingsModuleName, IDR_MOJO_BINDINGS_JS },
     { mojo::kBufferModuleName, IDR_MOJO_BUFFER_JS },
     { mojo::kCodecModuleName, IDR_MOJO_CODEC_JS },
-    { mojo::kConnectionModuleName, IDR_MOJO_CONNECTION_JS },
     { mojo::kConnectorModuleName, IDR_MOJO_CONNECTOR_JS },
     { mojo::kInterfaceTypesModuleName, IDR_MOJO_INTERFACE_TYPES_JS },
     { mojo::kRouterModuleName, IDR_MOJO_ROUTER_JS },
diff --git a/content/renderer/render_view_impl.cc b/content/renderer/render_view_impl.cc
index 3dadf811..06b29cba 100644
--- a/content/renderer/render_view_impl.cc
+++ b/content/renderer/render_view_impl.cc
@@ -1211,7 +1211,6 @@
     IPC_MESSAGE_HANDLER(InputMsg_ScrollFocusedEditableNodeIntoRect,
                         OnScrollFocusedEditableNodeIntoRect)
     IPC_MESSAGE_HANDLER(ViewMsg_SetPageScale, OnSetPageScale)
-    IPC_MESSAGE_HANDLER(ViewMsg_Zoom, OnZoom)
     IPC_MESSAGE_HANDLER(ViewMsg_AllowBindings, OnAllowBindings)
     IPC_MESSAGE_HANDLER(ViewMsg_SetInitialFocus, OnSetInitialFocus)
     IPC_MESSAGE_HANDLER(ViewMsg_UpdateTargetURL_ACK, OnUpdateTargetURLAck)
@@ -2066,36 +2065,6 @@
   webview()->setPageScaleFactor(page_scale_factor);
 }
 
-void RenderViewImpl::OnZoom(PageZoom zoom) {
-  if (!webview())  // Not sure if this can happen, but no harm in being safe.
-    return;
-
-  webview()->hidePopups();
-
-  double old_zoom_level = webview()->zoomLevel();
-  double zoom_level;
-  if (zoom == PAGE_ZOOM_RESET) {
-    zoom_level = 0;
-  } else if (static_cast<int>(old_zoom_level) == old_zoom_level) {
-    // Previous zoom level is a whole number, so just increment/decrement.
-    zoom_level = old_zoom_level + zoom;
-  } else {
-    // Either the user hit the zoom factor limit and thus the zoom level is now
-    // not a whole number, or a plugin changed it to a custom value.  We want
-    // to go to the next whole number so that the user can always get back to
-    // 100% with the keyboard/menu.
-    if ((old_zoom_level > 1 && zoom > 0) ||
-        (old_zoom_level < 1 && zoom < 0)) {
-      zoom_level = static_cast<int>(old_zoom_level + zoom);
-    } else {
-      // We're going towards 100%, so first go to the next whole number.
-      zoom_level = static_cast<int>(old_zoom_level);
-    }
-  }
-  SetZoomLevel(zoom_level);
-  zoomLevelChanged();
-}
-
 void RenderViewImpl::OnSetZoomLevel(
     PageMsg_SetZoomLevel_Command command,
     double zoom_level) {
@@ -2456,20 +2425,6 @@
                                         maximum_percent));
 }
 
-void RenderViewImpl::zoomLevelChanged() {
-  double zoom_level = webview()->zoomLevel();
-
-  // Do not send empty URLs to the browser when we are just setting the default
-  // zoom level (from RendererPreferences) before the first navigation.
-  if (!webview()->mainFrame()->document().url().isEmpty()) {
-    // Tell the browser which url got zoomed so it can update the menu and the
-    // saved values if necessary
-    Send(new ViewHostMsg_DidZoomURL(
-        GetRoutingID(), zoom_level,
-        GURL(webview()->mainFrame()->document().url())));
-  }
-}
-
 void RenderViewImpl::pageScaleFactorChanged() {
   if (!webview())
     return;
diff --git a/content/renderer/render_view_impl.h b/content/renderer/render_view_impl.h
index e1e606a..bc031e8e 100644
--- a/content/renderer/render_view_impl.h
+++ b/content/renderer/render_view_impl.h
@@ -199,8 +199,7 @@
   void FrameDidStartLoading(blink::WebFrame* frame);
   void FrameDidStopLoading(blink::WebFrame* frame);
 
-  // Sets the zoom level and notifies observers. Doesn't call zoomLevelChanged,
-  // as that is only for changes that aren't initiated by the client.
+  // Sets the zoom level and notifies observers.
   void SetZoomLevel(double zoom_level);
 
   double page_zoom_level() {
@@ -343,7 +342,6 @@
   int historyForwardListCount() override;
   blink::WebSpeechRecognizer* speechRecognizer() override;
   void zoomLimitsChanged(double minimum_level, double maximum_level) override;
-  virtual void zoomLevelChanged();
   void pageScaleFactorChanged() override;
   virtual double zoomLevelToZoomFactor(double zoom_level) const;
   virtual double zoomFactorToZoomLevel(double factor) const;
@@ -565,7 +563,6 @@
   void OnUpdateTargetURLAck();
   void OnUpdateWebPreferences(const WebPreferences& prefs);
   void OnSetPageScale(float page_scale_factor);
-  void OnZoom(PageZoom zoom);
   void OnForceRedraw(const ui::LatencyInfo& latency_info);
   void OnSelectWordAroundCaret();
   void OnAudioStateChanged(bool is_audio_playing);
diff --git a/content/test/data/gpu/pixel_offscreenCanvas_2d_commit_main.html b/content/test/data/gpu/pixel_offscreenCanvas_2d_commit_main.html
index 4cc702cb..ecdc4ff 100644
--- a/content/test/data/gpu/pixel_offscreenCanvas_2d_commit_main.html
+++ b/content/test/data/gpu/pixel_offscreenCanvas_2d_commit_main.html
@@ -14,29 +14,49 @@
   margin: 0px auto;
 }
 </style>
+</head>
+<body onload="main()">
+<div style="position:relative; width:300px; height:300px; background-color:white">
+</div>
+<div id="container" style="position:absolute; top:0px; left:0px">
+<canvas id="c" width="200" height="200" class="nomargin"></canvas>
+</div>
 <script>
 var g_swapsBeforeAck = 15;
 
 function main()
 {
-  draw();
-  waitForFinish();
+  drawLoop();
 }
 
-function draw()
+var g_animationFrameNumber = 0;
+var canvas = document.getElementById("c");
+var offscreenCanvas = canvas.transferControlToOffscreen();
+var offscreen2d = offscreenCanvas.getContext("2d");
+
+function drawLoop()
 {
-  var canvas = document.getElementById("c");
-  var offscreenCanvas = canvas.transferControlToOffscreen();
-  var offscreen2d = offscreenCanvas.getContext("2d");
-  offscreen2d.fillStyle = "red";
-  offscreen2d.fillRect(0, 0, 100, 100);
-  offscreen2d.fillStyle = "green";
-  offscreen2d.fillRect(100, 0, 100, 100);
-  offscreen2d.fillStyle = "blue";
-  offscreen2d.fillRect(0, 100, 100, 100);
-  offscreen2d.fillStyle = "black";
-  offscreen2d.fillRect(100, 100, 100, 100);
-  offscreen2d.commit();
+  if (g_animationFrameNumber < 3) {
+    offscreen2d.fillStyle = "red";
+    offscreen2d.fillRect(0, 0, 200, 200);
+    g_animationFrameNumber++;
+    offscreen2d.commit().then(drawLoop);
+  } else {
+    offscreen2d.fillStyle = "red";
+    offscreen2d.fillRect(0, 0, 100, 100);
+    offscreen2d.fillStyle = "green";
+    offscreen2d.fillRect(100, 0, 100, 100);
+    offscreen2d.fillStyle = "blue";
+    offscreen2d.fillRect(0, 100, 100, 100);
+    offscreen2d.fillStyle = "black";
+    offscreen2d.fillRect(100, 100, 100, 100);
+    offscreen2d.commit();
+
+    // The following fill is never committed
+    offscreen2d.fillStyle = "blue";
+    offscreen2d.fillRect(0, 0, 200, 200);
+    waitForFinish();
+  }
 }
 
 function waitForFinish()
@@ -47,16 +67,9 @@
   } else {
     g_swapsBeforeAck--;
     document.getElementById('container').style.zIndex = g_swapsBeforeAck + 1;
-    window.webkitRequestAnimationFrame(waitForFinish);
+    window.requestAnimationFrame(waitForFinish);
   }
 }
 </script>
-</head>
-<body onload="main()">
-<div style="position:relative; width:300px; height:300px; background-color:white">
-</div>
-<div id="container" style="position:absolute; top:0px; left:0px">
-<canvas id="c" width="200" height="200" class="nomargin"></canvas>
-</div>
 </body>
 </html>
diff --git a/content/test/data/gpu/pixel_offscreenCanvas_2d_commit_worker.html b/content/test/data/gpu/pixel_offscreenCanvas_2d_commit_worker.html
index 27c76fa51..0668fff 100644
--- a/content/test/data/gpu/pixel_offscreenCanvas_2d_commit_worker.html
+++ b/content/test/data/gpu/pixel_offscreenCanvas_2d_commit_worker.html
@@ -15,20 +15,40 @@
 }
 </style>
 <script id="myWorker" type="text/worker">
+
+var g_offscreen2d;
+var g_animationFrameNumber = 0;
+
 self.onmessage = function(e) {
-    var transferredCanvas = e.data;
-    var offscreen2d = transferredCanvas.getContext("2d");
-    offscreen2d.fillStyle = "red";
-    offscreen2d.fillRect(0, 0, 100, 100);
-    offscreen2d.fillStyle = "green";
-    offscreen2d.fillRect(100, 0, 100, 100);
-    offscreen2d.fillStyle = "blue";
-    offscreen2d.fillRect(0, 100, 100, 100);
-    offscreen2d.fillStyle = "black";
-    offscreen2d.fillRect(100, 100, 100, 100);
-    offscreen2d.commit();
+  var transferredCanvas = e.data;
+  g_offscreen2d = transferredCanvas.getContext("2d");
+  drawLoop();
+}  
+
+function drawLoop()
+{
+  if (g_animationFrameNumber < 3) {
+    g_offscreen2d.fillStyle = "red";
+    g_offscreen2d.fillRect(0, 0, 200, 200);
+    g_animationFrameNumber++;
+    g_offscreen2d.commit().then(drawLoop);
+  } else {
+    g_offscreen2d.fillStyle = "red";
+    g_offscreen2d.fillRect(0, 0, 100, 100);
+    g_offscreen2d.fillStyle = "green";
+    g_offscreen2d.fillRect(100, 0, 100, 100);
+    g_offscreen2d.fillStyle = "blue";
+    g_offscreen2d.fillRect(0, 100, 100, 100);
+    g_offscreen2d.fillStyle = "black";
+    g_offscreen2d.fillRect(100, 100, 100, 100);
+    g_offscreen2d.commit()
+
+    // The following fill is never committed
+    g_offscreen2d.fillStyle = "blue";
+    g_offscreen2d.fillRect(0, 0, 200, 200);    
     self.postMessage("");
-};
+  }
+}
 </script>
 <script>
 var g_swapsBeforeAck = 15;
@@ -47,7 +67,7 @@
   } else {
     g_swapsBeforeAck--;
     document.getElementById('container').style.zIndex = g_swapsBeforeAck + 1;
-    window.webkitRequestAnimationFrame(waitForFinish);
+    window.requestAnimationFrame(waitForFinish);
   }
 }
 
diff --git a/content/test/data/gpu/pixel_offscreenCanvas_transferToImageBitmap_main.html b/content/test/data/gpu/pixel_offscreenCanvas_transferToImageBitmap_main.html
index 2752feea..e4d9f63 100644
--- a/content/test/data/gpu/pixel_offscreenCanvas_transferToImageBitmap_main.html
+++ b/content/test/data/gpu/pixel_offscreenCanvas_transferToImageBitmap_main.html
@@ -53,7 +53,7 @@
   } else {
     g_swapsBeforeAck--;
     document.getElementById('container').style.zIndex = g_swapsBeforeAck + 1;
-    window.webkitRequestAnimationFrame(waitForFinish);
+    window.requestAnimationFrame(waitForFinish);
   }
 }
 </script>
diff --git a/content/test/data/gpu/pixel_offscreenCanvas_transferToImageBitmap_worker.html b/content/test/data/gpu/pixel_offscreenCanvas_transferToImageBitmap_worker.html
index 158818c8..828b73f 100644
--- a/content/test/data/gpu/pixel_offscreenCanvas_transferToImageBitmap_worker.html
+++ b/content/test/data/gpu/pixel_offscreenCanvas_transferToImageBitmap_worker.html
@@ -72,7 +72,7 @@
   } else {
     g_swapsBeforeAck--;
     document.getElementById('container').style.zIndex = g_swapsBeforeAck + 1;
-    window.webkitRequestAnimationFrame(waitForFinish);
+    window.requestAnimationFrame(waitForFinish);
   }
 }
 </script>
diff --git a/content/test/data/gpu/pixel_offscreenCanvas_webgl_commit_main.html b/content/test/data/gpu/pixel_offscreenCanvas_webgl_commit_main.html
index e879bde..95bf093e 100644
--- a/content/test/data/gpu/pixel_offscreenCanvas_webgl_commit_main.html
+++ b/content/test/data/gpu/pixel_offscreenCanvas_webgl_commit_main.html
@@ -16,16 +16,19 @@
 </style>
 <script>
 var g_swapsBeforeAck = 15;
+var g_frameNumber = 0;
+var gl;
 
 function main()
 {
-  draw();
-  waitForFinish();
+  var canvas = document.getElementById("c");
+  var offscreenCanvas = canvas.transferControlToOffscreen();
+  gl = offscreenCanvas.getContext("webgl");
+  drawLoop();
 }
 
-function drawTriangle(canvas)
+function drawTriangle()
 {
-  var gl = canvas.getContext("webgl");
   gl.clearColor(0, 1, 0, 1);
   gl.clear(gl.COLOR_BUFFER_BIT);
 
@@ -64,15 +67,25 @@
   gl.vertexAttribPointer(attr, 2, gl.FLOAT, false, 0, 0);
 
   gl.drawArrays(gl.TRIANGLE_STRIP, 0, 3);
-
-  gl.commit();
 }
 
-function draw()
+function drawLoop()
 {
-  var canvas = document.getElementById("c");
-  var offscreenCanvas = canvas.transferControlToOffscreen();
-  drawTriangle(offscreenCanvas);
+  if (g_frameNumber < 3) {
+    gl.clearColor(1, 0, 0, 1);
+    gl.clear(gl.COLOR_BUFFER_BIT);
+    g_frameNumber++;
+    gl.commit().then(drawLoop);
+  } else {
+    drawTriangle();
+    gl.commit();
+
+    // The following clear is never committed
+    gl.clearColor(0, 0, 1, 1);
+    gl.clear(gl.COLOR_BUFFER_BIT);
+
+    waitForFinish();
+  }
 }
 
 function waitForFinish()
@@ -83,7 +96,7 @@
   } else {
     g_swapsBeforeAck--;
     document.getElementById('container').style.zIndex = g_swapsBeforeAck + 1;
-    window.webkitRequestAnimationFrame(waitForFinish);
+    window.requestAnimationFrame(waitForFinish);
   }
 }
 </script>
diff --git a/content/test/data/gpu/pixel_offscreenCanvas_webgl_commit_worker.html b/content/test/data/gpu/pixel_offscreenCanvas_webgl_commit_worker.html
index 77cb4c93..fb19d6c 100644
--- a/content/test/data/gpu/pixel_offscreenCanvas_webgl_commit_worker.html
+++ b/content/test/data/gpu/pixel_offscreenCanvas_webgl_commit_worker.html
@@ -15,9 +15,12 @@
 }
 </style>
 <script id="myWorker" type="text/worker">
-function drawTriangle(canvas)
+
+var g_frameNumber = 0;
+var gl;
+
+function drawTriangle()
 {
-  var gl = canvas.getContext("webgl");
   gl.clearColor(0, 1, 0, 1);
   gl.clear(gl.COLOR_BUFFER_BIT);
 
@@ -56,14 +59,31 @@
   gl.vertexAttribPointer(attr, 2, gl.FLOAT, false, 0, 0);
 
   gl.drawArrays(gl.TRIANGLE_STRIP, 0, 3);
+}
 
-  gl.commit();
+function drawLoop()
+{
+  if (g_frameNumber < 3) {
+    gl.clearColor(1, 0, 0, 1);
+    gl.clear(gl.COLOR_BUFFER_BIT);
+    g_frameNumber++;
+    gl.commit().then(drawLoop);
+  } else {
+    drawTriangle();
+    gl.commit();
+
+    // The following clear is never committed
+    gl.clearColor(0, 0, 1, 1);
+    gl.clear(gl.COLOR_BUFFER_BIT);
+
+    self.postMessage("");
+  }
 }
 
 self.onmessage = function(e) {
   var transferredOffscreenCanvas = e.data;
-  drawTriangle(transferredOffscreenCanvas);
-  self.postMessage("");
+  gl = transferredOffscreenCanvas.getContext("webgl");
+  drawLoop();
 };
 </script>
 <script>
@@ -98,7 +118,7 @@
   } else {
     g_swapsBeforeAck--;
     document.getElementById('container').style.zIndex = g_swapsBeforeAck + 1;
-    window.webkitRequestAnimationFrame(waitForFinish);
+    window.requestAnimationFrame(waitForFinish);
   }
 }
 </script>
diff --git a/device/bluetooth/bluetooth_remote_gatt_service_mac.h b/device/bluetooth/bluetooth_remote_gatt_service_mac.h
index ae123d7..0d4196c 100644
--- a/device/bluetooth/bluetooth_remote_gatt_service_mac.h
+++ b/device/bluetooth/bluetooth_remote_gatt_service_mac.h
@@ -7,9 +7,9 @@
 
 #include <stdint.h>
 
+#include <unordered_map>
 #include <vector>
 
-#include "base/containers/scoped_ptr_hash_map.h"
 #include "base/mac/scoped_nsobject.h"
 #include "device/bluetooth/bluetooth_remote_gatt_service.h"
 
diff --git a/docs/android_build_instructions.md b/docs/android_build_instructions.md
index ee3c399e..6acb3fa3 100644
--- a/docs/android_build_instructions.md
+++ b/docs/android_build_instructions.md
@@ -1,6 +1,6 @@
 # Checking out and building Chromium for Android
 
-There are instructions for other platforms linked from the 
+There are instructions for other platforms linked from the
 [get the code](get_the_code.md) page.
 
 ## Instructions for Google Employees
@@ -311,11 +311,12 @@
 ### Faster Edit/Deploy (GN only)
 
 GN's "incremental install" uses reflection and side-loading to speed up the edit
-& deploy cycle (normally < 10 seconds).
+& deploy cycle (normally < 10 seconds). The initial launch of the apk will be
+a little slower since updated dex files are installed manually.
 
 *   Make sure to set` is_component_build = true `in your GN args
 *   All apk targets have \*`_incremental` targets defined (e.g.
-    `chrome_public_apk_incremental`)
+    `chrome_public_apk_incremental`) except for Webview and Monochrome
 
 Here's an example:
 
