diff --git a/DEPS b/DEPS
index 62d84b66ed..72156a0 100644
--- a/DEPS
+++ b/DEPS
@@ -45,11 +45,11 @@
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling Skia
   # and whatever else without interference from each other.
-  'skia_revision': 'cb9adf7c6e81bf0bf4825afddf7732810f174ea2',
+  'skia_revision': '94fddf83816ab846a25134dfc845746187b7733b',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling V8
   # and whatever else without interference from each other.
-  'v8_revision': 'c42c017f8423a0e142efc00599336d16cc50ec2f',
+  'v8_revision': '89e89852ff80a9b2d455f5e1f19b52e19652f41b',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling swarming_client
   # and whatever else without interference from each other.
@@ -101,7 +101,7 @@
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling catapult
   # and whatever else without interference from each other.
-  'catapult_revision': '9a255f51046c55ea3c209acd64e36d8a5bd46fa4',
+  'catapult_revision': '2d5148d57e6e520edf4adbc2f43a8f16c03c010a',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling libFuzzer
   # and whatever else without interference from each other.
diff --git a/android_webview/browser/aw_browser_context.cc b/android_webview/browser/aw_browser_context.cc
index 5b26cd6..baa76ec 100644
--- a/android_webview/browser/aw_browser_context.cc
+++ b/android_webview/browser/aw_browser_context.cc
@@ -247,13 +247,13 @@
   safe_browsing::RegisterProfilePrefs(pref_registry);
 
   PrefServiceFactory pref_service_factory;
-  pref_service_factory.set_user_prefs(make_scoped_refptr(
-      new InMemoryPrefStore()));
+  pref_service_factory.set_user_prefs(
+      base::MakeRefCounted<InMemoryPrefStore>());
   pref_service_factory.set_managed_prefs(
-      make_scoped_refptr(new policy::ConfigurationPolicyPrefStore(
+      base::MakeRefCounted<policy::ConfigurationPolicyPrefStore>(
           browser_policy_connector_->GetPolicyService(),
           browser_policy_connector_->GetHandlerList(),
-          policy::POLICY_LEVEL_MANDATORY)));
+          policy::POLICY_LEVEL_MANDATORY));
   pref_service_factory.set_read_error_callback(base::Bind(&HandleReadError));
   user_pref_service_ = pref_service_factory.Create(pref_registry);
   pref_change_registrar_.Init(user_pref_service_.get());
diff --git a/android_webview/browser/aw_field_trial_creator.cc b/android_webview/browser/aw_field_trial_creator.cc
index e0c8094..7eea8d9 100644
--- a/android_webview/browser/aw_field_trial_creator.cc
+++ b/android_webview/browser/aw_field_trial_creator.cc
@@ -70,7 +70,7 @@
       base::MakeUnique<base::ListValue>());
 
   pref_service_factory_.set_user_prefs(
-      make_scoped_refptr(new InMemoryPrefStore()));
+      base::MakeRefCounted<InMemoryPrefStore>());
   return pref_service_factory_.Create(pref_registry.get());
 }
 
diff --git a/ash/app_list/app_list_presenter_delegate_unittest.cc b/ash/app_list/app_list_presenter_delegate_unittest.cc
index d3129f8..bd612b9 100644
--- a/ash/app_list/app_list_presenter_delegate_unittest.cc
+++ b/ash/app_list/app_list_presenter_delegate_unittest.cc
@@ -11,6 +11,7 @@
 #include "ash/public/cpp/shell_window_ids.h"
 #include "ash/shelf/shelf.h"
 #include "ash/shelf/shelf_layout_manager.h"
+#include "ash/shelf/shelf_view.h"
 #include "ash/shell.h"
 #include "ash/shell_port.h"
 #include "ash/test/ash_test_base.h"
@@ -1052,4 +1053,24 @@
               view->app_list_state());
 }
 
+// Tests that a drag can not make the app list smaller than the shelf height.
+TEST_F(FullscreenAppListPresenterDelegateTest,
+       LauncherCannotGetSmallerThanShelf) {
+  app_list_presenter_impl()->Show(GetPrimaryDisplayId());
+  app_list::AppListView* view = app_list_presenter_impl()->GetView();
+
+  // Try to place the app list 1 px below the shelf, it should stay at shelf
+  // height.
+  int target_y = GetPrimaryShelf()
+                     ->GetShelfViewForTesting()
+                     ->GetBoundsInScreen()
+                     .top_right()
+                     .y();
+  const int expected_app_list_y = target_y;
+  target_y += 1;
+  view->UpdateYPositionAndOpacity(target_y, 1);
+
+  EXPECT_EQ(expected_app_list_y, view->GetBoundsInScreen().top_right().y());
+}
+
 }  // namespace ash
diff --git a/ash/display/display_manager_unittest.cc b/ash/display/display_manager_unittest.cc
index 41e7f48e..afe67c719 100644
--- a/ash/display/display_manager_unittest.cc
+++ b/ash/display/display_manager_unittest.cc
@@ -1472,12 +1472,12 @@
   display::ManagedDisplayInfo native_display_info =
       CreateDisplayInfo(display_id, gfx::Rect(0, 0, 1000, 500));
   display::ManagedDisplayInfo::ManagedDisplayModeList display_modes;
-  display_modes.push_back(make_scoped_refptr(new display::ManagedDisplayMode(
-      gfx::Size(1000, 500), 58.0f, false, true)));
-  display_modes.push_back(make_scoped_refptr(new display::ManagedDisplayMode(
-      gfx::Size(800, 300), 59.0f, false, false)));
-  display_modes.push_back(make_scoped_refptr(new display::ManagedDisplayMode(
-      gfx::Size(400, 500), 60.0f, false, false)));
+  display_modes.push_back(base::MakeRefCounted<display::ManagedDisplayMode>(
+      gfx::Size(1000, 500), 58.0f, false, true));
+  display_modes.push_back(base::MakeRefCounted<display::ManagedDisplayMode>(
+      gfx::Size(800, 300), 59.0f, false, false));
+  display_modes.push_back(base::MakeRefCounted<display::ManagedDisplayMode>(
+      gfx::Size(400, 500), 60.0f, false, false));
 
   native_display_info.SetManagedDisplayModes(display_modes);
 
@@ -1539,12 +1539,12 @@
   display::ManagedDisplayInfo native_display_info =
       CreateDisplayInfo(display_id, gfx::Rect(0, 0, 1000, 500));
   display::ManagedDisplayInfo::ManagedDisplayModeList display_modes;
-  display_modes.push_back(make_scoped_refptr(new display::ManagedDisplayMode(
-      gfx::Size(1000, 500), 58.0f, false, true)));
-  display_modes.push_back(make_scoped_refptr(new display::ManagedDisplayMode(
-      gfx::Size(800, 300), 59.0f, false, false)));
-  display_modes.push_back(make_scoped_refptr(new display::ManagedDisplayMode(
-      gfx::Size(400, 500), 60.0f, false, false)));
+  display_modes.push_back(base::MakeRefCounted<display::ManagedDisplayMode>(
+      gfx::Size(1000, 500), 58.0f, false, true));
+  display_modes.push_back(base::MakeRefCounted<display::ManagedDisplayMode>(
+      gfx::Size(800, 300), 59.0f, false, false));
+  display_modes.push_back(base::MakeRefCounted<display::ManagedDisplayMode>(
+      gfx::Size(400, 500), 60.0f, false, false));
 
   display::ManagedDisplayInfo::ManagedDisplayModeList copy = display_modes;
   native_display_info.SetManagedDisplayModes(copy);
diff --git a/ash/shelf/shelf_widget.cc b/ash/shelf/shelf_widget.cc
index 74d1517..e5d98269 100644
--- a/ash/shelf/shelf_widget.cc
+++ b/ash/shelf/shelf_widget.cc
@@ -64,7 +64,7 @@
  private:
   ShelfWidget* shelf_widget_;
   FocusCycler* focus_cycler_;
-  // A black background layer that may be visible depending on a
+  // A background layer that may be visible depending on a
   // ShelfBackgroundAnimator.
   ui::Layer opaque_background_;
   // A black foreground layer which is shown while transitioning between users.
@@ -86,6 +86,7 @@
   opaque_background_.SetBounds(GetLocalBounds());
   opaque_foreground_.SetBounds(GetLocalBounds());
   opaque_foreground_.SetOpacity(0.0f);
+  opaque_foreground_.SetColor(SK_ColorBLACK);
 }
 
 ShelfWidget::DelegateView::~DelegateView() {}
diff --git a/base/android/jni_generator/SampleForTests_jni.golden b/base/android/jni_generator/SampleForTests_jni.golden
index db497a3c..8a12f5b3 100644
--- a/base/android/jni_generator/SampleForTests_jni.golden
+++ b/base/android/jni_generator/SampleForTests_jni.golden
@@ -14,8 +14,6 @@
 
 #include "base/android/jni_generator/jni_generator_helper.h"
 
-#include "base/android/jni_int_wrapper.h"
-
 // Step 1: forward declarations.
 JNI_REGISTRATION_EXPORT extern const char
     kClassPath_org_chromium_example_jni_1generator_SampleForTests_00024InnerStructA[];
diff --git a/base/android/jni_generator/jni_generator.py b/base/android/jni_generator/jni_generator.py
index c7cee4b..d1e042d 100755
--- a/base/android/jni_generator/jni_generator.py
+++ b/base/android/jni_generator/jni_generator.py
@@ -888,8 +888,6 @@
 
 ${INCLUDES}
 
-#include "base/android/jni_int_wrapper.h"
-
 // Step 1: forward declarations.
 $CLASS_PATH_DEFINITIONS
 
diff --git a/base/android/jni_generator/jni_generator_helper.h b/base/android/jni_generator/jni_generator_helper.h
index 53629a657..8505baf 100644
--- a/base/android/jni_generator/jni_generator_helper.h
+++ b/base/android/jni_generator/jni_generator_helper.h
@@ -8,6 +8,7 @@
 #include <jni.h>
 
 #include "base/android/jni_android.h"
+#include "base/android/jni_int_wrapper.h"
 #include "base/android/scoped_java_ref.h"
 #include "base/logging.h"
 #include "build/build_config.h"
diff --git a/base/android/jni_generator/testCalledByNatives.golden b/base/android/jni_generator/testCalledByNatives.golden
index 420844e7..b2ab408 100644
--- a/base/android/jni_generator/testCalledByNatives.golden
+++ b/base/android/jni_generator/testCalledByNatives.golden
@@ -14,8 +14,6 @@
 
 #include "base/android/jni_generator/jni_generator_helper.h"
 
-#include "base/android/jni_int_wrapper.h"
-
 // Step 1: forward declarations.
 JNI_REGISTRATION_EXPORT extern const char kClassPath_org_chromium_TestJni[];
 const char kClassPath_org_chromium_TestJni[] = "org/chromium/TestJni";
diff --git a/base/android/jni_generator/testConstantsFromJavaP.golden b/base/android/jni_generator/testConstantsFromJavaP.golden
index 769a7eb..9b5a4bc 100644
--- a/base/android/jni_generator/testConstantsFromJavaP.golden
+++ b/base/android/jni_generator/testConstantsFromJavaP.golden
@@ -14,8 +14,6 @@
 
 #include "base/android/jni_generator/jni_generator_helper.h"
 
-#include "base/android/jni_int_wrapper.h"
-
 // Step 1: forward declarations.
 JNI_REGISTRATION_EXPORT extern const char kClassPath_android_view_MotionEvent[];
 const char kClassPath_android_view_MotionEvent[] = "android/view/MotionEvent";
diff --git a/base/android/jni_generator/testFromJavaP.golden b/base/android/jni_generator/testFromJavaP.golden
index 73ed4b3..67393627 100644
--- a/base/android/jni_generator/testFromJavaP.golden
+++ b/base/android/jni_generator/testFromJavaP.golden
@@ -14,8 +14,6 @@
 
 #include "base/android/jni_generator/jni_generator_helper.h"
 
-#include "base/android/jni_int_wrapper.h"
-
 // Step 1: forward declarations.
 JNI_REGISTRATION_EXPORT extern const char kClassPath_java_io_InputStream[];
 const char kClassPath_java_io_InputStream[] = "java/io/InputStream";
diff --git a/base/android/jni_generator/testFromJavaPGenerics.golden b/base/android/jni_generator/testFromJavaPGenerics.golden
index 164db66..158d1de 100644
--- a/base/android/jni_generator/testFromJavaPGenerics.golden
+++ b/base/android/jni_generator/testFromJavaPGenerics.golden
@@ -14,8 +14,6 @@
 
 #include "base/android/jni_generator/jni_generator_helper.h"
 
-#include "base/android/jni_int_wrapper.h"
-
 // Step 1: forward declarations.
 JNI_REGISTRATION_EXPORT extern const char kClassPath_java_util_HashSet[];
 const char kClassPath_java_util_HashSet[] = "java/util/HashSet";
diff --git a/base/android/jni_generator/testInnerClassNatives.golden b/base/android/jni_generator/testInnerClassNatives.golden
index 93316ad..6a2a87b 100644
--- a/base/android/jni_generator/testInnerClassNatives.golden
+++ b/base/android/jni_generator/testInnerClassNatives.golden
@@ -14,8 +14,6 @@
 
 #include "base/android/jni_generator/jni_generator_helper.h"
 
-#include "base/android/jni_int_wrapper.h"
-
 // Step 1: forward declarations.
 JNI_REGISTRATION_EXPORT extern const char kClassPath_org_chromium_TestJni[];
 const char kClassPath_org_chromium_TestJni[] = "org/chromium/TestJni";
diff --git a/base/android/jni_generator/testInnerClassNativesBothInnerAndOuter.golden b/base/android/jni_generator/testInnerClassNativesBothInnerAndOuter.golden
index d9712089..a6228f65 100644
--- a/base/android/jni_generator/testInnerClassNativesBothInnerAndOuter.golden
+++ b/base/android/jni_generator/testInnerClassNativesBothInnerAndOuter.golden
@@ -14,8 +14,6 @@
 
 #include "base/android/jni_generator/jni_generator_helper.h"
 
-#include "base/android/jni_int_wrapper.h"
-
 // Step 1: forward declarations.
 JNI_REGISTRATION_EXPORT extern const char
     kClassPath_org_chromium_TestJni_00024MyOtherInnerClass[];
diff --git a/base/android/jni_generator/testInnerClassNativesMultiple.golden b/base/android/jni_generator/testInnerClassNativesMultiple.golden
index ae93a86..b933c62 100644
--- a/base/android/jni_generator/testInnerClassNativesMultiple.golden
+++ b/base/android/jni_generator/testInnerClassNativesMultiple.golden
@@ -14,8 +14,6 @@
 
 #include "base/android/jni_generator/jni_generator_helper.h"
 
-#include "base/android/jni_int_wrapper.h"
-
 // Step 1: forward declarations.
 JNI_REGISTRATION_EXPORT extern const char
     kClassPath_org_chromium_TestJni_00024MyOtherInnerClass[];
diff --git a/base/android/jni_generator/testMultipleJNIAdditionalImport.golden b/base/android/jni_generator/testMultipleJNIAdditionalImport.golden
index 4a3d91c2..4999e97f 100644
--- a/base/android/jni_generator/testMultipleJNIAdditionalImport.golden
+++ b/base/android/jni_generator/testMultipleJNIAdditionalImport.golden
@@ -14,8 +14,6 @@
 
 #include "base/android/jni_generator/jni_generator_helper.h"
 
-#include "base/android/jni_int_wrapper.h"
-
 // Step 1: forward declarations.
 JNI_REGISTRATION_EXPORT extern const char kClassPath_org_chromium_foo_Foo[];
 const char kClassPath_org_chromium_foo_Foo[] = "org/chromium/foo/Foo";
diff --git a/base/android/jni_generator/testNativeExportsOnlyOption.golden b/base/android/jni_generator/testNativeExportsOnlyOption.golden
index f5be7c4..9fb7ef99 100644
--- a/base/android/jni_generator/testNativeExportsOnlyOption.golden
+++ b/base/android/jni_generator/testNativeExportsOnlyOption.golden
@@ -14,8 +14,6 @@
 
 #include "base/android/jni_generator/jni_generator_helper.h"
 
-#include "base/android/jni_int_wrapper.h"
-
 // Step 1: forward declarations.
 JNI_REGISTRATION_EXPORT extern const char
     kClassPath_org_chromium_example_jni_1generator_SampleForTests_00024MyOtherInnerClass[];
diff --git a/base/android/jni_generator/testNatives.golden b/base/android/jni_generator/testNatives.golden
index b57f935..0fddef4e 100644
--- a/base/android/jni_generator/testNatives.golden
+++ b/base/android/jni_generator/testNatives.golden
@@ -14,8 +14,6 @@
 
 #include "base/android/jni_generator/jni_generator_helper.h"
 
-#include "base/android/jni_int_wrapper.h"
-
 // Step 1: forward declarations.
 JNI_REGISTRATION_EXPORT extern const char kClassPath_org_chromium_TestJni[];
 const char kClassPath_org_chromium_TestJni[] = "org/chromium/TestJni";
diff --git a/base/android/jni_generator/testNativesLong.golden b/base/android/jni_generator/testNativesLong.golden
index 18d58fa4..992b4f5 100644
--- a/base/android/jni_generator/testNativesLong.golden
+++ b/base/android/jni_generator/testNativesLong.golden
@@ -14,8 +14,6 @@
 
 #include "base/android/jni_generator/jni_generator_helper.h"
 
-#include "base/android/jni_int_wrapper.h"
-
 // Step 1: forward declarations.
 JNI_REGISTRATION_EXPORT extern const char kClassPath_org_chromium_TestJni[];
 const char kClassPath_org_chromium_TestJni[] = "org/chromium/TestJni";
diff --git a/base/android/jni_generator/testSingleJNIAdditionalImport.golden b/base/android/jni_generator/testSingleJNIAdditionalImport.golden
index c8b6907..3c0c15e 100644
--- a/base/android/jni_generator/testSingleJNIAdditionalImport.golden
+++ b/base/android/jni_generator/testSingleJNIAdditionalImport.golden
@@ -14,8 +14,6 @@
 
 #include "base/android/jni_generator/jni_generator_helper.h"
 
-#include "base/android/jni_int_wrapper.h"
-
 // Step 1: forward declarations.
 JNI_REGISTRATION_EXPORT extern const char kClassPath_org_chromium_foo_Foo[];
 const char kClassPath_org_chromium_foo_Foo[] = "org/chromium/foo/Foo";
diff --git a/base/file_descriptor_store.cc b/base/file_descriptor_store.cc
index 15188cdf..34f3381 100644
--- a/base/file_descriptor_store.cc
+++ b/base/file_descriptor_store.cc
@@ -39,7 +39,7 @@
     base::MemoryMappedFile::Region* region) {
   base::ScopedFD fd = MaybeTakeFD(key, region);
   if (!fd.is_valid())
-    DLOG(FATAL) << "Unknown global descriptor: " << key;
+    DLOG(DCHECK) << "Unknown global descriptor: " << key;
   return fd;
 }
 
diff --git a/base/ios/scoped_critical_action.mm b/base/ios/scoped_critical_action.mm
index 3828fbc..dbfbd45 100644
--- a/base/ios/scoped_critical_action.mm
+++ b/base/ios/scoped_critical_action.mm
@@ -14,7 +14,7 @@
 namespace ios {
 
 ScopedCriticalAction::ScopedCriticalAction()
-    : core_(base::MakeRefCounted<ScopedCriticalAction::Core>()) {
+    : core_(MakeRefCounted<ScopedCriticalAction::Core>()) {
   ScopedCriticalAction::Core::StartBackgroundTask(core_);
 }
 
diff --git a/base/memory/discardable_shared_memory.cc b/base/memory/discardable_shared_memory.cc
index 7be8cf75..2b7f738 100644
--- a/base/memory/discardable_shared_memory.cc
+++ b/base/memory/discardable_shared_memory.cc
@@ -404,8 +404,8 @@
               AlignToPageSize(sizeof(SharedState)),
           AlignToPageSize(mapped_size_));
       if (discard_result != ERROR_SUCCESS) {
-        DLOG(FATAL) << "DiscardVirtualMemory() failed in Purge(): "
-                    << logging::SystemErrorCodeToString(discard_result);
+        DLOG(DCHECK) << "DiscardVirtualMemory() failed in Purge(): "
+                     << logging::SystemErrorCodeToString(discard_result);
       }
     }
   }
diff --git a/base/observer_list_unittest.cc b/base/observer_list_unittest.cc
index 21257e1..16bd088f 100644
--- a/base/observer_list_unittest.cc
+++ b/base/observer_list_unittest.cc
@@ -532,7 +532,7 @@
   auto task_runner_1 = CreateSequencedTaskRunnerWithTraits(TaskTraits());
   auto task_runner_2 = CreateSequencedTaskRunnerWithTraits(TaskTraits());
 
-  auto observer_list = make_scoped_refptr(new ObserverListThreadSafe<Foo>());
+  auto observer_list = MakeRefCounted<ObserverListThreadSafe<Foo>>();
 
   SequenceVerificationObserver observer_1(task_runner_1);
   SequenceVerificationObserver observer_2(task_runner_2);
@@ -558,7 +558,7 @@
 // from a notification, it is itself notified.
 TEST(ObserverListThreadSafeTest, AddObserverFromNotificationNotifyAll) {
   test::ScopedTaskEnvironment scoped_task_environment;
-  auto observer_list = make_scoped_refptr(new ObserverListThreadSafe<Foo>());
+  auto observer_list = MakeRefCounted<ObserverListThreadSafe<Foo>>();
 
   Adder observer_added_from_notification(1);
 
@@ -605,7 +605,7 @@
 // Verify that there is no crash when an observer is removed while it is being
 // notified.
 TEST(ObserverListThreadSafeTest, RemoveWhileNotificationIsRunning) {
-  auto observer_list = make_scoped_refptr(new ObserverListThreadSafe<Foo>());
+  auto observer_list = MakeRefCounted<ObserverListThreadSafe<Foo>>();
   RemoveWhileNotificationIsRunningObserver observer;
 
   WaitableEvent task_running(WaitableEvent::ResetPolicy::AUTOMATIC,
diff --git a/base/posix/global_descriptors.cc b/base/posix/global_descriptors.cc
index 8da808e..9cc75531 100644
--- a/base/posix/global_descriptors.cc
+++ b/base/posix/global_descriptors.cc
@@ -33,7 +33,7 @@
   const int ret = MaybeGet(key);
 
   if (ret == -1)
-    DLOG(FATAL) << "Unknown global descriptor: " << key;
+    DLOG(DCHECK) << "Unknown global descriptor: " << key;
   return ret;
 }
 
@@ -86,7 +86,7 @@
     if (i.key == key)
       return i.region;
   }
-  DLOG(FATAL) << "Unknown global descriptor: " << key;
+  DLOG(DCHECK) << "Unknown global descriptor: " << key;
   return base::MemoryMappedFile::Region::kWholeFile;
 }
 
diff --git a/base/task_scheduler/delayed_task_manager_unittest.cc b/base/task_scheduler/delayed_task_manager_unittest.cc
index 23cdb0ca..b3dbf07 100644
--- a/base/task_scheduler/delayed_task_manager_unittest.cc
+++ b/base/task_scheduler/delayed_task_manager_unittest.cc
@@ -61,7 +61,7 @@
 
   testing::StrictMock<MockTaskTarget> task_target_;
   const scoped_refptr<TestMockTimeTaskRunner> service_thread_task_runner_ =
-      make_scoped_refptr(new TestMockTimeTaskRunner);
+      MakeRefCounted<TestMockTimeTaskRunner>();
   DelayedTaskManager delayed_task_manager_;
   std::unique_ptr<Task> task_ = CreateTask(kLongDelay);
   Task* const task_raw_ = task_.get();
diff --git a/base/task_scheduler/scheduler_single_thread_task_runner_manager.cc b/base/task_scheduler/scheduler_single_thread_task_runner_manager.cc
index a3a493f..472931ca 100644
--- a/base/task_scheduler/scheduler_single_thread_task_runner_manager.cc
+++ b/base/task_scheduler/scheduler_single_thread_task_runner_manager.cc
@@ -514,9 +514,9 @@
     ThreadPriority priority_hint) {
   lock_.AssertAcquired();
   int id = next_worker_id_++;
-  workers_.emplace_back(make_scoped_refptr(new SchedulerWorker(
+  workers_.emplace_back(MakeRefCounted<SchedulerWorker>(
       priority_hint, CreateSchedulerWorkerDelegate<DelegateType>(name, id),
-      task_tracker_)));
+      task_tracker_));
   return workers_.back().get();
 }
 
diff --git a/base/task_scheduler/scheduler_worker_stack_unittest.cc b/base/task_scheduler/scheduler_worker_stack_unittest.cc
index bdb2778..d159c64 100644
--- a/base/task_scheduler/scheduler_worker_stack_unittest.cc
+++ b/base/task_scheduler/scheduler_worker_stack_unittest.cc
@@ -40,17 +40,17 @@
 class TaskSchedulerWorkerStackTest : public testing::Test {
  protected:
   void SetUp() override {
-    worker_a_ = make_scoped_refptr(new SchedulerWorker(
+    worker_a_ = MakeRefCounted<SchedulerWorker>(
         ThreadPriority::NORMAL, WrapUnique(new MockSchedulerWorkerDelegate),
-        &task_tracker_));
+        &task_tracker_);
     ASSERT_TRUE(worker_a_);
-    worker_b_ = make_scoped_refptr(new SchedulerWorker(
+    worker_b_ = MakeRefCounted<SchedulerWorker>(
         ThreadPriority::NORMAL, WrapUnique(new MockSchedulerWorkerDelegate),
-        &task_tracker_));
+        &task_tracker_);
     ASSERT_TRUE(worker_b_);
-    worker_c_ = make_scoped_refptr(new SchedulerWorker(
+    worker_c_ = MakeRefCounted<SchedulerWorker>(
         ThreadPriority::NORMAL, WrapUnique(new MockSchedulerWorkerDelegate),
-        &task_tracker_));
+        &task_tracker_);
     ASSERT_TRUE(worker_c_);
   }
 
diff --git a/base/task_scheduler/scheduler_worker_unittest.cc b/base/task_scheduler/scheduler_worker_unittest.cc
index e7d98da9..2308f02b 100644
--- a/base/task_scheduler/scheduler_worker_unittest.cc
+++ b/base/task_scheduler/scheduler_worker_unittest.cc
@@ -77,9 +77,9 @@
                     WaitableEvent::InitialState::NOT_SIGNALED) {}
 
   void SetUp() override {
-    worker_ = make_scoped_refptr(new SchedulerWorker(
+    worker_ = MakeRefCounted<SchedulerWorker>(
         ThreadPriority::NORMAL,
-        std::make_unique<TestSchedulerWorkerDelegate>(this), &task_tracker_));
+        std::make_unique<TestSchedulerWorkerDelegate>(this), &task_tracker_);
     ASSERT_TRUE(worker_);
     worker_->Start();
     worker_set_.Signal();
@@ -512,8 +512,8 @@
       delegate->controls();
   controls->set_can_cleanup(true);
   EXPECT_CALL(*delegate, OnMainEntry(_));
-  auto worker = make_scoped_refptr(new SchedulerWorker(
-      ThreadPriority::NORMAL, WrapUnique(delegate), &task_tracker));
+  auto worker = MakeRefCounted<SchedulerWorker>(
+      ThreadPriority::NORMAL, WrapUnique(delegate), &task_tracker);
   worker->Start();
   worker->WakeUp();
   controls->WaitForWorkToRun();
@@ -533,8 +533,8 @@
 
   controls->HaveWorkBlock();
 
-  auto worker = make_scoped_refptr(new SchedulerWorker(
-      ThreadPriority::NORMAL, std::move(delegate), &task_tracker));
+  auto worker = MakeRefCounted<SchedulerWorker>(
+      ThreadPriority::NORMAL, std::move(delegate), &task_tracker);
   worker->Start();
   worker->WakeUp();
 
@@ -555,8 +555,8 @@
   scoped_refptr<ControllableCleanupDelegate::Controls> controls =
       delegate->controls();
 
-  auto worker = make_scoped_refptr(new SchedulerWorker(
-      ThreadPriority::NORMAL, std::move(delegate), &task_tracker));
+  auto worker = MakeRefCounted<SchedulerWorker>(
+      ThreadPriority::NORMAL, std::move(delegate), &task_tracker);
   worker->Start();
   worker->WakeUp();
 
@@ -578,8 +578,8 @@
 
   controls->HaveWorkBlock();
 
-  auto worker = make_scoped_refptr(new SchedulerWorker(
-      ThreadPriority::NORMAL, std::move(delegate), &task_tracker));
+  auto worker = MakeRefCounted<SchedulerWorker>(
+      ThreadPriority::NORMAL, std::move(delegate), &task_tracker);
   worker->Start();
   worker->WakeUp();
 
@@ -603,8 +603,8 @@
       delegate->controls();
   controls->set_expect_get_work(false);
 
-  auto worker = make_scoped_refptr(new SchedulerWorker(
-      ThreadPriority::NORMAL, std::move(delegate), &task_tracker));
+  auto worker = MakeRefCounted<SchedulerWorker>(
+      ThreadPriority::NORMAL, std::move(delegate), &task_tracker);
 
   worker->Cleanup();
   worker->Start();
@@ -652,8 +652,8 @@
 
   controls->HaveWorkBlock();
 
-  auto worker = make_scoped_refptr(new SchedulerWorker(
-      ThreadPriority::NORMAL, std::move(delegate), &task_tracker));
+  auto worker = MakeRefCounted<SchedulerWorker>(
+      ThreadPriority::NORMAL, std::move(delegate), &task_tracker);
   worker->Start();
   worker->WakeUp();
 
@@ -731,8 +731,8 @@
           ? ThreadPriority::BACKGROUND
           : ThreadPriority::NORMAL);
 
-  auto worker = make_scoped_refptr(new SchedulerWorker(
-      ThreadPriority::BACKGROUND, std::move(delegate), &task_tracker));
+  auto worker = MakeRefCounted<SchedulerWorker>(
+      ThreadPriority::BACKGROUND, std::move(delegate), &task_tracker);
   worker->Start();
 
   // Verify that the initial thread priority is BACKGROUND (or NORMAL if thread
@@ -791,9 +791,9 @@
 
   // Create a worker with backward compatibility ENABLED. Wake it up and wait
   // until GetWork() returns.
-  auto worker = make_scoped_refptr(new SchedulerWorker(
+  auto worker = MakeRefCounted<SchedulerWorker>(
       ThreadPriority::NORMAL, std::move(delegate), &task_tracker, nullptr,
-      SchedulerBackwardCompatibility::INIT_COM_STA));
+      SchedulerBackwardCompatibility::INIT_COM_STA);
   worker->Start();
   worker->WakeUp();
   delegate_raw->WaitUntilGetWorkReturned();
@@ -818,9 +818,9 @@
 
   // Create a worker with backward compatibility DISABLED. Wake it up and wait
   // until GetWork() returns.
-  auto worker = make_scoped_refptr(new SchedulerWorker(
+  auto worker = MakeRefCounted<SchedulerWorker>(
       ThreadPriority::NORMAL, std::move(delegate), &task_tracker, nullptr,
-      SchedulerBackwardCompatibility::DISABLED));
+      SchedulerBackwardCompatibility::DISABLED);
   worker->Start();
   worker->WakeUp();
   delegate_raw->WaitUntilGetWorkReturned();
diff --git a/base/threading/post_task_and_reply_impl_unittest.cc b/base/threading/post_task_and_reply_impl_unittest.cc
index 9578071..6678c95 100644
--- a/base/threading/post_task_and_reply_impl_unittest.cc
+++ b/base/threading/post_task_and_reply_impl_unittest.cc
@@ -73,13 +73,12 @@
   testing::StrictMock<MockObject> mock_object;
   bool delete_flag = false;
 
-  EXPECT_TRUE(
-      PostTaskAndReplyTaskRunner(post_runner.get())
-          .PostTaskAndReply(
-              FROM_HERE,
-              BindOnce(&MockObject::Task, Unretained(&mock_object),
-                       make_scoped_refptr(new ObjectToDelete(&delete_flag))),
-              BindOnce(&MockObject::Reply, Unretained(&mock_object))));
+  EXPECT_TRUE(PostTaskAndReplyTaskRunner(post_runner.get())
+                  .PostTaskAndReply(
+                      FROM_HERE,
+                      BindOnce(&MockObject::Task, Unretained(&mock_object),
+                               MakeRefCounted<ObjectToDelete>(&delete_flag)),
+                      BindOnce(&MockObject::Reply, Unretained(&mock_object))));
 
   // Expect the task to be posted to |post_runner|.
   EXPECT_TRUE(post_runner->HasPendingTask());
diff --git a/base/threading/sequenced_worker_pool_unittest.cc b/base/threading/sequenced_worker_pool_unittest.cc
index afa9c5a..8afd5a1 100644
--- a/base/threading/sequenced_worker_pool_unittest.cc
+++ b/base/threading/sequenced_worker_pool_unittest.cc
@@ -393,7 +393,7 @@
   EXPECT_TRUE(pool()->PostDelayedTask(
       FROM_HERE,
       base::BindOnce(&ShouldNotRun,
-                     make_scoped_refptr(new DeletionHelper(deleted_flag))),
+                     MakeRefCounted<DeletionHelper>(deleted_flag)),
       TestTimeouts::action_timeout()));
 
   std::vector<int> completion_sequence = tracker()->WaitUntilTasksComplete(1);
diff --git a/base/threading/thread_checker_unittest.cc b/base/threading/thread_checker_unittest.cc
index cc40974..e258bfc2 100644
--- a/base/threading/thread_checker_unittest.cc
+++ b/base/threading/thread_checker_unittest.cc
@@ -63,7 +63,7 @@
     ThreadCheckerImpl* thread_checker,
     SequenceToken sequence_token) {
   ThreadTaskRunnerHandle thread_task_runner_handle(
-      make_scoped_refptr(new TestSimpleTaskRunner));
+      MakeRefCounted<TestSimpleTaskRunner>());
   ScopedSetSequenceTokenForCurrentThread
       scoped_set_sequence_token_for_current_thread(sequence_token);
   ExpectNotCalledOnValidThread(thread_checker);
@@ -79,7 +79,7 @@
 TEST(ThreadCheckerTest,
      AllowedSameThreadAndSequenceDifferentTasksWithThreadTaskRunnerHandle) {
   ThreadTaskRunnerHandle thread_task_runner_handle(
-      make_scoped_refptr(new TestSimpleTaskRunner));
+      MakeRefCounted<TestSimpleTaskRunner>());
 
   std::unique_ptr<ThreadCheckerImpl> thread_checker;
   const SequenceToken sequence_token = SequenceToken::Create();
@@ -130,7 +130,7 @@
 
 TEST(ThreadCheckerTest, DisallowedDifferentThreadsSameSequence) {
   ThreadTaskRunnerHandle thread_task_runner_handle(
-      make_scoped_refptr(new TestSimpleTaskRunner));
+      MakeRefCounted<TestSimpleTaskRunner>());
   const SequenceToken sequence_token(SequenceToken::Create());
 
   ScopedSetSequenceTokenForCurrentThread
@@ -147,7 +147,7 @@
   std::unique_ptr<ThreadCheckerImpl> thread_checker;
 
   ThreadTaskRunnerHandle thread_task_runner_handle(
-      make_scoped_refptr(new TestSimpleTaskRunner));
+      MakeRefCounted<TestSimpleTaskRunner>());
 
   {
     ScopedSetSequenceTokenForCurrentThread
@@ -180,7 +180,7 @@
 
 TEST(ThreadCheckerTest, DetachFromThreadWithSequenceToken) {
   ThreadTaskRunnerHandle thread_task_runner_handle(
-      make_scoped_refptr(new TestSimpleTaskRunner));
+      MakeRefCounted<TestSimpleTaskRunner>());
   ScopedSetSequenceTokenForCurrentThread
       scoped_set_sequence_token_for_current_thread(SequenceToken::Create());
   ThreadCheckerImpl thread_checker;
diff --git a/base/trace_event/memory_dump_manager_unittest.cc b/base/trace_event/memory_dump_manager_unittest.cc
index 6d4925b9..30a69ea 100644
--- a/base/trace_event/memory_dump_manager_unittest.cc
+++ b/base/trace_event/memory_dump_manager_unittest.cc
@@ -508,9 +508,9 @@
   InitializeMemoryDumpManagerForInProcessTesting(false /* is_coordinator */);
   std::vector<MockMemoryDumpProvider> mdps(3);
   scoped_refptr<TestSequencedTaskRunner> task_runner1(
-      make_scoped_refptr(new TestSequencedTaskRunner()));
+      MakeRefCounted<TestSequencedTaskRunner>());
   scoped_refptr<TestSequencedTaskRunner> task_runner2(
-      make_scoped_refptr(new TestSequencedTaskRunner()));
+      MakeRefCounted<TestSequencedTaskRunner>());
   RegisterDumpProviderWithSequencedTaskRunner(&mdps[0], task_runner1,
                                               kDefaultOptions);
   RegisterDumpProviderWithSequencedTaskRunner(&mdps[1], task_runner2,
diff --git a/build/android/pylib/local/device/local_device_environment.py b/build/android/pylib/local/device/local_device_environment.py
index e04e5c6f..1bae4a0 100644
--- a/build/android/pylib/local/device/local_device_environment.py
+++ b/build/android/pylib/local/device/local_device_environment.py
@@ -31,7 +31,6 @@
 
 
 LOGCAT_FILTERS = [
-  '*:e',
   'chromium:v',
   'cr_*:v',
   'DEBUG:I',
diff --git a/build/config/android/rules.gni b/build/config/android/rules.gni
index 6332b8f6..971bb702 100644
--- a/build/config/android/rules.gni
+++ b/build/config/android/rules.gni
@@ -176,8 +176,12 @@
     package_output_dir = "${base_output_dir}/${jni_package}"
     jni_output_dir = "${package_output_dir}/jni"
 
-    jni_generator_include =
-        "//base/android/jni_generator/jni_generator_helper.h"
+    if (defined(invoker.jni_generator_include)) {
+      jni_generator_include = invoker.jni_generator_include
+    } else {
+      jni_generator_include =
+          "//base/android/jni_generator/jni_generator_helper.h"
+    }
 
     foreach_target_name = "${target_name}__jni_gen"
     action_foreach(foreach_target_name) {
diff --git a/cc/base/delayed_unique_notifier_unittest.cc b/cc/base/delayed_unique_notifier_unittest.cc
index bbd2db5..bc1dfc4 100644
--- a/cc/base/delayed_unique_notifier_unittest.cc
+++ b/cc/base/delayed_unique_notifier_unittest.cc
@@ -37,7 +37,7 @@
 
   void SetUp() override {
     notification_count_ = 0;
-    task_runner_ = make_scoped_refptr(new base::TestSimpleTaskRunner);
+    task_runner_ = base::MakeRefCounted<base::TestSimpleTaskRunner>();
   }
 
   void Notify() { ++notification_count_; }
diff --git a/cc/blink/web_content_layer_impl.cc b/cc/blink/web_content_layer_impl.cc
index fe7d016..c72dffe 100644
--- a/cc/blink/web_content_layer_impl.cc
+++ b/cc/blink/web_content_layer_impl.cc
@@ -76,7 +76,7 @@
 scoped_refptr<cc::DisplayItemList>
 WebContentLayerImpl::PaintContentsToDisplayList(
     cc::ContentLayerClient::PaintingControlSetting painting_control) {
-  auto display_list = make_scoped_refptr(new cc::DisplayItemList);
+  auto display_list = base::MakeRefCounted<cc::DisplayItemList>();
   if (client_) {
     WebDisplayItemListImpl list(display_list.get());
     client_->PaintContents(&list, PaintingControlToWeb(painting_control));
diff --git a/cc/blink/web_display_item_list_impl_unittest.cc b/cc/blink/web_display_item_list_impl_unittest.cc
index 1cdabf3..19f1f1657 100644
--- a/cc/blink/web_display_item_list_impl_unittest.cc
+++ b/cc/blink/web_display_item_list_impl_unittest.cc
@@ -36,7 +36,7 @@
         clip_bounds.x, clip_bounds.y, clip_bounds.width, clip_bounds.height);
     SkIRect clip_irect = sk_clip_bounds.roundOut();
 
-    auto cc_list = make_scoped_refptr(new cc::DisplayItemList);
+    auto cc_list = base::MakeRefCounted<cc::DisplayItemList>();
     cc_blink::WebDisplayItemListImpl web_list(cc_list.get());
 
     // drawColor(background color)
diff --git a/cc/paint/display_item_list_unittest.cc b/cc/paint/display_item_list_unittest.cc
index 5fec9fb..c0308cd 100644
--- a/cc/paint/display_item_list_unittest.cc
+++ b/cc/paint/display_item_list_unittest.cc
@@ -72,7 +72,7 @@
   PaintFlags red_paint;
   red_paint.setColor(SK_ColorRED);
   unsigned char pixels[4 * 100 * 100] = {0};
-  auto list = make_scoped_refptr(new DisplayItemList);
+  auto list = base::MakeRefCounted<DisplayItemList>();
 
   gfx::Point offset(8, 9);
 
@@ -108,7 +108,7 @@
 
 TEST(DisplayItemListTest, EmptyUnpairedRangeDoesNotAddVisualRect) {
   gfx::Rect layer_rect(100, 100);
-  auto list = make_scoped_refptr(new DisplayItemList);
+  auto list = base::MakeRefCounted<DisplayItemList>();
 
   {
     list->StartPaint();
@@ -134,7 +134,7 @@
   PaintFlags red_paint;
   red_paint.setColor(SK_ColorRED);
   unsigned char pixels[4 * 100 * 100] = {0};
-  auto list = make_scoped_refptr(new DisplayItemList);
+  auto list = base::MakeRefCounted<DisplayItemList>();
 
   gfx::Point first_offset(8, 9);
   gfx::Rect first_recording_rect(first_offset, layer_rect.size());
@@ -208,7 +208,7 @@
   PaintFlags red_paint;
   red_paint.setColor(SK_ColorRED);
   unsigned char pixels[4 * 100 * 100] = {0};
-  auto list = make_scoped_refptr(new DisplayItemList);
+  auto list = base::MakeRefCounted<DisplayItemList>();
 
   gfx::Point first_offset(8, 9);
   gfx::Rect first_recording_rect(first_offset, layer_rect.size());
@@ -277,7 +277,7 @@
   gfx::Rect layer_rect(100, 100);
   FilterOperations filters;
   unsigned char pixels[4 * 100 * 100] = {0};
-  auto list = make_scoped_refptr(new DisplayItemList);
+  auto list = base::MakeRefCounted<DisplayItemList>();
 
   sk_sp<SkSurface> source_surface = SkSurface::MakeRasterN32Premul(50, 50);
   SkCanvas* source_canvas = source_surface->getCanvas();
@@ -359,7 +359,7 @@
   const int kNumPaintOps = 1000;
   size_t memory_usage;
 
-  auto list = make_scoped_refptr(new DisplayItemList);
+  auto list = base::MakeRefCounted<DisplayItemList>();
 
   gfx::Rect layer_rect(100, 100);
   PaintFlags blue_flags;
@@ -378,7 +378,7 @@
 }
 
 TEST(DisplayItemListTest, AsValueWithNoOps) {
-  auto list = make_scoped_refptr(new DisplayItemList);
+  auto list = base::MakeRefCounted<DisplayItemList>();
   list->Finalize();
 
   // Pass |true| to ask for PaintOps even though there are none.
@@ -439,7 +439,7 @@
 
 TEST(DisplayItemListTest, AsValueWithOps) {
   gfx::Rect layer_rect = gfx::Rect(1, 2, 8, 9);
-  auto list = make_scoped_refptr(new DisplayItemList);
+  auto list = base::MakeRefCounted<DisplayItemList>();
   gfx::Transform transform;
   transform.Translate(6.f, 7.f);
 
@@ -540,12 +540,12 @@
 }
 
 TEST(DisplayItemListTest, SizeEmpty) {
-  auto list = make_scoped_refptr(new DisplayItemList);
+  auto list = base::MakeRefCounted<DisplayItemList>();
   EXPECT_EQ(0u, list->op_count());
 }
 
 TEST(DisplayItemListTest, SizeOne) {
-  auto list = make_scoped_refptr(new DisplayItemList);
+  auto list = base::MakeRefCounted<DisplayItemList>();
   gfx::Rect drawing_bounds(5, 6, 1, 1);
   {
     list->StartPaint();
@@ -556,7 +556,7 @@
 }
 
 TEST(DisplayItemListTest, SizeMultiple) {
-  auto list = make_scoped_refptr(new DisplayItemList);
+  auto list = base::MakeRefCounted<DisplayItemList>();
   gfx::Rect clip_bounds(5, 6, 7, 8);
   {
     list->StartPaint();
@@ -574,7 +574,7 @@
 }
 
 TEST(DisplayItemListTest, AppendVisualRectSimple) {
-  auto list = make_scoped_refptr(new DisplayItemList);
+  auto list = base::MakeRefCounted<DisplayItemList>();
 
   // One drawing: D.
 
@@ -590,7 +590,7 @@
 }
 
 TEST(DisplayItemListTest, AppendVisualRectEmptyBlock) {
-  auto list = make_scoped_refptr(new DisplayItemList);
+  auto list = base::MakeRefCounted<DisplayItemList>();
 
   // One block: B1, E1.
 
@@ -615,7 +615,7 @@
 }
 
 TEST(DisplayItemListTest, AppendVisualRectEmptyBlockContainingEmptyBlock) {
-  auto list = make_scoped_refptr(new DisplayItemList);
+  auto list = base::MakeRefCounted<DisplayItemList>();
 
   // Two nested blocks: B1, B2, E2, E1.
 
@@ -654,7 +654,7 @@
 }
 
 TEST(DisplayItemListTest, AppendVisualRectBlockContainingDrawing) {
-  auto list = make_scoped_refptr(new DisplayItemList);
+  auto list = base::MakeRefCounted<DisplayItemList>();
 
   // One block with one drawing: B1, Da, E1.
 
@@ -688,7 +688,7 @@
 }
 
 TEST(DisplayItemListTest, AppendVisualRectBlockContainingEscapedDrawing) {
-  auto list = make_scoped_refptr(new DisplayItemList);
+  auto list = base::MakeRefCounted<DisplayItemList>();
 
   // One block with one drawing: B1, Da (escapes), E1.
 
@@ -723,7 +723,7 @@
 
 TEST(DisplayItemListTest,
      AppendVisualRectDrawingFollowedByBlockContainingEscapedDrawing) {
-  auto list = make_scoped_refptr(new DisplayItemList);
+  auto list = base::MakeRefCounted<DisplayItemList>();
 
   // One drawing followed by one block with one drawing: Da, B1, Db (escapes),
   // E1.
@@ -766,7 +766,7 @@
 }
 
 TEST(DisplayItemListTest, AppendVisualRectTwoBlocksTwoDrawings) {
-  auto list = make_scoped_refptr(new DisplayItemList);
+  auto list = base::MakeRefCounted<DisplayItemList>();
 
   // Multiple nested blocks with drawings amidst: B1, Da, B2, Db, E2, E1.
 
@@ -828,7 +828,7 @@
 
 TEST(DisplayItemListTest,
      AppendVisualRectTwoBlocksTwoDrawingsInnerDrawingEscaped) {
-  auto list = make_scoped_refptr(new DisplayItemList);
+  auto list = base::MakeRefCounted<DisplayItemList>();
 
   // Multiple nested blocks with drawings amidst: B1, Da, B2, Db (escapes), E2,
   // E1.
@@ -891,7 +891,7 @@
 
 TEST(DisplayItemListTest,
      AppendVisualRectTwoBlocksTwoDrawingsOuterDrawingEscaped) {
-  auto list = make_scoped_refptr(new DisplayItemList);
+  auto list = base::MakeRefCounted<DisplayItemList>();
 
   // Multiple nested blocks with drawings amidst: B1, Da (escapes), B2, Db, E2,
   // E1.
@@ -954,7 +954,7 @@
 
 TEST(DisplayItemListTest,
      AppendVisualRectTwoBlocksTwoDrawingsBothDrawingsEscaped) {
-  auto list = make_scoped_refptr(new DisplayItemList);
+  auto list = base::MakeRefCounted<DisplayItemList>();
 
   // Multiple nested blocks with drawings amidst:
   // B1, Da (escapes to the right), B2, Db (escapes to the left), E2, E1.
diff --git a/cc/raster/raster_buffer_provider_perftest.cc b/cc/raster/raster_buffer_provider_perftest.cc
index 2e1d247..c1f60362 100644
--- a/cc/raster/raster_buffer_provider_perftest.cc
+++ b/cc/raster/raster_buffer_provider_perftest.cc
@@ -221,8 +221,8 @@
 
   RasterBufferProviderPerfTestBase()
       : compositor_context_provider_(
-            make_scoped_refptr(new PerfContextProvider)),
-        worker_context_provider_(make_scoped_refptr(new PerfContextProvider)),
+            base::MakeRefCounted<PerfContextProvider>()),
+        worker_context_provider_(base::MakeRefCounted<PerfContextProvider>()),
         task_runner_(new base::TestSimpleTaskRunner),
         task_graph_runner_(new SynchronousTaskGraphRunner),
         timer_(kWarmupRuns,
diff --git a/cc/raster/task_graph_runner_perftest.cc b/cc/raster/task_graph_runner_perftest.cc
index 62b1d62..456abad5 100644
--- a/cc/raster/task_graph_runner_perftest.cc
+++ b/cc/raster/task_graph_runner_perftest.cc
@@ -224,7 +224,7 @@
 
   void CreateTasks(int num_tasks, PerfTaskImpl::Vector* tasks) {
     for (int i = 0; i < num_tasks; ++i)
-      tasks->push_back(make_scoped_refptr(new PerfTaskImpl));
+      tasks->push_back(base::MakeRefCounted<PerfTaskImpl>());
   }
 
   void CancelTasks(const PerfTaskImpl::Vector& tasks) {
diff --git a/cc/test/fake_content_layer_client.cc b/cc/test/fake_content_layer_client.cc
index c495e972..773bcf9 100644
--- a/cc/test/fake_content_layer_client.cc
+++ b/cc/test/fake_content_layer_client.cc
@@ -45,7 +45,7 @@
 scoped_refptr<DisplayItemList>
 FakeContentLayerClient::PaintContentsToDisplayList(
     PaintingControlSetting painting_control) {
-  auto display_list = make_scoped_refptr(new DisplayItemList);
+  auto display_list = base::MakeRefCounted<DisplayItemList>();
 
   for (RectPaintVector::const_iterator it = draw_rects_.begin();
        it != draw_rects_.end(); ++it) {
diff --git a/cc/test/layer_tree_pixel_test.cc b/cc/test/layer_tree_pixel_test.cc
index 0e0a8cc2..bd6901628 100644
--- a/cc/test/layer_tree_pixel_test.cc
+++ b/cc/test/layer_tree_pixel_test.cc
@@ -75,7 +75,7 @@
     // mimic texture transport from the renderer process to the Display
     // compositor.
     auto display_context_provider =
-        make_scoped_refptr(new TestInProcessContextProvider(nullptr));
+        base::MakeRefCounted<TestInProcessContextProvider>(nullptr);
     display_context_provider->BindToCurrentThread();
 
     bool flipped_output_surface = false;
diff --git a/cc/tiles/gpu_image_decode_cache.cc b/cc/tiles/gpu_image_decode_cache.cc
index 6c2028f..b6a06b2 100644
--- a/cc/tiles/gpu_image_decode_cache.cc
+++ b/cc/tiles/gpu_image_decode_cache.cc
@@ -518,10 +518,10 @@
     // Ref image and create a upload and decode tasks. We will release this ref
     // in UploadTaskCompleted.
     RefImage(draw_image);
-    task = make_scoped_refptr(new ImageUploadTaskImpl(
+    task = base::MakeRefCounted<ImageUploadTaskImpl>(
         this, draw_image,
         GetImageDecodeTaskAndRef(draw_image, tracing_info, task_type),
-        tracing_info));
+        tracing_info);
     image_data->upload.task = task;
   } else {
     task = GetImageDecodeTaskAndRef(draw_image, tracing_info, task_type);
diff --git a/cc/tiles/image_controller_unittest.cc b/cc/tiles/image_controller_unittest.cc
index 081c46c..1d9fbe6a 100644
--- a/cc/tiles/image_controller_unittest.cc
+++ b/cc/tiles/image_controller_unittest.cc
@@ -240,7 +240,7 @@
   ~ImageControllerTest() override = default;
 
   void SetUp() override {
-    worker_task_runner_ = make_scoped_refptr(new WorkerTaskRunner);
+    worker_task_runner_ = base::MakeRefCounted<WorkerTaskRunner>();
     controller_.reset(
         new ImageController(task_runner_.get(), worker_task_runner_));
     cache_ = TestableCache();
diff --git a/cc/tiles/tile_manager.cc b/cc/tiles/tile_manager.cc
index 21c016b..2bc4f83 100644
--- a/cc/tiles/tile_manager.cc
+++ b/cc/tiles/tile_manager.cc
@@ -1192,11 +1192,11 @@
                            std::move(image_id_to_current_frame_index));
   }
 
-  return make_scoped_refptr(new RasterTaskImpl(
+  return base::MakeRefCounted<RasterTaskImpl>(
       this, tile, resource, prioritized_tile.raster_source(), playback_settings,
       prioritized_tile.priority().resolution, invalidated_rect,
       prepare_tiles_count_, std::move(raster_buffer), &decode_tasks,
-      use_gpu_rasterization_, std::move(image_provider)));
+      use_gpu_rasterization_, std::move(image_provider));
 }
 
 void TileManager::ResetSignalsForTesting() {
@@ -1596,9 +1596,9 @@
 // posts |callback| to |task_runner| when run.
 scoped_refptr<TileTask> TileManager::CreateTaskSetFinishedTask(
     void (TileManager::*callback)()) {
-  return make_scoped_refptr(new TaskSetFinishedTaskImpl(
+  return base::MakeRefCounted<TaskSetFinishedTaskImpl>(
       task_runner_,
-      base::Bind(callback, task_set_finished_weak_ptr_factory_.GetWeakPtr())));
+      base::Bind(callback, task_set_finished_weak_ptr_factory_.GetWeakPtr()));
 }
 
 std::unique_ptr<base::trace_event::ConvertableToTraceFormat>
diff --git a/cc/tiles/tile_manager_unittest.cc b/cc/tiles/tile_manager_unittest.cc
index 71cf49c1..fb484ea8 100644
--- a/cc/tiles/tile_manager_unittest.cc
+++ b/cc/tiles/tile_manager_unittest.cc
@@ -2337,7 +2337,7 @@
       const LayerTreeSettings& settings,
       TaskRunnerProvider* task_runner_provider,
       TaskGraphRunner* task_graph_runner) override {
-    task_runner_ = make_scoped_refptr(new SynchronousSimpleTaskRunner);
+    task_runner_ = base::MakeRefCounted<SynchronousSimpleTaskRunner>();
     return std::make_unique<FakeLayerTreeHostImpl>(
         settings, task_runner_provider, task_graph_runner, task_runner_);
   }
diff --git a/cc/trees/layer_tree_host_common_unittest.cc b/cc/trees/layer_tree_host_common_unittest.cc
index 4ebd65ca6..669bb7d6 100644
--- a/cc/trees/layer_tree_host_common_unittest.cc
+++ b/cc/trees/layer_tree_host_common_unittest.cc
@@ -8602,9 +8602,9 @@
   FakeContentLayerClient client;
   client.set_bounds(root->bounds());
   scoped_refptr<LayerWithForcedDrawsContent> child =
-      make_scoped_refptr(new LayerWithForcedDrawsContent());
+      base::MakeRefCounted<LayerWithForcedDrawsContent>();
   scoped_refptr<LayerWithForcedDrawsContent> grandchild =
-      make_scoped_refptr(new LayerWithForcedDrawsContent());
+      base::MakeRefCounted<LayerWithForcedDrawsContent>();
   scoped_refptr<FakePictureLayer> greatgrandchild(
       FakePictureLayer::Create(&client));
 
@@ -9701,7 +9701,7 @@
 TEST_F(LayerTreeHostCommonTest, PropertyTreesRebuildWithOpacityChanges) {
   scoped_refptr<Layer> root = Layer::Create();
   scoped_refptr<LayerWithForcedDrawsContent> child =
-      make_scoped_refptr(new LayerWithForcedDrawsContent());
+      base::MakeRefCounted<LayerWithForcedDrawsContent>();
   root->AddChild(child);
   host()->SetRootLayer(root);
 
@@ -9743,7 +9743,7 @@
 TEST_F(LayerTreeHostCommonTest, OpacityAnimationsTrackingTest) {
   scoped_refptr<Layer> root = Layer::Create();
   scoped_refptr<LayerWithForcedDrawsContent> animated =
-      make_scoped_refptr(new LayerWithForcedDrawsContent());
+      base::MakeRefCounted<LayerWithForcedDrawsContent>();
   root->AddChild(animated);
   host()->SetRootLayer(root);
   host()->SetElementIdsForTesting();
@@ -9791,7 +9791,7 @@
 TEST_F(LayerTreeHostCommonTest, TransformAnimationsTrackingTest) {
   scoped_refptr<Layer> root = Layer::Create();
   scoped_refptr<LayerWithForcedDrawsContent> animated =
-      make_scoped_refptr(new LayerWithForcedDrawsContent());
+      base::MakeRefCounted<LayerWithForcedDrawsContent>();
   root->AddChild(animated);
   host()->SetRootLayer(root);
   host()->SetElementIdsForTesting();
diff --git a/cc/trees/layer_tree_host_pixeltest_masks.cc b/cc/trees/layer_tree_host_pixeltest_masks.cc
index ee78966..fa38e57 100644
--- a/cc/trees/layer_tree_host_pixeltest_masks.cc
+++ b/cc/trees/layer_tree_host_pixeltest_masks.cc
@@ -40,7 +40,7 @@
 
   scoped_refptr<DisplayItemList> PaintContentsToDisplayList(
       PaintingControlSetting picture_control) override {
-    auto display_list = make_scoped_refptr(new DisplayItemList);
+    auto display_list = base::MakeRefCounted<DisplayItemList>();
     display_list->StartPaint();
 
     display_list->push<SaveOp>();
@@ -186,7 +186,7 @@
   gfx::Rect PaintableRegion() override { return gfx::Rect(bounds_); }
   scoped_refptr<DisplayItemList> PaintContentsToDisplayList(
       PaintingControlSetting picture_control) override {
-    auto display_list = make_scoped_refptr(new DisplayItemList);
+    auto display_list = base::MakeRefCounted<DisplayItemList>();
     display_list->StartPaint();
 
     display_list->push<SaveOp>();
@@ -235,7 +235,7 @@
   gfx::Rect PaintableRegion() override { return gfx::Rect(bounds_); }
   scoped_refptr<DisplayItemList> PaintContentsToDisplayList(
       PaintingControlSetting picture_control) override {
-    auto display_list = make_scoped_refptr(new DisplayItemList);
+    auto display_list = base::MakeRefCounted<DisplayItemList>();
     display_list->StartPaint();
 
     display_list->push<SaveOp>();
diff --git a/cc/trees/layer_tree_host_pixeltest_tiles.cc b/cc/trees/layer_tree_host_pixeltest_tiles.cc
index 64ad181..0c903a60 100644
--- a/cc/trees/layer_tree_host_pixeltest_tiles.cc
+++ b/cc/trees/layer_tree_host_pixeltest_tiles.cc
@@ -107,7 +107,7 @@
   gfx::Rect PaintableRegion() override { return gfx::Rect(size_); }
   scoped_refptr<DisplayItemList> PaintContentsToDisplayList(
       PaintingControlSetting painting_status) override {
-    auto display_list = make_scoped_refptr(new DisplayItemList);
+    auto display_list = base::MakeRefCounted<DisplayItemList>();
 
     display_list->StartPaint();
 
diff --git a/cc/trees/layer_tree_host_unittest.cc b/cc/trees/layer_tree_host_unittest.cc
index c1ab7fdd2..ff56d51 100644
--- a/cc/trees/layer_tree_host_unittest.cc
+++ b/cc/trees/layer_tree_host_unittest.cc
@@ -1687,9 +1687,9 @@
   void SetupTree() override {
     scoped_refptr<Layer> root = Layer::Create();
     root->SetBounds(gfx::Size(10, 10));
-    child_layer_ = make_scoped_refptr(new UpdateCountingLayer);
+    child_layer_ = base::MakeRefCounted<UpdateCountingLayer>();
     child_layer_->SetBounds(gfx::Size(10, 10));
-    mask_layer_ = make_scoped_refptr(new UpdateCountingLayer);
+    mask_layer_ = base::MakeRefCounted<UpdateCountingLayer>();
     mask_layer_->SetBounds(gfx::Size(10, 10));
     child_layer_->SetMaskLayer(mask_layer_.get());
     root->AddChild(child_layer_);
diff --git a/chrome/android/junit/src/org/chromium/chrome/browser/media/router/ChromeMediaRouterTestBase.java b/chrome/android/junit/src/org/chromium/chrome/browser/media/router/ChromeMediaRouterTestBase.java
index edca8741..5f83b5a2 100644
--- a/chrome/android/junit/src/org/chromium/chrome/browser/media/router/ChromeMediaRouterTestBase.java
+++ b/chrome/android/junit/src/org/chromium/chrome/browser/media/router/ChromeMediaRouterTestBase.java
@@ -11,36 +11,27 @@
 import static org.mockito.Mockito.mock;
 import static org.mockito.Mockito.spy;
 
-import org.chromium.base.CommandLine;
 import org.junit.Before;
 import org.robolectric.shadows.ShadowLog;
 
+import org.chromium.base.CommandLine;
+
 /**
  * Robolectric test base class for ChromeMediaRouter.
  */
 public class ChromeMediaRouterTestBase {
-    protected static final String SOURCE_ID1 = new StringBuilder()
-            .append("https://google.com/cast#")
-            .append("__castAppId__=CCCCCCCC/")
-            .append("__castClientId__=11111111111111111/")
-            .append("__castAutoJoinPolicy__=origin_scoped/")
-            .append("__castLaunchTimeout__=10000")
-            .toString();
-    protected static final String SOURCE_ID2 = new StringBuilder()
-            .append("https://google.com/cast#")
-            .append("__castAppId__=CCCCCCCC/")
-            .append("__castClientId__=222222222222222222/")
-            .append("__castAutoJoinPolicy__=origin_scoped/")
-            .append("__castLaunchTimeout__=10000")
-            .toString();
-    protected static final String SINK_ID1 = new StringBuilder()
-            .append("com.google.android.gms/")
-            .append(".cast.media.MediaRouteProviderService:cccccccccccccccccccccccccccccccc")
-            .toString();
-    protected static final String SINK_ID2 = new StringBuilder()
-            .append("com.google.android.gms/")
-            .append(".cast.media.MediaRouteProviderService:dddddddddddddddddddddddddddddddd")
-            .toString();
+    protected static final String SOURCE_ID1 = "cast:CCCCCCCC?"
+            + "clientId=11111111111111111&"
+            + "autoJoinPolicy=origin_scoped&"
+            + "launchTimeout=10000";
+    protected static final String SOURCE_ID2 = "cast:CCCCCCCC?"
+            + "clientId=222222222222222222&"
+            + "autoJoinPolicy=origin_scoped&"
+            + "castLaunchTimeout=10000";
+    protected static final String SINK_ID1 = "com.google.android.gms/"
+            + ".cast.media.MediaRouteProviderService:cccccccccccccccccccccccccccccccc";
+    protected static final String SINK_ID2 = "com.google.android.gms/"
+            + ".cast.media.MediaRouteProviderService:dddddddddddddddddddddddddddddddd";
     protected static final String SINK_NAME1 = "sink name 1";
     protected static final String SINK_NAME2 = "sink name 2";
     protected static final String PRESENTATION_ID1 = "mr_CCCCCCCC-CCCC-CCCC-CCCC-CCCCCCCCCCCC";
diff --git a/chrome/android/junit/src/org/chromium/chrome/browser/media/router/cast/CastMediaRouteProviderTest.java b/chrome/android/junit/src/org/chromium/chrome/browser/media/router/cast/CastMediaRouteProviderTest.java
index 1974aa1..96558e6e 100644
--- a/chrome/android/junit/src/org/chromium/chrome/browser/media/router/cast/CastMediaRouteProviderTest.java
+++ b/chrome/android/junit/src/org/chromium/chrome/browser/media/router/cast/CastMediaRouteProviderTest.java
@@ -30,8 +30,9 @@
 @RunWith(LocalRobolectricTestRunner.class)
 @Config(manifest = Config.NONE)
 public class CastMediaRouteProviderTest {
-    private static final String SUPPORTED_SOURCE =
-            "https://google.com/cast/#__castAppId__=DEADBEEF";
+    private static final String SUPPORTED_SOURCE = "cast:DEADBEEF";
+
+    // TODO(crbug.com/672704): Android does not currently support 1-UA mode.
     private static final String UNSUPPORTED_SOURCE = "https://example.com";
 
     @Test
diff --git a/chrome/android/junit/src/org/chromium/chrome/browser/media/router/cast/CastMessageHandlerTest.java b/chrome/android/junit/src/org/chromium/chrome/browser/media/router/cast/CastMessageHandlerTest.java
index 29028b7..51eb550 100644
--- a/chrome/android/junit/src/org/chromium/chrome/browser/media/router/cast/CastMessageHandlerTest.java
+++ b/chrome/android/junit/src/org/chromium/chrome/browser/media/router/cast/CastMessageHandlerTest.java
@@ -55,17 +55,6 @@
 
     private static final String SESSION_ID = "SESSION_ID";
     private static final String INVALID_SESSION_ID = "INVALID_SESSION_ID";
-    private static final String APP_STATUS = "status";
-    private static final String ORIGIN = "http://www.example.com/";
-    private static final String SOURCE_ID = new StringBuilder()
-            .append("https://google.com/cast#")
-            .append("__castAppId__=CCCCCCCC/")
-            .append("__castClientId__=00000000000000001/")
-            .append("__castAutoJoinPolicy__=origin_scoped/")
-            .append("__castLaunchTimeout__=10000")
-            .toString();
-    private static final int TAB_ID = 1;
-    private static final int CALLBACK_ID = 1;
     private static final String CLIENT_ID1 = "00000000000000001";
     private static final String CLIENT_ID2 = "00000000000000002";
     private static final String INVALID_CLIENT_ID = "xxxxxxxxxxxxxxxxx";
@@ -274,8 +263,9 @@
                 any(JSONObject.class), anyString(), anyString(), anyInt());
         for (String messageType : CastMessageHandler.getMediaMessageTypesForTest()) {
             // TODO(zqzhang): SET_VOLUME and STOP should not reach here?
-            if ("MEDIA_SET_VOLUME".equals(messageType) || "STOP_MEDIA".equals(messageType))
+            if ("MEDIA_SET_VOLUME".equals(messageType) || "STOP_MEDIA".equals(messageType)) {
                 continue;
+            }
             JSONObject innerMessage = new JSONObject().put("type", messageType);
             JSONObject message = buildCastV2Message(CLIENT_ID1, innerMessage);
             assertTrue(mMessageHandler.handleCastV2Message(message));
diff --git a/chrome/android/webapk/shell_apk/shell_apk_version.gni b/chrome/android/webapk/shell_apk/shell_apk_version.gni
index f8d1f1f..24a0786 100644
--- a/chrome/android/webapk/shell_apk/shell_apk_version.gni
+++ b/chrome/android/webapk/shell_apk/shell_apk_version.gni
@@ -6,7 +6,7 @@
 # (including AndroidManifest.xml) is updated. This version should be incremented
 # prior to uploading a new ShellAPK to the WebAPK Minting Server.
 # Does not affect Chrome.apk
-template_shell_apk_version = 26
+template_shell_apk_version = 27
 
 # The ShellAPK version expected by Chrome. Chrome will try to update the WebAPK
 # if the WebAPK's ShellAPK version is less than |expected_shell_apk_version|.
diff --git a/chrome/android/webapk/shell_apk/src/org/chromium/webapk/shell_apk/DexLoader.java b/chrome/android/webapk/shell_apk/src/org/chromium/webapk/shell_apk/DexLoader.java
index d641716..48ba114 100644
--- a/chrome/android/webapk/shell_apk/src/org/chromium/webapk/shell_apk/DexLoader.java
+++ b/chrome/android/webapk/shell_apk/src/org/chromium/webapk/shell_apk/DexLoader.java
@@ -76,27 +76,7 @@
      * @param localDexDir Cache directory passed to {@link #load()}.
      */
     public void deleteCachedDexes(File localDexDir) {
-        deleteChildren(localDexDir);
-    }
-
-    /**
-     * Deletes all of a directory's children including subdirectories.
-     * @param parentDir Directory whose children should be deleted.
-     */
-    private static void deleteChildren(File parentDir) {
-        if (!parentDir.isDirectory()) {
-            return;
-        }
-
-        File[] files = parentDir.listFiles();
-        if (files != null) {
-            for (File file : files) {
-                deleteChildren(file);
-                if (!file.delete()) {
-                    Log.e(TAG, "Could not delete " + file.getPath());
-                }
-            }
-        }
+        WebApkUtils.deletePath(localDexDir);
     }
 
     /**
diff --git a/chrome/android/webapk/shell_apk/src/org/chromium/webapk/shell_apk/MainActivity.java b/chrome/android/webapk/shell_apk/src/org/chromium/webapk/shell_apk/MainActivity.java
index fc5c71c..5750e3d 100644
--- a/chrome/android/webapk/shell_apk/src/org/chromium/webapk/shell_apk/MainActivity.java
+++ b/chrome/android/webapk/shell_apk/src/org/chromium/webapk/shell_apk/MainActivity.java
@@ -18,7 +18,6 @@
 import org.chromium.webapk.lib.common.WebApkConstants;
 import org.chromium.webapk.lib.common.WebApkMetaDataKeys;
 
-import java.io.File;
 import java.util.List;
 
 /**
@@ -129,26 +128,9 @@
 
     /** Deletes the internal storage. */
     private void deleteInternalStorage() {
-        deletePath(getCacheDir());
-        deletePath(getFilesDir());
-        deletePath(getDir(HostBrowserClassLoader.DEX_DIR_NAME, Context.MODE_PRIVATE));
-    }
-
-    private void deletePath(File file) {
-        if (file == null) return;
-
-        if (file.isDirectory()) {
-            File[] children = file.listFiles();
-            if (children != null) {
-                for (File child : children) {
-                    deletePath(child);
-                }
-            }
-        }
-
-        if (!file.delete()) {
-            Log.e(TAG, "Failed to delete : " + file.getAbsolutePath());
-        }
+        WebApkUtils.deletePath(getCacheDir());
+        WebApkUtils.deletePath(getFilesDir());
+        WebApkUtils.deletePath(getDir(HostBrowserClassLoader.DEX_DIR_NAME, Context.MODE_PRIVATE));
     }
 
     private void launchInHostBrowser(String runtimeHost) {
diff --git a/chrome/android/webapk/shell_apk/src/org/chromium/webapk/shell_apk/WebApkUtils.java b/chrome/android/webapk/shell_apk/src/org/chromium/webapk/shell_apk/WebApkUtils.java
index e4ad6c37..8ef9566 100644
--- a/chrome/android/webapk/shell_apk/src/org/chromium/webapk/shell_apk/WebApkUtils.java
+++ b/chrome/android/webapk/shell_apk/src/org/chromium/webapk/shell_apk/WebApkUtils.java
@@ -16,6 +16,7 @@
 import android.os.Build;
 import android.os.Bundle;
 import android.text.TextUtils;
+import android.util.Log;
 import android.util.TypedValue;
 import android.view.View;
 import android.widget.TextView;
@@ -23,6 +24,7 @@
 import org.chromium.webapk.lib.common.WebApkConstants;
 import org.chromium.webapk.lib.common.WebApkMetaDataKeys;
 
+import java.io.File;
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.HashSet;
@@ -35,6 +37,8 @@
 public class WebApkUtils {
     public static final String SHARED_PREF_RUNTIME_HOST = "runtime_host";
 
+    private static final String TAG = "cr_WebApkUtils";
+
     /**
      * The package names of the channels of Chrome that support WebAPKs. The most preferred one
      * comes first.
@@ -326,4 +330,22 @@
             return res.getColor(id);
         }
     }
+
+    /** Delete the given File and (if it's a directory) everything within it. */
+    public static void deletePath(File file) {
+        if (file == null) return;
+
+        if (file.isDirectory()) {
+            File[] children = file.listFiles();
+            if (children != null) {
+                for (File child : children) {
+                    deletePath(child);
+                }
+            }
+        }
+
+        if (!file.delete()) {
+            Log.e(TAG, "Failed to delete : " + file.getAbsolutePath());
+        }
+    }
 }
diff --git a/chrome/browser/android/vr_shell/BUILD.gn b/chrome/browser/android/vr_shell/BUILD.gn
index 136ba649..55f3845 100644
--- a/chrome/browser/android/vr_shell/BUILD.gn
+++ b/chrome/browser/android/vr_shell/BUILD.gn
@@ -30,8 +30,6 @@
     "vr_core_info.h",
     "vr_gl_thread.cc",
     "vr_gl_thread.h",
-    "vr_input_manager.cc",
-    "vr_input_manager.h",
     "vr_metrics_util.cc",
     "vr_metrics_util.h",
     "vr_shell.cc",
diff --git a/chrome/browser/android/vr_shell/vr_gl_thread.cc b/chrome/browser/android/vr_shell/vr_gl_thread.cc
index 9fafd34c6..2bfdeb4a 100644
--- a/chrome/browser/android/vr_shell/vr_gl_thread.cc
+++ b/chrome/browser/android/vr_shell/vr_gl_thread.cc
@@ -7,7 +7,6 @@
 #include <utility>
 
 #include "base/message_loop/message_loop.h"
-#include "chrome/browser/android/vr_shell/vr_input_manager.h"
 #include "chrome/browser/android/vr_shell/vr_shell.h"
 #include "chrome/browser/android/vr_shell/vr_shell_gl.h"
 #include "chrome/browser/vr/browser_ui_interface.h"
diff --git a/chrome/browser/android/vr_shell/vr_input_manager.cc b/chrome/browser/android/vr_shell/vr_input_manager.cc
deleted file mode 100644
index 3a8c464..0000000
--- a/chrome/browser/android/vr_shell/vr_input_manager.cc
+++ /dev/null
@@ -1,113 +0,0 @@
-// Copyright 2016 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "chrome/browser/android/vr_shell/vr_input_manager.h"
-
-#include <memory>
-
-#include "base/task_runner_util.h"
-#include "content/public/browser/browser_thread.h"
-#include "content/public/browser/render_widget_host.h"
-#include "content/public/browser/render_widget_host_view.h"
-#include "content/public/browser/web_contents.h"
-#include "ui/events/keycodes/dom/dom_key.h"
-
-using blink::WebGestureEvent;
-using blink::WebMouseEvent;
-using blink::WebInputEvent;
-
-namespace vr_shell {
-
-namespace {
-WebGestureEvent MakeGestureEvent(WebInputEvent::Type type,
-                                 double time,
-                                 float x,
-                                 float y) {
-  WebGestureEvent result(type, WebInputEvent::kNoModifiers, time);
-  result.x = x;
-  result.y = y;
-  result.source_device = blink::kWebGestureDeviceTouchpad;
-  return result;
-}
-}  // namespace
-
-VrInputManager::VrInputManager(content::WebContents* web_contents)
-    : web_contents_(web_contents) {}
-
-VrInputManager::~VrInputManager() = default;
-
-void VrInputManager::ProcessUpdatedGesture(
-    std::unique_ptr<blink::WebInputEvent> event) {
-  if (WebInputEvent::IsMouseEventType(event->GetType()))
-    ForwardMouseEvent(static_cast<const blink::WebMouseEvent&>(*event));
-  else if (WebInputEvent::IsGestureEventType(event->GetType()))
-    SendGesture(static_cast<const blink::WebGestureEvent&>(*event));
-}
-
-void VrInputManager::GenerateKeyboardEvent(int char_value, int modifiers) {
-  content::NativeWebKeyboardEvent event(
-      blink::WebInputEvent::Type::kKeyDown, modifiers,
-      (base::TimeTicks::Now() - base::TimeTicks()).InSecondsF());
-  event.dom_key = ui::DomKey::FromCharacter(char_value);
-  event.native_key_code = char_value;
-  event.windows_key_code = char_value;
-  ForwardKeyboardEvent(event);
-
-  event.SetType(blink::WebInputEvent::Type::kChar);
-  event.text[0] = char_value;
-  event.unmodified_text[0] = char_value;
-  event.dom_code = char_value;
-  ForwardKeyboardEvent(event);
-
-  event.SetType(blink::WebInputEvent::Type::kKeyUp);
-  ForwardKeyboardEvent(event);
-}
-
-void VrInputManager::SendGesture(const WebGestureEvent& gesture) {
-  if (gesture.GetType() == WebGestureEvent::kGestureTapDown) {
-    ForwardGestureEvent(gesture);
-
-    // Generate and forward Tap
-    WebGestureEvent tap_event =
-        MakeGestureEvent(WebInputEvent::kGestureTap, gesture.TimeStampSeconds(),
-                         gesture.x, gesture.y);
-    tap_event.data.tap.tap_count = 1;
-    ForwardGestureEvent(tap_event);
-  } else {
-    ForwardGestureEvent(gesture);
-  }
-}
-
-void VrInputManager::ForwardGestureEvent(
-    const blink::WebGestureEvent& gesture) {
-  if (!web_contents_->GetRenderWidgetHostView())
-    return;
-  content::RenderWidgetHost* rwh =
-      web_contents_->GetRenderWidgetHostView()->GetRenderWidgetHost();
-  if (rwh)
-    rwh->ForwardGestureEvent(gesture);
-}
-
-void VrInputManager::ForwardMouseEvent(
-    const blink::WebMouseEvent& mouse_event) {
-  if (!web_contents_->GetRenderWidgetHostView())
-    return;
-  content::RenderWidgetHost* rwh =
-      web_contents_->GetRenderWidgetHostView()->GetRenderWidgetHost();
-  if (rwh)
-    rwh->ForwardMouseEvent(mouse_event);
-}
-
-void VrInputManager::ForwardKeyboardEvent(
-    const content::NativeWebKeyboardEvent& keyboard_event) {
-  content::RenderWidgetHostView* rwhv =
-      web_contents_->GetRenderWidgetHostView();
-  if (rwhv == nullptr)
-    return;
-  content::RenderWidgetHost* rwh = rwhv->GetRenderWidgetHost();
-  if (rwh)
-    rwh->ForwardKeyboardEvent(keyboard_event);
-}
-
-}  // namespace vr_shell
diff --git a/chrome/browser/android/vr_shell/vr_input_manager.h b/chrome/browser/android/vr_shell/vr_input_manager.h
deleted file mode 100644
index 79f2529..0000000
--- a/chrome/browser/android/vr_shell/vr_input_manager.h
+++ /dev/null
@@ -1,46 +0,0 @@
-// Copyright 2016 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef CHROME_BROWSER_ANDROID_VR_SHELL_VR_INPUT_MANAGER_H_
-#define CHROME_BROWSER_ANDROID_VR_SHELL_VR_INPUT_MANAGER_H_
-
-#include <memory>
-
-#include "base/macros.h"
-#include "base/memory/weak_ptr.h"
-#include "content/public/browser/native_web_keyboard_event.h"
-#include "third_party/WebKit/public/platform/WebGestureEvent.h"
-#include "third_party/WebKit/public/platform/WebInputEvent.h"
-#include "third_party/WebKit/public/platform/WebMouseEvent.h"
-
-namespace content {
-class WebContents;
-}
-
-namespace vr_shell {
-
-// Note: This class is not thread safe and must only be used from main thread.
-class VrInputManager {
- public:
-  explicit VrInputManager(content::WebContents* web_contents);
-  ~VrInputManager();
-
-  void ProcessUpdatedGesture(std::unique_ptr<blink::WebInputEvent> event);
-  void GenerateKeyboardEvent(int char_value, int modifiers);
-
- private:
-  void SendGesture(const blink::WebGestureEvent& gesture);
-  void ForwardGestureEvent(const blink::WebGestureEvent& gesture);
-  void ForwardMouseEvent(const blink::WebMouseEvent& mouse_event);
-  void ForwardKeyboardEvent(
-      const content::NativeWebKeyboardEvent& keyboard_event);
-
-  content::WebContents* web_contents_;
-
-  DISALLOW_COPY_AND_ASSIGN(VrInputManager);
-};
-
-}  // namespace vr_shell
-
-#endif  // CHROME_BROWSER_ANDROID_VR_SHELL_VR_INPUT_MANAGER_H_
diff --git a/chrome/browser/android/vr_shell/vr_shell.cc b/chrome/browser/android/vr_shell/vr_shell.cc
index ef3cf473..dc4fccbf 100644
--- a/chrome/browser/android/vr_shell/vr_shell.cc
+++ b/chrome/browser/android/vr_shell/vr_shell.cc
@@ -23,7 +23,6 @@
 #include "chrome/browser/android/vr_shell/android_ui_gesture_target.h"
 #include "chrome/browser/android/vr_shell/vr_compositor.h"
 #include "chrome/browser/android/vr_shell/vr_gl_thread.h"
-#include "chrome/browser/android/vr_shell/vr_input_manager.h"
 #include "chrome/browser/android/vr_shell/vr_shell_delegate.h"
 #include "chrome/browser/android/vr_shell/vr_shell_gl.h"
 #include "chrome/browser/android/vr_shell/vr_usage_monitor.h"
@@ -34,6 +33,7 @@
 #include "chrome/browser/vr/ui_interface.h"
 #include "chrome/browser/vr/ui_scene_manager.h"
 #include "chrome/browser/vr/vr_tab_helper.h"
+#include "chrome/browser/vr/web_contents_event_forwarder.h"
 #include "chrome/common/url_constants.h"
 #include "content/public/browser/browser_context.h"
 #include "content/public/browser/browser_thread.h"
@@ -197,12 +197,13 @@
 
   if (target) {
     android_ui_gesture_target_.reset(target);
-    input_manager_ = nullptr;
+    web_contents_event_forwarder_ = nullptr;
     metrics_helper_ = nullptr;
     return;
   }
-  input_manager_ =
-      base::MakeUnique<VrInputManager>(GetNonNativePageWebContents());
+  web_contents_event_forwarder_ =
+      base::MakeUnique<vr::WebContentsEventForwarder>(
+          GetNonNativePageWebContents());
   // TODO(billorr): Make VrMetricsHelper tab-aware and able to track multiple
   // tabs. crbug.com/684661
   metrics_helper_ =
@@ -587,7 +588,7 @@
 }
 
 void VrShell::ContentWebContentsDestroyed() {
-  input_manager_.reset();
+  web_contents_event_forwarder_.reset();
   web_contents_ = nullptr;
   // TODO(mthiesse): Handle web contents being destroyed.
   ForceExitVr();
@@ -595,13 +596,14 @@
 
 void VrShell::ContentWasHidden() {
   // Ensure we don't continue sending input to it.
-  input_manager_ = nullptr;
+  web_contents_event_forwarder_ = nullptr;
 }
 
 void VrShell::ContentWasShown() {
   if (GetNonNativePageWebContents()) {
-    input_manager_ =
-        base::MakeUnique<VrInputManager>(GetNonNativePageWebContents());
+    web_contents_event_forwarder_ =
+        base::MakeUnique<vr::WebContentsEventForwarder>(
+            GetNonNativePageWebContents());
   }
 }
 
@@ -793,8 +795,8 @@
 
 void VrShell::ProcessContentGesture(
     std::unique_ptr<blink::WebInputEvent> event) {
-  if (input_manager_) {
-    input_manager_->ProcessUpdatedGesture(std::move(event));
+  if (web_contents_event_forwarder_) {
+    web_contents_event_forwarder_->ForwardEvent(std::move(event));
   } else if (android_ui_gesture_target_) {
     android_ui_gesture_target_->DispatchWebInputEvent(std::move(event));
   }
diff --git a/chrome/browser/android/vr_shell/vr_shell.h b/chrome/browser/android/vr_shell/vr_shell.h
index f22ff4f2..3ace6dc 100644
--- a/chrome/browser/android/vr_shell/vr_shell.h
+++ b/chrome/browser/android/vr_shell/vr_shell.h
@@ -38,6 +38,7 @@
 namespace vr {
 class BrowserUiInterface;
 class ToolbarHelper;
+class WebContentsEventForwarder;
 }  // namespace vr
 
 namespace vr_shell {
@@ -45,7 +46,6 @@
 class AndroidUiGestureTarget;
 class VrCompositor;
 class VrGLThread;
-class VrInputManager;
 class VrMetricsHelper;
 class VrShellDelegate;
 class VrWebContentsObserver;
@@ -233,7 +233,7 @@
   VrShellDelegate* delegate_provider_ = nullptr;
   base::android::ScopedJavaGlobalRef<jobject> j_vr_shell_;
 
-  std::unique_ptr<VrInputManager> input_manager_;
+  std::unique_ptr<vr::WebContentsEventForwarder> web_contents_event_forwarder_;
   std::unique_ptr<AndroidUiGestureTarget> android_ui_gesture_target_;
   std::unique_ptr<VrMetricsHelper> metrics_helper_;
 
diff --git a/chrome/browser/background/background_contents_service.cc b/chrome/browser/background/background_contents_service.cc
index 8b0a9c6..22a2b8f 100644
--- a/chrome/browser/background/background_contents_service.cc
+++ b/chrome/browser/background/background_contents_service.cc
@@ -205,7 +205,7 @@
       extension, resource, gfx::Size(size, size),
       base::Bind(
           &NotificationImageReady, extension->name(), extension->id(), message,
-          make_scoped_refptr(new CrashNotificationDelegate(profile, extension)),
+          base::MakeRefCounted<CrashNotificationDelegate>(profile, extension),
           profile));
 }
 
diff --git a/chrome/browser/browsing_data/browsing_data_local_storage_helper_browsertest.cc b/chrome/browser/browsing_data/browsing_data_local_storage_helper_browsertest.cc
index 60bb30e..e7a16766 100644
--- a/chrome/browser/browsing_data/browsing_data_local_storage_helper_browsertest.cc
+++ b/chrome/browser/browsing_data/browsing_data_local_storage_helper_browsertest.cc
@@ -35,23 +35,23 @@
 using content::DOMStorageContext;
 
 namespace {
-typedef
-    BrowsingDataHelperCallback<BrowsingDataLocalStorageHelper::LocalStorageInfo>
-        TestCompletionCallback;
 
-const base::FilePath::CharType kTestFile0[] =
+using TestCompletionCallback = BrowsingDataHelperCallback<
+    BrowsingDataLocalStorageHelper::LocalStorageInfo>;
+
+constexpr base::FilePath::CharType kTestFile0[] =
     FILE_PATH_LITERAL("http_www.chromium.org_0.localstorage");
 
 const char kOriginOfTestFile0[] = "http://www.chromium.org/";
 
-const base::FilePath::CharType kTestFile1[] =
+constexpr base::FilePath::CharType kTestFile1[] =
     FILE_PATH_LITERAL("http_www.google.com_0.localstorage");
 
-const base::FilePath::CharType kTestFileInvalid[] =
+constexpr base::FilePath::CharType kTestFileInvalid[] =
     FILE_PATH_LITERAL("http_www.google.com_localstorage_0.foo");
 
 // This is only here to test that extension state is not listed by the helper.
-const base::FilePath::CharType kTestFileExtension[] = FILE_PATH_LITERAL(
+constexpr base::FilePath::CharType kTestFileExtension[] = FILE_PATH_LITERAL(
     "chrome-extension_behllobkkfkfnphdnhnkndlbkcpglgmj_0.localstorage");
 
 class BrowsingDataLocalStorageHelperTest : public InProcessBrowserTest {
@@ -62,9 +62,8 @@
     // stores data in the host file system.
     base::FilePath storage_path = GetLocalStoragePathForTestingProfile();
     base::CreateDirectory(storage_path);
-    const base::FilePath::CharType* kFilesToCreate[] = {
-        kTestFile0, kTestFile1, kTestFileInvalid, kTestFileExtension
-    };
+    static constexpr const base::FilePath::CharType* kFilesToCreate[] = {
+        kTestFile0, kTestFile1, kTestFileInvalid, kTestFileExtension};
     for (size_t i = 0; i < arraysize(kFilesToCreate); ++i) {
       base::FilePath file_path = storage_path.Append(kFilesToCreate[i]);
       base::WriteFile(file_path, nullptr, 0);
@@ -192,4 +191,5 @@
   ASSERT_EQ(1u, result.size());
   EXPECT_EQ(origin, result.begin()->origin_url);
 }
+
 }  // namespace
diff --git a/chrome/browser/chromeos/arc/fileapi/arc_content_file_system_file_stream_reader.cc b/chrome/browser/chromeos/arc/fileapi/arc_content_file_system_file_stream_reader.cc
index b31a230..14f5d590f 100644
--- a/chrome/browser/chromeos/arc/fileapi/arc_content_file_system_file_stream_reader.cc
+++ b/chrome/browser/chromeos/arc/fileapi/arc_content_file_system_file_stream_reader.cc
@@ -153,7 +153,7 @@
       // Pipe is not seekable. Just consume the contents.
       const size_t kTemporaryBufferSize = 1024 * 1024;
       auto temporary_buffer =
-          make_scoped_refptr(new net::IOBufferWithSize(kTemporaryBufferSize));
+          base::MakeRefCounted<net::IOBufferWithSize>(kTemporaryBufferSize);
       ConsumeFileContents(buf, buffer_length, callback, temporary_buffer,
                           offset_);
       break;
diff --git a/chrome/browser/chromeos/arc/fileapi/arc_content_file_system_file_stream_reader_unittest.cc b/chrome/browser/chromeos/arc/fileapi/arc_content_file_system_file_stream_reader_unittest.cc
index a94e55c..36bceac0 100644
--- a/chrome/browser/chromeos/arc/fileapi/arc_content_file_system_file_stream_reader_unittest.cc
+++ b/chrome/browser/chromeos/arc/fileapi/arc_content_file_system_file_stream_reader_unittest.cc
@@ -44,7 +44,7 @@
 bool ReadData(ArcContentFileSystemFileStreamReader* reader,
               net::IOBufferWithSize* buffer) {
   auto drainable_buffer =
-      make_scoped_refptr(new net::DrainableIOBuffer(buffer, buffer->size()));
+      base::MakeRefCounted<net::DrainableIOBuffer>(buffer, buffer->size());
   while (drainable_buffer->BytesRemaining()) {
     net::TestCompletionCallback callback;
     int result = callback.GetResult(
@@ -102,7 +102,7 @@
 
 TEST_F(ArcContentFileSystemFileStreamReaderTest, ReadRegularFile) {
   ArcContentFileSystemFileStreamReader reader(GURL(kArcUrlFile), 0);
-  auto buffer = make_scoped_refptr(new net::IOBufferWithSize(strlen(kData)));
+  auto buffer = base::MakeRefCounted<net::IOBufferWithSize>(strlen(kData));
   EXPECT_TRUE(ReadData(&reader, buffer.get()));
   EXPECT_EQ(base::StringPiece(kData, strlen(kData)),
             base::StringPiece(buffer->data(), buffer->size()));
@@ -112,7 +112,7 @@
   constexpr size_t kOffset = 10;
   ArcContentFileSystemFileStreamReader reader(GURL(kArcUrlFile), kOffset);
   auto buffer =
-      make_scoped_refptr(new net::IOBufferWithSize(strlen(kData) - kOffset));
+      base::MakeRefCounted<net::IOBufferWithSize>(strlen(kData) - kOffset);
   EXPECT_TRUE(ReadData(&reader, buffer.get()));
   EXPECT_EQ(base::StringPiece(kData + kOffset, strlen(kData) - kOffset),
             base::StringPiece(buffer->data(), buffer->size()));
@@ -120,7 +120,7 @@
 
 TEST_F(ArcContentFileSystemFileStreamReaderTest, ReadPipe) {
   ArcContentFileSystemFileStreamReader reader(GURL(kArcUrlPipe), 0);
-  auto buffer = make_scoped_refptr(new net::IOBufferWithSize(strlen(kData)));
+  auto buffer = base::MakeRefCounted<net::IOBufferWithSize>(strlen(kData));
   EXPECT_TRUE(ReadData(&reader, buffer.get()));
   EXPECT_EQ(base::StringPiece(kData, strlen(kData)),
             base::StringPiece(buffer->data(), buffer->size()));
@@ -130,7 +130,7 @@
   constexpr size_t kOffset = 10;
   ArcContentFileSystemFileStreamReader reader(GURL(kArcUrlPipe), kOffset);
   auto buffer =
-      make_scoped_refptr(new net::IOBufferWithSize(strlen(kData) - kOffset));
+      base::MakeRefCounted<net::IOBufferWithSize>(strlen(kData) - kOffset);
   EXPECT_TRUE(ReadData(&reader, buffer.get()));
   EXPECT_EQ(base::StringPiece(kData + kOffset, strlen(kData) - kOffset),
             base::StringPiece(buffer->data(), buffer->size()));
diff --git a/chrome/browser/chromeos/arc/voice_interaction/arc_voice_interaction_framework_service.cc b/chrome/browser/chromeos/arc/voice_interaction/arc_voice_interaction_framework_service.cc
index 778d7cfa..d22d0cb8 100644
--- a/chrome/browser/chromeos/arc/voice_interaction/arc_voice_interaction_framework_service.cc
+++ b/chrome/browser/chromeos/arc/voice_interaction/arc_voice_interaction_framework_service.cc
@@ -228,9 +228,9 @@
   if (is_request_pending_) {
     is_request_pending_ = false;
     if (is_pending_request_toggle_) {
-      framework_instance->ToggleVoiceInteractionSession();
+      framework_instance->ToggleVoiceInteractionSession(IsHomescreenActive());
     } else {
-      framework_instance->StartVoiceInteractionSession();
+      framework_instance->StartVoiceInteractionSession(IsHomescreenActive());
     }
   }
 }
@@ -405,7 +405,7 @@
 
   if (should_start_runtime_flow_) {
     VLOG(1) << "Starting runtime setup flow.";
-    framework_instance->StartVoiceInteractionSession();
+    framework_instance->StartVoiceInteractionSession(IsHomescreenActive());
     return;
   }
 
@@ -490,7 +490,7 @@
             arc_bridge_service_->voice_interaction_framework(),
             StartVoiceInteractionSession);
     DCHECK(framework_instance);
-    framework_instance->StartVoiceInteractionSession();
+    framework_instance->StartVoiceInteractionSession(IsHomescreenActive());
   } else {
     mojom::VoiceInteractionFrameworkInstance* framework_instance =
         ARC_GET_INSTANCE_FOR_METHOD(
@@ -513,7 +513,7 @@
           arc_bridge_service_->voice_interaction_framework(),
           ToggleVoiceInteractionSession);
   DCHECK(framework_instance);
-  framework_instance->ToggleVoiceInteractionSession();
+  framework_instance->ToggleVoiceInteractionSession(IsHomescreenActive());
 }
 
 bool ArcVoiceInteractionFrameworkService::ValidateTimeSinceUserInteraction() {
@@ -600,4 +600,9 @@
   ash::Shell::Get()->NotifyVoiceInteractionSetupCompleted(completed);
 }
 
+bool ArcVoiceInteractionFrameworkService::IsHomescreenActive() {
+  // Homescreen is considered to be active if there are no active windows.
+  return !ash::Shell::Get()->activation_client()->GetActiveWindow();
+}
+
 }  // namespace arc
diff --git a/chrome/browser/chromeos/arc/voice_interaction/arc_voice_interaction_framework_service.h b/chrome/browser/chromeos/arc/voice_interaction/arc_voice_interaction_framework_service.h
index c35741f..4b165bd4 100644
--- a/chrome/browser/chromeos/arc/voice_interaction/arc_voice_interaction_framework_service.h
+++ b/chrome/browser/chromeos/arc/voice_interaction/arc_voice_interaction_framework_service.h
@@ -129,6 +129,8 @@
 
   void SetVoiceInteractionSetupCompletedInternal(bool completed);
 
+  bool IsHomescreenActive();
+
   content::BrowserContext* context_;
   ArcBridgeService* const arc_bridge_service_;  // Owned by ArcServiceManager
   mojo::Binding<mojom::VoiceInteractionFrameworkHost> binding_;
diff --git a/chrome/browser/chromeos/display/display_preferences_unittest.cc b/chrome/browser/chromeos/display/display_preferences_unittest.cc
index 89f6c8b..c0d6ee7 100644
--- a/chrome/browser/chromeos/display/display_preferences_unittest.cc
+++ b/chrome/browser/chromeos/display/display_preferences_unittest.cc
@@ -567,8 +567,8 @@
   // Once the notification is removed, the specified resolution will be stored
   // by SetDisplayMode.
   ash::Shell::Get()->display_manager()->SetDisplayMode(
-      id, make_scoped_refptr(new display::ManagedDisplayMode(
-              gfx::Size(300, 200), 60.0f, false, true)));
+      id, base::MakeRefCounted<display::ManagedDisplayMode>(
+              gfx::Size(300, 200), 60.0f, false, true));
   UpdateDisplay("300x200#500x400|400x300|300x200");
 
   property = nullptr;
diff --git a/chrome/browser/chromeos/file_manager/open_with_browser.cc b/chrome/browser/chromeos/file_manager/open_with_browser.cc
index c7583fe..9a7199d 100644
--- a/chrome/browser/chromeos/file_manager/open_with_browser.cc
+++ b/chrome/browser/chromeos/file_manager/open_with_browser.cc
@@ -43,23 +43,15 @@
 const base::FilePath::CharType kSwfExtension[] = FILE_PATH_LITERAL(".swf");
 
 // List of file extensions viewable in the browser.
-const base::FilePath::CharType* kFileExtensionsViewableInBrowser[] = {
-  FILE_PATH_LITERAL(".bmp"),
-  FILE_PATH_LITERAL(".ico"),
-  FILE_PATH_LITERAL(".jpg"),
-  FILE_PATH_LITERAL(".jpeg"),
-  FILE_PATH_LITERAL(".png"),
-  FILE_PATH_LITERAL(".webp"),
-  FILE_PATH_LITERAL(".gif"),
-  FILE_PATH_LITERAL(".txt"),
-  FILE_PATH_LITERAL(".html"),
-  FILE_PATH_LITERAL(".htm"),
-  FILE_PATH_LITERAL(".mhtml"),
-  FILE_PATH_LITERAL(".mht"),
-  FILE_PATH_LITERAL(".xhtml"),
-  FILE_PATH_LITERAL(".xht"),
-  FILE_PATH_LITERAL(".shtml"),
-  FILE_PATH_LITERAL(".svg"),
+constexpr const base::FilePath::CharType* kFileExtensionsViewableInBrowser[] = {
+    FILE_PATH_LITERAL(".bmp"),   FILE_PATH_LITERAL(".ico"),
+    FILE_PATH_LITERAL(".jpg"),   FILE_PATH_LITERAL(".jpeg"),
+    FILE_PATH_LITERAL(".png"),   FILE_PATH_LITERAL(".webp"),
+    FILE_PATH_LITERAL(".gif"),   FILE_PATH_LITERAL(".txt"),
+    FILE_PATH_LITERAL(".html"),  FILE_PATH_LITERAL(".htm"),
+    FILE_PATH_LITERAL(".mhtml"), FILE_PATH_LITERAL(".mht"),
+    FILE_PATH_LITERAL(".xhtml"), FILE_PATH_LITERAL(".xht"),
+    FILE_PATH_LITERAL(".shtml"), FILE_PATH_LITERAL(".svg"),
 };
 
 // Returns true if |file_path| is viewable in the browser (ex. HTML file).
diff --git a/chrome/browser/chromeos/file_system_provider/fileapi/buffering_file_stream_writer_unittest.cc b/chrome/browser/chromeos/file_system_provider/fileapi/buffering_file_stream_writer_unittest.cc
index dce5438b..19ab06a 100644
--- a/chrome/browser/chromeos/file_system_provider/fileapi/buffering_file_stream_writer_unittest.cc
+++ b/chrome/browser/chromeos/file_system_provider/fileapi/buffering_file_stream_writer_unittest.cc
@@ -102,9 +102,9 @@
 
   void SetUp() override {
     short_text_buffer_ =
-        make_scoped_refptr(new net::StringIOBuffer(kShortTextToWrite));
+        base::MakeRefCounted<net::StringIOBuffer>(kShortTextToWrite);
     long_text_buffer_ =
-        make_scoped_refptr(new net::StringIOBuffer(kLongTextToWrite));
+        base::MakeRefCounted<net::StringIOBuffer>(kLongTextToWrite);
     ASSERT_LT(short_text_buffer_->size(), long_text_buffer_->size());
   }
 
diff --git a/chrome/browser/chromeos/file_system_provider/operations/read_file_unittest.cc b/chrome/browser/chromeos/file_system_provider/operations/read_file_unittest.cc
index ef512f2f..ab154ce0 100644
--- a/chrome/browser/chromeos/file_system_provider/operations/read_file_unittest.cc
+++ b/chrome/browser/chromeos/file_system_provider/operations/read_file_unittest.cc
@@ -83,7 +83,7 @@
         kExtensionId, MountOptions(kFileSystemId, "" /* display_name */),
         base::FilePath(), false /* configurable */, true /* watchable */,
         extensions::SOURCE_FILE);
-    io_buffer_ = make_scoped_refptr(new net::IOBuffer(kOffset + kLength));
+    io_buffer_ = base::MakeRefCounted<net::IOBuffer>(kOffset + kLength);
   }
 
   ProvidedFileSystemInfo file_system_info_;
diff --git a/chrome/browser/chromeos/file_system_provider/operations/write_file_unittest.cc b/chrome/browser/chromeos/file_system_provider/operations/write_file_unittest.cc
index c78093eb..080bc10e 100644
--- a/chrome/browser/chromeos/file_system_provider/operations/write_file_unittest.cc
+++ b/chrome/browser/chromeos/file_system_provider/operations/write_file_unittest.cc
@@ -47,7 +47,7 @@
     file_system_info_ = ProvidedFileSystemInfo(
         kExtensionId, mount_options, base::FilePath(), false /* configurable */,
         true /* watchable */, extensions::SOURCE_FILE);
-    io_buffer_ = make_scoped_refptr(new net::StringIOBuffer(kWriteData));
+    io_buffer_ = base::MakeRefCounted<net::StringIOBuffer>(kWriteData);
   }
 
   ProvidedFileSystemInfo file_system_info_;
diff --git a/chrome/browser/chromeos/login/proxy_auth_dialog_browsertest.cc b/chrome/browser/chromeos/login/proxy_auth_dialog_browsertest.cc
index 3107830..e3ac1d0 100644
--- a/chrome/browser/chromeos/login/proxy_auth_dialog_browsertest.cc
+++ b/chrome/browser/chromeos/login/proxy_auth_dialog_browsertest.cc
@@ -121,7 +121,9 @@
     screen_waiter.Wait();
     auth_dialog_waiter.Wait();
     ASSERT_TRUE(auth_dialog_waiter.login_handler());
+    auth_dialog_waiter.login_handler()->CancelAuth();
   }
+  base::RunLoop().RunUntilIdle();
 }
 
 }  // namespace chromeos
diff --git a/chrome/browser/chromeos/login/ui/login_display_host_impl.cc b/chrome/browser/chromeos/login/ui/login_display_host_impl.cc
index 4579fd1b..0f63976 100644
--- a/chrome/browser/chromeos/login/ui/login_display_host_impl.cc
+++ b/chrome/browser/chromeos/login/ui/login_display_host_impl.cc
@@ -94,6 +94,7 @@
 #include "ui/base/ime/chromeos/input_method_util.h"
 #include "ui/base/l10n/l10n_util.h"
 #include "ui/base/resource/resource_bundle.h"
+#include "ui/compositor/compositor_observer.h"
 #include "ui/compositor/layer.h"
 #include "ui/compositor/layer_animation_observer.h"
 #include "ui/compositor/scoped_layer_animation_settings.h"
@@ -306,6 +307,42 @@
   }
 }
 
+class CloseAfterCommit : public ui::CompositorObserver,
+                         public views::WidgetObserver {
+ public:
+  explicit CloseAfterCommit(views::Widget* widget) : widget_(widget) {
+    widget->GetCompositor()->AddObserver(this);
+    widget_->AddObserver(this);
+  }
+  ~CloseAfterCommit() override {
+    widget_->RemoveObserver(this);
+    widget_->GetCompositor()->RemoveObserver(this);
+  }
+
+  // ui::CompositorObserver:
+  void OnCompositingDidCommit(ui::Compositor* compositor) override {
+    DCHECK_EQ(widget_->GetCompositor(), compositor);
+    widget_->Close();
+  }
+
+  void OnCompositingStarted(ui::Compositor* compositor,
+                            base::TimeTicks start_time) override {}
+  void OnCompositingEnded(ui::Compositor* compositor) override {}
+  void OnCompositingLockStateChanged(ui::Compositor* compositor) override {}
+  void OnCompositingShuttingDown(ui::Compositor* compositor) override {}
+
+  // views::WidgetObserver:
+  void OnWidgetDestroying(views::Widget* widget) override {
+    DCHECK_EQ(widget, widget_);
+    delete this;
+  }
+
+ private:
+  views::Widget* const widget_;
+
+  DISALLOW_COPY_AND_ASSIGN(CloseAfterCommit);
+};
+
 }  // namespace
 
 namespace chromeos {
@@ -1228,7 +1265,15 @@
   }
 
   if (login_window_) {
-    login_window_->Close();
+    if (ash_util::IsRunningInMash()) {
+      login_window_->Close();
+    } else {
+      login_window_->Hide();
+      // This CompositorObserver becomes "owned" by login_window_ after
+      // construction and will delete itself once login_window_ is destroyed.
+      new CloseAfterCommit(login_window_);
+    }
+    login_window_->RemoveRemovalsObserver(this);
     login_window_ = nullptr;
     login_window_delegate_ = nullptr;
   }
diff --git a/chrome/browser/chromeos/login/wizard_controller_browsertest.cc b/chrome/browser/chromeos/login/wizard_controller_browsertest.cc
index 242af265..0e5cc935 100644
--- a/chrome/browser/chromeos/login/wizard_controller_browsertest.cc
+++ b/chrome/browser/chromeos/login/wizard_controller_browsertest.cc
@@ -1012,7 +1012,7 @@
 
   void SetUpOnMainThread() override {
     PrefServiceFactory factory;
-    factory.set_user_prefs(make_scoped_refptr(new PrefStoreStub()));
+    factory.set_user_prefs(base::MakeRefCounted<PrefStoreStub>());
     local_state_ = factory.Create(new PrefRegistrySimple());
     WizardController::set_local_state_for_testing(local_state_.get());
 
diff --git a/chrome/browser/chromeos/tether/tether_service_unittest.cc b/chrome/browser/chromeos/tether/tether_service_unittest.cc
index 51423d6..e5bb74e 100644
--- a/chrome/browser/chromeos/tether/tether_service_unittest.cc
+++ b/chrome/browser/chromeos/tether/tether_service_unittest.cc
@@ -213,7 +213,7 @@
         mock_cryptauth_device_manager_.get());
 
     mock_adapter_ =
-        make_scoped_refptr(new NiceMock<MockExtendedBluetoothAdapter>());
+        base::MakeRefCounted<NiceMock<MockExtendedBluetoothAdapter>>();
     SetIsBluetoothPowered(true);
     is_adapter_present_ = true;
     ON_CALL(*mock_adapter_, IsPresent())
diff --git a/chrome/browser/component_updater/chrome_component_updater_configurator.cc b/chrome/browser/component_updater/chrome_component_updater_configurator.cc
index 43204b1c..02b83a6 100644
--- a/chrome/browser/component_updater/chrome_component_updater_configurator.cc
+++ b/chrome/browser/component_updater/chrome_component_updater_configurator.cc
@@ -161,7 +161,7 @@
 
 scoped_refptr<update_client::OutOfProcessPatcher>
 ChromeConfigurator::CreateOutOfProcessPatcher() const {
-  return make_scoped_refptr(new ChromeOutOfProcessPatcher);
+  return base::MakeRefCounted<ChromeOutOfProcessPatcher>();
 }
 
 bool ChromeConfigurator::EnabledDeltas() const {
diff --git a/chrome/browser/exo_parts.cc b/chrome/browser/exo_parts.cc
index 4b1478e..45713349f 100644
--- a/chrome/browser/exo_parts.cc
+++ b/chrome/browser/exo_parts.cc
@@ -21,7 +21,6 @@
 #include "components/exo/file_helper.h"
 #include "components/exo/wayland/server.h"
 #include "components/exo/wm_helper_ash.h"
-#include "components/exo/wm_helper_mus.h"
 #include "content/public/browser/browser_thread.h"
 #include "ui/arc/notification/arc_notification_surface_manager_impl.h"
 
@@ -137,6 +136,9 @@
 
 // static
 std::unique_ptr<ExoParts> ExoParts::CreateIfNecessary() {
+  // For mash, exosphere will not run in the browser process.
+  if (ash_util::IsRunningInMash())
+    return nullptr;
   if (!base::CommandLine::ForCurrentProcess()->HasSwitch(
           switches::kEnableWaylandServer)) {
     return nullptr;
@@ -155,10 +157,8 @@
 ExoParts::ExoParts() {
   arc_notification_surface_manager_ =
       base::MakeUnique<arc::ArcNotificationSurfaceManagerImpl>();
-  if (ash_util::IsRunningInMash())
-    wm_helper_ = base::MakeUnique<exo::WMHelperMus>();
-  else
-    wm_helper_ = base::MakeUnique<exo::WMHelperAsh>();
+  DCHECK(!ash_util::IsRunningInMash());
+  wm_helper_ = base::MakeUnique<exo::WMHelperAsh>();
   exo::WMHelper::SetInstance(wm_helper_.get());
   display_ =
       base::MakeUnique<exo::Display>(arc_notification_surface_manager_.get(),
diff --git a/chrome/browser/extensions/api/image_writer_private/operation.cc b/chrome/browser/extensions/api/image_writer_private/operation.cc
index 0fedb395..097cdfa 100644
--- a/chrome/browser/extensions/api/image_writer_private/operation.cc
+++ b/chrome/browser/extensions/api/image_writer_private/operation.cc
@@ -108,11 +108,11 @@
 
   SetStage(image_writer_api::STAGE_UNZIP);
 
-  auto unzip_helper = make_scoped_refptr(new UnzipHelper(
+  auto unzip_helper = base::MakeRefCounted<UnzipHelper>(
       task_runner(), base::Bind(&Operation::OnUnzipOpenComplete, this),
       base::Bind(&Operation::CompleteAndContinue, this, continuation),
       base::Bind(&Operation::OnUnzipFailure, this),
-      base::Bind(&Operation::OnUnzipProgress, this)));
+      base::Bind(&Operation::OnUnzipProgress, this));
   unzip_helper->Unzip(image_path_, temp_dir_.GetPath());
 }
 
diff --git a/chrome/browser/extensions/api/storage/policy_value_store_unittest.cc b/chrome/browser/extensions/api/storage/policy_value_store_unittest.cc
index 9f0d24a..68eda0d 100644
--- a/chrome/browser/extensions/api/storage/policy_value_store_unittest.cc
+++ b/chrome/browser/extensions/api/storage/policy_value_store_unittest.cc
@@ -50,7 +50,7 @@
   explicit MutablePolicyValueStore(const base::FilePath& path)
       : PolicyValueStore(
             kTestExtensionId,
-            make_scoped_refptr(new SettingsObserverList()),
+            base::MakeRefCounted<SettingsObserverList>(),
             base::MakeUnique<LeveldbValueStore>(kDatabaseUMAClientName, path)) {
   }
   ~MutablePolicyValueStore() override {}
diff --git a/chrome/browser/extensions/chrome_extensions_browser_client.cc b/chrome/browser/extensions/chrome_extensions_browser_client.cc
index f00f274..17c4ec2 100644
--- a/chrome/browser/extensions/chrome_extensions_browser_client.cc
+++ b/chrome/browser/extensions/chrome_extensions_browser_client.cc
@@ -410,7 +410,7 @@
 ChromeExtensionsBrowserClient::CreateUpdateClient(
     content::BrowserContext* context) {
   return update_client::UpdateClientFactory(
-      make_scoped_refptr(new ChromeUpdateClientConfig(context)));
+      base::MakeRefCounted<ChromeUpdateClientConfig>(context));
 }
 
 std::unique_ptr<ExtensionApiFrameIdMapHelper>
diff --git a/chrome/browser/extensions/external_registry_loader_win_unittest.cc b/chrome/browser/extensions/external_registry_loader_win_unittest.cc
index bf9ba21d..6c11456 100644
--- a/chrome/browser/extensions/external_registry_loader_win_unittest.cc
+++ b/chrome/browser/extensions/external_registry_loader_win_unittest.cc
@@ -86,7 +86,7 @@
 // Regression test for https://crbug.com/653045.
 TEST_F(ExternalRegistryLoaderUnittest, TwoStartLoadingDoesNotCrash) {
   scoped_refptr<TestExternalRegistryLoader> test_loader =
-      make_scoped_refptr(new TestExternalRegistryLoader());
+      base::MakeRefCounted<TestExternalRegistryLoader>();
 
   test_loader->StartLoading();
   test_loader->StartLoading();
@@ -103,7 +103,7 @@
 // could overwrite the first one's prefs.
 TEST_F(ExternalRegistryLoaderUnittest, TwoStartLoadingDoesNotOverwritePrefs) {
   scoped_refptr<TestExternalRegistryLoader> test_loader =
-      make_scoped_refptr(new TestExternalRegistryLoader());
+      base::MakeRefCounted<TestExternalRegistryLoader>();
 
   test_loader->StartLoading();
   test_loader->StartLoading();
diff --git a/chrome/browser/extensions/service_worker_apitest.cc b/chrome/browser/extensions/service_worker_apitest.cc
index 3f0cbdb..5b67e9f9 100644
--- a/chrome/browser/extensions/service_worker_apitest.cc
+++ b/chrome/browser/extensions/service_worker_apitest.cc
@@ -41,6 +41,7 @@
 #include "extensions/browser/extension_host.h"
 #include "extensions/browser/extension_registry.h"
 #include "extensions/browser/process_manager.h"
+#include "extensions/common/switches.h"
 #include "extensions/test/background_page_watcher.h"
 #include "extensions/test/extension_test_message_listener.h"
 #include "net/dns/mock_host_resolver.h"
@@ -68,6 +69,8 @@
   return browser->tab_strip_model()->GetActiveWebContents();
 }
 
+enum BindingsType { NATIVE_BINDINGS, JAVASCRIPT_BINDINGS };
+
 class WebContentsLoadStopObserver : content::WebContentsObserver {
  public:
   explicit WebContentsLoadStopObserver(content::WebContents* web_contents)
@@ -96,7 +99,8 @@
 
 }  // namespace
 
-class ServiceWorkerTest : public ExtensionApiTest {
+class ServiceWorkerTest : public ExtensionApiTest,
+                          public ::testing::WithParamInterface<BindingsType> {
  public:
   ServiceWorkerTest() : current_channel_(version_info::Channel::STABLE) {}
 
@@ -107,6 +111,12 @@
     host_resolver()->AddRule("a.com", "127.0.0.1");
   }
 
+  void SetUpCommandLine(base::CommandLine* command_line) override {
+    ExtensionApiTest::SetUpCommandLine(command_line);
+    command_line->AppendSwitchASCII(switches::kNativeCrxBindings,
+                                    GetParam() == NATIVE_BINDINGS ? "1" : "0");
+  }
+
  protected:
   // Returns the ProcessManager for the test's profile.
   ProcessManager* process_manager() { return ProcessManager::Get(profile()); }
@@ -213,7 +223,7 @@
   void SetUpCommandLine(base::CommandLine* command_line) override {
     // ServiceWorkerRegistration.sync requires experimental flag.
     command_line->AppendSwitch(
-        switches::kEnableExperimentalWebPlatformFeatures);
+        ::switches::kEnableExperimentalWebPlatformFeatures);
     ServiceWorkerTest::SetUpCommandLine(command_line);
   }
 
@@ -256,7 +266,7 @@
   // ExtensionApiTest overrides.
   void SetUpCommandLine(base::CommandLine* command_line) override {
     command_line->AppendSwitch(
-        switches::kEnableExperimentalWebPlatformFeatures);
+        ::switches::kEnableExperimentalWebPlatformFeatures);
     ServiceWorkerTest::SetUpCommandLine(command_line);
   }
   void SetUpOnMainThread() override {
@@ -287,11 +297,11 @@
   DISALLOW_COPY_AND_ASSIGN(ServiceWorkerPushMessagingTest);
 };
 
-IN_PROC_BROWSER_TEST_F(ServiceWorkerTest, RegisterSucceeds) {
+IN_PROC_BROWSER_TEST_P(ServiceWorkerTest, RegisterSucceeds) {
   StartTestFromBackgroundPage("register.js", kExpectSuccess);
 }
 
-IN_PROC_BROWSER_TEST_F(ServiceWorkerTest, UpdateRefreshesServiceWorker) {
+IN_PROC_BROWSER_TEST_P(ServiceWorkerTest, UpdateRefreshesServiceWorker) {
   base::ThreadRestrictions::ScopedAllowIO allow_io;
   base::ScopedTempDir scoped_temp_dir;
   ASSERT_TRUE(scoped_temp_dir.CreateUniqueTempDir());
@@ -333,7 +343,7 @@
 }
 
 // TODO(crbug.com/765736) Fix the test.
-IN_PROC_BROWSER_TEST_F(ServiceWorkerTest, DISABLED_UpdateWithoutSkipWaiting) {
+IN_PROC_BROWSER_TEST_P(ServiceWorkerTest, DISABLED_UpdateWithoutSkipWaiting) {
   base::ThreadRestrictions::ScopedAllowIO allow_io;
   base::ScopedTempDir scoped_temp_dir;
   ASSERT_TRUE(scoped_temp_dir.CreateUniqueTempDir());
@@ -405,7 +415,7 @@
   EXPECT_TRUE(listener3.WaitUntilSatisfied());
 }
 
-IN_PROC_BROWSER_TEST_F(ServiceWorkerTest, FetchArbitraryPaths) {
+IN_PROC_BROWSER_TEST_P(ServiceWorkerTest, FetchArbitraryPaths) {
   const Extension* extension =
       StartTestFromBackgroundPage("fetch.js", kExpectSuccess);
 
@@ -427,7 +437,7 @@
             NavigateAndExtractInnerText(extension->GetResourceURL("")));
 }
 
-IN_PROC_BROWSER_TEST_F(ServiceWorkerTest, SWServedBackgroundPageReceivesEvent) {
+IN_PROC_BROWSER_TEST_P(ServiceWorkerTest, SWServedBackgroundPageReceivesEvent) {
   const Extension* extension =
       StartTestFromBackgroundPage("replace_background.js", kExpectSuccess);
   ExtensionHost* background_page =
@@ -454,7 +464,7 @@
   EXPECT_TRUE(listener.WaitUntilSatisfied());
 }
 
-IN_PROC_BROWSER_TEST_F(ServiceWorkerTest,
+IN_PROC_BROWSER_TEST_P(ServiceWorkerTest,
                        LoadingBackgroundPageBypassesServiceWorker) {
   const Extension* extension =
       StartTestFromBackgroundPage("fetch.js", kExpectSuccess);
@@ -499,7 +509,7 @@
             ExtractInnerText(background_page->host_contents()));
 }
 
-IN_PROC_BROWSER_TEST_F(ServiceWorkerTest,
+IN_PROC_BROWSER_TEST_P(ServiceWorkerTest,
                        ServiceWorkerPostsMessageToBackgroundClient) {
   const Extension* extension = StartTestFromBackgroundPage(
       "post_message_to_background_client.js", kExpectSuccess);
@@ -519,7 +529,7 @@
   EXPECT_EQ("true", ExecuteScriptInBackgroundPage(extension->id(), kScript));
 }
 
-IN_PROC_BROWSER_TEST_F(ServiceWorkerTest,
+IN_PROC_BROWSER_TEST_P(ServiceWorkerTest,
                        BackgroundPagePostsMessageToServiceWorker) {
   const Extension* extension =
       StartTestFromBackgroundPage("post_message_to_sw.js", kExpectSuccess);
@@ -536,7 +546,7 @@
   EXPECT_EQ("true", ExecuteScriptInBackgroundPage(extension->id(), kScript));
 }
 
-IN_PROC_BROWSER_TEST_F(ServiceWorkerTest,
+IN_PROC_BROWSER_TEST_P(ServiceWorkerTest,
                        ServiceWorkerSuspensionOnExtensionUnload) {
   // For this test, only hold onto the extension's ID and URL + a function to
   // get a resource URL, because we're going to be disabling and uninstalling
@@ -596,7 +606,7 @@
             NavigateAndGetPageType(get_resource_url("final.html")));
 }
 
-IN_PROC_BROWSER_TEST_F(ServiceWorkerTest, BackgroundPageIsWokenIfAsleep) {
+IN_PROC_BROWSER_TEST_P(ServiceWorkerTest, BackgroundPageIsWokenIfAsleep) {
   const Extension* extension =
       StartTestFromBackgroundPage("wake_on_fetch.js", kExpectSuccess);
 
@@ -628,7 +638,7 @@
                         "background-client-is-awake")));
 }
 
-IN_PROC_BROWSER_TEST_F(ServiceWorkerTest,
+IN_PROC_BROWSER_TEST_P(ServiceWorkerTest,
                        GetBackgroundClientFailsWithNoBackgroundPage) {
   // This extension doesn't have a background page, only a tab at page.html.
   // The service worker it registers tries to call getBackgroundClient() and
@@ -637,17 +647,17 @@
   EXPECT_TRUE(RunExtensionSubtest("service_worker/no_background", "page.html"));
 }
 
-IN_PROC_BROWSER_TEST_F(ServiceWorkerTest, NotificationAPI) {
+IN_PROC_BROWSER_TEST_P(ServiceWorkerTest, NotificationAPI) {
   EXPECT_TRUE(RunExtensionSubtest("service_worker/notifications/has_permission",
                                   "page.html"));
 }
 
-IN_PROC_BROWSER_TEST_F(ServiceWorkerTest, WebAccessibleResourcesFetch) {
+IN_PROC_BROWSER_TEST_P(ServiceWorkerTest, WebAccessibleResourcesFetch) {
   EXPECT_TRUE(RunExtensionSubtest(
       "service_worker/web_accessible_resources/fetch/", "page.html"));
 }
 
-IN_PROC_BROWSER_TEST_F(ServiceWorkerTest, TabsCreate) {
+IN_PROC_BROWSER_TEST_P(ServiceWorkerTest, TabsCreate) {
   // Extensions APIs from SW are only enabled on trunk.
   ScopedCurrentChannel current_channel_override(version_info::Channel::UNKNOWN);
   const Extension* extension = LoadExtensionWithFlags(
@@ -670,7 +680,7 @@
   EXPECT_EQ(starting_tab_count, browser()->tab_strip_model()->count());
 }
 
-IN_PROC_BROWSER_TEST_F(ServiceWorkerTest, Events) {
+IN_PROC_BROWSER_TEST_P(ServiceWorkerTest, Events) {
   // Extensions APIs from SW are only enabled on trunk.
   ScopedCurrentChannel current_channel_override(version_info::Channel::UNKNOWN);
   const Extension* extension = LoadExtensionWithFlags(
@@ -686,7 +696,7 @@
   ASSERT_EQ("chrome.tabs.onUpdated callback", result);
 }
 
-IN_PROC_BROWSER_TEST_F(ServiceWorkerTest, EventsToStoppedWorker) {
+IN_PROC_BROWSER_TEST_P(ServiceWorkerTest, EventsToStoppedWorker) {
   // Extensions APIs from SW are only enabled on trunk.
   ScopedCurrentChannel current_channel_override(version_info::Channel::UNKNOWN);
   const Extension* extension = LoadExtensionWithFlags(
@@ -722,7 +732,7 @@
 
 // Tests that worker ref count increments while extension API function is
 // active.
-IN_PROC_BROWSER_TEST_F(ServiceWorkerTest, WorkerRefCount) {
+IN_PROC_BROWSER_TEST_P(ServiceWorkerTest, WorkerRefCount) {
   // Extensions APIs from SW are only enabled on trunk.
   ScopedCurrentChannel current_channel_override(version_info::Channel::UNKNOWN);
   const Extension* extension = LoadExtensionWithFlags(
@@ -801,7 +811,7 @@
 // This test also verifies that if the requested resource exists in the manifest
 // but is not present in the extension directory, the Service Worker can still
 // serve the resource file.
-IN_PROC_BROWSER_TEST_F(ServiceWorkerTest, WebAccessibleResourcesIframeSrc) {
+IN_PROC_BROWSER_TEST_P(ServiceWorkerTest, WebAccessibleResourcesIframeSrc) {
   const Extension* extension = LoadExtensionWithFlags(
       test_data_dir_.AppendASCII(
           "service_worker/web_accessible_resources/iframe_src"),
@@ -864,7 +874,7 @@
   EXPECT_EQ("FROM_SW_RESOURCE", result);
 }
 
-IN_PROC_BROWSER_TEST_F(ServiceWorkerBackgroundSyncTest, Sync) {
+IN_PROC_BROWSER_TEST_P(ServiceWorkerBackgroundSyncTest, Sync) {
   const Extension* extension = LoadExtensionWithFlags(
       test_data_dir_.AppendASCII("service_worker/sync"), kFlagNone);
   ASSERT_TRUE(extension);
@@ -890,7 +900,7 @@
   EXPECT_TRUE(sync_listener.WaitUntilSatisfied());
 }
 
-IN_PROC_BROWSER_TEST_F(ServiceWorkerTest,
+IN_PROC_BROWSER_TEST_P(ServiceWorkerTest,
                        FetchFromContentScriptShouldNotGoToServiceWorkerOfPage) {
   ASSERT_TRUE(StartEmbeddedTestServer());
   GURL page_url = embedded_test_server()->GetURL(
@@ -910,7 +920,7 @@
       << message_;
 }
 
-IN_PROC_BROWSER_TEST_F(ServiceWorkerPushMessagingTest, OnPush) {
+IN_PROC_BROWSER_TEST_P(ServiceWorkerPushMessagingTest, OnPush) {
   const Extension* extension = LoadExtensionWithFlags(
       test_data_dir_.AppendASCII("service_worker/push_messaging"), kFlagNone);
   ASSERT_TRUE(extension);
@@ -950,10 +960,32 @@
   run_loop.Run();  // Wait until the message is handled by push service.
 }
 
-IN_PROC_BROWSER_TEST_F(ServiceWorkerTest, FilteredEvents) {
+IN_PROC_BROWSER_TEST_P(ServiceWorkerTest, FilteredEvents) {
   // Extensions APIs from SW are only enabled on trunk.
   ScopedCurrentChannel current_channel_override(version_info::Channel::UNKNOWN);
   ASSERT_TRUE(RunExtensionTest("service_worker/filtered_events"));
 }
 
+// Run with both native and JS-based bindings. This ensures that both stable
+// (JS) and experimental (native) phases work correctly with worker scripts
+// while we launch native bindings to stable.
+INSTANTIATE_TEST_CASE_P(ServiceWorkerTestWithNativeBindings,
+                        ServiceWorkerTest,
+                        ::testing::Values(NATIVE_BINDINGS));
+INSTANTIATE_TEST_CASE_P(ServiceWorkerTestWithJSBindings,
+                        ServiceWorkerTest,
+                        ::testing::Values(JAVASCRIPT_BINDINGS));
+INSTANTIATE_TEST_CASE_P(ServiceWorkerBackgroundSyncTestWithNativeBindings,
+                        ServiceWorkerBackgroundSyncTest,
+                        ::testing::Values(NATIVE_BINDINGS));
+INSTANTIATE_TEST_CASE_P(ServiceWorkerBackgroundSyncTestWithJSBindings,
+                        ServiceWorkerBackgroundSyncTest,
+                        ::testing::Values(JAVASCRIPT_BINDINGS));
+INSTANTIATE_TEST_CASE_P(ServiceWorkerPushMessagingTestWithNativeBindings,
+                        ServiceWorkerPushMessagingTest,
+                        ::testing::Values(NATIVE_BINDINGS));
+INSTANTIATE_TEST_CASE_P(ServiceWorkerPushMessagingTestWithJSBindings,
+                        ServiceWorkerPushMessagingTest,
+                        ::testing::Values(JAVASCRIPT_BINDINGS));
+
 }  // namespace extensions
diff --git a/chrome/browser/extensions/updater/chrome_update_client_config.cc b/chrome/browser/extensions/updater/chrome_update_client_config.cc
index 60a719d..5e9a0553 100644
--- a/chrome/browser/extensions/updater/chrome_update_client_config.cc
+++ b/chrome/browser/extensions/updater/chrome_update_client_config.cc
@@ -156,7 +156,7 @@
 
 scoped_refptr<update_client::OutOfProcessPatcher>
 ChromeUpdateClientConfig::CreateOutOfProcessPatcher() const {
-  return make_scoped_refptr(new component_updater::ChromeOutOfProcessPatcher);
+  return base::MakeRefCounted<component_updater::ChromeOutOfProcessPatcher>();
 }
 
 bool ChromeUpdateClientConfig::EnabledDeltas() const {
diff --git a/chrome/browser/local_discovery/service_discovery_shared_client.cc b/chrome/browser/local_discovery/service_discovery_shared_client.cc
index 6179a7c..ff6fce6 100644
--- a/chrome/browser/local_discovery/service_discovery_shared_client.cc
+++ b/chrome/browser/local_discovery/service_discovery_shared_client.cc
@@ -89,7 +89,7 @@
 #if defined(OS_MACOSX)
   return ServiceDiscoveryClientMacFactory::CreateInstance();
 #else
-  return make_scoped_refptr(new ServiceDiscoveryClientMdns());
+  return base::MakeRefCounted<ServiceDiscoveryClientMdns>();
 #endif  // defined(OS_MACOSX)
 #else
   NOTIMPLEMENTED();
diff --git a/chrome/browser/media/router/presentation_service_delegate_impl_unittest.cc b/chrome/browser/media/router/presentation_service_delegate_impl_unittest.cc
index 7c75dca48..fd8c5d2 100644
--- a/chrome/browser/media/router/presentation_service_delegate_impl_unittest.cc
+++ b/chrome/browser/media/router/presentation_service_delegate_impl_unittest.cc
@@ -38,10 +38,9 @@
 
 namespace {
 
-constexpr char kPresentationUrl1[] = "http://foo.fakeurl.com/";
-constexpr char kPresentationUrl2[] = "http://bar.fakeurl.com/";
-constexpr char kPresentationUrl3[] =
-    "https://google.com/cast#__castAppId__=233637DE";
+constexpr char kPresentationUrl1[] = "https://foo.fakeurl.com/";
+constexpr char kPresentationUrl2[] = "https://bar.fakeurl.com/";
+constexpr char kPresentationUrl3[] = "cast:233637DE";
 constexpr char kFrameUrl[] = "http://anotherframeurl.fakeurl.com/";
 constexpr char kPresentationId[] = "presentation_id";
 
diff --git a/chrome/browser/notifications/notification_platform_bridge_linux.cc b/chrome/browser/notifications/notification_platform_bridge_linux.cc
index 27e0981..970e721 100644
--- a/chrome/browser/notifications/notification_platform_bridge_linux.cc
+++ b/chrome/browser/notifications/notification_platform_bridge_linux.cc
@@ -409,7 +409,7 @@
       bus_options.bus_type = dbus::Bus::SESSION;
       bus_options.connection_type = dbus::Bus::PRIVATE;
       bus_options.dbus_task_runner = task_runner_;
-      bus_ = make_scoped_refptr(new dbus::Bus(bus_options));
+      bus_ = base::MakeRefCounted<dbus::Bus>(bus_options);
     }
 
     notification_proxy_ =
diff --git a/chrome/browser/predictors/loading_test_util.cc b/chrome/browser/predictors/loading_test_util.cc
index cb39b43..9850d00 100644
--- a/chrome/browser/predictors/loading_test_util.cc
+++ b/chrome/browser/predictors/loading_test_util.cc
@@ -215,8 +215,8 @@
 
 scoped_refptr<net::HttpResponseHeaders> MakeResponseHeaders(
     const char* headers) {
-  return make_scoped_refptr(new net::HttpResponseHeaders(
-      net::HttpUtil::AssembleRawHeaders(headers, strlen(headers))));
+  return base::MakeRefCounted<net::HttpResponseHeaders>(
+      net::HttpUtil::AssembleRawHeaders(headers, strlen(headers)));
 }
 
 MockURLRequestJob::MockURLRequestJob(
diff --git a/chrome/browser/prerender/prerender_browsertest.cc b/chrome/browser/prerender/prerender_browsertest.cc
index 51cb5646..86dc0119 100644
--- a/chrome/browser/prerender/prerender_browsertest.cc
+++ b/chrome/browser/prerender/prerender_browsertest.cc
@@ -469,9 +469,8 @@
     if (swap_observer_)
       return true;
     WebContents* new_tab = content::Details<WebContents>(details).ptr();
-    // Get the TabStripModel. Assume this is attached to a Browser.
     TabStripModel* tab_strip_model =
-        Browser::FromWebContents(new_tab)->tab_strip_model();
+        chrome::FindBrowserWithWebContents(new_tab)->tab_strip_model();
     swap_observer_.reset(new NavigationOrSwapObserver(tab_strip_model,
                                                       new_tab));
     swap_observer_->set_did_start_loading();
diff --git a/chrome/browser/resources/chromeos/login/oobe_eula.css b/chrome/browser/resources/chromeos/login/oobe_eula.css
index 3a49613b..aad0525 100644
--- a/chrome/browser/resources/chromeos/login/oobe_eula.css
+++ b/chrome/browser/resources/chromeos/login/oobe_eula.css
@@ -35,6 +35,7 @@
 #usageStats {
   --paper-checkbox-size: 16px;
   --paper-checkbox-checked-color: var(--google-blue-500);
+  --paper-checkbox-ink-size: 44px;
   size: 16px;
 }
 
diff --git a/chrome/browser/resources/settings/appearance_page/appearance_browser_proxy.js b/chrome/browser/resources/settings/appearance_page/appearance_browser_proxy.js
index c75464d..779818bd 100644
--- a/chrome/browser/resources/settings/appearance_page/appearance_browser_proxy.js
+++ b/chrome/browser/resources/settings/appearance_page/appearance_browser_proxy.js
@@ -17,17 +17,6 @@
     /** @return {boolean} Whether the current profile is supervised. */
     isSupervised() {}
 
-    /**
-     * @return {!Promise<boolean>} Whether the wallpaper setting row should be
-     *     visible.
-     */
-    isWallpaperSettingVisible() {}
-
-    /**
-     * @return {!Promise<boolean>} Whether the wallpaper is policy controlled.
-     */
-    isWallpaperPolicyControlled() {}
-
     // <if expr="chromeos">
     openWallpaperManager() {}
 
@@ -72,16 +61,6 @@
 
     // <if expr="chromeos">
     /** @override */
-    isWallpaperSettingVisible() {
-      return cr.sendWithPromise('isWallpaperSettingVisible');
-    }
-
-    /** @override */
-    isWallpaperPolicyControlled() {
-      return cr.sendWithPromise('isWallpaperPolicyControlled');
-    }
-
-    /** @override */
     openWallpaperManager() {
       chrome.send('openWallpaperManager');
     }
diff --git a/chrome/browser/resources/settings/appearance_page/appearance_page.html b/chrome/browser/resources/settings/appearance_page/appearance_page.html
index 10502194..6db97e0 100644
--- a/chrome/browser/resources/settings/appearance_page/appearance_page.html
+++ b/chrome/browser/resources/settings/appearance_page/appearance_page.html
@@ -51,14 +51,8 @@
               $i18n{openWallpaperApp}
             </div>
           </div>
-          <template is="dom-if" if="[[isWallpaperPolicyControlled_]]">
-            <cr-policy-indicator id="wallpaperPolicyIndicator"
-                indicator-type="devicePolicy">
-            </cr-policy-indicator>
-          </template>
-          <button class="icon-external" id="showWallpaperManager"
-              is="paper-icon-button-light" aria-label="$i18n{setWallpaper}"
-              disabled="[[isWallpaperPolicyControlled_]]"
+          <button class="icon-external" is="paper-icon-button-light"
+              aria-label="$i18n{setWallpaper}"
               aria-describedby="wallpaperSecondary"></button>
         </div>
         <div class="settings-box two-line"
diff --git a/chrome/browser/resources/settings/appearance_page/appearance_page.js b/chrome/browser/resources/settings/appearance_page/appearance_page.js
index 29a17fd06..92deb4b 100644
--- a/chrome/browser/resources/settings/appearance_page/appearance_page.js
+++ b/chrome/browser/resources/settings/appearance_page/appearance_page.js
@@ -35,9 +35,6 @@
     /** @private */
     defaultZoom_: Number,
 
-    /** @private */
-    isWallpaperPolicyControlled_: {type: Boolean, value: true},
-
     /**
      * List of options for the font size drop-down menu.
      * @type {!DropdownMenuOptionList}
@@ -137,17 +134,6 @@
     this.browserProxy_.getDefaultZoom().then(zoom => {
       this.defaultZoom_ = zoom;
     });
-    // <if expr="chromeos">
-    this.browserProxy_.isWallpaperSettingVisible().then(
-        isWallpaperSettingVisible => {
-          assert(this.pageVisibility);
-          this.pageVisibility.setWallpaper = isWallpaperSettingVisible;
-        });
-    this.browserProxy_.isWallpaperPolicyControlled().then(
-        isPolicyControlled => {
-          this.isWallpaperPolicyControlled_ = isPolicyControlled;
-        });
-    // </if>
   },
 
   /**
diff --git a/chrome/browser/resources/settings/page_visibility.js b/chrome/browser/resources/settings/page_visibility.js
index 8d8da3a4..80d9b201 100644
--- a/chrome/browser/resources/settings/page_visibility.js
+++ b/chrome/browser/resources/settings/page_visibility.js
@@ -56,8 +56,7 @@
 cr.define('settings', function() {
   /**
    * Dictionary defining page visibility.
-   * Sets all the pages' visibility when in guest mode, otherwise only sets the
-   * appearance page's visibility. All the other pages are visible when not set
+   * This is only set when in guest mode. All pages are visible when not set
    * because polymer only notifies after a property is set.
    * @type {!GuestModePageVisibility}
    */
@@ -101,18 +100,6 @@
       multidevice: false,
     };
     // </if>
-  } else {
-    // <if expr="chromeos">
-    pageVisibility = {
-      appearance: {
-        setWallpaper: true,
-        setTheme: true,
-        homeButton: true,
-        bookmarksBar: true,
-        pageZoom: true,
-      },
-    };
-    // </if>
   }
 
   return {pageVisibility: pageVisibility};
diff --git a/chrome/browser/supervised_user/supervised_user_browsertest.cc b/chrome/browser/supervised_user/supervised_user_browsertest.cc
index 64357d6..2f47eec 100644
--- a/chrome/browser/supervised_user/supervised_user_browsertest.cc
+++ b/chrome/browser/supervised_user/supervised_user_browsertest.cc
@@ -411,7 +411,7 @@
   SupervisedUserSettingsService* supervised_user_settings_service =
       SupervisedUserSettingsServiceFactory::GetForProfile(
           browser()->profile());
-  auto message_loop_runner = make_scoped_refptr(new content::MessageLoopRunner);
+  auto message_loop_runner = base::MakeRefCounted<content::MessageLoopRunner>();
   InterstitialPageObserver interstitial_observer(
       web_contents, message_loop_runner->QuitClosure());
   supervised_user_settings_service->SetLocalSetting(
diff --git a/chrome/browser/ui/app_list/app_list_service_unittest.cc b/chrome/browser/ui/app_list/app_list_service_unittest.cc
index 7788f967..753f9df 100644
--- a/chrome/browser/ui/app_list/app_list_service_unittest.cc
+++ b/chrome/browser/ui/app_list/app_list_service_unittest.cc
@@ -101,7 +101,7 @@
     profiles::RegisterPrefs(pref_registry);
 
     PrefServiceFactory factory;
-    factory.set_user_prefs(make_scoped_refptr(new TestingPrefStore));
+    factory.set_user_prefs(base::MakeRefCounted<TestingPrefStore>());
     local_state_ = factory.Create(pref_registry);
 
     profile_store_ = new FakeProfileStore(user_data_dir_, local_state_.get());
diff --git a/chrome/browser/ui/browser.cc b/chrome/browser/ui/browser.cc
index 51988286..0c6de8d 100644
--- a/chrome/browser/ui/browser.cc
+++ b/chrome/browser/ui/browser.cc
@@ -281,19 +281,6 @@
 #endif
 }
 
-// Stores a pointer to the Browser in the WebContents.
-struct BrowserLink : public base::SupportsUserData::Data {
-  static const char kKey[];
-
-  explicit BrowserLink(Browser* browser) : browser(browser) {}
-  ~BrowserLink() override = default;
-
-  Browser* browser;
-};
-
-// static
-const char BrowserLink::kKey[] = "BrowserLink";
-
 }  // namespace
 
 ////////////////////////////////////////////////////////////////////////////////
@@ -587,13 +574,6 @@
     select_file_dialog_->ListenerDestroyed();
 }
 
-// static
-Browser* Browser::FromWebContents(content::WebContents* web_contents) {
-  const BrowserLink* link =
-      static_cast<BrowserLink*>(web_contents->GetUserData(&BrowserLink::kKey));
-  return link ? link->browser : nullptr;
-}
-
 ///////////////////////////////////////////////////////////////////////////////
 // Getters & Setters
 
@@ -2381,14 +2361,6 @@
     zoom::ZoomController::FromWebContents(web_contents)->RemoveObserver(this);
     content_translate_driver.RemoveObserver(this);
   }
-
-  // Update the back-link from the WebContents to Browser.
-  if (set_delegate) {
-    web_contents->SetUserData(BrowserLink::kKey,
-                              base::MakeUnique<BrowserLink>(this));
-  } else {
-    web_contents->RemoveUserData(BrowserLink::kKey);
-  }
 }
 
 void Browser::CloseFrame() {
diff --git a/chrome/browser/ui/browser.h b/chrome/browser/ui/browser.h
index 5d8e4b517..cd5fcfb5 100644
--- a/chrome/browser/ui/browser.h
+++ b/chrome/browser/ui/browser.h
@@ -219,10 +219,6 @@
   explicit Browser(const CreateParams& params);
   ~Browser() override;
 
-  // Returns the Browser that contains the specified WebContents. May return
-  // null if no Browser has that WebContents as a tab.
-  static Browser* FromWebContents(content::WebContents* web_contents);
-
   // Set overrides for the initial window bounds and maximized state.
   void set_override_bounds(const gfx::Rect& bounds) {
     override_bounds_ = bounds;
diff --git a/chrome/browser/ui/startup/default_browser_infobar_delegate.cc b/chrome/browser/ui/startup/default_browser_infobar_delegate.cc
index b6264275..6b32c67 100644
--- a/chrome/browser/ui/startup/default_browser_infobar_delegate.cc
+++ b/chrome/browser/ui/startup/default_browser_infobar_delegate.cc
@@ -115,8 +115,8 @@
   // The worker pointer is reference counted. While it is running, the
   // message loops of the FILE and UI thread will hold references to it
   // and it will be automatically freed once all its tasks have finished.
-  make_scoped_refptr(new shell_integration::DefaultBrowserWorker(
-                         shell_integration::DefaultWebClientWorkerCallback()))
+  base::MakeRefCounted<shell_integration::DefaultBrowserWorker>(
+      shell_integration::DefaultWebClientWorkerCallback())
       ->StartSetAsDefault();
   return true;
 }
diff --git a/chrome/browser/ui/webui/settings/appearance_handler.cc b/chrome/browser/ui/webui/settings/appearance_handler.cc
index dae38e4..c863519 100644
--- a/chrome/browser/ui/webui/settings/appearance_handler.cc
+++ b/chrome/browser/ui/webui/settings/appearance_handler.cc
@@ -14,7 +14,6 @@
 
 #if defined(OS_CHROMEOS)
 #include "chrome/browser/chromeos/login/users/wallpaper/wallpaper_manager.h"
-#include "chromeos/login/login_state.h"
 #endif
 
 namespace settings {
@@ -44,16 +43,6 @@
       "openWallpaperManager",
       base::Bind(&AppearanceHandler::HandleOpenWallpaperManager,
                  base::Unretained(this)));
-
-  web_ui()->RegisterMessageCallback(
-      "isWallpaperSettingVisible",
-      base::Bind(&AppearanceHandler::IsWallpaperSettingVisible,
-                 base::Unretained(this)));
-
-  web_ui()->RegisterMessageCallback(
-      "isWallpaperPolicyControlled",
-      base::Bind(&AppearanceHandler::IsWallpaperPolicyControlled,
-                 base::Unretained(this)));
 #endif
 }
 
@@ -71,51 +60,9 @@
 #endif
 
 #if defined(OS_CHROMEOS)
-void AppearanceHandler::IsWallpaperSettingVisible(const base::ListValue* args) {
-  CHECK_EQ(args->GetSize(), 1U);
-  const base::Value* callback_id;
-  CHECK(args->Get(0, &callback_id));
-  AllowJavascript();
-
-  bool is_wallpaper_visible = false;
-  const chromeos::LoginState* login_state = chromeos::LoginState::Get();
-  const chromeos::LoginState::LoggedInUserType user_type =
-      login_state->GetLoggedInUserType();
-  const user_manager::User* user =
-      user_manager::UserManager::Get()->GetActiveUser();
-
-  // Only login, whitelist types and active users are allowed to change
-  // their wallpaper. Then show the wallpaper setting row for them.
-  if (login_state->IsUserLoggedIn() && user &&
-      (user_type == chromeos::LoginState::LOGGED_IN_USER_REGULAR ||
-       user_type == chromeos::LoginState::LOGGED_IN_USER_OWNER ||
-       user_type == chromeos::LoginState::LOGGED_IN_USER_PUBLIC_ACCOUNT ||
-       user_type == chromeos::LoginState::LOGGED_IN_USER_SUPERVISED)) {
-    is_wallpaper_visible = true;
-  }
-
-  ResolveJavascriptCallback(*callback_id, base::Value(is_wallpaper_visible));
-}
-
-void AppearanceHandler::IsWallpaperPolicyControlled(
-    const base::ListValue* args) {
-  CHECK_EQ(args->GetSize(), 1U);
-  const base::Value* callback_id;
-  CHECK(args->Get(0, &callback_id));
-  AllowJavascript();
-
-  ResolveJavascriptCallback(
-      *callback_id,
-      base::Value(chromeos::WallpaperManager::Get()->IsPolicyControlled(
-          user_manager::UserManager::Get()->GetActiveUser()->GetAccountId())));
-}
-
 void AppearanceHandler::HandleOpenWallpaperManager(
     const base::ListValue* /*args*/) {
-  if (!chromeos::WallpaperManager::Get()->IsPolicyControlled(
-          user_manager::UserManager::Get()->GetActiveUser()->GetAccountId())) {
-    chromeos::WallpaperManager::Get()->Open();
-  }
+  chromeos::WallpaperManager::Get()->Open();
 }
 #endif
 
diff --git a/chrome/browser/ui/webui/settings/appearance_handler.h b/chrome/browser/ui/webui/settings/appearance_handler.h
index d31af5aa..a00a9637 100644
--- a/chrome/browser/ui/webui/settings/appearance_handler.h
+++ b/chrome/browser/ui/webui/settings/appearance_handler.h
@@ -41,12 +41,6 @@
 #endif
 
 #if defined(OS_CHROMEOS)
-  // Whether should show the wallpaper setting row.
-  void IsWallpaperSettingVisible(const base::ListValue* args);
-
-  // Whether the wallpaper is policy controlled.
-  void IsWallpaperPolicyControlled(const base::ListValue* args);
-
   // Open the wallpaper manager app.
   void HandleOpenWallpaperManager(const base::ListValue* args);
 #endif
diff --git a/chrome/browser/vr/BUILD.gn b/chrome/browser/vr/BUILD.gn
index c03ae87..6a89dd2b 100644
--- a/chrome/browser/vr/BUILD.gn
+++ b/chrome/browser/vr/BUILD.gn
@@ -51,6 +51,8 @@
     "elements/insecure_content_permanent_texture.h",
     "elements/insecure_content_transient_texture.cc",
     "elements/insecure_content_transient_texture.h",
+    "elements/invisible_hit_target.cc",
+    "elements/invisible_hit_target.h",
     "elements/linear_layout.cc",
     "elements/linear_layout.h",
     "elements/loading_indicator.cc",
@@ -128,6 +130,8 @@
     "vr_gl_util.h",
     "vr_shell_renderer.cc",
     "vr_shell_renderer.h",
+    "web_contents_event_forwarder.cc",
+    "web_contents_event_forwarder.h",
   ]
 
   deps = [
diff --git a/chrome/browser/vr/elements/exit_prompt_backplane.h b/chrome/browser/vr/elements/exit_prompt_backplane.h
index d6aff604..cfb1c00 100644
--- a/chrome/browser/vr/elements/exit_prompt_backplane.h
+++ b/chrome/browser/vr/elements/exit_prompt_backplane.h
@@ -6,13 +6,13 @@
 #define CHROME_BROWSER_VR_ELEMENTS_EXIT_PROMPT_BACKPLANE_H_
 
 #include "base/callback.h"
-#include "chrome/browser/vr/elements/ui_element.h"
+#include "chrome/browser/vr/elements/invisible_hit_target.h"
 
 namespace vr {
 
 // An invisible but hittable plane behind the exit prompt, to keep the reticle
 // roughly planar with the prompt when its near the prompt.
-class ExitPromptBackplane : public UiElement {
+class ExitPromptBackplane : public InvisibleHitTarget {
  public:
   explicit ExitPromptBackplane(const base::Callback<void()>& click_callback);
   ~ExitPromptBackplane() override;
diff --git a/chrome/browser/vr/elements/full_screen_rect.h b/chrome/browser/vr/elements/full_screen_rect.h
index a3f16db..28dca3e 100644
--- a/chrome/browser/vr/elements/full_screen_rect.h
+++ b/chrome/browser/vr/elements/full_screen_rect.h
@@ -20,6 +20,7 @@
   void Render(UiElementRenderer* renderer,
               const gfx::Transform& view_proj_matrix) const final;
 
+ private:
   DISALLOW_COPY_AND_ASSIGN(FullScreenRect);
 };
 
diff --git a/chrome/browser/vr/elements/invisible_hit_target.cc b/chrome/browser/vr/elements/invisible_hit_target.cc
new file mode 100644
index 0000000..3fc3a08e
--- /dev/null
+++ b/chrome/browser/vr/elements/invisible_hit_target.cc
@@ -0,0 +1,19 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "chrome/browser/vr/elements/invisible_hit_target.h"
+
+namespace vr {
+
+InvisibleHitTarget::InvisibleHitTarget() {
+  set_hit_testable(true);
+}
+InvisibleHitTarget::~InvisibleHitTarget() = default;
+
+void InvisibleHitTarget::Render(UiElementRenderer* renderer,
+                                const gfx::Transform& view_proj_matrix) const {
+  DCHECK(hit_testable());
+}
+
+}  // namespace vr
diff --git a/chrome/browser/vr/elements/invisible_hit_target.h b/chrome/browser/vr/elements/invisible_hit_target.h
new file mode 100644
index 0000000..113da8a
--- /dev/null
+++ b/chrome/browser/vr/elements/invisible_hit_target.h
@@ -0,0 +1,28 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CHROME_BROWSER_VR_ELEMENTS_INVISIBLE_HIT_TARGET_H_
+#define CHROME_BROWSER_VR_ELEMENTS_INVISIBLE_HIT_TARGET_H_
+
+#include "base/macros.h"
+#include "chrome/browser/vr/elements/ui_element.h"
+
+namespace vr {
+
+// A hit target does not render, but may affect reticle positioning.
+class InvisibleHitTarget : public UiElement {
+ public:
+  InvisibleHitTarget();
+  ~InvisibleHitTarget() override;
+
+  void Render(UiElementRenderer* renderer,
+              const gfx::Transform& view_proj_matrix) const final;
+
+ private:
+  DISALLOW_COPY_AND_ASSIGN(InvisibleHitTarget);
+};
+
+}  // namespace vr
+
+#endif  // CHROME_BROWSER_VR_ELEMENTS_INVISIBLE_HIT_TARGET_H_
diff --git a/chrome/browser/vr/elements/vector_icon.cc b/chrome/browser/vr/elements/vector_icon.cc
index c603cdd..fc6dcd2 100644
--- a/chrome/browser/vr/elements/vector_icon.cc
+++ b/chrome/browser/vr/elements/vector_icon.cc
@@ -4,8 +4,9 @@
 
 #include "chrome/browser/vr/elements/vector_icon.h"
 
-#include "ui/gfx/canvas.h"
 #include "ui/gfx/paint_vector_icon.h"
+#include "ui/gfx/scoped_canvas.h"
+#include "ui/gfx/vector_icon_types.h"
 
 namespace vr {
 
@@ -14,11 +15,13 @@
                     float size_px,
                     const gfx::PointF& corner,
                     SkColor color) {
-  // TODO(cjgrant): Use CreateVectorIcon() when threading issues are resolved.
-  canvas->Save();
+  gfx::ScopedCanvas scoped(canvas);
   canvas->Translate({corner.x(), corner.y()});
-  PaintVectorIcon(canvas, icon, size_px, color);
-  canvas->Restore();
+
+  // Explicitly cut out the 1x version of the icon, as PaintVectorIcon draws the
+  // 1x version if device scale factor isn't set. See crbug.com/749146.
+  gfx::VectorIcon icon_no_1x{icon.path, nullptr};
+  PaintVectorIcon(canvas, icon_no_1x, size_px, color);
 }
 
 }  // namespace vr
diff --git a/chrome/browser/vr/test/ui_scene_manager_test.cc b/chrome/browser/vr/test/ui_scene_manager_test.cc
index 7ae3b0a..09576110 100644
--- a/chrome/browser/vr/test/ui_scene_manager_test.cc
+++ b/chrome/browser/vr/test/ui_scene_manager_test.cc
@@ -76,10 +76,9 @@
   for (auto name : names) {
     SCOPED_TRACE(name);
     auto* element = scene_->GetUiElementByName(name);
-    EXPECT_NE(nullptr, element);
-    if (element) {
-      EXPECT_TRUE(element->IsVisible() && IsElementFacingCamera(element));
-    }
+    ASSERT_NE(nullptr, element);
+    EXPECT_TRUE(element->IsVisible() && IsElementFacingCamera(element) &&
+                element->draw_phase() != kPhaseNone);
   }
 }
 
@@ -90,7 +89,7 @@
     SCOPED_TRACE(name);
     auto* element = scene_->GetUiElementByName(name);
     EXPECT_NE(nullptr, element);
-    if (element->IsVisible() != visible) {
+    if (!element || element->IsVisible() != visible) {
       return false;
     }
     if (!element || (visible && element->draw_phase() == kPhaseNone)) {
@@ -108,7 +107,7 @@
     SCOPED_TRACE(name);
     auto* element = scene_->GetUiElementByName(name);
     EXPECT_NE(nullptr, element);
-    if (element->requires_layout() != requires_layout) {
+    if (!element || element->requires_layout() != requires_layout) {
       return false;
     }
   }
@@ -157,13 +156,10 @@
   scene_->OnBeginFrame(base::TimeTicks(), gfx::Vector3dF(0.f, 0.f, -1.0f));
 }
 
-SkColor UiSceneManagerTest::GetBackgroundColor() const {
+void UiSceneManagerTest::GetBackgroundColor(SkColor* background_color) const {
   Rect* front =
       static_cast<Rect*>(scene_->GetUiElementByName(kBackgroundFront));
-  EXPECT_NE(nullptr, front);
-  if (!front)
-    return SK_ColorBLACK;
-
+  ASSERT_NE(nullptr, front);
   SkColor color = front->edge_color();
 
   // While returning background color, ensure that all background panel elements
@@ -171,14 +167,12 @@
   for (auto name : {kBackgroundFront, kBackgroundLeft, kBackgroundBack,
                     kBackgroundRight, kBackgroundTop, kBackgroundBottom}) {
     const Rect* panel = static_cast<Rect*>(scene_->GetUiElementByName(name));
-    EXPECT_NE(nullptr, panel);
-    if (!panel)
-      return SK_ColorBLACK;
+    ASSERT_NE(nullptr, panel);
     EXPECT_EQ(panel->center_color(), color);
     EXPECT_EQ(panel->edge_color(), color);
   }
 
-  return color;
+  *background_color = color;
 }
 
 }  // namespace vr
diff --git a/chrome/browser/vr/test/ui_scene_manager_test.h b/chrome/browser/vr/test/ui_scene_manager_test.h
index daa22917..4fe65f83 100644
--- a/chrome/browser/vr/test/ui_scene_manager_test.h
+++ b/chrome/browser/vr/test/ui_scene_manager_test.h
@@ -73,7 +73,7 @@
   // A wrapper to call scene_->OnBeginFrame.
   void OnBeginFrame();
 
-  SkColor GetBackgroundColor() const;
+  void GetBackgroundColor(SkColor* background_color) const;
 
   base::MessageLoop message_loop_;
   std::unique_ptr<MockBrowserInterface> browser_;
diff --git a/chrome/browser/vr/ui_scene_manager.cc b/chrome/browser/vr/ui_scene_manager.cc
index 4eef439..54670f54 100644
--- a/chrome/browser/vr/ui_scene_manager.cc
+++ b/chrome/browser/vr/ui_scene_manager.cc
@@ -16,6 +16,7 @@
 #include "chrome/browser/vr/elements/exit_prompt_backplane.h"
 #include "chrome/browser/vr/elements/full_screen_rect.h"
 #include "chrome/browser/vr/elements/grid.h"
+#include "chrome/browser/vr/elements/invisible_hit_target.h"
 #include "chrome/browser/vr/elements/linear_layout.h"
 #include "chrome/browser/vr/elements/loading_indicator.h"
 #include "chrome/browser/vr/elements/rect.h"
@@ -346,15 +347,15 @@
 void UiSceneManager::CreateContentQuad(ContentInputDelegate* delegate) {
   // Place an invisible but hittable plane behind the content quad, to keep the
   // reticle roughly planar with the content if near content.
-  std::unique_ptr<UiElement> hit_plane = base::MakeUnique<UiElement>();
+  auto hit_plane = base::MakeUnique<InvisibleHitTarget>();
   hit_plane->set_name(kBackplane);
+  hit_plane->set_draw_phase(kPhaseForeground);
   hit_plane->SetSize(kBackplaneSize, kBackplaneSize);
   hit_plane->SetTranslate(0, 0, -kTextureOffset);
   content_elements_.push_back(hit_plane.get());
   scene_->AddUiElement(k2dBrowsingContentGroup, std::move(hit_plane));
 
-  std::unique_ptr<ContentElement> main_content =
-      base::MakeUnique<ContentElement>(delegate);
+  auto main_content = base::MakeUnique<ContentElement>(delegate);
   main_content->set_name(kContentQuad);
   main_content->set_draw_phase(kPhaseForeground);
   main_content->SetSize(kContentWidth, kContentHeight);
@@ -606,6 +607,7 @@
   exit_prompt_backplane_ = backplane.get();
   element = std::move(backplane);
   element->set_name(kExitPromptBackplane);
+  element->set_draw_phase(kPhaseForeground);
   element->SetSize(kExitPromptBackplaneSize, kExitPromptBackplaneSize);
   element->SetTranslate(0.0, 0.0, -kTextureOffset);
   exit_prompt_backplane_ = element.get();
diff --git a/chrome/browser/vr/ui_scene_manager_unittest.cc b/chrome/browser/vr/ui_scene_manager_unittest.cc
index 8ee895d..7fdf9de 100644
--- a/chrome/browser/vr/ui_scene_manager_unittest.cc
+++ b/chrome/browser/vr/ui_scene_manager_unittest.cc
@@ -219,33 +219,42 @@
   MakeManager(kNotInCct, kNotInWebVr);
 
   // Hold onto the background color to make sure it changes.
-  SkColor initial_background = GetBackgroundColor();
+  SkColor initial_background = SK_ColorBLACK;
+  GetBackgroundColor(&initial_background);
   manager_->SetFullscreen(true);
 
   // Make sure background has changed for fullscreen.
-  EXPECT_NE(initial_background, GetBackgroundColor());
-
-  SkColor fullscreen_background = GetBackgroundColor();
+  SkColor fullscreen_background = SK_ColorBLACK;
+  GetBackgroundColor(&fullscreen_background);
+  EXPECT_NE(initial_background, fullscreen_background);
 
   manager_->SetIncognito(true);
 
   // Make sure background has changed for incognito.
-  EXPECT_NE(fullscreen_background, GetBackgroundColor());
-  EXPECT_NE(initial_background, GetBackgroundColor());
-
-  SkColor incognito_background = GetBackgroundColor();
+  SkColor incognito_background = SK_ColorBLACK;
+  GetBackgroundColor(&incognito_background);
+  EXPECT_NE(fullscreen_background, incognito_background);
+  EXPECT_NE(initial_background, incognito_background);
 
   manager_->SetIncognito(false);
-  EXPECT_EQ(fullscreen_background, GetBackgroundColor());
+  SkColor no_longer_incognito_background = SK_ColorBLACK;
+  GetBackgroundColor(&no_longer_incognito_background);
+  EXPECT_EQ(fullscreen_background, no_longer_incognito_background);
 
   manager_->SetFullscreen(false);
-  EXPECT_EQ(initial_background, GetBackgroundColor());
+  SkColor no_longer_fullscreen_background = SK_ColorBLACK;
+  GetBackgroundColor(&no_longer_fullscreen_background);
+  EXPECT_EQ(initial_background, no_longer_fullscreen_background);
 
   manager_->SetIncognito(true);
-  EXPECT_EQ(incognito_background, GetBackgroundColor());
+  SkColor incognito_again_background = SK_ColorBLACK;
+  GetBackgroundColor(&incognito_again_background);
+  EXPECT_EQ(incognito_background, incognito_again_background);
 
   manager_->SetIncognito(false);
-  EXPECT_EQ(initial_background, GetBackgroundColor());
+  SkColor no_longer_incognito_again_background = SK_ColorBLACK;
+  GetBackgroundColor(&no_longer_incognito_again_background);
+  EXPECT_EQ(initial_background, no_longer_incognito_again_background);
 }
 
 TEST_F(UiSceneManagerTest, WebVrAutopresentedInsecureOrigin) {
@@ -327,7 +336,8 @@
   MakeManager(kNotInCct, kNotInWebVr);
 
   // Hold onto the background color to make sure it changes.
-  SkColor initial_background = GetBackgroundColor();
+  SkColor initial_background = SK_ColorBLACK;
+  GetBackgroundColor(&initial_background);
   VerifyElementsVisible("Initial", kElementsVisibleInBrowsing);
   UiElement* content_quad = scene_->GetUiElementByName(kContentQuad);
   UiElement* content_group =
@@ -340,7 +350,9 @@
   manager_->SetFullscreen(true);
   VerifyElementsVisible("In fullscreen", visible_in_fullscreen);
   // Make sure background has changed for fullscreen.
-  EXPECT_NE(initial_background, GetBackgroundColor());
+  SkColor fullscreen_background = SK_ColorBLACK;
+  GetBackgroundColor(&fullscreen_background);
+  EXPECT_NE(initial_background, fullscreen_background);
   // Should have started transition.
   EXPECT_TRUE(IsAnimating(content_quad, {BOUNDS}));
   EXPECT_TRUE(IsAnimating(content_group, {TRANSFORM}));
@@ -354,7 +366,9 @@
   // Everything should return to original state after leaving fullscreen.
   manager_->SetFullscreen(false);
   VerifyElementsVisible("Restore initial", kElementsVisibleInBrowsing);
-  EXPECT_EQ(initial_background, GetBackgroundColor());
+  SkColor no_longer_fullscreen_background = SK_ColorBLACK;
+  GetBackgroundColor(&no_longer_fullscreen_background);
+  EXPECT_EQ(initial_background, no_longer_fullscreen_background);
   // Should have started transition.
   EXPECT_TRUE(IsAnimating(content_quad, {BOUNDS}));
   EXPECT_TRUE(IsAnimating(content_group, {TRANSFORM}));
diff --git a/chrome/browser/vr/web_contents_event_forwarder.cc b/chrome/browser/vr/web_contents_event_forwarder.cc
new file mode 100644
index 0000000..08db1a0
--- /dev/null
+++ b/chrome/browser/vr/web_contents_event_forwarder.cc
@@ -0,0 +1,43 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "chrome/browser/vr/web_contents_event_forwarder.h"
+
+#include "content/public/browser/render_widget_host.h"
+#include "content/public/browser/render_widget_host_view.h"
+#include "content/public/browser/web_contents.h"
+#include "third_party/WebKit/public/platform/WebGestureEvent.h"
+#include "third_party/WebKit/public/platform/WebMouseEvent.h"
+
+using blink::WebGestureEvent;
+using blink::WebMouseEvent;
+using blink::WebInputEvent;
+
+namespace vr {
+
+WebContentsEventForwarder::WebContentsEventForwarder(
+    content::WebContents* web_contents)
+    : web_contents_(web_contents) {}
+
+WebContentsEventForwarder::~WebContentsEventForwarder() = default;
+
+void WebContentsEventForwarder::ForwardEvent(
+    std::unique_ptr<WebInputEvent> event) {
+  if (!web_contents_->GetRenderWidgetHostView()) {
+    return;
+  }
+  content::RenderWidgetHost* rwh =
+      web_contents_->GetRenderWidgetHostView()->GetRenderWidgetHost();
+  if (!rwh) {
+    return;
+  }
+
+  if (WebInputEvent::IsMouseEventType(event->GetType())) {
+    rwh->ForwardMouseEvent(static_cast<const WebMouseEvent&>(*event));
+  } else if (WebInputEvent::IsGestureEventType(event->GetType())) {
+    rwh->ForwardGestureEvent(static_cast<const WebGestureEvent&>(*event));
+  }
+}
+
+}  // namespace vr
diff --git a/chrome/browser/vr/web_contents_event_forwarder.h b/chrome/browser/vr/web_contents_event_forwarder.h
new file mode 100644
index 0000000..3e03b67
--- /dev/null
+++ b/chrome/browser/vr/web_contents_event_forwarder.h
@@ -0,0 +1,39 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CHROME_BROWSER_VR_WEB_CONTENTS_EVENT_FORWARDER_H_
+#define CHROME_BROWSER_VR_WEB_CONTENTS_EVENT_FORWARDER_H_
+
+#include <memory>
+
+#include "base/macros.h"
+#include "base/memory/weak_ptr.h"
+#include "third_party/WebKit/public/platform/WebInputEvent.h"
+
+namespace content {
+class WebContents;
+}
+
+namespace vr {
+
+// Class used to forward events generated by events in VR down to
+// |web_contents_|.
+// Note: This class is not thread safe and must only be used from the main
+// thread.
+class WebContentsEventForwarder {
+ public:
+  explicit WebContentsEventForwarder(content::WebContents* web_contents);
+  ~WebContentsEventForwarder();
+
+  void ForwardEvent(std::unique_ptr<blink::WebInputEvent> event);
+
+ private:
+  content::WebContents* web_contents_;
+
+  DISALLOW_COPY_AND_ASSIGN(WebContentsEventForwarder);
+};
+
+}  // namespace vr
+
+#endif  // CHROME_BROWSER_VR_WEB_CONTENTS_EVENT_FORWARDER_H_
diff --git a/chrome/common/media_router/media_source_helper_unittest.cc b/chrome/common/media_router/media_source_helper_unittest.cc
index 44a61fa..8d004e6 100644
--- a/chrome/common/media_router/media_source_helper_unittest.cc
+++ b/chrome/common/media_router/media_source_helper_unittest.cc
@@ -10,7 +10,7 @@
 
 namespace media_router {
 
-constexpr char kPresentationUrl[] = "http://www.example.com/presentation.html";
+constexpr char kPresentationUrl[] = "https://www.example.com/presentation.html";
 
 TEST(MediaSourcesTest, IsMirroringMediaSource) {
   EXPECT_TRUE(IsTabMirroringMediaSource(MediaSourceForTab(123)));
@@ -35,8 +35,6 @@
   EXPECT_TRUE(IsValidMediaSource(MediaSourceForDesktop()));
   EXPECT_TRUE(IsValidMediaSource(
       MediaSourceForPresentationUrl(GURL(kPresentationUrl))));
-  EXPECT_TRUE(IsValidMediaSource(
-      MediaSourceForPresentationUrl(GURL(kPresentationUrl))));
 
   // Disallowed scheme
   EXPECT_FALSE(IsValidMediaSource(
diff --git a/chrome/test/base/testing_profile.cc b/chrome/test/base/testing_profile.cc
index f50f67d..998a550e 100644
--- a/chrome/test/base/testing_profile.cc
+++ b/chrome/test/base/testing_profile.cc
@@ -789,7 +789,7 @@
   SupervisedUserSettingsService* supervised_user_settings =
       SupervisedUserSettingsServiceFactory::GetForProfile(this);
   scoped_refptr<PrefStore> supervised_user_prefs =
-      make_scoped_refptr(new SupervisedUserPrefStore(supervised_user_settings));
+      base::MakeRefCounted<SupervisedUserPrefStore>(supervised_user_settings);
 
   factory.set_supervised_user_prefs(supervised_user_prefs);
 
diff --git a/chrome/test/data/webui/settings/appearance_page_test.js b/chrome/test/data/webui/settings/appearance_page_test.js
index 22029e8..9e1a7a2 100644
--- a/chrome/test/data/webui/settings/appearance_page_test.js
+++ b/chrome/test/data/webui/settings/appearance_page_test.js
@@ -9,8 +9,6 @@
       'getDefaultZoom',
       'getThemeInfo',
       'isSupervised',
-      'isWallpaperSettingVisible',
-      'isWallpaperPolicyControlled',
       'openWallpaperManager',
       'useDefaultTheme',
       'useSystemTheme',
@@ -25,12 +23,6 @@
 
     /** @private */
     this.isHomeUrlValid_ = true;
-
-    /** @private */
-    this.isWallpaperSettingVisible_ = true;
-
-    /** @private */
-    this.isWallpaperPolicyControlled_ = false;
   }
 
   /** @override */
@@ -52,18 +44,6 @@
   }
 
   /** @override */
-  isWallpaperSettingVisible() {
-    this.methodCalled('isWallpaperSettingVisible');
-    return Promise.resolve(this.isWallpaperSettingVisible_);
-  }
-
-  /** @override */
-  isWallpaperPolicyControlled() {
-    this.methodCalled('isWallpaperPolicyControlled');
-    return Promise.resolve(this.isWallpaperPolicyControlled_);
-  }
-
-  /** @override */
   openWallpaperManager() {
     this.methodCalled('openWallpaperManager');
   }
@@ -100,11 +80,6 @@
   setValidStartupPageResponse(isValid) {
     this.isHomeUrlValid_ = isValid;
   }
-
-  /** @param {boolean} Whether the wallpaper is policy controlled. */
-  setIsWallpaperPolicyControlled(isPolicyControlled) {
-    this.isWallpaperPolicyControlled_ = isPolicyControlled;
-  }
 }
 
 var appearancePage = null;
@@ -130,10 +105,6 @@
     },
   });
 
-  appearancePage.set('pageVisibility', {
-    setWallpaper: true,
-  });
-
   document.body.appendChild(appearancePage);
   Polymer.dom.flush();
 }
@@ -154,28 +125,6 @@
       MockInteractions.tap(button);
       return appearanceBrowserProxy.whenCalled('openWallpaperManager');
     });
-
-    test('wallpaperSettingVisible', function() {
-      appearancePage.set("pageVisibility.setWallpaper", false);
-      return appearanceBrowserProxy.whenCalled('isWallpaperSettingVisible')
-          .then(function() {
-            Polymer.dom.flush();
-            assertTrue(appearancePage.$$('#wallpaperButton').hidden);
-          });
-    });
-
-    test('wallpaperPolicyControlled', function() {
-      // Should show the wallpaper policy indicator and disable the toggle
-      // button if the wallpaper is policy controlled.
-      appearanceBrowserProxy.setIsWallpaperPolicyControlled(true);
-      createAppearancePage();
-      return appearanceBrowserProxy.whenCalled('isWallpaperPolicyControlled')
-          .then(function() {
-            Polymer.dom.flush();
-            assertFalse(appearancePage.$$('#wallpaperPolicyIndicator').hidden);
-            assertTrue(appearancePage.$$('#showWallpaperManager').disabled);
-          });
-    });
   } else {
     test('noWallpaperManager', function() {
       // The wallpaper button should not be present.
diff --git a/chrome/test/data/webui/settings/settings_main_test.js b/chrome/test/data/webui/settings/settings_main_test.js
index 8866264..02cd8592 100644
--- a/chrome/test/data/webui/settings/settings_main_test.js
+++ b/chrome/test/data/webui/settings/settings_main_test.js
@@ -67,7 +67,6 @@
       settingsMain = document.createElement('settings-main');
       settingsMain.prefs = settingsPrefs.prefs;
       settingsMain.toolbarSpinnerActive = false;
-      settingsMain.pageVisibility = settings.pageVisibility;
       document.body.appendChild(settingsMain);
     });
 
diff --git a/chrome/test/media_router/media_router_e2e_browsertest.cc b/chrome/test/media_router/media_router_e2e_browsertest.cc
index 89af106..a411147 100644
--- a/chrome/test/media_router/media_router_e2e_browsertest.cc
+++ b/chrome/test/media_router/media_router_e2e_browsertest.cc
@@ -30,15 +30,12 @@
 //   --enable-pixel-output-in-tests --run-manual
 //   --gtest_filter=MediaRouterE2EBrowserTest.<test case name>
 //   --enable-logging=stderr
-//   --whitelisted-extension-id=enhhojjnijigcajfphajepfemndkmdlo
 //   --ui-test-action-timeout=200000
-//   --media-router=1
 
 namespace {
 // URL to launch Castv2Player_Staging app on Chromecast
 const char kCastAppPresentationUrl[] =
-    "https://google.com/cast#__castAppId__=BE6E4473/"
-    "__castClientId__=143692175507258981";
+    "cast:BE6E4473?clientId=143692175507258981";
 const char kVideo[] = "video";
 const char kBearVP9Video[] = "bear-vp9.webm";
 const char kPlayer[] = "player.html";
diff --git a/chrome/test/media_router/resources/common.js b/chrome/test/media_router/resources/common.js
index 7942413..1381be4 100644
--- a/chrome/test/media_router/resources/common.js
+++ b/chrome/test/media_router/resources/common.js
@@ -14,9 +14,8 @@
 let params = (new URL(window.location.href)).searchParams;
 
 if (params.get('__is_android__') == 'true') {
-  // For android, "google.com/cast" is required in presentation URL.
-  // TODO(zqzhang): this requirement may be removed in the future.
-  presentationUrl = "https://google.com/cast#__castAppId__=CCCCCCCC/";
+  // Android only accepts Cast Presentation URLs for the time being.
+  presentationUrl = "cast:CCCCCCCC";
 } else if (params.get('__oneUA__') == 'true') {
   presentationUrl = "presentation_receiver.html";
 } else if (params.get('__oneUANoReceiver__') == 'true') {
diff --git a/chromeos/binder/transaction_data_reader.cc b/chromeos/binder/transaction_data_reader.cc
index 5788eee..b4c7344 100644
--- a/chromeos/binder/transaction_data_reader.cc
+++ b/chromeos/binder/transaction_data_reader.cc
@@ -120,7 +120,7 @@
   }
   switch (obj.type) {
     case BINDER_TYPE_HANDLE:
-      return make_scoped_refptr(new RemoteObject(command_broker, obj.handle));
+      return base::MakeRefCounted<RemoteObject>(command_broker, obj.handle);
     case BINDER_TYPE_BINDER:
       return make_scoped_refptr(reinterpret_cast<LocalObject*>(obj.cookie));
   }
diff --git a/chromeos/components/tether/ble_advertisement_synchronizer_unittest.cc b/chromeos/components/tether/ble_advertisement_synchronizer_unittest.cc
index b6535e4..93276883 100644
--- a/chromeos/components/tether/ble_advertisement_synchronizer_unittest.cc
+++ b/chromeos/components/tether/ble_advertisement_synchronizer_unittest.cc
@@ -128,9 +128,9 @@
 class BleAdvertisementSynchronizerTest : public testing::Test {
  protected:
   BleAdvertisementSynchronizerTest()
-      : fake_advertisement_(make_scoped_refptr(new FakeBluetoothAdvertisement(
+      : fake_advertisement_(base::MakeRefCounted<FakeBluetoothAdvertisement>(
             base::Bind(&BleAdvertisementSynchronizerTest::OnUnregisterCalled,
-                       base::Unretained(this))))) {}
+                       base::Unretained(this)))) {}
 
   void SetUp() override {
     num_register_success_ = 0;
diff --git a/chromeos/components/tether/ble_advertiser_unittest.cc b/chromeos/components/tether/ble_advertiser_unittest.cc
index cda1bf1..ce57bf1 100644
--- a/chromeos/components/tether/ble_advertiser_unittest.cc
+++ b/chromeos/components/tether/ble_advertiser_unittest.cc
@@ -125,7 +125,7 @@
 
   void SetUp() override {
     mock_adapter_ =
-        make_scoped_refptr(new StrictMock<device::MockBluetoothAdapter>());
+        base::MakeRefCounted<StrictMock<device::MockBluetoothAdapter>>();
 
     std::unique_ptr<cryptauth::MockForegroundEidGenerator> eid_generator =
         base::MakeUnique<cryptauth::MockForegroundEidGenerator>();
diff --git a/chromeos/components/tether/ble_connection_manager_unittest.cc b/chromeos/components/tether/ble_connection_manager_unittest.cc
index f063d66..de6fff2 100644
--- a/chromeos/components/tether/ble_connection_manager_unittest.cc
+++ b/chromeos/components/tether/ble_connection_manager_unittest.cc
@@ -289,7 +289,7 @@
     fake_cryptauth_service_ =
         base::MakeUnique<cryptauth::FakeCryptAuthService>();
     mock_adapter_ =
-        make_scoped_refptr(new NiceMock<device::MockBluetoothAdapter>());
+        base::MakeRefCounted<NiceMock<device::MockBluetoothAdapter>>();
 
     device_queue_ = base::MakeUnique<BleAdvertisementDeviceQueue>();
 
diff --git a/chromeos/components/tether/ble_scanner_unittest.cc b/chromeos/components/tether/ble_scanner_unittest.cc
index 88bffc82..0d56e20 100644
--- a/chromeos/components/tether/ble_scanner_unittest.cc
+++ b/chromeos/components/tether/ble_scanner_unittest.cc
@@ -85,23 +85,23 @@
 
 const size_t kMinNumBytesInServiceData = 4;
 
-const std::string kDefaultBluetoothAddress = "11:22:33:44:55:66";
+const char kDefaultBluetoothAddress[] = "11:22:33:44:55:66";
 
-const std::string fake_local_public_key = "fakeLocalPublicKey";
+const char fake_local_public_key[] = "fakeLocalPublicKey";
 
-const std::string current_eid_data = "currentEidData";
+const char current_eid_data[] = "currentEidData";
 const int64_t current_eid_start_ms = 1000L;
 const int64_t current_eid_end_ms = 2000L;
 
-const std::string adjacent_eid_data = "adjacentEidData";
+const char adjacent_eid_data[] = "adjacentEidData";
 const int64_t adjacent_eid_start_ms = 2000L;
 const int64_t adjacent_eid_end_ms = 3000L;
 
-const std::string fake_beacon_seed1_data = "fakeBeaconSeed1Data";
+const char fake_beacon_seed1_data[] = "fakeBeaconSeed1Data";
 const int64_t fake_beacon_seed1_start_ms = current_eid_start_ms;
 const int64_t fake_beacon_seed1_end_ms = current_eid_end_ms;
 
-const std::string fake_beacon_seed2_data = "fakeBeaconSeed2Data";
+const char fake_beacon_seed2_data[] = "fakeBeaconSeed2Data";
 const int64_t fake_beacon_seed2_start_ms = adjacent_eid_start_ms;
 const int64_t fake_beacon_seed2_end_ms = adjacent_eid_end_ms;
 
@@ -178,7 +178,7 @@
     last_discovery_error_callback_.Reset();
 
     mock_adapter_ =
-        make_scoped_refptr(new NiceMock<device::MockBluetoothAdapter>());
+        base::MakeRefCounted<NiceMock<device::MockBluetoothAdapter>>();
     ON_CALL(*mock_adapter_, StartDiscoverySession(_, _))
         .WillByDefault(
             Invoke(this, &BleScannerTest::SaveStartDiscoverySessionArgs));
diff --git a/chromeos/components/tether/initializer_impl_unittest.cc b/chromeos/components/tether/initializer_impl_unittest.cc
index a8045dca..5db593dc 100644
--- a/chromeos/components/tether/initializer_impl_unittest.cc
+++ b/chromeos/components/tether/initializer_impl_unittest.cc
@@ -202,7 +202,7 @@
       base::MakeUnique<TestNetworkConnectionHandler>();
 
   scoped_refptr<NiceMock<device::MockBluetoothAdapter>> mock_adapter =
-      make_scoped_refptr(new NiceMock<device::MockBluetoothAdapter>());
+      base::MakeRefCounted<NiceMock<device::MockBluetoothAdapter>>();
 
   // Call an instance method of the test instead of initializing and destroying
   // here because the friend relationship between Initializer and
diff --git a/chromeos/login/auth/extended_authenticator.cc b/chromeos/login/auth/extended_authenticator.cc
index cd5a3f2..31ce974e 100644
--- a/chromeos/login/auth/extended_authenticator.cc
+++ b/chromeos/login/auth/extended_authenticator.cc
@@ -11,13 +11,13 @@
 // static
 scoped_refptr<ExtendedAuthenticator> ExtendedAuthenticator::Create(
     NewAuthStatusConsumer* consumer) {
-  return make_scoped_refptr(new ExtendedAuthenticatorImpl(consumer));
+  return base::MakeRefCounted<ExtendedAuthenticatorImpl>(consumer);
 }
 
 // static
 scoped_refptr<ExtendedAuthenticator> ExtendedAuthenticator::Create(
       AuthStatusConsumer* consumer) {
-  return make_scoped_refptr(new ExtendedAuthenticatorImpl(consumer));
+  return base::MakeRefCounted<ExtendedAuthenticatorImpl>(consumer);
 }
 
 ExtendedAuthenticator::ExtendedAuthenticator() {
diff --git a/chromeos/network/host_resolver_impl_chromeos_unittest.cc b/chromeos/network/host_resolver_impl_chromeos_unittest.cc
index 9b200e7..2491481 100644
--- a/chromeos/network/host_resolver_impl_chromeos_unittest.cc
+++ b/chromeos/network/host_resolver_impl_chromeos_unittest.cc
@@ -8,10 +8,10 @@
 
 #include "base/location.h"
 #include "base/macros.h"
-#include "base/message_loop/message_loop.h"
 #include "base/run_loop.h"
 #include "base/single_thread_task_runner.h"
 #include "base/strings/stringprintf.h"
+#include "base/test/scoped_task_environment.h"
 #include "base/threading/thread_task_runner_handle.h"
 #include "chromeos/dbus/dbus_thread_manager.h"
 #include "chromeos/dbus/shill_device_client.h"
@@ -45,7 +45,9 @@
 
 class HostResolverImplChromeOSTest : public testing::Test {
  public:
-  HostResolverImplChromeOSTest() {}
+  HostResolverImplChromeOSTest()
+      : scoped_task_environment_(
+            base::test::ScopedTaskEnvironment::MainThreadType::IO) {}
 
   ~HostResolverImplChromeOSTest() override {}
 
@@ -63,8 +65,8 @@
     ASSERT_TRUE(default_device);
     SetDefaultIPConfigs(default_device->path());
 
-    // Create the host resolver from the IO message loop.
-    io_message_loop_.task_runner()->PostTask(
+    // Create the host resolver from the main thread loop.
+    scoped_task_environment_.GetMainThreadTaskRunner()->PostTask(
         FROM_HERE,
         base::Bind(&HostResolverImplChromeOSTest::InitializeHostResolver,
                    base::Unretained(this)));
@@ -78,9 +80,8 @@
   }
 
  protected:
-  // Run from main (UI) message loop, calls Resolve on IO message loop.
   int CallResolve(net::HostResolver::RequestInfo& info) {
-    io_message_loop_.task_runner()->PostTask(
+    scoped_task_environment_.GetMainThreadTaskRunner()->PostTask(
         FROM_HERE, base::Bind(&HostResolverImplChromeOSTest::Resolve,
                               base::Unretained(this), info));
     base::RunLoop().RunUntilIdle();
@@ -91,14 +92,14 @@
   int result_;
 
  private:
-  // Run from IO message loop.
+  // Run from the main thread loop.
   void InitializeHostResolver() {
     net::HostResolver::Options options;
     host_resolver_ = HostResolverImplChromeOS::CreateHostResolverForTest(
         base::ThreadTaskRunnerHandle::Get(), network_state_handler_.get());
   }
 
-  // Run from IO message loop.
+  // Run from the main thread loop.
   void Resolve(net::HostResolver::RequestInfo info) {
     result_ = host_resolver_->Resolve(info, net::DEFAULT_PRIORITY, &addresses_,
                                       base::Bind(&ResolveCompletionCallback),
@@ -135,9 +136,9 @@
         base::Bind(&DoNothingWithCallStatus));
   }
 
+  base::test::ScopedTaskEnvironment scoped_task_environment_;
   std::unique_ptr<NetworkStateHandler> network_state_handler_;
   std::unique_ptr<net::HostResolver> host_resolver_;
-  base::MessageLoop io_message_loop_;
   net::NetLogWithSource net_log_;
   std::unique_ptr<net::HostResolver::Request> request_;
 
diff --git a/components/arc/common/voice_interaction_framework.mojom b/components/arc/common/voice_interaction_framework.mojom
index aaa0a47..d1c3201 100644
--- a/components/arc/common/voice_interaction_framework.mojom
+++ b/components/arc/common/voice_interaction_framework.mojom
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 //
-// Next MinVersion: 11
+// Next MinVersion: 12
 
 module arc.mojom;
 
@@ -58,10 +58,12 @@
   Init@0(VoiceInteractionFrameworkHost host_ptr);
 
   // Starts the voice interaction session in container.
-  StartVoiceInteractionSession@1();
+  // |homescreen_is_active| is true if the session was invoked when homescreen is active.
+  StartVoiceInteractionSession@1([MinVersion=11] bool homescreen_is_active);
 
   // Starts or stops voice interaction session based on current state.
-  [MinVersion=9] ToggleVoiceInteractionSession@8();
+  // |homescreen_is_active| is true if the session was invoked when homescreen is active.
+  [MinVersion=9] ToggleVoiceInteractionSession@8([MinVersion=11] bool homescreen_is_active);
 
   // Starts the voice interaction session in container, with a screen region
   // selected.
diff --git a/components/arc/test/fake_voice_interaction_framework_instance.cc b/components/arc/test/fake_voice_interaction_framework_instance.cc
index 6d906325..0e075637 100644
--- a/components/arc/test/fake_voice_interaction_framework_instance.cc
+++ b/components/arc/test/fake_voice_interaction_framework_instance.cc
@@ -15,11 +15,13 @@
 void FakeVoiceInteractionFrameworkInstance::Init(
     mojom::VoiceInteractionFrameworkHostPtr host_ptr) {}
 
-void FakeVoiceInteractionFrameworkInstance::StartVoiceInteractionSession() {
+void FakeVoiceInteractionFrameworkInstance::StartVoiceInteractionSession(
+    bool homescreen_is_active) {
   start_session_count_++;
 }
 
-void FakeVoiceInteractionFrameworkInstance::ToggleVoiceInteractionSession() {
+void FakeVoiceInteractionFrameworkInstance::ToggleVoiceInteractionSession(
+    bool homescreen_is_active) {
   toggle_session_count_++;
 }
 
diff --git a/components/arc/test/fake_voice_interaction_framework_instance.h b/components/arc/test/fake_voice_interaction_framework_instance.h
index 249ec94..e18caff4 100644
--- a/components/arc/test/fake_voice_interaction_framework_instance.h
+++ b/components/arc/test/fake_voice_interaction_framework_instance.h
@@ -19,8 +19,8 @@
 
   // mojom::VoiceInteractionFrameworkInstance overrides:
   void Init(mojom::VoiceInteractionFrameworkHostPtr host_ptr) override;
-  void StartVoiceInteractionSession() override;
-  void ToggleVoiceInteractionSession() override;
+  void StartVoiceInteractionSession(bool homescreen_is_active) override;
+  void ToggleVoiceInteractionSession(bool homescreen_is_active) override;
   void StartVoiceInteractionSessionForRegion(const gfx::Rect& region) override;
   void SetMetalayerVisibility(bool visible) override;
   void SetVoiceInteractionEnabled(bool enable) override;
diff --git a/components/autofill/core/browser/autofill_test_utils.cc b/components/autofill/core/browser/autofill_test_utils.cc
index 303b143..e0543b1ea 100644
--- a/components/autofill/core/browser/autofill_test_utils.cc
+++ b/components/autofill/core/browser/autofill_test_utils.cc
@@ -79,7 +79,7 @@
   registry->RegisterInt64Pref(AccountFetcherService::kLastUpdatePref, 0);
 
   PrefServiceFactory factory;
-  factory.set_user_prefs(make_scoped_refptr(new TestingPrefStore()));
+  factory.set_user_prefs(base::MakeRefCounted<TestingPrefStore>());
   return factory.Create(registry);
 }
 
diff --git a/components/cryptauth/ble/bluetooth_low_energy_weave_client_connection_unittest.cc b/components/cryptauth/ble/bluetooth_low_energy_weave_client_connection_unittest.cc
index c8a00920..3429316 100644
--- a/components/cryptauth/ble/bluetooth_low_energy_weave_client_connection_unittest.cc
+++ b/components/cryptauth/ble/bluetooth_low_energy_weave_client_connection_unittest.cc
@@ -333,8 +333,8 @@
     generator_ = nullptr;
     receiver_ = nullptr;
 
-    adapter_ = make_scoped_refptr(new NiceMock<device::MockBluetoothAdapter>());
-    task_runner_ = make_scoped_refptr(new base::TestSimpleTaskRunner());
+    adapter_ = base::MakeRefCounted<NiceMock<device::MockBluetoothAdapter>>();
+    task_runner_ = base::MakeRefCounted<base::TestSimpleTaskRunner>();
 
     mock_bluetooth_device_ =
         base::MakeUnique<NiceMock<device::MockBluetoothDevice>>(
diff --git a/components/data_reduction_proxy/core/browser/data_reduction_proxy_io_data_unittest.cc b/components/data_reduction_proxy/core/browser/data_reduction_proxy_io_data_unittest.cc
index 4cb0966..58370dc2 100644
--- a/components/data_reduction_proxy/core/browser/data_reduction_proxy_io_data_unittest.cc
+++ b/components/data_reduction_proxy/core/browser/data_reduction_proxy_io_data_unittest.cc
@@ -8,11 +8,11 @@
 
 #include "base/memory/ptr_util.h"
 #include "base/memory/ref_counted.h"
-#include "base/message_loop/message_loop.h"
 #include "base/metrics/field_trial.h"
 #include "base/run_loop.h"
 #include "base/single_thread_task_runner.h"
 #include "base/strings/string_number_conversions.h"
+#include "base/test/scoped_task_environment.h"
 #include "base/time/time.h"
 #include "components/data_reduction_proxy/core/browser/data_reduction_proxy_prefs.h"
 #include "components/data_reduction_proxy/core/browser/data_reduction_proxy_request_options.h"
@@ -66,6 +66,10 @@
 
 class DataReductionProxyIODataTest : public testing::Test {
  public:
+  DataReductionProxyIODataTest()
+      : scoped_task_environment_(
+            base::test::ScopedTaskEnvironment::MainThreadType::IO) {}
+
   void SetUp() override {
     RegisterSimpleProfilePrefs(prefs_.registry());
   }
@@ -73,10 +77,6 @@
   void RequestCallback(int err) {
   }
 
-  scoped_refptr<base::SingleThreadTaskRunner> task_runner() {
-    return loop_.task_runner();
-  }
-
   net::TestDelegate* delegate() {
     return &delegate_;
   }
@@ -93,8 +93,10 @@
     return &prefs_;
   }
 
+ protected:
+  base::test::ScopedTaskEnvironment scoped_task_environment_;
+
  private:
-  base::MessageLoopForIO loop_;
   net::TestDelegate delegate_;
   net::TestURLRequestContext context_;
   net::NetLog net_log_;
@@ -103,10 +105,12 @@
 
 TEST_F(DataReductionProxyIODataTest, TestConstruction) {
   std::unique_ptr<DataReductionProxyIOData> io_data(
-      new DataReductionProxyIOData(Client::UNKNOWN, net_log(), task_runner(),
-                                   task_runner(), false /* enabled */,
-                                   std::string() /* user_agent */,
-                                   std::string() /* channel */));
+      new DataReductionProxyIOData(
+          Client::UNKNOWN, net_log(),
+          scoped_task_environment_.GetMainThreadTaskRunner(),
+          scoped_task_environment_.GetMainThreadTaskRunner(),
+          false /* enabled */, std::string() /* user_agent */,
+          std::string() /* channel */));
 
   // Check that the SimpleURLRequestContextGetter uses vanilla HTTP.
   net::URLRequestContext* request_context =
diff --git a/components/download/content/internal/download_driver_impl.cc b/components/download/content/internal/download_driver_impl.cc
index d54c4cd9..db06cab9 100644
--- a/components/download/content/internal/download_driver_impl.cc
+++ b/components/download/content/internal/download_driver_impl.cc
@@ -15,6 +15,7 @@
 #include "content/public/browser/download_url_parameters.h"
 #include "content/public/browser/storage_partition.h"
 #include "net/http/http_response_headers.h"
+#include "net/http/http_status_code.h"
 
 namespace download {
 
@@ -83,7 +84,13 @@
           : item->GetFullPath();
   entry.completion_time = item->GetEndTime();
   entry.response_headers = item->GetResponseHeaders();
-  entry.url_chain = item->GetUrlChain();
+  if (entry.response_headers.get()) {
+    entry.can_resume =
+        entry.response_headers->HasHeaderValue("Accept-Ranges", "bytes") ||
+        (entry.response_headers->HasHeader("Content-Range") &&
+         entry.response_headers->response_code() == net::HTTP_PARTIAL_CONTENT);
+    entry.can_resume &= entry.response_headers->HasStrongValidators();
+  }
   return entry;
 }
 
diff --git a/components/download/internal/config.cc b/components/download/internal/config.cc
index 9e667bac..60c3ac9 100644
--- a/components/download/internal/config.cc
+++ b/components/download/internal/config.cc
@@ -53,6 +53,14 @@
 const base::TimeDelta kDefaultNetworkChangeDelay =
     base::TimeDelta::FromSeconds(5);
 
+// The default delay to notify the observer after a navigation completes.
+const base::TimeDelta kDefaultNavigationCompletionDelay =
+    base::TimeDelta::FromSeconds(30);
+
+// The default timeout for a navigation.
+const base::TimeDelta kDefaultNavigationTimeoutDelay =
+    base::TimeDelta::FromSeconds(300);
+
 // The default value of download retry delay when the download is failed.
 const base::TimeDelta kDefaultDownloadRetryDelay =
     base::TimeDelta::FromSeconds(20);
@@ -102,6 +110,14 @@
       base::TimeDelta::FromMilliseconds(base::saturated_cast<int>(
           GetFinchConfigUInt(kNetworkChangeDelayMsConfig,
                              kDefaultNetworkChangeDelay.InMilliseconds())));
+  config->navigation_completion_delay =
+      base::TimeDelta::FromSeconds(base::saturated_cast<int>(
+          GetFinchConfigUInt(kNavigationCompletionDelaySecondsConfig,
+                             kDefaultNavigationCompletionDelay.InSeconds())));
+  config->navigation_timeout_delay =
+      base::TimeDelta::FromSeconds(base::saturated_cast<int>(
+          GetFinchConfigUInt(kNavigationTimeoutDelaySecondsConfig,
+                             kDefaultNavigationTimeoutDelay.InSeconds())));
   config->download_retry_delay =
       base::TimeDelta::FromMilliseconds(base::saturated_cast<int>(
           GetFinchConfigUInt(kDownloadRetryDelayMsConfig,
@@ -120,6 +136,8 @@
       window_start_time(kDefaultWindowStartTime),
       window_end_time(kDefaultWindowEndTime),
       network_change_delay(kDefaultNetworkChangeDelay),
+      navigation_completion_delay(kDefaultNavigationCompletionDelay),
+      navigation_timeout_delay(kDefaultNavigationTimeoutDelay),
       download_retry_delay(kDefaultDownloadRetryDelay) {}
 
 }  // namespace download
diff --git a/components/download/internal/config.h b/components/download/internal/config.h
index 9b31a9c..f7f6b6e3 100644
--- a/components/download/internal/config.h
+++ b/components/download/internal/config.h
@@ -45,6 +45,17 @@
 // milliseconds.
 constexpr char kNetworkChangeDelayMsConfig[] = "network_change_delay_ms";
 
+// Configuration name for the download resumption delay after a navigation
+// completes, measured in seconds.
+constexpr char kNavigationCompletionDelaySecondsConfig[] =
+    "navigation_completion_delay_seconds";
+
+// Configuration name for the timeout value from the start of a navigation after
+// which if still no response, download service will resume. Measured in
+// seconds.
+constexpr char kNavigationTimeoutDelaySecondsConfig[] =
+    "navigation_timeout_delay_seconds";
+
 // Configuration name for the retry delay when the download is failed, measured
 // in milliseconds.
 constexpr char kDownloadRetryDelayMsConfig[] = "retry_delay_ms";
@@ -97,6 +108,12 @@
   // The delay to notify network status changes.
   base::TimeDelta network_change_delay;
 
+  // The delay to notify about the navigation completion.
+  base::TimeDelta navigation_completion_delay;
+
+  // The timeout to wait for after a navigation starts.
+  base::TimeDelta navigation_timeout_delay;
+
   // The delay to retry a download when the download is failed.
   base::TimeDelta download_retry_delay;
 
diff --git a/components/download/internal/controller_impl.cc b/components/download/internal/controller_impl.cc
index eb4ae1f..38e1c0d0 100644
--- a/components/download/internal/controller_impl.cc
+++ b/components/download/internal/controller_impl.cc
@@ -90,6 +90,7 @@
       driver_(std::move(driver)),
       model_(std::move(model)),
       device_status_listener_(std::move(device_status_listener)),
+      navigation_monitor_(navigation_monitor),
       scheduler_(std::move(scheduler)),
       task_scheduler_(std::move(task_scheduler)),
       file_monitor_(std::move(file_monitor)),
@@ -108,6 +109,9 @@
   model_->Initialize(this);
   file_monitor_->Initialize(base::Bind(&ControllerImpl::OnFileMonitorReady,
                                        weak_ptr_factory_.GetWeakPtr()));
+  navigation_monitor_->Configure(config_->navigation_completion_delay,
+                                 config_->navigation_timeout_delay);
+  navigation_monitor_->SetObserver(this);
 }
 
 Controller::State ControllerImpl::GetState() {
@@ -784,6 +788,10 @@
 
   base::Optional<DriverEntry> driver_entry = driver_->Find(entry->guid);
 
+  bool currently_in_progress =
+      driver_entry.has_value() &&
+      driver_entry->state == DriverEntry::State::IN_PROGRESS;
+
   bool meets_device_criteria = device_status_listener_->CurrentDeviceStatus()
                                    .MeetsCondition(entry->scheduling_params)
                                    .MeetsRequirements();
@@ -791,8 +799,14 @@
       !externally_active_downloads_.empty() &&
       entry->scheduling_params.priority != SchedulingParams::Priority::UI;
   bool entry_paused = entry->state == Entry::State::PAUSED;
+  bool should_block_on_navigation = ShouldBlockDownloadOnNavigation(entry);
 
-  bool pause_driver = entry_paused || force_pause || !meets_device_criteria;
+  bool pause_driver = entry_paused || force_pause || !meets_device_criteria ||
+                      should_block_on_navigation;
+  if (currently_in_progress && pause_driver) {
+    stats::LogDownloadPauseReason(!meets_device_criteria, entry_paused,
+                                  should_block_on_navigation, force_pause);
+  }
 
   if (pause_driver) {
     if (driver_entry.has_value())
@@ -1021,6 +1035,28 @@
   scheduler_->Reschedule(scheduling_candidates);
 }
 
+void ControllerImpl::OnNavigationEvent() {
+  if (controller_state_ != State::READY)
+    return;
+
+  UpdateDriverStates();
+}
+
+bool ControllerImpl::ShouldBlockDownloadOnNavigation(Entry* entry) {
+  if (!navigation_monitor_->IsNavigationInProgress())
+    return false;
+
+  bool pausable_priority =
+      entry->scheduling_params.priority <= SchedulingParams::Priority::NORMAL;
+
+  base::Optional<DriverEntry> driver_entry = driver_->Find(entry->guid);
+  bool new_download = !driver_entry.has_value();
+  bool resumable_download =
+      driver_entry.has_value() && driver_entry->can_resume;
+
+  return pausable_priority && (new_download || resumable_download);
+}
+
 void ControllerImpl::HandleExternalDownload(const std::string& guid,
                                             bool active) {
   if (active) {
diff --git a/components/download/internal/controller_impl.h b/components/download/internal/controller_impl.h
index 4462a9a..1d4c1d5 100644
--- a/components/download/internal/controller_impl.h
+++ b/components/download/internal/controller_impl.h
@@ -22,6 +22,7 @@
 #include "components/download/internal/stats.h"
 #include "components/download/public/client.h"
 #include "components/download/public/download_params.h"
+#include "components/download/public/navigation_monitor.h"
 #include "components/download/public/task_scheduler.h"
 
 namespace download {
@@ -42,7 +43,8 @@
 class ControllerImpl : public Controller,
                        public DownloadDriver::Client,
                        public Model::Client,
-                       public DeviceStatusListener::Observer {
+                       public DeviceStatusListener::Observer,
+                       public NavigationMonitor::Observer {
  public:
   // |config| is externally owned and must be guaranteed to outlive this class.
   ControllerImpl(Configuration* config,
@@ -104,6 +106,9 @@
   // DeviceStatusListener::Observer implementation.
   void OnDeviceStatusChanged(const DeviceStatus& device_status) override;
 
+  // NavigationMonitor::Observer implementation.
+  void OnNavigationEvent() override;
+
   // Checks if initialization is complete and successful.  If so, completes the
   // internal state initialization.
   void AttemptToFinalizeSetup();
@@ -172,6 +177,10 @@
   // reached maximum.
   void ActivateMoreDownloads();
 
+  // Whether the download should be paused or postponed in case of an active
+  // navigation is in progress.
+  bool ShouldBlockDownloadOnNavigation(Entry* entry);
+
   void RemoveCleanupEligibleDownloads();
 
   void HandleExternalDownload(const std::string& guid, bool active);
@@ -213,6 +222,7 @@
   std::unique_ptr<DownloadDriver> driver_;
   std::unique_ptr<Model> model_;
   std::unique_ptr<DeviceStatusListener> device_status_listener_;
+  NavigationMonitor* navigation_monitor_;
   std::unique_ptr<Scheduler> scheduler_;
   std::unique_ptr<TaskScheduler> task_scheduler_;
   std::unique_ptr<FileMonitor> file_monitor_;
diff --git a/components/download/internal/driver_entry.cc b/components/download/internal/driver_entry.cc
index 88ab03df2..5eee41fc 100644
--- a/components/download/internal/driver_entry.cc
+++ b/components/download/internal/driver_entry.cc
@@ -11,6 +11,7 @@
 DriverEntry::DriverEntry()
     : state(State::UNKNOWN),
       paused(false),
+      can_resume(true),
       bytes_downloaded(0u),
       expected_total_size(0u) {}
 
diff --git a/components/download/internal/driver_entry.h b/components/download/internal/driver_entry.h
index c7b4163..fa28b152 100644
--- a/components/download/internal/driver_entry.h
+++ b/components/download/internal/driver_entry.h
@@ -48,6 +48,11 @@
   // If the download is paused.
   bool paused;
 
+  // Whether the download is resumable. Determined by whether "Accept-Ranges" or
+  // "Content-Range" is present in the response headers and if it has strong
+  // validators. If false, the download may not be resumable.
+  bool can_resume;
+
   // The number of bytes downloaded.
   uint64_t bytes_downloaded;
 
diff --git a/components/download/internal/navigation_monitor_impl.cc b/components/download/internal/navigation_monitor_impl.cc
index 9b8df1a..ade71664 100644
--- a/components/download/internal/navigation_monitor_impl.cc
+++ b/components/download/internal/navigation_monitor_impl.cc
@@ -4,14 +4,30 @@
 
 #include "components/download/internal/navigation_monitor_impl.h"
 
-#include "base/logging.h"
+#include "base/bind.h"
+#include "base/callback_helpers.h"
+#include "base/threading/thread_task_runner_handle.h"
 
 namespace download {
 
-NavigationMonitorImpl::NavigationMonitorImpl() = default;
+NavigationMonitorImpl::NavigationMonitorImpl()
+    : observer_(nullptr),
+      current_navigation_count_(0),
+      weak_ptr_factory_(this) {}
 
 NavigationMonitorImpl::~NavigationMonitorImpl() = default;
 
+void NavigationMonitorImpl::Configure(
+    base::TimeDelta navigation_completion_delay,
+    base::TimeDelta navigation_timeout_delay) {
+  navigation_completion_delay_ = navigation_completion_delay;
+  navigation_timeout_delay_ = navigation_timeout_delay;
+}
+
+bool NavigationMonitorImpl::IsNavigationInProgress() const {
+  return current_navigation_count_ > 0;
+}
+
 void NavigationMonitorImpl::SetObserver(NavigationMonitor::Observer* observer) {
   observer_ = observer;
   if (observer_)
@@ -19,9 +35,52 @@
 }
 
 void NavigationMonitorImpl::OnNavigationEvent(NavigationEvent event) {
-  // TODO(xingliu, shakti): Count navigation events and notify observer.
+  if (event == NavigationEvent::START_NAVIGATION) {
+    current_navigation_count_++;
+    if (observer_)
+      observer_->OnNavigationEvent();
+
+    navigation_finished_callback_.Cancel();
+    ScheduleBackupTask();
+  } else {
+    if (current_navigation_count_ == 0) {
+      // Somehow we didn't record the beginning of the navigation. No need to
+      // take any action.
+      backup_navigation_finished_callback_.Cancel();
+      navigation_finished_callback_.Cancel();
+      return;
+    }
+
+    current_navigation_count_--;
+    if (current_navigation_count_ == 0)
+      NotifyNavigationFinished();
+  }
+}
+
+void NavigationMonitorImpl::NotifyNavigationFinished() {
+  backup_navigation_finished_callback_.Cancel();
+  navigation_finished_callback_.Reset(
+      base::Bind(&NavigationMonitorImpl::OnNavigationFinished,
+                 weak_ptr_factory_.GetWeakPtr()));
+  base::ThreadTaskRunnerHandle::Get()->PostDelayedTask(
+      FROM_HERE, navigation_finished_callback_.callback(),
+      navigation_completion_delay_);
+}
+
+void NavigationMonitorImpl::OnNavigationFinished() {
+  // Reset the counter to handle timeout.
+  current_navigation_count_ = 0;
   if (observer_)
     observer_->OnNavigationEvent();
 }
 
+void NavigationMonitorImpl::ScheduleBackupTask() {
+  backup_navigation_finished_callback_.Reset(
+      base::Bind(&NavigationMonitorImpl::OnNavigationFinished,
+                 weak_ptr_factory_.GetWeakPtr()));
+  base::ThreadTaskRunnerHandle::Get()->PostDelayedTask(
+      FROM_HERE, backup_navigation_finished_callback_.callback(),
+      navigation_timeout_delay_);
+}
+
 }  // namespace download
diff --git a/components/download/internal/navigation_monitor_impl.h b/components/download/internal/navigation_monitor_impl.h
index 6ab69bb..a70f1bef 100644
--- a/components/download/internal/navigation_monitor_impl.h
+++ b/components/download/internal/navigation_monitor_impl.h
@@ -5,7 +5,9 @@
 #ifndef COMPONENTS_DOWNLOAD_INTERNAL_NAVIGATION_MONITOR_IMPL_H_
 #define COMPONENTS_DOWNLOAD_INTERNAL_NAVIGATION_MONITOR_IMPL_H_
 
+#include "base/cancelable_callback.h"
 #include "base/macros.h"
+#include "base/memory/weak_ptr.h"
 #include "components/download/public/navigation_monitor.h"
 
 namespace download {
@@ -18,9 +20,27 @@
   // NavigationMonitor implementation.
   void SetObserver(NavigationMonitor::Observer* observer) override;
   void OnNavigationEvent(NavigationEvent event) override;
+  bool IsNavigationInProgress() const override;
+  void Configure(base::TimeDelta navigation_completion_delay,
+                 base::TimeDelta navigation_timeout_delay) override;
 
  private:
-  NavigationMonitor::Observer* observer_ = nullptr;
+  void NotifyNavigationFinished();
+  void ScheduleBackupTask();
+  void OnNavigationFinished();
+
+  NavigationMonitor::Observer* observer_;
+
+  int current_navigation_count_;
+
+  base::CancelableClosure navigation_finished_callback_;
+
+  base::CancelableClosure backup_navigation_finished_callback_;
+
+  base::TimeDelta navigation_completion_delay_;
+  base::TimeDelta navigation_timeout_delay_;
+
+  base::WeakPtrFactory<NavigationMonitorImpl> weak_ptr_factory_;
 
   DISALLOW_COPY_AND_ASSIGN(NavigationMonitorImpl);
 };
diff --git a/components/download/internal/navigation_monitor_impl_unittests.cc b/components/download/internal/navigation_monitor_impl_unittests.cc
index ad129ddb..d0c7e897 100644
--- a/components/download/internal/navigation_monitor_impl_unittests.cc
+++ b/components/download/internal/navigation_monitor_impl_unittests.cc
@@ -4,28 +4,68 @@
 
 #include "components/download/internal/navigation_monitor_impl.h"
 
+#include "base/bind.h"
+#include "base/callback_helpers.h"
 #include "base/memory/ptr_util.h"
+#include "base/memory/weak_ptr.h"
+#include "base/test/test_mock_time_task_runner.h"
+#include "base/threading/thread_task_runner_handle.h"
 #include "testing/gmock/include/gmock/gmock.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
 namespace download {
 namespace {
 
-class MockNavigationMonitorObserver : public NavigationMonitor::Observer {
+class TestNavigationMonitorObserver : public NavigationMonitor::Observer {
  public:
-  MockNavigationMonitorObserver() = default;
-  ~MockNavigationMonitorObserver() override = default;
-  MOCK_METHOD0(OnNavigationEvent, void());
+  TestNavigationMonitorObserver(
+      scoped_refptr<base::TestMockTimeTaskRunner> task_runner,
+      NavigationMonitor* monitor)
+      : task_runner_(task_runner),
+        monitor_(monitor),
+        navigation_in_progress_(false),
+        weak_ptr_factory_(this) {}
+  ~TestNavigationMonitorObserver() override = default;
+
+  void OnNavigationEvent() override {
+    navigation_in_progress_ = monitor_->IsNavigationInProgress();
+  }
+
+  void VerifyNavigationState(bool expected) {
+    EXPECT_EQ(expected, navigation_in_progress_);
+  }
+
+  void VerifyNavigationStateAt(bool expected, int millis) {
+    task_runner_->PostDelayedTask(
+        FROM_HERE,
+        base::Bind(&TestNavigationMonitorObserver::VerifyNavigationState,
+                   weak_ptr_factory_.GetWeakPtr(), expected),
+        base::TimeDelta::FromMilliseconds(millis));
+  }
+
+ private:
+  scoped_refptr<base::TestMockTimeTaskRunner> task_runner_;
+  NavigationMonitor* monitor_;
+  bool navigation_in_progress_;
+  base::WeakPtrFactory<TestNavigationMonitorObserver> weak_ptr_factory_;
+
+  DISALLOW_COPY_AND_ASSIGN(TestNavigationMonitorObserver);
 };
 
 class NavigationMonitorImplTest : public testing::Test {
  public:
-  NavigationMonitorImplTest() = default;
+  NavigationMonitorImplTest()
+      : task_runner_(new base::TestMockTimeTaskRunner),
+        handle_(task_runner_),
+        weak_ptr_factory_(this) {}
   ~NavigationMonitorImplTest() override = default;
 
   void SetUp() override {
     navigation_monitor_ = base::MakeUnique<NavigationMonitorImpl>();
-    observer_ = base::MakeUnique<MockNavigationMonitorObserver>();
+    observer_ = base::MakeUnique<TestNavigationMonitorObserver>(
+        task_runner_, navigation_monitor_.get());
+    navigation_monitor_->Configure(base::TimeDelta::FromMilliseconds(20),
+                                   base::TimeDelta::FromMilliseconds(200));
   }
 
   void TearDown() override {
@@ -33,21 +73,105 @@
     observer_.reset();
   }
 
+  void WaitUntilDone() { task_runner_->FastForwardUntilNoTasksRemain(); }
+
+  void SendNavigationEvent(NavigationEvent event) {
+    navigation_monitor_->OnNavigationEvent(event);
+  }
+
+  void SendNavigationEventAt(NavigationEvent event, int millis) {
+    task_runner_->PostDelayedTask(
+        FROM_HERE,
+        base::Bind(&NavigationMonitorImplTest::SendNavigationEvent,
+                   weak_ptr_factory_.GetWeakPtr(), event),
+        base::TimeDelta::FromMilliseconds(millis));
+  }
+
  protected:
+  scoped_refptr<base::TestMockTimeTaskRunner> task_runner_;
+  base::ThreadTaskRunnerHandle handle_;
   std::unique_ptr<NavigationMonitorImpl> navigation_monitor_;
-  std::unique_ptr<MockNavigationMonitorObserver> observer_;
+  std::unique_ptr<TestNavigationMonitorObserver> observer_;
+  base::WeakPtrFactory<NavigationMonitorImplTest> weak_ptr_factory_;
 
  private:
   DISALLOW_COPY_AND_ASSIGN(NavigationMonitorImplTest);
 };
 
-// Ensures the navigation events are piped to the observer.
-TEST_F(NavigationMonitorImplTest, NavigationEventPipe) {
-  EXPECT_CALL(*observer_.get(), OnNavigationEvent())
-      .Times(1)
-      .RetiresOnSaturation();
+TEST_F(NavigationMonitorImplTest, NavigationTimeout) {
   navigation_monitor_->SetObserver(observer_.get());
-  // TODO(xingliu, shakti): Test navigation event counting and observer calls.
+  SendNavigationEventAt(NavigationEvent::START_NAVIGATION, 5);
+
+  observer_->VerifyNavigationStateAt(false, 0);
+  observer_->VerifyNavigationStateAt(true, 10);
+  observer_->VerifyNavigationStateAt(true, 50);
+  observer_->VerifyNavigationStateAt(true, 190);
+  observer_->VerifyNavigationStateAt(false, 210);
+  observer_->VerifyNavigationStateAt(false, 300);
+  WaitUntilDone();
+}
+
+TEST_F(NavigationMonitorImplTest, UnexpectedNavigationEndCalls) {
+  navigation_monitor_->SetObserver(observer_.get());
+  SendNavigationEventAt(NavigationEvent::NAVIGATION_COMPLETE, 5);
+  SendNavigationEventAt(NavigationEvent::NAVIGATION_COMPLETE, 10);
+
+  observer_->VerifyNavigationStateAt(false, 0);
+  observer_->VerifyNavigationStateAt(false, 7);
+  observer_->VerifyNavigationStateAt(false, 15);
+  observer_->VerifyNavigationStateAt(false, 50);
+  observer_->VerifyNavigationStateAt(false, 300);
+  WaitUntilDone();
+}
+
+TEST_F(NavigationMonitorImplTest, OverlappingNavigations) {
+  navigation_monitor_->SetObserver(observer_.get());
+  SendNavigationEventAt(NavigationEvent::START_NAVIGATION, 5);
+  SendNavigationEventAt(NavigationEvent::START_NAVIGATION, 27);
+  SendNavigationEventAt(NavigationEvent::NAVIGATION_COMPLETE, 50);
+  SendNavigationEventAt(NavigationEvent::NAVIGATION_COMPLETE, 55);
+
+  observer_->VerifyNavigationStateAt(false, 0);
+  observer_->VerifyNavigationStateAt(true, 20);
+  observer_->VerifyNavigationStateAt(true, 40);
+  observer_->VerifyNavigationStateAt(true, 60);
+  observer_->VerifyNavigationStateAt(false, 80);
+  observer_->VerifyNavigationStateAt(false, 300);
+  WaitUntilDone();
+}
+
+TEST_F(NavigationMonitorImplTest, TwoNavigationsShortlyOneAfterAnother) {
+  navigation_monitor_->SetObserver(observer_.get());
+  SendNavigationEventAt(NavigationEvent::START_NAVIGATION, 5);
+  SendNavigationEventAt(NavigationEvent::NAVIGATION_COMPLETE, 10);
+  SendNavigationEventAt(NavigationEvent::START_NAVIGATION, 27);
+  SendNavigationEventAt(NavigationEvent::NAVIGATION_COMPLETE, 50);
+
+  observer_->VerifyNavigationStateAt(false, 0);
+  observer_->VerifyNavigationStateAt(true, 7);
+  observer_->VerifyNavigationStateAt(true, 20);
+  observer_->VerifyNavigationStateAt(true, 40);
+  observer_->VerifyNavigationStateAt(true, 60);
+  observer_->VerifyNavigationStateAt(false, 80);
+  observer_->VerifyNavigationStateAt(false, 300);
+  WaitUntilDone();
+}
+
+TEST_F(NavigationMonitorImplTest, NavigationSpacedApartLongTime) {
+  navigation_monitor_->SetObserver(observer_.get());
+  SendNavigationEventAt(NavigationEvent::START_NAVIGATION, 5);
+  SendNavigationEventAt(NavigationEvent::NAVIGATION_COMPLETE, 10);
+  SendNavigationEventAt(NavigationEvent::START_NAVIGATION, 60);
+  SendNavigationEventAt(NavigationEvent::NAVIGATION_COMPLETE, 70);
+
+  observer_->VerifyNavigationStateAt(false, 0);
+  observer_->VerifyNavigationStateAt(true, 7);
+  observer_->VerifyNavigationStateAt(true, 15);
+  observer_->VerifyNavigationStateAt(false, 40);
+  observer_->VerifyNavigationStateAt(true, 65);
+  observer_->VerifyNavigationStateAt(true, 80);
+  observer_->VerifyNavigationStateAt(false, 100);
+  WaitUntilDone();
 }
 
 }  // namespace
diff --git a/components/download/internal/stats.cc b/components/download/internal/stats.cc
index e58349d..f6db72a 100644
--- a/components/download/internal/stats.cc
+++ b/components/download/internal/stats.cc
@@ -20,6 +20,27 @@
 // bucket.
 const int64_t kMaxFileSizeKB = 4 * 1024 * 1024; /* 4GB */
 
+// Enum used by UMA metrics to track various reasons of pausing a download.
+enum class PauseReason {
+  // The download was paused. The reason can be anything.
+  ANY = 0,
+
+  // The download was paused due to unsatisfied device criteria.
+  UNMET_DEVICE_CRITERIA = 1,
+
+  // The download was paused by client.
+  PAUSE_BY_CLIENT = 2,
+
+  // The download was paused due to external download.
+  EXTERNAL_DOWNLOAD = 3,
+
+  // The download was paused due to navigation.
+  EXTERNAL_NAVIGATION = 4,
+
+  // The count of entries for the enum.
+  COUNT = 5,
+};
+
 // Converts DownloadTaskType to histogram suffix.
 // Should maps to suffix string in histograms.xml.
 std::string TaskTypeToHistogramSuffix(DownloadTaskType task_type) {
@@ -135,6 +156,12 @@
   base::UmaHistogramCustomCounts(name, record_count, 1, 500, 50);
 }
 
+// Helper method to log the pause reason for a particular download.
+void LogDownloadPauseReason(PauseReason reason) {
+  UMA_HISTOGRAM_ENUMERATION("Download.Service.PauseReason", reason,
+                            PauseReason::COUNT);
+}
+
 }  // namespace
 
 void LogControllerStartupStatus(bool in_recovery, const StartupStatus& status) {
@@ -225,6 +252,25 @@
   base::UmaHistogramCustomCounts(name, file_size_kb, 1, kMaxFileSizeKB, 50);
 }
 