@@ -345,6 +346,27 @@
 out/Default/bin/install_chrome_public_apk_incremental -v --uninstall
 ```
 
+A subtly erroneous flow arises when you build a regular apk but install an
+incremental apk (e.g.
+`ninja -C out/Default foo_apk && out/Default/bin/install_foo_apk_incremental`).
+Setting `incremental_apk_by_default = true` in your GN args aliases regular
+targets as their incremental counterparts. With this arg set, the commands
+above become:
+
+```shell
+ninja -C out/Default chrome_public_apk
+out/Default/bin/install_chrome_public_apk
+
+ninja -C out/Default base_unittests
+out/Default/bin/run_base_unittests
+
+ninja -C out/Default chrome_public_test_apk
+out/Default/bin/run_chrome_public_test_apk
+```
+
+If you want to build a non-incremental apk you'll need to remove
+`incremental_apk_by_default` from your GN args.
+
 ## Tips, tricks, and troubleshooting
 
 ### Rebuilding libchrome.so for a particular release
diff --git a/extensions/renderer/dispatcher.cc b/extensions/renderer/dispatcher.cc
index 8d849a1a..a1b2b51e 100644
--- a/extensions/renderer/dispatcher.cc
+++ b/extensions/renderer/dispatcher.cc
@@ -736,8 +736,6 @@
   resources.push_back(
       std::make_pair(mojo::kCodecModuleName, IDR_MOJO_CODEC_JS));
   resources.push_back(
-      std::make_pair(mojo::kConnectionModuleName, IDR_MOJO_CONNECTION_JS));
-  resources.push_back(
       std::make_pair(mojo::kConnectorModuleName, IDR_MOJO_CONNECTOR_JS));
   resources.push_back(std::make_pair(mojo::kInterfaceTypesModuleName,
                                      IDR_MOJO_INTERFACE_TYPES_JS));
diff --git a/gpu/command_buffer/tests/gl_manager.h b/gpu/command_buffer/tests/gl_manager.h
index 7e7425c..ce85a39d 100644
--- a/gpu/command_buffer/tests/gl_manager.h
+++ b/gpu/command_buffer/tests/gl_manager.h
@@ -10,7 +10,6 @@
 
 #include <memory>
 
-#include "base/containers/scoped_ptr_hash_map.h"
 #include "base/memory/ref_counted.h"
 #include "gpu/command_buffer/client/gpu_control.h"
 #include "gpu/command_buffer/common/gles2_cmd_utils.h"
diff --git a/gpu/ipc/client/command_buffer_proxy_impl.h b/gpu/ipc/client/command_buffer_proxy_impl.h
index 00f844a..ea8f8bfc 100644
--- a/gpu/ipc/client/command_buffer_proxy_impl.h
+++ b/gpu/ipc/client/command_buffer_proxy_impl.h
@@ -16,7 +16,6 @@
 #include "base/callback.h"
 #include "base/compiler_specific.h"
 #include "base/containers/hash_tables.h"
-#include "base/containers/scoped_ptr_hash_map.h"
 #include "base/macros.h"
 #include "base/memory/ref_counted.h"
 #include "base/memory/weak_ptr.h"
diff --git a/gpu/ipc/client/gpu_channel_host.h b/gpu/ipc/client/gpu_channel_host.h
index 821dfd9c..989f1df6 100644
--- a/gpu/ipc/client/gpu_channel_host.h
+++ b/gpu/ipc/client/gpu_channel_host.h
@@ -13,7 +13,6 @@
 #include <vector>
 
 #include "base/atomic_sequence_num.h"
-#include "base/containers/scoped_ptr_hash_map.h"
 #include "base/macros.h"
 #include "base/memory/ref_counted.h"
 #include "base/memory/weak_ptr.h"
diff --git a/gpu/ipc/in_process_command_buffer.h b/gpu/ipc/in_process_command_buffer.h
index 113f086..6a55ec0 100644
--- a/gpu/ipc/in_process_command_buffer.h
+++ b/gpu/ipc/in_process_command_buffer.h
@@ -15,7 +15,6 @@
 #include "base/atomic_sequence_num.h"
 #include "base/callback.h"
 #include "base/compiler_specific.h"
-#include "base/containers/scoped_ptr_hash_map.h"
 #include "base/macros.h"
 #include "base/memory/ref_counted.h"
 #include "base/memory/weak_ptr.h"
diff --git a/ios/chrome/app/application_delegate/app_state_unittest.mm b/ios/chrome/app/application_delegate/app_state_unittest.mm
index f04cc58..1be7e7e 100644
--- a/ios/chrome/app/application_delegate/app_state_unittest.mm
+++ b/ios/chrome/app/application_delegate/app_state_unittest.mm
@@ -39,7 +39,7 @@
 #include "ios/public/provider/chrome/browser/user_feedback/test_user_feedback_provider.h"
 #import "ios/testing/ocmock_complex_type_helper.h"
 #include "ios/web/net/request_tracker_impl.h"
-#import "ios/web/public/test/test_web_thread_bundle.h"
+#include "ios/web/public/test/test_web_thread_bundle.h"
 #include "testing/platform_test.h"
 #import "third_party/ocmock/OCMock/OCMock.h"
 #include "third_party/ocmock/gtest_support.h"
diff --git a/ios/chrome/app/strings/OWNERS b/ios/chrome/app/strings/OWNERS
index fbcee9e..69a98a6 100644
--- a/ios/chrome/app/strings/OWNERS
+++ b/ios/chrome/app/strings/OWNERS
@@ -1 +1,2 @@
+per-file *.grd=*
 per-file *.xtb=*
diff --git a/ios/chrome/browser/browsing_data/cache_counter_unittest.cc b/ios/chrome/browser/browsing_data/cache_counter_unittest.cc
index da62052..e3e8e6a5 100644
--- a/ios/chrome/browser/browsing_data/cache_counter_unittest.cc
+++ b/ios/chrome/browser/browsing_data/cache_counter_unittest.cc
@@ -18,7 +18,7 @@
 #include "components/browsing_data/core/pref_names.h"
 #include "components/prefs/pref_registry_simple.h"
 #include "components/prefs/testing_pref_service.h"
-#include "ios/web/public/test/test_browser_state.h"
+#include "ios/web/public/test/fakes/test_browser_state.h"
 #include "ios/web/public/test/test_web_thread_bundle.h"
 #include "ios/web/public/web_thread.h"
 #include "net/disk_cache/disk_cache.h"
diff --git a/ios/chrome/browser/interstitials/ios_chrome_controller_client.h b/ios/chrome/browser/interstitials/ios_chrome_controller_client.h
index f92aa7f..111d9eee 100644
--- a/ios/chrome/browser/interstitials/ios_chrome_controller_client.h
+++ b/ios/chrome/browser/interstitials/ios_chrome_controller_client.h
@@ -41,9 +41,9 @@
   void Proceed() override;
   void Reload() override;
   void OpenUrlInCurrentTab(const GURL& url) override;
-  const std::string& GetApplicationLocale() override;
+  const std::string& GetApplicationLocale() const override;
   PrefService* GetPrefService() override;
-  const std::string GetExtendedReportingPrefName() override;
+  const std::string GetExtendedReportingPrefName() const override;
 
   web::WebState* web_state_;
   web::WebInterstitial* web_interstitial_;
diff --git a/ios/chrome/browser/interstitials/ios_chrome_controller_client.mm b/ios/chrome/browser/interstitials/ios_chrome_controller_client.mm
index 1f5b8b2..2d5658a 100644
--- a/ios/chrome/browser/interstitials/ios_chrome_controller_client.mm
+++ b/ios/chrome/browser/interstitials/ios_chrome_controller_client.mm
@@ -63,7 +63,7 @@
       ui::PAGE_TRANSITION_LINK, false));
 }
 
-const std::string& IOSChromeControllerClient::GetApplicationLocale() {
+const std::string& IOSChromeControllerClient::GetApplicationLocale() const {
   return GetApplicationContext()->GetApplicationLocale();
 }
 
@@ -73,6 +73,7 @@
       ->GetPrefs();
 }
 
-const std::string IOSChromeControllerClient::GetExtendedReportingPrefName() {
+const std::string IOSChromeControllerClient::GetExtendedReportingPrefName()
+    const {
   return std::string();
 }
diff --git a/ios/chrome/browser/itunes_links/itunes_links_observer_unittest.mm b/ios/chrome/browser/itunes_links/itunes_links_observer_unittest.mm
index ddee1266..4045567c 100644
--- a/ios/chrome/browser/itunes_links/itunes_links_observer_unittest.mm
+++ b/ios/chrome/browser/itunes_links/itunes_links_observer_unittest.mm
@@ -6,12 +6,12 @@
 
 #import "ios/chrome/browser/itunes_links/itunes_links_observer.h"
 
-#import "ios/web/public/test/test_web_state.h"
 #import "ios/chrome/browser/storekit_launcher.h"
+#import "ios/web/public/test/fakes/test_web_state.h"
 #include "testing/gtest_mac.h"
 #include "testing/platform_test.h"
-#import "third_party/ocmock/gtest_support.h"
 #import "third_party/ocmock/OCMock/OCMock.h"
+#import "third_party/ocmock/gtest_support.h"
 #include "url/gurl.h"
 
 #if !defined(__has_feature) || !__has_feature(objc_arc)
diff --git a/ios/chrome/browser/passwords/password_controller_off_the_record_unittest.mm b/ios/chrome/browser/passwords/password_controller_off_the_record_unittest.mm
index 8afcc2c..f88d68c 100644
--- a/ios/chrome/browser/passwords/password_controller_off_the_record_unittest.mm
+++ b/ios/chrome/browser/passwords/password_controller_off_the_record_unittest.mm
@@ -8,7 +8,7 @@
 #include "components/password_manager/core/browser/stub_password_manager_client.h"
 #include "ios/chrome/browser/browser_state/test_chrome_browser_state.h"
 #import "ios/chrome/browser/passwords/password_controller.h"
-#import "ios/web/public/test/test_web_state.h"
+#import "ios/web/public/test/fakes/test_web_state.h"
 #import "ios/web/public/test/web_test_with_web_state.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
diff --git a/ios/chrome/browser/passwords/password_controller_unittest.mm b/ios/chrome/browser/passwords/password_controller_unittest.mm
index 26dd353..9f52d6be 100644
--- a/ios/chrome/browser/passwords/password_controller_unittest.mm
+++ b/ios/chrome/browser/passwords/password_controller_unittest.mm
@@ -30,10 +30,10 @@
 #import "ios/chrome/browser/passwords/js_password_manager.h"
 #import "ios/web/public/navigation_item.h"
 #import "ios/web/public/navigation_manager.h"
-#import "ios/web/public/web_state/web_state.h"
 #include "ios/web/public/ssl_status.h"
+#import "ios/web/public/test/fakes/test_web_state.h"
 #import "ios/web/public/test/web_test_with_web_state.h"
-#import "ios/web/public/test/test_web_state.h"
+#import "ios/web/public/web_state/web_state.h"
 #include "testing/gmock/include/gmock/gmock.h"
 #include "testing/gtest/include/gtest/gtest.h"
 #include "testing/gtest_mac.h"
diff --git a/ios/chrome/browser/passwords/password_generation_agent_unittest.mm b/ios/chrome/browser/passwords/password_generation_agent_unittest.mm
index e1c8020c..1c47577 100644
--- a/ios/chrome/browser/passwords/password_generation_agent_unittest.mm
+++ b/ios/chrome/browser/passwords/password_generation_agent_unittest.mm
@@ -27,9 +27,9 @@
 #import "ios/chrome/browser/ui/commands/generic_chrome_command.h"
 #include "ios/chrome/browser/ui/commands/ios_command_ids.h"
 #import "ios/testing/ocmock_complex_type_helper.h"
-#include "ios/web/public/test/test_web_state.h"
-#include "ios/web/public/web_state/url_verification_constants.h"
+#import "ios/web/public/test/fakes/test_web_state.h"
 #import "ios/web/public/test/web_test_with_web_state.h"
+#include "ios/web/public/web_state/url_verification_constants.h"
 #include "testing/gtest_mac.h"
 #include "third_party/ocmock/OCMock/OCMock.h"
 #include "third_party/ocmock/gtest_support.h"
diff --git a/ios/chrome/browser/reading_list/reading_list_web_state_observer_unittest.mm b/ios/chrome/browser/reading_list/reading_list_web_state_observer_unittest.mm
index 3008236..f80c6d7b 100644
--- a/ios/chrome/browser/reading_list/reading_list_web_state_observer_unittest.mm
+++ b/ios/chrome/browser/reading_list/reading_list_web_state_observer_unittest.mm
@@ -8,8 +8,8 @@
 #include "components/reading_list/ios/reading_list_model_impl.h"
 #include "ios/chrome/browser/reading_list/offline_url_utils.h"
 #import "ios/web/public/navigation_item.h"
-#import "ios/web/public/test/test_navigation_manager.h"
-#include "ios/web/public/test/test_web_state.h"
+#import "ios/web/public/test/fakes/test_navigation_manager.h"
+#import "ios/web/public/test/fakes/test_web_state.h"
 #include "ios/web/public/test/web_test.h"
 #import "ios/web/public/web_state/web_state.h"
 #include "net/base/network_change_notifier.h"
diff --git a/ios/chrome/browser/signin/gaia_auth_fetcher_ios_unittest.mm b/ios/chrome/browser/signin/gaia_auth_fetcher_ios_unittest.mm
index 422e6b0..aad6ed6 100644
--- a/ios/chrome/browser/signin/gaia_auth_fetcher_ios_unittest.mm
+++ b/ios/chrome/browser/signin/gaia_auth_fetcher_ios_unittest.mm
@@ -10,7 +10,7 @@
 #include "base/run_loop.h"
 #include "google_apis/gaia/gaia_urls.h"
 #include "ios/chrome/browser/signin/gaia_auth_fetcher_ios_private.h"
-#include "ios/web/public/test/test_browser_state.h"
+#include "ios/web/public/test/fakes/test_browser_state.h"
 #include "ios/web/public/test/test_web_thread_bundle.h"
 #include "net/url_request/test_url_fetcher_factory.h"
 #include "testing/gmock/include/gmock/gmock.h"
diff --git a/ios/chrome/browser/u2f/u2f_controller_unittest.mm b/ios/chrome/browser/u2f/u2f_controller_unittest.mm
index 27719ac..08ab79a8 100644
--- a/ios/chrome/browser/u2f/u2f_controller_unittest.mm
+++ b/ios/chrome/browser/u2f/u2f_controller_unittest.mm
@@ -9,7 +9,7 @@
 #import "base/strings/sys_string_conversions.h"
 #include "base/strings/utf_string_conversions.h"
 #import "ios/chrome/browser/chrome_url_util.h"
-#import "ios/web/public/test/test_web_state.h"
+#import "ios/web/public/test/fakes/test_web_state.h"
 #include "ios/web/public/web_state/url_verification_constants.h"
 #include "testing/gmock/include/gmock/gmock.h"
 #include "testing/gtest/include/gtest/gtest.h"
diff --git a/ios/chrome/browser/ui/dialogs/dialog_presenter_unittest.mm b/ios/chrome/browser/ui/dialogs/dialog_presenter_unittest.mm
index 8bebde78..7e498f7 100644
--- a/ios/chrome/browser/ui/dialogs/dialog_presenter_unittest.mm
+++ b/ios/chrome/browser/ui/dialogs/dialog_presenter_unittest.mm
@@ -7,7 +7,7 @@
 #import "base/mac/scoped_nsobject.h"
 #include "base/time/time.h"
 #import "ios/chrome/browser/ui/alert_coordinator/alert_coordinator.h"
-#include "ios/web/public/test/test_web_state.h"
+#import "ios/web/public/test/fakes/test_web_state.h"
 #include "ios/web/public/web_state/web_state_observer.h"
 #include "testing/gtest/include/gtest/gtest.h"
 #include "testing/gtest_mac.h"
diff --git a/ios/chrome/browser/ui/dialogs/javascript_dialog_blocking_util_unittest.mm b/ios/chrome/browser/ui/dialogs/javascript_dialog_blocking_util_unittest.mm
index 56de41edf..a83cf0e 100644
--- a/ios/chrome/browser/ui/dialogs/javascript_dialog_blocking_util_unittest.mm
+++ b/ios/chrome/browser/ui/dialogs/javascript_dialog_blocking_util_unittest.mm
@@ -5,7 +5,7 @@
 #import "ios/chrome/browser/ui/dialogs/javascript_dialog_blocking_util.h"
 
 #include "ios/web/public/load_committed_details.h"
-#include "ios/web/public/test/test_web_state.h"
+#import "ios/web/public/test/fakes/test_web_state.h"
 #include "ios/web/public/web_state/web_state_observer.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
diff --git a/ios/chrome/browser/ui/fullscreen_controller_unittest.mm b/ios/chrome/browser/ui/fullscreen_controller_unittest.mm
index 14250b5..0e3aec6 100644
--- a/ios/chrome/browser/ui/fullscreen_controller_unittest.mm
+++ b/ios/chrome/browser/ui/fullscreen_controller_unittest.mm
@@ -4,7 +4,7 @@
 
 #include "base/mac/scoped_nsobject.h"
 #import "ios/chrome/browser/ui/fullscreen_controller.h"
-#import "ios/web/public/test/test_web_view_content_view.h"
+#import "ios/web/public/test/fakes/test_web_view_content_view.h"
 #import "ios/web/public/web_state/crw_web_view_scroll_view_proxy.h"
 #import "ios/web/public/web_state/ui/crw_web_view_content_view.h"
 #import "ios/web/web_state/crw_web_view_proxy_impl.h"
diff --git a/ios/chrome/browser/ui/history/history_panel_view_controller.mm b/ios/chrome/browser/ui/history/history_panel_view_controller.mm
index 158840f..231770f 100644
--- a/ios/chrome/browser/ui/history/history_panel_view_controller.mm
+++ b/ios/chrome/browser/ui/history/history_panel_view_controller.mm
@@ -47,6 +47,10 @@
   base::scoped_nsobject<UIView> _containerView;
   // The header view.
   base::scoped_nsobject<MDCAppBar> _appBar;
+  // Left bar button item for Search.
+  base::scoped_nsobject<UIBarButtonItem> _leftBarButtonItem;
+  // Right bar button item for Dismiss history action.
+  base::scoped_nsobject<UIBarButtonItem> _rightBarButtonItem;
 }
 // Closes history.
 - (void)closeHistory;
@@ -147,15 +151,17 @@
   [_appBar addSubviewsToParent];
 
   // Add navigation bar buttons.
-  self.navigationItem.leftBarButtonItem =
-      [ChromeIcon templateBarButtonItemWithImage:[ChromeIcon searchIcon]
-                                          target:self
-                                          action:@selector(enterSearchMode)];
-  self.navigationItem.rightBarButtonItem = [[[UIBarButtonItem alloc]
+  _leftBarButtonItem.reset([[ChromeIcon
+      templateBarButtonItemWithImage:[ChromeIcon searchIcon]
+                              target:self
+                              action:@selector(enterSearchMode)] retain]);
+  self.navigationItem.leftBarButtonItem = _leftBarButtonItem;
+  _rightBarButtonItem.reset([[UIBarButtonItem alloc]
       initWithTitle:l10n_util::GetNSString(IDS_IOS_NAVIGATION_BAR_DONE_BUTTON)
               style:UIBarButtonItemStylePlain
              target:self
-             action:@selector(closeHistory)] autorelease];
+             action:@selector(closeHistory)]);
+  self.navigationItem.rightBarButtonItem = _rightBarButtonItem;
   [self configureNavigationBar];
 }
 
@@ -353,10 +359,20 @@
     [[searchBarView widthAnchor] constraintEqualToAnchor:headerView.widthAnchor]
   ];
   [NSLayoutConstraint activateConstraints:constraints];
+  // Workaround so navigationItems are not voice-over selectable while hidden by
+  // the search view. We might have to re factor the view hierarchy in order to
+  // properly solve this issue. See: https://codereview.chromium.org/2605023002/
+  self.navigationItem.leftBarButtonItem = nil;
+  self.navigationItem.rightBarButtonItem = nil;
 }
 
 - (void)exitSearchMode {
   if (_historyCollectionController.get().searching) {
+    // Resets the navigation items to their initial state.
+    self.navigationItem.leftBarButtonItem = _leftBarButtonItem;
+    self.navigationItem.rightBarButtonItem = _rightBarButtonItem;
+    [self configureNavigationBar];
+
     [[_searchViewController view] removeFromSuperview];
     [_searchViewController removeFromParentViewController];
     _historyCollectionController.get().searching = NO;
diff --git a/ios/chrome/browser/ui/static_content/static_html_view_controller_unittest.mm b/ios/chrome/browser/ui/static_content/static_html_view_controller_unittest.mm
index ea2506c..c80bb82 100644
--- a/ios/chrome/browser/ui/static_content/static_html_view_controller_unittest.mm
+++ b/ios/chrome/browser/ui/static_content/static_html_view_controller_unittest.mm
@@ -16,9 +16,9 @@
 #include "ios/chrome/grit/ios_strings.h"
 #import "ios/testing/ocmock_complex_type_helper.h"
 #include "ios/web/public/referrer.h"
+#import "ios/web/public/test/fakes/test_web_client.h"
 #import "ios/web/public/test/js_test_util.h"
 #include "ios/web/public/test/scoped_testing_web_client.h"
-#import "ios/web/public/test/test_web_client.h"
 #include "ios/web/public/test/test_web_thread_bundle.h"
 #import "ios/web/public/web_state/ui/crw_native_content.h"
 #import "net/base/mac/url_conversions.h"
diff --git a/ios/chrome/browser/ui/sync/sync_fake_server_egtest.mm b/ios/chrome/browser/ui/sync/sync_fake_server_egtest.mm
index 2f754ada..ad78ec6 100644
--- a/ios/chrome/browser/ui/sync/sync_fake_server_egtest.mm
+++ b/ios/chrome/browser/ui/sync/sync_fake_server_egtest.mm
@@ -112,6 +112,24 @@
       testing::WaitUntilConditionOrTimeout(kSyncOperationTimeout, condition),
       @"Expected %d entities of the specified type", entity_count);
 }
+
+// Waits for |entity_count| entities of type |entity_type| with name |name|, and
+// fails with a GREYAssert if the condition is not met, within a short period of
+// time.
+void AssertNumberOfEntitiesWithName(int entity_count,
+                                    syncer::ModelType entity_type,
+                                    std::string name) {
+  ConditionBlock condition = ^{
+    NSError* error = nil;
+    BOOL success = chrome_test_util::VerifyNumberOfSyncEntitiesWithName(
+        entity_type, name, entity_count, &error);
+    DCHECK(success || error);
+    return !!success;
+  };
+  GREYAssert(
+      testing::WaitUntilConditionOrTimeout(kSyncOperationTimeout, condition),
+      @"Expected %d entities of the specified type", entity_count);
+}
 }  // namespace
 
 // Hermetic sync tests, which use the fake sync server.
@@ -534,7 +552,7 @@
 
 // Test that typed url is deleted from client after server sends tombstone for
 // that typed url.
-- (void)FLAKY_testSyncTypedURLDeleteFromServer {
+- (void)testSyncTypedURLDeleteFromServer {
   const GURL mockURL("http://not-a-real-site/");
 
   chrome_test_util::ClearBrowsingHistory();
@@ -553,17 +571,12 @@
   AssertSyncInitialized(YES);
   chrome_test_util::TriggerSyncCycle(syncer::TYPED_URLS);
 
-  NSError* error = nil;
-  BOOL success = chrome_test_util::VerifyNumberOfSyncEntitiesWithName(
-      syncer::TYPED_URLS, mockURL.spec(), 1, &error);
-  DCHECK(success || error);
-  GREYAssertTrue(success, [error localizedDescription]);
+  AssertNumberOfEntitiesWithName(1, syncer::TYPED_URLS, mockURL.spec());
 
   chrome_test_util::DeleteTypedUrlFromClient(mockURL);
 
   // Trigger sync and wait for fake server to be updated.
   chrome_test_util::TriggerSyncCycle(syncer::TYPED_URLS);
-
   __block NSError* blockSafeError = nil;
   GREYCondition* condition = [GREYCondition
       conditionWithName:@"Wait for typed URL to be downloaded."
@@ -574,7 +587,7 @@
                     blockSafeError = [error copy];
                     return result;
                   }];
-  success = [condition waitWithTimeout:kSyncOperationTimeout];
+  BOOL success = [condition waitWithTimeout:kSyncOperationTimeout];
   DCHECK(success || blockSafeError);
   if (blockSafeError) {
     [blockSafeError autorelease];
diff --git a/ios/chrome/browser/ui/toolbar/toolbar_model_impl_ios_unittest.mm b/ios/chrome/browser/ui/toolbar/toolbar_model_impl_ios_unittest.mm
index 11e148e..958bf3f 100644
--- a/ios/chrome/browser/ui/toolbar/toolbar_model_impl_ios_unittest.mm
+++ b/ios/chrome/browser/ui/toolbar/toolbar_model_impl_ios_unittest.mm
@@ -23,8 +23,8 @@
 #import "ios/chrome/browser/xcallback_parameters.h"
 #import "ios/testing/ocmock_complex_type_helper.h"
 #import "ios/web/public/navigation_item.h"
-#import "ios/web/public/test/test_navigation_manager.h"
-#import "ios/web/public/test/test_web_state.h"
+#import "ios/web/public/test/fakes/test_navigation_manager.h"
+#import "ios/web/public/test/fakes/test_web_state.h"
 #include "ios/web/public/test/test_web_thread.h"
 #include "ios/web/public/test/test_web_thread_bundle.h"
 #include "testing/gtest_mac.h"
diff --git a/ios/chrome/browser/web/chrome_web_client_unittest.mm b/ios/chrome/browser/web/chrome_web_client_unittest.mm
index 9aadad6e7..5375d78 100644
--- a/ios/chrome/browser/web/chrome_web_client_unittest.mm
+++ b/ios/chrome/browser/web/chrome_web_client_unittest.mm
@@ -12,9 +12,9 @@
 #include "base/memory/ptr_util.h"
 #include "base/strings/string_split.h"
 #include "base/strings/sys_string_conversions.h"
+#include "ios/web/public/test/fakes/test_browser_state.h"
 #import "ios/web/public/test/js_test_util.h"
 #include "ios/web/public/test/scoped_testing_web_client.h"
-#include "ios/web/public/test/test_browser_state.h"
 #include "ios/web/public/test/web_test.h"
 #import "ios/web/public/web_view_creation_util.h"
 #include "testing/gtest/include/gtest/gtest.h"
diff --git a/ios/chrome/browser/web/early_page_script_perftest.mm b/ios/chrome/browser/web/early_page_script_perftest.mm
index bca6bf9..4245030 100644
--- a/ios/chrome/browser/web/early_page_script_perftest.mm
+++ b/ios/chrome/browser/web/early_page_script_perftest.mm
@@ -6,8 +6,8 @@
 #include "base/mac/scoped_nsobject.h"
 #include "base/timer/elapsed_timer.h"
 #include "ios/chrome/test/base/perf_test_ios.h"
+#include "ios/web/public/test/fakes/test_browser_state.h"
 #import "ios/web/public/test/js_test_util.h"
-#include "ios/web/public/test/test_browser_state.h"
 #import "ios/web/public/web_view_creation_util.h"
 #import "ios/web/web_state/js/page_script_util.h"
 
diff --git a/ios/chrome/browser/web/network_activity_indicator_tab_helper_unittest.mm b/ios/chrome/browser/web/network_activity_indicator_tab_helper_unittest.mm
index 871691a..1898532 100644
--- a/ios/chrome/browser/web/network_activity_indicator_tab_helper_unittest.mm
+++ b/ios/chrome/browser/web/network_activity_indicator_tab_helper_unittest.mm
@@ -6,7 +6,7 @@
 
 #import <UIKit/UIKit.h>
 
-#import "ios/web/public/test/test_web_state.h"
+#import "ios/web/public/test/fakes/test_web_state.h"
 #import "ios/web/public/test/web_test.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
diff --git a/ios/web/BUILD.gn b/ios/web/BUILD.gn
index 4b29083..4d42c2b 100644
--- a/ios/web/BUILD.gn
+++ b/ios/web/BUILD.gn
@@ -379,8 +379,22 @@
   ]
 
   sources = [
-    "public/test/crw_test_js_injection_receiver.h",
-    "public/test/crw_test_js_injection_receiver.mm",
+    "public/test/fakes/crw_test_js_injection_receiver.h",
+    "public/test/fakes/crw_test_js_injection_receiver.mm",
+    "public/test/fakes/test_browser_state.cc",
+    "public/test/fakes/test_browser_state.h",
+    "public/test/fakes/test_native_content.h",
+    "public/test/fakes/test_native_content.mm",
+    "public/test/fakes/test_native_content_provider.h",
+    "public/test/fakes/test_native_content_provider.mm",
+    "public/test/fakes/test_navigation_manager.h",
+    "public/test/fakes/test_navigation_manager.mm",
+    "public/test/fakes/test_web_client.h",
+    "public/test/fakes/test_web_client.mm",
+    "public/test/fakes/test_web_state.h",
+    "public/test/fakes/test_web_state.mm",
+    "public/test/fakes/test_web_view_content_view.h",
+    "public/test/fakes/test_web_view_content_view.mm",
     "public/test/http_server.h",
     "public/test/http_server.mm",
     "public/test/http_server_util.h",
@@ -413,24 +427,10 @@
     "public/test/response_providers/string_response_provider.mm",
     "public/test/scoped_testing_web_client.h",
     "public/test/scoped_testing_web_client.mm",
-    "public/test/test_browser_state.cc",
-    "public/test/test_browser_state.h",
-    "public/test/test_native_content.h",
-    "public/test/test_native_content.mm",
-    "public/test/test_native_content_provider.h",
-    "public/test/test_native_content_provider.mm",
-    "public/test/test_navigation_manager.h",
-    "public/test/test_navigation_manager.mm",
     "public/test/test_redirect_observer.h",
     "public/test/test_redirect_observer.mm",
-    "public/test/test_web_client.h",
-    "public/test/test_web_client.mm",
-    "public/test/test_web_state.h",
-    "public/test/test_web_state.mm",
     "public/test/test_web_thread.h",
     "public/test/test_web_thread_bundle.h",
-    "public/test/test_web_view_content_view.h",
-    "public/test/test_web_view_content_view.mm",
     "public/test/web_js_test.h",
     "public/test/web_test.h",
     "public/test/web_test.mm",
diff --git a/ios/web/active_state_manager_impl_unittest.mm b/ios/web/active_state_manager_impl_unittest.mm
index a444001..808a93f 100644
--- a/ios/web/active_state_manager_impl_unittest.mm
+++ b/ios/web/active_state_manager_impl_unittest.mm
@@ -6,7 +6,7 @@
 
 #include "ios/web/public/active_state_manager.h"
 #include "ios/web/public/browser_state.h"
-#include "ios/web/public/test/test_browser_state.h"
+#include "ios/web/public/test/fakes/test_browser_state.h"
 #include "ios/web/public/test/test_web_thread_bundle.h"
 #include "ios/web/public/test/web_test.h"
 #include "testing/gmock/include/gmock/gmock.h"
diff --git a/ios/web/browser_state_unittest.cc b/ios/web/browser_state_unittest.cc
index f235bb6..435dc40 100644
--- a/ios/web/browser_state_unittest.cc
+++ b/ios/web/browser_state_unittest.cc
@@ -5,7 +5,7 @@
 #include "ios/web/public/browser_state.h"
 
 #include "base/supports_user_data.h"
-#include "ios/web/public/test/test_browser_state.h"
+#include "ios/web/public/test/fakes/test_browser_state.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
 namespace {
diff --git a/ios/web/ios_web_resources.grd b/ios/web/ios_web_resources.grd
index f17ef25..763a3f8c 100644
--- a/ios/web/ios_web_resources.grd
+++ b/ios/web/ios_web_resources.grd
@@ -12,7 +12,6 @@
       <include name="IDR_MOJO_BINDINGS_JS" file="../../mojo/public/js/bindings.js" flattenhtml="true" type="BINDATA" />
       <include name="IDR_MOJO_BUFFER_JS" file="../../mojo/public/js/buffer.js" flattenhtml="true" type="BINDATA" />
       <include name="IDR_MOJO_CODEC_JS" file="../../mojo/public/js/codec.js" flattenhtml="true" type="BINDATA" />
-      <include name="IDR_MOJO_CONNECTION_JS" file="../../mojo/public/js/connection.js" flattenhtml="true" type="BINDATA" />
       <include name="IDR_MOJO_CONNECTOR_JS" file="../../mojo/public/js/connector.js" flattenhtml="true" type="BINDATA" />
       <include name="IDR_MOJO_INTERFACE_TYPES_JS" file="../../mojo/public/js/interface_types.js" flattenhtml="true" type="BINDATA" />
       <include name="IDR_MOJO_ROUTER_JS" file="../../mojo/public/js/router.js" flattenhtml="true" type="BINDATA" />
diff --git a/ios/web/navigation/crw_session_controller_unittest.mm b/ios/web/navigation/crw_session_controller_unittest.mm
index 8f5c905..a2a9094 100644
--- a/ios/web/navigation/crw_session_controller_unittest.mm
+++ b/ios/web/navigation/crw_session_controller_unittest.mm
@@ -16,7 +16,7 @@
 #import "ios/web/navigation/crw_session_entry.h"
 #import "ios/web/navigation/navigation_item_impl.h"
 #include "ios/web/public/referrer.h"
-#include "ios/web/public/test/test_browser_state.h"
+#include "ios/web/public/test/fakes/test_browser_state.h"
 #include "ios/web/public/test/test_web_thread_bundle.h"
 #import "net/base/mac/url_conversions.h"
 #include "testing/gtest/include/gtest/gtest.h"
diff --git a/ios/web/navigation/navigation_manager_impl_unittest.mm b/ios/web/navigation/navigation_manager_impl_unittest.mm
index c91c356e..142da93 100644
--- a/ios/web/navigation/navigation_manager_impl_unittest.mm
+++ b/ios/web/navigation/navigation_manager_impl_unittest.mm
@@ -8,7 +8,7 @@
 #import "base/mac/scoped_nsobject.h"
 #import "ios/web/navigation/crw_session_controller+private_constructors.h"
 #import "ios/web/navigation/navigation_manager_delegate.h"
-#include "ios/web/public/test/test_browser_state.h"
+#include "ios/web/public/test/fakes/test_browser_state.h"
 #include "testing/gtest/include/gtest/gtest.h"
 #include "testing/platform_test.h"
 
diff --git a/ios/web/net/request_tracker_impl_unittest.mm b/ios/web/net/request_tracker_impl_unittest.mm
index 98499a29..b88873cb 100644
--- a/ios/web/net/request_tracker_impl_unittest.mm
+++ b/ios/web/net/request_tracker_impl_unittest.mm
@@ -17,7 +17,7 @@
 #include "ios/web/public/cert_policy.h"
 #include "ios/web/public/certificate_policy_cache.h"
 #include "ios/web/public/ssl_status.h"
-#include "ios/web/public/test/test_browser_state.h"
+#include "ios/web/public/test/fakes/test_browser_state.h"
 #include "ios/web/public/test/test_web_thread.h"