+void LogDownloadPauseReason(bool unmet_device_criteria,
+                            bool pause_by_client,
+                            bool external_navigation,
+                            bool external_download) {
+  LogDownloadPauseReason(PauseReason::ANY);
+
+  if (unmet_device_criteria)
+    LogDownloadPauseReason(PauseReason::UNMET_DEVICE_CRITERIA);
+
+  if (pause_by_client)
+    LogDownloadPauseReason(PauseReason::PAUSE_BY_CLIENT);
+
+  if (external_navigation)
+    LogDownloadPauseReason(PauseReason::EXTERNAL_NAVIGATION);
+
+  if (external_download)
+    LogDownloadPauseReason(PauseReason::EXTERNAL_DOWNLOAD);
+}
+
 void LogModelOperationResult(ModelAction action, bool success) {
   if (success) {
     UMA_HISTOGRAM_ENUMERATION("Download.Service.Db.Operation.Success", action,
diff --git a/components/download/internal/stats.h b/components/download/internal/stats.h
index 55774d63..cba8fd0 100644
--- a/components/download/internal/stats.h
+++ b/components/download/internal/stats.h
@@ -6,7 +6,9 @@
 #define COMPONENTS_DOWNLOAD_INTERNAL_STATS_H_
 
 #include "base/files/file.h"
+#include "base/optional.h"
 #include "components/download/internal/controller.h"
+#include "components/download/internal/driver_entry.h"
 #include "components/download/internal/entry.h"
 #include "components/download/public/clients.h"
 #include "components/download/public/download_params.h"
@@ -149,6 +151,13 @@
 void LogDownloadCompletion(CompletionType type,
                            uint64_t file_size_bytes);
 
+// Logs various pause reasons for download. The reasons are not mutually
+// exclusive.
+void LogDownloadPauseReason(bool unmet_device_criteria,
+                            bool pause_by_client,
+                            bool external_navigation,
+                            bool external_download);
+
 // Logs statistics about the result of a model operation.  Used to track failure
 // cases.
 void LogModelOperationResult(ModelAction action, bool success);
diff --git a/components/download/public/download_params.h b/components/download/public/download_params.h
index c6f7488..86a629c 100644
--- a/components/download/public/download_params.h
+++ b/components/download/public/download_params.h
@@ -52,11 +52,11 @@
 
   enum class Priority {
     // The lowest priority.  Requires that the device is idle or Chrome is
-    // running.
+    // running. Gets paused or postponed during on-going navigation.
     LOW = 0,
 
     // The normal priority.  Requires that the device is idle or Chrome is
-    // running.
+    // running. Gets paused or postponed during on-going navigation.
     NORMAL = 1,
 
     // The highest background priority.  Does not require the device to be idle.
diff --git a/components/download/public/navigation_monitor.h b/components/download/public/navigation_monitor.h
index 9054e84..5d8e065b 100644
--- a/components/download/public/navigation_monitor.h
+++ b/components/download/public/navigation_monitor.h
@@ -5,6 +5,7 @@
 #ifndef COMPONENTS_DOWNLOAD_PUBLIC_NAVIGATION_MONITOR_H_
 #define COMPONENTS_DOWNLOAD_PUBLIC_NAVIGATION_MONITOR_H_
 
+#include "base/time/time.h"
 #include "components/keyed_service/core/keyed_service.h"
 
 namespace download {
@@ -39,6 +40,18 @@
   // Called when navigation events happen.
   virtual void OnNavigationEvent(NavigationEvent event) = 0;
 
+  // Returns whether the system is idle or busy with navigations.
+  virtual bool IsNavigationInProgress() const = 0;
+
+  // Called to configure various delays used before notifying the observers.
+  // |navigation_completion_delay| is the amount of delay during which if there
+  // is no navigation activity, the system is considered to be idle.
+  // |navigation_timeout_delay| is the maximum timeout starting from the
+  // beginning of a navigation after which the navigation is considered to be
+  // lost so that download service can resume.
+  virtual void Configure(base::TimeDelta navigation_completion_delay,
+                         base::TimeDelta navigation_timeout_delay) = 0;
+
  protected:
   ~NavigationMonitor() override{};
 };
diff --git a/components/network_error_logging/BUILD.gn b/components/network_error_logging/BUILD.gn
index 65d2d6e3..738ca2f 100644
--- a/components/network_error_logging/BUILD.gn
+++ b/components/network_error_logging/BUILD.gn
@@ -29,6 +29,8 @@
     ":network_error_logging",
     "//base",
     "//base/test:test_support",
+    "//net",
     "//testing/gtest",
+    "//url",
   ]
 }
diff --git a/components/network_error_logging/network_error_logging_service.cc b/components/network_error_logging/network_error_logging_service.cc
index 5a999b7..cbf7d92 100644
--- a/components/network_error_logging/network_error_logging_service.cc
+++ b/components/network_error_logging/network_error_logging_service.cc
@@ -6,12 +6,22 @@
 
 #include <memory>
 #include <string>
+#include <utility>
 
 #include "base/feature_list.h"
+#include "base/json/json_reader.h"
 #include "base/logging.h"
 #include "base/memory/ptr_util.h"
+#include "base/time/default_tick_clock.h"
+#include "base/time/tick_clock.h"
+#include "base/time/time.h"
+#include "base/values.h"
+#include "net/base/ip_address.h"
 #include "net/base/net_errors.h"
 #include "net/reporting/reporting_service.h"
+#include "net/socket/next_proto.h"
+#include "net/url_request/network_error_logging_delegate.h"
+#include "url/gurl.h"
 #include "url/origin.h"
 
 namespace features {
@@ -21,8 +31,98 @@
 
 }  // namespace features
 
+namespace {
+
+const char kReportToKey[] = "report-to";
+const char kMaxAgeKey[] = "max-age";
+const char kIncludeSubdomainsKey[] = "includeSubdomains";
+
+// Returns the superdomain of a given domain, or the empty string if the given
+// domain is just a single label. Note that this does not take into account
+// anything like the Public Suffix List, so the superdomain may end up being a
+// bare TLD.
+//
+// Examples:
+//
+// GetSuperdomain("assets.example.com") -> "example.com"
+// GetSuperdomain("example.net") -> "net"
+// GetSuperdomain("littlebox") -> ""
+//
+// TODO(juliatuttle): Deduplicate from Reporting in //net.
+std::string GetSuperdomain(const std::string& domain) {
+  size_t dot_pos = domain.find('.');
+  if (dot_pos == std::string::npos)
+    return "";
+
+  return domain.substr(dot_pos + 1);
+}
+
+const struct {
+  net::Error error;
+  const char* type;
+} kErrorTypes[] = {
+    // dns.unreachable?
+    {net::ERR_NAME_NOT_RESOLVED, "dns.name_not_resolved"},
+    {net::ERR_NAME_RESOLUTION_FAILED, "dns.failed"},
+    {net::ERR_DNS_TIMED_OUT, "dns.timed_out"},
+
+    {net::ERR_CONNECTION_TIMED_OUT, "tcp.timed_out"},
+    {net::ERR_CONNECTION_CLOSED, "tcp.closed"},
+    {net::ERR_CONNECTION_RESET, "tcp.reset"},
+    {net::ERR_CONNECTION_REFUSED, "tcp.refused"},
+    {net::ERR_CONNECTION_ABORTED, "tcp.aborted"},
+    {net::ERR_ADDRESS_INVALID, "tcp.address_invalid"},
+    {net::ERR_ADDRESS_UNREACHABLE, "tcp.address_unreachable"},
+    {net::ERR_CONNECTION_FAILED, "tcp.failed"},
+
+    {net::ERR_SSL_VERSION_OR_CIPHER_MISMATCH, "tls.version_or_cipher_mismatch"},
+    {net::ERR_BAD_SSL_CLIENT_AUTH_CERT, "tls.bad_client_auth_cert"},
+    {net::ERR_CERT_COMMON_NAME_INVALID, "tls.cert.name_invalid"},
+    {net::ERR_CERT_DATE_INVALID, "tls.cert.date_invalid"},
+    {net::ERR_CERT_AUTHORITY_INVALID, "tls.cert.authority_invalid"},
+    {net::ERR_CERT_INVALID, "tls.cert.invalid"},
+    {net::ERR_CERT_REVOKED, "tls.cert.revoked"},
+    {net::ERR_SSL_PINNED_KEY_NOT_IN_CERT_CHAIN,
+     "tls.cert.pinned_key_not_in_cert_chain"},
+    {net::ERR_SSL_PROTOCOL_ERROR, "tls.protocol.error"},
+    // tls.failed?
+
+    // http.protocol.error?
+    {net::ERR_INVALID_HTTP_RESPONSE, "http.response.invalid"},
+    {net::ERR_TOO_MANY_REDIRECTS, "http.response.redirect_loop"},
+    // http.failed?
+
+    {net::ERR_ABORTED, "abandoned"},
+    // unknown?
+
+    // TODO(juliatuttle): Surely there are more errors we want here.
+};
+
+bool GetTypeFromNetError(net::Error error, std::string* type_out) {
+  for (size_t i = 0; i < arraysize(kErrorTypes); ++i) {
+    if (kErrorTypes[i].error == error) {
+      *type_out = kErrorTypes[i].type;
+      return true;
+    }
+  }
+  return false;
+}
+
+}  // namespace
+
 namespace network_error_logging {
 
+// static:
+
+const char NetworkErrorLoggingService::kReportType[] = "network-error";
+const char NetworkErrorLoggingService::kUriKey[] = "uri";
+const char NetworkErrorLoggingService::kReferrerKey[] = "referrer";
+const char NetworkErrorLoggingService::kServerIpKey[] = "server-ip";
+const char NetworkErrorLoggingService::kProtocolKey[] = "protocol";
+const char NetworkErrorLoggingService::kStatusCodeKey[] = "status-code";
+const char NetworkErrorLoggingService::kElapsedTimeKey[] = "elapsed-time";
+const char NetworkErrorLoggingService::kTypeKey[] = "type";
+
 // static
 std::unique_ptr<NetworkErrorLoggingService>
 NetworkErrorLoggingService::Create() {
@@ -42,14 +142,196 @@
 }
 
 void NetworkErrorLoggingService::OnHeader(const url::Origin& origin,
-                                          const std::string& value) {}
+                                          const std::string& value) {
+  // NEL is only available to secure origins, so don't permit insecure origins
+  // to set policies.
+  if (!origin.GetURL().SchemeIsCryptographic())
+    return;
 
-void NetworkErrorLoggingService::OnNetworkError(
-    const url::Origin& origin,
-    net::Error error,
-    ErrorDetailsCallback details_callback) {}
+  OriginPolicy policy;
+  if (!ParseHeader(value, &policy))
+    return;
+
+  PolicyMap::iterator it = policies_.find(origin);
+  if (it != policies_.end()) {
+    MaybeRemoveWildcardPolicy(origin, &it->second);
+    policies_.erase(it);
+  }
+
+  if (policy.expires.is_null())
+    return;
+
+  auto inserted = policies_.insert(std::make_pair(origin, policy));
+  DCHECK(inserted.second);
+  MaybeAddWildcardPolicy(origin, &inserted.first->second);
+}
+
+void NetworkErrorLoggingService::OnNetworkError(const ErrorDetails& details) {
+  if (!reporting_service_)
+    return;
+
+  url::Origin origin(details.uri);
+
+  // NEL is only available to secure origins, so ignore network errors from
+  // insecure origins. (The check in OnHeader prevents insecure origins from
+  // setting policies, but this check is needed to ensure that insecure origins
+  // can't match wildcard policies from secure origins.)
+  if (!origin.GetURL().SchemeIsCryptographic())
+    return;
+
+  const OriginPolicy* policy = FindPolicyForOrigin(origin);
+  if (!policy)
+    return;
+
+  std::string type_string;
+  if (!GetTypeFromNetError(details.type, &type_string))
+    return;
+
+  reporting_service_->QueueReport(details.uri, policy->report_to, kReportType,
+                                  CreateReportBody(type_string, details));
+}
+
+void NetworkErrorLoggingService::SetTickClockForTesting(
+    std::unique_ptr<base::TickClock> tick_clock) {
+  DCHECK(tick_clock);
+  tick_clock_ = std::move(tick_clock);
+}
 
 NetworkErrorLoggingService::NetworkErrorLoggingService()
-    : reporting_service_(nullptr) {}
+    : tick_clock_(base::MakeUnique<base::DefaultTickClock>()),
+      reporting_service_(nullptr) {}
+
+bool NetworkErrorLoggingService::ParseHeader(const std::string& json_value,
+                                             OriginPolicy* policy_out) {
+  DCHECK(policy_out);
+
+  std::unique_ptr<base::Value> value = base::JSONReader::Read(json_value);
+  if (!value)
+    return false;
+
+  const base::DictionaryValue* dict = nullptr;
+  if (!value->GetAsDictionary(&dict))
+    return false;
+
+  int max_age_sec;
+  if (!dict->GetInteger(kMaxAgeKey, &max_age_sec) || max_age_sec < 0)
+    return false;
+
+  std::string report_to;
+  if (!dict->GetString(kReportToKey, &report_to) && max_age_sec > 0)
+    return false;
+
+  bool include_subdomains = false;
+  // includeSubdomains is optional and defaults to false, so it's okay if
+  // GetBoolean fails.
+  dict->GetBoolean(kIncludeSubdomainsKey, &include_subdomains);
+
+  policy_out->report_to = report_to;
+  if (max_age_sec > 0) {
+    policy_out->expires =
+        tick_clock_->NowTicks() + base::TimeDelta::FromSeconds(max_age_sec);
+  } else {
+    policy_out->expires = base::TimeTicks();
+  }
+  policy_out->include_subdomains = include_subdomains;
+
+  return true;
+}
+
+const NetworkErrorLoggingService::OriginPolicy*
+NetworkErrorLoggingService::FindPolicyForOrigin(
+    const url::Origin& origin) const {
+  // TODO(juliatuttle): Clean out expired policies sometime/somewhere.
+  PolicyMap::const_iterator it = policies_.find(origin);
+  if (it != policies_.end() && tick_clock_->NowTicks() < it->second.expires)
+    return &it->second;
+
+  std::string domain = origin.host();
+  const OriginPolicy* wildcard_policy = nullptr;
+  while (!wildcard_policy && !domain.empty()) {
+    wildcard_policy = FindWildcardPolicyForDomain(domain);
+    domain = GetSuperdomain(domain);
+  }
+
+  return wildcard_policy;
+}
+
+const NetworkErrorLoggingService::OriginPolicy*
+NetworkErrorLoggingService::FindWildcardPolicyForDomain(
+    const std::string& domain) const {
+  DCHECK(!domain.empty());
+
+  WildcardPolicyMap::const_iterator it = wildcard_policies_.find(domain);
+  if (it == wildcard_policies_.end())
+    return nullptr;
+
+  DCHECK(!it->second.empty());
+
+  // TODO(juliatuttle): Come up with a deterministic way to resolve these.
+  if (it->second.size() > 1) {
+    LOG(WARNING) << "Domain " << domain
+                 << " matches multiple origins with includeSubdomains; "
+                 << "choosing one arbitrarily.";
+  }
+
+  for (std::set<const OriginPolicy*>::const_iterator jt = it->second.begin();
+       jt != it->second.end(); ++jt) {
+    if (tick_clock_->NowTicks() < (*jt)->expires)
+      return *jt;
+  }
+
+  return nullptr;
+}
+
+void NetworkErrorLoggingService::MaybeAddWildcardPolicy(
+    const url::Origin& origin,
+    const OriginPolicy* policy) {
+  DCHECK(policy);
+  DCHECK_EQ(policy, &policies_[origin]);
+
+  if (!policy->include_subdomains)
+    return;
+
+  auto inserted = wildcard_policies_[origin.host()].insert(policy);
+  DCHECK(inserted.second);
+}
+
+void NetworkErrorLoggingService::MaybeRemoveWildcardPolicy(
+    const url::Origin& origin,
+    const OriginPolicy* policy) {
+  DCHECK(policy);
+  DCHECK_EQ(policy, &policies_[origin]);
+
+  if (!policy->include_subdomains)
+    return;
+
+  WildcardPolicyMap::iterator wildcard_it =
+      wildcard_policies_.find(origin.host());
+  DCHECK(wildcard_it != wildcard_policies_.end());
+
+  size_t erased = wildcard_it->second.erase(policy);
+  DCHECK_EQ(1u, erased);
+  if (wildcard_it->second.empty())
+    wildcard_policies_.erase(wildcard_it);
+}
+
+std::unique_ptr<const base::Value> NetworkErrorLoggingService::CreateReportBody(
+    const std::string& type,
+    const net::NetworkErrorLoggingDelegate::ErrorDetails& details) const {
+  auto body = base::MakeUnique<base::DictionaryValue>();
+
+  body->SetString(kUriKey, details.uri.spec());
+  body->SetString(kReferrerKey, details.referrer.spec());
+  body->SetString(kServerIpKey, details.server_ip.ToString());
+  std::string protocol = net::NextProtoToString(details.protocol);
+  if (protocol == "unknown")
+    protocol = "";
+  body->SetString(kProtocolKey, protocol);
+  body->SetInteger(kStatusCodeKey, details.status_code);
+  body->SetInteger(kElapsedTimeKey, details.elapsed_time.InMilliseconds());
+  body->SetString(kTypeKey, type);
+
+  return std::move(body);
+}
 
 }  // namespace network_error_logging
diff --git a/components/network_error_logging/network_error_logging_service.h b/components/network_error_logging/network_error_logging_service.h
index fd3bb5fc..b8a881e 100644
--- a/components/network_error_logging/network_error_logging_service.h
+++ b/components/network_error_logging/network_error_logging_service.h
@@ -5,15 +5,23 @@
 #ifndef COMPONENTS_NETWORK_ERROR_LOGGING_NETWORK_ERROR_LOGGING_SERVICE_H_
 #define COMPONENTS_NETWORK_ERROR_LOGGING_NETWORK_ERROR_LOGGING_SERVICE_H_
 
+#include <map>
 #include <memory>
+#include <set>
 #include <string>
 
 #include "base/feature_list.h"
 #include "base/macros.h"
+#include "base/time/tick_clock.h"
+#include "base/time/time.h"
 #include "components/network_error_logging/network_error_logging_export.h"
 #include "net/base/net_errors.h"
 #include "net/url_request/network_error_logging_delegate.h"
 
+namespace base {
+class Value;
+}  // namespace base
+
 namespace net {
 class ReportingService;
 }  // namespace net
@@ -31,6 +39,18 @@
 class NETWORK_ERROR_LOGGING_EXPORT NetworkErrorLoggingService
     : public net::NetworkErrorLoggingDelegate {
  public:
+  static const char kReportType[];
+
+  // Keys for data included in report bodies. Exposed for tests.
+
+  static const char kUriKey[];
+  static const char kReferrerKey[];
+  static const char kServerIpKey[];
+  static const char kProtocolKey[];
+  static const char kStatusCodeKey[];
+  static const char kElapsedTimeKey[];
+  static const char kTypeKey[];
+
   // Creates the NetworkErrorLoggingService.
   //
   // Will return nullptr if Network Error Logging is disabled via
@@ -45,16 +65,62 @@
 
   void OnHeader(const url::Origin& origin, const std::string& value) override;
 
-  void OnNetworkError(const url::Origin& origin,
-                      net::Error error,
-                      ErrorDetailsCallback details_callback) override;
+  void OnNetworkError(const ErrorDetails& details) override;
+
+  void SetTickClockForTesting(std::unique_ptr<base::TickClock> tick_clock);
 
  private:
+  // NEL Policy set by an origin.
+  struct OriginPolicy {
+    // Reporting API endpoint group to which reports should be sent.
+    std::string report_to;
+
+    base::TimeTicks expires;
+
+    bool include_subdomains;
+  };
+
+  // Map from origin to origin's (owned) policy.
+  // Would be unordered_map, but url::Origin has no hash.
+  using PolicyMap = std::map<url::Origin, OriginPolicy>;
+
+  // Wildcard policies are policies for which the includeSubdomains flag is set.
+  //
+  // Wildcard policies are accessed by domain name, not full origin, so there
+  // can be multiple wildcard policies per domain name.
+  //
+  // This is a map from domain name to the set of pointers to wildcard policies
+  // in that domain.
+  //
+  // Policies in the map are unowned; they are pointers to the original in the
+  // PolicyMap.
+  using WildcardPolicyMap =
+      std::map<std::string, std::set<const OriginPolicy*>>;
+
   NetworkErrorLoggingService();
 
+  // Would be const, but base::TickClock::NowTicks isn't.
+  bool ParseHeader(const std::string& json_value, OriginPolicy* policy_out);
+
+  const OriginPolicy* FindPolicyForOrigin(const url::Origin& origin) const;
+  const OriginPolicy* FindWildcardPolicyForDomain(
+      const std::string& domain) const;
+  void MaybeAddWildcardPolicy(const url::Origin& origin,
+                              const OriginPolicy* policy);
+  void MaybeRemoveWildcardPolicy(const url::Origin& origin,
+                                 const OriginPolicy* policy);
+  std::unique_ptr<const base::Value> CreateReportBody(
+      const std::string& type,
+      const ErrorDetails& details) const;
+
+  std::unique_ptr<base::TickClock> tick_clock_;
+
   // Unowned.
   net::ReportingService* reporting_service_;
 
+  PolicyMap policies_;
+  WildcardPolicyMap wildcard_policies_;
+
   DISALLOW_COPY_AND_ASSIGN(NetworkErrorLoggingService);
 };
 
diff --git a/components/network_error_logging/network_error_logging_service_unittest.cc b/components/network_error_logging/network_error_logging_service_unittest.cc
index 681798a..e425662 100644
--- a/components/network_error_logging/network_error_logging_service_unittest.cc
+++ b/components/network_error_logging/network_error_logging_service_unittest.cc
@@ -3,28 +3,157 @@
 // found in the LICENSE file.
 
 #include <memory>
+#include <string>
+#include <vector>
 
+#include "base/bind.h"
+#include "base/callback.h"
 #include "base/macros.h"
+#include "base/memory/ptr_util.h"
 #include "base/test/scoped_feature_list.h"
+#include "base/test/values_test_util.h"
+#include "base/time/time.h"
+#include "base/values.h"
 #include "components/network_error_logging/network_error_logging_service.h"
+#include "net/base/ip_address.h"
+#include "net/base/net_errors.h"
+#include "net/reporting/reporting_service.h"
+#include "net/socket/next_proto.h"
 #include "testing/gtest/include/gtest/gtest.h"
+#include "url/gurl.h"
+#include "url/origin.h"
 
 namespace {
 
+class TestReportingService : public net::ReportingService {
+ public:
+  struct Report {
+    Report() {}
+
+    Report(Report&& other)
+        : url(other.url),
+          group(other.group),
+          type(other.type),
+          body(std::move(other.body)) {}
+
+    Report(const GURL& url,
+           const std::string& group,
+           const std::string& type,
+           std::unique_ptr<const base::Value> body)
+        : url(url), group(group), type(type), body(std::move(body)) {}
+
+    ~Report() {}
+
+    GURL url;
+    std::string group;
+    std::string type;
+    std::unique_ptr<const base::Value> body;
+
+   private:
+    DISALLOW_COPY(Report);
+  };
+
+  TestReportingService() {}
+
+  const std::vector<Report>& reports() const { return reports_; }
+
+  // net::ReportingService implementation:
+
+  ~TestReportingService() override {}
+
+  void QueueReport(const GURL& url,
+                   const std::string& group,
+                   const std::string& type,
+                   std::unique_ptr<const base::Value> body) override {
+    reports_.push_back(Report(url, group, type, std::move(body)));
+  }
+
+  void ProcessHeader(const GURL& url,
+                     const std::string& header_value) override {
+    NOTREACHED();
+  }
+
+  void RemoveBrowsingData(
+      int data_type_mask,
+      base::Callback<bool(const GURL&)> origin_filter) override {
+    NOTREACHED();
+  }
+
+ private:
+  std::vector<Report> reports_;
+
+  DISALLOW_COPY_AND_ASSIGN(TestReportingService);
+};
+
 class NetworkErrorLoggingServiceTest : public ::testing::Test {
  protected:
   NetworkErrorLoggingServiceTest() {
     scoped_feature_list_.InitAndEnableFeature(features::kNetworkErrorLogging);
     service_ = network_error_logging::NetworkErrorLoggingService::Create();
+    CreateReportingService();
+  }
+
+  void CreateReportingService() {
+    DCHECK(!reporting_service_);
+
+    reporting_service_ = base::MakeUnique<TestReportingService>();
+    service_->SetReportingService(reporting_service_.get());
+  }
+
+  void DestroyReportingService() {
+    DCHECK(reporting_service_);
+
+    service_->SetReportingService(nullptr);
+    reporting_service_.reset();
+  }
+
+  net::NetworkErrorLoggingDelegate::ErrorDetails MakeErrorDetails(
+      GURL url,
+      net::Error error_type) {
+    net::NetworkErrorLoggingDelegate::ErrorDetails details;
+
+    details.uri = url;
+    details.referrer = kReferrer_;
+    details.server_ip = net::IPAddress::IPv4AllZeros();
+    details.protocol = net::kProtoUnknown;
+    details.status_code = 0;
+    details.elapsed_time = base::TimeDelta::FromSeconds(1);
+    details.type = error_type;
+
+    return details;
   }
 
   network_error_logging::NetworkErrorLoggingService* service() {
     return service_.get();
   }
+  const std::vector<TestReportingService::Report>& reports() {
+    return reporting_service_->reports();
+  }
+
+  const GURL kUrl_ = GURL("https://example.com/path");
+  const GURL kUrlDifferentPort_ = GURL("https://example.com:4433/path");
+  const GURL kUrlSubdomain_ = GURL("https://subdomain.example.com/path");
+
+  const url::Origin kOrigin_ = url::Origin(kUrl_);
+  const url::Origin kOriginDifferentPort_ = url::Origin(kUrlDifferentPort_);
+  const url::Origin kOriginSubdomain_ = url::Origin(kUrlSubdomain_);
+
+  const std::string kHeader_ = "{\"report-to\":\"group\",\"max-age\":86400}";
+  const std::string kHeaderIncludeSubdomains_ =
+      "{\"report-to\":\"group\",\"max-age\":86400,\"includeSubdomains\":true}";
+  const std::string kHeaderMaxAge0_ = "{\"max-age\":0}";
+
+  const std::string kGroup_ = "group";
+
+  const std::string kType_ =
+      network_error_logging::NetworkErrorLoggingService::kReportType;
+
+  const GURL kReferrer_ = GURL("https://referrer.com/");
 
  private:
   base::test::ScopedFeatureList scoped_feature_list_;
   std::unique_ptr<network_error_logging::NetworkErrorLoggingService> service_;
+  std::unique_ptr<TestReportingService> reporting_service_;
 };
 
 TEST_F(NetworkErrorLoggingServiceTest, FeatureDisabled) {
@@ -41,4 +170,128 @@
   EXPECT_TRUE(service());
 }
 
+TEST_F(NetworkErrorLoggingServiceTest, NoReportingService) {
+  DestroyReportingService();
+
+  service()->OnHeader(kOrigin_, kHeader_);
+
+  service()->OnNetworkError(
+      MakeErrorDetails(kUrl_, net::ERR_CONNECTION_REFUSED));
+}
+
+TEST_F(NetworkErrorLoggingServiceTest, OriginInsecure) {
+  const GURL kInsecureUrl("http://insecure.com/");
+  const url::Origin kInsecureOrigin(kInsecureUrl);
+
+  service()->OnHeader(kInsecureOrigin, kHeader_);
+
+  service()->OnNetworkError(
+      MakeErrorDetails(kInsecureUrl, net::ERR_CONNECTION_REFUSED));
+
+  EXPECT_TRUE(reports().empty());
+}
+
+TEST_F(NetworkErrorLoggingServiceTest, NoPolicyForOrigin) {
+  service()->OnNetworkError(
+      MakeErrorDetails(kUrl_, net::ERR_CONNECTION_REFUSED));
+
+  EXPECT_TRUE(reports().empty());
+}
+
+TEST_F(NetworkErrorLoggingServiceTest, ReportQueued) {
+  service()->OnHeader(kOrigin_, kHeader_);
+
+  service()->OnNetworkError(
+      MakeErrorDetails(kUrl_, net::ERR_CONNECTION_REFUSED));
+
+  EXPECT_EQ(1u, reports().size());
+  EXPECT_EQ(kUrl_, reports()[0].url);
+  EXPECT_EQ(kGroup_, reports()[0].group);
+  EXPECT_EQ(kType_, reports()[0].type);
+
+  const base::DictionaryValue* body;
+  ASSERT_TRUE(reports()[0].body->GetAsDictionary(&body));
+  base::ExpectDictStringValue(
+      kUrl_.spec(), *body,
+      network_error_logging::NetworkErrorLoggingService::kUriKey);
+  base::ExpectDictStringValue(
+      kReferrer_.spec(), *body,
+      network_error_logging::NetworkErrorLoggingService::kReferrerKey);
+  // TODO(juliatuttle): Extract these constants.
+  base::ExpectDictStringValue(
+      "0.0.0.0", *body,
+      network_error_logging::NetworkErrorLoggingService::kServerIpKey);
+  base::ExpectDictStringValue(
+      "", *body,
+      network_error_logging::NetworkErrorLoggingService::kProtocolKey);
+  base::ExpectDictIntegerValue(
+      0, *body,
+      network_error_logging::NetworkErrorLoggingService::kStatusCodeKey);
+  base::ExpectDictIntegerValue(
+      1000, *body,
+      network_error_logging::NetworkErrorLoggingService::kElapsedTimeKey);
+  base::ExpectDictStringValue(
+      "tcp.refused", *body,
+      network_error_logging::NetworkErrorLoggingService::kTypeKey);
+}
+
+TEST_F(NetworkErrorLoggingServiceTest, MaxAge0) {
+  service()->OnHeader(kOrigin_, kHeader_);
+
+  service()->OnHeader(kOrigin_, kHeaderMaxAge0_);
+
+  service()->OnNetworkError(
+      MakeErrorDetails(kUrl_, net::ERR_CONNECTION_REFUSED));
+
+  EXPECT_TRUE(reports().empty());
+}
+
+TEST_F(NetworkErrorLoggingServiceTest,
+       ExcludeSubdomainsDoesntMatchDifferentPort) {
+  service()->OnHeader(kOrigin_, kHeader_);
+
+  service()->OnNetworkError(
+      MakeErrorDetails(kUrlDifferentPort_, net::ERR_CONNECTION_REFUSED));
+
+  EXPECT_TRUE(reports().empty());
+}
+
+TEST_F(NetworkErrorLoggingServiceTest, ExcludeSubdomainsDoesntMatchSubdomain) {
+  service()->OnHeader(kOrigin_, kHeader_);
+
+  service()->OnNetworkError(
+      MakeErrorDetails(kUrlSubdomain_, net::ERR_CONNECTION_REFUSED));
+
+  EXPECT_TRUE(reports().empty());
+}
+
+TEST_F(NetworkErrorLoggingServiceTest, IncludeSubdomainsMatchesDifferentPort) {
+  service()->OnHeader(kOrigin_, kHeaderIncludeSubdomains_);
+
+  service()->OnNetworkError(
+      MakeErrorDetails(kUrlDifferentPort_, net::ERR_CONNECTION_REFUSED));
+
+  EXPECT_EQ(1u, reports().size());
+  EXPECT_EQ(kUrlDifferentPort_, reports()[0].url);
+}
+
+TEST_F(NetworkErrorLoggingServiceTest, IncludeSubdomainsMatchesSubdomain) {
+  service()->OnHeader(kOrigin_, kHeaderIncludeSubdomains_);
+
+  service()->OnNetworkError(
+      MakeErrorDetails(kUrlSubdomain_, net::ERR_CONNECTION_REFUSED));
+
+  EXPECT_EQ(1u, reports().size());
+}
+
+TEST_F(NetworkErrorLoggingServiceTest,
+       IncludeSubdomainsDoesntMatchSuperdomain) {
+  service()->OnHeader(kOriginSubdomain_, kHeaderIncludeSubdomains_);
+
+  service()->OnNetworkError(
+      MakeErrorDetails(kUrl_, net::ERR_CONNECTION_REFUSED));
+
+  EXPECT_TRUE(reports().empty());
+}
+
 }  // namespace
diff --git a/components/offline_pages/core/client_policy_controller.cc b/components/offline_pages/core/client_policy_controller.cc
index b6004d6..4b0e29e 100644
--- a/components/offline_pages/core/client_policy_controller.cc
+++ b/components/offline_pages/core/client_policy_controller.cc
@@ -68,6 +68,7 @@
           .SetIsDisabledWhenPrefetchDisabled(true)
           .SetExpirePeriod(base::TimeDelta::FromDays(30))
           .SetIsSupportedByDownload(IsOfflinePagesPrefetchingUIEnabled())
+          .SetIsSuggested(true)
           .Build()));
   policies_.insert(std::make_pair(
       kBrowserActionsNamespace,
diff --git a/components/offline_pages/core/prefetch/BUILD.gn b/components/offline_pages/core/prefetch/BUILD.gn
index 9221839..b874561a 100644
--- a/components/offline_pages/core/prefetch/BUILD.gn
+++ b/components/offline_pages/core/prefetch/BUILD.gn
@@ -74,6 +74,8 @@
     "store/prefetch_downloader_quota.h",
     "store/prefetch_store.cc",
     "store/prefetch_store.h",
+    "store/prefetch_store_schema.cc",
+    "store/prefetch_store_schema.h",
     "store/prefetch_store_utils.cc",
     "store/prefetch_store_utils.h",
     "suggested_articles_observer.cc",
@@ -182,6 +184,7 @@
     "sent_get_operation_cleanup_task_unittest.cc",
     "stale_entry_finalizer_task_unittest.cc",
     "store/prefetch_downloader_quota_unittest.cc",
+    "store/prefetch_store_schema_unittest.cc",
     "store/prefetch_store_unittest.cc",
     "suggested_articles_observer_unittest.cc",
     "test_download_client.cc",
diff --git a/components/offline_pages/core/prefetch/import_archives_task.cc b/components/offline_pages/core/prefetch/import_archives_task.cc
index 0f1f7bdc..56cf10a 100644
--- a/components/offline_pages/core/prefetch/import_archives_task.cc
+++ b/components/offline_pages/core/prefetch/import_archives_task.cc
@@ -22,7 +22,7 @@
 std::unique_ptr<std::vector<PrefetchArchiveInfo>> GetArchivesSync(
     sql::Connection* db) {
   static const char kSql[] =
-      "SELECT offline_id, client_namespace, client_id, requested_url,"
+      "SELECT offline_id, client_namespace, guid, requested_url,"
       "  final_archived_url, title, file_path, file_size"
       " FROM prefetch_items"
       " WHERE state = ?";
@@ -34,6 +34,8 @@
     PrefetchArchiveInfo archive;
     archive.offline_id = statement.ColumnInt64(0);
     archive.client_id.name_space = statement.ColumnString(1);
+    // The client ID is the GUID of the download so that it can be shown
+    // consistently in Downloads Home.
     archive.client_id.id = statement.ColumnString(2);
     archive.url = GURL(statement.ColumnString(3));
     archive.final_archived_url = GURL(statement.ColumnString(4));
diff --git a/components/offline_pages/core/prefetch/import_archives_task_unittest.cc b/components/offline_pages/core/prefetch/import_archives_task_unittest.cc
index b9733c54..9827f44 100644
--- a/components/offline_pages/core/prefetch/import_archives_task_unittest.cc
+++ b/components/offline_pages/core/prefetch/import_archives_task_unittest.cc
@@ -32,8 +32,10 @@
 const GURL kTestURL2("http://sample.org");
 const GURL kTestFinalURL("https://sample.org/foo");
 const GURL kTestFinalURL2("https://sample.org/foo");
-const ClientId kTestClientID("Foo", "Bar");
-const ClientId kTestClientID2("Foo2", "Bar2");
+const std::string kTestGUID("C56A4180-65AA-42EC-A945-5FD21DEC0538");
+const ClientId kTestClientID("Foo", kTestGUID);
+const std::string kTestGUID2("784f1b8b-6a32-4535-9751-ade05f947aa9");
+const ClientId kTestClientID2("Foo2", kTestGUID2);
 const base::string16 kTestTitle = base::ASCIIToUTF16("Hello");
 const base::string16 kTestTitle2 = base::ASCIIToUTF16("Hello2");
 const base::FilePath kTestFilePath(FILE_PATH_LITERAL("foo"));
@@ -93,6 +95,7 @@
   item.offline_id = kTestOfflineID;
   item.state = PrefetchItemState::DOWNLOADED;
   item.url = kTestURL;
+  item.guid = kTestGUID;
   item.final_archived_url = kTestFinalURL;
   item.client_id = kTestClientID;
   item.title = kTestTitle;
@@ -106,6 +109,7 @@
   item2.offline_id = kTestOfflineID2;
   item2.state = PrefetchItemState::DOWNLOADED;
   item2.url = kTestURL2;
+  item2.guid = kTestGUID2;
   item2.final_archived_url = kTestFinalURL2;
   item2.client_id = kTestClientID2;
   item2.title = kTestTitle2;
diff --git a/components/offline_pages/core/prefetch/prefetch_item_unittest.cc b/components/offline_pages/core/prefetch/prefetch_item_unittest.cc
index 8be14345..7a9e6ca 100644
--- a/components/offline_pages/core/prefetch/prefetch_item_unittest.cc
+++ b/components/offline_pages/core/prefetch/prefetch_item_unittest.cc
@@ -9,7 +9,7 @@
 #include "base/strings/utf_string_conversions.h"
 #include "base/time/time.h"
 #include "components/offline_pages/core/prefetch/prefetch_types.h"
-#include "components/offline_pages/core/prefetch/store/prefetch_store.h"
+#include "components/offline_pages/core/prefetch/store/prefetch_store_schema.h"
 #include "testing/gtest/include/gtest/gtest.h"
 #include "url/gurl.h"
 
@@ -61,7 +61,8 @@
 
 // Computes the number of columns the SQL table has.
 std::size_t PrefetchItemTest::GetTableColumnsCount() {
-  std::string tableCreationSql(PrefetchStore::GetTableCreationSqlForTesting());
+  std::string tableCreationSql =
+      PrefetchStoreSchema::GetItemTableCreationSqlForTesting();
   std::vector<std::string> create_statement_split = base::SplitString(
       tableCreationSql, "()", base::KEEP_WHITESPACE, base::SPLIT_WANT_ALL);
   EXPECT_EQ(3U, create_statement_split.size());
diff --git a/components/offline_pages/core/prefetch/store/prefetch_store.cc b/components/offline_pages/core/prefetch/store/prefetch_store.cc
index 8624bff..0ba3ff26 100644
--- a/components/offline_pages/core/prefetch/store/prefetch_store.cc
+++ b/components/offline_pages/core/prefetch/store/prefetch_store.cc
@@ -9,104 +9,22 @@
 #include "base/files/file_util.h"
 #include "base/location.h"
 #include "base/logging.h"
-#include "base/metrics/histogram_macros.h"
 #include "base/sequenced_task_runner.h"
 #include "base/task_runner_util.h"
 #include "base/threading/thread_task_runner_handle.h"
 #include "components/offline_pages/core/offline_store_types.h"
-#include "components/offline_pages/core/prefetch/store/prefetch_store_utils.h"
+#include "components/offline_pages/core/prefetch/store/prefetch_store_schema.h"
 #include "sql/connection.h"
-#include "sql/meta_table.h"
-#include "sql/statement.h"
-#include "sql/transaction.h"
 
 namespace offline_pages {
 namespace {
 
-// Name of the table with prefetch items.
-const char kPrefetchItemsTableName[] = "prefetch_items";
-const char kPrefetchQuotaTableName[] = "prefetch_downloader_quota";
 const char kPrefetchStoreFileName[] = "PrefetchStore.db";
 
-const int kCurrentVersion = 1;
-const int kCompatibleVersion = 1;
-
 using InitializeCallback =
     base::Callback<void(InitializationStatus,
                         std::unique_ptr<sql::Connection>)>;
 
-// IMPORTANT #1: when making changes to these columns please also reflect them
-// into:
-// - PrefetchItem: update existing fields and all method implementations
-//   (operator=, operator<<, ToString, etc).
-// - PrefetchItemTest, PrefetchStoreTestUtil: update test related code to cover
-//   the changed set of columns and PrefetchItem members.
-// - MockPrefetchItemGenerator: so that its generated items consider all fields.
-// IMPORTANT #2: the ordering of column types is important in SQLite 3 tables to
-// simplify data retrieval. Columns with fixed length types must come first and
-// variable length types must come later.
-static const char kTableCreationSql[] =
-    "CREATE TABLE prefetch_items"
-    // Fixed length columns come first.
-    "(offline_id INTEGER PRIMARY KEY NOT NULL,"
-    " state INTEGER NOT NULL DEFAULT 0,"
-    " generate_bundle_attempts INTEGER NOT NULL DEFAULT 0,"
-    " get_operation_attempts INTEGER NOT NULL DEFAULT 0,"
-    " download_initiation_attempts INTEGER NOT NULL DEFAULT 0,"
-    " archive_body_length INTEGER_NOT_NULL DEFAULT -1,"
-    " creation_time INTEGER NOT NULL,"
-    " freshness_time INTEGER NOT NULL,"
-    " error_code INTEGER NOT NULL DEFAULT 0,"
-    " file_size INTEGER NOT NULL DEFAULT -1,"
-    // Variable length columns come later.
-    " guid VARCHAR NOT NULL DEFAULT '',"
-    " client_namespace VARCHAR NOT NULL DEFAULT '',"
-    " client_id VARCHAR NOT NULL DEFAULT '',"
-    " requested_url VARCHAR NOT NULL DEFAULT '',"
-    " final_archived_url VARCHAR NOT NULL DEFAULT '',"
-    " operation_name VARCHAR NOT NULL DEFAULT '',"
-    " archive_body_name VARCHAR NOT NULL DEFAULT '',"
-    " title VARCHAR NOT NULL DEFAULT '',"
-    " file_path VARCHAR NOT NULL DEFAULT ''"
-    ")";
-
-bool CreatePrefetchItemsTable(sql::Connection* db) {
-  return db->Execute(kTableCreationSql);
-}
-
-bool CreatePrefetchQuotaTable(sql::Connection* db) {
-  static const char kSql[] =
-      "CREATE TABLE prefetch_downloader_quota"
-      "(quota_id INTEGER PRIMARY KEY NOT NULL DEFAULT 1,"
-      " update_time INTEGER NOT NULL,"
-      " available_quota INTEGER NOT NULL DEFAULT 0)";
-  return db->Execute(kSql);
-}
-
-bool CreateSchema(sql::Connection* db) {
-  // If you create a transaction but don't Commit() it is automatically
-  // rolled back by its destructor when it falls out of scope.
-  sql::Transaction transaction(db);
-  if (!transaction.Begin())
-    return false;
-
-  if (!db->DoesTableExist(kPrefetchItemsTableName)) {
-    if (!CreatePrefetchItemsTable(db))
-      return false;
-  }
-
-  if (!db->DoesTableExist(kPrefetchQuotaTableName)) {
-    if (!CreatePrefetchQuotaTable(db))
-      return false;
-  }
-
-  sql::MetaTable meta_table;
-  meta_table.Init(db, kCurrentVersion, kCompatibleVersion);
-
-  // This would be a great place to add indices when we need them.
-  return transaction.Commit();
-}
-
 bool PrepareDirectory(const base::FilePath& path) {
   base::File::Error error = base::File::FILE_OK;
   if (!base::DirectoryExists(path.DirName())) {
@@ -147,7 +65,7 @@
   }
   db->Preload();
 
-  return CreateSchema(db);
+  return PrefetchStoreSchema::CreateOrUpgradeIfNeeded(db);
 }
 
 }  // namespace
@@ -188,6 +106,7 @@
 
 void PrefetchStore::OnInitializeDone(base::OnceClosure pending_command,
                                      bool success) {
+  // TODO(carlosk): Add initializing error reporting here.
   DCHECK_EQ(initialization_status_, InitializationStatus::INITIALIZING);
   initialization_status_ =
       success ? InitializationStatus::SUCCESS : InitializationStatus::FAILURE;
@@ -202,9 +121,4 @@
     initialization_status_ = InitializationStatus::NOT_INITIALIZED;
 }
 
-// static
-const char* PrefetchStore::GetTableCreationSqlForTesting() {
-  return kTableCreationSql;
-}
-
 }  // namespace offline_pages
diff --git a/components/offline_pages/core/prefetch/store/prefetch_store_schema.cc b/components/offline_pages/core/prefetch/store/prefetch_store_schema.cc
new file mode 100644
index 0000000..ecc30648
--- /dev/null
+++ b/components/offline_pages/core/prefetch/store/prefetch_store_schema.cc
@@ -0,0 +1,205 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "components/offline_pages/core/prefetch/store/prefetch_store_schema.h"
+
+#include "sql/connection.h"
+#include "sql/meta_table.h"
+#include "sql/transaction.h"
+
+namespace offline_pages {
+
+// Schema versions changelog:
+// * 1: Initial version with prefetch_items and prefetch_downloader_quota
+//   tables.
+// * 2: Changes prefetch_items.file_size to have a default value of -1 (instead
+//   of 0).
+
+// static
+const int PrefetchStoreSchema::kCurrentVersion = 2;
+// static
+const int PrefetchStoreSchema::kCompatibleVersion = 1;
+
+namespace {
+
+// TODO(https://crbug.com/765282): remove MetaTable internal values and helper
+// methods once its getters and setters for version information allow the caller
+// to be informed about internal errors.
+
+// From MetaTable internals.
+const char kVersionKey[] = "version";
+const char kCompatibleVersionKey[] = "last_compatible_version";
+
+const int kVersionError = -1;
+
+bool SetVersionNumber(sql::MetaTable* meta_table, int version) {
+  return meta_table->SetValue(kVersionKey, version);
+}
+
+bool SetCompatibleVersionNumber(sql::MetaTable* meta_table, int version) {
+  return meta_table->SetValue(kCompatibleVersionKey, version);
+}
+
+int GetVersionNumber(sql::MetaTable* meta_table) {
+  int version;
+  if (meta_table->GetValue(kVersionKey, &version))
+    return version;
+  return kVersionError;
+}
+
+int GetCompatibleVersionNumber(sql::MetaTable* meta_table) {
+  int version;
+  if (meta_table->GetValue(kCompatibleVersionKey, &version))
+    return version;
+  return kVersionError;
+}
+
+// IMPORTANT #1: when making changes to these columns please also reflect them
+// into:
+// - PrefetchItem: update existing fields and all method implementations
+//   (operator=, operator<<, ToString, etc).
+// - PrefetchItemTest, PrefetchStoreTestUtil: update test related code to cover
+//   the changed set of columns and PrefetchItem members.
+// - MockPrefetchItemGenerator: so that its generated items consider all fields.
+// IMPORTANT #2: the ordering of column types is important in SQLite 3 tables to
+// simplify data retrieval. Columns with fixed length types must come first and
+// variable length types must come later.
+static const char kItemsTableCreationSql[] =
+    "CREATE TABLE IF NOT EXISTS prefetch_items "
+    // Fixed length columns come first.
+    "(offline_id INTEGER PRIMARY KEY NOT NULL,"
+    " state INTEGER NOT NULL DEFAULT 0,"
+    " generate_bundle_attempts INTEGER NOT NULL DEFAULT 0,"
+    " get_operation_attempts INTEGER NOT NULL DEFAULT 0,"
+    " download_initiation_attempts INTEGER NOT NULL DEFAULT 0,"
+    " archive_body_length INTEGER_NOT_NULL DEFAULT -1,"
+    " creation_time INTEGER NOT NULL,"
+    " freshness_time INTEGER NOT NULL,"
+    " error_code INTEGER NOT NULL DEFAULT 0,"
+    " file_size INTEGER NOT NULL DEFAULT -1,"
+    // Variable length columns come later.
+    " guid VARCHAR NOT NULL DEFAULT '',"
+    " client_namespace VARCHAR NOT NULL DEFAULT '',"
+    " client_id VARCHAR NOT NULL DEFAULT '',"
+    " requested_url VARCHAR NOT NULL DEFAULT '',"
+    " final_archived_url VARCHAR NOT NULL DEFAULT '',"
+    " operation_name VARCHAR NOT NULL DEFAULT '',"
+    " archive_body_name VARCHAR NOT NULL DEFAULT '',"
+    " title VARCHAR NOT NULL DEFAULT '',"
+    " file_path VARCHAR NOT NULL DEFAULT ''"
+    ")";
+
+bool CreatePrefetchItemsTable(sql::Connection* db) {
+  return db->Execute(kItemsTableCreationSql);
+}
+
+static const char kQuotaTableCreationSql[] =
+    "CREATE TABLE IF NOT EXISTS prefetch_downloader_quota "
+    "(quota_id INTEGER PRIMARY KEY NOT NULL DEFAULT 1,"
+    " update_time INTEGER NOT NULL,"
+    " available_quota INTEGER NOT NULL DEFAULT 0)";
+
+bool CreatePrefetchQuotaTable(sql::Connection* db) {
+  return db->Execute(kQuotaTableCreationSql);
+}
+
+bool CreateLatestSchema(sql::Connection* db) {
+  sql::Transaction transaction(db);
+  if (!transaction.Begin())
+    return false;
+
+  if (!CreatePrefetchItemsTable(db) || !CreatePrefetchQuotaTable(db))
+    return false;
+
+  // This would be a great place to add indices when we need them.
+  return transaction.Commit();
+}
+
+}  // namespace
+
+// static
+bool PrefetchStoreSchema::CreateOrUpgradeIfNeeded(sql::Connection* db) {
+  DCHECK_GE(kCurrentVersion, kCompatibleVersion);
+  DCHECK(db);
+  if (!db)
+    return false;
+
+  sql::MetaTable meta_table;
+  if (!meta_table.Init(db, kCurrentVersion, kCompatibleVersion))
+    return false;
+
+  const int compatible_version = GetCompatibleVersionNumber(&meta_table);
+  const int current_version = GetVersionNumber(&meta_table);
+  if (current_version == kVersionError || compatible_version == kVersionError)
+    return false;
+  DCHECK_GE(current_version, compatible_version);
+
+  // Stored database version is newer and incompatible with the current running
+  // code (Chrome was downgraded). The DB will never work until Chrome is
+  // re-upgraded.
+  if (compatible_version > kCurrentVersion)
+    return false;
+
+  // Database is already at the latest version or has just been created. Create
+  // any missing tables and return.
+  if (current_version == kCurrentVersion)
+    return CreateLatestSchema(db);
+
+  // Versions 0 and below are unexpected.
+  if (current_version <= 0)
+    return false;
+
+  // Schema upgrade code starts here.
+  // Note: A series of if-else blocks was chosen to allow for more flexibility
+  // in the upgrade logic than a single switch-case block would.
+
+  if (current_version == 1) {
+    sql::Transaction transaction(db);
+    if (!transaction.Begin())
+      return false;
+
+    if (!db->Execute("ALTER TABLE prefetch_items RENAME TO prefetch_items_old"))
+      return false;
+
+    if (!CreatePrefetchItemsTable(db))
+      return false;
+
+    const char kMigrateItemsSql[] =
+        "INSERT INTO prefetch_items "
+        " (offline_id, state, generate_bundle_attempts, get_operation_attempts,"
+        "  download_initiation_attempts, archive_body_length, creation_time,"
+        "  freshness_time, error_code, file_size, guid, client_namespace,"
+        "  client_id, requested_url, final_archived_url, operation_name,"
+        "  archive_body_name, title, file_path)"
+        " SELECT "
+        "  offline_id, state, generate_bundle_attempts, get_operation_attempts,"
+        "  download_initiation_attempts, archive_body_length, creation_time,"
+        "  freshness_time, error_code, file_size, guid, client_namespace,"
+        "  client_id, requested_url, final_archived_url, operation_name,"
+        "  archive_body_name, title, file_path"
+        " FROM prefetch_items_old";
+    if (!db->Execute(kMigrateItemsSql))
+      return false;
+
+    if (!db->Execute("DROP TABLE prefetch_items_old"))
+      return false;
+
+    if (!SetVersionNumber(&meta_table, kCurrentVersion) ||
+        !SetCompatibleVersionNumber(&meta_table, kCompatibleVersion)) {
+      return false;
+    }
+
+    if (!transaction.Commit())
+      return false;
+  }
+
+  return true;
+}
+
+// static
+std::string PrefetchStoreSchema::GetItemTableCreationSqlForTesting() {
+  return kItemsTableCreationSql;
+}
+
+}  // namespace offline_pages
diff --git a/components/offline_pages/core/prefetch/store/prefetch_store_schema.h b/components/offline_pages/core/prefetch/store/prefetch_store_schema.h
new file mode 100644
index 0000000..e5da175
--- /dev/null
+++ b/components/offline_pages/core/prefetch/store/prefetch_store_schema.h
@@ -0,0 +1,34 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef COMPONENTS_OFFLINE_PAGES_CORE_PREFETCH_STORE_PREFETCH_STORE_SCHEMA_H_
+#define COMPONENTS_OFFLINE_PAGES_CORE_PREFETCH_STORE_PREFETCH_STORE_SCHEMA_H_
+
+#include <string>
+
+namespace sql {
+class Connection;
+}
+
+namespace offline_pages {
+
+// Maintains the schema of the prefetch database, ensuring creation and upgrades
+// from any and all previous database versions to the latest.
+class PrefetchStoreSchema {
+ public:
+  static const int kCurrentVersion;
+  static const int kCompatibleVersion;
+
+  // Creates or upgrade the database schema as needed from information stored in
+  // a metadata table. Returns |true| if the database is ready to be used,
+  // |false| if creation or upgrades failed.
+  static bool CreateOrUpgradeIfNeeded(sql::Connection* db);
+
+  // Returns the current items table creation SQL command for test usage.
+  static std::string GetItemTableCreationSqlForTesting();
+};
+
+}  // namespace offline_pages
+
+#endif  // COMPONENTS_OFFLINE_PAGES_CORE_PREFETCH_STORE_PREFETCH_STORE_SCHEMA_H_
diff --git a/components/offline_pages/core/prefetch/store/prefetch_store_schema_unittest.cc b/components/offline_pages/core/prefetch/store/prefetch_store_schema_unittest.cc
new file mode 100644
index 0000000..a7a383a
--- /dev/null
+++ b/components/offline_pages/core/prefetch/store/prefetch_store_schema_unittest.cc
@@ -0,0 +1,289 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "components/offline_pages/core/prefetch/store/prefetch_store_schema.h"
+
+#include <limits>
+
+#include "base/memory/ptr_util.h"
+#include "sql/connection.h"
+#include "sql/meta_table.h"
+#include "sql/statement.h"
+#include "sql/transaction.h"
+#include "testing/gtest/include/gtest/gtest.h"
+
+namespace offline_pages {
+
+static const char kSomeTableCreationSql[] =
+    "CREATE TABLE some_table "
+    "(id INTEGER PRIMARY KEY NOT NULL,"
+    " value INTEGER NOT NULL)";
+
+static const char kAnotherTableCreationSql[] =
+    "CREATE TABLE another_table "
+    "(id INTEGER PRIMARY KEY NOT NULL,"
+    " name VARCHAR NOT NULL)";
+
+TEST(PrefetchStoreSchemaPreconditionTest,
+     TestSqliteCreateTableIsTransactional) {
+  sql::Connection db;
+  ASSERT_TRUE(db.OpenInMemory());
+
+  sql::Transaction transaction(&db);
+  ASSERT_TRUE(transaction.Begin());
+  EXPECT_TRUE(db.Execute(kSomeTableCreationSql));
+  EXPECT_TRUE(db.Execute(kAnotherTableCreationSql));
+  transaction.Rollback();
+
+  EXPECT_FALSE(db.DoesTableExist("some_table"));
+  EXPECT_FALSE(db.DoesTableExist("another_table"));
+}
+
+TEST(PrefetchStoreSchemaPreconditionTest, TestSqliteDropTableIsTransactional) {
+  sql::Connection db;
+  ASSERT_TRUE(db.OpenInMemory());
+  EXPECT_TRUE(db.Execute(kSomeTableCreationSql));
+  EXPECT_TRUE(db.Execute(kAnotherTableCreationSql));
+
+  sql::Transaction transaction(&db);
+  ASSERT_TRUE(transaction.Begin());
+  EXPECT_TRUE(db.Execute("DROP TABLE some_table"));
+  EXPECT_TRUE(db.Execute("DROP TABLE another_table"));
+  transaction.Rollback();
+
+  EXPECT_TRUE(db.DoesTableExist("some_table"));
+  EXPECT_TRUE(db.DoesTableExist("another_table"));
+}
+
+TEST(PrefetchStoreSchemaPreconditionTest, TestSqliteAlterTableIsTransactional) {
+  sql::Connection db;
+  ASSERT_TRUE(db.OpenInMemory());
+  EXPECT_TRUE(db.Execute(kSomeTableCreationSql));
+
+  sql::Transaction transaction(&db);
+  ASSERT_TRUE(transaction.Begin());
+  EXPECT_TRUE(db.Execute("ALTER TABLE some_table ADD new_column VARCHAR NULL"));
+  EXPECT_TRUE(db.Execute("ALTER TABLE some_table RENAME TO another_table"));
+  transaction.Rollback();
+
+  EXPECT_TRUE(db.DoesTableExist("some_table"));
+  EXPECT_FALSE(db.DoesColumnExist("some_table", "new_column"));
+  EXPECT_FALSE(db.DoesTableExist("another_table"));
+}
+
+TEST(PrefetchStoreSchemaPreconditionTest,
+     TestCommonMigrationCodeIsTransactional) {
+  sql::Connection db;
+  ASSERT_TRUE(db.OpenInMemory());
+  EXPECT_TRUE(db.Execute(kSomeTableCreationSql));
+
+  sql::Transaction transaction(&db);
+  ASSERT_TRUE(transaction.Begin());
+  EXPECT_TRUE(db.Execute("ALTER TABLE some_table RENAME TO another_table"));
+  EXPECT_TRUE(db.Execute(kSomeTableCreationSql));
+  EXPECT_TRUE(db.Execute("DROP TABLE another_table"));
+  transaction.Rollback();
+
+  EXPECT_TRUE(db.DoesTableExist("some_table"));
+  EXPECT_FALSE(db.DoesTableExist("another_table"));
+  EXPECT_TRUE(db.DoesColumnExist("some_table", "value"));
+}
+
+class PrefetchStoreSchemaTest : public testing::Test {
+ public:
+  PrefetchStoreSchemaTest() = default;
+  ~PrefetchStoreSchemaTest() override = default;
+
+  void SetUp() override {
+    db_ = base::MakeUnique<sql::Connection>();
+    ASSERT_TRUE(db_->OpenInMemory());
+    ASSERT_FALSE(sql::MetaTable::DoesTableExist(db_.get()));
+  }
+
+  void CheckTablesExistence() {
+    EXPECT_TRUE(db_->DoesTableExist("prefetch_items"));
+    EXPECT_TRUE(db_->DoesTableExist("prefetch_downloader_quota"));
+    EXPECT_FALSE(db_->DoesTableExist("prefetch_items_old"));
+  }
+
+ protected:
+  std::unique_ptr<sql::Connection> db_;
+  std::unique_ptr<PrefetchStoreSchema> schema_;
+};
+
+TEST_F(PrefetchStoreSchemaTest, TestSchemaCreationFromNothing) {
+  EXPECT_TRUE(PrefetchStoreSchema::CreateOrUpgradeIfNeeded(db_.get()));
+  CheckTablesExistence();
+  sql::MetaTable meta_table;
+  EXPECT_TRUE(meta_table.Init(db_.get(), std::numeric_limits<int>::max(),
+                              std::numeric_limits<int>::max()));
+  EXPECT_EQ(PrefetchStoreSchema::kCurrentVersion,
+            meta_table.GetVersionNumber());
+  EXPECT_EQ(PrefetchStoreSchema::kCompatibleVersion,
+            meta_table.GetCompatibleVersionNumber());
+}
+
+TEST_F(PrefetchStoreSchemaTest, TestMissingTablesAreCreatedAtLatestVersion) {
+  sql::MetaTable meta_table;
+  EXPECT_TRUE(meta_table.Init(db_.get(), PrefetchStoreSchema::kCurrentVersion,
+                              PrefetchStoreSchema::kCompatibleVersion));
+  EXPECT_EQ(PrefetchStoreSchema::kCurrentVersion,
+            meta_table.GetVersionNumber());
+  EXPECT_EQ(PrefetchStoreSchema::kCompatibleVersion,
+            meta_table.GetCompatibleVersionNumber());
+
+  EXPECT_TRUE(PrefetchStoreSchema::CreateOrUpgradeIfNeeded(db_.get()));
+  CheckTablesExistence();
+}
+
+TEST_F(PrefetchStoreSchemaTest, TestMissingTablesAreRecreated) {
+  EXPECT_TRUE(PrefetchStoreSchema::CreateOrUpgradeIfNeeded(db_.get()));
+  CheckTablesExistence();
+
+  EXPECT_TRUE(db_->Execute("DROP TABLE prefetch_items"));
+  EXPECT_TRUE(PrefetchStoreSchema::CreateOrUpgradeIfNeeded(db_.get()));
+  CheckTablesExistence();
+
+  EXPECT_TRUE(db_->Execute("DROP TABLE prefetch_downloader_quota"));
+  EXPECT_TRUE(PrefetchStoreSchema::CreateOrUpgradeIfNeeded(db_.get()));
+  CheckTablesExistence();
+}
+
+void CreateVersion1TablesWithSampleRows(sql::Connection* db) {
+  // Create version 1 tables.
+  const char kV0ItemsTableCreationSql[] =
+      "CREATE TABLE prefetch_items"
+      "(offline_id INTEGER PRIMARY KEY NOT NULL,"
+      " state INTEGER NOT NULL DEFAULT 0,"
+      " generate_bundle_attempts INTEGER NOT NULL DEFAULT 0,"
+      " get_operation_attempts INTEGER NOT NULL DEFAULT 0,"
+      " download_initiation_attempts INTEGER NOT NULL DEFAULT 0,"
+      " archive_body_length INTEGER_NOT_NULL DEFAULT -1,"
+      " creation_time INTEGER NOT NULL,"
+      " freshness_time INTEGER NOT NULL,"
+      " error_code INTEGER NOT NULL DEFAULT 0,"
+      " file_size INTEGER NOT NULL DEFAULT 0,"
+      " guid VARCHAR NOT NULL DEFAULT '',"
+      " client_namespace VARCHAR NOT NULL DEFAULT '',"
+      " client_id VARCHAR NOT NULL DEFAULT '',"
+      " requested_url VARCHAR NOT NULL DEFAULT '',"
+      " final_archived_url VARCHAR NOT NULL DEFAULT '',"
+      " operation_name VARCHAR NOT NULL DEFAULT '',"
+      " archive_body_name VARCHAR NOT NULL DEFAULT '',"
+      " title VARCHAR NOT NULL DEFAULT '',"
+      " file_path VARCHAR NOT NULL DEFAULT ''"
+      ")";
+  EXPECT_TRUE(db->Execute(kV0ItemsTableCreationSql));
+  const char kV0QuotaTableCreationSql[] =
+      "CREATE TABLE prefetch_downloader_quota"
+      "(quota_id INTEGER PRIMARY KEY NOT NULL DEFAULT 1,"
+      " update_time INTEGER NOT NULL,"
+      " available_quota INTEGER NOT NULL DEFAULT 0)";
+  EXPECT_TRUE(db->Execute(kV0QuotaTableCreationSql));
+
+  // Insert one row with artificial values into the items table.
+  const char kV0ItemInsertSql[] =
+      "INSERT INTO prefetch_items"
+      " (offline_id, state, generate_bundle_attempts, get_operation_attempts,"
+      "  download_initiation_attempts, archive_body_length, creation_time,"
+      "  freshness_time, error_code, file_size, guid, client_namespace,"
+      "  client_id, requested_url, final_archived_url, operation_name,"
+      "  archive_body_name, title, file_path)"
+      " VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)";
+  sql::Statement insertStatement1(db->GetUniqueStatement(kV0ItemInsertSql));
+  // Generates fake values for all integer columns starting at 1.
+  for (int i = 0; i <= 9; ++i)
+    insertStatement1.BindInt(i, i + 1);
+  // Generates fake values for all string columns starting at "a".
+  for (int i = 10; i <= 18; ++i)
+    insertStatement1.BindString(i, std::string(1, 'a' + i - 10));
+  EXPECT_TRUE(insertStatement1.Run());
+
+  // Insert one row with artificial values into the quota table.
+  const char kV0QuotaInsertSql[] =
+      "INSERT INTO prefetch_downloader_quota"
+      " (quota_id, update_time, available_quota)"
+      " VALUES (?, ?, ?)";
+  sql::Statement insertStatement2(db->GetUniqueStatement(kV0QuotaInsertSql));
+  // Generates fake values for all columns.
+  insertStatement2.BindInt(0, 1);
+  insertStatement2.BindInt(1, 2);
+  insertStatement2.BindInt(2, 3);
+  EXPECT_TRUE(insertStatement2.Run());
+}
+
+void CheckSampleRowsAtCurrentVersion(sql::Connection* db) {
+  // Checks the previously inserted item row was migrated correctly.
+  const char kV0ItemSelectSql[] =
+      "SELECT "
+      " offline_id, state, generate_bundle_attempts, get_operation_attempts,"
+      "  download_initiation_attempts, archive_body_length, creation_time,"
+      "  freshness_time, error_code, file_size, guid, client_namespace,"
+      "  client_id, requested_url, final_archived_url, operation_name,"
+      "  archive_body_name, title, file_path"
+      " FROM prefetch_items";
+  sql::Statement selectStatement1(db->GetUniqueStatement(kV0ItemSelectSql));
+  ASSERT_TRUE(selectStatement1.Step());
+  // Checks fake values for all integer columns.
+  for (int i = 0; i <= 9; ++i)
+    EXPECT_EQ(i + 1, selectStatement1.ColumnInt(i))
+        << "Wrong integer value at items table's column " << i;
+  // Checks fake values for all string columns.
+  for (int i = 10; i <= 18; ++i)
+    EXPECT_EQ(std::string(1, 'a' + i - 10), selectStatement1.ColumnString(i))
+        << "Wrong string value at items table's column " << i;
+  ;
+  EXPECT_FALSE(selectStatement1.Step());
+
+  // Checks the previously inserted quota row was migrated correctly.
+  const char kV0QuotaSelectSql[] =
+      "SELECT quota_id, update_time, available_quota"
+      " FROM prefetch_downloader_quota";
+  sql::Statement selectStatement2(db->GetUniqueStatement(kV0QuotaSelectSql));
+  ASSERT_TRUE(selectStatement2.Step());
+  // Checks fake values for all columns.
+  EXPECT_EQ(1, selectStatement2.ColumnInt(0));
+  EXPECT_EQ(2, selectStatement2.ColumnInt(1));
+  EXPECT_EQ(3, selectStatement2.ColumnInt(2));
+  EXPECT_FALSE(selectStatement2.Step());
+}
+
+// Tests that a migration from the initially deployed version of the schema,
+// as it was for chromium/src at 90113a2c01ca9ff77042daacd8282a4c16aade85, is
+// correctly migrated to the final, current version without losing data.
+TEST_F(PrefetchStoreSchemaTest, TestMigrationFromV0) {
+  // Set version numbers to 1.
+  sql::MetaTable meta_table;
+  EXPECT_TRUE(meta_table.Init(db_.get(), 1, 1));
+  EXPECT_EQ(1, meta_table.GetVersionNumber());
+  EXPECT_EQ(1, meta_table.GetCompatibleVersionNumber());
+
+  CreateVersion1TablesWithSampleRows(db_.get());
+
+  // Executes the migration.
+  EXPECT_TRUE(PrefetchStoreSchema::CreateOrUpgradeIfNeeded(db_.get()));
+  EXPECT_EQ(2, meta_table.GetVersionNumber());
+  EXPECT_EQ(1, meta_table.GetCompatibleVersionNumber());
+  CheckTablesExistence();
+
+  CheckSampleRowsAtCurrentVersion(db_.get());
+
+  // Tests that the default value for file size is now -1.
+  sql::Statement fileSizeInsertStatement(db_->GetUniqueStatement(
+      "INSERT INTO prefetch_items (offline_id, creation_time, freshness_time)"
+      " VALUES (?, ?, ?)"));
+  fileSizeInsertStatement.BindInt(0, 100);
+  fileSizeInsertStatement.BindInt(1, 101);
+  fileSizeInsertStatement.BindInt(2, 102);
+  EXPECT_TRUE(fileSizeInsertStatement.Run());
+
+  sql::Statement fileSizeSelectStatement(db_->GetUniqueStatement(
+      "SELECT file_size FROM prefetch_items WHERE offline_id = ?"));
+  fileSizeSelectStatement.BindInt(0, 100);
+  ASSERT_TRUE(fileSizeSelectStatement.Step());
+  EXPECT_EQ(-1, fileSizeSelectStatement.ColumnInt(0));
+  EXPECT_FALSE(fileSizeSelectStatement.Step());
+}
+
+}  // namespace offline_pages
diff --git a/components/password_manager/core/browser/android_affiliation/affiliation_fetcher_unittest.cc b/components/password_manager/core/browser/android_affiliation/affiliation_fetcher_unittest.cc
index b1c516e..a72b8bd 100644
--- a/components/password_manager/core/browser/android_affiliation/affiliation_fetcher_unittest.cc
+++ b/components/password_manager/core/browser/android_affiliation/affiliation_fetcher_unittest.cc
@@ -56,7 +56,7 @@
  public:
   AffiliationFetcherTest()
       : request_context_getter_(new net::TestURLRequestContextGetter(
-            make_scoped_refptr(new base::NullTaskRunner))) {}
+            base::MakeRefCounted<base::NullTaskRunner>())) {}
 
   ~AffiliationFetcherTest() override {}
 
diff --git a/components/policy/core/browser/url_blacklist_manager.cc b/components/policy/core/browser/url_blacklist_manager.cc
index fa97e73..21a2802 100644
--- a/components/policy/core/browser/url_blacklist_manager.cc
+++ b/components/policy/core/browser/url_blacklist_manager.cc
@@ -447,7 +447,8 @@
 
   // Start enforcing the policies without a delay when they are present at
   // startup.
-  if (pref_service_->HasPrefPath(policy_prefs::kUrlBlacklist))
+  if (pref_service_->HasPrefPath(policy_prefs::kUrlBlacklist) ||
+      pref_service_->HasPrefPath(policy_prefs::kUrlWhitelist))
     Update();
 }
 
diff --git a/components/policy/core/browser/url_blacklist_manager_unittest.cc b/components/policy/core/browser/url_blacklist_manager_unittest.cc
index bf6d7f39..9b5f783 100644
--- a/components/policy/core/browser/url_blacklist_manager_unittest.cc
+++ b/components/policy/core/browser/url_blacklist_manager_unittest.cc
@@ -222,6 +222,32 @@
   EXPECT_EQ(GetParam().path(), path);
 }
 
+TEST_F(URLBlacklistManagerTest, LoadBlacklistOnCreate) {
+  auto list = base::MakeUnique<base::ListValue>();
+  list->AppendString("example.com");
+  pref_service_.SetManagedPref(policy_prefs::kUrlBlacklist, std::move(list));
+  auto manager = base::MakeUnique<URLBlacklistManager>(
+      &pref_service_, base::ThreadTaskRunnerHandle::Get(),
+      base::ThreadTaskRunnerHandle::Get(),
+      URLBlacklistManager::OverrideBlacklistCallback());
+  base::RunLoop().RunUntilIdle();
+  EXPECT_EQ(URLBlacklist::URL_IN_BLACKLIST,
+            manager->GetURLBlacklistState(GURL("http://example.com")));
+}
+
+TEST_F(URLBlacklistManagerTest, LoadWhitelistOnCreate) {
+  auto list = base::MakeUnique<base::ListValue>();
+  list->AppendString("example.com");
+  pref_service_.SetManagedPref(policy_prefs::kUrlWhitelist, std::move(list));
+  auto manager = base::MakeUnique<URLBlacklistManager>(
+      &pref_service_, base::ThreadTaskRunnerHandle::Get(),
+      base::ThreadTaskRunnerHandle::Get(),
+      URLBlacklistManager::OverrideBlacklistCallback());
+  base::RunLoop().RunUntilIdle();
+  EXPECT_EQ(URLBlacklist::URL_IN_WHITELIST,
+            manager->GetURLBlacklistState(GURL("http://example.com")));
+}
+
 TEST_F(URLBlacklistManagerTest, SingleUpdateForTwoPrefChanges) {
   auto blacklist = base::MakeUnique<base::ListValue>();
   blacklist->AppendString("*.google.com");
diff --git a/components/policy/core/common/cloud/component_cloud_policy_store_unittest.cc b/components/policy/core/common/cloud/component_cloud_policy_store_unittest.cc
index cbe231ed..1e750a8 100644
--- a/components/policy/core/common/cloud/component_cloud_policy_store_unittest.cc
+++ b/components/policy/core/common/cloud/component_cloud_policy_store_unittest.cc
@@ -99,7 +99,7 @@
     ASSERT_TRUE(temp_dir_.CreateUniqueTempDir());
     cache_.reset(
         new ResourceCache(temp_dir_.GetPath(),
-                          make_scoped_refptr(new base::TestSimpleTaskRunner)));
+                          base::MakeRefCounted<base::TestSimpleTaskRunner>()));
     store_.reset(new ComponentCloudPolicyStore(&store_delegate_, cache_.get()));
     store_->SetCredentials(ComponentPolicyBuilder::kFakeUsername,
                            ComponentPolicyBuilder::kFakeToken,
diff --git a/components/policy/core/common/cloud/policy_header_io_helper_unittest.cc b/components/policy/core/common/cloud/policy_header_io_helper_unittest.cc
index 35c31ef..8ac0e96b 100644
--- a/components/policy/core/common/cloud/policy_header_io_helper_unittest.cc
+++ b/components/policy/core/common/cloud/policy_header_io_helper_unittest.cc
@@ -25,7 +25,7 @@
 class PolicyHeaderIOHelperTest : public testing::Test {
  public:
   PolicyHeaderIOHelperTest() {
-    task_runner_ = make_scoped_refptr(new base::TestSimpleTaskRunner());
+    task_runner_ = base::MakeRefCounted<base::TestSimpleTaskRunner>();
   }
   ~PolicyHeaderIOHelperTest() override {}
 
diff --git a/components/policy/core/common/cloud/policy_header_service_unittest.cc b/components/policy/core/common/cloud/policy_header_service_unittest.cc
index a4c0073..71251c71 100644
--- a/components/policy/core/common/cloud/policy_header_service_unittest.cc
+++ b/components/policy/core/common/cloud/policy_header_service_unittest.cc
@@ -40,7 +40,7 @@
 class PolicyHeaderServiceTest : public testing::Test {
  public:
   PolicyHeaderServiceTest() {
-    task_runner_ = make_scoped_refptr(new base::TestSimpleTaskRunner());
+    task_runner_ = base::MakeRefCounted<base::TestSimpleTaskRunner>();
   }
   ~PolicyHeaderServiceTest() override {}
 
diff --git a/components/policy/core/common/cloud/resource_cache_unittest.cc b/components/policy/core/common/cloud/resource_cache_unittest.cc
index 2da7457..c2a2cc77 100644
--- a/components/policy/core/common/cloud/resource_cache_unittest.cc
+++ b/components/policy/core/common/cloud/resource_cache_unittest.cc
@@ -36,7 +36,7 @@
   base::ScopedTempDir temp_dir;
   ASSERT_TRUE(temp_dir.CreateUniqueTempDir());
   ResourceCache cache(temp_dir.GetPath(),
-                      make_scoped_refptr(new base::TestSimpleTaskRunner));
+                      base::MakeRefCounted<base::TestSimpleTaskRunner>());
 
   // No data initially.
   std::string data;
@@ -118,7 +118,7 @@
   base::ScopedTempDir temp_dir;
   ASSERT_TRUE(temp_dir.CreateUniqueTempDir());
   ResourceCache cache(temp_dir.GetPath(),
-                      make_scoped_refptr(new base::TestSimpleTaskRunner));
+                      base::MakeRefCounted<base::TestSimpleTaskRunner>());
 
   // Store some data.
   EXPECT_TRUE(cache.Store(kKey1, kSubA, kData0));
diff --git a/components/policy/core/common/config_dir_policy_loader.cc b/components/policy/core/common/config_dir_policy_loader.cc
index 5b5c0d5..c95e9098 100644
--- a/components/policy/core/common/config_dir_policy_loader.cc
+++ b/components/policy/core/common/config_dir_policy_loader.cc
@@ -28,9 +28,9 @@
 namespace {
 
 // Subdirectories that contain the mandatory and recommended policies.
-const base::FilePath::CharType kMandatoryConfigDir[] =
+constexpr base::FilePath::CharType kMandatoryConfigDir[] =
     FILE_PATH_LITERAL("managed");
-const base::FilePath::CharType kRecommendedConfigDir[] =
+constexpr base::FilePath::CharType kRecommendedConfigDir[] =
     FILE_PATH_LITERAL("recommended");
 
 PolicyLoadStatus JsonErrorToPolicyLoadStatus(int status) {
@@ -93,9 +93,8 @@
 }
 
 base::Time ConfigDirPolicyLoader::LastModificationTime() {
-  static const base::FilePath::CharType* kConfigDirSuffixes[] = {
-    kMandatoryConfigDir,
-    kRecommendedConfigDir,
+  static constexpr const base::FilePath::CharType* kConfigDirSuffixes[] = {
+      kMandatoryConfigDir, kRecommendedConfigDir,
   };
 
   base::Time last_modification = base::Time();
diff --git a/components/policy/resources/policy_templates.json b/components/policy/resources/policy_templates.json
index 14d07ed..c1e6ed58 100644
--- a/components/policy/resources/policy_templates.json
+++ b/components/policy/resources/policy_templates.json
@@ -2546,8 +2546,7 @@
               },
             },
           },
-          'future': True,
-          'supported_on': ['chrome.*:40-', 'chrome_os:40-'],
+          'supported_on': ['chrome.*:62-', 'chrome_os:62-'],
           'features': {
             'dynamic_refresh': True,
             'per_profile': True,
@@ -2610,9 +2609,6 @@
           <ph name="BLOCKED_INSTALL_MESSAGE">"blocked_install_message"</ph>: If a user tries to install an extension, but it is blocked by policy the Chrome Webstore displays a generic error message. This setting allows you to append text to the error message. This could be be used to direct users to your help desk, explain why a particular extension is blocked, or something else. This error message will be truncated if longer than 1000 characters.
           <ph name="RUNTIME_BLOCKED_HOSTS">"runtime_blocked_hosts"</ph>: Accepts a list of hosts that an extension will be blocked from interacting with. This includes injecting javascript, altering and viewing webRequests / webNavigation, viewing and altering cookies. The format is similar to Match Patterns <ph name="LINK_TO_MATCH_PATTERNS">https://developer.chrome.com/extensions/match_patterns</ph> except no paths may be defined. e.g. "*://*.example.com". This also supports effective TLD wildcarding e.g. "*://example.*".
           <ph name="RUNTIME_ALLOWED_HOSTS">"runtime_allowed_hosts"</ph>: Accepts a list of hosts that an extension can interact with regardless of whether they are listed in <ph name="RUNTIME_BLOCKED_HOSTS">"runtime_blocked_hosts"</ph>. This is the same format as <ph name="RUNTIME_BLOCKED_HOSTS">"runtime_blocked_hosts"</ph>.
-
-
-          This policy isn't ready for usage yet, please don't use it.
           '''
         },
       ],
diff --git a/components/sync/engine_impl/sync_scheduler_impl_unittest.cc b/components/sync/engine_impl/sync_scheduler_impl_unittest.cc
index 5082dd3a..92a44337 100644
--- a/components/sync/engine_impl/sync_scheduler_impl_unittest.cc
+++ b/components/sync/engine_impl/sync_scheduler_impl_unittest.cc
@@ -122,9 +122,9 @@
     extensions_activity_ = new ExtensionsActivity();
 
     workers_.clear();
-    workers_.push_back(make_scoped_refptr(new FakeModelWorker(GROUP_UI)));
-    workers_.push_back(make_scoped_refptr(new FakeModelWorker(GROUP_DB)));
-    workers_.push_back(make_scoped_refptr(new FakeModelWorker(GROUP_PASSIVE)));
+    workers_.push_back(base::MakeRefCounted<FakeModelWorker>(GROUP_UI));
+    workers_.push_back(base::MakeRefCounted<FakeModelWorker>(GROUP_DB));
+    workers_.push_back(base::MakeRefCounted<FakeModelWorker>(GROUP_PASSIVE));
 
     connection_ = std::make_unique<MockConnectionManager>(directory(),
                                                           &cancelation_signal_);
diff --git a/components/viz/common/frame_sinks/begin_frame_source_unittest.cc b/components/viz/common/frame_sinks/begin_frame_source_unittest.cc
index 0b64624..9332ccc 100644
--- a/components/viz/common/frame_sinks/begin_frame_source_unittest.cc
+++ b/components/viz/common/frame_sinks/begin_frame_source_unittest.cc
@@ -47,7 +47,7 @@
     now_src_.reset(new base::SimpleTestTickClock());
     now_src_->Advance(base::TimeDelta::FromMicroseconds(1000));
     task_runner_ =
-        make_scoped_refptr(new OrderedSimpleTaskRunner(now_src_.get(), false));
+        base::MakeRefCounted<OrderedSimpleTaskRunner>(now_src_.get(), false);
     std::unique_ptr<FakeDelayBasedTimeSource> time_source(
         new FakeDelayBasedTimeSource(now_src_.get(), task_runner_.get()));
     delay_based_time_source_ = time_source.get();
@@ -344,7 +344,7 @@
     now_src_.reset(new base::SimpleTestTickClock());
     now_src_->Advance(base::TimeDelta::FromMicroseconds(1000));
     task_runner_ =
-        make_scoped_refptr(new OrderedSimpleTaskRunner(now_src_.get(), false));
+        base::MakeRefCounted<OrderedSimpleTaskRunner>(now_src_.get(), false);
     std::unique_ptr<DelayBasedTimeSource> time_source(
         new FakeDelayBasedTimeSource(now_src_.get(), task_runner_.get()));
     time_source->SetTimebaseAndInterval(
diff --git a/components/viz/common/frame_sinks/delay_based_time_source_unittest.cc b/components/viz/common/frame_sinks/delay_based_time_source_unittest.cc
index be4437d..5cb092b 100644
--- a/components/viz/common/frame_sinks/delay_based_time_source_unittest.cc
+++ b/components/viz/common/frame_sinks/delay_based_time_source_unittest.cc
@@ -22,7 +22,7 @@
  protected:
   void SetUp() override {
     now_src_ = base::MakeUnique<base::SimpleTestTickClock>();
-    task_runner_ = make_scoped_refptr(new base::TestSimpleTaskRunner);
+    task_runner_ = base::MakeRefCounted<base::TestSimpleTaskRunner>();
     delay_based_time_source_ = base::MakeUnique<FakeDelayBasedTimeSource>(
         now_src_.get(), task_runner_.get());
     delay_based_time_source_->SetClient(&client_);
diff --git a/components/viz/service/display/gl_renderer.cc b/components/viz/service/display/gl_renderer.cc
index 4aa726e..1549e00 100644
--- a/components/viz/service/display/gl_renderer.cc
+++ b/components/viz/service/display/gl_renderer.cc
@@ -566,7 +566,7 @@
     read_lock_fence = current_sync_query_->Begin();
   } else {
     read_lock_fence =
-        make_scoped_refptr(new cc::ResourceProvider::SynchronousFence(gl_));
+        base::MakeRefCounted<cc::ResourceProvider::SynchronousFence>(gl_);
   }
   resource_provider_->SetReadLockFence(read_lock_fence.get());
 
diff --git a/components/viz/service/display/skia_renderer.cc b/components/viz/service/display/skia_renderer.cc
index cf678270..048e108 100644
--- a/components/viz/service/display/skia_renderer.cc
+++ b/components/viz/service/display/skia_renderer.cc
@@ -95,8 +95,8 @@
     NOTIMPLEMENTED();
   } else {
     read_lock_fence =
-        make_scoped_refptr(new cc::ResourceProvider::SynchronousFence(
-            output_surface_->context_provider()->ContextGL()));
+        base::MakeRefCounted<cc::ResourceProvider::SynchronousFence>(
+            output_surface_->context_provider()->ContextGL());
   }
   resource_provider_->SetReadLockFence(read_lock_fence.get());
 
diff --git a/components/viz/service/frame_sinks/frame_eviction_manager.cc b/components/viz/service/frame_sinks/frame_eviction_manager.cc
index d6ed398..c99b119 100644
--- a/components/viz/service/frame_sinks/frame_eviction_manager.cc
+++ b/components/viz/service/frame_sinks/frame_eviction_manager.cc
@@ -15,7 +15,6 @@
 #include "base/memory/shared_memory.h"
 #include "base/sys_info.h"
 #include "build/build_config.h"
-#include "components/viz/service/display_embedder/server_shared_bitmap_manager.h"
 
 namespace viz {
 namespace {
@@ -126,21 +125,11 @@
 #else
       std::min(5, 2 + (base::SysInfo::AmountOfPhysicalMemoryMB() / 256));
 #endif
-  max_handles_ = base::SharedMemory::GetHandleLimit() / 8.0f;
 }
 
 FrameEvictionManager::~FrameEvictionManager() {}
 
 void FrameEvictionManager::CullUnlockedFrames(size_t saved_frame_limit) {
-  if (unlocked_frames_.size() + locked_frames_.size() > 0) {
-    float handles_per_frame =
-        ServerSharedBitmapManager::current()->AllocatedBitmapCount() * 1.0f /
-        (unlocked_frames_.size() + locked_frames_.size());
-
-    saved_frame_limit = std::max(
-        1, static_cast<int>(std::min(static_cast<float>(saved_frame_limit),
-                                     max_handles_ / handles_per_frame)));
-  }
   while (!unlocked_frames_.empty() &&
          unlocked_frames_.size() + locked_frames_.size() > saved_frame_limit) {
     size_t old_size = unlocked_frames_.size();
diff --git a/components/viz/service/frame_sinks/frame_eviction_manager.h b/components/viz/service/frame_sinks/frame_eviction_manager.h
index 6e78277..81b9212 100644
--- a/components/viz/service/frame_sinks/frame_eviction_manager.h
+++ b/components/viz/service/frame_sinks/frame_eviction_manager.h
@@ -46,7 +46,6 @@
   void set_max_number_of_saved_frames(size_t max_number_of_saved_frames) {
     max_number_of_saved_frames_ = max_number_of_saved_frames;
   }
-  void set_max_handles(float max_handles) { max_handles_ = max_handles; }
 
   // React on memory pressure events to adjust the number of cached frames.
   // Please make this private when crbug.com/443824 has been fixed.
@@ -73,7 +72,6 @@
   std::map<FrameEvictionManagerClient*, size_t> locked_frames_;
   std::list<FrameEvictionManagerClient*> unlocked_frames_;
   size_t max_number_of_saved_frames_;
-  float max_handles_;
 
   DISALLOW_COPY_AND_ASSIGN(FrameEvictionManager);
 };
diff --git a/content/browser/background_fetch/background_fetch_cross_origin_filter_unittest.cc b/content/browser/background_fetch/background_fetch_cross_origin_filter_unittest.cc
index 5677d67c..980d287 100644
--- a/content/browser/background_fetch/background_fetch_cross_origin_filter_unittest.cc
+++ b/content/browser/background_fetch/background_fetch_cross_origin_filter_unittest.cc
@@ -37,8 +37,8 @@
           typename std::map<std::string, std::string>::value_type>
           response_headers) {
     scoped_refptr<BackgroundFetchRequestInfo> request_info =
-        make_scoped_refptr(new BackgroundFetchRequestInfo(
-            0 /* request_info */, ServiceWorkerFetchRequest()));
+        base::MakeRefCounted<BackgroundFetchRequestInfo>(
+            0 /* request_info */, ServiceWorkerFetchRequest());
 
     request_info->response_headers_ = response_headers;
     request_info->url_chain_ = {GURL(response_url)};
diff --git a/content/browser/background_fetch/mock_background_fetch_delegate.cc b/content/browser/background_fetch/mock_background_fetch_delegate.cc
index 29f3a85..21ed689 100644
--- a/content/browser/background_fetch/mock_background_fetch_delegate.cc
+++ b/content/browser/background_fetch/mock_background_fetch_delegate.cc
@@ -22,8 +22,8 @@
     int response_code)
     : response_(base::MakeUnique<TestResponse>()) {
   response_->succeeded_ = (response_code >= 200 && response_code < 300);
-  response_->headers = make_scoped_refptr(new net::HttpResponseHeaders(
-      "HTTP/1.1 " + std::to_string(response_code)));
+  response_->headers = base::MakeRefCounted<net::HttpResponseHeaders>(
+      "HTTP/1.1 " + std::to_string(response_code));
 }
 
 MockBackgroundFetchDelegate::TestResponseBuilder::~TestResponseBuilder() =
diff --git a/content/browser/compositor/gpu_process_transport_factory.cc b/content/browser/compositor/gpu_process_transport_factory.cc
index 35ed69c..12393f0 100644
--- a/content/browser/compositor/gpu_process_transport_factory.cc
+++ b/content/browser/compositor/gpu_process_transport_factory.cc
@@ -168,10 +168,10 @@
   constexpr bool automatic_flushes = false;
 
   GURL url("chrome://gpu/GpuProcessTransportFactory::CreateContextCommon");
-  return make_scoped_refptr(new ui::ContextProviderCommandBuffer(
+  return base::MakeRefCounted<ui::ContextProviderCommandBuffer>(
       std::move(gpu_channel_host), stream_id, stream_priority, surface_handle,
       url, automatic_flushes, support_locking, gpu::SharedMemoryLimits(),
-      attributes, shared_context_provider, type));
+      attributes, shared_context_provider, type);
 }
 
 #if defined(OS_MACOSX)
diff --git a/content/browser/devtools/devtools_url_interceptor_request_job.cc b/content/browser/devtools/devtools_url_interceptor_request_job.cc
index 9afeb06..46c2341 100644
--- a/content/browser/devtools/devtools_url_interceptor_request_job.cc
+++ b/content/browser/devtools/devtools_url_interceptor_request_job.cc
@@ -631,7 +631,7 @@
         modifications->modified_url.fromMaybe(redirect_->new_url.spec()));
     raw_headers.append(2, '\0');
     mock_response_details_.reset(new MockResponseDetails(
-        make_scoped_refptr(new net::HttpResponseHeaders(raw_headers)), "", 0,
+        base::MakeRefCounted<net::HttpResponseHeaders>(raw_headers), "", 0,
         base::TimeTicks::Now()));
     redirect_.reset();
 
diff --git a/content/browser/download/download_item_impl_unittest.cc b/content/browser/download/download_item_impl_unittest.cc
index 04e24e9..8d00725 100644
--- a/content/browser/download/download_item_impl_unittest.cc
+++ b/content/browser/download/download_item_impl_unittest.cc
@@ -281,8 +281,8 @@
   // Creates a new net::HttpResponseHeaders object for the |response_code|.
   scoped_refptr<const net::HttpResponseHeaders> CreateResponseHeaders(
       int response_code) {
-    return make_scoped_refptr(new net::HttpResponseHeaders(
-        "HTTP/1.1 " + std::to_string(response_code)));
+    return base::MakeRefCounted<net::HttpResponseHeaders>(
+        "HTTP/1.1 " + std::to_string(response_code));
   }
 
   // This class keeps ownership of the created download item; it will
diff --git a/content/browser/download/download_stats.cc b/content/browser/download/download_stats.cc
index 8485274..efc2c432 100644
--- a/content/browser/download/download_stats.cc
+++ b/content/browser/download/download_stats.cc
@@ -77,268 +77,138 @@
 // All of the download_file_types.asciipb entries should be in this list.
 // TODO(asanka): Replace this enum with calls to FileTypePolicies and move the
 // UMA metrics for dangerous/malicious downloads to //chrome/browser/download.
-const base::FilePath::CharType* kDangerousFileTypes[] = {
-  FILE_PATH_LITERAL(".ad"),
-  FILE_PATH_LITERAL(".ade"),
-  FILE_PATH_LITERAL(".adp"),
-  FILE_PATH_LITERAL(".ah"),
-  FILE_PATH_LITERAL(".apk"),
-  FILE_PATH_LITERAL(".app"),
-  FILE_PATH_LITERAL(".application"),
-  FILE_PATH_LITERAL(".asp"),
-  FILE_PATH_LITERAL(".asx"),
-  FILE_PATH_LITERAL(".bas"),
-  FILE_PATH_LITERAL(".bash"),
-  FILE_PATH_LITERAL(".bat"),
-  FILE_PATH_LITERAL(".cfg"),
-  FILE_PATH_LITERAL(".chi"),
-  FILE_PATH_LITERAL(".chm"),
-  FILE_PATH_LITERAL(".class"),
-  FILE_PATH_LITERAL(".cmd"),
-  FILE_PATH_LITERAL(".com"),
-  FILE_PATH_LITERAL(".command"),
-  FILE_PATH_LITERAL(".crt"),
-  FILE_PATH_LITERAL(".crx"),
-  FILE_PATH_LITERAL(".csh"),
-  FILE_PATH_LITERAL(".deb"),
-  FILE_PATH_LITERAL(".dex"),
-  FILE_PATH_LITERAL(".dll"),
-  FILE_PATH_LITERAL(".drv"),
-  FILE_PATH_LITERAL(".exe"),
-  FILE_PATH_LITERAL(".fxp"),
-  FILE_PATH_LITERAL(".grp"),
-  FILE_PATH_LITERAL(".hlp"),
-  FILE_PATH_LITERAL(".hta"),
-  FILE_PATH_LITERAL(".htm"),
-  FILE_PATH_LITERAL(".html"),
-  FILE_PATH_LITERAL(".htt"),
-  FILE_PATH_LITERAL(".inf"),
-  FILE_PATH_LITERAL(".ini"),
-  FILE_PATH_LITERAL(".ins"),
-  FILE_PATH_LITERAL(".isp"),
-  FILE_PATH_LITERAL(".jar"),
-  FILE_PATH_LITERAL(".jnlp"),
-  FILE_PATH_LITERAL(".user.js"),
-  FILE_PATH_LITERAL(".js"),
-  FILE_PATH_LITERAL(".jse"),
-  FILE_PATH_LITERAL(".ksh"),
-  FILE_PATH_LITERAL(".lnk"),
-  FILE_PATH_LITERAL(".local"),
-  FILE_PATH_LITERAL(".mad"),
-  FILE_PATH_LITERAL(".maf"),
-  FILE_PATH_LITERAL(".mag"),
-  FILE_PATH_LITERAL(".mam"),
-  FILE_PATH_LITERAL(".manifest"),
-  FILE_PATH_LITERAL(".maq"),
-  FILE_PATH_LITERAL(".mar"),
-  FILE_PATH_LITERAL(".mas"),
-  FILE_PATH_LITERAL(".mat"),
-  FILE_PATH_LITERAL(".mau"),
-  FILE_PATH_LITERAL(".mav"),
-  FILE_PATH_LITERAL(".maw"),
-  FILE_PATH_LITERAL(".mda"),
-  FILE_PATH_LITERAL(".mdb"),
-  FILE_PATH_LITERAL(".mde"),
-  FILE_PATH_LITERAL(".mdt"),
-  FILE_PATH_LITERAL(".mdw"),
-  FILE_PATH_LITERAL(".mdz"),
-  FILE_PATH_LITERAL(".mht"),
-  FILE_PATH_LITERAL(".mhtml"),
-  FILE_PATH_LITERAL(".mmc"),
-  FILE_PATH_LITERAL(".mof"),
-  FILE_PATH_LITERAL(".msc"),
-  FILE_PATH_LITERAL(".msh"),
-  FILE_PATH_LITERAL(".mshxml"),
-  FILE_PATH_LITERAL(".msi"),
-  FILE_PATH_LITERAL(".msp"),
-  FILE_PATH_LITERAL(".mst"),
-  FILE_PATH_LITERAL(".ocx"),
-  FILE_PATH_LITERAL(".ops"),
-  FILE_PATH_LITERAL(".pcd"),
-  FILE_PATH_LITERAL(".pif"),
-  FILE_PATH_LITERAL(".pkg"),
-  FILE_PATH_LITERAL(".pl"),
-  FILE_PATH_LITERAL(".plg"),
-  FILE_PATH_LITERAL(".prf"),
-  FILE_PATH_LITERAL(".prg"),
-  FILE_PATH_LITERAL(".pst"),
-  FILE_PATH_LITERAL(".py"),
-  FILE_PATH_LITERAL(".pyc"),
-  FILE_PATH_LITERAL(".pyw"),
-  FILE_PATH_LITERAL(".rb"),
-  FILE_PATH_LITERAL(".reg"),
-  FILE_PATH_LITERAL(".rpm"),
-  FILE_PATH_LITERAL(".scf"),
-  FILE_PATH_LITERAL(".scr"),
-  FILE_PATH_LITERAL(".sct"),
-  FILE_PATH_LITERAL(".sh"),
-  FILE_PATH_LITERAL(".shar"),
-  FILE_PATH_LITERAL(".shb"),
-  FILE_PATH_LITERAL(".shs"),
-  FILE_PATH_LITERAL(".shtm"),
-  FILE_PATH_LITERAL(".shtml"),
-  FILE_PATH_LITERAL(".spl"),
-  FILE_PATH_LITERAL(".svg"),
-  FILE_PATH_LITERAL(".swf"),
-  FILE_PATH_LITERAL(".sys"),
-  FILE_PATH_LITERAL(".tcsh"),
-  FILE_PATH_LITERAL(".url"),
-  FILE_PATH_LITERAL(".vb"),
-  FILE_PATH_LITERAL(".vbe"),
-  FILE_PATH_LITERAL(".vbs"),
-  FILE_PATH_LITERAL(".vsd"),
-  FILE_PATH_LITERAL(".vsmacros"),
-  FILE_PATH_LITERAL(".vss"),
-  FILE_PATH_LITERAL(".vst"),
-  FILE_PATH_LITERAL(".vsw"),
-  FILE_PATH_LITERAL(".ws"),
-  FILE_PATH_LITERAL(".wsc"),
-  FILE_PATH_LITERAL(".wsf"),
-  FILE_PATH_LITERAL(".wsh"),
-  FILE_PATH_LITERAL(".xbap"),
-  FILE_PATH_LITERAL(".xht"),
-  FILE_PATH_LITERAL(".xhtm"),
-  FILE_PATH_LITERAL(".xhtml"),
-  FILE_PATH_LITERAL(".xml"),
-  FILE_PATH_LITERAL(".xsl"),
-  FILE_PATH_LITERAL(".xslt"),
-  FILE_PATH_LITERAL(".website"),
-  FILE_PATH_LITERAL(".msh1"),
-  FILE_PATH_LITERAL(".msh2"),
-  FILE_PATH_LITERAL(".msh1xml"),
-  FILE_PATH_LITERAL(".msh2xml"),
-  FILE_PATH_LITERAL(".ps1"),
-  FILE_PATH_LITERAL(".ps1xml"),
-  FILE_PATH_LITERAL(".ps2"),
-  FILE_PATH_LITERAL(".ps2xml"),
-  FILE_PATH_LITERAL(".psc1"),
-  FILE_PATH_LITERAL(".psc2"),
-  FILE_PATH_LITERAL(".xnk"),
-  FILE_PATH_LITERAL(".appref-ms"),
-  FILE_PATH_LITERAL(".gadget"),
-  FILE_PATH_LITERAL(".efi"),
-  FILE_PATH_LITERAL(".fon"),
-  FILE_PATH_LITERAL(".partial"),
-  FILE_PATH_LITERAL(".svg"),
-  FILE_PATH_LITERAL(".xml"),
-  FILE_PATH_LITERAL(".xrm_ms"),
-  FILE_PATH_LITERAL(".xsl"),
-  FILE_PATH_LITERAL(".action"),
-  FILE_PATH_LITERAL(".bin"),
-  FILE_PATH_LITERAL(".inx"),
-  FILE_PATH_LITERAL(".ipa"),
-  FILE_PATH_LITERAL(".isu"),
-  FILE_PATH_LITERAL(".job"),
-  FILE_PATH_LITERAL(".out"),
-  FILE_PATH_LITERAL(".pad"),
-  FILE_PATH_LITERAL(".paf"),
-  FILE_PATH_LITERAL(".rgs"),
-  FILE_PATH_LITERAL(".u3p"),
-  FILE_PATH_LITERAL(".vbscript"),
-  FILE_PATH_LITERAL(".workflow"),
-  FILE_PATH_LITERAL(".001"),
-  FILE_PATH_LITERAL(".7z"),
-  FILE_PATH_LITERAL(".ace"),
-  FILE_PATH_LITERAL(".arc"),
-  FILE_PATH_LITERAL(".arj"),
-  FILE_PATH_LITERAL(".b64"),
-  FILE_PATH_LITERAL(".balz"),
-  FILE_PATH_LITERAL(".bhx"),
-  FILE_PATH_LITERAL(".bz"),
-  FILE_PATH_LITERAL(".bz2"),
-  FILE_PATH_LITERAL(".bzip2"),
-  FILE_PATH_LITERAL(".cab"),
-  FILE_PATH_LITERAL(".cpio"),
-  FILE_PATH_LITERAL(".fat"),
-  FILE_PATH_LITERAL(".gz"),
-  FILE_PATH_LITERAL(".gzip"),
-  FILE_PATH_LITERAL(".hfs"),
-  FILE_PATH_LITERAL(".hqx"),
-  FILE_PATH_LITERAL(".iso"),
-  FILE_PATH_LITERAL(".lha"),
-  FILE_PATH_LITERAL(".lpaq1"),
-  FILE_PATH_LITERAL(".lpaq5"),
-  FILE_PATH_LITERAL(".lpaq8"),
-  FILE_PATH_LITERAL(".lzh"),
-  FILE_PATH_LITERAL(".lzma"),
-  FILE_PATH_LITERAL(".mim"),
-  FILE_PATH_LITERAL(".ntfs"),
-  FILE_PATH_LITERAL(".paq8f"),
-  FILE_PATH_LITERAL(".paq8jd"),
-  FILE_PATH_LITERAL(".paq8l"),
-  FILE_PATH_LITERAL(".paq8o"),
-  FILE_PATH_LITERAL(".pea"),
-  FILE_PATH_LITERAL(".quad"),
-  FILE_PATH_LITERAL(".r00"),
-  FILE_PATH_LITERAL(".r01"),
-  FILE_PATH_LITERAL(".r02"),
-  FILE_PATH_LITERAL(".r03"),
-  FILE_PATH_LITERAL(".r04"),
-  FILE_PATH_LITERAL(".r05"),
-  FILE_PATH_LITERAL(".r06"),
-  FILE_PATH_LITERAL(".r07"),
-  FILE_PATH_LITERAL(".r08"),
-  FILE_PATH_LITERAL(".r09"),
-  FILE_PATH_LITERAL(".r10"),
-  FILE_PATH_LITERAL(".r11"),
-  FILE_PATH_LITERAL(".r12"),
-  FILE_PATH_LITERAL(".r13"),
-  FILE_PATH_LITERAL(".r14"),
-  FILE_PATH_LITERAL(".r15"),
-  FILE_PATH_LITERAL(".r16"),
-  FILE_PATH_LITERAL(".r17"),
-  FILE_PATH_LITERAL(".r18"),
-  FILE_PATH_LITERAL(".r19"),
-  FILE_PATH_LITERAL(".r20"),
-  FILE_PATH_LITERAL(".r21"),
-  FILE_PATH_LITERAL(".r22"),
-  FILE_PATH_LITERAL(".r23"),
-  FILE_PATH_LITERAL(".r24"),
-  FILE_PATH_LITERAL(".r25"),
-  FILE_PATH_LITERAL(".r26"),
-  FILE_PATH_LITERAL(".r27"),
-  FILE_PATH_LITERAL(".r28"),
-  FILE_PATH_LITERAL(".r29"),
-  FILE_PATH_LITERAL(".rar"),
-  FILE_PATH_LITERAL(".squashfs"),
-  FILE_PATH_LITERAL(".swm"),
-  FILE_PATH_LITERAL(".tar"),
-  FILE_PATH_LITERAL(".taz"),
-  FILE_PATH_LITERAL(".tbz"),
-  FILE_PATH_LITERAL(".tbz2"),
-  FILE_PATH_LITERAL(".tgz"),
-  FILE_PATH_LITERAL(".tpz"),
-  FILE_PATH_LITERAL(".txz"),
-  FILE_PATH_LITERAL(".tz"),
-  FILE_PATH_LITERAL(".udf"),
-  FILE_PATH_LITERAL(".uu"),
-  FILE_PATH_LITERAL(".uue"),
-  FILE_PATH_LITERAL(".vhd"),
-  FILE_PATH_LITERAL(".vmdk"),
-  FILE_PATH_LITERAL(".wim"),
-  FILE_PATH_LITERAL(".wrc"),
-  FILE_PATH_LITERAL(".xar"),
-  FILE_PATH_LITERAL(".xxe"),
-  FILE_PATH_LITERAL(".xz"),
-  FILE_PATH_LITERAL(".z"),
-  FILE_PATH_LITERAL(".zip"),
-  FILE_PATH_LITERAL(".zipx"),
-  FILE_PATH_LITERAL(".zpaq"),
-  FILE_PATH_LITERAL(".cdr"),
-  FILE_PATH_LITERAL(".dart"),
-  FILE_PATH_LITERAL(".dc42"),
-  FILE_PATH_LITERAL(".diskcopy42"),
-  FILE_PATH_LITERAL(".dmg"),
-  FILE_PATH_LITERAL(".dmgpart"),
-  FILE_PATH_LITERAL(".dvdr"),
-  FILE_PATH_LITERAL(".img"),
-  FILE_PATH_LITERAL(".imgpart"),
-  FILE_PATH_LITERAL(".ndif"),
-  FILE_PATH_LITERAL(".smi"),
-  FILE_PATH_LITERAL(".sparsebundle"),
-  FILE_PATH_LITERAL(".sparseimage"),
-  FILE_PATH_LITERAL(".toast"),
-  FILE_PATH_LITERAL(".udif"),
+constexpr const base::FilePath::CharType* kDangerousFileTypes[] = {
+    FILE_PATH_LITERAL(".ad"),          FILE_PATH_LITERAL(".ade"),
+    FILE_PATH_LITERAL(".adp"),         FILE_PATH_LITERAL(".ah"),
+    FILE_PATH_LITERAL(".apk"),         FILE_PATH_LITERAL(".app"),
+    FILE_PATH_LITERAL(".application"), FILE_PATH_LITERAL(".asp"),
+    FILE_PATH_LITERAL(".asx"),         FILE_PATH_LITERAL(".bas"),
+    FILE_PATH_LITERAL(".bash"),        FILE_PATH_LITERAL(".bat"),
+    FILE_PATH_LITERAL(".cfg"),         FILE_PATH_LITERAL(".chi"),
+    FILE_PATH_LITERAL(".chm"),         FILE_PATH_LITERAL(".class"),
+    FILE_PATH_LITERAL(".cmd"),         FILE_PATH_LITERAL(".com"),
+    FILE_PATH_LITERAL(".command"),     FILE_PATH_LITERAL(".crt"),
+    FILE_PATH_LITERAL(".crx"),         FILE_PATH_LITERAL(".csh"),
+    FILE_PATH_LITERAL(".deb"),         FILE_PATH_LITERAL(".dex"),
+    FILE_PATH_LITERAL(".dll"),         FILE_PATH_LITERAL(".drv"),
+    FILE_PATH_LITERAL(".exe"),         FILE_PATH_LITERAL(".fxp"),
+    FILE_PATH_LITERAL(".grp"),         FILE_PATH_LITERAL(".hlp"),
+    FILE_PATH_LITERAL(".hta"),         FILE_PATH_LITERAL(".htm"),
+    FILE_PATH_LITERAL(".html"),        FILE_PATH_LITERAL(".htt"),
+    FILE_PATH_LITERAL(".inf"),         FILE_PATH_LITERAL(".ini"),
+    FILE_PATH_LITERAL(".ins"),         FILE_PATH_LITERAL(".isp"),
+    FILE_PATH_LITERAL(".jar"),         FILE_PATH_LITERAL(".jnlp"),
+    FILE_PATH_LITERAL(".user.js"),     FILE_PATH_LITERAL(".js"),
+    FILE_PATH_LITERAL(".jse"),         FILE_PATH_LITERAL(".ksh"),
+    FILE_PATH_LITERAL(".lnk"),         FILE_PATH_LITERAL(".local"),
+    FILE_PATH_LITERAL(".mad"),         FILE_PATH_LITERAL(".maf"),
+    FILE_PATH_LITERAL(".mag"),         FILE_PATH_LITERAL(".mam"),
+    FILE_PATH_LITERAL(".manifest"),    FILE_PATH_LITERAL(".maq"),
+    FILE_PATH_LITERAL(".mar"),         FILE_PATH_LITERAL(".mas"),
+    FILE_PATH_LITERAL(".mat"),         FILE_PATH_LITERAL(".mau"),
+    FILE_PATH_LITERAL(".mav"),         FILE_PATH_LITERAL(".maw"),
+    FILE_PATH_LITERAL(".mda"),         FILE_PATH_LITERAL(".mdb"),
+    FILE_PATH_LITERAL(".mde"),         FILE_PATH_LITERAL(".mdt"),
+    FILE_PATH_LITERAL(".mdw"),         FILE_PATH_LITERAL(".mdz"),
+    FILE_PATH_LITERAL(".mht"),         FILE_PATH_LITERAL(".mhtml"),
+    FILE_PATH_LITERAL(".mmc"),         FILE_PATH_LITERAL(".mof"),
+    FILE_PATH_LITERAL(".msc"),         FILE_PATH_LITERAL(".msh"),
+    FILE_PATH_LITERAL(".mshxml"),      FILE_PATH_LITERAL(".msi"),
+    FILE_PATH_LITERAL(".msp"),         FILE_PATH_LITERAL(".mst"),
+    FILE_PATH_LITERAL(".ocx"),         FILE_PATH_LITERAL(".ops"),
+    FILE_PATH_LITERAL(".pcd"),         FILE_PATH_LITERAL(".pif"),
+    FILE_PATH_LITERAL(".pkg"),         FILE_PATH_LITERAL(".pl"),
+    FILE_PATH_LITERAL(".plg"),         FILE_PATH_LITERAL(".prf"),
+    FILE_PATH_LITERAL(".prg"),         FILE_PATH_LITERAL(".pst"),
+    FILE_PATH_LITERAL(".py"),          FILE_PATH_LITERAL(".pyc"),
+    FILE_PATH_LITERAL(".pyw"),         FILE_PATH_LITERAL(".rb"),
+    FILE_PATH_LITERAL(".reg"),         FILE_PATH_LITERAL(".rpm"),
+    FILE_PATH_LITERAL(".scf"),         FILE_PATH_LITERAL(".scr"),
+    FILE_PATH_LITERAL(".sct"),         FILE_PATH_LITERAL(".sh"),
+    FILE_PATH_LITERAL(".shar"),        FILE_PATH_LITERAL(".shb"),
+    FILE_PATH_LITERAL(".shs"),         FILE_PATH_LITERAL(".shtm"),
+    FILE_PATH_LITERAL(".shtml"),       FILE_PATH_LITERAL(".spl"),
+    FILE_PATH_LITERAL(".svg"),         FILE_PATH_LITERAL(".swf"),
+    FILE_PATH_LITERAL(".sys"),         FILE_PATH_LITERAL(".tcsh"),
+    FILE_PATH_LITERAL(".url"),         FILE_PATH_LITERAL(".vb"),
+    FILE_PATH_LITERAL(".vbe"),         FILE_PATH_LITERAL(".vbs"),
+    FILE_PATH_LITERAL(".vsd"),         FILE_PATH_LITERAL(".vsmacros"),
+    FILE_PATH_LITERAL(".vss"),         FILE_PATH_LITERAL(".vst"),
+    FILE_PATH_LITERAL(".vsw"),         FILE_PATH_LITERAL(".ws"),
+    FILE_PATH_LITERAL(".wsc"),         FILE_PATH_LITERAL(".wsf"),
+    FILE_PATH_LITERAL(".wsh"),         FILE_PATH_LITERAL(".xbap"),
+    FILE_PATH_LITERAL(".xht"),         FILE_PATH_LITERAL(".xhtm"),
+    FILE_PATH_LITERAL(".xhtml"),       FILE_PATH_LITERAL(".xml"),
+    FILE_PATH_LITERAL(".xsl"),         FILE_PATH_LITERAL(".xslt"),
+    FILE_PATH_LITERAL(".website"),     FILE_PATH_LITERAL(".msh1"),
+    FILE_PATH_LITERAL(".msh2"),        FILE_PATH_LITERAL(".msh1xml"),
+    FILE_PATH_LITERAL(".msh2xml"),     FILE_PATH_LITERAL(".ps1"),
+    FILE_PATH_LITERAL(".ps1xml"),      FILE_PATH_LITERAL(".ps2"),
+    FILE_PATH_LITERAL(".ps2xml"),      FILE_PATH_LITERAL(".psc1"),
+    FILE_PATH_LITERAL(".psc2"),        FILE_PATH_LITERAL(".xnk"),
+    FILE_PATH_LITERAL(".appref-ms"),   FILE_PATH_LITERAL(".gadget"),
+    FILE_PATH_LITERAL(".efi"),         FILE_PATH_LITERAL(".fon"),
+    FILE_PATH_LITERAL(".partial"),     FILE_PATH_LITERAL(".svg"),
+    FILE_PATH_LITERAL(".xml"),         FILE_PATH_LITERAL(".xrm_ms"),
+    FILE_PATH_LITERAL(".xsl"),         FILE_PATH_LITERAL(".action"),
+    FILE_PATH_LITERAL(".bin"),         FILE_PATH_LITERAL(".inx"),
+    FILE_PATH_LITERAL(".ipa"),         FILE_PATH_LITERAL(".isu"),
+    FILE_PATH_LITERAL(".job"),         FILE_PATH_LITERAL(".out"),
+    FILE_PATH_LITERAL(".pad"),         FILE_PATH_LITERAL(".paf"),
+    FILE_PATH_LITERAL(".rgs"),         FILE_PATH_LITERAL(".u3p"),
+    FILE_PATH_LITERAL(".vbscript"),    FILE_PATH_LITERAL(".workflow"),
+    FILE_PATH_LITERAL(".001"),         FILE_PATH_LITERAL(".7z"),
+    FILE_PATH_LITERAL(".ace"),         FILE_PATH_LITERAL(".arc"),
+    FILE_PATH_LITERAL(".arj"),         FILE_PATH_LITERAL(".b64"),
+    FILE_PATH_LITERAL(".balz"),        FILE_PATH_LITERAL(".bhx"),
+    FILE_PATH_LITERAL(".bz"),          FILE_PATH_LITERAL(".bz2"),
+    FILE_PATH_LITERAL(".bzip2"),       FILE_PATH_LITERAL(".cab"),
+    FILE_PATH_LITERAL(".cpio"),        FILE_PATH_LITERAL(".fat"),
+    FILE_PATH_LITERAL(".gz"),          FILE_PATH_LITERAL(".gzip"),
+    FILE_PATH_LITERAL(".hfs"),         FILE_PATH_LITERAL(".hqx"),
+    FILE_PATH_LITERAL(".iso"),         FILE_PATH_LITERAL(".lha"),
+    FILE_PATH_LITERAL(".lpaq1"),       FILE_PATH_LITERAL(".lpaq5"),
+    FILE_PATH_LITERAL(".lpaq8"),       FILE_PATH_LITERAL(".lzh"),
+    FILE_PATH_LITERAL(".lzma"),        FILE_PATH_LITERAL(".mim"),
+    FILE_PATH_LITERAL(".ntfs"),        FILE_PATH_LITERAL(".paq8f"),
+    FILE_PATH_LITERAL(".paq8jd"),      FILE_PATH_LITERAL(".paq8l"),
+    FILE_PATH_LITERAL(".paq8o"),       FILE_PATH_LITERAL(".pea"),
+    FILE_PATH_LITERAL(".quad"),        FILE_PATH_LITERAL(".r00"),
+    FILE_PATH_LITERAL(".r01"),         FILE_PATH_LITERAL(".r02"),
+    FILE_PATH_LITERAL(".r03"),         FILE_PATH_LITERAL(".r04"),
+    FILE_PATH_LITERAL(".r05"),         FILE_PATH_LITERAL(".r06"),
+    FILE_PATH_LITERAL(".r07"),         FILE_PATH_LITERAL(".r08"),
+    FILE_PATH_LITERAL(".r09"),         FILE_PATH_LITERAL(".r10"),
+    FILE_PATH_LITERAL(".r11"),         FILE_PATH_LITERAL(".r12"),
+    FILE_PATH_LITERAL(".r13"),         FILE_PATH_LITERAL(".r14"),
+    FILE_PATH_LITERAL(".r15"),         FILE_PATH_LITERAL(".r16"),
+    FILE_PATH_LITERAL(".r17"),         FILE_PATH_LITERAL(".r18"),
+    FILE_PATH_LITERAL(".r19"),         FILE_PATH_LITERAL(".r20"),
+    FILE_PATH_LITERAL(".r21"),         FILE_PATH_LITERAL(".r22"),
+    FILE_PATH_LITERAL(".r23"),         FILE_PATH_LITERAL(".r24"),
+    FILE_PATH_LITERAL(".r25"),         FILE_PATH_LITERAL(".r26"),
+    FILE_PATH_LITERAL(".r27"),         FILE_PATH_LITERAL(".r28"),
+    FILE_PATH_LITERAL(".r29"),         FILE_PATH_LITERAL(".rar"),
+    FILE_PATH_LITERAL(".squashfs"),    FILE_PATH_LITERAL(".swm"),
+    FILE_PATH_LITERAL(".tar"),         FILE_PATH_LITERAL(".taz"),
+    FILE_PATH_LITERAL(".tbz"),         FILE_PATH_LITERAL(".tbz2"),
+    FILE_PATH_LITERAL(".tgz"),         FILE_PATH_LITERAL(".tpz"),
+    FILE_PATH_LITERAL(".txz"),         FILE_PATH_LITERAL(".tz"),
+    FILE_PATH_LITERAL(".udf"),         FILE_PATH_LITERAL(".uu"),
+    FILE_PATH_LITERAL(".uue"),         FILE_PATH_LITERAL(".vhd"),
+    FILE_PATH_LITERAL(".vmdk"),        FILE_PATH_LITERAL(".wim"),
+    FILE_PATH_LITERAL(".wrc"),         FILE_PATH_LITERAL(".xar"),
+    FILE_PATH_LITERAL(".xxe"),         FILE_PATH_LITERAL(".xz"),
+    FILE_PATH_LITERAL(".z"),           FILE_PATH_LITERAL(".zip"),
+    FILE_PATH_LITERAL(".zipx"),        FILE_PATH_LITERAL(".zpaq"),
+    FILE_PATH_LITERAL(".cdr"),         FILE_PATH_LITERAL(".dart"),
+    FILE_PATH_LITERAL(".dc42"),        FILE_PATH_LITERAL(".diskcopy42"),
+    FILE_PATH_LITERAL(".dmg"),         FILE_PATH_LITERAL(".dmgpart"),
+    FILE_PATH_LITERAL(".dvdr"),        FILE_PATH_LITERAL(".img"),
+    FILE_PATH_LITERAL(".imgpart"),     FILE_PATH_LITERAL(".ndif"),
+    FILE_PATH_LITERAL(".smi"),         FILE_PATH_LITERAL(".sparsebundle"),
+    FILE_PATH_LITERAL(".sparseimage"), FILE_PATH_LITERAL(".toast"),
+    FILE_PATH_LITERAL(".udif"),
 };
 
 // The maximum size in KB for the file size metric, file size larger than this
diff --git a/content/browser/fileapi/file_system_operation_runner_unittest.cc b/content/browser/fileapi/file_system_operation_runner_unittest.cc
index e20a4e85..9f654ef 100644
--- a/content/browser/fileapi/file_system_operation_runner_unittest.cc
+++ b/content/browser/fileapi/file_system_operation_runner_unittest.cc
@@ -198,7 +198,7 @@
         base::ThreadTaskRunnerHandle::Get().get(),
         base::CreateSequencedTaskRunnerWithTraits({base::MayBlock()}).get(),
         storage::ExternalMountPoints::CreateRefCounted().get(),
-        make_scoped_refptr(new MockSpecialStoragePolicy()).get(), nullptr,
+        base::MakeRefCounted<MockSpecialStoragePolicy>().get(), nullptr,
         std::vector<std::unique_ptr<storage::FileSystemBackend>>(),
         std::vector<storage::URLRequestAutoMountHandler>(), base_dir,
         CreateAllowFileAccessOptions());
diff --git a/content/browser/frame_host/render_frame_host_impl.cc b/content/browser/frame_host/render_frame_host_impl.cc
index 3c19719..bf49a80 100644
--- a/content/browser/frame_host/render_frame_host_impl.cc
+++ b/content/browser/frame_host/render_frame_host_impl.cc
@@ -1261,8 +1261,20 @@
     }
   }
 
-  if (created && render_widget_host_)
+  if (created && render_widget_host_) {
+    mojom::WidgetPtr widget;
+    GetRemoteInterfaces()->GetInterface(&widget);
+    render_widget_host_->SetWidget(std::move(widget));
+
+    if (frame_input_handler_) {
+      mojom::WidgetInputHandlerAssociatedPtr widget_handler;
+      frame_input_handler_->GetWidgetInputHandler(
+          mojo::MakeRequest(&widget_handler));
+      render_widget_host_->SetWidgetInputHandler(std::move(widget_handler));
+    }
+
     render_widget_host_->InitForFrame();
+  }
 
   if (enabled_bindings_ && created) {
     if (!frame_bindings_control_)
diff --git a/content/browser/gpu/gpu_ipc_browsertests.cc b/content/browser/gpu/gpu_ipc_browsertests.cc
index afdc687..b547bd8 100644
--- a/content/browser/gpu/gpu_ipc_browsertests.cc
+++ b/content/browser/gpu/gpu_ipc_browsertests.cc
@@ -38,11 +38,11 @@
   attributes.bind_generates_resource = false;
   constexpr bool automatic_flushes = false;
   constexpr bool support_locking = false;
-  return make_scoped_refptr(new ui::ContextProviderCommandBuffer(
+  return base::MakeRefCounted<ui::ContextProviderCommandBuffer>(
       std::move(gpu_channel_host), content::kGpuStreamIdDefault,
       content::kGpuStreamPriorityDefault, gpu::kNullSurfaceHandle, GURL(),
       automatic_flushes, support_locking, gpu::SharedMemoryLimits(), attributes,
-      nullptr, ui::command_buffer_metrics::OFFSCREEN_CONTEXT_FOR_TESTING));
+      nullptr, ui::command_buffer_metrics::OFFSCREEN_CONTEXT_FOR_TESTING);
 }
 
 void OnEstablishedGpuChannel(
diff --git a/content/browser/loader/detachable_resource_handler_unittest.cc b/content/browser/loader/detachable_resource_handler_unittest.cc
index 38bf95f0..174ed5f2 100644
--- a/content/browser/loader/detachable_resource_handler_unittest.cc
+++ b/content/browser/loader/detachable_resource_handler_unittest.cc
@@ -155,10 +155,9 @@
   }
 
   MaybeSyncDetachAtPhase(DetachPhase::REQUEST_REDIRECTED);
-  ASSERT_EQ(
-      MockResourceLoader::Status::IDLE,
-      mock_loader_->OnRequestRedirected(
-          net::RedirectInfo(), make_scoped_refptr(new ResourceResponse())));
+  ASSERT_EQ(MockResourceLoader::Status::IDLE,
+            mock_loader_->OnRequestRedirected(
+                net::RedirectInfo(), base::MakeRefCounted<ResourceResponse>()));
   if (!WasDetachedBy(DetachPhase::REQUEST_REDIRECTED)) {
     EXPECT_EQ(1, test_handler_->on_request_redirected_called());
     EXPECT_EQ(0, test_handler_->on_response_started_called());
@@ -167,7 +166,7 @@
   MaybeSyncDetachAtPhase(DetachPhase::ON_RESPONSE_STARTED);
   ASSERT_EQ(MockResourceLoader::Status::IDLE,
             mock_loader_->OnResponseStarted(
-                make_scoped_refptr(new ResourceResponse())));
+                base::MakeRefCounted<ResourceResponse>()));
   if (!WasDetachedBy(DetachPhase::ON_RESPONSE_STARTED)) {
     EXPECT_EQ(1, test_handler_->on_request_redirected_called());
     EXPECT_EQ(1, test_handler_->on_response_started_called());
@@ -259,14 +258,14 @@
   MaybeAsyncDetachAt(DetachPhase::ON_WILL_START);
 
   mock_loader_->OnRequestRedirected(net::RedirectInfo(),
-                                    make_scoped_refptr(new ResourceResponse()));
+                                    base::MakeRefCounted<ResourceResponse>());
   if (test_handler_) {
     EXPECT_EQ(1, test_handler_->on_request_redirected_called());
     EXPECT_EQ(0, test_handler_->on_response_started_called());
   }
   MaybeAsyncDetachAt(DetachPhase::REQUEST_REDIRECTED);
 
-  mock_loader_->OnResponseStarted(make_scoped_refptr(new ResourceResponse()));
+  mock_loader_->OnResponseStarted(base::MakeRefCounted<ResourceResponse>());
   if (test_handler_) {
     EXPECT_EQ(1, test_handler_->on_request_redirected_called());
     EXPECT_EQ(1, test_handler_->on_response_started_called());
diff --git a/content/browser/loader/intercepting_resource_handler_unittest.cc b/content/browser/loader/intercepting_resource_handler_unittest.cc
index afc2ec6..302c18a 100644
--- a/content/browser/loader/intercepting_resource_handler_unittest.cc
+++ b/content/browser/loader/intercepting_resource_handler_unittest.cc
@@ -96,7 +96,7 @@
   // The response is received. The handler should not change.
   ASSERT_EQ(MockResourceLoader::Status::IDLE,
             mock_loader_->OnResponseStarted(
-                make_scoped_refptr(new ResourceResponse())));
+                base::MakeRefCounted<ResourceResponse>()));
 
   // The read is replayed by the MimeSniffingResourceHandler. The data should
   // have been received by the old intercepting_handler.
@@ -140,7 +140,7 @@
   // the download.
   ASSERT_EQ(MockResourceLoader::Status::IDLE,
             mock_loader_->OnResponseStarted(
-                make_scoped_refptr(new ResourceResponse())));
+                base::MakeRefCounted<ResourceResponse>()));
 
   EXPECT_FALSE(old_handler_status_.is_success());
   EXPECT_EQ(net::ERR_ABORTED, old_handler_status_.error());
@@ -198,7 +198,7 @@
   // the download.
   ASSERT_EQ(MockResourceLoader::Status::IDLE,
             mock_loader_->OnResponseStarted(
-                make_scoped_refptr(new ResourceResponse())));
+                base::MakeRefCounted<ResourceResponse>()));
 
   // The old handler should have received the payload.
   EXPECT_EQ(kPayload, old_handler_body_);
@@ -257,7 +257,7 @@
   // The response is received. The new ResourceHandler should tell us to fail.
   ASSERT_EQ(MockResourceLoader::Status::CANCELED,
             mock_loader_->OnResponseStarted(
-                make_scoped_refptr(new ResourceResponse())));
+                base::MakeRefCounted<ResourceResponse>()));
   EXPECT_EQ(net::ERR_ABORTED, mock_loader_->error_code());
 }
 
@@ -285,7 +285,7 @@
   // The response is received. The new ResourceHandler should tell us to fail.
   ASSERT_EQ(MockResourceLoader::Status::CANCELED,
             mock_loader_->OnResponseStarted(
-                make_scoped_refptr(new ResourceResponse())));
+                base::MakeRefCounted<ResourceResponse>()));
   EXPECT_EQ(net::ERR_ABORTED, mock_loader_->error_code());
 }
 
@@ -315,7 +315,7 @@
   // read yet.
   ASSERT_EQ(MockResourceLoader::Status::IDLE,
             mock_loader_->OnResponseStarted(
-                make_scoped_refptr(new ResourceResponse())));
+                base::MakeRefCounted<ResourceResponse>()));
   EXPECT_EQ(net::URLRequestStatus::CANCELED, old_handler_status_.status());
   EXPECT_EQ(net::ERR_ABORTED, old_handler_status_.error());
 
@@ -353,7 +353,7 @@
   // The response is received.
   ASSERT_EQ(MockResourceLoader::Status::IDLE,
             mock_loader_->OnResponseStarted(
-                make_scoped_refptr(new ResourceResponse())));
+                base::MakeRefCounted<ResourceResponse>()));
   EXPECT_EQ(net::URLRequestStatus::CANCELED, old_handler_status_.status());
   EXPECT_EQ(net::ERR_ABORTED, old_handler_status_.error());
 
@@ -434,7 +434,7 @@
   // OnReadCompleted method.
   ASSERT_EQ(MockResourceLoader::Status::CALLBACK_PENDING,
             mock_loader_->OnResponseStarted(
-                make_scoped_refptr(new ResourceResponse())));
+                base::MakeRefCounted<ResourceResponse>()));
   old_handler_->WaitUntilDeferred();
 
   EXPECT_EQ(1, old_handler_->on_read_completed_called());
@@ -573,7 +573,7 @@
   // The response is received.
   ASSERT_EQ(MockResourceLoader::Status::CALLBACK_PENDING,
             mock_loader_->OnResponseStarted(
-                make_scoped_refptr(new ResourceResponse())));
+                base::MakeRefCounted<ResourceResponse>()));
 
   EXPECT_EQ(net::URLRequestStatus::SUCCESS, old_handler_status_.status());
   EXPECT_FALSE(old_handler_);
@@ -613,7 +613,7 @@
   // The response is received.
   ASSERT_EQ(MockResourceLoader::Status::CALLBACK_PENDING,
             mock_loader_->OnResponseStarted(
-                make_scoped_refptr(new ResourceResponse())));
+                base::MakeRefCounted<ResourceResponse>()));
 
   EXPECT_EQ(net::URLRequestStatus::IO_PENDING, old_handler_status_.status());
   EXPECT_EQ(net::URLRequestStatus::IO_PENDING, new_handler_status.status());
diff --git a/content/browser/loader/mojo_async_resource_handler_unittest.cc b/content/browser/loader/mojo_async_resource_handler_unittest.cc
index 7b3f941..2c16321 100644
--- a/content/browser/loader/mojo_async_resource_handler_unittest.cc
+++ b/content/browser/loader/mojo_async_resource_handler_unittest.cc
@@ -388,7 +388,7 @@
   // Returns false if something bad happens.
   bool CallOnResponseStarted() {
     MockResourceLoader::Status result = mock_loader_->OnResponseStarted(
-        make_scoped_refptr(new ResourceResponse()));
+        base::MakeRefCounted<ResourceResponse>());
     EXPECT_EQ(MockResourceLoader::Status::IDLE, result);
     if (result != MockResourceLoader::Status::IDLE)
       return false;
@@ -633,7 +633,7 @@
             mock_loader_->OnWillStart(request_->url()));
   ASSERT_EQ(MockResourceLoader::Status::IDLE,
             mock_loader_->OnResponseStarted(
-                make_scoped_refptr(new ResourceResponse())));
+                base::MakeRefCounted<ResourceResponse>()));
   ASSERT_FALSE(url_loader_client_.has_received_response());
   url_loader_client_.RunUntilResponseReceived();
 
@@ -1181,7 +1181,7 @@
   redirect_info.status_code = 301;
   ASSERT_EQ(MockResourceLoader::Status::CALLBACK_PENDING,
             mock_loader_->OnRequestRedirected(
-                redirect_info, make_scoped_refptr(new ResourceResponse())));
+                redirect_info, base::MakeRefCounted<ResourceResponse>()));
 
   ASSERT_FALSE(url_loader_client_.has_received_response());
   ASSERT_FALSE(url_loader_client_.has_received_redirect());
@@ -1201,7 +1201,7 @@
   redirect_info.status_code = 302;
   ASSERT_EQ(MockResourceLoader::Status::CALLBACK_PENDING,
             mock_loader_->OnRequestRedirected(
-                redirect_info, make_scoped_refptr(new ResourceResponse())));
+                redirect_info, base::MakeRefCounted<ResourceResponse>()));
 
   ASSERT_FALSE(url_loader_client_.has_received_response());
   ASSERT_FALSE(url_loader_client_.has_received_redirect());
@@ -1219,7 +1219,7 @@
   // Give the final response.
   ASSERT_EQ(MockResourceLoader::Status::IDLE,
             mock_loader_->OnResponseStarted(
-                make_scoped_refptr(new ResourceResponse())));
+                base::MakeRefCounted<ResourceResponse>()));
 
   net::URLRequestStatus status(net::URLRequestStatus::SUCCESS, net::OK);
   ASSERT_EQ(MockResourceLoader::Status::IDLE,
@@ -1251,7 +1251,7 @@
             mock_loader_->OnWillStart(request_->url()));
   ASSERT_EQ(MockResourceLoader::Status::IDLE,
             mock_loader_->OnResponseStarted(
-                make_scoped_refptr(new ResourceResponse())));
+                base::MakeRefCounted<ResourceResponse>()));
 
   ASSERT_FALSE(url_loader_client_.has_received_response());
   url_loader_client_.RunUntilResponseReceived();
@@ -1303,7 +1303,7 @@
 
   ASSERT_EQ(MockResourceLoader::Status::IDLE,
             mock_loader_->OnResponseStarted(
-                make_scoped_refptr(new ResourceResponse())));
+                base::MakeRefCounted<ResourceResponse>()));
 
   ASSERT_FALSE(url_loader_client_.has_received_response());
   url_loader_client_.RunUntilResponseReceived();
diff --git a/content/browser/loader/redirect_to_file_resource_handler_unittest.cc b/content/browser/loader/redirect_to_file_resource_handler_unittest.cc
index 8dba0af7..5eac0392 100644
--- a/content/browser/loader/redirect_to_file_resource_handler_unittest.cc
+++ b/content/browser/loader/redirect_to_file_resource_handler_unittest.cc
@@ -332,7 +332,7 @@
   // and wait for it to resume the request if running an async test.
   MockResourceLoader::Status OnResponseStartedAndWaitForResult()
       WARN_UNUSED_RESULT {
-    mock_loader_->OnResponseStarted(make_scoped_refptr(new ResourceResponse()));
+    mock_loader_->OnResponseStarted(base::MakeRefCounted<ResourceResponse>());
     if (GetParam() == CompletionMode::ASYNC) {
       EXPECT_EQ(MockResourceLoader::Status::CALLBACK_PENDING,
                 mock_loader_->status());
@@ -417,7 +417,7 @@
     mock_loader_->WaitUntilIdleOrCanceled();
   }
   ASSERT_EQ(MockResourceLoader::Status::IDLE, mock_loader_->status());
-  mock_loader_->OnResponseStarted(make_scoped_refptr(new ResourceResponse()));
+  mock_loader_->OnResponseStarted(base::MakeRefCounted<ResourceResponse>());
   ASSERT_EQ(MockResourceLoader::Status::CALLBACK_PENDING,
             mock_loader_->status());
 
@@ -451,7 +451,7 @@
     mock_loader_->WaitUntilIdleOrCanceled();
   }
   ASSERT_EQ(MockResourceLoader::Status::IDLE, mock_loader_->status());
-  mock_loader_->OnResponseStarted(make_scoped_refptr(new ResourceResponse()));
+  mock_loader_->OnResponseStarted(base::MakeRefCounted<ResourceResponse>());
   ASSERT_EQ(MockResourceLoader::Status::CALLBACK_PENDING,
             mock_loader_->status());
 
diff --git a/content/browser/loader/throttling_resource_handler_unittest.cc b/content/browser/loader/throttling_resource_handler_unittest.cc
index 0db25d35..369fc3d 100644
--- a/content/browser/loader/throttling_resource_handler_unittest.cc
+++ b/content/browser/loader/throttling_resource_handler_unittest.cc
@@ -259,7 +259,7 @@
   redirect_info.new_url = GURL(kRedirectUrl);
   ASSERT_EQ(MockResourceLoader::Status::IDLE,
             mock_loader_->OnRequestRedirected(
-                redirect_info, make_scoped_refptr(new ResourceResponse())));
+                redirect_info, base::MakeRefCounted<ResourceResponse>()));
   EXPECT_EQ(1, throttle1_->will_redirect_request_called());
   EXPECT_EQ(0, throttle1_->will_process_response_called());
 
@@ -270,7 +270,7 @@
 
   ASSERT_EQ(MockResourceLoader::Status::IDLE,
             mock_loader_->OnResponseStarted(
-                make_scoped_refptr(new ResourceResponse())));
+                base::MakeRefCounted<ResourceResponse>()));
   EXPECT_EQ(1, throttle1_->will_process_response_called());
   EXPECT_EQ(1, throttle2_->will_process_response_called());
 
@@ -311,7 +311,7 @@
   redirect_info.new_url = GURL(kRedirectUrl);
   ASSERT_EQ(MockResourceLoader::Status::CALLBACK_PENDING,
             mock_loader_->OnRequestRedirected(
-                redirect_info, make_scoped_refptr(new ResourceResponse())));
+                redirect_info, base::MakeRefCounted<ResourceResponse>()));
   EXPECT_EQ(1, throttle1_->will_redirect_request_called());
   EXPECT_EQ(0, throttle2_->will_redirect_request_called());
 
@@ -328,7 +328,7 @@
   EXPECT_EQ(0, throttle1_->will_process_response_called());
   ASSERT_EQ(MockResourceLoader::Status::CALLBACK_PENDING,
             mock_loader_->OnResponseStarted(
-                make_scoped_refptr(new ResourceResponse())));
+                base::MakeRefCounted<ResourceResponse>()));
   EXPECT_EQ(1, throttle1_->will_process_response_called());
   EXPECT_EQ(0, throttle2_->will_process_response_called());
 
@@ -482,7 +482,7 @@
   redirect_info.new_url = GURL(kRedirectUrl);
   ASSERT_EQ(MockResourceLoader::Status::CANCELED,
             mock_loader_->OnRequestRedirected(
-                redirect_info, make_scoped_refptr(new ResourceResponse())));
+                redirect_info, base::MakeRefCounted<ResourceResponse>()));
   EXPECT_EQ(1, throttle1_->will_redirect_request_called());
   EXPECT_EQ(0, throttle2_->will_redirect_request_called());
   EXPECT_EQ(0, test_handler_->on_request_redirected_called());
@@ -519,7 +519,7 @@
   redirect_info.new_url = GURL(kRedirectUrl);
   ASSERT_EQ(MockResourceLoader::Status::CALLBACK_PENDING,
             mock_loader_->OnRequestRedirected(
-                redirect_info, make_scoped_refptr(new ResourceResponse())));
+                redirect_info, base::MakeRefCounted<ResourceResponse>()));
 
   throttle1_->CancelWithError(net::ERR_UNEXPECTED);
   EXPECT_EQ(1, throttle1_->will_redirect_request_called());
@@ -564,7 +564,7 @@
   redirect_info.new_url = GURL(kRedirectUrl);
   ASSERT_EQ(MockResourceLoader::Status::CALLBACK_PENDING,
             mock_loader_->OnRequestRedirected(
-                redirect_info, make_scoped_refptr(new ResourceResponse())));
+                redirect_info, base::MakeRefCounted<ResourceResponse>()));
 
   throttle1_->Resume();
   EXPECT_EQ(1, throttle1_->will_redirect_request_called());
@@ -601,7 +601,7 @@
 
   ASSERT_EQ(MockResourceLoader::Status::CANCELED,
             mock_loader_->OnResponseStarted(
-                make_scoped_refptr(new ResourceResponse())));
+                base::MakeRefCounted<ResourceResponse>()));
   EXPECT_EQ(1, throttle1_->will_process_response_called());
   EXPECT_EQ(0, throttle2_->will_process_response_called());
   EXPECT_EQ(0, test_handler_->on_response_started_called());
@@ -635,7 +635,7 @@
 
   ASSERT_EQ(MockResourceLoader::Status::CALLBACK_PENDING,
             mock_loader_->OnResponseStarted(
-                make_scoped_refptr(new ResourceResponse())));
+                base::MakeRefCounted<ResourceResponse>()));
   EXPECT_EQ(1, throttle1_->will_process_response_called());
   EXPECT_EQ(0, throttle2_->will_process_response_called());
   EXPECT_EQ(0, test_handler_->on_response_started_called());
@@ -680,7 +680,7 @@
 
   ASSERT_EQ(MockResourceLoader::Status::CALLBACK_PENDING,
             mock_loader_->OnResponseStarted(
-                make_scoped_refptr(new ResourceResponse())));
+                base::MakeRefCounted<ResourceResponse>()));
   EXPECT_EQ(1, throttle1_->will_process_response_called());
   EXPECT_EQ(0, throttle2_->will_process_response_called());
   EXPECT_EQ(0, test_handler_->on_response_started_called());
@@ -770,7 +770,7 @@
   redirect_info.new_url = GURL(kRedirectUrl);
   EXPECT_EQ(MockResourceLoader::Status::IDLE,
             mock_loader_->OnRequestRedirected(
-                redirect_info, make_scoped_refptr(new ResourceResponse())));
+                redirect_info, base::MakeRefCounted<ResourceResponse>()));
 
   throttle1_->CancelWithError(net::ERR_UNEXPECTED);
   EXPECT_EQ(MockResourceLoader::Status::CANCELED, mock_loader_->status());
@@ -806,7 +806,7 @@
       mock_loader_->OnRequestRedirected(redirect_info, new ResourceResponse()));
   EXPECT_EQ(MockResourceLoader::Status::IDLE,
             mock_loader_->OnResponseStarted(
-                make_scoped_refptr(new ResourceResponse())));
+                base::MakeRefCounted<ResourceResponse>()));
 
   throttle1_->CancelWithError(net::ERR_UNEXPECTED);
   EXPECT_EQ(MockResourceLoader::Status::CANCELED, mock_loader_->status());
diff --git a/content/browser/renderer_host/media/audio_output_delegate_impl_unittest.cc b/content/browser/renderer_host/media/audio_output_delegate_impl_unittest.cc
index 86b76e7e..eb5bad0 100644
--- a/content/browser/renderer_host/media/audio_output_delegate_impl_unittest.cc
+++ b/content/browser/renderer_host/media/audio_output_delegate_impl_unittest.cc
@@ -382,6 +382,7 @@
         &mirroring_manager_, &media_observer_, kStreamId, kRenderFrameId,
         kRenderProcessId, Params(), kDefaultDeviceId);
 
+    delegate->OnPlayStream();
     delegate->GetControllerForTesting()->OnError();
 
     // Errors are deferred by AudioOutputController, so wait for the error; pass
diff --git a/content/browser/renderer_host/media/media_devices_dispatcher_host.cc b/content/browser/renderer_host/media/media_devices_dispatcher_host.cc
index 1dfed3bc..6af84b14 100644
--- a/content/browser/renderer_host/media/media_devices_dispatcher_host.cc
+++ b/content/browser/renderer_host/media/media_devices_dispatcher_host.cc
@@ -206,6 +206,22 @@
                  weak_factory_.GetWeakPtr(), base::Passed(&client_callback)));
 }
 
+void MediaDevicesDispatcherHost::GetAllVideoInputDeviceFormats(
+    const std::string& device_id,
+    GetAllVideoInputDeviceFormatsCallback client_callback) {
+  DCHECK_CURRENTLY_ON(BrowserThread::IO);
+  GetVideoInputDeviceFormats(device_id, false /* try_in_use_first */,
+                             std::move(client_callback));
+}
+
+void MediaDevicesDispatcherHost::GetAvailableVideoInputDeviceFormats(
+    const std::string& device_id,
+    GetAvailableVideoInputDeviceFormatsCallback client_callback) {
+  DCHECK_CURRENTLY_ON(BrowserThread::IO);
+  GetVideoInputDeviceFormats(device_id, true /* try_in_use_first */,
+                             std::move(client_callback));
+}
+
 void MediaDevicesDispatcherHost::GetAudioInputCapabilities(
     GetAudioInputCapabilitiesCallback client_callback) {
   base::PostTaskAndReplyWithResult(
@@ -408,18 +424,8 @@
     ::mojom::VideoInputDeviceCapabilitiesPtr capabilities =
         ::mojom::VideoInputDeviceCapabilities::New();
     capabilities->device_id = std::move(hmac_device_id);
-    capabilities->formats = GetVideoInputFormats(descriptor.device_id);
-    if (capabilities->formats.empty()) {
-      // The device does not seem to support capability enumeration. Compose
-      // a fallback list of capabilities.
-      for (const auto& resolution : kFallbackVideoResolutions) {
-        for (const auto frame_rate : kFallbackVideoFrameRates) {
-          capabilities->formats.push_back(media::VideoCaptureFormat(
-              gfx::Size(resolution.width, resolution.height), frame_rate,
-              media::PIXEL_FORMAT_I420));
-        }
-      }
-    }
+    capabilities->formats =
+        GetVideoInputFormats(descriptor.device_id, true /* try_in_use_first */);
     capabilities->facing_mode = ToFacingMode(descriptor.facing);
 #if defined(OS_ANDROID)
     // On Android, the facing mode is not available in the |facing| field,
@@ -442,16 +448,64 @@
   std::move(client_callback).Run(std::move(video_input_capabilities));
 }
 
+void MediaDevicesDispatcherHost::GetVideoInputDeviceFormats(
+    const std::string& device_id,
+    bool try_in_use_first,
+    GetVideoInputDeviceFormatsCallback client_callback) {
+  DCHECK_CURRENTLY_ON(BrowserThread::IO);
+  base::PostTaskAndReplyWithResult(
+      BrowserThread::GetTaskRunnerForThread(BrowserThread::UI).get(), FROM_HERE,
+      base::Bind(GetOrigin, render_process_id_, render_frame_id_,
+                 security_origin_for_testing_),
+      base::Bind(&MediaDevicesDispatcherHost::EnumerateVideoDevicesForFormats,
+                 weak_factory_.GetWeakPtr(), base::Passed(&client_callback),
+                 device_id, try_in_use_first));
+}
+
+void MediaDevicesDispatcherHost::EnumerateVideoDevicesForFormats(
+    GetVideoInputDeviceFormatsCallback client_callback,
+    const std::string& device_id,
+    bool try_in_use_first,
+    const url::Origin& security_origin) {
+  DCHECK_CURRENTLY_ON(BrowserThread::IO);
+  media_stream_manager_->video_capture_manager()->EnumerateDevices(base::Bind(
+      &MediaDevicesDispatcherHost::FinalizeGetVideoInputDeviceFormats,
+      weak_factory_.GetWeakPtr(), base::Passed(&client_callback), device_id,
+      try_in_use_first, security_origin));
+}
+
+void MediaDevicesDispatcherHost::FinalizeGetVideoInputDeviceFormats(
+    GetVideoInputDeviceFormatsCallback client_callback,
+    const std::string& device_id,
+    bool try_in_use_first,
+    const url::Origin& security_origin,
+    const media::VideoCaptureDeviceDescriptors& device_descriptors) {
+  DCHECK_CURRENTLY_ON(BrowserThread::IO);
+  for (const auto& descriptor : device_descriptors) {
+    if (DoesMediaDeviceIDMatchHMAC(device_id_salt_, security_origin, device_id,
+                                   descriptor.device_id)) {
+      std::move(client_callback)
+          .Run(GetVideoInputFormats(descriptor.device_id, try_in_use_first));
+      return;
+    }
+  }
+  std::move(client_callback).Run(media::VideoCaptureFormats());
+}
+
 media::VideoCaptureFormats MediaDevicesDispatcherHost::GetVideoInputFormats(
-    const std::string& device_id) {
+    const std::string& device_id,
+    bool try_in_use_first) {
   DCHECK_CURRENTLY_ON(BrowserThread::IO);
   media::VideoCaptureFormats formats;
-  base::Optional<media::VideoCaptureFormat> format =
-      media_stream_manager_->video_capture_manager()->GetDeviceFormatInUse(
-          MEDIA_DEVICE_VIDEO_CAPTURE, device_id);
-  if (format.has_value()) {
-    formats.push_back(format.value());
-    return formats;
+
+  if (try_in_use_first) {
+    base::Optional<media::VideoCaptureFormat> format =
+        media_stream_manager_->video_capture_manager()->GetDeviceFormatInUse(
+            MEDIA_DEVICE_VIDEO_CAPTURE, device_id);
+    if (format.has_value()) {
+      formats.push_back(format.value());
+      return formats;
+    }
   }
 
   media_stream_manager_->video_capture_manager()->GetDeviceSupportedFormats(
@@ -463,6 +517,18 @@
                                }),
                 formats.end());
 
+  // If the device does not report any valid format, use a fallback list of
+  // standard formats.
+  if (formats.empty()) {
+    for (const auto& resolution : kFallbackVideoResolutions) {
+      for (const auto frame_rate : kFallbackVideoFrameRates) {
+        formats.push_back(media::VideoCaptureFormat(
+            gfx::Size(resolution.width, resolution.height), frame_rate,
+            media::PIXEL_FORMAT_I420));
+      }
+    }
+  }
+
   return formats;
 }
 
diff --git a/content/browser/renderer_host/media/media_devices_dispatcher_host.h b/content/browser/renderer_host/media/media_devices_dispatcher_host.h
index c1510fa8..1340981e 100644
--- a/content/browser/renderer_host/media/media_devices_dispatcher_host.h
+++ b/content/browser/renderer_host/media/media_devices_dispatcher_host.h
@@ -46,6 +46,12 @@
                         EnumerateDevicesCallback client_callback) override;
   void GetVideoInputCapabilities(
       GetVideoInputCapabilitiesCallback client_callback) override;
+  void GetAllVideoInputDeviceFormats(
+      const std::string& device_id,
+      GetAllVideoInputDeviceFormatsCallback client_callback) override;
+  void GetAvailableVideoInputDeviceFormats(
+      const std::string& device_id,
+      GetAvailableVideoInputDeviceFormatsCallback client_callback) override;
   void GetAudioInputCapabilities(
       GetAudioInputCapabilitiesCallback client_callback) override;
   void SubscribeDeviceChangeNotifications(MediaDeviceType type,
@@ -66,6 +72,9 @@
   void SetSecurityOriginForTesting(const url::Origin& origin);
 
  private:
+  using GetVideoInputDeviceFormatsCallback =
+      GetAllVideoInputDeviceFormatsCallback;
+
   void CheckPermissionsForEnumerateDevices(
       const MediaDevicesManager::BoolDeviceTypes& requested_types,
       EnumerateDevicesCallback client_callback,
@@ -114,8 +123,28 @@
 
   void FinalizeGetAudioInputCapabilities();
 
-  // Returns the currently supported video formats for the given |device_id|.
-  media::VideoCaptureFormats GetVideoInputFormats(const std::string& device_id);
+  void GetVideoInputDeviceFormats(
+      const std::string& device_id,
+      bool try_in_use_first,
+      GetVideoInputDeviceFormatsCallback client_callback);
+  void EnumerateVideoDevicesForFormats(
+      GetVideoInputDeviceFormatsCallback client_callback,
+      const std::string& device_id,
+      bool try_in_use_first,
+      const url::Origin& security_origin);
+  void FinalizeGetVideoInputDeviceFormats(
+      GetVideoInputDeviceFormatsCallback client_callback,
+      const std::string& device_id,
+      bool try_in_use_first,
+      const url::Origin& security_origin,
+      const media::VideoCaptureDeviceDescriptors& device_descriptors);
+
+  // Returns the supported video formats for the given |device_id|.
+  // If |try_in_use_first| is true and the device is being used, only the format
+  // in use is returned. Otherwise, all formats supported by the device are
+  // returned.
+  media::VideoCaptureFormats GetVideoInputFormats(const std::string& device_id,
+                                                  bool try_in_use_first);
 
   void NotifyDeviceChangeOnUIThread(const std::vector<uint32_t>& subscriptions,
                                     MediaDeviceType type,
diff --git a/content/browser/renderer_host/media/media_devices_dispatcher_host_unittest.cc b/content/browser/renderer_host/media/media_devices_dispatcher_host_unittest.cc
index 6b53458..e036c63 100644
--- a/content/browser/renderer_host/media/media_devices_dispatcher_host_unittest.cc
+++ b/content/browser/renderer_host/media/media_devices_dispatcher_host_unittest.cc
@@ -161,6 +161,8 @@
                void(const std::vector<std::vector<MediaDeviceInfo>>&));
   MOCK_METHOD0(MockVideoInputCapabilitiesCallback, void());
   MOCK_METHOD0(MockAudioInputCapabilitiesCallback, void());
+  MOCK_METHOD0(MockAllVideoInputDeviceFormatsCallback, void());
+  MOCK_METHOD0(MockAvailableVideoInputDeviceFormatsCallback, void());
 
   void VideoInputCapabilitiesCallback(
       std::vector<::mojom::VideoInputDeviceCapabilitiesPtr> capabilities) {
@@ -201,6 +203,30 @@
       EXPECT_TRUE(capability->parameters.IsValid());
   }
 
+  void AllVideoInputDeviceFormatsCallback(
+      const std::vector<media::VideoCaptureFormat>& formats) {
+    MockAllVideoInputDeviceFormatsCallback();
+    EXPECT_GT(formats.size(), 0U);
+    for (const auto& format : formats) {
+      EXPECT_GT(format.frame_size.GetArea(), 0);
+      EXPECT_GE(format.frame_rate, 0.0);
+    }
+  }
+
+  void AvailableVideoInputDeviceFormatsCallback(
+      const std::vector<media::VideoCaptureFormat>& formats) {
+    MockAvailableVideoInputDeviceFormatsCallback();
+    EXPECT_EQ(formats.size(), 4U);
+    EXPECT_EQ(formats[0], media::VideoCaptureFormat(gfx::Size(640, 480), 30.0,
+                                                    media::PIXEL_FORMAT_I420));
+    EXPECT_EQ(formats[1], media::VideoCaptureFormat(gfx::Size(800, 600), 30.0,
+                                                    media::PIXEL_FORMAT_I420));
+    EXPECT_EQ(formats[2], media::VideoCaptureFormat(gfx::Size(1020, 780), 30.0,
+                                                    media::PIXEL_FORMAT_I420));
+    EXPECT_EQ(formats[3], media::VideoCaptureFormat(gfx::Size(1920, 1080), 20.0,
+                                                    media::PIXEL_FORMAT_I420));
+  }
+
  protected:
   void DevicesEnumerated(
       const base::Closure& closure,
@@ -428,6 +454,32 @@
   run_loop.Run();
 }
 
+TEST_P(MediaDevicesDispatcherHostTest, GetAllVideoInputDeviceFormats) {
+  base::RunLoop run_loop;
+  EXPECT_CALL(*this, MockAllVideoInputDeviceFormatsCallback())
+      .WillOnce(InvokeWithoutArgs([&run_loop]() { run_loop.Quit(); }));
+  host_->GetAllVideoInputDeviceFormats(
+      GetHMACForMediaDeviceID(browser_context_.GetMediaDeviceIDSalt(), origin_,
+                              kDefaultVideoDeviceID),
+      base::BindOnce(
+          &MediaDevicesDispatcherHostTest::AllVideoInputDeviceFormatsCallback,
+          base::Unretained(this)));
+  run_loop.Run();
+}
+
+TEST_P(MediaDevicesDispatcherHostTest, GetAvailableVideoInputDeviceFormats) {
+  base::RunLoop run_loop;
+  EXPECT_CALL(*this, MockAvailableVideoInputDeviceFormatsCallback())
+      .WillOnce(InvokeWithoutArgs([&run_loop]() { run_loop.Quit(); }));
+  host_->GetAvailableVideoInputDeviceFormats(
+      GetHMACForMediaDeviceID(browser_context_.GetMediaDeviceIDSalt(), origin_,
+                              kNormalVideoDeviceID),
+      base::BindOnce(&MediaDevicesDispatcherHostTest::
+                         AvailableVideoInputDeviceFormatsCallback,
+                     base::Unretained(this)));
+  run_loop.Run();
+}
+
 INSTANTIATE_TEST_CASE_P(,
                         MediaDevicesDispatcherHostTest,
                         testing::Values(GURL(), GURL("https://test.com")));
diff --git a/content/browser/renderer_host/render_widget_host_view_aura_unittest.cc b/content/browser/renderer_host/render_widget_host_view_aura_unittest.cc
index eddc1f3..881c676 100644
--- a/content/browser/renderer_host/render_widget_host_view_aura_unittest.cc
+++ b/content/browser/renderer_host/render_widget_host_view_aura_unittest.cc
@@ -30,7 +30,6 @@
 #include "components/viz/common/quads/copy_output_request.h"
 #include "components/viz/common/surfaces/local_surface_id_allocator.h"
 #include "components/viz/service/display_embedder/server_shared_bitmap_manager.h"
-#include "components/viz/service/display_embedder/shared_bitmap_allocation_notifier_impl.h"
 #include "components/viz/service/frame_sinks/frame_sink_manager_impl.h"
 #include "components/viz/service/surfaces/surface.h"
 #include "components/viz/test/begin_frame_args_test.h"
@@ -3093,8 +3092,6 @@
   size_t renderer_count = max_renderer_frames + 1;
   gfx::Rect view_rect(100, 100);
   gfx::Size frame_size = view_rect.size();
-  DCHECK_EQ(0u,
-            viz::ServerSharedBitmapManager::current()->AllocatedBitmapCount());
 
   std::unique_ptr<RenderWidgetHostImpl* []> hosts(
       new RenderWidgetHostImpl*[renderer_count]);
@@ -3225,33 +3222,6 @@
       id2, MakeDelegatedFrame(1.f, size2, gfx::Rect(size2)));
   EXPECT_FALSE(views[1]->released_front_lock_active());
 
-  for (size_t i = 0; i < renderer_count - 1; ++i)
-    views[i]->Hide();
-
-  // Allocate enough bitmaps so that two frames (proportionally) would be
-  // enough hit the handle limit.
-  int handles_per_frame = 5;
-  FrameEvictionManager::GetInstance()->set_max_handles(handles_per_frame * 2);
-
-  viz::SharedBitmapAllocationNotifierImpl notifier(
-      viz::ServerSharedBitmapManager::current());
-
-  for (size_t i = 0; i < (renderer_count - 1) * handles_per_frame; i++) {
-    notifier.ChildAllocatedSharedBitmap(1, base::SharedMemoryHandle(),
-                                        viz::SharedBitmap::GenerateId());
-  }
-
-  // Hiding this last bitmap should evict all but two frames.
-  views[renderer_count - 1]->Hide();
-  for (size_t i = 0; i < renderer_count; ++i) {
-    if (i + 2 < renderer_count)
-      EXPECT_FALSE(views[i]->HasFrameData());
-    else
-      EXPECT_TRUE(views[i]->HasFrameData());
-  }
-  FrameEvictionManager::GetInstance()->set_max_handles(
-      base::SharedMemory::GetHandleLimit());
-
   for (size_t i = 0; i < renderer_count; ++i) {
     views[i]->Destroy();
     delete hosts[i];
@@ -3267,8 +3237,6 @@
   size_t renderer_count = max_renderer_frames + 1;
   gfx::Rect view_rect(100, 100);
   gfx::Size frame_size = view_rect.size();
-  DCHECK_EQ(0u,
-            viz::ServerSharedBitmapManager::current()->AllocatedBitmapCount());
 
   std::unique_ptr<RenderWidgetHostImpl* []> hosts(
       new RenderWidgetHostImpl*[renderer_count]);
@@ -3340,8 +3308,6 @@
   size_t renderer_count = kMaxRendererFrames;
   gfx::Rect view_rect(100, 100);
   gfx::Size frame_size = view_rect.size();
-  DCHECK_EQ(0u,
-            viz::ServerSharedBitmapManager::current()->AllocatedBitmapCount());
 
   std::unique_ptr<RenderWidgetHostImpl* []> hosts(
       new RenderWidgetHostImpl*[renderer_count]);
diff --git a/content/browser/service_worker/foreign_fetch_request_handler_unittest.cc b/content/browser/service_worker/foreign_fetch_request_handler_unittest.cc
index 7d1f246..cad3616d 100644
--- a/content/browser/service_worker/foreign_fetch_request_handler_unittest.cc
+++ b/content/browser/service_worker/foreign_fetch_request_handler_unittest.cc
@@ -145,7 +145,7 @@
     http_info->ssl_info.security_bits = 0x100;
     // SSL3 TLS_DHE_RSA_WITH_AES_256_CBC_SHA
     http_info->ssl_info.connection_status = 0x300039;
-    http_info->headers = make_scoped_refptr(new net::HttpResponseHeaders(""));
+    http_info->headers = base::MakeRefCounted<net::HttpResponseHeaders>("");
     return http_info;
   }
 
diff --git a/content/browser/service_worker/service_worker_storage_unittest.cc b/content/browser/service_worker/service_worker_storage_unittest.cc
index 0d134d4..4df07c5 100644
--- a/content/browser/service_worker/service_worker_storage_unittest.cc
+++ b/content/browser/service_worker/service_worker_storage_unittest.cc
@@ -1968,7 +1968,7 @@
       "AtSAc03z4qvid34W4MHMxyRFUJKlubZ+P5cs5yg6EiBWcagVbnm5uBgJMJN34pag7D5RywGV"
       "ol2RFf+4Sdm1hQ4AAABYeyJvcmlnaW4iOiAiaHR0cHM6Ly92YWxpZC5leGFtcGxlLmNvbTo0"
       "NDMiLCAiZmVhdHVyZSI6ICJGZWF0dXJlMyIsICJleHBpcnkiOiAxMDAwMDAwMDAwfQ==");
-  http_info.headers = make_scoped_refptr(new net::HttpResponseHeaders(""));
+  http_info.headers = base::MakeRefCounted<net::HttpResponseHeaders>("");
   http_info.headers->AddHeader(kOriginTrial + kFeature1Token);
   http_info.headers->AddHeader(kOriginTrial + kFeature2Token1);
   http_info.headers->AddHeader(kOriginTrial + kFeature2Token2);
diff --git a/content/browser/service_worker/service_worker_url_request_job_unittest.cc b/content/browser/service_worker/service_worker_url_request_job_unittest.cc
index cbd0ca08..6fe992e 100644
--- a/content/browser/service_worker/service_worker_url_request_job_unittest.cc
+++ b/content/browser/service_worker/service_worker_url_request_job_unittest.cc
@@ -241,7 +241,7 @@
     http_info.ssl_info.security_bits = 0x100;
     // SSL3 TLS_DHE_RSA_WITH_AES_256_CBC_SHA
     http_info.ssl_info.connection_status = 0x300039;
-    http_info.headers = make_scoped_refptr(new net::HttpResponseHeaders(""));
+    http_info.headers = base::MakeRefCounted<net::HttpResponseHeaders>("");
     version_->SetMainScriptHttpResponseInfo(http_info);
 
     // Create a controlled client.
diff --git a/content/child/resource_dispatcher.cc b/content/child/resource_dispatcher.cc
index 215a03c..01c61f4 100644
--- a/content/child/resource_dispatcher.cc
+++ b/content/child/resource_dispatcher.cc
@@ -219,8 +219,8 @@
   request_info->buffer.reset(
       new base::SharedMemory(shm_handle, true));  // read only
   request_info->received_data_factory =
-      make_scoped_refptr(new SharedMemoryReceivedDataFactory(
-          message_sender_, request_id, request_info->buffer));
+      base::MakeRefCounted<SharedMemoryReceivedDataFactory>(
+          message_sender_, request_id, request_info->buffer);
 
   bool ok = request_info->buffer->Map(shm_size);
   if (!ok) {
diff --git a/content/child/shared_memory_received_data_factory_unittest.cc b/content/child/shared_memory_received_data_factory_unittest.cc
index d2258a1..f0562b2 100644
--- a/content/child/shared_memory_received_data_factory_unittest.cc
+++ b/content/child/shared_memory_received_data_factory_unittest.cc
@@ -50,8 +50,8 @@
     sender_.reset(new StrictMock<MockSender>);
     request_id_ = 0xdeadbeaf;
     memory_.reset(new base::SharedMemory);
-    factory_ = make_scoped_refptr(new SharedMemoryReceivedDataFactory(
-        sender_.get(), request_id_, memory_));
+    factory_ = base::MakeRefCounted<SharedMemoryReceivedDataFactory>(
+        sender_.get(), request_id_, memory_);
     ASSERT_TRUE(memory_->CreateAndMapAnonymous(memory_size));
 
     ON_CALL(*sender_, SendAck(_)).WillByDefault(Return(true));
diff --git a/content/common/media/media_devices.mojom b/content/common/media/media_devices.mojom
index 6940ccb..c466598 100644
--- a/content/common/media/media_devices.mojom
+++ b/content/common/media/media_devices.mojom
@@ -57,6 +57,20 @@
   GetVideoInputCapabilities()
       => (array<VideoInputDeviceCapabilities> video_input_device_capabilities);
 
+  // Returns a list of all video formats supported by a given device, regardless
+  // of whether the device is being used or not. If the given |device_id| is
+  // invalid, the result is empty.
+  GetAllVideoInputDeviceFormats(string device_id)
+      => (array<media.mojom.VideoCaptureFormat> formats);
+
+  // Returns a list of video formats currently available for a given device.
+  // When the device is in use, it is expected that the result will contain only
+  // one entry. When the device is not in use, the result should be the same as
+  // for GetAllVideoInputDeviceFormats. If the given |device_id| is not valid,
+  // the result is empty.
+  GetAvailableVideoInputDeviceFormats(string device_id)
+      => (array<media.mojom.VideoCaptureFormat> formats);
+
   // Returns a list of audio input devices and their capabilities.
   // If there is a user-preferred device, it is the first in the result.
   // Otherwise, the system-default device is the first in the result.
diff --git a/content/public/common/simple_url_loader.cc b/content/public/common/simple_url_loader.cc
index c0fec16..8e3b9777 100644
--- a/content/public/common/simple_url_loader.cc
+++ b/content/public/common/simple_url_loader.cc
@@ -10,8 +10,12 @@
 #include <limits>
 
 #include "base/bind.h"
+#include "base/location.h"
+#include "base/logging.h"
 #include "base/macros.h"
 #include "base/memory/ptr_util.h"
+#include "base/memory/ref_counted.h"
+#include "base/sequence_checker.h"
 #include "content/public/common/resource_request.h"
 #include "content/public/common/resource_response.h"
 #include "content/public/common/url_loader.mojom.h"
@@ -28,9 +32,137 @@
 
 class SimpleURLLoaderImpl;
 
+// BodyHandler is an abstract class from which classes for a specific use case
+// (e.g. read response to a string, write it to a file) will derive. Those
+// clases may use BodyReader to handle reading data from the body pipe.
+
+// Utility class to drive the pipe reading a response body. Can be created on
+// one thread and then used to read data on another.
+class BodyReader {
+ public:
+  class Delegate {
+   public:
+    Delegate() {}
+
+    // The specified amount of data was read from the pipe. The BodyReader must
+    // not be deleted during this callback. The Delegate should return net::OK
+    // to continue reading, or a value indicating an error if the pipe should be
+    // closed.
+    virtual net::Error OnDataRead(uint32_t length, const char* data) = 0;
+
+    // Called when the pipe is closed by the remote size, the size limit is
+    // reached, or OnDataRead returned an error. |error| is net::OK if the
+    // pipe was closed, or an error value otherwise. It is safe to delete the
+    // BodyReader during this callback.
+    virtual void OnDone(net::Error error, int64_t total_bytes) = 0;
+
+   protected:
+    virtual ~Delegate() {}
+
+   private:
+    DISALLOW_COPY_AND_ASSIGN(Delegate);
+  };
+
+  BodyReader(Delegate* delegate, int64_t max_body_size)
+      : handle_watcher_(FROM_HERE, mojo::SimpleWatcher::ArmingPolicy::MANUAL),
+        delegate_(delegate),
+        max_body_size_(max_body_size) {
+    DCHECK_GE(max_body_size_, 0);
+  }
+
+  // Makes the reader start reading from |body_data_pipe|. May only be called
+  // once. The reader will continuously to try to read from the pipe (without
+  // blocking the thread), calling OnDataRead as data is read, until one of the
+  // following happens:
+  // * The size limit is reached.
+  // * OnDataRead returns an error.
+  // * The BodyReader is deleted.
+  void Start(mojo::ScopedDataPipeConsumerHandle body_data_pipe) {
+    DCHECK(!body_data_pipe_.is_valid());
+    body_data_pipe_ = std::move(body_data_pipe);
+    handle_watcher_.Watch(
+        body_data_pipe_.get(),
+        MOJO_HANDLE_SIGNAL_READABLE | MOJO_HANDLE_SIGNAL_PEER_CLOSED,
+        MOJO_WATCH_CONDITION_SATISFIED,
+        base::BindRepeating(&BodyReader::MojoReadyCallback,
+                            base::Unretained(this)));
+    ReadData();
+  }
+
+ private:
+  void MojoReadyCallback(MojoResult result,
+                         const mojo::HandleSignalsState& state) {
+    ReadData();
+  }
+
+  // Reads as much data as possible from |body_data_pipe_|, copying it to
+  // |body_|. Arms |handle_watcher_| when data is not currently available.
+  void ReadData() {
+    while (true) {
+      const void* body_data;
+      uint32_t read_size;
+      MojoResult result = body_data_pipe_->BeginReadData(
+          &body_data, &read_size, MOJO_READ_DATA_FLAG_NONE);
+      if (result == MOJO_RESULT_SHOULD_WAIT) {
+        handle_watcher_.ArmOrNotify();
+        return;
+      }
+
+      // If the pipe was closed, unclear if it was an error or success. Notify
+      // the consumer of how much data was received.
+      if (result != MOJO_RESULT_OK) {
+        // The only error other than MOJO_RESULT_SHOULD_WAIT this should fail
+        // with is MOJO_RESULT_FAILED_PRECONDITION, in the case the pipe was
+        // closed.
+        DCHECK_EQ(MOJO_RESULT_FAILED_PRECONDITION, result);
+        ClosePipe();
+        delegate_->OnDone(net::OK, total_bytes_read_);
+        return;
+      }
+
+      // Check size against the limit.
+      uint32_t copy_size = read_size;
+      if (static_cast<int64_t>(copy_size) > max_body_size_ - total_bytes_read_)
+        copy_size = max_body_size_ - total_bytes_read_;
+
+      total_bytes_read_ += copy_size;
+      net::Error error =
+          delegate_->OnDataRead(copy_size, static_cast<const char*>(body_data));
+      body_data_pipe_->EndReadData(read_size);
+      // Handling reads asynchronously is currently not supported.
+      DCHECK_NE(error, net::ERR_IO_PENDING);
+      if (error == net::OK && copy_size < read_size)
+        error = net::ERR_INSUFFICIENT_RESOURCES;
+
+      if (error) {
+        ClosePipe();
+        delegate_->OnDone(error, total_bytes_read_);
+        return;
+      }
+    }
+  }
+
+  // Frees Mojo resources and prevents any more Mojo messages from arriving.
+  void ClosePipe() {
+    handle_watcher_.Cancel();
+    body_data_pipe_.reset();
+  }
+
+  mojo::ScopedDataPipeConsumerHandle body_data_pipe_;
+  mojo::SimpleWatcher handle_watcher_;
+
+  Delegate* const delegate_;
+
+  const int64_t max_body_size_;
+  int64_t total_bytes_read_ = 0;
+
+  DISALLOW_COPY_AND_ASSIGN(BodyReader);
+};
+
 // Class to drive the pipe for reading the body, handle the results of the body
 // read as appropriate, and invoke the consumer's callback to notify it of
-// request completion.
+// request completion. Implementations typically use a BodyReader to to manage
+// reads from the body data pipe.
 class BodyHandler {
  public:
   // A raw pointer is safe, since |simple_url_loader| owns the BodyHandler.
@@ -38,21 +170,22 @@
       : simple_url_loader_(simple_url_loader) {}
   virtual ~BodyHandler() {}
 
-  // Called with the data pipe received from the URLLoader. The BodyHandler is
-  // responsible for reading from it and monitoring it for closure. Should call
-  // either SimpleURLLoaderImpl::OnBodyPipeClosed() when the body pipe is
-  // closed, or SimpleURLLoaderImpl::FinishWithResult() with an error code if
-  // some sort of unexpected error occurs, like a write to a file fails. Must
-  // not call both.
+  // Called by SimpleURLLoader with the data pipe received from the URLLoader.
+  // The BodyHandler is responsible for reading from it and monitoring it for
+  // closure. Should call SimpleURLLoaderImpl::OnBodyHandlerDone(), once either
+  // when the body pipe is closed or when an error occurs, like a write to a
+  // file fails.
   virtual void OnStartLoadingResponseBody(
       mojo::ScopedDataPipeConsumerHandle body_data_pipe) = 0;
 
-  // Notifies the consumer that the request has completed, either successfully
-  // or with an error. May be invoked before OnStartLoadingResponseBody(), or
-  // before the BodyHandler has notified SimplerURLloader of completion or an
-  // error. Once this is called, must not invoke any of SimpleURLLoaderImpl's
-  // callbacks.
-  virtual void NotifyConsumerOfCompletion() = 0;
+  // Called by SimpleURLLoader. Notifies the SimpleURLLoader's consumer that the
+  // request has completed, either successfully or with an error. May be invoked
+  // before OnStartLoadingResponseBody(), or before the BodyHandler has notified
+  // SimplerURLLoader of completion or an error. Once this is called, the
+  // BodyHandler must not invoke any of SimpleURLLoaderImpl's callbacks. If
+  // |destroy_results| is true, any received data should be destroyed instead of
+  // being sent to the consumer.
+  virtual void NotifyConsumerOfCompletion(bool destroy_results) = 0;
 
  protected:
   SimpleURLLoaderImpl* simple_url_loader() { return simple_url_loader_; }
@@ -64,43 +197,33 @@
 };
 
 // BodyHandler implementation for consuming the response as a string.
-class SaveToStringBodyHandler : public BodyHandler {
+class SaveToStringBodyHandler : public BodyHandler,
+                                public BodyReader::Delegate {
  public:
   SaveToStringBodyHandler(
       SimpleURLLoaderImpl* simple_url_loader,
       SimpleURLLoader::BodyAsStringCallback body_as_string_callback,
-      size_t max_body_size)
+      int64_t max_body_size)
       : BodyHandler(simple_url_loader),
-        max_body_size_(max_body_size),
         body_as_string_callback_(std::move(body_as_string_callback)),
-        handle_watcher_(FROM_HERE, mojo::SimpleWatcher::ArmingPolicy::MANUAL) {}
+        body_reader_(std::make_unique<BodyReader>(this, max_body_size)) {}
 
   ~SaveToStringBodyHandler() override {}
 
   // BodyHandler implementation:
   void OnStartLoadingResponseBody(
       mojo::ScopedDataPipeConsumerHandle body_data_pipe) override;
-  void NotifyConsumerOfCompletion() override;
+  void NotifyConsumerOfCompletion(bool destroy_results) override;
 
  private:
-  void MojoReadyCallback(MojoResult result,
-                         const mojo::HandleSignalsState& state);
-
-  // Reads as much data as possible from |body_data_pipe_|, copying it to
-  // |body_|. Arms |handle_watcher_| when data is not currently available.
-  void ReadData();
-
-  // Frees Mojo resources and prevents any more Mojo messages from arriving.
-  void ClosePipe();
-
-  const size_t max_body_size_;
-
-  SimpleURLLoader::BodyAsStringCallback body_as_string_callback_;
+  // BodyReader::Delegate implementation.
+  net::Error OnDataRead(uint32_t length, const char* data) override;
+  void OnDone(net::Error error, int64_t total_bytes) override;
 
   std::unique_ptr<std::string> body_;
+  SimpleURLLoader::BodyAsStringCallback body_as_string_callback_;
 
-  mojo::ScopedDataPipeConsumerHandle body_data_pipe_;
-  mojo::SimpleWatcher handle_watcher_;
+  std::unique_ptr<BodyReader> body_reader_;
 
   DISALLOW_COPY_AND_ASSIGN(SaveToStringBodyHandler);
 };
@@ -127,14 +250,14 @@
   int NetError() const override;
   const ResourceResponseHead* ResponseInfo() const override;
 
-  bool allow_partial_results() const { return allow_partial_results_; }
-
-  // Called by BodyHandler when the body pipe was closed. This could indicate an
-  // error, concellation, or completion. To determine which case this is, the
-  // size will also be compared to the size reported in
-  // ResourceRequestCompletionStatus(), if ResourceRequestCompletionStatus
-  // indicates a success.
-  void OnBodyPipeClosed(int64_t received_body_size);
+  // Called by BodyHandler when the BodyHandler body handler is done. If |error|
+  // is not net::OK, some error occurred reading or consuming the body. If it is
+  // net::OK, the pipe was closed and all data received was successfully
+  // handled. This could indicate an error, concellation, or completion. To
+  // determine which case this is, the size will also be compared to the size
+  // reported in ResourceRequestCompletionStatus(), if
+  // ResourceRequestCompletionStatus indicates a success.
+  void OnBodyHandlerDone(net::Error error, int64_t received_body_size);
 
   // Finished the request with the provided error code, after freeing Mojo
   // resources. Closes any open pipes, so no URLLoader or BodyHandlers callbacks
@@ -197,85 +320,43 @@
 
   std::unique_ptr<ResourceResponseHead> response_info_;
 
+  SEQUENCE_CHECKER(sequence_checker_);
+
   DISALLOW_COPY_AND_ASSIGN(SimpleURLLoaderImpl);
 };
 
 void SaveToStringBodyHandler::OnStartLoadingResponseBody(
     mojo::ScopedDataPipeConsumerHandle body_data_pipe) {
-  body_data_pipe_ = std::move(body_data_pipe);
+  DCHECK(!body_);
+
   body_ = base::MakeUnique<std::string>();
-  handle_watcher_.Watch(
-      body_data_pipe_.get(),
-      MOJO_HANDLE_SIGNAL_READABLE | MOJO_HANDLE_SIGNAL_PEER_CLOSED,
-      MOJO_WATCH_CONDITION_SATISFIED,
-      base::BindRepeating(&SaveToStringBodyHandler::MojoReadyCallback,
-                          base::Unretained(this)));
-  ReadData();
+  body_reader_->Start(std::move(body_data_pipe));
 }
 
-void SaveToStringBodyHandler::NotifyConsumerOfCompletion() {
-  ClosePipe();
+net::Error SaveToStringBodyHandler::OnDataRead(uint32_t length,
+                                               const char* data) {
+  body_->append(data, length);
+  return net::OK;
+}
 
-  if (simple_url_loader()->NetError() != net::OK &&
-      !simple_url_loader()->allow_partial_results()) {
-    // If it's a partial download or an error was received, erase the body.
+void SaveToStringBodyHandler::OnDone(net::Error error, int64_t total_bytes) {
+  DCHECK_EQ(body_->size(), static_cast<size_t>(total_bytes));
+  simple_url_loader()->OnBodyHandlerDone(error, total_bytes);
+}
+
+void SaveToStringBodyHandler::NotifyConsumerOfCompletion(bool destroy_results) {
+  body_reader_.reset();
+  if (destroy_results)
     body_.reset();
-  }
 
   std::move(body_as_string_callback_).Run(std::move(body_));
 }
 
-void SaveToStringBodyHandler::MojoReadyCallback(
-    MojoResult result,
-    const mojo::HandleSignalsState& state) {
-  ReadData();
+SimpleURLLoaderImpl::SimpleURLLoaderImpl() : client_binding_(this) {
+  // Allow creation and use on different threads.
+  DETACH_FROM_SEQUENCE(sequence_checker_);
 }
 
-void SaveToStringBodyHandler::ReadData() {
-  while (true) {
-    const void* body_data;
-    uint32_t read_size;
-    MojoResult result = body_data_pipe_->BeginReadData(
-        &body_data, &read_size, MOJO_READ_DATA_FLAG_NONE);
-    if (result == MOJO_RESULT_SHOULD_WAIT) {
-      handle_watcher_.ArmOrNotify();
-      return;
-    }
-
-    // If the pipe was closed, unclear if it was an error or success. Notify
-    // the SimpleURLLoaderImpl of how much data was received.
-    if (result != MOJO_RESULT_OK) {
-      // The only error other than MOJO_RESULT_SHOULD_WAIT this should fail
-      // with is MOJO_RESULT_FAILED_PRECONDITION, in the case the pipe was
-      // closed.
-      DCHECK_EQ(MOJO_RESULT_FAILED_PRECONDITION, result);
-      ClosePipe();
-      simple_url_loader()->OnBodyPipeClosed(body_->size());
-      return;
-    }
-
-    // Check size against the limit.
-    size_t copy_size = std::min(max_body_size_ - body_->size(),
-                                static_cast<size_t>(read_size));
-    body_->append(static_cast<const char*>(body_data), copy_size);
-    body_data_pipe_->EndReadData(copy_size);
-
-    // Fail the request if the size limit was exceeded.
-    if (copy_size < read_size) {
-      ClosePipe();
-      simple_url_loader()->FinishWithResult(net::ERR_INSUFFICIENT_RESOURCES);
-      return;
-    }
-  }
-}
-
-void SaveToStringBodyHandler::ClosePipe() {
-  handle_watcher_.Cancel();
-  body_data_pipe_.reset();
-}
-
-SimpleURLLoaderImpl::SimpleURLLoaderImpl() : client_binding_(this) {}
-
 SimpleURLLoaderImpl::~SimpleURLLoaderImpl() {}
 
 void SimpleURLLoaderImpl::DownloadToString(
@@ -329,16 +410,27 @@
   return response_info_.get();
 }
 
-void SimpleURLLoaderImpl::OnBodyPipeClosed(int64_t received_body_size) {
+void SimpleURLLoaderImpl::OnBodyHandlerDone(net::Error error,
+                                            int64_t received_body_size) {
+  DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
   DCHECK(body_started_);
   DCHECK(!body_completed_);
 
+  // If there's an error, fail request and report it immediately.
+  if (error != net::OK) {
+    FinishWithResult(error);
+    return;
+  }
+
+  // Otherwise, need to wait until the URLRequestClient pipe receives a complete
+  // message or is closed, to determine if the entire body was received.
   body_completed_ = true;
   received_body_size_ = received_body_size;
   MaybeComplete();
 }
 
 void SimpleURLLoaderImpl::FinishWithResult(int net_error) {
+  DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
   DCHECK(!finished_);
 
   client_binding_.Close();
@@ -346,13 +438,16 @@
 
   finished_ = true;
   net_error_ = net_error;
-  body_handler_->NotifyConsumerOfCompletion();
+  // If it's a partial download or an error was received, erase the body.
+  bool destroy_results = net_error_ != net::OK && !allow_partial_results_;
+  body_handler_->NotifyConsumerOfCompletion(destroy_results);
 }
 
 void SimpleURLLoaderImpl::StartInternal(
     const ResourceRequest& resource_request,
     mojom::URLLoaderFactory* url_loader_factory,
     const net::NetworkTrafficAnnotationTag& annotation_tag) {
+  DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
   // It's illegal to use a single SimpleURLLoaderImpl to make multiple requests.
   DCHECK(!finished_);
   DCHECK(!url_loader_);
@@ -372,6 +467,7 @@
     const ResourceResponseHead& response_head,
     const base::Optional<net::SSLInfo>& ssl_info,
     mojom::DownloadedTempFilePtr downloaded_file) {
+  DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
   if (response_info_) {
     // The final headers have already been received, so the URLLoader is
     // violating the API contract.
@@ -389,6 +485,7 @@
 void SimpleURLLoaderImpl::OnReceiveRedirect(
     const net::RedirectInfo& redirect_info,
     const ResourceResponseHead& response_head) {
+  DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
   if (response_info_) {
     // If the headers have already been received, the URLLoader is violating the
     // API contract.
@@ -417,6 +514,7 @@
 
 void SimpleURLLoaderImpl::OnStartLoadingResponseBody(
     mojo::ScopedDataPipeConsumerHandle body) {
+  DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
   if (body_started_ || !response_info_) {
     // If this was already called, or the headers have not yet been received,
     // the URLLoader is violating the API contract.
@@ -429,6 +527,7 @@
 
 void SimpleURLLoaderImpl::OnComplete(
     const ResourceRequestCompletionStatus& status) {
+  DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
   // Request should not have been completed yet.
   DCHECK(!finished_);
   DCHECK(!request_completed_);
@@ -449,6 +548,7 @@
 }
 
 void SimpleURLLoaderImpl::OnConnectionError() {
+  DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
   // |this| closes the pipe to the URLLoader in OnComplete(), so this method
   // being called indicates the pipe was closed before completion, most likely
   // due to peer death, or peer not calling OnComplete() on cancellation.
@@ -466,6 +566,7 @@
 }
 
 void SimpleURLLoaderImpl::MaybeComplete() {
+  DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
   // Request should not have completed yet.
   DCHECK(!finished_);
 
diff --git a/content/public/common/simple_url_loader.h b/content/public/common/simple_url_loader.h
index b4f0250..b68b34b 100644
--- a/content/public/common/simple_url_loader.h
+++ b/content/public/common/simple_url_loader.h
@@ -5,6 +5,8 @@
 #ifndef CONTENT_PUBLIC_COMMON_SIMPLE_URL_LOADER_H_
 #define CONTENT_PUBLIC_COMMON_SIMPLE_URL_LOADER_H_
 
+#include <stdint.h>
+
 #include <memory>
 #include <string>
 
diff --git a/content/renderer/categorized_worker_pool.cc b/content/renderer/categorized_worker_pool.cc
index d2f0c81..5a1cfa97 100644
--- a/content/renderer/categorized_worker_pool.cc
+++ b/content/renderer/categorized_worker_pool.cc
@@ -75,7 +75,7 @@
 
     tasks_.erase(tasks_.begin(), tasks_.begin() + completed_tasks_.size());
 
-    tasks_.push_back(make_scoped_refptr(new ClosureTask(std::move(task))));
+    tasks_.push_back(base::MakeRefCounted<ClosureTask>(std::move(task)));
     graph_.Reset();
     for (const auto& graph_task : tasks_) {
       int dependencies = 0;
@@ -204,7 +204,7 @@
       });
   tasks_.erase(end, tasks_.end());
 
-  tasks_.push_back(make_scoped_refptr(new ClosureTask(std::move(task))));
+  tasks_.push_back(base::MakeRefCounted<ClosureTask>(std::move(task)));
   graph_.Reset();
   for (const auto& graph_task : tasks_) {
     // Delayed tasks are assigned FOREGROUND category, ensuring that they run as
diff --git a/content/renderer/image_capture/image_capture_frame_grabber.cc b/content/renderer/image_capture/image_capture_frame_grabber.cc
index 6467bba..b4134879e 100644
--- a/content/renderer/image_capture/image_capture_frame_grabber.cc
+++ b/content/renderer/image_capture/image_capture_frame_grabber.cc
@@ -139,12 +139,13 @@
   // https://crbug.com/623042.
   frame_grab_in_progress_ = true;
   MediaStreamVideoSink::ConnectToTrack(
-      *track, base::Bind(&SingleShotFrameHandler::OnVideoFrameOnIOThread,
-                         make_scoped_refptr(new SingleShotFrameHandler),
-                         media::BindToCurrentLoop(
-                             base::Bind(&ImageCaptureFrameGrabber::OnSkImage,
-                                        weak_factory_.GetWeakPtr(),
-                                        base::Passed(&scoped_callbacks)))),
+      *track,
+      base::Bind(
+          &SingleShotFrameHandler::OnVideoFrameOnIOThread,
+          base::MakeRefCounted<SingleShotFrameHandler>(),
+          media::BindToCurrentLoop(base::Bind(
+              &ImageCaptureFrameGrabber::OnSkImage, weak_factory_.GetWeakPtr(),
+              base::Passed(&scoped_callbacks)))),
       false);
 }
 
diff --git a/content/renderer/media/media_devices_event_dispatcher_unittest.cc b/content/renderer/media/media_devices_event_dispatcher_unittest.cc
index c6071b65..674c5597 100644
--- a/content/renderer/media/media_devices_event_dispatcher_unittest.cc
+++ b/content/renderer/media/media_devices_event_dispatcher_unittest.cc
@@ -57,6 +57,18 @@
     NOTREACHED();
   }
 
+  void GetAllVideoInputDeviceFormats(
+      const std::string&,
+      GetAllVideoInputDeviceFormatsCallback) override {
+    NOTREACHED();
+  }
+
+  void GetAvailableVideoInputDeviceFormats(
+      const std::string&,
+      GetAvailableVideoInputDeviceFormatsCallback) override {
+    NOTREACHED();
+  }
+
   ::mojom::MediaDevicesDispatcherHostPtr CreateInterfacePtrAndBind() {
     ::mojom::MediaDevicesDispatcherHostPtr ptr;
     binding_.Bind(mojo::MakeRequest(&ptr));
diff --git a/content/renderer/media/user_media_client_impl_unittest.cc b/content/renderer/media/user_media_client_impl_unittest.cc
index 8ad75460..3acd71e 100644
--- a/content/renderer/media/user_media_client_impl_unittest.cc
+++ b/content/renderer/media/user_media_client_impl_unittest.cc
@@ -197,6 +197,18 @@
   MOCK_METHOD2(UnsubscribeDeviceChangeNotifications,
                void(MediaDeviceType type, uint32_t subscription_id));
 
+  void GetAllVideoInputDeviceFormats(
+      const std::string&,
+      GetAllVideoInputDeviceFormatsCallback) override {
+    NOTREACHED();
+  }
+
+  void GetAvailableVideoInputDeviceFormats(
+      const std::string&,
+      GetAvailableVideoInputDeviceFormatsCallback) override {
+    NOTREACHED();
+  }
+
  private:
   media::AudioParameters audio_parameters_ =
       media::AudioParameters::UnavailableDeviceParams();
diff --git a/content/renderer/render_thread_impl.cc b/content/renderer/render_thread_impl.cc
index 1f51cbf..79d6454 100644
--- a/content/renderer/render_thread_impl.cc
+++ b/content/renderer/render_thread_impl.cc
@@ -394,12 +394,12 @@
   attributes.enable_oop_rasterization = support_oop_rasterization;
 
   const bool automatic_flushes = false;
-  return make_scoped_refptr(new ui::ContextProviderCommandBuffer(
+  return base::MakeRefCounted<ui::ContextProviderCommandBuffer>(
       std::move(gpu_channel_host), stream_id, stream_priority,
       gpu::kNullSurfaceHandle,
       GURL("chrome://gpu/RenderThreadImpl::CreateOffscreenContext/" +
            ui::command_buffer_metrics::ContextTypeToString(type)),
-      automatic_flushes, support_locking, limits, attributes, nullptr, type));
+      automatic_flushes, support_locking, limits, attributes, nullptr, type);
 }
 
 bool IsRunningInMash() {
@@ -1083,9 +1083,9 @@
     mojom::FrameHostInterfaceBrokerPtr frame_host_interface_broker) {
   std::pair<PendingFrameCreateMap::iterator, bool> result =
       pending_frame_creates_.insert(std::make_pair(
-          routing_id, make_scoped_refptr(new PendingFrameCreate(
+          routing_id, base::MakeRefCounted<PendingFrameCreate>(
                           browser_info, routing_id, std::move(frame_request),
-                          std::move(frame_host_interface_broker)))));
+                          std::move(frame_host_interface_broker))));
   CHECK(result.second) << "Inserting a duplicate item.";
 }
 
diff --git a/content/renderer/render_thread_impl_browsertest.cc b/content/renderer/render_thread_impl_browsertest.cc
index c10caff..0c9e7e1e 100644
--- a/content/renderer/render_thread_impl_browsertest.cc
+++ b/content/renderer/render_thread_impl_browsertest.cc
@@ -201,7 +201,7 @@
                                   nullptr, io_task_runner);
 
     mock_process_.reset(new MockRenderProcess);
-    test_task_counter_ = make_scoped_refptr(new TestTaskCounter());
+    test_task_counter_ = base::MakeRefCounted<TestTaskCounter>();
 
     // RenderThreadImpl expects the browser to pass these flags.
     base::CommandLine* cmd = base::CommandLine::ForCurrentProcess();
diff --git a/content/shell/renderer/layout_test/blink_test_runner.cc b/content/shell/renderer/layout_test/blink_test_runner.cc
index 95cd5fd..f6b0ba2 100644
--- a/content/shell/renderer/layout_test/blink_test_runner.cc
+++ b/content/shell/renderer/layout_test/blink_test_runner.cc
@@ -758,7 +758,7 @@
   DCHECK(stream);
 #if BUILDFLAG(ENABLE_WEBRTC)
   return AddAudioTrackToMediaStream(
-      make_scoped_refptr(new MockAudioCapturerSource()),
+      base::MakeRefCounted<MockAudioCapturerSource>(),
       48000,  // sample rate
       media::CHANNEL_LAYOUT_STEREO,
       480,    // sample frames per buffer
diff --git a/content/test/layouttest_support.cc b/content/test/layouttest_support.cc
index 8727d98..8dfbf20e 100644
--- a/content/test/layouttest_support.cc
+++ b/content/test/layouttest_support.cc
@@ -402,14 +402,14 @@
     const bool support_locking = false;
 
     auto context_provider =
-        make_scoped_refptr(new ui::ContextProviderCommandBuffer(
+        base::MakeRefCounted<ui::ContextProviderCommandBuffer>(
             gpu_channel_, kGpuStreamIdDefault, kGpuStreamPriorityDefault,
             gpu::kNullSurfaceHandle,
             GURL("chrome://gpu/"
                  "LayoutTestDependenciesImpl::CreateOutputSurface"),
             automatic_flushes, support_locking, gpu::SharedMemoryLimits(),
             attributes, nullptr,
-            ui::command_buffer_metrics::OFFSCREEN_CONTEXT_FOR_TESTING));
+            ui::command_buffer_metrics::OFFSCREEN_CONTEXT_FOR_TESTING);
     context_provider->BindToCurrentThread();
 
     bool flipped_output_surface = false;
diff --git a/content/test/test_blink_web_unit_test_support.cc b/content/test/test_blink_web_unit_test_support.cc
index eb3154e3..9f4c763 100644
--- a/content/test/test_blink_web_unit_test_support.cc
+++ b/content/test/test_blink_web_unit_test_support.cc
@@ -116,7 +116,7 @@
     // of message loops, and their types are not known upfront. Some tests also
     // create their own thread bundles or message loops, and doing the same in
     // TestBlinkWebUnitTestSupport would introduce a conflict.
-    dummy_task_runner = make_scoped_refptr(new DummyTaskRunner());
+    dummy_task_runner = base::MakeRefCounted<DummyTaskRunner>();
     dummy_task_runner_handle.reset(
         new base::ThreadTaskRunnerHandle(dummy_task_runner));
   }
diff --git a/extensions/browser/api/device_permissions_prompt.cc b/extensions/browser/api/device_permissions_prompt.cc
index c823d0e..7324d68 100644
--- a/extensions/browser/api/device_permissions_prompt.cc
+++ b/extensions/browser/api/device_permissions_prompt.cc
@@ -390,18 +390,18 @@
 scoped_refptr<DevicePermissionsPrompt::Prompt>
 DevicePermissionsPrompt::CreateHidPromptForTest(const Extension* extension,
                                                 bool multiple) {
-  return make_scoped_refptr(new HidDevicePermissionsPrompt(
+  return base::MakeRefCounted<HidDevicePermissionsPrompt>(
       extension, nullptr, multiple, std::vector<HidDeviceFilter>(),
-      base::Bind(&NoopHidCallback)));
+      base::Bind(&NoopHidCallback));
 }
 
 // static
 scoped_refptr<DevicePermissionsPrompt::Prompt>
 DevicePermissionsPrompt::CreateUsbPromptForTest(const Extension* extension,
                                                 bool multiple) {
-  return make_scoped_refptr(new UsbDevicePermissionsPrompt(
+  return base::MakeRefCounted<UsbDevicePermissionsPrompt>(
       extension, nullptr, multiple, std::vector<UsbDeviceFilterPtr>(),
-      base::Bind(&NoopUsbCallback)));
+      base::Bind(&NoopUsbCallback));
 }
 
 }  // namespace extensions
diff --git a/extensions/browser/content_verify_job_unittest.cc b/extensions/browser/content_verify_job_unittest.cc
index e3f8434..dad557f 100644
--- a/extensions/browser/content_verify_job_unittest.cc
+++ b/extensions/browser/content_verify_job_unittest.cc
@@ -26,11 +26,11 @@
 scoped_refptr<ContentHashReader> CreateContentHashReader(
     const Extension& extension,
     const base::FilePath& extension_resource_path) {
-  return make_scoped_refptr(new ContentHashReader(
+  return base::MakeRefCounted<ContentHashReader>(
       extension.id(), *extension.version(), extension.path(),
       extension_resource_path,
       ContentVerifierKey(kWebstoreSignaturesPublicKey,
-                         kWebstoreSignaturesPublicKeySize)));
+                         kWebstoreSignaturesPublicKeySize));
 }
 
 void DoNothingWithReasonParam(ContentVerifyJob::FailureReason reason) {}
diff --git a/extensions/common/file_util.cc b/extensions/common/file_util.cc
index a6b338a08..4593cf4 100644
--- a/extensions/common/file_util.cc
+++ b/extensions/common/file_util.cc
@@ -342,8 +342,9 @@
 bool CheckForIllegalFilenames(const base::FilePath& extension_path,
                               std::string* error) {
   // Reserved underscore names.
-  static const base::FilePath::CharType* reserved_names[] = {
-      kLocaleFolder, kPlatformSpecificFolder, FILE_PATH_LITERAL("__MACOSX"), };
+  static const base::FilePath::CharType* const reserved_names[] = {
+      kLocaleFolder, kPlatformSpecificFolder, FILE_PATH_LITERAL("__MACOSX"),
+  };
   CR_DEFINE_STATIC_LOCAL(
       std::set<base::FilePath::StringType>,
       reserved_underscore_names,
diff --git a/extensions/common/file_util_unittest.cc b/extensions/common/file_util_unittest.cc
index 9fae938..b9696fdd 100644
--- a/extensions/common/file_util_unittest.cc
+++ b/extensions/common/file_util_unittest.cc
@@ -226,8 +226,8 @@
   base::ScopedTempDir temp;
   ASSERT_TRUE(temp.CreateUniqueTempDir());
 
-  const base::FilePath::CharType* folders[] = {
-      extensions::kLocaleFolder, extensions::kPlatformSpecificFolder};
+  static const base::FilePath::CharType* const folders[] = {
+      kLocaleFolder, kPlatformSpecificFolder};
 
   for (size_t i = 0; i < arraysize(folders); i++) {
     base::FilePath src_path = temp.GetPath().Append(folders[i]);
@@ -242,7 +242,7 @@
   base::ScopedTempDir temp;
   ASSERT_TRUE(temp.CreateUniqueTempDir());
 
-  base::FilePath src_path = temp.GetPath().Append(extensions::kLocaleFolder);
+  base::FilePath src_path = temp.GetPath().Append(kLocaleFolder);
   ASSERT_TRUE(base::CreateDirectory(src_path));
 
   src_path = temp.GetPath().AppendASCII("_some_dir");
@@ -338,7 +338,7 @@
       kManifest, temp.GetPath(), Manifest::UNPACKED, 0, &error);
   ASSERT_TRUE(extension.get()) << error;
 
-  std::vector<extensions::InstallWarning> warnings;
+  std::vector<InstallWarning> warnings;
   EXPECT_TRUE(file_util::ValidateExtension(extension.get(), &error, &warnings))
       << error;
   EXPECT_EQ(0U, warnings.size());
@@ -358,7 +358,7 @@
   scripts->AppendString("foo.js");
 
   std::string error;
-  std::vector<extensions::InstallWarning> warnings;
+  std::vector<InstallWarning> warnings;
   scoped_refptr<Extension> extension = LoadExtensionManifest(
       *value, temp.GetPath(), Manifest::UNPACKED, 0, &error);
   ASSERT_TRUE(extension.get()) << error;
@@ -470,7 +470,7 @@
   ASSERT_EQ(1u, extension->install_warnings().size());
   EXPECT_THAT(extension->install_warnings(),
               testing::ElementsAre(testing::Field(
-                  &extensions::InstallWarning::message,
+                  &InstallWarning::message,
                   testing::ContainsRegex(
                       "extension includes the key file.*ext_root.a_key.pem"))));
 
@@ -542,8 +542,7 @@
     GURL url(test_cases[i].url);
     base::FilePath expected_path =
         base::FilePath::FromUTF8Unsafe(test_cases[i].expected_relative_path);
-    base::FilePath actual_path =
-        extensions::file_util::ExtensionURLToRelativeFilePath(url);
+    base::FilePath actual_path = file_util::ExtensionURLToRelativeFilePath(url);
     EXPECT_FALSE(actual_path.IsAbsolute()) <<
       " For the path " << actual_path.value();
     EXPECT_EQ(expected_path.value(), actual_path.value()) <<
diff --git a/extensions/renderer/api/display_source/wifi_display/wifi_display_audio_encoder_lpcm.cc b/extensions/renderer/api/display_source/wifi_display/wifi_display_audio_encoder_lpcm.cc
index 6e6f169..4daefa3 100644
--- a/extensions/renderer/api/display_source/wifi_display/wifi_display_audio_encoder_lpcm.cc
+++ b/extensions/renderer/api/display_source/wifi_display/wifi_display_audio_encoder_lpcm.cc
@@ -231,7 +231,7 @@
     const wds::AudioCodec& audio_codec,
     const AudioEncoderCallback& encoder_callback) {
   encoder_callback.Run(
-      make_scoped_refptr(new WiFiDisplayAudioEncoderLPCM(audio_codec)));
+      base::MakeRefCounted<WiFiDisplayAudioEncoderLPCM>(audio_codec));
 }
 
 }  // namespace extensions
diff --git a/extensions/utility/unpacker.cc b/extensions/utility/unpacker.cc
index 81b8d5a..cec17aa 100644
--- a/extensions/utility/unpacker.cc
+++ b/extensions/utility/unpacker.cc
@@ -48,7 +48,7 @@
 // A limit to stop us passing dangerously large canvases to the browser.
 const int kMaxImageCanvas = 4096 * 4096;
 
-static const base::FilePath::CharType* kAllowedThemeFiletypes[] = {
+constexpr const base::FilePath::CharType* kAllowedThemeFiletypes[] = {
     FILE_PATH_LITERAL(".bmp"),  FILE_PATH_LITERAL(".gif"),
     FILE_PATH_LITERAL(".jpeg"), FILE_PATH_LITERAL(".jpg"),
     FILE_PATH_LITERAL(".json"), FILE_PATH_LITERAL(".png"),
diff --git a/gpu/ipc/service/image_transport_surface_win.cc b/gpu/ipc/service/image_transport_surface_win.cc
index 996a32e..2a0a6b26 100644
--- a/gpu/ipc/service/image_transport_surface_win.cc
+++ b/gpu/ipc/service/image_transport_surface_win.cc
@@ -52,8 +52,8 @@
 
     if (gl::GLSurfaceEGL::IsDirectCompositionSupported()) {
       scoped_refptr<DirectCompositionSurfaceWin> egl_surface =
-          make_scoped_refptr(new DirectCompositionSurfaceWin(
-              std::move(vsync_provider), delegate, surface_handle));
+          base::MakeRefCounted<DirectCompositionSurfaceWin>(
+              std::move(vsync_provider), delegate, surface_handle);
       if (!egl_surface->Initialize())
         return nullptr;
       surface = egl_surface;
diff --git a/ios/chrome/browser/BUILD.gn b/ios/chrome/browser/BUILD.gn
index 58f4b83..5640efa 100644
--- a/ios/chrome/browser/BUILD.gn
+++ b/ios/chrome/browser/BUILD.gn
@@ -122,6 +122,7 @@
     "//ios/chrome/browser/drag_and_drop",
     "//ios/chrome/browser/ssl:features",
     "//ios/chrome/browser/sync/glue",
+    "//ios/chrome/browser/ui/main:feature_flags",
     "//ios/chrome/browser/web:features",
     "//ios/chrome/common",
     "//ios/components/io_thread",
diff --git a/ios/chrome/browser/about_flags.mm b/ios/chrome/browser/about_flags.mm
index e49b53f6..230431a 100644
--- a/ios/chrome/browser/about_flags.mm
+++ b/ios/chrome/browser/about_flags.mm
@@ -39,6 +39,7 @@
 #include "ios/chrome/browser/drag_and_drop/drag_and_drop_flag.h"
 #include "ios/chrome/browser/ios_chrome_flag_descriptions.h"
 #include "ios/chrome/browser/ssl/captive_portal_features.h"
+#include "ios/chrome/browser/ui/main/main_feature_flags.h"
 #include "ios/chrome/browser/web/features.h"
 #include "ios/chrome/grit/ios_strings.h"
 #include "ios/public/provider/chrome/browser/chrome_browser_provider.h"
@@ -182,9 +183,12 @@
 #if defined(__IPHONE_11_0) && (__IPHONE_OS_VERSION_MAX_ALLOWED >= __IPHONE_11_0)
     {"drag_and_drop", flag_descriptions::kDragAndDropName,
      flag_descriptions::kDragAndDropDescription, flags_ui::kOsIos,
-     FEATURE_VALUE_TYPE(kDragAndDrop)}
+     FEATURE_VALUE_TYPE(kDragAndDrop)},
 #endif
-};
+    {"tab_switcher_presents_bvc",
+     flag_descriptions::kTabSwitcherPresentsBVCName,
+     flag_descriptions::kTabSwitcherPresentsBVCDescription, flags_ui::kOsIos,
+     FEATURE_VALUE_TYPE(kTabSwitcherPresentsBVC)}};
 
 // Add all switches from experimental flags to |command_line|.
 void AppendSwitchesFromExperimentalSettings(base::CommandLine* command_line) {
diff --git a/ios/chrome/browser/ios_chrome_flag_descriptions.cc b/ios/chrome/browser/ios_chrome_flag_descriptions.cc
index 5faa1f9c..01bb070 100644
--- a/ios/chrome/browser/ios_chrome_flag_descriptions.cc
+++ b/ios/chrome/browser/ios_chrome_flag_descriptions.cc
@@ -74,6 +74,12 @@
     "When enabled, the omnibox will include suggestions for web pages "
     "broadcast by devices near you.";
 
+const char kTabSwitcherPresentsBVCName[] = "TabSwitcher Presents BVC";
+const char kTabSwitcherPresentsBVCDescription[] =
+    "When enabled, the tab switcher will present the BVC, so that when the "
+    "BVC is visible, the tab switcher will remain in the VC hierarchy "
+    "underneath it.";
+
 const char kUseDdljsonApiName[] = "Use new ddljson API for Doodles";
 const char kUseDdljsonApiDescription[] =
     "Enables the new ddljson API to fetch Doodles for the NTP.";
diff --git a/ios/chrome/browser/ios_chrome_flag_descriptions.h b/ios/chrome/browser/ios_chrome_flag_descriptions.h
index 04b563e..2fe1f6f 100644
--- a/ios/chrome/browser/ios_chrome_flag_descriptions.h
+++ b/ios/chrome/browser/ios_chrome_flag_descriptions.h
@@ -62,6 +62,11 @@
 extern const char kPhysicalWeb[];
 extern const char kPhysicalWebDescription[];
 
+// Title and description for the flag to enable the TabSwitcher to present the
+// BVC.
+extern const char kTabSwitcherPresentsBVCName[];
+extern const char kTabSwitcherPresentsBVCDescription[];
+
 // Title and description for the flag to enable the ddljson Doodle API.
 extern const char kUseDdljsonApiName[];
 extern const char kUseDdljsonApiDescription[];
diff --git a/ios/chrome/browser/ios_chrome_io_thread_unittest.mm b/ios/chrome/browser/ios_chrome_io_thread_unittest.mm
index 379c30c..e148b18d 100644
--- a/ios/chrome/browser/ios_chrome_io_thread_unittest.mm
+++ b/ios/chrome/browser/ios_chrome_io_thread_unittest.mm
@@ -60,8 +60,7 @@
 
 TEST_F(IOSChromeIOThreadTest, AssertNoUrlRequests) {
   PrefServiceFactory pref_service_factory;
-  pref_service_factory.set_user_prefs(
-      make_scoped_refptr(new TestingPrefStore()));
+  pref_service_factory.set_user_prefs(base::MakeRefCounted<TestingPrefStore>());
 
   scoped_refptr<PrefRegistrySimple> pref_registry = new PrefRegistrySimple;
   PrefProxyConfigTrackerImpl::RegisterPrefs(pref_registry.get());
diff --git a/ios/chrome/browser/prefs/ios_chrome_pref_service_factory.cc b/ios/chrome/browser/prefs/ios_chrome_pref_service_factory.cc
index e60535f3..cd104c0 100644
--- a/ios/chrome/browser/prefs/ios_chrome_pref_service_factory.cc
+++ b/ios/chrome/browser/prefs/ios_chrome_pref_service_factory.cc
@@ -35,8 +35,8 @@
 void PrepareFactory(sync_preferences::PrefServiceSyncableFactory* factory,
                     const base::FilePath& pref_filename,
                     base::SequencedTaskRunner* pref_io_task_runner) {
-  factory->set_user_prefs(make_scoped_refptr(new JsonPrefStore(
-      pref_filename, pref_io_task_runner, std::unique_ptr<PrefFilter>())));
+  factory->set_user_prefs(base::MakeRefCounted<JsonPrefStore>(
+      pref_filename, pref_io_task_runner, std::unique_ptr<PrefFilter>()));
 
   factory->set_read_error_callback(base::Bind(&HandleReadError));
   factory->SetPrefModelAssociatorClient(
diff --git a/ios/chrome/browser/ui/main/BUILD.gn b/ios/chrome/browser/ui/main/BUILD.gn
index 33426997..6034402 100644
--- a/ios/chrome/browser/ui/main/BUILD.gn
+++ b/ios/chrome/browser/ui/main/BUILD.gn
@@ -34,6 +34,17 @@
   libs = [ "UIKit.framework" ]
 }
 
+source_set("feature_flags") {
+  configs += [ "//build/config/compiler:enable_arc" ]
+  sources = [
+    "main_feature_flags.cc",
+    "main_feature_flags.h",
+  ]
+  deps = [
+    "//base",
+  ]
+}
+
 source_set("unit_tests") {
   configs += [ "//build/config/compiler:enable_arc" ]
   testonly = true
diff --git a/ios/chrome/browser/ui/main/main_feature_flags.cc b/ios/chrome/browser/ui/main/main_feature_flags.cc
new file mode 100644
index 0000000..56e8b55
--- /dev/null
+++ b/ios/chrome/browser/ui/main/main_feature_flags.cc
@@ -0,0 +1,12 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "ios/chrome/browser/ui/main/main_feature_flags.h"
+
+const base::Feature kTabSwitcherPresentsBVC{"TabSwitcherPresentsBVC",
+                                            base::FEATURE_DISABLED_BY_DEFAULT};
+
+bool TabSwitcherPresentsBVCEnabled() {
+  return base::FeatureList::IsEnabled(kTabSwitcherPresentsBVC);
+}
diff --git a/ios/chrome/browser/ui/main/main_feature_flags.h b/ios/chrome/browser/ui/main/main_feature_flags.h
new file mode 100644
index 0000000..17462b0
--- /dev/null
+++ b/ios/chrome/browser/ui/main/main_feature_flags.h
@@ -0,0 +1,15 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef IOS_CHROME_BROWSER_UI_MAIN_MAIN_FEATURE_FLAGS_H_
+#define IOS_CHROME_BROWSER_UI_MAIN_MAIN_FEATURE_FLAGS_H_
+
+#include "base/feature_list.h"
+
+extern const base::Feature kTabSwitcherPresentsBVC;
+
+// Returns whether the tab switcher will present the BVC..
+bool TabSwitcherPresentsBVCEnabled();
+
+#endif  // IOS_CHROME_BROWSER_UI_MAIN_MAIN_FEATURE_FLAGS_H_
diff --git a/ios/chrome/browser/ui/payments/payment_request_coordinator.mm b/ios/chrome/browser/ui/payments/payment_request_coordinator.mm
index f157de79..1a2d8054 100644
--- a/ios/chrome/browser/ui/payments/payment_request_coordinator.mm
+++ b/ios/chrome/browser/ui/payments/payment_request_coordinator.mm
@@ -147,6 +147,9 @@
 
 - (void)setPending:(BOOL)pending {
   _pending = pending;
+
+  [_updatePaymentSummaryItemTimer invalidate];
+
   [_viewController setPending:pending];
   [_viewController loadModel];
   [[_viewController collectionView] reloadData];
diff --git a/ios/components/io_thread/ios_io_thread_unittest.mm b/ios/components/io_thread/ios_io_thread_unittest.mm
index a01ab20..816f0ce 100644
--- a/ios/components/io_thread/ios_io_thread_unittest.mm
+++ b/ios/components/io_thread/ios_io_thread_unittest.mm
@@ -64,8 +64,7 @@
 // url request context.
 TEST_F(IOSIOThreadTest, AssertSystemUrlRequestContext) {
   PrefServiceFactory pref_service_factory;
-  pref_service_factory.set_user_prefs(
-      make_scoped_refptr(new TestingPrefStore()));
+  pref_service_factory.set_user_prefs(base::MakeRefCounted<TestingPrefStore>());
 
   scoped_refptr<PrefRegistrySimple> pref_registry = new PrefRegistrySimple;
   PrefProxyConfigTrackerImpl::RegisterPrefs(pref_registry.get());
diff --git a/ios/web/web_state/js/context_menu_js_unittest.mm b/ios/web/web_state/js/context_menu_js_unittest.mm
index fe44539..3999427 100644
--- a/ios/web/web_state/js/context_menu_js_unittest.mm
+++ b/ios/web/web_state/js/context_menu_js_unittest.mm
@@ -8,7 +8,6 @@
 #import <Foundation/Foundation.h>
 #import <UIKit/UIKit.h>
 
-#include "base/ios/ios_util.h"
 #include "base/macros.h"
 #include "base/strings/stringprintf.h"
 #import "ios/web/public/test/web_test_with_web_state.h"
@@ -68,6 +67,7 @@
     for (size_t i = 0; i < arraysize(test_data); i++) {
       const TestCoordinatesAndExpectedValue& data = test_data[i];
       LoadHtml(page_content);
+      ExecuteJavaScript(@"document.getElementsByTagName('p')");  // Force layout
       id result = ExecuteGetElementFromPointJavaScript(data.x, data.y);
       EXPECT_NSEQ(data.expected_value, result)
           << " in test " << i << ": (" << data.x << ", " << data.y << ")";
@@ -91,14 +91,6 @@
 
 // Tests that __gCrWeb.getElementFromPoint function returns correct src.
 TEST_F(ContextMenuJsTest, GetImageUrlAtPoint) {
-// TODO(crbug.com/767339): This is extremely flaky on iPhone device with iOS 11.
-// Fix it and reenable it.
-#if !TARGET_IPHONE_SIMULATOR
-  if (base::ios::IsRunningOnIOS11OrLater()) {
-    return;
-  }
-#endif
-
   NSString* html =
       @"<img id='foo' style='width:200;height:200;' src='file:///bogus'/>";
   NSDictionary* expected_value = @{
@@ -135,13 +127,6 @@
 }
 
 TEST_F(ContextMenuJsTest, TextAreaStopsProximity) {
-// TODO(crbug.com/767339): This is extremely flaky on iPhone device with iOS 11.
-// Fix it and reenable it.
-#if !TARGET_IPHONE_SIMULATOR
-  if (base::ios::IsRunningOnIOS11OrLater()) {
-    return;
-  }
-#endif
   NSString* html =
       @"<html><body style='margin-left:10px;margin-top:10px;'>"
        "<div style='width:100px;height:100px;'>"
@@ -165,6 +150,7 @@
 
   for (size_t i = 0; i < arraysize(test_data); i++) {
     const TestCoordinatesAndExpectedValue& data = test_data[i];
+    ExecuteJavaScript(@"document.getElementsByTagName('img')");  // Force layout
     LoadHtml(html);
     id result = ExecuteGetElementFromPointJavaScript(data.x, data.y);
     EXPECT_NSEQ(data.expected_value, result)
diff --git a/ipc/ipc_channel_proxy_unittest.cc b/ipc/ipc_channel_proxy_unittest.cc
index ba3be18b..95182d31e 100644
--- a/ipc/ipc_channel_proxy_unittest.cc
+++ b/ipc/ipc_channel_proxy_unittest.cc
@@ -280,9 +280,9 @@
   // Construct a filter per message class.
   std::vector<scoped_refptr<MessageCountFilter>> class_filters;
   class_filters.push_back(
-      make_scoped_refptr(new MessageCountFilter(TestMsgStart)));
+      base::MakeRefCounted<MessageCountFilter>(TestMsgStart));
   class_filters.push_back(
-      make_scoped_refptr(new MessageCountFilter(AutomationMsgStart)));
+      base::MakeRefCounted<MessageCountFilter>(AutomationMsgStart));
   for (size_t i = 0; i < class_filters.size(); ++i)
     channel_proxy()->AddFilter(class_filters[i].get());
 
diff --git a/media/audio/audio_output_controller.cc b/media/audio/audio_output_controller.cc
index dd03cc93..7046192b 100644
--- a/media/audio/audio_output_controller.cc
+++ b/media/audio/audio_output_controller.cc
@@ -23,10 +23,47 @@
 
 namespace media {
 namespace {
+
 // Time in seconds between two successive measurements of audio power levels.
 constexpr int kPowerMonitorLogIntervalSeconds = 15;
+
+// Used to log the result of rendering startup.
+// Elements in this enum should not be deleted or rearranged; the only
+// permitted operation is to add new elements before
+// STREAM_CREATION_RESULT_MAX and update STREAM_CREATION_RESULT_MAX.
+enum StreamCreationResult {
+  STREAM_CREATION_OK = 0,
+  STREAM_CREATION_CREATE_FAILED = 1,
+  STREAM_CREATION_OPEN_FAILED = 2,
+  STREAM_CREATION_RESULT_MAX = STREAM_CREATION_OPEN_FAILED,
+};
+
+void LogStreamCreationResult(bool for_device_change,
+                             StreamCreationResult result) {
+  if (for_device_change) {
+    UMA_HISTOGRAM_ENUMERATION(
+        "Media.AudioOutputController.ProxyStreamCreationResultForDeviceChange",
+        result, STREAM_CREATION_RESULT_MAX + 1);
+  } else {
+    UMA_HISTOGRAM_ENUMERATION(
+        "Media.AudioOutputController.ProxyStreamCreationResult", result,
+        STREAM_CREATION_RESULT_MAX + 1);
+  }
+}
+
 }  // namespace
 
+AudioOutputController::ErrorStatisticsTracker::ErrorStatisticsTracker() {}
+
+AudioOutputController::ErrorStatisticsTracker::~ErrorStatisticsTracker() {
+  UMA_HISTOGRAM_BOOLEAN("Media.AudioOutputController.CallbackError",
+                        error_during_callback_);
+}
+
+void AudioOutputController::ErrorStatisticsTracker::RegisterError() {
+  error_during_callback_ = true;
+}
+
 AudioOutputController::AudioOutputController(
     AudioManager* audio_manager,
     EventHandler* handler,
@@ -128,17 +165,22 @@
       audio_manager_->MakeAudioOutputStreamProxy(params_, output_device_id_);
   if (!stream_) {
     state_ = kError;
+    LogStreamCreationResult(is_for_device_change,
+                            STREAM_CREATION_CREATE_FAILED);
     handler_->OnControllerError();
     return;
   }
 
   if (!stream_->Open()) {
     DoStopCloseAndClearStream();
+    LogStreamCreationResult(is_for_device_change, STREAM_CREATION_OPEN_FAILED);
     state_ = kError;
     handler_->OnControllerError();
     return;
   }
 
+  LogStreamCreationResult(is_for_device_change, STREAM_CREATION_OK);
+
   // Everything started okay, so re-register for state change callbacks if
   // stream_ was created via AudioManager.
   if (stream_ != diverting_to_stream_)
@@ -176,6 +218,8 @@
 
   stream_->Start(this);
 
+  stats_tracker_.emplace();
+
   // For UMA tracking purposes, start the wedge detection timer.  This allows us
   // to record statistics about the number of wedged playbacks in the field.
   //
@@ -243,6 +287,8 @@
     DoStopCloseAndClearStream();
     sync_reader_->Close();
     state_ = kClosed;
+
+    stats_tracker_.reset();
   }
 }
 
@@ -266,8 +312,13 @@
 
 void AudioOutputController::DoReportError() {
   DCHECK(message_loop_->BelongsToCurrentThread());
-  if (state_ != kClosed)
+  TRACE_EVENT0("audio", "AudioOutputController::DoReportError");
+  DLOG(ERROR) << "AudioOutputController::DoReportError";
+  if (state_ != kClosed) {
+    DCHECK(stats_tracker_);
+    stats_tracker_->RegisterError();
     handler_->OnControllerError();
+  }
 }
 
 int AudioOutputController::OnMoreData(base::TimeDelta delay,
@@ -400,7 +451,7 @@
         return "closed";
       case AudioOutputController::kError:
         return "error";
-    };
+    }
     return "unknown";
   };
 
diff --git a/media/audio/audio_output_controller.h b/media/audio/audio_output_controller.h
index 537bf0325..701f483 100644
--- a/media/audio/audio_output_controller.h
+++ b/media/audio/audio_output_controller.h
@@ -7,15 +7,16 @@
 