 #include "net/cert/x509_certificate.h"
 #include "net/http/http_response_headers.h"
diff --git a/ios/web/public/test/crw_test_js_injection_receiver.h b/ios/web/public/test/fakes/crw_test_js_injection_receiver.h
similarity index 66%
rename from ios/web/public/test/crw_test_js_injection_receiver.h
rename to ios/web/public/test/fakes/crw_test_js_injection_receiver.h
index e529663..4f36f973 100644
--- a/ios/web/public/test/crw_test_js_injection_receiver.h
+++ b/ios/web/public/test/fakes/crw_test_js_injection_receiver.h
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef IOS_WEB_PUBLIC_TEST_CRW_TEST_JS_INJECTION_RECEIVER_H_
-#define IOS_WEB_PUBLIC_TEST_CRW_TEST_JS_INJECTION_RECEIVER_H_
+#ifndef IOS_WEB_PUBLIC_TEST_FAKES_CRW_TEST_JS_INJECTION_RECEIVER_H_
+#define IOS_WEB_PUBLIC_TEST_FAKES_CRW_TEST_JS_INJECTION_RECEIVER_H_
 
 #import "ios/web/public/web_state/js/crw_js_injection_receiver.h"
 
@@ -12,4 +12,4 @@
 @interface CRWTestJSInjectionReceiver : CRWJSInjectionReceiver
 @end
 
-#endif  // IOS_WEB_PUBLIC_TEST_CRW_TEST_JS_INJECTION_RECEIVER_H_
+#endif  // IOS_WEB_PUBLIC_TEST_FAKES_CRW_TEST_JS_INJECTION_RECEIVER_H_
diff --git a/ios/web/public/test/crw_test_js_injection_receiver.mm b/ios/web/public/test/fakes/crw_test_js_injection_receiver.mm
similarity index 96%
rename from ios/web/public/test/crw_test_js_injection_receiver.mm
rename to ios/web/public/test/fakes/crw_test_js_injection_receiver.mm
index 7127e04..7ab4421 100644
--- a/ios/web/public/test/crw_test_js_injection_receiver.mm
+++ b/ios/web/public/test/fakes/crw_test_js_injection_receiver.mm
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#import "ios/web/public/test/crw_test_js_injection_receiver.h"
+#import "ios/web/public/test/fakes/crw_test_js_injection_receiver.h"
 
 #import <UIKit/UIKit.h>
 #import <WebKit/WebKit.h>
diff --git a/ios/web/public/test/test_browser_state.cc b/ios/web/public/test/fakes/test_browser_state.cc
similarity index 90%
rename from ios/web/public/test/test_browser_state.cc
rename to ios/web/public/test/fakes/test_browser_state.cc
index 054208c..a20502f 100644
--- a/ios/web/public/test/test_browser_state.cc
+++ b/ios/web/public/test/fakes/test_browser_state.cc
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "ios/web/public/test/test_browser_state.h"
+#include "ios/web/public/test/fakes/test_browser_state.h"
 
 #include "base/files/file_path.h"
 #include "ios/web/public/web_thread.h"
@@ -28,8 +28,8 @@
 
   net::URLRequestContext* GetURLRequestContext() override { return &context_; }
 
-  scoped_refptr<base::SingleThreadTaskRunner>
-  GetNetworkTaskRunner() const override {
+  scoped_refptr<base::SingleThreadTaskRunner> GetNetworkTaskRunner()
+      const override {
     return web::WebThread::GetTaskRunnerForThread(web::WebThread::IO);
   }
 
@@ -44,8 +44,7 @@
 
 TestBrowserState::TestBrowserState() : is_off_the_record_(false) {}
 
-TestBrowserState::~TestBrowserState() {
-}
+TestBrowserState::~TestBrowserState() {}
 
 bool TestBrowserState::IsOffTheRecord() const {
   return is_off_the_record_;
diff --git a/ios/web/public/test/test_browser_state.h b/ios/web/public/test/fakes/test_browser_state.h
similarity index 81%
rename from ios/web/public/test/test_browser_state.h
rename to ios/web/public/test/fakes/test_browser_state.h
index 8935041..5e54d90 100644
--- a/ios/web/public/test/test_browser_state.h
+++ b/ios/web/public/test/fakes/test_browser_state.h
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef IOS_WEB_PUBLIC_TEST_TEST_BROWSER_STATE_H_
-#define IOS_WEB_PUBLIC_TEST_TEST_BROWSER_STATE_H_
+#ifndef IOS_WEB_PUBLIC_TEST_FAKES_TEST_BROWSER_STATE_H_
+#define IOS_WEB_PUBLIC_TEST_FAKES_TEST_BROWSER_STATE_H_
 
 #include "base/memory/ref_counted.h"
 #include "ios/web/public/browser_state.h"
@@ -28,4 +28,4 @@
 };
 }  // namespace web
 
-#endif  // IOS_WEB_PUBLIC_TEST_TEST_BROWSER_STATE_H_
+#endif  // IOS_WEB_PUBLIC_TEST_FAKES_TEST_BROWSER_STATE_H_
diff --git a/ios/web/public/test/test_native_content.h b/ios/web/public/test/fakes/test_native_content.h
similarity index 80%
rename from ios/web/public/test/test_native_content.h
rename to ios/web/public/test/fakes/test_native_content.h
index cd487dfa..230c089 100644
--- a/ios/web/public/test/test_native_content.h
+++ b/ios/web/public/test/fakes/test_native_content.h
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef IOS_WEB_PUBLIC_TEST_TEST_NATIVE_CONTENT_H_
-#define IOS_WEB_PUBLIC_TEST_TEST_NATIVE_CONTENT_H_
+#ifndef IOS_WEB_PUBLIC_TEST_FAKES_TEST_NATIVE_CONTENT_H_
+#define IOS_WEB_PUBLIC_TEST_FAKES_TEST_NATIVE_CONTENT_H_
 
 #import "ios/web/public/web_state/ui/crw_native_content.h"
 
@@ -19,4 +19,4 @@
 - (instancetype)init NS_UNAVAILABLE;
 @end
 
-#endif  // IOS_WEB_PUBLIC_TEST_TEST_NATIVE_CONTENT_H_
+#endif  // IOS_WEB_PUBLIC_TEST_FAKES_TEST_NATIVE_CONTENT_H_
diff --git a/ios/web/public/test/test_native_content.mm b/ios/web/public/test/fakes/test_native_content.mm
similarity index 94%
rename from ios/web/public/test/test_native_content.mm
rename to ios/web/public/test/fakes/test_native_content.mm
index 398bae5..a3c1e76 100644
--- a/ios/web/public/test/test_native_content.mm
+++ b/ios/web/public/test/fakes/test_native_content.mm
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#import "ios/web/public/test/test_native_content.h"
+#import "ios/web/public/test/fakes/test_native_content.h"
 
 #import "base/mac/scoped_nsobject.h"
 
diff --git a/ios/web/public/test/test_native_content_provider.h b/ios/web/public/test/fakes/test_native_content_provider.h
similarity index 72%
rename from ios/web/public/test/test_native_content_provider.h
rename to ios/web/public/test/fakes/test_native_content_provider.h
index 135a252b..00f838cd 100644
--- a/ios/web/public/test/test_native_content_provider.h
+++ b/ios/web/public/test/fakes/test_native_content_provider.h
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef IOS_WEB_PUBLIC_TEST_TEST_NATIVE_CONTENT_PROVIDER_H_
-#define IOS_WEB_PUBLIC_TEST_TEST_NATIVE_CONTENT_PROVIDER_H_
+#ifndef IOS_WEB_PUBLIC_TEST_FAKES_TEST_NATIVE_CONTENT_PROVIDER_H_
+#define IOS_WEB_PUBLIC_TEST_FAKES_TEST_NATIVE_CONTENT_PROVIDER_H_
 
 #import "ios/web/public/web_state/ui/crw_native_content_provider.h"
 
@@ -17,4 +17,4 @@
 
 @end
 
-#endif  // IOS_WEB_PUBLIC_TEST_TEST_NATIVE_CONTENT_PROVIDER_H_
+#endif  // IOS_WEB_PUBLIC_TEST_FAKES_TEST_NATIVE_CONTENT_PROVIDER_H_
diff --git a/ios/web/public/test/test_native_content_provider.mm b/ios/web/public/test/fakes/test_native_content_provider.mm
similarity index 93%
rename from ios/web/public/test/test_native_content_provider.mm
rename to ios/web/public/test/fakes/test_native_content_provider.mm
index 91cf920b..43994f3 100644
--- a/ios/web/public/test/test_native_content_provider.mm
+++ b/ios/web/public/test/fakes/test_native_content_provider.mm
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#import "ios/web/public/test/test_native_content_provider.h"
+#import "ios/web/public/test/fakes/test_native_content_provider.h"
 
 #include <map>
 
diff --git a/ios/web/public/test/test_navigation_manager.h b/ios/web/public/test/fakes/test_navigation_manager.h
similarity index 90%
rename from ios/web/public/test/test_navigation_manager.h
rename to ios/web/public/test/fakes/test_navigation_manager.h
index 55c8e8f1..ca6c49b 100644
--- a/ios/web/public/test/test_navigation_manager.h
+++ b/ios/web/public/test/fakes/test_navigation_manager.h
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef IOS_WEB_PUBLIC_TEST_TEST_NAVIGATION_MANAGER_H_
-#define IOS_WEB_PUBLIC_TEST_TEST_NAVIGATION_MANAGER_H_
+#ifndef IOS_WEB_PUBLIC_TEST_FAKES_TEST_NAVIGATION_MANAGER_H_
+#define IOS_WEB_PUBLIC_TEST_FAKES_TEST_NAVIGATION_MANAGER_H_
 
 #import "ios/web/public/navigation_manager.h"
 
@@ -53,4 +53,4 @@
 
 }  // namespace web
 
-#endif
+#endif  // IOS_WEB_PUBLIC_TEST_FAKES_TEST_NAVIGATION_MANAGER_H_
diff --git a/ios/web/public/test/test_navigation_manager.mm b/ios/web/public/test/fakes/test_navigation_manager.mm
similarity index 97%
rename from ios/web/public/test/test_navigation_manager.mm
rename to ios/web/public/test/fakes/test_navigation_manager.mm
index 6fea4ad..5addd42 100644
--- a/ios/web/public/test/test_navigation_manager.mm
+++ b/ios/web/public/test/fakes/test_navigation_manager.mm
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#import "ios/web/public/test/test_navigation_manager.h"
+#import "ios/web/public/test/fakes/test_navigation_manager.h"
 
 namespace web {
 
diff --git a/ios/web/public/test/test_web_client.h b/ios/web/public/test/fakes/test_web_client.h
similarity index 92%
rename from ios/web/public/test/test_web_client.h
rename to ios/web/public/test/fakes/test_web_client.h
index 08ad507..bc83951 100644
--- a/ios/web/public/test/test_web_client.h
+++ b/ios/web/public/test/fakes/test_web_client.h
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef IOS_WEB_PUBLIC_TEST_TEST_WEB_CLIENT_H_
-#define IOS_WEB_PUBLIC_TEST_TEST_WEB_CLIENT_H_
+#ifndef IOS_WEB_PUBLIC_TEST_FAKES_TEST_WEB_CLIENT_H_
+#define IOS_WEB_PUBLIC_TEST_FAKES_TEST_WEB_CLIENT_H_
 
 #import <Foundation/Foundation.h>
 
@@ -58,4 +58,4 @@
 
 }  // namespace web
 
-#endif  // IOS_WEB_PUBLIC_TEST_TEST_WEB_CLIENT_H_
+#endif  // IOS_WEB_PUBLIC_TEST_FAKES_TEST_WEB_CLIENT_H_
diff --git a/ios/web/public/test/test_web_client.mm b/ios/web/public/test/fakes/test_web_client.mm
similarity index 96%
rename from ios/web/public/test/test_web_client.mm
rename to ios/web/public/test/fakes/test_web_client.mm
index 8440a68f..8a62706 100644
--- a/ios/web/public/test/test_web_client.mm
+++ b/ios/web/public/test/fakes/test_web_client.mm
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#import "ios/web/public/test/test_web_client.h"
+#import "ios/web/public/test/fakes/test_web_client.h"
 
 #include "base/logging.h"
 #include "ios/web/test/test_url_constants.h"
diff --git a/ios/web/public/test/test_web_state.h b/ios/web/public/test/fakes/test_web_state.h
similarity index 95%
rename from ios/web/public/test/test_web_state.h
rename to ios/web/public/test/fakes/test_web_state.h
index ca2e121..c6554fef 100644
--- a/ios/web/public/test/test_web_state.h
+++ b/ios/web/public/test/fakes/test_web_state.h
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef IOS_WEB_PUBLIC_TEST_TEST_WEB_STATE_H_
-#define IOS_WEB_PUBLIC_TEST_TEST_WEB_STATE_H_
+#ifndef IOS_WEB_PUBLIC_TEST_FAKES_TEST_WEB_STATE_H_
+#define IOS_WEB_PUBLIC_TEST_FAKES_TEST_WEB_STATE_H_
 
 #include <stdint.h>
 
@@ -104,4 +104,4 @@
 
 }  // namespace web
 
-#endif  // IOS_WEB_PUBLIC_TEST_TEST_WEB_STATE_H_
+#endif  // IOS_WEB_PUBLIC_TEST_FAKES_TEST_WEB_STATE_H_
diff --git a/ios/web/public/test/test_web_state.mm b/ios/web/public/test/fakes/test_web_state.mm
similarity index 98%
rename from ios/web/public/test/test_web_state.mm
rename to ios/web/public/test/fakes/test_web_state.mm
index e2edc40a..3171d2f0 100644
--- a/ios/web/public/test/test_web_state.mm
+++ b/ios/web/public/test/fakes/test_web_state.mm
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#import "ios/web/public/test/test_web_state.h"
+#import "ios/web/public/test/fakes/test_web_state.h"
 
 #include <stdint.h>
 
diff --git a/ios/web/public/test/test_web_view_content_view.h b/ios/web/public/test/fakes/test_web_view_content_view.h
similarity index 79%
rename from ios/web/public/test/test_web_view_content_view.h
rename to ios/web/public/test/fakes/test_web_view_content_view.h
index 03dc5e5a..8b7a257 100644
--- a/ios/web/public/test/test_web_view_content_view.h
+++ b/ios/web/public/test/fakes/test_web_view_content_view.h
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef IOS_WEB_PUBLIC_TEST_TEST_WEB_VIEW_CONTENT_VIEW_H_
-#define IOS_WEB_PUBLIC_TEST_TEST_WEB_VIEW_CONTENT_VIEW_H_
+#ifndef IOS_WEB_PUBLIC_TEST_FAKES_TEST_WEB_VIEW_CONTENT_VIEW_H_
+#define IOS_WEB_PUBLIC_TEST_FAKES_TEST_WEB_VIEW_CONTENT_VIEW_H_
 
 #import "ios/web/public/web_state/ui/crw_web_view_content_view.h"
 
@@ -20,4 +20,4 @@
                      scrollView:(UIScrollView*)scrollView NS_UNAVAILABLE;
 @end
 
-#endif  // IOS_WEB_PUBLIC_TEST_TEST_WEB_VIEW_CONTENT_VIEW_H_
+#endif  // IOS_WEB_PUBLIC_TEST_FAKES_TEST_WEB_VIEW_CONTENT_VIEW_H_
diff --git a/ios/web/public/test/test_web_view_content_view.mm b/ios/web/public/test/fakes/test_web_view_content_view.mm
similarity index 93%
rename from ios/web/public/test/test_web_view_content_view.mm
rename to ios/web/public/test/fakes/test_web_view_content_view.mm
index 3dbc9b8..a5c08161 100644
--- a/ios/web/public/test/test_web_view_content_view.mm
+++ b/ios/web/public/test/fakes/test_web_view_content_view.mm
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#import "ios/web/public/test/test_web_view_content_view.h"
+#import "ios/web/public/test/fakes/test_web_view_content_view.h"
 
 #include "base/logging.h"
 #import "base/mac/scoped_nsobject.h"
diff --git a/ios/web/public/test/web_test.h b/ios/web/public/test/web_test.h
index 8e0aa23..b98550c9 100644
--- a/ios/web/public/test/web_test.h
+++ b/ios/web/public/test/web_test.h
@@ -5,8 +5,8 @@
 #ifndef IOS_WEB_PUBLIC_TEST_WEB_TEST_H_
 #define IOS_WEB_PUBLIC_TEST_WEB_TEST_H_
 
+#include "ios/web/public/test/fakes/test_browser_state.h"
 #include "ios/web/public/test/scoped_testing_web_client.h"
-#include "ios/web/public/test/test_browser_state.h"
 #include "ios/web/public/test/test_web_thread_bundle.h"
 #include "testing/platform_test.h"
 
diff --git a/ios/web/public/test/web_test.mm b/ios/web/public/test/web_test.mm
index d22fe43..773261d2 100644
--- a/ios/web/public/test/web_test.mm
+++ b/ios/web/public/test/web_test.mm
@@ -6,7 +6,7 @@
 
 #include "base/memory/ptr_util.h"
 #include "ios/web/public/active_state_manager.h"
-#import "ios/web/public/test/test_web_client.h"
+#import "ios/web/public/test/fakes/test_web_client.h"
 
 namespace web {
 
diff --git a/ios/web/test/web_test_suite.mm b/ios/web/test/web_test_suite.mm
index 11102ec8..15063f1 100644
--- a/ios/web/test/web_test_suite.mm
+++ b/ios/web/test/web_test_suite.mm
@@ -7,7 +7,7 @@
 #include "base/memory/ptr_util.h"
 #include "base/metrics/statistics_recorder.h"
 #include "base/path_service.h"
-#import "ios/web/public/test/test_web_client.h"
+#import "ios/web/public/test/fakes/test_web_client.h"
 #include "ios/web/public/url_schemes.h"
 #include "testing/gtest/include/gtest/gtest.h"
 #include "ui/base/resource/resource_bundle.h"
diff --git a/ios/web/test/wk_web_view_crash_utils.mm b/ios/web/test/wk_web_view_crash_utils.mm
index a8bf8c6..15f364d3 100644
--- a/ios/web/test/wk_web_view_crash_utils.mm
+++ b/ios/web/test/wk_web_view_crash_utils.mm
@@ -9,7 +9,7 @@
 
 #include "base/logging.h"
 #import "base/mac/scoped_nsobject.h"
-#include "ios/web/public/test/test_browser_state.h"
+#include "ios/web/public/test/fakes/test_browser_state.h"
 #import "ios/web/public/web_view_creation_util.h"
 #import "third_party/ocmock/OCMock/NSInvocation+OCMAdditions.h"
 #import "third_party/ocmock/OCMock/OCMock.h"
diff --git a/ios/web/web_state/js/page_script_util_unittest.mm b/ios/web/web_state/js/page_script_util_unittest.mm
index 7ecdb74..250e3b98 100644
--- a/ios/web/web_state/js/page_script_util_unittest.mm
+++ b/ios/web/web_state/js/page_script_util_unittest.mm
@@ -10,9 +10,9 @@
 #import "base/mac/scoped_nsobject.h"
 #include "base/strings/sys_string_conversions.h"
 #import "base/test/ios/wait_util.h"
+#include "ios/web/public/test/fakes/test_browser_state.h"
+#import "ios/web/public/test/fakes/test_web_client.h"
 #import "ios/web/public/test/js_test_util.h"
-#include "ios/web/public/test/test_browser_state.h"
-#import "ios/web/public/test/test_web_client.h"
 #include "ios/web/public/test/web_test.h"
 #import "ios/web/public/web_view_creation_util.h"
 #import "testing/gtest_mac.h"
diff --git a/ios/web/web_state/ui/crw_web_controller_unittest.mm b/ios/web/web_state/ui/crw_web_controller_unittest.mm
index 87d007c1..18f93671 100644
--- a/ios/web/web_state/ui/crw_web_controller_unittest.mm
+++ b/ios/web/web_state/ui/crw_web_controller_unittest.mm
@@ -17,10 +17,10 @@
 #import "ios/web/navigation/navigation_item_impl.h"
 #import "ios/web/navigation/navigation_manager_impl.h"
 #include "ios/web/public/referrer.h"
-#import "ios/web/public/test/test_native_content.h"
-#import "ios/web/public/test/test_native_content_provider.h"
-#import "ios/web/public/test/test_web_client.h"
-#import "ios/web/public/test/test_web_view_content_view.h"
+#import "ios/web/public/test/fakes/test_native_content.h"
+#import "ios/web/public/test/fakes/test_native_content_provider.h"
+#import "ios/web/public/test/fakes/test_web_client.h"
+#import "ios/web/public/test/fakes/test_web_view_content_view.h"
 #import "ios/web/public/web_state/crw_web_controller_observer.h"
 #import "ios/web/public/web_state/ui/crw_content_view.h"
 #import "ios/web/public/web_state/ui/crw_native_content.h"
diff --git a/ios/web/web_state/ui/crw_wk_script_message_router_unittest.mm b/ios/web/web_state/ui/crw_wk_script_message_router_unittest.mm
index e04c3a47..64a749f 100644
--- a/ios/web/web_state/ui/crw_wk_script_message_router_unittest.mm
+++ b/ios/web/web_state/ui/crw_wk_script_message_router_unittest.mm
@@ -7,9 +7,9 @@
 #include "base/mac/scoped_block.h"
 #import "base/mac/scoped_nsobject.h"
 #include "base/memory/ptr_util.h"
+#include "ios/web/public/test/fakes/test_browser_state.h"
+#import "ios/web/public/test/fakes/test_web_client.h"
 #include "ios/web/public/test/scoped_testing_web_client.h"
-#include "ios/web/public/test/test_browser_state.h"
-#import "ios/web/public/test/test_web_client.h"
 #include "ios/web/public/test/web_test.h"
 #import "ios/web/public/web_view_creation_util.h"
 #include "third_party/ocmock/OCMock/OCMock.h"
diff --git a/ios/web/web_state/ui/web_view_js_utils.mm b/ios/web/web_state/ui/web_view_js_utils.mm
index a626924..02e4bd91 100644
--- a/ios/web/web_state/ui/web_view_js_utils.mm
+++ b/ios/web/web_state/ui/web_view_js_utils.mm
@@ -78,7 +78,7 @@
 namespace web {
 
 NSString* const kJSEvaluationErrorDomain = @"JSEvaluationError";
-int const kMaximumParsingRecursionDepth = 6;
+int const kMaximumParsingRecursionDepth = 8;
 
 std::unique_ptr<base::Value> ValueResultFromWKResult(id wk_result) {
   return ::ValueResultFromWKResult(wk_result, kMaximumParsingRecursionDepth);
diff --git a/ios/web/web_state/ui/wk_web_view_configuration_provider_unittest.mm b/ios/web/web_state/ui/wk_web_view_configuration_provider_unittest.mm
index fa53aa7..6bac135 100644
--- a/ios/web/web_state/ui/wk_web_view_configuration_provider_unittest.mm
+++ b/ios/web/web_state/ui/wk_web_view_configuration_provider_unittest.mm
@@ -8,8 +8,8 @@
 
 #import "base/ios/weak_nsobject.h"
 #include "base/memory/ptr_util.h"
+#include "ios/web/public/test/fakes/test_browser_state.h"
 #include "ios/web/public/test/scoped_testing_web_client.h"
-#include "ios/web/public/test/test_browser_state.h"
 #import "ios/web/public/web_client.h"
 #import "ios/web/web_state/js/page_script_util.h"
 #import "ios/web/web_state/ui/crw_wk_script_message_router.h"
diff --git a/ios/web/web_state/web_state_impl_unittest.mm b/ios/web/web_state/web_state_impl_unittest.mm
index 4f9e243f..1099a04 100644
--- a/ios/web/web_state/web_state_impl_unittest.mm
+++ b/ios/web/web_state/web_state_impl_unittest.mm
@@ -17,7 +17,7 @@
 #include "base/values.h"
 #import "ios/web/public/java_script_dialog_presenter.h"
 #include "ios/web/public/load_committed_details.h"
-#include "ios/web/public/test/test_browser_state.h"
+#include "ios/web/public/test/fakes/test_browser_state.h"
 #include "ios/web/public/test/web_test.h"
 #import "ios/web/public/web_state/context_menu_params.h"
 #include "ios/web/public/web_state/global_web_state_observer.h"
diff --git a/ios/web/web_state/web_view_internal_creation_util_unittest.mm b/ios/web/web_state/web_view_internal_creation_util_unittest.mm
index 9be10dd..d9e45ac 100644
--- a/ios/web/web_state/web_view_internal_creation_util_unittest.mm
+++ b/ios/web/web_state/web_view_internal_creation_util_unittest.mm
@@ -9,9 +9,9 @@
 
 #import "base/mac/scoped_nsobject.h"
 #include "base/memory/ptr_util.h"
+#include "ios/web/public/test/fakes/test_browser_state.h"
+#import "ios/web/public/test/fakes/test_web_client.h"
 #include "ios/web/public/test/scoped_testing_web_client.h"
-#include "ios/web/public/test/test_browser_state.h"
-#import "ios/web/public/test/test_web_client.h"
 #include "ios/web/public/test/web_test.h"
 #import "ios/web/public/web_view_creation_util.h"
 #import "ios/web/web_state/ui/wk_web_view_configuration_provider.h"
diff --git a/ios/web/webui/crw_web_ui_manager.mm b/ios/web/webui/crw_web_ui_manager.mm
index fd5fa0e2..4104f5f 100644
--- a/ios/web/webui/crw_web_ui_manager.mm
+++ b/ios/web/webui/crw_web_ui_manager.mm
@@ -218,7 +218,6 @@
       {mojo::kBindingsModuleName, IDR_MOJO_BINDINGS_JS},
       {mojo::kBufferModuleName, IDR_MOJO_BUFFER_JS},
       {mojo::kCodecModuleName, IDR_MOJO_CODEC_JS},
-      {mojo::kConnectionModuleName, IDR_MOJO_CONNECTION_JS},
       {mojo::kConnectorModuleName, IDR_MOJO_CONNECTOR_JS},
       {mojo::kInterfaceTypesModuleName, IDR_MOJO_INTERFACE_TYPES_JS},
       {mojo::kRouterModuleName, IDR_MOJO_ROUTER_JS},
diff --git a/ios/web/webui/crw_web_ui_manager_unittest.mm b/ios/web/webui/crw_web_ui_manager_unittest.mm
index 79d2e425..1e51194 100644
--- a/ios/web/webui/crw_web_ui_manager_unittest.mm
+++ b/ios/web/webui/crw_web_ui_manager_unittest.mm
@@ -17,9 +17,9 @@
 #import "base/strings/sys_string_conversions.h"
 #include "base/strings/utf_string_conversions.h"
 #include "base/values.h"
+#include "ios/web/public/test/fakes/test_browser_state.h"
+#import "ios/web/public/test/fakes/test_web_client.h"
 #include "ios/web/public/test/scoped_testing_web_client.h"
-#include "ios/web/public/test/test_browser_state.h"
-#import "ios/web/public/test/test_web_client.h"
 #include "ios/web/public/test/web_test.h"
 #import "ios/web/web_state/web_state_impl.h"
 #import "ios/web/webui/crw_web_ui_page_builder.h"
diff --git a/mojo/public/js/BUILD.gn b/mojo/public/js/BUILD.gn
index 8b23be9..5b2c715 100644
--- a/mojo/public/js/BUILD.gn
+++ b/mojo/public/js/BUILD.gn
@@ -14,7 +14,6 @@
     "bindings.js",
     "buffer.js",
     "codec.js",
-    "connection.js",
     "connector.js",
     "constants.cc",
     "constants.h",
diff --git a/mojo/public/js/connection.js b/mojo/public/js/connection.js
deleted file mode 100644
index 63c6691..0000000
--- a/mojo/public/js/connection.js
+++ /dev/null
@@ -1,297 +0,0 @@
-// Copyright 2014 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-define("mojo/public/js/connection", [
-  "mojo/public/js/connector",
-  "mojo/public/js/core",
-  "mojo/public/js/router",
-], function(connector, core, router) {
-
-  // TODO(yzshen): This module should only be used by the JS bindings internally
-  // and it will be removed soon.
-
-  var Router = router.Router;
-  var TestConnector = connector.TestConnector;
-  var TestRouter = router.TestRouter;
-
-  var kProxyProperties = Symbol("proxyProperties");
-  var kStubProperties = Symbol("stubProperties");
-
-  // Public proxy class properties that are managed at runtime by the JS
-  // bindings. See ProxyBindings below.
-  function ProxyProperties(receiver) {
-    this.receiver = receiver;
-  }
-
-  // TODO(hansmuller): remove then after 'Client=' has been removed from Mojom.
-  ProxyProperties.prototype.getLocalDelegate = function() {
-    return this.local && StubBindings(this.local).delegate;
-  }
-
-  // TODO(hansmuller): remove then after 'Client=' has been removed from Mojom.
-  ProxyProperties.prototype.setLocalDelegate = function(impl) {
-    if (this.local)
-      StubBindings(this.local).delegate = impl;
-    else
-      throw new Error("no stub object");
-  }
-
-  ProxyProperties.prototype.close = function() {
-    this.connection.close();
-  }
-
-  // Public stub class properties that are managed at runtime by the JS
-  // bindings. See StubBindings below.
-  function StubProperties(delegate) {
-    this.delegate = delegate;
-  }
-
-  StubProperties.prototype.close = function() {
-    this.connection.close();
-  }
-
-  // The base class for generated proxy classes.
-  function ProxyBase(receiver) {
-    this[kProxyProperties] = new ProxyProperties(receiver);
-
-    // TODO(hansmuller): Temporary, for Chrome backwards compatibility.
-    if (receiver instanceof Router)
-      this.receiver_ = receiver;
-  }
-
-  // The base class for generated stub classes.
-  function StubBase(delegate) {
-    this[kStubProperties] = new StubProperties(delegate);
-  }
-
-  // TODO(hansmuller): remove everything except the connection property doc
-  // after 'Client=' has been removed from Mojom.
-
-  // Provides access to properties added to a proxy object without risking
-  // Mojo interface name collisions. Unless otherwise specified, the initial
-  // value of all properties is undefined.
-  //
-  // ProxyBindings(proxy).connection - The Connection object that links the
-  //   proxy for a remote Mojo service to an optional local stub for a local
-  //   service. The value of ProxyBindings(proxy).connection.remote == proxy.
-  //
-  // ProxyBindings(proxy).local  - The "local" stub object whose delegate
-  //   implements the proxy's Mojo client interface.
-  //
-  // ProxyBindings(proxy).setLocalDelegate(impl) - Sets the implementation
-  //   delegate of the proxy's client stub object. This is just shorthand
-  //   for |StubBindings(ProxyBindings(proxy).local).delegate = impl|.
-  //
-  // ProxyBindings(proxy).getLocalDelegate() - Returns the implementation
-  //   delegate of the proxy's client stub object. This is just shorthand
-  //   for |StubBindings(ProxyBindings(proxy).local).delegate|.
-
-  function ProxyBindings(proxy) {
-    return (proxy instanceof ProxyBase) ? proxy[kProxyProperties] : proxy;
-  }
-
-  // TODO(hansmuller): remove the remote doc after 'Client=' has been
-  // removed from Mojom.
-
-  // Provides access to properties added to a stub object without risking
-  // Mojo interface name collisions. Unless otherwise specified, the initial
-  // value of all properties is undefined.
-  //
-  // StubBindings(stub).delegate - The optional implementation delegate for
-  //  the Mojo interface stub.
-  //
-  // StubBindings(stub).connection - The Connection object that links an
-  //   optional proxy for a remote service to this stub. The value of
-  //   StubBindings(stub).connection.local == stub.
-  //
-  // StubBindings(stub).remote - A proxy for the the stub's Mojo client
-  //   service.
-
-  function StubBindings(stub) {
-    return stub instanceof StubBase ?  stub[kStubProperties] : stub;
-  }
-
-  // TODO(hansmuller): the proxy receiver_ property should be receiver$
-
-  function BaseConnection(localStub, remoteProxy, router) {
-    this.router_ = router;
-    this.local = localStub;
-    this.remote = remoteProxy;
-
-    this.router_.setIncomingReceiver(localStub);
-    this.router_.setErrorHandler(function() {
-      if (StubBindings(this.local) &&
-          StubBindings(this.local).connectionErrorHandler)
-        StubBindings(this.local).connectionErrorHandler();
-    }.bind(this));
-    if (this.remote)
-      this.remote.receiver_ = router;
-
-    // Validate incoming messages: remote responses and local requests.
-    var validateRequest = localStub && localStub.validator;
-    var validateResponse = remoteProxy && remoteProxy.validator;
-    var payloadValidators = [];
-    if (validateRequest)
-      payloadValidators.push(validateRequest);
-    if (validateResponse)
-      payloadValidators.push(validateResponse);
-    this.router_.setPayloadValidators(payloadValidators);
-  }
-
-  BaseConnection.prototype.close = function() {
-    this.router_.close();
-    this.router_ = null;
-    this.local = null;
-    this.remote = null;
-  };
-
-  BaseConnection.prototype.encounteredError = function() {
-    return this.router_.encounteredError();
-  };
-
-  function Connection(
-      handle, localFactory, remoteFactory, routerFactory, connectorFactory) {
-    var routerClass = routerFactory || Router;
-    var router = new routerClass(handle, connectorFactory);
-    var remoteProxy = remoteFactory && new remoteFactory(router);
-    var localStub = localFactory && new localFactory(remoteProxy);
-    BaseConnection.call(this, localStub, remoteProxy, router);
-  }
-
-  Connection.prototype = Object.create(BaseConnection.prototype);
-
-  // The TestConnection subclass is only intended to be used in unit tests.
-  function TestConnection(handle, localFactory, remoteFactory) {
-    Connection.call(this,
-                    handle,
-                    localFactory,
-                    remoteFactory,
-                    TestRouter,
-                    TestConnector);
-  }
-
-  TestConnection.prototype = Object.create(Connection.prototype);
-
-  // Return a handle for a message pipe that's connected to a proxy
-  // for remoteInterface. Used by generated code for outgoing interface&
-  // (request) parameters: the caller is given the generated proxy via
-  // |proxyCallback(proxy)| and the generated code sends the handle
-  // returned by this function.
-  function bindProxy(proxyCallback, remoteInterface) {
-    var messagePipe = core.createMessagePipe();
-    if (messagePipe.result != core.RESULT_OK)
-      throw new Error("createMessagePipe failed " + messagePipe.result);
-
-    var proxy = new remoteInterface.proxyClass;
-    var router = new Router(messagePipe.handle0);
-    var connection = new BaseConnection(undefined, proxy, router);
-    ProxyBindings(proxy).connection = connection;
-    if (proxyCallback)
-      proxyCallback(proxy);
-
-    return messagePipe.handle1;
-  }
-
-  // Return a handle and proxy for a message pipe that's connected to a proxy
-  // for remoteInterface. Used by generated code for outgoing interface&
-  // (request) parameters
-  function getProxy(remoteInterface) {
-    var messagePipe = core.createMessagePipe();
-    if (messagePipe.result != core.RESULT_OK)
-      throw new Error("createMessagePipe failed " + messagePipe.result);
-
-    var proxy = new remoteInterface.proxyClass;
-    var router = new Router(messagePipe.handle0);
-    var connection = new BaseConnection(undefined, proxy, router);
-    ProxyBindings(proxy).connection = connection;
-
-    return {
-      requestHandle: messagePipe.handle1,
-      proxy: proxy
-    };
-  }
-
-  // Return a handle for a message pipe that's connected to a stub for