 #include <stdint.h>
 #include <memory>
-#include <set>
 #include <string>
 #include <utility>
 
 #include "base/atomic_ref_count.h"
 #include "base/callback.h"
+#include "base/containers/flat_set.h"
 #include "base/macros.h"
 #include "base/memory/ref_counted.h"
 #include "base/memory/weak_ptr.h"
+#include "base/optional.h"
 #include "base/threading/thread_checker.h"
 #include "base/timer/timer.h"
 #include "build/build_config.h"
@@ -193,6 +194,21 @@
   ~AudioOutputController() override;
 
  private:
+  // Used to store various stats about a stream. The lifetime of this object
+  // should be that of a single stream, from Play to Close. TODO(maxmorin):
+  // Move wedge checking code to this class, see also crbug.com/766677.
+  class ErrorStatisticsTracker {
+   public:
+    ErrorStatisticsTracker();
+    ~ErrorStatisticsTracker();
+
+    // Called to indicate an error callback was fired for the stream.
+    void RegisterError();
+
+   private:
+    bool error_during_callback_ = false;
+  };
+
   AudioOutputController(AudioManager* audio_manager, EventHandler* handler,
                         const AudioParameters& params,
                         const std::string& output_device_id,
@@ -242,7 +258,7 @@
   // The targets for audio stream to be copied to. |should_duplicate_| is set to
   // 1 when the OnMoreData() call should proxy the data to
   // BroadcastDataToDuplicationTargets().
-  std::set<AudioPushSink*> duplication_targets_;
+  base::flat_set<AudioPushSink*> duplication_targets_;
   base::AtomicRefCount should_duplicate_;
 
   // The current volume of the audio stream.
@@ -263,6 +279,8 @@
   // Updated each time a power measurement is logged.
   base::TimeTicks last_audio_level_log_time_;
 
+  base::Optional<ErrorStatisticsTracker> stats_tracker_;
+
   // Flags when we've asked for a stream to start but it never did.
   base::AtomicRefCount on_more_io_data_called_;
   std::unique_ptr<base::OneShotTimer> wedge_timer_;
diff --git a/media/base/android/media_service_throttler_unittest.cc b/media/base/android/media_service_throttler_unittest.cc
index dfbb5a01..d091776 100644
--- a/media/base/android/media_service_throttler_unittest.cc
+++ b/media/base/android/media_service_throttler_unittest.cc
@@ -23,7 +23,7 @@
     clock_->SetNowTicks(base::TimeTicks());
     throttler_->SetTickClockForTesting(clock_);
     test_task_runner_ =
-        make_scoped_refptr(new FakeSingleThreadTaskRunner(clock_));
+        base::MakeRefCounted<FakeSingleThreadTaskRunner>(clock_);
     throttler_->ResetInternalStateForTesting();
     throttler_->SetCrashListenerTaskRunnerForTesting(test_task_runner_);
     base_delay_ = throttler_->GetBaseThrottlingRateForTesting();
diff --git a/media/formats/mp4/box_definitions.cc b/media/formats/mp4/box_definitions.cc
index 9e2c254..f3e165a 100644
--- a/media/formats/mp4/box_definitions.cc
+++ b/media/formats/mp4/box_definitions.cc
@@ -739,7 +739,7 @@
           avcConfig->profile_indication);
 
       frame_bitstream_converter =
-          make_scoped_refptr(new AVCBitstreamConverter(std::move(avcConfig)));
+          base::MakeRefCounted<AVCBitstreamConverter>(std::move(avcConfig));
 #if BUILDFLAG(ENABLE_DOLBY_VISION_DEMUXING)
       // It can be Dolby Vision stream if there is DVCC box.
       DolbyVisionConfiguration dvccConfig;
@@ -763,7 +763,7 @@
       video_codec = kCodecHEVC;
       video_codec_profile = hevcConfig->GetVideoProfile();
       frame_bitstream_converter =
-          make_scoped_refptr(new HEVCBitstreamConverter(std::move(hevcConfig)));
+          base::MakeRefCounted<HEVCBitstreamConverter>(std::move(hevcConfig));
 #if BUILDFLAG(ENABLE_DOLBY_VISION_DEMUXING)
       // It can be Dolby Vision stream if there is DVCC box.
       DolbyVisionConfiguration dvccConfig;
@@ -784,7 +784,7 @@
           new AVCDecoderConfigurationRecord());
       RCHECK(reader->ReadChild(avcConfig.get()));
       frame_bitstream_converter =
-          make_scoped_refptr(new AVCBitstreamConverter(std::move(avcConfig)));
+          base::MakeRefCounted<AVCBitstreamConverter>(std::move(avcConfig));
       DVLOG(2) << __func__ << " reading DolbyVisionConfiguration (dvcC)";
       DolbyVisionConfiguration dvccConfig;
       RCHECK(reader->ReadChild(&dvccConfig));
@@ -800,7 +800,7 @@
           new HEVCDecoderConfigurationRecord());
       RCHECK(reader->ReadChild(hevcConfig.get()));
       frame_bitstream_converter =
-          make_scoped_refptr(new HEVCBitstreamConverter(std::move(hevcConfig)));
+          base::MakeRefCounted<HEVCBitstreamConverter>(std::move(hevcConfig));
       DVLOG(2) << __func__ << " reading DolbyVisionConfiguration (dvcC)";
       DolbyVisionConfiguration dvccConfig;
       RCHECK(reader->ReadChild(&dvccConfig));
diff --git a/media/gpu/android/codec_wrapper_unittest.cc b/media/gpu/android/codec_wrapper_unittest.cc
index e37bd5fe..711a01c 100644
--- a/media/gpu/android/codec_wrapper_unittest.cc
+++ b/media/gpu/android/codec_wrapper_unittest.cc
@@ -30,7 +30,7 @@
   CodecWrapperTest() {
     auto codec = base::MakeUnique<NiceMock<MockMediaCodecBridge>>();
     codec_ = codec.get();
-    surface_bundle_ = make_scoped_refptr(new AVDASurfaceBundle());
+    surface_bundle_ = base::MakeRefCounted<AVDASurfaceBundle>();
     wrapper_ = base::MakeUnique<CodecWrapper>(
         CodecSurfacePair(std::move(codec), surface_bundle_),
         output_buffer_release_cb_.Get());
@@ -93,7 +93,7 @@
 
 TEST_F(CodecWrapperTest, SetSurfaceInvalidatesCodecOutputBuffers) {
   auto codec_buffer = DequeueCodecOutputBuffer();
-  wrapper_->SetSurface(make_scoped_refptr(new AVDASurfaceBundle()));
+  wrapper_->SetSurface(base::MakeRefCounted<AVDASurfaceBundle>());
   ASSERT_FALSE(codec_buffer->ReleaseToSurface());
 }
 
@@ -271,7 +271,7 @@
 }
 
 TEST_F(CodecWrapperTest, SurfaceBundleIsUpdatedBySetSurface) {
-  auto new_bundle = make_scoped_refptr(new AVDASurfaceBundle());
+  auto new_bundle = base::MakeRefCounted<AVDASurfaceBundle>();
   EXPECT_CALL(*codec_, SetSurface(_)).WillOnce(Return(true));
   wrapper_->SetSurface(new_bundle);
   ASSERT_EQ(new_bundle.get(), wrapper_->SurfaceBundle());
diff --git a/media/gpu/d3d11_h264_accelerator.cc b/media/gpu/d3d11_h264_accelerator.cc
index 3ed6a67..3fa890e 100644
--- a/media/gpu/d3d11_h264_accelerator.cc
+++ b/media/gpu/d3d11_h264_accelerator.cc
@@ -63,7 +63,7 @@
   stream_ = eglCreateStreamKHR(egl_display, stream_attributes);
   RETURN_ON_FAILURE(!!stream_, "Could not create stream", false);
   gl_image_ =
-      make_scoped_refptr(new gl::GLImageDXGI(picture_buffer_.size(), stream_));
+      base::MakeRefCounted<gl::GLImageDXGI>(picture_buffer_.size(), stream_);
   gl::ScopedActiveTexture texture0(GL_TEXTURE0);
   gl::ScopedTextureBinder texture0_binder(
       GL_TEXTURE_EXTERNAL_OES, picture_buffer_.service_texture_ids()[0]);
diff --git a/media/gpu/dxva_picture_buffer_win.cc b/media/gpu/dxva_picture_buffer_win.cc
index 6f9fe603..b3c2ed1 100644
--- a/media/gpu/dxva_picture_buffer_win.cc
+++ b/media/gpu/dxva_picture_buffer_win.cc
@@ -216,7 +216,7 @@
       egl_display, EGL_D3D_TEXTURE_2D_SHARE_HANDLE_ANGLE, texture_share_handle_,
       egl_config, attrib_list);
   RETURN_ON_FAILURE(decoding_surface_, "Failed to create surface", false);
-  gl_image_ = make_scoped_refptr(new GLImagePbuffer(size(), decoding_surface_));
+  gl_image_ = base::MakeRefCounted<GLImagePbuffer>(size(), decoding_surface_);
   if (decoder.d3d11_device_ && decoder.use_keyed_mutex_) {
     void* keyed_mutex = nullptr;
     EGLBoolean ret =
@@ -448,7 +448,7 @@
   };
   stream_ = eglCreateStreamKHR(egl_display, stream_attributes);
   RETURN_ON_FAILURE(!!stream_, "Could not create stream", false);
-  gl_image_ = make_scoped_refptr(new gl::GLImageDXGI(size(), stream_));
+  gl_image_ = base::MakeRefCounted<gl::GLImageDXGI>(size(), stream_);
   gl::ScopedActiveTexture texture0(GL_TEXTURE0);
   gl::ScopedTextureBinder texture0_binder(
       GL_TEXTURE_EXTERNAL_OES, picture_buffer_.service_texture_ids()[0]);
@@ -600,9 +600,9 @@
                                                       producer_attributes);
   RETURN_ON_FAILURE(result, "Could not create stream producer", false);
   scoped_refptr<gl::CopyingGLImageDXGI> copying_image_ =
-      make_scoped_refptr(new gl::CopyingGLImageDXGI(
+      base::MakeRefCounted<gl::CopyingGLImageDXGI>(
           base::win::ScopedComPtr<ID3D11Device>(decoder.D3D11Device()), size(),
-          stream_));
+          stream_);
   gl_image_ = copying_image_;
   return copying_image_->Initialize();
 }
@@ -688,7 +688,7 @@
   };
   stream_ = eglCreateStreamKHR(egl_display, stream_attributes);
   RETURN_ON_FAILURE(!!stream_, "Could not create stream", false);
-  gl_image_ = make_scoped_refptr(new gl::GLImageDXGI(size(), stream_));
+  gl_image_ = base::MakeRefCounted<gl::GLImageDXGI>(size(), stream_);
   gl::ScopedActiveTexture texture0(GL_TEXTURE0);
   gl::ScopedTextureBinder texture0_binder(
       GL_TEXTURE_EXTERNAL_OES, picture_buffer_.service_texture_ids()[0]);
diff --git a/media/video/gpu_memory_buffer_video_frame_pool_unittest.cc b/media/video/gpu_memory_buffer_video_frame_pool_unittest.cc
index 3dfc897..e1f03ec 100644
--- a/media/video/gpu_memory_buffer_video_frame_pool_unittest.cc
+++ b/media/video/gpu_memory_buffer_video_frame_pool_unittest.cc
@@ -86,8 +86,8 @@
     test_clock_.Advance(base::TimeDelta::FromSeconds(1234));
 
     gles2_.reset(new TestGLES2Interface);
-    media_task_runner_ = make_scoped_refptr(new base::TestSimpleTaskRunner);
-    copy_task_runner_ = make_scoped_refptr(new base::TestSimpleTaskRunner);
+    media_task_runner_ = base::MakeRefCounted<base::TestSimpleTaskRunner>();
+    copy_task_runner_ = base::MakeRefCounted<base::TestSimpleTaskRunner>();
     media_task_runner_handle_.reset(
         new base::ThreadTaskRunnerHandle(media_task_runner_));
     mock_gpu_factories_.reset(
diff --git a/mojo/edk/system/data_pipe_consumer_dispatcher.cc b/mojo/edk/system/data_pipe_consumer_dispatcher.cc
index 9a3762c..aed5944 100644
--- a/mojo/edk/system/data_pipe_consumer_dispatcher.cc
+++ b/mojo/edk/system/data_pipe_consumer_dispatcher.cc
@@ -447,7 +447,7 @@
 
   base::AutoUnlock unlock(lock_);
   node_controller_->SetPortObserver(
-      control_port_, make_scoped_refptr(new PortObserverThunk(this)));
+      control_port_, base::MakeRefCounted<PortObserverThunk>(this));
 
   return true;
 }
diff --git a/mojo/edk/system/data_pipe_producer_dispatcher.cc b/mojo/edk/system/data_pipe_producer_dispatcher.cc
index 97d25b2..53cc526 100644
--- a/mojo/edk/system/data_pipe_producer_dispatcher.cc
+++ b/mojo/edk/system/data_pipe_producer_dispatcher.cc
@@ -410,7 +410,7 @@
 
   base::AutoUnlock unlock(lock_);
   node_controller_->SetPortObserver(
-      control_port_, make_scoped_refptr(new PortObserverThunk(this)));
+      control_port_, base::MakeRefCounted<PortObserverThunk>(this));
 
   return true;
 }
diff --git a/mojo/edk/system/message_pipe_dispatcher.cc b/mojo/edk/system/message_pipe_dispatcher.cc
index 1017cc0..5dc7dd1 100644
--- a/mojo/edk/system/message_pipe_dispatcher.cc
+++ b/mojo/edk/system/message_pipe_dispatcher.cc
@@ -97,7 +97,7 @@
            << " [pipe_id=" << pipe_id << "; endpoint=" << endpoint << "]";
 
   node_controller_->SetPortObserver(
-      port_, make_scoped_refptr(new PortObserverThunk(this)));
+      port_, base::MakeRefCounted<PortObserverThunk>(this));
 }
 
 bool MessagePipeDispatcher::Fuse(MessagePipeDispatcher* other) {
diff --git a/mojo/public/cpp/bindings/thread_safe_interface_ptr.h b/mojo/public/cpp/bindings/thread_safe_interface_ptr.h
index 7ca832831..53182fb 100644
--- a/mojo/public/cpp/bindings/thread_safe_interface_ptr.h
+++ b/mojo/public/cpp/bindings/thread_safe_interface_ptr.h
@@ -133,7 +133,7 @@
     // If the InterfacePtr is bound on another sequence, post the call.
     // TODO(yzshen, watk): We block both this sequence and the InterfacePtr
     // sequence. Ideally only this sequence would block.
-    auto response = make_scoped_refptr(new SyncResponseInfo());
+    auto response = base::MakeRefCounted<SyncResponseInfo>();
     auto response_signaler = std::make_unique<SyncResponseSignaler>(response);
     task_runner_->PostTask(
         FROM_HERE, base::Bind(forward_with_responder_, base::Passed(message),
diff --git a/mojo/public/cpp/system/BUILD.gn b/mojo/public/cpp/system/BUILD.gn
index 5dbbd36..6058fbfc 100644
--- a/mojo/public/cpp/system/BUILD.gn
+++ b/mojo/public/cpp/system/BUILD.gn
@@ -27,6 +27,8 @@
     "buffer.h",
     "core.h",
     "data_pipe.h",
+    "data_pipe_string_writer.cc",
+    "data_pipe_string_writer.h",
     "functions.h",
     "handle.h",
     "handle_signal_tracker.cc",
diff --git a/mojo/public/cpp/system/data_pipe_string_writer.cc b/mojo/public/cpp/system/data_pipe_string_writer.cc
new file mode 100644
index 0000000..646eca6
--- /dev/null
+++ b/mojo/public/cpp/system/data_pipe_string_writer.cc
@@ -0,0 +1,131 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "mojo/public/cpp/system/data_pipe_string_writer.h"
+
+#include <algorithm>
+
+#include "base/bind.h"
+#include "base/callback.h"
+#include "base/location.h"
+#include "base/task_scheduler/post_task.h"
+
+namespace mojo {
+
+namespace {
+
+// Attempts to write data to a producer handle. Outputs the actual number of
+// bytes written in |*size|, and returns a result indicating the status of the
+// last attempted write operation.
+MojoResult WriteDataToProducerHandle(DataPipeProducerHandle producer,
+                                     const char* data,
+                                     size_t* size) {
+  void* dest;
+  uint32_t bytes_left = static_cast<uint32_t>(*size);
+
+  // We loop here since the pipe's available capacity may be larger than its
+  // *contiguous* capacity, and hence two independent consecutive two-phase
+  // writes may succeed. The goal here is to write as much of |data| as possible
+  // until we either run out of data or run out of capacity.
+  MojoResult result;
+  do {
+    uint32_t capacity = bytes_left;
+    result =
+        producer.BeginWriteData(&dest, &capacity, MOJO_WRITE_DATA_FLAG_NONE);
+    if (result == MOJO_RESULT_SHOULD_WAIT) {
+      result = MOJO_RESULT_OK;
+      break;
+    } else if (result != MOJO_RESULT_OK) {
+      break;
+    }
+
+    capacity = std::min(capacity, bytes_left);
+    memcpy(dest, data, capacity);
+    MojoResult end_result = producer.EndWriteData(capacity);
+    DCHECK_EQ(MOJO_RESULT_OK, end_result);
+
+    data += capacity;
+    bytes_left -= capacity;
+  } while (bytes_left);
+
+  *size -= bytes_left;
+  return result;
+}
+
+}  // namespace
+
+DataPipeStringWriter::DataPipeStringWriter(
+    ScopedDataPipeProducerHandle producer)
+    : producer_(std::move(producer)),
+      watcher_(FROM_HERE, SimpleWatcher::ArmingPolicy::AUTOMATIC),
+      weak_factory_(this) {}
+
+DataPipeStringWriter::~DataPipeStringWriter() = default;
+
+void DataPipeStringWriter::Write(const base::StringPiece& data,
+                                 CompletionCallback callback) {
+  DCHECK(!callback_);
+  callback_ = std::move(callback);
+
+  // Immediately attempt to write data without making an extra copy. If we can
+  // get it all in one shot, we're done aleady.
+  size_t size = data.size();
+  MojoResult result =
+      WriteDataToProducerHandle(producer_.get(), data.data(), &size);
+  if (result == MOJO_RESULT_OK && size == data.size()) {
+    base::SequencedTaskRunnerHandle::Get()->PostTask(
+        FROM_HERE, base::BindOnce(&DataPipeStringWriter::InvokeCallback,
+                                  weak_factory_.GetWeakPtr(), MOJO_RESULT_OK));
+  } else {
+    // Copy whatever data didn't make the cut and try again when the pipe has
+    // some more capacity.
+    data_ = std::string(data.data() + size, data.size() - size);
+    data_view_ = data_;
+    watcher_.Watch(producer_.get(), MOJO_HANDLE_SIGNAL_WRITABLE,
+                   MOJO_WATCH_CONDITION_SATISFIED,
+                   base::Bind(&DataPipeStringWriter::OnProducerHandleReady,
+                              base::Unretained(this)));
+  }
+}
+
+void DataPipeStringWriter::InvokeCallback(MojoResult result) {
+  // May delete |this|.
+  std::move(callback_).Run(result);
+}
+
+void DataPipeStringWriter::OnProducerHandleReady(
+    MojoResult ready_result,
+    const HandleSignalsState& state) {
+  bool failed = false;
+  size_t size = data_view_.size();
+  if (ready_result == MOJO_RESULT_OK) {
+    MojoResult write_result =
+        WriteDataToProducerHandle(producer_.get(), data_view_.data(), &size);
+    if (write_result != MOJO_RESULT_OK)
+      failed = true;
+  } else {
+    failed = true;
+  }
+
+  if (failed) {
+    watcher_.Cancel();
+
+    // May delete |this|.
+    std::move(callback_).Run(MOJO_RESULT_ABORTED);
+    return;
+  }
+
+  if (size == data_view_.size()) {
+    watcher_.Cancel();
+
+    // May delete |this|.
+    std::move(callback_).Run(MOJO_RESULT_OK);
+    return;
+  }
+
+  data_view_ =
+      base::StringPiece(data_view_.data() + size, data_view_.size() - size);
+}
+
+}  // namespace mojo
diff --git a/mojo/public/cpp/system/data_pipe_string_writer.h b/mojo/public/cpp/system/data_pipe_string_writer.h
new file mode 100644
index 0000000..f3b8e44
--- /dev/null
+++ b/mojo/public/cpp/system/data_pipe_string_writer.h
@@ -0,0 +1,72 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef MOJO_PUBLIC_CPP_SYSTEM_DATA_PIPE_STRING_WRITER_H_
+#define MOJO_PUBLIC_CPP_SYSTEM_DATA_PIPE_STRING_WRITER_H_
+
+#include <string>
+
+#include "base/callback_forward.h"
+#include "base/macros.h"
+#include "base/memory/weak_ptr.h"
+#include "base/strings/string_piece.h"
+#include "mojo/public/cpp/system/data_pipe.h"
+#include "mojo/public/cpp/system/simple_watcher.h"
+#include "mojo/public/cpp/system/system_export.h"
+
+namespace mojo {
+
+// Helper class which takes ownership of a ScopedDataPipeProducerHandle and
+// assumes responsibility for feeding it the contents of a given string. This
+// takes care of waiting for pipe capacity as needed, and can notify callers
+// asynchronously when the operation is complete.
+//
+// Note that the DataPipeStringWriter must be kept alive until notified of
+// completion to ensure that all of the string's data is written to the pipe.
+// Premature destruction may result in partial or total truncation of data made
+// available to the consumer.
+class MOJO_CPP_SYSTEM_EXPORT DataPipeStringWriter {
+ public:
+  using CompletionCallback = base::OnceCallback<void(MojoResult result)>;
+
+  // Constructs a new DataPipeStringWriter which will write data to |producer|.
+  explicit DataPipeStringWriter(ScopedDataPipeProducerHandle producer);
+  ~DataPipeStringWriter();
+
+  // Attempts to eventually write all of |data|. Invokes |callback|
+  // asynchronously when done. Note that |callback| IS allowed to delete this
+  // DataPipeStringWriter.
+  //
+  // If the write is successful |result| will be |MOJO_RESULT_OK|. Otherwise
+  // (e.g. if the producer detects the consumer is closed and the pipe has no
+  // remaining capacity) |result| will be |MOJO_RESULT_ABORTED|.
+  //
+  // Note that if the DataPipeStringWriter is destroyed before |callback| can be
+  // invoked, |callback| is *never* invoked, and the write will be permanently
+  // interrupted (and the producer handle closed) after making potentially only
+  // partial progress.
+  //
+  // Multiple writes may be performed in sequence (each one after the last
+  // completes), but Write() must not be called before the |callback| for the
+  // previous call to Write() (if any) has returned.
+  void Write(const base::StringPiece& data, CompletionCallback callback);
+
+ private:
+  void InvokeCallback(MojoResult result);
+  void OnProducerHandleReady(MojoResult ready_result,
+                             const HandleSignalsState& state);
+
+  ScopedDataPipeProducerHandle producer_;
+  std::string data_;
+  base::StringPiece data_view_;
+  CompletionCallback callback_;
+  SimpleWatcher watcher_;
+  base::WeakPtrFactory<DataPipeStringWriter> weak_factory_;
+
+  DISALLOW_COPY_AND_ASSIGN(DataPipeStringWriter);
+};
+
+}  // namespace mojo
+
+#endif  // MOJO_PUBLIC_CPP_SYSTEM_DATA_PIPE_STRING_WRITER_H_
diff --git a/mojo/public/cpp/system/tests/BUILD.gn b/mojo/public/cpp/system/tests/BUILD.gn
index 2cfa209..9c74b5e 100644
--- a/mojo/public/cpp/system/tests/BUILD.gn
+++ b/mojo/public/cpp/system/tests/BUILD.gn
@@ -7,6 +7,7 @@
 
   sources = [
     "core_unittest.cc",
+    "data_pipe_string_writer_unittest.cc",
     "handle_signal_tracker_unittest.cc",
     "handle_signals_state_unittest.cc",
     "simple_watcher_unittest.cc",
diff --git a/mojo/public/cpp/system/tests/data_pipe_string_writer_unittest.cc b/mojo/public/cpp/system/tests/data_pipe_string_writer_unittest.cc
new file mode 100644
index 0000000..4bed947
--- /dev/null
+++ b/mojo/public/cpp/system/tests/data_pipe_string_writer_unittest.cc
@@ -0,0 +1,188 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include <algorithm>
+#include <list>
+#include <string>
+
+#include "base/bind.h"
+#include "base/callback.h"
+#include "base/macros.h"
+#include "base/memory/ptr_util.h"
+#include "base/run_loop.h"
+#include "base/strings/string_piece.h"
+#include "base/test/scoped_task_environment.h"
+#include "mojo/public/cpp/system/data_pipe.h"
+#include "mojo/public/cpp/system/data_pipe_string_writer.h"
+#include "mojo/public/cpp/system/simple_watcher.h"
+#include "testing/gtest/include/gtest/gtest.h"
+
+namespace mojo {
+
+// Test helper. Reads a consumer handle, accumulating data into a string. Reads
+// until encountering an error (e.g. peer closure), at which point it invokes an
+// async callback.
+class DataPipeReader {
+ public:
+  explicit DataPipeReader(ScopedDataPipeConsumerHandle consumer_handle,
+                          base::OnceClosure on_read_done)
+      : consumer_handle_(std::move(consumer_handle)),
+        on_read_done_(std::move(on_read_done)),
+        watcher_(FROM_HERE, SimpleWatcher::ArmingPolicy::AUTOMATIC) {
+    watcher_.Watch(
+        consumer_handle_.get(), MOJO_HANDLE_SIGNAL_READABLE,
+        MOJO_WATCH_CONDITION_SATISFIED,
+        base::Bind(&DataPipeReader::OnDataAvailable, base::Unretained(this)));
+  }
+  ~DataPipeReader() = default;
+
+  const std::string& data() const { return data_; }
+
+ private:
+  void OnDataAvailable(MojoResult result, const HandleSignalsState& state) {
+    if (result == MOJO_RESULT_OK) {
+      uint32_t size = 64;
+      std::vector<char> buffer(size, 0);
+      MojoResult read_result;
+      do {
+        read_result = consumer_handle_->ReadData(buffer.data(), &size,
+                                                 MOJO_READ_DATA_FLAG_NONE);
+        if (read_result == MOJO_RESULT_OK) {
+          std::copy(buffer.begin(), buffer.begin() + size,
+                    std::back_inserter(data_));
+        }
+      } while (read_result == MOJO_RESULT_OK);
+
+      if (read_result == MOJO_RESULT_SHOULD_WAIT)
+        return;
+    }
+
+    if (result != MOJO_RESULT_CANCELLED)
+      watcher_.Cancel();
+
+    std::move(on_read_done_).Run();
+  }
+
+  ScopedDataPipeConsumerHandle consumer_handle_;
+  base::OnceClosure on_read_done_;
+  SimpleWatcher watcher_;
+  std::string data_;
+
+  DISALLOW_COPY_AND_ASSIGN(DataPipeReader);
+};
+
+class DataPipeStringWriterTest : public testing::Test {
+ public:
+  DataPipeStringWriterTest() = default;
+  ~DataPipeStringWriterTest() override = default;
+
+ protected:
+  static void WriteStringThenCloseWriter(
+      std::unique_ptr<DataPipeStringWriter> writer,
+      const base::StringPiece& str) {
+    DataPipeStringWriter* raw_writer = writer.get();
+    raw_writer->Write(
+        str, base::BindOnce([](std::unique_ptr<DataPipeStringWriter> writer,
+                               MojoResult result) {},
+                            std::move(writer)));
+  }
+
+  static void WriteStringsThenCloseWriter(
+      std::unique_ptr<DataPipeStringWriter> writer,
+      std::list<base::StringPiece> strings) {
+    DataPipeStringWriter* raw_writer = writer.get();
+    base::StringPiece str = strings.front();
+    strings.pop_front();
+    raw_writer->Write(
+        str, base::BindOnce(
+                 [](std::unique_ptr<DataPipeStringWriter> writer,
+                    std::list<base::StringPiece> strings, MojoResult result) {
+                   if (!strings.empty())
+                     WriteStringsThenCloseWriter(std::move(writer),
+                                                 std::move(strings));
+                 },
+                 std::move(writer), std::move(strings)));
+  }
+
+ private:
+  base::test::ScopedTaskEnvironment task_environment_;
+
+  DISALLOW_COPY_AND_ASSIGN(DataPipeStringWriterTest);
+};
+
+TEST_F(DataPipeStringWriterTest, EqualCapacity) {
+  const std::string kTestString = "Hello, world!";
+
+  base::RunLoop loop;
+  mojo::DataPipe pipe(static_cast<uint32_t>(kTestString.size()));
+  DataPipeReader reader(std::move(pipe.consumer_handle), loop.QuitClosure());
+  WriteStringThenCloseWriter(
+      base::MakeUnique<DataPipeStringWriter>(std::move(pipe.producer_handle)),
+      kTestString);
+  loop.Run();
+
+  EXPECT_EQ(kTestString, reader.data());
+}
+
+TEST_F(DataPipeStringWriterTest, UnderCapacity) {
+  const std::string kTestString = "Hello, world!";
+
+  base::RunLoop loop;
+  mojo::DataPipe pipe(static_cast<uint32_t>(kTestString.size() * 2));
+  DataPipeReader reader(std::move(pipe.consumer_handle), loop.QuitClosure());
+  WriteStringThenCloseWriter(
+      base::MakeUnique<DataPipeStringWriter>(std::move(pipe.producer_handle)),
+      kTestString);
+  loop.Run();
+
+  EXPECT_EQ(kTestString, reader.data());
+}
+
+TEST_F(DataPipeStringWriterTest, OverCapacity) {
+  const std::string kTestString = "Hello, world!";
+
+  base::RunLoop loop;
+  mojo::DataPipe pipe(static_cast<uint32_t>(kTestString.size() / 2));
+  DataPipeReader reader(std::move(pipe.consumer_handle), loop.QuitClosure());
+  WriteStringThenCloseWriter(
+      base::MakeUnique<DataPipeStringWriter>(std::move(pipe.producer_handle)),
+      kTestString);
+  loop.Run();
+
+  EXPECT_EQ(kTestString, reader.data());
+}
+
+TEST_F(DataPipeStringWriterTest, TinyPipe) {
+  const std::string kTestString = "Hello, world!";
+
+  base::RunLoop loop;
+  mojo::DataPipe pipe(1);
+  DataPipeReader reader(std::move(pipe.consumer_handle), loop.QuitClosure());
+  WriteStringThenCloseWriter(
+      base::MakeUnique<DataPipeStringWriter>(std::move(pipe.producer_handle)),
+      kTestString);
+  loop.Run();
+
+  EXPECT_EQ(kTestString, reader.data());
+}
+
+TEST_F(DataPipeStringWriterTest, MultipleWrites) {
+  const std::string kTestString1 = "Hello, world!";
+  const std::string kTestString2 = "There is a lot of data coming your way!";
+  const std::string kTestString3 = "So many strings!";
+  const std::string kTestString4 = "Your cup runneth over!";
+
+  base::RunLoop loop;
+  mojo::DataPipe pipe(4);
+  DataPipeReader reader(std::move(pipe.consumer_handle), loop.QuitClosure());
+  WriteStringsThenCloseWriter(
+      base::MakeUnique<DataPipeStringWriter>(std::move(pipe.producer_handle)),
+      {kTestString1, kTestString2, kTestString3, kTestString4});
+  loop.Run();
+
+  EXPECT_EQ(kTestString1 + kTestString2 + kTestString3 + kTestString4,
+            reader.data());
+}
+
+}  // namespace mojo
diff --git a/net/base/filename_util_unittest.cc b/net/base/filename_util_unittest.cc
index b209666f..a38c1103 100644
--- a/net/base/filename_util_unittest.cc
+++ b/net/base/filename_util_unittest.cc
@@ -78,17 +78,13 @@
       << GetLocaleWarningString();
 }
 
-}  // namespace
-
-static const base::FilePath::CharType* kSafePortableBasenames[] = {
-    FILE_PATH_LITERAL("a"),
-    FILE_PATH_LITERAL("a.txt"),
-    FILE_PATH_LITERAL("a b.txt"),
-    FILE_PATH_LITERAL("a-b.txt"),
+constexpr const base::FilePath::CharType* kSafePortableBasenames[] = {
+    FILE_PATH_LITERAL("a"),           FILE_PATH_LITERAL("a.txt"),
+    FILE_PATH_LITERAL("a b.txt"),     FILE_PATH_LITERAL("a-b.txt"),
     FILE_PATH_LITERAL("My Computer"),
 };
 
-static const base::FilePath::CharType* kUnsafePortableBasenames[] = {
+constexpr const base::FilePath::CharType* kUnsafePortableBasenames[] = {
     FILE_PATH_LITERAL(""),
     FILE_PATH_LITERAL("."),
     FILE_PATH_LITERAL(".."),
@@ -115,20 +111,20 @@
 #endif
 };
 
-static const base::FilePath::CharType* kUnsafePortableBasenamesForWindows[] = {
-    FILE_PATH_LITERAL("con"),
-    FILE_PATH_LITERAL("con.zip"),
-    FILE_PATH_LITERAL("NUL"),
-    FILE_PATH_LITERAL("NUL.zip"),
+constexpr const base::FilePath::CharType* kUnsafePortableBasenamesForWin[] = {
+    FILE_PATH_LITERAL("con"), FILE_PATH_LITERAL("con.zip"),
+    FILE_PATH_LITERAL("NUL"), FILE_PATH_LITERAL("NUL.zip"),
 };
 
-static const base::FilePath::CharType* kSafePortableRelativePaths[] = {
+constexpr const base::FilePath::CharType* kSafePortableRelativePaths[] = {
     FILE_PATH_LITERAL("a/a"),
 #if defined(OS_WIN)
     FILE_PATH_LITERAL("a\\a"),
 #endif
 };
 
+}  // namespace
+
 TEST(FilenameUtilTest, IsSafePortablePathComponent) {
   for (size_t i = 0; i < arraysize(kSafePortableBasenames); ++i) {
     EXPECT_TRUE(
@@ -1072,10 +1068,10 @@
         << kSafePortableBasenames[i];
   }
 
-  for (size_t i = 0; i < arraysize(kUnsafePortableBasenamesForWindows); ++i) {
+  for (size_t i = 0; i < arraysize(kUnsafePortableBasenamesForWin); ++i) {
     EXPECT_TRUE(IsReservedNameOnWindows(
-        base::FilePath(kUnsafePortableBasenamesForWindows[i]).value()))
-        << kUnsafePortableBasenamesForWindows[i];
+        base::FilePath(kUnsafePortableBasenamesForWin[i]).value()))
+        << kUnsafePortableBasenamesForWin[i];
   }
 }
 
diff --git a/net/cert/cert_verify_proc_android_unittest.cc b/net/cert/cert_verify_proc_android_unittest.cc
index d2f90bc..f5f06a6 100644
--- a/net/cert/cert_verify_proc_android_unittest.cc
+++ b/net/cert/cert_verify_proc_android_unittest.cc
@@ -142,7 +142,7 @@
 class CertVerifyProcAndroidTestWithAIAFetching : public testing::Test {
  public:
   void SetUp() override {
-    fetcher_ = make_scoped_refptr(new MockCertNetFetcher());
+    fetcher_ = base::MakeRefCounted<MockCertNetFetcher>();
     CertVerifyProcAndroid::SetCertNetFetcherForTesting(fetcher_);
   }
 
@@ -178,7 +178,7 @@
        NoFetchIfProperIntermediatesSupplied) {
   ASSERT_TRUE(SetUpTestRoot());
   scoped_refptr<CertVerifyProcAndroid> proc =
-      make_scoped_refptr(new CertVerifyProcAndroid());
+      base::MakeRefCounted<CertVerifyProcAndroid>();
   scoped_refptr<X509Certificate> leaf;
   ASSERT_TRUE(
       CreateCertificateChainFromFiles({"target_one_aia.pem", "i.pem"}, &leaf));
@@ -192,7 +192,7 @@
 TEST_F(CertVerifyProcAndroidTestWithAIAFetching, NoAIAURL) {
   ASSERT_TRUE(SetUpTestRoot());
   scoped_refptr<CertVerifyProcAndroid> proc =
-      make_scoped_refptr(new CertVerifyProcAndroid());
+      base::MakeRefCounted<CertVerifyProcAndroid>();
   scoped_refptr<X509Certificate> cert;
   ASSERT_TRUE(ReadTestCert("target_no_aia.pem", &cert));
   CertVerifyResult verify_result;
@@ -207,7 +207,7 @@
 TEST_F(CertVerifyProcAndroidTestWithAIAFetching, OneFileAndOneHTTPURL) {
   ASSERT_TRUE(SetUpTestRoot());
   scoped_refptr<CertVerifyProcAndroid> proc =
-      make_scoped_refptr(new CertVerifyProcAndroid());
+      base::MakeRefCounted<CertVerifyProcAndroid>();
   scoped_refptr<X509Certificate> cert;
   ASSERT_TRUE(ReadTestCert("target_file_and_http_aia.pem", &cert));
   scoped_refptr<X509Certificate> intermediate;
@@ -236,7 +236,7 @@
        UnsuccessfulVerificationWithLeafOnly) {
   ASSERT_TRUE(SetUpTestRoot());
   scoped_refptr<CertVerifyProcAndroid> proc =
-      make_scoped_refptr(new CertVerifyProcAndroid());
+      base::MakeRefCounted<CertVerifyProcAndroid>();
   scoped_refptr<X509Certificate> cert;
   ASSERT_TRUE(ReadTestCert("target_one_aia.pem", &cert));
   const scoped_refptr<X509Certificate> bad_intermediate =
@@ -258,7 +258,7 @@
        UnsuccessfulVerificationWithLeafOnlyAndErrorOnFetch) {
   ASSERT_TRUE(SetUpTestRoot());
   scoped_refptr<CertVerifyProcAndroid> proc =
-      make_scoped_refptr(new CertVerifyProcAndroid());
+      base::MakeRefCounted<CertVerifyProcAndroid>();
   scoped_refptr<X509Certificate> cert;
   ASSERT_TRUE(ReadTestCert("target_one_aia.pem", &cert));
 
@@ -277,7 +277,7 @@
        UnsuccessfulVerificationWithLeafOnlyAndUnparseableFetch) {
   ASSERT_TRUE(SetUpTestRoot());
   scoped_refptr<CertVerifyProcAndroid> proc =
-      make_scoped_refptr(new CertVerifyProcAndroid());
+      base::MakeRefCounted<CertVerifyProcAndroid>();
   scoped_refptr<X509Certificate> cert;
   ASSERT_TRUE(ReadTestCert("target_one_aia.pem", &cert));
 
@@ -296,7 +296,7 @@
 TEST_F(CertVerifyProcAndroidTestWithAIAFetching, TwoHTTPURLs) {
   ASSERT_TRUE(SetUpTestRoot());
   scoped_refptr<CertVerifyProcAndroid> proc =
-      make_scoped_refptr(new CertVerifyProcAndroid());
+      base::MakeRefCounted<CertVerifyProcAndroid>();
   scoped_refptr<X509Certificate> cert;
   ASSERT_TRUE(ReadTestCert("target_two_aia.pem", &cert));
   scoped_refptr<X509Certificate> intermediate;
@@ -330,7 +330,7 @@
   // then the intermediate i2.pem would not require an AIA fetch. With the test
   // root untrusted, i2.pem does not verify and so it will trigger an AIA fetch.
   scoped_refptr<CertVerifyProcAndroid> proc =
-      make_scoped_refptr(new CertVerifyProcAndroid());
+      base::MakeRefCounted<CertVerifyProcAndroid>();
   scoped_refptr<X509Certificate> cert;
   ASSERT_TRUE(ReadTestCert("target_one_aia.pem", &cert));
   scoped_refptr<X509Certificate> intermediate;
@@ -360,7 +360,7 @@
 TEST_F(CertVerifyProcAndroidTestWithAIAFetching, MaxAIAFetches) {
   ASSERT_TRUE(SetUpTestRoot());
   scoped_refptr<CertVerifyProcAndroid> proc =
-      make_scoped_refptr(new CertVerifyProcAndroid());
+      base::MakeRefCounted<CertVerifyProcAndroid>();
   scoped_refptr<X509Certificate> cert;
   ASSERT_TRUE(ReadTestCert("target_six_aia.pem", &cert));
 
@@ -384,7 +384,7 @@
   // then the intermediate i.pem would not require an AIA fetch. With the test
   // root untrusted, i.pem does not verify and so it will trigger an AIA fetch.
   scoped_refptr<CertVerifyProcAndroid> proc =
-      make_scoped_refptr(new CertVerifyProcAndroid());
+      base::MakeRefCounted<CertVerifyProcAndroid>();
   scoped_refptr<X509Certificate> leaf;
   ASSERT_TRUE(
       CreateCertificateChainFromFiles({"target_one_aia.pem", "i.pem"}, &leaf));
diff --git a/net/cert/cert_verify_proc_unittest.cc b/net/cert/cert_verify_proc_unittest.cc
index 57d3a28..bae8ea26 100644
--- a/net/cert/cert_verify_proc_unittest.cc
+++ b/net/cert/cert_verify_proc_unittest.cc
@@ -1433,7 +1433,7 @@
   // However, if the CA is not well known, these should not be flagged:
   dummy_result.Reset();
   dummy_result.is_issued_by_known_root = false;
-  verify_proc = make_scoped_refptr(new MockCertVerifyProc(dummy_result));
+  verify_proc = base::MakeRefCounted<MockCertVerifyProc>(dummy_result);
   error = verify_proc->Verify(cert.get(), "webmail", std::string(), 0, nullptr,
                               CertificateList(), &verify_result);
   EXPECT_THAT(error, IsOk());
@@ -1480,7 +1480,7 @@
   dummy_result.is_issued_by_known_root = true;
   dummy_result.has_sha1 = true;
   dummy_result.has_sha1_leaf = true;
-  verify_proc = make_scoped_refptr(new MockCertVerifyProc(dummy_result));
+  verify_proc = base::MakeRefCounted<MockCertVerifyProc>(dummy_result);
   cert = CreateCertificateChainFromFile(GetTestCertsDirectory(),
                                         "sha1_jan_2016.pem",
                                         X509Certificate::FORMAT_AUTO);
@@ -1497,7 +1497,7 @@
   dummy_result.is_issued_by_known_root = false;
   dummy_result.has_sha1 = true;
   dummy_result.has_sha1_leaf = true;
-  verify_proc = make_scoped_refptr(new MockCertVerifyProc(dummy_result));
+  verify_proc = base::MakeRefCounted<MockCertVerifyProc>(dummy_result);
   cert = CreateCertificateChainFromFile(GetTestCertsDirectory(),
                                         "sha1_jan_2016.pem",
                                         X509Certificate::FORMAT_AUTO);
@@ -1514,7 +1514,7 @@
   dummy_result.is_issued_by_known_root = true;
   dummy_result.has_sha1 = true;
   dummy_result.has_sha1_leaf = false;
-  verify_proc = make_scoped_refptr(new MockCertVerifyProc(dummy_result));
+  verify_proc = base::MakeRefCounted<MockCertVerifyProc>(dummy_result);
   cert = CreateCertificateChainFromFile(GetTestCertsDirectory(),
                                         "sha1_jan_2016.pem",
                                         X509Certificate::FORMAT_AUTO);
diff --git a/net/cert/internal/cert_issuer_source_aia_unittest.cc b/net/cert/internal/cert_issuer_source_aia_unittest.cc
index 505d586..6003335 100644
--- a/net/cert/internal/cert_issuer_source_aia_unittest.cc
+++ b/net/cert/internal/cert_issuer_source_aia_unittest.cc
@@ -122,7 +122,7 @@
   ASSERT_TRUE(ReadTestCert("target_two_aia.pem", &cert));
 
   // No methods on |mock_fetcher| should be called.
-  auto mock_fetcher = make_scoped_refptr(new StrictMock<MockCertNetFetcher>());
+  auto mock_fetcher = base::MakeRefCounted<StrictMock<MockCertNetFetcher>>();
   CertIssuerSourceAia aia_source(mock_fetcher);
   ParsedCertificateList issuers;
   aia_source.SyncGetIssuersOf(cert.get(), &issuers);
@@ -136,7 +136,7 @@
   ASSERT_TRUE(ReadTestCert("target_no_aia.pem", &cert));
 
   // No methods on |mock_fetcher| should be called.
-  auto mock_fetcher = make_scoped_refptr(new StrictMock<MockCertNetFetcher>());
+  auto mock_fetcher = base::MakeRefCounted<StrictMock<MockCertNetFetcher>>();
   CertIssuerSourceAia aia_source(mock_fetcher);
   std::unique_ptr<CertIssuerSource::Request> request;
   aia_source.AsyncGetIssuersOf(cert.get(), &request);
@@ -152,7 +152,7 @@
   scoped_refptr<ParsedCertificate> cert;
   ASSERT_TRUE(ReadTestCert("target_file_aia.pem", &cert));
 
-  auto mock_fetcher = make_scoped_refptr(new StrictMock<MockCertNetFetcher>());
+  auto mock_fetcher = base::MakeRefCounted<StrictMock<MockCertNetFetcher>>();
   EXPECT_CALL(*mock_fetcher, FetchCaIssuers(GURL("file:///dev/null"), _, _))
       .WillOnce(Return(ByMove(CreateMockRequest(ERR_DISALLOWED_URL_SCHEME))));
 
@@ -173,7 +173,7 @@
   scoped_refptr<ParsedCertificate> cert;
   ASSERT_TRUE(ReadTestCert("target_invalid_url_aia.pem", &cert));
 
-  auto mock_fetcher = make_scoped_refptr(new StrictMock<MockCertNetFetcher>());
+  auto mock_fetcher = base::MakeRefCounted<StrictMock<MockCertNetFetcher>>();
   CertIssuerSourceAia aia_source(mock_fetcher);
   std::unique_ptr<CertIssuerSource::Request> request;
   aia_source.AsyncGetIssuersOf(cert.get(), &request);
@@ -187,7 +187,7 @@
   scoped_refptr<ParsedCertificate> intermediate_cert;
   ASSERT_TRUE(ReadTestCert("i.pem", &intermediate_cert));
 
-  auto mock_fetcher = make_scoped_refptr(new StrictMock<MockCertNetFetcher>());
+  auto mock_fetcher = base::MakeRefCounted<StrictMock<MockCertNetFetcher>>();
 
   EXPECT_CALL(*mock_fetcher,
               FetchCaIssuers(GURL("http://url-for-aia/I.cer"), _, _))
@@ -219,7 +219,7 @@
   scoped_refptr<ParsedCertificate> intermediate_cert;
   ASSERT_TRUE(ReadTestCert("i2.pem", &intermediate_cert));
 
-  auto mock_fetcher = make_scoped_refptr(new StrictMock<MockCertNetFetcher>());
+  auto mock_fetcher = base::MakeRefCounted<StrictMock<MockCertNetFetcher>>();
 
   EXPECT_CALL(*mock_fetcher, FetchCaIssuers(GURL("file:///dev/null"), _, _))
       .WillOnce(Return(ByMove(CreateMockRequest(ERR_DISALLOWED_URL_SCHEME))));
diff --git a/net/cert/internal/ocsp.cc b/net/cert/internal/ocsp.cc
index 2730629..d5c02c9 100644
--- a/net/cert/internal/ocsp.cc
+++ b/net/cert/internal/ocsp.cc
@@ -783,6 +783,9 @@
       response_data, certificate.get(), issuer_certificate.get(), verify_time,
       response_details);
 
+  // TODO(eroman): Process the OCSP extensions. In particular, must reject if
+  // there are any critical extensions that are not understood.
+
   // Check that the OCSP response has a valid signature. It must either be
   // signed directly by the issuing certificate, or a valid authorized
   // responder.
diff --git a/net/cert/internal/system_trust_store.cc b/net/cert/internal/system_trust_store.cc
index 2566c65..64a5225 100644
--- a/net/cert/internal/system_trust_store.cc
+++ b/net/cert/internal/system_trust_store.cc
@@ -11,12 +11,17 @@
 #include <Security/Security.h>
 #endif
 
+#include "base/files/file_path.h"
+#include "base/files/file_util.h"
 #include "base/memory/ptr_util.h"
 #include "build/build_config.h"
+#include "net/cert/internal/cert_errors.h"
 #include "net/cert/internal/parsed_certificate.h"
 #include "net/cert/internal/trust_store_collection.h"
 #include "net/cert/internal/trust_store_in_memory.h"
 #include "net/cert/test_root_certs.h"
+#include "net/cert/x509_certificate.h"
+#include "net/cert/x509_util.h"
 
 #if defined(USE_NSS_CERTS)
 #include "crypto/nss_util.h"
@@ -27,6 +32,9 @@
 #include "net/cert/internal/trust_store_mac.h"
 #include "net/cert/known_roots_mac.h"
 #include "net/cert/x509_util_mac.h"
+#elif defined(OS_FUCHSIA)
+#include "third_party/boringssl/src/include/openssl/pool.h"
+#include "third_party/boringssl/src/include/openssl/x509.h"
 #endif
 
 namespace net {
@@ -138,19 +146,60 @@
 
 #elif defined(OS_FUCHSIA)
 
+namespace {
+
+constexpr char kRootCertsFileFuchsia[] = "/system/data/boringssl/cert.pem";
+
+class FuchsiaSystemCerts {
+ public:
+  FuchsiaSystemCerts() {
+    base::FilePath filename(kRootCertsFileFuchsia);
+    std::string certs_file;
+    if (!base::ReadFileToString(filename, &certs_file)) {
+      LOG(ERROR) << "Can't load root certificates from " << filename;
+      return;
+    }
+
+    CertificateList certs = X509Certificate::CreateCertificateListFromBytes(
+        certs_file.data(), certs_file.length(), X509Certificate::FORMAT_AUTO);
+
+    for (const auto& cert : certs) {
+      CertErrors errors;
+      auto parsed = ParsedCertificate::Create(
+          bssl::UniquePtr<CRYPTO_BUFFER>(
+              X509Certificate::DupOSCertHandle(cert->os_cert_handle())),
+          x509_util::DefaultParseCertificateOptions(), &errors);
+      CHECK(parsed) << errors.ToDebugString();
+      system_trust_store_.AddTrustAnchor(parsed);
+    }
+  }
+
+  TrustStoreInMemory* system_trust_store() { return &system_trust_store_; }
+
+ private:
+  TrustStoreInMemory system_trust_store_;
+};
+
+base::LazyInstance<FuchsiaSystemCerts>::Leaky g_root_certs_fuchsia =
+    LAZY_INSTANCE_INITIALIZER;
+
+}  // namespace
+
 class SystemTrustStoreFuchsia : public BaseSystemTrustStore {
  public:
   SystemTrustStoreFuchsia() {
+    trust_store_.AddTrustStore(g_root_certs_fuchsia.Get().system_trust_store());
     if (TestRootCerts::HasInstance()) {
       trust_store_.AddTrustStore(
           TestRootCerts::GetInstance()->test_trust_store());
     }
   }
 
-  bool UsesSystemTrustStore() const override { return false; }
+  bool UsesSystemTrustStore() const override { return true; }
 
   bool IsKnownRoot(const ParsedCertificate* trust_anchor) const override {
-    return false;
+    return g_root_certs_fuchsia.Get().system_trust_store()->Contains(
+        trust_anchor);
   }
 };
 
diff --git a/net/cert_net/cert_net_fetcher_impl.cc b/net/cert_net/cert_net_fetcher_impl.cc
index 727a124..8545f54 100644
--- a/net/cert_net/cert_net_fetcher_impl.cc
+++ b/net/cert_net/cert_net_fetcher_impl.cc
@@ -816,7 +816,7 @@
 }  // namespace
 
 scoped_refptr<CertNetFetcher> CreateCertNetFetcher(URLRequestContext* context) {
-  return make_scoped_refptr(new CertNetFetcherImpl(context));
+  return base::MakeRefCounted<CertNetFetcherImpl>(context);
 }
 
 }  // namespace net
diff --git a/net/dns/dns_config_service_posix.cc b/net/dns/dns_config_service_posix.cc
index a118257..92b68a4 100644
--- a/net/dns/dns_config_service_posix.cc
+++ b/net/dns/dns_config_service_posix.cc
@@ -16,6 +16,7 @@
 #include "base/macros.h"
 #include "base/metrics/histogram_macros.h"
 #include "base/single_thread_task_runner.h"
+#include "base/threading/scoped_blocking_call.h"
 #include "base/threading/thread_task_runner_handle.h"
 #include "base/time/time.h"
 #include "build/build_config.h"
@@ -117,17 +118,18 @@
 };
 #endif  // defined(OS_IOS)
 
+ConfigParsePosixResult ReadDnsConfig(DnsConfig* dns_config) {
+  base::ScopedBlockingCall scoped_blocking_call(base::BlockingType::MAY_BLOCK);
 #if !defined(OS_ANDROID)
-ConfigParsePosixResult ReadDnsConfig(DnsConfig* config) {
   ConfigParsePosixResult result;
-  config->unhandled_options = false;
+  dns_config->unhandled_options = false;
 // TODO(fuchsia): Use res_ninit() when it's implemented on Fuchsia.
 #if defined(OS_OPENBSD) || defined(OS_FUCHSIA)
   // Note: res_ninit in glibc always returns 0 and sets RES_INIT.
   // res_init behaves the same way.
   memset(&_res, 0, sizeof(_res));
   if (res_init() == 0) {
-    result = ConvertResStateToDnsConfig(_res, config);
+    result = ConvertResStateToDnsConfig(_res, dns_config);
   } else {
     result = CONFIG_PARSE_POSIX_RES_INIT_FAILED;
   }
@@ -135,7 +137,7 @@
   struct __res_state res;
   memset(&res, 0, sizeof(res));
   if (res_ninit(&res) == 0) {
-    result = ConvertResStateToDnsConfig(res, config);
+    result = ConvertResStateToDnsConfig(res, dns_config);
   } else {
     result = CONFIG_PARSE_POSIX_RES_INIT_FAILED;
   }
@@ -154,15 +156,14 @@
       break;
     case CONFIG_PARSE_POSIX_UNHANDLED_OPTIONS:
       LOG(WARNING) << "dns_config has unhandled options!";
-      config->unhandled_options = true;
+      dns_config->unhandled_options = true;
     default:
       return error;
   }
 #endif  // defined(OS_MACOSX) && !defined(OS_IOS)
   // Override timeout value to match default setting on Windows.
-  config->timeout = base::TimeDelta::FromMilliseconds(kDnsDefaultTimeoutMs);
+  dns_config->timeout = base::TimeDelta::FromMilliseconds(kDnsDefaultTimeoutMs);
   return result;
-}
 #else  // defined(OS_ANDROID)
 // Theoretically, this is bad. __system_property_get is not a supported API
 // (but it's currently visible to anyone using Bionic), and the properties
@@ -173,7 +174,6 @@
 // won't end.
 // TODO(juliatuttle): Depend on libcutils, then switch this (and other uses of
 //                    __system_property_get) to property_get.
-ConfigParsePosixResult ReadDnsConfig(DnsConfig* dns_config) {
   dns_config->nameservers.clear();
 
   if (base::android::BuildInfo::GetInstance()->sdk_int() >=
@@ -209,8 +209,8 @@
   }
 
   return CONFIG_PARSE_POSIX_OK;
-}
 #endif  // !defined(OS_ANDROID)
+}
 
 }  // namespace
 
@@ -360,6 +360,8 @@
 
   void DoWork() override {
     base::TimeTicks start_time = base::TimeTicks::Now();
+    base::ScopedBlockingCall scoped_blocking_call(
+        base::BlockingType::MAY_BLOCK);
     success_ = ParseHostsFile(file_path_hosts_, &hosts_);
     UMA_HISTOGRAM_BOOLEAN("AsyncDNS.HostParseResult", success_);
     UMA_HISTOGRAM_TIMES("AsyncDNS.HostsParseDuration",
@@ -449,7 +451,7 @@
   dns_config_for_testing_ = dns_config;
   // Reset ConfigReader to bind new DnsConfig for testing.
   config_reader_->Cancel();
-  config_reader_ = make_scoped_refptr(new ConfigReader(this));
+  config_reader_ = base::MakeRefCounted<ConfigReader>(this);
 }
 
 void DnsConfigServicePosix::SetHostsFilePathForTesting(
@@ -458,7 +460,7 @@
   file_path_hosts_ = file_path;
   // Reset HostsReader to bind new hosts file path.
   hosts_reader_->Cancel();
-  hosts_reader_ = make_scoped_refptr(new HostsReader(this));
+  hosts_reader_ = base::MakeRefCounted<HostsReader>(this);
   // If watching, reset to bind new hosts file path and resume watching.
   if (watcher_) {
     watcher_.reset(new Watcher(this));
diff --git a/net/dns/dns_config_service_win.cc b/net/dns/dns_config_service_win.cc
index a2934811..b9705a6 100644
--- a/net/dns/dns_config_service_win.cc
+++ b/net/dns/dns_config_service_win.cc
@@ -23,6 +23,7 @@
 #include "base/strings/string_util.h"
 #include "base/strings/utf_string_conversions.h"
 #include "base/synchronization/lock.h"
+#include "base/threading/scoped_blocking_call.h"
 #include "base/threading/thread_checker.h"
 #include "base/threading/thread_restrictions.h"
 #include "base/threading/thread_task_runner_handle.h"
@@ -175,6 +176,7 @@
 
 // Reads DnsSystemSettings from IpHelper and registry.
 ConfigParseWinResult ReadSystemSettings(DnsSystemSettings* settings) {
+  base::ScopedBlockingCall scoped_blocking_call(base::BlockingType::MAY_BLOCK);
   settings->addresses = ReadIpHelper(GAA_FLAG_SKIP_ANYCAST |
                                      GAA_FLAG_SKIP_UNICAST |
                                      GAA_FLAG_SKIP_MULTICAST |
@@ -634,7 +636,7 @@
   DISALLOW_COPY_AND_ASSIGN(Watcher);
 };
 
-// Reads config from registry and IpHelper. All work performed on WorkerPool.
+// Reads config from registry and IpHelper. All work performed in TaskScheduler.
 class DnsConfigServiceWin::ConfigReader : public SerialWorker {
  public:
   explicit ConfigReader(DnsConfigServiceWin* service)
@@ -645,7 +647,6 @@
   ~ConfigReader() override {}
 
   void DoWork() override {
-    // Should be called on WorkerPool.
     base::TimeTicks start_time = base::TimeTicks::Now();
     DnsSystemSettings settings = {};
     ConfigParseWinResult result = ReadSystemSettings(&settings);
@@ -661,7 +662,7 @@
   }
 
   void OnWorkFinished() override {
-    DCHECK(loop()->BelongsToCurrentThread());
+    DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
     DCHECK(!IsCancelled());
     if (success_) {
       service_->OnConfigRead(dns_config_);
@@ -681,7 +682,7 @@
 };
 
 // Reads hosts from HOSTS file and fills in localhost and local computer name if
-// necessary. All work performed on WorkerPool.
+// necessary. All work performed in TaskScheduler.
 class DnsConfigServiceWin::HostsReader : public SerialWorker {
  public:
   explicit HostsReader(DnsConfigServiceWin* service)
@@ -695,6 +696,8 @@
 
   void DoWork() override {
     base::TimeTicks start_time = base::TimeTicks::Now();
+    base::ScopedBlockingCall scoped_blocking_call(
+        base::BlockingType::MAY_BLOCK);
     HostsParseWinResult result = HOSTS_PARSE_WIN_UNREADABLE_HOSTS_FILE;
     if (ParseHostsFile(path_, &hosts_))
       result = AddLocalhostEntries(&hosts_);
@@ -707,7 +710,7 @@
   }
 
   void OnWorkFinished() override {
-    DCHECK(loop()->BelongsToCurrentThread());
+    DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
     if (success_) {
       service_->OnHostsRead(hosts_);
     } else {
diff --git a/net/dns/fuzzed_host_resolver.cc b/net/dns/fuzzed_host_resolver.cc
index f44f367..63fac7bdd8 100644
--- a/net/dns/fuzzed_host_resolver.cc
+++ b/net/dns/fuzzed_host_resolver.cc
@@ -140,7 +140,7 @@
 FuzzedHostResolver::FuzzedHostResolver(const Options& options,
                                        NetLog* net_log,
                                        base::FuzzedDataProvider* data_provider)
-    : HostResolverImpl(options, net_log, base::ThreadTaskRunnerHandle::Get()),
+    : HostResolverImpl(options, net_log),
       data_provider_(data_provider),
       socket_factory_(data_provider),
       is_ipv6_reachable_(data_provider->ConsumeBool()),
diff --git a/net/dns/host_resolver_impl.cc b/net/dns/host_resolver_impl.cc
index be03fcfc..684e12e5 100644
--- a/net/dns/host_resolver_impl.cc
+++ b/net/dns/host_resolver_impl.cc
@@ -41,8 +41,9 @@
 #include "base/single_thread_task_runner.h"
 #include "base/strings/string_util.h"
 #include "base/strings/utf_string_conversions.h"
+#include "base/task_scheduler/post_task.h"
+#include "base/threading/scoped_blocking_call.h"
 #include "base/threading/thread_task_runner_handle.h"
-#include "base/threading/worker_pool.h"
 #include "base/time/time.h"
 #include "base/trace_event/trace_event.h"
 #include "base/values.h"
@@ -321,6 +322,7 @@
 // i.e. if only 127.0.0.1 and ::1 are routable.
 // Also returns false if it cannot determine this.
 bool HaveOnlyLoopbackAddresses() {
+  base::ScopedBlockingCall scoped_blocking_call(base::BlockingType::WILL_BLOCK);
 #if defined(OS_ANDROID)
   return android::HaveOnlyLoopbackAddresses();
 #elif defined(OS_NACL)
@@ -656,8 +658,7 @@
 
 //------------------------------------------------------------------------------
 
-// Calls HostResolverProc using a worker task runner. Performs retries if
-// necessary.
+// Calls HostResolverProc in TaskScheduler. Performs retries if necessary.
 //
 // Whenever we try to resolve the host, we post a delayed task to check if host
 // resolution (OnLookupComplete) is completed or not. If the original attempt
@@ -676,12 +677,10 @@
   ProcTask(const Key& key,
            const ProcTaskParams& params,
            const Callback& callback,
-           scoped_refptr<base::TaskRunner> worker_task_runner,
            const NetLogWithSource& job_net_log)
       : key_(key),
         params_(params),
         callback_(callback),
-        worker_task_runner_(std::move(worker_task_runner)),
         network_task_runner_(base::ThreadTaskRunnerHandle::Get()),
         attempt_number_(0),
         completed_attempt_number_(0),
@@ -738,20 +737,10 @@
     base::TimeTicks start_time = base::TimeTicks::Now();
     ++attempt_number_;
     // Dispatch the lookup attempt to a worker thread.
-    if (!worker_task_runner_->PostTask(
-            FROM_HERE, base::Bind(&ProcTask::DoLookup, this, start_time,
-                                  attempt_number_))) {
-      NOTREACHED();
-
-      // Since this method may have been called from Resolve(), can't just call
-      // OnLookupComplete().  Instead, must wait until Resolve() has returned
-      // (IO_PENDING).
-      network_task_runner_->PostTask(
-          FROM_HERE,
-          base::Bind(&ProcTask::OnLookupComplete, this, AddressList(),
-                     start_time, attempt_number_, ERR_UNEXPECTED, 0));
-      return;
-    }
+    base::PostTaskWithTraits(
+        FROM_HERE,
+        {base::MayBlock(), base::TaskShutdownBehavior::CONTINUE_ON_SHUTDOWN},
+        base::Bind(&ProcTask::DoLookup, this, start_time, attempt_number_));
 
     net_log_.AddEvent(NetLogEventType::HOST_RESOLVER_IMPL_ATTEMPT_STARTED,
                       NetLog::IntCallback("attempt_number", attempt_number_));
@@ -766,16 +755,16 @@
     }
   }
 
-  // WARNING: In production, this code runs on a worker pool. The shutdown code
-  // cannot wait for it to finish, so this code must be very careful about using
-  // other objects (like MessageLoops, Singletons, etc). During shutdown these
-  // objects may no longer exist. Multiple DoLookups() could be running in
-  // parallel, so any state inside of |this| must not mutate .
+  // WARNING: This code runs in TaskScheduler with CONTINUE_ON_SHUTDOWN. The
+  // shutdown code cannot wait for it to finish, so this code must be very
+  // careful about using other objects (like MessageLoops, Singletons, etc).
+  // During shutdown these objects may no longer exist. Multiple DoLookups()
+  // could be running in parallel, so any state inside of |this| must not
+  // mutate.
   void DoLookup(const base::TimeTicks& start_time,
                 const uint32_t attempt_number) {
     AddressList results;
     int os_error = 0;
-    // Running on a worker task runner.
     int error = params_.resolver_proc->Resolve(key_.hostname,
                                                key_.address_family,
                                                key_.host_resolver_flags,
@@ -997,9 +986,6 @@
   // The listener to the results of this ProcTask.
   Callback callback_;
 
-  // Task runner for the call to the HostResolverProc.
-  scoped_refptr<base::TaskRunner> worker_task_runner_;
-
   // Used to post events onto the network thread.
   scoped_refptr<base::SingleThreadTaskRunner> network_task_runner_;
 
@@ -1033,46 +1019,6 @@
 
 //-----------------------------------------------------------------------------
 
-// Wraps a call to HaveOnlyLoopbackAddresses to be executed on a
-// |worker_task_runner|, as it takes 40-100ms and should not block
-// initialization.
-class HostResolverImpl::LoopbackProbeJob {
- public:
-  LoopbackProbeJob(const base::WeakPtr<HostResolverImpl>& resolver,
-                   base::TaskRunner* worker_task_runner)
-      : resolver_(resolver), result_(false) {
-    DCHECK(resolver.get());
-
-    worker_task_runner->PostTaskAndReply(
-        FROM_HERE,
-        base::Bind(&LoopbackProbeJob::DoProbe, base::Unretained(this)),
-        base::Bind(&LoopbackProbeJob::OnProbeComplete, base::Owned(this)));
-  }
-
-  virtual ~LoopbackProbeJob() {}
-
- private:
-  // Runs on worker thread.
-  void DoProbe() {
-    result_ = HaveOnlyLoopbackAddresses();
-  }
-
-  void OnProbeComplete() {
-    if (!resolver_.get())
-      return;
-    resolver_->SetHaveOnlyLoopbackAddresses(result_);
-  }
-
-  // Used/set only on task runner thread.
-  base::WeakPtr<HostResolverImpl> resolver_;
-
-  bool result_;
-
-  DISALLOW_COPY_AND_ASSIGN(LoopbackProbeJob);
-};
-
-//-----------------------------------------------------------------------------
-
 // Resolves the hostname using DnsTransaction.
 // TODO(szym): This could be moved to separate source file as well.
 class HostResolverImpl::DnsTask : public base::SupportsWeakPtr<DnsTask> {
@@ -1308,12 +1254,10 @@
   Job(const base::WeakPtr<HostResolverImpl>& resolver,
       const Key& key,
       RequestPriority priority,
-      scoped_refptr<base::TaskRunner> worker_task_runner,
       const NetLogWithSource& source_net_log)
       : resolver_(resolver),
         key_(key),
         priority_tracker_(priority),
-        worker_task_runner_(std::move(worker_task_runner)),
         had_non_speculative_request_(false),
         had_dns_config_(false),
         num_occupied_job_slots_(0),
@@ -1603,16 +1547,16 @@
   }
 
   // TODO(szym): Since DnsTransaction does not consume threads, we can increase
-  // the limits on |dispatcher_|. But in order to keep the number of WorkerPool
-  // threads low, we will need to use an "inner" PrioritizedDispatcher with
-  // tighter limits.
+  // the limits on |dispatcher_|. But in order to keep the number of
+  // TaskScheduler threads low, we will need to use an "inner"
+  // PrioritizedDispatcher with tighter limits.
   void StartProcTask() {
     DCHECK(!is_dns_running());
     proc_task_ =
         new ProcTask(key_, resolver_->proc_params_,
                      base::Bind(&Job::OnProcTaskComplete,
                                 base::Unretained(this), base::TimeTicks::Now()),
-                     worker_task_runner_, net_log_);
+                     net_log_);
 
     if (had_non_speculative_request_)
       proc_task_->set_had_non_speculative_request();
@@ -1860,9 +1804,6 @@
   // Tracks the highest priority across |requests_|.
   PriorityTracker priority_tracker_;
 
-  // Task runner where the HostResolverProc is invoked.
-  scoped_refptr<base::TaskRunner> worker_task_runner_;
-
   bool had_non_speculative_request_;
 
   // Distinguishes measurements taken while DnsClient was fully configured.
@@ -1913,12 +1854,6 @@
 
 HostResolverImpl::ProcTaskParams::~ProcTaskParams() {}
 
-HostResolverImpl::HostResolverImpl(const Options& options, NetLog* net_log)
-    : HostResolverImpl(
-          options,
-          net_log,
-          base::WorkerPool::GetTaskRunner(true /* task_is_slow */)) {}
-
 HostResolverImpl::~HostResolverImpl() {
   DCHECK_CALLED_ON_VALID_THREAD(thread_checker_);
   // Prevent the dispatcher from starting new jobs.
@@ -1965,8 +1900,8 @@
   auto jobit = jobs_.find(key);
   Job* job;
   if (jobit == jobs_.end()) {
-    job = new Job(weak_ptr_factory_.GetWeakPtr(), key, priority,
-                  worker_task_runner_, source_net_log);
+    job =
+        new Job(weak_ptr_factory_.GetWeakPtr(), key, priority, source_net_log);
     job->Schedule(false);
 
     // Check for queue overflow.
@@ -1995,10 +1930,7 @@
   return ERR_IO_PENDING;
 }
 
-HostResolverImpl::HostResolverImpl(
-    const Options& options,
-    NetLog* net_log,
-    scoped_refptr<base::TaskRunner> worker_task_runner)
+HostResolverImpl::HostResolverImpl(const Options& options, NetLog* net_log)
     : max_queued_jobs_(0),
       proc_params_(NULL, options.max_retry_attempts),
       net_log_(net_log),
@@ -2009,7 +1941,6 @@
       last_ipv6_probe_result_(true),
       additional_resolver_flags_(0),
       fallback_to_proctask_(true),
-      worker_task_runner_(std::move(worker_task_runner)),
       persist_initialized_(false),
       weak_ptr_factory_(this),
       probe_weak_ptr_factory_(this) {
@@ -2427,8 +2358,14 @@
 }
 
 void HostResolverImpl::RunLoopbackProbeJob() {
-  new LoopbackProbeJob(weak_ptr_factory_.GetWeakPtr(),
-                       worker_task_runner_.get());
+  // Run this asynchronously as it can take 40-100ms and should not block
+  // initialization.
+  base::PostTaskWithTraitsAndReplyWithResult(
+      FROM_HERE,
+      {base::MayBlock(), base::TaskShutdownBehavior::CONTINUE_ON_SHUTDOWN},
+      base::BindOnce(&HaveOnlyLoopbackAddresses),
+      base::BindOnce(&HostResolverImpl::SetHaveOnlyLoopbackAddresses,
+                     weak_ptr_factory_.GetWeakPtr()));
 }
 
 void HostResolverImpl::AbortAllInProgressJobs() {
diff --git a/net/dns/host_resolver_impl.h b/net/dns/host_resolver_impl.h
index a7de17ea..f7e2ceb 100644
--- a/net/dns/host_resolver_impl.h
+++ b/net/dns/host_resolver_impl.h
@@ -33,10 +33,10 @@
 
 // For each hostname that is requested, HostResolver creates a
 // HostResolverImpl::Job. When this job gets dispatched it creates a ProcTask
-// which runs the given HostResolverProc on a worker thread (a WorkerPool
-// thread, in production code.) If requests for that same host are made during
-// the job's lifetime, they are attached to the existing job rather than
-// creating a new one. This avoids doing parallel resolves for the same host.
+// which runs the given HostResolverProc in TaskScheduler. If requests for that
+// same host are made during the job's lifetime, they are attached to the
+// existing job rather than creating a new one. This avoids doing parallel
+// resolves for the same host.
 //
 // The way these classes fit together is illustrated by:
 //
@@ -103,8 +103,8 @@
     uint32_t retry_factor;
   };
 
-  // Creates a HostResolver as specified by |options|. Blocking tasks are run on
-  // the WorkerPool.
+  // Creates a HostResolver as specified by |options|. Blocking tasks are run in
+  // TaskScheduler.
   //
   // If Options.enable_caching is true, a cache is created using
   // HostCache::CreateDefaultCache(). Otherwise no cache is used.
@@ -170,12 +170,6 @@
   }
 
  protected:
-  // Just like the public constructor, but allows the task runner used for
-  // blocking tasks to be specified. Intended for testing only.
-  HostResolverImpl(const Options& options,
-                   NetLog* net_log,
-                   scoped_refptr<base::TaskRunner> worker_task_runner);
-
   // Callback from HaveOnlyLoopbackAddresses probe.
   void SetHaveOnlyLoopbackAddresses(bool result);
 
@@ -371,11 +365,6 @@
   // Allow fallback to ProcTask if DnsTask fails.
   bool fallback_to_proctask_;
 
-  // Task runner used for DNS lookups using the platform resolver, and other
-  // blocking operations. Usually just the WorkerPool's task runner for slow
-  // tasks, but can be overridden for tests.
-  scoped_refptr<base::TaskRunner> worker_task_runner_;
-
   bool persist_initialized_;
   PersistCallback persist_callback_;
   base::OneShotTimer persist_timer_;
diff --git a/net/dns/host_resolver_impl_unittest.cc b/net/dns/host_resolver_impl_unittest.cc
index cf62a3d..89cc9ab 100644
--- a/net/dns/host_resolver_impl_unittest.cc
+++ b/net/dns/host_resolver_impl_unittest.cc
@@ -24,6 +24,7 @@
 #include "base/synchronization/condition_variable.h"
 #include "base/synchronization/lock.h"
 #include "base/test/test_timeouts.h"
+#include "base/threading/thread_restrictions.h"
 #include "base/threading/thread_task_runner_handle.h"
 #include "base/time/time.h"
 #include "net/base/address_list.h"
@@ -151,8 +152,12 @@
     capture_list_.push_back(ResolveKey(hostname, address_family));
     ++num_requests_waiting_;
     requests_waiting_.Broadcast();
-    while (!num_slots_available_)
-      slots_available_.Wait();
+    {
+      base::ScopedAllowBaseSyncPrimitivesForTesting
+          scoped_allow_base_sync_primitives;
+      while (!num_slots_available_)
+        slots_available_.Wait();
+    }
     DCHECK_GT(num_requests_waiting_, 0u);
     --num_slots_available_;
     --num_requests_waiting_;
@@ -375,6 +380,8 @@
     base::TimeTicks end_time = base::TimeTicks::Now() + wait_time;
     {
       base::AutoLock auto_lock(lock_);
+      base::ScopedAllowBaseSyncPrimitivesForTesting
+          scoped_allow_base_sync_primitives;
       while (resolved_attempt_number_ == 0 && base::TimeTicks::Now() < end_time)
         all_done_.TimedWait(end_time - base::TimeTicks::Now());
     }
diff --git a/net/dns/host_resolver_proc.cc b/net/dns/host_resolver_proc.cc
index 749993b7..8b26955a 100644
--- a/net/dns/host_resolver_proc.cc
+++ b/net/dns/host_resolver_proc.cc
@@ -8,6 +8,7 @@
 
 #include "base/logging.h"
 #include "base/sys_byteorder.h"
+#include "base/threading/scoped_blocking_call.h"
 #include "net/base/address_list.h"
 #include "net/base/net_errors.h"
 #include "net/base/sys_addrinfo.h"
@@ -190,6 +191,11 @@
   // Restrict result set to only this socket type to avoid duplicates.
   hints.ai_socktype = SOCK_STREAM;
 
+  // This function can block for a long time. Use ScopedBlockingCall to increase
+  // the current thread pool's capacity and thus avoid reducing CPU usage by the
+  // current process during that time.
+  base::ScopedBlockingCall scoped_blocking_call(base::BlockingType::WILL_BLOCK);
+
 #if defined(OS_POSIX) && !defined(OS_MACOSX) && !defined(OS_OPENBSD) && \
     !defined(OS_ANDROID) && !defined(OS_FUCHSIA)
   DnsReloaderMaybeReload();
diff --git a/net/dns/serial_worker.cc b/net/dns/serial_worker.cc
index 7ac87cc..595c0b9 100644
--- a/net/dns/serial_worker.cc
+++ b/net/dns/serial_worker.cc
@@ -6,37 +6,24 @@
 
 #include "base/bind.h"
 #include "base/location.h"
+#include "base/task_scheduler/post_task.h"
 #include "base/threading/thread_task_runner_handle.h"
-#include "base/threading/worker_pool.h"
 
 namespace net {
 
-SerialWorker::SerialWorker()
-    : task_runner_(base::ThreadTaskRunnerHandle::Get()), state_(IDLE) {
-}
+SerialWorker::SerialWorker() : state_(IDLE) {}
 
 SerialWorker::~SerialWorker() {}
 
 void SerialWorker::WorkNow() {
-  DCHECK(task_runner_->BelongsToCurrentThread());
+  DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
   switch (state_) {
     case IDLE:
-      if (!base::WorkerPool::PostTask(FROM_HERE, base::Bind(
-          &SerialWorker::DoWorkJob, this), false)) {
-#if defined(OS_POSIX)
-        // See worker_pool_posix.cc.
-        NOTREACHED() << "WorkerPool::PostTask is not expected to fail on posix";
-#else
-        LOG(WARNING) << "Failed to WorkerPool::PostTask, will retry later";
-        const int kWorkerPoolRetryDelayMs = 100;
-        task_runner_->PostDelayedTask(
-            FROM_HERE,
-            base::Bind(&SerialWorker::RetryWork, this),
-            base::TimeDelta::FromMilliseconds(kWorkerPoolRetryDelayMs));
-        state_ = WAITING;
-        return;
-#endif
-      }
+      base::PostTaskWithTraitsAndReply(
+          FROM_HERE,
+          {base::MayBlock(), base::TaskShutdownBehavior::CONTINUE_ON_SHUTDOWN},
+          base::BindOnce(&SerialWorker::DoWork, this),
+          base::BindOnce(&SerialWorker::OnWorkJobFinished, this));
       state_ = WORKING;
       return;
     case WORKING:
@@ -45,7 +32,6 @@
       return;
     case CANCELLED:
     case PENDING:
-    case WAITING:
       return;
     default:
       NOTREACHED() << "Unexpected state " << state_;
@@ -53,19 +39,12 @@
 }
 
 void SerialWorker::Cancel() {
-  DCHECK(task_runner_->BelongsToCurrentThread());
+  DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
   state_ = CANCELLED;
 }
 
-void SerialWorker::DoWorkJob() {
-  this->DoWork();
-  // If this fails, the loop is gone, so there is no point retrying.
-  task_runner_->PostTask(FROM_HERE,
-                         base::Bind(&SerialWorker::OnWorkJobFinished, this));
-}
-
 void SerialWorker::OnWorkJobFinished() {
-  DCHECK(task_runner_->BelongsToCurrentThread());
+  DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
   switch (state_) {
     case CANCELLED:
       return;
@@ -82,18 +61,4 @@
   }
 }
 
-void SerialWorker::RetryWork() {
-  DCHECK(task_runner_->BelongsToCurrentThread());
-  switch (state_) {
-    case CANCELLED:
-      return;
-    case WAITING:
-      state_ = IDLE;
-      WorkNow();
-      return;
-    default:
-      NOTREACHED() << "Unexpected state " << state_;
-  }
-}
-
 }  // namespace net
diff --git a/net/dns/serial_worker.h b/net/dns/serial_worker.h
index d06598c..858ebbd 100644
--- a/net/dns/serial_worker.h
+++ b/net/dns/serial_worker.h
@@ -10,21 +10,18 @@
 #include "base/compiler_specific.h"
 #include "base/macros.h"
 #include "base/memory/ref_counted.h"
+#include "base/sequence_checker.h"
+#include "base/task_scheduler/task_traits.h"
 #include "net/base/net_export.h"
 
-// Forward declaration
-namespace base {
-class SingleThreadTaskRunner;
-}
-
 namespace net {
 
-// SerialWorker executes a job on WorkerPool serially -- **once at a time**.
-// On |WorkNow|, a call to |DoWork| is scheduled on the WorkerPool. Once it
-// completes, |OnWorkFinished| is called on the origin thread.
-// If |WorkNow| is called (1 or more times) while |DoWork| is already under way,
-// |DoWork| will be called once: after current |DoWork| completes, before a
-// call to |OnWorkFinished|.
+// SerialWorker executes a job on TaskScheduler serially -- **once at a time**.
+// On |WorkNow|, a call to |DoWork| is scheduled on TaskScheduler. Once it
+// completes, |OnWorkFinished| is called on the origin thread. If |WorkNow| is
+// called (1 or more times) while |DoWork| is already under way, |DoWork| will
+// be called once: after current |DoWork| completes, before a call to
+// |OnWorkFinished|.
 //
 // This behavior is designed for updating a result after some trigger, for
 // example reading a file once FilePathWatcher indicates it changed.
@@ -35,14 +32,12 @@
 //
 // This implementation avoids locking by using the |state_| member to ensure
 // that |DoWork| and |OnWorkFinished| cannot execute in parallel.
-//
-// TODO(szym): update to WorkerPool::PostTaskAndReply once available.
 class NET_EXPORT_PRIVATE SerialWorker
     : public base::RefCountedThreadSafe<SerialWorker> {
  public:
   SerialWorker();
 
-  // Unless already scheduled, post |DoWork| to WorkerPool.
+  // Unless already scheduled, post |DoWork| to TaskScheduler.
   // Made virtual to allow mocking.
   virtual void WorkNow();
 
@@ -56,36 +51,27 @@
   // protected to allow sub-classing, but prevent deleting
   virtual ~SerialWorker();
 
-  // Executed on WorkerPool, at most once at a time.
+  // Executed on TaskScheduler, at most once at a time.
   virtual void DoWork() = 0;
 
   // Executed on origin thread after |DoRead| completes.
   virtual void OnWorkFinished() = 0;
 
-  base::SingleThreadTaskRunner* loop() { return task_runner_.get(); }
+  // Used to verify that the constructor, WorkNow(), Cancel() and
+  // OnWorkJobFinished() are called on the same sequence.
+  SEQUENCE_CHECKER(sequence_checker_);
 
  private:
   enum State {
     CANCELLED = -1,
     IDLE = 0,
-    WORKING,  // |DoWorkJob| posted on WorkerPool, until |OnWorkJobFinished|
+    WORKING,  // |DoWorkJob| posted to TaskScheduler, until |OnWorkJobFinished|
     PENDING,  // |WorkNow| while WORKING, must re-do work
-    WAITING,  // WorkerPool is busy, |RetryWork| is posted
   };
 
-  // Called on the worker thread, executes |DoWork| and notifies the origin
-  // thread.
-  void DoWorkJob();
-
   // Called on the the origin thread after |DoWork| completes.
   void OnWorkJobFinished();
 
-  // Posted to message loop in case WorkerPool is busy. (state == WAITING)
-  void RetryWork();
-
-  // Task runner for the thread of origin.
-  scoped_refptr<base::SingleThreadTaskRunner> task_runner_;
-
   State state_;
 
   DISALLOW_COPY_AND_ASSIGN(SerialWorker);
diff --git a/net/dns/serial_worker_unittest.cc b/net/dns/serial_worker_unittest.cc
index debda40..de16228 100644
--- a/net/dns/serial_worker_unittest.cc
+++ b/net/dns/serial_worker_unittest.cc
@@ -11,6 +11,7 @@
 #include "base/single_thread_task_runner.h"
 #include "base/synchronization/lock.h"
 #include "base/synchronization/waitable_event.h"
+#include "base/threading/thread_restrictions.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
 namespace net {
@@ -22,8 +23,7 @@
   // The class under test
   class TestSerialWorker : public SerialWorker {
    public:
-    explicit TestSerialWorker(SerialWorkerTest* t)
-      : test_(t) {}
+    explicit TestSerialWorker(SerialWorkerTest* t) : test_(t) {}
     void DoWork() override {
       ASSERT_TRUE(test_);
       test_->OnWork();
@@ -46,8 +46,12 @@
       work_running_ = true;
     }
     BreakNow("OnWork");
-    work_allowed_.Wait();
-    // Calling from WorkerPool, but protected by work_allowed_/work_called_.
+    {
+      base::ScopedAllowBaseSyncPrimitivesForTesting
+          scoped_allow_base_sync_primitives;
+      work_allowed_.Wait();
+    }
+    // Calling from TaskScheduler, but protected by work_allowed_/work_called_.
     output_value_ = input_value_;
 
     { // This lock might be destroyed after work_called_ is signalled.
diff --git a/net/http2/decoder/payload_decoders/altsvc_payload_decoder_test.cc b/net/http2/decoder/payload_decoders/altsvc_payload_decoder_test.cc
index c58d80f8..23306699 100644
--- a/net/http2/decoder/payload_decoders/altsvc_payload_decoder_test.cc
+++ b/net/http2/decoder/payload_decoders/altsvc_payload_decoder_test.cc
@@ -31,13 +31,6 @@
   // Returns the mask of flags that affect the decoding of the payload (i.e.
   // flags that that indicate the presence of certain fields or padding).
   static constexpr uint8_t FlagsAffectingPayloadDecoding() { return 0; }
-
-  static void Randomize(AltSvcPayloadDecoder* p, RandomBase* rng) {
-    CorruptEnum(&p->payload_state_, rng);
-    test::Randomize(&p->altsvc_fields_, rng);
-    VLOG(1) << "AltSvcPayloadDecoderPeer::Randomize altsvc_fields_="
-            << p->altsvc_fields_;
-  }
 };
 
 namespace {
diff --git a/net/http2/decoder/payload_decoders/continuation_payload_decoder_test.cc b/net/http2/decoder/payload_decoders/continuation_payload_decoder_test.cc
index 01a9a9e..e77bfb0 100644
--- a/net/http2/decoder/payload_decoders/continuation_payload_decoder_test.cc
+++ b/net/http2/decoder/payload_decoders/continuation_payload_decoder_test.cc
@@ -33,13 +33,6 @@
   // Returns the mask of flags that affect the decoding of the payload (i.e.
   // flags that that indicate the presence of certain fields or padding).
   static constexpr uint8_t FlagsAffectingPayloadDecoding() { return 0; }
-
-  static void Randomize(ContinuationPayloadDecoder* p, RandomBase* rng) {
-    // ContinuationPayloadDecoder has no fields,
-    // so there is nothing to randomize.
-    static_assert(std::is_empty<ContinuationPayloadDecoder>::value,
-                  "Need to randomize fields of ContinuationPayloadDecoder");
-  }
 };
 
 namespace {
diff --git a/net/http2/decoder/payload_decoders/data_payload_decoder_test.cc b/net/http2/decoder/payload_decoders/data_payload_decoder_test.cc
index be0b34ab..d1d7ff7 100644
--- a/net/http2/decoder/payload_decoders/data_payload_decoder_test.cc
+++ b/net/http2/decoder/payload_decoders/data_payload_decoder_test.cc
@@ -37,11 +37,6 @@
   static constexpr uint8_t FlagsAffectingPayloadDecoding() {
     return Http2FrameFlag::PADDED;
   }
-
-  static void Randomize(DataPayloadDecoder* p, RandomBase* rng) {
-    VLOG(1) << "DataPayloadDecoderPeer::Randomize";
-    CorruptEnum(&p->payload_state_, rng);
-  }
 };
 
 namespace {
diff --git a/net/http2/decoder/payload_decoders/goaway_payload_decoder_test.cc b/net/http2/decoder/payload_decoders/goaway_payload_decoder_test.cc
index ccb01146..74bcd18b 100644
--- a/net/http2/decoder/payload_decoders/goaway_payload_decoder_test.cc
+++ b/net/http2/decoder/payload_decoders/goaway_payload_decoder_test.cc
@@ -29,13 +29,6 @@
   // Returns the mask of flags that affect the decoding of the payload (i.e.
   // flags that that indicate the presence of certain fields or padding).
   static constexpr uint8_t FlagsAffectingPayloadDecoding() { return 0; }
-
-  static void Randomize(GoAwayPayloadDecoder* p, RandomBase* rng) {
-    CorruptEnum(&p->payload_state_, rng);
-    test::Randomize(&p->goaway_fields_, rng);
-    VLOG(1) << "GoAwayPayloadDecoderPeer::Randomize goaway_fields: "
-            << p->goaway_fields_;
-  }
 };
 
 namespace {
diff --git a/net/http2/decoder/payload_decoders/headers_payload_decoder_test.cc b/net/http2/decoder/payload_decoders/headers_payload_decoder_test.cc
index 55bd73f..75282d9 100644
--- a/net/http2/decoder/payload_decoders/headers_payload_decoder_test.cc
+++ b/net/http2/decoder/payload_decoders/headers_payload_decoder_test.cc
@@ -33,13 +33,6 @@
   static constexpr uint8_t FlagsAffectingPayloadDecoding() {
     return Http2FrameFlag::PADDED | Http2FrameFlag::PRIORITY;
   }
-
-  static void Randomize(HeadersPayloadDecoder* p, RandomBase* rng) {
-    CorruptEnum(&p->payload_state_, rng);
-    test::Randomize(&p->priority_fields_, rng);
-    VLOG(1) << "HeadersPayloadDecoderPeer::Randomize priority_fields_: "
-            << p->priority_fields_;
-  }
 };
 
 namespace {
diff --git a/net/http2/decoder/payload_decoders/ping_payload_decoder_test.cc b/net/http2/decoder/payload_decoders/ping_payload_decoder_test.cc
index b280d69..04e0b44 100644
--- a/net/http2/decoder/payload_decoders/ping_payload_decoder_test.cc
+++ b/net/http2/decoder/payload_decoders/ping_payload_decoder_test.cc
@@ -28,11 +28,6 @@
   // Returns the mask of flags that affect the decoding of the payload (i.e.
   // flags that that indicate the presence of certain fields or padding).
   static constexpr uint8_t FlagsAffectingPayloadDecoding() { return 0; }
-
-  static void Randomize(PingPayloadDecoder* p, RandomBase* rng) {
-    VLOG(1) << "PingPayloadDecoderPeer::Randomize";
-    test::Randomize(&p->ping_fields_, rng);
-  }
 };
 
 namespace {
diff --git a/net/http2/decoder/payload_decoders/priority_payload_decoder_test.cc b/net/http2/decoder/payload_decoders/priority_payload_decoder_test.cc
index 64b7f1d..53123631 100644
--- a/net/http2/decoder/payload_decoders/priority_payload_decoder_test.cc
+++ b/net/http2/decoder/payload_decoders/priority_payload_decoder_test.cc
@@ -30,11 +30,6 @@
   // Returns the mask of flags that affect the decoding of the payload (i.e.
   // flags that that indicate the presence of certain fields or padding).
   static constexpr uint8_t FlagsAffectingPayloadDecoding() { return 0; }
-
-  static void Randomize(PriorityPayloadDecoder* p, RandomBase* rng) {
-    VLOG(1) << "PriorityPayloadDecoderPeer::Randomize";
-    test::Randomize(&p->priority_fields_, rng);
-  }
 };
 
 namespace {
diff --git a/net/http2/decoder/payload_decoders/push_promise_payload_decoder_test.cc b/net/http2/decoder/payload_decoders/push_promise_payload_decoder_test.cc
index 0739687..92fd183c 100644
--- a/net/http2/decoder/payload_decoders/push_promise_payload_decoder_test.cc
+++ b/net/http2/decoder/payload_decoders/push_promise_payload_decoder_test.cc
@@ -35,12 +35,6 @@
   static constexpr uint8_t FlagsAffectingPayloadDecoding() {
     return Http2FrameFlag::PADDED;
   }
-
-  static void Randomize(PushPromisePayloadDecoder* p, RandomBase* rng) {
-    VLOG(1) << "PushPromisePayloadDecoderPeer::Randomize";
-    CorruptEnum(&p->payload_state_, rng);
-    test::Randomize(&p->push_promise_fields_, rng);
-  }
 };
 
 namespace {
diff --git a/net/http2/decoder/payload_decoders/rst_stream_payload_decoder_test.cc b/net/http2/decoder/payload_decoders/rst_stream_payload_decoder_test.cc
index df712cc..741c444 100644
--- a/net/http2/decoder/payload_decoders/rst_stream_payload_decoder_test.cc
+++ b/net/http2/decoder/payload_decoders/rst_stream_payload_decoder_test.cc
@@ -31,11 +31,6 @@
   // Returns the mask of flags that affect the decoding of the payload (i.e.
   // flags that that indicate the presence of certain fields or padding).
   static constexpr uint8_t FlagsAffectingPayloadDecoding() { return 0; }
-
-  static void Randomize(RstStreamPayloadDecoder* p, RandomBase* rng) {
-    VLOG(1) << "RstStreamPayloadDecoderPeer::Randomize";
-    test::Randomize(&p->rst_stream_fields_, rng);
-  }
 };
 
 namespace {
diff --git a/net/http2/decoder/payload_decoders/settings_payload_decoder_test.cc b/net/http2/decoder/payload_decoders/settings_payload_decoder_test.cc
index e801419..1764dc2 100644
--- a/net/http2/decoder/payload_decoders/settings_payload_decoder_test.cc
+++ b/net/http2/decoder/payload_decoders/settings_payload_decoder_test.cc
@@ -35,11 +35,6 @@
   static constexpr uint8_t FlagsAffectingPayloadDecoding() {
     return Http2FrameFlag::ACK;
   }
-
-  static void Randomize(SettingsPayloadDecoder* p, RandomBase* rng) {
-    VLOG(1) << "SettingsPayloadDecoderPeer::Randomize";
-    test::Randomize(&p->setting_fields_, rng);
-  }
 };
 
 namespace {
diff --git a/net/http2/decoder/payload_decoders/unknown_payload_decoder_test.cc b/net/http2/decoder/payload_decoders/unknown_payload_decoder_test.cc
index 27a9548..5c069302 100644
--- a/net/http2/decoder/payload_decoders/unknown_payload_decoder_test.cc
+++ b/net/http2/decoder/payload_decoders/unknown_payload_decoder_test.cc
@@ -35,12 +35,6 @@
   // Returns the mask of flags that affect the decoding of the payload (i.e.
   // flags that that indicate the presence of certain fields or padding).
   static constexpr uint8_t FlagsAffectingPayloadDecoding() { return 0; }
-
-  static void Randomize(UnknownPayloadDecoder* p, RandomBase* rng) {
-    // UnknownPayloadDecoder has no fields, so there is nothing to randomize.
-    static_assert(std::is_empty<UnknownPayloadDecoder>::value,
-                  "Need to randomize fields of UnknownPayloadDecoder");
-  }
 };
 
 namespace {
diff --git a/net/http2/decoder/payload_decoders/window_update_payload_decoder_test.cc b/net/http2/decoder/payload_decoders/window_update_payload_decoder_test.cc
index cfc64f1..e46d55bd 100644
--- a/net/http2/decoder/payload_decoders/window_update_payload_decoder_test.cc
+++ b/net/http2/decoder/payload_decoders/window_update_payload_decoder_test.cc
@@ -30,12 +30,6 @@
   // Returns the mask of flags that affect the decoding of the payload (i.e.
   // flags that that indicate the presence of certain fields or padding).
   static constexpr uint8_t FlagsAffectingPayloadDecoding() { return 0; }
-
-  static void Randomize(WindowUpdatePayloadDecoder* p, RandomBase* rng) {
-    test::Randomize(&p->window_update_fields_, rng);
-    VLOG(1) << "WindowUpdatePayloadDecoderPeer::Randomize "
-            << "window_update_fields_: " << p->window_update_fields_;
-  }
 };
 
 namespace {
diff --git a/net/quic/chromium/quic_http_stream_test.cc b/net/quic/chromium/quic_http_stream_test.cc
index b93d725..11076be 100644
--- a/net/quic/chromium/quic_http_stream_test.cc
+++ b/net/quic/chromium/quic_http_stream_test.cc
@@ -324,9 +324,6 @@
     promised_response_["content-type"] = "text/plain";
 
     promise_url_ = SpdyUtils::GetUrlFromHeaderBlock(push_promise_);
-
-    serialized_push_promise_ =
-        SpdyUtils::SerializeUncompressedHeaders(push_promise_);
   }
 
   void SetRequest(const string& method,
@@ -566,7 +563,6 @@
   SpdyHeaderBlock promised_response_;
   const QuicStreamId promise_id_;
   string promise_url_;
-  string serialized_push_promise_;
   const QuicStreamId stream_id_;
 
   const QuicConnectionId connection_id_;
@@ -1839,8 +1835,6 @@
 
   push_promise_[":authority"] = "mail.example.org";
   promise_url_ = SpdyUtils::GetUrlFromHeaderBlock(push_promise_);
-  serialized_push_promise_ =
-      SpdyUtils::SerializeUncompressedHeaders(push_promise_);
 
   ReceivePromise(promise_id_);
   EXPECT_NE(session_->GetPromisedByUrl(promise_url_), nullptr);
@@ -1910,8 +1904,6 @@
   // packet, but does it matter?
   push_promise_[":authority"] = "www.notexample.org";
   promise_url_ = SpdyUtils::GetUrlFromHeaderBlock(push_promise_);
-  serialized_push_promise_ =
-      SpdyUtils::SerializeUncompressedHeaders(push_promise_);
 
   ReceivePromise(promise_id_);
   // The promise will have been rejected because the cert doesn't
@@ -1932,8 +1924,6 @@
                                       net_log_.bound(), callback_.callback()));
 
   push_promise_["accept-encoding"] = "gzip";
-  serialized_push_promise_ =
-      SpdyUtils::SerializeUncompressedHeaders(push_promise_);
 
   // TODO(ckrasic) - could do this via constructing a PUSH_PROMISE
   // packet, but does it matter?
@@ -2025,8 +2015,6 @@
                                       net_log_.bound(), callback_.callback()));
 
   push_promise_["accept-encoding"] = "gzip";
-  serialized_push_promise_ =
-      SpdyUtils::SerializeUncompressedHeaders(push_promise_);
 
   // TODO(ckrasic) - could do this via constructing a PUSH_PROMISE
   // packet, but does it matter?
diff --git a/net/quic/chromium/quic_stream_factory_test.cc b/net/quic/chromium/quic_stream_factory_test.cc
index dbdb1fe..965aedb2 100644
--- a/net/quic/chromium/quic_stream_factory_test.cc
+++ b/net/quic/chromium/quic_stream_factory_test.cc
@@ -862,6 +862,28 @@
   ASSERT_FALSE(session->config()->HasInitialRoundTripTimeUsToSend());
 }
 
+TEST_P(QuicStreamFactoryTest, FactoryDestroyedWhenJobPending) {
+  Initialize();
+  ProofVerifyDetailsChromium verify_details = DefaultProofVerifyDetails();
+  crypto_client_stream_factory_.AddProofVerifyDetails(&verify_details);
+
+  MockQuicData socket_data;
+  socket_data.AddRead(SYNCHRONOUS, ERR_IO_PENDING);
+  socket_data.AddWrite(ConstructInitialSettingsPacket());
+  socket_data.AddSocketDataToFactory(&socket_factory_);
+
+  auto request = std::make_unique<QuicStreamRequest>(factory_.get());
+  EXPECT_EQ(ERR_IO_PENDING,
+            request->Request(host_port_pair_, version_, privacy_mode_,
+                             /*cert_verify_flags=*/0, url_, "GET", net_log_,
+                             &net_error_details_, callback_.callback()));
+  request.reset();
+  EXPECT_TRUE(HasActiveJob(host_port_pair_, privacy_mode_));
+  // Tearing down a QuicStreamFactory with a pending Job should not cause any
+  // crash. crbug.com/768343.
+  factory_.reset();
+}
+
 TEST_P(QuicStreamFactoryTest, RequireConfirmation) {
   crypto_client_stream_factory_.set_handshake_mode(
       MockCryptoClientStream::ZERO_RTT);
diff --git a/net/quic/core/quic_spdy_stream_test.cc b/net/quic/core/quic_spdy_stream_test.cc
index 7da9231..9ada186 100644
--- a/net/quic/core/quic_spdy_stream_test.cc
+++ b/net/quic/core/quic_spdy_stream_test.cc
@@ -410,7 +410,6 @@
                          stream_->flow_controller()));
 
   // Try to send more data than the flow control limit allows.
-  string headers = SpdyUtils::SerializeUncompressedHeaders(headers_);
   const uint64_t kOverflow = 15;
   string body(kWindow + kOverflow, 'a');
 
diff --git a/net/quic/core/spdy_utils.cc b/net/quic/core/spdy_utils.cc
index e628513..261edca 100644
--- a/net/quic/core/spdy_utils.cc
+++ b/net/quic/core/spdy_utils.cc
@@ -23,16 +23,6 @@
 namespace net {
 
 // static
-string SpdyUtils::SerializeUncompressedHeaders(const SpdyHeaderBlock& headers) {
-  size_t length = SpdyFramer::GetUncompressedSerializedLength(headers);
-  SpdyFrameBuilder builder(length);
-  SpdyFramer framer(SpdyFramer::DISABLE_COMPRESSION);
-  framer.SerializeHeaderBlockWithoutCompression(&builder, headers);
-  SpdySerializedFrame block(builder.take());
-  return string(block.data(), length);
-}
-
-// static
 bool SpdyUtils::ExtractContentLengthFromHeaders(int64_t* content_length,
                                                 SpdyHeaderBlock* headers) {
   auto it = headers->find("content-length");
diff --git a/net/quic/core/spdy_utils.h b/net/quic/core/spdy_utils.h
index 724136af..2c0fc737 100644
--- a/net/quic/core/spdy_utils.h
+++ b/net/quic/core/spdy_utils.h
@@ -19,9 +19,6 @@
 
 class QUIC_EXPORT_PRIVATE SpdyUtils {
  public:
-  static std::string SerializeUncompressedHeaders(
-      const SpdyHeaderBlock& headers);
-
   // Populate |content length| with the value of the content-length header.
   // Returns true on success, false if parsing fails or content-length header is
   // missing.
diff --git a/net/socket/ssl_client_socket_pool_unittest.cc b/net/socket/ssl_client_socket_pool_unittest.cc
index 39a11f0..bb25daf 100644
--- a/net/socket/ssl_client_socket_pool_unittest.cc
+++ b/net/socket/ssl_client_socket_pool_unittest.cc
@@ -147,13 +147,13 @@
 
   scoped_refptr<SSLSocketParams> SSLParams(ProxyServer::Scheme proxy,
                                            bool expect_spdy) {
-    return make_scoped_refptr(new SSLSocketParams(
+    return base::MakeRefCounted<SSLSocketParams>(
         proxy == ProxyServer::SCHEME_DIRECT ? direct_transport_socket_params_
                                             : NULL,
         proxy == ProxyServer::SCHEME_SOCKS5 ? socks_socket_params_ : NULL,
         proxy == ProxyServer::SCHEME_HTTP ? http_proxy_socket_params_ : NULL,
         HostPortPair("host", 443), ssl_config_, PRIVACY_MODE_DISABLED, 0,
-        expect_spdy));
+        expect_spdy);
   }
 
   void AddAuthToCache() {
diff --git a/net/spdy/chromium/buffered_spdy_framer.cc b/net/spdy/chromium/buffered_spdy_framer.cc
index 52cea7c..c811984 100644
--- a/net/spdy/chromium/buffered_spdy_framer.cc
+++ b/net/spdy/chromium/buffered_spdy_framer.cc
@@ -72,8 +72,6 @@
     control_frame_fields_->exclusive = exclusive;
   }
   control_frame_fields_->fin = fin;
-
-  DCHECK_NE(stream_id, SpdyFramer::kInvalidStream);
 }
 
 void BufferedSpdyFramer::OnDataFrameHeader(SpdyStreamId stream_id,
@@ -196,8 +194,6 @@
   control_frame_fields_->type = SpdyFrameType::PUSH_PROMISE;
   control_frame_fields_->stream_id = stream_id;
   control_frame_fields_->promised_stream_id = promised_stream_id;
-
-  DCHECK_NE(stream_id, SpdyFramer::kInvalidStream);
 }
 
 void BufferedSpdyFramer::OnAltSvc(
@@ -311,10 +307,6 @@
       spdy_framer_.SerializePriority(priority_ir));
 }
 
-SpdyPriority BufferedSpdyFramer::GetHighestPriority() const {
-  return spdy_framer_.GetHighestPriority();
-}
-
 size_t BufferedSpdyFramer::EstimateMemoryUsage() const {
   return SpdyEstimateMemoryUsage(spdy_framer_) +
          SpdyEstimateMemoryUsage(deframer_) +
diff --git a/net/spdy/chromium/buffered_spdy_framer.h b/net/spdy/chromium/buffered_spdy_framer.h
index 54548e11..bdc1520 100644
--- a/net/spdy/chromium/buffered_spdy_framer.h
+++ b/net/spdy/chromium/buffered_spdy_framer.h
@@ -216,16 +216,6 @@
     return spdy_framer_.SerializeFrame(frame);
   }
 
-  SpdyPriority GetHighestPriority() const;
-
-  size_t GetFrameMaximumSize() const {
-    return spdy_framer_.GetFrameMaximumSize();
-  }
-
-  size_t GetDataFrameMaximumPayload() const {
-    return spdy_framer_.GetDataFrameMaximumPayload();
-  }
-
   int frames_received() const { return frames_received_; }
 
   // Returns the estimate of dynamically allocated memory in bytes.
diff --git a/net/spdy/chromium/buffered_spdy_framer_unittest.cc b/net/spdy/chromium/buffered_spdy_framer_unittest.cc
index e2eabad9..0343c00d 100644
--- a/net/spdy/chromium/buffered_spdy_framer_unittest.cc
+++ b/net/spdy/chromium/buffered_spdy_framer_unittest.cc
@@ -50,7 +50,6 @@
                  bool fin,
                  SpdyHeaderBlock headers) override {
     header_stream_id_ = stream_id;
-    EXPECT_NE(header_stream_id_, SpdyFramer::kInvalidStream);
     headers_frame_count_++;
     headers_ = std::move(headers);
   }
@@ -111,10 +110,8 @@
                      SpdyStreamId promised_stream_id,
                      SpdyHeaderBlock headers) override {
     header_stream_id_ = stream_id;
-    EXPECT_NE(header_stream_id_, SpdyFramer::kInvalidStream);
     push_promise_frame_count_++;
     promised_stream_id_ = promised_stream_id;
-    EXPECT_NE(promised_stream_id_, SpdyFramer::kInvalidStream);
     headers_ = std::move(headers);
   }
 
diff --git a/net/spdy/chromium/spdy_session.h b/net/spdy/chromium/spdy_session.h
index 202d2ba..537b1c7 100644
--- a/net/spdy/chromium/spdy_session.h
+++ b/net/spdy/chromium/spdy_session.h
@@ -537,14 +537,6 @@
     return pooled_aliases_;
   }
 
-  size_t GetFrameMaximumSize() const {
-    return buffered_spdy_framer_->GetFrameMaximumSize();
-  }
-
-  size_t GetDataFrameMaximumPayload() const {
-    return buffered_spdy_framer_->GetDataFrameMaximumPayload();
-  }
-
   // https://http2.github.io/http2-spec/#TLSUsage mandates minimum security
   // standards for TLS.
   bool HasAcceptableTransportSecurity() const;
diff --git a/net/spdy/chromium/spdy_stream.cc b/net/spdy/chromium/spdy_stream.cc
index 88c334f..005dc57b 100644
--- a/net/spdy/chromium/spdy_stream.cc
+++ b/net/spdy/chromium/spdy_stream.cc
@@ -525,7 +525,7 @@
   }
 
   size_t length = buffer->GetRemainingSize();
-  DCHECK_LE(length, session_->GetDataFrameMaximumPayload());
+  DCHECK_LE(length, kHttp2DefaultFramePayloadLimit);
   base::WeakPtr<SpdyStream> weak_this = GetWeakPtr();
   // May close the stream.
   DecreaseRecvWindowSize(static_cast<int32_t>(length));
@@ -614,7 +614,7 @@
   size_t frame_payload_size = frame_size - kDataFrameMinimumSize;
 
   CHECK_GE(frame_size, kDataFrameMinimumSize);
-  CHECK_LE(frame_payload_size, session_->GetDataFrameMaximumPayload());
+  CHECK_LE(frame_payload_size, kHttp2DefaultFramePayloadLimit);
 
   send_bytes_ += frame_payload_size;
 
@@ -851,7 +851,7 @@
 
   DCHECK_GE(data_buffer->GetRemainingSize(), kDataFrameMinimumSize);
   size_t payload_size = data_buffer->GetRemainingSize() - kDataFrameMinimumSize;
-  DCHECK_LE(payload_size, session_->GetDataFrameMaximumPayload());
+  DCHECK_LE(payload_size, kHttp2DefaultFramePayloadLimit);
 
   // Send window size is based on payload size, so nothing to do if this is
   // just a FIN with no payload.
diff --git a/net/spdy/core/http2_frame_decoder_adapter.h b/net/spdy/core/http2_frame_decoder_adapter.h
index edbca62..c3e08b3 100644
--- a/net/spdy/core/http2_frame_decoder_adapter.h
+++ b/net/spdy/core/http2_frame_decoder_adapter.h
@@ -278,7 +278,7 @@
 
   // The limit on the size of received HTTP/2 payloads as specified in the
   // SETTINGS_MAX_FRAME_SIZE advertised to peer.
-  size_t recv_frame_size_limit_ = kSpdyInitialFrameSizeLimit;
+  size_t recv_frame_size_limit_ = kHttp2DefaultFramePayloadLimit;
 
   // Has OnFrameHeader been called?
   bool decoded_frame_header_ = false;
diff --git a/net/spdy/core/spdy_frame_builder.cc b/net/spdy/core/spdy_frame_builder.cc
index 5d7eeb2..23eff89 100644
--- a/net/spdy/core/spdy_frame_builder.cc
+++ b/net/spdy/core/spdy_frame_builder.cc
@@ -11,7 +11,6 @@
 
 #include "base/logging.h"
 #include "net/spdy/core/spdy_bug_tracker.h"
-#include "net/spdy/core/spdy_framer.h"
 #include "net/spdy/core/spdy_protocol.h"
 #include "net/spdy/core/zero_copy_output_buffer.h"
 