-  // localInterface. Used by generated code for outgoing interface
-  // parameters: the caller  is given the generated stub via
-  // |stubCallback(stub)| and the generated code sends the handle
-  // returned by this function. The caller is responsible for managing
-  // the lifetime of the stub and for setting it's implementation
-  // delegate with: StubBindings(stub).delegate = myImpl;
-  function bindImpl(stubCallback, localInterface) {
-    var messagePipe = core.createMessagePipe();
-    if (messagePipe.result != core.RESULT_OK)
-      throw new Error("createMessagePipe failed " + messagePipe.result);
-
-    var stub = new localInterface.stubClass;
-    var router = new Router(messagePipe.handle0);
-    var connection = new BaseConnection(stub, undefined, router);
-    StubBindings(stub).connection = connection;
-    if (stubCallback)
-      stubCallback(stub);
-
-    return messagePipe.handle1;
-  }
-
-  // Return a remoteInterface proxy for handle. Used by generated code
-  // for converting incoming interface parameters to proxies.
-  function bindHandleToProxy(handle, remoteInterface) {
-    if (!core.isHandle(handle))
-      throw new Error("Not a handle " + handle);
-
-    var proxy = new remoteInterface.proxyClass;
-    var router = new Router(handle);
-    var connection = new BaseConnection(undefined, proxy, router);
-    ProxyBindings(proxy).connection = connection;
-    return proxy;
-  }
-
-  // Return a localInterface stub for handle. Used by generated code
-  // for converting incoming interface& request parameters to localInterface
-  // stubs. The caller can specify the stub's implementation of localInterface
-  // like this: StubBindings(stub).delegate = myStubImpl.
-  function bindHandleToStub(handle, localInterface) {
-    if (!core.isHandle(handle))
-      throw new Error("Not a handle " + handle);
-
-    var stub = new localInterface.stubClass;
-    var router = new Router(handle);
-    var connection = new BaseConnection(stub, undefined, router);
-    StubBindings(stub).connection = connection;
-    return stub;
-  }
-
-  /**
-   * Creates a messape pipe and links one end of the pipe to the given object.
-   * @param {!Object} obj The object to create a handle for. Must be a subclass
-   *     of an auto-generated stub class.
-   * @return {!MojoHandle} The other (not yet connected) end of the message
-   *     pipe.
-   */
-  function bindStubDerivedImpl(obj) {
-    var pipe = core.createMessagePipe();
-    var router = new Router(pipe.handle0);
-    var connection = new BaseConnection(obj, undefined, router);
-    obj.connection = connection;
-    return pipe.handle1;
-  }
-
-  var exports = {};
-  exports.Connection = Connection;
-  exports.EmptyProxy = ProxyBase;
-  exports.EmptyStub = StubBase;
-  exports.ProxyBase = ProxyBase;
-  exports.ProxyBindings = ProxyBindings;
-  exports.StubBase = StubBase;
-  exports.StubBindings = StubBindings;
-  exports.TestConnection = TestConnection;
-
-  exports.bindProxy = bindProxy;
-  exports.getProxy = getProxy;
-  exports.bindImpl = bindImpl;
-  exports.bindHandleToProxy = bindHandleToProxy;
-  exports.bindHandleToStub = bindHandleToStub;
-  exports.bindStubDerivedImpl = bindStubDerivedImpl;
-  return exports;
-});
diff --git a/mojo/public/js/constants.cc b/mojo/public/js/constants.cc
index 2c9b9802..7c7b64e 100644
--- a/mojo/public/js/constants.cc
+++ b/mojo/public/js/constants.cc
@@ -9,7 +9,6 @@
 const char kBindingsModuleName[] = "mojo/public/js/bindings";
 const char kBufferModuleName[] = "mojo/public/js/buffer";
 const char kCodecModuleName[] = "mojo/public/js/codec";
-const char kConnectionModuleName[] = "mojo/public/js/connection";
 const char kConnectorModuleName[] = "mojo/public/js/connector";
 const char kInterfaceTypesModuleName[] = "mojo/public/js/interface_types";
 const char kRouterModuleName[] = "mojo/public/js/router";
diff --git a/mojo/public/js/constants.h b/mojo/public/js/constants.h
index c7cd9911..b8baa98 100644
--- a/mojo/public/js/constants.h
+++ b/mojo/public/js/constants.h
@@ -11,7 +11,6 @@
 extern const char kBindingsModuleName[];
 extern const char kBufferModuleName[];
 extern const char kCodecModuleName[];
-extern const char kConnectionModuleName[];
 extern const char kConnectorModuleName[];
 extern const char kInterfaceTypesModuleName[];
 extern const char kRouterModuleName[];
diff --git a/net/http2/hpack/decoder/hpack_decoder_string_buffer.cc b/net/http2/hpack/decoder/hpack_decoder_string_buffer.cc
index 90d0336..32758cf 100644
--- a/net/http2/hpack/decoder/hpack_decoder_string_buffer.cc
+++ b/net/http2/hpack/decoder/hpack_decoder_string_buffer.cc
@@ -7,6 +7,7 @@
 #include "base/logging.h"
 
 using base::StringPiece;
+using std::string;
 
 namespace net {
 
@@ -40,50 +41,41 @@
   }
 }
 
-HpackDecoderStringBuffer::HpackDecoderStringBuffer() {
-  Reset();
-}
+HpackDecoderStringBuffer::HpackDecoderStringBuffer()
+    : remaining_len_(0),
+      is_huffman_encoded_(false),
+      state_(State::RESET),
+      backing_(Backing::RESET) {}
 HpackDecoderStringBuffer::~HpackDecoderStringBuffer() {}
 
-// TODO(jamessynge): Consider eliminating most of Reset (i.e. do less); in
-// particular, if a variable won't be read again until after it is next set
-// (e.g. is_huffman_encoded_ or remaining_len_), then it doesn't need to be
-// cleared here. This will be easier when not supporting both HpackDecoder2
-// (in net/spdy/hpack) and HpackWholeEntryDecoder, so we can eliminate
-// the Set() and str() methods.
 void HpackDecoderStringBuffer::Reset() {
   DVLOG(3) << "HpackDecoderStringBuffer::Reset";
-  buffer_.clear();
-  value_.clear();
-  remaining_len_ = 0;
-  is_huffman_encoded_ = false;
   state_ = State::RESET;
-  backing_ = Backing::RESET;
 }
 
 void HpackDecoderStringBuffer::Set(StringPiece value, bool is_static) {
   DVLOG(2) << "HpackDecoderStringBuffer::Set";
   DCHECK_EQ(state_, State::RESET);
-  DCHECK_EQ(backing_, Backing::RESET);
   value_ = value;
   state_ = State::COMPLETE;
   backing_ = is_static ? Backing::STATIC : Backing::UNBUFFERED;
+  // TODO(jamessynge): Determine which of these two fields must be set.
+  remaining_len_ = 0;
+  is_huffman_encoded_ = false;
 }
 
 void HpackDecoderStringBuffer::OnStart(bool huffman_encoded, size_t len) {
   DVLOG(2) << "HpackDecoderStringBuffer::OnStart";
   DCHECK_EQ(state_, State::RESET);
-  DCHECK_EQ(backing_, Backing::RESET);
-  buffer_.clear();
-  value_.clear();
 
   remaining_len_ = len;
   is_huffman_encoded_ = huffman_encoded;
-
   state_ = State::COLLECTING;
 
   if (huffman_encoded) {
+    // We don't set, clear or use value_ for buffered strings until OnEnd.
     decoder_.Reset();
+    buffer_.clear();
     backing_ = Backing::BUFFERED;
 
     // Reserve space in buffer_ for the uncompressed string, assuming the
@@ -99,6 +91,9 @@
     // Assume for now that we won't need to use buffer_, so don't reserve space
     // in it.
     backing_ = Backing::RESET;
+    // OnData is not called for empty (zero length) strings, so make sure that
+    // value_ is cleared.
+    value_ = StringPiece();
   }
 }
 
@@ -111,19 +106,13 @@
 
   if (is_huffman_encoded_) {
     DCHECK_EQ(backing_, Backing::BUFFERED);
-    // We don't set value_ for buffered strings until OnEnd,
-    // so it should be empty.
-    DCHECK_EQ(0u, value_.size());
     return decoder_.Decode(StringPiece(data, len), &buffer_);
   }
 
   if (backing_ == Backing::RESET) {
-    // This is the first call to OnData.
-    DCHECK_EQ(0u, buffer_.size());
-    DCHECK_EQ(0u, value_.size());
-    // If data contains the entire string, don't copy the string. If we later
-    // find that the HPACK entry is split across input buffers, then we'll
-    // copy the string into buffer_.
+    // This is the first call to OnData. If data contains the entire string,
+    // don't copy the string. If we later find that the HPACK entry is split
+    // across input buffers, then we'll copy the string into buffer_.
     if (remaining_len_ == 0) {
       value_ = StringPiece(data, len);
       backing_ = Backing::UNBUFFERED;
@@ -131,7 +120,9 @@
     }
 
     // We need to buffer the string because it is split across input buffers.
+    // Reserve space in buffer_ for the entire string.
     backing_ = Backing::BUFFERED;
+    buffer_.reserve(remaining_len_ + len);
     buffer_.assign(data, len);
     return true;
   }
@@ -139,9 +130,6 @@
   // This is not the first call to OnData for this string, so it should be
   // buffered.
   DCHECK_EQ(backing_, Backing::BUFFERED);
-  // We don't set value_ for buffered strings until OnEnd, so it should be
-  // empty.
-  DCHECK_EQ(0u, value_.size());
 
   // Append to the current contents of the buffer.
   buffer_.append(data, len);
@@ -159,11 +147,11 @@
     if (!decoder_.InputProperlyTerminated()) {
       return false;  // No, it didn't.
     }
-  }
-  state_ = State::COMPLETE;
-  if (backing_ == Backing::BUFFERED) {
+    value_ = buffer_;
+  } else if (backing_ == Backing::BUFFERED) {
     value_ = buffer_;
   }
+  state_ = State::COMPLETE;
   return true;
 }
 
@@ -181,9 +169,14 @@
   }
 }
 
+bool HpackDecoderStringBuffer::IsBuffered() const {
+  DVLOG(3) << "HpackDecoderStringBuffer::IsBuffered";
+  return state_ != State::RESET && backing_ == Backing::BUFFERED;
+}
+
 size_t HpackDecoderStringBuffer::BufferedLength() const {
   DVLOG(3) << "HpackDecoderStringBuffer::BufferedLength";
-  return backing_ == Backing::BUFFERED ? buffer_.size() : 0;
+  return IsBuffered() ? buffer_.size() : 0;
 }
 
 StringPiece HpackDecoderStringBuffer::str() const {
@@ -192,6 +185,21 @@
   return value_;
 }
 
+string HpackDecoderStringBuffer::ReleaseString() {
+  DVLOG(3) << "HpackDecoderStringBuffer::ReleaseString";
+  DCHECK_EQ(state_, State::COMPLETE);
+  DCHECK_EQ(backing_, Backing::BUFFERED);
+  if (state_ == State::COMPLETE) {
+    state_ = State::RESET;
+    if (backing_ == Backing::BUFFERED) {
+      return std::move(buffer_);
+    } else {
+      return value_.as_string();
+    }
+  }
+  return "";
+}
+
 void HpackDecoderStringBuffer::OutputDebugStringTo(std::ostream& out) const {
   out << "{state=" << state_;
   if (state_ != State::RESET) {
diff --git a/net/http2/hpack/decoder/hpack_decoder_string_buffer.h b/net/http2/hpack/decoder/hpack_decoder_string_buffer.h
index a0917a2..8544941 100644
--- a/net/http2/hpack/decoder/hpack_decoder_string_buffer.h
+++ b/net/http2/hpack/decoder/hpack_decoder_string_buffer.h
@@ -39,10 +39,25 @@
   bool OnData(const char* data, size_t len);
   bool OnEnd();
   void BufferStringIfUnbuffered();
+  bool IsBuffered() const;
   size_t BufferedLength() const;
 
+  // Accessors for the completely collected string (i.e. Set or OnEnd has just
+  // been called, and no reset of the state has occurred).
+
+  // Returns a StringPiece pointing to the backing store for the string, either
+  // the internal buffer or the original transport buffer (e.g. for a literal
+  // value that wasn't Huffman encoded, and that wasn't split across transport
+  // buffers).
   base::StringPiece str() const;
 
+  // Returns the completely collected string by value, using std::move in an
+  // effort to avoid unnecessary copies. ReleaseString() must not be called
+  // unless the string has been buffered (to avoid forcing a potentially
+  // unnecessary copy). ReleaseString() also resets the instance so that it can
+  // be used to collect another string.
+  std::string ReleaseString();
+
   State state_for_testing() const { return state_; }
   Backing backing_for_testing() const { return backing_; }
   void OutputDebugStringTo(std::ostream& out) const;
@@ -60,10 +75,10 @@
   HpackHuffmanDecoder decoder_;
 
   // Count of bytes not yet passed to OnData.
-  size_t remaining_len_ = 0;
+  size_t remaining_len_;
 
   // Is the HPACK string Huffman encoded?
-  bool is_huffman_encoded_ = false;
+  bool is_huffman_encoded_;
 
   // State of the string decoding process.
   State state_;
diff --git a/net/http2/hpack/decoder/hpack_decoder_string_buffer_test.cc b/net/http2/hpack/decoder/hpack_decoder_string_buffer_test.cc
index bcf1f356..1efb113 100644
--- a/net/http2/hpack/decoder/hpack_decoder_string_buffer_test.cc
+++ b/net/http2/hpack/decoder/hpack_decoder_string_buffer_test.cc
@@ -174,6 +174,10 @@
   EXPECT_EQ(decoded, buf_.str());
   EXPECT_TRUE(VerifyLogHasSubstrs(
       {"{state=COMPLETE", "backing=BUFFERED", "buffer: www.example.com}"}));
+
+  string s = buf_.ReleaseString();
+  EXPECT_EQ(s, decoded);
+  EXPECT_EQ(state(), State::RESET);
 }
 
 TEST_F(HpackDecoderStringBufferTest, HuffmanSplit) {
@@ -208,6 +212,10 @@
   EXPECT_EQ(buf_.BufferedLength(), decoded.size());
   EXPECT_EQ(decoded, buf_.str());
   LOG(INFO) << buf_;
+
+  buf_.Reset();
+  EXPECT_EQ(state(), State::RESET);
+  LOG(INFO) << buf_;
 }
 
 TEST_F(HpackDecoderStringBufferTest, InvalidHuffmanOnData) {
@@ -239,6 +247,8 @@
   LOG(INFO) << buf_;
 }
 
+// TODO(jamessynge): Add tests for ReleaseString().
+
 }  // namespace
 }  // namespace test
 }  // namespace net
diff --git a/skia/config/SkUserConfig.h b/skia/config/SkUserConfig.h
index 94034ad..1bb8e1a 100644
--- a/skia/config/SkUserConfig.h
+++ b/skia/config/SkUserConfig.h
@@ -212,10 +212,6 @@
 #   define SK_IGNORE_GPU_DITHER
 #endif
 
-#ifndef    SK_SUPPORT_LEGACY_EVAL_CUBIC
-#   define SK_SUPPORT_LEGACY_EVAL_CUBIC
-#endif
-
 #ifndef    SK_DISABLE_COLOR_XFORM_PIPELINE
 #   define SK_DISABLE_COLOR_XFORM_PIPELINE
 #endif
diff --git a/testing/buildbot/chromium.android.fyi.json b/testing/buildbot/chromium.android.fyi.json
index 569c9459..a2d037a 100644
--- a/testing/buildbot/chromium.android.fyi.json
+++ b/testing/buildbot/chromium.android.fyi.json
@@ -8,9 +8,6 @@
         "test": "base_unittests"
       },
       {
-        "test": "blimp_unittests"
-      },
-      {
         "override_compile_targets": [
           "breakpad_unittests_deps"
         ],
@@ -91,14 +88,6 @@
     ],
     "instrumentation_tests": [
       {
-        "apk_under_test": "Blimp.apk",
-        "override_compile_targets": [
-          "blimp_test_apk"
-        ],
-        "test": "blimp_test_apk",
-        "test_apk": "BlimpTest.apk"
-      },
-      {
         "test": "chrome_public_test_apk"
       },
       {
@@ -118,9 +107,6 @@
         "test": "base_unittests"
       },
       {
-        "test": "blimp_unittests"
-      },
-      {
         "override_compile_targets": [
           "breakpad_unittests_deps"
         ],
@@ -204,14 +190,6 @@
         "test": "android_webview_test_apk"
       },
       {
-        "apk_under_test": "Blimp.apk",
-        "override_compile_targets": [
-          "blimp_test_apk"
-        ],
-        "test": "blimp_test_apk",
-        "test_apk": "BlimpTest.apk"
-      },
-      {
         "test": "chrome_public_test_apk"
       },
       {
@@ -231,9 +209,6 @@
         "test": "base_unittests"
       },
       {
-        "test": "blimp_unittests"
-      },
-      {
         "override_compile_targets": [
           "breakpad_unittests_deps"
         ],
@@ -326,13 +301,6 @@
         "timeout_scale": 4
       },
       {
-        "override_compile_targets": [
-          "blimp_test_apk"
-        ],
-        "test": "blimp_test_apk",
-        "timeout_scale": 4
-      },
-      {
         "test": "chrome_public_test_apk",
         "timeout_scale": 4
       },
@@ -1406,12 +1374,6 @@
         "test": "base_unittests"
       },
       {
-        "swarming": {
-          "can_use_on_swarming_builders": false
-        },
-        "test": "blimp_unittests"
-      },
-      {
         "override_compile_targets": [
           "breakpad_unittests_deps"
         ],
@@ -1575,12 +1537,6 @@
         "test": "android_webview_test_apk"
       },
       {
-        "override_compile_targets": [
-          "blimp_test_apk"
-        ],
-        "test": "blimp_test_apk"
-      },
-      {
         "test": "chrome_public_test_apk"
       },
       {
@@ -1612,12 +1568,6 @@
         "test": "base_unittests"
       },
       {
-        "swarming": {
-          "can_use_on_swarming_builders": false
-        },
-        "test": "blimp_unittests"
-      },
-      {
         "override_compile_targets": [
           "breakpad_unittests_deps"
         ],
@@ -1781,12 +1731,6 @@
         "test": "android_webview_test_apk"
       },
       {
-        "override_compile_targets": [
-          "blimp_test_apk"
-        ],
-        "test": "blimp_test_apk"
-      },
-      {
         "test": "chrome_public_test_apk"
       },
       {
diff --git a/testing/buildbot/chromium.android.json b/testing/buildbot/chromium.android.json
index cfcafa1..73f97b4c 100644
--- a/testing/buildbot/chromium.android.json
+++ b/testing/buildbot/chromium.android.json
@@ -104,72 +104,6 @@
         "test": "base_unittests"
       },
       {
-        "override_compile_targets": [
-          "blimp_test_apk"
-        ],
-        "override_isolate_target": "blimp_test_apk",
-        "swarming": {
-          "can_use_on_swarming_builders": true,
-          "cipd_packages": [
-            {
-              "cipd_package": "infra/tools/luci/logdog/butler/${platform}",
-              "location": "bin",
-              "revision": "git_revision:25755a2c316937ee44a6432163dc5e2f9c85cf58"
-            }
-          ],
-          "dimension_sets": [
-            {
-              "android_devices": "4",
-              "device_os": "MMB29Q",
-              "device_type": "bullhead"
-            }
-          ],
-          "hard_timeout": 960,
-          "output_links": [
-            {
-              "link": [
-                "https://luci-logdog.appspot.com/v/?s",
-                "=android%2Fswarming%2Flogcats%2F",
-                "${TASK_ID}%2F%2B%2Funified_logcats"
-              ],
-              "name": "shard #${SHARD_INDEX} logcats"
-            }
-          ]
-        },
-        "test": "blimp_test_apk"
-      },
-      {
-        "override_isolate_target": "blimp_unittests",
-        "swarming": {
-          "can_use_on_swarming_builders": true,
-          "cipd_packages": [
-            {
-              "cipd_package": "infra/tools/luci/logdog/butler/${platform}",
-              "location": "bin",
-              "revision": "git_revision:25755a2c316937ee44a6432163dc5e2f9c85cf58"
-            }
-          ],
-          "dimension_sets": [
-            {
-              "android_devices": "4",
-              "device_os": "MMB29Q",
-              "device_type": "bullhead"
-            }
-          ],
-          "output_links": [
-            {
-              "link": [
-                "https://luci-logdog.appspot.com/v/?s",
-                "=android%2Fswarming%2Flogcats%2F",
-                "${TASK_ID}%2F%2B%2Funified_logcats"
-              ],
-              "name": "shard #${SHARD_INDEX} logcats"
-            }
-          ]
-        },
-        "test": "blimp_unittests"
-      },
-      {
         "override_isolate_target": "blink_heap_unittests",
         "swarming": {
           "can_use_on_swarming_builders": true,
@@ -1216,9 +1150,6 @@
         "test": "base_unittests"
       },
       {
-        "test": "blimp_unittests"
-      },
-      {
         "override_compile_targets": [
           "breakpad_unittests_deps"
         ],
@@ -1305,14 +1236,6 @@
         "test": "android_webview_test_apk"
       },
       {
-        "apk_under_test": "Blimp.apk",
-        "override_compile_targets": [
-          "blimp_test_apk"
-        ],
-        "test": "blimp_test_apk",
-        "test_apk": "BlimpTest.apk"
-      },
-      {
         "test": "chrome_public_test_apk"
       },
       {
@@ -1392,39 +1315,6 @@
         "test": "base_unittests"
       },
       {
-        "override_isolate_target": "blimp_unittests",
-        "swarming": {
-          "can_use_on_swarming_builders": true,
-          "cipd_packages": [
-            {
-              "cipd_package": "infra/tools/luci/logdog/butler/${platform}",
-              "location": "bin",
-              "revision": "git_revision:25755a2c316937ee44a6432163dc5e2f9c85cf58"
-            }
-          ],
-          "dimension_sets": [
-            {
-              "android_devices": "4",
-              "device_os": "LMY48I",
-              "device_type": "hammerhead"
-            }
-          ],
-          "expiration": 10800,
-          "hard_timeout": 960,
-          "output_links": [
-            {
-              "link": [
-                "https://luci-logdog.appspot.com/v/?s",
-                "=android%2Fswarming%2Flogcats%2F",
-                "${TASK_ID}%2F%2B%2Funified_logcats"
-              ],
-              "name": "shard #${SHARD_INDEX} logcats"
-            }
-          ]
-        },
-        "test": "blimp_unittests"
-      },
-      {
         "override_compile_targets": [
           "breakpad_unittests_deps"
         ],
@@ -2293,42 +2183,6 @@
       },
       {
         "override_compile_targets": [
-          "blimp_test_apk"
-        ],
-        "override_isolate_target": "blimp_test_apk",
-        "swarming": {
-          "can_use_on_swarming_builders": true,
-          "cipd_packages": [
-            {
-              "cipd_package": "infra/tools/luci/logdog/butler/${platform}",
-              "location": "bin",
-              "revision": "git_revision:25755a2c316937ee44a6432163dc5e2f9c85cf58"
-            }
-          ],
-          "dimension_sets": [
-            {
-              "android_devices": "4",
-              "device_os": "LMY48I",
-              "device_type": "hammerhead"
-            }
-          ],
-          "expiration": 10800,
-          "hard_timeout": 960,
-          "output_links": [
-            {
-              "link": [
-                "https://luci-logdog.appspot.com/v/?s",
-                "=android%2Fswarming%2Flogcats%2F",
-                "${TASK_ID}%2F%2B%2Funified_logcats"
-              ],
-              "name": "shard #${SHARD_INDEX} logcats"
-            }
-          ]
-        },
-        "test": "blimp_test_apk"
-      },
-      {
-        "override_compile_targets": [
           "chrome_public_test_apk"
         ],
         "override_isolate_target": "chrome_public_test_apk",
@@ -2446,9 +2300,6 @@
         "test": "base_unittests"
       },
       {
-        "test": "blimp_unittests"
-      },
-      {
         "override_compile_targets": [
           "breakpad_unittests_deps"
         ],
@@ -2535,14 +2386,6 @@
         "test": "android_webview_test_apk"
       },
       {
-        "apk_under_test": "Blimp.apk",
-        "override_compile_targets": [
-          "blimp_test_apk"
-        ],
-        "test": "blimp_test_apk",
-        "test_apk": "BlimpTest.apk"
-      },
-      {
         "test": "chrome_public_test_apk"
       },
       {
@@ -2652,71 +2495,6 @@
         "test": "base_unittests"
       },
       {
-        "override_compile_targets": [
-          "blimp_test_apk"
-        ],
-        "override_isolate_target": "blimp_test_apk",
-        "swarming": {
-          "can_use_on_swarming_builders": true,
-          "cipd_packages": [
-            {
-              "cipd_package": "infra/tools/luci/logdog/butler/${platform}",
-              "location": "bin",
-              "revision": "git_revision:25755a2c316937ee44a6432163dc5e2f9c85cf58"
-            }
-          ],
-          "dimension_sets": [
-            {
-              "device_os": "MMB29Q",
-              "device_type": "bullhead"
-            }
-          ],
-          "hard_timeout": 600,
-          "output_links": [
-            {
-              "link": [
-                "https://luci-logdog.appspot.com/v/?s",
-                "=android%2Fswarming%2Flogcats%2F",
-                "${TASK_ID}%2F%2B%2Funified_logcats"
-              ],
-              "name": "shard #${SHARD_INDEX} logcats"
-            }
-          ]
-        },
-        "test": "blimp_test_apk"
-      },
-      {
-        "override_isolate_target": "blimp_unittests",
-        "swarming": {
-          "can_use_on_swarming_builders": true,
-          "cipd_packages": [
-            {
-              "cipd_package": "infra/tools/luci/logdog/butler/${platform}",
-              "location": "bin",
-              "revision": "git_revision:25755a2c316937ee44a6432163dc5e2f9c85cf58"
-            }
-          ],
-          "dimension_sets": [
-            {
-              "device_os": "MMB29Q",
-              "device_type": "bullhead"
-            }
-          ],
-          "hard_timeout": 960,
-          "output_links": [
-            {
-              "link": [
-                "https://luci-logdog.appspot.com/v/?s",
-                "=android%2Fswarming%2Flogcats%2F",
-                "${TASK_ID}%2F%2B%2Funified_logcats"
-              ],
-              "name": "shard #${SHARD_INDEX} logcats"
-            }
-          ]
-        },
-        "test": "blimp_unittests"
-      },
-      {
         "override_isolate_target": "blink_heap_unittests",
         "swarming": {
           "can_use_on_swarming_builders": true,
@@ -3672,9 +3450,6 @@
         "test": "base_unittests"
       },
       {
-        "test": "blimp_unittests"
-      },
-      {
         "override_compile_targets": [
           "breakpad_unittests_deps"
         ],
@@ -3761,14 +3536,6 @@
         "test": "android_webview_test_apk"
       },
       {
-        "apk_under_test": "Blimp.apk",
-        "override_compile_targets": [
-          "blimp_test_apk"
-        ],
-        "test": "blimp_test_apk",
-        "test_apk": "BlimpTest.apk"
-      },
-      {
         "test": "chrome_public_test_apk"
       },
       {
diff --git a/testing/buildbot/chromium.fyi.json b/testing/buildbot/chromium.fyi.json
index c4e9c24..c3cde1d0 100644
--- a/testing/buildbot/chromium.fyi.json
+++ b/testing/buildbot/chromium.fyi.json
@@ -265,36 +265,6 @@
         "test": "base_unittests"
       },
       {
-        "override_compile_targets": [
-          "blimp_test_apk"
-        ],
-        "override_isolate_target": "blimp_test_apk",
-        "swarming": {
-          "can_use_on_swarming_builders": true,
-          "dimension_sets": [
-            {
-              "android_devices": "4",
-              "device_type": "gce_x86"
-            }
-          ],
-          "hard_timeout": 600
-        },
-        "test": "blimp_test_apk"
-      },
-      {
-        "override_isolate_target": "blimp_unittests",
-        "swarming": {
-          "can_use_on_swarming_builders": true,
-          "dimension_sets": [
-            {
-              "android_devices": "4",
-              "device_type": "gce_x86"
-            }
-          ]
-        },
-        "test": "blimp_unittests"
-      },
-      {
         "override_isolate_target": "blink_heap_unittests",
         "swarming": {
           "can_use_on_swarming_builders": true,
@@ -936,35 +906,6 @@
         "test": "base_unittests"
       },
       {
-        "override_compile_targets": [
-          "blimp_test_apk"
-        ],
-        "override_isolate_target": "blimp_test_apk",
-        "swarming": {
-          "can_use_on_swarming_builders": true,
-          "dimension_sets": [
-            {
-              "android_devices": "1",
-              "device_type": "coho"
-            }
-          ]
-        },
-        "test": "blimp_test_apk"
-      },
-      {
-        "override_isolate_target": "blimp_unittests",
-        "swarming": {
-          "can_use_on_swarming_builders": true,
-          "dimension_sets": [
-            {
-              "android_devices": "1",
-              "device_type": "coho"
-            }
-          ]
-        },
-        "test": "blimp_unittests"
-      },
-      {
         "override_isolate_target": "blink_heap_unittests",
         "swarming": {
           "can_use_on_swarming_builders": true,
@@ -1573,122 +1514,6 @@
       }
     ]
   },
-  "Blimp Android Client": {
-    "gtest_tests": [
-      {
-        "override_compile_targets": [
-          "blimp_test_apk"
-        ],
-        "override_isolate_target": "blimp_test_apk",
-        "swarming": {
-          "can_use_on_swarming_builders": true,
-          "cipd_packages": [
-            {
-              "cipd_package": "infra/tools/luci/logdog/butler/${platform}",
-              "location": "bin",
-              "revision": "git_revision:25755a2c316937ee44a6432163dc5e2f9c85cf58"
-            }
-          ],
-          "dimension_sets": [
-            {
-              "android_devices": "4",
-              "device_os": "MMB29Q",
-              "device_type": "bullhead"
-            }
-          ],
-          "hard_timeout": 960,
-          "output_links": [
-            {
-              "link": [
-                "https://luci-logdog.appspot.com/v/?s",
-                "=android%2Fswarming%2Flogcats%2F",
-                "${TASK_ID}%2F%2B%2Funified_logcats"
-              ],
-              "name": "shard #${SHARD_INDEX} logcats"
-            }
-          ]
-        },
-        "test": "blimp_test_apk"
-      },
-      {
-        "override_isolate_target": "blimp_unittests",
-        "swarming": {
-          "can_use_on_swarming_builders": true,
-          "cipd_packages": [
-            {
-              "cipd_package": "infra/tools/luci/logdog/butler/${platform}",
-              "location": "bin",
-              "revision": "git_revision:25755a2c316937ee44a6432163dc5e2f9c85cf58"
-            }
-          ],
-          "dimension_sets": [
-            {
-              "android_devices": "4",
-              "device_os": "MMB29Q",
-              "device_type": "bullhead"
-            }
-          ],
-          "output_links": [
-            {
-              "link": [
-                "https://luci-logdog.appspot.com/v/?s",
-                "=android%2Fswarming%2Flogcats%2F",
-                "${TASK_ID}%2F%2B%2Funified_logcats"
-              ],
-              "name": "shard #${SHARD_INDEX} logcats"
-            }
-          ]
-        },
-        "test": "blimp_unittests"
-      }
-    ]
-  },
-  "Blimp Linux Engine": {
-    "gtest_tests": [
-      {
-        "swarming": {
-          "can_use_on_swarming_builders": true
-        },
-        "test": "base_unittests"
-      },
-      {
-        "swarming": {
-          "can_use_on_swarming_builders": true
-        },
-        "test": "blimp_browsertests"
-      },
-      {
-        "swarming": {
-          "can_use_on_swarming_builders": true
-        },