@@ -62,8 +61,7 @@
   return true;
 }
 
-bool SpdyFrameBuilder::BeginNewFrame(const SpdyFramer& framer,
-                                     SpdyFrameType type,
+bool SpdyFrameBuilder::BeginNewFrame(SpdyFrameType type,
                                      uint8_t flags,
                                      SpdyStreamId stream_id) {
   uint8_t raw_frame_type = SerializeFrameType(type);
@@ -85,32 +83,26 @@
   return success;
 }
 
-bool SpdyFrameBuilder::BeginNewFrame(const SpdyFramer& framer,
-                                     SpdyFrameType type,
+bool SpdyFrameBuilder::BeginNewFrame(SpdyFrameType type,
                                      uint8_t flags,
                                      SpdyStreamId stream_id,
                                      size_t length) {
   uint8_t raw_frame_type = SerializeFrameType(type);
   DCHECK(IsDefinedFrameType(raw_frame_type));
   DCHECK_EQ(0u, stream_id & ~kStreamIdMask);
-  SPDY_BUG_IF(framer.GetFrameMaximumSize() < length_)
-      << "Frame length  " << length_
-      << " is longer than the maximum allowed length.";
-  return BeginNewFrameInternal(framer, raw_frame_type, flags, stream_id,
-                               length);
+  SPDY_BUG_IF(length > kHttp2DefaultFramePayloadLimit)
+      << "Frame length  " << length_ << " is longer than frame size limit.";
+  return BeginNewFrameInternal(raw_frame_type, flags, stream_id, length);
 }
 
-bool SpdyFrameBuilder::BeginNewUncheckedFrame(const SpdyFramer& framer,
-                                              uint8_t raw_frame_type,
+bool SpdyFrameBuilder::BeginNewUncheckedFrame(uint8_t raw_frame_type,
                                               uint8_t flags,
                                               SpdyStreamId stream_id,
                                               size_t length) {
-  return BeginNewFrameInternal(framer, raw_frame_type, flags, stream_id,
-                               length);
+  return BeginNewFrameInternal(raw_frame_type, flags, stream_id, length);
 }
 
-bool SpdyFrameBuilder::BeginNewFrameInternal(const SpdyFramer& framer,
-                                             uint8_t raw_frame_type,
+bool SpdyFrameBuilder::BeginNewFrameInternal(uint8_t raw_frame_type,
                                              uint8_t flags,
                                              SpdyStreamId stream_id,
                                              size_t length) {
diff --git a/net/spdy/core/spdy_frame_builder.h b/net/spdy/core/spdy_frame_builder.h
index b7b8e65ba..b75e73b 100644
--- a/net/spdy/core/spdy_frame_builder.h
+++ b/net/spdy/core/spdy_frame_builder.h
@@ -20,8 +20,6 @@
 
 namespace net {
 
-class SpdyFramer;
-
 // This class provides facilities for basic binary value packing
 // into Spdy frames.
 //
@@ -48,23 +46,18 @@
 
   // Populates this frame with a HTTP2 frame prefix using length information
   // from |capacity_|. The given type must be a control frame type.
-  bool BeginNewFrame(const SpdyFramer& framer,
-                     SpdyFrameType type,
-                     uint8_t flags,
-                     SpdyStreamId stream_id);
+  bool BeginNewFrame(SpdyFrameType type, uint8_t flags, SpdyStreamId stream_id);
 
   // Populates this frame with a HTTP2 frame prefix with type and length
   // information.  |type| must be a defined frame type.
-  bool BeginNewFrame(const SpdyFramer& framer,
-                     SpdyFrameType type,
+  bool BeginNewFrame(SpdyFrameType type,
                      uint8_t flags,
                      SpdyStreamId stream_id,
                      size_t length);
 
   // Populates this frame with a HTTP2 frame prefix with type and length
   // information.  |raw_frame_type| may be a defined or undefined frame type.
-  bool BeginNewUncheckedFrame(const SpdyFramer& framer,
-                              uint8_t raw_frame_type,
+  bool BeginNewUncheckedFrame(uint8_t raw_frame_type,
                               uint8_t flags,
                               SpdyStreamId stream_id,
                               size_t length);
@@ -116,8 +109,7 @@
 
   // Populates this frame with a HTTP2 frame prefix with type and length
   // information.
-  bool BeginNewFrameInternal(const SpdyFramer& framer,
-                             uint8_t raw_frame_type,
+  bool BeginNewFrameInternal(uint8_t raw_frame_type,
                              uint8_t flags,
                              SpdyStreamId stream_id,
                              size_t length);
diff --git a/net/spdy/core/spdy_framer.cc b/net/spdy/core/spdy_framer.cc
index 5d3a456..4e90c05 100644
--- a/net/spdy/core/spdy_framer.cc
+++ b/net/spdy/core/spdy_framer.cc
@@ -48,66 +48,10 @@
 // Wire size of pad length field.
 const size_t kPadLengthFieldSize = 1;
 
-}  // namespace
+// The size of one parameter in SETTINGS frame.
+const size_t kOneSettingParameterSize = 6;
 
-const SpdyStreamId SpdyFramer::kInvalidStream = static_cast<SpdyStreamId>(-1);
-const size_t SpdyFramer::kHeaderDataChunkMaxSize = 1024;
-// Even though the length field is 24 bits, we keep this 16 kB
-// limit on control frame size for legacy reasons and to
-// mitigate DOS attacks.
-const size_t SpdyFramer::kMaxControlFrameSize = (1 << 14) - 1;
-const size_t SpdyFramer::kMaxDataPayloadSendSize = 1 << 14;
-// The size of the control frame buffer. Must be >= the minimum size of the
-// largest control frame.
-const size_t SpdyFramer::kControlFrameBufferSize = 19;
-const size_t SpdyFramer::kOneSettingParameterSize = 6;
-
-#ifdef DEBUG_SPDY_STATE_CHANGES
-#define CHANGE_STATE(newstate)                                  \
-  do {                                                          \
-    DVLOG(1) << "Changing state from: "                         \
-             << StateToString(state_)                           \
-             << " to " << StateToString(newstate) << "\n";      \
-    DCHECK(state_ != SPDY_ERROR);                               \
-    DCHECK_EQ(previous_state_, state_);                         \
-    previous_state_ = state_;                                   \
-    state_ = newstate;                                          \
-  } while (false)
-#else
-#define CHANGE_STATE(newstate)                                  \
-  do {                                                          \
-    DCHECK(state_ != SPDY_ERROR);                               \
-    DCHECK_EQ(previous_state_, state_);                         \
-    previous_state_ = state_;                                   \
-    state_ = newstate;                                          \
-  } while (false)
-#endif
-
-SpdyFramer::SpdyFramer(CompressionOption option)
-    : debug_visitor_(nullptr), compression_option_(option) {
-  static_assert(
-      kMaxControlFrameSize <= kSpdyInitialFrameSizeLimit + kFrameHeaderSize,
-      "Our send limit should be at most our receive limit");
-}
-
-SpdyFramer::~SpdyFramer() {}
-
-void SpdyFramer::set_debug_visitor(
-    SpdyFramerDebugVisitorInterface* debug_visitor) {
-  debug_visitor_ = debug_visitor;
-}
-
-size_t SpdyFramer::GetFrameMaximumSize() const {
-  return send_frame_size_limit_ + kFrameHeaderSize;
-}
-
-size_t SpdyFramer::GetDataFrameMaximumPayload() const {
-  return std::min(kMaxDataPayloadSendSize,
-                  GetFrameMaximumSize() - kDataFrameMinimumSize);
-}
-
-size_t SpdyFramer::GetUncompressedSerializedLength(
-    const SpdyHeaderBlock& headers) {
+size_t GetUncompressedSerializedLength(const SpdyHeaderBlock& headers) {
   const size_t num_name_value_pairs_size = sizeof(uint32_t);
   const size_t length_of_name_size = num_name_value_pairs_size;
   const size_t length_of_value_size = num_name_value_pairs_size;
@@ -122,6 +66,236 @@
   return total_length;
 }
 
+// Serializes the flags octet for a given SpdyHeadersIR.
+uint8_t SerializeHeaderFrameFlags(const SpdyHeadersIR& header_ir,
+                                  const bool end_headers) {
+  uint8_t flags = 0;
+  if (header_ir.fin()) {
+    flags |= CONTROL_FLAG_FIN;
+  }
+  if (end_headers) {
+    flags |= HEADERS_FLAG_END_HEADERS;
+  }
+  if (header_ir.padded()) {
+    flags |= HEADERS_FLAG_PADDED;
+  }
+  if (header_ir.has_priority()) {
+    flags |= HEADERS_FLAG_PRIORITY;
+  }
+  return flags;
+}
+
+// Serializes the flags octet for a given SpdyPushPromiseIR.
+uint8_t SerializePushPromiseFrameFlags(const SpdyPushPromiseIR& push_promise_ir,
+                                       const bool end_headers) {
+  uint8_t flags = 0;
+  if (push_promise_ir.padded()) {
+    flags = flags | PUSH_PROMISE_FLAG_PADDED;
+  }
+  if (end_headers) {
+    flags |= PUSH_PROMISE_FLAG_END_PUSH_PROMISE;
+  }
+  return flags;
+}
+
+// Serializes a HEADERS frame from the given SpdyHeadersIR and encoded header
+// block. Does not need or use the SpdyHeaderBlock inside SpdyHeadersIR.
+// Return false if the serialization fails. |encoding| should not be empty.
+bool SerializeHeadersGivenEncoding(const SpdyHeadersIR& headers,
+                                   const SpdyString& encoding,
+                                   const bool end_headers,
+                                   ZeroCopyOutputBuffer* output) {
+  const size_t frame_size =
+      GetHeaderFrameSizeSansBlock(headers) + encoding.size();
+  SpdyFrameBuilder builder(frame_size, output);
+  bool ret = builder.BeginNewFrame(
+      SpdyFrameType::HEADERS, SerializeHeaderFrameFlags(headers, end_headers),
+      headers.stream_id(), frame_size - kFrameHeaderSize);
+  DCHECK_EQ(kFrameHeaderSize, builder.length());
+
+  if (ret && headers.padded()) {
+    ret &= builder.WriteUInt8(headers.padding_payload_len());
+  }
+
+  if (ret && headers.has_priority()) {
+    int weight = ClampHttp2Weight(headers.weight());
+    ret &= builder.WriteUInt32(PackStreamDependencyValues(
+        headers.exclusive(), headers.parent_stream_id()));
+    // Per RFC 7540 section 6.3, serialized weight value is actual value - 1.
+    ret &= builder.WriteUInt8(weight - 1);
+  }
+
+  if (ret) {
+    ret &= builder.WriteBytes(encoding.data(), encoding.size());
+  }
+
+  if (ret && headers.padding_payload_len() > 0) {
+    SpdyString padding(headers.padding_payload_len(), 0);
+    ret &= builder.WriteBytes(padding.data(), padding.length());
+  }
+
+  if (!ret) {
+    DLOG(WARNING) << "Failed to build HEADERS. Not enough space in output";
+  }
+  return ret;
+}
+
+// Serializes a PUSH_PROMISE frame from the given SpdyPushPromiseIR and
+// encoded header block. Does not need or use the SpdyHeaderBlock inside
+// SpdyPushPromiseIR.
+bool SerializePushPromiseGivenEncoding(const SpdyPushPromiseIR& push_promise,
+                                       const SpdyString& encoding,
+                                       const bool end_headers,
+                                       ZeroCopyOutputBuffer* output) {
+  const size_t frame_size =
+      GetPushPromiseFrameSizeSansBlock(push_promise) + encoding.size();
+  SpdyFrameBuilder builder(frame_size, output);
+  bool ok = builder.BeginNewFrame(
+      SpdyFrameType::PUSH_PROMISE,
+      SerializePushPromiseFrameFlags(push_promise, end_headers),
+      push_promise.stream_id(), frame_size - kFrameHeaderSize);
+
+  if (push_promise.padded()) {
+    ok = ok && builder.WriteUInt8(push_promise.padding_payload_len());
+  }
+  ok = ok && builder.WriteUInt32(push_promise.promised_stream_id()) &&
+       builder.WriteBytes(encoding.data(), encoding.size());
+  if (ok && push_promise.padding_payload_len() > 0) {
+    SpdyString padding(push_promise.padding_payload_len(), 0);
+    ok = builder.WriteBytes(padding.data(), padding.length());
+  }
+
+  DLOG_IF(ERROR, !ok) << "Failed to write PUSH_PROMISE encoding, not enough "
+                      << "space in output";
+  return ok;
+}
+
+bool WritePayloadWithContinuation(SpdyFrameBuilder* builder,
+                                  const SpdyString& hpack_encoding,
+                                  SpdyStreamId stream_id,
+                                  SpdyFrameType type,
+                                  int padding_payload_len) {
+  uint8_t end_flag = 0;
+  uint8_t flags = 0;
+  if (type == SpdyFrameType::HEADERS) {
+    end_flag = HEADERS_FLAG_END_HEADERS;
+  } else if (type == SpdyFrameType::PUSH_PROMISE) {
+    end_flag = PUSH_PROMISE_FLAG_END_PUSH_PROMISE;
+  } else {
+    DLOG(FATAL) << "CONTINUATION frames cannot be used with frame type "
+                << FrameTypeToString(type);
+  }
+
+  // Write all the padding payload and as much of the data payload as possible
+  // into the initial frame.
+  size_t bytes_remaining = 0;
+  bytes_remaining = hpack_encoding.size() -
+                    std::min(hpack_encoding.size(),
+                             SpdyFramer::kMaxControlFrameSendSize -
+                                 builder->length() - padding_payload_len);
+  bool ret = builder->WriteBytes(&hpack_encoding[0],
+                                 hpack_encoding.size() - bytes_remaining);
+  if (padding_payload_len > 0) {
+    SpdyString padding = SpdyString(padding_payload_len, 0);
+    ret &= builder->WriteBytes(padding.data(), padding.length());
+  }
+
+  // Tack on CONTINUATION frames for the overflow.
+  while (bytes_remaining > 0 && ret) {
+    size_t bytes_to_write =
+        std::min(bytes_remaining, SpdyFramer::kMaxControlFrameSendSize -
+                                      kContinuationFrameMinimumSize);
+    // Write CONTINUATION frame prefix.
+    if (bytes_remaining == bytes_to_write) {
+      flags |= end_flag;
+    }
+    ret &= builder->BeginNewFrame(SpdyFrameType::CONTINUATION, flags, stream_id,
+                                  bytes_to_write);
+    // Write payload fragment.
+    ret &= builder->WriteBytes(
+        &hpack_encoding[hpack_encoding.size() - bytes_remaining],
+        bytes_to_write);
+    bytes_remaining -= bytes_to_write;
+  }
+  return ret;
+}
+
+void SerializeDataBuilderHelper(const SpdyDataIR& data_ir,
+                                uint8_t* flags,
+                                int* num_padding_fields,
+                                size_t* size_with_padding) {
+  if (data_ir.fin()) {
+    *flags = DATA_FLAG_FIN;
+  }
+
+  if (data_ir.padded()) {
+    *flags = *flags | DATA_FLAG_PADDED;
+    ++*num_padding_fields;
+  }
+
+  *size_with_padding = *num_padding_fields + data_ir.data_len() +
+                       data_ir.padding_payload_len() + kDataFrameMinimumSize;
+}
+
+void SerializeDataFrameHeaderWithPaddingLengthFieldBuilderHelper(
+    const SpdyDataIR& data_ir,
+    uint8_t* flags,
+    size_t* frame_size,
+    size_t* num_padding_fields) {
+  *flags = DATA_FLAG_NONE;
+  if (data_ir.fin()) {
+    *flags = DATA_FLAG_FIN;
+  }
+
+  *frame_size = kDataFrameMinimumSize;
+  if (data_ir.padded()) {
+    *flags = *flags | DATA_FLAG_PADDED;
+    ++(*num_padding_fields);
+    *frame_size = *frame_size + *num_padding_fields;
+  }
+}
+
+void SerializeSettingsBuilderHelper(const SpdySettingsIR& settings,
+                                    uint8_t* flags,
+                                    const SettingsMap* values,
+                                    size_t* size) {
+  if (settings.is_ack()) {
+    *flags = *flags | SETTINGS_FLAG_ACK;
+  }
+  *size =
+      kSettingsFrameMinimumSize + (values->size() * kOneSettingParameterSize);
+}
+
+void SerializeAltSvcBuilderHelper(const SpdyAltSvcIR& altsvc_ir,
+                                  SpdyString* value,
+                                  size_t* size) {
+  *size = kGetAltSvcFrameMinimumSize;
+  *size = *size + altsvc_ir.origin().length();
+  *value = SpdyAltSvcWireFormat::SerializeHeaderFieldValue(
+      altsvc_ir.altsvc_vector());
+  *size = *size + value->length();
+}
+
+}  // namespace
+
+// Even though the length field is 24 bits, we keep this 16 kB
+// limit on control frame size for legacy reasons and to
+// mitigate DOS attacks.
+const size_t SpdyFramer::kMaxControlFrameSendSize =
+    kHttp2DefaultFramePayloadLimit - 1;
+
+SpdyFramer::SpdyFramer(CompressionOption option)
+    : debug_visitor_(nullptr), compression_option_(option) {
+  static_assert(kMaxControlFrameSendSize <= kHttp2DefaultFrameSizeLimit,
+                "Our send limit should be at most our receive limit.");
+}
+
+SpdyFramer::~SpdyFramer() {}
+
+void SpdyFramer::set_debug_visitor(
+    SpdyFramerDebugVisitorInterface* debug_visitor) {
+  debug_visitor_ = debug_visitor;
+}
 
 SpdyFramer::SpdyFrameIterator::SpdyFrameIterator(SpdyFramer* framer)
     : framer_(framer), is_first_frame_(true), has_next_frame_(true) {}
@@ -139,21 +313,20 @@
   const size_t size_without_block =
       is_first_frame_ ? GetFrameSizeSansBlock() : kContinuationFrameMinimumSize;
   auto encoding = SpdyMakeUnique<SpdyString>();
-  encoder_->Next(kMaxControlFrameSize - size_without_block, encoding.get());
+  encoder_->Next(kMaxControlFrameSendSize - size_without_block, encoding.get());
   has_next_frame_ = encoder_->HasNext();
 
   if (framer_->debug_visitor_ != nullptr) {
     const auto& header_block_frame_ir =
         static_cast<const SpdyFrameWithHeaderBlockIR&>(frame_ir);
-    const size_t header_list_size = framer_->GetUncompressedSerializedLength(
-        header_block_frame_ir.header_block());
+    const size_t header_list_size =
+        GetUncompressedSerializedLength(header_block_frame_ir.header_block());
     framer_->debug_visitor_->OnSendCompressedFrame(
         frame_ir.stream_id(),
         is_first_frame_ ? frame_ir.frame_type() : SpdyFrameType::CONTINUATION,
         header_list_size, size_without_block + encoding->size());
   }
 
-  framer_->SetIsLastFrame(!has_next_frame_);
   const size_t free_bytes_before = output->BytesFree();
   bool ok = false;
   if (is_first_frame_) {
@@ -162,6 +335,7 @@
   } else {
     SpdyContinuationIR continuation_ir(frame_ir.stream_id());
     continuation_ir.take_encoding(std::move(encoding));
+    continuation_ir.set_end_headers(!has_next_frame_);
     ok = framer_->SerializeContinuation(continuation_ir, output);
   }
   return ok ? free_bytes_before - output->BytesFree() : 0;
@@ -176,7 +350,6 @@
     std::unique_ptr<const SpdyHeadersIR> headers_ir)
     : SpdyFrameIterator(framer), headers_ir_(std::move(headers_ir)) {
   SetEncoder(headers_ir_.get());
-  GetFramer()->SetOverwriteLastFrame(true);
 }
 
 SpdyFramer::SpdyHeaderFrameIterator::~SpdyHeaderFrameIterator() {}
@@ -186,14 +359,14 @@
 }
 
 size_t SpdyFramer::SpdyHeaderFrameIterator::GetFrameSizeSansBlock() const {
-  return GetFramer()->GetHeaderFrameSizeSansBlock(*headers_ir_);
+  return GetHeaderFrameSizeSansBlock(*headers_ir_);
 }
 
 bool SpdyFramer::SpdyHeaderFrameIterator::SerializeGivenEncoding(
     const SpdyString& encoding,
     ZeroCopyOutputBuffer* output) const {
-  return GetFramer()->SerializeHeadersGivenEncoding(*headers_ir_, encoding,
-                                                    output);
+  return SerializeHeadersGivenEncoding(*headers_ir_, encoding,
+                                       !has_next_frame(), output);
 }
 
 SpdyFramer::SpdyPushPromiseFrameIterator::SpdyPushPromiseFrameIterator(
@@ -201,7 +374,6 @@
     std::unique_ptr<const SpdyPushPromiseIR> push_promise_ir)
     : SpdyFrameIterator(framer), push_promise_ir_(std::move(push_promise_ir)) {
   SetEncoder(push_promise_ir_.get());
-  GetFramer()->SetOverwriteLastFrame(true);
 }
 
 SpdyFramer::SpdyPushPromiseFrameIterator::~SpdyPushPromiseFrameIterator() {}
@@ -211,14 +383,14 @@
 }
 
 size_t SpdyFramer::SpdyPushPromiseFrameIterator::GetFrameSizeSansBlock() const {
-  return GetFramer()->GetPushPromiseFrameSizeSansBlock(*push_promise_ir_);
+  return GetPushPromiseFrameSizeSansBlock(*push_promise_ir_);
 }
 
 bool SpdyFramer::SpdyPushPromiseFrameIterator::SerializeGivenEncoding(
     const SpdyString& encoding,
     ZeroCopyOutputBuffer* output) const {
-  return GetFramer()->SerializePushPromiseGivenEncoding(*push_promise_ir_,
-                                                        encoding, output);
+  return SerializePushPromiseGivenEncoding(*push_promise_ir_, encoding,
+                                           !has_next_frame(), output);
 }
 
 SpdyFramer::SpdyControlFrameIterator::SpdyControlFrameIterator(
@@ -269,24 +441,7 @@
   }
 }
 
-void SpdyFramer::SerializeDataBuilderHelper(const SpdyDataIR& data_ir,
-                                            uint8_t* flags,
-                                            int* num_padding_fields,
-                                            size_t* size_with_padding) const {
-  if (data_ir.fin()) {
-    *flags = DATA_FLAG_FIN;
-  }
-
-  if (data_ir.padded()) {
-    *flags = *flags | DATA_FLAG_PADDED;
-    ++*num_padding_fields;
-  }
-
-  *size_with_padding = *num_padding_fields + data_ir.data_len() +
-                       data_ir.padding_payload_len() + kDataFrameMinimumSize;
-}
-
-SpdySerializedFrame SpdyFramer::SerializeData(const SpdyDataIR& data_ir) const {
+SpdySerializedFrame SpdyFramer::SerializeData(const SpdyDataIR& data_ir) {
   uint8_t flags = DATA_FLAG_NONE;
   int num_padding_fields = 0;
   size_t size_with_padding = 0;
@@ -294,7 +449,7 @@
                              &size_with_padding);
 
   SpdyFrameBuilder builder(size_with_padding);
-  builder.BeginNewFrame(*this, SpdyFrameType::DATA, flags, data_ir.stream_id());
+  builder.BeginNewFrame(SpdyFrameType::DATA, flags, data_ir.stream_id());
   if (data_ir.padded()) {
     builder.WriteUInt8(data_ir.padding_payload_len() & 0xff);
   }
@@ -307,26 +462,8 @@
   return builder.take();
 }
 
-void SpdyFramer::SerializeDataFrameHeaderWithPaddingLengthFieldBuilderHelper(
-    const SpdyDataIR& data_ir,
-    uint8_t* flags,
-    size_t* frame_size,
-    size_t* num_padding_fields) const {
-  *flags = DATA_FLAG_NONE;
-  if (data_ir.fin()) {
-    *flags = DATA_FLAG_FIN;
-  }
-
-  *frame_size = kDataFrameMinimumSize;
-  if (data_ir.padded()) {
-    *flags = *flags | DATA_FLAG_PADDED;
-    ++(*num_padding_fields);
-    *frame_size = *frame_size + *num_padding_fields;
-  }
-}
-
 SpdySerializedFrame SpdyFramer::SerializeDataFrameHeaderWithPaddingLengthField(
-    const SpdyDataIR& data_ir) const {
+    const SpdyDataIR& data_ir) {
   uint8_t flags = DATA_FLAG_NONE;
   size_t frame_size = 0;
   size_t num_padding_fields = 0;
@@ -335,7 +472,7 @@
 
   SpdyFrameBuilder builder(frame_size);
   builder.BeginNewFrame(
-      *this, SpdyFrameType::DATA, flags, data_ir.stream_id(),
+      SpdyFrameType::DATA, flags, data_ir.stream_id(),
       num_padding_fields + data_ir.data_len() + data_ir.padding_payload_len());
   if (data_ir.padded()) {
     builder.WriteUInt8(data_ir.padding_payload_len() & 0xff);
@@ -349,8 +486,7 @@
   size_t expected_length = kRstStreamFrameSize;
   SpdyFrameBuilder builder(expected_length);
 
-  builder.BeginNewFrame(*this, SpdyFrameType::RST_STREAM, 0,
-                        rst_stream.stream_id());
+  builder.BeginNewFrame(SpdyFrameType::RST_STREAM, 0, rst_stream.stream_id());
 
   builder.WriteUInt32(rst_stream.error_code());
 
@@ -358,17 +494,6 @@
   return builder.take();
 }
 
-void SpdyFramer::SerializeSettingsBuilderHelper(const SpdySettingsIR& settings,
-                                                uint8_t* flags,
-                                                const SettingsMap* values,
-                                                size_t* size) const {
-  if (settings.is_ack()) {
-    *flags = *flags | SETTINGS_FLAG_ACK;
-  }
-  *size =
-      kSettingsFrameMinimumSize + (values->size() * kOneSettingParameterSize);
-}
-
 SpdySerializedFrame SpdyFramer::SerializeSettings(
     const SpdySettingsIR& settings) const {
   uint8_t flags = 0;
@@ -377,7 +502,7 @@
   const SettingsMap* values = &(settings.values());
   SerializeSettingsBuilderHelper(settings, &flags, values, &size);
   SpdyFrameBuilder builder(size);
-  builder.BeginNewFrame(*this, SpdyFrameType::SETTINGS, flags, 0);
+  builder.BeginNewFrame(SpdyFrameType::SETTINGS, flags, 0);
 
   // If this is an ACK, payload should be empty.
   if (settings.is_ack()) {
@@ -402,7 +527,7 @@
   if (ping.is_ack()) {
     flags |= PING_FLAG_ACK;
   }
-  builder.BeginNewFrame(*this, SpdyFrameType::PING, flags, 0);
+  builder.BeginNewFrame(SpdyFrameType::PING, flags, 0);
   builder.WriteUInt64(ping.id());
   DCHECK_EQ(kPingFrameSize, builder.length());
   return builder.take();
@@ -416,7 +541,7 @@
   SpdyFrameBuilder builder(expected_length);
 
   // Serialize the GOAWAY frame.
-  builder.BeginNewFrame(*this, SpdyFrameType::GOAWAY, 0, 0);
+  builder.BeginNewFrame(SpdyFrameType::GOAWAY, 0, 0);
 
   // GOAWAY frames specify the last good stream id.
   builder.WriteUInt32(goaway.last_good_stream_id());
@@ -466,14 +591,14 @@
 
   GetHpackEncoder()->EncodeHeaderSet(headers.header_block(), hpack_encoding);
   *size = *size + hpack_encoding->size();
-  if (*size > kMaxControlFrameSize) {
+  if (*size > kMaxControlFrameSendSize) {
     *size = *size + GetNumberRequiredContinuationFrames(*size) *
                         kContinuationFrameMinimumSize;
     *flags = *flags & ~HEADERS_FLAG_END_HEADERS;
   }
   // Compute frame length field.
   if (headers.padded()) {
-    *length_field = *length_field + 1;  // Padding length field.
+    *length_field = *length_field + kPadLengthFieldSize;
   }
   if (headers.has_priority()) {
     *length_field = *length_field + 4;  // Dependency field.
@@ -485,7 +610,7 @@
   // WritePayloadWithContinuation() will serialize CONTINUATION frames as
   // necessary.
   *length_field =
-      std::min(*length_field, kMaxControlFrameSize - kFrameHeaderSize);
+      std::min(*length_field, kMaxControlFrameSendSize - kFrameHeaderSize);
 }
 
 SpdySerializedFrame SpdyFramer::SerializeHeaders(const SpdyHeadersIR& headers) {
@@ -500,8 +625,8 @@
                                 &weight, &length_field);
 
   SpdyFrameBuilder builder(size);
-  builder.BeginNewFrame(*this, SpdyFrameType::HEADERS, flags,
-                        headers.stream_id(), length_field);
+  builder.BeginNewFrame(SpdyFrameType::HEADERS, flags, headers.stream_id(),
+                        length_field);
 
   DCHECK_EQ(kHeadersFrameMinimumSize, builder.length());
 
@@ -531,9 +656,9 @@
 }
 
 SpdySerializedFrame SpdyFramer::SerializeWindowUpdate(
-    const SpdyWindowUpdateIR& window_update) const {
+    const SpdyWindowUpdateIR& window_update) {
   SpdyFrameBuilder builder(kWindowUpdateFrameSize);
-  builder.BeginNewFrame(*this, SpdyFrameType::WINDOW_UPDATE, kNoFlags,
+  builder.BeginNewFrame(SpdyFrameType::WINDOW_UPDATE, kNoFlags,
                         window_update.stream_id());
   builder.WriteUInt32(window_update.delta());
   DCHECK_EQ(kWindowUpdateFrameSize, builder.length());
@@ -560,7 +685,7 @@
   GetHpackEncoder()->EncodeHeaderSet(push_promise.header_block(),
                                      hpack_encoding);
   *size = *size + hpack_encoding->size();
-  if (*size > kMaxControlFrameSize) {
+  if (*size > kMaxControlFrameSendSize) {
     *size = *size + GetNumberRequiredContinuationFrames(*size) *
                         kContinuationFrameMinimumSize;
     *flags = *flags & ~PUSH_PROMISE_FLAG_END_PUSH_PROMISE;
@@ -576,8 +701,8 @@
                                     &size);
 
   SpdyFrameBuilder builder(size);
-  size_t length = std::min(size, kMaxControlFrameSize) - kFrameHeaderSize;
-  builder.BeginNewFrame(*this, SpdyFrameType::PUSH_PROMISE, flags,
+  size_t length = std::min(size, kMaxControlFrameSendSize) - kFrameHeaderSize;
+  builder.BeginNewFrame(SpdyFrameType::PUSH_PROMISE, flags,
                         push_promise.stream_id(), length);
   int padding_payload_len = 0;
   if (push_promise.padded()) {
@@ -607,54 +732,13 @@
   return builder.take();
 }
 
-bool SpdyFramer::SerializeHeadersGivenEncoding(
-    const SpdyHeadersIR& headers,
-    const SpdyString& encoding,
-    ZeroCopyOutputBuffer* output) const {
-  size_t frame_size = GetHeaderFrameSizeSansBlock(headers) + encoding.size();
-  SpdyFrameBuilder builder(frame_size, output);
-  bool ret = builder.BeginNewFrame(
-      *this, SpdyFrameType::HEADERS, SerializeHeaderFrameFlags(headers),
-      headers.stream_id(), frame_size - kFrameHeaderSize);
-  DCHECK_EQ(kFrameHeaderSize, builder.length());
-
-  if (ret && headers.padded()) {
-    ret &= builder.WriteUInt8(headers.padding_payload_len());
-  }
-
-  if (ret && headers.has_priority()) {
-    int weight = ClampHttp2Weight(headers.weight());
-    ret &= builder.WriteUInt32(PackStreamDependencyValues(
-        headers.exclusive(), headers.parent_stream_id()));
-    // Per RFC 7540 section 6.3, serialized weight value is actual value - 1.
-    ret &= builder.WriteUInt8(weight - 1);
-  }
-
-  if (ret) {
-    ret &= builder.WriteBytes(encoding.data(), encoding.size());
-  }
-
-  if (ret && headers.padding_payload_len() > 0) {
-    SpdyString padding(headers.padding_payload_len(), 0);
-    ret &= builder.WriteBytes(padding.data(), padding.length());
-  }
-
-  if (!ret) {
-    DLOG(WARNING) << "Failed to build HEADERS. Not enough space in output";
-  }
-  return ret;
-}
-
 SpdySerializedFrame SpdyFramer::SerializeContinuation(
     const SpdyContinuationIR& continuation) const {
   const SpdyString& encoding = continuation.encoding();
   size_t frame_size = kContinuationFrameMinimumSize + encoding.size();
   SpdyFrameBuilder builder(frame_size);
-  uint8_t flags = ((overwrite_last_frame_ && is_last_frame_) ||
-                   (!overwrite_last_frame_ && continuation.end_headers()))
-                      ? HEADERS_FLAG_END_HEADERS
-                      : 0;
-  builder.BeginNewFrame(*this, SpdyFrameType::CONTINUATION, flags,
+  uint8_t flags = continuation.end_headers() ? HEADERS_FLAG_END_HEADERS : 0;
+  builder.BeginNewFrame(SpdyFrameType::CONTINUATION, flags,
                         continuation.stream_id());
   DCHECK_EQ(kFrameHeaderSize, builder.length());
 
@@ -662,23 +746,12 @@
   return builder.take();
 }
 
-void SpdyFramer::SerializeAltSvcBuilderHelper(const SpdyAltSvcIR& altsvc_ir,
-                                              SpdyString* value,
-                                              size_t* size) const {
-  *size = kGetAltSvcFrameMinimumSize;
-  *size = *size + altsvc_ir.origin().length();
-  *value = SpdyAltSvcWireFormat::SerializeHeaderFieldValue(
-      altsvc_ir.altsvc_vector());
-  *size = *size + value->length();
-}
-
 SpdySerializedFrame SpdyFramer::SerializeAltSvc(const SpdyAltSvcIR& altsvc_ir) {
   SpdyString value;
   size_t size = 0;
   SerializeAltSvcBuilderHelper(altsvc_ir, &value, &size);
   SpdyFrameBuilder builder(size);
-  builder.BeginNewFrame(*this, SpdyFrameType::ALTSVC, kNoFlags,
-                        altsvc_ir.stream_id());
+  builder.BeginNewFrame(SpdyFrameType::ALTSVC, kNoFlags, altsvc_ir.stream_id());
 
   builder.WriteUInt16(altsvc_ir.origin().length());
   builder.WriteBytes(altsvc_ir.origin().data(), altsvc_ir.origin().length());
@@ -690,7 +763,7 @@
 SpdySerializedFrame SpdyFramer::SerializePriority(
     const SpdyPriorityIR& priority) const {
   SpdyFrameBuilder builder(kPriorityFrameSize);
-  builder.BeginNewFrame(*this, SpdyFrameType::PRIORITY, kNoFlags,
+  builder.BeginNewFrame(SpdyFrameType::PRIORITY, kNoFlags,
                         priority.stream_id());
 
   builder.WriteUInt32(PackStreamDependencyValues(priority.exclusive(),
@@ -705,7 +778,7 @@
     const SpdyUnknownIR& unknown) const {
   const size_t total_size = kFrameHeaderSize + unknown.payload().size();
   SpdyFrameBuilder builder(total_size);
-  builder.BeginNewUncheckedFrame(*this, unknown.type(), unknown.flags(),
+  builder.BeginNewUncheckedFrame(unknown.type(), unknown.flags(),
                                  unknown.stream_id(), unknown.length());
   builder.WriteBytes(unknown.payload().data(), unknown.payload().size());
   return builder.take();
@@ -865,8 +938,8 @@
                              &size_with_padding);
   SpdyFrameBuilder builder(size_with_padding, output);
 
-  bool ok = builder.BeginNewFrame(*this, SpdyFrameType::DATA, flags,
-                                  data_ir.stream_id());
+  bool ok =
+      builder.BeginNewFrame(SpdyFrameType::DATA, flags, data_ir.stream_id());
 
   if (data_ir.padded()) {
     ok = ok && builder.WriteUInt8(data_ir.padding_payload_len() & 0xff);
@@ -893,10 +966,10 @@
 
   SpdyFrameBuilder builder(frame_size, output);
   bool ok = true;
-  ok = ok && builder.BeginNewFrame(*this, SpdyFrameType::DATA, flags,
-                                   data_ir.stream_id(),
-                                   num_padding_fields + data_ir.data_len() +
-                                       data_ir.padding_payload_len());
+  ok = ok &&
+       builder.BeginNewFrame(SpdyFrameType::DATA, flags, data_ir.stream_id(),
+                             num_padding_fields + data_ir.data_len() +
+                                 data_ir.padding_payload_len());
   if (data_ir.padded()) {
     ok = ok && builder.WriteUInt8(data_ir.padding_payload_len() & 0xff);
   }
@@ -908,7 +981,7 @@
                                     ZeroCopyOutputBuffer* output) const {
   size_t expected_length = kRstStreamFrameSize;
   SpdyFrameBuilder builder(expected_length, output);
-  bool ok = builder.BeginNewFrame(*this, SpdyFrameType::RST_STREAM, 0,
+  bool ok = builder.BeginNewFrame(SpdyFrameType::RST_STREAM, 0,
                                   rst_stream.stream_id());
   ok = ok && builder.WriteUInt32(rst_stream.error_code());
 
@@ -924,7 +997,7 @@
   const SettingsMap* values = &(settings.values());
   SerializeSettingsBuilderHelper(settings, &flags, values, &size);
   SpdyFrameBuilder builder(size, output);
-  bool ok = builder.BeginNewFrame(*this, SpdyFrameType::SETTINGS, flags, 0);
+  bool ok = builder.BeginNewFrame(SpdyFrameType::SETTINGS, flags, 0);
 
   // If this is an ACK, payload should be empty.
   if (settings.is_ack()) {
@@ -950,7 +1023,7 @@
   if (ping.is_ack()) {
     flags |= PING_FLAG_ACK;
   }
-  bool ok = builder.BeginNewFrame(*this, SpdyFrameType::PING, flags, 0);
+  bool ok = builder.BeginNewFrame(SpdyFrameType::PING, flags, 0);
   ok = ok && builder.WriteUInt64(ping.id());
   DCHECK_EQ(kPingFrameSize, builder.length());
   return ok;
@@ -964,7 +1037,7 @@
   SpdyFrameBuilder builder(expected_length, output);
 
   // Serialize the GOAWAY frame.
-  bool ok = builder.BeginNewFrame(*this, SpdyFrameType::GOAWAY, 0, 0);
+  bool ok = builder.BeginNewFrame(SpdyFrameType::GOAWAY, 0, 0);
 
   // GOAWAY frames specify the last good stream id.
   ok = ok && builder.WriteUInt32(goaway.last_good_stream_id()) &&
@@ -995,7 +1068,7 @@
 
   bool ok = true;
   SpdyFrameBuilder builder(size, output);
-  ok = ok && builder.BeginNewFrame(*this, SpdyFrameType::HEADERS, flags,
+  ok = ok && builder.BeginNewFrame(SpdyFrameType::HEADERS, flags,
                                    headers.stream_id(), length_field);
   DCHECK_EQ(kHeadersFrameMinimumSize, builder.length());
 
@@ -1029,7 +1102,7 @@
 bool SpdyFramer::SerializeWindowUpdate(const SpdyWindowUpdateIR& window_update,
                                        ZeroCopyOutputBuffer* output) const {
   SpdyFrameBuilder builder(kWindowUpdateFrameSize, output);
-  bool ok = builder.BeginNewFrame(*this, SpdyFrameType::WINDOW_UPDATE, kNoFlags,
+  bool ok = builder.BeginNewFrame(SpdyFrameType::WINDOW_UPDATE, kNoFlags,
                                   window_update.stream_id());
   ok = ok && builder.WriteUInt32(window_update.delta());
   DCHECK_EQ(kWindowUpdateFrameSize, builder.length());
@@ -1046,8 +1119,8 @@
 
   bool ok = true;
   SpdyFrameBuilder builder(size, output);
-  size_t length = std::min(size, kMaxControlFrameSize) - kFrameHeaderSize;
-  ok = builder.BeginNewFrame(*this, SpdyFrameType::PUSH_PROMISE, flags,
+  size_t length = std::min(size, kMaxControlFrameSendSize) - kFrameHeaderSize;
+  ok = builder.BeginNewFrame(SpdyFrameType::PUSH_PROMISE, flags,
                              push_promise.stream_id(), length);
 
   int padding_payload_len = 0;
@@ -1078,43 +1151,13 @@
   return ok;
 }
 
-bool SpdyFramer::SerializePushPromiseGivenEncoding(
-    const SpdyPushPromiseIR& push_promise,
-    const SpdyString& encoding,
-    ZeroCopyOutputBuffer* output) const {
-  size_t const frame_size =
-      GetPushPromiseFrameSizeSansBlock(push_promise) + encoding.size();
-  SpdyFrameBuilder builder(frame_size, output);
-  bool ok = builder.BeginNewFrame(*this, SpdyFrameType::PUSH_PROMISE,
-                                  SerializePushPromiseFrameFlags(push_promise),
-                                  push_promise.stream_id(),
-                                  frame_size - kFrameHeaderSize);
-
-  if (push_promise.padded()) {
-    ok = ok && builder.WriteUInt8(push_promise.padding_payload_len());
-  }
-  ok = ok && builder.WriteUInt32(push_promise.promised_stream_id()) &&
-       builder.WriteBytes(encoding.data(), encoding.size());
-  if (ok && push_promise.padding_payload_len() > 0) {
-    SpdyString padding(push_promise.padding_payload_len(), 0);
-    ok = builder.WriteBytes(padding.data(), padding.length());
-  }
-
-  DLOG_IF(ERROR, !ok) << "Failed to write PUSH_PROMISE encoding, not enough "
-                      << "space in output";
-  return ok;
-}
-
 bool SpdyFramer::SerializeContinuation(const SpdyContinuationIR& continuation,
                                        ZeroCopyOutputBuffer* output) const {
   const SpdyString& encoding = continuation.encoding();
   size_t frame_size = kContinuationFrameMinimumSize + encoding.size();
   SpdyFrameBuilder builder(frame_size, output);
-  uint8_t flags = ((overwrite_last_frame_ && is_last_frame_) ||
-                   (!overwrite_last_frame_ && continuation.end_headers()))
-                      ? HEADERS_FLAG_END_HEADERS
-                      : 0;
-  bool ok = builder.BeginNewFrame(*this, SpdyFrameType::CONTINUATION, flags,
+  uint8_t flags = continuation.end_headers() ? HEADERS_FLAG_END_HEADERS : 0;
+  bool ok = builder.BeginNewFrame(SpdyFrameType::CONTINUATION, flags,
                                   continuation.stream_id(),
                                   frame_size - kFrameHeaderSize);
   DCHECK_EQ(kFrameHeaderSize, builder.length());
@@ -1129,7 +1172,7 @@
   size_t size = 0;
   SerializeAltSvcBuilderHelper(altsvc_ir, &value, &size);
   SpdyFrameBuilder builder(size, output);
-  bool ok = builder.BeginNewFrame(*this, SpdyFrameType::ALTSVC, kNoFlags,
+  bool ok = builder.BeginNewFrame(SpdyFrameType::ALTSVC, kNoFlags,
                                   altsvc_ir.stream_id()) &&
             builder.WriteUInt16(altsvc_ir.origin().length()) &&
             builder.WriteBytes(altsvc_ir.origin().data(),
@@ -1142,7 +1185,7 @@
 bool SpdyFramer::SerializePriority(const SpdyPriorityIR& priority,
                                    ZeroCopyOutputBuffer* output) const {
   SpdyFrameBuilder builder(kPriorityFrameSize, output);
-  bool ok = builder.BeginNewFrame(*this, SpdyFrameType::PRIORITY, kNoFlags,
+  bool ok = builder.BeginNewFrame(SpdyFrameType::PRIORITY, kNoFlags,
                                   priority.stream_id());
   ok = ok &&
        builder.WriteUInt32(PackStreamDependencyValues(
@@ -1157,9 +1200,8 @@
                                   ZeroCopyOutputBuffer* output) const {
   const size_t total_size = kFrameHeaderSize + unknown.payload().size();
   SpdyFrameBuilder builder(total_size, output);
-  bool ok =
-      builder.BeginNewUncheckedFrame(*this, unknown.type(), unknown.flags(),
-                                     unknown.stream_id(), unknown.length());
+  bool ok = builder.BeginNewUncheckedFrame(
+      unknown.type(), unknown.flags(), unknown.stream_id(), unknown.length());
   ok = ok &&
        builder.WriteBytes(unknown.payload().data(), unknown.payload().size());
   return ok;
@@ -1230,125 +1272,14 @@
 }
 
 size_t SpdyFramer::GetNumberRequiredContinuationFrames(size_t size) {
-  DCHECK_GT(size, kMaxControlFrameSize);
-  size_t overflow = size - kMaxControlFrameSize;
-  int payload_size = kMaxControlFrameSize - kContinuationFrameMinimumSize;
+  DCHECK_GT(size, SpdyFramer::kMaxControlFrameSendSize);
+  size_t overflow = size - SpdyFramer::kMaxControlFrameSendSize;
+  int payload_size =
+      SpdyFramer::kMaxControlFrameSendSize - kContinuationFrameMinimumSize;
   // This is ceiling(overflow/payload_size) using integer arithmetics.
   return (overflow - 1) / payload_size + 1;
 }
 
-size_t SpdyFramer::GetHeaderFrameSizeSansBlock(const SpdyHeadersIR& header_ir) {
-  size_t min_size = kFrameHeaderSize;
-
-  if (header_ir.padded()) {
-    min_size += 1;
-    min_size += header_ir.padding_payload_len();
-  }
-
-  if (header_ir.has_priority()) {
-    min_size += 5;
-  }
-
-  return min_size;
-}
-
-size_t SpdyFramer::GetPushPromiseFrameSizeSansBlock(
-    const SpdyPushPromiseIR& push_promise_ir) {
-  size_t size = kPushPromiseFrameMinimumSize;
-
-  if (push_promise_ir.padded()) {
-    size += kPadLengthFieldSize + push_promise_ir.padding_payload_len();
-  }
-
-  return size;
-}
-
-uint8_t SpdyFramer::SerializeHeaderFrameFlags(
-    const SpdyHeadersIR& header_ir) const {
-  uint8_t flags = 0;
-  if (header_ir.fin()) {
-    flags |= CONTROL_FLAG_FIN;
-  }
-
-  if ((overwrite_last_frame_ && is_last_frame_) ||
-      (!overwrite_last_frame_ && header_ir.end_headers())) {
-    flags |= HEADERS_FLAG_END_HEADERS;
-  }
-
-  if (header_ir.padded()) {
-    flags |= HEADERS_FLAG_PADDED;
-  }
-  if (header_ir.has_priority()) {
-    flags |= HEADERS_FLAG_PRIORITY;
-  }
-  return flags;
-}
-
-uint8_t SpdyFramer::SerializePushPromiseFrameFlags(
-    const SpdyPushPromiseIR& push_promise_ir) const {
-  uint8_t flags = 0;
-
-  if (push_promise_ir.padded()) {
-    flags = flags | PUSH_PROMISE_FLAG_PADDED;
-  }
-
-  if ((overwrite_last_frame_ && is_last_frame_) ||
-      (!overwrite_last_frame_ && push_promise_ir.end_headers())) {
-    flags |= PUSH_PROMISE_FLAG_END_PUSH_PROMISE;
-  }
-
-  return flags;
-}
-
-bool SpdyFramer::WritePayloadWithContinuation(SpdyFrameBuilder* builder,
-                                              const SpdyString& hpack_encoding,
-                                              SpdyStreamId stream_id,
-                                              SpdyFrameType type,
-                                              int padding_payload_len) {
-  uint8_t end_flag = 0;
-  uint8_t flags = 0;
-  if (type == SpdyFrameType::HEADERS) {
-    end_flag = HEADERS_FLAG_END_HEADERS;
-  } else if (type == SpdyFrameType::PUSH_PROMISE) {
-    end_flag = PUSH_PROMISE_FLAG_END_PUSH_PROMISE;
-  } else {
-    DLOG(FATAL) << "CONTINUATION frames cannot be used with frame type "
-                << FrameTypeToString(type);
-  }
-
-  // Write all the padding payload and as much of the data payload as possible
-  // into the initial frame.
-  size_t bytes_remaining = 0;
-  bytes_remaining =
-      hpack_encoding.size() -
-      std::min(hpack_encoding.size(),
-               kMaxControlFrameSize - builder->length() - padding_payload_len);
-  bool ret = builder->WriteBytes(&hpack_encoding[0],
-                                 hpack_encoding.size() - bytes_remaining);
-  if (padding_payload_len > 0) {
-    SpdyString padding = SpdyString(padding_payload_len, 0);
-    ret &= builder->WriteBytes(padding.data(), padding.length());
-  }
-
-  // Tack on CONTINUATION frames for the overflow.
-  while (bytes_remaining > 0 && ret) {
-    size_t bytes_to_write = std::min(
-        bytes_remaining, kMaxControlFrameSize - kContinuationFrameMinimumSize);
-    // Write CONTINUATION frame prefix.
-    if (bytes_remaining == bytes_to_write) {
-      flags |= end_flag;
-    }
-    ret &= builder->BeginNewFrame(*this, SpdyFrameType::CONTINUATION, flags,
-                                  stream_id, bytes_to_write);
-    // Write payload fragment.
-    ret &= builder->WriteBytes(
-        &hpack_encoding[hpack_encoding.size() - bytes_remaining],
-        bytes_to_write);
-    bytes_remaining -= bytes_to_write;
-  }
-  return ret;
-}
-
 HpackEncoder* SpdyFramer::GetHpackEncoder() {
   if (hpack_encoder_.get() == nullptr) {
     hpack_encoder_ = SpdyMakeUnique<HpackEncoder>(ObtainHpackHuffmanTable());
@@ -1371,19 +1302,6 @@
   }
 }
 
-void SpdyFramer::SerializeHeaderBlockWithoutCompression(
-    SpdyFrameBuilder* builder,
-    const SpdyHeaderBlock& header_block) const {
-  // Serialize number of headers.
-  builder->WriteUInt32(header_block.size());
-
-  // Serialize each header.
-  for (const auto& header : header_block) {
-    builder->WriteStringPiece32(base::ToLowerASCII(header.first));
-    builder->WriteStringPiece32(header.second);
-  }
-}
-
 void SpdyFramer::SetEncoderHeaderTableDebugVisitor(
     std::unique_ptr<HpackHeaderTable::DebugVisitorInterface> visitor) {
   GetHpackEncoder()->SetHeaderTableDebugVisitor(std::move(visitor));
diff --git a/net/spdy/core/spdy_framer.h b/net/spdy/core/spdy_framer.h
index 88fc7070..38143205 100644
--- a/net/spdy/core/spdy_framer.h
+++ b/net/spdy/core/spdy_framer.h
@@ -28,7 +28,6 @@
 class HttpNetworkLayer;
 class HttpNetworkTransactionTest;
 class HttpProxyClientSocketPoolTest;
-class SpdyFrameBuilder;
 class SpdyHttpStreamTest;
 class SpdyNetworkTransactionTest;
 class SpdyProxyClientSocketTest;
@@ -37,7 +36,6 @@
 
 namespace test {
 
-class TestSpdyVisitor;
 class SpdyFramerPeer;
 class SpdyFramerTest_MultipleContinuationFramesWithIterator_Test;
 class SpdyFramerTest_PushPromiseFramesWithIterator_Test;
@@ -66,31 +64,31 @@
     DISABLE_COMPRESSION,
   };
 
-  // Constant for invalid (or unknown) stream IDs.
-  static const SpdyStreamId kInvalidStream;
-
-  // The maximum size of header data decompressed/delivered at once to the
-  // header block parser. (Exposed here for unit test purposes.)
-  static const size_t kHeaderDataChunkMaxSize;
-
-  void SerializeHeaderBlockWithoutCompression(
-      SpdyFrameBuilder* builder,
-      const SpdyHeaderBlock& header_block) const;
-
-  // Retrieve serialized length of SpdyHeaderBlock.
-  static size_t GetUncompressedSerializedLength(const SpdyHeaderBlock& headers);
+  // Create a SpdyFrameSequence to serialize |frame_ir|.
+  static std::unique_ptr<SpdyFrameSequence> CreateIterator(
+      SpdyFramer* framer,
+      std::unique_ptr<const SpdyFrameIR> frame_ir);
 
   // Gets the serialized flags for the given |frame|.
   static uint8_t GetSerializedFlags(const SpdyFrameIR& frame);
 
-  // Calculates the number of bytes required to serialize a SpdyHeadersIR, not
-  // including the bytes to be used for the encoded header set.
-  static size_t GetHeaderFrameSizeSansBlock(const SpdyHeadersIR& header_ir);
+  // The maximum size of the control frames that we send, including the size of
+  // the header. This limit is arbitrary. We can enforce it here or at the
+  // application layer. We chose the framing layer, but this can be changed (or
+  // removed) if necessary later down the line.
+  static const size_t kMaxControlFrameSendSize;
 
-  // Calculates the number of bytes required to serialize a SpdyPushPromiseIR,
-  // not including the bytes to be used for the encoded header set.
-  static size_t GetPushPromiseFrameSizeSansBlock(
-      const SpdyPushPromiseIR& push_promise_ir);
+  // Serialize a data frame.
+  static SpdySerializedFrame SerializeData(const SpdyDataIR& data_ir);
+  // Serializes the data frame header and optionally padding length fields,
+  // excluding actual data payload and padding.
+  static SpdySerializedFrame SerializeDataFrameHeaderWithPaddingLengthField(
+      const SpdyDataIR& data_ir);
+
+  // Serializes a WINDOW_UPDATE frame. The WINDOW_UPDATE
+  // frame is used to implement per stream flow control.
+  static SpdySerializedFrame SerializeWindowUpdate(
+      const SpdyWindowUpdateIR& window_update);
 
   explicit SpdyFramer(CompressionOption option);
 
@@ -101,18 +99,6 @@
   // If this is called multiple times, only the last visitor will be used.
   void set_debug_visitor(SpdyFramerDebugVisitorInterface* debug_visitor);
 
-  // Create a SpdyFrameSequence to serialize |frame_ir|.
-  static std::unique_ptr<SpdyFrameSequence> CreateIterator(
-      SpdyFramer* framer,
-      std::unique_ptr<const SpdyFrameIR> frame_ir);
-
-  // Serialize a data frame.
-  SpdySerializedFrame SerializeData(const SpdyDataIR& data) const;
-  // Serializes the data frame header and optionally padding length fields,
-  // excluding actual data payload and padding.
-  SpdySerializedFrame SerializeDataFrameHeaderWithPaddingLengthField(
-      const SpdyDataIR& data) const;
-
   SpdySerializedFrame SerializeRstStream(
       const SpdyRstStreamIR& rst_stream) const;
 
@@ -134,11 +120,6 @@
   // for sending headers.
   SpdySerializedFrame SerializeHeaders(const SpdyHeadersIR& headers);
 
-  // Serializes a WINDOW_UPDATE frame. The WINDOW_UPDATE
-  // frame is used to implement per stream flow control.
-  SpdySerializedFrame SerializeWindowUpdate(
-      const SpdyWindowUpdateIR& window_update) const;
-
   // Serializes a PUSH_PROMISE frame. The PUSH_PROMISE frame is used
   // to inform the client that it will be receiving an additional stream
   // in response to the original request. The frame includes synthesized
@@ -243,16 +224,6 @@
     GetHpackEncoder()->SetIndexingPolicy(std::move(policy));
   }
 
-  // Returns the maximum size a frame can be (data or control).
-  size_t GetFrameMaximumSize() const;
-
-  // Returns the maximum payload size of a DATA frame.
-  size_t GetDataFrameMaximumPayload() const;
-
-  SpdyPriority GetLowestPriority() const { return kV3LowestPriority; }
-
-  SpdyPriority GetHighestPriority() const { return kV3HighestPriority; }
-
   // Updates the maximum size of the header encoder compression table.
   void UpdateHeaderEncoderTableSize(uint32_t value);
 
@@ -262,21 +233,12 @@
   // Returns the maximum size of the header encoder compression table.
   size_t header_encoder_table_size() const;
 
-  size_t send_frame_size_limit() const { return send_frame_size_limit_; }
-  void set_send_frame_size_limit(size_t send_frame_size_limit) {
-    send_frame_size_limit_ = send_frame_size_limit;
-  }
-
   void SetEncoderHeaderTableDebugVisitor(
       std::unique_ptr<HpackHeaderTable::DebugVisitorInterface> visitor);
 
   // Get (and lazily initialize) the HPACK encoder state.
   HpackEncoder* GetHpackEncoder();
 
-  void SetOverwriteLastFrame(bool value) { overwrite_last_frame_ = value; }
-  void SetIsLastFrame(bool value) { is_last_frame_ = value; }
-  bool ShouldOverwriteLastFrame() const { return overwrite_last_frame_; }
-
   // Returns the estimate of dynamically allocated memory in bytes.
   size_t EstimateMemoryUsage() const;
 
@@ -290,7 +252,6 @@
   friend class SpdyProxyClientSocketTest;
   friend class SpdySessionTest;
   friend class SpdyStreamTest;
-  friend class test::TestSpdyVisitor;
   friend class test::SpdyFramerPeer;
   friend class test::SpdyFramerTest_MultipleContinuationFramesWithIterator_Test;
   friend class test::SpdyFramerTest_PushPromiseFramesWithIterator_Test;
@@ -329,11 +290,14 @@
                                         ZeroCopyOutputBuffer* output) const = 0;
 
     SpdyFramer* GetFramer() const { return framer_; }
+
     void SetEncoder(const SpdyFrameWithHeaderBlockIR* ir) {
       encoder_ =
           framer_->GetHpackEncoder()->EncodeHeaderSet(ir->header_block());
     }
 
+    bool has_next_frame() const { return has_next_frame_; }
+
    private:
     SpdyFramer* const framer_;
     std::unique_ptr<HpackEncoder::ProgressiveEncoder> encoder_;
@@ -405,61 +369,8 @@
   };
 
  private:
-  size_t GetNumberRequiredContinuationFrames(size_t size);
+  static size_t GetNumberRequiredContinuationFrames(size_t size);
 
-  bool WritePayloadWithContinuation(SpdyFrameBuilder* builder,
-                                    const SpdyString& hpack_encoding,
-                                    SpdyStreamId stream_id,
-                                    SpdyFrameType type,
-                                    int padding_payload_len);
-
-  // Utility to copy the given data block to the current frame buffer, up
-  // to the given maximum number of bytes, and update the buffer
-  // data (pointer and length). Returns the number of bytes
-  // read, and:
-  //   *data is advanced the number of bytes read.
-  //   *len is reduced by the number of bytes read.
-  size_t UpdateCurrentFrameBuffer(const char** data, size_t* len,
-                                  size_t max_bytes);
-
-  // Serializes a HEADERS frame from the given SpdyHeadersIR and encoded header
-  // block. Does not need or use the SpdyHeaderBlock inside SpdyHeadersIR.
-  // Return false if the serialization fails. |encoding| should not be empty.
-  bool SerializeHeadersGivenEncoding(const SpdyHeadersIR& headers,
-                                     const SpdyString& encoding,
-                                     ZeroCopyOutputBuffer* output) const;
-
-  // Serializes a PUSH_PROMISE frame from the given SpdyPushPromiseIR and
-  // encoded header block. Does not need or use the SpdyHeaderBlock inside
-  // SpdyPushPromiseIR.
-  bool SerializePushPromiseGivenEncoding(const SpdyPushPromiseIR& push_promise,
-                                         const SpdyString& encoding,
-                                         ZeroCopyOutputBuffer* output) const;
-
-  // Serializes the flags octet for a given SpdyHeadersIR.
-  uint8_t SerializeHeaderFrameFlags(const SpdyHeadersIR& header_ir) const;
-
-  // Serializes the flags octet for a given SpdyPushPromiseIR.
-  uint8_t SerializePushPromiseFrameFlags(
-      const SpdyPushPromiseIR& push_promise_ir) const;
-
-  // Helper functions to prepare the input for SpdyFrameBuilder.
-  void SerializeDataBuilderHelper(const SpdyDataIR& data_ir,
-                                  uint8_t* flags,
-                                  int* num_padding_fields,
-                                  size_t* size_with_padding) const;
-  void SerializeDataFrameHeaderWithPaddingLengthFieldBuilderHelper(
-      const SpdyDataIR& data_ir,
-      uint8_t* flags,
-      size_t* frame_size,
-      size_t* num_padding_fields) const;
-  void SerializeSettingsBuilderHelper(const SpdySettingsIR& settings,
-                                      uint8_t* flags,
-                                      const SettingsMap* values,
-                                      size_t* size) const;
-  void SerializeAltSvcBuilderHelper(const SpdyAltSvcIR& altsvc_ir,
-                                    SpdyString* value,
-                                    size_t* size) const;
   void SerializeHeadersBuilderHelper(const SpdyHeadersIR& headers,
                                      uint8_t* flags,
                                      size_t* size,
@@ -471,41 +382,12 @@
                                          SpdyString* hpack_encoding,
                                          size_t* size);
 
-  // The size of the control frame buffer.
-  // Since this is only used for control frame headers, the maximum control
-  // frame header size is sufficient; all remaining control
-  // frame data is streamed to the visitor.
-  static const size_t kControlFrameBufferSize;
-
-  // The maximum size of the control frames that we send, including the size of
-  // the header. This limit is arbitrary. We can enforce it here or at the
-  // application layer. We chose the framing layer, but this can be changed (or
-  // removed) if necessary later down the line.
-  // TODO(diannahu): Rename to make it clear that this limit is for sending.
-  static const size_t kMaxControlFrameSize;
-  // The maximum size for the payload of DATA frames to send.
-  static const size_t kMaxDataPayloadSendSize;
-  // The size of one parameter in SETTINGS frame.
-  static const size_t kOneSettingParameterSize;
-
-  // The limit on the size of sent HTTP/2 payloads as specified in the
-  // SETTINGS_MAX_FRAME_SIZE received from peer.
-  size_t send_frame_size_limit_ = kSpdyInitialFrameSizeLimit;
-
   std::unique_ptr<HpackEncoder> hpack_encoder_;
 
   SpdyFramerDebugVisitorInterface* debug_visitor_;
 
   // Determines whether HPACK compression is used.
   const CompressionOption compression_option_;
-
-  // TODO(yasong): Remove overwrite_last_frame_ and is_last_frame_ when we make
-  // Serialize<FrameType>() functions static and independent of SpdyFramer. And
-  // pass the last frame info in the arguments.
-  bool overwrite_last_frame_ = false;
-  // If the current frame to be serialized is the last frame. Will be valid iff
-  // overwrite_last_frame_ is true.
-  bool is_last_frame_ = false;
 };
 
 }  // namespace net
diff --git a/net/spdy/core/spdy_framer_test.cc b/net/spdy/core/spdy_framer_test.cc
index 5c0097d..2b4030f 100644
--- a/net/spdy/core/spdy_framer_test.cc
+++ b/net/spdy/core/spdy_framer_test.cc
@@ -217,9 +217,6 @@
 
 class SpdyFramerPeer {
  public:
-  static size_t ControlFrameBufferSize() {
-    return SpdyFramer::kControlFrameBufferSize;
-  }
   static size_t GetNumberRequiredContinuationFrames(SpdyFramer* framer,
                                                     size_t size) {
     return framer->GetNumberRequiredContinuationFrames(size);
@@ -239,7 +236,6 @@
     if (headers.padded()) {
       new_headers->set_padding_len(headers.padding_payload_len() + 1);
     }
-    new_headers->set_end_headers(headers.end_headers());
     return new_headers;
   }
 
@@ -306,7 +302,6 @@
     if (push_promise.padded()) {
       new_push_promise->set_padding_len(push_promise.padding_payload_len() + 1);
     }
-    new_push_promise->set_end_headers(push_promise.end_headers());
     return new_push_promise;
   }
 
@@ -616,7 +611,6 @@
     header_stream_id_ = stream_id;
     header_control_type_ = header_control_type;
     header_buffer_valid_ = true;
-    DCHECK_NE(header_stream_id_, SpdyFramer::kInvalidStream);
   }
 
   void set_extension_visitor(ExtensionVisitorInterface* extension) {
@@ -629,22 +623,6 @@
     header_buffer_.reset(new char[header_buffer_size]);
   }
 
-  // Largest control frame that the SPDY implementation sends, including the
-  // size of the header.
-  static size_t sent_control_frame_max_size() {
-    return SpdyFramer::kMaxControlFrameSize;
-  }
-
-  // Largest control frame that the SPDY implementation is willing to receive,
-  // excluding the size of the header.
-  static size_t received_control_frame_max_size() {
-    return kSpdyInitialFrameSizeLimit;
-  }
-
-  static size_t header_data_chunk_max_size() {
-    return SpdyFramer::kHeaderDataChunkMaxSize;
-  }
-
   SpdyFramer framer_;
   Http2DecoderAdapter deframer_;
 
@@ -1292,7 +1270,7 @@
   encoder.EncodeHeaderSet(header_set, &buffer);
   // Frame builder with plentiful buffer size.
   SpdyFrameBuilder frame(1024);
-  frame.BeginNewFrame(framer, SpdyFrameType::HEADERS,
+  frame.BeginNewFrame(SpdyFrameType::HEADERS,
                       HEADERS_FLAG_PRIORITY | HEADERS_FLAG_END_HEADERS, 3,
                       buffer.size() + 5 /* priority */);
   frame.WriteUInt32(0);   // Priority exclusivity and dependent stream.
@@ -2582,7 +2560,7 @@
     SpdyPushPromiseIR push_promise(/* stream_id = */ 42,
                                    /* promised_stream_id = */ 57);
     push_promise.set_padding_len(1);
-    SpdyString big_value(TestSpdyVisitor::sent_control_frame_max_size(), 'x');
+    SpdyString big_value(SpdyFramer::kMaxControlFrameSendSize, 'x');
     push_promise.SetHeader("xxx", big_value);
     SpdySerializedFrame frame(SpdyFramerPeer::SerializePushPromise(
         &framer, push_promise, use_output_ ? &output_ : nullptr));
@@ -2604,9 +2582,8 @@
 
     // Length of everything listed above except big_value.
     int len_non_data_payload = 31;
-    EXPECT_EQ(
-        TestSpdyVisitor::sent_control_frame_max_size() + len_non_data_payload,
-        frame.size());
+    EXPECT_EQ(SpdyFramer::kMaxControlFrameSendSize + len_non_data_payload,
+              frame.size());
 
     // Partially compare the PUSH_PROMISE frame against the template.
     const unsigned char* frame_data =
@@ -2616,7 +2593,7 @@
         kPartialPushPromiseFrameData, arraysize(kPartialPushPromiseFrameData));
 
     // Compare the CONTINUATION frame against the template.
-    frame_data += TestSpdyVisitor::sent_control_frame_max_size();
+    frame_data += SpdyFramer::kMaxControlFrameSendSize;
     CompareCharArraysWithHexError(
         kDescription, frame_data, arraysize(kContinuationFrameData),
         kContinuationFrameData, arraysize(kContinuationFrameData));
@@ -2705,7 +2682,7 @@
   const char kDescription[] = "Unknown frame";
   const uint8_t kType = 0x00;
   const uint8_t kFlags = 0x11;
-  const uint8_t kLength = framer_.GetFrameMaximumSize() + 42;
+  const uint8_t kLength = std::numeric_limits<uint8_t>::max();
   const unsigned int kStreamId = kStreamIdMask + 42;
   const unsigned char kFrameData[] = {
       0x00,   0x00, kLength,        // Length: 16426
@@ -2772,13 +2749,12 @@
 
   // Exact payload length will change with HPACK, but this should be long
   // enough to cause an overflow.
-  const size_t kBigValueSize = TestSpdyVisitor::sent_control_frame_max_size();
+  const size_t kBigValueSize = SpdyFramer::kMaxControlFrameSendSize;
   SpdyString big_value(kBigValueSize, 'x');
   headers.SetHeader("aa", big_value);
   SpdySerializedFrame control_frame(SpdyFramerPeer::SerializeHeaders(
       &framer, headers, use_output_ ? &output_ : nullptr));
-  EXPECT_GT(control_frame.size(),
-            TestSpdyVisitor::sent_control_frame_max_size());
+  EXPECT_GT(control_frame.size(), SpdyFramer::kMaxControlFrameSendSize);
 
   TestSpdyVisitor visitor(SpdyFramer::DISABLE_COMPRESSION);
   visitor.SimulateInFramer(
@@ -2798,7 +2774,7 @@
 
   // Exact payload length will change with HPACK, but this should be long
   // enough to cause an overflow.
-  const size_t kBigValueSize = TestSpdyVisitor::sent_control_frame_max_size();
+  const size_t kBigValueSize = SpdyFramer::kMaxControlFrameSendSize;
   SpdyString big_valuex(kBigValueSize, 'x');
   headers->SetHeader("aa", big_valuex);
   SpdyString big_valuez(kBigValueSize, 'z');
@@ -2809,8 +2785,7 @@
   EXPECT_TRUE(frame_it.HasNextFrame());
   EXPECT_GT(frame_it.NextFrame(&output_), 0u);
   SpdySerializedFrame headers_frame(output_.Begin(), output_.Size(), false);
-  EXPECT_EQ(headers_frame.size(),
-            TestSpdyVisitor::sent_control_frame_max_size());
+  EXPECT_EQ(headers_frame.size(), SpdyFramer::kMaxControlFrameSendSize);
 
   TestSpdyVisitor visitor(SpdyFramer::DISABLE_COMPRESSION);
   visitor.SimulateInFramer(
@@ -2826,8 +2801,7 @@
   EXPECT_TRUE(frame_it.HasNextFrame());
   EXPECT_GT(frame_it.NextFrame(&output_), 0u);
   SpdySerializedFrame first_cont_frame(output_.Begin(), output_.Size(), false);
-  EXPECT_EQ(first_cont_frame.size(),
-            TestSpdyVisitor::sent_control_frame_max_size());
+  EXPECT_EQ(first_cont_frame.size(), SpdyFramer::kMaxControlFrameSendSize);
 
   visitor.SimulateInFramer(
       reinterpret_cast<unsigned char*>(first_cont_frame.data()),
@@ -2842,8 +2816,7 @@
   EXPECT_TRUE(frame_it.HasNextFrame());
   EXPECT_GT(frame_it.NextFrame(&output_), 0u);
   SpdySerializedFrame second_cont_frame(output_.Begin(), output_.Size(), false);
-  EXPECT_LT(second_cont_frame.size(),
-            TestSpdyVisitor::sent_control_frame_max_size());
+  EXPECT_LT(second_cont_frame.size(), SpdyFramer::kMaxControlFrameSendSize);
 
   visitor.SimulateInFramer(
       reinterpret_cast<unsigned char*>(second_cont_frame.data()),
@@ -2866,7 +2839,7 @@
 
   // Exact payload length will change with HPACK, but this should be long
   // enough to cause an overflow.
-  const size_t kBigValueSize = TestSpdyVisitor::sent_control_frame_max_size();
+  const size_t kBigValueSize = SpdyFramer::kMaxControlFrameSendSize;
   SpdyString big_valuex(kBigValueSize, 'x');
   push_promise->SetHeader("aa", big_valuex);
   SpdyString big_valuez(kBigValueSize, 'z');
@@ -2879,8 +2852,7 @@
   EXPECT_GT(frame_it.NextFrame(&output_), 0u);
   SpdySerializedFrame push_promise_frame(output_.Begin(), output_.Size(),
                                          false);
-  EXPECT_EQ(push_promise_frame.size(),
-            TestSpdyVisitor::sent_control_frame_max_size());
+  EXPECT_EQ(push_promise_frame.size(), SpdyFramer::kMaxControlFrameSendSize);
 
   TestSpdyVisitor visitor(SpdyFramer::DISABLE_COMPRESSION);
   visitor.SimulateInFramer(
@@ -2897,8 +2869,7 @@
   EXPECT_GT(frame_it.NextFrame(&output_), 0u);
   SpdySerializedFrame first_cont_frame(output_.Begin(), output_.Size(), false);
 
-  EXPECT_EQ(first_cont_frame.size(),
-            TestSpdyVisitor::sent_control_frame_max_size());
+  EXPECT_EQ(first_cont_frame.size(), SpdyFramer::kMaxControlFrameSendSize);
   visitor.SimulateInFramer(
       reinterpret_cast<unsigned char*>(first_cont_frame.data()),
       first_cont_frame.size());
@@ -2912,8 +2883,7 @@
   output_.Reset();
   EXPECT_GT(frame_it.NextFrame(&output_), 0u);
   SpdySerializedFrame second_cont_frame(output_.Begin(), output_.Size(), false);
-  EXPECT_LT(second_cont_frame.size(),
-            TestSpdyVisitor::sent_control_frame_max_size());
+  EXPECT_LT(second_cont_frame.size(), SpdyFramer::kMaxControlFrameSendSize);
 
   visitor.SimulateInFramer(
       reinterpret_cast<unsigned char*>(second_cont_frame.data()),
@@ -2998,13 +2968,12 @@
 
   // Exact payload length will change with HPACK, but this should be long
   // enough to cause an overflow.
-  const size_t kBigValueSize = TestSpdyVisitor::sent_control_frame_max_size();
+  const size_t kBigValueSize = SpdyFramer::kMaxControlFrameSendSize;
   SpdyString big_value(kBigValueSize, 'x');
   push_promise.SetHeader("aa", big_value);
   SpdySerializedFrame control_frame(SpdyFramerPeer::SerializePushPromise(
       &framer, push_promise, use_output_ ? &output_ : nullptr));
-  EXPECT_GT(control_frame.size(),
-            TestSpdyVisitor::sent_control_frame_max_size());
+  EXPECT_GT(control_frame.size(), SpdyFramer::kMaxControlFrameSendSize);
 
   TestSpdyVisitor visitor(SpdyFramer::DISABLE_COMPRESSION);
   visitor.SimulateInFramer(
@@ -3023,7 +2992,7 @@
 TEST_P(SpdyFramerTest, ControlFrameMuchTooLarge) {
   const size_t kHeaderBufferChunks = 4;
   const size_t kHeaderBufferSize =
-      TestSpdyVisitor::header_data_chunk_max_size() * kHeaderBufferChunks;
+      kHttp2DefaultFramePayloadLimit / kHeaderBufferChunks;
   const size_t kBigValueSize = kHeaderBufferSize * 2;
   SpdyString big_value(kBigValueSize, 'x');
   SpdyFramer framer(SpdyFramer::ENABLE_COMPRESSION);
@@ -3045,9 +3014,7 @@
 
 TEST_P(SpdyFramerTest, ControlFrameSizesAreValidated) {
   // Create a GoAway frame that has a few extra bytes at the end.
-  // We create enough overhead to overflow the framer's control frame buffer.
-  ASSERT_LE(SpdyFramerPeer::ControlFrameBufferSize(), 250u);
-  const size_t length = SpdyFramerPeer::ControlFrameBufferSize() + 1;
+  const size_t length = 20;
 
   // HTTP/2 GOAWAY frames are only bound by a minimal length, since they may
   // carry opaque data. Verify that minimal length is tested.
@@ -3125,7 +3092,7 @@
              visitor.deframer_.spdy_framer_error());
 }
 
-// Tests handling of SETTINGS frames larger than the frame buffer size.
+// Tests handling of larger SETTINGS frames.
 TEST_P(SpdyFramerTest, ReadLargeSettingsFrame) {
   SpdySettingsIR settings_ir;
   settings_ir.AddSetting(SETTINGS_HEADER_TABLE_SIZE, 5);
@@ -3138,7 +3105,6 @@
     control_frame = SpdySerializedFrame(output_.Begin(), output_.Size(), false);
   }
 
-  EXPECT_LT(SpdyFramerPeer::ControlFrameBufferSize(), control_frame.size());
   TestSpdyVisitor visitor(SpdyFramer::DISABLE_COMPRESSION);
 
   // Read all at once.
@@ -3874,9 +3840,8 @@
   EXPECT_EQ(11u, kGetAltSvcFrameMinimumSize);
   EXPECT_EQ(9u, kFrameMinimumSize);
 
-  SpdyFramer framer(SpdyFramer::ENABLE_COMPRESSION);
-  EXPECT_EQ(16393u, framer_.GetFrameMaximumSize());
-  EXPECT_EQ(16384u, framer_.GetDataFrameMaximumPayload());
+  EXPECT_EQ(16384u, kHttp2DefaultFramePayloadLimit);
+  EXPECT_EQ(16393u, kHttp2DefaultFrameSizeLimit);
 }
 
 TEST_P(SpdyFramerTest, StateToStringTest) {
diff --git a/net/spdy/core/spdy_protocol.cc b/net/spdy/core/spdy_protocol.cc
index acea3962..e13761b5 100644
--- a/net/spdy/core/spdy_protocol.cc
+++ b/net/spdy/core/spdy_protocol.cc
@@ -420,4 +420,29 @@
   }
 }
 
+// Wire size of pad length field.
+const size_t kPadLengthFieldSize = 1;
+
+size_t GetHeaderFrameSizeSansBlock(const SpdyHeadersIR& header_ir) {
+  size_t min_size = kFrameHeaderSize;
+  if (header_ir.padded()) {
+    min_size += kPadLengthFieldSize;
+    min_size += header_ir.padding_payload_len();
+  }
+  if (header_ir.has_priority()) {
+    min_size += 5;
+  }
+  return min_size;
+}
+
+size_t GetPushPromiseFrameSizeSansBlock(
+    const SpdyPushPromiseIR& push_promise_ir) {
+  size_t min_size = kPushPromiseFrameMinimumSize;
+  if (push_promise_ir.padded()) {
+    min_size += kPadLengthFieldSize;
+    min_size += push_promise_ir.padding_payload_len();
+  }
+  return min_size;
+}
+
 }  // namespace net
diff --git a/net/spdy/core/spdy_protocol.h b/net/spdy/core/spdy_protocol.h
index 6faeecf..4672535 100644
--- a/net/spdy/core/spdy_protocol.h
+++ b/net/spdy/core/spdy_protocol.h
@@ -49,7 +49,15 @@
 
 // The initial value for the maximum frame payload size as per the spec. This is
 // the maximum control frame size we accept.
-const uint32_t kSpdyInitialFrameSizeLimit = 1 << 14;
+const uint32_t kHttp2DefaultFramePayloadLimit = 1 << 14;
+
+// Number of octets in the frame header.
+const size_t kFrameHeaderSize = 9;
+
+// The initial value for the maximum frame payload size as per the spec. This is
+// the maximum control frame size we accept.
+const uint32_t kHttp2DefaultFrameSizeLimit =
+    kHttp2DefaultFramePayloadLimit + kFrameHeaderSize;
 
 // The initial value for the maximum size of the header list, "unlimited" (max
 // unsigned 32-bit int) as per the spec.
@@ -255,9 +263,6 @@
 // for logging/debugging.
 const char* ErrorCodeToString(SpdyErrorCode error_code);
 
-// Number of octets in the frame header.
-const size_t kFrameHeaderSize = 9;
-
 // Minimum size of a frame, in octets.
 const size_t kFrameMinimumSize = kFrameHeaderSize;
 
@@ -460,8 +465,6 @@
   void SetHeader(SpdyStringPiece name, SpdyStringPiece value) {
     header_block_[name] = value;
   }
-  bool end_headers() const { return end_headers_; }
-  void set_end_headers(bool end_headers) { end_headers_ = end_headers; }
 
  protected:
   SpdyFrameWithHeaderBlockIR(SpdyStreamId stream_id,
@@ -469,7 +472,6 @@
 
  private:
   SpdyHeaderBlock header_block_;
-  bool end_headers_ = false;
 
   DISALLOW_COPY_AND_ASSIGN(SpdyFrameWithHeaderBlockIR);
 };
@@ -997,6 +999,15 @@
                                         size_t frame_len) {}
 };
 
+// Calculates the number of bytes required to serialize a SpdyHeadersIR, not
+// including the bytes to be used for the encoded header set.
+size_t GetHeaderFrameSizeSansBlock(const SpdyHeadersIR& header_ir);
+
+// Calculates the number of bytes required to serialize a SpdyPushPromiseIR,
+// not including the bytes to be used for the encoded header set.
+size_t GetPushPromiseFrameSizeSansBlock(
+    const SpdyPushPromiseIR& push_promise_ir);
+
 }  // namespace net
 
 #endif  // NET_SPDY_CORE_SPDY_PROTOCOL_H_
diff --git a/net/ssl/channel_id_service_unittest.cc b/net/ssl/channel_id_service_unittest.cc
index db3160f7..d14edaed 100644
--- a/net/ssl/channel_id_service_unittest.cc
+++ b/net/ssl/channel_id_service_unittest.cc
@@ -360,7 +360,7 @@
 // tasks gracefully fails. This is a regression test for http://crbug.com/236387
 TEST_F(ChannelIDServiceTest, RequestAfterPoolShutdown) {
   service_->set_task_runner_for_testing(
-      make_scoped_refptr(new base::NullTaskRunner()));
+      base::MakeRefCounted<base::NullTaskRunner>());
 
   // Make a request that will force synchronous completion.
   std::string host("encrypted.google.com");
diff --git a/net/ssl/ssl_platform_key_android.cc b/net/ssl/ssl_platform_key_android.cc
index 2c750c74..a67e165 100644
--- a/net/ssl/ssl_platform_key_android.cc
+++ b/net/ssl/ssl_platform_key_android.cc
@@ -205,9 +205,9 @@
     }
   }
 
-  return make_scoped_refptr(new ThreadedSSLPrivateKey(
+  return base::MakeRefCounted<ThreadedSSLPrivateKey>(
       std::make_unique<SSLPlatformKeyAndroid>(type, key, max_length, sys_rsa),
-      GetSSLPlatformKeyTaskRunner()));
+      GetSSLPlatformKeyTaskRunner());
 }
 
 }  // namespace net
diff --git a/net/ssl/ssl_platform_key_mac.cc b/net/ssl/ssl_platform_key_mac.cc
index 4476cc4..41be562 100644
--- a/net/ssl/ssl_platform_key_mac.cc
+++ b/net/ssl/ssl_platform_key_mac.cc
@@ -369,10 +369,10 @@
     return nullptr;
   }
 
-  return make_scoped_refptr(new ThreadedSSLPrivateKey(
+  return base::MakeRefCounted<ThreadedSSLPrivateKey>(
       std::make_unique<SSLPlatformKeyCSSM>(key_type, max_length, private_key,
                                            cssm_key),
-      GetSSLPlatformKeyTaskRunner()));
+      GetSSLPlatformKeyTaskRunner());
 }
 
 }  // namespace
diff --git a/net/ssl/ssl_platform_key_nss.cc b/net/ssl/ssl_platform_key_nss.cc
index c3162f1..d8af54d1 100644
--- a/net/ssl/ssl_platform_key_nss.cc
+++ b/net/ssl/ssl_platform_key_nss.cc
@@ -175,9 +175,9 @@
   if (!GetClientCertInfo(certificate, &type, &max_length))
     return nullptr;
 
-  return make_scoped_refptr(new ThreadedSSLPrivateKey(
+  return base::MakeRefCounted<ThreadedSSLPrivateKey>(
       std::make_unique<SSLPlatformKeyNSS>(type, std::move(key)),
-      GetSSLPlatformKeyTaskRunner()));
+      GetSSLPlatformKeyTaskRunner());
 }
 
 }  // namespace net
diff --git a/net/ssl/ssl_platform_key_win.cc b/net/ssl/ssl_platform_key_win.cc
index 422956a..46df075 100644
--- a/net/ssl/ssl_platform_key_win.cc
+++ b/net/ssl/ssl_platform_key_win.cc
@@ -236,9 +236,9 @@
     const X509Certificate* certificate,
     HCRYPTPROV prov,
     DWORD key_spec) {
-  return make_scoped_refptr(new ThreadedSSLPrivateKey(
+  return base::MakeRefCounted<ThreadedSSLPrivateKey>(
       std::make_unique<SSLPlatformKeyCAPI>(prov, key_spec),
-      GetSSLPlatformKeyTaskRunner()));
+      GetSSLPlatformKeyTaskRunner());
 }
 
 scoped_refptr<SSLPrivateKey> WrapCNGPrivateKey(
@@ -254,9 +254,9 @@
     return nullptr;
   }
 
-  return make_scoped_refptr(new ThreadedSSLPrivateKey(
+  return base::MakeRefCounted<ThreadedSSLPrivateKey>(
       std::make_unique<SSLPlatformKeyCNG>(key, key_type, max_length),
-      GetSSLPlatformKeyTaskRunner()));
+      GetSSLPlatformKeyTaskRunner());
 }
 
 scoped_refptr<SSLPrivateKey> FetchClientCertPrivateKey(
diff --git a/net/ssl/test_ssl_private_key.cc b/net/ssl/test_ssl_private_key.cc
index 38d9d30d..fb03052f 100644
--- a/net/ssl/test_ssl_private_key.cc
+++ b/net/ssl/test_ssl_private_key.cc
@@ -104,9 +104,9 @@
   if (!key)
     return nullptr;
 
-  return make_scoped_refptr(new ThreadedSSLPrivateKey(
+  return base::MakeRefCounted<ThreadedSSLPrivateKey>(
       std::make_unique<TestSSLPlatformKey>(std::move(key)),
-      GetSSLPlatformKeyTaskRunner()));
+      GetSSLPlatformKeyTaskRunner());
 }
 
 scoped_refptr<SSLPrivateKey> WrapRSAPrivateKey(
diff --git a/net/tools/quic/quic_simple_server_stream_test.cc b/net/tools/quic/quic_simple_server_stream_test.cc
index c1add55..052c8cf 100644
--- a/net/tools/quic/quic_simple_server_stream_test.cc
+++ b/net/tools/quic/quic_simple_server_stream_test.cc
@@ -227,7 +227,6 @@
   QuicHttpResponseCache response_cache_;
   StrictMock<MockQuicSimpleServerSession> session_;
   QuicSimpleServerStreamPeer* stream_;  // Owned by session_.
-  string headers_string_;
   string body_;
   QuicHeaderList header_list_;
 };
@@ -525,8 +524,6 @@
   // \000 is a way to write the null byte when followed by a literal digit.
   header_list_.OnHeader("content-length", QuicStringPiece("11\00012", 5));
 
-  headers_string_ = SpdyUtils::SerializeUncompressedHeaders(request_headers);
-
   EXPECT_CALL(session_, WriteHeadersMock(_, _, _, _, _));
   EXPECT_CALL(session_, WritevData(_, _, _, _, _, _))
       .Times(AnyNumber())
@@ -545,8 +542,6 @@
   // \000 is a way to write the null byte when followed by a literal digit.
   header_list_.OnHeader("content-length", QuicStringPiece("\00012", 3));
 
-  headers_string_ = SpdyUtils::SerializeUncompressedHeaders(request_headers);
-
   EXPECT_CALL(session_, WriteHeadersMock(_, _, _, _, _));
   EXPECT_CALL(session_, WritevData(_, _, _, _, _, _))
       .Times(AnyNumber())
@@ -563,8 +558,6 @@
   // \000 is a way to write the null byte when followed by a literal digit.
   header_list_.OnHeader("content-length", QuicStringPiece("11\00011", 5));
 
-  headers_string_ = SpdyUtils::SerializeUncompressedHeaders(request_headers);
-
   stream_->OnStreamHeaderList(false, kFakeFrameLen, header_list_);
 
   EXPECT_EQ(11, QuicSimpleServerStreamPeer::content_length(stream_));
diff --git a/net/url_request/network_error_logging_delegate.cc b/net/url_request/network_error_logging_delegate.cc
index 246b79e3..365e759 100644
--- a/net/url_request/network_error_logging_delegate.cc
+++ b/net/url_request/network_error_logging_delegate.cc
@@ -16,7 +16,6 @@
       protocol(other.protocol),
       status_code(other.status_code),
       elapsed_time(other.elapsed_time),
-      time(other.time),
       type(other.type) {}
 
 NetworkErrorLoggingDelegate::ErrorDetails::~ErrorDetails() {}
diff --git a/net/url_request/network_error_logging_delegate.h b/net/url_request/network_error_logging_delegate.h
index a4c62109..ec2238c 100644
--- a/net/url_request/network_error_logging_delegate.h
+++ b/net/url_request/network_error_logging_delegate.h
@@ -37,15 +37,9 @@
     NextProto protocol;
     int status_code;
     base::TimeDelta elapsed_time;
-    // Used to calculate age.
-    base::TimeTicks time;
     Error type;
   };
 
-  // A callback used to obtain the details of a network error. Should be called
-  // with a pointer to an ErrorDetails struct, and will fill it in.
-  using ErrorDetailsCallback = base::OnceCallback<void(ErrorDetails*)>;
-
   static const char kHeaderName[];
 
   virtual ~NetworkErrorLoggingDelegate();
@@ -69,17 +63,8 @@
 
   // Called when the network stack detects a network error.
   //
-  // |origin| is the origin the network stack was trying to talk to when it
-  // encountered the error.
-  //
-  // |error| is the error the network stack encountered.
-  //
-  // |details_callback| is a callback that will fill in the details of the error
-  // if the delegate wants them (based on |origin| and |error|). If called, it
-  // must be called synchronously, before OnNetworkError returns.
-  virtual void OnNetworkError(const url::Origin& origin,
-                              Error error,
-                              ErrorDetailsCallback details_callback) = 0;
+  // |details| is the details of the network error.
+  virtual void OnNetworkError(const ErrorDetails& details) = 0;
 };
 
 }  // namespace net
diff --git a/net/url_request/url_request_unittest.cc b/net/url_request/url_request_unittest.cc
index 028eb5e..9ced370 100644
--- a/net/url_request/url_request_unittest.cc
+++ b/net/url_request/url_request_unittest.cc
@@ -7143,17 +7143,8 @@
     std::string value;
   };
 
-  struct NetworkError {
-    NetworkError() {}
-    ~NetworkError() {}
-
-    url::Origin origin;
-    Error error;
-    NetworkErrorLoggingDelegate::ErrorDetails details;
-  };
-
   const std::vector<Header>& headers() { return headers_; }
-  const std::vector<NetworkError>& errors() { return errors_; }
+  const std::vector<ErrorDetails>& errors() { return errors_; }
 
   // NetworkErrorLoggingDelegate implementation:
 
@@ -7170,19 +7161,13 @@
     headers_.push_back(header);
   }
 
-  void OnNetworkError(const url::Origin& origin,
-                      Error error,
-                      ErrorDetailsCallback details_callback) override {
-    NetworkError network_error;
-    network_error.origin = origin;
-    network_error.error = error;
-    std::move(details_callback).Run(&network_error.details);
-    errors_.push_back(network_error);
+  void OnNetworkError(const ErrorDetails& details) override {
+    errors_.push_back(details);
   }
 
  private:
   std::vector<Header> headers_;
-  std::vector<NetworkError> errors_;
+  std::vector<ErrorDetails> errors_;
 };
 
 std::unique_ptr<test_server::HttpResponse> SendNelHeader(
diff --git a/ppapi/host/resource_message_filter.h b/ppapi/host/resource_message_filter.h
index 31b469c..42658ea 100644
--- a/ppapi/host/resource_message_filter.h
+++ b/ppapi/host/resource_message_filter.h
@@ -71,7 +71,7 @@
 // }
 //
 // The filter should then be added in the resource host using:
-// AddFilter(make_scoped_refptr(new MyMessageFilter));
+// AddFilter(base::MakeRefCounted<MyMessageFilter>());
 class PPAPI_HOST_EXPORT ResourceMessageFilter
     : public ResourceMessageHandler,
       public base::RefCountedThreadSafe<
diff --git a/printing/backend/print_backend_chromeos.cc b/printing/backend/print_backend_chromeos.cc
index 02b082d..c248d481 100644
--- a/printing/backend/print_backend_chromeos.cc
+++ b/printing/backend/print_backend_chromeos.cc
@@ -110,7 +110,7 @@
   return make_scoped_refptr(
       new PrintBackendCupsIpp(CreateConnection(print_backend_settings)));
 #else
-  return make_scoped_refptr(new PrintBackendChromeOS());
+  return base::MakeRefCounted<PrintBackendChromeOS>();
 #endif  // defined(USE_CUPS)
 }
 
diff --git a/services/preferences/persistent_pref_store_impl_unittest.cc b/services/preferences/persistent_pref_store_impl_unittest.cc
index a3daac3..c7584a9 100644
--- a/services/preferences/persistent_pref_store_impl_unittest.cc
+++ b/services/preferences/persistent_pref_store_impl_unittest.cc
@@ -85,8 +85,8 @@
           PersistentPrefStoreImpl::ObservedPrefs()) {
     if (observed_prefs.empty())
       observed_prefs.insert({kKey, kOtherKey});
-    return make_scoped_refptr(new PersistentPrefStoreClient(
-        impl_->CreateConnection(std::move(observed_prefs))));
+    return base::MakeRefCounted<PersistentPrefStoreClient>(
+        impl_->CreateConnection(std::move(observed_prefs)));
   }
 
   PersistentPrefStore* pref_store() { return pref_store_.get(); }
@@ -105,7 +105,7 @@
   constexpr char kUnregisteredKey[] = "path.to.unregistered_key";
   constexpr char kUnregisteredTopLevelKey[] = "unregistered_key";
   constexpr char kUnregisteredPrefixKey[] = "p";
-  auto backing_pref_store = make_scoped_refptr(new InMemoryPrefStore());
+  auto backing_pref_store = base::MakeRefCounted<InMemoryPrefStore>();
   const base::Value value("value");
   backing_pref_store->SetValue(kKey, value.CreateDeepCopy(), 0);
   backing_pref_store->SetValue(kUnregisteredKey, value.CreateDeepCopy(), 0);
@@ -125,7 +125,7 @@
 }
 
 TEST_F(PersistentPrefStoreImplTest, InitialValueWithoutPathExpansion) {
-  auto backing_pref_store = make_scoped_refptr(new InMemoryPrefStore());
+  auto backing_pref_store = base::MakeRefCounted<InMemoryPrefStore>();
   base::DictionaryValue dict;
   dict.SetKey(kKey, base::Value("value"));
   backing_pref_store->SetValue(kKey, dict.CreateDeepCopy(), 0);
@@ -137,7 +137,7 @@
 }
 
 TEST_F(PersistentPrefStoreImplTest, WriteObservedByOtherClient) {
-  auto backing_pref_store = make_scoped_refptr(new InMemoryPrefStore());
+  auto backing_pref_store = base::MakeRefCounted<InMemoryPrefStore>();
   CreateImpl(backing_pref_store);
   EXPECT_TRUE(pref_store()->IsInitializationComplete());
 
@@ -154,7 +154,7 @@
 }
 
 TEST_F(PersistentPrefStoreImplTest, UnregisteredPrefNotObservedByOtherClient) {
-  auto backing_pref_store = make_scoped_refptr(new InMemoryPrefStore());
+  auto backing_pref_store = base::MakeRefCounted<InMemoryPrefStore>();
   CreateImpl(backing_pref_store);
   EXPECT_TRUE(pref_store()->IsInitializationComplete());
 
@@ -173,7 +173,7 @@
 
 TEST_F(PersistentPrefStoreImplTest,
        WriteWithoutPathExpansionObservedByOtherClient) {
-  auto backing_pref_store = make_scoped_refptr(new InMemoryPrefStore());
+  auto backing_pref_store = base::MakeRefCounted<InMemoryPrefStore>();
   CreateImpl(backing_pref_store);
   EXPECT_TRUE(pref_store()->IsInitializationComplete());
 
@@ -191,7 +191,7 @@
 }
 
 TEST_F(PersistentPrefStoreImplTest, RemoveObservedByOtherClient) {
-  auto backing_pref_store = make_scoped_refptr(new InMemoryPrefStore());
+  auto backing_pref_store = base::MakeRefCounted<InMemoryPrefStore>();
   const base::Value value("value");
   backing_pref_store->SetValue(kKey, value.CreateDeepCopy(), 0);
   CreateImpl(backing_pref_store);
@@ -215,7 +215,7 @@
 
 TEST_F(PersistentPrefStoreImplTest,
        RemoveWithoutPathExpansionObservedByOtherClient) {
-  auto backing_pref_store = make_scoped_refptr(new InMemoryPrefStore());
+  auto backing_pref_store = base::MakeRefCounted<InMemoryPrefStore>();
   base::DictionaryValue dict;
   dict.SetKey(kKey, base::Value("value"));
   backing_pref_store->SetValue(kKey, dict.CreateDeepCopy(), 0);
@@ -245,7 +245,7 @@
 }
 
 TEST_F(PersistentPrefStoreImplTest, CommitPendingWrite) {
-  auto backing_store = make_scoped_refptr(new PersistentPrefStoreMock);
+  auto backing_store = base::MakeRefCounted<PersistentPrefStoreMock>();
   CreateImpl(backing_store);
   base::RunLoop run_loop;
   EXPECT_CALL(*backing_store, CommitPendingWriteMock()).Times(2);
@@ -254,7 +254,7 @@
 }
 
 TEST_F(PersistentPrefStoreImplTest, SchedulePendingLossyWrites) {
-  auto backing_store = make_scoped_refptr(new PersistentPrefStoreMock);
+  auto backing_store = base::MakeRefCounted<PersistentPrefStoreMock>();
   CreateImpl(backing_store);
   base::RunLoop run_loop;
   EXPECT_CALL(*backing_store, SchedulePendingLossyWrites())
@@ -265,7 +265,7 @@
 }
 
 TEST_F(PersistentPrefStoreImplTest, ClearMutableValues) {
-  auto backing_store = make_scoped_refptr(new PersistentPrefStoreMock);
+  auto backing_store = base::MakeRefCounted<PersistentPrefStoreMock>();
   CreateImpl(backing_store);
   base::RunLoop run_loop;
   EXPECT_CALL(*backing_store, ClearMutableValues())
diff --git a/services/preferences/pref_store_impl_unittest.cc b/services/preferences/pref_store_impl_unittest.cc
index 3f20233e..80bdb70 100644
--- a/services/preferences/pref_store_impl_unittest.cc
+++ b/services/preferences/pref_store_impl_unittest.cc
@@ -132,7 +132,7 @@
 };
 
 TEST_F(PrefStoreImplTest, InitializationSuccess) {
-  auto backing_pref_store = make_scoped_refptr(new MockPrefStore());
+  auto backing_pref_store = base::MakeRefCounted<MockPrefStore>();
   backing_pref_store->SetValue(kKey, base::MakeUnique<base::Value>("value"), 0);
   CreateImpl(backing_pref_store);
   EXPECT_FALSE(pref_store()->IsInitializationComplete());
@@ -143,7 +143,7 @@
 }
 
 TEST_F(PrefStoreImplTest, InitializationFailure) {
-  auto backing_pref_store = make_scoped_refptr(new MockPrefStore());
+  auto backing_pref_store = base::MakeRefCounted<MockPrefStore>();
   backing_pref_store->SetValue(kKey, base::MakeUnique<base::Value>("value"), 0);
   CreateImpl(backing_pref_store);
   EXPECT_FALSE(pref_store()->IsInitializationComplete());
@@ -156,7 +156,7 @@
 }
 
 TEST_F(PrefStoreImplTest, ValueChangesBeforeInitializationCompletes) {
-  auto backing_pref_store = make_scoped_refptr(new MockPrefStore());
+  auto backing_pref_store = base::MakeRefCounted<MockPrefStore>();
   CreateImpl(backing_pref_store);
   EXPECT_FALSE(pref_store()->IsInitializationComplete());
 
@@ -176,7 +176,7 @@
 }
 
 TEST_F(PrefStoreImplTest, InitialValue) {
-  auto backing_pref_store = make_scoped_refptr(new ValueMapPrefStore());
+  auto backing_pref_store = base::MakeRefCounted<ValueMapPrefStore>();
   const base::Value value("value");
   backing_pref_store->SetValue(kKey, value.CreateDeepCopy(), 0);
   CreateImpl(backing_pref_store);
@@ -187,7 +187,7 @@
 }
 
 TEST_F(PrefStoreImplTest, InitialValueWithoutPathExpansion) {
-  auto backing_pref_store = make_scoped_refptr(new ValueMapPrefStore());
+  auto backing_pref_store = base::MakeRefCounted<ValueMapPrefStore>();
   base::DictionaryValue dict;
   dict.SetKey(kKey, base::Value("value"));
   backing_pref_store->SetValue(kKey, dict.CreateDeepCopy(), 0);
@@ -199,7 +199,7 @@
 }
 
 TEST_F(PrefStoreImplTest, WriteObservedByClient) {
-  auto backing_pref_store = make_scoped_refptr(new ValueMapPrefStore());
+  auto backing_pref_store = base::MakeRefCounted<ValueMapPrefStore>();
   CreateImpl(backing_pref_store);
   ASSERT_TRUE(pref_store()->IsInitializationComplete());
 
@@ -213,7 +213,7 @@
 }
 
 TEST_F(PrefStoreImplTest, WriteToUnregisteredPrefNotObservedByClient) {
-  auto backing_pref_store = make_scoped_refptr(new ValueMapPrefStore());
+  auto backing_pref_store = base::MakeRefCounted<ValueMapPrefStore>();
   CreateImpl(backing_pref_store, {kKey});
   ASSERT_TRUE(pref_store()->IsInitializationComplete());
 
@@ -226,7 +226,7 @@
 }
 
 TEST_F(PrefStoreImplTest, WriteWithoutPathExpansionObservedByClient) {
-  auto backing_pref_store = make_scoped_refptr(new ValueMapPrefStore());
+  auto backing_pref_store = base::MakeRefCounted<ValueMapPrefStore>();
   CreateImpl(backing_pref_store);
   ASSERT_TRUE(pref_store()->IsInitializationComplete());
 
@@ -241,7 +241,7 @@
 }
 
 TEST_F(PrefStoreImplTest, RemoveObservedByClient) {
-  auto backing_pref_store = make_scoped_refptr(new ValueMapPrefStore());
+  auto backing_pref_store = base::MakeRefCounted<ValueMapPrefStore>();
   const base::Value value("value");
   backing_pref_store->SetValue(kKey, value.CreateDeepCopy(), 0);
   CreateImpl(backing_pref_store);
@@ -261,7 +261,7 @@
 }
 
 TEST_F(PrefStoreImplTest, RemoveOfUnregisteredPrefNotObservedByClient) {
-  auto backing_pref_store = make_scoped_refptr(new ValueMapPrefStore());
+  auto backing_pref_store = base::MakeRefCounted<ValueMapPrefStore>();
   const base::Value value("value");
   backing_pref_store->SetValue(kKey, value.CreateDeepCopy(), 0);
   backing_pref_store->SetValue(kOtherKey, value.CreateDeepCopy(), 0);
@@ -275,7 +275,7 @@
 }
 
 TEST_F(PrefStoreImplTest, RemoveWithoutPathExpansionObservedByOtherClient) {
-  auto backing_pref_store = make_scoped_refptr(new ValueMapPrefStore());
+  auto backing_pref_store = base::MakeRefCounted<ValueMapPrefStore>();
   base::DictionaryValue dict;
   dict.SetKey(kKey, base::Value("value"));
   backing_pref_store->SetValue(kKey, dict.CreateDeepCopy(), 0);
diff --git a/services/preferences/public/cpp/tests/persistent_pref_store_client_unittest.cc b/services/preferences/public/cpp/tests/persistent_pref_store_client_unittest.cc
index 9582c38..f832a83 100644
--- a/services/preferences/public/cpp/tests/persistent_pref_store_client_unittest.cc
+++ b/services/preferences/public/cpp/tests/persistent_pref_store_client_unittest.cc
@@ -45,7 +45,7 @@
                 base::MakeUnique<base::DictionaryValue>(), true),
             std::move(store_proxy), ::PersistentPrefStore::PREF_READ_ERROR_NONE,
             false)));
-    auto pref_registry = make_scoped_refptr(new PrefRegistrySimple());
+    auto pref_registry = base::MakeRefCounted<PrefRegistrySimple>();
     pref_registry->RegisterDictionaryPref(kDictionaryKey);
     pref_registry->RegisterDictionaryPref(kUninitializedDictionaryKey);
     PrefNotifierImpl* pref_notifier = new PrefNotifierImpl;
diff --git a/services/preferences/public/cpp/tests/pref_store_client_unittest.cc b/services/preferences/public/cpp/tests/pref_store_client_unittest.cc
index 8952cbf5..90cf119d 100644
--- a/services/preferences/public/cpp/tests/pref_store_client_unittest.cc
+++ b/services/preferences/public/cpp/tests/pref_store_client_unittest.cc
@@ -171,8 +171,8 @@
   auto prefs = base::MakeUnique<base::DictionaryValue>();
   prefs->Set(key, pref.CreateDeepCopy());
   auto store =
-      make_scoped_refptr(new PrefStoreClient(mojom::PrefStoreConnection::New(
-          mojo::MakeRequest(&observer_ptr), std::move(prefs), true)));
+      base::MakeRefCounted<PrefStoreClient>(mojom::PrefStoreConnection::New(
+          mojo::MakeRequest(&observer_ptr), std::move(prefs), true));
   store->AddObserver(&observer);
 
   const base::Value* value = nullptr;
diff --git a/services/ui/common/task_runner_test_base.cc b/services/ui/common/task_runner_test_base.cc
index f132ba9..1e1b133 100644
--- a/services/ui/common/task_runner_test_base.cc
+++ b/services/ui/common/task_runner_test_base.cc
@@ -23,8 +23,8 @@
 }
 
 void TaskRunnerTestBase::SetUp() {
-  task_runner_ = make_scoped_refptr(new base::TestMockTimeTaskRunner(
-      base::Time::Now(), base::TimeTicks::Now()));
+  task_runner_ = base::MakeRefCounted<base::TestMockTimeTaskRunner>(
+      base::Time::Now(), base::TimeTicks::Now());
   message_loop_.SetTaskRunner(task_runner_);
 }
 
diff --git a/services/ui/input_devices/input_device_unittests.cc b/services/ui/input_devices/input_device_unittests.cc
index 48f6a58..6fea3da 100644
--- a/services/ui/input_devices/input_device_unittests.cc
+++ b/services/ui/input_devices/input_device_unittests.cc
@@ -54,8 +54,8 @@
 
   // testing::Test:
   void SetUp() override {
-    task_runner_ = make_scoped_refptr(new base::TestMockTimeTaskRunner(
-        base::Time::Now(), base::TimeTicks::Now()));
+    task_runner_ = base::MakeRefCounted<base::TestMockTimeTaskRunner>(
+        base::Time::Now(), base::TimeTicks::Now());
     message_loop_.SetTaskRunner(task_runner_);
 
     DeviceDataManager::CreateInstance();
diff --git a/services/ui/public/cpp/gpu/gpu.cc b/services/ui/public/cpp/gpu/gpu.cc
index fefcc03..4cf9938d 100644
--- a/services/ui/public/cpp/gpu/gpu.cc
+++ b/services/ui/public/cpp/gpu/gpu.cc
@@ -83,11 +83,11 @@
   attributes.bind_generates_resource = false;
   attributes.lose_context_when_out_of_memory = true;
   ui::ContextProviderCommandBuffer* shared_context_provider = nullptr;
-  return make_scoped_refptr(new ui::ContextProviderCommandBuffer(
+  return base::MakeRefCounted<ui::ContextProviderCommandBuffer>(
       std::move(gpu_channel), stream_id, stream_priority,
       gpu::kNullSurfaceHandle, GURL("chrome://gpu/MusContextFactory"),
       automatic_flushes, support_locking, gpu::SharedMemoryLimits(), attributes,
-      shared_context_provider, ui::command_buffer_metrics::MUS_CLIENT_CONTEXT));
+      shared_context_provider, ui::command_buffer_metrics::MUS_CLIENT_CONTEXT);
 }
 
 void Gpu::CreateJpegDecodeAccelerator(
diff --git a/sql/connection.cc b/sql/connection.cc
index 9d55b8b..22259912 100644
--- a/sql/connection.cc
+++ b/sql/connection.cc
@@ -97,7 +97,7 @@
   if (!backup) {
     // Since this call only sets things up, this indicates a gross
     // error in SQLite.
-    DLOG(FATAL) << "Unable to start sqlite3_backup(): " << sqlite3_errmsg(dst);
+    DLOG(DCHECK) << "Unable to start sqlite3_backup(): " << sqlite3_errmsg(dst);
     return sqlite3_errcode(dst);
   }
 
@@ -466,7 +466,7 @@
     int rc = sqlite3_close(db_);
     if (rc != SQLITE_OK) {
       UMA_HISTOGRAM_SPARSE_SLOWLY("Sqlite.CloseFailure", rc);
-      DLOG(FATAL) << "sqlite3_close failed: " << GetErrorMessage();
+      DLOG(DCHECK) << "sqlite3_close failed: " << GetErrorMessage();
     }
   }
   db_ = NULL;
@@ -488,7 +488,7 @@
   AssertIOAllowed();
 
   if (!db_) {
-    DLOG_IF(FATAL, !poisoned_) << "Cannot preload null db";
+    DCHECK(poisoned_) << "Cannot preload null db";
     return;
   }
 
@@ -565,7 +565,7 @@
   // The database could have been closed during a transaction as part of error
   // recovery.
   if (!db_) {
-    DLOG_IF(FATAL, !poisoned_) << "Illegal use of connection without a db";
+    DCHECK(poisoned_) << "Illegal use of connection without a db";
     return;
   }
 
@@ -1054,18 +1054,18 @@
   AssertIOAllowed();
 
   if (!db_) {
-    DLOG_IF(FATAL, !poisoned_) << "Cannot raze null db";
+    DCHECK(poisoned_) << "Cannot raze null db";
     return false;
   }
 
   if (transaction_nesting_ > 0) {
-    DLOG(FATAL) << "Cannot raze within a transaction";
+    DLOG(DCHECK) << "Cannot raze within a transaction";
     return false;
   }
 
   sql::Connection null_db;
   if (!null_db.OpenInMemory()) {
-    DLOG(FATAL) << "Unable to open in-memory database.";
+    DLOG(DCHECK) << "Unable to open in-memory database.";
     return false;
   }
 
@@ -1141,38 +1141,33 @@
     sqlite3_file* file = NULL;
     rc = GetSqlite3File(db_, &file);
     if (rc != SQLITE_OK) {
-      DLOG(FATAL) << "Failure getting file handle.";
+      DLOG(DCHECK) << "Failure getting file handle.";
       return false;
     }
 
     rc = file->pMethods->xTruncate(file, 0);
     if (rc != SQLITE_OK) {
       UMA_HISTOGRAM_SPARSE_SLOWLY("Sqlite.RazeDatabaseTruncate",rc);
-      DLOG(FATAL) << "Failed to truncate file.";
+      DLOG(DCHECK) << "Failed to truncate file.";
       return false;
     }
 
     rc = BackupDatabase(null_db.db_, db_, kMain);
     UMA_HISTOGRAM_SPARSE_SLOWLY("Sqlite.RazeDatabase2",rc);
 