-        "test": "blimp_unittests"
-      },
-      {
-        "swarming": {
-          "can_use_on_swarming_builders": true
-        },
-        "test": "content_unittests"
-      },
-      {
-        "swarming": {
-          "can_use_on_swarming_builders": true
-        },
-        "test": "ipc_tests"
-      },
-      {
-        "swarming": {
-          "can_use_on_swarming_builders": true
-        },
-        "test": "net_unittests"
-      },
-      {
-        "swarming": {
-          "can_use_on_swarming_builders": true
-        },
-        "test": "sandbox_linux_unittests"
-      }
-    ]
-  },
   "Browser Side Navigation Linux": {
     "gtest_tests": [
       {
@@ -1778,12 +1603,6 @@
         "swarming": {
           "can_use_on_swarming_builders": true
         },
-        "test": "blimp_unittests"
-      },
-      {
-        "swarming": {
-          "can_use_on_swarming_builders": true
-        },
         "test": "blink_heap_unittests"
       },
       {
@@ -2161,12 +1980,6 @@
         "swarming": {
           "can_use_on_swarming_builders": true
         },
-        "test": "blimp_unittests"
-      },
-      {
-        "swarming": {
-          "can_use_on_swarming_builders": true
-        },
         "test": "blink_heap_unittests"
       },
       {
@@ -3774,35 +3587,6 @@
         "test": "base_unittests"
       },
       {
-        "override_compile_targets": [
-          "blimp_test_apk"
-        ],
-        "override_isolate_target": "blimp_test_apk",
-        "swarming": {
-          "can_use_on_swarming_builders": true,
-          "dimension_sets": [
-            {
-              "android_devices": "1",
-              "device_type": "coho"
-            }
-          ]
-        },
-        "test": "blimp_test_apk"
-      },
-      {
-        "override_isolate_target": "blimp_unittests",
-        "swarming": {
-          "can_use_on_swarming_builders": true,
-          "dimension_sets": [
-            {
-              "android_devices": "1",
-              "device_type": "coho"
-            }
-          ]
-        },
-        "test": "blimp_unittests"
-      },
-      {
         "override_isolate_target": "blink_heap_unittests",
         "swarming": {
           "can_use_on_swarming_builders": true,
@@ -11352,12 +11136,6 @@
         "swarming": {
           "can_use_on_swarming_builders": true
         },
-        "test": "blimp_unittests"
-      },
-      {
-        "swarming": {
-          "can_use_on_swarming_builders": true
-        },
         "test": "blink_heap_unittests"
       },
       {
@@ -12986,23 +12764,6 @@
         "args": [
           "--test-arguments=--site-per-process"
         ],
-        "name": "site_per_process_blimp_unittests",
-        "override_isolate_target": "blimp_unittests",
-        "swarming": {
-          "can_use_on_swarming_builders": true,
-          "dimension_sets": [
-            {
-              "android_devices": "4",
-              "device_type": "bullhead"
-            }
-          ]
-        },
-        "test": "blimp_unittests"
-      },
-      {
-        "args": [
-          "--test-arguments=--site-per-process"
-        ],
         "name": "site_per_process_components_browsertests",
         "override_isolate_target": "components_browsertests",
         "swarming": {
@@ -13048,15 +12809,6 @@
       },
       {
         "args": [
-          "--site-per-process"
-        ],
-        "swarming": {
-          "can_use_on_swarming_builders": true
-        },
-        "test": "blimp_unittests"
-      },
-      {
-        "args": [
           "--site-per-process",
           "--test-launcher-filter-file=../../testing/buildbot/filters/site-per-process.browser_tests.filter"
         ],
@@ -13318,12 +13070,6 @@
         "swarming": {
           "can_use_on_swarming_builders": true
         },
-        "test": "blimp_unittests"
-      },
-      {
-        "swarming": {
-          "can_use_on_swarming_builders": true
-        },
         "test": "blink_heap_unittests"
       },
       {
@@ -13680,12 +13426,6 @@
         "swarming": {
           "can_use_on_swarming_builders": true
         },
-        "test": "blimp_unittests"
-      },
-      {
-        "swarming": {
-          "can_use_on_swarming_builders": true
-        },
         "test": "blink_heap_unittests"
       },
       {
diff --git a/testing/buildbot/chromium.linux.json b/testing/buildbot/chromium.linux.json
index 84215c51..e71cdc8 100644
--- a/testing/buildbot/chromium.linux.json
+++ b/testing/buildbot/chromium.linux.json
@@ -120,72 +120,6 @@
         "test": "base_unittests"
       },
       {
-        "override_compile_targets": [
-          "blimp_test_apk"
-        ],
-        "override_isolate_target": "blimp_test_apk",
-        "swarming": {
-          "can_use_on_swarming_builders": true,
-          "cipd_packages": [
-            {
-              "cipd_package": "infra/tools/luci/logdog/butler/${platform}",
-              "location": "bin",
-              "revision": "git_revision:25755a2c316937ee44a6432163dc5e2f9c85cf58"
-            }
-          ],
-          "dimension_sets": [
-            {
-              "android_devices": "4",
-              "device_os": "KTU84P",
-              "device_type": "hammerhead"
-            }
-          ],
-          "hard_timeout": 600,
-          "output_links": [
-            {
-              "link": [
-                "https://luci-logdog.appspot.com/v/?s",
-                "=android%2Fswarming%2Flogcats%2F",
-                "${TASK_ID}%2F%2B%2Funified_logcats"
-              ],
-              "name": "shard #${SHARD_INDEX} logcats"
-            }
-          ]
-        },
-        "test": "blimp_test_apk"
-      },
-      {
-        "override_isolate_target": "blimp_unittests",
-        "swarming": {
-          "can_use_on_swarming_builders": true,
-          "cipd_packages": [
-            {
-              "cipd_package": "infra/tools/luci/logdog/butler/${platform}",
-              "location": "bin",
-              "revision": "git_revision:25755a2c316937ee44a6432163dc5e2f9c85cf58"
-            }
-          ],
-          "dimension_sets": [
-            {
-              "android_devices": "4",
-              "device_os": "KTU84P",
-              "device_type": "hammerhead"
-            }
-          ],
-          "output_links": [
-            {
-              "link": [
-                "https://luci-logdog.appspot.com/v/?s",
-                "=android%2Fswarming%2Flogcats%2F",
-                "${TASK_ID}%2F%2B%2Funified_logcats"
-              ],
-              "name": "shard #${SHARD_INDEX} logcats"
-            }
-          ]
-        },
-        "test": "blimp_unittests"
-      },
-      {
         "override_isolate_target": "blink_heap_unittests",
         "swarming": {
           "can_use_on_swarming_builders": true,
@@ -1395,72 +1329,6 @@
         "test": "base_unittests"
       },
       {
-        "override_compile_targets": [
-          "blimp_test_apk"
-        ],
-        "override_isolate_target": "blimp_test_apk",
-        "swarming": {
-          "can_use_on_swarming_builders": true,
-          "cipd_packages": [
-            {
-              "cipd_package": "infra/tools/luci/logdog/butler/${platform}",
-              "location": "bin",
-              "revision": "git_revision:25755a2c316937ee44a6432163dc5e2f9c85cf58"
-            }
-          ],
-          "dimension_sets": [
-            {
-              "android_devices": "4",
-              "device_os": "KTU84P",
-              "device_type": "hammerhead"
-            }
-          ],
-          "hard_timeout": 600,
-          "output_links": [
-            {
-              "link": [
-                "https://luci-logdog.appspot.com/v/?s",
-                "=android%2Fswarming%2Flogcats%2F",
-                "${TASK_ID}%2F%2B%2Funified_logcats"
-              ],
-              "name": "shard #${SHARD_INDEX} logcats"
-            }
-          ]
-        },
-        "test": "blimp_test_apk"
-      },
-      {
-        "override_isolate_target": "blimp_unittests",
-        "swarming": {
-          "can_use_on_swarming_builders": true,
-          "cipd_packages": [
-            {
-              "cipd_package": "infra/tools/luci/logdog/butler/${platform}",
-              "location": "bin",
-              "revision": "git_revision:25755a2c316937ee44a6432163dc5e2f9c85cf58"
-            }
-          ],
-          "dimension_sets": [
-            {
-              "android_devices": "4",
-              "device_os": "KTU84P",
-              "device_type": "hammerhead"
-            }
-          ],
-          "output_links": [
-            {
-              "link": [
-                "https://luci-logdog.appspot.com/v/?s",
-                "=android%2Fswarming%2Flogcats%2F",
-                "${TASK_ID}%2F%2B%2Funified_logcats"
-              ],
-              "name": "shard #${SHARD_INDEX} logcats"
-            }
-          ]
-        },
-        "test": "blimp_unittests"
-      },
-      {
         "override_isolate_target": "blink_heap_unittests",
         "swarming": {
           "can_use_on_swarming_builders": true,
@@ -2570,22 +2438,6 @@
       }
     ]
   },
-  "Blimp Linux (dbg)": {
-    "gtest_tests": [
-      {
-        "swarming": {
-          "can_use_on_swarming_builders": true
-        },
-        "test": "blimp_browsertests"
-      },
-      {
-        "swarming": {
-          "can_use_on_swarming_builders": false
-        },
-        "test": "blimp_unittests"
-      }
-    ]
-  },
   "Cast Linux": {
     "gtest_tests": [
       {
@@ -2799,12 +2651,6 @@
       },
       {
         "swarming": {
-          "can_use_on_swarming_builders": true
-        },
-        "test": "blimp_unittests"
-      },
-      {
-        "swarming": {
           "can_use_on_swarming_builders": true,
           "shards": 5
         },
@@ -3456,12 +3302,6 @@
       },
       {
         "swarming": {
-          "can_use_on_swarming_builders": true
-        },
-        "test": "blimp_unittests"
-      },
-      {
-        "swarming": {
           "can_use_on_swarming_builders": true,
           "shards": 10
         },
@@ -4009,12 +3849,6 @@
       },
       {
         "swarming": {
-          "can_use_on_swarming_builders": true
-        },
-        "test": "blimp_unittests"
-      },
-      {
-        "swarming": {
           "can_use_on_swarming_builders": true,
           "shards": 10
         },
diff --git a/testing/buildbot/gn_isolate_map.pyl b/testing/buildbot/gn_isolate_map.pyl
index 67280c5..fe019ae9 100644
--- a/testing/buildbot/gn_isolate_map.pyl
+++ b/testing/buildbot/gn_isolate_map.pyl
@@ -163,18 +163,6 @@
     "label": "//tools/battor_agent:battor_agent_unittests",
     "type": "console_test_launcher",
   },
-  "blimp_browsertests": {
-    "label": "//blimp:blimp_browsertests",
-    "type": "console_test_launcher",
-  },
-  "blimp_test_apk": {
-    "label": "//blimp/client/app:blimp_test_apk",
-    "type": "console_test_launcher",
-  },
-  "blimp_unittests": {
-    "label": "//blimp:blimp_unittests",
-    "type": "console_test_launcher",
-  },
   "blink_heap_unittests": {
     "label": "//third_party/WebKit/Source/platform/heap:blink_heap_unittests",
     "type": "console_test_launcher",
diff --git a/testing/variations/fieldtrial_testing_config.json b/testing/variations/fieldtrial_testing_config.json
index b092fd8..cc6cfbc 100644
--- a/testing/variations/fieldtrial_testing_config.json
+++ b/testing/variations/fieldtrial_testing_config.json
@@ -483,7 +483,7 @@
             ],
             "experiments": [
                 {
-                    "name": "DisableFirstRunAutoImport",
+                    "name": "AutoImportDisabled",
                     "enable_features": [
                         "DisableFirstRunAutoImport"
                     ]
diff --git a/third_party/WebKit/LayoutTests/fast/backgrounds/svg-as-mask-expected.png b/third_party/WebKit/LayoutTests/fast/backgrounds/svg-as-mask-expected.png
index 66a9fc2..2df0d65fc 100644
--- a/third_party/WebKit/LayoutTests/fast/backgrounds/svg-as-mask-expected.png
+++ b/third_party/WebKit/LayoutTests/fast/backgrounds/svg-as-mask-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/fast/canvas/OffscreenCanvas-commit-invalid-call.html b/third_party/WebKit/LayoutTests/fast/canvas/OffscreenCanvas-commit-invalid-call.html
index 1a1ad6d8..60df9042 100644
--- a/third_party/WebKit/LayoutTests/fast/canvas/OffscreenCanvas-commit-invalid-call.html
+++ b/third_party/WebKit/LayoutTests/fast/canvas/OffscreenCanvas-commit-invalid-call.html
@@ -5,12 +5,11 @@
 self.onmessage = function(e) {
     var offscreenCanvas = new OffscreenCanvas(50, 50);
     var offscreen2d = offscreenCanvas.getContext("2d");
-    try {
-        offscreen2d.commit();
-        self.postMessage("NoError");
-    } catch (ex) {
+    offscreen2d.commit().then(function() {
+        self.postMessage("NoError");    
+    }, ex => {
         self.postMessage(ex.name);
-    }
+    });
 };
 </script>
 <script>
@@ -19,35 +18,29 @@
    return new Worker(URL.createObjectURL(blob));
 }
 
-test(function() {
+promise_test(t => {
     var offscreenCanvas = new OffscreenCanvas(50, 50);
     var offscreen2d = offscreenCanvas.getContext("2d");
-    assert_throws("InvalidStateError", function () {
-        offscreen2d.commit();
-    });
-}, "Calling OffscreenCanvas.commit() on main without transferControlToOffscreen throws exception.");
+    return promise_rejects(t, new DOMException("", "InvalidStateError"), offscreen2d.commit());
+}, "Calling OffscreenCanvas.commit() on main without transferControlToOffscreen rejects promise with an exception.");
 
-test(function() {
+promise_test(t => {
     var offscreenCanvas = new OffscreenCanvas(50, 50);
     var gl = offscreenCanvas.getContext("webgl");
     gl.clearColor(1.0, 0.0, 0.0, 1.0);
     gl.clear(gl.COLOR_BUFFER_BIT);
-    assert_throws("InvalidStateError", function() {
-        gl.commit();
-    });
-}, "Calling WebGL's commit() on main without transferControlToOffscreen throws exception.");
+    return promise_rejects(t, new DOMException("", "InvalidStateError"), gl.commit());
+}, "Calling WebGL's commit() on main without transferControlToOffscreen rejects promise with an exception.");
 
-test(function() {
+promise_test(t => {
     var canvas = document.createElement('canvas');
     canvas.width = 50;
     canvas.height = 50;
     var gl = canvas.getContext("webgl");
     gl.clearColor(1.0, 0.0, 0.0, 1.0);
     gl.clear(gl.COLOR_BUFFER_BIT);
-    assert_throws("InvalidStateError", function() {
-        gl.commit();
-    });
-}, "Calling WebGL's commit() on main without a OffscreenCanvas throws exception.");
+    return promise_rejects(t, new DOMException("", "InvalidStateError"), gl.commit());
+}, "Calling WebGL's commit() on main without an OffscreenCanvas rejects promise with an exception.");
 
 async_test(function() {
     var worker = makeWorker(document.getElementById("myWorker").textContent);
@@ -56,7 +49,7 @@
         this.done();
     });
     worker.postMessage("");
-}, "Calling OffscreenCanvas.commit() on worker without transferControlToOffscreen throws exception.");
+}, "Calling OffscreenCanvas.commit() on worker without transferControlToOffscreen rejects promise with an exception.");
 
 
 
diff --git a/third_party/WebKit/LayoutTests/fast/canvas/OffscreenCanvas-commit-promise.html b/third_party/WebKit/LayoutTests/fast/canvas/OffscreenCanvas-commit-promise.html
new file mode 100644
index 0000000..6cce287
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/fast/canvas/OffscreenCanvas-commit-promise.html
@@ -0,0 +1,19 @@
+<!DOCTYPE html>
+<script src="../../resources/testharness.js"></script>
+<script src="../../resources/testharnessreport.js"></script>
+<script>
+promise_test(t => {
+  var canvas = document.createElement('canvas');
+  var offscreen = canvas.transferControlToOffscreen();
+  var ctx = offscreen.getContext('2d');
+  return ctx.commit();
+}, "Verify that the promise returned by a 2d context's commit() gets resolved.");
+
+promise_test(t => {
+  var canvas = document.createElement('canvas');
+  var offscreen = canvas.transferControlToOffscreen();
+  var ctx = offscreen.getContext('webgl');
+  return ctx.commit();
+}, "Verify that the promise returned by a webgl context's commit gets resolved.");
+
+</script>
\ No newline at end of file
diff --git a/third_party/WebKit/LayoutTests/images/resources/pngfuzz/border-image.png b/third_party/WebKit/LayoutTests/images/resources/pngfuzz/border-image.png
new file mode 100644
index 0000000..4f0530f
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/images/resources/pngfuzz/border-image.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/images/resources/pngfuzz/oval.png b/third_party/WebKit/LayoutTests/images/resources/pngfuzz/oval.png
new file mode 100644
index 0000000..b96b1ca
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/images/resources/pngfuzz/oval.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/images/resources/pngfuzz/png-animated-idat-not-part-of-animation.png b/third_party/WebKit/LayoutTests/images/resources/pngfuzz/png-animated-idat-not-part-of-animation.png
new file mode 100644
index 0000000..8667645d
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/images/resources/pngfuzz/png-animated-idat-not-part-of-animation.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/images/resources/pngfuzz/png-animated-idat-part-of-animation.png b/third_party/WebKit/LayoutTests/images/resources/pngfuzz/png-animated-idat-part-of-animation.png
new file mode 100644
index 0000000..5695742
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/images/resources/pngfuzz/png-animated-idat-part-of-animation.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/images/resources/pngfuzz/png-animated-three-independent-frames.png b/third_party/WebKit/LayoutTests/images/resources/pngfuzz/png-animated-three-independent-frames.png
new file mode 100644
index 0000000..8ea2a7a
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/images/resources/pngfuzz/png-animated-three-independent-frames.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/images/resources/pngfuzz/png-simple.png b/third_party/WebKit/LayoutTests/images/resources/pngfuzz/png-simple.png
new file mode 100644
index 0000000..0ddfdad9
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/images/resources/pngfuzz/png-simple.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/linux/fast/css3-text/css3-text-decoration/text-decoration-style-inherit-expected.png b/third_party/WebKit/LayoutTests/platform/linux/fast/css3-text/css3-text-decoration/text-decoration-style-inherit-expected.png
index 84de18f..b2923ae 100644
--- a/third_party/WebKit/LayoutTests/platform/linux/fast/css3-text/css3-text-decoration/text-decoration-style-inherit-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/linux/fast/css3-text/css3-text-decoration/text-decoration-style-inherit-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/linux/svg/animations/animate-elem-08-t-drt-expected.txt b/third_party/WebKit/LayoutTests/platform/linux/svg/animations/animate-elem-08-t-drt-expected.txt
deleted file mode 100644
index c8b945468..0000000
--- a/third_party/WebKit/LayoutTests/platform/linux/svg/animations/animate-elem-08-t-drt-expected.txt
+++ /dev/null
@@ -1,60 +0,0 @@
-SVG 1.1 dynamic animation tests
-
-
-A copy of the corresponding W3C-SVG-1.1 test, which dumps the animation at certain times
-
-On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
-
-
-PASS getTransformToElement(rootSVGElement, path1).a is 0
-PASS getTransformToElement(rootSVGElement, path1).b is 1
-PASS getTransformToElement(rootSVGElement, path1).c is -1
-PASS getTransformToElement(rootSVGElement, path1).d is 0
-PASS getTransformToElement(rootSVGElement, path1).e is 224.9
-FAIL getTransformToElement(rootSVGElement, path1).f should be close to -25.9. Was -25.000000000000014.
-PASS getTransformToElement(rootSVGElement, path2).a is 0
-PASS getTransformToElement(rootSVGElement, path2).b is -1
-PASS getTransformToElement(rootSVGElement, path2).c is 1
-PASS getTransformToElement(rootSVGElement, path2).d is 0
-FAIL getTransformToElement(rootSVGElement, path2).e should be close to -223.9. Was -225.
-FAIL getTransformToElement(rootSVGElement, path2).f should be close to 275.9. Was 275.
-PASS getTransformToElement(rootSVGElement, path1).a is 1
-PASS getTransformToElement(rootSVGElement, path1).b is 0.1
-PASS getTransformToElement(rootSVGElement, path1).c is -0.1
-PASS getTransformToElement(rootSVGElement, path1).d is 1
-FAIL getTransformToElement(rootSVGElement, path1).e should be close to -70.3. Was -70.88506886404467.
-FAIL getTransformToElement(rootSVGElement, path1).f should be close to -182.8. Was -182.5994545194139.
-PASS getTransformToElement(rootSVGElement, path2).a is -1
-PASS getTransformToElement(rootSVGElement, path2).b is -0.1
-PASS getTransformToElement(rootSVGElement, path2).c is 0.1
-PASS getTransformToElement(rootSVGElement, path2).d is -1
-FAIL getTransformToElement(rootSVGElement, path2).e should be close to 318.6. Was 319.3057494247923.
-FAIL getTransformToElement(rootSVGElement, path2).f should be close to 211.6. Was 210.65582089693936.
-PASS getTransformToElement(rootSVGElement, path1).a is 0.7
-PASS getTransformToElement(rootSVGElement, path1).b is -0.7
-PASS getTransformToElement(rootSVGElement, path1).c is 0.7
-PASS getTransformToElement(rootSVGElement, path1).d is 0.7
-PASS getTransformToElement(rootSVGElement, path1).e is -265.1
-FAIL getTransformToElement(rootSVGElement, path1).f should be close to -18.9. Was -17.677669529663703.
-PASS getTransformToElement(rootSVGElement, path2).a is -0.7
-PASS getTransformToElement(rootSVGElement, path2).b is 0.7
-PASS getTransformToElement(rootSVGElement, path2).c is -0.7
-PASS getTransformToElement(rootSVGElement, path2).d is -0.7
-FAIL getTransformToElement(rootSVGElement, path2).e should be close to 442.7. Was 441.94173824159213.
-FAIL getTransformToElement(rootSVGElement, path2).f should be close to -156.9. Was -159.09902576697306.
-PASS getTransformToElement(rootSVGElement, path1).a is 0.7
-PASS getTransformToElement(rootSVGElement, path1).b is -0.7
-PASS getTransformToElement(rootSVGElement, path1).c is 0.7
-PASS getTransformToElement(rootSVGElement, path1).d is 0.7
-PASS getTransformToElement(rootSVGElement, path1).e is -265.1
-FAIL getTransformToElement(rootSVGElement, path1).f should be close to -18.9. Was -17.677669529663703.
-PASS getTransformToElement(rootSVGElement, path2).a is -0.7
-PASS getTransformToElement(rootSVGElement, path2).b is 0.7
-PASS getTransformToElement(rootSVGElement, path2).c is -0.7
-PASS getTransformToElement(rootSVGElement, path2).d is -0.7
-FAIL getTransformToElement(rootSVGElement, path2).e should be close to 442.7. Was 441.94173824159213.
-FAIL getTransformToElement(rootSVGElement, path2).f should be close to -156.9. Was -159.09902576697306.
-PASS successfullyParsed is true
-
-TEST COMPLETE
-
diff --git a/third_party/WebKit/LayoutTests/platform/linux/svg/animations/animate-text-nested-transforms-expected.txt b/third_party/WebKit/LayoutTests/platform/linux/svg/animations/animate-text-nested-transforms-expected.txt
index 907d5b032..9d8804b 100644
--- a/third_party/WebKit/LayoutTests/platform/linux/svg/animations/animate-text-nested-transforms-expected.txt
+++ b/third_party/WebKit/LayoutTests/platform/linux/svg/animations/animate-text-nested-transforms-expected.txt
@@ -6,8 +6,8 @@
 On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
 
 
-FAIL rootSVGElement.getBBox().x should be close to 117. Was 115.01841735839844.
-FAIL rootSVGElement.getBBox().y should be close to -160. Was -154.0113525390625.
+PASS rootSVGElement.getBBox().x is 115
+PASS rootSVGElement.getBBox().y is -154
 PASS rootSVGElement.getBBox().x is 367
 PASS rootSVGElement.getBBox().y is 550
 PASS successfullyParsed is true
diff --git a/third_party/WebKit/LayoutTests/platform/linux/svg/as-background-image/svg-as-background-5-expected.png b/third_party/WebKit/LayoutTests/platform/linux/svg/as-background-image/svg-as-background-5-expected.png
index 5dd37f4..e9e3b21 100644
--- a/third_party/WebKit/LayoutTests/platform/linux/svg/as-background-image/svg-as-background-5-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/linux/svg/as-background-image/svg-as-background-5-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/linux/svg/as-background-image/svg-as-background-6-expected.png b/third_party/WebKit/LayoutTests/platform/linux/svg/as-background-image/svg-as-background-6-expected.png
index 44d98a9..49f008e 100644
--- a/third_party/WebKit/LayoutTests/platform/linux/svg/as-background-image/svg-as-background-6-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/linux/svg/as-background-image/svg-as-background-6-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/linux/svg/text/ligature-queries-expected.png b/third_party/WebKit/LayoutTests/platform/linux/svg/text/ligature-queries-expected.png
index 1c6b8f9..ec904b8 100644
--- a/third_party/WebKit/LayoutTests/platform/linux/svg/text/ligature-queries-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/linux/svg/text/ligature-queries-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/linux/svg/text/text-selection-path-01-b-expected.png b/third_party/WebKit/LayoutTests/platform/linux/svg/text/text-selection-path-01-b-expected.png
index a2c55406..c44f899 100644
--- a/third_party/WebKit/LayoutTests/platform/linux/svg/text/text-selection-path-01-b-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/linux/svg/text/text-selection-path-01-b-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/mac-mac10.9/fast/css3-text/css3-text-decoration/text-decoration-style-inherit-expected.png b/third_party/WebKit/LayoutTests/platform/mac-mac10.9/fast/css3-text/css3-text-decoration/text-decoration-style-inherit-expected.png
index 53f116dab..5587dd0 100644
--- a/third_party/WebKit/LayoutTests/platform/mac-mac10.9/fast/css3-text/css3-text-decoration/text-decoration-style-inherit-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/mac-mac10.9/fast/css3-text/css3-text-decoration/text-decoration-style-inherit-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/mac-mac10.9/svg/text/ligature-queries-expected.png b/third_party/WebKit/LayoutTests/platform/mac-mac10.9/svg/text/ligature-queries-expected.png
index 00cf094..7a800d9 100644
--- a/third_party/WebKit/LayoutTests/platform/mac-mac10.9/svg/text/ligature-queries-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/mac-mac10.9/svg/text/ligature-queries-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/mac/fast/css3-text/css3-text-decoration/text-decoration-style-inherit-expected.png b/third_party/WebKit/LayoutTests/platform/mac/fast/css3-text/css3-text-decoration/text-decoration-style-inherit-expected.png
index eaae339..e07daec 100644
--- a/third_party/WebKit/LayoutTests/platform/mac/fast/css3-text/css3-text-decoration/text-decoration-style-inherit-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/mac/fast/css3-text/css3-text-decoration/text-decoration-style-inherit-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/mac/svg/as-background-image/svg-as-background-5-expected.png b/third_party/WebKit/LayoutTests/platform/mac/svg/as-background-image/svg-as-background-5-expected.png
index dcfa0565..5050dbd5 100644
--- a/third_party/WebKit/LayoutTests/platform/mac/svg/as-background-image/svg-as-background-5-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/mac/svg/as-background-image/svg-as-background-5-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/mac/svg/as-background-image/svg-as-background-6-expected.png b/third_party/WebKit/LayoutTests/platform/mac/svg/as-background-image/svg-as-background-6-expected.png
index d356721b..055b35e 100644
--- a/third_party/WebKit/LayoutTests/platform/mac/svg/as-background-image/svg-as-background-6-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/mac/svg/as-background-image/svg-as-background-6-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/mac/svg/text/ligature-queries-expected.png b/third_party/WebKit/LayoutTests/platform/mac/svg/text/ligature-queries-expected.png
index 905a5c7a..d12daa3 100644
--- a/third_party/WebKit/LayoutTests/platform/mac/svg/text/ligature-queries-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/mac/svg/text/ligature-queries-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/mac/svg/text/text-selection-path-01-b-expected.png b/third_party/WebKit/LayoutTests/platform/mac/svg/text/text-selection-path-01-b-expected.png
index 2ccbbdd0..b045bc1b 100644
--- a/third_party/WebKit/LayoutTests/platform/mac/svg/text/text-selection-path-01-b-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/mac/svg/text/text-selection-path-01-b-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/win/fast/css3-text/css3-text-decoration/text-decoration-style-inherit-expected.png b/third_party/WebKit/LayoutTests/platform/win/fast/css3-text/css3-text-decoration/text-decoration-style-inherit-expected.png
index 491765c3..b1010944 100644
--- a/third_party/WebKit/LayoutTests/platform/win/fast/css3-text/css3-text-decoration/text-decoration-style-inherit-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/win/fast/css3-text/css3-text-decoration/text-decoration-style-inherit-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/win/svg/as-background-image/svg-as-background-5-expected.png b/third_party/WebKit/LayoutTests/platform/win/svg/as-background-image/svg-as-background-5-expected.png
index f00c67c6..dd8c0566 100644
--- a/third_party/WebKit/LayoutTests/platform/win/svg/as-background-image/svg-as-background-5-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/win/svg/as-background-image/svg-as-background-5-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/win/svg/as-background-image/svg-as-background-6-expected.png b/third_party/WebKit/LayoutTests/platform/win/svg/as-background-image/svg-as-background-6-expected.png
index f3a8624..00e7cd2 100644
--- a/third_party/WebKit/LayoutTests/platform/win/svg/as-background-image/svg-as-background-6-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/win/svg/as-background-image/svg-as-background-6-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/win/svg/text/ligature-queries-expected.png b/third_party/WebKit/LayoutTests/platform/win/svg/text/ligature-queries-expected.png
index 0762eb5..2b669b3 100644
--- a/third_party/WebKit/LayoutTests/platform/win/svg/text/ligature-queries-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/win/svg/text/ligature-queries-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/win/svg/text/text-selection-path-01-b-expected.png b/third_party/WebKit/LayoutTests/platform/win/svg/text/text-selection-path-01-b-expected.png
index 5201c83c..715014fb 100644
--- a/third_party/WebKit/LayoutTests/platform/win/svg/text/text-selection-path-01-b-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/win/svg/text/text-selection-path-01-b-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/win7/svg/as-background-image/svg-as-background-5-expected.png b/third_party/WebKit/LayoutTests/platform/win7/svg/as-background-image/svg-as-background-5-expected.png
index d3c0aeea..a9f5e62 100644
--- a/third_party/WebKit/LayoutTests/platform/win7/svg/as-background-image/svg-as-background-5-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/win7/svg/as-background-image/svg-as-background-5-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/svg/animations/animate-elem-08-t-drt-expected.txt b/third_party/WebKit/LayoutTests/svg/animations/animate-elem-08-t-drt-expected.txt
index 26cbd763..2564a64 100644
--- a/third_party/WebKit/LayoutTests/svg/animations/animate-elem-08-t-drt-expected.txt
+++ b/third_party/WebKit/LayoutTests/svg/animations/animate-elem-08-t-drt-expected.txt
@@ -11,49 +11,49 @@
 PASS getTransformToElement(rootSVGElement, path1).c is -1
 PASS getTransformToElement(rootSVGElement, path1).d is 0
 PASS getTransformToElement(rootSVGElement, path1).e is 224.9
-FAIL getTransformToElement(rootSVGElement, path1).f should be close to -25.9. Was -25.000000000000014.
+PASS getTransformToElement(rootSVGElement, path1).f is -25
 PASS getTransformToElement(rootSVGElement, path2).a is 0
 PASS getTransformToElement(rootSVGElement, path2).b is -1
 PASS getTransformToElement(rootSVGElement, path2).c is 1
 PASS getTransformToElement(rootSVGElement, path2).d is 0
-FAIL getTransformToElement(rootSVGElement, path2).e should be close to -223.9. Was -225.
-FAIL getTransformToElement(rootSVGElement, path2).f should be close to 275.9. Was 275.
+PASS getTransformToElement(rootSVGElement, path2).e is -225
+PASS getTransformToElement(rootSVGElement, path2).f is 275
 PASS getTransformToElement(rootSVGElement, path1).a is 1
 PASS getTransformToElement(rootSVGElement, path1).b is 0.1
 PASS getTransformToElement(rootSVGElement, path1).c is -0.1
 PASS getTransformToElement(rootSVGElement, path1).d is 1
-FAIL getTransformToElement(rootSVGElement, path1).e should be close to -70.3. Was -70.88506734438292.
-FAIL getTransformToElement(rootSVGElement, path1).f should be close to -182.8. Was -182.59945510934625.
+PASS getTransformToElement(rootSVGElement, path1).e is -70.9
+PASS getTransformToElement(rootSVGElement, path1).f is -182.6
 PASS getTransformToElement(rootSVGElement, path2).a is -1
 PASS getTransformToElement(rootSVGElement, path2).b is -0.1
 PASS getTransformToElement(rootSVGElement, path2).c is 0.1
 PASS getTransformToElement(rootSVGElement, path2).d is -1
-FAIL getTransformToElement(rootSVGElement, path2).e should be close to 318.6. Was 319.3057494247923.
-FAIL getTransformToElement(rootSVGElement, path2).f should be close to 211.6. Was 210.65582089693936.
+PASS getTransformToElement(rootSVGElement, path2).e is 319.3
+PASS getTransformToElement(rootSVGElement, path2).f is 210.7
 PASS getTransformToElement(rootSVGElement, path1).a is 0.7
 PASS getTransformToElement(rootSVGElement, path1).b is -0.7
 PASS getTransformToElement(rootSVGElement, path1).c is 0.7
 PASS getTransformToElement(rootSVGElement, path1).d is 0.7
 PASS getTransformToElement(rootSVGElement, path1).e is -265.1
-FAIL getTransformToElement(rootSVGElement, path1).f should be close to -18.9. Was -17.677669529663703.
+PASS getTransformToElement(rootSVGElement, path1).f is -17.7
 PASS getTransformToElement(rootSVGElement, path2).a is -0.7
 PASS getTransformToElement(rootSVGElement, path2).b is 0.7
 PASS getTransformToElement(rootSVGElement, path2).c is -0.7
 PASS getTransformToElement(rootSVGElement, path2).d is -0.7
-FAIL getTransformToElement(rootSVGElement, path2).e should be close to 442.7. Was 441.94173824159213.
-FAIL getTransformToElement(rootSVGElement, path2).f should be close to -156.9. Was -159.09902576697306.
+PASS getTransformToElement(rootSVGElement, path2).e is 442
+PASS getTransformToElement(rootSVGElement, path2).f is -159
 PASS getTransformToElement(rootSVGElement, path1).a is 0.7
 PASS getTransformToElement(rootSVGElement, path1).b is -0.7
 PASS getTransformToElement(rootSVGElement, path1).c is 0.7
 PASS getTransformToElement(rootSVGElement, path1).d is 0.7
 PASS getTransformToElement(rootSVGElement, path1).e is -265.1
-FAIL getTransformToElement(rootSVGElement, path1).f should be close to -18.9. Was -17.677669529663703.
+PASS getTransformToElement(rootSVGElement, path1).f is -17.7
 PASS getTransformToElement(rootSVGElement, path2).a is -0.7
 PASS getTransformToElement(rootSVGElement, path2).b is 0.7
 PASS getTransformToElement(rootSVGElement, path2).c is -0.7
 PASS getTransformToElement(rootSVGElement, path2).d is -0.7
-FAIL getTransformToElement(rootSVGElement, path2).e should be close to 442.7. Was 441.94173824159213.
-FAIL getTransformToElement(rootSVGElement, path2).f should be close to -156.9. Was -159.09902576697306.
+PASS getTransformToElement(rootSVGElement, path2).e is 442
+PASS getTransformToElement(rootSVGElement, path2).f is -159
 PASS successfullyParsed is true
 
 TEST COMPLETE
diff --git a/third_party/WebKit/LayoutTests/svg/animations/animate-text-nested-transforms-expected.txt b/third_party/WebKit/LayoutTests/svg/animations/animate-text-nested-transforms-expected.txt
index d5c59a1e..6ca118d 100644
--- a/third_party/WebKit/LayoutTests/svg/animations/animate-text-nested-transforms-expected.txt
+++ b/third_party/WebKit/LayoutTests/svg/animations/animate-text-nested-transforms-expected.txt
@@ -6,8 +6,8 @@
 On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
 
 
-PASS rootSVGElement.getBBox().x is 117
-FAIL rootSVGElement.getBBox().y should be close to -160. Was -162.88629150390625.
+FAIL rootSVGElement.getBBox().x should be close to 115. Was 116.01841735839844.
+FAIL rootSVGElement.getBBox().y should be close to -154. Was -162.8862762451172.
 PASS rootSVGElement.getBBox().x is 367
 PASS rootSVGElement.getBBox().y is 550
 PASS successfullyParsed is true
diff --git a/third_party/WebKit/LayoutTests/svg/animations/script-tests/animate-elem-08-t-drt.js b/third_party/WebKit/LayoutTests/svg/animations/script-tests/animate-elem-08-t-drt.js
index 100489a..a045d75e 100644
--- a/third_party/WebKit/LayoutTests/svg/animations/script-tests/animate-elem-08-t-drt.js
+++ b/third_party/WebKit/LayoutTests/svg/animations/script-tests/animate-elem-08-t-drt.js
@@ -3,18 +3,18 @@
 
 // Setup animation test
 function sample1() {
-    expectMatrix("getTransformToElement(rootSVGElement, path1)", "0", "1", "-1", "0", "224.9", "-25.9");
-    expectMatrix("getTransformToElement(rootSVGElement, path2)", "0", "-1", "1", "0", "-223.9", "275.9");
+    expectMatrix("getTransformToElement(rootSVGElement, path1)", "0", "1", "-1", "0", "224.9", "-25");
+    expectMatrix("getTransformToElement(rootSVGElement, path2)", "0", "-1", "1", "0", "-225", "275");
 }
 
 function sample2() {
-    expectMatrix("getTransformToElement(rootSVGElement, path1)", "1", "0.1", "-0.1", "1", "-70.3", "-182.8");
-    expectMatrix("getTransformToElement(rootSVGElement, path2)", "-1", "-0.1", "0.1", "-1", "318.6", "211.6");
+    expectMatrix("getTransformToElement(rootSVGElement, path1)", "1", "0.1", "-0.1", "1", "-70.9", "-182.6");
+    expectMatrix("getTransformToElement(rootSVGElement, path2)", "-1", "-0.1", "0.1", "-1", "319.3", "210.7");
 }
 
 function sample3() {
-    expectMatrix("getTransformToElement(rootSVGElement, path1)", "0.7", "-0.7", "0.7", "0.7", "-265.1", "-18.9");
-    expectMatrix("getTransformToElement(rootSVGElement, path2)", "-0.7", "0.7", "-0.7", "-0.7", "442.7", "-156.9");
+    expectMatrix("getTransformToElement(rootSVGElement, path1)", "0.7", "-0.7", "0.7", "0.7", "-265.1", "-17.7");
+    expectMatrix("getTransformToElement(rootSVGElement, path2)", "-0.7", "0.7", "-0.7", "-0.7", "442", "-159");
 }
 
 function executeTest() {
diff --git a/third_party/WebKit/LayoutTests/svg/animations/script-tests/animate-text-nested-transforms.js b/third_party/WebKit/LayoutTests/svg/animations/script-tests/animate-text-nested-transforms.js
index 58a79e8..d3dd0d4 100644
--- a/third_party/WebKit/LayoutTests/svg/animations/script-tests/animate-text-nested-transforms.js
+++ b/third_party/WebKit/LayoutTests/svg/animations/script-tests/animate-text-nested-transforms.js
@@ -19,8 +19,8 @@
 rootSVGElement.appendChild(text)
 
 function startSample() {
-    shouldBeCloseEnough("rootSVGElement.getBBox().x", "117", 1);
-    shouldBeCloseEnough("rootSVGElement.getBBox().y", "-160", 1);
+    shouldBeCloseEnough("rootSVGElement.getBBox().x", "115", 1);
+    shouldBeCloseEnough("rootSVGElement.getBBox().y", "-154", 1);
 }
 
 function endSample() {
diff --git a/third_party/WebKit/LayoutTests/webaudio/AudioBuffer/audiobuffer-resample-expected.txt b/third_party/WebKit/LayoutTests/webaudio/AudioBuffer/audiobuffer-resample-expected.txt
deleted file mode 100644
index 4dce2d3..0000000
--- a/third_party/WebKit/LayoutTests/webaudio/AudioBuffer/audiobuffer-resample-expected.txt
+++ /dev/null
@@ -1,11 +0,0 @@
-Test resampling of an AudioBuffer at 3000 Hz
-
-On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
-
-PASS Peak error between actual and reference data below threshold of 0.11.
-PASS SNR exceeds threshold of 22.35 dB.
-PASS AudioBuffer resampling is accurate for buffer rate of 3000 Hz.
-PASS successfullyParsed is true
-
-TEST COMPLETE
-
diff --git a/third_party/WebKit/LayoutTests/webaudio/AudioBuffer/audiobuffer-resample.html b/third_party/WebKit/LayoutTests/webaudio/AudioBuffer/audiobuffer-resample.html
index d45aa6cd..ce6dfc4 100644
--- a/third_party/WebKit/LayoutTests/webaudio/AudioBuffer/audiobuffer-resample.html
+++ b/third_party/WebKit/LayoutTests/webaudio/AudioBuffer/audiobuffer-resample.html
@@ -1,140 +1,115 @@
-<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
+<!doctype>
 <html>
   <head>
-    <script src="../../resources/js-test.js"></script>
+    <script src="../../resources/testharness.js"></script>
+    <script src="../../resources/testharnessreport.js"></script>
     <script src="../resources/audit-util.js"></script>
-    <script src="../resources/audio-testing.js"></script>
+    <script src="../resources/audit.js"></script>
   </head>
 
   <body>
-    <div id="description"></div>
-    <div id="console"></div>
-
     <script>
+      let audit = Audit.createTaskRunner();
+
       // These are global to make debugging a little easier.
-      var context;
-      var buffer;
-      var source;
-      var renderedData;
-      var trueData;
-      var signalEnergy;
-      var noiseEnergy;
-      var maxError;
+      let context;
+      let buffer;
+      let source;
+      let renderedData;
+      let trueData;
+      let signalEnergy;
+      let noiseEnergy;
+      let maxError;
 
       // Context sample rate.
-      var sampleRate = 48000;
+      let sampleRate = 48000;
       // The sample rate of the buffer.
-      var bufferRate = 3000;
+      let bufferRate = 3000;
       // The audio buffer is a sine wave of this frequency.
-      var toneFrequency = 440;
+      let toneFrequency = 440;
       // How long test is
-      var lengthInSeconds = 0.5;
-      // The maximum allowed peak error between the actual and true output. This value was
-      // experimentally determined for the given bufferRate.
-      var peakThreshold = 0.11;
+      let lengthInSeconds = 0.5;
+      // The maximum allowed peak error between the actual and true output. This
+      // value was experimentally determined for the given bufferRate.
+      let peakThreshold = 0.11;
       // The minimum SNR allowed between the actual and true output.
-      var snrThreshold = 22.35;
+      let snrThreshold = 22.35;
 
-      description("Test resampling of an AudioBuffer at " + bufferRate + " Hz");
 
-      function log10(x) {
-          return Math.log(x)/Math.LN10;
-      }
-      
-      // Generate a sine wave in an AudioBuffer using the given |freq|. The AudioBuffer has the
-      // sample rate of |rate|.
+      // Generate a sine wave in an AudioBuffer using the given |freq|. The
+      // AudioBuffer has the sample rate of |rate|.
       function createSineBuffer(context, freq, rate) {
-          var buf = context.createBuffer(1, lengthInSeconds * rate, rate);
-          var omega = 2 * Math.PI * freq / rate;
-          var signal = buf.getChannelData(0);
-          var length = signal.length;
-          for (var k = 0; k < length; ++k)
-            signal[k] = Math.sin(omega * k);
+        let buf = context.createBuffer(1, lengthInSeconds * rate, rate);
+        let omega = 2 * Math.PI * freq / rate;
+        let signal = buf.getChannelData(0);
+        let length = signal.length;
+        for (let k = 0; k < length; ++k)
+          signal[k] = Math.sin(omega * k);
 
-          return buf;
+        return buf;
       }
 
       // Check the output against the expected output.
-      function checkResult(event) {
-          renderedData = event.renderedBuffer.getChannelData(0);
-          var length = renderedData.length;
-          // Generate a reference sine wave at the context rate
-          var trueReference = createSineBuffer(context, toneFrequency, context.sampleRate);
-          trueData = trueReference.getChannelData(0);
+      function checkResult(buffer, should) {
+        renderedData = buffer.getChannelData(0);
+        let length = renderedData.length;
+        // Generate a reference sine wave at the context rate
+        let trueReference = createSineBuffer(context, toneFrequency, context.sampleRate);
+        trueData = trueReference.getChannelData(0);
 
-          // To compare the actual output against the reference, we compute the peak error and the
-          // SNR between the two.
-          signalEnergy = 0;
-          noiseEnergy = 0;
-          maxError = -1;
+        // To compare the actual output against the reference, we compute the
+        // peak error and the SNR between the two.
+        signalEnergy = 0;
+        noiseEnergy = 0;
+        maxError = -1;
 
-          var success = true;
+        let success = true;
 
-          // Compute the peak error and the SNR.
-          for (var k = 0; k < length / 2; ++k) {
-              var diff = renderedData[k] - trueData[k];
-              noiseEnergy += diff * diff;
-              signalEnergy += trueData[k] * trueData[k];
-              if (Math.abs(diff) > maxError)
-                  maxError = Math.abs(diff);
-          }
+        // Compute the peak error and the SNR.
+        for (let k = 0; k < length / 2; ++k) {
+          let diff = renderedData[k] - trueData[k];
+          noiseEnergy += diff * diff;
+          signalEnergy += trueData[k] * trueData[k];
+          if (Math.abs(diff) > maxError)
+            maxError = Math.abs(diff);
+        }
 
-          var snr;
+        let snr;
 
-          if (noiseEnergy == 0)
-              snr = 1000;
-          else
-              snr = 10 * log10(signalEnergy / noiseEnergy);
-      
-          if (maxError < peakThreshold) {
-              testPassed("Peak error between actual and reference data below threshold of " +
-                         peakThreshold + ".");
-          } else {
-              testFailed("Peak error of " + maxError + " exceeds threshold of " +
-                         peakThreshold + ".");
-              success = false;
-          }
+        if (noiseEnergy == 0)
+          snr = 1000;
+        else
+          snr = 10 * Math.log10(signalEnergy / noiseEnergy);
 
-          if (snr > snrThreshold) {
-              testPassed("SNR exceeds threshold of " + snrThreshold + " dB.");
-          } else {
-              testFailed("SNR of " + snr + " is below the threshold of " + snrThreshold + ".");
-              success = false;
-          }
-      
-          if (success)
-              testPassed("AudioBuffer resampling is accurate for buffer rate of " +
-                         bufferRate + " Hz.");
-          else
-              testFailed("AudioBuffer resampling is not accurate enough for buffer rate of " +
-                         bufferRate + " Hz.");
+        should(maxError, "Peak error between actual and reference data")
+          .beLessThan(peakThreshold);
 
-          finishJSTest();
+        should(snr, "SNR")
+          .beGreaterThan(snrThreshold);
       }
 
-      function runTest() {
-          if (window.testRunner) {
-              testRunner.dumpAsText();
-              testRunner.waitUntilDone();
-          }
+      audit.define("Test resampling of an AudioBuffer",
+        function(task, should) {
+          context = new OfflineAudioContext(1, lengthInSeconds *
+            sampleRate,
+            sampleRate);
 
-          window.jsTestIsAsync = true;
-
-          context = new OfflineAudioContext(1, lengthInSeconds * sampleRate, sampleRate);
-
-          // Create a sine wave in a buffer that's different from the context rate to test
-          // resampling.
+          // Create a sine wave in a buffer that's different from the context rate
+          // to test resampling.
           buffer = createSineBuffer(context, toneFrequency, bufferRate);
           source = context.createBufferSource();
           source.buffer = buffer;
           source.connect(context.destination);
           source.start();
 
-          context.oncomplete = checkResult;
-          context.startRendering();
-      }
-      runTest();
-      successfullyParsed = true;
+          context.startRendering()
+            .then(function(buffer) {
+              checkResult(buffer, should);
+            })
+            .then(task.done.bind(task));
+        });
+
+      audit.run();
     </script>
   </body>
 </html>
diff --git a/third_party/WebKit/Source/core/css/FontFace.cpp b/third_party/WebKit/Source/core/css/FontFace.cpp
index a7bb539..f199686 100644
--- a/third_party/WebKit/Source/core/css/FontFace.cpp
+++ b/third_party/WebKit/Source/core/css/FontFace.cpp
@@ -154,12 +154,12 @@
 }
 
 FontFace::FontFace(ExecutionContext* context)
-    : ContextClient(context), m_status(Unloaded) {}
+    : ContextLifecycleObserver(context), m_status(Unloaded) {}
 
 FontFace::FontFace(ExecutionContext* context,
                    const AtomicString& family,
                    const FontFaceDescriptors& descriptors)
-    : ContextClient(context), m_family(family), m_status(Unloaded) {
+    : ContextLifecycleObserver(context), m_family(family), m_status(Unloaded) {
   Document* document = toDocument(context);
   setPropertyFromString(document, descriptors.style(), CSSPropertyFontStyle);
   setPropertyFromString(document, descriptors.weight(), CSSPropertyFontWeight);
@@ -635,7 +635,7 @@
   visitor->trace(m_loadedProperty);
   visitor->trace(m_cssFontFace);
   visitor->trace(m_callbacks);
-  ContextClient::trace(visitor);
+  ContextLifecycleObserver::trace(visitor);
 }
 
 bool FontFace::hadBlankText() const {
diff --git a/third_party/WebKit/Source/core/css/FontFace.h b/third_party/WebKit/Source/core/css/FontFace.h
index 6924fff..f4ed0f6 100644
--- a/third_party/WebKit/Source/core/css/FontFace.h
+++ b/third_party/WebKit/Source/core/css/FontFace.h
@@ -58,7 +58,7 @@
 class FontFace : public GarbageCollectedFinalized<FontFace>,
                  public ScriptWrappable,
                  public ActiveScriptWrappable<FontFace>,
-                 public ContextClient {
+                 public ContextLifecycleObserver {
   DEFINE_WRAPPERTYPEINFO();
   USING_GARBAGE_COLLECTED_MIXIN(FontFace);
   WTF_MAKE_NONCOPYABLE(FontFace);
diff --git a/third_party/WebKit/Source/core/dom/Node.cpp b/third_party/WebKit/Source/core/dom/Node.cpp
index 54d7625..caf5618 100644
--- a/third_party/WebKit/Source/core/dom/Node.cpp
+++ b/third_party/WebKit/Source/core/dom/Node.cpp
@@ -1882,9 +1882,9 @@
 }
 
 using EventTargetDataMap =
-    HeapHashMap<WeakMember<Node>, Member<EventTargetData>>;
+    PersistentHeapHashMap<WeakMember<Node>, Member<EventTargetData>>;
 static EventTargetDataMap& eventTargetDataMap() {
-  DEFINE_STATIC_LOCAL(EventTargetDataMap, map, (new EventTargetDataMap));
+  DEFINE_STATIC_LOCAL(EventTargetDataMap, map, ());
   return map;
 }
 
diff --git a/third_party/WebKit/Source/core/frame/ImageBitmap.cpp b/third_party/WebKit/Source/core/frame/ImageBitmap.cpp
index c22d88d5..f6ba656 100644
--- a/third_party/WebKit/Source/core/frame/ImageBitmap.cpp
+++ b/third_party/WebKit/Source/core/frame/ImageBitmap.cpp
@@ -73,12 +73,8 @@
     if (!RuntimeEnabledFeatures::experimentalCanvasFeaturesEnabled() ||
         !RuntimeEnabledFeatures::colorCorrectRenderingEnabled()) {
       DCHECK_EQ(options.colorSpaceConversion(), "default");
-      // TODO(zakerinasab): Replace sRGB with a call to
-      // ImageDecoder::globalTargetColorSpace() when the crash problem on Mac
-      // is fixed. crbug.com/668546.
       if (RuntimeEnabledFeatures::colorCorrectRenderingDefaultModeEnabled()) {
-        parsedOptions.dstColorSpace =
-            SkColorSpace::MakeNamed(SkColorSpace::kSRGB_Named);
+        parsedOptions.dstColorSpace = ColorBehavior::globalTargetColorSpace();
         parsedOptions.dstColorType = SkColorType::kN32_SkColorType;
       }
     } else {
diff --git a/third_party/WebKit/Source/core/frame/ImageBitmapTest.cpp b/third_party/WebKit/Source/core/frame/ImageBitmapTest.cpp
index 6f54c5e1..ddf8122a 100644
--- a/third_party/WebKit/Source/core/frame/ImageBitmapTest.cpp
+++ b/third_party/WebKit/Source/core/frame/ImageBitmapTest.cpp
@@ -297,10 +297,7 @@
         NOTREACHED();
         break;
       case ColorSpaceConversion::DEFAULT_NOT_COLOR_CORRECTED:
-        // TODO(zakerinasab): Replace sRGB with a call to
-        // ImageDecoder::globalTargetColorSpace() when the crash problem on Mac
-        // is fixed. crbug.com/668546.
-        colorSpace = SkColorSpace::MakeNamed(SkColorSpace::kSRGB_Named);
+        colorSpace = ColorBehavior::globalTargetColorSpace();
         colorFormat = colorFormat32;
         break;
       case ColorSpaceConversion::DEFAULT_COLOR_CORRECTED:
@@ -400,10 +397,7 @@
         NOTREACHED();
         break;
       case ColorSpaceConversion::DEFAULT_NOT_COLOR_CORRECTED:
-        // TODO(zakerinasab): Replace sRGB with a call to
-        // ImageDecoder::globalTargetColorSpace() when the crash problem on Mac
-        // is fixed. crbug.com/668546.
-        colorSpace = SkColorSpace::MakeNamed(SkColorSpace::kSRGB_Named);
+        colorSpace = ColorBehavior::globalTargetColorSpace();
         colorFormat = colorFormat32;
         break;
       case ColorSpaceConversion::DEFAULT_COLOR_CORRECTED:
@@ -494,10 +488,7 @@
         NOTREACHED();
         break;
       case ColorSpaceConversion::DEFAULT_NOT_COLOR_CORRECTED:
-        // TODO(zakerinasab): Replace sRGB with a call to
-        // ImageDecoder::globalTargetColorSpace() when the crash problem on Mac
-        // is fixed. crbug.com/668546.
-        colorSpace = SkColorSpace::MakeNamed(SkColorSpace::kSRGB_Named);
+        colorSpace = ColorBehavior::globalTargetColorSpace();
         colorFormat = colorFormat32;
         break;
       case ColorSpaceConversion::DEFAULT_COLOR_CORRECTED:
diff --git a/third_party/WebKit/Source/core/html/canvas/CanvasRenderingContext.cpp b/third_party/WebKit/Source/core/html/canvas/CanvasRenderingContext.cpp
index 999194f..2ddfe27b 100644
--- a/third_party/WebKit/Source/core/html/canvas/CanvasRenderingContext.cpp
+++ b/third_party/WebKit/Source/core/html/canvas/CanvasRenderingContext.cpp
@@ -118,6 +118,10 @@
     canvas()->detachContext();
     m_canvas = nullptr;
   }
+  if (offscreenCanvas()) {
+    offscreenCanvas()->detachContext();
+    m_offscreenCanvas = nullptr;
+  }
 }
 
 CanvasRenderingContext::ContextType CanvasRenderingContext::contextTypeFromId(
diff --git a/third_party/WebKit/Source/core/html/canvas/CanvasRenderingContext.h b/third_party/WebKit/Source/core/html/canvas/CanvasRenderingContext.h
index 7aa0815..cb61c23 100644
--- a/third_party/WebKit/Source/core/html/canvas/CanvasRenderingContext.h
+++ b/third_party/WebKit/Source/core/html/canvas/CanvasRenderingContext.h
@@ -164,13 +164,14 @@
   virtual bool paint(GraphicsContext&, const IntRect&) { return false; }
 
   // OffscreenCanvas-specific methods
-  OffscreenCanvas* getOffscreenCanvas() const { return m_offscreenCanvas; }
+  OffscreenCanvas* offscreenCanvas() const { return m_offscreenCanvas; }
   virtual ImageBitmap* transferToImageBitmap(ScriptState*) { return nullptr; }
 
   bool wouldTaintOrigin(CanvasImageSource*, SecurityOrigin* = nullptr);
   void didMoveToNewDocument(Document*);
 
   void detachCanvas() { m_canvas = nullptr; }
+  void detachOffscreenCanvas() { m_offscreenCanvas = nullptr; }
 
   const CanvasContextCreationAttributes& creationAttributes() const {
     return m_creationAttributes;
diff --git a/third_party/WebKit/Source/core/layout/ng/ng_block_node.cc b/third_party/WebKit/Source/core/layout/ng/ng_block_node.cc
index 6fbb34b..1849d7a2 100644
--- a/third_party/WebKit/Source/core/layout/ng/ng_block_node.cc
+++ b/third_party/WebKit/Source/core/layout/ng/ng_block_node.cc
@@ -300,12 +300,23 @@
 
 NGPhysicalFragment* NGBlockNode::RunOldLayout(
     const NGConstraintSpace& constraint_space) {
-  // TODO(layout-ng): If fixedSize is true, set the override width/height too
-  NGLogicalSize available_size = constraint_space.AvailableSize();
+  NGLogicalSize available_size = constraint_space.PercentageResolutionSize();
   layout_box_->setOverrideContainingBlockContentLogicalWidth(
       available_size.inline_size);
   layout_box_->setOverrideContainingBlockContentLogicalHeight(
       available_size.block_size);
+  // TODO(layout-ng): Does this handle scrollbars correctly?
+  if (constraint_space.IsFixedSizeInline()) {
+    layout_box_->setOverrideLogicalContentWidth(
+        constraint_space.AvailableSize().inline_size -
+        layout_box_->borderAndPaddingLogicalWidth());
+  }
+  if (constraint_space.IsFixedSizeBlock()) {
+    layout_box_->setOverrideLogicalContentHeight(
+        constraint_space.AvailableSize().block_size -
+        layout_box_->borderAndPaddingLogicalHeight());
+  }
+
   if (layout_box_->isLayoutNGBlockFlow() && layout_box_->needsLayout()) {
     toLayoutNGBlockFlow(layout_box_)->LayoutBlockFlow::layoutBlock(true);
   } else {
diff --git a/third_party/WebKit/Source/core/layout/ng/ng_constraint_space.h b/third_party/WebKit/Source/core/layout/ng/ng_constraint_space.h
index e85a720..ddfdd8c 100644
--- a/third_party/WebKit/Source/core/layout/ng/ng_constraint_space.h
+++ b/third_party/WebKit/Source/core/layout/ng/ng_constraint_space.h
@@ -90,6 +90,8 @@
   // grid). These flags represented whether a layout needs to produce a
   // fragment that satisfies a fixed constraint in the inline and block
   // direction respectively.
+  // If these flags are true, the AvailableSize() is interpreted as the fixed
+  // border-box size of this box in the resepective dimension.
   bool IsFixedSizeInline() const { return is_fixed_size_inline_; }
 
   bool IsFixedSizeBlock() const { return is_fixed_size_block_; }
diff --git a/third_party/WebKit/Source/core/offscreencanvas/OffscreenCanvas.cpp b/third_party/WebKit/Source/core/offscreencanvas/OffscreenCanvas.cpp
index 4c3d4e04..4a47555 100644
--- a/third_party/WebKit/Source/core/offscreencanvas/OffscreenCanvas.cpp
+++ b/third_party/WebKit/Source/core/offscreencanvas/OffscreenCanvas.cpp
@@ -22,14 +22,28 @@
 
 namespace blink {
 
-OffscreenCanvas::OffscreenCanvas(const IntSize& size)
-    : m_size(size), m_originClean(true) {}
+OffscreenCanvas::OffscreenCanvas(const IntSize& size) : m_size(size) {}
 
 OffscreenCanvas* OffscreenCanvas::create(unsigned width, unsigned height) {
   return new OffscreenCanvas(
       IntSize(clampTo<int>(width), clampTo<int>(height)));
 }
 
+OffscreenCanvas::~OffscreenCanvas() {}
+
+void OffscreenCanvas::dispose() {
+  if (m_context) {
+    m_context->detachOffscreenCanvas();
+    m_context = nullptr;
+  }
+  if (m_commitPromiseResolver) {
+    // keepAliveWhilePending() guarantees the promise resolver is never
+    // GC-ed before the OffscreenCanvas
+    m_commitPromiseResolver->reject();
+    m_commitPromiseResolver.clear();
+  }
+}
+
 void OffscreenCanvas::setWidth(unsigned width) {
   IntSize newSize = m_size;
   newSize.setWidth(clampTo<int>(width));
@@ -213,12 +227,48 @@
     // (either main or worker) to the browser process and remains unchanged
     // throughout the lifetime of this OffscreenCanvas.
     m_frameDispatcher = WTF::wrapUnique(new OffscreenCanvasFrameDispatcherImpl(
-        m_clientId, m_sinkId, m_placeholderCanvasId, m_size.width(),
+        this, m_clientId, m_sinkId, m_placeholderCanvasId, m_size.width(),
         m_size.height()));
   }
   return m_frameDispatcher.get();
 }
 
+ScriptPromise OffscreenCanvas::commit(RefPtr<StaticBitmapImage> image,
+                                      bool isWebGLSoftwareRendering,
+                                      ScriptState* scriptState) {
+  if (m_commitPromiseResolver) {
+    if (image) {
+      m_overdrawFrame = std::move(image);
+      m_overdrawFrameIsWebGLSoftwareRendering = isWebGLSoftwareRendering;
+    }
+  } else {
+    m_overdrawFrame = nullptr;
+    m_commitPromiseResolver = ScriptPromiseResolver::create(scriptState);
+    m_commitPromiseResolver->keepAliveWhilePending();
+    doCommit(std::move(image), isWebGLSoftwareRendering);
+  }
+  return m_commitPromiseResolver->promise();
+}
+
+void OffscreenCanvas::doCommit(RefPtr<StaticBitmapImage> image,
+                               bool isWebGLSoftwareRendering) {
+  double commitStartTime = WTF::monotonicallyIncreasingTime();
+  getOrCreateFrameDispatcher()->dispatchFrame(std::move(image), commitStartTime,
+                                              isWebGLSoftwareRendering);
+}
+
+void OffscreenCanvas::beginFrame() {