-    if (rc != SQLITE_DONE) {
-      DLOG(FATAL) << "Failed retrying Raze().";
-    }
+    DCHECK_EQ(rc, SQLITE_DONE) << "Failed retrying Raze().";
   }
 
+  // TODO(shess): Figure out which other cases can happen.
+  DCHECK_EQ(rc, SQLITE_DONE) << "Unable to copy entire null database.";
+
   // The entire database should have been backed up.
-  if (rc != SQLITE_DONE) {
-    // TODO(shess): Figure out which other cases can happen.
-    DLOG(FATAL) << "Unable to copy entire null database.";
-    return false;
-  }
-
-  return true;
+  return rc == SQLITE_DONE;
 }
 
 bool Connection::RazeAndClose() {
   if (!db_) {
-    DLOG_IF(FATAL, !poisoned_) << "Cannot raze null db";
+    DCHECK(poisoned_) << "Cannot raze null db";
     return false;
   }
 
@@ -1193,7 +1188,7 @@
 
 void Connection::Poison() {
   if (!db_) {
-    DLOG_IF(FATAL, !poisoned_) << "Cannot poison null db";
+    DCHECK(poisoned_) << "Cannot poison null db";
     return;
   }
 
@@ -1284,7 +1279,7 @@
 
 void Connection::RollbackTransaction() {
   if (!transaction_nesting_) {
-    DLOG_IF(FATAL, !poisoned_) << "Rolling back a nonexistent transaction";
+    DCHECK(poisoned_) << "Rolling back a nonexistent transaction";
     return;
   }
 
@@ -1301,7 +1296,7 @@
 
 bool Connection::CommitTransaction() {
   if (!transaction_nesting_) {
-    DLOG_IF(FATAL, !poisoned_) << "Committing a nonexistent transaction";
+    DCHECK(poisoned_) << "Committing a nonexistent transaction";
     return false;
   }
   transaction_nesting_--;
@@ -1368,7 +1363,7 @@
 int Connection::ExecuteAndReturnErrorCode(const char* sql) {
   AssertIOAllowed();
   if (!db_) {
-    DLOG_IF(FATAL, !poisoned_) << "Illegal use of connection without a db";
+    DCHECK(poisoned_) << "Illegal use of connection without a db";
     return SQLITE_ERROR;
   }
   DCHECK(sql);
@@ -1431,7 +1426,7 @@
 
 bool Connection::Execute(const char* sql) {
   if (!db_) {
-    DLOG_IF(FATAL, !poisoned_) << "Illegal use of connection without a db";
+    DCHECK(poisoned_) << "Illegal use of connection without a db";
     return false;
   }
 
@@ -1443,14 +1438,14 @@
   // that there's a malformed SQL statement. This can arise in development if
   // a change alters the schema but not all queries adjust.  This can happen
   // in production if the schema is corrupted.
-  if (error == SQLITE_ERROR)
-    DLOG(FATAL) << "SQL Error in " << sql << ", " << GetErrorMessage();
+  DCHECK_NE(error, SQLITE_ERROR)
+      << "SQL Error in " << sql << ", " << GetErrorMessage();
   return error == SQLITE_OK;
 }
 
 bool Connection::ExecuteWithTimeout(const char* sql, base::TimeDelta timeout) {
   if (!db_) {
-    DLOG_IF(FATAL, !poisoned_) << "Illegal use of connection without a db";
+    DCHECK(poisoned_) << "Illegal use of connection without a db";
     return false;
   }
 
@@ -1502,8 +1497,7 @@
   int rc = sqlite3_prepare_v2(db_, sql, -1, &stmt, NULL);
   if (rc != SQLITE_OK) {
     // This is evidence of a syntax error in the incoming SQL.
-    if (rc == SQLITE_ERROR)
-      DLOG(FATAL) << "SQL compile error " << GetErrorMessage();
+    DCHECK_NE(rc, SQLITE_ERROR) << "SQL compile error " << GetErrorMessage();
 
     // It could also be database corruption.
     OnSqliteError(rc, NULL, sql);
@@ -1543,7 +1537,7 @@
 bool Connection::IsSQLValid(const char* sql) {
   AssertIOAllowed();
   if (!db_) {
-    DLOG_IF(FATAL, !poisoned_) << "Illegal use of connection without a db";
+    DCHECK(poisoned_) << "Illegal use of connection without a db";
     return false;
   }
 
@@ -1607,7 +1601,7 @@
 
 int64_t Connection::GetLastInsertRowId() const {
   if (!db_) {
-    DLOG_IF(FATAL, !poisoned_) << "Illegal use of connection without a db";
+    DCHECK(poisoned_) << "Illegal use of connection without a db";
     return 0;
   }
   return sqlite3_last_insert_rowid(db_);
@@ -1615,7 +1609,7 @@
 
 int Connection::GetLastChangeCount() const {
   if (!db_) {
-    DLOG_IF(FATAL, !poisoned_) << "Illegal use of connection without a db";
+    DCHECK(poisoned_) << "Illegal use of connection without a db";
     return 0;
   }
   return sqlite3_changes(db_);
@@ -1649,7 +1643,7 @@
   AssertIOAllowed();
 
   if (db_) {
-    DLOG(FATAL) << "sql::Connection is already open.";
+    DLOG(DCHECK) << "sql::Connection is already open.";
     return false;
   }
 
@@ -1688,7 +1682,7 @@
   // only considers the sqlite3 handle's state.
   // TODO(shess): Revise is_open() to consider poisoned_, and review
   // to see if any non-testing code even depends on it.
-  DLOG_IF(FATAL, poisoned_) << "sql::Connection is already open.";
+  DCHECK(!poisoned_) << "sql::Connection is already open.";
   poisoned_ = false;
 
   // Custom memory-mapping VFS which reads pages using regular I/O on first hit.
@@ -1908,7 +1902,7 @@
 void Connection::StatementRefDeleted(StatementRef* ref) {
   StatementRefSet::iterator i = open_statements_.find(ref);
   if (i == open_statements_.end())
-    DLOG(FATAL) << "Could not find statement";
+    DLOG(DCHECK) << "Could not find statement";
   else
     open_statements_.erase(i);
 }
@@ -1965,7 +1959,7 @@
 
   // The default handling is to assert on debug and to ignore on release.
   if (!IsExpectedSqliteError(err))
-    DLOG(FATAL) << GetErrorMessage();
+    DLOG(DCHECK) << GetErrorMessage();
   return err;
 }
 
diff --git a/sql/connection.h b/sql/connection.h
index 769d56f..e643680 100644
--- a/sql/connection.h
+++ b/sql/connection.h
@@ -497,7 +497,7 @@
   // Returns |true| if there is an error expecter (see SetErrorExpecter), and
   // that expecter returns |true| when passed |error|.  Clients which provide an
   // |error_callback| should use IsExpectedSqliteError() to check for unexpected
-  // errors; if one is detected, DLOG(FATAL) is generally appropriate (see
+  // errors; if one is detected, DLOG(DCHECK) is generally appropriate (see
   // OnSqliteError implementation).
   static bool IsExpectedSqliteError(int error);
 
diff --git a/sql/connection_unittest.cc b/sql/connection_unittest.cc
index 77e4991..4a41d6c 100644
--- a/sql/connection_unittest.cc
+++ b/sql/connection_unittest.cc
@@ -1645,7 +1645,7 @@
 }
 
 // To prevent invalid SQL from accidentally shipping to production, prepared
-// statements which fail to compile with SQLITE_ERROR call DLOG(FATAL).  This
+// statements which fail to compile with SQLITE_ERROR call DLOG(DCHECK).  This
 // case cannot be suppressed with an error callback.
 TEST_F(SQLConnectionTest, CompileError) {
   // DEATH tests not supported on Android, iOS, or Fuchsia.
diff --git a/sql/statement.cc b/sql/statement.cc
index 5778fd0d..12a7b86 100644
--- a/sql/statement.cc
+++ b/sql/statement.cc
@@ -351,7 +351,7 @@
   // TODO(gbillock,shess): make this invalidate the statement so it
   // can't wreak havoc.
   if (err == SQLITE_RANGE)
-    DLOG(FATAL) << "Bind value out of range";
+    DLOG(DCHECK) << "Bind value out of range";
   return err == SQLITE_OK;
 }
 
diff --git a/storage/browser/blob/blob_memory_controller_unittest.cc b/storage/browser/blob/blob_memory_controller_unittest.cc
index 2ab02f0e..ca71ad8 100644
--- a/storage/browser/blob/blob_memory_controller_unittest.cc
+++ b/storage/browser/blob/blob_memory_controller_unittest.cc
@@ -78,8 +78,8 @@
       const BlobDataBuilder& builder) {
     std::vector<scoped_refptr<ShareableBlobDataItem>> result;
     for (size_t i = 0; i < builder.items_.size(); ++i) {
-      result.push_back(make_scoped_refptr(new ShareableBlobDataItem(
-          builder.items_[i], ShareableBlobDataItem::QUOTA_NEEDED)));
+      result.push_back(base::MakeRefCounted<ShareableBlobDataItem>(
+          builder.items_[i], ShareableBlobDataItem::QUOTA_NEEDED));
     }
     return result;
   }
diff --git a/storage/browser/fileapi/dragged_file_util_unittest.cc b/storage/browser/fileapi/dragged_file_util_unittest.cc
index 5d53cfc..344ad0a 100644
--- a/storage/browser/fileapi/dragged_file_util_unittest.cc
+++ b/storage/browser/fileapi/dragged_file_util_unittest.cc
@@ -47,10 +47,8 @@
 // Random root paths in which we create each file/directory of the
 // RegularTestCases (so that we can simulate a drop with files/directories
 // from multiple directories).
-static const base::FilePath::CharType* kRootPaths[] = {
-  FILE_PATH_LITERAL("a"),
-  FILE_PATH_LITERAL("b/c"),
-  FILE_PATH_LITERAL("etc"),
+constexpr const base::FilePath::CharType* kRootPaths[] = {
+    FILE_PATH_LITERAL("a"), FILE_PATH_LITERAL("b/c"), FILE_PATH_LITERAL("etc"),
 };
 
 base::FilePath GetTopLevelPath(const base::FilePath& path) {
diff --git a/storage/browser/test/test_file_system_context.cc b/storage/browser/test/test_file_system_context.cc
index 074be842..b54e8e0 100644
--- a/storage/browser/test/test_file_system_context.cc
+++ b/storage/browser/test/test_file_system_context.cc
@@ -40,7 +40,7 @@
   return new storage::FileSystemContext(
       io_task_runner.get(), file_task_runner.get(),
       storage::ExternalMountPoints::CreateRefCounted().get(),
-      make_scoped_refptr(new MockSpecialStoragePolicy()).get(),
+      base::MakeRefCounted<MockSpecialStoragePolicy>().get(),
       quota_manager_proxy, std::move(additional_providers),
       std::vector<storage::URLRequestAutoMountHandler>(), base_path,
       CreateAllowFileAccessOptions());
@@ -56,7 +56,7 @@
       base::ThreadTaskRunnerHandle::Get().get(),
       base::ThreadTaskRunnerHandle::Get().get(),
       storage::ExternalMountPoints::CreateRefCounted().get(),
-      make_scoped_refptr(new MockSpecialStoragePolicy()).get(),
+      base::MakeRefCounted<MockSpecialStoragePolicy>().get(),
       quota_manager_proxy, std::move(additional_providers), auto_mounters,
       base_path, CreateAllowFileAccessOptions());
 }
@@ -68,7 +68,7 @@
       base::ThreadTaskRunnerHandle::Get().get(),
       base::ThreadTaskRunnerHandle::Get().get(),
       storage::ExternalMountPoints::CreateRefCounted().get(),
-      make_scoped_refptr(new MockSpecialStoragePolicy()).get(),
+      base::MakeRefCounted<MockSpecialStoragePolicy>().get(),
       quota_manager_proxy,
       std::vector<std::unique_ptr<storage::FileSystemBackend>>(),
       std::vector<storage::URLRequestAutoMountHandler>(), base_path,
diff --git a/third_party/WebKit/LayoutTests/external/WPT_BASE_MANIFEST.json b/third_party/WebKit/LayoutTests/external/WPT_BASE_MANIFEST.json
index 581bc89..b185d0e 100644
--- a/third_party/WebKit/LayoutTests/external/WPT_BASE_MANIFEST.json
+++ b/third_party/WebKit/LayoutTests/external/WPT_BASE_MANIFEST.json
@@ -4881,342 +4881,6 @@
      {}
     ]
    ],
-   "2dcontext/drawing-images-to-the-canvas/drawimage_canvas_1.html": [
-    [
-     "/2dcontext/drawing-images-to-the-canvas/drawimage_canvas_1.html",
-     [
-      [
-       "/2dcontext/drawing-images-to-the-canvas/drawimage_canvas_1_ref.html",
-       "=="
-      ]
-     ],
-     {}
-    ]
-   ],
-   "2dcontext/drawing-images-to-the-canvas/drawimage_canvas_10.html": [
-    [
-     "/2dcontext/drawing-images-to-the-canvas/drawimage_canvas_10.html",
-     [
-      [
-       "/2dcontext/drawing-images-to-the-canvas/drawimage_canvas_10_ref.html",
-       "=="
-      ]
-     ],
-     {}
-    ]
-   ],
-   "2dcontext/drawing-images-to-the-canvas/drawimage_canvas_11.html": [
-    [
-     "/2dcontext/drawing-images-to-the-canvas/drawimage_canvas_11.html",
-     [
-      [
-       "/2dcontext/drawing-images-to-the-canvas/drawimage_canvas_11_ref.html",
-       "=="
-      ]
-     ],
-     {}
-    ]
-   ],
-   "2dcontext/drawing-images-to-the-canvas/drawimage_canvas_12.html": [
-    [
-     "/2dcontext/drawing-images-to-the-canvas/drawimage_canvas_12.html",
-     [
-      [
-       "/2dcontext/drawing-images-to-the-canvas/drawimage_canvas_12_ref.html",
-       "=="
-      ]
-     ],
-     {}
-    ]
-   ],
-   "2dcontext/drawing-images-to-the-canvas/drawimage_canvas_2.html": [
-    [
-     "/2dcontext/drawing-images-to-the-canvas/drawimage_canvas_2.html",
-     [
-      [
-       "/2dcontext/drawing-images-to-the-canvas/drawimage_canvas_2_ref.html",
-       "=="
-      ]
-     ],
-     {}
-    ]
-   ],
-   "2dcontext/drawing-images-to-the-canvas/drawimage_canvas_3.html": [
-    [
-     "/2dcontext/drawing-images-to-the-canvas/drawimage_canvas_3.html",
-     [
-      [
-       "/2dcontext/drawing-images-to-the-canvas/drawimage_canvas_3_ref.html",
-       "=="
-      ]
-     ],
-     {}
-    ]
-   ],
-   "2dcontext/drawing-images-to-the-canvas/drawimage_canvas_4.html": [
-    [
-     "/2dcontext/drawing-images-to-the-canvas/drawimage_canvas_4.html",
-     [
-      [
-       "/2dcontext/drawing-images-to-the-canvas/drawimage_canvas_4_ref.html",
-       "=="
-      ]
-     ],
-     {}
-    ]
-   ],
-   "2dcontext/drawing-images-to-the-canvas/drawimage_canvas_5.html": [
-    [
-     "/2dcontext/drawing-images-to-the-canvas/drawimage_canvas_5.html",
-     [
-      [
-       "/2dcontext/drawing-images-to-the-canvas/drawimage_canvas_5_ref.html",
-       "=="
-      ]
-     ],
-     {}
-    ]
-   ],
-   "2dcontext/drawing-images-to-the-canvas/drawimage_canvas_6.html": [
-    [
-     "/2dcontext/drawing-images-to-the-canvas/drawimage_canvas_6.html",
-     [
-      [
-       "/2dcontext/drawing-images-to-the-canvas/drawimage_canvas_6_ref.html",
-       "=="
-      ]
-     ],
-     {}
-    ]
-   ],
-   "2dcontext/drawing-images-to-the-canvas/drawimage_canvas_7.html": [
-    [
-     "/2dcontext/drawing-images-to-the-canvas/drawimage_canvas_7.html",
-     [
-      [
-       "/2dcontext/drawing-images-to-the-canvas/drawimage_canvas_7_ref.html",
-       "=="
-      ]
-     ],
-     {}
-    ]
-   ],
-   "2dcontext/drawing-images-to-the-canvas/drawimage_canvas_8.html": [
-    [
-     "/2dcontext/drawing-images-to-the-canvas/drawimage_canvas_8.html",
-     [
-      [
-       "/2dcontext/drawing-images-to-the-canvas/drawimage_canvas_8_ref.html",
-       "=="
-      ]
-     ],
-     {}
-    ]
-   ],
-   "2dcontext/drawing-images-to-the-canvas/drawimage_canvas_9.html": [
-    [
-     "/2dcontext/drawing-images-to-the-canvas/drawimage_canvas_9.html",
-     [
-      [
-       "/2dcontext/drawing-images-to-the-canvas/drawimage_canvas_9_ref.html",
-       "=="
-      ]
-     ],
-     {}
-    ]
-   ],
-   "2dcontext/drawing-images-to-the-canvas/drawimage_html_image_1.html": [
-    [
-     "/2dcontext/drawing-images-to-the-canvas/drawimage_html_image_1.html",
-     [
-      [
-       "/2dcontext/drawing-images-to-the-canvas/drawimage_html_image_1_ref.html",
-       "=="
-      ]
-     ],
-     {}
-    ]
-   ],
-   "2dcontext/drawing-images-to-the-canvas/drawimage_html_image_10.html": [
-    [
-     "/2dcontext/drawing-images-to-the-canvas/drawimage_html_image_10.html",
-     [
-      [
-       "/2dcontext/drawing-images-to-the-canvas/drawimage_html_image_10_ref.html",
-       "=="
-      ]
-     ],
-     {}
-    ]
-   ],
-   "2dcontext/drawing-images-to-the-canvas/drawimage_html_image_11.html": [
-    [
-     "/2dcontext/drawing-images-to-the-canvas/drawimage_html_image_11.html",
-     [
-      [
-       "/2dcontext/drawing-images-to-the-canvas/drawimage_html_image_11_ref.html",
-       "=="
-      ]
-     ],
-     {}
-    ]
-   ],
-   "2dcontext/drawing-images-to-the-canvas/drawimage_html_image_12.html": [
-    [
-     "/2dcontext/drawing-images-to-the-canvas/drawimage_html_image_12.html",
-     [
-      [
-       "/2dcontext/drawing-images-to-the-canvas/drawimage_html_image_12_ref.html",
-       "=="
-      ]
-     ],
-     {}
-    ]
-   ],
-   "2dcontext/drawing-images-to-the-canvas/drawimage_html_image_13.html": [
-    [
-     "/2dcontext/drawing-images-to-the-canvas/drawimage_html_image_13.html",
-     [
-      [
-       "/2dcontext/drawing-images-to-the-canvas/drawimage_html_image_13_ref.html",
-       "=="
-      ]
-     ],
-     {}
-    ]
-   ],
-   "2dcontext/drawing-images-to-the-canvas/drawimage_html_image_14.html": [
-    [
-     "/2dcontext/drawing-images-to-the-canvas/drawimage_html_image_14.html",
-     [
-      [
-       "/2dcontext/drawing-images-to-the-canvas/drawimage_html_image_14_ref.html",
-       "=="
-      ]
-     ],
-     {}
-    ]
-   ],
-   "2dcontext/drawing-images-to-the-canvas/drawimage_html_image_15.html": [
-    [
-     "/2dcontext/drawing-images-to-the-canvas/drawimage_html_image_15.html",
-     [
-      [
-       "/2dcontext/drawing-images-to-the-canvas/drawimage_html_image_15_ref.html",
-       "=="
-      ]
-     ],
-     {}
-    ]
-   ],
-   "2dcontext/drawing-images-to-the-canvas/drawimage_html_image_2.html": [
-    [
-     "/2dcontext/drawing-images-to-the-canvas/drawimage_html_image_2.html",
-     [
-      [
-       "/2dcontext/drawing-images-to-the-canvas/drawimage_html_image_2_ref.html",
-       "=="
-      ]
-     ],
-     {}
-    ]
-   ],
-   "2dcontext/drawing-images-to-the-canvas/drawimage_html_image_3.html": [
-    [
-     "/2dcontext/drawing-images-to-the-canvas/drawimage_html_image_3.html",
-     [
-      [
-       "/2dcontext/drawing-images-to-the-canvas/drawimage_html_image_3_ref.html",
-       "=="
-      ]
-     ],
-     {}
-    ]
-   ],
-   "2dcontext/drawing-images-to-the-canvas/drawimage_html_image_4.html": [
-    [
-     "/2dcontext/drawing-images-to-the-canvas/drawimage_html_image_4.html",
-     [
-      [
-       "/2dcontext/drawing-images-to-the-canvas/drawimage_html_image_4_ref.html",
-       "=="
-      ]
-     ],
-     {}
-    ]
-   ],
-   "2dcontext/drawing-images-to-the-canvas/drawimage_html_image_5.html": [
-    [
-     "/2dcontext/drawing-images-to-the-canvas/drawimage_html_image_5.html",
-     [
-      [
-       "/2dcontext/drawing-images-to-the-canvas/drawimage_html_image_5_ref.html",
-       "=="
-      ]
-     ],
-     {}
-    ]
-   ],
-   "2dcontext/drawing-images-to-the-canvas/drawimage_html_image_6.html": [
-    [
-     "/2dcontext/drawing-images-to-the-canvas/drawimage_html_image_6.html",
-     [
-      [
-       "/2dcontext/drawing-images-to-the-canvas/drawimage_html_image_6_ref.html",
-       "=="
-      ]
-     ],
-     {}
-    ]
-   ],
-   "2dcontext/drawing-images-to-the-canvas/drawimage_html_image_7.html": [
-    [
-     "/2dcontext/drawing-images-to-the-canvas/drawimage_html_image_7.html",
-     [
-      [
-       "/2dcontext/drawing-images-to-the-canvas/drawimage_html_image_7_ref.html",
-       "=="
-      ]
-     ],
-     {}
-    ]
-   ],
-   "2dcontext/drawing-images-to-the-canvas/drawimage_html_image_8.html": [
-    [
-     "/2dcontext/drawing-images-to-the-canvas/drawimage_html_image_8.html",
-     [
-      [
-       "/2dcontext/drawing-images-to-the-canvas/drawimage_html_image_8_ref.html",
-       "=="
-      ]
-     ],
-     {}
-    ]
-   ],
-   "2dcontext/drawing-images-to-the-canvas/drawimage_html_image_9.html": [
-    [
-     "/2dcontext/drawing-images-to-the-canvas/drawimage_html_image_9.html",
-     [
-      [
-       "/2dcontext/drawing-images-to-the-canvas/drawimage_html_image_9_ref.html",
-       "=="
-      ]
-     ],
-     {}
-    ]
-   ],
-   "2dcontext/drawing-images-to-the-canvas/drawimage_svg_image_1.html": [
-    [
-     "/2dcontext/drawing-images-to-the-canvas/drawimage_svg_image_1.html",
-     [
-      [
-       "/2dcontext/drawing-images-to-the-canvas/drawimage_svg_image_1_ref.html",
-       "=="
-      ]
-     ],
-     {}
-    ]
-   ],
    "2dcontext/line-styles/canvas_linestyles_linecap_001.htm": [
     [
      "/2dcontext/line-styles/canvas_linestyles_linecap_001.htm",
@@ -68672,11 +68336,6 @@
      {}
     ]
    ],
-   "2dcontext/2x2-srgb.png": [
-    [
-     {}
-    ]
-   ],
    "2dcontext/2x2.png": [
     [
      {}
@@ -69077,146 +68736,6 @@
      {}
     ]
    ],
-   "2dcontext/drawing-images-to-the-canvas/drawimage_canvas_10_ref.html": [
-    [
-     {}
-    ]
-   ],
-   "2dcontext/drawing-images-to-the-canvas/drawimage_canvas_11_ref.html": [
-    [
-     {}
-    ]
-   ],
-   "2dcontext/drawing-images-to-the-canvas/drawimage_canvas_12_ref.html": [
-    [
-     {}
-    ]
-   ],
-   "2dcontext/drawing-images-to-the-canvas/drawimage_canvas_1_ref.html": [
-    [
-     {}
-    ]
-   ],
-   "2dcontext/drawing-images-to-the-canvas/drawimage_canvas_2_ref.html": [
-    [
-     {}
-    ]
-   ],
-   "2dcontext/drawing-images-to-the-canvas/drawimage_canvas_3_ref.html": [
-    [
-     {}
-    ]
-   ],
-   "2dcontext/drawing-images-to-the-canvas/drawimage_canvas_4_ref.html": [
-    [
-     {}
-    ]
-   ],
-   "2dcontext/drawing-images-to-the-canvas/drawimage_canvas_5_ref.html": [
-    [
-     {}
-    ]
-   ],
-   "2dcontext/drawing-images-to-the-canvas/drawimage_canvas_6_ref.html": [
-    [
-     {}
-    ]
-   ],
-   "2dcontext/drawing-images-to-the-canvas/drawimage_canvas_7_ref.html": [
-    [
-     {}
-    ]
-   ],
-   "2dcontext/drawing-images-to-the-canvas/drawimage_canvas_8_ref.html": [
-    [
-     {}
-    ]
-   ],
-   "2dcontext/drawing-images-to-the-canvas/drawimage_canvas_9_ref.html": [
-    [
-     {}
-    ]
-   ],
-   "2dcontext/drawing-images-to-the-canvas/drawimage_html_image_10_ref.html": [
-    [
-     {}
-    ]
-   ],
-   "2dcontext/drawing-images-to-the-canvas/drawimage_html_image_11_ref.html": [
-    [
-     {}
-    ]
-   ],
-   "2dcontext/drawing-images-to-the-canvas/drawimage_html_image_12_ref.html": [
-    [
-     {}
-    ]
-   ],
-   "2dcontext/drawing-images-to-the-canvas/drawimage_html_image_13_ref.html": [
-    [
-     {}
-    ]
-   ],
-   "2dcontext/drawing-images-to-the-canvas/drawimage_html_image_14_ref.html": [
-    [
-     {}
-    ]
-   ],
-   "2dcontext/drawing-images-to-the-canvas/drawimage_html_image_15_ref.html": [
-    [
-     {}
-    ]
-   ],
-   "2dcontext/drawing-images-to-the-canvas/drawimage_html_image_1_ref.html": [
-    [
-     {}
-    ]
-   ],
-   "2dcontext/drawing-images-to-the-canvas/drawimage_html_image_2_ref.html": [
-    [
-     {}
-    ]
-   ],
-   "2dcontext/drawing-images-to-the-canvas/drawimage_html_image_3_ref.html": [
-    [
-     {}
-    ]
-   ],
-   "2dcontext/drawing-images-to-the-canvas/drawimage_html_image_4_ref.html": [
-    [
-     {}
-    ]
-   ],
-   "2dcontext/drawing-images-to-the-canvas/drawimage_html_image_5_ref.html": [
-    [
-     {}
-    ]
-   ],
-   "2dcontext/drawing-images-to-the-canvas/drawimage_html_image_6_ref.html": [
-    [
-     {}
-    ]
-   ],
-   "2dcontext/drawing-images-to-the-canvas/drawimage_html_image_7_ref.html": [
-    [
-     {}
-    ]
-   ],
-   "2dcontext/drawing-images-to-the-canvas/drawimage_html_image_8_ref.html": [
-    [
-     {}
-    ]
-   ],
-   "2dcontext/drawing-images-to-the-canvas/drawimage_html_image_9_ref.html": [
-    [
-     {}
-    ]
-   ],
-   "2dcontext/drawing-images-to-the-canvas/drawimage_svg_image_1_ref.html": [
-    [
-     {}
-    ]
-   ],
    "2dcontext/drawing-model/.gitkeep": [
     [
      {}
@@ -100662,16 +100181,6 @@
      {}
     ]
    ],
-   "fetch/api/cors/cors-preflight-star.any-expected.txt": [
-    [
-     {}
-    ]
-   ],
-   "fetch/api/cors/cors-preflight-star.any.worker-expected.txt": [
-    [
-     {}
-    ]
-   ],
    "fetch/api/headers/headers-record-expected.txt": [
     [
      {}
@@ -126471,63 +125980,21 @@
      {}
     ]
    ],
-   "2dcontext/drawing-images-to-the-canvas/drawimage_html_image_10_srgb.html": [
+   "2dcontext/drawing-images-to-the-canvas/drawimage_canvas.html": [
     [
-     "/2dcontext/drawing-images-to-the-canvas/drawimage_html_image_10_srgb.html",
+     "/2dcontext/drawing-images-to-the-canvas/drawimage_canvas.html",
      {}
     ]
    ],
-   "2dcontext/drawing-images-to-the-canvas/drawimage_html_image_1_srgb.html": [
+   "2dcontext/drawing-images-to-the-canvas/drawimage_html_image.html": [
     [
-     "/2dcontext/drawing-images-to-the-canvas/drawimage_html_image_1_srgb.html",
+     "/2dcontext/drawing-images-to-the-canvas/drawimage_html_image.html",
      {}
     ]
    ],
-   "2dcontext/drawing-images-to-the-canvas/drawimage_html_image_2_srgb.html": [
+   "2dcontext/drawing-images-to-the-canvas/drawimage_svg_image_1.html": [
     [
-     "/2dcontext/drawing-images-to-the-canvas/drawimage_html_image_2_srgb.html",
-     {}
-    ]
-   ],
-   "2dcontext/drawing-images-to-the-canvas/drawimage_html_image_3_srgb.html": [
-    [
-     "/2dcontext/drawing-images-to-the-canvas/drawimage_html_image_3_srgb.html",
-     {}
-    ]
-   ],
-   "2dcontext/drawing-images-to-the-canvas/drawimage_html_image_4_srgb.html": [
-    [
-     "/2dcontext/drawing-images-to-the-canvas/drawimage_html_image_4_srgb.html",
-     {}
-    ]
-   ],
-   "2dcontext/drawing-images-to-the-canvas/drawimage_html_image_5_srgb.html": [
-    [
-     "/2dcontext/drawing-images-to-the-canvas/drawimage_html_image_5_srgb.html",
-     {}
-    ]
-   ],
-   "2dcontext/drawing-images-to-the-canvas/drawimage_html_image_6_srgb.html": [
-    [
-     "/2dcontext/drawing-images-to-the-canvas/drawimage_html_image_6_srgb.html",
-     {}
-    ]
-   ],
-   "2dcontext/drawing-images-to-the-canvas/drawimage_html_image_7_srgb.html": [
-    [
-     "/2dcontext/drawing-images-to-the-canvas/drawimage_html_image_7_srgb.html",
-     {}
-    ]
-   ],
-   "2dcontext/drawing-images-to-the-canvas/drawimage_html_image_8_srgb.html": [
-    [
-     "/2dcontext/drawing-images-to-the-canvas/drawimage_html_image_8_srgb.html",
-     {}
-    ]
-   ],
-   "2dcontext/drawing-images-to-the-canvas/drawimage_svg_image_1_srgb.html": [
-    [
-     "/2dcontext/drawing-images-to-the-canvas/drawimage_svg_image_1_srgb.html",
+     "/2dcontext/drawing-images-to-the-canvas/drawimage_svg_image_1.html",
      {}
     ]
    ],
@@ -191128,12 +190595,8 @@
    "c6687ea38b936e06efda7e48c443250c289f3c62",
    "support"
   ],
-  "2dcontext/2x2-srgb.png": [
-   "007be94902fda049d59255d281de42ab28cf109d",
-   "support"
-  ],
   "2dcontext/2x2.png": [
-   "c67d3f646e86413722833d2308a9bfc793a916bf",
+   "007be94902fda049d59255d281de42ab28cf109d",
    "support"
   ],
   "2dcontext/2x4.png": [
@@ -191996,268 +191459,16 @@
    "4674a8a0b00f134aec38b80915cb16568c123218",
    "testharness"
   ],
-  "2dcontext/drawing-images-to-the-canvas/drawimage_canvas_1.html": [
-   "45cc6f5a95362cd6f8f101692afbfe25572ebc52",
-   "reftest"
-  ],
-  "2dcontext/drawing-images-to-the-canvas/drawimage_canvas_10.html": [
-   "d6bde3c8a7cb6255b7e52065cef381eb63045972",
-   "reftest"
-  ],
-  "2dcontext/drawing-images-to-the-canvas/drawimage_canvas_10_ref.html": [
-   "fc6d733f48745d483b6703ba59b32fc29ad8012f",
-   "support"
-  ],
-  "2dcontext/drawing-images-to-the-canvas/drawimage_canvas_11.html": [
-   "10c87532f043983ac8312be3a874d819f8e1e33c",
-   "reftest"
-  ],
-  "2dcontext/drawing-images-to-the-canvas/drawimage_canvas_11_ref.html": [
-   "c8c570c550aac764217ccc0f9a683ffdc798cf3b",
-   "support"
-  ],
-  "2dcontext/drawing-images-to-the-canvas/drawimage_canvas_12.html": [
-   "2072da2d7ebe715814bcd36472095e701bff8f12",
-   "reftest"
-  ],
-  "2dcontext/drawing-images-to-the-canvas/drawimage_canvas_12_ref.html": [
-   "948c7a4095a3f1da82812aa26ee32eee033c517a",
-   "support"
-  ],
-  "2dcontext/drawing-images-to-the-canvas/drawimage_canvas_1_ref.html": [
-   "06a8ac92ae2e06670652b280eec5a8d91c7c9804",
-   "support"
-  ],
-  "2dcontext/drawing-images-to-the-canvas/drawimage_canvas_2.html": [
-   "7a79dc3b97ec80068e2f7437c1bcfc612d09fe72",
-   "reftest"
-  ],
-  "2dcontext/drawing-images-to-the-canvas/drawimage_canvas_2_ref.html": [
-   "49b6f0e32f8ca6021e4d76f48c7bf9c2d9135303",
-   "support"
-  ],
-  "2dcontext/drawing-images-to-the-canvas/drawimage_canvas_3.html": [
-   "ad3af2745bdca16f90bb5a8bdfcdd6fd2b3306b4",
-   "reftest"
-  ],
-  "2dcontext/drawing-images-to-the-canvas/drawimage_canvas_3_ref.html": [
-   "505f8af29ffffde788a4a9be8b7099f96b78c6b5",
-   "support"
-  ],
-  "2dcontext/drawing-images-to-the-canvas/drawimage_canvas_4.html": [
-   "05e96c0f9f62a2743b029119b348ed3e58279256",
-   "reftest"
-  ],
-  "2dcontext/drawing-images-to-the-canvas/drawimage_canvas_4_ref.html": [
-   "56bf9b6acb0da3cab55367ec0f1b15655cb2be20",
-   "support"
-  ],
-  "2dcontext/drawing-images-to-the-canvas/drawimage_canvas_5.html": [
-   "58823be95d7cb39eca4b7683b9a3a9103a4c4f25",
-   "reftest"
-  ],
-  "2dcontext/drawing-images-to-the-canvas/drawimage_canvas_5_ref.html": [
-   "4515e1303a684a0c83613f759cceccde4ef1ebf3",
-   "support"
-  ],
-  "2dcontext/drawing-images-to-the-canvas/drawimage_canvas_6.html": [
-   "fd09a7a1c596f9fa7ef12568d06bab2db45c4921",
-   "reftest"
-  ],
-  "2dcontext/drawing-images-to-the-canvas/drawimage_canvas_6_ref.html": [
-   "948c7a4095a3f1da82812aa26ee32eee033c517a",
-   "support"
-  ],
-  "2dcontext/drawing-images-to-the-canvas/drawimage_canvas_7.html": [
-   "ae32d6351ecb6e3df1bf073b31561422e1743a10",
-   "reftest"
-  ],
-  "2dcontext/drawing-images-to-the-canvas/drawimage_canvas_7_ref.html": [
-   "e1dbfa8e6bdd816be642e8b7ebf5537fa331dd59",
-   "support"
-  ],
-  "2dcontext/drawing-images-to-the-canvas/drawimage_canvas_8.html": [
-   "da697640dc83e4f7b7d0f020004e5adaff20c11d",
-   "reftest"
-  ],
-  "2dcontext/drawing-images-to-the-canvas/drawimage_canvas_8_ref.html": [
-   "a8245d6015224b501d26a6b84622f25e2d97f91f",
-   "support"
-  ],
-  "2dcontext/drawing-images-to-the-canvas/drawimage_canvas_9.html": [
-   "a7c9d8bd351c54a8b509c9935736fcefe4eb5476",
-   "reftest"
-  ],
-  "2dcontext/drawing-images-to-the-canvas/drawimage_canvas_9_ref.html": [
-   "635d7901d4bc9a48828c5f65bbc7414eb6efa7fc",
-   "support"
-  ],
-  "2dcontext/drawing-images-to-the-canvas/drawimage_html_image_1.html": [
-   "8cff9e2344fbbe84b2ce315f260e69c6ad92dd51",
-   "reftest"
-  ],
-  "2dcontext/drawing-images-to-the-canvas/drawimage_html_image_10.html": [
-   "ca239d9a40410e4331863f2d11daabae3e590af3",
-   "reftest"
-  ],
-  "2dcontext/drawing-images-to-the-canvas/drawimage_html_image_10_ref.html": [
-   "9a70c803aaf5bd8a843b18d6d16779575d4dc6f8",
-   "support"
-  ],
-  "2dcontext/drawing-images-to-the-canvas/drawimage_html_image_10_srgb.html": [
-   "5e07949e8b2fbfa1e369a0ad08169dfcdf21253a",
+  "2dcontext/drawing-images-to-the-canvas/drawimage_canvas.html": [
+   "3b15af010f2ce13316fed6fcab9d85e05484b60d",
    "testharness"
   ],
-  "2dcontext/drawing-images-to-the-canvas/drawimage_html_image_11.html": [
-   "04415ce09b3b52561f5d179e7a6a8050199189c9",
-   "reftest"
-  ],
-  "2dcontext/drawing-images-to-the-canvas/drawimage_html_image_11_ref.html": [
-   "b51c787c97490eed29787cadf62b0c5e5cbd9180",
-   "support"
-  ],
-  "2dcontext/drawing-images-to-the-canvas/drawimage_html_image_12.html": [
-   "efee9a63933437315c9adec573113d8dee786659",
-   "reftest"
-  ],
-  "2dcontext/drawing-images-to-the-canvas/drawimage_html_image_12_ref.html": [
-   "5529c622869289c1a64987216b525766003d5f8c",
-   "support"
-  ],
-  "2dcontext/drawing-images-to-the-canvas/drawimage_html_image_13.html": [
-   "50eb35b3f6f75bec5002df0893c37c00c005a8df",
-   "reftest"
-  ],
-  "2dcontext/drawing-images-to-the-canvas/drawimage_html_image_13_ref.html": [
-   "30150e3530438d42704fda8b3623286658f6c724",
-   "support"
-  ],
-  "2dcontext/drawing-images-to-the-canvas/drawimage_html_image_14.html": [
-   "fa83293cfbdbb67a9d5d27a20ac19ff5d9c46d07",
-   "reftest"
-  ],
-  "2dcontext/drawing-images-to-the-canvas/drawimage_html_image_14_ref.html": [
-   "0feedb34e5ade7a4e58cb4eb92e2b958a06929fe",
-   "support"
-  ],
-  "2dcontext/drawing-images-to-the-canvas/drawimage_html_image_15.html": [
-   "b37463cc33b46e9aba5bbe73244fd422ef38406e",
-   "reftest"
-  ],
-  "2dcontext/drawing-images-to-the-canvas/drawimage_html_image_15_ref.html": [
-   "d6817ddb2ac78b524f7cc80ebd4f348aded4d89f",
-   "support"
-  ],
-  "2dcontext/drawing-images-to-the-canvas/drawimage_html_image_1_ref.html": [
-   "9a70c803aaf5bd8a843b18d6d16779575d4dc6f8",
-   "support"
-  ],
-  "2dcontext/drawing-images-to-the-canvas/drawimage_html_image_1_srgb.html": [
-   "a66ab9aacb845f819a89ac7cf61b7687657cd1fd",
+  "2dcontext/drawing-images-to-the-canvas/drawimage_html_image.html": [
+   "ec86f8f5c84628cd5f3b8673de8dde34dc372fd9",
    "testharness"
   ],
-  "2dcontext/drawing-images-to-the-canvas/drawimage_html_image_2.html": [
-   "b03f11e43e455e2d1f453ecc2a4de00e00005ebc",
-   "reftest"
-  ],
-  "2dcontext/drawing-images-to-the-canvas/drawimage_html_image_2_ref.html": [
-   "a95c84aace62371b4a58c381acaab51499cdeedb",
-   "support"
-  ],
-  "2dcontext/drawing-images-to-the-canvas/drawimage_html_image_2_srgb.html": [
-   "4cf97a2a8cb40bf77e900f4205331aa10c12a8d2",
-   "testharness"
-  ],
-  "2dcontext/drawing-images-to-the-canvas/drawimage_html_image_3.html": [
-   "134fa026f56880acb111a8e91efe3a8bcc03bb6b",
-   "reftest"
-  ],
-  "2dcontext/drawing-images-to-the-canvas/drawimage_html_image_3_ref.html": [
-   "59d699ac4347a4af4246c0333e14a91a201da15c",
-   "support"
-  ],
-  "2dcontext/drawing-images-to-the-canvas/drawimage_html_image_3_srgb.html": [
-   "17306f59dc1670e314467493de3eef1aa74ca44e",
-   "testharness"
-  ],
-  "2dcontext/drawing-images-to-the-canvas/drawimage_html_image_4.html": [
-   "5d7254f7bbc8c6feffb2a4fcfeecb06fe6ed3d6c",
-   "reftest"
-  ],
-  "2dcontext/drawing-images-to-the-canvas/drawimage_html_image_4_ref.html": [
-   "6204815172949961351ea34906f99d05063bc78f",
-   "support"
-  ],
-  "2dcontext/drawing-images-to-the-canvas/drawimage_html_image_4_srgb.html": [
-   "06ad1f613d5b00b281d3ba0f1dc36c392b01e534",
-   "testharness"
-  ],
-  "2dcontext/drawing-images-to-the-canvas/drawimage_html_image_5.html": [
-   "6a02b961aa4a5eb013366cd85dbea06fd2c08da0",
-   "reftest"
-  ],
-  "2dcontext/drawing-images-to-the-canvas/drawimage_html_image_5_ref.html": [
-   "5554083bf4b74facca2670cd28d1a57449931334",
-   "support"
-  ],
-  "2dcontext/drawing-images-to-the-canvas/drawimage_html_image_5_srgb.html": [
-   "949c6bc816e233d7c80ac163ac676bbdaf9b7d6c",
-   "testharness"
-  ],
-  "2dcontext/drawing-images-to-the-canvas/drawimage_html_image_6.html": [
-   "ce7cbe3b76274177301acca263f7cdd6c4033aa1",
-   "reftest"
-  ],
-  "2dcontext/drawing-images-to-the-canvas/drawimage_html_image_6_ref.html": [
-   "359acc11d83341062450e86162d831a9fc1ae158",
-   "support"
-  ],
-  "2dcontext/drawing-images-to-the-canvas/drawimage_html_image_6_srgb.html": [
-   "c70a24a9a2ac25653c4e004da29b788c0fa2736f",
-   "testharness"
-  ],
-  "2dcontext/drawing-images-to-the-canvas/drawimage_html_image_7.html": [
-   "f5469ba799e0845bc59766d76713ee052f3e6966",
-   "reftest"
-  ],
-  "2dcontext/drawing-images-to-the-canvas/drawimage_html_image_7_ref.html": [
-   "53efd12eca32f7898ddeabdca9b2e61f952b296d",
-   "support"
-  ],
-  "2dcontext/drawing-images-to-the-canvas/drawimage_html_image_7_srgb.html": [
-   "1d4a7788629ebe61936dd8377d3caaab5833a722",
-   "testharness"
-  ],
-  "2dcontext/drawing-images-to-the-canvas/drawimage_html_image_8.html": [
-   "37958b2fb55bd90567c7c0b64b599165b20992b9",
-   "reftest"
-  ],
-  "2dcontext/drawing-images-to-the-canvas/drawimage_html_image_8_ref.html": [
-   "89f6e5589e3619835d67e8d919ab6a507fb3bbb5",
-   "support"
-  ],
-  "2dcontext/drawing-images-to-the-canvas/drawimage_html_image_8_srgb.html": [
-   "be4db18071ef6c96231a87ed32db8670e257d236",
-   "testharness"
-  ],
-  "2dcontext/drawing-images-to-the-canvas/drawimage_html_image_9.html": [
-   "25812771d9663a529f802ed3fbdaaf68c130341f",
-   "reftest"
-  ],
-  "2dcontext/drawing-images-to-the-canvas/drawimage_html_image_9_ref.html": [
-   "5e4587978bcf32905a2676da269a5a09d7938718",
-   "support"
-  ],
   "2dcontext/drawing-images-to-the-canvas/drawimage_svg_image_1.html": [
-   "79cc1291956ab4eecda3307f165f2eb2038d1d49",
-   "reftest"
-  ],
-  "2dcontext/drawing-images-to-the-canvas/drawimage_svg_image_1_ref.html": [
-   "9a70c803aaf5bd8a843b18d6d16779575d4dc6f8",
-   "support"
-  ],
-  "2dcontext/drawing-images-to-the-canvas/drawimage_svg_image_1_srgb.html": [
-   "7bb18e2ca03c1b303d211df55c01338b2dfee494",
+   "d86bbcbac918dc468c484e46cc03e6125122d1ef",
    "testharness"
   ],
   "2dcontext/drawing-model/.gitkeep": [
@@ -253753,7 +252964,7 @@
    "testharness"
   ],
   "fetch/api/abort/general-serviceworker.https-expected.txt": [
-   "cddf57d551be890ab3f27755e15ebedf77874f30",
+   "022888be280cb205ea7bf63899c03dc0853219a9",
    "support"
   ],
   "fetch/api/abort/general-serviceworker.https.html": [
@@ -254032,18 +253243,10 @@
    "1b578ad1180dd6523aa1f967c59c87738eef802c",
    "testharness"
   ],
-  "fetch/api/cors/cors-preflight-star.any-expected.txt": [
-   "82d5b67079d5772fed201c91f43fbbbb33445625",
-   "support"
-  ],
   "fetch/api/cors/cors-preflight-star.any.js": [
    "fd336bff06ef9d08b9a728592c9e7bf0c43496db",
    "testharness"
   ],
-  "fetch/api/cors/cors-preflight-star.any.worker-expected.txt": [
-   "82d5b67079d5772fed201c91f43fbbbb33445625",
-   "support"
-  ],
   "fetch/api/cors/cors-preflight-status.any.js": [
    "1e997f025bea838223e62293dfd4e3799462369b",
    "testharness"
diff --git a/third_party/WebKit/LayoutTests/external/wpt/presentation-api/controlling-ua/common.js b/third_party/WebKit/LayoutTests/external/wpt/presentation-api/controlling-ua/common.js
index 3d8715b..4a73acd 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/presentation-api/controlling-ua/common.js
+++ b/third_party/WebKit/LayoutTests/external/wpt/presentation-api/controlling-ua/common.js
@@ -7,7 +7,7 @@
   // on something that directly or indirectly maps to a resource on the W3C test
   // server.
   var castAppId = '915D2A2C';
-  var castUrl = 'https://google.com/cast#__castAppId__=' + castAppId;
+  var castUrl = 'cast:' + castAppId;
 
   window.presentationUrls = [
     'support/presentation.html',
@@ -22,4 +22,4 @@
     toController: '9bf08fea-a71a-42f9-b3c4-fa19499e4d12',
     toReceiver: 'f1fdfd10-b606-4748-a644-0a8e9df3bdd6'
   }
-})(window);
\ No newline at end of file
+})(window);
diff --git a/third_party/WebKit/LayoutTests/fast/canvas-api/canvas-ImageData-constructor.html b/third_party/WebKit/LayoutTests/fast/canvas-api/canvas-ImageData-constructor.html
new file mode 100644
index 0000000..a60d796
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/fast/canvas-api/canvas-ImageData-constructor.html
@@ -0,0 +1,120 @@
+<script src="../../resources/testharness.js"></script>
+<script src="../../resources/testharnessreport.js"></script>
+<body>
+<script>
+
+function setRGBA(imageData, i, rgba) {
+    var s = i * 4;
+    imageData[s] = rgba[0];
+    imageData[s + 1] = rgba[1];
+    imageData[s + 2] = rgba[2];
+    imageData[s + 3] = rgba[3];
+}
+
+function getRGBA(imageData, i) {
+    var result = [];
+    var s = i * 4;
+    for (var j = 0; j < 4; j++) {
+        result[j] = imageData[s + j];
+    }
+    return result;
+}
+
+test(function(t) {
+    assert_not_equals(ImageData, undefined);
+    imageData = new ImageData(100, 50);
+
+    assert_not_equals(imageData, null);
+    assert_not_equals(imageData.data, null);
+    assert_equals(imageData.width, 100);
+    assert_equals(imageData.height, 50);
+    assert_array_equals(getRGBA(imageData.data, 4), [0, 0, 0, 0]);
+
+    var testColor = [0, 255, 255, 128];
+    setRGBA(imageData.data, 4, testColor);
+    assert_array_equals(getRGBA(imageData.data, 4), testColor);
+
+    assert_throws(new TypeError(), function() {
+      new ImageData(10);
+    });
+    assert_throws("INDEX_SIZE_ERR", function() {
+      new ImageData(0, 10);
+    });
+    assert_throws("INDEX_SIZE_ERR", function() {
+      new ImageData(10, 0);
+    });
+    assert_throws("INDEX_SIZE_ERR", function() {
+      new ImageData('width', 'height');
+    });
+    assert_throws("INDEX_SIZE_ERR", function() {
+      new ImageData(1 << 31, 1 << 31);
+    });
+    assert_throws(new TypeError(), function() {
+      new ImageData(new Uint8ClampedArray(0));
+    });
+    assert_throws("INDEX_SIZE_ERR", function() {
+      new ImageData(new Uint8Array(100), 25);
+    });
+    assert_throws("INDEX_SIZE_ERR", function() {
+      new ImageData(new Uint8ClampedArray(27), 2);
+    });
+    assert_throws("INDEX_SIZE_ERR", function() {
+      new ImageData(new Uint8ClampedArray(28), 7, 0);
+    });
+    assert_throws("INDEX_SIZE_ERR", function() {
+      new ImageData(new Uint8ClampedArray(104), 14);
+    });
+    assert_throws("INDEX_SIZE_ERR", function() {
+      new ImageData(new Uint8ClampedArray([12, 34, 168, 65328]), 1, 151);
+    });
+    assert_throws(new TypeError(), function() {
+      new ImageData(self, 4, 4);
+    });
+    assert_throws(new TypeError(), function() {
+      new ImageData(null, 4, 4);
+    });
+    assert_throws("INDEX_SIZE_ERR", function() {
+      new ImageData(imageData.data, 0);
+    });
+    assert_throws("INDEX_SIZE_ERR", function() {
+      new ImageData(imageData.data, 13);
+    });
+    assert_throws("INDEX_SIZE_ERR", function() {
+      new ImageData(imageData.data, 1 << 31);
+    });
+    assert_throws("INDEX_SIZE_ERR", function() {
+      new ImageData(imageData.data, 'biggish');
+    });
+    assert_throws("INDEX_SIZE_ERR", function() {
+      new ImageData(imageData.data, 1 << 24, 1 << 31);
+    });
+    assert_equals((new ImageData(new Uint8ClampedArray(28), 7)).height, 1);
+
+    imageDataFromData = new ImageData(imageData.data, 100);
+    assert_equals(imageDataFromData.width, 100);
+    assert_equals(imageDataFromData.height, 50);
+    assert_equals(imageDataFromData.data, imageData.data);
+    assert_array_equals(getRGBA(imageDataFromData.data, 10), getRGBA(imageData.data, 10));
+    setRGBA(imageData.data, 10, testColor);
+    assert_array_equals(getRGBA(imageDataFromData.data, 10), getRGBA(imageData.data, 10));
+
+    var data = new Uint8ClampedArray(400);
+    data[22] = 129;
+    imageDataFromData = new ImageData(data, 20, 5);
+    assert_equals(imageDataFromData.width, 20);
+    assert_equals(imageDataFromData.height, 5);
+    assert_equals(imageDataFromData.data, data);
+    assert_array_equals(getRGBA(imageDataFromData.data, 2), getRGBA(data, 2));
+    setRGBA(imageDataFromData.data, 2, testColor);
+    assert_array_equals(getRGBA(imageDataFromData.data, 2), getRGBA(data, 2));
+
+    if (window.SharedArrayBuffer) {
+        try {
+          new ImageData(new Uint16Array(new SharedArrayBuffer(32)), 4, 2);
+        } catch (ex) {
+          assert_equals(ex.name, "TypeError");
+        }
+    }
+}, 'Test ImageData constructor');
+</script>
+</body>
diff --git a/third_party/WebKit/LayoutTests/fast/canvas/canvas-arc-negative-radius.html b/third_party/WebKit/LayoutTests/fast/canvas-api/canvas-arc-negative-radius.html
similarity index 63%
rename from third_party/WebKit/LayoutTests/fast/canvas/canvas-arc-negative-radius.html
rename to third_party/WebKit/LayoutTests/fast/canvas-api/canvas-arc-negative-radius.html
index 57e2937..03d928a 100644
--- a/third_party/WebKit/LayoutTests/fast/canvas/canvas-arc-negative-radius.html
+++ b/third_party/WebKit/LayoutTests/fast/canvas-api/canvas-arc-negative-radius.html
@@ -10,20 +10,28 @@
 
     ctx.arc(10, 10, 5, 0, 1, false);
     ctx.arc(10, 10, 0, 0, 1, false);
-    assert_throws(null, function() {ctx.arc(10, 10, -5, 0, 1, false);});
+    assert_throws("INDEX_SIZE_ERR", function() {
+      ctx.arc(10, 10, -5, 0, 1, false);
+    });
 
     ctx.arcTo(10, 10, 20, 20, 5);
     ctx.arcTo(10, 10, 20, 20, 0);
-    assert_throws(null, function() {ctx.arcTo(10, 10, 20, 20, -5);});
+    assert_throws("INDEX_SIZE_ERR", function() {
+      ctx.arcTo(10, 10, 20, 20, -5);
+    });
 
     var path = new Path2D();
 
     path.arc(10, 10, 5, 0, 1, false);
     path.arc(10, 10, 0, 0, 1, false);
-    assert_throws(null, function() {path.arc(10, 10, -5, 0, 1, false);});
+    assert_throws("INDEX_SIZE_ERR", function() {
+      path.arc(10, 10, -5, 0, 1, false);
+    });
 
     path.arcTo(10, 10, 20, 20, 5);
     path.arcTo(10, 10, 20, 20, 0);
-    assert_throws(null, function() {path.arcTo(10, 10, 20, 20, -5);});
+    assert_throws("INDEX_SIZE_ERR", function() {
+      path.arcTo(10, 10, 20, 20, -5);
+    });
 }, 'Tests CanvasPath arc and arcTo with negative radii.');
 </script>
diff --git a/third_party/WebKit/LayoutTests/fast/canvas/canvas-direction.html b/third_party/WebKit/LayoutTests/fast/canvas-api/canvas-direction.html
similarity index 97%
rename from third_party/WebKit/LayoutTests/fast/canvas/canvas-direction.html
rename to third_party/WebKit/LayoutTests/fast/canvas-api/canvas-direction.html
index acf2acb..8fa878ec 100644
--- a/third_party/WebKit/LayoutTests/fast/canvas/canvas-direction.html
+++ b/third_party/WebKit/LayoutTests/fast/canvas-api/canvas-direction.html
@@ -56,7 +56,6 @@
 
 function verifyDrawText(canvasId, text, expectedDirection)
 {
-    console.log(canvasId, text, expectedDirection);
     var canvasElement = document.getElementById(canvasId);
     var ctx = canvasElement.getContext('2d');
     var width = canvasElement.width/2;
@@ -71,7 +70,6 @@
 
 function verifyDrawTextWithSpecifiedDirection(testItem)
 {
-    console.log(testItem);
     var canvasElement = document.getElementById(testItem['canvasId']);
     var ctx = canvasElement.getContext('2d');
     var width = canvasElement.width/2;
@@ -181,7 +179,7 @@
          {canvasId: 'canvas6', text: 'Right-to-Left text', direction: 'inherit', expectedDirection: 'rtl'}],
     ];
     generate_tests(verifyDrawTextWithSpecifiedDirection, drawTextWithSpecifiedDirectionTests);
-    
+
     var directionAfterResetTests = [
         ['DirectionAfterResetTest1',
          {canvasId: 'canvas7', text: 'Right-to-Left', direction: 'rtl', expectedDirection: 'ltr'}],
@@ -189,15 +187,15 @@
          {canvasId: 'canvas8', text: 'Right-to-Left', direction: 'ltr', expectedDirection: 'rtl'}],
     ];
     generate_tests(verifyDirectionAfterReset, directionAfterResetTests);
-    
+
     var directionAfterAttributeChangeTests = [
-        ['DirectionAfterResetTest1',
+        ['DirectionAfterResetTest3',
          {canvasId: 'canvas9', text: 'Right-to-Left text', newDirection: 'rtl', forParentElement: true}],
-        ['DirectionAfterResetTest2',
+        ['DirectionAfterResetTest4',
          {canvasId: 'canvas10', text: 'Left-to-Right text', newDirection: 'ltr', forParentElement: false}],
     ];
     generate_tests(verifyDirectionAfterAttributeChange, directionAfterAttributeChangeTests);
-    
+
     verifyDirectionAcrossSaveRestores('canvas11',
                                       [{ text: 'Left-to-Right text', direction: 'ltr' },
                                        { text: 'Right-to-Left text', direction: 'rtl' },
@@ -211,6 +209,5 @@
         ['InvalidDirectionTestINHERIT', 'INHERIT'],
     ];
     generate_tests(verifyInvalidDirection, invalidDirectionTests);
-
 }, "Verify that canvas 2d context supports 'direction' attribute.");
 </script>
diff --git a/third_party/WebKit/LayoutTests/fast/canvas/canvas-ellipse-negative-radius.html b/third_party/WebKit/LayoutTests/fast/canvas-api/canvas-ellipse-negative-radius.html
similarity index 63%
rename from third_party/WebKit/LayoutTests/fast/canvas/canvas-ellipse-negative-radius.html
rename to third_party/WebKit/LayoutTests/fast/canvas-api/canvas-ellipse-negative-radius.html
index 6f7f2f4..c3a9a9c 100644
--- a/third_party/WebKit/LayoutTests/fast/canvas/canvas-ellipse-negative-radius.html
+++ b/third_party/WebKit/LayoutTests/fast/canvas-api/canvas-ellipse-negative-radius.html
@@ -10,10 +10,15 @@
     ctx.ellipse(10, 10, 10, 0, 0, 0, 1, false);
     ctx.ellipse(10, 10, -0, 5, 0, 0, 1, false);
 
-    assert_throws(null, function() {ctx.ellipse(10, 10, -2, 5, 0, 0, 1, false);});
-    assert_throws(null, function() {ctx.ellipse(10, 10, 0, -1.5, 0, 0, 1, false);});
-    assert_throws(null, function() {ctx.ellipse(10, 10, -2, -5, 0, 0, 1, false);});
-
+    assert_throws("INDEX_SIZE_ERR", function() {
+      ctx.ellipse(10, 10, -2, 5, 0, 0, 1, false);
+    });
+    assert_throws("INDEX_SIZE_ERR", function() {
+      ctx.ellipse(10, 10, 0, -1.5, 0, 0, 1, false);
+    });
+    assert_throws("INDEX_SIZE_ERR", function() {
+      ctx.ellipse(10, 10, -2, -5, 0, 0, 1, false);
+    });
     // FIXME: When this is exposed on Path as well as CanvasRenderingContext2D, add tests for Path as well.
 }, 'Tests CanvasPath ellipse with negative radii.');
 </script>
diff --git a/third_party/WebKit/LayoutTests/fast/canvas/canvas-with-incorrect-args.html b/third_party/WebKit/LayoutTests/fast/canvas-api/canvas-with-incorrect-args.html
similarity index 95%
rename from third_party/WebKit/LayoutTests/fast/canvas/canvas-with-incorrect-args.html
rename to third_party/WebKit/LayoutTests/fast/canvas-api/canvas-with-incorrect-args.html
index 5349ebb..81bb996 100644
--- a/third_party/WebKit/LayoutTests/fast/canvas/canvas-with-incorrect-args.html
+++ b/third_party/WebKit/LayoutTests/fast/canvas-api/canvas-with-incorrect-args.html
@@ -22,7 +22,9 @@
 
     context.fill();
     context.arc(2, 2, 0, 0, 90, true);
-    assert_throws(null, function() {context.arc(2, 2, -10, 0, 90, true);});  
+    assert_throws("INDEX_SIZE_ERR", function() {
+      context.arc(2, 2, -10, 0, 90, true);
+    });
     context.arc(2, 2, Infinity, 0, 90, true);
     context.arc(2, 2, NaN, 0, 90, true);
 
@@ -33,7 +35,7 @@
 
     context.beginPath();
     context.moveTo(10, 10);
-    assert_throws(null, function() {context.arcTo(2, 2, 4, 4, -10);});
+    context.arc(2, 2, 4, 4, -10);
     context.closePath();
 
     context.beginPath();
@@ -228,9 +230,10 @@
 
     var canvas2 = document.createElement('canvas');
     canvas2.width = canvas2.height = 0;
-    assert_throws(null, function() {var pattern = ctx.createPattern(canvas2, 'repeat');});
+    assert_throws("INVALID_STATE_ERR", function() {
+      var pattern = context.createPattern(canvas2, 'repeat');
+    });
     context.fillStyle = '#0f0';
     context.fillRect(0, 0, canvas.width, canvas.height);
-    
 }, "Verify the behavior of a number of the DOM Canvas drawing methods when given 0, Infinity, or NaN as parameters. Test should not crash.");
 </script>
diff --git a/third_party/WebKit/LayoutTests/fast/canvas-api/gradient-addColorStop-with-invalid-color.html b/third_party/WebKit/LayoutTests/fast/canvas-api/gradient-addColorStop-with-invalid-color.html
new file mode 100644
index 0000000..10734be
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/fast/canvas-api/gradient-addColorStop-with-invalid-color.html
@@ -0,0 +1,21 @@
+<script src="../../resources/testharness.js"></script>
+<script src="../../resources/testharnessreport.js"></script>
+<script>
+test(function(){
+
+    var gradient = document.createElement('canvas').getContext('2d').createLinearGradient(0, 0, 150, 0);
+
+    assert_throws("SYNTAX_ERR", function() {
+      gradient.addColorStop(0, '');
+    });
+    assert_throws("SYNTAX_ERR", function() {
+      gradient.addColorStop(0, '#cc');
+    });
+    assert_throws("SYNTAX_ERR", function() {
+      gradient.addColorStop(0, 'rgb(257, 0)');
+    });
+    assert_throws("SYNTAX_ERR", function() {
+      gradient.addColorStop(0, 'rgb(257, 0, 5, 0)');
+    });
+}, 'This test checks invalid colors on gradients.');
+</script>
diff --git a/third_party/WebKit/LayoutTests/fast/canvas-api/gradient-addColorStop-with-invalid-offset.html b/third_party/WebKit/LayoutTests/fast/canvas-api/gradient-addColorStop-with-invalid-offset.html
new file mode 100644
index 0000000..9158a534
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/fast/canvas-api/gradient-addColorStop-with-invalid-offset.html
@@ -0,0 +1,24 @@
+<script src="../../resources/testharness.js"></script>
+<script src="../../resources/testharnessreport.js"></script>
+<script>
+test(function() {
+
+    var gradient = document.createElement('canvas').getContext('2d').createLinearGradient(0, 0, 150, 0);
+
+    assert_throws("INDEX_SIZE_ERR", function() {
+      gradient.addColorStop(-1, '#000');
+    });
+    assert_throws("INDEX_SIZE_ERR", function() {
+      gradient.addColorStop(2, '#000');
+    });
+    assert_throws(new TypeError(), function() {
+      gradient.addColorStop(Infinity, '#000');
+    });
+    assert_throws(new TypeError(), function() {
+      gradient.addColorStop(-Infinity, '#000');
+    });
+    assert_throws(new TypeError(), function() {
+      gradient.addColorStop(NaN, '#000');
+    });
+}, 'This test checks invalid offsets on gradients.');
+</script>
diff --git a/third_party/WebKit/LayoutTests/fast/canvas/linearGradient-infinite-values.html b/third_party/WebKit/LayoutTests/fast/canvas-api/linearGradient-infinite-values.html
similarity index 92%
rename from third_party/WebKit/LayoutTests/fast/canvas/linearGradient-infinite-values.html
rename to third_party/WebKit/LayoutTests/fast/canvas-api/linearGradient-infinite-values.html
index 97c6eb9..7618aa7c 100644
--- a/third_party/WebKit/LayoutTests/fast/canvas/linearGradient-infinite-values.html
+++ b/third_party/WebKit/LayoutTests/fast/canvas-api/linearGradient-infinite-values.html
@@ -8,7 +8,9 @@
 function testCreateLinearGradient(params)
 {
     x0 = params[0]; y0 = params[1]; x1 = params[2]; y1 = params[3];
-    assert_throws(null, function(){ctx.createLinearGradient(x0, y0, x1, y1);});
+    assert_throws(new TypeError(), function() {
+      ctx.createLinearGradient(x0, y0, x1, y1);
+    });
 }
 
 var testScenarios = [
diff --git a/third_party/WebKit/LayoutTests/fast/canvas/canvas-ImageData-constructor-expected.txt b/third_party/WebKit/LayoutTests/fast/canvas/canvas-ImageData-constructor-expected.txt
deleted file mode 100644
index 555d42e..0000000
--- a/third_party/WebKit/LayoutTests/fast/canvas/canvas-ImageData-constructor-expected.txt
+++ /dev/null
@@ -1,4 +0,0 @@
-This is a testharness.js-based test.
-FAIL Test ImageData constructor Test bug: need to pass exception to assert_throws()
-Harness: the test ran to completion.
-
diff --git a/third_party/WebKit/LayoutTests/fast/canvas/canvas-ImageData-constructor.html b/third_party/WebKit/LayoutTests/fast/canvas/canvas-ImageData-constructor.html
deleted file mode 100644
index c5b0e58..0000000
--- a/third_party/WebKit/LayoutTests/fast/canvas/canvas-ImageData-constructor.html
+++ /dev/null
@@ -1,84 +0,0 @@
-<script src="../../resources/testharness.js"></script>
-<script src="../../resources/testharnessreport.js"></script>
-<body>
-<script>
-
-function setRGBA(imageData, i, rgba) {
-    var s = i * 4;
-    imageData[s] = rgba[0];
-    imageData[s + 1] = rgba[1];
-    imageData[s + 2] = rgba[2];
-    imageData[s + 3] = rgba[3];
-}
-
-function getRGBA(imageData, i) {
-    var result = [];
-    var s = i * 4;
-    for (var j = 0; j < 4; j++) {
-        result[j] = imageData[s + j];
-    }
-    return result;
-}
-
-test(function(t) {
-    assert_not_equals(ImageData, undefined);
-    assert_equals(ImageData.length, 2);
-    
-    imageData = new ImageData(100, 50);
-    
-    assert_not_equals(imageData, null);
-    assert_not_equals(imageData.data, null);
-    assert_equals(imageData.width, 100);
-    assert_equals(imageData.height, 50);
-    assert_array_equals(getRGBA(imageData.data, 4), [0, 0, 0, 0]);
-    
-    var testColor = [0, 255, 255, 128];
-    setRGBA(imageData.data, 4, testColor);
-    assert_array_equals(getRGBA(imageData.data, 4), testColor);
-    
-    assert_throws(null, function() {new ImageData(10)});
-    assert_throws(null, function() {new ImageData(0, 10)});
-    assert_throws(null, function() {new ImageData(10, 0)});
-    assert_throws(null, function() {new ImageData('width', 'height')});
-    assert_throws(null, function() {new ImageData(1 << 31, 1 << 31)});
-    
-    assert_throws(null, function() {new ImageData(new Uint8ClampedArray(0))});
-    assert_throws(null, function() {new ImageData(new Uint8Array(100), 25)});
-    assert_throws(null, function() {new ImageData(new Uint8ClampedArray(27), 2)});
-    assert_throws(null, function() {new ImageData(new Uint8ClampedArray(28), 7, 0)});
-    assert_throws(null, function() {new ImageData(new Uint8ClampedArray(104), 14)});
-    assert_throws(null, function() {new ImageData(new Uint8ClampedArray([12, 34, 168, 65328]), 1, 151)});
-    assert_throws(null, function() {new ImageData(self, 4, 4)});
-    assert_throws(null, function() {new ImageData(null, 4, 4)});
-    assert_throws(null, function() {new ImageData(imageData.data, 0)});
-    assert_throws(null, function() {new ImageData(imageData.data, 13)});
-    assert_throws(null, function() {new ImageData(imageData.data, 1 << 31)});
-    assert_throws(null, function() {new ImageData(imageData.data, 'biggish')});
-    assert_throws(null, function() {new ImageData(imageData.data, 1 << 24, 1 << 31)});
-    assert_equals((new ImageData(new Uint8ClampedArray(28), 7)).height, 1);
-    
-    imageDataFromData = new ImageData(imageData.data, 100);
-    assert_equals(imageDataFromData.width, 100);
-    assert_equals(imageDataFromData.height, 50);
-    assert_equals(imageDataFromData.data, imageData.data);
-    assert_array_equals(getRGBA(imageDataFromData.data, 10), getRGBA(imageData.data, 10));
-    setRGBA(imageData.data, 10, testColor);
-    assert_array_equals(getRGBA(imageDataFromData.data, 10), getRGBA(imageData.data, 10));
-    
-    var data = new Uint8ClampedArray(400);
-    data[22] = 129;
-    imageDataFromData = new ImageData(data, 20, 5);
-    assert_equals(imageDataFromData.width, 20);
-    assert_equals(imageDataFromData.height, 5);
-    assert_equals(imageDataFromData.data, data);
-    assert_array_equals(getRGBA(imageDataFromData.data, 2), getRGBA(data, 2));
-    setRGBA(imageDataFromData.data, 2, testColor);
-    assert_array_equals(getRGBA(imageDataFromData.data, 2), getRGBA(data, 2));
-
-    if (window.SharedArrayBuffer) {
-        assert_throws(null, function() {new ImageData(new Uint16Array(new SharedArrayBuffer(32)), 4, 2)});
-    }
-        
-}, 'Test ImageData constructor');
-</script>
-</body>
diff --git a/third_party/WebKit/LayoutTests/fast/canvas/canvas-arc-negative-radius-expected.txt b/third_party/WebKit/LayoutTests/fast/canvas/canvas-arc-negative-radius-expected.txt
deleted file mode 100644
index 08a2b134..0000000
--- a/third_party/WebKit/LayoutTests/fast/canvas/canvas-arc-negative-radius-expected.txt
+++ /dev/null
@@ -1,4 +0,0 @@
-This is a testharness.js-based test.
-FAIL Tests CanvasPath arc and arcTo with negative radii. Test bug: need to pass exception to assert_throws()
-Harness: the test ran to completion.
-
diff --git a/third_party/WebKit/LayoutTests/fast/canvas/canvas-currentTransform-expected.txt b/third_party/WebKit/LayoutTests/fast/canvas/canvas-currentTransform-expected.txt
deleted file mode 100644
index f0778c49..0000000
--- a/third_party/WebKit/LayoutTests/fast/canvas/canvas-currentTransform-expected.txt
+++ /dev/null
@@ -1,4 +0,0 @@
-This is a testharness.js-based test.
-FAIL Series of tests to ensure correct behaviour of canvas.currentTransform Test bug: need to pass exception to assert_throws()
-Harness: the test ran to completion.
-
diff --git a/third_party/WebKit/LayoutTests/fast/canvas/canvas-currentTransform.html b/third_party/WebKit/LayoutTests/fast/canvas/canvas-currentTransform.html
index 1790a95..2d5a44c 100644
--- a/third_party/WebKit/LayoutTests/fast/canvas/canvas-currentTransform.html
+++ b/third_party/WebKit/LayoutTests/fast/canvas/canvas-currentTransform.html
@@ -184,17 +184,23 @@
     assert_equals(matrix.e, 1);
     assert_equals(matrix.f, 2);
     setCurrentTransform(ctx, 1, 0, 0, 1, 0, 0);
-    
+
     // throws: TypeError: Failed to set the \'currentTransform\' property on \'CanvasRenderingContext2D\': The provided value is not of type \'SVGMatrix\'.
-    assert_throws(null, function() {ctx.currentTransform = ctx;});
+    assert_throws(new TypeError(), function() {
+      ctx.currentTransform = ctx;
+    });
     // throws: TypeError: Failed to set the \'currentTransform\' property on \'CanvasRenderingContext2D\': The provided value is not of type \'SVGMatrix\'.
-    assert_throws(null, function() {ctx.currentTransform = undefined;});
+    assert_throws(new TypeError(), function() {
+      ctx.currentTransform = undefined;
+    });
     // throws: TypeError: Failed to set the \'currentTransform\' property on \'CanvasRenderingContext2D\': The provided value is not of type \'SVGMatrix\'.
-    assert_throws(null, function() {ctx.currentTransform = null;});
-    
+    assert_throws(new TypeError(), function() {
+      ctx.currentTransform = null;
+    });
+
     ctx.fillStyle = 'red';
     ctx.fillRect(0, 0, 100, 100);
-    
+
     function setCurrentTransformToNonfinite(parameters)
     {
         ctx = parameters[0];
@@ -219,7 +225,7 @@
         assert_equals(matrix.e, 100);
         assert_equals(matrix.f, 10);
     }
-    
+
     ctx.translate(100, 10);
     matrix = ctx.currentTransform;
     assert_equals(matrix.a, 1);
@@ -307,7 +313,7 @@
         ['Case 75' , [ctx, 0, 0, 0, 0, Infinity, Infinity]]
     ]
     generate_tests(setCurrentTransformToNonfinite, testScenarios);
-    
+
     matrix = ctx.currentTransform;
     assert_equals(matrix.a, 1);
     assert_equals(matrix.b, 0);
@@ -315,10 +321,10 @@
     assert_equals(matrix.d, 1);
     assert_equals(matrix.e, 100);
     assert_equals(matrix.f, 10);
-    
+
     ctx.fillStyle = 'green';
     ctx.fillRect(-100, -10, 100, 100);
-    
+
     imageData = ctx.getImageData(1, 1, 98, 98);
     imgdata = imageData.data;
     assert_equals(imgdata[4], 0);
diff --git a/third_party/WebKit/LayoutTests/fast/canvas/canvas-direction-expected.txt b/third_party/WebKit/LayoutTests/fast/canvas/canvas-direction-expected.txt
deleted file mode 100644
index ceb7ce24..0000000
--- a/third_party/WebKit/LayoutTests/fast/canvas/canvas-direction-expected.txt
+++ /dev/null
@@ -1,24 +0,0 @@
-CONSOLE MESSAGE: line 59: canvas1
-CONSOLE MESSAGE: line 59: canvas2
-CONSOLE MESSAGE: line 74: [object Object]
-CONSOLE MESSAGE: line 74: [object Object]
-CONSOLE MESSAGE: line 74: [object Object]
-CONSOLE MESSAGE: line 74: [object Object]
-This is a testharness.js-based test.
-Harness Error. harness_status.status = 1 , harness_status.message = 2 duplicate test names: "DirectionAfterResetTest1", "DirectionAfterResetTest2"
-PASS Verify that canvas 2d context supports 'direction' attribute.
-PASS DrawTextTest1
-PASS DrawTextTest2
-PASS DrawTextWithSpecifiedDirectionTest1
-PASS DrawTextWithSpecifiedDirectionTest2
-PASS DrawTextWithSpecifiedDirectionTest3
-PASS DrawTextWithSpecifiedDirectionTest4
-PASS DirectionAfterResetTest1
-PASS DirectionAfterResetTest2
-PASS DirectionAfterResetTest1
-PASS DirectionAfterResetTest2
-PASS InvalidDirectionTestRTL
-PASS InvalidDirectionTestLTR
-PASS InvalidDirectionTestINHERIT
-Harness: the test ran to completion.
-
diff --git a/third_party/WebKit/LayoutTests/fast/canvas/canvas-ellipse-negative-radius-expected.txt b/third_party/WebKit/LayoutTests/fast/canvas/canvas-ellipse-negative-radius-expected.txt
deleted file mode 100644
index 3520f54d..0000000
--- a/third_party/WebKit/LayoutTests/fast/canvas/canvas-ellipse-negative-radius-expected.txt
+++ /dev/null
@@ -1,4 +0,0 @@
-This is a testharness.js-based test.
-FAIL Tests CanvasPath ellipse with negative radii. Test bug: need to pass exception to assert_throws()
-Harness: the test ran to completion.
-
diff --git a/third_party/WebKit/LayoutTests/fast/canvas/canvas-fillRect-shadow-expected.txt b/third_party/WebKit/LayoutTests/fast/canvas/canvas-fillRect-shadow-expected.txt
deleted file mode 100644
index 6a431445..0000000
--- a/third_party/WebKit/LayoutTests/fast/canvas/canvas-fillRect-shadow-expected.txt
+++ /dev/null
@@ -1,20 +0,0 @@
-This is a testharness.js-based test.
-Harness Error. harness_status.status = 1 , harness_status.message = 4 duplicate test names: "testBlurryShadow 1", "testBlurryShadow 2", "testBlurryShadow 3", "testBlurryShadow 4"
-PASS testSolidShadow 1
-PASS testSolidShadow 2
-PASS testSolidShadow 3
-PASS testSolidShadow 4
-PASS testSolidAlphaShadow 1
-PASS testSolidAlphaShadow 2
-PASS testSolidAlphaShadow 3
-PASS testSolidAlphaShadow 4
-PASS testBlurryShadow 1
-PASS testBlurryShadow 2
-PASS testBlurryShadow 3
-PASS testBlurryShadow 4
-PASS testBlurryShadow 1
-PASS testBlurryShadow 2
-PASS testBlurryShadow 3
-PASS testBlurryShadow 4
-Harness: the test ran to completion.
-
diff --git a/third_party/WebKit/LayoutTests/fast/canvas/canvas-fillRect-shadow.html b/third_party/WebKit/LayoutTests/fast/canvas/canvas-fillRect-shadow.html
index 1b2948a..ff7cc503 100644
--- a/third_party/WebKit/LayoutTests/fast/canvas/canvas-fillRect-shadow.html
+++ b/third_party/WebKit/LayoutTests/fast/canvas/canvas-fillRect-shadow.html
@@ -40,7 +40,7 @@
 ctx.shadowColor = 'rgba(255, 0, 0, 0.3)';
 ctx.fillRect(50, 500, 100, 100);
 
-testSolidShadow = 
+testSolidShadow =
     [
         ['testSolidShadow 1', ctx.getImageData(250, 50, 1, 1).data, [255, 0, 0, 255]],
         ['testSolidShadow 2', ctx.getImageData(250, 149, 1, 1).data, [255, 0, 0, 255]],
@@ -69,10 +69,10 @@
 // alpha < 10
 testBlurryAlphaShadow = 
     [
-        ['testBlurryShadow 1', ctx.getImageData(248, 498, 1, 1).data, [255, 0, 0, 0]],
-        ['testBlurryShadow 2', ctx.getImageData(248, 601, 1, 1).data, [255, 0, 0, 0]],
-        ['testBlurryShadow 3', ctx.getImageData(351, 498, 1, 1).data, [255, 0, 0, 0]],
-        ['testBlurryShadow 4', ctx.getImageData(351, 601, 1, 1).data, [255, 0, 0, 0]],
+        ['testBlurryShadow 5', ctx.getImageData(248, 498, 1, 1).data, [255, 0, 0, 0]],
+        ['testBlurryShadow 6', ctx.getImageData(248, 601, 1, 1).data, [255, 0, 0, 0]],
+        ['testBlurryShadow 7', ctx.getImageData(351, 498, 1, 1).data, [255, 0, 0, 0]],
+        ['testBlurryShadow 8', ctx.getImageData(351, 601, 1, 1).data, [255, 0, 0, 0]],
     ];
 
 generate_tests(testPixelShadow, testSolidShadow);
diff --git a/third_party/WebKit/LayoutTests/fast/canvas/canvas-path-addpath-expected.txt b/third_party/WebKit/LayoutTests/fast/canvas/canvas-path-addpath-expected.txt
deleted file mode 100644
index abfb08b..0000000
--- a/third_party/WebKit/LayoutTests/fast/canvas/canvas-path-addpath-expected.txt
+++ /dev/null
@@ -1,4 +0,0 @@
-This is a testharness.js-based test.
-FAIL Test addPath() method. Test bug: need to pass exception to assert_throws()
-Harness: the test ran to completion.
-
diff --git a/third_party/WebKit/LayoutTests/fast/canvas/canvas-path-addpath.html b/third_party/WebKit/LayoutTests/fast/canvas/canvas-path-addpath.html
index 154ec2b..e9d4af1 100644
--- a/third_party/WebKit/LayoutTests/fast/canvas/canvas-path-addpath.html
+++ b/third_party/WebKit/LayoutTests/fast/canvas/canvas-path-addpath.html
@@ -5,7 +5,7 @@
 test(function(t) {
     var canvas = document.createElement('canvas');
     var ctx = canvas.getContext('2d');
-    
+
     ctx.clearRect(0, 0, canvas.width, canvas.height);
     ctx.beginPath();
     var p1 = new Path2D();
@@ -17,7 +17,7 @@
     ctx.fillStyle = 'yellow';
     ctx.fill(p1);
     assert_array_equals(ctx.getImageData(1, 100, 1, 1).data, [255, 255, 0, 255]);
-    
+
     ctx.clearRect(0, 0, canvas.width, canvas.height);
     ctx.beginPath();
     var p3 = new Path2D();
@@ -31,7 +31,7 @@
     ctx.fillStyle = 'yellow';
     ctx.fill(p3);
     assert_array_equals(ctx.getImageData(101, 0, 1, 1).data, [255, 255, 0, 255]);
-    
+
     ctx.clearRect(0, 0, canvas.width, canvas.height);
     ctx.beginPath();
     var p5 = new Path2D();
@@ -45,7 +45,7 @@
     ctx.fillStyle = 'yellow';
     ctx.fill(p5);
     assert_array_equals(ctx.getImageData(101, 100, 1, 1).data, [0, 0, 0, 0]);
-    
+
     ctx.clearRect(0, 0, canvas.width, canvas.height);
     ctx.beginPath();
     var p7 = new Path2D();
@@ -53,12 +53,16 @@
     var p8 = new Path2D();
     p8.rect(100,100,100,100);
     p7.addPath(p8, null);
-    assert_throws(null, function() {p7.addPath(p8, []);});
-    assert_throws(null, function() {p7.addPath(p8, {});});
+    assert_throws(new TypeError(), function() {
+      p7.addPath(p8, []);
+    });
+    assert_throws(new TypeError(), function() {
+      p7.addPath(p8, {});
+    });
     ctx.fillStyle = 'red';
     ctx.fill(p7);
     assert_array_equals(ctx.getImageData(101, 100, 1, 1).data, [255, 0, 0, 255]);
-    
+
     ctx.clearRect(0, 0, canvas.width, canvas.height);
     ctx.beginPath();
     var p9 = new Path2D();
@@ -68,13 +72,18 @@
     ctx.fillStyle = 'red';
     ctx.fill(p10);
     assert_array_equals(ctx.getImageData(1, 1, 1, 1).data, [255, 0, 0, 255]);
-    
+
     var p9 = new Path2D();
     p9.rect(0,0,100,100);
-    assert_throws(null, function() {p7.addPath(null, m);});
-    assert_throws(null, function() {p7.addPath([], m);});
-    assert_throws(null, function() {p7.addPath({}, m);});
-    
+    assert_throws(new TypeError(), function() {
+      p7.addPath(null, m);
+    });
+    assert_throws(new TypeError(), function() {
+      p7.addPath([], m);
+    });
+    assert_throws(new TypeError(), function() {
+      p7.addPath({}, m);
+    });
 }, "Test addPath() method.");
 </script>
 </body>
diff --git a/third_party/WebKit/LayoutTests/fast/canvas/canvas-path-context-clip-expected.txt b/third_party/WebKit/LayoutTests/fast/canvas/canvas-path-context-clip-expected.txt
deleted file mode 100644
index fed463d..0000000
--- a/third_party/WebKit/LayoutTests/fast/canvas/canvas-path-context-clip-expected.txt
+++ /dev/null
@@ -1,4 +0,0 @@
-This is a testharness.js-based test.
-FAIL Series of tests to ensure clip() works with path and winding rule parameters. Test bug: need to pass exception to assert_throws()
-Harness: the test ran to completion.
-
diff --git a/third_party/WebKit/LayoutTests/fast/canvas/canvas-path-context-clip.html b/third_party/WebKit/LayoutTests/fast/canvas/canvas-path-context-clip.html
index c61e268..099a446 100644
--- a/third_party/WebKit/LayoutTests/fast/canvas/canvas-path-context-clip.html
+++ b/third_party/WebKit/LayoutTests/fast/canvas/canvas-path-context-clip.html
@@ -57,19 +57,45 @@
     }
 
     // Test exception cases.
-    assert_throws(null, function() {ctx.clip(null);});
-    assert_throws(null, function() {ctx.clip(null, null);});
-    assert_throws(null, function() {ctx.clip(null, 'nonzero');});
-    assert_throws(null, function() {ctx.clip(path, null);});
-    assert_throws(null, function() {ctx.clip([], 'nonzero');});
-    assert_throws(null, function() {ctx.clip({}, 'nonzero');});
-    assert_throws(null, function() {ctx.clip(null, 'evenodd');});
-    assert_throws(null, function() {ctx.clip([], 'evenodd');});
-    assert_throws(null, function() {ctx.clip({}, 'evenodd');});
-    assert_throws(null, function() {ctx.clip('gazonk');});
-    assert_throws(null, function() {ctx.clip(path, 'gazonk');});
-    assert_throws(null, function() {ctx.clip(undefined, undefined);});
-    assert_throws(null, function() {ctx.clip(undefined, 'nonzero');});
+    assert_throws(new TypeError(), function() {
+      ctx.clip(null);
+    });
+    assert_throws(new TypeError(), function() {
+      ctx.clip(null, null);
+    });
+    assert_throws(new TypeError(), function() {
+      ctx.clip(null, 'nonzero');
+    });
+    assert_throws(new TypeError(), function() {
+      ctx.clip(path, null);
+    });
+    assert_throws(new TypeError(), function() {
+      ctx.clip([], 'nonzero');
+    });
+    assert_throws(new TypeError(), function() {
+      ctx.clip({}, 'nonzero');
+    });
+    assert_throws(new TypeError(), function() {
+      ctx.clip(null, 'evenodd');
+    });
+    assert_throws(new TypeError(), function() {
+      ctx.clip([], 'evenodd');
+    });
+    assert_throws(new TypeError(), function() {
+      ctx.clip({}, 'evenodd');
+    });
+    assert_throws(new TypeError(), function() {
+      ctx.clip('gazonk');
+    });
+    assert_throws(new TypeError(), function() {
+      ctx.clip(path, 'gazonk');
+    });
+    assert_throws(new TypeError(), function() {
+      ctx.clip(undefined, undefined);
+    });
+    assert_throws(new TypeError(), function() {
+      ctx.clip(undefined, 'nonzero');
+    });
 }, 'Series of tests to ensure clip() works with path and winding rule parameters.');
 </script>
 </body>
diff --git a/third_party/WebKit/LayoutTests/fast/canvas/canvas-path-context-fill-expected.txt b/third_party/WebKit/LayoutTests/fast/canvas/canvas-path-context-fill-expected.txt
deleted file mode 100644
index 25ea92c..0000000
--- a/third_party/WebKit/LayoutTests/fast/canvas/canvas-path-context-fill-expected.txt
+++ /dev/null
@@ -1,4 +0,0 @@
-This is a testharness.js-based test.
-FAIL Series of tests to ensure fill() works with path and winding rule parameters. Test bug: need to pass exception to assert_throws()
-Harness: the test ran to completion.
-
diff --git a/third_party/WebKit/LayoutTests/fast/canvas/canvas-path-context-fill.html b/third_party/WebKit/LayoutTests/fast/canvas/canvas-path-context-fill.html
index 164cc79..8e31d62 100644
--- a/third_party/WebKit/LayoutTests/fast/canvas/canvas-path-context-fill.html
+++ b/third_party/WebKit/LayoutTests/fast/canvas/canvas-path-context-fill.html
@@ -55,19 +55,45 @@
     }
 
     // Test exception cases.
-    assert_throws(null, function() {ctx.fill(null);});
-    assert_throws(null, function() {ctx.fill(null, null);});
-    assert_throws(null, function() {ctx.fill(null, 'nonzero');});
-    assert_throws(null, function() {ctx.fill(path, null);});
-    assert_throws(null, function() {ctx.fill([], 'nonzero');});
-    assert_throws(null, function() {ctx.fill({}, 'nonzero');});
-    assert_throws(null, function() {ctx.fill(null, 'evenodd');});
-    assert_throws(null, function() {ctx.fill([], 'evenodd');});
-    assert_throws(null, function() {ctx.fill({}, 'evenodd');});
-    assert_throws(null, function() {ctx.fill('gazonk');});
-    assert_throws(null, function() {ctx.fill(path, 'gazonk');});
-    assert_throws(null, function() {ctx.fill(undefined, undefined);});
-    assert_throws(null, function() {ctx.fill(undefined, path);});
+    assert_throws(new TypeError(), function() {
+      ctx.fill(null);
+    });
+    assert_throws(new TypeError(), function() {
+      ctx.fill(null, null);
+    });
+    assert_throws(new TypeError(), function() {
+      ctx.fill(null, 'nonzero');
+    });
+    assert_throws(new TypeError(), function() {
+      ctx.fill(path, null);
+    });
+    assert_throws(new TypeError(), function() {
+      ctx.fill([], 'nonzero');
+    });
+    assert_throws(new TypeError(), function() {
+      ctx.fill({}, 'nonzero');
+    });
+    assert_throws(new TypeError(), function() {
+      ctx.fill(null, 'evenodd');
+    });
+    assert_throws(new TypeError(), function() {
+      ctx.fill([], 'evenodd');
+    });
+    assert_throws(new TypeError(), function() {
+      ctx.fill({}, 'evenodd');
+    });
+    assert_throws(new TypeError(), function() {
+      ctx.fill('gazonk');
+    });
+    assert_throws(new TypeError(), function() {
+      ctx.fill(path, 'gazonk');
+    });
+    assert_throws(new TypeError(), function() {
+      ctx.fill(undefined, undefined);
+    });
+    assert_throws(new TypeError(), function() {
+      ctx.fill(undefined, path);
+    });
 }, "Series of tests to ensure fill() works with path and winding rule parameters.");
 </script>
 </body>
diff --git a/third_party/WebKit/LayoutTests/fast/canvas/canvas-path-context-stroke-expected.txt b/third_party/WebKit/LayoutTests/fast/canvas/canvas-path-context-stroke-expected.txt
deleted file mode 100644
index dfbbe2d..0000000
--- a/third_party/WebKit/LayoutTests/fast/canvas/canvas-path-context-stroke-expected.txt
+++ /dev/null
@@ -1,4 +0,0 @@
-This is a testharness.js-based test.
-FAIL Series of tests to ensure stroke() works with optional path parameter. Test bug: need to pass exception to assert_throws()
-Harness: the test ran to completion.
-
diff --git a/third_party/WebKit/LayoutTests/fast/canvas/canvas-path-context-stroke.html b/third_party/WebKit/LayoutTests/fast/canvas/canvas-path-context-stroke.html
index 9025097..9bfc84d 100644
--- a/third_party/WebKit/LayoutTests/fast/canvas/canvas-path-context-stroke.html
+++ b/third_party/WebKit/LayoutTests/fast/canvas/canvas-path-context-stroke.html
@@ -40,10 +40,18 @@
     testStrokeWith(path);
 
     // Test exception cases.
-    assert_throws(null, function() {ctx.stroke(null);});
-    assert_throws(null, function() {ctx.stroke(undefined);});
-    assert_throws(null, function() {ctx.stroke([]);});
-    assert_throws(null, function() {ctx.stroke({});});
+    assert_throws(new TypeError(), function() {
+      ctx.stroke(null);
+    });
+    assert_throws(new TypeError(), function() {
+      ctx.stroke(undefined);
+    });
+    assert_throws(new TypeError(), function() {
+      ctx.stroke([]);
+    });
+    assert_throws(new TypeError(), function() {
+      ctx.stroke({});
+    });
 }, "Series of tests to ensure stroke() works with optional path parameter.");
 </script>
 </body>
diff --git a/third_party/WebKit/LayoutTests/fast/canvas/canvas-pattern-behaviour-expected.txt b/third_party/WebKit/LayoutTests/fast/canvas/canvas-pattern-behaviour-expected.txt
deleted file mode 100644
index 199c05e..0000000
--- a/third_party/WebKit/LayoutTests/fast/canvas/canvas-pattern-behaviour-expected.txt
+++ /dev/null
@@ -1,4 +0,0 @@
-This is a testharness.js-based test.
-FAIL Test the behavior of pattern use and construction. Test bug: need to pass exception to assert_throws()
-Harness: the test ran to completion.
-
diff --git a/third_party/WebKit/LayoutTests/fast/canvas/canvas-pattern-behaviour.html b/third_party/WebKit/LayoutTests/fast/canvas/canvas-pattern-behaviour.html
index 687bdac..0eab0b1 100644
--- a/third_party/WebKit/LayoutTests/fast/canvas/canvas-pattern-behaviour.html
+++ b/third_party/WebKit/LayoutTests/fast/canvas/canvas-pattern-behaviour.html
@@ -34,15 +34,31 @@
     pixelShouldBe(98, 1, [0, 128, 0, 255]);
     pixelShouldBe(1, 48, [0, 128, 0, 255]);
     pixelShouldBe(98, 48, [0, 128, 0, 255]);
- 
-    assert_throws(null, function() {context.createPattern(green1x1, 'null');});
-    assert_throws(null, function() {context.createPattern(green1x1, undefined);});
-    assert_throws(null, function() {context.createPattern(green1x1, 'undefined');});
-    assert_throws(null, function() {context.createPattern(green1x1, {toString:function(){ return null;}});});
-    assert_throws(null, function() {context.createPattern(null, '');});
-    assert_throws(null, function() {context.createPattern(undefined, '');});
-    assert_throws(null, function() {context.createPattern({}, '');});
-    assert_throws(null, function() {context.createPattern([], '');});
+
+    assert_throws("SYNTAX_ERR", function() {
+      context.createPattern(green1x1, 'null');
+    });
+    assert_throws("SYNTAX_ERR", function() {
+      context.createPattern(green1x1, undefined);
+    });
+    assert_throws("SYNTAX_ERR", function() {
+      context.createPattern(green1x1, 'undefined');
+    });
+    assert_throws("SYNTAX_ERR", function() {
+        context.createPattern(green1x1, {oString:function(){ return null;}});
+    });
+    assert_throws(new TypeError(), function() {
+      context.createPattern(null, '');
+    });
+    assert_throws(new TypeError(), function() {
+      context.createPattern(undefined, '');
+    });
+    assert_throws(new TypeError(), function() {
+      context.createPattern({}, '');
+    });
+    assert_throws(new TypeError(), function() {
+      context.createPattern([], '');
+    });
 
     pattern = context.createPattern(green1x1, '');
     context.fillStyle = pattern;
@@ -51,7 +67,7 @@
     pixelShouldBe(98, 1, [0, 128, 0, 255]);
     pixelShouldBe(1, 48, [0, 128, 0, 255]);
     pixelShouldBe(98, 48, [0, 128, 0, 255]);
-    
+
     pattern = context.createPattern(green1x1, {toString:function(){ return 'repeat';}});
     context.fillStyle = pattern;
     context.fillRect(0, 0, 100, 50);
diff --git a/third_party/WebKit/LayoutTests/fast/canvas/canvas-scale-shadowBlur-expected.txt b/third_party/WebKit/LayoutTests/fast/canvas/canvas-scale-shadowBlur-expected.txt
deleted file mode 100644
index 226d8ce..0000000
--- a/third_party/WebKit/LayoutTests/fast/canvas/canvas-scale-shadowBlur-expected.txt
+++ /dev/null
@@ -1,25 +0,0 @@
-This is a testharness.js-based test.
-Harness Error. harness_status.status = 1 , harness_status.message = 1 duplicate test name: "Verify bottom right 2"
-PASS Verify top left 1
-PASS Verify top left 2
-PASS Verify top left 3
-PASS Verify top left 4
-PASS Verify top left 5
-PASS Verify bottom left 1
-PASS Verify bottom left 2
-PASS Verify bottom left 3
-PASS Verify bottom left 4
-PASS Verify bottom left 5
-PASS Verify bottom left 6
-PASS Verify top right 1
-PASS Verify top right 2
-PASS Verify top right 3
-PASS Verify top right 4
-PASS Verify top right 5
-PASS Verify bottom right 1
-PASS Verify bottom right 2
-PASS Verify bottom right 3
-PASS Verify bottom right 2
-PASS Verify bottom right 2
-Harness: the test ran to completion.
-
diff --git a/third_party/WebKit/LayoutTests/fast/canvas/canvas-scale-shadowBlur.html b/third_party/WebKit/LayoutTests/fast/canvas/canvas-scale-shadowBlur.html
index 6dba9da..024b45ab 100644
--- a/third_party/WebKit/LayoutTests/fast/canvas/canvas-scale-shadowBlur.html
+++ b/third_party/WebKit/LayoutTests/fast/canvas/canvas-scale-shadowBlur.html
@@ -67,13 +67,12 @@
     ['Verify top right 3', 450, 325, [0, 0, 0, 0]],
     ['Verify top right 4', 375, 250, [0, 0, 0, 0]],
     ['Verify top right 5', 525, 250, [0, 0, 0, 0]],
-    
+
     ['Verify bottom right 1', 450, 450, [255, 0, 0, 126, 20]],
     ['Verify bottom right 2', 450, 375, [0, 0, 0, 0]],
     ['Verify bottom right 3', 450, 525, [0, 0, 0, 0]],
-    ['Verify bottom right 2', 375, 450, [0, 0, 0, 0]],
-    ['Verify bottom right 2', 525, 450, [0, 0, 0, 0]],
-    
+    ['Verify bottom right 4', 375, 450, [0, 0, 0, 0]],
+    ['Verify bottom right 5', 525, 450, [0, 0, 0, 0]],
 ];
 
 generate_tests(testPixelShadowBlur, testPixelShadowBlurScenarios);
diff --git a/third_party/WebKit/LayoutTests/fast/canvas/canvas-strokePath-alpha-shadow-expected.txt b/third_party/WebKit/LayoutTests/fast/canvas/canvas-strokePath-alpha-shadow-expected.txt
deleted file mode 100644
index 2fa1cf43..0000000
--- a/third_party/WebKit/LayoutTests/fast/canvas/canvas-strokePath-alpha-shadow-expected.txt
+++ /dev/null
@@ -1,24 +0,0 @@
-This is a testharness.js-based test.
-Harness Error. harness_status.status = 1 , harness_status.message = 1 duplicate test name: "Verify rotated blurry shadow 2"
-PASS Verify alpha shadow 1
-PASS Verify alpha shadow 2
-PASS Verify alpha shadow 3
-PASS Verify alpha shadow 4
-PASS Verify alpha shadow 5
-PASS Verify blurry shadow 1
-PASS Verify blurry shadow 2
-PASS Verify blurry shadow 3
-PASS Verify blurry shadow 4
-PASS Verify blurry shadow 5
-PASS Verify rotated alpha shadow 1
-PASS Verify rotated alpha shadow 2
-PASS Verify rotated alpha shadow 3
-PASS Verify rotated alpha shadow 4
-PASS Verify rotated alpha shadow 5
-PASS Verify rotated blurry shadow 1
-PASS Verify rotated blurry shadow 2
-PASS Verify rotated blurry shadow 3
-PASS Verify rotated blurry shadow 2
-PASS Verify rotated blurry shadow 2
-Harness: the test ran to completion.
-
diff --git a/third_party/WebKit/LayoutTests/fast/canvas/canvas-strokePath-alpha-shadow.html b/third_party/WebKit/LayoutTests/fast/canvas/canvas-strokePath-alpha-shadow.html
index b01883f..345b6faa 100644
--- a/third_party/WebKit/LayoutTests/fast/canvas/canvas-strokePath-alpha-shadow.html
+++ b/third_party/WebKit/LayoutTests/fast/canvas/canvas-strokePath-alpha-shadow.html
@@ -78,13 +78,12 @@
     ['Verify rotated alpha shadow 3', 400, 725, [255, 0, 0, 64, alphaTolerance]],
     ['Verify rotated alpha shadow 4', 325, 650, [255, 0, 0, 64, alphaTolerance]],
     ['Verify rotated alpha shadow 5', 475, 650, [255, 0, 0, 64, alphaTolerance]],
-    
+
     ['Verify rotated blurry shadow 1', 400, 900, [0, 0, 0, 0]],
     ['Verify rotated blurry shadow 2', 400, 800, [255, 0, 0, 31, alphaTolerance]],
     ['Verify rotated blurry shadow 3', 400, 1000, [255, 0, 0, 31, alphaTolerance]],
-    ['Verify rotated blurry shadow 2', 300, 900, [255, 0, 0, 31, alphaTolerance]],
-    ['Verify rotated blurry shadow 2', 500, 900, [255, 0, 0, 31, alphaTolerance]],
-    
+    ['Verify rotated blurry shadow 4', 300, 900, [255, 0, 0, 31, alphaTolerance]],
+    ['Verify rotated blurry shadow 5', 500, 900, [255, 0, 0, 31, alphaTolerance]],
 ];
 
 generate_tests(testPixelAlphaShadow, testPixelAlphaShadowScenarios);
diff --git a/third_party/WebKit/LayoutTests/fast/canvas/canvas-with-incorrect-args-expected.txt b/third_party/WebKit/LayoutTests/fast/canvas/canvas-with-incorrect-args-expected.txt
deleted file mode 100644
index 5774651..0000000
--- a/third_party/WebKit/LayoutTests/fast/canvas/canvas-with-incorrect-args-expected.txt
+++ /dev/null
@@ -1,4 +0,0 @@
-This is a testharness.js-based test.
-FAIL Verify the behavior of a number of the DOM Canvas drawing methods when given 0, Infinity, or NaN as parameters. Test should not crash. Test bug: need to pass exception to assert_throws()
-Harness: the test ran to completion.
-
diff --git a/third_party/WebKit/LayoutTests/fast/canvas/draw-focus-if-needed-expected.txt b/third_party/WebKit/LayoutTests/fast/canvas/draw-focus-if-needed-expected.txt
deleted file mode 100644
index f8acc20..0000000
--- a/third_party/WebKit/LayoutTests/fast/canvas/draw-focus-if-needed-expected.txt
+++ /dev/null
@@ -1,4 +0,0 @@
-This is a testharness.js-based test.
-FAIL Canvas test: drawFocusIfNeeded Test bug: need to pass exception to assert_throws()
-Harness: the test ran to completion.
-
diff --git a/third_party/WebKit/LayoutTests/fast/canvas/draw-focus-if-needed-with-path2d-expected.txt b/third_party/WebKit/LayoutTests/fast/canvas/draw-focus-if-needed-with-path2d-expected.txt
deleted file mode 100644
index 2bf2a12..0000000
--- a/third_party/WebKit/LayoutTests/fast/canvas/draw-focus-if-needed-with-path2d-expected.txt
+++ /dev/null
@@ -1,4 +0,0 @@
-This is a testharness.js-based test.
-FAIL Canvas test: drawFocusIfNeeded with Path2D Test bug: need to pass exception to assert_throws()
-Harness: the test ran to completion.
-
diff --git a/third_party/WebKit/LayoutTests/fast/canvas/draw-focus-if-needed-with-path2d.html b/third_party/WebKit/LayoutTests/fast/canvas/draw-focus-if-needed-with-path2d.html
index 479a692..4fa0c8c 100644
--- a/third_party/WebKit/LayoutTests/fast/canvas/draw-focus-if-needed-with-path2d.html
+++ b/third_party/WebKit/LayoutTests/fast/canvas/draw-focus-if-needed-with-path2d.html
@@ -8,43 +8,54 @@
 