+  if (m_overdrawFrame) {
+    // if we have an overdraw backlog, push the frame from the backlog
+    // first and save the promise resolution for later.
+    doCommit(std::move(m_overdrawFrame),
+             m_overdrawFrameIsWebGLSoftwareRendering);
+  } else if (m_commitPromiseResolver) {
+    m_commitPromiseResolver->resolve();
+    m_commitPromiseResolver.clear();
+  }
+}
+
 ScriptPromise OffscreenCanvas::convertToBlob(ScriptState* scriptState,
                                              const ImageEncodeOptions& options,
                                              ExceptionState& exceptionState) {
@@ -271,6 +321,7 @@
 DEFINE_TRACE(OffscreenCanvas) {
   visitor->trace(m_context);
   visitor->trace(m_executionContext);
+  visitor->trace(m_commitPromiseResolver);
   EventTargetWithInlineData::trace(visitor);
 }
 
diff --git a/third_party/WebKit/Source/core/offscreencanvas/OffscreenCanvas.h b/third_party/WebKit/Source/core/offscreencanvas/OffscreenCanvas.h
index e3f175a..2d121a593 100644
--- a/third_party/WebKit/Source/core/offscreencanvas/OffscreenCanvas.h
+++ b/third_party/WebKit/Source/core/offscreencanvas/OffscreenCanvas.h
@@ -26,14 +26,18 @@
 typedef OffscreenCanvasRenderingContext2DOrWebGLRenderingContextOrWebGL2RenderingContext
     OffscreenRenderingContext;
 
-class CORE_EXPORT OffscreenCanvas final : public EventTargetWithInlineData,
-                                          public CanvasImageSource,
-                                          public ImageBitmapSource {
+class CORE_EXPORT OffscreenCanvas final
+    : public EventTargetWithInlineData,
+      public CanvasImageSource,
+      public ImageBitmapSource,
+      public OffscreenCanvasFrameDispatcherClient {
   DEFINE_WRAPPERTYPEINFO();
+  USING_PRE_FINALIZER(OffscreenCanvas, dispose);
 
  public:
   static OffscreenCanvas* create(unsigned width, unsigned height);
-  ~OffscreenCanvas() override {}
+  ~OffscreenCanvas() override;
+  void dispose();
 
   // IDL attributes
   unsigned width() const { return m_size.width(); }
@@ -73,8 +77,6 @@
   // TODO(crbug.com/630356): apply the flag to WebGL context as well
   void setDisableReadingFromCanvasTrue() { m_disableReadingFromCanvas = true; }
 
-  OffscreenCanvasFrameDispatcher* getOrCreateFrameDispatcher();
-
   void setFrameSinkId(uint32_t clientId, uint32_t sinkId) {
     m_clientId = clientId;
     m_sinkId = sinkId;
@@ -86,6 +88,15 @@
     m_executionContext = context;
   }
 
+  ScriptPromise commit(RefPtr<StaticBitmapImage>,
+                       bool isWebGLSoftwareRendering,
+                       ScriptState*);
+
+  void detachContext() { m_context = nullptr; }
+
+  // OffscreenCanvasFrameDispatcherClient implementation
+  void beginFrame() final;
+
   // EventTarget implementation
   const AtomicString& interfaceName() const final {
     return EventTargetNames::OffscreenCanvas;
@@ -121,7 +132,8 @@
 
  private:
   explicit OffscreenCanvas(const IntSize&);
-
+  OffscreenCanvasFrameDispatcher* getOrCreateFrameDispatcher();
+  void doCommit(RefPtr<StaticBitmapImage>, bool isWebGLSoftwareRendering);
   using ContextFactoryVector =
       Vector<std::unique_ptr<CanvasRenderingContextFactory>>;
   static ContextFactoryVector& renderingContextFactories();
@@ -139,12 +151,15 @@
   IntSize m_size;
   bool m_isNeutered = false;
 
-  bool m_originClean;
+  bool m_originClean = true;
   bool m_disableReadingFromCanvas = false;
 
   bool isPaintable() const;
 
   std::unique_ptr<OffscreenCanvasFrameDispatcher> m_frameDispatcher;
+  Member<ScriptPromiseResolver> m_commitPromiseResolver;
+  RefPtr<StaticBitmapImage> m_overdrawFrame;
+  bool m_overdrawFrameIsWebGLSoftwareRendering = false;
   // cc::FrameSinkId is broken into two integer components as this can be used
   // in transfer of OffscreenCanvas across threads
   // If this object is not created via
diff --git a/third_party/WebKit/Source/modules/canvas2d/CanvasRenderingContext2DTest.cpp b/third_party/WebKit/Source/modules/canvas2d/CanvasRenderingContext2DTest.cpp
index b820677c..43a45fe 100644
--- a/third_party/WebKit/Source/modules/canvas2d/CanvasRenderingContext2DTest.cpp
+++ b/third_party/WebKit/Source/modules/canvas2d/CanvasRenderingContext2DTest.cpp
@@ -1362,10 +1362,7 @@
         NOTREACHED();
         break;
       case ColorSpaceConversion::DEFAULT_NOT_COLOR_CORRECTED:
-        // TODO(zakerinasab): Replace sRGB with a call to
-        // ImageDecoder::globalTargetColorSpace() when the crash problem on Mac
-        // is fixed. crbug.com/668546.
-        colorSpace = SkColorSpace::MakeNamed(SkColorSpace::kSRGB_Named);
+        colorSpace = ColorBehavior::globalTargetColorSpace();
         colorFormat = colorFormat32;
         break;
       case ColorSpaceConversion::DEFAULT_COLOR_CORRECTED:
diff --git a/third_party/WebKit/Source/modules/encryptedmedia/MediaKeys.h b/third_party/WebKit/Source/modules/encryptedmedia/MediaKeys.h
index db45c61..3b5eeb6b 100644
--- a/third_party/WebKit/Source/modules/encryptedmedia/MediaKeys.h
+++ b/third_party/WebKit/Source/modules/encryptedmedia/MediaKeys.h
@@ -93,6 +93,8 @@
   DECLARE_VIRTUAL_TRACE();
 
   // ContextLifecycleObserver implementation.
+  // FIXME: This class could derive from ContextLifecycleObserver
+  // again (http://crbug.com/483722).
   void contextDestroyed() override;
 
   // ScriptWrappable implementation.
diff --git a/third_party/WebKit/Source/modules/filesystem/DOMFileSystem.cpp b/third_party/WebKit/Source/modules/filesystem/DOMFileSystem.cpp
index eec1bfc..619f3c80 100644
--- a/third_party/WebKit/Source/modules/filesystem/DOMFileSystem.cpp
+++ b/third_party/WebKit/Source/modules/filesystem/DOMFileSystem.cpp
@@ -92,7 +92,7 @@
                              FileSystemType type,
                              const KURL& rootURL)
     : DOMFileSystemBase(context, name, type, rootURL),
-      ContextClient(context),
+      ContextLifecycleObserver(context),
       m_numberOfPendingCallbacks(0),
       m_rootEntry(DirectoryEntry::create(this, DOMFilePath::root)) {}
 
@@ -191,7 +191,7 @@
 
 DEFINE_TRACE(DOMFileSystem) {
   DOMFileSystemBase::trace(visitor);
-  ContextClient::trace(visitor);
+  ContextLifecycleObserver::trace(visitor);
   visitor->trace(m_rootEntry);
 }
 
diff --git a/third_party/WebKit/Source/modules/filesystem/DOMFileSystem.h b/third_party/WebKit/Source/modules/filesystem/DOMFileSystem.h
index 772709a..dfa990e3 100644
--- a/third_party/WebKit/Source/modules/filesystem/DOMFileSystem.h
+++ b/third_party/WebKit/Source/modules/filesystem/DOMFileSystem.h
@@ -55,7 +55,7 @@
     : public DOMFileSystemBase,
       public ScriptWrappable,
       public ActiveScriptWrappable<DOMFileSystem>,
-      public ContextClient {
+      public ContextLifecycleObserver {
   DEFINE_WRAPPERTYPEINFO();
   USING_GARBAGE_COLLECTED_MIXIN(DOMFileSystem);
 
diff --git a/third_party/WebKit/Source/modules/indexeddb/IDBTransaction.cpp b/third_party/WebKit/Source/modules/indexeddb/IDBTransaction.cpp
index 3f9a81e8..7efb5056 100644
--- a/third_party/WebKit/Source/modules/indexeddb/IDBTransaction.cpp
+++ b/third_party/WebKit/Source/modules/indexeddb/IDBTransaction.cpp
@@ -97,7 +97,7 @@
                                const HashSet<String>& scope,
                                WebIDBTransactionMode mode,
                                IDBDatabase* db)
-    : ContextClient(scriptState->getExecutionContext()),
+    : ContextLifecycleObserver(scriptState->getExecutionContext()),
       m_id(id),
       m_database(db),
       m_mode(mode),
@@ -121,7 +121,7 @@
                                IDBDatabase* db,
                                IDBOpenDBRequest* openDBRequest,
                                const IDBDatabaseMetadata& oldMetadata)
-    : ContextClient(executionContext),
+    : ContextLifecycleObserver(executionContext),
       m_id(id),
       m_database(db),
       m_openDBRequest(openDBRequest),
@@ -149,7 +149,7 @@
   visitor->trace(m_oldStoreMetadata);
   visitor->trace(m_deletedIndexes);
   EventTargetWithInlineData::trace(visitor);
-  ContextClient::trace(visitor);
+  ContextLifecycleObserver::trace(visitor);
 }
 
 void IDBTransaction::setError(DOMException* error) {
@@ -452,7 +452,7 @@
 }
 
 ExecutionContext* IDBTransaction::getExecutionContext() const {
-  return ContextClient::getExecutionContext();
+  return ContextLifecycleObserver::getExecutionContext();
 }
 
 DispatchEventResult IDBTransaction::dispatchEventInternal(Event* event) {
diff --git a/third_party/WebKit/Source/modules/indexeddb/IDBTransaction.h b/third_party/WebKit/Source/modules/indexeddb/IDBTransaction.h
index a012eff9..1c3a124 100644
--- a/third_party/WebKit/Source/modules/indexeddb/IDBTransaction.h
+++ b/third_party/WebKit/Source/modules/indexeddb/IDBTransaction.h
@@ -56,7 +56,7 @@
 class MODULES_EXPORT IDBTransaction final
     : public EventTargetWithInlineData,
       public ActiveScriptWrappable<IDBTransaction>,
-      public ContextClient {
+      public ContextLifecycleObserver {
   USING_GARBAGE_COLLECTED_MIXIN(IDBTransaction);
   DEFINE_WRAPPERTYPEINFO();
 
diff --git a/third_party/WebKit/Source/modules/installedapp/NavigatorInstalledApp.cpp b/third_party/WebKit/Source/modules/installedapp/NavigatorInstalledApp.cpp
index 78545b6b..4ba29c0 100644
--- a/third_party/WebKit/Source/modules/installedapp/NavigatorInstalledApp.cpp
+++ b/third_party/WebKit/Source/modules/installedapp/NavigatorInstalledApp.cpp
@@ -22,8 +22,8 @@
 
 namespace blink {
 
-NavigatorInstalledApp::NavigatorInstalledApp(LocalFrame* frame)
-    : ContextClient(frame) {}
+NavigatorInstalledApp::NavigatorInstalledApp(Navigator& navigator)
+    : Supplement<Navigator>(navigator) {}
 
 NavigatorInstalledApp* NavigatorInstalledApp::from(Document& document) {
   if (!document.frame() || !document.frame()->domWindow())
@@ -36,7 +36,7 @@
   NavigatorInstalledApp* supplement = static_cast<NavigatorInstalledApp*>(
       Supplement<Navigator>::from(navigator, supplementName()));
   if (!supplement) {
-    supplement = new NavigatorInstalledApp(navigator.frame());
+    supplement = new NavigatorInstalledApp(navigator);
     provideTo(navigator, supplementName(), supplement);
   }
   return *supplement;
@@ -71,17 +71,15 @@
   ScriptPromiseResolver* resolver = ScriptPromiseResolver::create(scriptState);
   ScriptPromise promise = resolver->promise();
 
-  // Don't crash when called and unattached to document.
-  Document* document = frame() ? frame()->document() : 0;
-
-  if (!document || !controller()) {
+  InstalledAppController* appController = controller();
+  if (!appController) {  // If the associated frame is detached
     DOMException* exception = DOMException::create(
         InvalidStateError, "The object is no longer associated to a document.");
     resolver->reject(exception);
     return promise;
   }
 
-  controller()->getInstalledApps(
+  appController->getInstalledApps(
       WebSecurityOrigin(
           scriptState->getExecutionContext()->getSecurityOrigin()),
       WTF::wrapUnique(
@@ -90,10 +88,10 @@
 }
 
 InstalledAppController* NavigatorInstalledApp::controller() {
-  if (!frame())
+  if (!host()->frame())
     return nullptr;
 
-  return InstalledAppController::from(*frame());
+  return InstalledAppController::from(*host()->frame());
 }
 
 const char* NavigatorInstalledApp::supplementName() {
@@ -102,7 +100,6 @@
 
 DEFINE_TRACE(NavigatorInstalledApp) {
   Supplement<Navigator>::trace(visitor);
-  ContextClient::trace(visitor);
 }
 
 }  // namespace blink
diff --git a/third_party/WebKit/Source/modules/installedapp/NavigatorInstalledApp.h b/third_party/WebKit/Source/modules/installedapp/NavigatorInstalledApp.h
index 17f39de6f..bfd63e3e 100644
--- a/third_party/WebKit/Source/modules/installedapp/NavigatorInstalledApp.h
+++ b/third_party/WebKit/Source/modules/installedapp/NavigatorInstalledApp.h
@@ -5,7 +5,6 @@
 #ifndef NavigatorInstalledApp_h
 #define NavigatorInstalledApp_h
 
-#include "core/dom/ContextLifecycleObserver.h"
 #include "core/frame/Navigator.h"
 #include "platform/Supplementable.h"
 #include "platform/heap/Handle.h"
@@ -21,8 +20,7 @@
 
 class NavigatorInstalledApp final
     : public GarbageCollected<NavigatorInstalledApp>,
-      public Supplement<Navigator>,
-      public ContextClient {
+      public Supplement<Navigator> {
   USING_GARBAGE_COLLECTED_MIXIN(NavigatorInstalledApp);
 
  public:
@@ -37,7 +35,7 @@
   DECLARE_VIRTUAL_TRACE();
 
  private:
-  explicit NavigatorInstalledApp(LocalFrame*);
+  explicit NavigatorInstalledApp(Navigator&);
   static const char* supplementName();
 };
 
diff --git a/third_party/WebKit/Source/modules/offscreencanvas2d/OffscreenCanvasRenderingContext2D.cpp b/third_party/WebKit/Source/modules/offscreencanvas2d/OffscreenCanvasRenderingContext2D.cpp
index 7b71d1a..1ae9597b 100644
--- a/third_party/WebKit/Source/modules/offscreencanvas2d/OffscreenCanvasRenderingContext2D.cpp
+++ b/third_party/WebKit/Source/modules/offscreencanvas2d/OffscreenCanvasRenderingContext2D.cpp
@@ -43,11 +43,12 @@
   BaseRenderingContext2D::trace(visitor);
 }
 
-void OffscreenCanvasRenderingContext2D::commit(ScriptState* scriptState,
-                                               ExceptionState& exceptionState) {
+ScriptPromise OffscreenCanvasRenderingContext2D::commit(
+    ScriptState* scriptState,
+    ExceptionState& exceptionState) {
   UseCounter::Feature feature = UseCounter::OffscreenCanvasCommit2D;
   UseCounter::count(scriptState->getExecutionContext(), feature);
-  if (!getOffscreenCanvas()->hasPlaceholderCanvas()) {
+  if (!offscreenCanvas()->hasPlaceholderCanvas()) {
     // If an OffscreenCanvas has no associated canvas Id, it indicates that
     // it is not an OffscreenCanvas created by transfering control from html
     // canvas.
@@ -55,21 +56,21 @@
                                      "Commit() was called on a context whose "
                                      "OffscreenCanvas is not associated with a "
                                      "canvas element.");
-    return;
+    return exceptionState.reject(scriptState);
   }
-  double commitStartTime = WTF::monotonicallyIncreasingTime();
-  RefPtr<StaticBitmapImage> image = transferToStaticBitmapImage();
-  getOffscreenCanvas()->getOrCreateFrameDispatcher()->dispatchFrame(
-      std::move(image), commitStartTime);
+
+  bool isWebGLSoftwareRendering = false;
+  return offscreenCanvas()->commit(transferToStaticBitmapImage(),
+                                   isWebGLSoftwareRendering, scriptState);
 }
 
 // BaseRenderingContext2D implementation
 bool OffscreenCanvasRenderingContext2D::originClean() const {
-  return getOffscreenCanvas()->originClean();
+  return offscreenCanvas()->originClean();
 }
 
 void OffscreenCanvasRenderingContext2D::setOriginTainted() {
-  return getOffscreenCanvas()->setOriginTainted();
+  return offscreenCanvas()->setOriginTainted();
 }
 
 bool OffscreenCanvasRenderingContext2D::wouldTaintOrigin(
@@ -87,11 +88,11 @@
 }
 
 int OffscreenCanvasRenderingContext2D::width() const {
-  return getOffscreenCanvas()->width();
+  return offscreenCanvas()->width();
 }
 
 int OffscreenCanvasRenderingContext2D::height() const {
-  return getOffscreenCanvas()->height();
+  return offscreenCanvas()->height();
 }
 
 bool OffscreenCanvasRenderingContext2D::hasImageBuffer() const {
@@ -180,7 +181,7 @@
       m_imageBuffer->newSkImageSnapshot(PreferNoAcceleration, reason);
   ImageData* imageData = nullptr;
   if (snapshot) {
-    imageData = ImageData::create(this->getOffscreenCanvas()->size());
+    imageData = ImageData::create(offscreenCanvas()->size());
     SkImageInfo imageInfo =
         SkImageInfo::Make(this->width(), this->height(), kRGBA_8888_SkColorType,
                           kUnpremul_SkAlphaType);
diff --git a/third_party/WebKit/Source/modules/offscreencanvas2d/OffscreenCanvasRenderingContext2D.h b/third_party/WebKit/Source/modules/offscreencanvas2d/OffscreenCanvasRenderingContext2D.h
index 16c3d09..aea21e2 100644
--- a/third_party/WebKit/Source/modules/offscreencanvas2d/OffscreenCanvasRenderingContext2D.h
+++ b/third_party/WebKit/Source/modules/offscreencanvas2d/OffscreenCanvasRenderingContext2D.h
@@ -37,7 +37,7 @@
     }
   };
 
-  void commit(ScriptState*, ExceptionState&);
+  ScriptPromise commit(ScriptState*, ExceptionState&);
 
   // CanvasRenderingContext implementation
   ~OffscreenCanvasRenderingContext2D() override;
@@ -106,8 +106,8 @@
 DEFINE_TYPE_CASTS(OffscreenCanvasRenderingContext2D,
                   CanvasRenderingContext,
                   context,
-                  context->is2d() && context->getOffscreenCanvas(),
-                  context.is2d() && context.getOffscreenCanvas());
+                  context->is2d() && context->offscreenCanvas(),
+                  context.is2d() && context.offscreenCanvas());
 
 }  // namespace blink
 
diff --git a/third_party/WebKit/Source/modules/offscreencanvas2d/OffscreenCanvasRenderingContext2D.idl b/third_party/WebKit/Source/modules/offscreencanvas2d/OffscreenCanvasRenderingContext2D.idl
index 7224955..aa3345c 100644
--- a/third_party/WebKit/Source/modules/offscreencanvas2d/OffscreenCanvasRenderingContext2D.idl
+++ b/third_party/WebKit/Source/modules/offscreencanvas2d/OffscreenCanvasRenderingContext2D.idl
@@ -9,9 +9,9 @@
     RuntimeEnabled=ExperimentalCanvasFeatures,
 ] interface OffscreenCanvasRenderingContext2D {
     // back-reference to the canvas
-    [ImplementedAs=getOffscreenCanvas] readonly attribute OffscreenCanvas canvas;
+    [ImplementedAs=offscreenCanvas] readonly attribute OffscreenCanvas canvas;
 
-    [CallWith=ScriptState, RaisesException] void commit();
+    [CallWith=ScriptState, RaisesException] Promise commit();
 
     // state
     void save(); // push state on state stack
diff --git a/third_party/WebKit/Source/modules/plugins/NavigatorPlugins.cpp b/third_party/WebKit/Source/modules/plugins/NavigatorPlugins.cpp
index 5a006809..93f46131 100644
--- a/third_party/WebKit/Source/modules/plugins/NavigatorPlugins.cpp
+++ b/third_party/WebKit/Source/modules/plugins/NavigatorPlugins.cpp
@@ -13,7 +13,7 @@
 namespace blink {
 
 NavigatorPlugins::NavigatorPlugins(Navigator& navigator)
-    : ContextClient(navigator.frame()) {}
+    : Supplement<Navigator>(navigator) {}
 
 // static
 NavigatorPlugins& NavigatorPlugins::from(Navigator& navigator) {
@@ -67,7 +67,6 @@
   visitor->trace(m_plugins);
   visitor->trace(m_mimeTypes);
   Supplement<Navigator>::trace(visitor);
-  ContextClient::trace(visitor);
 }
 
 }  // namespace blink
diff --git a/third_party/WebKit/Source/modules/plugins/NavigatorPlugins.h b/third_party/WebKit/Source/modules/plugins/NavigatorPlugins.h
index 97fb7ab..8912b64 100644
--- a/third_party/WebKit/Source/modules/plugins/NavigatorPlugins.h
+++ b/third_party/WebKit/Source/modules/plugins/NavigatorPlugins.h
@@ -5,7 +5,6 @@
 #ifndef NavigatorPlugins_h
 #define NavigatorPlugins_h
 
-#include "core/dom/ContextLifecycleObserver.h"
 #include "core/frame/Navigator.h"
 #include "platform/Supplementable.h"
 
@@ -17,8 +16,7 @@
 class Navigator;
 
 class NavigatorPlugins final : public GarbageCollected<NavigatorPlugins>,
-                               public Supplement<Navigator>,
-                               public ContextClient {
+                               public Supplement<Navigator> {
   USING_GARBAGE_COLLECTED_MIXIN(NavigatorPlugins);
 
  public:
diff --git a/third_party/WebKit/Source/modules/presentation/PresentationRequest.cpp b/third_party/WebKit/Source/modules/presentation/PresentationRequest.cpp
index 357d82d..fd276d13 100644
--- a/third_party/WebKit/Source/modules/presentation/PresentationRequest.cpp
+++ b/third_party/WebKit/Source/modules/presentation/PresentationRequest.cpp
@@ -89,7 +89,7 @@
 }
 
 ExecutionContext* PresentationRequest::getExecutionContext() const {
-  return ContextClient::getExecutionContext();
+  return ContextLifecycleObserver::getExecutionContext();
 }
 
 void PresentationRequest::addedEventListener(
@@ -224,11 +224,11 @@
 DEFINE_TRACE(PresentationRequest) {
   visitor->trace(m_availabilityProperty);
   EventTargetWithInlineData::trace(visitor);
-  ContextClient::trace(visitor);
+  ContextLifecycleObserver::trace(visitor);
 }
 
 PresentationRequest::PresentationRequest(ExecutionContext* executionContext,
                                          const KURL& url)
-    : ContextClient(executionContext), m_url(url) {}
+    : ContextLifecycleObserver(executionContext), m_url(url) {}
 
 }  // namespace blink
diff --git a/third_party/WebKit/Source/modules/presentation/PresentationRequest.h b/third_party/WebKit/Source/modules/presentation/PresentationRequest.h
index d914c10..3b59a456 100644
--- a/third_party/WebKit/Source/modules/presentation/PresentationRequest.h
+++ b/third_party/WebKit/Source/modules/presentation/PresentationRequest.h
@@ -22,7 +22,7 @@
 class MODULES_EXPORT PresentationRequest final
     : public EventTargetWithInlineData,
       public ActiveScriptWrappable<PresentationRequest>,
-      public ContextClient {
+      public ContextLifecycleObserver {
   USING_GARBAGE_COLLECTED_MIXIN(PresentationRequest);
   DEFINE_WRAPPERTYPEINFO();
 
diff --git a/third_party/WebKit/Source/modules/webgl/WebGL2RenderingContextBase.cpp b/third_party/WebKit/Source/modules/webgl/WebGL2RenderingContextBase.cpp
index 26b46a6..84e495c 100644
--- a/third_party/WebKit/Source/modules/webgl/WebGL2RenderingContextBase.cpp
+++ b/third_party/WebKit/Source/modules/webgl/WebGL2RenderingContextBase.cpp
@@ -1851,6 +1851,21 @@
       static_cast<uint8_t*>(data->baseAddress()) + srcOffset);
 }
 
+void WebGL2RenderingContextBase::compressedTexImage2D(GLenum target,
+                                                      GLint level,
+                                                      GLenum internalformat,
+                                                      GLsizei width,
+                                                      GLsizei height,
+                                                      GLint border,
+                                                      GLsizei imageSize,
+                                                      GLintptr offset) {
+  if (isContextLost())
+    return;
+  contextGL()->CompressedTexImage2D(target, level, internalformat, width,
+                                    height, border, imageSize,
+                                    reinterpret_cast<uint8_t*>(offset));
+}
+
 void WebGL2RenderingContextBase::compressedTexSubImage2D(
     GLenum target,
     GLint level,
@@ -1898,6 +1913,22 @@
       static_cast<uint8_t*>(data->baseAddress()) + srcOffset);
 }
 
+void WebGL2RenderingContextBase::compressedTexSubImage2D(GLenum target,
+                                                         GLint level,
+                                                         GLint xoffset,
+                                                         GLint yoffset,
+                                                         GLsizei width,
+                                                         GLsizei height,
+                                                         GLenum format,
+                                                         GLsizei imageSize,
+                                                         GLintptr offset) {
+  if (isContextLost())
+    return;
+  contextGL()->CompressedTexSubImage2D(target, level, xoffset, yoffset, width,
+                                       height, format, imageSize,
+                                       reinterpret_cast<uint8_t*>(offset));
+}
+
 void WebGL2RenderingContextBase::compressedTexImage3D(
     GLenum target,
     GLint level,
@@ -1933,6 +1964,22 @@
       static_cast<uint8_t*>(data->baseAddress()) + srcOffset);
 }
 
+void WebGL2RenderingContextBase::compressedTexImage3D(GLenum target,
+                                                      GLint level,
+                                                      GLenum internalformat,
+                                                      GLsizei width,
+                                                      GLsizei height,
+                                                      GLsizei depth,
+                                                      GLint border,
+                                                      GLsizei imageSize,
+                                                      GLintptr offset) {
+  if (isContextLost())
+    return;
+  contextGL()->CompressedTexImage3D(target, level, internalformat, width,
+                                    height, depth, border, imageSize,
+                                    reinterpret_cast<uint8_t*>(offset));
+}
+
 void WebGL2RenderingContextBase::compressedTexSubImage3D(
     GLenum target,
     GLint level,
@@ -1970,6 +2017,24 @@
       static_cast<uint8_t*>(data->baseAddress()) + srcOffset);
 }
 
+void WebGL2RenderingContextBase::compressedTexSubImage3D(GLenum target,
+                                                         GLint level,
+                                                         GLint xoffset,
+                                                         GLint yoffset,
+                                                         GLint zoffset,
+                                                         GLsizei width,
+                                                         GLsizei height,
+                                                         GLsizei depth,
+                                                         GLenum format,
+                                                         GLsizei imageSize,
+                                                         GLintptr offset) {
+  if (isContextLost())
+    return;
+  contextGL()->CompressedTexSubImage3D(target, level, xoffset, yoffset, zoffset,
+                                       width, height, depth, format, imageSize,
+                                       reinterpret_cast<uint8_t*>(offset));
+}
+
 GLint WebGL2RenderingContextBase::getFragDataLocation(WebGLProgram* program,
                                                       const String& name) {
   if (isContextLost() || !validateWebGLObject("getFragDataLocation", program))
diff --git a/third_party/WebKit/Source/modules/webgl/WebGL2RenderingContextBase.h b/third_party/WebKit/Source/modules/webgl/WebGL2RenderingContextBase.h
index b2d07a2..75929a9 100644
--- a/third_party/WebKit/Source/modules/webgl/WebGL2RenderingContextBase.h
+++ b/third_party/WebKit/Source/modules/webgl/WebGL2RenderingContextBase.h
@@ -527,6 +527,43 @@
                                DOMArrayBufferView*,
                                GLuint,
                                GLuint);
+  void compressedTexImage2D(GLenum target,
+                            GLint level,
+                            GLenum internalformat,
+                            GLsizei width,
+                            GLsizei height,
+                            GLint border,
+                            GLsizei imageSize,
+                            GLintptr offset);
+  void compressedTexSubImage2D(GLenum target,
+                               GLint level,
+                               GLint xoffset,
+                               GLint yoffset,
+                               GLsizei width,
+                               GLsizei height,
+                               GLenum format,
+                               GLsizei imageSize,
+                               GLintptr offset);
+  void compressedTexImage3D(GLenum target,
+                            GLint level,
+                            GLenum internalformat,
+                            GLsizei width,
+                            GLsizei height,
+                            GLsizei depth,
+                            GLint border,
+                            GLsizei imageSize,
+                            GLintptr offset);
+  void compressedTexSubImage3D(GLenum target,
+                               GLint level,
+                               GLint xoffset,
+                               GLint yoffset,
+                               GLint zoffset,
+                               GLsizei width,
+                               GLsizei height,
+                               GLsizei depth,
+                               GLenum format,
+                               GLsizei imageSize,
+                               GLintptr offset);
 
   // Have to re-declare/re-define the following compressedTex{Sub}Image2D
   // functions from the base class. This is because the above
diff --git a/third_party/WebKit/Source/modules/webgl/WebGL2RenderingContextBase.idl b/third_party/WebKit/Source/modules/webgl/WebGL2RenderingContextBase.idl
index 1a1bc79e..adfb7fe 100644
--- a/third_party/WebKit/Source/modules/webgl/WebGL2RenderingContextBase.idl
+++ b/third_party/WebKit/Source/modules/webgl/WebGL2RenderingContextBase.idl
@@ -337,6 +337,19 @@
     void compressedTexImage3D(GLenum target, GLint level, GLenum internalformat, GLsizei width, GLsizei height, GLsizei depth, GLint border, ArrayBufferView data, optional GLuint srcOffset = 0, optional GLuint srcLengthOverride = 0);
     void compressedTexSubImage3D(GLenum target, GLint level, GLint xoffset, GLint yoffset, GLint zoffset, GLsizei width, GLsizei height, GLsizei depth, GLenum format, ArrayBufferView data, optional GLuint srcOffset = 0, optional GLuint srcLengthOverride = 0);
 
+    void compressedTexImage2D(GLenum target, GLint level, GLenum internalformat,
+                              GLsizei width, GLsizei height, GLint border,
+                              GLsizei imageSize, GLintptr offset);
+    void compressedTexSubImage2D(GLenum target, GLint level, GLint xoffset, GLint yoffset,
+                                 GLsizei width, GLsizei height, GLenum format,
+                                 GLsizei imageSize, GLintptr offset);
+    void compressedTexImage3D(GLenum target, GLint level, GLenum internalformat,
+                              GLsizei width, GLsizei height, GLsizei depth, GLint border,
+                              GLsizei imageSize, GLintptr offset);
+    void compressedTexSubImage3D(GLenum target, GLint level, GLint xoffset, GLint yoffset, GLint zoffset,
+                                 GLsizei width, GLsizei height, GLsizei depth, GLenum format,
+                                 GLsizei imageSize, GLintptr offset);
+
     /* Programs and shaders */