 <script>
 test(function(t) {
-
     document.getElementById("button1").focus();
-    
     var canvas = document.getElementById("canvas").getContext("2d");
-    
-    assert_throws(null, function(){canvas.drawFocusIfNeeded(undefined);});
-    assert_throws(null, function(){canvas.drawFocusIfNeeded(undefined, undefined);});
-    assert_throws(null, function(){canvas.drawFocusIfNeeded(null);});
-    assert_throws(null, function(){canvas.drawFocusIfNeeded(null, null);});
-    assert_throws(null, function(){canvas.drawFocusIfNeeded();});
-    
+
+    assert_throws(new TypeError(), function() {
+      canvas.drawFocusIfNeeded(undefined);
+    });
+    assert_throws(new TypeError(), function() {
+      canvas.drawFocusIfNeeded(undefined, undefined);
+    });
+    assert_throws(new TypeError(), function() {
+      canvas.drawFocusIfNeeded(null);
+    });
+    assert_throws(new TypeError(), function() {
+      canvas.drawFocusIfNeeded(null, null);
+    });
+    assert_throws(new TypeError(), function() {
+      canvas.drawFocusIfNeeded();
+    });
+
     var path = new Path2D();
     path.rect(50, 50, 200, 100);
     canvas.fillStyle = "#ccf";
     canvas.fill(path);
     // re-test null case after having defined a path (regression test for crbug.com/353248)
-    assert_throws(null, function(){canvas.drawFocusIfNeeded(null);});
-    assert_throws(null, function(){canvas.drawFocusIfNeeded(null, null);});
+    assert_throws(new TypeError(), function() {
+      canvas.drawFocusIfNeeded(null);
+    });
+    assert_throws(new TypeError(), function() {
+      canvas.drawFocusIfNeeded(null, null);
+    });
     canvas.drawFocusIfNeeded(path, document.getElementById("button1"));
-    
+
     path = new Path2D();
     path.rect(50, 200, 200, 100);
     canvas.fillStyle = "#cfc";
     canvas.fill(path);
     canvas.drawFocusIfNeeded(path, document.getElementById("button2"));
-    
+
     // The top rect"s focus ring is tied to button1, which is focused.
     // It should have an outline in some color other than the background color.
     var imageData = canvas.getImageData(49, 50, 1, 1);
     var data = imageData.data;
     assert_true(data[0] != 0 || data[1] != 0 || data[2] != 0);
-    
+
     // The bottom rect"s focus ring is tied to button2, which is not focused.
     imageData = canvas.getImageData(49, 200, 1, 1);
     data = imageData.data;
     assert_true(data[0] == 0 && data[1] == 0 && data[2] == 0);
-    
 }, 'Canvas test: drawFocusIfNeeded with Path2D');
 </script>
 </body>
diff --git a/third_party/WebKit/LayoutTests/fast/canvas/draw-focus-if-needed.html b/third_party/WebKit/LayoutTests/fast/canvas/draw-focus-if-needed.html
index 394f4b9..8b3a268 100644
--- a/third_party/WebKit/LayoutTests/fast/canvas/draw-focus-if-needed.html
+++ b/third_party/WebKit/LayoutTests/fast/canvas/draw-focus-if-needed.html
@@ -11,37 +11,41 @@
 test(function(t) {
 
     document.getElementById("button1").focus();
-    
     var canvas = document.getElementById("canvas").getContext("2d");
-    
-    assert_throws(null, function(){canvas.drawFocusIfNeeded(null);});
-    assert_throws(null, function(){canvas.drawFocusIfNeeded();});
-    
+
+    assert_throws(new TypeError(), function() {
+      canvas.drawFocusIfNeeded(null);
+    });
+    assert_throws(new TypeError(), function() {
+      canvas.drawFocusIfNeeded();
+    });
+
     canvas.beginPath();
     canvas.rect(50, 50, 200, 100);
     canvas.fillStyle = "#ccf";
     canvas.fill();
     // re-test null case after having defined a path (regression test for crbug.com/353248)
-    assert_throws(null, function(){canvas.drawFocusIfNeeded(null);});
+    assert_throws(new TypeError(), function() {
+      canvas.drawFocusIfNeeded(null);
+    });
     canvas.drawFocusIfNeeded(document.getElementById("button1"));
-    
+
     canvas.beginPath();
     canvas.rect(50, 200, 200, 100);
     canvas.fillStyle = "#cfc";
     canvas.fill();
     canvas.drawFocusIfNeeded(document.getElementById("button2"));
-    
+
     // The top rect's focus ring is tied to button1, which is focused.
     // It should have an outline in some color other than the background color.
     var imageData = canvas.getImageData(49, 50, 1, 1);
     var data = imageData.data;
     assert_true(data[0] != 0 || data[1] != 0 || data[2] != 0);
-    
+
     // The bottom rect"s focus ring is tied to button2, which is not focused.
     imageData = canvas.getImageData(49, 200, 1, 1);
     data = imageData.data;
     assert_true(data[0] == 0 && data[1] == 0 && data[2] == 0);
-    
 }, 'Canvas test: drawFocusIfNeeded');
 </script>
 </body>
diff --git a/third_party/WebKit/LayoutTests/fast/canvas/gradient-addColorStop-with-invalid-color-expected.txt b/third_party/WebKit/LayoutTests/fast/canvas/gradient-addColorStop-with-invalid-color-expected.txt
deleted file mode 100644
index 8107bb1..0000000
--- a/third_party/WebKit/LayoutTests/fast/canvas/gradient-addColorStop-with-invalid-color-expected.txt
+++ /dev/null
@@ -1,4 +0,0 @@
-This is a testharness.js-based test.
-FAIL This test checks invalid colors on gradients. Test bug: need to pass exception to assert_throws()
-Harness: the test ran to completion.
-
diff --git a/third_party/WebKit/LayoutTests/fast/canvas/gradient-addColorStop-with-invalid-color.html b/third_party/WebKit/LayoutTests/fast/canvas/gradient-addColorStop-with-invalid-color.html
deleted file mode 100644
index d731bc77..0000000
--- a/third_party/WebKit/LayoutTests/fast/canvas/gradient-addColorStop-with-invalid-color.html
+++ /dev/null
@@ -1,17 +0,0 @@
-<script src="../../resources/testharness.js"></script>
-<script src="../../resources/testharnessreport.js"></script>
-<script>
-test(function(){
-
-    var gradient = document.createElement('canvas').getContext('2d').createLinearGradient(0, 0, 150, 0);
-
-    assert_throws(null, function(){gradient.addColorStop(0, '');}, '"SyntaxError: Failed to execute \'addColorStop\' on \'CanvasGradient\': The value provided (\'\') could not be parsed as a color."');
-
-    assert_throws(null, function(){gradient.addColorStop(0, '#cc');}, '"SyntaxError: Failed to execute \'addColorStop\' on \'CanvasGradient\': The value provided (\'#cc\') could not be parsed as a color."');
-
-    assert_throws(null, function(){gradient.addColorStop(0, 'rgb(257, 0)');}, '"SyntaxError: Failed to execute \'addColorStop\' on \'CanvasGradient\': The value provided (\'rgb(257, 0)\') could not be parsed as a color."');
-
-    assert_throws(null, function(){gradient.addColorStop(0, 'rgb(257, 0, 5, 0)');}, '"SyntaxError: Failed to execute \'addColorStop\' on \'CanvasGradient\': The value provided (\'rgb(257, 0, 5, 0)\') could not be parsed as a color."');
-
-}, 'This test checks invalid colors on gradients.');
-</script>
diff --git a/third_party/WebKit/LayoutTests/fast/canvas/gradient-addColorStop-with-invalid-offset-expected.txt b/third_party/WebKit/LayoutTests/fast/canvas/gradient-addColorStop-with-invalid-offset-expected.txt
deleted file mode 100644
index 8258c88..0000000
--- a/third_party/WebKit/LayoutTests/fast/canvas/gradient-addColorStop-with-invalid-offset-expected.txt
+++ /dev/null
@@ -1,4 +0,0 @@
-This is a testharness.js-based test.
-FAIL This test checks invalid offsets on gradients. Test bug: need to pass exception to assert_throws()
-Harness: the test ran to completion.
-
diff --git a/third_party/WebKit/LayoutTests/fast/canvas/gradient-addColorStop-with-invalid-offset.html b/third_party/WebKit/LayoutTests/fast/canvas/gradient-addColorStop-with-invalid-offset.html
deleted file mode 100644
index c2640a4..0000000
--- a/third_party/WebKit/LayoutTests/fast/canvas/gradient-addColorStop-with-invalid-offset.html
+++ /dev/null
@@ -1,15 +0,0 @@
-<script src="../../resources/testharness.js"></script>
-<script src="../../resources/testharnessreport.js"></script>
-<script>
-test(function() {
-
-    var gradient = document.createElement('canvas').getContext('2d').createLinearGradient(0, 0, 150, 0);
-
-    assert_throws(null, function(){gradient.addColorStop(-1, '#000');});
-    assert_throws(null, function(){gradient.addColorStop(2, '#000');});
-    assert_throws(null, function(){gradient.addColorStop(Infinity, '#000');});
-    assert_throws(null, function(){gradient.addColorStop(-Infinity, '#000');});
-    assert_throws(null, function(){gradient.addColorStop(NaN, '#000');});
-
-}, 'This test checks invalid offsets on gradients.');
-</script>
diff --git a/third_party/WebKit/LayoutTests/fast/canvas/linearGradient-infinite-values-expected.txt b/third_party/WebKit/LayoutTests/fast/canvas/linearGradient-infinite-values-expected.txt
deleted file mode 100644
index 49ee20d9..0000000
--- a/third_party/WebKit/LayoutTests/fast/canvas/linearGradient-infinite-values-expected.txt
+++ /dev/null
@@ -1,15 +0,0 @@
-This is a testharness.js-based test.
-FAIL Test createLinearGradient(0, 0, 100, NaN) Test bug: need to pass exception to assert_throws()
-FAIL Test createLinearGradient(0, 0, 100, Infinity) Test bug: need to pass exception to assert_throws()
-FAIL Test createLinearGradient(0, 0, 100, -Infinity) Test bug: need to pass exception to assert_throws()
-FAIL Test createLinearGradient(0, 0, NaN, 100) Test bug: need to pass exception to assert_throws()
-FAIL Test createLinearGradient(0, 0, Infinity, 100) Test bug: need to pass exception to assert_throws()
-FAIL Test createLinearGradient(0, 0, -Infinity, 100) Test bug: need to pass exception to assert_throws()
-FAIL Test createLinearGradient(0, NaN, 100, 100) Test bug: need to pass exception to assert_throws()
-FAIL Test createLinearGradient(0, Infinity, 100, 100) Test bug: need to pass exception to assert_throws()
-FAIL Test createLinearGradient(0, -Infinity, 100, 100) Test bug: need to pass exception to assert_throws()
-FAIL Test createLinearGradient(NaN, 0, 100, 100) Test bug: need to pass exception to assert_throws()
-FAIL Test createLinearGradient(Infinity, 0, 100, 100) Test bug: need to pass exception to assert_throws()
-FAIL Test createLinearGradient(-Infinity, 0, 100, 100) Test bug: need to pass exception to assert_throws()
-Harness: the test ran to completion.
-
diff --git a/third_party/WebKit/Source/core/exported/WebPagePopupImpl.cpp b/third_party/WebKit/Source/core/exported/WebPagePopupImpl.cpp
index b7c52bd..23694e0 100644
--- a/third_party/WebKit/Source/core/exported/WebPagePopupImpl.cpp
+++ b/third_party/WebKit/Source/core/exported/WebPagePopupImpl.cpp
@@ -321,9 +321,7 @@
   RefPtr<SharedBuffer> data = SharedBuffer::Create();
   popup_client_->WriteDocument(data.Get());
   frame->SetPageZoomFactor(popup_client_->ZoomFactor());
-  frame->Loader().Load(
-      FrameLoadRequest(0, ResourceRequest(BlankURL()),
-                       SubstituteData(data, kForceSynchronousLoad)));
+  frame->ForceSynchronousDocumentInstall("text/html", data);
   return true;
 }
 
diff --git a/third_party/WebKit/Source/core/frame/LocalFrame.cpp b/third_party/WebKit/Source/core/frame/LocalFrame.cpp
index 84b29312..01e50a8 100644
--- a/third_party/WebKit/Source/core/frame/LocalFrame.cpp
+++ b/third_party/WebKit/Source/core/frame/LocalFrame.cpp
@@ -37,6 +37,7 @@
 #include "core/CoreProbeSink.h"
 #include "core/css/StyleChangeReason.h"
 #include "core/dom/ChildFrameDisconnector.h"
+#include "core/dom/DocumentParser.h"
 #include "core/dom/DocumentType.h"
 #include "core/dom/events/Event.h"
 #include "core/editing/EditingUtilities.h"
@@ -1111,6 +1112,30 @@
   }
 }
 
+void LocalFrame::ForceSynchronousDocumentInstall(const AtomicString& mime_type,
+                                                 RefPtr<SharedBuffer> data) {
+  CHECK(loader_.StateMachine()->IsDisplayingInitialEmptyDocument());
+  DCHECK(!Client()->IsLocalFrameClientImpl());
+
+  // Any Document requires Shutdown() before detach, even the initial empty
+  // document.
+  GetDocument()->Shutdown();
+
+  DomWindow()->InstallNewDocument(
+      mime_type, DocumentInit::Create().WithFrame(this), false);
+  loader_.StateMachine()->AdvanceTo(
+      FrameLoaderStateMachine::kCommittedFirstRealLoad);
+
+  GetDocument()->OpenForNavigation(kForceSynchronousParsing, mime_type,
+                                   AtomicString("UTF-8"));
+  data->ForEachSegment(
+      [this](const char* segment, size_t segment_size, size_t segment_offset) {
+        GetDocument()->Parser()->AppendBytes(segment, segment_size);
+        return true;
+      });
+  GetDocument()->Parser()->Finish();
+}
+
 void LocalFrame::NotifyUserActivation() {
   bool had_gesture = HasReceivedUserGesture();
   if (!had_gesture)
diff --git a/third_party/WebKit/Source/core/frame/LocalFrame.h b/third_party/WebKit/Source/core/frame/LocalFrame.h
index 2fc0744..d8f3533 100644
--- a/third_party/WebKit/Source/core/frame/LocalFrame.h
+++ b/third_party/WebKit/Source/core/frame/LocalFrame.h
@@ -274,6 +274,12 @@
       LocalFrame*,
       UserGestureToken::Status = UserGestureToken::kPossiblyExistingGesture);
 
+  // Replaces the initial empty document with a Document suitable for
+  // |mime_type| and populated with the contents of |data|. Only intended for
+  // use in internal-implementation LocalFrames that aren't in the frame tree.
+  void ForceSynchronousDocumentInstall(const AtomicString& mime_type,
+                                       RefPtr<SharedBuffer> data);
+
  private:
   friend class FrameNavigationDisabler;
 
diff --git a/third_party/WebKit/Source/core/inspector/InspectorOverlayAgent.cpp b/third_party/WebKit/Source/core/inspector/InspectorOverlayAgent.cpp
index bfbd770..e46a6b0 100644
--- a/third_party/WebKit/Source/core/inspector/InspectorOverlayAgent.cpp
+++ b/third_party/WebKit/Source/core/inspector/InspectorOverlayAgent.cpp
@@ -850,15 +850,13 @@
       LocalFrame::Create(&dummy_local_frame_client, *overlay_page_, 0);
   frame->SetView(LocalFrameView::Create(*frame));
   frame->Init();
-  FrameLoader& loader = frame->Loader();
   frame->View()->SetCanHaveScrollbars(false);
   frame->View()->SetBaseBackgroundColor(Color::kTransparent);
 
   const WebData& overlay_page_html_resource =
       Platform::Current()->GetDataResource("InspectorOverlayPage.html");
-  loader.Load(FrameLoadRequest(
-      0, ResourceRequest(BlankURL()),
-      SubstituteData(overlay_page_html_resource, kForceSynchronousLoad)));
+  frame->ForceSynchronousDocumentInstall("text/html",
+                                         overlay_page_html_resource);
   v8::Isolate* isolate = ToIsolate(frame);
   ScriptState* script_state = ToScriptStateForMainWorld(frame);
   DCHECK(script_state);
diff --git a/third_party/WebKit/Source/core/layout/ng/ng_length_utils.cc b/third_party/WebKit/Source/core/layout/ng/ng_length_utils.cc
index 1c1224a..65cb0a2 100644
--- a/third_party/WebKit/Source/core/layout/ng/ng_length_utils.cc
+++ b/third_party/WebKit/Source/core/layout/ng/ng_length_utils.cc
@@ -391,7 +391,8 @@
                                        LayoutUnit available_size) {
   int used_count = ResolveUsedColumnCount(computed_count, computed_size,
                                           used_gap, available_size);
-  return ((available_size + used_gap) / used_count) - used_gap;
+  return std::max(((available_size + used_gap) / used_count) - used_gap,
+                  LayoutUnit());
 }
 
 LayoutUnit ResolveUsedColumnInlineSize(LayoutUnit available_size,
diff --git a/third_party/WebKit/Source/core/layout/ng/ng_length_utils_test.cc b/third_party/WebKit/Source/core/layout/ng/ng_length_utils_test.cc
index dcff080..abaa4d0d 100644
--- a/third_party/WebKit/Source/core/layout/ng/ng_length_utils_test.cc
+++ b/third_party/WebKit/Source/core/layout/ng/ng_length_utils_test.cc
@@ -497,6 +497,9 @@
   EXPECT_EQ(5, GetUsedColumnCount(6, 100, 10, 540));
   EXPECT_EQ(100, GetUsedColumnWidth(0, 100, 10, 540));
   EXPECT_EQ(5, GetUsedColumnCount(0, 100, 10, 540));
+
+  EXPECT_EQ(0, GetUsedColumnWidth(3, 0, 10, 10));
+  EXPECT_EQ(3, GetUsedColumnCount(3, 0, 10, 10));
 }
 
 }  // namespace
diff --git a/third_party/WebKit/Source/core/loader/DocumentLoader.cpp b/third_party/WebKit/Source/core/loader/DocumentLoader.cpp
index 6761803..1fd9b2ba 100644
--- a/third_party/WebKit/Source/core/loader/DocumentLoader.cpp
+++ b/third_party/WebKit/Source/core/loader/DocumentLoader.cpp
@@ -680,8 +680,7 @@
   DCHECK(frame_->GetPage());
 
   ParserSynchronizationPolicy parsing_policy = kAllowAsynchronousParsing;
-  if ((substitute_data_.IsValid() && substitute_data_.ForceSynchronousLoad()) ||
-      !Document::ThreadedParsingEnabledForTesting())
+  if (!Document::ThreadedParsingEnabledForTesting())
     parsing_policy = kForceSynchronousParsing;
 
   InstallNewDocument(Url(), owner_document, should_reuse_default_view,
diff --git a/third_party/WebKit/Source/core/loader/resource/ImageResourceContent.cpp b/third_party/WebKit/Source/core/loader/resource/ImageResourceContent.cpp
index edb7bf4..386d0712 100644
--- a/third_party/WebKit/Source/core/loader/resource/ImageResourceContent.cpp
+++ b/third_party/WebKit/Source/core/loader/resource/ImageResourceContent.cpp
@@ -551,10 +551,7 @@
     }
   }
 
-  if (image_->AnimationPolicy() != new_policy) {
-    image_->ResetAnimation();
-    image_->SetAnimationPolicy(new_policy);
-  }
+  image_->SetAnimationPolicy(new_policy);
 }
 
 void ImageResourceContent::ChangedInRect(const blink::Image* image,
diff --git a/third_party/WebKit/Source/core/page/ValidationMessageOverlayDelegate.cpp b/third_party/WebKit/Source/core/page/ValidationMessageOverlayDelegate.cpp
index ad3cac1..07b37a73 100644
--- a/third_party/WebKit/Source/core/page/ValidationMessageOverlayDelegate.cpp
+++ b/third_party/WebKit/Source/core/page/ValidationMessageOverlayDelegate.cpp
@@ -154,10 +154,7 @@
   // Propagate deprecated DSF for platforms without use-zoom-for-dsf.
   page_->SetDeviceScaleFactorDeprecated(
       main_page_->DeviceScaleFactorDeprecated());
-  frame->Loader().Load(
-      FrameLoadRequest(nullptr, ResourceRequest(BlankURL()),
-                       SubstituteData(data, "text/html", "UTF-8", KURL(),
-                                      kForceSynchronousLoad)));
+  frame->ForceSynchronousDocumentInstall("text/html", data);
 
   Element& container = GetElementById("container");
   if (LayoutTestSupport::IsRunningLayoutTest()) {
diff --git a/third_party/WebKit/Source/core/svg/graphics/SVGImage.cpp b/third_party/WebKit/Source/core/svg/graphics/SVGImage.cpp
index cb9c1c7..0b7a088 100644
--- a/third_party/WebKit/Source/core/svg/graphics/SVGImage.cpp
+++ b/third_party/WebKit/Source/core/svg/graphics/SVGImage.cpp
@@ -29,6 +29,7 @@
 
 #include "core/animation/DocumentAnimations.h"
 #include "core/animation/DocumentTimeline.h"
+#include "core/dom/DocumentParser.h"
 #include "core/dom/FlatTreeTraversal.h"
 #include "core/dom/NodeTraversal.h"
 #include "core/dom/TaskRunnerHelper.h"
@@ -793,10 +794,8 @@
   page_ = page;
 
   TRACE_EVENT0("blink", "SVGImage::dataChanged::load");
-  loader.Load(FrameLoadRequest(
-      0, ResourceRequest(BlankURL()),
-      SubstituteData(Data(), AtomicString("image/svg+xml"),
-                     AtomicString("UTF-8"), NullURL(), kForceSynchronousLoad)));
+
+  frame->ForceSynchronousDocumentInstall("image/svg+xml", Data());
 
   // Set the concrete object size before a container size is available.
   intrinsic_size_ = RoundedIntSize(ConcreteObjectSize(FloatSize(
diff --git a/third_party/WebKit/Source/devtools/front_end/console/ConsoleView.js b/third_party/WebKit/Source/devtools/front_end/console/ConsoleView.js
index 5205bd9..5416f766 100644
--- a/third_party/WebKit/Source/devtools/front_end/console/ConsoleView.js
+++ b/third_party/WebKit/Source/devtools/front_end/console/ConsoleView.js
@@ -1019,8 +1019,8 @@
     this._filterByExecutionContextSetting.addChangeListener(this._filterChanged);
     this._filterByConsoleAPISetting.addChangeListener(this._filterChanged);
 
-    this._textFilterUI = new UI.ToolbarInput(Common.UIString('Filter'), 0.2, 1);
-    this._textFilterUI.element.title = Common.UIString('e.g. /event\\d/ -cdn url:a.com');
+    this._textFilterUI =
+        new UI.ToolbarInput(Common.UIString('Filter'), 0.2, 1, Common.UIString('e.g. /event\\d/ -cdn url:a.com'));
     this._textFilterUI.addEventListener(UI.ToolbarInput.Event.TextChanged, this._textFilterChanged, this);
     this._filterParser = new TextUtils.FilterParser(Object.values(Console.ConsoleViewFilter._filterType));
     /** @type {!Array<!TextUtils.FilterParser.ParsedFilter>} */
diff --git a/third_party/WebKit/Source/devtools/front_end/ui/TextPrompt.js b/third_party/WebKit/Source/devtools/front_end/ui/TextPrompt.js
index 8de1500d..219bb8e6 100644
--- a/third_party/WebKit/Source/devtools/front_end/ui/TextPrompt.js
+++ b/third_party/WebKit/Source/devtools/front_end/ui/TextPrompt.js
@@ -202,6 +202,16 @@
       this._element.removeAttribute('data-placeholder');
   }
 
+  /**
+   * @param {boolean} enabled
+   */
+  setEnabled(enabled) {
+    if (enabled)
+      this._element.setAttribute('contenteditable', 'plaintext-only');
+    else
+      this._element.removeAttribute('contenteditable');
+  }
+
   _removeFromElement() {
     this.clearAutocomplete();
     this._element.removeEventListener('keydown', this._boundOnKeyDown, false);
diff --git a/third_party/WebKit/Source/devtools/front_end/ui/Toolbar.js b/third_party/WebKit/Source/devtools/front_end/ui/Toolbar.js
index d503020..a798c20 100644
--- a/third_party/WebKit/Source/devtools/front_end/ui/Toolbar.js
+++ b/third_party/WebKit/Source/devtools/front_end/ui/Toolbar.js
@@ -575,25 +575,33 @@
    * @param {string} placeholder
    * @param {number=} growFactor
    * @param {number=} shrinkFactor
+   * @param {string=} tooltip
    */
-  constructor(placeholder, growFactor, shrinkFactor) {
+  constructor(placeholder, growFactor, shrinkFactor, tooltip) {
     super(createElementWithClass('div', 'toolbar-input'));
 
-    this.input = this.element.createChild('input');
-    this.input.addEventListener('focus', () => this.element.classList.add('focused'));
-    this.input.addEventListener('blur', () => this.element.classList.remove('focused'));
-    this.input.addEventListener('input', () => this._onChangeCallback(), false);
+    var internalPromptElement = this.element.createChild('div', 'toolbar-input-prompt');
+    internalPromptElement.addEventListener('focus', () => this.element.classList.add('focused'));
+    internalPromptElement.addEventListener('blur', () => this.element.classList.remove('focused'));
+
+    this._prompt = new UI.TextPrompt();
+    this._proxyElement = this._prompt.attach(internalPromptElement);
+    this._proxyElement.classList.add('toolbar-prompt-proxy');
+    this._proxyElement.addEventListener('keydown', event => this._onKeydownCallback(event));
+    this._prompt.initialize(() => Promise.resolve([]));
+    if (tooltip)
+      this._prompt.setTitle(tooltip);
+    this._prompt.setPlaceholder(placeholder);
+    this._prompt.addEventListener(UI.TextPrompt.Events.TextChanged, this._onChangeCallback.bind(this));
+
     if (growFactor)
       this.element.style.flexGrow = growFactor;
     if (shrinkFactor)
       this.element.style.flexShrink = shrinkFactor;
-    if (placeholder)
-      this.input.setAttribute('placeholder', placeholder);
 
     var clearButton = this.element.createChild('div', 'toolbar-input-clear-button');
     clearButton.appendChild(UI.Icon.create('mediumicon-gray-cross-hover', 'search-cancel-button'));
     clearButton.addEventListener('click', () => this._internalSetValue('', true));
-    this.input.addEventListener('keydown', event => this._onKeydownCallback(event));
 
     this._updateEmptyStyles();
   }
@@ -603,7 +611,7 @@
    * @param {boolean} enabled
    */
   _applyEnabledState(enabled) {
-    this.input.disabled = !enabled;
+    this._prompt.setEnabled(enabled);
   }
 
   /**
@@ -618,7 +626,7 @@
    * @param {boolean} notify
    */
   _internalSetValue(value, notify) {
-    this.input.value = value;
+    this._prompt.setText(value);
     if (notify)
       this._onChangeCallback();
     this._updateEmptyStyles();
@@ -628,14 +636,16 @@
    * @return {string}
    */
   value() {
-    return this.input.value;
+    return this._prompt.text();
   }
 
   /**
    * @param {!Event} event
    */
   _onKeydownCallback(event) {
-    if (!isEscKey(event) || !this.input.value)
+    if (isEnterKey(event))
+      event.consume(true);
+    if (!isEscKey(event) || !this._prompt.text())
       return;
     this._internalSetValue('', true);
     event.consume(true);
@@ -643,11 +653,11 @@
 
   _onChangeCallback() {
     this._updateEmptyStyles();
-    this.dispatchEventToListeners(UI.ToolbarInput.Event.TextChanged, this.input.value);
+    this.dispatchEventToListeners(UI.ToolbarInput.Event.TextChanged, this._prompt.text());
   }
 
   _updateEmptyStyles() {
-    this.element.classList.toggle('toolbar-input-empty', !this.input.value);
+    this.element.classList.toggle('toolbar-input-empty', !this._prompt.text());
   }
 };
 
diff --git a/third_party/WebKit/Source/devtools/front_end/ui/toolbar.css b/third_party/WebKit/Source/devtools/front_end/ui/toolbar.css
index 1daebccc..cd03a781 100644
--- a/third_party/WebKit/Source/devtools/front_end/ui/toolbar.css
+++ b/third_party/WebKit/Source/devtools/front_end/ui/toolbar.css
@@ -223,8 +223,8 @@
 
 .toolbar-input {
     width: 120px;
-    height: 20px;
-    padding: 3px;
+    height: 19px;
+    padding: 4px 3px 3px 3px;
     margin: 1px 3px;
     background-color: white;
     border: solid 1px #d8d8d8;
@@ -257,6 +257,17 @@
     display: none;
 }
 
+.toolbar-prompt-proxy {
+    flex: 1;
+}
+
+.toolbar-input-prompt {
+    flex: 1;
+    overflow: hidden;
+    white-space: nowrap;
+    cursor: auto;
+}
+
 /* Separator */
 
 .toolbar-divider {
diff --git a/third_party/WebKit/Source/modules/webaudio/BaseAudioContext.h b/third_party/WebKit/Source/modules/webaudio/BaseAudioContext.h
index cb7714f..5cc8e10 100644
--- a/third_party/WebKit/Source/modules/webaudio/BaseAudioContext.h
+++ b/third_party/WebKit/Source/modules/webaudio/BaseAudioContext.h
@@ -122,7 +122,7 @@
 
   // Document notification
   void ContextDestroyed(ExecutionContext*) final;
-  bool HasPendingActivity() const final;
+  bool HasPendingActivity() const;
 
   // Cannnot be called from the audio thread.
   AudioDestinationNode* destination() const;
diff --git a/third_party/WebKit/Source/modules/webaudio/OfflineAudioContext.cpp b/third_party/WebKit/Source/modules/webaudio/OfflineAudioContext.cpp
index 5e90528d..59b66e71 100644
--- a/third_party/WebKit/Source/modules/webaudio/OfflineAudioContext.cpp
+++ b/third_party/WebKit/Source/modules/webaudio/OfflineAudioContext.cpp
@@ -367,6 +367,8 @@
     complete_resolver_->Reject(DOMException::Create(
         kInvalidStateError, "the execution context does not exist"));
   }
+
+  is_rendering_started_ = false;
 }
 
 bool OfflineAudioContext::HandlePreOfflineRenderTasks() {
@@ -458,4 +460,8 @@
   return false;
 }
 
+bool OfflineAudioContext::HasPendingActivity() const {
+  return is_rendering_started_;
+}
+
 }  // namespace blink
diff --git a/third_party/WebKit/Source/modules/webaudio/OfflineAudioContext.h b/third_party/WebKit/Source/modules/webaudio/OfflineAudioContext.h
index 4dbfa26..26285705 100644
--- a/third_party/WebKit/Source/modules/webaudio/OfflineAudioContext.h
+++ b/third_party/WebKit/Source/modules/webaudio/OfflineAudioContext.h
@@ -94,6 +94,9 @@
 
   using OfflineGraphAutoLocker = DeferredTaskHandler::OfflineGraphAutoLocker;
 
+  // Document notification
+  bool HasPendingActivity() const final;
+
  private:
   OfflineAudioContext(Document*,
                       unsigned number_of_channels,
@@ -121,9 +124,10 @@
 
   Member<ScriptPromiseResolver> complete_resolver_;
 
-  // This flag is necessary to indicate the rendering has actually started.
-  // Note that initial state of context is 'Suspended', which is the same
-  // state when the context is suspended.
+  // This flag is necessary to indicate the rendering has actually started or
+  // running. Note that initial state of context is 'Suspended', which is the
+  // same state when the context is suspended, so we cannot utilize it for this
+  // purpose.
   bool is_rendering_started_;
 
   // Total render sample length.
diff --git a/third_party/WebKit/Source/platform/graphics/BitmapImage.cpp b/third_party/WebKit/Source/platform/graphics/BitmapImage.cpp
index 722e42e..7a881bb 100644
--- a/third_party/WebKit/Source/platform/graphics/BitmapImage.cpp
+++ b/third_party/WebKit/Source/platform/graphics/BitmapImage.cpp
@@ -48,6 +48,24 @@
 
 namespace blink {
 
+int GetRepetitionCountWithPolicyOverride(int actual_count,
+                                         ImageAnimationPolicy policy) {
+  switch (policy) {
+    case kImageAnimationPolicyAllowed:
+      // Default policy, no count override.
+      return actual_count;
+    case kImageAnimationPolicyAnimateOnce:
+      // Only a single loop allowed.
+      return kAnimationLoopOnce;
+    case kImageAnimationPolicyNoAnimation:
+      // Dont animate.
+      return kAnimationNone;
+  }
+
+  NOTREACHED();
+  return actual_count;
+}
+
 BitmapImage::BitmapImage(ImageObserver* observer, bool is_multipart)
     : Image(observer, is_multipart),
       current_frame_index_(0),
@@ -136,7 +154,8 @@
                               : PaintImage::CompletionState::PARTIALLY_DONE;
   builder.set_paint_image_generator(std::move(generator))
       .set_frame_index(index)
-      .set_repetition_count(repetition_count_)
+      .set_repetition_count(GetRepetitionCountWithPolicyOverride(
+          repetition_count_, animation_policy_))
       .set_completion_state(completion_state);
 
   // The caching of the decoded image data by the external users of this image
@@ -688,6 +707,14 @@
   return true;
 }
 
+void BitmapImage::SetAnimationPolicy(ImageAnimationPolicy policy) {
+  if (animation_policy_ == policy)
+    return;
+
+  animation_policy_ = policy;
+  ResetAnimation();
+}
+
 void BitmapImage::NotifyObserversOfAnimationAdvance(TimerBase*) {
   if (GetImageObserver())
     GetImageObserver()->AnimationAdvanced(this);
diff --git a/third_party/WebKit/Source/platform/graphics/BitmapImage.h b/third_party/WebKit/Source/platform/graphics/BitmapImage.h
index 6aec98a2..356b181 100644
--- a/third_party/WebKit/Source/platform/graphics/BitmapImage.h
+++ b/third_party/WebKit/Source/platform/graphics/BitmapImage.h
@@ -78,9 +78,7 @@
   void ResetAnimation() override;
   bool MaybeAnimated() override;
 
-  void SetAnimationPolicy(ImageAnimationPolicy policy) override {
-    animation_policy_ = policy;
-  }
+  void SetAnimationPolicy(ImageAnimationPolicy) override;
   ImageAnimationPolicy AnimationPolicy() override { return animation_policy_; }
   void AdvanceTime(double delta_time_in_seconds) override;
 
diff --git a/third_party/WebKit/Source/platform/graphics/BitmapImageTest.cpp b/third_party/WebKit/Source/platform/graphics/BitmapImageTest.cpp
index 68c0ddadd..9339aeef 100644
--- a/third_party/WebKit/Source/platform/graphics/BitmapImageTest.cpp
+++ b/third_party/WebKit/Source/platform/graphics/BitmapImageTest.cpp
@@ -417,6 +417,31 @@
   }
 };
 
+TEST_F(BitmapImageTestWithMockDecoder, AnimationPolicyOverride) {
+  repetition_count_ = kAnimationLoopInfinite;
+  frame_count_ = 4u;
+  last_frame_complete_ = true;
+  image_->SetData(SharedBuffer::Create("data", sizeof("data")), false);
+
+  PaintImage image = image_->PaintImageForCurrentFrame();
+  EXPECT_EQ(image.repetition_count(), repetition_count_);
+
+  // Only one loop allowed.
+  image_->SetAnimationPolicy(kImageAnimationPolicyAnimateOnce);
+  image = image_->PaintImageForCurrentFrame();
+  EXPECT_EQ(image.repetition_count(), kAnimationLoopOnce);
+
+  // No animation allowed.
+  image_->SetAnimationPolicy(kImageAnimationPolicyNoAnimation);
+  image = image_->PaintImageForCurrentFrame();
+  EXPECT_EQ(image.repetition_count(), kAnimationNone);
+
+  // Default policy.
+  image_->SetAnimationPolicy(kImageAnimationPolicyAllowed);
+  image = image_->PaintImageForCurrentFrame();
+  EXPECT_EQ(image.repetition_count(), repetition_count_);
+}
+
 template <typename HistogramEnumType>
 struct HistogramTestParams {
   const char* filename;
diff --git a/third_party/WebKit/Source/platform/loader/fetch/Resource.cpp b/third_party/WebKit/Source/platform/loader/fetch/Resource.cpp
index 9423c64..319d25c8 100644
--- a/third_party/WebKit/Source/platform/loader/fetch/Resource.cpp
+++ b/third_party/WebKit/Source/platform/loader/fetch/Resource.cpp
@@ -271,7 +271,6 @@
       decoded_size_(0),
       overhead_size_(CalculateOverheadSize()),
       cache_identifier_(MemoryCache::DefaultCacheIdentifier()),
-      needs_synchronous_cache_hit_(false),
       link_preload_(false),
       is_revalidating_(false),
       is_alive_(false),
@@ -691,10 +690,9 @@
   }
 
   // If an error has occurred or we have existing data to send to the new client
-  // and the resource type supprts it, send it asynchronously.
+  // and the resource type supports it, send it asynchronously.
   if ((ErrorOccurred() || !GetResponse().IsNull()) &&
-      !TypeNeedsSynchronousCacheHit(GetType()) &&
-      !needs_synchronous_cache_hit_) {
+      !TypeNeedsSynchronousCacheHit(GetType())) {
     clients_awaiting_callback_.insert(client);
     if (!async_finish_pending_clients_task_.IsActive()) {
       async_finish_pending_clients_task_ =
diff --git a/third_party/WebKit/Source/platform/loader/fetch/Resource.h b/third_party/WebKit/Source/platform/loader/fetch/Resource.h
index 8960014..74666d6 100644
--- a/third_party/WebKit/Source/platform/loader/fetch/Resource.h
+++ b/third_party/WebKit/Source/platform/loader/fetch/Resource.h
@@ -106,10 +106,6 @@
   virtual void AppendData(const char*, size_t);
   virtual void FinishAsError(const ResourceError&);
 
-  void SetNeedsSynchronousCacheHit(bool needs_synchronous_cache_hit) {
-    needs_synchronous_cache_hit_ = needs_synchronous_cache_hit;
-  }
-
   void SetLinkPreload(bool is_link_preload) { link_preload_ = is_link_preload; }
   bool IsLinkPreload() const { return link_preload_; }
 
@@ -453,7 +449,6 @@
 
   String cache_identifier_;
 
-  bool needs_synchronous_cache_hit_;
   bool link_preload_;
   bool is_revalidating_;
   bool is_alive_;
diff --git a/third_party/WebKit/Source/platform/loader/fetch/ResourceFetcher.cpp b/third_party/WebKit/Source/platform/loader/fetch/ResourceFetcher.cpp
index ee1c32a..5423904 100644
--- a/third_party/WebKit/Source/platform/loader/fetch/ResourceFetcher.cpp
+++ b/third_party/WebKit/Source/platform/loader/fetch/ResourceFetcher.cpp
@@ -456,7 +456,6 @@
 
   Resource* resource = factory.Create(
       params.GetResourceRequest(), params.Options(), params.DecoderOptions());
-  resource->SetNeedsSynchronousCacheHit(substitute_data.ForceSynchronousLoad());
   // FIXME: We should provide a body stream here.
   resource->SetStatus(ResourceStatus::kPending);
   resource->NotifyStartLoad();
@@ -612,10 +611,8 @@
       MemoryCache::RemoveFragmentIdentifierIfNeeded(params.Url()), options,
       reporting_policy, params.GetOriginRestriction(),
       resource_request.GetRedirectStatus());
-  if (blocked_reason != ResourceRequestBlockedReason::kNone) {
-    DCHECK(!substitute_data.ForceSynchronousLoad());
+  if (blocked_reason != ResourceRequestBlockedReason::kNone)
     return kBlock;
-  }
 
   // For initial requests, call prepareRequest() here before revalidation
   // policy is determined.
diff --git a/third_party/WebKit/Source/platform/loader/fetch/SubstituteData.h b/third_party/WebKit/Source/platform/loader/fetch/SubstituteData.h
index 67cd49d..200eb500 100644
--- a/third_party/WebKit/Source/platform/loader/fetch/SubstituteData.h
+++ b/third_party/WebKit/Source/platform/loader/fetch/SubstituteData.h
@@ -33,34 +33,23 @@
 
 namespace blink {
 
-enum SubstituteDataLoadPolicy { kLoadNormally, kForceSynchronousLoad };
-
 class SubstituteData {
   DISALLOW_NEW();
 
  public:
-  SubstituteData() : substitute_data_load_policy_(kLoadNormally) {}
+  SubstituteData() {}
 
-  SubstituteData(
-      RefPtr<SharedBuffer> content,
-      SubstituteDataLoadPolicy substitute_data_load_policy = kLoadNormally)
-      : SubstituteData(content,
-                       "text/html",
-                       "UTF-8",
-                       KURL(),
-                       substitute_data_load_policy) {}
+  SubstituteData(RefPtr<SharedBuffer> content)
+      : SubstituteData(content, "text/html", "UTF-8", KURL()) {}
 
-  SubstituteData(
-      RefPtr<SharedBuffer> content,
-      const AtomicString& mime_type,
-      const AtomicString& text_encoding,
-      const KURL& failing_url,
-      SubstituteDataLoadPolicy substitute_data_load_policy = kLoadNormally)
+  SubstituteData(RefPtr<SharedBuffer> content,
+                 const AtomicString& mime_type,
+                 const AtomicString& text_encoding,
+                 const KURL& failing_url)
       : content_(std::move(content)),
         mime_type_(mime_type),
         text_encoding_(text_encoding),
-        failing_url_(failing_url),
-        substitute_data_load_policy_(substitute_data_load_policy) {}
+        failing_url_(failing_url) {}
 
   bool IsValid() const { return content_.Get(); }
 
@@ -68,16 +57,12 @@
   const AtomicString& MimeType() const { return mime_type_; }
   const AtomicString& TextEncoding() const { return text_encoding_; }
   const KURL& FailingURL() const { return failing_url_; }
-  bool ForceSynchronousLoad() const {
-    return substitute_data_load_policy_ == kForceSynchronousLoad;
-  }
 
  private:
   RefPtr<SharedBuffer> content_;
   AtomicString mime_type_;
   AtomicString text_encoding_;
   KURL failing_url_;
-  SubstituteDataLoadPolicy substitute_data_load_policy_;
 };
 
 }  // namespace blink
diff --git a/third_party/WebKit/Source/platform/scheduler/child/idle_helper.cc b/third_party/WebKit/Source/platform/scheduler/child/idle_helper.cc
index 0433b15..ca73dc7 100644
--- a/third_party/WebKit/Source/platform/scheduler/child/idle_helper.cc
+++ b/third_party/WebKit/Source/platform/scheduler/child/idle_helper.cc
@@ -37,7 +37,7 @@
       &IdleHelper::OnIdleTaskPostedOnMainThread, weak_idle_helper_ptr_));
 
   idle_task_runner_ =
-      make_scoped_refptr(new SingleThreadIdleTaskRunner(idle_queue_, this));
+      base::MakeRefCounted<SingleThreadIdleTaskRunner>(idle_queue_, this);
 
   // This fence will block any idle tasks from running.
   idle_queue_->InsertFence(TaskQueue::InsertFencePosition::BEGINNING_OF_TIME);
diff --git a/third_party/WebKit/Source/platform/scheduler/renderer/budget_pool_unittest.cc b/third_party/WebKit/Source/platform/scheduler/renderer/budget_pool_unittest.cc
index ade141c..aa22be1 100644
--- a/third_party/WebKit/Source/platform/scheduler/renderer/budget_pool_unittest.cc
+++ b/third_party/WebKit/Source/platform/scheduler/renderer/budget_pool_unittest.cc
@@ -35,7 +35,7 @@
     clock_.reset(new base::SimpleTestTickClock());
     clock_->Advance(base::TimeDelta::FromMicroseconds(5000));
     mock_task_runner_ =
-        make_scoped_refptr(new cc::OrderedSimpleTaskRunner(clock_.get(), true));
+        base::MakeRefCounted<cc::OrderedSimpleTaskRunner>(clock_.get(), true);
     delegate_ = SchedulerTqmDelegateForTest::Create(
         mock_task_runner_, base::MakeUnique<TestTimeSource>(clock_.get()));
     scheduler_.reset(new RendererSchedulerImpl(delegate_));
diff --git a/third_party/WebKit/Source/platform/scheduler/renderer/renderer_metrics_helper_unittest.cc b/third_party/WebKit/Source/platform/scheduler/renderer/renderer_metrics_helper_unittest.cc
index bfeb1562..a214f23 100644
--- a/third_party/WebKit/Source/platform/scheduler/renderer/renderer_metrics_helper_unittest.cc
+++ b/third_party/WebKit/Source/platform/scheduler/renderer/renderer_metrics_helper_unittest.cc
@@ -32,7 +32,7 @@
     histogram_tester_.reset(new base::HistogramTester());
     clock_ = base::MakeUnique<base::SimpleTestTickClock>();
     mock_task_runner_ =
-        make_scoped_refptr(new cc::OrderedSimpleTaskRunner(clock_.get(), true));
+        base::MakeRefCounted<cc::OrderedSimpleTaskRunner>(clock_.get(), true);
     delegate_ = SchedulerTqmDelegateForTest::Create(
         mock_task_runner_, base::MakeUnique<TestTimeSource>(clock_.get()));
     scheduler_ = base::MakeUnique<RendererSchedulerImpl>(delegate_);
diff --git a/third_party/WebKit/Source/platform/scheduler/renderer/task_queue_throttler_unittest.cc b/third_party/WebKit/Source/platform/scheduler/renderer/task_queue_throttler_unittest.cc
index 9533f3d..6576ba3 100644
--- a/third_party/WebKit/Source/platform/scheduler/renderer/task_queue_throttler_unittest.cc
+++ b/third_party/WebKit/Source/platform/scheduler/renderer/task_queue_throttler_unittest.cc
@@ -84,7 +84,7 @@
     clock_ = CreateClock();
     clock_->Advance(base::TimeDelta::FromMicroseconds(5000));
     mock_task_runner_ =
-        make_scoped_refptr(new cc::OrderedSimpleTaskRunner(clock_.get(), true));
+        base::MakeRefCounted<cc::OrderedSimpleTaskRunner>(clock_.get(), true);
     delegate_ = SchedulerTqmDelegateForTest::Create(
         mock_task_runner_, base::MakeUnique<TestTimeSource>(clock_.get()));
     scheduler_.reset(new RendererSchedulerImpl(delegate_));
diff --git a/third_party/WebKit/Source/platform/scheduler/renderer/web_frame_scheduler_impl_unittest.cc b/third_party/WebKit/Source/platform/scheduler/renderer/web_frame_scheduler_impl_unittest.cc
index ea4b8f3..a7d3cb2 100644
--- a/third_party/WebKit/Source/platform/scheduler/renderer/web_frame_scheduler_impl_unittest.cc
+++ b/third_party/WebKit/Source/platform/scheduler/renderer/web_frame_scheduler_impl_unittest.cc
@@ -31,7 +31,7 @@
     clock_.reset(new base::SimpleTestTickClock());
     clock_->Advance(base::TimeDelta::FromMicroseconds(5000));
     mock_task_runner_ =
-        make_scoped_refptr(new cc::OrderedSimpleTaskRunner(clock_.get(), true));
+        base::MakeRefCounted<cc::OrderedSimpleTaskRunner>(clock_.get(), true);
     delegate_ = SchedulerTqmDelegateForTest::Create(
         mock_task_runner_, base::WrapUnique(new TestTimeSource(clock_.get())));
     scheduler_.reset(new RendererSchedulerImpl(delegate_));
diff --git a/third_party/WebKit/Source/platform/scheduler/renderer/web_view_scheduler_impl_unittest.cc b/third_party/WebKit/Source/platform/scheduler/renderer/web_view_scheduler_impl_unittest.cc
index faa1610..8a40942 100644
--- a/third_party/WebKit/Source/platform/scheduler/renderer/web_view_scheduler_impl_unittest.cc
+++ b/third_party/WebKit/Source/platform/scheduler/renderer/web_view_scheduler_impl_unittest.cc
@@ -38,7 +38,7 @@
     clock_.reset(new base::SimpleTestTickClock());
     clock_->Advance(base::TimeDelta::FromMicroseconds(5000));
     mock_task_runner_ =
-        make_scoped_refptr(new cc::OrderedSimpleTaskRunner(clock_.get(), true));
+        base::MakeRefCounted<cc::OrderedSimpleTaskRunner>(clock_.get(), true);
     delegate_ = SchedulerTqmDelegateForTest::Create(
         mock_task_runner_, base::MakeUnique<TestTimeSource>(clock_.get()));
     scheduler_.reset(new RendererSchedulerImpl(delegate_));
diff --git a/third_party/WebKit/public/platform/WebMouseEvent.h b/third_party/WebKit/public/platform/WebMouseEvent.h
index 5f8d4b6..55b8e53c 100644
--- a/third_party/WebKit/public/platform/WebMouseEvent.h
+++ b/third_party/WebKit/public/platform/WebMouseEvent.h
@@ -6,7 +6,7 @@
 #define WebMouseEvent_h
 
 #include "WebInputEvent.h"
-#include "public/platform/WebMenuSourceType.h"
+#include "WebMenuSourceType.h"
 
 namespace blink {
 
diff --git a/third_party/blink/tools/move_blink_source.py b/third_party/blink/tools/move_blink_source.py
index 0d954f5..3a07e44 100755
--- a/third_party/blink/tools/move_blink_source.py
+++ b/third_party/blink/tools/move_blink_source.py
@@ -52,10 +52,12 @@
     MOJOM = 5
     TYPEMAP = 6
     BLINK_BUILD_PY = 7
+    LAYOUT_TESTS_WITH_MOJOM = 8
 
     @staticmethod
     def detect(path):
-        _, basename = os.path.split(path)
+        slash_dir, basename = os.path.split(path)
+        slash_dir = slash_dir.replace(os.path.sep, '/')
         if basename == 'DEPS':
             return FileType.DEPS
         if basename == 'OWNERS':
@@ -64,15 +66,18 @@
             return FileType.MOJOM
         if basename.endswith('.typemap'):
             return FileType.TYPEMAP
-        if basename.endswith('.py') and 'third_party/WebKit/Source/build' in path.replace('\\', '/'):
+        if basename.endswith('.py') and 'third_party/WebKit/Source/build' in slash_dir:
             return FileType.BLINK_BUILD_PY
         if basename.endswith(('.gn', '.gni')):
-            path = path.replace('\\', '/')
-            if 'third_party/WebKit' in path or 'third_party/blink' in path:
+            if 'third_party/WebKit' in path or 'third_party/blink' in slash_dir:
                 return FileType.BLINK_BUILD
-            if 'third_party' in path:
+            if 'third_party' in slash_dir:
                 return FileType.NONE
             return FileType.BUILD
+        if basename.endswith('.html') and re.search(
+                r'third_party/WebKit/LayoutTests/(geolocation-api|installedapp|' +
+                r'media/mediasession|payments|presentation|webshare)', slash_dir):
+            return FileType.LAYOUT_TESTS_WITH_MOJOM
         return FileType.NONE
 
 
@@ -269,6 +274,9 @@
         # enough.
         return self._update_basename(content)
 
+    def _update_layout_tests(self, content):
+        return content.replace('file:///gen/third_party/WebKit/', 'file:///gen/third_party/blink/renderer/')
+
     def _update_basename(self, content):
         return self._basename_re.sub(lambda match: self._basename_map[match.group(1)], content)
 
@@ -309,6 +317,8 @@
                 content = self._update_typemap(content)
             elif file_type == FileType.BLINK_BUILD_PY:
                 content = self._update_blink_build_py(content)
+            elif file_type == FileType.LAYOUT_TESTS_WITH_MOJOM:
+                content = self._update_layout_tests(content)
 
             if original_content == content:
                 continue
diff --git a/tools/battor_agent/battor_connection_impl.cc b/tools/battor_agent/battor_connection_impl.cc
index efda2e1..f4a386c 100644
--- a/tools/battor_agent/battor_connection_impl.cc
+++ b/tools/battor_agent/battor_connection_impl.cc
@@ -214,8 +214,7 @@
   LogSerial(StringPrintf("(message) Starting read of up to %zu bytes.",
                          max_bytes_to_read));
 
-  pending_read_buffer_ =
-      make_scoped_refptr(new net::IOBuffer(max_bytes_to_read));
+  pending_read_buffer_ = base::MakeRefCounted<net::IOBuffer>(max_bytes_to_read);
 
   io_handler_->Read(base::MakeUnique<device::ReceiveBuffer>(
       pending_read_buffer_, static_cast<uint32_t>(max_bytes_to_read),
@@ -318,8 +317,7 @@
       StringPrintf("(flush) Starting read (quiet period has lasted %f ms).",
                    quiet_period_duration.InMillisecondsF()));
 
-  pending_read_buffer_ =
-      make_scoped_refptr(new net::IOBuffer(kFlushBufferSize));
+  pending_read_buffer_ = base::MakeRefCounted<net::IOBuffer>(kFlushBufferSize);
 
   io_handler_->Read(base::MakeUnique<device::ReceiveBuffer>(
       pending_read_buffer_, static_cast<uint32_t>(kFlushBufferSize),
diff --git a/tools/metrics/histograms/enums.xml b/tools/metrics/histograms/enums.xml
index bf2f3dd..6d0211a 100644
--- a/tools/metrics/histograms/enums.xml
+++ b/tools/metrics/histograms/enums.xml
@@ -1670,6 +1670,12 @@
   <int value="3" label="Audio and silence"/>
 </enum>
 
+<enum name="AudioOutputStreamCreationResult">
+  <int value="0" label="OK"/>
+  <int value="1" label="Failed to create stream"/>
+  <int value="2" label="Failed to open stream"/>
+</enum>
+
 <enum name="AudioRendererEvents">
   <int value="0" label="Initialized"/>
   <int value="1" label="Runtime error"/>
@@ -8677,6 +8683,14 @@
   <int value="2" label="UNMETERED"/>
 </enum>
 
+<enum name="Download.Service.PauseReason">
+  <int value="0" label="ANY"/>
+  <int value="1" label="UNMET_DEVICE_CRITERIA"/>
+  <int value="2" label="PAUSE_BY_CLIENT"/>
+  <int value="3" label="EXTERNAL_DOWNLOAD"/>
+  <int value="4" label="EXTERNAL_NAVIGATION"/>
+</enum>
+
 <enum name="Download.Service.Priority">
   <int value="0" label="LOW"/>
   <int value="1" label="NORMAL"/>
@@ -39907,7 +39921,9 @@
 <enum name="VPNDriver">
   <int value="0" label="OpenVPN"/>
   <int value="1" label="L2TP/IPSec"/>
-  <int value="2" label="Third Party"/>
+  <int value="2" label="Third Party (CrOS)"/>
+  <int value="3" label="Third Party (Android)"/>
+  <int value="4" label="PPTP"/>
 </enum>
 
 <enum name="VPNRemoteAuthenticationType">
diff --git a/tools/metrics/histograms/histograms.xml b/tools/metrics/histograms/histograms.xml
index dcdb497..642f732 100644
--- a/tools/metrics/histograms/histograms.xml
+++ b/tools/metrics/histograms/histograms.xml
@@ -16373,6 +16373,15 @@
   <summary>The completion type for downloads in download service.</summary>
 </histogram>
 
+<histogram name="Download.Service.PauseReason"
+    enum="Download.Service.PauseReason">
+  <owner>shaktisahu@chromium.org</owner>
+  <summary>
+    The reason for pausing an in-progress download. Every pause will result in
+    two entries in the histogram: ANY and a more specific reason.
+  </summary>
+</histogram>
+
 <histogram name="Download.Service.Recovery" enum="Download.Service.EntryStates">
   <owner>xingliu@chromium.org</owner>
   <summary>
@@ -30854,6 +30863,36 @@
   <summary>Measures the time taken for AudioOutputController::</summary>
 </histogram>
 
+<histogram name="Media.AudioOutputController.CallbackError" enum="BooleanError">
+  <owner>maxmorin@chromium.org</owner>
+  <summary>
+    A boolean that reflects whether or not an error was reported during audio
+    rendering, reported after a stream has stopped, if it was started.
+  </summary>
+</histogram>
+
+<histogram name="Media.AudioOutputController.ProxyStreamCreationResult"
+    enum="AudioOutputStreamCreationResult">
+  <owner>maxmorin@chromium.org</owner>
+  <summary>
+    Whether an AudioOutputController succeeded in creating and opening an output
+    stream proxy. Only logged for the initial creation, subsequent re-creations
+    due to device change events are logged in the
+    Media.AudioOutputController.ProxyStreamCreationResultForDeviceChange
+    histogram.
+  </summary>
+</histogram>
+
+<histogram
+    name="Media.AudioOutputController.ProxyStreamCreationResultForDeviceChange"
+    enum="AudioOutputStreamCreationResult">
+  <owner>maxmorin@chromium.org</owner>
+  <summary>
+    Whether an AudioOutputController succeeded in creating and opening an output
+    stream proxy after receiving a default device change event.
+  </summary>
+</histogram>
+
 <histogram name="Media.AudioOutputControllerDataNotReady" units="ms">
   <owner>dalecurtis@chromium.org</owner>
   <summary>
@@ -46380,7 +46419,7 @@
 </histogram>
 
 <histogram name="Network.Shill.Vpn.Driver" enum="VPNDriver">
-  <owner>quiche@chromium.org</owner>
+  <owner>cernekee@chromium.org</owner>
   <summary>
     Chrome OS network usage metric sampled on each successful VPN connection
     that tracks the VPN connection type.
diff --git a/tools/perf/benchmark.csv b/tools/perf/benchmark.csv
index 537832c..0fec883b 100644
--- a/tools/perf/benchmark.csv
+++ b/tools/perf/benchmark.csv
@@ -9,7 +9,7 @@
 blink_perf.css,rune@opera.com,
 blink_perf.dom,"jbroman@chromium.org, yukishiino@chromium.org, haraken@chromium.org",
 blink_perf.events,hayato@chromium.org,
-blink_perf.image_decoder,"cblume@chromium.org, reveman@chromium.org",
+blink_perf.image_decoder,"cblume@chromium.org",
 blink_perf.layout,eae@chromium.org,
 blink_perf.owp_storage,dmurph@chromium.org,
 blink_perf.paint,wangxianzhu@chromium.org,
diff --git a/tools/perf/benchmarks/blink_perf.py b/tools/perf/benchmarks/blink_perf.py
index e8a2d6d..1f7a91f 100644
--- a/tools/perf/benchmarks/blink_perf.py
+++ b/tools/perf/benchmarks/blink_perf.py
@@ -443,8 +443,7 @@
     return StoryExpectations()
 
 
-@benchmark.Owner(emails=['cblume@chromium.org',
-                         'reveman@chromium.org'])
+@benchmark.Owner(emails=['cblume@chromium.org'])
 class BlinkPerfImageDecoder(_BlinkPerfBenchmark):
   tag = 'image_decoder'
   subdir = 'ImageDecoder'
diff --git a/tools/perf/benchmarks/tracing.py b/tools/perf/benchmarks/tracing.py
index e7c0b77..9ff6306 100644
--- a/tools/perf/benchmarks/tracing.py
+++ b/tools/perf/benchmarks/tracing.py
@@ -5,7 +5,6 @@
 from core import perf_benchmark
 
 from telemetry import benchmark
-from telemetry import decorators
 from telemetry import story
 from telemetry.timeline import chrome_trace_category_filter
 from telemetry.timeline import chrome_trace_config
@@ -15,7 +14,6 @@
 
 
 @benchmark.Owner(emails=['ssid@chromium.org'])
-@decorators.Disabled('all')  # crbug.com/765140
 class TracingWithBackgroundMemoryInfra(perf_benchmark.PerfBenchmark):
   """Measures the overhead of background memory-infra dumps"""
   page_set = page_sets.Top10PageSet
@@ -39,5 +37,5 @@
   def GetExpectations(self):
     class StoryExpectations(story.expectations.StoryExpectations):
       def SetExpectations(self):
-        pass # No tests disabled.
+        self.DisableBenchmark([story.expectations.ALL], 'crbug.com/765140')
     return StoryExpectations()
diff --git a/tools/perf/benchmarks/v8_browsing.py b/tools/perf/benchmarks/v8_browsing.py
index b3d13b7..8898cc3 100644
--- a/tools/perf/benchmarks/v8_browsing.py
+++ b/tools/perf/benchmarks/v8_browsing.py
@@ -203,6 +203,10 @@
             'browse:tech:discourse_infinite_scroll',
             [story.expectations.ANDROID_ONE],
             'crbug.com/767970')
+        self.DisableStory(
+            'browse:shopping:lazada',
+            [story.expectations.ANDROID_ONE],
+            'crbug.com/768472')
     return StoryExpectations()
 
   @classmethod
diff --git a/tools/perf/chrome_telemetry_build/binary_dependencies.json b/tools/perf/chrome_telemetry_build/binary_dependencies.json
index 43ab52c5..18596852 100644
--- a/tools/perf/chrome_telemetry_build/binary_dependencies.json
+++ b/tools/perf/chrome_telemetry_build/binary_dependencies.json
@@ -62,22 +62,6 @@
           ]
         }
       }
-    },
-    "memtrack_helper": {
-      "file_info": {
-        "android_armeabi-v7a": {
-          "local_paths": [
-            "../../../out/Debug/memtrack_helper",
-            "../../../out/Release/memtrack_helper"
-          ]
-        },
-        "arm64-v8a": {
-          "local_paths": [
-            "../../../out/Debug/memtrack_helper",
-            "../../../out/Release/memtrack_helper"
-          ]
-        }
-      }
     }
   }
 }
diff --git a/tools/perf/core/story_expectation_validator.py b/tools/perf/core/story_expectation_validator.py
index 4c30b2c..b17e6e6 100755
--- a/tools/perf/core/story_expectation_validator.py
+++ b/tools/perf/core/story_expectation_validator.py
@@ -10,6 +10,8 @@
 path_util.AddTelemetryToPath()
 path_util.AddAndroidPylibToPath()
 
+
+from telemetry import decorators
 from telemetry.internal.browser import browser_options
 
 
@@ -22,6 +24,17 @@
 ]
 
 
+# TODO(rnephew): Remove this check when it is the norm to not use decorators.
+def check_decorators(benchmarks):
+  for benchmark in benchmarks:
+    if (decorators.GetDisabledAttributes(benchmark) or
+        decorators.GetEnabledAttributes(benchmark)):
+      raise Exception(
+          'Disabling or enabling telemetry benchmark with decorator detected. '
+          'Please use StoryExpectations instead. Contact rnephew@ for more '
+          'information. \nBenchmark: %s' % benchmark.Name())
+
+
 def validate_story_names(benchmarks):
   for benchmark in benchmarks:
     if benchmark.Name() in CLUSTER_TELEMETRY_BENCHMARKS:
@@ -43,4 +56,5 @@
   del args  # unused
   benchmarks = benchmark_finders.GetAllBenchmarks()
   validate_story_names(benchmarks)
+  check_decorators(benchmarks)
   return 0
diff --git a/tools/perf/core/system_health_csv_generator.py b/tools/perf/core/system_health_csv_generator.py
new file mode 100644
index 0000000..dd37928
--- /dev/null
+++ b/tools/perf/core/system_health_csv_generator.py
@@ -0,0 +1,31 @@
+# Copyright 2016 The Chromium Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+import csv
+import page_sets
+
+
+def IterAllSystemHealthStories():
+  for s in page_sets.SystemHealthStorySet(platform='desktop'):
+    yield s
+  for s in page_sets.SystemHealthStorySet(platform='mobile'):
+    if len(s.SUPPORTED_PLATFORMS) < 2:
+      yield s
+
+
+def GenerateSystemHealthCSV(file_path):
+  system_health_stories = list(IterAllSystemHealthStories())
+  system_health_stories.sort(key=lambda s: s.name)
+  with open(file_path, 'w') as f:
+    csv_writer = csv.writer(f)
+    csv_writer.writerow([
+        'Story name', 'Platform', 'Description'])
+    for s in system_health_stories:
+      p = s.SUPPORTED_PLATFORMS
+      if len(p) == 2:
+        p = 'all'
+      else:
+        p = list(p)[0]
+      csv_writer.writerow([s.name, p, s.GetStoryDescription()])
+  return 0
diff --git a/tools/perf/generate_system_health_csv b/tools/perf/generate_system_health_csv
index aa1c079..f462ba1 100755
--- a/tools/perf/generate_system_health_csv
+++ b/tools/perf/generate_system_health_csv
@@ -3,43 +3,13 @@
 # Use of this source code is governed by a BSD-style license that can be
 # found in the LICENSE file.
 
-import csv
-import os
 import sys
-
+import os
+from core import system_health_csv_generator
 from core import path_util
-sys.path.insert(1, path_util.GetTelemetryDir())  # To resolve telemetry imports
 
-import page_sets
-
-
-def IterAllSystemHealthStories():
-  for s in page_sets.SystemHealthStorySet(platform='desktop'):
-    yield s
-  for s in page_sets.SystemHealthStorySet(platform='mobile'):
-    if len(s.SUPPORTED_PLATFORMS) < 2:
-      yield s
-
-SYSTEM_HEALTH_CSV = os.path.join(os.path.dirname(__file__),
+SYSTEM_HEALTH_CSV = os.path.join(path_util.GetPerfDir(),
                                  'system_health_stories.csv')
-
-
-def main():
-  system_health_stories = list(IterAllSystemHealthStories())
-  system_health_stories.sort(key=lambda s: s.name)
-  with open(SYSTEM_HEALTH_CSV, 'w') as f:
-    csv_writer = csv.writer(f)
-    csv_writer.writerow([
-        'Story name', 'Platform', 'Description'])
-    for s in system_health_stories:
-      p = s.SUPPORTED_PLATFORMS
-      if len(p) == 2:
-        p = 'all'
-      else:
-        p = list(p)[0]
-      csv_writer.writerow([s.name, p, s.GetStoryDescription()])
-  return 0
-
-
 if __name__ == '__main__':
-  sys.exit(main())
+  sys.exit(system_health_csv_generator.GenerateSystemHealthCSV(
+           SYSTEM_HEALTH_CSV))
\ No newline at end of file
diff --git a/tools/perf/system_health_stories.csv b/tools/perf/system_health_stories.csv
index 2d5947e..d63d491 100644
--- a/tools/perf/system_health_stories.csv
+++ b/tools/perf/system_health_stories.csv
@@ -1,53 +1,47 @@
-Story name,Platform,Description
-background:media:imgur,mobile,"Load http://imgur.com/gallery/hUita, then put the Chrome browser into the background."
-background:news:nytimes,mobile,"Load http://www.nytimes.com/2016/10/04/us/politics/vice-presidential-debate.html?_r=0, then put the Chrome browser into the background."
-background:search:google,mobile,"Load https://www.google.co.uk/#q=tom+cruise+movies, then put the Chrome browser into the background."
-background:social:facebook,mobile,"Load https://www.facebook.com/rihanna, then put the Chrome browser into the background."
-background:tools:gmail,mobile,Load https://mail.google.com/mail/
-blank:about:blank,all,Story that loads the about:blank page.
+Story name,Platform,Description

+background:media:imgur,mobile,"Load http://imgur.com/gallery/hUita, then put the browser into the background."

+background:news:nytimes,mobile,"Load http://www.nytimes.com/2016/10/04/us/politics/vice-presidential-debate.html?_r=0, then put the browser into the background."

+background:search:google,mobile,"Load https://www.google.co.uk/#q=tom+cruise+movies, then put the browser into the background."

+background:social:facebook,mobile,"Load https://www.facebook.com/rihanna, then put the browser into the background."

+background:tools:gmail,mobile,Load https://mail.google.com/mail/

 browse:chrome:newtab,mobile,"Story that loads new tab page and performs searches.
 
-  For each of the search queries in in the list below, this story does:
+  Given a list of typical search queries, this story does for each of them:
    - enter the search query on the new tab page search box
    - read results
    - navigates back to new tab page
-
-  List of search queries:
-    'does google know everything',
-    'most famous paintings',
-    'current weather',
-    'best movies 2016',
-    'how to tie a tie'
-  "
+  "

 browse:chrome:omnibox,mobile,"Story that peforms search by using omnibox search provider
 
   Loads a website and enters a search query on omnibox and navigates to default
   search provider (google).
-  "
+  "

 browse:media:facebook_photos,mobile,"Load a photo page from Rihanna's facebook page then navigate a few next
   photos.
-  "
-browse:media:imgur,desktop,Load http://imgur.com/gallery/5UlBN and navigate to some items/articles.
-browse:media:imgur,mobile,Load http://imgur.com/gallery/5UlBN and navigate to some items/articles.
-browse:media:pinterest,desktop,Load https://pinterest.com and navigate to some items/articles.
-browse:media:tumblr,desktop,Load https://tumblr.com/search/gifs and navigate to some items/articles.
+  "

+browse:media:flickr_infinite_scroll,desktop,Load https://www.flickr.com/explore then make a very long scroll.

+browse:media:flickr_infinite_scroll,mobile,Load https://www.flickr.com/explore then make a very long scroll.

+browse:media:imgur,desktop,Load http://imgur.com/gallery/5UlBN and navigate to some items/articles.

+browse:media:imgur,mobile,Load http://imgur.com/gallery/5UlBN and navigate to some items/articles.

+browse:media:pinterest,desktop,Load https://pinterest.com and navigate to some items/articles.

+browse:media:tumblr,desktop,Load https://tumblr.com/search/gifs and navigate to some items/articles.

 browse:media:youtube,desktop,"Load a typical YouTube video then navigate to a next few videos. Stop and
   watch each video for a few seconds.
-  "
+  "

 browse:media:youtube,mobile,"Load a typical YouTube video then navigate to a next few videos. Stop and
   watch each video for few seconds.
-  "
-browse:news:cnn,all,The second top website in http://www.alexa.com/topsites/category/News
-browse:news:cricbuzz,mobile,Load http://m.cricbuzz.com and navigate to some items/articles.
-browse:news:flipboard,desktop,Load https://flipboard.com/explore and navigate to some items/articles.
-browse:news:globo,mobile,Load http://www.globo.com and navigate to some items/articles.
-browse:news:hackernews,desktop,Load https://news.ycombinator.com and navigate to some items/articles.
-browse:news:nytimes,desktop,The third top website in http://www.alexa.com/topsites/category/News
-browse:news:qq,mobile,Load http://news.qq.com and navigate to some items/articles.
-browse:news:reddit,desktop,The top website in http://www.alexa.com/topsites/category/News
-browse:news:reddit,mobile,The top website in http://www.alexa.com/topsites/category/News
-browse:news:toi,mobile,Load http://m.timesofindia.com and navigate to some items/articles.
-browse:news:washingtonpost,mobile,Progressive website
+  "

+browse:news:cnn,all,The second top website in http://www.alexa.com/topsites/category/News

+browse:news:cricbuzz,mobile,Load http://m.cricbuzz.com and navigate to some items/articles.

+browse:news:flipboard,desktop,Load https://flipboard.com/explore and navigate to some items/articles.

+browse:news:globo,mobile,Load http://www.globo.com and navigate to some items/articles.

+browse:news:hackernews,desktop,Load https://news.ycombinator.com and navigate to some items/articles.

+browse:news:nytimes,desktop,The third top website in http://www.alexa.com/topsites/category/News

+browse:news:qq,mobile,Load http://news.qq.com and navigate to some items/articles.

+browse:news:reddit,desktop,The top website in http://www.alexa.com/topsites/category/News

+browse:news:reddit,mobile,The top website in http://www.alexa.com/topsites/category/News

+browse:news:toi,mobile,Load http://m.timesofindia.com and navigate to some items/articles.

+browse:news:washingtonpost,mobile,Progressive website

 browse:search:google,desktop,"
   A typical google search story:
     _ Start at https://www.google.com/search?q=flower
@@ -60,7 +54,7 @@
     _ Click the next page result of 'flower delivery'.
     _ Scroll the search page.
 
-  "
+  "

 browse:search:google_india,desktop,"
   A typical google search story in India:
     1. Start at https://www.google.co.in/search?q=%E0%A4%AB%E0%A5%82%E0%A4%B2`
@@ -71,22 +65,29 @@
     5. Click the next page result
     6. Scroll the search result page.
 
-  "
-browse:shopping:amazon,mobile,Load https://www.amazon.co.in/s/?field-keywords=Mobile and navigate to some items/articles.
-browse:shopping:avito,mobile,Load https://www.avito.ru/rossiya and navigate to some items/articles.
-browse:shopping:flipkart,mobile,Load https://flipkart.com/search?q=Sunglasses and navigate to some items/articles.
-browse:shopping:lazada,mobile,Load https://www.lazada.co.id/catalog/?q=Wrist+watch and navigate to some items/articles.
-browse:social:facebook,mobile,Load https://www.facebook.com/rihanna and navigate to some items/articles.
-browse:social:instagram,mobile,Load https://www.instagram.com/badgalriri/ and navigate to some items/articles.
-browse:social:twitter,desktop,Load https://www.twitter.com/nasa and navigate to some items/articles.
-browse:social:twitter,mobile,Load https://www.twitter.com/nasa and navigate to some items/articles.
+  "

+browse:shopping:amazon,mobile,Load https://www.amazon.co.in/s/?field-keywords=Mobile and navigate to some items/articles.

+browse:shopping:avito,mobile,Load https://www.avito.ru/rossiya and navigate to some items/articles.

+browse:shopping:flipkart,mobile,Load https://flipkart.com/search?q=Sunglasses and navigate to some items/articles.

+browse:shopping:lazada,mobile,Load https://www.lazada.co.id/catalog/?q=Wrist+watch and navigate to some items/articles.

+browse:social:facebook,mobile,Load https://www.facebook.com/rihanna and navigate to some items/articles.

+browse:social:facebook_infinite_scroll,desktop,Load https://www.facebook.com/shakira then make a very long scroll.

+browse:social:facebook_infinite_scroll,mobile,Load https://m.facebook.com/shakira then make a very long scroll.

+browse:social:instagram,mobile,Load https://www.instagram.com/badgalriri/ and navigate to some items/articles.

+browse:social:pinterest_infinite_scroll,mobile,Load https://www.pinterest.com/all then make a very long scroll.

+browse:social:tumblr_infinite_scroll,all,Load http://techcrunch.tumblr.com/ then make a very long scroll.

+browse:social:twitter,desktop,Load https://www.twitter.com/nasa and navigate to some items/articles.

+browse:social:twitter,mobile,Load https://www.twitter.com/nasa and navigate to some items/articles.

+browse:social:twitter_infinite_scroll,desktop,Load https://twitter.com/taylorswift13 then make a very long scroll.

+browse:tech:discourse_infinite_scroll,desktop,Load https://meta.discourse.org/t/the-official-discourse-tags-plugin-discourse-tagging/26482 then make a very long scroll.

+browse:tech:discourse_infinite_scroll,mobile,Load https://meta.discourse.org/t/the-official-discourse-tags-plugin-discourse-tagging/26482 then make a very long scroll.

 browse:tools:earth,desktop,"
   Google Earth story:
     _ Start at https://www.maps.google.com/maps
     _ Click on the Earth link
     _ Click ZoomIn three times, waiting for 3 sec in between.
 
-  "
+  "

 browse:tools:maps,desktop,"
   Google maps story:
     _ Start at https://www.maps.google.com/maps
@@ -94,70 +95,61 @@
     _ Click ZoomIn two times, waiting for 3 sec in between.
     _ Scroll the map horizontally and vertically.
     _ Pick a restaurant and ask for directions.
-  "
+  "

 browse:tools:maps,mobile,"Story that browses google maps mobile page
 
   This story searches for nearby restaurants on google maps website and finds
   directions to a chosen restaurant from search results.
-  "
-load:games:alphabetty,desktop,Load https://king.com/play/alphabetty
-load:games:bubbles,all,"Load ""smarty bubbles"" game on famobi.com"
-load:games:lazors,all,Load http://www8.games.mobi/games/html5/lazors/lazors.html
-load:games:miniclip,desktop,Load http://www.miniclip.com/games/en/
-load:games:spychase,all,Load http://playstar.mobi/games/spychase/index.php
-load:media:9gag,desktop,Load https://www.9gag.com/
-load:media:dailymotion,all,Load https://www.dailymotion.com/video/x489k7d_street-performer-shows-off-slinky-skills_fun?autoplay=false
-load:media:facebook_photos,mobile,Load a page of rihanna's facebook with a photo.
-load:media:flickr,desktop,Load https://www.flickr.com/photos/tags/farm
-load:media:google_images,all,Load https://www.google.co.uk/search?tbm=isch&q=love
-load:media:imgur,all,Load http://imgur.com/gallery/5UlBN
-load:media:soundcloud,all,Load https://soundcloud.com/lifeofdesiigner/desiigner-panda
-load:media:youtube,all,Load https://www.youtube.com/watch?v=QGfhS1hfTWw&autoplay=false
-load:news:bbc,desktop,Load https://www.bbc.co.uk/news/world-asia-china-36189636
-load:news:cnn,all,Load http://edition.cnn.com
-load:news:flipboard,desktop,Load https://flipboard.com/explore
-load:news:hackernews,desktop,Load https://news.ycombinator.com
-load:news:irctc,mobile,Load https://www.irctc.co.in
-load:news:nytimes,desktop,Load http://www.nytimes.com
-load:news:nytimes,mobile,Load http://mobile.nytimes.com
-load:news:qq,all,Load http://news.qq.com
-load:news:reddit,desktop,Load https://www.reddit.com/r/news/top/?sort=top&t=week
-load:news:reddit,mobile,Load https://www.reddit.com/r/news/top/?sort=top&t=week
-load:news:washingtonpost,mobile,Load https://www.washingtonpost.com/pwa
-load:news:wikipedia,all,Load https://en.wikipedia.org/wiki/Science
-load:search:amazon,desktop,Load https://www.amazon.com/s/?field-keywords=nexus
-load:search:baidu,all,Load https://www.baidu.com/s?word=google
-load:search:ebay,all,Load https://www.ebay.com/sch/i.html?_nkw=headphones
-load:search:google,all,Load https://www.google.co.uk/
-load:search:taobao,desktop,Load https://world.taobao.com/
-load:search:taobao,mobile,Load http://m.intl.taobao.com/?ali_trackid
-load:search:yahoo,all,Load https://search.yahoo.com/search;_ylt=?p=google
-load:search:yandex,all,Load https://yandex.ru/touchsearch?text=science
-load:social:facebook,all,Load https://www.facebook.com/rihanna
-load:social:instagram,desktop,Load https://www.instagram.com/selenagomez/
-load:social:pinterest,all,Load https://uk.pinterest.com/categories/popular/
-load:social:tumblr,all,Load https://50thousand.tumblr.com/
-load:social:twitter,all,Load https://www.twitter.com/nasa
-load:social:vk,desktop,Load https://vk.com/sbeatles
-load:tools:docs,all,Load a typical google doc page.
-load:tools:drive,all,Load https://drive.google.com/drive/my-drive
-load:tools:dropbox,all,Load https://www.dropbox.com
-load:tools:gmail,desktop,Load https://mail.google.com/mail/
-load:tools:gmail,mobile,Load https://mail.google.com/mail/
-load:tools:stackoverflow,all,Load a typical question & answer page of stackoverflow.com
-load:tools:weather,all,Load https://weather.com/en-GB/weather/today/l/USCA0286:1:US
-long_running:tools:gmail-background,desktop,Load https://mail.google.com/mail/ then open a new blank tab and let the loaded page stay in background for 100 seconds.
-long_running:tools:gmail-background,mobile,Load https://mail.google.com/mail/ then open a new blank tab and let the loaded page stay in background for 100 seconds.
-long_running:tools:gmail-foreground,desktop,Load https://mail.google.com/mail/ then let it stay in foreground for 100 seconds.
-long_running:tools:gmail-foreground,mobile,Load https://mail.google.com/mail/ then let it stay in foreground for 100 seconds.
-multitab:misc:typical24,desktop,"Load 24 different web sites in 24 tabs, then cycle through each tab."
-play:media:google_play_music,desktop,"Browse the songs list in music.google.com, then play a song."
-play:media:pandora,desktop,"Load pandora.com, then play a song."
-play:media:soundcloud,desktop,"Load soundcloud.com, search for ""Smooth Jazz"", then play a song."
-search:portal:google,all," A typical Google search user story.
-  Issue the search query ""what is science"" in the search box and press Enter.
-  Wait for the search result page to be loaded, then scroll to the Wikipedia
-  result.
-  Navigate to wikipedia page by clicking on the result and wait for it to be
-  fully loaded.
-  "
+  "

+load:chrome:blank,all,Story that loads the about:blank page.

+load:games:alphabetty,desktop,Load https://king.com/play/alphabetty

+load:games:bubbles,all,"Load ""smarty bubbles"" game on famobi.com"

+load:games:lazors,all,Load http://www8.games.mobi/games/html5/lazors/lazors.html

+load:games:miniclip,desktop,Load http://www.miniclip.com/games/en/

+load:games:spychase,all,Load http://playstar.mobi/games/spychase/index.php

+load:media:9gag,desktop,Load https://www.9gag.com/

+load:media:dailymotion,all,Load https://www.dailymotion.com/video/x489k7d_street-performer-shows-off-slinky-skills_fun?autoplay=false

+load:media:facebook_photos,mobile,Load a page of rihanna's facebook with a photo.

+load:media:google_images,all,Load https://www.google.co.uk/search?tbm=isch&q=love

+load:media:imgur,all,Load http://imgur.com/gallery/5UlBN

+load:media:soundcloud,all,Load https://soundcloud.com/lifeofdesiigner/desiigner-panda

+load:media:youtube,all,Load https://www.youtube.com/watch?v=QGfhS1hfTWw&autoplay=false

+load:news:bbc,desktop,Load https://www.bbc.co.uk/news/world-asia-china-36189636

+load:news:cnn,all,Load http://edition.cnn.com

+load:news:flipboard,desktop,Load https://flipboard.com/explore

+load:news:hackernews,desktop,Load https://news.ycombinator.com

+load:news:irctc,mobile,Load https://www.irctc.co.in

+load:news:nytimes,desktop,Load http://www.nytimes.com

+load:news:nytimes,mobile,Load http://mobile.nytimes.com

+load:news:qq,all,Load http://news.qq.com

+load:news:reddit,desktop,Load https://www.reddit.com/r/news/top/?sort=top&t=week

+load:news:reddit,mobile,Load https://www.reddit.com/r/news/top/?sort=top&t=week

+load:news:washingtonpost,mobile,Load https://www.washingtonpost.com/pwa

+load:news:wikipedia,all,Load https://en.wikipedia.org/wiki/Science

+load:search:amazon,desktop,Load https://www.amazon.com/s/?field-keywords=nexus

+load:search:baidu,all,Load https://www.baidu.com/s?word=google

+load:search:ebay,all,Load https://www.ebay.com/sch/i.html?_nkw=headphones

+load:search:google,all,Load https://www.google.co.uk/

+load:search:taobao,desktop,Load https://world.taobao.com/

+load:search:taobao,mobile,Load http://m.intl.taobao.com/?ali_trackid

+load:search:yahoo,all,Load https://search.yahoo.com/search;_ylt=?p=google

+load:search:yandex,all,Load https://yandex.ru/touchsearch?text=science

+load:social:instagram,desktop,Load https://www.instagram.com/selenagomez/

+load:social:pinterest,desktop,Load https://uk.pinterest.com/categories/popular/

+load:social:twitter,mobile,Load https://www.twitter.com/nasa

+load:social:vk,desktop,Load https://vk.com/sbeatles

+load:tools:docs,all,Load a typical google doc page.

+load:tools:drive,all,Load https://drive.google.com/drive/my-drive

+load:tools:dropbox,all,Load https://www.dropbox.com

+load:tools:gmail,desktop,Load https://mail.google.com/mail/

+load:tools:gmail,mobile,Load https://mail.google.com/mail/

+load:tools:stackoverflow,all,Load a typical question & answer page of stackoverflow.com

+load:tools:weather,all,Load https://weather.com/en-GB/weather/today/l/USCA0286:1:US

+long_running:tools:gmail-background,desktop,Load https://mail.google.com/mail/ then open a new blank tab and let the loaded page stay in background for 100 seconds.

+long_running:tools:gmail-background,mobile,Load https://mail.google.com/mail/ then open a new blank tab and let the loaded page stay in background for 100 seconds.

+long_running:tools:gmail-foreground,desktop,Load https://mail.google.com/mail/ then let it stay in foreground for 100 seconds.

+long_running:tools:gmail-foreground,mobile,Load https://mail.google.com/mail/ then let it stay in foreground for 100 seconds.

+multitab:misc:typical24,desktop,"Load 24 different web sites in 24 tabs, then cycle through each tab."

+play:media:google_play_music,desktop,"Browse the songs list in music.google.com, then play a song."

+play:media:pandora,desktop,"Load pandora.com, then play a song."

+play:media:soundcloud,desktop,"Load soundcloud.com, search for ""Smooth Jazz"", then play a song."

diff --git a/ui/app_list/views/app_list_folder_view.h b/ui/app_list/views/app_list_folder_view.h
index 6da2b8c..7698cec 100644
--- a/ui/app_list/views/app_list_folder_view.h
+++ b/ui/app_list/views/app_list_folder_view.h
@@ -72,6 +72,8 @@
 
   AppsGridView* items_grid_view() { return items_grid_view_; }
 
+  FolderHeaderView* folder_header_view() { return folder_header_view_; }
+
  private:
   void CalculateIdealBounds();
 
diff --git a/ui/app_list/views/app_list_view.cc b/ui/app_list/views/app_list_view.cc
index c041c896..937d24f0 100644
--- a/ui/app_list/views/app_list_view.cc
+++ b/ui/app_list/views/app_list_view.cc
@@ -230,6 +230,7 @@
       short_animations_for_testing_(false),
       is_fullscreen_app_list_enabled_(features::IsFullscreenAppListEnabled()),
       is_background_blur_enabled_(features::IsBackgroundBlurEnabled()),
+      is_app_list_focus_enabled_(features::IsAppListFocusEnabled()),
       display_observer_(this),
       animation_observer_(new HideViewAnimationObserver()) {
   CHECK(delegate);
@@ -1031,6 +1032,32 @@
   node_data->role = ui::AX_ROLE_DESKTOP;
 }
 
+void AppListView::OnKeyEvent(ui::KeyEvent* event) {
+  views::Textfield* search_box = search_box_view_->search_box();
+  bool is_search_box_focused = search_box->HasFocus();
+  bool is_folder_header_view_focused = app_list_main_view_->contents_view()
+                                           ->apps_container_view()
+                                           ->app_list_folder_view()
+                                           ->folder_header_view()
+                                           ->HasTextFocus();
+  if (is_app_list_focus_enabled_ && !is_search_box_focused &&
+      !is_folder_header_view_focused) {
+    views::Textfield* search_box = search_box_view_->search_box();
+    // Redirect key event to |search_box_|.
+    search_box->OnKeyEvent(event);
+    if (event->handled()) {
+      // Set search box focused if the key event is consumed.
+      search_box->RequestFocus();
+      return;
+    }
+    if (event->type() == ui::ET_KEY_PRESSED) {
+      // Insert it into search box if the key event is a character. Released
+      // key should not be handled to prevent inserting duplicate character.
+      search_box->InsertChar(*event);
+    }
+  }
+}
+
 void AppListView::OnTabletModeChanged(bool started) {
   is_tablet_mode_ = started;
   search_box_view_->OnTabletModeChanged(started);
@@ -1259,14 +1286,16 @@
 
 void AppListView::UpdateYPositionAndOpacity(int y_position_in_screen,
                                             float background_opacity) {
+  DCHECK(!is_side_shelf_);
   if (app_list_state_ == CLOSED)
     return;
 
   SetIsInDrag(true);
   background_opacity_ = background_opacity;
   gfx::Rect new_widget_bounds = fullscreen_widget_->GetWindowBoundsInScreen();
-  app_list_y_position_in_screen_ =
-      std::max(y_position_in_screen, GetDisplayNearestView().bounds().y());
+  app_list_y_position_in_screen_ = std::min(
+      std::max(y_position_in_screen, GetDisplayNearestView().bounds().y()),
+      GetDisplayNearestView().bounds().bottom() - kShelfSize);
   new_widget_bounds.set_y(app_list_y_position_in_screen_);
   gfx::NativeView native_view = fullscreen_widget_->GetNativeView();
   ::wm::ConvertRectFromScreen(native_view->parent(), &new_widget_bounds);
diff --git a/ui/app_list/views/app_list_view.h b/ui/app_list/views/app_list_view.h
index 67fffd1f..b2e999c3 100644
--- a/ui/app_list/views/app_list_view.h
+++ b/ui/app_list/views/app_list_view.h
@@ -138,6 +138,7 @@
   void Layout() override;
   void SchedulePaintInRect(const gfx::Rect& rect) override;
   void GetAccessibleNodeData(ui::AXNodeData* node_data) override;
+  void OnKeyEvent(ui::KeyEvent* event) override;
 
   // Overridden from ui::EventHandler:
   void OnScrollEvent(ui::ScrollEvent* event) override;
@@ -343,6 +344,8 @@
   const bool is_fullscreen_app_list_enabled_;
   // Whether the background blur is enabled.
   const bool is_background_blur_enabled_;
+  // Whether the app list focus is enabled.
+  const bool is_app_list_focus_enabled_;
   // The state of the app list, controlled via SetState().
   AppListState app_list_state_ = PEEKING;
   // An observer that notifies AppListView when the display has changed.
diff --git a/ui/app_list/views/app_list_view_unittest.cc b/ui/app_list/views/app_list_view_unittest.cc
index 6d539dfa..7e11f97 100644
--- a/ui/app_list/views/app_list_view_unittest.cc
+++ b/ui/app_list/views/app_list_view_unittest.cc
@@ -373,7 +373,7 @@
     for (const auto& data : result_types) {
       // Set the relevance of the results in each group in decreasing order (so
       // the earlier groups have higher relevance, and therefore appear first).
-      relevance -= 1.0;
+      relevance -= 0.5;
       for (int i = 0; i < data.second; ++i) {
         std::unique_ptr<TestSearchResult> result =
             base::MakeUnique<TestSearchResult>();
@@ -387,6 +387,17 @@
     RunPendingMessages();
   }
 
+  int GetOpenFirstSearchResultCount() {
+    std::map<size_t, int>& counts = delegate_->open_search_result_counts();
+    if (counts.size() == 0)
+      return 0;
+    return counts[0];
+  }
+
+  int GetTotalOpenSearchResultCount() {
+    return delegate_->open_search_result_count();
+  }
+
   AppListView* app_list_view() { return view_; }
 
   AppListMainView* main_view() { return view_->app_list_main_view(); }
@@ -548,6 +559,100 @@
   EXPECT_EQ(search_box_view()->search_box(), focused_view());
 }
 
+// Tests that key event which is not handled by focused view will be redirected
+// to search box.
+TEST_F(AppListViewFocusTest, RedirectFocusToSearchBox) {
+  Show();
+
+  // Set focus to first suggestion app and type a character.
+  suggestions_container_view()->tile_views()[0]->RequestFocus();
+  SimulateKeyPress(ui::VKEY_SPACE, false);
+  EXPECT_EQ(search_box_view()->search_box(), focused_view());
+  EXPECT_EQ(search_box_view()->search_box()->text(), base::UTF8ToUTF16(" "));
+
+  // Set focus to expand arrow and type a character.
+  apps_grid_view()->expand_arrow_view_for_test()->RequestFocus();
+  SimulateKeyPress(ui::VKEY_A, false);
+  EXPECT_EQ(search_box_view()->search_box(), focused_view());
+  EXPECT_EQ(search_box_view()->search_box()->text(), base::UTF8ToUTF16(" a"));
+
+  // Set focus to close button and type a character.
+  search_box_view()->close_button()->RequestFocus();
+  SimulateKeyPress(ui::VKEY_B, false);
+  EXPECT_EQ(search_box_view()->search_box(), focused_view());
+  EXPECT_EQ(search_box_view()->search_box()->text(), base::UTF8ToUTF16(" ab"));
+
+  // Set focus to close button and hitting backspace.
+  search_box_view()->close_button()->RequestFocus();
+  SimulateKeyPress(ui::VKEY_BACK, false);
+  EXPECT_EQ(search_box_view()->search_box(), focused_view());
+  EXPECT_EQ(search_box_view()->search_box()->text(), base::UTF8ToUTF16(" a"));
+}
+
+// Tests that the first search result's view is always selected after search
+// results are updated, but the focus is always on search box.
+TEST_F(AppListViewFocusTest, FirstResultSelectedAfterSearchResultsUpdated) {
+  Show();
+
+  // Type something in search box to transition to HALF state and populate
+  // fake list results.
+  search_box_view()->search_box()->InsertText(base::UTF8ToUTF16("test"));
+  const int kListResults = 2;
+  SetUpSearchResults(0, kListResults);
+  const views::View* results_container =
+      contents_view()
+          ->search_result_list_view_for_test()
+          ->results_container_for_test();
+  EXPECT_EQ(search_box_view()->search_box(), focused_view());
+  EXPECT_EQ(results_container->child_at(0),
+            contents_view()->search_results_page_view()->first_result_view());
+
+  // Populate both fake list results and tile results.
+  const int kTileResults = 3;
+  SetUpSearchResults(kTileResults, kListResults);
+  const std::vector<SearchResultTileItemView*>& tile_views =
+      contents_view()
+          ->search_result_tile_item_list_view_for_test()
+          ->tile_views_for_test();
+  EXPECT_EQ(search_box_view()->search_box(), focused_view());
+  EXPECT_EQ(tile_views[0],
+            contents_view()->search_results_page_view()->first_result_view());
+
+  // Clear up all search results.
+  SetUpSearchResults(0, 0);
+  EXPECT_EQ(search_box_view()->search_box(), focused_view());
+  EXPECT_EQ(nullptr,
+            contents_view()->search_results_page_view()->first_result_view());
+}
+
+// Tests that hitting Enter key when focus is on search box opens the first
+// result when it exists.
+TEST_F(AppListViewFocusTest, HittingEnterWhenFocusOnSearchBox) {
+  Show();
+
+  // Type something in search box to transition to HALF state and populate
+  // fake list results. Then hit Enter key.
+  search_box_view()->search_box()->InsertText(base::UTF8ToUTF16("test"));
+  const int kListResults = 2;
+  SetUpSearchResults(0, kListResults);
+  SimulateKeyPress(ui::VKEY_RETURN, false);
+  EXPECT_EQ(1, GetOpenFirstSearchResultCount());
+  EXPECT_EQ(1, GetTotalOpenSearchResultCount());
+
+  // Populate both fake list results and tile results. Then hit Enter key.
+  const int kTileResults = 3;
+  SetUpSearchResults(kTileResults, kListResults);
+  SimulateKeyPress(ui::VKEY_RETURN, false);
+  EXPECT_EQ(2, GetOpenFirstSearchResultCount());
+  EXPECT_EQ(2, GetTotalOpenSearchResultCount());
+
+  // Clear up all search results. Then hit Enter key.
+  SetUpSearchResults(0, 0);
+  SimulateKeyPress(ui::VKEY_RETURN, false);
+  EXPECT_EQ(2, GetOpenFirstSearchResultCount());
+  EXPECT_EQ(2, GetTotalOpenSearchResultCount());
+}
+
 // Tests that opening the app list opens in peeking mode by default.
 TEST_F(AppListViewFullscreenTest, ShowPeekingByDefault) {
   Initialize(0, false, false);
diff --git a/ui/app_list/views/search_box_view.cc b/ui/app_list/views/search_box_view.cc
index 05a22b7eb..11ea4a1 100644
--- a/ui/app_list/views/search_box_view.cc
+++ b/ui/app_list/views/search_box_view.cc
@@ -657,6 +657,10 @@
   HandleSearchBoxEvent(event);
 }
 
+void SearchBoxView::OnKeyEvent(ui::KeyEvent* event) {
+  app_list_view_->OnKeyEvent(event);
+}
+
 void SearchBoxView::ButtonPressed(views::Button* sender,
                                   const ui::Event& event) {
   if (back_button_ && sender == back_button_) {
@@ -773,9 +777,10 @@
           kSearchBoxBorderWidth, kSearchBoxFocusBorderCornerRadius,
           kSearchBoxBorderColor));
     }
-    if (!search_box_->text().empty()) {
+    if (!is_app_list_focus_enabled_ && !search_box_->text().empty()) {
       // If query is not empty (including a string of spaces), we need to select
-      // the entire text range.
+      // the entire text range. When app list focus flag is enabled, query is
+      // automatically selected all when search box is focused.
       search_box_->SelectAll(false);
     }
   } else {
@@ -800,6 +805,10 @@
 
 void SearchBoxView::ContentsChanged(views::Textfield* sender,
                                     const base::string16& new_contents) {
+  if (is_app_list_focus_enabled_) {
+    // Set search box focused when query changes.
+    search_box_->RequestFocus();
+  }
   UpdateModel();
   view_delegate_->AutoLaunchCanceled();
   NotifyQueryChanged();
@@ -819,6 +828,18 @@
 bool SearchBoxView::HandleKeyEvent(views::Textfield* sender,
                                    const ui::KeyEvent& key_event) {
   if (is_app_list_focus_enabled_) {
+    if (key_event.type() == ui::ET_KEY_PRESSED &&
+        key_event.key_code() == ui::VKEY_RETURN &&
+        !IsSearchBoxTrimmedQueryEmpty()) {
+      // Hitting Enter when focus is on search box opens the first result.
+      ui::KeyEvent event(key_event);
+      views::View* first_result_view =
+          static_cast<ContentsView*>(contents_view_)
+              ->search_results_page_view()
+              ->first_result_view();
+      if (first_result_view)
+        first_result_view->OnKeyEvent(&event);
+    }
     // TODO(weidongg/766807) Remove this function when the flag is enabled by
     // default.
     return false;
diff --git a/ui/app_list/views/search_box_view.h b/ui/app_list/views/search_box_view.h
index a4ef1914..b64c846 100644
--- a/ui/app_list/views/search_box_view.h
+++ b/ui/app_list/views/search_box_view.h
@@ -117,6 +117,7 @@
   const char* GetClassName() const override;
   void OnGestureEvent(ui::GestureEvent* event) override;
   void OnMouseEvent(ui::MouseEvent* event) override;
+  void OnKeyEvent(ui::KeyEvent* evetn) override;
 
   // Overridden from views::ButtonListener:
   void ButtonPressed(views::Button* sender, const ui::Event& event) override;
diff --git a/ui/app_list/views/search_result_answer_card_view.cc b/ui/app_list/views/search_result_answer_card_view.cc
index 7aa2228..2531b7e 100644
--- a/ui/app_list/views/search_result_answer_card_view.cc
+++ b/ui/app_list/views/search_result_answer_card_view.cc
@@ -199,4 +199,9 @@
              : nullptr;
 }
 
+views::View* SearchResultAnswerCardView::SetFirstResultSelected(bool selected) {
+  search_answer_container_view_->SetSelected(selected);
+  return search_answer_container_view_;
+}
+
 }  // namespace app_list
diff --git a/ui/app_list/views/search_result_answer_card_view.h b/ui/app_list/views/search_result_answer_card_view.h
index e8eb9b8..e2ee64e 100644
--- a/ui/app_list/views/search_result_answer_card_view.h
+++ b/ui/app_list/views/search_result_answer_card_view.h
@@ -30,6 +30,7 @@
   void UpdateSelectedIndex(int old_selected, int new_selected) override;
   bool OnKeyPressed(const ui::KeyEvent& event) override;
   views::View* GetSelectedView() const override;
+  views::View* SetFirstResultSelected(bool selected) override;
 
  private:
   class SearchAnswerContainerView;
diff --git a/ui/app_list/views/search_result_container_view.h b/ui/app_list/views/search_result_container_view.h
index b4c50d8a..c8d6fc4 100644
--- a/ui/app_list/views/search_result_container_view.h
+++ b/ui/app_list/views/search_result_container_view.h
@@ -87,6 +87,10 @@
   // Returns selected view in this container view.
   virtual views::View* GetSelectedView() const = 0;
 
+  // Sets the first result in this container view selected/unselected. Returns
+  // the result's view.
+  virtual views::View* SetFirstResultSelected(bool selected) = 0;
+
  private:
   // Schedules an Update call using |update_factory_|. Do nothing if there is a
   // pending call.
diff --git a/ui/app_list/views/search_result_list_view.cc b/ui/app_list/views/search_result_list_view.cc
index 71626c7..475ec552 100644
--- a/ui/app_list/views/search_result_list_view.cc
+++ b/ui/app_list/views/search_result_list_view.cc
@@ -177,6 +177,16 @@
              : nullptr;
 }
 
+views::View* SearchResultListView::SetFirstResultSelected(bool selected) {
+  DCHECK(results_container_->has_children());
+  if (num_results() <= 0)
+    return nullptr;
+  SearchResultView* search_result_view =
+      static_cast<SearchResultView*>(results_container_->child_at(0));
+  search_result_view->SetSelected(selected);
+  return search_result_view;
+}
+
 int SearchResultListView::DoUpdate() {
   std::vector<SearchResult*> display_results =
       AppListModel::FilterSearchResultsByDisplayType(
diff --git a/ui/app_list/views/search_result_list_view.h b/ui/app_list/views/search_result_list_view.h
index 17e135bc..98da754 100644
--- a/ui/app_list/views/search_result_list_view.h
+++ b/ui/app_list/views/search_result_list_view.h
@@ -60,6 +60,7 @@
   void NotifyFirstResultYIndex(int y_index) override;
   int GetYSize() override;
   views::View* GetSelectedView() const override;
+  views::View* SetFirstResultSelected(bool selected) override;
 
   views::View* results_container_for_test() const { return results_container_; }
 
diff --git a/ui/app_list/views/search_result_page_view.cc b/ui/app_list/views/search_result_page_view.cc
index d66dc289..f9c9263 100644
--- a/ui/app_list/views/search_result_page_view.cc
+++ b/ui/app_list/views/search_result_page_view.cc
@@ -310,28 +310,7 @@
   return index >= 0 && index < static_cast<int>(result_container_views_.size());
 }
 
-void SearchResultPageView::OnSearchResultContainerResultsChanged() {
-  DCHECK(!result_container_views_.empty());
-  if (is_fullscreen_app_list_enabled_)
-    DCHECK(result_container_views_.size() == separators_.size() + 1);
-
-  // Only sort and layout the containers when they have all updated.
-  for (SearchResultContainerView* view : result_container_views_) {
-    if (view->UpdateScheduled()) {
-      return;
-    }
-  }
-
-  SearchResultContainerView* old_selection =
-      HasSelection() ? result_container_views_[selected_index_] : nullptr;
-
-  // Truncate the currently selected container's selection if necessary. If
-  // there are no results, the selection will be cleared below.
-  if (old_selection && old_selection->num_results() > 0 &&
-      old_selection->selected_index() >= old_selection->num_results()) {
-    old_selection->SetSelectedIndex(old_selection->num_results() - 1);
-  }
-
+void SearchResultPageView::ReorderSearchResultContainers() {
   // Sort the result container views by their score.
   std::sort(result_container_views_.begin(), result_container_views_.end(),
             [](const SearchResultContainerView* a,
@@ -365,6 +344,47 @@
   }
 
   Layout();
+}
+
+void SearchResultPageView::OnSearchResultContainerResultsChanged() {
+  DCHECK(!result_container_views_.empty());
+  if (is_fullscreen_app_list_enabled_)
+    DCHECK(result_container_views_.size() == separators_.size() + 1);
+
+  // Only sort and layout the containers when they have all updated.
+  for (SearchResultContainerView* view : result_container_views_) {
+    if (view->UpdateScheduled()) {
+      return;
+    }
+  }
+
+  if (is_app_list_focus_enabled_) {
+    if (result_container_views_.empty())
+      return;
+    // Set the first result (if it exists) selected when search results are
+    // updated. Note that the focus is not set on the first result to prevent
+    // frequent focus switch between search box and first result during typing
+    // query.
+    SearchResultContainerView* old_first_container_view =
+        result_container_views_[0];
+    ReorderSearchResultContainers();
+    old_first_container_view->SetFirstResultSelected(false);
+    first_result_view_ =
+        result_container_views_[0]->SetFirstResultSelected(true);
+    return;
+  }
+
+  SearchResultContainerView* old_selection =
+      HasSelection() ? result_container_views_[selected_index_] : nullptr;
+
+  // Truncate the currently selected container's selection if necessary. If
+  // there are no results, the selection will be cleared below.
+  if (old_selection && old_selection->num_results() > 0 &&
+      old_selection->selected_index() >= old_selection->num_results()) {
+    old_selection->SetSelectedIndex(old_selection->num_results() - 1);
+  }
+
+  ReorderSearchResultContainers();
 
   SearchResultContainerView* new_selection = nullptr;
   if (HasSelection() &&
diff --git a/ui/app_list/views/search_result_page_view.h b/ui/app_list/views/search_result_page_view.h
index 09e2e3d..48fd670 100644
--- a/ui/app_list/views/search_result_page_view.h
+++ b/ui/app_list/views/search_result_page_view.h
@@ -58,6 +58,8 @@
 
   views::View* contents_view() { return contents_view_; }
 
+  views::View* first_result_view() const { return first_result_view_; }
+
  private:
   // Separator between SearchResultContainerView.
   class HorizontalSeparator;
@@ -67,6 +69,9 @@
   void SetSelectedIndex(int index, bool directional_movement);
   bool IsValidSelectionIndex(int index);
 
+  // Sort the result container views.
+  void ReorderSearchResultContainers();
+
   // The SearchResultContainerViews that compose the search page. All owned by
   // the views hierarchy.
   std::vector<SearchResultContainerView*> result_container_views_;
@@ -84,6 +89,9 @@
   // View containing SearchCardView instances. Owned by view hierarchy.
   views::View* const contents_view_;
 
+  // The first search result's view or nullptr if there's no search result.
+  views::View* first_result_view_ = nullptr;
+
   DISALLOW_COPY_AND_ASSIGN(SearchResultPageView);
 };
 
diff --git a/ui/app_list/views/search_result_tile_item_list_view.cc b/ui/app_list/views/search_result_tile_item_list_view.cc
index ed9e92e4..cbe751b0 100644
--- a/ui/app_list/views/search_result_tile_item_list_view.cc
+++ b/ui/app_list/views/search_result_tile_item_list_view.cc
@@ -119,6 +119,15 @@
                                                  : nullptr;
 }
 
+views::View* SearchResultTileItemListView::SetFirstResultSelected(
+    bool selected) {
+  DCHECK(!tile_views_.empty());
+  if (num_results() <= 0)
+    return nullptr;
+  tile_views_[0]->SetSelected(selected);
+  return tile_views_[0];
+}
+
 int SearchResultTileItemListView::DoUpdate() {
   std::vector<SearchResult*> display_results =
       AppListModel::FilterSearchResultsByDisplayType(
diff --git a/ui/app_list/views/search_result_tile_item_list_view.h b/ui/app_list/views/search_result_tile_item_list_view.h
index 82dd4158..a968310 100644
--- a/ui/app_list/views/search_result_tile_item_list_view.h
+++ b/ui/app_list/views/search_result_tile_item_list_view.h
@@ -34,6 +34,7 @@
   void NotifyFirstResultYIndex(int y_index) override;
   int GetYSize() override;
   views::View* GetSelectedView() const override;
+  views::View* SetFirstResultSelected(bool selected) override;
 
   // Overridden from views::View:
   bool OnKeyPressed(const ui::KeyEvent& event) override;
diff --git a/ui/app_list/views/search_result_view.cc b/ui/app_list/views/search_result_view.cc
index 2fccad89..a84ea60 100644
--- a/ui/app_list/views/search_result_view.cc
+++ b/ui/app_list/views/search_result_view.cc
@@ -182,6 +182,13 @@
   return accessible_name;
 }
 
+void SearchResultView::SetSelected(bool selected) {
+  if (selected_ == selected)
+    return;
+  selected_ = selected;
+  SchedulePaint();
+}
+
 void SearchResultView::UpdateAccessibleName() {
   SetAccessibleName(ComputeAccessibleName());
 }
@@ -507,13 +514,6 @@
   list_view_->SearchResultActionActivated(this, index, event_flags);
 }
 
-void SearchResultView::SetSelected(bool selected) {
-  if (selected_ == selected)
-    return;
-  selected_ = selected;
-  SchedulePaint();
-}
-
 void SearchResultView::ShowContextMenuForView(views::View* source,
                                               const gfx::Point& point,
                                               ui::MenuSourceType source_type) {
diff --git a/ui/app_list/views/search_result_view.h b/ui/app_list/views/search_result_view.h
index 49129ee..171d741 100644
--- a/ui/app_list/views/search_result_view.h
+++ b/ui/app_list/views/search_result_view.h
@@ -67,6 +67,9 @@
 
   void set_is_last_result(bool is_last) { is_last_result_ = is_last; }
 
+  void SetSelected(bool selected);
+  bool selected() const { return selected_; }
+
  private:
   friend class app_list::test::SearchResultListViewTest;
 
@@ -111,9 +114,6 @@
   // SearchResultActionsViewDelegate overrides:
   void OnSearchResultActionActivated(size_t index, int event_flags) override;
 
-  void SetSelected(bool selected);
-  bool selected() const { return selected_; }
-
   SearchResult* result_ = nullptr;  // Owned by AppListModel::SearchResults.
 
   bool is_last_result_ = false;
diff --git a/ui/app_list/views/suggestions_container_view.cc b/ui/app_list/views/suggestions_container_view.cc
index e2c2908..2660f8bd 100644
--- a/ui/app_list/views/suggestions_container_view.cc
+++ b/ui/app_list/views/suggestions_container_view.cc
@@ -138,6 +138,10 @@
              : nullptr;
 }
 
+views::View* SuggestionsContainerView::SetFirstResultSelected(bool selected) {
+  return nullptr;
+}
+
 void SuggestionsContainerView::CreateAppsGrid(int apps_num) {
   DCHECK(search_result_tile_views_.empty());
   views::GridLayout* tiles_layout_manager =
diff --git a/ui/app_list/views/suggestions_container_view.h b/ui/app_list/views/suggestions_container_view.h
index 8f62aa9..01cfa7fc 100644
--- a/ui/app_list/views/suggestions_container_view.h
+++ b/ui/app_list/views/suggestions_container_view.h
@@ -43,6 +43,7 @@
   void NotifyFirstResultYIndex(int y_index) override;
   int GetYSize() override;
   views::View* GetSelectedView() const override;
+  views::View* SetFirstResultSelected(bool selected) override;
 
  private:
   void CreateAppsGrid(int apps_num);
diff --git a/ui/base/cursor/ozone/cursor_data_factory_ozone.cc b/ui/base/cursor/ozone/cursor_data_factory_ozone.cc
index 3bcaf00..72df892d 100644
--- a/ui/base/cursor/ozone/cursor_data_factory_ozone.cc
+++ b/ui/base/cursor/ozone/cursor_data_factory_ozone.cc
@@ -97,7 +97,7 @@
     // We hold a ref forever because clients do not do refcounting for default
     // cursors.
     scoped_refptr<CursorDataOzone> cursor =
-        make_scoped_refptr(new CursorDataOzone(ui::CursorData(type)));
+        base::MakeRefCounted<CursorDataOzone>(ui::CursorData(type));
     default_cursors_[type] = std::move(cursor);
   }
 
diff --git a/ui/compositor/layer.cc b/ui/compositor/layer.cc
index 08dc98b..0e46f3ea 100644
--- a/ui/compositor/layer.cc
+++ b/ui/compositor/layer.cc
@@ -976,7 +976,7 @@
   gfx::Rect invalidation(
       gfx::IntersectRects(paint_region_.bounds(), local_bounds));
   paint_region_.Clear();
-  auto display_list = make_scoped_refptr(new cc::DisplayItemList);
+  auto display_list = base::MakeRefCounted<cc::DisplayItemList>();
   if (delegate_) {
     delegate_->OnPaintLayer(PaintContext(display_list.get(),
                                          device_scale_factor_, invalidation,
diff --git a/ui/display/manager/chromeos/touch_transform_controller_unittest.cc b/ui/display/manager/chromeos/touch_transform_controller_unittest.cc
index 2860c0855..cb707cc 100644
--- a/ui/display/manager/chromeos/touch_transform_controller_unittest.cc
+++ b/ui/display/manager/chromeos/touch_transform_controller_unittest.cc
@@ -715,12 +715,12 @@
 
   ManagedDisplayInfo::ManagedDisplayModeList internal_modes;
 
-  internal_modes.push_back(make_scoped_refptr(new ManagedDisplayMode(
+  internal_modes.push_back(base::MakeRefCounted<ManagedDisplayMode>(
       gfx::Size(kNativeDisplaySize.width(), kNativeDisplaySize.height()), 60,
-      false, true)));
-  internal_modes.push_back(make_scoped_refptr(new ManagedDisplayMode(
+      false, true));
+  internal_modes.push_back(base::MakeRefCounted<ManagedDisplayMode>(
       gfx::Size(kDisplaySize.width(), kDisplaySize.height()), 60, false,
-      false)));
+      false));
   internal_display_info.SetManagedDisplayModes(internal_modes);
 
   ui::TouchscreenDevice internal_touchscreen =
@@ -788,12 +788,12 @@
 
   ManagedDisplayInfo::ManagedDisplayModeList internal_modes;
 
-  internal_modes.push_back(make_scoped_refptr(new ManagedDisplayMode(
+  internal_modes.push_back(base::MakeRefCounted<ManagedDisplayMode>(
       gfx::Size(kNativeDisplaySize.width(), kNativeDisplaySize.height()), 60,
-      false, true)));
-  internal_modes.push_back(make_scoped_refptr(new ManagedDisplayMode(
+      false, true));
+  internal_modes.push_back(base::MakeRefCounted<ManagedDisplayMode>(
       gfx::Size(kDisplaySize.width(), kDisplaySize.height()), 60, false,
-      false)));
+      false));
   internal_display_info.SetManagedDisplayModes(internal_modes);
 
   ui::TouchscreenDevice internal_touchscreen =
diff --git a/ui/display/manager/display_manager.cc b/ui/display/manager/display_manager.cc
index b0ffb63c..e9de71e 100644
--- a/ui/display/manager/display_manager.cc
+++ b/ui/display/manager/display_manager.cc
@@ -1280,9 +1280,9 @@
           });
 
       scoped_refptr<ManagedDisplayMode> dm(*iter);
-      *iter = make_scoped_refptr(new ManagedDisplayMode(
+      *iter = base::MakeRefCounted<ManagedDisplayMode>(
           dm->size(), dm->refresh_rate(), dm->is_interlaced(),
-          true /* native */, dm->ui_scale(), dm->device_scale_factor()));
+          true /* native */, dm->ui_scale(), dm->device_scale_factor());
 
       info.SetManagedDisplayModes(modes);
       info.set_device_scale_factor(dm->device_scale_factor());
diff --git a/ui/ozone/platform/cast/surface_factory_cast.cc b/ui/ozone/platform/cast/surface_factory_cast.cc
index 522a837c..28bd060 100644
--- a/ui/ozone/platform/cast/surface_factory_cast.cc
+++ b/ui/ozone/platform/cast/surface_factory_cast.cc
@@ -132,7 +132,7 @@
     gfx::Size size,
     gfx::BufferFormat format,
     gfx::BufferUsage usage) {
-  return make_scoped_refptr(new CastPixmap(egl_implementation_.get()));
+  return base::MakeRefCounted<CastPixmap>(egl_implementation_.get());
 }
 
 }  // namespace ui
diff --git a/ui/ozone/platform/drm/gpu/gbm_surface_factory.cc b/ui/ozone/platform/drm/gpu/gbm_surface_factory.cc
index 7560a33..a347c94 100644
--- a/ui/ozone/platform/drm/gpu/gbm_surface_factory.cc
+++ b/ui/ozone/platform/drm/gpu/gbm_surface_factory.cc
@@ -156,7 +156,7 @@
   if (!buffer.get())
     return nullptr;
 
-  return make_scoped_refptr(new GbmPixmap(this, buffer));
+  return base::MakeRefCounted<GbmPixmap>(this, buffer);
 }
 
 scoped_refptr<gfx::NativePixmap>
@@ -185,7 +185,7 @@
       widget, size, format, std::move(scoped_fds), planes);
   if (!buffer)
     return nullptr;
-  return make_scoped_refptr(new GbmPixmap(this, buffer));
+  return base::MakeRefCounted<GbmPixmap>(this, buffer);
 }
 
 }  // namespace ui