     GLint getFragDataLocation(WebGLProgram program, DOMString name);
 
diff --git a/third_party/WebKit/Source/modules/webgl/WebGLRenderingContextBase.cpp b/third_party/WebKit/Source/modules/webgl/WebGLRenderingContextBase.cpp
index f9ee5f6c..badcb26 100644
--- a/third_party/WebKit/Source/modules/webgl/WebGLRenderingContextBase.cpp
+++ b/third_party/WebKit/Source/modules/webgl/WebGLRenderingContextBase.cpp
@@ -714,34 +714,34 @@
   return ImageBitmap::create(drawingBuffer()->transferToStaticBitmapImage());
 }
 
-void WebGLRenderingContextBase::commit(ScriptState* scriptState,
-                                       ExceptionState& exceptionState) {
+ScriptPromise WebGLRenderingContextBase::commit(
+    ScriptState* scriptState,
+    ExceptionState& exceptionState) {
   UseCounter::Feature feature = UseCounter::OffscreenCanvasCommitWebGL;
   UseCounter::count(scriptState->getExecutionContext(), feature);
-  if (!getOffscreenCanvas()) {
+  if (!offscreenCanvas()) {
     exceptionState.throwDOMException(InvalidStateError,
                                      "Commit() was called on a rendering "
                                      "context that was not created from an "
                                      "OffscreenCanvas.");
-    return;
+    return exceptionState.reject(scriptState);
   }
   // no HTMLCanvas associated, thrown InvalidStateError
-  if (!getOffscreenCanvas()->hasPlaceholderCanvas()) {
+  if (!offscreenCanvas()->hasPlaceholderCanvas()) {
     exceptionState.throwDOMException(InvalidStateError,
                                      "Commit() was called on a context whose "
                                      "OffscreenCanvas is not associated with a "
                                      "canvas element.");
-    return;
+    return exceptionState.reject(scriptState);
   }
-  if (!drawingBuffer())
-    return;
-  double commitStartTime = WTF::monotonicallyIncreasingTime();
+  if (!drawingBuffer()) {
+    return offscreenCanvas()->commit(nullptr, false, scriptState);
+  }
   // TODO(crbug.com/646864): Make commit() work correctly with
   // { preserveDrawingBuffer : true }.
-  getOffscreenCanvas()->getOrCreateFrameDispatcher()->dispatchFrame(
+  return offscreenCanvas()->commit(
       std::move(drawingBuffer()->transferToStaticBitmapImage()),
-      commitStartTime,
-      drawingBuffer()->contextProvider()->isSoftwareRendering());
+      drawingBuffer()->contextProvider()->isSoftwareRendering(), scriptState);
 }
 
 PassRefPtr<Image> WebGLRenderingContextBase::getImage(
@@ -7406,8 +7406,8 @@
 void WebGLRenderingContextBase::dispatchContextLostEvent(TimerBase*) {
   WebGLContextEvent* event = WebGLContextEvent::create(
       EventTypeNames::webglcontextlost, false, true, "");
-  if (getOffscreenCanvas())
-    getOffscreenCanvas()->dispatchEvent(event);
+  if (offscreenCanvas())
+    offscreenCanvas()->dispatchEvent(event);
   else
     canvas()->dispatchEvent(event);
   m_restoreAllowed = event->defaultPrevented();
@@ -7453,9 +7453,8 @@
       toPlatformContextAttributes(creationAttributes(), version());
   Platform::GraphicsInfo glInfo;
   std::unique_ptr<WebGraphicsContext3DProvider> contextProvider;
-  const auto& url = canvas()
-                        ? canvas()->document().topDocument().url()
-                        : getOffscreenCanvas()->getExecutionContext()->url();
+  const auto& url = canvas() ? canvas()->document().topDocument().url()
+                             : offscreenCanvas()->getExecutionContext()->url();
   if (isMainThread()) {
     contextProvider = WTF::wrapUnique(
         Platform::current()->createOffscreenGraphicsContext3DProvider(
@@ -7510,7 +7509,7 @@
   if (canvas())
     canvas()->dispatchEvent(event);
   else
-    getOffscreenCanvas()->dispatchEvent(event);
+    offscreenCanvas()->dispatchEvent(event);
 }
 
 String WebGLRenderingContextBase::ensureNotNull(const String& text) const {
@@ -7636,8 +7635,8 @@
     width = canvas()->width();
     height = canvas()->height();
   } else {
-    width = getOffscreenCanvas()->width();
-    height = getOffscreenCanvas()->height();
+    width = offscreenCanvas()->width();
+    height = offscreenCanvas()->height();
   }
   return IntSize(clamp(width, 1, m_maxViewportDims[0]),
                  clamp(height, 1, m_maxViewportDims[1]));
@@ -7799,7 +7798,7 @@
   if (canvas())
     result.setHTMLCanvasElement(canvas());
   else
-    result.setOffscreenCanvas(getOffscreenCanvas());
+    result.setOffscreenCanvas(offscreenCanvas());
 }
 
 }  // namespace blink
diff --git a/third_party/WebKit/Source/modules/webgl/WebGLRenderingContextBase.h b/third_party/WebKit/Source/modules/webgl/WebGLRenderingContextBase.h
index 88dce3d..d6de7b3 100644
--- a/third_party/WebKit/Source/modules/webgl/WebGLRenderingContextBase.h
+++ b/third_party/WebKit/Source/modules/webgl/WebGLRenderingContextBase.h
@@ -580,7 +580,7 @@
 
   void getHTMLOrOffscreenCanvas(HTMLCanvasElementOrOffscreenCanvas&) const;
 
-  void commit(ScriptState*, ExceptionState&);
+  ScriptPromise commit(ScriptState*, ExceptionState&);
 
  protected:
   friend class EXTDisjointTimerQuery;
diff --git a/third_party/WebKit/Source/modules/webgl/WebGLRenderingContextBase.idl b/third_party/WebKit/Source/modules/webgl/WebGLRenderingContextBase.idl
index 624f450c..892a94e 100644
--- a/third_party/WebKit/Source/modules/webgl/WebGLRenderingContextBase.idl
+++ b/third_party/WebKit/Source/modules/webgl/WebGLRenderingContextBase.idl
@@ -706,5 +706,5 @@
 
     void viewport(GLint x, GLint y, GLsizei width, GLsizei height);
 
-    [RuntimeEnabled=ExperimentalCanvasFeatures, CallWith=ScriptState, RaisesException] void commit();
+    [RuntimeEnabled=ExperimentalCanvasFeatures, CallWith=ScriptState, RaisesException] Promise commit();
 };
diff --git a/third_party/WebKit/Source/platform/BUILD.gn b/third_party/WebKit/Source/platform/BUILD.gn
index 2e7efe7..d7edb9e 100644
--- a/third_party/WebKit/Source/platform/BUILD.gn
+++ b/third_party/WebKit/Source/platform/BUILD.gn
@@ -2038,6 +2038,19 @@
   dict = "//testing/libfuzzer/fuzzers/dicts/web_icon_sizes.dict"
 }
 
+fuzzer_test("blink_png_decoder_fuzzer") {
+  sources = [
+    "PngFuzzer.cpp",
+  ]
+  deps = [
+    ":blink_fuzzer_test_support",
+    ":platform",
+    "//third_party/libpng",
+  ]
+  dict = "//testing/libfuzzer/fuzzers/dicts/png.dict"
+  seed_corpus = "//third_party/WebKit/LayoutTests/images/resources/pngfuzz"
+}
+
 # Fuzzer for blink::JSONParser.
 fuzzer_test("blink_json_parser_fuzzer") {
   sources = [
diff --git a/third_party/WebKit/Source/platform/PngFuzzer.cpp b/third_party/WebKit/Source/platform/PngFuzzer.cpp
new file mode 100644
index 0000000..eb87610
--- /dev/null
+++ b/third_party/WebKit/Source/platform/PngFuzzer.cpp
@@ -0,0 +1,65 @@
+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// TODO (scroggo): Move this to
+// third_party/WebKit/Source/platform/image-decoders ?
+
+// Compile with:
+// gn gen out/Fuzz '--args=use_libfuzzer=true is_asan=true
+// is_debug=false is_ubsan_security=true' --check
+// ninja -C out/Fuzz blink_png_decoder_fuzzer
+//
+// Run with:
+// ./out/Fuzz/blink_png_decoder_fuzzer
+// third_party/WebKit/LayoutTests/images/resources/pngfuzz
+//
+// Alternatively, it can be run with:
+// ./out/Fuzz/blink_png_decoder_fuzzer ~/another_dir_to_store_corpus
+// third_party/WebKit/LayoutTests/images/resources/pngfuzz
+//
+// so the fuzzer will read both directories passed, but all new generated
+// testcases will go into ~/another_dir_to_store_corpus
+//
+// For more details, see
+// https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/README.md
+
+#include "platform/image-decoders/png/PNGImageDecoder.cpp"
+#include "platform/testing/BlinkFuzzerTestSupport.h"
+
+namespace blink {
+
+std::unique_ptr<ImageDecoder> createDecoder(
+    ImageDecoder::AlphaOption alphaOption) {
+  return WTF::wrapUnique(new PNGImageDecoder(
+      alphaOption, ColorBehavior::transformToTargetForTesting(),
+      ImageDecoder::noDecodedImageByteLimit));
+}
+
+int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
+  auto buffer = SharedBuffer::create(data, size);
+  // TODO (scroggo): Also test ImageDecoder::AlphaNotPremultiplied?
+  auto decoder = createDecoder(ImageDecoder::AlphaPremultiplied);
+  const bool allDataReceived = true;
+  decoder->setData(buffer.get(), allDataReceived);
+  decoder->frameCount();
+  if (decoder->failed())
+    return 0;
+  for (size_t frame = 0; frame < decoder->frameCount(); frame++) {
+    decoder->frameBufferAtIndex(frame);
+    if (decoder->failed())
+      return 0;
+  }
+  return 0;
+}
+
+}  // namespace blink
+
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
+  return blink::LLVMFuzzerTestOneInput(data, size);
+}
+
+extern "C" int LLVMFuzzerInitialize(int* argc, char*** argv) {
+  blink::InitializeBlinkFuzzTest(argc, argv);
+  return 0;
+}
diff --git a/third_party/WebKit/Source/platform/graphics/OffscreenCanvasFrameDispatcher.h b/third_party/WebKit/Source/platform/graphics/OffscreenCanvasFrameDispatcher.h
index 60f7005..d5b7885 100644
--- a/third_party/WebKit/Source/platform/graphics/OffscreenCanvasFrameDispatcher.h
+++ b/third_party/WebKit/Source/platform/graphics/OffscreenCanvasFrameDispatcher.h
@@ -6,6 +6,7 @@
 #define OffscreenCanvasFrameDispatcher_h
 
 #include "platform/PlatformExport.h"
+#include "platform/WebTaskRunner.h"
 #include "wtf/RefPtr.h"
 #include "wtf/WeakPtr.h"
 
@@ -13,13 +14,17 @@
 
 class StaticBitmapImage;
 
+class OffscreenCanvasFrameDispatcherClient {
+ public:
+  virtual void beginFrame() = 0;
+};
+
 class PLATFORM_EXPORT OffscreenCanvasFrameDispatcher {
  public:
-  OffscreenCanvasFrameDispatcher() : m_weakPtrFactory(this) {}
   virtual ~OffscreenCanvasFrameDispatcher() {}
   virtual void dispatchFrame(RefPtr<StaticBitmapImage>,
                              double commitStartTime,
-                             bool isWebGLSoftwareRendering = false) = 0;
+                             bool isWebGLSoftwareRendering) = 0;
   virtual void reclaimResource(unsigned resourceId) = 0;
 
   virtual void reshape(int width, int height) = 0;
@@ -28,8 +33,15 @@
     return m_weakPtrFactory.createWeakPtr();
   }
 
+  OffscreenCanvasFrameDispatcherClient* client() { return m_client; }
+
+ protected:
+  OffscreenCanvasFrameDispatcher(OffscreenCanvasFrameDispatcherClient* client)
+      : m_weakPtrFactory(this), m_client(client) {}
+
  private:
   WeakPtrFactory<OffscreenCanvasFrameDispatcher> m_weakPtrFactory;
+  OffscreenCanvasFrameDispatcherClient* m_client;
 };
 
 }  // namespace blink
diff --git a/third_party/WebKit/Source/platform/graphics/OffscreenCanvasFrameDispatcherImpl.cpp b/third_party/WebKit/Source/platform/graphics/OffscreenCanvasFrameDispatcherImpl.cpp
index 61331f8..e392678f 100644
--- a/third_party/WebKit/Source/platform/graphics/OffscreenCanvasFrameDispatcherImpl.cpp
+++ b/third_party/WebKit/Source/platform/graphics/OffscreenCanvasFrameDispatcherImpl.cpp
@@ -27,13 +27,21 @@
 
 namespace blink {
 
+// This constant specifies the maximum number of pixel buffer that are allowed
+// to co-exist at a given time. The minimum number is 2 (double buffered).
+// larger numbers can help maintain a steadier frame rates, but they increase
+// latency.
+const int kMaximumOffscreenCanvasBufferCount = 3;
+
 OffscreenCanvasFrameDispatcherImpl::OffscreenCanvasFrameDispatcherImpl(
+    OffscreenCanvasFrameDispatcherClient* client,
     uint32_t clientId,
     uint32_t sinkId,
     int canvasId,
     int width,
     int height)
-    : m_frameSinkId(cc::FrameSinkId(clientId, sinkId)),
+    : OffscreenCanvasFrameDispatcher(client),
+      m_frameSinkId(cc::FrameSinkId(clientId, sinkId)),
       m_width(width),
       m_height(height),
       m_changeSizeForNextCommit(false),
@@ -50,6 +58,10 @@
                                       mojo::MakeRequest(&m_sink));
 }
 
+OffscreenCanvasFrameDispatcherImpl::~OffscreenCanvasFrameDispatcherImpl() {
+  m_syntheticBeginFrameTask.cancel();
+}
+
 void OffscreenCanvasFrameDispatcherImpl::setTransferableResourceToSharedBitmap(
     cc::TransferableResource& resource,
     RefPtr<StaticBitmapImage> image) {
@@ -178,9 +190,7 @@
     double commitStartTime,
     bool isWebGLSoftwareRendering /* This flag is true when WebGL's commit is
     called on SwiftShader. */) {
-  if (!image)
-    return;
-  if (!verifyImageSize(image->size()))
+  if (!image || !verifyImageSize(image->size()))
     return;
   cc::CompositorFrame frame;
   // TODO(crbug.com/652931): update the device_scale_factor
@@ -363,6 +373,21 @@
     m_changeSizeForNextCommit = false;
   }
   m_sink->SubmitCompositorFrame(m_currentLocalFrameId, std::move(frame));
+
+  // TODO(crbug.com/674744): Get BeginFrame to fire on its own.
+  scheduleSyntheticBeginFrame();
+}
+
+void OffscreenCanvasFrameDispatcherImpl::scheduleSyntheticBeginFrame() {
+  m_syntheticBeginFrameTask =
+      Platform::current()
+          ->currentThread()
+          ->getWebTaskRunner()
+          ->postDelayedCancellableTask(
+              BLINK_FROM_HERE,
+              WTF::bind(&OffscreenCanvasFrameDispatcherImpl::OnBeginFrame,
+                        WTF::unretained(this), cc::BeginFrameArgs()),
+              16);
 }
 
 void OffscreenCanvasFrameDispatcherImpl::DidReceiveCompositorFrameAck() {
@@ -370,7 +395,22 @@
 }
 
 void OffscreenCanvasFrameDispatcherImpl::OnBeginFrame(
-    const cc::BeginFrameArgs& beginFrameArgs) {}
+    const cc::BeginFrameArgs& beginFrameArgs) {
+  if (!client())
+    return;
+  unsigned framesInFlight = m_cachedImages.size() + m_sharedBitmaps.size() +
+                            m_cachedTextureIds.size();
+
+  // Limit the rate of compositor commits.
+  if (framesInFlight < kMaximumOffscreenCanvasBufferCount) {
+    client()->beginFrame();
+  } else {
+    // TODO(crbug.com/674744): Get BeginFrame to fire on its own.
+    // The following call is to reschedule the frame in cases where we encounter
+    // a backlog.
+    scheduleSyntheticBeginFrame();
+  }
+}
 
 void OffscreenCanvasFrameDispatcherImpl::ReclaimResources(
     const cc::ReturnedResourceArray& resources) {
@@ -384,7 +424,6 @@
 
 void OffscreenCanvasFrameDispatcherImpl::WillDrawSurface() {
   // TODO(fsamuel, staraz): Implement this.
-  NOTIMPLEMENTED();
 }
 
 void OffscreenCanvasFrameDispatcherImpl::reclaimResource(unsigned resourceId) {
diff --git a/third_party/WebKit/Source/platform/graphics/OffscreenCanvasFrameDispatcherImpl.h b/third_party/WebKit/Source/platform/graphics/OffscreenCanvasFrameDispatcherImpl.h
index bb531ca..6f10cc79 100644
--- a/third_party/WebKit/Source/platform/graphics/OffscreenCanvasFrameDispatcherImpl.h
+++ b/third_party/WebKit/Source/platform/graphics/OffscreenCanvasFrameDispatcherImpl.h
@@ -23,24 +23,26 @@
       NON_EXPORTED_BASE(
           public cc::mojom::blink::MojoCompositorFrameSinkClient) {
  public:
-  OffscreenCanvasFrameDispatcherImpl(uint32_t clientId,
+  OffscreenCanvasFrameDispatcherImpl(OffscreenCanvasFrameDispatcherClient*,
+                                     uint32_t clientId,
                                      uint32_t sinkId,
                                      int canvasId,
                                      int width,
                                      int height);
 
   // OffscreenCanvasFrameDispatcher implementation.
-  ~OffscreenCanvasFrameDispatcherImpl() override {}
+  ~OffscreenCanvasFrameDispatcherImpl() final;
   void dispatchFrame(RefPtr<StaticBitmapImage>,
                      double commitStartTime,
-                     bool isWebGLSoftwareRendering = false) override;
-  void reclaimResource(unsigned resourceId) override;
+                     bool isWebGLSoftwareRendering = false) final;
+  void reclaimResource(unsigned resourceId) final;
+  void reshape(int width, int height) final;
 
   // cc::mojom::blink::MojoCompositorFrameSinkClient implementation.
-  void DidReceiveCompositorFrameAck() override;
-  void OnBeginFrame(const cc::BeginFrameArgs&) override;
-  void ReclaimResources(const cc::ReturnedResourceArray& resources) override;
-  void WillDrawSurface() override;
+  void DidReceiveCompositorFrameAck() final;
+  void OnBeginFrame(const cc::BeginFrameArgs&) final;
+  void ReclaimResources(const cc::ReturnedResourceArray& resources) final;
+  void WillDrawSurface() final;
 
   // This enum is used in histogram, so it should be append-only.
   enum OffscreenCanvasCommitType {
@@ -51,11 +53,12 @@
     OffscreenCanvasCommitTypeCount,
   };
 
-  void reshape(int width, int height) override;
-
  private:
   // Surface-related
   cc::SurfaceIdAllocator m_surfaceIdAllocator;
+  void scheduleSyntheticBeginFrame();  // To be removed (crbug.com/674744)
+
+  TaskHandle m_syntheticBeginFrameTask;  // To be removed (crbug.com/674744)
   const cc::FrameSinkId m_frameSinkId;
   cc::LocalFrameId m_currentLocalFrameId;
 
diff --git a/third_party/WebKit/Source/platform/scheduler/DEPS b/third_party/WebKit/Source/platform/scheduler/DEPS
index b2f8c40..6958aa7 100644
--- a/third_party/WebKit/Source/platform/scheduler/DEPS
+++ b/third_party/WebKit/Source/platform/scheduler/DEPS
@@ -6,7 +6,6 @@
   "+base/cancelable_callback.h",
   "+base/command_line.h",
   "+base/compiler_specific.h",
-  "+base/containers/scoped_ptr_hash_map.h",
   "+base/debug/stack_trace.h",
   "+base/debug/task_annotator.h",
   "+base/feature_list.h",
diff --git a/third_party/WebKit/Source/platform/scheduler/renderer/webthread_impl_for_renderer_scheduler.h b/third_party/WebKit/Source/platform/scheduler/renderer/webthread_impl_for_renderer_scheduler.h
index 6b22afc..f0308e5a 100644
--- a/third_party/WebKit/Source/platform/scheduler/renderer/webthread_impl_for_renderer_scheduler.h
+++ b/third_party/WebKit/Source/platform/scheduler/renderer/webthread_impl_for_renderer_scheduler.h
@@ -5,7 +5,6 @@
 #ifndef THIRD_PARTY_WEBKIT_SOURCE_PLATFORM_SCHEDULER_RENDERER_WEBTHREAD_IMPL_FOR_RENDERER_SCHEDULER_H_
 #define THIRD_PARTY_WEBKIT_SOURCE_PLATFORM_SCHEDULER_RENDERER_WEBTHREAD_IMPL_FOR_RENDERER_SCHEDULER_H_
 
-#include "base/containers/scoped_ptr_hash_map.h"
 #include "public/platform/scheduler/child/webthread_base.h"
 
 namespace blink {
diff --git a/tools/clang/rewrite_to_chrome_style/RewriteToChromeStyle.cpp b/tools/clang/rewrite_to_chrome_style/RewriteToChromeStyle.cpp
index c3d3356..0365ec1e 100644
--- a/tools/clang/rewrite_to_chrome_style/RewriteToChromeStyle.cpp
+++ b/tools/clang/rewrite_to_chrome_style/RewriteToChromeStyle.cpp
@@ -1074,8 +1074,8 @@
   auto field_decl_matcher = id("decl", fieldDecl(in_blink_namespace));
   auto is_type_trait_value =
       varDecl(hasName("value"), hasStaticStorageDuration(), isPublic(),
-              hasType(isConstQualified()), hasType(type(anyOf(
-                  booleanType(), enumType()))),
+              hasType(isConstQualified()),
+              hasType(type(anyOf(builtinType(), enumType()))),
               unless(hasAncestor(recordDecl(
                   has(cxxMethodDecl(isUserProvided(), isInstanceMethod()))))));
   auto var_decl_matcher =
diff --git a/tools/clang/rewrite_to_chrome_style/tests/fields-expected.cc b/tools/clang/rewrite_to_chrome_style/tests/fields-expected.cc
index e0f87b1..e59d5328 100644
--- a/tools/clang/rewrite_to_chrome_style/tests/fields-expected.cc
+++ b/tools/clang/rewrite_to_chrome_style/tests/fields-expected.cc
@@ -153,6 +153,13 @@
   static const int kWeakHandlingFlag = TypeTrait2<T>::value ? 123 : 456;
 };
 
+template <int Format>
+struct IntermediateFormat {
+  // Some type traits have int type.  Example below is loosely based on
+  // third_party/WebKit/Source/platform/graphics/gpu/WebGLImageConversion.cpp
+  static const int value = (Format == 123) ? 456 : 789;
+};
+
 };  // namespace WTF
 
 void F() {
diff --git a/tools/clang/rewrite_to_chrome_style/tests/fields-original.cc b/tools/clang/rewrite_to_chrome_style/tests/fields-original.cc
index d93d986..d2c1b4d 100644
--- a/tools/clang/rewrite_to_chrome_style/tests/fields-original.cc
+++ b/tools/clang/rewrite_to_chrome_style/tests/fields-original.cc
@@ -150,6 +150,13 @@
   static const int kWeakHandlingFlag = TypeTrait2<T>::value ? 123 : 456;
 };
 
+template <int Format>
+struct IntermediateFormat {
+  // Some type traits have int type.  Example below is loosely based on
+  // third_party/WebKit/Source/platform/graphics/gpu/WebGLImageConversion.cpp
+  static const int value = (Format == 123) ? 456 : 789;
+};
+
 };  // namespace WTF
 
 void F() {
diff --git a/tools/perf/benchmarks/system_health.py b/tools/perf/benchmarks/system_health.py
index 8053919..d9469eb 100644
--- a/tools/perf/benchmarks/system_health.py
+++ b/tools/perf/benchmarks/system_health.py
@@ -77,6 +77,10 @@
         possible_browser.platform.GetDeviceTypeName() == 'Nexus 5X'):
       return True
 
+    # http://crbug.com/667470
+    if 'Nexus 7' in possible_browser.platform.GetDeviceTypeName():
+      return True
+
     return possible_browser.platform.GetDeviceTypeName() == 'Desktop'
 
 
diff --git a/ui/app_list/views/search_result_container_view.h b/ui/app_list/views/search_result_container_view.h
index fc57192..8c941a8a 100644
--- a/ui/app_list/views/search_result_container_view.h
+++ b/ui/app_list/views/search_result_container_view.h
@@ -48,7 +48,6 @@
   bool IsValidSelectionIndex(int index) const;
 
   int num_results() const { return num_results_; }
-  void set_num_results(int num_results) { num_results_ = num_results; }
 
   void set_container_score(double score) { container_score_ = score; }
   double container_score() const { return container_score_; }
diff --git a/ui/app_list/views/start_page_view.cc b/ui/app_list/views/start_page_view.cc
index 8df6a7a..0bac15b 100644
--- a/ui/app_list/views/start_page_view.cc
+++ b/ui/app_list/views/start_page_view.cc
@@ -190,7 +190,7 @@
       delete search_result_tile_views_[i];
     search_result_tile_views_.clear();
     RemoveChildView(all_apps_button_);
-    CreateAppsGrid(display_results.size());
+    CreateAppsGrid(std::min(kNumStartPageTiles, display_results.size()));
   }
 
   // Update the tile item results.
@@ -211,10 +211,10 @@
 void StartPageView::StartPageTilesContainer::UpdateSelectedIndex(
     int old_selected,
     int new_selected) {
-  if (old_selected >= 0 && old_selected < num_results())
+  if (old_selected >= 0)
     GetTileItemView(old_selected)->SetSelected(false);
 
-  if (new_selected >= 0 && new_selected < num_results())
+  if (new_selected >= 0)
     GetTileItemView(new_selected)->SetSelected(true);
 }
 
@@ -360,8 +360,8 @@
     custom_page_view->SetVisible(
         app_list_main_view_->ShouldShowCustomLauncherPage());
   }
+  tiles_container_->Update();
   tiles_container_->ClearSelectedIndex();
-  tiles_container_->set_num_results(tiles_container_->Update());
   custom_launcher_page_background_->SetSelected(false);
 }
 
diff --git a/ui/arc/notification/arc_notification_item.cc b/ui/arc/notification/arc_notification_item.cc
index ca97cf6..f67f33a 100644
--- a/ui/arc/notification/arc_notification_item.cc
+++ b/ui/arc/notification/arc_notification_item.cc
@@ -12,8 +12,7 @@
 #include "base/strings/string16.h"
 #include "base/strings/utf_string_conversions.h"
 #include "base/task_runner.h"
-#include "base/task_runner_util.h"
-#include "base/threading/worker_pool.h"
+#include "base/task_scheduler/post_task.h"
 #include "third_party/skia/include/core/SkCanvas.h"
 #include "third_party/skia/include/core/SkPaint.h"
 #include "ui/gfx/codec/png_codec.h"
@@ -33,7 +32,6 @@
 constexpr char kNotificationIdPrefix[] = "ARC_NOTIFICATION_";
 
 SkBitmap DecodeImage(const std::vector<uint8_t>& data) {
-  DCHECK(base::WorkerPool::RunsTasksOnCurrentThread());
   DCHECK(!data.empty());  // empty string should be handled in caller.
 
   // We may decode an image in the browser process since it has been generated
@@ -237,8 +235,9 @@
   }
 
   // TODO(yoshiki): Remove decoding by passing a bitmap directly from Android.
-  base::PostTaskAndReplyWithResult(
-      base::WorkerPool::GetTaskRunner(true).get(), FROM_HERE,
+  base::PostTaskWithTraitsAndReplyWithResult(
+      FROM_HERE, base::TaskTraits().WithShutdownBehavior(
+                     base::TaskShutdownBehavior::CONTINUE_ON_SHUTDOWN),
       base::Bind(&DecodeImage, data->icon_data),
       base::Bind(&ArcNotificationItem::OnImageDecoded,
                  weak_ptr_factory_.GetWeakPtr()));
diff --git a/ui/base/clipboard/clipboard_win.cc b/ui/base/clipboard/clipboard_win.cc
index 344951e..de66360 100644
--- a/ui/base/clipboard/clipboard_win.cc
+++ b/ui/base/clipboard/clipboard_win.cc
@@ -25,6 +25,7 @@
 #include "base/win/message_window.h"
 #include "base/win/scoped_gdi_object.h"
 #include "base/win/scoped_hdc.h"
+#include "skia/ext/skia_utils_win.h"
 #include "third_party/skia/include/core/SkBitmap.h"
 #include "ui/base/clipboard/clipboard_util_win.h"
 #include "ui/base/clipboard/custom_data_helper.h"
@@ -611,16 +612,21 @@
   const void* bitmap_bits = reinterpret_cast<const char*>(bitmap)
       + bitmap->bmiHeader.biSize + color_table_length * sizeof(RGBQUAD);
 
-  gfx::Canvas canvas(gfx::Size(bitmap->bmiHeader.biWidth,
-                               bitmap->bmiHeader.biHeight),
-                     1.0f,
-                     false);
+  void* dst_bits;
+  // dst_hbitmap is freed by the release_proc in skia_bitmap (below)
+  HBITMAP dst_hbitmap =
+      skia::CreateHBitmap(bitmap->bmiHeader.biWidth, bitmap->bmiHeader.biHeight,
+                          false, 0, &dst_bits);
+
   {
-    HDC dc = skia::GetNativeDrawingContext(canvas.sk_canvas());
-    ::SetDIBitsToDevice(dc, 0, 0, bitmap->bmiHeader.biWidth,
+    base::win::ScopedCreateDC hdc(CreateCompatibleDC(NULL));
+    HBITMAP old_hbitmap =
+        static_cast<HBITMAP>(SelectObject(hdc.Get(), dst_hbitmap));
+    ::SetDIBitsToDevice(hdc.Get(), 0, 0, bitmap->bmiHeader.biWidth,
                         bitmap->bmiHeader.biHeight, 0, 0, 0,
                         bitmap->bmiHeader.biHeight, bitmap_bits, bitmap,
                         DIB_RGB_COLORS);
+    SelectObject(hdc.Get(), old_hbitmap);
   }
   // Windows doesn't really handle alpha channels well in many situations. When
   // the source image is < 32 bpp, we force the bitmap to be opaque. When the
@@ -630,8 +636,10 @@
   // we assume the alpha channel contains garbage and force the bitmap to be
   // opaque as well. Note that this  heuristic will fail on a transparent bitmap
   // containing only black pixels...
-  SkPixmap device_pixels;
-  skia::GetWritablePixels(canvas.sk_canvas(), &device_pixels);
+  SkPixmap device_pixels(SkImageInfo::MakeN32Premul(bitmap->bmiHeader.biWidth,
+                                                    bitmap->bmiHeader.biHeight),
+                         dst_bits, bitmap->bmiHeader.biWidth * 4);
+
   {
     bool has_invalid_alpha_channel = bitmap->bmiHeader.biBitCount < 32 ||
         BitmapHasInvalidPremultipliedColors(device_pixels);
@@ -640,7 +648,14 @@
     }
   }
 
-  return canvas.ExtractImageRep().sk_bitmap();
+  SkBitmap skia_bitmap;
+  skia_bitmap.installPixels(device_pixels.info(), device_pixels.writable_addr(),
+                            device_pixels.rowBytes(), nullptr,
+                            [](void* pixels, void* hbitmap) {
+                              DeleteObject(static_cast<HBITMAP>(hbitmap));
+                            },
+                            dst_hbitmap);
+  return skia_bitmap;
 }
 
 void ClipboardWin::ReadCustomData(ClipboardType clipboard_type,
diff --git a/ui/events/ozone/evdev/libgestures_glue/gesture_property_provider.cc b/ui/events/ozone/evdev/libgestures_glue/gesture_property_provider.cc
index e445f1a..c0d8c122 100644
--- a/ui/events/ozone/evdev/libgestures_glue/gesture_property_provider.cc
+++ b/ui/events/ozone/evdev/libgestures_glue/gesture_property_provider.cc
@@ -611,11 +611,6 @@
 namespace internal {
 
 // Struct holding properties of a device.
-//
-// Note that we can't define it in GesturePropertyProvider as a nested class
-// because ScopedPtrHashMap will require us to expose the GestureProp's
-// destructor so that it can instantiate the object. This is something we
-// don't want to do.
 struct GestureDevicePropertyData {
   GestureDevicePropertyData() {}
 
diff --git a/ui/views/controls/textfield/textfield.cc b/ui/views/controls/textfield/textfield.cc
index 95b32cf..217bb57a 100644
--- a/ui/views/controls/textfield/textfield.cc
+++ b/ui/views/controls/textfield/textfield.cc
@@ -411,11 +411,6 @@
   SchedulePaint();
 }
 
-void Textfield::SetShadows(const gfx::ShadowValues& shadows) {
-  GetRenderText()->set_shadows(shadows);
-  SchedulePaint();
-}
-
 SkColor Textfield::GetSelectionBackgroundColor() const {
   return use_default_selection_background_color_ ?
       GetNativeTheme()->GetSystemColor(
diff --git a/ui/views/controls/textfield/textfield.h b/ui/views/controls/textfield/textfield.h
index bcc3bbc..69d7b46 100644
--- a/ui/views/controls/textfield/textfield.h
+++ b/ui/views/controls/textfield/textfield.h
@@ -139,9 +139,6 @@
   void SetSelectionBackgroundColor(SkColor color);
   void UseDefaultSelectionBackgroundColor();
 
-  // Set drop shadows underneath the text.
-  void SetShadows(const gfx::ShadowValues& shadows);
-
   // Gets/Sets whether or not the cursor is enabled.
   bool GetCursorEnabled() const;
   void SetCursorEnabled(bool enabled);
diff --git a/ui/views/widget/native_widget_aura.cc b/ui/views/widget/native_widget_aura.cc
index 419ed47c..e493ea20 100644
--- a/ui/views/widget/native_widget_aura.cc
+++ b/ui/views/widget/native_widget_aura.cc
@@ -22,6 +22,7 @@
 #include "ui/aura/client/screen_position_client.h"
 #include "ui/aura/client/window_parenting_client.h"
 #include "ui/aura/env.h"
+#include "ui/aura/mus/property_utils.h"
 #include "ui/aura/window.h"
 #include "ui/aura/window_event_dispatcher.h"
 #include "ui/aura/window_observer.h"
@@ -141,7 +142,9 @@
   ownership_ = params.ownership;
 
   RegisterNativeWidgetForWindow(this, window_);
-  window_->SetType(GetAuraWindowTypeForWidgetType(params.type));
+  // MusClient has assertions that ui::mojom::WindowType matches
+  // views::Widget::InitParams::Type.
+  aura::SetWindowType(window_, static_cast<ui::mojom::WindowType>(params.type));
   window_->SetProperty(aura::client::kShowStateKey, params.show_state);
   if (params.type == Widget::InitParams::TYPE_BUBBLE)
     aura::client::SetHideOnDeactivate(window_, true);